Merge staging-next into staging

pkgs/applications/networking/browsers/qutebrowser/default.nix

···
   buildPythonApplication = if isQt6 then python3Packages.buildPythonApplication else mkDerivationWith python3Packages.buildPythonApplication;
 
   pname = "qutebrowser";
-  version = if isQt6 then "unstable-2023-04-18" else "2.5.3";
+  version = if isQt6 then "unstable-2023-04-18" else "2.5.4";
 in
 
 assert withMediaPlayback -> gst_all_1 != null;
···
   # the release tarballs are different from the git checkout!
    else fetchurl {
     url = "https://github.com/qutebrowser/qutebrowser/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-hF7yJDTQIztUcZJae20HVhfGlLprvz6GWrgpSwLJ14E=";
+    hash = "sha256-pGCyICUn5CpnDCbSJdn6ZBfQkswfFvOpXnvJXdicGrE=";
   };
 
   # Needs tox

pkgs/applications/terminal-emulators/rxvt-unicode/default.nix

···
 { lib, stdenv, fetchurl, fetchpatch, makeDesktopItem
-, libX11, libXt, libXft, libXrender
+, libX11, libXt, libXft, libXrender, libXext
 , ncurses, fontconfig, freetype
 , pkg-config, gdk-pixbuf, perl
 , libptytty
···
 
 let
   pname = "rxvt-unicode";
-  version = "9.30";
+  version = "9.31";
   description = "A clone of the well-known terminal emulator rxvt";
 
   desktopItem = makeDesktopItem {
···
 
   src = fetchurl {
     url = "http://dist.schmorp.de/rxvt-unicode/Attic/rxvt-unicode-${version}.tar.bz2";
-    sha256 = "0badnkjsn3zps24r5iggj8k5v4f00npc77wqg92pcn1q5z8r677y";
+    sha256 = "qqE/y8FJ/g8/OR+TMnlYD3Spb9MS1u0GuP8DwtRmcug=";
   };
 
   nativeBuildInputs = [ pkg-config ];
···
     [ libX11 libXt libXft ncurses  # required to build the terminfo file
       fontconfig freetype libXrender
       libptytty
-    ] ++ optional perlSupport perl
+    ] ++ optionals perlSupport [ perl libXext ]
       ++ optional gdkPixbufSupport gdk-pixbuf;
 
   outputs = [ "out" "terminfo" ];

pkgs/applications/virtualization/qemu/default.nix

···
     + lib.optionalString xenSupport "-xen"
     + lib.optionalString hostCpuOnly "-host-cpu-only"
     + lib.optionalString nixosTestRunner "-for-vm-tests";
-  version = "8.0.0";
+  version = "8.0.2";
 
   src = fetchurl {
     url = "https://download.qemu.org/qemu-${version}.tar.xz";
-    sha256 = "u2DwNBUxGB1sw5ad0ZoBPQQnqH+RgZOXDZrbkRMeVtA=";
+    sha256 = "8GCr1DX75nlBJeLDmFaP/Dz6VABCWWkHqLGO3KNM9qU=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ]

pkgs/development/compilers/ghc/common-hadrian.nix

···
         return $ verbosity >= Verbose
   ''
 
+, ghcSrc ? (if rev != null then fetchgit else fetchurl) ({
+    inherit url sha256;
+  } // lib.optionalAttrs (rev != null) {
+    inherit rev;
+  })
+
+  # GHC's build system hadrian built from the GHC-to-build's source tree
+  # using our bootstrap GHC.
+, hadrian ? bootPkgs.callPackage ../../tools/haskell/hadrian {
+    ghcSrc = ghcSrc;
+    ghcVersion = version;
+    userSettings = hadrianUserSettings;
+  }
+
 , #  Whether to build sphinx documentation.
   enableDocs ? (
     # Docs disabled for musl and cross because it's a large task to keep
···
 assert !enableNativeBignum -> gmp != null;
 
 let
-  src = (if rev != null then fetchgit else fetchurl) ({
-    inherit url sha256;
-  } // lib.optionalAttrs (rev != null) {
-    inherit rev;
-  });
-
   inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
   inherit (bootPkgs) ghc;
···
     ++ lib.optionals targetPlatform.useAndroidPrebuilt [
       "*.*.ghc.c.opts += -optc-std=gnu99"
     ];
-
-  # GHC's build system hadrian built from the GHC-to-build's source tree
-  # using our bootstrap GHC.
-  hadrian = bootPkgs.callPackage ../../tools/haskell/hadrian {
-    ghcSrc = src;
-    ghcVersion = version;
-    userSettings = hadrianUserSettings;
-  };
 
