Merge branch 'master' into singularity

24 files changed, 268 insertions, 39 deletions

diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 620ea530fc55..4122af898de9 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -177,7 +177,7 @@ stdenv.mkDerivation {
       /**/ if targetPlatform.isAarch64 then endianPrefix + "aarch64"
       else if targetPlatform.isAarch32     then endianPrefix + "arm"
       else if targetPlatform.isx86_64  then "x86-64"
-      else if targetPlatform.isx86     then "i386"
+      else if targetPlatform.isx86_32  then "i386"
       else if targetPlatform.isMips    then {
           "mips"     = "btsmipn32"; # n32 variant
           "mipsel"   = "ltsmipn32"; # n32 variant
diff --git a/pkgs/build-support/build-bazel-package/default.nix b/pkgs/build-support/build-bazel-package/default.nix
index 28247bac1021..931b68c6329f 100644
--- a/pkgs/build-support/build-bazel-package/default.nix
+++ b/pkgs/build-support/build-bazel-package/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, bazel, enableNixHacks ? true }:
+{ stdenv, bazel, cacert, enableNixHacks ? true }:
 
 args@{ name, bazelFlags ? [], bazelTarget, buildAttrs, fetchAttrs, ... }:
 
@@ -20,6 +20,8 @@ in stdenv.mkDerivation (fBuildAttrs // {
       export bazelOut="$(echo ''${NIX_BUILD_TOP}/output | sed -e 's,//,/,g')"
       export bazelUserRoot="$(echo ''${NIX_BUILD_TOP}/tmp | sed -e 's,//,/,g')"
       export HOME="$NIX_BUILD_TOP"
+      # This is needed for git_repository with https remotes
+      export GIT_SSL_CAINFO="${cacert}/etc/ssl/certs/ca-bundle.crt"
     '';
 
     buildPhase = fFetchAttrs.buildPhase or ''
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 47c992d1f6ba..c36181130478 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -320,5 +320,6 @@ stdenv.mkDerivation {
     { description =
         stdenv.lib.attrByPath ["meta" "description"] "System C compiler" cc_
         + " (wrapper script)";
+      priority = 10;
   };
 }
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index 731dd1ea9929..83ff846db7ab 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -316,14 +316,21 @@ rec {
     # Files to add to the layer.
     contents,
     baseJson,
+    extraCommands,
     uid ? 0, gid ? 0,
   }:
     runCommand "${name}-customisation-layer" {
       buildInputs = [ jshon rsync tarsum ];
+      inherit extraCommands;
     }
     ''
       cp -r ${contents}/ ./layer
 
+      if [[ -n $extraCommands ]]; then
+        chmod ug+w layer
+        (cd layer; eval "$extraCommands")
+      fi
+
       # Tar up the layer and throw it into 'layer.tar'.
       echo "Packing layer..."
       mkdir $out
@@ -494,6 +501,8 @@ rec {
     # Time of creation of the image. Passing "now" will make the
     # created date be the time of building.
     created ? "1970-01-01T00:00:01Z",
+    # Optional bash script to run on the files prior to fixturizing the layer.
+    extraCommands ? "", uid ? 0, gid ? 0,
     # Docker's lowest maximum layer limit is 42-layers for an old
     # version of the AUFS graph driver. We pick 24 to ensure there is
     # plenty of room for extension. I believe the actual maximum is
@@ -501,8 +510,6 @@ rec {
     maxLayers ? 24
   }:
     let
-      uid = 0;
-      gid = 0;
       baseName = baseNameOf name;
       contentsEnv = symlinkJoin { name = "bulk-layers"; paths = (if builtins.isList contents then contents else [ contents ]); };
 
@@ -531,20 +538,25 @@ rec {
           name = baseName;
           contents = contentsEnv;
           baseJson = configJson;
-          inherit uid gid;
+          inherit uid gid extraCommands;
         };
       result = runCommand "docker-image-${baseName}.tar.gz" {
         buildInputs = [ jshon pigz coreutils findutils jq ];
         # Image name and tag must be lowercase
         imageName = lib.toLower name;
-        imageTag = if tag == null then "" else lib.toLower tag;
         baseJson = configJson;
+        passthru.imageTag =
+          if tag == null
+          then lib.head (lib.splitString "-" (lib.last (lib.splitString "/" result)))
+          else lib.toLower tag;
       } ''
-        ${lib.optionalString (tag == null) ''
+        ${if (tag == null) then ''
           outName="$(basename "$out")"
           outHash=$(echo "$outName" | cut -d - -f 1)
 
