diff --git a/pkgs/applications/audio/radiotray-ng/default.nix b/pkgs/applications/audio/radiotray-ng/default.nix
index 9efd7bb386fb5..82bc42143c67e 100644
--- a/pkgs/applications/audio/radiotray-ng/default.nix
+++ b/pkgs/applications/audio/radiotray-ng/default.nix
@@ -23,7 +23,7 @@
 # rt2rtng
 , python2
 # Testing
-, gmock
+, gtest
 # Fixup
 , wrapGAppsHook
 , makeWrapper
@@ -58,11 +58,10 @@ stdenv.mkDerivation rec {
     libxdg_basedir
     lsb-release
     wxGTK
-  ] ++ stdenv.lib.optional doCheck gmock
-    ++ gstInputs
+  ] ++ gstInputs
     ++ pythonInputs;
 
-  prePatch = ''
+  postPatch = ''
     for x in debian/CMakeLists.txt include/radiotray-ng/common.hpp data/*.desktop; do
       substituteInPlace $x --replace /usr $out
     done
@@ -74,14 +73,16 @@ stdenv.mkDerivation rec {
       --replace radiotray-ng-notification radiotray-ng-on
   '';
 
-  cmakeFlags = stdenv.lib.optional doCheck "-DBUILD_TESTS=ON";
+  cmakeFlags = [
+    "-DBUILD_TESTS=${if doCheck then "ON" else "OFF"}"
+  ];
 
   enableParallelBuilding = true;
 
- # XXX: as of 0.2.2, tries to download gmock instead of checking for provided
-  doCheck = false;
-
+  checkInputs = [ gtest ];
   checkPhase = "ctest";
+  # doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+  doCheck = false; # fails to pick up supplied gtest, tries to download it instead
 
   preFixup = ''
     gappsWrapperArgs+=(--suffix PATH : ${stdenv.lib.makeBinPath [ dbus ]})
diff --git a/pkgs/applications/graphics/feh/default.nix b/pkgs/applications/graphics/feh/default.nix
index 91d5d2f146780..f10916bcd6318 100644
--- a/pkgs/applications/graphics/feh/default.nix
+++ b/pkgs/applications/graphics/feh/default.nix
@@ -15,8 +15,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "man" "doc" ];
 
-  nativeBuildInputs = [ makeWrapper xorg.libXt ]
-    ++ optionals doCheck [ perlPackages.TestCommand perlPackages.TestHarness ];
+  nativeBuildInputs = [ makeWrapper xorg.libXt ];
 
   buildInputs = [ xorg.libX11 xorg.libXinerama imlib2 libjpeg libpng curl libexif ];
 
@@ -36,8 +35,9 @@ stdenv.mkDerivation rec {
     install -D -m 644 man/*.1 $out/share/man/man1
   '';
 
-  checkPhase = ''
-    PERL5LIB="${perlPackages.TestCommand}/lib/perl5/site_perl" make test
+  checkInputs = [ perlPackages.TestCommand perlPackages.TestHarness ];
+  preCheck = ''
+    export PERL5LIB="${perlPackages.TestCommand}/lib/perl5/site_perl"
   '';
 
   doCheck = true;
diff --git a/pkgs/applications/misc/ranger/default.nix b/pkgs/applications/misc/ranger/default.nix
index e3a3a5e80d68a..33b8c33033ead 100644
--- a/pkgs/applications/misc/ranger/default.nix
+++ b/pkgs/applications/misc/ranger/default.nix
@@ -43,7 +43,7 @@ python3Packages.buildPythonApplication rec {
 
     # give image previews out of the box when building with w3m
     substituteInPlace ranger/config/rc.conf \
-      --replace "set preview_images false" "set preview_images true" \
+      --replace "set preview_images false" "set preview_images true"
   '';
 
   meta =  with stdenv.lib; {
diff --git a/pkgs/applications/networking/feedreaders/rsstail/default.nix b/pkgs/applications/networking/feedreaders/rsstail/default.nix
index a7fd31cac2ffe..459aee01f43f2 100644
--- a/pkgs/applications/networking/feedreaders/rsstail/default.nix
+++ b/pkgs/applications/networking/feedreaders/rsstail/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     owner = "flok99";
   };
 
-  buildInputs = [ libmrss ]
-    ++ stdenv.lib.optional doCheck cppcheck;
+  buildInputs = [ libmrss ];
+  checkInputs = [ cppcheck ];
 
   postPatch = ''
     substituteInPlace Makefile --replace -liconv_hook ""
diff --git a/pkgs/applications/networking/instant-messengers/utox/default.nix b/pkgs/applications/networking/instant-messengers/utox/default.nix
index 5955ecb60bd9c..531ca5cbadc60 100644
--- a/pkgs/applications/networking/instant-messengers/utox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/utox/default.nix
@@ -22,15 +22,16 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    check cmake pkgconfig
+    cmake pkgconfig
   ];
 
   cmakeFlags = [
     "-DENABLE_AUTOUPDATE=OFF"
-  ] ++ lib.optional (doCheck) "-DENABLE_TESTS=ON";
-
-  doCheck = stdenv.isLinux;
+    "-DENABLE_TESTS=${if doCheck then "ON" else "OFF"}"
+  ];
 
+  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+  checkInputs = [ check ];
   checkPhase = ''
     runHook preCheck
     ctest -VV
diff --git a/pkgs/applications/version-management/fossil/default.nix b/pkgs/applications/version-management/fossil/default.nix
index 396ed10392ca4..b65ada145b9e8 100644
--- a/pkgs/applications/version-management/fossil/default.nix
+++ b/pkgs/applications/version-management/fossil/default.nix
@@ -21,10 +21,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ tcl ];
 
   doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
-
-  checkTarget = "test";
-
-  preCheck = stdenv.lib.optional doCheck ''
+  preCheck = ''
     export TCLLIBPATH="${tcllib}/lib/tcllib${tcllib.version}"
   '';
   configureFlags = stdenv.lib.optional withJson "--json";
diff --git a/pkgs/applications/version-management/mr/default.nix b/pkgs/applications/version-management/mr/default.nix
index 4d7ccaf30274b..16948003a7a1e 100644
--- a/pkgs/applications/version-management/mr/default.nix
+++ b/pkgs/applications/version-management/mr/default.nix
@@ -10,6 +10,10 @@ stdenv.mkDerivation rec {
     sha256 = "15i9bs2i25l7ibv530ghy8280kklcgm5kr6j86s7iwcqqckd0czp";
   };
 
+  postPatch = ''
+    patchShebangs .
+  '';
+
   buildInputs = [ perl ];
 
   makeFlags = "PREFIX=$(out)";
diff --git a/pkgs/applications/version-management/subversion/default.nix b/pkgs/applications/version-management/subversion/default.nix
index 981f25f00f847..0a61dc38c64a4 100644
--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@@ -91,6 +91,7 @@ let
 
     enableParallelBuilding = true;
 
+    checkInputs = [ python ];
     doCheck = false; # fails 10 out of ~2300 tests
 
     meta = with stdenv.lib; {
diff --git a/pkgs/build-support/release/binary-tarball.nix b/pkgs/build-support/release/binary-tarball.nix
index f691b1bf73564..dad65a0e7eb3d 100644
--- a/pkgs/build-support/release/binary-tarball.nix
+++ b/pkgs/build-support/release/binary-tarball.nix
@@ -27,11 +27,11 @@ stdenv.mkDerivation (
     postPhases = "finalPhase";
   }
 
-  // args // 
+  // args //
 
   {
     name = name + (if src ? version then "-" + src.version else "");
-  
+
     postHook = ''
       mkdir -p $out/nix-support
       echo "$system" > $out/nix-support/system
@@ -43,7 +43,7 @@ stdenv.mkDerivation (
       if test -e $origSrc/nix-support/hydra-release-name; then
           releaseName=$(cat $origSrc/nix-support/hydra-release-name)
       fi
-      
+
       installFlagsArray=(DESTDIR=$TMPDIR/inst)
 
       # Prefix hackery because of a bug in stdenv (it tries to `mkdir
@@ -62,18 +62,18 @@ stdenv.mkDerivation (
         tar cvfj $out/tarballs/''${releaseName:-binary-dist}.tar.bz2 -C $TMPDIR/inst .
       '';
 
-                
+
     finalPhase =
       ''
         for i in $out/tarballs/*; do
             echo "file binary-dist $i" >> $out/nix-support/hydra-build-products
         done
-        
+
         # Propagate the release name of the source tarball.  This is
         # to get nice package names in channels.
         test -n "$releaseName" && (echo "$releaseName" >> $out/nix-support/hydra-release-name)
       '';
-    
+
 
     meta = (if args ? meta then args.meta else {}) // {
       description = "Build of a generic binary distribution";
diff --git a/pkgs/desktops/gnome-3/core/gcr/default.nix b/pkgs/desktops/gnome-3/core/gcr/default.nix
index 61c17a210b436..a324fda0a7e14 100644
--- a/pkgs/desktops/gnome-3/core/gcr/default.nix
+++ b/pkgs/desktops/gnome-3/core/gcr/default.nix
@@ -1,6 +1,7 @@
 { stdenv, fetchurl, pkgconfig, intltool, gnupg, p11-kit, glib
 , libgcrypt, libtasn1, dbus-glib, gtk, pango, gdk_pixbuf, atk
-, gobjectIntrospection, makeWrapper, libxslt, vala, gnome3 }:
+, gobjectIntrospection, makeWrapper, libxslt, vala, gnome3
+, python2 }:
 
 stdenv.mkDerivation rec {
   name = "gcr-${version}";
@@ -15,6 +16,10 @@ stdenv.mkDerivation rec {
     updateScript = gnome3.updateScript { packageName = "gcr"; attrPath = "gnome3.gcr"; };
   };
 
+  postPatch = ''
+    patchShebangs .
+  '';
+
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ pkgconfig intltool gobjectIntrospection libxslt makeWrapper vala ];
@@ -27,7 +32,8 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ glib gtk p11-kit ];
 
-  #doCheck = true;
+  checkInputs = [ python2 ];
+  doCheck = false; # fails 21 out of 603 tests, needs dbus daemon
 
   #enableParallelBuilding = true; issues on hydra
 
diff --git a/pkgs/desktops/gnome-3/core/gnome-keyring/default.nix b/pkgs/desktops/gnome-3/core/gnome-keyring/default.nix
index 39108141c93c5..acb32bc174cad 100644
--- a/pkgs/desktops/gnome-3/core/gnome-keyring/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-keyring/default.nix
@@ -22,14 +22,11 @@ stdenv.mkDerivation rec {
     pango gcr gdk_pixbuf atk p11-kit
   ];
 
-  # In 3.20.1, tests do not support Python 3
-  checkInputs = [ dbus python2 ];
-
   propagatedBuildInputs = [ glib libtasn1 libxslt ];
 
   nativeBuildInputs = [
     pkgconfig intltool docbook_xsl docbook_xml_dtd_42 wrapGAppsHook
-  ] ++ stdenv.lib.optionals doCheck checkInputs;
+  ];
 
   configureFlags = [
     "--with-pkcs11-config=$$out/etc/pkcs11/" # installation directories
@@ -41,6 +38,9 @@ stdenv.mkDerivation rec {
   '';
 
   doCheck = true;
+  # In 3.20.1, tests do not support Python 3
+  checkInputs = [ dbus python2 ];
+
   checkPhase = ''
     export HOME=$(mktemp -d)
     dbus-run-session \
diff --git a/pkgs/development/compilers/cmdstan/default.nix b/pkgs/development/compilers/cmdstan/default.nix
index 3f25041f1753d..2b2ae896a6d3a 100644
--- a/pkgs/development/compilers/cmdstan/default.nix
+++ b/pkgs/development/compilers/cmdstan/default.nix
@@ -10,10 +10,10 @@ stdenv.mkDerivation rec {
 
   buildFlags = "build";
   enableParallelBuilding = true;
-  nativeBuildInputs = stdenv.lib.optional doCheck python;
 
   doCheck = true;
-  checkPhase = "python ./runCmdStanTests.py src/test/interface";  # see #5368
+  checkInputs = [ python ];
+  checkPhase = "python ./runCmdStanTests.py src/test/interface"; # see #5368
 
   installPhase = ''
     mkdir -p $out/opt $out/bin
diff --git a/pkgs/development/compilers/glslang/default.nix b/pkgs/development/compilers/glslang/default.nix
index cc27d19781fe6..b2a4eda9a63e3 100644
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@@ -28,6 +28,8 @@ stdenv.mkDerivation rec {
     fi
   '';
 
+  doCheck = false; # fails 3 out of 3 tests (ctest)
+
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
     description = "Khronos reference front-end for GLSL and ESSL";
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index f3dc248702720..510688ef41646 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, pkgconfig, flex, bison, libxslt, autoconf, graphviz
+{ stdenv, lib, fetchurl, pkgconfig, flex, bison, libxslt, autoconf, automake, graphviz
 , glib, libiconv, libintl, libtool, expat
 }:
 
@@ -7,13 +7,18 @@ let
   let
     atLeast = lib.versionAtLeast "${major}.${minor}";
   in stdenv.mkDerivation rec {
-    name = "vala-${major}.${minor}";
+    name = "vala-${version}";
+    version = "${major}.${minor}";
 
     src = fetchurl {
       url = "mirror://gnome/sources/vala/${major}/${name}.tar.xz";
       inherit sha256;
     };
 
+    postPatch = ''
+      patchShebangs tests
+    '';
+
     outputs = [ "out" "devdoc" ];
 
     nativeBuildInputs = [
@@ -26,6 +31,8 @@ let
     ] ++ lib.optional (atLeast "0.38") graphviz
       ++ extraBuildInputs;
 
+    doCheck = false; # fails, requires dbus daemon
+
     meta = with stdenv.lib; {
       description = "Compiler for GObject type system";
       homepage = https://wiki.gnome.org/Projects/Vala;
diff --git a/pkgs/development/guile-modules/guile-cairo/default.nix b/pkgs/development/guile-modules/guile-cairo/default.nix
index f5e000f3980c1..32a22566bdb11 100644
--- a/pkgs/development/guile-modules/guile-cairo/default.nix
+++ b/pkgs/development/guile-modules/guile-cairo/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
 
