Merge branch 'staging' into staging-next

nixos/doc/manual/release-notes/rl-2305.section.md

···
 
   - default linux: 5.15 -\> 6.1, all supported kernels available
 
+  - systemd has been updated to v253.1, see [the pull request](https://github.com/NixOS/nixpkgs/pull/216826) for more info.
+    It's recommended to use `nixos-rebuild boot` and `reboot`, rather than `nixos-rebuild switch` - since in some rare cases
+    the switch of a live system might fail.
+
 - Cinnamon has been updated to 5.6, see [the pull request](https://github.com/NixOS/nixpkgs/pull/201328#issue-1449910204) for what is changed.
 
 - KDE Plasma has been updated to v5.27, see [the release notes](https://kde.org/announcements/plasma/5/5.27.0/) for what is changed.
 
 - `nixos-rebuild` now supports an extra `--specialisation` option that can be used to change specialisation for `switch` and `test` commands.
+
+- `libxcrypt`, the library providing the `crypt(3)` password hashing function, is now built without support for algorithms not flagged [`strong`](https://github.com/besser82/libxcrypt/blob/v4.4.33/lib/hashes.conf#L48). This affects the availability of password hashing algorithms used for system login (`login(1)`, `passwd(1)`), but also Apache2 Basic-Auth, Samba, OpenLDAP, and [many other packages](https://github.com/search?q=repo%3ANixOS%2Fnixpkgs%20libxcrypt&type=code).
 
 ## New Services {#sec-release-23.05-new-services}
 
···
 
 - conntrack helper autodetection has been removed from kernels 6.0 and up upstream, and an assertion was added to ensure things don't silently stop working. Migrate your configuration to assign helpers explicitly or use an older LTS kernel branch as a temporary workaround.
 
+- The `services.pipewire.config` options have been removed, as they have basically never worked correctly. All behavior defined by the default configuration can be overridden with drop-in files as necessary - see [below](#sec-release-23.05-migration-pipewire) for details.
+
+- `services.pipewire.media-session` and the `pipewire-media-session` package have been removed, as they are no longer supported upstream. Users are encouraged to use `services.pipewire.wireplumber` instead.
 ## Other Notable Changes {#sec-release-23.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
···
 - The option `services.prometheus.exporters.pihole.interval` does not exist anymore and has been removed.
 
 - `k3s` can now be configured with an EnvironmentFile for its systemd service, allowing secrets to be provided without ending up in the Nix Store.
+
+## Detailed migration information {#sec-release-23.05-migration}
+
+### Pipewire configuration overrides {#sec-release-23.05-migration-pipewire}
+
+#### Why this change? {#sec-release-23.05-migration-pipewire-why}
+
+The Pipewire config semantics don't really match the NixOS module semantics, so it's extremely awkward to override the default config, especially when lists are involved. Vendoring the configuration files in nixpkgs also creates unnecessary maintenance overhead.
+
+Also, upstream added a lot of accomodations to allow doing most of the things you'd want to do with a config edit in better ways.
+
+#### Migrating your configuration {#sec-release-23.05-migration-pipewire-how}
+
+Compare your settings to [the defaults](https://gitlab.freedesktop.org/pipewire/pipewire/-/tree/master/src/daemon) and where your configuration differs from them.
+
+Then, create a drop-in JSON file in `/etc/pipewire/<config file name>.d/99-custom.conf` (the actual filename can be anything) and migrate your changes to it according to the following sections.
+
+Repeat for every file you've modified, changing the directory name accordingly.
+
+#### Things you can just copy over {#sec-release-23.05-migration-pipewire-simple}
+
+If you are:
+
+- setting properties via `*.properties`
+- loading a new module to `context.modules`
+- creating new objects with `context.objects`
+- declaring SPA libraries with `context.spa-libs`
+- running custom commands with `context.exec`
+- adding new rules with `*.rules`
+- running custom PulseAudio commands with `pulse.cmd`
+
+Simply move the definitions into the drop-in.
+
+Note that the use of `context.exec` is not recommended and other methods of running your thing are likely a better option.
+
+```json
+{
+  "context.properties": {
+    "your.property.name": "your.property.value"
+  },
+  "context.modules": [
+    { "name": "libpipewire-module-my-cool-thing" }
+  ],
+  "context.objects": [
+    { "factory": { ... } }
+  ],
+  "alsa.rules": [
+    { "matches: { ... }, "actions": { ... } }
+  ]
+}
+```
+
+#### Removing a module from `context.modules` {#sec-release-23.05-migration-pipewire-removing-modules}
+
+Look for an option to disable it via `context.properties` (`"module.x11.bell": "false"` is likely the most common use case here).
+If one is not available, proceed to [Nuclear option](#sec-release-23.05-migration-pipewire).
+
+#### Modifying a module's parameters in `context.modules` {#sec-release-23.05-migration-pipewire-modifying-modules}
+
+For most modules (e.g. `libpipewire-module-rt`) it's enough to load the module again with the new arguments, e.g.:
+
+```json
+{
+  "context.modules": [
+    {
+      "name": "libpipewire-module-rt",
+      "args": {
+        "rt.prio": 90
+      }
+    }
+  ]
+}
+```
+
+Note that `module-rt` specifically will generally use the highest values available by default, so setting limits on the `pipewire` systemd service is preferable to reloading.
+
+If reloading the module is not an option, proceed to [Nuclear option](#sec-release-23.05-migration-pipewire).
+
+#### Nuclear option {#sec-release-23.05-migration-pipewire-nuclear}
+If all else fails, you can still manually copy the contents of the default configuration file
+from `${pkgs.pipewire.lib}/share/pipewire` to `/etc/pipewire` and edit it to fully override the default.
+However, this should be done only as a last resort. Please talk to the Pipewire maintainers if you ever need to do this.

nixos/modules/config/users-groups.nix

···
 
   ###### implementation
 
-  config = {
+  config = let
+    cryptSchemeIdPatternGroup = "(${lib.concatStringsSep "|" pkgs.libxcrypt.enabledCryptSchemeIds})";
+  in {
 
     users.users = {
       root = {
···
       text = ''
         users=()
         while IFS=: read -r user hash tail; do
-          if [[ "$hash" = "$"* && ! "$hash" =~ ^\$(y|gy|7|2b|2y|2a|6)\$ ]]; then
+          if [[ "$hash" = "$"* && ! "$hash" =~ ^\''$${cryptSchemeIdPatternGroup}\$ ]]; then
             users+=("$user")
           fi
         done </etc/shadow
 
         if (( "''${#users[@]}" )); then
           echo "
-        WARNING: The following user accounts rely on password hashes that will
-        be removed in NixOS 23.05. They should be renewed as soon as possible."
+        WARNING: The following user accounts rely on password hashing algorithms
+        that have been removed. They need to be renewed as soon as possible, as
+        they do prevent their users from logging in."
           printf ' - %s\n' "''${users[@]}"
         fi
       '';
···
         let
           sep = "\\$";
           base64 = "[a-zA-Z0-9./]+";
-          id = "[a-z0-9-]+";
+          id = cryptSchemeIdPatternGroup;
           value = "[a-zA-Z0-9/+.-]+";
           options = "${id}(=${value})?(,${id}=${value})*";
           scheme  = "${id}(${sep}${options})?";

nixos/modules/module-list.nix

···
   ./services/desktops/gvfs.nix
   ./services/desktops/malcontent.nix
   ./services/desktops/neard.nix
-  ./services/desktops/pipewire/pipewire-media-session.nix
   ./services/desktops/pipewire/pipewire.nix
   ./services/desktops/pipewire/wireplumber.nix
   ./services/desktops/profile-sync-daemon.nix

nixos/modules/security/pam.nix

···
           optionalString config.services.homed.enable ''
             password sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so
           '' + ''
-            password sufficient pam_unix.so nullok sha512
+            password sufficient pam_unix.so nullok yescrypt
           '' +
           optionalString config.security.pam.enableEcryptfs ''
             password optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so

nixos/modules/services/desktops/pipewire/daemon/client-rt.conf.json

···
-{
-  "context.properties": {
-    "log.level": 0
-  },
-  "context.spa-libs": {
-    "audio.convert.*": "audioconvert/libspa-audioconvert",
-    "support.*": "support/libspa-support"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rt",
-      "args": {},
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-client-device"
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    },
-    {
-      "name": "libpipewire-module-metadata"
-    },
-    {
-      "name": "libpipewire-module-session-manager"
-    }
-  ],
-  "filter.properties": {},
-  "stream.properties": {},
-  "alsa.properties": {},
-  "alsa.rules": [
-    {
-      "matches": [
-        {
-          "application.process.binary": "resolve"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "alsa.buffer-bytes": 131072
-        }
-      }
-    }
-  ]
-}

nixos/modules/services/desktops/pipewire/daemon/client.conf.json

···
-{
-  "context.properties": {
-    "log.level": 0
-  },
-  "context.spa-libs": {
-    "audio.convert.*": "audioconvert/libspa-audioconvert",
-    "support.*": "support/libspa-support"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-client-device"
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    },
-    {
-      "name": "libpipewire-module-metadata"
-    },
-    {
-      "name": "libpipewire-module-session-manager"
-    }
-  ],
-  "filter.properties": {},
-  "stream.properties": {}
-}

nixos/modules/services/desktops/pipewire/daemon/filter-chain.conf.json

···
-{
-  "context.properties": {
-    "log.level": 0
-  },
-  "context.spa-libs": {
-    "audio.convert.*": "audioconvert/libspa-audioconvert",
-    "support.*": "support/libspa-support"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rt",
-      "args": {},
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    }
-  ]
-}

nixos/modules/services/desktops/pipewire/daemon/jack.conf.json

···
-{
-  "context.properties": {
-    "log.level": 0
-  },
-  "context.spa-libs": {
-    "support.*": "support/libspa-support"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rt",
-      "args": {},
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-metadata"
-    }
-  ],
-  "jack.properties": {},
-  "jack.rules": [
-    {
-      "matches": [
-        {}
-      ],
-      "actions": {
-        "update-props": {}
-      }
-    },
-    {
-      "matches": [
-        {
-          "application.process.binary": "jack_bufsize"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "jack.global-buffer-size": true
-        }
-      }
-    },
-    {
-      "matches": [
-        {
-          "application.process.binary": "qsynth"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "node.pause-on-idle": false,
-          "node.passive": true
-        }
-      }
-    },
-    {
-      "matches": [
-        {
-          "client.name": "Mixxx"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "jack.merge-monitor": false
-        }
-      }
-    }
-  ]
-}

nixos/modules/services/desktops/pipewire/daemon/minimal.conf.json

···
-{
-  "context.properties": {
-    "link.max-buffers": 16,
-    "core.daemon": true,
-    "core.name": "pipewire-0",
-    "settings.check-quantum": true,
-    "settings.check-rate": true,
-    "vm.overrides": {
-      "default.clock.min-quantum": 1024
-    }
-  },
-  "context.spa-libs": {
-    "audio.convert.*": "audioconvert/libspa-audioconvert",
-    "api.alsa.*": "alsa/libspa-alsa",
-    "support.*": "support/libspa-support"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rt",
-      "args": {
-        "nice.level": -11
-      },
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-profiler"
-    },
-    {
-      "name": "libpipewire-module-metadata"
-    },
-    {
-      "name": "libpipewire-module-spa-node-factory"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-access",
-      "args": {}
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    },
-    {
-      "name": "libpipewire-module-link-factory"
-    }
-  ],
-  "context.objects": [
-    {
-      "factory": "metadata",
-      "args": {
-        "metadata.name": "default"
-      }
-    },
-    {
-      "factory": "spa-node-factory",
-      "args": {
-        "factory.name": "support.node.driver",
-        "node.name": "Dummy-Driver",
-        "node.group": "pipewire.dummy",
-        "priority.driver": 20000
-      }
-    },
-    {
-      "factory": "spa-node-factory",
-      "args": {
-        "factory.name": "support.node.driver",
-        "node.name": "Freewheel-Driver",
-        "priority.driver": 19000,
-        "node.group": "pipewire.freewheel",
-        "node.freewheel": true
-      }
-    },
-    {
-      "factory": "adapter",
-      "args": {
-        "factory.name": "api.alsa.pcm.source",
-        "node.name": "system",
-        "node.description": "system",
-        "media.class": "Audio/Source",
-        "api.alsa.path": "hw:0",
-        "node.suspend-on-idle": true,
-        "resample.disable": true,
-        "channelmix.disable": true,
-        "adapter.auto-port-config": {
-          "mode": "dsp",
-          "monitor": false,
-          "control": false,
-          "position": "unknown"
-        }
-      }
-    },
-    {
-      "factory": "adapter",
-      "args": {
-        "factory.name": "api.alsa.pcm.sink",
-        "node.name": "system",
-        "node.description": "system",
-        "media.class": "Audio/Sink",
-        "api.alsa.path": "hw:0",
-        "node.suspend-on-idle": true,
-        "resample.disable": true,
-        "channelmix.disable": true,
-        "adapter.auto-port-config": {
-          "mode": "dsp",
-          "monitor": false,
-          "control": false,
-          "position": "unknown"
-        }
-      }
-    }
-  ],
-  "context.exec": []
-}

nixos/modules/services/desktops/pipewire/daemon/pipewire-aes67.conf.json

···
-{
-  "context.properties": {},
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rt",
-      "args": {
-        "nice.level": -11
-      },
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    },
-    {
-      "name": "libpipewire-module-rtp-source",
-      "args": {
-        "sap.ip": "239.255.255.255",
-        "sap.port": 9875,
-        "sess.latency.msec": 10,
-        "local.ifname": "eth0",
-        "stream.props": {
-          "media.class": "Audio/Source",
-          "node.virtual": false,
-          "device.api": "aes67"
-        }
-      }
-    }
-  ]
-}

nixos/modules/services/desktops/pipewire/daemon/pipewire-avb.conf.json

···
-{
-  "context.properties": {},
-  "context.spa-libs": {
-    "audio.convert.*": "audioconvert/libspa-audioconvert",
-    "support.*": "support/libspa-support"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rt",
-      "args": {
-        "nice.level": -11
-      },
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    },
-    {
-      "name": "libpipewire-module-avb",
-      "args": {}
-    }
-  ],
-  "context.exec": [],
-  "stream.properties": {},
-  "avb.properties": {
-    "ifname": "enp3s0",
-    "vm.overrides": {}
-  }
-}

nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json

···
-{
-  "context.properties": {},
-  "context.spa-libs": {
-    "audio.convert.*": "audioconvert/libspa-audioconvert",
-    "support.*": "support/libspa-support"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rt",
-      "args": {
-        "nice.level": -11
-      },
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    },
-    {
-      "name": "libpipewire-module-metadata"
-    },
-    {
-      "name": "libpipewire-module-protocol-pulse",
-      "args": {}
-    }
-  ],
-  "context.exec": [],
-  "pulse.cmd": [
-    {
-      "cmd": "load-module",
-      "args": "module-always-sink",
-      "flags": []
-    }
-  ],
-  "stream.properties": {},
-  "pulse.properties": {
-    "server.address": [
-      "unix:native"
-    ],
-    "vm.overrides": {
-      "pulse.min.quantum": "1024/48000"
-    }
-  },
-  "pulse.rules": [
-    {
-      "matches": [
-        {}
-      ],
-      "actions": {
-        "update-props": {}
-      }
-    },
-    {
-      "matches": [
-        {
-          "application.process.binary": "teams"
-        },
-        {
-          "application.process.binary": "teams-insiders"
-        },
-        {
-          "application.process.binary": "skypeforlinux"
-        }
-      ],
-      "actions": {
-        "quirks": [
-          "force-s16-info"
-        ]
-      }
-    },
-    {
-      "matches": [
-        {
-          "application.process.binary": "firefox"
-        }
-      ],
-      "actions": {
-        "quirks": [
-          "remove-capture-dont-move"
-        ]
-      }
-    },
-    {
-      "matches": [
-        {
-          "application.name": "~speech-dispatcher.*"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "pulse.min.req": "512/48000",
-          "pulse.min.quantum": "512/48000",
-          "pulse.idle.timeout": 5
-        }
-      }
-    }
-  ]
-}

nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json

···
-{
-  "context.properties": {
-    "link.max-buffers": 16,
-    "core.daemon": true,
-    "core.name": "pipewire-0",
-    "vm.overrides": {
-      "default.clock.min-quantum": 1024
-    },
-    "module.x11.bell": true
-  },
-  "context.spa-libs": {
-    "audio.convert.*": "audioconvert/libspa-audioconvert",
-    "avb.*": "avb/libspa-avb",
-    "api.alsa.*": "alsa/libspa-alsa",
-    "api.v4l2.*": "v4l2/libspa-v4l2",
-    "api.libcamera.*": "libcamera/libspa-libcamera",
-    "api.bluez5.*": "bluez5/libspa-bluez5",
-    "api.vulkan.*": "vulkan/libspa-vulkan",
-    "api.jack.*": "jack/libspa-jack",
-    "support.*": "support/libspa-support"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rt",
-      "args": {
-        "nice.level": -11
-      },
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-profiler"
-    },
-    {
-      "name": "libpipewire-module-metadata"
-    },
-    {
-      "name": "libpipewire-module-spa-device-factory"
-    },
-    {
-      "name": "libpipewire-module-spa-node-factory"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-client-device"
-    },
-    {
-      "name": "libpipewire-module-portal",
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-access",
-      "args": {}
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    },
-    {
-      "name": "libpipewire-module-link-factory"
-    },
-    {
-      "name": "libpipewire-module-session-manager"
-    },
-    {
-      "name": "libpipewire-module-x11-bell",
-      "args": {},
-      "flags": [
-        "ifexists",
-        "nofail"
-      ],
-      "condition": [
-        {
-          "module.x11.bell": true
-        }
-      ]
-    }
-  ],
-  "context.objects": [
-    {
-      "factory": "spa-node-factory",
-      "args": {
-        "factory.name": "support.node.driver",
-        "node.name": "Dummy-Driver",
-        "node.group": "pipewire.dummy",
-        "priority.driver": 20000
-      }
-    },
-    {
-      "factory": "spa-node-factory",
-      "args": {
-        "factory.name": "support.node.driver",
-        "node.name": "Freewheel-Driver",
-        "priority.driver": 19000,
-        "node.group": "pipewire.freewheel",
-        "node.freewheel": true
-      }
-    }
-  ],
-  "context.exec": []
-}

nixos/modules/services/desktops/pipewire/media-session/alsa-monitor.conf.json

···
-{
-  "properties": {},
-  "rules": [
-    {
-      "matches": [
-        {
-          "device.name": "~alsa_card.*"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "api.alsa.use-acp": true,
-          "api.acp.auto-profile": false,
-          "api.acp.auto-port": false
-        }
-      }
-    },
-    {
-      "matches": [
-        {
-          "node.name": "~alsa_input.*"
-        },
-        {
-          "node.name": "~alsa_output.*"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "node.pause-on-idle": false
-        }
-      }
-    }
-  ]
-}

nixos/modules/services/desktops/pipewire/media-session/bluez-monitor.conf.json

···
-{
-  "properties": {},
-  "rules": [
-    {
-      "matches": [
-        {
-          "device.name": "~bluez_card.*"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "bluez5.auto-connect": [
-            "hfp_hf",
-            "hsp_hs",
-            "a2dp_sink"
-          ]
-        }
-      }
-    },
-    {
-      "matches": [
-        {
-          "node.name": "~bluez_input.*"
-        },
-        {
-          "node.name": "~bluez_output.*"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "node.pause-on-idle": false
-        }
-      }
-    }
-  ]
-}

nixos/modules/services/desktops/pipewire/media-session/media-session.conf.json

···
-{
-  "context.properties": {},
-  "context.spa-libs": {
-    "api.bluez5.*": "bluez5/libspa-bluez5",
-    "api.alsa.*": "alsa/libspa-alsa",
-    "api.v4l2.*": "v4l2/libspa-v4l2",
-    "api.libcamera.*": "libcamera/libspa-libcamera"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rtkit",
-      "args": {},
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-client-device"
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    },
-    {
-      "name": "libpipewire-module-metadata"
-    },
-    {
-      "name": "libpipewire-module-session-manager"
-    }
-  ],
-  "session.modules": {
-    "default": [
-      "flatpak",
-      "portal",
-      "v4l2",
-      "suspend-node",
-      "policy-node"
-    ],
-    "with-audio": [
-      "metadata",
-      "default-nodes",
-      "default-profile",
-      "default-routes",
-      "alsa-seq",
-      "alsa-monitor"
-    ],
-    "with-alsa": [
-      "with-audio"
-    ],
-    "with-jack": [
-      "with-audio"
-    ],
-    "with-pulseaudio": [
-      "with-audio",
-      "bluez5",
-      "bluez5-autoswitch",
-      "logind",
-      "restore-stream",
-      "streams-follow-default"
-    ]
-  }
-}

nixos/modules/services/desktops/pipewire/media-session/v4l2-monitor.conf.json

···
-{
-  "properties": {},
-  "rules": [
-    {
-      "matches": [
-        {
-          "device.name": "~v4l2_device.*"
-        }
-      ],
-      "actions": {
-        "update-props": {}
-      }
-    },
-    {
-      "matches": [
-        {
-          "node.name": "~v4l2_input.*"
-        },
-        {
-          "node.name": "~v4l2_output.*"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "node.pause-on-idle": false
-        }
-      }
-    }
-  ]
-}

nixos/modules/services/desktops/pipewire/pipewire-media-session.nix

···
-# pipewire example session manager.
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  json = pkgs.formats.json {};
-  cfg = config.services.pipewire.media-session;
-  enable32BitAlsaPlugins = cfg.alsa.support32Bit
-                           && pkgs.stdenv.isx86_64
-                           && pkgs.pkgsi686Linux.pipewire != null;
-
-  # Use upstream config files passed through spa-json-dump as the base
-  # Patched here as necessary for them to work with this module
-  defaults = {
-    alsa-monitor = lib.importJSON ./media-session/alsa-monitor.conf.json;
-    bluez-monitor = lib.importJSON ./media-session/bluez-monitor.conf.json;
-    media-session = lib.importJSON ./media-session/media-session.conf.json;
-    v4l2-monitor = lib.importJSON ./media-session/v4l2-monitor.conf.json;
-  };
-
-  configs = {
-    alsa-monitor = recursiveUpdate defaults.alsa-monitor cfg.config.alsa-monitor;
-    bluez-monitor = recursiveUpdate defaults.bluez-monitor cfg.config.bluez-monitor;
-    media-session = recursiveUpdate defaults.media-session cfg.config.media-session;
-    v4l2-monitor = recursiveUpdate defaults.v4l2-monitor cfg.config.v4l2-monitor;
-  };
-in {
-
-  meta = {
-    maintainers = teams.freedesktop.members;
-    # uses attributes of the linked package
-    buildDocsInSandbox = false;
-  };
-
-  ###### interface
-  options = {
-    services.pipewire.media-session = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc "Whether to enable the deprecated example Pipewire session manager";
-      };
-
-      package = mkOption {
-        type = types.package;
-        default = pkgs.pipewire-media-session;
-        defaultText = literalExpression "pkgs.pipewire-media-session";
-        description = lib.mdDoc ''
-          The pipewire-media-session derivation to use.
-        '';
-      };
-
-      config = {
-        media-session = mkOption {
-          type = json.type;
-          description = lib.mdDoc ''
-            Configuration for the media session core. For details see
-            https://gitlab.freedesktop.org/pipewire/media-session/-/blob/${cfg.package.version}/src/daemon/media-session.d/media-session.conf
-          '';
-          default = defaults.media-session;
-        };
-
-        alsa-monitor = mkOption {
-          type = json.type;
-          description = lib.mdDoc ''
-            Configuration for the alsa monitor. For details see
-            https://gitlab.freedesktop.org/pipewire/media-session/-/blob/${cfg.package.version}/src/daemon/media-session.d/alsa-monitor.conf
-          '';
-          default = defaults.alsa-monitor;
-        };
-
-        bluez-monitor = mkOption {
-          type = json.type;
-          description = lib.mdDoc ''
-            Configuration for the bluez5 monitor. For details see
-            https://gitlab.freedesktop.org/pipewire/media-session/-/blob/${cfg.package.version}/src/daemon/media-session.d/bluez-monitor.conf
-          '';
-          default = defaults.bluez-monitor;
-        };
-
-        v4l2-monitor = mkOption {
-          type = json.type;
-          description = lib.mdDoc ''
-            Configuration for the V4L2 monitor. For details see
-            https://gitlab.freedesktop.org/pipewire/media-session/-/blob/${cfg.package.version}/src/daemon/media-session.d/v4l2-monitor.conf
-          '';
-          default = defaults.v4l2-monitor;
-        };
-      };
-    };
-  };
-
-  ###### implementation
-  config = mkIf cfg.enable {
-    environment.systemPackages = [ cfg.package ];
-    systemd.packages = [ cfg.package ];
-
-    # Enable either system or user units.
-    systemd.services.pipewire-media-session.enable = config.services.pipewire.systemWide;
-    systemd.user.services.pipewire-media-session.enable = !config.services.pipewire.systemWide;
-
-    systemd.services.pipewire-media-session.wantedBy = [ "pipewire.service" ];
-    systemd.user.services.pipewire-media-session.wantedBy = [ "pipewire.service" ];
-
-    environment.etc."pipewire/media-session.d/media-session.conf" = {
-      source = json.generate "media-session.conf" configs.media-session;
-    };
-    environment.etc."pipewire/media-session.d/v4l2-monitor.conf" = {
-      source = json.generate "v4l2-monitor.conf" configs.v4l2-monitor;
-    };
-
-    environment.etc."pipewire/media-session.d/with-audio" =
-      mkIf config.services.pipewire.audio.enable {
-        text = "";
-      };
-
-    environment.etc."pipewire/media-session.d/with-alsa" =
-      mkIf config.services.pipewire.alsa.enable {
-        text = "";
-      };
-    environment.etc."pipewire/media-session.d/alsa-monitor.conf" =
-      mkIf config.services.pipewire.alsa.enable {
-        source = json.generate "alsa-monitor.conf" configs.alsa-monitor;
-      };
-
-    environment.etc."pipewire/media-session.d/with-pulseaudio" =
-      mkIf config.services.pipewire.pulse.enable {
-        text = "";
-      };
-    environment.etc."pipewire/media-session.d/bluez-monitor.conf" =
-      mkIf config.services.pipewire.pulse.enable {
-        source = json.generate "bluez-monitor.conf" configs.bluez-monitor;
-      };
-
-    environment.etc."pipewire/media-session.d/with-jack" =
-      mkIf config.services.pipewire.jack.enable {
-        text = "";
-      };
-  };
-}

nixos/modules/services/desktops/pipewire/pipewire.nix

···
 with lib;
 
 let
-  json = pkgs.formats.json {};
   cfg = config.services.pipewire;
   enable32BitAlsaPlugins = cfg.alsa.support32Bit
                            && pkgs.stdenv.isx86_64
···
     mkdir -p "$out/lib"
     ln -s "${cfg.package.jack}/lib" "$out/lib/pipewire"
   '';
-
-  # Use upstream config files passed through spa-json-dump as the base
-  # Patched here as necessary for them to work with this module
-  defaults = {
-    client = lib.importJSON ./daemon/client.conf.json;
-    client-rt = lib.importJSON ./daemon/client-rt.conf.json;
-    jack = lib.importJSON ./daemon/jack.conf.json;
-    minimal = lib.importJSON ./daemon/minimal.conf.json;
-    pipewire = lib.importJSON ./daemon/pipewire.conf.json;
-    pipewire-pulse = lib.importJSON ./daemon/pipewire-pulse.conf.json;
-  };
-
-  useSessionManager = cfg.wireplumber.enable || cfg.media-session.enable;
-
-  configs = {
-    client = recursiveUpdate defaults.client cfg.config.client;
-    client-rt = recursiveUpdate defaults.client-rt cfg.config.client-rt;
-    jack = recursiveUpdate defaults.jack cfg.config.jack;
-    pipewire = recursiveUpdate (if useSessionManager then defaults.pipewire else defaults.minimal) cfg.config.pipewire;
-    pipewire-pulse = recursiveUpdate defaults.pipewire-pulse cfg.config.pipewire-pulse;
-  };
 in {
-
-  meta = {
-    maintainers = teams.freedesktop.members ++ [ lib.maintainers.k900 ];
-    # uses attributes of the linked package
-    buildDocsInSandbox = false;
-  };
+  meta.maintainers = teams.freedesktop.members ++ [ lib.maintainers.k900 ];
 
   ###### interface
   options = {
···
         '';
       };
 
-      config = {
-        client = mkOption {
-          type = json.type;
-          default = {};
-          description = lib.mdDoc ''
-            Configuration for pipewire clients. For details see
-            https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/${cfg.package.version}/src/daemon/client.conf.in
-          '';
-        };
-
-        client-rt = mkOption {
-          type = json.type;
-          default = {};
-          description = lib.mdDoc ''
-            Configuration for realtime pipewire clients. For details see
-            https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/${cfg.package.version}/src/daemon/client-rt.conf.in
-          '';
-        };
-
-        jack = mkOption {
-          type = json.type;
-          default = {};
-          description = lib.mdDoc ''
-            Configuration for the pipewire daemon's jack module. For details see
-            https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/${cfg.package.version}/src/daemon/jack.conf.in
-          '';
-        };
-
-        pipewire = mkOption {
-          type = json.type;
-          default = {};
-          description = lib.mdDoc ''
-            Configuration for the pipewire daemon. For details see
-            https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/${cfg.package.version}/src/daemon/pipewire.conf.in
-          '';
-        };
-
-        pipewire-pulse = mkOption {
-          type = json.type;
-          default = {};
-          description = lib.mdDoc ''
-            Configuration for the pipewire-pulse daemon. For details see
-            https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/${cfg.package.version}/src/daemon/pipewire-pulse.conf.in
-          '';
-        };
-      };
-
       audio = {
         enable = lib.mkOption {
           type = lib.types.bool;
···
           https://github.com/PipeWire/pipewire/blob/master/NEWS
         '';
       };
-
     };
   };
 
