Merge pull request #122068 from NixOS/staging-next

Staging next
2021-05-16 12:25:50 -07:00 · 2021-05-16 12:25:50 -07:00 · 2ba3a65a7d
parent b3a8cab594 8c6d819143
commit 2ba3a65a7d
407 changed files with 13564 additions and 2797 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -4999,7 +4999,7 @@
    name = "Julien Dehos";
  };
  julm = {
-    email = "julm+nix@sourcephile.fr";
+    email = "julm+nixpkgs@sourcephile.fr";
    github = "ju1m";
    githubId = 21160136;
    name = "Julien Moutinho";
--- a/nixos/doc/manual/release-notes/rl-2105.xml
+++ b/nixos/doc/manual/release-notes/rl-2105.xml
@ -697,6 +697,17 @@ environment.systemPackages = [
     All CUDA toolkit versions prior to CUDA 10 have been removed.
    </para>
   </listitem>
+   <listitem>
+     <para>
+       The <package>kbdKeymaps</package> package was removed since dvp and neo
+       are now included in <package>kbd</package>.
+
+       If you want to use the Programmer Dvorak Keyboard Layout, you have to use
+       <literal>dvorak-programmer</literal> in <option>console.keyMap</option>
+       now instead of <literal>dvp</literal>.
+       In <option>services.xserver.xkbVariant</option> it's still <literal>dvp</literal>.
+    </para>
+   </listitem>
   <listitem>
     <para>
       The <package>babeld</package> service is now being run as an unprivileged user. To achieve that the module configures
@ -923,6 +934,23 @@ environment.systemPackages = [
      Note that users defined with an explicit UID below 500 are exempted from this check, as <xref linkend="opt-users.users._name_.isSystemUser" /> has no effect for those.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     The <literal>security.apparmor</literal> module,
+     for the <link xlink:href="https://gitlab.com/apparmor/apparmor/-/wikis/Documentation">AppArmor</link>
+     Mandatory Access Control system,
+     has been substantialy improved along with related tools,
+     so that module maintainers can now more easily write AppArmor profiles for NixOS.
+     The most notable change on the user-side is the new option <xref linkend="opt-security.apparmor.policies"/>,
+     replacing the previous <literal>profiles</literal> option
+     to provide a way to disable a profile
+     and to select whether to confine in enforce mode (default)
+     or in complain mode (see <literal>journalctl -b --grep apparmor</literal>).
+     Security-minded users may also want to enable <xref linkend="opt-security.apparmor.killUnconfinedConfinables"/>,
+     at the cost of having some of their processes killed
+     when updating to a NixOS version introducing new AppArmor profiles.
+    </para>
+   </listitem>
   <listitem>
     <para>
       The GNOME desktop manager once again installs <package>gnome.epiphany</package> by default.
--- a/nixos/modules/config/console.nix
+++ b/nixos/modules/config/console.nix
@ -82,8 +82,7 @@ in

    packages = mkOption {
      type = types.listOf types.package;
-      default = with pkgs.kbdKeymaps; [ dvp neo ];
-      defaultText = "with pkgs.kbdKeymaps; [ dvp neo ]";
+      default = [ ];
      description = ''
        List of additional packages that provide console fonts, keymaps and
        other resources for virtual consoles use.
--- a/nixos/modules/config/fonts/fontconfig.nix
+++ b/nixos/modules/config/fonts/fontconfig.nix
@ -448,6 +448,40 @@ in
    (mkIf cfg.enable {
      environment.systemPackages    = [ pkgs.fontconfig ];
      environment.etc.fonts.source  = "${fontconfigEtc}/etc/fonts/";
+      security.apparmor.includes."abstractions/fonts" = ''
+        # fonts.conf
+        r ${pkg.out}/etc/fonts/fonts.conf,
+
+        # fontconfig default config files
+        r ${pkg.out}/etc/fonts/conf.d/*.conf,
+
+        # 00-nixos-cache.conf
+        r ${cacheConf},
+
+        # 10-nixos-rendering.conf
+        r ${renderConf},
+
+        # 50-user.conf
+        ${optionalString cfg.includeUserConf ''
+        r ${pkg.out}/etc/fonts/conf.d.bak/50-user.conf,
+        ''}
+
+        # local.conf (indirect priority 51)
+        ${optionalString (cfg.localConf != "") ''
+        r ${localConf},
+        ''}
+
+        # 52-nixos-default-fonts.conf
+        r ${defaultFontsConf},
+
+        # 53-no-bitmaps.conf
+        r ${rejectBitmaps},
+
+        ${optionalString (!cfg.allowType1) ''
+        # 53-nixos-reject-type1.conf
+        r ${rejectType1},
+        ''}
+      '';
    })
    (mkIf cfg.enable {
      fonts.fontconfig.confPackages = [ confPkg ];
--- a/nixos/modules/config/malloc.nix
+++ b/nixos/modules/config/malloc.nix
@ -87,5 +87,12 @@ in
    environment.etc."ld-nix.so.preload".text = ''
      ${providerLibPath}
    '';
+    security.apparmor.includes = {
+      "abstractions/base" = ''
+        r /etc/ld-nix.so.preload,
+        r ${config.environment.etc."ld-nix.so.preload".source},
+        mr ${providerLibPath},
+      '';
+    };
  };
 }
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -211,7 +211,6 @@
  ./rename.nix
  ./security/acme.nix
  ./security/apparmor.nix
-  ./security/apparmor-suid.nix
  ./security/audit.nix
  ./security/auditd.nix
  ./security/ca.nix
--- a/nixos/modules/profiles/hardened.nix
+++ b/nixos/modules/profiles/hardened.nix
@ -36,6 +36,7 @@ with lib;
  security.virtualisation.flushL1DataCache = mkDefault "always";

  security.apparmor.enable = mkDefault true;
+  security.apparmor.killUnconfinedConfinables = mkDefault true;

  boot.kernelParams = [
    # Slab/slub sanity checks, redzoning, and poisoning
--- a/nixos/modules/security/apparmor-suid.nix
+++ b/nixos/modules/security/apparmor-suid.nix
@ -1,49 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.security.apparmor;
-in
-with lib;
-{
-  imports = [
-    (mkRenamedOptionModule [ "security" "virtualization" "flushL1DataCache" ] [ "security" "virtualisation" "flushL1DataCache" ])
-  ];
-
-  options.security.apparmor.confineSUIDApplications = mkOption {
-    type = types.bool;
-    default = true;
-    description = ''
-      Install AppArmor profiles for commonly-used SUID application
-      to mitigate potential privilege escalation attacks due to bugs
-      in such applications.
-
-      Currently available profiles: ping
-    '';
-  };
-
-  config = mkIf (cfg.confineSUIDApplications) {
-    security.apparmor.profiles = [ (pkgs.writeText "ping" ''
-      #include <tunables/global>
-      /run/wrappers/bin/ping {
-        #include <abstractions/base>
-        #include <abstractions/consoles>
-        #include <abstractions/nameservice>
-
-        capability net_raw,
-        capability setuid,
-        network inet raw,
-
-        ${pkgs.stdenv.cc.libc.out}/lib/*.so mr,
-        ${pkgs.libcap.lib}/lib/libcap.so* mr,
-        ${pkgs.attr.out}/lib/libattr.so* mr,
-
-        ${pkgs.iputils}/bin/ping mixr,
-
-        #/etc/modules.conf r,
-
-        ## Site-specific additions and overrides. See local/README for details.
-        ##include <local/bin.ping>
-      }
-    '') ];
-  };
-
-}
--- a/nixos/modules/security/apparmor.nix
+++ b/nixos/modules/security/apparmor.nix
@ -1,59 +1,216 @@
 { config, lib, pkgs, ... }:

+with lib;
+
 let
-  inherit (lib) mkIf mkOption types concatMapStrings;
+  inherit (builtins) attrNames head map match readFile;
+  inherit (lib) types;
+  inherit (config.environment) etc;
  cfg = config.security.apparmor;
+  mkDisableOption = name: mkEnableOption name // {
+    default = true;
+    example = false;
+  };
+  enabledPolicies = filterAttrs (n: p: p.enable) cfg.policies;
 in

 {
-   options = {
-     security.apparmor = {
-       enable = mkOption {
-         type = types.bool;
-         default = false;
-         description = "Enable the AppArmor Mandatory Access Control system.";
-       };
-       profiles = mkOption {
-         type = types.listOf types.path;
-         default = [];
-         description = "List of files containing AppArmor profiles.";
-       };
-       packages = mkOption {
-         type = types.listOf types.package;
-         default = [];
-         description = "List of packages to be added to apparmor's include path";
-       };
-     };
-   };
+  imports = [
+    (mkRemovedOptionModule [ "security" "apparmor" "confineSUIDApplications" ] "Please use the new options: `security.apparmor.policies.<policy>.enable'.")
+    (mkRemovedOptionModule [ "security" "apparmor" "profiles" ] "Please use the new option: `security.apparmor.policies'.")
+    apparmor/includes.nix
+    apparmor/profiles.nix
+  ];

-   config = mkIf cfg.enable {
-     environment.systemPackages = [ pkgs.apparmor-utils ];
+  options = {
+    security.apparmor = {
+      enable = mkEnableOption ''
+        the AppArmor Mandatory Access Control system.

-     boot.kernelParams = [ "apparmor=1" "security=apparmor" ];
+        If you're enabling this module on a running system,
+        note that a reboot will be required to activate AppArmor in the kernel.

-     systemd.services.apparmor = let
-       paths = concatMapStrings (s: " -I ${s}/etc/apparmor.d")
-         ([ pkgs.apparmor-profiles ] ++ cfg.packages);
-     in {
-       after = [ "local-fs.target" ];
-       before = [ "sysinit.target" ];
-       wantedBy = [ "multi-user.target" ];
-       unitConfig = {
-         DefaultDependencies = "no";
-       };
-       serviceConfig = {
-         Type = "oneshot";
-         RemainAfterExit = "yes";
-         ExecStart = map (p:
-           ''${pkgs.apparmor-parser}/bin/apparmor_parser -rKv ${paths} "${p}"''
-         ) cfg.profiles;
-         ExecStop = map (p:
-           ''${pkgs.apparmor-parser}/bin/apparmor_parser -Rv "${p}"''
-         ) cfg.profiles;
-         ExecReload = map (p:
-           ''${pkgs.apparmor-parser}/bin/apparmor_parser --reload ${paths} "${p}"''
-         ) cfg.profiles;
-       };
-     };
-   };
+        Also, beware that enabling this module privileges stability over security
+        by not trying to kill unconfined but newly confinable running processes by default,
+        though it would be needed because AppArmor can only confine new
+        or already confined processes of an executable.
+        This killing would for instance be necessary when upgrading to a NixOS revision
+        introducing for the first time an AppArmor profile for the executable
+        of a running process.
+
+        Enable <xref linkend="opt-security.apparmor.killUnconfinedConfinables"/>
+        if you want this service to do such killing
+        by sending a <literal>SIGTERM</literal> to those running processes'';
+      policies = mkOption {
+        description = ''
+          AppArmor policies.
+        '';
+        type = types.attrsOf (types.submodule ({ name, config, ... }: {
+          options = {
+            enable = mkDisableOption "loading of the profile into the kernel";
+            enforce = mkDisableOption "enforcing of the policy or only complain in the logs";
+            profile = mkOption {
+              description = "The policy of the profile.";
+              type = types.lines;
+              apply = pkgs.writeText name;
+            };
+          };
+        }));
+        default = {};
+      };
+      includes = mkOption {
+        type = types.attrsOf types.lines;
+        default = {};
+        description = ''
+          List of paths to be added to AppArmor's searched paths
+          when resolving <literal>include</literal> directives.
+        '';
+        apply = mapAttrs pkgs.writeText;
+      };
+      packages = mkOption {
+        type = types.listOf types.package;
+        default = [];
+        description = "List of packages to be added to AppArmor's include path";
+      };
+      enableCache = mkEnableOption ''
+        caching of AppArmor policies
+        in <literal>/var/cache/apparmor/</literal>.
+
+        Beware that AppArmor policies almost always contain Nix store paths,
+        and thus produce at each change of these paths
+        a new cached version accumulating in the cache'';
+      killUnconfinedConfinables = mkEnableOption ''
+        killing of processes which have an AppArmor profile enabled
+        (in <xref linkend="opt-security.apparmor.policies"/>)
+        but are not confined (because AppArmor can only confine new processes).
+
+        This is only sending a gracious <literal>SIGTERM</literal> signal to the processes,
+        not a <literal>SIGKILL</literal>.
+
+        Beware that due to a current limitation of AppArmor,
+        only profiles with exact paths (and no name) can enable such kills'';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = map (policy:
+      { assertion = match ".*/.*" policy == null;
+        message = "`security.apparmor.policies.\"${policy}\"' must not contain a slash.";
+        # Because, for instance, aa-remove-unknown uses profiles_names_list() in rc.apparmor.functions
+        # which does not recurse into sub-directories.
+      }
+    ) (attrNames cfg.policies);
+
+    environment.systemPackages = [
+      pkgs.apparmor-utils
+      pkgs.apparmor-bin-utils
+    ];
+    environment.etc."apparmor.d".source = pkgs.linkFarm "apparmor.d" (
+      # It's important to put only enabledPolicies here and not all cfg.policies
+      # because aa-remove-unknown reads profiles from all /etc/apparmor.d/*
+      mapAttrsToList (name: p: { inherit name; path = p.profile; }) enabledPolicies ++
+      mapAttrsToList (name: path: { inherit name path; }) cfg.includes
+    );
+    environment.etc."apparmor/parser.conf".text = ''
+        ${if cfg.enableCache then "write-cache" else "skip-cache"}
+        cache-loc /var/cache/apparmor
+        Include /etc/apparmor.d
+      '' +
+      concatMapStrings (p: "Include ${p}/etc/apparmor.d\n") cfg.packages;
+    # For aa-logprof
+    environment.etc."apparmor/apparmor.conf".text = ''
+    '';
+    # For aa-logprof
+    environment.etc."apparmor/severity.db".source = pkgs.apparmor-utils + "/etc/apparmor/severity.db";
+    environment.etc."apparmor/logprof.conf".source = pkgs.runCommand "logprof.conf" {
+      header = ''
+        [settings]
+          # /etc/apparmor.d/ is read-only on NixOS
+          profiledir = /var/cache/apparmor/logprof
+          inactive_profiledir = /etc/apparmor.d/disable
+          # Use: journalctl -b --since today --grep audit: | aa-logprof
+          logfiles = /dev/stdin
+
+          parser = ${pkgs.apparmor-parser}/bin/apparmor_parser
+          ldd = ${pkgs.glibc.bin}/bin/ldd
+          logger = ${pkgs.utillinux}/bin/logger
+
+          # customize how file ownership permissions are presented
+          # 0 - off
+          # 1 - default of what ever mode the log reported
+          # 2 - force the new permissions to be user
+          # 3 - force all perms on the rule to be user
+          default_owner_prompt = 1
+
+          custom_includes = /etc/apparmor.d ${concatMapStringsSep " " (p: "${p}/etc/apparmor.d") cfg.packages}
+
+        [qualifiers]
+          ${pkgs.runtimeShell} = icnu
+          ${pkgs.bashInteractive}/bin/sh = icnu
+          ${pkgs.bashInteractive}/bin/bash = icnu
+          ${config.users.defaultUserShell} = icnu
+      '';
+      footer = "${pkgs.apparmor-utils}/etc/apparmor/logprof.conf";
+      passAsFile = [ "header" ];
+    } ''
+      cp $headerPath $out
+      sed '1,/\[qualifiers\]/d' $footer >> $out
+    '';
+
+    boot.kernelParams = [ "apparmor=1" "security=apparmor" ];
+
+    systemd.services.apparmor = {
+      after = [
+        "local-fs.target"
+        "systemd-journald-audit.socket"
+      ];
+      before = [ "sysinit.target" ];
+      wantedBy = [ "multi-user.target" ];
+      unitConfig = {
+        Description="Load AppArmor policies";
+        DefaultDependencies = "no";
+        ConditionSecurity = "apparmor";
+      };
+      # Reloading instead of restarting enables to load new AppArmor profiles
+      # without necessarily restarting all services which have Requires=apparmor.service
+      reloadIfChanged = true;
+      restartTriggers = [
+        etc."apparmor/parser.conf".source
+        etc."apparmor.d".source
+      ];
+      serviceConfig = let
+        killUnconfinedConfinables = pkgs.writeShellScript "apparmor-kill" ''
+          set -eu
+          ${pkgs.apparmor-bin-utils}/bin/aa-status --json |
+          ${pkgs.jq}/bin/jq --raw-output '.processes | .[] | .[] | select (.status == "unconfined") | .pid' |
+          xargs --verbose --no-run-if-empty --delimiter='\n' \
+          kill
+        '';
+        commonOpts = p: "--verbose --show-cache ${optionalString (!p.enforce) "--complain "}${p.profile}";
+        in {
+        Type = "oneshot";
+        RemainAfterExit = "yes";
+        ExecStartPre = "${pkgs.apparmor-utils}/bin/aa-teardown";
+        ExecStart = mapAttrsToList (n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts p}") enabledPolicies;
+        ExecStartPost = optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
+        ExecReload =
+          # Add or replace into the kernel profiles in enabledPolicies
+          # (because AppArmor can do that without stopping the processes already confined).
+          mapAttrsToList (n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --replace ${commonOpts p}") enabledPolicies ++
+          # Remove from the kernel any profile whose name is not
+          # one of the names within the content of the profiles in enabledPolicies
+          # (indirectly read from /etc/apparmor.d/*, without recursing into sub-directory).
+          # Note that this does not remove profiles dynamically generated by libvirt.
+          [ "${pkgs.apparmor-utils}/bin/aa-remove-unknown" ] ++
+          # Optionaly kill the processes which are unconfined but now have a profile loaded
+          # (because AppArmor can only start to confine new processes).
+          optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
+        ExecStop = "${pkgs.apparmor-utils}/bin/aa-teardown";
+        CacheDirectory = [ "apparmor" "apparmor/logprof" ];
+        CacheDirectoryMode = "0700";
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ julm ];
 }
--- a/nixos/modules/security/apparmor/includes.nix
+++ b/nixos/modules/security/apparmor/includes.nix
@ -0,0 +1,317 @@
+{ config, lib, pkgs, ... }:
+let
+  inherit (builtins) attrNames hasAttr isAttrs;
+  inherit (lib) getLib;
+  inherit (config.environment) etc;
+  # Utility to generate an AppArmor rule
+  # only when the given path exists in config.environment.etc
+  etcRule = arg:
+    let go = { path ? null, mode ? "r", trail ? "" }:
+      lib.optionalString (hasAttr path etc)
+        "${mode} ${config.environment.etc.${path}.source}${trail},";
+    in if isAttrs arg
+    then go arg
+    else go { path = arg; };
+in
+{
+# FIXME: most of the etcRule calls below have been
+# written systematically by converting from apparmor-profiles's profiles
+# without testing nor deep understanding of their uses,
+# and thus may need more rules or can have less rules;
+# this remains to be determined case by case,
+# some may even be completely useless.
+config.security.apparmor.includes = {
+  # This one is included by <tunables/global>
+  # which is usualy included before any profile.
+  "abstractions/tunables/alias" = ''
+    alias /bin -> /run/current-system/sw/bin,
+    alias /lib/modules -> /run/current-system/kernel/lib/modules,
+    alias /sbin -> /run/current-system/sw/sbin,
+    alias /usr -> /run/current-system/sw,
+  '';
+  "abstractions/audio" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/audio"
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      "asound.conf"
+      "esound/esd.conf"
+      "libao.conf"
+      { path = "pulse";  trail = "/"; }
+      { path = "pulse";  trail = "/**"; }
+      { path = "sound";  trail = "/"; }
+      { path = "sound";  trail = "/**"; }
+      { path = "alsa/conf.d";  trail = "/"; }
+      { path = "alsa/conf.d";  trail = "/*"; }
+      "openal/alsoft.conf"
+      "wildmidi/wildmidi.conf"
+    ];
+  "abstractions/authentication" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/authentication"
+    # Defined in security.pam
+    include <abstractions/pam>
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      "nologin"
+      "securetty"
+      { path = "security";  trail = "/*"; }
+      "shadow"
+      "gshadow"
+      "pwdb.conf"
+      "default/passwd"
+      "login.defs"
+    ];
+  "abstractions/base" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/base"
+    r ${pkgs.stdenv.cc.libc}/share/locale/**,
+    r ${pkgs.stdenv.cc.libc}/share/locale.alias,
+    ${lib.optionalString (pkgs.glibcLocales != null) "r ${pkgs.glibcLocales}/lib/locale/locale-archive,"}
+    ${etcRule "localtime"}
+    r ${pkgs.tzdata}/share/zoneinfo/**,
+    r ${pkgs.stdenv.cc.libc}/share/i18n/**,
+  '';
+  "abstractions/bash" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/bash"
+
+    # bash inspects filesystems at startup
+    # and /etc/mtab is linked to /proc/mounts
+    @{PROC}/mounts
+
+    # system-wide bash configuration
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      "profile.dos"
+      "profile"
+      "profile.d"
+      { path = "profile.d";  trail = "/*"; }
+      "bashrc"
+      "bash.bashrc"
+      "bash.bashrc.local"
+      "bash_completion"
+      "bash_completion.d"
+      { path = "bash_completion.d";  trail = "/*"; }
+      # bash relies on system-wide readline configuration
+      "inputrc"
+      # run out of /etc/bash.bashrc
+      "DIR_COLORS"
+    ];
+  "abstractions/consoles" = ''
+     include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/consoles"
+  '';
+  "abstractions/cups-client" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/cpus-client"
+    ${etcRule "cups/cups-client.conf"}
+  '';
+  "abstractions/dbus-session-strict" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/dbus-session-strict"
+    ${etcRule "machine-id"}
+  '';
+  "abstractions/dconf" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/dconf"
+    ${etcRule { path = "dconf";  trail = "/**"; }}
+  '';
+  "abstractions/dri-common" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/dri-common"
+    ${etcRule "drirc"}
+  '';
+  # The config.fonts.fontconfig NixOS module adds many files to /etc/fonts/
+  # by symlinking them but without exporting them outside of its NixOS module,
+  # those are therefore added there to this "abstractions/fonts".
+  "abstractions/fonts" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/fonts"
+    ${etcRule { path = "fonts";  trail = "/**"; }}
+  '';
+  "abstractions/gnome" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/gnome"
+    include <abstractions/fonts>
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      { path = "gnome";  trail = "/gtkrc*"; }
+      { path = "gtk";  trail = "/*"; }
+      { path = "gtk-2.0";  trail = "/*"; }
+      { path = "gtk-3.0";  trail = "/*"; }
+      "orbitrc"
+      { path = "pango";  trail = "/*"; }
+      { path = "/etc/gnome-vfs-2.0";  trail = "/modules/"; }
+      { path = "/etc/gnome-vfs-2.0";  trail = "/modules/*"; }
+      "papersize"
+      { path = "cups";  trail = "/lpoptions"; }
+      { path = "gnome";  trail = "/defaults.list"; }
+      { path = "xdg";  trail = "/{,*-}mimeapps.list"; }
+      "xdg/mimeapps.list"
+    ];
+  "abstractions/kde" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/kde"
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      { path = "qt3";  trail = "/kstylerc"; }
+      { path = "qt3";  trail = "/qt_plugins_3.3rc"; }
+      { path = "qt3";  trail = "/qtrc"; }
+      "kderc"
+      { path = "kde3";  trail = "/*"; }
+      "kde4rc"
+      { path = "xdg";  trail = "/kdeglobals"; }
+      { path = "xdg";  trail = "/Trolltech.conf"; }
+    ];
+  "abstractions/kerberosclient" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/kerberosclient"
+    '' + lib.concatMapStringsSep "\n" etcRule [
+    { path = "krb5.keytab"; mode="rk"; }
+    "krb5.conf"
+    "krb5.conf.d"
+    { path = "krb5.conf.d";  trail = "/*"; }
+
+    # config files found via strings on libs
+    "krb.conf"
+    "krb.realms"
+    "srvtab"
+    ];
+  "abstractions/ldapclient" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/ldapclient"
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      "ldap.conf"
+      "ldap.secret"
+      { path = "openldap";  trail = "/*"; }
+      { path = "openldap";  trail = "/cacerts/*"; }
+      { path = "sasl2";  trail = "/*"; }
+    ];
+  "abstractions/likewise" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/likewise"
+  '';
+  "abstractions/mdns" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/mdns"
+    ${etcRule "nss_mdns.conf"}
+  '';
+  "abstractions/nameservice" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nameservice"
+
+    # Many programs wish to perform nameservice-like operations, such as
+    # looking up users by name or id, groups by name or id, hosts by name
+    # or IP, etc. These operations may be performed through files, dns,
+    # NIS, NIS+, LDAP, hesiod, wins, etc. Allow them all here.
+    mr ${getLib pkgs.nss}/lib/libnss_*.so*,
+    mr ${getLib pkgs.nss}/lib64/libnss_*.so*,
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      "group"
+      "host.conf"
+      "hosts"
+      "nsswitch.conf"
+      "gai.conf"
+      "passwd"
+      "protocols"
+
+      # libtirpc (used for NIS/YP login) needs this
+      "netconfig"
+
+      "resolv.conf"
+
+      { path = "samba";  trail = "/lmhosts"; }
+      "services"
+
+      "default/nss"
+
+      # libnl-3-200 via libnss-gw-name
+      { path = "libnl";  trail = "/classid"; }
+      { path = "libnl-3";  trail = "/classid"; }
+    ];
+  "abstractions/nis" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nis"
+  '';
+  "abstractions/nvidia" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nvidia"
+    ${etcRule "vdpau_wrapper.cfg"}
+  '';
+  "abstractions/opencl-common" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/opencl-common"
+    ${etcRule { path = "OpenCL";  trail = "/**"; }}
+  '';
+  "abstractions/opencl-mesa" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/opencl-mesa"
+    ${etcRule "default/drirc"}
+  '';
+  "abstractions/openssl" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/openssl"
+    ${etcRule { path = "ssl";  trail = "/openssl.cnf"; }}
+  '';
+  "abstractions/p11-kit" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/p11-kit"
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      { path = "pkcs11";  trail = "/"; }
+      { path = "pkcs11";  trail = "/pkcs11.conf"; }
+      { path = "pkcs11";  trail = "/modules/"; }
+      { path = "pkcs11";  trail = "/modules/*"; }
+    ];
+  "abstractions/perl" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/perl"
+    ${etcRule { path = "perl";  trail = "/**"; }}
+  '';
+  "abstractions/php" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/php"
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      { path = "php";  trail = "/**/"; }
+      { path = "php5";  trail = "/**/"; }
+      { path = "php7";  trail = "/**/"; }
+      { path = "php";  trail = "/**.ini"; }
+      { path = "php5";  trail = "/**.ini"; }
+      { path = "php7";  trail = "/**.ini"; }
+    ];
+  "abstractions/postfix-common" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/postfix-common"
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      "mailname"
+      { path = "postfix";  trail = "/*.cf"; }
+      "postfix/main.cf"
+      "postfix/master.cf"
+    ];
+  "abstractions/python" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/python"
+  '';
+  "abstractions/qt5" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/qt5"
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      { path = "xdg";  trail = "/QtProject/qtlogging.ini"; }
+      { path = "xdg/QtProject";  trail = "/qtlogging.ini"; }
+      "xdg/QtProject/qtlogging.ini"
+    ];
+  "abstractions/samba" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/samba"
+    ${etcRule { path = "samba";  trail = "/*"; }}
+  '';
+  "abstractions/ssl_certs" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/ssl_certs"
+
+    # For the NixOS module: security.acme
+    r /var/lib/acme/*/cert.pem,
+    r /var/lib/acme/*/chain.pem,
+    r /var/lib/acme/*/fullchain.pem,
+
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      "ssl/certs/ca-certificates.crt"
+      "ssl/certs/ca-bundle.crt"
+      "pki/tls/certs/ca-bundle.crt"
+
+      { path = "ssl/trust";  trail = "/"; }
+      { path = "ssl/trust";  trail = "/*"; }
+      { path = "ssl/trust/anchors";  trail = "/"; }
+      { path = "ssl/trust/anchors";  trail = "/**"; }
+      { path = "pki/trust";  trail = "/"; }
+      { path = "pki/trust";  trail = "/*"; }
+      { path = "pki/trust/anchors";  trail = "/"; }
+      { path = "pki/trust/anchors";  trail = "/**"; }
+    ];
+  "abstractions/ssl_keys" = ''
+    # security.acme NixOS module
+    r /var/lib/acme/*/full.pem,
+    r /var/lib/acme/*/key.pem,
+  '';
+  "abstractions/vulkan" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/vulkan"
+    ${etcRule { path = "vulkan/icd.d";  trail = "/"; }}
+    ${etcRule { path = "vulkan/icd.d";  trail = "/*.json"; }}
+  '';
+  "abstractions/winbind" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/winbind"
+    ${etcRule { path = "samba";  trail = "/smb.conf"; }}
+    ${etcRule { path = "samba";  trail = "/dhcp.conf"; }}
+  '';
+  "abstractions/X" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/X"
+    ${etcRule { path = "X11/cursors";  trail = "/"; }}
+    ${etcRule { path = "X11/cursors";  trail = "/**"; }}
+  '';
+};
+}
--- a/nixos/modules/security/apparmor/profiles.nix
+++ b/nixos/modules/security/apparmor/profiles.nix
@ -0,0 +1,11 @@
+{ config, lib, pkgs, ... }:
+let apparmor = config.security.apparmor; in
+{
+config.security.apparmor.packages = [ pkgs.apparmor-profiles ];
+config.security.apparmor.policies."bin.ping".profile = lib.mkIf apparmor.policies."bin.ping".enable ''
+  include "${pkgs.iputils.apparmor}/bin.ping"
+  include "${pkgs.inetutils.apparmor}/bin.ping"
+  # Note that including those two profiles in the same profile
+  # would not work if the second one were to re-include <tunables/global>.
+'';
+}
--- a/nixos/modules/security/misc.nix
+++ b/nixos/modules/security/misc.nix
@ -7,6 +7,10 @@ with lib;
    maintainers = [ maintainers.joachifm ];
  };

+  imports = [
+    (lib.mkRenamedOptionModule [ "security" "virtualization" "flushL1DataCache" ] [ "security" "virtualisation" "flushL1DataCache" ])
+  ];
+
  options = {
    security.allowUserNamespaces = mkOption {
      type = types.bool;
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@ -895,6 +895,81 @@ in
        runuser-l = { rootOK = true; unixAuth = false; };
      };

