diff --git a/pkgs/applications/networking/browsers/chromium/update.nix b/pkgs/applications/networking/browsers/chromium/update.nix
index 3b9ea3966473..277ad29abe29 100644
--- a/pkgs/applications/networking/browsers/chromium/update.nix
+++ b/pkgs/applications/networking/browsers/chromium/update.nix
@@ -145,7 +145,7 @@ in rec {
         outputHashMode = "flat";
         outputHashAlgo = "md5";
 
-        buildInputs = [ curl ];
+        nativeBuildInputs = [ curl ];
         preferLocalBuild = true;
 
         buildCommand = ''
@@ -178,7 +178,7 @@ in rec {
 
     getHash = path: import (runCommand "gethash.nix" {
       inherit path;
-      buildInputs = [ nix ];
+      nativeBuildInputs = [ nix ];
     } ''
       sha256="$(nix-hash --flat --base32 --type sha256 "$path")"
       echo "\"$sha256\"" > "$out"
diff --git a/pkgs/applications/networking/cluster/chronos/chronos-deps.nix b/pkgs/applications/networking/cluster/chronos/chronos-deps.nix
index 1caf1ce0bc8e..aac0dd10e15a 100644
--- a/pkgs/applications/networking/cluster/chronos/chronos-deps.nix
+++ b/pkgs/applications/networking/cluster/chronos/chronos-deps.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
   outputHashMode = "recursive";
   outputHash = "0mm2sb1p5zz6b0z2s4zhdlix6fafydsxmqjy8zbkwzw4f6lazzyl";
 
-  buildInputs = [ curl ];
+  nativeBuildInputs = [ curl ];
 
   impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars;
 }
diff --git a/pkgs/applications/networking/cluster/mesos/mesos-deps.nix b/pkgs/applications/networking/cluster/mesos/mesos-deps.nix
index 642c660edb69..1cf819870f4e 100644
--- a/pkgs/applications/networking/cluster/mesos/mesos-deps.nix
+++ b/pkgs/applications/networking/cluster/mesos/mesos-deps.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
   outputHashMode = "recursive";
   outputHash = "10h0qs7svw0cqjkyxs8z6s3qraa8ga920zfrr59rdlanbwg4klly";
 
-  buildInputs = [ curl ];
+  nativeBuildInputs = [ curl ];
 
   impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars;
 }
diff --git a/pkgs/build-support/docker/pull.nix b/pkgs/build-support/docker/pull.nix
index 5ccd0a41c5e4..5611c7785862 100644
--- a/pkgs/build-support/docker/pull.nix
+++ b/pkgs/build-support/docker/pull.nix
@@ -14,7 +14,7 @@ let
 
       builder = ./pull.sh;
 
-      buildInputs = [ curl utillinux docker kmod dhcp cacert e2fsprogs ];
+      nativeBuildInputs = [ curl utillinux docker kmod dhcp cacert e2fsprogs ];
 
       outputHashAlgo = "sha256";
       outputHash = sha256;
diff --git a/pkgs/build-support/fetchbower/default.nix b/pkgs/build-support/fetchbower/default.nix
index 3e1f0eff84af..04b2a969a36d 100644
--- a/pkgs/build-support/fetchbower/default.nix
+++ b/pkgs/build-support/fetchbower/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, bower2nix, cacert }:
+{ stdenvNoCC, lib, bower2nix, cacert }:
 let
   bowerVersion = version:
     let
@@ -9,7 +9,7 @@ let
 
   cleanName = name: lib.replaceStrings ["/" ":"] ["-" "-"] name;
 
-  fetchbower = name: version: target: outputHash: stdenv.mkDerivation {
+  fetchbower = name: version: target: outputHash: stdenvNoCC.mkDerivation {
     name = "${cleanName name}-${bowerVersion version}";
     SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
     buildCommand = ''
@@ -23,7 +23,7 @@ let
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
     inherit outputHash;
-    buildInputs = [ bower2nix ];
+    nativeBuildInputs = [ bower2nix ];
   };
 
 in fetchbower
diff --git a/pkgs/build-support/fetchbzr/default.nix b/pkgs/build-support/fetchbzr/default.nix
index dd2c0363187a..f9250de4ee07 100644
--- a/pkgs/build-support/fetchbzr/default.nix
+++ b/pkgs/build-support/fetchbzr/default.nix
@@ -1,11 +1,11 @@
-{ stdenv, bazaar }: 
+{ stdenvNoCC, bazaar }:
 { url, rev, sha256 }:
 
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = "bzr-export";
 
   builder = ./builder.sh;
-  buildInputs = [ bazaar ];
+  nativeBuildInputs = [ bazaar ];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
diff --git a/pkgs/build-support/fetchcvs/default.nix b/pkgs/build-support/fetchcvs/default.nix
index d4c88ca6d15e..9d9deb3f629e 100644
--- a/pkgs/build-support/fetchcvs/default.nix
+++ b/pkgs/build-support/fetchcvs/default.nix
@@ -3,14 +3,14 @@
 # tag="<tagname>" (get version by tag name)
 # If you don't specify neither one date="NOW" will be used (get latest)
 
