wrapCC, wrapBintools: use absolute paths

pkgs/applications/audio/famistudio/build-native-wrapper.nix

@@ -33,7 +33,7 @@ stdenv.mkDerivation {
       --replace-quiet 'g++' "$CXX"
 
     # Replacing gcc via sed, would break -static-libgcc otherwise
-    sed -i -e "s/^gcc/$CC/g" build.sh
+    sed -i -e "s/^gcc/''${CC//[\/\\&$'\n']/\\&}/g" build.sh
   '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
     # Darwin rebuild scripts try to make a universal2 dylib
     # - build dylib for non-hostPlatform

pkgs/applications/science/logic/aiger/default.nix

@@ -12,6 +12,8 @@ stdenv.mkDerivation rec {
   patches = [
     # Fix implicit declaration of `isatty`, which is an error with newer versions of clang.
     ./fix-missing-header.patch
+    # Fixes sed replacements when $CC (or other variables) contain special characters.
+    ./fix-configure-sed.patch
   ];
 
   enableParallelBuilding = true;
@@ -22,7 +24,7 @@ stdenv.mkDerivation rec {
     ln -s ${picosat}/include/picosat/picosat.h ../picosat/picosat.h
     ln -s ${picosat}/lib/picosat.o             ../picosat/picosat.o
     ln -s ${picosat}/share/picosat.version     ../picosat/VERSION
-    ./configure.sh
+    bash configure.sh
   '';
 
   installPhase = ''

pkgs/applications/science/logic/aiger/fix-configure-sed.patch

@@ -0,0 +1,48 @@
+Fixes sed replacements when variables contain special replacement string
+characters ('\', '&' and separator '/').
+
+diff -u a/configure.sh b/configure.sh
+--- a/configure.sh
++++ b/configure.sh
+@@ -131,21 +131,27 @@
+   wrn "no proper '../lingeling' nor '../picosat' (will not build 'aigbmc' nor 'aigdep')"
+ fi
+
++# Use Bash to quote replacement string for sed.
++# https://gist.github.com/tie/7e81aaa4b357c486abc197bdbe00f27c
++function quoteSedReplacement() {
++  echo "${!1//[\/\\&$'\n']/\\&}"
++}
++
+ msg "compiling with: $CC $CFLAGS"
+ rm -f makefile
+ sed \
+-  -e "s/@CC@/$CC/" \
+-  -e "s/@CFLAGS@/$CFLAGS/" \
+-  -e "s/@AIGBMCTARGET@/$AIGBMCTARGET/" \
+-  -e "s/@AIGBMCTARGET@/$AIGBMCTARGET/" \
+-  -e "s,@AIGBMCHDEPS@,$AIGBMCHDEPS," \
+-  -e "s,@AIGBMCODEPS@,$AIGBMCODEPS," \
+-  -e "s,@AIGBMCLIBS@,$AIGBMCLIBS," \
+-  -e "s,@AIGBMCFLAGS@,$AIGBMCFLAGS," \
+-  -e "s/@AIGDEPTARGET@/$AIGDEPTARGET/" \
+-  -e "s/@AIGDEPTARGET@/$AIGDEPTARGET/" \
+-  -e "s,@AIGDEPHDEPS@,$AIGDEPHDEPS," \
+-  -e "s,@AIGDEPCODEPS@,$AIGDEPCODEPS," \
+-  -e "s,@AIGDEPLIBS@,$AIGDEPLIBS," \
+-  -e "s,@AIGDEPFLAGS@,$AIGDEPFLAGS," \
++  -e "s/@CC@/$(quoteSedReplacement CC)/" \
++  -e "s/@CFLAGS@/$(quoteSedReplacement CFLAGS)/" \
++  -e "s/@AIGBMCTARGET@/$(quoteSedReplacement AIGBMCTARGET)/" \
++  -e "s/@AIGBMCTARGET@/$(quoteSedReplacement AIGBMCTARGET)/" \
++  -e "s/@AIGBMCHDEPS@/$(quoteSedReplacement AIGBMCHDEPS)/" \
++  -e "s/@AIGBMCODEPS@/$(quoteSedReplacement AIGBMCODEPS)/" \
++  -e "s/@AIGBMCLIBS@/$(quoteSedReplacement AIGBMCLIBS)/" \
++  -e "s/@AIGBMCFLAGS@/$(quoteSedReplacement AIGBMCFLAGS)/" \
++  -e "s/@AIGDEPTARGET@/$(quoteSedReplacement AIGDEPTARGET)/" \
++  -e "s/@AIGDEPTARGET@/$(quoteSedReplacement AIGDEPTARGET)/" \
++  -e "s/@AIGDEPHDEPS@/$(quoteSedReplacement AIGDEPHDEPS)/" \
++  -e "s/@AIGDEPCODEPS@/$(quoteSedReplacement AIGDEPCODEPS)/" \
++  -e "s/@AIGDEPLIBS@/$(quoteSedReplacement AIGDEPLIBS)/" \
++  -e "s/@AIGDEPFLAGS@/$(quoteSedReplacement AIGDEPFLAGS)/" \
+   makefile.in > makefile