+    security.apparmor.includes."abstractions/pam" = let
+      isEnabled = test: fold or false (map test (attrValues config.security.pam.services));
+      in
+      lib.concatMapStringsSep "\n"
+        (name: "r ${config.environment.etc."pam.d/${name}".source},")
+        (attrNames config.security.pam.services) +
+      ''
+      mr ${getLib pkgs.pam}/lib/security/pam_filter/*,
+      mr ${getLib pkgs.pam}/lib/security/pam_*.so,
+      r ${getLib pkgs.pam}/lib/security/,
+      '' +
+      optionalString use_ldap ''
+         mr ${pam_ldap}/lib/security/pam_ldap.so,
+      '' +
+      optionalString config.services.sssd.enable ''
+        mr ${pkgs.sssd}/lib/security/pam_sss.so,
+      '' +
+      optionalString config.krb5.enable ''
+        mr ${pam_krb5}/lib/security/pam_krb5.so,
+        mr ${pam_ccreds}/lib/security/pam_ccreds.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.googleOsLoginAccountVerification)) ''
+        mr ${pkgs.google-compute-engine-oslogin}/lib/pam_oslogin_login.so,
+        mr ${pkgs.google-compute-engine-oslogin}/lib/pam_oslogin_admin.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.googleOsLoginAuthentication)) ''
+        mr ${pkgs.google-compute-engine-oslogin}/lib/pam_oslogin_login.so,
+      '' +
+      optionalString (config.security.pam.enableSSHAgentAuth
+                     && isEnabled (cfg: cfg.sshAgentAuth)) ''
+        mr ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.fprintAuth)) ''
+        mr ${pkgs.fprintd}/lib/security/pam_fprintd.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.u2fAuth)) ''
+        mr ${pkgs.pam_u2f}/lib/security/pam_u2f.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.usbAuth)) ''
+        mr ${pkgs.pam_usb}/lib/security/pam_usb.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.oathAuth)) ''
+        "mr ${pkgs.oathToolkit}/lib/security/pam_oath.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.yubicoAuth)) ''
+        mr ${pkgs.yubico-pam}/lib/security/pam_yubico.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.duoSecurity.enable)) ''
+        mr ${pkgs.duo-unix}/lib/security/pam_duo.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.otpwAuth)) ''
+        mr ${pkgs.otpw}/lib/security/pam_otpw.so,
+      '' +
+      optionalString config.security.pam.enableEcryptfs ''
+        mr ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.pamMount)) ''
+        mr ${pkgs.pam_mount}/lib/security/pam_mount.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.enableGnomeKeyring)) ''
+        mr ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.startSession)) ''
+        mr ${pkgs.systemd}/lib/security/pam_systemd.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.enableAppArmor)
+                     && config.security.apparmor.enable) ''
+        mr ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.enableKwallet)) ''
+        mr ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so,
+      '' +
+      optionalString config.virtualisation.lxc.lxcfs.enable ''
+        mr ${pkgs.lxc}/lib/security/pam_cgfs.so
+      '';
  };

 }
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@ -171,6 +171,14 @@ in
      export PATH="${wrapperDir}:$PATH"
    '';

+    security.apparmor.includes."nixos/security.wrappers" = ''
+      include "${pkgs.apparmorRulesFromClosure { name="security.wrappers"; } [
+        securityWrapper
+        pkgs.stdenv.cc.cc
+        pkgs.stdenv.cc.libc
+      ]}"
+    '';
+
    ###### setcap activation script
    system.activationScripts.wrappers =
      lib.stringAfter [ "specialfs" "users" ]
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@ -5,7 +5,7 @@ with lib;
 let
  cfg = config.services.transmission;
  inherit (config.environment) etc;
-  apparmor = config.security.apparmor.enable;
+  apparmor = config.security.apparmor;
  rootDir = "/run/transmission";
  homeDir = "/var/lib/transmission";
  settingsDir = ".config/transmission-daemon";
@ -184,8 +184,8 @@ in

    systemd.services.transmission = {
      description = "Transmission BitTorrent Service";
-      after = [ "network.target" ] ++ optional apparmor "apparmor.service";
-      requires = optional apparmor "apparmor.service";
+      after = [ "network.target" ] ++ optional apparmor.enable "apparmor.service";
+      requires = optional apparmor.enable "apparmor.service";
      wantedBy = [ "multi-user.target" ];
      environment.CURL_CA_BUNDLE = etc."ssl/certs/ca-certificates.crt".source;

@ -358,96 +358,39 @@ in
      })
    ];

-    security.apparmor.profiles = mkIf apparmor [
-      (pkgs.writeText "apparmor-transmission-daemon" ''
-        include <tunables/global>
+    security.apparmor.policies."bin.transmission-daemon".profile = ''
+      include "${pkgs.transmission.apparmor}/bin.transmission-daemon"
+    '';
+    security.apparmor.includes."local/bin.transmission-daemon" = ''
+      r ${config.systemd.services.transmission.environment.CURL_CA_BUNDLE},

-        ${pkgs.transmission}/bin/transmission-daemon {
-          include <abstractions/base>
-          include <abstractions/nameservice>
+      owner rw ${cfg.home}/${settingsDir}/**,
+      rw ${cfg.settings.download-dir}/**,
+      ${optionalString cfg.settings.incomplete-dir-enabled ''
+        rw ${cfg.settings.incomplete-dir}/**,
+      ''}
+      ${optionalString cfg.settings.watch-dir-enabled ''
+        rw ${cfg.settings.watch-dir}/**,
+      ''}
+      profile dirs {
+        rw ${cfg.settings.download-dir}/**,
+        ${optionalString cfg.settings.incomplete-dir-enabled ''
+          rw ${cfg.settings.incomplete-dir}/**,
+        ''}
+        ${optionalString cfg.settings.watch-dir-enabled ''
+          rw ${cfg.settings.watch-dir}/**,
+        ''}
+      }

-          # NOTE: https://github.com/NixOS/nixpkgs/pull/93457
-          # will remove the need for these by fixing <abstractions/base>
-          r ${etc."hosts".source},
-          r /etc/ld-nix.so.preload,
-          ${lib.optionalString (builtins.hasAttr "ld-nix.so.preload" etc) ''
-            r ${etc."ld-nix.so.preload".source},
-            ${concatMapStrings (p: optionalString (p != "") ("mr ${p},\n"))
-              (splitString "\n" config.environment.etc."ld-nix.so.preload".text)}
-          ''}
-          r ${etc."ssl/certs/ca-certificates.crt".source},
-          r ${pkgs.tzdata}/share/zoneinfo/**,
-          r ${pkgs.stdenv.cc.libc}/share/i18n/**,
-          r ${pkgs.stdenv.cc.libc}/share/locale/**,
-
-          mr ${getLib pkgs.stdenv.cc.cc}/lib/*.so*,
-          mr ${getLib pkgs.stdenv.cc.libc}/lib/*.so*,
-          mr ${getLib pkgs.attr}/lib/libattr*.so*,
-          mr ${getLib pkgs.c-ares}/lib/libcares*.so*,
-          mr ${getLib pkgs.curl}/lib/libcurl*.so*,
-          mr ${getLib pkgs.keyutils}/lib/libkeyutils*.so*,
-          mr ${getLib pkgs.libcap}/lib/libcap*.so*,
-          mr ${getLib pkgs.libevent}/lib/libevent*.so*,
-          mr ${getLib pkgs.libgcrypt}/lib/libgcrypt*.so*,
-          mr ${getLib pkgs.libgpgerror}/lib/libgpg-error*.so*,
-          mr ${getLib pkgs.libkrb5}/lib/lib*.so*,
-          mr ${getLib pkgs.libssh2}/lib/libssh2*.so*,
-          mr ${getLib pkgs.lz4}/lib/liblz4*.so*,
-          mr ${getLib pkgs.nghttp2}/lib/libnghttp2*.so*,
-          mr ${getLib pkgs.openssl}/lib/libcrypto*.so*,
-          mr ${getLib pkgs.openssl}/lib/libssl*.so*,
-          mr ${getLib pkgs.systemd}/lib/libsystemd*.so*,
-          mr ${getLib pkgs.util-linuxMinimal.out}/lib/libblkid.so*,
-          mr ${getLib pkgs.util-linuxMinimal.out}/lib/libmount.so*,
-          mr ${getLib pkgs.util-linuxMinimal.out}/lib/libuuid.so*,
-          mr ${getLib pkgs.xz}/lib/liblzma*.so*,
-          mr ${getLib pkgs.zlib}/lib/libz*.so*,
-          mr ${getLib pkgs.brotli}/lib/libbrotli*.so*,
-
-          r @{PROC}/sys/kernel/random/uuid,
-          r @{PROC}/sys/vm/overcommit_memory,
-          # @{pid} is not a kernel variable yet but a regexp
-          #r @{PROC}/@{pid}/environ,
-          r @{PROC}/@{pid}/mounts,
-          rwk /tmp/tr_session_id_*,
-          r /run/systemd/resolve/stub-resolv.conf,
-
-          r ${pkgs.openssl.out}/etc/**,
-          r ${config.systemd.services.transmission.environment.CURL_CA_BUNDLE},
-          r ${pkgs.transmission}/share/transmission/**,
-
-          owner rw ${cfg.home}/${settingsDir}/**,
-          rw ${cfg.settings.download-dir}/**,
-          ${optionalString cfg.settings.incomplete-dir-enabled ''
-            rw ${cfg.settings.incomplete-dir}/**,
-          ''}
-          ${optionalString cfg.settings.watch-dir-enabled ''
-            rw ${cfg.settings.watch-dir}/**,
-          ''}
-          profile dirs {
-            rw ${cfg.settings.download-dir}/**,
-            ${optionalString cfg.settings.incomplete-dir-enabled ''
-              rw ${cfg.settings.incomplete-dir}/**,
-            ''}
-            ${optionalString cfg.settings.watch-dir-enabled ''
-              rw ${cfg.settings.watch-dir}/**,
-            ''}
-          }
-
-          ${optionalString (cfg.settings.script-torrent-done-enabled &&
-                            cfg.settings.script-torrent-done-filename != "") ''
-            # Stack transmission_directories profile on top of
-            # any existing profile for script-torrent-done-filename
-            # FIXME: to be tested as I'm not sure it works well with NoNewPrivileges=
-            # https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorStacking#seccomp-and-no_new_privs
-            px ${cfg.settings.script-torrent-done-filename} -> &@{dirs},
-          ''}
-
-          # FIXME: enable customizing using https://github.com/NixOS/nixpkgs/pull/93457
-          # include <local/transmission-daemon>
-        }
-      '')
-    ];
+      ${optionalString (cfg.settings.script-torrent-done-enabled &&
+                        cfg.settings.script-torrent-done-filename != "") ''
+        # Stack transmission_directories profile on top of
+        # any existing profile for script-torrent-done-filename
+        # FIXME: to be tested as I'm not sure it works well with NoNewPrivileges=
+        # https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorStacking#seccomp-and-no_new_privs
+        px ${cfg.settings.script-torrent-done-filename} -> &@{dirs},
+      ''}
+    '';
  };

  meta.maintainers = with lib.maintainers; [ julm ];
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@ -1139,6 +1139,21 @@ in
    } else {
      ping.source = "${pkgs.iputils.out}/bin/ping";
    };
+    security.apparmor.policies."bin.ping".profile = lib.mkIf config.security.apparmor.policies."bin.ping".enable (lib.mkAfter ''
+      /run/wrappers/bin/ping {
+        include <abstractions/base>
+        include <nixos/security.wrappers>
+        rpx /run/wrappers/wrappers.*/ping,
+      }
+      /run/wrappers/wrappers.*/ping {
+        include <abstractions/base>
+        include <nixos/security.wrappers>
+        r /run/wrappers/wrappers.*/ping.real,
+        mrpx ${config.security.wrappers.ping.source},
+        capability net_raw,
+        capability setpcap,
+      }
+    '');

    # Set the host and domain names in the activation script.  Don't
    # clear it if it's not configured in the NixOS configuration,
--- a/nixos/modules/virtualisation/lxc.nix
+++ b/nixos/modules/virtualisation/lxc.nix
@ -74,9 +74,13 @@ in
    systemd.tmpfiles.rules = [ "d /var/lib/lxc/rootfs 0755 root root -" ];

    security.apparmor.packages = [ pkgs.lxc ];
-    security.apparmor.profiles = [
-      "${pkgs.lxc}/etc/apparmor.d/lxc-containers"
-      "${pkgs.lxc}/etc/apparmor.d/usr.bin.lxc-start"
-    ];
+    security.apparmor.policies = {
+      "bin.lxc-start".profile = ''
+        include ${pkgs.lxc}/etc/apparmor.d/usr.bin.lxc-start
+      '';
+      "lxc-containers".profile = ''
+        include ${pkgs.lxc}/etc/apparmor.d/lxc-containers
+      '';
+    };
  };
 }
--- a/nixos/modules/virtualisation/lxd.nix
+++ b/nixos/modules/virtualisation/lxd.nix
@ -97,11 +97,17 @@ in {
    # does a bunch of unrelated things.
    systemd.tmpfiles.rules = [ "d /var/lib/lxc/rootfs 0755 root root -" ];

-    security.apparmor.packages = [ cfg.lxcPackage ];
-    security.apparmor.profiles = [
-      "${cfg.lxcPackage}/etc/apparmor.d/lxc-containers"
-      "${cfg.lxcPackage}/etc/apparmor.d/usr.bin.lxc-start"
-    ];
+    security.apparmor = {
+      packages = [ cfg.lxcPackage ];
+      policies = {
+        "bin.lxc-start".profile = ''
+          include ${cfg.lxcPackage}/etc/apparmor.d/usr.bin.lxc-start
+        '';
+        "lxc-containers".profile = ''
+          include ${cfg.lxcPackage}/etc/apparmor.d/lxc-containers
+        '';
+      };
+    };

    # TODO: remove once LXD gets proper support for cgroupsv2
    # (currently most of the e.g. CPU accounting stuff doesn't work)
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -27,6 +27,7 @@ in
  airsonic = handleTest ./airsonic.nix {};
  amazon-init-shell = handleTest ./amazon-init-shell.nix {};
  ammonite = handleTest ./ammonite.nix {};
+  apparmor = handleTest ./apparmor.nix {};
  atd = handleTest ./atd.nix {};
  avahi = handleTest ./avahi.nix {};
  avahi-with-resolved = handleTest ./avahi.nix { networkd = true; };
--- a/nixos/tests/apparmor.nix
+++ b/nixos/tests/apparmor.nix
@ -0,0 +1,82 @@
+import ./make-test-python.nix ({ pkgs, ... } : {
+  name = "apparmor";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ julm ];
+  };
+
+  machine =
+    { lib, pkgs, config, ... }:
+    with lib;
+    {
+      security.apparmor.enable = mkDefault true;
+    };
+
+  testScript =
+    ''
+      machine.wait_for_unit("multi-user.target")
+
+      with subtest("AppArmor profiles are loaded"):
+          machine.succeed("systemctl status apparmor.service")
+
+      # AppArmor securityfs
+      with subtest("AppArmor securityfs is mounted"):
+          machine.succeed("mountpoint -q /sys/kernel/security")
+          machine.succeed("cat /sys/kernel/security/apparmor/profiles")
+
+      # Test apparmorRulesFromClosure by:
+      # 1. Prepending a string of the relevant packages' name and version on each line.
+      # 2. Sorting according to those strings.
+      # 3. Removing those prepended strings.
+      # 4. Using `diff` against the expected output.
+      with subtest("apparmorRulesFromClosure"):
+          machine.succeed(
+              "${pkgs.diffutils}/bin/diff ${pkgs.writeText "expected.rules" ''
+                  mr ${pkgs.bash}/lib/**.so*,
+                  r ${pkgs.bash},
+                  r ${pkgs.bash}/etc/**,
+                  r ${pkgs.bash}/lib/**,
+                  r ${pkgs.bash}/share/**,
+                  x ${pkgs.bash}/foo/**,
+                  mr ${pkgs.glibc}/lib/**.so*,
+                  r ${pkgs.glibc},
+                  r ${pkgs.glibc}/etc/**,
+                  r ${pkgs.glibc}/lib/**,
+                  r ${pkgs.glibc}/share/**,
+                  x ${pkgs.glibc}/foo/**,
+                  mr ${pkgs.libcap}/lib/**.so*,
+                  r ${pkgs.libcap},
+                  r ${pkgs.libcap}/etc/**,
+                  r ${pkgs.libcap}/lib/**,
+                  r ${pkgs.libcap}/share/**,
+                  x ${pkgs.libcap}/foo/**,
+                  mr ${pkgs.libcap.lib}/lib/**.so*,
+                  r ${pkgs.libcap.lib},
+                  r ${pkgs.libcap.lib}/etc/**,
+                  r ${pkgs.libcap.lib}/lib/**,
+                  r ${pkgs.libcap.lib}/share/**,
+                  x ${pkgs.libcap.lib}/foo/**,
+                  mr ${pkgs.libidn2.out}/lib/**.so*,
+                  r ${pkgs.libidn2.out},
+                  r ${pkgs.libidn2.out}/etc/**,
+                  r ${pkgs.libidn2.out}/lib/**,
+                  r ${pkgs.libidn2.out}/share/**,
+                  x ${pkgs.libidn2.out}/foo/**,
+                  mr ${pkgs.libunistring}/lib/**.so*,
+                  r ${pkgs.libunistring},
+                  r ${pkgs.libunistring}/etc/**,
+                  r ${pkgs.libunistring}/lib/**,
+                  r ${pkgs.libunistring}/share/**,
+                  x ${pkgs.libunistring}/foo/**,
+              ''} ${pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''
+                  ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ${builtins.storeDir}/[^,/-]*-\([^/,]*\):\1 \0:' ${
+                      pkgs.apparmorRulesFromClosure {
+                        name = "ping";
+                        additionalRules = ["x $path/foo/**"];
+                      } [ pkgs.libcap ]
+                  } |
+                  ${pkgs.coreutils}/bin/sort -n -k1 |
+                  ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ::' >$out
+              ''}"
+          )
+    '';
+})
--- a/nixos/tests/keymap.nix
+++ b/nixos/tests/keymap.nix
@ -107,17 +107,32 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
      altgr.expect = [ "~"       "#"       "{"       "["       "|"       ];
    };

-    extraConfig.console.keyMap = "azerty/fr";
+    extraConfig.console.keyMap = "fr";
    extraConfig.services.xserver.layout = "fr";
  };

+  bone = {
+    tests = {
+      layer1.qwerty = [ "f"           "j"                     ];
+      layer1.expect = [ "e"           "n"                     ];
+      layer2.qwerty = [ "shift-f"     "shift-j"     "shift-6" ];
+      layer2.expect = [ "E"           "N"           "$"       ];
+      layer3.qwerty = [ "caps_lock-d" "caps_lock-f"           ];
+      layer3.expect = [ "{"           "}"                     ];
+    };
+
+    extraConfig.console.keyMap = "bone";
+    extraConfig.services.xserver.layout = "de";
+    extraConfig.services.xserver.xkbVariant = "bone";
+  };
+
  colemak = {
    tests = {
      homerow.qwerty = [ "a" "s" "d" "f" "j" "k" "l" "semicolon" ];
      homerow.expect = [ "a" "r" "s" "t" "n" "e" "i" "o"         ];
    };

-    extraConfig.console.keyMap = "colemak/colemak";
+    extraConfig.console.keyMap = "colemak";
    extraConfig.services.xserver.layout = "us";
    extraConfig.services.xserver.xkbVariant = "colemak";
  };
@ -129,9 +144,13 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
      symbols.qwerty = [ "q" "w" "e" "minus" "equal" ];
      symbols.expect = [ "'" "," "." "["     "]"     ];
    };
+
+    extraConfig.console.keyMap = "dvorak";
+    extraConfig.services.xserver.layout = "us";
+    extraConfig.services.xserver.xkbVariant = "dvorak";
  };

-  dvp = {
+  dvorak-programmer = {
    tests = {
      homerow.qwerty = [ "a" "s" "d" "f" "j" "k" "l" "semicolon" ];
      homerow.expect = [ "a" "o" "e" "u" "h" "t" "n" "s"         ];
@ -142,6 +161,7 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
      symbols.expect = [ "&" "[" "{" "}" "(" "=" "*" ")" "+" "]" "!" ];
    };

+    extraConfig.console.keyMap = "dvorak-programmer";
    extraConfig.services.xserver.layout = "us";
    extraConfig.services.xserver.xkbVariant = "dvp";
  };
@ -156,6 +176,7 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
      layer3.expect = [ "{"           "}"                     ];
    };

+    extraConfig.console.keyMap = "neo";
    extraConfig.services.xserver.layout = "de";
    extraConfig.services.xserver.xkbVariant = "neo";
  };
--- a/pkgs/applications/blockchains/electrs.nix
+++ b/pkgs/applications/blockchains/electrs.nix
@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {

  # needed for librocksdb-sys
  nativeBuildInputs = [ llvmPackages.clang ];
-  LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
+  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";

  cargoSha256 = "1rqpadlr9r4z2z825li6vi5a21hivc3bsn5ibxshrdrwiycyyxz8";

--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@ -20,7 +20,7 @@ rustPlatform.buildRustPackage rec {

  nativeBuildInputs = [ clang ];

-  LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
+  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
  PROTOC = "${protobuf}/bin/protoc";

  # NOTE: We don't build the WASM runtimes since this would require a more
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@ -7,7 +7,7 @@
  , patches ? [ ]
 }:
 { stdenv, lib, fetchurl, fetchpatch, ncurses, xlibsWrapper, libXaw, libXpm
-, Xaw3d, libXcursor,  pkg-config, gettext, libXft, dbus, libpng, libjpeg, libungif
+, Xaw3d, libXcursor,  pkg-config, gettext, libXft, dbus, libpng, libjpeg, giflib
 , libtiff, librsvg, gconf, libxml2, imagemagick, gnutls, libselinux
 , alsaLib, cairo, acl, gpm, AppKit, GSS, ImageIO, m17n_lib, libotf
 , jansson, harfbuzz
@ -108,7 +108,7 @@ let emacs = stdenv.mkDerivation (lib.optionalAttrs nativeComp {
    [ ncurses gconf libxml2 gnutls alsaLib acl gpm gettext jansson harfbuzz.dev ]
    ++ lib.optionals stdenv.isLinux [ dbus libselinux systemd ]
    ++ lib.optionals withX
-      [ xlibsWrapper libXaw Xaw3d libXpm libpng libjpeg libungif libtiff libXft
+      [ xlibsWrapper libXaw Xaw3d libXpm libpng libjpeg giflib libtiff libXft
        gconf cairo ]
    ++ lib.optionals (withX || withNS) [ librsvg ]
    ++ lib.optionals withImageMagick [ imagemagick ]
--- a/pkgs/applications/editors/jove/default.nix
+++ b/pkgs/applications/editors/jove/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "jove";
-  version = "4.17.3.6";
+  version = "4.17.3.7";

  src = fetchFromGitHub {
    owner = "jonmacs";
    repo = "jove";
    rev = version;
-    sha256 = "sha256-uQRNKV06ipOHrOsvsceqIFGGlRv5qOQy18q0tFkR6Kg=";
+    sha256 = "sha256-fD87FIWZlfJE2tVX+0QaiGGqu+tJFHheXe1guJR/Hxg=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/editors/jucipp/default.nix
+++ b/pkgs/applications/editors/jucipp/default.nix
@ -56,8 +56,8 @@ stdenv.mkDerivation rec {
    e = "\");";
    v = lib.getVersion llvmPackages.clang;
  in
-    p+llvmPackages.libcxx+"/include/c++/v1"+e
-    +p+llvmPackages.clang-unwrapped+"/lib/clang/"+v+"/include/"+e
+    p+llvmPackages.libcxx.dev+"/include/c++/v1"+e
+    +p+llvmPackages.clang-unwrapped.lib+"/lib/clang/"+v+"/include/"+e
    +p+glibc.dev+"/include"+e;

  preConfigure = ''
--- a/pkgs/applications/editors/kdevelop5/kdevelop.nix
+++ b/pkgs/applications/editors/kdevelop5/kdevelop.nix
@ -23,7 +23,7 @@ mkDerivation rec {

  buildInputs = [
    kdevelop-pg-qt
-    llvmPackages.llvm llvmPackages.clang-unwrapped
+    llvmPackages.llvm llvmPackages.libclang
  ];

  propagatedBuildInputs = [
@ -37,7 +37,7 @@ mkDerivation rec {
  # https://cgit.kde.org/kdevelop.git/commit/?id=716372ae2e8dff9c51e94d33443536786e4bd85b
  # required as nixos seems to be unable to find CLANG_BUILTIN_DIR
  cmakeFlags = [
-    "-DCLANG_BUILTIN_DIR=${llvmPackages.clang-unwrapped}/lib/clang/${lib.getVersion llvmPackages.clang}/include"
+    "-DCLANG_BUILTIN_DIR=${llvmPackages.libclang.lib}/lib/clang/${lib.getVersion llvmPackages.clang}/include"
  ];

  dontWrapQtApps = true;
--- a/pkgs/applications/editors/rstudio/clang-location.patch
+++ b/pkgs/applications/editors/rstudio/clang-location.patch
@ -7,7 +7,7 @@ index ec12a3a1ff..8c81b633ae 100644
    // we need to add in the associated libclang headers as
    // they are not discovered / used by default during compilation
 -   FilePath llvmPath = s_libraryPath.parent().parent();
-+   FilePath llvmPath("@clang@");
+   FilePath llvmPath("@libclang@");
    boost::format fmt("%1%/lib/clang/%2%/include");
    fmt % llvmPath.absolutePath() % version.asString();
    std::string includePath = fmt.str();
--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@ -42,8 +42,8 @@ mkDerivation rec {
  postPatch = ''
    substituteInPlace src/cpp/core/r_util/REnvironmentPosix.cpp --replace '@R@' ${R}
    substituteInPlace src/cpp/core/libclang/LibClang.cpp \
-      --replace '@clang@' ${llvmPackages.clang.cc} \
-      --replace '@libclang.so@' ${llvmPackages.clang.cc.lib}/lib/libclang.so
+      --replace '@libclang@' ${llvmPackages.libclang.lib} \
+      --replace '@libclang.so@' ${llvmPackages.libclang.lib}/lib/libclang.so
  '';

  ginSrc = fetchurl {
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@ -18,13 +18,13 @@ in

 stdenv.mkDerivation rec {
  pname = "imagemagick";
-  version = "7.0.11-8";
+  version = "7.0.11-9";

  src = fetchFromGitHub {
    owner = "ImageMagick";
    repo = "ImageMagick";
    rev = version;
-    sha256 = "sha256-h9hoFXnxuLVQRVtEh83P7efz2KFLLqOXKD6nVJEhqiM=";
+    sha256 = "sha256-eL9zFrgkLb3pS8/UlQB5+p50UG8j3Q7TNDwcO/3BuXo=";
  };

  outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
--- a/pkgs/applications/graphics/fbida/default.nix
+++ b/pkgs/applications/graphics/fbida/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, libjpeg, libexif, libungif, libtiff, libpng, libwebp, libdrm
+{ lib, stdenv, fetchurl, libjpeg, libexif, giflib, libtiff, libpng, libwebp, libdrm
 , pkg-config, freetype, fontconfig, which, imagemagick, curl, sane-backends, libXpm
 , epoxy, poppler, mesa, lirc }:

@ -12,7 +12,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkg-config which ];
  buildInputs = [
-    libexif libjpeg libpng libungif freetype fontconfig libtiff libwebp
+    libexif libjpeg libpng giflib freetype fontconfig libtiff libwebp
    imagemagick curl sane-backends libdrm libXpm epoxy poppler lirc
    mesa
  ];
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -35,7 +35,7 @@ stdenv.mkDerivation rec {

  patches = lib.optional stdenv.isDarwin ./darwin.patch;

-  nativeBuildInputs = [ cmake makeWrapper python3Packages.wrapPython ]
+  nativeBuildInputs = [ cmake makeWrapper python3Packages.wrapPython llvmPackages.llvm.dev ]
    ++ optionals cudaSupport [ addOpenGLRunpath ];
  buildInputs =
    [ boost ffmpeg gettext glew ilmbase
--- a/pkgs/applications/misc/clipcat/default.nix
+++ b/pkgs/applications/misc/clipcat/default.nix
@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {

  cargoSha256 = "1ffgvhkdj8wkhlgi0cj0njdm9ycxq2qda4b5qn8bmaygzr2zkwpd";

-  LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
+  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";

  # needed for internal protobuf c wrapper library
  PROTOC = "${protobuf}/bin/protoc";
--- a/pkgs/applications/misc/cointop/default.nix
+++ b/pkgs/applications/misc/cointop/default.nix
@ -2,13 +2,13 @@

 buildGoPackage rec {
  pname = "cointop";
-  version = "1.6.3";
+  version = "1.6.5";

  src = fetchFromGitHub {
    owner = "miguelmota";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-h4102oWYSuY4uq/Pyo9u25Pdsai7AK2W9yUmS/zdjrw=";
+    sha256 = "sha256-pnh4z7vk8xazdBPNbwR5BrKFbi8df8UTM2SOU+KDvsk=";
  };

  goPackagePath = "github.com/miguelmota/cointop";
--- a/pkgs/applications/misc/imag/default.nix
+++ b/pkgs/applications/misc/imag/default.nix
@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
    ++ lib.optional stdenv.isDarwin Security;
  checkInputs = [ gitMinimal util-linuxMinimal ];

-  LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
+  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";

  cargoSha256 = "0n8cw70qh8g4hfwfaxwwxbrrx5hm2z037z8kdhvdpqkxljl9189x";

