diff --git a/nixos/modules/system/etc/etc.nix b/nixos/modules/system/etc/etc.nix
index a450f303572e0..91218d7eb137c 100644
--- a/nixos/modules/system/etc/etc.nix
+++ b/nixos/modules/system/etc/etc.nix
@@ -11,12 +11,11 @@ let
   etc = pkgs.stdenvNoCC.mkDerivation {
     name = "etc";
 
-    builder = ./make-etc.sh;
+    buildCommand = builtins.readFile ./make-etc.sh;
 
     preferLocalBuild = true;
     allowSubstitutes = false;
 
-    /* !!! Use toXML. */
     sources = map (x: x.source) etc';
     targets = map (x: x.target) etc';
     modes = map (x: x.mode) etc';
diff --git a/nixos/modules/system/etc/make-etc.sh b/nixos/modules/system/etc/make-etc.sh
index aabfb5e88a655..fbb9daed10e73 100644
--- a/nixos/modules/system/etc/make-etc.sh
+++ b/nixos/modules/system/etc/make-etc.sh
@@ -1,25 +1,15 @@
-source $stdenv/setup
+mkdir -p "$out/etc"
 
-mkdir -p $out/etc
-
-set -f
-sources_=($sources)
-targets_=($targets)
-modes_=($modes)
-users_=($users)
-groups_=($groups)
-set +f
-
-for ((i = 0; i < ${#targets_[@]}; i++)); do
-    source="${sources_[$i]}"
-    target="${targets_[$i]}"
+for ((i = 0; i < ${#targets[@]}; i++)); do
+    source="${sources[$i]}"
+    target="${targets[$i]}"
 
     if [[ "$source" =~ '*' ]]; then
 
         # If the source name contains '*', perform globbing.
-        mkdir -p $out/etc/$target
+        mkdir -p "$out/etc/$target"
         for fn in $source; do
-            ln -s "$fn" $out/etc/$target/
+            ln -s "$fn" "$out/etc/$target/"
         done
 
     else
diff --git a/pkgs/applications/audio/aacgain/default.nix b/pkgs/applications/audio/aacgain/default.nix
index 0f9b511d4553f..0d30a24e4487f 100644
--- a/pkgs/applications/audio/aacgain/default.nix
+++ b/pkgs/applications/audio/aacgain/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
 
   # -Wnarrowing is enabled by default in recent GCC versions,
   # causing compilation to fail.
-  NIX_CFLAGS_COMPILE = "-Wno-narrowing";
+  env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
 
   postPatch = ''
     (
diff --git a/pkgs/applications/audio/ardour/5.nix b/pkgs/applications/audio/ardour/5.nix
index 9e8c075bfb078..2f8319426fba3 100644
--- a/pkgs/applications/audio/ardour/5.nix
+++ b/pkgs/applications/audio/ardour/5.nix
@@ -119,7 +119,7 @@ in stdenv.mkDerivation rec {
     "--with-backends=jack,alsa,dummy"
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${qm-dsp}/include/qm-dsp";
+  env.NIX_CFLAGS_COMPILE = "-I${qm-dsp}/include/qm-dsp";
 
   # ardour's wscript has a "tarball" target but that required the git revision
   # be available. Since this is an unzipped tarball fetched from github we
diff --git a/pkgs/applications/audio/ardour/default.nix b/pkgs/applications/audio/ardour/default.nix
index 8bb7430650dd4..b2eb091c458f5 100644
--- a/pkgs/applications/audio/ardour/default.nix
+++ b/pkgs/applications/audio/ardour/default.nix
@@ -169,7 +169,7 @@ stdenv.mkDerivation rec {
       --prefix PATH : "${lib.makeBinPath [ harvid xjadeo ]}"
   '';
 
-  LINKFLAGS = "-lpthread";
+  env.LINKFLAGS = "-lpthread";
 
   meta = with lib; {
     description = "Multi-track hard disk recording software";
diff --git a/pkgs/applications/audio/audacious/default.nix b/pkgs/applications/audio/audacious/default.nix
index 82a2303e26b3b..7ab86a0a29b73 100644
--- a/pkgs/applications/audio/audacious/default.nix
+++ b/pkgs/applications/audio/audacious/default.nix
@@ -40,6 +40,7 @@ mkDerivation rec {
   # derivations, since they really expect to be in the same prefix.
   # This is slighly tricky.
   builder = builtins.toFile "builder.sh" ''
+    source .attrs.sh
     # First build audacious.
     (
       source $stdenv/setup
@@ -47,7 +48,7 @@ mkDerivation rec {
     )
     # Then build the plugins.
     (
-      nativeBuildInputs="$out $nativeBuildInputs" # to find audacious
+      nativeBuildInputs+=("''${outputs[out]}") # to find audacious
       source $stdenv/setup
       rm -rfv audacious-*
       src=$pluginsSrc
diff --git a/pkgs/applications/audio/audacity/default.nix b/pkgs/applications/audio/audacity/default.nix
index 0fee289021e46..4eeef3fab228a 100644
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
   '';
 
   # audacity only looks for ffmpeg at runtime, so we need to link it in manually
-  NIX_LDFLAGS = toString [
+  env.NIX_LDFLAGS = toString [
     "-lavcodec"
     "-lavdevice"
     "-lavfilter"
diff --git a/pkgs/applications/audio/audio-recorder/default.nix b/pkgs/applications/audio/audio-recorder/default.nix
index 6a4abbbdf5342..3c8a2d0fe0421 100644
--- a/pkgs/applications/audio/audio-recorder/default.nix
+++ b/pkgs/applications/audio/audio-recorder/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   };
 
   # https://bugs.launchpad.net/audio-recorder/+bug/1784622
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   nativeBuildInputs = [ pkg-config intltool wrapGAppsHook ];
 
diff --git a/pkgs/applications/audio/axoloti/libusb1.nix b/pkgs/applications/audio/axoloti/libusb1.nix
index b6c2a1b1ae6ea..c7675301d71d8 100644
--- a/pkgs/applications/audio/axoloti/libusb1.nix
+++ b/pkgs/applications/audio/axoloti/libusb1.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  NIX_LDFLAGS = lib.optionalString stdenv.isLinux "-lgcc_s";
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isLinux "-lgcc_s";
 
   preFixup = lib.optionalString stdenv.isLinux ''
     sed 's,-ludev,-L${lib.getLib systemd}/lib -ludev,' -i $out/lib/libusb-1.0.la
diff --git a/pkgs/applications/audio/chuck/default.nix b/pkgs/applications/audio/chuck/default.nix
index f30b5dba5b6b2..20c354a8009b1 100644
--- a/pkgs/applications/audio/chuck/default.nix
+++ b/pkgs/applications/audio/chuck/default.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./darwin-limits.patch ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-missing-sysroot";
-  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework MultitouchSupport";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-missing-sysroot";
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework MultitouchSupport";
 
   postPatch = ''
     substituteInPlace src/core/makefile.x/makefile.osx \
diff --git a/pkgs/applications/audio/easytag/default.nix b/pkgs/applications/audio/easytag/default.nix
index d55fd7ff0cb6b..f5490897c7da9 100644
--- a/pkgs/applications/audio/easytag/default.nix
+++ b/pkgs/applications/audio/easytag/default.nix
@@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {
     sha256 = "1mbxnqrw1fwcgraa1bgik25vdzvf97vma5pzknbwbqq5ly9fwlgw";
   };
 
-  NIX_LDFLAGS = "-lid3tag -lz";
+  env.NIX_LDFLAGS = "-lid3tag -lz";
 
   nativeBuildInputs = [ pkg-config intltool itstool libxml2 wrapGAppsHook ];
   buildInputs = [
diff --git a/pkgs/applications/audio/ecasound/default.nix b/pkgs/applications/audio/ecasound/default.nix
index e2ec9bf8ab2cd..a9fe0b334bf11 100644
--- a/pkgs/applications/audio/ecasound/default.nix
+++ b/pkgs/applications/audio/ecasound/default.nix
@@ -48,8 +48,8 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
 
-  CXXFLAGS = "-std=c++11";
-  configureFlags = "--enable-liblilv --with-extra-cppflags=-Dnullptr=0";
+  env.CXXFLAGS = "-std=c++11";
+  configureFlags = [ "--enable-liblilv" "--with-extra-cppflags=-Dnullptr=0" ];
 
   postPatch = ''
     sed -i -e '
diff --git a/pkgs/applications/audio/eflite/default.nix b/pkgs/applications/audio/eflite/default.nix
index 6a974abb8aa87..11d301532552d 100644
--- a/pkgs/applications/audio/eflite/default.nix
+++ b/pkgs/applications/audio/eflite/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     ./format.patch
   ];
 
-  CFLAGS = lib.optionalString debug " -DDEBUG=2";
+  env.CFLAGS = lib.optionalString debug " -DDEBUG=2";
 
   meta = {
     homepage = "http://eflite.sourceforge.net";
diff --git a/pkgs/applications/audio/faust/faust2.nix b/pkgs/applications/audio/faust/faust2.nix
index 051caf120fa26..3ce6ae9b36ab6 100644
--- a/pkgs/applications/audio/faust/faust2.nix
+++ b/pkgs/applications/audio/faust/faust2.nix
@@ -58,9 +58,7 @@ let
       cd build
     '';
 
-    cmakeFlags = ''
-      -C ../backends/all.cmake -C  ../targets/all.cmake ..
-    '';
+    cmakeFlags = [ "-C ../backends/all.cmake" "-C  ../targets/all.cmake .." ];
 
     postInstall = ''
       # syntax error when eval'd directly
diff --git a/pkgs/applications/audio/freewheeling/default.nix b/pkgs/applications/audio/freewheeling/default.nix
index 7bd063d9f53eb..c9dc078074530 100644
--- a/pkgs/applications/audio/freewheeling/default.nix
+++ b/pkgs/applications/audio/freewheeling/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
       configureFlags = oldAttrs.configureFlags ++ [ "--enable-openssl-compatibility" ];
     }))
   ];
-  NIX_CFLAGS_COMPILE = toString
+  env.NIX_CFLAGS_COMPILE = toString
     (makeSDLFlags [ SDL SDL_ttf SDL_gfx ] ++ [ "-I${libxml2.dev}/include/libxml2" ]);
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/applications/audio/ft2-clone/default.nix b/pkgs/applications/audio/ft2-clone/default.nix
index 8391a7509995d..8f770aaf7ee13 100644
--- a/pkgs/applications/audio/ft2-clone/default.nix
+++ b/pkgs/applications/audio/ft2-clone/default.nix
@@ -38,12 +38,12 @@ stdenv.mkDerivation rec {
          Cocoa
        ];
 
-  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin [
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isDarwin (toString [
     "-framework CoreAudio"
     "-framework CoreMIDI"
     "-framework CoreServices"
     "-framework Cocoa"
-  ];
+  ]);
 
   passthru.tests = {
     ft2-clone-starts = nixosTests.ft2-clone;
diff --git a/pkgs/applications/audio/grandorgue/default.nix b/pkgs/applications/audio/grandorgue/default.nix
index 2d660bc736c17..191d77a624bec 100644
--- a/pkgs/applications/audio/grandorgue/default.nix
+++ b/pkgs/applications/audio/grandorgue/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ pkg-config fftwFloat alsaLib zlib wavpack wxGTK31 udev ]
     ++ lib.optional jackaudioSupport libjack2;
 
-  cmakeFlags = lib.optional (!jackaudioSupport) [
+  cmakeFlags = lib.optionals (!jackaudioSupport) [
     "-DRTAUDIO_USE_JACK=OFF"
     "-DRTMIDI_USE_JACK=OFF"
   ] ++ lib.optional (!includeDemo) "-DINSTALL_DEMO=OFF";
diff --git a/pkgs/applications/audio/helm/default.nix b/pkgs/applications/audio/helm/default.nix
index 172f134907c59..99657fc82f387 100644
--- a/pkgs/applications/audio/helm/default.nix
+++ b/pkgs/applications/audio/helm/default.nix
@@ -29,7 +29,7 @@
     freetype alsaLib curl libjack2 pkg-config libGLU libGL lv2
   ];
 
-  CXXFLAGS = "-DHAVE_LROUND";
+  env.CXXFLAGS = "-DHAVE_LROUND";
 
   patches = [
     # gcc9 compatibility https://github.com/mtytel/helm/pull/233
diff --git a/pkgs/applications/audio/hivelytracker/default.nix b/pkgs/applications/audio/hivelytracker/default.nix
index 4cf20e3c89852..0ffb3b9e17d0b 100644
--- a/pkgs/applications/audio/hivelytracker/default.nix
+++ b/pkgs/applications/audio/hivelytracker/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   ];
 
   # TODO: try to exclude gtk and glib from darwin builds
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-I${SDL}/include/SDL"
     "-I${SDL_image}/include/SDL"
     "-I${SDL_ttf}/include/SDL"
diff --git a/pkgs/applications/audio/jack-rack/default.nix b/pkgs/applications/audio/jack-rack/default.nix
index ec62cb04c85ea..d20eb045f1f9c 100644
--- a/pkgs/applications/audio/jack-rack/default.nix
+++ b/pkgs/applications/audio/jack-rack/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   };
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libjack2 ladspaH gtk2 alsaLib libxml2 lrdf ];
-  NIX_LDFLAGS = "-ldl -lm -lpthread";
+  env.NIX_LDFLAGS = "-ldl -lm -lpthread";
 
   meta = {
     description = ''An effects "rack" for the JACK low latency audio API'';
diff --git a/pkgs/applications/audio/jamin/default.nix b/pkgs/applications/audio/jamin/default.nix
index 325d115b58168..7a2a33511cdf3 100644
--- a/pkgs/applications/audio/jamin/default.nix
+++ b/pkgs/applications/audio/jamin/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ fftwFloat gtk2 ladspaPlugins libjack2 liblo libxml2 ]
     ++ (with perlPackages; [ perl XMLParser ]);
 
-  NIX_LDFLAGS = "-ldl";
+  env.NIX_LDFLAGS = "-ldl";
 
   postInstall = ''
     wrapProgram $out/bin/jamin --set LADSPA_PATH ${ladspaPlugins}/lib/ladspa
diff --git a/pkgs/applications/audio/kid3/default.nix b/pkgs/applications/audio/kid3/default.nix
index 7f8015e714378..f7ac7f887ecdc 100644
--- a/pkgs/applications/audio/kid3/default.nix
+++ b/pkgs/applications/audio/kid3/default.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [ "-DWITH_APPS=Qt;CLI" ];
-  NIX_LDFLAGS = "-lm -lpthread";
+  env.NIX_LDFLAGS = "-lm -lpthread";
 
   preConfigure = ''
     export DOCBOOKDIR="${docbook_xsl}/xml/xsl/docbook/"
diff --git a/pkgs/applications/audio/klick/default.nix b/pkgs/applications/audio/klick/default.nix
index 281a7148dfeae..283f7d8a88412 100644
--- a/pkgs/applications/audio/klick/default.nix
+++ b/pkgs/applications/audio/klick/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ sconsPackages.scons_3_0_1 pkg-config ];
   buildInputs = [ libsamplerate libsndfile liblo libjack2 boost ];
   prefixKey = "PREFIX=";
-  NIX_CFLAGS_COMPILE = "-fpermissive";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
 
   meta = {
     homepage = "http://das.nasophon.de/klick/";
diff --git a/pkgs/applications/audio/lash/default.nix b/pkgs/applications/audio/lash/default.nix
index 74bbeb9b7bb73..1ff4315e7422a 100644
--- a/pkgs/applications/audio/lash/default.nix
+++ b/pkgs/applications/audio/lash/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation  rec {
   nativeBuildInputs = [ pkg-config makeWrapper ];
   buildInputs = [ alsaLib gtk2 libjack2 libxml2 readline ];
   propagatedBuildInputs = [ libuuid ];
-  NIX_LDFLAGS = "-lm -lpthread -luuid";
+  env.NIX_LDFLAGS = "-lm -lpthread -luuid";
 
   postInstall = ''
     for i in lash_control lash_panel
diff --git a/pkgs/applications/audio/littlegptracker/default.nix b/pkgs/applications/audio/littlegptracker/default.nix
index 4d7d70aebd662..6c7c337be9d1c 100644
--- a/pkgs/applications/audio/littlegptracker/default.nix
+++ b/pkgs/applications/audio/littlegptracker/default.nix
@@ -35,10 +35,10 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isLinux  [ "PLATFORM=DEB" ]
     ++ lib.optionals stdenv.isDarwin [ "PLATFORM=OSX" ];
 
-  NIX_CFLAGS_COMPILE = [ "-fpermissive" ] ++
-    lib.optional stdenv.hostPlatform.isAarch64 "-Wno-error=narrowing";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive" +
+    lib.optionalString stdenv.hostPlatform.isAarch64 " -Wno-error=narrowing";
 
-  NIX_LDFLAGS = lib.optional stdenv.isDarwin "-framework Foundation";
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework Foundation";
 
   installPhase = let extension = if stdenv.isDarwin then "app" else "deb-exe";
     in "install -Dm555 lgpt.${extension} $out/bin/lgpt";
diff --git a/pkgs/applications/audio/lsp-plugins/default.nix b/pkgs/applications/audio/lsp-plugins/default.nix
index e3f92d2da7455..85b5ade880c89 100644
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     "ETC_PATH=$(out)/etc"
   ];
 
-  NIX_CFLAGS_COMPILE = "-DLSP_NO_EXPERIMENTAL";
+  env.NIX_CFLAGS_COMPILE = "-DLSP_NO_EXPERIMENTAL";
 
   doCheck = true;
 
diff --git a/pkgs/applications/audio/mixxx/default.nix b/pkgs/applications/audio/mixxx/default.nix
index 7af4b585adfad..cf4413c123329 100644
--- a/pkgs/applications/audio/mixxx/default.nix
+++ b/pkgs/applications/audio/mixxx/default.nix
@@ -45,7 +45,7 @@ mkDerivation rec {
   ];
 
   qtWrapperArgs = [
-    "--set LOCALE_ARCHIVE ${glibcLocales}/lib/locale/locale-archive"
+    "--set" "LOCALE_ARCHIVE" "${glibcLocales}/lib/locale/locale-archive"
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/audio/mp3blaster/default.nix b/pkgs/applications/audio/mp3blaster/default.nix
index d7dd5f102dbd8..b6580a9c3710d 100644
--- a/pkgs/applications/audio/mp3blaster/default.nix
+++ b/pkgs/applications/audio/mp3blaster/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     libvorbis
   ] ++ lib.optional stdenv.isDarwin SDL;
 
-  NIX_CFLAGS_COMPILE = toString ([
+  env.NIX_CFLAGS_COMPILE = toString ([
     "-Wno-narrowing"
   ] ++ lib.optionals stdenv.cc.isClang [
     "-Wno-reserved-user-defined-literal"
diff --git a/pkgs/applications/audio/musescore/default.nix b/pkgs/applications/audio/musescore/default.nix
index b43b770b24f9e..14d6b870cafa4 100644
--- a/pkgs/applications/audio/musescore/default.nix
+++ b/pkgs/applications/audio/musescore/default.nix
@@ -29,7 +29,7 @@ mkDerivation rec {
   qtWrapperArgs = [
     # Work around crash on update from 3.4.2 to 3.5.0
     # https://bugreports.qt.io/browse/QTBUG-85967
-    "--set QML_DISABLE_DISK_CACHE 1"
+    "--set" "QML_DISABLE_DISK_CACHE" "1"
   ];
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/applications/audio/oxefmsynth/default.nix b/pkgs/applications/audio/oxefmsynth/default.nix
index 427029f3c863f..8f231b33395f1 100644
--- a/pkgs/applications/audio/oxefmsynth/default.nix
+++ b/pkgs/applications/audio/oxefmsynth/default.nix
@@ -22,7 +22,7 @@ in stdenv.mkDerivation rec {
     sha256 = "1rk71ls33a38wx8i22plsi7d89cqqxrfxknq5i4f9igsw1ipm4gn";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=narrowing" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=narrowing";
 
   buildFlags = [ "VSTSDK_PATH=${vst-sdk}/VST2_SDK" ];
 
diff --git a/pkgs/applications/audio/pianobar/default.nix b/pkgs/applications/audio/pianobar/default.nix
index c5ef0352503fc..4d898026f677b 100644
--- a/pkgs/applications/audio/pianobar/default.nix
+++ b/pkgs/applications/audio/pianobar/default.nix
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  CC = "gcc";
-  CFLAGS = "-std=c99";
+  env.CC = "gcc";
+  env.CFLAGS = "-std=c99";
 
   meta = with lib; {
     description = "A console front-end for Pandora.com";
diff --git a/pkgs/applications/audio/picoloop/default.nix b/pkgs/applications/audio/picoloop/default.nix
index 519888982ce4f..502294923ec85 100644
--- a/pkgs/applications/audio/picoloop/default.nix
+++ b/pkgs/applications/audio/picoloop/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "-f Makefile.PatternPlayer_debian_RtAudio_sdl20" ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${SDL2.dev}/include/SDL2" ];
+  env.NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2";
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/applications/audio/pragha/default.nix b/pkgs/applications/audio/pragha/default.nix
index da5a64f708eb0..15fd96041d963 100644
--- a/pkgs/applications/audio/pragha/default.nix
+++ b/pkgs/applications/audio/pragha/default.nix
@@ -81,9 +81,9 @@ mkDerivation rec {
   # ++ lib.optional withRygel rygel
   ;
 
-  CFLAGS = [ "-DHAVE_PARANOIA_NEW_INCLUDES" ];
+  env.CFLAGS = "-DHAVE_PARANOIA_NEW_INCLUDES";
 
-  NIX_CFLAGS_COMPILE = "-I${lib.getDev gst_all_1.gst-plugins-base}/include/gstreamer-1.0";
+  env.NIX_CFLAGS_COMPILE = "-I${lib.getDev gst_all_1.gst-plugins-base}/include/gstreamer-1.0";
 
   postInstall = ''
     qtWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
diff --git a/pkgs/applications/audio/sayonara/default.nix b/pkgs/applications/audio/sayonara/default.nix
index 651ac20db220b..9655d47b1a36f 100644
--- a/pkgs/applications/audio/sayonara/default.nix
+++ b/pkgs/applications/audio/sayonara/default.nix
@@ -56,7 +56,7 @@ mkDerivation rec {
   ];
 
   # gstreamer cannot otherwise be found
-  NIX_CFLAGS_COMPILE = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
+  env.NIX_CFLAGS_COMPILE = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
 
   postInstall = ''
     qtWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
diff --git a/pkgs/applications/audio/soundscape-renderer/default.nix b/pkgs/applications/audio/soundscape-renderer/default.nix
index fa9860ab248c1..3ce91c1dd07f5 100644
--- a/pkgs/applications/audio/soundscape-renderer/default.nix
+++ b/pkgs/applications/audio/soundscape-renderer/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
   # Without it doesn't find all of the boost libraries.
   BOOST_LIB_DIR="${boost}/lib";
   # uses the deprecated get_generic_category() in boost_system
-  NIX_CFLAGS_COMPILE="-DBOOST_SYSTEM_ENABLE_DEPRECATED=1";
+  env.NIX_CFLAGS_COMPILE="-DBOOST_SYSTEM_ENABLE_DEPRECATED=1";
 
   LC_ALL = "en_US.UTF-8";
 
diff --git a/pkgs/applications/audio/squishyball/default.nix b/pkgs/applications/audio/squishyball/default.nix
index b44efc1534f8a..9bb3313dcf6b5 100644
--- a/pkgs/applications/audio/squishyball/default.nix
+++ b/pkgs/applications/audio/squishyball/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ flac libao libvorbis ncurses opusfile ];
 
-  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS";
+  env.NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS";
 
   patches = [ ./gnu-screen.patch ];
 
diff --git a/pkgs/applications/audio/timemachine/default.nix b/pkgs/applications/audio/timemachine/default.nix
index 623714e706fb3..967e7d45d5afa 100644
--- a/pkgs/applications/audio/timemachine/default.nix
+++ b/pkgs/applications/audio/timemachine/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   preConfigure = "./autogen.sh";
 
-  NIX_LDFLAGS = "-lm";
+  env.NIX_LDFLAGS = "-lm";
 
   meta = {
     description = "JACK audio recorder";
diff --git a/pkgs/applications/blockchains/dashpay.nix b/pkgs/applications/blockchains/dashpay.nix
index ca1dd13e42519..4f8a737a5f837 100644
--- a/pkgs/applications/blockchains/dashpay.nix
+++ b/pkgs/applications/blockchains/dashpay.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
                   miniupnpc protobuf qrencode util-linux ];
 
 
-  configureFlags = [ "--with-boost-libdir=${boost.out}/lib --with-gui=no" ]
+  configureFlags = [ "--with-boost-libdir=${boost.out}/lib" "--with-gui=no" ]
                     ++ optional enable_Upnp "--enable-upnp-default"
                     ++ optional disable_Wallet "--disable-wallet"
                     ++ optional disable_Daemon "--disable-daemon"
diff --git a/pkgs/applications/blockchains/electrs.nix b/pkgs/applications/blockchains/electrs.nix
index af0346196a321..5c60054f25084 100644
--- a/pkgs/applications/blockchains/electrs.nix
+++ b/pkgs/applications/blockchains/electrs.nix
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
 
   # needed for librocksdb-sys
   nativeBuildInputs = [ llvmPackages.clang ];
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+  env.LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
 
   cargoSha256 = "1rqpadlr9r4z2z825li6vi5a21hivc3bsn5ibxshrdrwiycyyxz8";
 
diff --git a/pkgs/applications/blockchains/openethereum/default.nix b/pkgs/applications/blockchains/openethereum/default.nix
index b4b5d13f14074..28c23a608e2e5 100644
--- a/pkgs/applications/blockchains/openethereum/default.nix
+++ b/pkgs/applications/blockchains/openethereum/default.nix
@@ -38,7 +38,7 @@ rustPlatform.buildRustPackage.override { stdenv = stdenv; } rec {
 
   # Exclude some tests that don't work in the sandbox
   # - Nat test requires network access
-  checkFlags = "--skip configuration::tests::should_resolve_external_nat_hosts";
+  checkFlags = [ "--skip configuration::tests::should_resolve_external_nat_hosts" ];
 
   meta = with lib; {
     description = "Fast, light, robust Ethereum implementation";
diff --git a/pkgs/applications/display-managers/lightdm/gtk-greeter.nix b/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
index b012699a16bac..88bd79a6c9c44 100644
--- a/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
+++ b/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     configureFlagsArray+=( --enable-at-spi-command="${at-spi2-core}/libexec/at-spi-bus-launcher --launch-immediately" )
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   installFlags = [
     "localstatedir=\${TMPDIR}"
diff --git a/pkgs/applications/editors/cudatext/default.nix b/pkgs/applications/editors/cudatext/default.nix
index cdf327441482f..e5abeec480e93 100644
--- a/pkgs/applications/editors/cudatext/default.nix
+++ b/pkgs/applications/editors/cudatext/default.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional (widgetset == "gtk3") gtk3
     ++ lib.optional (widgetset == "qt5") libqt5pas;
 
-  NIX_LDFLAGS = "--as-needed -rpath ${lib.makeLibraryPath buildInputs}";
+  env.NIX_LDFLAGS = "--as-needed -rpath ${lib.makeLibraryPath buildInputs}";
 
   buildPhase = lib.concatStringsSep "\n" (lib.mapAttrsToList (name: dep: ''
     cp -r --no-preserve=mode ${dep} ${name}
diff --git a/pkgs/applications/editors/deadpixi-sam/default.nix b/pkgs/applications/editors/deadpixi-sam/default.nix
index 463865d26bf79..b6121b2c9dd05 100644
--- a/pkgs/applications/editors/deadpixi-sam/default.nix
+++ b/pkgs/applications/editors/deadpixi-sam/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
       --replace "CC=gcc" ""
   '';
 
-  CFLAGS = "-D_DARWIN_C_SOURCE";
+  env.CFLAGS = "-D_DARWIN_C_SOURCE";
   makeFlags = [ "DESTDIR=$(out)" ];
   buildInputs = [ libX11 libXi libXt libXft ];
 
diff --git a/pkgs/applications/editors/edbrowse/default.nix b/pkgs/applications/editors/edbrowse/default.nix
index 86cc81a58c268..28a125a410678 100644
--- a/pkgs/applications/editors/edbrowse/default.nix
+++ b/pkgs/applications/editors/edbrowse/default.nix
@@ -4,6 +4,13 @@ stdenv.mkDerivation rec {
   pname = "edbrowse";
   version = "3.7.7";
 
+  src = fetchFromGitHub {
+    owner = "CMB";
+    repo = "edbrowse";
+    rev = "v${version}";
+    sha256 = "0cw9d60mdhwna57r1vxn53s8gl81rr3cxnvm769ifq3xyh49vfcf";
+  };
+
   buildInputs = [ curl pcre readline openssl duktape perl html-tidy ];
 
   postPatch = ''
@@ -14,16 +21,10 @@ stdenv.mkDerivation rec {
   '';
 
   makeFlags = [
-    "-C" "src"
+    "-C src"
     "prefix=${placeholder "out"}"
   ];
 
-  src = fetchFromGitHub {
-    owner = "CMB";
-    repo = "edbrowse";
-    rev = "v${version}";
-    sha256 = "0cw9d60mdhwna57r1vxn53s8gl81rr3cxnvm769ifq3xyh49vfcf";
-  };
   meta = with lib; {
     description = "Command Line Editor Browser";
     longDescription = ''
diff --git a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
index 9e7662fe4902b..25521d502d408 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@@ -168,7 +168,7 @@ let
 
         irony = super.irony.overrideAttrs (old: {
           cmakeFlags = old.cmakeFlags or [ ] ++ [ "-DCMAKE_INSTALL_BINDIR=bin" ];
-          NIX_CFLAGS_COMPILE = "-UCLANG_RESOURCE_DIR";
+          env.NIX_CFLAGS_COMPILE = "-UCLANG_RESOURCE_DIR";
           preConfigure = ''
             cd server
           '';
diff --git a/pkgs/applications/editors/gnome-latex/default.nix b/pkgs/applications/editors/gnome-latex/default.nix
index 8fc6feecd57c9..6c4535387c865 100644
--- a/pkgs/applications/editors/gnome-latex/default.nix
+++ b/pkgs/applications/editors/gnome-latex/default.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   passthru.updateScript = gnome.updateScript {
     packageName = pname;
diff --git a/pkgs/applications/editors/hexcurse/default.nix b/pkgs/applications/editors/hexcurse/default.nix
index a1b90b83d589b..fc66445694a56 100644
--- a/pkgs/applications/editors/hexcurse/default.nix
+++ b/pkgs/applications/editors/hexcurse/default.nix
@@ -10,8 +10,11 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     sha256 = "17ckkxfzbqvvfdnh10if4aqdcq98q3vl6dn1v6f4lhr4ifnyjdlk";
   };
+
   buildInputs = [ ncurses ];
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=stringop-overflow" "-Wno-error=stringop-truncation" ];
+
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=stringop-overflow -Wno-error=stringop-truncation";
+
   patches = [
     # gcc7 compat
     (fetchpatch {
diff --git a/pkgs/applications/editors/ht/default.nix b/pkgs/applications/editors/ht/default.nix
index 2f1ea40359d50..79bcf5179cb85 100644
--- a/pkgs/applications/editors/ht/default.nix
+++ b/pkgs/applications/editors/ht/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./gcc7.patch ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-narrowing" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
 
   meta = with lib; {
     description = "File editor/viewer/analyzer for executables";
diff --git a/pkgs/applications/editors/jupyter/default.nix b/pkgs/applications/editors/jupyter/default.nix
index 2bca120c1debc..21db74d97ee4d 100644
--- a/pkgs/applications/editors/jupyter/default.nix
+++ b/pkgs/applications/editors/jupyter/default.nix
@@ -13,6 +13,6 @@ in
 
 with python3.pkgs; toPythonModule (
   notebook.overridePythonAttrs(oldAttrs: {
-    makeWrapperArgs = ["--set JUPYTER_PATH ${jupyterPath}"];
+    makeWrapperArgs = [ "--set" "JUPYTER_PATH" jupyterPath ];
   })
 )
diff --git a/pkgs/applications/editors/nedit/default.nix b/pkgs/applications/editors/nedit/default.nix
index 5a523c05d7959..8a4e9b6cdcfcd 100644
--- a/pkgs/applications/editors/nedit/default.nix
+++ b/pkgs/applications/editors/nedit/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   # the linux config works fine on darwin too!
   buildFlags = lib.optional (stdenv.isLinux || stdenv.isDarwin) "linux";
 
-  NIX_CFLAGS_COMPILE="-DBUILD_UNTESTED_NEDIT -L${motif}/lib";
+  env.NIX_CFLAGS_COMPILE="-DBUILD_UNTESTED_NEDIT -L${motif}/lib";
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/editors/texmacs/darwin.nix b/pkgs/applications/editors/texmacs/darwin.nix
index ff090dd3259a5..c62dd36350cda 100644
--- a/pkgs/applications/editors/texmacs/darwin.nix
+++ b/pkgs/applications/editors/texmacs/darwin.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
 
   GUILE_CPPFLAGS="-D_THREAD_SAFE -I${guile_1_8.dev}/include -I${guile_1_8.dev}/include/guile ";
 
-  NIX_LDFLAGS="${zlib}/lib/libz.dylib";
+  env.NIX_LDFLAGS="${zlib}/lib/libz.dylib";
 
   buildPhase = ''
     substituteInPlace Makefile \
diff --git a/pkgs/applications/editors/texmacs/default.nix b/pkgs/applications/editors/texmacs/default.nix
index d628eeadab6e8..b44d0d3412a8e 100644
--- a/pkgs/applications/editors/texmacs/default.nix
+++ b/pkgs/applications/editors/texmacs/default.nix
@@ -40,7 +40,7 @@ mkDerivation {
     git
     python3
   ];
-  NIX_LDFLAGS = "-lz";
+  env.NIX_LDFLAGS = "-lz";
 
   qtWrapperArgs = [
     "--suffix" "PATH" ":" (lib.makeBinPath [
diff --git a/pkgs/applications/editors/texmaker/default.nix b/pkgs/applications/editors/texmaker/default.nix
index 75f22da251635..db789b8dbbca5 100644
--- a/pkgs/applications/editors/texmaker/default.nix
+++ b/pkgs/applications/editors/texmaker/default.nix
@@ -11,7 +11,7 @@ mkDerivation rec {
 
   buildInputs = [ qtbase qtscript poppler zlib ];
   nativeBuildInputs = [ pkg-config poppler qmake ];
-  NIX_CFLAGS_COMPILE="-I${poppler.dev}/include/poppler";
+  env.NIX_CFLAGS_COMPILE = "-I${poppler.dev}/include/poppler";
 
   qmakeFlags = [
     "DESKTOPDIR=${placeholder "out"}/share/applications"
diff --git a/pkgs/applications/gis/grass/default.nix b/pkgs/applications/gis/grass/default.nix
index ef7458d7394cd..5c9743ace1725 100644
--- a/pkgs/applications/gis/grass/default.nix
+++ b/pkgs/applications/gis/grass/default.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H=1";
+  env.NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H=1";
 
   postInstall = ''
     wrapProgram $out/bin/grass76 \
diff --git a/pkgs/applications/gis/saga/default.nix b/pkgs/applications/gis/saga/default.nix
index 47defd44c640a..20645091287fb 100644
--- a/pkgs/applications/gis/saga/default.nix
+++ b/pkgs/applications/gis/saga/default.nix
@@ -80,7 +80,7 @@ mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11 -Wno-narrowing";
+  env.CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11 -Wno-narrowing";
 
   meta = with lib; {
     description = "System for Automated Geoscientific Analyses";
diff --git a/pkgs/applications/graphics/ahoviewer/default.nix b/pkgs/applications/graphics/ahoviewer/default.nix
index 0459d1d04ac24..2197915be8335 100644
--- a/pkgs/applications/graphics/ahoviewer/default.nix
+++ b/pkgs/applications/graphics/ahoviewer/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     gst_all_1.gst-plugins-base
   ] ++ lib.optional useUnrar unrar;
 
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   postPatch = "patchShebangs version.sh";
 
diff --git a/pkgs/applications/graphics/apngasm/2.nix b/pkgs/applications/graphics/apngasm/2.nix
index 0313115ddfa8f..509a374d2743c 100644
--- a/pkgs/applications/graphics/apngasm/2.nix
+++ b/pkgs/applications/graphics/apngasm/2.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     rm -rf libpng zlib zopfli
   '';
 
-  NIX_CFLAGS_LINK = "-lzopfli";
+  env.NIX_CFLAGS_LINK = "-lzopfli";
 
   installPhase = ''
     install -Dt $out/bin apngasm
diff --git a/pkgs/applications/graphics/dosage/default.nix b/pkgs/applications/graphics/dosage/default.nix
index db0012a184bef..289b8cbcdf4f8 100644
--- a/pkgs/applications/graphics/dosage/default.nix
+++ b/pkgs/applications/graphics/dosage/default.nix
@@ -3,7 +3,7 @@
 python3Packages.buildPythonApplication rec {
   pname = "dosage";
   version = "2018.04.08";
-  PBR_VERSION = version;
+  env.PBR_VERSION = version;
 
   src = fetchFromGitHub {
     owner = "webcomics";
diff --git a/pkgs/applications/graphics/fluxus/default.nix b/pkgs/applications/graphics/fluxus/default.nix
index acec5293101fc..e9f1de47bbfcd 100644
--- a/pkgs/applications/graphics/fluxus/default.nix
+++ b/pkgs/applications/graphics/fluxus/default.nix
@@ -78,10 +78,9 @@ stdenv.mkDerivation rec {
     "RacketLib=${racket}/lib/racket"
     "LIBPATH=${lib.makeLibraryPath libs}"
     "DESTDIR=build"
+    "Prefix=${placeholder "out"}"
   ];
-  configurePhase = ''
-    sconsFlags+=" Prefix=$out"
-  '';
+
   installPhase = ''
     mkdir -p $out
     cp -r build$out/* $out/
diff --git a/pkgs/applications/graphics/freepv/default.nix b/pkgs/applications/graphics/freepv/default.nix
index bf990c4d0ef82..538bbd6bddae1 100644
--- a/pkgs/applications/graphics/freepv/default.nix
+++ b/pkgs/applications/graphics/freepv/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
       --replace png_set_gray_1_2_4_to_8 png_set_expand_gray_1_2_4_to_8
   '';
 
-  NIX_CFLAGS_COMPILE = "-fpermissive -Wno-narrowing";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive -Wno-narrowing";
 
   meta = {
     description = "Open source panorama viewer using GL";
diff --git a/pkgs/applications/graphics/gimp/plugins/default.nix b/pkgs/applications/graphics/gimp/plugins/default.nix
index 2b8dbbc4d28de..b9ca7ae2a9c08 100644
--- a/pkgs/applications/graphics/gimp/plugins/default.nix
+++ b/pkgs/applications/graphics/gimp/plugins/default.nix
@@ -70,7 +70,7 @@ in
       url = "https://ftp.gimp.org/pub/gimp/plug-ins/v2.6/gap/gimp-gap-2.6.0.tar.bz2";
       sha256 = "1jic7ixcmsn4kx2cn32nc5087rk6g8xsrz022xy11yfmgvhzb0ql";
     };
-    NIX_LDFLAGS = "-lm";
+    env.NIX_LDFLAGS = "-lm";
     hardeningDisable = [ "format" ];
     meta = with lib; {
       description = "The GIMP Animation Package";
@@ -179,7 +179,7 @@ in
       Filters/Enhance/Wavelet sharpen
     */
     name = "wavelet-sharpen-0.1.2";
-    NIX_LDFLAGS = "-lm";
+    env.NIX_LDFLAGS = "-lm";
     src = fetchurl {
       url = "https://github.com/pixlsus/registry.gimp.org_static/raw/master/registry.gimp.org/files/wavelet-sharpen-0.1.2.tar.gz";
       sha256 = "0vql1k67i21g5ivaa1jh56rg427m0icrkpryrhg75nscpirfxxqw";
diff --git a/pkgs/applications/graphics/gnuclad/default.nix b/pkgs/applications/graphics/gnuclad/default.nix
index a1b4accc8d595..20694c7913e98 100644
--- a/pkgs/applications/graphics/gnuclad/default.nix
+++ b/pkgs/applications/graphics/gnuclad/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ka2kscpjff7gflsargv3r9fdaxhkf3nym9mfaln3pnq6q7fwdki";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/graphics/goxel/default.nix b/pkgs/applications/graphics/goxel/default.nix
index 64ea533eefd25..206f7f6e0e3b9 100644
--- a/pkgs/applications/graphics/goxel/default.nix
+++ b/pkgs/applications/graphics/goxel/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ scons pkg-config wrapGAppsHook ];
   buildInputs = [ glfw3 gtk3 libpng12 ];
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   buildPhase = ''
     make release
diff --git a/pkgs/applications/graphics/gqview/default.nix b/pkgs/applications/graphics/gqview/default.nix
index 39f7a42b3b3ba..37f9741210fe7 100644
--- a/pkgs/applications/graphics/gqview/default.nix
+++ b/pkgs/applications/graphics/gqview/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "format" ];
 
-  NIX_LDFLAGS = "-lm";
+  env.NIX_LDFLAGS = "-lm";
 
   meta = with lib; {
     description = "A fast image viewer";
diff --git a/pkgs/applications/graphics/hugin/default.nix b/pkgs/applications/graphics/hugin/default.nix
index f7f1e17be22c9..35ae7240756d3 100644
--- a/pkgs/applications/graphics/hugin/default.nix
+++ b/pkgs/applications/graphics/hugin/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   # disable installation of the python scripting interface
   cmakeFlags = [ "-DBUILD_HSI:BOOl=OFF" ];
 
-  NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
+  env.NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
 
   postInstall = ''
     for p in $out/bin/*; do
diff --git a/pkgs/applications/graphics/imgcat/default.nix b/pkgs/applications/graphics/imgcat/default.nix
index cb2301d6339e1..16a4a8f172da7 100644
--- a/pkgs/applications/graphics/imgcat/default.nix
+++ b/pkgs/applications/graphics/imgcat/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     sha256 = "0frz40rjwi73nx2dlqvmnn56zwr29bmnngfb11hhwr7v58yfajdi";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   meta = with lib; {
     description = "It's like cat, but for images";
diff --git a/pkgs/applications/graphics/ipe/default.nix b/pkgs/applications/graphics/ipe/default.nix
index 72c79d7dc5019..3b598cd22dd69 100644
--- a/pkgs/applications/graphics/ipe/default.nix
+++ b/pkgs/applications/graphics/ipe/default.nix
@@ -42,11 +42,11 @@ mkDerivation rec {
     zlib
   ];
 
-  IPEPREFIX=placeholder "out";
-  URWFONTDIR="${texlive}/texmf-dist/fonts/type1/urw/";
-  LUA_PACKAGE = "lua";
+  env.IPEPREFIX = placeholder "out";
+  env.URWFONTDIR = "${texlive}/texmf-dist/fonts/type1/urw/";
+  env.LUA_PACKAGE = "lua";
 
-  qtWrapperArgs = [ "--prefix PATH : ${texlive}/bin"  ];
+  qtWrapperArgs = [ "--prefix" "PATH" ":" "${texlive}/bin"  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/graphics/k3d/default.nix b/pkgs/applications/graphics/k3d/default.nix
index 99e56738dbfa4..fdc91d2b814ae 100644
--- a/pkgs/applications/graphics/k3d/default.nix
+++ b/pkgs/applications/graphics/k3d/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
 
   #doCheck = false;
 
-  NIX_CFLAGS_COMPILE = "-Wno-deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-deprecated-declarations";
 
   meta = with lib; {
     description = "A 3D editor with support for procedural editing";
diff --git a/pkgs/applications/graphics/krita/default.nix b/pkgs/applications/graphics/krita/default.nix
index 0c5a0fe6e3dab..6c7124b29bf06 100644
--- a/pkgs/applications/graphics/krita/default.nix
+++ b/pkgs/applications/graphics/krita/default.nix
@@ -28,8 +28,8 @@ mkDerivation rec {
     python3Packages.pyqt5
   ] ++ lib.optional (stdenv.hostPlatform.isi686 || stdenv.hostPlatform.isx86_64) vc;
 
-  NIX_CFLAGS_COMPILE = [ "-I${ilmbase.dev}/include/OpenEXR" ]
-    ++ lib.optional stdenv.cc.isGNU "-Wno-deprecated-copy";
+  env.NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR"
+    + lib.optionalString stdenv.cc.isGNU " -Wno-deprecated-copy";
 
   cmakeFlags = [
     "-DPYQT5_SIP_DIR=${python3Packages.pyqt5}/share/sip/PyQt5"
diff --git a/pkgs/applications/graphics/lazpaint/default.nix b/pkgs/applications/graphics/lazpaint/default.nix
index 82eab9757c73f..6502319f8ef72 100644
--- a/pkgs/applications/graphics/lazpaint/default.nix
+++ b/pkgs/applications/graphics/lazpaint/default.nix
@@ -31,7 +31,7 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [ pango cairo glib atk gtk2 libX11 gdk-pixbuf ];
 
-  NIX_LDFLAGS = "--as-needed -rpath ${lib.makeLibraryPath buildInputs}";
+  env.NIX_LDFLAGS = "--as-needed -rpath ${lib.makeLibraryPath buildInputs}";
 
   buildPhase = ''
     cp -r --no-preserve=mode ${bgrabitmap} bgrabitmap
diff --git a/pkgs/applications/graphics/luminance-hdr/default.nix b/pkgs/applications/graphics/luminance-hdr/default.nix
index c44ff57d18f3c..e39cc7726cae8 100644
--- a/pkgs/applications/graphics/luminance-hdr/default.nix
+++ b/pkgs/applications/graphics/luminance-hdr/default.nix
@@ -15,7 +15,7 @@ mkDerivation rec {
     sha256 = "1izmgjjp8mgyxv57sjjr05z7g7059ykb5wchlcn4wrnnb6aslnvn";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
+  env.NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
 
   buildInputs = [
     qtbase qtdeclarative qttools qtwebengine eigen
diff --git a/pkgs/applications/graphics/photoflare/default.nix b/pkgs/applications/graphics/photoflare/default.nix
index cc4f4342c6188..339a12691496f 100644
--- a/pkgs/applications/graphics/photoflare/default.nix
+++ b/pkgs/applications/graphics/photoflare/default.nix
@@ -17,7 +17,7 @@ mkDerivation rec {
 
   qmakeFlags = [ "PREFIX=${placeholder "out"}" ];
 
-  NIX_CFLAGS_COMPILE = "-I${graphicsmagick}/include/GraphicsMagick";
+  env.NIX_CFLAGS_COMPILE = "-I${graphicsmagick}/include/GraphicsMagick";
 
   meta = with lib; {
     description = "A cross-platform image editor with a powerful features and a very friendly graphical user interface";
diff --git a/pkgs/applications/graphics/tesseract/tesseract3.nix b/pkgs/applications/graphics/tesseract/tesseract3.nix
index 7b9669bc465e4..82546afa193c5 100644
--- a/pkgs/applications/graphics/tesseract/tesseract3.nix
+++ b/pkgs/applications/graphics/tesseract/tesseract3.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config autoreconfHook ];
   buildInputs = [ leptonica libpng libtiff icu pango opencl-headers ];
 
-  LIBLEPT_HEADERSDIR = "${leptonica}/include";
+  env.LIBLEPT_HEADERSDIR = "${leptonica}/include";
 
   meta = {
     description = "OCR engine";
diff --git a/pkgs/applications/graphics/xournal/default.nix b/pkgs/applications/graphics/xournal/default.nix
index 7d9ab53bef8b8..f1f4a38fa0b84 100644
--- a/pkgs/applications/graphics/xournal/default.nix
+++ b/pkgs/applications/graphics/xournal/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoconf automake libtool pkg-config ];
 
-  NIX_LDFLAGS = "-lz"
+  env.NIX_LDFLAGS = "-lz"
     + lib.optionalString (!isGdkQuartzBackend) " -lX11";
 
   desktopItem = makeDesktopItem {
diff --git a/pkgs/applications/graphics/xournalpp/default.nix b/pkgs/applications/graphics/xournalpp/default.nix
index 1810a6c6b8ebe..5911d354de616 100644
--- a/pkgs/applications/graphics/xournalpp/default.nix
+++ b/pkgs/applications/graphics/xournalpp/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optional withLua lua;
 
-  buildFlags = "translations";
+  buildFlags = [ "translations" ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/applications/kde/akonadi/default.nix b/pkgs/applications/kde/akonadi/default.nix
index fd662d7e99264..04056dee5ebdb 100644
--- a/pkgs/applications/kde/akonadi/default.nix
+++ b/pkgs/applications/kde/akonadi/default.nix
@@ -25,7 +25,7 @@ mkDerivation {
   ];
   propagatedBuildInputs = [ boost kitemmodels ];
   outputs = [ "out" "dev" ];
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     ''-DNIXPKGS_MYSQL_MYSQLD=\"${lib.getBin mariadb}/bin/mysqld\"''
     ''-DNIXPKGS_MYSQL_MYSQLADMIN=\"${lib.getBin mariadb}/bin/mysqladmin\"''
     ''-DNIXPKGS_MYSQL_MYSQL_INSTALL_DB=\"${lib.getBin mariadb}/bin/mysql_install_db\"''
diff --git a/pkgs/applications/kde/kdenlive/default.nix b/pkgs/applications/kde/kdenlive/default.nix
index 47afcd0a67e39..a2f13505f22b5 100644
--- a/pkgs/applications/kde/kdenlive/default.nix
+++ b/pkgs/applications/kde/kdenlive/default.nix
@@ -91,7 +91,7 @@ mkDerivation {
   # https://github.com/NixOS/nixpkgs/issues/83885
   # https://github.com/NixOS/nixpkgs/issues/29614#issuecomment-488849325
   qtWrapperArgs = [
-    "--set FREI0R_PATH ${frei0r}/lib/frei0r-1"
+    "--set" "FREI0R_PATH" "${frei0r}/lib/frei0r-1"
   ];
 
   preFixup = ''
diff --git a/pkgs/applications/kde/kio-extras.nix b/pkgs/applications/kde/kio-extras.nix
index fdc531d5d12d1..6590d8ac08403 100644
--- a/pkgs/applications/kde/kio-extras.nix
+++ b/pkgs/applications/kde/kio-extras.nix
@@ -19,5 +19,5 @@ mkDerivation {
     kdelibs4support kpty syntax-highlighting libmtp libssh openexr openslp
     phonon qtsvg samba solid gperf
   ];
-  CXXFLAGS = [ "-I${ilmbase.dev}/include/OpenEXR" ];
+  env.CXXFLAGS = "-I${ilmbase.dev}/include/OpenEXR";
 }
diff --git a/pkgs/applications/kde/print-manager.nix b/pkgs/applications/kde/print-manager.nix
index 2ea662419b17c..5fa200978353c 100644
--- a/pkgs/applications/kde/print-manager.nix
+++ b/pkgs/applications/kde/print-manager.nix
@@ -22,5 +22,5 @@ mkDerivation {
   outputs = [ "out" "dev" ];
   # Fix build with cups deprecations etc.
   # See: https://github.com/NixOS/nixpkgs/issues/73334
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations -Wno-error=format-security";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations -Wno-error=format-security";
 }
diff --git a/pkgs/applications/misc/apvlv/default.nix b/pkgs/applications/misc/apvlv/default.nix
index 140d6eb7d086d..94600fbc744f2 100644
--- a/pkgs/applications/misc/apvlv/default.nix
+++ b/pkgs/applications/misc/apvlv/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "1n4xiic8lqnv3mqi7wpdv866gyyakax71gffv3n9427rmcld465i";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${poppler.dev}/include/poppler";
+  env.NIX_CFLAGS_COMPILE = "-I${poppler.dev}/include/poppler";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/applications/misc/barrier/default.nix b/pkgs/applications/misc/barrier/default.nix
index b9dbcf529be12..7bcf6abc74dc7 100644
--- a/pkgs/applications/misc/barrier/default.nix
+++ b/pkgs/applications/misc/barrier/default.nix
@@ -23,7 +23,7 @@ mkDerivation rec {
   '';
 
   qtWrapperArgs = [
-    ''--prefix PATH : ${lib.makeBinPath [ openssl ]}''
+    "--prefix" "PATH" ":" (lib.makeBinPath [ openssl ])
   ];
 
   meta = {
diff --git a/pkgs/applications/misc/birdtray/default.nix b/pkgs/applications/misc/birdtray/default.nix
index f007fb71377be..95a0bce17f3a0 100644
--- a/pkgs/applications/misc/birdtray/default.nix
+++ b/pkgs/applications/misc/birdtray/default.nix
@@ -38,7 +38,7 @@ mkDerivation rec {
 
   # Wayland support is broken.
   # https://github.com/gyunaev/birdtray/issues/113#issuecomment-621742315
-  qtWrapperArgs = [ "--set QT_QPA_PLATFORM xcb" ];
+  qtWrapperArgs = [ "--set" "QT_QPA_PLATFORM" "xcb" ];
 
   meta = with lib; {
     description = "Mail system tray notification icon for Thunderbird";
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 8d345cdefe0e9..261abe7e375d2 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -132,11 +132,11 @@ stdenv.mkDerivation rec {
       "-DOPTIX_ROOT_DIR=${optix}"
     ];
 
-  NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR -I${python}/include/${python.libPrefix}";
+  env.NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR -I${python}/include/${python.libPrefix}";
 
   # Since some dependencies are built with gcc 6, we need gcc 6's
   # libstdc++ in our RPATH. Sigh.
-  NIX_LDFLAGS = optionalString cudaSupport "-rpath ${stdenv.cc.cc.lib}/lib";
+  env.NIX_LDFLAGS = optionalString cudaSupport "-rpath ${stdenv.cc.cc.lib}/lib";
 
   blenderExecutable =
     placeholder "out" + (if stdenv.isDarwin then "/Blender.app/Contents/MacOS/Blender" else "/bin/blender");
diff --git a/pkgs/applications/misc/clipcat/default.nix b/pkgs/applications/misc/clipcat/default.nix
index 95f50998f3ffa..98d488245ef99 100644
--- a/pkgs/applications/misc/clipcat/default.nix
+++ b/pkgs/applications/misc/clipcat/default.nix
@@ -14,11 +14,11 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1ffgvhkdj8wkhlgi0cj0njdm9ycxq2qda4b5qn8bmaygzr2zkwpd";
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+  env.LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
 
   # needed for internal protobuf c wrapper library
-  PROTOC = "${protobuf}/bin/protoc";
-  PROTOC_INCLUDE = "${protobuf}/include";
+  env.PROTOC = "${protobuf}/bin/protoc";
+  env.PROTOC_INCLUDE = "${protobuf}/include";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/applications/misc/cura/default.nix b/pkgs/applications/misc/cura/default.nix
index a33cb7b2ce6c9..e1d6d934c9ab7 100644
--- a/pkgs/applications/misc/cura/default.nix
+++ b/pkgs/applications/misc/cura/default.nix
@@ -33,7 +33,7 @@ mkDerivation rec {
 
   makeWrapperArgs = [
     # hacky workaround for https://github.com/NixOS/nixpkgs/issues/59901
-    "--set OMP_NUM_THREADS 1"
+    "--set" "OMP_NUM_THREADS" "1"
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/misc/digitalbitbox/default.nix b/pkgs/applications/misc/digitalbitbox/default.nix
index 4771cebc3411d..9245dcfc27abc 100644
--- a/pkgs/applications/misc/digitalbitbox/default.nix
+++ b/pkgs/applications/misc/digitalbitbox/default.nix
@@ -79,22 +79,18 @@ in mkDerivation rec {
     qtmultimedia
   ];
 
-  LUPDATE="${qttools.dev}/bin/lupdate";
-  LRELEASE="${qttools.dev}/bin/lrelease";
-  MOC="${qtbase.dev}/bin/moc";
-  QTDIR=qtbase.dev;
-  RCC="${qtbase.dev}/bin/rcc";
-  UIC="${qtbase.dev}/bin/uic";
-
-  configureFlags = [
-    "--enable-libusb"
-  ];
+  env.LUPDATE = "${qttools.dev}/bin/lupdate";
+  env.LRELEASE = "${qttools.dev}/bin/lrelease";
+  env.MOC = "${qtbase.dev}/bin/moc";
+  env.QTDIR = toString qtbase.dev;
+  env.RCC = "${qtbase.dev}/bin/rcc";
+  env.UIC = "${qtbase.dev}/bin/uic";
 
-  hardeningDisable = [
-    "format"
-  ];
+  configureFlags = [ "--enable-libusb" ];
+
+  hardeningDisable = [ "format" ];
 
-  qtWrapperArgs = [ "--prefix LD_LIBRARY_PATH : $out/lib" ];
+  qtWrapperArgs = [ "--prefix" "LD_LIBRARY_PATH" ":" "$out/lib" ];
 
   postInstall = ''
     mkdir -p "$out/lib"
diff --git a/pkgs/applications/misc/dunst/default.nix b/pkgs/applications/misc/dunst/default.nix
index 5dffbf56a36ae..4eba2f6a3a799 100644
--- a/pkgs/applications/misc/dunst/default.nix
+++ b/pkgs/applications/misc/dunst/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [
     "PREFIX=$(out)"
-    "VERSION=$(version)"
+    "VERSION=${version}"
     "SYSCONFDIR=$(out)/etc"
     "SERVICEDIR_DBUS=$(out)/share/dbus-1/services"
     "SERVICEDIR_SYSTEMD=$(out)/lib/systemd/user"
diff --git a/pkgs/applications/misc/fbreader/default.nix b/pkgs/applications/misc/fbreader/default.nix
index c2347d5fbb8bc..2c334a9ed0aa9 100644
--- a/pkgs/applications/misc/fbreader/default.nix
+++ b/pkgs/applications/misc/fbreader/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation {
 
   makeFlags = [ "INSTALLDIR=$(out)" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=narrowing";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=narrowing";
 
   meta = with lib; {
     description = "An e-book reader for Linux";
diff --git a/pkgs/applications/misc/getxbook/default.nix b/pkgs/applications/misc/getxbook/default.nix
index 15b7c37244fd1..dcfc7f9fff7a7 100644
--- a/pkgs/applications/misc/getxbook/default.nix
+++ b/pkgs/applications/misc/getxbook/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ihwrx4gspj8l7fc8vxch6dpjrw1lvv9z3c19f0wxnmnxhv1cjvs";
   };
 
-  NIX_CFLAGS_COMPILE = builtins.toString (
+  env.NIX_CFLAGS_COMPILE = builtins.toString (
     [ "-Wno-error=deprecated-declarations" ]
       ++ lib.optionals (!stdenv.cc.isClang) [
         "-Wno-error=format-truncation"
diff --git a/pkgs/applications/misc/gnome-recipes/default.nix b/pkgs/applications/misc/gnome-recipes/default.nix
index b35319c386305..6e35d0b48fd57 100644
--- a/pkgs/applications/misc/gnome-recipes/default.nix
+++ b/pkgs/applications/misc/gnome-recipes/default.nix
@@ -55,7 +55,7 @@ in stdenv.mkDerivation rec {
 
   # https://github.com/NixOS/nixpkgs/issues/36468
   # https://gitlab.gnome.org/GNOME/recipes/issues/76
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   postPatch = ''
     chmod +x src/list_to_c.py
diff --git a/pkgs/applications/misc/golden-cheetah/default.nix b/pkgs/applications/misc/golden-cheetah/default.nix
index c3b9a3226a3ca..300b9c86e655a 100644
--- a/pkgs/applications/misc/golden-cheetah/default.nix
+++ b/pkgs/applications/misc/golden-cheetah/default.nix
@@ -40,9 +40,9 @@ in mkDerivation rec {
     })
   ];
 
-  NIX_LDFLAGS = "-lz";
+  env.NIX_LDFLAGS = "-lz";
 
-  qtWrapperArgs = [ "--set LD_LIBRARY_PATH ${zlib.out}/lib" ];
+  qtWrapperArgs = [ "--set" "LD_LIBRARY_PATH" "${zlib.out}/lib" ];
 
   preConfigure = ''
     cp src/gcconfig.pri.in src/gcconfig.pri
diff --git a/pkgs/applications/misc/grip/default.nix b/pkgs/applications/misc/grip/default.nix
index 5ebe7765e50c4..678aa1152a021 100644
--- a/pkgs/applications/misc/grip/default.nix
+++ b/pkgs/applications/misc/grip/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "format" ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   meta = {
     description = "GTK-based audio CD player/ripper";
diff --git a/pkgs/applications/misc/gxneur/default.nix b/pkgs/applications/misc/gxneur/default.nix
index 9e8c5ddaef4ac..cee3dd6dbb33e 100644
--- a/pkgs/applications/misc/gxneur/default.nix
+++ b/pkgs/applications/misc/gxneur/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
   };
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   nativeBuildInputs = [ pkg-config intltool ];
   buildInputs = [
diff --git a/pkgs/applications/misc/imag/default.nix b/pkgs/applications/misc/imag/default.nix
index 5c1e87612e1bf..f3e162bb320e2 100644
--- a/pkgs/applications/misc/imag/default.nix
+++ b/pkgs/applications/misc/imag/default.nix
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
     ++ lib.optional stdenv.isDarwin Security;
   checkInputs = [ gitMinimal util-linuxMinimal ];
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+  env.LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
 
   cargoSha256 = "0n8cw70qh8g4hfwfaxwwxbrrx5hm2z037z8kdhvdpqkxljl9189x";
 
diff --git a/pkgs/applications/misc/k2pdfopt/default.nix b/pkgs/applications/misc/k2pdfopt/default.nix
index 6b594f196c942..7a868f2f5d408 100644
--- a/pkgs/applications/misc/k2pdfopt/default.nix
+++ b/pkgs/applications/misc/k2pdfopt/default.nix
@@ -151,7 +151,7 @@ in stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DCMAKE_C_FLAGS=-I${src}/include_mod" ];
 
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   installPhase = ''
     install -D -m 755 k2pdfopt $out/bin/k2pdfopt
diff --git a/pkgs/applications/misc/keepassx/community.nix b/pkgs/applications/misc/keepassx/community.nix
index fe09345349e59..23a478ef3c549 100644
--- a/pkgs/applications/misc/keepassx/community.nix
+++ b/pkgs/applications/misc/keepassx/community.nix
@@ -52,13 +52,13 @@ stdenv.mkDerivation rec {
     sha256 = "02ajfkw818cmalvkl0kqvza85rgdgs59kw2v7b3c4v8kv00c41j3";
   };
 
-  NIX_CFLAGS_COMPILE = optionalString stdenv.cc.isClang [
+  env.NIX_CFLAGS_COMPILE = optionalString stdenv.cc.isClang (toString [
     "-Wno-old-style-cast"
     "-Wno-error"
     "-D__BIG_ENDIAN__=${if stdenv.isBigEndian then "1" else "0"}"
-  ];
+  ]);
 
-  NIX_LDFLAGS = optionalString stdenv.isDarwin "-rpath ${libargon2}/lib";
+  env.NIX_LDFLAGS = optionalString stdenv.isDarwin "-rpath ${libargon2}/lib";
 
   patches = [
     ./darwin.patch
diff --git a/pkgs/applications/misc/klayout/default.nix b/pkgs/applications/misc/klayout/default.nix
index d1326848d2d69..bab22635b232d 100644
--- a/pkgs/applications/misc/klayout/default.nix
+++ b/pkgs/applications/misc/klayout/default.nix
@@ -44,7 +44,7 @@ mkDerivation rec {
     mv $out/lib/klayout $out/bin/
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-parentheses" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-parentheses";
 
   dontInstall = true; # Installation already happens as part of "build.sh"
 
diff --git a/pkgs/applications/misc/krename/default.nix b/pkgs/applications/misc/krename/default.nix
index c1e031b7277de..cd56ae829442d 100644
--- a/pkgs/applications/misc/krename/default.nix
+++ b/pkgs/applications/misc/krename/default.nix
@@ -23,7 +23,7 @@ in mkDerivation rec {
 
   propagatedBuildInputs = [ kconfig kcrash kinit kjsembed ];
 
-  NIX_LDFLAGS = "-ltag";
+  env.NIX_LDFLAGS = "-ltag";
 
   meta = with lib; {
     description = "A powerful batch renamer for KDE";
diff --git a/pkgs/applications/misc/lsd2dsl/default.nix b/pkgs/applications/misc/lsd2dsl/default.nix
index b30d652584f52..17a25c60d1d23 100644
--- a/pkgs/applications/misc/lsd2dsl/default.nix
+++ b/pkgs/applications/misc/lsd2dsl/default.nix
@@ -16,7 +16,7 @@ mkDerivation rec {
 
   buildInputs = [ boost libvorbis libsndfile minizip gtest qtwebkit ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=missing-braces";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=missing-braces";
 
   installPhase = ''
     install -Dm755 console/lsd2dsl gui/lsd2dsl-qtgui -t $out/bin
diff --git a/pkgs/applications/misc/lutris/default.nix b/pkgs/applications/misc/lutris/default.nix
index d294271ca25cc..2739323aec172 100644
--- a/pkgs/applications/misc/lutris/default.nix
+++ b/pkgs/applications/misc/lutris/default.nix
@@ -111,7 +111,7 @@ in buildPythonApplication rec {
   # avoid double wrapping
   dontWrapGApps = true;
   makeWrapperArgs = [
-    "--prefix PATH : ${binPath}"
+    "--prefix" "PATH" ":" binPath
     "\${gappsWrapperArgs[@]}"
   ];
   # needed for glib-schemas to work correctly (will crash on dialogues otherwise)
diff --git a/pkgs/applications/misc/mysql-workbench/default.nix b/pkgs/applications/misc/mysql-workbench/default.nix
index 63dde76fabcc9..c4e268e9268bb 100644
--- a/pkgs/applications/misc/mysql-workbench/default.nix
+++ b/pkgs/applications/misc/mysql-workbench/default.nix
@@ -136,7 +136,7 @@ in stdenv.mkDerivation rec {
   '';
 
   # error: 'OGRErr OGRSpatialReference::importFromWkt(char**)' is deprecated
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   cmakeFlags = [
     "-DMySQL_CONFIG_PATH=${mysql}/bin/mysql_config"
diff --git a/pkgs/applications/misc/navit/default.nix b/pkgs/applications/misc/navit/default.nix
index c041c2969274e..e501a5e7a4e13 100644
--- a/pkgs/applications/misc/navit/default.nix
+++ b/pkgs/applications/misc/navit/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./CMakeLists.txt.patch ];
 
-  NIX_CFLAGS_COMPILE = toString (optional sdlSupport "-I${SDL.dev}/include/SDL"
+  env.NIX_CFLAGS_COMPILE = toString (optional sdlSupport "-I${SDL.dev}/include/SDL"
     ++ optional speechdSupport "-I${speechd}/include/speech-dispatcher");
 
   # we choose only cmdline and speech-dispatcher speech options.
diff --git a/pkgs/applications/misc/osm2xmap/default.nix b/pkgs/applications/misc/osm2xmap/default.nix
index 4f2af99ab14dd..b925707679ca2 100644
--- a/pkgs/applications/misc/osm2xmap/default.nix
+++ b/pkgs/applications/misc/osm2xmap/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     "INSTALL_MANDIR=${placeholder "out"}/share/man/man1"
   ];
 
-  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
+  env.NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
 
   buildInputs = [ libroxml proj libyamlcpp boost ];
 
diff --git a/pkgs/applications/misc/prusa-slicer/default.nix b/pkgs/applications/misc/prusa-slicer/default.nix
index a6e81375de559..a2e22015ddc51 100644
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@@ -45,15 +45,15 @@ stdenv.mkDerivation rec {
   # cmake/modules/FindNLopt.cmake in the package source - for finding the nlopt
   # library, which doesn't pick up the package in the nix store.  We
   # additionally need to set the path via the NLOPT environment variable.
-  NLOPT = nlopt;
+  env.NLOPT = toString nlopt;
 
   # Disable compiler warnings that clutter the build log.
   # It seems to be a known issue for Eigen:
   # http://eigen.tuxfamily.org/bz/show_bug.cgi?id=1221
-  NIX_CFLAGS_COMPILE = "-Wno-ignored-attributes";
+  env.NIX_CFLAGS_COMPILE = "-Wno-ignored-attributes";
 
   # prusa-slicer uses dlopen on `libudev.so` at runtime
-  NIX_LDFLAGS = "-ludev";
+  env.NIX_LDFLAGS = "-ludev";
 
   prePatch = ''
     # In nix ioctls.h isn't available from the standard kernel-headers package
diff --git a/pkgs/applications/misc/qlcplus/default.nix b/pkgs/applications/misc/qlcplus/default.nix
index 439af2b8c01e6..d26e19d1e5c2e 100644
--- a/pkgs/applications/misc/qlcplus/default.nix
+++ b/pkgs/applications/misc/qlcplus/default.nix
@@ -29,7 +29,7 @@ mkDerivation rec {
 
   qmakeFlags = [ "INSTALLROOT=$(out)" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   postPatch = ''
     patchShebangs .
diff --git a/pkgs/applications/misc/redis-desktop-manager/default.nix b/pkgs/applications/misc/redis-desktop-manager/default.nix
index 8c4fa2efb2278..86dfb9e40b328 100644
--- a/pkgs/applications/misc/redis-desktop-manager/default.nix
+++ b/pkgs/applications/misc/redis-desktop-manager/default.nix
@@ -34,7 +34,7 @@ mkDerivation rec {
   dontUseQmakeConfigure = true;
   dontWrapQtApps = true;
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated";
 
   # Disable annoying update reminder
   postPatch = ''
diff --git a/pkgs/applications/misc/sdcv/default.nix b/pkgs/applications/misc/sdcv/default.nix
index 391ef82daf13b..3023796c90397 100644
--- a/pkgs/applications/misc/sdcv/default.nix
+++ b/pkgs/applications/misc/sdcv/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     mkdir locale
   '';
 
-  NIX_CFLAGS_COMPILE = "-D__GNU_LIBRARY__";
+  env.NIX_CFLAGS_COMPILE = "-D__GNU_LIBRARY__";
 
   meta = with lib; {
     homepage = "https://dushistov.github.io/sdcv/";
diff --git a/pkgs/applications/misc/vp/default.nix b/pkgs/applications/misc/vp/default.nix
index d133331a0a7b9..fad3f538f9cf8 100644
--- a/pkgs/applications/misc/vp/default.nix
+++ b/pkgs/applications/misc/vp/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ SDL SDL_image ];
 
-  NIX_CFLAGS_COMPILE="-I${SDL}/include/SDL -I${SDL_image}/include/SDL";
+  env.NIX_CFLAGS_COMPILE="-I${SDL}/include/SDL -I${SDL_image}/include/SDL";
 
   meta = with lib; {
     homepage = "https://brlcad.org/~erik/";
diff --git a/pkgs/applications/misc/xfontsel/default.nix b/pkgs/applications/misc/xfontsel/default.nix
index 365f6217861b8..15ef9d974eea8 100644
--- a/pkgs/applications/misc/xfontsel/default.nix
+++ b/pkgs/applications/misc/xfontsel/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [libX11 libXaw];
 
   # Without this, it gets Xmu as a dependency, but without rpath entry
-  NIX_LDFLAGS = "-lXmu";
+  env.NIX_LDFLAGS = "-lXmu";
 
   # This will not make xfontsel find its app-defaults, but at least the $out
   # directory will contain them.
diff --git a/pkgs/applications/misc/xmr-stak/default.nix b/pkgs/applications/misc/xmr-stak/default.nix
index cb4233be8ec34..746d13fcdece1 100644
--- a/pkgs/applications/misc/xmr-stak/default.nix
+++ b/pkgs/applications/misc/xmr-stak/default.nix
@@ -21,7 +21,7 @@ stdenv'.mkDerivation rec {
     sha256 = "0ilx5mhh91ks7dwvykfyynh53l6vkkignjpwkkss8ss6b2k8gdbj";
   };
 
-  NIX_CFLAGS_COMPILE = "-O3";
+  env.NIX_CFLAGS_COMPILE = "-O3";
 
   cmakeFlags = lib.optional (!cudaSupport) "-DCUDA_ENABLE=OFF"
     ++ lib.optional (!openclSupport) "-DOpenCL_ENABLE=OFF";
diff --git a/pkgs/applications/misc/xsw/default.nix b/pkgs/applications/misc/xsw/default.nix
index a664aec45e1f1..5248ed2f60401 100644
--- a/pkgs/applications/misc/xsw/default.nix
+++ b/pkgs/applications/misc/xsw/default.nix
@@ -18,7 +18,7 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [ SDL SDL_image SDL_ttf SDL_gfx ];
 
-  NIX_CFLAGS_COMPILE = toString (makeSDLFlags [ SDL SDL_image SDL_ttf SDL_gfx ]);
+  env.NIX_CFLAGS_COMPILE = toString (makeSDLFlags [ SDL SDL_image SDL_ttf SDL_gfx ]);
 
   patches = [
     ./parse.patch # Fixes compilation error by avoiding redundant definitions.
diff --git a/pkgs/applications/misc/zathura/cb/default.nix b/pkgs/applications/misc/zathura/cb/default.nix
index 69ecb1cfd1b89..e087f88ff1d46 100644
--- a/pkgs/applications/misc/zathura/cb/default.nix
+++ b/pkgs/applications/misc/zathura/cb/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ meson ninja pkg-config gettext ];
   buildInputs = [ libarchive zathura_core girara ];
 
-  PKG_CONFIG_ZATHURA_PLUGINDIR = "lib/zathura";
+  env.PKG_CONFIG_ZATHURA_PLUGINDIR = "lib/zathura";
 
   meta = with lib; {
     homepage = "https://pwmt.org/projects/zathura-cb/";
diff --git a/pkgs/applications/misc/zathura/djvu/default.nix b/pkgs/applications/misc/zathura/djvu/default.nix
index f0fe09486324d..33b06698498fb 100644
--- a/pkgs/applications/misc/zathura/djvu/default.nix
+++ b/pkgs/applications/misc/zathura/djvu/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ meson ninja pkg-config ];
   buildInputs = [ djvulibre gettext zathura_core gtk girara ];
 
-  PKG_CONFIG_ZATHURA_PLUGINDIR = "lib/zathura";
+  env.PKG_CONFIG_ZATHURA_PLUGINDIR = "lib/zathura";
 
   meta = with lib; {
     homepage = "https://pwmt.org/projects/zathura-djvu/";
diff --git a/pkgs/applications/misc/zathura/pdf-mupdf/default.nix b/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
index 05f6c2b6a65ec..1ea626a1e29f6 100644
--- a/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
+++ b/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
@@ -38,9 +38,9 @@ stdenv.mkDerivation rec {
   ];
 
   # avoid: undefined symbol: gumbo_destroy_output
-  NIX_LDFLAGS = [ "-lgumbo" ];
+  env.NIX_LDFLAGS = "-lgumbo";
 
-  PKG_CONFIG_ZATHURA_PLUGINDIR= "lib/zathura";
+  env.PKG_CONFIG_ZATHURA_PLUGINDIR= "lib/zathura";
 
   meta = with lib; {
     homepage = "https://pwmt.org/projects/zathura-pdf-mupdf/";
diff --git a/pkgs/applications/misc/zathura/pdf-poppler/default.nix b/pkgs/applications/misc/zathura/pdf-poppler/default.nix
index b76e72a6970ca..acf1947930855 100644
--- a/pkgs/applications/misc/zathura/pdf-poppler/default.nix
+++ b/pkgs/applications/misc/zathura/pdf-poppler/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ meson ninja pkg-config zathura_core ];
   buildInputs = [ poppler girara ];
 
-  PKG_CONFIG_ZATHURA_PLUGINDIR = "lib/zathura";
+  env.PKG_CONFIG_ZATHURA_PLUGINDIR = "lib/zathura";
 
   meta = with lib; {
     homepage = "https://pwmt.org/projects/zathura-pdf-poppler/";
diff --git a/pkgs/applications/misc/zathura/ps/default.nix b/pkgs/applications/misc/zathura/ps/default.nix
index ee63a9df53bd9..60e98d223f01a 100644
--- a/pkgs/applications/misc/zathura/ps/default.nix
+++ b/pkgs/applications/misc/zathura/ps/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ meson ninja pkg-config gettext ];
   buildInputs = [ libspectre zathura_core girara ];
 
-  PKG_CONFIG_ZATHURA_PLUGINDIR = "lib/zathura";
+  env.PKG_CONFIG_ZATHURA_PLUGINDIR = "lib/zathura";
 
   meta = with lib; {
     homepage = "https://pwmt.org/projects/zathura-ps/";
diff --git a/pkgs/applications/networking/bee/bee.nix b/pkgs/applications/networking/bee/bee.nix
index b0d05d928c050..4c1dddce53028 100644
--- a/pkgs/applications/networking/bee/bee.nix
+++ b/pkgs/applications/networking/bee/bee.nix
@@ -44,8 +44,8 @@ buildGoModule {
   subPackages = [ "cmd/bee" ];
 
   # no symbol table, no debug info, and pass the commit for the version string
-  buildFlags = lib.optionalString ( lib.hasAttr "goVersionString" versionSpec)
-    "-ldflags -s -ldflags -w -ldflags -X=github.com/ethersphere/bee.commit=${versionSpec.goVersionString}";
+  buildFlags = lib.optionals ( lib.hasAttr "goVersionString" versionSpec)
+    [ "-ldflags" "-s" "-ldflags" "-w" "-ldflags" "-X=github.com/ethersphere/bee.commit=${versionSpec.goVersionString}" ];
 
   # Mimic the bee Makefile: without disabling CGO, two (transitive and
   # unused) dependencies would fail to compile.
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index f84ce23309fac..023f44942cd42 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -321,7 +321,7 @@ let
     # Don't spam warnings about unknown warning options. This is useful because
     # our Clang is always older than Chromium's and the build logs have a size
     # of approx. 25 MB without this option (and this saves e.g. 66 %).
-    NIX_CFLAGS_COMPILE = "-Wno-unknown-warning-option";
+    env.NIX_CFLAGS_COMPILE = "-Wno-unknown-warning-option";
 
     buildPhase = let
       buildCommand = target: ''
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 4872324932302..179cff1e75556 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -183,11 +183,11 @@ buildStdenv.mkDerivation ({
                                           AVFoundation MediaToolbox CoreLocation
                                           Foundation libobjc AddressBook cups ];
 
-  NIX_LDFLAGS = lib.optionalString ltoSupport ''
+  env.NIX_LDFLAGS = lib.optionalString ltoSupport ''
     -rpath ${llvmPackages.libunwind.out}/lib
   '';
 
-  MACH_USE_SYSTEM_PYTHON = "1";
+  env.MACH_USE_SYSTEM_PYTHON = "1";
 
   postPatch = ''
     rm -rf obj-x86_64-pc-linux-gnu
diff --git a/pkgs/applications/networking/browsers/netsurf/libcss.nix b/pkgs/applications/networking/browsers/netsurf/libcss.nix
index 7777bb243fa62..9e44f7aae3e68 100644
--- a/pkgs/applications/networking/browsers/netsurf/libcss.nix
+++ b/pkgs/applications/networking/browsers/netsurf/libcss.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
   ];
 
-  NIX_CFLAGS_COMPILE= [ "-Wno-error=implicit-fallthrough" "-Wno-error=maybe-uninitialized" ];
+  env.NIX_CFLAGS_COMPILE= "-Wno-error=implicit-fallthrough -Wno-error=maybe-uninitialized";
 
   meta = with lib; {
     homepage = "https://www.netsurf-browser.org/projects/${libname}/";
diff --git a/pkgs/applications/networking/browsers/netsurf/libwapcaplet.nix b/pkgs/applications/networking/browsers/netsurf/libwapcaplet.nix
index 318885bd27214..6a2918fa7d950 100644
--- a/pkgs/applications/networking/browsers/netsurf/libwapcaplet.nix
+++ b/pkgs/applications/networking/browsers/netsurf/libwapcaplet.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type";
 
   meta = with lib; {
     homepage = "https://www.netsurf-browser.org/projects/${libname}/";
diff --git a/pkgs/applications/networking/browsers/w3m/default.nix b/pkgs/applications/networking/browsers/w3m/default.nix
index 2a4dc9e389ab7..62681a3e2c0ca 100644
--- a/pkgs/applications/networking/browsers/w3m/default.nix
+++ b/pkgs/applications/networking/browsers/w3m/default.nix
@@ -35,12 +35,16 @@ in stdenv.mkDerivation rec {
     sha256 = "1fbg2p8qh2gvi3g4iz4q6vc0k70pf248r4yndi5lcn2m3mzvjx0i";
   };
 
-  NIX_LDFLAGS = optionalString stdenv.isSunOS "-lsocket -lnsl";
-
-  # we must set these so that the generated files (e.g. w3mhelp.cgi) contain
-  # the correct paths.
-  PERL = "${perl}/bin/perl";
-  MAN = "${man}/bin/man";
+  env = {
+    NIX_LDFLAGS = optionalString stdenv.isSunOS "-lsocket -lnsl";
+    # we must set these so that the generated files (e.g. w3mhelp.cgi) contain
+    # the correct paths.
+    PERL = "${perl}/bin/perl";
+    MAN = "${man}/bin/man";
+    # for w3mimgdisplay
+    # see: https://bbs.archlinux.org/viewtopic.php?id=196093
+    LIBS = optionalString x11Support "-lX11";
+  };
 
   makeFlags = [ "AR=${stdenv.cc.bintools.targetPrefix}ar" ];
 
@@ -86,10 +90,6 @@ in stdenv.mkDerivation rec {
 
   enableParallelBuilding = false;
 
-  # for w3mimgdisplay
-  # see: https://bbs.archlinux.org/viewtopic.php?id=196093
-  LIBS = optionalString x11Support "-lX11";
-
   meta = {
     homepage = "http://w3m.sourceforge.net/";
     description = "A text-mode web browser";
diff --git a/pkgs/applications/networking/calls/default.nix b/pkgs/applications/networking/calls/default.nix
index 52e1bc50601a4..be8b8284c23ca 100644
--- a/pkgs/applications/networking/calls/default.nix
+++ b/pkgs/applications/networking/calls/default.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
     xvfb-run
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   mesonFlags = [
     "-Dgtk_doc=true"
diff --git a/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix b/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
index a251886ebdd76..aa5dc3b28969d 100644
--- a/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
+++ b/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
@@ -25,12 +25,11 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildFlagsArray = [
-    "-ldflags="
-    "-s"
-    "-w"
-    "-X code.cloudfoundry.org/cli/version.binaryBuildDate=1970-01-01"
-    "-X code.cloudfoundry.org/cli/version.binaryVersion=${version}"
+  buildFlags = [
+    ("-ldflags=-s"
+      + " -w"
+      + " -X code.cloudfoundry.org/cli/version.binaryBuildDate=1970-01-01"
+      + " -X code.cloudfoundry.org/cli/version.binaryVersion=${version}")
   ];
 
   postInstall = ''
diff --git a/pkgs/applications/networking/cluster/kubernetes/default.nix b/pkgs/applications/networking/cluster/kubernetes/default.nix
index 60d5dec48a5a6..d82a4b3c98965 100644
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     # go env breaks the sandbox
     substituteInPlace "hack/lib/golang.sh" \
-      --replace 'echo "$(go env GOHOSTOS)/$(go env GOHOSTARCH)"' 'echo "${go.GOOS}/${go.GOARCH}"'
+      --replace 'echo "$(go env GOHOSTOS)/$(go env GOHOSTARCH)"' 'echo "${go.env.GOOS}/${go.env.GOARCH}"'
 
     substituteInPlace "hack/update-generated-docs.sh" --replace "make" "make SHELL=${stdenv.shell}"
     # hack/update-munge-docs.sh only performs some tests on the documentation.
diff --git a/pkgs/applications/networking/cluster/node-problem-detector/default.nix b/pkgs/applications/networking/cluster/node-problem-detector/default.nix
index e53a9c39ea7e4..bc2e3aa66064c 100644
--- a/pkgs/applications/networking/cluster/node-problem-detector/default.nix
+++ b/pkgs/applications/networking/cluster/node-problem-detector/default.nix
@@ -28,8 +28,8 @@ buildGoModule rec {
 
   buildInputs = lib.optionals stdenv.isLinux [ systemd ];
 
-  buildFlags = "-mod vendor" +
-    lib.optionalString stdenv.isLinux " -tags journald";
+  buildFlags = [ "-mod" "vendor" ] ++
+    lib.optionals stdenv.isLinux [ "-tags" "journald" ];
 
   buildFlagsArray = [
     "-ldflags="
diff --git a/pkgs/applications/networking/cluster/spacegun/node-composition.nix b/pkgs/applications/networking/cluster/spacegun/node-composition.nix
index 7cbb2328ae731..ec98d0e68e51d 100644
--- a/pkgs/applications/networking/cluster/spacegun/node-composition.nix
+++ b/pkgs/applications/networking/cluster/spacegun/node-composition.nix
@@ -6,7 +6,7 @@
 
 let
   nodeEnv = import ../../../../development/node-packages/node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile;
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile jq;
     inherit pkgs nodejs;
     libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
   };
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index 2a4f10a8f117c..e09b643fb45f4 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -63,7 +63,8 @@ let
 
           # Make providers available in Terraform 0.13 and 0.12 search paths.
           pluginDir = lib.concatMapStrings (pl: let
-            inherit (pl) version GOOS GOARCH;
+            inherit (pl) version;
+            inherit (pl.env) GOOS GOARCH;
 
             pname = pl.pname or (throw "${pl.name} is missing a pname attribute");
 
diff --git a/pkgs/applications/networking/compactor/default.nix b/pkgs/applications/networking/compactor/default.nix
index f4535c9120cdf..50e86b651f947 100644
--- a/pkgs/applications/networking/compactor/default.nix
+++ b/pkgs/applications/networking/compactor/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     substituteInPlace configure \
       --replace "/usr/bin/file" "${file}/bin/file"
   '';
-  CXXFLAGS = "-std=c++11";
+  env.CXXFLAGS = "-std=c++11";
   configureFlags = [
     "--with-boost-libdir=${boost.out}/lib"
     "--with-boost=${boost.dev}"
diff --git a/pkgs/applications/networking/feedreaders/newsboat/default.nix b/pkgs/applications/networking/feedreaders/newsboat/default.nix
index 38bc05b1f8688..06b89e24b8641 100644
--- a/pkgs/applications/networking/feedreaders/newsboat/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsboat/default.nix
@@ -35,14 +35,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   # TODO: Check if that's still needed
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin " -Wno-error=format-security";
-
-  # https://github.com/NixOS/nixpkgs/pull/98471#issuecomment-703100014 . We set
-  # these for all platforms, since upstream's gettext crate behavior might
-  # change in the future.
-  GETTEXT_LIB_DIR = "${lib.getLib gettext}/lib";
-  GETTEXT_INCLUDE_DIR = "${lib.getDev gettext}/include";
-  GETTEXT_BIN_DIR = "${lib.getBin gettext}/bin";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin " -Wno-error=format-security";
 
   doCheck = true;
 
diff --git a/pkgs/applications/networking/ids/snort/default.nix b/pkgs/applications/networking/ids/snort/default.nix
index 714ca1c8990f3..d46742758066e 100644
--- a/pkgs/applications/networking/ids/snort/default.nix
+++ b/pkgs/applications/networking/ids/snort/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ pkg-config luajit openssl libpcap pcre libdnet daq zlib flex bison libtirpc ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
+  env.NIX_CFLAGS_COMPILE = "-I${libtirpc.dev}/include/tirpc";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/networking/instant-messengers/baresip/default.nix b/pkgs/applications/networking/instant-messengers/baresip/default.nix
index 0c6b33e04a224..3e5d51f977ed8 100644
--- a/pkgs/applications/networking/instant-messengers/baresip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/baresip/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   ++ lib.optional (stdenv.cc.libc != null) "SYSROOT=${stdenv.cc.libc}"
   ;
 
-  NIX_CFLAGS_COMPILE='' -I${librem}/include/rem -I${gsm}/include/gsm
+  env.NIX_CFLAGS_COMPILE='' -I${librem}/include/rem -I${gsm}/include/gsm
     -DHAVE_INTTYPES_H -D__GLIBC__
     -D__need_timeval -D__need_timespec -D__need_time_t '';
   meta = {
diff --git a/pkgs/applications/networking/instant-messengers/centerim/default.nix b/pkgs/applications/networking/instant-messengers/centerim/default.nix
index 78178f0021e2e..a0fdd47b91788 100644
--- a/pkgs/applications/networking/instant-messengers/centerim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/centerim/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "0viz86jflp684vfginhl6aaw4gh2qvalc25anlwljjl3kkmibklk";
   };
 
-  CXXFLAGS = "-std=gnu++98";
+  env.CXXFLAGS = "-std=gnu++98";
 
   buildInputs = [ openssl curl ncurses libjpeg ]
     ++ lib.optional withGpg gpgme;
diff --git a/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix b/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix
index dd46b64e4f64d..5c05a74e68726 100644
--- a/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix
@@ -42,7 +42,7 @@ buildPythonApplication rec {
     peewee
     prompt_toolkit
     setuptools
-  ] ++ lib.optional enableDbusUi [
+  ] ++ lib.optionals enableDbusUi [
       dbus-python
       notify2
       pygobject3
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix
index 9845491f235de..0b51d172b7462 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1gjm0z4wa5vi9x1xk43rany5pffrwg958n180ahdj9a7sa8a4hpm";
   };
 
-  NIX_CFLAGS_COMPILE = builtins.toString [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     # glib-2.62 deprecations
     "-DGLIB_DISABLE_DEPRECATION_WARNINGS"
     # override "-O0 -Werror" set by build system
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/skype4pidgin/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/skype4pidgin/default.nix
index 6e14ee1a2b889..5a95501587344 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/skype4pidgin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/skype4pidgin/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "116jfh5ravaixivqx4a4bz0lbb9c49d5r83nwmripja56zdbpgr0";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${libnotify}/include/libnotify";
+  env.NIX_CFLAGS_COMPILE = "-I${libnotify}/include/libnotify";
 
   patchPhase = ''
     sed -i -e 's/ [^ ]*-gcc/ gcc/' -e 's/-march[^ ]*//' \
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/telegram-purple/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/telegram-purple/default.nix
index 527af9ed98db6..500e4c93ac71a 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/telegram-purple/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/telegram-purple/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "0p93jpjpx7hszwffzgixw04zkrpsiyzz4za3gfr4j07krc4771fp";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ pidgin libwebp libgcrypt gettext ];
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/tox-prpl/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/tox-prpl/default.nix
index 41c6a75310a6f..3ee8ac2f8dd0c 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/tox-prpl/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/tox-prpl/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ms367l2f7x83k407c93bmhpyc820f1css61fh2gx4jq13cxqq3p";
   };
 
-  NIX_LDFLAGS = "-lssp -lsodium";
+  env.NIX_LDFLAGS = "-lssp -lsodium";
 
   postInstall = "mv $out/lib/purple-2 $out/lib/pidgin";
 
diff --git a/pkgs/applications/networking/instant-messengers/pidgin/default.nix b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
index dc5a873976098..987fe7e632aa5 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
@@ -27,7 +27,7 @@ let unwrapped = stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  NIX_CFLAGS_COMPILE = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
+  env.NIX_CFLAGS_COMPILE = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
 
   buildInputs = let
     python-with-dbus = python.withPackages (pp: with pp; [ dbus-python ]);
diff --git a/pkgs/applications/networking/instant-messengers/psi/default.nix b/pkgs/applications/networking/instant-messengers/psi/default.nix
index 62b6c8f8e59c0..ad48145659590 100644
--- a/pkgs/applications/networking/instant-messengers/psi/default.nix
+++ b/pkgs/applications/networking/instant-messengers/psi/default.nix
@@ -13,6 +13,7 @@ mkDerivation rec {
     sha256 = "hXDZODHl14kimRlMQ1XjISQ2kk9NS78axVN3U21wkuM=";
     fetchSubmodules = true;
   };
+
   patches = [
     ./fix-cmake-hunspell-1.7.patch
   ];
diff --git a/pkgs/applications/networking/instant-messengers/swift-im/default.nix b/pkgs/applications/networking/instant-messengers/swift-im/default.nix
index 58335bed4218c..1bd8e546b360c 100644
--- a/pkgs/applications/networking/instant-messengers/swift-im/default.nix
+++ b/pkgs/applications/networking/instant-messengers/swift-im/default.nix
@@ -23,7 +23,7 @@ mkDerivation rec {
 
   propagatedUserEnvPkgs = [ GConf ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-I${libxml2.dev}/include/libxml2"
     "-I${miniupnpc}/include/miniupnpc"
     "-I${qtwebkit.dev}/include/QtWebKit"
diff --git a/pkgs/applications/networking/instant-messengers/vacuum/default.nix b/pkgs/applications/networking/instant-messengers/vacuum/default.nix
index 0fc7e8b6d8ee2..d22150873a3b2 100644
--- a/pkgs/applications/networking/instant-messengers/vacuum/default.nix
+++ b/pkgs/applications/networking/instant-messengers/vacuum/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
   # hack: needed to fix build issues in
   # https://hydra.nixos.org/build/38322959/nixlog/1
   # should be an upstream issue but it's easy to fix
-  NIX_LDFLAGS = "-lz";
+  env.NIX_LDFLAGS = "-lz";
 
   nativeBuildInputs = [ qmake4Hook ];
 
diff --git a/pkgs/applications/networking/irc/bip/default.nix b/pkgs/applications/networking/irc/bip/default.nix
index a7b57aa31028b..5e63b59bc5959 100644
--- a/pkgs/applications/networking/irc/bip/default.nix
+++ b/pkgs/applications/networking/irc/bip/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=duplicate-decl-specifier";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=duplicate-decl-specifier";
 
   meta = {
     description = "An IRC proxy (bouncer)";
diff --git a/pkgs/applications/networking/irc/quassel/default.nix b/pkgs/applications/networking/irc/quassel/default.nix
index b72e28929e3ec..0a550812546b2 100644
--- a/pkgs/applications/networking/irc/quassel/default.nix
+++ b/pkgs/applications/networking/irc/quassel/default.nix
@@ -49,7 +49,7 @@ in (if !buildClient then stdenv.mkDerivation else mkDerivation) rec {
   ];
 
   # Prevent ``undefined reference to `qt_version_tag''' in SSL check
-  NIX_CFLAGS_COMPILE = "-DQT_NO_VERSION_TAGGING=1";
+  env.NIX_CFLAGS_COMPILE = "-DQT_NO_VERSION_TAGGING=1";
 
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ qtbase ]
diff --git a/pkgs/applications/networking/irc/weechat/default.nix b/pkgs/applications/networking/irc/weechat/default.nix
index daa088997309a..2245e72bd7aad 100644
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@@ -55,7 +55,7 @@ let
         ++ concatMap (p: p.buildInputs) enabledPlugins
         ++ extraBuildInputs;
 
-      NIX_CFLAGS_COMPILE = "-I${python}/include/${python.libPrefix}"
+      env.NIX_CFLAGS_COMPILE = "-I${python}/include/${python.libPrefix}"
         # Fix '_res_9_init: undefined symbol' error
         + (lib.optionalString stdenv.isDarwin "-DBIND_8_COMPAT=1 -lresolv");
 
diff --git a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix
index 679e278c8a09d..c5895866aa57a 100644
--- a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix
+++ b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   patches = [
     (substituteAll {
       src = ./libpath.patch;
-      env = "${buildEnv {
+      envPath = "${buildEnv {
         name = "wee-slack-env";
         paths = with python3Packages; [ websocket_client six ];
       }}/${python3Packages.python.sitePackages}";
diff --git a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/libpath.patch b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/libpath.patch
index af2dd36b41c51..d2ebf9def3a5b 100644
--- a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/libpath.patch
+++ b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/libpath.patch
@@ -6,7 +6,7 @@ index dbe6446..d1b7546 100644
  import socket
  import string
  
-+sys.path.append('@env@')
++sys.path.append('@envPath@')
 +
  from websocket import ABNF, create_connection, WebSocketConnectionClosedException
  
diff --git a/pkgs/applications/networking/irc/weechat/scripts/weechat-otr/default.nix b/pkgs/applications/networking/irc/weechat/scripts/weechat-otr/default.nix
index 987271e4ffa29..08f1ba473f6fb 100644
--- a/pkgs/applications/networking/irc/weechat/scripts/weechat-otr/default.nix
+++ b/pkgs/applications/networking/irc/weechat/scripts/weechat-otr/default.nix
@@ -47,7 +47,7 @@ in stdenv.mkDerivation rec {
   patches = [
     (substituteAll {
       src = ./libpath.patch;
-      env = "${buildEnv {
+      envPath = "${buildEnv {
         name = "weechat-otr-env";
         paths = [ potr pycrypto ];
       }}/${python3Packages.python.sitePackages}";
diff --git a/pkgs/applications/networking/irc/weechat/scripts/weechat-otr/libpath.patch b/pkgs/applications/networking/irc/weechat/scripts/weechat-otr/libpath.patch
index a7b77ed9b6026..17ff524494ced 100644
--- a/pkgs/applications/networking/irc/weechat/scripts/weechat-otr/libpath.patch
+++ b/pkgs/applications/networking/irc/weechat/scripts/weechat-otr/libpath.patch
@@ -6,7 +6,7 @@ index 0ccfb35..c42bebf 100644
  import shutil
  import sys
  
-+sys.path.append('@env@')
++sys.path.append('@envPath@')
 +
  import potr
  import weechat
diff --git a/pkgs/applications/networking/mailreaders/afew/default.nix b/pkgs/applications/networking/mailreaders/afew/default.nix
index 8a5f607dd32ca..e5ed478f5729a 100644
--- a/pkgs/applications/networking/mailreaders/afew/default.nix
+++ b/pkgs/applications/networking/mailreaders/afew/default.nix
@@ -19,9 +19,7 @@ python3Packages.buildPythonApplication rec {
     freezegun notmuch
   ];
 
-  makeWrapperArgs = [
-    ''--prefix PATH ':' "${notmuch}/bin"''
-  ];
+  makeWrapperArgs = ''--prefix PATH ':' "${notmuch}/bin"'';
 
   outputs = [ "out" "doc" ];
 
diff --git a/pkgs/applications/networking/mailreaders/balsa/default.nix b/pkgs/applications/networking/mailreaders/balsa/default.nix
index 2f9832d9193dd..47325540ce0a3 100644
--- a/pkgs/applications/networking/mailreaders/balsa/default.nix
+++ b/pkgs/applications/networking/mailreaders/balsa/default.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
     "--with-spell-checker=gtkspell"
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/networking/mailreaders/claws-mail/default.nix b/pkgs/applications/networking/mailreaders/claws-mail/default.nix
index 4a13cf68a8829..e7f16346065e8 100644
--- a/pkgs/applications/networking/mailreaders/claws-mail/default.nix
+++ b/pkgs/applications/networking/mailreaders/claws-mail/default.nix
@@ -156,7 +156,7 @@ in stdenv.mkDerivation rec {
 
       "--disable-gdata-plugin" # Complains about missing libgdata, even when provided
     ] ++
-    (map (feature: map (flag: strings.enableFeature feature.enabled flag) feature.flags) features);
+    flatten (map (feature: map (flag: strings.enableFeature feature.enabled flag) feature.flags) features);
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
index 53fe3d6f9496c..dcc73da96c17d 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
@@ -121,7 +121,7 @@ stdenv.mkDerivation rec {
     };
   };
 
-  PKG_CONFIG_LIBEDATASERVERUI_1_2_UIMODULEDIR = "${placeholder "out"}/lib/evolution-data-server/ui-modules";
+  env.PKG_CONFIG_LIBEDATASERVERUI_1_2_UIMODULEDIR = "${placeholder "out"}/lib/evolution-data-server/ui-modules";
 
   meta = with lib; {
     homepage = "https://wiki.gnome.org/Apps/Evolution";
diff --git a/pkgs/applications/networking/mailreaders/neomutt/default.nix b/pkgs/applications/networking/mailreaders/neomutt/default.nix
index b2187371f299d..464bdad974516 100644
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
   # Fix missing libidn in mutt;
   # this fix is ugly since it links all binaries in mutt against libidn
   # like pgpring, pgpewrap, ...
-  NIX_LDFLAGS = "-lidn";
+  env.NIX_LDFLAGS = "-lidn";
 
   postInstall = ''
     wrapProgram "$out/bin/neomutt" --prefix PATH : "$out/libexec/neomutt"
diff --git a/pkgs/applications/networking/mailreaders/notmuch/default.nix b/pkgs/applications/networking/mailreaders/notmuch/default.nix
index 6919e31342e41..db76a5a8c3c4f 100644
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     doxygen                   # (optional) api docs
     pythonPackages.sphinx     # (optional) documentation -> doc/INSTALL
     texinfo                   # (optional) documentation -> doc/INSTALL
-  ] ++ optional withEmacs [ emacs ];
+  ] ++ optional withEmacs emacs;
 
   buildInputs = [
     gnupg                     # undefined dependencies
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/default.nix b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
index 34799f3898fa5..28ed39ec77c76 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@@ -145,10 +145,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional pulseaudioSupport libpulseaudio
     ++ lib.optionals waylandSupport [ libxkbcommon libdrm ];
 
-  NIX_CFLAGS_COMPILE =[
-    "-I${glib.dev}/include/gio-unix-2.0"
-    "-I${nss_3_53.dev}/include/nss"
-  ];
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0 -I${nss_3_53.dev}/include/nss";
 
   patches = [
     ./no-buildconfig.patch
diff --git a/pkgs/applications/networking/mumble/default.nix b/pkgs/applications/networking/mumble/default.nix
index 088391ba48f72..1c71ca742034b 100644
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@@ -82,7 +82,7 @@ let
       "CONFIG+=no-server"
     ];
 
-    NIX_CFLAGS_COMPILE = lib.optional speechdSupport "-I${speechd}/include/speech-dispatcher";
+    env.NIX_CFLAGS_COMPILE = lib.optionalString speechdSupport "-I${speechd}/include/speech-dispatcher";
 
     installPhase = ''
       # bin stuff
diff --git a/pkgs/applications/networking/p2p/transgui/default.nix b/pkgs/applications/networking/p2p/transgui/default.nix
index ceccf44819fc4..570da3f7b9992 100644
--- a/pkgs/applications/networking/p2p/transgui/default.nix
+++ b/pkgs/applications/networking/p2p/transgui/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     libX11 glib gtk2 gdk-pixbuf pango atk cairo openssl
   ];
 
-  NIX_LDFLAGS = "
+  env.NIX_LDFLAGS = "
     -L${stdenv.cc.cc.lib}/lib
     -lX11 -lglib-2.0 -lgtk-x11-2.0 -lgdk-x11-2.0
     -lgdk_pixbuf-2.0 -lpango-1.0 -latk-1.0 -lcairo -lc -lcrypto
diff --git a/pkgs/applications/networking/p2p/transmission/default.nix b/pkgs/applications/networking/p2p/transmission/default.nix
index cfccff689fe00..6445aca5c9b48 100644
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@@ -76,7 +76,7 @@ in stdenv.mkDerivation {
   ++ lib.optionals stdenv.isLinux [ inotify-tools ]
   ;
 
-  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework CoreFoundation";
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework CoreFoundation";
 
   postInstall = ''
     mkdir $apparmor
diff --git a/pkgs/applications/networking/remote/putty/default.nix b/pkgs/applications/networking/remote/putty/default.nix
index e7544258acf13..07bce35cd31f7 100644
--- a/pkgs/applications/networking/remote/putty/default.nix
+++ b/pkgs/applications/networking/remote/putty/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   };
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   preConfigure = lib.optionalString stdenv.hostPlatform.isUnix ''
     perl mkfiles.pl
diff --git a/pkgs/applications/networking/sniffers/ettercap/default.nix b/pkgs/applications/networking/sniffers/ettercap/default.nix
index a3c79fd9560b7..905087645d936 100644
--- a/pkgs/applications/networking/sniffers/ettercap/default.nix
+++ b/pkgs/applications/networking/sniffers/ettercap/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   ];
 
   # TODO: Remove after the next release (0.8.4 should work without this):
-  NIX_CFLAGS_COMPILE = [ "-I${harfbuzz.dev}/include/harfbuzz" ];
+  env.NIX_CFLAGS_COMPILE = "-I${harfbuzz.dev}/include/harfbuzz";
 
   meta = with lib; {
     description = "Comprehensive suite for man in the middle attacks";
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index 230bb2d4fe41f..87457e7639ce1 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -31,7 +31,7 @@ in stdenv.mkDerivation {
   ];
 
   # Avoid referencing -dev paths because of debug assertions.
-  NIX_CFLAGS_COMPILE = [ "-DQT_NO_DEBUG" ];
+  env.NIX_CFLAGS_COMPILE = "-DQT_NO_DEBUG";
 
   nativeBuildInputs = [ bison cmake flex makeWrapper pkg-config ] ++ optional withQt qt5.wrapQtAppsHook;
 
diff --git a/pkgs/applications/networking/sync/acd_cli/default.nix b/pkgs/applications/networking/sync/acd_cli/default.nix
index 519242b887cc3..8ebb57ce61124 100644
--- a/pkgs/applications/networking/sync/acd_cli/default.nix
+++ b/pkgs/applications/networking/sync/acd_cli/default.nix
@@ -18,7 +18,7 @@ buildPythonApplication rec {
   propagatedBuildInputs = [ appdirs colorama dateutil fusepy requests
                             requests_toolbelt setuptools sqlalchemy ];
 
-  makeWrapperArgs = [ "--prefix LIBFUSE_PATH : ${fuse}/lib/libfuse.so" ];
+  makeWrapperArgs = [ "--prefix" "LIBFUSE_PATH" ":" "${fuse}/lib/libfuse.so" ];
 
   postFixup = ''
     function lnOverBin() {
diff --git a/pkgs/applications/networking/sync/casync/default.nix b/pkgs/applications/networking/sync/casync/default.nix
index 5bc29832c5f3b..933d5e3098f90 100644
--- a/pkgs/applications/networking/sync/casync/default.nix
+++ b/pkgs/applications/networking/sync/casync/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation {
     patchShebangs test/http-server.py
   '';
 
-  PKG_CONFIG_UDEV_UDEVDIR = "lib/udev";
+  env.PKG_CONFIG_UDEV_UDEVDIR = "lib/udev";
   mesonFlags = lib.optionals (!fuseSupport) [ "-Dfuse=false" ]
     ++ lib.optionals (!udevSupport) [ "-Dudev=false" ]
     ++ lib.optionals (!selinuxSupport) [ "-Dselinux=false" ];
diff --git a/pkgs/applications/office/calligra/default.nix b/pkgs/applications/office/calligra/default.nix
index e54a3cbad4cd6..b61232efbf980 100644
--- a/pkgs/applications/office/calligra/default.nix
+++ b/pkgs/applications/office/calligra/default.nix
@@ -36,7 +36,7 @@ mkDerivation rec {
 
   propagatedUserEnvPkgs = [ kproperty ];
 
-  NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
+  env.NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
 
   qtWrapperArgs = [
     "--prefix PATH : ${lib.getBin pstoedit}/bin"
diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
index d2251da700738..3d894bcc3d77c 100644
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
   propagatedUserEnvPkgs = [ dconf ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   postPatch = ''
     patchShebangs .
diff --git a/pkgs/applications/office/kmymoney/default.nix b/pkgs/applications/office/kmymoney/default.nix
index 95da79cca4f2b..8ec16f870ae6d 100644
--- a/pkgs/applications/office/kmymoney/default.nix
+++ b/pkgs/applications/office/kmymoney/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   };
 
   # Hidden dependency that wasn't included in CMakeLists.txt:
-  NIX_CFLAGS_COMPILE = "-I${kitemmodels.dev}/include/KF5";
+  env.NIX_CFLAGS_COMPILE = "-I${kitemmodels.dev}/include/KF5";
 
   nativeBuildInputs = [
     doxygen extra-cmake-modules graphviz kdoctools python2
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 1c5327ebc6ceb..e56a3cbc06f56 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -58,7 +58,7 @@ in (mkDrv rec {
 
   outputs = [ "out" "dev" ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-I${librdf_rasqal}/include/rasqal" # librdf_redland refers to rasqal.h instead of rasqal/rasqal.h
     "-fno-visibility-inlines-hidden" # https://bugs.documentfoundation.org/show_bug.cgi?id=78174#c10
   ];
@@ -406,7 +406,7 @@ in (mkDrv rec {
       gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly
       gst-libav
     ])
-    ++ lib.optional kdeIntegration [ qtbase qtx11extras kcoreaddons kio ];
+    ++ lib.optionals kdeIntegration [ qtbase qtx11extras kcoreaddons kio ];
 
   passthru = {
     inherit srcs jdk;
diff --git a/pkgs/applications/office/wordgrinder/default.nix b/pkgs/applications/office/wordgrinder/default.nix
index 0b086160e50ce..3647d8ea8e22f 100644
--- a/pkgs/applications/office/wordgrinder/default.nix
+++ b/pkgs/applications/office/wordgrinder/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   ];
 
   # To be able to find <Xft.h>
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isLinux "-I${libXft.dev}/include/X11";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isLinux "-I${libXft.dev}/include/X11";
 
   # Binaries look for LuaFileSystem library (lfs.so) at runtime
   postInstall = ''
diff --git a/pkgs/applications/radio/uhd/3.5.nix b/pkgs/applications/radio/uhd/3.5.nix
index d913927a7b995..5e1e18cf97bf0 100644
--- a/pkgs/applications/radio/uhd/3.5.nix
+++ b/pkgs/applications/radio/uhd/3.5.nix
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
     # TODO: Check if this still needed
     # ABI differences GCC 7.1
     # /nix/store/wd6r25miqbk9ia53pp669gn4wrg9n9cj-gcc-7.3.0/include/c++/7.3.0/bits/vector.tcc:394:7: note: parameter passing for argument of type 'std::vector<uhd::range_t>::iterator {aka __gnu_cxx::__normal_iterator<uhd::range_t*, std::vector<uhd::range_t> >}' changed in GCC 7.1
-    ++ [ (lib.optionalString stdenv.isAarch32 "-DCMAKE_CXX_FLAGS=-Wno-psabi") ]
+    ++ lib.optional stdenv.isAarch32 "-DCMAKE_CXX_FLAGS=-Wno-psabi"
   ;
 
   # Python + Mako are always required for the build itself but not necessary for runtime.
diff --git a/pkgs/applications/radio/uhd/default.nix b/pkgs/applications/radio/uhd/default.nix
index 9f2f39aab2c5d..d5ca04c3e73fe 100644
--- a/pkgs/applications/radio/uhd/default.nix
+++ b/pkgs/applications/radio/uhd/default.nix
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
     # TODO: Check if this still needed
     # ABI differences GCC 7.1
     # /nix/store/wd6r25miqbk9ia53pp669gn4wrg9n9cj-gcc-7.3.0/include/c++/7.3.0/bits/vector.tcc:394:7: note: parameter passing for argument of type 'std::vector<uhd::range_t>::iterator {aka __gnu_cxx::__normal_iterator<uhd::range_t*, std::vector<uhd::range_t> >}' changed in GCC 7.1
-    ++ [ (lib.optionalString stdenv.isAarch32 "-DCMAKE_CXX_FLAGS=-Wno-psabi") ]
+    ++ lib.optional stdenv.isAarch32 "-DCMAKE_CXX_FLAGS=-Wno-psabi"
   ;
 
   # Python + Mako are always required for the build itself but not necessary for runtime.
diff --git a/pkgs/applications/radio/unixcw/default.nix b/pkgs/applications/radio/unixcw/default.nix
index cdb84670c616f..d9fcc6e727717 100644
--- a/pkgs/applications/radio/unixcw/default.nix
+++ b/pkgs/applications/radio/unixcw/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     ./remove-use-of-dlopen.patch
   ];
   buildInputs = [libpulseaudio alsaLib pkg-config qt5.qtbase];
-  CFLAGS   ="-lasound -lpulse-simple";
+  env.CFLAGS  = "-lasound -lpulse-simple";
 
   dontWrapQtApps = true;
 
diff --git a/pkgs/applications/radio/xlog/default.nix b/pkgs/applications/radio/xlog/default.nix
index a013fe41d8306..2e348300e3da7 100644
--- a/pkgs/applications/radio/xlog/default.nix
+++ b/pkgs/applications/radio/xlog/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   buildInputs = [ glib pkg-config gtk2 hamlib ];
 
diff --git a/pkgs/applications/science/astronomy/gildas/default.nix b/pkgs/applications/science/astronomy/gildas/default.nix
index b716b0f2f90fc..2eb403ae63197 100644
--- a/pkgs/applications/science/astronomy/gildas/default.nix
+++ b/pkgs/applications/science/astronomy/gildas/default.nix
@@ -26,9 +26,9 @@ stdenv.mkDerivation rec {
 
   patches = [ ./wrapper.patch ./clang.patch ./aarch64.patch ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument";
 
-  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin (with darwin.apple_sdk.frameworks; "-F${CoreFoundation}/Library/Frameworks");
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isDarwin (with darwin.apple_sdk.frameworks; "-F${CoreFoundation}/Library/Frameworks");
 
   configurePhase=''
     substituteInPlace admin/wrapper.sh --replace '%%OUT%%' $out
diff --git a/pkgs/applications/science/astronomy/xplanet/default.nix b/pkgs/applications/science/astronomy/xplanet/default.nix
index 82331a9496d4b..769ecc3fc78a2 100644
--- a/pkgs/applications/science/astronomy/xplanet/default.nix
+++ b/pkgs/applications/science/astronomy/xplanet/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
 
   meta = with lib; {
     description = "Renders an image of the earth or other planets into the X root window";
diff --git a/pkgs/applications/science/biology/cmtk/default.nix b/pkgs/applications/science/biology/cmtk/default.nix
index f147c0422e454..85185d7ab46e5 100644
--- a/pkgs/applications/science/biology/cmtk/default.nix
+++ b/pkgs/applications/science/biology/cmtk/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
 
   meta = with lib; {
     description     = "Computational Morphometry Toolkit ";
diff --git a/pkgs/applications/science/biology/minia/default.nix b/pkgs/applications/science/biology/minia/default.nix
index 6b6bc300e0d9f..03df6239bd841 100644
--- a/pkgs/applications/science/biology/minia/default.nix
+++ b/pkgs/applications/science/biology/minia/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./no-bundle.patch ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wformat" ];
+  env.NIX_CFLAGS_COMPILE = "-Wformat";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ hdf5 boost ];
diff --git a/pkgs/applications/science/biology/niftyreg/default.nix b/pkgs/applications/science/biology/niftyreg/default.nix
index d5f625893e925..b4d7a1315ba8e 100644
--- a/pkgs/applications/science/biology/niftyreg/default.nix
+++ b/pkgs/applications/science/biology/niftyreg/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "07v9v9s41lvw72wpb1jgh2nzanyc994779bd35p76vg8mzifmprl";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=narrowing" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=narrowing";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ zlib ];
diff --git a/pkgs/applications/science/biology/strelka/default.nix b/pkgs/applications/science/biology/strelka/default.nix
index 8585f3770fbcd..2eb0f0ade9ba6 100644
--- a/pkgs/applications/science/biology/strelka/default.nix
+++ b/pkgs/applications/science/biology/strelka/default.nix
@@ -14,10 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ zlib python2 ];
 
-  NIX_CFLAGS_COMPILE = [
-    "-Wno-error=maybe-uninitialized"
-    "-Wno-error=pessimizing-move"
-  ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=maybe-uninitialized -Wno-error=pessimizing-move";
 
   preConfigure = ''
     sed -i 's|/usr/bin/env python|${python2}/bin/python|' src/python/lib/makeRunScript.py
diff --git a/pkgs/applications/science/chemistry/avogadro/default.nix b/pkgs/applications/science/chemistry/avogadro/default.nix
index f5c6d79e28aa5..061efa69d153e 100644
--- a/pkgs/applications/science/chemistry/avogadro/default.nix
+++ b/pkgs/applications/science/chemistry/avogadro/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkg-config doxygen ];
 
-  NIX_CFLAGS_COMPILE = "-include ${libGLU.dev}/include/GL/glu.h";
+  env.NIX_CFLAGS_COMPILE = "-include ${libGLU.dev}/include/GL/glu.h";
 
   patches = [
     (fetchurl {
diff --git a/pkgs/applications/science/chemistry/pymol/default.nix b/pkgs/applications/science/chemistry/pymol/default.nix
index 2df8b0e6d4739..27ba437efa100 100644
--- a/pkgs/applications/science/chemistry/pymol/default.nix
+++ b/pkgs/applications/science/chemistry/pymol/default.nix
@@ -29,7 +29,7 @@ python3Packages.buildPythonApplication rec {
   };
 
   buildInputs = [ python3Packages.numpy glew glm freeglut libpng libxml2 tk freetype msgpack ];
-  NIX_CFLAGS_COMPILE = "-I ${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = "-I ${libxml2.dev}/include/libxml2";
   hardeningDisable = [ "format" ];
 
   setupPyBuildFlags = [ "--glut" ];
diff --git a/pkgs/applications/science/electronics/magic-vlsi/default.nix b/pkgs/applications/science/electronics/magic-vlsi/default.nix
index 82d8dbd2ddc44..c04f9f3c5b1fe 100644
--- a/pkgs/applications/science/electronics/magic-vlsi/default.nix
+++ b/pkgs/applications/science/electronics/magic-vlsi/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     patchShebangs scripts/*
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
+  env.NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
 
   patches = [
     ./0001-strip-bin-prefix.patch
diff --git a/pkgs/applications/science/logic/avy/default.nix b/pkgs/applications/science/logic/avy/default.nix
index fe2f30a55a33d..ac5fa3415f8be 100644
--- a/pkgs/applications/science/logic/avy/default.nix
+++ b/pkgs/applications/science/logic/avy/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ zlib boost.out boost.dev ];
-  NIX_CFLAGS_COMPILE = toString ([ "-Wno-narrowing" ]
+  env.NIX_CFLAGS_COMPILE = toString ([ "-Wno-narrowing" ]
     # Squelch endless stream of warnings on same few things
     ++ lib.optionals stdenv.cc.isClang [
       "-Wno-empty-body"
diff --git a/pkgs/applications/science/logic/coq/default.nix b/pkgs/applications/science/logic/coq/default.nix
index 9d6212fef1126..24e77bf724588 100644
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@@ -158,7 +158,8 @@ self = stdenv.mkDerivation {
     )
   '';
 
-  prefixKey = "-prefix ";
+  prefixKey = "-prefix";
+  prefixAsSeperateFlag = true;
 
   buildFlags = [ "revision" "coq" "coqide" "bin/votour" ];
 
diff --git a/pkgs/applications/science/logic/elan/default.nix b/pkgs/applications/science/logic/elan/default.nix
index d20be86daf0b3..3c06558cb34b6 100644
--- a/pkgs/applications/science/logic/elan/default.nix
+++ b/pkgs/applications/science/logic/elan/default.nix
@@ -20,11 +20,11 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
 
-  OPENSSL_NO_VENDOR = 1;
+  env.OPENSSL_NO_VENDOR = 1;
   buildInputs = [ curl zlib openssl ]
     ++ lib.optional stdenv.isDarwin libiconv;
 
-  cargoBuildFlags = [ "--features no-self-update" ];
+  cargoBuildFlags = [ "--features" "no-self-update" ];
 
   patches = lib.optionals stdenv.isLinux [
     # Run patchelf on the downloaded binaries.
diff --git a/pkgs/applications/science/logic/ott/default.nix b/pkgs/applications/science/logic/ott/default.nix
index 8752c4ef59d43..c01325e9b7673 100644
--- a/pkgs/applications/science/logic/ott/default.nix
+++ b/pkgs/applications/science/logic/ott/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config opaline ];
   buildInputs = [ ocaml ];
 
-  installTargets = "ott.install";
+  installTargets = [ "ott.install" ];
 
   postInstall = ''
     opaline -prefix $out
diff --git a/pkgs/applications/science/machine-learning/shogun/default.nix b/pkgs/applications/science/machine-learning/shogun/default.nix
index 47b826078f24d..1c79a28b2aac0 100644
--- a/pkgs/applications/science/machine-learning/shogun/default.nix
+++ b/pkgs/applications/science/machine-learning/shogun/default.nix
@@ -62,8 +62,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  CCACHE_DISABLE="1";
-  CCACHE_DIR=".ccache";
+  env.CCACHE_DISABLE="1";
+  env.CCACHE_DIR=".ccache";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = with lib; [
@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
     ++ optionals (pythonSupport) (with pythonPackages; [ python ply numpy ])
     ++ optional  (opencvSupport) opencv;
 
-  NIX_CFLAGS_COMPILE="-faligned-new";
+  env.NIX_CFLAGS_COMPILE="-faligned-new";
 
   cmakeFlags =
   let
diff --git a/pkgs/applications/science/math/calculix/default.nix b/pkgs/applications/science/math/calculix/default.nix
index e9766b32c2a48..8e14747abf165 100644
--- a/pkgs/applications/science/math/calculix/default.nix
+++ b/pkgs/applications/science/math/calculix/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ arpack spooles blas lapack ];
 
-  NIX_CFLAGS_COMPILE = "-I${spooles}/include/spooles";
+  env.NIX_CFLAGS_COMPILE = "-I${spooles}/include/spooles";
 
   patches = [
     ./calculix.patch
diff --git a/pkgs/applications/science/math/gfm/default.nix b/pkgs/applications/science/math/gfm/default.nix
index 1078be99c3a96..8634dd58ad3b6 100644
--- a/pkgs/applications/science/math/gfm/default.nix
+++ b/pkgs/applications/science/math/gfm/default.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     libticonv
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${libticables2}/include/tilp2";
+  env.NIX_CFLAGS_COMPILE = "-I${libticables2}/include/tilp2";
 
   meta = with lib; {
     changelog = "http://lpg.ticalc.org/prj_tilp/news.html";
diff --git a/pkgs/applications/science/math/giac/default.nix b/pkgs/applications/science/math/giac/default.nix
index 4700402ff21e2..695e5f835f0c6 100644
--- a/pkgs/applications/science/math/giac/default.nix
+++ b/pkgs/applications/science/math/giac/default.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
   configure:16230: g++ -o conftest -g -O2   conftest.cpp -lntl  -llapack -lblas -lgfortran -ldl -lpng16 -lm -lmpfi -lmpfr -lgmp  >&5
   /nix/store/y9c1v4x7y39j2rfbg17agjwqdzxpsn18-ntl-11.3.2/lib/libntl.so: undefined reference to `pthread_key_create'
   */
-  NIX_CFLAGS_LINK="-lpthread";
+  env.NIX_CFLAGS_LINK="-lpthread";
 
   # xcas Phys and Turtle menus are broken with split outputs
   # and interactive use is likely to need docs
diff --git a/pkgs/applications/science/misc/boinc/default.nix b/pkgs/applications/science/misc/boinc/default.nix
index 460ea1408ecaa..e51a975a30f14 100644
--- a/pkgs/applications/science/misc/boinc/default.nix
+++ b/pkgs/applications/science/misc/boinc/default.nix
@@ -26,11 +26,11 @@ stdenv.mkDerivation rec {
     libnotify patchelf libX11 libxcb xcbutil
   ];
 
-  NIX_LDFLAGS = "-lX11";
+  env.NIX_LDFLAGS = "-lX11";
 
   preConfigure = ''
     ./_autosetup
-    configureFlags="$configureFlags --sysconfdir=$out/etc"
+    configureFlags+=("--sysconfdir=$out/etc")
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/science/misc/golly/beta.nix b/pkgs/applications/science/misc/golly/beta.nix
index 7741f7ba65bbf..d8f7a1d9baa64 100644
--- a/pkgs/applications/science/misc/golly/beta.nix
+++ b/pkgs/applications/science/misc/golly/beta.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   makeFlags=[
     "AM_LDFLAGS="
   ];
-  NIX_LDFLAGS="-l${python2.libPrefix} -lperl -ldl -lGL";
+  env.NIX_LDFLAGS="-l${python2.libPrefix} -lperl -ldl -lGL";
   preConfigure=''
     export NIX_LDFLAGS="$NIX_LDFLAGS -L$(dirname "$(find ${perl} -name libperl.so)")"
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE
diff --git a/pkgs/applications/science/misc/golly/default.nix b/pkgs/applications/science/misc/golly/default.nix
index be61ec86b3245..b4f15641e3114 100644
--- a/pkgs/applications/science/misc/golly/default.nix
+++ b/pkgs/applications/science/misc/golly/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   makeFlags=[
     "AM_LDFLAGS="
   ];
-  NIX_LDFLAGS="-l${python2.libPrefix} -lperl";
+  env.NIX_LDFLAGS="-l${python2.libPrefix} -lperl";
   preConfigure=''
     export NIX_LDFLAGS="$NIX_LDFLAGS -L$(dirname "$(find ${perl} -name libperl.so)")"
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE
diff --git a/pkgs/applications/science/misc/gplates/default.nix b/pkgs/applications/science/misc/gplates/default.nix
index d0315d1596742..69d4f5633cb1c 100644
--- a/pkgs/applications/science/misc/gplates/default.nix
+++ b/pkgs/applications/science/misc/gplates/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  NIX_CFLAGS_LINK="-ldl -lpthread -lutil";
+  env.NIX_CFLAGS_LINK = "-ldl -lpthread -lutil";
 
   meta = with lib; {
     description = "Desktop software for the interactive visualisation of plate-tectonics";
diff --git a/pkgs/applications/science/misc/vite/default.nix b/pkgs/applications/science/misc/vite/default.nix
index ed9d185287567..1c596fcf58084 100644
--- a/pkgs/applications/science/misc/vite/default.nix
+++ b/pkgs/applications/science/misc/vite/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ qt4 libGLU libGL ];
 
-  NIX_LDFLAGS = "-lGLU";
+  env.NIX_LDFLAGS = "-lGLU";
 
   meta = {
     description = "Visual Trace Explorer (ViTE), a tool to visualize execution traces";
diff --git a/pkgs/applications/science/physics/xfitter/default.nix b/pkgs/applications/science/physics/xfitter/default.nix
index 4390826ccee02..10da0af20c49d 100644
--- a/pkgs/applications/science/physics/xfitter/default.nix
+++ b/pkgs/applications/science/physics/xfitter/default.nix
@@ -50,8 +50,8 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  NIX_CFLAGS_COMPILE = lib.optional (stdenv.hostPlatform.libc == "glibc") "-I${libtirpc.dev}/include/tirpc";
-  NIX_LDFLAGS = lib.optional (stdenv.hostPlatform.libc == "glibc") "-ltirpc";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.hostPlatform.libc == "glibc") "-I${libtirpc.dev}/include/tirpc";
+  env.NIX_LDFLAGS = lib.optionalString (stdenv.hostPlatform.libc == "glibc") "-ltirpc";
 
   meta = with lib; {
     description = "The xFitter project is an open source QCD fit framework ready to extract PDFs and assess the impact of new data";
diff --git a/pkgs/applications/terminal-emulators/foot/default.nix b/pkgs/applications/terminal-emulators/foot/default.nix
index 5062329834c4c..1b092b09719c0 100644
--- a/pkgs/applications/terminal-emulators/foot/default.nix
+++ b/pkgs/applications/terminal-emulators/foot/default.nix
@@ -119,7 +119,7 @@ stdenv.mkDerivation rec {
 
