From e0db9a8776d80a24ec98afd6780b317c22d62945 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Sun, 26 Apr 2026 11:12:04 -0400
Subject: [PATCH 01/14] stdenv.mkDerivation: remove concat

---
 pkgs/stdenv/generic/make-derivation.nix | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 4406bef8f908..ab7dce917a6f 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -871,20 +871,18 @@ let
           v
         ) env';
 
-      # Fixed-output derivations may not reference other paths, which means that
-      # for a fixed-output derivation, the corresponding inputDerivation should
-      # *not* be fixed-output. To achieve this we simply delete the attributes that
-      # would make it fixed-output.
-      fixedOutputRelatedAttrs = [
+      attrsToRemove = [
+        # Fixed-output derivations may not reference other paths, which means that
+        # for a fixed-output derivation, the corresponding inputDerivation should
+        # *not* be fixed-output. To achieve this we simply delete the attributes that
+        # would make it fixed-output.
         "outputHashAlgo"
         "outputHash"
         "outputHashMode"
-      ];
 
-      # inputDerivation produces the inputs; not the outputs, so any
-      # restrictions on what used to be the outputs don't serve a purpose
-      # anymore.
-      outputCheckAttrs = [
+        # inputDerivation produces the inputs; not the outputs, so any
+        # restrictions on what used to be the outputs don't serve a purpose
+        # anymore.
         "allowedReferences"
         "allowedRequisites"
         "disallowedReferences"
@@ -902,7 +900,7 @@ let
         # needed to enter a nix-shell with
         #   nix-build shell.nix -A inputDerivation
         inputDerivation = derivation (
-          removeAttrs derivationArg (fixedOutputRelatedAttrs ++ outputCheckAttrs)
+          removeAttrs derivationArg attrsToRemove
           // {
             # Add a name in case the original drv didn't have one
             name = "inputDerivation" + lib.optionalString (derivationArg ? name) "-${derivationArg.name}";

From 59264b680a908ffed6af2969be39cda94b6dbb28 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Sun, 26 Apr 2026 11:17:50 -0400
Subject: [PATCH 02/14] stdenv.mkDerivation: inline several `let` variables

---
 pkgs/stdenv/generic/make-derivation.nix | 55 ++++++++++++-------------
 1 file changed, 27 insertions(+), 28 deletions(-)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index ab7dce917a6f..bcb8caf0f982 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -95,31 +95,28 @@ let
       # NOTE: the above documentation had to be duplicated in `lib/customisation.nix`: `makeOverridable`.
       overrideAttrs =
         f0:
-        let
-          extends' =
-            overlay: f:
-            (
-              final:
-              let
-                prev = f final;
-                thisOverlay = overlay final prev;
-                warnForBadVersionOverride = (
-                  prev ? src
-                  && thisOverlay ? version
-                  && prev ? version
-                  # We could check that the version is actually distinct, but that
-                  # would probably just delay the inevitable, or preserve tech debt.
-                  # && prev.version != thisOverlay.version
-                  && !(thisOverlay ? src)
-                  && !(thisOverlay.__intentionallyOverridingVersion or false)
-                );
-                pname = args.pname or "<unknown name>";
-                version = args.version or "<unknown version>";
-                pos = builtins.unsafeGetAttrPos "version" thisOverlay;
-              in
-              lib.warnIf warnForBadVersionOverride ''
+        makeDerivationExtensible (
+          (
+            overlay: f: final:
+            let
+              prev = f final;
+              thisOverlay = overlay final prev;
+              pos = builtins.unsafeGetAttrPos "version" thisOverlay;
+            in
+            lib.warnIf
+              (
+                prev ? src
+                && thisOverlay ? version
+                && prev ? version
+                # We could check that the version is actually distinct, but that
+                # would probably just delay the inevitable, or preserve tech debt.
+                # && prev.version != thisOverlay.version
+                && !(thisOverlay ? src)
+                && !(thisOverlay.__intentionallyOverridingVersion or false)
+              )
+              ''
                 ${
-                  args.name or "${pname}-${version}"
+                  args.name or "${args.pname or "<unknown name>"}-${args.version or "<unknown version>"}"
                 } was overridden with `version` but not `src` at ${pos.file or "<unknown file>"}:${
                   toString pos.line or "<unknown line>"
                 }:${toString pos.column or "<unknown column>"}.
@@ -136,10 +133,12 @@ let
                 })
 
                 (To silence this warning, set `__intentionallyOverridingVersion = true` in your `overrideAttrs` call.)
-              '' (prev // (removeAttrs thisOverlay [ "__intentionallyOverridingVersion" ]))
-            );
-        in
-        makeDerivationExtensible (extends' (lib.toExtension f0) rattrs);
+              ''
+              (prev // (removeAttrs thisOverlay [ "__intentionallyOverridingVersion" ]))
+          )
+            (lib.toExtension f0)
+            rattrs
+        );
 
       finalPackage = mkDerivationSimple overrideAttrs args;
 