--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -248,8 +248,8 @@ buildStdenv.mkDerivation ({
      $(< ${buildStdenv.cc}/nix-support/libc-cflags) \
      $(< ${buildStdenv.cc}/nix-support/cc-cflags) \
      $(< ${buildStdenv.cc}/nix-support/libcxx-cxxflags) \
-      ${lib.optionalString buildStdenv.cc.isClang "-idirafter ${buildStdenv.cc.cc}/lib/clang/${lib.getVersion buildStdenv.cc.cc}/include"} \
-      ${lib.optionalString buildStdenv.cc.isGNU "-isystem ${buildStdenv.cc.cc}/include/c++/${lib.getVersion buildStdenv.cc.cc} -isystem ${buildStdenv.cc.cc}/include/c++/${lib.getVersion buildStdenv.cc.cc}/${buildStdenv.hostPlatform.config}"} \
+      ${lib.optionalString buildStdenv.cc.isClang "-idirafter ${buildStdenv.cc.cc.lib}/lib/clang/${lib.getVersion buildStdenv.cc.cc}/include"} \
+      ${lib.optionalString buildStdenv.cc.isGNU "-isystem ${lib.getDev buildStdenv.cc.cc}/include/c++/${lib.getVersion buildStdenv.cc.cc} -isystem ${buildStdenv.cc.cc}/include/c++/${lib.getVersion buildStdenv.cc.cc}/${buildStdenv.hostPlatform.config}"} \
      $NIX_CFLAGS_COMPILE"

    echo "ac_add_options BINDGEN_CFLAGS='$BINDGEN_CFLAGS'" >> $MOZCONFIG
@ -282,7 +282,7 @@ buildStdenv.mkDerivation ({
    "--disable-updater"
    "--enable-jemalloc"
    "--enable-default-toolkit=${default-toolkit}"
-    "--with-libclang-path=${llvmPackages.libclang}/lib"
+    "--with-libclang-path=${llvmPackages.libclang.lib}/lib"
    "--with-system-nspr"
    "--with-system-nss"
  ]
--- a/pkgs/applications/networking/cluster/k9s/default.nix
+++ b/pkgs/applications/networking/cluster/k9s/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "k9s";
-  version = "0.24.6";
+  version = "0.24.8";

  src = fetchFromGitHub {
    owner  = "derailed";
    repo   = "k9s";
    rev    = "v${version}";
-    sha256 = "sha256-uqtjAvtsF+4cz3M60Xj9sCNotaoPzaeeTKnXQUB4CIo=";
+    sha256 = "sha256-6RGm2uiYvsdpWdhNwDTw4z1O6uNErkWTuyOiwKIvXOY=";
  };

  buildFlagsArray = ''
@ -18,7 +18,7 @@ buildGoModule rec {
      -X github.com/derailed/k9s/cmd.commit=${src.rev}
  '';

-  vendorSha256 = "sha256-/4Aof09MYHPc4VJJV2EyB7T9zNFtYY4JeDGJi67FQic=";
+  vendorSha256 = "sha256-lzxGTubm+qQes5QKaamfmSkXs4qquHHjIhts8YmKlYI=";

  doCheck = false;

--- a/pkgs/applications/networking/cluster/kube3d/default.nix
+++ b/pkgs/applications/networking/cluster/kube3d/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kube3d";
-  version = "4.4.2";
+  version = "4.4.3";

  src = fetchFromGitHub {
    owner = "rancher";
    repo = "k3d";
    rev = "v${version}";
-    sha256 = "sha256-6BDetNPWyAVZOsnCWs90HljVpfUlAytFDPQ/SqPxwgg=";
+    sha256 = "sha256-G8oaJtfsbSi5WaJobxUpNu9DchHfzbkpPvq23GYM99s=";
  };

  vendorSha256 = null;
--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@ -242,7 +242,7 @@ stdenv.mkDerivation rec {
    "--enable-strip"
  ]) ++ lib.optionals (!stdenv.hostPlatform.isi686) [
    # on i686-linux: --with-libclang-path is not available in this configuration
-    "--with-libclang-path=${llvmPackages.libclang}/lib"
+    "--with-libclang-path=${llvmPackages.libclang.lib}/lib"
    "--with-clang-path=${llvmPackages.clang}/bin/clang"
  ] ++ lib.optional alsaSupport "--enable-alsa"
  ++ lib.optional calendarSupport "--enable-calendar"
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@ -22,6 +22,7 @@
 , enableDaemon ? true
 , enableCli ? true
 , installLib ? false
+, apparmorRulesFromClosure
 }:

 let
@ -39,6 +40,8 @@ in stdenv.mkDerivation {
    fetchSubmodules = true;
  };

+  outputs = [ "out" "apparmor" ];
+
  cmakeFlags =
    let
      mkFlag = opt: if opt then "ON" else "OFF";
@ -75,6 +78,31 @@ in stdenv.mkDerivation {

  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework CoreFoundation";

+  postInstall = ''
+    mkdir $apparmor
+    cat >$apparmor/bin.transmission-daemon <<EOF
+    include <tunables/global>
+    $out/bin/transmission-daemon {
+      include <abstractions/base>
+      include <abstractions/nameservice>
+      include <abstractions/ssl_certs>
+      include "${apparmorRulesFromClosure { name = "transmission-daemon"; } ([
+        curl libevent openssl pcre zlib
+      ] ++ lib.optionals enableSystemd [ systemd ]
+        ++ lib.optionals stdenv.isLinux [ inotify-tools ]
+      )}"
+      r @{PROC}/sys/kernel/random/uuid,
+      r @{PROC}/sys/vm/overcommit_memory,
+      r @{PROC}/@{pid}/environ,
+      r @{PROC}/@{pid}/mounts,
+      rwk /tmp/tr_session_id_*,
+      r /run/systemd/resolve/stub-resolv.conf,
+
+      include <local/bin.transmission-daemon>
+    }
+    EOF
+  '';
+
  passthru.tests = {
    smoke-test = nixosTests.bittorrent;
  };
--- a/pkgs/applications/science/math/R/default.nix
+++ b/pkgs/applications/science/math/R/default.nix
@ -69,8 +69,8 @@ stdenv.mkDerivation rec {
      --disable-R-framework
      --without-x
      OBJC="clang"
-      CPPFLAGS="-isystem ${libcxx}/include/c++/v1"
-      LDFLAGS="-L${libcxx}/lib"
+      CPPFLAGS="-isystem ${lib.getDev libcxx}/include/c++/v1"
+      LDFLAGS="-L${lib.getLib libcxx}/lib"
  '' + ''
    )
    echo >>etc/Renviron.in "TCLLIBPATH=${tk}/lib"
--- a/pkgs/applications/science/math/glsurf/default.nix
+++ b/pkgs/applications/science/math/glsurf/default.nix
@ -1,5 +1,5 @@
-{ lib, stdenv, fetchurl, ocamlPackages, libGLU, libGL, freeglut
-, libmysqlclient, mpfr, gmp, libtiff, libjpeg, libpng, giflib
+{ lib, stdenv, fetchurl, ocamlPackages, libGLU, libGL, freeglut, giflib
+, libmysqlclient, mpfr, gmp, libtiff, libjpeg, libpng
 }:

 stdenv.mkDerivation {
@ -10,10 +10,10 @@ stdenv.mkDerivation {
    sha256 = "0w8xxfnw2snflz8wdr2ca9f5g91w5vbyp1hwlx1v7vg83d4bwqs7";
  };

-  buildInputs = [ freeglut libGLU libGL libmysqlclient mpfr gmp
-    libtiff libjpeg libpng giflib ]
+  buildInputs = [ freeglut libGLU libGL libmysqlclient mpfr giflib gmp
+    libtiff libjpeg libpng ]
  ++ (with ocamlPackages; [
-    ocaml findlib ocaml_mysql lablgl camlimages_4_0 mlgmpidl
+    ocaml findlib ocaml_mysql lablgl camlimages_4_1_2 mlgmpidl
  ]);

  installPhase = ''
@ -26,6 +26,6 @@ stdenv.mkDerivation {
  meta = {
    homepage = "https://raffalli.eu/~christophe/glsurf/";
    description = "A program to draw implicit surfaces and curves";
-    license = lib.licenses.lgpl21;
+    license = lib.licenses.gpl2Plus;
  };
 }
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
    sha256 = "0vrgi83hrw4n9zgx873fn4ba3vk54slrwk1cl4cc4plgxzv1y1kg";
  };

-  nativeBuildInputs = [ makeWrapper cmake pkg-config ];
+  nativeBuildInputs = [ makeWrapper cmake pkg-config llvm_5.dev ];
  buildInputs = [ ftgl gl2ps glew pcre zlib zstd llvm_5 libxml2 lz4 xz gsl xxHash libAfterImage giflib libjpeg libtiff libpng python.pkgs.numpy ]
    ++ lib.optionals (!stdenv.isDarwin) [ libX11 libXpm libXft libXext libGLU libGL ]
    ++ lib.optionals (stdenv.isDarwin) [ Cocoa OpenGL ]
--- a/pkgs/applications/video/mplayer/default.nix
+++ b/pkgs/applications/video/mplayer/default.nix
@ -106,6 +106,8 @@ stdenv.mkDerivation rec {
    rm -rf ffmpeg
  '';

+  patches = [ ./svn-r38199-ffmpeg44fix.patch ];
+
  depsBuildBuild = [ buildPackages.stdenv.cc ];
  nativeBuildInputs = [ pkg-config yasm ];
  buildInputs = with lib;
--- a/pkgs/applications/video/mplayer/svn-r38199-ffmpeg44fix.patch
+++ b/pkgs/applications/video/mplayer/svn-r38199-ffmpeg44fix.patch
@ -0,0 +1,22 @@
+Index: libmpcodecs/ad_spdif.c
+===================================================================
+diff --git a/libmpcodecs/ad_spdif.c b/libmpcodecs/ad_spdif.c
+--- a/libmpcodecs/ad_spdif.c	(revision 38198)
+++ b/libmpcodecs/ad_spdif.c	(revision 38199)
+@@ -298,14 +298,8 @@
+         if (spdif_ctx->header_written)
+             av_write_trailer(lavf_ctx);
+         av_freep(&lavf_ctx->pb);
+-        if (lavf_ctx->streams) {
+-            av_freep(&lavf_ctx->streams[0]->codec);
+-            av_freep(&lavf_ctx->streams[0]->info);
+-            av_freep(&lavf_ctx->streams[0]);
+-        }
+-        av_freep(&lavf_ctx->streams);
+-        av_freep(&lavf_ctx->priv_data);
+        avformat_free_context(lavf_ctx);
+        lavf_ctx = NULL;
+     }
+-    av_freep(&lavf_ctx);
+     av_freep(&spdif_ctx);
+ }
--- a/pkgs/applications/window-managers/icewm/default.nix
+++ b/pkgs/applications/window-managers/icewm/default.nix
@ -30,7 +30,7 @@
 , libpthreadstubs
 , libsndfile
 , libtiff
-, libungif
+, giflib
 , libxcb
 , mkfontdir
 , pcre
@ -81,7 +81,7 @@ stdenv.mkDerivation rec {
    libpthreadstubs
    libsndfile
    libtiff
-    libungif
+    giflib
    libxcb
    mkfontdir
    pcre
--- a/pkgs/applications/window-managers/windowmaker/default.nix
+++ b/pkgs/applications/window-managers/windowmaker/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, pkg-config
 , libX11, libXext, libXft, libXmu, libXinerama, libXrandr, libXpm
-, imagemagick, libpng, libjpeg, libexif, libtiff, libungif, libwebp }:
+, imagemagick, libpng, libjpeg, libexif, libtiff, giflib, libwebp }:

 stdenv.mkDerivation rec {
  pname = "windowmaker";
@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ pkg-config ];

  buildInputs = [ libX11 libXext libXft libXmu libXinerama libXrandr libXpm
-                  imagemagick libpng libjpeg libexif libtiff libungif libwebp ];
+                  imagemagick libpng libjpeg libexif libtiff giflib libwebp ];

  configureFlags = [
    "--with-x"
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@ -25,8 +25,9 @@ dontLink=0
 nonFlagArgs=0
 cc1=0
 # shellcheck disable=SC2193
-[[ "@prog@" = *++ ]] && isCpp=1 || isCpp=0
-cppInclude=1
+[[ "@prog@" = *++ ]] && isCxx=1 || isCxx=0
+cxxInclude=1
+cxxLibrary=1
 cInclude=1
 setDynamicLinker=1

@ -50,15 +51,15 @@ while (( "$n" < "$nParams" )); do
        dontLink=1
    elif [[ "$p" = -x && "$p2" = *-header ]]; then
        dontLink=1
-    elif [[ "$p" = -x && "$p2" = c++* && "$isCpp" = 0 ]]; then
-        isCpp=1
+    elif [[ "$p" = -x && "$p2" = c++* && "$isCxx" = 0 ]]; then
+        isCxx=1
    elif [ "$p" = -nostdlib ]; then
-        isCpp=-1
+        cxxLibrary=0
    elif [ "$p" = -nostdinc ]; then
        cInclude=0
-        cppInclude=0
+        cxxInclude=0
    elif [ "$p" = -nostdinc++ ]; then
-        cppInclude=0
+        cxxInclude=0
    elif [[ "$p" = -static || "$p" = -static-pie ]]; then
        setDynamicLinker=0
    elif [[ "$p" != -?* ]]; then
@ -131,12 +132,13 @@ if [ "$NIX_ENFORCE_NO_NATIVE_@suffixSalt@" = 1 ]; then
    params=(${rest+"${rest[@]}"})
 fi

-if [[ "$isCpp" = 1 ]]; then
-    NIX_CFLAGS_LINK_@suffixSalt@+=" $NIX_CXXSTDLIB_LINK_@suffixSalt@"
-fi
-
-if [[ "$cppInclude" = 1 ]]; then
-    NIX_CFLAGS_COMPILE_@suffixSalt@+=" $NIX_CXXSTDLIB_COMPILE_@suffixSalt@"
+if [[ "$isCxx" = 1 ]]; then
+    if [[ "$cxxInclude" = 1 ]]; then
+        NIX_CFLAGS_COMPILE_@suffixSalt@+=" $NIX_CXXSTDLIB_COMPILE_@suffixSalt@"
+    fi
+    if [[ "$cxxLibrary" = 1 ]]; then
+        NIX_CFLAGS_LINK_@suffixSalt@+=" $NIX_CXXSTDLIB_LINK_@suffixSalt@"
+    fi
 fi

 source @out@/nix-support/add-hardening.sh
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@ -370,7 +370,7 @@ stdenv.mkDerivation {
      done
    ''
    + optionalString (libcxx.isLLVM or false) (''
-      echo "-isystem ${libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
+      echo "-isystem ${lib.getDev libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
      echo "-stdlib=libc++" >> $out/nix-support/libcxx-ldflags
    '' + lib.optionalString stdenv.targetPlatform.isLinux ''
      echo "-lc++abi" >> $out/nix-support/libcxx-ldflags
@ -404,7 +404,7 @@ stdenv.mkDerivation {
      echo "$ccLDFlags" >> $out/nix-support/cc-ldflags
      echo "$ccCFlags" >> $out/nix-support/cc-cflags
    '' + optionalString (targetPlatform.isDarwin && (libcxx != null) && (cc.isClang or false)) ''
-      echo " -L${libcxx}/lib" >> $out/nix-support/cc-ldflags
+      echo " -L${lib.getLib libcxx}/lib" >> $out/nix-support/cc-ldflags
    ''

    ##
--- a/pkgs/build-support/rust/default-crate-overrides.nix
+++ b/pkgs/build-support/rust/default-crate-overrides.nix
@ -92,7 +92,7 @@ in
  nettle-sys = attrs: {
    nativeBuildInputs = [ pkg-config ];
    buildInputs = [ nettle clang ];
-    LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
+    LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
  };

  openssl = attrs: {
--- a/pkgs/desktops/gnustep/base/default.nix
+++ b/pkgs/desktops/gnustep/base/default.nix
@ -4,7 +4,7 @@
 , fetchurl, fetchpatch
 , gmp, gnutls
 , libffi, binutils-unwrapped
-, libjpeg, libtiff, libpng, giflib, libungif
+, libjpeg, libtiff, libpng, giflib
 , libxml2, libxslt, libiconv
 , libobjc, libgcrypt
 , icu
@ -26,7 +26,7 @@ gsmakeDerivation {
    cups
    gmp gnutls
    libffi binutils-unwrapped
-    libjpeg libtiff libpng giflib libungif
+    libjpeg libtiff libpng giflib giflib
    libxml2 libxslt libiconv
    libobjc libgcrypt
    icu
--- a/pkgs/desktops/gnustep/default.nix
+++ b/pkgs/desktops/gnustep/default.nix
@ -1,6 +1,5 @@
 { newScope
 , llvmPackages
-, giflib_4_1
 }:

 let
@ -16,7 +15,7 @@ let
    libobjc = callPackage ./libobjc2 {};
    make = callPackage ./make {};
    back = callPackage ./back {};
-    base = callPackage ./base { giflib = giflib_4_1; };
+    base = callPackage ./base { };
    gui = callPackage ./gui {};
    gworkspace = callPackage ./gworkspace {};
  };
--- a/pkgs/desktops/plasma-5/fetch.sh
+++ b/pkgs/desktops/plasma-5/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/plasma/5.21.3/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/plasma/5.21.4/ -A '*.tar.xz' )
--- a/pkgs/desktops/plasma-5/srcs.nix
+++ b/pkgs/desktops/plasma-5/srcs.nix
@ -4,419 +4,419 @@

 {
  bluedevil = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/bluedevil-5.21.3.tar.xz";
-      sha256 = "1xqm4bn97asilc4yw5rvmmhk7c7wvmbalalr6gz8gw4gv0pg67qv";
-      name = "bluedevil-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/bluedevil-5.21.4.tar.xz";
+      sha256 = "0ls6ijk10pgi75ycwcnq3z4j5hn657cnr4s7fky53qkc3y2x25g1";
+      name = "bluedevil-5.21.4.tar.xz";
    };
  };
  breeze = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/breeze-5.21.3.tar.xz";
-      sha256 = "0frm3f8q1n0pdzjk7zwmvlrl19fb9265ihnnfhak6ckaq50x72l3";
-      name = "breeze-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/breeze-5.21.4.tar.xz";
+      sha256 = "1n6hwppcbnn3hw5r3f9jssvslnming9qvs4s2czyl0kky1nv8bfm";
+      name = "breeze-5.21.4.tar.xz";
    };
  };
  breeze-grub = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/breeze-grub-5.21.3.tar.xz";
-      sha256 = "1j0pk4pv5pxwhwah1gd5znnsw3j15x2sc74pp6zinz9a1ywjklnz";
-      name = "breeze-grub-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/breeze-grub-5.21.4.tar.xz";
+      sha256 = "1jd8fy9b5cmv1da27xqbl6x3197pq6m4wwxzylxgnmciivhmnzm2";
+      name = "breeze-grub-5.21.4.tar.xz";
    };
  };
  breeze-gtk = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/breeze-gtk-5.21.3.tar.xz";
-      sha256 = "1x5by915lfhbkhgrhy3lkwg64skwdlqaxzbq92x0m9v9a9agwidc";
-      name = "breeze-gtk-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/breeze-gtk-5.21.4.tar.xz";
+      sha256 = "03aj8rxh46j663m26jsb9hrg0x5j0hvzjqwc8l1ayfcwkdgl4b4i";
+      name = "breeze-gtk-5.21.4.tar.xz";
    };
  };
  breeze-plymouth = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/breeze-plymouth-5.21.3.tar.xz";
-      sha256 = "01ida3pfj6g1igndjfjpv16199zysgxlxlnc7vsx7kr8aval8pmx";
-      name = "breeze-plymouth-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/breeze-plymouth-5.21.4.tar.xz";
+      sha256 = "0ibwl2aikh547k851pb78216v8ld5la9xg3f9945dcbf7ly88nd7";
+      name = "breeze-plymouth-5.21.4.tar.xz";
    };
  };
  discover = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/discover-5.21.3.tar.xz";
-      sha256 = "170kxhrwj4mvj5qg7cyz3sxdfyp7rr4pgsi3v7kahs19a9w3isnx";
-      name = "discover-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/discover-5.21.4.tar.xz";
+      sha256 = "1f3hvafyf2kga1ywn5aia37xxgagx6p2b43h7ap7mjkmw7ywyr30";
+      name = "discover-5.21.4.tar.xz";
    };
  };
  drkonqi = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/drkonqi-5.21.3.tar.xz";
-      sha256 = "1hq37vi0vndhy66labspm75blicx1g4q594wxfxzl076mav5jds4";
-      name = "drkonqi-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/drkonqi-5.21.4.tar.xz";
+      sha256 = "123l0hyyzskjivasp1q8w9y2f2mbjrwjap3yfi23h98zbzcblcaq";
+      name = "drkonqi-5.21.4.tar.xz";
    };
  };
  kactivitymanagerd = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kactivitymanagerd-5.21.3.tar.xz";
-      sha256 = "1x5p6rbjf9kz07r5mrkiglvbigvk5bfx8qpb8l2vagsbvlg298c3";
-      name = "kactivitymanagerd-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kactivitymanagerd-5.21.4.tar.xz";
+      sha256 = "0waawpy5pqllj8iacrxpwsnz4m1yy7z8jih63s7psgr22cbvd116";
+      name = "kactivitymanagerd-5.21.4.tar.xz";
    };
  };
  kde-cli-tools = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kde-cli-tools-5.21.3.tar.xz";
-      sha256 = "0hkmr3zxg4np1ppsgj77ijgkwgvl7d0zxwl46xjc2px877lx8bpp";
-      name = "kde-cli-tools-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kde-cli-tools-5.21.4.tar.xz";
+      sha256 = "1hvfb0qg6hxbyih665xwki8gbxjljgbw6x2blh2cikp7df66nhh1";
+      name = "kde-cli-tools-5.21.4.tar.xz";
    };
  };
  kdecoration = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kdecoration-5.21.3.tar.xz";
-      sha256 = "06a3gsf1lyjxccjzn0ad254wsf7x2bln2i6kyk5j4gwqss6lplf5";
-      name = "kdecoration-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kdecoration-5.21.4.tar.xz";
+      sha256 = "003yp803gnsszlnbw1lbh043h8xlrrzg92v7vls8k5cb04ib0p8a";
+      name = "kdecoration-5.21.4.tar.xz";
    };
  };
  kde-gtk-config = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kde-gtk-config-5.21.3.tar.xz";
-      sha256 = "17fyan2jah059kj1i0sy7h901a4d2k7cc87sd84mskyys7g8vs1h";
-      name = "kde-gtk-config-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kde-gtk-config-5.21.4.tar.xz";
+      sha256 = "0g7h1l5q9hdi2iq1kh5aclxjw1ffpq1l020p37k7f251m49440y8";
+      name = "kde-gtk-config-5.21.4.tar.xz";
    };
  };
  kdeplasma-addons = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kdeplasma-addons-5.21.3.tar.xz";
-      sha256 = "1181ax96csn4170p5blvhr679d7l865nby5a66swscyl3a5ys8b1";
-      name = "kdeplasma-addons-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kdeplasma-addons-5.21.4.tar.xz";
+      sha256 = "18jny36w6zf4nfqffaqgmdgp4vcaa2civnd2lrrls8jhlz81grid";
+      name = "kdeplasma-addons-5.21.4.tar.xz";
    };
  };
  kgamma5 = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kgamma5-5.21.3.tar.xz";
-      sha256 = "0h8rwwd6lyfzmxsr5sfvllh1j8gk1pbq1w2fva8q534qrkqhqb49";
-      name = "kgamma5-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kgamma5-5.21.4.tar.xz";
+      sha256 = "1rzn3d7i2i4bba9nfydbsvjqc7wzfz9lgd7qg74k19hzmfiqfhsl";
+      name = "kgamma5-5.21.4.tar.xz";
    };
  };
  khotkeys = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/khotkeys-5.21.3.tar.xz";
-      sha256 = "1n3ahrb5mzrxap572ydal1sy5q71af97iy4i2fwbljdb6zb1l1bl";
-      name = "khotkeys-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/khotkeys-5.21.4.tar.xz";
+      sha256 = "05k6b8zilll97s14s50x27dk8p4lzmld95gzgrsv4i81jdvjgx53";
+      name = "khotkeys-5.21.4.tar.xz";
    };
  };
  kinfocenter = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kinfocenter-5.21.3.tar.xz";
-      sha256 = "1hj4mnx2mxb1ya7la05frx5c39cp3q7c5f78lnp6p8bkv3ylik72";
-      name = "kinfocenter-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kinfocenter-5.21.4.tar.xz";
+      sha256 = "150kfx4cb10zjsaqkyidh1qis5644849xfqfnd5ldwsn07nkyp1y";
+      name = "kinfocenter-5.21.4.tar.xz";
    };
  };
  kmenuedit = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kmenuedit-5.21.3.tar.xz";
-      sha256 = "0fc3sal11amaj5ydws86hdmc45zhrxkv6lc5sfy200wvff3ynjjj";
-      name = "kmenuedit-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kmenuedit-5.21.4.tar.xz";
+      sha256 = "1hmqji2ahkw3knv7pcj5m86zlmxmbsz98xv2igdx2gv6hrjbn8nh";
+      name = "kmenuedit-5.21.4.tar.xz";
    };
  };
  kscreen = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kscreen-5.21.3.tar.xz";
-      sha256 = "1f9gxdlj883ddmc1xgd1nmm8n6m5yd269kfx3m9bbp61cw4hrqlm";
-      name = "kscreen-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kscreen-5.21.4.tar.xz";
+      sha256 = "1n9ymmysdfipwwi3f6ixg1kh3pkbp5wvi2y8fli0cpjdbrfj5lfr";
+      name = "kscreen-5.21.4.tar.xz";
    };
  };
  kscreenlocker = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kscreenlocker-5.21.3.tar.xz";
-      sha256 = "1hjlpwwca9nrdwgsiy5ss5ainr1fy1wfvi4g599cvijb77qc84h0";
-      name = "kscreenlocker-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kscreenlocker-5.21.4.tar.xz";
+      sha256 = "1z94p93khl2b8zz965d6wdd4vi1q60f0s2a7ca9ph06gp8d574k4";
+      name = "kscreenlocker-5.21.4.tar.xz";
    };
  };
  ksshaskpass = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/ksshaskpass-5.21.3.tar.xz";
-      sha256 = "16c2kzdmw3viphaygdff29cvi06r53ag4a6hkxw15yrscw31n3ns";
-      name = "ksshaskpass-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/ksshaskpass-5.21.4.tar.xz";
+      sha256 = "0zj4160xs940b9rin43b0a3j6czm3n04drg484y1h2mfqjflgc61";
+      name = "ksshaskpass-5.21.4.tar.xz";
    };
  };
  ksysguard = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/ksysguard-5.21.3.tar.xz";
-      sha256 = "0ys1idjqb9n67czdhlds6mhhiizxq8qq4rmds9nq8cm961g5kqsf";
-      name = "ksysguard-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/ksysguard-5.21.4.tar.xz";
+      sha256 = "10p5bb80rcawd0qdm4f17whmqrfhzhv6hd20d57f1i9m7ijq456d";
+      name = "ksysguard-5.21.4.tar.xz";
    };
  };
  kwallet-pam = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kwallet-pam-5.21.3.tar.xz";
-      sha256 = "1dnni2k4ry11mfjnfc0i44zww3glhsbr70qnpkl9dsf5rj4dcwj3";
-      name = "kwallet-pam-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kwallet-pam-5.21.4.tar.xz";
+      sha256 = "0s3wy9qikciblr6g98kn6s4ii5pnqwcngzng0czr3r4p90w33kkg";
+      name = "kwallet-pam-5.21.4.tar.xz";
    };
  };
  kwayland-integration = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kwayland-integration-5.21.3.tar.xz";
-      sha256 = "0kqw5dbsxmdm5fi34yq718ngkx5j23211jh4l9vl029qgbi42xhc";
-      name = "kwayland-integration-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kwayland-integration-5.21.4.tar.xz";
+      sha256 = "1r3fmmzmdyfdam4hsjvjv3wss5zvyi674xsyn6csclmq3jwfz70k";
+      name = "kwayland-integration-5.21.4.tar.xz";
    };
  };
  kwayland-server = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kwayland-server-5.21.3.tar.xz";
-      sha256 = "0d3asblzz9c7cbjfdk33z26hn5n14rdrc3s9jm9awvcc1sd122a4";
-      name = "kwayland-server-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kwayland-server-5.21.4.tar.xz";
+      sha256 = "1mkivw3siyxhgyhrm6fkqmp2wiswckrb433q87dh1j9gp7kg8cpz";
+      name = "kwayland-server-5.21.4.tar.xz";
    };
  };
  kwin = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kwin-5.21.3.tar.xz";
-      sha256 = "0ni0ipfm0hp90sq03m1a5lm6shxb2cf9j1a4kiqpaf7n62ch8f3w";
-      name = "kwin-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kwin-5.21.4.tar.xz";
+      sha256 = "0br3hxnbqm2vyxcxind01784zd88bkhpz6ira03g3gjq7hlwzjx9";
+      name = "kwin-5.21.4.tar.xz";
    };
  };
  kwrited = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kwrited-5.21.3.tar.xz";
-      sha256 = "01nn94qmi8q38rdv694d9qs7zahsziclmkw49zy0wlffq4ivpk6x";
-      name = "kwrited-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kwrited-5.21.4.tar.xz";
+      sha256 = "1hrsy1r7b7sgnj0l8zn1yxlrfhrrbk8rq2frbfi329fk3psca247";
+      name = "kwrited-5.21.4.tar.xz";
    };
  };
  libkscreen = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/libkscreen-5.21.3.tar.xz";
-      sha256 = "1j2d1xpn48ks0wk9vvnvj9r03bc0ggrqvblyhs30p31svfihjs3a";
-      name = "libkscreen-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/libkscreen-5.21.4.tar.xz";
+      sha256 = "0b0mlc1lzfbkpzxs8rd7s7q5xmqla6p1q1jdnjxly3wj60pas2dc";
+      name = "libkscreen-5.21.4.tar.xz";
    };
  };
  libksysguard = {
-    version = "5.21.3.1";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/libksysguard-5.21.3.1.tar.xz";
-      sha256 = "0nayjihapn71wrnzfb4wv9laafysl0x6sn98sbwhclapbdvxnw73";
-      name = "libksysguard-5.21.3.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/libksysguard-5.21.4.tar.xz";
+      sha256 = "0sziqldjwcwpblkn7mn4w9xg34lv9pzdlc87andka4g1lxcln2gc";
+      name = "libksysguard-5.21.4.tar.xz";
    };
  };
  milou = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/milou-5.21.3.tar.xz";
-      sha256 = "0qbk0y783n7f7pl0akx252vyblrrgmsg5yr7ncaijq4x4l90f1yf";
-      name = "milou-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/milou-5.21.4.tar.xz";
+      sha256 = "0y6mvzc5prgg1n7z2gzv1b7ngh0fygggrhdbk5wvpy6zp8yanwka";
+      name = "milou-5.21.4.tar.xz";
    };
  };
  oxygen = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/oxygen-5.21.3.tar.xz";
-      sha256 = "16yj1qx4mbi62brkn8wkcr6sz5dkbl2pf49zc1hadnxfm9wd3z0a";
-      name = "oxygen-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/oxygen-5.21.4.tar.xz";
+      sha256 = "1d7cdpy3k7zyg3k6n6jz2473cqhbi7npgnpka4kc2lfjrkb9s0zj";
+      name = "oxygen-5.21.4.tar.xz";
    };
  };
  plasma-browser-integration = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-browser-integration-5.21.3.tar.xz";
-      sha256 = "1hz996lv3vvp1zldzpkb9dmvnn94v69j2vq9sfs446c25ggf9d6y";
-      name = "plasma-browser-integration-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-browser-integration-5.21.4.tar.xz";
+      sha256 = "14yna45ykfa88a17iy4c5qkd673ay818693qqn13s4zwkxriby3n";
+      name = "plasma-browser-integration-5.21.4.tar.xz";
    };
  };
  plasma-desktop = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-desktop-5.21.3.tar.xz";
-      sha256 = "0bryk523qfzb5max1h460d67ir6xbrsws9bq72bdfbv1wkv64kyy";
-      name = "plasma-desktop-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-desktop-5.21.4.tar.xz";
+      sha256 = "1drv50601030xvskkw1pa5hi5ngrx2i8lkj7m8i9pym8zy15qqy9";
+      name = "plasma-desktop-5.21.4.tar.xz";
    };
  };
  plasma-disks = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-disks-5.21.3.tar.xz";
-      sha256 = "18a7dppfhb2wpb7sfhnayq96bxjlzygdz7sppcjikxil8klhv1aq";
-      name = "plasma-disks-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-disks-5.21.4.tar.xz";
+      sha256 = "1hjihh088v1w03lpz5pcz6pycbpd8b8kh54a44pq7zkhh6l6n65g";
+      name = "plasma-disks-5.21.4.tar.xz";
    };
  };
  plasma-firewall = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-firewall-5.21.3.tar.xz";
-      sha256 = "0bzmcakzwiimc90bbpih1z5isrcfhdfwlslp4q3v3npppnivv9bw";
-      name = "plasma-firewall-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-firewall-5.21.4.tar.xz";
+      sha256 = "1in9maphksc7ajj6jhy0qxgw5f7fy4m23dpik6wvxc5r3v5b76z7";
+      name = "plasma-firewall-5.21.4.tar.xz";
    };
  };
  plasma-integration = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-integration-5.21.3.tar.xz";
-      sha256 = "09dlbfildd8wl0nbss84yibljyl6cadx95q8q4n0c5wymyc4zqy1";
-      name = "plasma-integration-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-integration-5.21.4.tar.xz";
+      sha256 = "0bj2k5c4170apy7ascfdqc052jm35pi2w5zb3m39qb5b7ylq1hhw";
+      name = "plasma-integration-5.21.4.tar.xz";
    };
  };
  plasma-nano = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-nano-5.21.3.tar.xz";
-      sha256 = "1yqn29769nnfhiyqbpv15c0zxvkfzq4yvk9x9qlchbcwjc1gr23j";
-      name = "plasma-nano-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-nano-5.21.4.tar.xz";
+      sha256 = "0v5vr5di9bk57g2xi442qj8yv9219mdpc0l0n2bsvbb8x4f0d5qk";
+      name = "plasma-nano-5.21.4.tar.xz";
    };
  };
  plasma-nm = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-nm-5.21.3.tar.xz";
-      sha256 = "0d7v757kzd0pcvlz201m0njcz9y8j0bqkwbzdz3gik9s7x6rl73p";
-      name = "plasma-nm-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-nm-5.21.4.tar.xz";
+      sha256 = "1gy1drykjyipmrpqbb7yk2232g5hzy316gkmr45invgfg3fizl73";
+      name = "plasma-nm-5.21.4.tar.xz";
    };
  };
  plasma-pa = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-pa-5.21.3.tar.xz";
-      sha256 = "16z9xzn5swrzz86yd8lykjphs92ghdsahfxjv0v9nj3ca24kfibp";
-      name = "plasma-pa-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-pa-5.21.4.tar.xz";
+      sha256 = "1rcghgqvasldmpianxhn980kc3nw1knmdlmxz52kngnpnimmqmz9";
+      name = "plasma-pa-5.21.4.tar.xz";
    };
  };
  plasma-phone-components = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-phone-components-5.21.3.tar.xz";
-      sha256 = "1dhv0gdyk47dl8il6zwjdz84jmz2d4ppfyifzc2rzf0ys934scn0";
-      name = "plasma-phone-components-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-phone-components-5.21.4.tar.xz";
+      sha256 = "08dpch4c6q59c9ys4n4w1hky09886hi1wqxgwwr4lyp02g3xmwbd";
+      name = "plasma-phone-components-5.21.4.tar.xz";
    };
  };
  plasma-sdk = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-sdk-5.21.3.tar.xz";
-      sha256 = "0asbb7j5b8c4kixw1yf7mdfyd8gjrf57gdb2wfs1npasak0dw84w";
-      name = "plasma-sdk-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-sdk-5.21.4.tar.xz";
+      sha256 = "1cn0lq3d5ipmlwkjzarm7s5ipx6ybjv9cz93pnpxkfxlbi47q0s0";
+      name = "plasma-sdk-5.21.4.tar.xz";
    };
  };
  plasma-systemmonitor = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-systemmonitor-5.21.3.tar.xz";
-      sha256 = "1w1xzqmpzk016f8rkyx6cvm6lng3h177c441hird13n6v147l7ll";
-      name = "plasma-systemmonitor-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-systemmonitor-5.21.4.tar.xz";
+      sha256 = "16mrq66qripffnj4gskzb6l52hqw9siqr8cwxq618cwk5g7hg544";
+      name = "plasma-systemmonitor-5.21.4.tar.xz";
    };
  };
  plasma-tests = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-tests-5.21.3.tar.xz";
-      sha256 = "000iwijpxxicixy5zbbgfs96h988x1d4wvjw90vagjw4hj361dk8";
-      name = "plasma-tests-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-tests-5.21.4.tar.xz";
+      sha256 = "0mxl3laym3wlhqnq7pmjm1g9mm0r306dnsr3yjl5mmhdx3dwb165";
+      name = "plasma-tests-5.21.4.tar.xz";
    };
  };
  plasma-thunderbolt = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-thunderbolt-5.21.3.tar.xz";
-      sha256 = "1j0nb9p5wbgksxy19bxsz9ni9ys40r4arvs8rl8pvvv9hndqhndm";
-      name = "plasma-thunderbolt-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-thunderbolt-5.21.4.tar.xz";
+      sha256 = "10r90hjm1ykigy587kdna6cydbbh9y4h7rbifx2r5rjzkhp9mihd";
+      name = "plasma-thunderbolt-5.21.4.tar.xz";
    };
  };
  plasma-vault = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-vault-5.21.3.tar.xz";
-      sha256 = "1q59q6y8gx4qbp1a5nbsg8zmrdljacfqd3i5n214nlj6al13sg9j";
-      name = "plasma-vault-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-vault-5.21.4.tar.xz";
+      sha256 = "13d4z2g34skhw11wykhwyigdzxpa12pgq01i30km5cyp0idi6xy5";
+      name = "plasma-vault-5.21.4.tar.xz";
    };
  };
  plasma-workspace = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-workspace-5.21.3.tar.xz";
-      sha256 = "1djanxc7mslw9hnbzlngf6pflc6byjzqb14ibilg3fxsir2jwq40";
-      name = "plasma-workspace-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-workspace-5.21.4.tar.xz";
+      sha256 = "1m98ssdq4vzhlqazd87qmgryi3fhmp68y47qw95yhaxnf12ih2xs";
+      name = "plasma-workspace-5.21.4.tar.xz";
    };
  };
  plasma-workspace-wallpapers = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-workspace-wallpapers-5.21.3.tar.xz";
-      sha256 = "1qjkk3qfzz1id898kmx7xx6rr6p77y0jfwkjyf26abk51bdfk9lm";
-      name = "plasma-workspace-wallpapers-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-workspace-wallpapers-5.21.4.tar.xz";
+      sha256 = "1myqz90b1fcmzgq08a15mlikn83iv6hflmdw7985419w7cly81n7";
+      name = "plasma-workspace-wallpapers-5.21.4.tar.xz";
    };
  };
  plymouth-kcm = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plymouth-kcm-5.21.3.tar.xz";
-      sha256 = "0wmpvb06z0js50c9jpv61jlxbx9sf1f5lidzs5v4xs31shxc9sbg";
-      name = "plymouth-kcm-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plymouth-kcm-5.21.4.tar.xz";
+      sha256 = "1d0na5831azka04n3j78582i3hy5ns1hpdw24y558rly16w80z60";
+      name = "plymouth-kcm-5.21.4.tar.xz";
    };
  };
  polkit-kde-agent = {
-    version = "1-5.21.3";
+    version = "1-5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/polkit-kde-agent-1-5.21.3.tar.xz";
-      sha256 = "06qpkf01665mjr49wyc3f336g6g7l93k8l35q0yyih58i3v04s0v";
-      name = "polkit-kde-agent-1-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/polkit-kde-agent-1-5.21.4.tar.xz";
+      sha256 = "0lg2ls4fb135p64y3kmkxczrqmqzlzdq4ywsrf58ayi42drghdmj";
+      name = "polkit-kde-agent-1-5.21.4.tar.xz";
    };
  };
  powerdevil = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/powerdevil-5.21.3.tar.xz";
-      sha256 = "0lk6bvc0mym3x3sd85bsvsxvm82vr40lcx355xjycxskf75c5jzz";
-      name = "powerdevil-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/powerdevil-5.21.4.tar.xz";
+      sha256 = "0i84k7dv8nvww0pfly2d7mplydjgzdkh14sd17113rlwzyfp5wf6";
+      name = "powerdevil-5.21.4.tar.xz";
    };
  };
  qqc2-breeze-style = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/qqc2-breeze-style-5.21.3.tar.xz";
-      sha256 = "1ydvirjrkjbwfc2faz74dd9zlmfz18fa3cig143gna9rfr5api54";
-      name = "qqc2-breeze-style-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/qqc2-breeze-style-5.21.4.tar.xz";
+      sha256 = "0ny9i75zm0j4m103kazs6lnny8lcmisgl6kmyvjwsnxfl0wfrdww";
+      name = "qqc2-breeze-style-5.21.4.tar.xz";
    };
  };
  sddm-kcm = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/sddm-kcm-5.21.3.tar.xz";
-      sha256 = "1flqgfpiz66s7dsw1k95zdrbj7ka09r0i2pcdygnrwlls5yvqljz";
-      name = "sddm-kcm-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/sddm-kcm-5.21.4.tar.xz";
+      sha256 = "00940pi4x7is88w6b25f5chqhi97xqvnmn92jzy629p1g8zg75ik";
+      name = "sddm-kcm-5.21.4.tar.xz";
    };
  };
  systemsettings = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/systemsettings-5.21.3.tar.xz";
-      sha256 = "08ynlg282x1klgpd43mh3ng4m579iq9hjlln96fqaw19g7x1i58x";
-      name = "systemsettings-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/systemsettings-5.21.4.tar.xz";
+      sha256 = "017d42fdb8dn1srni4lvdyvraaflybbcwkdgdl98vwyv9hw0qjq3";
+      name = "systemsettings-5.21.4.tar.xz";
    };
  };
  xdg-desktop-portal-kde = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/xdg-desktop-portal-kde-5.21.3.tar.xz";
-      sha256 = "05r1kbw39jmj2gfn42052y779l0k89kxh7xynw07igr7c5mxy4ih";
-      name = "xdg-desktop-portal-kde-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/xdg-desktop-portal-kde-5.21.4.tar.xz";
+      sha256 = "01klvbvivw2zd478vj7bq0dn7l5mwsrqhnkj8hd5vc9xcaq6kgzg";
+      name = "xdg-desktop-portal-kde-5.21.4.tar.xz";
    };
  };
 }
--- a/pkgs/development/compilers/adoptopenjdk-bin/jdk-darwin-base.nix
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk-darwin-base.nix
@ -3,6 +3,7 @@
 { swingSupport ? true # not used for now
 , lib, stdenv
 , fetchurl
+, setJavaClassPath
 }:

