diff --git a/pkgs/applications/audio/aether-lv2/default.nix b/pkgs/applications/audio/aether-lv2/default.nix
index e912c7fa49a42..179c656968ce4 100644
--- a/pkgs/applications/audio/aether-lv2/default.nix
+++ b/pkgs/applications/audio/aether-lv2/default.nix
@@ -18,6 +18,12 @@ stdenv.mkDerivation rec {
     lv2 libX11 libGL libGLU mesa
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+    "-Wno-error=stringop-overflow"
+  ];
+
   installPhase = ''
     mkdir -p $out/lib/lv2
     cp -r aether.lv2 $out/lib/lv2
diff --git a/pkgs/applications/audio/furnace/default.nix b/pkgs/applications/audio/furnace/default.nix
index 0f15775b38d54..f3f7c3f624bab 100644
--- a/pkgs/applications/audio/furnace/default.nix
+++ b/pkgs/applications/audio/furnace/default.nix
@@ -63,6 +63,12 @@ stdenv.mkDerivation rec {
     "-DWARNINGS_ARE_ERRORS=ON"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=mismatched-new-delete"
+    "-Wno-error=use-after-free"
+  ];
+
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     # Normal CMake install phase on Darwin only installs the binary, the user is expected to use CPack to build a
     # bundle. That adds alot of overhead for not much benefit (CPack is currently abit broken, and needs impure access
diff --git a/pkgs/applications/audio/mimic/default.nix b/pkgs/applications/audio/mimic/default.nix
index 7e11c0a8d75fd..47e043f5d4673 100644
--- a/pkgs/applications/audio/mimic/default.nix
+++ b/pkgs/applications/audio/mimic/default.nix
@@ -38,6 +38,11 @@ stdenv.mkDerivation rec {
     pcre2
   ] ++ lib.optional pulseaudioSupport libpulseaudio;
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=free-nonheap-object"
+  ];
+
   postInstall = ''
     wrapProgram $out/bin/mimic \
       --run "export ALSA_PLUGIN_DIR=${alsa-plugins}/lib/alsa-lib"
diff --git a/pkgs/applications/editors/emacs/generic.nix b/pkgs/applications/editors/emacs/generic.nix
index feed7ba5b41e1..6da5164e9c0f1 100644
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@@ -60,9 +60,16 @@ assert withPgtk -> withGTK3 && !withX && gtk3 != null;
 assert withXwidgets -> withGTK3 && webkitgtk != null;
 
 
-let emacs = (if withMacport then llvmPackages_6.stdenv else stdenv).mkDerivation (lib.optionalAttrs nativeComp {
+let
+  libGccJitLibraryPaths = [
+    "${lib.getLib libgccjit}/lib/gcc"
+    "${lib.getLib stdenv.cc.libc}/lib"
+  ] ++ lib.optionals (stdenv.cc?cc.libgcc) [
+    "${lib.getLib stdenv.cc.cc.libgcc}/lib"
+  ];
+  emacs = (if withMacport then llvmPackages_6.stdenv else stdenv).mkDerivation (lib.optionalAttrs nativeComp {
   NATIVE_FULL_AOT = "1";
-  LIBRARY_PATH = "${lib.getLib stdenv.cc.libc}/lib";
+  LIBRARY_PATH = lib.concatStringsSep ":" libGccJitLibraryPaths;
 } // {
   pname = pname + lib.optionalString ( !withX && !withNS && !withMacport && !withGTK2 && !withGTK3 ) "-nox";
   inherit version;
@@ -73,17 +80,15 @@ let emacs = (if withMacport then llvmPackages_6.stdenv else stdenv).mkDerivation
             then ./native-comp-driver-options-28.patch
             else ./native-comp-driver-options.patch;
       backendPath = (lib.concatStringsSep " "
-        (builtins.map (x: ''"-B${x}"'') [
+        (builtins.map (x: ''"-B${x}"'') ([
           # Paths necessary so the JIT compiler finds its libraries:
           "${lib.getLib libgccjit}/lib"
-          "${lib.getLib libgccjit}/lib/gcc"
-          "${lib.getLib stdenv.cc.libc}/lib"
-
+        ] ++ libGccJitLibraryPaths ++ [
           # Executable paths necessary for compilation (ld, as):
           "${lib.getBin stdenv.cc.cc}/bin"
           "${lib.getBin stdenv.cc.bintools}/bin"
           "${lib.getBin stdenv.cc.bintools.bintools}/bin"
-        ]));
+        ])));
     })
   ];
 
diff --git a/pkgs/applications/emulators/mame/default.nix b/pkgs/applications/emulators/mame/default.nix
index 084bf07454298..aedf42ee126b5 100644
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@@ -117,6 +117,10 @@ stdenv.mkDerivation rec {
       --subst-var-by mamePath "$out/opt/mame"
   '';
 
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=use-after-free"
+  ];
+
   desktopItems = [
     (makeDesktopItem {
       name = "MAME";
diff --git a/pkgs/applications/graphics/foxotron/default.nix b/pkgs/applications/graphics/foxotron/default.nix
index e8fd0364808c2..ca2aa96bea141 100644
--- a/pkgs/applications/graphics/foxotron/default.nix
+++ b/pkgs/applications/graphics/foxotron/default.nix
@@ -46,6 +46,11 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isLinux [ libX11 libXrandr libXinerama libXcursor libXi libXext alsa-lib fontconfig libGLU ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ AVFoundation Carbon Cocoa CoreAudio Kernel OpenGL ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/applications/graphics/goxel/default.nix b/pkgs/applications/graphics/goxel/default.nix
index 325d1bcf083dd..8f70d9273b7a8 100644
--- a/pkgs/applications/graphics/goxel/default.nix
+++ b/pkgs/applications/graphics/goxel/default.nix
@@ -16,6 +16,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ scons pkg-config wrapGAppsHook ];
   buildInputs = [ glfw3 gtk3 libpng12 ];
+
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=format-truncation"
+  ];
+
   NIX_LDFLAGS = "-lpthread";
 
   buildPhase = ''
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
index e80ccd2105aa5..9feb5ff10a077 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib, stdenv, fetchFromGitHub, fetchpatch
 , pkg-config, cmake, ninja, yasm
 , libjpeg, openssl_1_1, libopus, ffmpeg, alsa-lib, libpulseaudio, protobuf
 , openh264, usrsctp, libevent, libvpx
@@ -31,6 +31,14 @@ stdenv.mkDerivation {
     mesa libepoxy libglvnd
   ];
 
+  patches = [
+    # GCC 12 Fix
+    (fetchpatch {
+      url = "https://github.com/desktop-app/tg_owt/pull/101/commits/86d2bcd7afb8706663d29e30f65863de5a626142.patch";
+      hash = "sha256-iWS0mB8R0vqPU/0qf6Ax54UCAKYDVCPac2mi/VHbFm0=";
+    })
+  ];
+
   cmakeFlags = [
     # Building as a shared library isn't officially supported and may break at any time.
     "-DBUILD_SHARED_LIBS=OFF"
diff --git a/pkgs/applications/science/biology/octopus/default.nix b/pkgs/applications/science/biology/octopus/default.nix
index 659b1e97f200f..b7c8c138cb82b 100644
--- a/pkgs/applications/science/biology/octopus/default.nix
+++ b/pkgs/applications/science/biology/octopus/default.nix
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-VaUr63v7mzhh4VBghH7a7qrqOYwl6vucmmKzTi9yAjY=";
   }) ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+  ];
+
   postInstall = ''
     mkdir $out/bin
     mv $out/octopus $out/bin
diff --git a/pkgs/applications/science/logic/cbmc/default.nix b/pkgs/applications/science/logic/cbmc/default.nix
index 4009761e8dc3c..7f15a5f8809af 100644
--- a/pkgs/applications/science/logic/cbmc/default.nix
+++ b/pkgs/applications/science/logic/cbmc/default.nix
@@ -60,9 +60,13 @@ stdenv.mkDerivation rec {
       --prefix PATH : "$out/share/cbmc" \
   '';
 
-  # fix "argument unused during compilation"
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
-    "-Wno-unused-command-line-argument";
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+  ] ++ lib.optionals stdenv.cc.isClang [
+    # fix "argument unused during compilation"
+    "-Wno-unused-command-line-argument"
+  ];
 
   # TODO: add jbmc support
   cmakeFlags = [ "-DWITH_JBMC=OFF" "-Dsat_impl=cadical" "-Dcadical_INCLUDE_DIR=${cadical.dev}/include" ];
diff --git a/pkgs/applications/science/math/mxnet/default.nix b/pkgs/applications/science/math/mxnet/default.nix
index dcba888ce2fb1..021593124a37d 100644
--- a/pkgs/applications/science/math/mxnet/default.nix
+++ b/pkgs/applications/science/math/mxnet/default.nix
@@ -54,6 +54,12 @@ stdenv.mkDerivation rec {
     ] else [ "-DUSE_CUDA=OFF" ])
     ++ lib.optional (!cudnnSupport) "-DUSE_CUDNN=OFF";
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+    "-Wno-error=uninitialized"
+  ];
+
   postPatch = ''
     substituteInPlace 3rdparty/mkldnn/tests/CMakeLists.txt \
       --replace "/bin/bash" "${bash}/bin/bash"
diff --git a/pkgs/applications/version-management/fnc/default.nix b/pkgs/applications/version-management/fnc/default.nix
index a60aa27a8439c..7fd1b34d4560e 100644
--- a/pkgs/applications/version-management/fnc/default.nix
+++ b/pkgs/applications/version-management/fnc/default.nix
@@ -13,6 +13,11 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+  ];
+
   preInstall = ''
     mkdir -p $out/bin
   '';
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 45ae3eba9b445..a3de0d8c0ce26 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -108,6 +108,7 @@ stdenv.mkDerivation {
   outputs = [ "out" ] ++ optionals propagateDoc ([ "man" ] ++ optional (bintools ? info) "info");
 
   passthru = {
+    inherit (bintools.passthru) isFromBootstrapFiles;
     inherit targetPrefix suffixSalt;
     inherit bintools libc nativeTools nativeLibc nativePrefix isGNU isLLVM;
 
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 2f3b2d8e37886..ea9a51d8085ae 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -9,7 +9,7 @@
 , lib
 , stdenvNoCC
 , cc ? null, libc ? null, bintools, coreutils ? null, shell ? stdenvNoCC.shell
-, gccForLibs ? null
+, gccForLibs ? if useCcForLibs then cc else null
 , zlib ? null
 , nativeTools, noLibc ? false, nativeLibc, nativePrefix ? ""
 , propagateDoc ? cc != null && cc ? man
@@ -18,6 +18,7 @@
 , isGNU ? false, isClang ? cc.isClang or false, gnugrep ? null
 , buildPackages ? {}
 , libcxx ? null
+, useCcForLibs ? isClang || (cc.passthru.enableExternalBootstrap or false)
 }:
 
 with lib;
@@ -63,7 +64,7 @@ let
     then import ../expand-response-params { inherit (buildPackages) stdenv; }
     else "";
 
-  useGccForLibs = isClang
+  useGccForLibs = useCcForLibs
     && libcxx == null
     && !stdenv.targetPlatform.isDarwin
     && !(stdenv.targetPlatform.useLLVM or false)
@@ -155,6 +156,7 @@ stdenv.mkDerivation {
     inherit expand-response-params;
 
     inherit nixSupport;
+    inherit (cc.passthru) isFromBootstrapFiles;
   };
 
   dontBuild = true;
diff --git a/pkgs/build-support/emacs/wrapper.nix b/pkgs/build-support/emacs/wrapper.nix
index edbe3ed971734..1cde4daf8c510 100644
--- a/pkgs/build-support/emacs/wrapper.nix
+++ b/pkgs/build-support/emacs/wrapper.nix
@@ -65,10 +65,12 @@ runCommand
     # Store all paths we want to add to emacs here, so that we only need to add
     # one path to the load lists
     deps = runCommand "emacs-packages-deps"
-      {
+      ({
         inherit explicitRequires lndir emacs;
         nativeBuildInputs = lib.optional nativeComp gcc;
-      }
+      } // lib.optionalAttrs nativeComp {
+        inherit (emacs) LIBRARY_PATH;
+      })
       ''
         findInputsOld() {
           local pkg="$1"; shift
diff --git a/pkgs/build-support/setup-hooks/reproducible-builds.sh b/pkgs/build-support/setup-hooks/reproducible-builds.sh
index 7b52f84df67b4..5e27ce8a25fec 100644
--- a/pkgs/build-support/setup-hooks/reproducible-builds.sh
+++ b/pkgs/build-support/setup-hooks/reproducible-builds.sh
@@ -3,7 +3,8 @@
 # derivation and not easily collide with other builds.
 # We also truncate the hash so that it cannot cause reference cycles.
 NIX_CFLAGS_COMPILE="${NIX_CFLAGS_COMPILE:-} -frandom-seed=$(
-    outbase="${out##*/}"
+    randSeed=${NIX_OUTPATH_USED_AS_RANDOM_SEED:-$out}
+    outbase="${randSeed##*/}"
     randomseed="${outbase:0:10}"
     echo $randomseed
 )"
diff --git a/pkgs/development/compilers/gcc/11/default.nix b/pkgs/development/compilers/gcc/11/default.nix
index 20da9a97aa5c3..b396949b5812b 100644
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@@ -27,6 +27,14 @@
 , cloog # unused; just for compat with gcc4, as we override the parameter on some places
 , buildPackages
 , libxcrypt
+, nukeReferences
+, callPackage
+, enableGdbPlugin ? enablePlugin
+, enableExternalBootstrap
+  ? (with stdenv; targetPlatform == hostPlatform && hostPlatform == buildPlatform)
+    && stdenv.enableGccExternalBootstrapForStdenv or false
+, enableLibGccOutput
+  ? (with stdenv; targetPlatform == hostPlatform)
 }:
 