-  buildInputs = [ guile cairo expat ]
-    ++ stdenv.lib.optional doCheck guile-lib;
+  buildInputs = [ guile cairo expat ];
+  checkInputs = [ guile-lib ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/apr/default.nix b/pkgs/development/libraries/apr/default.nix
index ecdeb35f6edaa..7d7acf90a95c2 100644
--- a/pkgs/development/libraries/apr/default.nix
+++ b/pkgs/development/libraries/apr/default.nix
@@ -10,6 +10,11 @@ stdenv.mkDerivation rec {
 
   patches = stdenv.lib.optionals stdenv.isDarwin [ ./is-this-a-compiler-bug.patch ];
 
+  # This test needs the net
+  postPatch = ''
+    rm test/testsock.*
+  '';
+
   outputs = [ "out" "dev" ];
   outputBin = "dev";
 
diff --git a/pkgs/development/libraries/clucene-core/2.x.nix b/pkgs/development/libraries/clucene-core/2.x.nix
index 0ba9e1545fbf0..0db253bbec263 100644
--- a/pkgs/development/libraries/clucene-core/2.x.nix
+++ b/pkgs/development/libraries/clucene-core/2.x.nix
@@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
         $out/lib/libclucene-core.1.dylib
   '';
 
+  doCheck = false; # fails with "Unable to find executable: /build/clucene-core-2.3.3.4/build/bin/cl_test"
+
   meta = {
     description = "Core library for full-featured text search engine";
     longDescription = ''
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index e763e5c1159ca..4bb995ff0743e 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -194,11 +194,11 @@ stdenv.mkDerivation rec {
     description = "A complete, cross-platform solution to record, convert and stream audio and video";
     homepage = http://www.ffmpeg.org/;
     longDescription = ''
-      FFmpeg is the leading multimedia framework, able to decode, encode, transcode, 
-      mux, demux, stream, filter and play pretty much anything that humans and machines 
-      have created. It supports the most obscure ancient formats up to the cutting edge. 
-      No matter if they were designed by some standards committee, the community or 
-      a corporation. 
+      FFmpeg is the leading multimedia framework, able to decode, encode, transcode,
+      mux, demux, stream, filter and play pretty much anything that humans and machines
+      have created. It supports the most obscure ancient formats up to the cutting edge.
+      No matter if they were designed by some standards committee, the community or
+      a corporation.
     '';
     license = licenses.gpl3;
     platforms = platforms.all;
diff --git a/pkgs/development/libraries/fftw/default.nix b/pkgs/development/libraries/fftw/default.nix
index 12b30cf0349fb..bc5de5f9730fa 100644
--- a/pkgs/development/libraries/fftw/default.nix
+++ b/pkgs/development/libraries/fftw/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, lib, precision ? "double" }:
+{ fetchurl, stdenv, lib, precision ? "double", perl }:
 
 with lib;
 
@@ -38,6 +38,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  checkInputs = [ perl ];
+
   meta = with stdenv.lib; {
     description = "Fastest Fourier Transform in the West library";
     homepage = http://www.fftw.org/;
diff --git a/pkgs/development/libraries/gd/default.nix b/pkgs/development/libraries/gd/default.nix
index 77fe948e003a3..5ceded0546c5b 100644
--- a/pkgs/development/libraries/gd/default.nix
+++ b/pkgs/development/libraries/gd/default.nix
@@ -35,6 +35,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  doCheck = false; # fails 2 tests
+
   meta = with stdenv.lib; {
     homepage = https://libgd.github.io/;
     description = "A dynamic image creation library";
diff --git a/pkgs/development/libraries/glibmm/default.nix b/pkgs/development/libraries/glibmm/default.nix
index 3c3b49e661619..ee77f4b498e41 100644
--- a/pkgs/development/libraries/glibmm/default.nix
+++ b/pkgs/development/libraries/glibmm/default.nix
@@ -26,7 +26,8 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ glib libsigcxx ];
 
   enableParallelBuilding = true;
-  #doCheck = true; # some tests need network
+
+  doCheck = false; # fails. one test needs the net, another /etc/fstab
 
   meta = with stdenv.lib; {
     description = "C++ interface to the GLib library";
diff --git a/pkgs/development/libraries/glog/default.nix b/pkgs/development/libraries/glog/default.nix
index 93e94fc8c42bb..b030eab7c3ad7 100644
--- a/pkgs/development/libraries/glog/default.nix
+++ b/pkgs/development/libraries/glog/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook }:
+{ stdenv, fetchFromGitHub, autoreconfHook, perl }:
 
 stdenv.mkDerivation rec {
   name = "glog-${version}";
@@ -13,6 +13,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
 
+  checkInputs = [ perl ];
+  doCheck = false; # fails with "Mangled symbols (28 out of 380) found in demangle.dm"
+
   meta = with stdenv.lib; {
     homepage = https://github.com/google/glog;
     license = licenses.bsd3;
diff --git a/pkgs/development/libraries/gmime/2.nix b/pkgs/development/libraries/gmime/2.nix
index 7d5eeb29997b1..b25f5c90bfaec 100644
--- a/pkgs/development/libraries/gmime/2.nix
+++ b/pkgs/development/libraries/gmime/2.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, glib, zlib, libgpgerror, gobjectIntrospection }:
+{ stdenv, fetchurl, pkgconfig, glib, zlib, gnupg, libgpgerror, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
   version = "2.6.23";
@@ -15,6 +15,17 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ glib zlib libgpgerror ];
   configureFlags = [ "--enable-introspection=yes" ];
 
+  postPatch = ''
+    substituteInPlace tests/testsuite.c \
+      --replace /bin/rm rm \
+      --replace /bin/mkdir mkdir
+
+    substituteInPlace tests/test-pkcs7.c \
+      --replace /bin/mkdir mkdir
+  '';
+
+  checkInputs = [ gnupg ];
+
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/gmime/3.nix b/pkgs/development/libraries/gmime/3.nix
index 124fc08cf3bde..65c99610a5c73 100644
--- a/pkgs/development/libraries/gmime/3.nix
+++ b/pkgs/development/libraries/gmime/3.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, glib, zlib, gpgme, libidn, gobjectIntrospection }:
+{ stdenv, fetchurl, pkgconfig, glib, zlib, gnupg, gpgme, libidn, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
   version = "3.2.0";
@@ -16,6 +16,13 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ glib ];
   configureFlags = [ "--enable-introspection=yes" ];
 
+  postPatch = ''
+    substituteInPlace tests/testsuite.c \
+      --replace /bin/rm rm
+  '';
+
+  checkInputs = [ gnupg ];
+
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index e7da60a9d1a22..b3b00a1c72264 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -44,6 +44,10 @@ stdenv.mkDerivation rec {
     # https://www.gnupg.org/documentation/manuals/gpgme/Largefile-Support-_0028LFS_0029.html
     ++ lib.optional (system == "i686-linux") "-D_FILE_OFFSET_BITS=64";
 
+  checkInputs = [ which ];
+
+  doCheck = false; # fails 8 out of 26 tests with "GPGME: Decryption failed". Spooky!
+
   meta = with stdenv.lib; {
     homepage = https://gnupg.org/software/gpgme/index.html;
     description = "Library for making GnuPG easier to use";
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 49216b70fe12f..dd4007bd142bd 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -57,6 +57,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  doCheck = false; # fails, wants DRI access for OpenGL
+
   patches = [
     (fetchpatch {
         url = "https://bug794856.bugzilla-attachments.gnome.org/attachment.cgi?id=370414";
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index ad7309be04453..99d27523b1c9d 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -54,4 +54,7 @@ stdenv.mkDerivation rec {
   ++ optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Cocoa ]
   ++ optionals stdenv.isLinux [ libv4l libpulseaudio libavc1394 libiec61883 ];
 
+  # fails 1 tests with "Unexpected critical/warning: g_object_set_is_valid_property: object class 'GstRtpStorage' has no property named ''"
+  doCheck = false;
+
 }
diff --git a/pkgs/development/libraries/gstreamer/legacy/gst-plugins-good/default.nix b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-good/default.nix
index 9c47ef0260b4e..7ecb6c34b4327 100644
--- a/pkgs/development/libraries/gstreamer/legacy/gst-plugins-good/default.nix
+++ b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-good/default.nix
@@ -36,6 +36,9 @@ stdenv.mkDerivation rec {
       --replace "${ncurses.dev}/lib" "${ncurses.out}/lib"
   '';
 
+  # fails 1 out of 65 tests with "Could not read TLS certificate from '../../tests/files/test-cert.pem': TLS support is not available"
+  doCheck = false;
+
   meta = {
     homepage = https://gstreamer.freedesktop.org;
 
diff --git a/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix b/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix
index 9f1048f2de56d..d4d4082509e4b 100644
--- a/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix
+++ b/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix
@@ -17,23 +17,22 @@ stdenv.mkDerivation rec {
   buildInputs = [ perl bison flex ];
   propagatedBuildInputs = [ glib libxml2 ];
 
-  patchPhase = ''
+  # See https://trac.macports.org/ticket/40783 for explanation of patch
+  patches = stdenv.lib.optional stdenv.isDarwin ./darwin.patch;
+
+  postPatch = ''
     sed -i -e 's/^   /\t/' docs/gst/Makefile.in docs/libs/Makefile.in docs/plugins/Makefile.in
-  ''
-  + stdenv.lib.optionalString stdenv.isDarwin ''
-    # Applying this patch manually to avoid a rebuild on Linux. Feel free to refactor later
-    # See https://trac.macports.org/ticket/40783 for explanation of patch
-    patch -p1 < ${./darwin.patch}
   '';
 
   configureFlags = [
     "--disable-examples"
-    "--enable-failing-tests"
     "--localstatedir=/var"
     "--disable-gtk-doc"
     "--disable-docbook"
   ];
 
+  doCheck = false; # fails. 2 tests crash
+
   postInstall = ''
     # Hm, apparently --disable-gtk-doc is ignored...
     rm -rf $out/share/gtk-doc
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index a0160a8440daa..24260234116bd 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -2,6 +2,7 @@
 , icu, graphite2, harfbuzz # The icu variant uses and propagates the non-icu one.
 , withIcu ? false # recommended by upstream as default, but most don't needed and it's big
 , withGraphite2 ? true # it is small and major distros do include it
+, python
 }:
 
 let
@@ -17,6 +18,11 @@ stdenv.mkDerivation {
     sha256 = "0my6m9aqv4a8fc2pjwqx9pfdfh3a9mqvas4si4psi1b1867zi8y8";
   };
 
+  postPatch = ''
+    patchShebangs src/gen-def.py
+    patchShebangs test
+  '';
+
   outputs = [ "out" "dev" ];
   outputBin = "dev";
 
@@ -29,8 +35,10 @@ stdenv.mkDerivation {
   buildInputs = [ glib freetype cairo ]; # recommended by upstream
   propagatedBuildInputs = []
     ++ optional withGraphite2 graphite2
-    ++ optionals withIcu [ icu harfbuzz ]
-    ;
+    ++ optionals withIcu [ icu harfbuzz ];
+
+  checkInputs = [ python ];
+  doInstallCheck = false; # fails, probably a bug
 
   # Slightly hacky; some pkgs expect them in a single directory.
   postInstall = optionalString withIcu ''
diff --git a/pkgs/development/libraries/hunspell/default.nix b/pkgs/development/libraries/hunspell/default.nix
index ecbfbb7da0b85..b3914a4438b3c 100644
--- a/pkgs/development/libraries/hunspell/default.nix
+++ b/pkgs/development/libraries/hunspell/default.nix
@@ -14,6 +14,10 @@ stdenv.mkDerivation rec {
   buildInputs = [ ncurses readline ];
   nativeBuildInputs = [ autoreconfHook ];
 
+  postPatch = ''
+    patchShebangs tests
+  '';
+
   autoreconfFlags = "-vfi";
 
   configureFlags = [ "--with-ui" "--with-readline" ];
diff --git a/pkgs/development/libraries/jbig2dec/default.nix b/pkgs/development/libraries/jbig2dec/default.nix
index b9dcc927172f6..cc838be0f4f0f 100644
--- a/pkgs/development/libraries/jbig2dec/default.nix
+++ b/pkgs/development/libraries/jbig2dec/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, python }:
 
 stdenv.mkDerivation rec {
   name = "jbig2dec-0.14";
@@ -8,6 +8,13 @@ stdenv.mkDerivation rec {
     sha256 = "0k01hp0q4275fj4rbr1gy64svfraw5w7wvwl08yjhvsnpb1rid11";
   };
 
+  postPatch = ''
+    patchShebangs test_jbig2dec.py
+  '';
+
+  checkInputs = [ python ];
+  doCheck = false; # fails 1 of 4 tests
+
   meta = {
     homepage = https://www.ghostscript.com/jbig2dec.html;
     description = "Decoder implementation of the JBIG2 image compression format";
diff --git a/pkgs/development/libraries/ldns/default.nix b/pkgs/development/libraries/ldns/default.nix
index e9d81d3ab7851..c4120e5bb0eb8 100644
--- a/pkgs/development/libraries/ldns/default.nix
+++ b/pkgs/development/libraries/ldns/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, openssl, perl, dns-root-data }:
+{ stdenv, fetchurl, fetchpatch, openssl, perl, which, dns-root-data }:
 
 stdenv.mkDerivation rec {
   pname = "ldns";
@@ -45,6 +45,9 @@ stdenv.mkDerivation rec {
     "ac_cv_func_realloc_0_nonnull=yes"
   ];
 
+  checkInputs = [ which ];
+  doCheck = false; # fails. missing some files
+
   postInstall = ''
     moveToOutput "bin/ldns-config" "$dev"
 
diff --git a/pkgs/development/libraries/libappindicator/default.nix b/pkgs/development/libraries/libappindicator/default.nix
index 71c388be6ea52..8bf0e4bcb93c5 100644
--- a/pkgs/development/libraries/libappindicator/default.nix
+++ b/pkgs/development/libraries/libappindicator/default.nix
@@ -61,6 +61,8 @@ in stdenv.mkDerivation rec {
       --replace /usr/bin/file ${file}/bin/file
   '';
 