   # recommended build flags for performance optimized foot builds
   # https://codeberg.org/dnkl/foot/src/branch/master/INSTALL.md#release-build
-  CFLAGS =
+  env.CFLAGS =
     if !doPgo
     then "-O3 -fno-plt"
     else pgoCflags;
diff --git a/pkgs/applications/terminal-emulators/mlterm/default.nix b/pkgs/applications/terminal-emulators/mlterm/default.nix
index b9f7d4ef677be..11aed38a4f769 100644
--- a/pkgs/applications/terminal-emulators/mlterm/default.nix
+++ b/pkgs/applications/terminal-emulators/mlterm/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
       --replace "-m 2755 -g utmp" " " \
       --replace "-m 4755 -o root" " "
   '';
-  NIX_LDFLAGS = lib.optionalString (!stdenv.isDarwin) "
+  env.NIX_LDFLAGS = lib.optionalString (!stdenv.isDarwin) "
     -L${stdenv.cc.cc.lib}/lib
     -lX11 -lgdk_pixbuf-2.0 -lcairo -lfontconfig -lfreetype -lXft
     -lvte-2.91 -lgtk-3 -lharfbuzz -lfribidi -lm17n
diff --git a/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix b/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
index 02f1b100f49fa..24c6d617b136c 100644
--- a/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
+++ b/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
@@ -55,8 +55,8 @@ stdenv.mkDerivation {
     (enableFeature unicode3Support "unicode3")
   ];
 
-  LDFLAGS = [ "-lfontconfig" "-lXrender" "-lpthread" ];
-  CFLAGS = [ "-I${freetype.dev}/include/freetype2" ];
+  env.LDFLAGS = "-lfontconfig -lXrender -lpthread";
+  env.CFLAGS = "-I${freetype.dev}/include/freetype2";
 
   preConfigure =
     ''
diff --git a/pkgs/applications/terminal-emulators/xterm/default.nix b/pkgs/applications/terminal-emulators/xterm/default.nix
index a5db50657077b..5bff2fd79608e 100644
--- a/pkgs/applications/terminal-emulators/xterm/default.nix
+++ b/pkgs/applications/terminal-emulators/xterm/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional enableDecLocator "--enable-dec-locator";
 
   # Work around broken "plink.sh".
-  NIX_LDFLAGS = "-lXmu -lXt -lICE -lX11 -lfontconfig";
+  env.NIX_LDFLAGS = "-lXmu -lXt -lICE -lX11 -lfontconfig";
 
   # Hack to get xterm built with the feature of releasing a possible setgid of 'utmp',
   # decided by the sysadmin to allow the xterm reporting to /var/run/utmp
diff --git a/pkgs/applications/version-management/commitizen/node-composition.nix b/pkgs/applications/version-management/commitizen/node-composition.nix
index 0769168a78fa3..edb1aa46608d2 100644
--- a/pkgs/applications/version-management/commitizen/node-composition.nix
+++ b/pkgs/applications/version-management/commitizen/node-composition.nix
@@ -5,9 +5,9 @@
   }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-12_x"}:
 
 let
-  nodeEnv = import ./node-env.nix {
-    inherit (pkgs) lib stdenv python2 util-linux runCommand writeTextFile;
-    inherit nodejs;
+  nodeEnv = import ../../../development/node-packages/node-env.nix {
+    inherit (pkgs) lib stdenv python2 runCommand writeTextFile jq;
+    inherit pkgs nodejs;
     libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
   };
 in
diff --git a/pkgs/applications/version-management/commitizen/node-env.nix b/pkgs/applications/version-management/commitizen/node-env.nix
deleted file mode 100644
index 262df27e464fe..0000000000000
--- a/pkgs/applications/version-management/commitizen/node-env.nix
+++ /dev/null
@@ -1,542 +0,0 @@
-# This file originates from node2nix
-
-{lib, stdenv, nodejs, python2, util-linux, libtool, runCommand, writeTextFile}:
-
-let
-  python = if nodejs ? python then nodejs.python else python2;
-
-  # Create a tar wrapper that filters all the 'Ignoring unknown extended header keyword' noise
-  tarWrapper = runCommand "tarWrapper" {} ''
-    mkdir -p $out/bin
-
-    cat > $out/bin/tar <<EOF
-    #! ${stdenv.shell} -e
-    $(type -p tar) "\$@" --warning=no-unknown-keyword --delay-directory-restore
-    EOF
-
-    chmod +x $out/bin/tar
-  '';
-
-  # Function that generates a TGZ file from a NPM project
-  buildNodeSourceDist =
-    { name, version, src, ... }:
-
-    stdenv.mkDerivation {
-      name = "node-tarball-${name}-${version}";
-      inherit src;
-      buildInputs = [ nodejs ];
-      buildPhase = ''
-        export HOME=$TMPDIR
-        tgzFile=$(npm pack | tail -n 1) # Hooks to the pack command will add output (https://docs.npmjs.com/misc/scripts)
-      '';
-      installPhase = ''
-        mkdir -p $out/tarballs
-        mv $tgzFile $out/tarballs
-        mkdir -p $out/nix-support
-        echo "file source-dist $out/tarballs/$tgzFile" >> $out/nix-support/hydra-build-products
-      '';
-    };
-
-  includeDependencies = {dependencies}:
-    lib.optionalString (dependencies != [])
-      (lib.concatMapStrings (dependency:
-        ''
-          # Bundle the dependencies of the package
-          mkdir -p node_modules
-          cd node_modules
-
-          # Only include dependencies if they don't exist. They may also be bundled in the package.
-          if [ ! -e "${dependency.name}" ]
-          then
-              ${composePackage dependency}
-          fi
-
-          cd ..
-        ''
-      ) dependencies);
-
-  # Recursively composes the dependencies of a package
-  composePackage = { name, packageName, src, dependencies ? [], ... }@args:
-    builtins.addErrorContext "while evaluating node package '${packageName}'" ''
-      DIR=$(pwd)
-      cd $TMPDIR
-
-      unpackFile ${src}
-
-      # Make the base dir in which the target dependency resides first
-      mkdir -p "$(dirname "$DIR/${packageName}")"
-
-      if [ -f "${src}" ]
-      then
-          # Figure out what directory has been unpacked
-          packageDir="$(find . -maxdepth 1 -type d | tail -1)"
-
-          # Restore write permissions to make building work
-          find "$packageDir" -type d -exec chmod u+x {} \;
-          chmod -R u+w "$packageDir"
-
-          # Move the extracted tarball into the output folder
-          mv "$packageDir" "$DIR/${packageName}"
-      elif [ -d "${src}" ]
-      then
-          # Get a stripped name (without hash) of the source directory.
-          # On old nixpkgs it's already set internally.
-          if [ -z "$strippedName" ]
-          then
-              strippedName="$(stripHash ${src})"
-          fi
-
-          # Restore write permissions to make building work
-          chmod -R u+w "$strippedName"
-
-          # Move the extracted directory into the output folder
-          mv "$strippedName" "$DIR/${packageName}"
-      fi
-
-      # Unset the stripped name to not confuse the next unpack step
-      unset strippedName
-
-      # Include the dependencies of the package
-      cd "$DIR/${packageName}"
-      ${includeDependencies { inherit dependencies; }}
-      cd ..
-      ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
-    '';
-
-  pinpointDependencies = {dependencies, production}:
-    let
-      pinpointDependenciesFromPackageJSON = writeTextFile {
-        name = "pinpointDependencies.js";
-        text = ''
-          var fs = require('fs');
-          var path = require('path');
-
-          function resolveDependencyVersion(location, name) {
-              if(location == process.env['NIX_STORE']) {
-                  return null;
-              } else {
-                  var dependencyPackageJSON = path.join(location, "node_modules", name, "package.json");
-
-                  if(fs.existsSync(dependencyPackageJSON)) {
-                      var dependencyPackageObj = JSON.parse(fs.readFileSync(dependencyPackageJSON));
-
-                      if(dependencyPackageObj.name == name) {
-                          return dependencyPackageObj.version;
-                      }
-                  } else {
-                      return resolveDependencyVersion(path.resolve(location, ".."), name);
-                  }
-              }
-          }
-
-          function replaceDependencies(dependencies) {
-              if(typeof dependencies == "object" && dependencies !== null) {
-                  for(var dependency in dependencies) {
-                      var resolvedVersion = resolveDependencyVersion(process.cwd(), dependency);
-
-                      if(resolvedVersion === null) {
-                          process.stderr.write("WARNING: cannot pinpoint dependency: "+dependency+", context: "+process.cwd()+"\n");
-                      } else {
-                          dependencies[dependency] = resolvedVersion;
-                      }
-                  }
-              }
-          }
-
-          /* Read the package.json configuration */
-          var packageObj = JSON.parse(fs.readFileSync('./package.json'));
-
-          /* Pinpoint all dependencies */
-          replaceDependencies(packageObj.dependencies);
-          if(process.argv[2] == "development") {
-              replaceDependencies(packageObj.devDependencies);
-          }
-          replaceDependencies(packageObj.optionalDependencies);
-
-          /* Write the fixed package.json file */
-          fs.writeFileSync("package.json", JSON.stringify(packageObj, null, 2));
-        '';
-      };
-    in
-    ''
-      node ${pinpointDependenciesFromPackageJSON} ${if production then "production" else "development"}
-
-      ${lib.optionalString (dependencies != [])
-        ''
-          if [ -d node_modules ]
-          then
-              cd node_modules
-              ${lib.concatMapStrings (dependency: pinpointDependenciesOfPackage dependency) dependencies}
-              cd ..
-          fi
-        ''}
-    '';
-
-  # Recursively traverses all dependencies of a package and pinpoints all
-  # dependencies in the package.json file to the versions that are actually
-  # being used.
-
-  pinpointDependenciesOfPackage = { packageName, dependencies ? [], production ? true, ... }@args:
-    ''
-      if [ -d "${packageName}" ]
-      then
-          cd "${packageName}"
-          ${pinpointDependencies { inherit dependencies production; }}
-          cd ..
-          ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
-      fi
-    '';
-
-  # Extract the Node.js source code which is used to compile packages with
-  # native bindings
-  nodeSources = runCommand "node-sources" {} ''
-    tar --no-same-owner --no-same-permissions -xf ${nodejs.src}
-    mv node-* $out
-  '';
-
-  # Script that adds _integrity fields to all package.json files to prevent NPM from consulting the cache (that is empty)
-  addIntegrityFieldsScript = writeTextFile {
-    name = "addintegrityfields.js";
-    text = ''
-      var fs = require('fs');
-      var path = require('path');
-
-      function augmentDependencies(baseDir, dependencies) {
-          for(var dependencyName in dependencies) {
-              var dependency = dependencies[dependencyName];
-
-              // Open package.json and augment metadata fields
-              var packageJSONDir = path.join(baseDir, "node_modules", dependencyName);
-              var packageJSONPath = path.join(packageJSONDir, "package.json");
-
-              if(fs.existsSync(packageJSONPath)) { // Only augment packages that exist. Sometimes we may have production installs in which development dependencies can be ignored
-                  console.log("Adding metadata fields to: "+packageJSONPath);
-                  var packageObj = JSON.parse(fs.readFileSync(packageJSONPath));
-
-                  if(dependency.integrity) {
-                      packageObj["_integrity"] = dependency.integrity;
-                  } else {
-                      packageObj["_integrity"] = "sha1-000000000000000000000000000="; // When no _integrity string has been provided (e.g. by Git dependencies), add a dummy one. It does not seem to harm and it bypasses downloads.
-                  }
-
-                  if(dependency.resolved) {
-                      packageObj["_resolved"] = dependency.resolved; // Adopt the resolved property if one has been provided
-                  } else {
-                      packageObj["_resolved"] = dependency.version; // Set the resolved version to the version identifier. This prevents NPM from cloning Git repositories.
-                  }
-
-                  if(dependency.from !== undefined) { // Adopt from property if one has been provided
-                      packageObj["_from"] = dependency.from;
-                  }
-
-                  fs.writeFileSync(packageJSONPath, JSON.stringify(packageObj, null, 2));
-              }
-
-              // Augment transitive dependencies
-              if(dependency.dependencies !== undefined) {
-                  augmentDependencies(packageJSONDir, dependency.dependencies);
-              }
-          }
-      }
-
-      if(fs.existsSync("./package-lock.json")) {
-          var packageLock = JSON.parse(fs.readFileSync("./package-lock.json"));
-
-          if(packageLock.lockfileVersion !== 1) {
-             process.stderr.write("Sorry, I only understand lock file version 1!\n");
-             process.exit(1);
-          }
-
-          if(packageLock.dependencies !== undefined) {
-              augmentDependencies(".", packageLock.dependencies);
-          }
-      }
-    '';
-  };
-
-  # Reconstructs a package-lock file from the node_modules/ folder structure and package.json files with dummy sha1 hashes
-  reconstructPackageLock = writeTextFile {
-    name = "addintegrityfields.js";
-    text = ''
-      var fs = require('fs');
-      var path = require('path');
-
-      var packageObj = JSON.parse(fs.readFileSync("package.json"));
-
-      var lockObj = {
-          name: packageObj.name,
-          version: packageObj.version,
-          lockfileVersion: 1,
-          requires: true,
-          dependencies: {}
-      };
-
-      function augmentPackageJSON(filePath, dependencies) {
-          var packageJSON = path.join(filePath, "package.json");
-          if(fs.existsSync(packageJSON)) {
-              var packageObj = JSON.parse(fs.readFileSync(packageJSON));
-              dependencies[packageObj.name] = {
-                  version: packageObj.version,
-                  integrity: "sha1-000000000000000000000000000=",
-                  dependencies: {}
-              };
-              processDependencies(path.join(filePath, "node_modules"), dependencies[packageObj.name].dependencies);
-          }
-      }
-
-      function processDependencies(dir, dependencies) {
-          if(fs.existsSync(dir)) {
-              var files = fs.readdirSync(dir);
-
-              files.forEach(function(entry) {
-                  var filePath = path.join(dir, entry);
-                  var stats = fs.statSync(filePath);
-
-                  if(stats.isDirectory()) {
-                      if(entry.substr(0, 1) == "@") {
-                          // When we encounter a namespace folder, augment all packages belonging to the scope
-                          var pkgFiles = fs.readdirSync(filePath);
-
-                          pkgFiles.forEach(function(entry) {
-                              if(stats.isDirectory()) {
-                                  var pkgFilePath = path.join(filePath, entry);
-                                  augmentPackageJSON(pkgFilePath, dependencies);
-                              }
-                          });
-                      } else {
-                          augmentPackageJSON(filePath, dependencies);
-                      }
-                  }
-              });
-          }
-      }
-
-      processDependencies("node_modules", lockObj.dependencies);
-
-      fs.writeFileSync("package-lock.json", JSON.stringify(lockObj, null, 2));
-    '';
-  };
-
-  prepareAndInvokeNPM = {packageName, bypassCache, reconstructLock, npmFlags, production}:
-    let
-      forceOfflineFlag = if bypassCache then "--offline" else "--registry http://www.example.com";
-    in
-    ''
-        # Pinpoint the versions of all dependencies to the ones that are actually being used
-        echo "pinpointing versions of dependencies..."
-        source $pinpointDependenciesScriptPath
-
-        # Patch the shebangs of the bundled modules to prevent them from
-        # calling executables outside the Nix store as much as possible
-        patchShebangs .
-
-        # Deploy the Node.js package by running npm install. Since the
-        # dependencies have been provided already by ourselves, it should not
-        # attempt to install them again, which is good, because we want to make
-        # it Nix's responsibility. If it needs to install any dependencies
-        # anyway (e.g. because the dependency parameters are
-        # incomplete/incorrect), it fails.
-        #
-        # The other responsibilities of NPM are kept -- version checks, build
-        # steps, postprocessing etc.
-
-        export HOME=$TMPDIR
-        cd "${packageName}"
-        runHook preRebuild
-
-        ${lib.optionalString bypassCache ''
-          ${lib.optionalString reconstructLock ''
-            if [ -f package-lock.json ]
-            then
-                echo "WARNING: Reconstruct lock option enabled, but a lock file already exists!"
-                echo "This will most likely result in version mismatches! We will remove the lock file and regenerate it!"
-                rm package-lock.json
-            else
-                echo "No package-lock.json file found, reconstructing..."
-            fi
-
-            node ${reconstructPackageLock}
-          ''}
-
-          node ${addIntegrityFieldsScript}
-        ''}
-
-        npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${lib.optionalString production "--production"} rebuild
-
-        if [ "''${dontNpmInstall-}" != "1" ]
-        then
-            # NPM tries to download packages even when they already exist if npm-shrinkwrap is used.
-            rm -f npm-shrinkwrap.json
-
-            npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${lib.optionalString production "--production"} install
-        fi
-    '';
-
-  # Builds and composes an NPM package including all its dependencies
-  buildNodePackage =
-    { name
-    , packageName
-    , version
-    , dependencies ? []
-    , buildInputs ? []
-    , production ? true
-    , npmFlags ? ""
-    , dontNpmInstall ? false
-    , bypassCache ? false
-    , reconstructLock ? false
-    , preRebuild ? ""
-    , dontStrip ? true
-    , unpackPhase ? "true"
-    , buildPhase ? "true"
-    , ... }@args:
-
-    let
-      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" ];
-    in
-    stdenv.mkDerivation ({
-      name = "node_${name}-${version}";
-      buildInputs = [ tarWrapper python nodejs ]
-        ++ lib.optional (stdenv.isLinux) util-linux
-        ++ lib.optional (stdenv.isDarwin) libtool
-        ++ buildInputs;
-
-      inherit nodejs;
-
-      inherit dontStrip; # Stripping may fail a build for some package deployments
-      inherit dontNpmInstall preRebuild unpackPhase buildPhase;
-
-      compositionScript = composePackage args;
-      pinpointDependenciesScript = pinpointDependenciesOfPackage args;
-
-      passAsFile = [ "compositionScript" "pinpointDependenciesScript" ];
-
-      installPhase = ''
-        # Create and enter a root node_modules/ folder
-        mkdir -p $out/lib/node_modules
-        cd $out/lib/node_modules
-
-        # Compose the package and all its dependencies
-        source $compositionScriptPath
-
-        ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
-
-        # Create symlink to the deployed executable folder, if applicable
-        if [ -d "$out/lib/node_modules/.bin" ]
-        then
-            ln -s $out/lib/node_modules/.bin $out/bin
-        fi
-
-        # Create symlinks to the deployed manual page folders, if applicable
-        if [ -d "$out/lib/node_modules/${packageName}/man" ]
-        then
-            mkdir -p $out/share
-            for dir in "$out/lib/node_modules/${packageName}/man/"*
-            do
-                mkdir -p $out/share/man/$(basename "$dir")
-                for page in "$dir"/*
-                do
-                    ln -s $page $out/share/man/$(basename "$dir")
-                done
-            done
-        fi
-
-        # Run post install hook, if provided
-        runHook postInstall
-      '';
-    } // extraArgs);
-
-  # Builds a development shell
-  buildNodeShell =
-    { name
-    , packageName
-    , version
-    , src
-    , dependencies ? []
-    , buildInputs ? []
-    , production ? true
-    , npmFlags ? ""
-    , dontNpmInstall ? false
-    , bypassCache ? false
-    , reconstructLock ? false
-    , dontStrip ? true
-    , unpackPhase ? "true"
-    , buildPhase ? "true"
-    , ... }@args:
-
-    let
-      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" ];
-
-      nodeDependencies = stdenv.mkDerivation ({
-        name = "node-dependencies-${name}-${version}";
-
-        buildInputs = [ tarWrapper python nodejs ]
-          ++ lib.optional (stdenv.isLinux) util-linux
-          ++ lib.optional (stdenv.isDarwin) libtool
-          ++ buildInputs;
-
-        inherit dontStrip; # Stripping may fail a build for some package deployments
-        inherit dontNpmInstall unpackPhase buildPhase;
-
-        includeScript = includeDependencies { inherit dependencies; };
-        pinpointDependenciesScript = pinpointDependenciesOfPackage args;
-
-        passAsFile = [ "includeScript" "pinpointDependenciesScript" ];
-
-        installPhase = ''
-          mkdir -p $out/${packageName}
-          cd $out/${packageName}
-
-          source $includeScriptPath
-
-          # Create fake package.json to make the npm commands work properly
-          cp ${src}/package.json .
-          chmod 644 package.json
-          ${lib.optionalString bypassCache ''
-            if [ -f ${src}/package-lock.json ]
-            then
-                cp ${src}/package-lock.json .
-            fi
-          ''}
-
-          # Go to the parent folder to make sure that all packages are pinpointed
-          cd ..
-          ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
-
-          ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
-
-          # Expose the executables that were installed
-          cd ..
-          ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
-
-          mv ${packageName} lib
-          ln -s $out/lib/node_modules/.bin $out/bin
-        '';
-      } // extraArgs);
-    in
-    stdenv.mkDerivation {
-      name = "node-shell-${name}-${version}";
-
-      buildInputs = [ python nodejs ] ++ lib.optional (stdenv.isLinux) util-linux ++ buildInputs;
-      buildCommand = ''
-        mkdir -p $out/bin
-        cat > $out/bin/shell <<EOF
-        #! ${stdenv.shell} -e
-        $shellHook
-        exec ${stdenv.shell}
-        EOF
-        chmod +x $out/bin/shell
-      '';
-
-      # Provide the dependencies in a development shell through the NODE_PATH environment variable
-      inherit nodeDependencies;
-      shellHook = lib.optionalString (dependencies != []) ''
-        export NODE_PATH=${nodeDependencies}/lib/node_modules
-        export PATH="${nodeDependencies}/bin:$PATH"
-      '';
-    };
-in
-{
-  buildNodeSourceDist = lib.makeOverridable buildNodeSourceDist;
-  buildNodePackage = lib.makeOverridable buildNodePackage;
-  buildNodeShell = lib.makeOverridable buildNodeShell;
-}
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 8ad150f13060a..d21110d6a47fd 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -78,8 +78,8 @@ stdenv.mkDerivation {
     ++ lib.optionals withLibsecret [ pkg-config glib libsecret ];
 
   # required to support pthread_cancel()
-  NIX_LDFLAGS = lib.optionalString (!stdenv.cc.isClang) "-lgcc_s"
-              + lib.optionalString (stdenv.isFreeBSD) "-lthr";
+  env.NIX_LDFLAGS = lib.optionalString (!stdenv.cc.isClang) "-lgcc_s"
+              + lib.optionalString (stdenv.isFreeBSD) " -lthr";
 
   configureFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "ac_cv_fread_reads_directories=yes"
diff --git a/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix b/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
index a40e959a50a41..d1c96ef5a9b4f 100644
--- a/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
     "SVN_INCLUDE=${subversion.dev}/include/subversion-1"
   ];
 
-  NIX_LDFLAGS = "-lsvn_fs-1";
+  env.NIX_LDFLAGS = "-lsvn_fs-1";
 
   dontWrapQtApps = true;
 
diff --git a/pkgs/applications/version-management/git-review/default.nix b/pkgs/applications/version-management/git-review/default.nix
index 38eed2dd5af23..a1c21954ec631 100644
--- a/pkgs/applications/version-management/git-review/default.nix
+++ b/pkgs/applications/version-management/git-review/default.nix
@@ -12,7 +12,7 @@ buildPythonApplication rec {
 
   # Manually set version because prb wants to get it from the git
   # upstream repository (and we are installing from tarball instead)
-  PBR_VERSION = version;
+  env.PBR_VERSION = version;
 
   src = fetchurl {
     url = "https://opendev.org/opendev/${pname}/archive/${version}.tar.gz";
diff --git a/pkgs/applications/version-management/gitlab/default.nix b/pkgs/applications/version-management/gitlab/default.nix
index 3e70e47dc95fa..6e11a032aaed8 100644
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@@ -58,8 +58,8 @@ let
     patches = [ ./remove-hardcoded-locations.patch ];
     # One of the patches uses this variable - if it's unset, execution
     # of rake tasks fails.
-    GITLAB_LOG_PATH = "log";
-    FOSS_ONLY = !gitlabEnterprise;
+    env.GITLAB_LOG_PATH = "log";
+    env.FOSS_ONLY = !gitlabEnterprise;
 
     configurePhase = ''
       runHook preConfigure
diff --git a/pkgs/applications/version-management/gogs/default.nix b/pkgs/applications/version-management/gogs/default.nix
index c0b0021f8cbec..0b845b17248cf 100644
--- a/pkgs/applications/version-management/gogs/default.nix
+++ b/pkgs/applications/version-management/gogs/default.nix
@@ -29,11 +29,11 @@ buildGoModule rec {
 
   buildInputs = optional pamSupport pam;
 
-  buildFlags = [ "-tags" ];
-
-  buildFlagsArray =
-    (  optional sqliteSupport "sqlite"
-    ++ optional pamSupport "pam");
+  buildFlags = [
+    "-tags"
+      ( optionalString sqliteSupport "sqlite"
+      + optionalString pamSupport " pam")
+  ];
 
   postInstall = ''
 
diff --git a/pkgs/applications/version-management/rcs/default.nix b/pkgs/applications/version-management/rcs/default.nix
index f8143711318cc..b185760cc7250 100644
--- a/pkgs/applications/version-management/rcs/default.nix
+++ b/pkgs/applications/version-management/rcs/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     make $checkFlags check || print_logs_and_fail
   '';
 
-  NIX_CFLAGS_COMPILE = "-std=c99";
+  env.NIX_CFLAGS_COMPILE = "-std=c99";
 
   hardeningDisable = lib.optional stdenv.cc.isClang "format";
 
diff --git a/pkgs/applications/video/aegisub/default.nix b/pkgs/applications/video/aegisub/default.nix
index 7d041f60f48fb..f19100f811f36 100644
--- a/pkgs/applications/video/aegisub/default.nix
+++ b/pkgs/applications/video/aegisub/default.nix
@@ -133,11 +133,11 @@ stdenv.mkDerivation rec {
 
   # compat with icu61+
   # https://github.com/unicode-org/icu/blob/release-64-2/icu4c/readme.html#L554
-  CXXFLAGS = [ "-DU_USING_ICU_NAMESPACE=1" ];
+  env.CXXFLAGS = "-DU_USING_ICU_NAMESPACE=1";
 
   # this is fixed upstream though not yet in an officially released version,
   # should be fine remove on next release (if one ever happens)
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   postInstall = "ln -s $out/bin/aegisub-* $out/bin/aegisub";
 
diff --git a/pkgs/applications/video/byzanz/default.nix b/pkgs/applications/video/byzanz/default.nix
index a9eee05d238f8..89dbacb92423a 100644
--- a/pkgs/applications/video/byzanz/default.nix
+++ b/pkgs/applications/video/byzanz/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
     ./autogen.sh --prefix=$out
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ which gnome.gnome-common glib intltool libtool cairo gtk3 xorg.xwininfo xorg.libXdamage ]
diff --git a/pkgs/applications/video/handbrake/default.nix b/pkgs/applications/video/handbrake/default.nix
index e14d902681dfd..335bea44e0cae 100644
--- a/pkgs/applications/video/handbrake/default.nix
+++ b/pkgs/applications/video/handbrake/default.nix
@@ -123,9 +123,7 @@ _EOF
   ] ++ lib.optional (stdenv.isx86_32 || stdenv.isx86_64) "--harden";
 
   # NOTE: 2018-12-27: Check NixOS HandBrake test if changing
-  NIX_LDFLAGS = [
-    "-lx265"
-  ];
+  env.NIX_LDFLAGS = "-lx265";
 
   preBuild = ''
     cd build
diff --git a/pkgs/applications/video/kodi/unwrapped.nix b/pkgs/applications/video/kodi/unwrapped.nix
index ba35c24ecf578..184274647424c 100644
--- a/pkgs/applications/video/kodi/unwrapped.nix
+++ b/pkgs/applications/video/kodi/unwrapped.nix
@@ -129,7 +129,7 @@ in stdenv.mkDerivation {
       lirc
       mesa # for libEGL
     ]
-    ++ lib.optional x11Support [
+    ++ lib.optionals x11Support [
       libX11 xorgproto libXt libXmu libXext.dev libXdmcp
       libXinerama libXrandr.dev libXtst libXfixes
     ]
@@ -149,7 +149,7 @@ in stdenv.mkDerivation {
       # Not sure why ".dev" is needed here, but CMake doesn't find libxkbcommon otherwise
       libxkbcommon.dev
     ]
-    ++ lib.optional gbmSupport [
+    ++ lib.optionals gbmSupport [
       libxkbcommon.dev
       mesa.dev
       libinput.dev
diff --git a/pkgs/applications/video/mkvtoolnix/default.nix b/pkgs/applications/video/mkvtoolnix/default.nix
index 23bad049d6f88..56fe67bbc9374 100644
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@@ -50,8 +50,8 @@ stdenv.mkDerivation rec {
     (enableFeature withGUI "qt")
   ];
 
-  CXXFLAGS = optional stdenv.cc.isClang "-std=c++17";
-  LDFLAGS = optional stdenv.cc.isClang "-lc++fs";
+  env.CXXFLAGS = optionalString stdenv.cc.isClang "-std=c++17";
+  env.LDFLAGS = optionalString stdenv.cc.isClang "-lc++fs";
 
   dontWrapQtApps = true;
   postFixup = optionalString withGUI ''
diff --git a/pkgs/applications/video/mplayer/default.nix b/pkgs/applications/video/mplayer/default.nix
index b6bfa9d0dcf2f..9fff6d7b7b2ac 100644
--- a/pkgs/applications/video/mplayer/default.nix
+++ b/pkgs/applications/video/mplayer/default.nix
@@ -144,7 +144,6 @@ stdenv.mkDerivation rec {
   configureFlags = with lib; [
     "--enable-freetype"
     (if fontconfigSupport then "--enable-fontconfig" else "--disable-fontconfig")
-    (if x11Support then "--enable-x11 --enable-gl" else "--disable-x11 --disable-gl")
     (if xineramaSupport then "--enable-xinerama" else "--disable-xinerama")
     (if xvSupport then "--enable-xv" else "--disable-xv")
     (if alsaSupport then "--enable-alsa" else "--disable-alsa")
@@ -155,22 +154,23 @@ stdenv.mkDerivation rec {
     (if bluraySupport then "--enable-bluray" else "--disable-bluray")
     (if amrSupport then "--enable-libopencore_amrnb" else "--disable-libopencore_amrnb")
     (if cacaSupport then "--enable-caca" else "--disable-caca")
-    (if lameSupport then "--enable-mp3lame --disable-mp3lame-lavc" else "--disable-mp3lame --enable-mp3lame-lavc")
     (if speexSupport then "--enable-speex" else "--disable-speex")
     (if theoraSupport then "--enable-theora" else "--disable-theora")
-    (if x264Support then "--enable-x264 --disable-x264-lavc" else "--disable-x264 --enable-x264-lavc")
     (if jackaudioSupport then "" else "--disable-jack")
     (if pulseSupport then "--enable-pulse" else "--disable-pulse")
-    (if v4lSupport then "--enable-v4l2 --enable-tv-v4l2" else "--disable-v4l2 --disable-tv-v4l2")
     "--disable-xanim"
     "--disable-ivtv"
-    "--disable-xvid --disable-xvid-lavc"
+    "--disable-xvid" "--disable-xvid-lavc"
     "--disable-ossaudio"
     "--disable-ffmpeg_a"
     "--yasm=${buildPackages.yasm}/bin/yasm"
     # Note, the `target` vs `host` confusion is intensional.
     "--target=${stdenv.hostPlatform.config}"
-  ] ++ optional
+  ] ++ (if x11Support then [ "--enable-x11" "--enable-gl" ] else [ "--disable-x11" "--disable-gl" ])
+    ++ (if v4lSupport then [ "--enable-v4l2" "--enable-tv-v4l2" ] else [ "--disable-v4l2" "--disable-tv-v4l2" ])
+    ++ (if lameSupport then [ "--enable-mp3lame" "--disable-mp3lame-lavc" ] else [ "--disable-mp3lame" "--enable-mp3lame-lavc" ])
+    ++ (if x264Support then [ "--enable-x264" "--disable-x264-lavc" ] else [ "--disable-x264" "--enable-x264-lavc" ])
+    ++ optional
          (useUnfreeCodecs && codecs != null && !crossBuild)
          "--codecsdir=${codecs}"
     ++ optional
@@ -201,7 +201,7 @@ stdenv.mkDerivation rec {
     echo CONFIG_MPEGAUDIODSP=yes >> config.mak
   '';
 
-  NIX_LDFLAGS = with lib; toString (
+  env.NIX_LDFLAGS = with lib; toString (
        optional  fontconfigSupport "-lfontconfig"
     ++ optional  fribidiSupport "-lfribidi"
     ++ optionals x11Support [ "-lX11" "-lXext" ]
diff --git a/pkgs/applications/video/mpv/default.nix b/pkgs/applications/video/mpv/default.nix
index 99cb08a02a0be..83b0f35a2c005 100644
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@@ -130,7 +130,7 @@ in stdenv.mkDerivation rec {
     ;
   };
 
-  NIX_LDFLAGS = optionalString x11Support "-lX11 -lXext "
+  env.NIX_LDFLAGS = optionalString x11Support "-lX11 -lXext "
               + optionalString stdenv.isDarwin "-framework CoreFoundation";
 
   wafConfigureFlags = [
diff --git a/pkgs/applications/video/shotcut/default.nix b/pkgs/applications/video/shotcut/default.nix
index 3a9c4809c6230..55e40b7632e29 100644
--- a/pkgs/applications/video/shotcut/default.nix
+++ b/pkgs/applications/video/shotcut/default.nix
@@ -50,7 +50,7 @@ mkDerivation rec {
     qtgraphicaleffects
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${mlt.dev}/include/mlt++ -I${mlt.dev}/include/mlt";
+  env.NIX_CFLAGS_COMPILE = "-I${mlt.dev}/include/mlt++ -I${mlt.dev}/include/mlt";
   qmakeFlags = [
     "QMAKE_LRELEASE=${lib.getDev qttools}/bin/lrelease"
     "SHOTCUT_VERSION=${version}"
@@ -66,10 +66,10 @@ mkDerivation rec {
   '';
 
   qtWrapperArgs = [
-    "--prefix FREI0R_PATH : ${frei0r}/lib/frei0r-1"
-    "--prefix LADSPA_PATH : ${ladspaPlugins}/lib/ladspa"
-    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ jack1 SDL2 ]}"
-    "--prefix PATH : ${mlt}/bin"
+    "--prefix" "FREI0R_PATH" ":" "${frei0r}/lib/frei0r-1"
+    "--prefix" "LADSPA_PATH" ":" "${ladspaPlugins}/lib/ladspa"
+    "--prefix" "LD_LIBRARY_PATH" ":" (lib.makeLibraryPath [ jack1 SDL2 ])
+    "--prefix" "PATH" ":" "${mlt}/bin"
   ];
 
   postInstall = ''
diff --git a/pkgs/applications/video/vdr/plugins.nix b/pkgs/applications/video/vdr/plugins.nix
index 395de891eb93f..fecdf6198602a 100644
--- a/pkgs/applications/video/vdr/plugins.nix
+++ b/pkgs/applications/video/vdr/plugins.nix
@@ -241,7 +241,7 @@ in {
     libconvpp = stdenv.mkDerivation {
       name = "jowi24-libconv++-20130216";
       propagatedBuildInputs = [ libiconv ];
-      CXXFLAGS = "-std=gnu++11 -Os";
+      env.CXXFLAGS = "-std=gnu++11 -Os";
       src = fetchFromGitHub {
         owner = "jowi24";
         repo = "libconvpp";
@@ -257,7 +257,7 @@ in {
 
     liblogpp = stdenv.mkDerivation {
       name = "jowi24-liblogpp-20130216";
-      CXXFLAGS = "-std=gnu++11 -Os";
+      env.CXXFLAGS = "-std=gnu++11 -Os";
       src = fetchFromGitHub {
         owner = "jowi24";
         repo = "liblogpp";
@@ -273,7 +273,7 @@ in {
 
     libnetpp = stdenv.mkDerivation {
       name = "jowi24-libnet++-20180628";
-      CXXFLAGS = "-std=gnu++11 -Os";
+      env.CXXFLAGS = "-std=gnu++11 -Os";
       src = fetchFromGitHub {
         owner = "jowi24";
         repo = "libnetpp";
@@ -290,7 +290,7 @@ in {
 
     libfritzpp = stdenv.mkDerivation {
       name = "jowi24-libfritzpp-20131201";
-      CXXFLAGS = "-std=gnu++11 -Os";
+      env.CXXFLAGS = "-std=gnu++11 -Os";
       src = fetchFromGitHub {
         owner = "jowi24";
         repo = "libfritzpp";
diff --git a/pkgs/applications/video/vlc/default.nix b/pkgs/applications/video/vlc/default.nix
index adb7ba970e294..f896d33fe66d8 100644
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@@ -54,11 +54,11 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  LIVE555_PREFIX = if (!stdenv.hostPlatform.isAarch64) then live555 else null;
+  env.LIVE555_PREFIX = optionalString (!stdenv.hostPlatform.isAarch64) (toString live555);
 
   # vlc depends on a c11-gcc wrapper script which we don't have so we need to
   # set the path to the compiler
-  BUILDCC = "${stdenv.cc}/bin/gcc";
+  env.BUILDCC = "${stdenv.cc}/bin/gcc";
 
   postPatch = ''
     substituteInPlace modules/text_renderer/freetype/platform_fonts.h --replace \
diff --git a/pkgs/applications/video/wxcam/default.nix b/pkgs/applications/video/wxcam/default.nix
index f197abacee04e..2e3dfdc21a802 100644
--- a/pkgs/applications/video/wxcam/default.nix
+++ b/pkgs/applications/video/wxcam/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   buildInputs = with lib;
   [ pkg-config intltool libX11 libXv libSM gtk libglade wxGTK perlPackages.XMLParser xvidcore mjpegtools alsaLib libv4l cimg ];
 
-  NIX_CFLAGS_COMPILE="-I ${cimg}/include/cimg";
+  env.NIX_CFLAGS_COMPILE="-I ${cimg}/include/cimg";
 
   postUnpack = ''
     sed -ie 's|/usr/share/|'"$out/share/"'|g' $sourceRoot/Makefile.in
diff --git a/pkgs/applications/video/xvidcap/default.nix b/pkgs/applications/video/xvidcap/default.nix
index e0cca04098786..eedcbfcfa8bc8 100644
--- a/pkgs/applications/video/xvidcap/default.nix
+++ b/pkgs/applications/video/xvidcap/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   ] ++ (with perlPackages; [ perl XMLParser ]);
 
   # !!! don't know why this is necessary
-  NIX_LDFLAGS = "-lXext -lX11 -lz -lgcc_s";
+  env.NIX_LDFLAGS = "-lXext -lX11 -lz -lgcc_s";
 
   meta = with lib; {
     description = "Screencast video catpuring tool";
diff --git a/pkgs/applications/virtualization/bochs/default.nix b/pkgs/applications/virtualization/bochs/default.nix
index 3a8e9dc0bee7f..7d926411c4f0e 100644
--- a/pkgs/applications/virtualization/bochs/default.nix
+++ b/pkgs/applications/virtualization/bochs/default.nix
@@ -108,8 +108,8 @@ stdenv.mkDerivation rec {
          "--enable-es1370"
          "--enable-busmouse" ];
 
-  NIX_CFLAGS_COMPILE="-I${gtk2.dev}/include/gtk-2.0/ -I${libtool}/include/";
-  NIX_LDFLAGS="-L${libtool.lib}/lib";
+  env.NIX_CFLAGS_COMPILE="-I${gtk2.dev}/include/gtk-2.0/ -I${libtool}/include/";
+  env.NIX_LDFLAGS="-L${libtool.lib}/lib";
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/applications/virtualization/containerd/default.nix b/pkgs/applications/virtualization/containerd/default.nix
index fa504511513cd..1f1a96e3b30ba 100644
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@@ -28,8 +28,7 @@ buildGoPackage rec {
 
   buildFlags = [ "VERSION=v${version}" "REVISION=${src.rev}" ];
 
-  BUILDTAGS = [ ]
-    ++ lib.optional (btrfs-progs == null) "no_btrfs";
+  BUILDTAGS = lib.optionalString (btrfs-progs == null) "no_btrfs";
 
   buildPhase = ''
     cd go/src/${goPackagePath}
diff --git a/pkgs/applications/virtualization/crosvm/default.nix b/pkgs/applications/virtualization/crosvm/default.nix
index 848b93a5381c7..1ea4f911a8e01 100644
--- a/pkgs/applications/virtualization/crosvm/default.nix
+++ b/pkgs/applications/virtualization/crosvm/default.nix
@@ -73,7 +73,7 @@ in
       cp seccomp/${arch}/* $out/share/policy/
     '';
 
-    CROSVM_CARGO_TEST_KERNEL_BINARY =
+    env.CROSVM_CARGO_TEST_KERNEL_BINARY =
       lib.optionalString (stdenv.buildPlatform == stdenv.hostPlatform)
         "${linux}/${stdenv.hostPlatform.linux-kernel.target}";
 
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 954404e5268f8..45e7cefbd06d8 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -44,7 +44,7 @@ rec {
       buildInputs = oldAttrs.buildInputs ++ [ libseccomp ];
     });
 
-    docker-tini = tini.overrideAttrs  (oldAttrs: {
+    docker-tini = tini.overrideAttrs (oldAttrs: {
       name = "docker-init-${version}";
       inherit version;
       src = fetchFromGitHub {
@@ -57,7 +57,7 @@ rec {
       # Do not remove static from make files as we want a static binary
       patchPhase = "";
 
-      NIX_CFLAGS_COMPILE = "-DMINIMAL=ON";
+      env = oldAttrs.env // { NIX_CFLAGS_COMPILE = "-DMINIMAL=ON"; };
     });
 
     moby = buildGoPackage ((optionalAttrs (stdenv.isLinux)) rec {
@@ -109,11 +109,11 @@ rec {
         install -Dm644 ./contrib/init/systemd/docker.socket $out/etc/systemd/system/docker.socket
       '';
 
-      DOCKER_BUILDTAGS = []
+      env.DOCKER_BUILDTAGS = toString ([]
         ++ optional (systemd != null) [ "journald" ]
         ++ optional (btrfs-progs == null) "exclude_graphdriver_btrfs"
         ++ optional (lvm2 == null) "exclude_graphdriver_devicemapper"
-        ++ optional (libseccomp != null) "seccomp";
+        ++ optional (libseccomp != null) "seccomp");
     });
   in
     buildGoPackage ((optionalAttrs (stdenv.isLinux) {
diff --git a/pkgs/applications/virtualization/libnvidia-container/default.nix b/pkgs/applications/virtualization/libnvidia-container/default.nix
index dd16fb4d25a76..b4b2a930cff2e 100644
--- a/pkgs/applications/virtualization/libnvidia-container/default.nix
+++ b/pkgs/applications/virtualization/libnvidia-container/default.nix
@@ -70,8 +70,8 @@ stdenv.mkDerivation rec {
       --prefix LD_LIBRARY_PATH : /run/opengl-driver/lib:/run/opengl-driver-32/lib
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
-  NIX_LDFLAGS = [ "-L${libtirpc.dev}/lib" "-ltirpc" ];
+  env.NIX_CFLAGS_COMPILE = "-I${libtirpc.dev}/include/tirpc";
+  env.NIX_LDFLAGS = "-L${libtirpc.dev}/lib -ltirpc";
 
   nativeBuildInputs = [ pkg-config rpcsvc-proto makeWrapper ];
 
diff --git a/pkgs/applications/virtualization/looking-glass-client/default.nix b/pkgs/applications/virtualization/looking-glass-client/default.nix
index 345018bbe4efd..bf85a21000920 100644
--- a/pkgs/applications/virtualization/looking-glass-client/default.nix
+++ b/pkgs/applications/virtualization/looking-glass-client/default.nix
@@ -30,10 +30,10 @@ stdenv.mkDerivation rec {
     # Including our own patch here since upstream commit patch doesnt apply cleanly on B3
     ./0001-client-all-fix-more-maybe-uninitialized-when-O3-is-i.patch
   ];
-  patchFlags = "-p2";
+  patchFlags = [ "-p2" ];
 
   sourceRoot = "source/client";
-  NIX_CFLAGS_COMPILE = "-mavx"; # Fix some sort of AVX compiler problem.
+  env.NIX_CFLAGS_COMPILE = "-mavx"; # Fix some sort of AVX compiler problem.
 
   meta = with lib; {
     description = "A KVM Frame Relay (KVMFR) implementation";
diff --git a/pkgs/applications/virtualization/open-vm-tools/default.nix b/pkgs/applications/virtualization/open-vm-tools/default.nix
index e747995744431..dcab3f033a789 100644
--- a/pkgs/applications/virtualization/open-vm-tools/default.nix
+++ b/pkgs/applications/virtualization/open-vm-tools/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = builtins.toString [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     # igrone glib-2.62 deprecations
     # Drop in next stable release.
     "-DGLIB_DISABLE_DEPRECATION_WARNINGS"
diff --git a/pkgs/applications/virtualization/tini/default.nix b/pkgs/applications/virtualization/tini/default.nix
index dd7bcb19978c2..63c4d22afe65e 100644
--- a/pkgs/applications/virtualization/tini/default.nix
+++ b/pkgs/applications/virtualization/tini/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   patchPhase = "sed -i /tini-static/d CMakeLists.txt";
 
-  NIX_CFLAGS_COMPILE = "-DPR_SET_CHILD_SUBREAPER=36 -DPR_GET_CHILD_SUBREAPER=37";
+  env.NIX_CFLAGS_COMPILE = "-DPR_SET_CHILD_SUBREAPER=36 -DPR_GET_CHILD_SUBREAPER=37";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ glibc glibc.static ];
diff --git a/pkgs/applications/virtualization/virtualbox/default.nix b/pkgs/applications/virtualization/virtualbox/default.nix
index 4f792b4eb6e44..546c22b9f0b6c 100644
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@@ -32,7 +32,7 @@ let
       url = "https://acpica.org/sites/acpica/files/acpica-unix-${version}.tar.gz";
       sha256 = "0bqhr3ndchvfhxb31147z8gd81dysyz5dwkvmp56832d0js2564q";
     };
-    NIX_CFLAGS_COMPILE = old.NIX_CFLAGS_COMPILE + " -Wno-error=stringop-truncation";
+    env = old.env // { NIX_CFLAGS_COMPILE = old.env.NIX_CFLAGS_COMPILE + " -Wno-error=stringop-truncation"; };
   });
 in stdenv.mkDerivation {
   pname = "virtualbox";
diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
index 218d4983ca557..65932c49ed835 100644
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types -Wno-error=implicit-function-declaration";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types -Wno-error=implicit-function-declaration";
 
   nativeBuildInputs = [ patchelf makeWrapper ];
   buildInputs = [ cdrkit ] ++ kernel.moduleBuildDependencies;
diff --git a/pkgs/applications/virtualization/xen/4.10.nix b/pkgs/applications/virtualization/xen/4.10.nix
index 765baa0a3b4d6..5adff4fc93456 100644
--- a/pkgs/applications/virtualization/xen/4.10.nix
+++ b/pkgs/applications/virtualization/xen/4.10.nix
@@ -148,7 +148,7 @@ callPackage (import ./generic.nix (rec {
     ++ optional (withOVMF) "--with-system-ovmf=${OVMF.fd}/FV/OVMF.fd"
     ++ optional (withInternalOVMF) "--enable-ovmf";
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Fix build on Glibc 2.24.
     "-Wno-error=deprecated-declarations"
     # Fix build with GCC 8
diff --git a/pkgs/applications/window-managers/fbpanel/default.nix b/pkgs/applications/window-managers/fbpanel/default.nix
index 1a87f29f67cd9..b3d78f40271e8 100644
--- a/pkgs/applications/window-managers/fbpanel/default.nix
+++ b/pkgs/applications/window-managers/fbpanel/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
       --replace "CFLAGSX =" "CFLAGSX = -I${gdk-pixbuf-xlib.dev}/include/gdk-pixbuf-2.0"
   '';
 
-  NIX_LDFLAGS="-lX11";
+  env.NIX_LDFLAGS="-lX11";
 
   meta = with lib; {
     description = "A stand-alone panel";
diff --git a/pkgs/applications/window-managers/matchbox/default.nix b/pkgs/applications/window-managers/matchbox/default.nix
index 51bb3010d3301..d0c4556217c24 100644
--- a/pkgs/applications/window-managers/matchbox/default.nix
+++ b/pkgs/applications/window-managers/matchbox/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libmatchbox ];
-  NIX_LDFLAGS = "-lX11 -L${libX11}/lib -lXext -L${libXext}/lib";
+  env.NIX_LDFLAGS = "-lX11 -L${libX11}/lib -lXext -L${libXext}/lib";
 
   src = fetchurl {
     url = "https://downloads.yoctoproject.org/releases/matchbox/matchbox-window-manager/${version}/matchbox-window-manager-${version}.tar.bz2";
diff --git a/pkgs/build-support/buildenv/builder.pl b/pkgs/build-support/buildenv/builder.pl
index 411b147cc58ef..563da57521304 100755
--- a/pkgs/build-support/buildenv/builder.pl
+++ b/pkgs/build-support/buildenv/builder.pl
@@ -6,13 +6,15 @@
 use File::Path;
 use File::Basename;
 use File::Compare;
+use File::Slurp qw(read_file);
 use JSON::PP;
 
 STDOUT->autoflush(1);
 
-my $out = $ENV{"out"};
+my $nixAttrs = decode_json(read_file(".attrs.json"));
+my $out = $nixAttrs->{outputs}->{out};
 
-my @pathsToLink = split ' ', $ENV{"pathsToLink"};
+my @pathsToLink = @{$nixAttrs->{pathsToLink}};
 
 sub isInPathsToLink {
     my $path = shift;
@@ -185,24 +187,13 @@ sub addPkg {
     }
 }
 
-# Read packages list.
-my $pkgs;
-
-if (exists $ENV{"pkgsPath"}) {
-    open FILE, $ENV{"pkgsPath"};
-    $pkgs = <FILE>;
-    close FILE;
-} else {
-    $pkgs = $ENV{"pkgs"}
-}
-
 # Symlink to the packages that have been installed explicitly by the
 # user.
-for my $pkg (@{decode_json $pkgs}) {
+for my $pkg (@{$nixAttrs->{pkgs}}) {
     for my $path (@{$pkg->{paths}}) {
         addPkg($path,
-               $ENV{"ignoreCollisions"} eq "1",
-               $ENV{"checkCollisionContents"} eq "1",
+               $nixAttrs->{ignoreCollisions},
+               $nixAttrs->{checkCollisionContents},
                $pkg->{priority})
            if -e $path;
     }
@@ -218,13 +209,12 @@ sub addPkg {
     my @pkgDirs = keys %postponed;
     %postponed = ();
     foreach my $pkgDir (sort @pkgDirs) {
-        addPkg($pkgDir, 2, $ENV{"checkCollisionContents"} eq "1", $priorityCounter++);
+        addPkg($pkgDir, 2, $nixAttrs->{"checkCollisionContents"}, $priorityCounter++);
     }
 }
 
-
 # Create the symlinks.
-my $extraPrefix = $ENV{"extraPrefix"};
+my $extraPrefix = $nixAttrs->{extraPrefix};
 my $nrLinks = 0;
 foreach my $relName (sort keys %symlinks) {
     my ($target, $priority) = @{$symlinks{$relName}};
@@ -245,7 +235,7 @@ sub addPkg {
 print STDERR "created $nrLinks symlinks in user environment\n";
 
 
-my $manifest = $ENV{"manifest"};
+my $manifest = $nixAttrs->{manifest};
 if ($manifest) {
     symlink($manifest, "$out/manifest") or die "cannot create manifest";
 }
diff --git a/pkgs/build-support/buildenv/default.nix b/pkgs/build-support/buildenv/default.nix
index c2186cf6bfa04..0e6440c9fb17b 100644
--- a/pkgs/build-support/buildenv/default.nix
+++ b/pkgs/build-support/buildenv/default.nix
@@ -49,6 +49,7 @@ let
     src = ./builder.pl;
     inherit (builtins) storeDir;
   };
+  perlPkgs = buildPackages.perlPackages;
 in
 
 runCommand name
@@ -56,7 +57,7 @@ runCommand name
     inherit manifest ignoreCollisions checkCollisionContents passthru
             meta pathsToLink extraPrefix postBuild
             nativeBuildInputs buildInputs;
-    pkgs = builtins.toJSON (map (drv: {
+    pkgs = map (drv: {
       paths =
         # First add the usual output(s): respect if user has chosen explicitly,
         # and otherwise use `meta.outputsToInstall`. The attribute is guaranteed
@@ -70,13 +71,13 @@ runCommand name
         ++ lib.filter (p: p!=null)
           (builtins.map (outName: drv.${outName} or null) extraOutputsToInstall);
       priority = drv.meta.priority or 5;
-    }) paths);
+    }) paths;
     preferLocalBuild = true;
     allowSubstitutes = false;
-    # XXX: The size is somewhat arbitrary
-    passAsFile = if builtins.stringLength pkgs >= 128*1024 then [ "pkgs" ] else [ ];
   }
   ''
+    source .attrs.sh
+    export PERL5LIB=${perlPkgs.makePerlPath (with perlPkgs; [ FileSlurp ])}
     ${buildPackages.perl}/bin/perl -w ${builder}
     eval "$postBuild"
   '')
diff --git a/pkgs/build-support/coq/default.nix b/pkgs/build-support/coq/default.nix
index 03922303ee346..4d05034e47d65 100644
--- a/pkgs/build-support/coq/default.nix
+++ b/pkgs/build-support/coq/default.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation (removeAttrs ({
 // (optionalAttrs (!args?installPhase && !args?useMelquiondRemake) {
   installFlags =
     [ "${var-coqlib-install}=$(out)/lib/coq/${coq.coq-version}/" ] ++
-    optional (match ".*doc$" (args.installTargets or "") != null)
+    optional (elem "doc" (args.installTargets or []))
       "DOCDIR=$(out)/share/coq/${coq.coq-version}/" ++
     extraInstallFlags;
 })
diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh
index 5b04a702aff43..c3311dd8f54dc 100644
--- a/pkgs/build-support/fetchurl/builder.sh
+++ b/pkgs/build-support/fetchurl/builder.sh
@@ -1,3 +1,5 @@
+source .attrs.sh
+
 source $stdenv/setup
 
 source $mirrorsFile
@@ -23,7 +25,7 @@ if ! [ -f "$SSL_CERT_FILE" ]; then
 fi
 
 curl+=(
-    $curlOpts
+    "${curlOpts[@]}"
     $NIX_CURL_FLAGS
 )
 
@@ -102,10 +104,10 @@ tryHashedMirrors() {
 # URL list may contain ?. No glob expansion for that, please
 set -o noglob
 
-urls2=
-for url in $urls; do
+declare -a urls2
+for url in "${urls[@]}"; do
     if test "${url:0:9}" != "mirror://"; then
-        urls2="$urls2 $url"
+        urls2+=("$url")
     else
         url2="${url:9}"; echo "${url2/\// }" > split; read site fileName < split
         #varName="mirror_$site"
@@ -120,18 +122,18 @@ for url in $urls; do
             if test -n "${!varName}"; then mirrors="${!varName}"; fi
 
             for url3 in $mirrors; do
-                urls2="$urls2 $url3$fileName";
+                urls2+=("$url3$fileName")
             done
         fi
     fi
 done
-urls="$urls2"
+urls=("${urls2[@]}")
 
 # Restore globbing settings
 set +o noglob
 
 if test -n "$showURLs"; then
-    echo "$urls" > $out
+    echo "${urls[@]}" > $out
     exit 0
 fi
 
@@ -143,7 +145,7 @@ fi
 set -o noglob
 
 success=
-for url in $urls; do
+for url in "${urls[@]}"; do
     if [ -z "$postFetch" ]; then
        case "$url" in
            https://github.com/*/archive/*)
diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
index 8ce69a7f1878b..57ab05049b32a 100644
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@@ -12,11 +12,14 @@ let
   # resulting store derivations (.drv files) much smaller, which in
   # turn makes nix-env/nix-instantiate faster.
   mirrorsFile =
-    buildPackages.stdenvNoCC.mkDerivation ({
+    stdenvNoCC.mkDerivation {
       name = "mirrors-list";
-      builder = ./write-mirror-list.sh;
-      preferLocalBuild = true;
-    } // mirrors);
+      env = lib.mapAttrs (k: m: toString m) mirrors;
+      buildCommand = ''
+        # !!! this is kinda hacky.
+        set | grep -E '^[a-zA-Z]+=.*://' > $out
+      '';
+    };
 
   # Names of the master sites that are mirrored (i.e., "sourceforge",
   # "gnu", etc.).
@@ -45,7 +48,7 @@ in
   urls ? []
 
 , # Additional curl options needed for the download to succeed.
-  curlOpts ? ""
+  curlOpts ? []
 
 , # Name of the file.  If empty, use the basename of `url' (or of the
   # first element of `urls').
diff --git a/pkgs/build-support/fetchurl/write-mirror-list.sh b/pkgs/build-support/fetchurl/write-mirror-list.sh
deleted file mode 100644
index 2dabd2e722be8..0000000000000
--- a/pkgs/build-support/fetchurl/write-mirror-list.sh
+++ /dev/null
@@ -1,4 +0,0 @@
-source $stdenv/setup
-
-# !!! this is kinda hacky.
-set | grep -E '^[a-zA-Z]+=.*://' > $out
diff --git a/pkgs/build-support/kernel/make-initrd.nix b/pkgs/build-support/kernel/make-initrd.nix
index 83d3bb65baec6..a76663677bd22 100644
--- a/pkgs/build-support/kernel/make-initrd.nix
+++ b/pkgs/build-support/kernel/make-initrd.nix
@@ -80,9 +80,9 @@ in stdenvNoCC.mkDerivation rec {
 
   ${if makeUInitrd then "uinitrdCompression" else null} = uInitrdCompression;
 
-  builder = ./make-initrd.sh;
+  buildCommand = builtins.readFile ./make-initrd.sh;
 
-  nativeBuildInputs = [ perl cpio ]
+  nativeBuildInputs = [ perl cpio jq ]
     ++ lib.optional makeUInitrd ubootTools;
 
   compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";
diff --git a/pkgs/build-support/kernel/make-initrd.sh b/pkgs/build-support/kernel/make-initrd.sh
index c0619ef14ae01..39872841afb57 100644
--- a/pkgs/build-support/kernel/make-initrd.sh
+++ b/pkgs/build-support/kernel/make-initrd.sh
@@ -1,11 +1,5 @@
-source $stdenv/setup
-
 set -o pipefail
 
-objects=($objects)
-symlinks=($symlinks)
-suffices=($suffices)
-
 mkdir root
 
 # Needed for splash_helper, which gets run before init.
@@ -13,25 +7,21 @@ mkdir root/dev
 mkdir root/sys
 mkdir root/proc
 
+objectCount=$(<.attrs.json jq '.contents | length')
 
-for ((n = 0; n < ${#objects[*]}; n++)); do
-    object=${objects[$n]}
-    symlink=${symlinks[$n]}
-    suffix=${suffices[$n]}
+for ((n = 0; n < $objectCount; n++)); do
+    object=$(<.attrs.json jq -r ".contents[$n].object")
+    symlink=$(<.attrs.json jq -r ".contents[$n].symlink")
+    suffix=$(<.attrs.json jq -r '.contents['"$n"'] | if has("suffix") then .suffix else "" end')
     if test "$suffix" = none; then suffix=; fi
 
     mkdir -p $(dirname root/$symlink)
     ln -s $object$suffix root/$symlink
 done
 
-
-# Get the paths in the closure of `object'.
-storePaths=$(perl $pathsFromGraph closure-*)
-
-
 # Paths in cpio archives *must* be relative, otherwise the kernel
 # won't unpack 'em.
-(cd root && cp -prd --parents $storePaths .)
+(cd root && cp -prd --parents $(cat "$closure/store-paths") .)
 
 
 # Put the closure in a gzipped cpio archive.
diff --git a/pkgs/build-support/kernel/modules-closure.nix b/pkgs/build-support/kernel/modules-closure.nix
index d82e279799ba3..a037f3c42a066 100644
--- a/pkgs/build-support/kernel/modules-closure.nix
+++ b/pkgs/build-support/kernel/modules-closure.nix
@@ -8,8 +8,13 @@
 
 stdenvNoCC.mkDerivation {
   name = kernel.name + "-shrunk";
-  builder = ./modules-closure.sh;
+  buildCommand = builtins.readFile ./modules-closure.sh;
   nativeBuildInputs = [ nukeReferences kmod ];
-  inherit kernel firmware rootModules allowMissing;
+  inherit rootModules;
+  env = {
+    kernel = "${kernel}";
+    firmware = "${firmware}";
+    inherit allowMissing;
+  };
   allowedReferences = ["out"];
 }
diff --git a/pkgs/build-support/kernel/modules-closure.sh b/pkgs/build-support/kernel/modules-closure.sh
index 3b3a38ea1d33e..a459d2429857b 100644
--- a/pkgs/build-support/kernel/modules-closure.sh
+++ b/pkgs/build-support/kernel/modules-closure.sh
@@ -1,14 +1,12 @@
-source $stdenv/setup
-
 # When no modules are built, the $out/lib/modules directory will not
 # exist. Because the rest of the script assumes it does exist, we
 # handle this special case first.
 if ! test -d "$kernel/lib/modules"; then
-    if test -z "$rootModules" || test -n "$allowMissing"; then
+    if test -z "${rootModules[*]}" || test -n "$allowMissing"; then
         mkdir -p "$out"
         exit 0
     else
-        echo "Required modules: $rootModules"
+        echo "Required modules: ${rootModules[*]}"
         echo "Can not derive a closure of kernel modules because no modules were provided."
         exit 1
     fi
@@ -21,7 +19,7 @@ echo "kernel version is $version"
 # Determine the dependencies of each root module.
 mkdir -p $out/lib/modules/"$version"
 touch closure
-for module in $rootModules; do
+for module in "${rootModules[@]}"; do
     echo "root module: $module"
     modprobe --config no-config -d $kernel --set-version "$version" --show-depends "$module" \
     | while read cmd module args; do
diff --git a/pkgs/build-support/mono-dll-fixer/builder.sh b/pkgs/build-support/mono-dll-fixer/builder.sh
deleted file mode 100644
index 67abc465a9bdd..0000000000000
--- a/pkgs/build-support/mono-dll-fixer/builder.sh
+++ /dev/null
@@ -1,4 +0,0 @@
-source $stdenv/setup
-
-substitute $dllFixer $out --subst-var-by perl $perl/bin/perl
-chmod +x $out
diff --git a/pkgs/build-support/mono-dll-fixer/default.nix b/pkgs/build-support/mono-dll-fixer/default.nix
index 8f7d1e795d799..7fbf4b10f18b7 100644
--- a/pkgs/build-support/mono-dll-fixer/default.nix
+++ b/pkgs/build-support/mono-dll-fixer/default.nix
@@ -1,8 +1,15 @@
-{stdenv, perl}:
+{ stdenv, perl }:
 
 stdenv.mkDerivation {
   name = "mono-dll-fixer";
-  builder = ./builder.sh;
-  dllFixer = ./dll-fixer.pl;
-  inherit perl;
+
+  src = ./dll-fixer.pl;
+  dontUnpack = true;
+
+  buildInputs = [ perl ];
+
+  installPhase = ''
+    cp $src $out
+    chmod +x $out
+  '';
 }
diff --git a/pkgs/build-support/mono-dll-fixer/dll-fixer.pl b/pkgs/build-support/mono-dll-fixer/dll-fixer.pl
index 4a8b468692f0c..58162512ac0d5 100644
--- a/pkgs/build-support/mono-dll-fixer/dll-fixer.pl
+++ b/pkgs/build-support/mono-dll-fixer/dll-fixer.pl
@@ -1,4 +1,4 @@
-#! @perl@ -w
+#!/usr/bin/perl -w
 
 use strict;
 
diff --git a/pkgs/build-support/nuke-references/builder.sh b/pkgs/build-support/nuke-references/builder.sh
index 7da322032185d..699f011409d3e 100644
--- a/pkgs/build-support/nuke-references/builder.sh
+++ b/pkgs/build-support/nuke-references/builder.sh
@@ -1,3 +1,5 @@
+source .attrs.sh
+
 source $stdenv/setup
 
 mkdir -p $out/bin
diff --git a/pkgs/build-support/rust/hooks/cargo-build-hook.sh b/pkgs/build-support/rust/hooks/cargo-build-hook.sh
index c10120c5aa19e..e34692d58e525 100644
--- a/pkgs/build-support/rust/hooks/cargo-build-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-build-hook.sh
@@ -24,7 +24,7 @@ cargoBuildHook() {
         --target @rustTargetPlatformSpec@ \
         --frozen \
         ${cargoBuildProfileFlag} \
-        ${cargoBuildFlags}
+        "${cargoBuildFlags[@]}"
     )
 
     if [ ! -z "${buildAndTestSubdir-}" ]; then
diff --git a/pkgs/build-support/rust/hooks/cargo-check-hook.sh b/pkgs/build-support/rust/hooks/cargo-check-hook.sh
index f0339afb38fa6..dd0fb6535edd6 100644
--- a/pkgs/build-support/rust/hooks/cargo-check-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-check-hook.sh
@@ -28,7 +28,7 @@ cargoCheckHook() {
               -j $NIX_BUILD_CORES \
               ${argstr} -- \
               --test-threads=${threads} \
-              ${checkFlags} \
+              "${checkFlags[@]}" \
               ${checkFlagsArray+"${checkFlagsArray[@]}"}
     )
 
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.sh b/pkgs/build-support/setup-hooks/auto-patchelf.sh
index 511371931de8f..31b8e97a091a4 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.sh
@@ -257,9 +257,9 @@ autoPatchelf() {
 # fixupOutput and the postFixup hook runs later.
 postFixupHooks+=('
     if [ -z "${dontAutoPatchelf-}" ]; then
-        autoPatchelf -- $(for output in $outputs; do
-            [ -e "${!output}" ] || continue
-            echo "${!output}"
+        autoPatchelf -- $(for output in "${outputs[@]}"; do
+            [ -e "${output}" ] || continue
+            echo "${output}"
         done)
     fi
 ')
diff --git a/pkgs/build-support/setup-hooks/multiple-outputs.sh b/pkgs/build-support/setup-hooks/multiple-outputs.sh
index bfa47e3b20e17..8734448964756 100644
--- a/pkgs/build-support/setup-hooks/multiple-outputs.sh
+++ b/pkgs/build-support/setup-hooks/multiple-outputs.sh
@@ -7,10 +7,10 @@ postFixupHooks+=(_multioutPropagateDev)
 # Assign the first string containing nonempty variable to the variable named $1
 _assignFirst() {
     local varName="$1"
-    local REMOVE=REMOVE # slightly hacky - we allow REMOVE (i.e. not a variable name)
     shift
     while (( $# )); do
-        if [ -n "${!1-}" ]; then eval "${varName}"="$1"; return; fi
+        if [ "$1" = REMOVE ]; then eval "${varName}"=REMOVE; return; fi
+        if [ ${outputs[$1]+isset} ]; then eval "${varName}"="$1"; return; fi
         shift
     done
     echo "Error: _assignFirst found no valid variant!"
@@ -44,10 +44,14 @@ _overrideFirst outputMan "man" "$outputBin"
 _overrideFirst outputDevman "devman" "devdoc" "$outputMan"
 _overrideFirst outputInfo "info" "$outputBin"
 
+# Backwards compatibility to ensure $out etc. exist
+for outputName in "${!outputs[@]}"; do
+  eval "export ${outputName}"="${outputs[$outputName]}"
+done
 
 # Add standard flags to put files into the desired outputs.
 _multioutConfig() {
-    if [ "$outputs" = "out" ] || [ -z "${setOutputFlags-1}" ]; then return; fi;
+    if [ "${#outputs[@]}" -eq 1 ] || [ -z "${setOutputFlags-1}" ]; then return; fi;
 
     # try to detect share/doc/${shareDocName}
     # Note: sadly, $configureScript detection comes later in configurePhase,
@@ -66,19 +70,19 @@ _multioutConfig() {
         fi
     fi
 
-    configureFlags="\
-        --bindir=${!outputBin}/bin --sbindir=${!outputBin}/sbin \
-        --includedir=${!outputInclude}/include --oldincludedir=${!outputInclude}/include \
-        --mandir=${!outputMan}/share/man --infodir=${!outputInfo}/share/info \
-        --docdir=${!outputDoc}/share/doc/${shareDocName} \
-        --libdir=${!outputLib}/lib --libexecdir=${!outputLib}/libexec \
-        --localedir=${!outputLib}/share/locale \
-        $configureFlags"
-
-    installFlags="\
-        pkgconfigdir=${!outputDev}/lib/pkgconfig \
-        m4datadir=${!outputDev}/share/aclocal aclocaldir=${!outputDev}/share/aclocal \
-        $installFlags"
+    configureFlags=(
+        "--bindir=${!outputBin}/bin" "--sbindir=${!outputBin}/sbin"
+        "--includedir=${!outputInclude}/include" "--oldincludedir=${!outputInclude}/include"
+        "--mandir=${!outputMan}/share/man" "--infodir=${!outputInfo}/share/info"
+        "--docdir=${!outputDoc}/share/doc/${shareDocName}"
+        "--libdir=${!outputLib}/lib" "--libexecdir=${!outputLib}/libexec"
+        "--localedir=${!outputLib}/share/locale"
+        "${configureFlags[@]}")
+
+    installFlags=(
+        "pkgconfigdir=${!outputDev}/lib/pkgconfig"
+        "m4datadir=${!outputDev}/share/aclocal" "aclocaldir=${!outputDev}/share/aclocal"
+        "${installFlags[@]}")
 }
 
 
@@ -94,10 +98,10 @@ moveToOutput() {
     local patt="$1"
     local dstOut="$2"
     local output
-    for output in $outputs; do
-        if [ "${!output}" = "$dstOut" ]; then continue; fi
+    for output in "${outputs[@]}"; do
+        if [ "${output}" = "$dstOut" ]; then continue; fi
         local srcPath
-        for srcPath in "${!output}"/$patt; do
+        for srcPath in "${output}"/$patt; do
             # apply to existing files/dirs, *including* broken symlinks
             if [ ! -e "$srcPath" ] && [ ! -L "$srcPath" ]; then continue; fi
 
@@ -105,7 +109,7 @@ moveToOutput() {
                 echo "Removing $srcPath"
                 rm -r "$srcPath"
             else
-                local dstPath="$dstOut${srcPath#${!output}}"
+                local dstPath="$dstOut${srcPath#${output}}"
                 echo "Moving $srcPath to $dstPath"
 
                 if [ -d "$dstPath" ] && [ -d "$srcPath" ]
@@ -149,7 +153,7 @@ _multioutDocs() {
 
 # Move development-only stuff to the desired outputs.
 _multioutDevs() {
-    if [ "$outputs" = "out" ] || [ -z "${moveToDev-1}" ]; then return; fi;
+    if [ "${#outputs[@]}" -eq 1 ] || [ -z "${moveToDev-1}" ]; then return; fi;
     moveToOutput include "${!outputInclude}"
     # these files are sometimes provided even without using the corresponding tool
     moveToOutput lib/pkgconfig "${!outputDev}"
@@ -166,34 +170,10 @@ _multioutDevs() {
 
 # Make the "dev" propagate other outputs needed for development.
 _multioutPropagateDev() {
-    if [ "$outputs" = "out" ]; then return; fi;
-
-    local outputFirst
-    for outputFirst in $outputs; do
-        break
-    done
-    local propagaterOutput="$outputDev"
-    if [ -z "$propagaterOutput" ]; then
-        propagaterOutput="$outputFirst"
-    fi
-
-    # Default value: propagate binaries, includes and libraries
-    if [ -z "${propagatedBuildOutputs+1}" ]; then
-        local po_dirty="$outputBin $outputInclude $outputLib"
-        set +o pipefail
-        propagatedBuildOutputs=`echo "$po_dirty" \
-            | tr -s ' ' '\n' | grep -v -F "$propagaterOutput" \
-            | sort -u | tr '\n' ' ' `
-        set -o pipefail
-    fi
-
-    # The variable was explicitly set to empty or we resolved it so
-    if [ -z "$propagatedBuildOutputs" ]; then
-        return
-    fi
+    if [ ${#outputs[@]} -eq 1 ]; then return; fi;
 
     mkdir -p "${!propagaterOutput}"/nix-support
-    for output in $propagatedBuildOutputs; do
-        echo -n " ${!output}" >> "${!propagaterOutput}"/nix-support/propagated-build-inputs
+    for output in "${propagatedBuildOutputs[@]+${propagatedBuildOutputs[@]}}"; do
+        echo -n " ${outputs[$output]}" >> "${!propagaterOutput}"/nix-support/propagated-build-inputs
     done
 }
diff --git a/pkgs/build-support/setup-hooks/separate-debug-info.sh b/pkgs/build-support/setup-hooks/separate-debug-info.sh
index 19dbb10d18e72..f7bf053510e68 100644
--- a/pkgs/build-support/setup-hooks/separate-debug-info.sh
+++ b/pkgs/build-support/setup-hooks/separate-debug-info.sh
@@ -20,7 +20,7 @@ _separateDebugInfo() {
 
         # Extract the Build ID. FIXME: there's probably a cleaner way.
         local id="$($READELF -n "$i" | sed 's/.*Build ID: \([0-9a-f]*\).*/\1/; t; d')"
-        if [ "${#id}" != 40 ]; then
+        if [ "${#id}" -ne 40 ]; then
             echo "could not find build ID of $i, skipping" >&2
             continue
         fi
diff --git a/pkgs/build-support/setup-hooks/win-dll-link.sh b/pkgs/build-support/setup-hooks/win-dll-link.sh
index 6130f32bef86c..f88da7805220d 100644
--- a/pkgs/build-support/setup-hooks/win-dll-link.sh
+++ b/pkgs/build-support/setup-hooks/win-dll-link.sh
@@ -15,8 +15,8 @@ _linkDLLs() {
     #   prefix $PATH by currently-built outputs
     local DLLPATH=""
     local outName
-    for outName in $outputs; do
-        addToSearchPath DLLPATH "${!outName}/bin"
+    for output in "${outputs[@]}"; do
+        addToSearchPath DLLPATH "${output}/bin"
     done
     DLLPATH="$DLLPATH:$PATH"
 
diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
index 1a46e075dbe76..551509dbdbded 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
@@ -38,7 +38,7 @@ gappsWrapperArgsHook() {
     done
 }
 
-preFixupPhases+=" gappsWrapperArgsHook"
+preFixupPhases+=("gappsWrapperArgsHook")
 
 wrapGApp() {
     local program="$1"
diff --git a/pkgs/build-support/substitute/substitute-all.sh b/pkgs/build-support/substitute/substitute-all.sh
index ec220481fcc09..e20fa41f135b7 100644
--- a/pkgs/build-support/substitute/substitute-all.sh
+++ b/pkgs/build-support/substitute/substitute-all.sh
@@ -1,3 +1,5 @@
+source .attrs.sh
+
 source $stdenv/setup
 
 eval "$preInstall"
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index 0bf67d21b3be6..a75a4555de2b2 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, stdenvNoCC, lndir, runtimeShell }:
+{ lib, stdenv, stdenvNoCC, lndir, runtimeShell, jq }:
 
 rec {
 
@@ -71,12 +71,13 @@ rec {
     # extra arguments to pass to stdenv.mkDerivation
     , name
     # name of the resulting derivation
-    }: buildCommand:
+    }: buildScript:
     stdenv.mkDerivation ({
       name = lib.strings.sanitizeDerivationName name;
-      inherit buildCommand;
-      passAsFile = [ "buildCommand" ]
-        ++ (derivationArgs.passAsFile or []);
+      inherit buildScript;
+      buildCommand = ''
+        source <(${jq}/bin/jq -r <.attrs.json '.buildScript')
+      '';
     }
     // (lib.optionalAttrs runLocal {
           preferLocalBuild = true;
@@ -84,7 +85,6 @@ rec {
        })
     // builtins.removeAttrs derivationArgs [ "passAsFile" ]);
 
-
   /* Writes a text file to the nix store.
    * The contents of text is added to the file in the store.
    *
@@ -117,7 +117,6 @@ rec {
     }:
     runCommand name
       { inherit text executable;
-        passAsFile = [ "text" ];
         # Pointless to do this on a remote machine.
         preferLocalBuild = true;
         allowSubstitutes = false;
@@ -126,11 +125,7 @@ rec {
         n=$out${destination}
         mkdir -p "$(dirname "$n")"
 
-        if [ -e "$textPath" ]; then
-          mv "$textPath" "$n"
-        else
-          echo -n "$text" > "$n"
-        fi
+        cp <(${jq}/bin/jq -r <.attrs.json '.text') $n
 
         ${checkPhase}
 
@@ -258,7 +253,6 @@ rec {
     {
       inherit name code;
       executable = true;
-      passAsFile = ["code"];
       # Pointless to do this on a remote machine.
       preferLocalBuild = true;
       allowSubstitutes = false;
@@ -266,7 +260,7 @@ rec {
     ''
     n=$out/bin/$name
     mkdir -p "$(dirname "$n")"
-    mv "$codePath" code.c
+    cp <(${jq}/bin/jq -r <.attrs.json '.code') code.c
     $CC -x c code.c -o "$n"
     '';
 
@@ -326,15 +320,14 @@ rec {
     let
       args = removeAttrs args_ [ "name" "postBuild" ]
         // {
-          inherit preferLocalBuild allowSubstitutes;
-          passAsFile = [ "paths" ];
+          inherit preferLocalBuild allowSubstitutes paths;
         }; # pass the defaults
     in runCommand name args
       ''
         mkdir -p $out
-        for i in $(cat $pathsPath); do
-          ${lndir}/bin/lndir -silent $i $out
-        done
+        while IFS= read -r path; do
+          ${lndir}/bin/lndir -silent $path $out
+        done < <(${jq}/bin/jq -r <.attrs.json '.paths[]')
         ${postBuild}
       '';
 
diff --git a/pkgs/data/documentation/anarchism/default.nix b/pkgs/data/documentation/anarchism/default.nix
index d0cda3da544c8..0299e5390f71a 100644
--- a/pkgs/data/documentation/anarchism/default.nix
+++ b/pkgs/data/documentation/anarchism/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "04ylk0y5b3jml2awmyz7m1hnymni8y1n83m0k6ychdh0px8frhm5";
   };
 
-  phases = [ "unpackPhase" "postPatch" "installPhase" ];
+  dontBuild = true;
 
   postPatch = ''
     substituteInPlace debian/anarchism.desktop \
diff --git a/pkgs/data/fonts/comic-neue/default.nix b/pkgs/data/fonts/comic-neue/default.nix
index df618aea81108..7485d435cb23a 100644
--- a/pkgs/data/fonts/comic-neue/default.nix
+++ b/pkgs/data/fonts/comic-neue/default.nix
@@ -10,8 +10,6 @@ stdenv.mkDerivation rec {
     stripRoot = false; # because it comes with a __MACOSX directory
   };
 
-  phases = [ "unpackPhase" "installPhase" ];
-
   installPhase = ''
     mkdir -pv $out/share/{doc/${pname}-${version},fonts/{opentype,truetype,WOFF,WOFF2}}
     cp -v ${pname}-${version}/{FONTLOG,OFL-FAQ,OFL}.txt $out/share/doc/
diff --git a/pkgs/data/fonts/unifont/default.nix b/pkgs/data/fonts/unifont/default.nix
index 507faae53e356..7fb7387179a9b 100644
--- a/pkgs/data/fonts/unifont/default.nix
+++ b/pkgs/data/fonts/unifont/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ libfaketime fonttosfnt mkfontscale ];
 
-  phases = [ "buildPhase" "installPhase" ];
+  dontUnpack = true;
 
   buildPhase =
     ''
diff --git a/pkgs/data/misc/geolite-legacy/builder.sh b/pkgs/data/misc/geolite-legacy/builder.sh
index 683b2e8606b8b..3ba76d5cd74c1 100644
--- a/pkgs/data/misc/geolite-legacy/builder.sh
+++ b/pkgs/data/misc/geolite-legacy/builder.sh
@@ -1,3 +1,5 @@
+source .attrs.sh
+
 source "$stdenv/setup"
 
 mkdir -p $out/share/GeoIP
diff --git a/pkgs/data/misc/scowl/default.nix b/pkgs/data/misc/scowl/default.nix
index a4d91eeb037a9..0d219d3f45ff3 100644
--- a/pkgs/data/misc/scowl/default.nix
+++ b/pkgs/data/misc/scowl/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ unzip zip perl aspell dos2unix ];
   buildInputs = lib.optional (!stdenv.isLinux) libiconv;
 
-  NIX_CFLAGS_COMPILE = "-Wno-narrowing";
+  env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
 
   preConfigure = ''
     patchShebangs .
diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
index 7ab25da3cc431..d6359efaa90aa 100644
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
   preInstall = ''
      mv zic.o zic.o.orig
      mv zic zic.orig
-     make $makeFlags cc=${stdenv.cc.nativePrefix}cc AR=${stdenv.cc.nativePrefix}ar zic
+     make "''${makeFlags[@]}" cc=${stdenv.cc.nativePrefix}cc AR=${stdenv.cc.nativePrefix}ar zic
      mv zic zic-native
      mv zic.o.orig zic.o
      mv zic.orig zic
diff --git a/pkgs/desktops/cinnamon/xapps/default.nix b/pkgs/desktops/cinnamon/xapps/default.nix
index 7be80048e3c24..a81f2ab3f8cad 100644
--- a/pkgs/desktops/cinnamon/xapps/default.nix
+++ b/pkgs/desktops/cinnamon/xapps/default.nix
@@ -33,9 +33,7 @@ stdenv.mkDerivation rec {
   };
 
   # TODO: https://github.com/NixOS/nixpkgs/issues/36468
-  NIX_CFLAGS_COMPILE = [
-    "-I${glib.dev}/include/gio-unix-2.0"
-  ];
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   nativeBuildInputs = [
     meson
diff --git a/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix b/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix
index 1e0064a8fadfb..3f4ec51d8994c 100644
--- a/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix
+++ b/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   ];
 
   patchFlags = [ "-p0" ];
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   preConfigure = "./jb configure prefix=$out";
 
diff --git a/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix b/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
index ec87bafc99808..15ede8912b603 100644
--- a/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
+++ b/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
@@ -16,5 +16,5 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ gtk2 intltool GConf enchant isocodes gnome-icon-theme ];
 
-  NIX_LDFLAGS = "-lgthread-2.0";
+  env.NIX_LDFLAGS = "-lgthread-2.0";
 }
diff --git a/pkgs/desktops/gnome-2/platform/libglade/default.nix b/pkgs/desktops/gnome-2/platform/libglade/default.nix
index 3eb7b533f09e3..912b7654898f0 100644
--- a/pkgs/desktops/gnome-2/platform/libglade/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libglade/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
   buildInputs = [ gtk2 gettext ]
     ++ lib.optional withLibgladeConvert python2;
 
-  NIX_LDFLAGS = "-lgmodule-2.0";
+  env.NIX_LDFLAGS = "-lgmodule-2.0";
 
   propagatedBuildInputs = [ libxml2 ];
 }
diff --git a/pkgs/desktops/gnome/apps/vinagre/default.nix b/pkgs/desktops/gnome/apps/vinagre/default.nix
index 31e198783e04f..24339d0214de2 100644
--- a/pkgs/desktops/gnome/apps/vinagre/default.nix
+++ b/pkgs/desktops/gnome/apps/vinagre/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     gtk3 vte libxml2 gtk-vnc libsecret gnome.adwaita-icon-theme librsvg
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-format-nonliteral";
+  env.NIX_CFLAGS_COMPILE = "-Wno-format-nonliteral";
 
   passthru = {
     updateScript = gnome.updateScript {
diff --git a/pkgs/desktops/gnome/core/evince/default.nix b/pkgs/desktops/gnome/core/evince/default.nix
index 3d7f3e0b8356c..148b7551c2d88 100644
--- a/pkgs/desktops/gnome/core/evince/default.nix
+++ b/pkgs/desktops/gnome/core/evince/default.nix
@@ -105,7 +105,7 @@ stdenv.mkDerivation rec {
     "-Dps=enabled"
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   preFixup = ''
     gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${shared-mime-info}/share")
diff --git a/pkgs/desktops/gnome/core/evolution-data-server/default.nix b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
index 0ed3565d7f039..6b0427f2b4a2c 100644
--- a/pkgs/desktops/gnome/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substitute ${./hardcode-gsettings.patch} hardcode-gsettings.patch --subst-var-by ESD_GSETTINGS_PATH ${glib.makeSchemaPath "$out" "${pname}-${version}"} \
       --subst-var-by GDS_GSETTINGS_PATH ${glib.getSchemaPath gsettings-desktop-schemas}
-    patches="$patches $PWD/hardcode-gsettings.patch"
+    patches+=("$PWD/hardcode-gsettings.patch")
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/gdm/default.nix b/pkgs/desktops/gnome/core/gdm/default.nix
index f304497734953..83303282664fb 100644
--- a/pkgs/desktops/gnome/core/gdm/default.nix
+++ b/pkgs/desktops/gnome/core/gdm/default.nix
@@ -132,20 +132,20 @@ stdenv.mkDerivation rec {
   '';
 
   preInstall = ''
-    install -D ${override} ${DESTDIR}/$out/share/glib-2.0/schemas/org.gnome.login-screen.gschema.override
+    install -D ${override} ${env.DESTDIR}/$out/share/glib-2.0/schemas/org.gnome.login-screen.gschema.override
   '';
 
   postInstall = ''
     # Move stuff from DESTDIR to proper location.
     # We use rsync to merge the directories.
-    rsync --archive "${DESTDIR}/etc" "$out"
-    rm --recursive "${DESTDIR}/etc"
-    for o in $outputs; do
-        rsync --archive "${DESTDIR}/''${!o}" "$(dirname "''${!o}")"
-        rm --recursive "${DESTDIR}/''${!o}"
+    rsync --archive "${env.DESTDIR}/etc" "$out"
+    rm --recursive "${env.DESTDIR}/etc"
+    for o in "''${outputs[@]}"; do
+        rsync --archive "${env.DESTDIR}/''${o}" "$(dirname "''${o}")"
+        rm --recursive "${env.DESTDIR}/''${o}"
     done
     # Ensure the DESTDIR is removed.
-    rmdir "${DESTDIR}/nix/store" "${DESTDIR}/nix" "${DESTDIR}"
+    rmdir "${env.DESTDIR}/nix/store" "${env.DESTDIR}/nix" "${env.DESTDIR}"
 
     # We are setting DESTDIR so the post-install script does not compile the schemas.
     glib-compile-schemas "$out/share/glib-2.0/schemas"
@@ -157,7 +157,7 @@ stdenv.mkDerivation rec {
   # at install time but Meson does not support this
   # so we need to convince it to install all files to a temporary
   # location using DESTDIR and then move it to proper one in postInstall.
-  DESTDIR = "${placeholder "out"}/dest";
+  env.DESTDIR = "${placeholder "out"}/dest";
 
   passthru = {
     updateScript = gnome.updateScript {
diff --git a/pkgs/desktops/gnome/core/gnome-online-miners/default.nix b/pkgs/desktops/gnome/core/gnome-online-miners/default.nix
index 95fdf35b8831b..96a0503be0074 100644
--- a/pkgs/desktops/gnome/core/gnome-online-miners/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-online-miners/default.nix
@@ -93,9 +93,8 @@ stdenv.mkDerivation rec {
     dleyna-server
   ];
 
-  NIX_CFLAGS_COMPILE = [
-    "-Wno-error=format-security" # https://gitlab.gnome.org/GNOME/gnome-online-miners/merge_requests/3/diffs#note_942747
-  ];
+  env.NIX_CFLAGS_COMPILE =
+    "-Wno-error=format-security";  # https://gitlab.gnome.org/GNOME/gnome-online-miners/merge_requests/3/diffs#note_942747
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/desktops/gnome/core/gnome-settings-daemon/default.nix b/pkgs/desktops/gnome/core/gnome-settings-daemon/default.nix
index e091cf2365af3..787a8742d722b 100644
--- a/pkgs/desktops/gnome/core/gnome-settings-daemon/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-settings-daemon/default.nix
@@ -108,7 +108,7 @@ stdenv.mkDerivation rec {
 
   # Default for release buildtype but passed manually because
   # we're using plain
-  NIX_CFLAGS_COMPILE = "-DG_DISABLE_CAST_CHECKS";
+  env.NIX_CFLAGS_COMPILE = "-DG_DISABLE_CAST_CHECKS";
 
 
   postPatch = ''
diff --git a/pkgs/desktops/gnome/core/mutter/default.nix b/pkgs/desktops/gnome/core/mutter/default.nix
index 4ad082dabfcd6..44d90e8ac7253 100644
--- a/pkgs/desktops/gnome/core/mutter/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/default.nix
@@ -131,7 +131,7 @@ let self = stdenv.mkDerivation rec {
   '';
 
   # Install udev files into our own tree.
-  PKG_CONFIG_UDEV_UDEVDIR = "${placeholder "out"}/lib/udev";
+  env.PKG_CONFIG_UDEV_UDEVDIR = "${placeholder "out"}/lib/udev";
 
   passthru = {
     libdir = "${self}/lib/mutter-7";
diff --git a/pkgs/desktops/gnome/extensions/workspace-matrix/default.nix b/pkgs/desktops/gnome/extensions/workspace-matrix/default.nix
index eb1d6e7e319c6..6f6f72e514699 100644
--- a/pkgs/desktops/gnome/extensions/workspace-matrix/default.nix
+++ b/pkgs/desktops/gnome/extensions/workspace-matrix/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     glib
   ];
 
-  buildFlags = "schemas";
+  buildFlags = [ "schemas" ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/desktops/gnustep/make/builder.sh b/pkgs/desktops/gnustep/make/builder.sh
index 66afe1271cae5..2204a5ace0f92 100644
--- a/pkgs/desktops/gnustep/make/builder.sh
+++ b/pkgs/desktops/gnustep/make/builder.sh
@@ -1,3 +1,5 @@
+source .attrs.sh
+
 source $stdenv/setup
 
 preConfigure() {
@@ -76,7 +78,7 @@ postInstall() {
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_DOC_INFO" in *"${tmp}"*) false;; *) true;; esac; then
 	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_INFO "$tmp"
     fi
-    
+
     # write the config file
     echo GNUSTEP_MAKEFILES=$GNUSTEP_MAKEFILES >> $conf
     if [ -n "$NIX_GNUSTEP_SYSTEM_APPS" ]; then
@@ -112,7 +114,7 @@ postInstall() {
     if [ -n "$NIX_GNUSTEP_SYSTEM_DOC_INFO" ]; then
 	echo NIX_GNUSTEP_SYSTEM_DOC_INFO="$NIX_GNUSTEP_SYSTEM_DOC_INFO" >> $conf
     fi
-    
+
     for i in $out/bin/*; do
 	echo "wrapping $(basename $i)"
 	wrapGSMake "$i" "$out/share/.GNUstep.conf"
diff --git a/pkgs/desktops/gnustep/make/default.nix b/pkgs/desktops/gnustep/make/default.nix
index f96eb7388b3da..255de806ab8d8 100644
--- a/pkgs/desktops/gnustep/make/default.nix
+++ b/pkgs/desktops/gnustep/make/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   ];
 
   preConfigure = ''
-    configureFlags="$configureFlags --with-config-file=$out/etc/GNUstep/GNUstep.conf"
+    configureFlags+=("--with-config-file=$out/etc/GNUstep/GNUstep.conf")
   '';
 
   makeFlags = [
diff --git a/pkgs/desktops/gnustep/make/setup-hook.sh b/pkgs/desktops/gnustep/make/setup-hook.sh
index b2b90f1e5222d..4af6519252f62 100644
--- a/pkgs/desktops/gnustep/make/setup-hook.sh
+++ b/pkgs/desktops/gnustep/make/setup-hook.sh
@@ -1,3 +1,5 @@
+out=${outputs[out]}
+
 # this path is used by some packages to install additional makefiles
 export DESTDIR_GNUSTEP_MAKEFILES=$out/share/GNUstep/Makefiles
 
diff --git a/pkgs/desktops/mate/atril/default.nix b/pkgs/desktops/mate/atril/default.nix
index 7e8afde588c6f..4cfbf21f07147 100644
--- a/pkgs/desktops/mate/atril/default.nix
+++ b/pkgs/desktops/mate/atril/default.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
     ++ optionals (enableXps) [ "--enable-xps" ]
     ++ optionals (enableImages) [ "--enable-pixbuf" ];
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   makeFlags = [ "cajaextensiondir=$$out/lib/caja/extensions-2.0" ];
 
diff --git a/pkgs/desktops/mate/mate-applets/default.nix b/pkgs/desktops/mate/mate-applets/default.nix
index ccd20a6b875a0..7c415e0b7a57d 100644
--- a/pkgs/desktops/mate/mate-applets/default.nix
+++ b/pkgs/desktops/mate/mate-applets/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-suid=no" ];
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/desktops/mate/mate-notification-daemon/default.nix b/pkgs/desktops/mate/mate-notification-daemon/default.nix
index 62181418fdfe3..f2ba9ae015041 100644
--- a/pkgs/desktops/mate/mate-notification-daemon/default.nix
+++ b/pkgs/desktops/mate/mate-notification-daemon/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     gtk3
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/desktops/mate/mate-panel/default.nix b/pkgs/desktops/mate/mate-panel/default.nix
index 328fcfd20dee3..2b4a1e075b3c7 100644
--- a/pkgs/desktops/mate/mate-panel/default.nix
+++ b/pkgs/desktops/mate/mate-panel/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     hicolor-icon-theme
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   makeFlags = [
     "INTROSPECTION_GIRDIR=$(out)/share/gir-1.0/"
diff --git a/pkgs/desktops/mate/mate-settings-daemon/default.nix b/pkgs/desktops/mate/mate-settings-daemon/default.nix
index 6c35a1d63120a..8bf4d3b66aec8 100644
--- a/pkgs/desktops/mate/mate-settings-daemon/default.nix
+++ b/pkgs/desktops/mate/mate-settings-daemon/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = lib.optional pulseaudioSupport "--enable-pulse";
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/desktops/mate/mate-utils/default.nix b/pkgs/desktops/mate/mate-utils/default.nix
index 0b7b181bd5769..65bb6a92b79c7 100644
--- a/pkgs/desktops/mate/mate-utils/default.nix
+++ b/pkgs/desktops/mate/mate-utils/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     hicolor-icon-theme
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/desktops/pantheon/apps/switchboard-plugs/onlineaccounts/default.nix b/pkgs/desktops/pantheon/apps/switchboard-plugs/onlineaccounts/default.nix
index ef12cb38e1b98..0f3e0299bab32 100644
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/onlineaccounts/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/onlineaccounts/default.nix
@@ -70,9 +70,9 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  PKG_CONFIG_LIBACCOUNTS_GLIB_PROVIDERFILESDIR = "${placeholder "out"}/share/accounts/providers";
-  PKG_CONFIG_LIBACCOUNTS_GLIB_SERVICEFILESDIR = "${placeholder "out"}/share/accounts/services";
-  PKG_CONFIG_SWITCHBOARD_2_0_PLUGSDIR = "${placeholder "out"}/lib/switchboard";
+  env.PKG_CONFIG_LIBACCOUNTS_GLIB_PROVIDERFILESDIR = "${placeholder "out"}/share/accounts/providers";
+  env.PKG_CONFIG_LIBACCOUNTS_GLIB_SERVICEFILESDIR = "${placeholder "out"}/share/accounts/services";
+  env.PKG_CONFIG_SWITCHBOARD_2_0_PLUGSDIR = "${placeholder "out"}/lib/switchboard";
 
 
   meta = with lib; {
diff --git a/pkgs/desktops/pantheon/apps/switchboard/wrapper.nix b/pkgs/desktops/pantheon/apps/switchboard/wrapper.nix
index 7953105951c6d..4a63b8e4c8961 100644
--- a/pkgs/desktops/pantheon/apps/switchboard/wrapper.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard/wrapper.nix
@@ -34,8 +34,8 @@ stdenv.mkDerivation rec {
     wrapGAppsHook
   ];
 
-  buildInputs = lib.forEach selectedPlugs (x: x.buildInputs)
-    ++ selectedPlugs;
+  buildInputs = lib.flatten (lib.forEach selectedPlugs (x: x.buildInputs)
+    ++ selectedPlugs);
 
   dontUnpack = true;
   dontConfigure = true;
diff --git a/pkgs/desktops/pantheon/desktop/wingpanel/wrapper.nix b/pkgs/desktops/pantheon/desktop/wingpanel/wrapper.nix
index ca887d45dc398..32ce4a0551469 100644
--- a/pkgs/desktops/pantheon/desktop/wingpanel/wrapper.nix
+++ b/pkgs/desktops/pantheon/desktop/wingpanel/wrapper.nix
@@ -32,8 +32,8 @@ stdenv.mkDerivation rec {
     wrapGAppsHook
   ];
 
-  buildInputs = lib.forEach selectedIndicators (x: x.buildInputs)
-    ++ selectedIndicators;
+  buildInputs = lib.flatten (lib.forEach selectedIndicators (x: x.buildInputs)
+    ++ selectedIndicators);
 
   dontUnpack = true;
   dontConfigure = true;
diff --git a/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix b/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
index 43fd7a69e8ad3..791aee0909a6c 100644
--- a/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
+++ b/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
@@ -136,7 +136,7 @@ stdenv.mkDerivation rec {
 
     # Default for release buildtype but passed manually because
     # we're using plain
-  NIX_CFLAGS_COMPILE = "-DG_DISABLE_CAST_CHECKS";
+  env.NIX_CFLAGS_COMPILE = "-DG_DISABLE_CAST_CHECKS";
 
   postPatch = ''
     for f in gnome-settings-daemon/codegen.py plugins/power/gsd-power-constants-update.pl meson_post_install.py; do
diff --git a/pkgs/desktops/plasma-5/kwin/default.nix b/pkgs/desktops/plasma-5/kwin/default.nix
index 2008529a38bc8..23f52fa937385 100644
--- a/pkgs/desktops/plasma-5/kwin/default.nix
+++ b/pkgs/desktops/plasma-5/kwin/default.nix
@@ -40,9 +40,7 @@ mkDerivation {
     ./0003-plugins-qpa-allow-using-nixos-wrapper.patch
     ./0001-NixOS-Unwrap-executable-name-for-.desktop-search.patch
   ];
-  CXXFLAGS = [
-    ''-DNIXPKGS_XWAYLAND=\"${lib.getBin xwayland}/bin/Xwayland\"''
-  ];
+  env.CXXFLAGS = ''-DNIXPKGS_XWAYLAND=\"${lib.getBin xwayland}/bin/Xwayland\"'';
   cmakeFlags = [ "-DCMAKE_SKIP_BUILD_RPATH=OFF" ];
   postInstall = ''
     # Some package(s) refer to these service types by the wrong name.
diff --git a/pkgs/desktops/plasma-5/plasma-desktop/default.nix b/pkgs/desktops/plasma-5/plasma-desktop/default.nix
index a07a50f04927b..a6e1b93032673 100644
--- a/pkgs/desktops/plasma-5/plasma-desktop/default.nix
+++ b/pkgs/desktops/plasma-5/plasma-desktop/default.nix
@@ -37,7 +37,7 @@ mkDerivation {
   postPatch = ''
     sed '1i#include <cmath>' -i kcms/touchpad/backends/x11/synapticstouchpad.cpp
   '';
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     "-I${lib.getDev xorgserver}/include/xorg"
     ''-DNIXPKGS_HWCLOCK=\"${lib.getBin util-linux}/sbin/hwclock\"''
   ];
diff --git a/pkgs/desktops/plasma-5/plasma-vault/default.nix b/pkgs/desktops/plasma-5/plasma-vault/default.nix
index e016944be4563..caabe85c25da8 100644
--- a/pkgs/desktops/plasma-5/plasma-vault/default.nix
+++ b/pkgs/desktops/plasma-5/plasma-vault/default.nix
@@ -28,7 +28,7 @@ mkDerivation {
     networkmanager-qt
   ];
 
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     ''-DNIXPKGS_ENCFS=\"${lib.getBin encfs}/bin/encfs\"''
     ''-DNIXPKGS_ENCFSCTL=\"${lib.getBin encfs}/bin/encfsctl\"''
 
diff --git a/pkgs/desktops/plasma-5/plasma-workspace/default.nix b/pkgs/desktops/plasma-5/plasma-workspace/default.nix
index b65bc7df8ed86..afe9628bc69da 100644
--- a/pkgs/desktops/plasma-5/plasma-workspace/default.nix
+++ b/pkgs/desktops/plasma-5/plasma-workspace/default.nix
@@ -59,7 +59,7 @@ mkDerivation {
       --replace 'query_qmake(QtBinariesDir QT_INSTALL_BINS)' 'set(QtBinariesDir "${lib.getBin qttools}/bin")'
   '';
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     ''-DNIXPKGS_XMESSAGE="${getBin xmessage}/bin/xmessage"''
     ''-DNIXPKGS_XRDB="${getBin xrdb}/bin/xrdb"''
     ''-DNIXPKGS_XSETROOT="${getBin xsetroot}/bin/xsetroot"''
diff --git a/pkgs/desktops/rox/rox-filer/default.nix b/pkgs/desktops/rox/rox-filer/default.nix
index ed00f37c6878d..5768c4571889d 100644
--- a/pkgs/desktops/rox/rox-filer/default.nix
+++ b/pkgs/desktops/rox/rox-filer/default.nix
@@ -13,7 +13,7 @@ in stdenv.mkDerivation {
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libxml2 gtk shared-mime-info libSM ];
-  NIX_LDFLAGS = "-ldl -lm";
+  env.NIX_LDFLAGS = "-ldl -lm";
 
   patches = [
     ./rox-filer-2.11-in-source-build.patch
diff --git a/pkgs/desktops/xfce/core/exo/default.nix b/pkgs/desktops/xfce/core/exo/default.nix
index 962170a1765ff..87117a4b43cf7 100644
--- a/pkgs/desktops/xfce/core/exo/default.nix
+++ b/pkgs/desktops/xfce/core/exo/default.nix
@@ -23,7 +23,7 @@ mkXfceDerivation {
   ];
 
   # Workaround https://bugzilla.xfce.org/show_bug.cgi?id=15825
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   meta = {
     description = "Application library for Xfce";
diff --git a/pkgs/desktops/xfce/core/xfce4-panel/default.nix b/pkgs/desktops/xfce/core/xfce4-panel/default.nix
index d0b1862c3f7c2..34e2c184d69da 100644
--- a/pkgs/desktops/xfce/core/xfce4-panel/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-panel/default.nix
@@ -49,7 +49,7 @@ mkXfceDerivation {
   '';
 
   # Workaround https://bugzilla.xfce.org/show_bug.cgi?id=15825
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   meta = {
     description = "Panel for the Xfce desktop environment";
diff --git a/pkgs/desktops/xfce/core/xfce4-session/default.nix b/pkgs/desktops/xfce/core/xfce4-session/default.nix
index 0d4c0615898c6..36a8e8ecd9fe7 100644
--- a/pkgs/desktops/xfce/core/xfce4-session/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-session/default.nix
@@ -12,7 +12,7 @@ mkXfceDerivation {
   configureFlags = [ "--with-xsession-prefix=${placeholder "out"}" ];
 
   # See https://github.com/NixOS/nixpkgs/issues/36468
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   passthru.xinitrc = "${xfce4-session}/etc/xdg/xfce4/xinitrc";
 
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix
index 10850974bb7d3..b09f1a5c14f9b 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix
@@ -24,7 +24,7 @@ mkXfceDerivation {
     automakeAddFlags
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${dbus-glib.dev}/include/dbus-1.0 -I${dbus.dev}/include/dbus-1.0";
+  env.NIX_CFLAGS_COMPILE = "-I${dbus-glib.dev}/include/dbus-1.0 -I${dbus.dev}/include/dbus-1.0";
 
   postPatch = ''
     substituteInPlace configure.ac.in --replace gio-2.0 gio-unix-2.0
diff --git a/pkgs/development/arduino/arduino-cli/default.nix b/pkgs/development/arduino/arduino-cli/default.nix
index 9629d90a3453f..5fdf40f6336f8 100644
--- a/pkgs/development/arduino/arduino-cli/default.nix
+++ b/pkgs/development/arduino/arduino-cli/default.nix
@@ -19,9 +19,10 @@ let
 
     doCheck = false;
 
-    buildFlagsArray = [
-      "-ldflags=-s -w -X github.com/arduino/arduino-cli/version.versionString=${version} -X github.com/arduino/arduino-cli/version.commit=unknown"
-    ] ++ lib.optionals stdenv.isLinux [ "-extldflags '-static'" ];
+    buildFlags = [
+      ("-ldflags=-s -w -X github.com/arduino/arduino-cli/version.versionString=${version} -X github.com/arduino/arduino-cli/version.commit=unknown"
+        + lib.optionalString stdenv.isLinux " -extldflags '-static'")
+    ];
 
     meta = with lib; {
       inherit (src.meta) homepage;
diff --git a/pkgs/development/arduino/arduino-core/default.nix b/pkgs/development/arduino/arduino-core/default.nix
index 529be6e2a56e8..001141040d8d4 100644
--- a/pkgs/development/arduino/arduino-core/default.nix
+++ b/pkgs/development/arduino/arduino-core/default.nix
@@ -131,14 +131,12 @@ stdenv.mkDerivation rec {
 
   buildPhase = ''
     # Copy pre-downloaded files to proper locations
-    download_src=($downloadSrcList)
-    download_dst=($downloadDstList)
-    while [[ "''${#download_src[@]}" -ne 0 ]]; do
-      file_src=''${download_src[0]}
-      file_dst=''${download_dst[0]}
+    while [[ "''${#downloadSrcList[@]}" -ne 0 ]]; do
+      file_src=''${downloadSrcList[0]}
+      file_dst=''${downloadDstList[0]}
       mkdir -p $(dirname $file_dst)
-      download_src=(''${download_src[@]:1})
-      download_dst=(''${download_dst[@]:1})
+      downloadSrcList=(''${downloadSrcList[@]:1})
+      downloadDstList=(''${downloadDstList[@]:1})
       cp -v $file_src $file_dst
     done
 
diff --git a/pkgs/development/beam-modules/fetch-hex.nix b/pkgs/development/beam-modules/fetch-hex.nix
index 7f84e23607040..4bb2d433f6f1c 100644
--- a/pkgs/development/beam-modules/fetch-hex.nix
+++ b/pkgs/development/beam-modules/fetch-hex.nix
@@ -14,14 +14,14 @@ stdenv.mkDerivation ({
     inherit sha256;
   };
 
-  phases = [ "unpackPhase" "installPhase" ];
-
   unpackCmd = ''
     tar -xf $curSrc contents.tar.gz
     mkdir contents
     tar -C contents -xzf contents.tar.gz
   '';
 
+  dontBuild = true;
+
   installPhase = ''
     runHook preInstall
     mkdir "$out"
diff --git a/pkgs/development/beam-modules/mix-release.nix b/pkgs/development/beam-modules/mix-release.nix
index 320fcaa9c9b7c..98a744ad393b5 100644
--- a/pkgs/development/beam-modules/mix-release.nix
+++ b/pkgs/development/beam-modules/mix-release.nix
@@ -18,13 +18,13 @@ in
 stdenv.mkDerivation (overridable // {
   nativeBuildInputs = nativeBuildInputs ++ [ erlang hex elixir makeWrapper git ];
 
-  MIX_ENV = mixEnv;
-  MIX_DEBUG = if enableDebugInfo then 1 else 0;
-  HEX_OFFLINE = 1;
-  DEBUG = if enableDebugInfo then 1 else 0; # for Rebar3 compilation
+  env.MIX_ENV = mixEnv;
+  env.MIX_DEBUG = if enableDebugInfo then 1 else 0;
+  env.HEX_OFFLINE = 1;
+  env.DEBUG = if enableDebugInfo then 1 else 0; # for Rebar3 compilation
   # the api with `mix local.rebar rebar path` makes a copy of the binary
-  MIX_REBAR = "${rebar}/bin/rebar";
-  MIX_REBAR3 = "${rebar3}/bin/rebar3";
+  env.MIX_REBAR = "${rebar}/bin/rebar";
+  env.MIX_REBAR3 = "${rebar3}/bin/rebar3";
 
   postUnpack = ''
     export HEX_HOME="$TEMPDIR/hex"
diff --git a/pkgs/development/bower-modules/generic/default.nix b/pkgs/development/bower-modules/generic/default.nix
index ba15b58816020..8ed5f8abd5e51 100644
--- a/pkgs/development/bower-modules/generic/default.nix
+++ b/pkgs/development/bower-modules/generic/default.nix
@@ -17,16 +17,14 @@ in pkgs.stdenv.mkDerivation (
 
     inherit bowerPackages;
 
-    builder = builtins.toFile "builder.sh" ''
-      source $stdenv/setup
-
+    buildCommand = ''
       # The project's bower.json is required
       cp $src/bower.json .
 