From 0080eb12264f7ece6f09fd97d215053e932868e7 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Sun, 26 Apr 2026 11:24:38 -0400
Subject: [PATCH 03/14] stdenv.mkDerivation: inline toPretty usage

---
 pkgs/stdenv/generic/make-derivation.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index bcb8caf0f982..7015353fee33 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -851,11 +851,10 @@ let
       checkedEnv =
         let
           overlappingNames = attrNames (builtins.intersectAttrs env' derivationArg);
-          prettyPrint = lib.generators.toPretty { };
           makeError =
             name:
-            "  - ${name}: in `env`: ${prettyPrint env'.${name}}; in derivation arguments: ${
-                prettyPrint derivationArg.${name}
+            "  - ${name}: in `env`: ${lib.generators.toPretty { } env'.${name}}; in derivation arguments: ${
+                lib.generators.toPretty { } derivationArg.${name}
               }";
           errors = lib.concatMapStringsSep "\n" makeError overlappingNames;
         in

From a07d262b8889a217f3d502242b619a290a6ce33f Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Sun, 26 Apr 2026 11:27:20 -0400
Subject: [PATCH 04/14] stdenv.mkDerivation: inline variable

---
 pkgs/stdenv/generic/make-derivation.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 7015353fee33..d05e003bb6eb 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -394,13 +394,17 @@ let
       separateDebugInfo' =
         let
           actualValue = separateDebugInfo && isLinux;
-          conflictingOption =
+        in
+        if
+          actualValue
+          && (
             attrs ? "disallowedReferences"
             || attrs ? "disallowedRequisites"
             || attrs ? "allowedRequisites"
-            || attrs ? "allowedReferences";
-        in
-        if actualValue && conflictingOption && !__structuredAttrs then
+            || attrs ? "allowedReferences"
+          )
+          && !__structuredAttrs
+        then
           throw "separateDebugInfo = true in ${
             attrs.pname or "mkDerivation argument"
           } requires __structuredAttrs if {dis,}allowedRequisites or {dis,}allowedReferences is set"

From d38a01c2594d7f5bb1e7d94ba5ed46807cad3213 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Sun, 26 Apr 2026 11:50:49 -0400
Subject: [PATCH 05/14] stdenv.mkDerivation: inline functions already in scope

---
 pkgs/stdenv/generic/make-derivation.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index d05e003bb6eb..bf775db5b55b 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -427,7 +427,7 @@ let
 
       concretizeFlagImplications =
         flag: impliesFlags: list:
-        if builtins.elem flag list then (list ++ impliesFlags) else list;
+        if elem flag list then (list ++ impliesFlags) else list;
 
       hardeningDisable' = unique (
         pipe hardeningDisable [
@@ -440,7 +440,7 @@ let
         ]
       );
       enabledHardeningOptions =
-        if builtins.elem "all" hardeningDisable' then
+        if elem "all" hardeningDisable' then
           [ ]
         else
           subtractLists hardeningDisable' (defaultHardeningFlags ++ hardeningEnable);
@@ -454,7 +454,7 @@ let
         positions: name: deps:
         imap1 (
           index: dep:
-          if dep == null || isDerivation dep || builtins.isString dep || builtins.isPath dep then
+          if dep == null || isDerivation dep || isString dep || builtins.isPath dep then
             dep
           else if isList dep then
             checkDependencyList' ([ index ] ++ positions) name dep
@@ -640,9 +640,9 @@ let
             else
               null
           } =
-            lib.warnIf ((builtins.elem "pie" hardeningEnable) || (builtins.elem "pie" hardeningDisable))
+            lib.warnIf (elem "pie" hardeningEnable || elem "pie" hardeningDisable)
               "The 'pie' hardening flag has been removed in favor of enabling PIE by default in compilers and should no longer be used. PIE can be disabled with the -no-pie compiler flag, but this is usually not necessary as most build systems pass this if needed. Usage of the 'pie' hardening flag will become an error in future."
-              (builtins.concatStringsSep " " enabledHardeningOptions);
+              (concatStringsSep " " enabledHardeningOptions);
 
           # TODO: remove platform condition
           # Enabling this check could be a breaking change as it requires to edit nix.conf
@@ -718,7 +718,7 @@ let
           # -- Windows/Cygwin-specific attrs --
           ${if isWindows || isCygwin then "allowedImpureDLLs" else null} =
             allowedImpureDLLs
-            ++ lib.optionals isCygwin [
+            ++ optionals isCygwin [
               "KERNEL32.dll"
             ];
 
@@ -741,7 +741,7 @@ let
                 inherit name;
                 value =
                   let
-                    raw = zipAttrsWith (_: builtins.concatLists) [
+                    raw = zipAttrsWith (_: concatLists) [
                       attrsOutputChecksFiltered
                       (makeOutputChecks attrs.outputChecks.${name} or { })
                     ];
@@ -905,7 +905,7 @@ let
           removeAttrs derivationArg attrsToRemove
           // {
             # Add a name in case the original drv didn't have one
-            name = "inputDerivation" + lib.optionalString (derivationArg ? name) "-${derivationArg.name}";
+            name = "inputDerivation" + optionalString (derivationArg ? name) "-${derivationArg.name}";
             # This always only has one output
             outputs = [ "out" ];
             # This doesn’t require any system features even if the original