+  doCheck = false; # generates shebangs in check phase, too lazy to fix
+
   installFlags = [
     "sysconfdir=\${out}/etc"
     "localstatedir=\${TMPDIR}"
diff --git a/pkgs/development/libraries/libcdio/default.nix b/pkgs/development/libraries/libcdio/default.nix
index bb81721feeaec..9dc3c1d11ba1d 100644
--- a/pkgs/development/libraries/libcdio/default.nix
+++ b/pkgs/development/libraries/libcdio/default.nix
@@ -8,12 +8,15 @@ stdenv.mkDerivation rec {
     sha256 = "0jr8ppdm80c533nzmrpz3iffnpc6nhvsria1di9f4jg1l19a03fd";
   };
 
+  postPatch = ''
+    patchShebangs .
+  '';
+
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libcddb ncurses help2man ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ libiconv Carbon IOKit ];
 
-  # Disabled due to several spurious test failures.
-  # doCheck = true;
+  doCheck = true;
 
   meta = with stdenv.lib; {
     description = "A library for OS-independent CD-ROM and CD image access";
diff --git a/pkgs/development/libraries/libdbusmenu/default.nix b/pkgs/development/libraries/libdbusmenu/default.nix
index 220cc5a2eeb42..730cef6f6960e 100644
--- a/pkgs/development/libraries/libdbusmenu/default.nix
+++ b/pkgs/development/libraries/libdbusmenu/default.nix
@@ -46,6 +46,8 @@ stdenv.mkDerivation rec {
     "--disable-scrollkeeper"
   ] ++ optional (gtkVersion != "2") "--disable-dumper";
 
+  doCheck = false; # generates shebangs in check phase, too lazy to fix
+
   installFlags = [
     "sysconfdir=\${out}/etc"
     "localstatedir=\${TMPDIR}"
diff --git a/pkgs/development/libraries/libdevil/default.nix b/pkgs/development/libraries/libdevil/default.nix
index f88d20bee7036..78e7490cd992a 100644
--- a/pkgs/development/libraries/libdevil/default.nix
+++ b/pkgs/development/libraries/libdevil/default.nix
@@ -42,6 +42,13 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  postPatch = ''
+    for a in test/Makefile.in test/format_test/format_checks.sh.in ; do
+      substituteInPlace $a \
+        --replace /bin/bash ${stdenv.shell}
+    done
+  '';
+
   meta = with stdenv.lib; {
     homepage = http://openil.sourceforge.net/;
     description = "An image library which can can load, save, convert, manipulate, filter and display a wide variety of image formats";
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index bedbce938bcb2..5107d8898d463 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -16,6 +16,12 @@ stdenv.mkDerivation rec {
 
   patches = stdenv.lib.optional stdenv.isDarwin ./libdrm-apple.patch;
 
+  postPatch = ''
+    for a in */*-symbol-check ; do
+      patchShebangs $a
+    done
+  '';
+
   preConfigure = stdenv.lib.optionalString stdenv.isDarwin
     "echo : \\\${ac_cv_func_clock_gettime=\'yes\'} > config.cache";
 
diff --git a/pkgs/development/libraries/libfaketime/default.nix b/pkgs/development/libraries/libfaketime/default.nix
index cedd5f98027af..cc9db8f7e661e 100644
--- a/pkgs/development/libraries/libfaketime/default.nix
+++ b/pkgs/development/libraries/libfaketime/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, bash, perl }:
 
 stdenv.mkDerivation rec {
   name = "libfaketime-${version}";
@@ -13,10 +13,20 @@ stdenv.mkDerivation rec {
     ./no-date-in-gzip-man-page.patch
   ];
 
+  postPatch = ''
+    patchShebangs test src
+    for a in test/functests/test_exclude_mono.sh src/faketime.c ; do
+      substituteInPlace $a \
+        --replace /bin/bash ${stdenv.shell}
+    done
+  '';
+
   preBuild = ''
     makeFlagsArray+=(PREFIX="$out" LIBDIRNAME=/lib)
   '';
 
+  checkInputs = [ perl ];
+
   meta = with stdenv.lib; {
     description = "Report faked system time to programs without having to change the system-wide time";
     homepage = "https://github.com/wolfcw/libfaketime/";
diff --git a/pkgs/development/libraries/libgsf/default.nix b/pkgs/development/libraries/libgsf/default.nix
index 90daf2ddf7434..20a08885142a6 100644
--- a/pkgs/development/libraries/libgsf/default.nix
+++ b/pkgs/development/libraries/libgsf/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig intltool libintl ];
 
-  buildInputs = [ gettext bzip2 zlib python ]
-    ++ stdenv.lib.optional doCheck perl;
+  buildInputs = [ gettext bzip2 zlib python ];
+  checkInputs = [ perl ];
 
   propagatedBuildInputs = [ libxml2 glib gdk_pixbuf libiconv ];
 
diff --git a/pkgs/development/libraries/libminc/default.nix b/pkgs/development/libraries/libminc/default.nix
index ddab3439f02a0..1e13f3238222a 100644
--- a/pkgs/development/libraries/libminc/default.nix
+++ b/pkgs/development/libraries/libminc/default.nix
@@ -14,21 +14,26 @@ stdenv.mkDerivation rec {
     sha256 = "0mn4n3ihzcr1jw2g1vy6c8p4lkc88jwljk04argmj7k4djrgpxpa";
   };
 
+  postPatch = ''
+    patchShebangs .
+  '';
+
   nativeBuildInputs = [ cmake ];
   buildInputs = [ zlib netcdf nifticlib hdf5 ];
 
-  cmakeFlags = [ "-DBUILD_TESTING=${if doCheck then "TRUE" else "FALSE"}"
-                 "-DLIBMINC_MINC1_SUPPORT=TRUE"
-                 "-DLIBMINC_BUILD_SHARED_LIBS=TRUE"
-                 "-DLIBMINC_USE_SYSTEM_NIFTI=TRUE" ];
-
+  cmakeFlags = [
+    "-DBUILD_TESTING=${if doCheck then "ON" else "OFF"}"
+    "-DLIBMINC_MINC1_SUPPORT=ON"
+    "-DLIBMINC_BUILD_SHARED_LIBS=ON"
+    "-DLIBMINC_USE_SYSTEM_NIFTI=ON"
+  ];
 
+  doCheck = stdenv.buildPlatform == stdenv.hostPlatform;
   checkPhase = ''
     export LD_LIBRARY_PATH="$(pwd)"  # see #22060
     ctest -E 'ezminc_rw_test|minc_conversion' --output-on-failure
     # ezminc_rw_test can't find libminc_io.so.5.2.0; minc_conversion hits netcdf compilation issue
   '';
-  doCheck = true;
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libndctl/default.nix b/pkgs/development/libraries/libndctl/default.nix
index 79439f822696d..b53920f60b8b8 100644
--- a/pkgs/development/libraries/libndctl/default.nix
+++ b/pkgs/development/libraries/libndctl/default.nix
@@ -31,6 +31,10 @@ in stdenv.mkDerivation rec {
     })
   ];
 
+  postPatch = ''
+    patchShebangs test
+  '';
+
   preAutoreconf = ''
     substituteInPlace configure.ac --replace "which" "${which}/bin/which"
     substituteInPlace git-version --replace /bin/bash ${stdenv.shell}
diff --git a/pkgs/development/libraries/libosinfo/default.nix b/pkgs/development/libraries/libosinfo/default.nix
index 0175e21bbc729..111bea61eb654 100644
--- a/pkgs/development/libraries/libosinfo/default.nix
+++ b/pkgs/development/libraries/libosinfo/default.nix
@@ -14,9 +14,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkgconfig vala intltool gobjectIntrospection gtk-doc docbook_xsl
-  ] ++ stdenv.lib.optionals doCheck checkInputs;
-  checkInputs = [ check curl perl ];
+  ];
   buildInputs = [ glib libsoup libxml2 libxslt ];
+  checkInputs = [ check curl perl ];
 
   patches = [
     ./osinfo-db-data-dir.patch
diff --git a/pkgs/development/libraries/libpng/default.nix b/pkgs/development/libraries/libpng/default.nix
index 4173588ac522a..0e5a4a866e8ff 100644
--- a/pkgs/development/libraries/libpng/default.nix
+++ b/pkgs/development/libraries/libpng/default.nix
@@ -3,9 +3,7 @@
 assert zlib != null;
 
 let
-  version = "1.6.34";
   patchVersion = "1.6.34";
-  sha256 = "1xjr0v34fyjgnhvaa1zixcpx5yvxcg4zwvfh0fyklfyfj86rc7ig";
   patch_src = fetchurl {
     url = "mirror://sourceforge/libpng-apng/libpng-${patchVersion}-apng.patch.gz";
     sha256 = "1ha4npf9mfrzp0srg8a5amks5ww84xzfpjbsj8k3yjjpai798qg6";
@@ -14,10 +12,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "libpng" + whenPatched "-apng" + "-${version}";
+  version = "1.6.34";
 
   src = fetchurl {
     url = "mirror://sourceforge/libpng/libpng-${version}.tar.xz";
-    inherit sha256;
+    sha256 = "1xjr0v34fyjgnhvaa1zixcpx5yvxcg4zwvfh0fyklfyfj86rc7ig";
   };
   postPatch = whenPatched "gunzip < ${patch_src} | patch -Np1";
 
@@ -26,9 +25,7 @@ in stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ zlib ];
 
-  # it's hard to cross-run tests and some check programs didn't compile anyway
-  makeFlags = stdenv.lib.optional (!doCheck) "check_PROGRAMS=";
-  doCheck = true; # not cross;
+  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
 
   passthru = { inherit zlib; };
 
diff --git a/pkgs/development/libraries/librdf/redland.nix b/pkgs/development/libraries/librdf/redland.nix
index 633611273a30e..422ace462a942 100644
--- a/pkgs/development/libraries/librdf/redland.nix
+++ b/pkgs/development/libraries/librdf/redland.nix
@@ -36,6 +36,8 @@ stdenv.mkDerivation rec {
   # Fix broken DT_NEEDED in lib/redland/librdf_storage_sqlite.so.
   NIX_CFLAGS_LINK = "-lraptor2";
 
+  doCheck = false; # fails 1 out of 17 tests with a segmentation fault
+
   meta = {
     homepage = http://librdf.org/;
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/development/libraries/libseccomp/default.nix b/pkgs/development/libraries/libseccomp/default.nix
index e0c77a0cf357c..c8d9e21366dfc 100644
--- a/pkgs/development/libraries/libseccomp/default.nix
+++ b/pkgs/development/libraries/libseccomp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, getopt, makeWrapper }:
+{ stdenv, fetchurl, getopt, makeWrapper, utillinux }:
 
 stdenv.mkDerivation rec {
   name = "libseccomp-${version}";
@@ -17,6 +17,9 @@ stdenv.mkDerivation rec {
     patchShebangs .
   '';
 
+  checkInputs = [ utillinux ];
+  doCheck = false; # dependency cycle
+
   # Hack to ensure that patchelf --shrink-rpath get rids of a $TMPDIR reference.
   preFixup = "rm -rfv src";
 
diff --git a/pkgs/development/libraries/libsecret/default.nix b/pkgs/development/libraries/libsecret/default.nix
index f311d1a033533..fde3c7a7b30e0 100644
--- a/pkgs/development/libraries/libsecret/default.nix
+++ b/pkgs/development/libraries/libsecret/default.nix
@@ -1,10 +1,9 @@
 { stdenv, fetchurl, glib, pkgconfig, intltool, libxslt, docbook_xsl
 , libgcrypt, gobjectIntrospection, vala_0_38, gnome3, libintl }:
-let
+
+stdenv.mkDerivation rec {
   pname = "libsecret";
   version = "0.18.5";
-in
-stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
@@ -12,6 +11,10 @@ stdenv.mkDerivation rec {
     sha256 = "1cychxc3ff8fp857iikw0n2s13s2mhw2dn1mr632f7w3sn6vvrww";
   };
 
+  postPatch = ''
+    patchShebangs .
+  '';
+
   outputs = [ "out" "dev" ];
 
   propagatedBuildInputs = [ glib ];
@@ -19,6 +22,10 @@ stdenv.mkDerivation rec {
   buildInputs = [ libgcrypt gobjectIntrospection vala_0_38 ];
   # optional: build docs with gtk-doc? (probably needs a flag as well)
 
+  # checkInputs = [ python2 ];
+
+  doCheck = false; # fails. with python3 tests fail to evaluate, with python2 they fail to run python3
+
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
diff --git a/pkgs/development/libraries/libsoup/default.nix b/pkgs/development/libraries/libsoup/default.nix
index f9ea73089f4c3..2804486e2f0a5 100644
--- a/pkgs/development/libraries/libsoup/default.nix
+++ b/pkgs/development/libraries/libsoup/default.nix
@@ -3,22 +3,19 @@
 , valaSupport ? true, vala_0_40
 , intltool, python3 }:
 
-let
-  pname = "libsoup";
-  version = "2.62.2";
-in
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
+  pname = "libsoup";
+  version = "2.62.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${name}.tar.xz";
     sha256 = "1dkrz1iwsswscayfmjxqv2q00b87snlq9nxdccn5vck0vbinylwy";
   };
 
