diff --git a/pkgs/applications/editors/geany/default.nix b/pkgs/applications/editors/geany/default.nix
index 799f58e5b68c..ed77e6f4b471 100644
--- a/pkgs/applications/editors/geany/default.nix
+++ b/pkgs/applications/editors/geany/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gtk2, which, pkgconfig, intltool, file, libintl }:
+{ stdenv, fetchurl, gtk2, which, pkgconfig, intltool, file, libintl, hicolor-icon-theme }:
 
 with stdenv.lib;
 
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkgconfig intltool libintl ];
-  buildInputs = [ gtk2 which file ];
+  buildInputs = [ gtk2 which file hicolor-icon-theme ];
 
   doCheck = true;
 
@@ -23,10 +23,6 @@ stdenv.mkDerivation rec {
 
   patchPhase = "patchShebangs .";
 
-  # This file should normally require a gtk-update-icon-cache -q /usr/share/icons/hicolor command
-  # It have no reasons to exist in a redistribuable package
-  postInstall = "rm $out/share/icons/hicolor/icon-theme.cache";
-
   meta = {
     description = "Small and lightweight IDE";
     longDescription = ''
diff --git a/pkgs/applications/graphics/dia/default.nix b/pkgs/applications/graphics/dia/default.nix
index ef63cb97a735..949dce7132be 100644
--- a/pkgs/applications/graphics/dia/default.nix
+++ b/pkgs/applications/graphics/dia/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchgit, autoconf, automake, libtool, gtk2, pkgconfig, perl,
 perlXMLParser, libxml2, gettext, python, libxml2Python, docbook5, docbook_xsl,
-libxslt, intltool, libart_lgpl, withGNOME ? false, libgnomeui,
+libxslt, intltool, libart_lgpl, withGNOME ? false, libgnomeui, hicolor-icon-theme,
 gtk-mac-integration }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [ gtk2 perlXMLParser libxml2 gettext python libxml2Python docbook5
-      libxslt docbook_xsl libart_lgpl ]
+      libxslt docbook_xsl libart_lgpl hicolor-icon-theme ]
       ++ stdenv.lib.optional withGNOME libgnomeui
       ++ stdenv.lib.optional stdenv.isDarwin gtk-mac-integration;
 
@@ -28,12 +28,6 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  # This file should normally require a gtk-update-icon-cache -q /usr/share/icons/hicolor command
-  # It have no reasons to exist in a redistribuable package
-  postInstall = ''
-    rm $out/share/icons/hicolor/icon-theme.cache
-  '';
-
   meta = {
     description = "Gnome Diagram drawing software";
     homepage = http://live.gnome.org/Dia;
diff --git a/pkgs/applications/graphics/glabels/default.nix b/pkgs/applications/graphics/glabels/default.nix
index b4715902df1f..df8ebee020c9 100644
--- a/pkgs/applications/graphics/glabels/default.nix
+++ b/pkgs/applications/graphics/glabels/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, barcode, gnome3, autoreconfHook
 , gtk3, gtk-doc, libxml2, librsvg , libtool, libe-book
-, intltool, itstool, makeWrapper, pkgconfig
+, intltool, itstool, makeWrapper, pkgconfig, hicolor-icon-theme
 }:
 
 stdenv.mkDerivation rec {
@@ -17,11 +17,10 @@ stdenv.mkDerivation rec {
     barcode gtk3 gtk-doc gnome3.yelp-tools
     gnome3.gnome-common gnome3.gsettings-desktop-schemas
     itstool libxml2 librsvg libe-book libtool
-    
+    hicolor-icon-theme
   ];
 
   preFixup = ''
-    rm "$out/share/icons/hicolor/icon-theme.cache"
     wrapProgram "$out/bin/glabels-3" \
       --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
   '';
diff --git a/pkgs/applications/graphics/inkscape/default.nix b/pkgs/applications/graphics/inkscape/default.nix
index a82f13ee409a..f4d08195309b 100644
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@@ -2,7 +2,7 @@
 , libpng, zlib, popt, boehmgc, libxml2, libxslt, glib, gtkmm2
 , glibmm, libsigcxx, lcms, boost, gettext, makeWrapper
 , gsl, python2, poppler, imagemagick, libwpg, librevenge
-, libvisio, libcdr, libexif, potrace, cmake
+, libvisio, libcdr, libexif, potrace, cmake, hicolor-icon-theme
 }:
 
 let
@@ -44,15 +44,13 @@ stdenv.mkDerivation rec {
     libXft libpng zlib popt boehmgc
     libxml2 libxslt glib gtkmm2 glibmm libsigcxx lcms boost gettext
     gsl poppler imagemagick libwpg librevenge
-    libvisio libcdr libexif potrace
+    libvisio libcdr libexif potrace hicolor-icon-theme
   ];
 
   enableParallelBuilding = true;
 
-  postInstall = ''
-    # Make sure PyXML modules can be found at run-time.
-    rm -f "$out/share/icons/hicolor/icon-theme.cache"
-  '' + stdenv.lib.optionalString stdenv.isDarwin ''
+  # Make sure PyXML modules can be found at run-time.
+  postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
     install_name_tool -change $out/lib/libinkscape_base.dylib $out/lib/inkscape/libinkscape_base.dylib $out/bin/inkscape
     install_name_tool -change $out/lib/libinkscape_base.dylib $out/lib/inkscape/libinkscape_base.dylib $out/bin/inkview
   '';
diff --git a/pkgs/applications/networking/newsreaders/liferea/default.nix b/pkgs/applications/networking/newsreaders/liferea/default.nix
index 74d59c05ec91..a82891a8f35f 100644
--- a/pkgs/applications/networking/newsreaders/liferea/default.nix
+++ b/pkgs/applications/networking/newsreaders/liferea/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, pkgconfig, intltool, python3Packages, wrapGAppsHook
 , glib, libxml2, libxslt, sqlite, libsoup , webkitgtk, json-glib, gst_all_1
 , libnotify, gtk3, gsettings-desktop-schemas, libpeas, dconf, librsvg
-, gobjectIntrospection, glib-networking
+, gobjectIntrospection, glib-networking, hicolor-icon-theme
 }:
 
 let
@@ -20,7 +20,7 @@ in stdenv.mkDerivation rec {
   buildInputs = [
     glib gtk3 webkitgtk libxml2 libxslt sqlite libsoup gsettings-desktop-schemas
     libpeas gsettings-desktop-schemas json-glib dconf gobjectIntrospection
-    librsvg glib-networking libnotify
+    librsvg glib-networking libnotify hicolor-icon-theme
   ] ++ (with gst_all_1; [
     gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad
   ]);
@@ -28,7 +28,6 @@ in stdenv.mkDerivation rec {
   pythonPath = with python3Packages; [ pygobject3 pycairo ];
 