 let cpuName = stdenv.hostPlatform.parsed.cpu.name;
@ -30,7 +31,11 @@ let cpuName = stdenv.hostPlatform.parsed.cpu.name;

    ln -s $out/Contents/Home/* $out/

+    # Propagate the setJavaClassPath setup hook from the JDK so that
+    # any package that depends on the JDK has $CLASSPATH set up
+    # properly.
    mkdir -p $out/nix-support
+    printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs

    # Set JAVA_HOME automatically.
    cat <<EOF >> $out/nix-support/setup-hook
--- a/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
@ -5,6 +5,7 @@
 , fetchurl
 , autoPatchelfHook
 , makeWrapper
+, setJavaClassPath
 # minimum dependencies
 , alsaLib
 , fontconfig
@ -74,7 +75,11 @@ let result = stdenv.mkDerivation rec {
    # https://github.com/NixOS/nixpkgs/issues/57733
    find "$out" -name 'libfreetype.so*' -delete

+    # Propagate the setJavaClassPath setup hook from the JDK so that
+    # any package that depends on the JDK has $CLASSPATH set up
+    # properly.
    mkdir -p $out/nix-support
+    printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs

    # Set JAVA_HOME automatically.
    cat <<EOF >> "$out/nix-support/setup-hook"
--- a/pkgs/development/compilers/crystal/default.nix
+++ b/pkgs/development/compilers/crystal/default.nix
@ -146,7 +146,7 @@ let
        "CRYSTAL_CONFIG_VERSION=${version}"
      ];

-      LLVM_CONFIG = "${llvmPackages.llvm}/bin/llvm-config";
+      LLVM_CONFIG = "${llvmPackages.llvm.dev}/bin/llvm-config";

      FLAGS = [
        "--release"
--- a/pkgs/development/compilers/dale/default.nix
+++ b/pkgs/development/compilers/dale/default.nix
@ -19,7 +19,7 @@ stdenv.mkDerivation {
    sha256 = "0v4ajrzrqvf279kd7wsd9flrpsav57lzxlwwimk9vnfwh7xpzf9v";
  };

-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [ cmake pkg-config llvm_6.dev ];
  buildInputs = [ libffi llvm_6 ];

  inherit doCheck;
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@ -4,6 +4,7 @@
 , langObjC ? stdenv.targetPlatform.isDarwin
 , langObjCpp ? stdenv.targetPlatform.isDarwin
 , langGo ? false
+, reproducibleBuild ? true
 , profiledCompiler ? false
 , langJit ? false
 , staticCompiler ? false
@ -48,11 +49,15 @@ assert langAda -> gnatboot != null;
 # threadsCross is just for MinGW
 assert threadsCross != null -> stdenv.targetPlatform.isWindows;

+# profiledCompiler builds inject non-determinism in one of the compilation stages.
+# If turned on, we can't provide reproducible builds anymore
+assert reproducibleBuild -> profiledCompiler == false;
+
 with lib;
 with builtins;

 let majorVersion = "10";
-    version = "${majorVersion}.2.0";
+    version = "${majorVersion}.3.0";

    inherit (stdenv) buildPlatform hostPlatform targetPlatform;

@ -85,7 +90,7 @@ stdenv.mkDerivation ({

  src = fetchurl {
    url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = "130xdkhmz1bc2kzx061s3sfwk36xah1fw5w332c0nzwwpdl47pdq";
+    sha256 = "0i6378ig6h397zkhd7m4ccwjx5alvzrf2hm27p1pzwjhlv0h9x34";
  };

  inherit patches;
@ -186,8 +191,7 @@ stdenv.mkDerivation ({

  dontDisableStatic = true;

-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];

  configureFlags = import ../common/configure-flags.nix {
    inherit
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@ -4,6 +4,7 @@
 , langObjCpp ? stdenv.targetPlatform.isDarwin
 , langJava ? false
 , langGo ? false
+, reproducibleBuild ? true
 , profiledCompiler ? false
 , langJit ? false
 , staticCompiler ? false
@ -58,6 +59,10 @@ assert langGo -> langCC;
 # threadsCross is just for MinGW
 assert threadsCross != null -> stdenv.targetPlatform.isWindows;

+# profiledCompiler builds inject non-determinism in one of the compilation stages.
+# If turned on, we can't provide reproducible builds anymore
+assert reproducibleBuild -> profiledCompiler == false;
+
 with lib;
 with builtins;

@ -196,8 +201,7 @@ stdenv.mkDerivation ({

  dontDisableStatic = true;

-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];

  configureFlags = import ../common/configure-flags.nix {
    inherit
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@ -4,6 +4,7 @@
 , langObjCpp ? stdenv.targetPlatform.isDarwin
 , langJava ? false
 , langGo ? false
+, reproducibleBuild ? true
 , profiledCompiler ? false
 , langJit ? false
 , staticCompiler ? false
@ -58,6 +59,10 @@ assert langGo -> langCC;
 # threadsCross is just for MinGW
 assert threadsCross != null -> stdenv.targetPlatform.isWindows;

+# profiledCompiler builds inject non-determinism in one of the compilation stages.
+# If turned on, we can't provide reproducible builds anymore
+assert reproducibleBuild -> profiledCompiler == false;
+
 with lib;
 with builtins;

@ -209,8 +214,7 @@ stdenv.mkDerivation ({

  dontDisableStatic = true;

-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];

  configureFlags = import ../common/configure-flags.nix {
    inherit
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@ -5,6 +5,7 @@
 , langObjCpp ? stdenv.targetPlatform.isDarwin
 , langJava ? false
 , langGo ? false
+, reproducibleBuild ? true
 , profiledCompiler ? false
 , langJit ? false
 , staticCompiler ? false
@ -61,6 +62,10 @@ assert langAda -> gnatboot != null;
 # threadsCross is just for MinGW
 assert threadsCross != null -> stdenv.targetPlatform.isWindows;

+# profiledCompiler builds inject non-determinism in one of the compilation stages.
+# If turned on, we can't provide reproducible builds anymore
+assert reproducibleBuild -> profiledCompiler == false;
+
 with lib;
 with builtins;

@ -232,8 +237,7 @@ stdenv.mkDerivation ({

  dontDisableStatic = true;

-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];

  configureFlags = import ../common/configure-flags.nix {
    inherit
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@ -3,6 +3,7 @@
 , langObjC ? stdenv.targetPlatform.isDarwin
 , langObjCpp ? stdenv.targetPlatform.isDarwin
 , langGo ? false
+, reproducibleBuild ? true
 , profiledCompiler ? false
 , langJit ? false
 , staticCompiler ? false
@ -45,6 +46,10 @@ assert langGo -> langCC;
 # threadsCross is just for MinGW
 assert threadsCross != null -> stdenv.targetPlatform.isWindows;

+# profiledCompiler builds inject non-determinism in one of the compilation stages.
+# If turned on, we can't provide reproducible builds anymore
+assert reproducibleBuild -> profiledCompiler == false;
+
 with lib;
 with builtins;

@ -197,8 +202,7 @@ stdenv.mkDerivation ({

  dontDisableStatic = true;

-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];

  configureFlags = import ../common/configure-flags.nix {
    inherit
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@ -3,6 +3,7 @@
 , langObjC ? stdenv.targetPlatform.isDarwin
 , langObjCpp ? stdenv.targetPlatform.isDarwin
 , langGo ? false
+, reproducibleBuild ? true
 , profiledCompiler ? false
 , langJit ? false
 , staticCompiler ? false
@ -45,6 +46,10 @@ assert langGo -> langCC;
 # threadsCross is just for MinGW
 assert threadsCross != null -> stdenv.targetPlatform.isWindows;

+# profiledCompiler builds inject non-determinism in one of the compilation stages.
+# If turned on, we can't provide reproducible builds anymore
+assert reproducibleBuild -> profiledCompiler == false;
+
 with lib;
 with builtins;

@ -183,8 +188,7 @@ stdenv.mkDerivation ({

  dontDisableStatic = true;

-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];

  configureFlags = import ../common/configure-flags.nix {
    inherit
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@ -5,6 +5,7 @@
 , langObjCpp ? stdenv.targetPlatform.isDarwin
 , langD ? false
 , langGo ? false
+, reproducibleBuild ? true
 , profiledCompiler ? false
 , langJit ? false
 , staticCompiler ? false
@ -54,6 +55,10 @@ assert langAda -> gnatboot != null;
 # threadsCross is just for MinGW
 assert threadsCross != null -> stdenv.targetPlatform.isWindows;

+# profiledCompiler builds inject non-determinism in one of the compilation stages.
+# If turned on, we can't provide reproducible builds anymore
+assert reproducibleBuild -> profiledCompiler == false;
+
 with lib;
 with builtins;

@ -200,8 +205,7 @@ stdenv.mkDerivation ({

  dontDisableStatic = true;

-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];

  configureFlags = import ../common/configure-flags.nix {
    inherit
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@ -44,6 +44,9 @@ let
  crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
  crossDarwin = targetPlatform != hostPlatform && targetPlatform.libc == "libSystem";

+  targetPrefix = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
+                  "${stdenv.targetPlatform.config}-";
+
  crossConfigureFlags =
    # Ensure that -print-prog-name is able to find the correct programs.
    [
@ -112,6 +115,18 @@ let

    # Basic configuration
    ++ [
+      # Force target prefix. The behavior if `--target` and `--host`
+      # are specified is inconsistent: Sometimes specifying `--target`
+      # always causes a prefix to be generated, sometimes it's only
+      # added if the `--host` and `--target` differ. This means that
+      # sometimes there may be a prefix even though nixpkgs doesn't
+      # expect one and sometimes there may be none even though nixpkgs
+      # expects one (since not all information is serialized into the
+      # config attribute). The easiest way out of these problems is to
+      # always set the program prefix, so gcc will conform to our
+      # expectations.
+      "--program-prefix=${targetPrefix}"
+
      (lib.enableFeature enableLTO "lto")
      "--disable-libstdcxx-pch"
      "--without-included-gettext"
--- a/pkgs/development/compilers/ghdl/default.nix
+++ b/pkgs/development/compilers/ghdl/default.nix
@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
  '';

  configureFlags = [ "--enable-synth" ] ++ lib.optional (backend == "llvm")
-    "--with-llvm-config=${llvm}/bin/llvm-config";
+    "--with-llvm-config=${llvm.dev}/bin/llvm-config";

  hardeningDisable = [ "format" ];

--- a/pkgs/development/compilers/intel-graphics-compiler/default.nix
+++ b/pkgs/development/compilers/intel-graphics-compiler/default.nix
@ -18,7 +18,7 @@ let
    inherit spirv-llvm-translator;
  };
  inherit (llvmPkgs) llvm;
-  inherit (if buildWithPatches then opencl-clang else llvmPkgs) clang clang-unwrapped spirv-llvm-translator;
+  inherit (if buildWithPatches then opencl-clang else llvmPkgs) clang libclang spirv-llvm-translator;
  inherit (lib) getVersion optional optionals versionOlder versions;
 in

@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
      ln -s ${clang}/bin/clang $out/
      ln -s clang $out/clang-${versions.major (getVersion clang)}
      ln -s ${opencl-clang}/lib/* $out/
-      ln -s ${clang-unwrapped}/lib/clang/${getVersion clang}/include/opencl-c.h $out/
+      ln -s ${lib.getLib libclang}/lib/clang/${getVersion clang}/include/opencl-c.h $out/
    '';
  };

--- a/pkgs/development/compilers/ispc/default.nix
+++ b/pkgs/development/compilers/ispc/default.nix
@ -28,10 +28,9 @@ stdenv.mkDerivation rec {
    })
  ];

-  nativeBuildInputs = [ cmake which m4 bison flex python3 ];
+  nativeBuildInputs = [ cmake which m4 bison flex python3 llvmPackages.llvm.dev ];
  buildInputs = with llvmPackages; [
-    # we need to link against libclang, so we need the unwrapped
-    llvm llvmPackages.clang-unwrapped
+    llvm llvmPackages.libclang
  ];

  postPatch = ''
@ -66,6 +65,7 @@ stdenv.mkDerivation rec {
  '';

  cmakeFlags = [
+    "-DLLVM_CONFIG_EXECUTABLE=${llvmPackages.llvm.dev}/bin/llvm-config"
    "-DCLANG_EXECUTABLE=${llvmPackages.clang}/bin/clang"
    "-DCLANGPP_EXECUTABLE=${llvmPackages.clang}/bin/clang++"
    "-DISPC_INCLUDE_EXAMPLES=OFF"
--- a/pkgs/development/compilers/ldc/generic.nix
+++ b/pkgs/development/compilers/ldc/generic.nix
@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
  '';

  nativeBuildInputs = [
-    cmake ldcBootstrap lit lit.python llvm_11 makeWrapper ninja unzip
+    cmake ldcBootstrap lit lit.python llvm_11.dev makeWrapper ninja unzip
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    darwin.apple_sdk.frameworks.Foundation
--- a/pkgs/development/compilers/llvm/10/clang/default.nix
+++ b/pkgs/development/compilers/llvm/10/clang/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3, lld
+{ lib, stdenv, fetch, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
+, buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
 }:
@ -18,28 +19,33 @@ let
      mv clang-tools-extra-* $sourceRoot/tools/extra
    '';

-    nativeBuildInputs = [ cmake python3 lld ]
+    nativeBuildInputs = [ cmake python3 ]
      ++ lib.optional enableManpages python3.pkgs.sphinx
      ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;

-    buildInputs = [ libxml2 llvm ];
+    buildInputs = [ libxml2 libllvm ];

    cmakeFlags = [
      "-DCMAKE_CXX_FLAGS=-std=c++14"
      "-DCLANGD_BUILD_XPC=OFF"
      "-DLLVM_ENABLE_RTTI=ON"
+      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
    ] ++ lib.optionals enableManpages [
      "-DCLANG_INCLUDE_DOCS=ON"
      "-DLLVM_ENABLE_SPHINX=ON"
      "-DSPHINX_OUTPUT_MAN=ON"
      "-DSPHINX_OUTPUT_HTML=OFF"
      "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+    ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+      "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
+      "-DCLANG_TABLEGEN=${buildLlvmTools.libclang.dev}/bin/clang-tblgen"
    ];

    patches = [
      ./purity.patch
      # https://reviews.llvm.org/D51899
      ./compiler-rt-baremetal.patch
+      ./gnu-install-dirs.patch
    ];

    postPatch = ''
@ -56,12 +62,12 @@ let
        --replace "NOT HAVE_CXX_ATOMICS64_WITHOUT_LIB" FALSE
    '';

-    outputs = [ "out" "lib" "python" ];
+    outputs = [ "out" "lib" "dev" "python" ];

    # Clang expects to find LLVMgold in its own prefix
    postInstall = ''
-      if [ -e ${llvm}/lib/LLVMgold.so ]; then
-        ln -sv ${llvm}/lib/LLVMgold.so $out/lib
+      if [ -e ${libllvm.lib}/lib/LLVMgold.so ]; then
+        ln -sv ${libllvm.lib}/lib/LLVMgold.so $lib/lib
      fi

      ln -sv $out/bin/clang $out/bin/cpp
@ -80,11 +86,14 @@ let
      fi
      mv $out/share/clang/*.py $python/share/clang
      rm $out/bin/c-index-test
+
+      mkdir -p $dev/bin
+      cp bin/clang-tblgen $dev/bin
    '';

    passthru = {
      isClang = true;
-      inherit llvm;
+      inherit libllvm;
    };

