diff --git a/scripts/bootstrap-prefix.sh b/scripts/bootstrap-prefix.sh
index 595a0019f3..c88fbce0ea 100755
--- a/scripts/bootstrap-prefix.sh
+++ b/scripts/bootstrap-prefix.sh
@@ -91,6 +91,24 @@ efetch() {
 	return 0
 }
 
+darwin_symlink_sdk() {
+	# setup MacOSX.sdk symlink for GCC/clang, this should probably be
+	# managed using an eselect module in the future
+	rm -f "${ROOT}/MacOSX.sdk"
+	local SDKPATH=$(xcrun --show-sdk-path --sdk macosx)
+	local SDKVERSION=$(xcrun --show-sdk-version --sdk macosx)
+	( cd ${ROOT} && ln -s "${SDKPATH}" MacOSX.sdk )
+	einfo "using system sources (${SDKVERSION}) from: ${SDKPATH}"
+}
+
+darwin_include_paths() {
+	local SDKPATH="${ROOT}/MacOSX.sdk"
+	export C_INCLUDE_PATH="${SDKPATH}/usr/include"
+
+	# we require command line tools. This allows stage2 to progress.
+	export CPLUS_INCLUDE_PATH="/Library/Developer/CommandLineTools/usr/include/c++/v1:${C_INCLUDE_PATH}"
+}
+
 configure_cflags() {
 	export CPPFLAGS="-I${ROOT}/tmp/usr/include"
 	
@@ -242,6 +260,10 @@ configure_toolchain() {
 					CC=clang
 					CXX=clang++
 					linker=sys-devel/binutils-apple
+					if [[ ! -d /usr/include ]]; then
+						darwin_symlink_sdk
+						darwin_include_paths
+					fi
 					;;
 				*"Apple LLVM version "*)
 					vers=${ccvers#*Apple LLVM version }
@@ -504,13 +526,7 @@ bootstrap_setup() {
 	esac
 
 	if [[ ${DARWIN_USE_GCC} == 1 ]] ; then
-		# setup MacOSX.sdk symlink for GCC, this should probably be
-		# managed using an eselect module in the future
-		rm -f "${ROOT}"/MacOSX.sdk
-		local SDKPATH=$(xcrun --show-sdk-path --sdk macosx)
-		( cd "${ROOT}" && ln -s "${SDKPATH}" MacOSX.sdk )
-		einfo "using system sources from ${SDKPATH}"
-
+		darwin_symlink_sdk
 		# amend profile, to use gcc one
 		profile="${profile}/gcc"
 	fi
@@ -1332,6 +1348,31 @@ bootstrap_libressl() {
 		https://ftp.openbsd.org/pub/OpenBSD/LibreSSL
 }
 
+bootstrap_libtapi() {
+	# grab the libtapi headers (which are actually compiled headers)
+	# but link with libtapi.dylib from CommaandLineTools
+
+	local PN PV A S
+	PN=libtapi
+	PV=1000.10.8_1
+	rev=${CHOST##*darwin}
+	A=${PN}-${PV}.darwin_${rev}.x86_64.tbz2
+	einfo "Bootstrapping ${A%-*} (link to system dylib)"
+
+	efetch "http://packages.macports.org/libtapi/${A}"
+
+	einfo "Unpacking ${A%-*}"
+	S="${PORTAGE_TMPDIR}/${PN}-${PV}"
+	rm -rf "${S}"
+	mkdir -p "${S}"
+	cd "${S}"
+	bzip2 -dc "${DISTDIR}/${A}" | tar -xf - || return 1
+	cp -r opt/local/include/tapi "${ROOT}"/tmp/usr/include || return 1
+
+	# to link with this lib, pass '-client_name ld' in LDFLAGS
+	ln -s /Library/Developer/CommandLineTools/usr/lib/libtapi.dylib "${ROOT}"/tmp/usr/lib
+}
+
 bootstrap_stage_host_gentoo() {
 	if ! is-rap ; then
 		einfo "Shortcut only supports prefix-standalone, but we are bootstrapping"
@@ -1453,6 +1494,11 @@ bootstrap_stage1() {
 			} > "${ROOT}"/tmp/usr/local/bin/java
 			cp "${ROOT}"/tmp/usr/local/bin/java{,c}
 			chmod 755 "${ROOT}"/tmp/usr/local/bin/java{,c}
+
+			# libtapi.dylib is needed to build binutils-apple in stage2
+			[[ ${DARWIN_USE_GCC} == 1 ]] \
+				|| [[ -f "${ROOT}"/tmp/usr/lib/libtapi.dylib ]] \
+				|| (bootstrap_libtapi) || return 1
 			;;
 		*-linux*)
 			if [[ ! -x "${ROOT}"/tmp/usr/bin/gcc ]] \
@@ -1713,8 +1759,10 @@ bootstrap_stage2() {
 		$([[ ${CHOST} == *-aix* ]] && echo dev-libs/libiconv ) # bash dependency
 		$([[ ${CHOST} == *-cygwin* ]] && echo dev-libs/libiconv ) # bash dependency
 		sys-libs/ncurses
+		dev-util/pkgconf # needed to build readline
 		sys-libs/readline
 		app-shells/bash
+		app-misc/pax-utils # needed to build xz-utils
 		app-arch/xz-utils
 		sys-apps/sed
 		sys-apps/baselayout-prefix
@@ -1736,8 +1784,8 @@ bootstrap_stage2() {
 	[[ ${CHOST} == *-solaris* ]] && echo "=dev-libs/libffi-3.3_rc0" \
 		>> "${ROOT}"/tmp/etc/portage/package.mask
 
-	# unlock GCC on Darwin for DARWIN_USE_GCC bootstraps
-	if [[ ${DARWIN_USE_GCC} == 1 ]] ; then
+	# unlock Darwin builds for GCC and clang bootstraps
+	if [[ -d "${ROOT}/MacOSX.sdk" ]] ; then
 		rm -f "${ROOT}"/tmp/MacOSX.sdk
 		( cd "${ROOT}"/tmp && ln -s ../MacOSX.sdk )
 	fi
@@ -1746,6 +1794,11 @@ bootstrap_stage2() {
 	# unless we only build the buildtool, bug #603012
 	echo "dev-util/cmake -server" >> "${ROOT}"/tmp/etc/portage/package.use
 
+	# rhash (dep of cmake) configure can't find the openssl/libressl.
+	# ssl use flag allows RHash to "use optimized algorithms"
+	# but RHash will work fine without, so disable during bootstrap.
+	echo "app-crypt/rhash -ssl" >> "${ROOT}"/tmp/etc/portage/package.use
+
 	emerge_pkgs --nodeps "${pkgs[@]}" || return 1
 
 	# Debian multiarch supported by RAP needs ld to support sysroot.
@@ -2836,7 +2889,7 @@ EOF
 	export CHOST=$(portageq envvar CHOST)
 
 	# after stage1 and stage2 we should have a bash of our own, which
-	# is preferably over the host-provided one, because we know it can
+	# is preferable over the host-provided one, because we know it can
 	# deal with the bash-constructs we use in stage3 and onwards
 	hash -r