   preFixup = ''
-    rm "$out/share/icons/hicolor/icon-theme.cache"
     buildPythonPath "$out $pythonPath"
     gappsWrapperArgs+=(--prefix PYTHONPATH : "$program_PYTHONPATH")
   '';
diff --git a/pkgs/applications/networking/p2p/transmission/default.nix b/pkgs/applications/networking/p2p/transmission/default.nix
index d9ddf0459216..b94864a0b40f 100644
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, intltool, file, wrapGAppsHook
-, openssl, curl, libevent, inotify-tools, systemd, zlib
+, openssl, curl, libevent, inotify-tools, systemd, zlib, hicolor-icon-theme
 , enableGTK3 ? false, gtk3
 , enableSystemd ? stdenv.isLinux
 , enableDaemon ? true
@@ -22,7 +22,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ intltool file openssl curl libevent zlib ]
     ++ optionals enableGTK3 [ gtk3 ]
     ++ optionals enableSystemd [ systemd ]
-    ++ optionals stdenv.isLinux [ inotify-tools ];
+    ++ optionals stdenv.isLinux [ inotify-tools ]
+    ++ optionals enableGTK3 [ hicolor-icon-theme ];
 
   postPatch = ''
     substituteInPlace ./configure \
@@ -39,10 +40,6 @@ stdenv.mkDerivation rec {
     ++ optional enableSystemd "--with-systemd-daemon"
     ++ optional enableGTK3 "--with-gtk";
 
-  preFixup = optionalString enableGTK3 ''
-    rm "$out/share/icons/hicolor/icon-theme.cache"
-  '';
-
   NIX_LDFLAGS = optionalString stdenv.isDarwin "-framework CoreFoundation";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/office/gnucash/2.4.nix b/pkgs/applications/office/gnucash/2.4.nix
index 252c6d878d0c..b4e962ce3fcf 100644
--- a/pkgs/applications/office/gnucash/2.4.nix
+++ b/pkgs/applications/office/gnucash/2.4.nix
@@ -1,7 +1,7 @@
 { fetchurl, stdenv, pkgconfig, libxml2, gconf, glib, gtk2, libgnomeui, libofx
 , libgtkhtml, gtkhtml, libgnomeprint, goffice, enchant, gettext, libbonoboui
 , intltool, perl, guile, slibGuile, swig, isocodes, bzip2, makeWrapper, libglade
-, libgsf, libart_lgpl, perlPackages, aqbanking, gwenhywfar
+, libgsf, libart_lgpl, perlPackages, aqbanking, gwenhywfar, hicolor-icon-theme
 }:
 
 /* If you experience GConf errors when running GnuCash on NixOS, see
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
     libgnomeprint goffice enchant gettext intltool perl guile slibGuile
     swig isocodes bzip2 makeWrapper libofx libglade libgsf libart_lgpl
     perlPackages.DateManip perlPackages.FinanceQuote aqbanking gwenhywfar
+    hicolor-icon-theme
   ];
   propagatedUserEnvPkgs = [ gconf ];
 
@@ -49,8 +50,6 @@ stdenv.mkDerivation rec {
         --set GCONF_CONFIG_SOURCE 'xml::~/.gconf'                       \
         --prefix PATH ":" "$out/bin:${stdenv.lib.makeBinPath [ perl gconf ]}"
     done
-
-    rm $out/share/icons/hicolor/icon-theme.cache
   '';
 
   # The following settings fix failures in the test suite. It's not required otherwise.
diff --git a/pkgs/applications/office/gnucash/2.6.nix b/pkgs/applications/office/gnucash/2.6.nix
index 4d85374ee9a6..471d2d757d96 100644
--- a/pkgs/applications/office/gnucash/2.6.nix
+++ b/pkgs/applications/office/gnucash/2.6.nix
@@ -3,7 +3,7 @@
 , glib, gtk2, libofx, aqbanking, gwenhywfar, libgnomecanvas, goffice
 , webkit, glibcLocales, gsettings-desktop-schemas, dconf
 , gettext, swig, slibGuile, enchant, bzip2, isocodes, libdbi, libdbiDrivers
-, pango, gdk_pixbuf
+, pango, gdk_pixbuf, hicolor-icon-theme
 }:
 
 /*
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     libxml2 libxslt glibcLocales gettext swig enchant
     bzip2 isocodes
     # glib, gtk...
-    glib gtk2 goffice webkit
+    glib gtk2 goffice webkit hicolor-icon-theme
     # gnome...
     dconf gconf libgnomecanvas gsettings-desktop-schemas
     # financial
@@ -83,8 +83,6 @@ stdenv.mkDerivation rec {
         --prefix GIO_EXTRA_MODULES : "${stdenv.lib.getLib dconf}/lib/gio/modules"  \
         --prefix PATH ":" "$out/bin:${stdenv.lib.makeBinPath [ perl gconf ]}"
     done
-
-    rm $out/share/icons/hicolor/icon-theme.cache
   '';
 
   # The following settings fix failures in the test suite. It's not required otherwise.
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 9ff0f4e6e9b9..6cc109c48c75 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -244,6 +244,7 @@ EOF
 
   ## InstallCheck
 
+  doCheck = false;
   doInstallCheck = true;
 
   installCheckTarget = "test";
diff --git a/pkgs/applications/video/handbrake/default.nix b/pkgs/applications/video/handbrake/default.nix
index 32dd3e6ff758..2f27eb838841 100644
--- a/pkgs/applications/video/handbrake/default.nix
+++ b/pkgs/applications/video/handbrake/default.nix
@@ -10,7 +10,7 @@
   libogg, libopus, libtheora, libvorbis, libdvdcss, a52dec,
   lame, libdvdread, libdvdnav, libbluray,
   mp4v2, mpeg2dec, x264, x265, libmkv,
-  fontconfig, freetype,
+  fontconfig, freetype, hicolor-icon-theme,
   glib, gtk3, intltool, libnotify,
   gst_all_1, dbus-glib, udev, libgudev, libvpx,
   useGtk ? true, wrapGAppsHook ? null, libappindicator-gtk3 ? null,
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals useGtk [
     glib gtk3 libappindicator-gtk3 libnotify
     gst_all_1.gstreamer gst_all_1.gst-plugins-base dbus-glib udev
-    libgudev
+    libgudev hicolor-icon-theme
   ] ++ (if useFfmpeg then [ ffmpeg ] else [ patched_libav_12 ])
   ++ lib.optional useFdk fdk_aac;
 
@@ -82,11 +82,6 @@ stdenv.mkDerivation rec {
     cd build
   '';
 
