Merge branch 'staging' into staging-next

doc/stdenv/stdenv.chapter.md

@@ -731,6 +731,10 @@ If set, files in `$out/sbin` are not moved to `$out/bin`. By default, they are.
 
 List of directories to search for libraries and executables from which *all* symbols should be stripped. By default, it’s empty. Stripping all symbols is risky, since it may remove not just debug symbols but also ELF information necessary for normal execution.
 
+##### `stripAllListTarget` {#var-stdenv-stripAllListTarget}
+
+Like `stripAllList`, but only applies to packages’ target platform. By default, it’s empty. Useful when supporting cross compilation.
+
 ##### `stripAllFlags` {#var-stdenv-stripAllFlags}
 
 Flags passed to the `strip` command applied to the files in the directories listed in `stripAllList`. Defaults to `-s` (i.e. `--strip-all`).
@@ -739,6 +743,10 @@ Flags passed to the `strip` command applied to the files in the directories list
 
 List of directories to search for libraries and executables from which only debugging-related symbols should be stripped. It defaults to `lib lib32 lib64 libexec bin sbin`.
 
+##### `stripDebugListTarget` {#var-stdenv-stripDebugListTarget}
+
+Like `stripDebugList`, but only applies to packages’ target platform. By default, it’s empty. Useful when supporting cross compilation.
+
 ##### `stripDebugFlags` {#var-stdenv-stripDebugFlags}
 
 Flags passed to the `strip` command applied to the files in the directories listed in `stripDebugList`. Defaults to `-S` (i.e. `--strip-debug`).
@@ -913,9 +921,9 @@ substitute ./foo.in ./foo.out \
     --subst-var someVar
 ```
 
-### `substituteInPlace` \<file\> \<subs\> {#fun-substituteInPlace}
+### `substituteInPlace` \<multiple files\> \<subs\> {#fun-substituteInPlace}
 
-Like `substitute`, but performs the substitutions in place on the file \<file\>.
+Like `substitute`, but performs the substitutions in place on the files passed.
 
 ### `substituteAll` \<infile\> \<outfile\> {#fun-substituteAll}
 

nixos/modules/services/databases/openldap.nix

@@ -3,7 +3,6 @@
 with lib;
 let
   cfg = config.services.openldap;
-  legacyOptions = [ "rootpwFile" "suffix" "dataDir" "rootdn" "rootpw" ];
   openldap = cfg.package;
   configDir = if cfg.configDir != null then cfg.configDir else "/etc/openldap/slapd.d";
 
@@ -11,7 +10,15 @@ let
     # Can't do types.either with multiple non-overlapping submodules, so define our own
     singleLdapValueType = lib.mkOptionType rec {
       name = "LDAP";
-      description = "LDAP value";
+      # TODO: It would be nice to define a { secret = ...; } option, using
+      # systemd's LoadCredentials for secrets. That would remove the last
+      # barrier to using DynamicUser for openldap. This is blocked on
+      # systemd/systemd#19604
+      description = ''
+        LDAP value - either a string, or an attrset containing
+        <literal>path</literal> or <literal>base64</literal> for included
+        values or base-64 encoded values respectively.
+      '';
       check = x: lib.isString x || (lib.isAttrs x && (x ? path || x ? base64));
       merge = lib.mergeEqualOption;
     };
@@ -76,52 +83,12 @@ let
     lib.flatten (lib.mapAttrsToList (name: value: attrsToLdif "${name},${dn}" value) children)
   );
 in {
-  imports = let
-    deprecationNote = "This option is removed due to the deprecation of `slapd.conf` upstream. Please migrate to `services.openldap.settings`, see the release notes for advice with this process.";
-    mkDatabaseOption = old: new:
-      lib.mkChangedOptionModule [ "services" "openldap" old ] [ "services" "openldap" "settings" "children" ]
-        (config: let
-          database = lib.getAttrFromPath [ "services" "openldap" "database" ] config;
-          value = lib.getAttrFromPath [ "services" "openldap" old ] config;
-        in lib.setAttrByPath ([ "olcDatabase={1}${database}" "attrs" ] ++ new) value);
-  in [
-    (lib.mkRemovedOptionModule [ "services" "openldap" "extraConfig" ] deprecationNote)
-    (lib.mkRemovedOptionModule [ "services" "openldap" "extraDatabaseConfig" ] deprecationNote)
-
-    (lib.mkChangedOptionModule [ "services" "openldap" "logLevel" ] [ "services" "openldap" "settings" "attrs" "olcLogLevel" ]
-      (config: lib.splitString " " (lib.getAttrFromPath [ "services" "openldap" "logLevel" ] config)))
-    (lib.mkChangedOptionModule [ "services" "openldap" "defaultSchemas" ] [ "services" "openldap" "settings" "children" "cn=schema" "includes"]
-      (config: lib.optionals (lib.getAttrFromPath [ "services" "openldap" "defaultSchemas" ] config) (
-        map (schema: "${openldap}/etc/schema/${schema}.ldif") [ "core" "cosine" "inetorgperson" "nis" ])))
-
-    (lib.mkChangedOptionModule [ "services" "openldap" "database" ] [ "services" "openldap" "settings" "children" ]
-      (config: let
-        database = lib.getAttrFromPath [ "services" "openldap" "database" ] config;
-      in {
-        "olcDatabase={1}${database}".attrs = {
-          # objectClass is case-insensitive, so don't need to capitalize ${database}
-          objectClass = [ "olcdatabaseconfig" "olc${database}config" ];
-          olcDatabase = "{1}${database}";
-          olcDbDirectory = lib.mkDefault "/var/db/openldap";
-        };
-        "cn=schema".includes = lib.mkDefault (
-          map (schema: "${openldap}/etc/schema/${schema}.ldif") [ "core" "cosine" "inetorgperson" "nis" ]
-        );
-      }))
-    (mkDatabaseOption "rootpwFile" [ "olcRootPW" "path" ])
-    (mkDatabaseOption "suffix" [ "olcSuffix" ])
-    (mkDatabaseOption "dataDir" [ "olcDbDirectory" ])
-    (mkDatabaseOption "rootdn" [ "olcRootDN" ])
-    (mkDatabaseOption "rootpw" [ "olcRootPW" ])
-  ];
   options = {
     services.openldap = {
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "
-          Whether to enable the ldap server.