 # Make sure we get GNU sed.
@@ -91,7 +99,7 @@ let majorVersion = "11";
 
 in
 
-stdenv.mkDerivation ({
+lib.pipe (stdenv.mkDerivation ({
   pname = "${crossNameAddon}${name}";
   inherit version;
 
@@ -165,7 +173,7 @@ stdenv.mkDerivation ({
     libcCross crossMingw;
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ texinfo which gettext ]
+  nativeBuildInputs = [ texinfo which gettext nukeReferences ]
     ++ (optional (perl != null) perl)
     ++ (optional langAda gnatboot)
     # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
@@ -220,6 +228,8 @@ stdenv.mkDerivation ({
       enableMultilib
       enablePlugin
       enableShared
+      enableGdbPlugin
+      enableExternalBootstrap
 
       langC
       langD
@@ -306,4 +316,12 @@ stdenv.mkDerivation ({
 }
 
 // optionalAttrs (enableMultilib) { dontMoveLib64 = true; }
-)
+))
+(callPackage ../common/external-bootstrap.nix {
+  inherit
+    version
+    langC langCC langJit
+    enablePlugin
+    profiledCompiler
+    enableExternalBootstrap enableLibGccOutput;
+}).mkDerivationOverrides
diff --git a/pkgs/development/compilers/gcc/12/default.nix b/pkgs/development/compilers/gcc/12/default.nix
index 74b03535a089f..cb6e164fa105a 100644
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@@ -28,6 +28,14 @@
 , cloog # unused; just for compat with gcc4, as we override the parameter on some places
 , buildPackages
 , libxcrypt
+, nukeReferences
+, callPackage
+, enableGdbPlugin ? enablePlugin
+, enableExternalBootstrap
+  ? (with stdenv; targetPlatform == hostPlatform && hostPlatform == buildPlatform)
+    && stdenv.enableGccExternalBootstrapForStdenv or false
+, enableLibGccOutput
+  ? (with stdenv; targetPlatform == hostPlatform)
 }:
 
 # Make sure we get GNU sed.
@@ -125,7 +133,7 @@ let majorVersion = "12";
 
 in
 
-stdenv.mkDerivation ({
+lib.pipe (stdenv.mkDerivation ({
   pname = "${crossNameAddon}${name}";
   inherit version;
 
@@ -199,7 +207,7 @@ stdenv.mkDerivation ({
     libcCross crossMingw;
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ texinfo which gettext ]
+  nativeBuildInputs = [ texinfo which gettext nukeReferences ]
     ++ (optional (perl != null) perl)
     ++ (optional langAda gnatboot)
     # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
@@ -256,6 +264,8 @@ stdenv.mkDerivation ({
       enableMultilib
       enablePlugin
       enableShared
+      enableGdbPlugin
+      enableExternalBootstrap
 
       langC
       langD
@@ -342,4 +352,13 @@ stdenv.mkDerivation ({
 }
 
 // optionalAttrs (enableMultilib) { dontMoveLib64 = true; }
-)
+))
+(callPackage ../common/external-bootstrap.nix {
+  inherit
+    version
+    langC langCC langJit
+    enablePlugin
+    profiledCompiler
+    enableExternalBootstrap enableLibGccOutput;
+}).mkDerivationOverrides
+
diff --git a/pkgs/development/compilers/gcc/9/default.nix b/pkgs/development/compilers/gcc/9/default.nix
index 248a92a2965a0..0aef025587eaf 100644
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@@ -267,6 +267,7 @@ stdenv.mkDerivation ({
   passthru = {
     inherit langC langCC langObjC langObjCpp langAda langFortran langGo langD version;
     isGNU = true;
+    isFromBootstrapFiles = false;
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index c9e9b00f60ed1..3a8a2ba234990 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -11,6 +11,7 @@
 , enableLTO
 , enableMultilib
 , enablePlugin
+, enableGdbPlugin ? enablePlugin  # "Libcc1 is the GCC cc1 plugin for the GDB debugger"
 , enableShared
 
 , langC
@@ -23,8 +24,12 @@
 , langObjC
 , langObjCpp
 , langJit
+, enableExternalBootstrap
+  ? (with stdenv; !(targetPlatform == hostPlatform && hostPlatform == buildPlatform))
+    && throw "please specify enableExternalBootstrap explicitly for native builds"
 }:
 
+assert enableGdbPlugin -> enablePlugin;
 assert cloog != null -> lib.versionOlder version "5";
 assert langJava -> lib.versionOlder version "7";
 
@@ -42,6 +47,7 @@ let
   inherit (stdenv)
     buildPlatform hostPlatform targetPlatform;
 
+  enableInternalBootstrap = targetPlatform == hostPlatform && hostPlatform == buildPlatform && !enableExternalBootstrap;
   crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
   crossDarwin = targetPlatform != hostPlatform && targetPlatform.libc == "libSystem";
 
@@ -119,7 +125,7 @@ let
       #  or ${with_sysroot}${native_system_header_dir}
       # While native build (build == host == target) uses passed headers
       # path as is:
-      #    ${native_system_header_dir}
+      #    ${with_build_sysroot}${native_system_header_dir}
       #
       # Nixpkgs uses flat directory structure for both native and cross
       # cases. As a result libc headers don't get found for cross case
@@ -172,9 +178,8 @@ let
       then ["--enable-multilib" "--disable-libquadmath"]
       else ["--disable-multilib"])
     ++ lib.optional (!enableShared) "--disable-shared"
-    ++ [
-      (lib.enableFeature enablePlugin "plugin")
-    ]
+    ++ [ (lib.enableFeature enablePlugin "plugin") ]
+    ++ [ (lib.enableFeature enableGdbPlugin "libcc1") ]
 
     # Support -m32 on powerpc64le/be
     ++ lib.optional (targetPlatform.system == "powerpc64le-linux")
@@ -215,7 +220,7 @@ let
     # TODO: aarch64-darwin has clang stdenv and its arch and cpu flag values are incompatible with gcc
     ++ lib.optionals (!(stdenv.isDarwin && stdenv.isAarch64)) (import ../common/platform-flags.nix { inherit (stdenv)  targetPlatform; inherit lib; })
     ++ lib.optionals (targetPlatform != hostPlatform) crossConfigureFlags
-    ++ lib.optional (targetPlatform != hostPlatform) "--disable-bootstrap"
+    ++ lib.optional (!enableInternalBootstrap) "--disable-bootstrap"
 
     # Platform-specific flags
     ++ lib.optional (targetPlatform == hostPlatform && targetPlatform.isx86_32) "--with-arch=${stdenv.hostPlatform.parsed.cpu.name}"
@@ -240,6 +245,9 @@ let
     ++ lib.optionals (langD) [
       "--with-target-system-zlib=yes"
     ]
+    # stdenv's setOutputFlags puts libexec in $lib; we need it in
+    # $out to prevent circular references between $lib and $out
+    ++ [ "--libexecdir=${builtins.placeholder "out"}/libexec" ]
   ;
 