-  # icon-theme.cache belongs in the icon theme, not in individual packages
-  postInstall = ''
-    rm $out/share/icons/hicolor/icon-theme.cache
-  '';
-
   meta = with stdenv.lib; {
     homepage = http://handbrake.fr/;
     description = "A tool for converting video files and ripping DVDs";
diff --git a/pkgs/build-support/bintools-wrapper/setup-hook.sh b/pkgs/build-support/bintools-wrapper/setup-hook.sh
index 025f6aa6e7aa..f65b792485a0 100644
--- a/pkgs/build-support/bintools-wrapper/setup-hook.sh
+++ b/pkgs/build-support/bintools-wrapper/setup-hook.sh
@@ -20,7 +20,13 @@ bintoolsWrapper_addLDVars () {
     fi
 
     if [[ -d "$1/lib" ]]; then
-        export NIX_${role_pre}LDFLAGS+=" -L$1/lib"
+        # Don't add the /lib directory if it actually doesn't contain any libraries. For instance,
+        # Python and Haskell packages often only have directories like $out/lib/ghc-8.4.3/ or
+        # $out/lib/python3.6/, so having them in LDFLAGS just makes the linker search unnecessary
+        # directories and bloats the size of the environment variable space.
+        if [[ -n "$(echo $1/lib/lib*)" ]]; then
+            export NIX_${role_pre}LDFLAGS+=" -L$1/lib"
+        fi
     fi
 }
 
diff --git a/pkgs/desktops/xfce/applications/orage.nix b/pkgs/desktops/xfce/applications/orage.nix
index 2c99bad8156b..72d8e682c862 100644
--- a/pkgs/desktops/xfce/applications/orage.nix
+++ b/pkgs/desktops/xfce/applications/orage.nix
@@ -1,6 +1,5 @@
 { stdenv, fetchurl, fetchpatch, pkgconfig, bison, flex, intltool, gtk, libical, dbus-glib, tzdata
-, libnotify, popt, xfce
-}:
+, libnotify, popt, xfce, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
   name = "${p_name}-${ver_maj}.${ver_min}";
@@ -35,8 +34,6 @@ stdenv.mkDerivation rec {
   buildInputs = [ gtk libical dbus-glib libnotify popt xfce.libxfce4util
     xfce.xfce4-panel ];
 
-  preFixup = "rm $out/share/icons/hicolor/icon-theme.cache ";
-
   meta = {
     homepage = http://www.xfce.org/projects/;
     description = "A simple calendar application with reminders";
diff --git a/pkgs/desktops/xfce/applications/xfce4-notifyd.nix b/pkgs/desktops/xfce/applications/xfce4-notifyd.nix
index a0856b6a6d7b..19ecff290933 100644
--- a/pkgs/desktops/xfce/applications/xfce4-notifyd.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-notifyd.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, intltool, libnotify
-, gtk , libxfce4util, libxfce4ui, xfconf }:
+, gtk , libxfce4util, libxfce4ui, xfconf, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
   p_name  = "xfce4-notifyd";
@@ -13,10 +13,9 @@ stdenv.mkDerivation rec {
   name = "${p_name}-${ver_maj}.${ver_min}";
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool libnotify gtk libxfce4util libxfce4ui xfconf ];
+  buildInputs = [ intltool libnotify gtk libxfce4util libxfce4ui xfconf hicolor-icon-theme ];
 
   preFixup = ''
-    rm $out/share/icons/hicolor/icon-theme.cache
     # to be able to run the daemon we need it in PATH
     ln -rs $out/lib/xfce4/notifyd/xfce4-notifyd $out/bin
   '';
diff --git a/pkgs/desktops/xfce/core/thunar-build.nix b/pkgs/desktops/xfce/core/thunar-build.nix
index 5f8cc71de851..0b606ee5fdd7 100644
--- a/pkgs/desktops/xfce/core/thunar-build.nix
+++ b/pkgs/desktops/xfce/core/thunar-build.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, pkgconfig, intltool
 , gtk, dbus-glib, libstartup_notification, libnotify, libexif, pcre, udev
-, exo, libxfce4util, xfconf, xfce4-panel, wrapGAppsHook
+, exo, libxfce4util, xfconf, xfce4-panel, hicolor-icon-theme, wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
@@ -26,13 +26,12 @@ stdenv.mkDerivation rec {
     intltool
     gtk dbus-glib libstartup_notification libnotify libexif pcre udev
     exo libxfce4util xfconf xfce4-panel
+    hicolor-icon-theme
   ];
   # TODO: optionality?
 
   enableParallelBuilding = true;
 
-  preFixup = "rm $out/share/icons/hicolor/icon-theme.cache";
-
   meta = {
     homepage = http://thunar.xfce.org/;
     description = "Xfce file manager";
diff --git a/pkgs/desktops/xfce/core/thunar-volman.nix b/pkgs/desktops/xfce/core/thunar-volman.nix
index a3b8a619f174..39214ca57b1f 100644
--- a/pkgs/desktops/xfce/core/thunar-volman.nix
+++ b/pkgs/desktops/xfce/core/thunar-volman.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, intltool, exo, gtk, libxfce4util, libxfce4ui
-, xfconf, udev, libgudev, libnotify }:
+, xfconf, udev, libgudev, libnotify, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
   p_name  = "thunar-volman";
@@ -15,9 +15,8 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [ pkgconfig intltool exo gtk udev libgudev libxfce4ui libxfce4util
-      xfconf libnotify
+      xfconf libnotify hicolor-icon-theme
     ];
-  preFixup = "rm $out/share/icons/hicolor/icon-theme.cache";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-battery-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-battery-plugin.nix
index c64e8770d256..6399aa3cc20d 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-battery-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-battery-plugin.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, libxfcegui4, xfconf, gtk}:
+{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, libxfcegui4, xfconf, gtk, hicolor-icon-theme }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
@@ -13,8 +13,7 @@ stdenv.mkDerivation rec {
   name = "${p_name}-${ver_maj}.${ver_min}";
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool libxfce4util libxfce4ui xfce4-panel libxfcegui4 xfconf gtk ];
-  preFixup = "rm $out/share/icons/hicolor/icon-theme.cache";
+  buildInputs = [ intltool libxfce4util libxfce4ui xfce4-panel libxfcegui4 xfconf gtk hicolor-icon-theme ];
 
   meta = {
     homepage = "http://goodies.xfce.org/projects/panel-plugins/${p_name}";
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin.nix
index 236c71c66d56..cb32d5676437 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, glib, exo, libXtst, xproto, libxfce4util, xfce4-panel, libxfce4ui, libxfcegui4, xfconf, gtk}:
+{ stdenv, fetchurl, pkgconfig, intltool, glib, exo, libXtst, xproto, libxfce4util, xfce4-panel, libxfce4ui, libxfcegui4, xfconf, gtk, hicolor-icon-theme }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
@@ -13,8 +13,7 @@ stdenv.mkDerivation rec {
   name = "${p_name}-${ver_maj}.${ver_min}";
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool glib exo libXtst xproto libxfce4util libxfce4ui xfce4-panel libxfcegui4 xfconf gtk ];
-  preFixup = "rm $out/share/icons/hicolor/icon-theme.cache";
+  buildInputs = [ intltool glib exo libXtst xproto libxfce4util libxfce4ui xfce4-panel libxfcegui4 xfconf gtk hicolor-icon-theme ];
 
   meta = {
     homepage = "http://goodies.xfce.org/projects/panel-plugins/${p_name}";
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-cpufreq-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-cpufreq-plugin.nix
index 0a309c433e95..07838f8fe7c9 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-cpufreq-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-cpufreq-plugin.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, libxfcegui4, xfconf, gtk}:
+{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, libxfcegui4, xfconf, gtk, hicolor-icon-theme }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
@@ -15,12 +15,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig intltool ];
 
