diff --git a/nixos/modules/services/computing/foldingathome/client.nix b/nixos/modules/services/computing/foldingathome/client.nix
index 9f99af48c48a..fbef6a04b16d 100644
--- a/nixos/modules/services/computing/foldingathome/client.nix
+++ b/nixos/modules/services/computing/foldingathome/client.nix
@@ -49,6 +49,15 @@ in
       '';
     };
 
+    daemonNiceLevel = mkOption {
+      type = types.ints.between (-20) 19;
+      default = 0;
+      description = ''
+        Daemon process priority for FAHClient.
+        0 is the default Unix process priority, 19 is the lowest.
+      '';
+    };
+
     extraArgs = mkOption {
       type = types.listOf types.str;
       default = [];
@@ -70,6 +79,7 @@ in
       serviceConfig = {
         DynamicUser = true;
         StateDirectory = "foldingathome";
+        Nice = cfg.daemonNiceLevel;
         WorkingDirectory = "%S/foldingathome";
       };
     };
diff --git a/nixos/modules/services/networking/cjdns.nix b/nixos/modules/services/networking/cjdns.nix
index e9a0e5af1a47..f1a504b3e3f4 100644
--- a/nixos/modules/services/networking/cjdns.nix
+++ b/nixos/modules/services/networking/cjdns.nix
@@ -12,8 +12,18 @@ let
   { ... }:
   { options =
     { password = mkOption {
-      type = types.str;
-      description = "Authorized password to the opposite end of the tunnel.";
+        type = types.str;
+        description = "Authorized password to the opposite end of the tunnel.";
+      };
+      login = mkOption {
+        default = "";
+        type = types.str;
+        description = "(optional) name your peer has for you";
+      };
+      peerName = mkOption {
+        default = "";
+        type = types.str;
+        description = "(optional) human-readable name for peer";
       };
       publicKey = mkOption {
         type = types.str;
diff --git a/pkgs/applications/editors/bless/default.nix b/pkgs/applications/editors/bless/default.nix
index 24fc8440bbd7..e613747aeab1 100644
--- a/pkgs/applications/editors/bless/default.nix
+++ b/pkgs/applications/editors/bless/default.nix
@@ -1,73 +1,58 @@
 { lib, stdenv
 , fetchFromGitHub
-, autoreconfHook
 , pkg-config
 , mono
+, meson
+, ninja
 , gtk-sharp-2_0
 , gettext
 , makeWrapper
 , glib
 , gtk2-x11
-, gnome2
+, libxslt
+, docbook_xsl
+, python3
 }:
 
 stdenv.mkDerivation rec {
   pname = "bless";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "afrantzis";
     repo = pname;
     rev = "v${version}";
-    sha256 = "04ra2mcx3pkhzbhcz0zwfmbpqj6cwisrypi6xbc2d6pxd4hdafn1";
+    hash = "sha256-rS+vJX0y9v1TiPsRfABroHiTuENQKEOxNsyKwagRuHM=";
   };
 
+  postPatch = ''
+    sed "s|get_option('tests')|false|g" -i meson.build
+    patchShebangs .
+  '';
+
   buildInputs = [
     gtk-sharp-2_0
     mono
     # runtime only deps
     glib
     gtk2-x11
-    gnome2.libglade
   ];
 
   nativeBuildInputs = [
     pkg-config
-    autoreconfHook
+    meson
+    ninja
     gettext
     makeWrapper
+    libxslt
+    docbook_xsl
+    python3
   ];
 