From e70789fb5a2fea7cbf45bdc68a372eb894f994f2 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Sun, 26 Apr 2026 12:25:32 -0400
Subject: [PATCH 06/14] stdenv.mkDerivation: inline variable

---
 pkgs/stdenv/generic/make-derivation.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index bf775db5b55b..07ac68b818ac 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -855,12 +855,12 @@ let
       checkedEnv =
         let
           overlappingNames = attrNames (builtins.intersectAttrs env' derivationArg);
-          makeError =
+          errors = lib.concatMapStringsSep "\n" (
             name:
             "  - ${name}: in `env`: ${lib.generators.toPretty { } env'.${name}}; in derivation arguments: ${
                 lib.generators.toPretty { } derivationArg.${name}
-              }";
-          errors = lib.concatMapStringsSep "\n" makeError overlappingNames;
+              }"
+          ) overlappingNames;
         in
         assert assertMsg (isAttrs env && !isDerivation env)
           "`env` must be an attribute set of environment variables. Set `env.env` or pick a more specific name.";

From 34a0d8447899e0d189c52124244c757043b21817 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Sun, 26 Apr 2026 12:26:40 -0400
Subject: [PATCH 07/14] stdenv.mkDerivation: inline variable

---
 pkgs/stdenv/generic/make-derivation.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 07ac68b818ac..4fe2613f1f8f 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -823,9 +823,8 @@ let
       );
 
     let
-      mainProgram = meta.mainProgram or null;
       env' = env // {
-        ${if mainProgram != null then "NIX_MAIN_PROGRAM" else null} = mainProgram;
+        ${if meta ? mainProgram then "NIX_MAIN_PROGRAM" else null} = meta.mainProgram;
       };
 
       derivationArg = makeDerivationArgument (

From 52d158340eeee1e5ead3244c612239b6205e3dfc Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Sun, 26 Apr 2026 12:52:15 -0400
Subject: [PATCH 08/14] stdenv.mkDerivation: compare to [] instead of using
 builtins.length

---
 pkgs/stdenv/generic/make-derivation.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 4fe2613f1f8f..4e44521530b4 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -413,7 +413,7 @@ let
       outputs' = outputs ++ optional separateDebugInfo' "debug";
 
       noNonNativeDeps =
-        builtins.length (
+        (
           depsBuildTarget
           ++ depsBuildTargetPropagated
           ++ depsHostHost
@@ -422,7 +422,7 @@ let
           ++ propagatedBuildInputs
           ++ depsTargetTarget
           ++ depsTargetTargetPropagated
-        ) == 0;
+        ) == [ ];
       dontAddHostSuffix = attrs ? outputHash && !noNonNativeDeps || !stdenvHasCC;
 
       concretizeFlagImplications =
@@ -464,7 +464,7 @@ let
             }${name} for ${attrs.name or attrs.pname}"
         ) deps;
     in
-    if builtins.length erroneousHardeningFlags != 0 then
+    if erroneousHardeningFlags != [ ] then
       abort (
         "mkDerivation was called with unsupported hardening flags: "
         + lib.generators.toPretty { } {

From db60650a727fa496c19e5299607fa244fa9378a6 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Sun, 26 Apr 2026 13:10:36 -0400
Subject: [PATCH 09/14] stdenv.mkDerivation: use `head foo` instead of `elemAt
 foo 0`

---
 pkgs/stdenv/generic/make-derivation.nix | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 4e44521530b4..a5cdbafa1a66 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -589,19 +589,19 @@ let
           __ignoreNulls = true;
           inherit __structuredAttrs strictDeps;
 
-          depsBuildBuild = elemAt (elemAt dependencies 0) 0;
-          nativeBuildInputs = elemAt (elemAt dependencies 0) 1;
-          depsBuildTarget = elemAt (elemAt dependencies 0) 2;
-          depsHostHost = elemAt (elemAt dependencies 1) 0;
+          depsBuildBuild = head (head dependencies);
+          nativeBuildInputs = elemAt (head dependencies) 1;
+          depsBuildTarget = elemAt (head dependencies) 2;
+          depsHostHost = head (elemAt dependencies 1);
           buildInputs = elemAt (elemAt dependencies 1) 1;
-          depsTargetTarget = elemAt (elemAt dependencies 2) 0;
+          depsTargetTarget = head (elemAt dependencies 2);
 