-  buildInputs = [ libxfce4util libxfce4ui xfce4-panel libxfcegui4 xfconf gtk ];
+  buildInputs = [ libxfce4util libxfce4ui xfce4-panel libxfcegui4 xfconf gtk hicolor-icon-theme ];
 
   enableParallelBuilding = true;
 
-  preFixup = "rm $out/share/icons/hicolor/icon-theme.cache";
-
   meta = {
     homepage = "http://goodies.xfce.org/projects/panel-plugins/${p_name}";
     description = "CPU Freq load plugin for Xfce panel";
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-cpugraph-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-cpugraph-plugin.nix
index c5487198f97e..8048a8570298 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-cpugraph-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-cpugraph-plugin.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, glib, exo, libXtst, xproto, libxfce4util, xfce4-panel, libxfce4ui, xfconf, gtk}:
+{ stdenv, fetchurl, pkgconfig, intltool, glib, exo, libXtst, xproto, libxfce4util, xfce4-panel, libxfce4ui, xfconf, gtk, hicolor-icon-theme }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
@@ -13,8 +13,7 @@ stdenv.mkDerivation rec {
   name = "${p_name}-${ver_maj}.${ver_min}";
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool glib exo libXtst xproto libxfce4util libxfce4ui xfce4-panel xfconf gtk ];
-  preFixup = "rm $out/share/icons/hicolor/icon-theme.cache";
+  buildInputs = [ intltool glib exo libXtst xproto libxfce4util libxfce4ui xfce4-panel xfconf gtk hicolor-icon-theme ];
 
   meta = {
     homepage = "http://goodies.xfce.org/projects/panel-plugins/${p_name}";
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-netload-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-netload-plugin.nix
index a843f0223c4e..e82669cc1a35 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-netload-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-netload-plugin.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, libxfcegui4, xfconf, gtk}:
+{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, libxfcegui4, xfconf, gtk, hicolor-icon-theme }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
@@ -13,8 +13,7 @@ stdenv.mkDerivation rec {
   name = "${p_name}-${ver_maj}.${ver_min}";
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool libxfce4util libxfce4ui xfce4-panel libxfcegui4 xfconf gtk ];
-  preFixup = "rm $out/share/icons/hicolor/icon-theme.cache";
+  buildInputs = [ intltool libxfce4util libxfce4ui xfce4-panel libxfcegui4 xfconf gtk hicolor-icon-theme ];
 
   meta = {
     homepage = "http://goodies.xfce.org/projects/panel-plugins/${p_name}";
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin.nix
index 1b963237c02c..6f6f5699b6e9 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4panel_gtk3, xfconf
-, gtk3, libpulseaudio
+, gtk3, libpulseaudio, hicolor-icon-theme
 , withKeybinder ? true, keybinder3
 , withLibnotify ? true, libnotify
 }:
@@ -21,12 +21,10 @@ stdenv.mkDerivation rec {
   name = "${p_name}-${ver_maj}.${ver_min}";
 
   nativeBuildInputs = [ pkgconfig intltool ];
-  buildInputs = [ libxfce4util xfce4panel_gtk3 xfconf gtk3 libpulseaudio ]
+  buildInputs = [ libxfce4util xfce4panel_gtk3 xfconf gtk3 libpulseaudio hicolor-icon-theme ]
     ++ optional withKeybinder keybinder3
     ++ optional withLibnotify libnotify;
 
-  preFixup = "rm $out/share/icons/hicolor/icon-theme.cache";
-
   meta = {
     homepage = "http://goodies.xfce.org/projects/panel-plugins/${p_name}";
     description = "Adjust the audio volume of the PulseAudio sound system";
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin.nix
index 03f062532ead..15cd526d6def 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, intltool, gtk, libxml2, libsoup, upower,
-libxfce4ui, libxfce4util, xfce4-panel }:
+libxfce4ui, libxfce4util, xfce4-panel, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
   name = "${p_name}-${ver_maj}.${ver_min}";
@@ -15,12 +15,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig intltool ];
 
   buildInputs = [ gtk libxml2 libsoup upower libxfce4ui libxfce4util
-   xfce4-panel ];
+   xfce4-panel hicolor-icon-theme ];
 
   enableParallelBuilding = true;
 
-  preFixup = "rm $out/share/icons/hicolor/icon-theme.cache";
-
   meta = {
     homepage = "http://goodies.xfce.org/projects/panel-plugins/${p_name}";
     description = "Weather plugin for the Xfce desktop environment";
diff --git a/pkgs/desktops/xfce/thunar-plugins/archive/default.nix b/pkgs/desktops/xfce/thunar-plugins/archive/default.nix
index e9c55618c60f..ea3a0f084439 100644
--- a/pkgs/desktops/xfce/thunar-plugins/archive/default.nix
+++ b/pkgs/desktops/xfce/thunar-plugins/archive/default.nix
@@ -2,7 +2,7 @@
 , gtk
 , thunar-bare
 , exo, libxfce4util, libxfce4ui
-, xfconf, udev, libnotify
+, xfconf, udev, libnotify, hicolor-icon-theme
 }:
 
 stdenv.mkDerivation rec {
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     xfce4-dev-tools
     thunar-bare
     exo gtk libxfce4util libxfce4ui
-    xfconf udev libnotify
+    xfconf udev libnotify hicolor-icon-theme
   ];
 
   preConfigure = ''
@@ -44,7 +44,6 @@ stdenv.mkDerivation rec {
     pushd $out/libexec/thunar-archive-plugin > /dev/null
     ln -s ./file-roller.tap org.gnome.FileRoller.tap
     popd > /dev/null
-    rm $out/share/icons/hicolor/icon-theme.cache
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/desktops/xfce/thunar-plugins/dropbox/default.nix b/pkgs/desktops/xfce/thunar-plugins/dropbox/default.nix
index 6b9aac4a8ccd..b86199c5012b 100644
--- a/pkgs/desktops/xfce/thunar-plugins/dropbox/default.nix
+++ b/pkgs/desktops/xfce/thunar-plugins/dropbox/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, pkgconfig
 , gtk
-, thunar-bare, python2
+, thunar-bare, python2, hicolor-icon-theme
 }:
 
 stdenv.mkDerivation rec {
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
     gtk
-    thunar-bare python2
+    thunar-bare python2 hicolor-icon-theme
   ];
 
   configurePhase = "python2 waf configure --prefix=$out";
@@ -28,8 +28,6 @@ stdenv.mkDerivation rec {
     python2 waf install
   '';
 