-        ";
+        description = "Whether to enable the ldap server.";
       };
 
       package = mkOption {
@@ -186,7 +153,7 @@ in {
                 attrs = {
                   objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
                   olcDatabase = "{1}mdb";
-                  olcDbDirectory = "/var/db/ldap";
+                  olcDbDirectory = "/var/lib/openldap/ldap";
                   olcDbIndex = [
                     "objectClass eq"
                     "cn pres,eq"
@@ -208,10 +175,20 @@ in {
         default = null;
         description = ''
           Use this config directory instead of generating one from the
-          <literal>settings</literal> option. Overrides all NixOS settings. If
-          you use this option,ensure `olcPidFile` is set to `/run/slapd/slapd.conf`.
+          <literal>settings</literal> option. Overrides all NixOS settings.
+        '';
+        example = "/var/lib/openldap/slapd.d";
+      };
+
+      mutableConfig = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to allow writable on-line configuration. If
+          <literal>true</literal>, the NixOS settings will only be used to
+          initialize the OpenLDAP configuration if it does not exist, and are
+          subsequently ignored.
         '';
-        example = "/var/db/slapd.d";
       };
 
       declarativeContents = mkOption {
@@ -225,6 +202,11 @@ in {
           reboot of the server. Performance-wise the database and indexes are
           rebuilt on each server startup, so this will slow down server startup,
           especially with large databases.
+
+          Note that the root of the DB must be defined in
+          <code>services.openldap.settings</code> and the
+          <code>olcDbDirectory</code> must begin with
+          <literal>"/var/lib/openldap"</literal>.
         '';
         example = lib.literalExpression ''
           {
@@ -247,11 +229,54 @@ in {
 
   meta.maintainers = with lib.maintainers; [ kwohlfahrt ];
 
-  config = mkIf cfg.enable {
-    assertions = map (opt: {
-      assertion = ((getAttr opt cfg) != "_mkMergedOptionModule") -> (cfg.database != "_mkMergedOptionModule");
-      message = "Legacy OpenLDAP option `services.openldap.${opt}` requires `services.openldap.database` (use value \"mdb\" if unsure)";
-    }) legacyOptions;
+  config = let
+    dbSettings = mapAttrs' (name: { attrs, ... }: nameValuePair attrs.olcSuffix attrs)
+      (filterAttrs (name: { attrs, ... }: (hasPrefix "olcDatabase=" name) && attrs ? olcSuffix) cfg.settings.children);
+    settingsFile = pkgs.writeText "config.ldif" (lib.concatStringsSep "\n" (attrsToLdif "cn=config" cfg.settings));
+    writeConfig = pkgs.writeShellScript "openldap-config" ''
+      set -euo pipefail
+
+      ${lib.optionalString (!cfg.mutableConfig) ''
+        chmod -R u+w ${configDir}
+        rm -rf ${configDir}/*
+      ''}
+      if [ ! -e "${configDir}/cn=config.ldif" ]; then
+        ${openldap}/bin/slapadd -F ${configDir} -bcn=config -l ${settingsFile}
+      fi
+      chmod -R ${if cfg.mutableConfig then "u+rw" else "u+r-w"} ${configDir}
+    '';
+
+    contentsFiles = mapAttrs (dn: ldif: pkgs.writeText "${dn}.ldif" ldif) cfg.declarativeContents;
+    writeContents = pkgs.writeShellScript "openldap-load" ''
+      set -euo pipefail
+
+      rm -rf $2/*
+      ${openldap}/bin/slapadd -F ${configDir} -b $1 -l $3
+    '';
+  in mkIf cfg.enable {
+    assertions = [{
+      assertion = (cfg.declarativeContents != {}) -> cfg.configDir == null;
+      message = ''
+        Declarative DB contents (${attrNames cfg.declarativeContents}) are not
+        supported with user-managed configuration.
+      '';
+    }] ++ (map (dn: {
+      assertion = (getAttr dn dbSettings) ? "olcDbDirectory";
+      # olcDbDirectory is necessary to prepopulate database using `slapadd`.
+      message = ''
+        Declarative DB ${dn} does not exist in `services.openldap.settings`, or does not have
+        `olcDbDirectory` configured.
+      '';
+    }) (attrNames cfg.declarativeContents)) ++ (mapAttrsToList (dn: { olcDbDirectory ? null, ... }: {
+      # For forward compatibility with `DynamicUser`, and to avoid accidentally clobbering
+      # directories with `declarativeContents`.
+      assertion = (olcDbDirectory != null) ->
+      ((hasPrefix "/var/lib/openldap/" olcDbDirectory) && (olcDbDirectory != "/var/lib/openldap/"));
+      message = ''
+        Database ${dn} has `olcDbDirectory` (${olcDbDirectory}) that is not a subdirectory of
+        `/var/lib/openldap/`.