-          depsBuildBuildPropagated = elemAt (elemAt propagatedDependencies 0) 0;
-          propagatedNativeBuildInputs = elemAt (elemAt propagatedDependencies 0) 1;
-          depsBuildTargetPropagated = elemAt (elemAt propagatedDependencies 0) 2;
-          depsHostHostPropagated = elemAt (elemAt propagatedDependencies 1) 0;
+          depsBuildBuildPropagated = head (head propagatedDependencies);
+          propagatedNativeBuildInputs = elemAt (head propagatedDependencies) 1;
+          depsBuildTargetPropagated = elemAt (head propagatedDependencies) 2;
+          depsHostHostPropagated = head (elemAt propagatedDependencies 1);
           propagatedBuildInputs = elemAt (elemAt propagatedDependencies 1) 1;
-          depsTargetTargetPropagated = elemAt (elemAt propagatedDependencies 2) 0;
+          depsTargetTargetPropagated = head (elemAt propagatedDependencies 2);
 
           # This parameter is sometimes a string, sometimes null, and sometimes a list, yuck
           configureFlags =

From 6926e99cffd71462f9b44c9d748a18674af2ea9c Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Sun, 26 Apr 2026 13:38:31 -0400
Subject: [PATCH 10/14] stdenv.mkDerivation: define dependencies and
 propagatedDependencies as separate variables

---
 pkgs/stdenv/generic/make-derivation.nix | 129 ++++++++++++------------
 1 file changed, 65 insertions(+), 64 deletions(-)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index a5cdbafa1a66..ffed9e197ff4 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -491,54 +491,61 @@ let
 
         outputs = outputs';
 
-        dependencies = [
-          [
-            (map (drv: getDev drv.__spliced.buildBuild or drv) (
-              checkDependencyList "depsBuildBuild" depsBuildBuild
-            ))
-            (map (drv: getDev drv.__spliced.buildHost or drv) (
-              checkDependencyList "nativeBuildInputs" nativeBuildInputs'
-            ))
-            (map (drv: getDev drv.__spliced.buildTarget or drv) (
-              checkDependencyList "depsBuildTarget" depsBuildTarget
-            ))
-          ]
-          [
-            (map (drv: getDev drv.__spliced.hostHost or drv) (checkDependencyList "depsHostHost" depsHostHost))
-            (map (drv: getDev drv.__spliced.hostTarget or drv) (checkDependencyList "buildInputs" buildInputs'))
-          ]
-          [
-            (map (drv: getDev drv.__spliced.targetTarget or drv) (
-              checkDependencyList "depsTargetTarget" depsTargetTarget
-            ))
-          ]
+        buildDependencies = [
+          (map (drv: getDev drv.__spliced.buildBuild or drv) (
+            checkDependencyList "depsBuildBuild" depsBuildBuild
+          ))
+          (map (drv: getDev drv.__spliced.buildHost or drv) (
+            checkDependencyList "nativeBuildInputs" nativeBuildInputs'
+          ))
+          (map (drv: getDev drv.__spliced.buildTarget or drv) (
+            checkDependencyList "depsBuildTarget" depsBuildTarget
+          ))
         ];
-        propagatedDependencies = [
-          [
-            (map (drv: getDev drv.__spliced.buildBuild or drv) (
-              checkDependencyList "depsBuildBuildPropagated" depsBuildBuildPropagated
-            ))
-            (map (drv: getDev drv.__spliced.buildHost or drv) (
-              checkDependencyList "propagatedNativeBuildInputs" propagatedNativeBuildInputs
-            ))
-            (map (drv: getDev drv.__spliced.buildTarget or drv) (
-              checkDependencyList "depsBuildTargetPropagated" depsBuildTargetPropagated
-            ))
-          ]
-          [
-            (map (drv: getDev drv.__spliced.hostHost or drv) (
-              checkDependencyList "depsHostHostPropagated" depsHostHostPropagated
-            ))
-            (map (drv: getDev drv.__spliced.hostTarget or drv) (
-              checkDependencyList "propagatedBuildInputs" propagatedBuildInputs
-            ))
-          ]
-          [
-            (map (drv: getDev drv.__spliced.targetTarget or drv) (
-              checkDependencyList "depsTargetTargetPropagated" depsTargetTargetPropagated
-            ))
-          ]
+        hostDependencies = [
+          (map (drv: getDev drv.__spliced.hostHost or drv) (checkDependencyList "depsHostHost" depsHostHost))
+          (map (drv: getDev drv.__spliced.hostTarget or drv) (checkDependencyList "buildInputs" buildInputs'))
         ];
+        targetDependencies = [
+          (map (drv: getDev drv.__spliced.targetTarget or drv) (
+            checkDependencyList "depsTargetTarget" depsTargetTarget
+          ))
+        ];
+        allDependencies = concatLists (concatLists [
+          buildDependencies
+          hostDependencies
+          targetDependencies
+        ]);
+
+        propagatedBuildDependencies = [
+          (map (drv: getDev drv.__spliced.buildBuild or drv) (
+            checkDependencyList "depsBuildBuildPropagated" depsBuildBuildPropagated
+          ))
+          (map (drv: getDev drv.__spliced.buildHost or drv) (
+            checkDependencyList "propagatedNativeBuildInputs" propagatedNativeBuildInputs
+          ))
+          (map (drv: getDev drv.__spliced.buildTarget or drv) (
+            checkDependencyList "depsBuildTargetPropagated" depsBuildTargetPropagated
+          ))
+        ];
+        propagatedHostDependencies = [
+          (map (drv: getDev drv.__spliced.hostHost or drv) (
+            checkDependencyList "depsHostHostPropagated" depsHostHostPropagated
+          ))
+          (map (drv: getDev drv.__spliced.hostTarget or drv) (
+            checkDependencyList "propagatedBuildInputs" propagatedBuildInputs
+          ))
+        ];
+        propagatedTargetDependencies = [
+          (map (drv: getDev drv.__spliced.targetTarget or drv) (
+            checkDependencyList "depsTargetTargetPropagated" depsTargetTargetPropagated
+          ))
+        ];
+        allPropagatedDependencies = concatLists (concatLists [
+          propagatedBuildDependencies
+          propagatedHostDependencies
+          propagatedTargetDependencies
+        ]);
 