-{stdenv, cvs}:
+{stdenvNoCC, cvs}:
 
 {cvsRoot, module, tag ? null, date ? null, sha256}:
 
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = "cvs-export";
   builder = ./builder.sh;
-  buildInputs = [cvs];
+  nativeBuildInputs = [cvs];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
diff --git a/pkgs/build-support/fetchdarcs/default.nix b/pkgs/build-support/fetchdarcs/default.nix
index 2df1b136c559..b2b0c364a130 100644
--- a/pkgs/build-support/fetchdarcs/default.nix
+++ b/pkgs/build-support/fetchdarcs/default.nix
@@ -1,15 +1,15 @@
-{stdenv, darcs, nix, cacert}:
+{stdenvNoCC, darcs, nix, cacert}:
 
 {url, rev ? null, context ? null, md5 ? "", sha256 ? ""}:
 
 if md5 != "" then
   throw "fetchdarcs does not support md5 anymore, please use sha256"
 else
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = "fetchdarcs";
   NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
   builder = ./builder.sh;
-  buildInputs = [darcs];
+  nativeBuildInputs = [darcs];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
diff --git a/pkgs/build-support/fetchegg/default.nix b/pkgs/build-support/fetchegg/default.nix
index 41d2c936e01e..746af9e27375 100644
--- a/pkgs/build-support/fetchegg/default.nix
+++ b/pkgs/build-support/fetchegg/default.nix
@@ -1,16 +1,16 @@
 # Fetches a chicken egg from henrietta using `chicken-install -r'
 # See: http://wiki.call-cc.org/chicken-projects/egg-index-4.html
 
-{ stdenv, chicken }:
+{ stdenvNoCC, chicken }:
 { name, version, md5 ? "", sha256 ? "" }:
 
 if md5 != "" then
   throw "fetchegg does not support md5 anymore, please use sha256"
 else
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = "chicken-${name}-export";
   builder = ./builder.sh;
-  buildInputs = [ chicken ];
+  nativeBuildInputs = [ chicken ];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
@@ -20,6 +20,6 @@ stdenv.mkDerivation {
 
   eggName = name;
 
-  impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars;
+  impureEnvVars = stdenvNoCC.lib.fetchers.proxyImpureEnvVars;
 }
 
diff --git a/pkgs/build-support/fetchfossil/default.nix b/pkgs/build-support/fetchfossil/default.nix
index 439c96019a41..27933b47178a 100644
--- a/pkgs/build-support/fetchfossil/default.nix
+++ b/pkgs/build-support/fetchfossil/default.nix
@@ -5,7 +5,7 @@
 stdenv.mkDerivation {
   name = "fossil-archive" + (if name != null then "-${name}" else "");
   builder = ./builder.sh;
-  buildInputs = [fossil];
+  nativeBuildInputs = [fossil];
 
   # Envvar docs are hard to find. A link for the future:
   # https://www.fossil-scm.org/index.html/doc/trunk/www/env-opts.md
diff --git a/pkgs/build-support/fetchgit/default.nix b/pkgs/build-support/fetchgit/default.nix
index 8e060b87ebd3..9fccc27ef632 100644
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@@ -1,6 +1,6 @@
-{stdenv, git, cacert}: let
+{stdenvNoCC, git, cacert}: let
   urlToName = url: rev: let
-    inherit (stdenv.lib) removeSuffix splitString last;
+    inherit (stdenvNoCC.lib) removeSuffix splitString last;
     base = last (splitString ":" (baseNameOf (removeSuffix "/" url)));
 
     matched = builtins.match "(.*).git" base;
@@ -48,11 +48,11 @@ assert deepClone -> leaveDotGit;
 if md5 != "" then
   throw "fetchgit does not support md5 anymore, please use sha256"
 else
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   inherit name;
   builder = ./builder.sh;
   fetcher = "${./nix-prefetch-git}";  # This must be a string to ensure it's called with bash.
-  buildInputs = [git];
+  nativeBuildInputs = [git];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
@@ -62,7 +62,7 @@ stdenv.mkDerivation {
 
   GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
-  impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars ++ [
+  impureEnvVars = stdenvNoCC.lib.fetchers.proxyImpureEnvVars ++ [
     "GIT_PROXY_COMMAND" "SOCKS_SERVER"
   ];
 
diff --git a/pkgs/build-support/fetchgit/private.nix b/pkgs/build-support/fetchgit/private.nix
index a1dd9210e731..4dcf6d06718a 100644
--- a/pkgs/build-support/fetchgit/private.nix
+++ b/pkgs/build-support/fetchgit/private.nix
@@ -17,7 +17,7 @@
       in builtins.toString sshConfigFile}'';
 
     ssh-wrapped = runCommand "fetchgit-ssh" {
-      buildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ makeWrapper ];
     } ''
       mkdir -p $out/bin
       makeWrapper ${openssh}/bin/ssh $out/bin/ssh --prefix PATH : "$out/bin" --add-flags "-F ${config}" "$@"
diff --git a/pkgs/build-support/fetchgx/default.nix b/pkgs/build-support/fetchgx/default.nix
index ea91a0854d16..c8c643182231 100644
--- a/pkgs/build-support/fetchgx/default.nix
+++ b/pkgs/build-support/fetchgx/default.nix
@@ -1,12 +1,12 @@
-{ stdenv, gx, gx-go, go, cacert }:
+{ stdenvNoCC, gx, gx-go, go, cacert }:
 