-  prePatch = ''
+  postPatch = ''
     patchShebangs libsoup/
-  '' + stdenv.lib.optionalString valaSupport
-  ''
+  '' + stdenv.lib.optionalString valaSupport ''
      substituteInPlace libsoup/Makefile.in --replace "\$(DESTDIR)\$(vapidir)" "\$(DESTDIR)\$(girdir)/../vala/vapi"
   '';
 
diff --git a/pkgs/development/libraries/libtoxcore/default.nix b/pkgs/development/libraries/libtoxcore/default.nix
index a005c8b374658..994d228467731 100644
--- a/pkgs/development/libraries/libtoxcore/default.nix
+++ b/pkgs/development/libraries/libtoxcore/default.nix
@@ -30,8 +30,6 @@ let
     enableParallelBuilding = true;
 
     doCheck = false; # hangs, tries to access the net?
-
-    # for some reason the tests are not running - it says "No tests found!!"
     checkInputs = [ check ];
     checkPhase = "ctest";
 
diff --git a/pkgs/development/libraries/liburcu/default.nix b/pkgs/development/libraries/liburcu/default.nix
index 85f8b6df2959d..58da13044523e 100644
--- a/pkgs/development/libraries/liburcu/default.nix
+++ b/pkgs/development/libraries/liburcu/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "01pbg67qy5hcssy2yi0ckqapzfclgdq93li2rmzw4pa3wh5j42cw";
   };
 
-  nativeBuildInputs = stdenv.lib.optional doCheck perl;
+  checkInputs = [ perl ];
 
   preCheck = "patchShebangs tests/unit";
   doCheck = true;
diff --git a/pkgs/development/libraries/libzip/default.nix b/pkgs/development/libraries/libzip/default.nix
index 76f5d6567dd36..50ed00711df7b 100644
--- a/pkgs/development/libraries/libzip/default.nix
+++ b/pkgs/development/libraries/libzip/default.nix
@@ -9,13 +9,19 @@ stdenv.mkDerivation rec {
     sha256 = "1633dvjc08zwwhzqhnv62rjf1abx8y5njmm8y16ik9iwd07ka6d9";
   };
 
+  postPatch = ''
+    patchShebangs test-driver
+    patchShebangs man/handle_links
+  '';
+
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ perl ];
   propagatedBuildInputs = [ zlib ];
 
-  preInstall = ''
-    patchShebangs man/handle_links
+  preCheck = ''
+    # regress/runtests is a generated file
+    patchShebangs regress
   '';
 
   # At least mysqlWorkbench cannot find zipconf.h; I think also openoffice
diff --git a/pkgs/development/libraries/lightning/default.nix b/pkgs/development/libraries/lightning/default.nix
index 8e38b7b619270..2ad14efa32233 100644
--- a/pkgs/development/libraries/lightning/default.nix
+++ b/pkgs/development/libraries/lightning/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0sbs2lm8b9in2m8d52zf0x9gpp40x6r7sl6sha92yq3pr78rwa4v";
   };
 
-  buildInputs = stdenv.lib.optional doCheck libopcodes;
+  checkInputs = [ libopcodes ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/netcdf/default.nix b/pkgs/development/libraries/netcdf/default.nix
index 8446a91cceca4..7d0e934d911c2 100644
--- a/pkgs/development/libraries/netcdf/default.nix
+++ b/pkgs/development/libraries/netcdf/default.nix
@@ -16,6 +16,15 @@ in stdenv.mkDerivation rec {
     sha256 = "0hi61cdihwwvz5jz1l7yq712j7ca1cj4bhr8x0x7c2vlb1s9biw9";
   };
 
+  postPatch = ''
+    patchShebangs .
+
+    # this test requires the net
+    for a in ncdap_test/Makefile.am ncdap_test/Makefile.in; do
+      substituteInPlace $a --replace testurl.sh " "
+    done
+  '';
+
   nativeBuildInputs = [ m4 ];
   buildInputs = [ hdf5 curl mpi ];
 
diff --git a/pkgs/development/libraries/nlohmann_json/default.nix b/pkgs/development/libraries/nlohmann_json/default.nix
index 0e9ff5d9105e7..8db3a3d92ff65 100644
--- a/pkgs/development/libraries/nlohmann_json/default.nix
+++ b/pkgs/development/libraries/nlohmann_json/default.nix
@@ -15,9 +15,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  doCheck = stdenv.buildPlatform == stdenv.hostPlatform;
-  checkTarget = "test";
-
   enableParallelBuilding = true;
 
   cmakeFlags = [
@@ -26,6 +23,8 @@ stdenv.mkDerivation rec {
     "-DCMAKE_SYSTEM_NAME=Windows"
   ];
 
+  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+
   meta = with stdenv.lib; {
     description = "Header only C++ library for the JSON file format";
     homepage = https://github.com/nlohmann/json;
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index 5387272a2f050..4e9dab79e4e96 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -55,6 +55,11 @@ in stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = "-Wno-error";
 
+  # TODO(@oxij): investigate this: `make -n check` works but `make
+  # check` fails with "no rule", same for "installcheck".
+  doCheck = false;
+  doInstallCheck = false;
+
   postInstall = ''
     rm -rf $out/private
     mv $out/public $out/include
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 35538b99060e4..7f8f222c00ea5 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -24,11 +24,19 @@ let
       ++ optional (versionOlder version "1.0.2" && hostPlatform.isDarwin)
            ./darwin-arch.patch;
 
-  postPatch = if (versionAtLeast version "1.1.0" && stdenv.hostPlatform.isMusl) then ''
-    substituteInPlace crypto/async/arch/async_posix.h \
-      --replace '!defined(__ANDROID__) && !defined(__OpenBSD__)' \
-                '!defined(__ANDROID__) && !defined(__OpenBSD__) && 0'
-  '' else null;
+    postPatch = ''
+      patchShebangs Configure
+    '' + optionalString (versionOlder version "1.1.0") ''
+      patchShebangs test/*
+      for a in test/t* ; do
+        substituteInPlace "$a" \
+          --replace /bin/rm rm
+      done
+    '' + optionalString (versionAtLeast version "1.1.0" && stdenv.hostPlatform.isMusl) ''
+      substituteInPlace crypto/async/arch/async_posix.h \
+        --replace '!defined(__ANDROID__) && !defined(__OpenBSD__)' \
+                  '!defined(__ANDROID__) && !defined(__OpenBSD__) && 0'
+    '';
 
     outputs = [ "bin" "dev" "out" "man" ];
     setOutputFlags = false;
@@ -38,6 +46,7 @@ let
     buildInputs = stdenv.lib.optional withCryptodev cryptodevHeaders;
 
     # TODO(@Ericson2314): Improve with mass rebuild
+    configurePlatforms = [];
     configureScript = {
         "x86_64-darwin"  = "./Configure darwin64-x86_64-cc";
         "x86_64-solaris" = "./Configure solaris64-x86_64-gcc";
@@ -56,13 +65,6 @@ let
           throw "Not sure what configuration to use for ${hostPlatform.config}"
       );
 
-    # TODO(@Ericson2314): Make unconditional on mass rebuild
-    ${if buildPlatform != hostPlatform then "configurePlatforms" else null} = [];
-
-    preConfigure = ''
-      patchShebangs Configure
-    '';
-
     configureFlags = [
       "shared" # "shared" builds both shared and static libraries
       "--libdir=lib"
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index a9a8c5c2563e8..28f8a221700d7 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -31,6 +31,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = optional stdenv.isDarwin "--without-x";
 
+  doCheck = false; # fails 1 out of 12 tests with "Fontconfig error: Cannot load default config file"
+
   meta = with stdenv.lib; {
     description = "A library for laying out and rendering of text, with an emphasis on internationalization";
 
diff --git a/pkgs/development/libraries/pcre2/default.nix b/pkgs/development/libraries/pcre2/default.nix
index e0819cde679b6..49357a5970c0e 100644
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "bin" "dev" "out" "doc" "man" "devdoc" ];
 
+  doCheck = false; # fails 1 out of 3 tests, looks like a bug
+
   postFixup = ''
     moveToOutput bin/pcre2-config "$dev"
   '';
diff --git a/pkgs/development/libraries/pixman/default.nix b/pkgs/development/libraries/pixman/default.nix
index 2987c67ae757a..af4e12a014b7c 100644
--- a/pkgs/development/libraries/pixman/default.nix
+++ b/pkgs/development/libraries/pixman/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ]
     ++ stdenv.lib.optionals stdenv.cc.isClang [ autoconf automake libtool autoreconfHook ];
 
-  buildInputs = stdenv.lib.optional doCheck libpng;
+  buildInputs = [ libpng ];
 
   configureFlags = stdenv.lib.optional stdenv.isAarch32 "--disable-arm-iwmmxt";
 
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebkit.nix b/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
index 62da679157f01..833433fabecae 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
@@ -17,6 +17,9 @@ let
       url = "http://dev-www.libreoffice.org/src/5ade6ae2a99bc1e9e57031ca88d36dad-${name}.tar.gz";
       sha256 = "304636d4eccd81a14b6914d07b84c79ebb815288c76fe027b9ebff6ff24d5705";
     };
+    postPatch = ''
+      patchShebangs tests
+    '';
     buildInputs = [ perl ];
   };
 in
@@ -60,6 +63,8 @@ qtModule {
       ]
     ++ optional (!stdenv.isDarwin) ''-DNIXPKGS_LIBUDEV="${getLib systemd}/lib/libudev"'';
 
+  doCheck = false; # fails 13 out of 13 tests (ctest)
+
   # Hack to avoid TMPDIR in RPATHs.
   preFixup = ''rm -rf "$(pwd)" && mkdir "$(pwd)" '';
 
diff --git a/pkgs/development/libraries/science/biology/nifticlib/default.nix b/pkgs/development/libraries/science/biology/nifticlib/default.nix
index ae916b84ea337..19e5644b99303 100644
--- a/pkgs/development/libraries/science/biology/nifticlib/default.nix
+++ b/pkgs/development/libraries/science/biology/nifticlib/default.nix
@@ -14,6 +14,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ zlib ];
 
   checkPhase = "ctest";
+  doCheck = false; # fails 7 out of 293 tests
 
   meta = with stdenv.lib; {
     homepage = https://sourceforge.net/projects/niftilib;
diff --git a/pkgs/development/libraries/silgraphite/graphite2.nix b/pkgs/development/libraries/silgraphite/graphite2.nix
index 30a99415981bf..dc3f4a118f6da 100644
--- a/pkgs/development/libraries/silgraphite/graphite2.nix
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, freetype, cmake }:
+{ stdenv, fetchurl, pkgconfig, freetype, cmake, python }:
 
 stdenv.mkDerivation rec {
   version = "1.3.6";
@@ -15,6 +15,9 @@ stdenv.mkDerivation rec {
 
   patches = stdenv.lib.optionals stdenv.isDarwin [ ./macosx.patch ];
 
+  checkInputs = [ python ];
+  doCheck = false; # fails, probably missing something
+
   meta = {
     description = "An advanced font engine";
     maintainers = [ stdenv.lib.maintainers.raskin ];
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index ed25fcb5b8014..4fcaef7e0e230 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -71,6 +71,8 @@ stdenv.mkDerivation rec {
     sed -i $out/lib/libsqlite3.la -e "s/dependency_libs=.*/dependency_libs='''/"
   '';
 
+  doCheck = false; # fails to link against tcl
+
   meta = {
     description = "A self-contained, serverless, zero-configuration, transactional SQL database engine";
     downloadPage = http://sqlite.org/download.html;
diff --git a/pkgs/development/libraries/twolame/default.nix b/pkgs/development/libraries/twolame/default.nix
index a65254fea24e2..a752da8cb57d0 100644
--- a/pkgs/development/libraries/twolame/default.nix
+++ b/pkgs/development/libraries/twolame/default.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ libsndfile ];
 
+  doCheck = false; # fails with "../build-scripts/test-driver: line 107: -Mstrict: command not found"
+
   meta = with stdenv.lib;{
     description = "A MP2 encoder";
     longDescription = ''
diff --git a/pkgs/development/libraries/uthash/default.nix b/pkgs/development/libraries/uthash/default.nix
index 9c252004656c1..57a1cbf73c2cd 100644
--- a/pkgs/development/libraries/uthash/default.nix
+++ b/pkgs/development/libraries/uthash/default.nix
@@ -13,9 +13,8 @@ stdenv.mkDerivation rec {
 
   dontBuild = false;
 
-  buildInputs = stdenv.lib.optional doCheck perl;
-
   doCheck = true;
+  checkInputs = [ perl ];
   checkTarget = "-C tests/";
 
   installPhase = ''
@@ -30,4 +29,3 @@ stdenv.mkDerivation rec {
     platforms   = platforms.all;
   };
 }
-
diff --git a/pkgs/development/libraries/vigra/default.nix b/pkgs/development/libraries/vigra/default.nix
index 14211ea65e9ab..4a002becdb3b1 100644
--- a/pkgs/development/libraries/vigra/default.nix
+++ b/pkgs/development/libraries/vigra/default.nix
@@ -26,6 +26,9 @@ in stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  # fails with "./test_watersheds3d: error while loading shared libraries: libvigraimpex.so.11: cannot open shared object file: No such file or directory"
+  doCheck = false;
+
   meta = with stdenv.lib; {
     description = "Novel computer vision C++ library with customizable algorithms and data structures";
     homepage = https://hci.iwr.uni-heidelberg.de/vigra;
diff --git a/pkgs/development/libraries/volume-key/default.nix b/pkgs/development/libraries/volume-key/default.nix
index a8515975c353a..b91c091c6c6f3 100644
--- a/pkgs/development/libraries/volume-key/default.nix
+++ b/pkgs/development/libraries/volume-key/default.nix
@@ -24,6 +24,8 @@ in stdenv.mkDerivation rec {
     "pythondir=$(py)/${python3.sitePackages}"
   ];
 
+  doCheck = false; # fails 1 out of 1 tests, needs `certutil`
+
   meta = with stdenv.lib; {
     description = "A library for manipulating storage volume encryption keys and storing them separately from volumes to handle forgotten passphrases, and the associated command-line tool";
     homepage = https://pagure.io/volume_key/;
diff --git a/pkgs/development/python-modules/arxiv2bib/default.nix b/pkgs/development/python-modules/arxiv2bib/default.nix
index 1182c36fc0cae..99725bcfa61d5 100644
--- a/pkgs/development/python-modules/arxiv2bib/default.nix
+++ b/pkgs/development/python-modules/arxiv2bib/default.nix
@@ -14,7 +14,6 @@ buildPythonPackage rec {
     sha256 = "1kp2iyx20lpc9dv4qg5fgwf83a1wx6f7hj1ldqyncg0kn9xcrhbg";
   };
 