-  preFixup = "rm $out/share/icons/hicolor/icon-theme.cache";
-
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/interpreters/python/cpython/2.7/boot.nix b/pkgs/development/interpreters/python/cpython/2.7/boot.nix
index 79aa85def3c1..66f358e4b95b 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/boot.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/boot.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, CF, configd, coreutils }:
+{ stdenv, fetchurl, configd, CF, coreutils }:
 
 with stdenv.lib;
 
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index bb6f2758f4cf..9e6d35b818f4 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -133,6 +133,11 @@ let
           ++ op (stdenv.hostPlatform != stdenv.buildPlatform)
              "--with-baseruby=${buildRuby}";
 
+        # fails with "16993 tests, 2229489 assertions, 105 failures, 14 errors, 89 skips"
+        # mostly TZ- and patch-related tests
+        # TZ- failures are caused by nix sandboxing, I didn't investigate others
+        doCheck = false;
+
         preInstall = ''
           # Ruby installs gems here itself now.
           mkdir -pv "$out/${passthru.gemPath}"
diff --git a/pkgs/development/libraries/boost/1.67.nix b/pkgs/development/libraries/boost/1.67.nix
index 8b9e7ccca7f1..150272df6ca3 100644
--- a/pkgs/development/libraries/boost/1.67.nix
+++ b/pkgs/development/libraries/boost/1.67.nix
@@ -1,8 +1,14 @@
-{ stdenv, callPackage, fetchurl, hostPlatform, buildPlatform, ... } @ args:
+{ stdenv, callPackage, fetchurl, fetchpatch, hostPlatform, buildPlatform, ... } @ args:
 
 callPackage ./generic.nix (args // rec {
   version = "1.67_0";
 
+  patches = [ (fetchpatch {
+    url = "https://github.com/boostorg/lockfree/commit/12726cda009a855073b9bedbdce57b6ce7763da2.patch";
+    sha256 = "0x65nkwzv8fdacj8sw5njl3v63jj19dirrpklbwy6qpsncw7fc7h";
+    stripLen = 1;
+  })];
+
   src = fetchurl {
     url = "mirror://sourceforge/boost/boost_1_67_0.tar.bz2";
     # SHA256 from http://www.boost.org/users/history/version_1_66_0.html
diff --git a/pkgs/development/libraries/gvfs/default.nix b/pkgs/development/libraries/gvfs/default.nix
index 4c858242bb54..86cbd01a6026 100644
--- a/pkgs/development/libraries/gvfs/default.nix
+++ b/pkgs/development/libraries/gvfs/default.nix
@@ -4,7 +4,7 @@
 , libxml2, libxslt, docbook_xsl, docbook_xml_dtd_42, samba, libmtp
 , gnomeSupport ? false, gnome, makeWrapper
 , libimobiledevice, libbluray, libcdio-paranoia, libnfs, openssh
-, libsecret, libgdata
+, libsecret, libgdata, python3
 # Remove when switching back to meson
 , autoreconfHook, lzma, bzip2
 }:
@@ -28,6 +28,10 @@ stdenv.mkDerivation rec {
     sha256 = "1xq105596sk9yram5a143b369wpaiiwc9gz86n0j1kfr7nipkqn4";
   };
 
+  postPatch = ''
+    patchShebangs test test-driver
+  '';
+
   # Uncomment when switching back to meson
   # postPatch = ''
   #   chmod +x meson_post_install.py # patchShebangs requires executable file
@@ -73,6 +77,10 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  checkInputs = [ python3 ];
+  doCheck = false; # fails with "ModuleNotFoundError: No module named 'gi'"
+  doInstallCheck = doCheck;
+
   preFixup = ''
     for f in $out/libexec/*; do
       wrapProgram $f \
diff --git a/pkgs/development/libraries/ilmbase/default.nix b/pkgs/development/libraries/ilmbase/default.nix
index 956a8667be5f..156b4f72749a 100644
--- a/pkgs/development/libraries/ilmbase/default.nix
+++ b/pkgs/development/libraries/ilmbase/default.nix
@@ -20,6 +20,11 @@ stdenv.mkDerivation rec {
 
   patches = [ ./bootstrap.patch ];
 
+  # fails 1 out of 1 tests with
+  # "lt-ImathTest: testBoxAlgo.cpp:892: void {anonymous}::boxMatrixTransform(): Assertion `b21 == b2' failed"
+  # at least on i686. spooky!
+  doCheck = stdenv.isx86_64;
+
   meta = with stdenv.lib; {
     homepage = http://www.openexr.com/;
     license = licenses.bsd3;
diff --git a/pkgs/development/libraries/libcommuni/default.nix b/pkgs/development/libraries/libcommuni/default.nix
index 0788236b6017..f247c48821f7 100644
--- a/pkgs/development/libraries/libcommuni/default.nix
+++ b/pkgs/development/libraries/libcommuni/default.nix
@@ -27,6 +27,7 @@ stdenv.mkDerivation rec {
 
   # The tests fail on darwin because of install_name if they run
   # before the frameworks are installed.
+  doCheck = false;
   doInstallCheck = true;
   installCheckTarget = "check";
 
diff --git a/pkgs/development/libraries/libffi/default.nix b/pkgs/development/libraries/libffi/default.nix
index 1c7c0715e75b..6f1aeefa6758 100644
--- a/pkgs/development/libraries/libffi/default.nix
+++ b/pkgs/development/libraries/libffi/default.nix
@@ -1,5 +1,9 @@
-{ stdenv, fetchurl, fetchpatch,  dejagnu, doCheck ? false
+{ stdenv, fetchurl, fetchpatch
 , buildPlatform, hostPlatform, autoreconfHook
+
+# libffi is used in darwin stdenv
+# we cannot run checks within it
+, doCheck ? !stdenv.isDarwin, dejagnu
 }:
 
 stdenv.mkDerivation rec {
@@ -40,8 +44,6 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man" "info" ];
 
-  buildInputs = stdenv.lib.optional doCheck dejagnu;
-
   nativeBuildInputs = stdenv.lib.optional hostPlatform.isRiscV autoreconfHook;
 
   configureFlags = [
@@ -54,6 +56,8 @@ stdenv.mkDerivation rec {
     NIX_HARDENING_ENABLE=''${NIX_HARDENING_ENABLE/fortify/}
   '';
 
+  checkInputs = [ dejagnu ];
+
   inherit doCheck;
 
   dontStrip = hostPlatform != buildPlatform; # Don't run the native `strip' when cross-compiling.
diff --git a/pkgs/development/libraries/librdf/rasqal.nix b/pkgs/development/libraries/librdf/rasqal.nix
index 07f560fe2724..124fd0178182 100644
--- a/pkgs/development/libraries/librdf/rasqal.nix
+++ b/pkgs/development/libraries/librdf/rasqal.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, librdf_raptor2, gmp, pkgconfig, pcre, libxml2 }:
+{ stdenv, fetchurl, librdf_raptor2, gmp, pkgconfig, pcre, libxml2, perl }:
 
 stdenv.mkDerivation rec {
   name = "rasqal-0.9.33";
@@ -16,6 +16,10 @@ stdenv.mkDerivation rec {
 
   postInstall = "rm -rvf $out/share/gtk-doc";
 