 in configureFlags
diff --git a/pkgs/development/compilers/gcc/common/external-bootstrap.nix b/pkgs/development/compilers/gcc/common/external-bootstrap.nix
new file mode 100644
index 0000000000000..555028d01d550
--- /dev/null
+++ b/pkgs/development/compilers/gcc/common/external-bootstrap.nix
@@ -0,0 +1,166 @@
+{ lib
+, stdenv
+, nukeReferences
+, version
+, langC
+, langCC
+, langJit
+, enablePlugin
+, profiledCompiler
+, enableExternalBootstrap
+, enableLibGccOutput
+}:
+
+# libgccjit.so must be built separately
+assert langJit -> !enableLibGccOutput;
+
+let
+  enableChecksum = enableExternalBootstrap && langC && langCC;
+in
+{
+
+  mkDerivationOverrides = [
+
+    (pkg: pkg.overrideAttrs (previousAttrs: {
+      passthru = previousAttrs.passthru // {
+        isFromBootstrapFiles = false;
+        inherit enableExternalBootstrap;
+      };
+      buildFlags = lib.optional
+        (with stdenv; targetPlatform == hostPlatform && hostPlatform == buildPlatform)
+        (let
+          bootstrap = lib.optionalString (!enableExternalBootstrap) "bootstrap";
+          profiled  = lib.optionalString profiledCompiler "profiled";
+        in "${profiled}${bootstrap}");
+      outputs = previousAttrs.outputs
+                ++ lib.optionals enableLibGccOutput [ "libgcc" ]
+                ++ lib.optionals enableChecksum [ "checksum" ];
+    }))
+
+    (pkg: pkg.overrideAttrs (previousAttrs: lib.optionalAttrs ((!langC) || langJit || enableLibGccOutput) {
+      # This is a separate phase because gcc assembles its phase scripts
+      # in bash instead of nix (we should fix that).
+      preFixupPhases = (previousAttrs.preFixupPhases or []) ++ [ "postPostInstallPhase" ];
+      postPostInstallPhase = lib.optionalString langJit ''
+        # this is to keep clang happy
+        mv $out/lib/gcc/${stdenv.targetPlatform.config}/${version}/* $out/lib/gcc/
+        rmdir $out/lib/gcc/${stdenv.targetPlatform.config}/${version}
+        rmdir $out/lib/gcc/${stdenv.targetPlatform.config}
+      '' + lib.optionalString enableLibGccOutput ''
+        # eliminate false lib->out references
+        find $lib/lib/ -name \*.so\* -exec patchelf --shrink-rpath {} \; || true
+      '' + lib.optionalString (!langC) ''
+        # delete extra/unused builds of libgcc_s to avoid potential confusion:
+        rm -f $out/lib/libgcc_s.so*
+      '' + lib.optionalString enableLibGccOutput (''
+        # move libgcc from lib to its own output (libgcc)
+        mkdir -p $libgcc/lib
+        mv    $lib/lib/libgcc_s.so       $libgcc/lib/
+        mv    $lib/lib/libgcc_s.so.1     $libgcc/lib/
+        ln -s $libgcc/lib/libgcc_s.so   $lib/lib/
+        ln -s $libgcc/lib/libgcc_s.so.1 $lib/lib/
+      ''
+      #
+      # Nixpkgs ordinarily turns dynamic linking into pseudo-static linking:
+      # libraries are still loaded dynamically, exactly which copy of each
+      # library is loaded is permanently fixed at compile time (via RUNPATH).
+      # For libgcc_s we must revert to the "impure dynamic linking" style found
+      # in imperative software distributions for `libgcc_s`.  This is because
+      # `libgcc_s` calls `malloc()` and therefore has a `DT_NEEDED` for `libc`,
+      # which creates two problems:
+      #
+      #  1. A circular package dependency `glibc`<-`libgcc`<-`glibc`
+      #
+      #  2. According to the `-Wl,-rpath` flags added by Nixpkgs' `ld-wrapper`,
+      #     the two versions of `glibc` in the cycle above are actually
+      #     different packages.  The later one is compiled by this `gcc`, but
+      #     the earlier one was compiled by the compiler *that compiled* this
+      #     `gcc` (usually the bootstrapFiles).  In any event, the `glibc`
+      #     dynamic loader won't honor that specificity without namespaced
+      #     manual loads (`dlmopen()`).  Once a `libc` is present in the address
+      #     space of a process, that `libc` will be used to satisfy all
+      #     `DT_NEEDED`s for `libc`, regardless of `RUNPATH`s.
+      #
+      # So we wipe the RUNPATH:
+      #
+      + ''
+        patchelf --set-rpath "" $libgcc/lib/libgcc_s.so.1
+      '');
+      #
+      # Note: `patchelf --remove-rpath` up through (and possibly after) version
+      # 0.15.0 will leave the old RUNPATH string in the file where the reference
+      # scanner can still find it:
+      #
+      #   https://github.com/NixOS/patchelf/issues/453
+      #
+      # ...so we use `--set-rpath ""` instead.  We'll have to keep doing it this
+      # way even after that issue is fixed because we might be using the
+      # bootstrapFiles' copy of patchelf.
+      #
+      # That the patchelfing above is *not* effectively equivalent to copying
+      # `libgcc_s` into `glibc`'s outpath.  There is one minor and one major
+      # difference:
+      #
+      # 1. (Minor): multiple builds of `glibc` (say, with different
+      #    overrides or parameters) will all reference a single store
+      #    path:
+      #
+      #      /nix/store/xxx...xxx-gcc-libgcc/lib/libgcc_s.so.1
+      #
+      #    This many-to-one referrer relationship will be visible in the store's
+      #    dependency graph, and will be available to `nix-store -q` queries.
+      #    Copying `libgcc_s` into each of its referrers would lose that
+      #    information.
+      #
+      # 2. (Major): by referencing `libgcc_s.so.1`, rather than copying it, we
+      #    are still able to run `nix-store -qd` on it to find out how it got
+      #    built!  Most importantly, we can see from that deriver which compiler
+      #    was used to build it (or if it is part of the unpacked
+      #    bootstrap-files).  Copying `libgcc_s.so.1` from one outpath to
+      #    another eliminates the ability to make these queries.
+      #
+    }))
+
+    (pkg: pkg.overrideAttrs (previousAttrs: lib.optionalAttrs enableChecksum {
+      # This is a separate phase because gcc assembles its phase scripts
+      # in bash instead of nix (we should fix that).
+      preFixupPhases = (previousAttrs.preFixupPhases or []) ++ [ "postInstallSaveChecksumPhase" ];
+      #
+      # gcc uses an auxiliary utility `genchecksum` to md5-hash (most of) its
+      # `.o` and `.a` files prior to linking (in case the linker is
+      # nondeterministic).  Since we want to compare across gccs built from two
+      # separate derivations, we wrap `genchecksum` with a `nuke-references`
+      # call.  We also stash copies of the inputs to `genchecksum` in
+      # `$checksum/inputs/` -- this is extremely helpful for debugging since
+      # it's hard to get Nix to not delete the $NIX_BUILD_TOP of a successful
+      # build.
+      #
+      postInstallSaveChecksumPhase = ''
+        mv gcc/build/genchecksum gcc/build/.genchecksum-wrapped
+        cat > gcc/build/genchecksum <<\EOF
+        #!/bin/sh
+        ${nukeReferences}/bin/nuke-refs $@
+        for INPUT in "$@"; do install -Dt $INPUT $checksum/inputs/; done
+        exec build/.genchecksum-wrapped $@
+        EOF
+        chmod +x gcc/build/genchecksum
+        rm gcc/*-checksum.*
+        make -C gcc cc1-checksum.o cc1plus-checksum.o
+        install -Dt $checksum/checksums/ gcc/cc*-checksum.o
+      '';
+    }))
+    # the plugins reference $out, so we can't put them in $lib
+    (pkg: pkg.overrideAttrs (previousAttrs: lib.optionalAttrs (enableExternalBootstrap && enablePlugin) {
+      # This is a separate phase because gcc assembles its phase scripts
+      # in bash instead of nix (we should fix that).
+      preFixupPhases = (previousAttrs.preFixupPhases or []) ++ [ "postInstallPluginPhase" ];
+      postInstallPluginPhase =
+        let path = "lib/gcc/${stdenv.targetPlatform.config}/${previousAttrs.version}/"; in ''
+          if [ -e "$lib/${path}/plugin" ]; then
+            mkdir -p $out/${path}
+            mv $lib/${path}/plugin $out/${path}/plugin
+          fi
+        '';
+    }))
+  ];
+}
diff --git a/pkgs/development/compilers/mit-scheme/default.nix b/pkgs/development/compilers/mit-scheme/default.nix
index 5a96242da7b13..da668b51e2785 100644
--- a/pkgs/development/compilers/mit-scheme/default.nix
+++ b/pkgs/development/compilers/mit-scheme/default.nix
@@ -49,6 +49,12 @@ stdenv.mkDerivation {
     runHook postConfigure
   '';
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-parameter"
+    "-Wno-error=use-after-free"
+  ];
+
   buildPhase = ''
     runHook preBuild
     cd src
diff --git a/pkgs/development/compilers/urweb/default.nix b/pkgs/development/compilers/urweb/default.nix
index 67ebaa04699e3..a881b2f1badb1 100644
--- a/pkgs/development/compilers/urweb/default.nix
+++ b/pkgs/development/compilers/urweb/default.nix
@@ -33,6 +33,11 @@ stdenv.mkDerivation rec {
                    -L${sqlite.out}/lib";
   '';
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=use-after-free"
+  ];
+
   # Be sure to keep the statically linked libraries
   dontDisableStatic = true;
 
diff --git a/pkgs/development/interpreters/gnu-apl/default.nix b/pkgs/development/interpreters/gnu-apl/default.nix
index 3bcada9aa8f04..e413914aa39cd 100644
--- a/pkgs/development/interpreters/gnu-apl/default.nix
+++ b/pkgs/development/interpreters/gnu-apl/default.nix
@@ -21,6 +21,10 @@ stdenv.mkDerivation rec {
     "-Wno-error=maybe-uninitialized"
     # Needed with GCC 11
     "-Wno-error=misleading-indentation"
+    # Needed with GCC 12
+    "-Wno-error=nonnull"
+    "-Wno-error=stringop-overflow"
+    "-Wno-error=use-after-free"
    ]) ++ optional stdenv.cc.isClang "-Wno-error=null-dereference");
 
   patchPhase = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/libraries/assimp/default.nix b/pkgs/development/libraries/assimp/default.nix
index 81d9e54de435d..ed0476fea642c 100644
--- a/pkgs/development/libraries/assimp/default.nix
+++ b/pkgs/development/libraries/assimp/default.nix
@@ -23,6 +23,11 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DASSIMP_BUILD_ASSIMP_TOOLS=ON" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   meta = with lib; {
     description = "A library to import various 3D model formats";
     homepage = "https://www.assimp.org/";
diff --git a/pkgs/development/libraries/belle-sip/default.nix b/pkgs/development/libraries/belle-sip/default.nix
index 152572c6b16a5..a33b9f163602a 100644
--- a/pkgs/development/libraries/belle-sip/default.nix
+++ b/pkgs/development/libraries/belle-sip/default.nix
@@ -34,6 +34,8 @@ stdenv.mkDerivation rec {
     "-Wno-error=deprecated-declarations"
     "-Wno-error=format-truncation"
     "-Wno-error=stringop-overflow"
+    # Needed with GCC 12
+    "-Wno-error=use-after-free"
   ];
 
   propagatedBuildInputs = [ libantlr3c mbedtls_2 bctoolbox belr ];
diff --git a/pkgs/development/libraries/boringssl/default.nix b/pkgs/development/libraries/boringssl/default.nix
index 61c2a27f3d857..b5d9d33a811fa 100644
--- a/pkgs/development/libraries/boringssl/default.nix
+++ b/pkgs/development/libraries/boringssl/default.nix
@@ -30,6 +30,11 @@ buildGoModule {
     export GOARCH=$(go env GOHOSTARCH)
   '';
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=stringop-overflow"
+  ];
+
   buildPhase = ''
     ninjaBuildPhase
   '';
diff --git a/pkgs/development/libraries/bzrtp/default.nix b/pkgs/development/libraries/bzrtp/default.nix
index 4bccc0c5cf2fa..5791924ad14a9 100644
--- a/pkgs/development/libraries/bzrtp/default.nix
+++ b/pkgs/development/libraries/bzrtp/default.nix
@@ -25,6 +25,11 @@ stdenv.mkDerivation rec {
   # Do not build static libraries
   cmakeFlags = [ "-DENABLE_STATIC=NO" "-DCMAKE_C_FLAGS=-Wno-error=cast-function-type" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=stringop-overflow"
+  ];
+
   meta = with lib; {
     description = "An opensource implementation of ZRTP keys exchange protocol. Part of the Linphone project.";
     homepage = "https://gitlab.linphone.org/BC/public/bzrtp";
diff --git a/pkgs/development/libraries/clucene-core/2.x.nix b/pkgs/development/libraries/clucene-core/2.x.nix
index 861e9179e0948..d928b814e826f 100644
--- a/pkgs/development/libraries/clucene-core/2.x.nix
+++ b/pkgs/development/libraries/clucene-core/2.x.nix
@@ -30,11 +30,14 @@ stdenv.mkDerivation rec {
     "-DLUCENE_STATIC_CONSTANT_SYNTAX_EXITCODE__TRYRUN_OUTPUT="
   ];
 
-  patches = # From debian
-    [ ./Fix-pkgconfig-file-by-adding-clucene-shared-library.patch
-      ./Fixing_ZLIB_configuration_in_shared_CMakeLists.patch
-      ./Install-contribs-lib.patch
-    ] ++ lib.optionals stdenv.isDarwin [ ./fix-darwin.patch ];
+  patches = [
+    # From debian
+    ./Fix-pkgconfig-file-by-adding-clucene-shared-library.patch
+    ./Fixing_ZLIB_configuration_in_shared_CMakeLists.patch
+    ./Install-contribs-lib.patch
+    # From arch
+    ./fix-missing-include-time.patch
+  ] ++ lib.optionals stdenv.isDarwin [ ./fix-darwin.patch ];
 
   # fails with "Unable to find executable:
   # /build/clucene-core-2.3.3.4/build/bin/cl_test"
diff --git a/pkgs/development/libraries/clucene-core/fix-missing-include-time.patch b/pkgs/development/libraries/clucene-core/fix-missing-include-time.patch
new file mode 100644
index 0000000000000..0ac26f76929ac
--- /dev/null
+++ b/pkgs/development/libraries/clucene-core/fix-missing-include-time.patch
@@ -0,0 +1,49 @@
+From c1c2000c35ff39b09cb70fbdf66a107d3b17a674 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Wed, 12 Oct 2022 08:40:49 +0200
+Subject: [PATCH] Fix missing #include <time.h>
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+At least on recent Fedora 37 beta, building now failed with
+
+> CLucene/document/DateTools.cpp:26:19: error: ‘gmtime’ was not declared in this scope
+>    26 |         tm *ptm = gmtime(&secs);
+>       |                   ^~~~~~
+
+etc.
+
+As it turns out, after 22f9d40320e3deeaa8d6aaa7a770077c20a21dae "git-svn-id:
+https://clucene.svn.sourceforge.net/svnroot/clucene/branches/lucene2_3_2@2672
+20ef185c-fe11-0410-a618-ba9304b01011" on 2008-06-26 had commented out
+_CL_TIME_WITH_SYS_TIME in clucene-config.h.cmake as "not actually used for
+anything", then cceccfb52917b5f4da447f1cf20c135952d41442 "Presenting DateTools
+and deprecating DateField. DateTools still requires some testing and its own
+unit testing" on 2008-06-29 had introduced this use of it (into then
+src/CLucene/document/DateTools.H).  And apparently most build environments have
+silently been happy ever since when the dead leading check for
+_CL_TIME_WITH_SYS_TIME didn't include both <sys/time.h> and <time.h>, but the
+following check for _CL_HAVE_SYS_TIME_H only included <sys/time.h> but not
+<time.h>.
+---
+ src/shared/CLucene/clucene-config.h.cmake | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/src/shared/CLucene/clucene-config.h.cmake b/src/shared/CLucene/clucene-config.h.cmake
+index bd8683a5..6fe0f92b 100644
+--- a/src/shared/CLucene/clucene-config.h.cmake
++++ b/src/shared/CLucene/clucene-config.h.cmake
+@@ -100,8 +100,7 @@ ${SYMBOL__T}
+ //#cmakedefine _CL_STAT_MACROS_BROKEN
+ 
+ /* Define to 1 if you can safely include both <sys/time.h> and <time.h>. */
+-//not actually used for anything...
+-//#cmakedefine _CL_TIME_WITH_SYS_TIME  1 
++#cmakedefine _CL_TIME_WITH_SYS_TIME  1 
+ 
+ /* Define that we will be using -fvisibility=hidden, and 
+  * make public classes visible using __attribute__ ((visibility("default")))
+-- 
+2.37.3
+
diff --git a/pkgs/development/libraries/cpp-ipfs-http-client/default.nix b/pkgs/development/libraries/cpp-ipfs-http-client/default.nix
index 44fcbe5463cb0..38acb5def4a3a 100644
--- a/pkgs/development/libraries/cpp-ipfs-http-client/default.nix
+++ b/pkgs/development/libraries/cpp-ipfs-http-client/default.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation {
 