       # Dereference symlinks -- bower doesn't like them
       cp  --recursive --reflink=auto       \
           --dereference --no-preserve=mode \
-          $bowerPackages bc
+          "''${bowerPackages[@]}" bc
 
       # Bower install in offline mode -- links together the fetched
       # bower packages.
diff --git a/pkgs/development/compilers/aspectj/builder.sh b/pkgs/development/compilers/aspectj/builder.sh
index 3b43937200423..4c19dade25e81 100755
--- a/pkgs/development/compilers/aspectj/builder.sh
+++ b/pkgs/development/compilers/aspectj/builder.sh
@@ -1,3 +1,5 @@
+source .attrs.sh
+
 source $stdenv/setup
 
 export JAVA_HOME=$jre
diff --git a/pkgs/development/compilers/chez/default.nix b/pkgs/development/compilers/chez/default.nix
index c1c8eced83ba1..78b6e8d27cf9a 100644
--- a/pkgs/development/compilers/chez/default.nix
+++ b/pkgs/development/compilers/chez/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=format-truncation";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=format-truncation";
 
   /*
   ** We patch out a very annoying 'feature' in ./configure, which
diff --git a/pkgs/development/compilers/clasp/default.nix b/pkgs/development/compilers/clasp/default.nix
index 31a669c313e0e..77a45003bc966 100644
--- a/pkgs/development/compilers/clasp/default.nix
+++ b/pkgs/development/compilers/clasp/default.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation rec {
       (x: {configureFlags = (x.configureFlags or []) ++ ["--enable-static"];}))
   ];
 
-  NIX_CXXSTDLIB_COMPILE = " -frtti ";
+  env.NIX_CXXSTDLIB_COMPILE = " -frtti ";
 
   postPatch = ''
     echo "
diff --git a/pkgs/development/compilers/crystal/build-package.nix b/pkgs/development/compilers/crystal/build-package.nix
index 67c8128f6b5d7..2d2eaf0a4638b 100644
--- a/pkgs/development/compilers/crystal/build-package.nix
+++ b/pkgs/development/compilers/crystal/build-package.nix
@@ -54,9 +54,9 @@ stdenv.mkDerivation (mkDerivationArgs // {
       ++ [ "runHook postConfigure" ]
     );
 
-  CRFLAGS = lib.concatStringsSep " " defaultOptions;
+  env.CRFLAGS = lib.concatStringsSep " " defaultOptions;
 
-  PREFIX = placeholder "out";
+  env.PREFIX = placeholder "out";
 
   buildInputs = args.buildInputs or [ ] ++ [ crystal ]
     ++ lib.optional (format != "crystal") shards;
@@ -66,7 +66,7 @@ stdenv.mkDerivation (mkDerivationArgs // {
   buildPhase = args.buildPhase or (lib.concatStringsSep "\n" ([
     "runHook preBuild"
   ] ++ lib.optional (format == "make")
-    "make \${buildTargets:-build} $makeFlags"
+    "make \${buildTargets:-build} \"\${makeFlags[@]}\""
   ++ lib.optionals (format == "crystal") (lib.mapAttrsToList
     (bin: attrs: ''
       crystal ${lib.escapeShellArgs ([
@@ -84,7 +84,7 @@ stdenv.mkDerivation (mkDerivationArgs // {
   installPhase = args.installPhase or (lib.concatStringsSep "\n" ([
     "runHook preInstall"
   ] ++ lib.optional (format == "make")
-    "make \${installTargets:-install} $installFlags"
+    "make \${installTargets:-install} \"\${installFlags[@]}\""
   ++ lib.optionals (format == "crystal") (map
     (bin: ''
       install -Dm555 ${lib.escapeShellArgs [ bin "${placeholder "out"}/bin/${bin}" ]}
@@ -111,9 +111,9 @@ stdenv.mkDerivation (mkDerivationArgs // {
   checkPhase = args.checkPhase or (lib.concatStringsSep "\n" ([
     "runHook preCheck"
   ] ++ lib.optional (format == "make")
-    "make \${checkTarget:-test} $checkFlags"
+    "make \${checkTarget:-test} \"\${checkFlags[@]}\""
   ++ lib.optional (format != "make")
-    "crystal \${checkTarget:-spec} $checkFlags"
+    "crystal \${checkTarget:-spec} \"\${checkFlags[@]}\""
   ++ [ "runHook postCheck" ]));
 
   doInstallCheck = args.doInstallCheck or true;
diff --git a/pkgs/development/compilers/crystal/default.nix b/pkgs/development/compilers/crystal/default.nix
index 8fc4a15efcedd..1280cafe43406 100644
--- a/pkgs/development/compilers/crystal/default.nix
+++ b/pkgs/development/compilers/crystal/default.nix
@@ -146,16 +146,13 @@ let
         "CRYSTAL_CONFIG_VERSION=${version}"
       ];
 
-      LLVM_CONFIG = "${llvmPackages.llvm.dev}/bin/llvm-config";
+      env.LLVM_CONFIG = "${llvmPackages.llvm.dev}/bin/llvm-config";
 
-      FLAGS = [
-        "--release"
-        "--single-module" # needed for deterministic builds
-      ];
+      env.FLAGS = "--release --single-module"; # needed for deterministic builds
 
       # This makes sure we don't keep depending on the previous version of
       # crystal used to build this one.
-      CRYSTAL_LIBRARY_PATH = "${placeholder "lib"}/crystal";
+      env.CRYSTAL_LIBRARY_PATH = "${placeholder "lib"}/crystal";
 
       # We *have* to add `which` to the PATH or crystal is unable to build
       # stuff later if which is not available.
diff --git a/pkgs/development/compilers/dmd/default.nix b/pkgs/development/compilers/dmd/default.nix
index 3ae72e5862f70..fd91b39fe384d 100644
--- a/pkgs/development/compilers/dmd/default.nix
+++ b/pkgs/development/compilers/dmd/default.nix
@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper unzip which gdb git ]
 
-  ++ lib.optional stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [
     Foundation
   ]);
 
@@ -95,7 +95,7 @@ stdenv.mkDerivation rec {
     "osx"
   else
     stdenv.hostPlatform.parsed.kernel.name;
-  top = "$(echo $NIX_BUILD_TOP)";
+  top = "$(echo $NIX_BUILD_TOP/$sourceRoot)";
   pathToDmd = "${top}/dmd/generated/${osname}/release/${bits}/dmd";
 
   # Buid and install are based on http://wiki.dlang.org/Building_DMD
diff --git a/pkgs/development/compilers/edk2/default.nix b/pkgs/development/compilers/edk2/default.nix
index 9d1abc11af190..ffab89c0ba45d 100644
--- a/pkgs/development/compilers/edk2/default.nix
+++ b/pkgs/development/compilers/edk2/default.nix
@@ -49,9 +49,9 @@ edk2 = buildStdenv.mkDerivation {
   buildInputs = [ libuuid pythonEnv ];
 
   makeFlags = [ "-C BaseTools" ]
-    ++ lib.optional (stdenv.cc.isClang) [ "BUILD_CC=clang BUILD_CXX=clang++ BUILD_AS=clang" ];
+    ++ lib.optionals (stdenv.cc.isClang) [ "BUILD_CC=clang" "BUILD_CXX=clang++" "BUILD_AS=clang" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-return-type" + lib.optionalString (stdenv.cc.isGNU) " -Wno-error=stringop-truncation";
+  env.NIX_CFLAGS_COMPILE = "-Wno-return-type" + lib.optionalString (stdenv.cc.isGNU) " -Wno-error=stringop-truncation";
 
   hardeningDisable = [ "format" "fortify" ];
 
diff --git a/pkgs/development/compilers/elm/packages/node-composition.nix b/pkgs/development/compilers/elm/packages/node-composition.nix
index 4b662bd072b4f..c670e724dfbd7 100644
--- a/pkgs/development/compilers/elm/packages/node-composition.nix
+++ b/pkgs/development/compilers/elm/packages/node-composition.nix
@@ -6,7 +6,7 @@
 
 let
   nodeEnv = import ../../../node-packages/node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile;
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile jq;
     inherit pkgs nodejs;
     libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
   };
diff --git a/pkgs/development/compilers/eql/default.nix b/pkgs/development/compilers/eql/default.nix
index a3fefbc1f480e..b049913854408 100644
--- a/pkgs/development/compilers/eql/default.nix
+++ b/pkgs/development/compilers/eql/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ecl qt4 xorgserver xkbcomp xkeyboard_config ];
 
-  NIX_CFLAGS_COMPILE = "-fPIC";
+  env.NIX_CFLAGS_COMPILE = "-fPIC";
 
   postPatch = ''
     sed -re 's@[(]in-home "gui/.command-history"[)]@(concatenate '"'"'string (ext:getenv "HOME") "/.eql-gui-command-history")@' -i gui/gui.lisp
diff --git a/pkgs/development/compilers/fpc/binary-builder.sh b/pkgs/development/compilers/fpc/binary-builder.sh
deleted file mode 100755
index 4308c1ed211ae..0000000000000
--- a/pkgs/development/compilers/fpc/binary-builder.sh
+++ /dev/null
@@ -1,14 +0,0 @@
-source $stdenv/setup
-
-tar xf $src
-cd */
-tarballdir=$(pwd)
-for i in *.tar; do tar xvf $i; done
-echo "Deploying binaries.."
-mkdir $out
-cd $out
-for i in $tarballdir/*.gz; do tar xvf $i; done
-echo 'Creating ppc* symlink..'
-for i in $out/lib/fpc/*/ppc*; do
-  ln -fs $i $out/bin/$(basename $i)
-done
diff --git a/pkgs/development/compilers/fpc/binary.nix b/pkgs/development/compilers/fpc/binary.nix
index c7e3ec30b49f1..d95c77ffa5ad8 100644
--- a/pkgs/development/compilers/fpc/binary.nix
+++ b/pkgs/development/compilers/fpc/binary.nix
@@ -22,7 +22,20 @@ stdenv.mkDerivation rec {
       }
     else throw "Not supported on ${stdenv.hostPlatform.system}.";
 
-  builder = ./binary-builder.sh;
+  buildPhase = ''
+    tarballdir=$(pwd)
+    for i in *.tar; do tar xvf $i; done
+  '';
+
+  installPhase = ''
+    mkdir $out
+    cd $out
+    for i in $tarballdir/*.gz; do tar xvf $i; done
+    echo 'Creating ppc* symlink..'
+    for i in $out/lib/fpc/*/ppc*; do
+      ln -fs $i $out/bin/$(basename $i)
+    done
+  '';
 
   meta = {
     description = "Free Pascal Compiler from a binary distribution";
diff --git a/pkgs/development/compilers/fpc/lazarus.nix b/pkgs/development/compilers/fpc/lazarus.nix
index 5cd0609960dfd..2368e4339747a 100644
--- a/pkgs/development/compilers/fpc/lazarus.nix
+++ b/pkgs/development/compilers/fpc/lazarus.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
 
   LCL_PLATFORM = if withQt then "qt5" else "gtk2";
 
-  NIX_LDFLAGS = lib.concatStringsSep " " ([
+  env.NIX_LDFLAGS = lib.concatStringsSep " " ([
     "-L${stdenv.cc.cc.lib}/lib"
     "-lX11"
     "-lXext"
diff --git a/pkgs/development/compilers/gcc/10/default.nix b/pkgs/development/compilers/gcc/10/default.nix
index aebe7b30f1a78..018c07315ef65 100644
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@@ -97,7 +97,6 @@ stdenv.mkDerivation ({
 
   outputs = [ "out" "man" "info" ] ++ lib.optional (!langJit) "lib";
   setOutputFlags = false;
-  NIX_NO_SELF_RPATH = true;
 
   libc_dev = stdenv.cc.libc_dev;
 
@@ -182,8 +181,6 @@ stdenv.mkDerivation ({
 
   depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
-
   preConfigure = import ../common/pre-configure.nix {
     inherit lib;
     inherit version targetPlatform hostPlatform gnatboot langAda langGo langJit;
@@ -229,31 +226,40 @@ stdenv.mkDerivation ({
 
   installTargets = optional stripped "install-strip";
 
-  # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
-  ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
-
-  # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
-  # library headers and binaries, regarless of the language being compiled.
-  #
-  # Likewise, the LTO code doesn't find zlib.
-  #
-  # Cross-compiling, we need gcc not to read ./specs in order to build the g++
-  # compiler (after the specs for the cross-gcc are created). Having
-  # LIBRARY_PATH= makes gcc read the specs from ., and the build breaks.
-
-  CPATH = optionals (targetPlatform == hostPlatform) (makeSearchPathOutput "dev" "include" ([]
-    ++ optional (zlib != null) zlib
-  ));
-
-  LIBRARY_PATH = optionals (targetPlatform == hostPlatform) (makeLibraryPath (optional (zlib != null) zlib));
-
-  inherit
-    (import ../common/extra-target-flags.nix {
-      inherit lib stdenv crossStageStatic libcCross threadsCross;
-    })
-    EXTRA_FLAGS_FOR_TARGET
-    EXTRA_LDFLAGS_FOR_TARGET
-    ;
+  env = {
+    NIX_NO_SELF_RPATH = true;
+
+    # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
+    # library headers and binaries, regarless of the language being compiled.
+    #
+    # Likewise, the LTO code doesn't find zlib.
+    #
+    # Cross-compiling, we need gcc not to read ./specs in order to build the g++
+    # compiler (after the specs for the cross-gcc are created). Having
+    # LIBRARY_PATH= makes gcc read the specs from ., and the build breaks.
+
+    CPATH = toString (makeSearchPathOutput "dev" "include" ([]
+      ++ optional (zlib != null) zlib
+    ));
+
+    # Per https://gcc.gnu.org/onlinedocs/gcc/Environment-Variables.html only
+    # affects native buidls, but should be fine for cross.
+    LIBRARY_PATH = toString (makeLibraryPath ([]
+      ++ optional (zlib != null) zlib
+    ));
+
+    inherit
+      (import ../common/extra-target-flags.nix {
+        inherit lib stdenv crossStageStatic libcCross threadsCross;
+      })
+      EXTRA_FLAGS_FOR_TARGET
+      EXTRA_LDFLAGS_FOR_TARGET
+      ;
+    NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  } // optionalAttrs (hostPlatform.system == "x86_64-solaris") {
+    # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
+    CC = "gcc -m64";
+  };
 
   passthru = {
     inherit langC langCC langObjC langObjCpp langAda langFortran langGo version;
@@ -292,7 +298,7 @@ stdenv.mkDerivation ({
 
 // optionalAttrs (targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt" && crossStageStatic) {
   makeFlags = [ "all-gcc" "all-target-libgcc" ];
-  installTargets = "install-gcc install-target-libgcc";
+  installTargets = [ "install-gcc" "install-target-libgcc" ];
 }
 
 // optionalAttrs (enableMultilib) { dontMoveLib64 = true; }
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index 86dd9247f5a04..9d23d98be004d 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -138,7 +138,6 @@ stdenv.mkDerivation ({
 
   outputs = [ "out" "lib" "man" "info" ];
   setOutputFlags = false;
-  NIX_NO_SELF_RPATH = true;
 
   libc_dev = stdenv.cc.libc_dev;
 
@@ -242,44 +241,51 @@ stdenv.mkDerivation ({
 
   installTargets = optional stripped "install-strip";
 
-  # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
-  ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
-
-  # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
-  # library headers and binaries, regarless of the language being compiled.
-  #
-  # Note: When building the Java AWT GTK peer, the build system doesn't honor
-  # `--with-gmp' et al., e.g., when building
-  # `libjava/classpath/native/jni/java-math/gnu_java_math_GMP.c', so we just add
-  # them to $CPATH and $LIBRARY_PATH in this case.
-  #
-  # Likewise, the LTO code doesn't find zlib.
-  #
-  # Cross-compiling, we need gcc not to read ./specs in order to build the g++
-  # compiler (after the specs for the cross-gcc are created). Having
-  # LIBRARY_PATH= makes gcc read the specs from ., and the build breaks.
-
-  CPATH = optionals (targetPlatform == hostPlatform) (makeSearchPathOutput "dev" "include" ([]
-    ++ optional (zlib != null) zlib
-    ++ optional langJava boehmgc
-    ++ optionals javaAwtGtk xlibs
-    ++ optionals javaAwtGtk [ gmp mpfr ]
-  ));
-
-  LIBRARY_PATH = optionals (targetPlatform == hostPlatform) (makeLibraryPath ([]
-    ++ optional (zlib != null) zlib
-    ++ optional langJava boehmgc
-    ++ optionals javaAwtGtk xlibs
-    ++ optionals javaAwtGtk [ gmp mpfr ]
-  ));
-
-  inherit
-    (import ../common/extra-target-flags.nix {
-      inherit lib stdenv crossStageStatic libcCross threadsCross;
-    })
-    EXTRA_FLAGS_FOR_TARGET
-    EXTRA_LDFLAGS_FOR_TARGET
-    ;
+  env = {
+    NIX_NO_SELF_RPATH = true;
+
+    # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
+    # library headers and binaries, regarless of the language being compiled.
+    #
+    # Note: When building the Java AWT GTK peer, the build system doesn't honor
+    # `--with-gmp' et al., e.g., when building
+    # `libjava/classpath/native/jni/java-math/gnu_java_math_GMP.c', so we just add
+    # them to $CPATH and $LIBRARY_PATH in this case.
+    #
+    # Likewise, the LTO code doesn't find zlib.
+    #
+    # Cross-compiling, we need gcc not to read ./specs in order to build the g++
+    # compiler (after the specs for the cross-gcc are created). Having
+    # LIBRARY_PATH= makes gcc read the specs from ., and the build breaks.
+
+    CPATH = toString (makeSearchPathOutput "dev" "include" ([]
+      ++ optional (zlib != null) zlib
+      ++ optional langJava boehmgc
+      ++ optionals javaAwtGtk xlibs
+      ++ optionals javaAwtGtk [ gmp mpfr ]
+    ));
+
+    # Per https://gcc.gnu.org/onlinedocs/gcc/Environment-Variables.html only
+    # affects native buidls, but should be fine for cross.
+    LIBRARY_PATH = toString (makeLibraryPath ([]
+      ++ optional (zlib != null) zlib
+      ++ optional langJava boehmgc
+      ++ optionals javaAwtGtk xlibs
+      ++ optionals javaAwtGtk [ gmp mpfr ]
+    ));
+
+    inherit
+      (import ../common/extra-target-flags.nix {
+        inherit lib stdenv crossStageStatic libcCross threadsCross;
+      })
+      EXTRA_FLAGS_FOR_TARGET
+      EXTRA_LDFLAGS_FOR_TARGET
+      ;
+    NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  } // optionalAttrs (hostPlatform.system == "x86_64-solaris") {
+    # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
+    CC = "gcc -m64";
+  };
 
   passthru = {
     inherit langC langCC langObjC langObjCpp langFortran langGo version;
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index b7c9e5bcc0a54..fe56a2e0b242f 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -151,7 +151,6 @@ stdenv.mkDerivation ({
   outputs = if langJava || langGo then ["out" "man" "info"]
     else [ "out" "lib" "man" "info" ];
   setOutputFlags = false;
-  NIX_NO_SELF_RPATH = true;
 
   libc_dev = stdenv.cc.libc_dev;
 
@@ -255,44 +254,51 @@ stdenv.mkDerivation ({
 
   installTargets = optional stripped "install-strip";
 
-  # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
-  ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
-
-  # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
-  # library headers and binaries, regarless of the language being compiled.
-  #
-  # Note: When building the Java AWT GTK peer, the build system doesn't honor
-  # `--with-gmp' et al., e.g., when building
-  # `libjava/classpath/native/jni/java-math/gnu_java_math_GMP.c', so we just add
-  # them to $CPATH and $LIBRARY_PATH in this case.
-  #
-  # Likewise, the LTO code doesn't find zlib.
-  #
-  # Cross-compiling, we need gcc not to read ./specs in order to build the g++
-  # compiler (after the specs for the cross-gcc are created). Having
-  # LIBRARY_PATH= makes gcc read the specs from ., and the build breaks.
-
-  CPATH = optionals (targetPlatform == hostPlatform) (makeSearchPathOutput "dev" "include" ([]
-    ++ optional (zlib != null) zlib
-    ++ optional langJava boehmgc
-    ++ optionals javaAwtGtk xlibs
-    ++ optionals javaAwtGtk [ gmp mpfr ]
-  ));
-
-  LIBRARY_PATH = optionals (targetPlatform == hostPlatform) (makeLibraryPath ([]
-    ++ optional (zlib != null) zlib
-    ++ optional langJava boehmgc
-    ++ optionals javaAwtGtk xlibs
-    ++ optionals javaAwtGtk [ gmp mpfr ]
-  ));
-
-  inherit
-    (import ../common/extra-target-flags.nix {
-      inherit lib stdenv crossStageStatic libcCross threadsCross;
-    })
-    EXTRA_FLAGS_FOR_TARGET
-    EXTRA_LDFLAGS_FOR_TARGET
-    ;
+  env = {
+    NIX_NO_SELF_RPATH = true;
+
+    # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
+    # library headers and binaries, regarless of the language being compiled.
+    #
+    # Note: When building the Java AWT GTK peer, the build system doesn't honor
+    # `--with-gmp' et al., e.g., when building
+    # `libjava/classpath/native/jni/java-math/gnu_java_math_GMP.c', so we just add
+    # them to $CPATH and $LIBRARY_PATH in this case.
+    #
+    # Likewise, the LTO code doesn't find zlib.
+    #
+    # Cross-compiling, we need gcc not to read ./specs in order to build the g++
+    # compiler (after the specs for the cross-gcc are created). Having
+    # LIBRARY_PATH= makes gcc read the specs from ., and the build breaks.
+
+    CPATH = toString (makeSearchPathOutput "dev" "include" ([]
+      ++ optional (zlib != null) zlib
+      ++ optional langJava boehmgc
+      ++ optionals javaAwtGtk xlibs
+      ++ optionals javaAwtGtk [ gmp mpfr ]
+    ));
+
+    # Per https://gcc.gnu.org/onlinedocs/gcc/Environment-Variables.html only
+    # affects native buidls, but should be fine for cross.
+    LIBRARY_PATH = toString (makeLibraryPath ([]
+      ++ optional (zlib != null) zlib
+      ++ optional langJava boehmgc
+      ++ optionals javaAwtGtk xlibs
+      ++ optionals javaAwtGtk [ gmp mpfr ]
+    ));
+
+    inherit
+      (import ../common/extra-target-flags.nix {
+        inherit lib stdenv crossStageStatic libcCross threadsCross;
+      })
+      EXTRA_FLAGS_FOR_TARGET
+      EXTRA_LDFLAGS_FOR_TARGET
+      ;
+    NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  } // optionalAttrs (hostPlatform.system == "x86_64-solaris") {
+    # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
+    CC = "gcc -m64";
+  };
 
   passthru = {
     inherit langC langCC langObjC langObjCpp langFortran langGo version;
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index 069d9c18a62b5..034ba49829b43 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -148,7 +148,6 @@ stdenv.mkDerivation ({
   outputs = if langJava || langGo || langJit then ["out" "man" "info"]
     else [ "out" "lib" "man" "info" ];
   setOutputFlags = false;
-  NIX_NO_SELF_RPATH = true;
 
   libc_dev = stdenv.cc.libc_dev;
 
@@ -228,8 +227,6 @@ stdenv.mkDerivation ({
 
   depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
-
   preConfigure = import ../common/pre-configure.nix {
     inherit lib;
     inherit version targetPlatform hostPlatform gnatboot langJava langAda langGo;
@@ -278,44 +275,51 @@ stdenv.mkDerivation ({
 
   installTargets = optional stripped "install-strip";
 
-  # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
-  ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
-
-  # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
-  # library headers and binaries, regarless of the language being compiled.
-  #
-  # Note: When building the Java AWT GTK peer, the build system doesn't honor
-  # `--with-gmp' et al., e.g., when building
-  # `libjava/classpath/native/jni/java-math/gnu_java_math_GMP.c', so we just add
-  # them to $CPATH and $LIBRARY_PATH in this case.
-  #
-  # Likewise, the LTO code doesn't find zlib.
-  #
-  # Cross-compiling, we need gcc not to read ./specs in order to build the g++
-  # compiler (after the specs for the cross-gcc are created). Having
-  # LIBRARY_PATH= makes gcc read the specs from ., and the build breaks.
-
-  CPATH = optionals (targetPlatform == hostPlatform) (makeSearchPathOutput "dev" "include" ([]
-    ++ optional (zlib != null) zlib
-    ++ optional langJava boehmgc
-    ++ optionals javaAwtGtk xlibs
-    ++ optionals javaAwtGtk [ gmp mpfr ]
-  ));
-
-  LIBRARY_PATH = optionals (targetPlatform == hostPlatform) (makeLibraryPath ([]
-    ++ optional (zlib != null) zlib
-    ++ optional langJava boehmgc
-    ++ optionals javaAwtGtk xlibs
-    ++ optionals javaAwtGtk [ gmp mpfr ]
-  ));
-
-  inherit
-    (import ../common/extra-target-flags.nix {
-      inherit lib stdenv crossStageStatic libcCross threadsCross;
-    })
-    EXTRA_FLAGS_FOR_TARGET
-    EXTRA_LDFLAGS_FOR_TARGET
-    ;
+  env = {
+    NIX_NO_SELF_RPATH = true;
+
+    # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
+    # library headers and binaries, regarless of the language being compiled.
+    #
+    # Note: When building the Java AWT GTK peer, the build system doesn't honor
+    # `--with-gmp' et al., e.g., when building
+    # `libjava/classpath/native/jni/java-math/gnu_java_math_GMP.c', so we just add
+    # them to $CPATH and $LIBRARY_PATH in this case.
+    #
+    # Likewise, the LTO code doesn't find zlib.
+    #
+    # Cross-compiling, we need gcc not to read ./specs in order to build the g++
+    # compiler (after the specs for the cross-gcc are created). Having
+    # LIBRARY_PATH= makes gcc read the specs from ., and the build breaks.
+
+    CPATH = toString (makeSearchPathOutput "dev" "include" ([]
+      ++ optional (zlib != null) zlib
+      ++ optional langJava boehmgc
+      ++ optionals javaAwtGtk xlibs
+      ++ optionals javaAwtGtk [ gmp mpfr ]
+    ));
+
+    # Per https://gcc.gnu.org/onlinedocs/gcc/Environment-Variables.html only
+    # affects native buidls, but should be fine for cross.
+    LIBRARY_PATH = toString (makeLibraryPath ([]
+      ++ optional (zlib != null) zlib
+      ++ optional langJava boehmgc
+      ++ optionals javaAwtGtk xlibs
+      ++ optionals javaAwtGtk [ gmp mpfr ]
+    ));
+
+    inherit
+      (import ../common/extra-target-flags.nix {
+        inherit stdenv lib crossStageStatic libcCross threadsCross;
+      })
+      EXTRA_FLAGS_FOR_TARGET
+      EXTRA_LDFLAGS_FOR_TARGET
+      ;
+    NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  } // optionalAttrs (hostPlatform.system == "x86_64-solaris") {
+    # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
+    CC = "gcc -m64";
+  };
 
   passthru = {
     inherit langC langCC langObjC langObjCpp langFortran langAda langGo version;
diff --git a/pkgs/development/compilers/gcc/7/default.nix b/pkgs/development/compilers/gcc/7/default.nix
index 1f153b0fb3a3d..ee8fe59c0f9dc 100644
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@@ -108,7 +108,6 @@ stdenv.mkDerivation ({
 
   outputs = [ "out" "man" "info" ] ++ lib.optional (!langJit) "lib";
   setOutputFlags = false;
-  NIX_NO_SELF_RPATH = true;
 
   libc_dev = stdenv.cc.libc_dev;
 
@@ -192,9 +191,6 @@ stdenv.mkDerivation ({
 
   depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
 
-  NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument";
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
-
   preConfigure = import ../common/pre-configure.nix {
     inherit lib;
     inherit version targetPlatform hostPlatform langGo;
@@ -243,31 +239,41 @@ stdenv.mkDerivation ({
 
   installTargets = optional stripped "install-strip";
 
-  # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
-  ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
-
-  # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
-  # library headers and binaries, regarless of the language being compiled.
-  #
-  # Likewise, the LTO code doesn't find zlib.
-  #
-  # Cross-compiling, we need gcc not to read ./specs in order to build the g++
-  # compiler (after the specs for the cross-gcc are created). Having
-  # LIBRARY_PATH= makes gcc read the specs from ., and the build breaks.
-
-  CPATH = optionals (targetPlatform == hostPlatform) (makeSearchPathOutput "dev" "include" ([]
-    ++ optional (zlib != null) zlib
-  ));
-
-  LIBRARY_PATH = optionals (targetPlatform == hostPlatform) (makeLibraryPath (optional (zlib != null) zlib));
-
-  inherit
-    (import ../common/extra-target-flags.nix {
-      inherit lib stdenv crossStageStatic libcCross threadsCross;
-    })
-    EXTRA_FLAGS_FOR_TARGET
-    EXTRA_LDFLAGS_FOR_TARGET
-    ;
+  env = {
+    NIX_NO_SELF_RPATH = true;
+
+    # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
+    # library headers and binaries, regarless of the language being compiled.
+    #
+    # Likewise, the LTO code doesn't find zlib.
+    #
+    # Cross-compiling, we need gcc not to read ./specs in order to build the g++
+    # compiler (after the specs for the cross-gcc are created). Having
+    # LIBRARY_PATH= makes gcc read the specs from ., and the build breaks.
+
+    CPATH = toString (makeSearchPathOutput "dev" "include" ([]
+      ++ optional (zlib != null) zlib
+    ));
+
+    # Per https://gcc.gnu.org/onlinedocs/gcc/Environment-Variables.html only
+    # affects native buidls, but should be fine for cross.
+    LIBRARY_PATH = toString (makeLibraryPath ([]
+      ++ optional (zlib != null) zlib
+    ));
+
+    inherit
+      (import ../common/extra-target-flags.nix {
+        inherit lib stdenv crossStageStatic libcCross threadsCross;
+      })
+      EXTRA_FLAGS_FOR_TARGET
+      EXTRA_LDFLAGS_FOR_TARGET
+      ;
+    NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument";
+    NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  } // optionalAttrs (hostPlatform.system == "x86_64-solaris") {
+    # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
+    CC = "gcc -m64";
+  };
 
   passthru = {
     inherit langC langCC langObjC langObjCpp langFortran langGo version;
diff --git a/pkgs/development/compilers/gcc/8/default.nix b/pkgs/development/compilers/gcc/8/default.nix
index 4d9e216947d49..ce74c49c3c3b5 100644
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@@ -95,7 +95,6 @@ stdenv.mkDerivation ({
 
   outputs = [ "out" "man" "info" ] ++ lib.optional (!langJit) "lib";
   setOutputFlags = false;
-  NIX_NO_SELF_RPATH = true;
 
   libc_dev = stdenv.cc.libc_dev;
 
@@ -179,8 +178,6 @@ stdenv.mkDerivation ({
 
   depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
-
   preConfigure = import ../common/pre-configure.nix {
     inherit lib;
     inherit version targetPlatform hostPlatform langGo;
@@ -225,31 +222,33 @@ stdenv.mkDerivation ({
 
   installTargets = optional stripped "install-strip";
 
-  # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
-  ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
-
-  # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
-  # library headers and binaries, regarless of the language being compiled.
-  #
-  # Likewise, the LTO code doesn't find zlib.
-  #
-  # Cross-compiling, we need gcc not to read ./specs in order to build the g++
-  # compiler (after the specs for the cross-gcc are created). Having
-  # LIBRARY_PATH= makes gcc read the specs from ., and the build breaks.
-
-  CPATH = optionals (targetPlatform == hostPlatform) (makeSearchPathOutput "dev" "include" ([]
-    ++ optional (zlib != null) zlib
-  ));
-
-  LIBRARY_PATH = optionals (targetPlatform == hostPlatform) (makeLibraryPath (optional (zlib != null) zlib));
-
-  inherit
-    (import ../common/extra-target-flags.nix {
-      inherit lib stdenv crossStageStatic libcCross threadsCross;
-    })
-    EXTRA_FLAGS_FOR_TARGET
-    EXTRA_LDFLAGS_FOR_TARGET
-    ;
+  env = {
+    NIX_NO_SELF_RPATH = true;
+
+    inherit
+      (import ../common/extra-target-flags.nix {
+        inherit lib stdenv crossStageStatic libcCross threadsCross;
+      })
+      EXTRA_FLAGS_FOR_TARGET
+      EXTRA_LDFLAGS_FOR_TARGET
+      ;
+  } // optionalAttrs (targetPlatform == hostPlatform) {
+    # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
+    # library headers and binaries, regarless of the language being compiled.
+    #
+    # Likewise, the LTO code doesn't find zlib.
+    #
+    # Cross-compiling, we need gcc not to read ./specs in order to build the g++
+    # compiler (after the specs for the cross-gcc are created). Having
+    # LIBRARY_PATH= makes gcc read the specs from ., and the build breaks.
+    CPATH = makeSearchPathOutput "dev" "include" (optional (zlib != null) zlib);
+    LIBRARY_PATH = makeLibraryPath (optional (zlib != null) zlib);
+  } // optionalAttrs (hostPlatform.system == "x86_64-solaris") {
+    # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
+    CC = "gcc -m64";
+  } // optionalAttrs hostPlatform.isSunOS {
+    NIX_LDFLAGS = "-lm -ldl";
+  };
 
   passthru = {
     inherit langC langCC langObjC langObjCpp langFortran langGo version;
diff --git a/pkgs/development/compilers/gcc/9/default.nix b/pkgs/development/compilers/gcc/9/default.nix
index 09cf7e98db799..c9ea7714ece03 100644
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@@ -111,7 +111,6 @@ stdenv.mkDerivation ({
 
   outputs = [ "out" "man" "info" ] ++ lib.optional (!langJit) "lib";
   setOutputFlags = false;
-  NIX_NO_SELF_RPATH = true;
 
   libc_dev = stdenv.cc.libc_dev;
 
@@ -196,8 +195,6 @@ stdenv.mkDerivation ({
 
   depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
-
   preConfigure = import ../common/pre-configure.nix {
     inherit lib;
     inherit version targetPlatform hostPlatform gnatboot langAda langGo langJit;
@@ -244,31 +241,40 @@ stdenv.mkDerivation ({
 
   installTargets = optional stripped "install-strip";
 
-  # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
-  ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
-
-  # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
-  # library headers and binaries, regarless of the language being compiled.
-  #
-  # Likewise, the LTO code doesn't find zlib.
-  #
-  # Cross-compiling, we need gcc not to read ./specs in order to build the g++
-  # compiler (after the specs for the cross-gcc are created). Having
-  # LIBRARY_PATH= makes gcc read the specs from ., and the build breaks.
-
-  CPATH = optionals (targetPlatform == hostPlatform) (makeSearchPathOutput "dev" "include" ([]
-    ++ optional (zlib != null) zlib
-  ));
-
-  LIBRARY_PATH = optionals (targetPlatform == hostPlatform) (makeLibraryPath (optional (zlib != null) zlib));
-
-  inherit
-    (import ../common/extra-target-flags.nix {
-      inherit lib stdenv crossStageStatic langD libcCross threadsCross;
-    })
-    EXTRA_FLAGS_FOR_TARGET
-    EXTRA_LDFLAGS_FOR_TARGET
-    ;
+  env = {
+    NIX_NO_SELF_RPATH = true;
+
+    # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
+    # library headers and binaries, regarless of the language being compiled.
+    #
+    # Likewise, the LTO code doesn't find zlib.
+    #
+    # Cross-compiling, we need gcc not to read ./specs in order to build the g++
+    # compiler (after the specs for the cross-gcc are created). Having
+    # LIBRARY_PATH= makes gcc read the specs from ., and the build breaks.
+
+    CPATH = toString (makeSearchPathOutput "dev" "include" ([]
+      ++ optional (zlib != null) zlib
+    ));
+
+    # Per https://gcc.gnu.org/onlinedocs/gcc/Environment-Variables.html only
+    # affects native buidls, but should be fine for cross.
+    LIBRARY_PATH = toString (makeLibraryPath ([]
+      ++ optional (zlib != null) zlib
+    ));
+
+    inherit
+      (import ../common/extra-target-flags.nix {
+        inherit lib stdenv crossStageStatic libcCross threadsCross;
+      })
+      EXTRA_FLAGS_FOR_TARGET
+      EXTRA_LDFLAGS_FOR_TARGET
+      ;
+    NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  } // optionalAttrs (hostPlatform.system == "x86_64-solaris") {
+    # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
+    CC = "gcc -m64";
+  };
 
   passthru = {
     inherit langC langCC langObjC langObjCpp langAda langFortran langGo langD version;
diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
index e6d41d7b29ab7..ad7ea7c8e3cf0 100644
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@@ -1,5 +1,6 @@
-source $stdenv/setup
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 
+source $stdenv/setup
 
 oldOpts="$(shopt -po nounset)" || true
 set -euo pipefail
@@ -17,8 +18,6 @@ fi
 
 
 # GCC interprets empty paths as ".", which we don't want.
-if test -z "${CPATH-}"; then unset CPATH; fi
-if test -z "${LIBRARY_PATH-}"; then unset LIBRARY_PATH; fi
 echo "\$CPATH is \`${CPATH-}'"
 echo "\$LIBRARY_PATH is \`${LIBRARY_PATH-}'"
 
@@ -184,7 +183,7 @@ preConfigure() {
         mkdir -p ../mingw
         # --with-build-sysroot expects that:
         cp -R $libcCross/include ../mingw
-        configureFlags="$configureFlags --with-build-sysroot=`pwd`/.."
+        configureFlags+=("--with-build-sysroot=$(pwd)/..")
     fi
 
     # Eval the preConfigure script from nix expression.
diff --git a/pkgs/development/compilers/gcc/common/extra-target-flags.nix b/pkgs/development/compilers/gcc/common/extra-target-flags.nix
index ad4ab6bcb4bde..f008fd7d05798 100644
--- a/pkgs/development/compilers/gcc/common/extra-target-flags.nix
+++ b/pkgs/development/compilers/gcc/common/extra-target-flags.nix
@@ -14,8 +14,8 @@ in
       ] ++ lib.optionals (! crossStageStatic) [
         "-B${lib.getLib dep}${dep.libdir or "/lib"}"
       ]);
-    in mkFlags libcCross langD
-    ++ lib.optionals (!crossStageStatic) (mkFlags threadsCross langD)
+    in builtins.toString (mkFlags libcCross langD
+    ++ lib.optionals (!crossStageStatic) (mkFlags threadsCross langD))
     ;
 
   EXTRA_LDFLAGS_FOR_TARGET = let
@@ -27,7 +27,7 @@ in
           "-Wl,-rpath,${lib.getLib dep}${dep.libdir or "/lib"}"
           "-Wl,-rpath-link,${lib.getLib dep}${dep.libdir or "/lib"}"
       ]));
-    in mkFlags libcCross
-    ++ lib.optionals (!crossStageStatic) (mkFlags threadsCross)
+    in builtins.toString (mkFlags libcCross
+    ++ lib.optionals (!crossStageStatic) (mkFlags threadsCross))
     ;
 }
diff --git a/pkgs/development/compilers/gcl/default.nix b/pkgs/development/compilers/gcl/default.nix
index 6d0471dacbb50..68927633c7d43 100644
--- a/pkgs/development/compilers/gcl/default.nix
+++ b/pkgs/development/compilers/gcl/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" "bindnow" ];
 
-  NIX_CFLAGS_COMPILE = "-fgnu89-inline";
+  env.NIX_CFLAGS_COMPILE = "-fgnu89-inline";
 
   meta = with lib; {
     description = "GNU Common Lisp compiler working via GCC";
diff --git a/pkgs/development/compilers/gerbil/build.nix b/pkgs/development/compilers/gerbil/build.nix
index 3d2fd7551e67d..110378244fd00 100644
--- a/pkgs/development/compilers/gerbil/build.nix
+++ b/pkgs/development/compilers/gerbil/build.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ gambit ]
     ++ buildInputs_libraries; # ++ buildInputs_staticLibraries;
 
-  NIX_CFLAGS_COMPILE = "-I${libmysqlclient}/include/mysql -L${libmysqlclient}/lib/mysql";
+  env.NIX_CFLAGS_COMPILE = "-I${libmysqlclient}/include/mysql -L${libmysqlclient}/lib/mysql";
 
   postPatch = ''
     echo '(define (gerbil-version-string) "v${git-version}")' > src/gerbil/runtime/gx-version.scm ;
diff --git a/pkgs/development/compilers/ghc/8.6.5-binary.nix b/pkgs/development/compilers/ghc/8.6.5-binary.nix
index 092511ba6d783..b12fcd4f43140 100644
--- a/pkgs/development/compilers/ghc/8.6.5-binary.nix
+++ b/pkgs/development/compilers/ghc/8.6.5-binary.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
 
   # Cannot patchelf beforehand due to relative RPATHs that anticipate
   # the final install location/
-  ${libEnvVar} = libPath;
+  env.${libEnvVar} = libPath;
 
   postUnpack =
     # GHC has dtrace probes, which causes ld to try to open /usr/lib/libdtrace.dylib
diff --git a/pkgs/development/compilers/ghdl/default.nix b/pkgs/development/compilers/ghdl/default.nix
index e7886eb8f5ed9..9240bc790abc2 100644
--- a/pkgs/development/compilers/ghdl/default.nix
+++ b/pkgs/development/compilers/ghdl/default.nix
@@ -14,9 +14,9 @@ stdenv.mkDerivation rec {
     sha256 = "1gyh0xckwbzgslbpw9yrpj4gqs9fm1a2qpbzl0sh143fk1kwjlly";
   };
 
-  LIBRARY_PATH = "${stdenv.cc.libc}/lib";
+  env.LIBRARY_PATH = "${stdenv.cc.libc}/lib";
 
-  buildInputs = [ gnat zlib ] ++ lib.optional (backend == "llvm") [ llvm ];
+  buildInputs = [ gnat zlib ] ++ lib.optionals (backend == "llvm") [ llvm ];
   propagatedBuildInputs = lib.optionals (backend == "llvm") [ zlib ];
 
   preConfigure = ''
diff --git a/pkgs/development/compilers/go/1.14.nix b/pkgs/development/compilers/go/1.14.nix
index 92c1cbdfc18bb..ae451e6b5c609 100644
--- a/pkgs/development/compilers/go/1.14.nix
+++ b/pkgs/development/compilers/go/1.14.nix
@@ -173,36 +173,34 @@ stdenv.mkDerivation rec {
     find . -name '*.orig' -exec rm {} ';'
   '';
 
-  GOOS = stdenv.targetPlatform.parsed.kernel.name;
-  GOARCH = goarch stdenv.targetPlatform;
-  # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
-  # Go will nevertheless build a for host system that we will copy over in
-  # the install phase.
-  GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
-  GOHOSTARCH = goarch stdenv.buildPlatform;
-
-  # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
-  # to be different from CC/CXX
-  CC_FOR_TARGET = if (stdenv.buildPlatform != stdenv.targetPlatform) then
-      "${targetCC}/bin/${targetCC.targetPrefix}cc"
-    else
-      null;
-  CXX_FOR_TARGET = if (stdenv.buildPlatform != stdenv.targetPlatform) then
-      "${targetCC}/bin/${targetCC.targetPrefix}c++"
-    else
-      null;
-
-  GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
-  GO386 = 387; # from Arch: don't assume sse2 on i686
-  CGO_ENABLED = 1;
-  # Hopefully avoids test timeouts on Hydra
-  GO_TEST_TIMEOUT_SCALE = 3;
-
-  # Indicate that we are running on build infrastructure
-  # Some tests assume things like home directories and users exists
-  GO_BUILDER_NAME = "nix";
-
-  GOROOT_BOOTSTRAP="${goBootstrap}/share/go";
+  env = {
+    GOOS = stdenv.targetPlatform.parsed.kernel.name;
+    GOARCH = goarch stdenv.targetPlatform;
+    # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
+    # Go will nevertheless build a for host system that we will copy over in
+    # the install phase.
+    GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
+    GOHOSTARCH = goarch stdenv.buildPlatform;
+
+    # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
+    # to be different from CC/CXX
+    CC_FOR_TARGET = lib.optionalString (stdenv.buildPlatform != stdenv.targetPlatform)
+      "${targetCC}/bin/${targetCC.targetPrefix}cc";
+    CXX_FOR_TARGET = lib.optionalString (stdenv.buildPlatform != stdenv.targetPlatform)
+      "${targetCC}/bin/${targetCC.targetPrefix}c++";
+
+    GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
+    GO386 = 387; # from Arch: don't assume sse2 on i686
+    CGO_ENABLED = 1;
+    # Hopefully avoids test timeouts on Hydra
+    GO_TEST_TIMEOUT_SCALE = 3;
+
+    # Indicate that we are running on build infrastructure
+    # Some tests assume things like home directories and users exists
+    GO_BUILDER_NAME = "nix";
+
+    GOROOT_BOOTSTRAP="${goBootstrap}/share/go";
+  };
 
   postConfigure = ''
     export GOCACHE=$TMPDIR/go-cache
@@ -239,13 +237,13 @@ stdenv.mkDerivation rec {
   '' + (if (stdenv.buildPlatform != stdenv.hostPlatform) then ''
     mv bin/*_*/* bin
     rmdir bin/*_*
-    ${optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
-      rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
+    ${optionalString (!(env.GOHOSTARCH == env.GOARCH && env.GOOS == env.GOHOSTOS)) ''
+      rm -rf pkg/${env.GOHOSTOS}_${env.GOHOSTARCH} pkg/tool/${env.GOHOSTOS}_${env.GOHOSTARCH}
     ''}
   '' else if (stdenv.hostPlatform != stdenv.targetPlatform) then ''
     rm -rf bin/*_*
-    ${optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
-      rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
+    ${optionalString (!(env.GOHOSTARCH == env.GOARCH && env.GOOS == env.GOHOSTOS)) ''
+      rm -rf pkg/${env.GOOS}_${env.GOARCH} pkg/tool/${env.GOOS}_${env.GOARCH}
     ''}
   '' else "");
 
diff --git a/pkgs/development/compilers/go/1.15.nix b/pkgs/development/compilers/go/1.15.nix
index 1aa0ec030174c..e085c7e7cbbd1 100644
--- a/pkgs/development/compilers/go/1.15.nix
+++ b/pkgs/development/compilers/go/1.15.nix
@@ -176,36 +176,34 @@ stdenv.mkDerivation rec {
     find . -name '*.orig' -exec rm {} ';'
   '';
 
-  GOOS = stdenv.targetPlatform.parsed.kernel.name;
-  GOARCH = goarch stdenv.targetPlatform;
-  # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
-  # Go will nevertheless build a for host system that we will copy over in
-  # the install phase.
-  GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
-  GOHOSTARCH = goarch stdenv.buildPlatform;
-
-  # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
-  # to be different from CC/CXX
-  CC_FOR_TARGET = if (stdenv.buildPlatform != stdenv.targetPlatform) then
-      "${targetCC}/bin/${targetCC.targetPrefix}cc"
-    else
-      null;
-  CXX_FOR_TARGET = if (stdenv.buildPlatform != stdenv.targetPlatform) then
-      "${targetCC}/bin/${targetCC.targetPrefix}c++"
-    else
-      null;
-
-  GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
-  GO386 = 387; # from Arch: don't assume sse2 on i686
-  CGO_ENABLED = 1;
-  # Hopefully avoids test timeouts on Hydra
-  GO_TEST_TIMEOUT_SCALE = 3;
-
-  # Indicate that we are running on build infrastructure
-  # Some tests assume things like home directories and users exists
-  GO_BUILDER_NAME = "nix";
-
-  GOROOT_BOOTSTRAP="${goBootstrap}/share/go";
+  env = {
+    GOOS = stdenv.targetPlatform.parsed.kernel.name;
+    GOARCH = goarch stdenv.targetPlatform;
+    # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
+    # Go will nevertheless build a for host system that we will copy over in
+    # the install phase.
+    GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
+    GOHOSTARCH = goarch stdenv.buildPlatform;
+
+    # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
+    # to be different from CC/CXX
+    CC_FOR_TARGET = lib.optionalString (stdenv.buildPlatform != stdenv.targetPlatform) 
+        "${targetCC}/bin/${targetCC.targetPrefix}cc";
+    CXX_FOR_TARGET = lib.optionalString (stdenv.buildPlatform != stdenv.targetPlatform)
+        "${targetCC}/bin/${targetCC.targetPrefix}c++";
+
+    GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
+    GO386 = 387; # from Arch: don't assume sse2 on i686
+    CGO_ENABLED = 1;
+    # Hopefully avoids test timeouts on Hydra
+    GO_TEST_TIMEOUT_SCALE = 3;
+
+    # Indicate that we are running on build infrastructure
+    # Some tests assume things like home directories and users exists
+    GO_BUILDER_NAME = "nix";
+
+    GOROOT_BOOTSTRAP="${goBootstrap}/share/go";
+  };
 
   postConfigure = ''
     export GOCACHE=$TMPDIR/go-cache
@@ -242,13 +240,13 @@ stdenv.mkDerivation rec {
   '' + (if (stdenv.buildPlatform != stdenv.hostPlatform) then ''
     mv bin/*_*/* bin
     rmdir bin/*_*
-    ${optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
-      rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
+    ${optionalString (!(env.GOHOSTARCH == env.GOARCH && env.GOOS == env.GOHOSTOS)) ''
+      rm -rf pkg/${env.GOHOSTOS}_${env.GOHOSTARCH} pkg/tool/${env.GOHOSTOS}_${env.GOHOSTARCH}
     ''}
   '' else if (stdenv.hostPlatform != stdenv.targetPlatform) then ''
     rm -rf bin/*_*
-    ${optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
-      rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
+    ${optionalString (!(env.GOHOSTARCH == env.GOARCH && env.GOOS == env.GOHOSTOS)) ''
+      rm -rf pkg/${env.GOOS}_${env.GOARCH} pkg/tool/${env.GOOS}_${env.GOARCH}
     ''}
   '' else "");
 
diff --git a/pkgs/development/compilers/go/1.16.nix b/pkgs/development/compilers/go/1.16.nix
index 219f19ad27c70..c62143aefadc6 100644
--- a/pkgs/development/compilers/go/1.16.nix
+++ b/pkgs/development/compilers/go/1.16.nix
@@ -171,36 +171,34 @@ stdenv.mkDerivation rec {
     find . -name '*.orig' -exec rm {} ';'
   '';
 
-  GOOS = stdenv.targetPlatform.parsed.kernel.name;
-  GOARCH = goarch stdenv.targetPlatform;
-  # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
-  # Go will nevertheless build a for host system that we will copy over in
-  # the install phase.
-  GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
-  GOHOSTARCH = goarch stdenv.buildPlatform;
-
-  # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
-  # to be different from CC/CXX
-  CC_FOR_TARGET = if (stdenv.buildPlatform != stdenv.targetPlatform) then
-      "${targetCC}/bin/${targetCC.targetPrefix}cc"
-    else
-      null;
-  CXX_FOR_TARGET = if (stdenv.buildPlatform != stdenv.targetPlatform) then
-      "${targetCC}/bin/${targetCC.targetPrefix}c++"
-    else
-      null;
-
-  GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
-  GO386 = "softfloat"; # from Arch: don't assume sse2 on i686
-  CGO_ENABLED = 1;
-  # Hopefully avoids test timeouts on Hydra
-  GO_TEST_TIMEOUT_SCALE = 3;
-
-  # Indicate that we are running on build infrastructure
-  # Some tests assume things like home directories and users exists
-  GO_BUILDER_NAME = "nix";
-
-  GOROOT_BOOTSTRAP="${goBootstrap}/share/go";
+  env = {
+    GOOS = stdenv.targetPlatform.parsed.kernel.name;
+    GOARCH = goarch stdenv.targetPlatform;
+    # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
+    # Go will nevertheless build a for host system that we will copy over in
+    # the install phase.
+    GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
+    GOHOSTARCH = goarch stdenv.buildPlatform;
+  
+    # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
+    # to be different from CC/CXX
+    CC_FOR_TARGET = optionalString (stdenv.buildPlatform != stdenv.targetPlatform)
+        "${targetCC}/bin/${targetCC.targetPrefix}cc";
+    CXX_FOR_TARGET = optionalString (stdenv.buildPlatform != stdenv.targetPlatform)
+        "${targetCC}/bin/${targetCC.targetPrefix}c++";
+  
+    GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
+    GO386 = "softfloat"; # from Arch: don't assume sse2 on i686
+    CGO_ENABLED = 1;
+    # Hopefully avoids test timeouts on Hydra
+    GO_TEST_TIMEOUT_SCALE = 3;
+  
+    # Indicate that we are running on build infrastructure
+    # Some tests assume things like home directories and users exists
+    GO_BUILDER_NAME = "nix";
+  
+    GOROOT_BOOTSTRAP="${goBootstrap}/share/go";
+  };
 
   postConfigure = ''
     export GOCACHE=$TMPDIR/go-cache
@@ -237,13 +235,13 @@ stdenv.mkDerivation rec {
   '' + (if (stdenv.buildPlatform != stdenv.hostPlatform) then ''
     mv bin/*_*/* bin
     rmdir bin/*_*
-    ${optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
-      rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
+    ${optionalString (!(env.GOHOSTARCH == env.GOARCH && env.GOOS == env.GOHOSTOS)) ''
+      rm -rf pkg/${env.GOHOSTOS}_${env.GOHOSTARCH} pkg/tool/${env.GOHOSTOS}_${env.GOHOSTARCH}
     ''}
   '' else if (stdenv.hostPlatform != stdenv.targetPlatform) then ''
     rm -rf bin/*_*
-    ${optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
-      rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
+    ${optionalString (!(env.GOHOSTARCH == env.GOARCH && env.GOOS == env.GOHOSTOS)) ''
+      rm -rf pkg/${env.GOOS}_${env.GOARCH} pkg/tool/${env.GOOS}_${env.GOARCH}
     ''}
   '' else "");
 
diff --git a/pkgs/development/compilers/go/2-dev.nix b/pkgs/development/compilers/go/2-dev.nix
index 4b541e8990e2f..48672489d05c1 100644
--- a/pkgs/development/compilers/go/2-dev.nix
+++ b/pkgs/development/compilers/go/2-dev.nix
@@ -168,36 +168,34 @@ stdenv.mkDerivation rec {
     find . -name '*.orig' -exec rm {} ';'
   '';
 
-  GOOS = stdenv.targetPlatform.parsed.kernel.name;
-  GOARCH = goarch stdenv.targetPlatform;
-  # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
-  # Go will nevertheless build a for host system that we will copy over in
-  # the install phase.
-  GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
-  GOHOSTARCH = goarch stdenv.buildPlatform;
-
-  # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
-  # to be different from CC/CXX
-  CC_FOR_TARGET = if (stdenv.buildPlatform != stdenv.targetPlatform) then
-      "${targetCC}/bin/${targetCC.targetPrefix}cc"
-    else
-      null;
-  CXX_FOR_TARGET = if (stdenv.buildPlatform != stdenv.targetPlatform) then
-      "${targetCC}/bin/${targetCC.targetPrefix}c++"
-    else
-      null;
-
-  GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
-  GO386 = "softfloat"; # from Arch: don't assume sse2 on i686
-  CGO_ENABLED = 1;
-  # Hopefully avoids test timeouts on Hydra
-  GO_TEST_TIMEOUT_SCALE = 3;
-
-  # Indicate that we are running on build infrastructure
-  # Some tests assume things like home directories and users exists
-  GO_BUILDER_NAME = "nix";
-
-  GOROOT_BOOTSTRAP="${goBootstrap}/share/go";
+  env = {
+    GOOS = stdenv.targetPlatform.parsed.kernel.name;
+    GOARCH = goarch stdenv.targetPlatform;
+    # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
+    # Go will nevertheless build a for host system that we will copy over in
+    # the install phase.
+    GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
+    GOHOSTARCH = goarch stdenv.buildPlatform;
+
+    # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
+    # to be different from CC/CXX
+    CC_FOR_TARGET = optionalString (stdenv.buildPlatform != stdenv.targetPlatform)
+        "${targetCC}/bin/${targetCC.targetPrefix}cc";
+    CXX_FOR_TARGET = optionalString (stdenv.buildPlatform != stdenv.targetPlatform)
+        "${targetCC}/bin/${targetCC.targetPrefix}c++";
+
+    GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
+    GO386 = "softfloat"; # from Arch: don't assume sse2 on i686
+    CGO_ENABLED = 1;
+    # Hopefully avoids test timeouts on Hydra
+    GO_TEST_TIMEOUT_SCALE = 3;
+
+    # Indicate that we are running on build infrastructure
+    # Some tests assume things like home directories and users exists
+    GO_BUILDER_NAME = "nix";
+
+    GOROOT_BOOTSTRAP="${goBootstrap}/share/go";
+  };
 
   postConfigure = ''
     export GOCACHE=$TMPDIR/go-cache
@@ -234,13 +232,13 @@ stdenv.mkDerivation rec {
   '' + (if (stdenv.buildPlatform != stdenv.hostPlatform) then ''
     mv bin/*_*/* bin
     rmdir bin/*_*
-    ${optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
-      rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
+    ${optionalString (!(env.GOHOSTARCH == env.GOARCH && env.GOOS == env.GOHOSTOS)) ''
+      rm -rf pkg/${env.GOHOSTOS}_${env.GOHOSTARCH} pkg/tool/${env.GOHOSTOS}_${env.GOHOSTARCH}
     ''}
   '' else if (stdenv.hostPlatform != stdenv.targetPlatform) then ''
     rm -rf bin/*_*
-    ${optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
-      rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
+    ${optionalString (!(env.GOHOSTARCH == env.GOARCH && env.GOOS == env.GOHOSTOS)) ''
+      rm -rf pkg/${env.GOOS}_${env.GOARCH} pkg/tool/${env.GOOS}_${env.GOARCH}
     ''}
   '' else "");
 
diff --git a/pkgs/development/compilers/graalvm/community-edition.nix b/pkgs/development/compilers/graalvm/community-edition.nix
index 3a8fca2c1a05b..55d43c4c40817 100644
--- a/pkgs/development/compilers/graalvm/community-edition.nix
+++ b/pkgs/development/compilers/graalvm/community-edition.nix
@@ -121,7 +121,6 @@ let
            }
 
            mkdir -p $out
-           arr=($srcs)
 
            # The tarball on Linux has the following directory structure:
            #
@@ -132,7 +131,7 @@ let
            #   graalvm-ce-java11-20.3.0/Contents/Home/*
            #
            # We therefor use --strip-components=1 vs 3 depending on the platform.
-           tar xf ''${arr[0]} -C $out --strip-components=${if stdenv.isLinux then "1" else "3"}
+           tar xf ''${srcs[0]} -C $out --strip-components=${if stdenv.isLinux then "1" else "3"}
 
            # Sanity check
            if [ ! -d $out/bin ]; then
@@ -143,10 +142,10 @@ let
               exit 1
            fi
 
-           unpack_jar ''${arr[1]}
-           unpack_jar ''${arr[2]}
-           unpack_jar ''${arr[3]}
-           unpack_jar ''${arr[4]}
+           unpack_jar ''${srcs[1]}
+           unpack_jar ''${srcs[2]}
+           unpack_jar ''${srcs[3]}
+           unpack_jar ''${srcs[4]}
         '';
 
         installPhase = {
diff --git a/pkgs/development/compilers/graalvm/default.nix b/pkgs/development/compilers/graalvm/default.nix
index ccfb4a18a12a0..5b5ff65d82086 100644
--- a/pkgs/development/compilers/graalvm/default.nix
+++ b/pkgs/development/compilers/graalvm/default.nix
@@ -312,11 +312,11 @@ in rec {
         --replace 'entry == false' '*entry == false'
     '';
     hardeningDisable = [ "fortify" ];
-    NIX_CFLAGS_COMPILE = toString (lib.optional stdenv.isDarwin [
+    env.NIX_CFLAGS_COMPILE = toString (lib.optional stdenv.isDarwin [
       "-Wno-reserved-user-defined-literal"
       "-Wno-c++11-narrowing"
     ] ++
-    lib.optional stdenv.isLinux [
+    lib.optionals stdenv.isLinux [
       "-Wno-error=format-overflow" # newly detected by gcc7
       "-Wno-error=nonnull"
     ]);
diff --git a/pkgs/development/compilers/hhvm/default.nix b/pkgs/development/compilers/hhvm/default.nix
index d8495977e780e..3c654cc8e6df3 100644
--- a/pkgs/development/compilers/hhvm/default.nix
+++ b/pkgs/development/compilers/hhvm/default.nix
@@ -33,10 +33,10 @@ stdenv.mkDerivation rec {
   ];
 
   dontUseCmakeBuildDir = true;
-  NIX_LDFLAGS = "-lpam -L${pam}/lib";
+  env.NIX_LDFLAGS = "-lpam -L${pam}/lib";
 
   # work around broken build system
-  NIX_CFLAGS_COMPILE = "-I${freetype.dev}/include/freetype2";
+  env.NIX_CFLAGS_COMPILE = "-I${freetype.dev}/include/freetype2";
 
   # the cmake package does not handle absolute CMAKE_INSTALL_INCLUDEDIR correctly
   # (setting it to an absolute path causes include files to go to $out/$out/include,
diff --git a/pkgs/development/compilers/iasl/default.nix b/pkgs/development/compilers/iasl/default.nix
index fb6bd41344ad0..624340fe350ae 100644
--- a/pkgs/development/compilers/iasl/default.nix
+++ b/pkgs/development/compilers/iasl/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1cb6aa6acrixmdzvj9vv4qs9lmlsbkd27pjlz14i1kq1x3xn0gwx";
   };
 
-  NIX_CFLAGS_COMPILE = "-O3";
+  env.NIX_CFLAGS_COMPILE = "-O3";
 
   buildFlags = [ "iasl" ];
 
diff --git a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
index 1f990ac433d2f..3865bd5a61505 100644
--- a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
@@ -16,9 +16,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake python3 llvm.dev ];
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
 
-  NIX_CFLAGS_COMPILE = [
-    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
-  ];
+  env.NIX_CFLAGS_COMPILE =
+    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0";
 
   cmakeFlags = [
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
index 257bc34092fe2..95e09e1ebf44e 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
@@ -16,9 +16,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake python3 llvm.dev ];
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
 
-  NIX_CFLAGS_COMPILE = [
-    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
-  ];
+  env.NIX_CFLAGS_COMPILE = 
+    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0";
+  
 
   cmakeFlags = [
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
diff --git a/pkgs/development/compilers/llvm/11/llvm/default.nix b/pkgs/development/compilers/llvm/11/llvm/default.nix
index c8033b585cb16..e6ec9f20628f9 100644
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@@ -100,7 +100,7 @@ in stdenv.mkDerivation (rec {
   '';
 
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
-  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
+  env.LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
   cmakeFlags = with stdenv; [
     "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
diff --git a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
index b880a0071b9e1..c67a60cb875f8 100644
--- a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
@@ -16,9 +16,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake python3 llvm.dev ];
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
 
-  NIX_CFLAGS_COMPILE = [
-    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
-  ];
+  env.NIX_CFLAGS_COMPILE =
+    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0";
 
   cmakeFlags = [
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
diff --git a/pkgs/development/compilers/llvm/12/llvm/default.nix b/pkgs/development/compilers/llvm/12/llvm/default.nix
index 0bc704a815590..7aa8c30ba39b8 100644
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/12/llvm/default.nix
@@ -106,7 +106,7 @@ in stdenv.mkDerivation (rec {
   '';
 
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
-  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
+  env.LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
   cmakeFlags = with stdenv; [
     "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
diff --git a/pkgs/development/compilers/llvm/5/compiler-rt/default.nix b/pkgs/development/compilers/llvm/5/compiler-rt/default.nix
index 7e85c420da03e..b45fe37ee979a 100644
--- a/pkgs/development/compilers/llvm/5/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/5/compiler-rt/default.nix
@@ -16,9 +16,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake python3 llvm.dev ];
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
 
-  NIX_CFLAGS_COMPILE = [
-    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
-  ];
+  env.NIX_CFLAGS_COMPILE = "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0";
 
   cmakeFlags = [
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
diff --git a/pkgs/development/compilers/llvm/5/libc++abi/default.nix b/pkgs/development/compilers/llvm/5/libc++abi/default.nix
index 8bc3b9e2977b6..042ad6b28d68f 100644
--- a/pkgs/development/compilers/llvm/5/libc++abi/default.nix
+++ b/pkgs/development/compilers/llvm/5/libc++abi/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
   postUnpack = ''
     unpackFile ${libcxx.src}
     unpackFile ${llvm.src}
-    export cmakeFlags="-DLLVM_PATH=$PWD/$(ls -d llvm-*) -DLIBCXXABI_LIBCXX_PATH=$PWD/$(ls -d libcxx-*)"
+    export cmakeFlags=("-DLLVM_PATH=$PWD/$(ls -d llvm-*)" "-DLIBCXXABI_LIBCXX_PATH=$PWD/$(ls -d libcxx-*)")
   '' + lib.optionalString stdenv.isDarwin ''
     export TRIPLE=x86_64-apple-darwin
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
diff --git a/pkgs/development/compilers/llvm/5/lldb/default.nix b/pkgs/development/compilers/llvm/5/lldb/default.nix
index 723792d1341c0..e2fd6f075ca53 100644
--- a/pkgs/development/compilers/llvm/5/lldb/default.nix
+++ b/pkgs/development/compilers/llvm/5/lldb/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
     darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa
   ];
 
-  CXXFLAGS = "-fno-rtti";
+  env.CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
 
   cmakeFlags = [
diff --git a/pkgs/development/compilers/llvm/6/compiler-rt/default.nix b/pkgs/development/compilers/llvm/6/compiler-rt/default.nix
index 384305f5cf288..b5f9eacd996d8 100644
--- a/pkgs/development/compilers/llvm/6/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/6/compiler-rt/default.nix
@@ -16,9 +16,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake python3 llvm.dev ];
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
 
-  NIX_CFLAGS_COMPILE = [
-    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
-  ];
+  env.NIX_CFLAGS_COMPILE = "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0";
 
   cmakeFlags = [
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
diff --git a/pkgs/development/compilers/llvm/6/lldb/default.nix b/pkgs/development/compilers/llvm/6/lldb/default.nix
index 31cc0ca68d71b..69dc9d18352dc 100644
--- a/pkgs/development/compilers/llvm/6/lldb/default.nix
+++ b/pkgs/development/compilers/llvm/6/lldb/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
     darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa
   ];
 
-  CXXFLAGS = "-fno-rtti";
+  env.CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
 
   cmakeFlags = [
diff --git a/pkgs/development/compilers/llvm/7/compiler-rt/default.nix b/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
index 75d61a51e6010..c15516a82b420 100644
--- a/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
@@ -16,9 +16,8 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake python3 llvm.dev ];
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
 
-  NIX_CFLAGS_COMPILE = [
-    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
-  ];
+  env.NIX_CFLAGS_COMPILE =
+    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0";
 
   cmakeFlags = [
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
diff --git a/pkgs/development/compilers/llvm/7/lldb/default.nix b/pkgs/development/compilers/llvm/7/lldb/default.nix
index 9788849287968..3aa2bb3269e28 100644
--- a/pkgs/development/compilers/llvm/7/lldb/default.nix
+++ b/pkgs/development/compilers/llvm/7/lldb/default.nix
@@ -55,10 +55,10 @@ stdenv.mkDerivation rec {
     darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa
   ];
 
-  CXXFLAGS = "-fno-rtti";
+  env.CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-I${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-I${libxml2.dev}/include/libxml2";
 
   cmakeFlags = [
     "-DLLDB_INCLUDE_TESTS=${if doCheck then "YES" else "NO"}"
diff --git a/pkgs/development/compilers/llvm/8/compiler-rt/default.nix b/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
index d370de031bb5b..354941108f6da 100644
--- a/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
@@ -16,9 +16,8 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake python3 llvm.dev ];
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
 
-  NIX_CFLAGS_COMPILE = [
-    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
-  ];
+  env.NIX_CFLAGS_COMPILE =
+    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0";
 
   cmakeFlags = [
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
diff --git a/pkgs/development/compilers/llvm/8/lldb/default.nix b/pkgs/development/compilers/llvm/8/lldb/default.nix
index 95bf4aae05462..a27f65f6071e9 100644
--- a/pkgs/development/compilers/llvm/8/lldb/default.nix
+++ b/pkgs/development/compilers/llvm/8/lldb/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa
   ];
 
-  CXXFLAGS = "-fno-rtti";
+  env.CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
 
   cmakeFlags = [
diff --git a/pkgs/development/compilers/llvm/9/compiler-rt/default.nix b/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
index 285fe811514ff..0d7c01fde0355 100644
--- a/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
@@ -16,9 +16,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake python3 llvm.dev ];
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
 
-  NIX_CFLAGS_COMPILE = [
-    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
-  ];
+  env.NIX_CFLAGS_COMPILE =
+    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0";
 
   cmakeFlags = [
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
diff --git a/pkgs/development/compilers/llvm/9/lldb/default.nix b/pkgs/development/compilers/llvm/9/lldb/default.nix
index 6d753ce1a869c..a8a840a3e1c07 100644
--- a/pkgs/development/compilers/llvm/9/lldb/default.nix
+++ b/pkgs/development/compilers/llvm/9/lldb/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
     darwin.apple_sdk.frameworks.Cocoa
   ];
 
-  CXXFLAGS = "-fno-rtti";
+  env.CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
 
   cmakeFlags = [
diff --git a/pkgs/development/compilers/mono/generic.nix b/pkgs/development/compilers/mono/generic.nix
index 901848c693a49..2d8cb1669ea15 100644
--- a/pkgs/development/compilers/mono/generic.nix
+++ b/pkgs/development/compilers/mono/generic.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   configurePhase = ''
     patchShebangs ./
-    ./autogen.sh --prefix $out $configureFlags
+    ./autogen.sh --prefix $out "''${configureFlags[@]}"
   '';
 
   # We want pkg-config to take priority over the dlls in the Mono framework and the GAC
diff --git a/pkgs/development/compilers/ocaml/4.00.1.nix b/pkgs/development/compilers/ocaml/4.00.1.nix
deleted file mode 100644
index 93e08740ddd82..0000000000000
--- a/pkgs/development/compilers/ocaml/4.00.1.nix
+++ /dev/null
@@ -1,67 +0,0 @@
-{ lib, stdenv, fetchurl, ncurses, xlibsWrapper }:
-
-let
-   useX11 = !stdenv.isAarch32 && !stdenv.isMips;
-   useNativeCompilers = !stdenv.isMips;
-   inherit (lib) optional optionals optionalString;
-in
-
-stdenv.mkDerivation rec {
-  pname = "ocaml";
-  version = "4.00.1";
-
-  src = fetchurl {
-    url = "https://caml.inria.fr/pub/distrib/ocaml-4.00/${pname}-${version}.tar.bz2";
-    sha256 = "33c3f4acff51685f5bfd7c260f066645e767d4e865877bf1613c176a77799951";
-  };
-
-  prefixKey = "-prefix ";
-  configureFlags = [ "-no-tk" ] ++ optionals useX11 [ "-x11lib" xlibsWrapper ];
-  buildFlags = [ "world" ] ++ optionals useNativeCompilers [ "bootstrap" "world.opt" ];
-  buildInputs = [ ncurses ] ++ optional useX11 xlibsWrapper;
-  installTargets = "install" + optionalString useNativeCompilers " installopt";
-  preConfigure = ''
-    CAT=$(type -tp cat)
-    sed -e "s@/bin/cat@$CAT@" -i config/auto-aux/sharpbang
-  '';
-  postBuild = ''
-    mkdir -p $out/include
-    ln -sv $out/lib/ocaml/caml $out/include/caml
-  '';
-
-  passthru = {
-    nativeCompilers = useNativeCompilers;
-  };
-
-  meta = with lib; {
-    homepage = "http://caml.inria.fr/ocaml";
-    branch = "4.00";
-    license = with licenses; [
-      qpl /* compiler */
-      lgpl2 /* library */
-    ];
-    description = "Most popular variant of the Caml language";
-
-    longDescription =
-      ''
-        OCaml is the most popular variant of the Caml language.  From a
-        language standpoint, it extends the core Caml language with a
-        fully-fledged object-oriented layer, as well as a powerful module
-        system, all connected by a sound, polymorphic type system featuring
-        type inference.
-
-        The OCaml system is an industrial-strength implementation of this
-        language, featuring a high-performance native-code compiler (ocamlopt)
-        for 9 processor architectures (IA32, PowerPC, AMD64, Alpha, Sparc,
-        Mips, IA64, HPPA, StrongArm), as well as a bytecode compiler (ocamlc)
-        and an interactive read-eval-print loop (ocaml) for quick development
-        and portability.  The OCaml distribution includes a comprehensive
-        standard library, a replay debugger (ocamldebug), lexer (ocamllex) and
-        parser (ocamlyacc) generators, a pre-processor pretty-printer (camlp4)
-        and a documentation generator (ocamldoc).
-      '';
-
-    platforms = with platforms; linux;
-  };
-
-}
diff --git a/pkgs/development/compilers/ocaml/4.01.0.nix b/pkgs/development/compilers/ocaml/4.01.0.nix
index 6362f360f7dab..12694c4859417 100644
--- a/pkgs/development/compilers/ocaml/4.01.0.nix
+++ b/pkgs/development/compilers/ocaml/4.01.0.nix
@@ -4,4 +4,6 @@ import ./generic.nix {
   patch_version = "0";
   patches = [ ./fix-clang-build-on-osx.diff ];
   sha256 = "03d7ida94s1gpr3gadf4jyhmh5rrszd5s4m4z59daaib25rvfyv7";
+
+  prefixAsSeperateFlag = true;
 }
diff --git a/pkgs/development/compilers/ocaml/4.02.nix b/pkgs/development/compilers/ocaml/4.02.nix
index 4773f9f74a5a1..0c7e58e3a558d 100644
--- a/pkgs/development/compilers/ocaml/4.02.nix
+++ b/pkgs/development/compilers/ocaml/4.02.nix
@@ -4,4 +4,6 @@ import ./generic.nix {
   patch_version = "3";
   patches = [ ./ocamlbuild.patch ];
   sha256 = "1qwwvy8nzd87hk8rd9sm667nppakiapnx4ypdwcrlnav2dz6kil3";
+
+  prefixAsSeperateFlag = true;
 }
diff --git a/pkgs/development/compilers/ocaml/4.03.nix b/pkgs/development/compilers/ocaml/4.03.nix
deleted file mode 100644
index 0bbe823304199..0000000000000
--- a/pkgs/development/compilers/ocaml/4.03.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-import ./generic.nix {
-  major_version = "4";
-  minor_version = "03";
-  patch_version = "0";
-  sha256 = "09p3iwwi55r6rbrpyp8f0wmkb0ppcgw67yxw6yfky60524wayp39";
-}
diff --git a/pkgs/development/compilers/ocaml/4.04.nix b/pkgs/development/compilers/ocaml/4.04.nix
deleted file mode 100644
index 4f49bcf807285..0000000000000
--- a/pkgs/development/compilers/ocaml/4.04.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-import ./generic.nix {
-  major_version = "4";
-  minor_version = "04";
-  patch_version = "2";
-  sha256 = "0bhgjzi78l10824qga85nlh18jg9lb6aiamf9dah1cs6jhzfsn6i";
-
-  # If the executable is stipped it does not work
-  dontStrip = true;
-}
diff --git a/pkgs/development/compilers/ocaml/4.05.nix b/pkgs/development/compilers/ocaml/4.05.nix
index a63b06a9f6288..58ef2f3bcd437 100644
--- a/pkgs/development/compilers/ocaml/4.05.nix
+++ b/pkgs/development/compilers/ocaml/4.05.nix
@@ -6,4 +6,6 @@ import ./generic.nix {
 
   # If the executable is stipped it does not work
   dontStrip = true;
+
+  prefixAsSeperateFlag = true;
 }
diff --git a/pkgs/development/compilers/ocaml/4.06.nix b/pkgs/development/compilers/ocaml/4.06.nix
index b54b8a6288fea..96ec9ff9e3626 100644
--- a/pkgs/development/compilers/ocaml/4.06.nix
+++ b/pkgs/development/compilers/ocaml/4.06.nix
@@ -6,4 +6,6 @@ import ./generic.nix {
 
   # If the executable is stipped it does not work
   dontStrip = true;
+
+  prefixAsSeperateFlag = true;
 }
diff --git a/pkgs/development/compilers/ocaml/4.07.nix b/pkgs/development/compilers/ocaml/4.07.nix
index c1952f30ba688..dc967d58ef1c9 100644
--- a/pkgs/development/compilers/ocaml/4.07.nix
+++ b/pkgs/development/compilers/ocaml/4.07.nix
@@ -6,4 +6,6 @@ import ./generic.nix {
 
   # If the executable is stripped it does not work
   dontStrip = true;
+
+  prefixAsSeperateFlag = true;
 }
diff --git a/pkgs/development/compilers/ocaml/ber-metaocaml.nix b/pkgs/development/compilers/ocaml/ber-metaocaml.nix
index d3ab0d6e1c609..613ab26c1b44a 100644
--- a/pkgs/development/compilers/ocaml/ber-metaocaml.nix
+++ b/pkgs/development/compilers/ocaml/ber-metaocaml.nix
@@ -31,7 +31,8 @@ stdenv.mkDerivation rec {
   x11lib = "${x11env}/lib";
   x11inc = "${x11env}/include";
 
-  prefixKey = "-prefix ";
+  prefixAsSeperateFlag = true;
+
   configureFlags = optionals useX11
     [ "-x11lib" x11lib
       "-x11include" x11inc
diff --git a/pkgs/development/compilers/ocaml/builder.sh b/pkgs/development/compilers/ocaml/builder.sh
deleted file mode 100644
index a1807682d8674..0000000000000
--- a/pkgs/development/compilers/ocaml/builder.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-source $stdenv/setup
-
-configureFlags="-prefix $out $configureFlags"
-genericBuild
-
-#cd emacs/
-#mkdir -p $out/share/ocaml/emacs
-#make EMACSDIR=$out/share/ocaml/emacs install
diff --git a/pkgs/development/compilers/ocaml/configure-3.08.0 b/pkgs/development/compilers/ocaml/configure-3.08.0
deleted file mode 100755
index 9c8705855120b..0000000000000
--- a/pkgs/development/compilers/ocaml/configure-3.08.0
+++ /dev/null
@@ -1,1482 +0,0 @@
-#! /bin/sh
-
-#########################################################################
-#                                                                       #
-#                            Objective Caml                             #
-#                                                                       #
-#            Xavier Leroy, projet Cristal, INRIA Rocquencourt           #
-#                                                                       #
-#   Copyright 1999 Institut National de Recherche en Informatique et    #
-#   en Automatique.  All rights reserved.  This file is distributed     #
-#   under the terms of the GNU Library General Public License, with     #
-#   the special exception on linking described in file LICENSE.         #
-#                                                                       #
-#########################################################################
-
-# $Id: configure,v 1.215.2.3 2004/07/09 15:08:51 doligez Exp $
-
-configure_options="$*"
-prefix=/usr/local
-bindir=''
-libdir=''
-mandir=''
-manext=1
-host_type=unknown
-ccoption=''
-cclibs=''
-curseslibs=''
-mathlib='-lm'
-dllib=''
-x11_include_dir=''
-x11_lib_dir=''
-tk_wanted=yes
-pthread_wanted=yes
-tk_defs=''
-tk_libs=''
-tk_x11=yes
-dl_defs=''
-verbose=no
-withcurses=yes
-withsharedlibs=yes
-binutils_dir=''
-gcc_warnings="-Wall"
-
-# Try to turn internationalization off, can cause config.guess to malfunction!
-unset LANG
-unset LC_ALL LC_CTYPE LC_COLLATE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME 
-
-# Turn off some macOS debugging stuff, same reason
-unset RC_TRACE_ARCHIVES RC_TRACE_DYLIBS RC_TRACE_PREBINDING_DISABLED
-
-# Parse command-line arguments
-
-while : ; do
-  case "$1" in
-    "") break;;
-    -prefix|--prefix)
-        prefix=$2; shift;;
-    -bindir|--bindir)
-        bindir=$2; shift;;
-    -libdir|--libdir)
-        libdir=$2; shift;;
-    -mandir|--mandir)
-        case "$2" in
-          */man[1-9ln])
-            mandir=`echo $2 | sed -e 's|^\(.*\)/man.$|\1|'`
-            manext=`echo $2 | sed -e 's/^.*\(.\)$/\1/'`;;
-          *)
-            mandir=$2
-            manext=1;;
-        esac
-        shift;;
-    -host*|--host*)
-        host_type=$2; shift;;
-    -cc*)
-        ccoption="$2"; shift;;
-    -lib*)
-        cclibs="$2 $cclibs"; shift;;
-    -no-curses)
-        withcurses=no;;
-    -no-shared-libs)
-        withsharedlibs=no;;
-    -x11include*|--x11include*)
-        x11_include_dir=$2; shift;;
-    -x11lib*|--x11lib*)
-        x11_lib_dir=$2; shift;;
-    -with-pthread*|--with-pthread*)
-        ;; # Ignored for backward compatibility
-    -no-pthread*|--no-pthread*)
-        pthread_wanted=no;;
-    -no-tk|--no-tk)
-        tk_wanted=no;;
-    -tkdefs*|--tkdefs*)
-        tk_defs=$2; shift;;
-    -tklibs*|--tklibs*)
-        tk_libs=$2; shift;;
-    -tk-no-x11|--tk-no-x11)
-        tk_x11=no;;
-    -dldefs*|--dldefs*)
-        dl_defs="$2"; shift;;
-    -dllibs*|--dllibs*)
-        dllib="$2"; shift;;
-    -binutils*|--binutils*)
-        binutils_dir=$2; shift;;
-    -verbose|--verbose)
-        verbose=yes;;
-    *) echo "Unknown option \"$1\"." 1>&2; exit 2;;
-  esac
-  shift
-done
-
-# Sanity checks
-
-case "$prefix" in
-  /*) ;;
-   *) echo "The -prefix directory must be absolute." 1>&2; exit 2;;
-esac
-case "$bindir" in
-  /*) ;;
-  "") ;;
-   *) echo "The -bindir directory must be absolute." 1>&2; exit 2;;
-esac
-case "$libdir" in
-  /*) ;;
-  "") ;;
-   *) echo "The -libdir directory must be absolute." 1>&2; exit 2;;
-esac
-case "$mandir" in
-  /*) ;;
-  "") ;;
-   *) echo "The -mandir directory must be absolute." 1>&2; exit 2;;
-esac
-
-# Generate the files
-
-cd config/auto-aux
-rm -f s.h m.h Makefile
-touch s.h m.h Makefile
-
-# Write options to Makefile
-
-echo "# generated by ./configure $configure_options" >> Makefile
-
-# Where to install
-
-echo "PREFIX=$prefix" >> Makefile
-case "$bindir" in
-  "") echo 'BINDIR=$(PREFIX)/bin' >> Makefile
-      bindir="$prefix/bin";;
-   *) echo "BINDIR=$bindir" >> Makefile;;
-esac
-case "$libdir" in
-  "") echo 'LIBDIR=$(PREFIX)/lib/ocaml' >> Makefile
-      libdir="$prefix/lib/ocaml";;
-   *) echo "LIBDIR=$libdir" >> Makefile;;
-esac
-echo 'STUBLIBDIR=$(LIBDIR)/stublibs' >> Makefile
-case "$mandir" in
-  "") echo 'MANDIR=$(PREFIX)/man' >> Makefile
-      mandir="$prefix/man";;
-   *) echo "MANDIR=$mandir" >> Makefile;;
-esac
-echo "MANEXT=$manext" >> Makefile
-
-# Determine the system type
-
-if test "$host_type" = "unknown"; then
-  if host_type=`../gnu/config.guess`; then :; else
-    echo "Cannot guess host type"
-    echo "You must specify one with the -host option"
-    exit 2
-  fi
-fi
-if host=`../gnu/config.sub $host_type`; then :; else
-  echo "Please specify the correct host type with the -host option"
-  exit 2
-fi
-echo "Configuring for a $host ..."
-
-# Do we have gcc?
-
-if test -z "$ccoption"; then
-  if sh ./searchpath gcc; then
-    echo "gcc found"
-    cc=gcc
-  else
-    cc=cc
-  fi
-else
-  cc="$ccoption"
-fi
-
-# Check for buggy versions of GCC
-
-buggycc="no"
-
-case "$host,$cc" in
-  i[3456]86-*-*,gcc*)
-    case `$cc --version` in
-      2.7.2.1) cat <<'EOF'
-
-WARNING: you are using gcc version 2.7.2.1 on an Intel x86 processor.
-This version of gcc is known to generate incorrect code for the
-Objective Caml runtime system on some Intel x86 machines. (The symptom
-is a crash of boot/ocamlc when compiling stdlib/pervasives.mli.)
-In particular, the version of gcc 2.7.2.1 that comes with
-Linux RedHat 4.x / Intel is affected by this problem.
-Other Linux distributions might also be affected.
-If you are using one of these configurations, you are strongly advised
-to use another version of gcc, such as 2.95, which are
-known to work well with Objective Caml.
-
-Press <enter> to proceed or <interrupt> to stop.
-EOF
-        read reply;;
-      2.96*) cat <<'EOF'
-
-WARNING: you are using gcc version 2.96 on an Intel x86 processor.
-Certain patched versions of gcc 2.96 are known to generate incorrect
-code for the Objective Caml runtime system.  (The symptom is a segmentation
-violation on boot/ocamlc.)  Those incorrectly patched versions can be found
-in RedHat 7.2 and Mandrake 8.0 and 8.1; other Linux distributions
-might also be affected.  (See bug #57760 on bugzilla.redhat.com)
-
-Auto-configuration will now select gcc compiler flags that work around
-the problem.  Still, if you observe segmentation faults while running
-ocamlc or ocamlopt, you are advised to try another version of gcc,
-such as 2.95.3 or 3.2.
-
-EOF
-        buggycc="gcc.2.96";;
-
-            esac;;
-esac
-
-# Configure the bytecode compiler
-
-bytecc="$cc"
-bytecccompopts=""
-bytecclinkopts=""
-ostype="Unix"
-exe=""
-
-case "$bytecc,$host" in
-  cc,*-*-nextstep*)
-    # GNU C extensions disabled, but __GNUC__ still defined!
-    bytecccompopts="-fno-defer-pop $gcc_warnings -U__GNUC__ -posix"
-    bytecclinkopts="-posix";;
-  *,*-*-rhapsody*)
-    # Almost the same as NeXTStep
-    bytecccompopts="-fno-defer-pop $gcc_warnings -DSHRINKED_GNUC"
-    mathlib="";;
-  *,*-*-darwin*)
-    # Almost the same as rhapsody
-    bytecccompopts="-fno-defer-pop -no-cpp-precomp $gcc_warnings"
-    mathlib="";;
-  *,*-*-beos*)
-    bytecccompopts="-fno-defer-pop $gcc_warnings"
-    # No -lm library
-    mathlib="";;
-  gcc,alpha*-*-osf*)
-    bytecccompopts="-fno-defer-pop $gcc_warnings"
-    if cc="$bytecc" sh ./hasgot -mieee; then
-      bytecccompopts="-mieee $bytecccompopts";
-    fi
-    # Put code and static data in lower 4GB
-    bytecclinkopts="-Wl,-T,12000000 -Wl,-D,14000000"
-    # Tell gcc that we can use 32-bit code addresses for threaded code
-    echo "#define ARCH_CODE32" >> m.h;;
-  cc,alpha*-*-osf*)
-    bytecccompopts="-std1 -ieee";;
-  gcc,alpha*-*-linux*)
-    if cc="$bytecc" sh ./hasgot -mieee; then
-      bytecccompopts="-mieee $bytecccompopts";
-    fi;;
-  cc,mips-*-irix6*)
-    # Add -n32 flag to ensure compatibility with native-code compiler
-    bytecccompopts="-n32"
-    # Turn off warning "unused library"
-    bytecclinkopts="-n32 -Wl,-woff,84";;
-  cc*,mips-*-irix6*)
-    # (For those who want to force "cc -64")
-    # Turn off warning "unused library"
-    bytecclinkopts="-Wl,-woff,84";;
-  *,alpha*-*-unicos*)
-    # For the Cray T3E
-    bytecccompopts="-DUMK";;
-  gcc*,powerpc-*-aix4.3*)
-    # Avoid name-space pollution by requiring Unix98-conformant includes
-    bytecccompopts="-fno-defer-pop $gcc_warnings -D_XOPEN_SOURCE=500";;
-  *,powerpc-*-aix4.3*)
-    bytecccompopts="-D_XOPEN_SOURCE=500";;
-  gcc*,*-*-cygwin*)
-    bytecccompopts="-fno-defer-pop $gcc_warnings -U_WIN32"
-    exe=".exe"
-    ostype="Cygwin";;
-  gcc*,x86_64-*-linux*)
-    bytecccompopts="-fno-defer-pop $gcc_warnings"
-    # Tell gcc that we can use 32-bit code addresses for threaded code
-    echo "#define ARCH_CODE32" >> m.h;;
-  gcc*)
-    bytecccompopts="-fno-defer-pop $gcc_warnings";;
-esac
-
-# Configure compiler to use in further tests
-
-cc="$bytecc -O $bytecclinkopts"
-export cc cclibs verbose
-
-# Check C compiler
-
-sh ./runtest ansi.c
-case $? in
-  0) echo "The C compiler is ANSI-compliant.";;
-  1) echo "The C compiler $cc is not ANSI-compliant."
-     echo "You need an ANSI C compiler to build Objective Caml."
-     exit 2;;
-  *) echo "Unable to compile the test program."
-     echo "Make sure the C compiler $cc is properly installed."
-     exit 2;;
-esac
-
-# Check the sizes of data types
-
-echo "Checking the sizes of integers and pointers..."
-set `sh ./runtest sizes.c`
-case "$2,$3" in
-  4,4) echo "OK, this is a regular 32 bit architecture."
-       echo "#undef ARCH_SIXTYFOUR" >> m.h;;
-  8,8) echo "Wow! A 64 bit architecture!"
-       echo "#define ARCH_SIXTYFOUR" >> m.h;;
-  *,8) echo "Wow! A 64 bit architecture!"
-       echo "Unfortunately, Objective Caml cannot work in the case"
-       echo "sizeof(long) != sizeof(long *)."
-       echo "Objective Caml won't run on this architecture."
-       exit 2;;
-  *,*) echo "This architecture seems to be neither 32 bits nor 64 bits."
-       echo "Objective Caml won't run on this architecture."
-       exit 2;;
-    *) echo "Unable to compile the test program."
-       echo "Make sure the C compiler $cc is properly installed."
-       exit 2;;
-esac
-if test $1 != 4 && test $2 != 4 && test $4 != 4; then
-  echo "Sorry, we can't find a 32-bit integer type"
-  echo "(sizeof(short) = $4, sizeof(int) = $1, sizeof(long) = $2)"
-  echo "Objective Caml won't run on this architecture."
-  exit 2
-fi
-
-echo "#define SIZEOF_INT $1" >> m.h
-echo "#define SIZEOF_LONG $2" >> m.h
-echo "#define SIZEOF_SHORT $4" >> m.h
-
-if test $2 = 8; then
-     echo "#define ARCH_INT64_TYPE long" >> m.h
-     echo "#define ARCH_UINT64_TYPE unsigned long" >> m.h
-     echo '#define ARCH_INT64_PRINTF_FORMAT "l"' >> m.h
-     int64_native=true
-else
-  sh ./runtest longlong.c
-  case $? in
-  0) echo "64-bit \"long long\" integer type found (printf with \"%ll\")."
-     echo "#define ARCH_INT64_TYPE long long" >> m.h
-     echo "#define ARCH_UINT64_TYPE unsigned long long" >> m.h
-     echo '#define ARCH_INT64_PRINTF_FORMAT "ll"' >> m.h
-     int64_native=true;;
-  1) echo "64-bit \"long long\" integer type found (printf with \"%q\")."
-     echo "#define ARCH_INT64_TYPE long long" >> m.h
-     echo "#define ARCH_UINT64_TYPE unsigned long long" >> m.h
-     echo '#define ARCH_INT64_PRINTF_FORMAT "q"' >> m.h
-     int64_native=true;;
-  2) echo "64-bit \"long long\" integer type found (but no printf)."
-     echo "#define ARCH_INT64_TYPE long long" >> m.h
-     echo "#define ARCH_UINT64_TYPE unsigned long long" >> m.h
-     echo '#undef ARCH_INT64_PRINTF_FORMAT' >> m.h
-     int64_native=true;;
-  *) echo "No suitable 64-bit integer type found, will use software emulation."
-     echo "#undef ARCH_INT64_TYPE" >> m.h
-     echo "#undef ARCH_UINT64_TYPE" >> m.h
-     echo '#undef ARCH_INT64_PRINTF_FORMAT' >> m.h
-     int64_native=false;;
-  esac
-fi
-
-# Determine endianness
-
-sh ./runtest endian.c
-case $? in
-  0) echo "This is a big-endian architecture."
-     echo "#define ARCH_BIG_ENDIAN" >> m.h;;
-  1) echo "This is a little-endian architecture."
-     echo "#undef ARCH_BIG_ENDIAN" >> m.h;;
-  2) echo "This architecture seems to be neither big endian nor little endian."
-     echo "Objective Caml won't run on this architecture."
-     exit 2;;
-  *) echo "Something went wrong during endianness determination."
-     echo "You'll have to figure out endianness yourself"
-     echo "(option ARCH_BIG_ENDIAN in m.h).";;
-esac
-
-# Determine alignment constraints
-
-case "$host" in
-  sparc-*-*|hppa*-*-*)
-    # On Sparc V9 with certain versions of gcc, determination of double
-    # alignment is not reliable (PR#1521), hence force it.
-    # Same goes for hppa.
-    # But there's a knack (PR#2572):
-    # if we're in 64-bit mode (sizeof(long) == 8), 
-    # we must not doubleword-align floats...
-    if test $2 = 8; then
-      echo "Doubles can be word-aligned."
-      echo "#undef ARCH_ALIGN_DOUBLE" >> m.h
-    else
-      echo "Doubles must be doubleword-aligned."
-      echo "#define ARCH_ALIGN_DOUBLE" >> m.h
-    fi;;
-  *)
-    sh ./runtest dblalign.c
-    case $? in
-      0) echo "Doubles can be word-aligned."
-         echo "#undef ARCH_ALIGN_DOUBLE" >> m.h;;
-      1) echo "Doubles must be doubleword-aligned."
-         echo "#define ARCH_ALIGN_DOUBLE" >> m.h;;
-      *) echo "Something went wrong during alignment determination for doubles."
-         echo "I'm going to assume this architecture has alignment constraints over doubles."
-         echo "That's a safe bet: Objective Caml will work even if"
-         echo "this architecture has actually no alignment constraints."
-         echo "#define ARCH_ALIGN_DOUBLE" >> m.h;;
-    esac;;
-esac
-
-if $int64_native; then
-  case "$host" in
-    hppa*-*-*)
-      if test $2 = 8; then
-        echo "64-bit integers can be word-aligned."
-        echo "#undef ARCH_ALIGN_INT64" >> m.h
-      else
-        echo "64-bit integers must be doubleword-aligned."
-        echo "#define ARCH_ALIGN_INT64" >> m.h
-      fi;;
-    *)
-      sh ./runtest int64align.c
-      case $? in
-        0) echo "64-bit integers can be word-aligned."
-           echo "#undef ARCH_ALIGN_INT64" >> m.h;;
-        1) echo "64-bit integers must be doubleword-aligned."
-           echo "#define ARCH_ALIGN_INT64" >> m.h;;
-        *) echo "Something went wrong during alignment determination for 64-bit integers."
-           echo "I'm going to assume this architecture has alignment constraints."
-           echo "That's a safe bet: Objective Caml will work even if"
-           echo "this architecture has actually no alignment constraints."
-           echo "#define ARCH_ALIGN_INT64" >> m.h;;
-      esac
-  esac
-else
-  echo "#undef ARCH_ALIGN_INT64" >> m.h
-fi
-
-# Check semantics of division and modulus
-
-sh ./runtest divmod.c
-case $? in
-  0) echo "Native division and modulus have round-towards-zero semantics, will use them."
-     echo "#undef NONSTANDARD_DIV_MOD" >> m.h;;
-  1) echo "Native division and modulus do not have round-towards-zero semantics, will use software emulation."
-     echo "#define NONSTANDARD_DIV_MOD" >> m.h;;
-  *) echo "Something went wrong while checking native division and modulus, please report it."
-     echo "#define NONSTANDARD_DIV_MOD" >> m.h;;
-esac
-
-# Shared library support
-
-shared_libraries_supported=false
-dl_needs_underscore=false
-sharedcccompopts=''
-mksharedlib=''
-byteccrpath=''
-mksharedlibrpath=''
-
-if test $withsharedlibs = "yes"; then
-  case "$host" in
-    *-*-linux-gnu|*-*-linux|*-*-freebsd[3-9]*)
-      sharedcccompopts="-fPIC"
-      mksharedlib="$bytecc -shared -o"
-      bytecclinkopts="$bytecclinkopts -Wl,-E"
-      byteccrpath="-Wl,-rpath,"
-      mksharedlibrpath="-Wl,-rpath,"
-      shared_libraries_supported=true;;
-    alpha*-*-osf*)
-      case "$bytecc" in
-        gcc*)
-          sharedcccompopts="-fPIC"
-          mksharedlib="$bytecc -shared -o"
-          byteccrpath="-Wl,-rpath,"
-          mksharedlibrpath="-Wl,-rpath,"
-          shared_libraries_supported=true;;
-        cc*)
-          sharedcccompopts=""
-          mksharedlib="ld -shared -expect_unresolved '*' -o"
-          byteccrpath="-Wl,-rpath,"
-          mksharedlibrpath="-rpath "
-          shared_libraries_supported=true;;
-      esac;;
-    *-*-solaris2*)
-      case "$bytecc" in
-        gcc*)
-          sharedcccompopts="-fPIC"
-          if sh ./solaris-ld; then
-            mksharedlib="$bytecc -shared -o"
-            byteccrpath="-R"
-            mksharedlibrpath="-R"
-          else
-            mksharedlib="$bytecc -shared -o"
-            bytecclinkopts="$bytecclinkopts -Wl,-E"
-            byteccrpath="-Wl,-rpath,"
-            mksharedlibrpath="-Wl,-rpath,"
-          fi
-          shared_libraries_supported=true;;
-        *)
-          sharedcccompopts="-KPIC"
-          byteccrpath="-R"
-          mksharedlibrpath="-R"
-          mksharedlib="/usr/ccs/bin/ld -G -o"
-          shared_libraries_supported=true;;
-      esac;;
-    mips*-*-irix[56]*)
-      case "$bytecc" in
-        cc*) sharedcccompopts="";;
-        gcc*) sharedcccompopts="-fPIC";;
-      esac
-      mksharedlib="ld -shared -rdata_shared -o"
-      byteccrpath="-Wl,-rpath,"
-      mksharedlibrpath="-rpath "
-      shared_libraries_supported=true;;
-    powerpc-apple-darwin*)
-      mksharedlib="cc -bundle -flat_namespace -undefined suppress -o"
-      bytecccompopts="$dl_defs $bytecccompopts"
-      #sharedcccompopts="-fnocommon"
-      dl_needs_underscore=true
-      shared_libraries_supported=true;;
-  esac
-fi
-
-# Further machine-specific hacks
-
-case "$host" in
-  ia64-*-linux*|alpha*-*-linux*|x86_64-*-linux*)
-    echo "Will use mmap() instead of malloc() for allocation of major heap chunks."
-    echo "#define USE_MMAP_INSTEAD_OF_MALLOC" >> s.h;;
-esac
-
-# Configure the native-code compiler
-
-arch=none
-model=default
-system=unknown
-
-case "$host" in
-  alpha*-*-osf*)                arch=alpha; system=digital;;
-  alpha*-*-linux*)              arch=alpha; system=linux;;
-  alpha*-*-freebsd*)            arch=alpha; system=freebsd;;
-  alpha*-*-netbsd*)             arch=alpha; system=netbsd;;
-  alpha*-*-openbsd*)            arch=alpha; system=openbsd;;
-  sparc*-*-sunos4.*)            arch=sparc; system=sunos;;
-  sparc*-*-solaris2.*)          arch=sparc; system=solaris;;
-  sparc*-*-*bsd*)               arch=sparc; system=bsd;;
-  sparc*-*-linux*)              arch=sparc; system=linux;;
-  i[3456]86-*-linux*)           arch=i386; system=linux_`sh ./runtest elf.c`;;
-  i[3456]86-*-*bsd*)            arch=i386; system=bsd_`sh ./runtest elf.c`;;
-  i[3456]86-*-nextstep*)        arch=i386; system=nextstep;;
-  i[3456]86-*-solaris*)         arch=i386; system=solaris;;
-  i[3456]86-*-beos*)            arch=i386; system=beos;;
-  i[3456]86-*-cygwin*)          arch=i386; system=cygwin;;
-  mips-*-irix6*)                arch=mips; system=irix;;
-  hppa1.1-*-hpux*)              arch=hppa; system=hpux;;
-  hppa2.0*-*-hpux*)             arch=hppa; system=hpux;;
-  hppa*-*-linux*)		arch=hppa; system=linux;;
-  powerpc-*-linux*)             arch=power; model=ppc; system=elf;;
-  powerpc-*-netbsd*)            arch=power; model=ppc; system=bsd;;
-  powerpc-*-rhapsody*)          arch=power; model=ppc; system=rhapsody;;
-  powerpc-*-darwin*)            arch=power; model=ppc; system=rhapsody;;
-  arm*-*-linux*)                arch=arm; system=linux;;
-  ia64-*-linux*)                arch=ia64; system=linux;;
-  ia64-*-freebsd*)              arch=ia64; system=freebsd;;
-  x86_64-*-linux*)              arch=amd64; system=linux;;
-  x86_64-*-freebsd*)            arch=amd64; system=freebsd;;
-  x86_64-*-openbsd*)            arch=amd64; system=openbsd;;
-esac
-
-if test -z "$ccoption"; then
-  case "$arch,$system,$cc" in
-    alpha,digital,gcc*) nativecc=cc;;
-    mips,*,gcc*) nativecc=cc;;
-    *) nativecc="$bytecc";;
-  esac
-else
-  nativecc="$ccoption"
-fi
-
-nativecccompopts=''
-nativecclinkopts=''
-nativeccrpath="$byteccrpath"
-
-case "$arch,$nativecc,$system,$host_type" in
-  alpha,cc*,digital,*) nativecccompopts=-std1;;
-  mips,cc*,irix,*)     nativecccompopts=-n32
-                       nativecclinkopts="-n32 -Wl,-woff,84";;
-  *,*,nextstep,*)      nativecccompopts="$gcc_warnings -U__GNUC__ -posix"
-                       nativecclinkopts="-posix";;
-  *,*,rhapsody,*darwin[1-5].*)
-                       nativecccompopts="$gcc_warnings -DSHRINKED_GNUC";;
-  *,*,rhapsody,*)
-                 nativecccompopts="$gcc_warnings -DDARWIN_VERSION_6 $dl_defs";;
-  *,gcc*,cygwin,*)     nativecccompopts="$gcc_warnings -U_WIN32";;
-  *,gcc*,*,*)          nativecccompopts="$gcc_warnings";;
-esac
-
-asflags=''
-aspp='$(AS)'
-asppflags=''
-asppprofflags='-DPROFILING'
-
-case "$arch,$model,$system" in
-  alpha,*,digital)  asflags='-O2'; asppflags='-O2 -DSYS_$(SYSTEM)';
-                    asppprofflags='-pg -DPROFILING';;
-  alpha,*,linux)    aspp='gcc'; asppflags='-c -DSYS_$(SYSTEM)';;
-  alpha,*,freebsd)  aspp='gcc'; asppflags='-c -DSYS_$(SYSTEM)';;
-  alpha,*,netbsd)   aspp='gcc'; asppflags='-c -DSYS_$(SYSTEM)';;
-  alpha,*,openbsd)  aspp='gcc'; asppflags='-c -DSYS_$(SYSTEM)';;
-  mips,*,irix)      asflags='-n32 -O2'; asppflags="$asflags";;
-  sparc,*,bsd)      aspp='gcc'; asppflags='-c -DSYS_$(SYSTEM)';;
-  sparc,*,linux)    aspp='gcc'; asppflags='-c -DSYS_$(SYSTEM)';;
-  sparc,*,*)        case "$cc" in
-                      gcc*) aspp='gcc'; asppflags='-c -DSYS_$(SYSTEM)';;
-                         *) asppflags='-P -DSYS_$(SYSTEM)';;
-                    esac;;
-  i386,*,solaris)   aspp='/usr/ccs/bin/as'; asppflags='-P -DSYS_$(SYSTEM)';;
-  i386,*,*)         aspp='gcc'; asppflags='-c -DSYS_$(SYSTEM)';;
-  hppa,*,*)         aspp="$cc"; asppflags='-traditional -c -DSYS_$(SYSTEM)';;
-  power,*,elf)      aspp='gcc'; asppflags='-c';;
-  power,*,bsd)      aspp='gcc'; asppflags='-c -DSYS_$(SYSTEM)';;
-  power,*,rhapsody) ;;
-  arm,*,linux)      aspp='gcc'; asppflags='-c -DSYS_$(SYSTEM)';;
-  ia64,*,*)         asflags=-xexplicit
-                    aspp='gcc'; asppflags='-c -DSYS_$(SYSTEM) -Wa,-xexplicit';;
-  amd64,*,*)        aspp='gcc'; asppflags='-c -DSYS_$(SYSTEM)';;
-esac
-
-cc_profile='-pg'
-case "$arch,$model,$system" in
-  alpha,*,digital) profiling='prof';;
-  i386,*,linux_elf) profiling='prof';;
-  i386,*,bsd_elf) profiling='prof';;
-  sparc,*,solaris)
-    profiling='prof'
-    case "$nativecc" in gcc*) ;; *) cc_profile='-xpg';; esac;;
-  amd64,*,linux) profiling='prof';;
-  *) profiling='noprof';;
-esac
-
-# Where are GNU binutils?
-
-binutils_objcopy=''
-binutils_nm=''
-
-if test "$arch" != "none"; then
-  binutils_path="${binutils_dir}:${PATH}:/usr/libexec/binutils"
-  old_IFS="$IFS"
-  IFS=':'
-  for d in ${binutils_path}; do
-    if test -z "$d"; then continue; fi
-    if test -f "$d/objcopy" && test -f "$d/nm"; then
-      echo "objcopy and nm found in $d"
-      if test `$d/objcopy --help | grep -s -c 'redefine-sym'` -eq 0; then
-        echo "$d/objcopy does not support option --redefine-sym, discarded"
-        continue;
-      fi
-      if test `$d/nm --version | grep -s -c 'GNU nm'` -eq 0; then
-        echo "$d/nm is not from GNU binutils, discarded"
-        continue;
-      fi
-      binutils_objcopy="$d/objcopy"
-      binutils_nm="$d/nm"
-      break
-    fi
-  done
-  IFS="$old_IFS"
-fi
-
-# Where is ranlib?
-
-if sh ./searchpath ranlib; then
-  echo "ranlib found"
-  echo "RANLIB=ranlib" >> Makefile
-  echo "RANLIBCMD=ranlib" >> Makefile
-else
-  echo "ranlib not used"
-  echo "RANLIB=ar rs" >> Makefile
-  echo "RANLIBCMD=" >> Makefile
-fi
-
-# Do #! scripts work?
-
-if (SHELL=/bin/sh; export SHELL; (./sharpbang || ./sharpbang2) >/dev/null); then
-  echo "#! appears to work in shell scripts"
-  case "$host" in
-    *-*-sunos*|*-*-unicos*)
-      echo "We won't use it, though, because under SunOS and Unicos it breaks"
-      echo "on pathnames longer than 30 characters"
-      echo "SHARPBANGSCRIPTS=false" >> Makefile;;
-    *-*-cygwin*)
-      echo "We won't use it, though, because of conflicts with .exe extension"
-      echo "under Cygwin"
-      echo "SHARPBANGSCRIPTS=false" >> Makefile;;
-    *)
-      echo "SHARPBANGSCRIPTS=true" >> Makefile;;
-  esac
-else
-  echo "No support for #! in shell scripts"
-  echo "SHARPBANGSCRIPTS=false" >> Makefile
-fi
-
-# Write the OS type (Unix or Cygwin)
-
-echo "#define OCAML_OS_TYPE \"$ostype\"" >> s.h
-echo "#define OCAML_STDLIB_DIR \"$libdir\"" >> s.h
-
-# Use 64-bit file offset if possible
-
-bytecccompopts="$bytecccompopts -D_FILE_OFFSET_BITS=64"
-nativecccompopts="$nativecccompopts -D_FILE_OFFSET_BITS=64"
-
-# Check the semantics of signal handlers
-
-if sh ./hasgot sigaction sigprocmask; then
-  echo "POSIX signal handling found."
-  echo "#define POSIX_SIGNALS" >> s.h
-else
-  if sh ./runtest signals.c; then
-    echo "Signals have the BSD semantics."
-    echo "#define BSD_SIGNALS" >> s.h
-  else
-    echo "Signals have the System V semantics."
-  fi
-  if sh ./hasgot sigsetmask; then
-    echo "sigsetmask() found"
-    echo "#define HAS_SIGSETMASK" >> s.h
-  fi
-fi
-
-# For the sys module
-
-if sh ./hasgot times; then
-  echo "times() found."
-  echo "#define HAS_TIMES" >> s.h
-fi
-
-# For the terminfo module
-
-if test "$withcurses" = "yes"; then
-  for libs in "" "-lcurses" "-ltermcap" "-lcurses -ltermcap" "-lncurses"; do
-    if sh ./hasgot $libs tgetent tgetstr tgetnum tputs; then
-      echo "termcap functions found (with libraries '$libs')"
-      echo "#define HAS_TERMCAP" >> s.h
-      curseslibs="${libs}"
-      break
-    fi
-  done
-fi
-
-# Configuration for the libraries
-
-otherlibraries="unix str num dynlink bigarray"
-
-# For the Unix library
-
-has_sockets=no
-if sh ./hasgot socket socketpair bind listen accept connect; then
-  echo "You have BSD sockets."
-  echo "#define HAS_SOCKETS" >> s.h
-  has_sockets=yes
-elif sh ./hasgot -lnsl -lsocket socket socketpair bind listen accept connect; then
-  echo "You have BSD sockets (with libraries '-lnsl -lsocket')"
-  cclibs="$cclibs -lnsl -lsocket"
-  echo "#define HAS_SOCKETS" >> s.h
-  has_sockets=yes
-fi
-
-if sh ./hasgot -i sys/socket.h -t socklen_t; then
-  echo "socklen_t is defined in <sys/socket.h>"
-  echo "#define HAS_SOCKLEN_T" >> s.h
-fi
-
-if sh ./hasgot inet_aton; then
-  echo "inet_aton() found."
-  echo "#define HAS_INET_ATON" >> s.h
-fi
-
-if sh ./hasgot -i sys/types.h -i sys/socket.h -i netinet/in.h \
-               -t 'struct sockaddr_in6' \
-&& sh ./hasgot getaddrinfo getnameinfo inet_pton inet_ntop; then
-  echo "IPv6 is supported."
-  echo "#define HAS_IPV6" >> s.h
-fi
-
-if sh ./hasgot -i unistd.h; then
-  echo "unistd.h found."
-  echo "#define HAS_UNISTD" >> s.h
-fi
-
-if sh ./hasgot -i sys/types.h -t off_t; then
-  echo "off_t is defined in <sys/types.h>"
-  echo "#define HAS_OFF_T" >> s.h
-fi
-
-if sh ./hasgot -i sys/types.h -i dirent.h; then
-  echo "dirent.h found."
-  echo "#define HAS_DIRENT" >> s.h
-fi
-
-if sh ./hasgot rewinddir; then
-  echo "rewinddir() found."
-  echo "#define HAS_REWINDDIR" >> s.h
-fi
-
-if sh ./hasgot lockf; then
-  echo "lockf() found."
-  echo "#define HAS_LOCKF" >> s.h
-fi
-
-if sh ./hasgot mkfifo; then
-  echo "mkfifo() found."
-  echo "#define HAS_MKFIFO" >> s.h
-fi
-
-if sh ./hasgot getcwd; then
-  echo "getcwd() found."
-  echo "#define HAS_GETCWD" >> s.h
-fi
-
-if sh ./hasgot getwd; then
-  echo "getwd() found."
-  echo "#define HAS_GETWD" >> s.h
-fi
-
-if sh ./hasgot getpriority setpriority; then
-  echo "getpriority() found."
-  echo "#define HAS_GETPRIORITY" >> s.h
-fi
-
-if sh ./hasgot -i sys/types.h -i utime.h && sh ./hasgot utime; then
-  echo "utime() found."
-  echo "#define HAS_UTIME" >> s.h
-fi
-
-if sh ./hasgot utimes; then
-  echo "utimes() found."
-  echo "#define HAS_UTIMES" >> s.h
-fi
-
-if sh ./hasgot dup2; then
-  echo "dup2() found."
-  echo "#define HAS_DUP2" >> s.h
-fi
-
-if sh ./hasgot fchmod fchown; then
-  echo "fchmod() found."
-  echo "#define HAS_FCHMOD" >> s.h
-fi
-
-if sh ./hasgot truncate ftruncate; then
-  echo "truncate() found."
-  echo "#define HAS_TRUNCATE" >> s.h
-fi
-
-select_include=''
-if sh ./hasgot -i sys/types.h -i sys/select.h; then
-  echo "sys/select.h found."
-  echo "#define HAS_SYS_SELECT_H" >> s.h
-  select_include='-i sys/select.h'
-fi
-
-has_select=no
-if sh ./hasgot select && \
-   sh ./hasgot -i sys/types.h $select_include -t fd_set ; then
-  echo "select() found."
-  echo "#define HAS_SELECT" >> s.h
-  has_select=yes
-fi
-
-if sh ./hasgot symlink readlink lstat;  then
-  echo "symlink() found."
-  echo "#define HAS_SYMLINK" >> s.h
-fi
-
-has_wait=no
-if sh ./hasgot waitpid;  then
-  echo "waitpid() found."
-  echo "#define HAS_WAITPID" >> s.h
-  has_wait=yes
-fi
-
-if sh ./hasgot wait4;  then
-  echo "wait4() found."
-  echo "#define HAS_WAIT4" >> s.h
-  has_wait=yes
-fi
-
-if sh ./hasgot -i limits.h && sh ./runtest getgroups.c; then
-  echo "getgroups() found."
-  echo "#define HAS_GETGROUPS" >> s.h
-fi
-
-if sh ./hasgot -i termios.h &&
-   sh ./hasgot tcgetattr tcsetattr tcsendbreak tcflush tcflow; then
-  echo "POSIX termios found."
-  echo "#define HAS_TERMIOS" >> s.h
-fi
-
-# Async I/O under OSF1 3.x are so buggy that the test program hangs...
-testasyncio=true
-if test -f /usr/bin/uname; then
-  case "`/usr/bin/uname -s -r`" in
-    "OSF1 V3."*) testasyncio=false;;
-  esac
-fi
-if $testasyncio && sh ./runtest async_io.c; then
-  echo "Asynchronous I/O are supported."
-  echo "#define HAS_ASYNC_IO" >> s.h
-fi
-
-has_setitimer=no
-if sh ./hasgot setitimer; then
-  echo "setitimer() found."
-  echo "#define HAS_SETITIMER" >> s.h
-  has_setitimer="yes"
-fi
-
-if sh ./hasgot gethostname; then
-  echo "gethostname() found."
-  echo "#define HAS_GETHOSTNAME" >> s.h
-fi
-
-if sh ./hasgot -i sys/utsname.h && sh ./hasgot uname; then
-  echo "uname() found."
-  echo "#define HAS_UNAME" >> s.h
-fi
-
-has_gettimeofday=no
-if sh ./hasgot gettimeofday; then
-  echo "gettimeofday() found."
-  echo "#define HAS_GETTIMEOFDAY" >> s.h
-  has_gettimeofday="yes"
-fi
-
-if sh ./hasgot mktime; then
-  echo "mktime() found."
-  echo "#define HAS_MKTIME" >> s.h
-fi
-
-case "$host" in
-  *-*-cygwin*) ;;  # setsid emulation under Cygwin breaks the debugger
-  *) if sh ./hasgot setsid; then
-       echo "setsid() found."
-       echo "#define HAS_SETSID" >> s.h
-     fi;;
-esac
-
-if sh ./hasgot putenv; then
-  echo "putenv() found."
-  echo "#define HAS_PUTENV" >> s.h
-fi
-
-if sh ./hasgot -i locale.h && sh ./hasgot setlocale; then
-  echo "setlocale() and <locale.h> found."
-  echo "#define HAS_LOCALE" >> s.h
-fi
-
-if sh ./hasgot -i mach-o/dyld.h && sh ./hasgot NSLinkModule; then
-  echo "NSLinkModule() found. Using darwin dynamic loading."
-  echo "#define HAS_NSLINKMODULE" >> s.h
-elif sh ./hasgot $dllib dlopen; then
-  echo "dlopen() found."
-elif sh ./hasgot $dllib -ldl dlopen; then
-  echo "dlopen() found in -ldl."
-  dllib="$dllib -ldl"
-else
-  shared_libraries_supported=no
-fi
-
-if $shared_libraries_supported; then
-  echo "Dynamic loading of shared libraries is supported."
-  echo "#define SUPPORT_DYNAMIC_LINKING" >> s.h
-  if $dl_needs_underscore; then
-    echo '#define DL_NEEDS_UNDERSCORE' >>s.h
-  fi
-fi
-
-if sh ./hasgot -i sys/types.h -i sys/mman.h && sh ./hasgot mmap munmap; then
-  echo "mmap() found."
-  echo "#define HAS_MMAP" >> s.h
-fi
-
-nargs=none
-for i in 5 6; do
-  if sh ./trycompile -DNUM_ARGS=${i} gethostbyname.c; then nargs=$i; break; fi
-done
-if test $nargs != "none"; then
-  echo "gethostbyname_r() found (with ${nargs} arguments)."
-  echo "#define HAS_GETHOSTBYNAME_R $nargs" >> s.h
-fi
-
-nargs=none
-for i in 7 8; do
-  if sh ./trycompile -DNUM_ARGS=${i} gethostbyaddr.c; then nargs=$i; break; fi
-done
-if test $nargs != "none"; then
-  echo "gethostbyaddr_r() found (with ${nargs} arguments)."
-  echo "#define HAS_GETHOSTBYADDR_R $nargs" >> s.h
-fi
-
-# Determine if the debugger is supported
-
-if test "$has_sockets" = "yes"; then
-  echo "Replay debugger supported."
-  debugger="ocamldebugger"
-else
-  echo "No replay debugger (missing system calls)"
-  debugger=""
-fi
-
-
-# Determine if system stack overflows can be detected
-
-case "$arch,$system" in
-  i386,linux_elf)
-    echo "System stack overflow can be detected."
-    echo "#define HAS_STACK_OVERFLOW_DETECTION" >> s.h;;
-  *)
-    echo "Cannot detect system stack overflow.";;
-esac
-
-# Determine the target architecture for the "num" library
-
-case "$host" in
-  alpha*-*-*)    bng_arch=alpha; bng_asm_level=1;;
-  i[3456]86-*-*) bng_arch=ia32
-                 if sh ./trycompile ia32sse2.c
-                 then bng_asm_level=2
-                 else bng_asm_level=1
-                 fi;;
-  mips-*-*)      bng_arch=mips; bng_asm_level=1;;
-  powerpc-*-*)   bng_arch=ppc; bng_asm_level=1;;
-  sparc*-*-*)    bng_arch=sparc; bng_asm_level=1;;
-  x86_64-*-*)    bng_arch=amd64; bng_asm_level=1;;
-  *)             bng_arch=generic; bng_asm_level=0;;
-esac
-
-echo "BNG_ARCH=$bng_arch" >> Makefile
-echo "BNG_ASM_LEVEL=$bng_asm_level" >> Makefile
-
-# Determine if the POSIX threads library is supported
-
-if test "$pthread_wanted" = "yes"; then
-  case "$host" in
-    *-*-solaris*)  pthread_link="-lpthread -lposix4";;
-    *-*-freebsd*)  pthread_link="-pthread";;
-    *-*-openbsd*)  pthread_link="-pthread";;
-    *)             pthread_link="-lpthread";;
-  esac
-  if ./hasgot -i pthread.h $pthread_link pthread_self; then
-    echo "POSIX threads library supported."
-    otherlibraries="$otherlibraries systhreads"
-    bytecccompopts="$bytecccompopts -D_REENTRANT"
-    nativecccompopts="$nativecccompopts -D_REENTRANT"
-    case "$host" in
-      *-*-freebsd*)
-          bytecccompopts="$bytecccompopts -D_THREAD_SAFE"
-          nativecccompopts="$nativecccompopts -D_THREAD_SAFE";;
-      *-*-openbsd*)
-          bytecccompopts="$bytecccompopts -pthread"
-          asppflags="$asppflags -pthread"
-          nativecccompopts="$nativecccompopts -pthread";;
-    esac
-    echo "Options for linking with POSIX threads: $pthread_link"
-    echo "PTHREAD_LINK=$pthread_link" >> Makefile
-    if sh ./hasgot $pthread_link sigwait; then
-      echo "sigwait() found"
-      echo "#define HAS_SIGWAIT" >> s.h
-    fi
-  else
-    echo "POSIX threads not found."
-    pthread_link=""
-  fi
-fi
-
-# Determine if the bytecode thread library is supported
-
-if test "$has_select" = "yes" \
-&& test "$has_setitimer" = "yes" \
-&& test "$has_gettimeofday" = "yes" \
-&& test "$has_wait" = "yes"; then
-  echo "Bytecode threads library supported."
-  otherlibraries="$otherlibraries threads"
-else
-  echo "Bytecode threads library not supported (missing system calls)"
-fi
-
-# Determine the location of X include files and libraries
-
-x11_include="not found"
-x11_link="not found"
-
-for dir in \
-    $x11_include_dir          \
-    ; \
-do
-  if test -f $dir/X11/X.h; then
-    x11_include=$dir
-    break
-  fi
-done
-
-if test "$x11_include" = "not found"; then
-  x11_try_lib_dir=''
-else
-  x11_try_lib_dir=`echo $x11_include | sed -e 's|include|lib|'`
-fi
-
-for dir in \
-    $x11_lib_dir          \
-    $x11_try_lib_dir      \
-    ; \
-do
-  if test -f $dir/libX11.a || \
-     test -f $dir/libX11.so || \
-     test -f $dir/libX11.dll.a || \
-     test -f $dir/libX11.sa; then
-    if test $dir = /usr/lib; then
-      x11_link="-lX11"
-    else
-      x11_link="-L$dir -lX11"
-      x11_libs="-L$dir"
-    fi
-    break
-  fi
-done
-
-
-if test "$x11_include" = "not found" || test "$x11_link" = "not found"
-then
-  echo "X11 not found, the \"graph\" library will not be supported."
-  x11_include=""
-else
-  echo "Location of X11 include files: $x11_include/X11"
-  echo "Options for linking with X11: $x11_link"
-  otherlibraries="$otherlibraries graph"
-  if test "$x11_include" = "/usr/include"; then
-    x11_include=""
-  else
-    x11_include="-I$x11_include"
-  fi
-  echo "X11_INCLUDES=$x11_include" >> Makefile
-  echo "X11_LINK=$x11_link" >> Makefile
-fi
-
-# See if we can compile the dbm library
-
-dbm_include="not found"
-dbm_link="not found"
-use_gdbm_ndbm=no
-
-for dir in ; do
-  if test -f $dir/ndbm.h; then
-    dbm_include=$dir
-    if sh ./hasgot dbm_open; then
-      dbm_link=""
-    elif sh ./hasgot -lndbm dbm_open; then
-      dbm_link="-lndbm"
-    elif sh ./hasgot -ldb1 dbm_open; then
-      dbm_link="-ldb1"
-    elif sh ./hasgot -lgdbm dbm_open; then
-      dbm_link="-lgdbm"
-    elif sh ./hasgot -lgdbm_compat -lgdbm dbm_open; then
-      dbm_link="-lgdbm_compat -lgdbm" 
-    fi
-    break
-  fi
-  if test -f $dir/gdbm-ndbm.h; then
-    dbm_include=$dir
-    use_gdbm_ndbm=yes
-    if sh ./hasgot -lgdbm_compat -lgdbm dbm_open; then
-      dbm_link="-lgdbm_compat -lgdbm"
-    fi
-    break   
-  fi
-done
-if test "$dbm_include" = "not found" || test "$dbm_link" = "not found"; then
-  echo "NDBM not found, the \"dbm\" library will not be supported."
-else
-  echo "NDBM found (in $dbm_include)"
-  if test "$dbm_include" = "/usr/include"; then
-    dbm_include=""
-  else
-    dbm_include="-I$dbm_include"
-  fi
-  echo "DBM_INCLUDES=$dbm_include" >> Makefile
-  echo "DBM_LINK=$dbm_link" >> Makefile
-  if test "$use_gdbm_ndbm" = "yes"; then
-    echo "#define DBM_USES_GDBM_NDBM" >> s.h
-  fi
-  otherlibraries="$otherlibraries dbm"
-fi
-
-# Look for tcl/tk
-
-echo "Configuring LablTk..."
-
-if test $tk_wanted = no; then
-  has_tk=false
-elif test $tk_x11 = no; then
-  has_tk=true
-elif test "$x11_include" = "not found" || test "$x11_link" = "not found"; then
-  echo "X11 not found."
-  has_tk=false
-else
-  tk_x11_include="$x11_include"
-  tk_x11_libs="$x11_libs -lX11"
-  has_tk=true
-fi
-
-if test $has_tk = true; then
-  tcl_version=''
-  tcl_version=`sh ./runtest $tk_defs $tk_x11_include tclversion.c`
-  if test -z "$tcl_version" && test -z "$tk_defs"; then
-    tk_defs=-I/usr/local/include
-    tcl_version=`sh ./runtest $tk_defs $tk_x11_include tclversion.c`
-  fi
-  if test -z "$tcl_version"; then
-    tk_defs="-I/usr/local/include/tcl8.2 -I/usr/local/include/tk8.2"
-    tcl_version=`sh ./runtest $tk_defs $tk_x11_include tclversion.c`
-  fi
-  if test -z "$tcl_version"; then
-    tk_defs="-I/usr/local/include/tcl8.3 -I/usr/local/include/tk8.3"
-    tcl_version=`sh ./runtest $tk_defs $tk_x11_include tclversion.c`
-  fi
-  if test -z "$tcl_version"; then
-    tk_defs="-I/usr/local/include/tcl8.4 -I/usr/local/include/tk8.4"
-    tcl_version=`sh ./runtest $tk_defs $tk_x11_include tclversion.c`
-  fi
-  if test -z "$tcl_version"; then
-    tk_defs="-I/usr/include/tcl8.2 -I/usr/include/tk8.2"
-    tcl_version=`sh ./runtest $tk_defs $tk_x11_include tclversion.c`
-  fi
-  if test -z "$tcl_version"; then
-    tk_defs="-I/usr/include/tcl8.3 -I/usr/include/tk8.3"
-    tcl_version=`sh ./runtest $tk_defs $tk_x11_include tclversion.c`
-  fi
-  if test -z "$tcl_version"; then
-    tk_defs="-I/usr/include/tcl8.4 -I/usr/include/tk8.4"
-    tcl_version=`sh ./runtest $tk_defs $tk_x11_include tclversion.c`
-  fi
-  if test -z "$tcl_version"; then
-    tk_defs="-I/sw/include"
-    tcl_version=`sh ./runtest $tk_defs $tk_x11_include tclversion.c`
-  fi
-  if test -n "$tcl_version"; then
-    echo "tcl.h version $tcl_version found with \"$tk_defs\"."
-    case $tcl_version in
-    7.5) tclmaj=7 tclmin=5 tkmaj=4 tkmin=1 ;;
-    7.6) tclmaj=7 tclmin=6 tkmaj=4 tkmin=2 ;;
-    8.0) tclmaj=8 tclmin=0 tkmaj=8 tkmin=0 ;;
-    8.1) tclmaj=8 tclmin=1 tkmaj=8 tkmin=1 ;;
-    8.2) tclmaj=8 tclmin=2 tkmaj=8 tkmin=2 ;;
-    8.3) tclmaj=8 tclmin=3 tkmaj=8 tkmin=3 ;;
-    8.4) tclmaj=8 tclmin=4 tkmaj=8 tkmin=4 ;;
-    *) echo "This version is not known."; has_tk=false ;;
-    esac
-  else
-    echo "tcl.h not found."
-    has_tk=false
-  fi
-fi
-
-if test $has_tk = true; then
-  if sh ./hasgot $tk_x11_include $tk_defs -i tk.h; then
-    echo "tk.h found."
-  else
-    echo "tk.h not found."
-    has_tk=false
-  fi
-fi
-
-tkauxlibs="$mathlib $dllib"
-tcllib=''
-tklib=''
-if test $has_tk = true; then
-  if sh ./hasgot $tk_libs $tk_x11_libs $tkauxlibs Tcl_DoOneEvent
-  then tk_libs="$tk_libs $dllib"
-  elif sh ./hasgot $tk_libs -ltcl$tclmaj.$tclmin $tkauxlibs Tcl_DoOneEvent
-  then
-    tk_libs="$tk_libs -ltk$tkmaj.$tkmin -ltcl$tclmaj.$tclmin $dllib"
-  elif sh ./hasgot $tk_libs -ltcl$tclmaj$tclmin $tkauxlibs Tcl_DoOneEvent
-  then
-    tk_libs="$tk_libs -ltk$tkmaj$tkmin -ltcl$tclmaj$tclmin $dllib"
-  elif test -z "$tk_libs" && tk_libs=-L/usr/local/lib && \
-    sh ./hasgot $tk_libs -ltcl$tclmaj.$tclmin $tkauxlibs Tcl_DoOneEvent
-  then
-    tk_libs="$tk_libs -ltk$tkmaj.$tkmin -ltcl$tclmaj.$tclmin $dllib"
-  elif sh ./hasgot $tk_libs -ltcl$tclmaj$tclmin $tkauxlibs Tcl_DoOneEvent
-  then
-    tk_libs="$tk_libs -ltk$tkmaj$tkmin -ltcl$tclmaj$tclmin $dllib"
-# elif sh ./hasgot $tk_libs -ltcl $tkauxlibs Tcl_DoOneEvent; then
-#   tk_libs="$tk_libs -ltk -ltcl"
-  elif sh ./hasgot -L/sw/lib $tk_libs -ltcl$tclmaj.$tclmin $tkauxlibs \
-                   Tcl_DoOneEvent
-  then tk_libs="-L/sw/lib -ltk$tkmaj.$tkmin -ltcl$tclmaj.$tclmin $dllib"
-  else
-    echo "Tcl library not found."
-    has_tk=false
-  fi
-fi
-if test $has_tk = true; then
-  if sh ./hasgot $tk_libs $tk_x11_libs $tkauxlibs Tk_SetGrid; then
-    echo "Tcl/Tk libraries found."
-  elif sh ./hasgot -L/sw/lib $tk_libs $tk_x11_libs $tkauxlibs Tk_SetGrid; then
-    tk_libs="-L/sw/lib $tk_libs"
-    echo "Tcl/Tk libraries found."
-  else
-    echo "Tcl library found."
-    echo "Tk library not found."
-    has_tk=false
-  fi
-fi
-
-if test $has_tk = true; then
-  if test $tk_x11 = yes; then
-    echo "TK_DEFS=$tk_defs "'$(X11_INCLUDES)' >> Makefile
-    echo "TK_LINK=$tk_libs "'$(X11_LINK)' >> Makefile
-  else
-    echo "TK_DEFS=$tk_defs" >> Makefile
-    echo "TK_LINK=$tk_libs" >> Makefile
-  fi
-  otherlibraries="$otherlibraries labltk"
-else
-  echo "Configuration failed, LablTk will not be built."
-fi
-
-# Camlp4
-
-(
-cd ../../camlp4/config
-EXE=$exe ./configure_batch -bindir "$bindir" -libdir "$libdir" -mandir "$mandir" -ocaml-top ../.. > /dev/null
-)
-
-# Final twiddling of compiler options to work around known bugs
-
-nativeccprofopts="$nativecccompopts"
-case "$buggycc" in
-  gcc.2.96)
-    bytecccompopts="$bytecccompopts -fomit-frame-pointer"
-    nativecccompopts="$nativecccompopts -fomit-frame-pointer";;
-esac
-
-# Finish generated files
-
-cclibs="$cclibs $mathlib"
-
-echo "BYTECC=$bytecc" >> Makefile
-echo "BYTECCCOMPOPTS=$bytecccompopts" >> Makefile
-echo "BYTECCLINKOPTS=$bytecclinkopts" >> Makefile
-echo "BYTECCLIBS=$cclibs $dllib $curseslibs $pthread_link" >> Makefile
-echo "BYTECCRPATH=$byteccrpath" >> Makefile
-echo "EXE=$exe" >> Makefile
-echo "SUPPORTS_SHARED_LIBRARIES=$shared_libraries_supported" >> Makefile
-echo "SHAREDCCCOMPOPTS=$sharedcccompopts" >> Makefile
-echo "MKSHAREDLIB=$mksharedlib" >> Makefile
-echo "MKSHAREDLIBRPATH=$mksharedlibrpath" >> Makefile
-echo "ARCH=$arch" >> Makefile
-echo "MODEL=$model" >> Makefile
-echo "SYSTEM=$system" >> Makefile
-echo "NATIVECC=$nativecc" >> Makefile
-echo "NATIVECCCOMPOPTS=$nativecccompopts" >> Makefile
-echo "NATIVECCPROFOPTS=$nativeccprofopts" >> Makefile
-echo "NATIVECCLINKOPTS=$nativecclinkopts" >> Makefile
-echo "NATIVECCRPATH=$nativeccrpath" >> Makefile
-echo "NATIVECCLIBS=$cclibs $dllib" >> Makefile
-echo "ASFLAGS=$asflags" >> Makefile
-echo "ASPP=$aspp" >> Makefile
-echo "ASPPFLAGS=$asppflags" >> Makefile
-echo "ASPPPROFFLAGS=$asppprofflags" >> Makefile
-echo "PROFILING=$profiling" >> Makefile
-echo "BINUTILS_OBJCOPY=$binutils_objcopy" >> Makefile
-echo "BINUTILS_NM=$binutils_nm" >> Makefile
-echo "DYNLINKOPTS=$dllib" >> Makefile
-echo "OTHERLIBRARIES=$otherlibraries" >> Makefile
-echo "DEBUGGER=$debugger" >> Makefile
-echo "CC_PROFILE=$cc_profile" >> Makefile
-
-rm -f tst hasgot.c
-rm -f ../m.h ../s.h ../Makefile
-mv m.h s.h Makefile ..
-
-# Print a summary
-
-echo
-echo "** Configuration summary **"
-echo
-echo "Directories where Objective Caml will be installed:"
-echo "        binaries.................. $bindir"
-echo "        standard library.......... $libdir"
-echo "        manual pages.............. $mandir (with extension .$manext)"
-
-echo "Configuration for the bytecode compiler:"
-echo "        C compiler used........... $bytecc"
-echo "        options for compiling..... $bytecccompopts"
-echo "        options for linking....... $bytecclinkopts $cclibs $dllib $curseslibs $pthread_link"
-if $shared_libraries_supported; then
-echo "        shared libraries are supported"
-echo "        options for compiling..... $sharedcccompopts $bytecccompopts"
-echo "        command for building...... $mksharedlib lib.so $mksharedlibrpath/a/path objs"
-else
-echo "        shared libraries not supported"
-fi
-
-echo "Configuration for the native-code compiler:"
-if test "$arch" = "none"; then
-  echo "        (not supported on this platform)"
-else
-  if test "$model" = "default"; then
-    echo "        hardware architecture..... $arch"
-  else
-    echo "        hardware architecture..... $arch ($model)"
-  fi
-  if test "$system" = "unknown"; then : ; else
-  echo "        OS variant................ $system"
-  fi
-  echo "        C compiler used........... $nativecc"
-  echo "        options for compiling..... $nativecccompopts"
-  echo "        options for linking....... $nativecclinkopts $cclibs"
-  echo "        assembler ................ \$(AS) $asflags"
-  echo "        preprocessed assembler ... $aspp $asppflags"
-  if test "$profiling" = "prof"; then
-  echo "        profiling with gprof ..... supported"
-  else
-  echo "        profiling with gprof ..... not supported"
-  fi
-  if test -n "$binutils_objcopy" && test -n "$binutils_nm"; then
-  echo "        ocamlopt -pack ........... supported"
-  else
-  echo "        ocamlopt -pack ........... not supported (no binutils)"
-  fi
-fi
-
-if test "$debugger" = "ocamldebugger"; then
-  echo "Source-level replay debugger: supported"
-else
-  echo "Source-level replay debugger: not supported"
-fi
-
-echo "Additional libraries supported:"
-echo "        $otherlibraries"
-
-echo "Configuration for the \"num\" library:"
-echo "        target architecture ...... $bng_arch (asm level $bng_asm_level)"
-
-if test "$x11_include" != "not found" && test "$x11_lib" != "not found"; then
-echo "Configuration for the \"graph\" library:"
-echo "        options for compiling .... $x11_include"
-echo "        options for linking ...... $x11_link"
-fi
-
-if test $has_tk = true; then
-echo "Configuration for the \"labltk\" library:"
-echo "        use tcl/tk version ....... $tcl_version"
-echo "        options for compiling .... $tk_defs"
-echo "        options for linking ...... $tk_libs"
-else
-echo "The \"labltk\" library: not found"
-fi
diff --git a/pkgs/development/compilers/ocaml/generic.nix b/pkgs/development/compilers/ocaml/generic.nix
index d9853dd642ab1..8f78e817f93e2 100644
--- a/pkgs/development/compilers/ocaml/generic.nix
+++ b/pkgs/development/compilers/ocaml/generic.nix
@@ -44,7 +44,6 @@ stdenv.mkDerivation (args // {
 
   inherit src;
 
-  prefixKey = "-prefix ";
   configureFlags =
     let flags = new: old:
       if lib.versionAtLeast version "4.08"
diff --git a/pkgs/development/compilers/ocaml/gnused-on-osx-fix.patch b/pkgs/development/compilers/ocaml/gnused-on-osx-fix.patch
deleted file mode 100644
index dc2bcb869766a..0000000000000
--- a/pkgs/development/compilers/ocaml/gnused-on-osx-fix.patch
+++ /dev/null
@@ -1,9 +0,0 @@
-diff -Nuar ocaml-3.11.1/ocamldoc/remove_DEBUG ocaml-3.11.1-nixpkgs/ocamldoc/remove_DEBUG
---- ocaml-3.11.1/ocamldoc/remove_DEBUG	2004-04-15 18:18:52.000000000 +0200
-+++ ocaml-3.11.1-nixpkgs/ocamldoc/remove_DEBUG	2011-01-01 17:37:07.000000000 +0100
-@@ -18,4 +18,4 @@
- # respecting the cpp # line annotation conventions
- 
- echo "# 1 \"$1\""
--LC_ALL=C sed -e '/DEBUG/s/.*//' "$1"
-+grep -v 'DEBUG' "$1"
diff --git a/pkgs/development/compilers/ocaml/metaocaml-3.09.nix b/pkgs/development/compilers/ocaml/metaocaml-3.09.nix
deleted file mode 100644
index e13f3006be579..0000000000000
--- a/pkgs/development/compilers/ocaml/metaocaml-3.09.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib, stdenv, fetchurl, xlibsWrapper, ncurses }:
-
-stdenv.mkDerivation ({
-
-  pname = "metaocaml";
-  version = "3.09-alpha-30";
-
-  src = fetchurl {
-    url = "http://www.metaocaml.org/dist/old/MetaOCaml_309_alpha_030.tar.gz";
-    sha256 = "0migbn0zwfb7yb24dy7qfqi19sv3drqcv4369xi7xzpds2cs35fd";
-  };
-
-  prefixKey = "-prefix ";
-  configureFlags = ["-no-tk" "-x11lib" xlibsWrapper];
-  buildFlags = [ "world" "bootstrap" "world.opt" ];
-  buildInputs = [xlibsWrapper ncurses];
-  installTargets = "install installopt";
-  patchPhase = ''
-    CAT=$(type -tp cat)
-    sed -e "s@/bin/cat@$CAT@" -i config/auto-aux/sharpbang
-  '';
-  postBuild = ''
-    mkdir -p $out/include
-    ln -sv $out/lib/ocaml/caml $out/include/caml
-  '';
-
-  meta = {
-    homepage = "http://www.metaocaml.org/";
-    license = with lib.licenses; [ qpl lgpl2 ];
-    description = "A compiled, type-safe, multi-stage programming language";
-    broken = true;
-  };
-
-})
diff --git a/pkgs/development/compilers/ocaml/mips64.patch b/pkgs/development/compilers/ocaml/mips64.patch
deleted file mode 100644
index cdef9cafb9323..0000000000000
--- a/pkgs/development/compilers/ocaml/mips64.patch
+++ /dev/null
@@ -1,240 +0,0 @@
-http://caml.inria.fr/mantis/view.php?id=4849
-
-diff -bur ocaml-3.11.1/asmcomp/mips/arch.ml my_ocaml/asmcomp/mips/arch.ml
---- asmcomp/mips/arch.ml	2002-11-29 16:03:36.000000000 +0100
-+++ asmcomp/mips/arch.ml	2009-08-09 23:18:31.000000000 +0200
-@@ -35,7 +35,7 @@
- 
- let big_endian =
-   match Config.system with
--    "ultrix" -> false
-+    "ultrix" | "gnu" -> false
-   | "irix" -> true
-   | _ -> fatal_error "Arch_mips.big_endian"
- 
-diff -bur ocaml-3.11.1/asmcomp/mips/emit.mlp my_ocaml/asmcomp/mips/emit.mlp
---- asmcomp/mips/emit.mlp	2004-01-05 21:25:56.000000000 +0100
-+++ asmcomp/mips/emit.mlp	2009-08-23 12:11:58.000000000 +0200
-@@ -58,7 +58,7 @@
-     !stack_offset +
-     4 * num_stack_slots.(0) + 8 * num_stack_slots.(1) +
-     (if !contains_calls then if !uses_gp then 8 else 4 else 0) in
--  Misc.align size 16
-+  Misc.align size 16	(* n32 require quadword alignment *)
- 
- let slot_offset loc cl =
-   match loc with
-@@ -252,7 +252,7 @@
-     | Lop(Icall_ind) ->
-         `	move	$25, {emit_reg i.arg.(0)}\n`;
-         liveregs i live_25;
--        `	jal	{emit_reg i.arg.(0)}\n`;
-+        `	jal	$25\n`; (* {emit_reg i.arg.(0)}\n; Equivalent but avoids "Warning: MIPS PIC call to register other than $25" on GNU as *)
-         `{record_frame i.live}\n`
-     | Lop(Icall_imm s) ->
-         liveregs i 0;
-@@ -269,7 +269,7 @@
-         liveregs i 0;
-         `	move	$25, {emit_reg i.arg.(0)}\n`;
-         liveregs i live_25;
--        `	j	{emit_reg i.arg.(0)}\n`
-+        `	j	$25\n`
-     | Lop(Itailcall_imm s) ->
-         if s = !function_name then begin
-           `	b	{emit_label !tailrec_entry_point}\n`
-@@ -277,11 +277,11 @@
-           let n = frame_size() in
-           if !contains_calls then
-             `	lw	$31, {emit_int(n - 4)}($sp)\n`;
-+          `	la	$25, {emit_symbol s}\n`;	(* Rxd: put before gp restore *)
-           if !uses_gp then
-             `	lw	$gp, {emit_int(n - 8)}($sp)\n`;
-           if n > 0 then
-             `	addu	$sp, $sp, {emit_int n}\n`;
--          `	la	$25, {emit_symbol s}\n`;
-           liveregs i live_25;
-           `	j	$25\n`
-         end
-@@ -305,8 +305,13 @@
-         begin match chunk with
-           Double_u ->
-             (* Destination is not 8-aligned, hence cannot use l.d *)
-+            if big_endian then begin
-             `	ldl	$24, {emit_addressing addr i.arg 0}\n`;
--            `	ldr	$24, {emit_addressing (offset_addressing addr 7) i.arg 0}\n`;
-+              `	ldr	$24, {emit_addressing (offset_addressing addr 7) i.arg 0}\n`
-+            end else begin
-+              `	ldl	$24, {emit_addressing (offset_addressing addr 7) i.arg 0}\n`;
-+              `	ldr	$24, {emit_addressing addr i.arg 0}\n`
-+            end;
-             `	dmtc1	$24, {emit_reg dest}\n`
-         | Single ->
-             `	l.s	{emit_reg dest}, {emit_addressing addr i.arg 0}\n`;
-@@ -328,8 +333,13 @@
-           Double_u ->
-             (* Destination is not 8-aligned, hence cannot use l.d *)
-             `	dmfc1	$24, {emit_reg src}\n`;
-+            if big_endian then begin
-             `	sdl	$24, {emit_addressing addr i.arg 1}\n`;
-             `	sdr	$24, {emit_addressing (offset_addressing addr 7) i.arg 1}\n`
-+            end else begin
-+              `	sdl	$24, {emit_addressing (offset_addressing addr 7) i.arg 1}\n`;
-+              `	sdr	$24, {emit_addressing addr i.arg 1}\n`
-+            end
-         | Single ->
-             `	cvt.s.d	$f31, {emit_reg src}\n`;
-             `	s.s	$f31, {emit_addressing addr i.arg 1}\n`
-@@ -552,6 +562,7 @@
-   (* There are really two groups of registers:
-       $sp and $30 always point to stack locations
-       $2 - $21 never point to stack locations. *)
-+  if Config.system = "irix" then begin
-   `	.noalias $2,$sp;  .noalias $2,$30;  .noalias $3,$sp;  .noalias $3,$30\n`;
-   `	.noalias $4,$sp;  .noalias $4,$30;  .noalias $5,$sp;  .noalias $5,$30\n`;
-   `	.noalias $6,$sp;  .noalias $6,$30;  .noalias $7,$sp;  .noalias $7,$30\n`;
-@@ -561,7 +572,8 @@
-   `	.noalias $14,$sp; .noalias $14,$30; .noalias $15,$sp; .noalias $15,$30\n`;
-   `	.noalias $16,$sp; .noalias $16,$30; .noalias $17,$sp; .noalias $17,$30\n`;
-   `	.noalias $18,$sp; .noalias $18,$30; .noalias $19,$sp; .noalias $19,$30\n`;
--  `	.noalias $20,$sp; .noalias $20,$30; .noalias $21,$sp; .noalias $21,$30\n\n`;
-+    `	.noalias $20,$sp; .noalias $20,$30; .noalias $21,$sp; .noalias $21,$30\n\n`
-+  end;
-   let lbl_begin = Compilenv.make_symbol (Some "data_begin") in
-   `	.data\n`;
-   `	.globl	{emit_symbol lbl_begin}\n`;
-diff -bur ocaml-3.11.1/asmrun/mips.s my_ocaml/asmrun/mips.s
---- asmrun/mips.s	2004-07-13 14:18:53.000000000 +0200
-+++ asmrun/mips.s	2009-08-20 09:34:36.000000000 +0200
-@@ -187,7 +187,7 @@
-         sw      $30, caml_exception_pointer
-     /* Call C function */
-         move    $25, $24
--        jal     $24
-+        jal     $25	/* Rxd: $24 replaced by $25 to avoid this "Warning: MIPS PIC call to register other than $25" ? */
-     /* Reload return address, alloc ptr, alloc limit */
-         lw      $31, 0($16)     /* caml_last_return_address */
-         lw      $22, 0($17)     /* caml_young_ptr */
-@@ -254,7 +254,7 @@
-         sw      $0, caml_last_return_address
-     /* Call the Caml code */
-         move    $25, $24
--        jal     $24
-+        jal     $25	/* Rxd: 24 replaced by 25 */
- $104:
-     /* Pop the trap frame, restoring caml_exception_pointer */
-         lw      $24, 0($sp)
-@@ -384,3 +384,8 @@
-         .word   $104            /* return address into callback */
-         .half   -1              /* negative frame size => use callback link */
-         .half   0               /* no roots here */
-+
-+#if defined(SYS_linux)
-+    /* Mark stack as non-executable, PR#4564 */
-+        .section .note.GNU-stack,"",%progbits
-+#endif
-diff -bur ocaml-3.11.1/configure my_ocaml/configure
---- configure	2009-05-20 17:33:09.000000000 +0200
-+++ configure	2009-08-23 10:55:44.000000000 +0200
-@@ -40,7 +40,7 @@
- verbose=no
- withcurses=yes
- withsharedlibs=yes
--gcc_warnings="-Wall"
-+gcc_warnings="-W -Wall"
- partialld="ld -r"
- 
- # Try to turn internationalization off, can cause config.guess to malfunction!
-@@ -292,6 +292,9 @@
-     # (For those who want to force "cc -64")
-     # Turn off warning "unused library"
-     bytecclinkopts="-Wl,-woff,84";;
-+  gcc*,mips64el-*)
-+    bytecccompopts=""
-+    bytecclinkopts="-fno-defer-pop $gcc_warnings -Wl,-O1 -Wl,--as-needed";;
-   *,alpha*-*-unicos*)
-     # For the Cray T3E
-     bytecccompopts="-DUMK";;
-@@ -468,6 +471,8 @@
-         echo "64-bit integers must be doubleword-aligned."
-         echo "#define ARCH_ALIGN_INT64" >> m.h
-       fi;;
-+    mips64el-*)
-+    	echo "#define ARCH_ALIGN_INT64" >> m.h;;
-     *)
-       sh ./runtest int64align.c
-       case $? in
-@@ -636,6 +641,7 @@
-                                 fi;;
-   i[3456]86-*-gnu*)             arch=i386; system=gnu;;
-   mips-*-irix6*)                arch=mips; system=irix;;
-+  mips*-gnu*)                   arch=mips; system=gnu;;
-   hppa1.1-*-hpux*)              arch=hppa; system=hpux;;
-   hppa2.0*-*-hpux*)             arch=hppa; system=hpux;;
-   hppa*-*-linux*)               arch=hppa; system=linux;;
-@@ -672,7 +678,7 @@
- if test -z "$ccoption"; then
-   case "$arch,$system,$cc" in
-     alpha,digital,gcc*) nativecc=cc;;
--    mips,*,gcc*) nativecc=cc;;
-+    mips,irix,gcc*) nativecc=cc;;
-     *) nativecc="$bytecc";;
-   esac
- else
-@@ -687,6 +693,9 @@
-   alpha,cc*,digital,*) nativecccompopts=-std1;;
-   mips,cc*,irix,*)     nativecccompopts=-n32
-                        nativecclinkopts="-n32 -Wl,-woff,84";;
-+  mips,gcc*,gnu,mips64el-*)
-+                       nativecccompopts="$gcc_warnings -fPIC"
-+                       nativecclinkopts="--as-needed";;
-   *,*,nextstep,*)      nativecccompopts="$gcc_warnings -U__GNUC__ -posix"
-                        nativecclinkopts="-posix";;
-   *,*,rhapsody,*darwin[1-5].*)
-@@ -725,6 +734,8 @@
-                     aspp='gcc -c -Wa,-xexplicit';;
-   mips,*,irix)      as='as -n32 -O2 -nocpp -g0'
-                     aspp='as -n32 -O2';;
-+  mips,*,gnu)       as='as -KPIC'
-+                    aspp='gcc -c -fPIC';;	# got bus error without fPIC ?
-   power,*,elf)      as='as -u -m ppc'
-                     aspp='gcc -c';;
-   power,*,bsd)      as='as'
-@@ -756,6 +767,7 @@
-     case "$nativecc" in gcc*) ;; *) cc_profile='-xpg';; esac;;
-   amd64,*,linux) profiling='prof';;
-   amd64,*,gnu) profiling='prof';;
-+  mips,*,gnu) profiling='prof';;
-   *) profiling='noprof';;
- esac
- 
-diff -bur ocaml-3.11.1/asmcomp/mips/proc.ml my_ocaml/asmcomp/mips/proc.ml
---- asmcomp/mips/proc.ml	2007-10-30 13:37:16.000000000 +0100
-+++ asmcomp/mips/proc.ml	2010-03-18 08:08:06.000000000 +0100
-@@ -114,7 +114,7 @@
-           incr int
-         end else begin
-           loc.(i) <- stack_slot (make_stack !ofs) ty;
--          ofs := !ofs + size_int
-+          ofs := !ofs + 8
-         end
-     | Float ->
-         if !float <= last_float then begin
-@@ -143,7 +143,7 @@
-    or float regs $f12...$f19.  Each argument "consumes" both one slot
-    in the int register file and one slot in the float register file.
-    Extra arguments are passed on stack, in a 64-bits slot, right-justified
--   (i.e. at +4 from natural address). *)   
-+   (i.e. at +4 from natural address for big endians). *)   
- 
- let loc_external_arguments arg =
-   let loc = Array.create (Array.length arg) Reg.dummy in
-@@ -158,7 +158,7 @@
-     end else begin
-       begin match arg.(i).typ with
-         Float -> loc.(i) <- stack_slot (Outgoing !ofs) Float
--      | ty    -> loc.(i) <- stack_slot (Outgoing (!ofs + 4)) ty
-+      | ty    -> loc.(i) <- stack_slot (Outgoing (!ofs + (if big_endian then 4 else 0))) ty
-       end;
-       ofs := !ofs + 8
-     end
- 
diff --git a/pkgs/development/compilers/opa/default.nix b/pkgs/development/compilers/opa/default.nix
index 8e70ca8dac256..5abab04205c69 100644
--- a/pkgs/development/compilers/opa/default.nix
+++ b/pkgs/development/compilers/opa/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     ocaml findlib ssl cryptokit camlzip ulex ocamlgraph camlp4
   ]);
 
