From 061f70f8f76249394cff90019ce36593d42a1bb8 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Thu, 5 Aug 2021 12:00:00 +0000
Subject: [PATCH 01/35] ocaml: fix static compilation on recent versions

---
 pkgs/development/compilers/ocaml/generic.nix | 12 +++++++++++-
 pkgs/top-level/static.nix                    | 15 +--------------
 2 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/compilers/ocaml/generic.nix b/pkgs/development/compilers/ocaml/generic.nix
index 2dd959600eacf..fb1eddc6a6222 100644
--- a/pkgs/development/compilers/ocaml/generic.nix
+++ b/pkgs/development/compilers/ocaml/generic.nix
@@ -56,7 +56,15 @@ stdenv.mkDerivation (args // {
   ++ optional aflSupport (flags "--with-afl" "-afl-instrument")
   ++ optional flambdaSupport (flags "--enable-flambda" "-flambda")
   ++ optional spaceTimeSupport (flags "--enable-spacetime" "-spacetime")
-  ;
+  ++ optional (stdenv.hostPlatform.isStatic && (lib.versionOlder version "4.08")) "-no-shared-libs"
+  ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform && lib.versionOlder version "4.08") [
+    "-host ${stdenv.hostPlatform.config}"
+    "-target ${stdenv.targetPlatform.config}"
+  ];
+  dontAddStaticConfigureFlags = lib.versionOlder version "4.08";
+  configurePlatforms = lib.optionals (lib.versionAtLeast version "4.08") [ "host" "target" ];
+  # x86_64-unknown-linux-musl-ld: -r and -pie may not be used together
+  hardeningDisable = lib.optional (lib.versionAtLeast version "4.09" && stdenv.hostPlatform.isMusl) "pie";
 
   buildFlags = [ "world" ] ++ optionals useNativeCompilers [ "bootstrap" "world.opt" ];
   buildInputs = optional (!lib.versionAtLeast version "4.07") ncurses
@@ -70,6 +78,8 @@ stdenv.mkDerivation (args // {
     # Do what upstream does by default now: https://github.com/ocaml/ocaml/pull/10176
     # This is required for aarch64-darwin, everything else works as is.
     AS="${stdenv.cc}/bin/cc -c" ASPP="${stdenv.cc}/bin/cc -c"
+  '' + optionalString (lib.versionOlder version "4.08" && stdenv.hostPlatform.isStatic) ''
+    configureFlagsArray+=("-cc" "$CC" "-as" "$AS" "-partialld" "$LD -r")
   '';
   postBuild = ''
     mkdir -p $out/include
diff --git a/pkgs/top-level/static.nix b/pkgs/top-level/static.nix
index 73fe6dbc8363a..344ce47fc2ae8 100644
--- a/pkgs/top-level/static.nix
+++ b/pkgs/top-level/static.nix
@@ -61,20 +61,7 @@ self: super: let
       super
     // {
       lablgtk = null; # Currently xlibs cause infinite recursion
-      ocaml = ((super.ocaml.override { useX11 = false; }).overrideAttrs (o: {
-        configurePlatforms = [ ];
-        dontUpdateAutotoolsGnuConfigScripts = true;
-      })).overrideDerivation (o: {
-        preConfigure = ''
-          configureFlagsArray+=("-cc" "$CC" "-as" "$AS" "-partialld" "$LD -r")
-        '';
-        dontAddStaticConfigureFlags = true;
-        configureFlags = [
-          "--no-shared-libs"
-          "-host ${o.stdenv.hostPlatform.config}"
-          "-target ${o.stdenv.targetPlatform.config}"
-        ];
-      });
+      ocaml = super.ocaml.override { useX11 = false; };
     };
 
 in {

From ddd479fe7c2500f4d2582467ba54dee007e43a58 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 7 Aug 2021 12:00:00 +0000
Subject: [PATCH 02/35] ocamlPackages.mkDerivation: use nativeBuildInputs for
 build tools

---
 pkgs/build-support/ocaml/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/ocaml/default.nix b/pkgs/build-support/ocaml/default.nix
index 88ed3dfc2c2f3..cd17eb688c2e4 100644
--- a/pkgs/build-support/ocaml/default.nix
+++ b/pkgs/build-support/ocaml/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, writeText, ocaml, findlib, ocamlbuild, camlp4 }:
 
-{ name, version, buildInputs ? [],
+{ name, version, nativeBuildInputs ? [],
   createFindlibDestdir ?  true,
   dontStrip ? true,
   minimumSupportedOcamlVersion ? null,
@@ -19,7 +19,7 @@ in
 stdenv.mkDerivation (args // {
   name = "ocaml-${name}-${version}";
 
-  buildInputs = [ ocaml findlib ocamlbuild camlp4 ] ++ buildInputs;
+  nativeBuildInputs = [ ocaml findlib ocamlbuild camlp4 ] ++ nativeBuildInputs;
 
   setupHook = if setupHook == null && hasSharedObjects
   then writeText "setupHook.sh" ''

From 856fa067c58fab38c3c5c1d4a03a63548789285a Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 7 Aug 2021 12:00:00 +0000
Subject: [PATCH 03/35] buildDunePackage: use nativeBuildInputs for build tools

---
 pkgs/build-support/ocaml/dune.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/ocaml/dune.nix b/pkgs/build-support/ocaml/dune.nix
index c049878d01311..6c136930d3fe0 100644
--- a/pkgs/build-support/ocaml/dune.nix
+++ b/pkgs/build-support/ocaml/dune.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, ocaml, findlib, dune_1, dune_2 }:
 
-{ pname, version, buildInputs ? [], enableParallelBuilding ? true, ... }@args:
+{ pname, version, nativeBuildInputs ? [], enableParallelBuilding ? true, ... }@args:
 
 let Dune = if args.useDune2 or false then dune_2 else dune_1; in
 
@@ -33,7 +33,7 @@ stdenv.mkDerivation ({
 
   name = "ocaml${ocaml.version}-${pname}-${version}";
 
-  buildInputs = [ ocaml Dune findlib ] ++ buildInputs;
+  nativeBuildInputs = [ ocaml Dune findlib ] ++ nativeBuildInputs;
 
   meta = (args.meta or {}) // { platforms = args.meta.platforms or ocaml.meta.platforms; };
 

From 37962fc5fb3c7cd39b18448b28ecc8d259062db5 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 7 Aug 2021 12:00:00 +0000
Subject: [PATCH 04/35] python27: fix static build