+  imports = [
+    (lib.mkRemovedOptionModule ["services" "pipewire" "config"] ''
+      Overriding default Pipewire configuration through NixOS options never worked correctly and is no longer supported.
+      Please create drop-in files in /etc/pipewire/pipewire.conf.d/ to make the desired setting changes instead.
+    '')
+
+    (lib.mkRemovedOptionModule ["services" "pipewire" "media-session"] ''
+      pipewire-media-session is no longer supported upstream and has been removed.
+      Please switch to `services.pipewire.wireplumber` instead.
+    '')
+  ];
 
   ###### implementation
   config = mkIf cfg.enable {
···
       source = "${cfg.package}/share/alsa/alsa.conf.d/99-pipewire-default.conf";
     };
 
-    environment.etc."pipewire/client.conf" = {
-      source = json.generate "client.conf" configs.client;
-    };
-    environment.etc."pipewire/client-rt.conf" = {
-      source = json.generate "client-rt.conf" configs.client-rt;
-    };
-    environment.etc."pipewire/jack.conf" = {
-      source = json.generate "jack.conf" configs.jack;
-    };
-    environment.etc."pipewire/pipewire.conf" = {
-      source = json.generate "pipewire.conf" configs.pipewire;
-    };
-    environment.etc."pipewire/pipewire-pulse.conf" = mkIf cfg.pulse.enable {
-      source = json.generate "pipewire-pulse.conf" configs.pipewire-pulse;
-    };
-
     environment.sessionVariables.LD_LIBRARY_PATH =
       lib.mkIf cfg.jack.enable [ "${cfg.package.jack}/lib" ];
 
···
       };
       groups.pipewire.gid = config.ids.gids.pipewire;
     };
-
-    # https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/464#note_723554
-    systemd.services.pipewire.environment."PIPEWIRE_LINK_PASSIVE" = "1";
-    systemd.user.services.pipewire.environment."PIPEWIRE_LINK_PASSIVE" = "1";
-
-    # pipewire-pulse default config expects pactl to be in PATH
-    systemd.user.services.pipewire-pulse.path = lib.mkIf cfg.pulse.enable [ pkgs.pulseaudio ];
   };
 }

nixos/modules/services/desktops/pipewire/wireplumber.nix

···
   config = lib.mkIf cfg.enable {
     assertions = [
       {
-        assertion = !config.services.pipewire.media-session.enable;
-        message = "WirePlumber and pipewire-media-session can't be enabled at the same time.";
-      }
-      {
         assertion = !config.hardware.bluetooth.hsphfpd.enable;
         message = "Using Wireplumber conflicts with hsphfpd, as it provides the same functionality. `hardware.bluetooth.hsphfpd.enable` needs be set to false";
       }

nixos/modules/services/x11/display-managers/gdm.nix

···
 
         account   sufficient    pam_unix.so
 
-        password  requisite     pam_unix.so nullok sha512
+        password  requisite     pam_unix.so nullok yescrypt
 
         session   optional      pam_keyinit.so revoke
         session   include       login

nixos/modules/services/x11/display-managers/lightdm.nix

···
 
         account   sufficient    pam_unix.so
 
-        password  requisite     pam_unix.so nullok sha512
+        password  requisite     pam_unix.so nullok yescrypt
 
         session   optional      pam_keyinit.so revoke
         session   include       login

nixos/modules/system/boot/systemd.nix

···
       # Filesystems.
       "systemd-fsck@.service"
       "systemd-fsck-root.service"
+      "systemd-growfs@.service"
+      "systemd-growfs-root.service"
       "systemd-remount-fs.service"
       "systemd-pstore.service"
       "local-fs.target"

nixos/modules/system/boot/systemd/initrd.nix

···
     "systemd-ask-password-console.path"
     "systemd-ask-password-console.service"
     "systemd-fsck@.service"
+    "systemd-growfs@.service"
     "systemd-halt.service"
     "systemd-hibernate-resume@.service"
     "systemd-journald-audit.socket"
···
       managerEnvironment.PATH = "/bin:/sbin";
 
       contents = {
+        "/tmp/.keep".text = "systemd requires the /tmp mount point in the initrd cpio archive";
         "/init".source = "${cfg.package}/lib/systemd/systemd";
         "/etc/systemd/system".source = stage1Units;
 

nixos/tests/pam/test_chfn.py

···
     "auth sufficient pam_rootok.so",
     "auth sufficient pam_unix.so   likeauth try_first_pass",
     "password sufficient @@pam_krb5@@/lib/security/pam_krb5.so use_first_pass",
-    "password sufficient pam_unix.so nullok sha512",
+    "password sufficient pam_unix.so nullok yescrypt",
     "session optional @@pam_krb5@@/lib/security/pam_krb5.so",
     "session required pam_env.so conffile=/etc/pam/environment readenv=0",
     "session required pam_unix.so",

pkgs/applications/audio/moc/default.nix

···
 , musepackSupport ? true, libmpc, libmpcdec, taglib
 , vorbisSupport ? true, libvorbis
 , speexSupport ? true, speex
-, ffmpegSupport ? true, ffmpeg
+, ffmpegSupport ? true, ffmpeg_4
 , sndfileSupport ? true, libsndfile
 , wavpackSupport ? true, wavpack
 # Misc
···
     ++ lib.optionals musepackSupport [ libmpc libmpcdec taglib ]
     ++ lib.optional vorbisSupport libvorbis
     ++ lib.optional speexSupport speex
-    ++ lib.optional ffmpegSupport ffmpeg
+    ++ lib.optional ffmpegSupport ffmpeg_4
     ++ lib.optional sndfileSupport libsndfile
     ++ lib.optional wavpackSupport wavpack
     # Misc

pkgs/applications/audio/musly/default.nix

···
-{ lib, stdenv, fetchFromGitHub, cmake, eigen, ffmpeg }:
+{ lib, stdenv, fetchFromGitHub, cmake, eigen, ffmpeg_4 }:
 stdenv.mkDerivation {
   pname = "musly";
   version = "unstable-2017-04-26";
···
     sha256 = "1q42wvdwy2pac7bhfraqqj2czw7w2m33ms3ifjl8phm7d87i8825";
   };
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ eigen ffmpeg ];
+  buildInputs = [ eigen ffmpeg_4 ];
   fixupPhase = lib.optionalString stdenv.isDarwin ''
     install_name_tool -change libmusly.dylib $out/lib/libmusly.dylib $out/bin/musly
     install_name_tool -change libmusly_resample.dylib $out/lib/libmusly_resample.dylib $out/bin/musly

pkgs/applications/audio/qsynth/default.nix

···
   buildInputs = [ alsa-lib fluidsynth libjack2 qtbase qttools qtx11extras ];
 
   enableParallelBuilding = true;
+  # Missing install depends:
+  #   lrelease error: Parse error at src/translations/qsynth_ru.ts:1503:33: Premature end of document.
+  #   make: *** [Makefile:107: src/translations/qsynth_ru.qm] Error 1
+  enableParallelInstalling = false;
 
   meta = with lib; {
     description = "Fluidsynth GUI";

pkgs/applications/audio/spek/default.nix

···
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, intltool, pkg-config, ffmpeg, wxGTK32, gtk3, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, intltool, pkg-config, ffmpeg_4, wxGTK32, gtk3, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "spek";
···
 
   nativeBuildInputs = [ autoreconfHook intltool pkg-config wrapGAppsHook ];
 
-  buildInputs = [ ffmpeg wxGTK32 gtk3 ];
+  buildInputs = [ ffmpeg_4 wxGTK32 gtk3 ];
 
   meta = with lib; {
     description = "Analyse your audio files by showing their spectrogram";

pkgs/applications/audio/tenacity/default.nix

···
 , expat
 , libid3tag
 , libopus
-, ffmpeg
+, ffmpeg_4
 , soundtouch
 , pcre
 , portaudio
···
   buildInputs = [
     alsa-lib
     expat
-    ffmpeg
+    ffmpeg_4
     file
     flac
     glib

pkgs/applications/blockchains/bitcoin-unlimited/default.nix

···
     homepage = "https://www.bitcoinunlimited.info/";
     maintainers = with maintainers; [ DmitryTsygankov ];
     license = licenses.mit;
-    broken = stdenv.isDarwin;
+    broken = true;
     platforms = platforms.unix;
   };
 }

pkgs/applications/blockchains/dogecoin/default.nix

···
     license = licenses.mit;
     maintainers = with maintainers; [ edwtjo offline ];
     platforms = platforms.unix;
+    broken = true;
   };
 }

pkgs/applications/blockchains/pivx/default.nix

···
   '';
 
   meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
+    broken = true;
     description = "An open source crypto-currency focused on fast private transactions";
     longDescription = ''
       PIVX is an MIT licensed, open source, blockchain-based cryptocurrency with

pkgs/applications/emulators/attract-mode/default.nix

···
-{ expat, fetchFromGitHub, ffmpeg, fontconfig, freetype, libarchive, libjpeg
+{ expat, fetchFromGitHub, ffmpeg_4, fontconfig, freetype, libarchive, libjpeg
 , libGLU, libGL, openal, pkg-config, sfml, lib, stdenv, zlib
 }:
 
···
   '';
 
   buildInputs = [
-    expat ffmpeg fontconfig freetype libarchive libjpeg libGLU libGL openal sfml zlib
+    expat ffmpeg_4 fontconfig freetype libarchive libjpeg libGLU libGL openal sfml zlib
   ];
 
   meta = with lib; {

pkgs/applications/emulators/citra/generic.nix

···
 , enableCubeb ? true, libpulseaudio
 , enableFfmpegAudioDecoder ? true
 , enableFfmpegVideoDumper ? true
-, ffmpeg
+, ffmpeg_4
 , useDiscordRichPresence ? true, rapidjson
 , enableFdk ? false, fdk_aac
 }:
···
     ++ lib.optional enableSdl2 SDL2
     ++ lib.optional enableQtTranslation qttools
     ++ lib.optional enableCubeb libpulseaudio
-    ++ lib.optional (enableFfmpegAudioDecoder || enableFfmpegVideoDumper) ffmpeg
+    ++ lib.optional (enableFfmpegAudioDecoder || enableFfmpegVideoDumper) ffmpeg_4
     ++ lib.optional useDiscordRichPresence rapidjson
     ++ lib.optional enableFdk fdk_aac;
 

pkgs/applications/emulators/pcsxr/default.nix

···
 { lib, stdenv, fetchurl, autoreconfHook, intltool, pkg-config, gtk3, SDL2, xorg
-, wrapGAppsHook, libcdio, nasm, ffmpeg, file
+, wrapGAppsHook, libcdio, nasm, ffmpeg_4, file
 , fetchpatch }:
 
 stdenv.mkDerivation rec {
···
 
   nativeBuildInputs = [ autoreconfHook intltool pkg-config wrapGAppsHook ];
   buildInputs = [
-    gtk3 SDL2 xorg.libXv xorg.libXtst libcdio nasm ffmpeg file
+    gtk3 SDL2 xorg.libXv xorg.libXtst libcdio nasm ffmpeg_4 file
     xorg.libXxf86vm
   ];
 

pkgs/applications/emulators/ppsspp/default.nix

···
 , SDL2
 , cmake
 , copyDesktopItems
-, ffmpeg
+, ffmpeg_4
 , glew
 , libffi
 , libsForQt5
···
 
   buildInputs = [
     SDL2
-    ffmpeg
+    ffmpeg_4
     (glew.override { enableEGL = forceWayland; })
     libzip
     snappy

pkgs/applications/emulators/retroarch/cores.nix

···
 , curl
 , fetchFromGitHub
 , ffmpeg
+, ffmpeg_4
 , fluidsynth
 , gettext
 , hexdump
···
   ppsspp = mkLibretroCore {
     core = "ppsspp";
     extraNativeBuildInputs = [ cmake pkg-config python3 ];
-    extraBuildInputs = [ libGLU libGL libzip ffmpeg snappy xorg.libX11 ];
+    extraBuildInputs = [ libGLU libGL libzip ffmpeg_4 snappy xorg.libX11 ];
     makefile = "Makefile";
     cmakeFlags = [
       "-DLIBRETRO=ON"

pkgs/applications/graphics/digikam/default.nix

···
 , boost
 , eigen
 , exiv2
-, ffmpeg
+, ffmpeg_4
 , flex
 , graphviz
 , imagemagick
···
     boost
     eigen
     exiv2
-    ffmpeg
+    ffmpeg_4
     flex
     graphviz
     imagemagick

pkgs/applications/graphics/fluxus/default.nix

···
     license = licenses.gpl2;
     homepage = "http://www.pawfal.org/fluxus/";
     maintainers = [ maintainers.brainrape ];
+    broken = true;
   };
 }

pkgs/applications/graphics/gnome-decoder/default.nix

···
     platforms = platforms.linux;
     mainProgram = "decoder";
     maintainers = with maintainers; [ zendo ];
+    broken = true;
   };
 }

pkgs/applications/networking/browsers/w3m/default.nix

···
 , x11Support ? graphicsSupport, libX11
 , mouseSupport ? !stdenv.isDarwin, gpm-ncurses
 , perl, man, pkg-config, buildPackages, w3m
+, testers
 }:
 
 let
···
   };
 in stdenv.mkDerivation rec {
   pname = "w3m";
-  version = "0.5.3+git20220429";
+  version = "0.5.3+git20230121";
 
   src = fetchFromGitHub {
     owner = "tats";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-aPPLZjjL3A5Tk0hv0NoAwJnjemC7a5RUoubhUr3lQE4=";
+    hash = "sha256-upb5lWqhC1jRegzTncIz5e21v4Pw912FyVn217HucFs=";
   };
 
   NIX_LDFLAGS = lib.optionalString stdenv.isSunOS "-lsocket -lnsl";
···
   # see: https://bbs.archlinux.org/viewtopic.php?id=196093
   LIBS = lib.optionalString x11Support "-lX11";
 
+  passthru.tests.version = testers.testVersion {
+    inherit version;
+    package = w3m;
+    command = "w3m -version";
+  };
+
   meta = with lib; {
     homepage = "https://w3m.sourceforge.net/";
+    changelog = "https://github.com/tats/w3m/blob/v${version}/ChangeLog";
     description = "A text-mode web browser";
     maintainers = with maintainers; [ cstrahan anthonyroussel ];
     platforms = platforms.unix;
     license = licenses.mit;
+    mainProgram = "w3m";
   };
 }

pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix

···
 , kwayland
 , lz4
 , xxHash
-, ffmpeg
+, ffmpeg_4
 , openalSoft
 , minizip
 , libopus
···
     qtsvg
     lz4
     xxHash
-    ffmpeg
+    ffmpeg_4
     openalSoft
     minizip
     libopus

pkgs/applications/science/biology/febio-studio/default.nix

···
 { lib, stdenv, fetchFromGitHub, cmake, zlib, libglvnd, libGLU, wrapQtAppsHook
 , sshSupport ? true, openssl, libssh
 , tetgenSupport ? true, tetgen
-, ffmpegSupport ? true, ffmpeg
+, ffmpegSupport ? true, ffmpeg_4
 , dicomSupport  ? false, dcmtk
 , withModelRepo ? true
 , withCadFeatures ? false
···
   buildInputs = [ zlib libglvnd libGLU openssl libssh ]
     ++ lib.optional sshSupport openssl
     ++ lib.optional tetgenSupport tetgen
-    ++ lib.optional ffmpegSupport ffmpeg
+    ++ lib.optional ffmpegSupport ffmpeg_4
     ++ lib.optional dicomSupport dcmtk
   ;
 

pkgs/applications/science/math/gretl/default.nix

···
   nativeBuildInputs = [ pkg-config ];
 
   enableParallelBuilding = true;
+  # Missing install depends:
+  #  cp: cannot stat '...-gretl-2022c/share/gretl/data/plotbars': Not a directory
+  #  make[1]: *** [Makefile:73: install_datafiles] Error 1
+  enableParallelInstalling = false;
 
   meta = with lib; {
     description = "A software package for econometric analysis";

pkgs/applications/science/networking/sumo/default.nix

···
-{ lib, bzip2, cmake, eigen, fetchFromGitHub, ffmpeg, fox_1_6, gdal,
+{ lib, bzip2, cmake, eigen, fetchFromGitHub, ffmpeg_4, fox_1_6, gdal,
   git, gl2ps, gpp , gtest, jdk, libGL, libGLU, libX11, libjpeg,
   libpng, libtiff, libxcrypt, openscenegraph , proj, python3,
   python3Packages, stdenv, swig, xercesc, xorg, zlib }:
···
   buildInputs = [
     bzip2
     eigen
-    ffmpeg
+    ffmpeg_4
     fox_1_6
     gdal
     gl2ps

pkgs/applications/terminal-emulators/syncterm/default.nix

···
 
   meta = with lib; {
     # error: unsupported option '-fsanitize=safe-stack' for target 'x86_64-apple-darwin'
-    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
+    # broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
+    broken = true; # sendmsg.c:(.text+0x1099): undefined reference to `pthread_yield'
     homepage = "https://syncterm.bbsdev.net/";
     description = "BBS terminal emulator";
     maintainers = with maintainers; [ embr ];

pkgs/applications/version-management/subversion/default.nix

···
     inherit perlBindings pythonBindings;
 
     enableParallelBuilding = true;
+    # Missing install dependencies:
+    # libtool:   error: error: relink 'libsvn_ra_serf-1.la' with the above command before installing it
+    # make: *** [build-outputs.mk:1316: install-serf-lib] Error 1
+    enableParallelInstalling = false;
 
     nativeCheckInputs = [ python3 ];
     doCheck = false; # fails 10 out of ~2300 tests

pkgs/applications/video/bino3d/default.nix

···
-{ mkDerivation, lib, fetchurl, pkg-config, ffmpeg, glew, libass, openal, qtbase }:
+{ mkDerivation, lib, fetchurl, pkg-config, ffmpeg_4, glew, libass, openal, qtbase }:
 
 mkDerivation rec {
   pname = "bino";
···
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ ffmpeg glew libass openal qtbase ];
+  buildInputs = [ ffmpeg_4 glew libass openal qtbase ];
 
   enableParallelBuilding = true;
 

pkgs/applications/video/bombono/default.nix

···
 , dvdplusrwtools
 , enca
 , cdrkit
-, ffmpeg
+, ffmpeg_4
 , gettext
 , gtk2
 , gtkmm2
···
     dvdauthor
     dvdplusrwtools
     enca
-    ffmpeg
+    ffmpeg_4
     gtk2
     gtkmm2
     libdvdread
···
     # fix iso authoring
     install -Dt  $out/share/bombono/resources/scons_authoring tools/scripts/SConsTwin.py
 
-    wrapProgram $out/bin/bombono-dvd --prefix PATH : ${lib.makeBinPath [ ffmpeg dvdauthor cdrkit ]}
+    wrapProgram $out/bin/bombono-dvd --prefix PATH : ${lib.makeBinPath [ ffmpeg_4 dvdauthor cdrkit ]}
   '';
 
   meta = with lib; {

pkgs/applications/video/ccextractor/default.nix

···
 , makeWrapper
 , tesseract4
 , leptonica
-, ffmpeg
+, ffmpeg_4
 }:
 
 stdenv.mkDerivation rec {
···
 
   buildInputs = [ zlib ]
     ++ lib.optional (!stdenv.isLinux) libiconv
-    ++ lib.optionals enableOcr [ leptonica tesseract4 ffmpeg ];
+    ++ lib.optionals enableOcr [ leptonica tesseract4 ffmpeg_4 ];
 
   cmakeFlags = [
     # file RPATH_CHANGE could not write new RPATH:

pkgs/applications/video/dvdstyler/default.nix

···
 , docbook-xsl-nons
 , dvdauthor
 , dvdplusrwtools
-, ffmpeg
+, ffmpeg_4
 , flex
 , fontconfig
 , gettext
···
     cdrtools
     dvdauthor
     dvdplusrwtools
-    ffmpeg
+    ffmpeg_4
     fontconfig
     glib
     libexif

pkgs/applications/video/mplayer/default.nix

···
-{ config, lib, stdenv, fetchurl, fetchsvn, pkg-config, freetype, yasm, ffmpeg
+{ config, lib, stdenv, fetchurl, fetchsvn, pkg-config, freetype, yasm, ffmpeg_4
 , aalibSupport ? true, aalib
 , fontconfigSupport ? true, fontconfig, freefont_ttf
 , fribidiSupport ? true, fribidi
···
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ pkg-config yasm ];
   buildInputs = with lib;
-    [ freetype ffmpeg ]
+    [ freetype ffmpeg_4 ]
     ++ optional aalibSupport aalib
     ++ optional fontconfigSupport fontconfig
     ++ optional fribidiSupport fribidi

pkgs/applications/video/olive-editor/default.nix

···
 { lib, stdenv, fetchFromGitHub
 , pkg-config, which, qmake, wrapQtAppsHook
-, qtmultimedia, frei0r, opencolorio_1, ffmpeg-full, CoreFoundation }:
+, qtmultimedia, frei0r, opencolorio_1, ffmpeg_4, CoreFoundation }:
 
 stdenv.mkDerivation rec {
   pname = "olive-editor";
···
   ];
 
   buildInputs = [
-    ffmpeg-full
+    ffmpeg_4
     frei0r
     opencolorio_1
     qtmultimedia

pkgs/applications/video/rtabmap/default.nix

···
     license = licenses.bsd3;
     maintainers = with maintainers; [ ckie ];
     platforms = with platforms; linux;
+    broken = true;
   };
 }

pkgs/applications/video/simplescreenrecorder/default.nix

···
-{ lib, stdenv, mkDerivation, fetchFromGitHub, alsa-lib, ffmpeg, libjack2, libX11, libXext, libXinerama, qtx11extras
+{ lib, stdenv, mkDerivation, fetchFromGitHub, alsa-lib, ffmpeg_4, libjack2, libX11, libXext, libXinerama, qtx11extras
 , libXfixes, libGLU, libGL, pkg-config, libpulseaudio, libv4l, qtbase, qttools, cmake, ninja
 }:
 
···
 
   nativeBuildInputs = [ pkg-config cmake ninja ];
   buildInputs = [
-    alsa-lib ffmpeg libjack2 libX11 libXext libXfixes libXinerama libGLU libGL
+    alsa-lib ffmpeg_4 libjack2 libX11 libXext libXfixes libXinerama libGLU libGL
     libpulseaudio libv4l qtbase qttools qtx11extras
   ];
 

pkgs/applications/video/webcamoid/default.nix

···
 { lib, fetchFromGitHub, pkg-config, libxcb, mkDerivation, cmake
 , qtbase, qtdeclarative, qtquickcontrols, qtquickcontrols2
-, ffmpeg-full, gst_all_1, libpulseaudio, alsa-lib, jack2
+, ffmpeg_4, gst_all_1, libpulseaudio, alsa-lib, jack2
 , v4l-utils }:
 mkDerivation rec {
   pname = "webcamoid";
···
   buildInputs = [
     libxcb
     qtbase qtdeclarative qtquickcontrols qtquickcontrols2
-    ffmpeg-full
+    ffmpeg_4
     gst_all_1.gstreamer gst_all_1.gst-plugins-base
     alsa-lib libpulseaudio jack2
     v4l-utils

pkgs/build-support/docker/default.nix

···
       cat > /etc/pam.d/other <<EOF
     account sufficient pam_unix.so
     auth sufficient pam_rootok.so
-    password requisite pam_unix.so nullok sha512
+    password requisite pam_unix.so nullok yescrypt
     session required pam_unix.so
     EOF
     fi

pkgs/build-support/setup-hooks/multiple-outputs.sh

···
 # specific to this function's use case, which is setting up the output variables.
 _assignFirst() {
     local varName="$1"
+    local _var
     local REMOVE=REMOVE # slightly hacky - we allow REMOVE (i.e. not a variable name)
     shift
-    for var in "$@"; do
-        if [ -n "${!var-}" ]; then eval "${varName}"="${var}"; return; fi
+    for _var in "$@"; do
+        if [ -n "${!_var-}" ]; then eval "${varName}"="${_var}"; return; fi
     done
     echo
-    echo "error: _assignFirst: could not find a non-empty variable to assign to ${varName}."
+    echo "error: _assignFirst: could not find a non-empty variable whose name to assign to ${varName}."
     echo "       The following variables were all unset or empty:"
     echo "           $*"
     if [ -z "${out:-}" ]; then
···
 
             # remove empty directories, printing iff at least one gets removed
             local srcParent="$(readlink -m "$srcPath/..")"
-            if rmdir "$srcParent"; then
+            if [ -n "$(find "$srcParent" -maxdepth 0 -type d -empty 2>/dev/null)" ]; then
                 echo "Removing empty $srcParent/ and (possibly) its parents"
-                rmdir -p --ignore-fail-on-non-empty "$(readlink -m "$srcParent/..")" \
+                rmdir -p --ignore-fail-on-non-empty "$srcParent" \
                     2> /dev/null || true # doesn't ignore failure for some reason
             fi
         done

pkgs/build-support/setup-hooks/separate-debug-info.sh

···
     local dst="${debug:-$out}"
     if [ "$prefix" = "$dst" ]; then return 0; fi
 
+    # in case there is nothing to strip, don't fail the build
+    mkdir -p "$dst"
+
     dst="$dst/lib/debug/.build-id"
 
     # Find executables and dynamic libraries.

pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix

···
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ doronbehar ];
     platforms = platforms.linux;
+    broken = true;
   };
 }
-

pkgs/development/compilers/gcc/11/default.nix

···
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
 
-  buildFlags = optional
-    (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
-    (if profiledCompiler then "profiledbootstrap" else "bootstrap");
+  buildFlags =
+    let target =
+          lib.optionalString (profiledCompiler) "profiled" +
+          lib.optionalString (targetPlatform == hostPlatform && hostPlatform == buildPlatform && !disableBootstrap) "bootstrap";
+    in lib.optional (target != "") target;
 
   inherit (callFile ../common/strip-attributes.nix { })
     stripDebugList

pkgs/development/compilers/gcc/12/default.nix

···
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
 
-  buildFlags = optional
-    (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
-    (if profiledCompiler then "profiledbootstrap" else "bootstrap");
+  buildFlags =
+    let target =
+          lib.optionalString (profiledCompiler) "profiled" +
+          lib.optionalString (targetPlatform == hostPlatform && hostPlatform == buildPlatform && !disableBootstrap) "bootstrap";
+    in lib.optional (target != "") target;
 
   inherit (callFile ../common/strip-attributes.nix { })
     stripDebugList

pkgs/development/compilers/gcc/builder.sh

···
         done
     fi
 
+    # Cross-compiler specific:
+    # --with-headers=$dir option triggers gcc to make a private copy
+    # of $dir headers and use it later as `-isysroot`. This prevents
+    # cc-wrapper from overriding libc headers with `-idirafter`.
+    # It should be safe to drop it and rely solely on the cc-wrapper.
+    local sysinc_dir=$out/${targetConfig+$targetConfig/}sys-include
+    if [ -d "$sysinc_dir" ]; then
+        chmod -R u+w "$out/${targetConfig+$targetConfig/}sys-include"
+        rm -rfv "$out/${targetConfig+$targetConfig/}sys-include"
+    fi
+
     # Get rid of some "fixed" header files
     rm -rfv $out/lib/gcc/*/*/include-fixed/{root,linux}
 

pkgs/development/compilers/llvm/10/clang/default.nix

···
     buildInputs = [ libxml2 libllvm ];
 
     cmakeFlags = [
-      "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
     ] ++ lib.optionals enableManpages [

pkgs/development/compilers/llvm/10/compiler-rt/default.nix

···
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+  ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals ((useLLVM || bareMetal) && !haveLibc) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
···
     ./gnu-install-dirs.patch
     ../../common/compiler-rt/libsanitizer-no-cyclades-11.patch
     ./X86-support-extension.patch # backported from LLVM 11
+    # Fix build on armv6l
+    ../../common/compiler-rt/armv6-mcr-dmb.patch
+    ../../common/compiler-rt/armv6-sync-ops-no-thumb.patch
+    ../../common/compiler-rt/armv6-no-ldrexd-strexd.patch
   ] ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks

pkgs/development/compilers/llvm/10/llvm/default.nix

···
 , zlib
 , buildLlvmTools
 , debugVersion ? false
+, doCheck ? stdenv.isLinux && (!stdenv.isx86_32)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
···
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitString "." release_version));
 
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
+
 in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
···
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake python3 ]
+  nativeBuildInputs = [ cmake python ]
     ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
 
   buildInputs = [ libxml2 libffi ]
···
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 

pkgs/development/compilers/llvm/11/clang/default.nix

···
     buildInputs = [ libxml2 libllvm ];
 
     cmakeFlags = [
-      "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
     ] ++ lib.optionals enableManpages [

pkgs/development/compilers/llvm/11/compiler-rt/default.nix

···
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+  ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals (!haveLibc || bareMetal) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
···
     ../../common/compiler-rt/libsanitizer-no-cyclades-11.patch
     ../../common/compiler-rt/darwin-plistbuddy-workaround.patch
     ./armv7l.patch
+    # Fix build on armv6l
+    ../../common/compiler-rt/armv6-mcr-dmb.patch
+    ../../common/compiler-rt/armv6-sync-ops-no-thumb.patch
+    ../../common/compiler-rt/armv6-no-ldrexd-strexd.patch
   ];
 
   preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''

pkgs/development/compilers/llvm/11/llvm/default.nix

···
 , zlib
 , buildLlvmTools
 , debugVersion ? false
+, doCheck ? stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl) && (!stdenv.hostPlatform.isRiscV)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
···
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitString "." release_version));
 