pkgs/applications/science/logic/fast-downward/default.nix

@@ -27,12 +27,6 @@ stdenv.mkDerivation rec {
     python build.py release
   '';
 
-  postPatch = ''
-    # Needed because the package tries to be too smart.
-    export CC="$(which $CC)"
-    export CXX="$(which $CXX)"
-  '';
-
   installPhase = ''
     install -Dm755 builds/release/bin/downward $out/libexec/fast-downward/downward
     cp -r builds/release/bin/translate $out/libexec/fast-downward/

pkgs/build-support/bintools-wrapper/setup-hook.sh

@@ -54,13 +54,16 @@ fi
 
 export NIX_BINTOOLS${role_post}=@out@
 
+# Note that certain tools (e.g. strip) sometimes don’t have wrappers so we also
+# check the underlying bintools package.
 for cmd in \
     ar as ld nm objcopy objdump readelf ranlib strip strings size windres
 do
     if
-        PATH=$_PATH type -p "@targetPrefix@${cmd}" > /dev/null
+        cmd_path=$(PATH=@out@/bin:@bintools_bin@/bin type -P @targetPrefix@${cmd})
     then
-        export "${cmd^^}${role_post}=@targetPrefix@${cmd}";
+        export NIX_${cmd^^}_BASENAME${role_post}=@targetPrefix@${cmd}
+        export ${cmd^^}${role_post}=${cmd_path}
     fi
 done
 
@@ -69,4 +72,4 @@ done
 export NIX_HARDENING_ENABLE
 
 # No local scope in sourced file
-unset -v role_post cmd upper_case
+unset -v role_post cmd cmd_path

pkgs/build-support/cc-wrapper/setup-hook.sh

@@ -107,8 +107,11 @@ fi
 
 export NIX_CC${role_post}=@out@
 
-export CC${role_post}=@named_cc@
-export CXX${role_post}=@named_cxx@
+export NIX_CC_BASENAME${role_post}=@named_cc@
+export NIX_CXX_BASENAME${role_post}=@named_cxx@
+
+export CC${role_post}=@out@/bin/@named_cc@
+export CXX${role_post}=@out@/bin/@named_cxx@
 
 # If unset, assume the default hardening flags.
 : ${NIX_HARDENING_ENABLE="@default_hardening_flags_str@"}

pkgs/development/compilers/gcc/common/builder.nix

@@ -63,9 +63,12 @@ originalAttrs: (stdenv.mkDerivation (finalAttrs: originalAttrs // {
             if [[ -e "''${!curBintools}/nix-support/orig-libc" ]]; then
                 # Figure out what extra flags when linking to pass to the gcc
                 # compilers being generated to make sure that they use our libc.
-                extraLDFlags=($(< "''${!curBintools}/nix-support/libc-ldflags") $(< "''${!curBintools}/nix-support/libc-ldflags-before" || true))
+                extraLDFlags=($(< "''${!curBintools}/nix-support/libc-ldflags"))
+                if [ -e "''${!curBintools}/nix-support/libc-ldflags-before" ]; then
+                    extraLDFlags+=($(< "''${!curBintools}/nix-support/libc-ldflags-before"))
+                fi
                 if [ -e ''${!curBintools}/nix-support/ld-set-dynamic-linker ]; then
-                    extraLDFlags=-dynamic-linker=$(< ''${!curBintools}/nix-support/dynamic-linker)
+                    extraLDFlags+=(-dynamic-linker=$(< ''${!curBintools}/nix-support/dynamic-linker))
                 fi
 
                 # The path to the Libc binaries such as `crti.o'.
@@ -153,16 +156,15 @@ originalAttrs: (stdenv.mkDerivation (finalAttrs: originalAttrs // {
             "NATIVE_SYSTEM_HEADER_DIR=$NIX_FIXINC_DUMMY"
 