---
 .../interpreters/python/cpython/2.7/default.nix            | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index ad2b7fe686056..108dfc5514b6b 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -26,8 +26,8 @@
 , sourceVersion
 , sha256
 , passthruFun
-, static ? false
-, stripBytecode ? true
+, static ? stdenv.hostPlatform.isStatic
+, stripBytecode ? reproducibleBuild
 , rebuildBytecode ? true
 , reproducibleBuild ? false
 , enableOptimizations ? false
@@ -187,8 +187,9 @@ let
 
   configureFlags = optionals enableOptimizations [
     "--enable-optimizations"
-  ] ++ [
+  ] ++ optionals (!static) [
     "--enable-shared"
+  ] ++ [
     "--with-threads"
     "--enable-unicode=ucs${toString ucsEncoding}"
   ] ++ optionals (stdenv.hostPlatform.isCygwin || stdenv.hostPlatform.isAarch64) [

From 36acee382058fcdc0a7dd69c633357457f022f36 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 7 Aug 2021 12:00:00 +0000
Subject: [PATCH 05/35] python3: fix static build

---
 pkgs/development/interpreters/python/cpython/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 76a66a648d847..cb273155a58fc 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -287,10 +287,11 @@ in with passthru; stdenv.mkDerivation {
   PYTHONHASHSEED=0;
 
   configureFlags = [
-    "--enable-shared"
     "--without-ensurepip"
     "--with-system-expat"
     "--with-system-ffi"
+  ] ++ optionals (!static) [
+    "--enable-shared"
   ] ++ optionals enableOptimizations [
     "--enable-optimizations"
   ] ++ optionals enableLTO [

From a9e262063072f4220414868ce4a4812e6676e374 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 7 Aug 2021 12:00:00 +0000
Subject: [PATCH 06/35] libbfd: fix static build

---
 pkgs/development/libraries/libbfd/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libbfd/default.nix b/pkgs/development/libraries/libbfd/default.nix
index 499f04349b5de..154e604e49765 100644
--- a/pkgs/development/libraries/libbfd/default.nix
+++ b/pkgs/development/libraries/libbfd/default.nix
@@ -37,9 +37,8 @@ stdenv.mkDerivation {
   configureFlags = [
     "--enable-targets=all" "--enable-64-bit-bfd"
     "--enable-install-libbfd"
-    "--enable-shared"
     "--with-system-zlib"
-  ];
+  ] ++ lib.optional (!stdenv.hostPlatform.isStatic) "--enable-shared";
 
   enableParallelBuilding = true;
 

From 652f7fafd2f06605bd82eb06f0eab7e0608abfb8 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 7 Aug 2021 12:00:00 +0000
Subject: [PATCH 07/35] libxml2: fix static build

---
 pkgs/development/libraries/libxml2/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 1b58b4539e465..9a8cea6955d92 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -2,7 +2,7 @@
 , zlib, xz, libintl, python, gettext, ncurses, findXMLCatalogs
 , pythonSupport ? enableShared && stdenv.buildPlatform == stdenv.hostPlatform
 , icuSupport ? false, icu ? null
-, enableShared ? stdenv.hostPlatform.libc != "msvcrt"
+, enableShared ? stdenv.hostPlatform.libc != "msvcrt" && !stdenv.hostPlatform.isStatic
 , enableStatic ? !enableShared
 }:
 

From 2d4dd130c2c46c14af96a7aeb8185a776a25e74c Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 7 Aug 2021 12:00:00 +0000
Subject: [PATCH 08/35] lzo: fix static build

---
 pkgs/development/libraries/lzo/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/lzo/default.nix b/pkgs/development/libraries/lzo/default.nix
index f5b0111a1a780..ad1c5d2c21e06 100644
--- a/pkgs/development/libraries/lzo/default.nix
+++ b/pkgs/development/libraries/lzo/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0wm04519pd3g8hqpjqhfr72q8qmbiwqaxcs3cndny9h86aa95y60";
   };
 
-  configureFlags = [ "--enable-shared" ];
+  configureFlags = lib.optional (!stdenv.hostPlatform.isStatic) "--enable-shared" ;
 
   enableParallelBuilding = true;
 

From cd97a3d62e61a72eae56cf62b5933d9ecd45692d Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 7 Aug 2021 12:00:00 +0000
Subject: [PATCH 09/35] curl: fix static build by disabling gssSupport

---
 pkgs/tools/networking/curl/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 984a6ecaaef8b..d14b1156670f1 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -7,7 +7,7 @@
 , gnutlsSupport ? false, gnutls ? null
 , wolfsslSupport ? false, wolfssl ? null
 , scpSupport ? zlibSupport && !stdenv.isSunOS && !stdenv.isCygwin, libssh2 ? null
-, gssSupport ? with stdenv.hostPlatform; !(
+, gssSupport ? with stdenv.hostPlatform; (
     !isWindows &&
     # a very sad story re static: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=439039
     !isStatic &&

From a2c566265e5a0d1b414b1115ac6d7320296e3958 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Wed, 11 Aug 2021 12:00:00 +0000
Subject: [PATCH 10/35] ocaml: add strictDeps = true

---
 pkgs/development/compilers/ocaml/generic.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/compilers/ocaml/generic.nix b/pkgs/development/compilers/ocaml/generic.nix
index fb1eddc6a6222..0f4f428c51f2a 100644
--- a/pkgs/development/compilers/ocaml/generic.nix
+++ b/pkgs/development/compilers/ocaml/generic.nix
@@ -44,6 +44,8 @@ stdenv.mkDerivation (args // {
 
   inherit src;
 
+  strictDeps = true;
+
   prefixKey = "-prefix ";
   configureFlags =
     let flags = new: old:

From 79b32fc42239cb0c24baec8fbf7b2cebf83e3e62 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Wed, 11 Aug 2021 12:00:00 +0000
Subject: [PATCH 11/35] python27: use strictDeps = true;

---
 pkgs/development/interpreters/python/cpython/2.7/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 108dfc5514b6b..fd7e684113e71 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -227,6 +227,7 @@ let
   ++ optional stdenv.hostPlatform.isLinux "ac_cv_func_lchmod=no"
   ++ optional static "LDFLAGS=-static";
 
+  strictDeps = true;
   buildInputs =
     optional (stdenv ? cc && stdenv.cc.libc != null) stdenv.cc.libc ++
     [ bzip2 openssl zlib ]

From b1b230596f0fa29c4cf2432a2f8dbeed524c497c Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Wed, 11 Aug 2021 12:00:00 +0000
Subject: [PATCH 12/35] libbfd: add strictDeps = true

---
 pkgs/development/libraries/libbfd/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/libraries/libbfd/default.nix b/pkgs/development/libraries/libbfd/default.nix
index 154e604e49765..1e2938d3a8e0e 100644
--- a/pkgs/development/libraries/libbfd/default.nix
+++ b/pkgs/development/libraries/libbfd/default.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation {
   # We update these ourselves
   dontUpdateAutotoolsGnuConfigScripts = true;
 
+  strictDeps = true;
   nativeBuildInputs = [ autoreconfHook bison ];
   buildInputs = [ libiberty zlib.dev ];
 