-  NIX_LDFLAGS = lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
+  env.NIX_LDFLAGS = lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
 
   postInstall = ''
     # Have compiler use same tools for code generation as used to build it.
diff --git a/pkgs/development/compilers/openjdk/11.nix b/pkgs/development/compilers/openjdk/11.nix
index 15238e63ecbd8..b60f97aeb289a 100644
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@@ -65,9 +65,9 @@ let
 
     separateDebugInfo = true;
 
-    NIX_CFLAGS_COMPILE = "-Wno-error";
+    env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
-    NIX_LDFLAGS = toString (lib.optionals (!headless) [
+    env.NIX_LDFLAGS = toString (lib.optionals (!headless) [
       "-lfontconfig" "-lcups" "-lXinerama" "-lXrandr" "-lmagic"
     ] ++ lib.optionals (!headless && enableGnome2) [
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
diff --git a/pkgs/development/compilers/openjdk/15.nix b/pkgs/development/compilers/openjdk/15.nix
index 6430c9709362f..2d2caa3fd60ac 100644
--- a/pkgs/development/compilers/openjdk/15.nix
+++ b/pkgs/development/compilers/openjdk/15.nix
@@ -70,9 +70,9 @@ let
 
     separateDebugInfo = true;
 
-    NIX_CFLAGS_COMPILE = "-Wno-error";
+    env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
-    NIX_LDFLAGS = toString (lib.optionals (!headless) [
+    env.NIX_LDFLAGS = toString (lib.optionals (!headless) [
       "-lfontconfig" "-lcups" "-lXinerama" "-lXrandr" "-lmagic"
     ] ++ lib.optionals (!headless && enableGnome2) [
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
diff --git a/pkgs/development/compilers/openjdk/16.nix b/pkgs/development/compilers/openjdk/16.nix
index 9a710ed6fa46d..986320be4e785 100644
--- a/pkgs/development/compilers/openjdk/16.nix
+++ b/pkgs/development/compilers/openjdk/16.nix
@@ -76,9 +76,9 @@ let
 
     separateDebugInfo = true;
 
-    NIX_CFLAGS_COMPILE = "-Wno-error";
+    env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
-    NIX_LDFLAGS = toString (lib.optionals (!headless) [
+    env.NIX_LDFLAGS = toString (lib.optionals (!headless) [
       "-lfontconfig" "-lcups" "-lXinerama" "-lXrandr" "-lmagic"
     ] ++ lib.optionals (!headless && enableGnome2) [
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
diff --git a/pkgs/development/compilers/openjdk/8.nix b/pkgs/development/compilers/openjdk/8.nix
index f10b7310df139..fd474ebb91414 100644
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@@ -135,7 +135,7 @@ let
 
     separateDebugInfo = true;
 
-    NIX_CFLAGS_COMPILE = toString ([
+    env.NIX_CFLAGS_COMPILE = toString ([
       # glibc 2.24 deprecated readdir_r so we need this
       # See https://www.mail-archive.com/openembedded-devel@lists.openembedded.org/msg49006.html
       "-Wno-error=deprecated-declarations"
@@ -148,7 +148,7 @@ let
       "-Wno-error"
     ]);
 
-    NIX_LDFLAGS= toString (lib.optionals (!headless) [
+    env.NIX_LDFLAGS= toString (lib.optionals (!headless) [
       "-lfontconfig" "-lcups" "-lXinerama" "-lXrandr" "-lmagic"
     ] ++ lib.optionals (!headless && enableGnome2) [
       "-lgtk-x11-2.0" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
diff --git a/pkgs/development/compilers/openjdk/openjfx/11.nix b/pkgs/development/compilers/openjdk/openjfx/11.nix
index 306130a0991cc..6da35d3b06809 100644
--- a/pkgs/development/compilers/openjdk/openjfx/11.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/11.nix
@@ -11,7 +11,7 @@ let
     java = openjdk11-bootstrap;
   }).gradle_4_10;
 
-  makePackage = args: stdenv.mkDerivation ({
+  makePackage = args: stdenv.mkDerivation (lib.recursiveUpdate {
     version = "${major}${update}-${build}";
 
     src = fetchurl {
@@ -30,7 +30,7 @@ let
     '' + args.gradleProperties or "");
 
     #avoids errors about deprecation of GTypeDebugFlags, GTimeVal, etc.
-    NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+    env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
     buildPhase = ''
       runHook preBuild
@@ -42,7 +42,7 @@ let
 
       runHook postBuild
     '';
-  } // args);
+  } args);
 
   # Fake build to pre-download deps into fixed-output derivation.
   # We run nearly full build because I see no other way to download everything that's needed.
@@ -87,7 +87,7 @@ in makePackage {
   '';
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   stripDebugList = [ "." ];
 
diff --git a/pkgs/development/compilers/openjdk/openjfx/15.nix b/pkgs/development/compilers/openjdk/openjfx/15.nix
index e5da2bc3fe053..973808354c856 100644
--- a/pkgs/development/compilers/openjdk/openjfx/15.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/15.nix
@@ -31,8 +31,8 @@ let
       JDK_HOME = ${openjdk11_headless.home}
     '' + args.gradleProperties or "");
 
-    #avoids errors about deprecation of GTypeDebugFlags, GTimeVal, etc.
-    NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+    # avoids errors about deprecation of GTypeDebugFlags, GTimeVal, etc.
+    env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
     buildPhase = ''
       runHook preBuild
@@ -89,7 +89,7 @@ in makePackage {
   '';
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   stripDebugList = [ "." ];
 
diff --git a/pkgs/development/compilers/ponyc/default.nix b/pkgs/development/compilers/ponyc/default.nix
index 9fc8188daa101..16c964d7b04fb 100644
--- a/pkgs/development/compilers/ponyc/default.nix
+++ b/pkgs/development/compilers/ponyc/default.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation (rec {
 
   doCheck = true;
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=redundant-move" "-Wno-error=implicit-fallthrough" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=redundant-move -Wno-error=implicit-fallthrough";
 
   installPhase = "make config=release prefix=$out "
     + lib.optionalString stdenv.isDarwin "bits=64 "
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index 3a7f29e322939..dc50f58d6637d 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -20,12 +20,14 @@ rustPlatform.buildRustPackage {
   buildInputs = [ cacert file curl python3 openssl zlib ]
     ++ lib.optionals stdenv.isDarwin [ CoreFoundation Security libiconv ];
 
-  # cargo uses git-rs which is made for a version of libgit2 from recent master that
-  # is not compatible with the current version in nixpkgs.
-  #LIBGIT2_SYS_USE_PKG_CONFIG = 1;
+  env = {
+    # cargo uses git-rs which is made for a version of libgit2 from recent master that
+    # is not compatible with the current version in nixpkgs.
+    #LIBGIT2_SYS_USE_PKG_CONFIG = 1;
 
-  # fixes: the cargo feature `edition` requires a nightly version of Cargo, but this is the `stable` channel
-  RUSTC_BOOTSTRAP = 1;
+    # fixes: the cargo feature `edition` requires a nightly version of Cargo, but this is the `stable` channel
+    RUSTC_BOOTSTRAP = 1;
+  };
 
   postInstall = ''
     # NOTE: We override the `http.cainfo` option usually specified in
diff --git a/pkgs/development/compilers/rust/clippy.nix b/pkgs/development/compilers/rust/clippy.nix
index a3597e9febf77..34bd936eb1183 100644
--- a/pkgs/development/compilers/rust/clippy.nix
+++ b/pkgs/development/compilers/rust/clippy.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage {
   buildInputs = [ rustc rustc.llvm ] ++ lib.optionals stdenv.isDarwin [ Security ];
 
   # fixes: error: the option `Z` is only accepted on the nightly compiler
-  RUSTC_BOOTSTRAP = 1;
+  env.RUSTC_BOOTSTRAP = 1;
 
   # Without disabling the test the build fails with:
   # error: failed to run custom build command for `rustc_llvm v0.0.0
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index b9bccf9f16e91..a89fe299d7017 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -37,14 +37,14 @@ in stdenv.mkDerivation rec {
   # See: https://github.com/NixOS/nixpkgs/pull/56540#issuecomment-471624656
   stripDebugList = [ "bin" ];
 
-  NIX_LDFLAGS = toString (
+  env.NIX_LDFLAGS = toString (
        # when linking stage1 libstd: cc: undefined reference to `__cxa_begin_catch'
        optional (stdenv.isLinux && !withBundledLLVM) "--push-state --as-needed -lstdc++ --pop-state"
     ++ optional (stdenv.isDarwin && !withBundledLLVM) "-lc++"
     ++ optional stdenv.isDarwin "-rpath ${llvmSharedForHost}/lib");
 
   # Increase codegen units to introduce parallelism within the compiler.
-  RUSTFLAGS = "-Ccodegen-units=10";
+  env.RUSTFLAGS = "-Ccodegen-units=10";
 
   # We need rust to build rust. If we don't provide it, configure will try to download it.
   # Reference: https://github.com/rust-lang/rust/blob/master/src/bootstrap/configure.py
diff --git a/pkgs/development/compilers/rust/rustfmt.nix b/pkgs/development/compilers/rust/rustfmt.nix
index b3191c242feab..4370e3f8bf405 100644
--- a/pkgs/development/compilers/rust/rustfmt.nix
+++ b/pkgs/development/compilers/rust/rustfmt.nix
@@ -14,12 +14,12 @@ rustPlatform.buildRustPackage rec {
   buildInputs = lib.optional stdenv.isDarwin Security;
 
   # As of 1.0.0 and rustc 1.30 rustfmt requires a nightly compiler
-  RUSTC_BOOTSTRAP = 1;
+  env.RUSTC_BOOTSTRAP = 1;
 
   # As of rustc 1.45.0, these env vars are required to build rustfmt (due to
   # https://github.com/rust-lang/rust/pull/72001)
-  CFG_RELEASE = "${rustPlatform.rust.rustc.version}-nightly";
-  CFG_RELEASE_CHANNEL = "nightly";
+  env.CFG_RELEASE = "${rustPlatform.rust.rustc.version}-nightly";
+  env.CFG_RELEASE_CHANNEL = "nightly";
 
   meta = with lib; {
     description = "A tool for formatting Rust code according to style guidelines";
diff --git a/pkgs/development/compilers/smlnj/default.nix b/pkgs/development/compilers/smlnj/default.nix
index 3e987e8ccdafc..3cb1daa878e2d 100644
--- a/pkgs/development/compilers/smlnj/default.nix
+++ b/pkgs/development/compilers/smlnj/default.nix
@@ -56,7 +56,7 @@ in stdenv.mkDerivation {
   '';
 
   unpackPhase = ''
-    for s in $sources; do
+    for s in "''${sources[@]}"; do
       b=$(basename $s)
       cp $s ''${b#*-}
     done
diff --git a/pkgs/development/compilers/swift/default.nix b/pkgs/development/compilers/swift/default.nix
index 5301156026736..b1e6bb3f999b9 100644
--- a/pkgs/development/compilers/swift/default.nix
+++ b/pkgs/development/compilers/swift/default.nix
@@ -298,7 +298,8 @@ stdenv.mkDerivation {
     export LIBRARY_PATH=${icu}/lib:${libuuid.out}/lib
 
     checkTarget=check-swift-all
-    ninjaFlags='-C buildbot_linux/swift-${stdenv.hostPlatform.parsed.kernel.name}-${stdenv.hostPlatform.parsed.cpu.name}'
+    ninjaFlags=('-C' 'buildbot_linux/swift-${stdenv.hostPlatform.parsed.kernel.name}-${stdenv.hostPlatform.parsed.cpu.name}')
+
     ninjaCheckPhase
   '';
 
diff --git a/pkgs/development/compilers/yap/default.nix b/pkgs/development/compilers/yap/default.nix
index da10125c24337..6a31c106658a8 100644
--- a/pkgs/development/compilers/yap/default.nix
+++ b/pkgs/development/compilers/yap/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-tabling=yes" ];
 
-  NIX_CFLAGS_COMPILE = "-fpermissive";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
 
   meta = {
     homepage = "http://www.dcc.fc.up.pt/~vsc/Yap/";
diff --git a/pkgs/development/compilers/z88dk/default.nix b/pkgs/development/compilers/z88dk/default.nix
index b825af6a202e2..324690b1d6e69 100644
--- a/pkgs/development/compilers/z88dk/default.nix
+++ b/pkgs/development/compilers/z88dk/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   doCheck = stdenv.hostPlatform.system != "aarch64-linux";
 
   #_FORTIFY_SOURCE requires compiling with optimization (-O)
-  NIX_CFLAGS_COMPILE = "-O";
+  env.NIX_CFLAGS_COMPILE = "-O";
 
   short_rev = builtins.substring 0 7 src.rev;
   makeFlags = [
diff --git a/pkgs/development/coq-modules/metalib/default.nix b/pkgs/development/coq-modules/metalib/default.nix
index 14f1bab574ad4..3d78a8c1d05c7 100644
--- a/pkgs/development/coq-modules/metalib/default.nix
+++ b/pkgs/development/coq-modules/metalib/default.nix
@@ -9,7 +9,7 @@ with lib; mkCoqDerivation {
   release."20200527".sha256 = "0wbypc05d2lqfm9qaw98ynr5yc1p0ipsvyc3bh1rk9nz7zwirmjs";
 
   sourceRoot = "source/Metalib";
-  installFlags = "COQMF_COQLIB=$(out)/lib/coq/${coq.coq-version}";
+  installFlags = [ "COQMF_COQLIB=$(out)/lib/coq/${coq.coq-version}" ];
 
   meta = {
     license = licenses.mit;
diff --git a/pkgs/development/gnuradio-modules/osmosdr/default.nix b/pkgs/development/gnuradio-modules/osmosdr/default.nix
index 0e1cf244c8fce..635974edc1208 100644
--- a/pkgs/development/gnuradio-modules/osmosdr/default.nix
+++ b/pkgs/development/gnuradio-modules/osmosdr/default.nix
@@ -52,7 +52,7 @@ in mkDerivation {
     libbladeRF
     rtl-sdr
     soapysdr-with-plugins
-  ] ++ lib.optional (gnuradio.hasFeature "gr-uhd" gnuradio.features) [
+  ] ++ lib.optionals (gnuradio.hasFeature "gr-uhd" gnuradio.features) [
     uhd
   ];
   cmakeFlags = [
diff --git a/pkgs/development/go-modules/generic/default.nix b/pkgs/development/go-modules/generic/default.nix
index 8246eaefed4c3..3653e1b23e210 100644
--- a/pkgs/development/go-modules/generic/default.nix
+++ b/pkgs/development/go-modules/generic/default.nix
@@ -52,14 +52,15 @@ let
     nativeBuildInputs = (args.nativeBuildInputs or []) ++ [ go git cacert ];
 
     inherit (args) src;
-    inherit (go) GOOS GOARCH;
+    env = {
+      inherit (go.env) GOOS GOARCH;
+      GO111MODULE = "on";
+    } // (args.env or {});
 
     patches = args.patches or [];
     preBuild = args.preBuild or "";
     sourceRoot = args.sourceRoot or "";
 
-    GO111MODULE = "on";
-
     impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
       "GIT_PROXY_COMMAND" "SOCKS_SERVER"
     ];
@@ -110,21 +111,20 @@ let
     '';
 
     dontFixup = true;
-  }; in modArgs // (
-      {
+  }; in lib.recursiveUpdate (modArgs // {
         outputHashMode = "recursive";
         outputHashAlgo = "sha256";
         outputHash = vendorSha256;
-      }
-  ) // overrideModAttrs modArgs) else "";
+      }) (overrideModAttrs modArgs)) else "";
 
   package = stdenv.mkDerivation (args // {
     nativeBuildInputs = [ go ] ++ nativeBuildInputs;
 
-    inherit (go) GOOS GOARCH;
-
-    GO111MODULE = "on";
-    GOFLAGS = [ "-mod=vendor" ] ++ lib.optionals (!allowGoReference) [ "-trimpath" ];
+    env = {
+      inherit (go.env) GOOS GOARCH;
+      GO111MODULE = "on";
+      GOFLAGS = "-mod=vendor" + lib.optionalString (!allowGoReference) " -trimpath";
+    } // (args.env or {});
 
     configurePhase = args.configurePhase or ''
       runHook preConfigure
@@ -153,7 +153,7 @@ let
         echo "$d" | grep -q "\(/_\|examples\|Godeps\|testdata\)" && return 0
         [ -n "$excludedPackages" ] && echo "$d" | grep -q "$excludedPackages" && return 0
         local OUT
-        if ! OUT="$(go $cmd $buildFlags "''${buildFlagsArray[@]}" -v -p $NIX_BUILD_CORES $d 2>&1)"; then
+        if ! OUT="$(go $cmd "''${buildFlags[@]}" "''${buildFlagsArray[@]}" -v -p $NIX_BUILD_CORES $d 2>&1)"; then
           if ! echo "$OUT" | grep -qE '(no( buildable| non-test)?|build constraints exclude all) Go (source )?files'; then
             echo "$OUT" >&2
             return 1
@@ -168,8 +168,8 @@ let
       getGoDirs() {
         local type;
         type="$1"
-        if [ -n "$subPackages" ]; then
-          echo "$subPackages" | sed "s,\(^\| \),\1./,g"
+        if [ ''${#subPackages[@]} -gt 0 ]; then
+          echo "''${subPackages[@]}" | sed "s,\(^\| \),\1./,g"
         else
           find . -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort --unique
         fi
diff --git a/pkgs/development/go-packages/generic/default.nix b/pkgs/development/go-packages/generic/default.nix
index 8a093a03d1c1d..4cfb067be23c9 100644
--- a/pkgs/development/go-packages/generic/default.nix
+++ b/pkgs/development/go-packages/generic/default.nix
@@ -35,7 +35,7 @@
 # IE: programs coupled with the compiler
 , allowGoReference ? false
 
-, CGO_ENABLED ? go.CGO_ENABLED
+, CGO_ENABLED ? go.env.CGO_ENABLED
 
 , meta ? {}, ... } @ args:
 
@@ -77,17 +77,19 @@ let
       ++ (lib.optional (!dontRenameImports) govers) ++ nativeBuildInputs;
     buildInputs = buildInputs;
 
-    inherit (go) GOOS GOARCH GO386;
+    env = {
+      inherit (go.env) GOOS GOARCH GO386;
 
-    GOHOSTARCH = go.GOHOSTARCH or null;
-    GOHOSTOS = go.GOHOSTOS or null;
+      GOHOSTARCH = go.env.GOHOSTARCH or null;
+      GOHOSTOS = go.env.GOHOSTOS or null;
 
-    inherit CGO_ENABLED;
+      inherit CGO_ENABLED;
 
-    GO111MODULE = "off";
-    GOFLAGS = lib.optionals (!allowGoReference) [ "-trimpath" ];
+      GO111MODULE = "off";
+      GOFLAGS = lib.optionalString (!allowGoReference) "-trimpath";
 
-    GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
+      GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
+    };
 
     configurePhase = args.configurePhase or ''
       runHook preConfigure
@@ -163,8 +165,8 @@ let
       getGoDirs() {
         local type;
         type="$1"
-        if [ -n "$subPackages" ]; then
-          echo "$subPackages" | sed "s,\(^\| \),\1$goPackagePath/,g"
+        if [ ''${#subPackages[@]} -gt 0 ]; then
+          echo "''${subPackages[@]}" | sed "s,\(^\| \),\1$goPackagePath/,g"
         else
           pushd "$NIX_BUILD_TOP/go/src" >/dev/null
           find "$goPackagePath" -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort | uniq
diff --git a/pkgs/development/guile-modules/guile-ncurses/default.nix b/pkgs/development/guile-modules/guile-ncurses/default.nix
index 1e6418b0c3c71..f4542f3dfe771 100644
--- a/pkgs/development/guile-modules/guile-ncurses/default.nix
+++ b/pkgs/development/guile-modules/guile-ncurses/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   ];
 
   preConfigure = ''
-    configureFlags="$configureFlags --with-guilesitedir=$out/share/guile/site"
+    configureFlags+=("--with-guilesitedir=$out/share/guile/site")
   '';
 
   postFixup = ''
diff --git a/pkgs/development/haskell-modules/generic-builder.nix b/pkgs/development/haskell-modules/generic-builder.nix
index 2f9127e30f3b3..a7385d5812387 100644
--- a/pkgs/development/haskell-modules/generic-builder.nix
+++ b/pkgs/development/haskell-modules/generic-builder.nix
@@ -309,7 +309,8 @@ stdenv.mkDerivation ({
   buildInputs = otherBuildInputs ++ optionals (!isLibrary) propagatedBuildInputs;
   propagatedBuildInputs = optionals isLibrary propagatedBuildInputs;
 
-  LANG = "en_US.UTF-8";         # GHC needs the locale configured during the Haddock phase.
+  env.LANG = "en_US.UTF-8";         # GHC needs the locale configured during the Haddock phase.
+  env.LOCALE_ARCHIVE = optionalString (stdenv.buildPlatform.libc == "glibc") "${glibcLocales}/lib/locale/locale-archive";
 
   prePatch = optionalString (editedCabalFile != null) ''
     echo "Replace Cabal file with edited version from ${newCabalFileUrl}."
@@ -334,7 +335,7 @@ stdenv.mkDerivation ({
     mkdir -p $packageConfDir
 
     setupCompileFlags="${concatStringsSep " " setupCompileFlags}"
-    configureFlags="${concatStringsSep " " defaultConfigureFlags} $configureFlags"
+    configureFlags=(${concatStringsSep " " defaultConfigureFlags} "''${configureFlags[@]}")
   ''
   # We build the Setup.hs on the *build* machine, and as such should only add
   # dependencies for the build machine.
@@ -351,16 +352,16 @@ stdenv.mkDerivation ({
     for p in "''${pkgsHostHost[@]}" "''${pkgsHostTarget[@]}"; do
       ${buildPkgDb ghc.name "$packageConfDir"}
       if [ -d "$p/include" ]; then
-        configureFlags+=" --extra-include-dirs=$p/include"
+        configureFlags+=("--extra-include-dirs=$p/include")
       fi
       if [ -d "$p/lib" ]; then
-        configureFlags+=" --extra-lib-dirs=$p/lib"
+        configureFlags+=("--extra-lib-dirs=$p/lib")
       fi
     ''
     # It is not clear why --extra-framework-dirs does work fine on Linux
     + optionalString (!stdenv.buildPlatform.isDarwin || versionAtLeast nativeGhc.version "8.0") ''
       if [[ -d "$p/Library/Frameworks" ]]; then
-        configureFlags+=" --extra-framework-dirs=$p/Library/Frameworks"
+        configureFlags+=("--extra-framework-dirs=$p/Library/Frameworks")
       fi
   '' + ''
     done
@@ -422,8 +423,8 @@ stdenv.mkDerivation ({
 
     unset GHC_PACKAGE_PATH      # Cabal complains if this variable is set during configure.
 
-    echo configureFlags: $configureFlags
-    ${setupCommand} configure $configureFlags 2>&1 | ${coreutils}/bin/tee "$NIX_BUILD_TOP/cabal-configure.log"
+    echo configureFlags: "''${configureFlags[@]}"
+    ${setupCommand} configure "''${configureFlags[@]}" 2>&1 | ${coreutils}/bin/tee "$NIX_BUILD_TOP/cabal-configure.log"
     ${lib.optionalString (!allowInconsistentDependencies) ''
       if ${gnugrep}/bin/egrep -q -z 'Warning:.*depends on multiple versions' "$NIX_BUILD_TOP/cabal-configure.log"; then
         echo >&2 "*** abort because of serious configure-time warning from Cabal"
@@ -620,21 +621,24 @@ stdenv.mkDerivation ({
       in stdenv.mkDerivation ({
         inherit name shellHook;
 
+        dontUnpack = true;
+
         depsBuildBuild = lib.optional isCross ghcEnvForBuild;
         nativeBuildInputs =
           [ ghcEnv ] ++ optional (allPkgconfigDepends != []) pkg-config ++
           collectedToolDepends;
         buildInputs =
           otherBuildInputsSystem;
-        phases = ["installPhase"];
-        installPhase = "echo $nativeBuildInputs $buildInputs > $out";
-        LANG = "en_US.UTF-8";
-        LOCALE_ARCHIVE = lib.optionalString (stdenv.hostPlatform.libc == "glibc") "${buildPackages.glibcLocales}/lib/locale/locale-archive";
-        "NIX_${ghcCommandCaps}" = "${ghcEnv}/bin/${ghcCommand}";
-        "NIX_${ghcCommandCaps}PKG" = "${ghcEnv}/bin/${ghcCommand}-pkg";
+        installPhase = ''
+          echo "''${nativeBuildInputs[@]}" "''${buildInputs[@]}" > $out
+        '';
+        env.LANG = "en_US.UTF-8";
+        env.LOCALE_ARCHIVE = lib.optionalString (stdenv.hostPlatform.libc == "glibc") "${buildPackages.glibcLocales}/lib/locale/locale-archive";
+        env."NIX_${ghcCommandCaps}" = "${ghcEnv}/bin/${ghcCommand}";
+        env."NIX_${ghcCommandCaps}PKG" = "${ghcEnv}/bin/${ghcCommand}-pkg";
         # TODO: is this still valid?
-        "NIX_${ghcCommandCaps}_DOCDIR" = "${ghcEnv}/share/doc/ghc/html";
-        "NIX_${ghcCommandCaps}_LIBDIR" = if ghc.isHaLVM or false
+        env."NIX_${ghcCommandCaps}_DOCDIR" = "${ghcEnv}/share/doc/ghc/html";
+        env."NIX_${ghcCommandCaps}_LIBDIR" = if ghc.isHaLVM or false
           then "${ghcEnv}/lib/HaLVM-${ghc.version}"
           else "${ghcEnv}/lib/${ghcCommand}-${ghc.version}";
       });
@@ -675,6 +679,5 @@ stdenv.mkDerivation ({
 // optionalAttrs (args ? postFixup)              { inherit postFixup; }
 // optionalAttrs (args ? dontStrip)              { inherit dontStrip; }
 // optionalAttrs (args ? hardeningDisable)       { inherit hardeningDisable; }
-// optionalAttrs (stdenv.buildPlatform.libc == "glibc"){ LOCALE_ARCHIVE = "${glibcLocales}/lib/locale/locale-archive"; }
 )
 )
diff --git a/pkgs/development/haskell-modules/hoogle.nix b/pkgs/development/haskell-modules/hoogle.nix
index cfa06b045de23..88a64f83848bf 100644
--- a/pkgs/development/haskell-modules/hoogle.nix
+++ b/pkgs/development/haskell-modules/hoogle.nix
@@ -60,9 +60,11 @@ buildPackages.stdenv.mkDerivation {
 
   inherit docPackages;
 
-  passAsFile = ["buildCommand"];
-
   buildCommand = ''
+    source <(${buildPackages.jq}/bin/jq -r <.attrs.json '.buildScript')
+  '';
+
+  buildScript = ''
     ${lib.optionalString (packages != [] -> docPackages == [])
        ("echo WARNING: localHoogle package list empty, even though"
        + " the following were specified: "
diff --git a/pkgs/development/interpreters/acl2/default.nix b/pkgs/development/interpreters/acl2/default.nix
index c089916158bdc..30d2b40e02c91 100644
--- a/pkgs/development/interpreters/acl2/default.nix
+++ b/pkgs/development/interpreters/acl2/default.nix
@@ -71,7 +71,7 @@ in stdenv.mkDerivation rec {
   '';
 
   preBuild = "mkdir -p $HOME";
-  makeFlags="LISP=${sbcl}/bin/sbcl";
+  makeFlags = [ "LISP=${sbcl}/bin/sbcl" ];
 
   doCheck = true;
   checkTarget = "mini-proveall";
diff --git a/pkgs/development/interpreters/clips/default.nix b/pkgs/development/interpreters/clips/default.nix
index 64fd89008e335..cf7b9bda7f6bb 100644
--- a/pkgs/development/interpreters/clips/default.nix
+++ b/pkgs/development/interpreters/clips/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     substituteInPlace core/makefile --replace 'gcc' '${stdenv.cc.targetPrefix}cc'
   '';
 
-  makeFlags = [ "-C" "core" ];
+  makeFlags = [ "-C core" ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/development/interpreters/clisp/default.nix b/pkgs/development/interpreters/clisp/default.nix
index 566d16179b578..d0814a7aeef5e 100644
--- a/pkgs/development/interpreters/clisp/default.nix
+++ b/pkgs/development/interpreters/clisp/default.nix
@@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
       (''./clisp-link add "$out"/lib/clisp*/base "$(dirname "$out"/lib/clisp*/base)"/full''
       + lib.concatMapStrings (x: " " + x) withModules);
 
-  NIX_CFLAGS_COMPILE = "-O0 ${lib.optionalString (!stdenv.is64bit) "-falign-functions=4"}";
+  env.NIX_CFLAGS_COMPILE = "-O0 ${lib.optionalString (!stdenv.is64bit) "-falign-functions=4"}";
 
   # TODO : make mod-check fails
   doCheck = false;
diff --git a/pkgs/development/interpreters/clisp/hg.nix b/pkgs/development/interpreters/clisp/hg.nix
index 83a1870d182b7..40cedf5661c2e 100644
--- a/pkgs/development/interpreters/clisp/hg.nix
+++ b/pkgs/development/interpreters/clisp/hg.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation rec {
       (''./clisp-link add "$out"/lib/clisp*/base "$(dirname "$out"/lib/clisp*/base)"/full''
       + lib.concatMapStrings (x: " " + x) withModules);
 
-  NIX_CFLAGS_COMPILE = "-O0 ${lib.optionalString (!stdenv.is64bit) "-falign-functions=4"}";
+  env.NIX_CFLAGS_COMPILE = "-O0 ${lib.optionalString (!stdenv.is64bit) "-falign-functions=4"}";
 
   # TODO : make mod-check fails
   doCheck = false;
diff --git a/pkgs/development/interpreters/dhall/build-dhall-package.nix b/pkgs/development/interpreters/dhall/build-dhall-package.nix
index 9fc9a44121560..4461b3c775be3 100644
--- a/pkgs/development/interpreters/dhall/build-dhall-package.nix
+++ b/pkgs/development/interpreters/dhall/build-dhall-package.nix
@@ -62,7 +62,7 @@ in
 
     mkdir -p ${cacheDhall}
 
-    for dependency in $dependencies; do
+    for dependency in "''${dependencies[@]}"; do
       ${lndir}/bin/lndir -silent $dependency/${cacheDhall} ${cacheDhall}
     done
 
diff --git a/pkgs/development/interpreters/gnu-apl/default.nix b/pkgs/development/interpreters/gnu-apl/default.nix
index abfa74bb67d36..c4a9f5aeb0c39 100644
--- a/pkgs/development/interpreters/gnu-apl/default.nix
+++ b/pkgs/development/interpreters/gnu-apl/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ readline gettext ncurses ];
 
   # Needed with GCC 8
-  NIX_CFLAGS_COMPILE = with lib; toString ((optionals stdenv.cc.isGNU [
+  env.NIX_CFLAGS_COMPILE = with lib; toString ((optionals stdenv.cc.isGNU [
     "-Wno-error=int-in-bool-context"
     "-Wno-error=class-memaccess"
     "-Wno-error=restrict"
diff --git a/pkgs/development/interpreters/guile/2.0.nix b/pkgs/development/interpreters/guile/2.0.nix
index b93ec556cd436..c0ae8bc92a964 100644
--- a/pkgs/development/interpreters/guile/2.0.nix
+++ b/pkgs/development/interpreters/guile/2.0.nix
@@ -59,7 +59,7 @@
   # "libgcc_s.so.1 must be installed for pthread_cancel to work".
 
   # don't have "libgcc_s.so.1" on darwin
-  LDFLAGS = lib.optionalString (!stdenv.isDarwin && !stdenv.hostPlatform.isMusl) "-lgcc_s";
+  env.LDFLAGS = lib.optionalString (!stdenv.isDarwin && !stdenv.hostPlatform.isMusl) "-lgcc_s";
 
   configureFlags = [ "--with-libreadline-prefix" ]
     ++ lib.optionals stdenv.isSunOS [
diff --git a/pkgs/development/interpreters/guile/default.nix b/pkgs/development/interpreters/guile/default.nix
index ed685682db66d..37cc98c317f67 100644
--- a/pkgs/development/interpreters/guile/default.nix
+++ b/pkgs/development/interpreters/guile/default.nix
@@ -58,7 +58,7 @@
   # "libgcc_s.so.1 must be installed for pthread_cancel to work".
 
   # don't have "libgcc_s.so.1" on darwin
-  LDFLAGS = lib.optionalString
+  env.LDFLAGS = lib.optionalString
     (!stdenv.isDarwin && !stdenv.hostPlatform.isStatic) "-lgcc_s";
 
   configureFlags = [ "--with-libreadline-prefix=${readline.dev}" ]
diff --git a/pkgs/development/interpreters/io/default.nix b/pkgs/development/interpreters/io/default.nix
index 48462a333bcb3..47543b45a12b8 100644
--- a/pkgs/development/interpreters/io/default.nix
+++ b/pkgs/development/interpreters/io/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation {
   '';
 
   # for gcc5; c11 inline semantics breaks the build
-  NIX_CFLAGS_COMPILE = "-fgnu89-inline";
+  env.NIX_CFLAGS_COMPILE = "-fgnu89-inline";
 
   meta = with lib; {
     description = "Io programming language";
diff --git a/pkgs/development/interpreters/j/default.nix b/pkgs/development/interpreters/j/default.nix
index e41d71ef960b8..f452c94b2c32f 100644
--- a/pkgs/development/interpreters/j/default.nix
+++ b/pkgs/development/interpreters/j/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   # Causes build failure due to warning
   # https://github.com/jsoftware/jsource/issues/16
-  NIX_CFLAGS_COMPILE = "-Wno-error=return-local-addr";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=return-local-addr";
 
   buildPhase = ''
     export SOURCE_DIR=$(pwd)
diff --git a/pkgs/development/interpreters/jimtcl/default.nix b/pkgs/development/interpreters/jimtcl/default.nix
index 78b9e40b64709..0df71ffa8e3e3 100644
--- a/pkgs/development/interpreters/jimtcl/default.nix
+++ b/pkgs/development/interpreters/jimtcl/default.nix
@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
     "--ipv6"
   ];
 
-  NIX_CFLAGS_COMPILE = toString (makeSDLFlags [ SDL SDL_gfx ]);
+  env.NIX_CFLAGS_COMPILE = toString (makeSDLFlags [ SDL SDL_gfx ]);
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/interpreters/love/0.10.nix b/pkgs/development/interpreters/love/0.10.nix
index ed002d99fbbe2..43b974b7338a2 100644
--- a/pkgs/development/interpreters/love/0.10.nix
+++ b/pkgs/development/interpreters/love/0.10.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
     "--with-lua=luajit"
   ];
 
-  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
+  env.NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
 
   meta = {
     homepage = "http://love2d.org";
diff --git a/pkgs/development/interpreters/love/0.7.nix b/pkgs/development/interpreters/love/0.7.nix
index 6cba19bff0f16..9f3ffbbfcc25e 100644
--- a/pkgs/development/interpreters/love/0.7.nix
+++ b/pkgs/development/interpreters/love/0.7.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     } || true
   '';
 
-  NIX_CFLAGS_COMPILE = ''
+  env.NIX_CFLAGS_COMPILE = ''
     -I${SDL.dev}/include/SDL
     -I${freetype.dev}include/freetype2
   '';
diff --git a/pkgs/development/interpreters/love/0.8.nix b/pkgs/development/interpreters/love/0.8.nix
index 8bad501170dbd..27dc0bb5d0c3f 100644
--- a/pkgs/development/interpreters/love/0.8.nix
+++ b/pkgs/development/interpreters/love/0.8.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     } || true
   '';
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-I${SDL.dev}/include/SDL"
     "-I${freetype.dev}include/freetype2"
     "-DGL_GLEXT_PROTOTYPES" # https://community.khronos.org/t/glgenbuffers-was-not-declared-in-this-scope/59283/2
diff --git a/pkgs/development/interpreters/love/0.9.nix b/pkgs/development/interpreters/love/0.9.nix
index b7e20498a39c3..0eeace190fffa 100644
--- a/pkgs/development/interpreters/love/0.9.nix
+++ b/pkgs/development/interpreters/love/0.9.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     "--with-lua=luajit"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-DluaL_reg=luaL_Reg" ]; # needed since luajit-2.1.0-beta3
+  env.NIX_CFLAGS_COMPILE = [ "-DluaL_reg=luaL_Reg" ]; # needed since luajit-2.1.0-beta3
 
   meta = {
     homepage = "http://love2d.org";
diff --git a/pkgs/development/interpreters/love/11.1.nix b/pkgs/development/interpreters/love/11.1.nix
index bf76547a07a73..1833cd67761de 100644
--- a/pkgs/development/interpreters/love/11.1.nix
+++ b/pkgs/development/interpreters/love/11.1.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
     "--with-lua=luajit"
   ];
 
-  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
+  env.NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
 
   meta = {
     homepage = "http://love2d.org";
diff --git a/pkgs/development/interpreters/luajit/default.nix b/pkgs/development/interpreters/luajit/default.nix
index 860642b0fd2f1..3cd900211b18b 100644
--- a/pkgs/development/interpreters/luajit/default.nix
+++ b/pkgs/development/interpreters/luajit/default.nix
@@ -26,7 +26,7 @@ assert enableValgrindSupport -> valgrind != null;
 let
   luaPackages = callPackage ../../lua-modules {lua=self; overrides=packageOverrides;};
 
-  XCFLAGS = with lib;
+  XCFLAGS = with lib; toString (
      optional (!enableFFI) "-DLUAJIT_DISABLE_FFI"
   ++ optional (!enableJIT) "-DLUAJIT_DISABLE_JIT"
   ++ optional enable52Compat "-DLUAJIT_ENABLE_LUA52COMPAT"
@@ -36,7 +36,7 @@ let
   ++ optional enableGDBJITSupport "-DLUAJIT_USE_GDBJIT"
   ++ optional enableAPICheck "-DLUAJIT_USE_APICHECK"
   ++ optional enableVMAssertions "-DLUAJIT_USE_ASSERT"
-  ;
+  );
 in
 stdenv.mkDerivation rec {
   inherit name version;
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
     "HOST_CC=${buildPackages.stdenv.cc}/bin/cc"
   ] ++ lib.optional enableJITDebugModule "INSTALL_LJLIBD=$(INSTALL_LMOD)";
   enableParallelBuilding = true;
-  NIX_CFLAGS_COMPILE = XCFLAGS;
+  env.NIX_CFLAGS_COMPILE = XCFLAGS;
 
   postInstall = ''
     ( cd "$out/include"; ln -s luajit-*/* . )
diff --git a/pkgs/development/interpreters/lush/default.nix b/pkgs/development/interpreters/lush/default.nix
index fe51d154956a1..193837e095c35 100644
--- a/pkgs/development/interpreters/lush/default.nix
+++ b/pkgs/development/interpreters/lush/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  NIX_LDFLAGS=" -lz ";
+  env.NIX_LDFLAGS=" -lz ";
 
   meta = {
     description = "Lisp Universal SHell";
diff --git a/pkgs/development/interpreters/nix-exec/default.nix b/pkgs/development/interpreters/nix-exec/default.nix
index c2a3fa2c77490..1f0e2b27bf370 100644
--- a/pkgs/development/interpreters/nix-exec/default.nix
+++ b/pkgs/development/interpreters/nix-exec/default.nix
@@ -12,7 +12,7 @@ in stdenv.mkDerivation {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ nix git ];
 
-  NIX_CFLAGS_COMPILE = "-std=c++1y";
+  env.NIX_CFLAGS_COMPILE = "-std=c++1y";
 
   meta = {
     description = "Run programs defined in nix expressions";
diff --git a/pkgs/development/interpreters/php/generic.nix b/pkgs/development/interpreters/php/generic.nix
index 13fd811c4ea8f..beb4c10fda59b 100644
--- a/pkgs/development/interpreters/php/generic.nix
+++ b/pkgs/development/interpreters/php/generic.nix
@@ -160,7 +160,7 @@ let
             [ pcre' ]
 
             # Enable sapis
-            ++ lib.optional pearSupport [ libxml2.dev ]
+            ++ lib.optional pearSupport libxml2.dev
 
             # Misc deps
             ++ lib.optional apxs2Support apacheHttpd
@@ -169,7 +169,7 @@ let
             ++ lib.optional valgrindSupport valgrind
           ;
 
-          CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
+          env.CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
 
           configureFlags =
             # Disable all extensions
@@ -186,7 +186,7 @@ let
             ++ lib.optional (!cgiSupport) "--disable-cgi"
             ++ lib.optional (!cliSupport) "--disable-cli"
             ++ lib.optional fpmSupport    "--enable-fpm"
-            ++ lib.optional pearSupport [ "--with-pear" "--enable-xml" "--with-libxml" ]
+            ++ lib.optionals pearSupport [ "--with-pear" "--enable-xml" "--with-libxml" ]
             ++ lib.optionals (pearSupport && (lib.versionOlder version "7.4")) [
               "--enable-libxml"
               "--with-libxml-dir=${libxml2.dev}"
diff --git a/pkgs/development/interpreters/pixie/default.nix b/pkgs/development/interpreters/pixie/default.nix
index ca55eceaedbfc..0b8f7e0569f45 100644
--- a/pkgs/development/interpreters/pixie/default.nix
+++ b/pkgs/development/interpreters/pixie/default.nix
@@ -58,19 +58,21 @@ let
       $PYTHON $RPYTHON ${common-flags} ${target}
       find pixie -name "*.pxi" -exec ./pixie-vm -c {} \;
     )'';
-    LD_LIBRARY_PATH = library-path;
-    C_INCLUDE_PATH = include-path;
-    LIBRARY_PATH = library-path;
-    PATH = bin-path;
+    env = {
+      LD_LIBRARY_PATH = library-path;
+      C_INCLUDE_PATH = include-path;
+      LIBRARY_PATH = library-path;
+      PATH = bin-path;
+    };
     installPhase = ''
       mkdir -p $out/share $out/bin
       cp pixie-src/pixie-vm $out/share/pixie-vm
       cp -R pixie-src/pixie $out/share/pixie
       makeWrapper $out/share/pixie-vm $out/bin/pixie \
-        --prefix LD_LIBRARY_PATH : ${LD_LIBRARY_PATH} \
-        --prefix C_INCLUDE_PATH : ${C_INCLUDE_PATH} \
-        --prefix LIBRARY_PATH : ${LIBRARY_PATH} \
-        --prefix PATH : ${PATH}
+        --prefix LD_LIBRARY_PATH : ${env.LD_LIBRARY_PATH} \
+        --prefix C_INCLUDE_PATH : ${env.C_INCLUDE_PATH} \
+        --prefix LIBRARY_PATH : ${env.LIBRARY_PATH} \
+        --prefix PATH : ${env.PATH}
     '';
     doCheck = true;
     checkPhase = ''
diff --git a/pkgs/development/interpreters/pure/default.nix b/pkgs/development/interpreters/pure/default.nix
index d1c03bba5a315..335ad6510fb93 100644
--- a/pkgs/development/interpreters/pure/default.nix
+++ b/pkgs/development/interpreters/pure/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ bison flex ];
   propagatedBuildInputs = [ libllvm gmp mpfr readline ];
-  NIX_LDFLAGS = "-lLLVMJIT";
+  env.NIX_LDFLAGS = "-lLLVMJIT";
 
   postPatch = ''
     for f in expr.cc matcher.cc printer.cc symtable.cc parserdefs.hh; do
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index d6ba795d20ada..1f7fd0ddfc995 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -255,12 +255,13 @@ in with passthru; stdenv.mkDerivation ({
 
     inherit src patches buildInputs nativeBuildInputs preConfigure configureFlags;
 
-    LDFLAGS = lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
-    inherit (mkPaths buildInputs) C_INCLUDE_PATH LIBRARY_PATH;
-
-    NIX_CFLAGS_COMPILE = optionalString stdenv.isDarwin "-msse2"
-      + optionalString stdenv.hostPlatform.isMusl " -DTHREAD_STACK_SIZE=0x100000";
-    DETERMINISTIC_BUILD = 1;
+    env = {
+      LDFLAGS = lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
+      inherit (mkPaths buildInputs) C_INCLUDE_PATH LIBRARY_PATH;
+      NIX_CFLAGS_COMPILE = optionalString stdenv.isDarwin "-msse2"
+        + optionalString stdenv.hostPlatform.isMusl " -DTHREAD_STACK_SIZE=0x100000";
+      DETERMINISTIC_BUILD = 1;
+    };
 
     setupHook = python-setup-hook sitePackages;
 
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 38ee086a88fe3..bbd457ef6fd41 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -260,12 +260,14 @@ in with passthru; stdenv.mkDerivation {
     substituteInPlace "Lib/tkinter/tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
   '';
 
-  CPPFLAGS = concatStringsSep " " (map (p: "-I${getDev p}/include") buildInputs);
-  LDFLAGS = concatStringsSep " " (map (p: "-L${getLib p}/lib") buildInputs);
-  LIBS = "${optionalString (!stdenv.isDarwin) "-lcrypt"} ${optionalString (ncurses != null) "-lncurses"}";
-  NIX_LDFLAGS = optionalString (stdenv.isLinux && !stdenv.hostPlatform.isMusl) "-lgcc_s" + optionalString stdenv.hostPlatform.isMusl "-lgcc_eh";
-  # Determinism: We fix the hashes of str, bytes and datetime objects.
-  PYTHONHASHSEED=0;
+  env = {
+    CPPFLAGS = concatStringsSep " " (map (p: "-I${getDev p}/include") buildInputs);
+    LDFLAGS = concatStringsSep " " (map (p: "-L${getLib p}/lib") buildInputs);
+    LIBS = "${optionalString (!stdenv.isDarwin) "-lcrypt"} ${optionalString (ncurses != null) "-lncurses"}";
+    NIX_LDFLAGS = optionalString (stdenv.isLinux && !stdenv.hostPlatform.isMusl) "-lgcc_s" + optionalString stdenv.hostPlatform.isMusl "-lgcc_eh";
+    # Determinism: We fix the hashes of str, bytes and datetime objects.
+    PYTHONHASHSEED = 0;
+  };
 
   configureFlags = [
     "--enable-shared"
diff --git a/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh b/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
index eb45205ff731f..6c9f6e585a462 100644
--- a/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
@@ -20,7 +20,7 @@ function _concatSep {
 
 function _pytestComputeDisabledTestsString () {
     declare -a tests
-    local tests=($1)
+    local tests=("$@")
     local prefix="not "
     prefixed=( "${tests[@]/#/$prefix}" )
     result=$(_concatSep "and" prefixed)
@@ -33,7 +33,7 @@ function pytestCheckPhase() {
 
     # Compose arguments
     args=" -m pytest"
-    if [ -n "$disabledTests" ]; then
+    if [[ -n "${disabledTests[@]-}" ]]; then
         disabledTestsString=$(_pytestComputeDisabledTestsString "${disabledTests[@]}")
       args+=" -k \""$disabledTestsString"\""
     fi
diff --git a/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh b/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
index f8ca84cd573ab..de3a8c14b5cd8 100644
--- a/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
@@ -4,9 +4,10 @@ echo "Sourcing python-imports-check-hook.sh"
 pythonImportsCheckPhase () {
     echo "Executing pythonImportsCheckPhase"
 
-    if [ -n "$pythonImportsCheck" ]; then
-        echo "Check whether the following modules can be imported: $pythonImportsCheck"
-        ( cd $out && eval "@pythonCheckInterpreter@ -c 'import os; import importlib; list(map(lambda mod: importlib.import_module(mod), os.environ[\"pythonImportsCheck\"].split()))'" )
+    if [ -n "${pythonImportsCheck[@]-}" ]; then
+        echo "Check whether the following modules can be imported: ${pythonImportsCheck[@]}"
+        export PYTHON_IMPORTS_CHECK="${pythonImportsCheck[@]}"
+        ( cd $out && eval "@pythonCheckInterpreter@ -c 'import os; import importlib; list(map(lambda mod: importlib.import_module(mod), os.environ[\"PYTHON_IMPORTS_CHECK\"].split()))'" )
     fi
 }
 
diff --git a/pkgs/development/interpreters/python/mk-python-derivation.nix b/pkgs/development/interpreters/python/mk-python-derivation.nix
index e9c769821d6f6..266fe346f9ca6 100644
--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@@ -89,6 +89,8 @@
 
 , meta ? {}
 
+, env ? {}
+
 , passthru ? {}
 
 , doCheck ? config.doCheckByDefault or false
@@ -149,7 +151,9 @@ let
 
     inherit strictDeps;
 
-    LANG = "${if python.stdenv.isDarwin then "en_US" else "C"}.UTF-8";
+    env = {
+      LANG = "${if python.stdenv.isDarwin then "en_US" else "C"}.UTF-8";
+    } // env;
 
     # Python packages don't have a checkPhase, only an installCheckPhase
     doCheck = false;
diff --git a/pkgs/development/interpreters/python/pypy/default.nix b/pkgs/development/interpreters/python/pypy/default.nix
index a5ba4983e43c8..826e9cd060c57 100644
--- a/pkgs/development/interpreters/python/pypy/default.nix
+++ b/pkgs/development/interpreters/python/pypy/default.nix
@@ -68,9 +68,11 @@ in with passthru; stdenv.mkDerivation rec {
   dontPatchShebangs = true;
   disallowedReferences = [ python ];
 
-  C_INCLUDE_PATH = makeSearchPathOutput "dev" "include" buildInputs;
-  LIBRARY_PATH = makeLibraryPath buildInputs;
-  LD_LIBRARY_PATH = makeLibraryPath (filter (x : x.outPath != stdenv.cc.libc.outPath or "") buildInputs);
+  env = {
+    C_INCLUDE_PATH = makeSearchPathOutput "dev" "include" buildInputs;
+    LIBRARY_PATH = makeLibraryPath buildInputs;
+    LD_LIBRARY_PATH = makeLibraryPath (filter (x : x.outPath != stdenv.cc.libc.outPath or "") buildInputs);
+  };
 
   patches = [
     (substituteAll {
diff --git a/pkgs/development/interpreters/python/wrap.sh b/pkgs/development/interpreters/python/wrap.sh
index f10ba003432be..46270026e90f4 100644
--- a/pkgs/development/interpreters/python/wrap.sh
+++ b/pkgs/development/interpreters/python/wrap.sh
@@ -1,13 +1,14 @@
 # Wrapper around wrapPythonProgramsIn, below. The $pythonPath
 # variable is passed in from the buildPythonPackage function.
 wrapPythonPrograms() {
-    wrapPythonProgramsIn "$out/bin" "$out $pythonPath"
+    local pythonPath=($out "${pythonPath[@]}")
+    wrapPythonProgramsIn "$out/bin" "${pythonPath[@]}"
 }
 
 # Builds environment variables like PYTHONPATH and PATH walking through closure
 # of dependencies.
 buildPythonPath() {
-    local pythonPath="$1"
+    local pythonPath=("$@")
     local path
 
     # Create an empty table of python paths (see doc on _addToPythonPath
@@ -18,7 +19,7 @@ buildPythonPath() {
     program_PATH=
     pythonPathsSeen["@pythonHost@"]=1
     addToSearchPath program_PATH @pythonHost@/bin
-    for path in $pythonPath; do
+    for path in "${pythonPath[@]}"; do
         _addToPythonPath $path
     done
 }
@@ -41,10 +42,11 @@ patchPythonScript() {
 # suffix).
 wrapPythonProgramsIn() {
     local dir="$1"
-    local pythonPath="$2"
+    shift
+    local pythonPath=("$@")
     local f
 
-    buildPythonPath "$pythonPath"
+    buildPythonPath "${pythonPath[@]}"
 
     # Find all regular files in the output directory that are executable.
     if [ -d "$dir" ]; then
diff --git a/pkgs/development/interpreters/racket/default.nix b/pkgs/development/interpreters/racket/default.nix
index 48be64aa0b8d2..25de92ef5333b 100644
--- a/pkgs/development/interpreters/racket/default.nix
+++ b/pkgs/development/interpreters/racket/default.nix
@@ -59,9 +59,9 @@ stdenv.mkDerivation rec {
     sha256 = "0lqqpa88v0br93qw7450a4blyi3pwn7sq2k04h0ikbsqrdnfj7lj";
   };
 
-  FONTCONFIG_FILE = fontsConf;
-  LD_LIBRARY_PATH = libPath;
-  NIX_LDFLAGS = lib.concatStringsSep " " [
+  env.LD_LIBRARY_PATH = libPath;
+  env.FONTCONFIG_FILE = toString fontsConf;
+  env.NIX_LDFLAGS = lib.concatStringsSep " " [
     (lib.optionalString (stdenv.cc.isGNU && ! stdenv.isDarwin) "-lgcc_s")
     (lib.optionalString stdenv.isDarwin "-framework CoreFoundation")
   ];
@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
     mkdir src/build
     cd src/build
 
-    gappsWrapperArgs+=("--prefix" "LD_LIBRARY_PATH" ":" ${LD_LIBRARY_PATH})
+    gappsWrapperArgs+=("--prefix" "LD_LIBRARY_PATH" ":" ${env.LD_LIBRARY_PATH})
   '';
 
   shared = if stdenv.isDarwin then "dylib" else "shared";
diff --git a/pkgs/development/interpreters/renpy/default.nix b/pkgs/development/interpreters/renpy/default.nix
index b0c10c8a65202..7fcec16d7f631 100644
--- a/pkgs/development/interpreters/renpy/default.nix
+++ b/pkgs/development/interpreters/renpy/default.nix
@@ -58,5 +58,5 @@ stdenv.mkDerivation rec {
       --add-flags "-O $out/share/renpy/renpy.py"
   '';
 
-  NIX_CFLAGS_COMPILE = "-I${pygame_sdl2}/include/${python.libPrefix}";
+  env.NIX_CFLAGS_COMPILE = "-I${pygame_sdl2}/include/${python.libPrefix}";
 }
diff --git a/pkgs/development/libraries/ace/default.nix b/pkgs/development/libraries/ace/default.nix
index b27cb8aae35a8..5bb342c1824b0 100644
--- a/pkgs/development/libraries/ace/default.nix
+++ b/pkgs/development/libraries/ace/default.nix
@@ -14,9 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config libtool ];
   buildInputs = [ perl ];
 
-  NIX_CFLAGS_COMPILE = [
-    "-Wno-error=format-security"
-  ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
 
   postPatch = ''
     patchShebangs ./MPC/prj_install.pl
diff --git a/pkgs/development/libraries/apache-activemq/default.nix b/pkgs/development/libraries/apache-activemq/default.nix
index 79c1715c61d75..13305d312736b 100644
--- a/pkgs/development/libraries/apache-activemq/default.nix
+++ b/pkgs/development/libraries/apache-activemq/default.nix
@@ -9,8 +9,6 @@ stdenv.mkDerivation rec {
     url = "mirror://apache/activemq/${version}/${pname}-${version}-bin.tar.gz";
   };
 
-  phases = [ "unpackPhase" "installPhase" ];
-
   installPhase = ''
     mkdir -p $out
     mv * $out/
diff --git a/pkgs/development/libraries/appindicator-sharp/default.nix b/pkgs/development/libraries/appindicator-sharp/default.nix
index 9eff4e3895ba1..cf076b6769ca8 100644
--- a/pkgs/development/libraries/appindicator-sharp/default.nix
+++ b/pkgs/development/libraries/appindicator-sharp/default.nix
@@ -31,8 +31,8 @@ stdenv.mkDerivation rec {
     libappindicator
   ];
 
-  ac_cv_path_MDOC = "no";
-  installFlagsArray = ["GAPIXMLDIR=/tmp/gapixml"];
+  env.ac_cv_path_MDOC = "no";
+  installFlags = [ "GAPIXMLDIR=/tmp/gapixml" ];
 
   meta = {
     description = "Bindings for appindicator using gobject-introspection";
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index ac53ae3bbd448..c67b75a4bec47 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -31,22 +31,38 @@ in stdenv.mkDerivation rec {
   };
   sourceRoot = "apache-arrow-${version}/cpp";
 
-  ARROW_JEMALLOC_URL = fetchurl {
-    # From
-    # ./cpp/cmake_modules/ThirdpartyToolchain.cmake
-    # ./cpp/thirdparty/versions.txt
-    url =
-      "https://github.com/jemalloc/jemalloc/releases/download/5.2.1/jemalloc-5.2.1.tar.bz2";
-    sha256 = "1xl7z0vwbn5iycg7amka9jd6hxd8nmfk7nahi4p9w2bnw9f0wcrl";
-  };
+  env = {
+    ARROW_JEMALLOC_URL = toString (fetchurl {
+      # From
+      # ./cpp/cmake_modules/ThirdpartyToolchain.cmake
+      # ./cpp/thirdparty/versions.txt
+      url =
+        "https://github.com/jemalloc/jemalloc/releases/download/5.2.1/jemalloc-5.2.1.tar.bz2";
+      sha256 = "1xl7z0vwbn5iycg7amka9jd6hxd8nmfk7nahi4p9w2bnw9f0wcrl";
+    });
 
-  ARROW_MIMALLOC_URL = fetchurl {
-    # From
-    # ./cpp/cmake_modules/ThirdpartyToolchain.cmake
-    # ./cpp/thirdparty/versions.txt
-    url =
-      "https://github.com/microsoft/mimalloc/archive/v1.6.4.tar.gz";
-    sha256 = "1b8av0974q70alcmaw5cwzbn6n9blnpmj721ik1qwmbbwwd6nqgs";
+    ARROW_MIMALLOC_URL = toString (fetchurl {
+      # From
+      # ./cpp/cmake_modules/ThirdpartyToolchain.cmake
+      # ./cpp/thirdparty/versions.txt
+      url =
+        "https://github.com/microsoft/mimalloc/archive/v1.6.4.tar.gz";
+      sha256 = "1b8av0974q70alcmaw5cwzbn6n9blnpmj721ik1qwmbbwwd6nqgs";
+    });
+
+    ARROW_TEST_DATA =
+      lib.optionalString doInstallCheck "${arrow-testing}/data";
+    PARQUET_TEST_DATA =
+      lib.optionalString doInstallCheck "${parquet-testing}/data";
+    GTEST_FILTER = let
+        # Upstream Issue: https://issues.apache.org/jira/browse/ARROW-11398
+        filteredTests = lib.optionals stdenv.hostPlatform.isAarch64 [
+          "TestFilterKernelWithNumeric/3.CompareArrayAndFilterRandomNumeric"
+          "TestFilterKernelWithNumeric/7.CompareArrayAndFilterRandomNumeric"
+          "TestCompareKernel.PrimitiveRandomTests"
+        ];
+      in 
+      lib.optionalString doInstallCheck "-${builtins.concatStringsSep ":" filteredTests}";
   };
 
   patches = [
@@ -119,19 +135,6 @@ in stdenv.mkDerivation rec {
   ARROW_XSIMD_URL = xsimd.src;
 
   doInstallCheck = true;
-  ARROW_TEST_DATA =
-    if doInstallCheck then "${arrow-testing}/data" else null;
-  PARQUET_TEST_DATA =
-    if doInstallCheck then "${parquet-testing}/data" else null;
-  GTEST_FILTER =
-    if doInstallCheck then let
-      # Upstream Issue: https://issues.apache.org/jira/browse/ARROW-11398
-      filteredTests = lib.optionals stdenv.hostPlatform.isAarch64 [
-        "TestFilterKernelWithNumeric/3.CompareArrayAndFilterRandomNumeric"
-        "TestFilterKernelWithNumeric/7.CompareArrayAndFilterRandomNumeric"
-        "TestCompareKernel.PrimitiveRandomTests"
-      ];
-    in "-${builtins.concatStringsSep ":" filteredTests}" else null;
   installCheckInputs = [ perl which ];
   installCheckPhase =
   let
diff --git a/pkgs/development/libraries/aspell/dictionaries.nix b/pkgs/development/libraries/aspell/dictionaries.nix
index 3923416c4a350..3f1ae4aa8fc83 100644
--- a/pkgs/development/libraries/aspell/dictionaries.nix
+++ b/pkgs/development/libraries/aspell/dictionaries.nix
@@ -45,7 +45,10 @@ let
 
       dontAddPrefix = true;
 
-      preBuild = "makeFlagsArray=(dictdir=$out/lib/aspell datadir=$out/lib/aspell)";
+      makeFlags = [
+        "dictdir=${placeholder "out"}/lib/aspell"
+        "datadir=${placeholder "out"}/lib/aspell"
+      ];
 
       meta = {
         description = "Aspell dictionary for ${fullName}";
@@ -108,6 +111,8 @@ let
   buildTxtDict =
     {langInputs ? [], ...}@args:
     buildDict ({
+      dontUnpack = true;
+
       propagatedUserEnvPackages = langInputs;
 
       preBuild = ''
@@ -152,8 +157,6 @@ let
           done
         }
       '';
-
-      phases = [ "preBuild" "buildPhase" "installPhase" ];
     } // args);
 
 in rec {
@@ -905,7 +908,11 @@ in rec {
 
     langInputs = [ en ];
 
-    buildPhase = "cat $src | aspell-affix en-computers --dont-validate-words --lang=en";
+    buildPhase = ''
+      runHook preBuild
+      cat $src | aspell-affix en-computers --dont-validate-words --lang=en
+      runHook postBuild
+    '';
     installPhase = "aspell-install en-computers";
 
     meta = {
@@ -930,8 +937,10 @@ in rec {
     langInputs = [ en ];
 
     buildPhase = ''
+      runHook preBuild
       cat $src1 | aspell-plain en_US-science --dont-validate-words --lang=en
       cat $src2 | aspell-plain en_GB-science --dont-validate-words --lang=en
+      runHook postBuild
     '';
     installPhase = "aspell-install en_US-science en_GB-science";
 
diff --git a/pkgs/development/libraries/audio/qm-dsp/default.nix b/pkgs/development/libraries/audio/qm-dsp/default.nix
index 3d8e15f97cdbf..5d7d2fe7a1c78 100644
--- a/pkgs/development/libraries/audio/qm-dsp/default.nix
+++ b/pkgs/development/libraries/audio/qm-dsp/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     "LIBDIR=${placeholder "out"}/lib"
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${kissfft}/include/kissfft";
+  env.NIX_CFLAGS_COMPILE = "-I${kissfft}/include/kissfft";
 
   meta = with lib; {
     description = "A C++ library of functions for DSP and Music Informatics purposes";
diff --git a/pkgs/development/libraries/audiofile/default.nix b/pkgs/development/libraries/audiofile/default.nix
index 88b1840955d32..02e22011057c8 100644
--- a/pkgs/development/libraries/audiofile/default.nix
+++ b/pkgs/development/libraries/audiofile/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   };
 
   # fix build with gcc9
-  NIX_CFLAGS_LINK = lib.optional (stdenv.system == "i686-linux") "-lgcc";
+  env.NIX_CFLAGS_LINK = lib.optionalString (stdenv.system == "i686-linux") "-lgcc";
 
   # Even when statically linking, libstdc++.la is put in dependency_libs here,
   # and hence libstdc++.so passed to the linker, just pass -lstdc++ and let the
diff --git a/pkgs/development/libraries/avahi/default.nix b/pkgs/development/libraries/avahi/default.nix
index a52d1be566e68..6302577523a4e 100644
--- a/pkgs/development/libraries/avahi/default.nix
+++ b/pkgs/development/libraries/avahi/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
     # autoipd won't build on darwin
     ++ lib.optional stdenv.isDarwin "--disable-autoipd";
 
-  NIX_CFLAGS_COMPILE = "-DAVAHI_SERVICE_DIR=\"/etc/avahi/services\"";
+  env.NIX_CFLAGS_COMPILE = "-DAVAHI_SERVICE_DIR=\"/etc/avahi/services\"";
 
   preBuild = lib.optionalString stdenv.isDarwin ''
     sed -i '20 i\
diff --git a/pkgs/development/libraries/aws-c-common/default.nix b/pkgs/development/libraries/aws-c-common/default.nix
index 580eaec2ebe76..a99730a008c8d 100644
--- a/pkgs/development/libraries/aws-c-common/default.nix
+++ b/pkgs/development/libraries/aws-c-common/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     "-DCMAKE_SKIP_BUILD_RPATH=OFF" # for tests
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin
     "-Wno-nullability-extension -Wno-typedef-redefinition";
 
   doCheck = true;
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index dd215dc01c5d3..1e4cdc9e5d4d7 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     "-DBUILD_ONLY=${lib.concatStringsSep ";" apis}";
 
   # fix build with gcc9, can be removed after bumping to current version
-  NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   preConfigure =
     ''
diff --git a/pkgs/development/libraries/bamf/default.nix b/pkgs/development/libraries/bamf/default.nix
index faee853808ccb..0b3d2dd2937f7 100644
--- a/pkgs/development/libraries/bamf/default.nix
+++ b/pkgs/development/libraries/bamf/default.nix
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
   doCheck = false;
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   meta = with lib; {
     description = "Application matching framework";
diff --git a/pkgs/development/libraries/bctoolbox/default.nix b/pkgs/development/libraries/bctoolbox/default.nix
index c482b55c60b9c..c3544933347d6 100644
--- a/pkgs/development/libraries/bctoolbox/default.nix
+++ b/pkgs/development/libraries/bctoolbox/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   # Do not build static libraries
   cmakeFlags = [ "-DENABLE_STATIC=NO" ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=stringop-truncation" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=stringop-truncation";
 
   meta = with lib; {
     inherit version;
diff --git a/pkgs/development/libraries/belle-sip/default.nix b/pkgs/development/libraries/belle-sip/default.nix
index 4032734416e4e..e491ed8d94944 100644
--- a/pkgs/development/libraries/belle-sip/default.nix
+++ b/pkgs/development/libraries/belle-sip/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   # Do not build static libraries
   cmakeFlags = [ "-DENABLE_STATIC=NO" ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=deprecated-declarations"
     "-Wno-error=format-truncation"
     "-Wno-error=cast-function-type"
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index 6158eb8751173..75a9608bb8755 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -155,7 +155,7 @@ stdenv.mkDerivation {
       -i ./tools/build/src/engine/build.sh
   '';
 
-  NIX_CFLAGS_LINK = lib.optionalString stdenv.isDarwin
+  env.NIX_CFLAGS_LINK = lib.optionalString stdenv.isDarwin
                       "-headerpad_max_install_names";
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/buddy/default.nix b/pkgs/development/libraries/buddy/default.nix
index a333a69ffa1b2..a108d1e5559ca 100644
--- a/pkgs/development/libraries/buddy/default.nix
+++ b/pkgs/development/libraries/buddy/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ bison ];
   patches = [ ./gcc-4.3.3-fixes.patch ];
   configureFlags = [ "CFLAGS=-O3" "CXXFLAGS=-O3" ];
-  NIX_LDFLAGS = "-lm";
+  env.NIX_LDFLAGS = "-lm";
   doCheck = true;
 
   meta = {
diff --git a/pkgs/development/libraries/bullet/default.nix b/pkgs/development/libraries/bullet/default.nix
index 50bf56bfbd221..db9045dec59df 100644
--- a/pkgs/development/libraries/bullet/default.nix
+++ b/pkgs/development/libraries/bullet/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     "-DBUILD_UNIT_TESTS=OFF"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
     "-Wno-error=argument-outside-range -Wno-error=c++11-narrowing";
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/bzrtp/default.nix b/pkgs/development/libraries/bzrtp/default.nix
index 5236c92527e24..9d7e18974dbee 100644
--- a/pkgs/development/libraries/bzrtp/default.nix
+++ b/pkgs/development/libraries/bzrtp/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   # Do not build static libraries
   cmakeFlags = [ "-DENABLE_STATIC=NO" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type";
 
   meta = with lib; {
     description = "An opensource implementation of ZRTP keys exchange protocol";
diff --git a/pkgs/development/libraries/clearsilver/default.nix b/pkgs/development/libraries/clearsilver/default.nix
index 73ffd6c12b23a..2a2c901126915 100644
--- a/pkgs/development/libraries/clearsilver/default.nix
+++ b/pkgs/development/libraries/clearsilver/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "1046m1dpq3nkgxbis2dr2x7hynmy51n64465q78d7pdgvqwa178y";
   };
 
-  PYTHON_SITE = "${placeholder "out"}/${python2.sitePackages}";
+  env.PYTHON_SITE = "${placeholder "out"}/${python2.sitePackages}";
 
   configureFlags = [
     "--with-python=${python2.interpreter}"
diff --git a/pkgs/development/libraries/clucene-core/2.x.nix b/pkgs/development/libraries/clucene-core/2.x.nix
index 9c1f3c21cd278..f2fcd1e59e83e 100644
--- a/pkgs/development/libraries/clucene-core/2.x.nix
+++ b/pkgs/development/libraries/clucene-core/2.x.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   # /build/clucene-core-2.3.3.4/build/bin/cl_test"
   doCheck = false;
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
 
   meta = with lib; {
     description = "Core library for full-featured text search engine";
diff --git a/pkgs/development/libraries/cpp-hocon/default.nix b/pkgs/development/libraries/cpp-hocon/default.nix
index dfe7f77767038..ac9baf3ab519f 100644
--- a/pkgs/development/libraries/cpp-hocon/default.nix
+++ b/pkgs/development/libraries/cpp-hocon/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "puppetlabs";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/libraries/cppdb/default.nix b/pkgs/development/libraries/cppdb/default.nix
index 98c9c7ecac159..b71a6c0730310 100644
--- a/pkgs/development/libraries/cppdb/default.nix
+++ b/pkgs/development/libraries/cppdb/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ sqlite libmysqlclient postgresql unixODBC ];
 
   cmakeFlags = [ "--no-warn-unused-cli" ];
-  NIX_CFLAGS_COMPILE = "-I${libmysqlclient}/include/mysql -L${libmysqlclient}/lib/mysql";
+  env.NIX_CFLAGS_COMPILE = "-I${libmysqlclient}/include/mysql -L${libmysqlclient}/lib/mysql";
 
   meta = with lib; {
     homepage = "http://cppcms.com/sql/cppdb/";
diff --git a/pkgs/development/libraries/crc32c/default.nix b/pkgs/development/libraries/crc32c/default.nix
index bc46e80db9b32..2b875bc8eeb33 100644
--- a/pkgs/development/libraries/crc32c/default.nix
+++ b/pkgs/development/libraries/crc32c/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ gflags ];
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isAarch64 "-march=armv8-a+crc";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isAarch64 "-march=armv8-a+crc";
   cmakeFlags = lib.optionals (!staticOnly) [ "-DBUILD_SHARED_LIBS=1"  ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/cre2/default.nix b/pkgs/development/libraries/cre2/default.nix
index d85843a54f7c7..894defd1f0980 100644
--- a/pkgs/development/libraries/cre2/default.nix
+++ b/pkgs/development/libraries/cre2/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   ];
   buildInputs = [ re2 texinfo ];
 
-  NIX_LDFLAGS="-lre2 -lpthread";
+  env.NIX_LDFLAGS="-lre2 -lpthread";
 
   configureFlags = [
     "--enable-maintainer-mode"
diff --git a/pkgs/development/libraries/cwiid/default.nix b/pkgs/development/libraries/cwiid/default.nix
index 31a5420e375c8..b0b04de477827 100644
--- a/pkgs/development/libraries/cwiid/default.nix
+++ b/pkgs/development/libraries/cwiid/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
-  NIX_LDFLAGS = "-lbluetooth";
+  env.NIX_LDFLAGS = "-lbluetooth";
 
   postInstall = ''
     # Some programs (for example, cabal-install) have problems with the double 0
diff --git a/pkgs/development/libraries/cxxopts/default.nix b/pkgs/development/libraries/cxxopts/default.nix
index 855a9eef8ea06..b3db815181e6e 100644
--- a/pkgs/development/libraries/cxxopts/default.nix
+++ b/pkgs/development/libraries/cxxopts/default.nix
@@ -11,12 +11,12 @@ stdenv.mkDerivation rec {
     sha256 = "0pwrac81zfqjs17g3hx8r3ds2xf04npb6mz111qjy4bx17314ib7";
   };
 
-  buildInputs = lib.optional enableUnicodeHelp [ icu.dev ];
+  buildInputs = lib.optional enableUnicodeHelp icu.dev;
   cmakeFlags = [ "-DCXXOPTS_BUILD_EXAMPLES=OFF" ]
     ++ lib.optional enableUnicodeHelp "-DCXXOPTS_USE_UNICODE_HELP=TRUE"
     # Due to -Wsuggest-override, remove when cxxopts is updated
     ++ lib.optional stdenv.isDarwin "-DCXXOPTS_ENABLE_WARNINGS=OFF";
-  nativeBuildInputs = [ cmake ] ++ lib.optional enableUnicodeHelp [ pkg-config ];
+  nativeBuildInputs = [ cmake ] ++ lib.optional enableUnicodeHelp pkg-config;
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index e9543fd95f93d..4a38364dfd069 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -89,8 +89,10 @@ stdenv.mkDerivation rec {
   # Enable X11 autolaunch support in libdbus. This doesn't actually depend on X11
   # (it just execs dbus-launch in dbus.tools), contrary to what the configure script demands.
   # problems building without x11Support so disabled in that case for now
-  NIX_CFLAGS_COMPILE = lib.optionalString x11Support "-DDBUS_ENABLE_X11_AUTOLAUNCH=1";
-  NIX_CFLAGS_LINK = lib.optionalString (!stdenv.isDarwin) "-Wl,--as-needed";
+  env = {
+    NIX_CFLAGS_COMPILE = lib.optionalString x11Support "-DDBUS_ENABLE_X11_AUTOLAUNCH=1";
+    NIX_CFLAGS_LINK = lib.optionalString (!stdenv.isDarwin) "-Wl,--as-needed";
+  };
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/directfb/default.nix b/pkgs/development/libraries/directfb/default.nix
index 1b0b50d28f008..992d294414df9 100644
--- a/pkgs/development/libraries/directfb/default.nix
+++ b/pkgs/development/libraries/directfb/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
       libXrender
     ]);
 
-  NIX_LDFLAGS = "-lgcc_s";
+  env.NIX_LDFLAGS = "-lgcc_s";
 
   configureFlags = [
     "--enable-sdl"
diff --git a/pkgs/development/libraries/easyloggingpp/default.nix b/pkgs/development/libraries/easyloggingpp/default.nix
index ad582d9330591..d85e999b1a62f 100644
--- a/pkgs/development/libraries/easyloggingpp/default.nix
+++ b/pkgs/development/libraries/easyloggingpp/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [cmake];
   buildInputs = [gtest];
   cmakeFlags = [ "-Dtest=ON" ];
-  NIX_CFLAGS_COMPILE = "-std=c++11" +
+  env.NIX_CFLAGS_COMPILE = "-std=c++11" +
     lib.optionalString stdenv.isLinux " -pthread";
   postInstall = ''
     mkdir -p $out/include
diff --git a/pkgs/development/libraries/epoxy/default.nix b/pkgs/development/libraries/epoxy/default.nix
index 7ae0e73953f44..ec82854e701a8 100644
--- a/pkgs/development/libraries/epoxy/default.nix
+++ b/pkgs/development/libraries/epoxy/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./libgl-path.patch ];
 
-  NIX_CFLAGS_COMPILE = ''-DLIBGL_PATH="${getLib libGL}/lib"'';
+  env.NIX_CFLAGS_COMPILE = ''-DLIBGL_PATH="${getLib libGL}/lib"'';
 
   doCheck = false; # needs X11
 
diff --git a/pkgs/development/libraries/ffmpeg-full/default.nix b/pkgs/development/libraries/ffmpeg-full/default.nix
index dcd1388143da1..895f804e75353 100644
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@@ -279,13 +279,6 @@ stdenv.mkDerivation rec {
     (enableFeature swscaleAlphaBuild "swscale-alpha")
     (enableFeature hardcodedTablesBuild "hardcoded-tables")
     (enableFeature safeBitstreamReaderBuild "safe-bitstream-reader")
-    (if multithreadBuild then (
-       if isCygwin then
-         "--disable-pthreads --enable-w32threads"
-       else # Use POSIX threads by default
-         "--enable-pthreads --disable-w32threads")
-     else
-       "--disable-pthreads --disable-w32threads")
     "--disable-os2threads" # We don't support OS/2
     (enableFeature networkBuild "network")
     (enableFeature pixelutilsBuild "pixelutils")
@@ -412,7 +405,15 @@ stdenv.mkDerivation rec {
     (enableFeature optimizationsDeveloper "optimizations")
     (enableFeature extraWarningsDeveloper "extra-warnings")
     (enableFeature strippingDeveloper "stripping")
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optional stdenv.cc.isClang  "--cc=clang"
+  ++ (if multithreadBuild then (
+       if isCygwin then
+         [ "--disable-pthreads" "--enable-w32threads" ]
+       else # Use POSIX threads by default
+         [ "--enable-pthreads" "--disable-w32threads" ])
+     else
+       [ "--disable-pthreads" "--disable-w32threads" ])
+  ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "--cross-prefix=${stdenv.cc.targetPrefix}"
     "--enable-cross-compile"
   ] ++ optionals stdenv.cc.isClang [
diff --git a/pkgs/development/libraries/ffms/default.nix b/pkgs/development/libraries/ffms/default.nix
index 283942df63f9e..55a0ef57ba76f 100644
--- a/pkgs/development/libraries/ffms/default.nix
+++ b/pkgs/development/libraries/ffms/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-3bPxt911T0bGpAIS2RxBjo+VV84xW06eKcCj3ZAcmvw=";
   };
 
-  NIX_CFLAGS_COMPILE = "-fPIC";
+  env.NIX_CFLAGS_COMPILE = "-fPIC";
 
   nativeBuildInputs = [
     autoreconfHook
diff --git a/pkgs/development/libraries/flatpak/default.nix b/pkgs/development/libraries/flatpak/default.nix
index 97410fda0d315..a138626837ba3 100644
--- a/pkgs/development/libraries/flatpak/default.nix
+++ b/pkgs/development/libraries/flatpak/default.nix
@@ -164,7 +164,7 @@ stdenv.mkDerivation rec {
   # TODO: some issues with temporary files
   doCheck = false;
 
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/fontconfig/make-fonts-cache.nix b/pkgs/development/libraries/fontconfig/make-fonts-cache.nix
index 47884b9c3b928..372a561fdcc1c 100644
--- a/pkgs/development/libraries/fontconfig/make-fonts-cache.nix
+++ b/pkgs/development/libraries/fontconfig/make-fonts-cache.nix
@@ -1,11 +1,10 @@
-{ runCommand, lib, fontconfig, fontDirectories }:
+{ runCommand, lib, fontconfig, jq, fontDirectories }:
 
 runCommand "fc-cache"
   {
-    nativeBuildInputs = [ fontconfig.bin ];
+    nativeBuildInputs = [ fontconfig.bin jq ];
     preferLocalBuild = true;
     allowSubstitutes = false;
-    passAsFile = [ "fontDirs" ];
     fontDirs = ''
       <!-- Font directories -->
       ${lib.concatStringsSep "\n" (map (font: "<dir>${font}</dir>") fontDirectories)}
@@ -21,7 +20,7 @@ runCommand "fc-cache"
       <include>${fontconfig.out}/etc/fonts/fonts.conf</include>
       <cachedir>$out</cachedir>
     EOF
-    cat "$fontDirsPath" >> fonts.conf
+    <.attrs.json jq .fontDirs >> fonts.conf
     echo "</fontconfig>" >> fonts.conf
 
     mkdir -p $out
diff --git a/pkgs/development/libraries/freeimage/default.nix b/pkgs/development/libraries/freeimage/default.nix
index 236305a572bf9..8a68ddc19b67c 100644
--- a/pkgs/development/libraries/freeimage/default.nix
+++ b/pkgs/development/libraries/freeimage/default.nix
@@ -30,8 +30,8 @@ stdenv.mkDerivation {
     make -f Makefile.fip
   '';
 
-  INCDIR = "${placeholder "out"}/include";
-  INSTALLDIR = "${placeholder "out"}/lib";
+  env.INCDIR = "${placeholder "out"}/include";
+  env.INSTALLDIR = "${placeholder "out"}/lib";
 
   preInstall = ''
     mkdir -p $INCDIR $INSTALLDIR
diff --git a/pkgs/development/libraries/freetype/default.nix b/pkgs/development/libraries/freetype/default.nix
index adda15696e8a3..194bdf9f144aa 100644
--- a/pkgs/development/libraries/freetype/default.nix
+++ b/pkgs/development/libraries/freetype/default.nix
@@ -53,10 +53,10 @@ in stdenv.mkDerivation rec {
   configureFlags = [ "--bindir=$(dev)/bin" "--enable-freetype-config" ];
 
   # native compiler to generate building tool
-  CC_BUILD = "${buildPackages.stdenv.cc}/bin/cc";
+  env.CC_BUILD = "${buildPackages.stdenv.cc}/bin/cc";
 
   # The asm for armel is written with the 'asm' keyword.
-  CFLAGS = optionalString stdenv.isAarch32 "-std=gnu99";
+  env.CFLAGS = optionalString stdenv.isAarch32 "-std=gnu99";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/g2o/default.nix b/pkgs/development/libraries/g2o/default.nix
index 0536ec95c6ff1..775409871df92 100644
--- a/pkgs/development/libraries/g2o/default.nix
+++ b/pkgs/development/libraries/g2o/default.nix
@@ -21,7 +21,7 @@ mkDerivation rec {
   buildInputs = [ eigen suitesparse blas lapack libGLU qtbase libqglviewer ];
 
   # Silence noisy warning
-  CXXFLAGS = "-Wno-deprecated-copy";
+  env.CXXFLAGS = "-Wno-deprecated-copy";
 
   dontWrapQtApps = true;
 
diff --git a/pkgs/development/libraries/galario/default.nix b/pkgs/development/libraries/galario/default.nix
index 4e28f84bacdb2..5a2bef3d5adcb 100644
--- a/pkgs/development/libraries/galario/default.nix
+++ b/pkgs/development/libraries/galario/default.nix
@@ -34,13 +34,13 @@ stdenv.mkDerivation rec {
   ++ lib.optional stdenv.isDarwin llvmPackages.openmp
   ;
 
-  propagatedBuildInputs = lib.optional enablePython [
+  propagatedBuildInputs = lib.optionals enablePython [
     pythonPackages.numpy
     pythonPackages.cython
     pythonPackages.pytest
   ];
 
-  checkInputs = lib.optional enablePython [ pythonPackages.scipy pythonPackages.pytestcov ];
+  checkInputs = lib.optionals enablePython [ pythonPackages.scipy pythonPackages.pytestcov ];
 
   preConfigure = ''
     mkdir -p build/external/src
diff --git a/pkgs/development/libraries/gamenetworkingsockets/default.nix b/pkgs/development/libraries/gamenetworkingsockets/default.nix
index 0546bfb8e08ec..4f2bfac8769a9 100644
--- a/pkgs/development/libraries/gamenetworkingsockets/default.nix
+++ b/pkgs/development/libraries/gamenetworkingsockets/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ninja go ];
 
-  cmakeFlags = [ "-G Ninja" ];
+  cmakeFlags = [ "-G" "Ninja" ];
 
   # tmp home for go
   preBuild = "export HOME=\"$TMPDIR\"";
diff --git a/pkgs/development/libraries/gdal/2.4.nix b/pkgs/development/libraries/gdal/2.4.nix
index 234d986b21fa6..9c40604affcec 100644
--- a/pkgs/development/libraries/gdal/2.4.nix
+++ b/pkgs/development/libraries/gdal/2.4.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  CXXFLAGS = "-fpermissive";
+  env.CXXFLAGS = "-fpermissive";
 
   postPatch = ''
     sed -i '/ifdef bool/i\
diff --git a/pkgs/development/libraries/gdal/default.nix b/pkgs/development/libraries/gdal/default.nix
index 15fc84895fb57..c67fb47069cf4 100644
--- a/pkgs/development/libraries/gdal/default.nix
+++ b/pkgs/development/libraries/gdal/default.nix
@@ -57,12 +57,11 @@ stdenv.mkDerivation rec {
     "--with-geos=${geos}/bin/geos-config" # optional
     "--with-hdf4=${hdf4.dev}" # optional
     "--with-xml2=yes" # optional
-    (if netcdfSupport then "--with-netcdf=${netcdf}" else "")
-  ];
+  ] ++ lib.optional netcdfSupport "--with-netcdf=${netcdf}";
 
   hardeningDisable = [ "format" ];
 
-  CXXFLAGS = "-fpermissive";
+  env.CXXFLAGS = "-fpermissive";
 
   # - Unset CC and CXX as they confuse libtool.
   # - teach gdal that libdf is the legacy name for libhdf
diff --git a/pkgs/development/libraries/gdcm/default.nix b/pkgs/development/libraries/gdcm/default.nix
index 75ce95e0e46bb..444b9e31a062d 100644
--- a/pkgs/development/libraries/gdcm/default.nix
+++ b/pkgs/development/libraries/gdcm/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     "-DGDCM_BUILD_SHARED_LIBS=ON"
     "-DGDCM_USE_VTK=ON"
   ]
-  ++ lib.optional enablePython [
+  ++ lib.optionals enablePython [
     "-DGDCM_WRAP_PYTHON:BOOL=ON"
     "-DGDCM_INSTALL_PYTHONMODULE_DIR=${placeholder "out"}/${python.sitePackages}"
   ];
@@ -30,11 +30,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ vtk_7 ]
-    ++ lib.optional stdenv.isDarwin [
+    ++ lib.optionals stdenv.isDarwin [
       darwin.apple_sdk.frameworks.ApplicationServices
       darwin.apple_sdk.frameworks.Cocoa
-    ] ++ lib.optional enablePython [ swig python ];
-  propagatedBuildInputs = [ ];
+    ] ++ lib.optionals enablePython [ swig python ];
 
   meta = with lib; {
     description = "The grassroots cross-platform DICOM implementation";
diff --git a/pkgs/development/libraries/gegl/4.0.nix b/pkgs/development/libraries/gegl/4.0.nix
index 11f4f070c08f5..d0e0db9bbe4e4 100644
--- a/pkgs/development/libraries/gegl/4.0.nix
+++ b/pkgs/development/libraries/gegl/4.0.nix
@@ -101,7 +101,7 @@ stdenv.mkDerivation rec {
 
   # TODO: Fix missing math symbols in gegl seamless clone.
   # It only appears when we use packaged poly2tri-c instead of vendored one.
-  NIX_CFLAGS_COMPILE = "-lm";
+  env.NIX_CFLAGS_COMPILE = "-lm";
 
   postPatch = ''
     chmod +x tests/opencl/opencl_test.sh
diff --git a/pkgs/development/libraries/geis/default.nix b/pkgs/development/libraries/geis/default.nix
index 1c1d4cfe507b3..d282ec9b41a55 100644
--- a/pkgs/development/libraries/geis/default.nix
+++ b/pkgs/development/libraries/geis/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     sha256 = "1svhbjibm448ybq6gnjjzj0ak42srhihssafj0w402aj71lgaq4a";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=misleading-indentation -Wno-error=pointer-compare";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=misleading-indentation -Wno-error=pointer-compare";
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index 3f8215d19fc28..d2f741338c3ed 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  LDFLAGS = if stdenv.isSunOS then "-lm -lmd -lmp -luutil -lnvpair -lnsl -lidmap -lavl -lsec" else "";
+  env.LDFLAGS = lib.optionalString stdenv.isSunOS "-lm -lmd -lmp -luutil -lnvpair -lnsl -lidmap -lavl -lsec";
 
   configureFlags = [
      "--disable-csharp" "--with-xz"
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 08f7c9a4c7805..196c13acc8145 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -126,12 +126,15 @@ stdenv.mkDerivation rec {
     "-Ddevbindir=${placeholder "dev"}/bin"
   ];
 
-  NIX_CFLAGS_COMPILE = toString [
-    "-Wno-error=nonnull"
-    # Default for release buildtype but passed manually because
-    # we're using plain
-    "-DG_DISABLE_CAST_CHECKS"
-  ];
+  env = {
+    NIX_CFLAGS_COMPILE = "-Wno-error=nonnull" +
+      # Default for release buildtype but passed manually because
+      # we're using plain
+      " -DG_DISABLE_CAST_CHECKS";
+    LIBELF_CFLAGS = optionalString stdenv.isFreeBSD "-I${libelf}";
+    LIBELF_LIBS = optionalString stdenv.isFreeBSD "-L${libelf} -lelf";
+    DETERMINISTIC_BUILD = 1;
+  };
 
   hardeningDisable = [ "pie" ];
 
@@ -145,8 +148,6 @@ stdenv.mkDerivation rec {
     patchShebangs tests/gen-casemap-txt.py
   '';
 
-  DETERMINISTIC_BUILD = 1;
-
   postInstall = ''
     moveToOutput "share/glib-2.0" "$dev"
     substituteInPlace "$dev/bin/gdbus-codegen" --replace "$out" "$dev"
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 0108214a56ee3..725af055ca44c 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -41,6 +41,7 @@
 } @ args:
 
 let
+  inherit (lib) foldl recursiveUpdate;
   version = "2.32";
   patchSuffix = "-46";
   sha256 = "0di848ibffrnwq7g2dvgqrnn4xqhj3h96csn69q4da51ymafl9qn";
@@ -49,7 +50,7 @@ in
 assert withLinuxHeaders -> linuxHeaders != null;
 assert withGd -> gd != null && libpng != null;
 
-stdenv.mkDerivation ({
+stdenv.mkDerivation (foldl recursiveUpdate {} [ {
   inherit version;
   linuxHeaders = if withLinuxHeaders then linuxHeaders else null;
 
@@ -174,7 +175,7 @@ stdenv.mkDerivation ({
     "OBJCOPY=${stdenv.cc.targetPrefix}objcopy"
   ];
 
-  installFlags = [ "sysconfdir=$(out)/etc" ];
+  installFlags = [ "sysconfdir=${placeholder "out"}/etc" ];
 
   outputs = [ "out" "bin" "dev" "static" ];
 
@@ -185,12 +186,12 @@ stdenv.mkDerivation ({
   # Needed to install share/zoneinfo/zone.tab.  Set to impure /bin/sh to
   # prevent a retained dependency on the bootstrap tools in the stdenv-linux
   # bootstrap.
-  BASH_SHELL = "/bin/sh";
+  env.BASH_SHELL = "/bin/sh";
 
   passthru = { inherit version; };
 }
 
-// (removeAttrs args [ "withLinuxHeaders" "withGd" ]) //
+(removeAttrs args [ "withLinuxHeaders" "withGd" ])
 
 {
   name = name + "-${version}${patchSuffix}";
@@ -215,7 +216,7 @@ stdenv.mkDerivation ({
     configureScript="`pwd`/../$sourceRoot/configure"
 
     ${lib.optionalString (stdenv.cc.libc != null)
-      ''makeFlags="$makeFlags BUILD_LDFLAGS=-Wl,-rpath,${stdenv.cc.libc}/lib OBJDUMP=${stdenv.cc.bintools.bintools}/bin/objdump"''
+      ''makeFlags+=("BUILD_LDFLAGS=-Wl,-rpath,${stdenv.cc.libc}/lib" "OBJDUMP=${stdenv.cc.bintools.bintools}/bin/objdump")''
     }
 
 
@@ -253,11 +254,11 @@ stdenv.mkDerivation ({
   } // meta;
 }
 
-// lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform) {
+(lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform) {
   preInstall = null; # clobber the native hook
 
   # To avoid a dependency on the build system 'bash'.
   preFixup = ''
     rm -f $bin/bin/{ldd,tzselect,catchsegv,xtrace}
   '';
-})
+}) ])
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index 9043c8fd0d4f3..decf06ef18ad6 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -24,7 +24,22 @@ callPackage ./common.nix { inherit stdenv; } {
     # (For example, if you define `patches = [...]` here, it will
     # override the patches in `common.nix`.)
 
-    NIX_NO_SELF_RPATH = true;
+    env = {
+      NIX_NO_SELF_RPATH = true;
+      NIX_CFLAGS_COMPILE = lib.concatStringsSep " "
+        (builtins.concatLists [
+          (lib.optionals withGd gdCflags)
+          # Fix -Werror build failure when building glibc with musl with GCC >= 8, see:
+          # https://github.com/NixOS/nixpkgs/pull/68244#issuecomment-544307798
+          (lib.optional stdenv.hostPlatform.isMusl "-Wno-error=attribute-alias")
+          (lib.optionals ((stdenv.hostPlatform != stdenv.buildPlatform) || stdenv.hostPlatform.isMusl) [
+            # Ignore "error: '__EI___errno_location' specifies less restrictive attributes than its target '__errno_location'"
+            # New warning as of GCC 9
+            # Same for musl: https://github.com/NixOS/nixpkgs/issues/78805
+            "-Wno-error=missing-attributes"
+          ])
+        ]);
+    };
 
     postConfigure = ''
       # Hack: get rid of the `-static' flag set by the bootstrap stdenv.
@@ -35,11 +50,15 @@ callPackage ./common.nix { inherit stdenv; } {
 
       export NIX_DONT_SET_RPATH=1
       unset CFLAGS
-
-      # Apparently --bindir is not respected.
-      makeFlagsArray+=("bindir=$bin/bin" "sbindir=$bin/sbin" "rootsbindir=$bin/sbin")
     '';
 
+    # Apparently --bindir is not respected.
+    makeFlags = [
+      "bindir=${placeholder "bin"}/bin"
+      "sbindir=${placeholder "bin"}/sbin"
+      "rootsbindir=${placeholder "bin"}/sbin"
+    ];
+
     # The stackprotector and fortify hardening flags are autodetected by glibc
     # and enabled by default if supported. Setting it for every gcc invocation
     # does not work.
@@ -48,20 +67,6 @@ callPackage ./common.nix { inherit stdenv; } {
     #      limit rebuilds by only disabling pie w/musl
       ++ lib.optional stdenv.hostPlatform.isMusl "pie";
 
-    NIX_CFLAGS_COMPILE = lib.concatStringsSep " "
-      (builtins.concatLists [
-        (lib.optionals withGd gdCflags)
-        # Fix -Werror build failure when building glibc with musl with GCC >= 8, see:
-        # https://github.com/NixOS/nixpkgs/pull/68244#issuecomment-544307798
-        (lib.optional stdenv.hostPlatform.isMusl "-Wno-error=attribute-alias")
-        (lib.optionals ((stdenv.hostPlatform != stdenv.buildPlatform) || stdenv.hostPlatform.isMusl) [
-          # Ignore "error: '__EI___errno_location' specifies less restrictive attributes than its target '__errno_location'"
-          # New warning as of GCC 9
-          # Same for musl: https://github.com/NixOS/nixpkgs/issues/78805
-          "-Wno-error=missing-attributes"
-        ])
-      ]);
-
     # When building glibc from bootstrap-tools, we need libgcc_s at RPATH for
     # any program we run, because the gcc will have been placed at a new
     # store path than that determined when built (as a source for the
diff --git a/pkgs/development/libraries/glibc/locales-builder.sh b/pkgs/development/libraries/glibc/locales-builder.sh
deleted file mode 100644
index d732e208fa22a..0000000000000
--- a/pkgs/development/libraries/glibc/locales-builder.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-# Glibc cannot have itself in its RPATH.
-export NIX_NO_SELF_RPATH=1
-
-source $stdenv/setup
-
-postConfigure() {
-    # Hack: get rid of the `-static' flag set by the bootstrap stdenv.
-    # This has to be done *after* `configure' because it builds some
-    # test binaries.
-    export NIX_CFLAGS_LINK=
-    export NIX_LDFLAGS_BEFORE=
-
-    export NIX_DONT_SET_RPATH=1
-    unset CFLAGS
-}
-
-genericBuild
diff --git a/pkgs/development/libraries/glibc/locales.nix b/pkgs/development/libraries/glibc/locales.nix
index 238cebf6209f8..4104c893015ba 100644
--- a/pkgs/development/libraries/glibc/locales.nix
+++ b/pkgs/development/libraries/glibc/locales.nix
@@ -13,10 +13,21 @@
 callPackage ./common.nix { inherit stdenv; } {
   name = "glibc-locales";
 
-  builder = ./locales-builder.sh;
-
   outputs = [ "out" ];
 
+  env.NIX_NO_SELF_RPATH = 1;
+
+  # Hack: get rid of the `-static' flag set by the bootstrap stdenv.
+  # This has to be done *after* `configure' because it builds some
+  # test binaries.
+  postConfigure = ''
+    export NIX_CFLAGS_LINK=
+    export NIX_LDFLAGS_BEFORE=
+
+    export NIX_DONT_SET_RPATH=1
+    unset CFLAGS
+  '';
+
   # Awful hack: `localedef' doesn't allow the path to `locale-archive'
   # to be overriden, but you *can* specify a prefix, i.e. it will use
   # <prefix>/<path-to-glibc>/lib/locale/locale-archive.  So we use
diff --git a/pkgs/development/libraries/glm/default.nix b/pkgs/development/libraries/glm/default.nix
index f5652a61c1de9..f40c24c9e5088 100644
--- a/pkgs/development/libraries/glm/default.nix
+++ b/pkgs/development/libraries/glm/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     cp ${gcc7PlatformPatch} glm/simd/platform.h
   '';
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-DGLM_COMPILER=0";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-DGLM_COMPILER=0";
 
   postInstall = ''
     mkdir -p $doc/share/doc/glm
diff --git a/pkgs/development/libraries/gnome-online-accounts/default.nix b/pkgs/development/libraries/gnome-online-accounts/default.nix
index 2d349181deeda..e015da4af1d13 100644
--- a/pkgs/development/libraries/gnome-online-accounts/default.nix
+++ b/pkgs/development/libraries/gnome-online-accounts/default.nix
@@ -81,7 +81,7 @@ stdenv.mkDerivation rec {
     webkitgtk
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   postPatch = ''
     chmod +x meson_post_install.py
diff --git a/pkgs/development/libraries/goocanvas/2.x.nix b/pkgs/development/libraries/goocanvas/2.x.nix
index c4df9f1f0fd7e..5c344a075a95e 100644
--- a/pkgs/development/libraries/goocanvas/2.x.nix
+++ b/pkgs/development/libraries/goocanvas/2.x.nix
@@ -19,8 +19,9 @@ in stdenv.mkDerivation rec {
   configureFlags = [
     "--disable-python"
   ];
-  PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_GIRDIR = "$(dev)/share/gir-1.0";
-  PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_TYPELIBDIR = "$(out)/lib/girepository-1.0";
+
+  env.PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_GIRDIR = "$(dev)/share/gir-1.0";
+  env.PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_TYPELIBDIR = "$(out)/lib/girepository-1.0";
 
   meta = with lib; {
     description = "Canvas widget for GTK based on the the Cairo 2D library";
diff --git a/pkgs/development/libraries/gperftools/default.nix b/pkgs/development/libraries/gperftools/default.nix
index bdb4e67f85feb..0fe826f7f0f3e 100644
--- a/pkgs/development/libraries/gperftools/default.nix
+++ b/pkgs/development/libraries/gperftools/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile.am --replace stdc++ c++
   '';
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin
     "-D_XOPEN_SOURCE";
 
   # some packages want to link to the static tcmalloc_minimal
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index 326e5da0812c9..84630b7129731 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
   # fit in the limit. https://github.com/NixOS/nix/pull/1085
     ++ lib.optionals stdenv.isDarwin [ "--disable-gpg-test" ];
 
-  NIX_CFLAGS_COMPILE = toString (
+  env.NIX_CFLAGS_COMPILE = toString (
     # qgpgme uses Q_ASSERT which retains build inputs at runtime unless
     # debugging is disabled
     lib.optional (qtbase != null) "-DQT_NO_DEBUG"
diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index 8a44c7bc13da9..0adb523e3bf0f 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     export LD_LIBRARY_PATH=$(pwd)''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
   '';
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=unknown-warning-option";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=unknown-warning-option";
 
   enableParallelBuilds = true;
 
diff --git a/pkgs/development/libraries/gsl/default.nix b/pkgs/development/libraries/gsl/default.nix
index 04c8bcbbbecc6..b571bdfaf1a1c 100644
--- a/pkgs/development/libraries/gsl/default.nix
+++ b/pkgs/development/libraries/gsl/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   # do not let -march=skylake to enable FMA (https://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html)
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isx86_64 "-mno-fma";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isx86_64 "-mno-fma";
 
   # https://lists.gnu.org/archive/html/bug-gsl/2015-11/msg00012.html
   doCheck = stdenv.hostPlatform.system != "i686-linux" && stdenv.hostPlatform.system != "aarch64-linux";
diff --git a/pkgs/development/libraries/gsl/gsl-1_16.nix b/pkgs/development/libraries/gsl/gsl-1_16.nix
index d266518757561..e304d495e5cec 100644
--- a/pkgs/development/libraries/gsl/gsl-1_16.nix
+++ b/pkgs/development/libraries/gsl/gsl-1_16.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   # do not let -march=skylake to enable FMA (https://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html)
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isx86_64 "-mno-fma";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isx86_64 "-mno-fma";
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 7e9095ef0edee..00fcc6d574432 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
     libjpeg
     tremor
     libGL
-  ] ++ lib.optional (!stdenv.isDarwin) [
+  ] ++ lib.optionals (!stdenv.isDarwin) [
     libvisual
   ] ++ lib.optionals stdenv.isDarwin [
     pango
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 86684893efd30..1d4bdbd8ddda5 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -143,11 +143,9 @@ stdenv.mkDerivation rec {
       scripts/extract-release-date-from-doap-file.py
   '';
 
-  NIX_LDFLAGS = [
-    # linking error on Darwin
-    # https://github.com/NixOS/nixpkgs/pull/70690#issuecomment-553694896
-    "-lncurses"
-  ];
+  # linking error on Darwin
+  # https://github.com/NixOS/nixpkgs/pull/70690#issuecomment-553694896
+  env.NIX_LDFLAGS = "-lncurses";
 
   # fails 1 tests with "Unexpected critical/warning: g_object_set_is_valid_property: object class 'GstRtpStorage' has no property named ''"
   doCheck = false;
diff --git a/pkgs/development/libraries/gtk-sharp/builder.sh b/pkgs/development/libraries/gtk-sharp/builder.sh
index 4b8f757540b55..8e4bd6332c8a7 100644
--- a/pkgs/development/libraries/gtk-sharp/builder.sh
+++ b/pkgs/development/libraries/gtk-sharp/builder.sh
@@ -1,3 +1,5 @@
+source .attrs.sh
+
 source $stdenv/setup
 
 genericBuild
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index f9b5d5f68b569..e14e2ad1be3a4 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -163,7 +163,7 @@ stdenv.mkDerivation rec {
 
   # These are the defines that'd you'd get with --enable-debug=minimum (default).
   # See: https://developer.gnome.org/gtk3/stable/gtk-building.html#extra-configuration-options
-  NIX_CFLAGS_COMPILE = "-DG_ENABLE_DEBUG -DG_DISABLE_CAST_CHECKS";
+  env.NIX_CFLAGS_COMPILE = "-DG_ENABLE_DEBUG -DG_DISABLE_CAST_CHECKS";
 
   postPatch = ''
     files=(
diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/development/libraries/gtk/4.x.nix
index 8791d24ad361a..44a6f684e9d4d 100644
--- a/pkgs/development/libraries/gtk/4.x.nix
+++ b/pkgs/development/libraries/gtk/4.x.nix
@@ -163,7 +163,7 @@ stdenv.mkDerivation rec {
 
   # These are the defines that'd you'd get with --enable-debug=minimum (default).
   # See: https://developer.gnome.org/gtk3/stable/gtk-building.html#extra-configuration-options
-  NIX_CFLAGS_COMPILE = "-DG_ENABLE_DEBUG -DG_DISABLE_CAST_CHECKS";
+  env.NIX_CFLAGS_COMPILE = "-DG_ENABLE_DEBUG -DG_DISABLE_CAST_CHECKS";
 
   postPatch = ''
     files=(
diff --git a/pkgs/development/libraries/hiredis/default.nix b/pkgs/development/libraries/hiredis/default.nix
index d4998b51592f0..6c38212ee3568 100644
--- a/pkgs/development/libraries/hiredis/default.nix
+++ b/pkgs/development/libraries/hiredis/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "01xnynm9d56a0alb5wxbfayakybm5pnr12icj9mqkn4xxihbnbgr";
   };
 
-  PREFIX = "\${out}";
+  env.PREFIX = "\${out}";
 
   meta = with lib; {
     homepage = "https://github.com/redis/hiredis";
diff --git a/pkgs/development/libraries/hspell/default.nix b/pkgs/development/libraries/hspell/default.nix
index 2a65afad809a8..be4e41230d415 100644
--- a/pkgs/development/libraries/hspell/default.nix
+++ b/pkgs/development/libraries/hspell/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     version = "1.1";
   };
 
-  PERL_USE_UNSAFE_INC = "1";
+  env.PERL_USE_UNSAFE_INC = "1";
 
   src = fetchurl {
     url = "${meta.homepage}${name}.tar.gz";
diff --git a/pkgs/development/libraries/http-parser/default.nix b/pkgs/development/libraries/http-parser/default.nix
index 9d1d23ede8b69..176d454621455 100644
--- a/pkgs/development/libraries/http-parser/default.nix
+++ b/pkgs/development/libraries/http-parser/default.nix
@@ -13,7 +13,7 @@ in stdenv.mkDerivation {
     sha256 = "1vda4dp75pjf5fcph73sy0ifm3xrssrmf927qd1x8g3q46z0cv6c";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
   patches = [ ./build-shared.patch ];
   makeFlags = [ "DESTDIR=" "PREFIX=$(out)" ];
   buildFlags = [ "library" ];
diff --git a/pkgs/development/libraries/hunspell/dictionaries.nix b/pkgs/development/libraries/hunspell/dictionaries.nix
index f1bcd4ad00c02..949714d3943c2 100644
--- a/pkgs/development/libraries/hunspell/dictionaries.nix
+++ b/pkgs/development/libraries/hunspell/dictionaries.nix
@@ -44,7 +44,6 @@ let
         maintainers = with maintainers; [ renzo ];
         platforms = platforms.all;
       };
-      phases = "unpackPhase patchPhase buildPhase installPhase";
       nativeBuildInputs = [ unzip ];
       buildInputs = [ bash coreutils which zip ];
       patchPhase = ''
@@ -88,7 +87,6 @@ let
         platforms = platforms.all;
       };
       nativeBuildInputs = [ unzip ];
-      phases = "unpackPhase installPhase";
       sourceRoot = ".";
       unpackCmd = ''
       unzip $src dictionaries/${dictFileName}.dic dictionaries/${dictFileName}.aff $readmeFile
@@ -128,7 +126,6 @@ let
         platforms = platforms.all;
       };
       nativeBuildInputs = [ unzip ];
-      phases = "unpackPhase installPhase";
       sourceRoot = ".";
       unpackCmd = ''
         unzip $src ${dictFileName}.dic ${dictFileName}.aff ${readmeFile}
@@ -157,7 +154,6 @@ let
         platforms = platforms.all;
       };
       nativeBuildInputs = [ unzip ];
-      phases = "unpackPhase installPhase";
       sourceRoot = ".";
       unpackCmd = ''
         unzip $src ${srcFileName}.dic ${srcFileName}.aff ${srcReadmeFile}
@@ -184,7 +180,6 @@ let
         platforms = platforms.all;
       };
       nativeBuildInputs = [ unzip ];
-      phases = "unpackPhase patchPhase installPhase";
       sourceRoot = ".";
       prePatch = ''
         # Fix dic file empty lines (FS#22275)
@@ -203,7 +198,6 @@ let
 
       inherit srcs;
 
-      phases = ["unpackPhase" "installPhase"];
       sourceRoot = ".";
       # Copy files stripping until first dash (path and hash)
       unpackCmd = "cp $curSrc \${curSrc##*-}";
@@ -241,7 +235,6 @@ let
 
       buildInputs = [ ispell perl hunspell ];
 
-      phases = ["unpackPhase" "installPhase"];
       installPhase = ''
         patchShebangs bin
         make hunspell/${dictFileName}.aff hunspell/${dictFileName}.dic
diff --git a/pkgs/development/libraries/incrtcl/default.nix b/pkgs/development/libraries/incrtcl/default.nix
index 67ae5623db120..5235c5efc3ddd 100644
--- a/pkgs/development/libraries/incrtcl/default.nix
+++ b/pkgs/development/libraries/incrtcl/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   '';
 
   preConfigure = ''
-    configureFlags="--exec_prefix=$prefix $configureFlags"
+    configureFlags+=("--exec_prefix=$prefix")
   '';
 
   postInstall = ''
diff --git a/pkgs/development/libraries/indicator-application/gtk3.nix b/pkgs/development/libraries/indicator-application/gtk3.nix
index 8947e33e9001a..606a23368cf6b 100644
--- a/pkgs/development/libraries/indicator-application/gtk3.nix
+++ b/pkgs/development/libraries/indicator-application/gtk3.nix
@@ -38,8 +38,8 @@ stdenv.mkDerivation rec {
     "localstatedir=\${TMPDIR}"
   ];
 
-  PKG_CONFIG_SYSTEMD_SYSTEMDUSERUNITDIR = "$(out)/lib/systemd/user";
-  PKG_CONFIG_INDICATOR3_0_4_INDICATORDIR = "$(out)/lib/indicators3/7/";
+  env.PKG_CONFIG_SYSTEMD_SYSTEMDUSERUNITDIR = "$(out)/lib/systemd/user";
+  env.PKG_CONFIG_INDICATOR3_0_4_INDICATORDIR = "$(out)/lib/indicators3/7/";
 
   # Upstart is not used in NixOS
   postFixup = ''
diff --git a/pkgs/development/libraries/java/dbus-java/default.nix b/pkgs/development/libraries/java/dbus-java/default.nix
index 9fbcf8b020ced..af3da1316d6c5 100644
--- a/pkgs/development/libraries/java/dbus-java/default.nix
+++ b/pkgs/development/libraries/java/dbus-java/default.nix
@@ -7,12 +7,17 @@ stdenv.mkDerivation {
     url = "https://dbus.freedesktop.org/releases/dbus-java/dbus-java-2.7.tar.gz";
     sha256 = "0cyaxd8x6sxmi6pklkkx45j311a6w51fxl4jc5j3inc4cailwh5y";
   };
-  JAVA_HOME=jdk;
-  JAVA="${jdk}/bin/java";
-  PREFIX="\${out}";
-  JAVAUNIXLIBDIR="${libmatthew_java}/lib/jni";
-  JAVAUNIXJARDIR="${libmatthew_java}/share/java";
+
+  env = {
+    JAVA_HOME = toString jdk;
+    JAVA = "${jdk}/bin/java";
+    PREFIX = placeholder "out";
+    JAVAUNIXLIBDIR = "${libmatthew_java}/lib/jni";
+    JAVAUNIXJARDIR = "${libmatthew_java}/share/java";
+  };
+
   buildInputs = [ gettext jdk ];
+
   # I'm too lazy to build the documentation
   preBuild = ''
     sed -i -e "s|all: bin doc man|all: bin|" \
diff --git a/pkgs/development/libraries/java/gwt-dragdrop/builder.sh b/pkgs/development/libraries/java/gwt-dragdrop/builder.sh
deleted file mode 100644
index d37e110011e8b..0000000000000
--- a/pkgs/development/libraries/java/gwt-dragdrop/builder.sh
+++ /dev/null
@@ -1,4 +0,0 @@
-source $stdenv/setup
-
-mkdir -p $out/share/java
-cp $src $out/share/java/$name.jar
diff --git a/pkgs/development/libraries/java/gwt-dragdrop/default.nix b/pkgs/development/libraries/java/gwt-dragdrop/default.nix
index 34a0e8c530a47..4db4b74993f5f 100644
--- a/pkgs/development/libraries/java/gwt-dragdrop/default.nix
+++ b/pkgs/development/libraries/java/gwt-dragdrop/default.nix
@@ -2,13 +2,19 @@
 
 stdenv.mkDerivation {
   name = "gwt-dnd-2.6.5";
-  builder = ./builder.sh;
 
   src = fetchurl {
     url = "http://gwt-dnd.googlecode.com/files/gwt-dnd-2.6.5.jar";
     sha256 = "07zdlr8afs499asnw0dcjmw1cnjc646v91lflx5dv4qj374c97fw";
   };
 
+  dontUnpack = true;
+
+  installPhase = ''
+    mkdir -p $out/share/java
+    cp $src $out/share/java/$name.jar
+  '';
+
   meta = with lib; {
     platforms = platforms.unix;
     license = licenses.asl20;
diff --git a/pkgs/development/libraries/java/gwt-widgets/builder.sh b/pkgs/development/libraries/java/gwt-widgets/builder.sh
deleted file mode 100644
index 8c2502385f2b5..0000000000000
--- a/pkgs/development/libraries/java/gwt-widgets/builder.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-source $stdenv/setup
-
-tar xfvz $src
-cd gwt-widgets-*
-mkdir -p $out/share/java
-cp gwt-widgets-*.jar $out/share/java
diff --git a/pkgs/development/libraries/java/gwt-widgets/default.nix b/pkgs/development/libraries/java/gwt-widgets/default.nix
index 692326a218953..4e69d2e4300fd 100644
--- a/pkgs/development/libraries/java/gwt-widgets/default.nix
+++ b/pkgs/development/libraries/java/gwt-widgets/default.nix
@@ -2,13 +2,21 @@
 
 stdenv.mkDerivation {
   name = "gwt-widgets-0.2.0";
-  builder = ./builder.sh;
 
   src = fetchurl {
     url = "mirror://sourceforge/gwt-widget/gwt-widgets-0.2.0-bin.tar.gz";
     sha256 = "09isj4j6842rj13nv8264irkjjhvmgihmi170ciabc98911bakxb";
   };
 
+  dontUnpack = true;
+
+  installPhase = ''
+    tar xfvz $src
+    cd gwt-widgets-*
+    mkdir -p $out/share/java
+    cp gwt-widgets-*.jar $out/share/java
+  '';
+
   meta = with lib; {
     platforms = platforms.unix;
     license = with licenses; [ afl21 lgpl2 ];
diff --git a/pkgs/development/libraries/java/httpunit/builder.sh b/pkgs/development/libraries/java/httpunit/builder.sh
deleted file mode 100755
index 2738500829580..0000000000000
--- a/pkgs/development/libraries/java/httpunit/builder.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-source $stdenv/setup
-
-$unzip/bin/unzip $src
-mkdir $out
-mv $name/* $out/
diff --git a/pkgs/development/libraries/java/httpunit/default.nix b/pkgs/development/libraries/java/httpunit/default.nix
index ad276fcdd6364..053066d9c0218 100644
--- a/pkgs/development/libraries/java/httpunit/default.nix
+++ b/pkgs/development/libraries/java/httpunit/default.nix
@@ -2,14 +2,18 @@
 
 stdenv.mkDerivation {
   name = "httpunit-1.7";
-  builder = ./builder.sh;
 
   src = fetchurl {
     url = "mirror://sourceforge/httpunit/httpunit-1.7.zip";
     sha256 = "09gnayqgizd8cjqayvdpkxrc69ipyxawc96aznfrgdhdiwv8l5zf";
   };
 
-  inherit unzip;
+  nativeBuildInputs = [ unzip ];
+
+  installPhase = ''
+    mkdir $out
+    cp -rv * $out/
+  '';
 
   meta = with lib; {
     homepage = "http://httpunit.sourceforge.net";
diff --git a/pkgs/development/libraries/java/jdom/builder.sh b/pkgs/development/libraries/java/jdom/builder.sh
deleted file mode 100755
index dbec4b6f3e0e5..0000000000000
--- a/pkgs/development/libraries/java/jdom/builder.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-set -e
-source $stdenv/setup
-
-tar zxvf $src
-mkdir -p $out
-mv * $out
diff --git a/pkgs/development/libraries/java/jdom/default.nix b/pkgs/development/libraries/java/jdom/default.nix
index 4bb90dd98874b..64cca6a001b09 100644
--- a/pkgs/development/libraries/java/jdom/default.nix
+++ b/pkgs/development/libraries/java/jdom/default.nix
@@ -2,13 +2,20 @@
 
 stdenv.mkDerivation {
   name = "jdom-1.0";
-  builder = ./builder.sh;
 
   src = fetchurl {
     url = "http://www.jdom.org/dist/binary/jdom-1.0.tar.gz";
     sha256 = "1igmxzcy0s25zcy9vmcw0kd13lh60r0b4qg8lnp1jic33f427pxf";
   };
 
+  dontUnpack = true;
+
+  installPhase = ''
+    tar zxvf $src
+    mkdir -p $out
+    mv * $out
+  '';
+
   meta = with lib; {
     description = "Java-based solution for accessing, manipulating, and outputting XML data from Java code";
     homepage = "http://www.jdom.org";
diff --git a/pkgs/development/libraries/java/libmatthew-java/default.nix b/pkgs/development/libraries/java/libmatthew-java/default.nix
index a3cdaa37ed065..8b781f7c10deb 100644
--- a/pkgs/development/libraries/java/libmatthew-java/default.nix
+++ b/pkgs/development/libraries/java/libmatthew-java/default.nix
@@ -6,8 +6,12 @@ stdenv.mkDerivation {
     url = "https://src.fedoraproject.org/repo/pkgs/libmatthew-java/libmatthew-java-0.8.tar.gz/8455b8751083ce25c99c2840609271f5/libmatthew-java-0.8.tar.gz";
     sha256 = "1yldkhsdzm0a41a0i881bin2jklhp85y3ah245jd6fz3npcx7l85";
   };
-  JAVA_HOME=jdk;
-  PREFIX="\${out}";
+
+  env = {
+    JAVA_HOME = toString jdk;
+    PREFIX = placeholder "out";
+  };
+
   buildInputs = [ jdk ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/java/swt/default.nix b/pkgs/development/libraries/java/swt/default.nix
index bf35490f9a889..3865d87101f2d 100644
--- a/pkgs/development/libraries/java/swt/default.nix
+++ b/pkgs/development/libraries/java/swt/default.nix
@@ -38,7 +38,7 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ unzip pkg-config ];
   buildInputs = [ jdk gtk2 libXt libXtst libXi libGLU libGL webkitgtk libsoup ];
 