             "LDFLAGS_FOR_BUILD=$EXTRA_LDFLAGS_FOR_BUILD"
-            #"LDFLAGS=$EXTRA_LDFLAGS"
+            "LDFLAGS=$EXTRA_LDFLAGS"
             "LDFLAGS_FOR_TARGET=$EXTRA_LDFLAGS_FOR_TARGET"
 
             "CFLAGS_FOR_BUILD=$EXTRA_FLAGS_FOR_BUILD $EXTRA_LDFLAGS_FOR_BUILD"
             "CXXFLAGS_FOR_BUILD=$EXTRA_FLAGS_FOR_BUILD $EXTRA_LDFLAGS_FOR_BUILD"
             "FLAGS_FOR_BUILD=$EXTRA_FLAGS_FOR_BUILD $EXTRA_LDFLAGS_FOR_BUILD"
 
-            # It seems there is a bug in GCC 5
-            #"CFLAGS=$EXTRA_FLAGS $EXTRA_LDFLAGS"
-            #"CXXFLAGS=$EXTRA_FLAGS $EXTRA_LDFLAGS"
+            "CFLAGS=$EXTRA_FLAGS $EXTRA_LDFLAGS"
+            "CXXFLAGS=$EXTRA_FLAGS $EXTRA_LDFLAGS"
 
             "CFLAGS_FOR_TARGET=$EXTRA_FLAGS_FOR_TARGET $EXTRA_LDFLAGS_FOR_TARGET"
             "CXXFLAGS_FOR_TARGET=$EXTRA_FLAGS_FOR_TARGET $EXTRA_LDFLAGS_FOR_TARGET"

pkgs/development/interpreters/ruby/default.nix

@@ -192,18 +192,14 @@ let
           sed -i '/^  CONFIG\["\(BASERUBY\|SHELL\|GREP\|EGREP\|MKDIR_P\|MAKEDIRS\|INSTALL\)"\]/d' $rbConfig
           # Remove unnecessary groff reference from runtime closure, since it's big
           sed -i '/NROFF/d' $rbConfig
-          ${
-            lib.optionalString (!jitSupport) ''
-              # Get rid of the CC runtime dependency
-              remove-references-to \
-                -t ${stdenv.cc} \
-                $out/lib/libruby*
-              remove-references-to \
-                -t ${stdenv.cc} \
-                $rbConfig
-              sed -i '/CC_VERSION_MESSAGE/d' $rbConfig
-            ''
-          }
+        '' + lib.optionalString (!jitSupport) ''
+          # Get rid of the CC runtime dependency
+          remove-references-to \
+            -t "$NIX_CC" \
+            -t "$NIX_BINTOOLS" \
+            -- "$rbConfig" "$out"/lib/libruby*
+          sed -i '/CC_VERSION_MESSAGE/d' $rbConfig
+        '' + ''
 
           # Allow to override compiler. This is important for cross compiling as
           # we need to set a compiler that is different from the build one.
@@ -255,8 +251,13 @@ let
           fi
 
           fallback_cc=$(unset CC; $out/bin/ruby -rrbconfig -e 'puts RbConfig::CONFIG["CC"]')
-          if [[ "$fallback_cc" != "$CC" ]]; then
-             echo "CC='$fallback_cc' should be '$CC' by default" >&2
+        '' + (if jitSupport then ''
+          expected_fallback_cc=$CC
+        '' else ''
+          expected_fallback_cc=$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-''${NIX_CC#"$NIX_STORE"/*-}/bin/$NIX_CC_BASENAME
+        '') + ''
+          if [[ "$fallback_cc" != "$expected_fallback_cc" ]]; then
+             echo "CC='$fallback_cc' should be '$expected_fallback_cc' by default" >&2
              false
           fi
         '';

pkgs/development/libraries/gcc/libgcc/default.nix

@@ -57,22 +57,16 @@ in stdenv.mkDerivation (finalAttrs: {
     cd "$buildRoot/gcc"
     (
       # We "shift" the tools over to fake platforms perspective from the previous stage.
-      export AS_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$AS_FOR_BUILD
-      export CC_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$CC_FOR_BUILD
-      export CPP_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$CPP_FOR_BUILD
-      export CXX_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$CXX_FOR_BUILD
-      export LD_FOR_BUILD=${buildPackages.stdenv.cc.bintools}/bin/$LD_FOR_BUILD
-
       export AS=$AS_FOR_BUILD
       export CC=$CC_FOR_BUILD
       export CPP=$CPP_FOR_BUILD
       export CXX=$CXX_FOR_BUILD
       export LD=$LD_FOR_BUILD
 