-  configureFlags = [
-    # scrollkeeper is a gnome2 package, so it must be old and we shouldn't really support it
-    # NOTE: that sadly doesn't turn off the compilation of the manual with scrollkeeper, so we have to fake the binaries below
-    "--without-scrollkeeper"
-  ];
-
-  autoreconfPhase = ''
-    mkdir _bin
-
-    # this fakes the scrollkeeper commands, to keep the build happy
-    for f in scrollkeeper-preinstall scrollkeeper-update; do
-      echo "true" > ./_bin/$f
-      chmod +x ./_bin/$f
-    done
-
-    export PATH="$PWD/_bin:$PATH"
-
-    # and it also wants to install that file
-    touch ./doc/user/bless-manual.omf
-
-    # patch mono path
-    sed "s|^mono|${mono}/bin/mono|g" -i src/bless-script.in
-
-    ./autogen.sh
-    '';
-
   preFixup = ''
-    MPATH="${gtk-sharp-2_0}/lib/mono/gtk-sharp-2.0:${glib.out}/lib:${gtk2-x11}/lib:${gnome2.libglade}/lib:${gtk-sharp-2_0}/lib"
-    wrapProgram $out/bin/bless --prefix MONO_PATH : "$MPATH" --prefix LD_LIBRARY_PATH : "$MPATH"
-    '';
+    MPATH="${gtk-sharp-2_0}/lib/mono/gtk-sharp-2.0:${glib.out}/lib:${gtk2-x11}/lib:${gtk-sharp-2_0}/lib"
+    wrapProgram $out/bin/bless --prefix MONO_PATH : "$MPATH" --prefix LD_LIBRARY_PATH : "$MPATH" --prefix PATH : ${lib.makeBinPath [ mono ]}
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/afrantzis/bless";
diff --git a/pkgs/applications/graphics/fondo/default.nix b/pkgs/applications/graphics/fondo/default.nix
index 34dd4926a49f..c2cb4c92d47e 100644
--- a/pkgs/applications/graphics/fondo/default.nix
+++ b/pkgs/applications/graphics/fondo/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , nix-update-script
 , pantheon
@@ -57,18 +58,15 @@ stdenv.mkDerivation rec {
     patchShebangs meson/post_install.py
   '';
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = pname;
-    };
-  };
-
-
   meta = with lib; {
-    description = "Find the most beautiful wallpapers for your desktop";
     homepage = "https://github.com/calo001/fondo";
+    description = "Find the most beautiful wallpapers for your desktop";
     license = licenses.agpl3Plus;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ AndersonTorres ];
     platforms = platforms.linux;
   };
+
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
 }
diff --git a/pkgs/applications/misc/notejot/default.nix b/pkgs/applications/misc/notejot/default.nix
index 724d9285ec2b..bd30fa2bb211 100644
--- a/pkgs/applications/misc/notejot/default.nix
+++ b/pkgs/applications/misc/notejot/default.nix
@@ -1,15 +1,30 @@
-{ lib, stdenv, fetchFromGitHub, nix-update-script, vala, pkg-config, meson, ninja, python3, pantheon
-, gtk3, gtksourceview, json-glib, libgee, wrapGAppsHook }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, gtk4
+, gtksourceview
+, json-glib
+, libadwaita
+, libgee
+, meson
+, ninja
+, nix-update-script
+, pantheon
+, pkg-config
+, python3
+, vala
+, wrapGAppsHook
+}:
 
 stdenv.mkDerivation rec {
   pname = "notejot";
-  version = "1.6.3";
+  version = "3.0.4";
 
   src = fetchFromGitHub {
     owner = "lainsce";
     repo = pname;
     rev = version;
-    sha256 = "170dzgd6cnf2k3hfifjysmdggpskx6v1pjmblqgbwaj2d3snf3h8";
+    hash = "sha256-p8rca3PsnT/3Lp6W30VvqR9aPr6EIuNrH5gsxL0lZ0Q=";
   };
 
   nativeBuildInputs = [
@@ -20,31 +35,30 @@ stdenv.mkDerivation rec {
     python3
     wrapGAppsHook
   ];
-
   buildInputs = [
-    gtk3
+    gtk4
     gtksourceview
     json-glib
+    libadwaita
     libgee
     pantheon.elementary-icon-theme
     pantheon.granite
   ];
 