    meta = {
--- a/pkgs/development/compilers/llvm/10/clang/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/10/clang/gnu-install-dirs.patch
@ -0,0 +1,248 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index dc1413f4b597..c173531e624f 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -9,6 +9,8 @@ endif()
+ if( CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR )
+   project(Clang)
+ 
+  include(GNUInstallDirs)
+
+   # Rely on llvm-config.
+   set(CONFIG_OUTPUT)
+   if(LLVM_CONFIG)
+@@ -417,7 +419,7 @@ include_directories(BEFORE
+ 
+ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+   install(DIRECTORY include/clang include/clang-c
+-    DESTINATION include
+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
+     COMPONENT clang-headers
+     FILES_MATCHING
+     PATTERN "*.def"
+@@ -427,7 +429,7 @@ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+     )
+ 
+   install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/include/clang
+-    DESTINATION include
+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
+     COMPONENT clang-headers
+     FILES_MATCHING
+     PATTERN "CMakeFiles" EXCLUDE
+@@ -447,7 +449,7 @@ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+ 
+   add_custom_target(bash-autocomplete DEPENDS utils/bash-autocomplete.sh)
+   install(PROGRAMS utils/bash-autocomplete.sh
+-          DESTINATION share/clang
+          DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+           COMPONENT bash-autocomplete)
+   if(NOT LLVM_ENABLE_IDE)
+     add_llvm_install_targets(install-bash-autocomplete
+diff --git a/cmake/modules/AddClang.cmake b/cmake/modules/AddClang.cmake
+index 577cc11ab015..a4f4481d8442 100644
+--- a/cmake/modules/AddClang.cmake
+++ b/cmake/modules/AddClang.cmake
+@@ -114,9 +114,9 @@ macro(add_clang_library name)
+       install(TARGETS ${name}
+         COMPONENT ${name}
+         ${export_to_clangtargets}
+-        LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-        ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-        RUNTIME DESTINATION bin)
+        LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
+        ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
+        RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
+ 
+       if (NOT LLVM_ENABLE_IDE)
+         add_llvm_install_targets(install-${name}
+@@ -160,7 +160,7 @@ macro(add_clang_tool name)
+ 
+     install(TARGETS ${name}
+       ${export_to_clangtargets}
+-      RUNTIME DESTINATION bin
+      RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
+       COMPONENT ${name})
+ 
+     if(NOT LLVM_ENABLE_IDE)
+@@ -175,7 +175,7 @@ endmacro()
+ macro(add_clang_symlink name dest)
+   add_llvm_tool_symlink(${name} ${dest} ALWAYS_GENERATE)
+   # Always generate install targets
+-  llvm_install_symlink(${name} ${dest} ALWAYS_GENERATE)
+  llvm_install_symlink(${name} ${dest} ${CMAKE_INSTALL_FULL_BINDIR} ALWAYS_GENERATE)
+ endmacro()
+ 
+ function(clang_target_link_libraries target type)
+diff --git a/lib/Headers/CMakeLists.txt b/lib/Headers/CMakeLists.txt
+index 85c3124234ad..64c48235d914 100644
+--- a/lib/Headers/CMakeLists.txt
+++ b/lib/Headers/CMakeLists.txt
+@@ -191,7 +191,7 @@ set_target_properties(clang-resource-headers PROPERTIES
+   FOLDER "Misc"
+   RUNTIME_OUTPUT_DIRECTORY "${output_dir}")
+ 
+-set(header_install_dir lib${LLVM_LIBDIR_SUFFIX}/clang/${CLANG_VERSION}/include)
+set(header_install_dir ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/clang/${CLANG_VERSION}/include)
+ 
+ install(
+   FILES ${files} ${generated_files}
+diff --git a/tools/c-index-test/CMakeLists.txt b/tools/c-index-test/CMakeLists.txt
+index ceef4b08637c..8efad5520ca4 100644
+--- a/tools/c-index-test/CMakeLists.txt
+++ b/tools/c-index-test/CMakeLists.txt
+@@ -54,7 +54,7 @@ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+     set_property(TARGET c-index-test APPEND PROPERTY INSTALL_RPATH
+        "@executable_path/../../lib")
+   else()
+-    set(INSTALL_DESTINATION bin)
+    set(INSTALL_DESTINATION ${CMAKE_INSTALL_BINDIR})
+   endif()
+ 
+   install(TARGETS c-index-test
+diff --git a/tools/clang-format/CMakeLists.txt b/tools/clang-format/CMakeLists.txt
+index 35ecdb11253c..d77d75de0094 100644
+--- a/tools/clang-format/CMakeLists.txt
+++ b/tools/clang-format/CMakeLists.txt
+@@ -21,20 +21,20 @@ if( LLVM_LIB_FUZZING_ENGINE OR LLVM_USE_SANITIZE_COVERAGE )
+ endif()
+ 
+ install(PROGRAMS clang-format-bbedit.applescript
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-format)
+ install(PROGRAMS clang-format-diff.py
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-format)
+ install(PROGRAMS clang-format-sublime.py
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-format)
+ install(PROGRAMS clang-format.el
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-format)
+ install(PROGRAMS clang-format.py
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-format)
+ install(PROGRAMS git-clang-format
+-  DESTINATION bin
+  DESTINATION ${CMAKE_INSTALL_BINDIR}
+   COMPONENT clang-format)
+diff --git a/tools/clang-rename/CMakeLists.txt b/tools/clang-rename/CMakeLists.txt
+index cda8e29ec5b1..0134d8ccd70b 100644
+--- a/tools/clang-rename/CMakeLists.txt
+++ b/tools/clang-rename/CMakeLists.txt
+@@ -19,8 +19,8 @@ clang_target_link_libraries(clang-rename
+   )
+ 
+ install(PROGRAMS clang-rename.py
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-rename)
+ install(PROGRAMS clang-rename.el
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-rename)
+diff --git a/tools/diagtool/CMakeLists.txt b/tools/diagtool/CMakeLists.txt
+index a95444be40ee..136d96d9bf5b 100644
+--- a/tools/diagtool/CMakeLists.txt
+++ b/tools/diagtool/CMakeLists.txt
+@@ -21,7 +21,7 @@ clang_target_link_libraries(diagtool
+ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+   install(TARGETS diagtool
+     COMPONENT diagtool
+-    RUNTIME DESTINATION bin)
+    RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
+ 
+   if (NOT LLVM_ENABLE_IDE)
+     add_llvm_install_targets(install-diagtool
+diff --git a/tools/libclang/CMakeLists.txt b/tools/libclang/CMakeLists.txt
+index 973655361f71..0181002e4e3b 100644
+--- a/tools/libclang/CMakeLists.txt
+++ b/tools/libclang/CMakeLists.txt
+@@ -141,7 +141,7 @@ endif()
+ if(INTERNAL_INSTALL_PREFIX)
+   set(LIBCLANG_HEADERS_INSTALL_DESTINATION "${INTERNAL_INSTALL_PREFIX}/include")
+ else()
+-  set(LIBCLANG_HEADERS_INSTALL_DESTINATION include)
+  set(LIBCLANG_HEADERS_INSTALL_DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
+ endif()
+ 
+ install(DIRECTORY ../../include/clang-c
+@@ -172,7 +172,7 @@ foreach(PythonVersion ${CLANG_PYTHON_BINDINGS_VERSIONS})
+           COMPONENT
+             libclang-python-bindings
+           DESTINATION
+-            "lib${LLVM_LIBDIR_SUFFIX}/python${PythonVersion}/site-packages")
+            "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/python${PythonVersion}/site-packages")
+ endforeach()
+ if(NOT LLVM_ENABLE_IDE)
+   add_custom_target(libclang-python-bindings)
+diff --git a/tools/scan-build/CMakeLists.txt b/tools/scan-build/CMakeLists.txt
+index 28241245fcb7..d6b59f02fc2a 100644
+--- a/tools/scan-build/CMakeLists.txt
+++ b/tools/scan-build/CMakeLists.txt
+@@ -42,7 +42,7 @@ if(CLANG_INSTALL_SCANBUILD)
+                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/bin/${BinFile})
+     list(APPEND Depends ${CMAKE_BINARY_DIR}/bin/${BinFile})
+     install(PROGRAMS bin/${BinFile}
+-            DESTINATION bin
+            DESTINATION ${CMAKE_INSTALL_BINDIR}
+             COMPONENT scan-build)
+   endforeach()
+ 
+@@ -56,7 +56,7 @@ if(CLANG_INSTALL_SCANBUILD)
+                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/libexec/${LibexecFile})
+     list(APPEND Depends ${CMAKE_BINARY_DIR}/libexec/${LibexecFile})
+     install(PROGRAMS libexec/${LibexecFile}
+-            DESTINATION libexec
+            DESTINATION ${CMAKE_INSTALL_LIBEXECDIR}
+             COMPONENT scan-build)
+   endforeach()
+ 
+@@ -84,7 +84,7 @@ if(CLANG_INSTALL_SCANBUILD)
+                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/share/scan-build/${ShareFile})
+     list(APPEND Depends ${CMAKE_BINARY_DIR}/share/scan-build/${ShareFile})
+     install(FILES share/scan-build/${ShareFile}
+-            DESTINATION share/scan-build
+            DESTINATION ${CMAKE_INSTALL_DATADIR}/scan-build
+             COMPONENT scan-build)
+   endforeach()
+ 
+diff --git a/tools/scan-view/CMakeLists.txt b/tools/scan-view/CMakeLists.txt
+index 22edb974bac7..9f140a9a4538 100644
+--- a/tools/scan-view/CMakeLists.txt
+++ b/tools/scan-view/CMakeLists.txt
+@@ -22,7 +22,7 @@ if(CLANG_INSTALL_SCANVIEW)
+                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/bin/${BinFile})
+     list(APPEND Depends ${CMAKE_BINARY_DIR}/bin/${BinFile})
+     install(PROGRAMS bin/${BinFile}
+-            DESTINATION bin
+            DESTINATION ${CMAKE_INSTALL_BINDIR}
+             COMPONENT scan-view)
+   endforeach()
+ 
+@@ -36,7 +36,7 @@ if(CLANG_INSTALL_SCANVIEW)
+                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/share/${ShareFile})
+     list(APPEND Depends ${CMAKE_BINARY_DIR}/share/scan-view/${ShareFile})
+     install(FILES share/${ShareFile}
+-            DESTINATION share/scan-view
+            DESTINATION ${CMAKE_INSTALL_DATADIR}/scan-view
+             COMPONENT scan-view)
+   endforeach()
+ 
+diff --git a/utils/hmaptool/CMakeLists.txt b/utils/hmaptool/CMakeLists.txt
+index 62f2de0cb15c..6aa66825b6ec 100644
+--- a/utils/hmaptool/CMakeLists.txt
+++ b/utils/hmaptool/CMakeLists.txt
+@@ -10,7 +10,7 @@ add_custom_command(OUTPUT ${CMAKE_BINARY_DIR}/${CMAKE_CFG_INTDIR}/bin/${CLANG_HM
+ 
+ list(APPEND Depends ${CMAKE_BINARY_DIR}/${CMAKE_CFG_INTDIR}/bin/${CLANG_HMAPTOOL})
+ install(PROGRAMS ${CLANG_HMAPTOOL}
+-        DESTINATION bin
+        DESTINATION ${CMAKE_INSTALL_BINDIR}
+         COMPONENT hmaptool)
+ 
+ add_custom_target(hmaptool ALL DEPENDS ${Depends})
--- a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
  inherit version;
  src = fetch pname "1yjqjri753w0fzmxcyz687nvd97sbc9rsqrxzpq720na47hwh3fr";

-  nativeBuildInputs = [ cmake python3 llvm ];
+  nativeBuildInputs = [ cmake python3 llvm.dev ];
  buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;

  NIX_CFLAGS_COMPILE = [
@ -54,6 +54,7 @@ stdenv.mkDerivation rec {
  patches = [
    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
    ./find-darwin-sdk-version.patch # don't test for macOS being >= 10.15
+    ./gnu-install-dirs.patch
  ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;

--- a/pkgs/development/compilers/llvm/10/compiler-rt/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/gnu-install-dirs.patch
@ -0,0 +1,129 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 8d768a404f21..74551dc5a004 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -12,6 +12,7 @@ endif()
+ # Check if compiler-rt is built as a standalone project.
+ if (CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR OR COMPILER_RT_STANDALONE_BUILD)
+   project(CompilerRT C CXX ASM)
+  include(GNUInstallDirs)
+   set(COMPILER_RT_STANDALONE_BUILD TRUE)
+   set_property(GLOBAL PROPERTY USE_FOLDERS ON)
+ endif()
+diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
+index 35a48c6af29c..e4300f256091 100644
+--- a/cmake/Modules/AddCompilerRT.cmake
+++ b/cmake/Modules/AddCompilerRT.cmake
+@@ -493,7 +493,7 @@ macro(add_compiler_rt_resource_file target_name file_name component)
+   add_custom_target(${target_name} DEPENDS ${dst_file})
+   # Install in Clang resource directory.
+   install(FILES ${file_name}
+-    DESTINATION ${COMPILER_RT_INSTALL_PATH}/share
+    DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_DATADIR}
+     COMPONENT ${component})
+   add_dependencies(${component} ${target_name})
+ 
+@@ -510,7 +510,7 @@ macro(add_compiler_rt_script name)
+   add_custom_target(${name} DEPENDS ${dst})
+   install(FILES ${dst}
+     PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE
+-    DESTINATION ${COMPILER_RT_INSTALL_PATH}/bin)
+    DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_BINDIR})
+ endmacro(add_compiler_rt_script src name)
+ 
+ # Builds custom version of libc++ and installs it in <prefix>.
+diff --git a/cmake/Modules/CompilerRTDarwinUtils.cmake b/cmake/Modules/CompilerRTDarwinUtils.cmake
+index 9f501a61c4b6..f9a0d92dbca0 100644
+--- a/cmake/Modules/CompilerRTDarwinUtils.cmake
+++ b/cmake/Modules/CompilerRTDarwinUtils.cmake
+@@ -440,7 +440,7 @@ macro(darwin_add_embedded_builtin_libraries)
+     set(DARWIN_macho_embedded_LIBRARY_OUTPUT_DIR
+       ${COMPILER_RT_OUTPUT_DIR}/lib/macho_embedded)
+     set(DARWIN_macho_embedded_LIBRARY_INSTALL_DIR
+-      ${COMPILER_RT_INSTALL_PATH}/lib/macho_embedded)
+      ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_LIBDIR}/macho_embedded)
+       
+     set(CFLAGS_armv7 "-target thumbv7-apple-darwin-eabi")
+     set(CFLAGS_i386 "-march=pentium")
+diff --git a/cmake/Modules/CompilerRTUtils.cmake b/cmake/Modules/CompilerRTUtils.cmake
+index 6e672b1e1818..64999709958e 100644
+--- a/cmake/Modules/CompilerRTUtils.cmake
+++ b/cmake/Modules/CompilerRTUtils.cmake
+@@ -371,7 +371,7 @@ endfunction()
+ function(get_compiler_rt_install_dir arch install_dir)
+   if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+     get_compiler_rt_target(${arch} target)
+-    set(${install_dir} ${COMPILER_RT_INSTALL_PATH}/lib/${target} PARENT_SCOPE)
+    set(${install_dir} ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_LIBDIR}/${target} PARENT_SCOPE)
+   else()
+     set(${install_dir} ${COMPILER_RT_LIBRARY_INSTALL_DIR} PARENT_SCOPE)
+   endif()
+diff --git a/cmake/base-config-ix.cmake b/cmake/base-config-ix.cmake
+index b4b87aa53073..f1ae8668837c 100644
+--- a/cmake/base-config-ix.cmake
+++ b/cmake/base-config-ix.cmake
+@@ -65,11 +65,11 @@ if (LLVM_TREE_AVAILABLE)
+ else()
+     # Take output dir and install path from the user.
+   set(COMPILER_RT_OUTPUT_DIR ${CMAKE_CURRENT_BINARY_DIR} CACHE PATH
+-    "Path where built compiler-rt libraries should be stored.")
+    "Path where built compiler-rt build artifacts should be stored.")
+   set(COMPILER_RT_EXEC_OUTPUT_DIR ${CMAKE_CURRENT_BINARY_DIR}/bin CACHE PATH
+     "Path where built compiler-rt executables should be stored.")
+-  set(COMPILER_RT_INSTALL_PATH ${CMAKE_INSTALL_PREFIX} CACHE PATH
+-    "Path where built compiler-rt libraries should be installed.")
+  set(COMPILER_RT_INSTALL_PATH "" CACHE PATH
+    "Prefix where built compiler-rt artifacts should be installed, comes before CMAKE_INSTALL_PREFIX.")
+   option(COMPILER_RT_INCLUDE_TESTS "Generate and build compiler-rt unit tests." OFF)
+   option(COMPILER_RT_ENABLE_WERROR "Fail and stop if warning is triggered" OFF)
+   # Use a host compiler to compile/link tests.
+@@ -97,7 +97,7 @@ else(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR)
+   set(COMPILER_RT_LIBRARY_OUTPUT_DIR
+     ${COMPILER_RT_OUTPUT_DIR}/lib/${COMPILER_RT_OS_DIR})
+   set(COMPILER_RT_LIBRARY_INSTALL_DIR
+-    ${COMPILER_RT_INSTALL_PATH}/lib/${COMPILER_RT_OS_DIR})
+    ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_LIBDIR}/${COMPILER_RT_OS_DIR})
+ endif()
+ 
+ if(APPLE)
+diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt
+index d47d7baeb118..507c8e5c713e 100644
+--- a/include/CMakeLists.txt
+++ b/include/CMakeLists.txt
+@@ -62,22 +62,22 @@ set_target_properties(compiler-rt-headers PROPERTIES FOLDER "Compiler-RT Misc")
+ install(FILES ${SANITIZER_HEADERS}
+   COMPONENT compiler-rt-headers
+   PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
+-  DESTINATION ${COMPILER_RT_INSTALL_PATH}/include/sanitizer)
+  DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_INCLUDEDIR}/sanitizer)
+ # Install fuzzer headers.
+ install(FILES ${FUZZER_HEADERS}
+   COMPONENT compiler-rt-headers
+   PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
+-  DESTINATION ${COMPILER_RT_INSTALL_PATH}/include/fuzzer)
+  DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_INCLUDEDIR}/fuzzer)
+ # Install xray headers.
+ install(FILES ${XRAY_HEADERS}
+   COMPONENT compiler-rt-headers
+   PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
+-  DESTINATION ${COMPILER_RT_INSTALL_PATH}/include/xray)
+  DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_INCLUDEDIR}/xray)
+ # Install profile headers.
+ install(FILES ${PROFILE_HEADERS}
+   COMPONENT compiler-rt-headers
+   PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
+-  DESTINATION ${COMPILER_RT_INSTALL_PATH}/include/profile)
+  DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_INCLUDEDIR}/profile)
+ 
+ if (NOT CMAKE_CONFIGURATION_TYPES) # don't add this for IDEs.
+   add_custom_target(install-compiler-rt-headers
+diff --git a/lib/dfsan/CMakeLists.txt b/lib/dfsan/CMakeLists.txt
+index 051215edbeb7..ecce1f52efb0 100644
+--- a/lib/dfsan/CMakeLists.txt
+++ b/lib/dfsan/CMakeLists.txt
+@@ -56,4 +56,4 @@ add_custom_command(OUTPUT ${dfsan_abilist_filename}
+                    DEPENDS done_abilist.txt libc_ubuntu1404_abilist.txt)
+ add_dependencies(dfsan dfsan_abilist)
+ install(FILES ${dfsan_abilist_filename}
+-        DESTINATION ${COMPILER_RT_INSTALL_PATH}/share)
+        DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_DATADIR})
--- a/pkgs/development/compilers/llvm/10/default.nix
+++ b/pkgs/development/compilers/llvm/10/default.nix
@ -1,6 +1,5 @@
 { lowPrio, newScope, pkgs, lib, stdenv, cmake, gccForLibs
 , libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith, wrapBintoolsWith
-, buildPackages
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 }:
@ -18,31 +17,39 @@ let
  clang-tools-extra_src = fetch "clang-tools-extra" "06n1yp638rh24xdxv9v2df0qajxbjz4w59b7dd4ky36drwmpi4yh";

  tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
-    mkExtraBuildCommands = cc: ''
+    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch buildLlvmTools; });
+    mkExtraBuildCommands0 = cc: ''
      rsrc="$out/resource-root"
      mkdir "$rsrc"
-      ln -s "${cc}/lib/clang/${release_version}/include" "$rsrc"
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/share" "$rsrc/share"
+      ln -s "${cc.lib}/lib/clang/${release_version}/include" "$rsrc"
      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
    '';
+    mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
+      ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
+      ln -s "${targetLlvmLibraries.compiler-rt.out}/share" "$rsrc/share"
+    '';
+
  in {

-    llvm = callPackage ./llvm { };
+    libllvm = callPackage ./llvm { };

-    clang-unwrapped = callPackage ./clang {
-      inherit (tools) lld;
+    # `llvm` historically had the binaries.  When choosing an output explicitly,
+    # we need to reintroduce `outputUnspecified` to get the expected behavior e.g. of lib.get*
+    llvm = tools.libllvm.out // { outputUnspecified = true; };
+
+    libclang = callPackage ./clang {
      inherit clang-tools-extra_src;
    };

+    clang-unwrapped = tools.libclang.out // { outputUnspecified = true; };
+
    # disabled until recommonmark supports sphinx 3
-    #Llvm-manpages = lowPrio (tools.llvm.override {
+    #Llvm-manpages = lowPrio (tools.libllvm.override {
    #  enableManpages = true;
    #  python3 = pkgs.python3;  # don't use python-boot
    #});

-    clang-manpages = lowPrio (tools.clang-unwrapped.override {
+    clang-manpages = lowPrio (tools.libclang.override {
      enableManpages = true;
      python3 = pkgs.python3;  # don't use python-boot
    });
@ -53,8 +60,6 @@ let
    #   python3 = pkgs.python3;  # don't use python-boot
    # });

-    libclang = tools.clang-unwrapped.lib;
-
    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;

    libstdcxxClang = wrapCCWith rec {
@ -144,7 +149,7 @@ let
      '' + mkExtraBuildCommands cc;
    };

-    lldClangNoCompilerRt = wrapCCWith {
+    lldClangNoCompilerRt = wrapCCWith rec {
      cc = tools.clang-unwrapped;
      libcxx = null;
      bintools = wrapBintoolsWith {
@ -154,7 +159,7 @@ let
      extraPackages = [ ];
      extraBuildCommands = ''
        echo "-nostartfiles" >> $out/nix-support/cc-cflags
-      '';
+      '' + mkExtraBuildCommands0 cc;
    };

  });
--- a/pkgs/development/compilers/llvm/10/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/10/libc++/default.nix
@ -13,7 +13,11 @@ stdenv.mkDerivation {
    export LIBCXXABI_INCLUDE_DIR="$PWD/$(ls -d libcxxabi-${version}*)/include"
  '';

-  patches = lib.optional stdenv.hostPlatform.isMusl ../../libcxx-0001-musl-hacks.patch;
+  outputs = [ "out" "dev" ];
+
+  patches = [
+    ./gnu-install-dirs.patch
+  ] ++ lib.optional stdenv.hostPlatform.isMusl ../../libcxx-0001-musl-hacks.patch;

  preConfigure = ''
    # Get headers from the cxxabi source so we can see private headers not installed by the cxxabi package
--- a/pkgs/development/compilers/llvm/10/libc++/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/10/libc++/gnu-install-dirs.patch
@ -0,0 +1,99 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 60564dc96c7b..77d832ad5a44 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -26,6 +26,8 @@ set(CMAKE_MODULE_PATH
+ if (CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR OR LIBCXX_STANDALONE_BUILD)
+   project(libcxx CXX C)
+ 
+  include(GNUInstallDirs)
+
+   set(PACKAGE_NAME libcxx)
+   set(PACKAGE_VERSION 10.0.1)
+   set(PACKAGE_STRING "${PACKAGE_NAME} ${PACKAGE_VERSION}")
+@@ -415,7 +417,7 @@ string(REGEX MATCH "[0-9]+\\.[0-9]+(\\.[0-9]+)?" CLANG_VERSION
+ if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+   set(LIBCXX_LIBRARY_DIR ${LLVM_LIBRARY_OUTPUT_INTDIR}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++)
+   set(LIBCXX_HEADER_DIR ${LLVM_BINARY_DIR})
+-  set(LIBCXX_INSTALL_LIBRARY_DIR lib${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++)
+  set(LIBCXX_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++)
+   if(LIBCXX_LIBDIR_SUBDIR)
+     string(APPEND LIBCXX_LIBRARY_DIR /${LIBCXX_LIBDIR_SUBDIR})
+     string(APPEND LIBCXX_INSTALL_LIBRARY_DIR /${LIBCXX_LIBDIR_SUBDIR})
+@@ -423,10 +425,10 @@ if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+ elseif(LLVM_LIBRARY_OUTPUT_INTDIR)
+   set(LIBCXX_LIBRARY_DIR ${LLVM_LIBRARY_OUTPUT_INTDIR})
+   set(LIBCXX_HEADER_DIR  ${LLVM_BINARY_DIR})
+-  set(LIBCXX_INSTALL_LIBRARY_DIR lib${LIBCXX_LIBDIR_SUFFIX})
+  set(LIBCXX_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LIBCXX_LIBDIR_SUFFIX})
+ else()
+   set(LIBCXX_LIBRARY_DIR ${CMAKE_BINARY_DIR}/lib${LIBCXX_LIBDIR_SUFFIX})
+-  set(LIBCXX_INSTALL_LIBRARY_DIR lib${LIBCXX_LIBDIR_SUFFIX})
+  set(LIBCXX_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LIBCXX_LIBDIR_SUFFIX})
+ endif()
+ 
+ file(MAKE_DIRECTORY "${LIBCXX_BINARY_INCLUDE_DIR}")
+diff --git a/cmake/Modules/HandleLibCXXABI.cmake b/cmake/Modules/HandleLibCXXABI.cmake
+index 10f100f7f0fb..95ed3978ab73 100644
+--- a/cmake/Modules/HandleLibCXXABI.cmake
+++ b/cmake/Modules/HandleLibCXXABI.cmake
+@@ -61,7 +61,7 @@ macro(setup_abi_lib abidefines abishared abistatic abifiles abidirs)
+ 
+         if (LIBCXX_INSTALL_HEADERS)
+           install(FILES "${LIBCXX_BINARY_INCLUDE_DIR}/${fpath}"
+-            DESTINATION ${LIBCXX_INSTALL_HEADER_PREFIX}include/c++/v1/${dstdir}
+            DESTINATION ${LIBCXX_INSTALL_HEADER_PREFIX}${CMAKE_INSTALL_INCLUDEDIR}/c++/v1/${dstdir}
+             COMPONENT cxx-headers
+             PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
+             )
+diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt
+index 302da8a131b4..4c6ab463f564 100644
+--- a/include/CMakeLists.txt
+++ b/include/CMakeLists.txt
+@@ -244,7 +244,7 @@ if (LIBCXX_INSTALL_HEADERS)
+   foreach(file ${files})
+     get_filename_component(dir ${file} DIRECTORY)
+     install(FILES ${file}
+-      DESTINATION ${LIBCXX_INSTALL_HEADER_PREFIX}include/c++/v1/${dir}
+      DESTINATION ${LIBCXX_INSTALL_HEADER_PREFIX}${CMAKE_INSTALL_INCLUDEDIR}/c++/v1/${dir}
+       COMPONENT ${CXX_HEADER_TARGET}
+       PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
+     )
+@@ -253,7 +253,7 @@ if (LIBCXX_INSTALL_HEADERS)
+   if (LIBCXX_NEEDS_SITE_CONFIG)
+     # Install the generated header as __config.
+     install(FILES ${LIBCXX_BINARY_DIR}/__generated_config
+-      DESTINATION ${LIBCXX_INSTALL_HEADER_PREFIX}include/c++/v1
+      DESTINATION ${LIBCXX_INSTALL_HEADER_PREFIX}${CMAKE_INSTALL_INCLUDEDIR}/c++/v1
+       PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
+       RENAME __config
+       COMPONENT ${CXX_HEADER_TARGET})
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index 120505fe18da..9b8456d8405a 100644
+--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
+@@ -341,21 +341,21 @@ if (LIBCXX_INSTALL_LIBRARY)
+     install(TARGETS cxx_shared
+       ARCHIVE DESTINATION ${LIBCXX_INSTALL_PREFIX}${LIBCXX_INSTALL_LIBRARY_DIR} COMPONENT cxx
+       LIBRARY DESTINATION ${LIBCXX_INSTALL_PREFIX}${LIBCXX_INSTALL_LIBRARY_DIR} COMPONENT cxx
+-      RUNTIME DESTINATION ${LIBCXX_INSTALL_PREFIX}bin COMPONENT cxx)
+      RUNTIME DESTINATION ${LIBCXX_INSTALL_PREFIX}${CMAKE_INSTALL_BINDIR} COMPONENT cxx)
+   endif()
+ 
+   if (LIBCXX_INSTALL_STATIC_LIBRARY)
+     install(TARGETS cxx_static
+       ARCHIVE DESTINATION ${LIBCXX_INSTALL_PREFIX}${LIBCXX_INSTALL_LIBRARY_DIR} COMPONENT cxx
+       LIBRARY DESTINATION ${LIBCXX_INSTALL_PREFIX}${LIBCXX_INSTALL_LIBRARY_DIR} COMPONENT cxx
+-      RUNTIME DESTINATION ${LIBCXX_INSTALL_PREFIX}bin COMPONENT cxx)
+      RUNTIME DESTINATION ${LIBCXX_INSTALL_PREFIX}${CMAKE_INSTALL_BINDIR} COMPONENT cxx)
+   endif()
+ 
+   if(LIBCXX_INSTALL_EXPERIMENTAL_LIBRARY)
+     install(TARGETS ${LIBCXX_INSTALL_TARGETS} ${experimental_lib}
+       LIBRARY DESTINATION ${LIBCXX_INSTALL_PREFIX}${LIBCXX_INSTALL_LIBRARY_DIR} COMPONENT cxx
+       ARCHIVE DESTINATION ${LIBCXX_INSTALL_PREFIX}${LIBCXX_INSTALL_LIBRARY_DIR} COMPONENT cxx
+-      RUNTIME DESTINATION ${LIBCXX_INSTALL_PREFIX}bin COMPONENT cxx)
+      RUNTIME DESTINATION ${LIBCXX_INSTALL_PREFIX}${CMAKE_INSTALL_BINDIR} COMPONENT cxx)
+   endif()
+ 
+   # NOTE: This install command must go after the cxx install command otherwise
--- a/pkgs/development/compilers/llvm/10/libc++abi/default.nix
+++ b/pkgs/development/compilers/llvm/10/libc++abi/default.nix
@ -8,6 +8,25 @@ stdenv.mkDerivation {

  src = fetch "libcxxabi" "0yqs722y76cwvmfsq0lb917r9m3fci7bf5z3yzl71yz9n88ghzm9";

+  outputs = [ "out" "dev" ];
+
+  postUnpack = ''
+    unpackFile ${libcxx.src}
+    unpackFile ${llvm.src}
+    cmakeFlags+=" -DLLVM_PATH=$PWD/$(ls -d llvm-*) -DLIBCXXABI_LIBCXX_PATH=$PWD/$(ls -d libcxx-*)"
+  '' + lib.optionalString stdenv.isDarwin ''
+    export TRIPLE=x86_64-apple-darwin
+  '' + lib.optionalString stdenv.hostPlatform.isMusl ''
+    patch -p1 -d $(ls -d libcxx-*) -i ${../../libcxx-0001-musl-hacks.patch}
+  '' + lib.optionalString stdenv.hostPlatform.isWasm ''
+    patch -p1 -d $(ls -d llvm-*) -i ${./wasm.patch}
+  '';
+
+  patches = [
+    ./no-threads.patch
+    ./gnu-install-dirs.patch
+  ];
+
  nativeBuildInputs = [ cmake ];
  buildInputs = lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm) libunwind;

@ -21,20 +40,6 @@ stdenv.mkDerivation {
    "-DLIBCXXABI_ENABLE_SHARED=OFF"
  ];

-  patches = [ ./no-threads.patch ];
-
-  postUnpack = ''
-    unpackFile ${libcxx.src}
-    unpackFile ${llvm.src}
-    cmakeFlags+=" -DLLVM_PATH=$PWD/$(ls -d llvm-*) -DLIBCXXABI_LIBCXX_PATH=$PWD/$(ls -d libcxx-*)"
-  '' + lib.optionalString stdenv.isDarwin ''
-    export TRIPLE=x86_64-apple-darwin
-  '' + lib.optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -d $(ls -d libcxx-*) -i ${../../libcxx-0001-musl-hacks.patch}
-  '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d $(ls -d llvm-*) -i ${./wasm.patch}
-  '';
-
  installPhase = if stdenv.isDarwin
    then ''
      for file in lib/*.dylib; do
--- a/pkgs/development/compilers/llvm/10/libc++abi/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/10/libc++abi/gnu-install-dirs.patch
@ -0,0 +1,34 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 8f9572586b4a..bf0e41dfc751 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -20,6 +20,8 @@ set(CMAKE_MODULE_PATH
+ if (CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR OR LIBCXXABI_STANDALONE_BUILD)
+   project(libcxxabi CXX C)
+ 
+  include(GNUInstallDirs)
+
+   set(PACKAGE_NAME libcxxabi)
+   set(PACKAGE_VERSION 10.0.1)
+   set(PACKAGE_STRING "${PACKAGE_NAME} ${PACKAGE_VERSION}")
+@@ -214,17 +216,17 @@ string(REGEX MATCH "[0-9]+\\.[0-9]+(\\.[0-9]+)?" CLANG_VERSION
+ 
+ if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+   set(LIBCXXABI_LIBRARY_DIR ${LLVM_LIBRARY_OUTPUT_INTDIR}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++)
+-  set(LIBCXXABI_INSTALL_LIBRARY_DIR lib${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++)
+  set(LIBCXXABI_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++)
+   if(LIBCXX_LIBDIR_SUBDIR)
+     string(APPEND LIBCXXABI_LIBRARY_DIR /${LIBCXXABI_LIBDIR_SUBDIR})
+     string(APPEND LIBCXXABI_INSTALL_LIBRARY_DIR /${LIBCXXABI_LIBDIR_SUBDIR})
+   endif()
+ elseif(LLVM_LIBRARY_OUTPUT_INTDIR)
+   set(LIBCXXABI_LIBRARY_DIR ${LLVM_LIBRARY_OUTPUT_INTDIR})
+-  set(LIBCXXABI_INSTALL_LIBRARY_DIR lib${LIBCXXABI_LIBDIR_SUFFIX})
+  set(LIBCXXABI_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LIBCXXABI_LIBDIR_SUFFIX})
+ else()
+   set(LIBCXXABI_LIBRARY_DIR ${CMAKE_BINARY_DIR}/lib${LIBCXXABI_LIBDIR_SUFFIX})
+-  set(LIBCXXABI_INSTALL_LIBRARY_DIR lib${LIBCXXABI_LIBDIR_SUFFIX})
+  set(LIBCXXABI_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LIBCXXABI_LIBDIR_SUFFIX})
+ endif()
+ 
+ set(LIBCXXABI_INSTALL_PREFIX "" CACHE STRING "Define libc++abi destination prefix.")
--- a/pkgs/development/compilers/llvm/10/libunwind/default.nix
+++ b/pkgs/development/compilers/llvm/10/libunwind/default.nix
@ -8,6 +8,12 @@ stdenv.mkDerivation rec {

  src = fetch pname "09syx66idnm2pr46x2vmk0jn3iwdv0lkd04xy4zjbwmz3vn066bl";