-      export AS_FOR_TARGET=${stdenv.cc}/bin/$AS
-      export CC_FOR_TARGET=${stdenv.cc}/bin/$CC
-      export CPP_FOR_TARGET=${stdenv.cc}/bin/$CPP
-      export LD_FOR_TARGET=${stdenv.cc.bintools}/bin/$LD
+      export AS_FOR_TARGET=$AS
+      export CC_FOR_TARGET=$CC
+      export CPP_FOR_TARGET=$CPP
+      export LD_FOR_TARGET=$LD
 
       # We define GENERATOR_FILE so nothing bothers looking for GNU GMP.
       export NIX_CFLAGS_COMPILE_FOR_BUILD+=' -DGENERATOR_FILE=1'
@@ -104,23 +98,6 @@ in stdenv.mkDerivation (finalAttrs: {
     cd "$buildRoot/gcc/${stdenv.hostPlatform.config}/libgcc"
     configureScript=$sourceRoot/configure
     chmod +x "$configureScript"
-
-    export AS_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$AS_FOR_BUILD
-    export CC_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$CC_FOR_BUILD
-    export CPP_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$CPP_FOR_BUILD
-    export CXX_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$CXX_FOR_BUILD
-    export LD_FOR_BUILD=${buildPackages.stdenv.cc.bintools}/bin/$LD_FOR_BUILD
-
-    export AS=${stdenv.cc}/bin/$AS
-    export CC=${stdenv.cc}/bin/$CC
-    export CPP=${stdenv.cc}/bin/$CPP
-    export CXX=${stdenv.cc}/bin/$CXX
-    export LD=${stdenv.cc.bintools}/bin/$LD
-
-    export AS_FOR_TARGET=${stdenv.cc}/bin/$AS_FOR_TARGET
-    export CC_FOR_TARGET=${stdenv.cc}/bin/$CC_FOR_TARGET
-    export CPP_FOR_TARGET=${stdenv.cc}/bin/$CPP_FOR_TARGET
-    export LD_FOR_TARGET=${stdenv.cc.bintools}/bin/$LD_FOR_TARGET
   '';
 
   configurePlatforms = [ "build" "host" ];

pkgs/development/libraries/gmp/4.3.2.nix

@@ -9,6 +9,10 @@ let self = stdenv.mkDerivation rec {
     sha256 = "0x8prpqi9amfcmi7r4zrza609ai9529pjaq0h4aw51i867064qck";
   };
 
+  patches = [
+    ./remove-cc-reference.patch
+  ];
+
   #outputs TODO: split $cxx due to libstdc++ dependency
   # maybe let ghc use a version with *.so shared with rest of nixpkgs and *.a added
   # - see #5855 for related discussion

pkgs/development/libraries/gmp/5.1.x.nix

@@ -23,6 +23,7 @@ let self = stdenv.mkDerivation rec {
   nativeBuildInputs = [ m4 ];
 
   patches = [
+    ./remove-cc-reference.patch
     ./5.1.3-CVE-2021-43618.patch
   ] ++ lib.optionals stdenv.isDarwin [
     ./need-size-t.patch

pkgs/development/libraries/gmp/6.x.nix

@@ -20,6 +20,10 @@ let self = stdenv.mkDerivation rec {
     hash = "sha256-rCghGnz7YJuuLiyNYFjWbI/pZDT3QM9v4uR7AA0cIMs=";
   };
 
+  patches = [
+    ./remove-cc-reference.patch
+  ];
+
   #outputs TODO: split $cxx due to libstdc++ dependency
   # maybe let ghc use a version with *.so shared with rest of nixpkgs and *.a added
   # - see #5855 for related discussion

pkgs/development/libraries/gmp/remove-cc-reference.patch

@@ -0,0 +1,13 @@
+--- a/gmp-h.in
++++ b/gmp-h.in
+@@ -2331,8 +2331,8 @@
+ };
+
+ /* Define CC and CFLAGS which were used to build this version of GMP */
+-#define __GMP_CC "@CC@"
+-#define __GMP_CFLAGS "@CFLAGS@"
++#define __GMP_CC "cc"
++#define __GMP_CFLAGS ""
+
+ /* Major version number is the value of __GNU_MP__ too, above. */
+ #define __GNU_MP_VERSION            6

pkgs/development/libraries/icu/make-icu.nix

@@ -20,9 +20,17 @@ let
     '';
 