         derivationArg = removeAttrs attrs removedOrReplacedAttrNames // {
           ${if (attrs ? name || (attrs ? pname && attrs ? version)) then "name" else null} =
@@ -589,19 +596,19 @@ let
           __ignoreNulls = true;
           inherit __structuredAttrs strictDeps;
 
-          depsBuildBuild = head (head dependencies);
-          nativeBuildInputs = elemAt (head dependencies) 1;
-          depsBuildTarget = elemAt (head dependencies) 2;
-          depsHostHost = head (elemAt dependencies 1);
-          buildInputs = elemAt (elemAt dependencies 1) 1;
-          depsTargetTarget = head (elemAt dependencies 2);
+          depsBuildBuild = head buildDependencies;
+          nativeBuildInputs = elemAt buildDependencies 1;
+          depsBuildTarget = elemAt buildDependencies 2;
+          depsHostHost = head hostDependencies;
+          buildInputs = elemAt hostDependencies 1;
+          depsTargetTarget = head targetDependencies;
 
-          depsBuildBuildPropagated = head (head propagatedDependencies);
-          propagatedNativeBuildInputs = elemAt (head propagatedDependencies) 1;
-          depsBuildTargetPropagated = elemAt (head propagatedDependencies) 2;
-          depsHostHostPropagated = head (elemAt propagatedDependencies 1);
-          propagatedBuildInputs = elemAt (elemAt propagatedDependencies 1) 1;
-          depsTargetTargetPropagated = head (elemAt propagatedDependencies 2);
+          depsBuildBuildPropagated = head propagatedBuildDependencies;
+          propagatedNativeBuildInputs = elemAt propagatedBuildDependencies 1;
+          depsBuildTargetPropagated = elemAt propagatedBuildDependencies 2;
+          depsHostHostPropagated = head propagatedHostDependencies;
+          propagatedBuildInputs = elemAt propagatedHostDependencies 1;
+          depsTargetTargetPropagated = head propagatedTargetDependencies;
 
           # This parameter is sometimes a string, sometimes null, and sometimes a list, yuck
           configureFlags =
@@ -654,8 +661,6 @@ let
           ${if buildIsDarwin then "__darwinAllowLocalNetworking" else null} = __darwinAllowLocalNetworking;
           ${if buildIsDarwin then "__sandboxProfile" else null} =
             let
-              allDependencies = concatLists (concatLists dependencies);
-              allPropagatedDependencies = concatLists (concatLists propagatedDependencies);
               computedSandboxProfile = concatMap (input: input.__propagatedSandboxProfile or [ ]) (
                 extraNativeBuildInputs ++ extraBuildInputs ++ allDependencies
               );
@@ -676,7 +681,6 @@ let
             concatStringsSep "\n" (filter (x: x != "") (unique profiles));
           ${if buildIsDarwin then "__propagatedSandboxProfile" else null} =
             let
-              allPropagatedDependencies = concatLists (concatLists propagatedDependencies);
               computedPropagatedSandboxProfile = concatMap (
                 input: input.__propagatedSandboxProfile or [ ]
               ) allPropagatedDependencies;
@@ -684,8 +688,6 @@ let
             unique (computedPropagatedSandboxProfile ++ [ propagatedSandboxProfile ]);
           ${if buildIsDarwin then "__impureHostDeps" else null} =
             let
-              allDependencies = concatLists (concatLists dependencies);
-              allPropagatedDependencies = concatLists (concatLists propagatedDependencies);
               computedImpureHostDeps = unique (
                 concatMap (input: input.__propagatedImpureHostDeps or [ ]) (
                   extraNativeBuildInputs ++ extraBuildInputs ++ allDependencies
@@ -708,7 +710,6 @@ let
             ];
           ${if buildIsDarwin then "__propagatedImpureHostDeps" else null} =
             let
-              allPropagatedDependencies = concatLists (concatLists propagatedDependencies);
               computedPropagatedImpureHostDeps = unique (
                 concatMap (input: input.__propagatedImpureHostDeps or [ ]) allPropagatedDependencies
               );