+  patches = [
+    ./gnu-install-dirs.patch
+  ];
+
+  outputs = [ "out" "dev" ];
+
  nativeBuildInputs = [ cmake ];

  cmakeFlags = lib.optional (!enableShared) "-DLIBUNWIND_ENABLE_SHARED=OFF";
--- a/pkgs/development/compilers/llvm/10/libunwind/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/10/libunwind/gnu-install-dirs.patch
@ -0,0 +1,34 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index c033069ef1d0..e2846896eece 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -18,6 +18,8 @@ set(CMAKE_MODULE_PATH
+ if (CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR OR LIBUNWIND_STANDALONE_BUILD)
+   project(libunwind)
+ 
+  include(GNUInstallDirs)
+
+   # Rely on llvm-config.
+   set(CONFIG_OUTPUT)
+   if(NOT LLVM_CONFIG_PATH)
+@@ -189,17 +191,17 @@ string(REGEX MATCH "[0-9]+\\.[0-9]+(\\.[0-9]+)?" CLANG_VERSION
+ 
+ if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+   set(LIBUNWIND_LIBRARY_DIR ${LLVM_LIBRARY_OUTPUT_INTDIR}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++)
+-  set(LIBUNWIND_INSTALL_LIBRARY_DIR lib${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++)
+  set(LIBUNWIND_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++)
+   if(LIBCXX_LIBDIR_SUBDIR)
+     string(APPEND LIBUNWIND_LIBRARY_DIR /${LIBUNWIND_LIBDIR_SUBDIR})
+     string(APPEND LIBUNWIND_INSTALL_LIBRARY_DIR /${LIBUNWIND_LIBDIR_SUBDIR})
+   endif()
+ elseif(LLVM_LIBRARY_OUTPUT_INTDIR)
+   set(LIBUNWIND_LIBRARY_DIR ${LLVM_LIBRARY_OUTPUT_INTDIR})
+-  set(LIBUNWIND_INSTALL_LIBRARY_DIR lib${LIBUNWIND_LIBDIR_SUFFIX})
+  set(LIBUNWIND_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LIBUNWIND_LIBDIR_SUFFIX})
+ else()
+   set(LIBUNWIND_LIBRARY_DIR ${CMAKE_BINARY_DIR}/lib${LIBUNWIND_LIBDIR_SUFFIX})
+-  set(LIBUNWIND_INSTALL_LIBRARY_DIR lib${LIBUNWIND_LIBDIR_SUFFIX})
+  set(LIBUNWIND_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LIBUNWIND_LIBDIR_SUFFIX})
+ endif()
+ 
+ set(CMAKE_ARCHIVE_OUTPUT_DIRECTORY ${LIBUNWIND_LIBRARY_DIR})
--- a/pkgs/development/compilers/llvm/10/lld/default.nix
+++ b/pkgs/development/compilers/llvm/10/lld/default.nix
@ -1,8 +1,9 @@
 { lib, stdenv
+, buildLlvmTools
 , fetch
 , cmake
 , libxml2
-, llvm
+, libllvm
 , version
 }:

@ -12,15 +13,20 @@ stdenv.mkDerivation rec {

  src = fetch pname "0ynzi35r4fckvp6842alpd43qr810j3728yfslc66fk2mbh4j52r";

+  patches = [
+    ./gnu-install-dirs.patch
+  ];
+
  nativeBuildInputs = [ cmake ];
-  buildInputs = [ llvm libxml2 ];
+  buildInputs = [ libllvm libxml2 ];

-  outputs = [ "out" "dev" ];
+  cmakeFlags = [
+    "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
+  ];

-  postInstall = ''
-    moveToOutput include "$dev"
-    moveToOutput lib "$dev"
-  '';
+  outputs = [ "out" "lib" "dev" ];

  meta = {
    description = "The LLVM Linker";
--- a/pkgs/development/compilers/llvm/10/lld/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/10/lld/gnu-install-dirs.patch
@ -0,0 +1,68 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 641f71c114ae..9d44c1463aff 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -6,6 +6,8 @@ if(CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR)
+   set(CMAKE_INCLUDE_CURRENT_DIR ON)
+   set(LLD_BUILT_STANDALONE TRUE)
+ 
+  include(GNUInstallDirs)
+
+   find_program(LLVM_CONFIG_PATH "llvm-config" DOC "Path to llvm-config binary")
+   if(NOT LLVM_CONFIG_PATH)
+     message(FATAL_ERROR "llvm-config not found: specify LLVM_CONFIG_PATH")
+@@ -202,7 +204,7 @@ include_directories(BEFORE
+ 
+ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+   install(DIRECTORY include/
+-    DESTINATION include
+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
+     FILES_MATCHING
+     PATTERN "*.h"
+     PATTERN ".svn" EXCLUDE
+diff --git a/cmake/modules/AddLLD.cmake b/cmake/modules/AddLLD.cmake
+index fa48b428d26b..e7967aad3ceb 100644
+--- a/cmake/modules/AddLLD.cmake
+++ b/cmake/modules/AddLLD.cmake
+@@ -20,9 +20,9 @@ macro(add_lld_library name)
+     install(TARGETS ${name}
+       COMPONENT ${name}
+       ${export_to_lldtargets}
+-      LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-      ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-      RUNTIME DESTINATION bin)
+      LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
+      ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
+      RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
+ 
+     if (${ARG_SHARED} AND NOT CMAKE_CONFIGURATION_TYPES)
+       add_llvm_install_targets(install-${name}
+@@ -54,7 +54,7 @@ macro(add_lld_tool name)
+ 
+     install(TARGETS ${name}
+       ${export_to_lldtargets}
+-      RUNTIME DESTINATION bin
+      RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
+       COMPONENT ${name})
+ 
+     if(NOT CMAKE_CONFIGURATION_TYPES)
+@@ -69,5 +69,5 @@ endmacro()
+ macro(add_lld_symlink name dest)
+   add_llvm_tool_symlink(${name} ${dest} ALWAYS_GENERATE)
+   # Always generate install targets
+-  llvm_install_symlink(${name} ${dest} ALWAYS_GENERATE)
+  llvm_install_symlink(${name} ${dest} ${CMAKE_INSTALL_FULL_BINDIR} ALWAYS_GENERATE)
+ endmacro()
+diff --git a/tools/lld/CMakeLists.txt b/tools/lld/CMakeLists.txt
+index a15e296e31df..654c2cfdb9c0 100644
+--- a/tools/lld/CMakeLists.txt
+++ b/tools/lld/CMakeLists.txt
+@@ -17,7 +17,7 @@ target_link_libraries(lld
+   )
+ 
+ install(TARGETS lld
+-  RUNTIME DESTINATION bin)
+  RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
+ 
+ if(NOT LLD_SYMLINKS_TO_CREATE)
+   set(LLD_SYMLINKS_TO_CREATE lld-link ld.lld ld64.lld wasm-ld)
--- a/pkgs/development/compilers/llvm/10/lldb/default.nix
+++ b/pkgs/development/compilers/llvm/10/lldb/default.nix
@ -7,8 +7,8 @@
 , which
 , libedit
 , libxml2
-, llvm
-, clang-unwrapped
+, libllvm
+, libclang
 , python3
 , version
 , darwin
@ -22,19 +22,22 @@ stdenv.mkDerivation (rec {

  src = fetch pname "051p5b04y6z3g730rmc2n2v71lipbw7k69riww3a6sl74myfiaq7";

-  patches = [ ./procfs.patch ];
+  patches = [
+    ./procfs.patch
+    ./gnu-install-dirs.patch
+  ];

-  nativeBuildInputs = [ cmake python3 which swig lit ]
-    ++ lib.optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
+  outputs = [ "out" "lib" "dev" ];
+
+  nativeBuildInputs = [
+    cmake python3 which swig lit
+  ] ++ lib.optionals enableManpages [
+    python3.pkgs.sphinx python3.pkgs.recommonmark
+  ];

  buildInputs = [
-    ncurses
-    zlib
-    libedit
-    libxml2
-    llvm
-  ]
-  ++ lib.optionals stdenv.isDarwin [
+    ncurses zlib libedit libxml2 libllvm
+  ] ++ lib.optionals stdenv.isDarwin [
    darwin.libobjc
    darwin.apple_sdk.libs.xpc
    darwin.apple_sdk.frameworks.Foundation
@ -46,8 +49,9 @@ stdenv.mkDerivation (rec {
  hardeningDisable = [ "format" ];

  cmakeFlags = [
+    "-DLLDB_INCLUDE_TESTS=${if doCheck then "YES" else "NO"}"
    "-DLLVM_ENABLE_RTTI=OFF"
-    "-DClang_DIR=${clang-unwrapped}/lib/cmake"
+    "-DClang_DIR=${libclang.dev}/lib/cmake"
    "-DLLVM_EXTERNAL_LIT=${lit}/bin/lit"
  ] ++ lib.optionals stdenv.isDarwin [
    "-DLLDB_USE_SYSTEM_DEBUGSERVER=ON"
@ -57,33 +61,38 @@ stdenv.mkDerivation (rec {
    "-DLLVM_ENABLE_SPHINX=ON"
    "-DSPHINX_OUTPUT_MAN=ON"
    "-DSPHINX_OUTPUT_HTML=OFF"
+  ] ++ lib.optionals doCheck [
+    "-DLLDB_TEST_C_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
+    "-DLLDB_TEST_CXX_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++"
  ];

+  doCheck = false;
+
  postInstall = ''
    # Editor support
    # vscode:
    install -D ../tools/lldb-vscode/package.json $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/package.json
    mkdir -p $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
-    ln -s $out/bin/lldb-vscode $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
+    ln -s $out/bin/llvm-vscode $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
  '';

  meta = with lib; {
    description = "A next-generation high-performance debugger";
-    homepage = "https://lldb.llvm.org";
-    license = licenses.ncsa;
-    platforms = platforms.all;
+    homepage    = "https://lldb.llvm.org";
+    license     = licenses.ncsa;
+    platforms   = platforms.all;
  };
 } // lib.optionalAttrs enableManpages {
  pname = "lldb-manpages";

  buildPhase = ''
-    make docs-lldb-man
+    make docs-man
  '';

  propagatedBuildInputs = [];

+  # manually install lldb man page
  installPhase = ''
-    # manually install lldb man page
    mkdir -p $out/share/man/man1
    install docs/man/lldb.1 -t $out/share/man/man1/
  '';
--- a/pkgs/development/compilers/llvm/10/lldb/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/10/lldb/gnu-install-dirs.patch
@ -0,0 +1,65 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 573b8556989e..a12cc6f6ba77 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -17,6 +17,8 @@ set(CMAKE_MODULE_PATH
+ # If we are not building as part of LLVM, build LLDB as a standalone project,
+ # using LLVM as an external library.
+ if (CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR)
+  include(GNUInstallDirs)
+
+   project(lldb)
+   include(LLDBStandalone)
+ 
+diff --git a/cmake/modules/AddLLDB.cmake b/cmake/modules/AddLLDB.cmake
+index ecf0b66a41a3..6f2d97af7a11 100644
+--- a/cmake/modules/AddLLDB.cmake
+++ b/cmake/modules/AddLLDB.cmake
+@@ -107,13 +107,13 @@ function(add_lldb_library name)
+   endif()
+ 
+   if(PARAM_SHARED)
+-    set(install_dest lib${LLVM_LIBDIR_SUFFIX})
+    set(install_dest ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
+     if(PARAM_INSTALL_PREFIX)
+       set(install_dest ${PARAM_INSTALL_PREFIX})
+     endif()
+     # RUNTIME is relevant for DLL platforms, FRAMEWORK for macOS
+     install(TARGETS ${name} COMPONENT ${name}
+-      RUNTIME DESTINATION bin
+      RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
+       LIBRARY DESTINATION ${install_dest}
+       ARCHIVE DESTINATION ${install_dest}
+       FRAMEWORK DESTINATION ${install_dest})
+diff --git a/cmake/modules/LLDBConfig.cmake b/cmake/modules/LLDBConfig.cmake
+index 4a15a343ee1d..c74bbb6878d7 100644
+--- a/cmake/modules/LLDBConfig.cmake
+++ b/cmake/modules/LLDBConfig.cmake
+@@ -238,7 +238,7 @@ include_directories(BEFORE
+ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+   install(DIRECTORY include/
+     COMPONENT lldb-headers
+-    DESTINATION include
+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
+     FILES_MATCHING
+     PATTERN "*.h"
+     PATTERN ".svn" EXCLUDE
+@@ -247,7 +247,7 @@ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+ 
+   install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/include/
+     COMPONENT lldb-headers
+-    DESTINATION include
+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
+     FILES_MATCHING
+     PATTERN "*.h"
+     PATTERN ".svn" EXCLUDE
+diff --git a/tools/intel-features/CMakeLists.txt b/tools/intel-features/CMakeLists.txt
+index aff75d7db334..98a527c5e761 100644
+--- a/tools/intel-features/CMakeLists.txt
+++ b/tools/intel-features/CMakeLists.txt
+@@ -64,4 +64,4 @@ if (LLDB_ENABLE_PYTHON AND LLDB_BUILD_INTEL_PT)
+ endif()
+ 
+ install(TARGETS lldbIntelFeatures
+-  LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX})
+  LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@ -1,4 +1,5 @@
 { lib, stdenv
+, pkgsBuildBuild
 , fetch
 , cmake
 , python3
@ -10,10 +11,10 @@
 , version
 , release_version
 , zlib
-, buildPackages
+, buildLlvmTools
 , debugVersion ? false
 , enableManpages ? false
-, enableSharedLibraries ? true
+, enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 , enablePFM ? !(stdenv.isDarwin
  || stdenv.isAarch64 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
  || stdenv.isAarch32 # broken for the armv7l builder
@ -44,8 +45,7 @@ in stdenv.mkDerivation (rec {
    mv polly-* $sourceRoot/tools/polly
  '';

-  outputs = [ "out" "python" ]
-    ++ optional enableSharedLibraries "lib";
+  outputs = [ "out" "lib" "dev" "python" ];

  nativeBuildInputs = [ cmake python3 ]
    ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
@ -55,10 +55,14 @@ in stdenv.mkDerivation (rec {

  propagatedBuildInputs = [ ncurses zlib ];

+  patches = [
+    ./gnu-install-dirs.patch
+  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
+
  postPatch = optionalString stdenv.isDarwin ''
    substituteInPlace cmake/modules/AddLLVM.cmake \
      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
-      --replace 'set(_install_rpath "@loader_path/../lib''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
+      --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
  ''
  # Patch llvm-config to return correct library path based on --link-{shared,static}.
  + optionalString (enableSharedLibraries) ''
@ -97,6 +101,7 @@ in stdenv.mkDerivation (rec {
  '';

  cmakeFlags = with stdenv; [
+    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
    "-DLLVM_BUILD_TESTS=ON"
@ -120,7 +125,20 @@ in stdenv.mkDerivation (rec {
    "-DCAN_TARGET_i386=false"
  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
    "-DCMAKE_CROSSCOMPILING=True"
-    "-DLLVM_TABLEGEN=${buildPackages.llvm_10}/bin/llvm-tblgen"
+    "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
+    (
+      let
+        nativeCC = pkgsBuildBuild.targetPackages.stdenv.cc;
+        nativeBintools = nativeCC.bintools.bintools;
+        nativeToolchainFlags = [
+          "-DCMAKE_C_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}cc"
+          "-DCMAKE_CXX_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}c++"
+          "-DCMAKE_AR=${nativeBintools}/bin/${nativeBintools.targetPrefix}ar"
+          "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
+          "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+    )
  ];

  postBuild = ''
@ -134,20 +152,19 @@ in stdenv.mkDerivation (rec {
  postInstall = ''
    mkdir -p $python/share
    mv $out/share/opt-viewer $python/share/opt-viewer
-  ''
-  + optionalString enableSharedLibraries ''
-    moveToOutput "lib/libLLVM-*" "$lib"
-    moveToOutput "lib/libLLVM${stdenv.hostPlatform.extensions.sharedLibrary}" "$lib"
-  ''
-  + optionalString (enableSharedLibraries && (!stdenv.isDarwin)) ''
-    substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
-      --replace "\''${_IMPORT_PREFIX}/lib/libLLVM-" "$lib/lib/libLLVM-"
+    moveToOutput "bin/llvm-config*" "$dev"
+    substituteInPlace "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
+      --replace "\''${_IMPORT_PREFIX}/lib/lib" "$lib/lib/lib" \
+      --replace "$out/bin/llvm-config" "$dev/bin/llvm-config"
+    substituteInPlace "$dev/lib/cmake/llvm/LLVMConfig.cmake" \
+      --replace 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}")' 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}'"$lib"'")'
  ''
  + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
-    substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
-      --replace "\''${_IMPORT_PREFIX}/lib/libLLVM.dylib" "$lib/lib/libLLVM.dylib"
    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
+  ''
+  + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+    cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
  '';