-  NIX_LFLAGS = toString (map (x: "-L${lib.getLib x}/lib") [ xorg.libX11 pango gdk-pixbuf glib ]) +
+  env.NIX_LFLAGS = toString (map (x: "-L${lib.getLib x}/lib") [ xorg.libX11 pango gdk-pixbuf glib ]) +
     " -lX11 -lpango-1.0 -lgdk_pixbuf-2.0 -lglib-2.0";
 
   buildPhase = ''
diff --git a/pkgs/development/libraries/kde-frameworks/default.nix b/pkgs/development/libraries/kde-frameworks/default.nix
index 94d403b9e343e..c2ac5b865e6d2 100644
--- a/pkgs/development/libraries/kde-frameworks/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/default.nix
@@ -55,7 +55,7 @@ let
                     # Propagate $dev so that this setup hook is propagated
                     # But only if there is a separate $dev output
                     if [ "''${outputDev:?}" != out ]; then
-                        propagatedBuildInputs="''${propagatedBuildInputs-} @dev@"
+                        propagatedBuildInputs+=("@dev@")
                     fi
                 fi
               '';
diff --git a/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/setup-hook.sh b/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/setup-hook.sh
index 4135f6bfd7aa3..6a709afb82ca0 100644
--- a/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/setup-hook.sh
+++ b/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/setup-hook.sh
@@ -6,49 +6,49 @@ addEnvHooks "$targetOffset" ecmEnvHook
 
 ecmPostHook() {
     # Because we need to use absolute paths here, we must set *all* the paths.
-    cmakeFlags+=" -DKDE_INSTALL_EXECROOTDIR=${!outputBin}"
-    cmakeFlags+=" -DKDE_INSTALL_BINDIR=${!outputBin}/bin"
-    cmakeFlags+=" -DKDE_INSTALL_SBINDIR=${!outputBin}/sbin"
-    cmakeFlags+=" -DKDE_INSTALL_LIBDIR=${!outputLib}/lib"
-    cmakeFlags+=" -DKDE_INSTALL_LIBEXECDIR=${!outputLib}/libexec"
-    cmakeFlags+=" -DKDE_INSTALL_CMAKEPACKAGEDIR=${!outputDev}/lib/cmake"
-    cmakeFlags+=" -DKDE_INSTALL_INCLUDEDIR=${!outputInclude}/include"
-    cmakeFlags+=" -DKDE_INSTALL_LOCALSTATEDIR=/var"
-    cmakeFlags+=" -DKDE_INSTALL_DATAROOTDIR=${!outputBin}/share"
-    cmakeFlags+=" -DKDE_INSTALL_DATADIR=${!outputBin}/share"
-    cmakeFlags+=" -DKDE_INSTALL_DOCBUNDLEDIR=${!outputBin}/share/doc/HTML"
-    cmakeFlags+=" -DKDE_INSTALL_KCFGDIR=${!outputBin}/share/config.kcfg"
-    cmakeFlags+=" -DKDE_INSTALL_KCONFUPDATEDIR=${!outputBin}/share/kconf_update"
-    cmakeFlags+=" -DKDE_INSTALL_KSERVICES5DIR=${!outputBin}/share/kservices5"
-    cmakeFlags+=" -DKDE_INSTALL_KSERVICETYPES5DIR=${!outputBin}/share/kservicetypes5"
-    cmakeFlags+=" -DKDE_INSTALL_KXMLGUI5DIR=${!outputBin}/share/kxmlgui5"
-    cmakeFlags+=" -DKDE_INSTALL_KNOTIFY5RCDIR=${!outputBin}/share/knotifications5"
-    cmakeFlags+=" -DKDE_INSTALL_ICONDIR=${!outputBin}/share/icons"
-    cmakeFlags+=" -DKDE_INSTALL_LOCALEDIR=${!outputLib}/share/locale"
-    cmakeFlags+=" -DKDE_INSTALL_SOUNDDIR=${!outputBin}/share/sounds"
-    cmakeFlags+=" -DKDE_INSTALL_TEMPLATEDIR=${!outputBin}/share/templates"
-    cmakeFlags+=" -DKDE_INSTALL_WALLPAPERDIR=${!outputBin}/share/wallpapers"
-    cmakeFlags+=" -DKDE_INSTALL_APPDIR=${!outputBin}/share/applications"
-    cmakeFlags+=" -DKDE_INSTALL_DESKTOPDIR=${!outputBin}/share/desktop-directories"
-    cmakeFlags+=" -DKDE_INSTALL_MIMEDIR=${!outputBin}/share/mime/packages"
-    cmakeFlags+=" -DKDE_INSTALL_METAINFODIR=${!outputBin}/share/appdata"
-    cmakeFlags+=" -DKDE_INSTALL_MANDIR=${!outputBin}/share/man"
-    cmakeFlags+=" -DKDE_INSTALL_INFODIR=${!outputBin}/share/info"
-    cmakeFlags+=" -DKDE_INSTALL_DBUSDIR=${!outputBin}/share/dbus-1"
-    cmakeFlags+=" -DKDE_INSTALL_DBUSINTERFACEDIR=${!outputBin}/share/dbus-1/interfaces"
-    cmakeFlags+=" -DKDE_INSTALL_DBUSSERVICEDIR=${!outputBin}/share/dbus-1/services"
-    cmakeFlags+=" -DKDE_INSTALL_DBUSSYSTEMSERVICEDIR=${!outputBin}/share/dbus-1/system-services"
-    cmakeFlags+=" -DKDE_INSTALL_SYSCONFDIR=${!outputBin}/etc"
-    cmakeFlags+=" -DKDE_INSTALL_CONFDIR=${!outputBin}/etc/xdg"
-    cmakeFlags+=" -DKDE_INSTALL_AUTOSTARTDIR=${!outputBin}/etc/xdg/autostart"
+    cmakeFlags+=("-DKDE_INSTALL_EXECROOTDIR=${!outputBin}")
+    cmakeFlags+=("-DKDE_INSTALL_BINDIR=${!outputBin}/bin")
+    cmakeFlags+=("-DKDE_INSTALL_SBINDIR=${!outputBin}/sbin")
+    cmakeFlags+=("-DKDE_INSTALL_LIBDIR=${!outputLib}/lib")
+    cmakeFlags+=("-DKDE_INSTALL_LIBEXECDIR=${!outputLib}/libexec")
+    cmakeFlags+=("-DKDE_INSTALL_CMAKEPACKAGEDIR=${!outputDev}/lib/cmake")
+    cmakeFlags+=("-DKDE_INSTALL_INCLUDEDIR=${!outputInclude}/include")
+    cmakeFlags+=("-DKDE_INSTALL_LOCALSTATEDIR=/var")
+    cmakeFlags+=("-DKDE_INSTALL_DATAROOTDIR=${!outputBin}/share")
+    cmakeFlags+=("-DKDE_INSTALL_DATADIR=${!outputBin}/share")
+    cmakeFlags+=("-DKDE_INSTALL_DOCBUNDLEDIR=${!outputBin}/share/doc/HTML")
+    cmakeFlags+=("-DKDE_INSTALL_KCFGDIR=${!outputBin}/share/config.kcfg")
+    cmakeFlags+=("-DKDE_INSTALL_KCONFUPDATEDIR=${!outputBin}/share/kconf_update")
+    cmakeFlags+=("-DKDE_INSTALL_KSERVICES5DIR=${!outputBin}/share/kservices5")
+    cmakeFlags+=("-DKDE_INSTALL_KSERVICETYPES5DIR=${!outputBin}/share/kservicetypes5")
+    cmakeFlags+=("-DKDE_INSTALL_KXMLGUI5DIR=${!outputBin}/share/kxmlgui5")
+    cmakeFlags+=("-DKDE_INSTALL_KNOTIFY5RCDIR=${!outputBin}/share/knotifications5")
+    cmakeFlags+=("-DKDE_INSTALL_ICONDIR=${!outputBin}/share/icons")
+    cmakeFlags+=("-DKDE_INSTALL_LOCALEDIR=${!outputLib}/share/locale")
+    cmakeFlags+=("-DKDE_INSTALL_SOUNDDIR=${!outputBin}/share/sounds")
+    cmakeFlags+=("-DKDE_INSTALL_TEMPLATEDIR=${!outputBin}/share/templates")
+    cmakeFlags+=("-DKDE_INSTALL_WALLPAPERDIR=${!outputBin}/share/wallpapers")
+    cmakeFlags+=("-DKDE_INSTALL_APPDIR=${!outputBin}/share/applications")
+    cmakeFlags+=("-DKDE_INSTALL_DESKTOPDIR=${!outputBin}/share/desktop-directories")
+    cmakeFlags+=("-DKDE_INSTALL_MIMEDIR=${!outputBin}/share/mime/packages")
+    cmakeFlags+=("-DKDE_INSTALL_METAINFODIR=${!outputBin}/share/appdata")
+    cmakeFlags+=("-DKDE_INSTALL_MANDIR=${!outputBin}/share/man")
+    cmakeFlags+=("-DKDE_INSTALL_INFODIR=${!outputBin}/share/info")
+    cmakeFlags+=("-DKDE_INSTALL_DBUSDIR=${!outputBin}/share/dbus-1")
+    cmakeFlags+=("-DKDE_INSTALL_DBUSINTERFACEDIR=${!outputBin}/share/dbus-1/interfaces")
+    cmakeFlags+=("-DKDE_INSTALL_DBUSSERVICEDIR=${!outputBin}/share/dbus-1/services")
+    cmakeFlags+=("-DKDE_INSTALL_DBUSSYSTEMSERVICEDIR=${!outputBin}/share/dbus-1/system-services")
+    cmakeFlags+=("-DKDE_INSTALL_SYSCONFDIR=${!outputBin}/etc")
+    cmakeFlags+=("-DKDE_INSTALL_CONFDIR=${!outputBin}/etc/xdg")
+    cmakeFlags+=("-DKDE_INSTALL_AUTOSTARTDIR=${!outputBin}/etc/xdg/autostart")
 
     if [ -n "${qtPluginPrefix-}" ]; then
-        cmakeFlags+=" -DKDE_INSTALL_QTPLUGINDIR=${!outputBin}/$qtPluginPrefix"
-        cmakeFlags+=" -DKDE_INSTALL_PLUGINDIR=${!outputBin}/$qtPluginPrefix"
+        cmakeFlags+=("-DKDE_INSTALL_QTPLUGINDIR=${!outputBin}/$qtPluginPrefix")
+        cmakeFlags+=("-DKDE_INSTALL_PLUGINDIR=${!outputBin}/$qtPluginPrefix")
     fi
 
     if [ -n "${qtQmlPrefix-}" ]; then
-        cmakeFlags+=" -DKDE_INSTALL_QMLDIR=${!outputBin}/$qtQmlPrefix"
+        cmakeFlags+=("-DKDE_INSTALL_QMLDIR=${!outputBin}/$qtQmlPrefix")
     fi
 }
 postHooks+=(ecmPostHook)
@@ -106,7 +106,7 @@ ecmHostPathHook() {
 
     if [ -d "$1/dbus-1" ]
     then
-        propagatedUserEnvPkgs+=" $1"
+        propagatedUserEnvPkgs+=("$1")
     fi
 }
 addEnvHooks "$targetOffset" ecmHostPathHook
diff --git a/pkgs/development/libraries/kde-frameworks/kimageformats.nix b/pkgs/development/libraries/kde-frameworks/kimageformats.nix
index 3d9c5851f2469..562cc9b40e93b 100644
--- a/pkgs/development/libraries/kde-frameworks/kimageformats.nix
+++ b/pkgs/development/libraries/kde-frameworks/kimageformats.nix
@@ -11,5 +11,5 @@ mkDerivation {
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ karchive openexr qtbase ];
   outputs = [ "out" ]; # plugins only
-  CXXFLAGS = "-I${getDev ilmbase}/include/OpenEXR";
+  env.CXXFLAGS = "-I${getDev ilmbase}/include/OpenEXR";
 }
diff --git a/pkgs/development/libraries/kde-frameworks/kinit/default.nix b/pkgs/development/libraries/kde-frameworks/kinit/default.nix
index 2a3a3dd5d1f09..4595d714450cb 100644
--- a/pkgs/development/libraries/kde-frameworks/kinit/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/kinit/default.nix
@@ -19,7 +19,7 @@ mkDerivation {
     ./0003-kdeinit-extra-libs.patch
     ./0004-start_kdeinit-environ-hard-limit.patch
   ];
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     ''-DNIXPKGS_KF5_KIOCORE=\"${getLib kio}/lib/libKF5KIOCore.so.5\"''
     ''-DNIXPKGS_KF5_PARTS=\"${getLib kparts}/lib/libKF5Parts.so.5\"''
     ''-DNIXPKGS_KF5_PLASMA=\"${getLib plasma-framework}/lib/libKF5Plasma.so.5\"''
diff --git a/pkgs/development/libraries/languagemachines/libfolia.nix b/pkgs/development/libraries/languagemachines/libfolia.nix
index fc5e622bcf4fb..3921bd6a067f1 100644
--- a/pkgs/development/libraries/languagemachines/libfolia.nix
+++ b/pkgs/development/libraries/languagemachines/libfolia.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
   preConfigure = "sh bootstrap.sh";
 
   # compat with icu61+ https://github.com/unicode-org/icu/blob/release-64-2/icu4c/readme.html#L554
-  CXXFLAGS = [ "-DU_USING_ICU_NAMESPACE=1" ];
+  env.CXXFLAGS = "-DU_USING_ICU_NAMESPACE=1";
 
   meta = with lib; {
     description = "A C++ API for FoLiA documents; an XML-based linguistic annotation format.";
diff --git a/pkgs/development/libraries/lcms2/default.nix b/pkgs/development/libraries/lcms2/default.nix
index 66bdcc03b9665..6bc081fa0cad0 100644
--- a/pkgs/development/libraries/lcms2/default.nix
+++ b/pkgs/development/libraries/lcms2/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ libtiff libjpeg zlib ];
 
   # See https://trac.macports.org/ticket/60656
-  LDFLAGS = if stdenv.hostPlatform.isDarwin then "-Wl,-w" else null;
+  env.LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-Wl,-w";
 
   meta = with lib; {
     description = "Color management engine";
diff --git a/pkgs/development/libraries/leatherman/default.nix b/pkgs/development/libraries/leatherman/default.nix
index 61d87211e0a5c..f329b021656a0 100644
--- a/pkgs/development/libraries/leatherman/default.nix
+++ b/pkgs/development/libraries/leatherman/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "puppetlabs";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ boost curl ruby ];
diff --git a/pkgs/development/libraries/libbluray/default.nix b/pkgs/development/libraries/libbluray/default.nix
index 3f90bb878adc9..5a336a782ae1c 100644
--- a/pkgs/development/libraries/libbluray/default.nix
+++ b/pkgs/development/libraries/libbluray/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = optional withAACS libaacs;
 
-  NIX_LDFLAGS = toString [
+  env.NIX_LDFLAGS = toString [
     (optionalString withAACS   "-L${libaacs}/lib -laacs")
     (optionalString withBDplus "-L${libbdplus}/lib -lbdplus")
   ];
diff --git a/pkgs/development/libraries/libcaca/default.nix b/pkgs/development/libraries/libcaca/default.nix
index f12409f271f92..4f51ddec42e48 100644
--- a/pkgs/development/libraries/libcaca/default.nix
+++ b/pkgs/development/libraries/libcaca/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     (if x11Support then "--enable-x11" else "--disable-x11")
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString (!x11Support) "-DX_DISPLAY_MISSING";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (!x11Support) "-DX_DISPLAY_MISSING";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libcdr/default.nix b/pkgs/development/libraries/libcdr/default.nix
index b987c3dbb25ac..7d55a9a48f268 100644
--- a/pkgs/development/libraries/libcdr/default.nix
+++ b/pkgs/development/libraries/libcdr/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  CXXFLAGS="--std=gnu++0x"; # For c++11 constants in lcms2.h
+  env.CXXFLAGS = "--std=gnu++0x"; # For c++11 constants in lcms2.h
 
   meta = {
     description = "A library providing ability to interpret and import Corel Draw drawings into various applications";
diff --git a/pkgs/development/libraries/libchop/default.nix b/pkgs/development/libraries/libchop/default.nix
index f02ac04621fc3..0239c0185b1f8 100644
--- a/pkgs/development/libraries/libchop/default.nix
+++ b/pkgs/development/libraries/libchop/default.nix
@@ -15,8 +15,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config gperf rpcsvc-proto ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
-  NIX_LDFLAGS = [ "-ltirpc" ];
+  env.NIX_CFLAGS_COMPILE = "-I${libtirpc.dev}/include/tirpc";
+  env.NIX_LDFLAGS = "-ltirpc";
 
   buildInputs =
     [ zlib bzip2 lzo
diff --git a/pkgs/development/libraries/libclxclient/default.nix b/pkgs/development/libraries/libclxclient/default.nix
index 0d39a5e55b261..40f259677ff4e 100644
--- a/pkgs/development/libraries/libclxclient/default.nix
+++ b/pkgs/development/libraries/libclxclient/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  NIX_CFLAGS_COMPILE = "-I${xorg.xorgproto}/include -I${libXft.dev}/include";
+  env.NIX_CFLAGS_COMPILE = "-I${xorg.xorgproto}/include -I${libXft.dev}/include";
 
   patchPhase = ''
     cd source
diff --git a/pkgs/development/libraries/libdiscid/default.nix b/pkgs/development/libraries/libdiscid/default.nix
index 3021aced93f6d..107fb822adb0b 100644
--- a/pkgs/development/libraries/libdiscid/default.nix
+++ b/pkgs/development/libraries/libdiscid/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "1f9irlj3dpb5gyfdnb1m4skbjvx4d4hwiz2152f83m0d9jn47r7r";
   };
 
-  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework CoreFoundation -framework IOKit";
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework CoreFoundation -framework IOKit";
 
   meta = with lib; {
     description = "A C library for creating MusicBrainz DiscIDs from audio CDs";
diff --git a/pkgs/development/libraries/libdv/default.nix b/pkgs/development/libraries/libdv/default.nix
index ff3c7f6f86313..1295a434431d8 100644
--- a/pkgs/development/libraries/libdv/default.nix
+++ b/pkgs/development/libraries/libdv/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   # This fixes an undefined symbol: _sched_setscheduler error on compile.
   # See the apple docs: http://cl.ly/2HeF bottom of the "Finding Imported Symbols" section
-  LDFLAGS = lib.optionalString stdenv.isDarwin "-undefined dynamic_lookup";
+  env.LDFLAGS = lib.optionalString stdenv.isDarwin "-undefined dynamic_lookup";
 
   configureFlags = [
     "--disable-asm"
diff --git a/pkgs/development/libraries/libdvdread/4.9.9.nix b/pkgs/development/libraries/libdvdread/4.9.9.nix
index 7049e1dd99358..52b7eb689bc73 100644
--- a/pkgs/development/libraries/libdvdread/4.9.9.nix
+++ b/pkgs/development/libraries/libdvdread/4.9.9.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   buildInputs = [libdvdcss];
 
-  NIX_LDFLAGS = "-ldvdcss";
+  env.NIX_LDFLAGS = "-ldvdcss";
 
   postInstall = ''
     ln -s dvdread $out/include/libdvdread
diff --git a/pkgs/development/libraries/libdvdread/default.nix b/pkgs/development/libraries/libdvdread/default.nix
index 32dfe4ee0fa5c..68e415dde1371 100644
--- a/pkgs/development/libraries/libdvdread/default.nix
+++ b/pkgs/development/libraries/libdvdread/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [libdvdcss];
 
-  NIX_LDFLAGS = "-ldvdcss";
+  env.NIX_LDFLAGS = "-ldvdcss";
 
   postInstall = ''
     ln -s dvdread $out/include/libdvdread
diff --git a/pkgs/development/libraries/libdynd/default.nix b/pkgs/development/libraries/libdynd/default.nix
index 4f1fd3904d98d..3484808b9ed73 100644
--- a/pkgs/development/libraries/libdynd/default.nix
+++ b/pkgs/development/libraries/libdynd/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
   ];
 
   # added to fix build with gcc7+
-  NIX_CFLAGS_COMPILE = builtins.toString [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=implicit-fallthrough"
     "-Wno-error=nonnull"
     "-Wno-error=tautological-compare"
diff --git a/pkgs/development/libraries/libe-book/default.nix b/pkgs/development/libraries/libe-book/default.nix
index f467a01ea7ab5..0c8712853b26a 100644
--- a/pkgs/development/libraries/libe-book/default.nix
+++ b/pkgs/development/libraries/libe-book/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation {
   src = fetchurl {
     inherit (s) url sha256;
   };
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
   meta = {
     inherit (s) version;
     description = "Library for import of reflowable e-book formats";
diff --git a/pkgs/development/libraries/libeatmydata/default.nix b/pkgs/development/libraries/libeatmydata/default.nix
index 70fab2da56884..7baab1fb42d8e 100644
--- a/pkgs/development/libraries/libeatmydata/default.nix
+++ b/pkgs/development/libraries/libeatmydata/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./find-shell-lib.patch ];
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   postPatch = ''
     substituteInPlace eatmydata.in \
diff --git a/pkgs/development/libraries/libf2c/default.nix b/pkgs/development/libraries/libf2c/default.nix
index ce1c35c7ec607..eb957ad529f61 100644
--- a/pkgs/development/libraries/libf2c/default.nix
+++ b/pkgs/development/libraries/libf2c/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     unzip ${src}
   '';
 
-  makeFlags = [ "-f" "makefile.u" ];
+  makeFlags = [ "-f makefile.u" ];
 
   installPhase = ''
     mkdir -p $out/include $out/lib
diff --git a/pkgs/development/libraries/libfakekey/default.nix b/pkgs/development/libraries/libfakekey/default.nix
index 3e568759c1bcb..6bb5f4de14cfc 100644
--- a/pkgs/development/libraries/libfakekey/default.nix
+++ b/pkgs/development/libraries/libfakekey/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libX11 libXi libXtst xorgproto ];
-  NIX_LDFLAGS = "-lX11";
+  env.NIX_LDFLAGS = "-lX11";
 
   meta = with lib; {
     description = "X virtual keyboard library";
diff --git a/pkgs/development/libraries/libfaketime/default.nix b/pkgs/development/libraries/libfaketime/default.nix
index 34c957715ddea..4f126cfd90dc7 100644
--- a/pkgs/development/libraries/libfaketime/default.nix
+++ b/pkgs/development/libraries/libfaketime/default.nix
@@ -26,10 +26,11 @@ stdenv.mkDerivation rec {
     substituteInPlace src/faketime.c --replace @DATE_CMD@ ${coreutils}/bin/date
   '';
 
-  PREFIX = placeholder "out";
-  LIBDIRNAME = "/lib";
-
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=cast-function-type -Wno-error=format-truncation";
+  env = {
+    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=cast-function-type -Wno-error=format-truncation";
+    PREFIX = placeholder "out";
+    LIBDIRNAME = "/lib";
+  };
 
   checkInputs = [ perl ];
 
diff --git a/pkgs/development/libraries/libfpx/default.nix b/pkgs/development/libraries/libfpx/default.nix
index 2576d426af555..e6d528dd453bf 100644
--- a/pkgs/development/libraries/libfpx/default.nix
+++ b/pkgs/development/libraries/libfpx/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   # Darwin gets misdetected as Windows without this
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-D__unix";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-D__unix";
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/development/libraries/libgaminggear/default.nix b/pkgs/development/libraries/libgaminggear/default.nix
index f059d6c73a2fd..f76a285be33cb 100644
--- a/pkgs/development/libraries/libgaminggear/default.nix
+++ b/pkgs/development/libraries/libgaminggear/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   ];
 
   # https://sourceforge.net/p/libgaminggear/discussion/general/thread/b43a776b3a/
-  NIX_CFLAGS_COMPILE = [ "-I${harfbuzz.dev}/include/harfbuzz" ];
+  env.NIX_CFLAGS_COMPILE = "-I${harfbuzz.dev}/include/harfbuzz";
 
   postFixup = ''
     moveToOutput bin "$bin"
diff --git a/pkgs/development/libraries/libgdiplus/default.nix b/pkgs/development/libraries/libgdiplus/default.nix
index 705205df396c9..bc7df2775af85 100644
--- a/pkgs/development/libraries/libgdiplus/default.nix
+++ b/pkgs/development/libraries/libgdiplus/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "1387lgph5r17viv3rkf5hbksdn435njzmra7s17q0nzk2mkkm68c";
   };
 
-  NIX_LDFLAGS = "-lgif";
+  env.NIX_LDFLAGS = "-lgif";
 
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/development/libraries/libglvnd/default.nix b/pkgs/development/libraries/libglvnd/default.nix
index 65d0651ed4151..9a9a45e1a731d 100644
--- a/pkgs/development/libraries/libglvnd/default.nix
+++ b/pkgs/development/libraries/libglvnd/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
       --replace "-Xlinker --version-script=$(VERSION_SCRIPT)" "-Xlinker"
   '';
 
-  NIX_CFLAGS_COMPILE = toString ([
+  env.NIX_CFLAGS_COMPILE = toString ([
     "-UDEFAULT_EGL_VENDOR_CONFIG_DIRS"
     # FHS paths are added so that non-NixOS applications can find vendor files.
     "-DDEFAULT_EGL_VENDOR_CONFIG_DIRS=\"${addOpenGLRunpath.driverLink}/share/glvnd/egl_vendor.d:/etc/glvnd/egl_vendor.d:/usr/share/glvnd/egl_vendor.d\""
diff --git a/pkgs/development/libraries/libguestfs/default.nix b/pkgs/development/libraries/libguestfs/default.nix
index 47f6ffe2c52f3..4b8a4e541c1f1 100644
--- a/pkgs/development/libraries/libguestfs/default.nix
+++ b/pkgs/development/libraries/libguestfs/default.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--disable-appliance" "--disable-daemon" "--with-distro=NixOS" ]
     ++ lib.optionals (!javaSupport) [ "--disable-java" "--without-java" ];
   patches = [ ./libguestfs-syms.patch ./ocaml-4.12.patch ];
-  NIX_CFLAGS_COMPILE="-I${libxml2.dev}/include/libxml2/";
+  env.NIX_CFLAGS_COMPILE="-I${libxml2.dev}/include/libxml2/";
   installFlags = [ "REALLY_INSTALL=yes" ];
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libhandy/default.nix b/pkgs/development/libraries/libhandy/default.nix
index 891bd04ea5439..8c8e8e870c00c 100644
--- a/pkgs/development/libraries/libhandy/default.nix
+++ b/pkgs/development/libraries/libhandy/default.nix
@@ -78,8 +78,8 @@ stdenv.mkDerivation rec {
   ];
 
   # Uses define_variable in pkg-config, but we still need it to use the glade output
-  PKG_CONFIG_GLADEUI_2_0_MODULEDIR = "${placeholder "glade"}/lib/glade/modules";
-  PKG_CONFIG_GLADEUI_2_0_CATALOGDIR = "${placeholder "glade"}/share/glade/catalogs";
+  env.PKG_CONFIG_GLADEUI_2_0_MODULEDIR = "${placeholder "glade"}/lib/glade/modules";
+  env.PKG_CONFIG_GLADEUI_2_0_CATALOGDIR = "${placeholder "glade"}/share/glade/catalogs";
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/libicns/default.nix b/pkgs/development/libraries/libicns/default.nix
index 1df2a8abb82cc..f121c7cb4d6ef 100644
--- a/pkgs/development/libraries/libicns/default.nix
+++ b/pkgs/development/libraries/libicns/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ libpng openjpeg ];
-  NIX_CFLAGS_COMPILE = [ "-I${openjpeg.dev}/include/${openjpeg.incDir}" ];
+  env.NIX_CFLAGS_COMPILE = "-I${openjpeg.dev}/include/${openjpeg.incDir}";
 
   meta = with lib; {
     description = "Library for manipulation of the Mac OS icns resource format";
diff --git a/pkgs/development/libraries/libiscsi/default.nix b/pkgs/development/libraries/libiscsi/default.nix
index adc721bc6d076..62e8d8cf49fc4 100644
--- a/pkgs/development/libraries/libiscsi/default.nix
+++ b/pkgs/development/libraries/libiscsi/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook ];
 
   # This problem is gone on libiscsi master.
-  NIX_CFLAGS_COMPILE = if stdenv.hostPlatform.is32bit then "-Wno-error=sign-compare" else null;
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.is32bit "-Wno-error=sign-compare";
 
   meta = with lib; {
     description = "iscsi client library and utilities";
diff --git a/pkgs/development/libraries/libjson-rpc-cpp/default.nix b/pkgs/development/libraries/libjson-rpc-cpp/default.nix
index e2dd30fc616ff..8e80b9bd84059 100644
--- a/pkgs/development/libraries/libjson-rpc-cpp/default.nix
+++ b/pkgs/development/libraries/libjson-rpc-cpp/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${catch2}/include/catch2";
+  env.NIX_CFLAGS_COMPILE = "-I${catch2}/include/catch2";
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/development/libraries/libmatchbox/default.nix b/pkgs/development/libraries/libmatchbox/default.nix
index 50b66eccfb3d6..fddf84033500f 100644
--- a/pkgs/development/libraries/libmatchbox/default.nix
+++ b/pkgs/development/libraries/libmatchbox/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libXft libICE pango libjpeg ];
   propagatedBuildInputs = [ libX11 libXext libpng ];
-  NIX_LDFLAGS = "-lX11";
+  env.NIX_LDFLAGS = "-lX11";
 
   src = fetchurl {
     url = "https://downloads.yoctoproject.org/releases/matchbox/libmatchbox/${version}/libmatchbox-${version}.tar.bz2";
diff --git a/pkgs/development/libraries/libmemcached/default.nix b/pkgs/development/libraries/libmemcached/default.nix
index 0ee0701d92904..b2fb1240beb01 100644
--- a/pkgs/development/libraries/libmemcached/default.nix
+++ b/pkgs/development/libraries/libmemcached/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
   buildInputs = [ libevent ];
   propagatedBuildInputs = [ cyrus_sasl ];
 
-  NIX_CFLAGS_COMPILE = "-fpermissive";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
 
   meta = with lib; {
     homepage = "https://libmemcached.org";
diff --git a/pkgs/development/libraries/libmikmod/default.nix b/pkgs/development/libraries/libmikmod/default.nix
index a734a4b800928..68f975d5fbac9 100644
--- a/pkgs/development/libraries/libmikmod/default.nix
+++ b/pkgs/development/libraries/libmikmod/default.nix
@@ -16,7 +16,7 @@ in stdenv.mkDerivation rec {
   propagatedBuildInputs =
     optional stdenv.isLinux libpulseaudio;
 
-  NIX_LDFLAGS = optionalString stdenv.isLinux "-lasound";
+  env.NIX_LDFLAGS = optionalString stdenv.isLinux "-lasound";
 
   meta = with lib; {
     description = "A library for playing tracker music module files";
diff --git a/pkgs/development/libraries/libnest2d/default.nix b/pkgs/development/libraries/libnest2d/default.nix
index 1e666758f816b..b15f3fa441948 100644
--- a/pkgs/development/libraries/libnest2d/default.nix
+++ b/pkgs/development/libraries/libnest2d/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ clipper nlopt boost ];
   nativeBuildInputs = [ cmake ];
 
-  CLIPPER_PATH = "${clipper.out}";
+  env.CLIPPER_PATH = "${clipper.out}";
   cmakeFlags = [ "-DLIBNEST2D_HEADER_ONLY=OFF" ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libnfs/default.nix b/pkgs/development/libraries/libnfs/default.nix
index 4e12553b00ba3..00424d41dbfe3 100644
--- a/pkgs/development/libraries/libnfs/default.nix
+++ b/pkgs/development/libraries/libnfs/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=tautological-compare";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=tautological-compare";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libnixxml/default.nix b/pkgs/development/libraries/libnixxml/default.nix
index 48edfbfce2c03..5c4fb801908cd 100644
--- a/pkgs/development/libraries/libnixxml/default.nix
+++ b/pkgs/development/libraries/libnixxml/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
   '';
 
   configureFlags = [ "--with-gd" "--with-glib" ];
-  CFLAGS = "-Wall";
+  env.CFLAGS = "-Wall";
 
   strictDeps = true;
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libomxil-bellagio/default.nix b/pkgs/development/libraries/libomxil-bellagio/default.nix
index 5e3b0c6798a64..fb9810a52bca9 100644
--- a/pkgs/development/libraries/libomxil-bellagio/default.nix
+++ b/pkgs/development/libraries/libomxil-bellagio/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   # Fix for #40213, probably permanent, because upstream doesn't seem to be
   # developed anymore. Alternatively, gcc7Stdenv could be used.
-  NIX_CFLAGS_COMPILE = "-Wno-error=array-bounds -Wno-error=stringop-overflow=8";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=array-bounds -Wno-error=stringop-overflow=8";
 
   meta = with lib; {
     homepage = "https://sourceforge.net/projects/omxil/";
diff --git a/pkgs/development/libraries/liboping/default.nix b/pkgs/development/libraries/liboping/default.nix
index c309c70e3d3b0..76f3672d5fdb8 100644
--- a/pkgs/development/libraries/liboping/default.nix
+++ b/pkgs/development/libraries/liboping/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "1n2wkmvw6n80ybdwkjq8ka43z2x8mvxq49byv61b52iyz69slf7b";
   };
 
-  NIX_CFLAGS_COMPILE = lib.optionalString
+  env.NIX_CFLAGS_COMPILE = lib.optionalString
     stdenv.cc.isGNU "-Wno-error=format-truncation";
 
   buildInputs = [ ncurses perl ];
diff --git a/pkgs/development/libraries/libpam-wrapper/default.nix b/pkgs/development/libraries/libpam-wrapper/default.nix
index 7d026eb5a0915..6088fa4ba0c38 100644
--- a/pkgs/development/libraries/libpam-wrapper/default.nix
+++ b/pkgs/development/libraries/libpam-wrapper/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     sha256 = "00mqhsashx7njrvxz085d0b88nizhdy7m3x17ip5yhvwsl63km6p";
   };
 
-  nativeBuildInputs = [ cmake ] ++ lib.optional enablePython [ python ];
+  nativeBuildInputs = [ cmake ] ++ lib.optional enablePython python;
 
   # We must use linux-pam, using openpam will result in broken fprintd.
   buildInputs = [ linux-pam ];
diff --git a/pkgs/development/libraries/libpar2/default.nix b/pkgs/development/libraries/libpar2/default.nix
index 625e780d1921f..3ae0be6985718 100644
--- a/pkgs/development/libraries/libpar2/default.nix
+++ b/pkgs/development/libraries/libpar2/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./libpar2-0.4-external-verification.patch ];
 
-  CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
+  env.CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
 
   meta = {
     homepage = "http://parchive.sourceforge.net/";
diff --git a/pkgs/development/libraries/libpfm/default.nix b/pkgs/development/libraries/libpfm/default.nix
index 20c4c0a1c6e2a..b05bad9fb2752 100644
--- a/pkgs/development/libraries/libpfm/default.nix
+++ b/pkgs/development/libraries/libpfm/default.nix
@@ -2,7 +2,7 @@
 , enableShared ? !stdenv.hostPlatform.isStatic
 }:
 
-stdenv.mkDerivation (rec {
+stdenv.mkDerivation (lib.recursiveUpdate rec {
   version = "4.11.0";
   pname = "libpfm";
 
@@ -18,7 +18,7 @@ stdenv.mkDerivation (rec {
     "SYS=${stdenv.hostPlatform.uname.system}"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   meta = with lib; {
     description = "Helper library to program the performance monitoring events";
@@ -32,8 +32,6 @@ stdenv.mkDerivation (rec {
     maintainers = [ maintainers.pierron ];
     platforms = platforms.linux;
   };
-} // lib.optionalAttrs ( ! enableShared )
-{
-  CONFIG_PFMLIB_SHARED = "n";
-}
-)
+} (lib.optionalAttrs (!enableShared) {
+  env.CONFIG_PFMLIB_SHARED = "n";
+}))
diff --git a/pkgs/development/libraries/libqtav/default.nix b/pkgs/development/libraries/libqtav/default.nix
index fc577d7e50820..fe16b7429f92d 100644
--- a/pkgs/development/libraries/libqtav/default.nix
+++ b/pkgs/development/libraries/libqtav/default.nix
@@ -30,7 +30,7 @@ mkDerivation rec {
   # Make sure libqtav finds its libGL dependency at both link and run time
   # by adding libGL to rpath. Not sure why it wasn't done automatically like
   # the other libraries as `libGL` is part of our `buildInputs`.
-  NIX_CFLAGS_LINK = "-Wl,-rpath,${libGL}/lib";
+  env.NIX_CFLAGS_LINK = "-Wl,-rpath,${libGL}/lib";
 
   preFixup = ''
     mkdir -p "$out/bin"
diff --git a/pkgs/development/libraries/librdf/redland.nix b/pkgs/development/libraries/librdf/redland.nix
index 731d1cf18684d..60355476c6c9c 100644
--- a/pkgs/development/libraries/librdf/redland.nix
+++ b/pkgs/development/libraries/librdf/redland.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     ];
 
   # Fix broken DT_NEEDED in lib/redland/librdf_storage_sqlite.so.
-  NIX_CFLAGS_LINK = "-lraptor2";
+  env.NIX_CFLAGS_LINK = "-lraptor2";
 
   doCheck = false; # fails 1 out of 17 tests with a segmentation fault
 
diff --git a/pkgs/development/libraries/librsb/default.nix b/pkgs/development/libraries/librsb/default.nix
index ef8b9ee441d30..1c75d469bc760 100644
--- a/pkgs/development/libraries/librsb/default.nix
+++ b/pkgs/development/libraries/librsb/default.nix
@@ -39,8 +39,8 @@ stdenv.mkDerivation rec {
   ];
 
   # Ensure C/Fortran code is position-independent.
-  NIX_CFLAGS_COMPILE = [ "-fPIC" "-Ofast" ];
-  FCFLAGS = [ "-fPIC" "-Ofast" ];
+  env.NIX_CFLAGS_COMPILE = "-fPIC -Ofast";
+  env.FCFLAGS = "-fPIC -Ofast";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libsndfile/default.nix b/pkgs/development/libraries/libsndfile/default.nix
index 61e6d9cd7652c..2dcb157f19df7 100644
--- a/pkgs/development/libraries/libsndfile/default.nix
+++ b/pkgs/development/libraries/libsndfile/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     '';
 
   # Needed on Darwin.
-  NIX_CFLAGS_LINK = "-logg -lvorbis";
+  env.NIX_CFLAGS_LINK = "-logg -lvorbis";
 
   meta = with lib; {
     description = "A C library for reading and writing files containing sampled sound";
diff --git a/pkgs/development/libraries/libsoundio/default.nix b/pkgs/development/libraries/libsoundio/default.nix
index ac9f3b2565463..f59aba5130492 100644
--- a/pkgs/development/libraries/libsoundio/default.nix
+++ b/pkgs/development/libraries/libsoundio/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional stdenv.isLinux alsaLib
     ++ lib.optional stdenv.isDarwin AudioUnit;
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-strict-prototypes";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-strict-prototypes";
 
   meta = with lib; {
     description = "Cross platform audio input and output";
diff --git a/pkgs/development/libraries/libsoup/default.nix b/pkgs/development/libraries/libsoup/default.nix
index fc805b2db9ec4..801ed59641a17 100644
--- a/pkgs/development/libraries/libsoup/default.nix
+++ b/pkgs/development/libraries/libsoup/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ meson ninja pkg-config gobject-introspection vala glib ];
   propagatedBuildInputs = [ glib libxml2 ];
 
-  NIX_CFLAGS_COMPILE = [ "-lpthread" ];
+  env.NIX_CFLAGS_COMPILE = "-lpthread";
 
   mesonFlags = [
     "-Dtls_check=false" # glib-networking is a runtime dependency, not a compile-time dependency
diff --git a/pkgs/development/libraries/libspatialite/default.nix b/pkgs/development/libraries/libspatialite/default.nix
index 2e9dadf0bf5d8..47c2415551eae 100644
--- a/pkgs/development/libraries/libspatialite/default.nix
+++ b/pkgs/development/libraries/libspatialite/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  CFLAGS = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H=1";
+  env.CFLAGS = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H=1";
 
   postInstall = "" + optionalString stdenv.isDarwin ''
     ln -s $out/lib/mod_spatialite.{so,dylib}
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index 46c13bbe4a9dc..41a016ce6af29 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -19,9 +19,7 @@ stdenv.mkDerivation rec {
     sha256 = "1jrkjv0xya9radddn8idxvs2gqzp3l2b1s8knlizmn7ad3jq817b";
   };
 
-  cmakeFlags = if stdenv.isDarwin then [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
-  ] else null;
+  cmakeFlags = lib.optional stdenv.isDarwin "-DCMAKE_SKIP_BUILD_RPATH=OFF";
 
   # FreeImage needs this patch
   patches = [ ./headers.patch ];
diff --git a/pkgs/development/libraries/libtoxcore/new-api.nix b/pkgs/development/libraries/libtoxcore/new-api.nix
index 77119e2830fed..bff49cf02cf05 100644
--- a/pkgs/development/libraries/libtoxcore/new-api.nix
+++ b/pkgs/development/libraries/libtoxcore/new-api.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "0ap1gvlyihnfivv235dbrgsxsiiz70bhlmlr5gn1027w3h5kqz8w";
   };
 
-  NIX_LDFLAGS = "-lgcc_s";
+  env.NIX_LDFLAGS = "-lgcc_s";
 
   postPatch = ''
     # within Nix chroot builds, localhost is unresolvable
diff --git a/pkgs/development/libraries/libunique/default.nix b/pkgs/development/libraries/libunique/default.nix
index 82f71f59070ce..13dc13e5e968e 100644
--- a/pkgs/development/libraries/libunique/default.nix
+++ b/pkgs/development/libraries/libunique/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   '';
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   # Patches from Gentoo portage
   patches = [
diff --git a/pkgs/development/libraries/libunistring/default.nix b/pkgs/development/libraries/libunistring/default.nix
index f7a77832c1831..ab2a5bd97703a 100644
--- a/pkgs/development/libraries/libunistring/default.nix
+++ b/pkgs/development/libraries/libunistring/default.nix
@@ -18,9 +18,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = lib.optional (!stdenv.isLinux) libiconv;
 
-  configureFlags = [
-    "--with-libiconv-prefix=${libiconv}"
-  ];
+  configureFlags = lib.optional (!stdenv.isLinux) "--with-libiconv-prefix=${libiconv}";
 
   doCheck = false;
 
diff --git a/pkgs/development/libraries/libvdpau/default.nix b/pkgs/development/libraries/libvdpau/default.nix
index 75dcd337c38bb..3e549e27ae483 100644
--- a/pkgs/development/libraries/libvdpau/default.nix
+++ b/pkgs/development/libraries/libvdpau/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   mesonFlags = lib.optional stdenv.isLinux
     [ "-Dmoduledir=${mesa.drivers.driverLink}/lib/vdpau" ];
 
-  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-lX11";
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-lX11";
 
   meta = with lib; {
     homepage = "https://people.freedesktop.org/~aplattner/vdpau/";
diff --git a/pkgs/development/libraries/libvirt/5.9.0.nix b/pkgs/development/libraries/libvirt/5.9.0.nix
index c8ad0e7e6030a..1646cd7e60b21 100644
--- a/pkgs/development/libraries/libvirt/5.9.0.nix
+++ b/pkgs/development/libraries/libvirt/5.9.0.nix
@@ -121,7 +121,7 @@ in stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = "-fno-stack-protector";
+  env.NIX_CFLAGS_COMPILE = "-fno-stack-protector";
 
   meta = {
     homepage = "http://libvirt.org/";
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index 28b67a801989b..3092c45e89a17 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -54,11 +54,10 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     ninja meson cmake makeWrapper pkg-config docutils
-  ] ++ optional (!stdenv.isDarwin) [
+  ] ++ optional (!stdenv.isDarwin)
     rpcsvc-proto
-  ] ++ optionals stdenv.isDarwin [
-    darwin.developer_cmds # needed for rpcgen
-  ];
+  ++ optional stdenv.isDarwin
+    darwin.developer_cmds; # needed for rpcgen
 
   buildInputs = [
     bash-completion pkg-config
diff --git a/pkgs/development/libraries/libvpx/1_8.nix b/pkgs/development/libraries/libvpx/1_8.nix
index f1a2bf377cc08..be6924dd2cb59 100644
--- a/pkgs/development/libraries/libvpx/1_8.nix
+++ b/pkgs/development/libraries/libvpx/1_8.nix
@@ -165,9 +165,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ ]
     ++ optionals unitTestsSupport [ coreutils curl ];
 
-  NIX_LDFLAGS = [
-    "-lpthread" # fixes linker errors
-  ];
+  env.NIX_LDFLAGS = "-lpthread"; # fixes linker errors
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libvpx/default.nix b/pkgs/development/libraries/libvpx/default.nix
index f19183966163c..56a45c733f77f 100644
--- a/pkgs/development/libraries/libvpx/default.nix
+++ b/pkgs/development/libraries/libvpx/default.nix
@@ -161,9 +161,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ ]
     ++ optionals unitTestsSupport [ coreutils curl ];
 
-  NIX_LDFLAGS = [
-    "-lpthread" # fixes linker errors
-  ];
+  env.NIX_LDFLAGS = "-lpthread"; # fixes linker errors
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libwebsockets/default.nix b/pkgs/development/libraries/libwebsockets/default.nix
index c62aa77c61a94..c69c411c829ce 100644
--- a/pkgs/development/libraries/libwebsockets/default.nix
+++ b/pkgs/development/libraries/libwebsockets/default.nix
@@ -22,7 +22,7 @@ let
       "-DLWS_WITH_SOCKS5=ON"
     ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "-DLWS_WITHOUT_TESTAPPS=ON";
 
-    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=unused-but-set-variable";
+    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=unused-but-set-variable";
 
     meta = with lib; {
       description = "Light, portable C library for websockets";
diff --git a/pkgs/development/libraries/libwhereami/default.nix b/pkgs/development/libraries/libwhereami/default.nix
index d0dd593a03dd0..3ad1f7916017e 100644
--- a/pkgs/development/libraries/libwhereami/default.nix
+++ b/pkgs/development/libraries/libwhereami/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "puppetlabs";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/libraries/libwps/default.nix b/pkgs/development/libraries/libwps/default.nix
index 7dd7153bae9f3..1714ae2f6bf39 100644
--- a/pkgs/development/libraries/libwps/default.nix
+++ b/pkgs/development/libraries/libwps/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ boost librevenge zlib ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-fallthrough";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-fallthrough";
 
   meta = with lib; {
     homepage = "http://libwps.sourceforge.net/";
diff --git a/pkgs/development/libraries/mapbox-gl-native/default.nix b/pkgs/development/libraries/mapbox-gl-native/default.nix
index c71bf17a3c777..d203dfc996351 100644
--- a/pkgs/development/libraries/mapbox-gl-native/default.nix
+++ b/pkgs/development/libraries/mapbox-gl-native/default.nix
@@ -45,7 +45,7 @@ mkDerivation rec {
     "-DMBGL_WITH_QT_LIB_ONLY=ON"
     "-DMBGL_WITH_QT_HEADLESS=OFF"
   ];
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations -Wno-error=type-limits";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations -Wno-error=type-limits";
 
   meta = with lib; {
     description = "Interactive, thoroughly customizable maps in native Android, iOS, macOS, Node.js, and Qt applications, powered by vector tiles and OpenGL";
diff --git a/pkgs/development/libraries/mapbox-gl-qml/default.nix b/pkgs/development/libraries/mapbox-gl-qml/default.nix
index 87e7657662270..8cd9ccd1eee97 100644
--- a/pkgs/development/libraries/mapbox-gl-qml/default.nix
+++ b/pkgs/development/libraries/mapbox-gl-qml/default.nix
@@ -29,7 +29,7 @@ mkDerivation rec {
   '';
 
   # Package expects qt5 subdirectory of mapbox-gl-native to be in the include path
-  NIX_CFLAGS_COMPILE = "-I${mapbox-gl-native}/include/qt5";
+  env.NIX_CFLAGS_COMPILE = "-I${mapbox-gl-native}/include/qt5";
 
   meta = with lib; {
     description = "Unofficial Mapbox GL Native bindings for Qt QML";
diff --git a/pkgs/development/libraries/mbedtls/default.nix b/pkgs/development/libraries/mbedtls/default.nix
index 90e2c9bd9a735..805e664e8bcc0 100644
--- a/pkgs/development/libraries/mbedtls/default.nix
+++ b/pkgs/development/libraries/mbedtls/default.nix
@@ -34,10 +34,8 @@ stdenv.mkDerivation rec {
   '';
 
   cmakeFlags = [ "-DUSE_SHARED_MBEDTLS_LIBRARY=on" ];
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
-    "-Wno-error=format"
-    "-Wno-error=format-truncation"
-  ];
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU
+    "-Wno-error=format -Wno-error=format-truncation";
 
   meta = with lib; {
     homepage = "https://tls.mbed.org/";
diff --git a/pkgs/development/libraries/mediastreamer/default.nix b/pkgs/development/libraries/mediastreamer/default.nix
index ea164dd481d3b..94a4b6c385cca 100644
--- a/pkgs/development/libraries/mediastreamer/default.nix
+++ b/pkgs/development/libraries/mediastreamer/default.nix
@@ -92,14 +92,14 @@ stdenv.mkDerivation rec {
   # Do not build static libraries
   cmakeFlags = [ "-DENABLE_STATIC=NO" ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-DGIT_VERSION=\"v${version}\""
     "-Wno-error=deprecated-declarations"
     "-Wno-error=cast-function-type"
     "-Wno-error=stringop-truncation"
     "-Wno-error=stringop-overflow"
   ];
-  NIX_LDFLAGS = "-lXext";
+  env.NIX_LDFLAGS = "-lXext";
 
   meta = with lib; {
     description = "A powerful and lightweight streaming engine specialized for voice/video telephony applications";
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 743080ee82eab..a799b74f8c72b 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -210,7 +210,7 @@ self = stdenv.mkDerivation {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-fno-common";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-fno-common";
 
   passthru = {
     inherit libdrm;
diff --git a/pkgs/development/libraries/mlt/qt-5.nix b/pkgs/development/libraries/mlt/qt-5.nix
index 5a4b6e34e9dcc..49641896b6a8a 100644
--- a/pkgs/development/libraries/mlt/qt-5.nix
+++ b/pkgs/development/libraries/mlt/qt-5.nix
@@ -71,9 +71,8 @@ mkDerivation rec {
 
   # mlt is unable to cope with our multi-prefix Qt build
   # because it does not use CMake or qmake.
-  NIX_CFLAGS_COMPILE = "-I${getDev qtsvg}/include/QtSvg";
-
-  CXXFLAGS = "-std=c++11";
+  env.NIX_CFLAGS_COMPILE = "-I${getDev qtsvg}/include/QtSvg";
+  env.CXXFLAGS = "-std=c++11";
 
   qtWrapperArgs = [
     "--prefix FREI0R_PATH : ${frei0r}/lib/frei0r-1"
diff --git a/pkgs/development/libraries/movit/default.nix b/pkgs/development/libraries/movit/default.nix
index 9c03a9f6c4913..b52f5401fb90a 100644
--- a/pkgs/development/libraries/movit/default.nix
+++ b/pkgs/development/libraries/movit/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  GTEST_DIR = "${gtest.src}/googletest";
+  env.GTEST_DIR = "${gtest.src}/googletest";
 
   propagatedBuildInputs = [ eigen epoxy ];
 
diff --git a/pkgs/development/libraries/mp4v2/default.nix b/pkgs/development/libraries/mp4v2/default.nix
index 7a6bbb552027d..c1040d9382f8c 100644
--- a/pkgs/development/libraries/mp4v2/default.nix
+++ b/pkgs/development/libraries/mp4v2/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     ./fix-build-clang.patch
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=narrowing" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=narrowing";
 
   # `faac' expects `mp4.h'.
   postInstall = "ln -s mp4v2/mp4v2.h $out/include/mp4.h";
diff --git a/pkgs/development/libraries/mps/default.nix b/pkgs/development/libraries/mps/default.nix
index 81b102d9bc362..3b67b8f3d99f0 100644
--- a/pkgs/development/libraries/mps/default.nix
+++ b/pkgs/development/libraries/mps/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ sqlite ];
 
   # needed for 1.116.0 to build with gcc7
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-implicit-fallthrough"
     "-Wno-error=clobbered"
     "-Wno-error=cast-function-type"
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 742de6cf92e75..2ec74c5975009 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     ];
 
   # Only the C compiler, and explicitly not C++ compiler needs this flag on solaris:
-  CFLAGS = lib.optionalString stdenv.isSunOS "-D_XOPEN_SOURCE_EXTENDED";
+  env.CFLAGS = lib.optionalString stdenv.isSunOS "-D_XOPEN_SOURCE_EXTENDED";
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/newt/default.nix b/pkgs/development/libraries/newt/default.nix
index dc6b604bd8e23..11836c8aca6f1 100644
--- a/pkgs/development/libraries/newt/default.nix
+++ b/pkgs/development/libraries/newt/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ slang popt python ];
 
-  NIX_LDFLAGS = "-lncurses";
+  env.NIX_LDFLAGS = "-lncurses";
 
   preConfigure = ''
     # If CPP is set explicitly, configure and make will not agree about which
diff --git a/pkgs/development/libraries/nss/3.53.nix b/pkgs/development/libraries/nss/3.53.nix
index 9f281743f6cf7..389271ebfe13b 100644
--- a/pkgs/development/libraries/nss/3.53.nix
+++ b/pkgs/development/libraries/nss/3.53.nix
@@ -97,7 +97,7 @@ in stdenv.mkDerivation rec {
     runHook postBuild
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\"";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\"";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index 962204268d7f2..a40556917835d 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -106,7 +106,7 @@ in stdenv.mkDerivation rec {
     runHook postBuild
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\"";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\"";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/development/libraries/ntrack/default.nix b/pkgs/development/libraries/ntrack/default.nix
index cb9f9ff575f83..d2d4e3c8d05cf 100644
--- a/pkgs/development/libraries/ntrack/default.nix
+++ b/pkgs/development/libraries/ntrack/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config python ];
 
   # error: ISO C does not support '__FUNCTION__' predefined identifier [-Werror=pedantic]
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   configureFlags = [ "--without-gobject" "CFLAGS=--std=gnu99" ];
 
diff --git a/pkgs/development/libraries/opae/default.nix b/pkgs/development/libraries/opae/default.nix
index cba7e7b285d99..de8139efd9f95 100644
--- a/pkgs/development/libraries/opae/default.nix
+++ b/pkgs/development/libraries/opae/default.nix
@@ -20,10 +20,7 @@ stdenv.mkDerivation rec {
 
   doCheck = false;
 
-  NIX_CFLAGS_COMPILE = [
-    "-Wno-error=format-truncation"
-    "-Wno-error=address-of-packed-member"
-  ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation -Wno-error=address-of-packed-member";
 
   nativeBuildInputs = [ cmake doxygen perl python2Packages.sphinx ];
   buildInputs = [ libuuid json_c python2 ];
diff --git a/pkgs/development/libraries/openal-soft/default.nix b/pkgs/development/libraries/openal-soft/default.nix
index 43c781cf52cef..a22989c976f43 100644
--- a/pkgs/development/libraries/openal-soft/default.nix
+++ b/pkgs/development/libraries/openal-soft/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     ++ optional pulseSupport libpulseaudio
     ++ optionals stdenv.isDarwin [ CoreServices AudioUnit AudioToolbox ];
 
-  NIX_LDFLAGS = toString ([]
+  env.NIX_LDFLAGS = toString ([]
     ++ optional alsaSupport "-lasound"
     ++ optional pulseSupport "-lpulse");
 
diff --git a/pkgs/development/libraries/opencv/3.x.nix b/pkgs/development/libraries/opencv/3.x.nix
index 33b1cd187571f..5784f4e18064b 100644
--- a/pkgs/development/libraries/opencv/3.x.nix
+++ b/pkgs/development/libraries/opencv/3.x.nix
@@ -210,7 +210,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake pkg-config unzip ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
 
   # Configure can't find the library without this.
   OpenBLAS_HOME = lib.optionalString enableOpenblas openblas;
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 58609a9186d67..ad02970665138 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -274,7 +274,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake pkg-config unzip ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
 
   # Configure can't find the library without this.
   OpenBLAS_HOME = lib.optionalString enableOpenblas openblas;
diff --git a/pkgs/development/libraries/opencv/default.nix b/pkgs/development/libraries/opencv/default.nix
index 005257780e40b..7167cff1e0441 100644
--- a/pkgs/development/libraries/opencv/default.nix
+++ b/pkgs/development/libraries/opencv/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkg-config unzip ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
 
   cmakeFlags = [
     (opencvFlag "TIFF" enableTIFF)
diff --git a/pkgs/development/libraries/openexrid-unstable/default.nix b/pkgs/development/libraries/openexrid-unstable/default.nix
index 47b2f6395478e..c9812434045b2 100644
--- a/pkgs/development/libraries/openexrid-unstable/default.nix
+++ b/pkgs/development/libraries/openexrid-unstable/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
         --replace g++ c++
   '';
 
-  NIX_CFLAGS_COMPILE=''-I${ilmbase.dev}/include/OpenEXR
+  env.NIX_CFLAGS_COMPILE=''-I${ilmbase.dev}/include/OpenEXR
                        -I${openexr.dev}/include/OpenEXR
                        -I${openfx.dev}/include/OpenFX
                       '';
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index fe4704341ef5c..86fe73514c6b1 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -44,9 +44,9 @@ stdenv.mkDerivation rec {
     ++ lib.optional stdenv.isFreeBSD "--with-pic";
 
   postBuild = ''
-    make $makeFlags CC=$CC -C contrib/slapd-modules/passwd/sha2
-    make $makeFlags CC=$CC -C contrib/slapd-modules/passwd/pbkdf2
-    make $makeFlags CC=$CC -C contrib/slapd-modules/passwd/argon2
+    make "''${makeFlags[@]}" CC=$CC -C contrib/slapd-modules/passwd/sha2
+    make "''${makeFlags[@]}" CC=$CC -C contrib/slapd-modules/passwd/pbkdf2
+    make "''${makeFlags[@]}" CC=$CC -C contrib/slapd-modules/passwd/argon2
   '';
 
   doCheck = false; # needs a running LDAP server
@@ -78,9 +78,9 @@ stdenv.mkDerivation rec {
   '';
 
   postInstall = ''
-    make $installFlags install -C contrib/slapd-modules/passwd/sha2
-    make $installFlags install -C contrib/slapd-modules/passwd/pbkdf2
-    make $installFlags install-lib -C contrib/slapd-modules/passwd/argon2
+    make "''${installFlags[@]}" install -C contrib/slapd-modules/passwd/sha2
+    make "''${installFlags[@]}" install -C contrib/slapd-modules/passwd/pbkdf2
+    make "''${installFlags[@]}" install -C contrib/slapd-modules/passwd/argon2
     chmod +x "$out"/lib/*.{so,dylib}
   '';
 
diff --git a/pkgs/development/libraries/openmpi/default.nix b/pkgs/development/libraries/openmpi/default.nix
index 2df08426368dc..674c1745b2268 100644
--- a/pkgs/development/libraries/openmpi/default.nix
+++ b/pkgs/development/libraries/openmpi/default.nix
@@ -49,7 +49,7 @@ in stdenv.mkDerivation rec {
     ++ lib.optionals cudaSupport [ cudatoolkit ]
     ++ [ libevent hwloc ]
     ++ lib.optional (isLinux || isFreeBSD) rdma-core
-    ++ lib.optional fabricSupport [ libpsm2 libfabric ];
+    ++ lib.optionals fabricSupport [ libpsm2 libfabric ];
 
   nativeBuildInputs = [ perl ];
 
diff --git a/pkgs/development/libraries/openvdb/default.nix b/pkgs/development/libraries/openvdb/default.nix
index 655d664d8fa63..c0e18a53d1d6c 100644
--- a/pkgs/development/libraries/openvdb/default.nix
+++ b/pkgs/development/libraries/openvdb/default.nix
@@ -37,8 +37,8 @@ stdenv.mkDerivation rec
 
   installFlags = [ "DESTDIR=$(out)" ];
 
-  NIX_CFLAGS_COMPILE="-I${openexr.dev}/include/OpenEXR -I${ilmbase.dev}/include/OpenEXR/";
-  NIX_LDFLAGS="-lboost_iostreams";
+  env.NIX_CFLAGS_COMPILE="-I${openexr.dev}/include/OpenEXR -I${ilmbase.dev}/include/OpenEXR/";
+  env.NIX_LDFLAGS="-lboost_iostreams";
 
   meta = with lib; {
     description = "An open framework for voxel";
diff --git a/pkgs/development/libraries/openvino/default.nix b/pkgs/development/libraries/openvino/default.nix
index b4e487887999e..5c8ad84b44d01 100644
--- a/pkgs/development/libraries/openvino/default.nix
+++ b/pkgs/development/libraries/openvino/default.nix
@@ -93,7 +93,7 @@ stdenv.mkDerivation rec {
     python
     tbb
     shellcheck
-  ] ++ lib.optional enablePython (with python.pkgs; [
+  ] ++ lib.optionals enablePython (with python.pkgs; [
     cython
     pybind11
   ]);
diff --git a/pkgs/development/libraries/ortp/default.nix b/pkgs/development/libraries/ortp/default.nix
index af924ad80d261..d58fed3de82cc 100644
--- a/pkgs/development/libraries/ortp/default.nix
+++ b/pkgs/development/libraries/ortp/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   # Do not build static libraries
   cmakeFlags = [ "-DENABLE_STATIC=NO" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=stringop-truncation";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=stringop-truncation";
 
   buildInputs = [ bctoolbox ];
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index f4dba00d3518d..cf3a9939f2f79 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -64,9 +64,9 @@ stdenv.mkDerivation rec {
   ];
 
   # Fontconfig error: Cannot load default config file
-  FONTCONFIG_FILE = makeFontsConf {
+  env.FONTCONFIG_FILE = toString (makeFontsConf {
     fontDirectories = [ freefont_ttf ];
-  };
+  });
 
   doCheck = false; # test-font: FAIL
 
diff --git a/pkgs/development/libraries/phonon/backends/gstreamer.nix b/pkgs/development/libraries/phonon/backends/gstreamer.nix
index 3e21415b4c772..47557fa4e93e7 100644
--- a/pkgs/development/libraries/phonon/backends/gstreamer.nix
+++ b/pkgs/development/libraries/phonon/backends/gstreamer.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   dontWrapQtApps = true;
 
-  NIX_CFLAGS_COMPILE =
+  env.NIX_CFLAGS_COMPILE =
     let gstPluginPaths =
           lib.makeSearchPathOutput "lib" "/lib/gstreamer-1.0"
           (with gst_all_1; [
diff --git a/pkgs/development/libraries/phonon/default.nix b/pkgs/development/libraries/phonon/default.nix
index 877bf973194a2..537495c362c26 100644
--- a/pkgs/development/libraries/phonon/default.nix
+++ b/pkgs/development/libraries/phonon/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  NIX_CFLAGS_COMPILE = "-fPIC";
+  env.NIX_CFLAGS_COMPILE = "-fPIC";
 
   cmakeFlags = [
     "-DCMAKE_BUILD_TYPE=${if debug then "Debug" else "Release"}"
@@ -61,9 +61,9 @@ stdenv.mkDerivation rec {
   dontWrapQtApps = true;
 
   preConfigure = ''
-    cmakeFlags+=" -DPHONON_QT_MKSPECS_INSTALL_DIR=''${!outputDev}/mkspecs"
-    cmakeFlags+=" -DPHONON_QT_IMPORTS_INSTALL_DIR=''${!outputBin}/$qtQmlPrefix"
-    cmakeFlags+=" -DPHONON_QT_PLUGIN_INSTALL_DIR=''${!outputBin}/$qtPluginPrefix/designer"
+    cmakeFlags+=("-DPHONON_QT_MKSPECS_INSTALL_DIR=''${!outputDev}/mkspecs")
+    cmakeFlags+=("-DPHONON_QT_IMPORTS_INSTALL_DIR=''${!outputBin}/$qtQmlPrefix")
+    cmakeFlags+=("-DPHONON_QT_PLUGIN_INSTALL_DIR=''${!outputBin}/$qtPluginPrefix/designer")
   '';
 
   postPatch = ''
diff --git a/pkgs/development/libraries/pipewire/0.2.nix b/pkgs/development/libraries/pipewire/0.2.nix
index 1e686b980043d..c8033e5ae5e9b 100644
--- a/pkgs/development/libraries/pipewire/0.2.nix
+++ b/pkgs/development/libraries/pipewire/0.2.nix
@@ -33,9 +33,9 @@ in stdenv.mkDerivation rec {
     "-Dgstreamer=enabled"
   ];
 
-  PKG_CONFIG_SYSTEMD_SYSTEMDUSERUNITDIR = "${placeholder "out"}/lib/systemd/user";
+  env.PKG_CONFIG_SYSTEMD_SYSTEMDUSERUNITDIR = "${placeholder "out"}/lib/systemd/user";
 
-  FONTCONFIG_FILE = fontsConf; # Fontconfig error: Cannot load default config file
+  env.FONTCONFIG_FILE = toString fontsConf; # Fontconfig error: Cannot load default config file
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/poly2tri-c/default.nix b/pkgs/development/libraries/poly2tri-c/default.nix
index cdfd376add1c2..c4ed50638d736 100644
--- a/pkgs/development/libraries/poly2tri-c/default.nix
+++ b/pkgs/development/libraries/poly2tri-c/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     glib
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     "--std=gnu99"
     "-Wno-error"
   ];
diff --git a/pkgs/development/libraries/poppler/0.61.nix b/pkgs/development/libraries/poppler/0.61.nix
index 9b89283972dd3..d8750879836e4 100644
--- a/pkgs/development/libraries/poppler/0.61.nix
+++ b/pkgs/development/libraries/poppler/0.61.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ninja pkg-config ];
 
   # Not sure when and how to pass it.  It seems an upstream bug anyway.
-  CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
+  env.CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
 
   cmakeFlags = [
     (mkFlag true "XPDF_HEADERS")
diff --git a/pkgs/development/libraries/portaudio/default.nix b/pkgs/development/libraries/portaudio/default.nix
index c7de116e879b5..c0832f690f13b 100644
--- a/pkgs/development/libraries/portaudio/default.nix
+++ b/pkgs/development/libraries/portaudio/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   configureFlags = [ "--disable-mac-universal" "--enable-cxx" ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=nullability-inferred-on-nested-type -Wno-error=nullability-completeness-on-arrays";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=nullability-inferred-on-nested-type -Wno-error=nullability-completeness-on-arrays";
 
   propagatedBuildInputs = lib.optionals stdenv.isDarwin [ AudioUnit AudioToolbox CoreAudio CoreServices Carbon ];
 
diff --git a/pkgs/development/libraries/precice/default.nix b/pkgs/development/libraries/precice/default.nix
index c3c75e2413f06..24a7f7ab0ccc2 100644
--- a/pkgs/development/libraries/precice/default.nix
+++ b/pkgs/development/libraries/precice/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     "-DPYTHON_INCLUDE_DIR=${python3}/include/${python3.libPrefix}"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin [ "-D_GNU_SOURCE" ];
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-D_GNU_SOURCE";
 
   nativeBuildInputs = [ cmake gcc ];
   buildInputs = [ boost eigen libxml2 mpi python3 python3.pkgs.numpy ];
diff --git a/pkgs/development/libraries/prime-server/default.nix b/pkgs/development/libraries/prime-server/default.nix
index 4f30a9f005c92..7dea5b880ff81 100644
--- a/pkgs/development/libraries/prime-server/default.nix
+++ b/pkgs/development/libraries/prime-server/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ curl zeromq czmq libsodium ];
 
   # https://github.com/kevinkreiser/prime_server/issues/95
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=unused-variable" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-variable";
 
   meta = with lib; {
     description = "Non-blocking (web)server API for distributed computing and SOA based on zeromq";
diff --git a/pkgs/development/libraries/prometheus-cpp/default.nix b/pkgs/development/libraries/prometheus-cpp/default.nix
index 173ee6d2e09dd..de0de0c9f567e 100644
--- a/pkgs/development/libraries/prometheus-cpp/default.nix
+++ b/pkgs/development/libraries/prometheus-cpp/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     "-DBUILD_SHARED_LIBS=ON"
   ];
 
-  NIX_LDFLAGS = "-ldl";
+  env.NIX_LDFLAGS = "-ldl";
 
   postInstall = ''
     mkdir -p $out/lib/pkgconfig
diff --git a/pkgs/development/libraries/qoauth/default.nix b/pkgs/development/libraries/qoauth/default.nix
index 2b0be6f0b3dd5..9948181b6c597 100644
--- a/pkgs/development/libraries/qoauth/default.nix
+++ b/pkgs/development/libraries/qoauth/default.nix
@@ -18,8 +18,8 @@ stdenv.mkDerivation {
   buildInputs = [ qtbase qca-qt5 ];
   nativeBuildInputs = [ qmake ];
 
-  NIX_CFLAGS_COMPILE = "-I${qca-qt5}/include/Qca-qt5/QtCrypto";
-  NIX_LDFLAGS = "-lqca-qt5";
+  env.NIX_CFLAGS_COMPILE = "-I${qca-qt5}/include/Qca-qt5/QtCrypto";
+  env.NIX_LDFLAGS = "-lqca-qt5";
 
   dontWrapQtApps = true;
 
diff --git a/pkgs/development/libraries/qt-4.x/4.8/default.nix b/pkgs/development/libraries/qt-4.x/4.8/default.nix
index 532a72c820ce0..3640747237180 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@@ -120,17 +120,18 @@ stdenv.mkDerivation rec {
 
   preConfigure = ''
     export LD_LIBRARY_PATH="`pwd`/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
-    configureFlags+="
-      -docdir $out/share/doc/${name}
-      -plugindir $out/lib/qt4/plugins
-      -importdir $out/lib/qt4/imports
-      -examplesdir $TMPDIR/share/doc/${name}/examples
-      -demosdir $TMPDIR/share/doc/${name}/demos
-      -datadir $out/share/${name}
-      -translationdir $out/share/${name}/translations
-      --jobs=$NIX_BUILD_CORES
-    "
     unset LD # Makefile uses gcc for linking; setting LD interferes
+
+    configureFlags+=(
+      "-docdir" "''${out}/share/doc/${name}"
+      "-plugindir" "''${out}/lib/qt4/plugins"
+      "-importdir" "''${out}/lib/qt4/imports"
+      "-examplesdir" "''${TMPDIR}/share/doc/${name}/examples"
+      "-demosdir" "''${TMPDIR}/share/doc/${name}/demos"
+      "-datadir" "''${out}/share/${name}"
+      "-translationdir" "''${out}/share/${name}/translations"
+      "--jobs=''${NIX_BUILD_CORES}"
+    )
   '' + lib.optionalString stdenv.cc.isClang ''
     sed -i 's/QMAKE_CC = gcc/QMAKE_CC = clang/' mkspecs/common/g++-base.conf
     sed -i 's/QMAKE_CXX = g++/QMAKE_CXX = clang++/' mkspecs/common/g++-base.conf
@@ -143,7 +144,8 @@ stdenv.mkDerivation rec {
       mkspecs/win32-g++/qmake.conf
   '';
 
-  prefixKey = "-prefix ";
+  prefixKey = "-prefix";
+  prefixAsSeperateFlag = true;
 
   configurePlatforms = [];
   configureFlags = let
@@ -190,7 +192,7 @@ stdenv.mkDerivation rec {
   buildInputs =
     [ cups # Qt dlopen's libcups instead of linking to it
       postgresql sqlite libjpeg libmng libtiff icu ]
-    ++ lib.optionals (libmysqlclient != null) [ libmysqlclient ]
+    ++ lib.optional (libmysqlclient != null) libmysqlclient
     ++ lib.optionals gtkStyle [ gtk2 gdk-pixbuf ]
     ++ lib.optionals stdenv.isDarwin [ ApplicationServices OpenGL Cocoa AGL libcxx libobjc ];
 
@@ -198,7 +200,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = toString (
+  env.NIX_CFLAGS_COMPILE = toString (
     # with gcc7 the warnings blow the log over Hydra's limit
     [ "-Wno-expansion-to-defined" "-Wno-unused-local-typedefs" ]
     ++ lib.optional stdenv.isLinux "-std=gnu++98" # gnu++ in (Obj)C flags is no good on Darwin
@@ -206,13 +208,13 @@ stdenv.mkDerivation rec {
       [ "-I${glib.dev}/include/glib-2.0" "-I${glib.out}/lib/glib-2.0/include" ]
     ++ lib.optional stdenv.isDarwin "-I${lib.getDev libcxx}/include/c++/v1");
 
-  NIX_LDFLAGS = lib.optionalString (stdenv.isFreeBSD || stdenv.isDarwin) "-lglib-2.0";
+  env.NIX_LDFLAGS = lib.optionalString (stdenv.isFreeBSD || stdenv.isDarwin) "-lglib-2.0";
 
   preBuild = lib.optionalString stdenv.isDarwin ''
     # resolve "extra qualification on member" error
     sed -i 's/struct ::TabletProximityRec;/struct TabletProximityRec;/' \
       src/gui/kernel/qt_cocoa_helpers_mac_p.h
-    find . -name "Makefile*" | xargs sed -i 's/^\(LINK[[:space:]]* = clang++\)/\1 ${NIX_LDFLAGS}/'
+    find . -name "Makefile*" | xargs sed -i 's/^\(LINK[[:space:]]* = clang++\)/\1 ${env.NIX_LDFLAGS}/'
     sed -i 's/^\(LIBS[[:space:]]*=.*$\)/\1 -lobjc/' ./src/corelib/Makefile.Release
   '';
 
diff --git a/pkgs/development/libraries/qt-4.x/4.8/qmake-hook.sh b/pkgs/development/libraries/qt-4.x/4.8/qmake-hook.sh
index f288e99dd12ad..f6643747925b2 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/qmake-hook.sh
+++ b/pkgs/development/libraries/qt-4.x/4.8/qmake-hook.sh
@@ -1,7 +1,7 @@
 qmakeConfigurePhase() {
     runHook preConfigure
 
-    $QMAKE PREFIX=$out $qmakeFlags
+    $QMAKE PREFIX=$out "${qmakeFlags[@]}"
 
     if ! [[ -v enableParallelBuilding ]]; then
         enableParallelBuilding=1
diff --git a/pkgs/development/libraries/qt-5/hooks/move-qt-dev-tools.sh b/pkgs/development/libraries/qt-5/hooks/move-qt-dev-tools.sh
index 85489c85105bc..a8d653232a1be 100644
--- a/pkgs/development/libraries/qt-5/hooks/move-qt-dev-tools.sh
+++ b/pkgs/development/libraries/qt-5/hooks/move-qt-dev-tools.sh
@@ -10,14 +10,14 @@ updateToolPath() {
 }
 
 moveQtDevTools() {
-    if [ -n "$devTools" ]; then
-        for tool in $devTools; do
+    if [[ -n ${devTools[@]+"${devTools[@]}"} ]]; then
+        for tool in "${devTools[@]}"; do
             moveToOutput "$tool" "${!outputDev}"
         done
 
         if [ -d "${!outputDev}/mkspecs" ]; then
             find "${!outputDev}/mkspecs" -name '*.pr?' | while read pr_; do
-                for tool in $devTools; do
+                for tool in "${devTools[@]}"; do
                     updateToolPath "$tool" "$pr_"
                 done
             done
@@ -25,7 +25,7 @@ moveQtDevTools() {
 
         if [ -d "${!outputDev}/lib/cmake" ]; then
             find "${!outputDev}/lib/cmake" -name '*.cmake' | while read cmake; do
-                for tool in $devTools; do
+                for tool in "${devTools[@]}"; do
                     updateToolPath "$tool" "$cmake"
                 done
             done
diff --git a/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh b/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
index 741225a5aa810..fd6cbe064c6b5 100644
--- a/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
@@ -1,6 +1,6 @@
 . @fix_qmake_libtool@
 
-qmakeFlags=( ${qmakeFlags-} )
+qmakeFlags=(${qmakeFlags[@]+"${qmakeFlags[@]}"})
 
 qmakePrePhase() {
     qmakeFlags_orig=( "${qmakeFlags[@]}" )
diff --git a/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh b/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh
index 1b57d676e1fc5..811e126c701aa 100644
--- a/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh
@@ -72,7 +72,7 @@ qtEnvHostTargetHook() {
     qtEnvHostTargetSeen[$1]=1
     if providesQtRuntime "$1" && [ "z${!outputBin}" != "z${!outputDev}" ]
     then
-        propagatedBuildInputs+=" $1"
+        propagatedBuildInputs+=("$1")
     fi
 }
 envHostTargetHooks+=(qtEnvHostTargetHook)
diff --git a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
index ce4d78fbb50f1..14d746823f1bb 100644
--- a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
@@ -2,7 +2,7 @@ if [[ -z "${__nix_wrapQtAppsHook-}" ]]; then
 __nix_wrapQtAppsHook=1  # Don't run this hook more than once.
 
 # Inherit arguments given in mkDerivation
-qtWrapperArgs=( ${qtWrapperArgs-} )
+qtWrapperArgs=(${qtWrapperArgs[@]+"${qtWrapperArgs[@]}"})
 
 qtHostPathSeen=()
 
diff --git a/pkgs/development/libraries/qt-5/mkDerivation.nix b/pkgs/development/libraries/qt-5/mkDerivation.nix
index 98f9a05fac7c4..1ef1fae1af868 100644
--- a/pkgs/development/libraries/qt-5/mkDerivation.nix
+++ b/pkgs/development/libraries/qt-5/mkDerivation.nix
@@ -14,4 +14,4 @@ let
   };
 in
 
-mkDerivation (args // args_)
+mkDerivation (lib.recursiveUpdate args args_)
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index 0d0bef342b02c..efc16e09e202f 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -198,7 +198,7 @@ stdenv.mkDerivation {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = toString ([
+  env.NIX_CFLAGS_COMPILE = toString ([
     "-Wno-error=sign-compare" # freetype-2.5.4 changed signedness of some struct fields
     ''-DNIXPKGS_QTCOMPOSE="${libX11.out}/share/X11/locale"''
     ''-D${if compareVersion "5.11.0" >= 0 then "LIBRESOLV_SO" else "NIXPKGS_LIBRESOLV"}="${stdenv.cc.libc.out}/lib/libresolv"''
@@ -210,19 +210,17 @@ stdenv.mkDerivation {
        ]
     ++ lib.optional decryptSslTraffic "-DQT_DECRYPT_SSL_TRAFFIC");
 
-  prefixKey = "-prefix ";
-
   # PostgreSQL autodetection fails sporadically because Qt omits the "-lpq" flag
   # if dependency paths contain the string "pq", which can occur in the hash.
   # To prevent these failures, we need to override PostgreSQL detection.
-  PSQL_LIBS = lib.optionalString (postgresql != null) "-L${postgresql.lib}/lib -lpq";
+  env.PSQL_LIBS = lib.optionalString (postgresql != null) "-L${postgresql.lib}/lib -lpq";
 
   # TODO Remove obsolete and useless flags once the build will be totally mastered
   configureFlags =
     [
-      "-plugindir $(out)/$(qtPluginPrefix)"
-      "-qmldir $(out)/$(qtQmlPrefix)"
-      "-docdir $(out)/$(qtDocPrefix)"
+      "-plugindir" "$(out)/$(qtPluginPrefix)"
+      "-qmldir" "$(out)/$(qtQmlPrefix)"
+      "-docdir" "$(out)/$(qtDocPrefix)"
 
       "-verbose"
       "-confirm-license"
@@ -238,7 +236,7 @@ stdenv.mkDerivation {
 
       "-gui"
       "-widgets"
-      "-opengl desktop"
+      "-opengl" "desktop"
       "-icu"
       "-L" "${icu.out}/lib"
       "-I" "${icu.dev}/include"
@@ -292,13 +290,13 @@ stdenv.mkDerivation {
       "-L" "${openssl.out}/lib"
       "-I" "${openssl.dev}/include"
       "-system-sqlite"
-      ''-${if libmysqlclient != null then "plugin" else "no"}-sql-mysql''
-      ''-${if postgresql != null then "plugin" else "no"}-sql-psql''
+      "-${if libmysqlclient != null then "plugin" else "no"}-sql-mysql"
+      "-${if postgresql != null then "plugin" else "no"}-sql-psql"
 
-      "-make libs"
-      "-make tools"
-      ''-${lib.optionalString (!buildExamples) "no"}make examples''
-      ''-${lib.optionalString (!buildTests) "no"}make tests''
+      "-make" "libs"
+      "-make" "tools"
+      "-${lib.optionalString (!buildExamples) "no"}make" "examples"
+      "-${lib.optionalString (!buildTests) "no"}make" "tests"
     ]
     ++ lib.optional (compareVersion "5.15.0" < 0) "-v"
 
@@ -306,7 +304,7 @@ stdenv.mkDerivation {
       if stdenv.isDarwin
       then
         [
-          "-platform macx-clang"
+          "-platform" "macx-clang"
           "-no-fontconfig"
           "-qt-freetype"
           "-qt-libpng"
@@ -319,7 +317,7 @@ stdenv.mkDerivation {
         ++ lib.optional (compareVersion "5.15.0" < 0) "-system-xcb"
         ++ [
           "-xcb"
-          "-qpa xcb"
+          "-qpa" "xcb"
           "-L" "${libX11.out}/lib"
           "-I" "${libX11.out}/include"
           "-L" "${libXext.out}/lib"
@@ -329,7 +327,7 @@ stdenv.mkDerivation {
 
           "-libinput"
 
-          ''-${lib.optionalString (cups == null) "no-"}cups''
+          "-${lib.optionalString (cups == null) "no-"}cups"
           "-dbus-linked"
           "-glib"
         ]
diff --git a/pkgs/development/libraries/qt-5/modules/qtmultimedia.nix b/pkgs/development/libraries/qt-5/modules/qtmultimedia.nix
index eb2c3bc7431da..7c3869f37055b 100644
--- a/pkgs/development/libraries/qt-5/modules/qtmultimedia.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtmultimedia.nix
@@ -13,5 +13,5 @@ qtModule {
     ++ optional (versionAtLeast qtbase.version "5.14.0" && stdenv.isLinux) wayland;
   outputs = [ "bin" "dev" "out" ];
   qmakeFlags = [ "GST_VERSION=1.0" ];
-  NIX_LDFLAGS = optionalString (stdenv.isDarwin) "-lobjc";
+  env.NIX_LDFLAGS = optionalString (stdenv.isDarwin) "-lobjc";
 }
diff --git a/pkgs/development/libraries/qt-5/modules/qtserialport.nix b/pkgs/development/libraries/qt-5/modules/qtserialport.nix
index 516d38340dc53..a9016938793ac 100644
--- a/pkgs/development/libraries/qt-5/modules/qtserialport.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtserialport.nix
@@ -1,11 +1,11 @@
 { qtModule, stdenv, lib, qtbase, systemd }:
 
-let inherit (lib) getLib optional; in
+let inherit (lib) getLib optionalString; in
 
 qtModule {
   name = "qtserialport";
   qtInputs = [ qtbase ];
-  NIX_CFLAGS_COMPILE =
-    optional stdenv.isLinux
+  env.NIX_CFLAGS_COMPILE =
+    optionalString stdenv.isLinux
     ''-DNIXPKGS_LIBUDEV="${getLib systemd}/lib/libudev"'';
 }
diff --git a/pkgs/development/libraries/qt-5/modules/qttools.nix b/pkgs/development/libraries/qt-5/modules/qttools.nix
index fae90972978f0..e1b0bb5ffa849 100644
--- a/pkgs/development/libraries/qt-5/modules/qttools.nix
+++ b/pkgs/development/libraries/qt-5/modules/qttools.nix
@@ -38,8 +38,8 @@ qtModule {
     "bin/macdeployqt"
   ];
 
-  NIX_CFLAGS_COMPILE =
-    lib.optional stdenv.isDarwin ''-DNIXPKGS_QMLIMPORTSCANNER="${qtdeclarative.dev}/bin/qmlimportscanner"'';
+  env.NIX_CFLAGS_COMPILE =
+    lib.optionalString stdenv.isDarwin ''-DNIXPKGS_QMLIMPORTSCANNER="${qtdeclarative.dev}/bin/qmlimportscanner"'';
 
   setupHook = ../hooks/qttools-setup-hook.sh;
 }
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index 23ca50ba25ab9..a9d6f5e7a496a 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -111,7 +111,7 @@ qtModule {
       --replace "audit_token_to_pid(msg.trailer.msgh_audit)" "msg.trailer.msgh_audit.val[5]"
     ''));
 
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isGNU [
     # with gcc8, -Wclass-memaccess became part of -Wall and this exceeds the logging limit
     "-Wno-class-memaccess"
   ] ++ lib.optionals (stdenv.hostPlatform.gcc.arch or "" == "sandybridge") [
@@ -131,7 +131,7 @@ qtModule {
     # TODO remove when new Apple SDK is in
     #
     "-fno-objc-arc"
-  ];
+  ]);
 
   preConfigure = ''
     export NINJAFLAGS=-j$NIX_BUILD_CORES
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebkit.nix b/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
index 288a0e30f6902..e10b2c458eba4 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
@@ -49,7 +49,7 @@ qtModule {
     export qmakeFlags="$qmakeFlags CONFIG+=silent"
   '';
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString ([
       # with gcc7 this warning blows the log over Hydra's limit
       "-Wno-expansion-to-defined"
     ]
@@ -57,7 +57,7 @@ qtModule {
     ++ optional stdenv.cc.isGNU "-Wno-class-memaccess"
     # with clang this warning blows the log over Hydra's limit
     ++ optional stdenv.isDarwin "-Wno-inconsistent-missing-override"
-    ++ optional (!stdenv.isDarwin) ''-DNIXPKGS_LIBUDEV="${getLib systemd}/lib/libudev"'';
+    ++ optional (!stdenv.isDarwin) ''-DNIXPKGS_LIBUDEV="${getLib systemd}/lib/libudev"'');
 
   doCheck = false; # fails 13 out of 13 tests (ctest)
 
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebview.nix b/pkgs/development/libraries/qt-5/modules/qtwebview.nix
index 4034dce49f56d..578ff858f99aa 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebview.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebview.nix
@@ -10,5 +10,5 @@ qtModule {
     darwin.apple_sdk.frameworks.WebKit
   ];
   outputs = [ "out" "dev" "bin" ];
-  NIX_LDFLAGS = optionalString stdenv.isDarwin "-framework CoreFoundation -framework WebKit";
+  env.NIX_LDFLAGS = optionalString stdenv.isDarwin "-framework CoreFoundation -framework WebKit";
 }
diff --git a/pkgs/development/libraries/qt-mobility/default.nix b/pkgs/development/libraries/qt-mobility/default.nix
index 60c1d2754d70d..b57778938d675 100644
--- a/pkgs/development/libraries/qt-mobility/default.nix
+++ b/pkgs/development/libraries/qt-mobility/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "14713pbscysd6d0b9rgm7gg145jzwvgdn22778pf2v13qzvfmy1i";
   };
 
-  NIX_CFLAGS_COMPILE="-fpermissive";
+  env.NIX_CFLAGS_COMPILE="-fpermissive";
 
   configurePhase = ''
     ./configure -prefix $out
diff --git a/pkgs/development/libraries/qtinstaller/default.nix b/pkgs/development/libraries/qtinstaller/default.nix
index ce69c855ac23f..c27f0f63a1496 100644
--- a/pkgs/development/libraries/qtinstaller/default.nix
+++ b/pkgs/development/libraries/qtinstaller/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   setOutputFlags = false;
   enableParallelBuilding = true;
-  NIX_QT_SUBMODULE = true;
+  env.NIX_QT_SUBMODULE = true;
   dontWrapQtApps = true;
 
   installPhase = ''
diff --git a/pkgs/development/libraries/qwt/6.nix b/pkgs/development/libraries/qwt/6.nix
index 1f2518fc73805..f7bc3c52798ac 100644
--- a/pkgs/development/libraries/qwt/6.nix
+++ b/pkgs/development/libraries/qwt/6.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     sed -e "s|QWT_INSTALL_PREFIX.*=.*|QWT_INSTALL_PREFIX = $out|g" -i qwtconfig.pri
   '';
 
-  qmakeFlags = [ "-after doc.path=$out/share/doc/${name}" ];
+  qmakeFlags = [ "-after" "doc.path=$out/share/doc/${name}" ];
 
   dontWrapQtApps = true;
 
diff --git a/pkgs/development/libraries/qwt/6_qt4.nix b/pkgs/development/libraries/qwt/6_qt4.nix
index 61903af93fac5..18fabef33e89d 100644
--- a/pkgs/development/libraries/qwt/6_qt4.nix
+++ b/pkgs/development/libraries/qwt/6_qt4.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
       install_name_tool -id "$out/lib/qwt.framework/Versions/6/qwt" "$out/lib/qwt.framework/Versions/6/qwt"
     '';
 
-  qmakeFlags = [ "-after doc.path=$out/share/doc/${name}" ];
+  qmakeFlags = [ "-after" "doc.path=$out/share/doc/${name}" ];
 
   meta = with lib; {
     description = "Qt widgets for technical applications";
diff --git a/pkgs/development/libraries/qwt/default.nix b/pkgs/development/libraries/qwt/default.nix
index e158fe3488566..f87e698052f78 100644
--- a/pkgs/development/libraries/qwt/default.nix
+++ b/pkgs/development/libraries/qwt/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   '';
 
   preConfigure = ''
-    qmakeFlags="$qmakeFlags INSTALLBASE=$out -after doc.path=$out/share/doc/${name}"
+    qmakeFlags+=("INSTALLBASE=$out" "-after" "doc.path=$out/share/doc/${name}")
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/rdkafka/default.nix b/pkgs/development/libraries/rdkafka/default.nix
index 0d7483d3c2e39..f07292c6320a4 100644
--- a/pkgs/development/libraries/rdkafka/default.nix
+++ b/pkgs/development/libraries/rdkafka/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ zlib openssl ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=strict-overflow";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=strict-overflow";
 
   postPatch = ''
     patchShebangs .
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index 6ab2fe9f6cbf7..c31168203a0c1 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = lib.optional enableJemalloc jemalloc;
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=deprecated-copy -Wno-error=pessimizing-move";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=deprecated-copy -Wno-error=pessimizing-move";
 
   cmakeFlags = [
     "-DPORTABLE=1"
@@ -47,12 +47,13 @@ stdenv.mkDerivation rec {
     "-DWITH_GFLAGS=0"
     "-DUSE_RTTI=1"
     "-DROCKSDB_INSTALL_ON_WINDOWS=YES" # harmless elsewhere
-    (lib.optional
+  ]
+  ++ (lib.optional
         (stdenv.hostPlatform.isx86 && stdenv.hostPlatform.isLinux)
         "-DFORCE_SSE42=1")
-    (lib.optional enableLite "-DROCKSDB_LITE=1")
-    "-DFAIL_ON_WARNINGS=${if stdenv.hostPlatform.isMinGW then "NO" else "YES"}"
-  ] ++ lib.optional (!enableShared) "-DROCKSDB_BUILD_SHARED=0";
+  ++ (lib.optional enableLite "-DROCKSDB_LITE=1")
+  ++ [ "-DFAIL_ON_WARNINGS=${if stdenv.hostPlatform.isMinGW then "NO" else "YES"}" ]
+  ++ lib.optional (!enableShared) "-DROCKSDB_BUILD_SHARED=0";
 
   # otherwise "cc1: error: -Wformat-security ignored without -Wformat [-Werror=format-security]"
   hardeningDisable = lib.optional stdenv.hostPlatform.isWindows "format";
diff --git a/pkgs/development/libraries/science/benchmark/papi/default.nix b/pkgs/development/libraries/science/benchmark/papi/default.nix
index c265f24c182be..2e790980fbf60 100644
--- a/pkgs/development/libraries/science/benchmark/papi/default.nix
+++ b/pkgs/development/libraries/science/benchmark/papi/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "13mngf9kl0y2wfxqvkad0smdaag7k8fvw82b4312gx62nwhc1i6r";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
 
   preConfigure = ''
     cd src
diff --git a/pkgs/development/libraries/science/math/nccl/default.nix b/pkgs/development/libraries/science/math/nccl/default.nix
index 5036ad890799e..66d6870157789 100644
--- a/pkgs/development/libraries/science/math/nccl/default.nix
+++ b/pkgs/development/libraries/science/math/nccl/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     addOpenGLRunpath $out/lib/lib*.so
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-unused-function" ];
+  env.NIX_CFLAGS_COMPILE = [ "-Wno-unused-function" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/science/math/osi/default.nix b/pkgs/development/libraries/science/math/osi/default.nix
index b61cd84060641..08273ec415012 100644
--- a/pkgs/development/libraries/science/math/osi/default.nix
+++ b/pkgs/development/libraries/science/math/osi/default.nix
@@ -21,11 +21,11 @@ stdenv.mkDerivation rec {
     lib.optionals withGurobi [ "--with-gurobi-incdir=${gurobi}/include" "--with-gurobi-lib=-lgurobi${gurobi.libSuffix}" ]
     ++ lib.optionals withCplex [ "--with-cplex-incdir=${cplex}/cplex/include/ilcplex" "--with-cplex-lib=-lcplex${cplex.libSuffix}" ];
 
-  NIX_LDFLAGS =
+  env.NIX_LDFLAGS =
     lib.optionalString withCplex "-L${cplex}/cplex/bin/${cplex.libArch}";
 
   # Compile errors
-  NIX_CFLAGS_COMPILE = "-Wno-cast-qual";
+  env.NIX_CFLAGS_COMPILE = "-Wno-cast-qual";
   hardeningDisable = [ "format" ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/science/math/suitesparse/4.4.nix b/pkgs/development/libraries/science/math/suitesparse/4.4.nix
index 1ebac6ac445d6..e36daffdbbff9 100644
--- a/pkgs/development/libraries/science/math/suitesparse/4.4.nix
+++ b/pkgs/development/libraries/science/math/suitesparse/4.4.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation {
     "LAPACK=-llapack"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin " -DNTIMER";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin " -DNTIMER";
 
   postInstall = ''
     # Build and install shared library
diff --git a/pkgs/development/libraries/science/networking/ns-3/default.nix b/pkgs/development/libraries/science/networking/ns-3/default.nix
index 4a90f082dc08f..4adea5c2d03e0 100644
--- a/pkgs/development/libraries/science/networking/ns-3/default.nix
+++ b/pkgs/development/libraries/science/networking/ns-3/default.nix
@@ -68,18 +68,18 @@ stdenv.mkDerivation rec {
       "--with-python=${pythonEnv.interpreter}"
   ]
   ++ optional (build_profile != null) "--build-profile=${build_profile}"
-  ++ optional withExamples " --enable-examples "
-  ++ optional doCheck " --enable-tests "
+  ++ optional withExamples "--enable-examples"
+  ++ optional doCheck "--enable-tests"
   ;
 
   doCheck = true;
 
   buildTargets = "build"
     + lib.optionalString enableDoxygen " doxygen"
-    + lib.optionalString withManual "sphinx";
+    + lib.optionalString withManual " sphinx";
 
   # to prevent fatal error: 'backward_warning.h' file not found
-  CXXFLAGS = "-D_GLIBCXX_PERMIT_BACKWARD_HASH";
+  env.CXXFLAGS = "-D_GLIBCXX_PERMIT_BACKWARD_HASH";
 
   postBuild = with lib; let flags = concatStringsSep ";" (
       optional enableDoxygen "./waf doxygen"
diff --git a/pkgs/development/libraries/serf/default.nix b/pkgs/development/libraries/serf/default.nix
index 2549704c1a8c1..32302c64b37c5 100644
--- a/pkgs/development/libraries/serf/default.nix
+++ b/pkgs/development/libraries/serf/default.nix
@@ -18,14 +18,18 @@ stdenv.mkDerivation rec {
 
   prefixKey = "PREFIX=";
 
+  sconsFlags = [
+    "OPENSSL=${openssl}"
+    "ZLIB=${zlib}"
+  ] ++ lib.optional (!stdenv.isCygwin)
+    "GSSAPI=${libkrb5.dev}";
+
   preConfigure = ''
-    sconsFlags+=" APR=$(echo ${apr.dev}/bin/*-config)"
-    sconsFlags+=" APU=$(echo ${aprutil.dev}/bin/*-config)"
-    sconsFlags+=" CC=$CC"
-    sconsFlags+=" OPENSSL=${openssl}"
-    sconsFlags+=" ZLIB=${zlib}"
-  '' + lib.optionalString (!stdenv.isCygwin) ''
-    sconsFlags+=" GSSAPI=${libkrb5.dev}"
+    sconsFlags+=(
+      "APR=$(echo ${apr.dev}/bin/*-config)"
+      "APU=$(echo ${aprutil.dev}/bin/*-config)"
+      "CC=$CC"
+    )
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/smpeg/default.nix b/pkgs/development/libraries/smpeg/default.nix
index 83b4b2193c030..9ef6b59caa8f4 100644
--- a/pkgs/development/libraries/smpeg/default.nix
+++ b/pkgs/development/libraries/smpeg/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
       --prefix PKG_CONFIG_PATH ":" "${SDL.dev}/lib/pkgconfig"
   '';
 
-  NIX_LDFLAGS = "-lX11";
+  env.NIX_LDFLAGS = "-lX11";
 
   meta = {
     homepage = "http://icculus.org/smpeg/";
diff --git a/pkgs/development/libraries/spatialite-tools/default.nix b/pkgs/development/libraries/spatialite-tools/default.nix
index ffded04510b49..e968be8289d4e 100644
--- a/pkgs/development/libraries/spatialite-tools/default.nix
+++ b/pkgs/development/libraries/spatialite-tools/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_LDFLAGS = "-lsqlite3";
+  env.NIX_LDFLAGS = "-lsqlite3";
 
   meta = {
     description = "A complete sqlite3-compatible CLI front-end for libspatialite";
diff --git a/pkgs/development/libraries/spdk/default.nix b/pkgs/development/libraries/spdk/default.nix
index a0c875079c442..b867c7176adf5 100644
--- a/pkgs/development/libraries/spdk/default.nix
+++ b/pkgs/development/libraries/spdk/default.nix
@@ -53,7 +53,7 @@ in stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-dpdk=${dpdk}" ];
 
-  NIX_CFLAGS_COMPILE = "-mssse3"; # Necessary to compile.
+  env.NIX_CFLAGS_COMPILE = "-mssse3"; # Necessary to compile.
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/spice-gtk/default.nix b/pkgs/development/libraries/spice-gtk/default.nix
index 3d76e67f67ad1..5c8f8946880c7 100644
--- a/pkgs/development/libraries/spice-gtk/default.nix
+++ b/pkgs/development/libraries/spice-gtk/default.nix
@@ -111,7 +111,7 @@ stdenv.mkDerivation rec {
     zlib
   ] ++ lib.optionals withPolkit [ polkit acl usbutils ] ;
 
-  PKG_CONFIG_POLKIT_GOBJECT_1_POLICYDIR = "${placeholder "out"}/share/polkit-1/actions";
+  env.PKG_CONFIG_POLKIT_GOBJECT_1_POLICYDIR = "${placeholder "out"}/share/polkit-1/actions";
 
   mesonFlags = [
     "-Dcelt051=disabled"
diff --git a/pkgs/development/libraries/spice/default.nix b/pkgs/development/libraries/spice/default.nix
index 584b1e15a8e33..8c0e38a38c5fb 100644
--- a/pkgs/development/libraries/spice/default.nix
+++ b/pkgs/development/libraries/spice/default.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
     zlib
   ];
 
-  NIX_CFLAGS_COMPILE = "-fno-stack-protector";
+  env.NIX_CFLAGS_COMPILE = "-fno-stack-protector";
 
   mesonFlags = [
     "-Dgstreamer=1.0"
diff --git a/pkgs/development/libraries/sqlcipher/default.nix b/pkgs/development/libraries/sqlcipher/default.nix
index 44da759409eef..afbd0f5276f8c 100644
--- a/pkgs/development/libraries/sqlcipher/default.nix
+++ b/pkgs/development/libraries/sqlcipher/default.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-threadsafe" "--disable-tcl" ];
 
-  CFLAGS = [ "-DSQLITE_ENABLE_COLUMN_METADATA=1" "-DSQLITE_SECURE_DELETE=1" "-DSQLITE_ENABLE_UNLOCK_NOTIFY=1" "-DSQLITE_HAS_CODEC" ];
-  LDFLAGS = lib.optional (readline != null) "-lncurses";
+  env.CFLAGS = "-DSQLITE_ENABLE_COLUMN_METADATA=1 -DSQLITE_SECURE_DELETE=1 -DSQLITE_ENABLE_UNLOCK_NOTIFY=1 -DSQLITE_HAS_CODEC";
+  env.LDFLAGS = lib.optionalString (readline != null) "-lncurses";
 
   doCheck = false; # fails. requires tcl?
 
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 50b52b905a928..6b3f3ac524933 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-threadsafe" ] ++ optional interactive "--enable-readline";
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-DSQLITE_ENABLE_COLUMN_METADATA"
     "-DSQLITE_ENABLE_DBSTAT_VTAB"
     "-DSQLITE_ENABLE_JSON1"
diff --git a/pkgs/development/libraries/swiften/default.nix b/pkgs/development/libraries/swiften/default.nix
index 980d034682f57..f3d0961fe8cb8 100644
--- a/pkgs/development/libraries/swiften/default.nix
+++ b/pkgs/development/libraries/swiften/default.nix
@@ -24,10 +24,8 @@ stdenv.mkDerivation rec {
     "debug=0"
     "swiften_dll=1"
   ];
-  preInstall = ''
-    installTargets="$out"
-    installFlags+=" SWIFTEN_INSTALLDIR=$out"
-  '';
+  installFlags = [ "SWIFT_INSTALLDIR=${placeholder "out"}" ];
+  installTargets = [ "${placeholder "out"}" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/sword/default.nix b/pkgs/development/libraries/sword/default.nix
index 35c1e6e15e299..823825c1fe3d5 100644
--- a/pkgs/development/libraries/sword/default.nix
+++ b/pkgs/development/libraries/sword/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   '';
 
   configureFlags = [ "--without-conf" "--enable-tests=no" ];
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     "-Wno-unused-but-set-variable"
     # compat with icu61+ https://github.com/unicode-org/icu/blob/release-64-2/icu4c/readme.html#L554
     "-DU_USING_ICU_NAMESPACE=1"
diff --git a/pkgs/development/libraries/tinyxml/2.6.2.nix b/pkgs/development/libraries/tinyxml/2.6.2.nix
index e8c5dd1dacdf6..ebfd8e5670ff6 100644
--- a/pkgs/development/libraries/tinyxml/2.6.2.nix
+++ b/pkgs/development/libraries/tinyxml/2.6.2.nix
@@ -27,7 +27,7 @@ in stdenv.mkDerivation {
 
   hardeningDisable = [ "format" ];
 
-  NIX_CFLAGS_COMPILE =
+  env.NIX_CFLAGS_COMPILE =
     lib.optionalString stdenv.isDarwin "-mmacosx-version-min=10.9";
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/ucl/default.nix b/pkgs/development/libraries/ucl/default.nix
index 43f7ddf63af95..5676eff6d1569 100644
--- a/pkgs/development/libraries/ucl/default.nix
+++ b/pkgs/development/libraries/ucl/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
   };
 
   # needed to successfully compile with gcc 6
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-std=c90";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-std=c90";
 
   meta = {
     homepage = "http://www.oberhumer.com/opensource/ucl/";
diff --git a/pkgs/development/libraries/uri/default.nix b/pkgs/development/libraries/uri/default.nix
index 48a80aacdf59f..4ff4d299ff6bf 100644
--- a/pkgs/development/libraries/uri/default.nix
+++ b/pkgs/development/libraries/uri/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "148361pixrm94q6v04k13s1msa04bx9yc3djb0lxpa7dlw19vhcd";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=parentheses";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=parentheses";
 
   nativeBuildInputs = [ cmake doxygen ];
 
diff --git a/pkgs/development/libraries/usbredir/default.nix b/pkgs/development/libraries/usbredir/default.nix
index 0313b8c81ef25..4441db9bce216 100644
--- a/pkgs/development/libraries/usbredir/default.nix
+++ b/pkgs/development/libraries/usbredir/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "002yik1x7kn0427xahvnhjby2np14a6xqw7c3dx530n9h5d9rg47";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   nativeBuildInputs = [ pkg-config ];
   propagatedBuildInputs = [ libusb1 ];
diff --git a/pkgs/development/libraries/ustr/default.nix b/pkgs/development/libraries/ustr/default.nix
index 2b04d8c0c5b78..db3a1e2aaff6d 100644
--- a/pkgs/development/libraries/ustr/default.nix
+++ b/pkgs/development/libraries/ustr/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   patches = [ ./va_args.patch ];
 
   # Work around gcc5 switch to gnu11
-  NIX_CFLAGS_COMPILE = "-std=gnu89";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu89";
 
   # Fix detection of stdint.h
   postPatch = ''
diff --git a/pkgs/development/libraries/v8/5_x.nix b/pkgs/development/libraries/v8/5_x.nix
index 441a5559b527d..fe3c99ef6b6f8 100644
--- a/pkgs/development/libraries/v8/5_x.nix
+++ b/pkgs/development/libraries/v8/5_x.nix
@@ -154,7 +154,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional stdenv.isDarwin xcbuild
     ++ lib.optional stdenv.isLinux patchelf;
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=strict-overflow -Wno-error=unused-function -Wno-error=attributes"
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=strict-overflow -Wno-error=unused-function -Wno-error=attributes"
     + lib.optionalString stdenv.cc.isClang " -Wno-error=unused-lambda-capture";
 
   buildFlags = [
diff --git a/pkgs/development/libraries/v8/default.nix b/pkgs/development/libraries/v8/default.nix
index 7c463aa01228c..37cb2c94c421c 100644
--- a/pkgs/development/libraries/v8/default.nix
+++ b/pkgs/development/libraries/v8/default.nix
@@ -77,7 +77,7 @@ stdenv.mkDerivation rec {
         mkdir -p $sourceRoot/${n}
         cp -r ${v}/* $sourceRoot/${n}
       '') deps)}
-    chmod u+w -R .
+    chmod u+w -R $sourceRoot/
   '';
 
   postPatch = lib.optionalString stdenv.isAarch64 ''
@@ -92,7 +92,7 @@ stdenv.mkDerivation rec {
                 'false'
   '';
 
-  gnFlags = [
+  gnFlags = builtins.toString ([
     "use_custom_libcxx=false"
     "is_clang=${lib.boolToString stdenv.cc.isClang}"
     "use_sysroot=false"
@@ -110,10 +110,10 @@ stdenv.mkDerivation rec {
     # ''custom_toolchain="//build/toolchain/linux/unbundle:default"''
     ''host_toolchain="//build/toolchain/linux/unbundle:default"''
     ''v8_snapshot_toolchain="//build/toolchain/linux/unbundle:default"''
-  ] ++ lib.optional stdenv.cc.isClang ''clang_base_path="${stdenv.cc}"'';
+  ] ++ lib.optional stdenv.cc.isClang ''clang_base_path="${stdenv.cc}"'');
 
-  NIX_CFLAGS_COMPILE = "-O2";
-  FORCE_MAC_SDK_MIN = stdenv.targetPlatform.sdkVer or "10.12";
+  env.NIX_CFLAGS_COMPILE = "-O2";
+  env.FORCE_MAC_SDK_MIN = stdenv.targetPlatform.sdkVer or "10.12";
 
   nativeBuildInputs = [
     gn
diff --git a/pkgs/development/libraries/vaapi-intel/default.nix b/pkgs/development/libraries/vaapi-intel/default.nix
index f21a947a533f1..1470227c23b06 100644
--- a/pkgs/development/libraries/vaapi-intel/default.nix
+++ b/pkgs/development/libraries/vaapi-intel/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   };
 
   # Set the correct install path:
-  LIBVA_DRIVERS_PATH = "${placeholder "out"}/lib/dri";
+  env.LIBVA_DRIVERS_PATH = "${placeholder "out"}/lib/dri";
 
   postInstall = lib.optionalString enableHybridCodec ''
     ln -s ${vaapi-intel-hybrid}/lib/dri/* $out/lib/dri/
diff --git a/pkgs/development/libraries/vigra/default.nix b/pkgs/development/libraries/vigra/default.nix
index 56402172d9ff1..bc7b9179a6447 100644
--- a/pkgs/development/libraries/vigra/default.nix
+++ b/pkgs/development/libraries/vigra/default.nix
@@ -13,7 +13,7 @@ in stdenv.mkDerivation rec {
     sha256 = "03i5wfscv83jb8vnwwhfmm8yfiniwkvk13myzhr1kbwbs9884wdj";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
+  env.NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
 
   # Fixes compilation with clang (on darwin) see https://github.com/ukoethe/vigra/issues/414
   patches =
diff --git a/pkgs/development/libraries/vtk/generic.nix b/pkgs/development/libraries/vtk/generic.nix
index 482e6be7bbcf5..13fa257167eaf 100644
--- a/pkgs/development/libraries/vtk/generic.nix
+++ b/pkgs/development/libraries/vtk/generic.nix
@@ -46,7 +46,7 @@ in stdenv.mkDerivation rec {
       ImageIO
       OpenGL
       GLUT
-    ] ++ optional enablePython [
+    ] ++ optionals enablePython [
       pythonInterpreter
     ];
   propagatedBuildInputs = optionals stdenv.isDarwin [ libobjc ];
diff --git a/pkgs/development/libraries/wxwidgets/2.8/default.nix b/pkgs/development/libraries/wxwidgets/2.8/default.nix
index 8029477708df4..7205c2c7c892d 100644
--- a/pkgs/development/libraries/wxwidgets/2.8/default.nix
+++ b/pkgs/development/libraries/wxwidgets/2.8/default.nix
@@ -37,14 +37,14 @@ stdenv.mkDerivation rec {
   ] ++ optional withMesa "--with-opengl";
 
   # These variables are used by configure to find some dependencies.
-  SEARCH_INCLUDE =
+  env.SEARCH_INCLUDE =
     "${libXinerama.dev}/include ${libSM.dev}/include ${libXxf86vm.dev}/include";
-  SEARCH_LIB =
+  env.SEARCH_LIB =
     "${libXinerama.out}/lib ${libSM.out}/lib ${libXxf86vm.out}/lib "
     + optionalString withMesa "${libGLU.out}/lib ${libGL.out}/lib ";
 
   # Work around a bug in configure.
-  NIX_CFLAGS_COMPILE = "-DHAVE_X11_XLIB_H=1 -lX11 -lcairo -Wno-narrowing";
+  env.NIX_CFLAGS_COMPILE = "-DHAVE_X11_XLIB_H=1 -lX11 -lcairo -Wno-narrowing";
 
   preConfigure = "
     substituteInPlace configure --replace 'SEARCH_INCLUDE=' 'DUMMY_SEARCH_INCLUDE='
diff --git a/pkgs/development/libraries/wxwidgets/3.0/mac.nix b/pkgs/development/libraries/wxwidgets/3.0/mac.nix
index 22e8184099133..e68991ae3467c 100644
--- a/pkgs/development/libraries/wxwidgets/3.0/mac.nix
+++ b/pkgs/development/libraries/wxwidgets/3.0/mac.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     ./wx-config --libs
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-undef";
+  env.NIX_CFLAGS_COMPILE = "-Wno-undef";
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/xine-lib/default.nix b/pkgs/development/libraries/xine-lib/default.nix
index 8915299a7349b..a372d369a9eaa 100644
--- a/pkgs/development/libraries/xine-lib/default.nix
+++ b/pkgs/development/libraries/xine-lib/default.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_LDFLAGS = "-lxcb-shm";
+  env.NIX_LDFLAGS = "-lxcb-shm";
 
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/xmlsec/default.nix b/pkgs/development/libraries/xmlsec/default.nix
index 8bf9876095003..f8a390216b0d2 100644
--- a/pkgs/development/libraries/xmlsec/default.nix
+++ b/pkgs/development/libraries/xmlsec/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation {
   configureFlags = [ "--enable-soap" ];
 
   # otherwise libxmlsec1-gnutls.so won't find libgcrypt.so, after #909
-  NIX_LDFLAGS = "-lgcrypt";
+  env.NIX_LDFLAGS = "-lgcrypt";
 
   postInstall = ''
     moveToOutput "bin/xmlsec1-config" "$dev"
diff --git a/pkgs/development/libraries/zeroc-ice/default.nix b/pkgs/development/libraries/zeroc-ice/default.nix
index ef16e381bcfd7..08545413afdc7 100644
--- a/pkgs/development/libraries/zeroc-ice/default.nix
+++ b/pkgs/development/libraries/zeroc-ice/default.nix
@@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {
   buildInputs = [ zeroc_mcpp bzip2 expat openssl lmdb ]
     ++ lib.optionals stdenv.isDarwin [ darwin.cctools libiconv Security ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=class-memaccess -Wno-error=deprecated-copy";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=class-memaccess -Wno-error=deprecated-copy";
 
   prePatch = lib.optional stdenv.isDarwin ''
     substituteInPlace Make.rules.Darwin \
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index 998550d1fee6e..85cf287a0b83c 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -90,7 +90,7 @@ stdenv.mkDerivation (rec {
 
   # As zlib takes part in the stdenv building, we don't want references
   # to the bootstrap-tools libgcc (as uses to happen on arm/mips)
-  NIX_CFLAGS_COMPILE = lib.optionalString (!stdenv.hostPlatform.isDarwin) "-static-libgcc";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (!stdenv.hostPlatform.isDarwin) "-static-libgcc";
 
   # We don't strip on static cross-compilation because of reports that native
   # stripping corrupted the target library; see commit 12e960f5 for the report.
diff --git a/pkgs/development/lisp-modules/clwrapper/default.nix b/pkgs/development/lisp-modules/clwrapper/default.nix
index 69872eb41af6a..7ae80932ef983 100644
--- a/pkgs/development/lisp-modules/clwrapper/default.nix
+++ b/pkgs/development/lisp-modules/clwrapper/default.nix
@@ -2,7 +2,8 @@
 stdenv.mkDerivation {
   name = "cl-wrapper-script";
 
-  buildPhase="";
+  dontUnpack = true;
+  dontBuild = true;
 
   installPhase=''
     mkdir -p "$out"/bin
@@ -42,9 +43,7 @@ stdenv.mkDerivation {
 
   setupHook = ./setup-hook.sh;
 
-  phases="installPhase fixupPhase";
-
-  ASDF_OUTPUT_TRANSLATIONS="${builtins.storeDir}/:${builtins.storeDir}";
+  env.ASDF_OUTPUT_TRANSLATIONS="${builtins.storeDir}/:${builtins.storeDir}";
 
   passthru = {
     inherit lisp;
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index eec969f99caf4..a5ec4587a69c0 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -305,7 +305,7 @@ with super;
         nativeBuildInputs = [ pkgs.fixDarwinDylibNames ];
 
         # Fixup linking libluv.dylib, for some reason it's not linked against lua correctly.
-        NIX_LDFLAGS = pkgs.lib.optionalString pkgs.stdenv.isDarwin
+        env.NIX_LDFLAGS = pkgs.lib.optionalString pkgs.stdenv.isDarwin
           (if isLuaJIT then "-lluajit-${lua.luaversion}" else "-llua");
       });
     };
diff --git a/pkgs/development/misc/google-clasp/google-clasp.nix b/pkgs/development/misc/google-clasp/google-clasp.nix
index baacee29ff201..01aa40cec33f5 100644
--- a/pkgs/development/misc/google-clasp/google-clasp.nix
+++ b/pkgs/development/misc/google-clasp/google-clasp.nix
@@ -6,7 +6,7 @@
 
 let
   nodeEnv = import ../../node-packages/node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile;
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile jq;
     inherit pkgs nodejs;
     libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
   };
diff --git a/pkgs/development/misc/resholve/deps.nix b/pkgs/development/misc/resholve/deps.nix
index 6a1d9c77b5a0c..2a11a0b2c26f2 100644
--- a/pkgs/development/misc/resholve/deps.nix
+++ b/pkgs/development/misc/resholve/deps.nix
@@ -80,7 +80,7 @@ rec {
 
     # TODO: not sure why I'm having to set this for nix-build...
     #       can anyone tell if I'm doing something wrong?
-    SOURCE_DATE_EPOCH = 315532800;
+    env.SOURCE_DATE_EPOCH = 315532800;
 
     # These aren't, strictly speaking, nix/nixpkgs specific, but I've
     # had hell upstreaming them. Pulling from resholve source and
@@ -103,10 +103,10 @@ rec {
       patchShebangs asdl build core doctools frontend native oil_lang
     '';
 
-    _NIX_SHELL_LIBCMARK = "${cmark}/lib/libcmark${stdenv.hostPlatform.extensions.sharedLibrary}";
+    env._NIX_SHELL_LIBCMARK = "${cmark}/lib/libcmark${stdenv.hostPlatform.extensions.sharedLibrary}";
 
     # See earlier note on glibcLocales
-    LOCALE_ARCHIVE = lib.optionalString (stdenv.buildPlatform.libc == "glibc") "${glibcLocales}/lib/locale/locale-archive";
+    env.LOCALE_ARCHIVE = lib.optionalString (stdenv.buildPlatform.libc == "glibc") "${glibcLocales}/lib/locale/locale-archive";
 
     meta = {
       description = "A new unix shell";
diff --git a/pkgs/development/misc/resholve/resholve.nix b/pkgs/development/misc/resholve/resholve.nix
index 4d039770ce0e5..48d48de2bb80e 100644
--- a/pkgs/development/misc/resholve/resholve.nix
+++ b/pkgs/development/misc/resholve/resholve.nix
@@ -58,7 +58,7 @@ python27Packages.buildPythonApplication {
 
   inherit doCheck;
   checkInputs = [ bats ];
-  RESHOLVE_PATH = "${lib.makeBinPath [ file findutils gettext ]}";
+  env.RESHOLVE_PATH = "${lib.makeBinPath [ file findutils gettext ]}";
 
   checkPhase = ''
     # explicit interpreter for test suite
diff --git a/pkgs/development/node-packages/composition.nix b/pkgs/development/node-packages/composition.nix
index 64326c6b21602..3ecf23f663437 100644
--- a/pkgs/development/node-packages/composition.nix
+++ b/pkgs/development/node-packages/composition.nix
@@ -6,7 +6,7 @@
 
 let
   nodeEnv = import ./node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile;
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile jq;
     inherit pkgs nodejs;
     libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
   };
diff --git a/pkgs/development/node-packages/node-env.nix b/pkgs/development/node-packages/node-env.nix
index c2b723195b77e..1d42af58719a3 100644
--- a/pkgs/development/node-packages/node-env.nix
+++ b/pkgs/development/node-packages/node-env.nix
@@ -1,6 +1,6 @@
 # This file originates from node2nix
 
-{lib, stdenv, nodejs, python2, pkgs, libtool, runCommand, writeTextFile}:
+{lib, stdenv, nodejs, python2, pkgs, libtool, runCommand, writeTextFile, jq}:
 
 let
   # Workaround to cope with utillinux in Nixpkgs 20.09 and util-linux in Nixpkgs master
@@ -327,7 +327,7 @@ let
     ''
         # Pinpoint the versions of all dependencies to the ones that are actually being used
         echo "pinpointing versions of dependencies..."
-        source $pinpointDependenciesScriptPath
+        source <(${jq}/bin/jq -r <$NIX_BUILD_TOP/.attrs.json '.pinpointDependenciesScript')
 
         # Patch the shebangs of the bundled modules to prevent them from
         # calling executables outside the Nix store as much as possible
@@ -411,15 +411,13 @@ let
       compositionScript = composePackage args;
       pinpointDependenciesScript = pinpointDependenciesOfPackage args;
 
-      passAsFile = [ "compositionScript" "pinpointDependenciesScript" ];
-
       installPhase = ''
         # Create and enter a root node_modules/ folder
         mkdir -p $out/lib/node_modules
         cd $out/lib/node_modules
 
         # Compose the package and all its dependencies
-        source $compositionScriptPath
+        source <(${jq}/bin/jq -r <$NIX_BUILD_TOP/.attrs.json '.compositionScript')
 
         ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
 
@@ -483,13 +481,11 @@ let
         includeScript = includeDependencies { inherit dependencies; };
         pinpointDependenciesScript = pinpointDependenciesOfPackage args;
 
-        passAsFile = [ "includeScript" "pinpointDependenciesScript" ];
-
         installPhase = ''
           mkdir -p $out/${packageName}
           cd $out/${packageName}
 
-          source $includeScriptPath
+          source <(${jq}/bin/jq -r <$NIX_BUILD_TOP/.attrs.json '.includeScript')
 
           # Create fake package.json to make the npm commands work properly
           cp ${src}/package.json .
diff --git a/pkgs/development/ocaml-modules/cil/default.nix b/pkgs/development/ocaml-modules/cil/default.nix
index 3aefe2eb874cf..1afea028790f7 100644
--- a/pkgs/development/ocaml-modules/cil/default.nix
+++ b/pkgs/development/ocaml-modules/cil/default.nix
@@ -19,7 +19,6 @@ stdenv.mkDerivation {
     substituteInPlace Makefile.in --replace 'MACHDEPCC=gcc' 'MACHDEPCC=$(CC)'
     export FORCE_PERL_PREFIX=1
   '';
-  prefixKey = "-prefix=";
 
   meta = with lib; {
     homepage = "http://kerneis.github.io/cil/";
diff --git a/pkgs/development/ocaml-modules/curses/default.nix b/pkgs/development/ocaml-modules/curses/default.nix
index f1211ad9cdc63..2e086b3208095 100644
--- a/pkgs/development/ocaml-modules/curses/default.nix
+++ b/pkgs/development/ocaml-modules/curses/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ ocaml findlib ];
 
   # Fix build for recent ncurses versions
-  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
+  env.NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
 
   createFindlibDestdir = true;
 
diff --git a/pkgs/development/ocaml-modules/elina/default.nix b/pkgs/development/ocaml-modules/elina/default.nix
index 4eff6c2957de8..be75db0249100 100644
--- a/pkgs/development/ocaml-modules/elina/default.nix
+++ b/pkgs/development/ocaml-modules/elina/default.nix
@@ -12,7 +12,6 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ apron camlidl gmp mpfr ];
 
-  prefixKey = "--prefix ";
   configureFlags = [
     "--use-apron"
     "--use-opam"
@@ -21,6 +20,8 @@ stdenv.mkDerivation rec {
   ++ lib.optional stdenv.isDarwin "--absolute-dylibs"
   ;
 
+  prefixAsSeperateFlag = true;
+
   createFindlibDestdir = true;
 
   meta = {
diff --git a/pkgs/development/ocaml-modules/mlgmpidl/default.nix b/pkgs/development/ocaml-modules/mlgmpidl/default.nix
index a0026e3a8ca85..cc42a4283d6cc 100644
--- a/pkgs/development/ocaml-modules/mlgmpidl/default.nix
+++ b/pkgs/development/ocaml-modules/mlgmpidl/default.nix
@@ -12,10 +12,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ perl gmp mpfr ocaml findlib camlidl ];
 
-  prefixKey = "-prefix ";
+  prefixAsSeperateFlag = true;
+
   configureFlags = [
-    "--gmp-prefix ${gmp.dev}"
-    "--mpfr-prefix ${mpfr.dev}"
+    "--gmp-prefix" gmp.dev
+    "--mpfr-prefix" mpfr.dev
   ];
 
   postConfigure = ''
diff --git a/pkgs/development/ocaml-modules/ounit/default.nix b/pkgs/development/ocaml-modules/ounit/default.nix
index 2f4a4f0437a2a..34ec3a605e4ce 100644
--- a/pkgs/development/ocaml-modules/ounit/default.nix
+++ b/pkgs/development/ocaml-modules/ounit/default.nix
@@ -7,10 +7,10 @@ stdenv.mkDerivation {
   buildInputs = [ findlib ];
   propagatedBuildInputs = [ ounit2 ];
 
-  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
+  dontBuild = true;
 
   createFindlibDestdir = true;
 
-  installTargets = "install-ounit version='${ounit2.version}'";
+  installTargets = [ "install-ounit" "version='${ounit2.version}'" ];
 
 }
diff --git a/pkgs/development/ocaml-modules/zarith/default.nix b/pkgs/development/ocaml-modules/zarith/default.nix
index eed6b158d4a6f..01fdec8586a97 100644
--- a/pkgs/development/ocaml-modules/zarith/default.nix
+++ b/pkgs/development/ocaml-modules/zarith/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ gmp ];
 
   dontAddPrefix = true;
-  configureFlags = [ "-installdir ${placeholder "out"}/lib/ocaml/${ocaml.version}/site-lib" ];
+  configureFlags = [ "-installdir" "${placeholder "out"}/lib/ocaml/${ocaml.version}/site-lib" ];
 
   preInstall = "mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/stublibs";
 
diff --git a/pkgs/development/octave-modules/io/default.nix b/pkgs/development/octave-modules/io/default.nix
index 57058c5f95de5..56481e38f35ff 100644
--- a/pkgs/development/octave-modules/io/default.nix
+++ b/pkgs/development/octave-modules/io/default.nix
@@ -15,9 +15,7 @@ buildOctavePackage rec {
     sha256 = "044y8lfp93fx0592mv6x2ss0nvjkjgvlci3c3ahav76pk1j3rikb";
   };
 
-  buildInputs = [
-    (lib.optional enableJava jdk)
-  ];
+  buildInputs = lib.optional enableJava jdk;
 
   propagatedBuildInputs = [
     unzip
diff --git a/pkgs/development/perl-modules/Mozilla-LDAP/default.nix b/pkgs/development/perl-modules/Mozilla-LDAP/default.nix
index 6c3d01a346295..12808863bfe7b 100644
--- a/pkgs/development/perl-modules/Mozilla-LDAP/default.nix
+++ b/pkgs/development/perl-modules/Mozilla-LDAP/default.nix
@@ -3,13 +3,16 @@
 buildPerlPackage rec {
   pname = "Mozilla-Ldap";
   version = "1.5.3";
-  USE_OPENLDAP = 1;
-  LDAPSDKDIR = openldap.dev;
-  LDAPSDKLIBDIR = "${openldap.out}/lib";
+
   src = fetchurl {
     url = "https://ftp.mozilla.org/pub/directory/perldap/releases/${version}/src/perl-mozldap-${version}.tar.gz";
     sha256 = "0s0albdw0zvg3w37s7is7gddr4mqwicjxxsy400n1p96l7ipnw4x";
   };
+
+  env.USE_OPENLDAP = 1;
+  env.LDAPSDKDIR = toString openldap.dev;
+  env.LDAPSDKLIBDIR = "${openldap.out}/lib";
+
   meta = {
     description = "Mozilla's ldap client library";
     homepage = "https://metacpan.org/release/perldap";
diff --git a/pkgs/development/perl-modules/generic/builder.sh b/pkgs/development/perl-modules/generic/builder.sh
index 9b42401fc4dcd..9fa54d2687e28 100644
--- a/pkgs/development/perl-modules/generic/builder.sh
+++ b/pkgs/development/perl-modules/generic/builder.sh
@@ -1,3 +1,5 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
+
 source $stdenv/setup
 
 PERL5LIB="$PERL5LIB${PERL5LIB:+:}$out/lib/perl5/site_perl"
diff --git a/pkgs/development/perl-modules/generic/default.nix b/pkgs/development/perl-modules/generic/default.nix
index 9beacd65a646e..c702ddf216d8a 100644
--- a/pkgs/development/perl-modules/generic/default.nix
+++ b/pkgs/development/perl-modules/generic/default.nix
@@ -17,17 +17,19 @@ toPerlModule(stdenv.mkDerivation (
 
     checkTarget = "test";
 
-    # Prevent CPAN downloads.
-    PERL_AUTOINSTALL = "--skipdeps";
-
-    # From http://wiki.cpantesters.org/wiki/CPANAuthorNotes: "allows
-    # authors to skip certain tests (or include certain tests) when
-    # the results are not being monitored by a human being."
-    AUTOMATED_TESTING = true;
-
-    # current directory (".") is removed from @INC in Perl 5.26 but many old libs rely on it
-    # https://metacpan.org/pod/release/XSAWYERX/perl-5.26.0/pod/perldelta.pod#Removal-of-the-current-directory-%28%22.%22%29-from-@INC
-    PERL_USE_UNSAFE_INC = "1";
+    env = {
+      # Prevent CPAN downloads.
+      PERL_AUTOINSTALL = "--skipdeps";
+
+      # From http://wiki.cpantesters.org/wiki/CPANAuthorNotes: "allows
+      # authors to skip certain tests (or include certain tests) when
+      # the results are not being monitored by a human being."
+      AUTOMATED_TESTING = true;
+
+      # current directory (".") is removed from @INC in Perl 5.26 but many old libs rely on it
+      # https://metacpan.org/pod/release/XSAWYERX/perl-5.26.0/pod/perldelta.pod#Removal-of-the-current-directory-%28%22.%22%29-from-@INC
+      PERL_USE_UNSAFE_INC = "1";
+    };
 
     meta.homepage = "https://metacpan.org/release/${lib.getName attrs}"; # TODO: phase-out `attrs.name`
     meta.platforms = perl.meta.platforms;
diff --git a/pkgs/development/pharo/vm/build-vm.nix b/pkgs/development/pharo/vm/build-vm.nix
index c1f703f725156..5f193aefe70b5 100644
--- a/pkgs/development/pharo/vm/build-vm.nix
+++ b/pkgs/development/pharo/vm/build-vm.nix
@@ -85,8 +85,8 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--without-npsqueak"
                      "--with-vmversion=5.0"
                      "--with-src=${vm}" ];
-  CFLAGS = "-DPharoVM -DIMMUTABILITY=1 -msse2 -D_GNU_SOURCE -DCOGMTVM=0 -g -O2 -DNDEBUG -DDEBUGVM=0";
-  LDFLAGS = "-Wl,-z,now";
+  env.CFLAGS = "-DPharoVM -DIMMUTABILITY=1 -msse2 -D_GNU_SOURCE -DCOGMTVM=0 -g -O2 -DNDEBUG -DDEBUGVM=0";
+  env.LDFLAGS = "-Wl,-z,now";
 