 { name, src, sha256 }:
 
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = "${name}-gxdeps";
   inherit src;
 
-  buildInputs = [ go gx gx-go ];
+  nativeBuildInputs = [ go gx gx-go ];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
diff --git a/pkgs/build-support/fetchhg/default.nix b/pkgs/build-support/fetchhg/default.nix
index aba12317963a..36a48ce9f170 100644
--- a/pkgs/build-support/fetchhg/default.nix
+++ b/pkgs/build-support/fetchhg/default.nix
@@ -1,15 +1,15 @@
-{stdenv, mercurial, nix}: {name ? null, url, rev ? null, md5 ? null, sha256 ? null, fetchSubrepos ? false}:
+{stdenvNoCC, mercurial, nix}: {name ? null, url, rev ? null, md5 ? null, sha256 ? null, fetchSubrepos ? false}:
 
 if md5 != null then
   throw "fetchhg does not support md5 anymore, please use sha256"
 else
 # TODO: statically check if mercurial as the https support if the url starts woth https.
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = "hg-archive" + (if name != null then "-${name}" else "");
   builder = ./builder.sh;
-  buildInputs = [mercurial];
+  nativeBuildInputs = [mercurial];
 
-  impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars;
+  impureEnvVars = stdenvNoCC.lib.fetchers.proxyImpureEnvVars;
 
   subrepoClause = if fetchSubrepos then "S" else "";
 
diff --git a/pkgs/build-support/fetchipfs/default.nix b/pkgs/build-support/fetchipfs/default.nix
index 196b3bebc916..dc8949794221 100644
--- a/pkgs/build-support/fetchipfs/default.nix
+++ b/pkgs/build-support/fetchipfs/default.nix
@@ -28,7 +28,7 @@ in
 if (!hasHash) then throw "Specify sha for fetchipfs fixed-output derivation" else stdenv.mkDerivation {
   name = ipfs;
   builder = ./builder.sh;
-  buildInputs = [ curl ];
+  nativeBuildInputs = [ curl ];
 
   # New-style output content requirements.
   outputHashAlgo = if outputHashAlgo != "" then outputHashAlgo else
diff --git a/pkgs/build-support/fetchmtn/default.nix b/pkgs/build-support/fetchmtn/default.nix
index 1dc14e8cab13..7ce67453d698 100644
--- a/pkgs/build-support/fetchmtn/default.nix
+++ b/pkgs/build-support/fetchmtn/default.nix
@@ -1,5 +1,5 @@
 # You can specify some extra mirrors and a cache DB via options
-{stdenv, monotone, defaultDBMirrors ? [], cacheDB ? "./mtn-checkout.db"}:
+{stdenvNoCC, monotone, defaultDBMirrors ? [], cacheDB ? "./mtn-checkout.db"}:
 # dbs is a list of strings
 # each is an url for sync
 
@@ -8,7 +8,7 @@
 {name ? "mtn-checkout", dbs ? [], sha256
 , selector ? "h:" + branch, branch}:
 
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   builder = ./builder.sh;
   nativeBuildInputs = [monotone];
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   dbs = defaultDBMirrors ++ dbs;
   inherit branch cacheDB name selector;
 
-  impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars;
+  impureEnvVars = stdenvNoCC.lib.fetchers.proxyImpureEnvVars;
 
 }
 
diff --git a/pkgs/build-support/fetchnuget/default.nix b/pkgs/build-support/fetchnuget/default.nix
index 62b700dd81b5..40ba79ec4353 100644
--- a/pkgs/build-support/fetchnuget/default.nix
+++ b/pkgs/build-support/fetchnuget/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, buildDotnetPackage, unzip }:
+{ stdenvNoCC, fetchurl, buildDotnetPackage, unzip }:
 
 attrs @
 { baseName
diff --git a/pkgs/build-support/fetchrepoproject/default.nix b/pkgs/build-support/fetchrepoproject/default.nix
index 199c029d3b64..f8793dbac950 100644
--- a/pkgs/build-support/fetchrepoproject/default.nix
+++ b/pkgs/build-support/fetchrepoproject/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, gitRepo, cacert, copyPathsToStore }:
+{ stdenvNoCC, gitRepo, cacert, copyPathsToStore }:
 
 { name, manifest, rev ? "HEAD", sha256
 # Optional parameters:
@@ -9,7 +9,7 @@
 assert repoRepoRev != "" -> repoRepoURL != "";
 assert createMirror -> !useArchive;
 