+      '';
+    }) dbSettings);
     environment.systemPackages = [ openldap ];
 
     # Literal attributes must always be set
@@ -259,7 +284,6 @@ in {
       attrs = {
         objectClass = "olcGlobal";
         cn = "config";
-        olcPidFile = "/run/slapd/slapd.pid";
       };
       children."cn=schema".attrs = {
         cn = "schema";
@@ -276,44 +300,31 @@ in {
       ];
       wantedBy = [ "multi-user.target" ];
       after = [ "network-online.target" ];
-      preStart = let
-        settingsFile = pkgs.writeText "config.ldif" (lib.concatStringsSep "\n" (attrsToLdif "cn=config" cfg.settings));
-
-        dbSettings = lib.filterAttrs (name: value: lib.hasPrefix "olcDatabase=" name) cfg.settings.children;
-        dataDirs = lib.mapAttrs' (name: value: lib.nameValuePair value.attrs.olcSuffix value.attrs.olcDbDirectory)
-          (lib.filterAttrs (_: value: value.attrs ? olcDbDirectory) dbSettings);
-        dataFiles = lib.mapAttrs (dn: contents: pkgs.writeText "${dn}.ldif" contents) cfg.declarativeContents;
-        mkLoadScript = dn: let
-          dataDir = lib.escapeShellArg (getAttr dn dataDirs);
-        in  ''
-          rm -rf ${dataDir}/*
-          ${openldap}/bin/slapadd -F ${lib.escapeShellArg configDir} -b ${dn} -l ${getAttr dn dataFiles}
-          chown -R "${cfg.user}:${cfg.group}" ${dataDir}
-        '';
-      in ''
-        mkdir -p /run/slapd
-        chown -R "${cfg.user}:${cfg.group}" /run/slapd
-
-        mkdir -p ${lib.escapeShellArg configDir} ${lib.escapeShellArgs (lib.attrValues dataDirs)}
-        chown "${cfg.user}:${cfg.group}" ${lib.escapeShellArg configDir} ${lib.escapeShellArgs (lib.attrValues dataDirs)}
-
-        ${lib.optionalString (cfg.configDir == null) (''
-          rm -Rf ${configDir}/*
-          ${openldap}/bin/slapadd -F ${configDir} -bcn=config -l ${settingsFile}
-        '')}
-        chown -R "${cfg.user}:${cfg.group}" ${lib.escapeShellArg configDir}
-
-        ${lib.concatStrings (map mkLoadScript (lib.attrNames cfg.declarativeContents))}
-        ${openldap}/bin/slaptest -u -F ${lib.escapeShellArg configDir}
-      '';
       serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStartPre = [
+          "!${pkgs.coreutils}/bin/mkdir -p ${configDir}"
+          "+${pkgs.coreutils}/bin/chown $USER ${configDir}"
+        ] ++ (lib.optional (cfg.configDir == null) writeConfig)
+        ++ (mapAttrsToList (dn: content: lib.escapeShellArgs [
+          writeContents dn (getAttr dn dbSettings).olcDbDirectory content
+        ]) contentsFiles)
+        ++ [ "${openldap}/bin/slaptest -u -F ${configDir}" ];
         ExecStart = lib.escapeShellArgs ([
-          "${openldap}/libexec/slapd" "-u" cfg.user "-g" cfg.group "-F" configDir
-          "-h" (lib.concatStringsSep " " cfg.urlList)
+          "${openldap}/libexec/slapd" "-d" "0" "-F" configDir "-h" (lib.concatStringsSep " " cfg.urlList)
         ]);
         Type = "notify";
+        # Fixes an error where openldap attempts to notify from a thread
+        # outside the main process:
+        #   Got notification message from PID 6378, but reception only permitted for main PID 6377
         NotifyAccess = "all";
-        PIDFile = cfg.settings.attrs.olcPidFile;
+        RuntimeDirectory = "openldap";
+        StateDirectory = ["openldap"]
+          ++ (map ({olcDbDirectory, ... }: removePrefix "/var/lib/" olcDbDirectory) (attrValues dbSettings));
+        StateDirectoryMode = "700";
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
       };
     };
 

nixos/modules/system/boot/systemd.nix

@@ -592,6 +592,12 @@ in
     systemd.services.systemd-importd.environment = proxy_env;
     systemd.services.systemd-pstore.wantedBy = [ "sysinit.target" ]; # see #81138
 
+    # NixOS has kernel modules in a different location, so override that here.
+    systemd.services.kmod-static-nodes.unitConfig.ConditionFileNotEmpty = [
+      ""  # required to unset the previous value!
+      "/run/booted-system/kernel-modules/lib/modules/%v/modules.devname"
+    ];
+
     # Don't bother with certain units in containers.
     systemd.services.systemd-remount-fs.unitConfig.ConditionVirtualization = "!container";
     systemd.services.systemd-random-seed.unitConfig.ConditionVirtualization = "!container";

nixos/modules/system/boot/systemd/initrd.nix

@@ -420,6 +420,9 @@ in {
       services."systemd-makefs@" = lib.mkIf needMakefs { unitConfig.IgnoreOnIsolate = true; };
       services."systemd-growfs@" = lib.mkIf needGrowfs { unitConfig.IgnoreOnIsolate = true; };
 
+      # make sure all the /dev nodes are set up
+      services.systemd-tmpfiles-setup-dev.wantedBy = ["sysinit.target"];
+
       services.initrd-nixos-activation = {
         after = [ "initrd-fs.target" ];
         requiredBy = [ "initrd.target" ];

nixos/tests/openldap.nix

@@ -1,9 +1,4 @@
-{ pkgs ? (import ../.. { inherit system; config = { }; })
-, system ? builtins.currentSystem
-, ...