From bf74dfbc54b6c25397d1094a07c1e5a5a3d4d645 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Wed, 11 Aug 2021 12:00:00 +0000
Subject: [PATCH 13/35] libxml2: add strictDeps = true

---
 pkgs/development/libraries/libxml2/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 9a8cea6955d92..c98a1cbce0e9f 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -40,6 +40,8 @@ stdenv.mkDerivation rec {
     ++ lib.optional pythonSupport "py"
     ++ lib.optional (enableStatic && enableShared) "static";
 
+  strictDeps = true;
+
   buildInputs = lib.optional pythonSupport python
     ++ lib.optional (pythonSupport && python?isPy2 && python.isPy2) gettext
     ++ lib.optional (pythonSupport && python?isPy3 && python.isPy3) ncurses

From 842c163b4f1469a6a70325f475c9681dea873c0f Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Wed, 11 Aug 2021 12:00:00 +0000
Subject: [PATCH 14/35] lzo: add strictDeps = true;

---
 pkgs/development/libraries/lzo/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/lzo/default.nix b/pkgs/development/libraries/lzo/default.nix
index ad1c5d2c21e06..480e2bb909cd3 100644
--- a/pkgs/development/libraries/lzo/default.nix
+++ b/pkgs/development/libraries/lzo/default.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
 
   doCheck = true; # not cross;
 
+  strictDeps = true;
+
   meta = with lib; {
     description = "Real-time data (de)compression library";
     longDescription = ''

From 73dee3ad4efc9429f611403b75c7f582d90d0e4d Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Wed, 11 Aug 2021 12:00:00 +0000
Subject: [PATCH 15/35] python3: add strictDeps = true

---
 pkgs/development/interpreters/python/cpython/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index cb273155a58fc..8e340dd3b1469 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -101,6 +101,8 @@ let
 
   version = with sourceVersion; "${major}.${minor}.${patch}${suffix}";
 
+  strictDeps = true;
+
   nativeBuildInputs = optionals (!stdenv.isDarwin) [
     autoreconfHook
   ] ++ optionals (!stdenv.isDarwin && passthru.pythonAtLeast "3.10") [

From 81d185ad5de88f1eb2027024654b77a727866407 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Wed, 11 Aug 2021 12:00:00 +0000
Subject: [PATCH 16/35] curl: add strictDeps = true

---
 pkgs/tools/networking/curl/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index d14b1156670f1..4fd754a3a6c73 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -63,6 +63,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  strictDeps = true;
+
   nativeBuildInputs = [ pkg-config perl ];
 
   # Zlib and OpenSSL must be propagated because `libcurl.la' contains

From c47609456e9ea6b73b1e602e7739767689f4163a Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 14 Aug 2021 12:00:00 +0000
Subject: [PATCH 17/35] pkgStatics.ocaml-ng: fix eval when there are no
 buildInputs

---
 pkgs/top-level/static.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/static.nix b/pkgs/top-level/static.nix
index 344ce47fc2ae8..da66cbfbe2c3c 100644
--- a/pkgs/top-level/static.nix
+++ b/pkgs/top-level/static.nix
@@ -51,7 +51,7 @@ self: super: let
     b.overrideAttrs (o: {
       configurePlatforms = [ ];
       dontAddStaticConfigureFlags = true;
-      buildInputs = o.buildInputs ++ o.nativeBuildInputs or [ ];
+      buildInputs = (o.buildInputs or [ ]) ++ o.nativeBuildInputs or [ ];
       propagatedNativeBuildInputs = o.propagatedBuildInputs or [ ];
     });
 

From e6f82a9ec108a22faa9f95576f756ec865102139 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 14 Aug 2021 12:00:00 +0000
Subject: [PATCH 18/35] ocamlPackages.easy-format: fix nativeBuildInputs vs
 buildInputs

---
 pkgs/development/ocaml-modules/easy-format/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/ocaml-modules/easy-format/default.nix b/pkgs/development/ocaml-modules/easy-format/default.nix
index 6a3566fda2b61..161e263e129b1 100644
--- a/pkgs/development/ocaml-modules/easy-format/default.nix
+++ b/pkgs/development/ocaml-modules/easy-format/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation {
     sha256 = "00ga7mrlycjc99gzp3bgx6iwhf7i6j8856f8xzrf1yas7zwzgzm9";
   };
 
-  buildInputs = [ ocaml findlib ];
+  nativeBuildInputs = [ ocaml findlib ];
+  strictDeps = true;
 
   createFindlibDestdir = true;
 

From 2c35af220559ee4bae7339d55cd25f87de5f835a Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 14 Aug 2021 12:00:00 +0000
Subject: [PATCH 19/35] dune: fix buildInputs vs nativeBuildInputs

---
 pkgs/development/tools/ocaml/dune/1.nix | 3 ++-
 pkgs/development/tools/ocaml/dune/2.nix | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/ocaml/dune/1.nix b/pkgs/development/tools/ocaml/dune/1.nix
index ad908787911b8..1c74980eb9519 100644
--- a/pkgs/development/tools/ocaml/dune/1.nix
+++ b/pkgs/development/tools/ocaml/dune/1.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "1rkc8lqw30ifjaz8d81la6i8j05ffd0whpxqsbg6dci16945zjvp";
   };
 
-  buildInputs = [ ocaml findlib ];
+  nativeBuildInputs = [ ocaml findlib ];
+  strictDeps = true;
 
   buildFlags = [ "release" ];
   makeFlags = [
diff --git a/pkgs/development/tools/ocaml/dune/2.nix b/pkgs/development/tools/ocaml/dune/2.nix
index 3945389e8cd11..4dadba4e62e30 100644
--- a/pkgs/development/tools/ocaml/dune/2.nix
+++ b/pkgs/development/tools/ocaml/dune/2.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "07m476kgagpd6kzm3jq30yfxqspr2hychah0xfqs14z82zxpq8dv";
   };
 
-  buildInputs = [ ocaml findlib ];
+  nativeBuildInputs = [ ocaml findlib ];
+  strictDeps = true;
 
   buildFlags = "release";
 

From 4c0020beabe366f5477935a6aed633a407425d08 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 14 Aug 2021 12:00:00 +0000
Subject: [PATCH 20/35] ocamlPackages.findlib: fix buildInputs vs
 nativeBuildInputs

---
 pkgs/development/tools/ocaml/findlib/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/tools/ocaml/findlib/default.nix b/pkgs/development/tools/ocaml/findlib/default.nix
index 2286c0945fcf0..86685493d4c65 100644
--- a/pkgs/development/tools/ocaml/findlib/default.nix
+++ b/pkgs/development/tools/ocaml/findlib/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-K0K4vVRIjWTEvzy3BUtLN70wwdwSvUMeoeTXrYqYD+I=";
   };
 