-with stdenv.lib;
+with stdenvNoCC.lib;
 
 let
   extraRepoInitFlags = [
@@ -28,7 +28,7 @@ let
 
   local_manifests = copyPathsToStore localManifests;
 
-in stdenv.mkDerivation {
+in stdenvNoCC.mkDerivation {
   inherit name;
 
   inherit cacert manifest rev repoRepoURL repoRepoRev referenceDir; # TODO
@@ -44,7 +44,7 @@ in stdenv.mkDerivation {
     "GIT_PROXY_COMMAND" "SOCKS_SERVER"
   ];
 
-  buildInputs = [ gitRepo cacert ];
+  nativeBuildInputs = [ gitRepo cacert ];
 
   GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
diff --git a/pkgs/build-support/fetchs3/default.nix b/pkgs/build-support/fetchs3/default.nix
index a5cdbd150b8b..e6b7a3418c0c 100644
--- a/pkgs/build-support/fetchs3/default.nix
+++ b/pkgs/build-support/fetchs3/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, runCommand, awscli }:
+{ stdenvNoCC, runCommand, awscli }:
 
 { s3url
 , sha256
@@ -10,13 +10,13 @@
 }:
 
 let
-  credentialAttrs = stdenv.lib.optionalAttrs (credentials != null) {
+  credentialAttrs = stdenvNoCC.lib.optionalAttrs (credentials != null) {
     AWS_ACCESS_KEY_ID = credentials.access_key_id;
     AWS_SECRET_ACCESS_KEY = credentials.secret_access_key;
     AWS_SESSION_TOKEN = credentials.session_token ? null;
   };
 in runCommand "foo" ({
-  buildInputs = [ awscli ];
+  nativeBuildInputs = [ awscli ];
   outputHashAlgo = "sha256";
   outputHash = sha256;
   outputHashMode = if recursiveHash then "recursive" else "flat";
diff --git a/pkgs/build-support/fetchsvn/default.nix b/pkgs/build-support/fetchsvn/default.nix
index 8a1085affd3c..da57d581dadd 100644
--- a/pkgs/build-support/fetchsvn/default.nix
+++ b/pkgs/build-support/fetchsvn/default.nix
@@ -1,9 +1,9 @@
-{stdenv, subversion, glibcLocales, sshSupport ? false, openssh ? null}:
+{stdenvNoCC, subversion, glibcLocales, sshSupport ? false, openssh ? null}:
 {url, rev ? "HEAD", md5 ? "", sha256 ? "",
  ignoreExternals ? false, ignoreKeywords ? false, name ? null}:
 
 let
-  repoName = with stdenv.lib;
+  repoName = with stdenvNoCC.lib;
     let
       fst = head;
       snd = l: head (tail l);
@@ -28,10 +28,10 @@ in
 if md5 != "" then
   throw "fetchsvn does not support md5 anymore, please use sha256"
 else
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = name_;
   builder = ./builder.sh;
-  buildInputs = [ subversion glibcLocales ];
+  nativeBuildInputs = [ subversion glibcLocales ];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
@@ -39,6 +39,6 @@ stdenv.mkDerivation {
 
   inherit url rev sshSupport openssh ignoreExternals ignoreKeywords;
 
-  impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars;
+  impureEnvVars = stdenvNoCC.lib.fetchers.proxyImpureEnvVars;
   preferLocalBuild = true;
 }
diff --git a/pkgs/build-support/fetchsvnssh/default.nix b/pkgs/build-support/fetchsvnssh/default.nix
index a6f3d3469f09..f76bd10247ba 100644
--- a/pkgs/build-support/fetchsvnssh/default.nix
+++ b/pkgs/build-support/fetchsvnssh/default.nix
@@ -1,14 +1,14 @@
-{stdenv, subversion, sshSupport ? false, openssh ? null, expect}: 
+{stdenvNoCC, subversion, sshSupport ? false, openssh ? null, expect}: 
 {username, password, url, rev ? "HEAD", md5 ? "", sha256 ? ""}:
 
 
 if md5 != "" then
   throw "fetchsvnssh does not support md5 anymore, please use sha256"
 else
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = "svn-export-ssh";
   builder = ./builder.sh;
-  buildInputs = [subversion expect];
+  nativeBuildInputs = [subversion expect];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
index 8dac273eb1ca..3e47d4a4b683 100644
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, curl }: # Note that `curl' may be `null', in case of the native stdenv.
+{ stdenvNoCC, curl }: # Note that `curl' may be `null', in case of the native stdenvNoCC.
 
 let
 
@@ -10,7 +10,7 @@ let
   # resulting store derivations (.drv files) much smaller, which in
   # turn makes nix-env/nix-instantiate faster.
   mirrorsFile =
-    stdenv.mkDerivation ({
+    stdenvNoCC.mkDerivation ({
       name = "mirrors-list";
       builder = ./write-mirror-list.sh;
       preferLocalBuild = true;
@@ -20,7 +20,7 @@ let
   # "gnu", etc.).
   sites = builtins.attrNames mirrors;
 