   NIX_CFLAGS_COMPILE = [
     "-Wno-error=range-loop-construct"
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 780a3e091dafb..3f84ac2be5d14 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -178,7 +178,11 @@ stdenv.mkDerivation ({
   };
 
   # Used by libgcc, elf-header, and others to determine ABI
-  passthru = { inherit version; minorRelease = version; };
+  passthru = {
+    inherit version;
+    minorRelease = version;
+    isFromBootstrapFiles = false;
+  };
 }
 
 // (removeAttrs args [ "withLinuxHeaders" "withGd" ]) //
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index 9193404d01235..3e7e33fb39fdd 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -4,6 +4,7 @@
 , withGd ? false
 , withLibcrypt? false
 , buildPackages
+, enableCopyLibGccHack ? !stdenv.enableGccExternalBootstrapForStdenv or false
 }:
 
 let
@@ -14,10 +15,12 @@ let
   ];
 in
 
+lib.pipe
 (callPackage ./common.nix { inherit stdenv; } {
   inherit withLinuxHeaders withGd profilingLibraries withLibcrypt;
   pname = "glibc" + lib.optionalString withGd "-gd";
-}).overrideAttrs(previousAttrs: {
+}) [
+  (pkg: pkg.overrideAttrs(previousAttrs: {
 
     # Note:
     # Things you write here override, and do not add to,
@@ -64,18 +67,46 @@ in
         ])
       ]);
 
-    # When building glibc from bootstrap-tools, we need libgcc_s at RPATH for
-    # any program we run, because the gcc will have been placed at a new
-    # store path than that determined when built (as a source for the
-    # bootstrap-tools tarball)
-    # Building from a proper gcc staying in the path where it was installed,
-    # libgcc_s will now be at {gcc}/lib, and gcc's libgcc will be found without
-    # any special hack.
-    # TODO: remove this hack. Things that rely on this hack today:
-    # - dejagnu: during linux bootstrap tcl SIGSEGVs
-    # - clang-wrapper in cross-compilation
-    # Last attempt: https://github.com/NixOS/nixpkgs/pull/36948
-    preInstall = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
+    # glibc needs to `dlopen()` `libgcc_s.so` (see `preInstall` phase below for
+    # why) but does not link against it.  Furthermore, glibc doesn't use the
+    # ordinary `dlopen()` call to do this; instead it uses one which ignores
+    # most paths:
+    #
+    #   https://sourceware.org/legacy-ml/libc-help/2013-11/msg00026.html
+    #
+    # In order to get it to not ignore `libgcc_s.so`, we have to add its path to
+    # `user-defined-trusted-dirs`:
+    #
+    #   https://sourceware.org/git/?p=glibc.git;a=blob;f=elf/Makefile;h=b509b3eada1fb77bf81e2a0ca5740b94ad185764#l1355
+    #
+    # Conveniently, this will also inform Nix of the fact that glibc depends on
+    # gcc.libgcc, since the path will be embedded in the resulting binary.
+    #
+    makeFlags =
+      (previousAttrs.makeFlags or [])
+      ++ lib.optionals (!enableCopyLibGccHack && stdenv.cc.cc?libgcc) [
+        "user-defined-trusted-dirs=${stdenv.cc.cc.libgcc}/lib"
+      ];
+
+    # Since glibc commit 9d79e0377b08773ec4f7ec38479b1563606f7ef7, Any program
+    # which calls `pthread_cancel()` or `pthread_exit()` must be able to
+    # `dlopen("libgcc_s.so")`.  If it cannot, `glibc` will abort the process.
+    # Earlier versions of `glibc` did not require `libgcc_s.so`.  These two
+    # functions are used very infrequently -- the most notable user is `libtcl`
+    # via `expect`.
+    #
+    # Why does `glibc` need `libgcc_s.so` in order to do this?
+    #
+    # Thread cancellation can be either deferred (the default) or asynchronous.
+    # Implementing asynchronous thread cancellation requires cooperation from the
+    # compiler that go beyond the C ABI -- usually stack-unwinding capabilities.
+    # I was unable to find any software in nixpkgs that uses asynchronous thread
+    # cancellation.  From `man 3 pthread_setcanceltype`: "Setting the
+    # cancelability type to PTHREAD_CANCEL_ASYNCHRONOUS is rarely useful".  In
+    # spite of this, `glibc` chose to remove the existing compiler-independent
+    # routine for deferred thread cancellation.
+    #
+    preInstall = lib.optionalString (enableCopyLibGccHack && stdenv.hostPlatform == stdenv.buildPlatform) ''
       if [ -f ${lib.getLib stdenv.cc.cc}/lib/libgcc_s.so.1 ]; then
           mkdir -p $out/lib
           cp ${lib.getLib stdenv.cc.cc}/lib/libgcc_s.so.1 $out/lib/libgcc_s.so.1
@@ -162,6 +193,15 @@ in
 
     separateDebugInfo = true;
 
-  meta = (previousAttrs.meta or {}) // { description = "The GNU C Library"; };
-})
+    meta = (previousAttrs.meta or {}) // { description = "The GNU C Library"; };
+  }))
+
+  (pkg: pkg.overrideAttrs (previousAttrs: {
+    passthru = (previousAttrs.passthru or {}) // {
+      isFromBootstrapTools = false;
+    } // lib.optionalAttrs (!enableCopyLibGccHack && stdenv.cc.cc?libgcc) {
+      inherit (stdenv.cc.cc) libgcc;
+    };
+  }))
+]
 
diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index 7857bfa0e3557..5c1ad9df47697 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -26,7 +26,10 @@ let self = stdenv.mkDerivation rec {
   # maybe let ghc use a version with *.so shared with rest of nixpkgs and *.a added
   # - see #5855 for related discussion
   outputs = [ "out" "dev" "info" ];
-  passthru.static = self.out;
+  passthru = {
+    static = self.out;
+    isFromBootstrapFiles = false;
+  };
 
   strictDeps = true;
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/development/libraries/gsmlib/default.nix b/pkgs/development/libraries/gsmlib/default.nix
index ec6646d98f572..f993eeedc33b9 100644
--- a/pkgs/development/libraries/gsmlib/default.nix
+++ b/pkgs/development/libraries/gsmlib/default.nix
@@ -2,13 +2,21 @@
 stdenv.mkDerivation rec {
   pname = "gsmlib";
   version = "unstable-2017-10-06";
+
   src = fetchFromGitHub {
     owner = "x-logLT";
     repo = "gsmlib";
     rev = "4f794b14450132f81673f7d3570c5a859aecf7ae";
     sha256 = "16v8aj914ac1ipf14a867ljib3gy7fhzd9ypxnsg9l0zi8mm3ml5";
   };
+
   nativeBuildInputs = [ autoreconfHook ];
+
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-std=c++14"
+  ];
+
   meta = with lib; {
     description = "Library to access GSM mobile phones through GSM modems";
     homepage = "https://github.com/x-logLT/gsmlib";
diff --git a/pkgs/development/libraries/iqueue/default.nix b/pkgs/development/libraries/iqueue/default.nix
index 04fd7202d1d16..ab873f82c579a 100644
--- a/pkgs/development/libraries/iqueue/default.nix
+++ b/pkgs/development/libraries/iqueue/default.nix
@@ -12,6 +12,12 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libbsd microsoft_gsl ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-parameter"
+    "-Wno-error=misleading-indentation"
+  ];
+
   meta = with lib; {
     homepage = "https://github.com/twosigma/iqueue";
     description = "Indexed queue";
diff --git a/pkgs/development/libraries/isl/generic.nix b/pkgs/development/libraries/isl/generic.nix
index 039d7138278b5..67836c527f5d2 100644
--- a/pkgs/development/libraries/isl/generic.nix
+++ b/pkgs/development/libraries/isl/generic.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
+  passthru.isFromBootstrapFiles = false;
   meta = {
     homepage = "https://libisl.sourceforge.io/";
     license = lib.licenses.lgpl21;
diff --git a/pkgs/development/libraries/libbladeRF/default.nix b/pkgs/development/libraries/libbladeRF/default.nix
index 4b2c48824fb7c..e5e51a447b484 100644
--- a/pkgs/development/libraries/libbladeRF/default.nix
+++ b/pkgs/development/libraries/libbladeRF/default.nix
@@ -46,6 +46,11 @@ in stdenv.mkDerivation rec {
     "-DBLADERF_GROUP=bladerf"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   hardeningDisable = [ "fortify" ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libcli/default.nix b/pkgs/development/libraries/libcli/default.nix
index da076a590e19a..6e38c1ab84f13 100644
--- a/pkgs/development/libraries/libcli/default.nix
+++ b/pkgs/development/libraries/libcli/default.nix
@@ -24,6 +24,11 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" "AR=${stdenv.cc.targetPrefix}ar" "PREFIX=$(out)" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=address"
+  ];
+
   meta = with lib; {
     description = "Emulate a Cisco-style telnet command-line interface";
     homepage = "http://sites.dparrish.com/libcli";
diff --git a/pkgs/development/libraries/libdynd/default.nix b/pkgs/development/libraries/libdynd/default.nix
index b418279e477b8..6018e00f944ec 100644
--- a/pkgs/development/libraries/libdynd/default.nix
+++ b/pkgs/development/libraries/libdynd/default.nix
@@ -15,14 +15,17 @@ stdenv.mkDerivation rec {
     "-DDYND_BUILD_BENCHMARKS=OFF"
   ];
 
-  # added to fix build with gcc7+
   NIX_CFLAGS_COMPILE = builtins.toString [
+    # added to fix build with gcc7+
     "-Wno-error=implicit-fallthrough"
     "-Wno-error=nonnull"
     "-Wno-error=tautological-compare"
     "-Wno-error=class-memaccess"
     "-Wno-error=parentheses"
     "-Wno-error=deprecated-copy"
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=maybe-uninitialized"
   ];
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libmpc/default.nix b/pkgs/development/libraries/libmpc/default.nix
index 481f12e17526f..23126cf2db3c7 100644
--- a/pkgs/development/libraries/libmpc/default.nix
+++ b/pkgs/development/libraries/libmpc/default.nix
@@ -38,4 +38,5 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.all;
     maintainers = [ ];
   };
+  passthru.isFromBootstrapFiles = false;
 }
diff --git a/pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix b/pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix
index 6578a86e35b1b..3997ceb623f38 100644
--- a/pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix
+++ b/pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
     "--with-x-locale-root=${libX11.out}/share/X11/locale"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   preBuild = lib.optionalString stdenv.isDarwin ''
     sed -i 's/,--version-script=.*$//' Makefile
   '';
diff --git a/pkgs/development/libraries/mpfr/default.nix b/pkgs/development/libraries/mpfr/default.nix
index e0a33e27c12c0..6dc8cf095fcbc 100644
--- a/pkgs/development/libraries/mpfr/default.nix
+++ b/pkgs/development/libraries/mpfr/default.nix
@@ -48,6 +48,7 @@ stdenv.mkDerivation rec {
           pcregrep -o1 '<title>GNU MPFR version ([0-9.]+)</title>')"
       update-source-version ${pname} "$new_version"
     '';
+    isFromBootstrapFiles = false;
   };
 
   meta = {
diff --git a/pkgs/development/libraries/octomap/default.nix b/pkgs/development/libraries/octomap/default.nix
index 9b1635511ec62..5a2064eb595dc 100644
--- a/pkgs/development/libraries/octomap/default.nix
+++ b/pkgs/development/libraries/octomap/default.nix
@@ -10,10 +10,16 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     hash = "sha256-qE5i4dGugm7tR5tgDCpbla/R7hYR/PI8BzrZQ4y6Yz8=";
   };
+
   sourceRoot = "source/octomap";
 