   postPatch = ''
-    patchShebangs meson/post_install.py
+    chmod +x build-aux/post_install.py
+    patchShebangs build-aux/post_install.py
   '';
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = pname;
-    };
-  };
-
   meta = with lib; {
-    description = "Stupidly-simple sticky notes applet";
     homepage = "https://github.com/lainsce/notejot";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ ];
+    description = "Stupidly-simple sticky notes applet";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ AndersonTorres ];
     platforms = platforms.linux;
   };
+
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
 }
diff --git a/pkgs/applications/networking/ftp/taxi/default.nix b/pkgs/applications/networking/ftp/taxi/default.nix
index 9e6ee864137b..66692f96c669 100644
--- a/pkgs/applications/networking/ftp/taxi/default.nix
+++ b/pkgs/applications/networking/ftp/taxi/default.nix
@@ -1,33 +1,48 @@
-{ lib, stdenv, fetchFromGitHub, nix-update-script, pantheon, pkg-config, meson, ninja, python3, vala
-, gtk3, libgee, libsoup, libsecret, gobject-introspection, wrapGAppsHook }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, gobject-introspection
+, gtk3
+, libgee
+, libsecret
+, libsoup
+, meson
+, ninja
+, nix-update-script
+, pantheon
+, pkg-config
+, python3
+, vala
+, wrapGAppsHook
+}:
 
 stdenv.mkDerivation rec {
   pname = "taxi";
-  version = "0.0.1";
+  version = "0.0.1-unstable=2020-09-03";
 
   src = fetchFromGitHub {
     owner = "Alecaddd";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "01c552w68576pnsyqbwy3hjhbww6vys3r3s0wxjdiscjqj1aawqg";
+    rev = "74aade67fd9ba9e5bc10c950ccd8d7e48adc2ea1";
+    sha256 = "sha256-S/FeKJxIdA30CpfFVrQsALdq7Gy4F4+P50Ky5tmqKvM=";
   };
 
   nativeBuildInputs = [
-    vala
     gobject-introspection
     meson
     ninja
     pkg-config
     python3
+    vala
     wrapGAppsHook
   ];
 
   buildInputs = [
-    pantheon.granite
-    libgee
     gtk3
+    libgee
     libsecret
     libsoup
+    pantheon.granite
   ];
 
   postPatch = ''
@@ -35,17 +50,15 @@ stdenv.mkDerivation rec {
     patchShebangs meson/post_install.py
   '';
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = pname;
-    };
+  meta = with lib; {
+    homepage = "https://github.com/Alecaddd/taxi";
+    description = "The FTP Client that drives you anywhere";
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = platforms.linux;
   };
 
-  meta = with lib; {
-    description = "The FTP Client that drives you anywhere";
-    homepage    = "https://github.com/Alecaddd/taxi";
-    license     = licenses.gpl3Plus;
-    maintainers = with maintainers; [ ];
-    platforms   = platforms.linux;
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
   };
 }
diff --git a/pkgs/applications/science/biology/samblaster/default.nix b/pkgs/applications/science/biology/samblaster/default.nix
index 48c19666ba04..4315dd2767e1 100644
--- a/pkgs/applications/science/biology/samblaster/default.nix
+++ b/pkgs/applications/science/biology/samblaster/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0g24fq5hplnfgqkh3xqpg3lgx3wmxwnh9c7m6yw7pbi40lmgl1jv";
   };
 
+  makeFlags = [ "CPP=${stdenv.cc.targetPrefix}c++" ];
+
   installPhase = ''
     mkdir -p $out/bin
     cp samblaster $out/bin
diff --git a/pkgs/applications/video/celluloid/default.nix b/pkgs/applications/video/celluloid/default.nix
index 838d306c6854..f6bc0561b0c6 100644
--- a/pkgs/applications/video/celluloid/default.nix
+++ b/pkgs/applications/video/celluloid/default.nix
@@ -1,42 +1,42 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, nix-update-script
-, meson
-, ninja
-, python3
-, gettext
-, pkg-config
-, desktop-file-utils
-, wrapGAppsHook
 , appstream-glib
+, desktop-file-utils
 , epoxy
+, gettext
 , glib
 , gtk3
+, meson
 , mpv
+, ninja
+, nix-update-script
+, pkg-config
+, python3
+, wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
   pname = "celluloid";
-  version = "0.20";
+  version = "0.21";
 
   src = fetchFromGitHub {
     owner = "celluloid-player";
     repo = "celluloid";
     rev = "v${version}";
-    hash = "sha256-fEZnH8EqU6CykgKINXnKChuBUlisroa97B1vjcx2cWA=";
+    hash = "sha256-1Jeg1uqWxURGKR/Xg4j4roZ9Pg5MR7geyttdzlOU+rA=";
   };
 