-  buildInputs = [m4 ncurses ocaml];
+  nativeBuildInputs = [m4 ocaml];
+  buildInputs = [ ncurses ];
 
   patches = [ ./ldconf.patch ./install_topfind.patch ];
 

From fc3806b422edc0ec6709b1719c875941360f47cb Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 14 Aug 2021 12:00:00 +0000
Subject: [PATCH 21/35] ocamlPackages.gen: fix cross

---
 pkgs/development/ocaml-modules/gen/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/ocaml-modules/gen/default.nix b/pkgs/development/ocaml-modules/gen/default.nix
index 04d1a08166062..77fc0b63c55ed 100644
--- a/pkgs/development/ocaml-modules/gen/default.nix
+++ b/pkgs/development/ocaml-modules/gen/default.nix
@@ -12,7 +12,9 @@ stdenv.mkDerivation {
     sha256 = "14b8vg914nb0yp1hgxzm29bg692m0gqncjj43b599s98s1cwl92h";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild qtest ounit ];
+  nativeBuildInputs = [ ocaml findlib ocamlbuild ];
+  buildInputs = [ qtest ounit ];
+  strictDeps = true;
 
   configureFlags = [
     "--enable-tests"

From 0631aa0cb302f5e953f2bdbc0326c22ca2d62799 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 14 Aug 2021 12:00:00 +0000
Subject: [PATCH 22/35] ocamlPackages.process: fix static cross

---
 pkgs/development/ocaml-modules/process/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/ocaml-modules/process/default.nix b/pkgs/development/ocaml-modules/process/default.nix
index 34ca51f073926..aecf03987ab16 100644
--- a/pkgs/development/ocaml-modules/process/default.nix
+++ b/pkgs/development/ocaml-modules/process/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0m1ldah5r9gcq09d9jh8lhvr77910dygx5m309k1jm60ah9mdcab";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild ];
+  nativeBuildInputs = [ ocaml findlib ocamlbuild ];
+  strictDeps = true;
 
   createFindlibDestdir = true;
 

From 0b134b0a9c0f8f12e4dbeca790e2bb8408ec2196 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 14 Aug 2021 12:00:00 +0000
Subject: [PATCH 23/35] ocamlPackages.seq: fix static cross

---
 pkgs/development/ocaml-modules/seq/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/ocaml-modules/seq/default.nix b/pkgs/development/ocaml-modules/seq/default.nix
index aa0546dd390be..44503668ff0ad 100644
--- a/pkgs/development/ocaml-modules/seq/default.nix
+++ b/pkgs/development/ocaml-modules/seq/default.nix
@@ -20,7 +20,8 @@ stdenv.mkDerivation ({
     sha256 = "1cjpsc7q76yfgq9iyvswxgic4kfq2vcqdlmxjdjgd4lx87zvcwrv";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild ];
+  nativeBuildInputs = [ ocaml findlib ocamlbuild ];
+  strictDeps = true;
 
   createFindlibDestdir = true;
 

From dd8a67479603f826c33d85a7fc45db1d59e27516 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 14 Aug 2021 12:00:00 +0000
Subject: [PATCH 24/35] ocamlPackages.wasm: fix static cross

---
 pkgs/development/ocaml-modules/wasm/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/ocaml-modules/wasm/default.nix b/pkgs/development/ocaml-modules/wasm/default.nix
index c89449264889d..4befff2721b97 100644
--- a/pkgs/development/ocaml-modules/wasm/default.nix
+++ b/pkgs/development/ocaml-modules/wasm/default.nix
@@ -15,7 +15,11 @@ stdenv.mkDerivation rec {
     sha256 = "1kp72yv4k176i94np0m09g10cviqp2pnpm7jmiq6ik7fmmbknk7c";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild ];
+  nativeBuildInputs = [ ocaml findlib ocamlbuild ];
+  strictDeps = true;
+
+  # x86_64-unknown-linux-musl-ld: -r and -pie may not be used together
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
   makeFlags = [ "-C" "interpreter" ];
 

From a99983b48baa81a32ab1d7686e10cf9fe71474fa Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 14 Aug 2021 12:00:00 +0000
Subject: [PATCH 25/35] ocamlPackages.zarith: fix static cross

---
 pkgs/development/ocaml-modules/zarith/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ocaml-modules/zarith/default.nix b/pkgs/development/ocaml-modules/zarith/default.nix
index eed6b158d4a6f..12523b7bc7d1f 100644
--- a/pkgs/development/ocaml-modules/zarith/default.nix
+++ b/pkgs/development/ocaml-modules/zarith/default.nix
@@ -17,9 +17,9 @@ stdenv.mkDerivation rec {
     sha256 = "1jslm1rv1j0ya818yh23wf3bb6hz7qqj9pn5fwl45y9mqyqa01s9";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ ocaml findlib ];
+  nativeBuildInputs = [ pkg-config ocaml findlib ];
   propagatedBuildInputs = [ gmp ];
+  strictDeps = true;
 
   dontAddPrefix = true;
   configureFlags = [ "-installdir ${placeholder "out"}/lib/ocaml/${ocaml.version}/site-lib" ];

From e98be5d5e09cd1c43789cba9d681cf0799d2e957 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 14 Aug 2021 12:00:00 +0000
Subject: [PATCH 26/35] ocamlPackages.findlib: refactor

---
 .../tools/ocaml/findlib/default.nix           | 21 +++++++------------
 1 file changed, 8 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/tools/ocaml/findlib/default.nix b/pkgs/development/tools/ocaml/findlib/default.nix
index 86685493d4c65..3d4c919bd8357 100644
--- a/pkgs/development/tools/ocaml/findlib/default.nix
+++ b/pkgs/development/tools/ocaml/findlib/default.nix
@@ -16,19 +16,14 @@ stdenv.mkDerivation rec {
 
   dontAddPrefix=true;
 
-  preConfigure=''
-    configureFlagsArray=(
-      -bindir $out/bin
-      -mandir $out/share/man
-      -sitelib $out/lib/ocaml/${ocaml.version}/site-lib
-      -config $out/etc/findlib.conf
-    )
-  '';
-
-  buildPhase = ''
-    make all
-    make opt
-  '';
+  configureFlags = [
+      "-bindir" "${placeholder "out"}/bin"
+      "-mandir" "${placeholder "out"}/share/man"
+      "-sitelib" "${placeholder "out"}/lib/ocaml/${ocaml.version}/site-lib"
+      "-config" "${placeholder "out"}/etc/findlib.conf"
+  ];
+
+  buildFlags = [ "all" "opt" ];
 
   setupHook = writeText "setupHook.sh" ''
     addOCamlPath () {

From a3ab43d3a45338f845a0f8a12ed34e84c8b79dae Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 14 Aug 2021 12:00:00 +0000
Subject: [PATCH 27/35] ocamlPackages.findlib: create destdir even when there
 are no buildInputs