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
+
 in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
···
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake python3 ]
+  nativeBuildInputs = [ cmake python ]
     ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
 
   buildInputs = [ libxml2 libffi ]
···
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl) && (!stdenv.hostPlatform.isRiscV)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 

pkgs/development/compilers/llvm/12/clang/default.nix

···
     buildInputs = [ libxml2 libllvm ];
 
     cmakeFlags = [
-      "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
     ] ++ lib.optionals enableManpages [

pkgs/development/compilers/llvm/12/compiler-rt/default.nix

···
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+    "-DCOMPILER_RT_BUILD_MEMPROF=OFF"
+  ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
-    "-DCOMPILER_RT_BUILD_MEMPROF=OFF"
   ] ++ lib.optionals ((useLLVM && !haveLibc) || bareMetal) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
     "-DCMAKE_CXX_COMPILER_WORKS=ON"
···
     ./normalize-var.patch
     ../../common/compiler-rt/darwin-plistbuddy-workaround.patch
     ./armv7l.patch
+    # Fix build on armv6l
+    ../../common/compiler-rt/armv6-mcr-dmb.patch
+    ../../common/compiler-rt/armv6-sync-ops-no-thumb.patch
+    ../../common/compiler-rt/armv6-no-ldrexd-strexd.patch
   ];
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks

pkgs/development/compilers/llvm/12/llvm/default.nix

···
 , zlib
 , buildLlvmTools
 , debugVersion ? false
+, doCheck ? stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
···
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitString "." release_version));
 
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
+
 in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
···
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake python3 ]
+  nativeBuildInputs = [ cmake python ]
     ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
 
   buildInputs = [ libxml2 libffi ]
···
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 

pkgs/development/compilers/llvm/13/clang/default.nix

···
     buildInputs = [ libxml2 libllvm ];
 
     cmakeFlags = [
-      "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
     ] ++ lib.optionals enableManpages [

pkgs/development/compilers/llvm/13/compiler-rt/default.nix

···
   ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
-    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
     "-DCOMPILER_RT_BUILD_MEMPROF=OFF"
     "-DCOMPILER_RT_BUILD_ORC=OFF" # may be possible to build with musl if necessary
+  ] ++ lib.optionals (useLLVM || bareMetal) [
+    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals ((useLLVM && !haveLibc) || bareMetal) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
     "-DCMAKE_CXX_COMPILER_WORKS=ON"
···
     ./darwin-targetconditionals.patch
     ../../common/compiler-rt/darwin-plistbuddy-workaround.patch
     ./armv7l.patch
+    # Fix build on armv6l
+    ../../common/compiler-rt/armv6-mcr-dmb.patch
+    ../../common/compiler-rt/armv6-sync-ops-no-thumb.patch
+    ../../common/compiler-rt/armv6-no-ldrexd-strexd.patch
+    ../../common/compiler-rt/armv6-scudo-no-yield.patch
+    ../../common/compiler-rt/armv6-scudo-libatomic.patch
   ];
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks

pkgs/development/compilers/llvm/13/llvm/default.nix

···
 , which
 , buildLlvmTools
 , debugVersion ? false
+, doCheck ? stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
···
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitString "." release_version));
 
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
+
 in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
···
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake python3 ]
+  nativeBuildInputs = [ cmake python ]
     ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
 
   buildInputs = [ libxml2 libffi ]
···
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 

pkgs/development/compilers/llvm/14/clang/default.nix

···
     buildInputs = [ libxml2 libllvm ];
 
     cmakeFlags = [
-      "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
     ] ++ lib.optionals enableManpages [

pkgs/development/compilers/llvm/14/compiler-rt/default.nix

···
     ./darwin-targetconditionals.patch
     ../../common/compiler-rt/darwin-plistbuddy-workaround.patch
     ./armv7l.patch
+    # Fix build on armv6l
+    ../../common/compiler-rt/armv6-mcr-dmb.patch
+    ../../common/compiler-rt/armv6-sync-ops-no-thumb.patch
+    ../../common/compiler-rt/armv6-no-ldrexd-strexd.patch
+    ../../common/compiler-rt/armv6-scudo-no-yield.patch
+    ../../common/compiler-rt/armv6-scudo-libatomic.patch
   ];
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks

pkgs/development/compilers/llvm/14/default.nix

···
 { lowPrio, newScope, pkgs, lib, stdenv, cmake
 , gccForLibs, preLibcCrossHeaders
-, libxml2, python3, isl, fetchFromGitHub, overrideCC, wrapCCWith, wrapBintoolsWith
+, libxml2, python3, fetchFromGitHub, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 , targetLlvm
···
   };
 
   tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version monorepoSrc buildLlvmTools; });
+    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 release_version version monorepoSrc buildLlvmTools; });
     mkExtraBuildCommands0 = cc: ''
       rsrc="$out/resource-root"
       mkdir "$rsrc"
···
   });
 
   libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version monorepoSrc; });
+    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 release_version version monorepoSrc; });
   in {
 
     compiler-rt-libc = callPackage ./compiler-rt {

pkgs/development/compilers/llvm/14/llvm/default.nix

···
 , which
 , buildLlvmTools
 , debugVersion ? false
+, doCheck ? stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
 # broken for the armv7l builder
 , enablePFM ? stdenv.isLinux && !stdenv.hostPlatform.isAarch
-, enablePolly ? false
+, enablePolly ? true
 } @args:
 
 let
···
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitString "." release_version));
 
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
+
 in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
···
     cp -r ${monorepoSrc}/${pname} "$out"
     cp -r ${monorepoSrc}/third-party "$out"
   '' + lib.optionalString enablePolly ''
-    cp -r ${monorepoSrc}/polly "$out/llvm/tools"
+    chmod u+w "$out/${pname}/tools"
+    cp -r ${monorepoSrc}/polly "$out/${pname}/tools"
   '');
 
   sourceRoot = "${src.name}/${pname}";
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake python3 ]
+  nativeBuildInputs = [ cmake python ]
     ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
 
   buildInputs = [ libxml2 libffi ]
···
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 

pkgs/development/compilers/llvm/14/llvm/gnu-install-dirs-polly.patch

···
-diff --git a/tools/polly/CMakeLists.txt b/tools/polly/CMakeLists.txt
-index ca7c04c565bb..6a6155806ffa 100644
---- a/tools/polly/CMakeLists.txt
-+++ b/tools/polly/CMakeLists.txt
-@@ -3,6 +3,8 @@ if (NOT DEFINED LLVM_MAIN_SRC_DIR)
-   project(Polly)
-   cmake_minimum_required(VERSION 3.13.4)
- 
-+  include(GNUInstallDirs)
-+
-   # Where is LLVM installed?
-   find_package(LLVM CONFIG REQUIRED)
-   set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} ${LLVM_CMAKE_DIR})
-@@ -122,13 +124,13 @@ include_directories(
- 
- if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
-   install(DIRECTORY include/
--    DESTINATION include
-+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
-     FILES_MATCHING
-     PATTERN "*.h"
-     )
- 
-   install(DIRECTORY ${POLLY_BINARY_DIR}/include/
--    DESTINATION include
-+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
-     FILES_MATCHING
-     PATTERN "*.h"
-     PATTERN "CMakeFiles" EXCLUDE
-diff --git a/tools/polly/cmake/CMakeLists.txt b/tools/polly/cmake/CMakeLists.txt
-index 7cc129ba2e90..137be25e4b80 100644
---- a/tools/polly/cmake/CMakeLists.txt
-+++ b/tools/polly/cmake/CMakeLists.txt
-@@ -79,18 +79,18 @@ file(GENERATE
- 
- # Generate PollyConfig.cmake for the install tree.
- unset(POLLY_EXPORTS)
--set(POLLY_INSTALL_PREFIX "${CMAKE_INSTALL_PREFIX}")
-+set(POLLY_INSTALL_PREFIX "")
- set(POLLY_CONFIG_LLVM_CMAKE_DIR "${LLVM_BINARY_DIR}/${LLVM_INSTALL_PACKAGE_DIR}")
--set(POLLY_CONFIG_CMAKE_DIR "${POLLY_INSTALL_PREFIX}/${POLLY_INSTALL_PACKAGE_DIR}")
--set(POLLY_CONFIG_LIBRARY_DIRS "${POLLY_INSTALL_PREFIX}/lib${LLVM_LIBDIR_SUFFIX}")
-+set(POLLY_CONFIG_CMAKE_DIR "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_PREFIX}/${POLLY_INSTALL_PACKAGE_DIR}")
-+set(POLLY_CONFIG_LIBRARY_DIRS "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
- if (POLLY_BUNDLED_ISL)
-   set(POLLY_CONFIG_INCLUDE_DIRS
--    "${POLLY_INSTALL_PREFIX}/include"
--    "${POLLY_INSTALL_PREFIX}/include/polly"
-+    "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_LIBDIR}"
-+    "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_LIBDIR}/polly"
-     )
- else()
-   set(POLLY_CONFIG_INCLUDE_DIRS
--    "${POLLY_INSTALL_PREFIX}/include"
-+    "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_INCLUDEDIR}"
-     ${ISL_INCLUDE_DIRS}
-     )
- endif()
-@@ -100,12 +100,12 @@ endif()
- foreach(tgt IN LISTS POLLY_CONFIG_EXPORTED_TARGETS)
-   get_target_property(tgt_type ${tgt} TYPE)
-   if (tgt_type STREQUAL "EXECUTABLE")
--    set(tgt_prefix "bin/")
-+    set(tgt_prefix "${CMAKE_INSTALL_BINDIR}/")
-   else()
--    set(tgt_prefix "lib/")
-+    set(tgt_prefix "${CMAKE_INSTALL_LIBDIR}/")
-   endif()
- 
--  set(tgt_path "${CMAKE_INSTALL_PREFIX}/${tgt_prefix}$<TARGET_FILE_NAME:${tgt}>")
-+  set(tgt_path "${tgt_prefix}$<TARGET_FILE_NAME:${tgt}>")
-   file(RELATIVE_PATH tgt_path ${POLLY_CONFIG_CMAKE_DIR} ${tgt_path})
- 
-   if (NOT tgt_type STREQUAL "INTERFACE_LIBRARY")
+This is the one remaining Polly install dirs related change that hasn't made it
+into upstream yet; previously this patch file also included:
+https://reviews.llvm.org/D117541
+
 diff --git a/tools/polly/cmake/polly_macros.cmake b/tools/polly/cmake/polly_macros.cmake
 index 518a09b45a42..bd9d6f5542ad 100644
 --- a/tools/polly/cmake/polly_macros.cmake
···
    endif()
    set_property(GLOBAL APPEND PROPERTY LLVM_EXPORTS ${name})
  endmacro(add_polly_library)
-diff --git a/tools/polly/lib/External/CMakeLists.txt b/tools/polly/lib/External/CMakeLists.txt
-index e3a5683fccdc..293b482eb28a 100644
---- a/tools/polly/lib/External/CMakeLists.txt
-+++ b/tools/polly/lib/External/CMakeLists.txt
-@@ -290,7 +290,7 @@ if (POLLY_BUNDLED_ISL)
-     install(DIRECTORY
-       ${ISL_SOURCE_DIR}/include/
-       ${ISL_BINARY_DIR}/include/
--      DESTINATION include/polly
-+      DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/polly
-       FILES_MATCHING
-       PATTERN "*.h"
-       PATTERN "CMakeFiles" EXCLUDE

pkgs/development/compilers/llvm/15/compiler-rt/default.nix

···
     "-DCOMPILER_RT_BUILD_MEMPROF=OFF"
     "-DCOMPILER_RT_BUILD_ORC=OFF" # may be possible to build with musl if necessary
   ] ++ lib.optionals (useLLVM || bareMetal) [
-     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
+    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals ((useLLVM && !haveLibc) || bareMetal) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
     "-DCMAKE_CXX_COMPILER_WORKS=ON"

pkgs/development/compilers/llvm/5/compiler-rt/default.nix

···
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+  ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCMAKE_C_COMPILER_WORKS=ON"

pkgs/development/compilers/llvm/6/compiler-rt/default.nix

···
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+  ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCMAKE_C_COMPILER_WORKS=ON"

pkgs/development/compilers/llvm/6/llvm/default.nix

···
 , zlib
 , buildLlvmTools
 , fetchpatch
+, doCheck ? stdenv.isLinux && (!stdenv.isi686)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , debugVersion ? false
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
···
   versionSuffixes = with lib;
     let parts = splitVersion release_version; in
     imap (i: _: concatStringsSep "." (take i parts)) parts;
+
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
 in
 
 stdenv.mkDerivation (rec {
···
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake python3 ]
+  nativeBuildInputs = [ cmake python ]
     ++ optional enableManpages python3.pkgs.sphinx;
 
   buildInputs = [ libxml2 libffi ];
···
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isi686)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 

pkgs/development/compilers/llvm/7/compiler-rt/default.nix

···
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+  ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals ((useLLVM || bareMetal) && !haveLibc) [
     "-DCMAKE_C_COMPILER_WORKS=ON"

pkgs/development/compilers/llvm/7/llvm/default.nix

···
 , zlib
 , buildLlvmTools
 , debugVersion ? false
+, doCheck ? stdenv.isLinux && (!stdenv.isx86_32)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
···
     let parts = splitVersion release_version; in
     imap (i: _: concatStringsSep "." (take i parts)) parts;
 
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
+
 in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
···
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake python3 ]
+  nativeBuildInputs = [ cmake python ]
     ++ optional enableManpages python3.pkgs.sphinx;
 
   buildInputs = [ libxml2 libffi ]
···
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 

pkgs/development/compilers/llvm/8/compiler-rt/default.nix

···
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+  ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals ((useLLVM || bareMetal) && !haveLibc) [
     "-DCMAKE_C_COMPILER_WORKS=ON"

pkgs/development/compilers/llvm/8/llvm/default.nix

···
 , zlib
 , buildLlvmTools
 , debugVersion ? false
+, doCheck ? stdenv.isLinux && (!stdenv.isx86_32)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
···
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitVersion release_version));
 
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
+
 in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
···
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake python3 ]
+  nativeBuildInputs = [ cmake python ]
     ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
 
   buildInputs = [ libxml2 libffi ]
···
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 

pkgs/development/compilers/llvm/9/compiler-rt/default.nix

···
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+  ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals ((useLLVM || bareMetal) && !haveLibc) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
···
     ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./gnu-install-dirs.patch
     ../../common/compiler-rt/libsanitizer-no-cyclades-9.patch
+    # Fix build on armv6l
+    ../../common/compiler-rt/armv6-mcr-dmb.patch
+    ../../common/compiler-rt/armv6-sync-ops-no-thumb.patch
+    ../../common/compiler-rt/armv6-no-ldrexd-strexd.patch
   ] ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks

pkgs/development/compilers/llvm/9/llvm/default.nix

···
 , zlib
 , buildLlvmTools
 , debugVersion ? false
+, doCheck ? stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isRiscV)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
···
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitString "." release_version));
 
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
+
 in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
···
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake python3 ]
+  nativeBuildInputs = [ cmake python ]
     ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
 
   buildInputs = [ libxml2 libffi ]
···
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isRiscV)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 

pkgs/development/compilers/llvm/common/compiler-rt/armv6-mcr-dmb.patch

···
+From a11d1cc41c725ec6dee58f75e4a852a658dd7543 Mon Sep 17 00:00:00 2001
+From: Khem Raj <[e-mail]>
+Date: Thu, 10 Mar 2022 19:30:00 -0800
+Subject: [PATCH] [builtins] Use mcr for dmb instruction on armv6
+
+At present compiler-rt cross compiles for armv6 ( -march=armv6 ) but includes
+dmb instructions which are only available in armv7+ this causes SIGILL on
+clang+compiler-rt compiled components on rpi0w platforms.
+
+Reviewed By: MaskRay
+
+Differential Revision: https://reviews.llvm.org/D99282
+---
+ compiler-rt/lib/builtins/arm/sync-ops.h | 8 ++++----
+ compiler-rt/lib/builtins/assembly.h     | 8 ++++++++
+ 2 files changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/lib/builtins/arm/sync-ops.h b/lib/builtins/arm/sync-ops.h
+index c9623249e5d20..7a26170741ad2 100644
+--- a/lib/builtins/arm/sync-ops.h
++++ b/lib/builtins/arm/sync-ops.h
+@@ -19,14 +19,14 @@
+   .thumb;                                                                      \
+   .syntax unified;                                                             \
+   DEFINE_COMPILERRT_THUMB_FUNCTION(__sync_fetch_and_##op)                      \
+-  dmb;                                                                         \
++  DMB;                                                                         \
+   mov r12, r0;                                                                 \
+   LOCAL_LABEL(tryatomic_##op) : ldrex r0, [r12];                               \
+   op(r2, r0, r1);                                                              \
+   strex r3, r2, [r12];                                                         \
+   cmp r3, #0;                                                                  \
+   bne LOCAL_LABEL(tryatomic_##op);                                             \
+-  dmb;                                                                         \
++  DMB;                                                                         \
+   bx lr
+ 
+ #define SYNC_OP_8(op)                                                          \
+@@ -35,14 +35,14 @@
+   .syntax unified;                                                             \
+   DEFINE_COMPILERRT_THUMB_FUNCTION(__sync_fetch_and_##op)                      \
+   push {r4, r5, r6, lr};                                                       \
+-  dmb;                                                                         \
++  DMB;                                                                         \
+   mov r12, r0;                                                                 \
+   LOCAL_LABEL(tryatomic_##op) : ldrexd r0, r1, [r12];                          \
+   op(r4, r5, r0, r1, r2, r3);                                                  \
+   strexd r6, r4, r5, [r12];                                                    \
+   cmp r6, #0;                                                                  \
+   bne LOCAL_LABEL(tryatomic_##op);                                             \
+-  dmb;                                                                         \
++  DMB;                                                                         \
+   pop { r4, r5, r6, pc }
+ 
+ #define MINMAX_4(rD, rN, rM, cmp_kind)                                         \
+diff --git a/lib/builtins/assembly.h b/lib/builtins/assembly.h
+index 69a3d8620f924..06aa18162e3b4 100644
+--- a/lib/builtins/assembly.h
++++ b/lib/builtins/assembly.h
+@@ -189,6 +189,14 @@
+   JMP(ip)
+ #endif
+ 
++#if __ARM_ARCH >= 7
++#define DMB dmb
++#elif __ARM_ARCH >= 6
++#define DMB mcr p15, #0, r0, c7, c10, #5
++#else
++#error only supported on ARMv6+
++#endif
++
+ #if defined(USE_THUMB_2)
+ #define WIDE(op) op.w
+ #else
+

pkgs/development/compilers/llvm/common/compiler-rt/armv6-no-ldrexd-strexd.patch

···
+From 4fe3f21bf8b20c766877d2251d61118d0ff36688 Mon Sep 17 00:00:00 2001
+From: Ben Wolsieffer <[e-mail]>
+Date: Wed, 7 Dec 2022 14:56:51 -0500
+Subject: [PATCH] [compiler-rt][builtins] Do not use ldrexd or strexd on ARMv6
+
+The ldrexd and strexd instructions are not available on base ARMv6, and were
+only added in ARMv6K (see [1]). This patch solves this problem once and for all
+using the __ARM_FEATURE_LDREX macro (see [2]) defined in the ARM C Language
+Extensions (ACLE). Although this macro is technically deprecated in the ACLE,
+it allows compiler-rt to reliably detect whether ldrexd and strexd are supported
+without complicated conditionals to detect different ARM architecture variants.
+
+[1] https://developer.arm.com/documentation/dht0008/a/ch01s02s01
+[2] https://arm-software.github.io/acle/main/acle.html#ldrexstrex
+
+Differential Revision: https://reviews.llvm.org/D139585
+---
+ compiler-rt/lib/builtins/arm/sync_fetch_and_add_8.S  | 2 +-
+ compiler-rt/lib/builtins/arm/sync_fetch_and_and_8.S  | 2 +-
+ compiler-rt/lib/builtins/arm/sync_fetch_and_max_8.S  | 2 +-
+ compiler-rt/lib/builtins/arm/sync_fetch_and_min_8.S  | 2 +-
+ compiler-rt/lib/builtins/arm/sync_fetch_and_nand_8.S | 2 +-
+ compiler-rt/lib/builtins/arm/sync_fetch_and_or_8.S   | 2 +-
+ compiler-rt/lib/builtins/arm/sync_fetch_and_sub_8.S  | 2 +-
+ compiler-rt/lib/builtins/arm/sync_fetch_and_umax_8.S | 2 +-
+ compiler-rt/lib/builtins/arm/sync_fetch_and_umin_8.S | 2 +-
+ compiler-rt/lib/builtins/arm/sync_fetch_and_xor_8.S  | 2 +-
+ 10 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/lib/builtins/arm/sync_fetch_and_add_8.S b/lib/builtins/arm/sync_fetch_and_add_8.S
+index 18bdd875b8b7..bee6f7ba0f34 100644
+--- a/lib/builtins/arm/sync_fetch_and_add_8.S
++++ b/lib/builtins/arm/sync_fetch_and_add_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define add_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI) \
+     adds rD_LO, rN_LO, rM_LO ; \
+     adc rD_HI, rN_HI, rM_HI
+diff --git a/lib/builtins/arm/sync_fetch_and_and_8.S b/lib/builtins/arm/sync_fetch_and_and_8.S
+index 3716eff809d5..b4e77a54edf6 100644
+--- a/lib/builtins/arm/sync_fetch_and_and_8.S
++++ b/lib/builtins/arm/sync_fetch_and_and_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define and_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI) \
+     and rD_LO, rN_LO, rM_LO ; \
+     and rD_HI, rN_HI, rM_HI
+diff --git a/lib/builtins/arm/sync_fetch_and_max_8.S b/lib/builtins/arm/sync_fetch_and_max_8.S
+index 06115ab55246..1813274cc649 100644
+--- a/lib/builtins/arm/sync_fetch_and_max_8.S
++++ b/lib/builtins/arm/sync_fetch_and_max_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define max_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI)         MINMAX_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI, gt)
+ 
+ SYNC_OP_8(max_8)
+diff --git a/lib/builtins/arm/sync_fetch_and_min_8.S b/lib/builtins/arm/sync_fetch_and_min_8.S
+index 4f3e299d95cc..fa8f3477757b 100644
+--- a/lib/builtins/arm/sync_fetch_and_min_8.S
++++ b/lib/builtins/arm/sync_fetch_and_min_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define min_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI)         MINMAX_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI, lt)
+ 
+ SYNC_OP_8(min_8)
+diff --git a/lib/builtins/arm/sync_fetch_and_nand_8.S b/lib/builtins/arm/sync_fetch_and_nand_8.S
+index 425c94474af7..fb27219ee200 100644
+--- a/lib/builtins/arm/sync_fetch_and_nand_8.S
++++ b/lib/builtins/arm/sync_fetch_and_nand_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define nand_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI) \
+     bic rD_LO, rN_LO, rM_LO ; \
+     bic rD_HI, rN_HI, rM_HI
+diff --git a/lib/builtins/arm/sync_fetch_and_or_8.S b/lib/builtins/arm/sync_fetch_and_or_8.S
+index 4f18dcf84df9..3b077c8737b1 100644
+--- a/lib/builtins/arm/sync_fetch_and_or_8.S
++++ b/lib/builtins/arm/sync_fetch_and_or_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define or_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI) \
+     orr rD_LO, rN_LO, rM_LO ; \
+     orr rD_HI, rN_HI, rM_HI
+diff --git a/lib/builtins/arm/sync_fetch_and_sub_8.S b/lib/builtins/arm/sync_fetch_and_sub_8.S
+index 25a4a1076555..c171607eabd8 100644
+--- a/lib/builtins/arm/sync_fetch_and_sub_8.S
++++ b/lib/builtins/arm/sync_fetch_and_sub_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define sub_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI) \
+     subs rD_LO, rN_LO, rM_LO ; \
+     sbc rD_HI, rN_HI, rM_HI
+diff --git a/lib/builtins/arm/sync_fetch_and_umax_8.S b/lib/builtins/arm/sync_fetch_and_umax_8.S
+index aa5213ff1def..d1224f758049 100644
+--- a/lib/builtins/arm/sync_fetch_and_umax_8.S
++++ b/lib/builtins/arm/sync_fetch_and_umax_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define umax_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI)         MINMAX_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI, hi)
+ 
+ SYNC_OP_8(umax_8)
+diff --git a/lib/builtins/arm/sync_fetch_and_umin_8.S b/lib/builtins/arm/sync_fetch_and_umin_8.S
+index 8b40541ab47d..595444e6d053 100644
+--- a/lib/builtins/arm/sync_fetch_and_umin_8.S
++++ b/lib/builtins/arm/sync_fetch_and_umin_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define umin_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI)         MINMAX_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI, lo)
+ 
+ SYNC_OP_8(umin_8)
+diff --git a/lib/builtins/arm/sync_fetch_and_xor_8.S b/lib/builtins/arm/sync_fetch_and_xor_8.S
+index 7436eb1d4cae..9fc3d85cef75 100644
+--- a/lib/builtins/arm/sync_fetch_and_xor_8.S
++++ b/lib/builtins/arm/sync_fetch_and_xor_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define xor_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI) \
+     eor rD_LO, rN_LO, rM_LO ; \
+     eor rD_HI, rN_HI, rM_HI
+-- 
+2.38.1
+

pkgs/development/compilers/llvm/common/compiler-rt/armv6-scudo-libatomic.patch

···
+From a56bb19a9dc303a50ef12d83cd24c2395bf81076 Mon Sep 17 00:00:00 2001
+From: Ben Wolsieffer <[e-mail]>
+Date: Wed, 7 Dec 2022 21:25:46 -0500
+Subject: [PATCH] [scudo][standalone] Use CheckAtomic to decide to link to
+ libatomic
+
+Standalone scudo uses the atomic operation builtin functions, which require
+linking to libatomic on some platforms. Currently, this is done in an ad-hoc
+manner. MIPS platforms always link to libatomic, and the tests are always linked
+to it as well. libatomic is required on base ARMv6 (but not ARMv6K), but it is
+currently not linked, causing the build to fail.
+
+This patch replaces this ad-hoc logic with the CheckAtomic CMake module already
+used in other parts of LLVM. The CheckAtomic module checks whether std::atomic
+requires libatomic, which is not strictly the same as checking the atomic
+builtins, but should have the same results as far as I know. If this is
+problematic, a custom version of CheckAtomic could be used to specifically test
+the builtins.
+---
+ compiler-rt/lib/scudo/standalone/CMakeLists.txt       | 7 +++++++
+ compiler-rt/lib/scudo/standalone/tests/CMakeLists.txt | 4 +---
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/lib/scudo/standalone/CMakeLists.txt b/lib/scudo/standalone/CMakeLists.txt
+index ae5c354768c8..eb27374ca520 100644
+--- a/lib/scudo/standalone/CMakeLists.txt
++++ b/lib/scudo/standalone/CMakeLists.txt
+@@ -1,5 +1,8 @@
+ add_compiler_rt_component(scudo_standalone)
+ 
++include(DetermineGCCCompatible)
++include(CheckAtomic)
++
+ include_directories(../.. include)
+ 
+ set(SCUDO_CFLAGS)
+@@ -34,6 +37,10 @@ list(APPEND SCUDO_LINK_FLAGS -Wl,-z,defs,-z,now,-z,relro)
+ 
+ list(APPEND SCUDO_LINK_FLAGS -ffunction-sections -fdata-sections -Wl,--gc-sections)
+ 
++if(HAVE_CXX_ATOMICS_WITH_LIB OR HAVE_CXX_ATOMICS64_WITH_LIB)
++  list(APPEND SCUDO_LINK_FLAGS -latomic)
++endif()
++
+ # We don't use the C++ standard library, so avoid including it by mistake.
+ append_list_if(COMPILER_RT_HAS_NOSTDLIBXX_FLAG -nostdlib++ SCUDO_LINK_FLAGS)
+ 
+diff --git a/lib/scudo/standalone/tests/CMakeLists.txt b/lib/scudo/standalone/tests/CMakeLists.txt
+index 6d0936cbb5c1..70a5a7e959c1 100644
+--- a/lib/scudo/standalone/tests/CMakeLists.txt
++++ b/lib/scudo/standalone/tests/CMakeLists.txt
+@@ -38,9 +38,7 @@ set(LINK_FLAGS
+   ${SANITIZER_TEST_CXX_LIBRARIES}
+   )
+ list(APPEND LINK_FLAGS -pthread)
+-# Linking against libatomic is required with some compilers
+-check_library_exists(atomic __atomic_load_8 "" COMPILER_RT_HAS_LIBATOMIC)
+-if (COMPILER_RT_HAS_LIBATOMIC)
++if(HAVE_CXX_ATOMICS_WITH_LIB OR HAVE_CXX_ATOMICS64_WITH_LIB)
+   list(APPEND LINK_FLAGS -latomic)
+ endif()
+ 
+-- 
+2.38.1
+