From 9500a7bff7e3f83ab03524c9915a3d3658f516a7 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Sun, 26 Apr 2026 14:07:02 -0400
Subject: [PATCH 11/14] stdenv.mkDerivation: remove duplicate assertions

---
 pkgs/stdenv/generic/make-derivation.nix | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index ffed9e197ff4..79f49c5eedb4 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -374,17 +374,6 @@ let
 
       ...
     }@attrs:
-
-    # Policy on acceptable hash types in nixpkgs
-    assert
-      attrs ? outputHash
-      -> (
-        let
-          algo = attrs.outputHashAlgo or (head (splitString "-" attrs.outputHash));
-        in
-        if algo == "md5" then throw "Rejected insecure ${algo} hash '${attrs.outputHash}'" else true
-      );
-
     let
       # TODO(@oxij, @Ericson2314): This is here to keep the old semantics, remove when
       # no package has `doCheck = true`.

From 407f9757dbadc8e1ab1850c36cb3666443f16bba Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Sun, 26 Apr 2026 14:54:46 -0400
Subject: [PATCH 12/14] stdenv.mkDerivation: remove pie hardening flag warning

---
 doc/release-notes/rl-2605.section.md    | 2 ++
 pkgs/stdenv/generic/make-derivation.nix | 6 ++----
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index b133b37cd5c7..b333f6848381 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -274,6 +274,8 @@
 
 - The default packages in `services.jenkins.packages` have been dropped, since not every Jenkins installation needs any package at all. It's more reasonable to leave it empty and let users configure what they need.
 
+- The `pie` hardening flag has been removed and will now error, after being deprecated in 25.11. Compilers are expected to enable PIE by default, as has been common practice since 2016 outside of Nixpkgs. If a package needs `pie` disabled pass `-no-pie` in `CFLAGS`. It is unlikely this will be necessary in many cases; due to the prevalence of default PIE toolchains, most packages incompatible with PIE already pass `-no-pie`.
+
 ## Other Notable Changes {#sec-nixpkgs-release-26.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 79f49c5eedb4..2a8361efe328 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -434,7 +434,7 @@ let
         else
           subtractLists hardeningDisable' (defaultHardeningFlags ++ hardeningEnable);
       # hardeningDisable additionally supports "all".
-      erroneousHardeningFlags = subtractLists (knownHardeningFlags ++ [ "pie" ]) (
+      erroneousHardeningFlags = subtractLists knownHardeningFlags (
         hardeningEnable ++ remove "all" hardeningDisable
       );
 
@@ -636,9 +636,7 @@ let
             else
               null
           } =
-            lib.warnIf (elem "pie" hardeningEnable || elem "pie" hardeningDisable)
-              "The 'pie' hardening flag has been removed in favor of enabling PIE by default in compilers and should no longer be used. PIE can be disabled with the -no-pie compiler flag, but this is usually not necessary as most build systems pass this if needed. Usage of the 'pie' hardening flag will become an error in future."
-              (concatStringsSep " " enabledHardeningOptions);
+            concatStringsSep " " enabledHardeningOptions;
 
           # TODO: remove platform condition
           # Enabling this check could be a breaking change as it requires to edit nix.conf

From 5e347175022ba2da7f7b4dfb436ba55a3ac798b2 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Sun, 26 Apr 2026 16:16:46 -0400
Subject: [PATCH 13/14] stdenv.mkDerivation: inline function calls

---
 pkgs/stdenv/generic/make-derivation.nix | 74 ++++++++++++-------------
 1 file changed, 35 insertions(+), 39 deletions(-)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 2a8361efe328..4bb75a46fbf2 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -96,48 +96,44 @@ let
       overrideAttrs =
         f0:
         makeDerivationExtensible (
-          (
-            overlay: f: final:
-            let
-              prev = f final;
-              thisOverlay = overlay final prev;
-              pos = builtins.unsafeGetAttrPos "version" thisOverlay;
-            in
-            lib.warnIf
-              (
-                prev ? src
-                && thisOverlay ? version
-                && prev ? version
-                # We could check that the version is actually distinct, but that
-                # would probably just delay the inevitable, or preserve tech debt.
-                # && prev.version != thisOverlay.version
-                && !(thisOverlay ? src)
-                && !(thisOverlay.__intentionallyOverridingVersion or false)
-              )
-              ''
-                ${
-                  args.name or "${args.pname or "<unknown name>"}-${args.version or "<unknown version>"}"
-                } was overridden with `version` but not `src` at ${pos.file or "<unknown file>"}:${
-                  toString pos.line or "<unknown line>"
-                }:${toString pos.column or "<unknown column>"}.
+          final:
+          let
+            prev = rattrs final;
+            thisOverlay = lib.toExtension f0 final prev;
+            pos = builtins.unsafeGetAttrPos "version" thisOverlay;
+          in
+          lib.warnIf
+            (
+              prev ? src
+              && thisOverlay ? version
+              && prev ? version
+              # We could check that the version is actually distinct, but that
+              # would probably just delay the inevitable, or preserve tech debt.
+              # && prev.version != thisOverlay.version
+              && !(thisOverlay ? src)
+              && !(thisOverlay.__intentionallyOverridingVersion or false)
+            )
+            ''
+              ${
+                args.name or "${args.pname or "<unknown name>"}-${args.version or "<unknown version>"}"
+              } was overridden with `version` but not `src` at ${pos.file or "<unknown file>"}:${
+                toString pos.line or "<unknown line>"
+              }:${toString pos.column or "<unknown column>"}.
 