  doCheck = stdenv.isLinux && (!stdenv.isx86_32);
--- a/pkgs/development/compilers/llvm/10/llvm/gnu-install-dirs-polly.patch
+++ b/pkgs/development/compilers/llvm/10/llvm/gnu-install-dirs-polly.patch
@ -0,0 +1,106 @@
+diff --git a/tools/polly/CMakeLists.txt b/tools/polly/CMakeLists.txt
+index 9939097f743e..8cc538da912a 100644
+--- a/tools/polly/CMakeLists.txt
+++ b/tools/polly/CMakeLists.txt
+@@ -2,7 +2,11 @@
+ if (NOT DEFINED LLVM_MAIN_SRC_DIR)
+   project(Polly)
+   cmake_minimum_required(VERSION 3.4.3)
+endif()
+
+include(GNUInstallDirs)
+ 
+if (NOT DEFINED LLVM_MAIN_SRC_DIR)
+   # Where is LLVM installed?
+   find_package(LLVM CONFIG REQUIRED)
+   set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} ${LLVM_CMAKE_DIR})
+@@ -145,14 +149,14 @@ include_directories(
+ 
+ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+   install(DIRECTORY include/
+-    DESTINATION include
+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
+     FILES_MATCHING
+     PATTERN "*.h"
+     PATTERN ".svn" EXCLUDE
+     )
+ 
+   install(DIRECTORY ${POLLY_BINARY_DIR}/include/
+-    DESTINATION include
+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
+     FILES_MATCHING
+     PATTERN "*.h"
+     PATTERN "CMakeFiles" EXCLUDE
+diff --git a/tools/polly/cmake/CMakeLists.txt b/tools/polly/cmake/CMakeLists.txt
+index 211f95512717..f9e04a4844b6 100644
+--- a/tools/polly/cmake/CMakeLists.txt
+++ b/tools/polly/cmake/CMakeLists.txt
+@@ -79,18 +79,18 @@ file(GENERATE
+ 
+ # Generate PollyConfig.cmake for the install tree.
+ unset(POLLY_EXPORTS)
+-set(POLLY_INSTALL_PREFIX "${CMAKE_INSTALL_PREFIX}")
+set(POLLY_INSTALL_PREFIX "")
+ set(POLLY_CONFIG_LLVM_CMAKE_DIR "${LLVM_BINARY_DIR}/${LLVM_INSTALL_PACKAGE_DIR}")
+-set(POLLY_CONFIG_CMAKE_DIR "${POLLY_INSTALL_PREFIX}/${POLLY_INSTALL_PACKAGE_DIR}")
+-set(POLLY_CONFIG_LIBRARY_DIRS "${POLLY_INSTALL_PREFIX}/lib${LLVM_LIBDIR_SUFFIX}")
+set(POLLY_CONFIG_CMAKE_DIR "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_PREFIX}/${POLLY_INSTALL_PACKAGE_DIR}")
+set(POLLY_CONFIG_LIBRARY_DIRS "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
+ if (POLLY_BUNDLED_ISL)
+   set(POLLY_CONFIG_INCLUDE_DIRS
+-    "${POLLY_INSTALL_PREFIX}/include"
+-    "${POLLY_INSTALL_PREFIX}/include/polly"
+    "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_LIBDIR}"
+    "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_LIBDIR}/polly"
+     )
+ else()
+   set(POLLY_CONFIG_INCLUDE_DIRS
+-    "${POLLY_INSTALL_PREFIX}/include"
+    "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_INCLUDEDIR}"
+     ${ISL_INCLUDE_DIRS}
+     )
+ endif()
+@@ -100,12 +100,12 @@ endif()
+ foreach(tgt IN LISTS POLLY_CONFIG_EXPORTED_TARGETS)
+   get_target_property(tgt_type ${tgt} TYPE)
+   if (tgt_type STREQUAL "EXECUTABLE")
+-    set(tgt_prefix "bin/")
+    set(tgt_prefix "${CMAKE_INSTALL_BINDIR}/")
+   else()
+-    set(tgt_prefix "lib/")
+    set(tgt_prefix "${CMAKE_INSTALL_LIBDIR}/")
+   endif()
+ 
+-  set(tgt_path "${CMAKE_INSTALL_PREFIX}/${tgt_prefix}$<TARGET_FILE_NAME:${tgt}>")
+  set(tgt_path "${tgt_prefix}$<TARGET_FILE_NAME:${tgt}>")
+   file(RELATIVE_PATH tgt_path ${POLLY_CONFIG_CMAKE_DIR} ${tgt_path})
+ 
+   if (NOT tgt_type STREQUAL "INTERFACE_LIBRARY")
+diff --git a/tools/polly/cmake/polly_macros.cmake b/tools/polly/cmake/polly_macros.cmake
+index 86de6f10686e..91f30891ccbe 100644
+--- a/tools/polly/cmake/polly_macros.cmake
+++ b/tools/polly/cmake/polly_macros.cmake
+@@ -44,8 +44,8 @@ macro(add_polly_library name)
+   if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY OR ${name} STREQUAL "LLVMPolly")
+     install(TARGETS ${name}
+       EXPORT LLVMExports
+-      LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-      ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX})
+	  LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
+      ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
+   endif()
+   set_property(GLOBAL APPEND PROPERTY LLVM_EXPORTS ${name})
+ endmacro(add_polly_library)
+diff --git a/tools/polly/lib/External/CMakeLists.txt b/tools/polly/lib/External/CMakeLists.txt
+index 8ffd984e542b..261cc19f3238 100644
+--- a/tools/polly/lib/External/CMakeLists.txt
+++ b/tools/polly/lib/External/CMakeLists.txt
+@@ -274,7 +274,7 @@ if (POLLY_BUNDLED_ISL)
+     install(DIRECTORY
+       ${ISL_SOURCE_DIR}/include/
+       ${ISL_BINARY_DIR}/include/
+-      DESTINATION include/polly
+      DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/polly
+       FILES_MATCHING
+       PATTERN "*.h"
+       PATTERN "CMakeFiles" EXCLUDE
--- a/pkgs/development/compilers/llvm/10/llvm/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/10/llvm/gnu-install-dirs.patch
@ -0,0 +1,416 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 0e85afa82c76..3e700d9c5fae 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -253,15 +253,21 @@ if (CMAKE_BUILD_TYPE AND
+   message(FATAL_ERROR "Invalid value for CMAKE_BUILD_TYPE: ${CMAKE_BUILD_TYPE}")
+ endif()
+ 
+include(GNUInstallDirs)
+
+ set(LLVM_LIBDIR_SUFFIX "" CACHE STRING "Define suffix of library directory name (32/64)" )
+ 
+-set(LLVM_TOOLS_INSTALL_DIR "bin" CACHE STRING "Path for binary subdirectory (defaults to 'bin')")
+set(LLVM_TOOLS_INSTALL_DIR "${CMAKE_INSTALL_BINDIR}" CACHE STRING
+    "Path for binary subdirectory (defaults to 'bin')")
+ mark_as_advanced(LLVM_TOOLS_INSTALL_DIR)
+ 
+ set(LLVM_UTILS_INSTALL_DIR "${LLVM_TOOLS_INSTALL_DIR}" CACHE STRING
+     "Path to install LLVM utilities (enabled by LLVM_INSTALL_UTILS=ON) (defaults to LLVM_TOOLS_INSTALL_DIR)")
+ mark_as_advanced(LLVM_UTILS_INSTALL_DIR)
+ 
+set(LLVM_INSTALL_CMAKE_DIR "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/cmake/llvm" CACHE STRING
+	"Path for CMake subdirectory (defaults to lib/cmake/llvm)" )
+
+ # They are used as destination of target generators.
+ set(LLVM_RUNTIME_OUTPUT_INTDIR ${CMAKE_CURRENT_BINARY_DIR}/${CMAKE_CFG_INTDIR}/bin)
+ set(LLVM_LIBRARY_OUTPUT_INTDIR ${CMAKE_CURRENT_BINARY_DIR}/${CMAKE_CFG_INTDIR}/lib${LLVM_LIBDIR_SUFFIX})
+@@ -527,9 +533,9 @@ option (LLVM_ENABLE_SPHINX "Use Sphinx to generate llvm documentation." OFF)
+ option (LLVM_ENABLE_OCAMLDOC "Build OCaml bindings documentation." ON)
+ option (LLVM_ENABLE_BINDINGS "Build bindings." ON)
+ 
+-set(LLVM_INSTALL_DOXYGEN_HTML_DIR "share/doc/llvm/doxygen-html"
+set(LLVM_INSTALL_DOXYGEN_HTML_DIR "${CMAKE_INSTALL_DOCDIR}/${project}/doxygen-html"
+     CACHE STRING "Doxygen-generated HTML documentation install directory")
+-set(LLVM_INSTALL_OCAMLDOC_HTML_DIR "share/doc/llvm/ocaml-html"
+set(LLVM_INSTALL_OCAMLDOC_HTML_DIR "${CMAKE_INSTALL_DOCDIR}/${project}/ocaml-html"
+     CACHE STRING "OCamldoc-generated HTML documentation install directory")
+ 
+ option (LLVM_BUILD_EXTERNAL_COMPILER_RT
+@@ -993,7 +999,7 @@ endif()
+ 
+ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+   install(DIRECTORY include/llvm include/llvm-c
+-    DESTINATION include
+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
+     COMPONENT llvm-headers
+     FILES_MATCHING
+     PATTERN "*.def"
+@@ -1005,7 +1011,7 @@ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+     )
+ 
+   install(DIRECTORY ${LLVM_INCLUDE_DIR}/llvm ${LLVM_INCLUDE_DIR}/llvm-c
+-    DESTINATION include
+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
+     COMPONENT llvm-headers
+     FILES_MATCHING
+     PATTERN "*.def"
+@@ -1020,13 +1026,13 @@ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+ 
+   if (LLVM_INSTALL_MODULEMAPS)
+     install(DIRECTORY include/llvm include/llvm-c
+-            DESTINATION include
+            DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
+             COMPONENT llvm-headers
+             FILES_MATCHING
+             PATTERN "module.modulemap"
+             )
+     install(FILES include/llvm/module.install.modulemap
+-            DESTINATION include/llvm
+            DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/llvm
+             COMPONENT llvm-headers
+             RENAME "module.extern.modulemap"
+             )
+diff --git a/cmake/modules/AddLLVM.cmake b/cmake/modules/AddLLVM.cmake
+index f5a1b0d6f238..a7387224d68f 100644
+--- a/cmake/modules/AddLLVM.cmake
+++ b/cmake/modules/AddLLVM.cmake
+@@ -729,9 +729,9 @@ macro(add_llvm_library name)
+ 
+       install(TARGETS ${name}
+               ${export_to_llvmexports}
+-              LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX} COMPONENT ${name}
+-              ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX} COMPONENT ${name}
+-              RUNTIME DESTINATION bin COMPONENT ${name})
+              LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX} COMPONENT ${name}
+              ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX} COMPONENT ${name}
+              RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT ${name})
+ 
+       if (NOT LLVM_ENABLE_IDE)
+         add_llvm_install_targets(install-${name}
+@@ -934,7 +934,7 @@ function(process_llvm_pass_plugins)
+           "set(LLVM_STATIC_EXTENSIONS ${LLVM_STATIC_EXTENSIONS})")
+       install(FILES
+           ${llvm_cmake_builddir}/LLVMConfigExtensions.cmake
+-          DESTINATION ${LLVM_INSTALL_PACKAGE_DIR}
+          DESTINATION ${LLVM_INSTALL_CMAKE_DIR}
+           COMPONENT cmake-exports)
+ 
+       set(ExtensionDef "${LLVM_BINARY_DIR}/include/llvm/Support/Extension.def")
+@@ -1147,7 +1147,7 @@ macro(add_llvm_example name)
+   endif()
+   add_llvm_executable(${name} ${ARGN})
+   if( LLVM_BUILD_EXAMPLES )
+-    install(TARGETS ${name} RUNTIME DESTINATION examples)
+    install(TARGETS ${name} RUNTIME DESTINATION ${CMAKE_INSTALL_DOCDIR}/examples)
+   endif()
+   set_target_properties(${name} PROPERTIES FOLDER "Examples")
+ endmacro(add_llvm_example name)
+@@ -1713,7 +1713,7 @@ function(llvm_install_library_symlink name dest type)
+   set(full_name ${CMAKE_${type}_LIBRARY_PREFIX}${name}${CMAKE_${type}_LIBRARY_SUFFIX})
+   set(full_dest ${CMAKE_${type}_LIBRARY_PREFIX}${dest}${CMAKE_${type}_LIBRARY_SUFFIX})
+ 
+-  set(output_dir lib${LLVM_LIBDIR_SUFFIX})
+  set(output_dir ${CMAKE_INSTALL_FULL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
+   if(WIN32 AND "${type}" STREQUAL "SHARED")
+     set(output_dir bin)
+   endif()
+@@ -1730,7 +1730,7 @@ function(llvm_install_library_symlink name dest type)
+   endif()
+ endfunction()
+ 
+-function(llvm_install_symlink name dest)
+function(llvm_install_symlink name dest output_dir)
+   cmake_parse_arguments(ARG "ALWAYS_GENERATE" "COMPONENT" "" ${ARGN})
+   foreach(path ${CMAKE_MODULE_PATH})
+     if(EXISTS ${path}/LLVMInstallSymlink.cmake)
+@@ -1753,7 +1753,7 @@ function(llvm_install_symlink name dest)
+   set(full_dest ${dest}${CMAKE_EXECUTABLE_SUFFIX})
+ 
+   install(SCRIPT ${INSTALL_SYMLINK}
+-          CODE "install_symlink(${full_name} ${full_dest} ${LLVM_TOOLS_INSTALL_DIR})"
+          CODE "install_symlink(${full_name} ${full_dest} ${output_dir})"
+           COMPONENT ${component})
+ 
+   if (NOT LLVM_ENABLE_IDE AND NOT ARG_ALWAYS_GENERATE)
+@@ -1836,7 +1836,8 @@ function(add_llvm_tool_symlink link_name target)
+     endif()
+ 
+     if ((TOOL_IS_TOOLCHAIN OR NOT LLVM_INSTALL_TOOLCHAIN_ONLY) AND LLVM_BUILD_TOOLS)
+-      llvm_install_symlink(${link_name} ${target})
+      GNUInstallDirs_get_absolute_install_dir(output_dir LLVM_TOOLS_INSTALL_DIR)
+      llvm_install_symlink(${link_name} ${target} ${output_dir})
+     endif()
+   endif()
+ endfunction()
+@@ -1958,9 +1959,9 @@ function(llvm_setup_rpath name)
+ 
+   if (APPLE)
+     set(_install_name_dir INSTALL_NAME_DIR "@rpath")
+-    set(_install_rpath "@loader_path/../lib${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
+    set(_install_rpath "@loader_path/../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
+   elseif(UNIX)
+-    set(_install_rpath "\$ORIGIN/../lib${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
+    set(_install_rpath "\$ORIGIN/../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
+     if(${CMAKE_SYSTEM_NAME} MATCHES "(FreeBSD|DragonFly)")
+       set_property(TARGET ${name} APPEND_STRING PROPERTY
+                    LINK_FLAGS " -Wl,-z,origin ")
+diff --git a/cmake/modules/AddOCaml.cmake b/cmake/modules/AddOCaml.cmake
+index 554046b20edf..4d1ad980641e 100644
+--- a/cmake/modules/AddOCaml.cmake
+++ b/cmake/modules/AddOCaml.cmake
+@@ -144,9 +144,9 @@ function(add_ocaml_library name)
+   endforeach()
+ 
+   if( APPLE )
+-    set(ocaml_rpath "@executable_path/../../../lib${LLVM_LIBDIR_SUFFIX}")
+    set(ocaml_rpath "@executable_path/../../../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
+   elseif( UNIX )
+-    set(ocaml_rpath "\\$ORIGIN/../../../lib${LLVM_LIBDIR_SUFFIX}")
+    set(ocaml_rpath "\\$ORIGIN/../../../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
+   endif()
+   list(APPEND ocaml_flags "-ldopt" "-Wl,-rpath,${ocaml_rpath}")
+ 
+diff --git a/cmake/modules/AddSphinxTarget.cmake b/cmake/modules/AddSphinxTarget.cmake
+index 2bf654b60c44..450ee45d86e6 100644
+--- a/cmake/modules/AddSphinxTarget.cmake
+++ b/cmake/modules/AddSphinxTarget.cmake
+@@ -78,7 +78,7 @@ function (add_sphinx_target builder project)
+         endif()
+       elseif (builder STREQUAL html)
+         string(TOUPPER "${project}" project_upper)
+-        set(${project_upper}_INSTALL_SPHINX_HTML_DIR "share/doc/${project}/html"
+        set(${project_upper}_INSTALL_SPHINX_HTML_DIR "${CMAKE_INSTALL_DOCDIR}/${project}/html"
+             CACHE STRING "HTML documentation install directory for ${project}")
+ 
+         # '/.' indicates: copy the contents of the directory directly into
+diff --git a/cmake/modules/CMakeLists.txt b/cmake/modules/CMakeLists.txt
+index af757d6199a8..b0fb7e7705d1 100644
+--- a/cmake/modules/CMakeLists.txt
+++ b/cmake/modules/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-set(LLVM_INSTALL_PACKAGE_DIR lib${LLVM_LIBDIR_SUFFIX}/cmake/llvm)
+set(LLVM_INSTALL_PACKAGE_DIR ${LLVM_INSTALL_CMAKE_DIR} CACHE STRING "Path for CMake subdirectory (defaults to 'cmake/llvm')")
+ set(llvm_cmake_builddir "${LLVM_BINARY_DIR}/${LLVM_INSTALL_PACKAGE_DIR}")
+ 
+ # First for users who use an installed LLVM, create the LLVMExports.cmake file.
+@@ -96,13 +96,13 @@ foreach(p ${_count})
+   set(LLVM_CONFIG_CODE "${LLVM_CONFIG_CODE}
+ get_filename_component(LLVM_INSTALL_PREFIX \"\${LLVM_INSTALL_PREFIX}\" PATH)")
+ endforeach(p)
+-set(LLVM_CONFIG_INCLUDE_DIRS "\${LLVM_INSTALL_PREFIX}/include")
+set(LLVM_CONFIG_INCLUDE_DIRS "\${LLVM_INSTALL_PREFIX}/${CMAKE_INSTALL_INCLUDEDIR}")
+ set(LLVM_CONFIG_INCLUDE_DIR "${LLVM_CONFIG_INCLUDE_DIRS}")
+ set(LLVM_CONFIG_MAIN_INCLUDE_DIR "${LLVM_CONFIG_INCLUDE_DIRS}")
+-set(LLVM_CONFIG_LIBRARY_DIRS "\${LLVM_INSTALL_PREFIX}/lib\${LLVM_LIBDIR_SUFFIX}")
+set(LLVM_CONFIG_LIBRARY_DIRS "\${LLVM_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}\${LLVM_LIBDIR_SUFFIX}")
+ set(LLVM_CONFIG_CMAKE_DIR "\${LLVM_INSTALL_PREFIX}/${LLVM_INSTALL_PACKAGE_DIR}")
+ set(LLVM_CONFIG_BINARY_DIR "\${LLVM_INSTALL_PREFIX}")
+-set(LLVM_CONFIG_TOOLS_BINARY_DIR "\${LLVM_INSTALL_PREFIX}/bin")
+set(LLVM_CONFIG_TOOLS_BINARY_DIR "\${LLVM_INSTALL_PREFIX}/${CMAKE_INSTALL_BINDIR}")
+ set(LLVM_CONFIG_EXPORTS_FILE "\${LLVM_CMAKE_DIR}/LLVMExports.cmake")
+ set(LLVM_CONFIG_EXPORTS "${LLVM_EXPORTS}")
+ configure_file(
+diff --git a/cmake/modules/LLVMInstallSymlink.cmake b/cmake/modules/LLVMInstallSymlink.cmake
+index 09fed8085c23..aa79f192abf0 100644
+--- a/cmake/modules/LLVMInstallSymlink.cmake
+++ b/cmake/modules/LLVMInstallSymlink.cmake
+@@ -10,7 +10,7 @@ function(install_symlink name target outdir)
+     set(LINK_OR_COPY copy)
+   endif()
+ 
+-  set(bindir "${DESTDIR}${CMAKE_INSTALL_PREFIX}/${outdir}/")
+  set(bindir "${DESTDIR}${outdir}/")
+ 
+   message(STATUS "Creating ${name}")
+ 
+diff --git a/docs/CMake.rst b/docs/CMake.rst
+index a86ebb3a37bd..e720711e2b3c 100644
+--- a/docs/CMake.rst
+++ b/docs/CMake.rst
+@@ -196,7 +196,7 @@ CMake manual, or execute ``cmake --help-variable VARIABLE_NAME``.
+ **LLVM_LIBDIR_SUFFIX**:STRING
+   Extra suffix to append to the directory where libraries are to be
+   installed. On a 64-bit architecture, one could use ``-DLLVM_LIBDIR_SUFFIX=64``
+-  to install libraries to ``/usr/lib64``.
+  to install libraries to ``/usr/lib64``. See also ``CMAKE_INSTALL_LIBDIR``.
+ 
+ **CMAKE_C_FLAGS**:STRING
+   Extra flags to use when compiling C source files.
+@@ -516,8 +516,8 @@ LLVM-specific variables
+ 
+ **LLVM_INSTALL_DOXYGEN_HTML_DIR**:STRING
+   The path to install Doxygen-generated HTML documentation to. This path can
+-  either be absolute or relative to the CMAKE_INSTALL_PREFIX. Defaults to
+-  `share/doc/llvm/doxygen-html`.
+  either be absolute or relative to the ``CMAKE_INSTALL_PREFIX``. Defaults to
+  `${CMAKE_INSTALL_DOCDIR}/${project}/doxygen-html`.
+ 
+ **LLVM_ENABLE_SPHINX**:BOOL
+   If specified, CMake will search for the ``sphinx-build`` executable and will make
+@@ -548,13 +548,33 @@ LLVM-specific variables
+ 
+ **LLVM_INSTALL_SPHINX_HTML_DIR**:STRING
+   The path to install Sphinx-generated HTML documentation to. This path can
+-  either be absolute or relative to the CMAKE_INSTALL_PREFIX. Defaults to
+-  `share/doc/llvm/html`.
+  either be absolute or relative to the ``CMAKE_INSTALL_PREFIX``. Defaults to
+  `${CMAKE_INSTALL_DOCDIR}/${project}/html`.
+ 
+ **LLVM_INSTALL_OCAMLDOC_HTML_DIR**:STRING
+   The path to install OCamldoc-generated HTML documentation to. This path can
+-  either be absolute or relative to the CMAKE_INSTALL_PREFIX. Defaults to
+-  `share/doc/llvm/ocaml-html`.
+  either be absolute or relative to the ``CMAKE_INSTALL_PREFIX``. Defaults to
+  `${CMAKE_INSTALL_DOCDIR}/${project}/ocaml-html`.
+
+**CMAKE_INSTALL_BINDIR**:STRING
+  The path to install binary tools, relative to the ``CMAKE_INSTALL_PREFIX``.
+  Defaults to `bin`.
+
+**CMAKE_INSTALL_LIBDIR**:STRING
+  The path to install libraries, relative to the ``CMAKE_INSTALL_PREFIX``.
+  Defaults to `lib`.
+
+**CMAKE_INSTALL_INCLUDEDIR**:STRING
+  The path to install header files, relative to the ``CMAKE_INSTALL_PREFIX``.
+  Defaults to `include`.
+
+**CMAKE_INSTALL_DOCDIR**:STRING
+  The path to install documentation, relative to the ``CMAKE_INSTALL_PREFIX``.
+  Defaults to `share/doc`.
+
+**CMAKE_INSTALL_MANDIR**:STRING
+  The path to install manpage files, relative to the ``CMAKE_INSTALL_PREFIX``.
+  Defaults to `share/man`.
+ 
+ **LLVM_CREATE_XCODE_TOOLCHAIN**:BOOL
+   macOS Only: If enabled CMake will generate a target named
+@@ -740,9 +760,11 @@ the ``cmake`` command or by setting it directly in ``ccmake`` or ``cmake-gui``).
+ 
+ This file is available in two different locations.
+ 
+-* ``<INSTALL_PREFIX>/lib/cmake/llvm/LLVMConfig.cmake`` where
+-  ``<INSTALL_PREFIX>`` is the install prefix of an installed version of LLVM.
+-  On Linux typically this is ``/usr/lib/cmake/llvm/LLVMConfig.cmake``.
+* ``<LLVM_INSTALL_PACKAGE_DIR>LLVMConfig.cmake`` where
+  ``<LLVM_INSTALL_PACKAGE_DIR>`` is the location where LLVM CMake modules are
+  installed as part of an installed version of LLVM. This is typically
+  ``cmake/llvm/`` within the lib directory. On Linux, this is typically
+  ``/usr/lib/cmake/llvm/LLVMConfig.cmake``.
+ 
+ * ``<LLVM_BUILD_ROOT>/lib/cmake/llvm/LLVMConfig.cmake`` where
+   ``<LLVM_BUILD_ROOT>`` is the root of the LLVM build tree. **Note: this is only
+diff --git a/examples/Bye/CMakeLists.txt b/examples/Bye/CMakeLists.txt
+index 3206f90d0916..1822965fc35f 100644
+--- a/examples/Bye/CMakeLists.txt
+++ b/examples/Bye/CMakeLists.txt
+@@ -9,5 +9,5 @@ add_llvm_pass_plugin(Bye
+   BUILDTREE_ONLY
+  )
+ 
+-install(TARGETS ${name} RUNTIME DESTINATION examples)
+install(TARGETS ${name} RUNTIME DESTINATION ${CMAKE_INSTALL_DOCDIR}/examples)
+ set_target_properties(${name} PROPERTIES FOLDER "Examples")
+diff --git a/include/llvm/CMakeLists.txt b/include/llvm/CMakeLists.txt
+index 1d5ca3ba92b0..026f5453c1da 100644
+--- a/include/llvm/CMakeLists.txt
+++ b/include/llvm/CMakeLists.txt
+@@ -4,5 +4,5 @@ add_subdirectory(Support)
+ # If we're doing an out-of-tree build, copy a module map for generated
+ # header files into the build area.
+ if (NOT "${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_BINARY_DIR}")
+-  configure_file(module.modulemap.build module.modulemap COPYONLY)
+  configure_file(module.modulemap.build ${LLVM_INCLUDE_DIR}/module.modulemap COPYONLY)
+ endif (NOT "${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_BINARY_DIR}")
+diff --git a/tools/llvm-config/BuildVariables.inc.in b/tools/llvm-config/BuildVariables.inc.in
+index 63cef75368b7..6295478b1f3d 100644
+--- a/tools/llvm-config/BuildVariables.inc.in
+++ b/tools/llvm-config/BuildVariables.inc.in
+@@ -23,6 +23,10 @@
+ #define LLVM_CXXFLAGS "@LLVM_CXXFLAGS@"
+ #define LLVM_BUILDMODE "@LLVM_BUILDMODE@"
+ #define LLVM_LIBDIR_SUFFIX "@LLVM_LIBDIR_SUFFIX@"
+#define LLVM_INSTALL_BINDIR "@CMAKE_INSTALL_BINDIR@"
+#define LLVM_INSTALL_LIBDIR "@CMAKE_INSTALL_LIBDIR@"
+#define LLVM_INSTALL_INCLUDEDIR "@CMAKE_INSTALL_INCLUDEDIR@"
+#define LLVM_INSTALL_CMAKEDIR "@LLVM_INSTALL_CMAKE_DIR@"
+ #define LLVM_TARGETS_BUILT "@LLVM_TARGETS_BUILT@"
+ #define LLVM_SYSTEM_LIBS "@LLVM_SYSTEM_LIBS@"
+ #define LLVM_BUILD_SYSTEM "@LLVM_BUILD_SYSTEM@"
+diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
+index fb12e29a36a8..dbb6c2b90332 100644
+--- a/tools/llvm-config/llvm-config.cpp
+++ b/tools/llvm-config/llvm-config.cpp
+@@ -358,12 +358,26 @@ int main(int argc, char **argv) {
+         ("-I" + ActiveIncludeDir + " " + "-I" + ActiveObjRoot + "/include");
+   } else {
+     ActivePrefix = CurrentExecPrefix;
+-    ActiveIncludeDir = ActivePrefix + "/include";
+-    SmallString<256> path(StringRef(LLVM_TOOLS_INSTALL_DIR));
+-    sys::fs::make_absolute(ActivePrefix, path);
+-    ActiveBinDir = path.str();
+-    ActiveLibDir = ActivePrefix + "/lib" + LLVM_LIBDIR_SUFFIX;
+-    ActiveCMakeDir = ActiveLibDir + "/cmake/llvm";
+    {
+      SmallString<256> path(StringRef(LLVM_INSTALL_INCLUDEDIR));
+      sys::fs::make_absolute(ActivePrefix, path);
+      ActiveIncludeDir = std::string(path.str());
+    }
+    {
+      SmallString<256> path(StringRef(LLVM_INSTALL_BINDIR));
+      sys::fs::make_absolute(ActivePrefix, path);
+      ActiveBinDir = std::string(path.str());
+    }
+    {
+      SmallString<256> path(StringRef(LLVM_INSTALL_LIBDIR LLVM_LIBDIR_SUFFIX));
+      sys::fs::make_absolute(ActivePrefix, path);
+      ActiveLibDir = std::string(path.str());
+    }
+    {
+      SmallString<256> path(StringRef(LLVM_INSTALL_CMAKEDIR));
+      sys::fs::make_absolute(ActivePrefix, path);
+      ActiveCMakeDir = std::string(path.str());
+    }
+     ActiveIncludeOption = "-I" + ActiveIncludeDir;
+   }
+ 
+diff --git a/tools/lto/CMakeLists.txt b/tools/lto/CMakeLists.txt
+index b86e4abd01a7..02ce5773f17d 100644
+--- a/tools/lto/CMakeLists.txt
+++ b/tools/lto/CMakeLists.txt
+@@ -23,7 +23,7 @@ set(LLVM_EXPORTED_SYMBOL_FILE ${CMAKE_CURRENT_SOURCE_DIR}/lto.exports)
+ add_llvm_library(LTO SHARED INSTALL_WITH_TOOLCHAIN ${SOURCES} DEPENDS intrinsics_gen)
+ 
+ install(FILES ${LLVM_MAIN_INCLUDE_DIR}/llvm-c/lto.h
+-  DESTINATION include/llvm-c
+  DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/llvm-c
+   COMPONENT LTO)
+ 
+ if (APPLE)
+diff --git a/tools/opt-viewer/CMakeLists.txt b/tools/opt-viewer/CMakeLists.txt
+index ead73ec13a8f..250362021f17 100644
+--- a/tools/opt-viewer/CMakeLists.txt
+++ b/tools/opt-viewer/CMakeLists.txt
+@@ -8,7 +8,7 @@ set (files
+ 
+ foreach (file ${files})
+   install(PROGRAMS ${file}
+-    DESTINATION share/opt-viewer
+    DESTINATION ${CMAKE_INSTALL_DATADIR}/opt-viewer
+     COMPONENT opt-viewer)
+ endforeach (file)
+ 
+diff --git a/tools/remarks-shlib/CMakeLists.txt b/tools/remarks-shlib/CMakeLists.txt
+index e948496c603a..1f4df8a98b10 100644
+--- a/tools/remarks-shlib/CMakeLists.txt
+++ b/tools/remarks-shlib/CMakeLists.txt
+@@ -11,7 +11,7 @@ set(LLVM_EXPORTED_SYMBOL_FILE ${CMAKE_CURRENT_SOURCE_DIR}/Remarks.exports)
+ add_llvm_library(Remarks SHARED INSTALL_WITH_TOOLCHAIN ${SOURCES})
+ 
+ install(FILES ${LLVM_MAIN_INCLUDE_DIR}/llvm-c/Remarks.h
+-  DESTINATION include/llvm-c
+  DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/llvm-c
+   COMPONENT Remarks)
+ 
+ if (APPLE)
--- a/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3, lld
+{ lib, stdenv, fetch, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
+, buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
 }:
@ -19,26 +20,31 @@ let
      mv clang-tools-extra-* $sourceRoot/tools/extra
    '';

-    nativeBuildInputs = [ cmake python3 lld ]
+    nativeBuildInputs = [ cmake python3 ]
      ++ lib.optional enableManpages python3.pkgs.sphinx
      ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;

-    buildInputs = [ libxml2 llvm ];
+    buildInputs = [ libxml2 libllvm ];

    cmakeFlags = [
      "-DCMAKE_CXX_FLAGS=-std=c++14"
      "-DCLANGD_BUILD_XPC=OFF"
+      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
    ] ++ lib.optionals enableManpages [
      "-DCLANG_INCLUDE_DOCS=ON"
      "-DLLVM_ENABLE_SPHINX=ON"
      "-DSPHINX_OUTPUT_MAN=ON"
      "-DSPHINX_OUTPUT_HTML=OFF"
      "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+    ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+      "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
+      "-DCLANG_TABLEGEN=${buildLlvmTools.libclang.dev}/bin/clang-tblgen"
    ];

    patches = [
      ./purity.patch
      # https://reviews.llvm.org/D51899
+      ./gnu-install-dirs.patch
    ];

    postPatch = ''
@ -55,12 +61,12 @@ let
        --replace "NOT HAVE_CXX_ATOMICS64_WITHOUT_LIB" FALSE
    '';

-    outputs = [ "out" "lib" "python" ];
+    outputs = [ "out" "lib" "dev" "python" ];

    # Clang expects to find LLVMgold in its own prefix
    postInstall = ''
-      if [ -e ${llvm}/lib/LLVMgold.so ]; then
-        ln -sv ${llvm}/lib/LLVMgold.so $out/lib
+      if [ -e ${libllvm.lib}/lib/LLVMgold.so ]; then
+        ln -sv ${libllvm.lib}/lib/LLVMgold.so $lib/lib
      fi

      ln -sv $out/bin/clang $out/bin/cpp
@ -79,11 +85,14 @@ let
      fi
      mv $out/share/clang/*.py $python/share/clang
      rm $out/bin/c-index-test
+
+      mkdir -p $dev/bin
+      cp bin/clang-tblgen $dev/bin
    '';

    passthru = {
      isClang = true;
-      inherit llvm;
+      inherit libllvm;
    };

    meta = {
--- a/pkgs/development/compilers/llvm/11/clang/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/11/clang/gnu-install-dirs.patch
@ -0,0 +1,235 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index bb4b801f01c8..77a8b43b22c8 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -9,6 +9,8 @@ endif()
+ if( CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR )
+   project(Clang)
+ 
+  include(GNUInstallDirs)
+
+   set(CMAKE_CXX_STANDARD 14 CACHE STRING "C++ standard to conform to")
+   set(CMAKE_CXX_STANDARD_REQUIRED YES)
+   set(CMAKE_CXX_EXTENSIONS NO)
+@@ -447,7 +449,7 @@ include_directories(BEFORE
+ 
+ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+   install(DIRECTORY include/clang include/clang-c
+-    DESTINATION include
+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
+     COMPONENT clang-headers
+     FILES_MATCHING
+     PATTERN "*.def"
+@@ -457,7 +459,7 @@ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+     )
+ 
+   install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/include/clang
+-    DESTINATION include
+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
+     COMPONENT clang-headers
+     FILES_MATCHING
+     PATTERN "CMakeFiles" EXCLUDE
+@@ -477,7 +479,7 @@ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+ 
+   add_custom_target(bash-autocomplete DEPENDS utils/bash-autocomplete.sh)
+   install(PROGRAMS utils/bash-autocomplete.sh
+-          DESTINATION share/clang
+          DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+           COMPONENT bash-autocomplete)
+   if(NOT LLVM_ENABLE_IDE)
+     add_llvm_install_targets(install-bash-autocomplete
+diff --git a/cmake/modules/AddClang.cmake b/cmake/modules/AddClang.cmake
+index 704278a0e93b..d25c8d325c71 100644
+--- a/cmake/modules/AddClang.cmake
+++ b/cmake/modules/AddClang.cmake
+@@ -123,9 +123,9 @@ macro(add_clang_library name)
+         install(TARGETS ${lib}
+           COMPONENT ${lib}
+           ${export_to_clangtargets}
+-          LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-          ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-          RUNTIME DESTINATION bin)
+          LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
+          ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
+          RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
+ 
+         if (NOT LLVM_ENABLE_IDE)
+           add_llvm_install_targets(install-${lib}
+@@ -170,7 +170,7 @@ macro(add_clang_tool name)
+ 
+     install(TARGETS ${name}
+       ${export_to_clangtargets}
+-      RUNTIME DESTINATION bin
+      RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
+       COMPONENT ${name})
+ 
+     if(NOT LLVM_ENABLE_IDE)
+@@ -185,7 +185,7 @@ endmacro()
+ macro(add_clang_symlink name dest)
+   add_llvm_tool_symlink(${name} ${dest} ALWAYS_GENERATE)
+   # Always generate install targets
+-  llvm_install_symlink(${name} ${dest} ALWAYS_GENERATE)
+  llvm_install_symlink(${name} ${dest} ${CMAKE_INSTALL_FULL_BINDIR} ALWAYS_GENERATE)
+ endmacro()
+ 
+ function(clang_target_link_libraries target type)
+diff --git a/lib/Headers/CMakeLists.txt b/lib/Headers/CMakeLists.txt
+index 0692fe75a441..6f201e7207d0 100644
+--- a/lib/Headers/CMakeLists.txt
+++ b/lib/Headers/CMakeLists.txt
+@@ -208,7 +208,7 @@ set_target_properties(clang-resource-headers PROPERTIES
+   FOLDER "Misc"
+   RUNTIME_OUTPUT_DIRECTORY "${output_dir}")
+ 
+-set(header_install_dir lib${LLVM_LIBDIR_SUFFIX}/clang/${CLANG_VERSION}/include)
+set(header_install_dir ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/clang/${CLANG_VERSION}/include)
+ 
+ install(
+   FILES ${files} ${generated_files}
+diff --git a/tools/c-index-test/CMakeLists.txt b/tools/c-index-test/CMakeLists.txt
+index ceef4b08637c..8efad5520ca4 100644
+--- a/tools/c-index-test/CMakeLists.txt
+++ b/tools/c-index-test/CMakeLists.txt
+@@ -54,7 +54,7 @@ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+     set_property(TARGET c-index-test APPEND PROPERTY INSTALL_RPATH
+        "@executable_path/../../lib")
+   else()
+-    set(INSTALL_DESTINATION bin)
+    set(INSTALL_DESTINATION ${CMAKE_INSTALL_BINDIR})
+   endif()
+ 
+   install(TARGETS c-index-test
+diff --git a/tools/clang-format/CMakeLists.txt b/tools/clang-format/CMakeLists.txt
+index 35ecdb11253c..d77d75de0094 100644
+--- a/tools/clang-format/CMakeLists.txt
+++ b/tools/clang-format/CMakeLists.txt
+@@ -21,20 +21,20 @@ if( LLVM_LIB_FUZZING_ENGINE OR LLVM_USE_SANITIZE_COVERAGE )
+ endif()
+ 
+ install(PROGRAMS clang-format-bbedit.applescript
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-format)
+ install(PROGRAMS clang-format-diff.py
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-format)
+ install(PROGRAMS clang-format-sublime.py
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-format)
+ install(PROGRAMS clang-format.el
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-format)
+ install(PROGRAMS clang-format.py
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-format)
+ install(PROGRAMS git-clang-format
+-  DESTINATION bin
+  DESTINATION ${CMAKE_INSTALL_BINDIR}
+   COMPONENT clang-format)
+diff --git a/tools/clang-rename/CMakeLists.txt b/tools/clang-rename/CMakeLists.txt
+index cda8e29ec5b1..0134d8ccd70b 100644
+--- a/tools/clang-rename/CMakeLists.txt
+++ b/tools/clang-rename/CMakeLists.txt
+@@ -19,8 +19,8 @@ clang_target_link_libraries(clang-rename
+   )
+ 
+ install(PROGRAMS clang-rename.py
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-rename)
+ install(PROGRAMS clang-rename.el
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-rename)
+diff --git a/tools/libclang/CMakeLists.txt b/tools/libclang/CMakeLists.txt
+index 5cd9ac5cddc1..a197676fedbd 100644
+--- a/tools/libclang/CMakeLists.txt
+++ b/tools/libclang/CMakeLists.txt
+@@ -165,7 +165,7 @@ endif()
+ if(INTERNAL_INSTALL_PREFIX)
+   set(LIBCLANG_HEADERS_INSTALL_DESTINATION "${INTERNAL_INSTALL_PREFIX}/include")
+ else()
+-  set(LIBCLANG_HEADERS_INSTALL_DESTINATION include)
+  set(LIBCLANG_HEADERS_INSTALL_DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
+ endif()
+ 
+ install(DIRECTORY ../../include/clang-c
+@@ -196,7 +196,7 @@ foreach(PythonVersion ${CLANG_PYTHON_BINDINGS_VERSIONS})
+           COMPONENT
+             libclang-python-bindings
+           DESTINATION
+-            "lib${LLVM_LIBDIR_SUFFIX}/python${PythonVersion}/site-packages")
+            "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/python${PythonVersion}/site-packages")
+ endforeach()
+ if(NOT LLVM_ENABLE_IDE)
+   add_custom_target(libclang-python-bindings)
+diff --git a/tools/scan-build/CMakeLists.txt b/tools/scan-build/CMakeLists.txt
+index ec0702d76f18..d25d982f51da 100644
+--- a/tools/scan-build/CMakeLists.txt
+++ b/tools/scan-build/CMakeLists.txt
+@@ -47,7 +47,7 @@ if(CLANG_INSTALL_SCANBUILD)
+                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/bin/${BinFile})
+     list(APPEND Depends ${CMAKE_BINARY_DIR}/bin/${BinFile})
+     install(PROGRAMS bin/${BinFile}
+-            DESTINATION bin
+            DESTINATION ${CMAKE_INSTALL_BINDIR}
+             COMPONENT scan-build)
+   endforeach()
+ 
+@@ -61,7 +61,7 @@ if(CLANG_INSTALL_SCANBUILD)
+                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/libexec/${LibexecFile})
+     list(APPEND Depends ${CMAKE_BINARY_DIR}/libexec/${LibexecFile})
+     install(PROGRAMS libexec/${LibexecFile}
+-            DESTINATION libexec
+            DESTINATION ${CMAKE_INSTALL_LIBEXECDIR}
+             COMPONENT scan-build)
+   endforeach()
+ 
+@@ -89,7 +89,7 @@ if(CLANG_INSTALL_SCANBUILD)
+                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/share/scan-build/${ShareFile})
+     list(APPEND Depends ${CMAKE_BINARY_DIR}/share/scan-build/${ShareFile})
+     install(FILES share/scan-build/${ShareFile}
+-            DESTINATION share/scan-build
+            DESTINATION ${CMAKE_INSTALL_DATADIR}/scan-build
+             COMPONENT scan-build)
+   endforeach()
+ 
+diff --git a/tools/scan-view/CMakeLists.txt b/tools/scan-view/CMakeLists.txt
+index 22edb974bac7..9f140a9a4538 100644
+--- a/tools/scan-view/CMakeLists.txt
+++ b/tools/scan-view/CMakeLists.txt
+@@ -22,7 +22,7 @@ if(CLANG_INSTALL_SCANVIEW)
+                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/bin/${BinFile})
+     list(APPEND Depends ${CMAKE_BINARY_DIR}/bin/${BinFile})
+     install(PROGRAMS bin/${BinFile}
+-            DESTINATION bin
+            DESTINATION ${CMAKE_INSTALL_BINDIR}
+             COMPONENT scan-view)
+   endforeach()
+ 
+@@ -36,7 +36,7 @@ if(CLANG_INSTALL_SCANVIEW)
+                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/share/${ShareFile})
+     list(APPEND Depends ${CMAKE_BINARY_DIR}/share/scan-view/${ShareFile})
+     install(FILES share/${ShareFile}
+-            DESTINATION share/scan-view
+            DESTINATION ${CMAKE_INSTALL_DATADIR}/scan-view
+             COMPONENT scan-view)
+   endforeach()
+ 
+diff --git a/utils/hmaptool/CMakeLists.txt b/utils/hmaptool/CMakeLists.txt
+index 62f2de0cb15c..6aa66825b6ec 100644
+--- a/utils/hmaptool/CMakeLists.txt
+++ b/utils/hmaptool/CMakeLists.txt
+@@ -10,7 +10,7 @@ add_custom_command(OUTPUT ${CMAKE_BINARY_DIR}/${CMAKE_CFG_INTDIR}/bin/${CLANG_HM
+ 
+ list(APPEND Depends ${CMAKE_BINARY_DIR}/${CMAKE_CFG_INTDIR}/bin/${CLANG_HMAPTOOL})
+ install(PROGRAMS ${CLANG_HMAPTOOL}
+-        DESTINATION bin
+        DESTINATION ${CMAKE_INSTALL_BINDIR}
+         COMPONENT hmaptool)
+ 
+ add_custom_target(hmaptool ALL DEPENDS ${Depends})
--- a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
  inherit version;
  src = fetch pname "0x1j8ngf1zj63wlnns9vlibafq48qcm72p4jpaxkmkb4qw0grwfy";