pkgs/development/compilers/llvm/common/compiler-rt/armv6-scudo-no-yield.patch

···
+From ff0b373b959165477f45d9f5f9a8da471ae111ab Mon Sep 17 00:00:00 2001
+From: Ben Wolsieffer <[e-mail]>
+Date: Wed, 7 Dec 2022 18:03:56 -0500
+Subject: [PATCH] [scudo][standalone] Only use yield on ARMv6K and newer
+
+The yield instruction is only available in ARMv6K and newer. It behaves as a
+nop on single threaded platforms anyway, so use nop instead on unsupported
+architectures.
+
+Differential Revision: https://reviews.llvm.org/D139600
+---
+ compiler-rt/lib/scudo/standalone/common.h | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/lib/scudo/standalone/common.h b/lib/scudo/standalone/common.h
+index bc3dfec6dbba..862cda1d4bc4 100644
+--- a/lib/scudo/standalone/common.h
++++ b/lib/scudo/standalone/common.h
+@@ -109,7 +109,12 @@ inline void yieldProcessor(u8 Count) {
+ #elif defined(__aarch64__) || defined(__arm__)
+   __asm__ __volatile__("" ::: "memory");
+   for (u8 I = 0; I < Count; I++)
++#if __ARM_ARCH >= 6 && !defined(__ARM_ARCH_6__)
++    // yield is supported on ARMv6K and newer
+     __asm__ __volatile__("yield");
++#else
++    __asm__ __volatile__("nop");
++#endif
+ #endif
+   __asm__ __volatile__("" ::: "memory");
+ }
+-- 
+2.38.1
+

pkgs/development/compilers/llvm/common/compiler-rt/armv6-sync-ops-no-thumb.patch

···
+From 5017de8ba4b1fe985169cf54590e858a9019a91f Mon Sep 17 00:00:00 2001
+From: Khem Raj <[e-mail]>
+Date: Fri, 11 Mar 2022 16:25:49 -0800
+Subject: [PATCH] [builtins] Do not force thumb mode directive in
+ arm/sync-ops.h
+
+.thumb_func was not switching mode until [1]
+so it did not show up but now that .thumb_func (without argument) is
+switching mode, its causing build failures on armv6 ( rpi0 ) even when
+build is explicitly asking for this file to be built with -marm (ARM
+mode), therefore use DEFINE_COMPILERRT_FUNCTION macro to add function
+header which considers arch and mode from compiler cmdline to decide if
+the function is built using thumb mode or arm mode.
+
+[1] https://reviews.llvm.org/D101975
+
+Note that it also needs https://reviews.llvm.org/D99282
+
+Reviewed By: peter.smith, MaskRay
+
+Differential Revision: https://reviews.llvm.org/D104183
+---
+ compiler-rt/lib/builtins/arm/sync-ops.h | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/lib/builtins/arm/sync-ops.h b/lib/builtins/arm/sync-ops.h
+index 7a26170741ad2..d914f9d3a1093 100644
+--- a/lib/builtins/arm/sync-ops.h
++++ b/lib/builtins/arm/sync-ops.h
+@@ -16,9 +16,8 @@
+ 
+ #define SYNC_OP_4(op)                                                          \
+   .p2align 2;                                                                  \
+-  .thumb;                                                                      \
+   .syntax unified;                                                             \
+-  DEFINE_COMPILERRT_THUMB_FUNCTION(__sync_fetch_and_##op)                      \
++  DEFINE_COMPILERRT_FUNCTION(__sync_fetch_and_##op)                            \
+   DMB;                                                                         \
+   mov r12, r0;                                                                 \
+   LOCAL_LABEL(tryatomic_##op) : ldrex r0, [r12];                               \
+@@ -31,9 +30,8 @@
+ 
+ #define SYNC_OP_8(op)                                                          \
+   .p2align 2;                                                                  \
+-  .thumb;                                                                      \
+   .syntax unified;                                                             \
+-  DEFINE_COMPILERRT_THUMB_FUNCTION(__sync_fetch_and_##op)                      \
++  DEFINE_COMPILERRT_FUNCTION(__sync_fetch_and_##op)                            \
+   push {r4, r5, r6, lr};                                                       \
+   DMB;                                                                         \
+   mov r12, r0;                                                                 \
+

pkgs/development/compilers/llvm/git/clang/default.nix

···
 
     cmakeFlags = [
       "-DCLANG_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/cmake/clang"
-      "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
     ] ++ lib.optionals enableManpages [

pkgs/development/compilers/llvm/git/compiler-rt/default.nix

···
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
-    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
     "-DCOMPILER_RT_BUILD_MEMPROF=OFF"
     "-DCOMPILER_RT_BUILD_ORC=OFF" # may be possible to build with musl if necessary
+  ] ++ lib.optionals (useLLVM || bareMetal) [
+    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals ((useLLVM && !haveLibc) || bareMetal) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
     "-DCMAKE_CXX_COMPILER_WORKS=ON"

pkgs/development/compilers/llvm/git/default.nix

···
 { lowPrio, newScope, pkgs, lib, stdenv, cmake, ninja
 , gccForLibs, preLibcCrossHeaders
-, libxml2, python3, isl, fetchFromGitHub, overrideCC, wrapCCWith, wrapBintoolsWith
+, libxml2, python3, fetchFromGitHub, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 # This is the default binutils, but with *this* version of LLD rather
···
   };
 
   tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake ninja libxml2 python3 isl release_version version monorepoSrc buildLlvmTools; });
+    callPackage = newScope (tools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc buildLlvmTools; });
     mkExtraBuildCommands0 = cc: ''
       rsrc="$out/resource-root"
       mkdir "$rsrc"
···
   });
 
   libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake ninja libxml2 python3 isl release_version version monorepoSrc; });
+    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc; });
   in {
 
     compiler-rt-libc = callPackage ./compiler-rt {
···
 
     libcxxStdenv = overrideCC stdenv buildLlvmTools.libcxxClang;
 
-    libcxx = callPackage ./libcxx {
-      inherit llvm_meta;
-      stdenv = if stdenv.hostPlatform.useLLVM or false
-               then overrideCC stdenv buildLlvmTools.clangNoLibcxx
-               else stdenv;
-    };
-
     libcxxabi = let
-      stdenv_ = if stdenv.hostPlatform.useLLVM or false
-               then overrideCC stdenv buildLlvmTools.clangNoLibcxx
-               else stdenv;
+      # CMake will "require" a compiler capable of compiling C++ programs
+      # cxx-header's build does not actually use one so it doesn't really matter
+      # what stdenv we use here, as long as CMake is happy.
       cxx-headers = callPackage ./libcxx {
         inherit llvm_meta;
-        stdenv = stdenv_;
         headersOnly = true;
       };
+
+      # `libcxxabi` *doesn't* need a compiler with a working C++ stdlib but it
+      # *does* need a relatively modern C++ compiler (see:
+      # https://releases.llvm.org/15.0.0/projects/libcxx/docs/index.html#platform-and-compiler-support).
+      #
+      # So, we use the clang from this LLVM package set, like libc++
+      # "boostrapping builds" do:
+      # https://releases.llvm.org/15.0.0/projects/libcxx/docs/BuildingLibcxx.html#bootstrapping-build
+      #
+      # We cannot use `clangNoLibcxx` because that contains `compiler-rt` which,
+      # on macOS, depends on `libcxxabi`, thus forming a cycle.
+      stdenv_ = overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc;
     in callPackage ./libcxxabi {
       stdenv = stdenv_;
       inherit llvm_meta cxx-headers;
+    };
+
+    # Like `libcxxabi` above, `libcxx` requires a fairly modern C++ compiler,
+    # so: we use the clang from this LLVM package set instead of the regular
+    # stdenv's compiler.
+    libcxx = callPackage ./libcxx {
+      inherit llvm_meta;
+      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
     };
 
     libunwind = callPackage ./libunwind {

pkgs/development/compilers/llvm/git/libcxxabi/default.nix

···
   cmakeFlags = [
     "-DLLVM_ENABLE_RUNTIMES=libcxxabi"
     "-DLIBCXXABI_LIBCXX_INCLUDES=${cxx-headers}/include/c++/v1"
+
+    # `libcxxabi`'s build does not need a toolchain with a c++ stdlib attached
+    # (we specify the headers it should use explicitly above).
+    #
+    # CMake however checks for this anyways; this flag tells it not to. See:
+    # https://github.com/llvm/llvm-project/blob/4bd3f3759259548e159aeba5c76efb9a0864e6fa/llvm/runtimes/CMakeLists.txt#L243
+    "-DCMAKE_CXX_COMPILER_WORKS=ON"
   ] ++ lib.optionals (stdenv.hostPlatform.useLLVM or false) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"

pkgs/development/compilers/llvm/git/llvm/default.nix

···
 , which
 , buildLlvmTools
 , debugVersion ? false
+, doCheck ? stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 , enablePFM ? !(stdenv.isDarwin
   || stdenv.isAarch64 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
   || stdenv.isAarch32 # broken for the armv7l builder
 )
-, enablePolly ? false
+, enablePolly ? true
 } @args:
 
 let
···
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitString "." release_version));
 
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
+
 in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
···
     cp -r ${monorepoSrc}/${pname} "$out"
     cp -r ${monorepoSrc}/third-party "$out"
   '' + lib.optionalString enablePolly ''
-    cp -r ${monorepoSrc}/polly "$out/llvm/tools"
+    chmod u+w "$out/${pname}/tools"
+    cp -r ${monorepoSrc}/polly "$out/${pname}/tools"
   '');
 
   sourceRoot = "${src.name}/${pname}";
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake ninja python3 ]
+  nativeBuildInputs = [ cmake ninja python ]
     ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
 
   buildInputs = [ libxml2 libffi ]
···
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 

pkgs/development/compilers/llvm/git/llvm/gnu-install-dirs-polly.patch

···
-diff --git a/tools/polly/CMakeLists.txt b/tools/polly/CMakeLists.txt
-index ca7c04c565bb..6a6155806ffa 100644
---- a/tools/polly/CMakeLists.txt
-+++ b/tools/polly/CMakeLists.txt
-@@ -3,6 +3,8 @@ if (NOT DEFINED LLVM_MAIN_SRC_DIR)
-   project(Polly)
-   cmake_minimum_required(VERSION 3.13.4)
- 
-+  include(GNUInstallDirs)
-+
-   # Where is LLVM installed?
-   find_package(LLVM CONFIG REQUIRED)
-   set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} ${LLVM_CMAKE_DIR})
-@@ -122,13 +124,13 @@ include_directories(
- 
- if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
-   install(DIRECTORY include/
--    DESTINATION include
-+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
-     FILES_MATCHING
-     PATTERN "*.h"
-     )
- 
-   install(DIRECTORY ${POLLY_BINARY_DIR}/include/
--    DESTINATION include
-+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
-     FILES_MATCHING
-     PATTERN "*.h"
-     PATTERN "CMakeFiles" EXCLUDE
-diff --git a/tools/polly/cmake/CMakeLists.txt b/tools/polly/cmake/CMakeLists.txt
-index 7cc129ba2e90..137be25e4b80 100644
---- a/tools/polly/cmake/CMakeLists.txt
-+++ b/tools/polly/cmake/CMakeLists.txt
-@@ -79,18 +79,18 @@ file(GENERATE
- 
- # Generate PollyConfig.cmake for the install tree.
- unset(POLLY_EXPORTS)
--set(POLLY_INSTALL_PREFIX "${CMAKE_INSTALL_PREFIX}")
-+set(POLLY_INSTALL_PREFIX "")
- set(POLLY_CONFIG_LLVM_CMAKE_DIR "${LLVM_BINARY_DIR}/${LLVM_INSTALL_PACKAGE_DIR}")
--set(POLLY_CONFIG_CMAKE_DIR "${POLLY_INSTALL_PREFIX}/${POLLY_INSTALL_PACKAGE_DIR}")
--set(POLLY_CONFIG_LIBRARY_DIRS "${POLLY_INSTALL_PREFIX}/lib${LLVM_LIBDIR_SUFFIX}")
-+set(POLLY_CONFIG_CMAKE_DIR "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_PREFIX}/${POLLY_INSTALL_PACKAGE_DIR}")
-+set(POLLY_CONFIG_LIBRARY_DIRS "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
- if (POLLY_BUNDLED_ISL)
-   set(POLLY_CONFIG_INCLUDE_DIRS
--    "${POLLY_INSTALL_PREFIX}/include"
--    "${POLLY_INSTALL_PREFIX}/include/polly"
-+    "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_LIBDIR}"
-+    "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_LIBDIR}/polly"
-     )
- else()
-   set(POLLY_CONFIG_INCLUDE_DIRS
--    "${POLLY_INSTALL_PREFIX}/include"
-+    "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_INCLUDEDIR}"
-     ${ISL_INCLUDE_DIRS}
-     )
- endif()
-@@ -100,12 +100,12 @@ endif()
- foreach(tgt IN LISTS POLLY_CONFIG_EXPORTED_TARGETS)
-   get_target_property(tgt_type ${tgt} TYPE)
-   if (tgt_type STREQUAL "EXECUTABLE")
--    set(tgt_prefix "bin/")
-+    set(tgt_prefix "${CMAKE_INSTALL_BINDIR}/")
-   else()
--    set(tgt_prefix "lib/")
-+    set(tgt_prefix "${CMAKE_INSTALL_LIBDIR}/")
-   endif()
- 
--  set(tgt_path "${CMAKE_INSTALL_PREFIX}/${tgt_prefix}$<TARGET_FILE_NAME:${tgt}>")
-+  set(tgt_path "${tgt_prefix}$<TARGET_FILE_NAME:${tgt}>")
-   file(RELATIVE_PATH tgt_path ${POLLY_CONFIG_CMAKE_DIR} ${tgt_path})
- 
-   if (NOT tgt_type STREQUAL "INTERFACE_LIBRARY")
+This is the one remaining Polly install dirs related change that hasn't made it
+into upstream yet; previously this patch file also included:
+https://reviews.llvm.org/D117541
+
 diff --git a/tools/polly/cmake/polly_macros.cmake b/tools/polly/cmake/polly_macros.cmake
 index 518a09b45a42..bd9d6f5542ad 100644
 --- a/tools/polly/cmake/polly_macros.cmake
···
    endif()
    set_property(GLOBAL APPEND PROPERTY LLVM_EXPORTS ${name})
  endmacro(add_polly_library)
-diff --git a/tools/polly/lib/External/CMakeLists.txt b/tools/polly/lib/External/CMakeLists.txt
-index e3a5683fccdc..293b482eb28a 100644
---- a/tools/polly/lib/External/CMakeLists.txt
-+++ b/tools/polly/lib/External/CMakeLists.txt
-@@ -290,7 +290,7 @@ if (POLLY_BUNDLED_ISL)
-     install(DIRECTORY
-       ${ISL_SOURCE_DIR}/include/
-       ${ISL_BINARY_DIR}/include/
--      DESTINATION include/polly
-+      DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/polly
-       FILES_MATCHING
-       PATTERN "*.h"
-       PATTERN "CMakeFiles" EXCLUDE

pkgs/development/compilers/ocaml/generic.nix

···
   #  make[2]: *** [Makefile:199: backup] Error 1
   enableParallelBuilding = lib.versionAtLeast version "4.08";
 
+  # Workaround missing dependencies for install parallelism:
+  #  install: target '...-ocaml-4.14.0/lib/ocaml/threads': No such file or directory
+  #  make[1]: *** [Makefile:140: installopt] Error 1
+  enableParallelInstalling = false;
+
   # Workaround lack of parallelism support among top-level targets:
   # we place nixpkgs-specific targets to a separate file and set
   # sequential order among them as a single rule.

pkgs/development/compilers/openjdk/11.nix

···
-{ stdenv, lib, fetchFromGitHub, bash, pkg-config, autoconf, cpio, file, which, unzip
+{ stdenv, lib, fetchpatch, fetchFromGitHub, bash, pkg-config, autoconf, cpio, file, which, unzip
 , zip, perl, cups, freetype, harfbuzz, alsa-lib, libjpeg, giflib, libpng, zlib, lcms2
 , libX11, libICE, libXrender, libXext, libXt, libXtst, libXi, libXinerama
 , libXcursor, libXrandr, fontconfig, openjdk11-bootstrap
···
 , headless ? false
 , enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
-# Hold back make-4.4 as 4.4.1 breaks the build:
-#   https://github.com/NixOS/nixpkgs/issues/219513
-, gnumake44
 }:
 
 let
···
       sha256 = "sha256-QGOpMIrWwOtIcUY/CLbTRDvcVTG2xioZu46v+n+IIQ4=";
     };
 
-    nativeBuildInputs = [ gnumake44 pkg-config autoconf unzip ];
+    nativeBuildInputs = [ pkg-config autoconf unzip ];
     buildInputs = [
       cpio file which zip perl zlib cups freetype harfbuzz alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
···
       ./currency-date-range-jdk10.patch
       ./increase-javadoc-heap.patch
       ./fix-library-path-jdk11.patch
+
+      # Fix build for gnumake-4.4.1:
+      #   https://github.com/openjdk/jdk/pull/12992
+      (fetchpatch {
+        name = "gnumake-4.4.1";
+        url = "https://github.com/openjdk/jdk/commit/9341d135b855cc208d48e47d30cd90aafa354c36.patch";
+        hash = "sha256-Qcm3ZmGCOYLZcskNjj7DYR85R4v07vYvvavrVOYL8vg=";
+      })
     ] ++ lib.optionals (!headless && enableGnome2) [
       ./swing-use-gtk-jdk10.patch
     ];

pkgs/development/compilers/openjdk/17.nix

···
-{ stdenv, lib, fetchurl, fetchFromGitHub, bash, pkg-config, autoconf, cpio
+{ stdenv, lib, fetchurl, fetchpatch, fetchFromGitHub, bash, pkg-config, autoconf, cpio
 , file, which, unzip, zip, perl, cups, freetype, harfbuzz, alsa-lib, libjpeg, giflib
 , libpng, zlib, lcms2, libX11, libICE, libXrender, libXext, libXt, libXtst
 , libXi, libXinerama, libXcursor, libXrandr, fontconfig, openjdk17-bootstrap
···
 , headless ? false
 , enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
-# Hold back make-4.4 as 4.4.1 breaks the build:
-#   https://github.com/NixOS/nixpkgs/issues/219513
-, gnumake44
 }:
 
 let
···
       sha256 = "sha256-zPpINi++3Ct0PCwlwlfhceh/ploMkclw+MgeI9dULdc=";
     };
 
-    nativeBuildInputs = [ gnumake44 pkg-config autoconf unzip ];
+    nativeBuildInputs = [ pkg-config autoconf unzip ];
     buildInputs = [
       cpio file which zip perl zlib cups freetype harfbuzz alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
···
       (fetchurl {
         url = "https://git.alpinelinux.org/aports/plain/community/openjdk17/FixNullPtrCast.patch?id=41e78a067953e0b13d062d632bae6c4f8028d91c";
         sha256 = "sha256-LzmSew51+DyqqGyyMw2fbXeBluCiCYsS1nCjt9hX6zo=";
+      })
+
+      # Fix build for gnumake-4.4.1:
+      #   https://github.com/openjdk/jdk/pull/12992
+      (fetchpatch {
+        name = "gnumake-4.4.1";
+        url = "https://github.com/openjdk/jdk/commit/9341d135b855cc208d48e47d30cd90aafa354c36.patch";
+        hash = "sha256-Qcm3ZmGCOYLZcskNjj7DYR85R4v07vYvvavrVOYL8vg=";
       })
     ] ++ lib.optionals (!headless && enableGnome2) [
       ./swing-use-gtk-jdk13.patch

pkgs/development/compilers/openjdk/19.nix

···
 , headless ? stdenv.targetPlatform.isGhcjs
 , enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
-# Hold back make-4.4 as 4.4.1 breaks the build:
-#   https://github.com/NixOS/nixpkgs/issues/219513
-, gnumake44
 }:
 
 let
···
       hash = "sha256-pBEHmBtIgG4Czou4C/zpBBYZEDImvXiLoA5CjOzpeyI=";
     };
 
-    nativeBuildInputs = [ gnumake44 pkg-config autoconf unzip ensureNewerSourcesForZipFilesHook ];
+    nativeBuildInputs = [ pkg-config autoconf unzip ensureNewerSourcesForZipFilesHook ];
     buildInputs = [
       cpio file which zip perl zlib cups freetype alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
···
       (fetchpatch {
         url = "https://git.alpinelinux.org/aports/plain/testing/openjdk19/FixNullPtrCast.patch?id=93dc07f97ff716b647c5f57c6224901ea06da560";
         hash = "sha256-H4X3Yip5bCpXMH7MSu9BgXIOYRVUBMZPZW8EvZSWI5k=";
+      })
+
+      # Fix build for gnumake-4.4.1:
+      #   https://github.com/openjdk/jdk/pull/12992
+      (fetchpatch {
+        name = "gnumake-4.4.1";
+        url = "https://github.com/openjdk/jdk/commit/9341d135b855cc208d48e47d30cd90aafa354c36.patch";
+        hash = "sha256-Qcm3ZmGCOYLZcskNjj7DYR85R4v07vYvvavrVOYL8vg=";
       })
     ] ++ lib.optionals (!headless && enableGnome2) [
       ./swing-use-gtk-jdk13.patch

pkgs/development/compilers/rust/cargo-auditable.nix

···
-{ lib, fetchFromGitHub, makeRustPlatform, rustc, cargo }:
+{ lib, fetchFromGitHub, makeRustPlatform, rustc, cargo, installShellFiles }:
 
 let
   args = rec {
     pname = "cargo-auditable";
-    version = "0.6.0";
+    version = "0.6.1";
 
     src = fetchFromGitHub {
       owner = "rust-secure-code";
       repo = pname;
       rev = "v${version}";
-      sha256 = "sha256-mSiEC+9QtRjWmywJnGgUqp+q8fhY0qUYrgjrAVaY114=";
+      sha256 = "sha256-MKMPLv8jeST0l4tq+MMPC18qfZMmBixdj6Ng19YKepU=";
     };
 
-    cargoSha256 = "sha256-Wz5My/QxPpZVsPBUe3KHT3ttD6CTU8NCY8rhFEC+UlA=";
+    cargoSha256 = "sha256-6/f7pNaTL+U6bI6jMakU/lfwYYxN/EM3WkKZcydsyLk=";
+
+    # Cargo.lock is outdated
+    preConfigure = ''
+      cargo update --offline
+    '';
 
     meta = with lib; {
       description = "A tool to make production Rust binaries auditable";
···
 
 rustPlatform.buildRustPackage.override { cargo-auditable = bootstrap; } (args // {
   auditable = true; # TODO: remove when this is the default
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  postInstall = ''
+    installManPage cargo-auditable/cargo-auditable.1
+  '';
 })

pkgs/development/interpreters/ruby/default.nix

···
 , fetchurl, fetchpatch, fetchFromSavannah, fetchFromGitHub
 , zlib, gdbm, ncurses, readline, groff, libyaml, libffi, jemalloc, autoreconfHook, bison
 , autoconf, libiconv, libobjc, libunwind, Foundation
-, buildEnv, bundler, bundix
+, buildEnv, bundler, bundix, rustPlatform
 , makeBinaryWrapper, buildRubyGem, defaultGemConfig, removeReferencesTo
 , openssl, openssl_1_1
+, linuxPackages, libsystemtap
 } @ args:
 
 let
   op = lib.optional;
   ops = lib.optionals;
   opString = lib.optionalString;
-  patchSet = import ./rvm-patchsets.nix { inherit fetchFromGitHub; };
   config = import ./config.nix { inherit fetchFromSavannah; };
   rubygems = import ./rubygems { inherit stdenv lib fetchurl; };
 
   # Contains the ruby version heuristics
   rubyVersion = import ./ruby-version.nix { inherit lib; };
 
-  generic = { version, sha256 }: let
+  generic = { version, sha256, cargoSha256 ? null }: let
     ver = version;
     atLeast30 = lib.versionAtLeast ver.majMin "3.0";
+    atLeast31 = lib.versionAtLeast ver.majMin "3.1";
+    atLeast32 = lib.versionAtLeast ver.majMin "3.2";
     self = lib.makeOverridable (
       { stdenv, buildPackages, lib
       , fetchurl, fetchpatch, fetchFromSavannah, fetchFromGitHub
-      , useRailsExpress ? true
       , rubygemsSupport ? true
       , zlib, zlibSupport ? true
       , openssl, openssl_1_1, opensslSupport ? true
···
       , libyaml, yamlSupport ? true
       , libffi, fiddleSupport ? true
       , jemalloc, jemallocSupport ? false
+      , linuxPackages, systemtap ? linuxPackages.systemtap, libsystemtap, dtraceSupport ? false
       # By default, ruby has 3 observed references to stdenv.cc:
       #
       # - If you run:
···
       #   Or (usually):
       #     $(nix-build -A ruby)/lib/ruby/2.6.0/x86_64-linux/rbconfig.rb
       # - In $out/lib/libruby.so and/or $out/lib/libruby.dylib
-      , removeReferencesTo, jitSupport ? false
+      , removeReferencesTo, jitSupport ? yjitSupport
+      , rustPlatform, yjitSupport ? atLeast32
       , autoreconfHook, bison, autoconf
       , buildEnv, bundler, bundix
       , libiconv, libobjc, libunwind, Foundation
       , makeBinaryWrapper, buildRubyGem, defaultGemConfig
       , baseRuby ? buildPackages.ruby_3_1.override {
-          useRailsExpress = false;
           docSupport = false;
           rubygemsSupport = false;
         }
-      , useBaseRuby ? stdenv.hostPlatform != stdenv.buildPlatform || useRailsExpress
+      , useBaseRuby ? stdenv.hostPlatform != stdenv.buildPlatform
       }:
       stdenv.mkDerivation rec {
         pname = "ruby";
···
 
         outputs = [ "out" ] ++ lib.optional docSupport "devdoc";
 
+        strictDeps = true;
+
         nativeBuildInputs = [ autoreconfHook bison ]
           ++ (op docSupport groff)
+          ++ (ops (dtraceSupport && stdenv.isLinux) [ systemtap libsystemtap ])
+          ++ ops yjitSupport [ rustPlatform.cargoSetupHook rustPlatform.rust.cargo rustPlatform.rust.rustc ]
           ++ op useBaseRuby baseRuby;
         buildInputs = [ autoconf ]
           ++ (op fiddleSupport libffi)
···
         propagatedBuildInputs = op jemallocSupport jemalloc;
 
         enableParallelBuilding = true;
+        # /build/ruby-2.7.7/lib/fileutils.rb:882:in `chmod':
+        #   No such file or directory @ apply2files - ...-ruby-2.7.7-devdoc/share/ri/2.7.0/system/ARGF/inspect-i.ri (Errno::ENOENT)
+        # make: *** [uncommon.mk:373: do-install-all] Error 1
+        enableParallelInstalling = false;
 
-        patches =
-          (import ./patchsets.nix {
-            inherit patchSet useRailsExpress ops fetchpatch;
-            patchLevel = ver.patchLevel;
-          }).${ver.majMinTiny}
-          ++ op (lib.versionOlder ver.majMin "3.1") ./do-not-regenerate-revision.h.patch
-          ++ op (atLeast30 && useBaseRuby) ./do-not-update-gems-baseruby.patch
+        patches = op (lib.versionOlder ver.majMin "3.1") ./do-not-regenerate-revision.h.patch
+          ++ op (atLeast30 && useBaseRuby) (
+            if atLeast32 then ./do-not-update-gems-baseruby-3.2.patch
+            else ./do-not-update-gems-baseruby.patch
+          )
           ++ ops (ver.majMin == "3.0") [
             # Ruby 3.0 adds `-fdeclspec` to $CC instead of $CFLAGS. Fixed in later versions.
             (fetchpatch {
···
               sha256 = "sha256-43hI9L6bXfeujgmgKFVmiWhg7OXvshPCCtQ4TxqK1zk=";
             })
           ]
+          ++ ops (ver.majMin == "3.1") [
+            # Ruby 3.1.3 cannot find pkg-config in mkmf.rb
+            # https://bugs.ruby-lang.org/issues/19189
+            (fetchpatch {
+              url = "https://github.com/ruby/ruby/commit/613fca01486e47dee9364a2fd86b5f5e77fe23c8.patch";
+              sha256 = "sha256-0Ku7l6VEpcvxexL9QA5+mNER4v8gYZOJhAjhCL1WDpw=";
+            })
+          ]
           ++ ops (!atLeast30 && rubygemsSupport) [
             # We upgrade rubygems to a version that isn't compatible with the
             # ruby 2.7 installer. Backport the upstream fix.
···
               url = "https://github.com/ruby/ruby/commit/261d8dd20afd26feb05f00a560abd99227269c1c.patch";
               sha256 = "0wrii25cxcz2v8bgkrf7ibcanjlxwclzhayin578bf0qydxdm9qy";
             })
+          ]
+          ++ ops atLeast31 [
+            # When using a baseruby, ruby always sets "libdir" to the build
+            # directory, which nix rejects due to a reference in to /build/ in
+            # the final product. Removing this reference doesn't seem to break
+            # anything and fixes cross compliation.
+            ./dont-refer-to-build-dir.patch
           ];
 
+        cargoRoot = opString yjitSupport "yjit";
+
+        cargoDeps = if yjitSupport then rustPlatform.fetchCargoTarball {
+          inherit src;
+          sourceRoot = "${pname}-${version}/${cargoRoot}";
+          sha256 = cargoSha256;
+        } else null;
+
         postUnpack = opString rubygemsSupport ''
           rm -rf $sourceRoot/{lib,test}/rubygems*
           cp -r ${rubygems}/lib/rubygems* $sourceRoot/lib
···
           (lib.enableFeature true "pthread")
           (lib.withFeatureAs true "soname" "ruby-${version}")
           (lib.withFeatureAs useBaseRuby "baseruby" "${baseRuby}/bin/ruby")
+          (lib.enableFeature dtraceSupport "dtrace")
           (lib.enableFeature jitSupport "jit-support")
+          (lib.enableFeature yjitSupport "yjit")
           (lib.enableFeature docSupport "install-doc")
           (lib.withFeature jemallocSupport "jemalloc")
           (lib.withFeatureAs docSupport "ridir" "${placeholder "devdoc"}/share/ri")
···
           for makefile in $extMakefiles; do
             make -C "$(dirname "$makefile")" distclean
           done
-          find "$out/${passthru.gemPath}" -name gem_make.out -delete
+          find "$out/${passthru.gemPath}" \( -name gem_make.out -o -name mkmf.log \) -delete
           # Bundler tries to create this directory
           mkdir -p $out/nix-support
           cat > $out/nix-support/setup-hook <<EOF
···
             ruby = self;
           };
 