   # Splicer will pull out correct variations
   libDeps = platform: lib.optional enableTerminfo ncurses
···
   pname = "${targetPrefix}ghc${variantSuffix}";
   inherit version;
 
-  inherit src;
+  src = ghcSrc;
 
   enableParallelBuilding = true;
 

pkgs/development/libraries/glfw/3.x.nix

···
 { stdenv, lib, fetchFromGitHub, cmake
 , libGL, libXrandr, libXinerama, libXcursor, libX11, libXi, libXext
-, Cocoa, Kernel, fixDarwinDylibNames
+, Carbon, Cocoa, Kernel, OpenGL, fixDarwinDylibNames
 , waylandSupport ? false, extra-cmake-modules, wayland
 , wayland-protocols, libxkbcommon
 }:
···
   # Fix linkage issues on X11 (https://github.com/NixOS/nixpkgs/issues/142583)
   patches = lib.optional (!waylandSupport) ./x11.patch;
 
-  propagatedBuildInputs = [ libGL ];
+  propagatedBuildInputs = [ (if stdenv.isDarwin then OpenGL else libGL) ];
 
   nativeBuildInputs = [ cmake ]
     ++ lib.optional stdenv.isDarwin fixDarwinDylibNames
···
     if waylandSupport
     then [ wayland wayland-protocols libxkbcommon ]
     else [ libX11 libXrandr libXinerama libXcursor libXi libXext ]
-         ++ lib.optionals stdenv.isDarwin [ Cocoa Kernel ];
+         ++ lib.optionals stdenv.isDarwin [ Carbon Cocoa Kernel ];
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"

pkgs/development/python-modules/ansible/core.nix

···
 { lib
-, callPackage
 , buildPythonPackage
 , fetchPypi
 , installShellFiles
···
 , ncclient
 , packaging
 , paramiko
+, passlib
 , pexpect
 , psutil
 , pycrypto
···
     cryptography
     jinja2
     packaging
+    passlib
     pyyaml
     resolvelib # This library is a PITA, since ansible requires a very old version of it
     # optional dependencies

pkgs/development/python-modules/token-bucket/default.nix

···
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, pytest-runner
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "token-bucket";
   version = "0.3.0";
   format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "falconry";
     repo = pname;
-    rev = version;
-    sha256 = "0a703y2d09kvv2l9vq7vc97l4pi2wwq1f2hq783mbw2238jymb3m";
+    rev = "refs/tags/${version}";
+    hash = "sha256-dazqJRpC8FUHOhgKFzDnIl5CT2L74J2o2Hsm0IQf4Cg=";
   };
 
-  nativeBuildInputs = [
-    pytest-runner
-  ];
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "'pytest-runner'" ""
+  '';
 
   nativeCheckInputs = [
     pytestCheckHook
···
   meta = with lib; {
     description = "Token Bucket Implementation for Python Web Apps";
     homepage = "https://github.com/falconry/token-bucket";
+    changelog = "https://github.com/falconry/token-bucket/releases/tag/${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ hexa ];
   };

pkgs/development/r-modules/default.nix

···
     chebpol = [ pkgs.fftw.dev ];
     ChemmineOB = with pkgs; [ openbabel pkg-config ];
     curl = [ pkgs.curl.dev ];
-    data_table = [ pkgs.zlib.dev ] ++ lib.optional stdenv.isDarwin pkgs.llvmPackages.openmp;
+    data_table = with pkgs; [ pkg-config zlib.dev ] ++ lib.optional stdenv.isDarwin pkgs.llvmPackages.openmp;
     devEMF = with pkgs; [ xorg.libXft.dev ];
     diversitree = with pkgs; [ gsl fftw ];
     exactextractr = [ pkgs.geos ];

pkgs/development/tools/analysis/checkov/default.nix

···
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.3.283";
+  version = "2.3.285";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-2NiDCzbZR82wQeRRTeKLx6FZe25k4wmzACCWNUJG+yI=";
+    hash = "sha256-e451r8md6HOOhEIsjFitQ0IGacQ6bhA/jBFmaz/zVv8=";
   };
 
