8 files changed, 112 insertions, 10 deletions
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 47c992d1f6ba..176df51cbd9a 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -13,6 +13,7 @@
 , extraPackages ? [], extraBuildCommands ? ""
 , isGNU ? false, isClang ? cc.isClang or false, gnugrep ? null
 , buildPackages ? {}
+, libcxx ? null
 }:
 
 with stdenvNoCC.lib;
@@ -44,8 +45,11 @@ let
   # The wrapper scripts use 'cat' and 'grep', so we may need coreutils.
   coreutils_bin = if nativeTools then "" else getBin coreutils;
 
-  default_cxx_stdlib_compile = optionalString (targetPlatform.isLinux && !(cc.isGNU or false) && !nativeTools && cc ? gcc)
-    "-isystem $(echo -n ${cc.gcc}/include/c++/*) -isystem $(echo -n ${cc.gcc}/include/c++/*)/$(${cc.gcc}/bin/gcc -dumpmachine)";
+  default_cxx_stdlib_compile = if (targetPlatform.isLinux && !(cc.isGNU or false) && !nativeTools && cc ? gcc) then
+    "-isystem $(echo -n ${cc.gcc}/include/c++/*) -isystem $(echo -n ${cc.gcc}/include/c++/*)/$(${cc.gcc}/bin/gcc -dumpmachine)"
+  else if targetPlatform.isDarwin && (libcxx != null) && (cc.isClang or false) then
+    "-isystem ${libcxx}/include/c++/v1"
+  else "";
 
   # The "infix salt" is a arbitrary string added in the middle of env vars
   # defined by cc-wrapper's hooks so that multiple cc-wrappers can be used
@@ -256,9 +260,9 @@ stdenv.mkDerivation {
 
       echo "$ccLDFlags" > $out/nix-support/cc-ldflags
       echo "$ccCFlags" > $out/nix-support/cc-cflags
-    ''
-
-    + optionalString propagateDoc ''
+    '' + optionalString (targetPlatform.isDarwin && (libcxx != null) && (cc.isClang or false)) ''
+      echo " -L${libcxx}/lib" >> $out/nix-support/cc-ldflags
+    '' + optionalString propagateDoc ''
       ##
       ## Man page and info support
       ##
@@ -320,5 +324,6 @@ stdenv.mkDerivation {
     { description =
         stdenv.lib.attrByPath ["meta" "description"] "System C compiler" cc_
         + " (wrapper script)";
+      priority = 10;
   };
 }
diff --git a/pkgs/build-support/fetchbitbucket/default.nix b/pkgs/build-support/fetchbitbucket/default.nix
new file mode 100644
index 000000000000..a99f72e9eaa7
--- /dev/null
+++ b/pkgs/build-support/fetchbitbucket/default.nix
@@ -0,0 +1,10 @@
+{ fetchzip }:
+
+{ owner, repo, rev, name ? "source"
+, ... # For hash agility
+}@args: fetchzip ({
+  inherit name;
+  url = "https://bitbucket.org/${owner}/${repo}/get/${rev}.tar.gz";
+  meta.homepage = "https://bitbucket.org/${owner}/${repo}/";
+  extraPostFetch = ''rm -f "$out"/.hg_archival.txt''; # impure file; see #12002
+} // removeAttrs args [ "owner" "repo" "rev" ]) // { inherit rev; }
diff --git a/pkgs/build-support/fetchgithub/default.nix b/pkgs/build-support/fetchgithub/default.nix
new file mode 100644
index 000000000000..66671dd0a6ae
--- /dev/null
+++ b/pkgs/build-support/fetchgithub/default.nix
@@ -0,0 +1,33 @@
+{ lib, fetchgit, fetchzip }:
+
+{ owner, repo, rev, name ? "source"
+, fetchSubmodules ? false, private ? false
+, githubBase ? "github.com", varPrefix ? null
+, ... # For hash agility
+}@args: assert private -> !fetchSubmodules;
+let
+  baseUrl = "https://${githubBase}/${owner}/${repo}";
+  passthruAttrs = removeAttrs args [ "owner" "repo" "rev" "fetchSubmodules" "private" "githubBase" "varPrefix" ];
+  varBase = "NIX${if varPrefix == null then "" else "_${varPrefix}"}_GITHUB_PRIVATE_";
+  # We prefer fetchzip in cases we don't need submodules as the hash
+  # is more stable in that case.
+  fetcher = if fetchSubmodules then fetchgit else fetchzip;
+  privateAttrs = lib.optionalAttrs private {
+    netrcPhase = ''
+      if [ -z "''$${varBase}USERNAME" -o -z "''$${varBase}PASSWORD" ]; then
+        echo "Error: Private fetchFromGitHub requires the nix building process (nix-daemon in multi user mode) to have the ${varBase}USERNAME and ${varBase}PASSWORD env vars set." >&2
+        exit 1
+      fi
+      cat > netrc <<EOF
+      machine ${githubBase}
+              login ''$${varBase}USERNAME
+              password ''$${varBase}PASSWORD
+      EOF
+    '';
+    netrcImpureEnvVars = [ "${varBase}USERNAME" "${varBase}PASSWORD" ];
+  };
+  fetcherArgs = (if fetchSubmodules
+    then { inherit rev fetchSubmodules; url = "${baseUrl}.git"; }
+    else ({ url = "${baseUrl}/archive/${rev}.tar.gz"; } // privateAttrs)
+  ) // passthruAttrs // { inherit name; };
+in fetcher fetcherArgs // { meta.homepage = baseUrl; inherit rev; }
diff --git a/pkgs/build-support/fetchgitlab/default.nix b/pkgs/build-support/fetchgitlab/default.nix
new file mode 100644
index 000000000000..be110cf8393e
--- /dev/null
+++ b/pkgs/build-support/fetchgitlab/default.nix
@@ -0,0 +1,10 @@
+{ fetchzip, lib }:
+
+# gitlab example
+{ owner, repo, rev, domain ? "gitlab.com", name ? "source", group ? null
+, ... # For hash agility
+}@args: fetchzip ({
+  inherit name;
+  url = "https://${domain}/api/v4/projects/${lib.optionalString (group != null) "${lib.replaceStrings ["."] ["%2E"] group}%2F"}${lib.replaceStrings ["."] ["%2E"] owner}%2F${lib.replaceStrings ["."] ["%2E"] repo}/repository/archive.tar.gz?sha=${rev}";
+  meta.homepage = "https://${domain}/${lib.optionalString (group != null) "${group}/"}${owner}/${repo}/";
+} // removeAttrs args [ "domain" "owner" "group" "repo" "rev" ]) // { inherit rev; }
diff --git a/pkgs/build-support/fetchrepoorcz/default.nix b/pkgs/build-support/fetchrepoorcz/default.nix
new file mode 100644
index 000000000000..3ac7cace0dcf
--- /dev/null
+++ b/pkgs/build-support/fetchrepoorcz/default.nix
@@ -0,0 +1,10 @@
+{ fetchzip }:
+
+# gitweb example, snapshot support is optional in gitweb
+{ repo, rev, name ? "source"
+, ... # For hash agility
+}@args: fetchzip ({
+  inherit name;
+  url = "https://repo.or.cz/${repo}.git/snapshot/${rev}.tar.gz";
+  meta.homepage = "https://repo.or.cz/${repo}.git/";
+} // removeAttrs args [ "repo" "rev" ]) // { inherit rev; }
diff --git a/pkgs/build-support/fetchsavannah/default.nix b/pkgs/build-support/fetchsavannah/default.nix
new file mode 100644
index 000000000000..994922a58679
--- /dev/null
+++ b/pkgs/build-support/fetchsavannah/default.nix
@@ -0,0 +1,10 @@
+{ fetchzip }:
+
+# cgit example, snapshot support is optional in cgit
+{ repo, rev, name ? "source"
+, ... # For hash agility
+}@args: fetchzip ({
+  inherit name;
+  url = "https://git.savannah.gnu.org/cgit/${repo}.git/snapshot/${repo}-${rev}.tar.gz";
+  meta.homepage = "https://git.savannah.gnu.org/cgit/${repo}.git/";
+} // removeAttrs args [ "repo" "rev" ]) // { inherit rev; }
diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh b/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh
index 25ac12996cc1..b5ceb4a13d85 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh
@@ -36,16 +36,40 @@ wrapGAppsHook() {
   done
 