-}:
-
-let
+import ./make-test-python.nix ({ pkgs, ... }: let
   dbContents = ''
     dn: dc=example
     objectClass: domain
@@ -13,118 +8,149 @@ let
     objectClass: organizationalUnit
     ou: users
   '';
-  testScript = ''
-    machine.wait_for_unit("openldap.service")
-    machine.succeed(
-        'ldapsearch -LLL -D "cn=root,dc=example" -w notapassword -b "dc=example"',
-    )
-  '';
-in {
-  # New-style configuration
-  current = import ./make-test-python.nix ({ pkgs, ... }: {
-    inherit testScript;
-    name = "openldap";
 
-    nodes.machine = { pkgs, ... }: {
-      environment.etc."openldap/root_password".text = "notapassword";
-      services.openldap = {
-        enable = true;
-        settings = {
-          children = {
-            "cn=schema".includes = [
-              "${pkgs.openldap}/etc/schema/core.ldif"
-              "${pkgs.openldap}/etc/schema/cosine.ldif"
-              "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
-              "${pkgs.openldap}/etc/schema/nis.ldif"
-            ];
-            "olcDatabase={1}mdb" = {
-              # This tests string, base64 and path values, as well as lists of string values
-              attrs = {
-                objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
-                olcDatabase = "{1}mdb";
-                olcDbDirectory = "/var/db/openldap";
-                olcSuffix = "dc=example";
-                olcRootDN = {
-                  # cn=root,dc=example
-                  base64 = "Y249cm9vdCxkYz1leGFtcGxl";
-                };
-                olcRootPW = {
-                  path = "/etc/openldap/root_password";
-                };
+  ldifConfig = ''
+    dn: cn=config
+    cn: config
+    objectClass: olcGlobal
+    olcLogLevel: stats
+
+    dn: cn=schema,cn=config
+    cn: schema
+    objectClass: olcSchemaConfig
+
+    include: file://${pkgs.openldap}/etc/schema/core.ldif
+    include: file://${pkgs.openldap}/etc/schema/cosine.ldif
+    include: file://${pkgs.openldap}/etc/schema/inetorgperson.ldif
+
+    dn: olcDatabase={0}config,cn=config
+    olcDatabase: {0}config
+    objectClass: olcDatabaseConfig
+    olcRootDN: cn=root,cn=config
+    olcRootPW: configpassword
+
+    dn: olcDatabase={1}mdb,cn=config
+    objectClass: olcDatabaseConfig
+    objectClass: olcMdbConfig
+    olcDatabase: {1}mdb
+    olcDbDirectory: /var/db/openldap
+    olcDbIndex: objectClass eq
+    olcSuffix: dc=example
+    olcRootDN: cn=root,dc=example
+    olcRootPW: notapassword
+  '';
+
+  ldapClientConfig = {
+    enable = true;
+    loginPam = false;
+    nsswitch = false;
+    server = "ldap://";
+    base = "dc=example";
+  };
+
+in {
+  name = "openldap";
+
+  nodes.machine = { pkgs, ... }: {
+    environment.etc."openldap/root_password".text = "notapassword";
+
+    users.ldap = ldapClientConfig;
+
+    services.openldap = {
+      enable = true;
+      urlList = [ "ldapi:///" "ldap://" ];
+      settings = {
+        children = {
+          "cn=schema".includes = [
+            "${pkgs.openldap}/etc/schema/core.ldif"
+            "${pkgs.openldap}/etc/schema/cosine.ldif"
+            "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
+            "${pkgs.openldap}/etc/schema/nis.ldif"
+          ];
+          "olcDatabase={0}config" = {
+            attrs = {
+              objectClass = [ "olcDatabaseConfig" ];
+              olcDatabase = "{0}config";
+              olcRootDN = "cn=root,cn=config";
+              olcRootPW = "configpassword";
+            };
+          };
+          "olcDatabase={1}mdb" = {
+            # This tests string, base64 and path values, as well as lists of string values
+            attrs = {
+              objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
+              olcDatabase = "{1}mdb";
+              olcDbDirectory = "/var/lib/openldap/db";
+              olcSuffix = "dc=example";
+              olcRootDN = {
+                # cn=root,dc=example
+                base64 = "Y249cm9vdCxkYz1leGFtcGxl";
+              };
+              olcRootPW = {
+                path = "/etc/openldap/root_password";
               };
             };
           };
         };
-        declarativeContents."dc=example" = dbContents;
-      };
-    };
-  }) { inherit pkgs system; };
-
-  # Old-style configuration
-  oldOptions = import ./make-test-python.nix ({ pkgs, ... }: {
-    inherit testScript;
-    name = "openldap";
-
-    nodes.machine = { pkgs, ... }: {
-      services.openldap = {
-        enable = true;
-        logLevel = "stats acl";
-        defaultSchemas = true;
-        database = "mdb";
-        suffix = "dc=example";
-        rootdn = "cn=root,dc=example";
-        rootpw = "notapassword";
-        declarativeContents."dc=example" = dbContents;
-      };
-    };
-  }) { inherit system pkgs; };
-
-  # Manually managed configDir, for example if dynamic config is essential
-  manualConfigDir = import ./make-test-python.nix ({ pkgs, ... }: {
-    name = "openldap";
-
-    nodes.machine = { pkgs, ... }: {
-      services.openldap = {
-        enable = true;
-        configDir = "/var/db/slapd.d";
       };
     };
 
-    testScript = let
-      contents = pkgs.writeText "data.ldif" dbContents;
-      config = pkgs.writeText "config.ldif" ''
-        dn: cn=config
-        cn: config
-        objectClass: olcGlobal
-        olcLogLevel: stats
-        olcPidFile: /run/slapd/slapd.pid
+    specialisation = {
+      declarativeContents.configuration = { ... }: {
+        services.openldap.declarativeContents."dc=example" = dbContents;
+      };