   patches = [

pkgs/games/minecraft-servers/versions.json

···
 {
+  "1.20": {
+    "url": "https://piston-data.mojang.com/v1/objects/15c777e2cfe0556eef19aab534b186c0c6f277e1/server.jar",
+    "sha1": "15c777e2cfe0556eef19aab534b186c0c6f277e1",
+    "version": "1.20",
+    "javaVersion": 17
+  },
   "1.19": {
     "url": "https://piston-data.mojang.com/v1/objects/8f3112a1049751cc472ec13e397eade5336ca7ae/server.jar",
     "sha1": "8f3112a1049751cc472ec13e397eade5336ca7ae",
···
     "javaVersion": 17
   },
   "1.18": {
-    "url": "https://launcher.mojang.com/v1/objects/c8f83c5655308435b3dcf03c06d9fe8740a77469/server.jar",
+    "url": "https://piston-data.mojang.com/v1/objects/c8f83c5655308435b3dcf03c06d9fe8740a77469/server.jar",
     "sha1": "c8f83c5655308435b3dcf03c06d9fe8740a77469",
     "version": "1.18.2",
     "javaVersion": 17
   },
   "1.17": {
-    "url": "https://launcher.mojang.com/v1/objects/a16d67e5807f57fc4e550299cf20226194497dc2/server.jar",
+    "url": "https://piston-data.mojang.com/v1/objects/a16d67e5807f57fc4e550299cf20226194497dc2/server.jar",
     "sha1": "a16d67e5807f57fc4e550299cf20226194497dc2",
     "version": "1.17.1",
     "javaVersion": 16
   },
   "1.16": {
-    "url": "https://launcher.mojang.com/v1/objects/1b557e7b033b583cd9f66746b7a9ab1ec1673ced/server.jar",
+    "url": "https://piston-data.mojang.com/v1/objects/1b557e7b033b583cd9f66746b7a9ab1ec1673ced/server.jar",
     "sha1": "1b557e7b033b583cd9f66746b7a9ab1ec1673ced",
     "version": "1.16.5",
     "javaVersion": 8
   },
   "1.15": {
-    "url": "https://launcher.mojang.com/v1/objects/bb2b6b1aefcd70dfd1892149ac3a215f6c636b07/server.jar",
+    "url": "https://piston-data.mojang.com/v1/objects/bb2b6b1aefcd70dfd1892149ac3a215f6c636b07/server.jar",
     "sha1": "bb2b6b1aefcd70dfd1892149ac3a215f6c636b07",
     "version": "1.15.2",
     "javaVersion": 8
   },
   "1.14": {
-    "url": "https://launcher.mojang.com/v1/objects/3dc3d84a581f14691199cf6831b71ed1296a9fdf/server.jar",
+    "url": "https://piston-data.mojang.com/v1/objects/3dc3d84a581f14691199cf6831b71ed1296a9fdf/server.jar",
     "sha1": "3dc3d84a581f14691199cf6831b71ed1296a9fdf",
     "version": "1.14.4",
     "javaVersion": 8
   },
   "1.13": {
-    "url": "https://launcher.mojang.com/v1/objects/3737db93722a9e39eeada7c27e7aca28b144ffa7/server.jar",
+    "url": "https://piston-data.mojang.com/v1/objects/3737db93722a9e39eeada7c27e7aca28b144ffa7/server.jar",
     "sha1": "3737db93722a9e39eeada7c27e7aca28b144ffa7",
     "version": "1.13.2",
     "javaVersion": 8
   },
   "1.12": {
-    "url": "https://launcher.mojang.com/v1/objects/886945bfb2b978778c3a0288fd7fab09d315b25f/server.jar",
+    "url": "https://piston-data.mojang.com/v1/objects/886945bfb2b978778c3a0288fd7fab09d315b25f/server.jar",
     "sha1": "886945bfb2b978778c3a0288fd7fab09d315b25f",
     "version": "1.12.2",
     "javaVersion": 8
   },
   "1.11": {
-    "url": "https://launcher.mojang.com/v1/objects/f00c294a1576e03fddcac777c3cf4c7d404c4ba4/server.jar",
+    "url": "https://piston-data.mojang.com/v1/objects/f00c294a1576e03fddcac777c3cf4c7d404c4ba4/server.jar",
     "sha1": "f00c294a1576e03fddcac777c3cf4c7d404c4ba4",
     "version": "1.11.2",
     "javaVersion": 8
   },
   "1.10": {
-    "url": "https://launcher.mojang.com/v1/objects/3d501b23df53c548254f5e3f66492d178a48db63/server.jar",
+    "url": "https://piston-data.mojang.com/v1/objects/3d501b23df53c548254f5e3f66492d178a48db63/server.jar",
     "sha1": "3d501b23df53c548254f5e3f66492d178a48db63",
     "version": "1.10.2",
     "javaVersion": 8
   },
   "1.9": {
-    "url": "https://launcher.mojang.com/v1/objects/edbb7b1758af33d365bf835eb9d13de005b1e274/server.jar",
+    "url": "https://piston-data.mojang.com/v1/objects/edbb7b1758af33d365bf835eb9d13de005b1e274/server.jar",
     "sha1": "edbb7b1758af33d365bf835eb9d13de005b1e274",
     "version": "1.9.4",
     "javaVersion": 8

pkgs/servers/mail/postfix/default.nix

···
 
 in stdenv.mkDerivation rec {
   pname = "postfix";
-  version = "3.8.0";
+  version = "3.8.1";
 
   src = fetchurl {
     url = "http://cdn.postfix.johnriley.me/mirrors/postfix-release/official/${pname}-${version}.tar.gz";
-    hash = "sha256-o62AKb0sawxXZHeg93v50sC3YcuqDvv+9Hlp7+purek=";
+    hash = "sha256-VOG//e0wMoKKcN4iwqGpTRwJf8RRPg/b/P2/O/9rcJI=";
   };
 
   nativeBuildInputs = [ makeWrapper m4 ];

pkgs/servers/monitoring/grafana/default.nix

···
 
 buildGoModule rec {
   pname = "grafana";
-  version = "9.5.2";
+  version = "9.5.3";
 
   excludedPackages = [ "alert_webhook_listener" "clean-swagger" "release_publisher" "slow_proxy" "slow_proxy_mac" "macaron" "devenv" ];
 
···
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    hash = "sha256-4Gt5VwKD6YkxNSKxvfGjakXF4jF9aoaFZ+dXy/GsDaU=";
+    hash = "sha256-b9FkyDEidM7n+eY9IlZT9vysphe4CW5vGXYn9M5BIJM=";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    hash = "sha256-xY600pasxP/+XbbbX4U3zp8R837/46+uJ9zQWva5Or8=";
+    hash = "sha256-PfdRPMQrEaTwg9wWeyJo6I9HuQX6sxl1JbT9CTixnyc=";
   };
 
   vendorHash = "sha256-E9Qdsk691+laPrQQnYBIwxAIbXh7wxB0G2e/Vp+4x98=";

pkgs/tools/misc/rrdtool/default.nix

···
 { fetchurl, lib, stdenv, gettext, perl, pkg-config, libxml2, pango, cairo, groff
-, tcl-8_5, darwin }:
+, tcl, darwin }:
 
 perl.pkgs.toPerlModule (stdenv.mkDerivation rec {
   pname = "rrdtool";
···
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ gettext perl libxml2 pango cairo groff ]
-    ++ lib.optionals stdenv.isDarwin [ tcl-8_5 darwin.apple_sdk.frameworks.ApplicationServices ];
+    ++ lib.optionals stdenv.isDarwin [ tcl darwin.apple_sdk.frameworks.ApplicationServices ];
 
   postInstall = ''
     # for munin and rrdtool support

pkgs/tools/security/aflplusplus/default.nix

···
 { lib, stdenv, stdenvNoCC, fetchFromGitHub, callPackage, makeWrapper
-, clang, llvm, gcc, which, libcgroup, python, perl, gmp
+, clang, llvm, gcc, which, libcgroup, python3, perl, gmp
 , file, wine ? null, fetchpatch
+, cmocka
+, llvmPackages
 }:
 
 # wine fuzzing is only known to work for win32 binaries, and using a mixture of
···
   libtokencap = callPackage ./libtokencap.nix { inherit aflplusplus; };
   aflplusplus = stdenvNoCC.mkDerivation rec {
     pname = "aflplusplus";
-    version = "2.65c";
+    version = "4.06c";
 
     src = fetchFromGitHub {
       owner = "AFLplusplus";
       repo = "AFLplusplus";
       rev = version;
-      sha256 = "1np2a3kypb2m8nyv6qnij18yzn41pl8619jzydci40br4vxial9l";
+      sha256 = "sha256-Gb1nYDBnwLS+m8e1UD0WLIrnp8KRgliGQVvQD22JXrQ=";
     };
     enableParallelBuilding = true;
 