   # VM sources require some patching before build.
   prePatch = ''
diff --git a/pkgs/development/python-modules/ansible-lint/default.nix b/pkgs/development/python-modules/ansible-lint/default.nix
index eec3b5cc813ea..b9d4f47b4aca2 100644
--- a/pkgs/development/python-modules/ansible-lint/default.nix
+++ b/pkgs/development/python-modules/ansible-lint/default.nix
@@ -84,7 +84,7 @@ buildPythonPackage rec {
     "test_prerun_reqs_v2"
   ];
 
-  makeWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ ansible-base ]}" ];
+  makeWrapperArgs = [ "--prefix" "PATH" ":" (lib.makeBinPath [ ansible-base ]) ];
 
   meta = with lib; {
     homepage = "https://github.com/ansible-community/ansible-lint";
diff --git a/pkgs/development/python-modules/bootstrapped-pip/default.nix b/pkgs/development/python-modules/bootstrapped-pip/default.nix
index 42eb1cccee351..04014dc50236d 100644
--- a/pkgs/development/python-modules/bootstrapped-pip/default.nix
+++ b/pkgs/development/python-modules/bootstrapped-pip/default.nix
@@ -22,14 +22,17 @@ stdenv.mkDerivation rec {
     (pipInstallHook.override{pip=null;})
     (setuptoolsBuildHook.override{setuptools=null; wheel=null;})
   ];
+  nativeBuildInputs = [ makeWrapper unzip ];
+  buildInputs = [ python ];
+
+  postUnpack = ''
+    chmod -R u+w *
+  '';
 
   postPatch = ''
     mkdir -p $out/bin
   '';
 
-  nativeBuildInputs = [ makeWrapper unzip ];
-  buildInputs = [ python ];
-
   buildPhase = ":";
 
   installPhase = lib.strings.optionalString (!stdenv.hostPlatform.isWindows) ''
diff --git a/pkgs/development/python-modules/certbot/default.nix b/pkgs/development/python-modules/certbot/default.nix
index 12e541d9007a5..88b63d80c51eb 100644
--- a/pkgs/development/python-modules/certbot/default.nix
+++ b/pkgs/development/python-modules/certbot/default.nix
@@ -53,7 +53,7 @@ buildPythonPackage rec {
 
   doCheck = true;
 
-  makeWrapperArgs = [ "--prefix PATH : ${dialog}/bin" ];
+  makeWrapperArgs = [ "--prefix" "PATH" ":" "${dialog}/bin" ];
 
   # certbot.withPlugins has a similar calling convention as python*.withPackages
   # it gets invoked with a lambda, and invokes that lambda with the python package set matching certbot's:
diff --git a/pkgs/development/python-modules/cffi/default.nix b/pkgs/development/python-modules/cffi/default.nix
index 92899ed85e583..55e2bbe4c4bf3 100644
--- a/pkgs/development/python-modules/cffi/default.nix
+++ b/pkgs/development/python-modules/cffi/default.nix
@@ -30,7 +30,7 @@ if isPyPy then null else buildPythonPackage rec {
   '';
 
   # The tests use -Werror but with python3.6 clang detects some unreachable code.
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
     "-Wno-unused-command-line-argument -Wno-unreachable-code";
 
   doCheck = !stdenv.hostPlatform.isMusl && !stdenv.isDarwin; # TODO: Investigate
diff --git a/pkgs/development/python-modules/cld2-cffi/default.nix b/pkgs/development/python-modules/cld2-cffi/default.nix
index fc5a6b0e54bc2..eefefcafbd6b8 100644
--- a/pkgs/development/python-modules/cld2-cffi/default.nix
+++ b/pkgs/development/python-modules/cld2-cffi/default.nix
@@ -13,7 +13,7 @@ buildPythonPackage rec {
   checkInputs = [ nose ];
 
   # gcc doesn't approve of this code, so disable -Werror
-  NIX_CFLAGS_COMPILE = "-w" + lib.optionalString stdenv.cc.isClang " -Wno-error=c++11-narrowing";
+  env.NIX_CFLAGS_COMPILE = "-w" + lib.optionalString stdenv.cc.isClang " -Wno-error=c++11-narrowing";
 
   checkPhase = "nosetests -v";
 
diff --git a/pkgs/development/python-modules/click/default.nix b/pkgs/development/python-modules/click/default.nix
index fcbd4d0981af7..769ffd308f281 100644
--- a/pkgs/development/python-modules/click/default.nix
+++ b/pkgs/development/python-modules/click/default.nix
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   checkInputs = [ pytestCheckHook ];
 
   meta = with lib; {
-    homepage = "https://click.palletsprojects.com/";
+    homepage = "http://click.pocoo.org/";
     description = "Create beautiful command line interfaces in Python";
     longDescription = ''
       A Python package for creating beautiful command line interfaces in a
diff --git a/pkgs/development/python-modules/datatable/default.nix b/pkgs/development/python-modules/datatable/default.nix
index 60eb0df1d09d2..29c3826d14a7f 100644
--- a/pkgs/development/python-modules/datatable/default.nix
+++ b/pkgs/development/python-modules/datatable/default.nix
@@ -39,7 +39,7 @@ buildPythonPackage rec {
   checkInputs = [ docutils pytestCheckHook ];
 
   LLVM = llvm;
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-isystem ${lib.getDev libcxx}/include/c++/v1";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-isystem ${lib.getDev libcxx}/include/c++/v1";
 
   pytestFlagsArray = let
     # ini file (not included in tarball) required to change python_files setting,
diff --git a/pkgs/development/python-modules/fiona/default.nix b/pkgs/development/python-modules/fiona/default.nix
index 42f1a410624ca..870b9e27caae7 100644
--- a/pkgs/development/python-modules/fiona/default.nix
+++ b/pkgs/development/python-modules/fiona/default.nix
@@ -14,7 +14,7 @@ buildPythonPackage rec {
     sha256 = "b732ece0ff8886a29c439723a3e1fc382718804bb057519d537a81308854967a";
   };
 
-  CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
+  env.CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
 
   nativeBuildInputs = [
     gdal_2 # for gdal-config
diff --git a/pkgs/development/python-modules/google-crc32c/default.nix b/pkgs/development/python-modules/google-crc32c/default.nix
index b36635654a9d5..0ec10ab075a28 100644
--- a/pkgs/development/python-modules/google-crc32c/default.nix
+++ b/pkgs/development/python-modules/google-crc32c/default.nix
@@ -15,8 +15,8 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ cffi ];
 
-  LDFLAGS = "-L${crc32c}/lib";
-  CFLAGS = "-I${crc32c}/include";
+  env.LDFLAGS = "-L${crc32c}/lib";
+  env.CFLAGS = "-I${crc32c}/include";
 
   checkInputs = [ pytestCheckHook crc32c ];
 
diff --git a/pkgs/development/python-modules/graphviz/default.nix b/pkgs/development/python-modules/graphviz/default.nix
index 1a0e6d903a474..eba31e0ab789c 100644
--- a/pkgs/development/python-modules/graphviz/default.nix
+++ b/pkgs/development/python-modules/graphviz/default.nix
@@ -31,9 +31,9 @@ buildPythonPackage rec {
   ];
 
   # Fontconfig error: Cannot load default config file
-  FONTCONFIG_FILE = makeFontsConf {
+  env.FONTCONFIG_FILE = toString (makeFontsConf {
     fontDirectories = [ freefont_ttf ];
-  };
+  });
 
   checkInputs = [ mock pytestCheckHook pytest-mock pytestcov ];
 
diff --git a/pkgs/development/python-modules/ifcopenshell/default.nix b/pkgs/development/python-modules/ifcopenshell/default.nix
index 2eedaaece690b..2788542661f51 100644
--- a/pkgs/development/python-modules/ifcopenshell/default.nix
+++ b/pkgs/development/python-modules/ifcopenshell/default.nix
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     cd cmake
   '';
 
-  PYTHONUSERBASE=".";
+  env.PYTHONUSERBASE=".";
   cmakeFlags = [
     "-DUSERSPACE_PYTHON_PREFIX=ON"
     "-DOCC_INCLUDE_DIR=${opencascade-occt}/include/opencascade"
diff --git a/pkgs/development/python-modules/jaraco_classes/default.nix b/pkgs/development/python-modules/jaraco_classes/default.nix
index 9054f1f109c52..f4a3fd3f11b6c 100644
--- a/pkgs/development/python-modules/jaraco_classes/default.nix
+++ b/pkgs/development/python-modules/jaraco_classes/default.nix
@@ -18,7 +18,7 @@ buildPythonPackage rec {
 
   pythonNamespaces = [ "jaraco" ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [ setuptools_scm toml ];
 
diff --git a/pkgs/development/python-modules/jaraco_text/default.nix b/pkgs/development/python-modules/jaraco_text/default.nix
index fb945d5b3f6fa..4f5173281b036 100644
--- a/pkgs/development/python-modules/jaraco_text/default.nix
+++ b/pkgs/development/python-modules/jaraco_text/default.nix
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   nativeBuildInputs =[ setuptools_scm ];
   propagatedBuildInputs = [
     jaraco_functools
-  ] ++ lib.optional (pythonOlder "3.7") [ importlib-resources ];
+  ] ++ lib.optional (pythonOlder "3.7") importlib-resources;
 
   # no tests in pypi package
   doCheck = false;
diff --git a/pkgs/development/python-modules/kiwisolver/1_1.nix b/pkgs/development/python-modules/kiwisolver/1_1.nix
index 762b5bc0b7b39..5e5c9ae05ab6f 100644
--- a/pkgs/development/python-modules/kiwisolver/1_1.nix
+++ b/pkgs/development/python-modules/kiwisolver/1_1.nix
@@ -14,7 +14,7 @@ buildPythonPackage rec {
     sha256 = "53eaed412477c836e1b9522c19858a8557d6e595077830146182225613b11a75";
   };
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${lib.getDev libcxx}/include/c++/v1";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${lib.getDev libcxx}/include/c++/v1";
 
   # Does not include tests
   doCheck = false;
diff --git a/pkgs/development/python-modules/kiwisolver/default.nix b/pkgs/development/python-modules/kiwisolver/default.nix
index 2b157494f9193..192d4d353261d 100644
--- a/pkgs/development/python-modules/kiwisolver/default.nix
+++ b/pkgs/development/python-modules/kiwisolver/default.nix
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     sha256 = "950a199911a8d94683a6b10321f9345d5a3a8433ec58b217ace979e18f16e248";
   };
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${lib.getDev libcxx}/include/c++/v1";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${lib.getDev libcxx}/include/c++/v1";
 
   nativeBuildInputs = [
     cppy
diff --git a/pkgs/development/python-modules/notebook/default.nix b/pkgs/development/python-modules/notebook/default.nix
index c7dc40d707915..2d44c40c935af 100644
--- a/pkgs/development/python-modules/notebook/default.nix
+++ b/pkgs/development/python-modules/notebook/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     sha256 = "cbc9398d6c81473e9cdb891d2cae9c0d3718fca289dda6d26df5cb660fcadc7d";
   };
 
-  LC_ALL = "en_US.utf8";
+  env.LC_ALL = "en_US.utf8";
 
   checkInputs = [ nose pytestCheckHook glibcLocales ]
     ++ (if isPy3k then [ nose_warnings_filters ] else [ mock ]);
diff --git a/pkgs/development/python-modules/numba/default.nix b/pkgs/development/python-modules/numba/default.nix
index c49a4105abe9c..b18cb5e64cf2c 100644
--- a/pkgs/development/python-modules/numba/default.nix
+++ b/pkgs/development/python-modules/numba/default.nix
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     sha256 = "55c11d7edbba2ba715f2b56f5294cad55cfd87bff98e2627c3047c2d5cc52d16";
   };
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${lib.getDev libcxx}/include/c++/v1";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${lib.getDev libcxx}/include/c++/v1";
 
   propagatedBuildInputs = [ numpy llvmlite setuptools ];
   pythonImportsCheck = [ "numba" ];
diff --git a/pkgs/development/python-modules/paramiko/default.nix b/pkgs/development/python-modules/paramiko/default.nix
index c2237f68524f8..3e073e3d8d983 100644
--- a/pkgs/development/python-modules/paramiko/default.nix
+++ b/pkgs/development/python-modules/paramiko/default.nix
@@ -9,6 +9,7 @@
 , pytest
 , pytest-relaxed
 , mock
+, enum34
 }:
 
 buildPythonPackage rec {
@@ -21,7 +22,7 @@ buildPythonPackage rec {
   };
 
   checkInputs = [ invoke pytest mock pytest-relaxed ];
-  propagatedBuildInputs = [ bcrypt cryptography pynacl pyasn1 ];
+  propagatedBuildInputs = [ bcrypt cryptography pynacl pyasn1 enum34 ];
 
   __darwinAllowLocalNetworking = true;
 
diff --git a/pkgs/development/python-modules/pivy/default.nix b/pkgs/development/python-modules/pivy/default.nix
index 7645fdaec8aa0..790039c408084 100644
--- a/pkgs/development/python-modules/pivy/default.nix
+++ b/pkgs/development/python-modules/pivy/default.nix
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     libXi libXext libSM libICE libX11
   ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-I${qtbase.dev}/include/QtCore"
     "-I${qtbase.dev}/include/QtGui"
     "-I${qtbase.dev}/include/QtOpenGL"
diff --git a/pkgs/development/python-modules/py3exiv2/default.nix b/pkgs/development/python-modules/py3exiv2/default.nix
index 59d0cdb7299f9..6ef204fe52579 100644
--- a/pkgs/development/python-modules/py3exiv2/default.nix
+++ b/pkgs/development/python-modules/py3exiv2/default.nix
@@ -13,7 +13,7 @@ buildPythonPackage rec {
   buildInputs = [ exiv2 boost ];
 
   # work around python distutils compiling C++ with $CC (see issue #26709)
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${lib.getDev libcxx}/include/c++/v1";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${lib.getDev libcxx}/include/c++/v1";
 
   meta = with lib; {
     homepage = "https://launchpad.net/py3exiv2";
diff --git a/pkgs/development/python-modules/pygtk/default.nix b/pkgs/development/python-modules/pygtk/default.nix
index 938b55630c06a..45ae695776136 100644
--- a/pkgs/development/python-modules/pygtk/default.nix
+++ b/pkgs/development/python-modules/pygtk/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
 
   buildPhase = "buildPhase";
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-ObjC";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-ObjC";
 
   installPhase = "installPhase";
 
diff --git a/pkgs/development/python-modules/pynest2d/default.nix b/pkgs/development/python-modules/pynest2d/default.nix
index f3b5b9ba68549..847a5fb674a51 100644
--- a/pkgs/development/python-modules/pynest2d/default.nix
+++ b/pkgs/development/python-modules/pynest2d/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ libnest2d sip_4 clipper ];
   nativeBuildInputs = [ cmake ];
 
-  CLIPPER_PATH = "${clipper.out}";
+  env.CLIPPER_PATH = "${clipper.out}";
 
   postPatch = ''
      sed -i 's#''${Python3_SITEARCH}#${placeholder "out"}/${python3.sitePackages}#' cmake/SIPMacros.cmake
diff --git a/pkgs/development/python-modules/pypoppler/default.nix b/pkgs/development/python-modules/pypoppler/default.nix
index d325c170dc64b..1759087e55efe 100644
--- a/pkgs/development/python-modules/pypoppler/default.nix
+++ b/pkgs/development/python-modules/pypoppler/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     sha256 = "47e6ac99e5b114b9abf2d1dd1bca06f22c028d025432512989f659142470810f";
   };
 
-  NIX_CFLAGS_COMPILE="-I${pkgs.poppler.dev}/include/poppler/";
+  env.NIX_CFLAGS_COMPILE="-I${pkgs.poppler.dev}/include/poppler/";
   nativeBuildInputs = [ pkgs.pkg-config ];
   buildInputs = [ pkgs.poppler.dev ];
   propagatedBuildInputs = [ pycairo pygobject2 ];
diff --git a/pkgs/development/python-modules/pyscard/default.nix b/pkgs/development/python-modules/pyscard/default.nix
index 28c40e5ec5fc0..a25ddebf6bff5 100644
--- a/pkgs/development/python-modules/pyscard/default.nix
+++ b/pkgs/development/python-modules/pyscard/default.nix
@@ -24,7 +24,7 @@ buildPythonPackage rec {
                 "${lib.getLib pcsclite}/lib/libpcsclite${stdenv.hostPlatform.extensions.sharedLibrary}"
   '';
 
-  NIX_CFLAGS_COMPILE = lib.optionalString (! withApplePCSC)
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (! withApplePCSC)
     "-I ${lib.getDev pcsclite}/include/PCSC";
 
   propagatedBuildInputs = if withApplePCSC then [ PCSC ] else [ pcsclite ];
diff --git a/pkgs/development/python-modules/python-dbusmock/default.nix b/pkgs/development/python-modules/python-dbusmock/default.nix
index d643603a0679e..e53f5d89c49ed 100644
--- a/pkgs/development/python-modules/python-dbusmock/default.nix
+++ b/pkgs/development/python-modules/python-dbusmock/default.nix
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   # TODO: Get the rest of these tests running?
   # This is a mocking library used as a check dependency for a single derivation.
   # That derivation's tests pass. Maybe not worth the effort to fix these...
-  NOSE_EXCLUDE = lib.concatStringsSep "," [
+  env.NOSE_EXCLUDE = lib.concatStringsSep "," [
     "test_bluez4" # NixOS ships BlueZ5
     # These appear to fail because they're expecting to run in an Ubuntu chroot?
     "test_everything" # BlueZ5 OBEX
diff --git a/pkgs/development/python-modules/python-uinput/default.nix b/pkgs/development/python-modules/python-uinput/default.nix
index 8d82ffb6b3b9f..ffc257fb34f7a 100644
--- a/pkgs/development/python-modules/python-uinput/default.nix
+++ b/pkgs/development/python-modules/python-uinput/default.nix
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   buildInputs = [ udev ];
 
-  NIX_CFLAGS_LINK = "-ludev";
+  env.NIX_CFLAGS_LINK = "-ludev";
 
   meta = with lib; {
     description = "Pythonic API to Linux uinput kernel module";
diff --git a/pkgs/development/python-modules/pytorch/default.nix b/pkgs/development/python-modules/pytorch/default.nix
index 59a8c74f709ce..c9dd76e8a023c 100644
--- a/pkgs/development/python-modules/pytorch/default.nix
+++ b/pkgs/development/python-modules/pytorch/default.nix
@@ -209,7 +209,7 @@ in buildPythonPackage rec {
   #
   # Also of interest: pytorch ignores CXXFLAGS uses CFLAGS for both C and C++:
   # https://github.com/pytorch/pytorch/blob/v1.2.0/setup.py#L17
-  NIX_CFLAGS_COMPILE = lib.optionals (blas.implementation == "mkl") [ "-Wno-error=array-bounds" ];
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (blas.implementation == "mkl") "-Wno-error=array-bounds";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/python-modules/roboschool/default.nix b/pkgs/development/python-modules/roboschool/default.nix
index 97eee2155a5e1..32d241929192d 100644
--- a/pkgs/development/python-modules/roboschool/default.nix
+++ b/pkgs/development/python-modules/roboschool/default.nix
@@ -46,7 +46,7 @@ buildPythonPackage rec {
 
   dontWrapQtApps = true;
 
-  NIX_CFLAGS_COMPILE="-I ${python}/include/${python.libPrefix}";
+  env.NIX_CFLAGS_COMPILE = "-I ${python}/include/${python.libPrefix}";
 
   patches = [
     # Remove kwarg that was removed in upstream gym
diff --git a/pkgs/development/python-modules/shiboken2/default.nix b/pkgs/development/python-modules/shiboken2/default.nix
index 23836addd0ca9..b96699c6c524a 100644
--- a/pkgs/development/python-modules/shiboken2/default.nix
+++ b/pkgs/development/python-modules/shiboken2/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
     cd sources/shiboken2
   '';
 
-  CLANG_INSTALL_DIR = llvmPackages.libclang.out;
+  env.CLANG_INSTALL_DIR = toString llvmPackages.libclang.out;
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ llvmPackages.libclang python qt5.qtbase qt5.qtxmlpatterns ];
diff --git a/pkgs/development/python-modules/tensorflow/default.nix b/pkgs/development/python-modules/tensorflow/default.nix
index 0216c05eeacf1..3cff43c500ddc 100644
--- a/pkgs/development/python-modules/tensorflow/default.nix
+++ b/pkgs/development/python-modules/tensorflow/default.nix
@@ -242,7 +242,7 @@ let
     '';
 
     # https://github.com/tensorflow/tensorflow/pull/39470
-    NIX_CFLAGS_COMPILE = [ "-Wno-stringop-truncation" ];
+    env.NIX_CFLAGS_COMPILE = "-Wno-stringop-truncation";
 
     preConfigure = let
       opt_flags = []
diff --git a/pkgs/development/python-modules/tqdm/default.nix b/pkgs/development/python-modules/tqdm/default.nix
index ae89b3ee0b07d..ccfb459cb2051 100644
--- a/pkgs/development/python-modules/tqdm/default.nix
+++ b/pkgs/development/python-modules/tqdm/default.nix
@@ -43,7 +43,7 @@ buildPythonPackage rec {
     "perf"
   ];
 
-  LC_ALL="en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
 
   pythonImportsCheck = [ "tqdm" ];
 
diff --git a/pkgs/development/r-modules/generic-builder.nix b/pkgs/development/r-modules/generic-builder.nix
index 7201bab40e129..3958128867e6a 100644
--- a/pkgs/development/r-modules/generic-builder.nix
+++ b/pkgs/development/r-modules/generic-builder.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation ({
                 lib.optionals requireX [util-linux xvfb-run] ++
                 lib.optionals stdenv.isDarwin [Cocoa Foundation gfortran];
 
-  NIX_CFLAGS_COMPILE =
+  env.NIX_CFLAGS_COMPILE =
     lib.optionalString stdenv.isDarwin "-I${lib.getDev libcxx}/include/c++/v1";
 
   configurePhase = ''
@@ -36,7 +36,7 @@ stdenv.mkDerivation ({
   installPhase = ''
     runHook preInstall
     mkdir -p $out/library
-    $rCommand CMD INSTALL $installFlags --configure-args="$configureFlags" -l $out/library .
+    $rCommand CMD INSTALL "''${installFlags[@]}" --configure-args="''${configureFlags[@]}" -l $out/library .
     runHook postInstall
   '';
 
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index 1a09ce60c044e..a7263b662d5d5 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -124,7 +124,7 @@ in
   };
 
   dep-selector-libgecode = attrs: {
-    USE_SYSTEM_GECODE = true;
+    env.USE_SYSTEM_GECODE = true;
     postInstall = ''
       installPath=$(cat $out/nix-support/gem-meta/install-path)
       sed -i $installPath/lib/dep-selector-libgecode.rb -e 's@VENDORED_GECODE_DIR =.*@VENDORED_GECODE_DIR = "${gecode_3}"@'
@@ -169,7 +169,7 @@ in
   };
 
   mimemagic = attrs: {
-    FREEDESKTOP_MIME_TYPES_PATH = "${shared-mime-info}/share/mime/packages/freedesktop.org.xml";
+    env.FREEDESKTOP_MIME_TYPES_PATH = "${shared-mime-info}/share/mime/packages/freedesktop.org.xml";
   };
 
   mini_magick = attrs: {
@@ -278,7 +278,7 @@ in
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ openssl ];
     hardeningDisable = [ "format" ];
-    NIX_CFLAGS_COMPILE = toString [
+    env.NIX_CFLAGS_COMPILE = toString [
       "-Wno-error=stringop-overflow"
       "-Wno-error=implicit-fallthrough"
       "-Wno-error=sizeof-pointer-memaccess"
@@ -433,6 +433,8 @@ in
       "--with-exslt-lib=${libxslt.out}/lib"
       "--with-exslt-include=${libxslt.dev}/include"
     ] ++ lib.optional stdenv.isDarwin "--with-iconv-dir=${libiconv}";
+    nativeBuildInputs = [ pkg-config ];
+    buildInputs = [ libxml2 libxslt ];
   };
 
   openssl = attrs: {
@@ -562,7 +564,7 @@ in
   sassc = attrs: {
     nativeBuildInputs = [ rake ];
     dontBuild = false;
-    SASS_LIBSASS_PATH = toString libsass;
+    env.SASS_LIBSASS_PATH = toString libsass;
     postPatch = ''
       substituteInPlace lib/sassc/native.rb \
         --replace 'gem_root = spec.gem_dir' 'gem_root = File.join(__dir__, "../../")'
diff --git a/pkgs/development/ruby-modules/gem/default.nix b/pkgs/development/ruby-modules/gem/default.nix
index c8dba5142082f..47e2f0866c61c 100644
--- a/pkgs/development/ruby-modules/gem/default.nix
+++ b/pkgs/development/ruby-modules/gem/default.nix
@@ -82,7 +82,6 @@ let
 in
 
 stdenv.mkDerivation ((builtins.removeAttrs attrs ["source"]) // {
-  inherit ruby;
   inherit dontBuild;
   inherit dontStrip;
   inherit type;
@@ -99,7 +98,6 @@ stdenv.mkDerivation ((builtins.removeAttrs attrs ["source"]) // {
 
   inherit src;
 
-
   unpackPhase = attrs.unpackPhase or ''
     runHook preUnpack
 
@@ -131,9 +129,12 @@ stdenv.mkDerivation ((builtins.removeAttrs attrs ["source"]) // {
 
   # As of ruby 3.0, ruby headers require -fdeclspec when building with clang
   # Introduced in https://github.com/ruby/ruby/commit/0958e19ffb047781fe1506760c7cbd8d7fe74e57
-  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isClang && lib.versionAtLeast ruby.version.major "3") [
-    "-fdeclspec"
-  ];
+  env = {
+    RUBY = toString ruby;
+    NIX_CFLAGS_COMPILE = (lib.optionalString (stdenv.cc.isClang && lib.versionAtLeast ruby.version.major "3")
+      "-fdeclspec")
+      + (lib.optionalString ((attrs.env or {}) ? NIX_CFLAGS_COMPILE) " ${attrs.env.NIX_CFLAGS_COMPILE}");
+  } // (attrs.env or {});
 
   buildPhase = attrs.buildPhase or ''
     runHook preBuild
@@ -174,21 +175,21 @@ stdenv.mkDerivation ((builtins.removeAttrs attrs ["source"]) // {
     export GEM_HOME=$out/${ruby.gemPath}
     mkdir -p $GEM_HOME
 
-    echo "buildFlags: $buildFlags"
+    echo "buildFlags: ''${buildFlags[@]}"
 
     ${lib.optionalString (type ==  "url") ''
     ruby ${./nix-bundle-install.rb} \
       "path" \
       '${gemName}' \
       '${version}' \
-      '${lib.escapeShellArgs buildFlags}'
+      "''${buildFlags[@]}"
     ''}
     ${lib.optionalString (type == "git") ''
     ruby ${./nix-bundle-install.rb} \
       "git" \
       '${gemName}' \
       '${version}' \
-      '${lib.escapeShellArgs buildFlags}' \
+      "''${buildFlags[@]}"
       '${attrs.source.url}' \
       '.' \
       '${attrs.source.rev}'
@@ -213,7 +214,7 @@ stdenv.mkDerivation ((builtins.removeAttrs attrs ["source"]) // {
       --backtrace \
       --no-env-shebang \
       ${documentFlag} \
-      $gempkg $gemFlags -- $buildFlags
+      $gempkg "''${gemFlags[@]}" -- "''${buildFlags[@]}"
 
     # looks like useless files which break build repeatability and consume space
     pushd $out/${ruby.gemPath}
diff --git a/pkgs/development/ruby-modules/gem/gem-post-build.rb b/pkgs/development/ruby-modules/gem/gem-post-build.rb
index b754f94598614..05c3f8331f733 100644
--- a/pkgs/development/ruby-modules/gem/gem-post-build.rb
+++ b/pkgs/development/ruby-modules/gem/gem-post-build.rb
@@ -3,7 +3,7 @@
 require 'rubygems/specification'
 require 'fileutils'
 
-ruby = File.join(ENV["ruby"], "bin", RbConfig::CONFIG['ruby_install_name'])
+ruby = File.join(ENV["RUBY"], "bin", RbConfig::CONFIG['ruby_install_name'])
 out = ENV["out"]
 bin_path = File.join(ENV["out"], "bin")
 gem_home = ENV["GEM_HOME"]
diff --git a/pkgs/development/ruby-modules/gem/nix-bundle-install.rb b/pkgs/development/ruby-modules/gem/nix-bundle-install.rb
index 0d501bd9add73..d25ba9736a39a 100644
--- a/pkgs/development/ruby-modules/gem/nix-bundle-install.rb
+++ b/pkgs/development/ruby-modules/gem/nix-bundle-install.rb
@@ -25,7 +25,7 @@
 #   repo        - path to local checkout
 #   ref         - the commit hash
 
-ruby = File.join(ENV["ruby"], "bin", RbConfig::CONFIG['ruby_install_name'])
+ruby = File.join(ENV["RUBY"], "bin", RbConfig::CONFIG['ruby_install_name'])
 out = ENV["out"]
 bin_dir = File.join(ENV["out"], "bin")
 
diff --git a/pkgs/development/tools/analysis/eresi/default.nix b/pkgs/development/tools/analysis/eresi/default.nix
index b8abad44f241c..682e376c1cd77 100644
--- a/pkgs/development/tools/analysis/eresi/default.nix
+++ b/pkgs/development/tools/analysis/eresi/default.nix
@@ -47,12 +47,11 @@ stdenv.mkDerivation rec {
   # The configure script is not generated by autoconf but is hand-rolled, so it
   # has --enable-static but no --disabled-static and also doesn't support the
   # equals sign in --prefix.
-  prefixKey = "--prefix ";
+  prefixAsSeperateFlag = true;
   dontDisableStatic = true;
 
   nativeBuildInputs = [ which ];
   buildInputs = [ openssl readline ];
-  enableParallelBuilding = true;
 
   installTargets = lib.singleton "install"
                 ++ lib.optional stdenv.is64bit "install64";
diff --git a/pkgs/development/tools/analysis/rr/default.nix b/pkgs/development/tools/analysis/rr/default.nix
index c0121d2421775..8457ae651ee69 100644
--- a/pkgs/development/tools/analysis/rr/default.nix
+++ b/pkgs/development/tools/analysis/rr/default.nix
@@ -33,7 +33,7 @@ gcc9Stdenv.mkDerivation rec {
   ];
 
   # we turn on additional warnings due to hardening
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   hardeningDisable = [ "fortify" ];
 
diff --git a/pkgs/development/tools/build-managers/apache-maven/builder.sh b/pkgs/development/tools/build-managers/apache-maven/builder.sh
index dcc38b9ec74a1..553d0ff4a4166 100644
--- a/pkgs/development/tools/build-managers/apache-maven/builder.sh
+++ b/pkgs/development/tools/build-managers/apache-maven/builder.sh
@@ -1,3 +1,5 @@
+source .attrs.sh
+
 source $stdenv/setup
 
 unpackPhase
diff --git a/pkgs/development/tools/build-managers/boot/builder.sh b/pkgs/development/tools/build-managers/boot/builder.sh
index c1481dc6a1445..744a335bd178f 100644
--- a/pkgs/development/tools/build-managers/boot/builder.sh
+++ b/pkgs/development/tools/build-managers/boot/builder.sh
@@ -1,3 +1,5 @@
+source .attrs.sh
+
 source $stdenv/setup
 
 boot_bin=$out/bin/boot
diff --git a/pkgs/development/tools/build-managers/cmake/setup-hook.sh b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
index 89e8e0e197a0b..6662959485fe1 100755
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
@@ -31,7 +31,7 @@ cmakeConfigurePhase() {
     fi
 
     if [ -z "${dontAddPrefix-}" ]; then
-        cmakeFlags="-DCMAKE_INSTALL_PREFIX=$prefix $cmakeFlags"
+        cmakeFlags=("-DCMAKE_INSTALL_PREFIX=$prefix" ${cmakeFlags[@]+"${cmakeFlags[@]}"})
     fi
 
     # We should set the proper `CMAKE_SYSTEM_NAME`.
@@ -40,30 +40,63 @@ cmakeConfigurePhase() {
     # Unfortunately cmake seems to expect absolute paths for ar, ranlib, and
     # strip. Otherwise they are taken to be relative to the source root of the
     # package being built.
-    cmakeFlags="-DCMAKE_CXX_COMPILER=$CXX $cmakeFlags"
-    cmakeFlags="-DCMAKE_C_COMPILER=$CC $cmakeFlags"
-    cmakeFlags="-DCMAKE_AR=$(command -v $AR) $cmakeFlags"
-    cmakeFlags="-DCMAKE_RANLIB=$(command -v $RANLIB) $cmakeFlags"
-    cmakeFlags="-DCMAKE_STRIP=$(command -v $STRIP) $cmakeFlags"
-
-    # on macOS we want to prefer Unix-style headers to Frameworks
-    # because we usually do not package the framework
-    cmakeFlags="-DCMAKE_FIND_FRAMEWORK=LAST $cmakeFlags"
-
-    # we never want to use the global macOS SDK
-    cmakeFlags="-DCMAKE_OSX_SYSROOT= $cmakeFlags"
-
-    # correctly detect our clang compiler
-    cmakeFlags="-DCMAKE_POLICY_DEFAULT_CMP0025=NEW $cmakeFlags"
-
-    # This installs shared libraries with a fully-specified install
-    # name. By default, cmake installs shared libraries with just the
-    # basename as the install name, which means that, on Darwin, they
-    # can only be found by an executable at runtime if the shared
-    # libraries are in a system path or in the same directory as the
-    # executable. This flag makes the shared library accessible from its
-    # nix/store directory.
-    cmakeFlags="-DCMAKE_INSTALL_NAME_DIR=${!outputLib}/lib $cmakeFlags"
+    cmakeFlags=(
+        "-DCMAKE_CXX_COMPILER=$CXX"
+        "-DCMAKE_C_COMPILER=$CC"
+        "-DCMAKE_AR=$(command -v $AR)"
+        "-DCMAKE_RANLIB=$(command -v $RANLIB)"
+        "-DCMAKE_STRIP=$(command -v $STRIP)"
+
+        # on macOS we want to prefer Unix-style headers to Frameworks
+        # because we usually do not package the framework
+        "-DCMAKE_FIND_FRAMEWORK=LAST"
+
+        # on macOS i686 was only relevant for 10.5 or earlier.
+        "-DCMAKE_OSX_ARCHITECTURES=x86_64"
+
+        # we never want to use the global macOS SDK
+        "-DCMAKE_OSX_SYSROOT="
+
+        # correctly detect our clang compiler
+        "-DCMAKE_POLICY_DEFAULT_CMP0025=NEW"
+
+        # This installs shared libraries with a fully-specified install
+        # name. By default, cmake installs shared libraries with just the
+        # basename as the install name, which means that, on Darwin, they
+        # can only be found by an executable at runtime if the shared
+        # libraries are in a system path or in the same directory as the
+        # executable. This flag makes the shared library accessible from its
+        # nix/store directory.
+        "-DCMAKE_INSTALL_NAME_DIR=${!outputLib}/lib"
+
+        # This ensures correct paths with multiple output derivations
+        # It requires the project to use variables from GNUInstallDirs module
+        # https://cmake.org/cmake/help/latest/module/GNUInstallDirs.html
+        "-DCMAKE_INSTALL_BINDIR=${!outputBin}/bin"
+        "-DCMAKE_INSTALL_SBINDIR=${!outputBin}/sbin"
+        "-DCMAKE_INSTALL_INCLUDEDIR=${!outputInclude}/include"
+        "-DCMAKE_INSTALL_OLDINCLUDEDIR=${!outputInclude}/include"
+        "-DCMAKE_INSTALL_MANDIR=${!outputMan}/share/man"
+        "-DCMAKE_INSTALL_INFODIR=${!outputInfo}/share/info"
+        "-DCMAKE_INSTALL_DOCDIR=${!outputDoc}/share/doc/${shareDocName}"
+        "-DCMAKE_INSTALL_LIBDIR=${!outputLib}/lib"
+        "-DCMAKE_INSTALL_LIBEXECDIR=${!outputLib}/libexec"
+        "-DCMAKE_INSTALL_LOCALEDIR=${!outputLib}/share/locale"
+
+        # Avoid cmake resetting the rpath of binaries, on make install
+        # And build always Release, to ensure optimisation flags
+        "-DCMAKE_BUILD_TYPE=${cmakeBuildType:-Release}" "-DCMAKE_SKIP_BUILD_RPATH=ON"
+
+        # Disable user package registry to avoid potential side effects
+        # and unecessary attempts to access non-existent home folder
+        # https://cmake.org/cmake/help/latest/manual/cmake-packages.7.html#disabling-the-package-registry
+        "-DCMAKE_EXPORT_NO_PACKAGE_REGISTRY=ON"
+        "-DCMAKE_FIND_USE_PACKAGE_REGISTRY=OFF"
+        "-DCMAKE_FIND_USE_SYSTEM_PACKAGE_REGISTRY=OFF"
+
+        ${cmakeFlags[@]+"${cmakeFlags[@]}"}
+        ${cmakeFlagsArray[@]+"${cmakeFlagsArray[@]}"}
+    )
 
     # The docdir flag needs to include PROJECT_NAME as per GNU guidelines,
     # try to extract it from CMakeLists.txt.
@@ -83,43 +116,17 @@ cmakeConfigurePhase() {
         fi
     fi
 
-    # This ensures correct paths with multiple output derivations
-    # It requires the project to use variables from GNUInstallDirs module
-    # https://cmake.org/cmake/help/latest/module/GNUInstallDirs.html
-    cmakeFlags="-DCMAKE_INSTALL_BINDIR=${!outputBin}/bin $cmakeFlags"
-    cmakeFlags="-DCMAKE_INSTALL_SBINDIR=${!outputBin}/sbin $cmakeFlags"
-    cmakeFlags="-DCMAKE_INSTALL_INCLUDEDIR=${!outputInclude}/include $cmakeFlags"
-    cmakeFlags="-DCMAKE_INSTALL_OLDINCLUDEDIR=${!outputInclude}/include $cmakeFlags"
-    cmakeFlags="-DCMAKE_INSTALL_MANDIR=${!outputMan}/share/man $cmakeFlags"
-    cmakeFlags="-DCMAKE_INSTALL_INFODIR=${!outputInfo}/share/info $cmakeFlags"
-    cmakeFlags="-DCMAKE_INSTALL_DOCDIR=${!outputDoc}/share/doc/${shareDocName} $cmakeFlags"
-    cmakeFlags="-DCMAKE_INSTALL_LIBDIR=${!outputLib}/lib $cmakeFlags"
-    cmakeFlags="-DCMAKE_INSTALL_LIBEXECDIR=${!outputLib}/libexec $cmakeFlags"
-    cmakeFlags="-DCMAKE_INSTALL_LOCALEDIR=${!outputLib}/share/locale $cmakeFlags"
-
     # Don’t build tests when doCheck = false
     if [ -z "${doCheck-}" ]; then
-        cmakeFlags="-DBUILD_TESTING=OFF $cmakeFlags"
+        cmakeFlags=("-DBUILD_TESTING=OFF" "${cmakeFlags[@]}")
     fi
-
-    # Avoid cmake resetting the rpath of binaries, on make install
-    # And build always Release, to ensure optimisation flags
-    cmakeFlags="-DCMAKE_BUILD_TYPE=${cmakeBuildType:-Release} -DCMAKE_SKIP_BUILD_RPATH=ON $cmakeFlags"
-
-    # Disable user package registry to avoid potential side effects
-    # and unecessary attempts to access non-existent home folder
-    # https://cmake.org/cmake/help/latest/manual/cmake-packages.7.html#disabling-the-package-registry
-    cmakeFlags="-DCMAKE_EXPORT_NO_PACKAGE_REGISTRY=ON $cmakeFlags"
-    cmakeFlags="-DCMAKE_FIND_USE_PACKAGE_REGISTRY=OFF $cmakeFlags"
-    cmakeFlags="-DCMAKE_FIND_USE_SYSTEM_PACKAGE_REGISTRY=OFF $cmakeFlags"
-
     if [ "${buildPhase-}" = ninjaBuildPhase ]; then
-        cmakeFlags="-GNinja $cmakeFlags"
+        cmakeFlags=("-GNinja" "${cmakeFlags[@]}")
     fi
 
-    echo "cmake flags: $cmakeFlags ${cmakeFlagsArray[@]}"
+    echo "cmake flags: ${cmakeFlags[@]}"
 
-    cmake ${cmakeDir:-.} $cmakeFlags "${cmakeFlagsArray[@]}"
+    cmake ${cmakeDir:-.} "${cmakeFlags[@]}"
 
     if ! [[ -v enableParallelBuilding ]]; then
         enableParallelBuilding=1
diff --git a/pkgs/development/tools/build-managers/gup/default.nix b/pkgs/development/tools/build-managers/gup/default.nix
index dfa65736f99f2..ccb6b985995ed 100644
--- a/pkgs/development/tools/build-managers/gup/default.nix
+++ b/pkgs/development/tools/build-managers/gup/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ python3 which pychecker ];
   buildInputs = [ python3 ];
   strictDeps = true;
-  SKIP_PYCHECKER = pychecker == null;
+  env.SKIP_PYCHECKER = pychecker == null;
   buildPhase = "make python";
   installPhase = ''
     mkdir $out
diff --git a/pkgs/development/tools/build-managers/meson/setup-hook.sh b/pkgs/development/tools/build-managers/meson/setup-hook.sh
index 3d946fcffd522..bb05128247420 100644
--- a/pkgs/development/tools/build-managers/meson/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/meson/setup-hook.sh
@@ -2,25 +2,26 @@ mesonConfigurePhase() {
     runHook preConfigure
 
     if [ -z "${dontAddPrefix-}" ]; then
-        mesonFlags="--prefix=$prefix $mesonFlags"
+        mesonFlags=("--prefix=$prefix" ${mesonFlags[@]+"${mesonFlags[@]}"})
     fi
 
     # See multiple-outputs.sh and meson’s coredata.py
-    mesonFlags="\
-        --libdir=${!outputLib}/lib --libexecdir=${!outputLib}/libexec \
-        --bindir=${!outputBin}/bin --sbindir=${!outputBin}/sbin \
-        --includedir=${!outputInclude}/include \
-        --mandir=${!outputMan}/share/man --infodir=${!outputInfo}/share/info \
-        --localedir=${!outputLib}/share/locale \
-        -Dauto_features=${mesonAutoFeatures:-enabled} \
-        -Dwrap_mode=${mesonWrapMode:-nodownload} \
-        $mesonFlags"
-
-    mesonFlags="${crossMesonFlags+$crossMesonFlags }--buildtype=${mesonBuildType:-plain} $mesonFlags"
-
-    echo "meson flags: $mesonFlags ${mesonFlagsArray[@]}"
-
-    meson build $mesonFlags "${mesonFlagsArray[@]}"
+    mesonFlags=(
+      "--libdir=${!outputLib}/lib" "--libexecdir=${!outputLib}/libexec"
+      "--bindir=${!outputBin}/bin" "--sbindir=${!outputBin}/sbin"
+      "--includedir=${!outputInclude}/include"
+      "--mandir=${!outputMan}/share/man" "--infodir=${!outputInfo}/share/info"
+      "--localedir=${!outputLib}/share/locale"
+      "-Dauto_features=${mesonAutoFeatures:-enabled}"
+      "-Dwrap_mode=${mesonWrapMode:-nodownload}"
+      ${mesonFlags[@]+"${mesonFlags[@]}"}
+    )
+
+    mesonFlags=(${crossMesonFlags+"$crossMesonFlags"} "--buildtype=${mesonBuildType:-plain}" "${mesonFlags[@]}")
+
+    echo "meson flags: ${mesonFlags[@]}"
+
+    meson build "${mesonFlags[@]}"
     cd build
 
     if ! [[ -v enableParallelBuilding ]]; then
diff --git a/pkgs/development/tools/build-managers/ninja/setup-hook.sh b/pkgs/development/tools/build-managers/ninja/setup-hook.sh
index 7d8087ad13422..f4b8f9905333a 100644
--- a/pkgs/development/tools/build-managers/ninja/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/ninja/setup-hook.sh
@@ -10,7 +10,7 @@ ninjaBuildPhase() {
 
     local flagsArray=(
         -j$buildCores -l$NIX_BUILD_CORES
-        $ninjaFlags "${ninjaFlagsArray[@]}"
+        ${ninjaFlags[@]+"${ninjaFlags[@]}"}
     )
 
     echoCmd 'build flags' "${flagsArray[@]}"
@@ -28,8 +28,8 @@ ninjaInstallPhase() {
 
     # shellcheck disable=SC2086
     local flagsArray=(
-        $ninjaFlags "${ninjaFlagsArray[@]}"
-        ${installTargets:-install}
+        ${ninjaFlags[@]+"${ninjaFlags[@]}"}
+        "${installTargets[@]-install}"
     )
 
     echoCmd 'install flags' "${flagsArray[@]}"
@@ -62,7 +62,7 @@ ninjaCheckPhase() {
 
         local flagsArray=(
             -j$buildCores -l$NIX_BUILD_CORES
-            $ninjaFlags "${ninjaFlagsArray[@]}"
+            ${ninjaFlags[@]+"${ninjaFlags[@]}"}
             $checkTarget
         )
 
diff --git a/pkgs/development/tools/build-managers/redo-apenwarr/default.nix b/pkgs/development/tools/build-managers/redo-apenwarr/default.nix
index 638f10f018737..c2db3a7753e98 100644
--- a/pkgs/development/tools/build-managers/redo-apenwarr/default.nix
+++ b/pkgs/development/tools/build-managers/redo-apenwarr/default.nix
@@ -50,7 +50,6 @@
 
   nativeBuildInputs = [
     python3
-    (with python3.pkgs; [ beautifulsoup4 markdown ])
     which
     findutils
     installShellFiles
diff --git a/pkgs/development/tools/build-managers/scons/setup-hook.sh b/pkgs/development/tools/build-managers/scons/setup-hook.sh
index 0b908f68286b5..76e6deb328910 100644
--- a/pkgs/development/tools/build-managers/scons/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/scons/setup-hook.sh
@@ -11,8 +11,8 @@ sconsBuildPhase() {
 
     local flagsArray=(
       ${enableParallelBuilding:+-j${NIX_BUILD_CORES}}
-      $sconsFlags ${sconsFlagsArray[@]}
-      $buildFlags ${buildFlagsArray[@]}
+      ${sconsFlags[@]}
+      ${buildFlags[@]} ${buildFlagsArray[@]}
     )
 
     echoCmd 'build flags' "${flagsArray[@]}"
@@ -33,8 +33,8 @@ sconsInstallPhase() {
     fi
 
     local flagsArray=(
-        $sconsFlags ${sconsFlagsArray[@]}
-        $installFlags ${installFlagsArray[@]}
+        ${sconsFlags[@]}
+        ${installFlags[@]} ${installFlagsArray[@]}
         ${installTargets:-install}
     )
 
@@ -60,7 +60,7 @@ sconsCheckPhase() {
     else
         local flagsArray=(
             ${enableParallelChecking:+-j${NIX_BUILD_CORES}}
-            $sconsFlags ${sconsFlagsArray[@]}
+            ${sconsFlags[@]}
             ${checkFlagsArray[@]}
         )
 
diff --git a/pkgs/development/tools/build-managers/wafHook/setup-hook.sh b/pkgs/development/tools/build-managers/wafHook/setup-hook.sh
index 439350c3abc28..efbab2754ea28 100644
--- a/pkgs/development/tools/build-managers/wafHook/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/wafHook/setup-hook.sh
@@ -7,12 +7,12 @@ wafConfigurePhase() {
     fi
 
     if [ -z "${dontAddPrefix:-}" ] && [ -n "$prefix" ]; then
-        wafConfigureFlags="${prefixKey:---prefix=}$prefix $wafConfigureFlags"
+        wafConfigureFlags=("${prefixKey:---prefix=}$prefix" "${wafConfigureFlags[@]}")
     fi
 
     local flagsArray=(
         "${flagsArray[@]}"
-        $wafConfigureFlags "${wafConfigureFlagsArray[@]}"
+        "${wafConfigureFlags[@]}" "${wafConfigureFlagsArray[@]}"
         ${configureTargets:-configure}
     )
     if [ -z "${dontAddWafCrossFlags:-}" ]; then
@@ -32,12 +32,12 @@ wafBuildPhase () {
     runHook preBuild
 
     # set to empty if unset
-    : ${wafFlags=}
+    wafFlags=(${wafFlags+"${wafFlags[@]}"})
 
     local flagsArray=(
       ${enableParallelBuilding:+-j ${NIX_BUILD_CORES}}
-      $wafFlags ${wafFlagsArray[@]}
-      $buildFlags ${buildFlagsArray[@]}
+      "${wafFlags[@]}" "${wafFlagsArray[@]}"
+      "${buildFlags[@]}" "${buildFlagsArray[@]}"
       ${buildTargets:-build}
     )
 
@@ -59,8 +59,8 @@ wafInstallPhase() {
     fi
 
     local flagsArray=(
-        $wafFlags ${wafFlagsArray[@]}
-        $installFlags ${installFlagsArray[@]}
+        "${wafFlags[@]}" "${wafFlagsArray[@]}"
+        "${installFlags[@]}" "${installFlagsArray[@]}"
         ${installTargets:-install}
     )
 
diff --git a/pkgs/development/tools/conftest/default.nix b/pkgs/development/tools/conftest/default.nix
index 833f2f84b058c..87c335f65a1d9 100644
--- a/pkgs/development/tools/conftest/default.nix
+++ b/pkgs/development/tools/conftest/default.nix
@@ -15,11 +15,10 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [
-    "-ldflags="
-    "-s"
-    "-w"
-    "-X github.com/open-policy-agent/conftest/internal/commands.version=${version}"
+  buildFlags = [
+    ("-ldflags=-s"
+      + " -w"
+      + " -X github.com/open-policy-agent/conftest/internal/commands.version=${version}")
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/tools/devpi-client/default.nix b/pkgs/development/tools/devpi-client/default.nix
index 5bca873377146..d42118fc75b89 100644
--- a/pkgs/development/tools/devpi-client/default.nix
+++ b/pkgs/development/tools/devpi-client/default.nix
@@ -47,7 +47,7 @@ buildPythonApplication rec {
     HOME=$TMPDIR py.test --fast
   '';
 
-  LC_ALL = "en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
 
   meta = with lib; {
     homepage = "http://doc.devpi.net";
diff --git a/pkgs/development/tools/diesel-cli/default.nix b/pkgs/development/tools/diesel-cli/default.nix
index 8a976f44bf728..47c44dceab8f1 100644
--- a/pkgs/development/tools/diesel-cli/default.nix
+++ b/pkgs/development/tools/diesel-cli/default.nix
@@ -70,7 +70,7 @@ rustPlatform.buildRustPackage rec {
 
   # Fix the build with mariadb, which otherwise shows "error adding symbols:
   # DSO missing from command line" errors for libz and libssl.
-  NIX_LDFLAGS = optionalString mysqlSupport "-lz -lssl -lcrypto";
+  env.NIX_LDFLAGS = optionalString mysqlSupport "-lz -lssl -lcrypto";
 
   meta = with lib; {
     description = "Database tool for working with Rust projects that use Diesel";
diff --git a/pkgs/development/tools/documentation/doxygen/default.nix b/pkgs/development/tools/documentation/doxygen/default.nix
index a4a70dabd69dc..c81689df8930c 100644
--- a/pkgs/development/tools/documentation/doxygen/default.nix
+++ b/pkgs/development/tools/documentation/doxygen/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     [ "-DICONV_INCLUDE_DIR=${libiconv}/include" ] ++
     lib.optional (qt5 != null) "-Dbuild_wizard=YES";
 
-  NIX_CFLAGS_COMPILE =
+  env.NIX_CFLAGS_COMPILE =
     lib.optionalString stdenv.isDarwin "-mmacosx-version-min=10.9";
 
   enableParallelBuilding = false;
diff --git a/pkgs/development/tools/godot/default.nix b/pkgs/development/tools/godot/default.nix
index d5eb7a9b0e012..9b44acd41d046 100644
--- a/pkgs/development/tools/godot/default.nix
+++ b/pkgs/development/tools/godot/default.nix
@@ -33,10 +33,9 @@ in stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  sconsFlags = "target=release_debug platform=x11";
-  preConfigure = ''
-    sconsFlags+=" ${lib.concatStringsSep " " (lib.mapAttrsToList (k: v: "${k}=${builtins.toJSON v}") options)}"
-  '';
+  sconsFlags = [
+    "target=release_debug" "platform=x11"
+  ] ++ (lib.mapAttrsToList (k: v: "${k}=${builtins.toJSON v}") options);
 
   outputs = [ "out" "dev" "man" ];
 
diff --git a/pkgs/development/tools/gomplate/default.nix b/pkgs/development/tools/gomplate/default.nix
index 45602a0535223..d85744317db6a 100644
--- a/pkgs/development/tools/gomplate/default.nix
+++ b/pkgs/development/tools/gomplate/default.nix
@@ -19,11 +19,11 @@ buildGoModule rec {
     rm net/net_test.go
   '';
 
-  buildFlagsArray = [
-    "-ldflags="
-    "-s"
-    "-w"
-    "-X github.com/${owner}/${pname}/v3/version.Version=${rev}"
+  buildFlags = [
+    ("-ldflags="
+      + "-s"
+      + " -w"
+      + " -X github.com/${owner}/${pname}/v3/version.Version=${rev}")
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/tools/jq/default.nix b/pkgs/development/tools/jq/default.nix
index 39819db47def6..3d8e9a2b5416f 100644
--- a/pkgs/development/tools/jq/default.nix
+++ b/pkgs/development/tools/jq/default.nix
@@ -1,55 +1,37 @@
-{ lib, stdenv, fetchpatch, fetchFromGitHub, autoreconfHook
-, onigurumaSupport ? true, oniguruma }:
+{ lib, stdenv, nixosTests, fetchurl, oniguruma, minimal ? false }:
 
 stdenv.mkDerivation rec {
   pname = "jq";
   version = "1.6";
 
-  src = fetchFromGitHub {
-    owner = "stedolan";
-    repo = "jq";
-    rev = "${pname}-${version}";
-    hash = "sha256-CIE8vumQPGK+TFAncmpBijANpFALLTadOvkob0gVzro";
+  src = fetchurl {
+    url =
+      "https://github.com/stedolan/jq/releases/download/jq-${version}/jq-${version}.tar.gz";
+    sha256 = "0wmapfskhzfwranf6515nzmm84r7kwljgfs7dg6bjgxakbicis2x";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fix-tests-when-building-without-regex-supports.patch";
-      url = "https://github.com/stedolan/jq/pull/2292/commits/f6a69a6e52b68a92b816a28eb20719a3d0cb51ae.patch";
-      sha256 = "pTM5FZ6hFs5Rdx+W2dICSS2lcoLY1Q//Lan3Hu8Gr58=";
-    })
-  ];
+  outputs = if minimal then [ "out" ] else [ "bin" "doc" "man" "dev" "lib" "out" ];
 
-  outputs = [ "bin" "doc" "man" "dev" "lib" "out" ];
+  buildInputs = lib.optional (!minimal) oniguruma;
 
-  # Upstream script that writes the version that's eventually compiled
-  # and printed in `jq --help` relies on a .git directory which our src
-  # doesn't keep.
-  preConfigure = ''
-    echo "#!/bin/sh" > scripts/version
-    echo "echo ${version}" >> scripts/version
-    patchShebangs scripts/version
-  '';
-
-  # paranoid mode: make sure we never use vendored version of oniguruma
-  # Note: it must be run after automake, or automake will complain
-  preBuild = ''
-    rm -r ./modules/oniguruma
-  '';
-
-  buildInputs = lib.optionals onigurumaSupport [ oniguruma ];
-  nativeBuildInputs = [ autoreconfHook ];
-
-  configureFlags = [
-    "--bindir=\${bin}/bin"
-    "--sbindir=\${bin}/bin"
-    "--datadir=\${doc}/share"
-    "--mandir=\${man}/share/man"
-  ] ++ lib.optional (!onigurumaSupport) "--with-oniguruma=no"
+  configureFlags =
+    if minimal then [ "--with-oniguruma=no" "--enable-all-static" ]
+    else [
+      "--bindir=\${bin}/bin"
+      "--sbindir=\${bin}/bin"
+      "--datadir=\${doc}/share"
+      "--mandir=\${man}/share/man"
+    ]
     # jq is linked to libjq:
     ++ lib.optional (!stdenv.isDarwin) "LDFLAGS=-Wl,-rpath,\\\${libdir}";
 
-  doInstallCheck = true;
+  preFixup = lib.optionalString minimal (''
+    rm -r .libs $out/{include,share}
+  '' + lib.optionalString stdenv.isLinux ''
+    patchelf --shrink-rpath $out/bin/jq
+  '');
+
+  doInstallCheck = !minimal;
   installCheckTarget = "check";
 
   postInstallCheck = ''
@@ -57,8 +39,6 @@ stdenv.mkDerivation rec {
     $bin/bin/jq -r '.values[1]' <<< '{"values":["hello","world"]}' | grep '^world$' > /dev/null
   '';
 
-  passthru = { inherit onigurumaSupport; };
-
   meta = with lib; {
     description = "A lightweight and flexible command-line JSON processor";
     license = licenses.mit;
diff --git a/pkgs/development/tools/jsduck/default.nix b/pkgs/development/tools/jsduck/default.nix
index 15a3a68340348..987f69a7c66fb 100644
--- a/pkgs/development/tools/jsduck/default.nix
+++ b/pkgs/development/tools/jsduck/default.nix
@@ -1,15 +1,17 @@
 { stdenv, lib, bundlerEnv, makeWrapper, bundlerUpdateScript }:
 
-stdenv.mkDerivation rec {
+let
   pname = "jsduck";
-  version = (import ./gemset.nix).jsduck.version;
-
   env = bundlerEnv {
     name = pname;
     gemfile = ./Gemfile;
     lockfile = ./Gemfile.lock;
     gemset = ./gemset.nix;
   };
+in
+stdenv.mkDerivation rec {
+  inherit pname;
+  version = (import ./gemset.nix).jsduck.version;
 
   phases = [ "installPhase" ];
 
diff --git a/pkgs/development/tools/misc/automake/automake-1.11.x.nix b/pkgs/development/tools/misc/automake/automake-1.11.x.nix
index 5e3167d182dcb..0d108c62a4706 100644
--- a/pkgs/development/tools/misc/automake/automake-1.11.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.11.x.nix
@@ -3,11 +3,6 @@
 stdenv.mkDerivation rec {
   name = "automake-1.11.6";
 
-  # TODO: Remove the `aclocal' wrapper when $ACLOCAL_PATH support is
-  # available upstream; see
-  # <https://debbugs.gnu.org/cgi/bugreport.cgi?bug=9026>.
-  builder = ./builder.sh;
-
   setupHook = ./setup-hook.sh;
 
   src = fetchurl {
@@ -31,6 +26,50 @@ stdenv.mkDerivation rec {
   # Run the test suite in parallel.
   enableParallelBuilding = true;
 
+  # Wrap the given `aclocal' program, appending extra `-I' flags
+  # corresponding to the directories listed in $ACLOCAL_PATH.  (Note
+  # that `wrapProgram' can't be used for that purpose since it can only
+  # prepend flags, not append them.)
+  postInstall = ''
+    wrapAclocal() {
+      local program="$1"
+      local wrapped="$(dirname $program)/.$(basename $program)-wrapped"
+
+      mv "$program" "$wrapped"
+      cat > "$program"<<EOF
+#! $SHELL -e
+
+unset extraFlagsArray
+declare -a extraFlagsArray
+
+oldIFS=\$IFS
+IFS=:
+for dir in \$ACLOCAL_PATH; do
+    if test -n "\$dir" -a -d "\$dir"; then
+        extraFlagsArray=("\''${extraFlagsArray[@]}" "-I" "\$dir")
+    fi
+done
+IFS=\$oldIFS
+
+exec "$wrapped" "\$@" "\''${extraFlagsArray[@]}"
+EOF
+      chmod +x "$program"
+    }
+  '' +
+  # Create a wrapper around `aclocal' that converts every element in
+  # `ACLOCAL_PATH' into a `-I dir' option.  This way `aclocal'
+  # becomes modular; M4 macros do not need to be stored in a single
+  # global directory, while callers of `aclocal' do not need to pass
+  # `-I' options explicitly.
+  ''
+    for prog in $out/bin/aclocal*; do
+        wrapAclocal "$prog"
+    done
+
+    ln -s aclocal-1.11 $out/share/aclocal
+    ln -s automake-1.11 $out/share/automake
+  '';
+
   meta = {
     branch = "1.11";
     homepage = "https://www.gnu.org/software/automake/";
diff --git a/pkgs/development/tools/misc/automake/builder.sh b/pkgs/development/tools/misc/automake/builder.sh
deleted file mode 100644
index e54a2acca67e8..0000000000000
--- a/pkgs/development/tools/misc/automake/builder.sh
+++ /dev/null
@@ -1,47 +0,0 @@
-source $stdenv/setup
-
-# Wrap the given `aclocal' program, appending extra `-I' flags
-# corresponding to the directories listed in $ACLOCAL_PATH.  (Note
-# that `wrapProgram' can't be used for that purpose since it can only
-# prepend flags, not append them.)
-wrapAclocal() {
-    local program="$1"
-    local wrapped="$(dirname $program)/.$(basename $program)-wrapped"
-
-    mv "$program" "$wrapped"
-    cat > "$program"<<EOF
-#! $SHELL -e
-
-unset extraFlagsArray
-declare -a extraFlagsArray
-
-oldIFS=\$IFS
-IFS=:
-for dir in \$ACLOCAL_PATH; do
-    if test -n "\$dir" -a -d "\$dir"; then
-        extraFlagsArray=("\${extraFlagsArray[@]}" "-I" "\$dir")
-    fi
-done
-IFS=\$oldIFS
-
-exec "$wrapped" "\$@" "\${extraFlagsArray[@]}"
-EOF
-    chmod +x "$program"
-}
-
-postInstall() {
-    # Create a wrapper around `aclocal' that converts every element in
-    # `ACLOCAL_PATH' into a `-I dir' option.  This way `aclocal'
-    # becomes modular; M4 macros do not need to be stored in a single
-    # global directory, while callers of `aclocal' do not need to pass
-    # `-I' options explicitly.
-
-    for prog in $out/bin/aclocal*; do
-        wrapAclocal "$prog"
-    done
-
-    ln -s aclocal-1.11 $out/share/aclocal
-    ln -s automake-1.11 $out/share/automake
-}
-
-genericBuild
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 8042655a859d4..2c782e7d095a9 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -101,7 +101,7 @@ stdenv.mkDerivation {
 
   # As binutils takes part in the stdenv building, we don't want references
   # to the bootstrap-tools libgcc (as uses to happen on arm/mips)
-  NIX_CFLAGS_COMPILE = if stdenv.hostPlatform.isDarwin
+  env.NIX_CFLAGS_COMPILE = if stdenv.hostPlatform.isDarwin
     then "-Wno-string-plus-int -Wno-deprecated-declarations"
     else "-static-libgcc";
 
diff --git a/pkgs/development/tools/misc/bossa/default.nix b/pkgs/development/tools/misc/bossa/default.nix
index 74073722857f2..1e4e84e0d9e58 100644
--- a/pkgs/development/tools/misc/bossa/default.nix
+++ b/pkgs/development/tools/misc/bossa/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
 
   # Explicitly specify targets so they don't get stripped.
   makeFlags = [ "bin/bossac" "bin/bossash" "bin/bossa" ];
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/development/tools/misc/chruby/default.nix b/pkgs/development/tools/misc/chruby/default.nix
index bcc0687f55b60..12d9ca76e8301 100644
--- a/pkgs/development/tools/misc/chruby/default.nix
+++ b/pkgs/development/tools/misc/chruby/default.nix
@@ -19,9 +19,7 @@ in stdenv.mkDerivation rec {
     sha256 = "1894g6fymr8kra9vwhbmnrcr58l022mcd7g9ans4zd3izla2j3gx";
   };
 
-  phases = [ "unpackPhase" "patchPhase" "installPhase" "fixupPhase" ];
-
-  patches = lib.optionalString (rubies != null) [
+  patches = lib.optionals (rubies != null) [
     ./env.patch
   ];
 
diff --git a/pkgs/development/tools/misc/clojure-lsp/default.nix b/pkgs/development/tools/misc/clojure-lsp/default.nix
index dc342e501e4ce..ed4a5266779e2 100644
--- a/pkgs/development/tools/misc/clojure-lsp/default.nix
+++ b/pkgs/development/tools/misc/clojure-lsp/default.nix
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
     sha256 = "059gz7y2rzwdxpyqy80w4lghzgxi5lb4rxmks1721yq6k7ljjyqy";
   };
 
-  GRAALVM_HOME = graalvm11-ce;
-  CLOJURE_LSP_JAR = jar;
+  env.GRAALVM_HOME = toString graalvm11-ce;
+  env.CLOJURE_LSP_JAR = toString jar;
 
   buildInputs = [ graalvm11-ce ];
 
diff --git a/pkgs/development/tools/misc/cwebbin/default.nix b/pkgs/development/tools/misc/cwebbin/default.nix
index 055a24f3fe0a0..5b0b32a717a47 100644
--- a/pkgs/development/tools/misc/cwebbin/default.nix
+++ b/pkgs/development/tools/misc/cwebbin/default.nix
@@ -40,13 +40,13 @@ stdenv.mkDerivation rec {
 
   buildPhase = ''
     zcat ${cweb} | tar -xvpf -
-    make -f Makefile.unix boot $makeFlags
-    make -f Makefile.unix cautiously $makeFlags
+    make -f Makefile.unix boot "''${makeFlags[@]}"
+    make -f Makefile.unix cautiously "''${makeFlags[@]}"
   '';
 
   installPhase = ''
     mkdir -p $out/share/man/man1 $out/share/texmf/tex/generic $out/share/emacs $out/lib
-    make -f Makefile.unix install $makeFlags
+    make -f Makefile.unix install "''${makeFlags[@]}"
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/misc/dbench/default.nix b/pkgs/development/tools/misc/dbench/default.nix
index 9565eaa362622..629e97a024be9 100644
--- a/pkgs/development/tools/misc/dbench/default.nix
+++ b/pkgs/development/tools/misc/dbench/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ autoconf rpcsvc-proto ];
   buildInputs = [ popt zlib libtirpc ];
-  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
-  NIX_LDFLAGS = [ "-ltirpc" ];
+  env.NIX_CFLAGS_COMPILE = "-I${libtirpc.dev}/include/tirpc";
+  env.NIX_LDFLAGS = "-ltirpc";
 
   patches = [
     # patch has been also sent upstream and might be included in future versions
diff --git a/pkgs/development/tools/misc/ddd/default.nix b/pkgs/development/tools/misc/ddd/default.nix
index 74eb9fcb29367..912e5d0b500aa 100644
--- a/pkgs/development/tools/misc/ddd/default.nix
+++ b/pkgs/development/tools/misc/ddd/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./gcc44.patch ];
 
-  NIX_CFLAGS_COMPILE = "-fpermissive";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
 
   meta = {
     homepage = "https://www.gnu.org/software/ddd";
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index 66d4e8bc05726..d342ab7a6f51d 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
   # darwin build fails with format hardening since v7.12
   hardeningDisable = lib.optionals stdenv.isDarwin [ "format" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-format-nonliteral";
+  env.NIX_CFLAGS_COMPILE = "-Wno-format-nonliteral";
 
   configurePlatforms = [ "build" "host" "target" ];
 
diff --git a/pkgs/development/tools/misc/hydra/common.nix b/pkgs/development/tools/misc/hydra/common.nix
index 9ad8295c9b9db..6c63fdeec7871 100644
--- a/pkgs/development/tools/misc/hydra/common.nix
+++ b/pkgs/development/tools/misc/hydra/common.nix
@@ -99,7 +99,7 @@ in stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-docbook-xsl=${docbook_xsl}/xml/xsl/docbook" ];
 
-  NIX_CFLAGS_COMPILE = "-pthread";
+  env.NIX_CFLAGS_COMPILE = "-pthread";
 
   shellHook = ''
     PATH=$(pwd)/src/script:$(pwd)/src/hydra-eval-jobs:$(pwd)/src/hydra-queue-runner:$(pwd)/src/hydra-evaluator:$PATH
diff --git a/pkgs/development/tools/misc/igprof/default.nix b/pkgs/development/tools/misc/igprof/default.nix
index 47f41f130bef0..22f766b6aca28 100644
--- a/pkgs/development/tools/misc/igprof/default.nix
+++ b/pkgs/development/tools/misc/igprof/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [libunwind gdb pcre];
   nativeBuildInputs = [cmake];
-  CXXFLAGS = ["-fPIC" "-O2" "-w" "-fpermissive"];
+  env.CXXFLAGS = "-fPIC -O2 -w -fpermissive";
 
   meta = {
     description = "The Ignominous Profiler";
diff --git a/pkgs/development/tools/misc/indent/default.nix b/pkgs/development/tools/misc/indent/default.nix
index 8c5ec6af1c7fa..340a84d643080 100644
--- a/pkgs/development/tools/misc/indent/default.nix
+++ b/pkgs/development/tools/misc/indent/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ texinfo ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
     "-Wno-implicit-function-declaration";
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/development/tools/misc/intel-gpu-tools/default.nix b/pkgs/development/tools/misc/intel-gpu-tools/default.nix
index 62d350593b16c..05e5c9fcbc7a2 100644
--- a/pkgs/development/tools/misc/intel-gpu-tools/default.nix
+++ b/pkgs/development/tools/misc/intel-gpu-tools/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     libXext libXv libXrandr glib bison libunwind python3 procps
     gtk-doc openssl peg elfutils ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=array-bounds" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=array-bounds";
 
   preConfigure = ''
     ./autogen.sh
diff --git a/pkgs/development/tools/misc/kconfig-frontends/default.nix b/pkgs/development/tools/misc/kconfig-frontends/default.nix
index ae757f0d80d66..8651933e2fb4b 100644
--- a/pkgs/development/tools/misc/kconfig-frontends/default.nix
+++ b/pkgs/development/tools/misc/kconfig-frontends/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     "--enable-frontends=conf,mconf,nconf"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=format-security";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=format-security";
 
   meta = with lib; {
     description = "Out of Linux tree packaging of the kconfig infrastructure";
diff --git a/pkgs/development/tools/misc/luarocks/default.nix b/pkgs/development/tools/misc/luarocks/default.nix
index d4f2ec4ded983..24856eddc74f5 100644
--- a/pkgs/development/tools/misc/luarocks/default.nix
+++ b/pkgs/development/tools/misc/luarocks/default.nix
@@ -28,12 +28,12 @@ stdenv.mkDerivation rec {
     lua -e "" || {
         luajit -e "" && {
             export LUA_SUFFIX=jit
-            configureFlags="$configureFlags --lua-suffix=$LUA_SUFFIX"
+            configureFlags+=("--lua-suffix=$LUA_SUFFIX")
         }
     }
     lua_inc="$(echo "${lua}/include"/*/)"
     if test -n "$lua_inc"; then
-        configureFlags="$configureFlags --with-lua-include=$lua_inc"
+        configureFlags+=("--with-lua-include=$lua_inc")
     fi
   '';
 
diff --git a/pkgs/development/tools/misc/openocd/default.nix b/pkgs/development/tools/misc/openocd/default.nix
index 7b3a16fb75e4c..049fce8a7af1d 100644
--- a/pkgs/development/tools/misc/openocd/default.nix
+++ b/pkgs/development/tools/misc/openocd/default.nix
@@ -32,10 +32,10 @@ stdenv.mkDerivation rec {
     "--enable-remote-bitbang"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isGNU [
     "-Wno-error=cpp"
     "-Wno-error=strict-prototypes" # fixes build failure with hidapi 0.10.0
-  ];
+  ]);
 
   postInstall = lib.optionalString stdenv.isLinux ''
     mkdir -p "$out/etc/udev/rules.d"
diff --git a/pkgs/development/tools/misc/tcptrack/default.nix b/pkgs/development/tools/misc/tcptrack/default.nix
index 5b1fd72a7f517..8b48a56e5da93 100644
--- a/pkgs/development/tools/misc/tcptrack/default.nix
+++ b/pkgs/development/tools/misc/tcptrack/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ncurses libpcap ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=cpp";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=cpp";
 
   meta = with lib; {
     inherit (src.meta) homepage;
diff --git a/pkgs/development/tools/misc/uisp/default.nix b/pkgs/development/tools/misc/uisp/default.nix
index 1fb255073ed80..cd9e621eb778a 100644
--- a/pkgs/development/tools/misc/uisp/default.nix
+++ b/pkgs/development/tools/misc/uisp/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "1bncxp5yxh9r1yrp04vvhfiva8livi1pwic7v8xj99q09zrwahvw";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   meta = {
     description = "Tool for AVR microcontrollers which can interface to many hardware in-system programmers";
diff --git a/pkgs/development/tools/misc/xxdiff/default.nix b/pkgs/development/tools/misc/xxdiff/default.nix
index c187ad42c0e98..4f2b42bb09708 100644
--- a/pkgs/development/tools/misc/xxdiff/default.nix
+++ b/pkgs/development/tools/misc/xxdiff/default.nix
@@ -20,7 +20,7 @@ mkDerivation rec {
   dontUseQmakeConfigure = true;
 
   # c++11 and above is needed for building with Qt 5.9+
-  NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
+  env.NIX_CFLAGS_COMPILE = "-std=c++14";
 
   sourceRoot = "source/src";
 
diff --git a/pkgs/development/tools/node-webkit/nw12.nix b/pkgs/development/tools/node-webkit/nw12.nix
index 475c08eb169fa..712c8061eca16 100644
--- a/pkgs/development/tools/node-webkit/nw12.nix
+++ b/pkgs/development/tools/node-webkit/nw12.nix
@@ -30,8 +30,6 @@ in stdenv.mkDerivation rec {
       "117gx6yjbcya64yg2vybcfyp591sid209pg8a33k9afbsmgz684c";
   };
 
-  phases = [ "unpackPhase" "installPhase" ];
-
   installPhase = ''
     mkdir -p $out/share/nwjs
     cp -R * $out/share/nwjs
diff --git a/pkgs/development/tools/nrpl/default.nix b/pkgs/development/tools/nrpl/default.nix
index 67a86ca8dec59..85e172a861940 100644
--- a/pkgs/development/tools/nrpl/default.nix
+++ b/pkgs/development/tools/nrpl/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
     })
   ];
 
-  NIX_LDFLAGS = "-lpcre";
+  env.NIX_LDFLAGS = "-lpcre";
 
   buildPhase = ''
     HOME=$TMPDIR
diff --git a/pkgs/development/tools/nsis/default.nix b/pkgs/development/tools/nsis/default.nix
index 4820d8bb4b7db..02eca9230a82c 100644
--- a/pkgs/development/tools/nsis/default.nix
+++ b/pkgs/development/tools/nsis/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional stdenv.isDarwin "APPEND_LINKFLAGS=-liconv";
 
   preBuild = ''
-    sconsFlagsArray+=(
+    sconsFlags+=(
       "PATH=$PATH"
       "CC=$CC"
       "CXX=$CXX"
diff --git a/pkgs/development/tools/nwjs/default.nix b/pkgs/development/tools/nwjs/default.nix
index 9cfb3c448e84e..3b2ad44711dd8 100644
--- a/pkgs/development/tools/nwjs/default.nix
+++ b/pkgs/development/tools/nwjs/default.nix
@@ -47,8 +47,6 @@ in stdenv.mkDerivation rec {
       "0nlpdz76k1p1pq4xygfr2an91m0d7p5fjyg2xhiggyy8b7sp4964";
   };
 
-  phases = [ "unpackPhase" "installPhase" ];
-
   # we have runtime deps like sqlite3 that should remain
   dontPatchELF = true;
 
diff --git a/pkgs/development/tools/ocaml/camlp5/default.nix b/pkgs/development/tools/ocaml/camlp5/default.nix
index fc79cafdc42a1..afdff94c59b2c 100644
--- a/pkgs/development/tools/ocaml/camlp5/default.nix
+++ b/pkgs/development/tools/ocaml/camlp5/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ ocaml perl ];
 
-  prefixKey = "-prefix ";
+  prefixAsSeperateFlag = true;
 
   preConfigure = ''
     configureFlagsArray=(--strict --libdir $out/lib/ocaml/${ocaml.version}/site-lib)
diff --git a/pkgs/development/tools/ocaml/dune/2.nix b/pkgs/development/tools/ocaml/dune/2.nix
index 2acc7e5bdf324..e1bc6aa6ad0a6 100644
--- a/pkgs/development/tools/ocaml/dune/2.nix
+++ b/pkgs/development/tools/ocaml/dune/2.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ocaml findlib ];
 
-  buildFlags = "release";
+  buildFlags = [ "release" ];
 
   dontAddPrefix = true;
 
diff --git a/pkgs/development/tools/parsing/lemon/default.nix b/pkgs/development/tools/parsing/lemon/default.nix
index 3db9e0f6d9ed7..9c8786950d221 100644
--- a/pkgs/development/tools/parsing/lemon/default.nix
+++ b/pkgs/development/tools/parsing/lemon/default.nix
@@ -19,7 +19,7 @@ in stdenv.mkDerivation {
   pname = "lemon";
   version = "1.69";
 
-  phases = [ "buildPhase" "installPhase" ];
+  dontUnpack = true;
 
   buildPhase = ''
     sh -xc "$CC ${srcs.lemon} -o lemon"
diff --git a/pkgs/development/tools/parsing/ragel/default.nix b/pkgs/development/tools/parsing/ragel/default.nix
index 6bbcf36cd2c22..cd638d8e84a77 100644
--- a/pkgs/development/tools/parsing/ragel/default.nix
+++ b/pkgs/development/tools/parsing/ragel/default.nix
@@ -21,7 +21,7 @@ let
 
       configureFlags = [ "--with-colm=${colm}" ];
 
-      NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-std=gnu++98";
+      env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-std=gnu++98";
 
       doCheck = true;
 
diff --git a/pkgs/development/tools/phantomjs2/default.nix b/pkgs/development/tools/phantomjs2/default.nix
index 3d0db49aedcd5..2c76908854f78 100644
--- a/pkgs/development/tools/phantomjs2/default.nix
+++ b/pkgs/development/tools/phantomjs2/default.nix
@@ -71,7 +71,7 @@ in stdenv.mkDerivation rec {
 
   # Avoids error in webpage.cpp:80:89:
   # invalid suffix on literal; C++11 requires a space between litend identifier
-  NIX_CFLAGS_COMPILE = "-Wno-reserved-user-defined-literal";
+  env.NIX_CFLAGS_COMPILE = "-Wno-reserved-user-defined-literal";
 
   __impureHostDeps = lib.optional stdenv.isDarwin "/usr/lib/libicucore.dylib";
 
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix b/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
index bb7b4e39b037a..92efde2ffc228 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
@@ -116,8 +116,8 @@ pythonPackages.callPackage
       buildInputs = (
         baseBuildInputs
         ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) pythonPackages.setuptools
-        ++ lib.optional (!isSource) (getManyLinuxDeps fileInfo.name).pkg
-        ++ lib.optional isLocal buildSystemPkgs
+        ++ lib.optionals (!isSource) (getManyLinuxDeps fileInfo.name).pkg
+        ++ lib.optionals isLocal buildSystemPkgs
         ++ lib.optional (!__isBootstrap) pythonPackages.poetry
       );
 
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix b/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
index f217aefc2d26a..caf027dd2a956 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
@@ -137,11 +137,11 @@ self: super:
   cryptography = super.cryptography.overridePythonAttrs (
     old: {
       nativeBuildInputs = (old.nativeBuildInputs or [ ])
-        ++ lib.optional (lib.versionAtLeast old.version "3.4") [ self.setuptools-rust ]
+        ++ lib.optionals (lib.versionAtLeast old.version "3.4") [ self.setuptools-rust ]
         ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) self.python.pythonForBuild.pkgs.cffi;
       buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.openssl ];
     } // lib.optionalAttrs (lib.versionAtLeast old.version "3.4" && lib.versionOlder old.version "3.5") {
-      CRYPTOGRAPHY_DONT_BUILD_RUST = "1";
+      env = (old.env or {}) // { CRYPTOGRAPHY_DONT_BUILD_RUST = "1"; };
     }
   );
 
diff --git a/pkgs/development/tools/pxview/default.nix b/pkgs/development/tools/pxview/default.nix
index 20049215a70d8..a718603e77f96 100644
--- a/pkgs/development/tools/pxview/default.nix
+++ b/pkgs/development/tools/pxview/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--with-pxlib=${pxlib.out}" ];
 
   # https://sourceforge.net/p/pxlib/bugs/12/
-  LDFLAGS = "-lm";
+  env.LDFLAGS = "-lm";
   hardeningDisable = [ "format" ];
 
   meta = with lib; {
diff --git a/pkgs/development/tools/py-spy/default.nix b/pkgs/development/tools/py-spy/default.nix
index 89480f53a375e..394e0df598eca 100644
--- a/pkgs/development/tools/py-spy/default.nix
+++ b/pkgs/development/tools/py-spy/default.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-O6DbY/0ZI+BeG22jd9snbE718Y2vv7fqmeDdGWTnqfY=";
   };
 
-  NIX_CFLAGS_COMPILE = "-L${libunwind}/lib";
+  env.NIX_CFLAGS_COMPILE = "-L${libunwind}/lib";
 
   # error: linker `arm-linux-gnueabihf-gcc` not found
   preConfigure = lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
diff --git a/pkgs/development/tools/ronn/default.nix b/pkgs/development/tools/ronn/default.nix
index 8b5166272202e..0c0976716457d 100644
--- a/pkgs/development/tools/ronn/default.nix
+++ b/pkgs/development/tools/ronn/default.nix
@@ -1,13 +1,14 @@
 { stdenv, lib, bundlerEnv, bundlerUpdateScript, makeWrapper, groff }:
 
-stdenv.mkDerivation rec {
-  pname = "ronn";
-  version = env.gems.ronn.version;
-
+let
   env = bundlerEnv {
     name = "ronn-gems";
     gemdir = ./.;
   };
+in
+stdenv.mkDerivation rec {
+  pname = "ronn";
+  version = env.gems.ronn.version;
 
   phases = ["installPhase"];
 
diff --git a/pkgs/development/tools/rust/cbindgen/default.nix b/pkgs/development/tools/rust/cbindgen/default.nix
index 2e3391de94e2d..993cb12d53c42 100644
--- a/pkgs/development/tools/rust/cbindgen/default.nix
+++ b/pkgs/development/tools/rust/cbindgen/default.nix
@@ -22,11 +22,11 @@ rustPlatform.buildRustPackage rec {
   checkFlags = [
     # Disable tests that require rust unstable features
     # https://github.com/eqrion/cbindgen/issues/338
-    "--skip test_expand"
-    "--skip test_bitfield"
-    "--skip lib_default_uses_debug_build"
-    "--skip lib_explicit_debug_build"
-    "--skip lib_explicit_release_build"
+    "--skip" "test_expand"
+    "--skip" "test_bitfield"
+    "--skip" "lib_default_uses_debug_build"
+    "--skip" "lib_explicit_debug_build"
+    "--skip" "lib_explicit_release_build"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/tools/shadered/default.nix b/pkgs/development/tools/shadered/default.nix
index 01c16b1394685..0e0ea5d28269a 100644
--- a/pkgs/development/tools/shadered/default.nix
+++ b/pkgs/development/tools/shadered/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     sfml
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
 
   meta = with lib; {
     description = "Lightweight, cross-platform & full-featured shader IDE";
diff --git a/pkgs/development/tools/shellcheck/default.nix b/pkgs/development/tools/shellcheck/default.nix
index 568b9e1e1dddc..284ce6d817a91 100644
--- a/pkgs/development/tools/shellcheck/default.nix
+++ b/pkgs/development/tools/shellcheck/default.nix
@@ -27,8 +27,6 @@ let
 
     outputs = [ "bin" "man" "doc" "out" ];
 
-    phases = [ "unpackPhase" "buildPhase" "installPhase" "fixupPhase" ];
-
     buildPhase = ''
       pandoc -s -f markdown-smart -t man shellcheck.1.md -o shellcheck.1
     '';
diff --git a/pkgs/development/tools/simavr/default.nix b/pkgs/development/tools/simavr/default.nix
index 1d47b32510103..789dfe09626ab 100644
--- a/pkgs/development/tools/simavr/default.nix
+++ b/pkgs/development/tools/simavr/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     "AVR=avr-"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=stringop-truncation" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=stringop-truncation";
 
   nativeBuildInputs = [ which pkg-config avrgcc ];
   buildInputs = [ libelf freeglut libGLU libGL ]
diff --git a/pkgs/development/tools/tora/default.nix b/pkgs/development/tools/tora/default.nix
index 213c926521fea..a87bb00980072 100644
--- a/pkgs/development/tools/tora/default.nix
+++ b/pkgs/development/tools/tora/default.nix
@@ -40,9 +40,9 @@ mkDerivation {
   ];
 
   # these libraries are only searched for at runtime so we need to force-link them
-  NIX_LDFLAGS = "-lgvc -lmysqlclient -lecpg -lssl";
+  env.NIX_LDFLAGS = "-lgvc -lmysqlclient -lecpg -lssl";
 
-  NIX_CFLAGS_COMPILE = "-L${libmysqlclient}/lib/mysql -I${libmysqlclient}/include/mysql";
+  env.NIX_CFLAGS_COMPILE = "-L${libmysqlclient}/lib/mysql -I${libmysqlclient}/include/mysql";
 
   qtWrapperArgs = [
     ''--prefix PATH : ${lib.getBin graphviz}/bin''
diff --git a/pkgs/development/tools/tracy/default.nix b/pkgs/development/tools/tracy/default.nix
index 724e74098dec2..61217b67115ec 100644
--- a/pkgs/development/tools/tracy/default.nix
+++ b/pkgs/development/tools/tracy/default.nix
@@ -19,12 +19,8 @@ in stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isDarwin [ Carbon AppKit freetype ]
     ++ lib.optionals stdenv.isLinux [ gtk3 tbb ];
 
-  NIX_CFLAGS_COMPILE = [ ]
-    ++ lib.optional stdenv.isLinux "-ltbb"
-    ++ lib.optional stdenv.cc.isClang "-faligned-allocation"
-    ++ lib.optional disableLTO "-fno-lto";
-
-  NIX_CFLAGS_LINK = lib.optional disableLTO "-fno-lto";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isLinux "-ltbb"
+    + lib.optionalString stdenv.cc.isClang " -faligned-allocation";
 
   buildPhase = ''
     make -j $NIX_BUILD_CORES -C profiler/build/unix release
diff --git a/pkgs/development/tools/xcbuild/default.nix b/pkgs/development/tools/xcbuild/default.nix
index af0f546eb82a0..78b45cab2771a 100644
--- a/pkgs/development/tools/xcbuild/default.nix
+++ b/pkgs/development/tools/xcbuild/default.nix
@@ -54,7 +54,7 @@ in stdenv.mkDerivation {
     cp liblinenoise.* $out/lib/
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   cmakeFlags = [ "-GNinja" ];
 
diff --git a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix b/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
index ad7e2738bf593..3d4372f749a8a 100644
--- a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
+++ b/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
@@ -105,7 +105,7 @@ in rec {
 
     in stdenv.mkDerivation {
       inherit preBuild postBuild name;
-      phases = ["configurePhase" "buildPhase"];
+      dontUnpack = true;
       buildInputs = [ yarn nodejs git ] ++ extraBuildInputs;
 
       configurePhase = ''
@@ -113,8 +113,8 @@ in rec {
         export HOME=$PWD/yarn_home
       '';
 
-      buildPhase = ''
-        runHook preBuild
+      installPhase = ''
+        runHook preInstall
 
         mkdir -p "deps/${pname}"
         cp ${packageJSON} "deps/${pname}/package.json"
@@ -138,7 +138,7 @@ in rec {
         mv deps $out/
         patchShebangs $out
 
-        runHook postBuild
+        runHook postInstall
       '';
     };
 
diff --git a/pkgs/development/web/kore/default.nix b/pkgs/development/web/kore/default.nix
index bc8113fc6a1d1..9287c7e6f7d54 100644
--- a/pkgs/development/web/kore/default.nix
+++ b/pkgs/development/web/kore/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   '';
 
   # added to fix build w/gcc7 and clang5
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=pointer-compare"
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=pointer-compare"
     + lib.optionalString stdenv.cc.isClang " -Wno-error=unknown-warning-option";
 
   enableParallelBuilding = true;
diff --git a/pkgs/games/0ad/game.nix b/pkgs/games/0ad/game.nix
index feaf4347329c4..25000e02cb450 100644
--- a/pkgs/games/0ad/game.nix
+++ b/pkgs/games/0ad/game.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     nvidia-texture-tools libsodium fmt
   ] ++ lib.optional withEditor wxGTK;
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-I${xorgproto}/include/X11"
     "-I${libX11.dev}/include/X11"
     "-I${libXcursor.dev}/include/X11"
diff --git a/pkgs/games/airstrike/default.nix b/pkgs/games/airstrike/default.nix
index 12b485764a5b1..41fd44200d70f 100644
--- a/pkgs/games/airstrike/default.nix
+++ b/pkgs/games/airstrike/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ SDL SDL_image ];
 
-  NIX_LDFLAGS = "-lm";
+  env.NIX_LDFLAGS = "-lm";
 
   installPhase = ''
     ls -l
diff --git a/pkgs/games/anki/default.nix b/pkgs/games/anki/default.nix
index 6edddfeed5c70..898028f3973e2 100644
--- a/pkgs/games/anki/default.nix
+++ b/pkgs/games/anki/default.nix
@@ -48,7 +48,7 @@ let
       rev = rev-manual;
       sha256 = sha256-manual;
     };
-    phases = [ "unpackPhase" "patchPhase" "buildPhase" ];
+    dontInstall = true;
     nativeBuildInputs = [ asciidoc ];
     patchPhase = ''
       # rsync isnt needed
@@ -132,7 +132,7 @@ buildPythonApplication rec {
   '';
 
   # UTF-8 locale needed for testing
-  LC_ALL = "en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
 
   # tests fail with to many open files
   doCheck = !stdenv.isDarwin;
diff --git a/pkgs/games/asc/default.nix b/pkgs/games/asc/default.nix
index 778f5224d2d8c..ae547ed7c6c26 100644
--- a/pkgs/games/asc/default.nix
+++ b/pkgs/games/asc/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-paragui" "--disable-paraguitest" ];
 
-  NIX_CFLAGS_COMPILE = "-fpermissive -Wno-error=narrowing"; # I'm too lazy to catch all gcc47-related problems
+  env.NIX_CFLAGS_COMPILE = "-fpermissive -Wno-error=narrowing"; # I'm too lazy to catch all gcc47-related problems
   hardeningDisable = [ "format" ];
 
   buildInputs = [
diff --git a/pkgs/games/beret/default.nix b/pkgs/games/beret/default.nix
index e59fc7eb27408..d8ee1798a9538 100644
--- a/pkgs/games/beret/default.nix
+++ b/pkgs/games/beret/default.nix
@@ -5,9 +5,9 @@ stdenv.mkDerivation {
 
   buildInputs = [ SDL SDL_image SDL_ttf SDL_mixer ];
 
-  NIX_CFLAGS_COMPILE = "-I${SDL.dev}/include/SDL";
-  NIX_CFLAGS_LINK = lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
-  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin
+  env.NIX_CFLAGS_COMPILE = "-I${SDL.dev}/include/SDL";
+  env.NIX_CFLAGS_LINK = lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isDarwin
     "-framework CoreFoundation -framework OpenGL -framework Cocoa";
 
   patches = [ ./use-home-dir.patch ];
diff --git a/pkgs/games/bitsnbots/default.nix b/pkgs/games/bitsnbots/default.nix
index a3bd399a5ffd8..ef0286cf1285e 100644
--- a/pkgs/games/bitsnbots/default.nix
+++ b/pkgs/games/bitsnbots/default.nix
@@ -14,9 +14,9 @@ stdenv.mkDerivation rec {
 
   makefile = "Makefile.linux";
 
-  NIX_CFLAGS_COMPILE = "-I${SDL.dev}/include/SDL";
+  env.NIX_CFLAGS_COMPILE = "-I${SDL.dev}/include/SDL";
 
-  NIX_LDFLAGS = "-lGL";
+  env.NIX_LDFLAGS = "-lGL";
 
   installPhase = ''
     mkdir -p $out/share/${name}
diff --git a/pkgs/games/blackshades/default.nix b/pkgs/games/blackshades/default.nix
index 7fe4a6087f794..c9f21713f05e9 100644
--- a/pkgs/games/blackshades/default.nix
+++ b/pkgs/games/blackshades/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "0kbrh1dympk8scjxr6av24qs2bffz44l8qmw2m5gyqf4g3rxf6ra";
   };
 
-  NIX_LDFLAGS = "-lSDL_image";
+  env.NIX_LDFLAGS = "-lSDL_image";
 
   buildInputs = [ SDL SDL_image libGLU libGL openal libvorbis freealut ];
 
diff --git a/pkgs/games/blobwars/default.nix b/pkgs/games/blobwars/default.nix
index b99c9f2b8e360..a58d6fcbf8acb 100644
--- a/pkgs/games/blobwars/default.nix
+++ b/pkgs/games/blobwars/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config gettext ];
   buildInputs = [ SDL2 SDL2_image SDL2_mixer SDL2_net SDL2_ttf zlib ];
-  NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   makeFlags = [ "PREFIX=$(out)" "RELEASE=1" ];
 
diff --git a/pkgs/games/btanks/default.nix b/pkgs/games/btanks/default.nix
index 202bab0df667b..e1a58b6395d08 100644
--- a/pkgs/games/btanks/default.nix
+++ b/pkgs/games/btanks/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = "-I${SDL_image}/include/SDL";
+  env.NIX_CFLAGS_COMPILE = "-I${SDL_image}/include/SDL";
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/games/commandergenius/default.nix b/pkgs/games/commandergenius/default.nix
index 725cc5231c7ef..d648324b66338 100644
--- a/pkgs/games/commandergenius/default.nix
+++ b/pkgs/games/commandergenius/default.nix
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ SDL2 SDL2_image SDL2_mixer libGL boost libvorbis zlib curl python3 ];
 
   preConfigure = ''
-    export cmakeFlags="$cmakeFlags -DCMAKE_INSTALL_PREFIX=$out -DSHAREDIR=$out/share"
-    export makeFlags="$makeFlags DESTDIR=$(out)"
+    export cmakeFlags+=(-DCMAKE_INSTALL_PREFIX=$out -DSHAREDIR=$out/share)
+    export makeFlags+=(DESTDIR=$(out))
   '';
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/games/crawl/default.nix b/pkgs/games/crawl/default.nix
index 11ac23fcef3ac..3557f8e4260bd 100644
--- a/pkgs/games/crawl/default.nix
+++ b/pkgs/games/crawl/default.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     rm -rf contrib
   '';
 
-  fontsPath = lib.optionalString tileMode dejavu_fonts;
+  env.fontsPath = toString (lib.optionalString tileMode dejavu_fonts);
 
   makeFlags = [ "prefix=${placeholder "out"}" "FORCE_CC=${stdenv.cc.targetPrefix}cc" "FORCE_CXX=${stdenv.cc.targetPrefix}c++" "HOSTCXX=${buildPackages.stdenv.cc.targetPrefix}c++"
                 "FORCE_PKGCONFIG=y"
diff --git a/pkgs/games/devilutionx/default.nix b/pkgs/games/devilutionx/default.nix
index fa457b1f1bcce..3f03016d79ea0 100644
--- a/pkgs/games/devilutionx/default.nix
+++ b/pkgs/games/devilutionx/default.nix
@@ -15,10 +15,8 @@ stdenv.mkDerivation rec {
     substituteInPlace Source/init.cpp --replace "/usr/share/diasurgical/devilutionx/" "${placeholder "out"}/share/diasurgical/devilutionx/"
   '';
 
-  NIX_CFLAGS_COMPILE = [
-    "-I${SDL2_ttf}/include/SDL2"
-    ''-DTTF_FONT_PATH="${placeholder "out"}/share/fonts/truetype/CharisSILB.ttf"''
-  ];
+  env.NIX_CFLAGS_COMPILE = "-I${SDL2_ttf}/include/SDL2" +
+    '' -DTTF_FONT_PATH="${placeholder "out"}/share/fonts/truetype/CharisSILB.ttf"'';
 
   cmakeFlags = [
     "-DBINARY_RELEASE=ON"
diff --git a/pkgs/games/dwarf-fortress/soundsense.nix b/pkgs/games/dwarf-fortress/soundsense.nix
index a59c873069039..9a825d0f6c719 100644
--- a/pkgs/games/dwarf-fortress/soundsense.nix
+++ b/pkgs/games/dwarf-fortress/soundsense.nix
@@ -19,7 +19,6 @@ stdenv.mkDerivation rec {
     url = "http://df.zweistein.cz/soundsense/soundSense_${version}.zip";
     sha256 = "1gkrs69l3xsh858yjp204ddp29m668j630akm7arssc9359wxqkk";
   };
-  phases = [ "unpackPhase" "buildPhase" "installPhase" ];
   nativeBuildInputs = [ dos2unix ];
   buildPhase = ''
     dos2unix soundSense.sh
diff --git a/pkgs/games/dxx-rebirth/default.nix b/pkgs/games/dxx-rebirth/default.nix
index c2e3fac7e15db..3b1066a4d28f2 100644
--- a/pkgs/games/dxx-rebirth/default.nix
+++ b/pkgs/games/dxx-rebirth/default.nix
@@ -36,10 +36,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = [
-    "-Wno-format-nonliteral"
-    "-Wno-format-truncation"
-  ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-format-nonliteral -Wno-format-truncation";
 
   postInstall = ''
     install -Dm644 ${music} $out/share/games/dxx-rebirth/${music.name}
diff --git a/pkgs/games/eboard/default.nix b/pkgs/games/eboard/default.nix
index 67d7d38018e8a..e129bd60c6682 100644
--- a/pkgs/games/eboard/default.nix
+++ b/pkgs/games/eboard/default.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation {
     patchShebangs ./configure
   '';
 
-  NIX_CFLAGS_COMPILE = "-fpermissive";
-  NIX_LDFLAGS = "-ldl";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
+  env.NIX_LDFLAGS = "-ldl";
 
   meta = {
     homepage = "http://www.bergo.eng.br/eboard/";
diff --git a/pkgs/games/eduke32/default.nix b/pkgs/games/eduke32/default.nix
index a5796f697ef13..f06ff09cb14d7 100644
--- a/pkgs/games/eduke32/default.nix
+++ b/pkgs/games/eduke32/default.nix
@@ -42,7 +42,7 @@ in stdenv.mkDerivation {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2 -I${SDL2_mixer}/include/SDL2";
+  env.NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2 -I${SDL2_mixer}/include/SDL2";
 
   makeFlags = [
     "SDLCONFIG=${SDL2}/bin/sdl2-config"
diff --git a/pkgs/games/egoboo/default.nix b/pkgs/games/egoboo/default.nix
index 56ebcb1444ed8..592755d3d44e9 100644
--- a/pkgs/games/egoboo/default.nix
+++ b/pkgs/games/egoboo/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     '';
   */
 
-  NIX_LDFLAGS = "-lm";
+  env.NIX_LDFLAGS = "-lm";
 
   meta = {
     description = "3D dungeon crawling adventure";
diff --git a/pkgs/games/enigma/default.nix b/pkgs/games/enigma/default.nix
index 131bd00e1857c..bb343e99107bb 100644
--- a/pkgs/games/enigma/default.nix
+++ b/pkgs/games/enigma/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   # For some reason (might be related to the alpha status), some includes
   # which are required by lib-src/enigma-core are not picked up by the
   # configure script. Hence we add them manually.
-  CPPFLAGS = "-I${SDL2.dev}/include/SDL2 -I${SDL2_ttf}/include/SDL2 -I${SDL2_image}/include/SDL2 -I${SDL2_mixer}/include/SDL2";
+  env.CPPFLAGS = "-I${SDL2.dev}/include/SDL2 -I${SDL2_ttf}/include/SDL2 -I${SDL2_image}/include/SDL2 -I${SDL2_mixer}/include/SDL2";
 
   postInstall = ''
     rm -r $out/include
diff --git a/pkgs/games/exult/default.nix b/pkgs/games/exult/default.nix
index 40d7300e9c5a1..16ddfafab90de 100644
--- a/pkgs/games/exult/default.nix
+++ b/pkgs/games/exult/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_LDFLAGS = "-lX11";
+  env.NIX_LDFLAGS = "-lX11";
 
   postInstall =
     ''
diff --git a/pkgs/games/freeciv/default.nix b/pkgs/games/freeciv/default.nix
index 58e91a44842cd..aee7fb61f8925 100644
--- a/pkgs/games/freeciv/default.nix
+++ b/pkgs/games/freeciv/default.nix
@@ -29,7 +29,7 @@ in stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ autoreconfHook pkg-config ]
-    ++ optional qtClient [ qt5.wrapQtAppsHook ];
+    ++ optionals qtClient [ qt5.wrapQtAppsHook ];
 
   buildInputs = [ lua5_3 zlib bzip2 curl xz gettext libiconv ]
     ++ optionals sdlClient [ SDL SDL_mixer SDL_image SDL_ttf SDL_gfx freetype fluidsynth ]
diff --git a/pkgs/games/freesweep/default.nix b/pkgs/games/freesweep/default.nix
index 7c17877e93416..eb6c11af1d689 100644
--- a/pkgs/games/freesweep/default.nix
+++ b/pkgs/games/freesweep/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ ncurses ];
 
   preConfigure = ''
-    configureFlags="$configureFlags --with-prefsdir=$out/share"
+    configureFlags+=("--with-prefsdir=$out/share")
   '';
 
   installPhase = ''
diff --git a/pkgs/games/gimx/default.nix b/pkgs/games/gimx/default.nix
index 0ae5a7917096a..275af354fe673 100644
--- a/pkgs/games/gimx/default.nix
+++ b/pkgs/games/gimx/default.nix
@@ -31,7 +31,7 @@ in stdenv.mkDerivation rec {
   prePatch = (if gimxAuth == "afterglow" then (import ./variant.nix).afterglow
               else "");
 
-  makeFlags = "build-core";
+  makeFlags = [ "build-core" ];
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/games/globulation/default.nix b/pkgs/games/globulation/default.nix
index 9150541afd085..780e74e2480c8 100644
--- a/pkgs/games/globulation/default.nix
+++ b/pkgs/games/globulation/default.nix
@@ -19,7 +19,9 @@ stdenv.mkDerivation rec {
     sha256 = "1f0l2cqp2g3llhr9jl6jj15k0wb5q8n29vqj99xy4p5hqs78jk8g";
   };
 
-  patches = [ ./header-order.patch ./public-buildproject.patch
+  patches = [
+    ./header-order.patch
+    ./public-buildproject.patch
     (fetchpatch {
       url = "https://bitbucket.org/giszmo/glob2/commits/c9dc715624318e4fea4abb24e04f0ebdd9cd8d2a/raw";
       sha256 = "0017xg5agj3dy0hx71ijdcrxb72bjqv7x6aq7c9zxzyyw0mkxj0k";
@@ -35,13 +37,13 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ sconsPackages.scons_3_0_1 ];
   buildInputs = [ libGLU libGL SDL SDL_ttf SDL_image zlib SDL_net speex libvorbis libogg boost fribidi bsdiff ];
 
-  postConfigure = ''
-    sconsFlags+=" BINDIR=$out/bin"
-    sconsFlags+=" INSTALLDIR=$out/share/globulation2"
-    sconsFlags+=" DATADIR=$out/share/globulation2/glob2"
-  '';
+  sconsFlags = [
+    "BINDIR=${placeholder "out"}/bin"
+    "INSTALLDIR=${placeholder "out"}/share/globulation2"
+    "DATADIR=${placeholder "out"}/share/globulation2/glob2"
+  ];
 
-  NIX_LDFLAGS = "-lboost_system";
+  env.NIX_LDFLAGS = "-lboost_system";
 
   meta = with lib; {
     description = "RTS without micromanagement";
@@ -49,5 +51,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.gpl3;
   };
+
   passthru.updateInfo.downloadPage = "http://globulation2.org/wiki/Download_and_Install";
 }
diff --git a/pkgs/games/gnujump/default.nix b/pkgs/games/gnujump/default.nix
index 6f91b10345815..35ba621a530e9 100644
--- a/pkgs/games/gnujump/default.nix
+++ b/pkgs/games/gnujump/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ copyDesktopItems ];
   buildInputs = [ SDL SDL_image SDL_mixer ];
 
-  NIX_LDFLAGS = "-lm";
+  env.NIX_LDFLAGS = "-lm";
 
   desktopItems = [ (makeDesktopItem {
     name = "gnujump";
diff --git a/pkgs/games/gzdoom/default.nix b/pkgs/games/gzdoom/default.nix
index 8ab54468c0011..7a7b1848a9f4f 100644
--- a/pkgs/games/gzdoom/default.nix
+++ b/pkgs/games/gzdoom/default.nix
@@ -53,7 +53,7 @@ let
       zmusic
     ];
 
-    NIX_CFLAGS_LINK = "-lopenal -lfluidsynth";
+    env.NIX_CFLAGS_LINK = "-lopenal -lfluidsynth";
 
     installPhase = ''
       install -Dm755 gzdoom "$out/lib/gzdoom/gzdoom"
diff --git a/pkgs/games/hedgewars/default.nix b/pkgs/games/hedgewars/default.nix
index 9062af5be3837..39f2f07e21671 100644
--- a/pkgs/games/hedgewars/default.nix
+++ b/pkgs/games/hedgewars/default.nix
@@ -56,7 +56,7 @@ mkDerivation rec {
         "haskell_flags} -package network-2.6.3.1 -hide-package network-bsd"
   '';
 
-  NIX_LDFLAGS = lib.concatMapStringsSep " " (e: "-rpath ${e}/lib") [
+  env.NIX_LDFLAGS = lib.concatMapStringsSep " " (e: "-rpath ${e}/lib") [
     SDL2.out
     SDL2_image
     SDL2_mixer
diff --git a/pkgs/games/hyperrogue/default.nix b/pkgs/games/hyperrogue/default.nix
index 08427bd29205f..d8ee8cffb215b 100644
--- a/pkgs/games/hyperrogue/default.nix
+++ b/pkgs/games/hyperrogue/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "0bijgbqpc867pq8lbwwvcnc713gm51mmz625xb5br0q2qw09nkyh";
   };
 
-  CPPFLAGS = "-I${SDL.dev}/include/SDL";
+  env.CPPFLAGS = "-I${SDL.dev}/include/SDL";
 
   buildInputs = [ autoreconfHook SDL SDL_ttf SDL_gfx SDL_mixer libpng glew ];
 
diff --git a/pkgs/games/instead/default.nix b/pkgs/games/instead/default.nix
index 5c35219c19bf4..4ca7d033283e6 100644
--- a/pkgs/games/instead/default.nix
+++ b/pkgs/games/instead/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
     sha256 = "u5j2kDKRvMQPsG8iA6uOBScuyE/e1BJIK2+qVL6jqQs=";
   };
 
-  NIX_LDFLAGS = "-llua -lgcc_s";
+  env.NIX_LDFLAGS = "-llua -lgcc_s";
 
   nativeBuildInputs = [ pkg-config unzip ];
   buildInputs = [ SDL2 SDL2_ttf SDL2_image SDL2_mixer lua zlib ];
diff --git a/pkgs/games/iortcw/sp.nix b/pkgs/games/iortcw/sp.nix
index fa6f73a177b20..2f9f04571f388 100644
--- a/pkgs/games/iortcw/sp.nix
+++ b/pkgs/games/iortcw/sp.nix
@@ -30,11 +30,8 @@ stdenv.mkDerivation rec {
   ];
   nativeBuildInputs = [ makeWrapper ];
 
-  NIX_CFLAGS_COMPILE = [
-    "-I${SDL2.dev}/include/SDL2"
-    "-I${opusfile}/include/opus"
-  ];
-  NIX_CFLAGS_LINK = [ "-lSDL2" ];
+  env.NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2 -I${opusfile}/include/opus";
+  env.NIX_CFLAGS_LINK = "-lSDL2";
 
   postInstall = ''
     for i in `find $out/opt/iortcw -maxdepth 1 -type f -executable`; do
diff --git a/pkgs/games/ivan/default.nix b/pkgs/games/ivan/default.nix
index 3ec196b7373ea..24b3384483926 100644
--- a/pkgs/games/ivan/default.nix
+++ b/pkgs/games/ivan/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = ["-DCMAKE_CXX_FLAGS=-DWIZARD"];
 
   # Help CMake find SDL_mixer.h
-  NIX_CFLAGS_COMPILE = "-I${SDL2_mixer}/include/SDL2";
+  env.NIX_CFLAGS_COMPILE = "-I${SDL2_mixer}/include/SDL2";
 
   # Create "ivan.desktop" file
   ivanDesktop = makeDesktopItem {
diff --git a/pkgs/games/keeperrl/default.nix b/pkgs/games/keeperrl/default.nix
index bd49b821f9e1b..8f502920ce4c9 100644
--- a/pkgs/games/keeperrl/default.nix
+++ b/pkgs/games/keeperrl/default.nix
@@ -43,9 +43,7 @@ stdenv.mkDerivation rec {
     openal curl libogg libvorbis SDL2 SDL2_image zlib
   ];
 
-  NIX_CFLAGS_COMPILE = [
-    "-I${SDL2.dev}/include/SDL2"
-  ];
+  env.NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/games/liquidwar/5.nix b/pkgs/games/liquidwar/5.nix
index e95371ec5eafc..059fd76b71c50 100644
--- a/pkgs/games/liquidwar/5.nix
+++ b/pkgs/games/liquidwar/5.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  NIX_CFLAGS_COMPILE = [ "-lm" ];
+  env.NIX_CFLAGS_COMPILE = "-lm";
 
   meta = with lib; {
     description = "The classic version of a quick tactics game LiquidWar";
diff --git a/pkgs/games/liquidwar/default.nix b/pkgs/games/liquidwar/default.nix
index 09ddcb0346c8f..ecaba48afd741 100644
--- a/pkgs/games/liquidwar/default.nix
+++ b/pkgs/games/liquidwar/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  NIX_CFLAGS_COMPILE =
+  env.NIX_CFLAGS_COMPILE =
     "-Wno-error=deprecated-declarations" +
     # Avoid GL_GLEXT_VERSION double definition
     " -DNO_SDL_GLEXT"
diff --git a/pkgs/games/macopix/default.nix b/pkgs/games/macopix/default.nix
index bb91891a68266..902d2cc5dd647 100644
--- a/pkgs/games/macopix/default.nix
+++ b/pkgs/games/macopix/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_LDFLAGS = "-lX11";
+  env.NIX_LDFLAGS = "-lX11";
 
   meta = {
     description = "Mascot Constructive Pilot for X";
diff --git a/pkgs/games/minetest/default.nix b/pkgs/games/minetest/default.nix
index 7ffa361da559c..cc8cb59d4c641 100644
--- a/pkgs/games/minetest/default.nix
+++ b/pkgs/games/minetest/default.nix
@@ -40,7 +40,7 @@ let
       "-DOpenGL_GL_PREFERENCE=GLVND"
     ];
 
-    NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
+    env.NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
 
     nativeBuildInputs = [ cmake doxygen graphviz ];
 
diff --git a/pkgs/games/naev/default.nix b/pkgs/games/naev/default.nix
index f359b8c9d98ba..a8c2f70b5c6b9 100644
--- a/pkgs/games/naev/default.nix
+++ b/pkgs/games/naev/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
 
-  NIX_CFLAGS_COMPILE="-include ${zlib.dev}/include/zlib.h";
+  env.NIX_CFLAGS_COMPILE="-include ${zlib.dev}/include/zlib.h";
 
   postInstall = ''
     mkdir -p $out/share/naev
diff --git a/pkgs/games/nexuiz/default.nix b/pkgs/games/nexuiz/default.nix
index 84d8a6200015f..2026199c2bf09 100644
--- a/pkgs/games/nexuiz/default.nix
+++ b/pkgs/games/nexuiz/default.nix
@@ -35,7 +35,7 @@ in stdenv.mkDerivation {
     cd ../../
   '';
 
-  NIX_LDFLAGS = ''
+  env.NIX_LDFLAGS = ''
     -rpath ${zlib.out}/lib
     -rpath ${curl.out}/lib
     -rpath ${libjpeg.out}/lib
diff --git a/pkgs/games/onscripter-en/default.nix b/pkgs/games/onscripter-en/default.nix
index bcd33eb989286..9ff8e948f1d82 100644
--- a/pkgs/games/onscripter-en/default.nix
+++ b/pkgs/games/onscripter-en/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   configureFlags = [ "--no-werror" ];
 
   # Without this libvorbisfile.so is not getting linked properly for some reason.
-  NIX_CFLAGS_LINK = "-lvorbisfile";
+  env.NIX_CFLAGS_LINK = "-lvorbisfile";
 
   preBuild = ''
     sed -i 's/.dll//g' Makefile
diff --git a/pkgs/games/opendungeons/default.nix b/pkgs/games/opendungeons/default.nix
index d18682b8807f1..16180b8c45078 100644
--- a/pkgs/games/opendungeons/default.nix
+++ b/pkgs/games/opendungeons/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ ogre cegui boost sfml openal ois ];
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   meta = with lib; {
     description = "An open source, real time strategy game sharing game elements with the Dungeon Keeper series and Evil Genius";
diff --git a/pkgs/games/openlierox/default.nix b/pkgs/games/openlierox/default.nix
index fefac190b0a3d..2c31326242047 100644
--- a/pkgs/games/openlierox/default.nix
+++ b/pkgs/games/openlierox/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
     sha256 = "1k35xppfqi3qfysv81xq3hj4qdy9j2ciinbkfdcmwclcsf3nh94z";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2 -std=c++98 -Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2 -std=c++98 -Wno-error";
 
   # The breakpad fails to build on x86_64, and it's only to report bugs upstream
   cmakeFlags = [ "-DBREAKPAD=0" ];
diff --git a/pkgs/games/openmw/tes3mp.nix b/pkgs/games/openmw/tes3mp.nix
index 72b698ceb7301..31c5f659ffef9 100644
--- a/pkgs/games/openmw/tes3mp.nix
+++ b/pkgs/games/openmw/tes3mp.nix
@@ -82,7 +82,7 @@ let
     # https://github.com/TES3MP/openmw-tes3mp/issues/552
     patches = [ ./tes3mp.patch ];
 
-    NIX_CFLAGS_COMPILE = "-fpermissive";
+    env.NIX_CFLAGS_COMPILE = "-fpermissive";
 
     preConfigure = ''
       substituteInPlace files/version.in \
diff --git a/pkgs/games/openspades/default.nix b/pkgs/games/openspades/default.nix
index 58ac3f8df7994..9bffcaa0b8617 100644
--- a/pkgs/games/openspades/default.nix
+++ b/pkgs/games/openspades/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
     cp $notoFont $out/share/games/openspades/Resources/
   '';
 
-  NIX_CFLAGS_LINK = "-lopenal";
+  env.NIX_CFLAGS_LINK = "-lopenal";
 
   meta = with lib; {
     description = "A compatible client of Ace of Spades 0.75";
diff --git a/pkgs/games/pinball/default.nix b/pkgs/games/pinball/default.nix
index b7abf1dac8cb2..6d356b9ff165b 100644
--- a/pkgs/games/pinball/default.nix
+++ b/pkgs/games/pinball/default.nix
@@ -23,10 +23,8 @@ stdenv.mkDerivation rec {
     "--with-sdl-prefix=${lib.getDev SDL}"
   ];
 
-  NIX_CFLAGS_COMPILE = [
-    "-I${lib.getDev SDL_image}/include/SDL"
-    "-I${lib.getDev SDL_mixer}/include/SDL"
-  ];
+  env.NIX_CFLAGS_COMPILE =
+    "-I${lib.getDev SDL_image}/include/SDL -I${lib.getDev SDL_mixer}/include/SDL";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/games/pokerth/default.nix b/pkgs/games/pokerth/default.nix
index 59555a8ac2401..37a90625c70f6 100644
--- a/pkgs/games/pokerth/default.nix
+++ b/pkgs/games/pokerth/default.nix
@@ -59,7 +59,7 @@ mkDerivation rec {
     "pokerth.pro"
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${SDL.dev}/include/SDL";
+  env.NIX_CFLAGS_COMPILE = "-I${SDL.dev}/include/SDL";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/games/rogue/default.nix b/pkgs/games/rogue/default.nix
index 1e215c813b531..cedb263b48c40 100644
--- a/pkgs/games/rogue/default.nix
+++ b/pkgs/games/rogue/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
   buildInputs = [ ncurses ];
 
   # Fix build for recent ncurses versions
-  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
+  env.NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
 
   meta = with lib; {
     homepage = "http://rogue.rogueforge.net/rogue-5-4/";
diff --git a/pkgs/games/scorched3d/default.nix b/pkgs/games/scorched3d/default.nix
index 227ab720490a4..f7fefaad4d947 100644
--- a/pkgs/games/scorched3d/default.nix
+++ b/pkgs/games/scorched3d/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-fftw=${fftwSinglePrec.dev}" ];
 
-  NIX_LDFLAGS = "-lopenal";
+  env.NIX_LDFLAGS = "-lopenal";
 
   meta = with lib; {
     homepage = "http://scorched3d.co.uk/";
diff --git a/pkgs/games/spring/default.nix b/pkgs/games/spring/default.nix
index 21aca5730628d..9806072b7b6ba 100644
--- a/pkgs/games/spring/default.nix
+++ b/pkgs/games/spring/default.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional withAI jdk
     ++ lib.optional withAI python;
 
-  NIX_CFLAGS_COMPILE = "-fpermissive"; # GL header minor incompatibility
+  env.NIX_CFLAGS_COMPILE = "-fpermissive"; # GL header minor incompatibility
 
   postInstall = ''
     wrapProgram "$out/bin/spring" \
diff --git a/pkgs/games/stuntrally/default.nix b/pkgs/games/stuntrally/default.nix
index bf9e034d7b4a8..32fcdfac9b8f9 100644
--- a/pkgs/games/stuntrally/default.nix
+++ b/pkgs/games/stuntrally/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   # include/OGRE/OgreException.h:265:126: error: invalid conversion from
   # 'int' to 'Ogre::Exception::ExceptionCodes' [-fpermissive]
-  NIX_CFLAGS_COMPILE="-fpermissive";
+  env.NIX_CFLAGS_COMPILE="-fpermissive";
 
   preConfigure = ''
     pushd data
diff --git a/pkgs/games/tome4/default.nix b/pkgs/games/tome4/default.nix
index 70a0321715826..3f81b59599278 100644
--- a/pkgs/games/tome4/default.nix
+++ b/pkgs/games/tome4/default.nix
@@ -41,7 +41,7 @@ in stdenv.mkDerivation rec {
   # disable parallel building as it caused sporadic build failures
   enableParallelBuilding = false;
 
-  NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2 -I${SDL2_image}/include/SDL2 -I${SDL2_ttf}/include/SDL2";
+  env.NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2 -I${SDL2_image}/include/SDL2 -I${SDL2_ttf}/include/SDL2";
 
   makeFlags = [ "config=release" ];
 
diff --git a/pkgs/games/tremulous/default.nix b/pkgs/games/tremulous/default.nix
index e07697f7c0e1a..5fe85506ce25b 100644
--- a/pkgs/games/tremulous/default.nix
+++ b/pkgs/games/tremulous/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   '';
   patches = [ ./parse.patch ];
   patchFlags = [ "-p" "0" ];
-  NIX_LD_FLAGS = ''
+  env.NIX_LD_FLAGS = ''
     -rpath ${stdenv.cc}/lib
     -rpath ${stdenv.cc}/lib64
   '';
diff --git a/pkgs/games/ufoai/default.nix b/pkgs/games/ufoai/default.nix
index 7694821d44f52..a9ece20a894a1 100644
--- a/pkgs/games/ufoai/default.nix
+++ b/pkgs/games/ufoai/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     curl libjpeg libpng gettext cunit
   ];
 
-  NIX_CFLAGS_LINK = "-lgcc_s"; # to avoid occasional runtime error in finding libgcc_s.so.1
+  env.NIX_CFLAGS_LINK = "-lgcc_s"; # to avoid occasional runtime error in finding libgcc_s.so.1
 
   meta = {
     homepage = "http://ufoai.org";
diff --git a/pkgs/games/xbill/default.nix b/pkgs/games/xbill/default.nix
index a20b52e78546a..a2d1484cc3ecb 100644
--- a/pkgs/games/xbill/default.nix
+++ b/pkgs/games/xbill/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ copyDesktopItems ];
   buildInputs = [ libX11 libXpm libXt motif ];
 
-  NIX_CFLAGS_LINK = "-lXpm";
+  env.NIX_CFLAGS_LINK = "-lXpm";
 
   configureFlags = [
     "--with-x"
diff --git a/pkgs/games/xmoto/default.nix b/pkgs/games/xmoto/default.nix
index afeded792f2eb..e24620c066086 100644
--- a/pkgs/games/xmoto/default.nix
+++ b/pkgs/games/xmoto/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     lua5 ode libxdg_basedir libxml2
   ];
 
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     "-fpermissive"
     # Build using the old C++ ABI to fix issue with missing text; the issue
     # should be fixed in the next stable release (if that ever does happen)
diff --git a/pkgs/games/xonotic/default.nix b/pkgs/games/xonotic/default.nix
index fb6cb93f7f242..433440737e3cb 100644
--- a/pkgs/games/xonotic/default.nix
+++ b/pkgs/games/xonotic/default.nix
@@ -64,8 +64,8 @@ let
 
     nativeBuildInputs = [ unzip ];
     buildInputs = [ libjpeg zlib libvorbis curl ]
-      ++ lib.optional withGLX [ libX11.dev libGLU.dev libGL.dev libXpm.dev libXext.dev libXxf86vm.dev alsaLib.dev ]
-      ++ lib.optional withSDL [ SDL2.dev ];
+      ++ lib.optionals withGLX [ libX11.dev libGLU.dev libGL.dev libXpm.dev libXext.dev libXxf86vm.dev alsaLib.dev ]
+      ++ lib.optionals withSDL [ SDL2.dev ];
 
     sourceRoot = "Xonotic/source/darkplaces";
 
diff --git a/pkgs/games/xpilot/bloodspilot-client.nix b/pkgs/games/xpilot/bloodspilot-client.nix
index 8e603ef53f78b..889258b73a141 100644
--- a/pkgs/games/xpilot/bloodspilot-client.nix
+++ b/pkgs/games/xpilot/bloodspilot-client.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     libX11 SDL SDL_ttf SDL_image libGLU libGL expat zlib
   ];
 
-  NIX_LDFLAGS = "-lX11";
+  env.NIX_LDFLAGS = "-lX11";
 
   meta = {
     description = "A multiplayer space combat game (client part)";
diff --git a/pkgs/games/xsok/default.nix b/pkgs/games/xsok/default.nix
index ddc43518de64c..43fb420622ce9 100644
--- a/pkgs/games/xsok/default.nix
+++ b/pkgs/games/xsok/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   buildInputs = [libX11 libXt libXaw libXpm libXext];
   nativeBuildInputs = [imake];
 
-  NIX_CFLAGS_COMPILE=" -isystem ${libXpm.dev}/include/X11 ";
+  env.NIX_CFLAGS_COMPILE=" -isystem ${libXpm.dev}/include/X11 ";
 
   preConfigure = ''
     sed -e "s@/usr/@$out/share/@g" -i src/Imakefile
diff --git a/pkgs/games/xsokoban/default.nix b/pkgs/games/xsokoban/default.nix
index 68b47e6225a59..4d8a6fa050568 100644
--- a/pkgs/games/xsokoban/default.nix
+++ b/pkgs/games/xsokoban/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libX11 xorgproto libXpm libXt ];
 
-  NIX_CFLAGS_COMPILE = "-I${libXpm.dev}/include/X11";
+  env.NIX_CFLAGS_COMPILE = "-I${libXpm.dev}/include/X11";
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/games/zaz/default.nix b/pkgs/games/zaz/default.nix
index 1925d6417175a..2b5947d99a4c1 100644
--- a/pkgs/games/zaz/default.nix
+++ b/pkgs/games/zaz/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   ];
 
   # Fix SDL include problems
-  NIX_CFLAGS_COMPILE="-I${SDL.dev}/include/SDL -I${SDL_image}/include/SDL";
+  env.NIX_CFLAGS_COMPILE="-I${SDL.dev}/include/SDL -I${SDL_image}/include/SDL";
   # Fix linking errors
   makeFlags = [
     "ZAZ_LIBS+=-lSDL"
diff --git a/pkgs/games/zdoom/default.nix b/pkgs/games/zdoom/default.nix
index 3a31f8fdfb5f6..bd1602938b86e 100644
--- a/pkgs/games/zdoom/default.nix
+++ b/pkgs/games/zdoom/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   sourceRoot = ".";
 
-  NIX_CFLAGS_LINK = [ "-lopenal" "-lfluidsynth" ];
+  env.NIX_CFLAGS_LINK = "-lopenal -lfluidsynth";
 
   preConfigure = ''
     sed -i \
diff --git a/pkgs/games/zod/default.nix b/pkgs/games/zod/default.nix
index f7d7a5612d822..13f4677fca544 100644
--- a/pkgs/games/zod/default.nix
+++ b/pkgs/games/zod/default.nix
@@ -37,9 +37,10 @@ let
   hardeningDisable = [ "format" ];
   NIX_LDFLAGS = "-L${libmysqlclient}/lib/mysql";
   zod_engine = stdenv.mkDerivation {
-    inherit name version src nativeBuildInputs buildInputs hardeningDisable NIX_LDFLAGS;
+    inherit name version src nativeBuildInputs buildInputs hardeningDisable;
     pname = "${name}-engine";
     enableParallelBuilding = true;
+    env.NIX_LDFLAGS = NIX_LDFLAGS;
     preBuild = "cd zod_src";
     installPhase = ''
       mkdir -p $out/bin
@@ -48,9 +49,10 @@ let
     '';
   };
   zod_map_editor = stdenv.mkDerivation {
-    inherit name version src nativeBuildInputs buildInputs hardeningDisable NIX_LDFLAGS;
+    inherit name version src nativeBuildInputs buildInputs hardeningDisable;
     pname = "${name}-map_editor";
     enableParallelBuilding = true;
+    env.NIX_LDFLAGS = NIX_LDFLAGS;
     preBuild = "cd zod_src";
     makeFlags = [ "map_editor" ];
     installPhase = ''
diff --git a/pkgs/games/zoom/default.nix b/pkgs/games/zoom/default.nix
index 086d860872c71..2727b2bb8552a 100644
--- a/pkgs/games/zoom/default.nix
+++ b/pkgs/games/zoom/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ perl expat xlibsWrapper freetype ];
 
