about summary refs log tree commit diff
path: root/pkgs/os-specific
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/os-specific')
-rw-r--r--pkgs/os-specific/bsd/netbsd/default.nix197
-rw-r--r--pkgs/os-specific/bsd/netbsd/no-dynamic-linker.patch16
-rw-r--r--pkgs/os-specific/darwin/DarwinTools/default.nix6
-rw-r--r--pkgs/os-specific/darwin/DarwinTools/sw_vers-CFPriv.patch19
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix151
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/cf-setup-hook.sh6
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/default.nix58
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix193
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix78
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/libcharset.nix16
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/libnetwork.nix20
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix21
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/libunwind.nix24
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix17
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/CarbonHeaders/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/CommonCrypto/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix7
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/ICU/default.nix38
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libc/825_40_1.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libinfo/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libnotify/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix24
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix5
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/architecture/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix15
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/configd/default.nix148
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/copyfile/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/default.nix22
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix7
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/dyld/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/eap8021x/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/launchd/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libclosure/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libplatform/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libpthread/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libresolv/default.nix67
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/ppp/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/removefile/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix9
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix20
-rw-r--r--pkgs/os-specific/darwin/binutils/default.nix1
-rw-r--r--pkgs/os-specific/darwin/cctools/port.nix4
-rw-r--r--pkgs/os-specific/darwin/darwin-stubs/default.nix4
-rw-r--r--pkgs/os-specific/darwin/libtapi/default.nix40
-rw-r--r--pkgs/os-specific/darwin/libtapi/disable-rpath.patch14
-rw-r--r--pkgs/os-specific/darwin/libtapi/native-clang-tblgen.patch21
-rw-r--r--pkgs/os-specific/darwin/print-reexports/default.nix (renamed from pkgs/os-specific/darwin/apple-sdk/print-reexports/default.nix)4
-rw-r--r--pkgs/os-specific/darwin/print-reexports/main.c (renamed from pkgs/os-specific/darwin/apple-sdk/print-reexports/main.c)81
-rw-r--r--pkgs/os-specific/darwin/print-reexports/setup-hook.sh19
-rw-r--r--pkgs/os-specific/darwin/rewrite-tbd/default.nix16
-rw-r--r--pkgs/os-specific/darwin/signing-utils/auto-sign-hook.sh20
-rw-r--r--pkgs/os-specific/darwin/signing-utils/default.nix24
-rw-r--r--pkgs/os-specific/darwin/signing-utils/utils.sh43
-rw-r--r--pkgs/os-specific/darwin/sigtool/default.nix24
-rw-r--r--pkgs/os-specific/darwin/xcode/sdk-pkgs.nix1
-rw-r--r--pkgs/os-specific/linux/bionic-prebuilt/default.nix113
-rw-r--r--pkgs/os-specific/linux/bionic-prebuilt/ndk-version.patch42
-rw-r--r--pkgs/os-specific/linux/catfs/default.nix2
-rw-r--r--pkgs/os-specific/linux/dlm/default.nix2
-rw-r--r--pkgs/os-specific/linux/dpdk/default.nix2
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-manager/default.nix2
-rw-r--r--pkgs/os-specific/linux/firmware/system76-firmware/default.nix2
-rw-r--r--pkgs/os-specific/linux/fuse/common.nix2
-rw-r--r--pkgs/os-specific/linux/greetd/default.nix2
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix6
-rw-r--r--pkgs/os-specific/linux/kernel-headers/default.nix20
-rw-r--r--pkgs/os-specific/linux/kernel/generate-config.pl2
-rw-r--r--pkgs/os-specific/linux/kernel/generic.nix10
-rw-r--r--pkgs/os-specific/linux/kernel/linux-xanmod.nix6
-rw-r--r--pkgs/os-specific/linux/libcgroup/default.nix23
-rw-r--r--pkgs/os-specific/linux/libsepol/default.nix7
-rw-r--r--pkgs/os-specific/linux/lvm2/default.nix4
-rw-r--r--pkgs/os-specific/linux/miraclecast/default.nix2
-rw-r--r--pkgs/os-specific/linux/swapview/default.nix2
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix2
-rw-r--r--pkgs/os-specific/linux/tuigreet/default.nix2
-rw-r--r--pkgs/os-specific/linux/wlgreet/default.nix2
-rw-r--r--pkgs/os-specific/linux/xpadneo/default.nix2
-rw-r--r--pkgs/os-specific/windows/default.nix2
89 files changed, 1499 insertions, 362 deletions
diff --git a/pkgs/os-specific/bsd/netbsd/default.nix b/pkgs/os-specific/bsd/netbsd/default.nix
index 801d574b5bcdb..7aad67e777ecd 100644
--- a/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@@ -106,8 +106,8 @@ in lib.makeScopeWithSplicing
   ##
   makeMinimal = mkDerivation {
     path = "tools/make";
-    sha256 = "1xbzfd4i7allrkk1if74a8ymgpizyj0gkvdigzzj37qar7la7nc1";
-    version = "8.0";
+    sha256 = "0fh0nrnk18m613m5blrliq2aydciv51qhc0ihsj4k63incwbk90n";
+    version = "9.1";
 
     buildInputs = with self; [];
     nativeBuildInputs = with buildPackages.netbsd; [ bsdSetupHook ];
@@ -139,11 +139,11 @@ in lib.makeScopeWithSplicing
   };
 
   compat = mkDerivation (let
-    version = "8.0";
+    version = "9.1";
     commonDeps = [ zlib ];
   in {
     path = "tools/compat";
-    sha256 = "050449lq5gpxqsripdqip5ks49g5ypjga188nd3ss8dg1zf7ydz3";
+    sha256 = "1vsxg7136nlhc72vpa664vs22874xh7ila95nkmsd8crn3z3cyn0";
     inherit version;
 
     setupHooks = [
@@ -191,12 +191,15 @@ in lib.makeScopeWithSplicing
       install -D $BSDSRCDIR/include/vis.h $out/include/vis.h
       install -D $BSDSRCDIR/include/db.h $out/include/db.h
       install -D $BSDSRCDIR/include/netconfig.h $out/include/netconfig.h
-      install -D $BSDSRCDIR/include/rpc/types.h $out/include/rpc/types.h
       install -D $BSDSRCDIR/include/utmpx.h $out/include/utmpx.h
       install -D $BSDSRCDIR/include/tzfile.h $out/include/tzfile.h
       install -D $BSDSRCDIR/sys/sys/tree.h $out/include/sys/tree.h
       install -D $BSDSRCDIR/include/nl_types.h $out/include/nl_types.h
       install -D $BSDSRCDIR/include/stringlist.h $out/include/stringlist.h
+
+      # Collapse includes slightly to fix dangling reference
+      install -D $BSDSRCDIR/common/include/rpc/types.h $out/include/rpc/types.h
+      sed -i '1s;^;#include "nbtool_config.h"\n;' $out/include/rpc/types.h
    '' + lib.optionalString stdenv.isDarwin ''
       mkdir -p $out/include/ssp
       touch $out/include/ssp/ssp.h
@@ -206,11 +209,11 @@ in lib.makeScopeWithSplicing
         --subst-var-by out $out \
         --subst-var-by version ${version}
     '';
-    extraPaths = with self; [ libc.src libutil.src
-      (fetchNetBSD "include" "8.0" "128m77k16i7frvk8kifhmxzk7a37m7z1s0bbmja3ywga6sx6v6sq")
-      (fetchNetBSD "external/bsd/flex" "8.0" "0yxcjshz9nj827qhmjwwjmzvmmqgaf0d25b42k7lj84vliwrgyr6")
-      (fetchNetBSD "sys/sys" "8.0" "0b0yjjy0c0cvk5nyffppqwxlwh2s1qr2xzl97a9ldck00dibar94")
-    ] ++ libutil.extraPaths ++ libc.extraPaths;
+    extraPaths = with self; [ include.src libc.src libutil.src
+      (fetchNetBSD "external/bsd/flex" "9.1" "0h98jpfj7vx5zh7vd7bk6b1hmzgkcb757a8j6d9zgygxxv13v43m")
+      (fetchNetBSD "sys/sys" "9.1" "1xx633pvmdgdb0h1x0bw1rvkc63h29ziwh51166rc3q5bil7y01n")
+      (fetchNetBSD "common/include/rpc/types.h" "9.1" "0n2df12mlc3cbc48jxq35yzl1y7ghgpykvy7jnfh898rdhac7m9a")
+    ] ++ libutil.extraPaths ++ _mainLibcExtraPaths;
   });
 
   # HACK: to ensure parent directories exist. This emulates GNU
@@ -222,7 +225,7 @@ in lib.makeScopeWithSplicing
     xinstall "$@"
   ''; in mkDerivation {
     path = "usr.bin/xinstall";
-    version = "8.0";
+    version = "9.1";
     sha256 = "1f6pbz3qv1qcrchdxif8p5lbmnwl8b9nq615hsd3cyl4avd5bfqj";
     extraPaths = with self; [ mtree.src make.src ];
     nativeBuildInputs = with buildPackages.netbsd; [
@@ -248,15 +251,15 @@ in lib.makeScopeWithSplicing
     pname = "fts";
     path = "include/fts.h";
     sha256 = "01d4fpxvz1pgzfk5xznz5dcm0x0gdzwcsfm1h3d0xc9kc6hj2q77";
-    version = "8.0";
+    version = "9.1";
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook
     ];
     propagatedBuildInputs = with self; compatIfNeeded;
     extraPaths = with self; [
-      (fetchNetBSD "lib/libc/gen/fts.c" "8.0" "1a8hmf26242nmv05ipn3ircxb0jqmmi66rh78kkyi9vjwkfl3qn7")
-      (fetchNetBSD "lib/libc/include/namespace.h" "8.0" "1sjvh9nw3prnk4rmdwrfsxh6gdb9lmilkn46jcfh3q5c8glqzrd7")
-      (fetchNetBSD "lib/libc/gen/fts.3" "8.0" "1asxw0n3fhjdadwkkq3xplfgqgl3q32w1lyrvbakfa3gs0wz5zc1")
+      (fetchNetBSD "lib/libc/gen/fts.c" "9.1" "1a8hmf26242nmv05ipn3ircxb0jqmmi66rh78kkyi9vjwkfl3qn7")
+      (fetchNetBSD "lib/libc/include/namespace.h" "9.1" "0kksr3pdwdc1cplqf5z12ih4cml6l11lqrz91f7hjjm64y7785kc")
+      (fetchNetBSD "lib/libc/gen/fts.3" "9.1" "1asxw0n3fhjdadwkkq3xplfgqgl3q32w1lyrvbakfa3gs0wz5zc1")
     ];
     skipIncludesPhase = true;
     buildPhase = ''
@@ -283,8 +286,8 @@ in lib.makeScopeWithSplicing
   # Don't add this to nativeBuildInputs directly.  Use statHook instead.
   stat = mkDerivation {
     path = "usr.bin/stat";
-    version = "8.0";
-    sha256 = "0z4r96id2r4cfy443rw2s1n52n186xm0lqvs8s3qjf4314z7r7yh";
+    version = "9.1";
+    sha256 = "18nqwlndfc34qbbgqx5nffil37jfq9aw663ippasfxd2hlyc106x";
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook
       makeMinimal
@@ -305,7 +308,7 @@ in lib.makeScopeWithSplicing
 
   tsort = mkDerivation {
     path = "usr.bin/tsort";
-    version = "8.0";
+    version = "9.1";
     sha256 = "1dqvf9gin29nnq3c4byxc7lfd062pg7m84843zdy6n0z63hnnwiq";
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook
@@ -316,7 +319,7 @@ in lib.makeScopeWithSplicing
 
   lorder = mkDerivation {
     path = "usr.bin/lorder";
-    version = "8.0";
+    version = "9.1";
     sha256 = "0rjf9blihhm0n699vr2bg88m4yjhkbxh6fxliaay3wxkgnydjwn2";
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook
@@ -333,8 +336,8 @@ in lib.makeScopeWithSplicing
   ##
   make = mkDerivation {
     path = "usr.bin/make";
-    sha256 = "103643qs3w5kiahir6cca2rkm5ink81qbg071qyzk63qvspfq10c";
-    version = "8.0";
+    sha256 = "09szl3lp9s081h7f3nci5h9zc78wlk9a6g18mryrznrss90q9ngx";
+    version = "9.1";
     postPatch = ''
       # make needs this to pick up our sys make files
       export NIX_CFLAGS_COMPILE+=" -D_PATH_DEFSYSPATH=\"$out/share/mk\""
@@ -352,39 +355,39 @@ in lib.makeScopeWithSplicing
       make -C $BSDSRCDIR/share/mk FILESDIR=$out/share/mk install
     '';
     extraPaths = [
-      (fetchNetBSD "share/mk" "8.0" "033q4w3rmvwznz6m7fn9xcf13chyhwwl8ijj3a9mrn80fkwm55qs")
+      (fetchNetBSD "share/mk" "9.1" "0qi3ypd5dsxk2c33885fsn68a550nibsxb1jwf5w6bfrvcblzn2z")
     ];
   };
 
   mtree = mkDerivation {
     path = "usr.sbin/mtree";
-    version = "8.0";
-    sha256 = "0hanmzm8bgwz2bhsinmsgfmgy6nbdhprwmgwbyjm6bl17vgn7vid";
+    version = "9.1";
+    sha256 = "04p7w540vz9npvyb8g8hcf2xa05phn1y88hsyrcz3vwanvpc0yv9";
     extraPaths = with self; [ mknod.src ];
   };
 
   mknod = mkDerivation {
     path = "sbin/mknod";
-    version = "8.0";
-    sha256 = "0vq66v0hj0r4z2r2z2d3l3c5vh48pvcdmddc8bhm8hzq2civ5df2";
+    version = "9.1";
+    sha256 = "1d9369shzwgixz3nph991i8q5vk7hr04py3n9avbfbhzy4gndqs2";
   };
 
   getent = mkDerivation {
     path = "usr.bin/getent";
-    sha256 = "1ylhw4dnpyrmcy8n5kjcxywm8qc9p124dqnm17x4magiqx1kh9iz";
-    version = "8.0";
+    sha256 = "1qngywcmm0y7nl8h3n8brvkxq4jw63szbci3kc1q6a6ndhycbbvr";
+    version = "9.1";
     patches = [ ./getent.patch ];
   };
 
   getconf = mkDerivation {
     path = "usr.bin/getconf";
     sha256 = "122vslz4j3h2mfs921nr2s6m078zcj697yrb75rwp2hnw3qz4s8q";
-    version = "8.0";
+    version = "9.1";
   };
 
   locale = mkDerivation {
     path = "usr.bin/locale";
-    version = "8.0";
+    version = "9.1";
     sha256 = "0kk6v9k2bygq0wf9gbinliqzqpzs9bgxn0ndyl2wcv3hh2bmsr9p";
     patches = [ ./locale.patch ];
     NIX_CFLAGS_COMPILE = "-DYESSTR=__YESSTR -DNOSTR=__NOSTR";
@@ -392,31 +395,31 @@ in lib.makeScopeWithSplicing
 
   rpcgen = mkDerivation {
     path = "usr.bin/rpcgen";
-    version = "8.0";
+    version = "9.1";
     sha256 = "1kfgfx54jg98wbg0d95p0rvf4w0302v8fz724b0bdackdsrd4988";
   };
 
   genassym = mkDerivation {
     path = "usr.bin/genassym";
-    version = "8.0";
+    version = "9.1";
     sha256 = "1acl1dz5kvh9h5806vkz2ap95rdsz7phmynh5i3x5y7agbki030c";
   };
 
   gencat = mkDerivation {
     path = "usr.bin/gencat";
-    version = "8.0";
-    sha256 = "1696lgh2lhz93247lklvpvkd0f5asg6z27w2g4bmpfijlgw2h698";
+    version = "9.1";
+    sha256 = "0gd463x1hg36bhr7y0xryb5jyxk0z0g7xvy8rgk82nlbnlnsbbwb";
   };
 
   nbperf = mkDerivation {
     path = "usr.bin/nbperf";
-    version = "8.0";
-    sha256 = "0gzm0zv2400lasnsswnjw9bwzyizhxzdbrcjwcl1k65aj86aqyqb";
+    version = "9.1";
+    sha256 = "1nxc302vgmjhm3yqdivqyfzslrg0vjpbss44s74rcryrl19mma9r";
   };
 
   tic = mkDerivation {
     path = "tools/tic";
-    version = "8.0";
+    version = "9.1";
     sha256 = "092y7db7k4kh2jq8qc55126r5qqvlb8lq8mhmy5ipbi36hwb4zrz";
     HOSTPROG = "tic";
     buildInputs = with self; compatIfNeeded;
@@ -428,29 +431,29 @@ in lib.makeScopeWithSplicing
     makeFlags = [ "TOOLDIR=$(out)" ];
     extraPaths = with self; [
       libterminfo.src
-      (fetchNetBSD "usr.bin/tic" "8.0" "0diirnzmdnpc5bixyb34c9rid9paw2a4zfczqrpqrfvjsf1nnljf")
-      (fetchNetBSD "tools/Makefile.host" "8.0" "1p23dsc4qrv93vc6gzid9w2479jwswry9qfn88505s0pdd7h6nvp")
+      (fetchNetBSD "usr.bin/tic" "9.1" "1mwdfg7yx1g43ss378qsgl5rqhsxskqvsd2mqvrn38qw54i8v5i1")
+      (fetchNetBSD "tools/Makefile.host" "9.1" "15b4ab0n36lqj00j5lz2xs83g7l8isk3wx1wcapbrn66qmzz2sxy")
     ];
   };
 
   uudecode = mkDerivation {
     path = "usr.bin/uudecode";
-    version = "8.0";
+    version = "9.1";
     sha256 = "00a3zmh15pg4vx6hz0kaa5mi8d2b1sj4h512d7p6wbvxq6mznwcn";
     NIX_CFLAGS_COMPILE = lib.optional stdenv.isLinux "-DNO_BASE64";
   };
 
   cksum = mkDerivation {
     path = "usr.bin/cksum";
-    version = "8.0";
-    sha256 = "0327820171djn9dzb2q1arypxw2zsxiixnd1ahy34dagd9cwcphj";
+    version = "9.1";
+    sha256 = "0msfhgyvh5c2jmc6qjnf12c378dhw32ffsl864qz4rdb2b98rfcq";
     meta.platforms = lib.platforms.netbsd;
   };
 
   config = mkDerivation {
     path = "usr.bin/config";
-    version = "8.0";
-    sha256 = "0piyn8lgdqxwz9wkgc2plzp2xpj93fs4xncri8l0jfas9rv5j2m5";
+    version = "9.1";
+    sha256 = "08mqq0izd9550dwk181smni51cbiim7rwp208phf25c4mqzaznf4";
     NIX_CFLAGS_COMPILE = [ "-DMAKE_BOOTSTRAP" ];
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook
@@ -468,8 +471,8 @@ in lib.makeScopeWithSplicing
   ##
   include = mkDerivation {
     path = "include";
-    version = "8.0";
-    sha256 = "128m77k16i7frvk8kifhmxzk7a37m7z1s0bbmja3ywga6sx6v6sq";
+    version = "9.1";
+    sha256 = "127kj61prvj3klc2an5rpgavgah2g6igfgprl45255i264wyg8v3";
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook
       makeMinimal
@@ -482,13 +485,17 @@ in lib.makeScopeWithSplicing
     makeFlags = [ "RPCGEN_CPP=${buildPackages.stdenv.cc.cc}/bin/cpp" ];
   };
 
-  common = fetchNetBSD "common" "8.0" "1fsm2b7p7zkhiz523jw75088cq2h39iknp0fp3di9a64bikwbhi1";
+  common = fetchNetBSD "common" "9.1" "000n9frjm02h1bdwhb9rbr7wphs8vrj7n09l3v9hhnqrkn7nhy30";
 
   sys-headers = mkDerivation {
     pname = "sys-headers";
     path = "sys";
-    version = "8.0";
-    sha256 = "123ilg8fqmp69bw6bs6nh98fpi1v2n9lamrzar61p27ji6sj7g0w";
+    version = "9.1";
+    sha256 = "03sv6d7nvnkas4m5z87zxh1rpmggr91ls7di88fwc3cwd3mg3iyx";
+
+    # Fix this error when building bootia32.efi and bootx64.efi:
+    # error: PHDR segment not covered by LOAD segment
+    patches = [ ./no-dynamic-linker.patch ];
 