           imageTag=$outHash
+        '' else ''
+          imageTag="${tag}"
         ''}
 
         find ${bulkLayers} -mindepth 1 -maxdepth 1 | sort -t/ -k5 -n > layer-list
diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
index a5a65fb2a409..d78e35c56625 100644
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@@ -155,6 +155,7 @@ rec {
   layered-image = pkgs.dockerTools.buildLayeredImage {
     name = "layered-image";
     tag = "latest";
+    extraCommands = ''echo "(extraCommand)" > extraCommands'';
     config.Cmd = [ "${pkgs.hello}/bin/hello" ];
     contents = [ pkgs.hello pkgs.bash pkgs.coreutils ];
   };
diff --git a/pkgs/build-support/fetchbitbucket/default.nix b/pkgs/build-support/fetchbitbucket/default.nix
new file mode 100644
index 000000000000..a99f72e9eaa7
--- /dev/null
+++ b/pkgs/build-support/fetchbitbucket/default.nix
@@ -0,0 +1,10 @@
+{ fetchzip }:
+
+{ owner, repo, rev, name ? "source"
+, ... # For hash agility
+}@args: fetchzip ({
+  inherit name;
+  url = "https://bitbucket.org/${owner}/${repo}/get/${rev}.tar.gz";
+  meta.homepage = "https://bitbucket.org/${owner}/${repo}/";
+  extraPostFetch = ''rm -f "$out"/.hg_archival.txt''; # impure file; see #12002
+} // removeAttrs args [ "owner" "repo" "rev" ]) // { inherit rev; }
diff --git a/pkgs/build-support/fetchgit/default.nix b/pkgs/build-support/fetchgit/default.nix
index 9fccc27ef632..256c86748d28 100644
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@@ -19,6 +19,7 @@ in
 , # Shell code executed after the file has been fetched
   # successfully. This can do things like check or transform the file.
   postFetch ? ""
+, preferLocalBuild ? true
 }:
 
 /* NOTE:
@@ -66,5 +67,5 @@ stdenvNoCC.mkDerivation {
     "GIT_PROXY_COMMAND" "SOCKS_SERVER"
   ];
 