-  NIX_CFLAGS_COMPILE = "-I${freetype}/include/freetype2 -fgnu89-inline";
+  env.NIX_CFLAGS_COMPILE = "-I${freetype}/include/freetype2 -fgnu89-inline";
 
   meta = with lib; {
     description = "Player for Z-Code, TADS and HUGO stories or games";
diff --git a/pkgs/misc/base16-builder/node-packages.nix b/pkgs/misc/base16-builder/node-packages.nix
index 79748949ff727..45025077238d0 100644
--- a/pkgs/misc/base16-builder/node-packages.nix
+++ b/pkgs/misc/base16-builder/node-packages.nix
@@ -10,7 +10,7 @@ let
     inherit (pkgs) stdenv lib nix-gitignore fetchurl fetchgit;
   });
   nodeEnv = import ../../development/node-packages/node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile;
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile jq;
     inherit pkgs nodejs;
     libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
   };
diff --git a/pkgs/misc/cups/drivers/cups-bjnp/default.nix b/pkgs/misc/cups/drivers/cups-bjnp/default.nix
index 40243bb919699..b0b7cf20c0d65 100644
--- a/pkgs/misc/cups/drivers/cups-bjnp/default.nix
+++ b/pkgs/misc/cups/drivers/cups-bjnp/default.nix
@@ -11,11 +11,7 @@ stdenv.mkDerivation rec {
   preConfigure = ''configureFlags="--with-cupsbackenddir=$out/lib/cups/backend"'';
 
   buildInputs = [cups];
-  NIX_CFLAGS_COMPILE = [
-    "-include stdio.h"
-    "-Wno-error=stringop-truncation"
-    "-Wno-error=deprecated-declarations"
-  ];
+  env.NIX_CFLAGS_COMPILE = "-include stdio.h -Wno-error=stringop-truncation -Wno-error=deprecated-declarations";
 
   meta = {
     description = "CUPS back-end for Canon printers";
diff --git a/pkgs/misc/drivers/utsushi/default.nix b/pkgs/misc/drivers/utsushi/default.nix
index ae3a083148ba8..481aa04604002 100644
--- a/pkgs/misc/drivers/utsushi/default.nix
+++ b/pkgs/misc/drivers/utsushi/default.nix
@@ -38,12 +38,7 @@ in stdenv.mkDerivation rec {
     libusb1.dev
   ];
 
-  NIX_CFLAGS_COMPILE = [
-    "-Wno-error=deprecated-declarations"
-    "-Wno-error=parentheses"
-    "-Wno-error=unused-variable"
-  ];
-
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations -Wno-error=parentheses -Wno-error=unused-variable";
 
   postPatch = ''
     # create fake udev and sane config
diff --git a/pkgs/misc/emulators/cdemu/libmirage.nix b/pkgs/misc/emulators/cdemu/libmirage.nix
index 9813c906befc9..f20011d3675c5 100644
--- a/pkgs/misc/emulators/cdemu/libmirage.nix
+++ b/pkgs/misc/emulators/cdemu/libmirage.nix
@@ -10,8 +10,8 @@ let pkg = import ./base.nix {
 in callPackage pkg {
   buildInputs = [ glib libsndfile zlib bzip2 xz libsamplerate intltool ];
   drvParams = {
-    PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_GIRDIR = "${placeholder "out"}/share/gir-1.0";
-    PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_TYPELIBDIR = "${placeholder "out"}/lib/girepository-1.0";
+    env.PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_GIRDIR = "${placeholder "out"}/share/gir-1.0";
+    env.PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_TYPELIBDIR = "${placeholder "out"}/lib/girepository-1.0";
     nativeBuildInputs = [ cmake gobject-introspection pkg-config ];
     propagatedBuildInputs = [ pcre util-linux libselinux libsepol ];
   };
diff --git a/pkgs/misc/emulators/desmume/default.nix b/pkgs/misc/emulators/desmume/default.nix
index ff17833f690b6..bda353a6c5a2b 100644
--- a/pkgs/misc/emulators/desmume/default.nix
+++ b/pkgs/misc/emulators/desmume/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     ./01_use_system_tinyxml.patch
   ];
 
-  CXXFLAGS = "-fpermissive";
+  env.CXXFLAGS = "-fpermissive";
 
   buildInputs =
   [ pkg-config libtool intltool libXmu lua agg alsaLib soundtouch
diff --git a/pkgs/misc/emulators/dolphin-emu/master.nix b/pkgs/misc/emulators/dolphin-emu/master.nix
index 1162791456038..014759de89520 100644
--- a/pkgs/misc/emulators/dolphin-emu/master.nix
+++ b/pkgs/misc/emulators/dolphin-emu/master.nix
@@ -55,7 +55,7 @@ in stdenv.mkDerivation rec {
   ];
 
   qtWrapperArgs = lib.optionals stdenv.isLinux [
-    "--prefix LD_LIBRARY_PATH : ${vulkan-loader}/lib"
+    "--prefix" "LD_LIBRARY_PATH" ":" "${vulkan-loader}/lib"
   ];
 
   # - Allow Dolphin to use nix-provided libraries instead of building them
diff --git a/pkgs/misc/emulators/fakenes/default.nix b/pkgs/misc/emulators/fakenes/default.nix
index 2011d8ce03758..23d65fa1878cc 100644
--- a/pkgs/misc/emulators/fakenes/default.nix
+++ b/pkgs/misc/emulators/fakenes/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
     cp fakenes $out/bin
   '';
 
-  NIX_LDFLAGS = "-lX11 -lXxf86vm -lXcursor -lXpm";
+  env.NIX_LDFLAGS = "-lX11 -lXxf86vm -lXcursor -lXpm";
 
   patches = [ ./build.patch ];
 
diff --git a/pkgs/misc/emulators/fceux/default.nix b/pkgs/misc/emulators/fceux/default.nix
index f76fc761abbcf..e1c3336c36666 100644
--- a/pkgs/misc/emulators/fceux/default.nix
+++ b/pkgs/misc/emulators/fceux/default.nix
@@ -16,7 +16,12 @@ stdenv.mkDerivation {
     zlib SDL lua5_1
   ];
 
-  sconsFlags = "OPENGL=false GTK=false CREATE_AVI=false LOGO=false";
+  sconsFlags = [
+    "OPENGL=false"
+    "GTK=false"
+    "CREATE_AVI=false"
+    "LOGO=false"
+  ];
   prefixKey = "--prefix=";
 
   # sed allows scons to find libraries in nix.
diff --git a/pkgs/misc/emulators/gens-gs/default.nix b/pkgs/misc/emulators/gens-gs/default.nix
index abc676ffa632a..af810164db1c8 100644
--- a/pkgs/misc/emulators/gens-gs/default.nix
+++ b/pkgs/misc/emulators/gens-gs/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   # Work around build failures on recent GTK.
   # See http://ubuntuforums.org/showthread.php?p=10535837
-  NIX_CFLAGS_COMPILE = "-UGTK_DISABLE_DEPRECATED -UGSEAL_ENABLE";
+  env.NIX_CFLAGS_COMPILE = "-UGTK_DISABLE_DEPRECATED -UGSEAL_ENABLE";
 
   meta = with lib; {
     homepage = "https://segaretro.org/Gens/GS";
diff --git a/pkgs/misc/emulators/mame/default.nix b/pkgs/misc/emulators/mame/default.nix
index e803a13068338..18ce7d21855a4 100644
--- a/pkgs/misc/emulators/mame/default.nix
+++ b/pkgs/misc/emulators/mame/default.nix
@@ -28,7 +28,7 @@ in mkDerivation {
   };
 
   hardeningDisable = [ "fortify" ];
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=maybe-uninitialized" "-Wno-error=missing-braces" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=maybe-uninitialized -Wno-error=missing-braces";
 
   makeFlags = [
     "TOOLS=1"
diff --git a/pkgs/misc/emulators/tilem/default.nix b/pkgs/misc/emulators/tilem/default.nix
index bde706e23040d..2c9640904d8d6 100644
--- a/pkgs/misc/emulators/tilem/default.nix
+++ b/pkgs/misc/emulators/tilem/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   };
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ glib gtk2 libticonv libtifiles2 libticables2 libticalcs2 ];
-  NIX_CFLAGS_COMPILE = [ "-lm" ];
+  env.NIX_CFLAGS_COMPILE = "-lm";
   meta = with lib; {
     homepage = "http://lpg.ticalc.org/prj_tilem/";
     description = "Emulator and debugger for Texas Instruments Z80-based graphing calculators";
diff --git a/pkgs/misc/emulators/uae/default.nix b/pkgs/misc/emulators/uae/default.nix
index 75b86eaeebd12..6424a095eead8 100644
--- a/pkgs/misc/emulators/uae/default.nix
+++ b/pkgs/misc/emulators/uae/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ gtk2 alsaLib SDL ];
 
   hardeningDisable = [ "format" ];
-  LDFLAGS = [ "-lm" ];
+  env.LDFLAGS = "-lm";
 
   meta = {
     description = "Ultimate/Unix/Unusable Amiga Emulator";
diff --git a/pkgs/misc/emulators/wine/base.nix b/pkgs/misc/emulators/wine/base.nix
index 8553ab8364556..9b4302cfa4ccd 100644
--- a/pkgs/misc/emulators/wine/base.nix
+++ b/pkgs/misc/emulators/wine/base.nix
@@ -88,7 +88,7 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
   # Wine locates a lot of libraries dynamically through dlopen().  Add
   # them to the RPATH so that the user doesn't have to set them in
   # LD_LIBRARY_PATH.
-  NIX_LDFLAGS = toString (map (path: "-rpath " + path) (
+  env.NIX_LDFLAGS = toString (map (path: "-rpath " + path) (
       map (x: "${lib.getLib x}/lib") ([ stdenv.cc.cc ] ++ buildInputs)
       # libpulsecommon.so is linked but not found otherwise
       ++ lib.optionals supportFlags.pulseaudioSupport (map (x: "${lib.getLib x}/lib/pulseaudio")
diff --git a/pkgs/misc/emulators/wine/builder-wow.sh b/pkgs/misc/emulators/wine/builder-wow.sh
index c006db3116b59..b045ec3051c9f 100644
--- a/pkgs/misc/emulators/wine/builder-wow.sh
+++ b/pkgs/misc/emulators/wine/builder-wow.sh
@@ -1,5 +1,7 @@
 ## build described at http://wiki.winehq.org/Wine64
 
+source .attrs.sh
+
 source $stdenv/setup
 
 unpackPhase
@@ -11,14 +13,14 @@ mkdir -p $TMP/wine-wow $TMP/wine64
 
 cd $TMP/wine64
 sourceRoot=`pwd`
-configureFlags="--enable-win64"
+configureFlags=("--enable-win64")
 configurePhase
 buildPhase
 # checkPhase
 
 cd $TMP/wine-wow
 sourceRoot=`pwd`
-configureFlags="--with-wine64=../wine64"
+configureFlags=("--with-wine64=../wine64")
 configurePhase
 buildPhase
 # checkPhase
diff --git a/pkgs/misc/emulators/wxmupen64plus/default.nix b/pkgs/misc/emulators/wxmupen64plus/default.nix
index 8621d213b79db..90d4c60cb4772 100644
--- a/pkgs/misc/emulators/wxmupen64plus/default.nix
+++ b/pkgs/misc/emulators/wxmupen64plus/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
     wafConfigureFlagsArray+=("--mupenapi=$APIDIR" "--wxconfig=`type -P wx-config`")
   '';
 
-  NIX_CFLAGS_COMPILE = "-fpermissive";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
 
   meta = {
     description = "GUI for the Mupen64Plus 2.0 emulator";
diff --git a/pkgs/misc/gnash/default.nix b/pkgs/misc/gnash/default.nix
index 9f5f022b85380..93debe3759663 100644
--- a/pkgs/misc/gnash/default.nix
+++ b/pkgs/misc/gnash/default.nix
@@ -90,7 +90,7 @@ stdenv.mkDerivation {
     ++ optional  enableQt        qt4
     ++ optional  enableFFmpeg    ffmpeg_2
     ++ optional  enableJemalloc  jemalloc
-    ++ optional  enableHwAccel   [ libGL libGLU ]
+    ++ optionals enableHwAccel   [ libGL libGLU ]
     ++ optionals enableOpenGL    [ libGL libGLU ]
     ++ optionals enablePlugins   [ xulrunner npapi_sdk ]
     ++ optionals enableGTK       [ gtk2 gnome2.gtkglext gnome2.GConf ];
diff --git a/pkgs/misc/screensavers/rss-glx/default.nix b/pkgs/misc/screensavers/rss-glx/default.nix
index 981db782c7c92..69e4ab3b45b14 100644
--- a/pkgs/misc/screensavers/rss-glx/default.nix
+++ b/pkgs/misc/screensavers/rss-glx/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libGLU libGL xlibsWrapper imagemagick6 libtiff bzip2 ];
 
-  NIX_CFLAGS_COMPILE = "-I${imagemagick6.dev}/include/ImageMagick";
-  NIX_LDFLAGS= "-rpath ${libXext}/lib";
+  env.NIX_CFLAGS_COMPILE = "-I${imagemagick6.dev}/include/ImageMagick";
+  env.NIX_LDFLAGS = "-rpath ${libXext}/lib";
 
   meta = {
     description = "Really Slick Screensavers Port to GLX";
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index cd401907125ba..1a87208b0c47b 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -70,14 +70,12 @@ let
       "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
     ] ++ extraMakeFlags;
 
-    passAsFile = [ "extraConfig" ];
-
     configurePhase = ''
       runHook preConfigure
 
       make ${defconfig}
 
-      cat $extraConfigPath >> .config
+      cat <(${buildPackages.jq}/bin/jq -r <.attrs.json .extraConfig) >> .config
 
       runHook postConfigure
     '';
diff --git a/pkgs/os-specific/darwin/apple-source-releases/architecture/default.nix b/pkgs/os-specific/darwin/apple-source-releases/architecture/default.nix
index 74327bc4c4285..c51028cbd62a9 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/architecture/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/architecture/default.nix
@@ -11,7 +11,7 @@ appleDerivation {
 
   installFlags = [ "EXPORT_DSTDIR=/include/architecture" ];
 
-  DSTROOT = "$(out)";
+  env.DSTROOT = "$(out)";
 
   appleHeaders = ''
     architecture/alignment.h
diff --git a/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
index 1daa492961040..e280ae2104639 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
@@ -5,8 +5,8 @@ appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
   buildInputs = [ libutil ];
 
-  NIX_CFLAGS_COMPILE = "-I.";
-  NIX_LDFLAGS = "-lutil";
+  env.NIX_CFLAGS_COMPILE = "-I.";
+  env.NIX_LDFLAGS = "-lutil";
   patchPhase = ''
     # ugly hacks for missing headers
     # most are bsd related - probably should make this a drv
diff --git a/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix b/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
index 3e7e89642c26f..fa4261d94cfd1 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
@@ -4,8 +4,8 @@
 appleDerivation {
   nativeBuildInputs = [ xcbuildHook flex bison fixDarwinDylibNames ];
   buildInputs = [ CoreSymbolication darling xnu ];
-  NIX_CFLAGS_COMPILE = "-DCTF_OLD_VERSIONS -DPRIVATE -DYYDEBUG=1 -I${xnu}/Library/Frameworks/System.framework/Headers -Wno-error=implicit-function-declaration";
-  NIX_LDFLAGS = "-L./Products/Release";
+  env.NIX_CFLAGS_COMPILE = "-DCTF_OLD_VERSIONS -DPRIVATE -DYYDEBUG=1 -I${xnu}/Library/Frameworks/System.framework/Headers -Wno-error=implicit-function-declaration";
+  env.NIX_LDFLAGS = "-L./Products/Release";
   xcbuildFlags = [ "-target" "dtrace_frameworks" "-target" "dtrace" ];
 
   doCheck = false;
diff --git a/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
index dd3cf03095266..f787a70a833b2 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
@@ -5,7 +5,7 @@ appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
   buildInputs = [ openssl_1_0_2 xnu Librpcsvc libpcap developer_cmds ];
 
-  NIX_CFLAGS_COMPILE = " -I./unbound -I${xnu}/Library/Frameworks/System.framework/Headers/";
+  env.NIX_CFLAGS_COMPILE = " -I./unbound -I${xnu}/Library/Frameworks/System.framework/Headers/";
 
   # "spray" requires some files that aren't compiling correctly in xcbuild.
   # "rtadvd" seems to fail with some missing constants.
diff --git a/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix b/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix
index 2fc4afa77d9f8..315f0fb06219b 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix
@@ -1,8 +1,6 @@
 { appleDerivation, darwin-stubs }:
 
 appleDerivation {
-  phases = [ "unpackPhase" "installPhase" ];
-
   # Not strictly necessary, since libSystem depends on it, but it's nice to be explicit so we
   # can easily find out what's impure.
   __propagatedImpureHostDeps = [
diff --git a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
index 34d093b7cc002..761d50c90ccca 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
@@ -12,7 +12,7 @@ appleDerivation {
   # NIX_CFLAGS_COMPILE = lib.optionalString hostPlatform.isi686 "-D__i386__"
   #                    + lib.optionalString hostPlatform.isx86_64 "-D__x86_64__"
   #                    + lib.optionalString hostPlatform.isAarch32 "-D__arm__";
-  NIX_CFLAGS_COMPILE = [ "-DDAEMON_UID=1"
+  env.NIX_CFLAGS_COMPILE = builtins.toString ([ "-DDAEMON_UID=1"
                          "-DDAEMON_GID=1"
                          "-DDEFAULT_AT_QUEUE='a'"
                          "-DDEFAULT_BATCH_QUEUE='b'"
@@ -28,7 +28,7 @@ appleDerivation {
                          "-DAHZV1=64 "
                          "-DAU_SESSION_FLAG_HAS_TTY=0x4000"
                          "-DAU_SESSION_FLAG_HAS_AUTHENTICATED=0x4000"
-                       ] ++ lib.optional (!stdenv.isLinux) " -D__FreeBSD__ ";
+                       ] ++ lib.optional (!stdenv.isLinux) " -D__FreeBSD__ ");
 
   patchPhase = ''
     substituteInPlace login.tproj/login.c \
diff --git a/pkgs/os-specific/darwin/apple-source-releases/top/default.nix b/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
index a2f912ca5782c..f6b00c85648c0 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
@@ -3,7 +3,7 @@
 appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
   buildInputs = [ apple_sdk.frameworks.IOKit ncurses libutil ];
-  NIX_LDFLAGS = "-lutil";
+  env.NIX_LDFLAGS = "-lutil";
   installPhase = ''
     install -D Products/Release/libtop.a $out/lib/libtop.a
     install -D Products/Release/libtop.h $out/include/libtop.h
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
index 9892814468e9b..b99b70b1139a8 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@@ -60,7 +60,7 @@ appleDerivation ({
   MIGCC = "cc";
   ARCHS = "x86_64";
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   preBuild = ''
     # This is a bit of a hack...
diff --git a/pkgs/os-specific/darwin/maloader/default.nix b/pkgs/os-specific/darwin/maloader/default.nix
index 9142484e043ca..312ff1c3da262 100644
--- a/pkgs/os-specific/darwin/maloader/default.nix
+++ b/pkgs/os-specific/darwin/maloader/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
       ld-mac.cc
   '';
 
-  NIX_CFLAGS_COMPILE = "-I${lib.getDev libcxx}/include/c++/v1";
+  env.NIX_CFLAGS_COMPILE = "-I${lib.getDev libcxx}/include/c++/v1";
   buildInputs = [ clang libcxx ];
   buildFlags = [ "USE_LIBCXX=1" "release" ];
 
diff --git a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
index 560be0c31ab61..4a64c54b7f983 100644
--- a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
+++ b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
@@ -58,12 +58,15 @@ stdenv.mkDerivation {
       --replace '#if U_ICU_VERSION_MAJOR_NUM' '#if 0 //'
   '';
 
-  BUILD_DIR = "./Build";
-  CFLAGS = "-DINCLUDE_OBJC -I${libxml2.dev}/include/libxml2"; # They seem to assume we include objc in some places and not in others, make a PR; also not sure why but libxml2 include path isn't getting picked up from buildInputs
-
-  # I'm guessing at the version here. https://github.com/apple/swift-corelibs-foundation/commit/df3ec55fe6c162d590a7653d89ad669c2b9716b1 imported "high sierra"
-  # and this version is a version from there. No idea how accurate it is.
-  LDFLAGS = "-current_version 1454.90.0 -compatibility_version 150.0.0 -init ___CFInitialize";
+  env = {
+    BUILD_DIR = "./Build";
+    # They seem to assume we include objc in some places and not in others, make a PR; also not sure why but libxml2 include path isn't getting picked up from buildInputs
+    CFLAGS = "-DINCLUDE_OBJC -I${libxml2.dev}/include/libxml2";
+
+    # I'm guessing at the version here. https://github.com/apple/swift-corelibs-foundation/commit/df3ec55fe6c162d590a7653d89ad669c2b9716b1 imported "high sierra"
+    # and this version is a version from there. No idea how accurate it is.
+    LDFLAGS = "-current_version 1454.90.0 -compatibility_version 150.0.0 -init ___CFInitialize";
+  };
 
   configurePhase = ''
     ../configure release --sysroot UNUSED
diff --git a/pkgs/os-specific/linux/amdgpu-pro/default.nix b/pkgs/os-specific/linux/amdgpu-pro/default.nix
index 13dd8302b18d2..20b04393caf9f 100644
--- a/pkgs/os-specific/linux/amdgpu-pro/default.nix
+++ b/pkgs/os-specific/linux/amdgpu-pro/default.nix
@@ -75,7 +75,7 @@ in stdenv.mkDerivation rec {
 
   preBuild = optionalString (!libsOnly) ''
     pushd usr/src/amdgpu-${build}
-    makeFlags="$makeFlags M=$(pwd)"
+    makeFlags+=("M=$(pwd)")
     patchShebangs pre-build.sh
     ./pre-build.sh ${kernel.version}
     popd
@@ -94,9 +94,9 @@ in stdenv.mkDerivation rec {
   postBuild = optionalString (!libsOnly)
     (concatMapStrings (m: "xz usr/src/amdgpu-${build}/${m}\n") modules);
 
-  NIX_CFLAGS_COMPILE = "-Werror";
+  env.NIX_CFLAGS_COMPILE = "-Werror";
 
-  makeFlags = optionalString (!libsOnly)
+  makeFlags = optional (!libsOnly)
     "-C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build modules";
 
   depLibPath = makeLibraryPath [
diff --git a/pkgs/os-specific/linux/autofs/default.nix b/pkgs/os-specific/linux/autofs/default.nix
index 3055a91161b32..8e57b62aee26e 100644
--- a/pkgs/os-specific/linux/autofs/default.nix
+++ b/pkgs/os-specific/linux/autofs/default.nix
@@ -13,7 +13,7 @@ in stdenv.mkDerivation {
   };
 
   preConfigure = ''
-    configureFlags="--enable-force-shutdown --enable-ignore-busy --with-path=$PATH"
+    configureFlags+=("--enable-force-shutdown" "--enable-ignore-busy" "--with-path=$PATH")
     export sssldir="${sssd}/lib/sssd/modules"
     export HAVE_SSS_AUTOFS=1
 
@@ -29,7 +29,7 @@ in stdenv.mkDerivation {
   '';
 
   # configure script is not finding the right path
-  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
+  env.NIX_CFLAGS_COMPILE = "-I${libtirpc.dev}/include/tirpc";
 
   installPhase = ''
     make install SUBDIRS="lib daemon modules man" # all but samples
diff --git a/pkgs/os-specific/linux/bolt/default.nix b/pkgs/os-specific/linux/bolt/default.nix
index d38a97387f5a4..4a0ab935871e6 100644
--- a/pkgs/os-specific/linux/bolt/default.nix
+++ b/pkgs/os-specific/linux/bolt/default.nix
@@ -82,8 +82,8 @@ stdenv.mkDerivation rec {
     "-Dlocalstatedir=/var"
   ];
 
-  PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMUNITDIR = "${placeholder "out"}/lib/systemd/system";
-  PKG_CONFIG_UDEV_UDEVDIR = "${placeholder "out"}/lib/udev";
+  env.PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMUNITDIR = "${placeholder "out"}/lib/systemd/system";
+  env.PKG_CONFIG_UDEV_UDEVDIR = "${placeholder "out"}/lib/udev";
 
   meta = with lib; {
     description = "Thunderbolt 3 device management daemon";
diff --git a/pkgs/os-specific/linux/conky/default.nix b/pkgs/os-specific/linux/conky/default.nix
index 9bd8890e71348..bade31d7d4877 100644
--- a/pkgs/os-specific/linux/conky/default.nix
+++ b/pkgs/os-specific/linux/conky/default.nix
@@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
     substituteInPlace cmake/Conky.cmake --replace "# set(RELEASE true)" "set(RELEASE true)"
   '';
 
-  NIX_LDFLAGS = "-lgcc_s";
+  env.NIX_LDFLAGS = "-lgcc_s";
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ glib libXinerama ]
diff --git a/pkgs/os-specific/linux/crda/default.nix b/pkgs/os-specific/linux/crda/default.nix
index c337da2fe723e..d0e0abb4963ae 100644
--- a/pkgs/os-specific/linux/crda/default.nix
+++ b/pkgs/os-specific/linux/crda/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     "REG_BIN=${wireless-regdb}/lib/crda/regulatory.bin"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-const-variable";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-const-variable";
 
   buildFlags = [ "all_noverify" ];
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/cryptodev/default.nix b/pkgs/os-specific/linux/cryptodev/default.nix
index f09679ba2128d..ac737775cc3d4 100644
--- a/pkgs/os-specific/linux/cryptodev/default.nix
+++ b/pkgs/os-specific/linux/cryptodev/default.nix
@@ -13,9 +13,9 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  KERNEL_DIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
-  INSTALL_MOD_PATH = "\${out}";
-  prefix = "\${out}";
+  env.KERNEL_DIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+  env.INSTALL_MOD_PATH = "\${out}";
+  env.prefix = "\${out}";
 
   meta = {
     description = "Device that allows access to Linux kernel cryptographic drivers";
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index ad700c0977221..dce2de85ca93b 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     substituteInPlace tests/unit-utils-io.c --replace "| O_DIRECT" ""
   '';
 
-  NIX_LDFLAGS = "-lgcc_s";
+  env.NIX_LDFLAGS = "-lgcc_s";
 
   configureFlags = [
     "--enable-cryptsetup-reencrypt"
diff --git a/pkgs/os-specific/linux/dbus-broker/default.nix b/pkgs/os-specific/linux/dbus-broker/default.nix
index c6f1c1d825049..db155c010dcfc 100644
--- a/pkgs/os-specific/linux/dbus-broker/default.nix
+++ b/pkgs/os-specific/linux/dbus-broker/default.nix
@@ -19,9 +19,9 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [ "-D=system-console-users=gdm,sddm,lightdm" ];
 
-  PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMUNITDIR = "${placeholder "out"}/lib/systemd/system";
-  PKG_CONFIG_SYSTEMD_SYSTEMDUSERUNITDIR = "${placeholder "out"}/lib/systemd/user";
-  PKG_CONFIG_SYSTEMD_CATALOGDIR = "${placeholder "out"}/lib/systemd/catalog";
+  env.PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMUNITDIR = "${placeholder "out"}/lib/systemd/system";
+  env.PKG_CONFIG_SYSTEMD_SYSTEMDUSERUNITDIR = "${placeholder "out"}/lib/systemd/user";
+  env.PKG_CONFIG_SYSTEMD_CATALOGDIR = "${placeholder "out"}/lib/systemd/catalog";
 
   postInstall = ''
     install -Dm644 $src/README.md $out/share/doc/dbus-broker/README
diff --git a/pkgs/os-specific/linux/disk-indicator/default.nix b/pkgs/os-specific/linux/disk-indicator/default.nix
index f754882ccd010..6ce2dbc81c8d1 100644
--- a/pkgs/os-specific/linux/disk-indicator/default.nix
+++ b/pkgs/os-specific/linux/disk-indicator/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
 
   buildPhase = "make -f makefile";
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=cpp";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=cpp";
 
   hardeningDisable = [ "fortify" ];
 
diff --git a/pkgs/os-specific/linux/ebtables/default.nix b/pkgs/os-specific/linux/ebtables/default.nix
index bca24d9c90507..31a5dbd68f9d2 100644
--- a/pkgs/os-specific/linux/ebtables/default.nix
+++ b/pkgs/os-specific/linux/ebtables/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     "LOCALSTATEDIR=/var"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   preInstall = "mkdir -p $out/etc/sysconfig";
 
diff --git a/pkgs/os-specific/linux/ena/default.nix b/pkgs/os-specific/linux/ena/default.nix
index 1ff0b9a154a41..6d6c5e0197513 100644
--- a/pkgs/os-specific/linux/ena/default.nix
+++ b/pkgs/os-specific/linux/ena/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
   # linux 3.12
-  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
 
   configurePhase = ''
     runHook preConfigure
diff --git a/pkgs/os-specific/linux/firmware/openelec-dvb-firmware/default.nix b/pkgs/os-specific/linux/firmware/openelec-dvb-firmware/default.nix
index 3181072ea1821..097a70b389bec 100644
--- a/pkgs/os-specific/linux/firmware/openelec-dvb-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/openelec-dvb-firmware/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "cef3ce537d213e020af794cecf9de207e2882c375ceda39102eb6fa2580bad8d";
   };
 
-  phases = [ "unpackPhase" "installPhase" ];
+  dontBuild = true;
 
   installPhase = ''
     DESTDIR="$out" ./install
diff --git a/pkgs/os-specific/linux/firmware/rtl8192su-firmware/default.nix b/pkgs/os-specific/linux/firmware/rtl8192su-firmware/default.nix
index 34c2b683ea40e..6cbaa4acb8d24 100644
--- a/pkgs/os-specific/linux/firmware/rtl8192su-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/rtl8192su-firmware/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "0j3c35paapq1icmxq0mg7pm2xa2m69q7bkfmwgq99d682yr2cb5l";
   };
 
-  phases = [ "unpackPhase" "installPhase" ];
+  dontBuild = true;
 
   installPhase = ''
     for i in rtl8192sfw.bin \
diff --git a/pkgs/os-specific/linux/firmware/rtl8723bs-firmware/default.nix b/pkgs/os-specific/linux/firmware/rtl8723bs-firmware/default.nix
index 36580d4b1b917..c587994ccecb0 100644
--- a/pkgs/os-specific/linux/firmware/rtl8723bs-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/rtl8723bs-firmware/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation {
   name = "rtl8723bs-firmware-${linuxPackages.rtl8723bs.version}";
   inherit (linuxPackages.rtl8723bs) src;
 
-  phases = [ "unpackPhase" "installPhase" ];
+  dontBuild = true;
 
   installPhase = ''
     mkdir -p                "$out/lib/firmware/rtlwifi"
diff --git a/pkgs/os-specific/linux/gobi_loader/default.nix b/pkgs/os-specific/linux/gobi_loader/default.nix
index b7972007719c9..2b251242119c8 100644
--- a/pkgs/os-specific/linux/gobi_loader/default.nix
+++ b/pkgs/os-specific/linux/gobi_loader/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     substituteInPlace 60-gobi.rules --replace "/lib/firmware" "/run/current-system/firmware"
   '';
 
-  makeFlags = "prefix=${placeholder "out"}";
+  makeFlags = [ "prefix=${placeholder "out"}" ];
 
   meta = with lib; {
     description = "Firmware loader for Qualcomm Gobi USB chipsets";
diff --git a/pkgs/os-specific/linux/irqbalance/default.nix b/pkgs/os-specific/linux/irqbalance/default.nix
index 7cb05f7fe989a..b1a0d09b7200c 100644
--- a/pkgs/os-specific/linux/irqbalance/default.nix
+++ b/pkgs/os-specific/linux/irqbalance/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ glib ncurses libcap_ng ];
 
-  LDFLAGS = "-lncurses";
+  env.LDFLAGS = "-lncurses";
 
   postInstall =
     ''
diff --git a/pkgs/os-specific/linux/jool/cli.nix b/pkgs/os-specific/linux/jool/cli.nix
index b1bce496614a1..0e3cbc5971265 100644
--- a/pkgs/os-specific/linux/jool/cli.nix
+++ b/pkgs/os-specific/linux/jool/cli.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ libnl iptables ];
 
-  makeFlags = [ "-C" "src/usr" ];
+  makeFlags = [ "-C src/usr" ];
 
   prePatch = ''
     sed -e 's%^XTABLES_SO_DIR = .*%XTABLES_SO_DIR = '"$out"'/lib/xtables%g' -i src/usr/iptables/Makefile
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index 34e80ac8222c0..512aaa6841a6b 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -35,13 +35,13 @@ let
 
     # Skip clean on darwin, case-sensitivity issues.
     buildPhase = lib.optionalString (!stdenvNoCC.buildPlatform.isDarwin) ''
-      make mrproper $makeFlags
+      make mrproper ''${makeFlags[@]}
     '' + ''
-      make headers $makeFlags
+      make headers ''${makeFlags[@]}
     '';
 
     checkPhase = ''
-      make headers_check $makeFlags
+      make headers_check ''${makeFlags[@]}
     '';
 
     # The following command requires rsync:
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 68a1fcdb0e6ba..1dde037766183 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -1,6 +1,7 @@
 { buildPackages
 , callPackage
 , perl
+, jq
 , bison ? null
 , flex ? null
 , gmp ? null
@@ -101,20 +102,21 @@ let
     pname = "linux-config";
     inherit version;
 
-    generateConfig = ./generate-config.pl;
-
-    kernelConfig = kernelConfigFun intermediateNixConfig;
-    passAsFile = [ "kernelConfig" ];
-
     depsBuildBuild = [ buildPackages.stdenv.cc ];
-    nativeBuildInputs = [ perl gmp libmpc mpfr ]
+ 
+    nativeBuildInputs = [ perl gmp libmpc mpfr jq ]
       ++ lib.optionals (lib.versionAtLeast version "4.16") [ bison flex ];
 
-    platformName = stdenv.hostPlatform.linux-kernel.name;
-    # e.g. "defconfig"
-    kernelBaseConfig = if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig;
-    # e.g. "bzImage"
-    kernelTarget = stdenv.hostPlatform.linux-kernel.target;
+    kernelConfig = kernelConfigFun intermediateNixConfig;
+
+    env = {
+      generateConfig = "${./generate-config.pl}";
+      platformName = stdenv.hostPlatform.linux-kernel.name;
+      # e.g. "defconfig"
+      kernelBaseConfig = if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig;
+      # e.g. "bzImage"
+      kernelTarget = stdenv.hostPlatform.linux-kernel.target;
+    };
 
     prePatch = kernel.prePatch + ''
       # Patch kconfig to print "###" after every question so that
@@ -137,7 +139,7 @@ let
 
       # Create the config file.
       echo "generating kernel configuration..."
-      ln -s "$kernelConfigPath" "$buildRoot/kernel-config"
+      jq -r <../.attrs.json '.kernelConfig' > "$buildRoot/kernel-config"
       DEBUG=1 ARCH=$kernelArch KERNEL_CONFIG="$buildRoot/kernel-config" AUTO_MODULES=$autoModules \
            PREFER_BUILTIN=$preferBuiltin BUILD_ROOT="$buildRoot" SRC=. perl -w $generateConfig
     '';
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index f874762267a8f..3557ad39aacc8 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -178,11 +178,11 @@ let
       installFlags = [
         "INSTALLKERNEL=${installkernel}"
         "INSTALL_PATH=$(out)"
-      ] ++ (optional isModular "INSTALL_MOD_PATH=$(out)")
+      ] ++ optional isModular "INSTALL_MOD_PATH=$(out)"
       ++ optional installsFirmware "INSTALL_FW_PATH=$(out)/lib/firmware";
 
       preInstall = ''
-        installFlagsArray+=("-j$NIX_BUILD_CORES")
+        installFlags+=("-j$NIX_BUILD_CORES")
       '';
 
       # Some image types need special install targets (e.g. uImage is installed with make uinstall)
@@ -201,10 +201,10 @@ let
         mkdir -p $dev
         cp vmlinux $dev/
         if [ -z "''${dontStrip-}" ]; then
-          installFlagsArray+=("INSTALL_MOD_STRIP=1")
+          installFlags+=("INSTALL_MOD_STRIP=1")
         fi
         make modules_install $makeFlags "''${makeFlagsArray[@]}" \
-          $installFlags "''${installFlagsArray[@]}"
+          "''${installFlags[@]}"
         unlink $out/lib/modules/${modDirVersion}/build
         unlink $out/lib/modules/${modDirVersion}/source
 
@@ -273,7 +273,7 @@ let
         sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
       '' else optionalString installsFirmware ''
         make firmware_install $makeFlags "''${makeFlagsArray[@]}" \
-          $installFlags "''${installFlagsArray[@]}"
+          "''${installFlags[@]}"
       '');
 
       requiredSystemFeatures = [ "big-parallel" ];
diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index b28e16590839f..1d6596069bc43 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation {
 
   # Note: we don't add elfutils to buildInputs, since it provides a
   # bad `ld' and other stuff.
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=cpp"
     "-Wno-error=bool-compare"
     "-Wno-error=deprecated-declarations"
diff --git a/pkgs/os-specific/linux/libbpf/default.nix b/pkgs/os-specific/linux/libbpf/default.nix
index 2e497584fab87..a0b9445ce04eb 100644
--- a/pkgs/os-specific/linux/libbpf/default.nix
+++ b/pkgs/os-specific/linux/libbpf/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
       sha256 = "17mvjrs7s727drz013a8qlyj0345ldi2kph6pazcmxv6kl1qrz2z";
     })
   ];
-  patchFlags = "-p2";
+  patchFlags = [ "-p2" ];
   # https://github.com/libbpf/libbpf/pull/201#issuecomment-689174740
   postPatch = ''
     substituteInPlace ../scripts/check-reallocarray.sh \
diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index fbf7e4bd995a4..50230e5f18df1 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   # command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror]
   hardeningDisable = [ "fortify" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   makeFlags = [
     "PREFIX=$(out)"
diff --git a/pkgs/os-specific/linux/libsemanage/default.nix b/pkgs/os-specific/linux/libsemanage/default.nix
index 11a6f2755d4cd..35e7d6932cfbb 100644
--- a/pkgs/os-specific/linux/libsemanage/default.nix
+++ b/pkgs/os-specific/linux/libsemanage/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   #  1278 |  int i;
   #       |      ^
   # cc1: all warnings being treated as errors
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=clobbered" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=clobbered";
 
   installTargets = [ "install" ] ++ optionals enablePython [ "install-pywrap" ];
 
diff --git a/pkgs/os-specific/linux/libsepol/default.nix b/pkgs/os-specific/linux/libsepol/default.nix
index 12a94d6fc422d..24021eb56b0e4 100644
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     "SHLIBDIR=$(out)/lib"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   passthru = { inherit se_release se_url; };
 
diff --git a/pkgs/os-specific/linux/lttng-modules/default.nix b/pkgs/os-specific/linux/lttng-modules/default.nix
index 8e20ffda346e7..b7d97934f11ed 100644
--- a/pkgs/os-specific/linux/lttng-modules/default.nix
+++ b/pkgs/os-specific/linux/lttng-modules/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
 
   preConfigure = ''
     export KERNELDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index ae175a3632411..c82d67ae2699e 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -68,8 +68,6 @@ stdenv.mkDerivation rec {
       sha256 = "0hfadrycb60sm6hb6by4ycgaqc9sgrhh42k39v8xpmcvdzxrsq2n";
     })
   ];
-  CFLAGS = [ "-fstack-protector-strong" ]
-    ++ lib.optional stdenv.hostPlatform.isPower "-mlong-double-64";
 
   configureFlags = [
     "--enable-shared"
@@ -84,7 +82,11 @@ stdenv.mkDerivation rec {
   dontDisableStatic = true;
   separateDebugInfo = true;
 
-  NIX_DONT_SET_RPATH = true;
+  env = {
+    NIX_DONT_SET_RPATH = true;
+    CFLAGS = "-fstack-protector-strong"
+      + lib.optionalString stdenv.hostPlatform.isPower "-mlong-double-64";
+  };
 
   preBuild = ''
     ${if (stdenv.targetPlatform.libc == "musl" && stdenv.targetPlatform.isx86_32) then
diff --git a/pkgs/os-specific/linux/numactl/default.nix b/pkgs/os-specific/linux/numactl/default.nix
index 2f8a4feb03015..85a80764a03f8 100644
--- a/pkgs/os-specific/linux/numactl/default.nix
+++ b/pkgs/os-specific/linux/numactl/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     patchShebangs test
   '';
 
-  LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
+  env.LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
 
   # You probably shouldn't ever run these! They will reconfigure Linux
   # NUMA settings, which on my build machine makes the rest of package
diff --git a/pkgs/os-specific/linux/odp-dpdk/default.nix b/pkgs/os-specific/linux/odp-dpdk/default.nix
index b5610d35ddea1..5d1b6d1ddd0b3 100644
--- a/pkgs/os-specific/linux/odp-dpdk/default.nix
+++ b/pkgs/os-specific/linux/odp-dpdk/default.nix
@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
     jansson
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=address-of-packed-member" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=address-of-packed-member";
 
   # for some reason, /build/odp-dpdk-1.22.0.0_DPDK_18.11/lib/.libs ends up in all binaries,
   # while it should be $out/lib instead.
diff --git a/pkgs/os-specific/linux/open-iscsi/default.nix b/pkgs/os-specific/linux/open-iscsi/default.nix
index f510c03d99900..64519c7c2b602 100644
--- a/pkgs/os-specific/linux/open-iscsi/default.nix
+++ b/pkgs/os-specific/linux/open-iscsi/default.nix
@@ -18,8 +18,8 @@ stdenv.mkDerivation rec {
 
   DESTDIR = "$(out)";
 
-  NIX_LDFLAGS = "-lkmod -lsystemd";
-  NIX_CFLAGS_COMPILE = "-DUSE_KMOD";
+  env.NIX_LDFLAGS = "-lkmod -lsystemd";
+  env.NIX_CFLAGS_COMPILE = "-DUSE_KMOD";
 
   preConfigure = ''
     sed -i 's|/usr|/|' Makefile
diff --git a/pkgs/os-specific/linux/pktgen/default.nix b/pkgs/os-specific/linux/pktgen/default.nix
index 47ca709c44b99..2ebb694dc87cb 100644
--- a/pkgs/os-specific/linux/pktgen/default.nix
+++ b/pkgs/os-specific/linux/pktgen/default.nix
@@ -18,10 +18,10 @@ stdenv.mkDerivation rec {
     [ dpdk libbsd libpcap lua5_3 numactl which ]
     ++ lib.optionals withGtk [gtk2];
 
-  RTE_SDK = dpdk;
-  GUI = lib.optionalString withGtk "true";
+  env.RTE_SDK = toString dpdk;
+  env.GUI = lib.optionalString withGtk "true";
 
-  NIX_CFLAGS_COMPILE = "-msse3";
+  env.NIX_CFLAGS_COMPILE = "-msse3";
 
   patches = [ ./configure.patch ];
 
diff --git a/pkgs/os-specific/linux/roccat-tools/default.nix b/pkgs/os-specific/linux/roccat-tools/default.nix
index 1eba2511b9877..459a939389bea 100644
--- a/pkgs/os-specific/linux/roccat-tools/default.nix
+++ b/pkgs/os-specific/linux/roccat-tools/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     "-DLIBDIR=lib"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${harfbuzz.dev}/include/harfbuzz" ];
+  env.NIX_CFLAGS_COMPILE = "-I${harfbuzz.dev}/include/harfbuzz";
 
   meta = {
     description = "Tools to configure ROCCAT devices";
diff --git a/pkgs/os-specific/linux/rtl8814au/default.nix b/pkgs/os-specific/linux/rtl8814au/default.nix
index 2b0fb9622a4bb..5edd61f334289 100644
--- a/pkgs/os-specific/linux/rtl8814au/default.nix
+++ b/pkgs/os-specific/linux/rtl8814au/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "pic" ];
 
-  NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
+  env.NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
 
   prePatch = ''
     substituteInPlace ./Makefile \
diff --git a/pkgs/os-specific/linux/rtl8821au/default.nix b/pkgs/os-specific/linux/rtl8821au/default.nix
index 08e097b0d5f3e..bce22ff60c19a 100644
--- a/pkgs/os-specific/linux/rtl8821au/default.nix
+++ b/pkgs/os-specific/linux/rtl8821au/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" "format" ];
 
-  NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
+  env.NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
 
   prePatch = ''
     substituteInPlace ./Makefile \
diff --git a/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix b/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
index d65a601fd9e29..8a0c7938155f0 100644
--- a/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
+++ b/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
 
   # Fix build for 5.12 kernels
   patches = [
diff --git a/pkgs/os-specific/linux/sssd/default.nix b/pkgs/os-specific/linux/sssd/default.nix
index d768546b12bb6..664f04aa57790 100644
--- a/pkgs/os-specific/linux/sssd/default.nix
+++ b/pkgs/os-specific/linux/sssd/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   ];
 
   # Something is looking for <libxml/foo.h> instead of <libxml2/libxml/foo.h>
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   preConfigure = ''
     export SGML_CATALOG_FILES="${docbookFiles}"
diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix
index 23e78dd848edd..daf9babc7b639 100644
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   ] ++ optional (kernel == null) "-DBUILD_DRIVER=OFF";
 
   # needed since luajit-2.1.0-beta3
-  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg -DluaL_getn(L,i)=((int)lua_objlen(L,i))";
+  env.NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg -DluaL_getn(L,i)=((int)lua_objlen(L,i))";
 
   preConfigure = ''
     cmakeFlagsArray+=(-DCMAKE_EXE_LINKER_FLAGS="-ltbb -lcurl")
diff --git a/pkgs/os-specific/linux/sysklogd/default.nix b/pkgs/os-specific/linux/sysklogd/default.nix
index af180b5e5241f..7cafb40e5e4c0 100644
--- a/pkgs/os-specific/linux/sysklogd/default.nix
+++ b/pkgs/os-specific/linux/sysklogd/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   patches = [ ./systemd.patch ./union-wait.patch ./fix-includes-for-musl.patch ];
 
-  NIX_CFLAGS_COMPILE = "-DSYSV";
+  env.NIX_CFLAGS_COMPILE = "-DSYSV";
 
   installFlags = [ "BINDIR=$(out)/sbin" "MANDIR=$(out)/share/man" "INSTALL=install" ];
 
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index b7beeb727c4de..8218121a7bb46 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -407,7 +407,6 @@ stdenv.mkDerivation {
   ];
 
   preConfigure = ''
-    mesonFlagsArray+=(-Dntp-servers="0.nixos.pool.ntp.org 1.nixos.pool.ntp.org 2.nixos.pool.ntp.org 3.nixos.pool.ntp.org")
     export LC_ALL="en_US.UTF-8";
     # FIXME: patch this in systemd properly (and send upstream).
     # already fixed in f00929ad622c978f8ad83590a15a765b4beecac9: (u)mount
@@ -465,7 +464,7 @@ stdenv.mkDerivation {
       --replace "SYSTEMD_CGROUP_AGENT_PATH" "_SYSTEMD_CGROUP_AGENT_PATH"
   '';
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Can't say ${polkit.bin}/bin/pkttyagent here because that would
     # lead to a cyclic dependency.
     "-UPOLKIT_AGENT_BINARY_PATH"
diff --git a/pkgs/os-specific/linux/tcp-wrappers/default.nix b/pkgs/os-specific/linux/tcp-wrappers/default.nix
index 92a6b328b2ccc..6e717d2d3109b 100644
--- a/pkgs/os-specific/linux/tcp-wrappers/default.nix
+++ b/pkgs/os-specific/linux/tcp-wrappers/default.nix
@@ -19,7 +19,7 @@ in stdenv.mkDerivation rec {
 
   prePatch = ''
     tar -xaf $debian
-    patches="$(cat debian/patches/series | sed 's,^,debian/patches/,') $patches"
+    patches=($(cat debian/patches/series | sed 's,^,debian/patches/,') "''${patches[@]}")
 
     substituteInPlace Makefile --replace STRINGS STRINGDEFS
     substituteInPlace debian/patches/13_shlib_weaksym --replace STRINGS STRINGDEFS
diff --git a/pkgs/os-specific/linux/tiptop/default.nix b/pkgs/os-specific/linux/tiptop/default.nix
index c6870d2a4c447..6c9e2c72008ac 100644
--- a/pkgs/os-specific/linux/tiptop/default.nix
+++ b/pkgs/os-specific/linux/tiptop/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ flex bison ];
   buildInputs = [ libxml2 ncurses ];
 
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   meta = with lib; {
     description = "Performance monitoring tool for Linux";
diff --git a/pkgs/os-specific/linux/tmon/default.nix b/pkgs/os-specific/linux/tmon/default.nix
index 5a14d3d2ee340..f72ae3c239b83 100644
--- a/pkgs/os-specific/linux/tmon/default.nix
+++ b/pkgs/os-specific/linux/tmon/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   '';
 
   makeFlags = kernel.makeFlags ++ [ "INSTALL_ROOT=\"$(out)\"" "BINDIR=bin" ];
-  NIX_CFLAGS_LINK = "-lgcc_s";
+  env.NIX_CFLAGS_LINK = "-lgcc_s";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/usbip/default.nix b/pkgs/os-specific/linux/usbip/default.nix
index 43c22a8fd12af..09b3f0d2c1098 100644
--- a/pkgs/os-specific/linux/usbip/default.nix
+++ b/pkgs/os-specific/linux/usbip/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ autoconf automake libtool ];
   buildInputs = [ udev ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=address-of-packed-member" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=address-of-packed-member";
 
   preConfigure = ''
     cd tools/usb/usbip
diff --git a/pkgs/os-specific/linux/usermount/default.nix b/pkgs/os-specific/linux/usermount/default.nix
index d0c690a952748..6052a13273f43 100644
--- a/pkgs/os-specific/linux/usermount/default.nix
+++ b/pkgs/os-specific/linux/usermount/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dbus libnotify udisks2 gdk-pixbuf ];
 
-  NIX_CFLAGS_COMPILE = "-DENABLE_NOTIFICATIONS";
+  env.NIX_CFLAGS_COMPILE = "-DENABLE_NOTIFICATIONS";
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/os-specific/linux/virtualbox/default.nix b/pkgs/os-specific/linux/virtualbox/default.nix
index f795d36207a8c..5414f788e2324 100644
--- a/pkgs/os-specific/linux/virtualbox/default.nix
+++ b/pkgs/os-specific/linux/virtualbox/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  KERN_DIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+  env.KERN_DIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
 
   makeFlags = [ "INSTALL_MOD_PATH=$(out)" ];
   installTargets = [ "install" ];
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 2578d09fc1ecc..657e3af10dcbf 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -16,14 +16,16 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  KERNELDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+  env = {
+    KERNELDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+    INSTALL_MOD_PATH = placeholder "out";
+  };
 
   nativeBuildInputs = [ perl bc ] ++ kernel.moduleBuildDependencies;
 
   preBuild = "cd src";
   buildFlags = [ "module" ];
 
-  INSTALL_MOD_PATH = placeholder "out";
   installFlags = [ "DEPMOD=true" ];
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/xf86-input-wacom/default.nix b/pkgs/os-specific/linux/xf86-input-wacom/default.nix
index e404ac72f5c5b..e912e1e79731c 100644
--- a/pkgs/os-specific/linux/xf86-input-wacom/default.nix
+++ b/pkgs/os-specific/linux/xf86-input-wacom/default.nix
@@ -15,11 +15,14 @@ stdenv.mkDerivation rec {
 
   preConfigure = ''
     mkdir -p $out/share/X11/xorg.conf.d
-    configureFlags="--with-xorg-module-dir=$out/lib/xorg/modules
-    --with-sdkdir=$out/include/xorg --with-xorg-conf-dir=$out/share/X11/xorg.conf.d"
+    configureFlags+=(
+      "--with-xorg-module-dir=$out/lib/xorg/modules"
+      "--with-sdkdir=$out/include/xorg"
+      "--with-xorg-conf-dir=$out/share/X11/xorg.conf.d"
+    )
   '';
 
-  CFLAGS = "-I${pixman}/include/pixman-1";
+  env.CFLAGS = "-I${pixman}/include/pixman-1";
 
   meta = with lib; {
     maintainers = [ maintainers.goibhniu ];
diff --git a/pkgs/os-specific/linux/xf86-video-nested/default.nix b/pkgs/os-specific/linux/xf86-video-nested/default.nix
index 7c93fa91854b7..1680b4a5f4096 100644
--- a/pkgs/os-specific/linux/xf86-video-nested/default.nix
+++ b/pkgs/os-specific/linux/xf86-video-nested/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "fortify" ];
 
-  CFLAGS = "-I${pixman}/include/pixman-1";
+  env.CFLAGS = "-I${pixman}/include/pixman-1";
 
   meta = with lib; {
     homepage = "https://cgit.freedesktop.org/xorg/driver/xf86-video-nested";
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 6db953ae4eff4..e02d8884e4f0e 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -93,7 +93,7 @@ let
         ++ optional (buildUser && enablePython) python3;
 
       # for zdb to get the rpath to libgcc_s, needed for pthread_cancel to work
-      NIX_CFLAGS_LINK = "-lgcc_s";
+      env.NIX_CFLAGS_LINK = "-lgcc_s";
 
       hardeningDisable = [ "fortify" "stackprotector" "pic" ];
 
diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix
index 4b6982f387d08..9ce3b34e809ad 100644
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -39,10 +39,9 @@ rec {
 
     generate = name: value: pkgs.runCommandNoCC name {
       nativeBuildInputs = [ pkgs.jq ];
-      value = builtins.toJSON value;
-      passAsFile = [ "value" ];
+      inherit value;
     } ''
-      jq . "$valuePath"> $out
+      jq .value .attrs.json > $out
     '';
 
   };
@@ -120,11 +119,11 @@ rec {
     in valueType;
 
     generate = name: value: pkgs.runCommandNoCC name {
-      nativeBuildInputs = [ pkgs.remarshal ];
-      value = builtins.toJSON value;
-      passAsFile = [ "value" ];
+      nativeBuildInputs = [ pkgs.remarshal pkgs.jq ];
+      inherit value;
     } ''
-      json2toml "$valuePath" "$out"
+      jq .value .attrs.json > value.json
+      json2toml value.json "$out"
     '';
 
   };
diff --git a/pkgs/servers/amqp/qpid-cpp/default.nix b/pkgs/servers/amqp/qpid-cpp/default.nix
index 04e63d9173fbc..938f6d9652ff9 100644
--- a/pkgs/servers/amqp/qpid-cpp/default.nix
+++ b/pkgs/servers/amqp/qpid-cpp/default.nix
@@ -34,7 +34,7 @@ let
       sed -i '/management/d' CMakeLists.txt
     '';
 
-    NIX_CFLAGS_COMPILE = toString ([
+    env.NIX_CFLAGS_COMPILE = toString ([
       "-Wno-error=deprecated-declarations"
       "-Wno-error=int-in-bool-context"
       "-Wno-error=maybe-uninitialized"
diff --git a/pkgs/servers/apcupsd/default.nix b/pkgs/servers/apcupsd/default.nix
index f2193d67ff5a1..d81ecca15a952 100644
--- a/pkgs/servers/apcupsd/default.nix
+++ b/pkgs/servers/apcupsd/default.nix
@@ -16,6 +16,24 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ util-linux man ] ++ lib.optional enableCgiScripts gd;
 
+  configureFlags = [
+    "--bindir=${placeholder "out"}/bin"
+    "--sbindir=${placeholder "out"}/bin"
+    "--sysconfdir=${placeholder "out"}/etc/apcupsd"
+    "--mandir=${placeholder "out"}/share/man"
+    "--with-halpolicydir=${placeholder "out"}/share/halpolicy"
+    "--localstatedir=/var/"
+    "--with-nologin=/run"
+    "--with-log-dir=/var/log/apcupsd"
+    "--with-pwrfail-dir=/run/apcupsd"
+    "--with-lock-dir=/run/lock"
+    "--with-pid-dir=/run"
+    "--enable-usb"
+  ] ++ lib.optionals enableCgiScripts [
+    "--enable-cgi"
+    "--with-cgi-bin=${placeholder "out"}/libexec/cgi-bin"
+  ];
+
   prePatch = ''
     sed -e "s,\$(INSTALL_PROGRAM) \$(STRIP),\$(INSTALL_PROGRAM)," \
         -i ./src/apcagent/Makefile ./autoconf/targets.mak
@@ -27,21 +45,6 @@ stdenv.mkDerivation rec {
     export ac_cv_path_SHUTDOWN=${systemd}/sbin/shutdown
     export ac_cv_path_WALL=${wall}/bin/wall
     sed -i 's|/bin/cat|${coreutils}/bin/cat|' configure
-    export configureFlags="\
-        --bindir=$out/bin \
-        --sbindir=$out/bin \
-        --sysconfdir=$out/etc/apcupsd \
-        --mandir=$out/share/man \
-        --with-halpolicydir=$out/share/halpolicy \
-        --localstatedir=/var/ \
-        --with-nologin=/run \
-        --with-log-dir=/var/log/apcupsd \
-        --with-pwrfail-dir=/run/apcupsd \
-        --with-lock-dir=/run/lock \
-        --with-pid-dir=/run \
-        --enable-usb \
-        ${lib.optionalString enableCgiScripts "--enable-cgi --with-cgi-bin=$out/libexec/cgi-bin"}
-        "
   '';
 
   postInstall = ''
diff --git a/pkgs/servers/computing/torque/default.nix b/pkgs/servers/computing/torque/default.nix
index ccb57f55bb24d..9cf0b9ba0b20c 100644
--- a/pkgs/servers/computing/torque/default.nix
+++ b/pkgs/servers/computing/torque/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   # added to fix build with gcc7
-  NIX_CFLAGS_COMPILE = "-Wno-error -fpermissive";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error -fpermissive";
 
   postPatch = ''
     substituteInPlace Makefile.am \
diff --git a/pkgs/servers/dict/dictd-wordnet.nix b/pkgs/servers/dict/dictd-wordnet.nix
index 8378102dac535..e9277ca55e19d 100644
--- a/pkgs/servers/dict/dictd-wordnet.nix
+++ b/pkgs/servers/dict/dictd-wordnet.nix
@@ -4,11 +4,11 @@ stdenv.mkDerivation rec {
   version = "542";
   pname = "dict-db-wordnet";
 
+  dontUnpack = true;
+
   buildInputs = [python2 wordnet];
-  convert = ./wordnet_structures.py;
 
-  builder = writeScript "builder.sh" ''
-    . ${stdenv}/setup
+  installPhase = ''
     mkdir -p $out/share/dictd/
     cd $out/share/dictd
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
       DATA="$DATA `echo $i | sed -e s,data,index,` $i";
     done
 
-    python ${convert} $DATA
+    python ${./wordnet_structures.py} $DATA
     echo en_US.UTF-8 > locale
   '';
 
diff --git a/pkgs/servers/dict/libmaa.nix b/pkgs/servers/dict/libmaa.nix
index d55f89b9477f3..b0762990f2d50 100644
--- a/pkgs/servers/dict/libmaa.nix
+++ b/pkgs/servers/dict/libmaa.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libtool ];
   # configureFlags = [ "--datadir=/run/current-system/share/dictd" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
 
   meta = with lib; {
     description = "Dict protocol server and client";
diff --git a/pkgs/servers/dict/wiktionary/builder.sh b/pkgs/servers/dict/wiktionary/builder.sh
index 65652ad4bdbfd..af1b84b7f52be 100644
--- a/pkgs/servers/dict/wiktionary/builder.sh
+++ b/pkgs/servers/dict/wiktionary/builder.sh
@@ -1,3 +1,5 @@
+source .attrs.sh
+
 source $stdenv/setup
 
 mkdir -p $out/share/dictd/
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index 11adceb0f74d4..e3ca06040e3ba 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  CFLAGS = [ "-O2" "-DNDEBUG" ];
+  env.CFLAGS = "-O2 -DNDEBUG";
 
   doCheck = true;
   doInstallCheck = true;
diff --git a/pkgs/servers/fcgiwrap/default.nix b/pkgs/servers/fcgiwrap/default.nix
index 3e0a4e5d99406..ff31ea1353622 100644
--- a/pkgs/servers/fcgiwrap/default.nix
+++ b/pkgs/servers/fcgiwrap/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "07y6s4mm86cv7p1ljz94sxnqa89y9amn3vzwsnbq5hrl4vdy0zac";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-fallthrough";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-fallthrough";
   configureFlags = [ "--with-systemd" "--with-systemdsystemunitdir=$(out)/etc/systemd/system" ];
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/servers/fingerd/bsd-fingerd/default.nix b/pkgs/servers/fingerd/bsd-fingerd/default.nix
index d03cd1c915ab4..9ffb8f7faac67 100644
--- a/pkgs/servers/fingerd/bsd-fingerd/default.nix
+++ b/pkgs/servers/fingerd/bsd-fingerd/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "1yhkiv0in588il7f84k2xiy78g9lv12ll0y7047gazhiimk5v244";
   };
 
-  NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
+  env.NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
 
   patches = [ ./ubuntu-0.17-9.patch ];
 
diff --git a/pkgs/servers/ftp/vsftpd/default.nix b/pkgs/servers/ftp/vsftpd/default.nix
index b87d11809b11a..8cbfda0a594af 100644
--- a/pkgs/servers/ftp/vsftpd/default.nix
+++ b/pkgs/servers/ftp/vsftpd/default.nix
@@ -23,11 +23,11 @@ stdenv.mkDerivation rec {
     mkdir -p $out/sbin $out/man/man{5,8}
   '';
 
-  NIX_LDFLAGS = "-lcrypt -lssl -lcrypto -lpam -lcap";
+  env.NIX_LDFLAGS = "-lcrypt -lssl -lcrypto -lpam -lcap";
 
   # On gcc9, this would produce
   #   error: '-Werror=enum-conversion': no option -Wenum-conversion
-  NIX_CFLAGS_COMPILE = lib.optionalString (lib.versionAtLeast stdenv.cc.version "10")
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (lib.versionAtLeast stdenv.cc.version "10")
     "-Wno-error=enum-conversion";
 
   enableParallelBuilding = true;
diff --git a/pkgs/servers/gemini/agate/default.nix b/pkgs/servers/gemini/agate/default.nix
index 9530877216524..9f46567942676 100644
--- a/pkgs/servers/gemini/agate/default.nix
+++ b/pkgs/servers/gemini/agate/default.nix
@@ -18,8 +18,8 @@ rustPlatform.buildRustPackage rec {
   checkFlags = [
     # Username and Password use the same ports and causes collision
     # https://github.com/mbrubeck/agate/issues/50
-    "--skip username"
-    "--skip password"
+    "--skip" "username"
+    "--skip" "password"
   ];
 
   doInstallCheck = true;
diff --git a/pkgs/servers/gpsd/default.nix b/pkgs/servers/gpsd/default.nix
index 62b711af67a09..f11058d31d116 100644
--- a/pkgs/servers/gpsd/default.nix
+++ b/pkgs/servers/gpsd/default.nix
@@ -52,9 +52,6 @@ stdenv.mkDerivation rec {
     patchShebangs .
     sed -e "s|systemd_dir = .*|systemd_dir = '$out/lib/systemd/system'|" -i SConscript
     export TAR=noop
-
-    sconsFlags+=" udevdir=$out/lib/udev"
-    sconsFlags+=" python_libdir=$out/lib/${python3Packages.python.libPrefix}/site-packages"
   '';
 
   sconsFlags = [
@@ -62,6 +59,8 @@ stdenv.mkDerivation rec {
     "gpsd_user=${gpsdUser}"
     "gpsd_group=${gpsdGroup}"
     "systemd=yes"
+    "udevdir=${placeholder "out"}/lib/udev"
+    "python_libdir=${placeholder "out"}/lib/${python3Packages.python.libPrefix}/site-packages"
     "xgps=${if guiSupport then "True" else "False"}"
   ];
 
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index 3fff2ac9fceb6..788ada55a19a8 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   '';
 
   # Required for ‘pthread_cancel’.
-  NIX_LDFLAGS = lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
+  env.NIX_LDFLAGS = lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
 
   configureFlags = [
     "--with-apr=${apr.dev}"
diff --git a/pkgs/servers/http/jboss/jdbc/mysql/builder.sh b/pkgs/servers/http/jboss/jdbc/mysql/builder.sh
deleted file mode 100644
index 6af39a0cb6338..0000000000000
--- a/pkgs/servers/http/jboss/jdbc/mysql/builder.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-buildInputs="$mysql_jdbc"
-source $stdenv/setup
-
-mkdir -p $out/server/default/lib
-ln -s $mysql_jdbc/share/java/mysql-connector-java.jar $out/server/default/lib/mysql-connector-java.jar
diff --git a/pkgs/servers/http/jboss/jdbc/mysql/default.nix b/pkgs/servers/http/jboss/jdbc/mysql/default.nix
index e05bf4bfce8cc..991a31e90f795 100644
--- a/pkgs/servers/http/jboss/jdbc/mysql/default.nix
+++ b/pkgs/servers/http/jboss/jdbc/mysql/default.nix
@@ -3,9 +3,14 @@
 stdenv.mkDerivation {
   name = "jboss-mysql-jdbc";
 
-  builder = ./builder.sh;
+  buildInputs = [ mysql_jdbc ];
 
-  inherit mysql_jdbc;
+  dontUnpack = true;
+
+  installPhase = ''
+    mkdir -p $out/server/default/lib
+    ln -s ${mysql_jdbc}/share/java/mysql-connector-java.jar $out/server/default/lib/mysql-connector-java.jar
+  '';
 
   meta = {
     platforms = lib.platforms.unix;
diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index e13c0b4e92234..39c2c39d567eb 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -99,7 +99,7 @@ stdenv.mkDerivation {
     ++ configureFlags
     ++ map (mod: "--add-module=${mod.src}") modules;
 
-  NIX_CFLAGS_COMPILE = toString ([
+  env.NIX_CFLAGS_COMPILE = toString ([
     "-I${libxml2.dev}/include/libxml2"
     "-Wno-error=implicit-fallthrough"
   ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations");
diff --git a/pkgs/servers/http/tengine/default.nix b/pkgs/servers/http/tengine/default.nix
index d7c8ea226febf..e0ffbe309488e 100644
--- a/pkgs/servers/http/tengine/default.nix
+++ b/pkgs/servers/http/tengine/default.nix
@@ -98,7 +98,7 @@ stdenv.mkDerivation rec {
     ++ optional (with stdenv.hostPlatform; isLinux || isFreeBSD) "--with-file-aio"
     ++ map (mod: "--add-module=${mod.src}") modules;
 
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2 -Wno-error=implicit-fallthrough"
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2 -Wno-error=implicit-fallthrough"
     + optionalString stdenv.isDarwin " -Wno-error=deprecated-declarations";
 
   preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules);
diff --git a/pkgs/servers/http/tomcat/axis2/builder.sh b/pkgs/servers/http/tomcat/axis2/builder.sh
deleted file mode 100644
index 2e36367e9dcf5..0000000000000
--- a/pkgs/servers/http/tomcat/axis2/builder.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-source $stdenv/setup
-
-unzip $src
-cd axis2-*
-mkdir -p $out
-cp -av * $out
-cd webapp
-ant
-cd ..
-mkdir -p $out/webapps
-cp dist/axis2.war $out/webapps
-cd $out/webapps
-mkdir axis2
-cd axis2
-unzip ../axis2.war
diff --git a/pkgs/servers/http/tomcat/axis2/default.nix b/pkgs/servers/http/tomcat/axis2/default.nix
index ab05d8cbb0eda..3323321e0deb5 100644
--- a/pkgs/servers/http/tomcat/axis2/default.nix
+++ b/pkgs/servers/http/tomcat/axis2/default.nix
@@ -11,7 +11,20 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ unzip ];
   buildInputs = [ apacheAnt jdk ];
-  builder = ./builder.sh;
+
+  installPhase = ''
+    mkdir -p $out
+    cp -av * $out
+    cd webapp
+    ant
+    cd ..
+    mkdir -p $out/webapps
+    cp dist/axis2.war $out/webapps
+    cd $out/webapps
+    mkdir axis2
+    cd axis2
+    unzip ../axis2.war
+  '';
 
   meta = {
     description = "Web Services / SOAP / WSDL engine, the successor to the widely used Apache Axis SOAP stack";
diff --git a/pkgs/servers/mail/archiveopteryx/default.nix b/pkgs/servers/mail/archiveopteryx/default.nix
index 4cc612ef89a1d..4d8a51e592fcf 100644
--- a/pkgs/servers/mail/archiveopteryx/default.nix
+++ b/pkgs/servers/mail/archiveopteryx/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   '';
 
   # fix build on gcc7+
-  NIX_CFLAGS_COMPILE = builtins.toString [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=builtin-declaration-mismatch"
     "-Wno-error=implicit-fallthrough"
     "-Wno-error=deprecated-copy"
diff --git a/pkgs/servers/mail/opensmtpd/extras.nix b/pkgs/servers/mail/opensmtpd/extras.nix
index 65ff08b453963..d0ddc1a468f7e 100644
--- a/pkgs/servers/mail/opensmtpd/extras.nix
+++ b/pkgs/servers/mail/opensmtpd/extras.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
     "--with-table-redis"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString enableRedis
+  env.NIX_CFLAGS_COMPILE = lib.optionalString enableRedis
       "-I${hiredis}/include/hiredis -lhiredis"
     + lib.optionalString enableMysql
       " -L${libmysqlclient}/lib/mysql";
diff --git a/pkgs/servers/mail/postfix/default.nix b/pkgs/servers/mail/postfix/default.nix
index ad704ca792b72..4f8d26b499e23 100644
--- a/pkgs/servers/mail/postfix/default.nix
+++ b/pkgs/servers/mail/postfix/default.nix
@@ -79,7 +79,7 @@ in stdenv.mkDerivation rec {
     make makefiles CCARGS='${ccargs}' AUXLIBS='${auxlibs}'
   '';
 
-  NIX_LDFLAGS = lib.optionalString withLDAP "-llber";
+  env.NIX_LDFLAGS = lib.optionalString withLDAP "-llber";
 
   installTargets = [ "non-interactive-package" ];
 
diff --git a/pkgs/servers/mail/postfix/pfixtools.nix b/pkgs/servers/mail/postfix/pfixtools.nix
index df04ade5b452d..d57aaa4ef29d0 100644
--- a/pkgs/servers/mail/postfix/pfixtools.nix
+++ b/pkgs/servers/mail/postfix/pfixtools.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation {
                       --replace /bin/bash ${bash}/bin/bash;
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=nonnull-compare -Wno-error=format-truncation";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=nonnull-compare -Wno-error=format-truncation";
 
   makeFlags = [ "DESTDIR=$(out)" "prefix=" ];
 
diff --git a/pkgs/servers/matrix-synapse/matrix-appservice-irc/node-composition.nix b/pkgs/servers/matrix-synapse/matrix-appservice-irc/node-composition.nix
index e0d21f7d44d36..e56cb9176e92b 100644
--- a/pkgs/servers/matrix-synapse/matrix-appservice-irc/node-composition.nix
+++ b/pkgs/servers/matrix-synapse/matrix-appservice-irc/node-composition.nix
@@ -6,7 +6,7 @@
 
 let
   nodeEnv = import ../../../development/node-packages/node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile;
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile jq;
     inherit pkgs nodejs;
     libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
   };
diff --git a/pkgs/servers/matrix-synapse/matrix-appservice-slack/node-composition.nix b/pkgs/servers/matrix-synapse/matrix-appservice-slack/node-composition.nix
index e0d21f7d44d36..e56cb9176e92b 100644
--- a/pkgs/servers/matrix-synapse/matrix-appservice-slack/node-composition.nix
+++ b/pkgs/servers/matrix-synapse/matrix-appservice-slack/node-composition.nix
@@ -6,7 +6,7 @@
 
 let
   nodeEnv = import ../../../development/node-packages/node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile;
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile jq;
     inherit pkgs nodejs;
     libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
   };
diff --git a/pkgs/servers/memcached/default.nix b/pkgs/servers/memcached/default.nix
index f684883b8f554..338fe8ee41fa5 100644
--- a/pkgs/servers/memcached/default.nix
+++ b/pkgs/servers/memcached/default.nix
@@ -17,8 +17,8 @@ stdenv.mkDerivation rec {
 
   hardeningEnable = [ "pie" ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ]
-    ++ lib.optional stdenv.isDarwin "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations"
+    + lib.optionalString stdenv.isDarwin " -Wno-error";
 
   meta = with lib; {
     description = "A distributed memory object caching system";
diff --git a/pkgs/servers/misc/oven-media-engine/default.nix b/pkgs/servers/misc/oven-media-engine/default.nix
index 6a63292301b50..c2c35f013aa24 100644
--- a/pkgs/servers/misc/oven-media-engine/default.nix
+++ b/pkgs/servers/misc/oven-media-engine/default.nix
@@ -48,7 +48,10 @@ stdenv.mkDerivation rec {
   ];
 
   sourceRoot = "source/src";
-  makeFlags = "release CONFIG_LIBRARY_PATHS= CONFIG_PKG_PATHS= GLOBAL_CC=$(CC) GLOBAL_CXX=$(CXX) GLOBAL_LD=$(CXX) SHELL=${stdenv.shell}";
+  makeFlags = [
+    "release" "CONFIG_LIBRARY_PATHS=" "CONFIG_PKG_PATHS=" "GLOBAL_CC=$(CC)"
+    "GLOBAL_CXX=$(CXX)" "GLOBAL_LD=$(CXX)" "SHELL=${stdenv.shell}"
+  ];
   enableParallelBuilding = true;
 
   nativeBuildInputs = [ bc pkg-config perl ];
diff --git a/pkgs/servers/monitoring/grafana-agent/default.nix b/pkgs/servers/monitoring/grafana-agent/default.nix
index 1f08dc3344a50..59fe99a110968 100644
--- a/pkgs/servers/monitoring/grafana-agent/default.nix
+++ b/pkgs/servers/monitoring/grafana-agent/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   # uses go-systemd, which uses libsystemd headers
   # https://github.com/coreos/go-systemd/issues/351
-  NIX_CFLAGS_COMPILE = [ "-I${lib.getDev systemd}/include" ];
+  env.NIX_CFLAGS_COMPILE = "-I${lib.getDev systemd}/include";
 
   # tries to access /sys: https://github.com/grafana/agent/issues/333
   preBuild = ''
diff --git a/pkgs/servers/monitoring/nagios/default.nix b/pkgs/servers/monitoring/nagios/default.nix
index a58ec2bf7b299..3eb707447b9a3 100644
--- a/pkgs/servers/monitoring/nagios/default.nix
+++ b/pkgs/servers/monitoring/nagios/default.nix
@@ -15,13 +15,13 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--localstatedir=/var/lib/nagios" ];
   buildFlags = [ "all" ];
-  CFLAGS = "-ldl";
+  env.CFLAGS = "-ldl";
 
   # Do not create /var directories
   preInstall = ''
     substituteInPlace Makefile --replace '$(MAKE) install-basic' ""
   '';
-  installTargets = "install install-config";
+  installTargets = [ "install" "install-config" ];
   postInstall = ''
     # don't make default files use hardcoded paths to commands
     sed -i 's@command_line *[^ ]*/\([^/]*\) @command_line \1 @'  $out/etc/objects/commands.cfg
diff --git a/pkgs/servers/monitoring/prometheus/default.nix b/pkgs/servers/monitoring/prometheus/default.nix
index b87817af439c3..cdaf45c8ba1e0 100644
--- a/pkgs/servers/monitoring/prometheus/default.nix
+++ b/pkgs/servers/monitoring/prometheus/default.nix
@@ -40,10 +40,10 @@ in buildGoModule rec {
     ln -s ${webui} web/ui/static/react
   '';
 
-  buildFlags = "-tags=builtinassets";
-  buildFlagsArray = let
+  buildFlags = let 
     t = "${goPackagePath}/vendor/github.com/prometheus/common/version";
   in [
+    "-tags=builtinassets" 
     ''
       -ldflags=
          -X ${t}.Version=${version}
diff --git a/pkgs/servers/monitoring/zabbix/agent2.nix b/pkgs/servers/monitoring/zabbix/agent2.nix
index 1deada4363740..ef8f8c7491ddb 100644
--- a/pkgs/servers/monitoring/zabbix/agent2.nix
+++ b/pkgs/servers/monitoring/zabbix/agent2.nix
@@ -17,8 +17,6 @@ import ./versions.nix ({ version, sha256 }:
     nativeBuildInputs = [ autoreconfHook pkg-config ];
     buildInputs = [ libiconv openssl pcre zlib ];
 
-    inherit (buildGoModule.go) GOOS GOARCH;
-
     # need to provide GO* env variables & patch for reproducibility
     postPatch = ''
       substituteInPlace src/go/Makefile.am \
diff --git a/pkgs/servers/nosql/aerospike/default.nix b/pkgs/servers/nosql/aerospike/default.nix
index 33347a73a20ce..a14dc747d0261 100644
--- a/pkgs/servers/nosql/aerospike/default.nix
+++ b/pkgs/servers/nosql/aerospike/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoconf automake libtool ];
   buildInputs = [ openssl zlib ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=format-truncation"
     "-Wno-error=address-of-packed-member"
     "-Wno-error=format-overflow"
diff --git a/pkgs/servers/nosql/arangodb/default.nix b/pkgs/servers/nosql/arangodb/default.nix
index bf7f7b4396096..ac33bd42ec96b 100644
--- a/pkgs/servers/nosql/arangodb/default.nix
+++ b/pkgs/servers/nosql/arangodb/default.nix
@@ -17,7 +17,6 @@ let
 
     # prevent failing with "cmake-3.13.4/nix-support/setup-hook: line 10: ./3rdParty/rocksdb/RocksDBConfig.cmake.in: No such file or directory"
     dontFixCmake       =                     lib.versionAtLeast version "3.5";
-    NIX_CFLAGS_COMPILE = lib.optionalString (lib.versionAtLeast version "3.5") "-Wno-error";
     preConfigure       = lib.optionalString (lib.versionAtLeast version "3.5") "patchShebangs utils";
 
     postPatch = ''
@@ -36,6 +35,8 @@ let
       "-DASM_OPTIMIZATIONS=${if stdenv.hostPlatform.sse4_2Support then "ON" else "OFF"}"
     ];
 
+    env.NIX_CFLAGS_COMPILE = lib.optionalString (lib.versionAtLeast version "3.5") "-Wno-error";
+
     meta = with lib; {
       homepage = "https://www.arangodb.com";
       description = "A native multi-model database with flexible data models for documents, graphs, and key-values";
diff --git a/pkgs/servers/nosql/mongodb/mongodb.nix b/pkgs/servers/nosql/mongodb/mongodb.nix
index 8a66528d81cd3..d37069503a0f1 100644
--- a/pkgs/servers/nosql/mongodb/mongodb.nix
+++ b/pkgs/servers/nosql/mongodb/mongodb.nix
@@ -84,7 +84,7 @@ in stdenv.mkDerivation rec {
       --replace 'engine("wiredTiger")' 'engine("mmapv1")'
   '';
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
     "-Wno-unused-command-line-argument";
 
   sconsFlags = [
@@ -99,10 +99,9 @@ in stdenv.mkDerivation rec {
   ] ++ map (lib: "--use-system-${lib}") system-libraries;
 
   preBuild = ''
-    sconsFlags+=" CC=$CC"
-    sconsFlags+=" CXX=$CXX"
+    sconsFlags+=("CC=$CC" "CXX=$CXX")
   '' + optionalString stdenv.isAarch64 ''
-    sconsFlags+=" CCFLAGS='-march=armv8-a+crc'"
+    sconsFlags+=("CCFLAGS='-march=armv8-a+crc'")
   '';
 
   preInstall = ''
diff --git a/pkgs/servers/nosql/redis/default.nix b/pkgs/servers/nosql/redis/default.nix
index 48dcbb8f81382..c033f06255745 100644
--- a/pkgs/servers/nosql/redis/default.nix
+++ b/pkgs/servers/nosql/redis/default.nix
@@ -32,12 +32,12 @@ stdenv.mkDerivation rec {
   # It's weird that the build isn't failing because of failure to compile dependencies, it's from failure to link them!
   makeFlags = [ "PREFIX=$(out)" ]
     ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [ "AR=${stdenv.cc.targetPrefix}ar" "RANLIB=${stdenv.cc.targetPrefix}ranlib" "MALLOC=libc" ]
-    ++ lib.optional withSystemd [ "USE_SYSTEMD=yes" ]
+    ++ lib.optionals withSystemd [ "USE_SYSTEMD=yes" ]
     ++ lib.optionals tlsSupport [ "BUILD_TLS=yes" ];
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isClang [ "-std=c11" ];
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-std=c11";
 
   doCheck = false; # needs tcl
 
diff --git a/pkgs/servers/prayer/default.nix b/pkgs/servers/prayer/default.nix
index fe3cabcf9d7b7..096374ab51d08 100644
--- a/pkgs/servers/prayer/default.nix
+++ b/pkgs/servers/prayer/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ openssl db zlib uwimap html-tidy pam ];
   nativeBuildInputs = [ perl ];
 
-  NIX_LDFLAGS = "-lpam";
+  env.NIX_LDFLAGS = "-lpam";
 
   meta = {
     homepage = "http://www-uxsup.csx.cam.ac.uk/~dpc22/prayer/";
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index bebe4801c65e7..204f90cd9d891 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -103,7 +103,7 @@ stdenv.mkDerivation rec {
   # the alternative is to copy the files from /usr/include to src, but there are
   # probably a large number of files that would need to be copied (I stopped
   # after the seventh)
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I/usr/include";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I/usr/include";
 
   installFlags =
     [ "sysconfdir=${placeholder "out"}/etc"
diff --git a/pkgs/servers/pulseaudio/pali.nix b/pkgs/servers/pulseaudio/pali.nix
index cc11f98a82903..29c9db1ffe26c 100644
--- a/pkgs/servers/pulseaudio/pali.nix
+++ b/pkgs/servers/pulseaudio/pali.nix
@@ -180,9 +180,9 @@ stdenv.mkDerivation rec {
   # the alternative is to copy the files from /usr/include to src, but there are
   # probably a large number of files that would need to be copied (I stopped
   # after the seventh)
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I/usr/include";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I/usr/include";
 
-  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework CoreServices -framework Cocoa -framework AudioUnit";
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework CoreServices -framework Cocoa -framework AudioUnit";
 
   postInstall = ''
     moveToOutput lib/cmake "$dev"
diff --git a/pkgs/servers/search/sphinxsearch/default.nix b/pkgs/servers/search/sphinxsearch/default.nix
index a44f96db7026a..a5bd53d37cc93 100644
--- a/pkgs/servers/search/sphinxsearch/default.nix
+++ b/pkgs/servers/search/sphinxsearch/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     expat
   ];
 
-  CXXFLAGS = with lib; concatStringsSep " " (optionals stdenv.isDarwin [
+  env.CXXFLAGS = with lib; concatStringsSep " " (optionals stdenv.isDarwin [
     # see upstream bug: http://sphinxsearch.com/bugs/view.php?id=2578
     # workaround for "error: invalid suffix on literal
     "-Wno-reserved-user-defined-literal"
diff --git a/pkgs/servers/shishi/default.nix b/pkgs/servers/shishi/default.nix
index 6737119d88120..46acae00c1b2c 100644
--- a/pkgs/servers/shishi/default.nix
+++ b/pkgs/servers/shishi/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     (mkEnable true                "arcfour"       null)
   ];
 
-  NIX_CFLAGS_COMPILE
+  env.NIX_CFLAGS_COMPILE
     = optionalString stdenv.isDarwin "-DBIND_8_COMPAT";
 
   doCheck = true;
diff --git a/pkgs/servers/sip/freeswitch/default.nix b/pkgs/servers/sip/freeswitch/default.nix
index d7611baad14e4..c3db377856fcf 100644
--- a/pkgs/servers/sip/freeswitch/default.nix
+++ b/pkgs/servers/sip/freeswitch/default.nix
@@ -129,7 +129,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/servers/sql/cockroachdb/default.nix b/pkgs/servers/sql/cockroachdb/default.nix
index 63cbbf16b3026..988ed07731071 100644
--- a/pkgs/servers/sql/cockroachdb/default.nix
+++ b/pkgs/servers/sql/cockroachdb/default.nix
@@ -24,7 +24,7 @@ buildGoPackage rec {
     sha256 = "0mm3hfr778c7djza8gr1clwa8wca4d3ldh9hlg80avw4x664y5zi";
   };
 
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [ "-Wno-error=deprecated-copy" "-Wno-error=redundant-move" "-Wno-error=pessimizing-move" ];
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=deprecated-copy -Wno-error=redundant-move -Wno-error=pessimizing-move";
 
   inherit nativeBuildInputs buildInputs;
 
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index db588b3abe01f..43907cd27c47b 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -40,7 +40,7 @@ common = rec { # attributes common to both builds
     ncurses openssl zlib pcre2 libiconv curl
   ] ++ optionals stdenv.hostPlatform.isLinux [ libaio systemd libkrb5 ]
     ++ optionals stdenv.hostPlatform.isDarwin [ perl cctools CoreServices ]
-    ++ optional (!stdenv.hostPlatform.isDarwin) [ jemalloc ];
+    ++ optional (!stdenv.hostPlatform.isDarwin) jemalloc;
 
   prePatch = ''
     sed -i 's,[^"]*/var/log,/var/log,g' storage/mroonga/vendor/groonga/CMakeLists.txt
@@ -173,17 +173,17 @@ server = stdenv.mkDerivation (common // {
     "-DWITHOUT_EXAMPLE=1"
     "-DWITHOUT_FEDERATED=1"
     "-DWITHOUT_TOKUDB=1"
-  ] ++ optional (stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32) [
+  ] ++ optional (stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32)
     "-DWITH_NUMA=ON"
-  ] ++ optional (!withStorageMroonga) [
+    ++ optional (!withStorageMroonga)
     "-DWITHOUT_MROONGA=1"
-  ] ++ optional (!withStorageRocks) [
+    ++ optional (!withStorageRocks)
     "-DWITHOUT_ROCKSDB=1"
-  ] ++ optional (!stdenv.hostPlatform.isDarwin && withStorageRocks) [
+    ++ optional (!stdenv.hostPlatform.isDarwin && withStorageRocks)
     "-DWITH_ROCKSDB_JEMALLOC=ON"
-  ] ++ optional (!stdenv.hostPlatform.isDarwin) [
+    ++ optional (!stdenv.hostPlatform.isDarwin)
     "-DWITH_JEMALLOC=yes"
-  ] ++ optionals stdenv.hostPlatform.isDarwin [
+    ++ optionals stdenv.hostPlatform.isDarwin [
     "-DPLUGIN_AUTH_PAM=OFF"
     "-DWITHOUT_OQGRAPH=1"
     "-DWITHOUT_PLUGIN_S3=1"
@@ -210,6 +210,6 @@ server = stdenv.mkDerivation (common // {
     wrapProgram $out/bin/mytop --set PATH ${makeBinPath [ less ncurses ]}
   '';
 
-  CXXFLAGS = optionalString stdenv.hostPlatform.isi686 "-fpermissive";
+  env.CXXFLAGS = optionalString stdenv.hostPlatform.isi686 "-fpermissive";
 });
 in mariadb
diff --git a/pkgs/servers/sql/mysql/5.7.x.nix b/pkgs/servers/sql/mysql/5.7.x.nix
index 36e26d38fc483..0b9f6b955107e 100644
--- a/pkgs/servers/sql/mysql/5.7.x.nix
+++ b/pkgs/servers/sql/mysql/5.7.x.nix
@@ -58,9 +58,11 @@ self = stdenv.mkDerivation rec {
     "-DINSTALL_DOCDIR=share/mysql/docs"
     "-DINSTALL_SHAREDIR=share/mysql"
   ];
-
-  CXXFLAGS = "-fpermissive -std=c++11";
-  NIX_LDFLAGS = lib.optionalString stdenv.isLinux "-lgcc_s";
+  
+  env = {
+    CXXFLAGS = "-fpermissive -std=c++11";
+    NIX_LDFLAGS = lib.optionalString stdenv.isLinux "-lgcc_s";
+  };
 
   prePatch = ''
     sed -i -e "s|/usr/bin/libtool|libtool|" cmake/merge_archives.cmake.in
diff --git a/pkgs/servers/sql/mysql/jdbc/builder.sh b/pkgs/servers/sql/mysql/jdbc/builder.sh
deleted file mode 100644
index 56336e041356f..0000000000000
--- a/pkgs/servers/sql/mysql/jdbc/builder.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-source $stdenv/setup
-
-set -e
-
-unzip $src
-cd mysql-connector-java-*
-
-mkdir -p $out/share/java
-cp mysql-connector-java-*-bin.jar $out/share/java/mysql-connector-java.jar
diff --git a/pkgs/servers/sql/mysql/jdbc/default.nix b/pkgs/servers/sql/mysql/jdbc/default.nix
index 6b22185cd8003..67ceabd9788b1 100644
--- a/pkgs/servers/sql/mysql/jdbc/default.nix
+++ b/pkgs/servers/sql/mysql/jdbc/default.nix
@@ -2,7 +2,6 @@
 
 stdenv.mkDerivation rec {
   name = "mysql-connector-java-5.1.46";
-  builder = ./builder.sh;
 
   src = fetchurl {
     url = "http://dev.mysql.com/get/Downloads/Connector-J/${name}.zip";
@@ -12,6 +11,16 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ unzip ];
   buildInputs = [ ant ];
 
+  unpackPhase = ''
+    unzip $src
+    cd mysql-connector-java-*
+  '';
+
+  installPhase = ''
+    mkdir -p $out/share/java
+    cp mysql-connector-java-*-bin.jar $out/share/java/mysql-connector-java.jar
+  '';
+
   meta = {
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/servers/sql/percona/5.6.x.nix b/pkgs/servers/sql/percona/5.6.x.nix
index 905a8424e8efe..f7e7f82f9a0c0 100644
--- a/pkgs/servers/sql/percona/5.6.x.nix
+++ b/pkgs/servers/sql/percona/5.6.x.nix
@@ -37,8 +37,8 @@ stdenv.mkDerivation rec {
     "-DINSTALL_SHAREDIR=share/mysql"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=address-of-packed-member" ];
-  NIX_LDFLAGS = "-lgcc_s";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=address-of-packed-member";
+  env.NIX_LDFLAGS = "-lgcc_s";
 
   prePatch = ''
     sed -i -e "s|/usr/bin/libtool|libtool|" cmake/libutils.cmake
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 63446a684b256..f8b67dd294f84 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -51,7 +51,7 @@ let
 
     buildFlags = [ "world" ];
 
-    NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+    env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
     # Otherwise it retains a reference to compiler and fails; see #44767.  TODO: better.
     preConfigure = "CC=${stdenv.cc.targetPrefix}cc";
diff --git a/pkgs/servers/sql/postgresql/ext/postgis.nix b/pkgs/servers/sql/postgresql/ext/postgis.nix
index f3f7a4a69114a..950b9bb0aa090 100644
--- a/pkgs/servers/sql/postgresql/ext/postgis.nix
+++ b/pkgs/servers/sql/postgresql/ext/postgis.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   dontDisableStatic = true;
 
   # postgis config directory assumes /include /lib from the same root for json-c library
-  NIX_LDFLAGS = "-L${lib.getLib json_c}/lib";
+  env.NIX_LDFLAGS = "-L${lib.getLib json_c}/lib";
 
   preConfigure = ''
     sed -i 's@/usr/bin/file@${file}/bin/file@' configure
diff --git a/pkgs/servers/sql/sqlite/jdbc/default.nix b/pkgs/servers/sql/sqlite/jdbc/default.nix
index 01a9d5fa2e234..36fba217e005a 100644
--- a/pkgs/servers/sql/sqlite/jdbc/default.nix
+++ b/pkgs/servers/sql/sqlite/jdbc/default.nix
@@ -11,8 +11,6 @@ stdenv.mkDerivation rec {
     sha256 = "1xk5fi2wzq3jspvbdm5hvs78501i14jy3v7x6fjnh5fnpqdacpd4";
   };
 
-  phases = [ "installPhase" ];
-
   installPhase = ''
     install -m444 -D ${src}/share/java/*${pname}-${version}.jar "$out/share/java/${pname}-${version}.jar"
   '';
diff --git a/pkgs/servers/tvheadend/default.nix b/pkgs/servers/tvheadend/default.nix
index 98a40766d7e74..9e44f7b22eaae 100644
--- a/pkgs/servers/tvheadend/default.nix
+++ b/pkgs/servers/tvheadend/default.nix
@@ -35,7 +35,7 @@ in stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake makeWrapper pkg-config ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=format-truncation" "-Wno-error=stringop-truncation" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation -Wno-error=stringop-truncation";
 
   # disable dvbscan, as having it enabled causes a network download which
   # cannot happen during build.  We now include the dtv-scan-tables ourselves
diff --git a/pkgs/servers/varnish/default.nix b/pkgs/servers/varnish/default.nix
index 1fbb36257d268..38c26546a7a6c 100644
--- a/pkgs/servers/varnish/default.nix
+++ b/pkgs/servers/varnish/default.nix
@@ -26,7 +26,7 @@ let
       '';
 
       # https://github.com/varnishcache/varnish-cache/issues/1875
-      NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-fexcess-precision=standard";
+      env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-fexcess-precision=standard";
 
       outputs = [ "out" "dev" "man" ];
 
diff --git a/pkgs/servers/varnish/digest.nix b/pkgs/servers/varnish/digest.nix
index 55d13ffae31f9..cd980e9b8bb4a 100644
--- a/pkgs/servers/varnish/digest.nix
+++ b/pkgs/servers/varnish/digest.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "VMOD_DIR=$(out)/lib/varnish/vmods" ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ];
+  env.NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ];
 
   doCheck = true;
 
diff --git a/pkgs/servers/web-apps/cryptpad/node-packages.nix b/pkgs/servers/web-apps/cryptpad/node-packages.nix
index 76d5cf6a202f1..2720ef776a5b9 100644
--- a/pkgs/servers/web-apps/cryptpad/node-packages.nix
+++ b/pkgs/servers/web-apps/cryptpad/node-packages.nix
@@ -6,7 +6,7 @@
 
 let
   nodeEnv = import ../../../development/node-packages/node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile;
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile jq;
     inherit pkgs nodejs;
     libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
   };
diff --git a/pkgs/servers/web-apps/fileshelter/default.nix b/pkgs/servers/web-apps/fileshelter/default.nix
index b6abc423eb858..f48a1fdac8c6c 100644
--- a/pkgs/servers/web-apps/fileshelter/default.nix
+++ b/pkgs/servers/web-apps/fileshelter/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ libzip boost wt4 libconfig ];
 
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   postInstall = ''
     ln -s ${wt4}/share/Wt/resources $out/share/fileshelter/docroot/resources
diff --git a/pkgs/servers/web-apps/whitebophir/node-packages.nix b/pkgs/servers/web-apps/whitebophir/node-packages.nix
index 76d5cf6a202f1..2720ef776a5b9 100644
--- a/pkgs/servers/web-apps/whitebophir/node-packages.nix
+++ b/pkgs/servers/web-apps/whitebophir/node-packages.nix
@@ -6,7 +6,7 @@
 
 let
   nodeEnv = import ../../../development/node-packages/node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile;
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile jq;
     inherit pkgs nodejs;
     libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
   };
diff --git a/pkgs/servers/x11/xorg/builder.sh b/pkgs/servers/x11/xorg/builder.sh
index 5a832cb14d539..98e4685d4bd46 100644
--- a/pkgs/servers/x11/xorg/builder.sh
+++ b/pkgs/servers/x11/xorg/builder.sh
@@ -1,4 +1,5 @@
 # This is the builder for all X.org components.
+source .attrs.sh
 source $stdenv/setup
 
 
@@ -27,7 +28,7 @@ postInstall() {
 }
 
 
-installFlags="appdefaultdir=$out/share/X11/app-defaults $installFlags"
+installFlags+=("appdefaultdir=$out/share/X11/app-defaults")
 
 
 if test -n "$x11BuildHook"; then
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 1e6b9888ba2ff..31303361f2c6b 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -59,7 +59,7 @@ self: super:
     x11BuildHook = ./imake.sh;
     patches = [./imake.patch ./imake-cc-wrapper-uberhack.patch];
     setupHook = ./imake-setup-hook.sh;
-    CFLAGS = "-DIMAKE_COMPILETIME_CPP='\"${if stdenv.isDarwin
+    env.CFLAGS = "-DIMAKE_COMPILETIME_CPP='\"${if stdenv.isDarwin
       then "${tradcpp}/bin/cpp"
       else "gcc"}\"'";
 
@@ -421,7 +421,7 @@ self: super:
   xf86videowsfb    = super.xf86videowsfb.overrideAttrs    (attrs: { meta = attrs.meta // { broken = true; }; });
 
   xf86videoomap    = super.xf86videoomap.overrideAttrs (attrs: {
-    NIX_CFLAGS_COMPILE = [ "-Wno-error=format-overflow" ];
+    env.NIX_CFLAGS_COMPILE = "-Wno-error=format-overflow";
   });
 
   xf86videoamdgpu = super.xf86videoamdgpu.overrideAttrs (attrs: {
@@ -429,7 +429,7 @@ self: super:
   });
 
   xf86videoati = super.xf86videoati.overrideAttrs (attrs: {
-    NIX_CFLAGS_COMPILE = "-I${self.xorgserver.dev or self.xorgserver}/include/xorg";
+    env.NIX_CFLAGS_COMPILE = "-I${self.xorgserver.dev or self.xorgserver}/include/xorg";
   });
 
   xf86videovmware = super.xf86videovmware.overrideAttrs (attrs: {
diff --git a/pkgs/servers/xinetd/default.nix b/pkgs/servers/xinetd/default.nix
index 3d130c93b784b..beeaa7bbbd608 100644
--- a/pkgs/servers/xinetd/default.nix
+++ b/pkgs/servers/xinetd/default.nix
@@ -18,8 +18,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libtirpc ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
-  NIX_LDFLAGS = [ "-ltirpc" ];
+  env.NIX_CFLAGS_COMPILE = "-I${libtirpc.dev}/include/tirpc";
+  env.NIX_LDFLAGS = "-ltirpc";
 
   meta = {
     description = "Secure replacement for inetd";
diff --git a/pkgs/shells/bash/4.4.nix b/pkgs/shells/bash/4.4.nix
index b3259466ddb1c..0acb384699e73 100644
--- a/pkgs/shells/bash/4.4.nix
+++ b/pkgs/shells/bash/4.4.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man" "doc" "info" ];
 
-  NIX_CFLAGS_COMPILE = ''
+  env.NIX_CFLAGS_COMPILE = ''
     -DSYS_BASHRC="/etc/bashrc"
     -DSYS_BASH_LOGOUT="/etc/bash_logout"
     -DDEFAULT_PATH_VALUE="/no-such-path"
diff --git a/pkgs/shells/bash/5.1.nix b/pkgs/shells/bash/5.1.nix
index ddf2edfd1db69..21d26dbe5b129 100644
--- a/pkgs/shells/bash/5.1.nix
+++ b/pkgs/shells/bash/5.1.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man" "doc" "info" ];
 
-  NIX_CFLAGS_COMPILE = ''
+  env.NIX_CFLAGS_COMPILE = ''
     -DSYS_BASHRC="/etc/bashrc"
     -DSYS_BASH_LOGOUT="/etc/bash_logout"
     -DDEFAULT_PATH_VALUE="/no-such-path"
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index d8f73d5a7e3e1..7568f0626c495 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -43,7 +43,9 @@ rec {
       if stdenv'.hostPlatform.isDarwin
       then throw "Cannot build fully static binaries on Darwin/macOS"
       else stdenv'.mkDerivation (args // {
-        NIX_CFLAGS_LINK = toString (args.NIX_CFLAGS_LINK or "") + " -static";
+        env = (args.env or {}) // {
+          NIX_CFLAGS_LINK = (args.env.NIX_CFLAGS_LINK or "") + " -static";
+        };
         configureFlags = (args.configureFlags or []) ++ [
             "--disable-shared" # brrr...
           ];
@@ -183,7 +185,9 @@ rec {
   keepDebugInfo = stdenv: stdenv //
     { mkDerivation = args: stdenv.mkDerivation (args // {
         dontStrip = true;
-        NIX_CFLAGS_COMPILE = toString (args.NIX_CFLAGS_COMPILE or "") + " -ggdb -Og";
+        env = (args.env or {}) // {
+          NIX_CFLAGS_COMPILE = (args.env.NIX_CFLAGS_COMPILE or "") + " -ggdb -Og";
+        };
       });
     };
 
@@ -191,7 +195,9 @@ rec {
   /* Modify a stdenv so that it uses the Gold linker. */
   useGoldLinker = stdenv: stdenv //
     { mkDerivation = args: stdenv.mkDerivation (args // {
-        NIX_CFLAGS_LINK = toString (args.NIX_CFLAGS_LINK or "") + " -fuse-ld=gold";
+        env = (args.env or {}) // {
+          NIX_CFLAGS_LINK = (args.env.NIX_CFLAGS_LINK or "") + " -fuse-ld=gold";
+        };
       });
     };
 
@@ -202,8 +208,10 @@ rec {
      WARNING: this breaks purity! */
   impureUseNativeOptimizations = stdenv: stdenv //
     { mkDerivation = args: stdenv.mkDerivation (args // {
-        NIX_CFLAGS_COMPILE = toString (args.NIX_CFLAGS_COMPILE or "") + " -march=native";
-        NIX_ENFORCE_NO_NATIVE = false;
+        env = (args.env or {}) // {
+          NIX_CFLAGS_COMPILE = (args.env.NIX_CFLAGS_COMPILE or "") + " -march=native";
+          NIX_ENFORCE_NO_NATIVE = false;
+        };
 
         preferLocalBuild = true;
         allowSubstitutes = false;
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index c2db758bbeae6..2018459058b78 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -417,7 +417,9 @@ in rec {
   };
 
   stage4 = prevStage: let
-    persistent = self: super: with prevStage; {
+    persistent = self: super: with prevStage; let
+      libxml2-nopython = super.libxml2.override { pythonSupport = false; };
+    in {
       inherit
         gnumake gzip gnused bzip2 gawk ed xz patch bash python3
         ncurses libffi zlib gmp pcre gnugrep cmake
@@ -489,7 +491,10 @@ in rec {
       # Need to get rid of these when cross-compiling.
       inherit binutils binutils-unwrapped;
     };
-  in import ../generic rec {
+  cc = pkgs.llvmPackages.libcxxClang.override {
+    cc = pkgs.llvmPackages.clang-unwrapped;
+  };
+  in import ../generic {
     name = "stdenv-darwin";
 
     inherit config;
@@ -510,9 +515,7 @@ in rec {
     initialPath = import ../common-path.nix { inherit pkgs; };
     shell       = "${pkgs.bash}/bin/bash";
 
-    cc = pkgs.llvmPackages.libcxxClang.override {
-      cc = pkgs.llvmPackages.clang-unwrapped;
-    };
+    inherit cc;
 
     extraNativeBuildInputs = [];
     extraBuildInputs = [ pkgs.darwin.CF ];
diff --git a/pkgs/stdenv/generic/default-builder.sh b/pkgs/stdenv/generic/default-builder.sh
index 273fc55c75523..a10f826ae5a73 100644
--- a/pkgs/stdenv/generic/default-builder.sh
+++ b/pkgs/stdenv/generic/default-builder.sh
@@ -1,2 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
+
 source $stdenv/setup
 genericBuild
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 4536024c51183..2985564eb8294 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -88,6 +88,9 @@ in rec {
     , hardeningDisable ? []
 
     , patches ? []
+    , __structuredAttrs ? true
+
+    , env ? {}
 
     , __contentAddressed ?
       (! attrs ? outputHash) # Fixed-output drvs can't be content addressed too
@@ -95,6 +98,23 @@ in rec {
 
     , ... } @ attrs:
 
+    assert lib.isList (attrs.buildFlags or []);
+    assert lib.isList configureFlags;
+    assert lib.isList cmakeFlags;
+    assert lib.isList (attrs.makeFlags or []);
+    assert lib.isList (attrs.checkFlags or []);
+    assert lib.isList (attrs.patchFlags or []);
+    assert lib.isList (attrs.installFlags or []);
+    assert lib.isList (attrs.installTargets or []);
+    assert !(attrs ? CFLAGS);
+    assert !(attrs ? CXXFLAGS);
+    assert !(attrs ? LDFLAGS);
+    assert !(attrs ? NIX_LDFLAGS);
+    assert !(attrs ? NIX_CFLAGS_COMPILE);
+    assert !(attrs ? NIX_CFLAGS_LINK);
+    assert !(attrs ? NIX_NO_SELF_RPATH);
+    assert !(attrs ? NIX_DONT_SET_RPATH);
+
     let
       # TODO(@oxij, @Ericson2314): This is here to keep the old semantics, remove when
       # no package has `doCheck = true`.
@@ -137,7 +157,9 @@ in rec {
       references = nativeBuildInputs ++ buildInputs
                 ++ propagatedNativeBuildInputs ++ propagatedBuildInputs;
 
-      dependencies = map (map lib.chooseDevOutputs) [
+      filterNull = ds: lib.filter (d: d != null) ds;
+
+      dependencies = map (map filterNull) (map (map lib.chooseDevOutputs) [
         [
           (map (drv: drv.__spliced.buildBuild or drv) depsBuildBuild)
           (map (drv: drv.nativeDrv or drv) nativeBuildInputs
@@ -154,8 +176,8 @@ in rec {
         [
           (map (drv: drv.__spliced.targetTarget or drv) depsTargetTarget)
         ]
-      ];
-      propagatedDependencies = map (map lib.chooseDevOutputs) [
+      ]);
+      propagatedDependencies = map (map filterNull) (map (map lib.chooseDevOutputs) [
         [
           (map (drv: drv.__spliced.buildBuild or drv) depsBuildBuildPropagated)
           (map (drv: drv.nativeDrv or drv) propagatedNativeBuildInputs)
@@ -168,7 +190,7 @@ in rec {
         [
           (map (drv: drv.__spliced.targetTarget or drv) depsTargetTargetPropagated)
         ]
-      ];
+      ]);
 
       computedSandboxProfile =
         lib.concatMap (input: input.__propagatedSandboxProfile or [])
@@ -190,6 +212,14 @@ in rec {
         lib.unique (lib.concatMap (input: input.__propagatedImpureHostDeps or [])
           (lib.concatLists propagatedDependencies));
 
+      propagaterOutput = let
+        # mimic behavior from `multiple-outputs.sh`
+        find = n: default: lib.findFirst (x: n == x) default outputs;
+        outputDev = find "dev" (find "out" null);
+      in if lib.elem outputDev outputs then outputDev else lib.head outputs;
+      propagatedBuildOutputs = attrs.propagatedBuildOutputs or
+        (lib.filter (i: i != propagaterOutput && lib.elem i outputs) [ "out" "bin" "dev" "lib"]);
+
       derivationArg =
         (removeAttrs attrs
           ["meta" "passthru" "pos"
@@ -223,6 +253,12 @@ in rec {
           args = attrs.args or ["-e" (attrs.builder or ./default-builder.sh)];
           inherit stdenv;
 
+          env = lib.mapAttrs
+            (k: v: if lib.isString v || lib.isBool v || lib.isInt v
+                   then v
+                   else throw "Environment variable '${k}' is a ${builtins.typeOf v} but should be a string, boolean or integer")
+            env;
+
           # The `system` attribute of a derivation has special meaning to Nix.
           # Derivations set it to choose what sort of machine could be used to
           # execute the build, The build platform entirely determines this,
@@ -233,28 +269,63 @@ in rec {
 
           userHook = config.stdenv.userHook or null;
           __ignoreNulls = true;
+          inherit __structuredAttrs;
 
           inherit strictDeps;
 
-          depsBuildBuild              = lib.elemAt (lib.elemAt dependencies 0) 0;
-          nativeBuildInputs           = lib.elemAt (lib.elemAt dependencies 0) 1;
-          depsBuildTarget             = lib.elemAt (lib.elemAt dependencies 0) 2;
-          depsHostHost                = lib.elemAt (lib.elemAt dependencies 1) 0;
-          buildInputs                 = lib.elemAt (lib.elemAt dependencies 1) 1;
-          depsTargetTarget            = lib.elemAt (lib.elemAt dependencies 2) 0;
-
-          depsBuildBuildPropagated    = lib.elemAt (lib.elemAt propagatedDependencies 0) 0;
-          propagatedNativeBuildInputs = lib.elemAt (lib.elemAt propagatedDependencies 0) 1;
-          depsBuildTargetPropagated   = lib.elemAt (lib.elemAt propagatedDependencies 0) 2;
-          depsHostHostPropagated      = lib.elemAt (lib.elemAt propagatedDependencies 1) 0;
-          propagatedBuildInputs       = lib.elemAt (lib.elemAt propagatedDependencies 1) 1;
-          depsTargetTargetPropagated  = lib.elemAt (lib.elemAt propagatedDependencies 2) 0;
+          depsBuildBuild =
+            let deps = lib.elemAt (lib.elemAt dependencies 0) 0; in
+            assert lib.all (v: lib.isDerivation v || builtins.isPath v || builtins.isString v) deps;
+            deps;
+          nativeBuildInputs =
+            let deps = lib.elemAt (lib.elemAt dependencies 0) 1; in
+            assert lib.all (v: lib.isDerivation v || builtins.isPath v || builtins.isString v) deps;
+            deps;
+          depsBuildTarget =
+            let deps = lib.elemAt (lib.elemAt dependencies 0) 2; in
+            assert lib.all (v: lib.isDerivation v || builtins.isPath v || builtins.isString v) deps;
+            deps;
+          depsHostHost =
+            let deps = lib.elemAt (lib.elemAt dependencies 1) 0; in
+            assert lib.all (v: lib.isDerivation v || builtins.isPath v || builtins.isString v) deps;
+            deps;
+          buildInputs =
+            let deps = lib.elemAt (lib.elemAt dependencies 1) 1; in
+            assert lib.all (v: lib.isDerivation v || builtins.isPath v || builtins.isString v) deps;
+            deps;
+          depsTargetTarget =
+            let deps = lib.elemAt (lib.elemAt dependencies 2) 0; in
+            assert lib.all (v: lib.isDerivation v || builtins.isPath v || builtins.isString v) deps;
+            deps;
+
+          depsBuildBuildPropagated =
+            let deps = lib.elemAt (lib.elemAt propagatedDependencies 0) 0; in
+            assert lib.all (v: lib.isDerivation v || builtins.isPath v || builtins.isString v) deps;
+            deps;
+          propagatedNativeBuildInputs =
+            let deps = lib.elemAt (lib.elemAt propagatedDependencies 0) 1; in
+            assert lib.all (v: lib.isDerivation v || builtins.isPath v || builtins.isString v) deps;
+            deps;
+          depsBuildTargetPropagated =
+            let deps = lib.elemAt (lib.elemAt propagatedDependencies 0) 2; in
+            assert lib.all (v: lib.isDerivation v || builtins.isPath v || builtins.isString v) deps;
+            deps;
+          depsHostHostPropagated =
+            let deps = lib.elemAt (lib.elemAt propagatedDependencies 1) 0; in
+            assert lib.all (v: lib.isDerivation v || builtins.isPath v || builtins.isString v) deps;
+            deps;
+          propagatedBuildInputs =
+            let deps = lib.elemAt (lib.elemAt propagatedDependencies 1) 1; in
+            assert lib.all (v: lib.isDerivation v || builtins.isPath v || builtins.isString v) deps;
+            deps;
+          depsTargetTargetPropagated =
+            let deps = lib.elemAt (lib.elemAt propagatedDependencies 2) 0; in
+            assert lib.all (v: lib.isDerivation v || builtins.isPath v || builtins.isString v) deps;
+            deps;
 
           # This parameter is sometimes a string, sometimes null, and sometimes a list, yuck
-          configureFlags = let inherit (lib) optional elem; in
-            (/**/ if lib.isString configureFlags then [configureFlags]
-             else if configureFlags == null      then []
-             else                                     configureFlags)
+          configureFlags = let inherit (lib) elem optional; in
+            assert (lib.all (n: lib.isDerivation n || !builtins.isList n && !builtins.isAttrs n) configureFlags); configureFlags
             ++ optional (elem "build"  configurePlatforms) "--build=${stdenv.buildPlatform.config}"
             ++ optional (elem "host"   configurePlatforms) "--host=${stdenv.hostPlatform.config}"
             ++ optional (elem "target" configurePlatforms) "--target=${stdenv.targetPlatform.config}";
@@ -264,6 +335,9 @@ in rec {
           inherit doCheck doInstallCheck;
 
           inherit outputs;
+
+          inherit propagaterOutput propagatedBuildOutputs;
+
         } // lib.optionalAttrs (__contentAddressed) {
           inherit __contentAddressed;
           # Provide default values for outputHashMode and outputHashAlgo because
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index a73474c952e50..d7aa5123f6d55 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -5,9 +5,6 @@ if (( "${NIX_DEBUG:-0}" >= 6 )); then
     set -x
 fi
 
-: ${outputs:=out}
-
-
 ######################################################################
 # Hook handling.
 
@@ -219,6 +216,10 @@ printWords() {
 ######################################################################
 # Initialisation.
 
