@taktoa, thanks for your PR! By analyzing the history of the files in this pull request, we identified @aszlig and @vcunat to be potential reviewers.

Yes, --enable-secure-api is necessary to compile some programs.

Thanks for the tip about enable-idl, I'll use that in my work too.

MSYS2, a project that relies heavily on mingw-w64, usually just builds from the latest Git version, and I find that to be convenient too because mingw-w64 can take a long time between releases and most of the commits to it are pretty straightforward bug fixes. The upstream project is also pretty fast at accepting patches when I send them. So I would prefer to use git, but I suppose it also works to do it this way and just patch it as needed in nixpkgs.

I'm fine with using the latest git revision, but I've usually found there to be a fairly strong bias in nixpkgs towards using the latest stable release (and having 5.0.2 is still going to be a huge improvement over 4.0.6), so I'll leave it as-is and someone else can make another PR that upgrades it to the latest git.

It would also acceptable to have a newer unstable variant of mingw-w64 as well.

I think having both stable and unstable is OK when there is a reason to have unstable, too.

Maybe adding meta would be a good idea.

This would break 32-bit builds, as gcc-5.4.0-i686-pc-mingw32-stage-final fails with:

checking for -rdynamic... g++   -g -O2 -DIN_GCC  -DCROSS_DIRECTORY_STRUCTURE  -fno-exceptions -fno-rtti -fasynchronous-unwind-tables -W -Wall -Wno-narrowing -Wwrite-strings -Wcast-qual -Wmissing-format-attribute -Woverloaded-virtual -pedantic -Wno-long-long -Wno-variadic-macros -Wno-overlength-strings   -DHAVE_CONFIG_H -DGENERATOR_FILE -static-libstdc++ -static-libgcc  -o build/genmatch \
    build/genmatch.o ../build-x86_64-unknown-linux-gnu/libcpp/libcpp.a build/errors.o build/vec.o build/hash-table.o ../build-x86_64-unknown-linux-gnu/libiberty/libiberty.a
yes
checking for library containing dlopen... genattr: Internal error: abort in copy_rtx, at rtl.c:356
make[2]: *** [Makefile:2130: s-attr] Error 1
make[2]: *** Waiting for unfinished jobs....

You can test quickly e.g. by nix-build pkgs/top-level/release-cross.nix -Q -A crossMingw32.libtool.

@taktoa I last summer split that derivation up kind of like you did, but into separate files. I figured that was good enough, but integrated your extra configure flags, and then cherry-picked @angerman's patch.

I'll get hydra to build this to see what happens! https://hydra.nixos.org/eval/1436486

Ooop, I had broken the cross jobs quite bad. https://hydra.nixos.org/eval/1442341 has it.

OK hydra is slow but I built in manually. Thanks, you both!