   nativeBuildInputs = [ cmake ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+  ];
+
   meta = with lib; {
     description = "A probabilistic, flexible, and compact 3D mapping library for robotic systems";
     homepage = "https://octomap.github.io/";
diff --git a/pkgs/development/libraries/opendbx/default.nix b/pkgs/development/libraries/opendbx/default.nix
index 0460f012424c3..ce8064cdc1eb9 100644
--- a/pkgs/development/libraries/opendbx/default.nix
+++ b/pkgs/development/libraries/opendbx/default.nix
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ readline libmysqlclient postgresql sqlite ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-std=c++14"
+  ];
+
   meta = with lib; {
     broken = stdenv.isDarwin;
     description = "Extremely lightweight but extensible database access library written in C";
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index 057baafdc610d..7ba261e54a877 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -36,8 +36,16 @@ stdenv.mkDerivation rec {
     "tools"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=deprecated-copy -Wno-error=pessimizing-move"
-    + lib.optionalString stdenv.cc.isClang "-Wno-error=unused-private-field -faligned-allocation";
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+    "-Wno-error=deprecated-copy"
+    "-Wno-error=pessimizing-move"
+    # Needed with GCC 12
+    "-Wno-error=format-truncation"
+    "-Wno-error=maybe-uninitialized"
+  ] ++ lib.optionals stdenv.cc.isClang [
+    "-Wno-error=unused-private-field"
+    "-faligned-allocation"
+  ];
 
   cmakeFlags = [
     "-DPORTABLE=1"
diff --git a/pkgs/development/libraries/roctracer/default.nix b/pkgs/development/libraries/roctracer/default.nix
index ee844bb417ba9..87cf7d0819ad1 100644
--- a/pkgs/development/libraries/roctracer/default.nix
+++ b/pkgs/development/libraries/roctracer/default.nix
@@ -62,6 +62,11 @@ stdenv.mkDerivation (finalAttrs: {
     "-DCMAKE_INSTALL_INCLUDEDIR=include"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   postPatch = ''
     export HIP_DEVICE_LIB_PATH=${rocm-device-libs}/amdgcn/bitcode
   '' + lib.optionalString (!buildTests) ''
diff --git a/pkgs/development/libraries/swiftshader/default.nix b/pkgs/development/libraries/swiftshader/default.nix
index 2c508a3735f96..28aabc03682be 100644
--- a/pkgs/development/libraries/swiftshader/default.nix
+++ b/pkgs/development/libraries/swiftshader/default.nix
@@ -13,6 +13,12 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake python3 jq ];
   buildInputs = [ libX11 libXext zlib ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+    "-Wno-error=uninitialized"
+  ];
+
   # Make sure we include the drivers and icd files in the output as the cmake
   # generated install command only puts in the spirv-tools stuff.
   installPhase = ''
diff --git a/pkgs/development/libraries/unittest-cpp/default.nix b/pkgs/development/libraries/unittest-cpp/default.nix
index 6f27a71b3ee46..e9f67a74f9a3e 100644
--- a/pkgs/development/libraries/unittest-cpp/default.nix
+++ b/pkgs/development/libraries/unittest-cpp/default.nix
@@ -1,4 +1,9 @@
-{lib, stdenv, fetchFromGitHub, cmake}:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, cmake
+}:
 
 stdenv.mkDerivation rec {
   pname = "unittest-cpp";
@@ -11,6 +16,14 @@ stdenv.mkDerivation rec {
     sha256 = "0sxb3835nly1jxn071f59fwbdzmqi74j040r81fanxyw3s1azw0i";
   };
 
+  patches = [
+    # GCC12 Patch
+    (fetchpatch {
+      url = "https://github.com/unittest-cpp/unittest-cpp/pull/185/commits/f361c2a1034c02ba8059648f9a04662d6e2b5553.patch";
+      hash = "sha256-xyhV2VBelw/uktUXSZ3JBxgG+8/Mout/JiXEZVV2+2Y=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   doCheck = false;
diff --git a/pkgs/development/libraries/uri/default.nix b/pkgs/development/libraries/uri/default.nix
index 980d073f1281e..6189fcf016de2 100644
--- a/pkgs/development/libraries/uri/default.nix
+++ b/pkgs/development/libraries/uri/default.nix
@@ -11,7 +11,12 @@ stdenv.mkDerivation rec {
     sha256 = "148361pixrm94q6v04k13s1msa04bx9yc3djb0lxpa7dlw19vhcd";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=parentheses";
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=parentheses"
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=nonnull"
+  ];
 
   nativeBuildInputs = [ cmake doxygen ];
 
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 0d7e12a51fb19..8c669a0ac8d16 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -248,6 +248,7 @@ stdenv.mkDerivation (finalAttrs: {
     # (around PLUGINS) for cases that support or not support plugins.
     # No platform specific filters yet here.
     hasPluginAPI = enableGold;
+    isFromBootstrapFiles = false;
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/wlcs/default.nix b/pkgs/development/tools/wlcs/default.nix
index f2075f683b1eb..558a05730c6f6 100644
--- a/pkgs/development/tools/wlcs/default.nix
+++ b/pkgs/development/tools/wlcs/default.nix
@@ -47,6 +47,11 @@ stdenv.mkDerivation rec {
     wayland
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+  ];
+
   passthru.updateScript = gitUpdater {
     rev-prefix = "v";
   };
diff --git a/pkgs/games/cataclysm-dda/stable.nix b/pkgs/games/cataclysm-dda/stable.nix
index 3bf2f884ab36a..da84422308cc7 100644
--- a/pkgs/games/cataclysm-dda/stable.nix
+++ b/pkgs/games/cataclysm-dda/stable.nix
@@ -44,6 +44,11 @@ let
       "VERSION=${version}"
     ];
 
+    NIX_CFLAGS_COMPILE = [
+      # Needed with GCC 12
+      "-Wno-error=array-bounds"
+    ];
+
     meta = common.meta // {
       maintainers = with lib.maintainers;
         common.meta.maintainers ++ [ skeidel ];
diff --git a/pkgs/games/cdogs-sdl/default.nix b/pkgs/games/cdogs-sdl/default.nix
index 23eb6e96dcb8e..a4943187dd694 100644
--- a/pkgs/games/cdogs-sdl/default.nix
+++ b/pkgs/games/cdogs-sdl/default.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation rec {
     "-DCMAKE_C_FLAGS=-Wno-error=array-bounds"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=stringop-overflow"
+  ];
+
   nativeBuildInputs = [
     pkg-config
     cmake
diff --git a/pkgs/games/gimx/default.nix b/pkgs/games/gimx/default.nix
index 785d38a759a02..410228c4f02fb 100644
--- a/pkgs/games/gimx/default.nix
+++ b/pkgs/games/gimx/default.nix
@@ -38,6 +38,14 @@ in stdenv.mkDerivation rec {
   '';
 
   makeFlags = [ "build-core" ];
+
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=address"
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=use-after-free"
+  ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/games/liquidwar/default.nix b/pkgs/games/liquidwar/default.nix
index e012886c884d3..a3532fa6e1980 100644
--- a/pkgs/games/liquidwar/default.nix
+++ b/pkgs/games/liquidwar/default.nix
@@ -30,11 +30,14 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  NIX_CFLAGS_COMPILE =
-    "-Wno-error=deprecated-declarations" +
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=deprecated-declarations"
+    # Needed with GCC 12
+    "-Wno-error=address"
+    "-Wno-error=use-after-free"
     # Avoid GL_GLEXT_VERSION double definition
     " -DNO_SDL_GLEXT"
-  ;
+  ];
 
   # To avoid problems finding SDL_types.h.
   configureFlags = [ "CFLAGS=-I${lib.getDev SDL}/include/SDL" ];
diff --git a/pkgs/games/openrct2/default.nix b/pkgs/games/openrct2/default.nix
index d474b0eae92ac..10914d4107748 100644
--- a/pkgs/games/openrct2/default.nix
+++ b/pkgs/games/openrct2/default.nix
@@ -94,6 +94,11 @@ stdenv.mkDerivation {
     "-DDOWNLOAD_TITLE_SEQUENCES=OFF"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+  ];
+
   postUnpack = ''
     cp -r ${objects-src}         $sourceRoot/data/object
     cp -r ${title-sequences-src} $sourceRoot/data/sequence
diff --git a/pkgs/os-specific/linux/anbox/default.nix b/pkgs/os-specific/linux/anbox/default.nix
index 2a98aa82ebbd5..9d3afc9ad2185 100644
--- a/pkgs/os-specific/linux/anbox/default.nix
+++ b/pkgs/os-specific/linux/anbox/default.nix
@@ -85,6 +85,11 @@ stdenv.mkDerivation rec {
     systemd
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=mismatched-new-delete"
+  ];
+
   patchPhase = ''
     patchShebangs scripts
 
diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix
index 198cd86816466..efc64e81af551 100644
--- a/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened/config.nix
@@ -65,8 +65,8 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
   # Gather additional entropy at boot time for systems that may not have appropriate entropy sources.
   GCC_PLUGIN_LATENT_ENTROPY = yes;
 
-  GCC_PLUGIN_STRUCTLEAK = yes; # A port of the PaX structleak plugin
-  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = yes; # Also cover structs passed by address
+  GCC_PLUGIN_STRUCTLEAK = option yes; # A port of the PaX structleak plugin
+  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = option yes; # Also cover structs passed by address
   GCC_PLUGIN_STACKLEAK = whenAtLeast "4.20" yes; # A port of the PaX stackleak plugin
   GCC_PLUGIN_RANDSTRUCT = whenOlder "5.19" yes; # A port of the PaX randstruct plugin
   GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenOlder "5.19" yes;
diff --git a/pkgs/os-specific/linux/odp-dpdk/default.nix b/pkgs/os-specific/linux/odp-dpdk/default.nix
index 3aeef46255628..7cb364597bb61 100644
--- a/pkgs/os-specific/linux/odp-dpdk/default.nix
+++ b/pkgs/os-specific/linux/odp-dpdk/default.nix
@@ -25,6 +25,7 @@ in stdenv.mkDerivation rec {
     autoreconfHook
     pkg-config
   ];
+
   buildInputs = [
     dpdk_19_11
     libconfig
@@ -38,6 +39,12 @@ in stdenv.mkDerivation rec {
     libbpf
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+    "-Wno-error=uninitialized"
+  ];
+
   # binaries will segfault otherwise
   dontStrip = true;
 
diff --git a/pkgs/os-specific/linux/pktgen/default.nix b/pkgs/os-specific/linux/pktgen/default.nix
index 20db1cdd74f94..60a55096b446e 100644
--- a/pkgs/os-specific/linux/pktgen/default.nix
+++ b/pkgs/os-specific/linux/pktgen/default.nix
@@ -46,6 +46,12 @@ stdenv.mkDerivation rec {
   RTE_SDK = dpdk;
   GUI = lib.optionalString withGtk "true";
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=address"
+    "-Wno-error=use-after-free"
+  ];
+
   # requires symbols from this file
   NIX_LDFLAGS = "-lrte_net_bond";
 
diff --git a/pkgs/servers/foundationdb/cmake.nix b/pkgs/servers/foundationdb/cmake.nix
index 9d65198c8cef3..436f0a7fc4d17 100644
--- a/pkgs/servers/foundationdb/cmake.nix
+++ b/pkgs/servers/foundationdb/cmake.nix
@@ -60,6 +60,11 @@ let
             (lib.optionalString (!useClang) "-DUSE_LD=GOLD")
           ];
 
+        NIX_CFLAGS_COMPILE = [
+          # Needed with GCC 12
+          "-Wno-error=missing-template-keyword"
+        ];
+
         inherit patches;
 
         # fix up the use of the very weird and custom 'fdb_install' command by just
diff --git a/pkgs/servers/osrm-backend/default.nix b/pkgs/servers/osrm-backend/default.nix
index ed163f2547df1..cddda5d399f2f 100644
--- a/pkgs/servers/osrm-backend/default.nix
+++ b/pkgs/servers/osrm-backend/default.nix
@@ -15,6 +15,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ bzip2 libxml2 libzip boost lua luabind tbb expat ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=stringop-overflow"
+    "-Wno-error=uninitialized"
+  ];
+
   postInstall = "mkdir -p $out/share/osrm-backend && cp -r ../profiles $out/share/osrm-backend/profiles";
 
   meta = {
diff --git a/pkgs/servers/tvheadend/default.nix b/pkgs/servers/tvheadend/default.nix
index 833d31de40131..e9db31f792ff6 100644
--- a/pkgs/servers/tvheadend/default.nix
+++ b/pkgs/servers/tvheadend/default.nix
@@ -78,6 +78,8 @@ in stdenv.mkDerivation {
   NIX_CFLAGS_COMPILE = [
     "-Wno-error=format-truncation"
     "-Wno-error=stringop-truncation"
+    # Needed with GCC 12
+    "-Wno-error=use-after-free"
   ];
 
   configureFlags = [
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index a0ce6a7424bd8..cc32e29188f79 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -887,6 +887,11 @@ self: super:
           "--disable-tls"
         ];
 