     CONFIG = "GENERIC";
 
@@ -536,7 +543,7 @@ in lib.makeScopeWithSplicing
   };
 
   headers = symlinkJoin {
-    name = "netbsd-headers-8.0";
+    name = "netbsd-headers-9.1";
     paths = with self; [
       include
       sys-headers
@@ -553,8 +560,8 @@ in lib.makeScopeWithSplicing
   ##
   libutil = mkDerivation {
     path = "lib/libutil";
-    version = "8.0";
-    sha256 = "077syyxd303m4x7avs5nxzk4c9n13d5lyk5aicsacqjvx79qrk3i";
+    version = "9.1";
+    sha256 = "02gm5a5zhh8qp5r5q5r7x8x6x50ir1i0ncgsnfwh1vnrz6mxbq7z";
     extraPaths = with self; [ common libc.src sys.src ];
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook
@@ -567,8 +574,8 @@ in lib.makeScopeWithSplicing
 
   libedit = mkDerivation {
     path = "lib/libedit";
-    version = "8.0";
-    sha256 = "0pmqh2mkfp70bwchiwyrkdyq9jcihx12g1awd6alqi9bpr3f9xmd";
+    version = "9.1";
+    sha256 = "1wqhngraxwqk4jgrf5f18jy195yrp7c06n1gf31pbplq79mg1bcj";
     buildInputs = with self; [ libterminfo libcurses ];
     propagatedBuildInputs = with self; compatIfNeeded;
     SHLIBINSTALLDIR = "$(out)/lib";
@@ -588,8 +595,8 @@ in lib.makeScopeWithSplicing
 
   libterminfo = mkDerivation {
     path = "lib/libterminfo";
-    version = "8.0";
-    sha256 = "14gp0d6fh6zjnbac2yjhyq5m6rca7gm6q1s9gilhzpdgl9m7vb9r";
+    version = "9.1";
+    sha256 = "0pq05k3dj0dfsczv07frnnji92mazmy2qqngqbx2zgqc1x251414";
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook
       makeMinimal install tsort lorder mandoc statHook nbperf tic
@@ -608,14 +615,14 @@ in lib.makeScopeWithSplicing
       make -C $BSDSRCDIR/share/terminfo $makeFlags BINDIR=$out/share install
     '';
     extraPaths = with self; [
-      (fetchNetBSD "share/terminfo" "8.0" "18db0fk1dw691vk6lsm6dksm4cf08g8kdm0gc4052ysdagg2m6sm")
+      (fetchNetBSD "share/terminfo" "9.1" "1vh9rl4w8118a9qdpblfxmv1wkpm83rm9gb4rzz5bpm56i6d7kk7")
     ];
   };
 
   libcurses = mkDerivation {
     path = "lib/libcurses";
-    version = "8.0";
-    sha256 = "0azhzh1910v24dqx45zmh4z4dl63fgsykajrbikx5xfvvmkcq7xs";
+    version = "9.1";
+    sha256 = "0pd0dggl3w4bv5i5h0s1wrc8hr66n4hkv3zlklarwfdhc692fqal";
     buildInputs = with self; [ libterminfo ];
     NIX_CFLAGS_COMPILE = [
       "-D__scanflike(a,b)="
@@ -636,21 +643,21 @@ in lib.makeScopeWithSplicing
 
   column = mkDerivation {
     path = "usr.bin/column";
-    version = "8.0";
+    version = "9.1";
     sha256 = "0r6b0hjn5ls3j3sv6chibs44fs32yyk2cg8kh70kb4cwajs4ifyl";
   };
 
   libossaudio = mkDerivation {
     path = "lib/libossaudio";
-    version = "8.0";
-    sha256 = "03azp5anavhjr15sinjlik9792lyf7w4zmkcihlkksrywhs05axh";
+    version = "9.1";
+    sha256 = "16l3bfy6dcwqnklvh3x0ps8ld1y504vf57v9rx8f9adzhb797jh0";
     meta.platforms = lib.platforms.netbsd;
   };
 
   librpcsvc = mkDerivation {
     path = "lib/librpcsvc";
-    version = "8.0";
-    sha256 = "14ri9w6gdhsm4id5ck133syyvbmkbknfa8w0xkklm726nskhfkj7";
+    version = "9.1";
+    sha256 = "1q34pfiyjbrgrdqm46jwrsqms49ly6z3b0xh1wg331zga900vq5n";
     makeFlags = [ "INCSDIR=$(out)/include/rpcsvc" ];
     meta.platforms = lib.platforms.netbsd;
     nativeBuildInputs = with buildPackages.netbsd; [
@@ -662,10 +669,10 @@ in lib.makeScopeWithSplicing
 
   librt = mkDerivation {
     path = "lib/librt";
-    version = "8.0";
-    sha256 = "078qsi4mg1hyyxr1awvjs9b0c2gicg3zw4vl603g1m9vm8gfxw9l";
+    version = "9.1";
+    sha256 = "07f8mpjcqh5kig5z5sp97fg55mc4dz6aa1x5g01nv2pvbmqczxc6";
     meta.platforms = lib.platforms.netbsd;
-    extraPaths = with self; [ common libc.src ];
+    extraPaths = with self; [ libc.src ] ++ libc.extraPaths;
     postPatch = ''
       sed -i 's,/usr\(/include/sys/syscall.h\),${self.headers}\1,g' \
         $BSDSRCDIR/lib/{libc,librt}/sys/Makefile.inc
@@ -674,7 +681,7 @@ in lib.makeScopeWithSplicing
 
   libcrypt = mkDerivation {
     path = "lib/libcrypt";
-    version = "8.0";
+    version = "9.1";
     sha256 = "0siqan1wdqmmhchh2n8w6a8x1abbff8n4yb6jrqxap3hqn8ay54g";
     SHLIBINSTALLDIR = "$(out)/lib";
     meta.platforms = lib.platforms.netbsd;
@@ -683,8 +690,8 @@ in lib.makeScopeWithSplicing
   libpthread-headers = mkDerivation {
     pname = "libpthread-headers";
     path = "lib/libpthread";
-    version = "8.0";
-    sha256 = "0pcz61klc3ijf5z2zf8s78nj7bwjfblzjllx7vr4z5qv3m0sdb3j";
+    version = "9.1";
+    sha256 = "0mlmc31k509dwfmx5s2x010wxjc44mr6y0cbmk30cfipqh8c962h";
     installPhase = "includesPhase";
     dontBuild = true;
     noCC = true;
@@ -697,21 +704,22 @@ in lib.makeScopeWithSplicing
     noCC = false;
     dontBuild = false;
     buildInputs = with self; [ headers ];
-    extraPaths = with self; [ common libc.src sys.src ];
+    SHLIBINSTALLDIR = "$(out)/lib";
+    extraPaths = with self; [ common libc.src librt.src sys.src ];
   };
 
   libresolv = mkDerivation {
     path = "lib/libresolv";
-    version = "8.0";
-    sha256 = "11vpb3p2343wyrhw4v9gwz7i0lcpb9ysmfs9gsx56b5gkgipdy4v";
+    version = "9.1";
+    sha256 = "1am74s74mf1ynwz3p4ncjkg63f78a1zjm983q166x4sgzps15626";
     meta.platforms = lib.platforms.netbsd;
     extraPaths = with self; [ libc.src ];
   };
 
   libm = mkDerivation {
     path = "lib/libm";
-    version = "8.0";
-    sha256 = "0i22603cgj6n00gn2m446v4kn1pk109qs1g6ylrslmihfmiy2h1d";
+    version = "9.1";
+    sha256 = "1apwfr26shdmbqqnmg7hxf7bkfxw44ynqnnnghrww9bnhqdnsy92";
     SHLIBINSTALLDIR = "$(out)/lib";
     meta.platforms = lib.platforms.netbsd;
     extraPaths = with self; [ sys.src ];
@@ -719,7 +727,7 @@ in lib.makeScopeWithSplicing
 
   i18n_module = mkDerivation {
     path = "lib/i18n_module";
-    version = "8.0";
+    version = "9.1";
     sha256 = "0w6y5v3binm7gf2kn7y9jja8k18rhnyl55cvvfnfipjqdxvxd9jd";
     meta.platforms = lib.platforms.netbsd;
     extraPaths = with self; [ libc.src ];
@@ -727,8 +735,8 @@ in lib.makeScopeWithSplicing
 
   csu = mkDerivation {
     path = "lib/csu";
-    version = "8.0";
-    sha256 = "0630lbvz6v4ic13bfg8ccwfhqkgcv76bfdw9f36rfsnwfgpxqsmq";
+    version = "9.1";
+    sha256 = "0al5jfazvhlzn9hvmnrbchx4d0gm282hq5gp4xs2zmj9ycmf6d03";
     meta.platforms = lib.platforms.netbsd;
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook
@@ -742,8 +750,8 @@ in lib.makeScopeWithSplicing
 
   ld_elf_so = mkDerivation {
     path  = "libexec/ld.elf_so";
-    version = "8.0";
-    sha256 = "1jmqpi0kg2daiqnvpwdyfy8rpnszxsm70sxizz0r7wn53xjr5hva";
+    version = "9.1";
+    sha256 = "0ia9mqzdljly0vqfwflm5mzz55k7qsr4rw2bzhivky6k30vgirqa";
     meta.platforms = lib.platforms.netbsd;
     LIBC_PIC = "${stdenv.cc.libc}/lib/libc_pic.a";
     # Hack to prevent a symlink being installed here for compatibility.
@@ -753,16 +761,20 @@ in lib.makeScopeWithSplicing
     extraPaths = with self; [ libc.src ] ++ libc.extraPaths;
   };
 
+  _mainLibcExtraPaths = with self; [
+      common i18n_module.src sys.src
+      ld_elf_so.src libpthread.src libm.src libresolv.src
+      librpcsvc.src libutil.src librt.src libcrypt.src
+  ];
+
   libc = mkDerivation {
     path = "lib/libc";
-    version = "8.0";
-    sha256 = "0lgbc58qgn8kwm3l011x1ml1kgcf7jsgq7hbf0hxhlbvxq5bljl3";
+    version = "9.1";
+    sha256 = "0jg6kpi1xn4wvlqpwnkcv8655hxi0nhcxbk8lzbj7mlr6srxci8j";
     USE_FORT = "yes";
     MKPROFILE = "no";
-    extraPaths = with self; [
-      common i18n_module.src sys.src
-      ld_elf_so.src libpthread.src libm.src libresolv.src
-      librpcsvc.src libutil.src librt.src libcrypt.src
+    extraPaths = with self; _mainLibcExtraPaths ++ [
+      (fetchNetBSD "external/bsd/jemalloc" "9.1" "0cq704swa0h2yxv4gc79z2lwxibk9k7pxh3q5qfs7axx3jx3n8kb")
     ];
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook
@@ -774,6 +786,7 @@ in lib.makeScopeWithSplicing
     NIX_CFLAGS_COMPILE = "-B${self.csu}/lib";
     meta.platforms = lib.platforms.netbsd;
     SHLIBINSTALLDIR = "$(out)/lib";
+    MKPICINSTALL = "yes";
     NLSDIR = "$(out)/share/nls";
     makeFlags = [ "FILESDIR=$(out)/var/db"];
     postInstall = ''
@@ -827,24 +840,24 @@ in lib.makeScopeWithSplicing
   dict = mkDerivation {
     path = "share/dict";
     noCC = true;
-    version = "8.0";
-    sha256 = "1pk0y3xc5ihc2k89wjkh33qqx3w9q34k03k2qcffvbqh1l6wm36l";
+    version = "9.1";
+    sha256 = "0svfc0byk59ri37pyjslv4c4rc7zw396r73mr593i78d39q5g3ad";
     makeFlags = [ "BINDIR=$(out)/share" ];
   };
 
   misc = mkDerivation {
     path = "share/misc";
     noCC = true;
-    version = "8.0";
-    sha256 = "0d34b3irjbqsqfk8v8aaj36fjyvwyx410igl26jcx2ryh3ispch8";
+    version = "9.1";
+    sha256 = "1j2cdssdx6nncv8ffj7f7ybl7m9hadjj8vm8611skqdvxnjg6nbc";
     makeFlags = [ "BINDIR=$(out)/share" ];
   };
 
   man = mkDerivation {
     path = "share/man";
     noCC = true;
-    version = "8.0";
-    sha256 = "0yp48syf3y5psm0mymxp6va6spym5izjym0ybr628iqwji21cqdz";
+    version = "9.1";
+    sha256 = "14sfvz9a5x0kmr9ywsdz09jhw8r1cmhq45wrrz2xwy09b8ykhip6";
     makeFlags = [ "FILESDIR=$(out)/share" ];
   };
   #
diff --git a/pkgs/os-specific/bsd/netbsd/no-dynamic-linker.patch b/pkgs/os-specific/bsd/netbsd/no-dynamic-linker.patch
new file mode 100644
index 0000000000000..5a2b9092a5c56
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/no-dynamic-linker.patch
@@ -0,0 +1,16 @@
+===================================================================
+RCS file: /ftp/cvs/cvsroot/src/sys/arch/i386/stand/efiboot/Makefile.efiboot,v
+rcsdiff: /ftp/cvs/cvsroot/src/sys/arch/i386/stand/efiboot/Makefile.efiboot,v: warning: Unknown phrases like `commitid ...;' are present.
+retrieving revision 1.16
+retrieving revision 1.17
+diff -u -p -r1.16 -r1.17
+--- sys/arch/i386/stand/efiboot/Makefile.efiboot	2019/09/13 02:19:45	1.16
++++ sys/arch/i386/stand/efiboot/Makefile.efiboot	2020/04/04 15:30:46	1.17
+@@ -41,6 +41,7 @@ BINMODE=444
+ .PATH:	${.CURDIR}/../../libsa
+ 
+ LDSCRIPT?= ${.CURDIR}/ldscript
++LDFLAGS+= --no-dynamic-linker --noinhibit-exec
+ LDFLAGS+= -nostdlib -T${LDSCRIPT} -Bsymbolic -shared -nocombreloc
+ CPPFLAGS+= -I$S -I${.CURDIR} -I${.CURDIR}/.. -I$S/lib/libsa
+ CPPFLAGS+= -I${.OBJDIR}
diff --git a/pkgs/os-specific/darwin/DarwinTools/default.nix b/pkgs/os-specific/darwin/DarwinTools/default.nix
index 5badf2434d640..588769c7bfc6a 100644
--- a/pkgs/os-specific/darwin/DarwinTools/default.nix
+++ b/pkgs/os-specific/darwin/DarwinTools/default.nix
@@ -8,7 +8,11 @@ stdenv.mkDerivation rec {
     sha256 = "0hh4jl590jv3v830p77r3jcrnpndy7p2b8ajai3ldpnx2913jfhp";
   };
 