-  preferLocalBuild = true;
+  inherit preferLocalBuild;
 }
diff --git a/pkgs/build-support/fetchgithub/default.nix b/pkgs/build-support/fetchgithub/default.nix
new file mode 100644
index 000000000000..66671dd0a6ae
--- /dev/null
+++ b/pkgs/build-support/fetchgithub/default.nix
@@ -0,0 +1,33 @@
+{ lib, fetchgit, fetchzip }:
+
+{ owner, repo, rev, name ? "source"
+, fetchSubmodules ? false, private ? false
+, githubBase ? "github.com", varPrefix ? null
+, ... # For hash agility
+}@args: assert private -> !fetchSubmodules;
+let
+  baseUrl = "https://${githubBase}/${owner}/${repo}";
+  passthruAttrs = removeAttrs args [ "owner" "repo" "rev" "fetchSubmodules" "private" "githubBase" "varPrefix" ];
+  varBase = "NIX${if varPrefix == null then "" else "_${varPrefix}"}_GITHUB_PRIVATE_";
+  # We prefer fetchzip in cases we don't need submodules as the hash
+  # is more stable in that case.
+  fetcher = if fetchSubmodules then fetchgit else fetchzip;
+  privateAttrs = lib.optionalAttrs private {
+    netrcPhase = ''
+      if [ -z "''$${varBase}USERNAME" -o -z "''$${varBase}PASSWORD" ]; then
+        echo "Error: Private fetchFromGitHub requires the nix building process (nix-daemon in multi user mode) to have the ${varBase}USERNAME and ${varBase}PASSWORD env vars set." >&2
+        exit 1
+      fi
+      cat > netrc <<EOF
+      machine ${githubBase}
+              login ''$${varBase}USERNAME
+              password ''$${varBase}PASSWORD
+      EOF
+    '';
+    netrcImpureEnvVars = [ "${varBase}USERNAME" "${varBase}PASSWORD" ];
+  };
+  fetcherArgs = (if fetchSubmodules
+    then { inherit rev fetchSubmodules; url = "${baseUrl}.git"; }
+    else ({ url = "${baseUrl}/archive/${rev}.tar.gz"; } // privateAttrs)
+  ) // passthruAttrs // { inherit name; };
+in fetcher fetcherArgs // { meta.homepage = baseUrl; inherit rev; }
diff --git a/pkgs/build-support/fetchgitlab/default.nix b/pkgs/build-support/fetchgitlab/default.nix
new file mode 100644
index 000000000000..be110cf8393e
--- /dev/null
+++ b/pkgs/build-support/fetchgitlab/default.nix
@@ -0,0 +1,10 @@
+{ fetchzip, lib }:
+
+# gitlab example
+{ owner, repo, rev, domain ? "gitlab.com", name ? "source", group ? null
+, ... # For hash agility
+}@args: fetchzip ({
+  inherit name;
+  url = "https://${domain}/api/v4/projects/${lib.optionalString (group != null) "${lib.replaceStrings ["."] ["%2E"] group}%2F"}${lib.replaceStrings ["."] ["%2E"] owner}%2F${lib.replaceStrings ["."] ["%2E"] repo}/repository/archive.tar.gz?sha=${rev}";
+  meta.homepage = "https://${domain}/${lib.optionalString (group != null) "${group}/"}${owner}/${repo}/";
+} // removeAttrs args [ "domain" "owner" "group" "repo" "rev" ]) // { inherit rev; }
diff --git a/pkgs/build-support/fetchhg/default.nix b/pkgs/build-support/fetchhg/default.nix
index 40ead021cdbf..41eff1f9c0c5 100644
--- a/pkgs/build-support/fetchhg/default.nix
+++ b/pkgs/build-support/fetchhg/default.nix
@@ -1,4 +1,11 @@
-{stdenvNoCC, mercurial}: {name ? null, url, rev ? null, md5 ? null, sha256 ? null, fetchSubrepos ? false}:
+{ stdenvNoCC, mercurial }:
+{ name ? null
+, url
+, rev ? null
+, md5 ? null
+, sha256 ? null
+, fetchSubrepos ? false
+, preferLocalBuild ? true }:
 
 if md5 != null then
   throw "fetchhg does not support md5 anymore, please use sha256"
@@ -18,5 +25,5 @@ stdenvNoCC.mkDerivation {
   outputHash = sha256;
 
   inherit url rev;
-  preferLocalBuild = true;
+  inherit preferLocalBuild;
 }
diff --git a/pkgs/build-support/fetchipfs/default.nix b/pkgs/build-support/fetchipfs/default.nix
index dc8949794221..7a66999ec569 100644
--- a/pkgs/build-support/fetchipfs/default.nix
+++ b/pkgs/build-support/fetchipfs/default.nix
@@ -14,6 +14,7 @@
 , meta           ? {}
 , port           ? "8080"
 , postFetch      ? ""
+, preferLocalBuild ? true
 }:
 
 assert sha512 != "" -> builtins.compareVersions "1.11" builtins.nixVersion <= 0;
@@ -42,11 +43,10 @@ if (!hasHash) then throw "Specify sha for fetchipfs fixed-output derivation" els
           postFetch
           ipfs
           url
-          port;
+          port
+          meta;
 