-  # Required for tests only
   checkInputs = [ mock ];
 
   checkPhase = "${python.interpreter} -m unittest discover -s tests";
diff --git a/pkgs/development/python-modules/dbus/default.nix b/pkgs/development/python-modules/dbus/default.nix
index 8f3f331fd5097..13465f1af2c86 100644
--- a/pkgs/development/python-modules/dbus/default.nix
+++ b/pkgs/development/python-modules/dbus/default.nix
@@ -15,12 +15,12 @@ if isPyPy then throw "dbus-python not supported for interpreter ${python.executa
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ dbus dbus-glib ]
-    ++ lib.optionals doCheck [ dbus.out pygobject3 ]
     # My guess why it's sometimes trying to -lncurses.
     # It seems not to retain the dependency anyway.
     ++ lib.optional (! python ? modules) ncurses;
 
   doCheck = true;
+  checkInputs = [ dbus.out pygobject3 ];
 
   meta = {
     description = "Python DBus bindings";
diff --git a/pkgs/development/python-modules/gensim/default.nix b/pkgs/development/python-modules/gensim/default.nix
index f9f8198e4ac1b..9a1a870dd00a2 100644
--- a/pkgs/development/python-modules/gensim/default.nix
+++ b/pkgs/development/python-modules/gensim/default.nix
@@ -5,6 +5,7 @@
 , six
 , scipy
 , smart_open
+, scikitlearn, testfixtures, unittest2
 }:
 
 buildPythonPackage rec {
@@ -15,20 +16,20 @@ buildPythonPackage rec {
     sha256 = "78ed9b6ac35f104542f3bee0386d71ddf9432d74c153065d2ea9f6baf10e5b49";
   };
 
-  propagatedBuildInputs = [ smart_open numpy six scipy
-                            # scikitlearn testfixtures unittest2 # for tests
-                          ];
-  doCheck = false;
+  propagatedBuildInputs = [ smart_open numpy six scipy ];
 
-  # Two tests fail.
+  checkInputs = [ scikitlearn testfixtures unittest2 ];
 
+  # Two tests fail.
+  #
   # ERROR: testAddMorphemesToEmbeddings (gensim.test.test_varembed_wrapper.TestVarembed)
   # ImportError: Could not import morfessor.
   # This package is not in nix
-
+  #
   # ERROR: testWmdistance (gensim.test.test_fasttext_wrapper.TestFastText)
   # ImportError: Please install pyemd Python package to compute WMD.
   # This package is not in nix
+  doCheck = false;
 
   meta = {
     description = "Topic-modelling library";
diff --git a/pkgs/development/python-modules/markdown/default.nix b/pkgs/development/python-modules/markdown/default.nix
index 515dee0e7662e..f2397138771ec 100644
--- a/pkgs/development/python-modules/markdown/default.nix
+++ b/pkgs/development/python-modules/markdown/default.nix
@@ -25,4 +25,4 @@ buildPythonPackage rec {
     homepage = https://github.com/Python-Markdown/markdown;
     license = lib.licenses.bsd3;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/tools/misc/automake/automake-1.11.x.nix b/pkgs/development/tools/misc/automake/automake-1.11.x.nix
index 0a33160052362..8f437af0ada87 100644
--- a/pkgs/development/tools/misc/automake/automake-1.11.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.11.x.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perl, autoconf, makeWrapper }:
+{ stdenv, fetchurl, perl, autoconf }:
 
 stdenv.mkDerivation rec {
   name = "automake-1.11.6";
@@ -17,11 +17,12 @@ stdenv.mkDerivation rec {
 
   patches = [ ./fix-test-autoconf-2.69.patch ./fix-perl-5.26.patch ];
 
-  buildInputs = [perl autoconf makeWrapper];
+  buildInputs = [ perl autoconf ];
 
   # Disable indented log output from Make, otherwise "make.test" will
   # fail.
   preCheck = "unset NIX_INDENT_MAKE";
+  doCheck = false; # takes _a lot_ of time, fails 11 of 782 tests
 
   # Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the
   # "fixed" path in generated files!
diff --git a/pkgs/development/tools/misc/automake/automake-1.16.x.nix b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
index 6646b84725267..478fc14d680d7 100644
--- a/pkgs/development/tools/misc/automake/automake-1.16.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perl, autoconf, doCheck ? false }:
+{ stdenv, fetchurl, perl, autoconf }:
 
 stdenv.mkDerivation rec {
   name = "automake-1.16.1";
@@ -16,7 +16,8 @@ stdenv.mkDerivation rec {
   # Disable indented log output from Make, otherwise "make.test" will
   # fail.
   preCheck = "unset NIX_INDENT_MAKE";
-  inherit doCheck;
+  doCheck = false; # takes _a lot_ of time, fails 3 out of 2698 tests, all seem to be related to paths
+  doInstallCheck = false; # runs the same thing, fails the same tests
 
   # The test suite can run in parallel.
   enableParallelBuilding = true;
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 890ff7b64a915..3ca9e539ddd83 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -1,6 +1,6 @@
 { stdenv, buildPackages
 , fetchurl, zlib, autoreconfHook264
-, hostPlatform, targetPlatform
+, hostPlatform, buildPlatform, targetPlatform
 , noSysDirs, gold ? true, bison ? null
 }:
 
@@ -121,6 +121,9 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # fails
 
+  # else fails with "./sanity.sh: line 36: $out/bin/size: not found"
+  doInstallCheck = buildPlatform == hostPlatform && hostPlatform == targetPlatform;
+
   enableParallelBuilding = true;
 
   passthru = {
diff --git a/pkgs/development/tools/misc/elfutils/default.nix b/pkgs/development/tools/misc/elfutils/default.nix
index e067c0a669bed..85adf73ed2ac5 100644
--- a/pkgs/development/tools/misc/elfutils/default.nix
+++ b/pkgs/development/tools/misc/elfutils/default.nix
@@ -10,7 +10,11 @@ stdenv.mkDerivation rec {
     sha256 = "1zq0l12k64hrbjmdjc4llrad96c25i427hpma1id9nk87w9qqvdp";
   };
 
-  patches = ./debug-info-from-env.patch;
+  patches = [ ./debug-info-from-env.patch ];
+
+  postPatch = ''
+    patchShebangs tests
+  '';
 
   hardeningDisable = [ "format" ];
 
@@ -63,6 +67,9 @@ stdenv.mkDerivation rec {
     cp version.h $out/include
   '';
 
+  doCheck = false; # fails 3 out of 174 tests
+  doInstallCheck = false; # fails 70 out of 174 tests
+
   meta = {
     homepage = https://sourceware.org/elfutils/;
     description = "A set of utilities to handle ELF objects";
diff --git a/pkgs/development/tools/misc/intel-gpu-tools/default.nix b/pkgs/development/tools/misc/intel-gpu-tools/default.nix
index d92b20a12b020..6023b0a2c2853 100644
--- a/pkgs/development/tools/misc/intel-gpu-tools/default.nix
+++ b/pkgs/development/tools/misc/intel-gpu-tools/default.nix
@@ -20,6 +20,8 @@ stdenv.mkDerivation rec {
   '';
 
   preBuild = ''
+    patchShebangs tests
+
     patchShebangs debugger/system_routine/pre_cpp.py
     substituteInPlace tools/Makefile.am --replace '$(CAIRO_CFLAGS)' '$(CAIRO_CFLAGS) $(GLIB_CFLAGS)'
     substituteInPlace tests/Makefile.am --replace '$(CAIRO_CFLAGS)' '$(CAIRO_CFLAGS) $(GLIB_CFLAGS)'
diff --git a/pkgs/development/tools/misc/patchelf/default.nix b/pkgs/development/tools/misc/patchelf/default.nix
index 39ec46ffbfddb..df24f6003d7fd 100644
--- a/pkgs/development/tools/misc/patchelf/default.nix
+++ b/pkgs/development/tools/misc/patchelf/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   setupHook = [ ./setup-hook.sh ];
 
-  #doCheck = true; # problems when loading libc.so.6
+  doCheck = false; # fails 8 out of 24 tests, problems when loading libc.so.6
 
   meta = {
     homepage = https://nixos.org/patchelf.html;
diff --git a/pkgs/development/tools/misc/rman/default.nix b/pkgs/development/tools/misc/rman/default.nix
index 702dabcf39550..8093846780d22 100644
--- a/pkgs/development/tools/misc/rman/default.nix
+++ b/pkgs/development/tools/misc/rman/default.nix
@@ -8,7 +8,12 @@ stdenv.mkDerivation {
     sha256 = "0prdld6nbkdlkcgc2r1zp13h2fh8r0mlwxx423dnc695ddlk18b8";
   };
 
-  makeFlags = "BINDIR=$(out)/bin MANDIR=$(out)/share/man";
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace ginstall install
+  '';
+
+  makeFlags = [ "BINDIR=$(out)/bin" "MANDIR=$(out)/share/man" ];
 
   preInstall = ''
     mkdir -p $out/bin
@@ -17,6 +22,8 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "format" ];
 
+  doCheck = false; # "check" target is probably meant to do "installcheck" or something
+
   meta = {
     description = "Parse formatted man pages and man page source from most flavors of UNIX and converts them to HTML, ASCII, TkMan, DocBook, and other formats";
     license = "artistic";
diff --git a/pkgs/development/tools/misc/strace/default.nix b/pkgs/development/tools/misc/strace/default.nix
index a5fd8f5cf64d2..3f1319f9e0865 100644
--- a/pkgs/development/tools/misc/strace/default.nix
+++ b/pkgs/development/tools/misc/strace/default.nix
@@ -16,6 +16,10 @@ stdenv.mkDerivation rec {
 
   configureFlags = stdenv.lib.optional (stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isRiscV) "--enable-mpers=check";
 
+  # fails 1 out of 523 tests with
+  # "strace-k.test: failed test: ../../strace -e getpid -k ../stack-fcall output mismatch"
+  doCheck = false;
+
   meta = with stdenv.lib; {
     homepage = https://strace.io/;
     description = "A system call tracer for Linux";
diff --git a/pkgs/development/tools/misc/texinfo/common.nix b/pkgs/development/tools/misc/texinfo/common.nix
index 12534297ff3da..101298cd3052f 100644
--- a/pkgs/development/tools/misc/texinfo/common.nix
+++ b/pkgs/development/tools/misc/texinfo/common.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ xz.bin ]
     ++ optionals stdenv.isSunOS [ libiconv gawk ]
-    ++ optionals interactive [ ncurses procps ];
+    ++ optional interactive ncurses;
 
   configureFlags = [ "PERL=${buildPackages.perl}/bin/perl" ]
     ++ stdenv.lib.optional stdenv.isSunOS "AWK=${gawk}/bin/awk";
@@ -33,6 +33,8 @@ stdenv.mkDerivation rec {
     installTargets="install install-tex";
   '';
 
+  checkInputs = [ procps ];
+
   doCheck = interactive
     && !stdenv.isDarwin
     && !stdenv.isSunOS; # flaky
diff --git a/pkgs/development/tools/parsing/bison/2.x.nix b/pkgs/development/tools/parsing/bison/2.x.nix
index 071ad93329143..019c154a6b76a 100644
--- a/pkgs/development/tools/parsing/bison/2.x.nix
+++ b/pkgs/development/tools/parsing/bison/2.x.nix
@@ -8,8 +8,9 @@ stdenv.mkDerivation rec {
     sha256 = "0c9li3iaslzzr3zig6m3zlmb4r8i0wfvkcrvdyiqxasb09mjkqh8";
   };
 
-  nativeBuildInputs = [ m4 ] ++ stdenv.lib.optional doCheck perl;
+  nativeBuildInputs = [ m4 ];
   propagatedBuildInputs = [ m4 ];
+  checkInputs = [ perl ];
 
   patches = lib.optional stdenv.isDarwin ./darwin-vasnprintf.patch;
 
diff --git a/pkgs/development/tools/parsing/flex/2.5.35.nix b/pkgs/development/tools/parsing/flex/2.5.35.nix
index 1062a361413c6..1fdad9b622722 100644
--- a/pkgs/development/tools/parsing/flex/2.5.35.nix
+++ b/pkgs/development/tools/parsing/flex/2.5.35.nix
@@ -8,6 +8,10 @@ stdenv.mkDerivation rec {
     sha256 = "0wh06nix8bd4w1aq4k2fbbkdq5i30a9lxz3xczf3ff28yy0kfwzm";
   };
 
+  postPatch = ''
+    patchShebangs tests
+  '';
+
   nativeBuildInputs = [ flex bison texinfo help2man autoreconfHook ];
 
   propagatedBuildInputs = [ m4 ];
@@ -17,6 +21,8 @@ stdenv.mkDerivation rec {
     "ac_cv_func_realloc_0_nonnull=yes"
   ];
 
+  doCheck = false; # fails 2 out of 46 tests
+
   meta = {
     branch = "2.5.35";
     homepage = http://flex.sourceforge.net/;
diff --git a/pkgs/development/tools/parsing/flex/2.6.1.nix b/pkgs/development/tools/parsing/flex/2.6.1.nix
index 954c2bbcb245c..8115ca19d0235 100644
--- a/pkgs/development/tools/parsing/flex/2.6.1.nix
+++ b/pkgs/development/tools/parsing/flex/2.6.1.nix
@@ -8,6 +8,12 @@ stdenv.mkDerivation rec {
     sha256 = "0fy14c35yz2m1n1m4f02by3501fn0cca37zn7jp8lpp4b3kgjhrw";
   };
 
+  postPatch = ''
+    patchShebangs tests
+  '' + stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+    substituteInPlace Makefile.in --replace "tests" " ";
+  '';
+
   buildInputs = [ bison ];
 
   propagatedBuildInputs = [ m4 ];
@@ -21,11 +27,6 @@ stdenv.mkDerivation rec {
     sed -i Makefile -e 's/-no-undefined//;'
   '';
 