---
 pkgs/development/tools/ocaml/findlib/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/tools/ocaml/findlib/default.nix b/pkgs/development/tools/ocaml/findlib/default.nix
index 3d4c919bd8357..4b02231b471fa 100644
--- a/pkgs/development/tools/ocaml/findlib/default.nix
+++ b/pkgs/development/tools/ocaml/findlib/default.nix
@@ -33,6 +33,8 @@ stdenv.mkDerivation rec {
         if test -d "''$1/lib/ocaml/${ocaml.version}/site-lib/stublibs"; then
             export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH-}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/stublibs"
         fi
+    }
+    createOcamlDestDir () {
         export OCAMLFIND_DESTDIR="''$out/lib/ocaml/${ocaml.version}/site-lib/"
         if test -n "''${createFindlibDestdir-}"; then
           mkdir -p $OCAMLFIND_DESTDIR
@@ -40,6 +42,7 @@ stdenv.mkDerivation rec {
     }
 
     addEnvHooks "$targetOffset" addOCamlPath
+    preConfigureHooks+=(createOcamlDestDir)
   '';
 
   meta = {

From ce31d529bccc12b28621f98d5d8875737946687a Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 14 Aug 2021 12:00:00 +0000
Subject: [PATCH 28/35] ocamlbuild: fix static cross

---
 pkgs/development/tools/ocaml/ocamlbuild/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/tools/ocaml/ocamlbuild/default.nix b/pkgs/development/tools/ocaml/ocamlbuild/default.nix
index 926838ede5456..d4c7cfcac164d 100644
--- a/pkgs/development/tools/ocaml/ocamlbuild/default.nix
+++ b/pkgs/development/tools/ocaml/ocamlbuild/default.nix
@@ -12,7 +12,11 @@ stdenv.mkDerivation rec {
 
   createFindlibDestdir = true;
 
-  buildInputs = [ ocaml findlib ];
+  nativeBuildInputs = [ ocaml findlib ];
+  strictDeps = true;
+
+  # x86_64-unknown-linux-musl-ld: -r and -pie may not be used together
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
   configurePhase = ''
   make -f configure.make Makefile.config \

From fd60747cbded525bcc57e5f641a559d7ac6957bd Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 14 Aug 2021 12:00:00 +0000
Subject: [PATCH 29/35] ocamlPackages.syslog: fix static cross

---
 pkgs/development/ocaml-modules/syslog/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/ocaml-modules/syslog/default.nix b/pkgs/development/ocaml-modules/syslog/default.nix
index c97f1225663ed..9614c404c5b91 100644
--- a/pkgs/development/ocaml-modules/syslog/default.nix
+++ b/pkgs/development/ocaml-modules/syslog/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "1kqpc55ppzv9n555qgqpda49n7nvkqimzisyjx2a7338r7q4r5bw";
   };
 
-  buildInputs = [ ocaml findlib ];
+  nativeBuildInputs = [ ocaml findlib ];
+  strictDeps = true;
 
   buildFlags = [ "all" "opt" ];
 

From 9ae5ae736ae34a95785deec309e10ec29875d1cc Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 14 Aug 2021 12:00:00 +0000
Subject: [PATCH 30/35] opaline: fix static build

---
 pkgs/development/tools/ocaml/opaline/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/tools/ocaml/opaline/default.nix b/pkgs/development/tools/ocaml/opaline/default.nix
index 9cdacd289d493..d9ba33bb473e6 100644
--- a/pkgs/development/tools/ocaml/opaline/default.nix
+++ b/pkgs/development/tools/ocaml/opaline/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1aj1fdqymq3pnr39h47hn3kxk5v9pnwx0jap1z2jzh78x970z21m";
   };
 
-  buildInputs = with ocamlPackages; [ ocaml findlib ocamlbuild opam-file-format ];
+  nativeBuildInputs = with ocamlPackages; [ ocaml findlib ocamlbuild ];
+  buildInputs = with ocamlPackages; [ opam-file-format ];
 
   preInstall = "mkdir -p $out/bin";
 

From 6506d2ae4ddc7370c118f124f24d2db9932b8ce2 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 14 Aug 2021 12:00:00 +0000
Subject: [PATCH 31/35] pkgsStatic.ocaml: migrate some logic from static
 adapter to ocaml

---
 pkgs/development/compilers/ocaml/generic.nix | 4 ++--
 pkgs/top-level/static.nix                    | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/ocaml/generic.nix b/pkgs/development/compilers/ocaml/generic.nix
index 0f4f428c51f2a..e4cec4cf52ed0 100644
--- a/pkgs/development/compilers/ocaml/generic.nix
+++ b/pkgs/development/compilers/ocaml/generic.nix
@@ -3,7 +3,7 @@
 let
   versionNoPatch = "${toString major_version}.${toString minor_version}";
   version = "${versionNoPatch}.${toString patch_version}";
-  safeX11 = stdenv: !(stdenv.isAarch32 || stdenv.isMips);
+  safeX11 = stdenv: !(stdenv.isAarch32 || stdenv.isMips || stdenv.hostPlatform.isStatic);
 in
 
 { lib, stdenv, fetchurl, ncurses, buildEnv, libunwind
@@ -13,7 +13,7 @@ in
 , spaceTimeSupport ? false
 }:
 
-assert useX11 -> !stdenv.isAarch32 && !stdenv.isMips;
+assert useX11 -> safeX11 stdenv;
 assert aflSupport -> lib.versionAtLeast version "4.05";
 assert flambdaSupport -> lib.versionAtLeast version "4.03";
 assert spaceTimeSupport -> lib.versionAtLeast version "4.04";
diff --git a/pkgs/top-level/static.nix b/pkgs/top-level/static.nix
index da66cbfbe2c3c..39923b0f59a75 100644
--- a/pkgs/top-level/static.nix
+++ b/pkgs/top-level/static.nix
@@ -61,7 +61,7 @@ self: super: let
       super
     // {
       lablgtk = null; # Currently xlibs cause infinite recursion
-      ocaml = super.ocaml.override { useX11 = false; };
+      ocaml = super.ocaml;
     };
 
 in {

From 41e07ee477012daa36857027695a377046ba3369 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 14 Aug 2021 12:00:00 +0000
Subject: [PATCH 32/35] pkgsStatic.ocaml-ng: migrate more logic to derivations