     # Note: libcgroup isn't needed for building, just for the afl-cgroup
     # script.
     nativeBuildInputs = [ makeWrapper which clang gcc ];
-    buildInputs = [ llvm python gmp ]
-      ++ lib.optional (wine != null) python.pkgs.wrapPython;
+    buildInputs = [ llvm python3 gmp llvmPackages.bintools ]
+      ++ lib.optional (wine != null) python3.pkgs.wrapPython;
 
+    # Flag is already set by package and causes some compiler warnings.
+    # warning: "_FORTIFY_SOURCE" redefined
+    hardeningDisable = [ "fortify" ];
 
     postPatch = ''
-      # Replace the CLANG_BIN variables with the correct path
-      substituteInPlace llvm_mode/afl-clang-fast.c \
+      # Don't care about this.
+      rm Android.bp
+
+      # Replace the CLANG_BIN variables with the correct path.
+      # Replace "gcc" and friends with full paths in afl-gcc.
+      # Prevents afl-gcc picking up any (possibly incorrect) gcc from the path.
+      # Replace LLVM_BINDIR with a non-existing path to give a hard error when it's used.
+      substituteInPlace src/afl-cc.c \
         --replace "CLANGPP_BIN" '"${clang}/bin/clang++"' \
         --replace "CLANG_BIN" '"${clang}/bin/clang"' \
-        --replace 'getenv("AFL_PATH")' "(getenv(\"AFL_PATH\") ? getenv(\"AFL_PATH\") : \"$out/lib/afl\")"
-
-      # Replace "gcc" and friends with full paths in afl-gcc
-      # Prevents afl-gcc picking up any (possibly incorrect) gcc from the path
-      substituteInPlace src/afl-gcc.c \
         --replace '"gcc"' '"${gcc}/bin/gcc"' \
         --replace '"g++"' '"${gcc}/bin/g++"' \
-        --replace '"gcj"' '"gcj-UNSUPPORTED"' \
-        --replace '"clang"' '"clang-UNSUPPORTED"' \
-        --replace '"clang++"' '"clang++-UNSUPPORTED"'
+        --replace 'getenv("AFL_PATH")' "(getenv(\"AFL_PATH\") ? getenv(\"AFL_PATH\") : \"$out/lib/afl\")"
+
+      substituteInPlace src/afl-ld-lto.c \
+        --replace 'LLVM_BINDIR' '"/nixpkgs-patched-does-not-exist"'
+
+      # Remove the rest of the line
+      sed -i 's|LLVM_BINDIR = .*|LLVM_BINDIR = |' utils/aflpp_driver/GNUmakefile
+      substituteInPlace utils/aflpp_driver/GNUmakefile \
+        --replace 'LLVM_BINDIR = ' 'LLVM_BINDIR = ${clang}/bin/'
+
+      substituteInPlace GNUmakefile.llvm \
+        --replace "\$(LLVM_BINDIR)/clang" "${clang}/bin/clang"
     '';
 
     env.NIX_CFLAGS_COMPILE = toString [
···
       "-Wno-error=use-after-free"
     ];
 
-    makeFlags = [ "PREFIX=$(out)" ];
+    makeFlags = [
+      "PREFIX=$(out)"
+      "USE_BINDIR=0"
+    ];
     buildPhase = ''
+      runHook preBuild
+
       common="$makeFlags -j$NIX_BUILD_CORES"
-      make all $common
-      make radamsa $common
-      make -C gcc_plugin CC=${gcc}/bin/gcc CXX=${gcc}/bin/g++ $common
-      make -C llvm_mode $common
+      make distrib $common
       make -C qemu_mode/libcompcov $common
       make -C qemu_mode/unsigaction $common
+
+      runHook postBuild
     '';
 
     postInstall = ''
···
       cp qemu_mode/unsigaction/unsigaction*.so $out/lib/afl/
 
       # Install the custom QEMU emulator for binary blob fuzzing.
-      cp ${aflplusplus-qemu}/bin/${qemu-exe-name} $out/bin/afl-qemu-trace
+      ln -s ${aflplusplus-qemu}/bin/${qemu-exe-name} $out/bin/afl-qemu-trace
 
       # give user a convenient way of accessing libcompconv.so, libdislocator.so, libtokencap.so
       cat > $out/bin/get-afl-qemu-libcompcov-so <<END
···
       echo $out/lib/afl/libcompcov.so
       END
       chmod +x $out/bin/get-afl-qemu-libcompcov-so
-      cp ${libdislocator}/bin/get-libdislocator-so $out/bin/
-      cp ${libtokencap}/bin/get-libtokencap-so $out/bin/
+      ln -s ${libdislocator}/bin/get-libdislocator-so $out/bin/
+      ln -s ${libtokencap}/bin/get-libtokencap-so $out/bin/
 