-  patchPhase = ''
+  patches = [
+    ./sw_vers-CFPriv.patch
+  ];
+
+  postPatch = ''
     substituteInPlace Makefile \
       --replace gcc cc
   '';
diff --git a/pkgs/os-specific/darwin/DarwinTools/sw_vers-CFPriv.patch b/pkgs/os-specific/darwin/DarwinTools/sw_vers-CFPriv.patch
new file mode 100644
index 0000000000000..6faeaa75025e6
--- /dev/null
+++ b/pkgs/os-specific/darwin/DarwinTools/sw_vers-CFPriv.patch
@@ -0,0 +1,19 @@
+--- a/sw_vers.c	2021-04-19 13:06:50.131346864 +0900
++++ b/sw_vers.c	2021-04-19 13:07:32.481967474 +0900
+@@ -28,7 +28,15 @@
+  */
+ 
+ #include <CoreFoundation/CoreFoundation.h>
+-#include <CoreFoundation/CFPriv.h>
++
++// Avoid dependency on CoreFoundation/CFPriv, which no longer appears to be
++// part of the upstream sdk.
++
++CFDictionaryRef _CFCopyServerVersionDictionary(void);
++CFDictionaryRef _CFCopySystemVersionDictionary(void);
++extern CFStringRef _kCFSystemVersionProductNameKey;
++extern CFStringRef _kCFSystemVersionProductVersionKey;
++extern CFStringRef _kCFSystemVersionBuildVersionKey;
+ 
+ void usage(char *progname) {
+ 	fprintf(stderr, "Usage: %s [-productName|-productVersion|-buildVersion]\n", progname);
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
new file mode 100644
index 0000000000000..a4242405b4118
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
@@ -0,0 +1,151 @@
+{ lib, stdenvNoCC, buildPackages, fetchurl, xar, cpio, pkgs, python3, pbzx, MacOSX-SDK }:
+
+# TODO: reorganize to make this just frameworks, and move libs to default.nix
+
+let
+  stdenv = stdenvNoCC;
+
+  standardFrameworkPath = name: private:
+    "/System/Library/${lib.optionalString private "Private"}Frameworks/${name}.framework";
+
+  mkDepsRewrites = deps:
+  let
+    mergeRewrites = x: y: {
+      prefix = lib.mergeAttrs (x.prefix or {}) (y.prefix or {});
+      const = lib.mergeAttrs (x.const or {}) (y.const or {});
+    };
+
+    rewriteArgs = { prefix ? {}, const ? {} }: lib.concatLists (
+      (lib.mapAttrsToList (from: to: [ "-p" "${from}:${to}" ]) prefix) ++
+      (lib.mapAttrsToList (from: to: [ "-c" "${from}:${to}" ]) const)
+    );
+
+    rewrites = depList: lib.fold mergeRewrites {}
+      (map (dep: dep.tbdRewrites)
+        (lib.filter (dep: dep ? tbdRewrites) depList));
+  in
+    lib.escapeShellArgs (rewriteArgs (rewrites (builtins.attrValues deps)));
+
+  mkFramework = { name, deps, private ? false }:
+    let self = stdenv.mkDerivation {
+      pname = "apple-${lib.optionalString private "private-"}framework-${name}";
+      version = MacOSX-SDK.version;
+
+      dontUnpack = true;
+
+      # because we copy files from the system
+      preferLocalBuild = true;
+
+      disallowedRequisites = [ MacOSX-SDK ];
+
+      nativeBuildInputs = [ buildPackages.darwin.rewrite-tbd ];
+
+      installPhase = ''
+        mkdir -p $out/Library/Frameworks
+
+        cp -r ${MacOSX-SDK}${standardFrameworkPath name private} $out/Library/Frameworks
+
+        # Fix and check tbd re-export references
+        chmod u+w -R $out
+        find $out -name '*.tbd' -type f | while read tbd; do
+          echo "Fixing re-exports in $tbd"
+          rewrite-tbd \
+            -p ${standardFrameworkPath name private}/:$out/Library/Frameworks/${name}.framework/ \
+            ${mkDepsRewrites deps} \
+            -r ${builtins.storeDir} \
+            "$tbd"
+        done
+      '';
+
+      propagatedBuildInputs = builtins.attrValues deps;
+
+      passthru = {
+        tbdRewrites = {
+          prefix."${standardFrameworkPath name private}/" = "${self}/Library/Frameworks/${name}.framework/";
+        };
+      };
+
+      meta = with lib; {
+        description = "Apple SDK framework ${name}";
+        maintainers = with maintainers; [ copumpkin ];
+        platforms   = platforms.darwin;
+      };
+    };
+  in self;
+
+  framework = name: deps: mkFramework { inherit name deps; private = false; };
+  privateFramework = name: deps: mkFramework { inherit name deps; private = true; };
+in rec {
+  libs = {
+    xpc = stdenv.mkDerivation {
+      name   = "apple-lib-xpc";
+      dontUnpack = true;
+
+      installPhase = ''
+        mkdir -p $out/include
+        pushd $out/include >/dev/null
+        cp -r "${MacOSX-SDK}/usr/include/xpc" $out/include/xpc
+        cp "${MacOSX-SDK}/usr/include/launch.h" $out/include/launch.h
+        popd >/dev/null
+      '';
+    };
+
+    Xplugin = stdenv.mkDerivation {
+      name   = "apple-lib-Xplugin";
+      dontUnpack = true;
+
+      propagatedBuildInputs = with frameworks; [
+        OpenGL ApplicationServices Carbon IOKit CoreGraphics CoreServices CoreText
+      ];
+
+      installPhase = ''
+        mkdir -p $out/include $out/lib
+        ln -s "${MacOSX-SDK}/include/Xplugin.h" $out/include/Xplugin.h
+        cp ${MacOSX-SDK}/usr/lib/libXplugin.1.tbd $out/lib
+        ln -s libXplugin.1.tbd $out/lib/libXplugin.tbd
+      '';
+    };
+
+    utmp = stdenv.mkDerivation {
+      name   = "apple-lib-utmp";
+      dontUnpack = true;
+
+      installPhase = ''
+        mkdir -p $out/include
+        pushd $out/include >/dev/null
+        ln -s "${MacOSX-SDK}/include/utmp.h"
+        ln -s "${MacOSX-SDK}/include/utmpx.h"
+        popd >/dev/null
+      '';
+    };
+
+    libDER = stdenv.mkDerivation {
+      name = "apple-lib-libDER";
+      dontUnpack = true;
+      installPhase = ''
+        mkdir -p $out/include
+        cp -r ${MacOSX-SDK}/usr/include/libDER $out/include
+      '';
+    };
+  };
+
+  overrides = super: {
+    CoreFoundation = lib.overrideDerivation super.CoreFoundation (drv: {
+      setupHook = ./cf-setup-hook.sh;
+    });
+  };
+
+  bareFrameworks = (
+    lib.mapAttrs framework (import ./frameworks.nix {
+      inherit frameworks libs;
+      inherit (pkgs.darwin) libobjc Libsystem;
+      inherit (pkgs.darwin.apple_sdk) libnetwork;
+    })
+  ) // (
+    lib.mapAttrs privateFramework (import ./private-frameworks.nix {
+      inherit frameworks;
+    })
+  );
+
+  frameworks = bareFrameworks // overrides bareFrameworks;
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/cf-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk-11.0/cf-setup-hook.sh
new file mode 100644
index 0000000000000..3b08c51d196e4
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/cf-setup-hook.sh
@@ -0,0 +1,6 @@
+forceLinkCoreFoundationFramework() {
+  NIX_CFLAGS_COMPILE="-F@out@/Library/Frameworks${NIX_CFLAGS_COMPILE:+ }${NIX_CFLAGS_COMPILE-}"
+  NIX_LDFLAGS+=" @out@/Library/Frameworks/CoreFoundation.framework/CoreFoundation"
+}
+
+preConfigureHooks+=(forceLinkCoreFoundationFramework)
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
new file mode 100644
index 0000000000000..03a6650d9d989
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
@@ -0,0 +1,58 @@
+{ stdenvNoCC, fetchurl, newScope, pkgs
+, xar, cpio, python3, pbzx }:
+
+let
+  MacOSX-SDK = stdenvNoCC.mkDerivation rec {
+    pname = "MacOSX-SDK";
+    version = "11.0.0";
+
+    # https://swscan.apple.com/content/catalogs/others/index-10.16.merged-1.sucatalog
+    src = fetchurl {
+      url = "http://swcdn.apple.com/content/downloads/58/37/001-75138-A_59RXKDS8YM/12ksm19hgzscfc7cau3yhecz4vpkps7wbq/CLTools_macOSNMOS_SDK.pkg";
+      sha256 = "0n51ba926ckwm62w5c8lk3w5hj4ihk0p5j02321qi75wh824hl8m";
+    };
+
+    dontBuild = true;
+    darwinDontCodeSign = true;
+
+    nativeBuildInputs = [ cpio pbzx ];
+
+    outputs = [ "out" ];
+
+    unpackPhase = ''
+      pbzx $src | cpio -idm
+    '';
+
+    installPhase = ''
+      cd Library/Developer/CommandLineTools/SDKs/MacOSX11.0.sdk
+
+      mkdir $out
+      cp -r System usr $out/
+    '';
+
+    passthru = {
+      inherit version;
+    };
+  };
+
+  callPackage = newScope (packages // pkgs.darwin // { inherit MacOSX-SDK; });
+
+  packages = {
+    inherit (callPackage ./apple_sdk.nix {}) frameworks libs;
+
+    # TODO: this is nice to be private. is it worth the callPackage above?
+    # Probably, I don't think that callPackage costs much at all.
+    inherit MacOSX-SDK;
+
+    Libsystem = callPackage ./libSystem.nix {};
+    LibsystemCross = pkgs.darwin.Libsystem;
+    libcharset = callPackage ./libcharset.nix {};
+    libunwind = callPackage ./libunwind.nix {};
+    libnetwork = callPackage ./libnetwork.nix {};
+    objc4 = callPackage ./libobjc.nix {};
+
+    # questionable aliases
+    configd = pkgs.darwin.apple_sdk.frameworks.SystemConfiguration;
+    IOKit = pkgs.darwin.apple_sdk.frameworks.IOKit;
+  };
+in packages
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
new file mode 100644
index 0000000000000..c8f8ccc4a0813
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
@@ -0,0 +1,193 @@
+{ frameworks, libs, libobjc, Libsystem, libnetwork }: with frameworks; with libs;
+{
+  AGL                              = { inherit Carbon OpenGL; };
+  AVFoundation                     = { inherit ApplicationServices AVFCapture AVFCore CoreGraphics; };
+  AVKit                            = {};
+  Accelerate                       = { inherit CoreWLAN IOBluetooth; };
+  Accessibility                    = {};
+  Accounts                         = {};
+  AdSupport                        = {};
+  AddressBook                      = { inherit AddressBookCore Carbon ContactsPersistence libobjc; };
+  AppKit                           = { inherit ApplicationServices AudioToolbox AudioUnit Foundation QuartzCore UIFoundation; };
+  AppTrackingTransparency          = {};
+  AppleScriptKit                   = {};
+  AppleScriptObjC                  = {};
+  ApplicationServices              = { inherit ColorSync CoreGraphics CoreServices CoreText ImageIO; };
+  AudioToolbox                     = { inherit AudioToolboxCore CoreAudio CoreMIDI; };
+  AudioUnit                        = { inherit AudioToolbox Carbon CoreAudio; };
+  AudioVideoBridging               = { inherit Foundation; };
+  AuthenticationServices           = {};
+  AutomaticAssessmentConfiguration = {};
+  Automator                        = {};
+  BackgroundTasks                  = {};
+  BusinessChat                     = {};
+  CFNetwork                        = {};
+  CalendarStore                    = {};
+  CallKit                          = {};
+  Carbon                           = { inherit ApplicationServices CoreServices Foundation IOKit QuartzCore Security libobjc; };
+  ClassKit                         = {};
+  CloudKit                         = { inherit CoreLocation; };
+  Cocoa                            = { inherit AppKit CoreData; };
+  Collaboration                    = {};
+  ColorSync                        = {};
+  Combine                          = {};
+  Contacts                         = {};
+  ContactsUI                       = {};
+  CoreAudio                        = { inherit IOKit CoreAudioTypes; };
+  CoreAudioKit                     = { inherit AudioUnit; };
+  CoreAudioTypes                   = {};
+  CoreBluetooth                    = {};
+  CoreData                         = { inherit CloudKit; };
+  CoreDisplay                      = {};
+  CoreFoundation                   = { inherit libobjc; };
+  CoreGraphics                     = { inherit Accelerate IOKit IOSurface SystemConfiguration; };
+  CoreHaptics                      = {};
+  CoreImage                        = {};
+  CoreLocation                     = {};
+  CoreMIDI                         = {};
+  CoreMIDIServer                   = { inherit CoreMIDI; };
+  CoreML                           = {};
+  CoreMedia                        = { inherit ApplicationServices AudioToolbox AudioUnit CoreAudio CoreGraphics CoreVideo; };
+  CoreMediaIO                      = { inherit CoreMedia; };
+  CoreMotion                       = {};
+  CoreServices                     = { inherit CFNetwork CoreAudio CoreData CoreFoundation DiskArbitration NetFS OpenDirectory Security ServiceManagement; };
+  CoreSpotlight                    = {};
+  CoreTelephony                    = {};
+  CoreText                         = { inherit CoreGraphics; };
+  CoreVideo                        = { inherit ApplicationServices CoreGraphics IOSurface OpenGL; };
+  CoreWLAN                         = { inherit SecurityFoundation; };
+  CryptoKit                        = {};
+  CryptoTokenKit                   = {};
+  DVDPlayback                      = {};
+  DeveloperToolsSupport            = {};
+  DeviceCheck                      = {};
+  DirectoryService                 = {};
+  DiscRecording                    = { inherit CoreServices IOKit libobjc; };
+  DiscRecordingUI                  = {};
+  DiskArbitration                  = { inherit IOKit; };
+  DriverKit                        = {};
+  EventKit                         = {};
+  ExceptionHandling                = {};
+  ExecutionPolicy                  = {};
+  ExternalAccessory                = {};
+  FWAUserLib                       = {};
+  FileProvider                     = {};
+  FileProviderUI                   = {};
+  FinderSync                       = {};
+  ForceFeedback                    = { inherit IOKit; };
+  Foundation                       = { inherit ApplicationServices CoreFoundation Security SystemConfiguration libobjc; };
+  GLKit                            = {};
+  GLUT                             = { inherit OpenGL; };
+  GSS                              = {};
+  GameController                   = {};
+  GameKit                          = { inherit Cocoa Foundation GameCenterFoundation GameCenterUI GameCenterUICore GameController GameplayKit Metal MetalKit ModelIO ReplayKit SceneKit SpriteKit; };
+  GameplayKit                      = {};
+  HIDDriverKit                     = {};
+  Hypervisor                       = {};
+  ICADevices                       = { inherit Carbon IOBluetooth libobjc; };
+  IMServicePlugIn                  = {};
+  IOBluetooth                      = { inherit CoreBluetooth IOKit; };
+  IOBluetoothUI                    = { inherit IOBluetooth; };
+  IOKit                            = {};
+  IOSurface                        = { inherit IOKit xpc; };
+  IOUSBHost                        = {};
+  IdentityLookup                   = {};
+  ImageCaptureCore                 = {};
+  ImageIO                          = { inherit CoreGraphics; };
+  InputMethodKit                   = { inherit Carbon; };
+  InstallerPlugins                 = {};
+  InstantMessage                   = {};
+  Intents                          = {};
+  JavaNativeFoundation             = {};
+  JavaRuntimeSupport               = {};
+  JavaScriptCore                   = { inherit libobjc; };
+  Kerberos                         = {};
+  Kernel                           = { inherit IOKit; };
+  KernelManagement                 = {};
+  LDAP                             = {};
+  LatentSemanticMapping            = { inherit Carbon; };
+  LinkPresentation                 = { inherit URLFormatting; };
+  LocalAuthentication              = {};
+  MLCompute                        = {};
+  MapKit                           = {};
+  MediaAccessibility               = { inherit CoreGraphics CoreText QuartzCore; };
+  MediaLibrary                     = {};
+  MediaPlayer                      = {};
+  MediaToolbox                     = { inherit AudioToolbox AudioUnit CoreMedia; };
+  Message                          = {};
+  Metal                            = {};
+  MetalKit                         = { inherit Metal ModelIO; };
+  MetalPerformanceShaders          = {};
+  MetalPerformanceShadersGraph     = {};
+  MetricKit                        = { inherit SignpostMetrics; };
+  ModelIO                          = {};
+  MultipeerConnectivity            = {};
+  NaturalLanguage                  = {};
+  NearbyInteraction                = {};
+  NetFS                            = {};
+  Network                          = { inherit libnetwork; };
+  NetworkExtension                 = { inherit Network; };
+  NetworkingDriverKit              = {};
+  NotificationCenter               = {};
+  OSAKit                           = { inherit Carbon; };
+  OSLog                            = {};
+  OpenAL                           = {};
+  OpenCL                           = { inherit IOSurface OpenGL; };
+  OpenDirectory                    = {};
+  OpenGL                           = {};
+  PCIDriverKit                     = {};
+  PCSC                             = { inherit CoreData; };
+  PDFKit                           = {};
+  ParavirtualizedGraphics          = {};
+  PassKit                          = { inherit PassKitCore; };
+  PencilKit                        = {};
+  Photos                           = {};
+  PhotosUI                         = {};
+  PreferencePanes                  = {};
+  PushKit                          = {};
+  Python                           = {};
+  QTKit                            = { inherit CoreMedia CoreMediaIO MediaToolbox VideoToolbox; };
+  Quartz                           = { inherit QTKit QuartzCore QuickLook PDFKit; };
+  QuartzCore                       = { inherit ApplicationServices CoreImage CoreVideo Metal OpenCL libobjc; };
+  QuickLook                        = { inherit ApplicationServices; };
+  QuickLookThumbnailing            = {};
+  RealityKit                       = {};
+  ReplayKit                        = {};
+  Ruby                             = {};
+  SafariServices                   = {};
+  SceneKit                         = {};
+  ScreenSaver                      = {};
+  ScreenTime                       = {};
+  ScriptingBridge                  = {};
+  Security                         = { inherit IOKit libDER; };
+  SecurityFoundation               = { inherit Security; };
+  SecurityInterface                = { inherit Security SecurityFoundation; };
+  SensorKit                        = {};
+  ServiceManagement                = { inherit Security; };
+  Social                           = {};
+  SoundAnalysis                    = {};
+  Speech                           = {};
+  SpriteKit                        = {};
+  StoreKit                         = {};
+  SwiftUI                          = {};
+  SyncServices                     = {};
+  System                           = {};
+  SystemConfiguration              = { inherit Security; };
+  SystemExtensions                 = {};
+  TWAIN                            = { inherit Carbon; };
+  Tcl                              = {};
+  Tk                               = {};
+  USBDriverKit                     = {};
+  UniformTypeIdentifiers           = {};
+  UserNotifications                = {};
+  UserNotificationsUI              = {};
+  VideoDecodeAcceleration          = { inherit CoreVideo; };
+  VideoSubscriberAccount           = {};
+  VideoToolbox                     = { inherit CoreMedia CoreVideo; };
+  Virtualization                   = {};
+  Vision                           = {};
+  WebKit                           = { inherit ApplicationServices Carbon JavaScriptCore OpenGL libobjc; };
+  WidgetKit                        = {};
+  iTunesLibrary                    = {};
+  vmnet                            = {};
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix
new file mode 100644
index 0000000000000..f04b964f755f4
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix
@@ -0,0 +1,78 @@
+{ stdenvNoCC, buildPackages, MacOSX-SDK }:
+
+stdenvNoCC.mkDerivation {
+  pname = "libSystem";
+  version = MacOSX-SDK.version;
+
+  dontBuild = true;
+  dontUnpack = true;
+
+  nativeBuildInputs = [ buildPackages.darwin.rewrite-tbd ];
+
+  includeDirs = [
+    "CommonCrypto" "_types" "architecture" "arpa" "atm" "bank" "bsd" "bsm"
+    "corecrypto" "corpses" "default_pager" "device" "dispatch" "hfs" "i386"
+    "iokit" "kern" "libkern" "mach" "mach-o" "mach_debug" "machine" "malloc"
+    "miscfs" "net" "netinet" "netinet6" "netkey" "nfs" "os" "osfmk" "pexpert"
+    "platform" "protocols" "pthread" "rpc" "rpcsvc" "secure" "security"
+    "servers" "sys" "uuid" "vfs" "voucher" "xlocale"
+  ] ++ [
+    "arm" "xpc" "arm64"
+  ];
+
+  csu = [
+    "bundle1.o" "crt0.o" "crt1.10.5.o" "crt1.10.6.o" "crt1.o" "dylib1.10.5.o"
+    "dylib1.o" "gcrt1.o" "lazydylib1.o"
+  ];
+
+  installPhase = ''
+    mkdir -p $out/{include,lib}
+
+    for dir in $includeDirs; do
+      from=${MacOSX-SDK}/usr/include/$dir
+      if [ -e "$from" ]; then
+        cp -dr $from $out/include
+      else
+        echo "Header directory '$from' doesn't exist: skipping"
+      fi
+    done
+
+    cp -d \
+      ${MacOSX-SDK}/usr/include/*.h \
+      $out/include
+
+    rm $out/include/tk*.h $out/include/tcl*.h
+
+    cp -dr \
+      ${MacOSX-SDK}/usr/lib/libSystem.* \
+      ${MacOSX-SDK}/usr/lib/system \
+      $out/lib
+
+    # Extra libraries
+    for name in c dbm dl info m mx poll proc pthread rpcsvc util gcc_s.1 resolv; do
+      cp -d \
+        ${MacOSX-SDK}/usr/lib/lib$name.tbd \
+        ${MacOSX-SDK}/usr/lib/lib$name.*.tbd \
+        $out/lib
+    done
+
+    for f in $csu; do
+      from=${MacOSX-SDK}/usr/lib/$f
+      if [ -e "$from" ]; then
+        cp -d $from $out/lib
+      else
+        echo "Csu file '$from' doesn't exist: skipping"
+      fi
+    done
+
+    chmod u+w -R $out/lib
+    find $out -name '*.tbd' -type f | while read tbd; do
+      rewrite-tbd \
+        -c /usr/lib/libsystem.dylib:$out/lib/libsystem.dylib \
+        -p /usr/lib/system/:$out/lib/system/ \
+        -r ${builtins.storeDir} \
+        "$tbd"
+    done
+  '';
+}
+
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/libcharset.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/libcharset.nix
new file mode 100644
index 0000000000000..bf55037ab6057
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/libcharset.nix
@@ -0,0 +1,16 @@
+{ stdenvNoCC, buildPackages, MacOSX-SDK }:
+
+stdenvNoCC.mkDerivation {
+  pname = "libcharset";
+  version = MacOSX-SDK.version;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ buildPackages.darwin.checkReexportsHook ];
+
+  installPhase = ''
+    mkdir -p $out/{include,lib}
+    cp ${MacOSX-SDK}/usr/lib/libcharset* $out/lib
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/libnetwork.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/libnetwork.nix
new file mode 100644
index 0000000000000..2e5c0593bf406
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/libnetwork.nix
@@ -0,0 +1,20 @@
+{ stdenvNoCC, buildPackages, MacOSX-SDK }:
+
+let self = stdenvNoCC.mkDerivation {
+  pname = "libnetwork";
+  version = MacOSX-SDK.version;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/lib
+    cp ${MacOSX-SDK}/usr/lib/libnetwork* $out/lib
+  '';
+
+  passthru = {
+    tbdRewrites = {
+      const."/usr/lib/libnetwork.dylib" = "${self}/lib/libnetwork.dylib";
+    };
+  };
+}; in self
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix
new file mode 100644
index 0000000000000..63ef2a1c263e0
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix
@@ -0,0 +1,21 @@
+{ stdenvNoCC, MacOSX-SDK, libcharset }:
+
+let self = stdenvNoCC.mkDerivation {
+  pname = "libobjc";
+  version = MacOSX-SDK.version;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/{include,lib}
+    cp -r ${MacOSX-SDK}/usr/include/objc $out/include
+    cp ${MacOSX-SDK}/usr/lib/libobjc* $out/lib
+  '';
+
+  passthru = {
+    tbdRewrites = {
+      const."/usr/lib/libobjc.A.dylib" = "${self}/lib/libobjc.A.dylib";
+    };
+  };
+}; in self
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/libunwind.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/libunwind.nix
new file mode 100644
index 0000000000000..885780eba75cd
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/libunwind.nix
@@ -0,0 +1,24 @@
+{ stdenvNoCC, buildPackages, MacOSX-SDK }:
+
+stdenvNoCC.mkDerivation {
+  pname = "libunwind";
+  version = MacOSX-SDK.version;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ buildPackages.darwin.checkReexportsHook ];
+
+  installPhase = ''
+    mkdir -p $out/include/mach-o
+
+    cp \
+      ${MacOSX-SDK}/usr/include/libunwind.h \
+      ${MacOSX-SDK}/usr/include/unwind.h \
+      $out/include
+
+    cp \
+      ${MacOSX-SDK}/usr/include/mach-o/compact_unwind_encoding.h \
+      $out/include/mach-o
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
new file mode 100644
index 0000000000000..48b373bbd22c5
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
@@ -0,0 +1,17 @@
+{ frameworks }: with frameworks;
+# generated by hand to avoid exposing all private frameworks
+# frameworks here are only the necessary ones used by public frameworks.
+{
+  AVFCapture = {};
+  AVFCore = {};
+  AddressBookCore = { inherit ContactsPersistence; };
+  AudioToolboxCore = {};
+  ContactsPersistence = {};
+  UIFoundation = {};
+  GameCenterFoundation = {};
+  GameCenterUI = {};
+  GameCenterUICore = {};
+  URLFormatting = {};
+  SignpostMetrics = {};
+  PassKitCore = {};
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/CarbonHeaders/default.nix b/pkgs/os-specific/darwin/apple-source-releases/CarbonHeaders/default.nix
index b53c5985a21c2..25e1df3773dbf 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/CarbonHeaders/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/CarbonHeaders/default.nix
@@ -1,6 +1,6 @@
-{ lib, appleDerivation }:
+{ lib, appleDerivation', stdenvNoCC }:
 