+          inherit rubygems;
           inherit (import ../../ruby-modules/with-packages {
             inherit lib stdenv makeBinaryWrapper buildRubyGem buildEnv;
             gemConfig = defaultGemConfig;
···
   };
 
   ruby_3_1 = generic {
-    version = rubyVersion "3" "1" "2" "";
-    sha256 = "0gm84ipk6mrfw94852w5h7xxk2lqrxjbnlwb88svf0lz70933131";
+    version = rubyVersion "3" "1" "3" "";
+    sha256 = "sha256-XqSYo19M0Vh1IApS3eQrbrF54SZOF9eHMsOlfNHGq54=";
+  };
+
+  ruby_3_2 = generic {
+    version = rubyVersion "3" "2" "1" "";
+    sha256 = "sha256-E9Z5AWYO4yF9vZ3VYFk0a9QhLOZKacMG71LfZJNfjb0=";
+    cargoSha256 = "sha256-6du7RJo0DH+eYMOoh3L31F3aqfR5+iG1iKauSV1uNcQ=";
   };
 }

pkgs/development/interpreters/ruby/do-not-update-gems-baseruby-3.2.patch

···
+diff --git a/common.mk b/common.mk
+index 3798f82bc6..4d07b28aa4 100644
+--- a/common.mk
++++ b/common.mk
+@@ -1374,7 +1374,7 @@ update-config_files: PHONY
+ 	    config.guess config.sub
+ 
+ refresh-gems: update-bundled_gems prepare-gems
+-prepare-gems: $(HAVE_BASERUBY:yes=update-gems) $(HAVE_BASERUBY:yes=extract-gems)
++prepare-gems:
+ extract-gems: $(HAVE_BASERUBY:yes=update-gems)
+ 
+ update-gems$(gnumake:yes=-sequential): PHONY

pkgs/development/interpreters/ruby/dont-refer-to-build-dir.patch

···
+diff --git a/tool/fake.rb b/tool/fake.rb
+index 91dfb041c4..9c235f1e3a 100644
+--- a/tool/fake.rb
++++ b/tool/fake.rb
+@@ -48,7 +48,6 @@ class File
+   $builtruby ||= File.join(builddir, config['RUBY_INSTALL_NAME'] + config['EXEEXT'])
+   RbConfig.fire_update!("builddir", builddir)
+   RbConfig.fire_update!("buildlibdir", builddir)
+-  RbConfig.fire_update!("libdir", builddir)
+   RbConfig.fire_update!("prefix", $topdir)
+   RbConfig.fire_update!("top_srcdir", $top_srcdir ||= top_srcdir)
+   RbConfig.fire_update!("extout", $extout)

pkgs/development/interpreters/ruby/patchsets.nix

···
-{ patchSet, useRailsExpress, ops, patchLevel, fetchpatch }:
-
-{
-  "2.7.7" = ops useRailsExpress [
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/01-fix-broken-tests-caused-by-ad.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/02-improve-gc-stats.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/03-more-detailed-stacktrace.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/04-malloc-trim.patch"
-  ];
-  "3.0.5" = ops useRailsExpress [
-    "${patchSet}/patches/ruby/3.0/head/railsexpress/01-improve-gc-stats.patch"
-    "${patchSet}/patches/ruby/3.0/head/railsexpress/02-malloc-trim.patch"
-  ];
-  "3.1.2" = ops useRailsExpress [
-    "${patchSet}/patches/ruby/3.1/head/railsexpress/01-improve-gc-stats.patch"
-    "${patchSet}/patches/ruby/3.1/head/railsexpress/02-malloc-trim.patch"
-  ];
-}

pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch

···
    extend Gem::Deprecate
  
    DEFAULT_OPTIONS = { # :nodoc:
--    :env_shebang         => false,
-+    :env_shebang         => true,
-     :document            => %w[ri],
-     :domain              => :both, # HACK dup
-     :force               => false,
+-    :env_shebang => false,
++    :env_shebang => true,
+     :document => %w[ri],
+     :domain => :both, # HACK dup
+     :force => false,
 -- 
 2.21.0
 

pkgs/development/interpreters/ruby/rubygems/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.3.20";
+  version = "3.4.8";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    sha256 = "sha256-VTUMZ2mqbszM7uXOYV6Grg7dkeGAGVXYjBX0hA/vOTg=";
+    sha256 = "sha256-0FlDZJNJJGVkvBmKWNBqNRaTto6ciCOuQEK6uq6dotQ=";
   };
 
   patches = [
···
 
   meta = with lib; {
     description = "Package management framework for Ruby";
+    changelog = "https://github.com/rubygems/rubygems/blob/v${version}/CHANGELOG.md";
     homepage = "https://rubygems.org/";
     license = with licenses; [ mit /* or */ ruby ];
     maintainers = with maintainers; [ zimbatm ];

pkgs/development/interpreters/ruby/rvm-patchsets.nix

···
-{ fetchFromGitHub }:
-
-fetchFromGitHub {
-  owner  = "skaes";
-  repo   = "rvm-patchsets";
-  rev    = "e6574c54a34fe6e4d45aa1433872a22ddfe14cf3";
-  hash   = "sha256-x2KvhgRVJ4Nc5v1j4DggKO1u3otG8HVMxhq4yuUKnds=";
-}

pkgs/development/interpreters/s9fes/default.nix

···
   buildInputs = [ ncurses ];
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" "PREFIX=$(out)" ];
   enableParallelBuilding = true;
+  # ...-bash-5.2-p15/bin/bash: line 1: ...-s9fes-20181205/bin/s9help: No such file or directory
+  # make: *** [Makefile:157: install-util] Error 1
+  enableParallelInstalling = false;
 
   meta = with lib; {
     description = "Scheme 9 From Empty Space, an interpreter for R4RS Scheme";

pkgs/development/libraries/SDL2/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "SDL2";
-  version = "2.26.3";
+  version = "2.26.4";
 
   src = fetchurl {
     url = "https://www.libsdl.org/release/${pname}-${version}.tar.gz";
-    sha256 = "sha256-xmEgWlU7fSUkJfS3Uf8TIJ5eAguHa7+hWYSUr2F5AFc=";
+    sha256 = "sha256-Gg9oZJj7dorZ8/gLOQN6fQBurAk6rTnLTrzIMqiIcjE=";
   };
   dontDisableStatic = if withStatic then 1 else 0;
   outputs = [ "out" "dev" ];
···
     homepage = "http://www.libsdl.org/";
     license = licenses.zlib;
     platforms = platforms.all;
-    maintainers = with maintainers; [ cpages ];
+    maintainers = with maintainers; [ cpages superherointj ];
   };
 }

pkgs/development/libraries/audio/libopenmpt/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.6.8";
+  version = "0.6.9";
 
   outputs = [ "out" "dev" "bin" ];
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "HGGLPf8afLaiT0MXVZIPokN1YmgTj/ox09t8YHwsLWk=";
+    sha256 = "R56XWrt9wPqcrUG90x8lXXjUPgcmVGIIBY08P897blo=";
   };
 
   enableParallelBuilding = true;

pkgs/development/libraries/directx-headers/default.nix

···
 { lib, stdenv, fetchFromGitHub, meson, ninja }:
 stdenv.mkDerivation rec {
   pname = "directx-headers";
-  version = "1.608.2";
+  version = "1.608.2b";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "DirectX-Headers";
     rev = "v${version}";
-    hash = "sha256-F0riTDJpydqe4yhE9GKSSvnRI0Sl3oY2sOP+H/vDHG0=";
+    hash = "sha256-o4p8L2VKvMHdu1L2I1JI6pwIRtnyVCoKebg9yKTk1T8=";
   };
 
   nativeBuildInputs = [ meson ninja ];

pkgs/development/libraries/fftw/default.nix

···
 , perl
 , llvmPackages
 , precision ? "double"
-, enableAvx ? stdenv.hostPlatform.avxSupport
-, enableAvx2 ? stdenv.hostPlatform.avx2Support
-, enableAvx512 ? stdenv.hostPlatform.avx512Support
-, enableFma ? stdenv.hostPlatform.fmaSupport
 , enableMpi ? false
 , mpi
 , withDoc ? stdenv.cc.isGNU
···
     llvmPackages.openmp
   ] ++ lib.optional enableMpi mpi;
 
-  configureFlags =
-    [ "--enable-shared"
-      "--enable-threads"
-    ]
-    ++ lib.optional (precision != "double") "--enable-${precision}"
-    # all x86_64 have sse2
-    # however, not all float sizes fit
-    ++ lib.optional (stdenv.isx86_64 && (precision == "single" || precision == "double") )  "--enable-sse2"
-    ++ lib.optional enableAvx "--enable-avx"
-    ++ lib.optional enableAvx2 "--enable-avx2"
-    ++ lib.optional enableAvx512 "--enable-avx512"
-    ++ lib.optional enableFma "--enable-fma"
-    ++ [ "--enable-openmp" ]
-    ++ lib.optional enableMpi "--enable-mpi"
-    # doc generation causes Fortran wrapper generation which hard-codes gcc
-    ++ lib.optional (!withDoc) "--disable-doc";
+  configureFlags = [
+    "--enable-shared"
+    "--enable-threads"
+    "--enable-openmp"
+  ]
+
+  ++ lib.optional (precision != "double") "--enable-${precision}"
+  # https://www.fftw.org/fftw3_doc/SIMD-alignment-and-fftw_005fmalloc.html
+  # FFTW will try to detect at runtime whether the CPU supports these extensions
+  ++ lib.optional (stdenv.isx86_64 && (precision == "single" || precision == "double"))
+    "--enable-sse2 --enable-avx --enable-avx2 --enable-avx512 --enable-avx128-fma"
+  ++ lib.optional enableMpi "--enable-mpi"
+  # doc generation causes Fortran wrapper generation which hard-codes gcc
+  ++ lib.optional (!withDoc) "--disable-doc";
+
+  # fftw builds with -mtune=native by default
+  postPatch = ''
+    substituteInPlace configure --replace "-mtune=native" "-mtune=generic"
+  '';
 
   enableParallelBuilding = true;
 

pkgs/development/libraries/gtk/2.x.nix

···
   '' else null;
 
   configureFlags = [
+    "--sysconfdir=/etc"
     "--with-gdktarget=${gdktarget}"
     "--with-xinput=yes"
   ] ++ lib.optionals stdenv.isDarwin [
···
   ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "ac_cv_path_GTK_UPDATE_ICON_CACHE=${buildPackages.gtk2}/bin/gtk-update-icon-cache"
     "ac_cv_path_GDK_PIXBUF_CSOURCE=${buildPackages.gdk-pixbuf.dev}/bin/gdk-pixbuf-csource"
+  ];
+
+  installFlags = [
+    "sysconfdir=${placeholder "out"}/etc"
   ];
 
   doCheck = false; # needs X11

pkgs/development/libraries/lcms2/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "lcms2";
-  version = "2.13.1";
+  version = "2.15";
 
   src = fetchurl {
     url = "mirror://sourceforge/lcms/${pname}-${version}.tar.gz";
-    sha256 = "sha256-1HPnlueyfFrwG9bRVS1CtFtDRX5xgs6ZA/OLt0ggO4g=";
+    sha256 = "sha256-sgy8vQ9QNDO+Kk6BRiEG+mEFCjUHTcJKTjVnktlxqzk=";
   };
 
   outputs = [ "bin" "dev" "out" ];

pkgs/development/libraries/libedit/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libedit";
-  version = "20210910-3.1";
+  version = "20221030-3.1";
 
   src = fetchurl {
     url = "https://thrysoee.dk/editline/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Z5KmqZIFB2LtzKKP8zGM233jfcz3vDDbWfzXAX7tE8U=";
+    sha256 = "sha256-8JJaWt9LG/EW7hl2a32qdmkXrsGYdHlDscTt9npL4rs=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/libextractor/default.nix

···
 # '';
 # See also <https://nixos.org/nixpkgs/manual/#sec-language-gnome>.
 , gtkSupport ? true, glib, gtk3
-, videoSupport ? true, ffmpeg, libmpeg2
+, videoSupport ? true, ffmpeg_4, libmpeg2
 }:
 
 stdenv.mkDerivation rec {
···
    ] ++ lib.optionals gstreamerSupport
           ([ gst_all_1.gstreamer ] ++ gstPlugins gst_all_1)
      ++ lib.optionals gtkSupport [ glib gtk3 ]
-     ++ lib.optionals videoSupport [ ffmpeg libmpeg2 ];
+     ++ lib.optionals videoSupport [ ffmpeg_4 libmpeg2 ];
 
   configureFlags = [
     "--disable-ltdl-install"

pkgs/development/libraries/libimagequant/Cargo.lock

···
 
 [[package]]
 name = "ahash"
-version = "0.7.6"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
+checksum = "2c99f64d1e06488f620f932677e24bc6e2897582980441ae90a671415bd7ec2f"
 dependencies = [
- "getrandom",
+ "cfg-if",
  "once_cell",
  "version_check",
 ]
···
 
 [[package]]
 name = "bytemuck"
-version = "1.13.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c041d3eab048880cb0b86b256447da3f18859a163c3b8d8893f4e6368abe6393"
+checksum = "17febce684fd15d89027105661fec94afb475cb995fbc59d2865198446ba2eea"
 
 [[package]]
 name = "c_test"
···
 
 [[package]]
 name = "cc"
-version = "1.0.78"
+version = "1.0.79"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a20104e2335ce8a659d6dd92a51a767a0c062599c73b343fd152cb401e828c3d"
+checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
 
 [[package]]
 name = "cfg-if"
···
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.6"
+version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2dd04ddaf88237dc3b8d8f9a3c1004b506b54b3313403944054d23c0870c521"
+checksum = "cf2b3e8478797446514c91ef04bafcb59faba183e621ad488df88983cc14128c"
 dependencies = [
  "cfg-if",
  "crossbeam-utils",
···
 
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "715e8152b692bba2d374b53d4875445368fdf21a94751410af607a5ac677d1fc"
+checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef"
 dependencies = [
  "cfg-if",
  "crossbeam-epoch",
···
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.13"
+version = "0.9.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01a9af1f4c2ef74bb8aa1f7e19706bc72d03598c8a570bb5de72243c7a9d9d5a"
+checksum = "46bd5f3f85273295a9d14aedfb86f6aadbff6d8f5295c4a9edb08e819dcf5695"
 dependencies = [
  "autocfg",
  "cfg-if",
···
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.14"
+version = "0.8.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fb766fa798726286dbbb842f174001dab8abc7b627a1dd86e0b7222a95d929f"
+checksum = "3c063cd8cc95f5c377ed0d4b49a4b21f632396ff690e8470c29b3359b346984b"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "either"
-version = "1.8.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90e5c1c8368803113bf0c9584fc495a58b86dc8a29edbf8fe877d21d9507e797"
+checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
 
 [[package]]
 name = "fallible_collections"
-version = "0.4.6"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f57ccc32870366ae684be48b32a1a2e196f98a42a9b4361fe77e13fd4a34755"
+checksum = "9acf77205554f3cfeca94a4b910e159ad9824e8c2d164de02b3f12495cc1074d"
 dependencies = [
  "hashbrown",
 ]
···
 ]
 
 [[package]]
-name = "getrandom"
-version = "0.2.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c05aeb6a22b8f62540c194aac980f2115af067bfe15a0734d7277a768d396b31"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi",
-]
-
-[[package]]
 name = "hashbrown"
-version = "0.12.3"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+checksum = "43a3c133739dddd0d2990f9a4bdf8eb4b21ef50e4851ca85ab661199821d510e"
 dependencies = [
  "ahash",
 ]
···
 
 [[package]]
 name = "imagequant"
-version = "4.1.0"
+version = "4.1.1"
 dependencies = [
  "arrayvec",
  "lodepng",
···
 
 [[package]]
 name = "libc"
-version = "0.2.139"
+version = "0.2.140"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "201de327520df007757c1f0adce6e827fe8562fbc28bfd9c15571c66ca1f5f79"
+checksum = "99227334921fae1a979cf0bfdfcc6b3e5ce376ef57e16fb6fb3ea2ed6095f80c"
 
 [[package]]
 name = "lodepng"
···
 
 [[package]]
 name = "memoffset"
-version = "0.7.1"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
+checksum = "d61c719bcfbcf5d62b3a09efa6088de8c54bc0bfcd3ea7ae39fcc186108b8de1"
 dependencies = [
  "autocfg",
 ]
···
 
 [[package]]
 name = "once_cell"
-version = "1.17.0"
+version = "1.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f61fba1741ea2b3d6a1e3178721804bb716a68a6aeba1149b5d52e3d464ea66"
+checksum = "b7e5500299e16ebb147ae15a00a942af264cf3688f47923b8fc2cd5858f23ad3"
 
 [[package]]
 name = "rayon"
-version = "1.6.1"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db3a213adf02b3bcfd2d3846bb41cb22857d131789e01df434fb7e7bc0759b7"
+checksum = "1d2df5196e37bcc87abebc0053e20787d73847bb33134a69841207dd0a47f03b"
 dependencies = [
  "either",
  "rayon-core",
···
 
 [[package]]
 name = "rayon-core"
-version = "1.10.2"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "356a0625f1954f730c0201cdab48611198dc6ce21f4acff55089b5a78e6e835b"
+checksum = "4b8f95bd6966f5c87776639160a66bd8ab9895d9d4ab01ddba9fc60661aebe8d"
 dependencies = [
  "crossbeam-channel",
  "crossbeam-deque",
···
 
 [[package]]
 name = "rgb"
-version = "0.8.34"
+version = "0.8.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3603b7d71ca82644f79b5a06d1220e9a58ede60bd32255f698cb1af8838b8db3"
+checksum = "20ec2d3e3fc7a92ced357df9cebd5a10b6fb2aa1ee797bf7e9ce2f17dffc8f59"
 dependencies = [
  "bytemuck",
 ]
···
 
 [[package]]
 name = "thread_local"
-version = "1.1.4"
+version = "1.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5516c27b78311c50bf42c071425c560ac799b11c30b31f87e3081965fe5e0180"
+checksum = "3fdd6f064ccff2d6567adcb3873ca630700f00b5ad3f060c25b5dcfd9a4ce152"
 dependencies = [
+ "cfg-if",
  "once_cell",
 ]
 
···
 version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
-
-[[package]]
-name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"

pkgs/development/libraries/libimagequant/default.nix

···
 in
 rustPlatform.buildRustPackage rec {
   pname = "libimagequant";
-  version = "4.1.0";
+  version = "4.1.1";
 
   src = fetchFromGitHub {
     owner = "ImageOptim";
     repo = pname;
     rev = version;
-    hash = "sha256-W9Q81AbFhWUe6c3csAnm8L5wLqURizrjwqcurWhPISI=";
+    hash = "sha256-sCxscs4D2p7LNDpcrKfAc315/NbxbQXtsyc33zUmccM=";
   };
 
   cargoLock = {

pkgs/development/libraries/libmbim/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libmbim";
-  version = "1.28.2";
+  version = "1.28.4";
 
   outputs = [ "out" "dev" "man" ];
 
···
     owner = "mobile-broadband";
     repo = "libmbim";
     rev = version;
-    hash = "sha256-EtjUaSNBT1e/eeTX4oHzQolGrisbsGKBK8Cfl3rRQTQ=";
+    hash = "sha256-aaYjvJ2OMTzkUyqWCyHdmsKJ3VGqBmKQzb1DWK/1cPU=";
   };
 
   mesonFlags = [
···
   meta = with lib; {
     homepage = "https://www.freedesktop.org/wiki/Software/libmbim/";
     description = "Library for talking to WWAN modems and devices which speak the Mobile Interface Broadband Model (MBIM) protocol";
+    changelog = "https://gitlab.freedesktop.org/mobile-broadband/libmbim/-/raw/${version}/NEWS";
     maintainers = teams.freedesktop.members;
     platforms = platforms.linux;
     license = licenses.gpl2Plus;

pkgs/development/libraries/libpcap/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libpcap";
-  version = "1.10.1";
+  version = "1.10.3";
 
   src = fetchurl {
     url = "https://www.tcpdump.org/release/${pname}-${version}.tar.gz";
-    sha256 = "sha256-7ShfSsyvBTRPkJdXV7Pb/ncrpB0cQBwmSLf6RbcRvdQ=";
+    sha256 = "sha256-KoiFxANRbPewkz7UsU1sqjDgIFJInr1BTcdaxS51WeY=";
   };
 
   buildInputs = lib.optionals withRemote [ libxcrypt ];

pkgs/development/libraries/libqtav/default.nix

···
 , libX11
 , libass
 , openal
-, ffmpeg
+, ffmpeg_4
 , libuchardet
 , alsa-lib
 , libpulseaudio
···
     libX11
     libass
     openal
-    ffmpeg
+    ffmpeg_4
     libuchardet
     alsa-lib
     libpulseaudio

pkgs/development/libraries/liburcu/default.nix

···
 { lib, stdenv, fetchurl, perl }:
 
 stdenv.mkDerivation rec {
-  version = "0.13.2";
+  version = "0.14.0";
   pname = "liburcu";
 
   src = fetchurl {
     url = "https://lttng.org/files/urcu/userspace-rcu-${version}.tar.bz2";
-    sha256 = "sha256-EhP9nxsLdNp94rt0M1t2CY25c4/sXTzcB8DFJPNPwDI=";
+    sha256 = "sha256-ykO/Jh1NOSz/IN+uRAg2YDvwCfziT9ybJpfYN6IjnU8=";
   };
 
   nativeCheckInputs = [ perl ];
···
   meta = with lib; {
     description = "Userspace RCU (read-copy-update) library";
     homepage = "https://lttng.org/urcu";
+    changelog = "https://github.com/urcu/userspace-rcu/raw/v${version}/ChangeLog";
     license = licenses.lgpl21Plus;
     platforms = platforms.unix;
     maintainers = [ maintainers.bjornfor ];

pkgs/development/libraries/libwpe/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libwpe";
-  version = "1.14.0";
+  version = "1.14.1";
 
   src = fetchurl {
     url = "https://wpewebkit.org/releases/libwpe-${version}.tar.xz";
-    sha256 = "wHMwW7rF9EAswcikdTv6PWOkCJAfhhggUeqlp13YnAA=";
+    sha256 = "sha256-sdDNzw+Nu0lOZbD3kT41cQbamg1X9Pu3udEjim2+mt4=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/libxcrypt/default.nix

···
   ];
 
   configureFlags = [
-    "--enable-hashes=all"
+    # Update the enabled crypt scheme ids in passthru when the enabled hashes change
+    "--enable-hashes=strong"
     "--enable-obsolete-api=glibc"
     "--disable-failure-tokens"
   ] ++ lib.optionals (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.libc == "bionic") [
···
 
   doCheck = true;
 
-  passthru.tests = {
-    inherit (nixosTests) login shadow;
+  passthru = {
+    tests = {
+      inherit (nixosTests) login shadow;
+    };
+    enabledCryptSchemeIds = [
+      # https://github.com/besser82/libxcrypt/blob/v4.4.33/lib/hashes.conf
+      "y"   # yescrypt
+      "gy"  # gost_yescrypt
+      "7"   # scrypt
+      "2b"  # bcrypt
+      "2y"  # bcrypt_y
+      "2a"  # bcrypt_a
+      "6"   # sha512crypt
+    ];
   };
 
   meta = with lib; {

pkgs/development/libraries/mediastreamer/default.nix

···
 , bzrtp
 , cmake
 , fetchFromGitLab
-, ffmpeg
+, ffmpeg_4
 , glew
 , gsm
 , lib
···
     bzrtp
     ortp
 
-    ffmpeg
+    ffmpeg_4
     glew
     libX11
     libXext

pkgs/development/libraries/mesa/default.nix

···
   if stdenv.isLinux then
     [
       "d3d12" # WSL emulated GPU (aka Dozen)
-      "kmsro" # helper driver for display-only devices
       "nouveau" # Nvidia
       "radeonsi" # new AMD (GCN+)
       "r300" # very old AMD
···
       "svga" # VMWare virtualized GPU
       "virgl" # QEMU virtualized GPU (aka VirGL)
       "zink" # generic OpenGL over Vulkan, experimental
-    ]
-    ++ lib.optionals stdenv.isAarch64 [
+    ] ++ lib.optionals (stdenv.isAarch64 || stdenv.isAarch32) [
       "etnaviv" # Vivante GPU designs (mostly NXP/Marvell SoCs)
       "freedreno" # Qualcomm Adreno (all Qualcomm SoCs)
       "lima" # ARM Mali 4xx
       "panfrost" # ARM Mali Midgard and up (T/G series)
+      "vc4" # Broadcom VC4 (Raspberry Pi 0-3)
+    ] ++ lib.optionals stdenv.isAarch64 [
       "tegra" # Nvidia Tegra SoCs
       "v3d" # Broadcom VC5 (Raspberry Pi 4)
-      "vc4" # Broadcom VC4 (Raspberry Pi 0-3)
     ] ++ lib.optionals stdenv.hostPlatform.isx86 [
       "iris" # new Intel, could work on non-x86 with PCIe cards, but doesn't build as of 22.3.4
       "crocus" # Intel legacy, x86 only

pkgs/development/libraries/ncurses/default.nix

···
   # Only the C compiler, and explicitly not C++ compiler needs this flag on solaris:
   CFLAGS = lib.optionalString stdenv.isSunOS "-D_XOPEN_SOURCE_EXTENDED";
 
+  strictDeps = true;
   depsBuildBuild = [
     buildPackages.stdenv.cc
   ];

pkgs/development/libraries/openhmd/default.nix

···
     license = licenses.boost;
     maintainers = with maintainers; [ oxij ];
     platforms = platforms.unix;
+    broken = true;
   };
 }

pkgs/development/libraries/pangolin/default.nix

···
 { stdenv, lib, fetchFromGitHub, cmake, pkg-config, doxygen, libGL, glew
-, xorg, ffmpeg, libjpeg, libpng, libtiff, eigen
+, xorg, ffmpeg_4, libjpeg, libpng, libtiff, eigen
 , Carbon ? null, Cocoa ? null
 }:
 
···
     libGL
     glew
     xorg.libX11
-    ffmpeg
+    ffmpeg_4
     libjpeg
     libpng
     libtiff

pkgs/development/libraries/pipewire/default.nix

···
 , xorg
 , mysofaSupport ? true
 , libmysofa
+, tinycompress
 }:
 
 let
···
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.66";
+    version = "0.3.67";
 
     outputs = [
       "out"
···
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-qx4mgNRhMdha+8ap+FhVfxpsHE9TcTx29uwQIHLyMHA=";
+      sha256 = "sha256-YM1WOv/SqaGnYevwoFxoOQhF6loFVx/fVPHQY3mpaH0=";
     };
 
     patches = [
···
       vulkan-headers
       vulkan-loader
       webrtc-audio-processing
+      tinycompress
     ] ++ (if enableSystemd then [ systemd ] else [ eudev ])
     ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
     ++ lib.optionals libcameraSupport [ libcamera libdrm ]
···
       "-Dlibmysofa=${mesonEnableFeature mysofaSupport}"
       "-Dsdl2=disabled" # required only to build examples, causes dependency loop
       "-Drlimits-install=false" # installs to /etc, we won't use this anyway
+      "-Dcompress-offload=enabled"
     ];
 
     # Fontconfig error: Cannot load default config file
···
     '';
 
     postInstall = ''
-      mkdir $out/nix-support
-      ${if (stdenv.hostPlatform == stdenv.buildPlatform) then ''
-        pushd $lib/share/pipewire
-        for f in *.conf; do
-          echo "Generating JSON from $f"
-
-          $out/bin/spa-json-dump "$f" > "$out/nix-support/$f.json"
-        done
-        popd
-      '' else ''
-        cp ${buildPackages.pipewire}/nix-support/*.json "$out/nix-support"
-      ''}
-
       ${lib.optionalString enableSystemd ''
         moveToOutput "share/systemd/user/pipewire-pulse.*" "$pulse"
         moveToOutput "lib/systemd/user/pipewire-pulse.*" "$pulse"
···
       moveToOutput "bin/pw-jack" "$jack"
     '';
 