+      mutableConfig.configuration = { ... }: {
+        services.openldap = {
+          declarativeContents."dc=example" = dbContents;
+          mutableConfig = true;
+        };
+      };
+      manualConfigDir = {
+        inheritParentConfig = false;
+        configuration = { ... }: {
+          users.ldap = ldapClientConfig;
+          services.openldap = {
+            enable = true;
+            configDir = "/var/db/slapd.d";
+          };
+        };
+      };
+    };
+  };
+  testScript = { nodes, ... }: let
+    specializations = "${nodes.machine.config.system.build.toplevel}/specialisation";
+    changeRootPw = ''
+      dn: olcDatabase={1}mdb,cn=config
+      changetype: modify
+      replace: olcRootPW
+      olcRootPW: foobar
+    '';
+  in ''
+    # Test startup with empty DB
+    machine.wait_for_unit("openldap.service")
 
-        dn: cn=schema,cn=config
-        cn: schema
-        objectClass: olcSchemaConfig
+    with subtest("declarative contents"):
+      machine.succeed('${specializations}/declarativeContents/bin/switch-to-configuration test')
+      machine.wait_for_unit("openldap.service")
+      machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword')
+      machine.fail('ldapmodify -D cn=root,cn=config -w configpassword -f ${pkgs.writeText "rootpw.ldif" changeRootPw}')
 
-        include: file://${pkgs.openldap}/etc/schema/core.ldif
-        include: file://${pkgs.openldap}/etc/schema/cosine.ldif
-        include: file://${pkgs.openldap}/etc/schema/inetorgperson.ldif
+    with subtest("mutable config"):
+      machine.succeed('${specializations}/mutableConfig/bin/switch-to-configuration test')
+      machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword')
+      machine.succeed('ldapmodify -D cn=root,cn=config -w configpassword -f ${pkgs.writeText "rootpw.ldif" changeRootPw}')
+      machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w foobar')
 
-        dn: olcDatabase={1}mdb,cn=config
-        objectClass: olcDatabaseConfig
-        objectClass: olcMdbConfig
-        olcDatabase: {1}mdb
-        olcDbDirectory: /var/db/openldap
-        olcDbIndex: objectClass eq
-        olcSuffix: dc=example
-        olcRootDN: cn=root,dc=example
-        olcRootPW: notapassword
-      '';
-    in ''
+    with subtest("manual config dir"):
       machine.succeed(
-          "mkdir -p /var/db/slapd.d /var/db/openldap",
-          "slapadd -F /var/db/slapd.d -n0 -l ${config}",
-          "slapadd -F /var/db/slapd.d -n1 -l ${contents}",
-          "chown -R openldap:openldap /var/db/slapd.d /var/db/openldap",
-          "systemctl restart openldap",
+        'mkdir /var/db/slapd.d /var/db/openldap',
+        'slapadd -F /var/db/slapd.d -n0 -l ${pkgs.writeText "config.ldif" ldifConfig}',
+        'slapadd -F /var/db/slapd.d -n1 -l ${pkgs.writeText "contents.ldif" dbContents}',
+        'chown -R openldap:openldap /var/db/slapd.d /var/db/openldap',
+        '${specializations}/manualConfigDir/bin/switch-to-configuration test',
       )
-    '' + testScript;
-  }) { inherit system pkgs; };
-}
+      machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword')
+      machine.succeed('ldapmodify -D cn=root,cn=config -w configpassword -f ${pkgs.writeText "rootpw.ldif" changeRootPw}')
+      machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w foobar')
+  '';
+})

pkgs/applications/audio/fluidsynth/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluidsynth";
-  version = "2.2.7";
+  version = "2.2.8";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     rev = "v${version}";
-    sha256 = "sha256-4uo+Ldrp66dmemulKqofX2pz8tE73/5zGtmnY5BHjs8=";
+    sha256 = "sha256-zJMe2skFeXhrAx9vBcTXWJLfivI/iXyc0JFlNKpBETQ=";
   };
 
   nativeBuildInputs = [ buildPackages.stdenv.cc pkg-config cmake ];

pkgs/applications/display-managers/lightdm/default.nix

@@ -1,4 +1,5 @@
 { lib, stdenv
+, buildPackages
 , fetchFromGitHub
 , nix-update-script
 , substituteAll
@@ -120,7 +121,7 @@ stdenv.mkDerivation rec {
 
   prePatch = ''
     substituteInPlace autogen.sh \
-      --replace "which" "${busybox}/bin/which"
+      --replace "which" "${buildPackages.busybox}/bin/which"
 
     substituteInPlace src/shared-data-manager.c \
       --replace /bin/rm ${busybox}/bin/rm

pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -19,6 +19,7 @@
 , pkg-config, glib, libsecret
 , gzip # needed at runtime by gitweb.cgi
 , withSsh ? false
+, doInstallCheck ? !stdenv.isDarwin  # extremely slow on darwin
 }:
 
 assert osxkeychainSupport -> stdenv.isDarwin;
@@ -31,7 +32,7 @@ let
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "git"
     + lib.optionalString svnSupport "-with-svn"
     + lib.optionalString (!svnSupport && !guiSupport && !sendEmailSupport && !withManual && !pythonSupport && !withpcre2) "-minimal";
@@ -280,7 +281,7 @@ stdenv.mkDerivation {
   ## InstallCheck
 
   doCheck = false;
-  doInstallCheck = true;
+  inherit doInstallCheck;
 
   installCheckTarget = "test";
 
@@ -369,6 +370,9 @@ stdenv.mkDerivation {
   passthru = {
     shellPath = "/bin/git-shell";
     tests = {
+      withInstallCheck = finalAttrs.finalPackage.overrideAttrs (_: {
+        doInstallCheck = true;
+      });
       buildbot-integration = nixosTests.buildbot;
     };
   };
@@ -387,4 +391,4 @@ stdenv.mkDerivation {
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ primeos wmertens globin ];
   };
-}
+})

pkgs/build-support/bintools-wrapper/default.nix

@@ -164,11 +164,13 @@ stdenv.mkDerivation {
       wrap ld-solaris ${./ld-solaris-wrapper.sh}
     '')
 
-    # Create a symlink to as (the assembler).