-appleDerivation {
+appleDerivation' stdenvNoCC {
   dontBuild = true;
 
   installPhase = ''
diff --git a/pkgs/os-specific/darwin/apple-source-releases/CommonCrypto/default.nix b/pkgs/os-specific/darwin/apple-source-releases/CommonCrypto/default.nix
index 476a77c59d7f8..36013fe307ce4 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/CommonCrypto/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/CommonCrypto/default.nix
@@ -1,6 +1,6 @@
-{ lib, appleDerivation }:
+{ lib, appleDerivation', stdenvNoCC }:
 
-appleDerivation {
+appleDerivation' stdenvNoCC {
   installPhase = ''
     mkdir -p $out/include/CommonCrypto
     cp include/* $out/include/CommonCrypto
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix
index e3b3179d4a3b2..ac09a282f5121 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix
@@ -1,13 +1,14 @@
-{ lib, appleDerivation }:
+{ lib, appleDerivation', stdenv }:
+
+appleDerivation' stdenv {
 
-appleDerivation {
   prePatch = ''
     substituteInPlace Makefile \
       --replace /usr/lib /lib \
       --replace /usr/local/lib /lib \
       --replace /usr/bin "" \
       --replace /bin/ "" \
-      --replace "CC = " "CC = cc #" \
+      --replace "CC = " "#" \
       --replace "SDK_DIR = " "SDK_DIR = . #" \
 
     # Mac OS didn't support rpaths back before 10.5, but we don't care about it.
diff --git a/pkgs/os-specific/darwin/apple-source-releases/ICU/default.nix b/pkgs/os-specific/darwin/apple-source-releases/ICU/default.nix
index 032b1447463d8..cdebfe6d2f727 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/ICU/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/ICU/default.nix
@@ -1,8 +1,20 @@
-{ appleDerivation, python3 }:
+{ appleDerivation, lib, stdenv, buildPackages, python3 }:
+
+let
+  formatVersionNumeric = version:
+    let
+      versionParts = lib.versions.splitVersion version;
+      major = lib.toInt (lib.elemAt versionParts 0);
+      minor = lib.toInt (lib.elemAt versionParts 1);
+      patch = if lib.length versionParts > 2 then lib.toInt (lib.elemAt versionParts 2) else 0;
+    in toString (major * 10000 + minor * 100 + patch);
+in
 
 appleDerivation {
   nativeBuildInputs = [ python3 ];
 
+  depsBuildBuild = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [ buildPackages.stdenv.cc ];
+
   postPatch = ''
     substituteInPlace makefile \
       --replace "/usr/bin/" "" \
@@ -26,6 +38,13 @@ appleDerivation {
       --replace "&TestMailFilterCSS" "NULL"
 
     patchShebangs icuSources
+  '' + lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+
+    # This looks like a bug in the makefile. It defines ENV_BUILDHOST to
+    # propagate the correct value of CC, CXX, etc, but has the following double
+    # expansion that results in the empty string.
+    substituteInPlace makefile \
+      --replace '$($(ENV_BUILDHOST))' '$(ENV_BUILDHOST)'
   '';
 
   # APPLE is using makefile to save its default configuration and call ./configure, so we hack makeFlags
@@ -40,10 +59,21 @@ appleDerivation {
 
     "DATA_INSTALL_DIR=/share/icu/"
     "DATA_LOOKUP_DIR=$(DSTROOT)$(DATA_INSTALL_DIR)"
-
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ # darwin* platform properties are only defined on darwin
     # hack to use our lower macos version
-    "MAC_OS_X_VERSION_MIN_REQUIRED=__MAC_OS_X_VERSION_MIN_REQUIRED"
-    "OSX_HOST_VERSION_MIN_STRING=$(MACOSX_DEPLOYMENT_TARGET)"
+    "MAC_OS_X_VERSION_MIN_REQUIRED=${formatVersionNumeric stdenv.hostPlatform.darwinMinVersion}"
+    "ICU_TARGET_VERSION=-m${stdenv.hostPlatform.darwinPlatform}-version-min=${stdenv.hostPlatform.darwinMinVersion}"
+  ]
+  ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    "CROSS_BUILD=YES"
+    "BUILD_TYPE="
+    "RC_ARCHS=${stdenv.hostPlatform.darwinArch}"
+    "HOSTCC=cc"
+    "HOSTCXX=c++"
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "CXX=${stdenv.cc.targetPrefix}c++"
+    "HOSTISYSROOT="
+    "OSX_HOST_VERSION_MIN_STRING=${stdenv.buildPlatform.darwinMinVersion}"
   ];
 
   doCheck = true;
diff --git a/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix b/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
index 0ba61ccb49150..085d223bd04d8 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
@@ -1,7 +1,7 @@
-{ lib, appleDerivation, IOKitSrcs, xnu, darwin-stubs }:
+{ lib, appleDerivation', stdenv, IOKitSrcs, xnu, darwin-stubs }:
 
 # Someday it'll make sense to split these out into their own packages, but today is not that day.
-appleDerivation {
+appleDerivation' stdenv {
   srcs = lib.attrValues IOKitSrcs;
   sourceRoot = ".";
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libc/825_40_1.nix b/pkgs/os-specific/darwin/apple-source-releases/Libc/825_40_1.nix
index 29aa3d64cb08b..c9202b536583c 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libc/825_40_1.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libc/825_40_1.nix
@@ -1,6 +1,6 @@
-{ appleDerivation, ed, unifdef }:
+{ appleDerivation', stdenvNoCC, ed, unifdef }:
 
-appleDerivation {
+appleDerivation' stdenvNoCC {
   nativeBuildInputs = [ ed unifdef ];
 
   installPhase = ''
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix
index 3554a2e15b074..9bec0b103c9db 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix
@@ -1,6 +1,6 @@
-{ appleDerivation, ed, unifdef, Libc_old, Libc_10-9 }:
+{ appleDerivation', stdenvNoCC, ed, unifdef, Libc_old, Libc_10-9 }:
 
-appleDerivation {
+appleDerivation' stdenvNoCC {
   nativeBuildInputs = [ ed unifdef ];
 
   # TODO: asl.h actually comes from syslog project now
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libinfo/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libinfo/default.nix
index 5481ae74d38d4..789e536b8a7f1 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libinfo/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libinfo/default.nix
@@ -1,6 +1,6 @@
-{ appleDerivation }:
+{ appleDerivation', stdenvNoCC }:
 
-appleDerivation {
+appleDerivation' stdenvNoCC {
   installPhase = ''
     substituteInPlace xcodescripts/install_files.sh \
       --replace "/usr/local/" "/" \
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix
index df5f6b7b8fd64..6e6712f375e65 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix
@@ -1,6 +1,6 @@
-{ appleDerivation }:
+{ appleDerivation', stdenvNoCC }:
 
-appleDerivation {
+appleDerivation' stdenvNoCC {
   installPhase = ''
     mkdir -p $out/include
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libnotify/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libnotify/default.nix
index 2ee80d7026463..969e64427c9b9 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libnotify/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libnotify/default.nix
@@ -1,6 +1,6 @@
-{ appleDerivation }:
+{ appleDerivation', stdenvNoCC }:
 
-appleDerivation {
+appleDerivation' stdenvNoCC {
   installPhase = ''
     mkdir -p $out/include
     cp notify.h      $out/include
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
index 2c98dd35e39d9..cb85566b51281 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
@@ -1,9 +1,13 @@
-{ lib, appleDerivation, cpio, xnu, Libc, Libm, libdispatch, cctools, Libinfo
+{ lib, stdenv, buildPackages
+, appleDerivation', cpio, xnu, Libc, Libm, libdispatch, Libinfo
 , dyld, Csu, architecture, libclosure, CarbonHeaders, ncurses, CommonCrypto
-, copyfile, removefile, libresolv, Libnotify, libplatform, libpthread
-, mDNSResponder, launchd, libutil, hfs, darling, darwin-stubs }:
+, copyfile, removefile, libresolvHeaders, libresolv, Libnotify, libplatform, libpthread
+, mDNSResponder, launchd, libutilHeaders, hfsHeaders, darling, darwin-stubs
+, headersOnly ? false
+, withLibresolv ? !headersOnly
+}:
 
-appleDerivation {
+appleDerivation' stdenv {
   dontBuild = true;
   dontFixup = true;
 
@@ -21,13 +25,13 @@ appleDerivation {
 
     for dep in ${Libc} ${Libm} ${Libinfo} ${dyld} ${architecture} \
                ${libclosure} ${CarbonHeaders} ${libdispatch} ${ncurses.dev} \
-               ${CommonCrypto} ${copyfile} ${removefile} ${libresolv} \
+               ${CommonCrypto} ${copyfile} ${removefile} ${libresolvHeaders} \
                ${Libnotify} ${libplatform} ${mDNSResponder} ${launchd} \
-               ${libutil} ${libpthread} ${hfs}; do
+               ${libutilHeaders} ${libpthread} ${hfsHeaders}; do
       (cd $dep/include && find . -name '*.h' | cpio -pdm $out/include)
     done
 
-    (cd ${cctools.dev}/include/mach-o && find . -name '*.h' | cpio -pdm $out/include/mach-o)
+    (cd ${buildPackages.darwin.cctools.dev}/include/mach-o && find . -name '*.h' | cpio -pdm $out/include/mach-o)
 
     mkdir -p $out/include/os
 
@@ -84,6 +88,7 @@ appleDerivation {
     #define TARGET_RT_64_BIT        1
     #endif  /* __TARGETCONDITIONALS__ */
     EOF
+  '' + lib.optionalString (!headersOnly) ''
 
     # The startup object files
     cp ${Csu}/lib/* $out/lib
@@ -101,14 +106,15 @@ appleDerivation {
     for name in c dbm dl info m mx poll proc pthread rpcsvc util gcc_s.10.4 gcc_s.10.5; do
       ln -s libSystem.tbd $out/lib/lib$name.tbd
     done
+  '' + lib.optionalString withLibresolv ''
 
     # This probably doesn't belong here, but we want to stay similar to glibc, which includes resolv internally...
     cp ${libresolv}/lib/libresolv.9.dylib $out/lib/libresolv.9.dylib
-    resolv_libSystem=$(otool -L "$out/lib/libresolv.9.dylib" | tail -n +3 | grep -o "$NIX_STORE.*-\S*") || true
+    resolv_libSystem=$(${stdenv.cc.bintools.targetPrefix}otool -L "$out/lib/libresolv.9.dylib" | tail -n +3 | grep -o "$NIX_STORE.*-\S*") || true
     echo $libs
 
     chmod +w $out/lib/libresolv.9.dylib
-    install_name_tool \
+    ${stdenv.cc.bintools.targetPrefix}install_name_tool \
       -id $out/lib/libresolv.9.dylib \
       -change "$resolv_libSystem" /usr/lib/libSystem.dylib \
       $out/lib/libresolv.9.dylib
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix b/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
index b819057f0c1ad..bb09adce252e1 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
@@ -1,6 +1,6 @@
-{ appleDerivation, darwin-stubs }:
+{ appleDerivation', stdenv, darwin-stubs }:
 
-appleDerivation {
+appleDerivation' stdenv {
   phases = [ "unpackPhase" "installPhase" ];
 
   __propagatedImpureHostDeps = [
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
index b4c28e23c142a..2ca2d061591af 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
@@ -1,4 +1,4 @@
-{ lib, appleDerivation, fetchzip, bsdmake, perl, flex, bison
+{ lib, stdenv, buildPackages, appleDerivation, fetchzip, bsdmake, perl, flex, bison
 }:
 
 # this derivation sucks
@@ -16,6 +16,7 @@ let recentAdvCmds = fetchzip {
 };
 
 in appleDerivation {
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ bsdmake perl bison flex ];
   buildInputs = [ flex ];
 
@@ -61,7 +62,7 @@ in appleDerivation {
 
     bsdmake -C usr-share-locale.tproj
 
-    clang ${recentAdvCmds}/ps/*.c -o ps
+    ${stdenv.cc.targetPrefix}clang ${recentAdvCmds}/ps/*.c -o ps
   '';
 
   installPhase = ''
diff --git a/pkgs/os-specific/darwin/apple-source-releases/architecture/default.nix b/pkgs/os-specific/darwin/apple-source-releases/architecture/default.nix
index 74327bc4c4285..e0e27255b72f4 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/architecture/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/architecture/default.nix
@@ -1,6 +1,6 @@
-{ lib, appleDerivation }:
+{ lib, appleDerivation', stdenvNoCC }:
 
-appleDerivation {
+appleDerivation' stdenvNoCC {
   dontBuild = true;
 
   postPatch = ''
diff --git a/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix
index 800da92dae9d5..ff98ed88804ce 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix
@@ -1,4 +1,13 @@
-{ lib, stdenv, appleDerivation, bison, flex }:
+{ lib, appleDerivation, stdenv, bison, flex }:
+
+let
+
+  # Hard to get CC to pull this off without infinite recursion
+  targetTargetPrefix = lib.optionalString
+    (with stdenv; hostPlatform != targetPlatform)
+    (stdenv.targetPlatform.config + "-");
+
+in
 
 appleDerivation {
   nativeBuildInputs = [ bison flex ];
@@ -12,7 +21,7 @@ appleDerivation {
     yacc -d parser.y
     flex --header-file=lexxer.yy.h -o lexxer.yy.c lexxer.l
 
-    cc -std=gnu99 -Os -dead_strip -DMIG_VERSION=\"$pname-$version\" -I. -o migcom *.c
+    $CC -std=gnu99 -Os -dead_strip -DMIG_VERSION=\"$pname-$version\" -I. -o migcom *.c
   '';
 
   installPhase = ''
@@ -29,6 +38,6 @@ appleDerivation {
       --replace 'arch=`/usr/bin/arch`' 'arch=${stdenv.targetPlatform.darwinArch}' \
       --replace '/usr/bin/' "" \
       --replace '/bin/rmdir' "rmdir" \
-      --replace 'C=''${MIGCC}' "C=cc"
+      --replace 'C=''${MIGCC}' "C=${targetTargetPrefix}cc"
   '';
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix b/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix
index 20168d24dd712..879d3a7b5f79f 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, appleDerivation, launchd, bootstrap_cmds, xnu, ppp, IOKit, eap8021x, Security }:
+{ stdenv, appleDerivation', launchd, bootstrap_cmds, xnu, ppp, IOKit, eap8021x, Security }:
 
-appleDerivation {
+appleDerivation' stdenv {
   meta.broken = stdenv.cc.nativeLibc;
 
   nativeBuildInputs = [ bootstrap_cmds ];
@@ -127,78 +127,78 @@ appleDerivation {
     mig -arch x86_64 -header derived/helper.h          -user derived/helperUser.c          -sheader /dev/null -server /dev/null helper/helper.defs
     mig -arch x86_64 -header derived/pppcontroller.h   -user derived/pppcontrollerUser.c   -sheader /dev/null -server /dev/null pppcontroller.defs
 