+        NIX_CFLAGS_COMPILE = [
+          # Needed with GCC 12
+          "-Wno-error=array-bounds"
+        ];
+
         postInstall = ''
           rm -fr $out/share/X11/xkb/compiled # otherwise X will try to write in it
           ( # assert() keeps runtime reference xorgserver-dev in xf86-video-intel and others
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 5c7dfcceec644..c6eb7116dc572 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -93,6 +93,7 @@
   files = archLookupTable.${localSystem.system} or (if getCompatibleTools != null then getCompatibleTools
     else (abort "unsupported platform for the pure Linux stdenv"));
   in files
+, enableGccExternalBootstrapForStdenv ? true
 }:
 
 assert crossSystem == localSystem;
@@ -100,6 +101,23 @@ assert crossSystem == localSystem;
 let
   inherit (localSystem) system;
 
+  isFromNixpkgs = pkg: !(isFromBootstrapFiles pkg);
+  isFromBootstrapFiles =
+    pkg: pkg.passthru.isFromBootstrapFiles
+      or (throw "${pkg.name} from ${pkg.stdenv.name} is missing passthru.isFromBootstrapFiles attribute");
+  isBuiltByNixpkgsCompiler =
+    pkg: isFromNixpkgs pkg && isFromNixpkgs pkg.stdenv.cc;
+  isBuiltByBootstrapFilesCompiler =
+    pkg: isFromNixpkgs pkg && isFromBootstrapFiles pkg.stdenv.cc;
+
+  commonGccOverrides = {
+    enableExternalBootstrap = enableGccExternalBootstrapForStdenv;
+    # Use a deterministically built compiler
+    # see https://github.com/NixOS/nixpkgs/issues/108475 for context
+    reproducibleBuild = true;
+    profiledCompiler = false;
+  };
+
   commonPreHook =
     ''
       export NIX_ENFORCE_PURITY="''${NIX_ENFORCE_PURITY-1}"
@@ -117,16 +135,14 @@ let
 
 
   # Download and unpack the bootstrap tools (coreutils, GCC, Glibc, ...).
-  bootstrapTools = import (if localSystem.libc == "musl" then ./bootstrap-tools-musl else ./bootstrap-tools) {
+  bootstrapTools = (import (if localSystem.libc == "musl" then ./bootstrap-tools-musl else ./bootstrap-tools) {
     inherit system bootstrapFiles;
-    extraAttrs = lib.optionalAttrs
-      config.contentAddressedByDefault
-      {
-        __contentAddressed = true;
-        outputHashAlgo = "sha256";
-        outputHashMode = "recursive";
-      };
-  };
+    extraAttrs = lib.optionalAttrs config.contentAddressedByDefault {
+      __contentAddressed = true;
+      outputHashAlgo = "sha256";
+      outputHashMode = "recursive";
+    };
+  }) // { passthru.isFromBootstrapFiles = true; };
 
   getLibc = stage: stage.${localSystem.libc};
 
@@ -161,7 +177,7 @@ let
 
         cc = if prevStage.gcc-unwrapped == null
              then null
-             else lib.makeOverridable (import ../../build-support/cc-wrapper) {
+             else (lib.makeOverridable (import ../../build-support/cc-wrapper) {
           name = "${name}-gcc-wrapper";
           nativeTools = false;
           nativeLibc = false;
@@ -175,9 +191,18 @@ let
           inherit lib;
           inherit (prevStage) coreutils gnugrep;
           stdenvNoCC = prevStage.ccWrapperStdenv;
-        };
+        }).overrideAttrs(a: lib.optionalAttrs (prevStage.gcc-unwrapped.pname or "" == "xgcc") {
+          postFixup = (a.postFixup or "") + ''
+            echo "--sysroot=${lib.getDev (getLibc prevStage)}" >> $out/nix-support/cc-cflags
+          '';
+        });
 
-        overrides = self: super: (overrides self super) // { fetchurl = thisStdenv.fetchurlBoot; };
+        overrides = self: super: {
+          inherit (prevStage) perl;  # only build perl *once*
+        } // (overrides self super) // {
+          fetchurl = thisStdenv.fetchurlBoot;
+        };
+        extraAttrs = { inherit enableGccExternalBootstrapForStdenv; };
       };
 
     in {
@@ -186,12 +211,13 @@ let
     };
 
 in
-
+  assert bootstrapTools.passthru.isFromBootstrapFiles;  # sanity check
 [
 
   ({}: {
     __raw = true;
 
+    stdenv = { inherit enableGccExternalBootstrapForStdenv; };
     gcc-unwrapped = null;
     binutils = null;
     coreutils = null;
@@ -201,8 +227,6 @@ in
   # Build a dummy stdenv with no GCC or working fetchurl.  This is
   # because we need a stdenv to build the GCC wrapper and fetchurl.
   #
-  # resulting stage0 stdenv:
-  # - coreutils, binutils, glibc, gcc: from bootstrapFiles
   (prevStage: stageFun prevStage {
     name = "bootstrap-stage0";
 
@@ -220,7 +244,7 @@ in
       ${localSystem.libc} = self.stdenv.mkDerivation {
         pname = "bootstrap-stage0-${localSystem.libc}";
         strictDeps = true;
-        version = "bootstrap";
+        version = "bootstrapFiles";
         enableParallelBuilding = true;
         buildCommand = ''
           mkdir -p $out
@@ -230,6 +254,7 @@ in
         '' + lib.optionalString (localSystem.libc == "musl") ''
           ln -s ${bootstrapTools}/include-libc $out/include
         '';
+        passthru.isFromBootstrapFiles = true;
       };
       gcc-unwrapped = bootstrapTools;
       binutils = import ../../build-support/bintools-wrapper {
@@ -258,10 +283,14 @@ in
   # If we ever need to use a package from more than one stage back, we
   # simply re-export those packages in the middle stage(s) using the
   # overrides attribute and the inherit syntax.
-  #
-  # resulting stage1 stdenv:
-  # - coreutils, binutils, glibc, gcc: from bootstrapFiles
-  (prevStage: stageFun prevStage {
+  (prevStage:
+    # previous stage0 stdenv:
+    assert isFromBootstrapFiles prevStage.binutils;
+    assert isFromBootstrapFiles prevStage."${localSystem.libc}";
+    assert isFromBootstrapFiles prevStage.gcc-unwrapped;
+    assert isFromBootstrapFiles prevStage.coreutils;
+    assert isFromBootstrapFiles prevStage.gnugrep;
+    stageFun prevStage {
     name = "bootstrap-stage1";
 
     # Rebuild binutils to use from stage2 onwards.
@@ -281,17 +310,90 @@ in
       # won't be included in the final stdenv and won't be exported to
       # top-level pkgs as an override either.
       perl = super.perl.override { enableThreading = false; enableCrypt = false; };
+    } // lib.optionalAttrs (enableGccExternalBootstrapForStdenv) {
+      inherit (prevStage) binutils;
     };
   })
 
+] ++ lib.optionals enableGccExternalBootstrapForStdenv [
+
+  # First rebuild of gcc; this is linked against all sorts of junk
+  # from the bootstrap-files, but we only care about the code that
+  # this compiler *emits*.  The `gcc` binary produced in this stage
+  # is not part of the final stdenv.
+  (prevStage:
+    assert isBuiltByBootstrapFilesCompiler prevStage.binutils-unwrapped;
+    assert            isFromBootstrapFiles prevStage."${localSystem.libc}";
+    assert            isFromBootstrapFiles prevStage.gcc-unwrapped;
+    assert            isFromBootstrapFiles prevStage.coreutils;
+    assert            isFromBootstrapFiles prevStage.gnugrep;
+    stageFun prevStage {
+      name = "bootstrap-stage-xgcc";
+      overrides = final: prev: lib.optionalAttrs enableGccExternalBootstrapForStdenv {
+        inherit (prevStage) ccWrapperStdenv coreutils gnugrep gettext bison texinfo zlib gnum4;
+        patchelf = bootstrapTools;
+        ${localSystem.libc} = getLibc prevStage;
+        gmp      = prev.gmp.override { cxx = false; };
+        gcc-unwrapped =
+          (prev.gcc-unwrapped.override (commonGccOverrides // {
+            enablePlugin = false;
+          })).overrideAttrs (a: {
+            # The most logical name for this package would be something like
+            # "gcc-stage1".  Unfortunately "stage" is already reserved for the
+            # layers of stdenv, so using "stage" in the name of this package
+            # would cause massive confusion.
+            #
+            # Gcc calls its "stage1" compiler `xgcc` (--disable-bootstrap results
+            # in `xgcc` being copied to $prefix/bin/gcc).  So we imitate that.
+            #
+            pname = "x${a.pname}";
+
+            # Gcc will look for the C library headers in
+            #
+            #    ${with_build_sysroot}${native_system_header_dir}
+            #
+            # The ordinary gcc expression sets `--with-build-sysroot=/` and sets
+            # `native-system-header-dir` to `"${lib.getDev stdenv.cc.libc}/include`.
+            #
+            # Unfortunately the value of "--with-native-system-header-dir=" gets "burned in" to the
+            # compiler, and it is quite difficult to get the compiler to change or ignore it
+            # afterwards.  On the other hand, the `sysroot` is very easy to change; you can just pass
+            # a `--sysroot` flag to `gcc`.
+            #
+            # So we override the expression to remove the default settings for these flags, and
+            # replace them such that the concatenated value will be the same as before, but we split
+            # the value between the two variables differently: `--native-system-header-dir=/include`,
+            # and `--with-build-sysroot=${lib.getDev stdenv.cc.libc}`.
+            #
+            configureFlags =
+              (builtins.filter
+                (f: !(
+                  lib.hasPrefix "--with-native-system-header-dir=" f ||
+                  lib.hasPrefix "--with-build-sysroot=" f
+                ))
+                (a.configureFlags or []))
+              ++ [
+                "--with-native-system-header-dir=/include"
+                "--with-build-sysroot=${lib.getDev final.stdenv.cc.libc}"
+              ];
+          });
+      };
+    })
+
+] ++ [
 
   # 2nd stdenv that contains our own rebuilt binutils and is used for
   # compiling our own Glibc.
   #
-  # resulting stage2 stdenv:
-  # - coreutils, glibc, gcc: from bootstrapFiles
-  # - binutils: from nixpkgs, built by bootstrapFiles toolchain
-  (prevStage: stageFun prevStage {
+  (prevStage:
+    # previous stage1 stdenv:
+    assert                                         isBuiltByBootstrapFilesCompiler prevStage.binutils-unwrapped;
+    assert                                                    isFromBootstrapFiles prevStage."${localSystem.libc}";
+    assert !enableGccExternalBootstrapForStdenv ->            isFromBootstrapFiles prevStage.gcc-unwrapped;
+    assert  enableGccExternalBootstrapForStdenv -> isBuiltByBootstrapFilesCompiler prevStage.gcc-unwrapped;
+    assert                                                    isFromBootstrapFiles prevStage.coreutils;
+    assert                                                    isFromBootstrapFiles prevStage.gnugrep;
+    stageFun prevStage {
     name = "bootstrap-stage2";
 
     overrides = self: super: {
@@ -334,6 +436,7 @@ in
         bintools = self.stdenvNoCC.mkDerivation {
           pname = prevStage.bintools.bintools.pname + "-patchelfed-ld";
           inherit (prevStage.bintools.bintools) version;
+          passthru = { inherit (prevStage.bintools.passthru) isFromBootstrapFiles; };
           enableParallelBuilding = true;
           dontUnpack = true;
           dontBuild = true;
@@ -349,6 +452,8 @@ in
           '';
         };
       };
+    } // lib.optionals enableGccExternalBootstrapForStdenv {
+      inherit (prevStage) gettext texinfo which;
     };
 