   # Doing the download on a remote machine just duplicates network
   # traffic, so don't do that.
-  preferLocalBuild = true;
-
-  inherit meta;
+  inherit preferLocalBuild;
 }
diff --git a/pkgs/build-support/fetchrepoorcz/default.nix b/pkgs/build-support/fetchrepoorcz/default.nix
new file mode 100644
index 000000000000..3ac7cace0dcf
--- /dev/null
+++ b/pkgs/build-support/fetchrepoorcz/default.nix
@@ -0,0 +1,10 @@
+{ fetchzip }:
+
+# gitweb example, snapshot support is optional in gitweb
+{ repo, rev, name ? "source"
+, ... # For hash agility
+}@args: fetchzip ({
+  inherit name;
+  url = "https://repo.or.cz/${repo}.git/snapshot/${rev}.tar.gz";
+  meta.homepage = "https://repo.or.cz/${repo}.git/";
+} // removeAttrs args [ "repo" "rev" ]) // { inherit rev; }
diff --git a/pkgs/build-support/fetchsavannah/default.nix b/pkgs/build-support/fetchsavannah/default.nix
new file mode 100644
index 000000000000..994922a58679
--- /dev/null
+++ b/pkgs/build-support/fetchsavannah/default.nix
@@ -0,0 +1,10 @@
+{ fetchzip }:
+
+# cgit example, snapshot support is optional in cgit
+{ repo, rev, name ? "source"
+, ... # For hash agility
+}@args: fetchzip ({
+  inherit name;
+  url = "https://git.savannah.gnu.org/cgit/${repo}.git/snapshot/${repo}-${rev}.tar.gz";
+  meta.homepage = "https://git.savannah.gnu.org/cgit/${repo}.git/";
+} // removeAttrs args [ "repo" "rev" ]) // { inherit rev; }
diff --git a/pkgs/build-support/fetchsvn/default.nix b/pkgs/build-support/fetchsvn/default.nix
index da57d581dadd..194ce3b39b1d 100644
--- a/pkgs/build-support/fetchsvn/default.nix
+++ b/pkgs/build-support/fetchsvn/default.nix
@@ -1,6 +1,7 @@
 {stdenvNoCC, subversion, glibcLocales, sshSupport ? false, openssh ? null}:
-{url, rev ? "HEAD", md5 ? "", sha256 ? "",
- ignoreExternals ? false, ignoreKeywords ? false, name ? null}:
+{url, rev ? "HEAD", md5 ? "", sha256 ? ""
+, ignoreExternals ? false, ignoreKeywords ? false, name ? null
+, preferLocalBuild ? true }:
 
 let
   repoName = with stdenvNoCC.lib;
@@ -40,5 +41,5 @@ stdenvNoCC.mkDerivation {
   inherit url rev sshSupport openssh ignoreExternals ignoreKeywords;
 
   impureEnvVars = stdenvNoCC.lib.fetchers.proxyImpureEnvVars;
-  preferLocalBuild = true;
+  inherit preferLocalBuild;
 }
diff --git a/pkgs/build-support/fetchsvnssh/default.nix b/pkgs/build-support/fetchsvnssh/default.nix
index f76bd10247ba..fbd74efd750a 100644
--- a/pkgs/build-support/fetchsvnssh/default.nix
+++ b/pkgs/build-support/fetchsvnssh/default.nix
@@ -1,4 +1,4 @@
-{stdenvNoCC, subversion, sshSupport ? false, openssh ? null, expect}: 
+{stdenvNoCC, subversion, sshSupport ? true, openssh ? null, expect}:
 {username, password, url, rev ? "HEAD", md5 ? "", sha256 ? ""}:
 
 
diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
index 5f0c1384c79e..3ce90cbeab3a 100644
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@@ -87,6 +87,9 @@ in
 
   # Passthru information, if any.
 , passthru ? {}
+  # Doing the download on a remote machine just duplicates network
+  # traffic, so don't do that by default
+, preferLocalBuild ? true
 }:
 
 assert sha512 != "" -> builtins.compareVersions "1.11" builtins.nixVersion <= 0;
@@ -135,9 +138,7 @@ stdenvNoCC.mkDerivation {
 
   nixpkgsVersion = lib.trivial.release;
 
-  # Doing the download on a remote machine just duplicates network
-  # traffic, so don't do that.
-  preferLocalBuild = true;
+  inherit preferLocalBuild;
 
   postHook = if netrcPhase == null then null else ''
     ${netrcPhase}
diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index 6ee9ceb52861..404c744eea2a 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -44,6 +44,8 @@ rec {
 
   # GCC.
   gcc = [
+    https://bigsearcher.com/mirrors/gcc/
+    http://mirror.koddos.net/gcc/
     ftp://ftp.nluug.nl/mirror/languages/gcc/
     ftp://ftp.fu-berlin.de/unix/languages/gcc/
     ftp://ftp.irisa.fr/pub/mirrors/gcc.gnu.org/gcc/
@@ -257,9 +259,8 @@ rec {
 
   # X.org.
   xorg = [
-    http://xorg.freedesktop.org/releases/
-    http://ftp.gwdg.de/pub/x11/x.org/pub/
-    http://ftp.x.org/pub/ # often incomplete (e.g. files missing from X.org 7.4)
+    https://xorg.freedesktop.org/releases/
+    https://ftp.x.org/archive/
   ];
 