---
 pkgs/development/tools/ocaml/dune/1.nix | 3 ++-
 pkgs/top-level/static.nix               | 2 --
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/ocaml/dune/1.nix b/pkgs/development/tools/ocaml/dune/1.nix
index 1c74980eb9519..79707a3c0090b 100644
--- a/pkgs/development/tools/ocaml/dune/1.nix
+++ b/pkgs/development/tools/ocaml/dune/1.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, ocaml, findlib }:
+{ stdenv, lib, fetchurl, ocaml, findlib, ncurses }:
 
 if !lib.versionAtLeast ocaml.version "4.02"
 || lib.versionAtLeast ocaml.version "4.12"
@@ -14,6 +14,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ ocaml findlib ];
+  buildInputs = [ ncurses ];
   strictDeps = true;
 
   buildFlags = [ "release" ];
diff --git a/pkgs/top-level/static.nix b/pkgs/top-level/static.nix
index 39923b0f59a75..2ca24175cfa07 100644
--- a/pkgs/top-level/static.nix
+++ b/pkgs/top-level/static.nix
@@ -51,8 +51,6 @@ self: super: let
     b.overrideAttrs (o: {
       configurePlatforms = [ ];
       dontAddStaticConfigureFlags = true;
-      buildInputs = (o.buildInputs or [ ]) ++ o.nativeBuildInputs or [ ];
-      propagatedNativeBuildInputs = o.propagatedBuildInputs or [ ];
     });
 
   ocamlStaticAdapter = _: super:

From a17fc0337522b002166730d94e32f3b1517e0817 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 14 Aug 2021 12:00:00 +0000
Subject: [PATCH 33/35] pkgsStatic.ocaml-ng: migrate static adapter to
 derivations themselves

---
 pkgs/build-support/ocaml/dune.nix             |  2 ++
 .../ocaml-modules/bolt/default.nix            |  2 ++
 .../ocaml-modules/hacl-star/raw.nix           |  2 ++
 .../janestreet/buildOcamlJane.nix             |  2 ++
 .../janestreet/js-build-tools.nix             |  2 ++
 .../ocaml-modules/javalib/default.nix         |  2 ++
 .../ocaml-modules/labltk/default.nix          |  2 ++
 .../ocaml-modules/ocamlnet/default.nix        |  2 ++
 .../ocaml-modules/ocsigen-server/default.nix  |  2 ++
 .../ocaml-modules/sawja/default.nix           |  2 ++
 .../ocaml-modules/zarith/default.nix          |  2 ++
 pkgs/development/tools/ocaml/dune/1.nix       |  2 ++
 pkgs/development/tools/ocaml/dune/2.nix       |  2 ++
 .../tools/ocaml/findlib/default.nix           |  2 ++
 pkgs/top-level/static.nix                     | 20 -------------------
 15 files changed, 28 insertions(+), 20 deletions(-)

diff --git a/pkgs/build-support/ocaml/dune.nix b/pkgs/build-support/ocaml/dune.nix
index 6c136930d3fe0..6bdec501630e9 100644
--- a/pkgs/build-support/ocaml/dune.nix
+++ b/pkgs/build-support/ocaml/dune.nix
@@ -12,6 +12,8 @@ else
 stdenv.mkDerivation ({
 
   inherit enableParallelBuilding;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/development/ocaml-modules/bolt/default.nix b/pkgs/development/ocaml-modules/bolt/default.nix
index 54bc28697ec47..ea32d659f6465 100644
--- a/pkgs/development/ocaml-modules/bolt/default.nix
+++ b/pkgs/development/ocaml-modules/bolt/default.nix
@@ -42,6 +42,8 @@ EOF
   # The custom `configure` script does not expect the --prefix
   # option. Installation is handled by ocamlfind.
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   createFindlibDestdir = true;
 
diff --git a/pkgs/development/ocaml-modules/hacl-star/raw.nix b/pkgs/development/ocaml-modules/hacl-star/raw.nix
index cd1217b97101a..aa787c9a91a07 100644
--- a/pkgs/development/ocaml-modules/hacl-star/raw.nix
+++ b/pkgs/development/ocaml-modules/hacl-star/raw.nix
@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
   installTargets = "install-hacl-star-raw";
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   buildInputs = [
     which
diff --git a/pkgs/development/ocaml-modules/janestreet/buildOcamlJane.nix b/pkgs/development/ocaml-modules/janestreet/buildOcamlJane.nix
index fdb0d8034e690..62876e5eaf948 100644
--- a/pkgs/development/ocaml-modules/janestreet/buildOcamlJane.nix
+++ b/pkgs/development/ocaml-modules/janestreet/buildOcamlJane.nix
@@ -17,6 +17,8 @@ buildOcaml (args // {
   buildInputs = [ ocaml_oasis js_build_tools opaline ] ++ buildInputs;
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   configurePhase = "./configure --prefix $out";
 
diff --git a/pkgs/development/ocaml-modules/janestreet/js-build-tools.nix b/pkgs/development/ocaml-modules/janestreet/js-build-tools.nix
index ff03c209190d7..2f68ee8230e77 100644
--- a/pkgs/development/ocaml-modules/janestreet/js-build-tools.nix
+++ b/pkgs/development/ocaml-modules/janestreet/js-build-tools.nix
@@ -16,6 +16,8 @@ buildOcaml rec {
   buildInputs = [ ocaml_oasis opaline ];
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
   configurePhase = "./configure --prefix $prefix";
   installPhase = "opaline -prefix $prefix -libdir $OCAMLFIND_DESTDIR ${name}.install";
 
diff --git a/pkgs/development/ocaml-modules/javalib/default.nix b/pkgs/development/ocaml-modules/javalib/default.nix
index d158e4216ab43..15678f89da3c1 100644
--- a/pkgs/development/ocaml-modules/javalib/default.nix
+++ b/pkgs/development/ocaml-modules/javalib/default.nix
@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
 
   configureScript = "./configure.sh";
   dontAddPrefix = "true";
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   propagatedBuildInputs = [ camlzip extlib ];
 
diff --git a/pkgs/development/ocaml-modules/labltk/default.nix b/pkgs/development/ocaml-modules/labltk/default.nix
index 5a6daa54de39d..3161b56239d07 100644
--- a/pkgs/development/ocaml-modules/labltk/default.nix
+++ b/pkgs/development/ocaml-modules/labltk/default.nix
@@ -51,6 +51,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--use-findlib" "--installbindir" "$(out)/bin" ];
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   buildFlags = [ "all" "opt" ];
 
diff --git a/pkgs/development/ocaml-modules/ocamlnet/default.nix b/pkgs/development/ocaml-modules/ocamlnet/default.nix
index bdbbf1d8c67f0..5c3ca95bb0d8c 100644
--- a/pkgs/development/ocaml-modules/ocamlnet/default.nix
+++ b/pkgs/development/ocaml-modules/ocamlnet/default.nix
@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
   createFindlibDestdir = true;
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   preConfigure = ''
     configureFlagsArray=(
diff --git a/pkgs/development/ocaml-modules/ocsigen-server/default.nix b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
index 25d45d9aed9b1..96a66874c759d 100644
--- a/pkgs/development/ocaml-modules/ocsigen-server/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
@@ -40,6 +40,8 @@ buildDunePackage rec {
   configureFlags = [ "--root $(out)" "--prefix /" ];
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   postConfigure = ''
     make -C src confs
diff --git a/pkgs/development/ocaml-modules/sawja/default.nix b/pkgs/development/ocaml-modules/sawja/default.nix
index 68a8731201d6f..30ac2cfb22dda 100644
--- a/pkgs/development/ocaml-modules/sawja/default.nix
+++ b/pkgs/development/ocaml-modules/sawja/default.nix
@@ -31,6 +31,8 @@ stdenv.mkDerivation {
 