-  nativeBuildInputs = [ cmake python3 llvm ];
+  nativeBuildInputs = [ cmake python3 llvm.dev ];
  buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;

  NIX_CFLAGS_COMPILE = [
@ -24,10 +24,6 @@ stdenv.mkDerivation rec {
    "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
    "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
    "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
-  ] ++ lib.optionals (stdenv.isDarwin) [
-    "-DDARWIN_macosx_OVERRIDE_SDK_VERSION=ON"
-    "-DDARWIN_osx_ARCHS=${stdenv.hostPlatform.darwinArch}"
-    "-DDARWIN_osx_BUILTIN_ARCHS=${stdenv.hostPlatform.darwinArch}"
  ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
    "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
    "-DCOMPILER_RT_BUILD_XRAY=OFF"
@ -45,6 +41,10 @@ stdenv.mkDerivation rec {
    "-DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY"
  ] ++ lib.optionals (bareMetal) [
    "-DCOMPILER_RT_OS_DIR=baremetal"
+  ] ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
+    "-DDARWIN_macosx_OVERRIDE_SDK_VERSION=ON"
+    "-DDARWIN_osx_ARCHS=${stdenv.hostPlatform.darwinArch}"
+    "-DDARWIN_osx_BUILTIN_ARCHS=${stdenv.hostPlatform.darwinArch}"
  ];

  outputs = [ "out" "dev" ];
@ -52,6 +52,10 @@ stdenv.mkDerivation rec {
  patches = [
    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
    ./X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
+    ./gnu-install-dirs.patch
+    # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
+    # extra `/`.
+    ./normalize-var.patch
  ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;

--- a/pkgs/development/compilers/llvm/11/compiler-rt/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/gnu-install-dirs.patch
@ -0,0 +1,129 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index fa62814b635d..6328614d829e 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -12,6 +12,7 @@ endif()
+ # Check if compiler-rt is built as a standalone project.
+ if (CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR OR COMPILER_RT_STANDALONE_BUILD)
+   project(CompilerRT C CXX ASM)
+  include(GNUInstallDirs)
+   set(COMPILER_RT_STANDALONE_BUILD TRUE)
+   set_property(GLOBAL PROPERTY USE_FOLDERS ON)
+ endif()
+diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
+index 7c127a93dfa7..6a95a65b70a7 100644
+--- a/cmake/Modules/AddCompilerRT.cmake
+++ b/cmake/Modules/AddCompilerRT.cmake
+@@ -524,7 +524,7 @@ macro(add_compiler_rt_resource_file target_name file_name component)
+   add_custom_target(${target_name} DEPENDS ${dst_file})
+   # Install in Clang resource directory.
+   install(FILES ${file_name}
+-    DESTINATION ${COMPILER_RT_INSTALL_PATH}/share
+    DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_DATADIR}
+     COMPONENT ${component})
+   add_dependencies(${component} ${target_name})
+ 
+@@ -541,7 +541,7 @@ macro(add_compiler_rt_script name)
+   add_custom_target(${name} DEPENDS ${dst})
+   install(FILES ${dst}
+     PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE
+-    DESTINATION ${COMPILER_RT_INSTALL_PATH}/bin)
+    DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_BINDIR})
+ endmacro(add_compiler_rt_script src name)
+ 
+ # Builds custom version of libc++ and installs it in <prefix>.
+diff --git a/cmake/Modules/CompilerRTDarwinUtils.cmake b/cmake/Modules/CompilerRTDarwinUtils.cmake
+index be8d7e733c7a..ab256bdff26c 100644
+--- a/cmake/Modules/CompilerRTDarwinUtils.cmake
+++ b/cmake/Modules/CompilerRTDarwinUtils.cmake
+@@ -498,7 +498,7 @@ macro(darwin_add_embedded_builtin_libraries)
+     set(DARWIN_macho_embedded_LIBRARY_OUTPUT_DIR
+       ${COMPILER_RT_OUTPUT_DIR}/lib/macho_embedded)
+     set(DARWIN_macho_embedded_LIBRARY_INSTALL_DIR
+-      ${COMPILER_RT_INSTALL_PATH}/lib/macho_embedded)
+      ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_LIBDIR}/macho_embedded)
+       
+     set(CFLAGS_armv7 "-target thumbv7-apple-darwin-eabi")
+     set(CFLAGS_i386 "-march=pentium")
+diff --git a/cmake/Modules/CompilerRTUtils.cmake b/cmake/Modules/CompilerRTUtils.cmake
+index 99b9f0e4af44..c5183ffa746e 100644
+--- a/cmake/Modules/CompilerRTUtils.cmake
+++ b/cmake/Modules/CompilerRTUtils.cmake
+@@ -375,7 +375,7 @@ endfunction()
+ function(get_compiler_rt_install_dir arch install_dir)
+   if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+     get_compiler_rt_target(${arch} target)
+-    set(${install_dir} ${COMPILER_RT_INSTALL_PATH}/lib/${target} PARENT_SCOPE)
+    set(${install_dir} ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_LIBDIR}/${target} PARENT_SCOPE)
+   else()
+     set(${install_dir} ${COMPILER_RT_LIBRARY_INSTALL_DIR} PARENT_SCOPE)
+   endif()
+diff --git a/cmake/base-config-ix.cmake b/cmake/base-config-ix.cmake
+index 964dd598f102..2acaab87d349 100644
+--- a/cmake/base-config-ix.cmake
+++ b/cmake/base-config-ix.cmake
+@@ -66,11 +66,11 @@ if (LLVM_TREE_AVAILABLE)
+ else()
+     # Take output dir and install path from the user.
+   set(COMPILER_RT_OUTPUT_DIR ${CMAKE_CURRENT_BINARY_DIR} CACHE PATH
+-    "Path where built compiler-rt libraries should be stored.")
+    "Path where built compiler-rt build artifacts should be stored.")
+   set(COMPILER_RT_EXEC_OUTPUT_DIR ${CMAKE_CURRENT_BINARY_DIR}/bin CACHE PATH
+     "Path where built compiler-rt executables should be stored.")
+-  set(COMPILER_RT_INSTALL_PATH ${CMAKE_INSTALL_PREFIX} CACHE PATH
+-    "Path where built compiler-rt libraries should be installed.")
+  set(COMPILER_RT_INSTALL_PATH "" CACHE PATH
+    "Prefix where built compiler-rt artifacts should be installed, comes before CMAKE_INSTALL_PREFIX.")
+   option(COMPILER_RT_INCLUDE_TESTS "Generate and build compiler-rt unit tests." OFF)
+   option(COMPILER_RT_ENABLE_WERROR "Fail and stop if warning is triggered" OFF)
+   # Use a host compiler to compile/link tests.
+@@ -98,7 +98,7 @@ else(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR)
+   set(COMPILER_RT_LIBRARY_OUTPUT_DIR
+     ${COMPILER_RT_OUTPUT_DIR}/lib/${COMPILER_RT_OS_DIR})
+   set(COMPILER_RT_LIBRARY_INSTALL_DIR
+-    ${COMPILER_RT_INSTALL_PATH}/lib/${COMPILER_RT_OS_DIR})
+    ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_LIBDIR}/${COMPILER_RT_OS_DIR})
+ endif()
+ 
+ if(APPLE)
+diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt
+index d47d7baeb118..507c8e5c713e 100644
+--- a/include/CMakeLists.txt
+++ b/include/CMakeLists.txt
+@@ -62,22 +62,22 @@ set_target_properties(compiler-rt-headers PROPERTIES FOLDER "Compiler-RT Misc")
+ install(FILES ${SANITIZER_HEADERS}
+   COMPONENT compiler-rt-headers
+   PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
+-  DESTINATION ${COMPILER_RT_INSTALL_PATH}/include/sanitizer)
+  DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_INCLUDEDIR}/sanitizer)
+ # Install fuzzer headers.
+ install(FILES ${FUZZER_HEADERS}
+   COMPONENT compiler-rt-headers
+   PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
+-  DESTINATION ${COMPILER_RT_INSTALL_PATH}/include/fuzzer)
+  DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_INCLUDEDIR}/fuzzer)
+ # Install xray headers.
+ install(FILES ${XRAY_HEADERS}
+   COMPONENT compiler-rt-headers
+   PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
+-  DESTINATION ${COMPILER_RT_INSTALL_PATH}/include/xray)
+  DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_INCLUDEDIR}/xray)
+ # Install profile headers.
+ install(FILES ${PROFILE_HEADERS}
+   COMPONENT compiler-rt-headers
+   PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
+-  DESTINATION ${COMPILER_RT_INSTALL_PATH}/include/profile)
+  DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_INCLUDEDIR}/profile)
+ 
+ if (NOT CMAKE_CONFIGURATION_TYPES) # don't add this for IDEs.
+   add_custom_target(install-compiler-rt-headers
+diff --git a/lib/dfsan/CMakeLists.txt b/lib/dfsan/CMakeLists.txt
+index 051215edbeb7..ecce1f52efb0 100644
+--- a/lib/dfsan/CMakeLists.txt
+++ b/lib/dfsan/CMakeLists.txt
+@@ -56,4 +56,4 @@ add_custom_command(OUTPUT ${dfsan_abilist_filename}
+                    DEPENDS done_abilist.txt libc_ubuntu1404_abilist.txt)
+ add_dependencies(dfsan dfsan_abilist)
+ install(FILES ${dfsan_abilist_filename}
+-        DESTINATION ${COMPILER_RT_INSTALL_PATH}/share)
+        DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_DATADIR})
--- a/pkgs/development/compilers/llvm/11/compiler-rt/normalize-var.patch
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/normalize-var.patch
@ -0,0 +1,16 @@
+diff --git a/compiler-rt/cmake/Modules/CompilerRTUtils.cmake b/compiler-rt/cmake/Modules/CompilerRTUtils.cmake
+index c5183ffa746e..e4e4a007335d 100644
+--- a/cmake/Modules/CompilerRTUtils.cmake
+++ b/cmake/Modules/CompilerRTUtils.cmake
+@@ -299,8 +299,9 @@ macro(load_llvm_config)
+     # Get some LLVM variables from LLVMConfig.
+     include("${LLVM_CMAKE_PATH}/LLVMConfig.cmake")
+ 
+-    set(LLVM_LIBRARY_OUTPUT_INTDIR
+-      ${LLVM_BINARY_DIR}/${CMAKE_CFG_INTDIR}/lib${LLVM_LIBDIR_SUFFIX})
+    get_filename_component(LLVM_LIBRARY_OUTPUT_INTDIR
+      ${LLVM_BINARY_DIR}/${CMAKE_CFG_INTDIR}/lib${LLVM_LIBDIR_SUFFIX}
+      REALPATH)
+   endif()
+ endmacro()
+ 
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@ -1,6 +1,5 @@
 { lowPrio, newScope, pkgs, lib, stdenv, cmake, gccForLibs
 , libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith, wrapBintoolsWith
-, buildPackages
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 }:
@ -20,31 +19,38 @@ let
  clang-tools-extra_src = fetch "clang-tools-extra" "18n1w1hkv931xzq02b34wglbv6zd6sd0r5kb8piwvag7klj7qw3n";

  tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
-    mkExtraBuildCommands = cc: ''
+    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch buildLlvmTools; });
+    mkExtraBuildCommands0 = cc: ''
      rsrc="$out/resource-root"
      mkdir "$rsrc"
-      ln -s "${cc}/lib/clang/${release_version}/include" "$rsrc"
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/share" "$rsrc/share"
+      ln -s "${cc.lib}/lib/clang/${release_version}/include" "$rsrc"
      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
    '';
+    mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
+      ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
+      ln -s "${targetLlvmLibraries.compiler-rt.out}/share" "$rsrc/share"
+    '';
+
  in {

-    llvm = callPackage ./llvm { };
+    libllvm = callPackage ./llvm { };

-    clang-unwrapped = callPackage ./clang {
-      inherit (tools) lld;
+    # `llvm` historically had the binaries.  When choosing an output explicitly,
+    # we need to reintroduce `outputUnspecified` to get the expected behavior e.g. of lib.get*
+    llvm = tools.libllvm.out // { outputUnspecified = true; };
+
+    libclang = callPackage ./clang {
      inherit clang-tools-extra_src;
    };

+    clang-unwrapped = tools.libclang.out // { outputUnspecified = true; };
    # disabled until recommonmark supports sphinx 3
-    #Llvm-manpages = lowPrio (tools.llvm.override {
+    #Llvm-manpages = lowPrio (tools.libllvm.override {
    #  enableManpages = true;
    #  python3 = pkgs.python3;  # don't use python-boot
    #});

-    clang-manpages = lowPrio (tools.clang-unwrapped.override {
+    clang-manpages = lowPrio (tools.libclang.override {
      enableManpages = true;
      python3 = pkgs.python3;  # don't use python-boot
    });
@ -55,8 +61,6 @@ let
    #   python3 = pkgs.python3;  # don't use python-boot
    # });

-    libclang = tools.clang-unwrapped.lib;
-
    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;

    libstdcxxClang = wrapCCWith rec {
@ -146,7 +150,7 @@ let
      '' + mkExtraBuildCommands cc;
    };

-    lldClangNoCompilerRt = wrapCCWith {
+    lldClangNoCompilerRt = wrapCCWith rec {
      cc = tools.clang-unwrapped;
      libcxx = null;
      bintools = wrapBintoolsWith {
@ -156,7 +160,7 @@ let
      extraPackages = [ ];
      extraBuildCommands = ''
        echo "-nostartfiles" >> $out/nix-support/cc-cflags
-      '';
+      '' + mkExtraBuildCommands0 cc;
    };

  });
--- a/pkgs/development/compilers/llvm/11/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/11/libc++/default.nix
@ -15,6 +15,8 @@ stdenv.mkDerivation {
    mv llvm-* llvm
  '';

+  outputs = [ "out" "dev" ];
+
  patches = [
    (fetchpatch {
      # Backported from LLVM 12, avoids clashes with commonly used "block.h" header.
@ -22,6 +24,7 @@ stdenv.mkDerivation {
      sha256 = "sha256-aWa66ogmPkG0xHzSfcpD0qZyZQcNKwLV44js4eiun78=";
      stripLen = 1;
    })
+    ./gnu-install-dirs.patch
  ] ++ lib.optional stdenv.hostPlatform.isMusl ../../libcxx-0001-musl-hacks.patch;

  preConfigure = lib.optionalString stdenv.hostPlatform.isMusl ''
--- a/pkgs/development/compilers/llvm/11/libc++/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/11/libc++/gnu-install-dirs.patch
@ -0,0 +1,100 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 910d04b54b6d..80ef692d83eb 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -31,6 +31,8 @@ set(CMAKE_MODULE_PATH
+ if (CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR OR LIBCXX_STANDALONE_BUILD)
+   project(libcxx CXX C)
+ 
+  include(GNUInstallDirs)
+
+   set(PACKAGE_NAME libcxx)
+   set(PACKAGE_VERSION 11.1.0)
+   set(PACKAGE_STRING "${PACKAGE_NAME} ${PACKAGE_VERSION}")
+@@ -418,7 +420,7 @@ string(REGEX MATCH "[0-9]+\\.[0-9]+(\\.[0-9]+)?" CLANG_VERSION
+ if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+   set(LIBCXX_LIBRARY_DIR ${LLVM_LIBRARY_OUTPUT_INTDIR}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++)
+   set(LIBCXX_HEADER_DIR ${LLVM_BINARY_DIR})
+-  set(LIBCXX_INSTALL_LIBRARY_DIR lib${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++)
+  set(LIBCXX_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++)
+   if(LIBCXX_LIBDIR_SUBDIR)
+     string(APPEND LIBCXX_LIBRARY_DIR /${LIBCXX_LIBDIR_SUBDIR})
+     string(APPEND LIBCXX_INSTALL_LIBRARY_DIR /${LIBCXX_LIBDIR_SUBDIR})
+@@ -426,11 +428,11 @@ if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+ elseif(LLVM_LIBRARY_OUTPUT_INTDIR)
+   set(LIBCXX_LIBRARY_DIR ${LLVM_LIBRARY_OUTPUT_INTDIR})
+   set(LIBCXX_HEADER_DIR  ${LLVM_BINARY_DIR})
+-  set(LIBCXX_INSTALL_LIBRARY_DIR lib${LIBCXX_LIBDIR_SUFFIX})
+  set(LIBCXX_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LIBCXX_LIBDIR_SUFFIX})
+ else()
+   set(LIBCXX_LIBRARY_DIR ${CMAKE_BINARY_DIR}/lib${LIBCXX_LIBDIR_SUFFIX})
+   set(LIBCXX_HEADER_DIR  ${CMAKE_BINARY_DIR})
+-  set(LIBCXX_INSTALL_LIBRARY_DIR lib${LIBCXX_LIBDIR_SUFFIX})
+  set(LIBCXX_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LIBCXX_LIBDIR_SUFFIX})
+ endif()
+ 
+ file(MAKE_DIRECTORY "${LIBCXX_BINARY_INCLUDE_DIR}")
+diff --git a/cmake/Modules/HandleLibCXXABI.cmake b/cmake/Modules/HandleLibCXXABI.cmake
+index c5aa26739e36..8841c4a5252d 100644
+--- a/cmake/Modules/HandleLibCXXABI.cmake
+++ b/cmake/Modules/HandleLibCXXABI.cmake
+@@ -63,7 +63,7 @@ macro(setup_abi_lib abidefines abishared abistatic abifiles abidirs)
+ 
+         if (LIBCXX_INSTALL_HEADERS)
+           install(FILES "${LIBCXX_BINARY_INCLUDE_DIR}/${fpath}"
+-            DESTINATION ${LIBCXX_INSTALL_HEADER_PREFIX}include/c++/v1/${dstdir}
+            DESTINATION ${LIBCXX_INSTALL_HEADER_PREFIX}${CMAKE_INSTALL_INCLUDEDIR}/c++/v1/${dstdir}
+             COMPONENT cxx-headers
+             PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
+             )
+diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt
+index be8141c98166..93847e5758cc 100644
+--- a/include/CMakeLists.txt
+++ b/include/CMakeLists.txt
+@@ -257,7 +257,7 @@ if (LIBCXX_INSTALL_HEADERS)
+   foreach(file ${files})
+     get_filename_component(dir ${file} DIRECTORY)
+     install(FILES ${file}
+-      DESTINATION ${LIBCXX_INSTALL_HEADER_PREFIX}include/c++/v1/${dir}
+      DESTINATION ${LIBCXX_INSTALL_HEADER_PREFIX}${CMAKE_INSTALL_INCLUDEDIR}/c++/v1/${dir}
+       COMPONENT ${CXX_HEADER_TARGET}
+       PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
+     )
+@@ -265,7 +265,7 @@ if (LIBCXX_INSTALL_HEADERS)
+ 
+   # Install the generated header as __config.
+   install(FILES ${LIBCXX_BINARY_DIR}/__generated_config
+-    DESTINATION ${LIBCXX_INSTALL_HEADER_PREFIX}include/c++/v1
+    DESTINATION ${LIBCXX_INSTALL_HEADER_PREFIX}${CMAKE_INSTALL_INCLUDEDIR}/c++/v1
+     PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
+     RENAME __config
+     COMPONENT ${CXX_HEADER_TARGET})
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index 2001c09761d9..5bd11ea6b400 100644
+--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
+@@ -344,21 +344,21 @@ if (LIBCXX_INSTALL_LIBRARY)
+     install(TARGETS cxx_shared
+       ARCHIVE DESTINATION ${LIBCXX_INSTALL_PREFIX}${LIBCXX_INSTALL_LIBRARY_DIR} COMPONENT cxx
+       LIBRARY DESTINATION ${LIBCXX_INSTALL_PREFIX}${LIBCXX_INSTALL_LIBRARY_DIR} COMPONENT cxx
+-      RUNTIME DESTINATION ${LIBCXX_INSTALL_PREFIX}bin COMPONENT cxx)
+      RUNTIME DESTINATION ${LIBCXX_INSTALL_PREFIX}${CMAKE_INSTALL_BINDIR} COMPONENT cxx)
+   endif()
+ 
+   if (LIBCXX_INSTALL_STATIC_LIBRARY)
+     install(TARGETS cxx_static
+       ARCHIVE DESTINATION ${LIBCXX_INSTALL_PREFIX}${LIBCXX_INSTALL_LIBRARY_DIR} COMPONENT cxx
+       LIBRARY DESTINATION ${LIBCXX_INSTALL_PREFIX}${LIBCXX_INSTALL_LIBRARY_DIR} COMPONENT cxx
+-      RUNTIME DESTINATION ${LIBCXX_INSTALL_PREFIX}bin COMPONENT cxx)
+      RUNTIME DESTINATION ${LIBCXX_INSTALL_PREFIX}${CMAKE_INSTALL_BINDIR} COMPONENT cxx)
+   endif()
+ 
+   if(LIBCXX_INSTALL_EXPERIMENTAL_LIBRARY)
+     install(TARGETS cxx_experimental
+       LIBRARY DESTINATION ${LIBCXX_INSTALL_PREFIX}${LIBCXX_INSTALL_LIBRARY_DIR} COMPONENT cxx
+       ARCHIVE DESTINATION ${LIBCXX_INSTALL_PREFIX}${LIBCXX_INSTALL_LIBRARY_DIR} COMPONENT cxx
+-      RUNTIME DESTINATION ${LIBCXX_INSTALL_PREFIX}bin COMPONENT cxx)
+      RUNTIME DESTINATION ${LIBCXX_INSTALL_PREFIX}${CMAKE_INSTALL_BINDIR} COMPONENT cxx)
+   endif()
+ 
+   # NOTE: This install command must go after the cxx install command otherwise
--- a/pkgs/development/compilers/llvm/11/libc++abi/default.nix
+++ b/pkgs/development/compilers/llvm/11/libc++abi/default.nix
@ -8,20 +8,7 @@ stdenv.mkDerivation {

  src = fetch "libcxxabi" "1azcf31mxw59hb1x17xncnm3dyw90ylh8rqx462lvypqh3nr6c8l";

-  nativeBuildInputs = [ cmake ];
-  buildInputs = lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm) libunwind;
-
-  cmakeFlags = lib.optionals (stdenv.hostPlatform.useLLVM or false) [
-    "-DLLVM_ENABLE_LIBCXX=ON"
-    "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
-  ] ++ lib.optionals stdenv.hostPlatform.isWasm [
-    "-DLIBCXXABI_ENABLE_THREADS=OFF"
-    "-DLIBCXXABI_ENABLE_EXCEPTIONS=OFF"
-  ] ++ lib.optionals (!enableShared) [
-    "-DLIBCXXABI_ENABLE_SHARED=OFF"
-  ];
-
-  patches = [ ./no-threads.patch ];
+  outputs = [ "out" "dev" ];

  postUnpack = ''
    unpackFile ${libcxx.src}
@ -36,6 +23,24 @@ stdenv.mkDerivation {
    patch -p1 -d llvm -i ${./wasm.patch}
  '';

+  patches = [
+    ./no-threads.patch
+    ./gnu-install-dirs.patch
+  ];
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm) libunwind;
+
+  cmakeFlags = lib.optionals (stdenv.hostPlatform.useLLVM or false) [
+    "-DLLVM_ENABLE_LIBCXX=ON"
+    "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
+  ] ++ lib.optionals stdenv.hostPlatform.isWasm [
+    "-DLIBCXXABI_ENABLE_THREADS=OFF"
+    "-DLIBCXXABI_ENABLE_EXCEPTIONS=OFF"
+  ] ++ lib.optionals (!enableShared) [
+    "-DLIBCXXABI_ENABLE_SHARED=OFF"
+  ];
+
  installPhase = if stdenv.isDarwin
    then ''
      for file in lib/*.dylib; do
--- a/pkgs/development/compilers/llvm/11/libc++abi/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/11/libc++abi/gnu-install-dirs.patch
@ -0,0 +1,34 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 36c6b2249e2b..a93c13ccaed9 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -24,6 +24,8 @@ set(CMAKE_MODULE_PATH
+ if (CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR OR LIBCXXABI_STANDALONE_BUILD)
+   project(libcxxabi CXX C)
+ 
+  include(GNUInstallDirs)
+
+   set(PACKAGE_NAME libcxxabi)
+   set(PACKAGE_VERSION 11.1.0)
+   set(PACKAGE_STRING "${PACKAGE_NAME} ${PACKAGE_VERSION}")
+@@ -160,17 +162,17 @@ string(REGEX MATCH "[0-9]+\\.[0-9]+(\\.[0-9]+)?" CLANG_VERSION
+ 
+ if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+   set(LIBCXXABI_LIBRARY_DIR ${LLVM_LIBRARY_OUTPUT_INTDIR}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++)
+-  set(LIBCXXABI_INSTALL_LIBRARY_DIR lib${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++)
+  set(LIBCXXABI_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++)
+   if(LIBCXX_LIBDIR_SUBDIR)
+     string(APPEND LIBCXXABI_LIBRARY_DIR /${LIBCXXABI_LIBDIR_SUBDIR})
+     string(APPEND LIBCXXABI_INSTALL_LIBRARY_DIR /${LIBCXXABI_LIBDIR_SUBDIR})
+   endif()
+ elseif(LLVM_LIBRARY_OUTPUT_INTDIR)
+   set(LIBCXXABI_LIBRARY_DIR ${LLVM_LIBRARY_OUTPUT_INTDIR})
+-  set(LIBCXXABI_INSTALL_LIBRARY_DIR lib${LIBCXXABI_LIBDIR_SUFFIX})
+  set(LIBCXXABI_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LIBCXXABI_LIBDIR_SUFFIX})
+ else()
+   set(LIBCXXABI_LIBRARY_DIR ${CMAKE_BINARY_DIR}/lib${LIBCXXABI_LIBDIR_SUFFIX})
+-  set(LIBCXXABI_INSTALL_LIBRARY_DIR lib${LIBCXXABI_LIBDIR_SUFFIX})
+  set(LIBCXXABI_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LIBCXXABI_LIBDIR_SUFFIX})
+ endif()
+ 
+ set(LIBCXXABI_INSTALL_PREFIX "" CACHE STRING "Define libc++abi destination prefix.")
--- a/pkgs/development/compilers/llvm/11/libunwind/default.nix
+++ b/pkgs/development/compilers/llvm/11/libunwind/default.nix
@ -8,6 +8,12 @@ stdenv.mkDerivation rec {

  src = fetch pname "1vpqs2c358v8fbr1r8jmzkfqk12jllimjcfmgxga127ksq9b37nj";

+  patches = [
+    ./gnu-install-dirs.patch
+  ];
+
+  outputs = [ "out" "dev" ];
+
  nativeBuildInputs = [ cmake ];

  cmakeFlags = lib.optional (!enableShared) "-DLIBUNWIND_ENABLE_SHARED=OFF";
--- a/pkgs/development/compilers/llvm/11/libunwind/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/11/libunwind/gnu-install-dirs.patch
@ -0,0 +1,34 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index e44a103648f9..aaf1f9555d7f 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -18,6 +18,8 @@ set(CMAKE_MODULE_PATH
+ if (CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR OR LIBUNWIND_STANDALONE_BUILD)
+   project(libunwind LANGUAGES C CXX ASM)
+ 
+  include(GNUInstallDirs)
+
+   # Rely on llvm-config.
+   set(CONFIG_OUTPUT)
+   if(NOT LLVM_CONFIG_PATH)
+@@ -192,17 +194,17 @@ string(REGEX MATCH "[0-9]+\\.[0-9]+(\\.[0-9]+)?" CLANG_VERSION
+ 
+ if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+   set(LIBUNWIND_LIBRARY_DIR ${LLVM_LIBRARY_OUTPUT_INTDIR}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++)
+-  set(LIBUNWIND_INSTALL_LIBRARY_DIR lib${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++)
+  set(LIBUNWIND_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++)
+   if(LIBCXX_LIBDIR_SUBDIR)
+     string(APPEND LIBUNWIND_LIBRARY_DIR /${LIBUNWIND_LIBDIR_SUBDIR})
+     string(APPEND LIBUNWIND_INSTALL_LIBRARY_DIR /${LIBUNWIND_LIBDIR_SUBDIR})
+   endif()
+ elseif(LLVM_LIBRARY_OUTPUT_INTDIR)
+   set(LIBUNWIND_LIBRARY_DIR ${LLVM_LIBRARY_OUTPUT_INTDIR})
+-  set(LIBUNWIND_INSTALL_LIBRARY_DIR lib${LIBUNWIND_LIBDIR_SUFFIX})
+  set(LIBUNWIND_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LIBUNWIND_LIBDIR_SUFFIX})
+ else()
+   set(LIBUNWIND_LIBRARY_DIR ${CMAKE_BINARY_DIR}/lib${LIBUNWIND_LIBDIR_SUFFIX})
+-  set(LIBUNWIND_INSTALL_LIBRARY_DIR lib${LIBUNWIND_LIBDIR_SUFFIX})
+  set(LIBUNWIND_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LIBUNWIND_LIBDIR_SUFFIX})
+ endif()
+ 
+ set(CMAKE_ARCHIVE_OUTPUT_DIRECTORY ${LIBUNWIND_LIBRARY_DIR})
--- a/Show More
+++ b/Show More