   # Apache mirrors (see http://www.apache.org/mirrors/).
diff --git a/pkgs/build-support/prefer-remote-fetch/default.nix b/pkgs/build-support/prefer-remote-fetch/default.nix
new file mode 100644
index 000000000000..2e55e3707421
--- /dev/null
+++ b/pkgs/build-support/prefer-remote-fetch/default.nix
@@ -0,0 +1,19 @@
+# An overlay that download sources on remote builder.
+# This is useful when the evaluating machine has a slow
+# upload while the builder can fetch faster directly from the source.
+# Usage: Put the following snippet in your usual overlay definition:
+#
+#   self: super:
+#     (super.prefer-remote-fetch self super)
+# Full configuration example for your own account:
+#
+# $ mkdir ~/.config/nixpkgs/overlays/
+# $ echo 'self: super: super.prefer-remote-fetch self super' > ~/.config/nixpkgs/overlays/prefer-remote-fetch.nix
+#
+self: super: {
+  fetchurl = args: super.fetchurl (args // { preferLocalBuild = false; });
+  fetchgit = args: super.fetchgit (args // { preferLocalBuild = false; });
+  fetchhg = args: super.fetchhg (args // { preferLocalBuild = false; });
+  fetchsvn = args: super.fetchsvn (args // { preferLocalBuild = false; });
+  fetchipfs = args: super.fetchipfs (args // { preferLocalBuild = false; });
+}
diff --git a/pkgs/build-support/rust/crates-io.nix b/pkgs/build-support/rust/crates-io.nix
index b03f52d35096..f312cd6e4903 100644
--- a/pkgs/build-support/rust/crates-io.nix
+++ b/pkgs/build-support/rust/crates-io.nix
@@ -4,7 +4,6 @@ let inherit (lib.lists) fold;
     inherit (lib.attrsets) recursiveUpdate;
 in
 rec {
-
 # aho-corasick-0.6.8
 
   crates.aho_corasick."0.6.8" = deps: { features?(features_.aho_corasick."0.6.8" deps {}) }: buildRustCrate {
@@ -1457,6 +1456,38 @@ rec {
 
 
 # end
+# serde-1.0.84
+
+  crates.serde."1.0.84" = deps: { features?(features_.serde."1.0.84" deps {}) }: buildRustCrate {
+    crateName = "serde";
+    version = "1.0.84";
+    authors = [ "Erick Tryzelaar <erick.tryzelaar@gmail.com>" "David Tolnay <dtolnay@gmail.com>" ];
+    sha256 = "1x40cvvkbkz592jflwbfbxhim3wxdqp9dy0qxjw13ra7q57b29gy";
+    build = "build.rs";
+    dependencies = mapFeatures features ([
+]);
+    features = mkFeatures (features."serde"."1.0.84" or {});
+  };
+  features_.serde."1.0.84" = deps: f: updateFeatures f (rec {
+    serde = fold recursiveUpdate {} [
+      { "1.0.84".default = (f.serde."1.0.84".default or true); }
+      { "1.0.84".serde_derive =
+        (f.serde."1.0.84".serde_derive or false) ||
+        (f.serde."1.0.84".derive or false) ||
+        (serde."1.0.84"."derive" or false); }
+      { "1.0.84".std =
+        (f.serde."1.0.84".std or false) ||
+        (f.serde."1.0.84".default or false) ||
+        (serde."1.0.84"."default" or false); }
+      { "1.0.84".unstable =
+        (f.serde."1.0.84".unstable or false) ||
+        (f.serde."1.0.84".alloc or false) ||
+        (serde."1.0.84"."alloc" or false); }
+    ];
+  }) [];
+
+
+# end
 # serde_derive-1.0.80
 
   crates.serde_derive."1.0.80" = deps: { features?(features_.serde_derive."1.0.80" deps {}) }: buildRustCrate {
@@ -1745,6 +1776,26 @@ rec {
 
 
 # end
+# toml-0.4.10
+
+  crates.toml."0.4.10" = deps: { features?(features_.toml."0.4.10" deps {}) }: buildRustCrate {
+    crateName = "toml";
+    version = "0.4.10";
+    authors = [ "Alex Crichton <alex@alexcrichton.com>" ];
+    sha256 = "0fs4kxl86w3kmgwcgcv23nk79zagayz1spg281r83w0ywf88d6f1";
+    dependencies = mapFeatures features ([
+      (crates."serde"."${deps."toml"."0.4.10"."serde"}" deps)
+    ]);
+  };
+  features_.toml."0.4.10" = deps: f: updateFeatures f (rec {
+    serde."${deps.toml."0.4.10".serde}".default = true;
+    toml."0.4.10".default = (f.toml."0.4.10".default or true);
+  }) [
+    (features_.serde."${deps."toml"."0.4.10"."serde"}" deps)
+  ];
+
+
+# end
 # toml-0.4.8
 
   crates.toml."0.4.8" = deps: { features?(features_.toml."0.4.8" deps {}) }: buildRustCrate {
@@ -1765,6 +1816,26 @@ rec {
 