   configureScript = "./configure.sh";
   dontAddPrefix = "true";
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   propagatedBuildInputs = [ javalib ];
 
diff --git a/pkgs/development/ocaml-modules/zarith/default.nix b/pkgs/development/ocaml-modules/zarith/default.nix
index 12523b7bc7d1f..95351caee307b 100644
--- a/pkgs/development/ocaml-modules/zarith/default.nix
+++ b/pkgs/development/ocaml-modules/zarith/default.nix
@@ -22,6 +22,8 @@ stdenv.mkDerivation rec {
   strictDeps = true;
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
   configureFlags = [ "-installdir ${placeholder "out"}/lib/ocaml/${ocaml.version}/site-lib" ];
 
   preInstall = "mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/stublibs";
diff --git a/pkgs/development/tools/ocaml/dune/1.nix b/pkgs/development/tools/ocaml/dune/1.nix
index 79707a3c0090b..74deb9d2fa556 100644
--- a/pkgs/development/tools/ocaml/dune/1.nix
+++ b/pkgs/development/tools/ocaml/dune/1.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
   ];
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   meta = with lib; {
     homepage = "https://dune.build/";
diff --git a/pkgs/development/tools/ocaml/dune/2.nix b/pkgs/development/tools/ocaml/dune/2.nix
index 4dadba4e62e30..16f33268cf1e8 100644
--- a/pkgs/development/tools/ocaml/dune/2.nix
+++ b/pkgs/development/tools/ocaml/dune/2.nix
@@ -19,6 +19,8 @@ stdenv.mkDerivation rec {
   buildFlags = "release";
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   installFlags = [ "PREFIX=${placeholder "out"}" "LIBDIR=$(OCAMLFIND_DESTDIR)" ];
 
diff --git a/pkgs/development/tools/ocaml/findlib/default.nix b/pkgs/development/tools/ocaml/findlib/default.nix
index 4b02231b471fa..497a8ce91c1d5 100644
--- a/pkgs/development/tools/ocaml/findlib/default.nix
+++ b/pkgs/development/tools/ocaml/findlib/default.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
   patches = [ ./ldconf.patch ./install_topfind.patch ];
 
   dontAddPrefix=true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   configureFlags = [
       "-bindir" "${placeholder "out"}/bin"
diff --git a/pkgs/top-level/static.nix b/pkgs/top-level/static.nix
index 2ca24175cfa07..38f6a8fad424e 100644
--- a/pkgs/top-level/static.nix
+++ b/pkgs/top-level/static.nix
@@ -47,21 +47,6 @@ self: super: let
     # ++ optional (super.stdenv.hostPlatform.libc == "glibc") ((flip overrideInStdenv) [ self.stdenv.glibc.static ])
   ;
 
-  ocamlFixPackage = b:
-    b.overrideAttrs (o: {
-      configurePlatforms = [ ];
-      dontAddStaticConfigureFlags = true;
-    });
-
-  ocamlStaticAdapter = _: super:
-    self.lib.mapAttrs
-      (_: p: if p ? overrideAttrs then ocamlFixPackage p else p)
-      super
-    // {
-      lablgtk = null; # Currently xlibs cause infinite recursion
-      ocaml = super.ocaml;
-    };
-
 in {
   stdenv = foldl (flip id) super.stdenv staticAdapters;
 
@@ -78,11 +63,6 @@ in {
     gssSupport = false;
   };
 
-  ocaml-ng = self.lib.mapAttrs (_: set:
-    if set ? overrideScope' then set.overrideScope' ocamlStaticAdapter else set
-  ) super.ocaml-ng;
-
-
   zlib = super.zlib.override {
     # Don’t use new stdenv zlib because
     # it doesn’t like the --disable-shared flag

From 904625852d535bbe53cadb006c9e1137ab481818 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 19 Aug 2021 17:56:53 +0000
Subject: [PATCH 34/35] pkgsStatic: Inline more of static overlay

---
 pkgs/development/libraries/boost/generic.nix |  2 +
 pkgs/development/libraries/zlib/default.nix  | 10 +++--
 pkgs/stdenv/adapters.nix                     | 18 ++++++++
 pkgs/tools/networking/curl/default.nix       | 17 ++++----
 pkgs/top-level/static.nix                    | 45 +++-----------------
 5 files changed, 41 insertions(+), 51 deletions(-)

diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index 7ea7902e0873f..2d8d13482eac4 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -189,6 +189,8 @@ stdenv.mkDerivation {
 
   configureScript = "./bootstrap.sh";
   configurePlatforms = [];
+  dontDisableStatic = true;
+  dontAddStaticConfigureFlags = true;
   configureFlags = [
     "--includedir=$(dev)/include"
     "--libdir=$(out)/lib"
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index a9fadf46c4b2e..8d7cb3a48c885 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -57,11 +57,13 @@ stdenv.mkDerivation (rec {
   # and giving nothing builds both.
   # So we have 3 possible ways to build both:
   # `--static --shared`, `--shared` and giving nothing.
-  # Of these, we choose `--shared`, only because that's
-  # what we did in the past and we can avoid mass rebuilds this way.
-  # As a result, we pass `--static` only when we want just static.
-  configureFlags = lib.optional (static && !shared) "--static"
+  # Of these, we choose `--static --shared`, for clarity and simpler
+  # conditions.
+  configureFlags = lib.optional static "--static"
                    ++ lib.optional shared "--shared";
+  # We do the right thing manually, above, so don't need these.
+  dontDisableStatic = true;
+  dontAddStaticConfigureFlags = true;
 
   # Note we don't need to set `dontDisableStatic`, because static-disabling
   # works by grepping for `enable-static` in the `./configure` script
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index 719f679982664..9e1c73a57db14 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -90,6 +90,24 @@ rec {
       });
     });
 