+# export all vars that should be in the ENV
+for envVar in "${!env[@]}"; do
+    export $envVar="${env[$envVar]}"
+done
 
 # Set a fallback default value for SOURCE_DATE_EPOCH, used by some build tools
 # to provide a deterministic substitute for the "current" time. Note that
@@ -430,30 +431,22 @@ findInputs() {
     done
 }
 
-# Make sure all are at least defined as empty
-: ${depsBuildBuild=} ${depsBuildBuildPropagated=}
-: ${nativeBuildInputs=} ${propagatedNativeBuildInputs=} ${defaultNativeBuildInputs=}
-: ${depsBuildTarget=} ${depsBuildTargetPropagated=}
-: ${depsHostHost=} ${depsHostHostPropagated=}
-: ${buildInputs=} ${propagatedBuildInputs=} ${defaultBuildInputs=}
-: ${depsTargetTarget=} ${depsTargetTargetPropagated=}
-
-for pkg in $depsBuildBuild $depsBuildBuildPropagated; do
+for pkg in ${depsBuildBuild+"${depsBuildBuild[@]}"} ${depsBuildBuildPropagated+"${depsBuildBuildPropagated[@]}"}; do
     findInputs "$pkg" -1 -1
 done
-for pkg in $nativeBuildInputs $propagatedNativeBuildInputs; do
+for pkg in ${nativeBuildInputs+"${nativeBuildInputs[@]}"} ${propagatedNativeBuildInputs+"${propagatedNativeBuildInputs[@]}"}; do
     findInputs "$pkg" -1  0
 done
-for pkg in $depsBuildTarget $depsBuildTargetPropagated; do
+for pkg in ${depsBuildTarget+"${depsBuildTarget[@]}"} ${depsBuildTargetPropagated+"${depsBuildTargetPropagated[@]}"}; do
     findInputs "$pkg" -1  1
 done
-for pkg in $depsHostHost $depsHostHostPropagated; do
+for pkg in ${depsHostHost+"${depsHostHost[@]}"} ${depsHostHostPropagated+"${depsHostHostPropagated[@]}"}; do
     findInputs "$pkg"  0  0
 done
-for pkg in $buildInputs $propagatedBuildInputs ; do
+for pkg in ${buildInputs+"${buildInputs[@]}"} ${propagatedBuildInputs+"${propagatedBuildInputs[@]}"}; do
     findInputs "$pkg"  0  1
 done
-for pkg in $depsTargetTarget $depsTargetTargetPropagated; do
+for pkg in ${depsTargetTarget+"${depsTargetTarget[@]}"} ${depsTargetTargetPropagated+"${depsTargetTargetPropagated[@]}"}; do
     findInputs "$pkg"  1  1
 done
 # Default inputs must be processed last
@@ -742,11 +735,14 @@ substituteInPlace() {
 }
 
 _allFlags() {
-    for varName in $(awk 'BEGIN { for (v in ENVIRON) if (v ~ /^[a-z][a-zA-Z0-9_]*$/) print v }'); do
-        if (( "${NIX_DEBUG:-0}" >= 1 )); then
-            printf "@%s@ -> %q\n" "${varName}" "${!varName}"
+    local varNames="$(comm -3 <(declare | sort) <(declare -f | sort) | cut -d '=' -f 1)"
+    for varName in $varNames; do
+        if ! [ -z ${!varName+x} ] && [ $varName != _ ]; then
+            if (( "${NIX_DEBUG:-0}" >= 1 )); then
+                printf "@%s@ -> %q\n" "${varName}" "${!varName}" >&2
+            fi
+            args+=("--subst-var" "$varName")
         fi
-        args+=("--subst-var" "$varName")
     done
 }
 
@@ -855,13 +851,13 @@ unpackFile() {
 unpackPhase() {
     runHook preUnpack
 
-    if [ -z "${srcs:-}" ]; then
+    if [ -z ${srcs-"${srcs[@]}"} ]; then
         if [ -z "${src:-}" ]; then
             # shellcheck disable=SC2016
             echo 'variable $src or $srcs should point to the source'
             exit 1
         fi
-        srcs="$src"
+        srcs=("$src")
     fi
 
     # To determine the source directory created by unpacking the
@@ -875,8 +871,13 @@ unpackPhase() {
         fi
     done
 
+    if [ "$sourceRoot" == "." ]; then
+      mkdir source
+      cd source
+    fi
+
     # Unpack all source archives.
-    for i in $srcs; do
+    for i in "${srcs[@]}"; do
         unpackFile "$i"
     done
 
@@ -910,6 +911,11 @@ unpackPhase() {
         exit 1
     fi
 
+    if [ "$sourceRoot" == "." ]; then
+      cd ..
+      sourceRoot=source
+    fi
+
     echo "source root is $sourceRoot"
 
     # By default, add write permission to the sources.  This is often
@@ -926,7 +932,7 @@ unpackPhase() {
 patchPhase() {
     runHook prePatch
 
-    for i in ${patches:-}; do
+    for i in ${patches+"${patches[@]}"}; do
         header "applying patch $i" 3
         local uncompress=cat
         case "$i" in
@@ -945,7 +951,7 @@ patchPhase() {
         esac
         # "2>&1" is a hack to make patch fail if the decompressor fails (nonexistent patch, etc.)
         # shellcheck disable=SC2086
-        $uncompress < "$i" 2>&1 | patch ${patchFlags:--p1}
+        $uncompress < "$i" 2>&1 | patch "${patchFlags[@]:--p1}"
     done
 
     runHook postPatch
@@ -962,7 +968,6 @@ configurePhase() {
 
     # set to empty if unset
     : ${configureScript=}
-    : ${configureFlags=}
 
     if [[ -z "$configureScript" && -x ./configure ]]; then
         configureScript=./configure
@@ -977,32 +982,36 @@ configurePhase() {
     fi
 
     if [[ -z "${dontAddPrefix:-}" && -n "$prefix" ]]; then
-        configureFlags="${prefixKey:---prefix=}$prefix $configureFlags"
+        if [[ -z "${prefixAsSeperateFlag:-}" ]]; then
+            configureFlags=("${prefixKey:---prefix=}$prefix" "${configureFlags[@]}")
+        else
+            configureFlags=("${prefixKey:---prefix}" "$prefix" "${configureFlags[@]}")
+        fi
     fi
 
     # Add --disable-dependency-tracking to speed up some builds.
     if [ -z "${dontAddDisableDepTrack:-}" ]; then
         if [ -f "$configureScript" ] && grep -q dependency-tracking "$configureScript"; then
-            configureFlags="--disable-dependency-tracking $configureFlags"
+            configureFlags=("--disable-dependency-tracking" "${configureFlags[@]}")
         fi
     fi
 
     # By default, disable static builds.
     if [ -z "${dontDisableStatic:-}" ]; then
         if [ -f "$configureScript" ] && grep -q enable-static "$configureScript"; then
-            configureFlags="--disable-static $configureFlags"
+            configureFlags=("--disable-static" "${configureFlags[@]}")
         fi
     fi
 
     if [ -n "$configureScript" ]; then
         # Old bash empty array hack
         # shellcheck disable=SC2086
-        local flagsArray=(
-            $configureFlags ${configureFlagsArray+"${configureFlagsArray[@]}"}
+        configureFlags+=(
+            ${configureFlagsArray+"${configureFlagsArray[@]}"}
         )
-        echoCmd 'configure flags' "${flagsArray[@]}"
+        echoCmd 'configure flags' "${configureFlags[@]}"
         # shellcheck disable=SC2086
-        $configureScript "${flagsArray[@]}"
+        $configureScript "${configureFlags[@]}"
         unset flagsArray
     else
         echo "no configure script, doing nothing"
@@ -1016,9 +1025,9 @@ buildPhase() {
     runHook preBuild
 
     # set to empty if unset
-    : ${makeFlags=}
+    makeFlags=${makeFlags+"${makeFlags[@]}"}
 
-    if [[ -z "$makeFlags" && -z "${makefile:-}" && ! ( -e Makefile || -e makefile || -e GNUmakefile ) ]]; then
+    if [[ -z "${makeFlags[@]}" && -z "${makefile:-}" && ! ( -e Makefile || -e makefile || -e GNUmakefile ) ]]; then
         echo "no Makefile, doing nothing"
     else
         foundMakefile=1
@@ -1028,8 +1037,9 @@ buildPhase() {
         local flagsArray=(
             ${enableParallelBuilding:+-j${NIX_BUILD_CORES} -l${NIX_BUILD_CORES}}
             SHELL=$SHELL
-            $makeFlags ${makeFlagsArray+"${makeFlagsArray[@]}"}
-            $buildFlags ${buildFlagsArray+"${buildFlagsArray[@]}"}
+            ${makeFlags[@]} ${makeFlagsArray+"${makeFlagsArray[@]}"}
+            ${buildFlags+"${buildFlags[@]}"} ${buildFlagsArray+"${buildFlagsArray[@]}"}
+            ${buildTargets+"${buildTargets[@]}"}
         )
 
         echoCmd 'build flags' "${flagsArray[@]}"
@@ -1067,7 +1077,7 @@ checkPhase() {
         local flagsArray=(
             ${enableParallelChecking:+-j${NIX_BUILD_CORES} -l${NIX_BUILD_CORES}}
             SHELL=$SHELL
-            $makeFlags ${makeFlagsArray+"${makeFlagsArray[@]}"}
+            ${makeFlags[@]} ${makeFlagsArray+"${makeFlagsArray[@]}"}
             ${checkFlags:-VERBOSE=y} ${checkFlagsArray+"${checkFlagsArray[@]}"}
             ${checkTarget}
         )
@@ -1093,9 +1103,9 @@ installPhase() {
     # shellcheck disable=SC2086
     local flagsArray=(
         SHELL=$SHELL
-        $makeFlags ${makeFlagsArray+"${makeFlagsArray[@]}"}
-        $installFlags ${installFlagsArray+"${installFlagsArray[@]}"}
-        ${installTargets:-install}
+        ${makeFlags[@]} ${makeFlagsArray+"${makeFlagsArray[@]}"}
+        ${installFlags+"${installFlags[@]}"} ${installFlagsArray+"${installFlagsArray[@]}"}
+        "${installTargets[@]:-install}"
     )
 
     echoCmd 'install flags' "${flagsArray[@]}"
@@ -1112,15 +1122,15 @@ installPhase() {
 fixupPhase() {
     # Make sure everything is writable so "strip" et al. work.
     local output
-    for output in $outputs; do
-        if [ -e "${!output}" ]; then chmod -R u+w "${!output}"; fi
+    for output in ${outputs[@]}; do
+        if [ -e "${output}" ]; then chmod -R u+w "${output}"; fi
     done
 
     runHook preFixup
 
     # Apply fixup to each output.
     local output
-    for output in $outputs; do
+    for output in ${!outputs[@]}; do
         prefix="${!output}" runHook fixupOutput
     done
 
@@ -1148,7 +1158,7 @@ fixupPhase() {
         local propagatedInputsSlice="${flatVars[$propagatedInputsIndex]}[@]"
         local propagatedInputsFile="${flatFiles[$propagatedInputsIndex]}"
 
-        [[ "${!propagatedInputsSlice}" ]] || continue
+        [[ "${!propagatedInputsSlice-}" ]] || continue
 
         mkdir -p "${!outputDev}/nix-support"
         # shellcheck disable=SC2086
@@ -1165,7 +1175,7 @@ fixupPhase() {
     if [ -n "${setupHooks:-}" ]; then
         mkdir -p "${!outputDev}/nix-support"
         local hook
-        for hook in $setupHooks; do
+        for hook in ${setupHooks[@]}; do
             local content
             consumeEntire content < "$hook"
             substituteAllStream content "file '$hook'" >> "${!outputDev}/nix-support/setup-hook"
@@ -1179,7 +1189,7 @@ fixupPhase() {
     if [ -n "${propagatedUserEnvPkgs:-}" ]; then
         mkdir -p "${!outputBin}/nix-support"
         # shellcheck disable=SC2086
-        printWords $propagatedUserEnvPkgs > "${!outputBin}/nix-support/propagated-user-env-packages"
+        printWords ${propagatedUserEnvPkgs[@]} > "${!outputBin}/nix-support/propagated-user-env-packages"
     fi
 
     runHook postFixup
@@ -1201,7 +1211,7 @@ installCheckPhase() {
         local flagsArray=(
             ${enableParallelChecking:+-j${NIX_BUILD_CORES} -l${NIX_BUILD_CORES}}
             SHELL=$SHELL
-            $makeFlags ${makeFlagsArray+"${makeFlagsArray[@]}"}
+            ${makeFlags[@]} ${makeFlagsArray+"${makeFlagsArray[@]}"}
             $installCheckFlags ${installCheckFlagsArray+"${installCheckFlagsArray[@]}"}
             ${installCheckTarget:-installcheck}
         )
@@ -1257,10 +1267,6 @@ showPhaseHeader() {
 
 
 genericBuild() {
-    if [ -f "${buildCommandPath:-}" ]; then
-        source "$buildCommandPath"
-        return
-    fi
     if [ -n "${buildCommand:-}" ]; then
         eval "$buildCommand"
         return
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 816f0865fa759..ad4601b1998d1 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -243,7 +243,7 @@ in
         # Apparently iconv won't work with bootstrap glibc, but it will be used
         # with glibc built later where we keep *this* build of libunistring,
         # so we need to trick it into supporting libiconv.
-        am_cv_func_iconv_works = "yes";
+        env = { am_cv_func_iconv_works = "yes"; } // attrs.env or {};
       });
       libidn2 = super.libidn2.overrideAttrs (attrs: {
         postFixup = attrs.postFixup or "" + ''
diff --git a/pkgs/tools/X11/find-cursor/default.nix b/pkgs/tools/X11/find-cursor/default.nix
index 3f330c63b0f10..76f2a337aa700 100644
--- a/pkgs/tools/X11/find-cursor/default.nix
+++ b/pkgs/tools/X11/find-cursor/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ installShellFiles git ];
   buildInputs = [ libX11 libXdamage libXrender libXcomposite libXext ];
   preInstall = "mkdir -p $out/share/man/man1";
-  installFlags = "PREFIX=${placeholder "out"}";
+  installFlags = [ "PREFIX=${placeholder "out"}" ];
 
   meta = with lib; {
     description = "Simple XLib program to highlight the cursor position";
diff --git a/pkgs/tools/X11/nx-libs/default.nix b/pkgs/tools/X11/nx-libs/default.nix
index 022111e4b3141..a34939ded875d 100644
--- a/pkgs/tools/X11/nx-libs/default.nix
+++ b/pkgs/tools/X11/nx-libs/default.nix
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
     xorg.xkbcomp xorg.xkeyboardconfig libtirpc
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
-  NIX_LDFLAGS = [ "-ltirpc" ];
+  env.NIX_CFLAGS_COMPILE = "-I${libtirpc.dev}/include/tirpc";
+  env.NIX_LDFLAGS = "-ltirpc";
 
   postPatch = ''
     patchShebangs .
@@ -29,12 +29,12 @@ stdenv.mkDerivation rec {
     ln -s libNX_X11.so.6.3.0
   '';
 
-  PREFIX=""; # Don't install to $out/usr/local
-  installPhase = ''
-    make DESTDIR="$out" install
-    # See:
-    # - https://salsa.debian.org/debian-remote-team/nx-libs/blob/bcc152100617dc59156015a36603a15db530a64f/debian/rules#L66-72
-    # - https://github.com/ArcticaProject/nx-libs/issues/652
+  installFlags = [ "PREFIX=" "DESTDIR=${placeholder "out"}" ];
+
+  # See:
+  # - https://salsa.debian.org/debian-remote-team/nx-libs/blob/bcc152100617dc59156015a36603a15db530a64f/debian/rules#L66-72
+  # - https://github.com/ArcticaProject/nx-libs/issues/652
+  postFixup = ''
     patchelf --remove-needed "libX11.so.6" $out/bin/nxagent
   '';
 
diff --git a/pkgs/tools/X11/x11spice/default.nix b/pkgs/tools/X11/x11spice/default.nix
index 4facc365c1ede..4a89268889bd1 100644
--- a/pkgs/tools/X11/x11spice/default.nix
+++ b/pkgs/tools/X11/x11spice/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     gtk2 spice spice-protocol
   ];
 
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   meta = with lib; {
     description = "Enable a running X11 desktop to be available via a Spice server";
diff --git a/pkgs/tools/X11/xmousepasteblock/default.nix b/pkgs/tools/X11/xmousepasteblock/default.nix
index 35db8a133a23c..984f6ac70a6b7 100644
--- a/pkgs/tools/X11/xmousepasteblock/default.nix
+++ b/pkgs/tools/X11/xmousepasteblock/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0vidckfp277cg2gsww8a8q5b18m10iy4ppyp2qipr89771nrcmns";
     rev = version;
   };
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
   buildInputs = with xorg; [ libX11 libXext libXi libev ];
   nativeBuildInputs = [ pkg-config ];
   meta = with lib; {
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index 8fd0cf016bf4a..518d8b5621792 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -90,7 +90,7 @@ in buildPythonApplication rec {
   ];
 
     # error: 'import_cairo' defined but not used
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
 
   setupPyBuildFlags = [
     "--with-Xdummy"
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index 57bc14ba900ce..9da0497e4bd4e 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -17,10 +17,9 @@ buildGoModule rec {
 
   subPackages = [ "cmd/eksctl" ];
 
-  buildFlags = [ "-tags netgo" "-tags release" ];
-
-  buildFlagsArray = [
+  buildFlags = [
     "-ldflags=-s -w -X github.com/weaveworks/eksctl/pkg/version.gitCommit=${src.rev} -X github.com/weaveworks/eksctl/pkg/version.buildDate=19700101-00:00:00"
+    "-tags" "netgo" "-tags" "release"
   ];
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/tools/archivers/p7zip/default.nix b/pkgs/tools/archivers/p7zip/default.nix
index 8ba87da6b6ac9..1b552dbe08bdf 100644
--- a/pkgs/tools/archivers/p7zip/default.nix
+++ b/pkgs/tools/archivers/p7zip/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
 
   meta = {
     homepage = "https://github.com/szcnick/p7zip";
diff --git a/pkgs/tools/archivers/unzip/default.nix b/pkgs/tools/archivers/unzip/default.nix
index e74637ca25ec1..bd61c54d63226 100644
--- a/pkgs/tools/archivers/unzip/default.nix
+++ b/pkgs/tools/archivers/unzip/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation {
 
   makefile = "unix/Makefile";
 
-  NIX_LDFLAGS = "-lbz2" + lib.optionalString enableNLS " -lnatspec";
+  env.NIX_LDFLAGS = "-lbz2" + lib.optionalString enableNLS " -lnatspec";
 
   buildFlags = [
     "generic"
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index c218aa7e4e122..0a2f48dda2dda 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -261,7 +261,7 @@ in pythonPackages.buildPythonApplication rec {
     runHook postInstallCheck
   '';
 
-  makeWrapperArgs = [ "--set GI_TYPELIB_PATH \"$GI_TYPELIB_PATH\"" "--set GST_PLUGIN_SYSTEM_PATH_1_0 \"$GST_PLUGIN_SYSTEM_PATH_1_0\"" ];
+  makeWrapperArgs = [ "--set" "GI_TYPELIB_PATH" "\"$GI_TYPELIB_PATH\"" "--set" "GST_PLUGIN_SYSTEM_PATH_1_0" "\"$GST_PLUGIN_SYSTEM_PATH_1_0\"" ];
 
   passthru = {
     # FIXME: remove in favor of pkgs.beetsExternalPlugins
diff --git a/pkgs/tools/audio/botamusique/default.nix b/pkgs/tools/audio/botamusique/default.nix
index 11f228ea6919c..3655a12d6f19f 100644
--- a/pkgs/tools/audio/botamusique/default.nix
+++ b/pkgs/tools/audio/botamusique/default.nix
@@ -15,7 +15,7 @@
 let
   nodejs = pkgs.nodejs-12_x;
   nodeEnv = import ../../../development/node-packages/node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile;
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile jq;
     inherit pkgs nodejs;
     libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
   };
diff --git a/pkgs/tools/audio/darkice/default.nix b/pkgs/tools/audio/darkice/default.nix
index f7d74dc615c82..0f7b69201e57c 100644
--- a/pkgs/tools/audio/darkice/default.nix
+++ b/pkgs/tools/audio/darkice/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     libopus libvorbis libogg libpulseaudio alsaLib libsamplerate libjack2 lame
   ];
 
-  NIX_CFLAGS_COMPILE = "-fpermissive";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
 
   configureFlags = [
     "--with-faac-prefix=${faac}"
diff --git a/pkgs/tools/audio/gvolicon/default.nix b/pkgs/tools/audio/gvolicon/default.nix
index 03ea3302d262a..a9a781ab7b19e 100644
--- a/pkgs/tools/audio/gvolicon/default.nix
+++ b/pkgs/tools/audio/gvolicon/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  NIX_CFLAGS_COMPILE = "-D_POSIX_C_SOURCE";
+  env.NIX_CFLAGS_COMPILE = "-D_POSIX_C_SOURCE";
 
   meta = {
     description = "A simple and lightweight volume icon that sits in your system tray";
diff --git a/pkgs/tools/audio/pa-applet/default.nix b/pkgs/tools/audio/pa-applet/default.nix
index 358e662ca1e06..34c68ea21af22 100644
--- a/pkgs/tools/audio/pa-applet/default.nix
+++ b/pkgs/tools/audio/pa-applet/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   '';
 
   # work around a problem related to gtk3 updates
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   postInstall = "";
 
diff --git a/pkgs/tools/backup/borgbackup/default.nix b/pkgs/tools/backup/borgbackup/default.nix
index 86eee2bc9aa0d..39750dd686c29 100644
--- a/pkgs/tools/backup/borgbackup/default.nix
+++ b/pkgs/tools/backup/borgbackup/default.nix
@@ -29,7 +29,7 @@ python3.pkgs.buildPythonApplication rec {
   '';
 
   makeWrapperArgs = [
-    ''--prefix PATH ':' "${openssh}/bin"''
+    "--prefix" "PATH" ":" "${openssh}/bin"
   ];
 
   postInstall = ''
@@ -51,15 +51,7 @@ python3.pkgs.buildPythonApplication rec {
     cp scripts/shell_completions/zsh/_borg $out/share/zsh/site-functions/
   '';
 
-  checkInputs = with python3.pkgs; [
-    pytest
-  ];
-
-  checkPhase = ''
-    HOME=$(mktemp -d) py.test --pyargs borg.testsuite
-  '';
-
-  # 64 failures, needs pytest-benchmark
+  # tries to fuse mount and create directories in /var/tmp
   doCheck = false;
 
   passthru.tests = {
diff --git a/pkgs/tools/backup/chunksync/default.nix b/pkgs/tools/backup/chunksync/default.nix
index 2bab8d5ea22e6..23edfcd42d33e 100644
--- a/pkgs/tools/backup/chunksync/default.nix
+++ b/pkgs/tools/backup/chunksync/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [openssl perl];
 
-  NIX_LDFLAGS = "-lgcc_s";
+  env.NIX_LDFLAGS = "-lgcc_s";
 
   makeFlags = [
     "DESTDIR=$(out)"
diff --git a/pkgs/tools/backup/duplicity/default.nix b/pkgs/tools/backup/duplicity/default.nix
index 24e1a2954ed6f..b95e82dced015 100644
--- a/pkgs/tools/backup/duplicity/default.nix
+++ b/pkgs/tools/backup/duplicity/default.nix
@@ -36,7 +36,7 @@ pythonPackages.buildPythonApplication rec {
     ./linux-disable-timezone-test.patch
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/tools/cd-dvd/cdrdao/default.nix b/pkgs/tools/cd-dvd/cdrdao/default.nix
index 3fca8b2cd3c61..541d697d37fb0 100644
--- a/pkgs/tools/cd-dvd/cdrdao/default.nix
+++ b/pkgs/tools/cd-dvd/cdrdao/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
   '';
 
   # Needed on gcc >= 6.
-  NIX_CFLAGS_COMPILE = "-Wno-narrowing";
+  env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
 
   meta = with lib; {
     description = "A tool for recording audio or data CD-Rs in disk-at-once (DAO) mode";
diff --git a/pkgs/tools/compression/ncompress/builder.sh b/pkgs/tools/compression/ncompress/builder.sh
deleted file mode 100644
index 7a3f34aae4691..0000000000000
--- a/pkgs/tools/compression/ncompress/builder.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-source $stdenv/setup
-installFlags="PREFIX=$out"
-
-preBuild() {
-    cp Makefile.def Makefile
-    sed -i GNUmakefile -e 's/compress %/%/g'
-}
-
-postInstall() {
-    rm $out/bin/uncompress* $out/bin/zcat*
-    ln -s compress $out/bin/uncompress
-    ln -s compress $out/bin/zcat
-}
-
-genericBuild
diff --git a/pkgs/tools/compression/ncompress/default.nix b/pkgs/tools/compression/ncompress/default.nix
index f580709495ed9..0f2f08797e1b1 100644
--- a/pkgs/tools/compression/ncompress/default.nix
+++ b/pkgs/tools/compression/ncompress/default.nix
@@ -1,16 +1,27 @@
-{lib, stdenv, fetchurl}:
+{ lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
   pname = "ncompress";
   version = "5.0";
 
-  builder = ./builder.sh;
-
   src = fetchurl {
     url = "mirror://sourceforge/project/ncompress/${pname}-${version}.tar.gz";
     sha256 = "004r086c11sw9vg2j3srgxpz98w8pycjl33bk3pgqnd0s92igrn4";
   };
 
+  installFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  preBuild = ''
+    cp Makefile.def Makefile
+    sed -i GNUmakefile -e 's/compress %/%/g'
+  '';
+
+  postInstall = ''
+    rm $out/bin/uncompress* $out/bin/zcat*
+    ln -s compress $out/bin/uncompress
+    ln -s compress $out/bin/zcat
+  '';
+
   meta = {
     homepage = "http://ncompress.sourceforge.net/";
     license = lib.licenses.publicDomain;
diff --git a/pkgs/tools/compression/pbzip2/default.nix b/pkgs/tools/compression/pbzip2/default.nix
index 6d27b84e8c4c7..81144fb14b193 100644
--- a/pkgs/tools/compression/pbzip2/default.nix
+++ b/pkgs/tools/compression/pbzip2/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "PREFIX=$(out)" ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=reserved-user-defined-literal";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=reserved-user-defined-literal";
 
   meta = with lib; {
     homepage = "http://compression.ca/pbzip2/";
diff --git a/pkgs/tools/compression/upx/default.nix b/pkgs/tools/compression/upx/default.nix
index 10e02626c0178..df5c04f3ff9cf 100644
--- a/pkgs/tools/compression/upx/default.nix
+++ b/pkgs/tools/compression/upx/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "051pk5jk8fcfg5mpgzj43z5p4cn7jy5jbyshyn78dwjqr7slsxs7";
   };
 
-  CXXFLAGS = "-Wno-unused-command-line-argument";
+  env.CXXFLAGS = "-Wno-unused-command-line-argument";
 
   buildInputs = [ ucl zlib perl ];
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     export UPX_UCLDIR=${ucl}
   '';
 
-  makeFlags = [ "-C" "src" "CHECK_WHITESPACE=true" ];
+  makeFlags = [ "-C src" "CHECK_WHITESPACE=true" ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/filesystems/blobfuse/default.nix b/pkgs/tools/filesystems/blobfuse/default.nix
index a620a07d4753e..b3ba3a45c50b3 100644
--- a/pkgs/tools/filesystems/blobfuse/default.nix
+++ b/pkgs/tools/filesystems/blobfuse/default.nix
@@ -24,7 +24,7 @@ in stdenv.mkDerivation rec {
   pname = "blobfuse";
   inherit version src;
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
 
   buildInputs = [ curl gnutls libgcrypt libuuid fuse boost cpplite ];
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/tools/filesystems/curlftpfs/default.nix b/pkgs/tools/filesystems/curlftpfs/default.nix
index 2c5d886c14df7..6749b97e1b509 100644
--- a/pkgs/tools/filesystems/curlftpfs/default.nix
+++ b/pkgs/tools/filesystems/curlftpfs/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ fuse curl glib zlib ];
 
-  CFLAGS = lib.optionalString stdenv.isDarwin "-D__off_t=off_t";
+  env.CFLAGS = lib.optionalString stdenv.isDarwin "-D__off_t=off_t";
 
   postPatch = lib.optionalString stdenv.isDarwin ''
     # Fix the build on macOS with macFUSE installed. Needs autoreconfHook for
diff --git a/pkgs/tools/filesystems/darling-dmg/default.nix b/pkgs/tools/filesystems/darling-dmg/default.nix
index 54d23e770db16..e53195fad8c4c 100644
--- a/pkgs/tools/filesystems/darling-dmg/default.nix
+++ b/pkgs/tools/filesystems/darling-dmg/default.nix
@@ -15,10 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ fuse openssl zlib bzip2 libxml2 icu lzfse ]
     ++ lib.optionals stdenv.isDarwin [ libiconv ];
 
-  CXXFLAGS = [
-    "-DCOMPILE_WITH_LZFSE=1"
-    "-llzfse"
-  ];
+  env.CXXFLAGS = "-DCOMPILE_WITH_LZFSE=1 -llzfse";
 
   meta = with lib; {
     homepage = "https://www.darlinghq.org/";
diff --git a/pkgs/tools/filesystems/fuseiso/default.nix b/pkgs/tools/filesystems/fuseiso/default.nix
index 7e44e7c15f9cb..814f7e8bc5369 100644
--- a/pkgs/tools/filesystems/fuseiso/default.nix
+++ b/pkgs/tools/filesystems/fuseiso/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
 
   # after autoreconfHook, glib and zlib are not found, so force link against
   # them
-  NIX_LDFLAGS = "-lglib-2.0 -lz";
+  env.NIX_LDFLAGS = "-lglib-2.0 -lz";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/filesystems/irods/common.nix b/pkgs/tools/filesystems/irods/common.nix
index 87bb2b9051ced..5dab97c9c25a0 100644
--- a/pkgs/tools/filesystems/irods/common.nix
+++ b/pkgs/tools/filesystems/irods/common.nix
@@ -28,9 +28,7 @@
     substituteInPlace CMakeLists.txt --replace "DESTINATION usr/bin" "DESTINATION bin"
     substituteInPlace CMakeLists.txt --replace "INCLUDE_DIRS usr/include/" "INCLUDE_DIRS include/"
     substituteInPlace CMakeLists.txt --replace "DESTINATION usr/lib/" "DESTINATION lib/"
-    export cmakeFlags="$cmakeFlags
-      -DCMAKE_INSTALL_PREFIX=$out
-    "
+    cmakeFlags+=("-DCMAKE_INSTALL_PREFIX=$out")
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/filesystems/irods/default.nix b/pkgs/tools/filesystems/irods/default.nix
index cbc9f19c664a8..a5044a744eced 100644
--- a/pkgs/tools/filesystems/irods/default.nix
+++ b/pkgs/tools/filesystems/irods/default.nix
@@ -31,7 +31,7 @@ in rec {
     patches = [ ./irods_root_path.patch ];
 
     # fix build with recent llvm versions
-    NIX_CFLAGS_COMPILE = "-Wno-deprecated-register -Wno-deprecated-declarations";
+    env.NIX_CFLAGS_COMPILE = "-Wno-deprecated-register -Wno-deprecated-declarations";
 
     preConfigure = common.preConfigure + ''
       patchShebangs ./test
@@ -45,11 +45,11 @@ in rec {
       do
         substituteInPlace $file --replace "CATCH2}/include" "CATCH2}/include/catch2"
       done
-      export cmakeFlags="$cmakeFlags
-        -DCMAKE_EXE_LINKER_FLAGS=-Wl,-rpath,$out/lib
-        -DCMAKE_MODULE_LINKER_FLAGS=-Wl,-rpath,$out/lib
-        -DCMAKE_SHARED_LINKER_FLAGS=-Wl,-rpath,$out/lib
-        "
+      cmakeFlags+=(
+        "-DCMAKE_EXE_LINKER_FLAGS=-Wl,-rpath,$out/lib"
+        "-DCMAKE_MODULE_LINKER_FLAGS=-Wl,-rpath,$out/lib"
+        "-DCMAKE_SHARED_LINKER_FLAGS=-Wl,-rpath,$out/lib"
+      )
 
       substituteInPlace cmake/server.cmake --replace SETUID ""
     '';
diff --git a/pkgs/tools/filesystems/reiserfsprogs/default.nix b/pkgs/tools/filesystems/reiserfsprogs/default.nix
index dc97cdb652e25..01a6b292707be 100644
--- a/pkgs/tools/filesystems/reiserfsprogs/default.nix
+++ b/pkgs/tools/filesystems/reiserfsprogs/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ libuuid ];
 
-  NIX_CFLAGS_COMPILE = [ "-std=gnu90" "-D_GNU_SOURCE" ];
+  env.NIX_CFLAGS_COMPILE = "-std=gnu90 -D_GNU_SOURCE";
 
   meta = {
     inherit version;
diff --git a/pkgs/tools/filesystems/sshfs-fuse/common.nix b/pkgs/tools/filesystems/sshfs-fuse/common.nix
index f85faa712dd4c..5a410858f9385 100644
--- a/pkgs/tools/filesystems/sshfs-fuse/common.nix
+++ b/pkgs/tools/filesystems/sshfs-fuse/common.nix
@@ -26,7 +26,7 @@ in stdenv.mkDerivation rec {
   buildInputs = [ fuse glib ];
   checkInputs = [ which python3Packages.pytest ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString
+  env.NIX_CFLAGS_COMPILE = lib.optionalString
     (stdenv.hostPlatform.system == "i686-linux")
     "-D_FILE_OFFSET_BITS=64";
 
diff --git a/pkgs/tools/filesystems/svnfs/default.nix b/pkgs/tools/filesystems/svnfs/default.nix
index a192032aa9380..6636252309663 100644
--- a/pkgs/tools/filesystems/svnfs/default.nix
+++ b/pkgs/tools/filesystems/svnfs/default.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation rec {
     export LD_LIBRARY_PATH=${subversion.out}/lib
   '';
 
-  NIX_CFLAGS_COMPILE="-I ${subversion.dev}/include/subversion-1";
-  NIX_LDFLAGS="-lsvn_client-1 -lsvn_subr-1";
+  env.NIX_CFLAGS_COMPILE="-I ${subversion.dev}/include/subversion-1";
+  env.NIX_LDFLAGS="-lsvn_client-1 -lsvn_subr-1";
 
   meta = {
     description = "FUSE filesystem for accessing Subversion repositories";
diff --git a/pkgs/tools/filesystems/udftools/default.nix b/pkgs/tools/filesystems/udftools/default.nix
index ec3fd6efefae4..f50f98d33dc25 100644
--- a/pkgs/tools/filesystems/udftools/default.nix
+++ b/pkgs/tools/filesystems/udftools/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "fortify" ];
 
-  NIX_CFLAGS_COMPILE = "-std=gnu90";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu90";
 
   preConfigure = ''
     sed -e '1i#include <limits.h>' -i cdrwtool/cdrwtool.c -i pktsetup/pktsetup.c
diff --git a/pkgs/tools/filesystems/wiimms-iso-tools/default.nix b/pkgs/tools/filesystems/wiimms-iso-tools/default.nix
index 70c4450140987..98117c05fdf51 100644
--- a/pkgs/tools/filesystems/wiimms-iso-tools/default.nix
+++ b/pkgs/tools/filesystems/wiimms-iso-tools/default.nix
@@ -18,8 +18,8 @@ stdenv.mkDerivation rec {
     patchShebangs gen-text-file.sh
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
-  INSTALL_PATH = "$out";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
+  env.INSTALL_PATH = "$out";
 
   installPhase = ''
     mkdir "$out"
diff --git a/pkgs/tools/graphics/appleseed/default.nix b/pkgs/tools/graphics/appleseed/default.nix
index a0d659efb3e86..0f3a20b591def 100644
--- a/pkgs/tools/graphics/appleseed/default.nix
+++ b/pkgs/tools/graphics/appleseed/default.nix
@@ -25,7 +25,7 @@ in stdenv.mkDerivation rec {
     osl seexpr
   ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-I${openexr.dev}/include/OpenEXR"
     "-I${ilmbase.dev}/include/OpenEXR"
     "-I${openimageio.dev}/include/OpenImageIO"
diff --git a/pkgs/tools/graphics/asymptote/default.nix b/pkgs/tools/graphics/asymptote/default.nix
index 30a3b9cc98f90..ee29b23c3746c 100644
--- a/pkgs/tools/graphics/asymptote/default.nix
+++ b/pkgs/tools/graphics/asymptote/default.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
     "--with-context=$out/share/texmf/tex/context/third"
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${boehmgc.dev}/include/gc";
+  env.NIX_CFLAGS_COMPILE = "-I${boehmgc.dev}/include/gc";
 
   postInstall = ''
     mv $out/share/info/asymptote/*.info $out/share/info/
diff --git a/pkgs/tools/graphics/directx-shader-compiler/default.nix b/pkgs/tools/graphics/directx-shader-compiler/default.nix
index 6bab32ff27fa0..80a62ab9a8381 100644
--- a/pkgs/tools/graphics/directx-shader-compiler/default.nix
+++ b/pkgs/tools/graphics/directx-shader-compiler/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   configurePhase = ''
     # Requires some additional flags to cmake from a file in the repo
     additionalCMakeFlags=$(< utils/cmake-predefined-config-params)
-    cmakeFlags="$additionalCMakeFlags''${cmakeFlags:+ $cmakeFlags}"
+    cmakeFlags+=($additionalCMakeFlags)
     cmakeConfigurePhase
   '';
 
diff --git a/pkgs/tools/graphics/exifprobe/default.nix b/pkgs/tools/graphics/exifprobe/default.nix
index 7331ac69185ae..53e89ac57acdc 100644
--- a/pkgs/tools/graphics/exifprobe/default.nix
+++ b/pkgs/tools/graphics/exifprobe/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1c1fhc0v1m452lgnfcijnvrc0by06qfbhn3zkliqi60kv8l2isbp";
   };
 
-  CFLAGS = [ "-O2" ];
+  env.CFLAGS = "-O2";
 
   installFlags = [ "DESTDIR=$(out)" ];
 
diff --git a/pkgs/tools/graphics/facedetect/default.nix b/pkgs/tools/graphics/facedetect/default.nix
index 257de05a898ab..aa45fd1fa6874 100644
--- a/pkgs/tools/graphics/facedetect/default.nix
+++ b/pkgs/tools/graphics/facedetect/default.nix
@@ -14,8 +14,6 @@ stdenv.mkDerivation rec {
   buildInputs = [ python2Packages.python python2Packages.wrapPython ];
   pythonPath = [ python2Packages.numpy python2Packages.opencv4 ];
 
-  phases = [ "unpackPhase" "patchPhase" "installPhase" ];
-
   patchPhase = ''
     substituteInPlace facedetect \
       --replace /usr/share/opencv "${python2Packages.opencv4}/share/opencv4"
diff --git a/pkgs/tools/graphics/fim/default.nix b/pkgs/tools/graphics/fim/default.nix
index 252510f805968..6722e1d781923 100644
--- a/pkgs/tools/graphics/fim/default.nix
+++ b/pkgs/tools/graphics/fim/default.nix
@@ -35,7 +35,7 @@ gcc9Stdenv.mkDerivation rec {
     ++ optional jpegSupport libjpeg
     ++ optional pngSupport libpng;
 
-  NIX_CFLAGS_COMPILE = lib.optionalString x11Support "-lSDL";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString x11Support "-lSDL";
 
   meta = with lib; {
     description = "A lightweight, highly customizable and scriptable image viewer";
diff --git a/pkgs/tools/graphics/gifsicle/default.nix b/pkgs/tools/graphics/gifsicle/default.nix
index c05a552f2051c..6c7794d6ecf9b 100644
--- a/pkgs/tools/graphics/gifsicle/default.nix
+++ b/pkgs/tools/graphics/gifsicle/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = optional (!gifview) "--disable-gifview";
 
-  LDFLAGS = optionalString static "-static";
+  env.LDFLAGS = optionalString static "-static";
 
   doCheck = true;
   checkPhase = ''
diff --git a/pkgs/tools/graphics/gnuplot/default.nix b/pkgs/tools/graphics/gnuplot/default.nix
index 2ad99c727d970..0a9ada9834b1c 100644
--- a/pkgs/tools/graphics/gnuplot/default.nix
+++ b/pkgs/tools/graphics/gnuplot/default.nix
@@ -48,7 +48,7 @@ in
     (if aquaterm then "--with-aquaterm" else "--without-aquaterm")
   ];
 
-  CXXFLAGS = lib.optionalString (stdenv.isDarwin && withQt) "-std=c++11";
+  env.CXXFLAGS = lib.optionalString (stdenv.isDarwin && withQt) "-std=c++11";
 
   postInstall = lib.optionalString withX ''
     wrapProgram $out/bin/gnuplot \
diff --git a/pkgs/tools/graphics/ldgallery/viewer/node-composition.nix b/pkgs/tools/graphics/ldgallery/viewer/node-composition.nix
index aaf54a05c8843..7fab15f4164c3 100644
--- a/pkgs/tools/graphics/ldgallery/viewer/node-composition.nix
+++ b/pkgs/tools/graphics/ldgallery/viewer/node-composition.nix
@@ -6,7 +6,7 @@
 
 let
   nodeEnv = import ../../../../development/node-packages/node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile;
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile jq;
     inherit pkgs nodejs;
     libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
   };
diff --git a/pkgs/tools/graphics/optipng/default.nix b/pkgs/tools/graphics/optipng/default.nix
index 72caf6f86aecd..0de4e56f7e11d 100644
--- a/pkgs/tools/graphics/optipng/default.nix
+++ b/pkgs/tools/graphics/optipng/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libpng ];
 
-  LDFLAGS = optional static "-static";
+  env.LDFLAGS = optionalString static "-static";
   # Workaround for crash in cexcept.h. See
   # https://github.com/NixOS/nixpkgs/issues/28106
   preConfigure = ''
@@ -26,13 +26,11 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--with-system-zlib"
     "--with-system-libpng"
-  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    #"-prefix=$out"
   ];
 
-  postInstall = if stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform.isWindows then ''
+  postInstall = optionalString (stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform.isWindows) ''
     mv "$out"/bin/optipng{,.exe}
-  '' else null;
+  '';
 
   meta = with lib; {
     homepage = "http://optipng.sourceforge.net/";
diff --git a/pkgs/tools/graphics/qrcode/default.nix b/pkgs/tools/graphics/qrcode/default.nix
index 93a620b57792e..3bf99a955d48b 100644
--- a/pkgs/tools/graphics/qrcode/default.nix
+++ b/pkgs/tools/graphics/qrcode/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "0v81745nx5gny2g05946k8j553j18a29ikmlyh6c3syq6c15k8cf";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
 
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
 
diff --git a/pkgs/tools/graphics/quirc/default.nix b/pkgs/tools/graphics/quirc/default.nix
index dec2a1020c893..4de3f49909de2 100644
--- a/pkgs/tools/graphics/quirc/default.nix
+++ b/pkgs/tools/graphics/quirc/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
   buildInputs = [ SDL SDL_gfx libjpeg libpng ];
 
   makeFlags = [ "PREFIX=$(out)" ];
-  NIX_CFLAGS_COMPILE = "-I${SDL.dev}/include/SDL -I${SDL_gfx}/include/SDL";
+  env.NIX_CFLAGS_COMPILE = "-I${SDL.dev}/include/SDL -I${SDL_gfx}/include/SDL";
 
   configurePhase = ''
     runHook preConfigure
diff --git a/pkgs/tools/graphics/transfig/default.nix b/pkgs/tools/graphics/transfig/default.nix
index a6c9cd988c071..52c2e2262d555 100644
--- a/pkgs/tools/graphics/transfig/default.nix
+++ b/pkgs/tools/graphics/transfig/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation {
         cp tmpsed transfig/Imakefile
     }
 
-    for i in $patches; do
+    for i in "''${patches[@]}"; do
         header "applying patch $i" 3
         patch -p0 < $i
         stopNest
diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix
index df0983b2d645c..78ca8d8c11151 100644
--- a/pkgs/tools/graphics/zbar/default.nix
+++ b/pkgs/tools/graphics/zbar/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
   ];
 
   # Disable assertions which include -dev QtBase file paths.
-  NIX_CFLAGS_COMPILE = "-DQT_NO_DEBUG";
+  env.NIX_CFLAGS_COMPILE = "-DQT_NO_DEBUG";
 
   configureFlags = [
     "--without-python"
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix
index 5422efb9d38df..5a5fb2da22827 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ fcitx gettext ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-narrowing";
+  env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
 
   preInstall = ''
     substituteInPlace src/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/skk/skk-dicts/default.nix b/pkgs/tools/inputmethods/skk/skk-dicts/default.nix
index bc9aa73c2fc6b..a9fc8c7ed3167 100644
--- a/pkgs/tools/inputmethods/skk/skk-dicts/default.nix
+++ b/pkgs/tools/inputmethods/skk/skk-dicts/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation {
     }
     mkdir -p $out/share
 
-    for src in $srcs; do
+    for src in "''${srcs[@]}"; do
       dst=$out/share/$(dictname $src)
       echo ";;; -*- coding: utf-8 -*-" > $dst  # libskk requires this on the first line
       iconv -f EUC-JP -t UTF-8 $src |\
diff --git a/pkgs/tools/misc/abduco/default.nix b/pkgs/tools/misc/abduco/default.nix
index 9493df1c66c49..c98c1842ab59e 100644
--- a/pkgs/tools/misc/abduco/default.nix
+++ b/pkgs/tools/misc/abduco/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     "cp ${writeText "config.def.h" conf} config.def.h";
 
   installFlags = [ "install-completion" ];
-  CFLAGS = lib.optionalString stdenv.isDarwin "-D_DARWIN_C_SOURCE";
+  env.CFLAGS = lib.optionalString stdenv.isDarwin "-D_DARWIN_C_SOURCE";
 
   meta = with lib; {
     homepage = "http://brain-dump.org/projects/abduco";
diff --git a/pkgs/tools/misc/aescrypt/default.nix b/pkgs/tools/misc/aescrypt/default.nix
index 2a8b8b0b024d9..4bc9cd244b091 100644
--- a/pkgs/tools/misc/aescrypt/default.nix
+++ b/pkgs/tools/misc/aescrypt/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1iziymcbpc64d44djgqfifpblsly4sr5bxsp5g29jgxz552kjlah";
   };
 
-  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-liconv";
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-liconv";
 
   preBuild = ''
     substituteInPlace src/Makefile --replace "CC=gcc" "CC?=gcc"
diff --git a/pkgs/tools/misc/cloud-sql-proxy/default.nix b/pkgs/tools/misc/cloud-sql-proxy/default.nix
index 552ea140d6089..0d5d9a091f77c 100644
--- a/pkgs/tools/misc/cloud-sql-proxy/default.nix
+++ b/pkgs/tools/misc/cloud-sql-proxy/default.nix
@@ -16,7 +16,7 @@ buildGoPackage rec {
 
   goDeps = ./deps.nix;
 
-  buildFlagsArray = [ "-ldflags=" "-X main.versionString=${version}" ];
+  buildFlagsArray = [ "-ldflags=-X main.versionString=${version}" ];
 
   meta = with lib; {
     description = "An authenticating proxy for Second Generation Google Cloud SQL databases";
diff --git a/pkgs/tools/misc/colord/default.nix b/pkgs/tools/misc/colord/default.nix
index 89435332c9cb4..29934d3964553 100644
--- a/pkgs/tools/misc/colord/default.nix
+++ b/pkgs/tools/misc/colord/default.nix
@@ -92,11 +92,11 @@ stdenv.mkDerivation rec {
     glib-compile-schemas $out/share/glib-2.0/schemas
   '';
 
-  PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMUNITDIR = "${placeholder "out"}/lib/systemd/system";
-  PKG_CONFIG_SYSTEMD_SYSTEMDUSERUNITDIR = "${placeholder "out"}/lib/systemd/user";
-  PKG_CONFIG_SYSTEMD_TMPFILESDIR = "${placeholder "out"}/lib/tmpfiles.d";
-  PKG_CONFIG_BASH_COMPLETION_COMPLETIONSDIR= "${placeholder "out"}/share/bash-completion/completions";
-  PKG_CONFIG_UDEV_UDEVDIR = "${placeholder "out"}/lib/udev";
+  env.PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMUNITDIR = "${placeholder "out"}/lib/systemd/system";
+  env.PKG_CONFIG_SYSTEMD_SYSTEMDUSERUNITDIR = "${placeholder "out"}/lib/systemd/user";
+  env.PKG_CONFIG_SYSTEMD_TMPFILESDIR = "${placeholder "out"}/lib/tmpfiles.d";
+  env.PKG_CONFIG_BASH_COMPLETION_COMPLETIONSDIR= "${placeholder "out"}/share/bash-completion/completions";
+  env.PKG_CONFIG_UDEV_UDEVDIR = "${placeholder "out"}/lib/udev";
 
   passthru = {
     tests = {
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index bfe5c5c5045f3..5df742129bdd3 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -20,7 +20,7 @@ assert selinuxSupport -> libselinux != null && libsepol != null;
 
 with lib;
 
-stdenv.mkDerivation (rec {
+stdenv.mkDerivation (foldl recursiveUpdate {} [ rec {
   pname = "coreutils";
   version = "8.32";
 
@@ -115,8 +115,10 @@ stdenv.mkDerivation (rec {
   # man/sha512sum.td/sha512sum’.
   enableParallelBuilding = false;
 
-  NIX_LDFLAGS = optionalString selinuxSupport "-lsepol";
-  FORCE_UNSAFE_CONFIGURE = optionalString stdenv.hostPlatform.isSunOS "1";
+  env = {
+    NIX_LDFLAGS = optionalString selinuxSupport "-lsepol";
+    FORCE_UNSAFE_CONFIGURE = optionalString stdenv.hostPlatform.isSunOS "1";
+  };
 
   # Works around a bug with 8.26:
   # Makefile:3440: *** Recursive variable 'INSTALL' references itself (eventually).  Stop.
@@ -152,9 +154,12 @@ stdenv.mkDerivation (rec {
 
     maintainers = [ maintainers.eelco ];
   };
-} // optionalAttrs stdenv.hostPlatform.isMusl {
+
+}
+(optionalAttrs stdenv.hostPlatform.isMusl {
   # Work around a bogus warning in conjunction with musl.
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 } // lib.optionalAttrs stdenv.hostPlatform.isAndroid {
-  NIX_CFLAGS_COMPILE = "-D__USE_FORTIFY_LEVEL=0";
+  env.NIX_CFLAGS_COMPILE = "-D__USE_FORTIFY_LEVEL=0";
 })
+])
diff --git a/pkgs/tools/misc/dvtm/dvtm.nix b/pkgs/tools/misc/dvtm/dvtm.nix
index 9a42655b7378d..eeb01afd19c70 100644
--- a/pkgs/tools/misc/dvtm/dvtm.nix
+++ b/pkgs/tools/misc/dvtm/dvtm.nix
@@ -3,7 +3,7 @@ stdenv.mkDerivation {
 
   inherit name src patches;
 
-  CFLAGS = lib.optionalString stdenv.isDarwin "-D_DARWIN_C_SOURCE";
+  env.CFLAGS = lib.optionalString stdenv.isDarwin "-D_DARWIN_C_SOURCE";
 
   postPatch = lib.optionalString (customConfig != null) ''
     cp ${builtins.toFile "config.h" customConfig} ./config.h
diff --git a/pkgs/tools/misc/dynamic-colors/default.nix b/pkgs/tools/misc/dynamic-colors/default.nix
index c0ff0fec328a2..1422ded67ca21 100644
--- a/pkgs/tools/misc/dynamic-colors/default.nix
+++ b/pkgs/tools/misc/dynamic-colors/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0i63570z9aqbxa8ixh4ayb3akgjdnlqyl2sbf9d7x8f1pxhk5kd5";
   };
 
-  PREFIX = placeholder "out";
+  env.PREFIX = placeholder "out";
 
   postPatch = ''
     substituteInPlace bin/dynamic-colors \
diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index 89435e7698965..b6871d02fc029 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   patches = lib.optionals stdenv.isDarwin [ ./fix-luajit-darwin.patch ];
 
   # _FORTIFY_SOURCE requires compiling with optimization (-O)
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-O";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-O";
 
   postPatch = ''
     substituteInPlace src/CMakeLists.txt \
diff --git a/pkgs/tools/misc/fontforge/default.nix b/pkgs/tools/misc/fontforge/default.nix
index 5f64057c46c3b..02bbdba6b70e5 100644
--- a/pkgs/tools/misc/fontforge/default.nix
+++ b/pkgs/tools/misc/fontforge/default.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
   '';
 
   # do not use x87's 80-bit arithmetic, rouding errors result in very different font binaries
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-msse2 -mfpmath=sse";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-msse2 -mfpmath=sse";
 
   nativeBuildInputs = [ pkg-config cmake ];
   buildInputs = [
diff --git a/pkgs/tools/misc/gibo/default.nix b/pkgs/tools/misc/gibo/default.nix
index 70d0eb19ca853..6ee4698d750c4 100644
--- a/pkgs/tools/misc/gibo/default.nix
+++ b/pkgs/tools/misc/gibo/default.nix
@@ -11,8 +11,6 @@ stdenv.mkDerivation rec {
     sha256 = "07j3sv9ar9l074krajw8nfmsfmdp836irsbd053dbqk2v880gfm6";
   };
 
-  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
-
   installPhase = ''
     mkdir -p $out/bin $out/share/bash-completion/completions
     cp gibo $out/bin
diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix
index fcf29beb1882c..3158698107950 100644
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "all" ];
 
   # Work around a bug in the generated flex lexer (upstream flex bug?)
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   preConfigure =
     '' for i in "tests/util/"*.in
diff --git a/pkgs/tools/misc/grub/trusted.nix b/pkgs/tools/misc/grub/trusted.nix
index b0a8c9e10338c..ff32e3a691498 100644
--- a/pkgs/tools/misc/grub/trusted.nix
+++ b/pkgs/tools/misc/grub/trusted.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "stackprotector" "pic" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error"; # generated code redefines yyfree
+  env.NIX_CFLAGS_COMPILE = "-Wno-error"; # generated code redefines yyfree
 
   preConfigure =
     '' for i in "tests/util/"*.in
diff --git a/pkgs/tools/misc/ipxe/default.nix b/pkgs/tools/misc/ipxe/default.nix
index 641e86c22c4b6..49f2a563cd74e 100644
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   # not possible due to assembler code
   hardeningDisable = [ "pic" "stackprotector" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   makeFlags =
     [ "ECHO_E_BIN_ECHO=echo" "ECHO_E_BIN_ECHO_E=echo" # No /bin/echo here.
diff --git a/pkgs/tools/misc/ldmtool/default.nix b/pkgs/tools/misc/ldmtool/default.nix
index a826f3a0de542..9d39bbaabb53b 100644
--- a/pkgs/tools/misc/ldmtool/default.nix
+++ b/pkgs/tools/misc/ldmtool/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   '';
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   configureScript = "sh autogen.sh";
 
diff --git a/pkgs/tools/misc/memtest86+/default.nix b/pkgs/tools/misc/memtest86+/default.nix
index 0db6f9f72872d..184f5cef8bcfb 100644
--- a/pkgs/tools/misc/memtest86+/default.nix
+++ b/pkgs/tools/misc/memtest86+/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "0cwx20yja24bfknqh1rjb5rl2c0kwnppzsisg1dibbak0l8mxchk";
   };
 
-  NIX_CFLAGS_COMPILE = "-I. -std=gnu90";
+  env.NIX_CFLAGS_COMPILE = "-I. -std=gnu90";
 
   hardeningDisable = [ "all" ];
 
diff --git a/pkgs/tools/misc/osm2pgsql/default.nix b/pkgs/tools/misc/osm2pgsql/default.nix
index 4d959c6480a29..c4d71cfa10562 100644
--- a/pkgs/tools/misc/osm2pgsql/default.nix
+++ b/pkgs/tools/misc/osm2pgsql/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = [ "-DEXTERNAL_LIBOSMIUM=ON" "-DEXTERNAL_PROTOZERO=ON" ]
     ++ lib.optional withLuaJIT "-DWITH_LUAJIT:BOOL=ON";
 
-  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
+  env.NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
 
   meta = with lib; {
     description = "OpenStreetMap data to PostgreSQL converter";
diff --git a/pkgs/tools/misc/parcellite/default.nix b/pkgs/tools/misc/parcellite/default.nix
index 615e9e528d728..bdc6c1bb8bdef 100644
--- a/pkgs/tools/misc/parcellite/default.nix
+++ b/pkgs/tools/misc/parcellite/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook intltool pkg-config wrapGAppsHook ];
   buildInputs = [ gtk2 hicolor-icon-theme ];
-  NIX_LDFLAGS = "-lgio-2.0";
+  env.NIX_LDFLAGS = "-lgio-2.0";
 
   preFixup = ''
     # Need which and xdotool on path to fix auto-pasting.
diff --git a/pkgs/tools/misc/pipelight/default.nix b/pkgs/tools/misc/pipelight/default.nix
index 96027677fa864..c2a784d8adaed 100644
--- a/pkgs/tools/misc/pipelight/default.nix
+++ b/pkgs/tools/misc/pipelight/default.nix
@@ -19,7 +19,7 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [ wine_custom libX11 libGLU libGL curl ];
 
-  NIX_CFLAGS_COMPILE = [ "-fpermissive" ];
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
 
   patches = [ ./pipelight.patch ];
 
diff --git a/pkgs/tools/misc/qjoypad/default.nix b/pkgs/tools/misc/qjoypad/default.nix
index 7fc578ec85791..2597f5805f993 100644
--- a/pkgs/tools/misc/qjoypad/default.nix
+++ b/pkgs/tools/misc/qjoypad/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   };
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libX11 libXtst qt4 ];
-  NIX_LDFLAGS = "-lX11";
+  env.NIX_LDFLAGS = "-lX11";
   patchPhase = ''
     cd src
     substituteInPlace config --replace /bin/bash ${stdenv.shell}
diff --git a/pkgs/tools/misc/snapper/default.nix b/pkgs/tools/misc/snapper/default.nix
index 8eeee269b07d7..4550dcee24cbe 100644
--- a/pkgs/tools/misc/snapper/default.nix
+++ b/pkgs/tools/misc/snapper/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   postInstall = ''
     rm -r $out/etc/cron.*
diff --git a/pkgs/tools/misc/timidity/default.nix b/pkgs/tools/misc/timidity/default.nix
index 63c4fd36ff6e8..38e72a6df9aec 100644
--- a/pkgs/tools/misc/timidity/default.nix
+++ b/pkgs/tools/misc/timidity/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   configureFlags = [ "--enable-audio=oss,alsa,jack" "--enable-alsaseq" "--with-default-output=alsa" "--enable-ncurses" ];
 
-  NIX_LDFLAGS = "-ljack -L${libjack2}/lib";
+  env.NIX_LDFLAGS = "-ljack -L${libjack2}/lib";
 
   instruments = fetchurl {
     url = "http://www.csee.umbc.edu/pub/midia/instruments.tar.gz";
diff --git a/pkgs/tools/misc/toybox/default.nix b/pkgs/tools/misc/toybox/default.nix
index 25db7e668678d..7281c303ffb4e 100644
--- a/pkgs/tools/misc/toybox/default.nix
+++ b/pkgs/tools/misc/toybox/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
   checkInputs = [ which ]; # used for tests with checkFlags = [ "DEBUG=true" ];
   checkTarget = "tests";
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   meta = with lib; {
     description = "Lightweight implementation of some Unix command line utilities";
diff --git a/pkgs/tools/misc/usbmuxd/default.nix b/pkgs/tools/misc/usbmuxd/default.nix
index d001db4d3cb02..446f66693e5e0 100644
--- a/pkgs/tools/misc/usbmuxd/default.nix
+++ b/pkgs/tools/misc/usbmuxd/default.nix
@@ -15,8 +15,8 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ libimobiledevice libusb1 ];
 
   preConfigure = ''
-    configureFlags="$configureFlags --with-udevrulesdir=$out/lib/udev/rules.d"
-    configureFlags="$configureFlags --with-systemdsystemunitdir=$out/lib/systemd/system"
+    configureFlags+=("--with-udevrulesdir=$out/lib/udev/rules.d")
+    configureFlags+=("--with-systemdsystemunitdir=$out/lib/systemd/system")
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/wimboot/default.nix b/pkgs/tools/misc/wimboot/default.nix
index 04dbca9ed63f2..5e4d4711895e5 100644
--- a/pkgs/tools/misc/wimboot/default.nix
+++ b/pkgs/tools/misc/wimboot/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "134wqqr147az5vbj4szd0xffwa99b4rar7w33zm3119zsn7sd79k";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-address-of-packed-member"; # Fails on gcc9
+  env.NIX_CFLAGS_COMPILE = "-Wno-address-of-packed-member"; # Fails on gcc9
 
   patches = [
     # Fixes for newer binutils
diff --git a/pkgs/tools/misc/wv2/default.nix b/pkgs/tools/misc/wv2/default.nix
index c0f85b4b8de7e..1cff6f3a3fcb7 100644
--- a/pkgs/tools/misc/wv2/default.nix
+++ b/pkgs/tools/misc/wv2/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ libgsf glib libxml2 ];
 
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   meta = {
     description = "Excellent MS Word filter lib, used in most Office suites";
diff --git a/pkgs/tools/misc/wyrd/default.nix b/pkgs/tools/misc/wyrd/default.nix
index 491c362eed40d..710a3e9222d87 100644
--- a/pkgs/tools/misc/wyrd/default.nix
+++ b/pkgs/tools/misc/wyrd/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0zlrg602q781q8dij62lwdprpfliyy9j1rqfqcz8p2wgndpivddj";
   };
 
-  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
+  env.NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
 
   preConfigure = ''
     substituteInPlace curses/curses.ml --replace 'pp gcc' "pp $CC"
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index e5b8d79eeb6d0..86b96bcfca02a 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -39,7 +39,7 @@ buildPythonPackage rec {
         ++ lib.optional ffmpegSupport ffmpeg
         ++ lib.optional rtmpSupport rtmpdump
         ++ lib.optional phantomjsSupport phantomjs2;
-    in [ ''--prefix PATH : "${lib.makeBinPath packagesToBinPath}"'' ];
+    in [ "--prefix" "PATH" ":" (lib.makeBinPath packagesToBinPath) ];
 
   setupPyBuildFlags = [
     "build_lazy_extractors"
diff --git a/pkgs/tools/networking/airfield/node.nix b/pkgs/tools/networking/airfield/node.nix
index 0bcd0eb4b8512..7f2d6b057260b 100644
--- a/pkgs/tools/networking/airfield/node.nix
+++ b/pkgs/tools/networking/airfield/node.nix
@@ -6,7 +6,7 @@
 
 let
   nodeEnv = import ../../../development/node-packages/node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile;
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile jq;
     inherit pkgs nodejs;
     libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
   };
diff --git a/pkgs/tools/networking/altermime/default.nix b/pkgs/tools/networking/altermime/default.nix
index 703af40864ae5..290b37889977c 100644
--- a/pkgs/tools/networking/altermime/default.nix
+++ b/pkgs/tools/networking/altermime/default.nix
@@ -9,7 +9,7 @@ gccStdenv.mkDerivation rec {
     sha256 = "15zxg6spcmd35r6xbidq2fgcg2nzyv1sbbqds08lzll70mqx4pj7";
   };
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=format"
     "-Wno-error=format-truncation"
     "-Wno-error=pointer-compare"
diff --git a/pkgs/tools/networking/argus-clients/default.nix b/pkgs/tools/networking/argus-clients/default.nix
index cd935a5f5d7d7..4534cccae192d 100644
--- a/pkgs/tools/networking/argus-clients/default.nix
+++ b/pkgs/tools/networking/argus-clients/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1c9vj6ma00gqq9h92fg71sxcsjzz912166sdg90ahvnmvmh3l1rj";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
+  env.NIX_CFLAGS_COMPILE = "-I${libtirpc.dev}/include/tirpc";
 
   postPatch = ''
     for file in ./examples/*/*.pl; do
diff --git a/pkgs/tools/networking/atftp/default.nix b/pkgs/tools/networking/atftp/default.nix
index 0e76cb94346b7..c2c246a30250f 100644
--- a/pkgs/tools/networking/atftp/default.nix
+++ b/pkgs/tools/networking/atftp/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ readline tcp_wrappers pcre gcc ];
 
   # Expects pre-GCC5 inline semantics
-  NIX_CFLAGS_COMPILE = "-std=gnu89";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu89";
 
   doCheck = false; # fails
 
diff --git a/pkgs/tools/networking/atinout/default.nix b/pkgs/tools/networking/atinout/default.nix
index 93535531d91bd..4593238a02282 100644
--- a/pkgs/tools/networking/atinout/default.nix
+++ b/pkgs/tools/networking/atinout/default.nix
@@ -4,8 +4,8 @@ stdenv.mkDerivation rec {
   name = "atinout-${version}";
   version = "0.9.2-alpha";
 
-  NIX_CFLAGS_COMPILE = lib.optionalString (!stdenv.cc.isClang) "-Werror=implicit-fallthrough=0";
-  LANG = if stdenv.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (!stdenv.cc.isClang) "-Werror=implicit-fallthrough=0";
+  env.LANG = if stdenv.isDarwin then "en_US.UTF-8" else "C.UTF-8";
   nativeBuildInputs = [ ronn mount ];
 
   src = fetchgit {
diff --git a/pkgs/tools/networking/bsd-finger/default.nix b/pkgs/tools/networking/bsd-finger/default.nix
index 189f636cd1fb4..ebf17fbcc4eb1 100644
--- a/pkgs/tools/networking/bsd-finger/default.nix
+++ b/pkgs/tools/networking/bsd-finger/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "1yhkiv0in588il7f84k2xiy78g9lv12ll0y7047gazhiimk5v244";
   };
 
-  NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
+  env.NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
 
   patches = [ ./ubuntu-0.17-9.patch ];
 
diff --git a/pkgs/tools/networking/bukubrow/default.nix b/pkgs/tools/networking/bukubrow/default.nix
index 157720651f43b..17999cb269a44 100644
--- a/pkgs/tools/networking/bukubrow/default.nix
+++ b/pkgs/tools/networking/bukubrow/default.nix
@@ -1,12 +1,18 @@
-{ lib, rustPlatform, fetchFromGitHub, sqlite }: let
-
-manifest = {
-  description = "Bukubrow extension host application";
-  name = "com.samhh.bukubrow";
-  path = "@out@/bin/bukubrow";
-  type = "stdio";
-};
-
+{ lib, writeText, rustPlatform, fetchFromGitHub, sqlite }:
+
+let
+  manifest = {
+    description = "Bukubrow extension host application";
+    name = "com.samhh.bukubrow";
+    path = "${placeholder "out"}/bin/bukubrow";
+    type = "stdio";
+  };
+  firefoxManifest = writeText "firefox.json" (builtins.toJSON (manifest // {
+    allowed_extensions = [ "bukubrow@samhh.com" ];
+  }));
+  chromeManifest = writeText "chrome.json" (builtins.toJSON (manifest // {
+    allowed_origins = [ "chrome-extension://ghniladkapjacfajiooekgkfopkjblpn/" ];
+  }));
 in rustPlatform.buildRustPackage rec {
   pname = "bukubrow-host";
   version = "5.0.0";
@@ -22,16 +28,9 @@ in rustPlatform.buildRustPackage rec {
 
   buildInputs = [ sqlite ];
 
-  passAsFile = [ "firefoxManifest" "chromeManifest" ];
-  firefoxManifest = builtins.toJSON (manifest // {
-    allowed_extensions = [ "bukubrow@samhh.com" ];
-  });
-  chromeManifest = builtins.toJSON (manifest // {
-    allowed_origins = [ "chrome-extension://ghniladkapjacfajiooekgkfopkjblpn/" ];
-  });
   postBuild = ''
-    substituteAll $firefoxManifestPath firefox.json
-    substituteAll $chromeManifestPath chrome.json
+    install -v ${firefoxManifest} firefox.json
+    install -v ${chromeManifest} chrome.json
   '';
   postInstall = ''
     install -Dm0644 firefox.json $out/lib/mozilla/native-messaging-hosts/com.samhh.bukubrow.json
diff --git a/pkgs/tools/networking/bwm-ng/default.nix b/pkgs/tools/networking/bwm-ng/default.nix
index 26cdfe7c0dbf4..e525100e6a055 100644
--- a/pkgs/tools/networking/bwm-ng/default.nix
+++ b/pkgs/tools/networking/bwm-ng/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
 
   # This code uses inline in the gnu89 sense: see http://clang.llvm.org/compatibility.html#inline
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-std=gnu89";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-std=gnu89";
 
   meta = with lib; {
     description = "A small and simple console-based live network and disk io bandwidth monitor";
diff --git a/pkgs/tools/networking/cjdns/default.nix b/pkgs/tools/networking/cjdns/default.nix
index 474c9d59c9e55..779841d448c6b 100644
--- a/pkgs/tools/networking/cjdns/default.nix
+++ b/pkgs/tools/networking/cjdns/default.nix
@@ -15,10 +15,12 @@ stdenv.mkDerivation rec {
     # for flock
     lib.optional stdenv.isLinux util-linux;
 
-  CFLAGS = "-O2 -Wno-error=stringop-truncation";
+  env.CFLAGS = "-O2 -Wno-error=stringop-truncation";
+
   buildPhase =
     lib.optionalString stdenv.isAarch32 "Seccomp_NO=1 "
     + "bash do";
+
   installPhase = ''
     install -Dt "$out/bin/" cjdroute makekeys privatetopublic publictoip6
     sed -i 's,/usr/bin/env node,'$(type -P node), \
diff --git a/pkgs/tools/networking/clash/default.nix b/pkgs/tools/networking/clash/default.nix
index 61e529dc8729d..51cef9ee5cd26 100644
--- a/pkgs/tools/networking/clash/default.nix
+++ b/pkgs/tools/networking/clash/default.nix
@@ -15,9 +15,8 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [
-    "-ldflags="
-    "-X github.com/Dreamacro/clash/constant.Version=${version}"
+  buildFlags = [
+    "-ldflags=-X github.com/Dreamacro/clash/constant.Version=${version}"
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/connman/connman-ncurses/default.nix b/pkgs/tools/networking/connman/connman-ncurses/default.nix
index 976708c038cd0..9d638c48000a9 100644
--- a/pkgs/tools/networking/connman/connman-ncurses/default.nix
+++ b/pkgs/tools/networking/connman/connman-ncurses/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ dbus ncurses json_c connman ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   installPhase = ''
     mkdir -p "$out/bin"
diff --git a/pkgs/tools/networking/dhcp/default.nix b/pkgs/tools/networking/dhcp/default.nix
index 08b3543c5c04f..ee42b59435f90 100644
--- a/pkgs/tools/networking/dhcp/default.nix
+++ b/pkgs/tools/networking/dhcp/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional stdenv.isLinux "--with-randomdev=/dev/random"
     ++ lib.optionals (openldap != null) [ "--with-ldap" "--with-ldapcrypto" ];
 
-  NIX_CFLAGS_COMPILE = builtins.toString [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=pointer-compare"
     "-Wno-error=format-truncation"
     "-Wno-error=stringop-truncation"
diff --git a/pkgs/tools/networking/dibbler/default.nix b/pkgs/tools/networking/dibbler/default.nix
index 1633505763c6a..b981b5047a18d 100644
--- a/pkgs/tools/networking/dibbler/default.nix
+++ b/pkgs/tools/networking/dibbler/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     "--enable-resolvconf"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-D__APPLE_USE_RFC_2292=1";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-D__APPLE_USE_RFC_2292=1";
 
   meta = with lib; {
     description = "Portable DHCPv6 implementation";
diff --git a/pkgs/tools/networking/dnstracer/default.nix b/pkgs/tools/networking/dnstracer/default.nix
index 597592b4d7cef..88c116604bdcc 100644
--- a/pkgs/tools/networking/dnstracer/default.nix
+++ b/pkgs/tools/networking/dnstracer/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [] ++ lib.optionals stdenv.isDarwin [ libresolv ];
 
-  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-lresolv";
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-lresolv";
 
   meta = with lib; {
     description = "Determines where a given Domain Name Server (DNS) gets its information from, and follows the chain of DNS servers back to the servers which know the data";
diff --git a/pkgs/tools/networking/dropbear/default.nix b/pkgs/tools/networking/dropbear/default.nix
index f922a70344c4e..f7d163f23b0b0 100644
--- a/pkgs/tools/networking/dropbear/default.nix
+++ b/pkgs/tools/networking/dropbear/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = lib.optional enableStatic "LDFLAGS=-static";
 
-  CFLAGS = "-DSFTPSERVER_PATH=\\\"${sftpPath}\\\"";
+  env.CFLAGS = "-DSFTPSERVER_PATH=\\\"${sftpPath}\\\"";
 
   # https://www.gnu.org/software/make/manual/html_node/Libraries_002fSearch.html
   preConfigure = ''
diff --git a/pkgs/tools/networking/dsniff/default.nix b/pkgs/tools/networking/dsniff/default.nix
index 8e641ec83e73e..6966e88127f1c 100644
--- a/pkgs/tools/networking/dsniff/default.nix
+++ b/pkgs/tools/networking/dsniff/default.nix
@@ -60,8 +60,8 @@ in gcc9Stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook rpcsvc-proto ];
   buildInputs = [ glib pcap libtirpc libnsl ];
-  NIX_CFLAGS_LINK = "-lglib-2.0 -lpthread -ldl -ltirpc";
-  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
+  env.NIX_CFLAGS_LINK = "-lglib-2.0 -lpthread -ldl -ltirpc";
+  env.NIX_CFLAGS_COMPILE = "-I${libtirpc.dev}/include/tirpc";
   postPatch = ''
     for patch in debian/patches/*.patch; do
       patch < $patch
diff --git a/pkgs/tools/networking/httplz/default.nix b/pkgs/tools/networking/httplz/default.nix
index eacb598674d20..5214c6afc7d6d 100644
--- a/pkgs/tools/networking/httplz/default.nix
+++ b/pkgs/tools/networking/httplz/default.nix
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
     libiconv darwin.apple_sdk.frameworks.Security
   ];
 
-  cargoBuildFlags = [ "--bin httplz" ];
+  cargoBuildFlags = [ "--bin" "httplz" ];
   cargoPatches = [ ./cargo-lock.patch ];
   cargoSha256 = "1rpwzrr9bvw375vn97y5fqhraqz35d3ani9kfflvn2758x3g8gwf";
 
diff --git a/pkgs/tools/networking/iftop/default.nix b/pkgs/tools/networking/iftop/default.nix
index c3e71e6132de6..5eff668ecb984 100644
--- a/pkgs/tools/networking/iftop/default.nix
+++ b/pkgs/tools/networking/iftop/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   # Explicitly link against libgcc_s, to work around the infamous
   # "libgcc_s.so.1 must be installed for pthread_cancel to work".
-  LDFLAGS = lib.optionalString stdenv.isLinux "-lgcc_s";
+  env.LDFLAGS = lib.optionalString stdenv.isLinux "-lgcc_s";
 
   preConfigure = ''
     cp ${automake}/share/automake*/config.{sub,guess} config
diff --git a/pkgs/tools/networking/innernet/default.nix b/pkgs/tools/networking/innernet/default.nix
index 7a39c250ccf58..67ac535c2086f 100644
--- a/pkgs/tools/networking/innernet/default.nix
+++ b/pkgs/tools/networking/innernet/default.nix
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
   ];
   buildInputs = [ sqlite ] ++ lib.optionals stdenv.isDarwin [ Security libiconv ];
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+  env.LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
 
   postInstall = ''
     installManPage doc/innernet-server.8.gz
diff --git a/pkgs/tools/networking/iodine/default.nix b/pkgs/tools/networking/iodine/default.nix
index 226cfb9ce8ef5..a684f3a580f56 100644
--- a/pkgs/tools/networking/iodine/default.nix
+++ b/pkgs/tools/networking/iodine/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   patchPhase = ''sed -i "s,/sbin/route,${nettools}/bin/route," src/tun.c'';
 
-  NIX_CFLAGS_COMPILE = "-DIFCONFIGPATH=\"${nettools}/bin/\"";
+  env.NIX_CFLAGS_COMPILE = "-DIFCONFIGPATH=\"${nettools}/bin/\"";
 
   installFlags = [ "prefix=\${out}" ];
 
diff --git a/pkgs/tools/networking/libnids/default.nix b/pkgs/tools/networking/libnids/default.nix
index a2cf239b56ba6..63da69bae4317 100644
--- a/pkgs/tools/networking/libnids/default.nix
+++ b/pkgs/tools/networking/libnids/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
   this is necessary for dsniff to compile; otherwise g_thread_init is a missing
   symbol when linking (?!?)
   */
-  NIX_CFLAGS_COMPILE="-Dg_thread_init= ";
+  env.NIX_CFLAGS_COMPILE="-Dg_thread_init= ";
 
   meta = with lib; {
     description = "An E-component of Network Intrusion Detection System which emulates the IP stack of Linux 2.0.x";
diff --git a/pkgs/tools/networking/lsh/default.nix b/pkgs/tools/networking/lsh/default.nix
index b03098d540a38..e5bc5b540c622 100644
--- a/pkgs/tools/networking/lsh/default.nix
+++ b/pkgs/tools/networking/lsh/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     export lsh_cv_sys_unix98_ptys=yes
   '';
 
-  NIX_CFLAGS_COMPILE = "-std=gnu90";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu90";
 
   buildInputs = [ gperf guile gmp zlib liboop readline gnum4 pam ];
 
diff --git a/pkgs/tools/networking/mosh/default.nix b/pkgs/tools/networking/mosh/default.nix
index 92c241967ae0b..926319e2363f8 100644
--- a/pkgs/tools/networking/mosh/default.nix
+++ b/pkgs/tools/networking/mosh/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
       wrapProgram $out/bin/mosh --prefix PERL5LIB : $PERL5LIB
   '';
 
-  CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
+  env.CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
 
   meta = with lib; {
     homepage = "https://mosh.org/";
diff --git a/pkgs/tools/networking/nbd/default.nix b/pkgs/tools/networking/nbd/default.nix
index 6478a15aa1a42..8997f2ccfec7a 100644
--- a/pkgs/tools/networking/nbd/default.nix
+++ b/pkgs/tools/networking/nbd/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   # Glib calls `clock_gettime', which is in librt. Linking that library
   # here ensures that a proper rpath is added to the executable so that
   # it can be loaded at run-time.
-  NIX_LDFLAGS = lib.optionalString stdenv.isLinux "-lrt -lpthread";
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isLinux "-lrt -lpthread";
 
   meta = {
     homepage = "http://nbd.sourceforge.net";
diff --git a/pkgs/tools/networking/networkmanager/iodine/default.nix b/pkgs/tools/networking/networkmanager/iodine/default.nix
index e56d9411b3933..cbf40840b808e 100644
--- a/pkgs/tools/networking/networkmanager/iodine/default.nix
+++ b/pkgs/tools/networking/networkmanager/iodine/default.nix
@@ -33,7 +33,7 @@ in stdenv.mkDerivation {
   nativeBuildInputs = [ intltool autoreconfHook pkg-config ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   preConfigure = "intltoolize";
   configureFlags = [
diff --git a/pkgs/tools/networking/networkmanager/sstp/default.nix b/pkgs/tools/networking/networkmanager/sstp/default.nix
index f486623443807..32fdb6d29c68d 100644
--- a/pkgs/tools/networking/networkmanager/sstp/default.nix
+++ b/pkgs/tools/networking/networkmanager/sstp/default.nix
@@ -40,7 +40,7 @@ in stdenv.mkDerivation {
   '';
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   preConfigure = "intltoolize";
   configureFlags = [
diff --git a/pkgs/tools/networking/networkmanager/strongswan/default.nix b/pkgs/tools/networking/networkmanager/strongswan/default.nix
index cebcec35a314f..83371f6d6c5cf 100644
--- a/pkgs/tools/networking/networkmanager/strongswan/default.nix
+++ b/pkgs/tools/networking/networkmanager/strongswan/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ intltool pkg-config ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   configureFlags = [
     "--without-libnm-glib"
diff --git a/pkgs/tools/networking/nfstrace/default.nix b/pkgs/tools/networking/nfstrace/default.nix
index ca75e50fa5270..6876c4fd350de 100644
--- a/pkgs/tools/networking/nfstrace/default.nix
+++ b/pkgs/tools/networking/nfstrace/default.nix
@@ -33,10 +33,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
 
   # To build with GCC 8+ it needs:
-  CXXFLAGS = "-Wno-class-memaccess -Wno-ignored-qualifiers";
+  env.CXXFLAGS = "-Wno-class-memaccess -Wno-ignored-qualifiers";
   # CMake can't find json_c without:
-  NIX_CFLAGS_COMPILE = [ "-I${json_c.dev}/include/json-c" "-Wno-error=address-of-packed-member" "-I${libtirpc.dev}/include/tirpc" ];
-  NIX_LDFLAGS = [ "-ltirpc" ];
+  env.NIX_CFLAGS_COMPILE = "-I${json_c.dev}/include/json-c -Wno-error=address-of-packed-member -I${libtirpc.dev}/include/tirpc";
+  env.NIX_LDFLAGS = "-ltirpc";
 
   doCheck = false; # requires network access
 
diff --git a/pkgs/tools/networking/ntopng/default.nix b/pkgs/tools/networking/ntopng/default.nix
index 2ba373a2c61cb..8c54a6c32f00c 100644
--- a/pkgs/tools/networking/ntopng/default.nix
+++ b/pkgs/tools/networking/ntopng/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     sed 's|LIBS += -lstdc++.6||' -i Makefile
   '';
 
-  NIX_CFLAGS_COMPILE = "-fpermissive"
+  env.NIX_CFLAGS_COMPILE = "-fpermissive"
     + lib.optionalString stdenv.cc.isClang " -Wno-error=reserved-user-defined-literal";
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/p2p/azureus/builder.sh b/pkgs/tools/networking/p2p/azureus/builder.sh
deleted file mode 100644
index 9d41dba2e439e..0000000000000
--- a/pkgs/tools/networking/p2p/azureus/builder.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-source $stdenv/setup
-
-mkdir -p $out/jars
-cp $src $out/jars/azureus.jar
-
-mkdir -p $out/bin
-cat > $out/bin/azureus <<EOF
-#! $SHELL -e
-azureusHome=$out
-if test -n "\$HOME"; then
-    azureusHome=\$HOME/.Azureus
-fi
-exec $jdk/bin/java -Xms16m -Xmx128m \
-  -cp $out/jars/azureus.jar:$swt/jars/swt.jar \
-  -Djava.library.path=$swt/lib \
-  -Dazureus.install.path=\$azureusHome \
-  org.gudy.azureus2.ui.swt.Main
-EOF
-chmod +x $out/bin/azureus
diff --git a/pkgs/tools/networking/p2p/azureus/default.nix b/pkgs/tools/networking/p2p/azureus/default.nix
index 1c72be0c51006..d463439cf48a9 100644
--- a/pkgs/tools/networking/p2p/azureus/default.nix
+++ b/pkgs/tools/networking/p2p/azureus/default.nix
@@ -2,13 +2,33 @@
 
 stdenv.mkDerivation {
   name = "azureus-2.3.0.6";
-  builder = ./builder.sh;
+
   src = fetchurl {
     url = "http://tarballs.nixos.org/Azureus2.3.0.6.jar";
     sha256 = "1hwrh3n0b0jbpsdk15zrs7pw175418phhmg6pn4xi1bvilxq1wrd";
   };
 
-  inherit jdk swt;
+  dontUnpack = true;
+
+  installPhase = ''
+    mkdir -p $out/jars
+    cp $src $out/jars/azureus.jar
+
+    mkdir -p $out/bin
+    cat > $out/bin/azureus <<EOF
+    #! $SHELL -e
+    azureusHome=$out
+    if test -n "\$HOME"; then
+        azureusHome=\$HOME/.Azureus
+    fi
+    exec ${jdk}/bin/java -Xms16m -Xmx128m \
+      -cp $out/jars/azureus.jar:${swt}/jars/swt.jar \
+      -Djava.library.path=${swt}/lib \
+      -Dazureus.install.path=\$azureusHome \
+      org.gudy.azureus2.ui.swt.Main
+    EOF
+    chmod +x $out/bin/azureus
+  '';
 
   meta = {
     platforms = lib.platforms.linux;
diff --git a/pkgs/tools/networking/packetdrill/default.nix b/pkgs/tools/networking/packetdrill/default.nix
index 861e9c0383bb7..3a38ebb79b0ca 100644
--- a/pkgs/tools/networking/packetdrill/default.nix
+++ b/pkgs/tools/networking/packetdrill/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     export sourceRoot=$(realpath */gtests/net/packetdrill)
   '';
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=unused-result"
     "-Wno-error=stringop-truncation"
     "-Wno-error=address-of-packed-member"
diff --git a/pkgs/tools/networking/pmacct/default.nix b/pkgs/tools/networking/pmacct/default.nix
index 9cb8c0b88f73a..e12d130fa2a49 100644
--- a/pkgs/tools/networking/pmacct/default.nix
+++ b/pkgs/tools/networking/pmacct/default.nix
@@ -19,7 +19,7 @@ assert withSQLite -> sqlite != null;
 assert withPgSQL -> postgresql != null;
 assert withMysql -> libmysqlclient != null;
 
-let inherit (lib) getDev optional optionalString; in
+let inherit (lib) getDev optional optionals optionalString; in
 
 stdenv.mkDerivation rec {
   version = "1.7.5";
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     ++ optional withNflog libnetfilter_log
     ++ optional withSQLite sqlite
     ++ optional withPgSQL postgresql
-    ++ optional withMysql [ libmysqlclient zlib ];
+    ++ optionals withMysql [ libmysqlclient zlib ];
 
   MYSQL_CONFIG =
     optionalString withMysql "${getDev libmysqlclient}/bin/mysql_config";
diff --git a/pkgs/tools/networking/ripmime/default.nix b/pkgs/tools/networking/ripmime/default.nix
index 0dfeb900c9a86..2032c591bf371 100644
--- a/pkgs/tools/networking/ripmime/default.nix
+++ b/pkgs/tools/networking/ripmime/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/bin" "$out/share/man/man1"
   '';
 
-  NIX_CFLAGS_COMPILE=" -Wno-error ";
+  env.NIX_CFLAGS_COMPILE=" -Wno-error ";
 
   meta = with lib; {
     description = "Attachment extractor for MIME messages";
diff --git a/pkgs/tools/networking/siege/default.nix b/pkgs/tools/networking/siege/default.nix
index 3a7e64623afd2..c41a8ffdb16ca 100644
--- a/pkgs/tools/networking/siege/default.nix
+++ b/pkgs/tools/networking/siege/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "0xzjfljhv9wcf58qw2c1sbpa5nqz1pb6rjpgvz7bxrv90n31bghx";
   };
 
-  NIX_LDFLAGS = lib.optionalString stdenv.isLinux "-lgcc_s";
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isLinux "-lgcc_s";
 
   buildInputs = [
     openssl
diff --git a/pkgs/tools/networking/sipsak/default.nix b/pkgs/tools/networking/sipsak/default.nix
index 5562049728603..c039147a60ad0 100644
--- a/pkgs/tools/networking/sipsak/default.nix
+++ b/pkgs/tools/networking/sipsak/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     c-ares
   ];
 
-  NIX_CFLAGS_COMPILE = "--std=gnu89";
+  env.NIX_CFLAGS_COMPILE = "--std=gnu89";
 
   src = fetchurl {
     url = "https://github.com/sipwise/sipsak/archive/mr${version}.tar.gz";
diff --git a/pkgs/tools/networking/snabb/default.nix b/pkgs/tools/networking/snabb/default.nix
index affe6577eb802..06d367049fc63 100644
--- a/pkgs/tools/networking/snabb/default.nix
+++ b/pkgs/tools/networking/snabb/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=stringop-truncation" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=stringop-truncation";
 
   patchPhase = ''
     patchShebangs .
diff --git a/pkgs/tools/networking/ssmtp/default.nix b/pkgs/tools/networking/ssmtp/default.nix
index 6957d43e79131..72bf0122dd346 100644
--- a/pkgs/tools/networking/ssmtp/default.nix
+++ b/pkgs/tools/networking/ssmtp/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
 
   buildInputs = lib.optional tlsSupport openssl;
 
-  NIX_LDFLAGS = lib.optionalString tlsSupport "-lcrypto";
+  env.NIX_LDFLAGS = lib.optionalString tlsSupport "-lcrypto";
 
   meta = with lib; {
     platforms = platforms.linux;
diff --git a/pkgs/tools/networking/strongswan/default.nix b/pkgs/tools/networking/strongswan/default.nix
index 67df00b8e694b..d1d83759c701b 100644
--- a/pkgs/tools/networking/strongswan/default.nix
+++ b/pkgs/tools/networking/strongswan/default.nix
@@ -103,7 +103,7 @@ stdenv.mkDerivation rec {
     echo "include /etc/ipsec.secrets" >> $out/etc/ipsec.secrets
   '';
 
-  NIX_LDFLAGS = optionalString stdenv.cc.isGNU "-lgcc_s" ;
+  env.NIX_LDFLAGS = optionalString stdenv.cc.isGNU "-lgcc_s" ;
 
   meta = {
     description = "OpenSource IPsec-based VPN Solution";
diff --git a/pkgs/tools/networking/tracebox/default.nix b/pkgs/tools/networking/tracebox/default.nix
index 3d50b11f8e1ae..29e077c0414b2 100644
--- a/pkgs/tools/networking/tracebox/default.nix
+++ b/pkgs/tools/networking/tracebox/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-lua=yes" ];
 
-  NIX_LDFLAGS = "${libpcap}/lib/libpcap.so ${libcrafter}/lib/libcrafter.so";
+  env.NIX_LDFLAGS = "${libpcap}/lib/libpcap.so ${libcrafter}/lib/libcrafter.so";
 
   preAutoreconf = ''
     substituteInPlace Makefile.am --replace "noinst" ""
diff --git a/pkgs/tools/networking/trickle/default.nix b/pkgs/tools/networking/trickle/default.nix
index 8a5143d1e3bd0..e612df7c14437 100644
--- a/pkgs/tools/networking/trickle/default.nix
+++ b/pkgs/tools/networking/trickle/default.nix
@@ -18,8 +18,8 @@ stdenv.mkDerivation rec {
     sed -i '/#define in_addr_t/ s:^://:' config.h
   '';
 
-  NIX_LDFLAGS = [ "-levent" "-ltirpc" ];
-  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
+  env.NIX_LDFLAGS = "-levent -ltirpc";
+  env.NIX_CFLAGS_COMPILE = "-I${libtirpc.dev}/include/tirpc";
 
   configureFlags = [ "--with-libevent" ];
 
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index a0c774fb7341a..3b96561a04daf 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
     # This avoids gnutls.out -> unbound.lib -> openssl.out.
     # There was some problem with this on Darwin; let's not complicate non-Linux.
     ''
-      configureFlags="$configureFlags --with-nettle=${nettle.dev} --with-libunbound-only"
+      configureFlags+=("--with-nettle=${nettle.dev}" "--with-libunbound-only")
       configurePhase
       buildPhase
       installPhase
diff --git a/pkgs/tools/networking/uwimap/default.nix b/pkgs/tools/networking/uwimap/default.nix
index e675268163acc..e94959ae29a97 100644
--- a/pkgs/tools/networking/uwimap/default.nix
+++ b/pkgs/tools/networking/uwimap/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation ({
     sed -i src/osdep/unix/Makefile -e 's,^SSLLIB=.*,SSLLIB=${openssl.out}/lib,'
   '';
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin
     "-I${openssl.dev}/include/openssl";
 
   installPhase = ''
diff --git a/pkgs/tools/networking/wrk/default.nix b/pkgs/tools/networking/wrk/default.nix
index 4298bd70d600d..a91d5a22fd6cd 100644
--- a/pkgs/tools/networking/wrk/default.nix
+++ b/pkgs/tools/networking/wrk/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
+  env.NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/nix/cached-nix-shell/default.nix b/pkgs/tools/nix/cached-nix-shell/default.nix
index 853bf87346f24..fb2ec5485e57a 100644
--- a/pkgs/tools/nix/cached-nix-shell/default.nix
+++ b/pkgs/tools/nix/cached-nix-shell/default.nix
@@ -24,7 +24,7 @@ in rustPlatform.buildRustPackage rec {
   # The BLAKE3 C library is intended to be built by the project depending on it
   # rather than as a standalone library.
   # https://github.com/BLAKE3-team/BLAKE3/blob/0.3.1/c/README.md#building
-  BLAKE3_CSRC = "${blake3-src}/c";
+  env.BLAKE3_CSRC = "${blake3-src}/c";
 
   nativeBuildInputs = [ ronn ];
 
diff --git a/pkgs/tools/package-management/apk-tools/default.nix b/pkgs/tools/package-management/apk-tools/default.nix
index c8b2ce0030144..1345feff91d11 100644
--- a/pkgs/tools/package-management/apk-tools/default.nix
+++ b/pkgs/tools/package-management/apk-tools/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     "PKGCONFIGDIR=$(out)/lib/pkgconfig"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=unused-result" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/package-management/disnix/DisnixWebService/default.nix b/pkgs/tools/package-management/disnix/DisnixWebService/default.nix
index 8a4d5d44b8dd2..daff22a61edd7 100644
--- a/pkgs/tools/package-management/disnix/DisnixWebService/default.nix
+++ b/pkgs/tools/package-management/disnix/DisnixWebService/default.nix
@@ -7,10 +7,10 @@ stdenv.mkDerivation {
     sha256 = "02jxbgn9a0c9cr6knzp78bp9wiywzczy89wav7yxhg79vff8a1gr";
   };
   buildInputs = [ apacheAnt jdk ];
-  PREFIX = "\${env.out}";
-  AXIS2_LIB = "${axis2}/lib";
-  AXIS2_WEBAPP = "${axis2}/webapps/axis2";
-  DBUS_JAVA_LIB = "${dbus_java}/share/java";
+  env.PREFIX = "\${env.out}";
+  env.AXIS2_LIB = "${axis2}/lib";
+  env.AXIS2_WEBAPP = "${axis2}/webapps/axis2";
+  env.DBUS_JAVA_LIB = "${dbus_java}/share/java";
   prePatch = ''
     sed -i -e "s|#JAVA_HOME=|JAVA_HOME=${jdk}|" \
        -e "s|#AXIS2_LIB=|AXIS2_LIB=${axis2}/lib|" \
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 159fc5b39c128..8159a2b28e6df 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -34,8 +34,6 @@ common =
 
       is24 = lib.versionAtLeast version "2.4pre";
 
-      VERSION_SUFFIX = suffix;
-
       outputs = [ "out" "dev" "man" "doc" ];
 
       nativeBuildInputs =
@@ -71,7 +69,7 @@ common =
       propagatedBuildInputs = [ boehmgc ];
 
       # Seems to be required when using std::atomic with 64-bit types
-      NIX_LDFLAGS =
+      env.NIX_LDFLAGS =
         # need to list libraries individually until
         # https://github.com/NixOS/nix/commit/3e85c57a6cbf46d5f0fe8a89b368a43abd26daba
         # is in a release
diff --git a/pkgs/tools/package-management/nixui/nixui.nix b/pkgs/tools/package-management/nixui/nixui.nix
index 0bcd0eb4b8512..7f2d6b057260b 100644
--- a/pkgs/tools/package-management/nixui/nixui.nix
+++ b/pkgs/tools/package-management/nixui/nixui.nix
@@ -6,7 +6,7 @@
 
 let
   nodeEnv = import ../../../development/node-packages/node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile;
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile jq;
     inherit pkgs nodejs;
     libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
   };
diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index f942efe6dd7b8..b5e0660130db2 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ popt nss db bzip2 libarchive libbfd ]
     ++ lib.optional stdenv.isLinux elfutils;
 
-  NIX_CFLAGS_COMPILE = "-I${nspr.dev}/include/nspr -I${nss.dev}/include/nss";
+  env.NIX_CFLAGS_COMPILE = "-I${nspr.dev}/include/nspr -I${nss.dev}/include/nss";
 
   configureFlags = [
     "--with-external-db"
diff --git a/pkgs/tools/package-management/xbps/default.nix b/pkgs/tools/package-management/xbps/default.nix
index 46aaf4a94d66c..05d5910a5c225 100644
--- a/pkgs/tools/package-management/xbps/default.nix
+++ b/pkgs/tools/package-management/xbps/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./cert-paths.patch ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
 
   postPatch = ''
     # fix unprefixed ranlib (needed on cross)
diff --git a/pkgs/tools/security/bitwarden_rs/default.nix b/pkgs/tools/security/bitwarden_rs/default.nix
index e3d43374558d6..fbe956fcceb6e 100644
--- a/pkgs/tools/security/bitwarden_rs/default.nix
+++ b/pkgs/tools/security/bitwarden_rs/default.nix
@@ -4,7 +4,7 @@
 , dbBackend ? "sqlite", libmysqlclient, postgresql }:
 
 let
-  featuresFlag = "--features ${dbBackend}";
+  featuresFlags = [ "--features" dbBackend ];
 
 in rustPlatform.buildRustPackage rec {
   pname = "bitwarden_rs";
@@ -23,15 +23,15 @@ in rustPlatform.buildRustPackage rec {
     ++ optional (dbBackend == "mysql") libmysqlclient
     ++ optional (dbBackend == "postgresql") postgresql;
 
-  RUSTC_BOOTSTRAP = 1;
+  env.RUSTC_BOOTSTRAP = 1;
 
   cargoSha256 = "139by5y2ma3v52nabzr5man1qy395rchs2dlivkj9xi829kg4mcr";
-  cargoBuildFlags = [ featuresFlag ];
+  cargoBuildFlags = featuresFlags;
 
   checkPhase = ''
     runHook preCheck
-    echo "Running cargo cargo test ${featuresFlag} -- ''${checkFlags} ''${checkFlagsArray+''${checkFlagsArray[@]}}"
-    cargo test ${featuresFlag} -- ''${checkFlags} ''${checkFlagsArray+"''${checkFlagsArray[@]}"}
+    echo "Running cargo cargo test ${toString featuresFlags} -- "''${checkFlags[@]}" ''${checkFlagsArray+''${checkFlagsArray[@]}}"
+    cargo test ${toString featuresFlags} -- "''${checkFlags[@]}" ''${checkFlagsArray+"''${checkFlagsArray[@]}"}
     runHook postCheck
   '';
 
diff --git a/pkgs/tools/security/browserpass/default.nix b/pkgs/tools/security/browserpass/default.nix
index 9aec14e0a418b..016763ef1b319 100644
--- a/pkgs/tools/security/browserpass/default.nix
+++ b/pkgs/tools/security/browserpass/default.nix
@@ -25,7 +25,7 @@ buildGoModule rec {
     sed -i -e 's/INSTALL :=.*/INSTALL := install/' Makefile
   '';
 
-  DESTDIR = placeholder "out";
+  env.DESTDIR = placeholder "out";
 
   postConfigure = ''
     make configure
diff --git a/pkgs/tools/security/chaps/default.nix b/pkgs/tools/security/chaps/default.nix
index 2f89c3ea58581..874a7d24a2bef 100644
--- a/pkgs/tools/security/chaps/default.nix
+++ b/pkgs/tools/security/chaps/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     sha256 = "0chk6pnn365d5kcz6vfqx1d0383ksk97icc0lzg0vvb0kvyj0ff1";
   };
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = [
     # readdir_r(3) is deprecated in glibc >= 2.24
     "-Wno-error=deprecated-declarations"
     # gcc8 catching polymorphic type error
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index fbb9c421e3539..5a1bc30f3266b 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -22,7 +22,7 @@ python3.pkgs.buildPythonApplication rec {
 
   patches = lib.optionals withDriver [ ./ko-path.diff ./compile-ko.diff ];
 
-  KSRC = lib.optionalString withDriver "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+  env.KSRC = lib.optionalString withDriver "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
 
   nativeBuildInputs = [
     libelf
diff --git a/pkgs/tools/security/doas/default.nix b/pkgs/tools/security/doas/default.nix
index 7da3b8e9f0683..d703eea51e5c3 100644
--- a/pkgs/tools/security/doas/default.nix
+++ b/pkgs/tools/security/doas/default.nix
@@ -23,10 +23,9 @@ stdenv.mkDerivation rec {
   dontDisableStatic = true;
 
   configureFlags = [
-    (lib.optionalString withTimestamp "--with-timestamp") # to allow the "persist" setting
-    (lib.optionalString (!withPAM) "--without-pam")
     "--pamdir=${placeholder "out"}/etc/pam.d"
-  ];
+  ] ++ lib.optional withTimestamp "--with-timestamp" # to allow the "persist" setting
+    ++ lib.optional (!withPAM) "--without-pam";
 
   patches = [
     # Allow doas to discover binaries in /run/current-system/sw/{s,}bin and
diff --git a/pkgs/tools/security/gnupg/1compat.nix b/pkgs/tools/security/gnupg/1compat.nix
index 371a7ca67afde..a756f491ba412 100644
--- a/pkgs/tools/security/gnupg/1compat.nix
+++ b/pkgs/tools/security/gnupg/1compat.nix
@@ -3,8 +3,9 @@
 stdenv.mkDerivation {
   name = "gnupg1compat-${gnupg.version}";
 
-  builder = writeScript "gnupg1compat-builder" ''
-    PATH=${coreutils}/bin
+  dontUnpack = true;
+
+  installPhase = ''
     # First symlink all top-level dirs
     mkdir -p $out
     ln -s "${gnupg}/"* $out
@@ -20,6 +21,8 @@ stdenv.mkDerivation {
       [[ -e ''${f%2} ]] && continue # ignore commands that already have non-*2 versions
       ln -s -- "''${f##*/}" "''${f%2}"
     done
+
+    rm $out/lib
   '';
 
   meta = gnupg.meta // {
diff --git a/pkgs/tools/security/gorilla-bin/default.nix b/pkgs/tools/security/gorilla-bin/default.nix
index 68aa7c4881984..228271742c640 100644
--- a/pkgs/tools/security/gorilla-bin/default.nix
+++ b/pkgs/tools/security/gorilla-bin/default.nix
@@ -11,7 +11,6 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ patchelf makeWrapper ];
-  phases = [ "unpackPhase" "installPhase" ];
 
   unpackCmd = ''
     mkdir gorilla;
diff --git a/pkgs/tools/security/gpgstats/default.nix b/pkgs/tools/security/gpgstats/default.nix
index f6f6d36781096..c2c5dc05794ac 100644
--- a/pkgs/tools/security/gpgstats/default.nix
+++ b/pkgs/tools/security/gpgstats/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     cp gpgstats $out/bin
   '';
 
-  NIX_CFLAGS_COMPILE = lib.optionalString (!stdenv.is64bit)
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (!stdenv.is64bit)
     "-D_FILE_OFFSET_BITS=64 -DLARGEFILE_SOURCE=1";
 
   meta = with lib; {
diff --git a/pkgs/tools/security/haka/default.nix b/pkgs/tools/security/haka/default.nix
index 809902e889766..7c541ad7cc680 100644
--- a/pkgs/tools/security/haka/default.nix
+++ b/pkgs/tools/security/haka/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
     sha256 = "0dm39g3k77sa70zrjsqadidg27a6iqq61jzfdxazpllnrw4mjy4w";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   preConfigure = ''
     sed -i 's,/etc,'$out'/etc,' src/haka/haka.c
diff --git a/pkgs/tools/security/krunner-pass/default.nix b/pkgs/tools/security/krunner-pass/default.nix
index 7904235b86a47..305d03f125a6e 100644
--- a/pkgs/tools/security/krunner-pass/default.nix
+++ b/pkgs/tools/security/krunner-pass/default.nix
@@ -29,9 +29,7 @@ mkDerivation rec {
     ./pass-path.patch
   ];
 
-  CXXFLAGS = [
-    ''-DNIXPKGS_PASS=\"${lib.getBin pass}/bin/pass\"''
-  ];
+  env.CXXFLAGS = ''-DNIXPKGS_PASS=\"${lib.getBin pass}/bin/pass\"'';
 
   meta = with lib; {
     description = "Integrates krunner with pass the unix standard password manager (https://www.passwordstore.org/)";
diff --git a/pkgs/tools/security/nasty/default.nix b/pkgs/tools/security/nasty/default.nix
index b3b19c9268bfc..7ad8da99fc4f3 100644
--- a/pkgs/tools/security/nasty/default.nix
+++ b/pkgs/tools/security/nasty/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   # does not apply cleanly with patchPhase/fetchpatch
   # https://sources.debian.net/src/nasty/0.6-3/debian/patches/02_add_largefile_support.patch
-  CFLAGS = "-D_FILE_OFFSET_BITS=64";
+  env.CFLAGS = "-D_FILE_OFFSET_BITS=64";
 
   buildInputs = [ gpgme ];
 
diff --git a/pkgs/tools/security/opensc/default.nix b/pkgs/tools/security/opensc/default.nix
index 51e0c1f58f93e..f9289ce01f01f 100644
--- a/pkgs/tools/security/opensc/default.nix
+++ b/pkgs/tools/security/opensc/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   ++ lib.optional stdenv.isDarwin Carbon
   ++ (if withApplePCSC then [ PCSC ] else [ pcsclite ]);
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   configureFlags = [
     "--enable-zlib"
diff --git a/pkgs/tools/security/pcsc-cyberjack/default.nix b/pkgs/tools/security/pcsc-cyberjack/default.nix
index 40736cdc86bad..b420263c209b2 100644
--- a/pkgs/tools/security/pcsc-cyberjack/default.nix
+++ b/pkgs/tools/security/pcsc-cyberjack/default.nix
@@ -23,7 +23,7 @@ in stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=narrowing";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=narrowing";
 
   configureFlags = [
     "--with-usbdropdir=${placeholder "out"}/pcsc/drivers"
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index 5e308fd25ca54..83807eb807475 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -52,8 +52,15 @@ stdenv.mkDerivation rec {
         #undef _PATH_MV
         #define _PATH_MV "${coreutils}/bin/mv"
       EOF
-      makeFlags="install_uid=$(id -u) install_gid=$(id -g)"
-      installFlags="sudoers_uid=$(id -u) sudoers_gid=$(id -g) sysconfdir=$out/etc rundir=$TMPDIR/dummy vardir=$TMPDIR/dummy DESTDIR=/"
+      makeFlagsArray+=("install_uid=$(id -u)" "install_gid=$(id -g)")
+      installFlagsArray+=(
+        "sudoers_uid=$(id -u)"
+        "sudoers_gid=$(id -g)"
+        "sysconfdir=$out/etc"
+        "rundir=$TMPDIR/dummy"
+        "vardir=$TMPDIR/dummy"
+        "DESTDIR=/"
+      )
     '';
 
   nativeBuildInputs = [ groff ];
diff --git a/pkgs/tools/security/super/default.nix b/pkgs/tools/security/super/default.nix
index f8e78c66979fd..dea154fc93c57 100644
--- a/pkgs/tools/security/super/default.nix
+++ b/pkgs/tools/security/super/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
+  env.NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
 
   configureFlags = [
     "--sysconfdir=/etc"
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index 2e1e1ae2a67b6..e45c731d3a0fe 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
   configureFlags = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
     "--disable-tool-name-check";
 
-  NIX_CFLAGS_LINK = lib.optionalString stdenv.cc.isGNU "-lgcc_s";
+  env.NIX_CFLAGS_LINK = lib.optionalString stdenv.cc.isGNU "-lgcc_s";
 
   postPatch = ''
     substituteInPlace contrib/client-tools/torify \
diff --git a/pkgs/tools/security/trousers/default.nix b/pkgs/tools/security/trousers/default.nix
index 16536409b5e6f..9e20e5f773d7b 100644
--- a/pkgs/tools/security/trousers/default.nix
+++ b/pkgs/tools/security/trousers/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-usercheck" ];
 
-  NIX_CFLAGS_COMPILE = [ "-DALLOW_NON_TSS_CONFIG_FILE" ];
+  env.NIX_CFLAGS_COMPILE = "-DALLOW_NON_TSS_CONFIG_FILE";
   enableParallelBuilding = true;
 
   meta = with lib; {
diff --git a/pkgs/tools/system/acpica-tools/default.nix b/pkgs/tools/system/acpica-tools/default.nix
index 36ad8ff06e389..ca6723581966a 100644
--- a/pkgs/tools/system/acpica-tools/default.nix
+++ b/pkgs/tools/system/acpica-tools/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0z19bniqsa8y0n1qrxmb6gz7m63jpwx22zgk5ablyriixhfpz07v";
   };
 
-  NIX_CFLAGS_COMPILE = "-O3";
+  env.NIX_CFLAGS_COMPILE = "-O3";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/system/clinfo/default.nix b/pkgs/tools/system/clinfo/default.nix
index 9c5b54f554bd8..7aa0f4728bbac 100644
--- a/pkgs/tools/system/clinfo/default.nix
+++ b/pkgs/tools/system/clinfo/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ocl-icd opencl-headers ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=stringop-overflow"
     "-Wno-error=stringop-truncation"
   ];
diff --git a/pkgs/tools/system/ddrescueview/default.nix b/pkgs/tools/system/ddrescueview/default.nix
index 6c8e9c56cdc97..0e0821dad511a 100644
--- a/pkgs/tools/system/ddrescueview/default.nix
+++ b/pkgs/tools/system/ddrescueview/default.nix
@@ -19,7 +19,7 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [ atk cairo gdk-pixbuf glib gtk2 libX11 pango ];
 
-  NIX_LDFLAGS = "--as-needed -rpath ${lib.makeLibraryPath buildInputs}";
+  env.NIX_LDFLAGS = "--as-needed -rpath ${lib.makeLibraryPath buildInputs}";
 
   buildPhase = ''
     lazbuild --lazarusdir=${lazarus}/share/lazarus ddrescueview.lpi
diff --git a/pkgs/tools/system/efivar/default.nix b/pkgs/tools/system/efivar/default.nix
index c92b28e7f5eaf..b30f653e9388e 100644
--- a/pkgs/tools/system/efivar/default.nix
+++ b/pkgs/tools/system/efivar/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   ];
   # We have no LTO here since commit 22284b07.  With GCC 10 that triggers a warning.
   postPatch = "sed '/^OPTIMIZE /s/-flto//' -i Make.defaults";
-  NIX_CFLAGS_COMPILE = "-Wno-error=stringop-truncation";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=stringop-truncation";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ popt ];
diff --git a/pkgs/tools/system/facter/default.nix b/pkgs/tools/system/facter/default.nix
index d1d18809a5b5f..c0c55e2f37a7b 100644
--- a/pkgs/tools/system/facter/default.nix
+++ b/pkgs/tools/system/facter/default.nix
@@ -11,16 +11,15 @@ stdenv.mkDerivation rec {
     owner = "puppetlabs";
   };
 
-  CXXFLAGS = lib.optionalString stdenv.cc.isGNU "-fpermissive -Wno-error=catch-value";
-  NIX_LDFLAGS = lib.optionalString stdenv.isLinux "-lblkid";
+  env.CXXFLAGS = lib.optionalString stdenv.cc.isGNU "-fpermissive -Wno-error=catch-value";
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isLinux "-lblkid";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   cmakeFlags = [
     "-DFACTER_RUBY=${ruby}/lib/libruby${stdenv.hostPlatform.extensions.sharedLibrary}"
     "-DRUBY_LIB_INSTALL=${placeholder "out"}/lib/ruby"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
-
   nativeBuildInputs = [ cmake ];
   buildInputs = [ boost cpp-hocon curl leatherman libwhereami libyamlcpp openssl ruby util-linux ];
 
diff --git a/pkgs/tools/system/gdmap/default.nix b/pkgs/tools/system/gdmap/default.nix
index d9c639ab1c419..aa487d219814f 100644
--- a/pkgs/tools/system/gdmap/default.nix
+++ b/pkgs/tools/system/gdmap/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  NIX_LDFLAGS = "-lm";
+  env.NIX_LDFLAGS = "-lm";
 
   meta = with lib; {
     homepage = "http://gdmap.sourceforge.net";
diff --git a/pkgs/tools/system/hardinfo/default.nix b/pkgs/tools/system/hardinfo/default.nix
index 15c8cbd12f069..4a6a20a1beb91 100644
--- a/pkgs/tools/system/hardinfo/default.nix
+++ b/pkgs/tools/system/hardinfo/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "all" ];
 
   # Ignore undefined references to a bunch of libsoup symbols
-  NIX_LDFLAGS = "--unresolved-symbol=ignore-all";
+  env.NIX_LDFLAGS = "--unresolved-symbol=ignore-all";
 
   preConfigure = ''
     patchShebangs configure
diff --git a/pkgs/tools/system/hardlink/default.nix b/pkgs/tools/system/hardlink/default.nix
index a790c600a9d33..5277a950f1e7b 100644
--- a/pkgs/tools/system/hardlink/default.nix
+++ b/pkgs/tools/system/hardlink/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
   };
 
   buildInputs = [ pcre2 ];
-  NIX_CFLAGS_LINK = "-lpcre2-8";
+  env.NIX_CFLAGS_LINK = "-lpcre2-8";
 
   buildPhase = ''
     $CC -O2 hardlink.c -o hardlink $NIX_CFLAGS_LINK
diff --git a/pkgs/tools/system/ipmiutil/default.nix b/pkgs/tools/system/ipmiutil/default.nix
index 4efc8024cc4ae..8f65a7843cdc3 100644
--- a/pkgs/tools/system/ipmiutil/default.nix
+++ b/pkgs/tools/system/ipmiutil/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     sed -e "s@/var@$out/var@g" -i Makefile */Makefile */*/Makefile
   '';
 
-  NIX_CFLAGS_COMPILE = "-fno-stack-protector";
+  env.NIX_CFLAGS_COMPILE = "-fno-stack-protector";
 
   meta = with lib; {
     description = "An easy-to-use IPMI server management utility";
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index d1fa401d4e069..69c2e946e1968 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -41,7 +41,7 @@ in stdenv.mkDerivation rec {
     ./no-files-in-etc-and-var.patch
   ];
 
-  NIX_CFLAGS_COMPILE = optionalString withDebug "-O1 -ggdb -DNETDATA_INTERNAL_CHECKS=1";
+  env.NIX_CFLAGS_COMPILE = optionalString withDebug "-O1 -ggdb -DNETDATA_INTERNAL_CHECKS=1";
 
   postInstall = ''
     ln -s ${go-d-plugin}/lib/netdata/conf.d/* $out/lib/netdata/conf.d
diff --git a/pkgs/tools/system/opencl-info/default.nix b/pkgs/tools/system/opencl-info/default.nix
index d5fd86f231ab9..045568a7f5eea 100644
--- a/pkgs/tools/system/opencl-info/default.nix
+++ b/pkgs/tools/system/opencl-info/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ opencl-clhpp ocl-icd ];
 
-  NIX_LDFLAGS = "-lOpenCL";
+  env.NIX_LDFLAGS = "-lOpenCL";
 
   installPhase = ''
     install -Dm755 opencl-info $out/bin/opencl-info
diff --git a/pkgs/tools/system/plan9port/builder.sh b/pkgs/tools/system/plan9port/builder.sh
index b5196e512f418..b77ad62d1fbf0 100644
--- a/pkgs/tools/system/plan9port/builder.sh
+++ b/pkgs/tools/system/plan9port/builder.sh
@@ -1,3 +1,4 @@
+source .attrs.sh
 source $stdenv/setup
 
 export PLAN9=$out/plan9
diff --git a/pkgs/tools/system/rowhammer-test/default.nix b/pkgs/tools/system/rowhammer-test/default.nix
index 9afb1933e17fb..9ddb6037c04dd 100644
--- a/pkgs/tools/system/rowhammer-test/default.nix
+++ b/pkgs/tools/system/rowhammer-test/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "1fbfcnm5gjish47wdvikcsgzlb5vnlfqlzzm6mwiw2j5qkq0914i";
   };
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-Wno-error=format";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-Wno-error=format";
 
   buildPhase = "sh -e make.sh";
 
diff --git a/pkgs/tools/system/stress-ng/default.nix b/pkgs/tools/system/stress-ng/default.nix
index 2e1c4e3a1fa48..ad2ffecefa663 100644
--- a/pkgs/tools/system/stress-ng/default.nix
+++ b/pkgs/tools/system/stress-ng/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     "BASHDIR=${placeholder "out"}/share/bash-completion/completions"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isMusl "-D_LINUX_SYSINFO_H=1";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isMusl "-D_LINUX_SYSINFO_H=1";
 
   # Won't build on i686 because the binary will be linked again in the
   # install phase without checking the dependencies. This will prevent
diff --git a/pkgs/tools/system/testdisk/default.nix b/pkgs/tools/system/testdisk/default.nix
index 10cbed470689a..a487d4af79e10 100644
--- a/pkgs/tools/system/testdisk/default.nix
+++ b/pkgs/tools/system/testdisk/default.nix
@@ -41,7 +41,7 @@ assert enableQt -> qwt != null;
 
   nativeBuildInputs = [ pkg-config ];
 
-  NIX_CFLAGS_COMPILE="-Wno-unused";
+  env.NIX_CFLAGS_COMPILE="-Wno-unused";
 
   meta = with lib; {
     homepage = "https://www.cgsecurity.org/wiki/Main_Page";
diff --git a/pkgs/tools/system/vboot_reference/default.nix b/pkgs/tools/system/vboot_reference/default.nix
index b4b92b8f90fb6..c740c1d0515c8 100644
--- a/pkgs/tools/system/vboot_reference/default.nix
+++ b/pkgs/tools/system/vboot_reference/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   patches = [ ./dont_static_link.patch ];
 
   # fix build with gcc9
-  NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   postPatch = ''
     substituteInPlace Makefile \
diff --git a/pkgs/tools/text/kytea/default.nix b/pkgs/tools/text/kytea/default.nix
index 9cbc2c030a455..322fa77ebad67 100644
--- a/pkgs/tools/text/kytea/default.nix
+++ b/pkgs/tools/text/kytea/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./gcc-O3.patch ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
 
   meta = with lib; {
     homepage = "http://www.phontron.com/kytea/";
diff --git a/pkgs/tools/text/multitran/libmtquery/default.nix b/pkgs/tools/text/multitran/libmtquery/default.nix
index 3b7dd681e8aee..a1626f6b9a47b 100644
--- a/pkgs/tools/text/multitran/libmtquery/default.nix
+++ b/pkgs/tools/text/multitran/libmtquery/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ libmtsupport libfacet libbtree multitrandata ];
 
-  NIX_LDFLAGS = "-lbtree";
+  env.NIX_LDFLAGS = "-lbtree";
 
   patchPhase = ''
     sed -i -e 's@\$(DESTDIR)/usr@'$out'@' \
diff --git a/pkgs/tools/text/ripgrep/default.nix b/pkgs/tools/text/ripgrep/default.nix
index 61c24ae39e4d8..773b5e8ebbe76 100644
--- a/pkgs/tools/text/ripgrep/default.nix
+++ b/pkgs/tools/text/ripgrep/default.nix
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "03wf9r2csi6jpa7v5sw5lpxkrk4wfzwmzx7k3991q3bdjzcwnnwp";
 
-  cargoBuildFlags = lib.optional withPCRE2 "--features pcre2";
+  cargoBuildFlags = lib.optionals withPCRE2 [ "--features" "pcre2" ];
 
   nativeBuildInputs = [ asciidoctor installShellFiles ]
     ++ lib.optional withPCRE2 pkg-config;
diff --git a/pkgs/tools/text/sgml/jade/default.nix b/pkgs/tools/text/sgml/jade/default.nix
index 338520b4df2bb..32bd2e97b083a 100644
--- a/pkgs/tools/text/sgml/jade/default.nix
+++ b/pkgs/tools/text/sgml/jade/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ gnum4 ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-deprecated";
+  env.NIX_CFLAGS_COMPILE = "-Wno-deprecated";
 
   preInstall = ''
     install -d -m755 "$out"/lib
diff --git a/pkgs/tools/text/silver-searcher/default.nix b/pkgs/tools/text/silver-searcher/default.nix
index 8cd67b99263c4..0aa57c8388231 100644
--- a/pkgs/tools/text/silver-searcher/default.nix
+++ b/pkgs/tools/text/silver-searcher/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./bash-completion.patch ];
 
-  NIX_LDFLAGS = lib.optionalString stdenv.isLinux "-lgcc_s";
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isLinux "-lgcc_s";
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ pcre zlib xz ];
diff --git a/pkgs/tools/text/smu/default.nix b/pkgs/tools/text/smu/default.nix
index 854e70c7622b8..7d3511f49c3ee 100644
--- a/pkgs/tools/text/smu/default.nix
+++ b/pkgs/tools/text/smu/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   # _FORTIFY_SOURCE requires compiling with optimization (-O)
-  NIX_CFLAGS_COMPILE = "-O";
+  env.NIX_CFLAGS_COMPILE = "-O";
 
   makeFlags = [
     "PREFIX=${placeholder "out"}"
diff --git a/pkgs/tools/typesetting/sile/default.nix b/pkgs/tools/typesetting/sile/default.nix
index 92062b8eac8a2..8d0d1ab665a46 100644
--- a/pkgs/tools/typesetting/sile/default.nix
+++ b/pkgs/tools/typesetting/sile/default.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
     sed -i -e 's|@import AppKit;|#import <AppKit/AppKit.h>|' src/macfonts.m
   '';
 
-  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework AppKit";
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework AppKit";
 
   FONTCONFIG_FILE = makeFontsConf {
     fontDirectories = [
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index 32fba9a8e1f35..da9664da15f0d 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -184,7 +184,7 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
         fi
 
         mkdir -p "$path" && cd "$path"
-        "../../../$path/configure" $configureFlags $extraConfig
+        "../../../$path/configure" ''${configureFlags[@]} $extraConfig
 
         if [[ "$path" =~ "libs/pplib" ]]; then
           # TODO: revert for texlive 2022
@@ -213,8 +213,8 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
     "xetex"
   ];
   postInstall = ''
-    for output in $outputs; do
-      mkdir -p "''${!output}/bin"
+    for output in ''${outputs[@]}; do
+      mkdir -p "$output/bin"
     done
 
     mv "$out/bin"/{inimf,mf,mf-nowin} "$metafont/bin/"
diff --git a/pkgs/tools/video/mjpegtools/default.nix b/pkgs/tools/video/mjpegtools/default.nix
index 45f63dc7727d5..a2ce5dc13bc09 100644
--- a/pkgs/tools/video/mjpegtools/default.nix
+++ b/pkgs/tools/video/mjpegtools/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libdv libjpeg libpng ]
               ++ lib.optionals (!withMinimal) [ gtk2 libX11 SDL SDL_gfx ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString (!withMinimal) "-I${SDL.dev}/include/SDL";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (!withMinimal) "-I${SDL.dev}/include/SDL";
 
   postPatch = ''
     sed -i -e '/ARCHFLAGS=/s:=.*:=:' configure
diff --git a/pkgs/tools/video/swfmill/default.nix b/pkgs/tools/video/swfmill/default.nix
index c5e777f7531e9..e3cafe0f46b2a 100644
--- a/pkgs/tools/video/swfmill/default.nix
+++ b/pkgs/tools/video/swfmill/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   };
 
   # Fixes build with GCC 6
-  NIX_CFLAGS_COMPILE = "-std=c++03";
+  env.NIX_CFLAGS_COMPILE = "-std=c++03";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libxslt freetype libpng libxml2 ];
diff --git a/pkgs/tools/virtualization/cloud-init/default.nix b/pkgs/tools/virtualization/cloud-init/default.nix
index dfd3321b6b62d..550acdf05c044 100644
--- a/pkgs/tools/virtualization/cloud-init/default.nix
+++ b/pkgs/tools/virtualization/cloud-init/default.nix
@@ -59,7 +59,7 @@ buildPythonApplication rec {
   ];
 
   makeWrapperArgs = [
-    "--prefix PATH : ${lib.makeBinPath [
+    "--prefix" "PATH" ":" "${lib.makeBinPath [
       dmidecode cloud-utils.guest
     ]}/bin"
   ];
diff --git a/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix b/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix
index 0718e437b06b2..132394e78eee8 100644
--- a/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix
+++ b/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix
@@ -28,8 +28,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ curl.dev pam ];
 
-  NIX_CFLAGS_COMPILE = "-I${json_c.dev}/include/json-c";
-  NIX_CFLAGS_LINK = "-L${json_c}/lib";
+  env.NIX_CFLAGS_COMPILE = "-I${json_c.dev}/include/json-c";
+  env.NIX_CFLAGS_LINK = "-L${json_c}/lib";
 
   makeFlags = [
     "VERSION=${version}"
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 1889370cc31f7..720386653ebaf 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -921,8 +921,7 @@ mapAliases ({
   callPackage_i686 = pkgsi686Linux.callPackage;
 
   inherit (ocaml-ng) # added 2016-09-14
-    ocamlPackages_4_00_1 ocamlPackages_4_01_0 ocamlPackages_4_02
-    ocamlPackages_4_03
+    ocamlPackages_4_01_0 ocamlPackages_4_02
     ocamlPackages_latest;
 
   # added 2019-08-01
@@ -939,10 +938,8 @@ mapAliases ({
   zeromq3 = throw "zeromq3 has been deprecated by zeromq4.";
   jzmq = throw "jzmq has been removed from nixpkgs, as it was unmaintained";
 } // (with ocaml-ng; { # added 2016-09-14
-  ocaml_4_00_1 = ocamlPackages_4_00_1.ocaml;
   ocaml_4_01_0 = ocamlPackages_4_01_0.ocaml;
   ocaml_4_02   = ocamlPackages_4_02.ocaml;
-  ocaml_4_03   = ocamlPackages_4_03.ocaml;
 }) // {
 
   # added 2019-10-28
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a3ef9e0df2a6a..382ae1fb5eed2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11452,8 +11452,6 @@ in
 
   orocos-kdl = callPackage ../development/libraries/orocos-kdl { };
 
-  metaocaml_3_09 = callPackage ../development/compilers/ocaml/metaocaml-3.09.nix { };
-
   ber_metaocaml = callPackage ../development/compilers/ocaml/ber-metaocaml.nix { };
 
   ocaml_make = callPackage ../development/ocaml-modules/ocamlmake { };
@@ -11463,7 +11461,7 @@ in
   ocsigen-i18n = callPackage ../development/tools/ocaml/ocsigen-i18n { };
 
   opa = callPackage ../development/compilers/opa {
-    ocamlPackages = ocaml-ng.ocamlPackages_4_04;
+    ocamlPackages = ocaml-ng.ocamlPackages_4_05;
   };
 
   opaline = callPackage ../development/tools/ocaml/opaline { };
@@ -16712,7 +16710,8 @@ in
     inherit (libxml2) passthru;
     # the hook to find catalogs is hidden by buildEnv
     postBuild = ''
-      mkdir "$out/nix-support"
+      out="''${outputs[out]}"
+      mkdir -p "$out/nix-support"
       cp '${libxml2.dev}/nix-support/propagated-build-inputs' "$out/nix-support/"
     '';
   };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index b58fe1f4294ea..aa7639b322f84 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1477,16 +1477,10 @@ let
 in let inherit (pkgs) callPackage; in rec
 {
 
-  ocamlPackages_4_00_1 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.00.1.nix { });
-
   ocamlPackages_4_01_0 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.01.0.nix { });
 
   ocamlPackages_4_02 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.02.nix { });
 
-  ocamlPackages_4_03 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.03.nix { });
-
-  ocamlPackages_4_04 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.04.nix { });
-
   ocamlPackages_4_05 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.05.nix { });
 
   ocamlPackages_4_06 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.06.nix { });
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 7bcdf6190c854..e97a704c3de56 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -686,7 +686,7 @@ let
     };
     buildInputs = [ PodParser ];
     propagatedBuildInputs = [ AppPackager FileLoadLines IOString ImageInfo PDFAPI2 StringInterpolateNamed TextLayout ]
-      ++ lib.optional (!stdenv.isDarwin) [ Wx ];
+      ++ lib.optional (!stdenv.isDarwin) Wx;
     nativeBuildInputs = lib.optional stdenv.isDarwin shortenPerlShebang;
     postInstall = lib.optionalString stdenv.isDarwin ''
       shortenPerlShebang $out/bin/chordpro
@@ -941,8 +941,8 @@ let
       sha256 = "0jk3djnk6yf0jsjh8qk3mj8bkx4avp6i4czcpr5xrbf7f41744l3";
     };
     buildInputs = [ pkgs.zlib TestWarn ];
-    NIX_CFLAGS_COMPILE = "-I${pkgs.zlib.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.zlib.out}/lib -lz";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.zlib.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.zlib.out}/lib -lz";
     meta = {
       description = "Fast C metadata and tag reader for all common audio file formats";
       license = lib.licenses.gpl2;
@@ -4045,8 +4045,8 @@ let
       sha256 = "0f5gdprcql4kwzgxl2s6ngcfg1jl45lzcqh7dkv5bkwlwmxa9rsi";
     };
     buildInputs = [ pkgs.gmp DevelChecklib TestRequires ];
-    NIX_CFLAGS_COMPILE = "-I${pkgs.gmp.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.gmp.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
   };
 
   CryptDSA = buildPerlPackage {
@@ -4344,8 +4344,8 @@ let
       url = "mirror://cpan/authors/id/M/MG/MGREGORO/Crypt-Sodium-0.11.tar.gz";
       sha256 = "0y3c24zv4iwnvlf9zwxambk8ddram54fm6l1m5yhbskc0nhp6z4h";
     };
-    NIX_CFLAGS_COMPILE = "-I${pkgs.libsodium.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.libsodium.out}/lib -lsodium";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.libsodium.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.libsodium.out}/lib -lsodium";
     meta = {
       homepage = "https://metacpan.org/release/Crypt-Sodium";
       description = "Perl bindings for libsodium (NaCL)";
@@ -4403,8 +4403,8 @@ let
       url = "mirror://cpan/authors/id/T/TT/TTAR/Crypt-OpenSSL-AES-0.02.tar.gz";
       sha256 = "b66fab514edf97fc32f58da257582704a210c2b35e297d5c31b7fa2ffd08e908";
     };
-    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
     meta = with lib; {
       description = "Perl wrapper around OpenSSL's AES library";
       license = with licenses; [ artistic1 gpl1Plus ];
@@ -4418,8 +4418,8 @@ let
       url = "mirror://cpan/authors/id/K/KM/KMX/Crypt-OpenSSL-Bignum-0.09.tar.gz";
       sha256 = "1p22znbajq91lbk2k3yg12ig7hy5b4vy8igxwqkmbm4nhgxp4ki3";
     };
-    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
   };
 
   CryptOpenSSLGuess = buildPerlPackage {
@@ -4443,8 +4443,8 @@ let
       url = "mirror://cpan/authors/id/R/RU/RURBAN/Crypt-OpenSSL-Random-0.15.tar.gz";
       sha256 = "1x6ffps8q7mnawmcfq740llzy7i10g3319vap0wiw4d33fm6z1zh";
     };
-    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
     buildInputs = [ CryptOpenSSLGuess ];
   };
 
@@ -4456,8 +4456,8 @@ let
       sha256 = "4173403ad4cf76732192099f833fbfbf3cd8104e0246b3844187ae384d2c5436";
     };
     propagatedBuildInputs = [ CryptOpenSSLRandom ];
-    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
     buildInputs = [ CryptOpenSSLGuess ];
   };
 
@@ -4468,8 +4468,8 @@ let
       url = "mirror://cpan/authors/id/J/JO/JONASBN/Crypt-OpenSSL-X509-1.813.tar.gz";
       sha256 = "684bd888d2ed4c748f8f6dd8e87c14afa2974b12ee01faa082ad9cfa1e321e62";
     };
-    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
     meta = {
       homepage = "https://github.com/dsully/perl-crypt-openssl-x509";
       description = "Perl extension to OpenSSL's X509 API";
@@ -4603,7 +4603,7 @@ let
       sha256 = "086vaj4wh5473hbp5f4amk6l0yzm66yxdcd2znz5pcqrmpiplw3l";
     };
     propagatedBuildInputs = [ pkgs.ncurses ];
-    NIX_CFLAGS_LINK = "-lncurses";
+    env.NIX_CFLAGS_LINK = "-lncurses";
     meta = {
       description = "Perl bindings to ncurses";
       license = lib.licenses.artistic1;
@@ -5830,7 +5830,7 @@ let
       sha256 = "1k6n261nrrcll9wxn5xwi4ibpavqv1il96687k62mbpznzl2gx37";
     };
 
-    SYBASE = pkgs.freetds;
+    env.SYBASE = toString pkgs.freetds;
 
     buildInputs = [ pkgs.freetds ];
     propagatedBuildInputs = [ DBI ];
@@ -11435,7 +11435,7 @@ let
       sha256 = "312940c1f60f47c4fc93fa0a9d2a626425faa837040c8c2f1ad58ee09f62f371";
     };
     buildInputs = [ pkgs.acl ];
-    NIX_CFLAGS_LINK = "-L${pkgs.acl.out}/lib -lacl";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.acl.out}/lib -lacl";
     meta = {
       maintainers = teams.deshaw.members;
       description = "Perl extension for reading and setting Access Control Lists for files by libacl linux library";
@@ -12483,8 +12483,8 @@ let
     };
     buildInputs = [ pkgs.gmp ];
     doCheck = false;
-    NIX_CFLAGS_COMPILE = "-I${pkgs.gmp.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.gmp.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
     propagatedBuildInputs = [ MathBigInt ];
   };
 
@@ -12529,8 +12529,8 @@ let
       sha256 = "0psmpj3j8cw02b5bzb7qnkd4rcpxm82891rwpdi2hx2jxy0mznhn";
     };
     buildInputs = [ pkgs.gmp AlienGMP ];
-    NIX_CFLAGS_COMPILE = "-I${pkgs.gmp.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.gmp.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
     meta = {
       description = "High speed arbitrary size integer math";
       license = with lib.licenses; [ lgpl21Plus ];
@@ -12545,7 +12545,7 @@ let
       sha256 = "f4459ed32fb9bb793e2504fd442c515fd468a4a34d2a1f98e46ca41e275c73cb";
     };
     buildInputs = [ pkgs.gmp ];
-    NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
     meta = {
       homepage = "https://github.com/sisyphus/math-gmpz";
       description = "Perl interface to the GMP integer functions";
@@ -12649,8 +12649,8 @@ let
       sha256 = "2697c7fd5c7e35fdec7f50ed56a67be807a2f22657589e637dad3592744003be";
     };
     buildInputs = [ pkgs.gmp ];
-    NIX_CFLAGS_COMPILE = "-I${pkgs.gmp.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.gmp.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
     meta = {
       homepage = "https://github.com/danaj/Math-Prime-Util-GMP";
       description = "Utilities related to prime numbers, using GMP";
@@ -14974,7 +14974,7 @@ let
     };
     buildInputs = [ ModuleBuildXSUtil TestException TestFatal TestLeakTrace TestOutput TestRequires TryTiny ];
     perlPreHook = "export LD=$CC";
-    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-fno-stack-protector";
+    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-fno-stack-protector";
     hardeningDisable = lib.optional stdenv.isi686 "stackprotector";
   };
 
@@ -16208,8 +16208,8 @@ let
     # fix "error: format not a string literal and no format arguments [-Werror=format-security]"
     hardeningDisable = [ "format" ];
     # Make the async API accessible
-    NIX_CFLAGS_COMPILE = "-DTHREADED";
-    NIX_CFLAGS_LINK = "-L${pkgs.zookeeper_mt.out}/lib -lzookeeper_mt";
+    env.NIX_CFLAGS_COMPILE = "-DTHREADED";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.zookeeper_mt.out}/lib -lzookeeper_mt";
     # Most tests are skipped as no server is available in the sandbox.
     # `t/35_log.t` seems to suffer from a race condition; remove it.  See
     # https://github.com/NixOS/nixpkgs/pull/104889#issuecomment-737144513
@@ -16692,8 +16692,8 @@ let
       sha256 = "17f6i16jv6ci6459vh6y3sz94vgcvykjjszcl4xsykryakjvf8i7";
     };
     buildInputs = [ pkgs.pcsclite ];
-    nativeBuildInputs = [ pkgs.pkg-config ];
-    NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.pcsclite}/lib -lpcsclite";
+    nativeBuildInputs = [ pkgs.pkgconfig ];
+    env.NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.pcsclite}/lib -lpcsclite";
     # tests fail; look unfinished
     doCheck = false;
     meta = {
@@ -16891,7 +16891,7 @@ let
       sha256 = "4848679a3f201e3f3b0c5f6f9526e602af52923ffa471a2a3657db786bd3bdc5";
     };
     buildInputs = [ pkgs.zlib ];
-    NIX_CFLAGS_LINK = "-L${pkgs.zlib.out}/lib -lz";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.zlib.out}/lib -lz";
     meta = {
       description = "Perl extension to provide a PerlIO layer to gzip/gunzip";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
@@ -19988,11 +19988,11 @@ let
       sha256 = "9a08f7a4013c9b865541c10dbba1210779eb9128b961250b746d26702bab6925";
     };
     buildInputs = [ pkgs.readline pkgs.ncurses ];
-    NIX_CFLAGS_LINK = "-lreadline -lncursesw";
+    env.NIX_CFLAGS_LINK = "-lreadline -lncursesw";
 
     # For some crazy reason Makefile.PL doesn't generate a Makefile if
     # AUTOMATED_TESTING is set.
-    AUTOMATED_TESTING = false;
+    env.AUTOMATED_TESTING = false;
 
     # Makefile.PL looks for ncurses in Glibc's prefix.
     preConfigure =
@@ -21747,8 +21747,8 @@ let
     };
     propagatedBuildInputs = [ pkgs.aspell ];
     ASPELL_CONF = "dict-dir ${pkgs.aspellDicts.en}/lib/aspell";
-    NIX_CFLAGS_COMPILE = "-I${pkgs.aspell}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.aspell}/lib -laspell";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.aspell}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.aspell}/lib -laspell";
   };
 
   TextAutoformat = buildPerlPackage {
@@ -22318,7 +22318,7 @@ let
       sha256 = "0avk50kia78kxryh2whmaj5l18q2wvmkdyqyjsf6kwr4kgy6x3i7";
     };
     # https://rt.cpan.org/Public/Bug/Display.html?id=124815
-    NIX_CFLAGS_COMPILE = "-DHAS_VPRINTF";
+    env.NIX_CFLAGS_COMPILE = "-DHAS_VPRINTF";
   };
 
   TextUnidecode = buildPerlPackage {
@@ -23288,7 +23288,7 @@ let
         name = "WWWCurl-curl-7.71.0.patch";
       })
     ];
-    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-return-type";
+    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-return-type";
     buildInputs = [ pkgs.curl ];
     doCheck = false; # performs network access
   };
@@ -23455,7 +23455,7 @@ let
       sha256 = "1dq89bh6fqv7l5mbffqcismcljpq5f869bx7g8lg698zgindv5ny";
     };
     buildInputs = [ pkgs.xlibsWrapper ];
-    NIX_CFLAGS_LINK = "-lX11";
+    env.NIX_CFLAGS_LINK = "-lX11";
     doCheck = false; # requires an X server
   };
 
@@ -23483,7 +23483,7 @@ let
       sha256 = "0jznws68skdzkhgkgcgjlj40qdyh9i75r7fw8bqzy406f19xxvnw";
     };
     buildInputs = [ pkgs.xlibsWrapper pkgs.xorg.libXtst pkgs.xorg.libXi ];
-    NIX_CFLAGS_LINK = "-lX11 -lXext -lXtst";
+    env.NIX_CFLAGS_LINK = "-lX11 -lXext -lXtst";
     doCheck = false; # requires an X server
   };
 
@@ -23494,10 +23494,10 @@ let
       url = "mirror://cpan/authors/id/M/MS/MSTPLBG/X11-XCB-0.18.tar.gz";
       sha256 = "1cjpghw7cnackw20lbd7yzm222kz5bnrwz52f8ay24d1f4pwrnxf";
     };
-    AUTOMATED_TESTING = false;
+    env.AUTOMATED_TESTING = false;
     buildInputs = [ pkgs.xorg.libxcb pkgs.xorg.xcbproto pkgs.xorg.xcbutil pkgs.xorg.xcbutilwm ExtUtilsDepends ExtUtilsPkgConfig TestDeep TestException XSObjectMagic ];
     propagatedBuildInputs = [ DataDump MouseXNativeTraits XMLDescent XMLSimple ];
-    NIX_CFLAGS_LINK = "-lxcb -lxcb-util -lxcb-xinerama -lxcb-icccm";
+    env.NIX_CFLAGS_LINK = "-lxcb -lxcb-util -lxcb-xinerama -lxcb-icccm";
     doCheck = false; # requires an X server
     meta = {
       description = "XCB bindings for X";
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 6aa23a22713a1..c43a57056228e 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -514,7 +514,7 @@ lib.makeScope pkgs.newScope (self: with self; {
       { name = "xmlreader";
         buildInputs = [ libxml2 ];
         internalDeps = [ php.extensions.dom ];
-        NIX_CFLAGS_COMPILE = [ "-I../.." "-DHAVE_DOM" ];
+        env.NIX_CFLAGS_COMPILE = "-I../.. -DHAVE_DOM";
         configureFlags = [ "--enable-xmlreader" ]
           # Required to build on darwin.
           ++ lib.optionals (lib.versionOlder php.version "7.4") [ "--with-libxml-dir=${libxml2.dev}" ]; }
diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index 77f3cc677f656..8662e8b59f5ec 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -70,10 +70,13 @@ let
     };
 
   trivialBuilders = self: super:
-    import ../build-support/trivial-builders.nix {
-      inherit lib; inherit (self) stdenv stdenvNoCC; inherit (self.pkgsBuildHost.xorg) lndir;
-      inherit (self) runtimeShell;
-    };
+    let
+      jq = self.pkgsBuildHost.jq.override { minimal = true; };
+    in
+      import ../build-support/trivial-builders.nix {
+        inherit lib; inherit (self) stdenv stdenvNoCC; inherit (self.pkgsBuildHost.xorg) lndir;
+        inherit (self) runtimeShell; inherit jq;
+      };
 
   stdenvBootstappingAndPlatforms = self: super: let
     withFallback = thisPkgs: