Merge #144730: branch 'staging-next'

doc/languages-frameworks/rust.section.md

···
 `lib.fakeHash` as a stub hash. Building the package (and thus the
 vendored dependencies) will then inform you of the correct hash.
 
+### Cargo features {#cargo-features}
+
+You can disable default features using `buildNoDefaultFeatures`, and
+extra features can be added with `buildFeatures`.
+
+If you want to use different features for check phase, you can use
+`checkNoDefaultFeatures` and `checkFeatures`. They are only passed to
+`cargo test` and not `cargo build`. If left unset, they default to
+`buildNoDefaultFeatures` and `buildFeatures`.
+
+For example:
+
+```nix
+rustPlatform.buildRustPackage rec {
+  pname = "myproject";
+  version = "1.0.0";
+
+  buildNoDefaultFeatures = true;
+  buildFeatures = [ "color" "net" ];
+
+  # disable network features in tests
+  checkFeatures = [ "color" ];
+
+  # ...
+}
+```
+
 ### Cross compilation {#cross-compilation}
 
 By default, Rust packages are compiled for the host platform, just like any
···
 Please note that the code will be compiled twice here: once in `release` mode
 for the `buildPhase`, and again in `debug` mode for the `checkPhase`.
 
-Test flags, e.g., `--features xxx/yyy`, can be passed to `cargo test` via the
+Test flags, e.g., `--package foo`, can be passed to `cargo test` via the
 `cargoTestFlags` attribute.
 
 Another attribute, called `checkFlags`, is used to pass arguments to the test
···
 * `cargoBuildHook`: use Cargo to build a crate. If the crate to be
   built is a crate in e.g. a Cargo workspace, the relative path to the
   crate to build can be set through the optional `buildAndTestSubdir`
-  environment variable. Additional Cargo build flags can be passed
-  through `cargoBuildFlags`.
+  environment variable. Features can be specified with
+  `cargoBuildNoDefaultFeatures` and `cargoBuildFeatures`. Additional
+  Cargo build flags can be passed through `cargoBuildFlags`.
 * `maturinBuildHook`: use [Maturin](https://github.com/PyO3/maturin)
   to build a Python wheel. Similar to `cargoBuildHook`, the optional
   variable `buildAndTestSubdir` can be used to build a crate in a
   Cargo workspace. Additional Maturin flags can be passed through
   `maturinBuildFlags`.
 * `cargoCheckHook`: run tests using Cargo. The build type for checks
-  can be set using `cargoCheckType`. Additional flags can be passed to
-  the tests using `checkFlags` and `checkFlagsArray`. By default,
-  tests are run in parallel. This can be disabled by setting
-  `dontUseCargoParallelTests`.
+  can be set using `cargoCheckType`. Features can be specified with
+  `cargoCheckNoDefaultFeaatures` and `cargoCheckFeatures`. Additional
+  flags can be passed to the tests using `checkFlags` and
+  `checkFlagsArray`. By default, tests are run in parallel. This can
+  be disabled by setting `dontUseCargoParallelTests`.
 * `cargoInstallHook`: install binaries and static/shared libraries
   that were built using `cargoBuildHook`.
 

nixos/doc/manual/from_md/release-notes/rl-2111.section.xml

···
       </listitem>
       <listitem>
         <para>
+          The <literal>fluidsynth_1</literal> attribute has been
+          removed, as this legacy version is no longer needed in
+          nixpkgs. The actively maintained 2.x series is available as
+          <literal>fluidsynth</literal> unchanged.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           Nextcloud 20 (<literal>pkgs.nextcloud20</literal>) has been
           dropped because it was EOLed by upstream in 2021-10.
         </para>

nixos/doc/manual/release-notes/rl-2111.section.md

···
 - The `services.mosquitto` module has been rewritten to support multiple listeners and per-listener configuration.
   Module configurations from previous releases will no longer work and must be updated.
 
+- The `fluidsynth_1` attribute has been removed, as this legacy version is no longer needed in nixpkgs. The actively maintained 2.x series is available as `fluidsynth` unchanged.
+
 - Nextcloud 20 (`pkgs.nextcloud20`) has been dropped because it was EOLed by upstream in 2021-10.
 
 - The `virtualisation.pathsInNixDB` option was renamed

nixos/modules/security/pam.nix

···
         '';
       };
 
+      ttyAudit = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Enable or disable TTY auditing for specified users
+          '';
+        };
+
+        enablePattern = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = ''
+            For each user matching one of comma-separated
+            glob patterns, enable TTY auditing
+          '';
+        };
+
+        disablePattern = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = ''
+            For each user matching one of comma-separated
+            glob patterns, disable TTY auditing
+          '';
+        };
+
+        openOnly = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Set the TTY audit flag when opening the session,
+            but do not restore it when closing the session.
+            Using this option is necessary for some services
+            that don't fork() to run the authenticated session,
+            such as sudo.
+          '';
+        };
+      };
+
       forwardXAuth = mkOption {
         default = false;
         type = types.bool;
···
               "session ${
                 if config.boot.isContainer then "optional" else "required"
               } pam_loginuid.so"}
+          ${optionalString cfg.ttyAudit.enable
+              "session required ${pkgs.pam}/lib/security/pam_tty_audit.so
+                open_only=${toString cfg.ttyAudit.openOnly}
+                ${optionalString (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"}
+                ${optionalString (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"}
+              "}
           ${optionalString cfg.makeHomeDir
               "session required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=0077"}
           ${optionalString cfg.updateWtmp

nixos/tests/all-tests.nix

···
   kerberos = handleTest ./kerberos/default.nix {};
   kernel-generic = handleTest ./kernel-generic.nix {};
   kernel-latest-ath-user-regd = handleTest ./kernel-latest-ath-user-regd.nix {};
+  kexec = handleTest ./kexec.nix {};
   keycloak = discoverTests (import ./keycloak.nix);
   keymap = handleTest ./keymap.nix {};
   knot = handleTest ./knot.nix {};

nixos/tests/kexec.nix

···
   name = "kexec";
   meta = with lib.maintainers; {
     maintainers = [ eelco ];
-    # Currently hangs forever; last output is:
-    #     machine # [   10.239914] dhcpcd[707]: eth0: adding default route via fe80::2
-    #     machine: waiting for the VM to finish booting
-    #     machine # Cannot find the ESP partition mount point.
-    #     machine # [   28.681197] nscd[692]: 692 checking for monitored file `/etc/netgroup': No such file or directory
-    broken = true;
   };
 
   machine = { ... }:
···
   testScript =
     ''
       machine.wait_for_unit("multi-user.target")
+      machine.succeed('kexec --load /run/current-system/kernel --initrd /run/current-system/initrd --command-line "$(</proc/cmdline)"')
       machine.execute("systemctl kexec >&2 &", check_return=False)
       machine.connected = False
+      machine.connect()
       machine.wait_for_unit("multi-user.target")
+      machine.shutdown()
     '';
 })

pkgs/applications/audio/cdparanoia/default.nix

···
     cp ${gnu-config}/config.guess configure.guess
   '';
 
+  # Build system reuses the same object file names for shared and static
+  # library. Occasionally fails in the middle:
+  #    gcc -O2 -fsigned-char -g -O2 -c scan_devices.c
+  #    rm  -f *.o core *~ *.out
+  #    gcc -O2 -fsigned-char -g -O2 -fpic -c scan_devices.c
+  #    gcc -fpic -shared -o libcdda_interface.so.0.10.2 ... scan_devices.o ...
+  #    scan_devices.o: file not recognized: file format not recognized
+  enableParallelBuilding = false;
+
   meta = with lib; {
     homepage = "https://xiph.org/paranoia";
     description = "A tool and library for reading digital audio from CDs";

pkgs/applications/audio/espeak-ng/default.nix

···
     "--with-mbrola=${if mbrolaSupport then "yes" else "no"}"
   ];
 
+  # Current release lacks dependencies on local espeak-ng:
+  #  cd dictsource && ESPEAK_DATA_PATH=/build/espeak-ng LD_LIBRARY_PATH=../src: ../src/espeak-ng --compile=yue && cd ..
+  #  bash: line 1: ../src/espeak-ng: No such file or directory
+  # Should be fixed in next release: https://github.com/espeak-ng/espeak-ng/pull/1029
+  enableParallelBuilding = false;
+
   postInstall = lib.optionalString stdenv.isLinux ''
     patchelf --set-rpath "$(patchelf --print-rpath $out/bin/espeak-ng)" $out/bin/speak-ng
   '';

pkgs/applications/audio/fluidsynth/default.nix

···
 { stdenv, lib, fetchFromGitHub, pkg-config, cmake
 , alsa-lib, glib, libjack2, libsndfile, libpulseaudio
 , AudioUnit, CoreAudio, CoreMIDI, CoreServices
-, version ? "2"
 }:
 
-let
-  versionMap = {
-    "1" = {
-      fluidsynthVersion = "1.1.11";
-      sha256 = "0n75jq3xgq46hfmjkaaxz3gic77shs4fzajq40c8gk043i84xbdh";
-    };
-    "2" = {
-      fluidsynthVersion = "2.2.3";
-      sha256 = "0x5808d03ym23np17nl8gfbkx3c4y3d7jyyr2222wn2prswbb6x3";
-    };
-  };
-in
-
-with versionMap.${version};
-
-stdenv.mkDerivation  {
-  name = "fluidsynth-${fluidsynthVersion}";
-  version = fluidsynthVersion;
+stdenv.mkDerivation rec {
+  pname = "fluidsynth";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
-    rev = "v${fluidsynthVersion}";
-    inherit sha256;
+    rev = "v${version}";
+    sha256 = "0x5808d03ym23np17nl8gfbkx3c4y3d7jyyr2222wn2prswbb6x3";
   };
 
   nativeBuildInputs = [ pkg-config cmake ];

pkgs/applications/audio/ncspot/default.nix

···
 , withMPRIS ? false, dbus ? null
 }:
 
-let
-  features = [ "cursive/pancurses-backend" ]
-    ++ lib.optional withALSA "alsa_backend"
-    ++ lib.optional withPulseAudio "pulseaudio_backend"
-    ++ lib.optional withPortAudio "portaudio_backend"
-    ++ lib.optional withMPRIS "mpris";
-in
 rustPlatform.buildRustPackage rec {
   pname = "ncspot";
   version = "0.9.0";
···
 
   cargoSha256 = "0sdbba32f56z2q7kha5fxw2f00hikbz9sf4zl4wfl2i9b13j7mj0";
 
-  cargoBuildFlags = [ "--no-default-features" "--features" "${lib.concatStringsSep "," features}" ];
-
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ ncurses openssl ]
···
     ++ lib.optional withPulseAudio libpulseaudio
     ++ lib.optional withPortAudio portaudio
     ++ lib.optional withMPRIS dbus;
+
+  buildNoDefaultFeatures = true;
+  buildFeatures = [ "cursive/pancurses-backend" ]
+    ++ lib.optional withALSA "alsa_backend"
+    ++ lib.optional withPulseAudio "pulseaudio_backend"
+    ++ lib.optional withPortAudio "portaudio_backend"
+    ++ lib.optional withMPRIS "mpris";
 
   doCheck = false;
 

pkgs/applications/audio/whipper/default.nix

···
     mutagen
     pycdio
     pygobject3
-    ruamel_yaml
+    ruamel-yaml
     discid
     pillow
   ];

pkgs/applications/display-managers/sddm/default.nix

···
       url = "https://github.com/sddm/sddm/commit/e1dedeeab6de565e043f26ac16033e613c222ef9.patch";
       sha256 = "sha256-OPyrUI3bbH+PGDBfoL4Ohb4wIvmy9TeYZhE0JxR/D58=";
     })
+    # Fix build with Qt 5.15.3
+    # See: https://github.com/sddm/sddm/pull/1325
+    (fetchpatch {
+      url = "https://github.com/sddm/sddm/commit/e93bf95c54ad8c2a1604f8d7be05339164b19308.patch";
+      sha256 = "sha256:1rh6sdvzivjcl5b05fczarvxhgpjhi7019hvf2gadnwgwdg104r4";
+    })
   ];
 
   postPatch =

pkgs/applications/editors/helix/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "helix";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "helix-editor";
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-lScMHZ/pLcHkuvv8kSKnYK5AFVxyhOUMFdsu3nlDVD0=";
+    sha256 = "sha256-NoVg/8oJIgMQtxlCSjrLnYCG8shigYqZzWAQwmiqxgA=";
   };
 
-  cargoSha256 = "sha256-N5vlPoYyksHEZsyia8u8qtoEBY6qsXqO9CRBFaTQmiw=";
+  cargoSha256 = "sha256-kqPI8WpGpr0VL7CbBTSsjKl3xqJrv/6Qjr6UFnIgaVo=";
 
   nativeBuildInputs = [ makeWrapper ];
 

pkgs/applications/editors/vim/common.nix

···
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.3337";
+  version = "8.2.3451";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "sha256-iwSGcLeqXH0bVIXEI5OnotG88Uv8ntycisD9EcHjz/c=";
+    sha256 = "sha256-8OaEaFyOaL59j0EZkUY+kuR6si79H2dN09f8SnltxbQ=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/graphics/epick/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "epick";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "vv9k";
     repo = pname;
     rev = version;
-    sha256 = "0l7m45bqx62nrwi0r4pdwxcq37s7h3nnawk9nq2zpvl9wcgnx3gc";
+    sha256 = "sha256-x1C8kY9VpMg7aXgC/jRsLCeUV8uRLobgjSAQdK2/sHk=";
   };
 
-  cargoSha256 = "sha256-LERV3+zwt5oVfyueGfxM7HsOha4cuWTkPyvPQwHSZqo=";
+  cargoSha256 = "sha256-KgQOlvKRt47lg7NteqBa2DLKkDf93JTzp9EIHn3clxY=";
 
   nativeBuildInputs = lib.optional stdenv.isLinux python3;
 

pkgs/applications/graphics/menyoki/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "menyoki";
-  version = "1.5.3";
+  version = "1.5.5";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "050c6c60il6cy0a8d3nw4z2cyp043912a7n4n44yjpmx047w7kc7";
+    sha256 = "sha256-wEPt96z/odQ05hosN+GB5KLsCu8onR9WWamofJayhwU=";
   };
 
-  cargoSha256 = "0wwcda2w8jg3q132cvhdgfmjc0rz93fx6fai93g5w8br98aq9qzx";
+  cargoSha256 = "sha256-nwxBreouL3Z47zHSH+Y/ej7KU2/bXyMQ+Tb7R4U+yKk=";
 
   nativeBuildInputs = [ installShellFiles ]
     ++ lib.optional stdenv.isLinux pkg-config;
···
   meta = with lib; {
     description = "Screen{shot,cast} and perform ImageOps on the command line";
     homepage = "https://menyoki.cli.rs/";
+    changelog = "https://github.com/orhun/menyoki/blob/v${version}/CHANGELOG.md";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ figsoda ];
-    broken = stdenv.isDarwin;
   };
 }

pkgs/applications/misc/khard/default.nix

···
   propagatedBuildInputs = with python3.pkgs; [
     atomicwrites
     configobj
+    ruamel-yaml
+    unidecode
     vobject
-    ruamel_yaml
-    ruamel_base
-    unidecode
   ];
 
   postInstall = ''
···
     # see https://github.com/scheibler/khard/issues/263
     export COLUMNS=80
   '';
+
+  pythonImportsCheck = [ "khard" ];
 
   meta = {
     homepage = "https://github.com/scheibler/khard";

pkgs/applications/misc/robo3t/default.nix

···
 }:
 
 let
-  curlWithGnuTls = curl.override { gnutlsSupport = true; sslSupport = false; };
+  curlWithGnuTls = curl.override { gnutlsSupport = true; opensslSupport = false; };
 in
 
 stdenv.mkDerivation rec {

pkgs/applications/networking/browsers/firefox/common.nix

···
   # When LTO for Darwin is fixed, the following will need updating as lld
   # doesn't work on it. For now it is fine since ltoSupport implies no Darwin.
   buildStdenv = if ltoSupport
-                then overrideCC stdenv llvmPackages.clangUseLLVM
+                # LTO requires LLVM bintools including ld.lld and llvm-ar.
+                then overrideCC llvmPackages.stdenv (llvmPackages.stdenv.cc.override {
+                  inherit (llvmPackages) bintools;
+                })
                 else stdenv;
 
   # --enable-release adds -ffunction-sections & LTO that require a big amount of
···
   ] ++
   lib.optional (lib.versionAtLeast version "86") ./env_var_for_system_dir-ff86.patch ++
   lib.optional (lib.versionAtLeast version "90") ./no-buildconfig-ffx90.patch ++
+  # This fixes a race condition causing deadlock.
+  # https://phabricator.services.mozilla.com/D128657
+  lib.optional (lib.versionAtLeast version "94") (fetchpatch {
+    url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/9c7f25d45bb1dd6b1a865780bc249cdaa619aa83/trunk/0002-Bug-1735905-Upgrade-cubeb-pulse-to-fix-a-race-condit.patch";
+    sha256 = "l4bMK/YDXcDpIjPy9DPuUSFyDpzVQca201A4h9eav5g=";
+  }) ++
   patches;
 
   # Ignore trivial whitespace changes in patches, this fixes compatibility of

pkgs/applications/office/libreoffice/default.nix

···
     tar -xf ${srcs.translations}
   '';
 
+  patches = [ ./skip-failed-test-with-icu70.patch ];
+
   ### QT/KDE
   #
   # We have to resort to the ugly patching of configure.ac as it assumes that

pkgs/applications/office/libreoffice/skip-failed-test-with-icu70.patch

···
+--- a/i18npool/qa/cppunit/test_breakiterator.cxx
++++ b/i18npool/qa/cppunit/test_breakiterator.cxx
+@@ -35,7 +35,7 @@ public:
+     void testWeak();
+     void testAsian();
+     void testThai();
+-#if (U_ICU_VERSION_MAJOR_NUM > 51)
++#if (U_ICU_VERSION_MAJOR_NUM > 51 && U_ICU_VERSION_MAJOR_NUM < 70)
+     void testLao();
+ #ifdef TODO
+     void testNorthernThai();
+@@ -52,7 +52,7 @@ public:
+     CPPUNIT_TEST(testWeak);
+     CPPUNIT_TEST(testAsian);
+     CPPUNIT_TEST(testThai);
+-#if (U_ICU_VERSION_MAJOR_NUM > 51)
++#if (U_ICU_VERSION_MAJOR_NUM > 51 && U_ICU_VERSION_MAJOR_NUM < 70)
+     CPPUNIT_TEST(testLao);
+ #ifdef TODO
+     CPPUNIT_TEST(testKhmer);
+@@ -843,7 +843,7 @@ void TestBreakIterator::testAsian()
+     }
+ }
+ 
+-#if (U_ICU_VERSION_MAJOR_NUM > 51)
++#if (U_ICU_VERSION_MAJOR_NUM > 51 && U_ICU_VERSION_MAJOR_NUM < 70)
+ //A test to ensure that our Lao word boundary detection is useful
+ void TestBreakIterator::testLao()
+ {

pkgs/applications/office/libreoffice/src-still/override.nix

···
     "--with-commons-logging-jar=${commonsLogging}/share/java/commons-logging-1.2.jar"
     "--without-system-qrcodegen"
   ];
-  patches = [ ../xdg-open-brief.patch ]; # drop this when switching to 7.2
+  patches = attrs.patches or [] ++ [ ../xdg-open-brief.patch ]; # drop this when switching to 7.2
 }

pkgs/applications/office/libreoffice/src-still/primary.nix

···
 
   major = "7";
   minor = "1";
-  patch = "6";
+  patch = "7";
   tweak = "2";
 
   subdir = "${major}.${minor}.${patch}";
···
 
   src = fetchurl {
     url = "https://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${version}.tar.xz";
-    sha256 = "1g1nlnmgxka1xj3800ra7j28y08k1irz7a24awx1gyjs9fci58qq";
+    sha256 = "T98ICdiAM4i9E6zis0V/Cmq5+e98mNb0bMZA//xelLo=";
   };
 
   # FIXME rename
   translations = fetchSrc {
     name = "translations";
-    sha256 = "0kblfwcnsc0pz96wxmkghmchjd31h0w1wjxlqxqbqqpz3vbr61k3";
+    sha256 = "g8skm02R5nRyF09ZbL9kJqMxRqaQ0AfpletDK3AAggk=";
   };
 
   # the "dictionaries" archive is not used for LO build because we already build hunspellDicts packages from
···
 
   help = fetchSrc {
     name = "help";
-    sha256 = "1b28xqgvfnx62zgnxfisi58r7nhixvz35pmq8cb20ayxhdfg6v31";
+    sha256 = "jAFrO4RyONhPH3H5QW0SL8Id53bBvJ7AYxSNtLhG4rQ=";
   };
 }

pkgs/applications/version-management/git-and-tools/lucky-commit/default.nix

···
   cargoBuildFlags = lib.optional (!withOpenCL) "--no-default-features";
 
   # disable tests that require gpu
-  cargoTestFlags = [ "--no-default-features" ];
+  checkNoDefaultFeatures = true;
 
   meta = with lib; {
     description = "Change the start of your git commit hashes to whatever you want";

pkgs/applications/version-management/gitkraken/default.nix

···
 with lib;
 
 let
-  curlWithGnuTls = curl.override { gnutlsSupport = true; sslSupport = false; };
+  curlWithGnuTls = curl.override { gnutlsSupport = true; opensslSupport = false; };
   pname = "gitkraken";
   version = "8.1.0";
 

pkgs/applications/video/corrscope/default.nix

···
 
   buildInputs = [ ffmpeg qtbase ];
 
-  propagatedBuildInputs = with python3Packages; [ appdirs atomicwrites attrs click matplotlib numpy pyqt5 ruamel_yaml ];
+  propagatedBuildInputs = with python3Packages; [ appdirs atomicwrites attrs click matplotlib numpy pyqt5 ruamel-yaml ];
 
   dontWrapQtApps = true;
 

pkgs/applications/video/filebot/default.nix

···
 
 let
   # FileBot requires libcurl-gnutls.so to build
-  curlWithGnuTls = curl.override { gnutlsSupport = true; sslSupport = false; };
+  curlWithGnuTls = curl.override { gnutlsSupport = true; opensslSupport = false; };
 
 in
 

pkgs/build-support/appimage/default.nix

···
       xorg.libICE
       gnome2.GConf
       freetype
-      (curl.override { gnutlsSupport = true; sslSupport = false; })
+      (curl.override { gnutlsSupport = true; opensslSupport = false; })
       nspr
       nss
       fontconfig

pkgs/build-support/rust/build-rust-package/default.nix

···
 , cargoLock ? null
 , cargoVendorDir ? null
 , checkType ? buildType
+, buildNoDefaultFeatures ? false
+, checkNoDefaultFeatures ? buildNoDefaultFeatures
+, buildFeatures ? [ ]
+, checkFeatures ? buildFeatures
 , depsExtraArgs ? {}
 
 # Toggles whether a custom sysroot is created when the target is a .json file.
···
   cargoBuildType = buildType;
 
   cargoCheckType = checkType;
+
+  cargoBuildNoDefaultFeatures = buildNoDefaultFeatures;
+
+  cargoCheckNoDefaultFeatures = checkNoDefaultFeatures;
+
+  cargoBuildFeatures = buildFeatures;
+
+  cargoCheckFeatures = checkFeatures;
 
   patchRegistryDeps = ./patch-registry-deps;
 

pkgs/build-support/rust/hooks/cargo-build-hook.sh

···
         cargoBuildProfileFlag="--${cargoBuildType}"
     fi
 
+    if [ -n "${cargoBuildNoDefaultFeatures-}" ]; then
+        cargoBuildNoDefaultFeaturesFlag=--no-default-features
+    fi
+
+    if [ -n "${cargoBuildFeatures-}" ]; then
+        cargoBuildFeaturesFlag="--features=${cargoBuildFeatures// /,}"
+    fi
+
     (
     set -x
     env \
···
         --target @rustTargetPlatformSpec@ \
         --frozen \
         ${cargoBuildProfileFlag} \
+        ${cargoBuildNoDefaultFeaturesFlag} \
+        ${cargoBuildFeaturesFlag} \
         ${cargoBuildFlags}
     )
 

pkgs/build-support/rust/hooks/cargo-check-hook.sh

···
         cargoCheckProfileFlag="--${cargoCheckType}"
     fi
 
-    argstr="${cargoCheckProfileFlag} --target @rustTargetPlatformSpec@ --frozen ${cargoTestFlags}";
+    if [ -n "${cargoCheckNoDefaultFeatures-}" ]; then
+        cargoCheckNoDefaultFeaturesFlag=--no-default-features
+    fi
+
+    if [ -n "${cargoCheckFeatures-}" ]; then
+        cargoCheckFeaturesFlag="--features=${cargoCheckFeatures// /,}"
+    fi
+
+    argstr="${cargoCheckProfileFlag} ${cargoCheckNoDefaultFeaturesFlag} ${cargoCheckFeaturesFlag}
+        --target @rustTargetPlatformSpec@ --frozen ${cargoTestFlags}"
 
     (
         set -x

pkgs/build-support/setup-hooks/validate-pkg-config.sh

···
     for pc in $(find "$prefix" -name '*.pc'); do
         # Do not fail immediately. It's nice to see all errors when
         # there are multiple pkgconfig files.
-        if ! pkg-config --validate "$pc"; then
+        if ! $PKG_CONFIG --validate "$pc"; then
             bail=1
         fi
     done

pkgs/development/compilers/gcc/11/default.nix

···
 with builtins;
 
 let majorVersion = "11";
-    version = "${majorVersion}.1.0";
+    version = "${majorVersion}.2.0";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
···
       })
 
       # Obtain latest patch with ../update-mcfgthread-patches.sh
-      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch
-
-      ++ [ ../libsanitizer-no-cyclades.patch ];
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch;
 
     /* Cross-gcc settings (build == host != target) */
     crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
···
 
   src = fetchurl {
     url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = "1pwxrjhsymv90xzh0x42cxfnmhjinf2lnrrf3hj5jq1rm2w6yjjc";
+    sha256 = "sha256-0I7cU2tUw3KhAQ/2YZ3SdMDxYDqkkhK6IPeqLNo2+os=";
   };
 
   inherit patches;

pkgs/development/compilers/openjdk/11.nix

···
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
     ]);
 
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
     buildFlags = [ "all" ];
 
     installPhase = ''

pkgs/development/compilers/openjdk/12.nix

···
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
     ];
 
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
     buildFlags = [ "all" ];
 
     installPhase = ''

pkgs/development/compilers/openjdk/13.nix

···
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
     ]);
 
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
     buildFlags = [ "all" ];
 
     installPhase = ''

pkgs/development/compilers/openjdk/14.nix

···
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
     ]);
 
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
     buildFlags = [ "all" ];
 
     installPhase = ''

pkgs/development/compilers/openjdk/15.nix

···
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
     ]);
 
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
     buildFlags = [ "all" ];
 
     installPhase = ''

pkgs/development/compilers/openjdk/16.nix

···
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
     ]);
 
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
     buildFlags = [ "all" ];
 
     installPhase = ''

pkgs/development/compilers/openjdk/17.nix

···
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
     ]);
 
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
     buildFlags = [ "images" ];
 
     installPhase = ''

pkgs/development/compilers/openjdk/8.nix

···
       "-lgtk-x11-2.0" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
     ]);
 
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
     buildFlags = [ "all" ];
 
     doCheck = false; # fails with "No rule to make target 'y'."

pkgs/development/compilers/rust/1_55.nix

···
-# New rust versions should first go to staging.
-# Things to check after updating:
-# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
-#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
-#    This testing can be also done by other volunteers as part of the pull
-#    request review, in case platforms cannot be covered.
-# 2. The LLVM version used for building should match with rust upstream.
-#    Check the version number in the src/llvm-project git submodule in:
-#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
-# 3. Firefox and Thunderbird should still build on x86_64-linux.
-
-{ stdenv, lib
-, buildPackages
-, newScope, callPackage
-, CoreFoundation, Security, SystemConfiguration
-, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
-, makeRustPlatform
-, llvmPackages_11
-, llvmPackages_12, llvm_12
-} @ args:
-
-import ./default.nix {
-  rustcVersion = "1.55.0";
-  rustcSha256 = "07l28f7grdmi65naq71pbmvdd61hwcpi40ry7kp7dy7m233rldxj";
-
-  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_12.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForHost = pkgsBuildHost.llvmPackages_12.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_12.libllvm.override { enableSharedLibraries = true; };
-
-  llvmBootstrapForDarwin = llvmPackages_11;
-
-  # For use at runtime
-  llvmShared = llvm_12.override { enableSharedLibraries = true; };
-
-  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
-  llvmPackagesForBuild = pkgsBuildBuild.llvmPackages_12;
-
-  # Note: the version MUST be one version prior to the version we're
-  # building
-  bootstrapVersion = "1.54.0";
-
-  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
-  bootstrapHashes = {
-    i686-unknown-linux-gnu = "1cd06090463711d50d98374ef52c1a84b9f4e3e35febaaef4890fb10536ceb3a";
-    x86_64-unknown-linux-gnu = "350354495b1d4b6dd2ec7cf96aa9bc61d031951cf667a31e8cf401dc508639e6";
-    x86_64-unknown-linux-musl = "3571db0018fcd32f3b579a32b2301826dbd1cce44b373aed8e8a31c2a6f52fe8";
-    arm-unknown-linux-gnueabihf = "77f4e4c2195f75466c6de0b1d8fd7fb8cef3d12666e3aae777dcfd0d71d080ca";
-    armv7-unknown-linux-gnueabihf = "dd01ccb6a53d5e895a6755a78c213ae601a347366688941d5c543b5af5835d6d";
-    aarch64-unknown-linux-gnu = "33a50c5366a57aaab43c1c19e4a49ab7d8ffcd99a72925c315fb1f9389139e6f";
-    aarch64-unknown-linux-musl = "49d94116a357ea13f5a3231de2472f59210028c3cf81f158b8a367c3155ac544";
-    x86_64-apple-darwin = "5eb27a4f5f7a4699bc70cf1848e340ddd74e151488bfcb26853fd584958e3d33";
-    aarch64-apple-darwin = "801b3b15b992b0321261de8b8ea2728e9a74822c6cb99bf978b34e217c7825ba";
-    powerpc64le-unknown-linux-gnu = "67cadf7ac5bd2e3d5fb4baede69846059f17c4e099f771329b266d08b875ed71";
-    riscv64gc-unknown-linux-gnu = "6113a6cce3500033d0dc0d170b54c5f22562ef3025fd58d804c822a2499c74d7";
-  };
-
-  selectRustPackage = pkgs: pkgs.rust_1_55;
-
-  rustcPatches = [
-  ];
-}
-
-(builtins.removeAttrs args [ "fetchpatch" "pkgsBuildHost" "llvmPackages_11" "llvmPackages_12" "llvm_12"])

pkgs/development/compilers/rust/1_56.nix

···
+# New rust versions should first go to staging.
+# Things to check after updating:
+# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
+#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
+#    This testing can be also done by other volunteers as part of the pull
+#    request review, in case platforms cannot be covered.
+# 2. The LLVM version used for building should match with rust upstream.
+#    Check the version number in the src/llvm-project git submodule in:
+#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
+# 3. Firefox and Thunderbird should still build on x86_64-linux.
+
+{ stdenv, lib
+, buildPackages
+, newScope, callPackage
+, CoreFoundation, Security, SystemConfiguration
+, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
+, makeRustPlatform
+, llvmPackages_11
+, llvmPackages_13, llvm_13
+} @ args:
+
+import ./default.nix {
+  rustcVersion = "1.56.1";
+  rustcSha256 = "04cmqx7nn63hzz7z27b2b0dj2qx18rck9ifvip43s6dampx8v2f3";
+
+  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_13.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForHost = pkgsBuildHost.llvmPackages_13.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_13.libllvm.override { enableSharedLibraries = true; };
+
+  llvmBootstrapForDarwin = llvmPackages_11;
+
+  # For use at runtime
+  llvmShared = llvm_13.override { enableSharedLibraries = true; };
+
+  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
+  llvmPackagesForBuild = pkgsBuildBuild.llvmPackages_13;
+
+  # Note: the version MUST be one version prior to the version we're
+  # building
+  bootstrapVersion = "1.55.0";
+
+  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
+  bootstrapHashes = {
+    i686-unknown-linux-gnu = "6e42b6c44d2eb4170f4144423fa3c33338d8d5c3ea00b03bbac200c877bc9e98";
+    x86_64-unknown-linux-gnu = "2080253a2ec36ac8ed6e060d30802d888533124b8d16545cfd4af898b365eaac";
+    x86_64-unknown-linux-musl = "f24f68587253c4bfbe59d3d10fe4897068d9130538de6b2d02097a25718030c2";
+    arm-unknown-linux-gnueabihf = "483444153d35cda51c6aec2c24bc4c97fa4fd30b28df4b60bf9763bd6e06da3a";
+    armv7-unknown-linux-gnueabihf = "8c72f0eb75b10db970fb546c3b41f5e97df294d5dbbf0b8fa96e17f2b281ee9c";
+    aarch64-unknown-linux-gnu = "eebdb2e659ed14884a49f0457d44e5e8c9f89fca3414533752c6dbb96232c156";
+    aarch64-unknown-linux-musl = "2ce36a7d34f1f2aa43b4cbc0b437d96eefb45743828bf9ae699ff581ae257f28";
+    x86_64-apple-darwin = "2e345ac7724c192c9487a2c6bd4f6c52c884d791981510288830d27d9a0bf2f3";
+    aarch64-apple-darwin = "70c71d30d0de76912fcd88d503a6cb4323cfe6250c1a255be7e0d4e644b3d40a";
+    powerpc64le-unknown-linux-gnu = "12bf6447d338cbe2b55539b84e6369b17e7eefe938d1ba7e3dd69781c9cc9812";
+    riscv64gc-unknown-linux-gnu = "effceb45346fef3b0b54b357336e6f374f788b803bb1bee4084f25eace8907f3";
+  };
+
+  selectRustPackage = pkgs: pkgs.rust_1_56;
+
+  rustcPatches = [
+  ];
+}
+
+(builtins.removeAttrs args [ "fetchpatch" "pkgsBuildHost" "llvmPackages_11" "llvmPackages_13" "llvm_13"])

pkgs/development/compilers/vala/default.nix

···
   };
 
   vala_0_52 = generic {
-    version = "0.52.5";
-    sha256 = "sha256-hKG7MSs+Xcrkt7JcRVmNN14stpIzzvtZoV0jUMdr3ZE=";
+    version = "0.52.6";
+    sha256 = "sha256-FNfrTZZLfDrcFuRTcTIIbdxmJO0eDruBEeKsgierOnI=";
   };
 
   vala_0_54 = generic {
-    version = "0.54.1";
-    sha256 = "0jlhd6hr9mai7hhc2c78w6zmnzf7xncp7fhyiavkqqzhhsn7gpjx";
+    version = "0.54.2";
+    sha256 = "iE3nRTF9TVbk6M7emT3I8E1Qz8o2z2DS8vJ4wwwrExE=";
   };
 
   vala = vala_0_54;

pkgs/development/libraries/adns/default.nix

···
   preConfigure =
     lib.optionalString stdenv.isDarwin "sed -i -e 's|-Wl,-soname=$(SHLIBSONAME)||' configure";
 
+  # Autogenerated headers miss interdependencies in Makefile, fail parallel build:
+  #  https://debbugs.gnu.org/cgi/bugreport.cgi?bug=51329
+  enableParallelBuilding = false;
+
   # https://www.mail-archive.com/[e-mail]/msg01347.html for details.
   doCheck = false;
 

pkgs/development/libraries/dbus/default.nix

···
 , fetchurl
 , pkg-config
 , expat
-, enableSystemd ? stdenv.isLinux && !stdenv.hostPlatform.isMusl
+, enableSystemd ? stdenv.isLinux && !stdenv.hostPlatform.isStatic
 , systemd
 , audit
 , libapparmor

pkgs/development/libraries/directfb/default.nix

···
     "--with-smooth-scaling"
   ] ++ lib.optional enableX11 "--enable-x11";
 
+  # Disable parallel building as parallel builds fail due to incomplete
+  # depends between autogenerated CoreSlave.h and it's include sites:
+  #    CC       prealloc_surface_pool_bridge.lo
+  #    prealloc_surface_pool_bridge.c:41:10:
+  #        fatal error: core/CoreSlave.h: No such file or directory
+  #
+  # Dependencies are specified manually in src/core/Makefile.am. Instead
+  # of fixing them one by one locally let's disable parallel builds until
+  # upstream fixes them.
+  enableParallelBuilding = false;
+
   meta = with lib; {
     description = "Graphics and input library designed with embedded systems in mind";
     longDescription = ''

pkgs/development/libraries/ffmpeg/4.nix

···
 # Darwin frameworks
 , Cocoa, CoreMedia, VideoToolbox
 , stdenv, lib
-, fetchpatch
 , ...
 }@args:
 
 callPackage ./generic.nix (rec {
-  version = "4.4";
-  branch = "4.4";
-  sha256 = "03kxc29y8190k4y8s8qdpsghlbpmchv1m8iqygq2qn0vfm4ka2a2";
+  version = "4.4.1";
+  branch = version;
+  sha256 = "0hmck0placn12kd9l0wam70mrpgfs2nlfmi8krd135gdql5g5jcg";
   darwinFrameworks = [ Cocoa CoreMedia VideoToolbox ];
-
-  patches = [
-    (fetchpatch {
-      name = "CVE-2021-33815.patch";
-      url = "https://github.com/FFmpeg/FFmpeg/commit/26d3c81bc5ef2f8c3f09d45eaeacfb4b1139a777.patch";
-      sha256 = "0l8dqga5845f7d3wdbvd05i23saldq4pm2cyfdgszbr0c18sxagf";
-    })
-    (fetchpatch {
-      name = "CVE-2021-38114.patch";
-      url = "https://github.com/FFmpeg/FFmpeg/commit/7150f9575671f898382c370acae35f9087a30ba1.patch";
-      sha256 = "0gwkc7v1wsh4j0am2nnskhsca1b5aqzhcfd41sd9mh2swsdyf27i";
-    })
-    (fetchpatch {
-      name = "CVE-2021-38171.patch";
-      url = "https://github.com/FFmpeg/FFmpeg/commit/9ffa49496d1aae4cbbb387aac28a9e061a6ab0a6.patch";
-      sha256 = "0b8hsb45izw7w1vb2b94k9f6kvn2shxrap5ip1krdxg6hs7an0x8";
-    })
-    (fetchpatch {
-      name = "CVE-2021-38291.patch";
-      url = "https://github.com/FFmpeg/FFmpeg/commit/e01d306c647b5827102260b885faa223b646d2d1.patch";
-      sha256 = "0p2p8gcnb5j469xa3czfssm09w3jk08kz8rnl8wi2l9aj9l08my9";
-    })
-    # Fix incorrect segment length in HLS child playlist with fmp4 segment format
-    # FIXME remove in version 4.5
-    # https://trac.ffmpeg.org/ticket/9193
-    # https://trac.ffmpeg.org/ticket/9205
-    (fetchpatch {
-      name = "ffmpeg_fix_incorrect_segment_length_in_hls.patch";
-      url = "https://git.videolan.org/?p=ffmpeg.git;a=commitdiff_plain;h=59032494e81a1a65c0b960aaae7ec4c2cc9db35a";
-      sha256 = "03zz1lw51kkc3g3vh47xa5hfiz3g3g1rbrll3kcnslvwylmrqmy3";
-    })
-  ] ++ lib.optionals stdenv.isDarwin [
-    # Work around https://trac.ffmpeg.org/ticket/9242
-    ./v2-0001-avcodec-videotoolboxenc-define-TARGET_CPU_ARM64-t.patch
-  ];
 } // args)

pkgs/development/libraries/ffmpeg/v2-0001-avcodec-videotoolboxenc-define-TARGET_CPU_ARM64-t.patch

···
-From 5b562aaddbc6e7a94a079c2e88230b205a7f4d73 Mon Sep 17 00:00:00 2001
-From: Zane van Iperen <[e-mail]>
-Date: Sat, 15 May 2021 19:33:52 +1000
-Subject: [PATCH v2] avcodec/videotoolboxenc: #define TARGET_CPU_ARM64 to 0 if
- not provided by the SDK
-
-Fixes build failure on older SDKs without it.
-
-Fixes #9242
-
-Signed-off-by: Zane van Iperen <[e-mail]>
----
- libavcodec/videotoolboxenc.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-NB: This is untested, I do not have a Mac to try it on.
-
-diff --git a/libavcodec/videotoolboxenc.c b/libavcodec/videotoolboxenc.c
-index 58239e0ab9..f063a86e73 100644
---- a/libavcodec/videotoolboxenc.c
-+++ b/libavcodec/videotoolboxenc.c
-@@ -50,6 +50,10 @@ enum { kCVPixelFormatType_420YpCbCr10BiPlanarFullRange = 'xf20' };
- enum { kCVPixelFormatType_420YpCbCr10BiPlanarVideoRange = 'x420' };
- #endif
- 
-+#ifndef TARGET_CPU_ARM64
-+#   define TARGET_CPU_ARM64 0
-+#endif
-+
- typedef OSStatus (*getParameterSetAtIndex)(CMFormatDescriptionRef videoDesc,
-                                            size_t parameterSetIndex,
-                                            const uint8_t **parameterSetPointerOut,
--- 
-2.29.3
-

pkgs/development/libraries/gcc/libgcc/default.nix

···
     sourceRoot=$(readlink -e "./libgcc")
   '';
 
+  hardeningDisable = [ "pie" ];
+
   preConfigure = ''
     cd "$buildRoot"
   ''

pkgs/development/libraries/glib/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "glib";
-  version = "2.70.0";
+  version = "2.70.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0hh7hk02fkm1bn48k4z8f3kgv9qbni5z22gizd567fn527w7s390";
+    sha256 = "+be85/UXU6H0OFO7ysqL8J4V6ZQmjinP16dvZWNiY8A=";
   };
 
   patches = optionals stdenv.isDarwin [
···
     ./quark_init_on_demand.patch
     ./gobject_init_on_demand.patch
   ] ++ [
+    ./glib-appinfo-watch.patch
     ./schema-override-variable.patch
 
     # GLib contains many binaries used for different purposes;

pkgs/development/libraries/glib/glib-appinfo-watch.patch

···
+This patch lets GLib's GDesktopAppInfo API watch and notice changes
+to the Nix user and system profiles.  That way, the list of available
+applications shown by the desktop environment is immediately updated
+when the user installs or removes any
+(see <https://issues.guix.gnu.org/35594>).
+
+It does so by monitoring /nix/var/nix/profiles (for changes to the system
+profile) and /nix/var/nix/profiles/per-user/USER (for changes to the user
+profile) as well as /etc/profiles/per-user (for chanes to the user
+environment profile) and crawling their share/applications sub-directory when
+changes happen.
+
+diff --git a/gio/gdesktopappinfo.c b/gio/gdesktopappinfo.c
+index b779b30..31069f7 100644
+--- a/gio/gdesktopappinfo.c
++++ b/gio/gdesktopappinfo.c
+@@ -150,6 +150,7 @@ typedef struct
+   gchar                      *alternatively_watching;
+   gboolean                    is_config;
+   gboolean                    is_setup;
++  gchar                      *nix_profile_watch_dir;
+   GFileMonitor               *monitor;
+   GHashTable                 *app_names;
+   GHashTable                 *mime_tweaks;
+@@ -181,6 +182,7 @@ desktop_file_dir_unref (DesktopFileDir *dir)
+     {
+       desktop_file_dir_reset (dir);
+       g_free (dir->path);
++      g_free (dir->nix_profile_watch_dir);
+       g_free (dir);
+     }
+ }
+@@ -205,6 +207,14 @@ desktop_file_dir_get_alternative_dir (DesktopFileDir *dir)
+ {
+   gchar *parent;
+ 
++  /* If DIR is a profile, watch the specified directory--e.g.,
++   * /nix/var/nix/profiles/per-user/$USER/ for the user profile.  Do not watch
++   * ~/.nix-profile or /run/current-system/sw because GFileMonitor does
++   * not pass IN_DONT_FOLLOW and thus cannot notice any change.
++   * /etc/profiles/per-user is monitored directly for the same reason. */
++  if (dir->nix_profile_watch_dir != NULL)
++    return g_strdup (dir->nix_profile_watch_dir);
++
+   /* If the directory itself exists then we need no alternative. */
+   if (g_access (dir->path, R_OK | X_OK) == 0)
+     return NULL;
+@@ -250,11 +260,11 @@ desktop_file_dir_changed (GFileMonitor      *monitor,
+    *
+    * If this is a notification for a parent directory (because the
+    * desktop directory didn't exist) then we shouldn't fire the signal
+-   * unless something actually changed.
++   * unless something actually changed or it's part of a Nix profile.
+    */
+   g_mutex_lock (&desktop_file_dir_lock);
+ 
+-  if (dir->alternatively_watching)
++  if (dir->alternatively_watching && dir->nix_profile_watch_dir == NULL)
+     {
+       gchar *alternative_dir;
+ 
+@@ -1556,6 +1566,40 @@ desktop_file_dirs_lock (void)
+       for (i = 0; dirs[i]; i++)
+         g_ptr_array_add (desktop_file_dirs, desktop_file_dir_new (dirs[i]));
+ 
++      {
++        /* Monitor the system and user profile under /nix/var/nix/profiles and
++         * treat modifications to them as if they were modifications to their
++         * /share sub-directory.  */
++        const gchar *user;
++        DesktopFileDir *system_profile_dir, *user_profile_dir, *user_env_dir;
++
++        system_profile_dir =
++          desktop_file_dir_new ("/nix/var/nix/profiles/system/sw/share");
++        system_profile_dir->nix_profile_watch_dir = g_strdup ("/nix/var/nix/profiles");
++        g_ptr_array_add (desktop_file_dirs, desktop_file_dir_ref (system_profile_dir));
++
++        user = g_get_user_name ();
++        if (user != NULL)
++          {
++            gchar *profile_dir, *user_data_dir, *env_dir, *env_data_dir;
++
++            profile_dir = g_build_filename ("/nix/var/nix/profiles/per-user", user, NULL);
++            user_data_dir = g_build_filename (profile_dir, "profile", "share", NULL);
++            user_profile_dir = desktop_file_dir_new (user_data_dir);
++            user_profile_dir->nix_profile_watch_dir = profile_dir;
++            
++            env_dir = g_build_filename ("/etc/profiles/per-user", NULL);
++            env_data_dir = g_build_filename (env_dir, user, "share", NULL);
++            user_env_dir = desktop_file_dir_new (env_data_dir);
++            user_env_dir->nix_profile_watch_dir = env_dir;
++
++            g_ptr_array_add (desktop_file_dirs, desktop_file_dir_ref (user_profile_dir));
++            g_ptr_array_add (desktop_file_dirs, desktop_file_dir_ref (user_env_dir));
++            g_free (user_data_dir);
++            g_free (env_data_dir);
++          }
++      }
++
+       /* The list of directories will never change after this, unless
+        * g_get_user_config_dir() changes due to %G_TEST_OPTION_ISOLATE_DIRS. */
+       desktop_file_dirs_config_dir = user_config_dir;

pkgs/development/libraries/glibc/common.nix

···
 , profilingLibraries ? false
 , withGd ? false
 , meta
+, extraBuildInputs ? []
+, extraNativeBuildInputs ? []
 , ...
 } @ args:
 
 let
   version = "2.33";
-  patchSuffix = "-55";
+  patchSuffix = "-56";
   sha256 = "sha256-LiVWAA4QXb1X8Layoy/yzxc73k8Nhd/8z9i35RoGd/8=";
 in
 
···
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
           $ git fetch --all -p && git checkout origin/release/2.33/master && git describe
-          glibc-2.33-55-g4b95183785
+          glibc-2.33-56-g6090cf1330
           $ git show --minimal --reverse glibc-2.33.. | gzip -9n --rsyncable - > 2.33-master.patch.gz
 
          To compare the archive contents zdiff can be used.
···
   outputs = [ "out" "bin" "dev" "static" ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ bison python3Minimal ];
-  buildInputs = [ linuxHeaders ] ++ lib.optionals withGd [ gd libpng ];
+  nativeBuildInputs = [ bison python3Minimal ] ++ extraNativeBuildInputs;
+  buildInputs = [ linuxHeaders ] ++ lib.optionals withGd [ gd libpng ] ++ extraBuildInputs;
 
   # Needed to install share/zoneinfo/zone.tab.  Set to impure /bin/sh to
   # prevent a retained dependency on the bootstrap tools in the stdenv-linux

pkgs/development/libraries/glibc/locales.nix

···
    https://sourceware.org/git/?p=glibc.git;a=blob;f=localedata/SUPPORTED
 */
 
-{ lib, stdenv, buildPackages, callPackage, writeText
+{ lib, stdenv, buildPackages, callPackage, writeText, glibc
 , allLocales ? true, locales ? [ "en_US.UTF-8/UTF-8" ]
 }:
 
···
 
   outputs = [ "out" ];
 
+  extraNativeBuildInputs = [ glibc ];
+
   # Awful hack: `localedef' doesn't allow the path to `locale-archive'
   # to be overriden, but you *can* specify a prefix, i.e. it will use
   # <prefix>/<path-to-glibc>/lib/locale/locale-archive.  So we use
···
   # $TMPDIR/nix/store/...-glibc-.../lib/locale/locale-archive.
   buildPhase =
     ''
-      mkdir -p $TMPDIR/"${buildPackages.stdenv.cc.libc.out}/lib/locale"
+      mkdir -p $TMPDIR/"${buildPackages.glibc.out}/lib/locale"
 
       echo 'C.UTF-8/UTF-8 \' >> ../glibc-2*/localedata/SUPPORTED
 

pkgs/development/libraries/gnutls/default.nix

···
 { config, lib, stdenv, fetchurl, zlib, lzo, libtasn1, nettle, pkg-config, lzip
 , perl, gmp, autoconf, automake, libidn, p11-kit, libiconv
-, unbound, dns-root-data, gettext, cacert, util-linux
+, unbound, dns-root-data, gettext, util-linux
 , guileBindings ? config.gnutls.guile or false, guile
 , tpmSupport ? false, trousers, which, nettools, libunistring
 , withSecurity ? false, Security  # darwin Security.framework
···
   propagatedBuildInputs = [ nettle ];
 
   inherit doCheck;
-  # stdenv's `NIX_SSL_CERT_FILE=/no-cert-file.crt` broke tests with:
-  #   Error setting the x509 trust file: Error while reading file.
-  checkInputs = [ cacert ];
+  # stdenv's `NIX_SSL_CERT_FILE=/no-cert-file.crt` breaks tests.
+  # Also empty files won't work, and we want to avoid potentially impure /etc/
+  preCheck = "NIX_SSL_CERT_FILE=${./dummy.crt}";
 
   # Fixup broken libtool and pkg-config files
   preFixup = lib.optionalString (!isDarwin) ''

pkgs/development/libraries/gnutls/dummy.crt

···
+ACCVRAIZ1
+-----BEGIN CERTIFICATE-----
+MIIH0zCCBbugAwIBAgIIXsO3pkN/pOAwDQYJKoZIhvcNAQEFBQAwQjESMBAGA1UE
+AwwJQUNDVlJBSVoxMRAwDgYDVQQLDAdQS0lBQ0NWMQ0wCwYDVQQKDARBQ0NWMQsw
+CQYDVQQGEwJFUzAeFw0xMTA1MDUwOTM3MzdaFw0zMDEyMzEwOTM3MzdaMEIxEjAQ
+BgNVBAMMCUFDQ1ZSQUlaMTEQMA4GA1UECwwHUEtJQUNDVjENMAsGA1UECgwEQUND
+VjELMAkGA1UEBhMCRVMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCb
+qau/YUqXry+XZpp0X9DZlv3P4uRm7x8fRzPCRKPfmt4ftVTdFXxpNRFvu8gMjmoY
+HtiP2Ra8EEg2XPBjs5BaXCQ316PWywlxufEBcoSwfdtNgM3802/J+Nq2DoLSRYWo
+G2ioPej0RGy9ocLLA76MPhMAhN9KSMDjIgro6TenGEyxCQ0jVn8ETdkXhBilyNpA
+lHPrzg5XPAOBOp0KoVdDaaxXbXmQeOW1tDvYvEyNKKGno6e6Ak4l0Squ7a4DIrhr
+IA8wKFSVf+DuzgpmndFALW4ir50awQUZ0m/A8p/4e7MCQvtQqR0tkw8jq8bBD5L/
+0KIV9VMJcRz/RROE5iZe+OCIHAr8Fraocwa48GOEAqDGWuzndN9wrqODJerWx5eH
+k6fGioozl2A3ED6XPm4pFdahD9GILBKfb6qkxkLrQaLjlUPTAYVtjrs78yM2x/47
+4KElB0iryYl0/wiPgL/AlmXz7uxLaL2diMMxs0Dx6M/2OLuc5NF/1OVYm3z61PMO
+m3WR5LpSLhl+0fXNWhn8ugb2+1KoS5kE3fj5tItQo05iifCHJPqDQsGH+tUtKSpa
+cXpkatcnYGMN285J9Y0fkIkyF/hzQ7jSWpOGYdbhdQrqeWZ2iE9x6wQl1gpaepPl
+uUsXQA+xtrn13k/c4LOsOxFwYIRKQ26ZIMApcQrAZQIDAQABo4ICyzCCAscwfQYI
+KwYBBQUHAQEEcTBvMEwGCCsGAQUFBzAChkBodHRwOi8vd3d3LmFjY3YuZXMvZmls
+ZWFkbWluL0FyY2hpdm9zL2NlcnRpZmljYWRvcy9yYWl6YWNjdjEuY3J0MB8GCCsG
+AQUFBzABhhNodHRwOi8vb2NzcC5hY2N2LmVzMB0GA1UdDgQWBBTSh7Tj3zcnk1X2
+VuqB5TbMjB4/vTAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNKHtOPfNyeT
+VfZW6oHlNsyMHj+9MIIBcwYDVR0gBIIBajCCAWYwggFiBgRVHSAAMIIBWDCCASIG
+CCsGAQUFBwICMIIBFB6CARAAQQB1AHQAbwByAGkAZABhAGQAIABkAGUAIABDAGUA
+cgB0AGkAZgBpAGMAYQBjAGkA8wBuACAAUgBhAO0AegAgAGQAZQAgAGwAYQAgAEEA
+QwBDAFYAIAAoAEEAZwBlAG4AYwBpAGEAIABkAGUAIABUAGUAYwBuAG8AbABvAGcA
+7QBhACAAeQAgAEMAZQByAHQAaQBmAGkAYwBhAGMAaQDzAG4AIABFAGwAZQBjAHQA
+cgDzAG4AaQBjAGEALAAgAEMASQBGACAAUQA0ADYAMAAxADEANQA2AEUAKQAuACAA
+QwBQAFMAIABlAG4AIABoAHQAdABwADoALwAvAHcAdwB3AC4AYQBjAGMAdgAuAGUA
+czAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu
+aHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt
+aW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud
+DwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXMwDQYJKoZIhvcNAQEF
+BQADggIBAJcxAp/n/UNnSEQU5CmH7UwoZtCPNdpNYbdKl02125DgBS4OxnnQ8pdp
+D70ER9m+27Up2pvZrqmZ1dM8MJP1jaGo/AaNRPTKFpV8M9xii6g3+CfYCS0b78gU
+JyCpZET/LtZ1qmxNYEAZSUNUY9rizLpm5U9EelvZaoErQNV/+QEnWCzI7UiRfD+m
+AM/EKXMRNt6GGT6d7hmKG9Ww7Y49nCrADdg9ZuM8Db3VlFzi4qc1GwQA9j9ajepD
+vV+JHanBsMyZ4k0ACtrJJ1vnE5Bc5PUzolVt3OAJTS+xJlsndQAJxGJ3KQhfnlms
+tn6tn1QwIgPBHnFk/vk4CpYY3QIUrCPLBhwepH2NDd4nQeit2hW3sCPdK6jT2iWH
+7ehVRE2I9DZ+hJp4rPcOVkkO1jMl1oRQQmwgEh0q1b688nCBpHBgvgW1m54ERL5h
+I6zppSSMEYCUWqKiuUnSwdzRp+0xESyeGabu4VXhwOrPDYTkF7eifKXeVSUG7szA
+h1xA2syVP1XgNce4hL60Xc16gwFy7ofmXx2utYXGJt/mwZrpHgJHnyqobalbz+xF
+d3+YJ5oyXSrjhO7FmGYvliAd3djDJ9ew+f7Zfc3Qn48LFFhRny+Lwzgt3uiP1o2H
+pPVWQxaZLPSkVrQ0uGE3ycJYgBugl6H8WY3pEfbRD0tVNEYqi4Y7
+-----END CERTIFICATE-----

pkgs/development/libraries/gperftools/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "gperftools";
-  version = "2.8.1";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "19bj2vlsbfwq7m826v2ccqg47kd7cb5vcz1yw2x0v5qzhaxbakk1";
+    sha256 = "sha256-loUlC6mtR3oyS5opSmicCnfUqcefSk8+kKDcHNmC/oo=";
   };
 
   patches = [

pkgs/development/libraries/gtk/3.x.nix

···
     "-Dtests=false"
     "-Dtracker3=${lib.boolToString trackerSupport}"
     "-Dbroadway_backend=${lib.boolToString broadwaySupport}"
+    "-Dx11_backend=${lib.boolToString x11Support}"
+    "-Dquartz_backend=${lib.boolToString (stdenv.isDarwin && !x11Support)}"
   ];
 
   doCheck = false; # needs X11
···
   NIX_CFLAGS_COMPILE = "-DG_ENABLE_DEBUG -DG_DISABLE_CAST_CHECKS";
 
   postPatch = ''
+    # See https://github.com/NixOS/nixpkgs/issues/132259
+    substituteInPlace meson.build \
+      --replace "x11_enabled = false" ""
+
     files=(
       build-aux/meson/post-install.py
       demos/gtk-demo/geninclude.py

pkgs/development/libraries/icu/70.nix

···
+import ./base.nix {
+  version = "70.1";
+  sha256 = "1m9zgkaf5lyh65nyc6n0n5bs2f5k53nnj1ih6nskpwbvq4l5884d";
+}

pkgs/development/libraries/icu/base.nix

···
 
     meta = with lib; {
       description = "Unicode and globalization support library";
-      homepage = "http://site.icu-project.org/";
+      homepage = "https://icu.unicode.org/";
       maintainers = with maintainers; [ raskin ];
       platforms = platforms.all;
     };

pkgs/development/libraries/json-glib/default.nix

···
 , withIntrospection ? stdenv.buildPlatform == stdenv.hostPlatform
 , gobject-introspection
 , fixDarwinDylibNames
-, gtk-doc
-, docbook-xsl-nons
-, docbook_xml_dtd_43
+, gi-docgen
 , gnome
 }:
 
 stdenv.mkDerivation rec {
   pname = "json-glib";
-  version = "1.6.2";
+  version = "1.6.6";
 
   outputs = [ "out" "dev" ]
     ++ lib.optional withIntrospection "devdoc";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "092g2dyy1hhl0ix9kp33wcab0pg1qicnsv0cj5ms9g9qs336cgd3";
+    sha256 = "luyYvnqR9t3jNjZyDj2i/27LuQ52zKpJSX8xpoVaSQ4=";
   };
 
   strictDeps = true;
···
     pkg-config
     gettext
     glib
-    docbook-xsl-nons
-    docbook_xml_dtd_43
   ] ++ lib.optional stdenv.hostPlatform.isDarwin [
     fixDarwinDylibNames
   ] ++ lib.optionals withIntrospection [
     gobject-introspection
-    gtk-doc
+    gi-docgen
   ];
 
   propagatedBuildInputs = [
···
 
   mesonFlags = lib.optionals (!withIntrospection) [
     "-Dintrospection=disabled"
-    # doc gen uses introspection, doesn't work properly
+    # gi-docgen relies on introspection data
     "-Dgtk_doc=disabled"
   ];
 
   doCheck = true;
+
+  postFixup = ''
+    # Move developer documentation to devdoc output.
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    if [[ -d "$out/share/doc" ]]; then
+        find -L "$out/share/doc" -type f -regex '.*\.devhelp2?' -print0 \
+          | while IFS= read -r -d ''' file; do
+            moveToOutput "$(dirname "''${file/"$out/"/}")" "$devdoc"
+        done
+    fi
+  '';
 
   passthru = {
     updateScript = gnome.updateScript {

pkgs/development/libraries/kde-frameworks/sonnet.nix

···
 { mkDerivation
+, fetchpatch
 , extra-cmake-modules
 , aspell, qtbase, qttools
 }:
 
 mkDerivation {
   name = "sonnet";
+  patches = [
+    # Pull upstream path to fix determinism.
+    (fetchpatch {
+      url = "https://invent.kde.org/frameworks/sonnet/-/commit/a01fc66b8affb01221d1fdf84146a78c172d4c6b.patch";
+      sha256 = "1jzd65rmgvfpcxrsnsmdz8ac1ldqs9rjfryy8fryy0ibzbhc1050";
+    })
+  ];
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ aspell qttools ];
   propagatedBuildInputs = [ qtbase ];

pkgs/development/libraries/keybinder3/default.nix

···
     description = "Library for registering global key bindings";
     homepage = "https://github.com/kupferlauncher/keybinder/";
     license = licenses.mit;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = [ maintainers.cstrahan ];
   };
 }

pkgs/development/libraries/libaom/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "3.1.3";
+  version = "3.2.0";
 
   src = fetchzip {
     url = "https://aomedia.googlesource.com/aom/+archive/v${version}.tar.gz";
-    sha256 = "08rk31d2cp9k9nj37s6a4n7klpfqfbj62anwyiggzsz7b68psjq3";
+    sha256 = "0fmnbzpl481i7kchx4hbvb507r5pfgyrzfrlrs7jk3bicycm75qv";
     stripRoot = false;
   };
 

pkgs/development/libraries/libb64/default.nix

···
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "libb64";
···
     rev = "v${version}";
     sha256 = "sha256-9loDftr769qnIi00MueO86kjha2EiG9pnCLogp0Iq3c=";
   };
+
+  patches = [
+    # Fix parallel build failure: https://github.com/libb64/libb64/pull/9
+    #  make[1]: *** No rule to make target 'libb64.a', needed by 'c-example1'.  Stop.
+    (fetchpatch {
+      name = "parallel-make.patch";
+      url = "https://github.com/libb64/libb64/commit/4fe47c052e9123da8f751545deb48be08c3411f6.patch";
+      sha256 = "18b3np3gpyzimqmk6001riqv5n70wfbclky6zzsrvj5zl1dj4ljf";
+    })
+  ];
+
+  enableParallelBuilding = true;
 
   installPhase = ''
     mkdir -p $out $out/lib $out/bin $out/include

pkgs/development/libraries/libmediainfo/default.nix

···
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, libzen, zlib }:
+{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, libzen, zlib, fetchpatch }:
 
 stdenv.mkDerivation rec {
   version = "21.09";
···
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ libzen zlib ];
 
-  sourceRoot = "./MediaInfoLib/Project/GNU/Library/";
+  patches = [
+    # fixes pkgsMusl.libmediainfo build
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/aports/plain/community/libmediainfo/fix-include-signal.patch?id=b8d666a3d33575c184308e1176f4de9e519af577";
+      sha256 = "sha256-b3HoIwy/hKSh8jUakwVJpnPmYw5KUwZXgLW7IPMY4/c=";
+    })
+  ];
+
+  postPatch = "cd Project/GNU/Library";
 
   configureFlags = [ "--enable-shared" ];
 

pkgs/development/libraries/libomxil-bellagio/default.nix

···
     ./fno-common.patch
   ];
 
+  # Disable parallel build as it fails as:
+  #    ld: cannot find -lomxil-bellagio
+  enableParallelBuilding = false;
+
   doCheck = false; # fails
 
   # Fix for #40213, probably permanent, because upstream doesn't seem to be

pkgs/development/libraries/librsvg/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "librsvg";
-  version = "2.52.0";
+  version = "2.52.3";
 
   outputs = [ "out" "dev" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "14zkdd7a9mymnfs3laqj0gr69c16nwixvbc5a4gvd534w6riz0mx";
+    sha256 = "Nuf1vIjXhgjqf2wF5K/krMFga5rxPChF1DhQc9CCuKQ=";
   };
 
   cargoVendorDir = "vendor";

pkgs/development/libraries/libseccomp/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libseccomp";
-  version = "2.5.1";
+  version = "2.5.2";
 
   src = fetchurl {
     url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
-    sha256 = "0m8dlg1v7kflcxvajs4p76p275qwsm2abbf5mfapkakp7hw7wc7f";
+    sha256 = "sha256-F6ZS37SR2Wvok5YOm3kZFJNu4WwTt3ejyvVi/kjLh98=";
   };
 
   outputs = [ "out" "lib" "dev" "man" "pythonsrc" ];
···
   meta = with lib; {
     description = "High level library for the Linux Kernel seccomp filter";
     homepage = "https://github.com/seccomp/libseccomp";
-    license = licenses.lgpl21;
+    license = licenses.lgpl21Only;
     platforms = platforms.linux;
     badPlatforms = [
       "alpha-linux"

pkgs/development/libraries/libsoup/3.x.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libsoup";
-  version = "3.0.1";
+  version = "3.0.2";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-bwwxbRD4RYuW9WTHZEvjwgEb11rVBUyNsmr7DJqRvEc=";
+    sha256 = "sha256-mO9T7ZtIFewFIyFVNxr4A6mSj0ZSrMaF/wIIa+FqP/U=";
   };
 
   nativeBuildInputs = [
···
     ninja
     pkg-config
     glib
+    python3
   ] ++ lib.optionals withIntrospection [
     gobject-introspection
   ] ++ lib.optionals withVala [
···
   ];
 
   buildInputs = [
-    python3
     sqlite
     libpsl
     glib.out

pkgs/development/libraries/libsoup/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libsoup";
-  version = "2.74.0";
+  version = "2.74.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-M7HU4NY5RWxnXCJ4d+lKgHjXMSM+LVdonBGrzvfTxI4=";
+    sha256 = "sha256-3CejuPowvI/5ULWnWVh1fSJC4+UeTi2cTmI+9195O/g=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/libvpx/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libvpx";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "webmproject";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-EZP33U10fchyqy7Jr26vHgUUfWR6xtG3fcMWUII0m9w=";
+    sha256 = "00f1jrclai2b6ys78dpsg6r1mvcyxlna93vxcz8zjyia24c2pjsb";
   };
 
   postPatch = ''
···
   meta = with lib; {
     description = "WebM VP8/VP9 codec SDK";
     homepage    = "https://www.webmproject.org/";
+    changelog   = "https://github.com/webmproject/libvpx/raw/v${version}/CHANGELOG";
     license     = licenses.bsd3;
     maintainers = with maintainers; [ codyopel ];
     platforms   = platforms.all;

pkgs/development/libraries/mesa/default.nix

···
   #  revive ./dricore-gallium.patch when it gets ported (from Ubuntu), as it saved
   #  ~35 MB in $drivers; watch https://launchpad.net/ubuntu/+source/mesa/+changelog
   patches = [
-    ./missing-includes.patch # dev_t needs sys/stat.h, time_t needs time.h, etc.-- fixes build w/musl
-    ./opencl.patch
-    ./disk_cache-include-dri-driver-path-in-cache-key.patch
-    # Fix `-Werror=int-conversion` pthread warnings on musl.
-    # TODO: Remove when https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/6121 is merged and available
+    # fixes pkgsMusl.mesa build
     (fetchpatch {
-      name = "nine_debug-Make-tid-more-type-correct";
-      url = "https://gitlab.freedesktop.org/mesa/mesa/commit/aebbf819df6d1e.patch";
-      sha256 = "17248hyzg43d73c86p077m4lv1pkncaycr3l27hwv9k4ija9zl8q";
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl.patch";
+      sha256 = "sha256-Jyl7ILLhn8hBJG7afnEjE8H56Wz/1bxkvlqfrXK5U7I=";
     })
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl-endian.patch";
+      sha256 = "sha256-eRc91qCaFlVzrxFrNUPpAHd1gsqKsLCCN0IW8pBQcqk=";
+    })
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl-stacksize.patch";
+      sha256 = "sha256-bEp0AWddsw1Pc3rxdKN8fsrX4x2TQEzMUa5afhLXGsg=";
+    })
+
+    ./opencl.patch
+    ./disk_cache-include-dri-driver-path-in-cache-key.patch
   ] ++ optionals (stdenv.isDarwin && stdenv.isAarch64) [
     # Fix aarch64-darwin build, remove when upstreaam supports it out of the box.
     # See: https://gitlab.freedesktop.org/mesa/mesa/-/issues/1020

pkgs/development/libraries/mesa/missing-includes.patch

···
---- ./src/gallium/winsys/svga/drm/vmw_screen.h.orig
-+++ ./src/gallium/winsys/svga/drm/vmw_screen.h
-@@ -34,7 +34,7 @@
- #ifndef VMW_SCREEN_H_
- #define VMW_SCREEN_H_
- 
--
-+#include <sys/stat.h>
- #include "pipe/p_compiler.h"
- #include "pipe/p_state.h"
- 
---- a/src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
-+++ b/src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
-@@ -28,6 +28,8 @@
- #ifndef RADV_AMDGPU_WINSYS_H
- #define RADV_AMDGPU_WINSYS_H
-
-+#include <sys/types.h>
-+
- #include <amdgpu.h>
- #include <pthread.h>
- #include "util/list.h"

pkgs/development/libraries/ncurses/clang.patch

···
-diff -ruNp ncurses-5.8.orig/c++/cursesf.h ncurses-5.8/c++/cursesf.h
---- ncurses-5.8.orig/c++/cursesf.h	2005-08-13 21:08:24.000000000 +0300
-+++ ncurses-5.8/c++/cursesf.h	2011-04-03 18:29:29.000000000 +0300
-@@ -681,7 +681,7 @@ public:
- 		   const T* p_UserData = STATIC_CAST(T*)(0),
- 		   bool with_frame=FALSE,
- 		   bool autoDelete_Fields=FALSE)
--    : NCursesForm (Fields, with_frame, autoDelete_Fields) {
-+    : NCursesForm (&Fields, with_frame, autoDelete_Fields) {
-       if (form)
- 	set_user (const_cast<void *>(p_UserData));
-   };
-@@ -694,7 +694,7 @@ public:
- 		   const T* p_UserData = STATIC_CAST(T*)(0),
- 		   bool with_frame=FALSE,
- 		   bool autoDelete_Fields=FALSE)
--    : NCursesForm (Fields, nlines, ncols, begin_y, begin_x,
-+    : NCursesForm (&Fields, nlines, ncols, begin_y, begin_x,
- 		   with_frame, autoDelete_Fields) {
-       if (form)
- 	set_user (const_cast<void *>(p_UserData));
-diff -ruNp ncurses-5.8.orig/c++/cursesm.h ncurses-5.8/c++/cursesm.h
---- ncurses-5.8.orig/c++/cursesm.h	2005-08-13 21:10:36.000000000 +0300
-+++ ncurses-5.8/c++/cursesm.h	2011-04-03 18:31:42.000000000 +0300
-@@ -639,7 +639,7 @@ public:
- 		   const T* p_UserData = STATIC_CAST(T*)(0),
- 		   bool with_frame=FALSE,
- 		   bool autoDelete_Items=FALSE)
--    : NCursesMenu (Items, with_frame, autoDelete_Items) {
-+    : NCursesMenu (&Items, with_frame, autoDelete_Items) {
-       if (menu)
- 	set_user (const_cast<void *>(p_UserData));
-   };
-@@ -651,7 +651,7 @@ public:
- 		   int begin_x = 0,
- 		   const T* p_UserData = STATIC_CAST(T*)(0),
- 		   bool with_frame=FALSE)
--    : NCursesMenu (Items, nlines, ncols, begin_y, begin_x, with_frame) {
-+    : NCursesMenu (&Items, nlines, ncols, begin_y, begin_x, with_frame) {
-       if (menu)
- 	set_user (const_cast<void *>(p_UserData));
-   };

pkgs/development/libraries/ncurses/default.nix

···
     sha256 = "15r2456g0mlq2q7gh2z52vl6zv6y0z8sdchrs80kg4idqd8sm8fd";
   };
 
-  patches = lib.optional (!stdenv.cc.isClang) ./clang.patch;
-
   outputs = [ "out" "dev" "man" ];
   setOutputFlags = false; # some aren't supported
 

pkgs/development/libraries/polkit/default.nix

···
-{ lib, stdenv, fetchurl, pkg-config, glib, expat, pam, perl, fetchpatch
-, intltool, spidermonkey_78, gobject-introspection, libxslt, docbook_xsl, dbus
-, docbook_xml_dtd_412, gtk-doc, coreutils
-, useSystemd ? (stdenv.isLinux && !stdenv.hostPlatform.isMusl), systemd, elogind
+{ lib
+, stdenv
+, fetchFromGitLab
+, pkg-config
+, glib
+, expat
+, pam
+, meson
+, ninja
+, perl
+, rsync
+, python3
+, fetchpatch
+, gettext
+, spidermonkey_78
+, gobject-introspection
+, libxslt
+, docbook-xsl-nons
+, dbus
+, docbook_xml_dtd_412
+, gtk-doc
+, coreutils
+, useSystemd ? stdenv.isLinux
+, systemd
+, elogind
 # needed until gobject-introspection does cross-compile (https://github.com/NixOS/nixpkgs/pull/88222)
 , withIntrospection ? (stdenv.buildPlatform == stdenv.hostPlatform)
 # A few tests currently fail on musl (polkitunixusertest, polkitunixgrouptest, polkitidentitytest segfault).
···
 }:
 
 let
-
   system = "/run/current-system/sw";
   setuid = "/run/wrappers/bin";
-
 in
-
 stdenv.mkDerivation rec {
   pname = "polkit";
-  version = "0.119";
+  version = "0.120";
+
+  outputs = [ "bin" "dev" "out" ]; # small man pages in $bin
 
-  src = fetchurl {
-    url = "https://www.freedesktop.org/software/${pname}/releases/${pname}-${version}.tar.gz";
-    sha256 = "0p0zzmr0kh3mpmqya4q27y4h9b920zp5ya0i8909ahp9hvdrymy8";
+  # Tarballs do not contain subprojects.
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "polkit";
+    repo = "polkit";
+    rev = version;
+    sha256 = "oEaRf1g13zKMD+cP1iwIA6jaCDwvNfGy2i8xY8vuVSo=";
   };
 
-  patches = lib.optionals stdenv.hostPlatform.isMusl [
+  patches = [
+    # Allow changing base for paths in pkg-config file as before.
+    # https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/100
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/polkit/polkit/-/commit/7ba07551dfcd4ef9a87b8f0d9eb8b91fabcb41b3.patch";
+      sha256 = "ebbLILncq1hAZTBMsLm+vDGw6j0iQ0crGyhzyLZQgKA=";
+    })
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     # Make netgroup support optional (musl does not have it)
     # Upstream MR: https://gitlab.freedesktop.org/polkit/polkit/merge_requests/10
     # We use the version of the patch that Alpine uses successfully.
     (fetchpatch {
       name = "make-innetgr-optional.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/polkit/make-innetgr-optional.patch?id=391e7de6ced1a96c2dac812e0b12f1d7e0ea705e";
-      sha256 = "1p9qqqhnrfyjvvd50qh6vpl256kyfblm1qnhz5pm09klrl1bh1n4";
+      url = "https://git.alpinelinux.org/aports/plain/community/polkit/make-innetgr-optional.patch?id=424ecbb6e9e3a215c978b58c05e5c112d88dddfc";
+      sha256 = "0iyiksqk29sizwaa4623bv683px1fny67639qpb1him89hza00wy";
     })
   ];
 
-  postPatch = lib.optionalString stdenv.isDarwin ''
-    sed -i -e "s/-Wl,--as-needed//" configure.ac
-  '';
+  nativeBuildInputs = [
+    glib
+    gtk-doc
+    pkg-config
+    gettext
+    meson
+    ninja
+    perl
+    rsync
+    (python3.withPackages (pp: with pp; [
+      dbus-python
+      (python-dbusmock.overridePythonAttrs (attrs: {
+        # Avoid dependency cycle.
+        doCheck = false;
+      }))
+    ]))
 
-  outputs = [ "bin" "dev" "out" ]; # small man pages in $bin
+    # man pages
+    libxslt
+    docbook-xsl-nons
+    docbook_xml_dtd_412
+  ];
 
-  nativeBuildInputs =
-    [ glib gtk-doc pkg-config intltool perl ]
-    ++ [ libxslt docbook_xsl docbook_xml_dtd_412 ]; # man pages
-  buildInputs =
-    [ expat pam spidermonkey_78 ]
+  buildInputs = [
+    expat
+    pam
+    spidermonkey_78
+  ] ++ lib.optionals stdenv.isLinux [
     # On Linux, fall back to elogind when systemd support is off.
-    ++ lib.optional stdenv.isLinux (if useSystemd then systemd else elogind)
-    ++ lib.optional withIntrospection gobject-introspection;
+    (if useSystemd then systemd else elogind)
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
+  ];
 
   propagatedBuildInputs = [
     glib # in .pc Requires
   ];
 
-  preConfigure = ''
-    chmod +x test/mocklibc/bin/mocklibc{,-test}.in
-    patchShebangs .
+  checkInputs = [
+    dbus
+  ];
+
+  mesonFlags = [
+    "--datadir=${system}/share"
+    "--sysconfdir=/etc"
+    "-Dsystemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
+    "-Dpolkitd_user=polkituser" #TODO? <nixos> config.ids.uids.polkituser
+    "-Dos_type=redhat" # only affects PAM includes
+    "-Dintrospection=${lib.boolToString withIntrospection}"
+    "-Dtests=${lib.boolToString doCheck}"
+    "-Dgtk_doc=${lib.boolToString true}"
+    "-Dman=true"
+  ] ++ lib.optionals stdenv.isLinux [
+    "-Dsession_tracking=${if useSystemd then "libsystemd-login" else "libelogind"}"
+  ];
+
+  # HACK: We want to install policy files files to $out/share but polkit
+  # should read them from /run/current-system/sw/share on a NixOS system.
+  # Similarly for config files in /etc.
+  # With autotools, it was possible to override Make variables
+  # at install time but Meson does not support this
+  # so we need to convince it to install all files to a temporary
+  # location using DESTDIR and then move it to proper one in postInstall.
+  DESTDIR = "${placeholder "out"}/dest";
+
+  inherit doCheck;
+
+  postPatch = ''
+    patchShebangs test/polkitbackend/polkitbackendjsauthoritytest-wrapper.py
 
     # ‘libpolkit-agent-1.so’ should call the setuid wrapper on
     # NixOS.  Hard-coding the path is kinda ugly.  Maybe we can just
···
     substituteInPlace test/data/etc/polkit-1/rules.d/10-testing.rules \
       --replace   /bin/true ${coreutils}/bin/true \
       --replace   /bin/false ${coreutils}/bin/false
-
-  '' + lib.optionalString useSystemd /* bogus chroot detection */ ''
-    sed '/libsystemd autoconfigured/s/.*/:/' -i configure
   '';
 
-  configureFlags = [
-    "--datadir=${system}/share"
-    "--sysconfdir=/etc"
-    "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
-    "--with-polkitd-user=polkituser" #TODO? <nixos> config.ids.uids.polkituser
-    "--with-os-type=NixOS" # not recognized but prevents impurities on non-NixOS
-    (if withIntrospection then "--enable-introspection" else "--disable-introspection")
-  ] ++ lib.optional (!doCheck) "--disable-test";
+  postConfigure = ''
+    # Unpacked by meson
+    chmod +x subprojects/mocklibc-1.0/bin/mocklibc
+    patchShebangs subprojects/mocklibc-1.0/bin/mocklibc
+  '';
 
-  makeFlags = [
-    "INTROSPECTION_GIRDIR=${placeholder "out"}/share/gir-1.0"
-    "INTROSPECTION_TYPELIBDIR=${placeholder "out"}/lib/girepository-1.0"
-  ];
-
-  installFlags = [
-    "datadir=${placeholder "out"}/share"
-    "sysconfdir=${placeholder "out"}/etc"
-  ];
-
-  inherit doCheck;
-  checkInputs = [ dbus ];
   checkPhase = ''
     runHook preCheck
 
-    # unfortunately this test needs python-dbusmock, but python-dbusmock needs polkit,
-    # leading to a circular dependency
-    substituteInPlace test/Makefile --replace polkitbackend ""
-
     # tests need access to the system bus
-    dbus-run-session --config-file=${./system_bus.conf} -- sh -c 'DBUS_SYSTEM_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS make check'
+    dbus-run-session --config-file=${./system_bus.conf} -- sh -c 'DBUS_SYSTEM_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS meson test --print-errorlogs'
 
     runHook postCheck
+  '';
+
+  postInstall = ''
+    # Move stuff from DESTDIR to proper location.
+    # We use rsync to merge the directories.
+    rsync --archive "${DESTDIR}/etc" "$out"
+    rm --recursive "${DESTDIR}/etc"
+    rsync --archive "${DESTDIR}${system}"/* "$out"
+    rm --recursive "${DESTDIR}${system}"/*
+    rmdir --parents --ignore-fail-on-non-empty "${DESTDIR}${system}"
+    for o in $outputs; do
+        rsync --archive "${DESTDIR}/''${!o}" "$(dirname "''${!o}")"
+        rm --recursive "${DESTDIR}/''${!o}"
+    done
+    # Ensure the DESTDIR is removed.
+    destdirContainer="$(dirname "${DESTDIR}")"
+    pushd "$destdirContainer"; rmdir --parents "''${DESTDIR##$destdirContainer/}${builtins.storeDir}"; popd
   '';
 
   meta = with lib; {

pkgs/development/libraries/portaudio/default.nix

···
 
   propagatedBuildInputs = lib.optionals stdenv.isDarwin [ AudioUnit AudioToolbox CoreAudio CoreServices Carbon ];
 
+  # Disable parallel build as it fails as:
+  #   make: *** No rule to make target '../../../lib/libportaudio.la',
+  #     needed by 'libportaudiocpp.la'.  Stop.
+  # Next release should address it with
+  #     https://github.com/PortAudio/portaudio/commit/28d2781d9216115543aa3f0a0ffb7b4ee0fac551.patch
+  enableParallelBuilding = false;
+
   # not sure why, but all the headers seem to be installed by the make install
   installPhase = ''
     make install

pkgs/development/libraries/protobuf/3.18.nix

···
 { callPackage, ... }:
 
 callPackage ./generic-v3.nix {
-  version = "3.18.0";
-  sha256 = "0nhjw4m4dm6wqwwsi0b18js5wbh3ibrpsq195g6mk9cx54fx097f";
+  version = "3.18.1";
+  sha256 = "sha256-5PK0uuk7Du9hX/hHy0gninHIKu6b8THdfVh87Gn7y2Q=";
 }

pkgs/development/libraries/protobuf/3.19.nix

···
+{ callPackage, ... }:
+
+callPackage ./generic-v3.nix {
+  version = "3.19.0";
+  sha256 = "0rx4r4d7hqr0gi3v90jbkm2lnkj9p37dhgwx9d0w7kgh3rvr4i7g";
+}

pkgs/development/libraries/pth/default.nix

···
     configureFlagsArray+=("ac_cv_check_sjlj=ssjlj")
   '';
 
+  # Fails parallel build due to missing dependency on autogenrated
+  # 'pth_p.h' file:
+  #     ./shtool scpp -o pth_p.h ...
+  #     ./libtool --mode=compile --quiet gcc -c -I. -O2 -pipe pth_uctx.c
+  #     pth_uctx.c:31:10: fatal error: pth_p.h: No such file
+  enableParallelBuilding = false;
+
   meta = with lib; {
     description = "The GNU Portable Threads library";
     homepage = "https://www.gnu.org/software/pth";

pkgs/development/libraries/qt-5/5.15/default.nix

···
 
 # Updates
 
-Before a major version update, make a copy of this directory. (We like to
-keep the old version around for a short time after major updates.) Add a
-top-level attribute to `top-level/all-packages.nix`.
-
-1. Update the URL in `pkgs/development/libraries/qt-5/$VERSION/fetch.sh`.
-2. From the top of the Nixpkgs tree, run
-   `./maintainers/scripts/fetch-kde-qt.sh pkgs/development/libraries/qt-5/$VERSION`.
-3. Check that the new packages build correctly.
-4. Commit the changes and open a pull request.
+Run `./fetch.sh` to update package sources from Git.
+Check for any minor version changes.
 
 */
 
···
 
 let
 
+  srcs = import ./srcs.nix { inherit lib fetchgit fetchFromGitHub; };
+
   qtCompatVersion = srcs.qtbase.version;
 
   stdenvActual = if stdenv.cc.isClang then llvmPackages_5.stdenv else stdenv;
 
-  mirror = "https://download.qt.io";
-  srcs = import ./srcs.nix { inherit fetchurl; inherit mirror; } // {
-    # qtwebkit does not have an official release tarball on the qt mirror and is
-    # mostly maintained by the community.
-    qtwebkit = rec {
-      src = fetchFromGitHub {
-        owner = "qt";
-        repo = "qtwebkit";
-        rev = "v${version}";
-        sha256 = "0x8rng96h19xirn7qkz3lydal6v4vn00bcl0s3brz36dfs0z8wpg";
-      };
-      version = "5.212.0-alpha4";
-    };
-    qtwebengine =
-      let
-        branchName = "5.15.6";
-        rev = "v${branchName}-lts";
-      in
-      {
-        version = "${branchName}-${lib.substring 0 7 rev}";
-
-        src = fetchgit {
-          url = "https://github.com/qt/qtwebengine.git";
-          sha256 = "17bw9yf04zmr9ck5jkrd435c8b03zpf937vn2nwgsr8p78wkg3kr";
-          inherit rev branchName;
-          fetchSubmodules = true;
-          leaveDotGit = true;
-          name = "qtwebengine-${lib.substring 0 7 rev}.tar.gz";
-          postFetch = ''
-            # remove submodule .git directory
-            rm -rf "$out/src/3rdparty/.git"
-
-            # compress to not exceed the 2GB output limit
-            # try to make a deterministic tarball
-            tar -I 'gzip -n' \
-              --sort=name \
-              --mtime=1970-01-01 \
-              --owner=root --group=root \
-              --numeric-owner --mode=go=rX,u+rw,a-s \
-              --transform='s@^@source/@' \
-              -cf temp  -C "$out" .
-            rm -r "$out"
-            mv temp "$out"
-          '';
-        };
-      };
-  };
-
   patches = {
     qtbase = lib.optionals stdenv.isDarwin [
       ./qtbase.patch.d/0001-qtbase-mkspecs-mac.patch
···
       ./qtbase.patch.d/0009-qtbase-qtpluginpath.patch
       ./qtbase.patch.d/0010-qtbase-assert.patch
       ./qtbase.patch.d/0011-fix-header_module.patch
-      (fetchpatch { # This can be removed when https://codereview.qt-project.org/c/qt/qtbase/+/339323 is included in an release.
-        name = "0014-gcc11-compat.patch";
-        url = "https://codereview.qt-project.org/gitweb?p=qt/qtbase.git;a=patch;h=049e14870c13235cd066758f29c42dc96c1ccdf8";
-        sha256 = "1cb2hwi859hds0fa2cbap014qaa7mah9p0rcxcm2cvj2ybl33qfc";
-      })
-      (fetchpatch { # This can be removed when https://codereview.qt-project.org/c/qt/qtbase/+/363880/3 is included in an release.
-        name = "qtbase-mysql-version-vs-functionality-check.patch";
-        url = "https://codereview.qt-project.org/gitweb?p=qt/qtbase.git;a=patch;h=211369133cf40b2f522caaff259c19069ed23ca4";
-        sha256 = "19kq9h10qm344fpdqa9basrbzh1y5kr48c6jzz3nvk61pk4ja1k4";
-      })
     ];
     qtdeclarative = [ ./qtdeclarative.patch ];
     qtscript = [ ./qtscript.patch ];

pkgs/development/libraries/qt-5/5.15/fetch.sh

···
-WGET_ARGS=( http://download.qt.io/official_releases/qt/5.15/5.15.2/submodules/ \
-            -A '*.tar.xz' )
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-prefetch-scripts jq
+
+set -eox pipefail
+
+here="$(dirname "${BASH_SOURCE[0]}")"
+modules="${here}/modules"
+srcs="${here}/srcs-generated.json"
+
+while read -r module; do
+    if [[ -z "$module" ]]; then continue; fi
+    url="https://invent.kde.org/qt/qt/${module}.git"
+    nix-prefetch-git --url $url --rev refs/heads/kde/5.15 \
+        | jq "{key: \"${module}\", value: {url,rev,sha256}}"
+done < "$modules" | jq -s 'from_entries' > "${srcs}.tmp"
+
+mv "${srcs}.tmp" "$srcs"

pkgs/development/libraries/qt-5/5.15/modules

···
+qt3d
+qtactiveqt
+qtandroidextras
+qtbase
+qtcharts
+qtconnectivity
+qtdatavis3d
+qtdeclarative
+qtdoc
+qtgamepad
+qtgraphicaleffects
+qtimageformats
+qtlocation
+qtlottie
+qtmacextras
+qtmultimedia
+qtnetworkauth
+qtpurchasing
+qtquick3d
+qtquickcontrols
+qtquickcontrols2
+qtquicktimeline
+qtremoteobjects
+qtscript
+qtscxml
+qtsensors
+qtserialbus
+qtserialport
+qtspeech
+qtsvg
+qttools
+qttranslations
+qtvirtualkeyboard
+qtwayland
+qtwebchannel
+qtwebglplugin
+qtwebsockets
+qtwebview
+qtwinextras
+qtx11extras
+qtxmlpatterns

pkgs/development/libraries/qt-5/5.15/srcs-generated.json

···
+{
+  "qt3d": {
+    "url": "https://invent.kde.org/qt/qt/qt3d.git",
+    "rev": "7edec6e014de27b9dd03f63875c471aac606a918",
+    "sha256": "0qv4vhciigqd8bnqzrs7y71ls7jx1p9cal2rh78m42qgskk1ci59"
+  },
+  "qtactiveqt": {
+    "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
+    "rev": "f0d03da0e37a84029a4eae1733813521482ac1fb",
+    "sha256": "0llk76lf0mh4mzj7pwd8cs55wpmfq8v1bsdzvizb1sx0vfbjh8g6"
+  },
+  "qtandroidextras": {
+    "url": "https://invent.kde.org/qt/qt/qtandroidextras.git",
+    "rev": "8cce1098c59534352aa0f343ea73861f603ac04a",
+    "sha256": "130a1yda2m7pa10as3rccz84m3617422n6s51pdn4kp8p8rk7cs6"
+  },
+  "qtbase": {
+    "url": "https://invent.kde.org/qt/qt/qtbase.git",
+    "rev": "c9fde86b0a2440133bc08f4811b6ca793be47f0a",
+    "sha256": "1fqhdkv3sp3nbzqi2a5wvxn5d4v0xcrq2bl609bdyj4nx367a8wp"
+  },
+  "qtcharts": {
+    "url": "https://invent.kde.org/qt/qt/qtcharts.git",
+    "rev": "130463160b4923069eb98da49edaf7d93180f4f8",
+    "sha256": "19g35cddbfh307mk76wac1ps03warynlsj7xi8i596bxiaf7i4pw"
+  },
+  "qtconnectivity": {
+    "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
+    "rev": "69a87a9b831e36a578594a0a13130c384ad03121",
+    "sha256": "0ph07rdf9qfxnw3z2nqbmh6na65z0p2snmlzdw80amd7s0g255kw"
+  },
+  "qtdatavis3d": {
+    "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
+    "rev": "c085311c02dd216e5a041b90c164d55b3cf3ce92",
+    "sha256": "0xya1m2csb42yisl90s9822p9q92n7ags909nlbapfsb49qwsqnj"
+  },
+  "qtdeclarative": {
+    "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
+    "rev": "55324650f9e759a43dce927f823c9858574106c3",
+    "sha256": "0cxz4pqvb8l0wqpc4hr0xmc72csqf7dpbbzdqgil9nyyg21ihkz0"
+  },
+  "qtdoc": {
+    "url": "https://invent.kde.org/qt/qt/qtdoc.git",
+    "rev": "897e90fe304d844beaf694b82a93a50237fa8b9e",
+    "sha256": "1c4m9vlgg6bfw7hwzanl5s4vslg0r7xiz50lanhqrlcrr9i36xs1"
+  },
+  "qtgamepad": {
+    "url": "https://invent.kde.org/qt/qt/qtgamepad.git",
+    "rev": "64afa18a0a1e9588060e2e6d917bb01ccdd48a81",
+    "sha256": "1h9yb0asprynnb2qyjbmyglrkk9f9v19g6zzpk0gmixrp0h8gk46"
+  },
+  "qtgraphicaleffects": {
+    "url": "https://invent.kde.org/qt/qt/qtgraphicaleffects.git",
+    "rev": "c36998dc1581167b12cc3de8e4ac68c2a5d9f76e",
+    "sha256": "0x11n2fym765z3gyb4xnfl7v6zrip1wjkkl6nx1bxaya173fvdw8"
+  },
+  "qtimageformats": {
+    "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
+    "rev": "cb82c74310837fe4e832c8ab72176a5d63e4355f",
+    "sha256": "0j4cv5sa6mm3adcjw8cv6kbzrslmhjc1rgxqgc130l8vm3vmgbkr"
+  },
+  "qtlocation": {
+    "url": "https://invent.kde.org/qt/qt/qtlocation.git",
+    "rev": "861e372b6ad81570d4f496e42fb25a6699b72f2f",
+    "sha256": "1g24pg9v6sv5zf80r48innp3h4g0hss69hnr7ygfzfvfnmmn6g52"
+  },
+  "qtlottie": {
+    "url": "https://invent.kde.org/qt/qt/qtlottie.git",
+    "rev": "fa8c8bfc6742ab98b61d1351e054e0e73e9a42f4",
+    "sha256": "1xgykaw8qjnaip6h9jx0nfadc9amb6aclk758vm5pp43dvs5j96r"
+  },
+  "qtmacextras": {
+    "url": "https://invent.kde.org/qt/qt/qtmacextras.git",
+    "rev": "e72896968697e2a8af16a312e1560948e4c40f30",
+    "sha256": "1hndpbr1nnybn7frg76q99bk1c8fhvra6wjm0q78p4a8pinrvcms"
+  },
+  "qtmultimedia": {
+    "url": "https://invent.kde.org/qt/qt/qtmultimedia.git",
+    "rev": "bd29c87027637a013f2c5e3b549fcda84e4d7545",
+    "sha256": "11pz9zzrhsr3n78ga7l3kp3gi20rpxsa4iz3wclhcbcm2xr3nd94"
+  },
+  "qtnetworkauth": {
+    "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git",
+    "rev": "53870ee9bb9117702cd1f11cb1c5d1cfc2d5394a",
+    "sha256": "0idaysqpwrghih7ijrm9hagj9jw3fy9nw539fr4d9rmcggnkkzn2"
+  },
+  "qtpurchasing": {
+    "url": "https://invent.kde.org/qt/qt/qtpurchasing.git",
+    "rev": "cbf444fb570ca4f4ca21d963d2ae4010f10d473e",
+    "sha256": "1cki7n62wqm3xxn36mka0y67ngn7jvjkrvr08vsassbjb7kfsmxp"
+  },
+  "qtquick3d": {
+    "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
+    "rev": "3e3e53c834b25dc2959dd30f319d12d6f84ee1e3",
+    "sha256": "1b1khfg26zl3p28yvhwjfldqy3flh10pb5hm5z0av03rz7jy7l8s"
+  },
+  "qtquickcontrols": {
+    "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
+    "rev": "cf3f6d7fec824cdf01f9b329ab3b92b1c0e0a420",
+    "sha256": "1vxp0kwigwhqyyfm0xg8llyd1l1f4l18hmk6xqkm57xpi15x55bc"
+  },
+  "qtquickcontrols2": {
+    "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
+    "rev": "be66bf9a5618c745d2a6ee2262967af6307b3b07",
+    "sha256": "11h3f3rb2kqgsw7njzhjwazw1k03v12i83irjndylafiaqw6c6ks"
+  },
+  "qtquicktimeline": {
+    "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
+    "rev": "67503cdadea43b95ddad0de1a04951aff0ce1a07",
+    "sha256": "0h4b3ibcf6rsmqmcfbwbk9pbvw3b9cac8nx2538aqvnpyyp1vhid"
+  },
+  "qtremoteobjects": {
+    "url": "https://invent.kde.org/qt/qt/qtremoteobjects.git",
+    "rev": "4d6d1e35fb8e0cb900b5e5e9266edea51dc4f735",
+    "sha256": "1zbxl5jk7x8qklrnbbaikymyviigqdq7vf0wc8gzls4126vcx146"
+  },
+  "qtscript": {
+    "url": "https://invent.kde.org/qt/qt/qtscript.git",
+    "rev": "5cec94b2c1503f106f4ef4778d016410ebb86211",
+    "sha256": "1xdri98cw7m78k9kfb53cgh8wyz98q3i623jhhcv01rvy1zsf8m1"
+  },
+  "qtscxml": {
+    "url": "https://invent.kde.org/qt/qt/qtscxml.git",
+    "rev": "7a15000f42c7a3171719727cd056f82a78244ed7",
+    "sha256": "1i2ajsj9pb1s4lk4djj1h1ay9mkz1z3m75a747cspyc1p1iymipq"
+  },
+  "qtsensors": {
+    "url": "https://invent.kde.org/qt/qt/qtsensors.git",
+    "rev": "921a31375f29e429e95352b08b2b9dbfea663cb1",
+    "sha256": "1ijayk6lf34nwv7s3ib3cfqx9sjrmr1c6jnziwmxa1l6fy3ik4g8"
+  },
+  "qtserialbus": {
+    "url": "https://invent.kde.org/qt/qt/qtserialbus.git",
+    "rev": "8884c5e43df846deac5a0c7c290eeb633d6bfe32",
+    "sha256": "1ydb5x21j26pl58mr6klnwixkqx8h119nvnzvyawz83gji3ay3a5"
+  },
+  "qtserialport": {
+    "url": "https://invent.kde.org/qt/qt/qtserialport.git",
+    "rev": "941d1d8560d1f3e40077c251fbde6fd6a5b0f0d4",
+    "sha256": "0x7ly67gddmz0hqls9109bk4rgaa97ksyv24qk4brrhzkpr7q9cx"
+  },
+  "qtspeech": {
+    "url": "https://invent.kde.org/qt/qt/qtspeech.git",
+    "rev": "a0efc38377e5bf7eed2d354d1cb4d7a0d5dc7e1b",
+    "sha256": "1ljf45f65pfp8x367qnzl0ssz7n17cxhk29qvqpz9z7rh65zqix5"
+  },
+  "qtsvg": {
+    "url": "https://invent.kde.org/qt/qt/qtsvg.git",
+    "rev": "24128cdf8bef53eddf31a5709bbbc46293006b1c",
+    "sha256": "0vinjcbq4saxhlmvb5i93bzgg30qc3j8r2qfwrzaxc4vmfhfgi56"
+  },
+  "qttools": {
+    "url": "https://invent.kde.org/qt/qt/qttools.git",
+    "rev": "33693a928986006d79c1ee743733cde5966ac402",
+    "sha256": "02n0lppsp6g4s9bdvnfxpf7ndkbs9bzm0clcwvirwf2cd8q95a4n"
+  },
+  "qttranslations": {
+    "url": "https://invent.kde.org/qt/qt/qttranslations.git",
+    "rev": "8fbbdf21f127197f97b58c7d80d2fa2a59135638",
+    "sha256": "06r2jb2fsdr5fvxs748war0lr4mm3l3d3b37xc4n73y294vwrmn7"
+  },
+  "qtvirtualkeyboard": {
+    "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
+    "rev": "353b75b2e34bdae901625bbddf5c5e3f3e6c0de5",
+    "sha256": "12nv773zc05yrbai1z6i481yinih0kxcjzgm9pa0580qz69gd9a5"
+  },
+  "qtwayland": {
+    "url": "https://invent.kde.org/qt/qt/qtwayland.git",
+    "rev": "992833ca741efe8f533c61abfaf129a1d8bfcfee",
+    "sha256": "1w8mq38k6s0fncqv113bw1pc7g10ysfmsbyg23hxh9fr5q4ia4q7"
+  },
+  "qtwebchannel": {
+    "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
+    "rev": "47be9a51b01d9fd9e7f6dca81e98d4eedcec6d38",
+    "sha256": "167rp43c86xr4grzxs4bl46y6sf1q9xa0641mgp4r94g2ipxyc1d"
+  },
+  "qtwebglplugin": {
+    "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
+    "rev": "550a8cee241bbf8c11863dec9587d579dcb1108b",
+    "sha256": "0p1y0b8zsm7rrkhhylndp282ghgki2cjrgc4n5zhjn732ahxg515"
+  },
+  "qtwebsockets": {
+    "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
+    "rev": "e7883bc64440b1ff4666272ac6eb710ee4bc221b",
+    "sha256": "1rj99y1f0wn6g1m2k53xkni5v79zgq25yv8b9wx2bz0n2r9iasca"
+  },
+  "qtwebview": {
+    "url": "https://invent.kde.org/qt/qt/qtwebview.git",
+    "rev": "920de5f1cd9f9001cfef1bfd2c19e6720793362f",
+    "sha256": "04hnqalabhypkd2hgl45jxf9p1p6dgjwlc5b7gs4f6588lafgd3f"
+  },
+  "qtwinextras": {
+    "url": "https://invent.kde.org/qt/qt/qtwinextras.git",
+    "rev": "3df03dab21f3e84d5a7274c64dd879854ca1bfe7",
+    "sha256": "12dkw982xcm7hxw3lxhg34wny4srbickxm9s3nz7bdyp9dmqnygx"
+  },
+  "qtx11extras": {
+    "url": "https://invent.kde.org/qt/qt/qtx11extras.git",
+    "rev": "3898f5484fd4864b047729bfeda9a1222f32364f",
+    "sha256": "04rp8arml19b03iybd7sa78dsdv7386m9ymmgqciwl13dhwjssra"
+  },
+  "qtxmlpatterns": {
+    "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
+    "rev": "189e28d0aff1f3d7960228ba318b83e3cadac98c",
+    "sha256": "0vs9j2i1dnlivcrzz175zz66ql1m8mrdqkglvyqjqv6cb7mpskrq"
+  }
+}

pkgs/development/libraries/qt-5/5.15/srcs.nix

···
-# DO NOT EDIT! This file is generated automatically.
-# Command: ./maintainers/scripts/fetch-kde-qt.sh pkgs/development/libraries/qt-5/5.15
-{ fetchurl, mirror }:
+{ lib, fetchgit, fetchFromGitHub }:
 
-{
-  qt3d = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qt3d-everywhere-src-5.15.2.tar.xz";
-      sha256 = "03ed6a48c813c75296c19f5d721184ab168280b69d2656cf16f877d3d4c55c1d";
-      name = "qt3d-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtactiveqt = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtactiveqt-everywhere-src-5.15.2.tar.xz";
-      sha256 = "868161fee0876d17079cd5bed58d1667bf19ffd0018cbe515129f11510ad2a5c";
-      name = "qtactiveqt-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtandroidextras = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtandroidextras-everywhere-src-5.15.2.tar.xz";
-      sha256 = "5813278690d89a9c232eccf697fc280034de6f9f02a7c40d95ad5fcf8ac8dabd";
-      name = "qtandroidextras-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtbase = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtbase-everywhere-src-5.15.2.tar.xz";
-      sha256 = "909fad2591ee367993a75d7e2ea50ad4db332f05e1c38dd7a5a274e156a4e0f8";
-      name = "qtbase-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtcharts = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtcharts-everywhere-src-5.15.2.tar.xz";
-      sha256 = "e0750e4195bd8a8b9758ab4d98d437edbe273cd3d289dd6a8f325df6d13f3d11";
-      name = "qtcharts-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtconnectivity = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtconnectivity-everywhere-src-5.15.2.tar.xz";
-      sha256 = "0380327871f76103e5b8c2a305988d76d352b6a982b3e7b3bc3cdc184c64bfa0";
-      name = "qtconnectivity-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtdatavis3d = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtdatavis3d-everywhere-src-5.15.2.tar.xz";
-      sha256 = "226a6575d573ad78aca459709722c496c23aee526aa0c38eb7c93b0bea1eb6fd";
-      name = "qtdatavis3d-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtdeclarative = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtdeclarative-everywhere-src-5.15.2.tar.xz";
-      sha256 = "c600d09716940f75d684f61c5bdaced797f623a86db1627da599027f6c635651";
-      name = "qtdeclarative-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtdoc = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtdoc-everywhere-src-5.15.2.tar.xz";
-      sha256 = "a47809f00f1bd690ca4e699cb32ffe7717d43da84e0167d1f562210da7714ce4";
-      name = "qtdoc-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtgamepad = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtgamepad-everywhere-src-5.15.2.tar.xz";
-      sha256 = "c77611f7898326d69176ad67a9b886f617cdedc368ec29f223d63537d25b075c";
-      name = "qtgamepad-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtgraphicaleffects = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtgraphicaleffects-everywhere-src-5.15.2.tar.xz";
-      sha256 = "ec8d67f64967d5046410490b549c576f9b9e8b47ec68594ae84aa8870173dfe4";
-      name = "qtgraphicaleffects-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtimageformats = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtimageformats-everywhere-src-5.15.2.tar.xz";
-      sha256 = "bf8285c7ce04284527ab823ddc7cf48a1bb79131db3a7127342167f4814253d7";
-      name = "qtimageformats-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtlocation = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtlocation-everywhere-src-5.15.2.tar.xz";
-      sha256 = "984fcb09e108df49a8dac35d5ce6dffc49caafd2acb1c2f8a5173a6a21f392a0";
-      name = "qtlocation-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtlottie = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtlottie-everywhere-src-5.15.2.tar.xz";
-      sha256 = "cec6095ab8f714e609d2ad3ea8c4fd819461ce8793adc42abe37d0f6dc432517";
-      name = "qtlottie-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtmacextras = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtmacextras-everywhere-src-5.15.2.tar.xz";
-      sha256 = "6959b0f2cec71cd66800f36cab797430860e55fa33c9c23698d6a08fc2b8776e";
-      name = "qtmacextras-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtmultimedia = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtmultimedia-everywhere-src-5.15.2.tar.xz";
-      sha256 = "0c3758810e5131aabcf76e4965e4c18b8911af54d9edd9305d2a8278d8346df5";
-      name = "qtmultimedia-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtnetworkauth = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtnetworkauth-everywhere-src-5.15.2.tar.xz";
-      sha256 = "fcc2ec42faa68561efa8f00cd72e662fbc06563ebc6de1dc42d96bb2997acd85";
-      name = "qtnetworkauth-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtpurchasing = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtpurchasing-everywhere-src-5.15.2.tar.xz";
-      sha256 = "87120d319ff2f8106e78971f7296d72a66dfe91e763d213199aea55046e93227";
-      name = "qtpurchasing-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtquick3d = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtquick3d-everywhere-src-5.15.2.tar.xz";
-      sha256 = "5b0546323365ce34e4716f22f305ebb4902e222c1a0910b65ee448443c2f94bb";
-      name = "qtquick3d-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtquickcontrols = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtquickcontrols-everywhere-src-5.15.2.tar.xz";
-      sha256 = "c393fb7384b1f047f10e91a6832cf3e6a4c2a41408b8cb2d05af2283e8549fb5";
-      name = "qtquickcontrols-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtquickcontrols2 = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtquickcontrols2-everywhere-src-5.15.2.tar.xz";
-      sha256 = "671b6ce5f4b8ecc94db622d5d5fb29ef4ff92819be08e5ea55bfcab579de8919";
-      name = "qtquickcontrols2-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtquicktimeline = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtquicktimeline-everywhere-src-5.15.2.tar.xz";
-      sha256 = "b9c247227607437acec7c7dd18ad46179d20369c9d22bdb1e9fc128dfb832a28";
-      name = "qtquicktimeline-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtremoteobjects = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtremoteobjects-everywhere-src-5.15.2.tar.xz";
-      sha256 = "6781b6bc90888254ea77ce812736dac00c67fa4eeb3095f5cd65e4b9c15dcfc2";
-      name = "qtremoteobjects-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtscript = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtscript-everywhere-src-5.15.2.tar.xz";
-      sha256 = "a299715369afbd1caa4d7fa2875d442eab91adcaacafce54a36922442624673e";
-      name = "qtscript-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtscxml = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtscxml-everywhere-src-5.15.2.tar.xz";
-      sha256 = "60b9590b9a41c60cee7b8a8c8410ee4625f0389c1ff8d79883ec5a985638a7dc";
-      name = "qtscxml-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtsensors = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtsensors-everywhere-src-5.15.2.tar.xz";
-      sha256 = "3f0011f9e9942cad119146b54d960438f4568a22a274cdad4fae06bb4e0e4839";
-      name = "qtsensors-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtserialbus = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtserialbus-everywhere-src-5.15.2.tar.xz";
-      sha256 = "aeeb7e5c0d3f8503215b22e1a84c0002ca67cf63862f6e3c6ef44a67ca31bd88";
-      name = "qtserialbus-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtserialport = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtserialport-everywhere-src-5.15.2.tar.xz";
-      sha256 = "59c559d748417306bc1b2cf2315c1e63eed011ace38ad92946af71f23e2ef79d";
-      name = "qtserialport-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtspeech = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtspeech-everywhere-src-5.15.2.tar.xz";
-      sha256 = "c810fb9eecb08026434422a32e79269627f3bc2941be199e86ec410bdfe883f5";
-      name = "qtspeech-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtsvg = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtsvg-everywhere-src-5.15.2.tar.xz";
-      sha256 = "8bc3c2c1bc2671e9c67d4205589a8309b57903721ad14c60ea21a5d06acb585e";
-      name = "qtsvg-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qttools = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qttools-everywhere-src-5.15.2.tar.xz";
-      sha256 = "c189d0ce1ff7c739db9a3ace52ac3e24cb8fd6dbf234e49f075249b38f43c1cc";
-      name = "qttools-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qttranslations = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qttranslations-everywhere-src-5.15.2.tar.xz";
-      sha256 = "d5788e86257b21d5323f1efd94376a213e091d1e5e03b45a95dd052b5f570db8";
-      name = "qttranslations-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtvirtualkeyboard = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtvirtualkeyboard-everywhere-src-5.15.2.tar.xz";
-      sha256 = "9a3193913be30f09a896e3b8c2f9696d2e9b3f88a63ae9ca8c97a2786b68cf55";
-      name = "qtvirtualkeyboard-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwayland = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwayland-everywhere-src-5.15.2.tar.xz";
-      sha256 = "193732229ff816f3aaab9a5e2f6bed71ddddbf1988ce003fe8dd84a92ce9aeb5";
-      name = "qtwayland-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwebchannel = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwebchannel-everywhere-src-5.15.2.tar.xz";
-      sha256 = "127fe79c43b386713f151ed7d411cd81e45e29f9c955584f29736f78c9303ec1";
-      name = "qtwebchannel-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwebengine = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwebengine-everywhere-src-5.15.2.tar.xz";
-      sha256 = "c8afca0e43d84f7bd595436fbe4d13a5bbdb81ec5104d605085d07545b6f91e0";
-      name = "qtwebengine-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwebglplugin = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwebglplugin-everywhere-src-5.15.2.tar.xz";
-      sha256 = "81e782b517ed29e10bea1aa90c9f59274c98a910f2c8b105fa78368a36b41446";
-      name = "qtwebglplugin-everywhere-src-5.15.2.tar.xz";
-    };
+let
+  version = "5.15.3";
+  overrides = {
+    qtscript.version = "5.15.4";
   };
-  qtwebsockets = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwebsockets-everywhere-src-5.15.2.tar.xz";
-      sha256 = "a0b42d85dd34ff6e2d23400e02f83d8b85bcd80e60efd1521d12d9625d4a233f";
-      name = "qtwebsockets-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwebview = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwebview-everywhere-src-5.15.2.tar.xz";
-      sha256 = "be9f46167e4977ead5ef5ecf883fdb812a4120f2436383583792f65557e481e7";
-      name = "qtwebview-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwinextras = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwinextras-everywhere-src-5.15.2.tar.xz";
-      sha256 = "65b8272005dec00791ab7d81ab266d1e3313a3bbd8e54e546d984cf4c4ab550e";
-      name = "qtwinextras-everywhere-src-5.15.2.tar.xz";
+
+  mk = name: args:
+    let
+      override = overrides.${name} or {};
+    in
+    {
+      version = override.version or version;
+      src = override.src or
+        fetchgit {
+          inherit (args) url rev sha256;
+          fetchLFS = false;
+          fetchSubmodules = false;
+          deepClone = false;
+          leaveDotGit = false;
+        };
     };
-  };
-  qtx11extras = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtx11extras-everywhere-src-5.15.2.tar.xz";
-      sha256 = "7014702ee9a644a5a93da70848ac47c18851d4f8ed622b29a72eed9282fc6e3e";
-      name = "qtx11extras-everywhere-src-5.15.2.tar.xz";
+in
+lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
+// {
+  # qtwebkit does not have an official release tarball on the qt mirror and is
+  # mostly maintained by the community.
+  qtwebkit = rec {
+    src = fetchFromGitHub {
+      owner = "qt";
+      repo = "qtwebkit";
+      rev = "v${version}";
+      sha256 = "0x8rng96h19xirn7qkz3lydal6v4vn00bcl0s3brz36dfs0z8wpg";
     };
+    version = "5.212.0-alpha4";
   };
-  qtxmlpatterns = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtxmlpatterns-everywhere-src-5.15.2.tar.xz";
-      sha256 = "76ea2162a7c349188d7e7e4f6c77b78e8a205494c90fee3cea3487a1ae2cf2fa";
-      name = "qtxmlpatterns-everywhere-src-5.15.2.tar.xz";
+
+  qtwebengine =
+    let
+      branchName = "5.15.6";
+      rev = "v${branchName}-lts";
+    in
+    {
+      version = "${branchName}-${lib.substring 0 7 rev}";
+
+      src = fetchgit {
+        url = "https://github.com/qt/qtwebengine.git";
+        sha256 = "17bw9yf04zmr9ck5jkrd435c8b03zpf937vn2nwgsr8p78wkg3kr";
+        inherit rev branchName;
+        fetchSubmodules = true;
+        leaveDotGit = true;
+        name = "qtwebengine-${lib.substring 0 7 rev}.tar.gz";
+        postFetch = ''
+          # remove submodule .git directory
+          rm -rf "$out/src/3rdparty/.git"
+
+          # compress to not exceed the 2GB output limit
+          # try to make a deterministic tarball
+          tar -I 'gzip -n' \
+            --sort=name \
+            --mtime=1970-01-01 \
+            --owner=root --group=root \
+            --numeric-owner --mode=go=rX,u+rw,a-s \
+            --transform='s@^@source/@' \
+            -cf temp  -C "$out" .
+          rm -r "$out"
+          mv temp "$out"
+        '';
+      };
     };
-  };
 }

pkgs/development/libraries/qt-5/modules/qtbase.nix

···
     sed -i '/PATHS.*NO_DEFAULT_PATH/ d' src/corelib/Qt5CoreMacros.cmake
     sed -i 's/NO_DEFAULT_PATH//' src/gui/Qt5GuiConfigExtras.cmake.in
     sed -i '/PATHS.*NO_DEFAULT_PATH/ d' mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
+  '' + lib.optionalString (compareVersion "5.15.0" >= 0) ''
+    patchShebangs ./bin
   '' + (
     if stdenv.isDarwin then ''
         sed -i \
···
     ''}
 
     NIX_CFLAGS_COMPILE+=" -DNIXPKGS_QT_PLUGIN_PREFIX=\"$qtPluginPrefix\""
+  '' + lib.optionalString (compareVersion "5.15.0" >= 0) ''
+    ./bin/syncqt.pl -version $version
   '';
 
   postConfigure = ''

pkgs/development/libraries/qt-5/qtModule.nix

···
     ${args.preConfigure or ""}
 
     fixQtBuiltinPaths . '*.pr?'
+  '' + lib.optionalString (builtins.compareVersions "5.15.0" version <= 0)
+  # Note: We use ${version%%-*} to remove any tag from the end of the version
+  # string. Version tags are added by Nixpkgs maintainers and not reflected in
+  # the source version.
+  ''
+    if [[ -z "$dontCheckQtModuleVersion" ]] \
+        && grep -q '^MODULE_VERSION' .qmake.conf 2>/dev/null \
+        && ! grep -q -F "''${version%%-*}" .qmake.conf 2>/dev/null
+    then
+      echo >&2 "error: could not find version ''${version%%-*} in .qmake.conf"
+      echo >&2 "hint: check .qmake.conf and update the package version in Nixpkgs"
+      exit 1
+    fi
+
+    if [[ -z "$dontSyncQt" && -f sync.profile ]]; then
+      syncqt.pl -version "''${version%%-*}"
+    fi
   '';
 
   dontWrapQtApps = args.dontWrapQtApps or true;

pkgs/development/libraries/snappy/default.nix

···
 { lib, stdenv, fetchFromGitHub, cmake
+, fetchpatch
 , static ? stdenv.hostPlatform.isStatic
 }:
 
 stdenv.mkDerivation rec {
   pname = "snappy";
-  version = "1.1.8";
+  version = "1.1.9";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "snappy";
     rev = version;
-    sha256 = "1j0kslq2dvxgkcxl1gakhvsa731yrcvcaipcp5k8k7ayicvkv9jv";
+    sha256 = "sha256-JXWl63KVP+CDNWIXYtz+EKqWLJbPKl3ifhr8dKAp/w8=";
   };
 
-  patches = [ ./disable-benchmark.patch ];
+  patches = [
+    (fetchpatch {
+      name = "clang-7-compat.patch";
+      url = "https://github.com/google/snappy/pull/142/commits/658cb2fcf67b626fff2122a3dbf7a3560c58f7ee.patch";
+      sha256 = "1kg3lxjwmhc7gjx36nylilnf444ddbnr3px1wpvyc6l1nh6zh4al";
+    })
+  ];
 
   outputs = [ "out" "dev" ];
 
···
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
     "-DCMAKE_SKIP_BUILD_RPATH=OFF"
+    "-DSNAPPY_BUILD_TESTS=OFF"
+    "-DSNAPPY_BUILD_BENCHMARKS=OFF"
   ];
 
   postInstall = ''
     substituteInPlace "$out"/lib/cmake/Snappy/SnappyTargets.cmake \
       --replace 'INTERFACE_INCLUDE_DIRECTORIES "''${_IMPORT_PREFIX}/include"' 'INTERFACE_INCLUDE_DIRECTORIES "'$dev'"'
+
+    mkdir -p $dev/lib/pkgconfig
+    cat <<EOF > $dev/lib/pkgconfig/snappy.pc
+      Name: snappy
+      Description: Fast compressor/decompressor library.
+      Version: ${version}
+      Libs: -L$out/lib -lsnappy
+      Cflags: -I$dev/include
+    EOF
   '';
 
-  checkTarget = "test";
+  #checkTarget = "test";
 
-  doCheck = true;
+  # requires gbenchmark and gtest but it also installs them out $dev
+  doCheck = false;
 
   meta = with lib; {
     homepage = "https://google.github.io/snappy/";

pkgs/development/libraries/snappy/disable-benchmark.patch

···
---- a/snappy-test.cc
-+++ b/snappy-test.cc
-@@ -46 +46 @@
--DEFINE_bool(run_microbenchmarks, true,
-+DEFINE_bool(run_microbenchmarks, false,

pkgs/development/libraries/srtp/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libsrtp";
-  version = "2.4.0";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "cisco";
     repo = "libsrtp";
     rev = "v${version}";
-    sha256 = "0syl2ywddgqz29h43d6rc7waf3hp2yc14yhnrvdsja2bg8wrv6sb";
+    sha256 = "sha256-6FAkfxC7Tg7uIAmTmRt5Sn8/YofILfpe7Y4pSaq8XL8=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/xalanc/default.nix

···
 
   buildInputs = [ xercesc getopt ];
 
+  # Parallel build fails as:
+  #   c++ ... -c ... ExecutionContext.cpp
+  #   ProblemListenerBase.hpp:28:10: fatal error: LocalMsgIndex.hpp: No such file or directory
+  # The build failure happens due to missing intra-project dependencies
+  # against generated headers. Future 1.12 version dropped
+  # autotools-based build system. Let's disable parallel builds until
+  # next release.
+  enableParallelBuilding = false;
+
   meta = {
     homepage = "http://xalan.apache.org/";
     description = "A XSLT processor for transforming XML documents";

pkgs/development/python-modules/Nikola/default.nix

···
 , pytestCheckHook
 , pythonOlder
 , requests
-, ruamel_yaml
+, ruamel-yaml
 , stdenv
 , toml
 , typogrify
···
     pyphen
     PyRSS2Gen
     requests
-    ruamel_yaml
+    ruamel-yaml
     toml
     typogrify
     unidecode

pkgs/development/python-modules/argon2_cffi/default.nix

···
 , fetchPypi
 , isPy3k
 , lib
+, stdenv
 }:
 
 buildPythonPackage rec {
   pname = "argon2_cffi";
-  version = "20.1.0";
+  version = "21.1.0";
 
   src = fetchPypi {
     pname = "argon2-cffi";
     inherit version;
-    sha256 = "0zgr4mnnm0p4i99023safb0qb8cgvl202nly1rvylk2b7qnrn0nq";
+    sha256 = "sha256-9xC2EQPRofaSyj7L0Tc+KKpeVFrGJboGf/L+yhsruHA=";
   };
 
   propagatedBuildInputs = [ cffi six ] ++ lib.optional (!isPy3k) enum34;
+
+  propagatedNativeBuildInputs = [ cffi ];
+
+  ARGON2_CFFI_USE_SSE2 = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) "0";
+
   checkInputs = [ hypothesis pytest wheel ];
   checkPhase = ''
     pytest tests

pkgs/development/python-modules/asgiref/default.nix

···
-{ stdenv
+{ lib
+, stdenv
 , async-timeout
 , buildPythonPackage
 , fetchFromGitHub
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
-, lib
 }:
 
 buildPythonPackage rec {
-  version = "3.3.4";
+  version = "3.4.1";
   pname = "asgiref";
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "django";
     repo = pname;
     rev = version;
-    sha256 = "1rr76252l6p12yxc0q4k9wigg1jz8nsqga9c0nixy9q77zhvh9n2";
+    sha256 = "sha256-aXD46qH5sTTmp0rlzQGLAN+MfIz1u6obCwtfqoIYgBA=";
   };
 
-  propagatedBuildInputs = [ async-timeout ];
+  propagatedBuildInputs = [
+    async-timeout
+  ];
 
   checkInputs = [
     pytestCheckHook
···
     "test_multiprocessing"
   ];
 
+  pythonImportsCheck = [ "asgiref" ];
+
   meta = with lib; {
     description = "Reference ASGI adapters and channel layers";
+    homepage = "https://github.com/django/asgiref";
     license = licenses.bsd3;
-    homepage = "https://github.com/django/asgiref";
+    maintainers = with maintainers; [ ];
   };
 }

pkgs/development/python-modules/bcrypt/default.nix

···
 
   propagatedBuildInputs = [ six ] ++ lib.optional (!isPyPy) cffi;
 
+  propagatedNativeBuildInputs = lib.optional (!isPyPy) cffi;
+
   meta = with lib; {
     maintainers = with maintainers; [ domenkozar ];
     description = "Modern password hashing for your software and your servers";

pkgs/development/python-modules/brotlicffi/default.nix

···
     brotli
   ];
 
+  propagatedNativeBuildInputs = [
+    cffi
+  ];
+
   propagatedBuildInputs = [
     cffi
   ];

pkgs/development/python-modules/brotlipy/default.nix

···
 
   propagatedBuildInputs = [ cffi enum34 construct ];
 
+  propagatedNativeBuildInputs = [ cffi ];
+
   checkInputs = [ pytest hypothesis ];
 
   checkPhase = ''

pkgs/development/python-modules/cairocffi/default.nix

···
 , makeFontsConf
 , freefont_ttf
 , pytest
-, pytest-runner
 , glibcLocales
 , cairo
 , cffi

pkgs/development/python-modules/cairocffi/generic.nix

···
     fontDirectories = [ freefont_ttf ];
   };
 
-  checkInputs = [ numpy pytest pytest-runner glibcLocales ];
   propagatedBuildInputs = [ cairo cffi ] ++ lib.optional withXcffib xcffib;
+  propagatedNativeBuildInputs = [ cffi ];
+
+  # pytestCheckHook does not work
+  checkInputs = [ numpy pytest glibcLocales ];
+
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "pytest-runner" "" \
+      --replace "pytest-cov" "" \
+      --replace "pytest-flake8" "" \
+      --replace "pytest-isort" "" \
+      --replace "--flake8 --isort" ""
+  '';
 
   checkPhase = ''
     py.test $out/${python.sitePackages}

pkgs/development/python-modules/cairosvg/default.nix

···
 , pillow
 , tinycss2
 , pytestCheckHook
-, pytest-runner
-, pytest-flake8
-, pytest-isort
 }:
 
 buildPythonPackage rec {
···
     sha256 = "sha256-sLmSnPXboAUXjXRqgDb88AJVUPSYylTbYYczIjhHg7w=";
   };
 
-  nativeBuildInputs = [ pytest-runner ];
+  propagatedBuildInputs = [ cairocffi cssselect2 defusedxml pillow tinycss2 ];
+
+  propagatedNativeBuildInputs = [ cairocffi ];
 
-  propagatedBuildInputs = [ cairocffi cssselect2 defusedxml pillow tinycss2 ];
+  checkInputs = [ pytestCheckHook ];
 
-  checkInputs = [ pytestCheckHook pytest-flake8 pytest-isort ];
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "pytest-runner" "" \
+      --replace "pytest-flake8" "" \
+      --replace "pytest-isort" "" \
+      --replace "pytest-cov" "" \
+      --replace "--flake8" "" \
+      --replace "--isort" ""
+  '';
 
   pytestFlagsArray = [
     "cairosvg/test_api.py"

pkgs/development/python-modules/click/default.nix

···
 
 buildPythonPackage rec {
   pname = "click";
-  version = "8.0.2";
+  version = "8.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7027bc7bbafaab8b2c2816861d8eb372429ee3c02e193fc2f93d6c4ab9de49c5";
+    sha256 = "sha256-QQ6TKwUPXu13PEzalN51lxyJzbMVWnKggxE5p55ey1s=";
   };
 
   postPatch = ''
     substituteInPlace src/click/_unicodefun.py \
-      --replace "'locale'" "'${locale}/bin/locale'"
+      --replace '"locale"' "'${locale}/bin/locale'"
   '';
 
   propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [

pkgs/development/python-modules/cmarkgfm/default.nix

···
     sha256 = "ec2bf8d5799c4b5bbfbae30a4a1dfcb06512f2e17e9ee60ba7e1d390318582fc";
   };
 
+  propagatedNativeBuildInputs = [ cffi ];
+
   propagatedBuildInputs = [ cffi ];
 
   checkInputs = [ pytestCheckHook ];

pkgs/development/python-modules/conda/default.nix

···
 , fetchPypi
 , pycosat
 , requests
-, ruamel_yaml
+, ruamel-yaml
 , isPy3k
 , enum34
 }:
···
     sha256 = "a91ef821343dea3ba9670f3d10b36c1ace4f4c36d70c175d8fc8886e94285953";
   };
 
-  propagatedBuildInputs = [ pycosat requests ruamel_yaml ] ++ lib.optional (!isPy3k) enum34;
+  propagatedBuildInputs = [ pycosat requests ruamel-yaml ] ++ lib.optional (!isPy3k) enum34;
 
   # No tests
   doCheck = false;

pkgs/development/python-modules/construct/2.10.54.nix

···
-{ lib, stdenv, buildPythonPackage, fetchFromGitHub, pytestCheckHook, pytest-benchmark, enum34, numpy, arrow, ruamel_yaml
+{ lib, stdenv, buildPythonPackage, fetchFromGitHub
+, pytestCheckHook, pytest-benchmark, enum34, numpy, arrow, ruamel-yaml
 }:
 
 buildPythonPackage rec {
···
     sha256 = "1mqspsn6bf3ibvih1zna2glkg8iw7vy5zg9gzg0d1m8zcndk2c48";
   };
 
-  checkInputs = [ pytestCheckHook pytest-benchmark enum34 numpy arrow ruamel_yaml ];
+  checkInputs = [ pytestCheckHook pytest-benchmark enum34 numpy arrow ruamel-yaml ];
 
   disabledTests = lib.optionals stdenv.isDarwin [ "test_multiprocessing" ];
 

pkgs/development/python-modules/construct/default.nix

···
 { lib, stdenv, buildPythonPackage, fetchFromGitHub, pythonOlder
-, pytestCheckHook, pytest-benchmark, numpy, arrow, ruamel_yaml
+, pytestCheckHook, pytest-benchmark, numpy, arrow, ruamel-yaml
 , lz4, cloudpickle
 }:
 
···
     lz4
   ];
 
-  checkInputs = [ pytestCheckHook pytest-benchmark numpy arrow ruamel_yaml cloudpickle ];
+  checkInputs = [ pytestCheckHook pytest-benchmark numpy arrow ruamel-yaml cloudpickle ];
 
   disabledTests = lib.optionals stdenv.isDarwin [ "test_multiprocessing" ];
 

pkgs/development/python-modules/dateparser/0.x.nix

···
 , convertdate
 , umalqurra
 , jdatetime
-, ruamel_yaml
+, ruamel-yaml
 }:
 
 buildPythonPackage rec {
···
     # install_requires
     python-dateutil pytz regex tzlocal
     # extra_requires
-    convertdate umalqurra jdatetime ruamel_yaml
+    convertdate umalqurra jdatetime ruamel-yaml
   ];
 
   pythonImportsCheck = [ "dateparser" ];

pkgs/development/python-modules/dateparser/default.nix

···
 , parameterized
 , pytestCheckHook
 , GitPython
-, ruamel_yaml
+, ruamel-yaml
 }:
 
 buildPythonPackage rec {
···
     parameterized
     pytestCheckHook
     GitPython
-    ruamel_yaml
+    ruamel-yaml
   ];
 
   preCheck = ''

pkgs/development/python-modules/drf-yasg/default.nix

···
 , buildPythonPackage
 , fetchPypi
 , inflection
-, ruamel_yaml
+, ruamel-yaml
 , setuptools-scm
 , six
 , coreapi
···
   propagatedBuildInputs = [
     six
     inflection
-    ruamel_yaml
+    ruamel-yaml
     coreapi
     djangorestframework
   ];

pkgs/development/python-modules/editdistance-s/default.nix

···
     sha256 = "0w2qd5b6a3c3ahd0xy9ykq4wzqk0byqwdqrr26dyn8j2425j46lg";
   };
 
+  propagatedNativeBuildInputs = [ cffi ];
+
   propagatedBuildInputs = [ cffi ];
 
   checkInputs = [ pytestCheckHook ];

pkgs/development/python-modules/fastpbkdf2/default.nix

···
   buildInputs = [ openssl ];
   checkInputs = [ pytest ];
   propagatedBuildInputs = [ cffi six ];
+  propagatedNativeBuildInputs = [ cffi ];
 
   meta = with lib; {
     homepage = "https://github.com/Ayrx/python-fastpbkdf2";

pkgs/development/python-modules/httplib2/default.nix

···
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , isPy27
 , mock
 , pyparsing
···
 
 buildPythonPackage rec {
   pname = "httplib2";
-  version = "0.19.1";
+  version = "0.20.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-e0Mq9AVJEWQ9GEtYFXk2fMIs7GtAUsyJN6XheqAnD3I=";
+    sha256 = "sha256-1zqs3YRVtm5DwewETLtRg5XhMJPJsMi0QLfeGirOURs=";
   };
-
-  patches = [
-    # fix test_inject_space
-    (fetchpatch {
-      url = "https://github.com/httplib2/httplib2/commit/08d6993b69256fbc6c0b1c615c24910803c4d610.patch";
-      sha256 = "0kbd1skn58m20kfkh4qzd66g9bvj31xlkbhsg435dkk4qz6l3yn3";
-    })
-  ];
 
   postPatch = ''
     sed -i "/--cov/d" setup.cfg

pkgs/development/python-modules/jc/default.nix

···
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, ruamel_yaml
+, ruamel-yaml
 , xmltodict
 , pygments
 , pytestCheckHook
···
     sha256 = "sha256-ISggj6oOF0B7TKIQAlZtauRrDAWP88OOFezLJK6edjI=";
   };
 
-  propagatedBuildInputs = [ ruamel_yaml xmltodict pygments ];
+  propagatedBuildInputs = [ ruamel-yaml xmltodict pygments ];
 
   checkInputs = [ pytestCheckHook ];
 

pkgs/development/python-modules/jupyter-repo2docker/default.nix

···
 , pkgs-docker
 , python-json-logger
 , pythonOlder
-, ruamel_yaml
+, ruamel-yaml
 , semver
 , toml
 , traitlets
···
     jinja2
     pkgs-docker
     python-json-logger
-    ruamel_yaml
+    ruamel-yaml
     semver
     toml
     traitlets

pkgs/development/python-modules/jupyter-telemetry/default.nix

···
 , pythonOlder
 , python-json-logger
 , jsonschema
-, ruamel_yaml
+, ruamel-yaml
 , traitlets
 }:
 
···
   };
 
   propagatedBuildInputs = [
-    python-json-logger jsonschema ruamel_yaml traitlets
+    python-json-logger jsonschema ruamel-yaml traitlets
   ];
 
   meta = with lib; {

pkgs/development/python-modules/liquidctl/default.nix

···
     colorlog
   ];
 
+  propagatedNativeBuildInputs = [
+    smbus-cffi
+  ];
+
   outputs = [ "out" "man" ];
 
   postInstall = ''

pkgs/development/python-modules/mautrix/default.nix

···
 { lib, buildPythonPackage, fetchPypi, aiohttp, pythonOlder
-, sqlalchemy, ruamel_yaml, CommonMark, lxml
+, sqlalchemy, ruamel-yaml, CommonMark, lxml
 }:
 
 buildPythonPackage rec {
···
 
     # defined in optional-requirements.txt
     sqlalchemy
-    ruamel_yaml
+    ruamel-yaml
     CommonMark
     lxml
   ];

pkgs/development/python-modules/maya/default.nix

···
 { lib, fetchPypi, fetchpatch, buildPythonPackage
-, dateparser, humanize, pendulum, ruamel_yaml, tzlocal }:
+, dateparser, humanize, pendulum, ruamel-yaml, tzlocal }:
 
 buildPythonPackage rec {
   pname = "maya";
···
     })
   ];
 
-  propagatedBuildInputs = [ dateparser humanize pendulum ruamel_yaml tzlocal ];
+  propagatedBuildInputs = [ dateparser humanize pendulum ruamel-yaml tzlocal ];
 
   # No tests
   doCheck = false;

pkgs/development/python-modules/miniaudio/default.nix

···
     sha256 = "1yx4n4zax103fmjzdiqzw37zibsh68b2p2l5qvgcnx2zrrjd31yl";
   };
 
-  propagatedBuildInputs = [
-    cffi
-  ];
+  propagatedNativeBuildInputs = [ cffi ];
+  propagatedBuildInputs = [ cffi ];
 
   checkInputs = [
     pytestCheckHook

pkgs/development/python-modules/misaka/default.nix

···
     sha256 = "1mzc29wwyhyardclj1vg2xsfdibg2lzb7f1azjcxi580ama55wv2";
   };
 
+  propagatedNativeBuildInputs = [ cffi ];
+
   propagatedBuildInputs = [ cffi ];
 
   # The tests require write access to $out

pkgs/development/python-modules/mitmproxy/default.nix

···
 , pyopenssl
 , pyparsing
 , pyperclip
-, ruamel_yaml
+, ruamel-yaml
 , setuptools
 , sortedcontainers
 , tornado
···
     pyopenssl
     pyparsing
     pyperclip
-    ruamel_yaml
+    ruamel-yaml
     sortedcontainers
     tornado
     urwid

pkgs/development/python-modules/monty/default.nix

···
 , pandas
 , pydantic
 , pymongo
-, ruamel_yaml
+, ruamel-yaml
 , tqdm
 }:
 
···
   '';
 
   propagatedBuildInputs = [
-    ruamel_yaml
+    ruamel-yaml
     tqdm
     msgpack
   ];

pkgs/development/python-modules/multidict/default.nix

···
 , fetchPypi
 , buildPythonPackage
 , pytestCheckHook
-, isPy3k
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "multidict";
   version = "5.2.0";
 
-  disabled = !isPy3k;
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
···
   };
 
   postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "--cov=multidict --cov-report term-missing:skip-covered --cov-report xml" ""
+    sed -i '/^addopts/d' setup.cfg
   '';
 
   checkInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "multidict" ];
 
   meta = with lib; {
     description = "Multidict implementation";

pkgs/development/python-modules/ntc-templates/default.nix

···
 , poetry-core
 , textfsm
 , pytestCheckHook
-, ruamel_yaml
+, ruamel-yaml
 , yamllint
 }:
 
···
 
   checkInputs = [
     pytestCheckHook
-    ruamel_yaml
+    ruamel-yaml
     yamllint
   ];
 

pkgs/development/python-modules/passlib/default.nix

···
 
   checkInputs = [ nose ];
   propagatedBuildInputs = [ bcrypt argon2_cffi ];
+  propagatedNativeBuildInputs = [ argon2_cffi ];
 
   meta = {
     description = "A password hashing library for Python";

pkgs/development/python-modules/prance/default.nix

···
 , fetchFromGitHub
 , chardet
 , requests
-, ruamel_yaml
+, ruamel-yaml
 , six
 , semver
 , pytestCheckHook
···
   propagatedBuildInputs = [
     chardet
     requests
-    ruamel_yaml
+    ruamel-yaml
     six
     semver
   ];

pkgs/development/python-modules/pre-commit-hooks/default.nix

···
 , git
 , pythonOlder
 , pytestCheckHook
-, ruamel_yaml
+, ruamel-yaml
 , toml
 }:
 
···
   };
 
   propagatedBuildInputs = [
-    ruamel_yaml
+    ruamel-yaml
     toml
   ];
 

pkgs/development/python-modules/prox-tv/default.nix

···
     cffi
   ];
 
+  propagatedNativeBuildInputs = [ cffi ];
+
   buildInputs = [ blas lapack ];
 
   enableParallelBuilding = true;

pkgs/development/python-modules/pycares/default.nix

···
     idna
   ];
 
+  propagatedNativeBuildInputs = [
+    cffi
+  ];
+
   # Requires network access
   doCheck = false;
 

pkgs/development/python-modules/pycmarkgfm/default.nix

···
     sha256 = "694cb242f4961437c30b5b015dfbce9d1a1fa48305c2e39f902ce7c65b4cbe0e";
   };
 
+  propagatedNativeBuildInputs = [ cffi ];
+
   propagatedBuildInputs = [ cffi ];
 
   # I would gladly use pytestCheckHook, but pycmarkgfm relies on a native

pkgs/development/python-modules/pygit2/default.nix

···
     cached-property
   ] ++ lib.optional (!isPyPy) cffi;
 
+  propagatedNativeBuildInputs = lib.optional (!isPyPy) cffi;
+
   checkInputs = [ pytestCheckHook ];
 
   preCheck = ''

pkgs/development/python-modules/pykeepass/default.nix

···
     argon2_cffi python-dateutil future
   ];
 
+  propagatedNativeBuildInputs = [ argon2_cffi ];
+
   checkPhase = ''
     ${python.interpreter} -m unittest tests.tests
   '';

pkgs/development/python-modules/pymatgen/default.nix

···
 , plotly
 , pydispatcher
 , requests
-, ruamel_yaml
+, ruamel-yaml
 , scipy
 , six
 , spglib
···
     plotly
     pydispatcher
     requests
-    ruamel_yaml
+    ruamel-yaml
     scipy
     six
     spglib

pkgs/development/python-modules/pynacl/default.nix

···
 , libsodium
 , cffi
 , hypothesis
+, stdenv
 , six
 }:
 
···
   ];
 
   propagatedBuildInputs = [
+    cffi
     six
   ];
 

pkgs/development/python-modules/pytest/4.nix

···
     }
 
     preDistPhases+=" pytestcachePhase"
+
+    # pytest generates it's own bytecode files to improve assertion messages.
+    # These files similar to cpython's bytecode files but are never laoded
+    # by python interpreter directly. We remove them for a few reasons:
+    # - files are non-deterministic: https://github.com/NixOS/nixpkgs/issues/139292
+    #   (file headers are generatedt by pytest directly and contain timestamps)
+    # - files are not needed after tests are finished
+    pytestRemoveBytecodePhase () {
+        # suffix is defined at:
+        #    https://github.com/pytest-dev/pytest/blob/4.6.11/src/_pytest/assertion/rewrite.py#L32-L47
+        find $out -name "*-PYTEST.py[co]" -delete
+    }
+    preDistPhases+=" pytestRemoveBytecodePhase"
   '';
 
   meta = with lib; {

pkgs/development/python-modules/pytest/5.nix

···
         find $out -name .pytest_cache -type d -exec rm -rf {} +
     }
     preDistPhases+=" pytestcachePhase"
+
+    # pytest generates it's own bytecode files to improve assertion messages.
+    # These files similar to cpython's bytecode files but are never laoded
+    # by python interpreter directly. We remove them for a few reasons:
+    # - files are non-deterministic: https://github.com/NixOS/nixpkgs/issues/139292
+    #   (file headers are generatedt by pytest directly and contain timestamps)
+    # - files are not needed after tests are finished
+    pytestRemoveBytecodePhase () {
+        # suffix is defined at:
+        #    https://github.com/pytest-dev/pytest/blob/5.4.3/src/_pytest/assertion/rewrite.py#L42-L45
+        find $out -name "*-pytest-*.py[co]" -delete
+    }
+    preDistPhases+=" pytestRemoveBytecodePhase"
   '';
 
   pythonImportsCheck = [

pkgs/development/python-modules/pytest/default.nix

···
         find $out -name .pytest_cache -type d -exec rm -rf {} +
     }
     preDistPhases+=" pytestcachePhase"
+
+    # pytest generates it's own bytecode files to improve assertion messages.
+    # These files similar to cpython's bytecode files but are never laoded
+    # by python interpreter directly. We remove them for a few reasons:
+    # - files are non-deterministic: https://github.com/NixOS/nixpkgs/issues/139292
+    #   (file headers are generatedt by pytest directly and contain timestamps)
+    # - files are not needed after tests are finished
+    pytestRemoveBytecodePhase () {
+        # suffix is defined at:
+        #    https://github.com/pytest-dev/pytest/blob/6.2.5/src/_pytest/assertion/rewrite.py#L51-L53
+        find $out -name "*-pytest-*.py[co]" -delete
+    }
+    preDistPhases+=" pytestRemoveBytecodePhase"
   '';
 
   pythonImportsCheck = [

pkgs/development/python-modules/python-box/default.nix

···
 , pytestCheckHook
 , pythonOlder
 , pyyaml
-, ruamel_yaml
+, ruamel-yaml
 , toml
 }:
 
···
   propagatedBuildInputs = [
     msgpack
     pyyaml
-    ruamel_yaml
+    ruamel-yaml
     toml
   ];
 

pkgs/development/python-modules/python-magic/default.nix

···
 , python
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , substituteAll
 , file
 , glibcLocales
···
   };
 
   patches = [
+    # pull upstream patch to support file-5.41
+    (fetchpatch {
+      name = "file-5.41-compat.patch";
+      url = "https://github.com/ahupp/python-magic/commit/0ae7e7ceac0e80e03adc75c858bb378c0427331a.patch";
+      sha256 = "0vclaamb56nza1mcy88wjbkh81hnish2gzvl8visa2cknhgdmk50";
+    })
+
     (substituteAll {
       src = ./libmagic-path.patch;
       libmagic = "${file}/lib/libmagic${stdenv.hostPlatform.extensions.sharedLibrary}";

pkgs/development/python-modules/python-olm/default.nix

···
     future
   ] ++ lib.optionals (!isPy3k) [ typing ];
 
+  propagatedNativeBuildInputs = [
+    cffi
+  ];
+
   # Some required libraries for testing are not packaged yet.
   doCheck = false;
   pythonImportsCheck = [ "olm" ];

pkgs/development/python-modules/pyuavcan/default.nix

···
 { lib, buildPythonPackage, fetchFromGitHub, pythonOlder, numpy, nunavut
-, pyserial , pytest, ruamel_yaml}:
+, pyserial , pytest, ruamel-yaml}:
 
  buildPythonPackage rec {
   pname = "pyuavcan";
···
     nunavut
     pyserial
     pytest
-    ruamel_yaml
+    ruamel-yaml
   ];
 
   # allow for writable directory for darwin

pkgs/development/python-modules/reflink/default.nix

···
 , fetchPypi
 , lib
 , pytestCheckHook
-, pytest-runner
 }:
 
 buildPythonPackage rec {
···
     sha256 = "sha256-ySU1gtskQTv9cDq/wbKkneePMbSQcjnyhumhkpoebjo=";
   };
 
-  propagatedBuildInputs = [ cffi pytest-runner ];
+  propagatedBuildInputs = [ cffi ];
+
+  propagatedNativeBuildInputs = [ cffi ];
 
   checkInputs = [ pytestCheckHook ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "pytest-runner" ""
+  '';
 
   # FIXME: These do not work, and I have been unable to figure out why.
   doCheck = false;

pkgs/development/python-modules/ruamel-yaml/0.16.nix

···
+{ lib
+, buildPythonPackage
+, fetchPypi
+, ruamel-base
+, ruamel-ordereddict
+, ruamel-yaml-clib ? null
+, isPy27
+, isPyPy
+}:
+
+buildPythonPackage rec {
+  pname = "ruamel-yaml";
+  version = "0.16.13";
+
+  src = fetchPypi {
+    pname = "ruamel.yaml";
+    inherit version;
+    sha256 = "0hm9yg785f46bkrgqknd6fdvmkby9dpzjnm0b63qf0i748acaj5v";
+  };
+
+  # Tests use relative paths
+  doCheck = false;
+
+  propagatedBuildInputs = [ ruamel-base ]
+    ++ lib.optional isPy27 ruamel-ordereddict
+    ++ lib.optional (!isPyPy) ruamel-yaml-clib;
+
+  # causes namespace clash on py27
+  dontUsePythonImportsCheck = isPy27;
+  pythonImportsCheck = [ "ruamel.yaml" ];
+
+  meta = with lib; {
+    description = "YAML parser/emitter that supports roundtrip preservation of comments, seq/map flow style, and map key order";
+    homepage = "https://sourceforge.net/projects/ruamel-yaml/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}

pkgs/development/python-modules/ruamel-yaml/default.nix

···
+{ lib
+, buildPythonPackage
+, fetchPypi
+, ruamel-base
+, ruamel-yaml-clib
+, isPyPy
+}:
+
+buildPythonPackage rec {
+  pname = "ruamel-yaml";
+  version = "0.17.16";
+
+  src = fetchPypi {
+    pname = "ruamel.yaml";
+    inherit version;
+    sha256 = "1a771fc92d3823682b7f0893ad56cb5a5c87c48e62b5399d6f42c8759a583b33";
+  };
+
+  # Tests use relative paths
+  doCheck = false;
+
+  propagatedBuildInputs = [ ruamel-base ]
+    ++ lib.optional (!isPyPy) ruamel-yaml-clib;
+
+  pythonImportsCheck = [ "ruamel.yaml" ];
+
+  meta = with lib; {
+    description = "YAML parser/emitter that supports roundtrip preservation of comments, seq/map flow style, and map key order";
+    homepage = "https://sourceforge.net/projects/ruamel-yaml/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}

pkgs/development/python-modules/ruamel_base/default.nix pkgs/development/python-modules/ruamel-base/default.nix

···
 }:
 
 buildPythonPackage rec {
-  pname = "ruamel.base";
+  pname = "ruamel-base";
   version = "1.0.0";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "ruamel.base";
+    inherit version;
     sha256 = "1wswxrn4givsm917mfl39rafgadimf1sldpbjdjws00g1wx36hf0";
   };
 
+  # no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "ruamel.base" ];
+
   meta = with lib; {
     description = "Common routines for ruamel packages";
     homepage = "https://sourceforge.net/projects/ruamel-base/";
     license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
-
 }

pkgs/development/python-modules/ruamel_ordereddict/default.nix pkgs/development/python-modules/ruamel-ordereddict/default.nix

···
 }:
 
 buildPythonPackage rec {
-  pname = "ruamel.ordereddict";
+  pname = "ruamel-ordereddict";
   version = "0.4.15";
   disabled = isPy3k || isPyPy;
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "ruamel.ordereddict";
+    inherit version;
     sha256 = "d7d9cf8b11e7662deb460260cf062980cd84b87a1d0457132060ab9d44e0a5f4";
   };
 
···
     description = "A version of dict that keeps keys in insertion resp. sorted order";
     homepage = "https://sourceforge.net/projects/ruamel-ordereddict/";
     license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
-
 }

pkgs/development/python-modules/ruamel_yaml/0.16.nix

···
-{ lib
-, buildPythonPackage
-, fetchPypi
-, ruamel_base
-, ruamel_ordereddict ? null
-, ruamel_yaml_clib ? null
-, isPy3k
-, isPyPy
-}:
-
-buildPythonPackage rec {
-  pname = "ruamel.yaml";
-  version = "0.16.13";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0hm9yg785f46bkrgqknd6fdvmkby9dpzjnm0b63qf0i748acaj5v";
-  };
-
-  # Tests use relative paths
-  doCheck = false;
-
-  propagatedBuildInputs = [ ruamel_base ]
-    ++ lib.optional (!isPy3k) ruamel_ordereddict
-    ++ lib.optional (!isPyPy) ruamel_yaml_clib;
-
-  # causes namespace clash on py27
-  dontUsePythonImportsCheck = !isPy3k;
-  pythonImportsCheck = [
-    "ruamel.yaml"
-    "ruamel.base"
-  ];
-
-  meta = with lib; {
-    description = "YAML parser/emitter that supports roundtrip preservation of comments, seq/map flow style, and map key order";
-    homepage = "https://sourceforge.net/projects/ruamel-yaml/";
-    license = licenses.mit;
-  };
-
-}

pkgs/development/python-modules/ruamel_yaml/default.nix

···
-{ lib
-, buildPythonPackage
-, fetchPypi
-, ruamel_base
-, ruamel_ordereddict ? null
-, ruamel_yaml_clib ? null
-, isPy3k
-, isPyPy
-}:
-
-buildPythonPackage rec {
-  pname = "ruamel.yaml";
-  version = "0.17.16";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1a771fc92d3823682b7f0893ad56cb5a5c87c48e62b5399d6f42c8759a583b33";
-  };
-
-  # Tests use relative paths
-  doCheck = false;
-
-  propagatedBuildInputs = [ ruamel_base ]
-    ++ lib.optional (!isPy3k) ruamel_ordereddict
-    ++ lib.optional (!isPyPy) ruamel_yaml_clib;
-
-  # causes namespace clash on py27
-  dontUsePythonImportsCheck = !isPy3k;
-  pythonImportsCheck = [
-    "ruamel.yaml"
-    "ruamel.base"
-  ];
-
-  meta = with lib; {
-    description = "YAML parser/emitter that supports roundtrip preservation of comments, seq/map flow style, and map key order";
-    homepage = "https://sourceforge.net/projects/ruamel-yaml/";
-    license = licenses.mit;
-  };
-
-}

pkgs/development/python-modules/ruamel_yaml_clib/default.nix pkgs/development/python-modules/ruamel-yaml-clib/default.nix

···
 }:
 
 buildPythonPackage rec {
-  pname = "ruamel.yaml.clib";
-  version = "0.2.0";
+  pname = "ruamel-yaml-clib";
+  version = "0.2.4";
 
   src = fetchhg {
     url = "http://hg.code.sf.net/p/ruamel-yaml-clib/code";
     rev = version;
-    sha256 = "0kq6zi96qlm72lzj90fc2rfk6nm5kqhk6qxdl8wl9s3a42b0v6wl";
+    sha256 = "sha256-HQZY1opUvVQdXUHmsZmcYX2vfgjKsl6xATmVIXjnBlc=";
   };
 
-  # outputs match wheel
+  # no tests
   doCheck = false;
 
+  # circular depedency with ruamel-yaml
+  # pythonImportsCheck = [ "_ruamel_yaml" ];
+
   meta = with lib; {
     description = "YAML parser/emitter that supports roundtrip preservation of comments, seq/map flow style, and map key order";
     homepage = "https://sourceforge.net/projects/ruamel-yaml-clib/";
     license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
-
 }

pkgs/development/python-modules/schema-salad/default.nix

···
 , mistune
 , rdflib
 , rdflib-jsonld
-, ruamel_yaml
+, ruamel-yaml
 , pytestCheckHook
 , pythonOlder
 }:
···
     mistune
     rdflib
     rdflib-jsonld
-    ruamel_yaml
+    ruamel-yaml
   ];
 
   checkInputs = [

pkgs/development/python-modules/smbus-cffi/default.nix

···
     })
   ];
 
+  propagatedNativeBuildInputs = [ cffi ];
+
   propagatedBuildInputs = [ cffi ];
 
   installCheckPhase = ''

pkgs/development/python-modules/soundfile/default.nix

···
 
     checkInputs = [ pytest ];
     propagatedBuildInputs = [ numpy libsndfile cffi ];
+    propagatedNativeBuildInputs = [ cffi ];
 
     meta = {
       description = "An audio library based on libsndfile, CFFI and NumPy";

pkgs/development/python-modules/sphinx/default.nix

···
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, fetchpatch
 # propagatedBuildInputs
 , Babel
 , alabaster
···
 
 buildPythonPackage rec {
   pname = "sphinx";
-  version = "4.0.2";
+  version = "4.2.0";
   disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
     owner = "sphinx-doc";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0QdgHFX4r40BDHjpi9R40lXqT4n5ZgrIny+w070LZPE=";
+    sha256 = "1i38n5bxqiycjwmiv9dl72r3f5ks4zmif30znqg8zilclbx6g16x";
   };
-
-  patches = [
-    (fetchpatch {
-      # Fix tests with pygments 2.10
-      url = "https://github.com/sphinx-doc/sphinx/commit/bde6c8d2effc56dc8b9098abee796167f972c306.patch";
-      sha256 = "0d0ddhgrrh7z9ix0f3zrc2gjb4d73f6ffm98zl62fzv5l4fd00lr";
-    })
-  ];
 
   propagatedBuildInputs = [
     Babel

pkgs/development/python-modules/strictyaml/default.nix

···
 , lib
 , fetchPypi
 , isPy27
-, ruamel_yaml
+, ruamel-yaml
 , python-dateutil
 }:
 
···
       --replace "ruamel.yaml==0.17.4" "ruamel.yaml"
   '';
 
-  propagatedBuildInputs = [ ruamel_yaml python-dateutil ];
+  propagatedBuildInputs = [ ruamel-yaml python-dateutil ];
 
   # Library tested with external tool
   # https://hitchdev.com/approach/contributing-to-hitch-libraries/

pkgs/development/python-modules/tinycss2/default.nix

···
 { lib
 , buildPythonPackage
 , pythonOlder
-, fetchPypi
-, fetchpatch
+, fetchFromGitHub
 , webencodings
-# Check inputs
-, pytest
-, pytest-runner
-, pytest-cov
-, pytest-flake8
-, pytest-isort
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "tinycss2";
-  version = "1.0.2";
+  version = "1.1.0";
   disabled = pythonOlder "3.5";
+  format = "flit";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1kw84y09lggji4krkc58jyhsfj31w8npwhznr7lf19d0zbix09v4";
+  src = fetchFromGitHub {
+    owner = "kozea";
+    repo = "tinycss2";
+    rev = "v${version}";
+    # for tests
+    fetchSubmodules = true;
+    sha256 = "sha256-WA88EYolL76WqeA1UKR3Sfw11j8NuOGOxPezujYizH8=";
   };
-
-  patches = [
-    (
-      fetchpatch {
-        name = "tinycss2-fix-pytest-flake8-fail.patch";
-        url = "https://github.com/Kozea/tinycss2/commit/6556604fb98c2153412384d6f0f705db2da1aa60.patch";
-        sha256 = "1srvdzg1bak65fawd611rlskcgn5abmwmyjnk8qrrrasr554bc59";
-      }
-    )
-  ];
 
   propagatedBuildInputs = [ webencodings ];
 
-  checkInputs = [ pytest pytest-runner pytest-cov pytest-flake8 pytest-isort ];
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-  # https://github.com/PyCQA/pycodestyle/issues/598
-  preCheck = ''
-    printf "[flake8]\nignore=W504,E741,E126" >> setup.cfg
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "'pytest-cov', 'pytest-flake8', 'pytest-isort', 'coverage[toml]'" "" \
+      --replace "--isort --flake8 --cov" ""
   '';
 
   meta = with lib; {

pkgs/development/python-modules/watchdog/default.nix

···
 , stdenv
 , buildPythonPackage
 , fetchPypi
-, argh
 , pathtools
 , pyyaml
 , flaky
···
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
   propagatedBuildInputs = [
-    argh
     pathtools
     pyyaml
   ];

pkgs/development/python-modules/xcffib/default.nix

···
 
   propagatedBuildInputs = [ cffi six ];
 
+  propagatedNativeBuildInputs = [ cffi ];
+
   checkInputs = [ nose ];
 
   pythonImportsCheck = [ "xcffib" ];

pkgs/development/python-modules/xpybutil/default.nix

···
   };
 
   # pillow is a dependency in image.py which is not listed in setup.py
-  propagatedBuildInputs = [ xcffib pillow ];
+  propagatedBuildInputs = [ pillow xcffib ];
+
+  propagatedNativeBuildInputs = [ xcffib ];
 
   checkInputs = [ nose ];
 

pkgs/development/python-modules/yamale/default.nix

···
 , pythonOlder
 , pytestCheckHook
 , pyyaml
-, ruamel_yaml
+, ruamel-yaml
 }:
 
 buildPythonPackage rec {
···
 
   propagatedBuildInputs = [
     pyyaml
-    ruamel_yaml
+    ruamel-yaml
   ];
 
   checkInputs = [

pkgs/development/python-modules/zopfli/default.nix

···
-{ lib, buildPythonPackage, fetchPypi, pytest }:
+{ lib, buildPythonPackage, fetchPypi, setuptools-scm, zopfli, pytest }:
 
 buildPythonPackage rec {
   pname = "zopfli";
-  version = "0.1.8";
+  version = "0.1.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8b977dc07e3797907ab59e08096583bcd0b7e6c739849fbbeec09263f6356623";
+    sha256 = "78de3cc08a8efaa8013d61528907d91ac4d6cc014ffd8a41cc10ee75e9e60d7b";
     extension = "zip";
   };
+
+  nativeBuildInputs = [ setuptools-scm ];
+
+  buildInputs = [ zopfli ];
+  USE_SYSTEM_ZOPFLI = "True";
 
   # doesn't work with pytestCheckHook
   checkInputs = [ pytest ];

pkgs/development/python-modules/zstandard/default.nix

···
     sha256 = "eaae2d3e8fdf8bfe269628385087e4b648beef85bb0c187644e7df4fb0fe9046";
   };
 
+  propagatedNativeBuildInputs = [ cffi ];
+
   propagatedBuildInputs = [ cffi ];
 
   checkInputs = [ hypothesis ];

pkgs/development/tools/analysis/clang-analyzer/0001-Fix-scan-build-to-use-NIX_CFLAGS_COMPILE.patch

···
-From 40239d92957f1969652cdd41d6d2749c41ac4338 Mon Sep 17 00:00:00 2001
+From 99a7e55a60c8d96e160f9104a3dd31b7914d3488 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <[e-mail]>
 Date: Fri, 31 Jul 2020 09:22:03 +0100
-Subject: [PATCH] [PATCH] Fix scan-build to use NIX_CFLAGS_COMPILE
+Subject: [PATCH] Fix scan-build to use NIX_CFLAGS_COMPILE
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
 Signed-off-by: Jörg Thalheim <[e-mail]>
 ---
- tools/scan-build/libexec/ccc-analyzer | 8 ++++++++
+ clang/tools/scan-build/libexec/ccc-analyzer | 8 ++++++++
  1 file changed, 8 insertions(+)
 
-diff --git a/tools/scan-build/libexec/ccc-analyzer b/tools/scan-build/libexec/ccc-analyzer
-index 800f38b5..0fb50fb3 100755
---- a/tools/scan-build/libexec/ccc-analyzer
-+++ b/tools/scan-build/libexec/ccc-analyzer
-@@ -246,6 +246,14 @@ sub Analyze {
+diff --git a/clang/tools/scan-build/libexec/ccc-analyzer
+b/clang/tools/scan-build/libexec/ccc-analyzer
+index ed0d4d3d73f3..2d5113435ca5 100755
+--- a/clang/tools/scan-build/libexec/ccc-analyzer
++++ b/clang/tools/scan-build/libexec/ccc-analyzer
+@@ -249,6 +249,14 @@ sub Analyze {
        push @Args, "-target", $AnalyzerTarget;
      }
  
···
      @CmdArgs = @$AnalysisArgs;
    }
 -- 
-2.27.0
-
+2.33.0

pkgs/development/tools/analysis/clang-analyzer/default.nix

···
 
   installPhase = ''
     mkdir -p $out/share/scan-view $out/bin
-    cp -R tools/scan-view/share/* $out/share/scan-view
-    cp -R tools/scan-view/bin/* $out/bin/scan-view
-    cp -R tools/scan-build/* $out
+    cp -R clang/tools/scan-view/share/* $out/share/scan-view
+    cp -R clang/tools/scan-view/bin/* $out/bin/scan-view
+    cp -R clang/tools/scan-build/* $out
 
     rm $out/bin/*.bat $out/libexec/*.bat $out/CMakeLists.txt
 
···
 
   meta = {
     description = "Clang Static Analyzer";
-    homepage    = "http://clang-analyzer.llvm.org";
+    longDescription = ''
+      The Clang Static Analyzer is a source code analysis tool that finds bugs
+      in C, C++, and Objective-C programs.
+    '';
+    homepage    = "https://clang-analyzer.llvm.org/";
     license     = lib.licenses.bsd3;
     platforms   = lib.platforms.unix;
     maintainers = [ lib.maintainers.thoughtpolice ];

pkgs/development/tools/analysis/valgrind/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "valgrind";
-  version = "3.17.0";
+  version = "3.18.1";
 
   src = fetchurl {
     url = "https://sourceware.org/pub/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "18l5jbk301j3462gipqn9bkfx44mdmwn0pwr73r40gl1irkfqfmd";
+    sha256 = "sha256-AIWaoTp3Lt33giIl9LRu4NOa++Bx0yd42k2ZmECB9/U=";
   };
 
   outputs = [ "out" "dev" "man" "doc" ];

pkgs/development/tools/build-managers/waf/default.nix

···
-{ lib, stdenv, fetchFromGitLab, python, ensureNewerSourcesForZipFilesHook
+{ lib, stdenv, fetchFromGitLab, python3, ensureNewerSourcesForZipFilesHook
 # optional list of extra waf tools, e.g. `[ "doxygen" "pytest" ]`
 , withTools ? null
 }:
···
     sha256 = "sha256-WGGyhvQdFYmC0NOA5VVqCRMF1fvfPcTI42x1nHvz0W0=";
   };
 
-  buildInputs = [ python ensureNewerSourcesForZipFilesHook ];
+  nativeBuildInputs = [ python3 ensureNewerSourcesForZipFilesHook ];
+
+  # waf bin has #!/usr/bin/env python
+  buildInputs = [ python3 ];
 
   configurePhase = ''
     python waf-light configure
···
   installPhase = ''
     install -D waf $out/bin/waf
   '';
+
+  strictDeps = true;
 
   meta = with lib; {
     description = "Meta build system";

pkgs/development/tools/documentation/gi-docgen/default.nix

···
 { lib
 , fetchFromGitLab
+, fetchpatch
 , meson
 , ninja
 , python3
···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gi-docgen";
-  version = "2021.7";
+  version = "2021.8";
 
   format = "other";
 
···
     owner = "GNOME";
     repo = pname;
     rev = version;
-    sha256 = "i2s4JXg+D9sYq1QwVcDRLIr9qnRmzHC+cBInHv4SXHI=";
+    sha256 = "Y1IdCH6bytxbKIj48IAw/3XUQhoqwPshvdj/d1hRS3o=";
   };
+
+  patches = [
+    # Fix building docs of some packages (e.g. gnome-builder)
+    # https://gitlab.gnome.org/GNOME/gi-docgen/-/issues/111
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gi-docgen/-/commit/72f3c5dbe27aabb5f7a376afda23f3dfc3c2e212.patch";
+      sha256 = "iVXc3idmcjmFVZQdE2QX2V53YZ79lqxZid9nWdxAZ/Q=";
+    })
+  ];
 
   nativeBuildInputs = [
     meson

pkgs/development/tools/dt-schema/default.nix

···
 , buildPythonPackage
 , fetchPypi
 , git
-, ruamel_yaml
+, ruamel-yaml
 , jsonschema
 , rfc3987
 , setuptools
···
   nativeBuildInputs = [ setuptools-scm git ];
   propagatedBuildInputs = [
     setuptools
-    ruamel_yaml
+    ruamel-yaml
     jsonschema
     rfc3987
   ];

pkgs/development/tools/fdroidserver/default.nix

···
     pyyaml
     qrcode
     requests
-    ruamel_yaml
+    ruamel-yaml
     yamllint
   ];
 

pkgs/development/tools/misc/autogen/default.nix

···
     done
 
   '' + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
-    # remove /build/** from RPATHs
+    # remove build directory (/build/**, or /tmp/nix-build-**) from RPATHs
     for f in "$bin"/bin/*; do
-      local nrp="$(patchelf --print-rpath "$f" | sed -E 's@(:|^)/build/[^:]*:@\1@g')"
+      local nrp="$(patchelf --print-rpath "$f" | sed -E 's@(:|^)'$NIX_BUILD_TOP'[^:]*:@\1@g')"
       patchelf --set-rpath "$nrp" "$f"
     done
   '';

pkgs/development/tools/misc/binutils/CVE-2021-3487.patch

···
+From: Nick Clifton <[e-mail]>
+Date: Thu, 26 Nov 2020 17:08:33 +0000 (+0000)
+Subject: Prevent a memory allocation failure when parsing corrupt DWARF debug sections.
+X-Git-Tag: binutils-2_36~485
+X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=647cebce12a6b0a26960220caff96ff38978cf24;hp=239ca5e497dda2c151009d664d500086a5c2173a
+
+Prevent a memory allocation failure when parsing corrupt DWARF debug sections.
+
+	PR 26946
+	* dwarf2.c (read_section): Check for debug sections with excessive
+	sizes.
+---
+
+diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c
+index 977bf43a6a1..8bbfc81d3e7 100644
+--- a/bfd/dwarf2.c
++++ b/bfd/dwarf2.c
+@@ -531,22 +531,24 @@ read_section (bfd *	      abfd,
+ 	      bfd_byte **     section_buffer,
+ 	      bfd_size_type * section_size)
+ {
+-  asection *msec;
+   const char *section_name = sec->uncompressed_name;
+   bfd_byte *contents = *section_buffer;
+-  bfd_size_type amt;
+ 
+   /* The section may have already been read.  */
+   if (contents == NULL)
+     {
++      bfd_size_type amt;
++      asection *msec;
++      ufile_ptr filesize;
++
+       msec = bfd_get_section_by_name (abfd, section_name);
+-      if (! msec)
++      if (msec == NULL)
+ 	{
+ 	  section_name = sec->compressed_name;
+ 	  if (section_name != NULL)
+ 	    msec = bfd_get_section_by_name (abfd, section_name);
+ 	}
+-      if (! msec)
++      if (msec == NULL)
+ 	{
+ 	  _bfd_error_handler (_("DWARF error: can't find %s section."),
+ 			      sec->uncompressed_name);
+@@ -554,12 +556,23 @@ read_section (bfd *	      abfd,
+ 	  return FALSE;
+ 	}
+ 
+-      *section_size = msec->rawsize ? msec->rawsize : msec->size;
++      amt = bfd_get_section_limit_octets (abfd, msec);
++      filesize = bfd_get_file_size (abfd);
++      if (amt >= filesize)
++	{
++	  /* PR 26946 */
++	  _bfd_error_handler (_("DWARF error: section %s is larger than its filesize! (0x%lx vs 0x%lx)"),
++			      section_name, (long) amt, (long) filesize);
++	  bfd_set_error (bfd_error_bad_value);
++	  return FALSE;
++	}
++      *section_size = amt;
+       /* Paranoia - alloc one extra so that we can make sure a string
+ 	 section is NUL terminated.  */
+-      amt = *section_size + 1;
++      amt += 1;
+       if (amt == 0)
+ 	{
++	  /* Paranoia - this should never happen.  */
+ 	  bfd_set_error (bfd_error_no_memory);
+ 	  return FALSE;
+ 	}
+

pkgs/development/tools/misc/binutils/default.nix

···
 let
   reuseLibs = enableShared && withAllTargets;
 
-  version = "2.35.1";
+  version = "2.35.2";
   basename = "binutils";
   # The targetPrefix prepended to binary names to allow multiple binuntils on the
   # PATH to both be usable.
···
   # HACK to ensure that we preserve source from bootstrap binutils to not rebuild LLVM
   normal-src = stdenv.__bootPackages.binutils-unwrapped.src or (fetchurl {
     url = "mirror://gnu/binutils/${basename}-${version}.tar.bz2";
-    sha256 = "sha256-Mg56HQ9G/Nn0E/EEbiFsviO7K85t62xqYzBEJeSLGUI=";
+    sha256 = "sha256-z6dkTb7PRZHhNutAfBwdoWV4vSsD8MLorNzroZS7nWE=";
   });
 in
 
···
     ./gold-Update-GNU_PROPERTY_X86_XXX-macros.patch
 
     ./CVE-2020-35448.patch
+    ./CVE-2021-3487.patch
   ] ++ lib.optional stdenv.targetPlatform.isiOS ./support-ios.patch
     ++ # This patch was suggested by Nick Clifton to fix
        # https://sourceware.org/bugzilla/show_bug.cgi?id=16177

pkgs/development/tools/misc/help2man/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "help2man";
-  version = "1.48.1";
+  version = "1.48.5";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-3op0dAvQWGRlZ7kqtOzeudqfGgfMfE9gejwU3TjRB5k=";
+    sha256 = "sha256-ZznkyqQuau0zmb5Dh8p5OZZAlnM06RcohjuOqpIlgr4=";
   };
 
   nativeBuildInputs = [ gettext perlPackages.LocaleGettext ];

pkgs/development/tools/misc/replacement/default.nix

···
   };
 
   propagatedBuildInputs = with python3Packages; [
-    ruamel_yaml
+    ruamel-yaml
   ];
 
   checkInputs = with python3Packages; [

pkgs/development/tools/parsing/bison/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "bison";
-  version = "3.7.6";
+  version = "3.8.2";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-adwLtG6o/DB9TKHgthyMNV6yB9Cwxp9PhGIyjnTXueo=";
+    sha256 = "sha256-BsnhO99+sk1M62tZIFpPZ8LH5yExGWREMP6C+9FKCrs=";
   };
 
+  # gnulib relies on --host= to detect iconv() features on musl().
+  # Otherwise tests fail due to incorrect unicode symbol oconversion.
+  configurePlatforms = [ "build" "host" ];
+
   nativeBuildInputs = [ m4 perl ] ++ lib.optional stdenv.isSunOS help2man;
   propagatedBuildInputs = [ m4 ];
 
-  doCheck = false; # fails
-  doInstallCheck = false; # fails
+  enableParallelBuilding = true;
+
+  doCheck = true;
+  doInstallCheck = true;
 
   meta = {
     homepage = "https://www.gnu.org/software/bison/";

pkgs/games/steam/fhsenv.nix

···
     xorg.libICE
     gnome2.GConf
     freetype
-    (curl.override { gnutlsSupport = true; sslSupport = false; })
+    (curl.override { gnutlsSupport = true; opensslSupport = false; })
     nspr
     nss
     fontconfig

pkgs/misc/cups/default.nix

···
 , libtiff
 , pam
 , dbus
-, enableSystemd ? stdenv.isLinux && !stdenv.hostPlatform.isMusl
+, enableSystemd ? stdenv.isLinux
 , systemd
 , acl
 , gmp

pkgs/os-specific/linux/cryptsetup/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "cryptsetup";
-  version = "2.4.0";
+  version = "2.4.1";
 
   outputs = [ "out" "dev" "man" ];
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/cryptsetup/v2.4/${pname}-${version}.tar.xz";
-    sha256 = "sha256-xci9oxFZqcAQ6nLnCAU8xCUs9e69ylIOFQq8Bgkof/g=";
+    sha256 = "sha256-o1anJ6g6RkreVm6VI5Yioi2+Tg9IKxmP2wSrDTpanF8=";
   };
 
   # Disable 4 test cases that fail in a sandbox

pkgs/os-specific/linux/ell/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.43";
+  version = "0.44";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/${pname}/${pname}.git";
     rev = version;
-    sha256 = "sha256-ttKFKV8spxnkFpZHV4Dn9BxJdjxYLWYrHY+qq6uAOlg=";
+    sha256 = "sha256-8korsEvlQOtfyuGkzFun1Xbuc4uhI2I0YpACUfxlpIM=";
   };
 
   nativeBuildInputs = [

pkgs/os-specific/linux/kernel/common-config.nix

···
       XDP_SOCKETS        = whenAtLeast "4.19" yes;
       XDP_SOCKETS_DIAG   = whenAtLeast "5.1" yes;
       WAN                = yes;
+      TCP_CONG_ADVANCED  = yes;
       TCP_CONG_CUBIC     = yes; # This is the default congestion control algorithm since 2.6.19
       # Required by systemd per-cgroup firewalling
       CGROUP_BPF                  = option yes;
···
       DVB_DYNAMIC_MINORS = option yes; # we use udev
 
       EFI_STUB            = yes; # EFI bootloader in the bzImage itself
+      EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER =
+          whenAtLeast "5.8" yes; # initrd kernel parameter for EFI
       CGROUPS             = yes; # used by systemd
       FHANDLE             = yes; # used by systemd
       SECCOMP             = yes; # used by systemd >= 231

pkgs/os-specific/linux/kernel/manual-config.nix

···
         # See also https://kernelnewbies.org/BuildId
         sed -i Makefile -e 's|--build-id=[^ ]*|--build-id=none|'
 
-        patchShebangs scripts
+        # Some linux-hardened patches now remove certain files in the scripts directory, so we cannot
+        # patch all scripts until after patches are applied.
+        # However, scripts/ld-version.sh is still ran when generating a configfile for a kernel, so it needs
+        # to be patched prior to patchPhase
+        patchShebangs scripts/ld-version.sh
       '';
 
       postPatch = ''
···
             --replace NIXOS_RANDSTRUCT_SEED \
             $(echo ${randstructSeed}${src} ${configfile} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
         fi
+
+        patchShebangs scripts
       '';
 
       configurePhase = ''

pkgs/os-specific/linux/kexec-tools/default.nix

···
-{ lib, stdenv, buildPackages, fetchurl, zlib, fetchpatch }:
+{ lib, stdenv, buildPackages, fetchurl, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "kexec-tools";
-  version = "2.0.20";
+  version = "2.0.23";
 
   src = fetchurl {
     urls = [
       "mirror://kernel/linux/utils/kernel/kexec/${pname}-${version}.tar.xz"
       "http://horms.net/projects/kexec/kexec-tools/${pname}-${version}.tar.xz"
     ];
-    sha256 = "1j7qlhxk1rbv9jbj8wd6hb7zl8p2mp29ymrmccgmsi0m0dzhgn6s";
+    sha256 = "qmPNbH3ZWwbOumJAp/3GeSeJytp1plXmcUmHF1IkJBs=";
   };
 
   hardeningDisable = [ "format" "pic" "relro" "pie" ];
···
   configureFlags = [ "BUILD_CC=${buildPackages.stdenv.cc.targetPrefix}cc" ];
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   buildInputs = [ zlib ];
-
-  patches = [
-    # fix build on i686
-    # See: https://src.fedoraproject.org/rpms/kexec-tools/c/cb1e5463b5298b064e9b6c86ad6fe3505fec9298
-    (fetchpatch {
-      name = "kexec-tools-2.0.20-fix-broken-multiboot2-buliding-for-i386.patch";
-      url = "https://src.fedoraproject.org/rpms/kexec-tools/raw/cb1e5463b5298b064e9b6c86ad6fe3505fec9298/f/kexec-tools-2.0.20-fix-broken-multiboot2-buliding-for-i386.patch";
-      sha256 = "1kzmcsbhwfdgxlc5s88ir0n494phww1j16yk0z42x09qlkxxkg0l";
-    })
-
-    (fetchpatch {
-      # upstream build fix against -fno-common compilers like >=gcc-10
-      name = "fno-common.patch";
-      url = "https://git.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git/patch/?id=cc087b11462af9f971a2c090d07e8d780a867b50";
-      sha256 = "043hcsy6m14h64p6b9w25c7a3y0f487322dj81l6mbm6sws6s9lv";
-    })
-  ];
 
   meta = with lib; {
     homepage = "http://horms.net/projects/kexec/kexec-tools";

pkgs/os-specific/linux/libselinux/default.nix

···
     "SHLIBDIR=$(out)/lib"
 
     "LIBSEPOLA=${lib.getLib libsepol}/lib/libsepol.a"
+    "ARCH=${stdenv.hostPlatform.linuxArch}"
   ] ++ optionals enablePython [
     "PYTHON=${python3.pythonForBuild.interpreter}"
     "PYTHONLIBDIR=$(py)/${python3.sitePackages}"

pkgs/os-specific/linux/lvm2/2_02.nix

···
+import ./common.nix {
+  version = "2.02.187";
+  sha256Hash = "sha256-Dg1SGoY6XbJEDy4edie6grcCc65KsLvhMIUdsNWOWvE=";
+}

pkgs/os-specific/linux/lvm2/2_03.nix

···
+import ./common.nix {
+  version = "2.03.12";
+  sha256Hash = "1shczwfd0888dchjiaqzd48ampm6f8y0ngsqd99fy4nxlbr5q1vn";
+}

pkgs/os-specific/linux/lvm2/default.nix pkgs/os-specific/linux/lvm2/common.nix

···
+{ version, sha256Hash }:
+
 { lib, stdenv
 , fetchpatch
 , fetchurl
···
 assert enableDmeventd -> enableCmdlib;
 
 stdenv.mkDerivation rec {
-  pname = "lvm2" + lib.optionalString enableDmeventd "with-dmeventd";
-  version = "2.03.12";
+  pname = "lvm2" + lib.optionalString enableDmeventd "-with-dmeventd";
+  inherit version;
 
   src = fetchurl {
     url = "https://mirrors.kernel.org/sourceware/lvm2/LVM2.${version}.tgz";
-    sha256 = "1shczwfd0888dchjiaqzd48ampm6f8y0ngsqd99fy4nxlbr5q1vn";
+    sha256 = sha256Hash;
   };
 
   nativeBuildInputs = [ pkg-config ];
···
       --replace "(BINDIR)/systemd-run" /run/current-system/systemd/bin/systemd-run
 
     substituteInPlace make.tmpl.in --replace "@systemdsystemunitdir@" "$out/lib/systemd/system"
+  '' + lib.optionalString (lib.versionAtLeast version "2.03") ''
     substituteInPlace libdm/make.tmpl.in --replace "@systemdsystemunitdir@" "$out/lib/systemd/system"
   '';
 

pkgs/os-specific/linux/pam/default.nix

···
-{ lib, stdenv, buildPackages, fetchurl, flex, cracklib, db4, gettext
+{ lib, stdenv, buildPackages, fetchurl, flex, cracklib, db4, gettext, audit
 , nixosTests
 , withLibxcrypt ? false, libxcrypt
 }:
···
   nativeBuildInputs = [ flex ]
     ++ lib.optional stdenv.buildPlatform.isDarwin gettext;
 
-  buildInputs = [ cracklib db4 ]
+  buildInputs = [ cracklib db4 audit ]
     ++ lib.optional withLibxcrypt libxcrypt;
 
   enableParallelBuilding = true;

pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch

···
-From 57e31a2d4a5d5bd7a9e1cd8a0d8bc6a00624ad68 Mon Sep 17 00:00:00 2001
+From 06a8dbb65584b6f705fee8a486f32dab12f72082 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <[e-mail]>
 Date: Tue, 8 Jan 2013 15:46:30 +0100
 Subject: [PATCH 01/19] Start device units for uninitialised encrypted devices
···
  SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}!="crypto_LUKS", SYMLINK+="gpt-auto-root"
  SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}=="crypto_LUKS", SYMLINK+="gpt-auto-root-luks"
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch

···
-From 43465a392b47238a32f8719f603ed9e2c9bb0363 Mon Sep 17 00:00:00 2001
+From 2c98ff115f7027bebde14cf3e74f2c51b343874c Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <[e-mail]>
 Date: Fri, 12 Apr 2013 13:16:57 +0200
 Subject: [PATCH 02/19] Don't try to unmount /nix or /nix/store
···
                  || path_equal(path, "/usr")
  #endif
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch

···
-From a99666d3d7012c2162fdacf84a57fc0b848fd957 Mon Sep 17 00:00:00 2001
+From 16f441b6495ff4c4d1d0b71a7f1650505147173d Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <[e-mail]>
 Date: Wed, 16 Apr 2014 10:59:28 +0200
 Subject: [PATCH 03/19] Fix NixOS containers
···
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 04685fecba..0e5ece5f91 100644
+index 575b9da447..438ca294db 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
 @@ -5590,6 +5590,7 @@ static int run(int argc, char *argv[]) {
···
  
          } else {
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch

···
-From 3f0780b25bdbe4156a2f761c90083bbba5f4d473 Mon Sep 17 00:00:00 2001
+From 261423bc039378115ad9223c2b6ede9c395847b2 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <[e-mail]>
 Date: Thu, 1 May 2014 14:10:10 +0200
 Subject: [PATCH 04/19] Look for fsck in the right place
···
                  cmdline[i++] = "-T";
  
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch

···
-From 82698c6a5142e710c302f9c38367ed00d8ec94ba Mon Sep 17 00:00:00 2001
+From 18b45c20499747bcc66714ee87edf34d4f6e3dca Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <[e-mail]>
 Date: Fri, 19 Dec 2014 14:46:17 +0100
 Subject: [PATCH 05/19] Add some NixOS-specific unit directories
···
  
                  if (!add)
 diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index fc0f8c34fa..ded74ce50a 100644
+index fc0f8c34fa..162432e77f 100644
 --- a/src/core/systemd.pc.in
 +++ b/src/core/systemd.pc.in
 @@ -38,10 +38,10 @@ systemdsystemconfdir=${systemd_system_conf_dir}
···
  
  systemd_sleep_dir=${root_prefix}/lib/systemd/system-sleep
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch

···
-From e2a8db60ebfb1e0477ce989f6c3d4a95f2e08120 Mon Sep 17 00:00:00 2001
+From 8b8f4168828a12cac17c3e8803cacebf31608c68 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <[e-mail]>
 Date: Mon, 11 May 2015 15:39:38 +0200
 Subject: [PATCH 06/19] Get rid of a useless message in user sessions
···
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 8884437347..e23d47b4a4 100644
+index 34891a8754..b9b4789720 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
 @@ -1375,7 +1375,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
···
                  /* If stopping a unit fails continuously we might enter a stop loop here, hence stop acting on the
                   * service being unnecessary after a while. */
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch

···
-From 56ae06b48c6852071dfc57c1203c04f07309d757 Mon Sep 17 00:00:00 2001
+From e147e9defaf2bb5e8040566537661d90b4008daf Mon Sep 17 00:00:00 2001
 From: Gabriel Ebner <[e-mail]>
 Date: Sun, 6 Dec 2015 14:26:36 +0100
 Subject: [PATCH 07/19] hostnamed, localed, timedated: disable methods that
···
  
          context_read_machine_info(c);
 diff --git a/src/locale/localed.c b/src/locale/localed.c
-index df0eb030d4..d026eae97e 100644
+index c228385d0e..942ccaa038 100644
 --- a/src/locale/localed.c
 +++ b/src/locale/localed.c
 @@ -360,6 +360,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
···
          if (r < 0)
                  return r;
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch

···
-From b783b2da164482f26ac5e6e347dc41930c072ea5 Mon Sep 17 00:00:00 2001
+From 992d0e6abb09aacceee2f8646c4bcdacf7277dc7 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <[e-mail]>
 Date: Thu, 7 Jul 2016 02:47:13 +0300
 Subject: [PATCH 08/19] Fix hwdb paths
···
 +        "/etc/udev/hwdb.bin\0"
 +
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch

···
-From e24c05ef8cfe48c4f0ebdb92e8147ae2151e4c87 Mon Sep 17 00:00:00 2001
+From 462bc01b3a38468fd617066a3d7f27b1acca9e0a Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <[e-mail]>
 Date: Tue, 11 Oct 2016 13:12:08 +0300
 Subject: [PATCH 09/19] Change /usr/share/zoneinfo to /etc/zoneinfo
···
          (void) mkdir_parents(etc_localtime, 0755);
          if (symlink(e, etc_localtime) < 0)
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 0e5ece5f91..cc46435472 100644
+index 438ca294db..98bd110d92 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
 @@ -1887,8 +1887,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
···
                          return -ENOMEM;
  
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch

···
-From 09f6ca91b4131637038686dafd57b5da642c100e Mon Sep 17 00:00:00 2001
+From fbb302d00c63dc17a210f83648f24a1da983b2c0 Mon Sep 17 00:00:00 2001
 From: Imuli <[e-mail]>
 Date: Wed, 19 Oct 2016 08:46:47 -0400
 Subject: [PATCH 10/19] localectl: use /etc/X11/xkb for list-x11-*
···
                  return log_error_errno(errno, "Failed to open keyboard mapping list. %m");
  
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch

···
-From d5716cd93fdaad16b590a581f39d95954f40748e Mon Sep 17 00:00:00 2001
+From b850dae349de8ac6906d4f920a21ef275cecb2de Mon Sep 17 00:00:00 2001
 From: Franz Pletz <[e-mail]>
 Date: Sun, 11 Feb 2018 04:37:44 +0100
 Subject: [PATCH 11/19] build: don't create statedir and don't touch prefixdir
···
  1 file changed, 3 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index 738879eb21..453ee4b1c0 100644
+index b5a51b6d0d..99b071542c 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -3538,9 +3538,6 @@ install_data('LICENSE.GPL2',
+@@ -3540,9 +3540,6 @@ install_data('LICENSE.GPL2',
               'docs/GVARIANT-SERIALIZATION.md',
               install_dir : docdir)
  
···
  
  # Ensure that changes to the docs/ directory do not break the
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch

···
-From 40a5df71e7af5feefacae9fc95bf94e72c6c12f4 Mon Sep 17 00:00:00 2001
+From beefb6d381286769cc47c71c82b831a37a405d90 Mon Sep 17 00:00:00 2001
 From: Andreas Rammhold <[e-mail]>
 Date: Fri, 2 Nov 2018 21:15:42 +0100
 Subject: [PATCH 12/19] inherit systemd environment when calling generators.
···
  1 file changed, 9 insertions(+), 4 deletions(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index e23d47b4a4..1047aadebc 100644
+index b9b4789720..79239afe4a 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -4145,10 +4145,15 @@ static int manager_run_generators(Manager *m) {
+@@ -4149,10 +4149,15 @@ static int manager_run_generators(Manager *m) {
          argv[4] = NULL;
  
          RUN_WITH_UMASK(0022)
···
  
  finish:
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch

···
-From fe3aff271cf127c1484533237fe0a024e07ae7bc Mon Sep 17 00:00:00 2001
+From 146b79d55cc4fdfdb5fd4978e68b21f5c1df1679 Mon Sep 17 00:00:00 2001
 From: Andreas Rammhold <[e-mail]>
 Date: Thu, 9 May 2019 11:15:22 +0200
 Subject: [PATCH 13/19] add rootprefix to lookup dir paths
···
  #define CONF_PATHS(n)                           \
          CONF_PATHS_USR(n)                       \
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch

···
-From 31732478745f7a200004fb8ec013f54dbc536f2e Mon Sep 17 00:00:00 2001
+From 8edd810e74e2308f34eba6e8072e559e69307830 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <[e-mail]>
 Date: Thu, 25 Jul 2019 20:45:55 +0300
 Subject: [PATCH 14/19] systemd-shutdown: execute scripts in
···
          /* The log target defaults to console, but the original systemd process will pass its log target in through a
           * command line argument, which will override this default. Also, ensure we'll never log to the journal or
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch

···
-From 3f2277b86f39cb55936ae11c2365feb283b547cb Mon Sep 17 00:00:00 2001
+From 9ed24199dd3ce91d3f7fbfbdf823312c124aba56 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <[e-mail]>
 Date: Thu, 25 Jul 2019 20:46:58 +0300
 Subject: [PATCH 15/19] systemd-sleep: execute scripts in
···
          };
  
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch

···
-From 330490aa8a44206bc03205654680913ab01408a1 Mon Sep 17 00:00:00 2001
+From 6db7ad4d5526a82e4ed9b135daf1054a8b71e1c7 Mon Sep 17 00:00:00 2001
 From: Florian Klink <[e-mail]>
 Date: Sat, 7 Mar 2020 22:40:27 +0100
 Subject: [PATCH 16/19] kmod-static-nodes.service: Update ConditionFileNotEmpty
···
  [Service]
  Type=oneshot
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch

···
-From 216018be7b422586b937dae8fd83f51989479a41 Mon Sep 17 00:00:00 2001
+From 160d32c336c96744bbfb618eae4c12cb90138644 Mon Sep 17 00:00:00 2001
 From: Florian Klink <[e-mail]>
 Date: Sun, 8 Mar 2020 01:05:54 +0100
 Subject: [PATCH 17/19] path-util.h: add placeholder for DEFAULT_PATH_NORMAL
···
  #if HAVE_SPLIT_USR
  #  define DEFAULT_PATH DEFAULT_PATH_SPLIT_USR
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0018-logind-seat-debus-show-CanMultiSession-again.patch

···
-From beb594ff3bceb95598ffa8ec47c31bacb2449473 Mon Sep 17 00:00:00 2001
-From: Thomas Tuegel <[e-mail]>
-Date: Mon, 26 Oct 2020 21:21:38 +0100
-Subject: [PATCH 18/19] logind-seat-debus: show CanMultiSession again
-
-Fixes the "switch user" function in Plasma < 5.20.
----
- src/login/logind-seat-dbus.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/login/logind-seat-dbus.c b/src/login/logind-seat-dbus.c
-index cceb3b1d2d..94b4723bb9 100644
---- a/src/login/logind-seat-dbus.c
-+++ b/src/login/logind-seat-dbus.c
-@@ -419,7 +419,7 @@ static const sd_bus_vtable seat_vtable[] = {
- 
-         SD_BUS_PROPERTY("Id", "s", NULL, offsetof(Seat, id), SD_BUS_VTABLE_PROPERTY_CONST),
-         SD_BUS_PROPERTY("ActiveSession", "(so)", property_get_active_session, 0, SD_BUS_VTABLE_PROPERTY_EMITS_CHANGE),
--        SD_BUS_PROPERTY("CanMultiSession", "b", property_get_const_true, 0, SD_BUS_VTABLE_PROPERTY_CONST|SD_BUS_VTABLE_HIDDEN),
-+        SD_BUS_PROPERTY("CanMultiSession", "b", property_get_const_true, 0, SD_BUS_VTABLE_PROPERTY_CONST),
-         SD_BUS_PROPERTY("CanTTY", "b", property_get_can_tty, 0, SD_BUS_VTABLE_PROPERTY_CONST),
-         SD_BUS_PROPERTY("CanGraphical", "b", property_get_can_graphical, 0, SD_BUS_VTABLE_PROPERTY_EMITS_CHANGE),
-         SD_BUS_PROPERTY("Sessions", "a(so)", property_get_sessions, 0, 0),
--- 
-2.32.0
-

pkgs/os-specific/linux/systemd/0019-pkg-config-derive-prefix-from-prefix.patch pkgs/os-specific/linux/systemd/0018-pkg-config-derive-prefix-from-prefix.patch

···
-From 2e7477dc29095141a0556ded11f0ee370d82bfbb Mon Sep 17 00:00:00 2001
+From 777d61550f95b1dcf253e1d2132f9db7010a18f3 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <[e-mail]>
 Date: Sun, 6 Dec 2020 08:34:19 +0100
-Subject: [PATCH 19/19] pkg-config: derive prefix from --prefix
+Subject: [PATCH 18/19] pkg-config: derive prefix from --prefix
 
 Point prefix to the one configured, instead of `/usr` `systemd` has limited
 support for making the pkgconfig prefix overridable, and interpolates those
···
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index ded74ce50a..0262f53154 100644
+index 162432e77f..2fc20daf03 100644
 --- a/src/core/systemd.pc.in
 +++ b/src/core/systemd.pc.in
 @@ -11,7 +11,7 @@
···
  rootprefix=${root_prefix}
  sysconf_dir={{SYSCONF_DIR}}
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0020-core-respect-install_sysconfdir_samples-in-meson-fil.patch

···
-From 1a2d24d210c9329e8b900fdb01576c57374581d8 Mon Sep 17 00:00:00 2001
-From: Andreas Rammhold <[e-mail]>
-Date: Mon, 26 Jul 2021 16:57:43 +0200
-Subject: [PATCH 20/20] core: respect install_sysconfdir_samples in meson file
-
-The refactoring done in e11a25cadbe caused the configuration files to be
-installed into the pkgsysconfdir regardless of the state of the
-install_sysconfdir_samples boolean that indicated whether or not the
-sample files should be installed.
----
- src/core/meson.build | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/src/core/meson.build b/src/core/meson.build
-index f0d2c6f642..4ff7e00e36 100644
---- a/src/core/meson.build
-+++ b/src/core/meson.build
-@@ -187,6 +187,10 @@ foreach item : in_files
-         file = item[0]
-         dir = item[1]
- 
-+        if not install_sysconfdir_samples and dir == pkgsysconfdir
-+                continue
-+        endif
-+
-         custom_target(
-                 file,
-                 input : file + '.in',
--- 
-2.32.0
-

pkgs/os-specific/linux/systemd/0021-login-respect-install_sysconfdir_samples-in-meson-fi.patch

···
-From 189ba3af8b21cfc53527453907e800a2917b1bfd Mon Sep 17 00:00:00 2001
-From: Andreas Rammhold <[e-mail]>
-Date: Mon, 26 Jul 2021 17:20:34 +0200
-Subject: [PATCH] login: respect install_sysconfdir_samples in meson file
-
-The refactoring done in c900d89faa0 caused the configuration files to be
-installed into the pkgsysconfdir regardless of the state of the
-install_sysconfdir_samples boolean that indicates whether or not the
-sample files should be installed.
----
- src/login/meson.build | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/login/meson.build b/src/login/meson.build
-index 8c20e6be65..b637adc9a2 100644
---- a/src/login/meson.build
-+++ b/src/login/meson.build
-@@ -67,7 +67,7 @@ pam_systemd_c = files('pam_systemd.c')
- 
- enable_logind = conf.get('ENABLE_LOGIND') == 1
- in_files = [
--        ['logind.conf',        pkgsysconfdir, enable_logind],
-+        ['logind.conf',        pkgsysconfdir, enable_logind and install_sysconfdir_samples],
-         ['70-uaccess.rules',   udevrulesdir,  enable_logind and conf.get('HAVE_ACL') == 1],
-         ['71-seat.rules',      udevrulesdir,  enable_logind],
-         ['73-seat-late.rules', udevrulesdir,  enable_logind],
--- 
-2.32.0
-

pkgs/os-specific/linux/systemd/0022-core-Handle-lookup-paths-being-symlinks.patch pkgs/os-specific/linux/systemd/0019-core-handle-lookup-paths-being-symlinks.patch

···
-From 5f17b65d30480e489e135b403a072b38535b2911 Mon Sep 17 00:00:00 2001
+From 273e706ff561f2164b84c714148346ac92dd8846 Mon Sep 17 00:00:00 2001
 From: Andreas Rammhold <[e-mail]>
 Date: Wed, 18 Aug 2021 19:10:08 +0200
-Subject: [PATCH] core: handle lookup paths being symlinks
+Subject: [PATCH 19/19] core: handle lookup paths being symlinks
 
 With a recent change paths leaving the statically known lookup paths
 would be treated differently then those that remained within those. That
···
  1 file changed, 31 insertions(+), 2 deletions(-)
 
 diff --git a/src/basic/unit-file.c b/src/basic/unit-file.c
-index 884a0674a9..3ae2a115d0 100644
+index 0d58b1c4fe..7314f1245f 100644
 --- a/src/basic/unit-file.c
 +++ b/src/basic/unit-file.c
 @@ -254,6 +254,7 @@ int unit_file_build_name_map(
···
                                          log_debug("%s: linked unit file: %s → %s",
                                                    __func__, filename, simplified);
 -- 
-2.32.0
+2.33.0
 

pkgs/os-specific/linux/systemd/0023-path-util-make-find_executable-work-without-proc-mounted.patch

···
-From 93413acd3ef3a637a0f31a1d133b103e1dc81fd6 Mon Sep 17 00:00:00 2001
-From: Yu Watanabe <[e-mail]>
-Date: Mon, 23 Aug 2021 06:16:48 +0900
-Subject: [PATCH] path-util: make find_executable() work without /proc mounted
-
-Follow-up for 888f65ace6296ed61285d31db846babf1c11885e.
-
-Hopefully fixes #20514.
----
- src/basic/path-util.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/src/basic/path-util.c b/src/basic/path-util.c
-index d11f254a9f6a..a21981616b59 100644
---- a/src/basic/path-util.c
-+++ b/src/basic/path-util.c
-@@ -630,7 +630,11 @@ static int check_x_access(const char *path, int *ret_fd) {
-                 return r;
- 
-         r = access_fd(fd, X_OK);
--        if (r < 0)
-+        if (r == -ENOSYS) {
-+                /* /proc is not mounted. Fallback to access(). */
-+                if (access(path, X_OK) < 0)
-+                        return -errno;
-+        } else if (r < 0)
-                 return r;
- 
-         if (ret_fd)

pkgs/os-specific/linux/systemd/default.nix

···
 , lib
 , fetchFromGitHub
 , fetchpatch
+, fetchzip
 , buildPackages
 , ninja
 , meson
···
 , withHomed ? false
 , withHostnamed ? true
 , withHwdb ? true
-, withImportd ? true
+, withImportd ? !stdenv.hostPlatform.isMusl
 , withLibBPF ? false # currently fails while generating BPF objects
 , withLocaled ? true
 , withLogind ? true
 , withMachined ? true
 , withNetworkd ? true
-, withNss ? true
+, withNss ? !stdenv.hostPlatform.isMusl
 , withOomd ? false
 , withPCRE2 ? true
 , withPolkit ? true
 , withPortabled ? false
-, withRemote ? true
+, withRemote ? !stdenv.hostPlatform.isMusl
 , withResolved ? true
 , withShellCompletions ? true
 , withTimedated ? true
 , withTimesyncd ? true
-, withTpm2Tss ? true
-, withUserDb ? true
+, withTpm2Tss ? !stdenv.hostPlatform.isMusl
+, withUserDb ? !stdenv.hostPlatform.isMusl
 , libfido2
 , p11-kit
 
···
 assert withCryptsetup -> (cryptsetup != null);
 let
   wantCurl = withRemote || withImportd;
-  version = "249.4";
+  version = "249.5";
 in
 stdenv.mkDerivation {
   inherit pname version;
···
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    sha256 = "0pqi9gbk9kgwvd0idf13ybxz7s4h5przn01bwj6fna44jr0wy41c";
+    sha256 = "0bir2syy20rdi59sv8xp8nw1c92zl9z0wmv7ggsll8dca7niqwbp";
   };
 
   # If these need to be regenerated, `git am path/to/00*.patch` them into a
···
     ./0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
     ./0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
     ./0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
-    ./0018-logind-seat-debus-show-CanMultiSession-again.patch
-    ./0019-pkg-config-derive-prefix-from-prefix.patch
-
-    # In v249 a bunch of meson files had been touched as part of the migration to
-    # jinja2 for templating. Unfortunately some of those files lost the `install_sysconfdir_samples` check.
-    # The following two patches are part of a PR that was filed to fix those cases.
-    # https://github.com/systemd/systemd/pull/20303
-    ./0020-core-respect-install_sysconfdir_samples-in-meson-fil.patch
-    ./0021-login-respect-install_sysconfdir_samples-in-meson-fi.patch
+    ./0018-pkg-config-derive-prefix-from-prefix.patch
 
-    # In v248 or v249 we started to get in trouble due to our /etc/systemd/sytem being
-    # a symlink and thus being treated differently by systemd. With the below
-    # patch we mitigate that effect by special casing all our root unit dirs
-    # if they are symlinks. This does exactly what we need (AFAICT).
-    ./0022-core-Handle-lookup-paths-being-symlinks.patch
+    # In v248 or v249 we started to get in trouble due to our
+    # /etc/systemd/system being a symlink and thus being treated differently by
+    # systemd. With the below patch we mitigate that effect by special casing
+    # all our root unit dirs if they are symlinks. This does exactly what we
+    # need (AFAICT).
+    ./0019-core-handle-lookup-paths-being-symlinks.patch
+  ] ++ lib.optional stdenv.hostPlatform.isMusl (let
+    oe-core = fetchzip {
+      url = "https://git.openembedded.org/openembedded-core/snapshot/openembedded-core-14c6e5a4b72d0e4665279158a0740dd1dc21f72f.tar.bz2";
+      sha256 = "1jixya4czkr5p5rdcw3d6ips8zzr82dvnanvzvgjh67730scflya";
+    };
+    musl-patches = oe-core + "/meta/recipes-core/systemd/systemd";
+  in [
+    (musl-patches + "/0002-don-t-use-glibc-specific-qsort_r.patch")
+    (musl-patches + "/0003-missing_type.h-add-__compare_fn_t-and-comparison_fn_.patch")
+    (musl-patches + "/0004-add-fallback-parse_printf_format-implementation.patch")
+    (musl-patches + "/0005-src-basic-missing.h-check-for-missing-strndupa.patch")
+    (musl-patches + "/0006-Include-netinet-if_ether.h.patch")
+    (musl-patches + "/0007-don-t-fail-if-GLOB_BRACE-and-GLOB_ALTDIRFUNC-is-not-.patch")
+    (musl-patches + "/0008-add-missing-FTW_-macros-for-musl.patch")
+    (musl-patches + "/0009-fix-missing-of-__register_atfork-for-non-glibc-build.patch")
+    (musl-patches + "/0010-Use-uintmax_t-for-handling-rlim_t.patch")
+    (musl-patches + "/0011-test-sizeof.c-Disable-tests-for-missing-typedefs-in-.patch")
+    (musl-patches + "/0012-don-t-pass-AT_SYMLINK_NOFOLLOW-flag-to-faccessat.patch")
+    (musl-patches + "/0013-Define-glibc-compatible-basename-for-non-glibc-syste.patch")
+    (musl-patches + "/0014-Do-not-disable-buffering-when-writing-to-oom_score_a.patch")
+    (musl-patches + "/0015-distinguish-XSI-compliant-strerror_r-from-GNU-specif.patch")
+    (musl-patches + "/0016-Hide-__start_BUS_ERROR_MAP-and-__stop_BUS_ERROR_MAP.patch")
+    (musl-patches + "/0017-missing_type.h-add-__compar_d_fn_t-definition.patch")
+    (musl-patches + "/0018-avoid-redefinition-of-prctl_mm_map-structure.patch")
+    (musl-patches + "/0019-Handle-missing-LOCK_EX.patch")
+    (musl-patches + "/0021-test-json.c-define-M_PIl.patch")
+    (musl-patches + "/0022-do-not-disable-buffer-in-writing-files.patch")
+    (musl-patches + "/0025-Handle-__cpu_mask-usage.patch")
+    (musl-patches + "/0026-Handle-missing-gshadow.patch")
+    (musl-patches + "/0028-missing_syscall.h-Define-MIPS-ABI-defines-for-musl.patch")
 
-    # The way files are being tested for being executable changed in v248/v249
-    # which caused our confinement setup to fail as we do not mount /proc by
-    # default.
-    # The issue has been reported upstream and this patch carries the upstream
-    # fix for the same. Upstream now has a test for this scenario.
-    # https://github.com/systemd/systemd/issues/20514
-    ./0023-path-util-make-find_executable-work-without-proc-mounted.patch
-  ];
+    # Being discussed upstream: https://lists.openembedded.org/g/openembedded-core/topic/86411771#157056
+    ./musl.diff
+  ]);
 
   postPatch = ''
     substituteInPlace src/basic/path-util.h --replace "@defaultPathNormal@" "${placeholder "out"}/bin/"
···
     "-Dnss-systemd=false"
   ] ++ lib.optionals withLibBPF [
     "-Dbpf-framework=true"
-  ] ++ lib.optional withTpm2Tss "-Dtpm2=true";
+  ] ++ lib.optionals withTpm2Tss [
+    "-Dtpm2=true"
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+    "-Dgshadow=false"
+    "-Dutmp=false"
+    "-Didn=false"
+  ];
 
   preConfigure = ''
     mesonFlagsArray+=(-Dntp-servers="0.nixos.pool.ntp.org 1.nixos.pool.ntp.org 2.nixos.pool.ntp.org 3.nixos.pool.ntp.org")
···
       --replace "SYSTEMD_CGROUP_AGENT_PATH" "_SYSTEMD_CGROUP_AGENT_PATH"
   '';
 
-  NIX_CFLAGS_COMPILE = toString [
+  NIX_CFLAGS_COMPILE = toString ([
     # Can't say ${polkit.bin}/bin/pkttyagent here because that would
     # lead to a cyclic dependency.
     "-UPOLKIT_AGENT_BINARY_PATH"
···
 
     "-USYSTEMD_BINARY_PATH"
     "-DSYSTEMD_BINARY_PATH=\"/run/current-system/systemd/lib/systemd/systemd\""
-  ];
+
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+    "-D__UAPI_DEF_ETHHDR=0"
+  ]);
 
   doCheck = false; # fails a bunch of tests
 

pkgs/os-specific/linux/systemd/musl.diff

···
+diff --git a/src/shared/mount-setup.c b/src/shared/mount-setup.c
+index ef3527e..cc1ba23 100644
+--- a/src/shared/mount-setup.c
++++ b/src/shared/mount-setup.c
+@@ -32,6 +32,7 @@
+ #include "strv.h"
+ #include "user-util.h"
+ #include "virt.h"
++#include "missing_type.h"
+ 
+ typedef enum MountMode {
+         MNT_NONE           = 0,

pkgs/servers/home-assistant/default.nix

···
     pytz
     pyyaml
     requests
-    ruamel_yaml
+    ruamel-yaml
     voluptuous
     voluptuous-serialize
     yarl

pkgs/servers/jicofo/default.nix

···
 
 let
   pname = "jicofo";
-  version = "1.0-798";
+  version = "1.0-813";
   src = fetchurl {
     url = "https://download.jitsi.org/stable/${pname}_${version}-1_all.deb";
-    sha256 = "55JagMfiBbBw0nqRxcMmfiwGF7B/1LA+pb5n6ZOZvag=";
+    sha256 = "MVlGD2l0e1a2AtYPU1fkBoEfdPhjf2nOehAcacQl4Jk=";
   };
 in
 stdenv.mkDerivation {

pkgs/servers/mautrix-facebook/default.nix

···
     pycryptodome
     python-olm
     python_magic
-    ruamel_yaml
+    ruamel-yaml
     unpaddedbase64
     yarl
   ] ++ lib.optional enableSystemd systemd;

pkgs/servers/mautrix-signal/default.nix

···
     python-olm
     python_magic
     qrcode
-    ruamel_yaml
+    ruamel-yaml
     unpaddedbase64
     yarl
   ];

pkgs/servers/mautrix-telegram/default.nix

···
     mautrix
     sqlalchemy
     CommonMark
-    ruamel_yaml
+    ruamel-yaml
     python_magic
     telethon
     telethon-session-sqlalchemy

pkgs/servers/nosql/redis/default.nix

···
 { lib, stdenv, fetchurl, lua, pkg-config, nixosTests
-, withSystemd ? stdenv.isLinux && !stdenv.hostPlatform.isMusl, systemd
+, withSystemd ? stdenv.isLinux && !stdenv.hostPlatform.isStatic, systemd
 # dependency ordering is broken at the moment when building with openssl
 , tlsSupport ? !stdenv.hostPlatform.isStatic, openssl
 }:

pkgs/servers/x11/xorg/default.nix

···
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXi = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext, libXfixes }: stdenv.mkDerivation {
     pname = "libXi";
-    version = "1.7.10";
+    version = "1.8";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXi-1.7.10.tar.bz2";
-      sha256 = "0q8hz3slga3w3ch8wp0k7ay9ilhz315qnab0w1y2x9w3cf7hv8rn";
+      url = "mirror://xorg/individual/lib/libXi-1.8.tar.bz2";
+      sha256 = "005sicls6faddkcj449858i9xz1nafy70y26frsk7iv1d9283l9f";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkg-config ];
···
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86inputlibinput = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libinput, xorgserver }: stdenv.mkDerivation {
     pname = "xf86-input-libinput";
-    version = "1.1.0";
+    version = "1.2.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/driver/xf86-input-libinput-1.1.0.tar.bz2";
-      sha256 = "05ldqr10f2rrnshyk3lc773rz0gp3ccdzwa8n7lsc94i850jl7g1";
+      url = "mirror://xorg/individual/driver/xf86-input-libinput-1.2.0.tar.bz2";
+      sha256 = "1xk9b05csndcgcj8kbb6fkwa3c7njzzxc6qvz9bvy77y2k2s63gq";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkg-config ];

pkgs/servers/x11/xorg/tarballs.list

···
 mirror://xorg/individual/driver/xf86-input-evdev-2.10.6.tar.bz2
 mirror://xorg/individual/driver/xf86-input-joystick-1.6.3.tar.bz2
 mirror://xorg/individual/driver/xf86-input-keyboard-1.9.0.tar.bz2
-mirror://xorg/individual/driver/xf86-input-libinput-1.1.0.tar.bz2
+mirror://xorg/individual/driver/xf86-input-libinput-1.2.0.tar.bz2
 mirror://xorg/individual/driver/xf86-input-mouse-1.9.3.tar.bz2
 mirror://xorg/individual/driver/xf86-input-synaptics-1.9.1.tar.bz2
 mirror://xorg/individual/driver/xf86-input-vmmouse-13.1.0.tar.bz2
···
 mirror://xorg/individual/lib/libXfont-1.5.4.tar.bz2
 mirror://xorg/individual/lib/libXfont2-2.0.5.tar.bz2
 mirror://xorg/individual/lib/libXft-2.3.4.tar.bz2
-mirror://xorg/individual/lib/libXi-1.7.10.tar.bz2
+mirror://xorg/individual/lib/libXi-1.8.tar.bz2
 mirror://xorg/individual/lib/libXinerama-1.1.4.tar.bz2
 mirror://xorg/individual/lib/libxkbfile-1.1.0.tar.bz2
 mirror://xorg/individual/lib/libXmu-1.1.3.tar.bz2

pkgs/stdenv/generic/setup.sh

···
         case "$fn" in
             *.tar.xz | *.tar.lzma | *.txz)
                 # Don't rely on tar knowing about .xz.
-                xz -d < "$fn" | tar xf -
+                xz -d < "$fn" | tar xf - --warning=no-timestamp
                 ;;
             *.tar | *.tar.* | *.tgz | *.tbz2 | *.tbz)
                 # GNU tar can automatically select the decompression method
                 # (info "(tar) gzip").
-                tar xf "$fn"
+                tar xf "$fn" --warning=no-timestamp
                 ;;
             *)
                 return 1

pkgs/tools/admin/awscli2/default.nix

···
     prompt-toolkit
     pyyaml
     rsa
-    ruamel_yaml
+    ruamel-yaml
     s3transfer
     six
     wcwidth

pkgs/tools/backup/borgmatic/default.nix

···
     borgbackup
     colorama
     jsonschema
-    ruamel_yaml
+    ruamel-yaml
     requests
     setuptools
   ];

pkgs/tools/filesystems/e2fsprogs/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "e2fsprogs";
-  version = "1.46.2";
+  version = "1.46.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-958mtPZb3AWfyhLh7GowQMPOGlA/tw65Fb7nGQOBXNU=";
+    sha256 = "0ra2d1wasksy1zy3rgviwdni40dnamchisjrrqqi940y545m493m";
   };
 
   outputs = [ "bin" "dev" "out" "man" "info" ];

pkgs/tools/filesystems/xfsprogs/default.nix

···
-{ lib, stdenv, buildPackages, fetchpatch, fetchurl, autoconf, automake, gettext, libtool, pkg-config
+{ lib, stdenv, buildPackages, fetchurl, autoconf, automake, gettext, libtool, pkg-config
 , icu, libuuid, readline, inih
 }:
 
 stdenv.mkDerivation rec {
   pname = "xfsprogs";
-  version = "5.11.0";
+  version = "5.13.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/fs/xfs/xfsprogs/${pname}-${version}.tar.xz";
-    sha256 = "0lxks616nmdk8zkdbwpq5sf9zz19smgy5rpmp3hpk2mvrl7kk70f";
+    sha256 = "sha256-ThQtS6vghq35AW2MYGyAWCnaCORjiaRDP0A0YgT5DNs=";
   };
 
   outputs = [ "bin" "dev" "out" "doc" ];

pkgs/tools/graphics/graphviz/default.nix

···
 import ./base.nix rec {
-  rev = "887cd2207e6858ff2c0fe6e461dd309a435c8d5a"; # use rev as tags have disappeared before
-  version = "2.47.3";
-  sha256 = "sha256-WUu3eAycG/oHTnT7HiZvf0B45I8miYolwRi9fHfA3uA=";
- }
+  rev = "3425dae078262591d04fec107ec71ab010651852"; # use rev as tags have disappeared before
+  version = "2.49.3";
+  sha256 = "1qvyjly7r1ihacdvxq0r59l4csr09sc05palpshzqsiz2wb1izk0";
+}

pkgs/tools/inputmethods/m17n-lib/default.nix

···
 
   buildInputs = [ m17n_db ];
 
+  # Fails parallel build due to missing intra-package depends:
+  #   https://savannah.nongnu.org/bugs/index.php?61377
+  #     make[2]: *** No rule to make target '../src/libm17n-core.la', needed by 'libm17n.la'.  Stop.
+  enableParallelBuilding = false;
+
   meta = {
     homepage = "https://www.nongnu.org/m17n/";
     description = "Multilingual text processing library (runtime)";

pkgs/tools/misc/bkyml/default.nix

···
   pythonImportsCheck = [ "bkyml" ];
 
   propagatedBuildInputs = [
-    ruamel_yaml
+    ruamel-yaml
     setuptools
   ];
 

pkgs/tools/misc/coreutils/default.nix

···
   # Prevents attempts of running 'help2man' on cross-built binaries.
   PERL = if stdenv.hostPlatform == stdenv.buildPlatform then null else "missing";
 
-  # Saw random failures like ‘help2man: can't get '--help' info from
-  # man/sha512sum.td/sha512sum’.
-  enableParallelBuilding = false;
+  enableParallelBuilding = true;
 
   NIX_LDFLAGS = optionalString selinuxSupport "-lsepol";
   FORCE_UNSAFE_CONFIGURE = optionalString stdenv.hostPlatform.isSunOS "1";

pkgs/tools/misc/file/default.nix

···
-{ lib, stdenv, fetchurl, file, zlib, libgnurx, fetchpatch }:
+{ lib, stdenv, fetchurl, file, zlib, libgnurx }:
 
 stdenv.mkDerivation rec {
   pname = "file";
-  version = "5.40";
+  version = "5.41";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.astron.com/pub/file/${pname}-${version}.tar.gz"
       "https://distfiles.macports.org/file/${pname}-${version}.tar.gz"
     ];
-    sha256 = "0myxlpj9gy2diqavx33vq88kpvr1k1bpzsm0d0zmb2hl7ks22wqn";
+    sha256 = "sha256-E+Uyx7Nk99V+I9/uoxRxAxUMuQWTpXr4bBDk9uQRYD8=";
   };
 
   nativeBuildInputs = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) file;
   buildInputs = [ zlib ]
     ++ lib.optional stdenv.hostPlatform.isWindows libgnurx;
 
-  patches = [
-    # Fix the mime type detection of xz file. Is merged in master.
-    (fetchpatch {
-      url = "https://github.com/file/file/commit/9b0459afab309a82aa4e46f73a4e50dd641f3d39.patch";
-      sha256 = "sha256-6vjyIn5gVbgmhUlfXJKFRVltm8YKATKmh0/X6+2lLnM=";
-    })
-  ];
-
   doCheck = true;
 
   makeFlags = lib.optional stdenv.hostPlatform.isWindows "FILE_COMPILE=file";
···
   meta = with lib; {
     homepage = "https://darwinsys.com/file";
     description = "A program that shows the type of files";
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ doronbehar ];
     license = licenses.bsd2;
     platforms = platforms.all;
   };

pkgs/tools/misc/ntfy/default.nix

···
   ];
 
   propagatedBuildInputs = with python3Packages; [
-    requests ruamel_yaml appdirs
+    requests ruamel-yaml appdirs
     sleekxmpp dnspython
     emoji
     psutil

pkgs/tools/misc/starship/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "starship";
-  version = "0.58.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "starship";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-s84fIpCyTF7FrJZGATjIJHt/+aknlhlz1V9s+c4f+Ig=";
+    sha256 = "sha256-KU9IbvQ6qPbSoHVRN/g7iETV47Y4wMMESzpRHMQ0Uxw=";
   };
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optionals stdenv.isLinux [ pkg-config ];
···
     done
   '';
 
-  cargoSha256 = "sha256-5YOF0nXn4rdp3uxatzdvaqdAbLlHK6nq5H4+ZX/7joM=";
+  cargoSha256 = "sha256-IzTRvvQ1uHS2WY2Cf8VQOq423PjwXYNW4bub0ZyvTIE=";
 
   preCheck = ''
     HOME=$TMPDIR

pkgs/tools/misc/synth/default.nix

···
 , pkg-config
 , openssl
 , stdenv
+, AppKit
 , Security
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "synth";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "getsynth";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-i5X2HUOCgY2znH4rDzhFpsPXsFeM7GR4soAO/rFDjjo=";
+    sha256 = "sha256-VsvGrlFmn8Q7dhvo3Buy8G0oeNErtBT4lZ8k8WFC8Zo=";
   };
 
-  cargoSha256 = "sha256-47i46Y6JjTGWC7mfMd2x2k8v0SY1o2UHdEU4rF0VrsY=";
+  cargoSha256 = "sha256-10b2n7wMuBt90GZ6AVnSMT7r2501tounw13eJhyrmS4=";
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ] ++ lib.optional stdenv.isDarwin Security;
+  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [
+    AppKit
+    Security
+  ];
 
   # requires unstable rust features
   RUSTC_BOOTSTRAP = 1;

pkgs/tools/misc/zellij/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "zellij";
-  version = "0.19.0";
+  version = "0.20.1";
 
   src = fetchFromGitHub {
     owner = "zellij-org";
     repo = "zellij";
     rev = "v${version}";
-    sha256 = "sha256-/1ngmthzWp9K7pBBOBiSMUv0yC66K3Tg2g2PoBskpTU=";
+    sha256 = "sha256-VeFKUNAOhNvNAqIp4yg0dulIVC6vCvD3ClYjMg1vM1g=";
   };
 
-  cargoSha256 = "sha256-eFWsqjXO6QFTO26ppZ4tiJXc/PEYD+5ZdbTBMoDoLFI=";
+  cargoSha256 = "sha256-qZjyl+irC5Cj3tpUs97jLxs1UB+7E1xZKbnF3TPFhKE=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch

···
+On darwin, providing SystemConfiguration to curl currently results in a
+reference loop, so we have to disable the check for it and the feature
+which requires it (NAT64).
+
+Patching actual configure script here as we also don't want to require
+autoconf in the bootstrap loop just to regenerate a patched configure.ac.
+
+--- a/configure   2021-10-16 00:51:59.000000000 +0100
++++ b/configure   2021-10-16 01:06:46.000000000 +0100
+@@ -20810,7 +20810,7 @@
+     if test "x$build_for_macos" != xno; then
+       { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+ printf "%s\n" "yes" >&6; }
+-      LDFLAGS="$LDFLAGS -framework CoreFoundation -framework SystemConfiguration"
++      LDFLAGS="$LDFLAGS -framework CoreFoundation"
+     else
+       { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+ printf "%s\n" "no" >&6; }
+@@ -22211,9 +22211,6 @@
+ fi
+ 
+ 
+-if test "$HAVE_GETHOSTBYNAME" != "1"; then
+-  as_fn_error $? "couldn't find libraries for gethostbyname()" "$LINENO" 5
+-fi
+ 
+ 
+ curl_includes_winsock2="\
+diff --git a/lib/curl_setup.h b/lib/curl_setup.h
+index 99048c489..19abfbbac 100644
+--- a/lib/curl_setup.h
++++ b/lib/curl_setup.h
+@@ -247,19 +247,6 @@
+ #  include "setup-win32.h"
+ #endif
+ 
+-/*
+- * Use getaddrinfo to resolve the IPv4 address literal. If the current network
+- * interface doesn't support IPv4, but supports IPv6, NAT64, and DNS64,
+- * performing this task will result in a synthesized IPv6 address.
+- */
+-#if defined(__APPLE__) && !defined(USE_ARES)
+-#include <TargetConditionals.h>
+-#define USE_RESOLVE_ON_IPS 1
+-#  if defined(TARGET_OS_OSX) && TARGET_OS_OSX
+-#    define CURL_OSX_CALL_COPYPROXIES 1
+-#  endif
+-#endif
+-
+ #ifdef USE_LWIPSOCK
+ #  include <lwip/init.h>
+ #  include <lwip/sockets.h>

pkgs/tools/networking/curl/CVE-2021-22897.patch

···
-From bbb71507b7bab52002f9b1e0880bed6a32834511 Mon Sep 17 00:00:00 2001
-From: Daniel Stenberg <[e-mail]>
-Date: Fri, 23 Apr 2021 10:54:10 +0200
-Subject: [PATCH] schannel: don't use static to store selected ciphers
-
-CVE-2021-22897
-
-Bug: https://curl.se/docs/CVE-2021-22897.html
----
- lib/vtls/schannel.c | 9 +++++----
- lib/vtls/schannel.h | 3 +++
- 2 files changed, 8 insertions(+), 4 deletions(-)
-
-diff --git a/lib/vtls/schannel.c b/lib/vtls/schannel.c
-index 8c25ac5dd5a5..dba7072273a9 100644
---- a/lib/vtls/schannel.c
-+++ b/lib/vtls/schannel.c
-@@ -328,12 +328,12 @@ get_alg_id_by_name(char *name)
- }
- 
- static CURLcode
--set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers)
-+set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers,
-+                int *algIds)
- {
-   char *startCur = ciphers;
-   int algCount = 0;
--  static ALG_ID algIds[45]; /*There are 45 listed in the MS headers*/
--  while(startCur && (0 != *startCur) && (algCount < 45)) {
-+  while(startCur && (0 != *startCur) && (algCount < NUMOF_CIPHERS)) {
-     long alg = strtol(startCur, 0, 0);
-     if(!alg)
-       alg = get_alg_id_by_name(startCur);
-@@ -593,7 +593,8 @@ schannel_connect_step1(struct Curl_easy *data, struct connectdata *conn,
-     }
- 
-     if(SSL_CONN_CONFIG(cipher_list)) {
--      result = set_ssl_ciphers(&schannel_cred, SSL_CONN_CONFIG(cipher_list));
-+      result = set_ssl_ciphers(&schannel_cred, SSL_CONN_CONFIG(cipher_list),
-+                               BACKEND->algIds);
-       if(CURLE_OK != result) {
-         failf(data, "Unable to set ciphers to passed via SSL_CONN_CONFIG");
-         return result;
-diff --git a/lib/vtls/schannel.h b/lib/vtls/schannel.h
-index 2952caa1a5a1..77853aa30f96 100644
---- a/lib/vtls/schannel.h
-+++ b/lib/vtls/schannel.h
-@@ -71,6 +71,8 @@ CURLcode Curl_verify_certificate(struct Curl_easy *data,
- #endif
- #endif
- 
-+#define NUMOF_CIPHERS 45 /* There are 45 listed in the MS headers */
-+
- struct Curl_schannel_cred {
-   CredHandle cred_handle;
-   TimeStamp time_stamp;
-@@ -102,6 +104,7 @@ struct ssl_backend_data {
- #ifdef HAS_MANUAL_VERIFY_API
-   bool use_manual_cred_validation; /* true if manual cred validation is used */
- #endif
-+  ALG_ID algIds[NUMOF_CIPHERS];
- };
- #endif /* EXPOSE_SCHANNEL_INTERNAL_STRUCTS */
- 

pkgs/tools/networking/curl/CVE-2021-22898.patch

···
-From 39ce47f219b09c380b81f89fe54ac586c8db6bde Mon Sep 17 00:00:00 2001
-From: Harry Sintonen <[e-mail]>
-Date: Fri, 7 May 2021 13:09:57 +0200
-Subject: [PATCH] telnet: check sscanf() for correct number of matches
-
-CVE-2021-22898
-
-Bug: https://curl.se/docs/CVE-2021-22898.html
----
- lib/telnet.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/lib/telnet.c b/lib/telnet.c
-index 26e0658ba9cc..fdd137fb0c04 100644
---- a/lib/telnet.c
-+++ b/lib/telnet.c
-@@ -922,7 +922,7 @@ static void suboption(struct Curl_easy *data)
-         size_t tmplen = (strlen(v->data) + 1);
-         /* Add the variable only if it fits */
-         if(len + tmplen < (int)sizeof(temp)-6) {
--          if(sscanf(v->data, "%127[^,],%127s", varname, varval)) {
-+          if(sscanf(v->data, "%127[^,],%127s", varname, varval) == 2) {
-             msnprintf((char *)&temp[len], sizeof(temp) - len,
-                       "%c%s%c%s", CURL_NEW_ENV_VAR, varname,
-                       CURL_NEW_ENV_VALUE, varval);

pkgs/tools/networking/curl/CVE-2021-22901.patch

···
-Based on upstream 7f4a9a9b2a49547eae24d2e19bc5c346e9026479, modified by ris to
-apply without 0c55fbab45bedb761766109d41c3da49c4bc66c6
-
-diff --git a/lib/multi.c b/lib/multi.c
-index 54365f399e9b..1b3e261c682a 100644
---- a/lib/multi.c
-+++ b/lib/multi.c
-@@ -878,8 +878,10 @@ bool Curl_multiplex_wanted(const struct Curl_multi *multi)
- void Curl_detach_connnection(struct Curl_easy *data)
- {
-   struct connectdata *conn = data->conn;
--  if(conn)
-+  if(conn) {
-     Curl_llist_remove(&conn->easyq, &data->conn_queue, NULL);
-+    Curl_ssl_detach_conn(data, conn);
-+  }
-   data->conn = NULL;
- }
- 
-@@ -896,6 +898,7 @@ void Curl_attach_connnection(struct Curl_easy *data,
-   data->conn = conn;
-   Curl_llist_insert_next(&conn->easyq, conn->easyq.tail, data,
-                          &data->conn_queue);
-+  Curl_ssl_associate_conn(data, conn);
- }
- 
- static int waitconnect_getsock(struct connectdata *conn,
-diff --git a/lib/vtls/gskit.c b/lib/vtls/gskit.c
-index c648f624579b..ca953769d1ba 100644
---- a/lib/vtls/gskit.c
-+++ b/lib/vtls/gskit.c
-@@ -1304,7 +1304,9 @@ const struct Curl_ssl Curl_ssl_gskit = {
-   Curl_none_set_engine_default,   /* set_engine_default */
-   Curl_none_engines_list,         /* engines_list */
-   Curl_none_false_start,          /* false_start */
--  NULL                            /* sha256sum */
-+  NULL,                           /* sha256sum */
-+  NULL,                           /* associate_connection */
-+  NULL                            /* disassociate_connection */
- };
- 
- #endif /* USE_GSKIT */
-diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
-index a10c0dbcca05..ecde5c44deeb 100644
---- a/lib/vtls/gtls.c
-+++ b/lib/vtls/gtls.c
-@@ -1656,7 +1656,9 @@ const struct Curl_ssl Curl_ssl_gnutls = {
-   Curl_none_set_engine_default,  /* set_engine_default */
-   Curl_none_engines_list,        /* engines_list */
-   Curl_none_false_start,         /* false_start */
--  gtls_sha256sum                 /* sha256sum */
-+  gtls_sha256sum,                /* sha256sum */
-+  NULL,                          /* associate_connection */
-+  NULL                           /* disassociate_connection */
- };
- 
- #endif /* USE_GNUTLS */
-diff --git a/lib/vtls/mbedtls.c b/lib/vtls/mbedtls.c
-index ca77de58667c..3a0be0f04b4f 100644
---- a/lib/vtls/mbedtls.c
-+++ b/lib/vtls/mbedtls.c
-@@ -1093,7 +1093,9 @@ const struct Curl_ssl Curl_ssl_mbedtls = {
-   Curl_none_set_engine_default,     /* set_engine_default */
-   Curl_none_engines_list,           /* engines_list */
-   Curl_none_false_start,            /* false_start */
--  mbedtls_sha256sum                 /* sha256sum */
-+  mbedtls_sha256sum,                /* sha256sum */
-+  NULL,                             /* associate_connection */
-+  NULL                              /* disassociate_connection */
- };
- 
- #endif /* USE_MBEDTLS */
-diff --git a/lib/vtls/mesalink.c b/lib/vtls/mesalink.c
-index f16c77c27fe0..bf8600d3230b 100644
---- a/lib/vtls/mesalink.c
-+++ b/lib/vtls/mesalink.c
-@@ -666,7 +666,9 @@ const struct Curl_ssl Curl_ssl_mesalink = {
-   Curl_none_set_engine_default,  /* set_engine_default */
-   Curl_none_engines_list,        /* engines_list */
-   Curl_none_false_start,         /* false_start */
--  NULL                           /* sha256sum */
-+  NULL,                          /* sha256sum */
-+  NULL,                          /* associate_connection */
-+  NULL                           /* disassociate_connection */
- };
- 
- #endif
-diff --git a/lib/vtls/nss.c b/lib/vtls/nss.c
-index 2aa4bdaa134f..1582b1e580a9 100644
---- a/lib/vtls/nss.c
-+++ b/lib/vtls/nss.c
-@@ -2465,7 +2465,9 @@ const struct Curl_ssl Curl_ssl_nss = {
-   Curl_none_set_engine_default, /* set_engine_default */
-   Curl_none_engines_list,       /* engines_list */
-   nss_false_start,              /* false_start */
--  nss_sha256sum                 /* sha256sum */
-+  nss_sha256sum,                /* sha256sum */
-+  NULL,                         /* associate_connection */
-+  NULL                          /* disassociate_connection */
- };
- 
- #endif /* USE_NSS */
-diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
-index 1521600dd5f6..ebd7abc3b4ac 100644
---- a/lib/vtls/openssl.c
-+++ b/lib/vtls/openssl.c
-@@ -240,6 +240,10 @@ struct ssl_backend_data {
- #endif
- };
- 
-+static void ossl_associate_connection(struct Curl_easy *data,
-+                                      struct connectdata *conn,
-+                                      int sockindex);
-+
- /*
-  * Number of bytes to read from the random number seed file. This must be
-  * a finite value (because some entropy "files" like /dev/urandom have
-@@ -2581,6 +2585,7 @@ static CURLcode ossl_connect_step1(struct Curl_easy *data,
-   curl_socket_t sockfd = conn->sock[sockindex];
-   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
-   ctx_option_t ctx_options = 0;
-+  void *ssl_sessionid = NULL;
- 
- #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
-   bool sni;
-@@ -3225,46 +3230,23 @@ static CURLcode ossl_connect_step1(struct Curl_easy *data,
-   }
- #endif
- 
--  /* Check if there's a cached ID we can/should use here! */
--  if(SSL_SET_OPTION(primary.sessionid)) {
--    void *ssl_sessionid = NULL;
--    int data_idx = ossl_get_ssl_data_index();
--    int connectdata_idx = ossl_get_ssl_conn_index();
--    int sockindex_idx = ossl_get_ssl_sockindex_index();
--    int proxy_idx = ossl_get_proxy_index();
--
--    if(data_idx >= 0 && connectdata_idx >= 0 && sockindex_idx >= 0 &&
--       proxy_idx >= 0) {
--      /* Store the data needed for the "new session" callback.
--       * The sockindex is stored as a pointer to an array element. */
--      SSL_set_ex_data(backend->handle, data_idx, data);
--      SSL_set_ex_data(backend->handle, connectdata_idx, conn);
--      SSL_set_ex_data(backend->handle, sockindex_idx, conn->sock + sockindex);
--#ifndef CURL_DISABLE_PROXY
--      SSL_set_ex_data(backend->handle, proxy_idx, SSL_IS_PROXY() ? (void *) 1:
--                      NULL);
--#else
--      SSL_set_ex_data(backend->handle, proxy_idx, NULL);
--#endif
--
--    }
-+  ossl_associate_connection(data, conn, sockindex);
- 
--    Curl_ssl_sessionid_lock(data);
--    if(!Curl_ssl_getsessionid(data, conn, SSL_IS_PROXY() ? TRUE : FALSE,
--                              &ssl_sessionid, NULL, sockindex)) {
--      /* we got a session id, use it! */
--      if(!SSL_set_session(backend->handle, ssl_sessionid)) {
--        Curl_ssl_sessionid_unlock(data);
--        failf(data, "SSL: SSL_set_session failed: %s",
--              ossl_strerror(ERR_get_error(), error_buffer,
--                            sizeof(error_buffer)));
--        return CURLE_SSL_CONNECT_ERROR;
--      }
--      /* Informational message */
--      infof(data, "SSL re-using session ID\n");
-+  Curl_ssl_sessionid_lock(data);
-+  if(!Curl_ssl_getsessionid(data, conn, SSL_IS_PROXY() ? TRUE : FALSE,
-+                            &ssl_sessionid, NULL, sockindex)) {
-+    /* we got a session id, use it! */
-+    if(!SSL_set_session(backend->handle, ssl_sessionid)) {
-+      Curl_ssl_sessionid_unlock(data);
-+      failf(data, "SSL: SSL_set_session failed: %s",
-+            ossl_strerror(ERR_get_error(), error_buffer,
-+                          sizeof(error_buffer)));
-+      return CURLE_SSL_CONNECT_ERROR;
-     }
--    Curl_ssl_sessionid_unlock(data);
-+    /* Informational message */
-+    infof(data, "SSL re-using session ID\n");
-   }
-+  Curl_ssl_sessionid_unlock(data);
- 
- #ifndef CURL_DISABLE_PROXY
-   if(conn->proxy_ssl[sockindex].use) {
-@@ -4498,6 +4480,90 @@ static void *ossl_get_internals(struct ssl_connect_data *connssl,
-          (void *)backend->ctx : (void *)backend->handle;
- }
- 
-+static void ossl_associate_connection(struct Curl_easy *data,
-+                                      struct connectdata *conn,
-+                                      int sockindex)
-+{
-+  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
-+  struct ssl_backend_data *backend = connssl->backend;
-+
-+  /* If we don't have SSL context, do nothing. */
-+  if(!backend->handle)
-+    return;
-+
-+  if(SSL_SET_OPTION(primary.sessionid)) {
-+    int data_idx = ossl_get_ssl_data_index();
-+    int connectdata_idx = ossl_get_ssl_conn_index();
-+    int sockindex_idx = ossl_get_ssl_sockindex_index();
-+    int proxy_idx = ossl_get_proxy_index();
-+
-+    if(data_idx >= 0 && connectdata_idx >= 0 && sockindex_idx >= 0 &&
-+       proxy_idx >= 0) {
-+      /* Store the data needed for the "new session" callback.
-+       * The sockindex is stored as a pointer to an array element. */
-+      SSL_set_ex_data(backend->handle, data_idx, data);
-+      SSL_set_ex_data(backend->handle, connectdata_idx, conn);
-+      SSL_set_ex_data(backend->handle, sockindex_idx, conn->sock + sockindex);
-+#ifndef CURL_DISABLE_PROXY
-+      SSL_set_ex_data(backend->handle, proxy_idx, SSL_IS_PROXY() ? (void *) 1:
-+                      NULL);
-+#else
-+      SSL_set_ex_data(backend->handle, proxy_idx, NULL);
-+#endif
-+    }
-+  }
-+}
-+
-+/*
-+ * Starting with TLS 1.3, the ossl_new_session_cb callback gets called after
-+ * the handshake. If the transfer that sets up the callback gets killed before
-+ * this callback arrives, we must make sure to properly clear the data to
-+ * avoid UAF problems. A future optimization could be to instead store another
-+ * transfer that might still be using the same connection.
-+ */
-+
-+static void ossl_disassociate_connection(struct Curl_easy *data,
-+                                         int sockindex)
-+{
-+  struct connectdata *conn = data->conn;
-+  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
-+  struct ssl_backend_data *backend = connssl->backend;
-+
-+  /* If we don't have SSL context, do nothing. */
-+  if(!backend->handle)
-+    return;
-+
-+  if(SSL_SET_OPTION(primary.sessionid)) {
-+    bool isproxy = FALSE;
-+    bool incache;
-+    void *old_ssl_sessionid = NULL;
-+    int data_idx = ossl_get_ssl_data_index();
-+    int connectdata_idx = ossl_get_ssl_conn_index();
-+    int sockindex_idx = ossl_get_ssl_sockindex_index();
-+    int proxy_idx = ossl_get_proxy_index();
-+
-+    if(data_idx >= 0 && connectdata_idx >= 0 && sockindex_idx >= 0 &&
-+       proxy_idx >= 0) {
-+      /* Invalidate the session cache entry, if any */
-+      isproxy = SSL_get_ex_data(backend->handle, proxy_idx) ? TRUE : FALSE;
-+
-+      /* Disable references to data in "new session" callback to avoid
-+       * accessing a stale pointer. */
-+      SSL_set_ex_data(backend->handle, data_idx, NULL);
-+      SSL_set_ex_data(backend->handle, connectdata_idx, NULL);
-+      SSL_set_ex_data(backend->handle, sockindex_idx, NULL);
-+      SSL_set_ex_data(backend->handle, proxy_idx, NULL);
-+    }
-+
-+    Curl_ssl_sessionid_lock(data);
-+    incache = !(Curl_ssl_getsessionid(data, conn, isproxy,
-+                                      &old_ssl_sessionid, NULL, sockindex));
-+    if(incache)
-+      Curl_ssl_delsessionid(data, old_ssl_sessionid);
-+    Curl_ssl_sessionid_unlock(data);
-+  }
-+}
-+
- const struct Curl_ssl Curl_ssl_openssl = {
-   { CURLSSLBACKEND_OPENSSL, "openssl" }, /* info */
- 
-@@ -4533,10 +4599,12 @@ const struct Curl_ssl Curl_ssl_openssl = {
-   ossl_engines_list,        /* engines_list */
-   Curl_none_false_start,    /* false_start */
- #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
--  ossl_sha256sum            /* sha256sum */
-+  ossl_sha256sum,           /* sha256sum */
- #else
--  NULL                      /* sha256sum */
-+  NULL,                     /* sha256sum */
- #endif
-+  ossl_associate_connection, /* associate_connection */
-+  ossl_disassociate_connection /* disassociate_connection */
- };
- 
- #endif /* USE_OPENSSL */
-diff --git a/lib/vtls/rustls.c b/lib/vtls/rustls.c
-index 9dfbd2c3c4c2..161f3bf51d75 100644
---- a/lib/vtls/rustls.c
-+++ b/lib/vtls/rustls.c
-@@ -604,7 +604,9 @@ const struct Curl_ssl Curl_ssl_rustls = {
-   Curl_none_set_engine_default,    /* set_engine_default */
-   Curl_none_engines_list,          /* engines_list */
-   Curl_none_false_start,           /* false_start */
--  NULL                             /* sha256sum */
-+  NULL,                            /* sha256sum */
-+  NULL,                            /* associate_connection */
-+  NULL                             /* disassociate_connection */
- };
- 
- #endif /* USE_RUSTLS */
-diff --git a/lib/vtls/schannel.c b/lib/vtls/schannel.c
-index dba7072273a9..2bcf11db2576 100644
---- a/lib/vtls/schannel.c
-+++ b/lib/vtls/schannel.c
-@@ -329,7 +329,7 @@ get_alg_id_by_name(char *name)
- 
- static CURLcode
- set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers,
--                int *algIds)
-+                ALG_ID *algIds)
- {
-   char *startCur = ciphers;
-   int algCount = 0;
-@@ -2433,7 +2433,9 @@ const struct Curl_ssl Curl_ssl_schannel = {
-   Curl_none_set_engine_default,      /* set_engine_default */
-   Curl_none_engines_list,            /* engines_list */
-   Curl_none_false_start,             /* false_start */
--  schannel_sha256sum                 /* sha256sum */
-+  schannel_sha256sum,                /* sha256sum */
-+  NULL,                              /* associate_connection */
-+  NULL                               /* disassociate_connection */
- };
- 
- #endif /* USE_SCHANNEL */
-diff --git a/lib/vtls/sectransp.c b/lib/vtls/sectransp.c
-index 4276b89cfb3a..8b1e84ed7715 100644
---- a/lib/vtls/sectransp.c
-+++ b/lib/vtls/sectransp.c
-@@ -3453,6 +3453,8 @@ const struct Curl_ssl Curl_ssl_sectransp = {
-   Curl_none_engines_list,             /* engines_list */
-   sectransp_false_start,              /* false_start */
-   sectransp_sha256sum                 /* sha256sum */
-+  NULL,                               /* associate_connection */
-+  NULL                                /* disassociate_connection */
- };
- 
- #ifdef __clang__
-diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
-index d63fd5c76386..65f4f773dd63 100644
---- a/lib/vtls/vtls.c
-+++ b/lib/vtls/vtls.c
-@@ -586,6 +586,25 @@ CURLcode Curl_ssl_addsessionid(struct Curl_easy *data,
-   return CURLE_OK;
- }
- 
-+void Curl_ssl_associate_conn(struct Curl_easy *data,
-+                             struct connectdata *conn)
-+{
-+  if(Curl_ssl->associate_connection) {
-+    Curl_ssl->associate_connection(data, conn, FIRSTSOCKET);
-+    if(conn->sock[SECONDARYSOCKET] && conn->bits.sock_accepted)
-+      Curl_ssl->associate_connection(data, conn, SECONDARYSOCKET);
-+  }
-+}
-+
-+void Curl_ssl_detach_conn(struct Curl_easy *data,
-+                          struct connectdata *conn)
-+{
-+  if(Curl_ssl->disassociate_connection) {
-+    Curl_ssl->disassociate_connection(data, FIRSTSOCKET);
-+    if(conn->sock[SECONDARYSOCKET] && conn->bits.sock_accepted)
-+      Curl_ssl->disassociate_connection(data, SECONDARYSOCKET);
-+  }
-+}
- 
- void Curl_ssl_close_all(struct Curl_easy *data)
- {
-@@ -1214,7 +1233,9 @@ static const struct Curl_ssl Curl_ssl_multi = {
-   Curl_none_set_engine_default,      /* set_engine_default */
-   Curl_none_engines_list,            /* engines_list */
-   Curl_none_false_start,             /* false_start */
--  NULL                               /* sha256sum */
-+  NULL,                              /* sha256sum */
-+  NULL,                              /* associate_connection */
-+  NULL                               /* disassociate_connection */
- };
- 
- const struct Curl_ssl *Curl_ssl =
-diff --git a/lib/vtls/vtls.h b/lib/vtls/vtls.h
-index a22d526ca810..7f93e7aedb21 100644
---- a/lib/vtls/vtls.h
-+++ b/lib/vtls/vtls.h
-@@ -84,6 +84,11 @@ struct Curl_ssl {
-   bool (*false_start)(void);
-   CURLcode (*sha256sum)(const unsigned char *input, size_t inputlen,
-                     unsigned char *sha256sum, size_t sha256sumlen);
-+
-+  void (*associate_connection)(struct Curl_easy *data,
-+                               struct connectdata *conn,
-+                               int sockindex);
-+  void (*disassociate_connection)(struct Curl_easy *data, int sockindex);
- };
- 
- #ifdef USE_SSL
-@@ -283,6 +288,11 @@ bool Curl_ssl_cert_status_request(void);
- 
- bool Curl_ssl_false_start(void);
- 
-+void Curl_ssl_associate_conn(struct Curl_easy *data,
-+                             struct connectdata *conn);
-+void Curl_ssl_detach_conn(struct Curl_easy *data,
-+                          struct connectdata *conn);
-+
- #define SSL_SHUTDOWN_TIMEOUT 10000 /* ms */
- 
- #else /* if not USE_SSL */
-@@ -309,6 +319,8 @@ bool Curl_ssl_false_start(void);
- #define Curl_ssl_cert_status_request() FALSE
- #define Curl_ssl_false_start() FALSE
- #define Curl_ssl_tls13_ciphersuites() FALSE
-+#define Curl_ssl_associate_conn(a,b) Curl_nop_stmt
-+#define Curl_ssl_detach_conn(a,b) Curl_nop_stmt
- #endif
- 
- #endif /* HEADER_CURL_VTLS_H */
-diff --git a/lib/vtls/wolfssl.c b/lib/vtls/wolfssl.c
-index 02fcd236697e..60e27e366252 100644
---- a/lib/vtls/wolfssl.c
-+++ b/lib/vtls/wolfssl.c
-@@ -1125,7 +1125,9 @@ const struct Curl_ssl Curl_ssl_wolfssl = {
-   Curl_none_set_engine_default,    /* set_engine_default */
-   Curl_none_engines_list,          /* engines_list */
-   Curl_none_false_start,           /* false_start */
--  wolfssl_sha256sum                /* sha256sum */
-+  wolfssl_sha256sum,               /* sha256sum */
-+  NULL,                            /* associate_connection */
-+  NULL                             /* disassociate_connection */
- };
- 
- #endif

pkgs/tools/networking/curl/CVE-2021-22945.patch

···
-From 43157490a5054bd24256fe12876931e8abc9df49 Mon Sep 17 00:00:00 2001
-From: z2_ on hackerone <>
-Date: Tue, 24 Aug 2021 09:50:33 +0200
-Subject: [PATCH] mqtt: clear the leftovers pointer when sending succeeds
-
-CVE-2021-22945
-
-Bug: https://curl.se/docs/CVE-2021-22945.html
----
- lib/mqtt.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/lib/mqtt.c b/lib/mqtt.c
-index f077e6c3dc44..fcd40b41e600 100644
---- a/lib/mqtt.c
-+++ b/lib/mqtt.c
-@@ -128,6 +128,10 @@ static CURLcode mqtt_send(struct Curl_easy *data,
-     mq->sendleftovers = sendleftovers;
-     mq->nsend = nsend;
-   }
-+  else {
-+    mq->sendleftovers = NULL;
-+    mq->nsend = 0;
-+  }
-   return result;
- }
- 

pkgs/tools/networking/curl/default.nix

···
 , idnSupport ? false, libidn ? null
 , ldapSupport ? false, openldap ? null
 , zlibSupport ? true, zlib ? null
-, sslSupport ? zlibSupport, openssl ? null
+, opensslSupport ? zlibSupport, openssl ? null
 , gnutlsSupport ? false, gnutls ? null
 , wolfsslSupport ? false, wolfssl ? null
 , scpSupport ? zlibSupport && !stdenv.isSunOS && !stdenv.isCygwin, libssh2 ? null
···
 assert idnSupport -> libidn != null;
 assert ldapSupport -> openldap != null;
 assert zlibSupport -> zlib != null;
-assert sslSupport -> openssl != null;
-assert !(gnutlsSupport && sslSupport);
+assert opensslSupport -> openssl != null;
+assert !(gnutlsSupport && opensslSupport);
 assert !(gnutlsSupport && wolfsslSupport);
-assert !(sslSupport && wolfsslSupport);
+assert !(opensslSupport && wolfsslSupport);
 assert gnutlsSupport -> gnutls != null;
 assert wolfsslSupport -> wolfssl != null;
 assert scpSupport -> libssh2 != null;
···
 
 stdenv.mkDerivation rec {
   pname = "curl";
-  version = "7.76.1";
+  version = "7.79.1";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/${pname}-${version}.tar.bz2"
       "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] pname}-${version}/${pname}-${version}.tar.bz2"
     ];
-    sha256 = "1scmfrp0c27pkd7yva9k50miprjpsyfbb33apx72qc9igm6ii3ks";
+    sha256 = "0lbq73wz44p4fm2gp05mzrqrzfvhlmvlgfg8c8wkj5lkkamw8qny";
   };
 
   patches = [
-    ./CVE-2021-22897.patch
-    ./CVE-2021-22898.patch
-    ./CVE-2021-22901.patch
-    ./CVE-2021-22945.patch
+    ./7.79.1-darwin-no-systemconfiguration.patch
   ];
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
···
     optional zlibSupport zlib ++
     optional gssSupport libkrb5 ++
     optional c-aresSupport c-ares ++
-    optional sslSupport openssl ++
+    optional opensslSupport openssl ++
     optional gnutlsSupport gnutls ++
     optional wolfsslSupport wolfssl ++
     optional scpSupport libssh2 ++
···
       # The build fails when using wolfssl with --with-ca-fallback
       (lib.withFeature (!wolfsslSupport) "ca-fallback")
       "--disable-manual"
-      (lib.withFeatureAs sslSupport "ssl" openssl.dev)
+      (lib.withFeatureAs opensslSupport "openssl" openssl.dev)
       (lib.withFeatureAs gnutlsSupport "gnutls" gnutls.dev)
       (lib.withFeatureAs scpSupport "libssh2" libssh2.dev)
       (lib.enableFeature ldapSupport "ldap")
···
   '';
 
   passthru = {
-    inherit sslSupport openssl;
+    inherit opensslSupport openssl;
   };
 
   meta = with lib; {

pkgs/tools/networking/mtr/default.nix

···
-{ stdenv, lib, fetchFromGitHub, autoreconfHook, pkg-config
+{ stdenv, lib, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config
 , libcap, ncurses, jansson
 , withGtk ? false, gtk3 }:
 
···
     rev = "v${version}";
     sha256 = "0wnz87cr2lcl74bj8qxq9xgai40az3pk9k0z893scyc8svd61xz6";
   };
+
+  patches = [
+    # pull patch to fix build failure against ncurses-6.3:
+    #  https://github.com/traviscross/mtr/pull/411
+    (fetchpatch {
+      name = "ncurses-6.3.patch";
+      url = "https://github.com/traviscross/mtr/commit/aeb493e08eabcb4e6178bda0bb84e9cd01c9f213.patch";
+      sha256 = "1qk8lf4sha18g36mr84vbdvll2s8khgbzyyq0as3ifx44lv0qlf2";
+    })
+  ];
 
   # we need this before autoreconfHook does its thing
   postPatch = ''

pkgs/tools/networking/unbound/default.nix

···
     "--with-libhiredis=${hiredis}"
   ];
 
-  PROTOC_C = if withDNSTAP then "${protobufc}/bin/protoc-c" else null;
+  PROTOC_C = lib.optionalString withDNSTAP "${protobufc}/bin/protoc-c";
 
   # Remove references to compile-time dependencies that are included in the configure flags
   postConfigure = let

pkgs/tools/package-management/cargo-about/default.nix

···
-{ lib, rustPlatform, fetchFromGitHub, stdenv, libiconv }:
+{ lib, rustPlatform, fetchFromGitHub }:
+
 rustPlatform.buildRustPackage rec {
   pname = "cargo-about";
-  version = "0.3.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "EmbarkStudios";
     repo = "cargo-about";
     rev = version;
-    sha256 = "sha256-MsXNneKj2xCci1guj1TKcIrX7XByJ5/lWUmjxAsgzPY=";
+    sha256 = "sha256-Am0VwF37fYsZvUogxnSlP/kwy20J7maFu3Is8f/1b1E=";
   };
 
-  cargoSha256 = "sha256-ssAmY+o+/2+C9sol+PeFlpNwVuN5JNoofgkr3cUW+S4=";
-
-  buildInputs = lib.optional stdenv.isDarwin libiconv;
+  cargoSha256 = "sha256-gf5OtRGjXmGbnXA4ZYOys6JU+JkF+rYnRSnjy3JE7c0=";
 
   meta = with lib; {
     description = "Cargo plugin to generate list of all licenses for a crate";
     homepage = "https://github.com/EmbarkStudios/cargo-about";
+    changelog = "https://github.com/EmbarkStudios/cargo-about/blob/${version}/CHANGELOG.md";
     license = with licenses; [ mit /* or */ asl20 ];
-    maintainers = with maintainers; [ evanjs ];
+    maintainers = with maintainers; [ evanjs figsoda ];
   };
 }

pkgs/tools/security/ibm-sw-tpm2/default.nix

···
-{ stdenv, fetchurl, lib, openssl }:
+{ stdenv, fetchurl, fetchpatch, lib, openssl }:
 
 stdenv.mkDerivation rec {
   pname = "ibm-sw-tpm2";
···
     url = "mirror://sourceforge/ibmswtpm2/ibmtpm${version}.tar.gz";
     sha256 = "sha256-VRRZKK0rJPNL5qDqz5+0kuEODqkZuEKMch+pcOhdYUc=";
   };
+
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/kgoldman/ibmswtpm2/commit/e6684009aff9c1bad38875e3319c2e02ef791424.patch";
+      sha256 = "1flzlri807c88agmpb0w8xvh5f16mmqv86xw4ic4z272iynzd40j";
+    })
+  ];
+
+  patchFlags = [ "-p2" ];
 
   buildInputs = [ openssl ];
 

pkgs/tools/security/pcsclite/default.nix

···
 , lib
 , fetchurl
 , autoreconfHook
+, autoconf-archive
 , pkg-config
 , perl
 , python3
···
 
 stdenv.mkDerivation rec {
   pname = "pcsclite";
-  version = "1.9.1";
+  version = "1.9.4";
 
   outputs = [ "bin" "out" "dev" "doc" "man" ];
 
   src = fetchurl {
     url = "https://pcsclite.apdu.fr/files/pcsc-lite-${version}.tar.bz2";
-    sha256 = "sha256-c8R4m3h2qDOnD0k82iFlXf6FaJ2bfilwHCQyduVeaDo=";
+    sha256 = "sha256:0jqwnpywk9ka3q88b1k93p8s0xhmx1isdpcqa80nd8p04z1am34a";
   };
 
   patches = [ ./no-dropdir-literals.patch ];
···
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ autoreconfHook pkg-config perl ];
+  nativeBuildInputs = [ autoreconfHook autoconf-archive pkg-config perl ];
 
   buildInputs = [ python3 ]
     ++ lib.optionals stdenv.isLinux [ dbus polkit systemd ]

pkgs/tools/system/kmon/default.nix

···
-{ lib, fetchFromGitHub, rustPlatform, python3, libxcb }:
+{ lib, rustPlatform, fetchFromGitHub, installShellFiles, python3, libxcb }:
 
 rustPlatform.buildRustPackage rec {
   pname = "kmon";
-  version = "1.5.5";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-x4P9p2zXthGtokfKcWR/xaX/E7a9mEuQiK6cjFw4nS8=";
+    sha256 = "sha256-0sjRTbTLtBUTyx6+HnihL9TggoeIOqX9zKRaXjBUfE0=";
   };
 
-  cargoSha256 = "sha256-ZAHp7eR2pu+xEP9NZOLoczEF8QSFA5Z/8bKsCYqk4Ww=";
+  cargoSha256 = "sha256-QMJ3Rpgcfrza2zFiA5LFBuYedn+VnffzpyzAGeC0PSM=";
 
-  nativeBuildInputs = [ python3 ];
+  nativeBuildInputs = [ installShellFiles python3 ];
 
   buildInputs = [ libxcb ];
 
   postInstall = ''
-    install -D man/kmon.8 -t $out/share/man/man8/
+    installManPage man/kmon.8
   '';
 
   meta = with lib; {
     description = "Linux Kernel Manager and Activity Monitor";
     homepage = "https://github.com/orhun/kmon";
-    license = with licenses; [ gpl3 ];
+    changelog = "https://github.com/orhun/kmon/blob/v${version}/CHANGELOG.md";
+    license = licenses.gpl3Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ misuzu ];
+    maintainers = with maintainers; [ figsoda misuzu ];
   };
 }

pkgs/top-level/all-packages.nix

···
   sydbox = callPackage ../os-specific/linux/sydbox { };
 
   synth = callPackage ../tools/misc/synth {
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin.apple_sdk.frameworks) AppKit Security;
   };
 
   syscall_limiter = callPackage ../os-specific/linux/syscall_limiter {};
···
 
   volumeicon = callPackage ../tools/audio/volumeicon { };
 
-  waf = callPackage ../development/tools/build-managers/waf { python = python3; };
+  waf = callPackage ../development/tools/build-managers/waf { };
   wafHook = callPackage ../development/tools/build-managers/wafHook { };
 
   wagyu = callPackage ../tools/misc/wagyu {
···
     stdenv = gcc7Stdenv;
   }));
 
-  llvmPackages_latest = llvmPackages_12;
+  llvmPackages_latest = llvmPackages_13;
 
   llvmPackages_rocm = recurseIntoAttrs (callPackage ../development/compilers/llvm/rocm { });
 
···
     inherit (darwin) apple_sdk;
   };
 
-  rust_1_55 = callPackage ../development/compilers/rust/1_55.nix {
+  rust_1_56 = callPackage ../development/compilers/rust/1_56.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
-    llvm_12 = llvmPackages_12.libllvm;
+    llvm_13 = llvmPackages_13.libllvm;
   };
-  rust = rust_1_55;
+  rust = rust_1_56;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
   mrustc-bootstrap = callPackage ../development/compilers/mrustc/bootstrap.nix { };
 
-  rustPackages_1_55 = rust_1_55.packages.stable;
-  rustPackages = rustPackages_1_55;
+  rustPackages_1_56 = rust_1_56.packages.stable;
+  rustPackages = rustPackages_1_56;
 
   inherit (rustPackages) cargo clippy rustc rustPlatform;
 
···
   inherit (callPackage ../development/interpreters/ruby {
     inherit (darwin) libiconv libobjc libunwind;
     inherit (darwin.apple_sdk.frameworks) Foundation;
-    autoreconfHook = buildPackages.autoreconfHook269;
-    bison = buildPackages.bison_3_5;
   })
     ruby_2_7
     ruby_3_0;
···
   };
 
   bison = callPackage ../development/tools/parsing/bison { };
-
-  # Ruby fails to build with current bison
-  bison_3_5 = bison.overrideAttrs (oldAttrs: rec {
-    version = "3.5.4";
-    src = fetchurl {
-      url = "mirror://gnu/${oldAttrs.pname}/${oldAttrs.pname}-${version}.tar.gz";
-      sha256 = "0a2cbrqh7mgx2dwf5qm10v68iakv1i0dqh9di4x5aqxsz96ibpf0";
-    };
-  });
 
   bisoncpp = callPackage ../development/tools/parsing/bisonc++ { };
 
···
 
   relibc = callPackage ../development/libraries/relibc { };
 
-  # Only supported on Linux, using glibc
-  glibcLocales = if stdenv.hostPlatform.libc == "glibc" then callPackage ../development/libraries/glibc/locales.nix { } else null;
+  # Only supported on Linux
+  glibcLocales = if stdenv.hostPlatform.isLinux then callPackage ../development/libraries/glibc/locales.nix { } else null;
 
   glibcInfo = callPackage ../development/libraries/glibc/info.nix { };
 
···
   } // (lib.optionalAttrs (stdenv.hostPlatform.isi686 && stdenv.cc.isGNU) {
       stdenv = gcc6Stdenv; # with gcc-7: undefined reference to `__divmoddi4'
     }));
+  icu70 = callPackage ../development/libraries/icu/70.nix ({
+    nativeBuildRoot = buildPackages.icu70.override { buildRootOnly = true; };
+  } // (lib.optionalAttrs (stdenv.hostPlatform.isi686 && stdenv.cc.isGNU) {
+      stdenv = gcc6Stdenv; # with gcc-7: undefined reference to `__divmoddi4'
+    }));
 
-  icu = icu69;
+  icu = icu70;
 
   id3lib = callPackage ../development/libraries/id3lib { };
 
···
   };
 
   keybinder3 = callPackage ../development/libraries/keybinder3 {
+    gtk3 = if stdenv.isDarwin then gtk3-x11 else gtk3;
     automake = automake111x;
   };
 
···
 
   prospector = callPackage ../development/tools/prospector { };
 
-  protobuf = protobuf3_18;
+  protobuf = protobuf3_19;
 
+  protobuf3_19 = callPackage ../development/libraries/protobuf/3.19.nix { };
   protobuf3_18 = callPackage ../development/libraries/protobuf/3.18.nix { };
   protobuf3_17 = callPackage ../development/libraries/protobuf/3.17.nix { };
   protobuf3_16 = callPackage ../development/libraries/protobuf/3.16.nix { };
···
 
   lsscsi = callPackage ../os-specific/linux/lsscsi { };
 
-  lvm2 = callPackage ../os-specific/linux/lvm2 {
+  lvm2-2_03 = callPackage ../os-specific/linux/lvm2/2_03.nix {
     # udev is the same package as systemd which depends on cryptsetup
     # which depends on lvm2 again.  But we only need the libudev part
     # which does not depend on cryptsetup.
     udev = systemdMinimal;
   };
-  lvm2_dmeventd = callPackage ../os-specific/linux/lvm2 {
+  lvm2-2_02 = callPackage ../os-specific/linux/lvm2/2_02.nix {
+    udev = systemdMinimal;
+  };
+  lvm2 = if stdenv.targetPlatform.isMusl then lvm2-2_02 else lvm2-2_03;
+
+  lvm2_dmeventd = lvm2.override {
     enableDmeventd = true;
     enableCmdlib = true;
   };
···
   fluidsynth = callPackage ../applications/audio/fluidsynth {
     inherit (darwin.apple_sdk.frameworks) AudioUnit CoreAudio CoreMIDI CoreServices;
   };
-  fluidsynth_1 = fluidsynth.override { version = "1"; };
 
   fmit = libsForQt5.callPackage ../applications/audio/fmit { };
 
···
 
   spotify-unwrapped = callPackage ../applications/audio/spotify {
     curl = curl.override {
-      sslSupport = false; gnutlsSupport = true;
+      opensslSupport = false; gnutlsSupport = true;
     };
   };
 

pkgs/top-level/metrics.nix

···
 
 runCommand "nixpkgs-metrics"
   { nativeBuildInputs = with pkgs.lib; map getBin [ nix time jq ];
-    #FIXME: the job doesn't work, see issue #76776
-    #requiredSystemFeatures = [ "benchmark" ]; # dedicated machine, by @vcunat last time
+    requiredSystemFeatures = [ "benchmark" ]; # dedicated `t2a` machine, by @vcunat
   }
   ''
     export NIX_STORE_DIR=$TMPDIR/store

pkgs/top-level/perl-packages.nix

···
       url = "mirror://cpan/authors/id/S/SH/SHAY/libnet-3.12.tar.gz";
       sha256 = "1px35q9qchzd7rxqldj87vbrall8v31blidhmh0d25d5hyq9lw25";
     };
+    patches = [
+      (fetchpatch {
+        name = "deterministic-libnet.cfg";
+        url = "https://github.com/steve-m-hay/perl-libnet/commit/7d076c4352f67ee4ed64092cfad3963a2321bd53.patch";
+        sha256 = "0pg9w2m08janqn5nrp4x9w5hbcsyxz87hfskd21zzfrzjk8z28qv";
+      })
+    ];
     meta = {
       description = "Collection of network protocol modules";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
···
       url = "mirror://cpan/authors/id/M/MS/MSTPLBG/X11-XCB-0.18.tar.gz";
       sha256 = "1cjpghw7cnackw20lbd7yzm222kz5bnrwz52f8ay24d1f4pwrnxf";
     };
+    patches = [
+      # Pull upstream fix for parallel build failure
+      (fetchpatch {
+        url = "https://github.com/stapelberg/X11-XCB/commit/813608dacdae1ae35c9eb0f171a958617e014520.patch";
+        sha256 = "017f5r4fyryhzgp99lw3csrl21r27hmqv483vp9fdz9xkvrmh743";
+      })
+    ];
     AUTOMATED_TESTING = false;
     buildInputs = [ pkgs.xorg.libxcb pkgs.xorg.xcbproto pkgs.xorg.xcbutil pkgs.xorg.xcbutilwm ExtUtilsDepends ExtUtilsPkgConfig TestDeep TestException XSObjectMagic ];
     propagatedBuildInputs = [ DataDump MouseXNativeTraits XMLDescent XMLSimple ];

pkgs/top-level/python-aliases.nix

···
   qasm2image = throw "qasm2image is no longer maintained (since November 2018), and is not compatible with the latest pythonPackages.qiskit versions."; # added 2020-12-09
   requests_toolbelt = requests-toolbelt; # added 2017-09-26
   rotate-backups = throw "rotate-backups was removed in favor of the top-level rotate-backups"; # added 2021-07-01
+  ruamel_base = ruamel-base; # added 2021-11-01
+  ruamel_yaml = ruamel-yaml; # added 2021-11-01
+  ruamel_yaml_clib = ruamel-yaml-clib; # added 2021-11-01
   scikitlearn = scikit-learn; # added 2021-07-21
   selectors34 = throw "selectors34 has been removed: functionality provided by Python itself; archived by upstream."; # added 2021-06-10
   setuptools_scm = setuptools-scm; # added 2021-06-03

pkgs/top-level/python-packages.nix

···
 
   rtslib = callPackage ../development/python-modules/rtslib { };
 
-  ruamel-base = self.ruamel_base;
-  ruamel_base = callPackage ../development/python-modules/ruamel_base { };
+  ruamel-base = callPackage ../development/python-modules/ruamel-base { };
 
-  ruamel-yaml = self.ruamel_yaml;
-  ruamel_yaml = callPackage ../development/python-modules/ruamel_yaml { };
+  ruamel-yaml = callPackage ../development/python-modules/ruamel-yaml { };
 
-  ruamel-yaml-clib = self.ruamel_yaml_clib;
-  ruamel_yaml_clib = callPackage ../development/python-modules/ruamel_yaml_clib { };
+  ruamel-yaml-clib = callPackage ../development/python-modules/ruamel-yaml-clib { };
 
   rubymarshal = callPackage ../development/python-modules/rubymarshal { };
 
···
 
   zope_testrunner = callPackage ../development/python-modules/zope_testrunner { };
 
-  zopfli = callPackage ../development/python-modules/zopfli { };
+  zopfli = callPackage ../development/python-modules/zopfli {
+    inherit (pkgs) zopfli;
+  };
 
   zstandard = callPackage ../development/python-modules/zstandard { };
 

pkgs/top-level/python2-packages.nix

···
 
   robotframework-ride = callPackage ../development/python-modules/robotframework-ride { };
 
-  ruamel-ordereddict = self.ruamel_ordereddict;
-  ruamel_ordereddict = callPackage ../development/python-modules/ruamel_ordereddict { };
+  ruamel-ordereddict = callPackage ../development/python-modules/ruamel-ordereddict { };
 
-  ruamel_yaml = self.ruamel-yaml;
-  ruamel-yaml = callPackage ../development/python-modules/ruamel_yaml/0.16.nix { };
+  ruamel-yaml = callPackage ../development/python-modules/ruamel-yaml/0.16.nix { };
 
   runsnakerun = callPackage ../development/python-modules/runsnakerun { };