+  # Best effort static binaries. Will still be linked to libSystem,
+  # but more portable than Nix store binaries.
+  makeStaticDarwin = stdenv: stdenv.override (old: {
+    # extraBuildInputs are dropped in cross.nix, but darwin still needs them
+    extraBuildInputs = [ pkgs.buildPackages.darwin.CF ];
+    mkDerivationFromStdenv = extendMkDerivationArgs old (args: {
+      NIX_CFLAGS_LINK = toString (args.NIX_CFLAGS_LINK or "")
+        + lib.optionalString (stdenv.cc.isGNU or false) " -static-libgcc";
+      nativeBuildInputs = (args.nativeBuildInputs or []) ++ [
+        (pkgs.buildPackages.makeSetupHook {
+          substitutions = {
+            libsystem = "${stdenv.cc.libc}/lib/libSystem.B.dylib";
+          };
+        } ./darwin/portable-libsystem.sh)
+      ];
+    });
+  });
+
 
   /* Modify a stdenv so that all buildInputs are implicitly propagated to
      consuming derivations
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 4fd754a3a6c73..5dba94abe35bc 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -9,6 +9,7 @@
 , scpSupport ? zlibSupport && !stdenv.isSunOS && !stdenv.isCygwin, libssh2 ? null
 , gssSupport ? with stdenv.hostPlatform; (
     !isWindows &&
+    # disable gss becuase of: undefined reference to `k5_bcmp'
     # a very sad story re static: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=439039
     !isStatic &&
     # the "mig" tool does not configure its compiler correctly. This could be
@@ -95,15 +96,15 @@ stdenv.mkDerivation rec {
       "--without-ca-bundle"
       "--without-ca-path"
       # The build fails when using wolfssl with --with-ca-fallback
-      ( if wolfsslSupport then "--without-ca-fallback" else "--with-ca-fallback")
+      (lib.withFeature wolfsslSupport "ca-fallback")
       "--disable-manual"
-      ( if sslSupport then "--with-ssl=${openssl.dev}" else "--without-ssl" )
-      ( if gnutlsSupport then "--with-gnutls=${gnutls.dev}" else "--without-gnutls" )
-      ( if scpSupport then "--with-libssh2=${libssh2.dev}" else "--without-libssh2" )
-      ( if ldapSupport then "--enable-ldap" else "--disable-ldap" )
-      ( if ldapSupport then "--enable-ldaps" else "--disable-ldaps" )
-      ( if idnSupport then "--with-libidn=${libidn.dev}" else "--without-libidn" )
-      ( if brotliSupport then "--with-brotli" else "--without-brotli" )
+      (lib.withFeatureAs sslSupport "ssl" openssl.dev)
+      (lib.withFeatureAs gnutlsSupport "gnutls" gnutls.dev)
+      (lib.withFeatureAs scpSupport "libssh2" libssh2.dev)
+      (lib.enableFeature ldapSupport "ldap")
+      (lib.enableFeature ldapSupport "ldaps")
+      (lib.withFeatureAs idnSupport "libidn" libidn.dev)
+      (lib.withFeature brotliSupport "brotli")
     ]
     ++ lib.optional wolfsslSupport "--with-wolfssl=${wolfssl.dev}"
     ++ lib.optional c-aresSupport "--enable-ares=${c-ares}"
diff --git a/pkgs/top-level/static.nix b/pkgs/top-level/static.nix
index 38f6a8fad424e..3cc3f6b79f4b1 100644
--- a/pkgs/top-level/static.nix
+++ b/pkgs/top-level/static.nix
@@ -13,26 +13,9 @@
 self: super: let
   inherit (super.stdenvAdapters) makeStaticBinaries
                                  makeStaticLibraries
-                                 propagateBuildInputs;
-  inherit (super.lib) foldl optional flip id composeExtensions optionalAttrs optionalString;
-  inherit (super) makeSetupHook;
-
-  # Best effort static binaries. Will still be linked to libSystem,
-  # but more portable than Nix store binaries.
-  makeStaticDarwin = stdenv_: let stdenv = stdenv_.override {
-    # extraBuildInputs are dropped in cross.nix, but darwin still needs them
-    extraBuildInputs = [ self.buildPackages.darwin.CF ];
-  }; in stdenv // {
-    mkDerivation = args: stdenv.mkDerivation (args // {
-      NIX_CFLAGS_LINK = toString (args.NIX_CFLAGS_LINK or "")
-                      + optionalString (stdenv_.cc.isGNU or false) " -static-libgcc";
-      nativeBuildInputs = (args.nativeBuildInputs or []) ++ [ (makeSetupHook {
-        substitutions = {
-          libsystem = "${stdenv.cc.libc}/lib/libSystem.B.dylib";
-        };
-      } ../stdenv/darwin/portable-libsystem.sh) ];
-    });
-  };
+                                 propagateBuildInputs
+                                 makeStaticDarwin;
+  inherit (super.lib) foldl optional flip id composeExtensions;
 
   staticAdapters =
     optional super.stdenv.hostPlatform.isDarwin makeStaticDarwin
@@ -48,24 +31,8 @@ self: super: let
   ;
 
 in {
-  stdenv = foldl (flip id) super.stdenv staticAdapters;
-
-  boost = super.boost.override {
-    # Don’t use new stdenv for boost because it doesn’t like the
-    # --disable-shared flag
-    stdenv = super.stdenv;
-  };
+  # Do not add new packages here! Instead use `stdenv.hostPlatform.isStatic` to
+  # write conditional code in the original package.
 
-  curl = super.curl.override {
-    # brotli doesn't build static (Mar. 2021)
-    brotliSupport = false;
-    # disable gss becuase of: undefined reference to `k5_bcmp'
-    gssSupport = false;
-  };
-
-  zlib = super.zlib.override {
-    # Don’t use new stdenv zlib because
-    # it doesn’t like the --disable-shared flag
-    stdenv = super.stdenv;
-  };
+  stdenv = foldl (flip id) super.stdenv staticAdapters;
 }

From a5c133a4b4fec615c31de82f5235709ecbcab6c0 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Thu, 19 Aug 2021 12:00:00 +0000
Subject: [PATCH 35/35] ocamlbuild: fix build

findlib's setup hook is now a preConfigure setup hook, so make sure to
run it
---
 pkgs/development/tools/ocaml/ocamlbuild/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/tools/ocaml/ocamlbuild/default.nix b/pkgs/development/tools/ocaml/ocamlbuild/default.nix
index d4c7cfcac164d..e3043d46ee5ec 100644
--- a/pkgs/development/tools/ocaml/ocamlbuild/default.nix
+++ b/pkgs/development/tools/ocaml/ocamlbuild/default.nix
@@ -19,11 +19,15 @@ stdenv.mkDerivation rec {
   hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
   configurePhase = ''
+  runHook preConfigure
+
   make -f configure.make Makefile.config \
     "OCAMLBUILD_PREFIX=$out" \
     "OCAMLBUILD_BINDIR=$out/bin" \
     "OCAMLBUILD_MANDIR=$out/share/man" \
     "OCAMLBUILD_LIBDIR=$OCAMLFIND_DESTDIR"
+
+  runHook postConfigure
   '';
 
   meta = with lib; {