   nativeBuildInputs = [
+    appstream-glib
+    desktop-file-utils
+    gettext
     meson
     ninja
-    python3
-    appstream-glib
-    gettext
     pkg-config
-    desktop-file-utils
+    python3
     wrapGAppsHook
   ];
-
   buildInputs = [
     epoxy
     glib
@@ -50,22 +50,20 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = pname;
-    };
-  };
-
   meta = with lib; {
+    homepage = "https://github.com/celluloid-player/celluloid";
     description = "Simple GTK frontend for the mpv video player";
     longDescription = ''
-      GNOME MPV interacts with mpv via the client API exported by libmpv,
-      allowing access to mpv's powerful playback capabilities through an
-      easy-to-use user interface.
+      Celluloid (formerly GNOME MPV) is a simple GTK+ frontend for mpv.
+      Celluloid interacts with mpv via the client API exported by libmpv,
+      allowing access to mpv's powerful playback capabilities.
     '';
-    homepage = "https://github.com/celluloid-player/celluloid";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ AndersonTorres ];
     platforms = platforms.linux;
   };
+
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
 }
diff --git a/pkgs/desktops/lxqt/lxqt-build-tools/default.nix b/pkgs/desktops/lxqt/lxqt-build-tools/default.nix
index 27fda636103e..fb2ed9e37d7b 100644
--- a/pkgs/desktops/lxqt/lxqt-build-tools/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-build-tools/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , mkDerivation
 , fetchFromGitHub
 , cmake
@@ -21,6 +22,13 @@ mkDerivation rec {
     sha256 = "0zhcv6cbdn9fr5lpglz26gzssbxkpi824sgc0g7w3hh1z6nqqf8l";
   };
 
+  # Nix clang on darwin identifies as 'Clang', not 'AppleClang'
+  # Without this, dependants fail to link.
+  postPatch = ''
+    substituteInPlace cmake/modules/LXQtCompilerSettings.cmake \
+      --replace AppleClang Clang
+  '';
+
   nativeBuildInputs = [
     cmake
     pkg-config
diff --git a/pkgs/development/libraries/libtomcrypt/default.nix b/pkgs/development/libraries/libtomcrypt/default.nix
index 7ed8fca3babd..936c92bf7c5d 100644
--- a/pkgs/development/libraries/libtomcrypt/default.nix
+++ b/pkgs/development/libraries/libtomcrypt/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, libtool }:
+{ lib, stdenv, fetchurl, fetchpatch, libtool, libtommath }:
 
 stdenv.mkDerivation rec {
   pname = "libtomcrypt";
@@ -17,14 +17,16 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ libtool ];
+  nativeBuildInputs = [ libtool libtommath ];
 
   postPatch = ''
     substituteInPlace makefile.shared --replace "LT:=glibtool" "LT:=libtool"
   '';
 
   preBuild = ''
-    makeFlagsArray=(PREFIX=$out \
+    makeFlagsArray+=(PREFIX=$out \
+      CFLAGS="-DUSE_LTM -DLTM_DESC -DLTC_PTHREAD" \
+      EXTRALIBS=\"-ltommath\" \
       INSTALL_GROUP=$(id -g) \
       INSTALL_USER=$(id -u))
   '';
diff --git a/pkgs/development/ocaml-modules/containers/default.nix b/pkgs/development/ocaml-modules/containers/default.nix
index c3847acb9594..b0df52061520 100644
--- a/pkgs/development/ocaml-modules/containers/default.nix
+++ b/pkgs/development/ocaml-modules/containers/default.nix
@@ -5,7 +5,7 @@
 }:
 
 buildDunePackage rec {
-  version = "3.0.1";
+  version = "3.4";
   pname = "containers";
 
   useDune2 = true;
@@ -14,7 +14,7 @@ buildDunePackage rec {
     owner = "c-cube";
     repo = "ocaml-containers";
     rev = "v${version}";
-    sha256 = "1m19cfcwks3xcj16nqldfb49dg0vdc7by1q1j8bpac3z2mjvks0l";
+    sha256 = "0ixpy81p6rc3lq71djfndb2sg2hfj20j1jbzzrrmgqsysqdjsgzz";
   };
 