     # https://sourceware.org/glibc/wiki/Release/2.26#Removal_of_.27xlocale.h.27
-    postPatch = if (stdenv.hostPlatform.libc == "glibc" || stdenv.hostPlatform.libc == "musl") && lib.versionOlder version "62.1"
-      then "substituteInPlace i18n/digitlst.cpp --replace '<xlocale.h>' '<locale.h>'"
-      else null; # won't find locale_t on darwin
+    postPatch = lib.optionalString ((stdenv.hostPlatform.libc == "glibc" || stdenv.hostPlatform.libc == "musl") && lib.versionOlder version "62.1") ''
+      substituteInPlace i18n/digitlst.cpp --replace '<xlocale.h>' '<locale.h>'
+    ''
+    # Remove CC/CXX references from tools/toolutil/udbgutil.cpp and do not
+    # embed build platform alias in the output for reproducibility.
+    + ''
+      substituteInPlace tools/toolutil/Makefile.in \
+        --replace-fail \
+        'CPPFLAGS+=  "-DU_BUILD=\"@build@\"" "-DU_HOST=\"@host@\"" "-DU_CC=\"@CC@\"" "-DU_CXX=\"@CXX@\""' \
+        'CPPFLAGS += "-DU_HOST=\"@host@\"" "-DU_CC=\"''${NIX_CC_BASENAME}\"" "-DU_CXX=\"''${NIX_CXX_BASENAME}\""'
+    '';
 
     inherit patchFlags patches;
 

pkgs/development/libraries/openssl/default.nix

@@ -28,7 +28,9 @@ let
       inherit hash;
     };
 
-    inherit patches;
+    patches = patches ++ [
+      ./remove-cflags-references.patch
+    ];
 
     postPatch = ''
       patchShebangs Configure

pkgs/development/libraries/openssl/remove-cflags-references.patch

@@ -0,0 +1,18 @@
+--- a/util/mkbuildinf.pl
++++ b/util/mkbuildinf.pl
+@@ -12,6 +12,15 @@
+ my ($cflags, $platform) = @ARGV;
+ $cflags = "compiler: $cflags";
+
++# OpenSSL is part of the stdenv bootstrap, but also removeReferencesTo on Darwin
++# requires signingUtils that, in turn, requires OpenSSL, causing infinite
++# recursion. To break the cycle, we make OpenSSL build system aware of the Nix
++# build environment and remove store references from the embedded cflags string
++# at build time. This is arguably cleaner approach as we still retain this
++# information if some dependency needs it, but don’t have to modify and
++# potentially fixup the resulting binaries.
++$cflags =~ s/(\Q$ENV{NIX_STORE}\E)\/[a-z0-9]{32}-/$1\/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-/g;
++
+ my $date = gmtime($ENV{'SOURCE_DATE_EPOCH'} || time()) . " UTC";
+
+ print <<"END_OUTPUT";

pkgs/development/python-modules/clustershell/default.nix

@@ -97,6 +97,9 @@ buildPythonPackage rec {
     tests/*.py
   '';
 
+  # FIXME: for some reason, tests get stuck (that is an issue on master branch as well).
+  doCheck = false;
+
   meta = with lib; {
     broken = stdenv.isDarwin;
     description = "Scalable Python framework for cluster administration";

pkgs/development/tools/abuild/default.nix

@@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-xVxgcBchGfeVo1cgP9iVsWjZ6SHVN6R8zWaE1k3DcXQ=";
   };
 
+  strictDeps = true;
+
   buildInputs = [
     openssl
     zlib

pkgs/os-specific/linux/musl/default.nix

@@ -89,6 +89,16 @@ stdenv.mkDerivation rec {
     "--syslibdir=${placeholder "out"}/lib"
   ];
 
+  # Set variables that affect the path used by musl-gcc and musl-clang wrappers.
+  # If $CC ends with gcc, WRAPCC_GCC is set to $CC. Same for clang. Note that
+  # musl-gcc wrapper uses REALGCC environment variable at runtime if it is set.
+  # We want to avoid reference to the $CC, so we force the default values when
+  # building (see Makefile).
+  makeFlags = [
+    "WRAPCC_GCC=gcc"
+    "WRAPCC_CLANG=clang"
+  ];
+
   outputs = [ "out" "bin" "dev" ];
 
   dontDisableStatic = true;