       # Install the cgroups wrapper for asan-based fuzzing.
-      cp examples/asan_cgroups/limit_memory.sh $out/bin/afl-cgroup
+      cp utils/asan_cgroups/limit_memory.sh $out/bin/afl-cgroup
       chmod +x $out/bin/afl-cgroup
       substituteInPlace $out/bin/afl-cgroup \
         --replace "cgcreate" "${libcgroup}/bin/cgcreate" \
···
         if [ -x $winePath ]; then break; fi
       done
       makeWrapperArgs="--set-default 'AFL_WINE_PATH' '$winePath'" \
-        wrapPythonProgramsIn $out/bin ${python.pkgs.pefile}
+        wrapPythonProgramsIn $out/bin ${python3.pkgs.pefile}
     '';
 
-    nativeInstallCheckInputs = [ perl file ];
+    nativeInstallCheckInputs = [ perl file cmocka ];
     doInstallCheck = true;
     installCheckPhase = ''
+      runHook preInstallCheck
+
       # replace references to tools in build directory with references to installed locations
-      substituteInPlace test/test.sh \
+      substituteInPlace test/test-qemu-mode.sh \
         --replace '../libcompcov.so' '`$out/bin/get-afl-qemu-libcompcov-so`' \
+        --replace '../afl-qemu-trace' '$out/bin/afl-qemu-trace' \
+        --replace '../afl-fuzz' '$out/bin/afl-fuzz' \
+        --replace '../qemu_mode/unsigaction/unsigaction32.so' '$out/lib/afl/unsigaction32.so' \
+        --replace '../qemu_mode/unsigaction/unsigaction64.so' '$out/lib/afl/unsigaction64.so'
+
+      substituteInPlace test/test-libextensions.sh \
         --replace '../libdislocator.so' '`$out/bin/get-libdislocator-so`' \
         --replace '../libtokencap.so' '`$out/bin/get-libtokencap-so`'
-      perl -pi -e 's|(?<!\.)(?<!-I)(\.\./)([^\s\/]+?)(?<!\.c)(?<!\.s?o)(?=\s)|\$out/bin/\2|g' test/test.sh
-      cd test && ./test.sh
+      substituteInPlace test/test-llvm.sh \
+        --replace '../afl-cmin.bash' '`$out/bin/afl-cmin.bash`'
+      # perl -pi -e 's|(?<!\.)(?<!-I)(\.\./)([^\s\/]+?)(?<!\.c)(?<!\.s?o)(?=\s)|\$out/bin/\2|g' test/test.sh
+      patchShebangs .
+      cd test && ./test-all.sh
+
+      runHook postInstallCheck
     '';
 
     passthru = {

pkgs/tools/security/aflplusplus/libdislocator.nix

···
 
   src = aflplusplus.src;
   postUnpack = "chmod -R +w ${aflplusplus.src.name}";
-  sourceRoot = "${aflplusplus.src.name}/libdislocator";
+  sourceRoot = "${aflplusplus.src.name}/utils/libdislocator";
 
   makeFlags = [ "PREFIX=$(out)" ];
 
   preInstall = ''
     mkdir -p $out/lib/afl
-    # issue is fixed upstream: https://github.com/AFLplusplus/AFLplusplus/commit/2a60ceb6944a7ca273057ddf64dcf837bf7f9521
-    sed -i 's/README\.dislocator\.md/README\.md/g' Makefile
   '';
+
   postInstall = ''
     mkdir $out/bin
     cat > $out/bin/get-libdislocator-so <<END

pkgs/tools/security/aflplusplus/libtokencap.nix

···
 
   src = aflplusplus.src;
   postUnpack = "chmod -R +w ${aflplusplus.src.name}";
-  sourceRoot = "${aflplusplus.src.name}/libtokencap";
+  sourceRoot = "${aflplusplus.src.name}/utils/libtokencap";
 
   makeFlags = [ "PREFIX=$(out)" ];
 