   buildInputs = [ dune-configurator ];
diff --git a/pkgs/development/python-modules/pyatmo/default.nix b/pkgs/development/python-modules/pyatmo/default.nix
index 6bea15df386f..ea6e85221776 100644
--- a/pkgs/development/python-modules/pyatmo/default.nix
+++ b/pkgs/development/python-modules/pyatmo/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pyatmo";
-  version = "4.2.2";
+  version = "4.2.3";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "jabesq";
     repo = "pyatmo";
     rev = "v${version}";
-    sha256 = "sha256-3IxDDLa8KMHVkHAeTmdNVRPc5aKzF3VwL2kKnG8Fp7I=";
+    sha256 = "sha256-hbs+1x/pwv00dhm+1Yj1effddJZHDjs2K3oeBmdCY+k=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/misc/ccache/default.nix b/pkgs/development/tools/misc/ccache/default.nix
index 4128118decf6..b905f5e8ed5e 100644
--- a/pkgs/development/tools/misc/ccache/default.nix
+++ b/pkgs/development/tools/misc/ccache/default.nix
@@ -7,26 +7,25 @@
 , cmake
 , perl
 , zstd
+, bashInteractive
 , xcodebuild
 , makeWrapper
 }:
 
 let ccache = stdenv.mkDerivation rec {
   pname = "ccache";
-  version = "4.2.1";
+  version = "4.3";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-AmgJpW7AGCSggbHp1fLO5yhXS9LIm7O77nQdDERJYAA=";
+    hash = "sha256-ZBxDTMUZiZJLIYbvACTFwvlss+IZiMjiL0khfM5hFCM=";
   };
 
-  patches = [
-    # test/run use compgen to get environment variable names, but
-    # compgen isn't available in non-interactive bash.
-    ./env-instead-of-compgen.patch
+  outputs = [ "out" "man" ];
 
+  patches = [
     # When building for Darwin, test/run uses dwarfdump, whereas on
     # Linux it uses objdump. We don't have dwarfdump packaged for
     # Darwin, so this patch updates the test to also use objdump on
@@ -38,18 +37,22 @@ let ccache = stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ asciidoc cmake perl ];
-
   buildInputs = [ zstd ];
 
-  outputs = [ "out" "man" ];
-
   doCheck = true;
-  checkInputs = lib.optional stdenv.isDarwin xcodebuild;
+  checkInputs = [
+    # test/run requires the compgen function which is available in
+    # bashInteractive, but not bash.
+    bashInteractive
+  ] ++ lib.optional stdenv.isDarwin xcodebuild;
+
   checkPhase = ''
+    runHook preCheck
     export HOME=$(mktemp -d)
     ctest --output-on-failure ${lib.optionalString stdenv.isDarwin ''
       -E '^(test.nocpp2|test.basedir|test.multi_arch)$'
     ''}
+    runHook postCheck
   '';
 
   passthru = {
diff --git a/pkgs/development/tools/misc/ccache/env-instead-of-compgen.patch b/pkgs/development/tools/misc/ccache/env-instead-of-compgen.patch
deleted file mode 100644
index 313de0fa58c3..000000000000
--- a/pkgs/development/tools/misc/ccache/env-instead-of-compgen.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-diff --git a/test/run b/test/run
-index cbdd98f0..bc930200 100755
---- a/test/run
-+++ b/test/run
-@@ -346,11 +346,11 @@ expect_perm() {
- }
- 
- reset_environment() {
--    while IFS= read -r name; do
-+    while IFS='=' read -r name value; do
-         if [[ $name =~ ^CCACHE_[A-Z0-9_]*$ ]]; then
-             unset $name
-         fi
--    done < <(compgen -e)
-+    done < <(env)
- 
-     unset GCC_COLORS
-     unset TERM
diff --git a/pkgs/servers/firebird/default.nix b/pkgs/servers/firebird/default.nix
index 2d4e22ba2443..fa3a8d022983 100644
--- a/pkgs/servers/firebird/default.nix
+++ b/pkgs/servers/firebird/default.nix
@@ -1,91 +1,84 @@
-{lib, stdenv, fetchurl, libedit, automake, autoconf, libtool
-,
-  # icu = null: use icu which comes with firebird
+{ lib, stdenv, fetchFromGitHub, libedit, autoreconfHook, zlib, unzip, libtommath, libtomcrypt, icu, superServer ? false }:
 