-                This is most likely not what you want. In order to properly change the version of a package, override
-                both the `version` and `src` attributes:
+              This is most likely not what you want. In order to properly change the version of a package, override
+              both the `version` and `src` attributes:
 
-                hello.overrideAttrs (oldAttrs: rec {
-                  version = "1.0.0";
-                  src = pkgs.fetchurl {
-                    url = "mirror://gnu/hello/hello-''${version}.tar.gz";
-                    hash = "...";
-                  };
-                })
+              hello.overrideAttrs (oldAttrs: rec {
+                version = "1.0.0";
+                src = pkgs.fetchurl {
+                  url = "mirror://gnu/hello/hello-''${version}.tar.gz";
+                  hash = "...";
+                };
+              })
 
-                (To silence this warning, set `__intentionallyOverridingVersion = true` in your `overrideAttrs` call.)
-              ''
-              (prev // (removeAttrs thisOverlay [ "__intentionallyOverridingVersion" ]))
-          )
-            (lib.toExtension f0)
-            rattrs
+              (To silence this warning, set `__intentionallyOverridingVersion = true` in your `overrideAttrs` call.)
+            ''
+            (prev // (removeAttrs thisOverlay [ "__intentionallyOverridingVersion" ]))
         );
 
       finalPackage = mkDerivationSimple overrideAttrs args;

From 9c56dc667093e1ed2c873991fb55a7da037091a8 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Sun, 26 Apr 2026 16:51:27 -0400
Subject: [PATCH 14/14] stdenv.mkDerivation: fully expand out dependency
 variables

---
 pkgs/stdenv/generic/make-derivation.nix | 127 ++++++++++++------------
 1 file changed, 62 insertions(+), 65 deletions(-)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 4bb75a46fbf2..c178f82aaa01 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -20,7 +20,6 @@ let
     concatMapStrings
     concatStringsSep
     elem
-    elemAt
     extendDerivation
     filter
     filterAttrs
@@ -476,61 +475,59 @@ let
 
         outputs = outputs';
 
-        buildDependencies = [
-          (map (drv: getDev drv.__spliced.buildBuild or drv) (
-            checkDependencyList "depsBuildBuild" depsBuildBuild
-          ))
-          (map (drv: getDev drv.__spliced.buildHost or drv) (
-            checkDependencyList "nativeBuildInputs" nativeBuildInputs'
-          ))
-          (map (drv: getDev drv.__spliced.buildTarget or drv) (
-            checkDependencyList "depsBuildTarget" depsBuildTarget
-          ))
+        buildBuildOutputs = map (drv: getDev drv.__spliced.buildBuild or drv) (
+          checkDependencyList "depsBuildBuild" depsBuildBuild
+        );
+        buildHostOutputs = map (drv: getDev drv.__spliced.buildHost or drv) (
+          checkDependencyList "nativeBuildInputs" nativeBuildInputs'
+        );
+        buildTargetOutputs = map (drv: getDev drv.__spliced.buildTarget or drv) (
+          checkDependencyList "depsBuildTarget" depsBuildTarget
+        );
+        hostHostOutputs = map (drv: getDev drv.__spliced.hostHost or drv) (
+          checkDependencyList "depsHostHost" depsHostHost
+        );
+        hostTargetOutputs = map (drv: getDev drv.__spliced.hostTarget or drv) (
+          checkDependencyList "buildInputs" buildInputs'
+        );
+        targetTargetOutputs = map (drv: getDev drv.__spliced.targetTarget or drv) (
+          checkDependencyList "depsTargetTarget" depsTargetTarget
+        );
+        allDependencies = concatLists [
+          buildBuildOutputs
+          buildHostOutputs
+          buildTargetOutputs
+          hostHostOutputs
+          hostTargetOutputs
+          targetTargetOutputs
         ];
-        hostDependencies = [
-          (map (drv: getDev drv.__spliced.hostHost or drv) (checkDependencyList "depsHostHost" depsHostHost))
-          (map (drv: getDev drv.__spliced.hostTarget or drv) (checkDependencyList "buildInputs" buildInputs'))
-        ];
-        targetDependencies = [
-          (map (drv: getDev drv.__spliced.targetTarget or drv) (
-            checkDependencyList "depsTargetTarget" depsTargetTarget
-          ))
-        ];
-        allDependencies = concatLists (concatLists [
-          buildDependencies
-          hostDependencies
-          targetDependencies
-        ]);
 