+  checkInputs = [ perl ];
+  doCheck = false; # fails with "No testsuite plan file sparql-query-plan.ttl could be created in build/..."
+  doInstallCheck = false; # fails with "rasqal-config does not support (--help|--version)"
+
   meta = {
     description = "Library that handles Resource Description Framework (RDF)";
     homepage = http://librdf.org/rasqal;
diff --git a/pkgs/development/libraries/mdds/default.nix b/pkgs/development/libraries/mdds/default.nix
index 90d86ea9165c..43fee9ccead8 100644
--- a/pkgs/development/libraries/mdds/default.nix
+++ b/pkgs/development/libraries/mdds/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, boost }:
 
 stdenv.mkDerivation rec {
   version = "1.3.1";
@@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
    cp "$out/share/pkgconfig/"* "$out/lib/pkgconfig"
   '';
 
+  checkInputs = [ boost ];
+
   meta = {
     inherit version;
     homepage = https://gitlab.com/mdds/mdds;
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 028930ba066d..480afcf607a6 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -92,7 +92,7 @@ let self = stdenv.mkDerivation {
   patches = [
     ./glx_ro_text_segm.patch # fix for grsecurity/PaX
     ./symlink-drivers.patch
-    ./missing-include.patch # dev_t needs sys/stat.h, fixes build w/musl
+    ./missing-includes.patch # dev_t needs sys/stat.h, time_t needs time.h, etc.-- fixes build w/musl
   ];
 
   outputs = [ "out" "dev" "drivers" "osmesa" ];
diff --git a/pkgs/development/libraries/mesa/missing-include.patch b/pkgs/development/libraries/mesa/missing-include.patch
deleted file mode 100644
index dd3e6bb64af8..000000000000
--- a/pkgs/development/libraries/mesa/missing-include.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- ./src/gallium/winsys/svga/drm/vmw_screen.h.orig
-+++ ./src/gallium/winsys/svga/drm/vmw_screen.h
-@@ -34,7 +34,7 @@
- #ifndef VMW_SCREEN_H_
- #define VMW_SCREEN_H_
- 
--
-+#include <sys/stat.h>
- #include "pipe/p_compiler.h"
- #include "pipe/p_state.h"
- 
diff --git a/pkgs/development/libraries/mesa/missing-includes.patch b/pkgs/development/libraries/mesa/missing-includes.patch
new file mode 100644
index 000000000000..feb6ffe428c0
--- /dev/null
+++ b/pkgs/development/libraries/mesa/missing-includes.patch
@@ -0,0 +1,55 @@
+--- ./src/gallium/winsys/svga/drm/vmw_screen.h.orig
++++ ./src/gallium/winsys/svga/drm/vmw_screen.h
+@@ -34,7 +34,7 @@
+ #ifndef VMW_SCREEN_H_
+ #define VMW_SCREEN_H_
+ 
+-
++#include <sys/stat.h>
+ #include "pipe/p_compiler.h"
+ #include "pipe/p_state.h"
+ 
+--- ./src/gallium/state_trackers/nine/threadpool.h.orig	2015-05-07 14:10:53.443337212 +0200
++++ ./src/gallium/state_trackers/nine/threadpool.h	2015-05-07 14:11:04.210307653 +0200
+@@ -24,6 +24,8 @@
+ #ifndef _THREADPOOL_H_
+ #define _THREADPOOL_H_
+ 
++#include <pthread.h>
++
+ #define MAXTHREADS 1
+ 
+ struct threadpool {
+--- ./src/util/rand_xor.c.orig	2017-06-20 00:38:57.199474067 +0200
++++ ./src/util/rand_xor.c	2017-06-20 00:40:31.351279557 +0200
+@@ -23,7 +23,9 @@
+  */
+ 
+ #if defined(__linux__)
++#include <sys/types.h>
+ #include <sys/file.h>
++#include <sys/stat.h>
+ #include <unistd.h>
+ #include <fcntl.h>
+ #else
+--- ./src/mesa/drivers/dri/i965/brw_bufmgr.h
++++ ./src/mesa/drivers/dri/i965/brw_bufmgr.h
+@@ -37,6 +37,7 @@
+ #include <stdbool.h>
+ #include <stdint.h>
+ #include <stdio.h>
++#include <time.h>
+ #include "util/u_atomic.h"
+ #include "util/list.h"
+
+--- ./src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
++++ ./src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
+@@ -28,6 +28,8 @@
+ #ifndef RADV_AMDGPU_WINSYS_H
+ #define RADV_AMDGPU_WINSYS_H
+ 
++#include <sys/types.h>
++
+ #include "radv_radeon_winsys.h"
+ #include "ac_gpu_info.h"
+ #include "addrlib/addrinterface.h"<Paste>
diff --git a/pkgs/development/libraries/neon/0.29.nix b/pkgs/development/libraries/neon/0.29.nix
index e393d50bf9d2..dbde83c2d94b 100644
--- a/pkgs/development/libraries/neon/0.29.nix
+++ b/pkgs/development/libraries/neon/0.29.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libxml2, pkgconfig
+{ stdenv, fetchurl, libxml2, pkgconfig, perl
 , compressionSupport ? true, zlib ? null
 , sslSupport ? true, openssl ? null
 , static ? false
@@ -38,6 +38,9 @@ stdenv.mkDerivation rec {
 
   passthru = {inherit compressionSupport sslSupport;};
 
+  checkInputs = [ perl ];
+  doCheck = false; # fails, needs the net
+
   meta = {
     description = "An HTTP and WebDAV client library";
     homepage = http://www.webdav.org/neon/;
diff --git a/pkgs/development/libraries/neon/default.nix b/pkgs/development/libraries/neon/default.nix
index 2351e3b0800b..9c2a3265491a 100644
--- a/pkgs/development/libraries/neon/default.nix
+++ b/pkgs/development/libraries/neon/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libxml2, pkgconfig
+{ stdenv, fetchurl, libxml2, pkgconfig, perl
 , compressionSupport ? true, zlib ? null
 , sslSupport ? true, openssl ? null
 , static ? false
@@ -38,6 +38,9 @@ stdenv.mkDerivation rec {
 
   passthru = {inherit compressionSupport sslSupport;};
 