-    passthru = {
-      updateScript = ./update-pipewire.sh;
-      tests = {
-        installedTests = nixosTests.installed-tests.pipewire;
-
-        # This ensures that all the paths used by the NixOS module are found.
-        test-paths = callPackage ./test-paths.nix { package = self; } {
-          paths-out = [
-            "share/alsa/alsa.conf.d/50-pipewire.conf"
-            "nix-support/client-rt.conf.json"
-            "nix-support/client.conf.json"
-            "nix-support/jack.conf.json"
-            "nix-support/minimal.conf.json"
-            "nix-support/pipewire.conf.json"
-            "nix-support/pipewire-aes67.conf.json"
-            "nix-support/pipewire-pulse.conf.json"
-          ];
-          paths-lib = [
-            "lib/alsa-lib/libasound_module_pcm_pipewire.so"
-            "share/alsa-card-profile/mixer"
-          ];
-        };
-      };
-    };
+    passthru.tests = nixosTests.installed-tests.pipewire;
 
     meta = with lib; {
       description = "Server and user space API to deal with multimedia pipelines";

pkgs/development/libraries/pipewire/media-session.nix

···
-{ stdenv
-, lib
-, fetchFromGitLab
-, fetchpatch
-, meson
-, ninja
-, pkg-config
-, doxygen
-, graphviz
-, systemd
-, pipewire
-, glib
-, dbus
-, alsa-lib
-, callPackage
-}:
-
-let
-  mesonEnable = b: if b then "enabled" else "disabled";
-  mesonList = l: "[" + lib.concatStringsSep "," l + "]";
-
-  self = stdenv.mkDerivation rec {
-    pname = "pipewire-media-session";
-    version = "0.4.1";
-
-    src = fetchFromGitLab {
-      domain = "gitlab.freedesktop.org";
-      owner = "pipewire";
-      repo = "media-session";
-      rev = version;
-      sha256 = "sha256-e537gTkiNYMz2YJrOff/MXYWVDgHZDkqkSn8Qh+7Wr4=";
-    };
-
-    patches = [
-      # Fix `ERROR: Tried to access unknown option "session-managers".`
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/pipewire/media-session/-/commit/dfa740175c83e1cd0d815ad423f90872de566437.diff";
-        sha256 = "01rfwq8ipm8wyv98rxal1s5zrkf0pn9hgrngiq2wdbwj6vjdnr1h";
-      })
-      # Fix attempt to put system service units into pkgs.systemd.
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/pipewire/media-session/-/commit/2ff6b0baec7325dde229013b9d37c93f8bc7edee.diff";
-        sha256 = "18gg7ca04ihl4ylnw78wdyrbvg66m8w43gg0wp258x4nv95gpps2";
-      })
-    ];
-
-    nativeBuildInputs = [
-      doxygen
-      graphviz
-      meson
-      ninja
-      pkg-config
-    ];
-
-    buildInputs = [
-      alsa-lib
-      dbus
-      glib
-      pipewire
-      systemd
-    ];
-
-    mesonFlags = [
-      "-Ddocs=enabled"
-      "-Dsystemd-system-service=enabled"
-      # We generate these empty files from the nixos module, don't bother installing them
-      "-Dwith-module-sets=[]"
-    ];
-
-    postUnpack = ''
-      patchShebangs source/doc/input-filter-h.sh
-      patchShebangs source/doc/input-filter.sh
-    '';
-
-    postInstall = ''
-      mkdir $out/nix-support
-      cd $out/share/pipewire/media-session.d
-      for f in *.conf; do
-        echo "Generating JSON from $f"
-        ${pipewire}/bin/spa-json-dump "$f" > "$out/nix-support/$f.json"
-      done
-    '';
-
-    passthru = {
-      updateScript = ./update-media-session.sh;
-      tests = {
-        test-paths = callPackage ./test-paths.nix { package = self; } {
-          paths-out = [
-            "nix-support/alsa-monitor.conf.json"
-            "nix-support/bluez-monitor.conf.json"
-            "nix-support/media-session.conf.json"
-            "nix-support/v4l2-monitor.conf.json"
-          ];
-          paths-lib = [];
-        };
-      };
-    };
-
-    meta = with lib; {
-      description = "Example session manager for PipeWire";
-      homepage = "https://pipewire.org";
-      license = licenses.mit;
-      platforms = platforms.linux;
-      maintainers = with maintainers; [ jtojnar kranzes ];
-    };
-  };
-
-in
-self

pkgs/development/libraries/pipewire/test-paths.nix

···
-{ lib, runCommand, package, paths-out, paths-lib }:
-
-let
-  check-path = output: path: ''
-    if [[ ! -f "${output}/${path}" && ! -d "${output}/${path}" ]]; then
-      printf "Missing: %s\n" "${output}/${path}" | tee -a $out
-      error=error
-    else
-      printf "Found: %s\n" "${output}/${path}" | tee -a $out
-    fi
-  '';
-
-  check-output = output: lib.concatMapStringsSep "\n" (check-path output);
-in runCommand "pipewire-test-paths" { } ''
-  touch $out
-
-  ${check-output package.lib paths-lib}
-  ${check-output package paths-out}
-
-  if [[ -n "$error" ]]; then
-    exit 1
-  fi
-''

pkgs/development/libraries/pipewire/update-media-session.sh

···
-#!/usr/bin/env nix-shell
-#!nix-shell -p nix-update -i bash
-# shellcheck shell=bash
-
-set -o errexit -o pipefail -o nounset -o errtrace
-shopt -s inherit_errexit
-shopt -s nullglob
-IFS=$'\n'
-
-NIXPKGS_ROOT="$(git rev-parse --show-toplevel)"
-
-cd "$NIXPKGS_ROOT"
-nix-update pipewire-media-session
-outputs=$(nix-build . -A pipewire-media-session)
-for p in $outputs; do
-    conf_files=$(find "$p/nix-support/" -name '*.conf.json')
-    for c in $conf_files; do
-        file_name=$(basename "$c")
-        if [[ ! -e "nixos/modules/services/desktops/pipewire/media-session/$file_name" ]]; then
-            echo "New file $file_name found! Add it to the module config and passthru tests!"
-        fi
-        install -m 0644 "$c" "nixos/modules/services/desktops/pipewire/media-session/"
-    done
-done

pkgs/development/libraries/pipewire/update-pipewire.sh

···
-#!/usr/bin/env nix-shell
-#!nix-shell -p nix-update -i bash
-# shellcheck shell=bash
-
-set -o errexit -o pipefail -o nounset -o errtrace
-shopt -s inherit_errexit
-shopt -s nullglob
-IFS=$'\n'
-
-NIXPKGS_ROOT="$(git rev-parse --show-toplevel)"
-
-cd "$NIXPKGS_ROOT"
-nix-update pipewire
-outputs=$(nix-build . -A pipewire)
-for p in $outputs; do
-    conf_files=$(find "$p/nix-support/" -name '*.conf.json')
-    for c in $conf_files; do
-        file_name=$(basename "$c")
-        if [[ ! -e "nixos/modules/services/desktops/pipewire/daemon/$file_name" ]]; then
-            echo "New file $file_name found! Add it to the module config and passthru tests!"
-        fi
-        install -m 0644 "$c" "nixos/modules/services/desktops/pipewire/daemon/"
-    done
-done
-

pkgs/development/libraries/qt-4.x/4.8/qmake-hook.sh

···
         echo "qmake4Hook: enabled parallel building"
     fi
 
+    if ! [[ -v enableParallelInstalling ]]; then
+        enableParallelInstalling=1
+        echo "qmake: enabled parallel installing"
+    fi
+
     runHook postConfigure
 }
 

pkgs/development/libraries/qt-5/hooks/qmake-hook.sh

···
         echo "qmake: enabled parallel building"
     fi
 
+    if ! [[ -v enableParallelInstalling ]]; then
+        enableParallelInstalling=1
+        echo "qmake: enabled parallel installing"
+    fi
+
     runHook postConfigure
 }
 

pkgs/development/libraries/qt-6/hooks/qmake-hook.sh

···
         echo "qmake: enabled parallel building"
     fi
 
+    if ! [[ -v enableParallelInstalling ]]; then
+        enableParallelInstalling=1
+        echo "qmake: enabled parallel installing"
+    fi
+
     runHook postConfigure
 }
 

pkgs/development/libraries/readline/6.3.nix

···
 
   outputs = [ "out" "dev" "man" "doc" "info" ];
 
-  propagatedBuildInputs = [ncurses];
+  strictDeps = true;
+  propagatedBuildInputs = [ ncurses ];
 
   patchFlags = [ "-p0" ];
 

pkgs/development/libraries/readline/7.0.nix

···
 
   outputs = [ "out" "dev" "man" "doc" "info" ];
 
-  propagatedBuildInputs = [ncurses];
+  strictDeps = true;
+  propagatedBuildInputs = [ ncurses ];
 
   patchFlags = [ "-p0" ];
 

pkgs/development/libraries/readline/8.2.nix

···
 
   outputs = [ "out" "dev" "man" "doc" "info" ];
 
-  propagatedBuildInputs = [ncurses];
+  strictDeps = true;
+  propagatedBuildInputs = [ ncurses ];
 
   patchFlags = [ "-p0" ];
 

pkgs/development/libraries/science/math/openblas/default.nix

···
     FC = "${stdenv.cc.targetPrefix}gfortran";
     CC = "${stdenv.cc.targetPrefix}${if stdenv.cc.isClang then "clang" else "cc"}";
     PREFIX = placeholder "out";
+    OPENBLAS_INCLUDE_DIR = "${placeholder "dev"}/include";
     NUM_THREADS = 64;
     INTERFACE64 = blas64;
     NO_STATIC = !enableStatic;
···
 Name: $alias
 Version: ${version}
 Description: $alias provided by the OpenBLAS package.
-Cflags: -I$out/include
+Cflags: -I$dev/include
 Libs: -L$out/lib -lopenblas
 EOF
     done

pkgs/development/libraries/snappy/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "snappy";
-  version = "1.1.9";
+  version = "1.1.10";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "snappy";
     rev = version;
-    sha256 = "sha256-JXWl63KVP+CDNWIXYtz+EKqWLJbPKl3ifhr8dKAp/w8=";
+    hash = "sha256-wYZkKVDXKCugycx/ZYhjV0BjM/NrEM0R6A4WFhs/WPU=";
   };
 
   patches = [
-    (fetchpatch {
-      name = "clang-7-compat.patch";
-      url = "https://github.com/google/snappy/pull/142/commits/658cb2fcf67b626fff2122a3dbf7a3560c58f7ee.patch";
-      sha256 = "1kg3lxjwmhc7gjx36nylilnf444ddbnr3px1wpvyc6l1nh6zh4al";
-    })
     # Re-enable RTTI, without which other applications can't subclass
     # snappy::Source (this breaks Ceph, as one example)
     # https://tracker.ceph.com/issues/53060
···
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ cmake ];
+
+  # See https://github.com/NixOS/nixpkgs/pull/219778#issuecomment-1464884412.
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.isAarch64 && stdenv.isDarwin) "-Wno-sign-compare";
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"

pkgs/development/libraries/spandsp/3.nix

···
-{ lib, stdenv, fetchFromGitHub, audiofile, libtiff, autoreconfHook }:
-stdenv.mkDerivation rec {
+{ lib
+, stdenv
+, fetchFromGitHub
+, audiofile
+, libtiff
+, autoreconfHook
+, fetchpatch
+, buildPackages
+, callPackage
+}:
+
+(callPackage ./common.nix {}).overrideAttrs(finalAttrs: {
   version = "3.0.0";
-  pname = "spandsp";
   src = fetchFromGitHub {
     owner = "freeswitch";
-    repo = pname;
+    repo = finalAttrs.pname;
     rev = "6ec23e5a7e411a22d59e5678d12c4d2942c4a4b6"; # upstream does not seem to believe in tags
     sha256 = "03w0s99y3zibi5fnvn8lk92dggfgrr0mz5255745jfbz28b2d5y7";
   };
-
-  outputs = [ "out" "dev" ];
-
-  nativeBuildInputs = [ autoreconfHook ];
-  propagatedBuildInputs = [ audiofile libtiff ];
-
-  meta = {
-    description = "A portable and modular SIP User-Agent with audio and video support";
-    homepage = "https://github.com/freeswitch/spandsp";
-    platforms = with lib.platforms; unix;
-    maintainers = with lib.maintainers; [ ajs124 misuzu ];
-    license = lib.licenses.gpl2;
-  };
-}
+})

pkgs/development/libraries/spandsp/common.nix

···
+{ lib
+, stdenv
+, fetchurl
+, audiofile
+, libtiff
+, buildPackages
+, fetchpatch
+, autoreconfHook
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "spandsp";
+
+  patches = [
+    # submitted upstream: https://github.com/freeswitch/spandsp/pull/47
+    (fetchpatch {
+      url = "https://github.com/freeswitch/spandsp/commit/1f810894804d3fa61ab3fc2f3feb0599145a3436.patch";
+      hash = "sha256-Cf8aaoriAvchh5cMb75yP2gsZbZaOLha/j5mq3xlkVA=";
+    })
+  ];
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [ autoreconfHook ];
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  propagatedBuildInputs = [ audiofile libtiff ];
+
+  configureFlags = [
+    # This flag is required to prevent linking error in the cross-compilation case.
+    # I think it's fair to assume that realloc(NULL, size) will return a valid memory
+    # block for most libc implementation, so let's just assume that and hope for the best.
+    "ac_cv_func_malloc_0_nonnull=yes"
+  ];
+
+  enableParallelBuilding = true;
+
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "CC_FOR_BUILD=${buildPackages.stdenv.cc}/bin/cc"
+  ];
+
+  strictDeps = true;
+
+  meta = {
+    description = "A portable and modular SIP User-Agent with audio and video support";
+    homepage = "https://github.com/freeswitch/spandsp";
+    platforms = with lib.platforms; unix;
+    maintainers = with lib.maintainers; [ ajs124 misuzu ];
+    license = lib.licenses.gpl2;
+    downloadPage = "http://www.soft-switch.org/downloads/spandsp/";
+  };
+})

pkgs/development/libraries/spandsp/default.nix

···
-{ lib, stdenv, fetchurl, audiofile, libtiff, buildPackages }:
-stdenv.mkDerivation rec {
+{ lib
+, stdenv
+, fetchurl
+, audiofile
+, libtiff
+, buildPackages
+, fetchpatch
+, autoreconfHook
+, callPackage
+}:
+
+(callPackage ./common.nix {}).overrideAttrs(_: rec {
   version = "0.0.6";
-  pname = "spandsp";
-  src=fetchurl {
+  src = fetchurl {
     url = "https://www.soft-switch.org/downloads/spandsp/spandsp-${version}.tar.gz";
     sha256 = "0rclrkyspzk575v8fslzjpgp4y2s4x7xk3r55ycvpi4agv33l1fc";
   };
-
-  outputs = [ "out" "dev" ];
-  makeFlags = [
-    "CC=${stdenv.cc.targetPrefix}cc"
-    "CC_FOR_BUILD=${buildPackages.stdenv.cc}/bin/cc"
-  ];
-
-  configureFlags = [
-    # This flag is required to prevent linking error in the cross-compilation case.
-    # I think it's fair to assume that realloc(NULL, size) will return a valid memory
-    # block for most libc implementation, so let's just assume that and hope for the best.
-    "ac_cv_func_malloc_0_nonnull=yes"
-  ];
-
-  strictDeps = true;
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  propagatedBuildInputs = [audiofile libtiff];
-  meta = {
-    description = "A portable and modular SIP User-Agent with audio and video support";
-    homepage = "http://www.creytiv.com/baresip.html";
-    platforms = with lib.platforms; linux;
-    maintainers = with lib.maintainers; [raskin];
-    license = lib.licenses.gpl2;
-    downloadPage = "http://www.soft-switch.org/downloads/spandsp/";
-  };
-}
+})

pkgs/development/libraries/sqlite/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "sqlite${lib.optionalString interactive "-interactive"}";
-  version = "3.41.0";
+  version = "3.41.1";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2023/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    hash = "sha256-Sfd6xT/Zql1zlfJJnLgWQQ5WIZhKEhuFjMygUxCwXHA=";
+    hash = "sha256-Ta376rn44WxpXU+7xRwWsvd/uX/0wcPROZGd/AOMnjM=";
   };
 
   outputs = [ "bin" "dev" "out" ];

pkgs/development/libraries/sqlite/tools.nix

···
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.41.0";
+    version = "3.41.1";
 
     # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2023/sqlite-src-${archiveVersion version}.zip";
-      hash = "sha256-ZKdjijXoa5kfDBWujigwBjtpSygGi491lTWOMgWp62Y=";
+      hash = "sha256-25KQEvkAnn8Hlg5/AX6DLYeJop9LIDBxtP15Ip59eiA=";
     };
 
     nativeBuildInputs = [ unzip ];

pkgs/development/libraries/tinycompress/default.nix

···
+{ lib
+, stdenv
+, fetchurl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "tinycompress";
+  version = "1.2.8";
+
+  src = fetchurl {
+    url = "mirror://alsa/tinycompress/${pname}-${version}.tar.bz2";
+    hash = "sha256-L4l+URLNO8pnkLXOz9puBmLIvF7g+6uXKyR6DMYg1mw=";
+  };
+
+  meta = with lib; {
+    homepage = "http://www.alsa-project.org/";
+    description = "a userspace library for anyone who wants to use the ALSA compressed APIs";
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ k900 ];
+  };
+}

pkgs/development/libraries/tracker/default.nix

···
     patchShebangs utils/data-generators/cc/generate
   '';
 
+  strictDeps = true;
+
   depsBuildBuild = [
     pkg-config
   ];
···
     dbus
   ] ++ lib.optionals stdenv.isLinux [
     systemd
+  ];
+
+  nativeCheckInputs = [
+    dbus
   ];
 
   mesonFlags = [

pkgs/development/libraries/xine-lib/default.nix

···
 , aalib
 , alsa-lib
 , autoconf
-, ffmpeg
+, ffmpeg_4
 , flac
 , libGL
 , libGLU
···
       url = "https://raw.githubusercontent.com/archlinux/svntogit-community/209ae10d59d29c13633b75aa327cf937f3ff0725/trunk/010-xine-lib-libcaca-0.99.beta20-fix.patch";
       sha256 = "088141x1yp84y09x3s01v21yzas2bwavxz9v30z5hyq6c3syrmgr";
     })
-    # Fix build with ffmpeg 5.0 ; remove for xine-lib 1.2.12
-    (fetchpatch {
-      name = "xine-lib-ffmpeg-5.0-fix.patch";
-      url = "https://raw.githubusercontent.com/archlinux/svntogit-community/209ae10d59d29c13633b75aa327cf937f3ff0725/trunk/020-xine-lib-ffmpeg-5.0-fix.patch";
-      sha256 = "15ff15bqxq1nqqazfbmfq6swrdjr2raxyq7hx6k0r61izhf0g8ld";
-    })
   ];
 
   nativeBuildInputs = [
···
   buildInputs = [
     aalib
     alsa-lib
-    ffmpeg
+    ffmpeg_4 # xine-lib 1.2.12 should support ffmpeg_5
     flac
     libGL
     libGLU

pkgs/development/octave-modules/video/default.nix

···
 , lib
 , fetchurl
 , pkg-config
-, ffmpeg
+, ffmpeg_4
 }:
 
 buildOctavePackage rec {
···
   ];
 
   propagatedBuildInputs = [
-    ffmpeg
+    ffmpeg_4
   ];
 
   meta = with lib; {

pkgs/development/python-modules/apache-beam/default.nix

···
     homepage = "https://beam.apache.org/";
     license = licenses.asl20;
     maintainers = with maintainers; [ ndl ];
+    broken = true;
   };
 }

pkgs/development/python-modules/appnope/default.nix

···
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "appnope";
   version = "0.1.3";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Ar2RxN6Gn7seHFCq/ECYgnp6VKsvOdncumyVR+2SDiQ=";
+  src = fetchFromGitHub {
+    owner = "minrk";
+    repo = "appnope";
+    rev = version;
+    hash = "sha256-JYzNOPD1ofOrtZK5TTKxbF1ausmczsltR7F1Vwss8Sw=";
   };
 
+  checkInputs = [
+    pytestCheckHook
+  ];
+
   meta = {
     description = "Disable App Nap on macOS";
-    homepage    = "https://pypi.python.org/pypi/appnope";
-    platforms   = lib.platforms.darwin;
-    license     = lib.licenses.bsd3;
+    homepage = "https://github.com/minrk/appnope";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ OPNA2608 ];
+    # Not Darwin-specific because dummy fallback may be used cross-platform
   };
 }

pkgs/development/python-modules/babel/default.nix

···
-{ stdenv, lib, buildPythonPackage, fetchPypi, pythonOlder, pytz, pytestCheckHook, freezegun }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonAtLeast
+, pythonOlder
+
+# tests
+, freezegun
+, pytestCheckHook
+, pytz
+}:
 
 buildPythonPackage rec {
   pname = "babel";
   version = "2.12.1";
+  format = "setuptools";
+
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
···
     hash = "sha256-zC2ZmZzQHURCCuclohyeNxGzqtx5dtYUf2IthYGWNFU=";
   };
 
-  propagatedBuildInputs = lib.optional (pythonOlder "3.9") pytz;
+  propagatedBuildInputs = lib.optionals (pythonOlder "3.9") [
+    pytz
+  ];
 
-  nativeCheckInputs = [ pytestCheckHook freezegun ];
+  # including backports.zoneinfo for python<3.9 yields infinite recursion
+  doCheck = pythonAtLeast "3.9";
+
+  nativeCheckInputs = [
+    # via setup.py
+    freezegun
+    pytestCheckHook
+    # via tox.ini
+    pytz
+  ];
+
+  disabledTests = [
+    # fails on days switching from and to daylight saving time in EST
+    # https://github.com/python-babel/babel/issues/988
+    "test_format_time"
+  ];
 
   meta = with lib; {
     homepage = "https://babel.pocoo.org/";
+    changelog = "https://github.com/python-babel/babel/releases/tag/v${version}";
     description = "Collection of internationalizing tools";
     license = licenses.bsd3;
     maintainers = with maintainers; [ SuperSandro2000 ];

pkgs/development/python-modules/ffmpeg-python/default.nix

···
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, ffmpeg
+, ffmpeg_4
 , future
 , pytest-mock
 , pytestCheckHook
···
   patches = [
     (substituteAll {
       src = ./ffmpeg-location.patch;
-      inherit ffmpeg;
+      ffmpeg = ffmpeg_4;
     })
   ];
 

pkgs/development/python-modules/more-itertools/default.nix

···
 
 buildPythonPackage rec {
   pname = "more-itertools";
-  version = "9.0.0";
+  version = "9.1.0";
   format = "flit";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-WmJX5Ah47wUgsYA5kOPiIwOkG1cUAGwyo/2DBLJuoas=";
+    hash = "sha256-yrqjQa0DieqDwXqUVmpTrkydBzSYYeyxTcbQNFz5rF0=";
   };
 
   nativeBuildInouts = [

pkgs/development/python-modules/myst-parser/default.nix

···
 
 buildPythonPackage rec {
   pname = "myst-parser";
-  version = "0.19.1";
+  version = "1.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
···
     owner = "executablebooks";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-dmvtRvVOF6lxeC+CC/dwkIs4VRDAZtlmblh9uaV+lW0=";
+    hash = "sha256-Kewd6/4yawpRuyCe8Na0BGUMo59tr2fc97VlGbVJ8mI=";
   };
 
   nativeBuildInputs = [ flit-core ];

pkgs/development/python-modules/pims/default.nix

···
     homepage = "https://github.com/soft-matter/pims";
     license = licenses.bsd3;
     maintainers = with maintainers; [ costrouc ];
+    broken = true;
   };
 }

pkgs/development/python-modules/pydevd/default.nix

···
     homepage = "https://github.com/fabioz/PyDev.Debugger";
     license = licenses.epl10;
     maintainers = with maintainers; [ onny ];
+    broken = true;
   };
 }

pkgs/development/python-modules/pynacl/default.nix

···
 , buildPythonPackage
 , fetchPypi
 , pytestCheckHook
+, sphinxHook
 , pythonOlder
 , libsodium
 , cffi
···
 buildPythonPackage rec {
   pname = "pynacl";
   version = "1.5.0";
+  outputs = [ "out" "doc" ];
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
···
     pname = "PyNaCl";
     sha256 = "8ac7448f09ab85811607bdd21ec2464495ac8b7c66d146bf545b0f08fb9220ba";
   };
+
+  nativeBuildInputs = [
+    sphinxHook
+  ];
 
   buildInputs = [
     libsodium

pkgs/development/python-modules/python-efl/default.nix

···
     platforms = platforms.linux;
     license = with licenses; [ gpl3 lgpl3 ];
     maintainers = with maintainers; [ matejc ftrvxmtrx ] ++ teams.enlightenment.members;
+    broken = true;
   };
 }

pkgs/development/python-modules/spectral-cube/default.nix

···
     license = lib.licenses.bsd3;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ smaret ];
+    broken = true;
   };
 }
-

pkgs/development/python-modules/sphinx-rtd-theme/default.nix

···
     sphinxcontrib-jquery
   ];
 
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
-    pythonRelaxDepsHook
     readthedocs-sphinx-ext
   ];
 

pkgs/development/python-modules/sqlalchemy/default.nix

···
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "2.0.4";
+  version = "2.0.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-laGOGmryEU29nuTxaK0zBw1jF+Ebr6KNmDzHtYX+kAs=";
+    hash = "sha256-w0PwtUZJX116I5xwv1CpmkjXMhwWW4Kvr6hIO56+v24=";
   };
 
   nativeBuildInputs =[

pkgs/development/python-modules/sunpy/default.nix

···
     homepage = "https://sunpy.org";
     license = licenses.bsd2;
     maintainers = with maintainers; [ costrouc ];
+    broken = true;
   };
 }

pkgs/development/python-modules/wxPython/4.0.nix

···
     description = "Cross platform GUI toolkit for Python, Phoenix version";
     homepage = "http://wxpython.org/";
     license = lib.licenses.wxWindows;
+    broken = true;
   };
 
 }

pkgs/development/python-modules/wxPython/4.1.nix

···
     homepage = "http://wxpython.org/";
     license = licenses.wxWindows;
     maintainers = with maintainers; [ tfmoraes ];
+    broken = true;
   };
 }

pkgs/development/ruby-modules/bundler/default.nix

···
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.4.6";
-  source.sha256 = "sha256-MI/g13w5NMoHQ78AJ11BlKhulroUI6xNPqQ19iH51P8=";
+  version = "2.4.8";
+  source.sha256 = "sha256-/oLW+JPyFz4TIykm4rnOtvZwJ8fxZr/B49bsfZaZoWQ=";
   dontPatchShebangs = true;
 
   postFixup = ''

pkgs/development/tools/analysis/eresi/default.nix

···
   nativeBuildInputs = [ which ];
   buildInputs = [ openssl readline ];
   enableParallelBuilding = true;
+  # ln: failed to create symbolic link '...-eresi-0.83-a3-phoenix//bin/elfsh': No such file or directory
+  # make: *** [Makefile:108: install64] Error 1
+  enableParallelInstalling = false;
 
   installTargets = lib.singleton "install"
                 ++ lib.optional stdenv.is64bit "install64";

pkgs/development/tools/build-managers/bmake/setup-hook.sh

···
 
     # shellcheck disable=SC2086
     local flagsArray=(
+        ${enableParallelInstalling:+-j${NIX_BUILD_CORES}}
         SHELL=$SHELL
         # Old bash empty array hack
         $makeFlags ${makeFlagsArray+"${makeFlagsArray[@]}"}

pkgs/development/tools/build-managers/cmake/default.nix

···
     + lib.optionalString isBootstrap "-boot"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.25.2";
+  version = "3.25.3";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
-    sha256 = "0g6k9sa23smh9z5dz8v6dqy89887gxc7s24gchpm7p9ip4ng49n0";
+    sha256 = "sha256-zJlXAdWQym3rxCRemYmTkJnKUoJ91GtdNZLwk6/hkBw=";
   };
 
   patches = [

pkgs/development/tools/build-managers/cmake/setup-hook.sh

···
         echo "cmake: enabled parallel building"
     fi
 
+    if ! [[ -v enableParallelInstalling ]]; then
+        enableParallelInstalling=1
+        echo "cmake: enabled parallel installing"
+    fi
+
     runHook postConfigure
 }
 

pkgs/development/tools/build-managers/gnumake/4.4/0001-No-impure-bin-sh.patch

···
-From e00a5257a6ca5fedbf68b09eee7df3502971a057 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <[e-mail]>
-Date: Sat, 24 Apr 2021 10:11:40 +0200
-Subject: [PATCH 1/2] No impure bin sh
-
-default_shell is used to populuate default shell used to execute jobs.
-Unless SHELL is set to a different value this would be /bin/sh.
-Our stdenv provides sh in form of bash anyway. Having this value not
-hard-coded has some advantages:
-
-- It would ensure that on all systems it uses sh from its PATH rather
-  than /bin/sh, which helps as different systems might have different
-  shells there (bash vs. dash)
-- In the past I had issues with LD_PRELOAD with BEAR, where /bin/sh
-  used a different glibc than BEAR which came from my development shell.
----
- src/job.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/job.c b/src/job.c
-index ae1f18b..6b4ddb3 100644
---- a/src/job.c
-+++ b/src/job.c
-@@ -77,7 +77,7 @@ char * vms_strsignal (int status);
- 
- #else
- 
--const char *default_shell = "/bin/sh";
-+const char *default_shell = "sh";
- int batch_mode_shell = 0;
- 
- #endif
--- 
-2.31.1
-

pkgs/development/tools/build-managers/gnumake/4.4/0002-remove-impure-dirs.patch

···
-From 795d63d3c8b5c0dbb7e544954f75507b371b7228 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <[e-mail]>
-Date: Sat, 24 Apr 2021 10:20:16 +0200
-Subject: [PATCH 2/2] remove impure dirs
-
----
- src/read.c   | 3 ---
- src/remake.c | 2 --
- 2 files changed, 5 deletions(-)
-
-diff --git a/src/read.c b/src/read.c
-index fa197fb..defacfb 100644
---- a/src/read.c
-+++ b/src/read.c
-@@ -109,9 +109,6 @@ static const char *default_include_directories[] =
- #endif
-     INCLUDEDIR,
- #ifndef _AMIGA
--    "/usr/gnu/include",
--    "/usr/local/include",
--    "/usr/include",
- #endif
-     0
-   };
-diff --git a/src/remake.c b/src/remake.c
-index fb237c5..94bff7d 100644
---- a/src/remake.c
-+++ b/src/remake.c
-@@ -1601,8 +1601,6 @@ library_search (const char *lib, FILE_TIMESTAMP *mtime_ptr)
-   static const char *dirs[] =
-     {
- #ifndef _AMIGA
--      "/lib",
--      "/usr/lib",
- #endif
- #if defined(WINDOWS32) && !defined(LIBDIR)
- /*
--- 
-2.31.1
-