     # `libtool` comes with obsolete config.sub/config.guess that don't recognize Risc-V.
@@ -360,36 +465,70 @@ in
   # Construct a third stdenv identical to the 2nd, except that this
   # one uses the rebuilt Glibc from stage2.  It still uses the recent
   # binutils and rest of the bootstrap tools, including GCC.
-  #
-  # resulting stage3 stdenv:
-  # - coreutils, gcc: from bootstrapFiles
-  # - glibc, binutils: from nixpkgs, built by bootstrapFiles toolchain
-  (prevStage: stageFun prevStage {
+  (prevStage:
+    # previous stage2 stdenv:
+    assert !enableGccExternalBootstrapForStdenv -> isBuiltByBootstrapFilesCompiler prevStage.binutils-unwrapped;
+    assert  enableGccExternalBootstrapForStdenv ->        isBuiltByNixpkgsCompiler prevStage.binutils-unwrapped;
+    assert !enableGccExternalBootstrapForStdenv -> isBuiltByBootstrapFilesCompiler prevStage.${localSystem.libc};
+    assert  enableGccExternalBootstrapForStdenv ->        isBuiltByNixpkgsCompiler prevStage.${localSystem.libc};
+    assert !enableGccExternalBootstrapForStdenv ->            isFromBootstrapFiles prevStage.gcc-unwrapped;
+    assert  enableGccExternalBootstrapForStdenv -> isBuiltByBootstrapFilesCompiler prevStage.gcc-unwrapped;
+    assert                                                    isFromBootstrapFiles prevStage.coreutils;
+    assert                                                    isFromBootstrapFiles prevStage.gnugrep;
+    assert  enableGccExternalBootstrapForStdenv -> lib.all isBuiltByNixpkgsCompiler (with prevStage; [ gmp isl_0_20 libmpc mpfr ]);
+    stageFun prevStage {
     name = "bootstrap-stage3";
 
     overrides = self: super: rec {
       inherit (prevStage)
         ccWrapperStdenv
-        binutils coreutils gnugrep gettext
-        perl patchelf linuxHeaders gnum4 bison libidn2 libunistring;
+        binutils coreutils gnugrep patchelf
+        perl linuxHeaders gnum4 bison libidn2 libunistring;
+      } // lib.optionalAttrs (enableGccExternalBootstrapForStdenv) {
+        inherit (prevStage) gettext libxcrypt;
+        # We build a special copy of libgmp which doesn't use libstdc++, because
+        # xgcc++'s libstdc++ references the bootstrap-files (which is what
+        # compiles xgcc++).
+        gmp = super.gmp.override { cxx = false; };
+      } // {
       ${localSystem.libc} = getLibc prevStage;
-      gcc-unwrapped =
+      gcc-unwrapped = (super.gcc-unwrapped.override (commonGccOverrides // {
+        enableLibGccOutput = enableGccExternalBootstrapForStdenv;
+      } // lib.optionalAttrs enableGccExternalBootstrapForStdenv {
+        inherit (prevStage) which;
+        # It appears that the g++ build process links libcc1
+        # (which is not a g++ plugin; it is a gdb plugin)
+        # against the libstdc++ from the compiler that *built*
+        # g++, not the libstdc++ which was just built.  This
+        # causes a reference:
+        #
+        #   stdenv <- gcc-lib <- xgcc-lib <- bootstrap-files
+        #
+        # For now, anybody who is using the libcc1 plugin for
+        # gdb will need to build an extra compiler.  The
+        # long-term solution is to make libcc1 a separate
+        # derivation from gcc, rather than part of gcc's lib
+        # output (I want to do this for quite a few of
+        # gcc-lib's bits and pieces).
+        #
+        enableGdbPlugin = false;
+      } // lib.optionalAttrs (!enableGccExternalBootstrapForStdenv) (
         let makeStaticLibrariesAndMark = pkg:
               lib.makeOverridable (pkg.override { stdenv = self.makeStaticLibraries self.stdenv; })
                 .overrideAttrs (a: { pname = "${a.pname}-stage3"; });
-        in super.gcc-unwrapped.override {
-        # Link GCC statically against GMP etc.  This makes sense because
-        # these builds of the libraries are only used by GCC, so it
-        # reduces the size of the stdenv closure.
-        gmp = makeStaticLibrariesAndMark super.gmp;
-        mpfr = makeStaticLibrariesAndMark super.mpfr;
-        libmpc = makeStaticLibrariesAndMark super.libmpc;
-        isl = makeStaticLibrariesAndMark super.isl_0_20;
-        # Use a deterministically built compiler
-        # see https://github.com/NixOS/nixpkgs/issues/108475 for context
-        reproducibleBuild = true;
-        profiledCompiler = false;
-      };
+        in {
+          # Link GCC statically against GMP etc.  This makes sense because
+          # these builds of the libraries are only used by GCC, so it
+          # reduces the size of the stdenv closure.
+          gmp = makeStaticLibrariesAndMark super.gmp;
+          mpfr = makeStaticLibrariesAndMark super.mpfr;
+          libmpc = makeStaticLibrariesAndMark super.libmpc;
+          isl = makeStaticLibrariesAndMark super.isl_0_20;
+        })
+      )).overrideAttrs (a: {
+        # so we can add them to allowedRequisites below
+        passthru = a.passthru // { inherit (self) gmp mpfr libmpc isl; };
+      });
     };
     extraNativeBuildInputs = [ prevStage.patchelf ] ++
       # Many tarballs come with obsolete config.sub/config.guess that don't recognize aarch64.
@@ -401,17 +540,25 @@ in
   # Construct a fourth stdenv that uses the new GCC.  But coreutils is
   # still from the bootstrap tools.
   #
-  # resulting stage4 stdenv:
-  # - coreutils: from bootstrapFiles
-  # - glibc, binutils: from nixpkgs, built by bootstrapFiles toolchain
-  # - gcc: from nixpkgs, built by bootstrapFiles toolchain. Can assume
-  #        it has almost no code from bootstrapTools as gcc bootstraps
-  #        internally. The only exceptions are crt files from glibc
-  #        built by bootstrapTools used to link executables and libraries,
-  #        and the bootstrapTools-built, statically-linked
-  #        lib{mpfr,mpc,gmp,isl}.a which are linked into the final gcc
-  #        (see commit cfde88976ba4cddd01b1bb28b40afd12ea93a11d).
-  (prevStage: stageFun prevStage {
+  (prevStage:
+    # previous stage3 stdenv:
+    assert !enableGccExternalBootstrapForStdenv -> isBuiltByBootstrapFilesCompiler prevStage.binutils-unwrapped;
+    assert  enableGccExternalBootstrapForStdenv ->        isBuiltByNixpkgsCompiler prevStage.binutils-unwrapped;
+    assert !enableGccExternalBootstrapForStdenv -> isBuiltByBootstrapFilesCompiler prevStage.${localSystem.libc};
+    assert  enableGccExternalBootstrapForStdenv ->        isBuiltByNixpkgsCompiler prevStage.${localSystem.libc};
+    assert !enableGccExternalBootstrapForStdenv -> isBuiltByBootstrapFilesCompiler prevStage.gcc-unwrapped;
+    assert  enableGccExternalBootstrapForStdenv ->        isBuiltByNixpkgsCompiler prevStage.gcc-unwrapped;
+    assert                                                    isFromBootstrapFiles prevStage.coreutils;
+    assert                                                    isFromBootstrapFiles prevStage.gnugrep;
+    # If !enableGccExternalBootstrapForStdenv:
+    # Can assume prevStage.gcc-unwrapped has almost no code from
+    # bootstrapTools as gcc bootstraps internally. The only
+    # exceptions are crt files from glibc built bybootstrapTools
+    # used to link executables and libraries, and the
+    # bootstrapTools-built, statically-linked
+    # lib{mpfr,mpc,gmp,isl}.a which are linked into the final gcc
+    # (see commit cfde88976ba4cddd01b1bb28b40afd12ea93a11d).
+    stageFun prevStage {
     name = "bootstrap-stage4";
 
     overrides = self: super: {
@@ -421,6 +568,7 @@ in
       # other purposes (binutils and top-level pkgs) too.
       inherit (prevStage) gettext gnum4 bison perl texinfo zlib linuxHeaders libidn2 libunistring;
       ${localSystem.libc} = getLibc prevStage;
+
       binutils = super.binutils.override {
         # Don't use stdenv's shell but our own
         shell = self.bash + "/bin/bash";
@@ -430,10 +578,12 @@ in
         };
       };
 
+    } // lib.optionalAttrs (!enableGccExternalBootstrapForStdenv) {
       # force gmp to rebuild so we have the option of dynamically linking
       # libgmp without creating a reference path from:
       #   stage5.gcc -> stage4.coreutils -> stage3.glibc -> bootstrap
       gmp = lib.makeOverridable (super.gmp.override { stdenv = self.stdenv; }).overrideAttrs (a: { pname = "${a.pname}-stage4"; });
+    } // {
 
       # To allow users' overrides inhibit dependencies too heavy for
       # bootstrap, like guile: https://github.com/NixOS/nixpkgs/issues/181188
@@ -468,17 +618,17 @@ in
   # dependency (`nix-store -qR') on bootstrapTools or the first
   # binutils built.
   #
-  # resulting stage5 (final) stdenv:
-  # - coreutils, binutils: from nixpkgs, built by nixpkgs toolchain
-  # - glibc: from nixpkgs, built by bootstrapFiles toolchain
-  # - gcc: from nixpkgs, built by bootstrapFiles toolchain. Can assume
-  #        it has almost no code from bootstrapTools as gcc bootstraps
-  #        internally. The only exceptions are crt files from glibc
-  #        built by bootstrapTools used to link executables and libraries,
-  #        and the bootstrapTools-built, statically-linked
-  #        lib{mpfr,mpc,gmp,isl}.a which are linked into the final gcc
-  #        (see commit cfde88976ba4cddd01b1bb28b40afd12ea93a11d).
-  (prevStage: {
+  (prevStage:
+    # previous stage4 stdenv; see stage3 comment regarding gcc,
+    # which applies here as well.
+    assert                                                isBuiltByNixpkgsCompiler prevStage.binutils-unwrapped;
+    assert !enableGccExternalBootstrapForStdenv -> isBuiltByBootstrapFilesCompiler prevStage.${localSystem.libc};
+    assert  enableGccExternalBootstrapForStdenv ->        isBuiltByNixpkgsCompiler prevStage.${localSystem.libc};
+    assert !enableGccExternalBootstrapForStdenv -> isBuiltByBootstrapFilesCompiler prevStage.gcc-unwrapped;
+    assert  enableGccExternalBootstrapForStdenv ->        isBuiltByNixpkgsCompiler prevStage.gcc-unwrapped;
+    assert                                                isBuiltByNixpkgsCompiler prevStage.coreutils;
+    assert                                                isBuiltByNixpkgsCompiler prevStage.gnugrep;
+    {
     inherit config overlays;
     stdenv = import ../generic rec {
       name = "stdenv-linux";
@@ -507,6 +657,7 @@ in
       extraAttrs = {
         inherit bootstrapTools;
         shellPackage = prevStage.bash;
+        inherit enableGccExternalBootstrapForStdenv;
       };
 
       disallowedRequisites = [ bootstrapTools.out ];
@@ -525,11 +676,15 @@ in
           )
         # More complicated cases
         ++ (map (x: getOutput x (getLibc prevStage)) [ "out" "dev" "bin" ] )
-        ++  [ /*propagated from .dev*/ linuxHeaders
-            binutils gcc gcc.cc gcc.cc.lib gcc.expand-response-params
+        ++  [ linuxHeaders # propagated from .dev
+            binutils gcc gcc.cc gcc.cc.lib gcc.expand-response-params (gcc.cc.libgcc or null) (glibc.passthru.libgcc or null)
           ]
-          ++ lib.optionals (!localSystem.isx86 || localSystem.libc == "musl")
-            [ prevStage.updateAutotoolsGnuConfigScriptsHook prevStage.gnu-config ];
+        ++ lib.optionals (!localSystem.isx86 || localSystem.libc == "musl")
+          [ prevStage.updateAutotoolsGnuConfigScriptsHook prevStage.gnu-config ]
+        ++ lib.optionals enableGccExternalBootstrapForStdenv (with gcc-unwrapped.passthru; [
+          gmp libmpc mpfr isl
+        ])
+      ;
 
       overrides = self: super: {
         inherit (prevStage)
@@ -554,4 +709,18 @@ in
     };
   })
 