-  impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars ++ [
+  impureEnvVars = stdenvNoCC.lib.fetchers.proxyImpureEnvVars ++ [
     # This variable allows the user to pass additional options to curl
     "NIX_CURL_FLAGS"
 
@@ -103,8 +103,8 @@ let
 in
 
 if md5 != "" then throw "fetchurl does not support md5 anymore, please use sha256 or sha512"
-else if (!hasHash) then throw "Specify hash for fetchurl fixed-output derivation: ${stdenv.lib.concatStringsSep ", " urls_}"
-else stdenv.mkDerivation {
+else if (!hasHash) then throw "Specify hash for fetchurl fixed-output derivation: ${stdenvNoCC.lib.concatStringsSep ", " urls_}"
+else stdenvNoCC.mkDerivation {
   name =
     if showURLs then "urls"
     else if name != "" then name
@@ -112,7 +112,7 @@ else stdenv.mkDerivation {
 
   builder = ./builder.sh;
 
-  buildInputs = [ curl ];
+  nativeBuildInputs = [ curl ];
 
   urls = urls_;
 
diff --git a/pkgs/build-support/rust/fetchcargo.nix b/pkgs/build-support/rust/fetchcargo.nix
index 9b3ba5303398..5529e9eea33c 100644
--- a/pkgs/build-support/rust/fetchcargo.nix
+++ b/pkgs/build-support/rust/fetchcargo.nix
@@ -2,7 +2,7 @@
 { name ? "cargo-deps", src, srcs, sourceRoot, sha256, cargoUpdateHook ? "" }:
 stdenv.mkDerivation {
   name = "${name}-vendor";
-  buildInputs = [ cacert cargoVendor git rust.cargo ];
+  nativeBuildInputs = [ cacert cargoVendor git rust.cargo ];
   inherit src srcs sourceRoot;
 
   phases = "unpackPhase installPhase";
diff --git a/pkgs/data/fonts/clearlyU/default.nix b/pkgs/data/fonts/clearlyU/default.nix
index 1e4df0c9221e..cbca697cb262 100644
--- a/pkgs/data/fonts/clearlyU/default.nix
+++ b/pkgs/data/fonts/clearlyU/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "1xn14jbv3m1khy7ydvad9ydkn7yygdbhjy9wm1v000jzjwr3lv21";
   };
   
-  buildInputs = [ mkfontdir mkfontscale ];
+  nativeBuildInputs = [ mkfontdir mkfontscale ];
 
   installPhase =
     ''
diff --git a/pkgs/data/fonts/corefonts/default.nix b/pkgs/data/fonts/corefonts/default.nix
index 91c8ed1163d4..8c45c8139534 100644
--- a/pkgs/data/fonts/corefonts/default.nix
+++ b/pkgs/data/fonts/corefonts/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
     inherit sha256;
   }) fonts;
 
-  buildInputs = [cabextract];
+  nativeBuildInputs = [cabextract];
 
   buildCommand = ''
     for i in $exes; do
diff --git a/pkgs/data/fonts/dejavu-fonts/default.nix b/pkgs/data/fonts/dejavu-fonts/default.nix
index 60e1eff2c9d5..23158a38f218 100644
--- a/pkgs/data/fonts/dejavu-fonts/default.nix
+++ b/pkgs/data/fonts/dejavu-fonts/default.nix
@@ -25,7 +25,7 @@ let
 
   full-ttf = stdenv.mkDerivation {
     name = "dejavu-fonts-full-${version}";
-    buildInputs = [fontforge perl FontTTF];
+    nativeBuildInputs = [fontforge perl FontTTF];
 
     src = fetchFromGitHub {
       owner = "dejavu-fonts";
diff --git a/pkgs/data/fonts/dina-pcf/default.nix b/pkgs/data/fonts/dina-pcf/default.nix
index b94004b24bb4..975bbc1749a7 100644
--- a/pkgs/data/fonts/dina-pcf/default.nix
+++ b/pkgs/data/fonts/dina-pcf/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1kq86lbxxgik82aywwhawmj80vsbz3hfhdyhicnlv9km7yjvnl8z";
   };
 
-  buildInputs = [ unzip bdftopcf mkfontdir mkfontscale ];
+  nativeBuildInputs = [ unzip bdftopcf mkfontdir mkfontscale ];
 
   dontBuild = true;
   patchPhase = "sed -i 's/microsoft-cp1252/ISO8859-1/' *.bdf";
diff --git a/pkgs/data/fonts/envypn-font/default.nix b/pkgs/data/fonts/envypn-font/default.nix
index 40880d022db0..0e31231d05fc 100644
--- a/pkgs/data/fonts/envypn-font/default.nix
+++ b/pkgs/data/fonts/envypn-font/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "bda67b6bc6d5d871a4d46565d4126729dfb8a0de9611dae6c68132a7b7db1270";
   };
 