···
   '';
 
   meta = with lib; {
-    homepage = "https://github.com/vanhauser-thc/AFLplusplus";
+    homepage = "https://github.com/AFLplusplus/AFLplusplus";
     description = "strcmp & memcmp token capture library";
     license = lib.licenses.asl20;
     maintainers = with maintainers; [ ris ];

pkgs/tools/security/aflplusplus/qemu.nix

···
-{ lib, stdenv, fetchurl, aflplusplus, python3, zlib, pkg-config, glib, perl
-, texinfo, libuuid, flex, bison, pixman, autoconf
+{ lib
+, stdenv
+, fetchurl
+, aflplusplus
+, python3
+, zlib
+, pkg-config
+, glib
+, perl
+, texinfo
+, libuuid
+, flex
+, bison
+, pixman
+, meson
+, fetchFromGitHub
+, ninja
 }:
 
 let
-  qemuName = "qemu-3.1.0";
-  cpuTarget = if stdenv.targetPlatform.system == "x86_64-linux" then "x86_64-linux-user"
+  qemuName = "qemu-5.2.50";
+  cpuTarget =
+    if stdenv.targetPlatform.system == "x86_64-linux" then "x86_64-linux-user"
     else if stdenv.targetPlatform.system == "i686-linux" then "i386-linux-user"
     else throw "aflplusplus: no support for ${stdenv.targetPlatform.system}!";
 in
 stdenv.mkDerivation {
   name = "aflplusplus-${qemuName}";
 
-  srcs = [
-    (fetchurl {
-      url = "http://wiki.qemu.org/download/${qemuName}.tar.bz2";
-      sha256 = "08frr1fdjx8qcfh3fafn10kibdwbvkqqvfl7hpqbm7i9dg4f1zlq";
-    })
-    aflplusplus.src
-  ];
-
-  sourceRoot = qemuName;
-
-  postUnpack = ''
-    chmod -R +w ${aflplusplus.src.name}
-    for f in ${aflplusplus.src.name}/qemu_mode/patches/* ; do
-      sed -E -i 's|(\.\./)+patches/([a-z-]+\.h)|\2|g' $f
-      sed -E -i 's|\.\./\.\./config\.h|afl-config.h|g' $f
-      sed -E -i 's|\.\./\.\./include/cmplog\.h|afl-cmplog.h|g' $f
-    done
-    cp ${aflplusplus.src.name}/qemu_mode/patches/*.h $sourceRoot/
-    cp ${aflplusplus.src.name}/types.h $sourceRoot/afl-types.h
-    substitute ${aflplusplus.src.name}/config.h $sourceRoot/afl-config.h \
-      --replace "types.h" "afl-types.h"
-    substitute ${aflplusplus.src.name}/include/cmplog.h $sourceRoot/afl-cmplog.h \
-      --replace "config.h" "afl-config.h" \
-      --replace "forkserver.h" "afl-forkserver.h"
-    substitute ${aflplusplus.src.name}/include/forkserver.h $sourceRoot/afl-forkserver.h \
-      --replace "types.h" "afl-types.h"
-
-    cat ${aflplusplus.src.name}/qemu_mode/patches/*.diff > all.patch
-  '';
+  src = fetchFromGitHub {
+    owner = "AFLplusplus";
+    repo = "qemuafl";
+    rev = "0569eff8a12dec73642b96757f6b5b51a618a03a";
+    sha256 = "sha256-nYWHyRfOH2p9znRxjxsiyw11uZuMBiuJfEc7FHM5X7M=";
+    fetchSubmodules = true;
+  };
 
   nativeBuildInputs = [
-    python3 perl pkg-config flex bison autoconf texinfo
+    python3
+    perl
+    pkg-config
+    flex
+    bison
+    meson
+    texinfo
+    ninja
   ];
 
   buildInputs = [
-    zlib glib pixman libuuid
+    zlib
+    glib
+    pixman
+    libuuid
   ];
 
   enableParallelBuilding = true;
 
-  patches = [
-    # patches extracted from aflplusplus source
-    "../all.patch"
-    # nix-specific patches to make installation more well-behaved
-    ./qemu-no-etc-install.patch
-  ];
+  dontUseMesonConfigure = true; # meson's configurePhase isn't compatible with qemu build
+  preBuild = "cd build";
+  preConfigure = ''
+    # this script isn't marked as executable b/c it's indirectly used by meson. Needed to patch its shebang
+    chmod +x ./scripts/shaderinclude.pl
+    patchShebangs .
+  '';
 