+  checkInputs = [ perl ];
+  doCheck = false; # fails, needs the net
+
   meta = {
     description = "An HTTP and WebDAV client library";
     homepage = http://www.webdav.org/neon/;
diff --git a/pkgs/development/libraries/npth/default.nix b/pkgs/development/libraries/npth/default.nix
index 203be8b6907b..c02998184fc5 100644
--- a/pkgs/development/libraries/npth/default.nix
+++ b/pkgs/development/libraries/npth/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "npth-1.5";
+  name = "npth-1.6";
 
   src = fetchurl {
     url = "mirror://gnupg/npth/${name}.tar.bz2";
-    sha256 = "1hmkkp6vzyrh8v01c2ynzf9vwikyagp7p1lxhbnr4ysk3w66jji9";
+    sha256 = "1lg2lkdd3z1s3rpyf88786l243adrzyk9p4q8z9n41ygmpcsp4qk";
   };
 
   doCheck = true;
diff --git a/pkgs/development/python-modules/hypothesis/default.nix b/pkgs/development/python-modules/hypothesis/default.nix
index 88705962627f..6701c5a5b7e9 100644
--- a/pkgs/development/python-modules/hypothesis/default.nix
+++ b/pkgs/development/python-modules/hypothesis/default.nix
@@ -20,9 +20,9 @@ buildPythonPackage rec {
     sha256 = "063sn5m1966gvm3wrlxczdq4vw0r94h3nd9xpr94qxahpg2r4bpb";
   };
 
-  checkInputs = [ pytest pytest_xdist flaky mock ];
   propagatedBuildInputs = [ attrs coverage ] ++ lib.optional (!isPy3k) [ enum34 ];
 
+  checkInputs = [ pytest pytest_xdist flaky mock ];
   inherit doCheck;
 
   # https://github.com/DRMacIver/hypothesis/issues/300
diff --git a/pkgs/development/python-modules/pytest-flake8/default.nix b/pkgs/development/python-modules/pytest-flake8/default.nix
index 101594750fd5..1d7447293dfa 100644
--- a/pkgs/development/python-modules/pytest-flake8/default.nix
+++ b/pkgs/development/python-modules/pytest-flake8/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   };
 
   checkPhase = ''
-    pytest .
+    pytest . -k "not test_mtime_caching"
   '';
 
   meta = {
diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index b5a8cc252b97..1c0ceef83657 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -1,6 +1,6 @@
 { stdenv, buildPythonPackage, fetchPypi, attrs, hypothesis, py
 , setuptools_scm, setuptools, six, pluggy, funcsigs, isPy3k, more-itertools
-, atomicwrites, mock
+, atomicwrites, mock, writeText
 }:
 buildPythonPackage rec {
   version = "3.6.2";
@@ -27,6 +27,11 @@ buildPythonPackage rec {
     runHook postCheck
   '';
 
+  # Don't create .pytest-cache when using py.test in a Nix build
+  setupHook = writeText "pytest-hook" ''
+    export PYTEST_ADDOPTS="-p no:cacheprovider"
+  '';
+
   meta = with stdenv.lib; {
     maintainers = with maintainers; [ domenkozar lovek323 madjar lsix ];
     platforms = platforms.unix;
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 2ccd6637d088..3cb906d50edf 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -2,12 +2,12 @@
   targetPrefix = lib.optionalString stdenv.isCross
                    (targetPlatform.config + "-");
 in python3Packages.buildPythonApplication rec {
-  version = "0.47.0";
+  version = "0.46.1";
   pname = "meson";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "1mxsvsw7mg3q4yj8qrkrwv79qwws14qnbihryn2i7504b3r204h6";
+    sha256 = "1jdxs2mkniy1hpdjc4b4jb95axsjp6j5fzphmm6d4gqmqyykjvqc";
   };
 
   postFixup = ''
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index bfd79cb42dc5..c4a01ce09bd0 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -32,14 +32,14 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "busybox-1.29.0";
+  name = "busybox-1.29.1";
 
   # Note to whoever is updating busybox: please verify that:
   # nix-build pkgs/stdenv/linux/make-bootstrap-tools.nix -A test
   # still builds after the update.
   src = fetchurl {
     url = "https://busybox.net/downloads/${name}.tar.bz2";
-    sha256 = "10hccqprhr1mwkqc9i3kny44mb6sdmv9hl63wx20cr5yy095c4f8";
+    sha256 = "1hqlr5b3bsyb6avadz1z4za6pyl32r1krnpcpwwqilhnx8q0f9gw";
   };
 
   hardeningDisable = [ "format" ] ++ lib.optionals enableStatic [ "fortify" ];
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index 35f32b0afdd8..87741d29f8e5 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -5,14 +5,14 @@ let
   version = lib.concatStringsSep "." ([ majorVersion ]
     ++ lib.optional (patchVersion != "") patchVersion);
   majorVersion = "2.32";
-  patchVersion = "";
+  patchVersion = "1";
 
 in stdenv.mkDerivation rec {
   name = "util-linux-${version}";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${majorVersion}/${name}.tar.xz";
-    sha256 = "0d2758kjll5xqm5fpp3sww1h66aahx161sf2b60jxqv4qymrfwvc";
+    sha256 = "1ck7d8srw5szpjq7v0gpmjahnjs6wgqzm311ki4gazww6xx71rl6";
   };
 
   patches = [
diff --git a/pkgs/servers/dns/bind/default.nix b/pkgs/servers/dns/bind/default.nix
index ff99f7a7cbf6..f72ec76cc649 100644
--- a/pkgs/servers/dns/bind/default.nix
+++ b/pkgs/servers/dns/bind/default.nix
@@ -8,14 +8,14 @@
 assert enableSeccomp -> libseccomp != null;
 assert enablePython -> python3 != null;
 
-let version = "9.12.1-P2"; in
+let version = "9.12.2"; in
 
 stdenv.mkDerivation rec {
   name = "bind-${version}";
 
   src = fetchurl {
     url = "https://ftp.isc.org/isc/bind9/${version}/${name}.tar.gz";
-    sha256 = "0a9dvyg1dk7vpqn9gz7p5jas3bz7z22bjd66b98g1qk16i2w7rqd";
+    sha256 = "0ll46igs9xfq2qclc5wzqsnj3zv7ssga0544gm24s1m7765lqslz";
   };
 
   outputs = [ "out" "lib" "dev" "man" "dnsutils" "host" ];
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 366be3915802..b7b3640a9535 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -188,7 +188,18 @@ in rec {
   };
 
   stage1 = prevStage: let
-    persistent = _: super: { python = super.python.override { configd = null; }; };
+    persistent = self: super: with prevStage; {
+      cmake = super.cmake.override {
+        majorVersion = "3.9";  # FIXME: update ApplicationServices patch
+        isBootstrap = true;
+        useSharedLibraries = false;
+      };
+
+      python = super.callPackage ../../development/interpreters/python/cpython/2.7/boot.nix {
+        CF = null;  # use CoreFoundation from bootstrap-tools
+        configd = null;
+      };
+    };
   in with prevStage; stageFun 1 prevStage {
     extraPreHook = "export NIX_CFLAGS_COMPILE+=\" -F${bootstrapTools}/Library/Frameworks\"";
     extraNativeBuildInputs = [];
@@ -239,6 +250,9 @@ in rec {
         openssh sqlite sed serf openldap db cyrus-sasl expat apr-util
         findfreetype libssh curl cmake autoconf automake libtool cpio;
 