-  # icu = pkgs.icu => you may have trouble sharing database files with windows
-  # users if "Collation unicode" columns are being used
-  # windows icu version is *30.dll, however neither the icu 3.0 nor the 3.6
-  # sources look close to what ships with this package.
-  # Thus I think its best to trust firebird devs and use their version
-
-  # icu version missmatch may cause such error when selecting from a table:
-  # "Collation unicode for character set utf8 is not installed"
-
-  # icu 3.0 can still be built easily by nix (by dropping the #elif case and
-  # make | make)
-  icu ? null
-
-, superServer ? false
-, port ? 3050
-, serviceName ? "gds_db"
-}:
-
-/*
-   there are 3 ways to use firebird:
-   a) superserver
-    - one process, one thread for each connection
-   b) classic
-    - is built by default
-    - one process for each connection
-    - on linux direct io operations (?)
-   c) embedded.
-
-   manual says that you usually don't notice the difference between a and b.
-
-   I'm only interested in the embedder shared libary for now.
-   So everything isn't tested yet
-
-*/
-
-stdenv.mkDerivation rec {
-  version = "2.5.7.27050-0";
+let base = {
   pname = "firebird";
 
-  # enableParallelBuilding = false; build fails
+  meta = with lib; {
+    description = "SQL relational database management system";
+    homepage = "https://firebirdsql.org/";
+    changelog = "https://github.com/FirebirdSQL/firebird/blob/master/CHANGELOG.md";
+    license = [ "IDPL" "Interbase-1.0" ];
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ marcweber ];
+  };
 
-  # http://tracker.firebirdsql.org/browse/CORE-3246
-  preConfigure = ''
-    makeFlags="$makeFlags CPU=$NIX_BUILD_CORES"
+  nativeBuildInputs = [ autoreconfHook ];
+
+  buildInputs = [ libedit icu ];
+
+  LD_LIBRARY_PATH = lib.makeLibraryPath [ icu ];
+
+  configureFlags = [
+    "--with-system-editline"
+  ] ++ (lib.optional superServer "--enable-superserver");
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -r gen/Release/firebird/* $out
+    runHook postInstall
   '';
 
-  configureFlags =
-    [ "--with-serivec-port=${builtins.toString port}"
-      "--with-service-name=${serviceName}"
-      "--with-system-editline"
-      "--with-fblog=/var/log/firebird"
-      "--with-fbconf=/etc/firebird"
-      "--with-fbsecure-db=/var/db/firebird/system"
-    ]
-    ++ (lib.optional  (icu != null) "--with-system-icu")
-    ++ (lib.optional superServer "--enable-superserver");
+}; in {
 
-  src = fetchurl {
-    url = "mirror://sourceforge/firebird/Firebird-${version}.tar.bz2";
-    sha256 = "06hp6bq5irqvm3h03s79qjgcc3jsjpq150y9aq7anklx9v4nhfqa";
-  };
+  firebird_2_5 = stdenv.mkDerivation (base // rec {
+    version = "2.5.9";
 
-  hardeningDisable = [ "format" ];
+    src = fetchFromGitHub {
+      owner = "FirebirdSQL";
+      repo = "firebird";
+      rev = "R${builtins.replaceStrings [ "." ] [ "_" ] version}";
+      sha256 = "sha256-YyvlMeBux80OpVhsCv+6IVxKXFRsgdr+1siupMR13JM=";
+    };
 
-  # configurePhase = ''
-  #   sed -i 's@cp /usr/share/automake-.*@@' autogen.sh
-  #   sh autogen.sh $configureFlags --prefix=$out
-  # '';
-  buildInputs = [libedit icu automake autoconf libtool];
+    configureFlags = base.configureFlags ++ [ "--with-system-icu" ];
 
-  # TODO: Probably this hase to be tidied up..
-  # make install requires beeing. disabling the root checks
-  # dosen't work. Copying the files manually which can be found
-  # in ubuntu -dev -classic, -example packages:
-  # maybe some of those files can be removed again
-  installPhase = "cp -r gen/firebird $out";
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out
+      cp -r gen/firebird/* $out
+      runHook postInstall
+    '';
 