   configureFlags =
-    [ "--disable-system"
+    [
+      "--target-list=${stdenv.hostPlatform.uname.processor}-linux-user"
+      "--sysconfdir=/etc"
+      "--localstatedir=/var"
+      "--meson=meson"
+      "--disable-system"
       "--enable-linux-user"
+      "--enable-pie"
+      "--audio-drv-list="
+      "--disable-blobs"
+      "--disable-bochs"
+      "--disable-brlapi"
+      "--disable-bsd-user"
+      "--disable-bzip2"
+      "--disable-cap-ng"
+      "--disable-cloop"
+      "--disable-curl"
+      "--disable-curses"
+      "--disable-dmg"
+      "--disable-fdt"
+      "--disable-gcrypt"
+      "--disable-glusterfs"
+      "--disable-gnutls"
       "--disable-gtk"
+      "--disable-guest-agent"
+      "--disable-iconv"
+      "--disable-libiscsi"
+      "--disable-libnfs"
+      "--disable-libssh"
+      "--disable-libusb"
+      "--disable-linux-aio"
+      "--disable-live-block-migration"
+      "--disable-lzo"
+      "--disable-nettle"
+      "--disable-numa"
+      "--disable-opengl"
+      "--disable-parallels"
+      "--disable-plugins"
+      "--disable-qcow1"
+      "--disable-qed"
+      "--disable-rbd"
+      "--disable-rdma"
+      "--disable-replication"
       "--disable-sdl"
+      "--disable-seccomp"
+      "--disable-sheepdog"
+      "--disable-smartcard"
+      "--disable-snappy"
+      "--disable-spice"
+      "--disable-system"
+      "--disable-tools"
+      "--disable-tpm"
+      "--disable-usb-redir"
+      "--disable-vde"
+      "--disable-vdi"
+      "--disable-vhost-crypto"
+      "--disable-vhost-kernel"
+      "--disable-vhost-net"
+      "--disable-vhost-scsi"
+      "--disable-vhost-user"
+      "--disable-vhost-vdpa"
+      "--disable-vhost-vsock"
+      "--disable-virglrenderer"
+      "--disable-virtfs"
       "--disable-vnc"
-      "--disable-kvm"
-      "--target-list=${cpuTarget}"
-      "--enable-pie"
-      "--sysconfdir=/etc"
-      "--localstatedir=/var"
+      "--disable-vnc-jpeg"
+      "--disable-vnc-png"
+      "--disable-vnc-sasl"
+      "--disable-vte"
+      "--disable-vvfat"
+      "--disable-xen"
+      "--disable-xen-pci-passthrough"
+      "--disable-xfsctl"
+      "--without-default-devices"
     ];
 
   meta = with lib; {
-    homepage = "https://www.qemu.org/";
+    homepage = "https://github.com/AFLplusplus/qemuafl";
     description = "Fork of QEMU with AFL++ instrumentation support";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ ris ];

pkgs/tools/text/dirdiff/default.nix

···
     done
   '';
 
+  env = {
+    NIX_CFLAGS_COMPILE = "-DUSE_INTERP_RESULT";
+    NIX_LDFLAGS = "-ltcl";
+  };
+
   # If we don't create the directories ourselves, then 'make install' creates
   # files named 'bin' and 'lib'.
   preInstall = ''
···
     homepage = "https://www.samba.org/ftp/paulus/";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ khumba ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }

pkgs/top-level/all-packages.nix

···
   };
 
   aflplusplus = callPackage ../tools/security/aflplusplus {
-    clang = clang_9;
-    llvm = llvm_9;
-    python = python3;
+    clang = clang_15;
+    llvm = llvm_15;
+    llvmPackages = llvmPackages_15;
     wine = null;
   };
 
···
 
   dsp = callPackage ../tools/audio/dsp { };
 
-  dirdiff = callPackage ../tools/text/dirdiff {
-    tcl = tcl-8_5;
-    tk = tk-8_5;
-  };
+  dirdiff = callPackage ../tools/text/dirdiff { };
 
   dwdiff = callPackage ../applications/misc/dwdiff { };
 
···
   };
   glfw2 = callPackage ../development/libraries/glfw/2.x.nix { };
   glfw3 = callPackage ../development/libraries/glfw/3.x.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa Kernel;
+    inherit (darwin.apple_sdk.frameworks) Carbon Cocoa Kernel OpenGL;
   };
 
   glibc = callPackage ../development/libraries/glibc {
···
 
   alot = callPackage ../applications/networking/mailreaders/alot { };
 
-  alpine = callPackage ../applications/networking/mailreaders/alpine {
-    tcl = tcl-8_5;
-  };
+  alpine = callPackage ../applications/networking/mailreaders/alpine { };
 
   msgviewer = callPackage ../applications/networking/mailreaders/msgviewer { };