-    cc -I. -Ihelper -Iderived -F. -c SCSchemaDefinitions.c -o SCSchemaDefinitions.o
-    cc -I. -Ihelper -Iderived -F. -c SCD.c -o SCD.o
-    cc -I. -Ihelper -Iderived -F. -c SCDKeys.c -o SCDKeys.o
-    cc -I. -Ihelper -Iderived -F. -c SCDPrivate.c -o SCDPrivate.o
-    cc -I. -Ihelper -Iderived -F. -c SCDPlugin.c -o SCDPlugin.o
-    cc -I. -Ihelper -Iderived -F. -c CaptiveNetwork.c -o CaptiveNetwork.o
-    cc -I. -Ihelper -Iderived -F. -c SCDOpen.c -o SCDOpen.o
-    cc -I. -Ihelper -Iderived -F. -c SCDList.c -o SCDList.o
-    cc -I. -Ihelper -Iderived -F. -c SCDAdd.c -o SCDAdd.o
-    cc -I. -Ihelper -Iderived -F. -c SCDGet.c -o SCDGet.o
-    cc -I. -Ihelper -Iderived -F. -c SCDSet.c -o SCDSet.o
-    cc -I. -Ihelper -Iderived -F. -c SCDRemove.c -o SCDRemove.o
-    cc -I. -Ihelper -Iderived -F. -c SCDNotify.c -o SCDNotify.o
-    cc -I. -Ihelper -Iderived -F. -c SCDNotifierSetKeys.c -o SCDNotifierSetKeys.o
-    cc -I. -Ihelper -Iderived -F. -c SCDNotifierAdd.c -o SCDNotifierAdd.o
-    cc -I. -Ihelper -Iderived -F. -c SCDNotifierRemove.c -o SCDNotifierRemove.o
-    cc -I. -Ihelper -Iderived -F. -c SCDNotifierGetChanges.c -o SCDNotifierGetChanges.o
-    cc -I. -Ihelper -Iderived -F. -c SCDNotifierWait.c -o SCDNotifierWait.o
-    cc -I. -Ihelper -Iderived -F. -c SCDNotifierInformViaCallback.c -o SCDNotifierInformViaCallback.o
-    cc -I. -Ihelper -Iderived -F. -c SCDNotifierInformViaFD.c -o SCDNotifierInformViaFD.o
-    cc -I. -Ihelper -Iderived -F. -c SCDNotifierInformViaSignal.c -o SCDNotifierInformViaSignal.o
-    cc -I. -Ihelper -Iderived -F. -c SCDNotifierCancel.c -o SCDNotifierCancel.o
-    cc -I. -Ihelper -Iderived -F. -c SCDSnapshot.c -o SCDSnapshot.o
-    cc -I. -Ihelper -Iderived -F. -c SCP.c -o SCP.o
-    cc -I. -Ihelper -Iderived -F. -c SCPOpen.c -o SCPOpen.o
-    cc -I. -Ihelper -Iderived -F. -c SCPLock.c -o SCPLock.o
-    cc -I. -Ihelper -Iderived -F. -c SCPUnlock.c -o SCPUnlock.o
-    cc -I. -Ihelper -Iderived -F. -c SCPList.c -o SCPList.o
-    cc -I. -Ihelper -Iderived -F. -c SCPGet.c -o SCPGet.o
-    cc -I. -Ihelper -Iderived -F. -c SCPAdd.c -o SCPAdd.o
-    cc -I. -Ihelper -Iderived -F. -c SCPSet.c -o SCPSet.o
-    cc -I. -Ihelper -Iderived -F. -c SCPRemove.c -o SCPRemove.o
-    cc -I. -Ihelper -Iderived -F. -c SCPCommit.c -o SCPCommit.o
-    cc -I. -Ihelper -Iderived -F. -c SCPApply.c -o SCPApply.o
-    cc -I. -Ihelper -Iderived -F. -c SCPPath.c -o SCPPath.o
-    cc -I. -Ihelper -Iderived -F. -c SCDConsoleUser.c -o SCDConsoleUser.o
-    cc -I. -Ihelper -Iderived -F. -c SCDHostName.c -o SCDHostName.o
-    cc -I. -Ihelper -Iderived -F. -c SCLocation.c -o SCLocation.o
-    cc -I. -Ihelper -Iderived -F. -c SCNetwork.c -o SCNetwork.o
-    cc -I. -Ihelper -Iderived -F. -c derived/pppcontrollerUser.c -o pppcontrollerUser.o
-    cc -I. -Ihelper -Iderived -F. -c SCNetworkConnection.c -o SCNetworkConnection.o
-    cc -I. -Ihelper -Iderived -F. -c SCNetworkConnectionPrivate.c -o SCNetworkConnectionPrivate.o
-    cc -I. -Ihelper -Iderived -I../dnsinfo -F. -c SCNetworkReachability.c -o SCNetworkReachability.o
-    cc -I. -Ihelper -Iderived -F. -c SCProxies.c -o SCProxies.o
-    cc -I. -Ihelper -Iderived -F. -c DHCP.c -o DHCP.o
-    cc -I. -Ihelper -Iderived -F. -c moh.c -o moh.o
-    cc -I. -Ihelper -Iderived -F. -c DeviceOnHold.c -o DeviceOnHold.o
-    cc -I. -Ihelper -Iderived -I $HACK -F. -c LinkConfiguration.c -o LinkConfiguration.o
-    cc -I. -Ihelper -Iderived -F. -c dy_framework.c -o dy_framework.o
-    cc -I. -Ihelper -Iderived -I $HACK -F. -c VLANConfiguration.c -o VLANConfiguration.o
-    cc -I. -Ihelper -Iderived -F. -c derived/configUser.c -o configUser.o
-    cc -I. -Ihelper -Iderived -F. -c SCPreferencesPathKey.c -o SCPreferencesPathKey.o
-    cc -I. -Ihelper -Iderived -I../dnsinfo -F. -c derived/shared_dns_infoUser.c -o shared_dns_infoUser.o
-    cc -I. -Ihelper -Iderived -F. -c SCNetworkConfigurationInternal.c -o SCNetworkConfigurationInternal.o
-    cc -I. -Ihelper -Iderived -F. -c SCNetworkInterface.c -o SCNetworkInterface.o
-    cc -I. -Ihelper -Iderived -F. -c SCNetworkProtocol.c -o SCNetworkProtocol.o
-    cc -I. -Ihelper -Iderived -F. -c SCNetworkService.c -o SCNetworkService.o
-    cc -I. -Ihelper -Iderived -F. -c SCNetworkSet.c -o SCNetworkSet.o
-    cc -I. -Ihelper -Iderived -I $HACK -F. -c BondConfiguration.c -o BondConfiguration.o
-    cc -I. -Ihelper -Iderived -I $HACK -F. -c BridgeConfiguration.c -o BridgeConfiguration.o
-    cc -I. -Ihelper -Iderived -F. -c helper/SCHelper_client.c -o SCHelper_client.o
-    cc -I. -Ihelper -Iderived -F. -c SCPreferencesKeychainPrivate.c -o SCPreferencesKeychainPrivate.o
-    cc -I. -Ihelper -Iderived -F. -c SCNetworkSignature.c -o SCNetworkSignature.o
-    cc -I. -Ihelper -Iderived -F. -c VPNPrivate.c -o VPNPrivate.o
-    cc -I. -Ihelper -Iderived -F. -c VPNConfiguration.c -o VPNConfiguration.o
-    cc -I. -Ihelper -Iderived -F. -c VPNTunnel.c -o VPNTunnel.o
-    cc -I. -Ihelper -Iderived -F. -c derived/helperUser.c -o helperUser.o
-    cc -I. -Ihelper -Iderived -F. -c reachability/SCNetworkReachabilityServer_client.c -o SCNetworkReachabilityServer_client.o
-    cc -I. -Ihelper -Iderived -F. -c reachability/rb.c -o rb.o
-    cc -I. -Ihelper -Iderived -F. -c derived/SystemConfiguration_vers.c -o SystemConfiguration_vers.o
-
-    cc -dynamiclib *.o -install_name $out/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration -dead_strip -framework CoreFoundation -single_module -o SystemConfiguration.framework/SystemConfiguration
+    $CC -I. -Ihelper -Iderived -F. -c SCSchemaDefinitions.c -o SCSchemaDefinitions.o
+    $CC -I. -Ihelper -Iderived -F. -c SCD.c -o SCD.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDKeys.c -o SCDKeys.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDPrivate.c -o SCDPrivate.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDPlugin.c -o SCDPlugin.o
+    $CC -I. -Ihelper -Iderived -F. -c CaptiveNetwork.c -o CaptiveNetwork.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDOpen.c -o SCDOpen.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDList.c -o SCDList.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDAdd.c -o SCDAdd.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDGet.c -o SCDGet.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDSet.c -o SCDSet.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDRemove.c -o SCDRemove.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDNotify.c -o SCDNotify.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDNotifierSetKeys.c -o SCDNotifierSetKeys.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDNotifierAdd.c -o SCDNotifierAdd.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDNotifierRemove.c -o SCDNotifierRemove.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDNotifierGetChanges.c -o SCDNotifierGetChanges.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDNotifierWait.c -o SCDNotifierWait.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDNotifierInformViaCallback.c -o SCDNotifierInformViaCallback.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDNotifierInformViaFD.c -o SCDNotifierInformViaFD.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDNotifierInformViaSignal.c -o SCDNotifierInformViaSignal.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDNotifierCancel.c -o SCDNotifierCancel.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDSnapshot.c -o SCDSnapshot.o
+    $CC -I. -Ihelper -Iderived -F. -c SCP.c -o SCP.o
+    $CC -I. -Ihelper -Iderived -F. -c SCPOpen.c -o SCPOpen.o
+    $CC -I. -Ihelper -Iderived -F. -c SCPLock.c -o SCPLock.o
+    $CC -I. -Ihelper -Iderived -F. -c SCPUnlock.c -o SCPUnlock.o
+    $CC -I. -Ihelper -Iderived -F. -c SCPList.c -o SCPList.o
+    $CC -I. -Ihelper -Iderived -F. -c SCPGet.c -o SCPGet.o
+    $CC -I. -Ihelper -Iderived -F. -c SCPAdd.c -o SCPAdd.o
+    $CC -I. -Ihelper -Iderived -F. -c SCPSet.c -o SCPSet.o
+    $CC -I. -Ihelper -Iderived -F. -c SCPRemove.c -o SCPRemove.o
+    $CC -I. -Ihelper -Iderived -F. -c SCPCommit.c -o SCPCommit.o
+    $CC -I. -Ihelper -Iderived -F. -c SCPApply.c -o SCPApply.o
+    $CC -I. -Ihelper -Iderived -F. -c SCPPath.c -o SCPPath.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDConsoleUser.c -o SCDConsoleUser.o
+    $CC -I. -Ihelper -Iderived -F. -c SCDHostName.c -o SCDHostName.o
+    $CC -I. -Ihelper -Iderived -F. -c SCLocation.c -o SCLocation.o
+    $CC -I. -Ihelper -Iderived -F. -c SCNetwork.c -o SCNetwork.o
+    $CC -I. -Ihelper -Iderived -F. -c derived/pppcontrollerUser.c -o pppcontrollerUser.o
+    $CC -I. -Ihelper -Iderived -F. -c SCNetworkConnection.c -o SCNetworkConnection.o
+    $CC -I. -Ihelper -Iderived -F. -c SCNetworkConnectionPrivate.c -o SCNetworkConnectionPrivate.o
+    $CC -I. -Ihelper -Iderived -I../dnsinfo -F. -c SCNetworkReachability.c -o SCNetworkReachability.o
+    $CC -I. -Ihelper -Iderived -F. -c SCProxies.c -o SCProxies.o
+    $CC -I. -Ihelper -Iderived -F. -c DHCP.c -o DHCP.o
+    $CC -I. -Ihelper -Iderived -F. -c moh.c -o moh.o
+    $CC -I. -Ihelper -Iderived -F. -c DeviceOnHold.c -o DeviceOnHold.o
+    $CC -I. -Ihelper -Iderived -I $HACK -F. -c LinkConfiguration.c -o LinkConfiguration.o
+    $CC -I. -Ihelper -Iderived -F. -c dy_framework.c -o dy_framework.o
+    $CC -I. -Ihelper -Iderived -I $HACK -F. -c VLANConfiguration.c -o VLANConfiguration.o
+    $CC -I. -Ihelper -Iderived -F. -c derived/configUser.c -o configUser.o
+    $CC -I. -Ihelper -Iderived -F. -c SCPreferencesPathKey.c -o SCPreferencesPathKey.o
+    $CC -I. -Ihelper -Iderived -I../dnsinfo -F. -c derived/shared_dns_infoUser.c -o shared_dns_infoUser.o
+    $CC -I. -Ihelper -Iderived -F. -c SCNetworkConfigurationInternal.c -o SCNetworkConfigurationInternal.o
+    $CC -I. -Ihelper -Iderived -F. -c SCNetworkInterface.c -o SCNetworkInterface.o
+    $CC -I. -Ihelper -Iderived -F. -c SCNetworkProtocol.c -o SCNetworkProtocol.o
+    $CC -I. -Ihelper -Iderived -F. -c SCNetworkService.c -o SCNetworkService.o
+    $CC -I. -Ihelper -Iderived -F. -c SCNetworkSet.c -o SCNetworkSet.o
+    $CC -I. -Ihelper -Iderived -I $HACK -F. -c BondConfiguration.c -o BondConfiguration.o
+    $CC -I. -Ihelper -Iderived -I $HACK -F. -c BridgeConfiguration.c -o BridgeConfiguration.o
+    $CC -I. -Ihelper -Iderived -F. -c helper/SCHelper_client.c -o SCHelper_client.o
+    $CC -I. -Ihelper -Iderived -F. -c SCPreferencesKeychainPrivate.c -o SCPreferencesKeychainPrivate.o
+    $CC -I. -Ihelper -Iderived -F. -c SCNetworkSignature.c -o SCNetworkSignature.o
+    $CC -I. -Ihelper -Iderived -F. -c VPNPrivate.c -o VPNPrivate.o
+    $CC -I. -Ihelper -Iderived -F. -c VPNConfiguration.c -o VPNConfiguration.o
+    $CC -I. -Ihelper -Iderived -F. -c VPNTunnel.c -o VPNTunnel.o
+    $CC -I. -Ihelper -Iderived -F. -c derived/helperUser.c -o helperUser.o
+    $CC -I. -Ihelper -Iderived -F. -c reachability/SCNetworkReachabilityServer_client.c -o SCNetworkReachabilityServer_client.o
+    $CC -I. -Ihelper -Iderived -F. -c reachability/rb.c -o rb.o
+    $CC -I. -Ihelper -Iderived -F. -c derived/SystemConfiguration_vers.c -o SystemConfiguration_vers.o
+
+    $CC -dynamiclib *.o -install_name $out/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration -dead_strip -framework CoreFoundation -single_module -o SystemConfiguration.framework/SystemConfiguration
 
     popd >/dev/null
   '';
diff --git a/pkgs/os-specific/darwin/apple-source-releases/copyfile/default.nix b/pkgs/os-specific/darwin/apple-source-releases/copyfile/default.nix
index 7e1dc5309b1d0..5e7f38e84d7d8 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/copyfile/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/copyfile/default.nix
@@ -1,6 +1,6 @@
-{ appleDerivation }:
+{ appleDerivation', stdenvNoCC }:
 
-appleDerivation {
+appleDerivation' stdenvNoCC {
   dontBuild = true;
   installPhase = ''
     mkdir -p $out/include/
diff --git a/pkgs/os-specific/darwin/apple-source-releases/default.nix b/pkgs/os-specific/darwin/apple-source-releases/default.nix
index 3e431810f20d9..5e098926d2968 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, stdenvNoCC, fetchurl, fetchzip, pkgs }:
+{ lib, stdenv, fetchurl, fetchzip, pkgs }:
 
 let
   # This attrset can in theory be computed automatically, but for that to work nicely we need
@@ -154,7 +154,7 @@ let
     version = versions.${sdkName}.${pname};
   in fetchApple' pname version sha256;
 
-  appleDerivation' = pname: version: sdkName: sha256: attrs: stdenv.mkDerivation ({
+  appleDerivation'' = stdenv: pname: version: sdkName: sha256: attrs: stdenv.mkDerivation ({
     inherit pname version;
 
     src = if attrs ? srcs then null else (fetchApple' pname version sha256);
@@ -223,8 +223,9 @@ let
   applePackage' = namePath: version: sdkName: sha256:
     let
       pname = builtins.head (lib.splitString "/" namePath);
-      appleDerivation = appleDerivation' pname version sdkName sha256;
-      callPackage = self.newScope { inherit appleDerivation; };
+      appleDerivation' = stdenv: appleDerivation'' stdenv pname version sdkName sha256;
+      appleDerivation = appleDerivation' stdenv;
+      callPackage = self.newScope { inherit appleDerivation' appleDerivation; };
     in callPackage (./. + "/${namePath}");
 
   applePackage = namePath: sdkName: sha256: let
@@ -272,17 +273,16 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     libplatform     = applePackage "libplatform"       "osx-10.12.6"     "0rh1f5ybvwz8s0nwfar8s0fh7jbgwqcy903cv2x8m15iq1x599yn" {};
     libpthread      = applePackage "libpthread"        "osx-10.12.6"     "1j6541rcgjpas1fc77ip5krjgw4bvz6jq7bq7h9q7axb0jv2ns6c" {};
     libresolv       = applePackage "libresolv"         "osx-10.12.6"     "077j6ljfh7amqpk2146rr7dsz5vasvr3als830mgv5jzl7l6vz88" {};
-    Libsystem       = applePackage "Libsystem"         "osx-10.12.6"     "1082ircc1ggaq3wha218vmfa75jqdaqidsy1bmrc4ckfkbr3bwx2" {
-      libutil = pkgs.darwin.libutil.override { headersOnly = true; };
-      hfs = pkgs.darwin.hfs.override { headersOnly = true; };
-    };
+    Libsystem       = applePackage "Libsystem"         "osx-10.12.6"     "1082ircc1ggaq3wha218vmfa75jqdaqidsy1bmrc4ckfkbr3bwx2" {};
     libutil         = applePackage "libutil"           "osx-10.12.6"     "0lqdxaj82h8yjbjm856jjz9k2d96k0viimi881akfng08xk1246y" {};
     libunwind       = applePackage "libunwind"         "osx-10.12.6"     "0miffaa41cv0lzf8az5k1j1ng8jvqvxcr4qrlkf3xyj479arbk1b" {};
     mDNSResponder   = applePackage "mDNSResponder"     "osx-10.12.6"     "02ms1p8zlgmprzn65jzr7yaqxykh3zxjcrw0c06aayim6h0dsqfy" {};
     objc4           = applePackage "objc4"             "osx-10.12.6"     "1cj1vhbcs9pkmag2ms8wslagicnq9bxi2qjkszmp3ys7z7ccrbwz" {};
     ppp             = applePackage "ppp"               "osx-10.12.6"     "1kcc2nc4x1kf8sz0a23i6nfpvxg381kipi0qdisrp8x9z2gbkxb8" {};
     removefile      = applePackage "removefile"        "osx-10.12.6"     "0jzjxbmxgjzhssqd50z7kq9dlwrv5fsdshh57c0f8mdwcs19bsyx" {};
-    xnu             = applePackage "xnu"               "osx-10.12.6"     "1sjb0i7qzz840v2h4z3s4jyjisad4r5yyi6sg8pakv3wd81i5fg5" {};
+    xnu             = applePackage "xnu"               "osx-10.12.6"     "1sjb0i7qzz840v2h4z3s4jyjisad4r5yyi6sg8pakv3wd81i5fg5" {
+      python3 = pkgs.buildPackages.buildPackages.python3; # TODO(@Ericson2314) this shouldn't be needed.
+    };
     hfs             = applePackage "hfs"               "osx-10.12.6"     "1mj3xvqpq1mgd80b6kl1s04knqnap7hccr0gz8rjphalq14rbl5g" {};
     Librpcsvc       = applePackage "Librpcsvc"         "osx-10.11.6"     "1zwfwcl9irxl1dlnf2b4v30vdybp0p0r6n6g1pd14zbdci1jcg2k" {};
     adv_cmds        = applePackage "adv_cmds"          "osx-10.11.6"    "12gbv35i09aij9g90p6b3x2f3ramw43qcb2gjrg8lzkzmwvcyw9q" {};
@@ -297,6 +297,10 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     top             = applePackage "top"               "osx-10.11.6"     "0i9120rfwapgwdvjbfg0ya143i29s1m8zbddsxh39pdc59xnsg5l" {};
     PowerManagement = applePackage "PowerManagement"   "osx-10.11.6"     "1llimhvp0gjffd47322lnjq7cqwinx0c5z7ikli04ad5srpa68mh" {};
 
+    libutilHeaders  = pkgs.darwin.libutil.override { headersOnly = true; };
+    hfsHeaders      = pkgs.darwin.hfs.override { headersOnly = true; };
+    libresolvHeaders= pkgs.darwin.libresolv.override { headersOnly = true; };
+
     # TODO(matthewbauer):
     # To be removed, once I figure out how to build a newer Security version.
     Security        = applePackage "Security/boot.nix" "osx-10.9.5"      "1nv0dczf67dhk17hscx52izgdcyacgyy12ag0jh6nl5hmfzsn8yy" {};
diff --git a/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
index 77de079e2f0f4..f2c4ec32146f2 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
@@ -1,7 +1,7 @@
-{ lib, appleDerivation, xcbuildHook, llvmPackages }:
+{ lib, appleDerivation, xcbuildHook, llvmPackages, makeWrapper }:
 
 appleDerivation {
-  nativeBuildInputs = [ xcbuildHook ];
+  nativeBuildInputs = [ xcbuildHook makeWrapper ];
 
   patches = [
     # The following copied from
@@ -11,8 +11,9 @@ appleDerivation {
   ];
 
   postPatch = ''
+    makeWrapper ${llvmPackages.clang}/bin/clang $out/bin/clang-cpp --add-flags "--driver-mode=cpp"
     substituteInPlace rpcgen/rpc_main.c \
-      --replace "/usr/bin/cpp" "${llvmPackages.clang-unwrapped}/bin/clang-cpp"
+      --replace "/usr/bin/cpp" "$out/bin/clang-cpp"
   '';
 
   # temporary install phase until xcodebuild has "install" support
diff --git a/pkgs/os-specific/darwin/apple-source-releases/dyld/default.nix b/pkgs/os-specific/darwin/apple-source-releases/dyld/default.nix
index 01d44d22f5ef0..ca3b70cd09264 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/dyld/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/dyld/default.nix
@@ -1,6 +1,6 @@
-{ lib, appleDerivation }:
+{ lib, appleDerivation', stdenvNoCC }:
 
-appleDerivation {
+appleDerivation' stdenvNoCC {
   installPhase = ''
     mkdir -p $out/lib $out/include
     ln -s /usr/lib/dyld $out/lib/dyld
diff --git a/pkgs/os-specific/darwin/apple-source-releases/eap8021x/default.nix b/pkgs/os-specific/darwin/apple-source-releases/eap8021x/default.nix
index b24d94b9d70d8..f5c47f01d37a9 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/eap8021x/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/eap8021x/default.nix
@@ -1,6 +1,6 @@
-{ appleDerivation }:
+{ appleDerivation', stdenv }:
 
-appleDerivation {
+appleDerivation' stdenv {
   dontBuild = true;
   installPhase = ''
     mkdir -p $out/Library/Frameworks/EAP8021X.framework/Headers
diff --git a/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
index 53f98e2b457e3..981e1370437d6 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
@@ -1,8 +1,8 @@
-{ lib, appleDerivation, xcbuildHook, zlib, bzip2, xz, ncurses, libutil }:
+{ lib, appleDerivation, xcbuildHook, zlib, bzip2, xz, ncurses, libutil, Libinfo }:
 
 appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
-  buildInputs = [ zlib bzip2 xz ncurses libutil ];
+  buildInputs = [ zlib bzip2 xz ncurses libutil Libinfo ];
 