+
+  # This "no-op" stage is just a place to put the assertions about stage5.
+  (prevStage:
+    # previous stage5 stdenv; see stage3 comment regarding gcc,
+    # which applies here as well.
+    assert                                                isBuiltByNixpkgsCompiler prevStage.binutils-unwrapped;
+    assert !enableGccExternalBootstrapForStdenv -> isBuiltByBootstrapFilesCompiler prevStage.${localSystem.libc};
+    assert  enableGccExternalBootstrapForStdenv ->        isBuiltByNixpkgsCompiler prevStage.${localSystem.libc};
+    assert !enableGccExternalBootstrapForStdenv -> isBuiltByBootstrapFilesCompiler prevStage.gcc-unwrapped;
+    assert  enableGccExternalBootstrapForStdenv ->        isBuiltByNixpkgsCompiler prevStage.gcc-unwrapped;
+    assert                                                isBuiltByNixpkgsCompiler prevStage.coreutils;
+    assert                                                isBuiltByNixpkgsCompiler prevStage.gnugrep;
+    { inherit (prevStage) config overlays stdenv; })
+
 ]
diff --git a/pkgs/test/stdenv/default.nix b/pkgs/test/stdenv/default.nix
index bad6eb7ba7aa3..089a9fb92e010 100644
--- a/pkgs/test/stdenv/default.nix
+++ b/pkgs/test/stdenv/default.nix
@@ -96,7 +96,7 @@ let
 
 in
 
-{
+rec {
   # tests for hooks in `stdenv.defaultNativeBuildInputs`
   hooks = lib.recurseIntoAttrs (import ./hooks.nix { stdenv = bootStdenv; pkgs = earlyPkgs; });
 
@@ -273,4 +273,53 @@ in
       };
 
   };
+
+  # This test *must* be run prior to releasing any build of either stdenv or the
+  # gcc that it exports!  This check should also be part of CI for any PR that
+  # causes a rebuild of `stdenv.cc`.
+  #
+  # When we used gcc's internal bootstrap it did this check as part of (and
+  # serially with) the gcc derivation.  Now that we bootstrap externally this
+  # check can be done in parallel with any/all of stdenv's referrers.  But we
+  # must remember to do the check.
+  #
+  gcc-stageCompare =
+    assert stdenv.cc.isGNU;
+    assert !(stdenv.enableGccExternalBootstrapForStdenv or false)
+            -> throw "gcc-stageCompare can only be used with externally-bootstrapped gcc";
+    with pkgs;
+    # rebuild gcc using the "final" stdenv
+    let gcc-stageCompare = (gcc-unwrapped.override {
+          reproducibleBuild = true;
+          profiledCompiler = false;
+          stdenv = overrideCC stdenv (wrapCCWith {
+            cc = stdenv.cc;
+          });
+        }).overrideAttrs(_: {
+          NIX_OUTPATH_USED_AS_RANDOM_SEED = stdenv.cc.cc.out;
+        });
+    in stdenv.mkDerivation {
+      name = "gcc-stageCompare";
+      inherit (gcc-unwrapped) version;
+      dontUnpack = true;
+      dontBuild = true;
+      dontFixup = true;
+      doCheck = true;
+      installPhase = ''
+        runHook preInstall
+        touch $out
+        runHook postInstall
+      '';
+      checkPhase = ''
+        runHook preCheck
+        diff -sr ${pkgs.gcc-unwrapped.checksum}/checksums ${gcc-stageCompare.checksum}/checksums
+        runHook postCheck
+      '';
+    };
+
+  # because "OfBorg @build" doesn't have any way to restrict which
+  # platforms are built upon...
+  gcc-stageCompare-onRelevantPlatforms =
+    lib.optional (stdenv.enableGccExternalBootstrapForStdenv or false)
+      gcc-stageCompare;
 }
diff --git a/pkgs/tools/admin/tigervnc/default.nix b/pkgs/tools/admin/tigervnc/default.nix
index e4933986176e8..2c282514d330c 100644
--- a/pkgs/tools/admin/tigervnc/default.nix
+++ b/pkgs/tools/admin/tigervnc/default.nix
@@ -34,7 +34,6 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-77X+AvHFWfYYIio3c+EYf11jg/1IbYhNUweRIDHMOZw=";
   };
 
-
   patches = [
     (fetchpatch {
       url = "https://patch-diff.githubusercontent.com/raw/TigerVNC/tigervnc/pull/1383.patch";
@@ -65,6 +64,10 @@ stdenv.mkDerivation rec {
     "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "out"}/bin"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=array-bounds"
+  ];
+
   postBuild = lib.optionalString stdenv.isLinux ''
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-error=int-to-pointer-cast -Wno-error=pointer-to-int-cast"
     export CXXFLAGS="$CXXFLAGS -fpermissive"
diff --git a/pkgs/tools/audio/mpris-scrobbler/default.nix b/pkgs/tools/audio/mpris-scrobbler/default.nix
index 35685fd5fb2f5..0c051047c0fc3 100644
--- a/pkgs/tools/audio/mpris-scrobbler/default.nix
+++ b/pkgs/tools/audio/mpris-scrobbler/default.nix
@@ -53,14 +53,17 @@ stdenv.mkDerivation rec {
     "-Dversion=${version}"
   ];
 
-  NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.isDarwin [
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=address"
+  ] ++ lib.optionals stdenv.isDarwin [
     "-Wno-sometimes-uninitialized"
     "-Wno-tautological-pointer-compare"
   ] ++ lib.optionals stdenv.isLinux [
     "-Wno-array-bounds"
     "-Wno-free-nonheap-object"
     "-Wno-stringop-truncation"
-  ]);
+  ];
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/tools/filesystems/blobfuse/default.nix b/pkgs/tools/filesystems/blobfuse/default.nix
index a620a07d4753e..b9bed9cc20c06 100644
--- a/pkgs/tools/filesystems/blobfuse/default.nix
+++ b/pkgs/tools/filesystems/blobfuse/default.nix
@@ -24,7 +24,11 @@ in stdenv.mkDerivation rec {
   pname = "blobfuse";
   inherit version src;
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=catch-value"
+  ];
 
   buildInputs = [ curl gnutls libgcrypt libuuid fuse boost cpplite ];
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/tools/filesystems/idsk/default.nix b/pkgs/tools/filesystems/idsk/default.nix
index 39052ecba9356..d3c82479d1009 100644
--- a/pkgs/tools/filesystems/idsk/default.nix
+++ b/pkgs/tools/filesystems/idsk/default.nix
@@ -14,6 +14,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-std=c++14"
+  ];
+
   installPhase = ''
     mkdir -p $out/bin
     cp iDSK $out/bin
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index a89621e8fe5f8..771a83a723f03 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -169,6 +169,8 @@ stdenv.mkDerivation rec {
     rm -r "$out/share"
   '';
 
+  passthru.isFromBootstrapFiles = false;
+
   meta = with lib; {
     homepage = "https://www.gnu.org/software/coreutils/";
     description = "The GNU Core Utilities";
diff --git a/pkgs/tools/misc/lockfile-progs/default.nix b/pkgs/tools/misc/lockfile-progs/default.nix
index e245a05182dad..8fdee47befbf7 100644
--- a/pkgs/tools/misc/lockfile-progs/default.nix
+++ b/pkgs/tools/misc/lockfile-progs/default.nix
@@ -11,6 +11,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ liblockfile ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=format-overflow"
+  ];
+
   installPhase = ''
     runHook preInstall
     mkdir -p $out/bin $out/man/man1
diff --git a/pkgs/tools/misc/wimboot/default.nix b/pkgs/tools/misc/wimboot/default.nix
index bc43d77bbfba5..6a039698369bc 100644
--- a/pkgs/tools/misc/wimboot/default.nix
+++ b/pkgs/tools/misc/wimboot/default.nix
@@ -16,6 +16,11 @@ stdenv.mkDerivation rec {
   buildInputs = [ libbfd zlib libiberty ];
   makeFlags = [ "wimboot.x86_64.efi" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   installPhase = ''
     mkdir -p $out/share/wimboot/
     cp wimboot.x86_64.efi $out/share/wimboot
diff --git a/pkgs/tools/networking/tgt/default.nix b/pkgs/tools/networking/tgt/default.nix
index dedafc52f979e..5fade3f201b60 100644
--- a/pkgs/tools/networking/tgt/default.nix
+++ b/pkgs/tools/networking/tgt/default.nix
@@ -22,6 +22,11 @@ stdenv.mkDerivation rec {
     "SD_NOTIFY=1"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+  ];
+
   installFlags = [
     "sysconfdir=${placeholder "out"}/etc"
   ];
diff --git a/pkgs/tools/networking/uqmi/default.nix b/pkgs/tools/networking/uqmi/default.nix
index 17a55d86b9a37..93be3b78cee14 100644
--- a/pkgs/tools/networking/uqmi/default.nix
+++ b/pkgs/tools/networking/uqmi/default.nix
@@ -18,6 +18,11 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [ libubox json_c ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=dangling-pointer"
+  ];
+
   meta = with lib; {
     description = "Tiny QMI command line utility";
     homepage = "https://git.openwrt.org/?p=project/uqmi.git;a=summary";
diff --git a/pkgs/tools/security/aflplusplus/default.nix b/pkgs/tools/security/aflplusplus/default.nix
index c25db9e2d3987..7817329f06de8 100644
--- a/pkgs/tools/security/aflplusplus/default.nix
+++ b/pkgs/tools/security/aflplusplus/default.nix
@@ -51,6 +51,11 @@ let
         --replace '"clang++"' '"clang++-UNSUPPORTED"'
     '';
 
+    NIX_CFLAGS_COMPILE = [
+      # Needed with GCC 12
+      "-Wno-error=use-after-free"
+    ];
+
     makeFlags = [ "PREFIX=$(out)" ];
     buildPhase = ''
       common="$makeFlags -j$NIX_BUILD_CORES"
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index edb10f384bdf7..b897fe6187101 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -40,6 +40,11 @@ python3.pkgs.buildPythonApplication rec {
     mkdir -p $CHIPSEC_BUILD_LIB/chipsec/helper/linux
   '';
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=dangling-pointer"
+  ];
+
   preInstall = lib.optionalString withDriver ''
     mkdir -p $out/${python3.pkgs.python.sitePackages}/drivers/linux
     mv $CHIPSEC_BUILD_LIB/chipsec/helper/linux/chipsec.ko \
diff --git a/pkgs/tools/system/acpica-tools/default.nix b/pkgs/tools/system/acpica-tools/default.nix
index 88f39e8a63e45..98ac2254fb6ea 100644
--- a/pkgs/tools/system/acpica-tools/default.nix
+++ b/pkgs/tools/system/acpica-tools/default.nix
@@ -29,7 +29,11 @@ stdenv.mkDerivation rec {
     "iasl"
   ];
 
-  NIX_CFLAGS_COMPILE = "-O3";
+  NIX_CFLAGS_COMPILE = [
+    "-O3"
+    # Needed with GCC 12
+    "-Wno-dangling-pointer"
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/text/gnugrep/default.nix b/pkgs/tools/text/gnugrep/default.nix
index efb3be1c8fb2d..1fffbfb51ce90 100644
--- a/pkgs/tools/text/gnugrep/default.nix
+++ b/pkgs/tools/text/gnugrep/default.nix
@@ -66,5 +66,8 @@ stdenv.mkDerivation {
     mainProgram = "grep";
   };
 
-  passthru = {inherit pcre;};
+  passthru = {
+    inherit pcre;
+    isFromBootstrapFiles = false;
+  };
 }
diff --git a/pkgs/tools/text/qgrep/default.nix b/pkgs/tools/text/qgrep/default.nix
index 032e9474128ae..20c85e76e160f 100644
--- a/pkgs/tools/text/qgrep/default.nix
+++ b/pkgs/tools/text/qgrep/default.nix
@@ -21,6 +21,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices CoreFoundation ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=mismatched-new-delete"
+  ];
+
   postPatch = lib.optionalString stdenv.isAarch64 ''
     substituteInPlace Makefile \
       --replace "-msse2" "" --replace "-DUSE_SSE2" ""
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5c18da67c27d4..6ccaf1a0ee8f7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -14257,8 +14257,7 @@ with pkgs;
   inherit (let
       num =
         if (with stdenv.targetPlatform; isVc4 || libc == "relibc") then 6
-        else if (stdenv.targetPlatform.isAarch64 && stdenv.isLinux) then 9
-        else 11;
+        else 12;
       numS = toString num;
     in {
       gcc = pkgs.${"gcc${numS}"};
@@ -14597,6 +14596,7 @@ with pkgs;
     langC = false;
     profiledCompiler = false;
     langJit = true;
+    enableLibGccOutput = false;
     enableLTO = false;
   };
 
@@ -23561,7 +23561,10 @@ with pkgs;
 
   vte = callPackage ../development/libraries/vte {
     # Needs GCC ≥10 but aarch64 defaults to GCC 9.
-    stdenv = clangStdenv;
+    stdenv =
+      if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU
+      then clangStdenv
+      else stdenv;
   };
 
   vte-gtk4 = vte.override {