 
 # end
+# toml2nix-0.1.1
+
+  crates.toml2nix."0.1.1" = deps: { features?(features_.toml2nix."0.1.1" deps {}) }: buildRustCrate {
+    crateName = "toml2nix";
+    version = "0.1.1";
+    authors = [ "Pierre-Étienne Meunier <pierre-etienne.meunier@inria.fr>" ];
+    sha256 = "167qyylp0s76h7r0n99as3jwry5mrn5q1wxh2sdwh51d5qnnw6b2";
+    dependencies = mapFeatures features ([
+      (crates."toml"."${deps."toml2nix"."0.1.1"."toml"}" deps)
+    ]);
+  };
+  features_.toml2nix."0.1.1" = deps: f: updateFeatures f (rec {
+    toml."${deps.toml2nix."0.1.1".toml}".default = true;
+    toml2nix."0.1.1".default = (f.toml2nix."0.1.1".default or true);
+  }) [
+    (features_.toml."${deps."toml2nix"."0.1.1"."toml"}" deps)
+  ];
+
+
+# end
 # ucd-util-0.1.1
 
   crates.ucd_util."0.1.1" = deps: { features?(features_.ucd_util."0.1.1" deps {}) }: buildRustCrate {
diff --git a/pkgs/build-support/setup-hooks/make-wrapper.sh b/pkgs/build-support/setup-hooks/make-wrapper.sh
index bc12be0fa36c..06891893e8c1 100644
--- a/pkgs/build-support/setup-hooks/make-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-wrapper.sh
@@ -8,7 +8,7 @@ assertExecutable() {
 }
 
 # construct an executable file that wraps the actual executable
-# makeWrapper EXECUTABLE ARGS
+# makeWrapper EXECUTABLE OUT_PATH ARGS
 
 # ARGS:
 # --argv0       NAME    : set name of executed process to NAME
diff --git a/pkgs/build-support/setup-hooks/prune-libtool-files.sh b/pkgs/build-support/setup-hooks/prune-libtool-files.sh
index d75812e05b60..5d7432e8f09a 100644
--- a/pkgs/build-support/setup-hooks/prune-libtool-files.sh
+++ b/pkgs/build-support/setup-hooks/prune-libtool-files.sh
@@ -8,7 +8,7 @@
 fixupOutputHooks+=(_pruneLibtoolFiles)
 
 _pruneLibtoolFiles() {
-    if [ "$dontPruneLibtoolFiles" ]; then
+    if [ "$dontPruneLibtoolFiles" ] || [ ! -e "$prefix" ]; then
        return
     fi
 
@@ -16,7 +16,7 @@ _pruneLibtoolFiles() {
     # the "old_library" field for static libraries.  We are processing only
     # those .la files that do not describe static libraries.
     find "$prefix" -type f -name '*.la' \
-         -exec grep -q '^# Generated by libtool' {} \; \
+         -exec grep -q '^# Generated by .*libtool' {} \; \
          -exec grep -q "^old_library=''" {} \; \
          -exec sed -i {} -e "/^dependency_libs='[^']/ c dependency_libs='' #pruned" \;
 }
diff --git a/pkgs/build-support/singularity-tools/default.nix b/pkgs/build-support/singularity-tools/default.nix
index cc86fef64ccc..4206b0f33ff9 100644
--- a/pkgs/build-support/singularity-tools/default.nix
+++ b/pkgs/build-support/singularity-tools/default.nix
@@ -74,7 +74,10 @@ rec {
             mkdir -p bin nix/store
             for f in $(cat $layerClosure) ; do
               cp -ar $f ./$f
-              for f in $f/bin/* ; do
+            done
+
+            for c in ${toString contents} ; do
+              for f in $c/bin/* ; do
                 if [ ! -e bin/$(basename $f) ] ; then
                   ln -s $f bin/
                 fi
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index 7543433640a3..454ef8912b3b 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -258,15 +258,17 @@ rec {
    * Example:
    *
    * # Symlinks hello path in store to current $out/hello
-   * linkFarm "hello" entries = [ { name = "hello"; path = pkgs.hello; } ];
+   * linkFarm "hello" [ { name = "hello"; path = pkgs.hello; } ];
    *
    */
-  linkFarm = name: entries: runCommand name { preferLocalBuild = true; }
-    ("mkdir -p $out; cd $out; \n" +
-      (lib.concatMapStrings (x: ''
-        mkdir -p "$(dirname '${x.name}')"
-        ln -s '${x.path}' '${x.name}'
-      '') entries));
+  linkFarm = name: entries: runCommand name { preferLocalBuild = true; allowSubstitutes = false; }
+    ''mkdir -p $out
+      cd $out
+      ${lib.concatMapStrings (x: ''
+          mkdir -p "$(dirname ${lib.escapeShellArg x.name})"
+          ln -s ${lib.escapeShellArg x.path} ${lib.escapeShellArg x.name}
+      '') entries}
+    '';
 