-  # disable tests which can't run on build machine
-  postPatch = stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
-    substituteInPlace Makefile.in --replace "tests" " ";
-  '';
-
   meta = {
     homepage = https://github.com/westes/flex;
     description = "A fast lexical analyser generator";
diff --git a/pkgs/development/tools/parsing/flex/default.nix b/pkgs/development/tools/parsing/flex/default.nix
index 1bff2076b9ab8..52f7156ee808e 100644
--- a/pkgs/development/tools/parsing/flex/default.nix
+++ b/pkgs/development/tools/parsing/flex/default.nix
@@ -19,7 +19,10 @@ stdenv.mkDerivation rec {
         + "/tools/flex/patches/200-build-AC_USE_SYSTEM_EXTENSIONS-in-configure.ac.patch";
     sha256 = "1aarhcmz7mfrgh15pkj6f7ikxa2m0mllw1i1vscsf1kw5d05lw6f";
   })];
-  postPatch = stdenv.lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+
+  postPatch = ''
+    patchShebangs tests
+  '' + stdenv.lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     substituteInPlace Makefile.in --replace "tests" " "
 
     substituteInPlace doc/Makefile.am --replace 'flex.1: $(top_srcdir)/configure.ac' 'flex.1: '
diff --git a/pkgs/development/tools/parsing/re2c/default.nix b/pkgs/development/tools/parsing/re2c/default.nix
index da1bcced32ec0..1d0545f6889e5 100644
--- a/pkgs/development/tools/parsing/re2c/default.nix
+++ b/pkgs/development/tools/parsing/re2c/default.nix
@@ -15,6 +15,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
 
+  preCheck = ''
+    patchShebangs run_tests.sh
+  '';
+
   meta = with stdenv.lib; {
     description = "Tool for writing very fast and very flexible scanners";
     homepage    = "http://re2c.org";
diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 3f0ab5ff50672..eb9e32328100a 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -4,6 +4,7 @@
 , writeScript, coreutils, gnugrep, jq, curl, common-updater-scripts, nix
 , gnupg
 , darwin ? null
+, procps
 }:
 
 with stdenv.lib;
@@ -66,16 +67,27 @@ in
 
     inherit patches;
 
-    preBuild = optionalString stdenv.isDarwin ''
-      sed -i -e "s|tr1/type_traits|type_traits|g" \
-      -e "s|std::tr1|std|" src/util.h
-    '';
-
-    prePatch = ''
+    postPatch = ''
       patchShebangs .
       sed -i 's/raise.*No Xcode or CLT version detected.*/version = "7.0.0"/' tools/gyp/pylib/gyp/xcode_emulation.py
+
+      # fix tests
+      for a in test/parallel/test-child-process-env.js \
+               test/parallel/test-child-process-exec-env.js \
+               test/parallel/test-child-process-default-options.js \
+               test/fixtures/syntax/good_syntax_shebang.js \
+               test/fixtures/syntax/bad_syntax_shebang.js ; do
+        substituteInPlace $a \
+          --replace "/usr/bin/env" "${coreutils}/bin/env"
+      done
+    '' + optionalString stdenv.isDarwin ''
+      sed -i -e "s|tr1/type_traits|type_traits|g" \
+             -e "s|std::tr1|std|" src/util.h
     '';
 
+    checkInputs = [ procps ];
+    doCheck = false; # fails 4 out of 1453 tests
+
     postInstall = ''
       paxmark m $out/bin/node
       PATH=$out/bin:$PATH patchShebangs $out
diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index feeb73a27e901..38ad73d016001 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -1,6 +1,7 @@
 { stdenv, fetchurl, fetchpatch, pkgconfig, removeReferencesTo
 , zlib, libjpeg, libpng, libtiff, pam, dbus, systemd, acl, gmp, darwin
 , libusb ? null, gnutls ? null, avahi ? null, libpaper ? null
+, coreutils
 }:
 
 ### IMPORTANT: before updating cups, make sure the nixos/tests/printing.nix test
@@ -30,6 +31,11 @@ stdenv.mkDerivation rec {
     ./cups-clean-dirty.patch
   ];
 
+  postPatch = ''
+    substituteInPlace cups/testfile.c \
+      --replace 'cupsFileFind("cat", "/bin' 'cupsFileFind("cat", "${coreutils}/bin'
+  '';
+
   nativeBuildInputs = [ pkgconfig removeReferencesTo ];
 
   buildInputs = [ zlib libjpeg libpng libtiff libusb gnutls libpaper ]
diff --git a/pkgs/misc/drivers/foo2zjs/default.nix b/pkgs/misc/drivers/foo2zjs/default.nix
index e4d2da3afc253..7e1ff01bda05c 100644
--- a/pkgs/misc/drivers/foo2zjs/default.nix
+++ b/pkgs/misc/drivers/foo2zjs/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, foomatic-filters, bc, unzip, ghostscript, systemd, vim }:
+{ stdenv, fetchurl, foomatic-filters, bc, unzip, ghostscript, systemd, vim, time }:
 
 stdenv.mkDerivation rec {
   name = "foo2zjs-20180519";
@@ -39,6 +39,9 @@ stdenv.mkDerivation rec {
     sed -e "/PRINTERID=/s@=.*@=$out/bin/usb_printerid@" -i hplj1000
   '';
 
+  checkInputs = [ time ];
+  doCheck = false; # fails to find its own binary. Also says "Tests will pass only if you are using ghostscript-8.71-16.fc14".
+
   preInstall = ''
     mkdir -pv $out/{etc/udev/rules.d,lib/udev/rules.d,etc/hotplug/usb}
     mkdir -pv $out/share/foomatic/db/source/{opt,printer,driver}
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index fc13d97429c2e..5211fd2a61bf7 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -20,6 +20,10 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  postPatch = ''
+    patchShebangs tests
+  '';
+
   NIX_LDFLAGS = "-lgcc_s";
 
   configureFlags = [
diff --git a/pkgs/os-specific/linux/fuse/common.nix b/pkgs/os-specific/linux/fuse/common.nix
index 7cc58c19c07d6..1e4f3d8d58365 100644
--- a/pkgs/os-specific/linux/fuse/common.nix
+++ b/pkgs/os-specific/linux/fuse/common.nix
@@ -4,6 +4,7 @@
 , fusePackages, utillinux, gettext
 , meson, ninja, pkgconfig
 , autoreconfHook
+, python3Packages, which
 }:
 
 let
@@ -58,6 +59,14 @@ in stdenv.mkDerivation rec {
       ./makeconf.sh
     '');
 
+  checkInputs = [ which ] ++ (with python3Packages; [ python pytest ]);
+
+  checkPhase = ''
+    python3 -m pytest test/
+  '';
+
+  doCheck = false; # v2: no tests, v3: all tests get skipped in a sandbox
+
   postFixup = "cd $out\n" + (if isFuse3 then ''
     install -D -m444 etc/fuse.conf $common/etc/fuse.conf
     install -D -m444 etc/udev/rules.d/99-fuse3.rules $common/etc/udev/rules.d/99-fuse.rules
diff --git a/pkgs/os-specific/linux/libaio/default.nix b/pkgs/os-specific/linux/libaio/default.nix
index e2be136adee15..949c8135df7b5 100644
--- a/pkgs/os-specific/linux/libaio/default.nix
+++ b/pkgs/os-specific/linux/libaio/default.nix
@@ -14,10 +14,20 @@ stdenv.mkDerivation rec {
     sha256 = "1kqpiswjn549s3w3m89bw5qkl7bw5pvq6gp5cdzd926ymlgivj5c";
   }) ];
 
+  postPatch = ''
+    patchShebangs harness
+
+    # Makefile is too optimistic, gcc is too smart
+    substituteInPlace harness/Makefile \
+      --replace "-Werror" ""
+  '';
+
   makeFlags = "prefix=$(out)";
 
   hardeningDisable = stdenv.lib.optional (stdenv.isi686) "stackprotector";
 
+  checkTarget = "partcheck"; # "check" needs root
+
   meta = {
     description = "Library for asynchronous I/O in Linux";
     homepage = http://lse.sourceforge.net/io/aio.html;
diff --git a/pkgs/os-specific/linux/numactl/default.nix b/pkgs/os-specific/linux/numactl/default.nix
index 9928897ae4d49..4506945ffba2c 100644
--- a/pkgs/os-specific/linux/numactl/default.nix
+++ b/pkgs/os-specific/linux/numactl/default.nix
@@ -23,6 +23,15 @@ stdenv.mkDerivation rec {
       sha256 = "080b0sygmg7104qbbh1amh3b322yyiajwi2d3d0vayffgva0720v";
     });
 
+  postPatch = ''
+    patchShebangs test
+  '';
+
+  # You probably shouldn't ever run these! They will reconfigure Linux
+  # NUMA settings, which on my build machine makes the rest of package
+  # building ~5% slower until reboot. Ugh!
+  doCheck = false; # never ever!
+
   meta = with stdenv.lib; {
     description = "Library and tools for non-uniform memory access (NUMA) machines";
     homepage = http://oss.sgi.com/projects/libnuma/;
diff --git a/pkgs/os-specific/linux/pmount/default.nix b/pkgs/os-specific/linux/pmount/default.nix
index ea34075210df0..f0f706157ed13 100644
--- a/pkgs/os-specific/linux/pmount/default.nix
+++ b/pkgs/os-specific/linux/pmount/default.nix
@@ -34,6 +34,8 @@ stdenv.mkDerivation rec {
     substituteInPlace ./src/Makefile --replace '-o root -g root -m 4755 ' '-m 755 '
   '';
 
+  doCheck = false; # fails 1 out of 1 tests with "Error: could not open fstab-type file: No such file or directory"
+
   meta = {
     homepage = http://pmount.alioth.debian.org/;
     description = "Mount removable devices as normal user";
diff --git a/pkgs/os-specific/linux/syslinux/default.nix b/pkgs/os-specific/linux/syslinux/default.nix
index 8a87d3fce5801..f02f1baafe63e 100644
--- a/pkgs/os-specific/linux/syslinux/default.nix
+++ b/pkgs/os-specific/linux/syslinux/default.nix
@@ -21,19 +21,23 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ nasm perl python ];
-  buildInputs = [ libuuid makeWrapper ];
-
-  enableParallelBuilding = false; # Fails very rarely with 'No rule to make target: ...'
-  hardeningDisable = [ "pic" "stackprotector" "fortify" ];
-
-  preBuild = ''
+  postPatch = ''
     substituteInPlace Makefile --replace /bin/pwd $(type -P pwd)
     substituteInPlace gpxe/src/Makefile.housekeeping --replace /bin/echo $(type -P echo)
     substituteInPlace utils/ppmtolss16 --replace /usr/bin/perl $(type -P perl)
     substituteInPlace gpxe/src/Makefile --replace /usr/bin/perl $(type -P perl)
+
+    # fix tests
+    substituteInPlace tests/unittest/include/unittest/unittest.h \
+      --replace /usr/include/ ""
   '';
 
+  nativeBuildInputs = [ nasm perl python ];
+  buildInputs = [ libuuid makeWrapper ];
+
+  enableParallelBuilding = false; # Fails very rarely with 'No rule to make target: ...'
+  hardeningDisable = [ "pic" "stackprotector" "fortify" ];
+
   stripDebugList = "bin sbin share/syslinux/com32";
 
   makeFlags = [
@@ -47,6 +51,8 @@ stdenv.mkDerivation rec {
     "bios"
   ];
 
+  doCheck = false; # fails. some fail in a sandbox, others require qemu
+
   postInstall = ''
     wrapProgram $out/bin/syslinux \
       --prefix PATH : "${mtools}/bin"
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index 55673ccf01391..3602b772183e9 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -22,6 +22,8 @@ in stdenv.mkDerivation rec {
   outputs = [ "bin" "dev" "out" "man" ];
 
   postPatch = ''
+    patchShebangs tests/run.sh
+
     substituteInPlace include/pathnames.h \
       --replace "/bin/login" "${shadow}/bin/login"
     substituteInPlace sys-utils/eject.c \
@@ -54,6 +56,8 @@ in stdenv.mkDerivation rec {
     [ zlib pam ]
     ++ lib.filter (p: p != null) [ ncurses systemd perl ];
 
+  doCheck = false; # "For development purpose only. Don't execute on production system!"
+
   postInstall = ''
     rm "$bin/bin/su" # su should be supplied by the su package (shadow)
   '' + lib.optionalString minimal ''
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index 2bdd758b98026..50951c8cb82b7 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -30,7 +30,8 @@ stdenv.mkDerivation rec {
 
   CFLAGS = [ "-O2" "-DNDEBUG" ];
 
-  #doCheck = true; problems in combination with dynamic linking
+  doCheck = true;
+  doInstallCheck = false; # needs pykeymgr?
 
   postInstall = ''rm -r "$out"/var "$out"/lib/*.la'';
 
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index 6d48ed20e0ae0..6ccd849e1c8f9 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -27,11 +27,12 @@ unwrapped = stdenv.mkDerivation rec {
 
   # http://knot-resolver.readthedocs.io/en/latest/build.html#requirements
   buildInputs = [ knot-dns luajit libuv gnutls nettle lmdb ]
-    ++ optional doCheck cmocka
     ++ optional stdenv.isLinux systemd # sd_notify
     ## optional dependencies; TODO: libedit, dnstap
     ;
 
+  checkInputs = [ cmocka ];
+
   makeFlags = [
     "PREFIX=$(out)"
     "ROOTHINTS=${dns-root-data}/root.hints"
@@ -83,4 +84,3 @@ wrapped-full = with luajitPackages; let
   '';
 
 in result
-
diff --git a/pkgs/servers/http/lighttpd/default.nix b/pkgs/servers/http/lighttpd/default.nix
index 4596dac09086f..c41da6ea2fbd9 100644
--- a/pkgs/servers/http/lighttpd/default.nix
+++ b/pkgs/servers/http/lighttpd/default.nix
@@ -3,6 +3,7 @@
 , enableMysql ? false, mysql ? null
 , enableLdap ? false, openldap ? null
 , enableWebDAV ? true, sqlite ? null, libuuid ? null
+, perl
 }:
 
 assert enableMagnet -> lua5_1 != null;
@@ -19,6 +20,10 @@ stdenv.mkDerivation rec {
     sha256 = "02ff77cpvy1006cwfym38vf78xm18plyj636ll74r7kx2bblkpxf";
   };
 