   # some commands not working:
   # mtree: _simple.h not found
diff --git a/pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix b/pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix
index 58bac765a959c..093e8525e5877 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix
@@ -1,6 +1,6 @@
-{ appleDerivation, lib, headersOnly ? true }:
+{ appleDerivation', stdenv, stdenvNoCC, lib, headersOnly ? true }:
 
-appleDerivation {
+appleDerivation' (if headersOnly then stdenvNoCC else stdenv) {
   installPhase = lib.optionalString headersOnly ''
     mkdir -p $out/include/hfs
     cp core/*.h $out/include/hfs
diff --git a/pkgs/os-specific/darwin/apple-source-releases/launchd/default.nix b/pkgs/os-specific/darwin/apple-source-releases/launchd/default.nix
index c882b83d0a384..67e051d56853e 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/launchd/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/launchd/default.nix
@@ -1,6 +1,6 @@
-{ appleDerivation }:
+{ appleDerivation', stdenvNoCC }:
 
-appleDerivation {
+appleDerivation' stdenvNoCC {
   # No clue why the same file has two different names. Ask Apple!
   installPhase = ''
     mkdir -p $out/include/ $out/include/servers
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libclosure/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libclosure/default.nix
index d42a288208c5b..976658b7e5ddc 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libclosure/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libclosure/default.nix
@@ -1,6 +1,6 @@
-{ appleDerivation }:
+{ appleDerivation', stdenvNoCC }:
 
-appleDerivation {
+appleDerivation' stdenvNoCC {
   installPhase = ''
     mkdir -p $out/include
     cp *.h $out/include/
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
index 3b9d4a34cc63a..e91ee86cde08f 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
@@ -1,6 +1,6 @@
-{ appleDerivation }:
+{ appleDerivation', stdenvNoCC }:
 
-appleDerivation {
+appleDerivation' stdenvNoCC {
   dontConfigure = true;
   dontBuild = true;
   installPhase = ''
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libplatform/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libplatform/default.nix
index 9acbcb212e4d8..39c801962692f 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libplatform/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libplatform/default.nix
@@ -1,6 +1,6 @@
-{ appleDerivation }:
+{ appleDerivation', stdenvNoCC }:
 
-appleDerivation {
+appleDerivation' stdenvNoCC {
   installPhase = ''
     mkdir $out
     cp -r include $out/include
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libpthread/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libpthread/default.nix
index 20eccd8205970..3d62270d76c0d 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libpthread/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libpthread/default.nix
@@ -1,6 +1,6 @@
-{ lib, appleDerivation, libdispatch, xnu }:
+{ lib, appleDerivation', stdenvNoCC, libdispatch, xnu }:
 
-appleDerivation {
+appleDerivation' stdenvNoCC {
   propagatedBuildInputs = [ libdispatch xnu ];
 
   installPhase = ''
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libresolv/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libresolv/default.nix
index f3c7558cfc626..53fc019768dd4 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libresolv/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libresolv/default.nix
@@ -1,37 +1,39 @@
-{ appleDerivation, Libinfo, configd, mDNSResponder }:
+{ lib, appleDerivation', stdenv, stdenvNoCC, Libinfo, configd, mDNSResponder
+, headersOnly ? false
+}:
 
-appleDerivation {
-  buildInputs = [ Libinfo configd mDNSResponder ];
+appleDerivation' (if headersOnly then stdenvNoCC else stdenv) {
+  buildInputs = lib.optionals (!headersOnly) [ Libinfo configd mDNSResponder ];
 
-  buildPhase = ''
-    cc -I. -c dns_util.c
-    cc -I. -c dns.c
-    cc -I. -c dns_async.c
-    cc -I. -c base64.c
-    cc -I. -c dst_api.c
-    cc -I. -c dst_hmac_link.c
-    cc -I. -c dst_support.c
-    cc -I. -c ns_date.c
-    cc -I. -c ns_name.c
-    cc -I. -c ns_netint.c
-    cc -I. -c ns_parse.c
-    cc -I. -c ns_print.c
-    cc -I. -c ns_samedomain.c
-    cc -I. -c ns_sign.c
-    cc -I. -c ns_ttl.c
-    cc -I. -c ns_verify.c
-    cc -I. -c res_comp.c
-    cc -I. -c res_data.c
-    cc -I. -c res_debug.c
-    cc -I. -c res_findzonecut.c
-    cc -I. -c res_init.c
-    cc -I. -c res_mkquery.c
-    cc -I. -c res_mkupdate.c
-    cc -I. -c res_query.c
-    cc -I. -c res_send.c
-    cc -I. -c res_sendsigned.c
-    cc -I. -c res_update.c
-    cc -dynamiclib -install_name $out/lib/libresolv.9.dylib -current_version 1.0.0 -compatibility_version 1.0.0 -o libresolv.9.dylib *.o
+  buildPhase = lib.optionalString (!headersOnly) ''
+    $CC -I. -c dns_util.c
+    $CC -I. -c dns.c
+    $CC -I. -c dns_async.c
+    $CC -I. -c base64.c
+    $CC -I. -c dst_api.c
+    $CC -I. -c dst_hmac_link.c
+    $CC -I. -c dst_support.c
+    $CC -I. -c ns_date.c
+    $CC -I. -c ns_name.c
+    $CC -I. -c ns_netint.c
+    $CC -I. -c ns_parse.c
+    $CC -I. -c ns_print.c
+    $CC -I. -c ns_samedomain.c
+    $CC -I. -c ns_sign.c
+    $CC -I. -c ns_ttl.c
+    $CC -I. -c ns_verify.c
+    $CC -I. -c res_comp.c
+    $CC -I. -c res_data.c
+    $CC -I. -c res_debug.c
+    $CC -I. -c res_findzonecut.c
+    $CC -I. -c res_init.c
+    $CC -I. -c res_mkquery.c
+    $CC -I. -c res_mkupdate.c
+    $CC -I. -c res_query.c
+    $CC -I. -c res_send.c
+    $CC -I. -c res_sendsigned.c
+    $CC -I. -c res_update.c
+    $CC -dynamiclib -install_name $out/lib/libresolv.9.dylib -current_version 1.0.0 -compatibility_version 1.0.0 -o libresolv.9.dylib *.o
   '';
 
   installPhase = ''
@@ -42,6 +44,7 @@ appleDerivation {
     cp nameser.h       $out/include
     ln -s ../nameser.h $out/include/arpa
     cp resolv.h        $out/include
+  '' + lib.optionalString (!headersOnly) ''
 
     cp libresolv.9.dylib $out/lib
     ln -s libresolv.9.dylib $out/lib/libresolv.dylib
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
index ea9ca75e7e54b..e7c8a6b1113b2 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
@@ -1,9 +1,9 @@
-{ lib, appleDerivation, xcbuildHook
+{ lib, stdenv, stdenvNoCC, appleDerivation', xcbuildHook
 
 # headersOnly is true when building for libSystem
 , headersOnly ? false }:
 
-appleDerivation {
+appleDerivation' (if headersOnly then stdenvNoCC else stdenv) {
   nativeBuildInputs = lib.optional (!headersOnly) xcbuildHook;
 
   prePatch = ''
diff --git a/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix b/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix
index f17ed785360d9..64de728805fd3 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix
@@ -1,6 +1,6 @@
-{ appleDerivation }:
+{ appleDerivation', stdenvNoCC }:
 
-appleDerivation {
+appleDerivation' stdenvNoCC {
   phases = [ "unpackPhase" "installPhase" ];
 
   installPhase = ''
diff --git a/pkgs/os-specific/darwin/apple-source-releases/ppp/default.nix b/pkgs/os-specific/darwin/apple-source-releases/ppp/default.nix
index 5668c376130e7..4ced564ffb722 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/ppp/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/ppp/default.nix
@@ -1,6 +1,6 @@
-{ appleDerivation }:
+{ appleDerivation', stdenv }:
 
-appleDerivation {
+appleDerivation' stdenv {
   dontBuild = true;
   installPhase = ''
     mkdir -p $out/include/ppp
diff --git a/pkgs/os-specific/darwin/apple-source-releases/removefile/default.nix b/pkgs/os-specific/darwin/apple-source-releases/removefile/default.nix
index 0b2c1c9c7dcc3..611f445e1ec94 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/removefile/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/removefile/default.nix
@@ -1,6 +1,6 @@
-{ appleDerivation }:
+{ appleDerivation', stdenvNoCC }:
 
-appleDerivation {
+appleDerivation' stdenvNoCC {
   installPhase = ''
     mkdir -p $out/include/
     cp removefile.h checkint.h $out/include/
diff --git a/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
index e2e13a168f04c..a8352285c78e0 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
@@ -1,7 +1,7 @@
-{ lib, appleDerivation, xcbuildHook }:
+{ lib, appleDerivation, xcbuildHook, launchd }:
 
 appleDerivation {
-  nativeBuildInputs = [ xcbuildHook ];
+  nativeBuildInputs = [ xcbuildHook launchd ];
 
   patchPhase = ''
     # NOTE: these hashes must be recalculated for each version change
diff --git a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
index 34d093b7cc002..d42d142ef6ee7 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
@@ -1,5 +1,5 @@
 { stdenv, appleDerivation, lib
-, Librpcsvc, apple_sdk, pam, CF, openbsm }:
+, libutil, Librpcsvc, apple_sdk, pam, CF, openbsm }:
 
 appleDerivation {
   # xcbuild fails with:
@@ -7,7 +7,7 @@ appleDerivation {
   # see issue facebook/xcbuild#188
   # buildInputs = [ xcbuild ];
 
-  buildInputs = [ Librpcsvc apple_sdk.frameworks.OpenDirectory pam CF
+  buildInputs = [ libutil Librpcsvc apple_sdk.frameworks.OpenDirectory pam CF
                   apple_sdk.frameworks.IOKit openbsm ];
   # NIX_CFLAGS_COMPILE = lib.optionalString hostPlatform.isi686 "-D__i386__"
   #                    + lib.optionalString hostPlatform.isx86_64 "-D__x86_64__"
@@ -35,6 +35,11 @@ appleDerivation {
       --replace bsm/audit_session.h bsm/audit.h
     substituteInPlace login.tproj/login_audit.c \
       --replace bsm/audit_session.h bsm/audit.h
+  '' + lib.optionalString stdenv.isAarch64 ''
+    substituteInPlace sysctl.tproj/sysctl.c \
+      --replace "GPROF_STATE" "0"
+    substituteInPlace login.tproj/login.c \
+      --replace "defined(__arm__)" "defined(__arm__) || defined(__arm64__)"
   '';
 
   buildPhase = ''
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
index 9892814468e9b..90f572d3940d6 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@@ -1,8 +1,12 @@
-{ appleDerivation, lib, bootstrap_cmds, bison, flex
+{ appleDerivation', lib, stdenv, stdenvNoCC, buildPackages
+, bootstrap_cmds, bison, flex
 , gnum4, unifdef, perl, python3
-, headersOnly ? true }:
+, headersOnly ? true
+}:
+
+appleDerivation' (if headersOnly then stdenvNoCC else stdenv) ({
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
 
-appleDerivation ({
   nativeBuildInputs = [ bootstrap_cmds bison flex gnum4 unifdef perl python3 ];
 
   patches = [ ./python3.patch ];
@@ -44,16 +48,16 @@ appleDerivation ({
 
   PLATFORM = "MacOSX";
   SDKVERSION = "10.11";
-  CC = "cc";
-  CXX = "c++";
+  CC = "${stdenv.cc.targetPrefix or ""}cc";
+  CXX = "${stdenv.cc.targetPrefix or ""}c++";
   MIG = "mig";
   MIGCOM = "migcom";
-  STRIP = "strip";
-  NM = "nm";
+  STRIP = "${stdenv.cc.bintools.targetPrefix or ""}strip";
+  NM = "${stdenv.cc.bintools.targetPrefix or ""}nm";
   UNIFDEF = "unifdef";
   DSYMUTIL = "dsymutil";
   HOST_OS_VERSION = "10.10";
-  HOST_CC = "cc";
+  HOST_CC = "${buildPackages.stdenv.cc.targetPrefix or ""}cc";
   HOST_FLEX = "flex";
   HOST_BISON = "bison";
   HOST_GM4 = "m4";
diff --git a/pkgs/os-specific/darwin/binutils/default.nix b/pkgs/os-specific/darwin/binutils/default.nix
index 29ae1871ddb14..5dc57f43e4ab2 100644
--- a/pkgs/os-specific/darwin/binutils/default.nix
+++ b/pkgs/os-specific/darwin/binutils/default.nix
@@ -9,6 +9,7 @@ let
   cmds = [
     "ar" "ranlib" "as" "install_name_tool"
     "ld" "strip" "otool" "lipo" "nm" "strings" "size"
+    "codesign_allocate"
   ];
 in
 
diff --git a/pkgs/os-specific/darwin/cctools/port.nix b/pkgs/os-specific/darwin/cctools/port.nix
index 50e0a2eb3fbfc..bace6f0689d9e 100644
--- a/pkgs/os-specific/darwin/cctools/port.nix
+++ b/pkgs/os-specific/darwin/cctools/port.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, autoreconfHook
 , installShellFiles
-, libcxxabi, libuuid
+, libuuid
 , libobjc ? null, maloader ? null
 , enableTapiSupport ? true, libtapi
 }:
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ autoconf automake libtool autoreconfHook installShellFiles ];
   buildInputs = [ libuuid ]
-    ++ lib.optionals stdenv.isDarwin [ libcxxabi libobjc ]
+    ++ lib.optionals stdenv.isDarwin [ libobjc ]
     ++ lib.optional enableTapiSupport libtapi;
 
   patches = [ ./ld-ignore-rpath-link.patch ./ld-rpath-nonfinal.patch ];
diff --git a/pkgs/os-specific/darwin/darwin-stubs/default.nix b/pkgs/os-specific/darwin/darwin-stubs/default.nix
index aa946eb5bf0a2..6e3439455cce5 100644
--- a/pkgs/os-specific/darwin/darwin-stubs/default.nix
+++ b/pkgs/os-specific/darwin/darwin-stubs/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchurl }:
+{ stdenvNoCC, fetchurl }:
 
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   pname = "darwin-stubs";
   version = "10.12";
 
diff --git a/pkgs/os-specific/darwin/libtapi/default.nix b/pkgs/os-specific/darwin/libtapi/default.nix
index 8c83b4ae1e699..da07107409736 100644
--- a/pkgs/os-specific/darwin/libtapi/default.nix
+++ b/pkgs/os-specific/darwin/libtapi/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, cmake, python3, ncurses }:
+{ lib, stdenv, fetchFromGitHub, pkgsBuildBuild, cmake, python3, ncurses }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "libtapi";
   version = "1100.0.11"; # determined by looking at VERSION.txt
 
@@ -13,13 +13,43 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "source/src/llvm";
 
+  # Backported from newer llvm, fixes configure error when cross compiling.
+  # Also means we don't have to manually fix the result with install_name_tool.
+  patches = [
+    ./disable-rpath.patch
+  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+    # TODO: make unconditional and rebuild the world
+    # TODO: send upstream
+    ./native-clang-tblgen.patch
+  ];
+
   nativeBuildInputs = [ cmake python3 ];
 
   # ncurses is required here to avoid a reference to bootstrap-tools, which is
   # not allowed for the stdenv.
   buildInputs = [ ncurses ];
 
-  cmakeFlags = [ "-DLLVM_INCLUDE_TESTS=OFF" ];
+  cmakeFlags = [ "-DLLVM_INCLUDE_TESTS=OFF" ]
+    ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) [
+      "-DCMAKE_CROSSCOMPILING=True"
+      # This package could probably have a llvm_6 llvm-tblgen and clang-tblgen
+      # provided to reduce some building. This package seems intended to
+      # include all of its dependencies, including enough of LLVM to build the
+      # required tablegens.
+      (
+        let
+          nativeCC = pkgsBuildBuild.stdenv.cc;
+          nativeBintools = nativeCC.bintools.bintools;
+          nativeToolchainFlags = [
+            "-DCMAKE_C_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}cc"
+            "-DCMAKE_CXX_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}c++"
+            "-DCMAKE_AR=${nativeBintools}/bin/${nativeBintools.targetPrefix}ar"
+            "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
+            "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
+          ];
+        in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+      )
+    ];
 
   # fixes: fatal error: 'clang/Basic/Diagnostic.h' file not found
   # adapted from upstream
@@ -35,10 +65,6 @@ stdenv.mkDerivation rec {
 
   installTargets = [ "install-libtapi" "install-tapi-headers" "install-tapi" ];
 
-  postInstall = lib.optionalString stdenv.isDarwin ''
-    install_name_tool -id $out/lib/libtapi.dylib $out/lib/libtapi.dylib
-  '';
-
   meta = with lib; {
     description = "Replaces the Mach-O Dynamic Library Stub files in Apple's SDKs to reduce the size";
     homepage = "https://github.com/tpoechtrager/apple-libtapi";
diff --git a/pkgs/os-specific/darwin/libtapi/disable-rpath.patch b/pkgs/os-specific/darwin/libtapi/disable-rpath.patch
new file mode 100644
index 0000000000000..87c0cf3330de6
--- /dev/null
+++ b/pkgs/os-specific/darwin/libtapi/disable-rpath.patch
@@ -0,0 +1,14 @@
+diff --git a/src/llvm/cmake/modules/AddLLVM.cmake b/src/llvm/cmake/modules/AddLLVM.cmake
+index a53016eb0..b65e608a4 100644
+--- a/cmake/modules/AddLLVM.cmake
++++ b/cmake/modules/AddLLVM.cmake
+@@ -1683,8 +1683,7 @@ function(llvm_setup_rpath name)
+   endif()
+ 
+   if (APPLE)
+-    set(_install_name_dir INSTALL_NAME_DIR "@rpath")
+-    set(_install_rpath "@loader_path/../lib" ${extra_libdir})
++    set(_install_name_dir)
+   elseif(UNIX)
+     set(_install_rpath "\$ORIGIN/../lib${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
+     if(${CMAKE_SYSTEM_NAME} MATCHES "(FreeBSD|DragonFly)")
diff --git a/pkgs/os-specific/darwin/libtapi/native-clang-tblgen.patch b/pkgs/os-specific/darwin/libtapi/native-clang-tblgen.patch
new file mode 100644
index 0000000000000..9b715766a122e
--- /dev/null
+++ b/pkgs/os-specific/darwin/libtapi/native-clang-tblgen.patch
@@ -0,0 +1,21 @@
+diffprojects/libtapi/CMakeLists.txt b/src/llvm/projects/libtapi/CMakeLists.txt
+index 8ee6d8138..8277be147 100644
+--- a/projects/libtapi/CMakeLists.txt
++++ b/projects/libtapi/CMakeLists.txt
+@@ -193,7 +193,15 @@ if (NOT DEFINED CLANG_VERSION)
+   set(CLANG_VERSION "${LLVM_VERSION_MAJOR}.${LLVM_VERSION_MINOR}.${LLVM_VERSION_PATCH}")
+ endif ()
+ if (NOT DEFINED CLANG_TABLEGEN_EXE)
+-  set(CLANG_TABLEGEN_EXE "${LLVM_TOOLS_BINARY_DIR}/clang-tblgen")
++  if(LLVM_USE_HOST_TOOLS)
++    if (NOT CMAKE_CONFIGURATION_TYPES)
++      set(CLANG_TABLEGEN_EXE "${LLVM_NATIVE_BUILD}/bin/clang-tblgen")
++    else()
++      set(CLANG_TABLEGEN_EXE "${LLVM_NATIVE_BUILD}/Release/bin/clang-tblgen")
++    endif()
++  else()
++    set(CLANG_TABLEGEN_EXE "${LLVM_TOOLS_BINARY_DIR}/clang-tblgen")
++  endif ()
+ endif ()
+ 
+ # Include must go first.
diff --git a/pkgs/os-specific/darwin/apple-sdk/print-reexports/default.nix b/pkgs/os-specific/darwin/print-reexports/default.nix
index a548d8da753f5..740bcb48ef595 100644
--- a/pkgs/os-specific/darwin/apple-sdk/print-reexports/default.nix
+++ b/pkgs/os-specific/darwin/print-reexports/default.nix
@@ -7,11 +7,11 @@ stdenv.mkDerivation {
   buildInputs = [ libyaml ];
 
   buildPhase = ''
-    $CC -lyaml -o $name main.c
+    $CC -lyaml -o print-reexports main.c
   '';
 
   installPhase = ''
     mkdir -p $out/bin
-    mv $name $out/bin
+    mv print-reexports $out/bin
   '';
 }
diff --git a/pkgs/os-specific/darwin/apple-sdk/print-reexports/main.c b/pkgs/os-specific/darwin/print-reexports/main.c
index df46e3f18e897..e6ff527da9668 100644
--- a/pkgs/os-specific/darwin/apple-sdk/print-reexports/main.c
+++ b/pkgs/os-specific/darwin/print-reexports/main.c
@@ -21,6 +21,10 @@
 #include <sys/errno.h>
 #include <yaml.h>
 