pkgs/development/tools/build-managers/gnumake/4.4/default.nix

···
-{ lib
-, stdenv
-, fetchurl
-, guileSupport ? false, guile
-# avoid guile depend on bootstrap to prevent dependency cycles
-, inBootstrap ? false
-, pkg-config
-, gnumake
-}:
-
-let
-  guileEnabled = guileSupport && !inBootstrap;
-in
-
-stdenv.mkDerivation rec {
-  pname = "gnumake";
-  version = "4.4";
-
-  src = fetchurl {
-    url = "mirror://gnu/make/make-${version}.tar.gz";
-    hash = "sha256-WB9NToctp0s5Qch0IViYp9NYAvA3Mr3M7h1KeXkQXRg=";
-  };
-
-  # to update apply these patches with `git am *.patch` to https://git.savannah.gnu.org/git/make.git
-  patches = [
-    # Replaces /bin/sh with sh, see patch file for reasoning
-    ./0001-No-impure-bin-sh.patch
-    # Purity: don't look for library dependencies (of the form `-lfoo') in /lib
-    # and /usr/lib. It's a stupid feature anyway. Likewise, when searching for
-    # included Makefiles, don't look in /usr/include and friends.
-    ./0002-remove-impure-dirs.patch
-  ];
-
-  nativeBuildInputs = lib.optionals guileEnabled [ pkg-config ];
-  buildInputs = lib.optionals guileEnabled [ guile ];
-
-  configureFlags = lib.optional guileEnabled "--with-guile"
-
-    # Make uses this test to decide whether it should keep track of
-    # subseconds. Apple made this possible with APFS and macOS 10.13.
-    # However, we still support macOS 10.11 and 10.12. Binaries built
-    # in Nixpkgs will be unable to use futimens to set mtime less than
-    # a second. So, tell Make to ignore nanoseconds in mtime here by
-    # overriding the autoconf test for the struct.
-    # See https://github.com/NixOS/nixpkgs/issues/51221 for discussion.
-    ++ lib.optional stdenv.isDarwin "ac_cv_struct_st_mtim_nsec=no";
-
-  outputs = [ "out" "man" "info" ];
-  separateDebugInfo = true;
-
-  passthru.tests = {
-    # make sure that the override doesn't break bootstrapping
-    gnumakeWithGuile = gnumake.override { guileSupport = true; };
-  };
-
-  meta = with lib; {
-    description = "A tool to control the generation of non-source files from sources";
-    longDescription = ''
-      Make is a tool which controls the generation of executables and
-      other non-source files of a program from the program's source files.
-
-      Make gets its knowledge of how to build your program from a file
-      called the makefile, which lists each of the non-source files and
-      how to compute it from other files. When you write a program, you
-      should write a makefile for it, so that it is possible to use Make
-      to build and install the program.
-    '';
-    homepage = "https://www.gnu.org/software/make/";
-
-    license = licenses.gpl3Plus;
-    maintainers = [ maintainers.vrthra ];
-    mainProgram = "make";
-    platforms = platforms.all;
-  };
-}

pkgs/development/tools/build-managers/meson/setup-hook.sh

···
         echo "meson: enabled parallel building"
     fi
 
+    if ! [[ -v enableParallelInstalling ]]; then
+        enableParallelInstalling=1
+        echo "meson: enabled parallel installing"
+    fi
+
     runHook postConfigure
 }
 

pkgs/development/tools/build-managers/ninja/setup-hook.sh

···
 ninjaInstallPhase() {
     runHook preInstall
 
+    local buildCores=1
+
+    # Parallel building is enabled by default.
+    if [ "${enableParallelInstalling-1}" ]; then
+        buildCores="$NIX_BUILD_CORES"
+    fi
+
     # shellcheck disable=SC2086
     local flagsArray=(
+        -j$buildCores
         $ninjaFlags "${ninjaFlagsArray[@]}"
         ${installTargets:-install}
     )

pkgs/development/tools/build-managers/scons/setup-hook.sh

···
     fi
 
     local flagsArray=(
+        ${enableParallelInstalling:+-j${NIX_BUILD_CORES}}
         $sconsFlags ${sconsFlagsArray[@]}
         $installFlags ${installFlagsArray[@]}
         ${installTargets:-install}

pkgs/development/tools/build-managers/wafHook/setup-hook.sh

···
         echo "waf: enabled parallel building"
     fi
 
+    if ! [[ -v enableParallelInstalling ]]; then
+        enableParallelInstalling=1
+        echo "waf: enabled parallel installing"
+    fi
+
     runHook postConfigure
 }
 
···
     fi
 
     local flagsArray=(
+        ${enableParallelInstalling:+-j ${NIX_BUILD_CORES}}
         $wafFlags ${wafFlagsArray[@]}
         $installFlags ${installFlagsArray[@]}
         ${installTargets:-install}

pkgs/development/tools/misc/patchelf/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "patchelf";
-  version = "0.15.0";
+  version = "0.17.2";
 
   src = fetchurl {
     url = "https://github.com/NixOS/${pname}/releases/download/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-9ANtPuTY4ijewb7/8PbkbYpA6eVw4AaOOdd+YuLIvcI=";
+    sha256 = "sha256-uuLqN2By5CLBliGN2b3vBUjMwI2k3p82tGct+E6i2OI=";
   };
 
   strictDeps = true;

pkgs/development/tools/pandoc/default.nix

···
     buildDepends = drv.buildDepends or [] ++ [haskellPackages.file-embed];
     buildTools = (drv.buildTools or []) ++ [ removeReferencesTo ];
 
+    # Normally, the static linked executable shouldn't refer to any library or the compiler.
+    # This is not always the case when the dependency has Paths_* module generated by Cabal,
+    # where bindir, datadir, and libdir contain the path to the library, and thus make the
+    # executable indirectly refer to GHC. However, most Haskell programs only use Paths_*.version for
+    # getting the version at runtime, so it's safe to remove the references to them.
+    # This is true so far for pandoc-types and warp.
+    # For details see: https://github.com/NixOS/nixpkgs/issues/34376
     postInstall = drv.postInstall or "" + ''
       remove-references-to \
         -t ${haskellPackages.pandoc-types} \
+        $out/bin/pandoc
+      remove-references-to \
+        -t ${haskellPackages.warp} \
         $out/bin/pandoc
     '' + lib.optionalString (stdenv.buildPlatform == stdenv.hostPlatform) ''
       mkdir -p $out/share/bash-completion/completions
···
     # lead to a transitive runtime dependency on the whole GHC distribution.
     # This should ideally be fixed in haskellPackages (or even Cabal),
     # but a minimal pandoc is important enough to patch it manually.
-    disallowedReferences = [ haskellPackages.pandoc-types ];
+    disallowedReferences = [ haskellPackages.pandoc-types haskellPackages.warp ];
   })

pkgs/development/tools/shadered/default.nix

···
     homepage = "https://github.com/dfranx/SHADERed";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ Scriptkiddi ];
+    broken = true;
   };
 }

pkgs/development/web/nodejs/v18.nix

···
 in
 buildNodejs {
   inherit enableNpm;
-  version = "18.14.2";
-  sha256 = "sha256-+8Nk3SX+4srMDyAz2y2GEV/AdXUxDqDmRAi4Fw0JxoU=";
+  version = "18.15.0";
+  sha256 = "sha256-jkTWUBj/lzKEGVwjGGRpoOpAgul+xCAOX1cG1VhNqjc=";
   patches = [
     ./disable-darwin-v8-system-instrumentation.patch
     ./bypass-darwin-xcrun-node16.patch
+    ./revert-arm64-pointer-auth.patch
   ];
 }

pkgs/games/hedgewars/default.nix

···
-{ stdenv, SDL2_image, SDL2_ttf, SDL2_net, fpc, ghcWithPackages, ffmpeg, freeglut
+{ stdenv, SDL2_image, SDL2_ttf, SDL2_net, fpc, ghcWithPackages, ffmpeg_4, freeglut
 , lib, fetchurl, cmake, pkg-config, lua5_1, SDL2, SDL2_mixer
 , zlib, libpng, libGL, libGLU, physfs
 , qtbase, qttools, wrapQtAppsHook
···
     SDL2_ttf SDL2_net SDL2 SDL2_mixer SDL2_image
     fpc lua5_1
     llvm # hard-requirement on aarch64, for some reason not strictly necessary on x86-64
-    ffmpeg freeglut physfs
+    ffmpeg_4 freeglut physfs
     qtbase
   ] ++ lib.optional withServer ghc;
 

pkgs/games/openclonk/default.nix

···
     license = if enableSoundtrack then licenses.unfreeRedistributable else licenses.isc;
     maintainers = with maintainers; [ lheckemann ];
     platforms = [ "x86_64-linux" "i686-linux" ];
+    broken = true;
   };
 }

pkgs/games/openrw/default.nix

···
 , openal
 , SDL2
 , boost
-, ffmpeg
+, ffmpeg_4
 , Cocoa
 , OpenAL }:
 
···
   nativeBuildInputs = [ cmake ];
 
   buildInputs = [
-    sfml libGLU libGL bullet glm libmad openal SDL2 boost ffmpeg
+    sfml libGLU libGL bullet glm libmad openal SDL2 boost ffmpeg_4
   ] ++ lib.optionals stdenv.isDarwin [ OpenAL Cocoa ];
 
   meta = with lib; {

pkgs/games/performous/default.nix

···
 , aubio
 , boost
 , cmake
-, ffmpeg
+, ffmpeg_4
 , gettext
 , git
 , glew
···
     SDL2
     aubio
     boost
-    ffmpeg
+    ffmpeg_4
     glew
     glibmm
     glm

pkgs/games/spring/default.nix

···
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ qknight domenkozar sorki ];
     platforms = [ "x86_64-linux" ];
+    broken = true;
   };
 }

pkgs/games/stepmania/default.nix

···
 { stdenv, lib, fetchFromGitHub, cmake, nasm
-, gtk2, glib, ffmpeg, alsa-lib, libmad, libogg, libvorbis
+, gtk2, glib, ffmpeg_4, alsa-lib, libmad, libogg, libvorbis
 , glew, libpulseaudio, udev
 }:
 
···
   nativeBuildInputs = [ cmake nasm ];
 
   buildInputs = [
-    gtk2 glib ffmpeg alsa-lib libmad libogg libvorbis
+    gtk2 glib ffmpeg_4 alsa-lib libmad libogg libvorbis
     glew libpulseaudio udev
   ];
 

pkgs/games/ultrastardx/default.nix

···
 , SDL2_gfx
 , SDL2_mixer
 , SDL2_net, SDL2_ttf
-, ffmpeg
+, ffmpeg_4
 , sqlite
 , zlib
 , libX11
···
   sharedLibs = [
     pcre portaudio freetype
     SDL2 SDL2_image SDL2_gfx SDL2_mixer SDL2_net SDL2_ttf
-    sqlite lua zlib libX11 libGLU libGL ffmpeg
+    sqlite lua zlib libX11 libGLU libGL ffmpeg_4
   ];
 
 in stdenv.mkDerivation rec {
···
 
     # ultrastardx binds to libffmpeg (and sublibs), specifying a very restrictive
     # upper bounds on the minor versions of .so files.
-    # We can assume ffmpeg won’t break any major ABI compatibility, since their
-    # patch version seems to always stay at 100,
-    # and their minor version changes quite frequently.
+    # We can assume ffmpeg_4 won’t break any major ABI compatibility, since it's
+    # effectively EOL
     sed \
       -e 's/^  LIBAVCODEC_MAX_VERSION_MINOR.*$/  LIBAVCODEC_MAX_VERSION_MINOR = 1000;/' \
       -i src/lib/ffmpeg-4.0/avcodec.pas

pkgs/misc/screensavers/electricsheep/default.nix

···
 , fetchFromGitHub
 , autoreconfHook
 , wxGTK32
-, ffmpeg
+, ffmpeg_4
 , lua5_1
 , curl
 , libpng
···
 
   buildInputs = [
     wxGTK32
-    ffmpeg
+    ffmpeg_4
     lua5_1
     curl
     libpng

pkgs/os-specific/linux/guvcview/default.nix

···
 , pkg-config
 , portaudio
 , SDL2
-, ffmpeg
+, ffmpeg_4
 , udev
 , libusb1
 , libv4l
···
   buildInputs = [
     SDL2
     alsa-lib
-    ffmpeg
+    ffmpeg_4
     libusb1
     libv4l
     portaudio

pkgs/os-specific/linux/iproute/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "6.1.0";
+  version = "6.2.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-XOEqD+xrIScl7yGHNZQbLat2JE235yZGp2AhsFN7Q6s=";
+    sha256 = "sha256-TXJzAgDsWyqrqhovIFU8Z0gpLwZdmhVMfV4iVZ35/WI=";
   };
 
   patches = [

pkgs/os-specific/linux/pam/default.nix

···
-{ lib, stdenv, buildPackages, fetchurl, flex, cracklib, db4, gettext, audit
+{ lib, stdenv, buildPackages, fetchurl, flex, cracklib, db4, gettext, audit, libxcrypt
 , nixosTests
-, withLibxcrypt ? true, libxcrypt
 }:
 
 stdenv.mkDerivation rec {
···
   nativeBuildInputs = [ flex ]
     ++ lib.optional stdenv.buildPlatform.isDarwin gettext;
 
-  buildInputs = [ cracklib db4 ]
-    ++ lib.optional stdenv.buildPlatform.isLinux audit
-    ++ lib.optional withLibxcrypt libxcrypt;
+  buildInputs = [ cracklib db4 libxcrypt ]
+    ++ lib.optional stdenv.buildPlatform.isLinux audit;
 
   enableParallelBuilding = true;
 

pkgs/os-specific/linux/sssd/default.nix

···
   '';
 
   enableParallelBuilding = true;
+  # Disable parallel install due to missing depends:
+  #   libtool:   error: error: relink '_py3sss.la' with the above command before installing i
+  enableParallelInstalling = false;
   nativeBuildInputs = [ autoreconfHook makeWrapper pkg-config doxygen ];
   buildInputs = [ augeas dnsutils c-ares curl cyrus_sasl ding-libs libnl libunistring nss
                   samba nfs-utils p11-kit python3 popt

pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch

···
  2 files changed, 4 insertions(+)
 
 diff --git a/src/shared/fstab-util.c b/src/shared/fstab-util.c
-index f683f05981..5a04c2c2a6 100644
+index 164e71a150..68e0766594 100644
 --- a/src/shared/fstab-util.c
 +++ b/src/shared/fstab-util.c
-@@ -40,6 +40,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
+@@ -41,6 +41,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
          /* Don't bother with the OS data itself */
          if (PATH_IN_SET(mount,
                          "/",
···
                          "/etc"))
                  return true;
 diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
-index e650b82170..5d0d41aa28 100644
+index 61bd9d2601..a6243da417 100644
 --- a/src/shutdown/umount.c
 +++ b/src/shutdown/umount.c
-@@ -522,6 +522,8 @@ static int delete_md(MountPoint *m) {
+@@ -531,6 +531,8 @@ static int delete_md(MountPoint *m) {
  
  static bool nonunmountable_path(const char *path) {
          return path_equal(path, "/")

pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch

···
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 01a67b5553..86dd2cea84 100644
+index 36d336dfc8..d62c5173ca 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -5636,6 +5636,7 @@ static int run(int argc, char *argv[]) {
+@@ -5634,6 +5634,7 @@ static int run(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
···
                          _cleanup_free_ char *p = NULL;
  
                          if (arg_pivot_root_new)
-@@ -5650,6 +5651,7 @@ static int run(int argc, char *argv[]) {
+@@ -5648,6 +5649,7 @@ static int run(int argc, char *argv[]) {
                                                      "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
                                  goto finish;
                          }

pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch

···
  1 file changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/src/fsck/fsck.c b/src/fsck/fsck.c
-index 73c76fceea..d00cea7158 100644
+index e25c5d5efa..26f4e5669e 100644
 --- a/src/fsck/fsck.c
 +++ b/src/fsck/fsck.c
-@@ -352,6 +352,7 @@ static int run(int argc, char *argv[]) {
+@@ -351,6 +351,7 @@ static int run(int argc, char *argv[]) {
          if (r == 0) {
                  char dash_c[STRLEN("-C") + DECIMAL_STR_MAX(int) + 1];
                  int progress_socket = -1;
···
                  const char *cmdline[9];
                  int i = 0;
  
-@@ -372,7 +373,10 @@ static int run(int argc, char *argv[]) {
+@@ -371,7 +372,10 @@ static int run(int argc, char *argv[]) {
                  } else
                          dash_c[0] = 0;
  

pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch

···
  2 files changed, 6 insertions(+), 19 deletions(-)
 
 diff --git a/src/basic/path-lookup.c b/src/basic/path-lookup.c
-index 36f386254b..a968d28dfc 100644
+index c99e9d8786..b9f85d1f8c 100644
 --- a/src/basic/path-lookup.c
 +++ b/src/basic/path-lookup.c
 @@ -92,11 +92,7 @@ int xdg_user_data_dir(char **ret, const char *suffix) {

pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch

···
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index a59afafb58..d9e7d77913 100644
+index 7b394794b0..50d092042c 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -1432,7 +1432,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
+@@ -1437,7 +1437,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
                  if (!unit_is_bound_by_inactive(u, &culprit))
                          continue;
  

pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch

···
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Gabriel Ebner <[e-mail]>
-Date: Sun, 6 Dec 2015 14:26:36 +0100
-Subject: [PATCH] hostnamed, localed, timedated: disable methods that change
- system settings.
-
----
- src/hostname/hostnamed.c |  6 ++++++
- src/locale/localed.c     |  9 +++++++++
- src/timedate/timedated.c | 10 ++++++++++
- 3 files changed, 25 insertions(+)
-
-diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
-index 486b093062..580e933f14 100644
---- a/src/hostname/hostnamed.c
-+++ b/src/hostname/hostnamed.c
-@@ -906,6 +906,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
-         if (r < 0)
-                 return r;
- 
-+        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
-+            "Changing system settings via systemd is not supported on NixOS.");
-+
-         name = empty_to_null(name);
- 
-         context_read_etc_hostname(c);
-@@ -969,6 +972,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
-         if (r < 0)
-                 return r;
- 
-+        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
-+            "Changing system settings via systemd is not supported on NixOS.");
-+
-         name = empty_to_null(name);
- 
-         context_read_machine_info(c);
-diff --git a/src/locale/localed.c b/src/locale/localed.c
-index 7aa47f18c2..0a8ef68931 100644
---- a/src/locale/localed.c
-+++ b/src/locale/localed.c
-@@ -309,6 +309,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
-         if (r < 0)
-                 return r;
- 
-+        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
-+                                 "Changing system settings via systemd is not supported on NixOS.");
-+
-         use_localegen = locale_gen_check_available();
- 
-         /* If single locale without variable name is provided, then we assume it is LANG=. */
-@@ -423,6 +426,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
-         if (r < 0)
-                 return r;
- 
-+        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
-+            "Changing system settings via systemd is not supported on NixOS.");
-+
-         keymap = empty_to_null(keymap);
-         keymap_toggle = empty_to_null(keymap_toggle);
- 
-@@ -602,6 +608,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
-         if (r < 0)
-                 return r;
- 
-+        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
-+            "Changing system settings via systemd is not supported on NixOS.");
-+
-         layout = empty_to_null(layout);
-         model = empty_to_null(model);
-         variant = empty_to_null(variant);
-diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index 373574cc06..6dbf73eb42 100644
---- a/src/timedate/timedated.c
-+++ b/src/timedate/timedated.c
-@@ -665,6 +665,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
-         if (r < 0)
-                 return r;
- 
-+        if (getenv("NIXOS_STATIC_TIMEZONE"))
-+                return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
-+                    "Changing timezone via systemd is not supported when it is set in NixOS configuration.");
-+
-         if (!timezone_is_valid(z, LOG_DEBUG))
-                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z);
- 
-@@ -743,6 +747,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
-         if (r < 0)
-                 return r;
- 
-+        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
-+            "Changing system settings via systemd is not supported on NixOS.");
-+
-         if (lrtc == c->local_rtc && !fix_system)
-                 return sd_bus_reply_method_return(m, NULL);
- 
-@@ -923,6 +930,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
-         if (r < 0)
-                 return r;
- 
-+        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
-+            "Changing system settings via systemd is not supported on NixOS.");
-+
-         r = context_update_ntp_status(c, bus, m);
-         if (r < 0)
-                 return r;

pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch

···
  1 file changed, 2 insertions(+), 5 deletions(-)
 
 diff --git a/src/libsystemd/sd-hwdb/hwdb-internal.h b/src/libsystemd/sd-hwdb/hwdb-internal.h
-index 62d27f7b89..87318e041b 100644
+index 5302679a62..c681f3a984 100644
 --- a/src/libsystemd/sd-hwdb/hwdb-internal.h
 +++ b/src/libsystemd/sd-hwdb/hwdb-internal.h
 @@ -83,8 +83,5 @@ struct trie_value_entry2_f {

pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch

···
      <literal>Etc/UTC</literal>. The resulting link should lead to the
      corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index 71b2f67350..465f1c0b15 100644
+index b700f364ef..116b1cec63 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
-@@ -1280,7 +1280,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
+@@ -1282,7 +1282,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
  
          assert(ret);
  
···
          if (!f)
                  return -errno;
  
-@@ -1319,7 +1319,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
+@@ -1321,7 +1321,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
          _cleanup_strv_free_ char **zones = NULL;
          int r;
  
···
          if (!f)
                  return -errno;
  
-@@ -1431,7 +1431,7 @@ int verify_timezone(const char *name, int log_level) {
+@@ -1433,7 +1433,7 @@ int verify_timezone(const char *name, int log_level) {
          if (p - name >= PATH_MAX)
                  return -ENAMETOOLONG;
  
···
  
          fd = open(t, O_RDONLY|O_CLOEXEC);
          if (fd < 0)
-@@ -1489,7 +1489,7 @@ int get_timezone(char **ret) {
+@@ -1491,7 +1491,7 @@ int get_timezone(char **ret) {
          if (r < 0)
                  return r; /* returns EINVAL if not a symlink */
  
···
                  return -EINVAL;
  
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index 065ee896cd..1b260416c8 100644
+index 9e79f84691..1a1c75718c 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -510,7 +510,7 @@ static int process_timezone(void) {
+@@ -512,7 +512,7 @@ static int process_timezone(void) {
          if (isempty(arg_timezone))
                  return 0;
  
···
          (void) mkdir_parents(etc_localtime, 0755);
          r = symlink_atomic(e, etc_localtime);
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 86dd2cea84..4e5f03669d 100644
+index d62c5173ca..84beac064b 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1905,8 +1905,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
+@@ -1915,8 +1915,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
···
  
  static bool etc_writable(void) {
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index 6dbf73eb42..a36dd459d2 100644
+index ad483301ef..a7f22b1c86 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
 @@ -282,7 +282,7 @@ static int context_read_data(Context *c) {

pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch

···
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/locale/localectl.c b/src/locale/localectl.c
-index c23f1fa3f6..ad2eba82ad 100644
+index fb83881cc7..c47a33134a 100644
 --- a/src/locale/localectl.c
 +++ b/src/locale/localectl.c
-@@ -299,7 +299,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
+@@ -297,7 +297,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
          } state = NONE, look_for;
          int r;
  

pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch

···
  1 file changed, 3 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index 76ad51d3fb..839dcef437 100644
+index bfc86857d6..84e3e4c1db 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -4067,9 +4067,6 @@ install_data('LICENSE.GPL2',
+@@ -4277,9 +4277,6 @@ install_data('LICENSE.GPL2',
  install_subdir('LICENSES',
                 install_dir : docdir)
  

pkgs/os-specific/linux/systemd/0012-add-rootprefix-to-lookup-dir-paths.patch pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch

···
 we should again be able to discover the udev rules amongst other default
 files that I might have missed.
 ---
- src/basic/def.h | 6 ++++--
+ src/basic/constants.h | 6 ++++--
  1 file changed, 4 insertions(+), 2 deletions(-)
 
-diff --git a/src/basic/def.h b/src/basic/def.h
-index 2b4de29021..1bd61dc45f 100644
---- a/src/basic/def.h
-+++ b/src/basic/def.h
-@@ -44,13 +44,15 @@
+diff --git a/src/basic/constants.h b/src/basic/constants.h
+index 5d68cc6332..a2ccc315e1 100644
+--- a/src/basic/constants.h
++++ b/src/basic/constants.h
+@@ -73,13 +73,15 @@
          "/run/" n "\0"                          \
          "/usr/local/lib/" n "\0"                \
          "/usr/lib/" n "\0"                      \

pkgs/os-specific/linux/systemd/0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch

···
  1 file changed, 1 insertion(+)
 
 diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
-index dcee0f9006..24b03d6948 100644
+index 42111d2772..53467ac229 100644
 --- a/src/shutdown/shutdown.c
 +++ b/src/shutdown/shutdown.c
-@@ -334,6 +334,7 @@ static void init_watchdog(void) {
+@@ -335,6 +335,7 @@ static void init_watchdog(void) {
  int main(int argc, char *argv[]) {
          static const char* const dirs[] = {
                  SYSTEM_SHUTDOWN_PATH,

pkgs/os-specific/linux/systemd/0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch

···
  1 file changed, 1 insertion(+)
 
 diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index 3461d3e45f..d7d0ec2a7a 100644
+index 9c51a3367f..75d6b76a87 100644
 --- a/src/sleep/sleep.c
 +++ b/src/sleep/sleep.c
 @@ -184,6 +184,7 @@ static int execute(

pkgs/os-specific/linux/systemd/0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch

···
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index 22d3632e6e..1e8bbb242b 100644
+index 56f01f41d8..f9b8627388 100644
 --- a/src/basic/path-util.h
 +++ b/src/basic/path-util.h
 @@ -24,11 +24,11 @@

pkgs/os-specific/linux/systemd/0017-inherit-systemd-environment-when-calling-generators.patch pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch

···
  1 file changed, 8 insertions(+)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index d9e7d77913..ba3ce14bf0 100644
+index 50d092042c..898f9ed2f1 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -3693,9 +3693,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
+@@ -3714,9 +3714,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
           * adjust generated units to that. Let's pass down some bits of information that are easy for us to
           * determine (but a bit harder for generator scripts to determine), as environment variables. */
  

pkgs/os-specific/linux/systemd/0018-core-don-t-taint-on-unmerged-usr.patch pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch

···
  1 file changed, 4 deletions(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index ba3ce14bf0..03bf66ff74 100644
+index 898f9ed2f1..5040d5b105 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -4493,10 +4493,6 @@ char* manager_taint_string(const Manager *m) {
+@@ -4543,10 +4543,6 @@ char* manager_taint_string(const Manager *m) {
          if (m->taint_usr)
                  stage[n++] = "split-usr";
  

pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch

···
-From 236e9281cb158be3191c500524fbc5f397a25e03 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Nick Cao <[e-mail]>
 Date: Sun, 15 Jan 2023 20:15:55 +0800
 Subject: [PATCH] tpm2_context_init: fix driver name checking
···
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
-index ba8dfb041d..7de5d5fc77 100644
+index 259f280e0f..142e70a740 100644
 --- a/src/shared/tpm2-util.c
 +++ b/src/shared/tpm2-util.c
-@@ -192,7 +192,7 @@ int tpm2_context_init(const char *device, struct tpm2_context *ret) {
+@@ -176,7 +176,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
                  fn = strjoina("libtss2-tcti-", driver, ".so.0");
  
                  /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */
···
 +                if (!path_is_valid(fn))
                          return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 driver name '%s' not valid, refusing.", driver);
  
-                 dl = dlopen(fn, RTLD_NOW);
--- 
-2.39.0
-
+                 context->tcti_dl = dlopen(fn, RTLD_NOW);

pkgs/os-specific/linux/systemd/default.nix

···
 , bpftools
 , libbpf
 
+, withAcl ? true
 , withAnalyze ? true
 , withApparmor ? true
+, withAudit ? true
 , withCompression ? true  # adds bzip2, lz4, xz and zstd
 , withCoredump ? true
 , withCryptsetup ? true
···
 , withHostnamed ? true
 , withHwdb ? true
 , withImportd ? !stdenv.hostPlatform.isMusl
+, withKmod ? true
 , withLibBPF ? lib.versionAtLeast buildPackages.llvmPackages.clang.version "10.0"
     && stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6" # assumes hard floats
     && !stdenv.hostPlatform.isMips64   # see https://github.com/NixOS/nixpkgs/pull/194149#issuecomment-1266642211
+, withLibidn2 ? true
 , withLocaled ? true
 , withLogind ? true
 , withMachined ? true
 , withNetworkd ? true
 , withNss ? !stdenv.hostPlatform.isMusl
 , withOomd ? true
+, withPam ? true
 , withPCRE2 ? true
 , withPolkit ? true
 , withPortabled ? !stdenv.hostPlatform.isMusl
···
 assert withImportd -> withCompression;
 assert withCoredump -> withCompression;
 assert withHomed -> withCryptsetup;
+assert withHomed -> withPam;
 
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "252.5";
+  version = "253.1";
 
   # Bump this variable on every (major) version change. See below (in the meson options list) for why.
   # command:
   #  $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \
   #     jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
-  releaseTimestamp = "1667246393";
+  releaseTimestamp = "1676488940";
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname version;
···
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    hash = "sha256-cNZRTuYFMR1z6KpELeQoJahMhRl4fKuRuc3xXH3KzlM=";
+    hash = "sha256-PyAhkLxDkT5gVocCXh8bst6PBgguASjnA82xinQOtjw=";
   };
 