   if [[ -z "$dontWrapGApps" ]]; then
+    targetDirsThatExist=()
+    targetDirsRealPath=()
+
+    # wrap binaries
     targetDirs=( "${prefix}/bin" "${prefix}/libexec" )
     for targetDir in "${targetDirs[@]}"; do
       if [[ -d "${targetDir}" ]]; then
-        find -L "${targetDir}" -type f -executable -print0 \
+        targetDirsThatExist+=("${targetDir}")
+        targetDirsRealPath+=("$(realpath "${targetDir}")/")
+        find "${targetDir}" -type f -executable -print0 \
           | while IFS= read -r -d '' file; do
-          echo "Wrapping program ${file}"
+          echo "Wrapping program '${file}'"
           wrapProgram "${file}" "${gappsWrapperArgs[@]}"
         done
       fi
     done
+
+    # wrap links to binaries that point outside targetDirs
+    # Note: links to binaries within targetDirs do not need
+    #       to be wrapped as the binaries have already been wrapped
+    if [[ ${#targetDirsThatExist[@]} -ne 0 ]]; then
+      find "${targetDirsThatExist[@]}" -type l -xtype f -executable -print0 \
+        | while IFS= read -r -d '' linkPath; do
+        linkPathReal=$(realpath "${linkPath}")
+        for targetPath in "${targetDirsRealPath[@]}"; do
+          if [[ "$linkPathReal" == "$targetPath"* ]]; then
+            echo "Not wrapping link: '$linkPath' (already wrapped)"
+            continue 2
+          fi
+        done
+        echo "Wrapping link: '$linkPath'"
+        wrapProgram "${linkPath}" "${gappsWrapperArgs[@]}"
+      done
+    fi
   fi
 }
 
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index bd4465e93a15..d6feb7e9ded1 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -162,7 +162,7 @@ rec {
     fi
 
     # Set up automatic kernel module loading.
-    export MODULE_DIR=${linux}/lib/modules/
+    export MODULE_DIR=${kernel}/lib/modules/
     ${coreutils}/bin/cat <<EOF > /run/modprobe
     #! ${bash}/bin/sh
     export MODULE_DIR=$MODULE_DIR
@@ -315,7 +315,7 @@ rec {
       name = "extract-file";
       buildInputs = [ utillinux ];
       buildCommand = ''
-        ln -s ${linux}/lib /lib
+        ln -s ${kernel}/lib /lib
         ${kmod}/bin/modprobe loop
         ${kmod}/bin/modprobe ext4
         ${kmod}/bin/modprobe hfs
@@ -340,7 +340,7 @@ rec {
       name = "extract-file-mtd";
       buildInputs = [ utillinux mtdutils ];
       buildCommand = ''
-        ln -s ${linux}/lib /lib
+        ln -s ${kernel}/lib /lib
         ${kmod}/bin/modprobe mtd
         ${kmod}/bin/modprobe mtdram total_size=131072
         ${kmod}/bin/modprobe mtdchar