-  meta = {
-    description = "SQL relational database management system";
-    homepage = "https://www.firebirdnews.org";
-    license = ["IDPL" "Interbase-1.0"];
-    maintainers = [lib.maintainers.marcweber];
-    platforms = lib.platforms.linux;
-    broken = true;
-  };
+    meta = base.meta // { platforms = [ "x86_64-linux" ]; };
+  });
+
+  firebird_3 = stdenv.mkDerivation (base // rec {
+    version = "3.0.7";
+
+    src = fetchFromGitHub {
+      owner = "FirebirdSQL";
+      repo = "firebird";
+      rev = "R${builtins.replaceStrings [ "." ] [ "_" ] version}";
+      sha256 = "sha256-8nGan10qjW8dFF89BL/tUWtwMGhahBiODbOqRrHSrbs=";
+    };
+
+    buildInputs = base.buildInputs ++ [ zlib libtommath ];
+
+    meta = base.meta // { platforms = [ "x86_64-linux" ]; };
+  });
+
+  firebird_4 = stdenv.mkDerivation (base // rec {
+    version = "4.0.0-rc1";
+
+    src = fetchFromGitHub {
+      owner = "FirebirdSQL";
+      repo = "firebird";
+      rev = "T4_0_0_RC1";
+      sha256 = "sha256-FLaRePosF5dtJ+fmrfvzkE6wawC9Z9YLhT/ZWkwWXb4=";
+    };
+
+    buildInputs = base.buildInputs ++ [ zlib unzip libtommath libtomcrypt ];
+  });
 
 }
diff --git a/pkgs/servers/monitoring/prometheus/unbound-exporter.nix b/pkgs/servers/monitoring/prometheus/unbound-exporter.nix
index df53d30de716..c7c8f3e5963a 100644
--- a/pkgs/servers/monitoring/prometheus/unbound-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/unbound-exporter.nix
@@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub, openssl, pkg-config, nixosTests }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, openssl, pkg-config, nixosTests, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "unbound-telemetry";
@@ -15,7 +15,8 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ];
+  buildInputs = [ openssl ]
+    ++ lib.optional stdenv.isDarwin Security;
 
   passthru.tests = {
     inherit (nixosTests.prometheus-exporters) unbound;
diff --git a/pkgs/servers/simple-http-server/default.nix b/pkgs/servers/simple-http-server/default.nix
index d93b4664019e..1ecb44aed870 100644
--- a/pkgs/servers/simple-http-server/default.nix
+++ b/pkgs/servers/simple-http-server/default.nix
@@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub, pkg-config, openssl }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, pkg-config, openssl, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "simple-http-server";
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ];
+  buildInputs = if stdenv.isDarwin then [ Security ] else [ openssl ];
 
   # Currently no tests are implemented, so we avoid building the package twice
   doCheck = false;
diff --git a/pkgs/tools/misc/rig/default.nix b/pkgs/tools/misc/rig/default.nix
index 9fa28264eed9..5efa92ef1575 100644
--- a/pkgs/tools/misc/rig/default.nix
+++ b/pkgs/tools/misc/rig/default.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
   # http://deb.debian.org/debian/pool/main/r/rig/rig_1.11-1.diff.gz
   patches = [ ./rig_1.11-1.diff ];
 
+  makeFlags = [ "CXX=${stdenv.cc.targetPrefix}c++" ];
+
   meta = {
     homepage = "http://rig.sourceforge.net/";
     description = "Random identity generator";
diff --git a/pkgs/tools/misc/silicon/default.nix b/pkgs/tools/misc/silicon/default.nix
index 123dc715546c..d115997498b3 100644
--- a/pkgs/tools/misc/silicon/default.nix
+++ b/pkgs/tools/misc/silicon/default.nix
@@ -9,6 +9,7 @@
 , freetype
 , libxcb
 , python3
+, libiconv
 , AppKit
 , CoreText
 , Security
@@ -29,7 +30,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [ llvmPackages.libclang expat freetype ]
     ++ lib.optionals stdenv.isLinux [ libxcb ]
-    ++ lib.optionals stdenv.isDarwin [ AppKit CoreText Security ];
+    ++ lib.optionals stdenv.isDarwin [ libiconv AppKit CoreText Security ];
 