   # On major changes, or when otherwise required, you *must* reformat the patches,
···
     ./0004-Look-for-fsck-in-the-right-place.patch
     ./0005-Add-some-NixOS-specific-unit-directories.patch
     ./0006-Get-rid-of-a-useless-message-in-user-sessions.patch
-    ./0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
-    ./0008-Fix-hwdb-paths.patch
-    ./0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
-    ./0010-localectl-use-etc-X11-xkb-for-list-x11.patch
-    ./0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
-    ./0012-add-rootprefix-to-lookup-dir-paths.patch
-    ./0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
-    ./0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
-    ./0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
-    ./0016-pkg-config-derive-prefix-from-prefix.patch
-    ./0017-inherit-systemd-environment-when-calling-generators.patch
-    ./0018-core-don-t-taint-on-unmerged-usr.patch
-    ./0019-tpm2_context_init-fix-driver-name-checking.patch
+    ./0007-Fix-hwdb-paths.patch
+    ./0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+    ./0009-localectl-use-etc-X11-xkb-for-list-x11.patch
+    ./0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+    ./0011-add-rootprefix-to-lookup-dir-paths.patch
+    ./0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+    ./0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+    ./0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+    ./0015-pkg-config-derive-prefix-from-prefix.patch
+    ./0016-inherit-systemd-environment-when-calling-generators.patch
+    ./0017-core-don-t-taint-on-unmerged-usr.patch
+    ./0018-tpm2_context_init-fix-driver-name-checking.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
···
           # Systemd does this decision during configure time and uses ifdef's to
           # enable specific branches. We can safely ignore (nuke) the libidn "v1"
           # libraries.
-          { name = "libidn2.so.0"; pkg = libidn2; }
+          { name = "libidn2.so.0"; pkg = opt withLibidn2 libidn2; }
           { name = "libidn.so.12"; pkg = null; }
           { name = "libidn.so.11"; pkg = null; }
 
···
           # inspect-elf support
           { name = "libelf.so.1"; pkg = opt withCoredump elfutils; }
           { name = "libdw.so.1"; pkg = opt withCoredump elfutils; }
+
+          # Support for PKCS#11 in systemd-cryptsetup, systemd-cryptenroll and systemd-homed
+          { name = "libp11-kit.so.0"; pkg = opt (withHomed || withCryptsetup) p11-kit; }
         ];
 
       patchDlOpen = dl:
···
 
   buildInputs =
     [
-      acl
-      audit
-      kmod
       libxcrypt
       libcap
-      libidn2
       libuuid
       linuxHeaders
-      pam
       bashInteractive # for patch shebangs
     ]
 
     ++ lib.optionals wantGcrypt [ libgcrypt libgpg-error ]
     ++ lib.optional withTests glib
+    ++ lib.optional withAcl acl
     ++ lib.optional withApparmor libapparmor
+    ++ lib.optional withAudit audit
     ++ lib.optional wantCurl (lib.getDev curl)
     ++ lib.optionals withCompression [ bzip2 lz4 xz zstd ]
     ++ lib.optional withCoredump elfutils
     ++ lib.optional withCryptsetup (lib.getDev cryptsetup.dev)
     ++ lib.optional withEfi gnu-efi
     ++ lib.optional withKexectools kexec-tools
+    ++ lib.optional withKmod kmod
+    ++ lib.optional withLibidn2 libidn2
     ++ lib.optional withLibseccomp libseccomp
     ++ lib.optional withNetworkd iptables
+    ++ lib.optional withPam pam
     ++ lib.optional withPCRE2 pcre2
     ++ lib.optional withSelinux libselinux
     ++ lib.optional withRemote libmicrohttpd
-    ++ lib.optionals withHomed [ p11-kit ]
+    ++ lib.optionals (withHomed || withCryptsetup) [ p11-kit ]
     ++ lib.optionals (withHomed || withCryptsetup) [ libfido2 ]
     ++ lib.optionals withLibBPF [ libbpf ]
     ++ lib.optional withTpm2Tss tpm2-tss
···
     "-Ddbuspolicydir=${placeholder "out"}/share/dbus-1/system.d"
     "-Ddbussessionservicedir=${placeholder "out"}/share/dbus-1/services"
     "-Ddbussystemservicedir=${placeholder "out"}/share/dbus-1/system-services"
+    "-Dpam=${lib.boolToString withPam}"
     "-Dpamconfdir=${placeholder "out"}/etc/pam.d"
     "-Drootprefix=${placeholder "out"}"
     "-Dpkgconfiglibdir=${placeholder "dev"}/lib/pkgconfig"
···
     "-Dglib=${lib.boolToString withTests}"
     # while we do not run tests we should also not build them. Removes about 600 targets
     "-Dtests=false"
+    "-Dacl=${lib.boolToString withAcl}"
     "-Danalyze=${lib.boolToString withAnalyze}"
+    "-Daudit=${lib.boolToString withAudit}"
     "-Dgcrypt=${lib.boolToString wantGcrypt}"
     "-Dimportd=${lib.boolToString withImportd}"
     "-Dlz4=${lib.boolToString withCompression}"
···
     "-Dsplit-usr=false"
     "-Dlibcurl=${lib.boolToString wantCurl}"
     "-Dlibidn=false"
-    "-Dlibidn2=true"
+    "-Dlibidn2=${lib.boolToString withLibidn2}"
     "-Dquotacheck=false"
     "-Dldconfig=false"
     "-Dsmack=true"
···
     "-Dsysvinit-path="
     "-Dsysvrcnd-path="
 
-    "-Dkmod-path=${kmod}/bin/kmod"
     "-Dsulogin-path=${util-linux}/bin/sulogin"
     "-Dmount-path=${util-linux}/bin/mount"
     "-Dumount-path=${util-linux}/bin/umount"
···
     # more frequent development builds
     "-Dman=true"
 
+    # Temporary disable the ukify tool. see https://github.com/NixOS/nixpkgs/pull/216826#issuecomment-1465228824
+    "-Dukify=false"
+
     "-Defi=${lib.boolToString withEfi}"
     "-Dgnu-efi=${lib.boolToString withEfi}"
   ] ++ lib.optionals withEfi [
···
   ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     "-Dgshadow=false"
     "-Didn=false"
+  ] ++ lib.optionals withKmod [
+    "-Dkmod=true"
+    "-Dkmod-path=${kmod}/bin/kmod"
   ];
   preConfigure =
     let
···
           replacement = "${coreutils}/bin/cat";
           where = [ "test/create-busybox-container" "test/test-execute/exec-noexecpaths-simple.service" "src/journal/cat.c" ];
         }
-        { search = "/sbin/modprobe"; replacement = "${lib.getBin kmod}/sbin/modprobe"; where = [ "units/modprobe@.service" ]; }
         {
           search = "/usr/lib/systemd/systemd-fsck";
           replacement = "$out/lib/systemd/systemd-fsck";
···
             "src/import/pull-tar.c"
           ];
         }
+      ] ++ lib.optionals withKmod [
+        { search = "/sbin/modprobe"; replacement = "${lib.getBin kmod}/sbin/modprobe"; where = [ "units/modprobe@.service" ]; }
       ];
 
       # { replacement, search, where } -> List[str]
···
 
   postInstall = ''
     mkdir -p $out/example/systemd
-    mv $out/lib/{modules-load.d,binfmt.d,sysctl.d,tmpfiles.d} $out/example
+    mv $out/lib/{binfmt.d,sysctl.d,tmpfiles.d} $out/example
     mv $out/lib/systemd/{system,user} $out/example/systemd
 
     rm -rf $out/etc/systemd/system
···
     find $out -name "*kernel-install*" -exec rm {} \;
   '' + lib.optionalString (!withDocumentation) ''
     rm -rf $out/share/doc
+  '' + lib.optionalString withKmod ''
+    mv $out/lib/modules-load.d $out/example
   '';
 
   # Avoid *.EFI binary stripping. At least on aarch64-linux strip
···
     # runtime; otherwise we can't and we need to reboot.
     interfaceVersion = 2;
 
-    inherit withCryptsetup withHostnamed withImportd withLocaled withMachined withPortabled withTimedated withUtmp util-linux kmod kbd;
+    inherit withCryptsetup withHostnamed withImportd withKmod withLocaled withMachined withPortabled withTimedated withUtmp util-linux kmod kbd;
 
     tests = {
       inherit (nixosTests) switchTest;

pkgs/servers/hydron/default.nix

···
 , fetchFromGitHub
 , gitUpdater
 , pkg-config
-, ffmpeg
+, ffmpeg_4
 }:
 
 buildGoModule rec {
···
   proxyVendor = true;
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ ffmpeg ];
+  buildInputs = [ ffmpeg_4 ];
 
   passthru.updateScript = gitUpdater {
     rev-prefix = "v";

pkgs/servers/irc/solanum/default.nix

···
   doCheck = !stdenv.isDarwin;
 
   enableParallelBuilding = true;
+  # Missing install depends:
+  #   ...-binutils-2.40/bin/ld: cannot find ./.libs/libircd.so: No such file or directory
+  #   collect2: error: ld returned 1 exit status
+  #   make[4]: *** [Makefile:634: solanum] Error 1
+  enableParallelInstalling = false;
 
   meta = with lib; {
     description = "An IRCd for unified networks";

pkgs/servers/misc/oven-media-engine/default.nix

···
 , perl
 , openssl
 , zlib
-, ffmpeg
+, ffmpeg_4
 , libvpx
 , libopus
 , libuuid
···
   enableParallelBuilding = true;
 
   nativeBuildInputs = [ bc pkg-config perl ];
-  buildInputs = [ openssl srt zlib ffmpeg libvpx libopus srtp jemalloc pcre2 libuuid hiredis ];
+  buildInputs = [ openssl srt zlib ffmpeg_4 libvpx libopus srtp jemalloc pcre2 libuuid hiredis ];
 
   preBuild = ''
     patchShebangs core/colorg++

pkgs/servers/monitoring/net-snmp/default.nix

···
     ++ lib.optional withPerlTools perlWithPkgs;
 
   enableParallelBuilding = true;
+  # Missing dependencies during relinking:
+  #   ./.libs/libnetsnmpagent.so: file not recognized: file format not recognized
+  enableParallelInstalling = false;
   doCheck = false;  # tries to use networking
 
   postInstall = ''

pkgs/servers/tvheadend/default.nix

···
 , bzip2
 , dbus
 , dtv-scan-tables
-, ffmpeg
+, ffmpeg_4
 , gettext
 , gnutar
 , gzip
···
     avahi
     bzip2
     dbus
-    ffmpeg
+    ffmpeg_4 # depends on libav
     gettext
     gzip
     libiconv

pkgs/servers/x11/xorg/builder.sh

···
 
 
 enableParallelBuilding=1
+enableParallelInstalling=1
 
 genericBuild

pkgs/stdenv/generic/make-derivation.nix

···
     } // lib.optionalAttrs (enableParallelBuilding) {
       inherit enableParallelBuilding;
       enableParallelChecking = attrs.enableParallelChecking or true;
+      enableParallelInstalling = attrs.enableParallelInstalling or true;
     } // lib.optionalAttrs (hardeningDisable != [] || hardeningEnable != [] || stdenv.hostPlatform.isMusl) {
       NIX_HARDENING_ENABLE = enabledHardeningOptions;
     } // lib.optionalAttrs (stdenv.hostPlatform.isx86_64 && stdenv.hostPlatform ? gcc.arch) {

pkgs/stdenv/generic/setup.sh

···
 
     # shellcheck disable=SC2086
     local flagsArray=(
+        ${enableParallelInstalling:+-j${NIX_BUILD_CORES}}
         SHELL=$SHELL
     )
     _accumFlagsArray makeFlags makeFlagsArray installFlags installFlagsArray

pkgs/test/stdenv/default.nix

···
 { stdenv
 , pkgs
 , lib
-, runCommand
 , testers
 }:
 
 let
   # early enough not to rebuild gcc but late enough to have patchelf
   earlyPkgs = stdenv.__bootPackages.stdenv.__bootPackages;
+  earlierPkgs = stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages;
   # use a early stdenv so when hacking on stdenv this test can be run quickly
   bootStdenv = stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv;
   pkgsStructured = import pkgs.path { config = { structuredAttrsByDefault = true; }; inherit (stdenv.hostPlatform) system; };
   bootStdenvStructuredAttrsByDefault = pkgsStructured.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv;
+
+  runCommand = earlierPkgs.runCommand;
 
 
   ccWrapperSubstitutionsTest = { name, stdenv', extraAttrs ? { } }:
···
   hooks = lib.recurseIntoAttrs (import ./hooks.nix { stdenv = bootStdenv; pkgs = earlyPkgs; inherit lib; });
 
   outputs-no-out = runCommand "outputs-no-out-assert" {
-    result = testers.testBuildFailure (stdenv.mkDerivation {
+    result = earlierPkgs.testers.testBuildFailure (bootStdenv.mkDerivation {
       NIX_DEBUG = 1;
       name = "outputs-no-out";
       outputs = ["foo"];
···
 
     # Assumption: the first output* variable to be configured is
     #   _overrideFirst outputDev "dev" "out"
-    expectedMsg = "error: _assignFirst: could not find a non-empty variable to assign to outputDev.\n       The following variables were all unset or empty:\n           dev out";
+    expectedMsg = "error: _assignFirst: could not find a non-empty variable whose name to assign to outputDev.\n       The following variables were all unset or empty:\n           dev out";
   } ''
     grep -F "$expectedMsg" $result/testBuildFailure.log >/dev/null
     touch $out

pkgs/tools/audio/acoustid-fingerprinter/default.nix

···
-{ lib, stdenv, fetchurl, fetchpatch, cmake, pkg-config, qt4, taglib, chromaprint, ffmpeg }:
+{ lib, stdenv, fetchurl, fetchpatch, cmake, pkg-config, qt4, taglib, chromaprint, ffmpeg_4 }:
 
 stdenv.mkDerivation rec {
   pname = "acoustid-fingerprinter";
···
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ qt4 taglib chromaprint ffmpeg ];
+  buildInputs = [ qt4 taglib chromaprint ffmpeg_4 ];
 
   cmakeFlags = [ "-DTAGLIB_MIN_VERSION=${lib.getVersion taglib}" ];
 

pkgs/tools/audio/loudgain/default.nix

···
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, ffmpeg, libebur128
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, ffmpeg_4, libebur128
 , libresample, taglib, zlib }:
 
 stdenv.mkDerivation rec {
···
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ ffmpeg libebur128 libresample taglib zlib ];
+  buildInputs = [ ffmpeg_4 libebur128 libresample taglib zlib ];
 
   postInstall = ''
     sed -e "1aPATH=$out/bin:\$PATH" -i "$out/bin/rgbpm"

pkgs/tools/filesystems/xfsprogs/default.nix

···
   propagatedBuildInputs = [ libuuid ]; # Dev headers include <uuid/uuid.h>
 
   enableParallelBuilding = true;
+  # Install fails as:
+  #   make[1]: *** No rule to make target '\', needed by 'kmem.lo'.  Stop.
+  enableParallelInstalling = false;
 
   # @sbindir@ is replaced with /run/current-system/sw/bin to fix dependency cycles
   preConfigure = ''

pkgs/tools/graphics/asymptote/default.nix

···
   '';
 
   enableParallelBuilding = true;
+  # Missing install depends:
+  #   ...-coreutils-9.1/bin/install: cannot stat 'asy-keywords.el': No such file or directory
+  #   make: *** [Makefile:272: install-asy] Error 1
+  enableParallelInstalling = false;
 
   meta = with lib; {
     description =  "A tool for programming graphics intended to replace Metapost";

pkgs/tools/graphics/vulkan-cts/default.nix

···
 , fetchFromGitHub
 , fetchurl
 , cmake
-, ffmpeg
+, ffmpeg_4
 , libdrm
 , libglvnd
 , libffi
···
   '';
 
   buildInputs = [
-    ffmpeg
+    ffmpeg_4
     libdrm
     libffi
     libglvnd

pkgs/tools/networking/dnsmasq/default.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "dnsmasq";
-  version = "2.88";
+  version = "2.89";
 
   src = fetchurl {
     url = "https://www.thekelleys.org.uk/dnsmasq/${pname}-${version}.tar.xz";
-    sha256 = "sha256-I1RN7aEDQMBTvqbxWpP+1up/WqqFMWv8Zx/6bSL7wbM=";
+    sha256 = "sha256-Ar0jA0bPC51ZCfXhUd8WiycHEDeF62FrVmhYVa3rtgk=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''

pkgs/tools/networking/modemmanager/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "modemmanager";
-  version = "1.20.4";
+  version = "1.20.6";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mobile-broadband";
     repo = "ModemManager";
     rev = version;
-    hash = "sha256-OWP23EQ7a8rghhV7AC9yinCxRI0xwcntB5dl9XtgK6M=";
+    hash = "sha256-/A4WTsUQVeZDi5ei6qBvqoWYLKdRcZaYZU8/qWOPrvM=";
   };
 
   patches = [

pkgs/tools/networking/networkmanager/default.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "networkmanager";
-  version = "1.40.12";
+  version = "1.42.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/NetworkManager/${lib.versions.majorMinor version}/NetworkManager-${version}.tar.xz";
-    sha256 = "sha256-wCJ+BKttAylmLfoKftxGbgQGJek2odjo4CoFM6cRca8=";
+    sha256 = "sha256-3P6cXJCdOMga6VzP6JWjKKKhTBHaz7f1B760Be/OBYA=";
   };
 
   outputs = [ "out" "dev" "devdoc" "man" "doc" ];
···
     "-Dfirewalld_zone=false"
     "-Dtests=no"
     "-Dcrypto=gnutls"
+    "-Dmobile_broadband_provider_info_database=${mobile-broadband-provider-info}/share/mobile-broadband-provider-info/serviceproviders.xml"
   ];
 
   patches = [

pkgs/tools/networking/networkmanager/fix-install-paths.patch

···
 diff --git a/meson.build b/meson.build
-index 300e71319c..2a9fba7116 100644
+index 6813e52ac1..ecdb78ca54 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -996,9 +996,9 @@ meson.add_install_script(
+@@ -999,9 +999,9 @@ meson.add_install_script(
    join_paths('tools', 'meson-post-install.sh'),
    nm_datadir,
    nm_bindir,

pkgs/tools/networking/networkmanager/fix-paths.patch

···
  ExecStart=@sbindir@/NetworkManager --no-daemon
  Restart=on-failure
 diff --git a/src/core/devices/nm-device.c b/src/core/devices/nm-device.c
-index c51da9ac82..ad67a301ef 100644
+index 3565c04d59..52c58fec24 100644
 --- a/src/core/devices/nm-device.c
 +++ b/src/core/devices/nm-device.c
-@@ -13879,14 +13879,14 @@ nm_device_start_ip_check(NMDevice *self)
+@@ -14005,14 +14005,14 @@ nm_device_start_ip_check(NMDevice *self)
              gw = nm_l3_config_data_get_best_default_route(l3cd, AF_INET);
              if (gw) {
-                 _nm_utils_inet4_ntop(NMP_OBJECT_CAST_IP4_ROUTE(gw)->gateway, buf);
+                 nm_inet4_ntop(NMP_OBJECT_CAST_IP4_ROUTE(gw)->gateway, buf);
 -                ping_binary = nm_utils_find_helper("ping", "/usr/bin/ping", NULL);
 +                ping_binary = "@iputils@/bin/ping";
                  log_domain  = LOGD_IP4;
···
          } else if (priv->ip_data_6.state == NM_DEVICE_IP_STATE_READY) {
              gw = nm_l3_config_data_get_best_default_route(l3cd, AF_INET6);
              if (gw) {
-                 _nm_utils_inet6_ntop(&NMP_OBJECT_CAST_IP6_ROUTE(gw)->gateway, buf);
+                 nm_inet6_ntop(&NMP_OBJECT_CAST_IP6_ROUTE(gw)->gateway, buf);
 -                ping_binary = nm_utils_find_helper("ping6", "/usr/bin/ping6", NULL);
 +                ping_binary = "@iputils@/bin/ping";
                  log_domain  = LOGD_IP6;
              }
          }
 diff --git a/src/libnm-client-impl/meson.build b/src/libnm-client-impl/meson.build
-index 46464a6328..d943d4351a 100644
+index 143126c51a..a7143443ec 100644
 --- a/src/libnm-client-impl/meson.build
 +++ b/src/libnm-client-impl/meson.build
-@@ -171,7 +171,6 @@ if enable_introspection
+@@ -172,7 +172,6 @@ if enable_introspection
        input: libnm_core_settings_sources,
        output: 'nm-propery-infos-' + info + '.xml',
        command: [
···
          join_paths(meson.source_root(), 'tools', 'generate-docs-nm-property-infos.py'),
          info,
          '@OUTPUT@',
-@@ -228,7 +227,6 @@ if enable_introspection
+@@ -229,7 +228,6 @@ if enable_introspection
        'env',
        'GI_TYPELIB_PATH=' + gi_typelib_path,
        'LD_LIBRARY_PATH=' + ld_library_path,
···
      g_ptr_array_add(argv, (char *) arg1);
  
 diff --git a/src/libnmc-base/nm-vpn-helpers.c b/src/libnmc-base/nm-vpn-helpers.c
-index 7ad5bee509..2641dbf637 100644
+index 476fbe518e..2641dbf637 100644
 --- a/src/libnmc-base/nm-vpn-helpers.c
 +++ b/src/libnmc-base/nm-vpn-helpers.c
 @@ -198,25 +198,8 @@ nm_vpn_openconnect_authenticate_helper(const char *host,
···
      const char *const   *iter;
      const char          *path;
 -    const char *const    DEFAULT_PATHS[] = {
--           "/sbin/",
--           "/usr/sbin/",
--           "/usr/local/sbin/",
--           "/bin/",
--           "/usr/bin/",
--           "/usr/local/bin/",
--           NULL,
+-        "/sbin/",
+-        "/usr/sbin/",
+-        "/usr/local/sbin/",
+-        "/bin/",
+-        "/usr/bin/",
+-        "/usr/local/bin/",
+-        NULL,
 -    };
  
 -    path = nm_utils_file_search_in_paths("openconnect",
···
      if (!g_spawn_sync(NULL,
                        (char **) NM_MAKE_STRV(path, "--authenticate", host),
 diff --git a/src/libnmc-setting/meson.build b/src/libnmc-setting/meson.build
-index 49314cad2e..6d52624699 100644
+index cf8a21fc80..61b992a50e 100644
 --- a/src/libnmc-setting/meson.build
 +++ b/src/libnmc-setting/meson.build
 @@ -7,7 +7,6 @@ if enable_docs
···
        '@OUTPUT@',
        nm_property_infos_xml['nmcli'],
 diff --git a/src/tests/client/meson.build b/src/tests/client/meson.build
-index b2e455bbbd..a12ebf212a 100644
+index 6dc0f2a2c8..0a32977a59 100644
 --- a/src/tests/client/meson.build
 +++ b/src/tests/client/meson.build
 @@ -6,7 +6,6 @@ test(
···
      build_root,
      source_root,
 -    python.path(),
+     '--',
    ],
-   timeout: 120,
- )
+   env: [

pkgs/tools/networking/vpnc/default.nix

···
   '';
 
   enableParallelBuilding = true;
+  # Missing install depends:
+  #   install: target '...-vpnc-unstable-2021-11-04/share/doc/vpnc': No such file or directory
+  #   make: *** [Makefile:149: install-doc] Error 1
+  enableParallelInstalling = false;
 
   meta = with lib; {
     homepage = "https://davidepucci.it/doc/vpnc/";

pkgs/tools/video/harvid/default.nix

···
-{ lib, stdenv, fetchFromGitHub, fetchpatch, ffmpeg, libjpeg, libpng, pkg-config }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, ffmpeg_4, libjpeg, libpng, pkg-config }:
 
 stdenv.mkDerivation rec {
   pname = "harvid";
···
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ ffmpeg libjpeg libpng ];
+  buildInputs = [ ffmpeg_4 libjpeg libpng ];
 
   makeFlags = [ "DESTDIR=$(out)" "libdir=\"/lib\"" ];
 

pkgs/tools/video/untrunc-anthwlock/default.nix

···
-{ lib, stdenv, fetchFromGitHub, ffmpeg, libui }:
+{ lib, stdenv, fetchFromGitHub, ffmpeg_4, libui }:
 
 stdenv.mkDerivation {
   pname = "untrunc-anthwlock";
···
     sha256 = "14i2lq68q990hnm2kkfamlsi67bcml85zl8yjsyxc5h8ncc2f3dp";
   };
 
-  buildInputs = [ ffmpeg libui ];
+  buildInputs = [ ffmpeg_4 libui ];
 
   buildPhase = ''
     runHook preBuild

pkgs/tools/video/xjadeo/default.nix

···
-{ lib, stdenv, autoreconfHook, fetchFromGitHub, ffmpeg, freetype, libGLU
+{ lib, stdenv, autoreconfHook, fetchFromGitHub, ffmpeg_4, freetype, libGLU
 , libjack2, liblo, libX11, libXv, pkg-config, portmidi, xorg }:
 
 stdenv.mkDerivation rec {
···
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [
-    ffmpeg
+    ffmpeg_4
     libjack2
     libX11
     xorg.libXext

pkgs/top-level/aliases.nix

···
   pidginwindowmerge = throw "'pidginwindowmerge' has been renamed to/replaced by 'pidgin-window-merge'"; # Converted to throw 2022-02-22
   pifi = throw "pifi has been removed from nixpkgs, as it is no longer developed"; # Added 2022-01-19
   ping = throw "'ping' does not build with recent valac and has been removed. If you are just looking for the 'ping' command use either 'iputils' or 'inetutils'"; # Added 2022-04-18
+  pipewire-media-session = throw "pipewire-media-session is no longer maintained and has been removed. Please use Wireplumber instead.";
   piwik = throw "'piwik' has been renamed to/replaced by 'matomo'"; # Converted to throw 2022-02-22
   pixie = throw "pixie has been removed: abandoned by upstream"; # Added 2022-04-21
   pkgconfig = pkg-config; # Added 2018-02-02, moved to aliases.nix 2021-01-18

pkgs/top-level/all-packages.nix

···
 
   tinycbor = callPackage ../development/libraries/tinycbor { };
 
+  tinycompress = callPackage ../development/libraries/tinycompress { };
+
   tinyfecvpn = callPackage ../tools/networking/tinyfecvpn { };
 
   tinygltf = callPackage ../development/libraries/tinygltf { };
···
       /**/ if platform.isDarwin then 11
       else if platform.isFreeBSD then 12
       else if platform.isAndroid then 12
-      else if platform.system == "armv6l-linux" then 7  # This fixes armv6 cross-compilation
       else if platform.isLinux then 11
       else if platform.isWasm then 12
       else latest_version;
···
     ffmpeg = ffmpeg-headless;
   };
 
-  pipewire-media-session = callPackage ../development/libraries/pipewire/media-session.nix { };
-
   pipewire_0_2 = callPackage ../development/libraries/pipewire/0.2.nix { };
   wireplumber = callPackage ../development/libraries/pipewire/wireplumber.nix { };
 
···
     mkRuby
     ruby_2_7
     ruby_3_0
-    ruby_3_1;
+    ruby_3_1
+    ruby_3_2;
 
   ruby = ruby_2_7;
   rubyPackages = rubyPackages_2_7;
···
   rubyPackages_2_7 = recurseIntoAttrs ruby_2_7.gems;
   rubyPackages_3_0 = recurseIntoAttrs ruby_3_0.gems;
   rubyPackages_3_1 = recurseIntoAttrs ruby_3_1.gems;
+  rubyPackages_3_2 = recurseIntoAttrs ruby_3_2.gems;
 
   mruby = callPackage ../development/compilers/mruby { };
 
···
 
   gnumake = callPackage ../development/tools/build-managers/gnumake { };
   gnumake42 = callPackage ../development/tools/build-managers/gnumake/4.2 { };
-  # openjdk-17 fails on 4.4.1. Provide 4.4 until we fix it.
-  gnumake44 = callPackage ../development/tools/build-managers/gnumake/4.4 { };
 
   go-licenses = callPackage ../development/tools/misc/go-licenses  { };
 
···
   # update to ffmpeg
   # Packages which use ffmpeg as a library, should pin to the relevant major
   # version number which the upstream support.
-  ffmpeg = ffmpeg_4;
-  ffmpeg-headless = ffmpeg_4-headless;
-  ffmpeg-full = ffmpeg_4-full;
+  ffmpeg = ffmpeg_5;
+  ffmpeg-headless = ffmpeg_5-headless;
+  ffmpeg-full = ffmpeg_5-full;
 
   ffmpegthumbnailer = callPackage ../development/libraries/ffmpegthumbnailer { };
 
···
   };
   systemdMinimal = systemd.override {
     pname = "systemd-minimal";
+    withAcl = false;
     withAnalyze = false;
     withApparmor = false;
+    withAudit = false;
     withCompression = false;
     withCoredump = false;
     withCryptsetup = false;
···
     withHomed = false;
     withHwdb = false;
     withImportd = false;
+    withKmod = false;
     withLibBPF = false;
+    withLibidn2 = false;
     withLocaled = false;
     withLogind = false;
     withMachined = false;
···
     withNss = false;
     withOomd = false;
     withPCRE2 = false;
+    withPam = false;
     withPolkit = false;
     withPortabled = false;
     withRemote = false;
···
   };
   systemdStage1 = systemdMinimal.override {
     pname = "systemd-stage-1";
+    withAcl = true;
     withCryptsetup = true;
     withFido2 = true;
+    withKmod = true;
     withTpm2Tss = true;
   };
   systemdStage1Network = systemdStage1.override {
     pname = "systemd-stage-1-network";
     withNetworkd = true;
+    withLibidn2 = true;
   };