-  buildInputs = [ mkfontdir mkfontscale ];
+  nativeBuildInputs = [ mkfontdir mkfontscale ];
 
   unpackPhase = ''
     tar -xzf $src --strip-components=1
diff --git a/pkgs/data/fonts/gohufont/default.nix b/pkgs/data/fonts/gohufont/default.nix
index f4043697e7b5..7936a216ada7 100644
--- a/pkgs/data/fonts/gohufont/default.nix
+++ b/pkgs/data/fonts/gohufont/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "0rqqavhqbs7pajcblg92mjlz2dxk8b60vgdh271axz7kjs2wf9mr";
   };
 
-  buildInputs = [ mkfontdir mkfontscale bdf2psf ];
+  nativeBuildInputs = [ mkfontdir mkfontscale bdf2psf ];
 
   unpackPhase = ''
     mkdir pcf bdf
diff --git a/pkgs/data/fonts/inconsolata/lgc.nix b/pkgs/data/fonts/inconsolata/lgc.nix
index aa7d3d7def4f..8563e0e112ac 100644
--- a/pkgs/data/fonts/inconsolata/lgc.nix
+++ b/pkgs/data/fonts/inconsolata/lgc.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0dqjj3mlc28s8ljnph6l086b4j9r5dly4fldq59crycwys72zzai";
   };
 
-  buildInputs = [ fontforge ];
+  nativeBuildInputs = [ fontforge ];
 
   installPhase = ''
     mkdir -p $out/share/fonts/truetype
diff --git a/pkgs/data/fonts/kochi-substitute/default.nix b/pkgs/data/fonts/kochi-substitute/default.nix
index f49d20e3ba7c..5815b84f21a4 100644
--- a/pkgs/data/fonts/kochi-substitute/default.nix
+++ b/pkgs/data/fonts/kochi-substitute/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
     sha256 = "91ce6c993a3a0f77ed85db76f62ce18632b4c0cbd8f864676359a17ae5e6fa3c";
   };
 
-  buildInputs = [ dpkg ];
+  nativeBuildInputs = [ dpkg ];
 
   unpackCmd = ''
     dpkg-deb --fsys-tarfile $src | tar xf - ./usr/share/fonts/truetype/kochi/kochi-gothic-subst.ttf
diff --git a/pkgs/data/fonts/league-of-moveable-type/default.nix b/pkgs/data/fonts/league-of-moveable-type/default.nix
index 3fac3024dd4f..b79855789981 100644
--- a/pkgs/data/fonts/league-of-moveable-type/default.nix
+++ b/pkgs/data/fonts/league-of-moveable-type/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   srcs = fonts;
 
-  buildInputs = [ unzip ];
+  nativeBuildInputs = [ unzip ];
   sourceRoot = ".";
 
   installPhase = ''
diff --git a/pkgs/data/fonts/meslo-lg/default.nix b/pkgs/data/fonts/meslo-lg/default.nix
index 8a11a98ebd23..d95aea26c8d4 100644
--- a/pkgs/data/fonts/meslo-lg/default.nix
+++ b/pkgs/data/fonts/meslo-lg/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     sha256="0lnbkrvcpgz9chnvix79j6fiz36wj6n46brb7b1746182rl1l875";
   };
 
-  buildInputs = [ unzip ];
+  nativeBuildInputs = [ unzip ];
 
   sourceRoot = ".";
 
diff --git a/pkgs/data/fonts/nafees/default.nix b/pkgs/data/fonts/nafees/default.nix
index 054c2ca91f6e..b39a59d1ba7a 100644
--- a/pkgs/data/fonts/nafees/default.nix
+++ b/pkgs/data/fonts/nafees/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   })
 ];
 
-  buildInputs = [unzip];
+  nativeBuildInputs = [unzip];
 
   sourceRoot = ".";
 
diff --git a/pkgs/data/fonts/poly/default.nix b/pkgs/data/fonts/poly/default.nix
index b27290707b6b..81fc7b799259 100644
--- a/pkgs/data/fonts/poly/default.nix
+++ b/pkgs/data/fonts/poly/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     sha256 = "1chzcy3kyi7wpr4iq4aj1v24fq1wwph1v5z96dimlqcrnvm66h2l";
   };
 
-  buildInputs = [unzip];
+  nativeBuildInputs = [unzip];
 
   sourceRoot = ".";
 
diff --git a/pkgs/data/fonts/proggyfonts/default.nix b/pkgs/data/fonts/proggyfonts/default.nix
index 895ef3dae0f2..5ebb365ecdfb 100644
--- a/pkgs/data/fonts/proggyfonts/default.nix
+++ b/pkgs/data/fonts/proggyfonts/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "1plcm1sjpa3hdqhhin48fq6zmz3ndm4md72916hd8ff0w6596q0n";
   };
 