+  postPatch = ''
+    patchShebangs tests
+  '';
+
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ pcre libxml2 zlib attr bzip2 which file openssl ]
              ++ stdenv.lib.optional enableMagnet lua5_1
@@ -38,6 +43,9 @@ stdenv.mkDerivation rec {
     sed -i "s:/usr/bin/file:${file}/bin/file:g" configure
   '';
 
+  checkInputs = [ perl ];
+  doCheck = false; # fails 2 tests
+
   postInstall = ''
     mkdir -p "$out/share/lighttpd/doc/config"
     cp -vr doc/config "$out/share/lighttpd/doc/"
diff --git a/pkgs/servers/http/myserver/default.nix b/pkgs/servers/http/myserver/default.nix
index a18ac202a4a20..b4ed3324491a3 100644
--- a/pkgs/servers/http/myserver/default.nix
+++ b/pkgs/servers/http/myserver/default.nix
@@ -14,9 +14,11 @@ stdenv.mkDerivation rec {
   patches =
     [ ./disable-dns-lookup-in-chroot.patch ];
 
-  buildInputs =
-    [ libgcrypt libevent libidn gnutls libxml2 zlib guile texinfo ]
-    ++ lib.optional doCheck cppunit;
+  buildInputs = [
+    libgcrypt libevent libidn gnutls libxml2 zlib guile texinfo
+  ];
+
+  checkInputs = [ cppunit ];
 
   makeFlags = [ "V=1" ];
 
diff --git a/pkgs/servers/nosql/redis/default.nix b/pkgs/servers/nosql/redis/default.nix
index bf1ccbd06d564..51df7c18a1e6d 100644
--- a/pkgs/servers/nosql/redis/default.nix
+++ b/pkgs/servers/nosql/redis/default.nix
@@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  doCheck = false; # needs tcl
+
   meta = with stdenv.lib; {
     homepage = https://redis.io;
     description = "An open source, advanced key-value store";
diff --git a/pkgs/servers/x11/xorg/xcb-util-xrm.nix b/pkgs/servers/x11/xorg/xcb-util-xrm.nix
index c38d4e80143b8..5a315b99b08bc 100644
--- a/pkgs/servers/x11/xorg/xcb-util-xrm.nix
+++ b/pkgs/servers/x11/xorg/xcb-util-xrm.nix
@@ -10,9 +10,9 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkgconfig m4 ];
-  buildInputs = [ libxcb xcbutil ]
-    ++ stdenv.lib.optional doCheck libX11;
   doCheck = true;
+  buildInputs = [ libxcb xcbutil ];
+  checkInputs = [ libX11 ];
 
   meta = with stdenv.lib; {
     description = "XCB utility functions for the X resource manager";
diff --git a/pkgs/shells/bash/4.4.nix b/pkgs/shells/bash/4.4.nix
index ab89dc28828b8..de8efd5af270b 100644
--- a/pkgs/shells/bash/4.4.nix
+++ b/pkgs/shells/bash/4.4.nix
@@ -1,5 +1,5 @@
 { stdenv, buildPackages
-, fetchurl, binutils ? null, bison, autoconf
+, fetchurl, binutils ? null, bison, autoconf, utillinux
 , buildPlatform, hostPlatform
 
 # patch for cygwin requires readline support
@@ -87,6 +87,9 @@ stdenv.mkDerivation rec {
     "SHOBJ_LIBS=-lbash"
   ];
 
+  checkInputs = [ utillinux ];
+  doCheck = false; # dependency cycle, needs to be interactive
+
   postInstall = ''
     ln -s bash "$out/bin/sh"
     rm -f $out/lib/bash/Makefile.inc
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index edb771b5b3ec4..f9a05c4281af9 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchFromGitHub, gnugrep
 , fixDarwinDylibNames
+, file
 , legacySupport ? false }:
 
 stdenv.mkDerivation rec {
@@ -19,6 +20,10 @@ stdenv.mkDerivation rec {
     "ZSTD_LEGACY_SUPPORT=${if legacySupport then "1" else "0"}"
   ];
 
+  checkInputs = [ file ];
+  doCheck = false; # fails with "zstd: --list does not support reading from standard input"
+                   # probably a bug
+
   installFlags = [
     "PREFIX=$(out)"
   ];
diff --git a/pkgs/tools/filesystems/e2fsprogs/default.nix b/pkgs/tools/filesystems/e2fsprogs/default.nix
index ef18d24778ff0..0e983ca219bbe 100644
--- a/pkgs/tools/filesystems/e2fsprogs/default.nix
+++ b/pkgs/tools/filesystems/e2fsprogs/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPackages, fetchurl, pkgconfig, libuuid, gettext, texinfo }:
+{ stdenv, buildPackages, fetchurl, pkgconfig, libuuid, gettext, texinfo, perl }:
 
 stdenv.mkDerivation rec {
   name = "e2fsprogs-1.44.3";
@@ -21,8 +21,10 @@ stdenv.mkDerivation rec {
       "--disable-libuuid" "--disable-uuidd" "--disable-libblkid" "--disable-fsck"
     ] else [
       "--enable-libuuid --disable-e2initrd-helper"
-    ]
-  ;
+    ];
+
+  checkInputs = [ perl ];
+  doCheck = false; # fails
 
   # hacky way to make it install *.pc
   postInstall = ''
diff --git a/pkgs/tools/filesystems/nixpart/0.4/parted.nix b/pkgs/tools/filesystems/nixpart/0.4/parted.nix
index 3f43fdc0c3950..f356727e64bb5 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/parted.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/parted.nix
@@ -13,8 +13,7 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional (readline != null) readline
     ++ stdenv.lib.optional (gettext != null) gettext
     ++ stdenv.lib.optional (lvm2 != null) lvm2
-    ++ stdenv.lib.optional (hurd != null) hurd
-    ++ stdenv.lib.optional doCheck check;
+    ++ stdenv.lib.optional (hurd != null) hurd;
 
   configureFlags =
        (if (readline != null)
@@ -24,11 +23,7 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional enableStatic "--enable-static";
 
   doCheck = true;
-
-  preCheck =
-    stdenv.lib.optionalString doCheck
-      # The `t0400-loop-clobber-infloop.sh' test wants `mkswap'.
-      "export PATH=\"${utillinux}/sbin:$PATH\"";
+  checkInputs = [ check utillinux ];
 
   meta = {
     description = "Create, destroy, resize, check, and copy partitions";
diff --git a/pkgs/tools/filesystems/sshfs-fuse/default.nix b/pkgs/tools/filesystems/sshfs-fuse/default.nix
index 6d95d5ee12b52..b7cccae0f38d3 100644
--- a/pkgs/tools/filesystems/sshfs-fuse/default.nix
+++ b/pkgs/tools/filesystems/sshfs-fuse/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, meson, pkgconfig, ninja, glib, fuse3
-, docutils
+, docutils, which, python3Packages
 }:
 
 stdenv.mkDerivation rec {
@@ -25,6 +25,12 @@ stdenv.mkDerivation rec {
     ln -sf $out/bin/sshfs $out/sbin/mount.sshfs
   '';
 
+  checkInputs = [ which ] ++ (with python3Packages; [ python pytest ]);
+
+  checkPhase = ''
+    python3 -m pytest test/
+  '';
+
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
     description = "FUSE-based filesystem that allows remote filesystems to be mounted over SSH";
diff --git a/pkgs/tools/misc/jdupes/default.nix b/pkgs/tools/misc/jdupes/default.nix
index acd58c9bcbd57..bf5e04a511f76 100644
--- a/pkgs/tools/misc/jdupes/default.nix
+++ b/pkgs/tools/misc/jdupes/default.nix
@@ -19,9 +19,10 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  doCheck = false; # broken Makefile, the above also removes tests
+
   postInstall = ''
     install -Dm644 -t $out/share/doc/jdupes CHANGES LICENSE README
-
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/memtest86+/default.nix b/pkgs/tools/misc/memtest86+/default.nix
index 6103ba0212607..7bebc26d7ec2f 100644
--- a/pkgs/tools/misc/memtest86+/default.nix
+++ b/pkgs/tools/misc/memtest86+/default.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
 
   buildFlags = "memtest.bin";
 
+  doCheck = false; # fails
+
   installPhase = ''
     mkdir -p $out
     chmod -x memtest.bin
diff --git a/pkgs/tools/misc/parted/default.nix b/pkgs/tools/misc/parted/default.nix
index 6649db4c48da9..643a3bafc66fc 100644
--- a/pkgs/tools/misc/parted/default.nix
+++ b/pkgs/tools/misc/parted/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
       sha256 = "0i29lfg8cwj342q5s7qwqhncz2bkifj5rjc7cx6jd4zqb6ykkndj";
     });
 
-  postPatch = stdenv.lib.optionalString doCheck ''
+  postPatch = ''
     patchShebangs tests
   '';
 
@@ -31,8 +31,7 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional (readline != null) readline
     ++ stdenv.lib.optional (gettext != null) gettext
     ++ stdenv.lib.optional (lvm2 != null) lvm2
-    ++ stdenv.lib.optional (hurd != null) hurd
-    ++ stdenv.lib.optionals doCheck [ check perl python2 ];
+    ++ stdenv.lib.optional (hurd != null) hurd;
 
   configureFlags =
        (if (readline != null)
@@ -45,10 +44,7 @@ stdenv.mkDerivation rec {
   # That should hopefully be fixed now.
   doCheck = !stdenv.hostPlatform.isMusl; /* translation test */
 
-  preCheck =
-    stdenv.lib.optionalString doCheck
-      # The `t0400-loop-clobber-infloop.sh' test wants `mkswap'.
-      "export PATH=\"${utillinux}/sbin:$PATH\"";
+  checkInputs = [ check perl python2 utillinux ];
 
   meta = {
     description = "Create, destroy, resize, check, and copy partitions";
diff --git a/pkgs/tools/misc/recutils/default.nix b/pkgs/tools/misc/recutils/default.nix
index a1fa7dee08367..3dd3baed0996a 100644
--- a/pkgs/tools/misc/recutils/default.nix
+++ b/pkgs/tools/misc/recutils/default.nix
@@ -8,14 +8,16 @@ stdenv.mkDerivation rec {
     sha256 = "0cdwa4094x3yx7vn98xykvnlp9rngvd58d19vs3vh5hrvggccg93";
   };
 
-  doCheck = true;
-
   hardeningDisable = [ "format" ];
 
-  buildInputs = [ curl emacs ] ++ (stdenv.lib.optionals doCheck [ check bc ]);
+  buildInputs = [ curl emacs ];
+
+  checkInputs = [ check bc ];
+  doCheck = true;
 
+  # one file fails to compile with emacs 26
   postInstall = ''
-    ${emacs}/bin/emacs -Q -batch -f batch-byte-compile $out/share/emacs/site-lisp/*.el #*/
+    ${emacs}/bin/emacs -Q -batch -f batch-byte-compile $out/share/emacs/site-lisp/*.el || true
   '';
 
   meta = {
diff --git a/pkgs/tools/misc/system-config-printer/default.nix b/pkgs/tools/misc/system-config-printer/default.nix
index a58eb31563847..c898761e424bc 100644
--- a/pkgs/tools/misc/system-config-printer/default.nix
+++ b/pkgs/tools/misc/system-config-printer/default.nix
@@ -41,6 +41,8 @@ stdenv.mkDerivation rec {
 
   stripDebugList = [ "bin" "lib" "etc/udev" ];
 
+  doCheck = false; # generates shebangs in check phase, too lazy to fix
+
   postInstall =
     ''
       buildPythonPath "$out $pythonPath"
diff --git a/pkgs/tools/networking/aria2/default.nix b/pkgs/tools/networking/aria2/default.nix
index 87725f51a7fbc..028691229e3ba 100644
--- a/pkgs/tools/networking/aria2/default.nix
+++ b/pkgs/tools/networking/aria2/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchFromGitHub, pkgconfig, autoreconfHook
 , openssl, c-ares, libxml2, sqlite, zlib, libssh2
+, cppunit
 , Security
 }:
 
@@ -21,6 +22,9 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt" ];
 
+  checkInputs = [ cppunit ];
+  doCheck = false; # needs the net
+
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/chrony/default.nix b/pkgs/tools/networking/chrony/default.nix
index 2db26985dcf94..bf1ef0600bccd 100644
--- a/pkgs/tools/networking/chrony/default.nix
+++ b/pkgs/tools/networking/chrony/default.nix
@@ -13,6 +13,10 @@ stdenv.mkDerivation rec {
     sha256 = "0a1ilzr88xhzx1ql3xhn36a4rvl79hvp0dvgm3az4cjhhzav47qd";
   };
 
+  postPatch = ''
+    patchShebangs test
+  '';
+
   buildInputs = [ readline texinfo nss nspr ]
     ++ stdenv.lib.optionals stdenv.isLinux [ libcap libseccomp pps-tools ];
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/networking/mailutils/default.nix b/pkgs/tools/networking/mailutils/default.nix
index 4df7f80fff6c3..f4e14d9824808 100644
--- a/pkgs/tools/networking/mailutils/default.nix
+++ b/pkgs/tools/networking/mailutils/default.nix
@@ -2,9 +2,7 @@
 , gdbm, pam, readline, ncurses, gnutls, guile, texinfo, gnum4, sasl, fribidi, nettools
 , python, gss, mysql, sendmailPath ? "/run/wrappers/bin/sendmail" }:
 
-let
-  p = "https://raw.githubusercontent.com/gentoo/gentoo/9c921e89d51876fd876f250324893fd90c019326/net-mail/mailutils/files";
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   name = "${project}-${version}";
   project = "mailutils";
   version = "3.2";
@@ -14,9 +12,21 @@ in stdenv.mkDerivation rec {
     sha256 = "0zh7xn8yvnw9zkc7gi5290i34viwxp1rn0g1q9nyvmckkvk59lwn";
   };
 