 
   /* Print an error message if the file with the specified name and
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 7880d98e6b6a..3612be1120ca 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -162,7 +162,7 @@ rec {
     fi
 
     # Set up automatic kernel module loading.
-    export MODULE_DIR=${linux}/lib/modules/
+    export MODULE_DIR=${kernel}/lib/modules/
     ${coreutils}/bin/cat <<EOF > /run/modprobe
     #! /bin/sh
     export MODULE_DIR=$MODULE_DIR
@@ -315,7 +315,7 @@ rec {
       name = "extract-file";
       buildInputs = [ utillinux ];
       buildCommand = ''
-        ln -s ${linux}/lib /lib
+        ln -s ${kernel}/lib /lib
         ${kmod}/bin/modprobe loop
         ${kmod}/bin/modprobe ext4
         ${kmod}/bin/modprobe hfs
@@ -340,7 +340,7 @@ rec {
       name = "extract-file-mtd";
       buildInputs = [ utillinux mtdutils ];
       buildCommand = ''
-        ln -s ${linux}/lib /lib
+        ln -s ${kernel}/lib /lib
         ${kmod}/bin/modprobe mtd
         ${kmod}/bin/modprobe mtdram total_size=131072
         ${kmod}/bin/modprobe mtdchar
@@ -964,6 +964,40 @@ rec {
       packages = commonDebPackages ++ [ "diffutils" "libc-bin" ];
     };
 
+    ubuntu1804i386 = {
+      name = "ubuntu-18.04-bionic-i386";
+      fullName = "Ubuntu 18.04 Bionic (i386)";
+      packagesLists =
+        [ (fetchurl {
+            url = mirror://ubuntu/dists/bionic/main/binary-i386/Packages.xz;
+            sha256 = "0f0v4131kwf7m7f8j3288rlqdxk1k3vqy74b7fcfd6jz9j8d840i";
+          })
+          (fetchurl {
+            url = mirror://ubuntu/dists/bionic/universe/binary-i386/Packages.xz;
+            sha256 = "1v75c0dqr0wp0dqd4hnci92qqs4hll8frqdbpswadgxm5chn91bw";
+          })
+        ];
+      urlPrefix = mirror://ubuntu;
+      packages = commonDebPackages ++ [ "diffutils" "libc-bin" ];
+    };
+
+    ubuntu1804x86_64 = {
+      name = "ubuntu-18.04-bionic-amd64";
+      fullName = "Ubuntu 18.04 Bionic (amd64)";
+      packagesLists =
+        [ (fetchurl {
+            url = mirror://ubuntu/dists/bionic/main/binary-amd64/Packages.xz;
+            sha256 = "1ls81bjyvmfz6i919kszl7xks1ibrh1xqhsk6698ackndkm0wp39";
+          })
+          (fetchurl {
+            url = mirror://ubuntu/dists/bionic/universe/binary-amd64/Packages.xz;
+            sha256 = "1832nqpn4ap95b3sj870xqayrza9in4kih9jkmjax27pq6x15v1r";
+          })
+        ];
+      urlPrefix = mirror://ubuntu;
+      packages = commonDebPackages ++ [ "diffutils" "libc-bin" ];
+    };
+
     debian8i386 = {
       name = "debian-8.11-jessie-i386";
       fullName = "Debian 8.11 Jessie (i386)";