-  buildInputs = [ mkfontdir mkfontscale ];
+  nativeBuildInputs = [ mkfontdir mkfontscale ];
 
   installPhase =
     ''
diff --git a/pkgs/data/fonts/redhat-liberation-fonts/default.nix b/pkgs/data/fonts/redhat-liberation-fonts/default.nix
index 3fbcefc3187c..88d438096c10 100644
--- a/pkgs/data/fonts/redhat-liberation-fonts/default.nix
+++ b/pkgs/data/fonts/redhat-liberation-fonts/default.nix
@@ -4,14 +4,14 @@ let
   inherit (python2.pkgs) fonttools;
 
   common =
-    {version, url, sha256, buildInputs, postPatch ? null, outputHash}:
+    {version, url, sha256, nativeBuildInputs, postPatch ? null, outputHash}:
     stdenv.mkDerivation rec {
       name = "liberation-fonts-${version}";
       src = fetchurl {
         inherit url sha256;
       };
 
-      inherit buildInputs postPatch;
+      inherit nativeBuildInputs postPatch;
 
       installPhase = ''
         mkdir -p $out/share/fonts/truetype
@@ -53,21 +53,21 @@ in {
     version = "1.07.4";
     url = "https://releases.pagure.org/liberation-fonts/liberation-fonts-${version}.tar.gz";
     sha256 = "01jlg88q2s6by7qv6fmnrlx0lwjarrjrpxv811zjz6f2im4vg65d";
-    buildInputs = [ fontforge ];
+    nativeBuildInputs = [ fontforge ];
     outputHash = "1q102rmg4004p74f8m4y8a6iklmnva0q39sq260jsq3lhcfypg7p";
   };
   liberation_ttf_v1_binary = common rec {
     version = "1.07.4";
     url = "https://releases.pagure.org/liberation-fonts/liberation-fonts-ttf-${version}.tar.gz";
     sha256 = "0p7frz29pmjlk2d0j2zs5kfspygwdnpzxkb2hwzcfhrafjvf59v1";
-    buildInputs = [ ];
+    nativeBuildInputs = [ ];
     outputHash = "12gwb9b4ij9d93ky4c9ykgp03fqr62axy37pds88q7y6zgciwkab";
   };
   liberation_ttf_v2_from_source = common rec {
     version = "2.00.1";
     url = "https://releases.pagure.org/liberation-fonts/liberation-fonts-${version}.tar.gz";
     sha256 = "1ymryvd2nw4jmw4w5y1i3ll2dn48rpkqzlsgv7994lk6qc9cdjvs";
-    buildInputs = [ fontforge fonttools ];
+    nativeBuildInputs = [ fontforge fonttools ];
     postPatch = ''
       substituteInPlace scripts/setisFixedPitch-fonttools.py --replace \
         'font = ttLib.TTFont(fontfile)' \
@@ -79,7 +79,7 @@ in {
     version = "2.00.1";
     url = "https://releases.pagure.org/liberation-fonts/liberation-fonts-ttf-${version}.tar.gz";
     sha256 = "010m4zfqan4w04b6bs9pm3gapn9hsb18bmwwgp2p6y6idj52g43q";
-    buildInputs = [ ];
+    nativeBuildInputs = [ ];
     outputHash = "19jky9li345zsig9pcb0rnlsjqqclh7r60vbi4pwh16f14850gpk";
   };
 }
diff --git a/pkgs/data/fonts/tempora-lgc/default.nix b/pkgs/data/fonts/tempora-lgc/default.nix
index d0e7b89888c3..1cab3da200e6 100644
--- a/pkgs/data/fonts/tempora-lgc/default.nix
+++ b/pkgs/data/fonts/tempora-lgc/default.nix
@@ -18,12 +18,12 @@ let
       sha256 = "0iwa8wyydcpjss6d1jy4jibqxpvzph4vmaxwwmndpsqy1fz64y9i";
     })
   ];
-  buildInputs = [
+  nativeBuildInputs = [
   ];
 in
 stdenv.mkDerivation {
   name = "tempora-lgc";
-  inherit buildInputs;
+  inherit nativeBuildInputs;
   inherit srcs;
   phases = "installPhase";
   installPhase = ''
diff --git a/pkgs/data/fonts/tewi/default.nix b/pkgs/data/fonts/tewi/default.nix
index e499eb412bac..32d859bf53bd 100644
--- a/pkgs/data/fonts/tewi/default.nix
+++ b/pkgs/data/fonts/tewi/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "0c7k847cp68w20frzsdknpss2cwv3lp970asyybv65jxyl2jz3iq";
   };
 
-  buildInputs = [ bdftopcf mkfontdir mkfontscale ];
+  nativeBuildInputs = [ bdftopcf mkfontdir mkfontscale ];
   buildPhase = ''
     for i in *.bdf; do
         bdftopcf -o ''${i/bdf/pcf} $i
diff --git a/pkgs/data/fonts/ucs-fonts/default.nix b/pkgs/data/fonts/ucs-fonts/default.nix
index 75ab2f40b6f1..996d11923972 100644
--- a/pkgs/data/fonts/ucs-fonts/default.nix
+++ b/pkgs/data/fonts/ucs-fonts/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   sourceRoot = ".";
 