+  postPatch = ''
+    sed -i -e '/chown root:mail/d' \
+           -e 's/chmod [24]755/chmod 0755/' \
+      */Makefile{.in,.am}
+    sed -i 's:/usr/lib/mysql:${mysql.connector-c}/lib/mysql:' configure.ac
+    sed -i 's/0\.18/0.19/' configure.ac
+    sed -i -e 's:mysql/mysql.h:mysql.h:' \
+           -e 's:mysql/errmsg.h:errmsg.h:' \
+      sql/mysql.c
+  '';
+
   nativeBuildInputs = [
     autoreconfHook gettext pkgconfig
-  ] ++ stdenv.lib.optional doCheck dejagnu;
+  ];
+
   buildInputs = [
     gdbm pam readline ncurses gnutls guile texinfo gnum4 sasl fribidi nettools
     gss mysql.connector-c python
@@ -33,7 +43,6 @@ in stdenv.mkDerivation rec {
     ./path-to-cat.patch
   ];
 
-  doCheck = true;
   enableParallelBuilding = false;
   hardeningDisable = [ "format" ];
 
@@ -44,26 +53,21 @@ in stdenv.mkDerivation rec {
     "--with-path-sendmail=${sendmailPath}"
   ];
 
-  readmsg-tests = stdenv.lib.optionals doCheck [
+  readmsg-tests = let
+    p = "https://raw.githubusercontent.com/gentoo/gentoo/9c921e89d51876fd876f250324893fd90c019326/net-mail/mailutils/files";
+  in [
     (fetchurl { url = "${p}/hdr.at"; sha256 = "0phpkqyhs26chn63wjns6ydx9468ng3ssbjbfhcvza8h78jlsd98"; })
     (fetchurl { url = "${p}/nohdr.at"; sha256 = "1vkbkfkbqj6ml62s1am8i286hxwnpsmbhbnq0i2i0j1i7iwkk4b7"; })
     (fetchurl { url = "${p}/twomsg.at"; sha256 = "15m29rg2xxa17xhx6jp4s2vwa9d4khw8092vpygqbwlhw68alk9g"; })
     (fetchurl { url = "${p}/weed.at"; sha256 = "1101xakhc99f5gb9cs3mmydn43ayli7b270pzbvh7f9rbvh0d0nh"; })
   ];
 
-  postPatch = ''
-    sed -i -e '/chown root:mail/d' \
-           -e 's/chmod [24]755/chmod 0755/' \
-      */Makefile{.in,.am}
-    sed -i 's:/usr/lib/mysql:${mysql.connector-c}/lib/mysql:' configure.ac
-    sed -i 's/0\.18/0.19/' configure.ac
-    sed -i -e 's:mysql/mysql.h:mysql.h:' \
-           -e 's:mysql/errmsg.h:errmsg.h:' \
-      sql/mysql.c
-  '';
-
   NIX_CFLAGS_COMPILE = "-L${mysql.connector-c}/lib/mysql -I${mysql.connector-c}/include/mysql";
 
+  checkInputs = [ dejagnu ];
+  doCheck = false; # fails 1 out of a bunch of tests, looks like a bug
+  doInstallCheck = false; # fails
+
   preCheck = ''
     # Add missing test files
     cp ${builtins.toString readmsg-tests} readmsg/tests/
@@ -79,6 +83,7 @@ in stdenv.mkDerivation rec {
     # Provide libraries for mhn.
     export LD_LIBRARY_PATH=$(pwd)/lib/.libs
   '';
+
   postCheck = ''
     unset LD_LIBRARY_PATH
   '';
diff --git a/pkgs/tools/networking/socat/default.nix b/pkgs/tools/networking/socat/default.nix
index 0e9efb028ba8d..37fe3398ae8b2 100644
--- a/pkgs/tools/networking/socat/default.nix
+++ b/pkgs/tools/networking/socat/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, openssl, readline }:
+{ stdenv, fetchurl, openssl, readline, which, nettools }:
 
 stdenv.mkDerivation rec {
   name = "socat-1.7.3.2";
@@ -8,10 +8,20 @@ stdenv.mkDerivation rec {
     sha256 = "0lcj6zpra33xhgvhmz9l3cqz10v8ybafb8dd1yqkwf1rhy01ymp3";
   };
 
+  postPatch = ''
+    patchShebangs test.sh
+    substituteInPlace test.sh \
+      --replace /bin/rm rm \
+      --replace /sbin/ifconfig ifconfig
+  '';
+
   buildInputs = [ openssl readline ];
 
   hardeningEnable = [ "pie" ];
 
+  checkInputs = [ which nettools ];
+  doCheck = false; # fails a bunch, hangs
+
   meta = {
     description = "A utility for bidirectional data transfer between two independent data channels";
     homepage = http://www.dest-unreach.org/socat/;
diff --git a/pkgs/tools/networking/swec/default.nix b/pkgs/tools/networking/swec/default.nix
index 4af7e1eb5babb..bc9c9532e4f07 100644
--- a/pkgs/tools/networking/swec/default.nix
+++ b/pkgs/tools/networking/swec/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1m3971z4z1wr0paggprfz0n8ng8vsnkc9m6s3bdplgyz7qjk6jwx";
   };
 
-  buildInputs = [ makeWrapper perl LWP URI HTMLParser ]
-   ++ stdenv.lib.optionals doCheck [ HTTPServerSimple Parent ];
+  buildInputs = [ makeWrapper perl LWP URI HTMLParser ];
+  checkInputs = [ HTTPServerSimple Parent ];
 
   configurePhase = ''
     for i in swec tests/{runTests,testServer}
diff --git a/pkgs/tools/networking/tcpdump/default.nix b/pkgs/tools/networking/tcpdump/default.nix
index 8b4850a6347cb..58f020e1bdd88 100644
--- a/pkgs/tools/networking/tcpdump/default.nix
+++ b/pkgs/tools/networking/tcpdump/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libpcap }:
+{ stdenv, fetchurl, libpcap, perl }:
 
 stdenv.mkDerivation rec {
   name = "tcpdump-${version}";
@@ -16,6 +16,12 @@ stdenv.mkDerivation rec {
   #   sha256 = "1vzrvn1q7x28h18yskqc390y357pzpg5xd3pzzj4xz3llnvsr64p";
   # };
 
+  postPatch = ''
+    patchShebangs tests
+  '';
+
+  checkInputs = [ perl ];
+
   buildInputs = [ libpcap ];
 
   configureFlags = stdenv.lib.optional
diff --git a/pkgs/tools/nix/info/default.nix b/pkgs/tools/nix/info/default.nix
index cfdef4dd5613d..898026a629028 100644
--- a/pkgs/tools/nix/info/default.nix
+++ b/pkgs/tools/nix/info/default.nix
@@ -1,15 +1,12 @@
-{ stdenv, lib, coreutils, findutils, gnugrep, darwin, shellcheck
-, doCheck ? false # Avoid having GHC in the build-time closure of all NixOS configuratinos
+{ stdenv, lib, coreutils, findutils, gnugrep, darwin
+# Avoid having GHC in the build-time closure of all NixOS configurations
+, doCheck ? false, shellcheck
 }:
 
 stdenv.mkDerivation {
   name = "nix-info";
   src = ./info.sh;
 
-  nativeBuildInputs = lib.optionals doCheck [
-    shellcheck
-  ];
-
   path = lib.makeBinPath ([
     coreutils findutils gnugrep
   ] ++ (if stdenv.isDarwin then [ darwin.DarwinTools ] else []));
@@ -29,6 +26,8 @@ stdenv.mkDerivation {
   '';
 
   inherit doCheck;
+  checkInputs = [ shellcheck ];
+
   checkPhase = ''
     shellcheck ./nix-info
   '';
diff --git a/pkgs/tools/security/paperkey/default.nix b/pkgs/tools/security/paperkey/default.nix
index 1c235c9d88395..44cee21bc4971 100644
--- a/pkgs/tools/security/paperkey/default.nix
+++ b/pkgs/tools/security/paperkey/default.nix
@@ -9,6 +9,13 @@ stdenv.mkDerivation rec {
     sha256 = "1prd2jaf4zjad3xhv160hmi5n408ssljfg7iz90jxs9w111pjwy4";
   };
 
+  postPatch = ''
+    for a in checks/*.sh ; do
+      substituteInPlace $a \
+        --replace /bin/echo echo
+    done
+  '';
+
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/pass/default.nix b/pkgs/tools/security/pass/default.nix
index 007414d68a5e6..e7a3d2e0759b7 100644
--- a/pkgs/tools/security/pass/default.nix
+++ b/pkgs/tools/security/pass/default.nix
@@ -87,6 +87,24 @@ let
         --prefix PATH : "$out/bin:${wrapperPath}"
     '';
 
+    # Turn "check" into "installcheck", since we want to test our pass,
+    # not the one before the fixup.
+    postPatch = ''
+      patchShebangs tests
+
+      # the turning
+      sed -i -e 's@^PASS=.*''$@PASS=$out/bin/pass@' \
+             -e 's@^GPGS=.*''$@GPG=${gnupg}/bin/gpg2@' \
+             -e '/which gpg/ d' \
+        tests/setup.sh
+    '';
+
+    doCheck = false;
+
+    doInstallCheck = true;
+    installCheckInputs = [ git ];
+    installCheckTarget = "test";
+
     passthru = {
       extensions = passExtensions;
     } // extraPassthru;
diff --git a/pkgs/tools/system/gptfdisk/default.nix b/pkgs/tools/system/gptfdisk/default.nix
index 4a3c895c3b93f..25d60ffca5dc8 100644
--- a/pkgs/tools/system/gptfdisk/default.nix
+++ b/pkgs/tools/system/gptfdisk/default.nix
@@ -11,7 +11,9 @@ stdenv.mkDerivation rec {
     sha256 = "13d7gff4prl1nsdknjigmb7bbqhn79165n01v4y9mwbnd0d3jqxn";
   };
 
-  patchPhase = stdenv.lib.optionalString stdenv.isDarwin ''
+  postPatch = ''
+    patchShebangs gdisk_test.sh
+  '' + stdenv.lib.optionalString stdenv.isDarwin ''
     substituteInPlace Makefile.mac --replace \
       "-mmacosx-version-min=10.4" "-mmacosx-version-min=10.6"
     substituteInPlace Makefile.mac --replace \
diff --git a/pkgs/tools/text/kakasi/default.nix b/pkgs/tools/text/kakasi/default.nix
index b0baeaab5f662..6264557325999 100644
--- a/pkgs/tools/text/kakasi/default.nix
+++ b/pkgs/tools/text/kakasi/default.nix
@@ -21,4 +21,14 @@ stdenv.mkDerivation rec {
     url = "http://kakasi.namazu.org/stable/${name}.tar.xz";
     sha256 = "1qry3xqb83pjgxp3my8b1sy77z4f0893h73ldrvdaky70cdppr9f";
   };
+
+  postPatch = ''
+    for a in tests/kakasi-* ; do
+      substituteInPlace $a \
+        --replace "/bin/echo" echo
+    done
+  '';
+
+  doCheck = false; # fails 1 of 6 tests
+
 }
diff --git a/pkgs/tools/text/recode/default.nix b/pkgs/tools/text/recode/default.nix
index 9946da614c71c..f097ed5c0fa80 100644
--- a/pkgs/tools/text/recode/default.nix
+++ b/pkgs/tools/text/recode/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     substituteInPlace src/Makefile.am --replace "ansi2knr" ""
   '';
 
-  #doCheck = true; # doesn't work yet
+  doCheck = false; # fails 10 out of 16 tests
 
   preCheck = ''
     checkFlagsArray=(CPPFLAGS="-I../lib" LDFLAGS="-L../src/.libs -Wl,-rpath=../src/.libs")
diff --git a/pkgs/tools/text/wdiff/default.nix b/pkgs/tools/text/wdiff/default.nix
index f4edc02b9faec..df2ef21506917 100644
--- a/pkgs/tools/text/wdiff/default.nix
+++ b/pkgs/tools/text/wdiff/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, texinfo }:
+{ stdenv, fetchurl, texinfo, which }:
 
 stdenv.mkDerivation rec {
   name = "wdiff-1.2.2";
@@ -10,6 +10,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ texinfo ];
 
+  checkInputs = [ which ];
+
   meta = {
     homepage = http://www.gnu.org/software/wdiff/;
     description = "Comparing files on a word by word basis";
diff --git a/pkgs/tools/typesetting/xmlto/default.nix b/pkgs/tools/typesetting/xmlto/default.nix
index 939615f5797cf..400a26f84fd21 100644
--- a/pkgs/tools/typesetting/xmlto/default.nix
+++ b/pkgs/tools/typesetting/xmlto/default.nix
@@ -9,7 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "0xhj8b2pwp4vhl9y16v3dpxpsakkflfamr191mprzsspg4xdyc0i";
   };
 
-  patchPhase = ''
+  postPatch = ''
+    patchShebangs xmlif/test/run-test
+
     substituteInPlace "xmlto.in" \
       --replace "/bin/bash" "${bash}/bin/bash"
     substituteInPlace "xmlto.in" \
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 522b0e0574a25..256c82f003abf 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -8093,6 +8093,7 @@ let
     preConfigure = ''
       substituteInPlace Makefile.PL --replace "exit 0;" ""
     '';
+    buildInputs = [ TestPod ];
     meta = {
       description = "JSON (JavaScript Object Notation) encoder/decoder";
       license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6fc3a140eb811..46a1324aab5e4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1377,7 +1377,7 @@ in {
       sha256 = "1aqmy3psn12lxgp659d0zsxkirxzy5lnbnzxf9xjq1a93s3qm704";
     };
 
-    buildInputs = with self; [ pkgs.libev cython ] ++ optionals doCheck [ scales eventlet twisted mock gevent nose pytz pyyaml sure ];
+    buildInputs = with self; [ pkgs.libev cython ];
 
     propagatedBuildInputs = with self; [ futures six ];
 
@@ -1390,6 +1390,8 @@ in {
       ${python.interpreter} setup.py eventlet_nosetests
     '';
 
+    checkInputs = [ scales eventlet twisted mock gevent nose pytz pyyaml sure ];
+
     # Could not get tests running
     doCheck = false;