+    # Create symlinks for rest of the binaries.
     + ''
-      if [ -e $ldPath/${targetPrefix}as ]; then
-        ln -s $ldPath/${targetPrefix}as $out/bin/${targetPrefix}as
-      fi
+      for binary in objdump objcopy size strings as ar nm gprof dwp c++filt addr2line ranlib readelf elfedit; do
+        if [ -e $ldPath/${targetPrefix}''${binary} ]; then
+          ln -s $ldPath/${targetPrefix}''${binary} $out/bin/${targetPrefix}''${binary}
+        fi
+      done
 
     '' + (if !useMacosReexportHack then ''
       wrap ${targetPrefix}ld ${./ld-wrapper.sh} ''${ld:-$ldPath/${targetPrefix}ld}

pkgs/build-support/bintools-wrapper/ld-wrapper.sh

@@ -50,6 +50,11 @@ if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "${NIX_STORE:-}"
             n+=1; skip "$p2"
         elif [ "$p" = -dynamic-linker ] && badPath "$p2"; then
             n+=1; skip "$p2"
+        elif [ "$p" = -syslibroot ] && [ $p2 == // ]; then
+            # When gcc is built on darwin --with-build-sysroot=/
+            # produces '-syslibroot //' linker flag. It's a no-op,
+            # which does not introduce impurities.
+            n+=1; skip "$p2"
         elif [ "${p:0:1}" = / ] && badPath "$p"; then
             # We cannot skip this; barf.
             echo "impure path \`$p' used in link" >&2

pkgs/build-support/cc-wrapper/default.nix

@@ -249,12 +249,19 @@ stdenv.mkDerivation {
       wrap ${targetPrefix}gdc $wrapper $ccPath/${targetPrefix}gdc
     ''
 
-    + optionalString cc.langFortran or false ''
+    + optionalString cc.langFortran or false (''
       wrap ${targetPrefix}gfortran $wrapper $ccPath/${targetPrefix}gfortran
       ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}g77
       ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}f77
       export named_fc=${targetPrefix}gfortran
     ''
+    # Darwin aarch64 fortran compilations seem to fail otherwise, see:
+    # https://github.com/NixOS/nixpkgs/issues/140041
+    + (if (stdenvNoCC.isDarwin && stdenvNoCC.isAarch64) then ''
+      export fortran_hardening="pic strictoverflow relro bindnow"
+    '' else ''
+      export fortran_hardening="pic strictoverflow relro bindnow stackprotector"
+    ''))
 
     + optionalString cc.langJava or false ''
       wrap ${targetPrefix}gcj $wrapper $ccPath/${targetPrefix}gcj
@@ -374,7 +381,6 @@ stdenv.mkDerivation {
     + optionalString (libcxx.isLLVM or false) (''
       echo "-isystem ${lib.getDev libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
       echo "-stdlib=libc++" >> $out/nix-support/libcxx-ldflags
-    '' + lib.optionalString stdenv.targetPlatform.isLinux ''
       echo "-lc++abi" >> $out/nix-support/libcxx-ldflags
     '')
 

pkgs/build-support/cc-wrapper/fortran-hook.sh

@@ -5,7 +5,7 @@ export FC${role_post}=@named_fc@
 
 # If unset, assume the default hardening flags.
 # These are different for fortran.
-: ${NIX_HARDENING_ENABLE="stackprotector pic strictoverflow relro bindnow"}
+: ${NIX_HARDENING_ENABLE="@fortran_hardening@"}
 export NIX_HARDENING_ENABLE
 
 unset -v role_post

pkgs/build-support/setup-hooks/strip.sh

@@ -7,38 +7,39 @@ _doStrip() {
     # to $out anyways---if it does, that's a bigger problem that a lack of
     # stripping will help catch.
     local -ra flags=(dontStripHost dontStripTarget)
-    local -ra stripCmds=(STRIP TARGET_STRIP)
+    local -ra debugDirs=(stripDebugList stripDebugListTarget)
+    local -ra allDirs=(stripAllList stripAllListTarget)
+    local -ra stripCmds=(STRIP STRIP_FOR_TARGET)
+    local -ra ranlibCmds=(RANLIB RANLIB_FOR_TARGET)
 
-    # Optimization
-    if [[ "${STRIP-}" == "${TARGET_STRIP-}" ]]; then
-        dontStripTarget+=1
-    fi
+    # Strip only host paths by default. Leave targets as is.