-        propagatedBuildDependencies = [
-          (map (drv: getDev drv.__spliced.buildBuild or drv) (
-            checkDependencyList "depsBuildBuildPropagated" depsBuildBuildPropagated
-          ))
-          (map (drv: getDev drv.__spliced.buildHost or drv) (
-            checkDependencyList "propagatedNativeBuildInputs" propagatedNativeBuildInputs
-          ))
-          (map (drv: getDev drv.__spliced.buildTarget or drv) (
-            checkDependencyList "depsBuildTargetPropagated" depsBuildTargetPropagated
-          ))
+        propagatedBuildBuildOutputs = map (drv: getDev drv.__spliced.buildBuild or drv) (
+          checkDependencyList "depsBuildBuildPropagated" depsBuildBuildPropagated
+        );
+        propagatedBuildHostOutputs = map (drv: getDev drv.__spliced.buildHost or drv) (
+          checkDependencyList "propagatedNativeBuildInputs" propagatedNativeBuildInputs
+        );
+        propagatedBuildTargetOutputs = map (drv: getDev drv.__spliced.buildTarget or drv) (
+          checkDependencyList "depsBuildTargetPropagated" depsBuildTargetPropagated
+        );
+        propagatedHostHostOutputs = map (drv: getDev drv.__spliced.hostHost or drv) (
+          checkDependencyList "depsHostHostPropagated" depsHostHostPropagated
+        );
+        propagatedHostTargetOutputs = map (drv: getDev drv.__spliced.hostTarget or drv) (
+          checkDependencyList "propagatedBuildInputs" propagatedBuildInputs
+        );
+        propagatedTargetTargetOutputs = map (drv: getDev drv.__spliced.targetTarget or drv) (
+          checkDependencyList "depsTargetTargetPropagated" depsTargetTargetPropagated
+        );
+        allPropagatedDependencies = concatLists [
+          propagatedBuildBuildOutputs
+          propagatedBuildHostOutputs
+          propagatedBuildTargetOutputs
+          propagatedHostHostOutputs
+          propagatedHostTargetOutputs
+          propagatedTargetTargetOutputs
         ];
-        propagatedHostDependencies = [
-          (map (drv: getDev drv.__spliced.hostHost or drv) (
-            checkDependencyList "depsHostHostPropagated" depsHostHostPropagated
-          ))
-          (map (drv: getDev drv.__spliced.hostTarget or drv) (
-            checkDependencyList "propagatedBuildInputs" propagatedBuildInputs
-          ))
-        ];
-        propagatedTargetDependencies = [
-          (map (drv: getDev drv.__spliced.targetTarget or drv) (
-            checkDependencyList "depsTargetTargetPropagated" depsTargetTargetPropagated
-          ))
-        ];
-        allPropagatedDependencies = concatLists (concatLists [
-          propagatedBuildDependencies
-          propagatedHostDependencies
-          propagatedTargetDependencies
-        ]);
 
         derivationArg = removeAttrs attrs removedOrReplacedAttrNames // {
           ${if (attrs ? name || (attrs ? pname && attrs ? version)) then "name" else null} =
@@ -581,19 +578,19 @@ let
           __ignoreNulls = true;
           inherit __structuredAttrs strictDeps;
 
-          depsBuildBuild = head buildDependencies;
-          nativeBuildInputs = elemAt buildDependencies 1;
-          depsBuildTarget = elemAt buildDependencies 2;
-          depsHostHost = head hostDependencies;
-          buildInputs = elemAt hostDependencies 1;
-          depsTargetTarget = head targetDependencies;
+          depsBuildBuild = buildBuildOutputs;
+          nativeBuildInputs = buildHostOutputs;
+          depsBuildTarget = buildTargetOutputs;
+          depsHostHost = hostHostOutputs;
+          buildInputs = hostTargetOutputs;
+          depsTargetTarget = targetTargetOutputs;
 
-          depsBuildBuildPropagated = head propagatedBuildDependencies;
-          propagatedNativeBuildInputs = elemAt propagatedBuildDependencies 1;
-          depsBuildTargetPropagated = elemAt propagatedBuildDependencies 2;
-          depsHostHostPropagated = head propagatedHostDependencies;
-          propagatedBuildInputs = elemAt propagatedHostDependencies 1;
-          depsTargetTargetPropagated = head propagatedTargetDependencies;
+          depsBuildBuildPropagated = propagatedBuildBuildOutputs;
+          propagatedNativeBuildInputs = propagatedBuildHostOutputs;
+          depsBuildTargetPropagated = propagatedBuildTargetOutputs;
+          depsHostHostPropagated = propagatedHostHostOutputs;
+          propagatedBuildInputs = propagatedHostTargetOutputs;
+          depsTargetTargetPropagated = propagatedTargetTargetOutputs;
 
           # This parameter is sometimes a string, sometimes null, and sometimes a list, yuck
           configureFlags =