+#define LOG(str, ...) fprintf(stderr, "%s", str)
+
+#define LOGF(...) fprintf(stderr, __VA_ARGS__)
+
 static yaml_node_t *get_mapping_entry(yaml_document_t *document, yaml_node_t *mapping, const char *name) {
   if (!mapping) {
     fprintf(stderr, "get_mapping_entry: mapping is null\n");
@@ -35,12 +39,12 @@ static yaml_node_t *get_mapping_entry(yaml_document_t *document, yaml_node_t *ma
     yaml_node_t *key = yaml_document_get_node(document, pair->key);
 
     if (!key) {
-      fprintf(stderr, "get_mapping_entry: key (%i) is null\n", pair->key);
+      LOGF("key (%d) is null\n", pair->key);
       return NULL;
     }
 
     if (key->type != YAML_SCALAR_NODE) {
-      fprintf(stderr, "get_mapping_entry: key is not a scalar\n");
+      LOG("get_mapping_entry: key is not a scalar\n");
       return NULL;
     }
 
@@ -54,18 +58,17 @@ static yaml_node_t *get_mapping_entry(yaml_document_t *document, yaml_node_t *ma
   return NULL;
 }
 
-static int emit_reexports(yaml_document_t *document) {
+static int emit_reexports_v2(yaml_document_t *document) {
   yaml_node_t *root = yaml_document_get_root_node(document);
 
   yaml_node_t *exports = get_mapping_entry(document, root, "exports");
 
   if (!exports) {
-    fprintf(stderr, "emit_reexports: no exports found\n");
-    return 0;
+    return 1;
   }
 
   if (exports->type != YAML_SEQUENCE_NODE) {
-    fprintf(stderr, "emit_reexports, value is not a sequence\n");
+    LOG("value is not a sequence\n");
     return 0;
   }
 
@@ -82,6 +85,11 @@ static int emit_reexports(yaml_document_t *document) {
       continue;
     }
 
+    if (reexports->type != YAML_SEQUENCE_NODE) {
+      LOG("re-exports is not a sequence\n");
+      return 0;
+    }
+
     for (
         yaml_node_item_t *reexport = reexports->data.sequence.items.start;
         reexport < reexports->data.sequence.items.top;
@@ -90,7 +98,58 @@ static int emit_reexports(yaml_document_t *document) {
       yaml_node_t *val = yaml_document_get_node(document, *reexport);
 
       if (val->type != YAML_SCALAR_NODE) {
-        fprintf(stderr, "item is not a scalar\n");
+        LOG("item is not a scalar\n");
+        return 0;
+      }
+
+      fwrite(val->data.scalar.value, val->data.scalar.length, 1, stdout);
+      putchar('\n');
+    }
+  }
+
+  return 1;
+}
+
+static int emit_reexports_v4(yaml_document_t *document) {
+  yaml_node_t *root = yaml_document_get_root_node(document);
+  yaml_node_t *reexports = get_mapping_entry(document, root, "reexported-libraries");
+
+  if (!reexports) {
+    return 1;
+  }
+
+  if (reexports->type != YAML_SEQUENCE_NODE) {
+    LOG("value is not a sequence\n");
+    return 0;
+  }
+
+  for (
+      yaml_node_item_t *entry = reexports->data.sequence.items.start;
+      entry < reexports->data.sequence.items.top;
+      ++entry
+  ) {
+    yaml_node_t *entry_node = yaml_document_get_node(document, *entry);
+
+    yaml_node_t *libs = get_mapping_entry(document, entry_node, "libraries");
+
+    if (!libs) {
+      continue;
+    }
+
+    if (libs->type != YAML_SEQUENCE_NODE) {
+      LOG("libraries is not a sequence\n");
+      return 0;
+    }
+
+    for (
+        yaml_node_item_t *lib = libs->data.sequence.items.start;
+        lib < libs->data.sequence.items.top;
+        ++lib
+    ) {
+      yaml_node_t *val = yaml_document_get_node(document, *lib);
+
+      if (val->type != YAML_SCALAR_NODE) {
+        LOG("item is not a scalar\n");
         return 0;
       }
 
@@ -135,7 +194,13 @@ int main(int argc, char **argv) {
     goto err_yaml;
   }
 
-  emit_reexports(&yaml_document);
+  // Try both, only fail if one reports an error.  A lack of re-exports is not
+  // considered an error.
+  int ok = 1;
+  ok = ok && emit_reexports_v2(&yaml_document);
+  ok = ok && emit_reexports_v4(&yaml_document);
+
+  result = !ok;
 
 err_yaml:
   yaml_parser_delete(&yaml_parser);
diff --git a/pkgs/os-specific/darwin/print-reexports/setup-hook.sh b/pkgs/os-specific/darwin/print-reexports/setup-hook.sh
new file mode 100644
index 0000000000000..9efb00aeb4dc4
--- /dev/null
+++ b/pkgs/os-specific/darwin/print-reexports/setup-hook.sh
@@ -0,0 +1,19 @@
+fixupOutputHooks+=('checkTbdReexports')
+
+checkTbdReexports() {
+  local dir="$1"
+
+  while IFS= read -r -d $'\0' tbd; do
+    echo "checkTbdRexports: checking re-exports in $tbd"
+    while read -r target; do
+      local expected="${target%.dylib}.tbd"
+      if ! [ -e "$expected" ]; then
+        echo -e "Re-export missing:\n\t'$target'\n\t(expected '$expected')"
+        echo -e "While processing\n\t'$tbd'"
+        exit 1
+      else
+        echo "Re-exported target '$target' ok"
+      fi
+    done < <(print-reexports "$tbd")
+  done < <(find $prefix -type f -name '*.tbd' -print0)
+}
diff --git a/pkgs/os-specific/darwin/rewrite-tbd/default.nix b/pkgs/os-specific/darwin/rewrite-tbd/default.nix
new file mode 100644
index 0000000000000..f41b81b3bc90f
--- /dev/null
+++ b/pkgs/os-specific/darwin/rewrite-tbd/default.nix
@@ -0,0 +1,16 @@
+{ stdenv, fetchFromGitHub, cmake, pkg-config, libyaml }:
+
+stdenv.mkDerivation {
+  pname = "rewrite-tbd";
+  version = "20201114";
+
+  src = fetchFromGitHub {
+    owner = "thefloweringash";
+    repo = "rewrite-tbd";
+    rev = "988f29c6ccbca9b883966225263d8d78676da6a3";
+    sha256 = "08sk91zwj6n9x2ymwid2k7y0rwv5b7p6h1b25ipx1dv0i43p6v1a";
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [ libyaml ];
+}
diff --git a/pkgs/os-specific/darwin/signing-utils/auto-sign-hook.sh b/pkgs/os-specific/darwin/signing-utils/auto-sign-hook.sh
new file mode 100644
index 0000000000000..430aba8cdc7eb
--- /dev/null
+++ b/pkgs/os-specific/darwin/signing-utils/auto-sign-hook.sh
@@ -0,0 +1,20 @@
+fixupOutputHooks+=('signDarwinBinariesIn $prefix')
+
+# Uses signingUtils, see definition of autoSignDarwinBinariesHook in
+# darwin-packages.nix
+
+signDarwinBinariesIn() {
+  local dir="$1"
+
+  if [ ! -d "$dir" ]; then
+    return 0
+  fi
+
+  if [ "${darwinDontCodeSign:-}" ]; then
+    return 0
+  fi
+
+  while IFS= read -r -d $'\0' f; do
+    signIfRequired "$f"
+  done < <(find "$dir" -type f -print0)
+}
diff --git a/pkgs/os-specific/darwin/signing-utils/default.nix b/pkgs/os-specific/darwin/signing-utils/default.nix
new file mode 100644
index 0000000000000..035ac59b725ae
--- /dev/null
+++ b/pkgs/os-specific/darwin/signing-utils/default.nix
@@ -0,0 +1,24 @@
+{ stdenvNoCC
+, sigtool
+, cctools
+}:
+
+let
+  stdenv = stdenvNoCC;
+in
+
+stdenv.mkDerivation {
+  name = "signing-utils";
+
+  dontUnpack = true;
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    substituteAll ${./utils.sh} $out
+  '';
+
+  # Substituted variables
+  inherit sigtool;
+  codesignAllocate = "${cctools}/bin/${cctools.targetPrefix}codesign_allocate";
+}
diff --git a/pkgs/os-specific/darwin/signing-utils/utils.sh b/pkgs/os-specific/darwin/signing-utils/utils.sh
new file mode 100644
index 0000000000000..6d23a461fc995
--- /dev/null
+++ b/pkgs/os-specific/darwin/signing-utils/utils.sh
@@ -0,0 +1,43 @@
+# Work around for some odd behaviour where we can't codesign a file
+# in-place if it has been called before. This happens for example if
+# you try to fix-up a binary using strip/install_name_tool, after it
+# had been used previous.  The solution is to copy the binary (with
+# the corrupted signature from strip/install_name_tool) to some
+# location, sign it there and move it back into place.
+#
+# This does not appear to happen with the codesign tool that ships
+# with recent macOS BigSur installs on M1 arm64 machines.  However it
+# had also been happening with the tools that shipped with the DTKs.
+sign() {
+    local tmpdir
+    tmpdir=$(mktemp -d)
+
+    # $1 is the file
+
+    cp "$1" "$tmpdir"
+    CODESIGN_ALLOCATE=@codesignAllocate@ \
+        @sigtool@/bin/codesign -f -s - "$tmpdir/$(basename "$1")"
+    mv "$tmpdir/$(basename "$1")" "$1"
+    rmdir "$tmpdir"
+}
+
+checkRequiresSignature() {
+    local file=$1
+    local rc=0
+
+    @sigtool@/bin/sigtool --file "$file" check-requires-signature || rc=$?
+
+    if [ "$rc" -eq 0 ] || [ "$rc" -eq 1 ]; then
+        return "$rc"
+    fi
+
+    echo "Unexpected exit status from sigtool: $rc"
+    exit 1
+}
+
+signIfRequired() {
+    local file=$1
+    if checkRequiresSignature "$file"; then
+        sign "$file"
+    fi
+}
diff --git a/pkgs/os-specific/darwin/sigtool/default.nix b/pkgs/os-specific/darwin/sigtool/default.nix
new file mode 100644
index 0000000000000..933ef784879f6
--- /dev/null
+++ b/pkgs/os-specific/darwin/sigtool/default.nix
@@ -0,0 +1,24 @@
+{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, makeWrapper, openssl }:
+
+stdenv.mkDerivation {
+  name = "sigtool";
+
+  src = fetchFromGitHub {
+    owner = "thefloweringash";
+    repo = "sigtool";
+    rev = "4a3719b42dc91c3f513df94048851cc98e7c7fcf";
+    sha256 = "04ra1cx7k1sdbkj5yrvl0s3l333vpir8rnm8k1dh2zy1w0a6hpqa";
+  };
+
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ openssl ];
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  # Upstream (me) asserts the driver script is optional.
+  postInstall = ''
+    substitute $NIX_BUILD_TOP/$sourceRoot/codesign.sh $out/bin/codesign \
+      --replace sigtool "$out/bin/sigtool"
+    chmod a+x $out/bin/codesign
+  '';
+}
diff --git a/pkgs/os-specific/darwin/xcode/sdk-pkgs.nix b/pkgs/os-specific/darwin/xcode/sdk-pkgs.nix
index ab934d7eaaafe..0512d9dd46a17 100644
--- a/pkgs/os-specific/darwin/xcode/sdk-pkgs.nix
+++ b/pkgs/os-specific/darwin/xcode/sdk-pkgs.nix
@@ -41,6 +41,7 @@ rec {
       mv cc-cflags.tmp $out/nix-support/cc-cflags
       echo "-target ${targetPlatform.config}" >> $out/nix-support/cc-cflags
       echo "-isystem ${sdk}/usr/include${lib.optionalString (lib.versionAtLeast "10" sdk.version) " -isystem ${sdk}/usr/include/c++/4.2.1/ -stdlib=libstdc++"}" >> $out/nix-support/cc-cflags
+      ${lib.optionalString (lib.versionAtLeast sdk.version "14") "echo -isystem ${xcode}/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include/c++/v1 >> $out/nix-support/cc-cflags"}
     '';
   }) // {
     inherit sdk;
diff --git a/pkgs/os-specific/linux/bionic-prebuilt/default.nix b/pkgs/os-specific/linux/bionic-prebuilt/default.nix
new file mode 100644
index 0000000000000..920732a2020d2
--- /dev/null
+++ b/pkgs/os-specific/linux/bionic-prebuilt/default.nix
@@ -0,0 +1,113 @@
+{ stdenvNoCC, lib, fetchzip, pkgs
+}:
+let
+
+  prebuilt_crt = fetchzip {
+    url =  "https://android.googlesource.com/platform/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9/+archive/98dce673ad97a9640c5d90bbb1c718e75c21e071/lib/gcc/aarch64-linux-android/4.9.x.tar.gz";
+    sha256 = "sha256-LLD2OJi78sNN5NulOsJZl7Ei4F1EUYItGG6eUsKWULc=";
+    stripRoot = false;
+  };
+
+  prebuilt_libs = fetchzip {
+    url = "https://android.googlesource.com/platform/prebuilts/ndk/+archive/f2c77d8ba8a7f5c2d91771e31164f29be0b8ff98/platform/platforms/android-30/arch-arm64/usr/lib.tar.gz";
+    sha256 = "sha256-TZBV7+D1QvKOCEi+VNGT5SStkgj0xRbyWoLH65zSrjw=";
+    stripRoot = false;
+  };
+
+  prebuilt_ndk_crt = fetchzip {
+    url = "https://android.googlesource.com/toolchain/prebuilts/ndk/r23/+archive/6c5fa4c0d3999b9ee932f6acbd430eb2f31f3151/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/aarch64-linux-android/30.tar.gz";
+    sha256 = "sha256-KHw+cCwAwlm+5Nwp1o8WONqdi4BBDhFaVVr+7GxQ5uE=";
+    stripRoot = false;
+  };
+
+  ndk_support_headers = fetchzip {
+    url ="https://android.googlesource.com/platform/prebuilts/clang/host/linux-x86/+archive/0e7f808fa26cce046f444c9616d9167dafbfb272/clang-r416183b/include/c++/v1/support.tar.gz";
+    sha256 = "sha256-NBv7Pk1CEaz8ns9moleEERr3x/rFmVmG33LgFSeO6fY=";
+    stripRoot = false;
+  };
+
+  kernelHeaders = pkgs.makeLinuxHeaders {
+    version = "android-common-11-5.4";
+    src = fetchzip {
+      url = "https://android.googlesource.com/kernel/common/+archive/48ffcbf0b9e7f0280bfb8c32c68da0aaf0fdfef6.tar.gz";
+      sha256 = "1y7cmlmcr5vdqydd9n785s139yc4aylc3zhqa59xsylmkaf5habk";
+      stripRoot = false;
+    };
+  };
+
+in
+stdenvNoCC.mkDerivation rec {
+  pname = "bionic-prebuilt";
+  version = "ndk-release-r23";
+
+  src = fetchzip {
+    url = "https://android.googlesource.com/platform/bionic/+archive/00e8ce1142d8823b0d2fc8a98b40119b0f1f02cd.tar.gz";
+    sha256 = "10z5mp4w0acvjvgxv7wlqa7m70hcyarmjdlfxbd9rwzf4mrsr8d1";
+    stripRoot = false;
+  };
+
+  NIX_DONT_SET_RPATH = true;
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  patches = [
+    ./ndk-version.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace libc/include/sys/cdefs.h --replace \
+      "__has_builtin(__builtin_umul_overflow)" "1"
+    substituteInPlace libc/include/bits/ioctl.h --replace \
+      "!defined(BIONIC_IOCTL_NO_SIGNEDNESS_OVERLOAD)" "0"
+  '';
+
+  installPhase= ''
+    # copy the bionic headers
+    mkdir -p $out/include/support $out/include/android
+    cp -vr libc/include/* $out/include
+    # copy the kernel headers
+    cp -vr ${kernelHeaders}/include/*  $out/include/
+
+    chmod -R +w $out/include/linux
+
+    # fix a bunch of kernel headers so that things can actually be found
+    sed -i 's,struct epoll_event {,#include <bits/epoll_event.h>\nstruct Xepoll_event {,' $out/include/linux/eventpoll.h
+    sed -i 's,struct in_addr {,typedef unsigned int in_addr_t;\nstruct in_addr {,' $out/include/linux/in.h
+    sed -i 's,struct udphdr {,struct Xudphdr {,' $out/include/linux/udp.h
+    sed -i 's,union semun {,union Xsemun {,' $out/include/linux/sem.h
+    sed -i 's,struct __kernel_sockaddr_storage,#define sockaddr_storage __kernel_sockaddr_storage\nstruct __kernel_sockaddr_storage,' $out/include/linux/socket.h
+    sed -i 's,#ifndef __UAPI_DEF_.*$,#if 1,' $out/include/linux/libc-compat.h
+    substituteInPlace $out/include/linux/in.h --replace "__be32		imr_" "struct in_addr		imr_"
+    substituteInPlace $out/include/linux/in.h --replace "__be32		imsf_" "struct in_addr		imsf_"
+    substituteInPlace $out/include/linux/sysctl.h --replace "__unused" "_unused"
+
+    # what could possibly live in <linux/compiler.h>
+    touch $out/include/linux/compiler.h
+
+    # copy the support headers
+    cp -vr ${ndk_support_headers}* $out/include/support/
+
+    mkdir $out/lib
+    cp -v ${prebuilt_crt.out}/*.o $out/lib/
+    cp -v ${prebuilt_crt.out}/libgcc.a $out/lib/
+    cp -v ${prebuilt_ndk_crt.out}/*.o $out/lib/
+    for i in libc.so libm.so libdl.so liblog.so; do
+      cp -v ${prebuilt_libs.out}/$i $out/lib/
+    done
+
+    mkdir -p $dev/include
+    cp -v $out/include/*.h $dev/include/
+  '';
+
+  outputs = [ "out" "dev" ];
+  passthru.linuxHeaders = kernelHeaders;
+
+  meta = with lib; {
+    description = "The Android libc implementation";
+    homepage    = "https://android.googlesource.com/platform/bionic/";
+    license     = licenses.mit;
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ s1341 ];
+  };
+}
diff --git a/pkgs/os-specific/linux/bionic-prebuilt/ndk-version.patch b/pkgs/os-specific/linux/bionic-prebuilt/ndk-version.patch
new file mode 100644
index 0000000000000..a6842ed479ff0
--- /dev/null
+++ b/pkgs/os-specific/linux/bionic-prebuilt/ndk-version.patch
@@ -0,0 +1,42 @@
+--- a/libc/include/android/ndk-version.h	2021-04-01 16:08:03.109183965 +0300
++++ b/libc/include/android/ndk-version.h	2021-04-01 16:07:19.811424641 +0300
+@@ -0,0 +1,39 @@
++#pragma once
++
++/**
++ * Set to 1 if this is an NDK, unset otherwise. See
++ * https://android.googlesource.com/platform/bionic/+/master/docs/defines.md.
++ */
++#define __ANDROID_NDK__ 1
++
++/**
++ * Major version of this NDK.
++ *
++ * For example: 16 for r16.
++ */
++#define __NDK_MAJOR__ 22
++
++/**
++ * Minor version of this NDK.
++ *
++ * For example: 0 for r16 and 1 for r16b.
++ */
++#define __NDK_MINOR__ 0
++
++/**
++ * Set to 0 if this is a release build, or 1 for beta 1,
++ * 2 for beta 2, and so on.
++ */
++#define __NDK_BETA__ 0
++
++/**
++ * Build number for this NDK.
++ *
++ * For a local development build of the NDK, this is -1.
++ */
++#define __NDK_BUILD__ 7026061
++
++/**
++ * Set to 1 if this is a canary build, 0 if not.
++ */
++#define __NDK_CANARY__ 0
diff --git a/pkgs/os-specific/linux/catfs/default.nix b/pkgs/os-specific/linux/catfs/default.nix
index 0ca585fab47b4..dbb525e0e298d 100644
--- a/pkgs/os-specific/linux/catfs/default.nix
+++ b/pkgs/os-specific/linux/catfs/default.nix
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "0zca0c4n2p9s5kn8c9f9lyxdf3df88a63nmhprpgflj86bh8wgf5";
   };
 