+    stripDebugList=${stripDebugList:-lib lib32 lib64 libexec bin sbin}
+    stripDebugListTarget=${stripDebugListTarget:-}
+    stripAllList=${stripAllList:-}
+    stripAllListTarget=${stripAllListTarget:-}
 
     local i
     for i in ${!stripCmds[@]}; do
         local -n flag="${flags[$i]}"
+        local -n debugDirList="${debugDirs[$i]}"
+        local -n allDirList="${allDirs[$i]}"
         local -n stripCmd="${stripCmds[$i]}"
+        local -n ranlibCmd="${ranlibCmds[$i]}"
 
         # `dontStrip` disables them all
         if [[ "${dontStrip-}" || "${flag-}" ]] || ! type -f "${stripCmd-}" 2>/dev/null
         then continue; fi
 
-        stripDebugList=${stripDebugList:-lib lib32 lib64 libexec bin sbin}
-        if [ -n "$stripDebugList" ]; then
-            stripDirs "$stripCmd" "$stripDebugList" "${stripDebugFlags:--S}"
-        fi
-
-        stripAllList=${stripAllList:-}
-        if [ -n "$stripAllList" ]; then
-            stripDirs "$stripCmd" "$stripAllList" "${stripAllFlags:--s}"
-        fi
+        stripDirs "$stripCmd" "$ranlibCmd" "$debugDirList" "${stripDebugFlags:--S}"
+        stripDirs "$stripCmd" "$ranlibCmd" "$allDirList" "${stripAllFlags:--s}"
     done
 }
 
 stripDirs() {
     local cmd="$1"
-    local dirs="$2"
-    local stripFlags="$3"
+    local ranlibCmd="$2"
+    local dirs="$3"
+    local stripFlags="$4"
     local dirsNew=
 
     local d
@@ -50,8 +51,13 @@ stripDirs() {
     dirs=${dirsNew}
 
     if [ -n "${dirs}" ]; then
-        header "stripping (with command $cmd and flags $stripFlags) in$dirs"
+        echo "stripping (with command $cmd and flags $stripFlags) in$dirs"
         find $dirs -type f -exec $cmd $stripFlags '{}' \; 2>/dev/null
-        stopNest
+        # 'strip' does not normally preserve archive index in .a files.
+        # This usually causes linking failures against static libs like:
+        #   ld: ...-i686-w64-mingw32-stage-final-gcc-13.0.0-lib/i686-w64-mingw32/lib/libstdc++.dll.a:
+        #     error adding symbols: archive has no index; run ranlib to add one
+        # Restore the index by running 'ranlib'.
+        find $dirs -name '*.a' -type f -exec $ranlibCmd '{}' \; 2>/dev/null
     fi
 }

pkgs/development/compilers/gcc/10/default.nix

@@ -24,9 +24,6 @@
 , libcCross ? null
 , threadsCross ? null # for MinGW
 , crossStageStatic ? false
-, # Strip kills static libs of other archs (hence no cross)
-  stripped ? stdenv.hostPlatform.system == stdenv.buildPlatform.system
-          && stdenv.targetPlatform.system == stdenv.hostPlatform.system
 , gnused ? null
 , cloog # unused; just for compat with gcc4, as we override the parameter on some places
 , buildPackages
@@ -86,7 +83,7 @@ let majorVersion = "10";
 in
 
 stdenv.mkDerivation ({
-  pname = "${crossNameAddon}${name}${if stripped then "" else "-debug"}";
+  pname = "${crossNameAddon}${name}";
   inherit version;
 
   builder = ../builder.sh;
@@ -191,7 +188,7 @@ stdenv.mkDerivation ({
 
   preConfigure = import ../common/pre-configure.nix {
     inherit lib;
-    inherit version targetPlatform hostPlatform gnatboot langAda langGo langJit;
+    inherit version targetPlatform hostPlatform gnatboot langAda langGo langJit crossStageStatic;
   };
 
   dontDisableStatic = true;
@@ -231,9 +228,11 @@ stdenv.mkDerivation ({
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
     (if profiledCompiler then "profiledbootstrap" else "bootstrap");
 
-  dontStrip = !stripped;
-
-  installTargets = optional stripped "install-strip";
+  inherit
+    (import ../common/strip-attributes.nix { inherit stdenv; })
+    stripDebugList
+    stripDebugListTarget
+    preFixup;
 
   # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
@@ -274,8 +273,7 @@ stdenv.mkDerivation ({
   meta = {
     homepage = "https://gcc.gnu.org/";
     license = lib.licenses.gpl3Plus;  # runtime support libraries are typically LGPLv3+
-    description = "GNU Compiler Collection, version ${version}"
-      + (if stripped then "" else " (with debugging info)");
+    description = "GNU Compiler Collection, version ${version}";
 
     longDescription = ''
       The GNU Compiler Collection includes compiler front ends for C, C++,

pkgs/development/compilers/gcc/11/default.nix

@@ -24,9 +24,6 @@
 , libcCross ? null
 , threadsCross ? null # for MinGW
 , crossStageStatic ? false
-, # Strip kills static libs of other archs (hence no cross)
-  stripped ? stdenv.hostPlatform.system == stdenv.buildPlatform.system
-          && stdenv.targetPlatform.system == stdenv.hostPlatform.system
 , gnused ? null
 , cloog # unused; just for compat with gcc4, as we override the parameter on some places
 , buildPackages
@@ -92,7 +89,7 @@ let majorVersion = "11";
 in
 
 stdenv.mkDerivation ({
-  pname = "${crossNameAddon}${name}${if stripped then "" else "-debug"}";
+  pname = "${crossNameAddon}${name}";
   inherit version;
 
   builder = ../builder.sh;
@@ -199,7 +196,7 @@ stdenv.mkDerivation ({
 
   preConfigure = import ../common/pre-configure.nix {
     inherit lib;
-    inherit version targetPlatform hostPlatform gnatboot langAda langGo langJit;
+    inherit version targetPlatform hostPlatform gnatboot langAda langGo langJit crossStageStatic;
   };
 
   dontDisableStatic = true;
@@ -239,9 +236,11 @@ stdenv.mkDerivation ({