-  buildInputs = [ mkfontdir mkfontscale ];
+  nativeBuildInputs = [ mkfontdir mkfontscale ];
 
   phases = [ "unpackPhase" "installPhase" ];
 
diff --git a/pkgs/data/fonts/uni-vga/default.nix b/pkgs/data/fonts/uni-vga/default.nix
index ce18893ced7d..2a13824b36f7 100644
--- a/pkgs/data/fonts/uni-vga/default.nix
+++ b/pkgs/data/fonts/uni-vga/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "05sns8h5yspa7xkl81ri7y1yxf5icgsnl497f3xnaryhx11s2rv6";
   };
 
-  buildInputs = [ mkfontdir mkfontscale ];
+  nativeBuildInputs = [ mkfontdir mkfontscale ];
 
   installPhase = ''
     mkdir -p $out/share/fonts
diff --git a/pkgs/data/fonts/unifont/default.nix b/pkgs/data/fonts/unifont/default.nix
index 29d5060d4012..e56807a434e8 100644
--- a/pkgs/data/fonts/unifont/default.nix
+++ b/pkgs/data/fonts/unifont/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ypkmwyfrsnag69h1c0mx89ranz4f6jc9y1sqkpq2rbzg64maik0";
   };
 
-  buildInputs = [ mkfontscale mkfontdir ];
+  nativeBuildInputs = [ mkfontscale mkfontdir ];
 
   phases = "installPhase";
 
diff --git a/pkgs/data/fonts/unscii/default.nix b/pkgs/data/fonts/unscii/default.nix
index 092537c216aa..c4969d046d48 100644
--- a/pkgs/data/fonts/unscii/default.nix
+++ b/pkgs/data/fonts/unscii/default.nix
@@ -8,7 +8,6 @@ stdenv.mkDerivation rec {
     url = "http://pelulamu.net/${pname}/${name}-src.tar.gz";
     sha256 = "0qcxcnqz2nlwfzlrn115kkp3n8dd7593h762vxs6vfqm13i39lq1";
   };
-  buildInputs = [];
   nativeBuildInputs = [perl bdftopcf perlPackages.TextCharWidth fontforge 
     SDL SDL_image];
   preConfigure = ''
diff --git a/pkgs/games/factorio/fetch.nix b/pkgs/games/factorio/fetch.nix
index 439f2478a667..7dbe2064a5c4 100644
--- a/pkgs/games/factorio/fetch.nix
+++ b/pkgs/games/factorio/fetch.nix
@@ -18,7 +18,7 @@
 }:
 
 stdenv.mkDerivation {
-  buildInputs = [ curl xidel ];
+  nativeBuildInputs = [ curl xidel ];
 
   inherit name url loginUrl username password cacert;
 
diff --git a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
index 809d0ba5264c..206ea01bb20e 100644
--- a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     # traffic, so don't do that.
     preferLocalBuild = true;
 
-    buildInputs = [ git gnupg ];
+    nativeBuildInputs = [ git gnupg ];
     NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
   } ''
     git init src && (
diff --git a/pkgs/servers/xmpp/ejabberd/default.nix b/pkgs/servers/xmpp/ejabberd/default.nix
index 2799241fa990..3cde8307cb02 100644
--- a/pkgs/servers/xmpp/ejabberd/default.nix
+++ b/pkgs/servers/xmpp/ejabberd/default.nix
@@ -50,7 +50,7 @@ in stdenv.mkDerivation rec {
 
     configureFlags = [ "--enable-all" "--with-sqlite3=${sqlite.dev}" ];
 
-    buildInputs = [ git erlang openssl expat libyaml sqlite pam zlib elixir ];
+    nativeBuildInputs = [ git erlang openssl expat libyaml sqlite pam zlib elixir ];
 
     GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 2542d2428859..afbade7c73a4 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -118,8 +118,8 @@ in rec {
         initialPath  = [ bootstrapTools ];
 
         fetchurlBoot = import ../../build-support/fetchurl {
-          stdenv = stage0.stdenv;
-          curl   = bootstrapTools;
+          stdenvNoCC = stage0.stdenv;
+          curl = bootstrapTools;
         };
 
         # The stdenvs themselves don't use mkDerivation, so I need to specify this here
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1fd87d2a4521..f9b8249bfc30 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -180,10 +180,10 @@ with pkgs;
 
   # `fetchurl' downloads a file from the network.
   fetchurl = import ../build-support/fetchurl {
-    inherit stdenv;
+    inherit stdenvNoCC;
     # On darwin, libkrb5 needs bootstrap_cmds which would require
     # converting many packages to fetchurl_boot to avoid evaluation cycles.
-    curl = curl.override (lib.optionalAttrs stdenv.isDarwin { gssSupport = false; });
+    curl = buildPackages.curl.override (lib.optionalAttrs stdenv.isDarwin { gssSupport = false; });
   };
 
   fetchRepoProject = callPackage ../build-support/fetchrepoproject { };