   nativeBuildInputs = [ cmake pkg-config ]
     ++ lib.optionals stdenv.isLinux [ python3 ];
diff --git a/pkgs/tools/package-management/cargo-release/default.nix b/pkgs/tools/package-management/cargo-release/default.nix
index 7fb077344e4f..da57ae347143 100644
--- a/pkgs/tools/package-management/cargo-release/default.nix
+++ b/pkgs/tools/package-management/cargo-release/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-release";
-  version = "0.13.10";
+  version = "0.13.11";
 
   src = fetchFromGitHub {
     owner = "sunng87";
     repo = "cargo-release";
     rev = "v${version}";
-    sha256 = "sha256-WWU+aNMNOOstHiGRE5nj2biWCL3uwyqJKgt0xCAfS0s=";
+    sha256 = "sha256-v0XKLwxUIxBt9hIUzprz+VsxCRifH1/SbNcI0sH2ENM=";
   };
 
-  cargoSha256 = "sha256-W+/owW9Hl1cSBlfSN8Gea575tkjmZlwa5X6TCYyaLsM=";
+  cargoSha256 = "sha256-zbET6UsV29hAL83rw3XRgrcM5FABFNI3w3Kbd61FS7E=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ]
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c427bbdf0df1..554799c3744d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12839,12 +12839,12 @@ in
       inherit (stdenv) cc;
     };
 
-  ccacheStdenv = lowPrio (makeOverridable ({ extraConfig, stdenv }:
-    overrideCC stdenv (buildPackages.ccacheWrapper.override {
-      inherit extraConfig;
+  ccacheStdenv = lowPrio (makeOverridable ({ stdenv, ... } @ extraArgs:
+    overrideCC stdenv (buildPackages.ccacheWrapper.override ({
       inherit (stdenv) cc;
-    })) {
-      extraConfig = "";
+    } // lib.optionalAttrs (builtins.hasAttr "extraConfig" extraArgs) {
+      extraConfig = extraArgs.extraConfig;
+    }))) {
       inherit stdenv;
     });
 
@@ -18932,8 +18932,8 @@ in
 
   fingerd_bsd = callPackage ../servers/fingerd/bsd-fingerd { };
 
-  firebird = callPackage ../servers/firebird { icu = null; /*stdenv = gcc5Stdenv;*/ };
-  firebirdSuper = firebird.override { icu = icu58; superServer = true; /*stdenv = gcc5Stdenv;*/ };
+  inherit (callPackages ../servers/firebird { }) firebird_4 firebird_3 firebird_2_5;
+  firebird = firebird_3;
 
   freeradius = callPackage ../servers/freeradius { };
 
@@ -19533,7 +19533,9 @@ in
   prometheus-tor-exporter = callPackage ../servers/monitoring/prometheus/tor-exporter.nix { };
   prometheus-statsd-exporter = callPackage ../servers/monitoring/prometheus/statsd-exporter.nix { };
   prometheus-surfboard-exporter = callPackage ../servers/monitoring/prometheus/surfboard-exporter.nix { };
-  prometheus-unbound-exporter = callPackage ../servers/monitoring/prometheus/unbound-exporter.nix { };
+  prometheus-unbound-exporter = callPackage ../servers/monitoring/prometheus/unbound-exporter.nix {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
   prometheus-unifi-exporter = callPackage ../servers/monitoring/prometheus/unifi-exporter { };
   prometheus-varnish-exporter = callPackage ../servers/monitoring/prometheus/varnish-exporter.nix { };
   prometheus-jmx-httpserver = callPackage ../servers/monitoring/prometheus/jmx-httpserver.nix {  };
@@ -31422,7 +31424,9 @@ in
 
   simplehttp2server = callPackage ../servers/simplehttp2server { };
 
-  simple-http-server = callPackage ../servers/simple-http-server { };
+  simple-http-server = callPackage ../servers/simple-http-server {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   diceware = with python3Packages; toPythonApplication diceware;