+      # Avoid pulling in a full python and it's extra dependencies for the llvm/clang builds.
+      libxml2 = super.libxml2.override { pythonSupport = false; };
+
       llvmPackages_5 = super.llvmPackages_5 // (let
         libraries = super.llvmPackages_5.libraries.extend (_: _: {
           inherit (llvmPackages_5) libcxx libcxxabi;
@@ -281,6 +295,15 @@ in rec {
         ncurses libffi zlib gmp pcre gnugrep
         coreutils findutils diffutils patchutils;
 
+      # Hack to make sure we don't link ncurses in bootstrap tools. The proper
+      # solution is to avoid passing -L/nix-store/...-bootstrap-tools/lib,
+      # quite a sledgehammer just to get the C runtime.
+      gettext = super.gettext.overrideAttrs (drv: {
+        configureFlags = drv.configureFlags ++ [
+          "--disable-curses"
+        ];
+      });
+
       llvmPackages_5 = super.llvmPackages_5 // (let
         tools = super.llvmPackages_5.tools.extend (llvmSelf: _: {
           inherit (llvmPackages_5) llvm clang-unwrapped;
@@ -303,16 +326,7 @@ in rec {
     extraPreHook = ''
       export PATH_LOCALE=${pkgs.darwin.locale}/share/locale
     '';
-    overrides = lib.composeExtensions persistent (self: super: {
-      # Hack to make sure we don't link ncurses in bootstrap tools. The proper
-      # solution is to avoid passing -L/nix-store/...-bootstrap-tools/lib,
-      # quite a sledgehammer just to get the C runtime.
-      gettext = super.gettext.overrideAttrs (old: {
-         configureFlags = old.configureFlags ++ [
-           "--disable-curses"
-         ];
-      });
-    });
+    overrides = persistent;
   };
 
   stdenvDarwin = prevStage: let
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 26d28609d877..c5feffcea99b 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -660,6 +660,10 @@ substituteStream() {
                     echo "substituteStream(): ERROR: substitution variables must be valid Bash names, \"$varName\" isn't." >&2
                     return 1
                 fi
+                if [ -z ${!varName+x} ]; then
+                    echo "substituteStream(): ERROR: variable \$$varName is unset" >&2
+                    return 1
+                fi
                 pattern="@$varName@"
                 replacement="${!varName}"
                 ;;
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 2ebae0b0c17f..06798bdcc281 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -24,14 +24,14 @@ assert brotliSupport -> brotli != null;
 assert gssSupport -> kerberos != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.60.0";
+  name = "curl-7.61.0";
 
   src = fetchurl {
     urls = [
-      "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] name}/${name}.tar.bz2"
       "https://curl.haxx.se/download/${name}.tar.bz2"
+      "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] name}/${name}.tar.bz2"
     ];
-    sha256 = "16qyhy9alq2wk6zgqhh5dchr45f6nxaqzy3rh8rbx6dx0hignzc9";
+    sha256 = "173ccmnnr4qcawzgn7vm0ciyzphanzghigdgavg88nyg45lk6vsz";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/tools/system/pciutils/default.nix b/pkgs/tools/system/pciutils/default.nix
index 9acf41c62ef8..1762b98984f7 100644
--- a/pkgs/tools/system/pciutils/default.nix
+++ b/pkgs/tools/system/pciutils/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, zlib, kmod, which }:
 
 stdenv.mkDerivation rec {
-  name = "pciutils-3.6.0"; # with database from 2018-06-29
+  name = "pciutils-3.6.1"; # with database from 2018-06-29
 
   src = fetchurl {
     url = "mirror://kernel/software/utils/pciutils/${name}.tar.xz";
-    sha256 = "17g9rvjknj2yqwxldnz8m5kaabbdvkcjnfic4sbx88kh0s81197j";
+    sha256 = "1q39hh8scgvqppk1clzjh7yiq5p2r0knv52g3qzmdhsir4f47h7w";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -22,16 +22,6 @@ stdenv.mkDerivation rec {
 
   installTargets = "install install-lib";
 
-  # Use standardized and equivalent realpath(path, NULL) instead of canonicalize_file_name(path).
-  # This is documented to be equivalent, see `man 3 canonicalize_file_name`.
-  # Fixes w/musl.
-  # Upstream PR: https://github.com/pciutils/pciutils/pull/6
-  postPatch = ''
-    substituteInPlace lib/sysfs.c \
-      --replace "canonicalize_file_name(path)" \
-                "realpath(path, NULL)"
-  '';
-
   # Get rid of update-pciids as it won't work.
   postInstall = "rm $out/sbin/update-pciids $out/man/man8/update-pciids.8";
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 79ef20188e9b..59724842198a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6882,13 +6882,6 @@ with pkgs;
     inherit (stdenvAdapters) overrideCC;
     buildLlvmTools = buildPackages.llvmPackages_5.tools;
     targetLlvmLibraries = targetPackages.llvmPackages_5.libraries;
-  } // stdenv.lib.optionalAttrs (stdenv.isDarwin && hostPlatform == buildPlatform) {
-    cmake = buildPackages.cmake.override {
-      isBootstrap = true;
-      majorVersion = "3.9"; # 3.10.2: 'ApplicationServices/ApplicationServices.h' file not found
-    };
-    libxml2 = libxml2.override { pythonSupport = false; };
-    python2 = callPackage ../development/interpreters/python/cpython/2.7/boot.nix { inherit (darwin) CF configd; };
   } // stdenv.lib.optionalAttrs (stdenv.cc.isGNU && stdenv.hostPlatform.isi686) {
     stdenv = overrideCC stdenv buildPackages.gcc6; # with gcc-7: undefined reference to `__divmoddi4'
   });
@@ -11073,15 +11066,9 @@ with pkgs;
 
   neardal = callPackage ../development/libraries/neardal { };
 
-  neon = callPackage ../development/libraries/neon {
-    compressionSupport = true;
-    sslSupport = true;
-  };
+  neon = callPackage ../development/libraries/neon { };
 
-  neon_0_29 = callPackage ../development/libraries/neon/0.29.nix {
-    compressionSupport = true;
-    sslSupport = true;
-  };
+  neon_0_29 = callPackage ../development/libraries/neon/0.29.nix { };
 
   nettle = callPackage ../development/libraries/nettle { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 789a9076772b..3350fad20068 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1925,11 +1925,8 @@ in {
   pytest = self.pytest_36;
 
   pytest_36 = callPackage ../development/python-modules/pytest {
-    hypothesis = self.hypothesis.override {
-      # hypothesis requires pytest that causes dependency cycle
-      doCheck = false;
-      pytest = null;
-    };
+    # hypothesis tests require pytest that causes dependency cycle
+    hypothesis = self.hypothesis.override { doCheck = false; };
   };
 
   # Needed for celery