-  cargoSha256 = "0v6lxwj4vcph32np68awpncafvf1dwcik9a2asa0lkb7kmfdjsjk";
+  cargoSha256 = "1agcwq409s40kyij487wjrp8mj7942r9l2nqwks4xqlfb0bvaimf";
 
   cargoPatches = [
     # update cargo lock
diff --git a/pkgs/os-specific/linux/dlm/default.nix b/pkgs/os-specific/linux/dlm/default.nix
index 9e81ea38348b5..3b6f4773a29cf 100644
--- a/pkgs/os-specific/linux/dlm/default.nix
+++ b/pkgs/os-specific/linux/dlm/default.nix
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "1r3w7my0g3v2ya317qnvjx8wnagjahpj7yx72a65hf2pjbf5x42p";
   };
 
-  cargoSha256 = "OFMCsUmrRYlobiUAqm1huuzDxdf1BWmU2RqZ9Y6Yjew=";
+  cargoSha256 = "01a8k60qnx2pgxb2adgw30c2hjb60w6230khm5hyqgmp7z4rm8k8";
 
   meta = with lib; {
     description = "A stupid simple graphical login manager";
diff --git a/pkgs/os-specific/linux/dpdk/default.nix b/pkgs/os-specific/linux/dpdk/default.nix
index e71da643bb429..38dac78b3fecb 100644
--- a/pkgs/os-specific/linux/dpdk/default.nix
+++ b/pkgs/os-specific/linux/dpdk/default.nix
@@ -63,8 +63,6 @@ in stdenv.mkDerivation rec {
 
   outputs = [ "out" ] ++ lib.optional mod "kmod";
 
-  enableParallelBuilding = true;
-
   meta = with lib; {
     description = "Set of libraries and drivers for fast packet processing";
     homepage = "http://dpdk.org/";
diff --git a/pkgs/os-specific/linux/firmware/firmware-manager/default.nix b/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
index 80730fdbefbc7..ee36ab5744266 100644
--- a/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
 
   installPhase = "make prefix='$(out)' install";
 
-  cargoSha256 = "sha256-TISYaSOu8c+74ie4QHLqflXfLWwcLHEOch/hAx3iu60=";
+  cargoSha256 = "sha256-BUo77ERHvuc8IkDdU3Z/gZZicNHT26IbAgEBnVM3O4U=";
 
   doCheck = false;
 
diff --git a/pkgs/os-specific/linux/firmware/system76-firmware/default.nix b/pkgs/os-specific/linux/firmware/system76-firmware/default.nix
index 9d47d50b43fc5..ca750d89cc5bc 100644
--- a/pkgs/os-specific/linux/firmware/system76-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/system76-firmware/default.nix
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoBuildFlags = [ "--workspace" ];
 
-  cargoSha256 = "sha256-sKC0jfpy7mxGwO+mKU3W5e9HsJx+HQNzqq78YViNJcs=";
+  cargoSha256 = "sha256-gGw3zpxLxQZ3rglpDERO0fSxBOez1Q10Fljis6nyB/4=";
 
   # Purposefully don't install systemd unit file, that's for NixOS
   postInstall = ''
diff --git a/pkgs/os-specific/linux/fuse/common.nix b/pkgs/os-specific/linux/fuse/common.nix
index c1217f669384e..5adb1b5355ad4 100644
--- a/pkgs/os-specific/linux/fuse/common.nix
+++ b/pkgs/os-specific/linux/fuse/common.nix
@@ -82,8 +82,6 @@ in stdenv.mkDerivation rec {
     cp ${fusePackages.fuse_3.common}/etc/udev/rules.d/99-fuse.rules etc/udev/rules.d/99-fuse.rules
   '');
 
-  enableParallelBuilding = true;
-
   meta = with lib; {
     description = "Library that allows filesystems to be implemented in user space";
     longDescription = ''
diff --git a/pkgs/os-specific/linux/greetd/default.nix b/pkgs/os-specific/linux/greetd/default.nix
index fc5dd04b43c10..6f305c5d6ebb5 100644
--- a/pkgs/os-specific/linux/greetd/default.nix
+++ b/pkgs/os-specific/linux/greetd/default.nix
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "b+S3fuJ8gjnSQzLHl3Bs9iO/Un2ynggAplz01GjJvFI=";
   };
 
-  cargoSha256 = "w6d8rIc03Qa2/TpztpyVijjd3y0Vo38+JDhsOkSFG5E=";
+  cargoHash = "sha256-YSC7osyBPwx+lo7P1ftI72mRWeQlDc2srRPzTFqVTxM=";
 
   nativeBuildInputs = [
     scdoc
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index bd52f37e62f89..f700bf035de89 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.344";
+  version = "0.347";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    sha256 = "0rsnm94r814shr86jk6f2323i1n4p58inkgkx7362yz9k4a8ir7a";
+    sha256 = "19kmz25zq6qqs67ppqhws4mh3qf6zrp55cpyxyw36q95yjdcqp21";
   };
 
   preConfigure = "patchShebangs ./configure";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   outputHashMode = "recursive";
   outputHashAlgo = "sha256";
-  outputHash = "011lyldzskfb4sfn4i7qyyq3i4gaf1v9yfbc82889cabka0n4nfz";
+  outputHash = "0haaczd6pi9q2vdlvbwn7100sb87zsy64z94xhpbmlari4vzjmz0";
 
   meta = {
     homepage = "https://github.com/vcrhonek/hwdata";
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index 34e80ac8222c0..9d727838b3fb7 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -1,4 +1,9 @@
-{ stdenvNoCC, lib, buildPackages, fetchurl, perl, elf-header }:
+{ stdenvNoCC, lib, buildPackages, fetchurl, perl, elf-header
+, bison ? null, flex ? null, python ? null, rsync ? null
+}:
+
+assert stdenvNoCC.hostPlatform.isAndroid ->
+  (flex != null && bison != null && python != null && rsync != null);
 
 let
   makeLinuxHeaders = { src, version, patches ? [] }: stdenvNoCC.mkDerivation {
@@ -13,7 +18,11 @@ let
     # We do this so we have a build->build, not build->host, C compiler.
     depsBuildBuild = [ buildPackages.stdenv.cc ];
     # `elf-header` is null when libc provides `elf.h`.
-    nativeBuildInputs = [ perl elf-header ];
+    nativeBuildInputs = [
+      perl elf-header
+    ] ++ lib.optionals stdenvNoCC.hostPlatform.isAndroid [
+      flex bison python rsync
+    ];
 
     extraIncludeDirs = lib.optional stdenvNoCC.hostPlatform.isPowerPC ["ppc"];
 
@@ -36,9 +45,12 @@ let
     # Skip clean on darwin, case-sensitivity issues.
     buildPhase = lib.optionalString (!stdenvNoCC.buildPlatform.isDarwin) ''
       make mrproper $makeFlags
-    '' + ''
+    '' + (if stdenvNoCC.hostPlatform.isAndroid then ''
+      make defconfig
+      make headers_install
+    '' else ''
       make headers $makeFlags
-    '';
+    '');
 
     checkPhase = ''
       make headers_check $makeFlags
diff --git a/pkgs/os-specific/linux/kernel/generate-config.pl b/pkgs/os-specific/linux/kernel/generate-config.pl
index 6a2aec809a1bc..82e1cb66e2be4 100644
--- a/pkgs/os-specific/linux/kernel/generate-config.pl
+++ b/pkgs/os-specific/linux/kernel/generate-config.pl
@@ -40,7 +40,7 @@ close ANSWERS;
 sub runConfig {
 
     # Run `make config'.
-    my $pid = open2(\*IN, \*OUT, "make -C $ENV{SRC} O=$buildRoot config SHELL=bash ARCH=$ENV{ARCH}");
+    my $pid = open2(\*IN, \*OUT, "make -C $ENV{SRC} O=$buildRoot config SHELL=bash ARCH=$ENV{ARCH} CC=$ENV{CC} HOSTCC=$ENV{HOSTCC} HOSTCXX=$ENV{HOSTCXX}");
 
     # Parse the output, look for questions and then send an
     # appropriate answer.
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 68a1fcdb0e6ba..b35c84513e69e 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -128,12 +128,16 @@ let
 
     buildPhase = ''
       export buildRoot="''${buildRoot:-build}"
+      export HOSTCC=$CC_FOR_BUILD
+      export HOSTCXX=$CXX_FOR_BUILD
+      export HOSTAR=$AR_FOR_BUILD
+      export HOSTLD=$LD_FOR_BUILD
 
       # Get a basic config file for later refinement with $generateConfig.
-      make -C .  O="$buildRoot" $kernelBaseConfig \
+      make -C . O="$buildRoot" $kernelBaseConfig \
           ARCH=$kernelArch \
-          HOSTCC=${buildPackages.stdenv.cc.targetPrefix}gcc \
-          HOSTCXX=${buildPackages.stdenv.cc.targetPrefix}g++
+          HOSTCC=$HOSTCC HOSTCXX=$HOSTCXX HOSTAR=$HOSTAR HOSTLD=$HOSTLD \
+          CC=$CC OBJCOPY=$OBJCOPY OBJDUMP=$OBJDUMP READELF=$READELF
 
       # Create the config file.
       echo "generating kernel configuration..."
diff --git a/pkgs/os-specific/linux/kernel/linux-xanmod.nix b/pkgs/os-specific/linux/kernel/linux-xanmod.nix
index 95f736d941836..eecdc09ca2013 100644
--- a/pkgs/os-specific/linux/kernel/linux-xanmod.nix
+++ b/pkgs/os-specific/linux/kernel/linux-xanmod.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, buildLinux, fetchFromGitHub, ... } @ args:
 
 let
-  version = "5.11.16";
+  version = "5.12.5";
   suffix = "xanmod1-cacule";
 in
   buildLinux (args // rec {
@@ -12,14 +12,14 @@ in
       owner = "xanmod";
       repo = "linux";
       rev = modDirVersion;
-      sha256 = "sha256-sK2DGJsmKP/gvPyT8HWjPa21OOXydMhGjJzrOkPo71Q=";
+      sha256 = "sha256-u9ebl2M8zrCNdangcUdk/78KwPCYV41PIB6YKTqCgIY=";
       extraPostFetch = ''
         rm $out/.config
       '';
     };
 
     extraMeta = {
-      branch = "5.11";
+      branch = "5.12-cacule";
       maintainers = with lib.maintainers; [ fortuneteller2k ];
       description = "Built with custom settings and new features built to provide a stable, responsive and smooth desktop experience";
       broken = stdenv.hostPlatform.isAarch64;
diff --git a/pkgs/os-specific/linux/libcgroup/default.nix b/pkgs/os-specific/linux/libcgroup/default.nix
index e40a59ce82330..6d6a8e7c21e11 100644
--- a/pkgs/os-specific/linux/libcgroup/default.nix
+++ b/pkgs/os-specific/linux/libcgroup/default.nix
@@ -1,26 +1,21 @@
-{ lib, stdenv, fetchurl, fetchpatch, pam, bison, flex }:
+{ lib, stdenv, fetchFromGitHub, pam, bison, flex, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "libcgroup";
-  version = "0.41";
+  version = "0.42.2";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/libcg/${pname}-${version}.tar.bz2";
-    sha256 = "0lgvyq37gq84sk30sg18admxaj0j0p5dq3bl6g74a1ppgvf8pqz4";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1h8s70lm6g7r0wj7j3xgj2g3j9fifvsy2pna6w0j3i5hh42qfms4";
   };
 
   buildInputs = [ pam bison flex ];
-
-  patches = [
-    (fetchpatch {
-      name = "CVE-2018-14348.patch";
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-libs/libcgroup/files/libcgroup-0.41-remove-umask.patch?id=33e9f4c81de754bbf76b893ea1133ed023f2a0e5";
-      sha256 = "1x0x29ld0cgmfwq4qy13s6d5c8sym1frfh1j2q47d8gfw6qaxka5";
-    })
-  ];
+  nativeBuildInputs = [ autoreconfHook ];
 
   postPatch = ''
-    substituteInPlace src/tools/Makefile.in \
+    substituteInPlace src/tools/Makefile.am \
       --replace 'chmod u+s' 'chmod +x'
   '';
 
diff --git a/pkgs/os-specific/linux/libsepol/default.nix b/pkgs/os-specific/linux/libsepol/default.nix
index 12a94d6fc422d..732ad88c70db4 100644
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@@ -13,6 +13,11 @@ stdenv.mkDerivation rec {
     sha256 = "0ygb6dh5lng91xs6xiqf5v0nxa68qmjc787p0s5h9w89364f2yjv";
   };
 
+  postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
+    substituteInPlace src/Makefile --replace 'all: $(LIBA) $(LIBSO)' 'all: $(LIBA)'
+    sed -i $'/^\t.*LIBSO/d' src/Makefile
+  '';
+
   nativeBuildInputs = [ flex ];
 
   makeFlags = [
@@ -34,6 +39,6 @@ stdenv.mkDerivation rec {
     homepage = "http://userspace.selinuxproject.org";
     platforms = platforms.linux;
     maintainers = [ maintainers.phreedom ];
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Plus;
   };
 }
diff --git a/pkgs/os-specific/linux/lvm2/default.nix b/pkgs/os-specific/linux/lvm2/default.nix
index 3db9c5e9eb6b5..d822ceed714c7 100644
--- a/pkgs/os-specific/linux/lvm2/default.nix
+++ b/pkgs/os-specific/linux/lvm2/default.nix
@@ -16,11 +16,11 @@ assert enableDmeventd -> enableCmdlib;
 
 stdenv.mkDerivation rec {
   pname = "lvm2" + lib.optionalString enableDmeventd "with-dmeventd";
-  version = "2.03.11";
+  version = "2.03.12";
 
   src = fetchurl {
     url = "https://mirrors.kernel.org/sourceware/lvm2/LVM2.${version}.tgz";
-    sha256 = "1m4xpda8vbyd89ca0w8nacvnl4j34yzsa625gn990fb5sh84ab44";
+    sha256 = "1shczwfd0888dchjiaqzd48ampm6f8y0ngsqd99fy4nxlbr5q1vn";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/miraclecast/default.nix b/pkgs/os-specific/linux/miraclecast/default.nix
index 8545d31c71ab7..b5efaa40afe9e 100644
--- a/pkgs/os-specific/linux/miraclecast/default.nix
+++ b/pkgs/os-specific/linux/miraclecast/default.nix
@@ -16,8 +16,6 @@ stdenv.mkDerivation {
 
   buildInputs = [ glib pcre readline systemd udev ];
 
-  enableParallelBuilding = true;
-
   mesonFlags = [
     "-Drely-udev=true"
     "-Dbuild-tests=true"
diff --git a/pkgs/os-specific/linux/swapview/default.nix b/pkgs/os-specific/linux/swapview/default.nix
index c88c8757db3c0..8eb4555010527 100644
--- a/pkgs/os-specific/linux/swapview/default.nix
+++ b/pkgs/os-specific/linux/swapview/default.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "0339biydk997j5r72vzp7djwkscsz89xr3936nshv23fmxjh2rzj";
   };
 
-  cargoSha256 = "0z99pqd41y8cci3yvwsnm5zbq7pzli62z8qqqghmz1hcq5pb5q7g";
+  cargoSha256 = "03yi6bsjjnl8hznxr1nrnxx5lrqb574625j2lkxqbl9vrg9mswdz";
 
   meta = with lib; {
     description = "A simple program to view processes' swap usage on Linux";
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index b7beeb727c4de..c13f97fcde745 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -514,8 +514,6 @@ stdenv.mkDerivation {
     rm -rf $out/share/doc
   '';
 
-  enableParallelBuilding = true;
-
   # The interface version prevents NixOS from switching to an
   # incompatible systemd at runtime.  (Switching across reboots is
   # fine, of course.)  It should be increased whenever systemd changes
diff --git a/pkgs/os-specific/linux/tuigreet/default.nix b/pkgs/os-specific/linux/tuigreet/default.nix
index b6db7cfbb7fd0..a904eb8b9b4ac 100644
--- a/pkgs/os-specific/linux/tuigreet/default.nix
+++ b/pkgs/os-specific/linux/tuigreet/default.nix
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "1fk8ppxr3a8vdp7g18pp3sgr8b8s11j30mcqpdap4ai14v19idh8";
   };
 
-  cargoSha256 = "0qpambizjy6z44spnjnh2kd8nay5953mf1ga2iff2mjlv97zpq22";
+  cargoSha256 = "1ds5rcxg7qn799zp0jdn9ifkdzh9h5ibsqh688dvrqyzrsfz6x7m";
 
   meta = with lib; {
     description = "Graphical console greter for greetd";
diff --git a/pkgs/os-specific/linux/wlgreet/default.nix b/pkgs/os-specific/linux/wlgreet/default.nix
index e48443b1b1e60..2bbf01b01c5ee 100644
--- a/pkgs/os-specific/linux/wlgreet/default.nix
+++ b/pkgs/os-specific/linux/wlgreet/default.nix
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "0n0lzg3y1z5s9s6kfkdj5q8w67bqpw08hqfccc5kz0ninzy9j0cc";
   };
 
-  cargoSha256 = "01bfv2kzg2r9z75b8pq61n2ydc8l5zh69jdyjpj931l642f6kd5a";
+  cargoSha256 = "08m8r8wy7yg5lhmyfx4n0vaf99xv97vzrs774apyxxx2wkhbyjhg";
 
   meta = with lib; {
     description = "Raw wayland greeter for greetd, to be run under sway or similar";
diff --git a/pkgs/os-specific/linux/xpadneo/default.nix b/pkgs/os-specific/linux/xpadneo/default.nix
index 3007e54639d15..c1874877620ca 100644
--- a/pkgs/os-specific/linux/xpadneo/default.nix
+++ b/pkgs/os-specific/linux/xpadneo/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     description = "Advanced Linux driver for Xbox One wireless controllers";
     homepage = "https://atar-axis.github.io/xpadneo";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ metadark ];
+    maintainers = with maintainers; [ kira-bruneau ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/windows/default.nix b/pkgs/os-specific/windows/default.nix
index 7c8041206caa0..15e3d7f89ab67 100644
--- a/pkgs/os-specific/windows/default.nix
+++ b/pkgs/os-specific/windows/default.nix
@@ -19,7 +19,7 @@ lib.makeScope newScope (self: with self; {
 
   crossThreadsStdenv = overrideCC crossLibcStdenv
     (if stdenv.hostPlatform.useLLVM or false
-     then buildPackages.llvmPackages_8.lldClangNoLibcxx
+     then buildPackages.llvmPackages_8.clangNoLibcxx
      else buildPackages.gccCrossStageStatic.override (old: {
        bintools = old.bintools.override {
          libc = libcCross;