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
     (if profiledCompiler then "profiledbootstrap" else "bootstrap");
 
-  dontStrip = !stripped;
-
-  installTargets = optional stripped "install-strip";
+  inherit
+    (import ../common/strip-attributes.nix { inherit stdenv; })
+    stripDebugList
+    stripDebugListTarget
+    preFixup;
 
   # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
@@ -282,8 +281,7 @@ stdenv.mkDerivation ({
   meta = {
     homepage = "https://gcc.gnu.org/";
     license = lib.licenses.gpl3Plus;  # runtime support libraries are typically LGPLv3+
-    description = "GNU Compiler Collection, version ${version}"
-      + (if stripped then "" else " (with debugging info)");
+    description = "GNU Compiler Collection, version ${version}";
 
     longDescription = ''
       The GNU Compiler Collection includes compiler front ends for C, C++,

pkgs/development/compilers/gcc/12/default.nix

@@ -24,9 +24,6 @@
 , libcCross ? null
 , threadsCross ? null # for MinGW
 , crossStageStatic ? false
-, # Strip kills static libs of other archs (hence no cross)
-  stripped ? stdenv.hostPlatform.system == stdenv.buildPlatform.system
-          && stdenv.targetPlatform.system == stdenv.hostPlatform.system
 , gnused ? null
 , cloog # unused; just for compat with gcc4, as we override the parameter on some places
 , buildPackages
@@ -89,7 +86,7 @@ let majorVersion = "12";
 in
 
 stdenv.mkDerivation ({
-  pname = "${crossNameAddon}${name}${if stripped then "" else "-debug"}";
+  pname = "${crossNameAddon}${name}";
   inherit version;
 
   builder = ../builder.sh;
@@ -194,7 +191,7 @@ stdenv.mkDerivation ({
 
   preConfigure = import ../common/pre-configure.nix {
     inherit lib;
-    inherit version targetPlatform hostPlatform gnatboot langAda langGo langJit;
+    inherit version targetPlatform hostPlatform gnatboot langAda langGo langJit crossStageStatic;
   };
 
   dontDisableStatic = true;
@@ -234,9 +231,11 @@ stdenv.mkDerivation ({
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
     (if profiledCompiler then "profiledbootstrap" else "bootstrap");
 
-  dontStrip = !stripped;
-
-  installTargets = optional stripped "install-strip";
+  inherit
+    (import ../common/strip-attributes.nix { inherit stdenv; })
+    stripDebugList
+    stripDebugListTarget
+    preFixup;
 
   # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
@@ -277,8 +276,7 @@ stdenv.mkDerivation ({
   meta = {
     homepage = "https://gcc.gnu.org/";
     license = lib.licenses.gpl3Plus;  # runtime support libraries are typically LGPLv3+
-    description = "GNU Compiler Collection, version ${version}"
-      + (if stripped then "" else " (with debugging info)");
+    description = "GNU Compiler Collection, version ${version}";
 
     longDescription = ''
       The GNU Compiler Collection includes compiler front ends for C, C++,

pkgs/development/compilers/gcc/4.8/default.nix

@@ -28,9 +28,6 @@
 , libcCross ? null
 , threadsCross ? null # for MinGW
 , crossStageStatic ? false
-, # Strip kills static libs of other archs (hence no cross)
-  stripped ? stdenv.hostPlatform == stdenv.buildPlatform
-          && stdenv.targetPlatform == stdenv.hostPlatform
 , gnused ? null
 , buildPackages
 }:
@@ -124,7 +121,7 @@ in
 assert x11Support -> (filter (x: x == null) ([ gtk2 libart_lgpl ] ++ xlibs)) == [];
 
 stdenv.mkDerivation ({
-  pname = "${crossNameAddon}${name}${if stripped then "" else "-debug"}";
+  pname = "${crossNameAddon}${name}";
   inherit version;
 
   builder = ../builder.sh;
@@ -198,7 +195,7 @@ stdenv.mkDerivation ({
 
   preConfigure = import ../common/pre-configure.nix {
     inherit lib;
-    inherit version targetPlatform hostPlatform langJava langGo;
+    inherit version targetPlatform hostPlatform langJava langGo crossStageStatic;
   };
 
   dontDisableStatic = true;
@@ -238,12 +235,14 @@ stdenv.mkDerivation ({
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
     (if profiledCompiler then "profiledbootstrap" else "bootstrap");
 
-  dontStrip = !stripped;
+  inherit
+    (import ../common/strip-attributes.nix { inherit stdenv; })
+    stripDebugList
+    stripDebugListTarget
+    preFixup;
 
   doCheck = false; # requires a lot of tools, causes a dependency cycle for stdenv
 
-  installTargets = optional stripped "install-strip";
-
   # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
 
@@ -297,8 +296,7 @@ stdenv.mkDerivation ({
   meta = {
     homepage = "https://gcc.gnu.org/";
     license = lib.licenses.gpl3Plus;  # runtime support libraries are typically LGPLv3+
-    description = "GNU Compiler Collection, version ${version}"
-      + (if stripped then "" else " (with debugging info)");
+    description = "GNU Compiler Collection, version ${version}";
 
     longDescription = ''
       The GNU Compiler Collection includes compiler front ends for C, C++,

pkgs/development/compilers/gcc/4.9/default.nix

@@ -28,9 +28,6 @@
 , libcCross ? null
 , threadsCross ? null # for MinGW
 , crossStageStatic ? false
-, # Strip kills static libs of other archs (hence no cross)
-  stripped ? stdenv.hostPlatform == stdenv.buildPlatform
-          && stdenv.targetPlatform == stdenv.hostPlatform
 , gnused ? null
 , buildPackages
 }:
@@ -140,7 +137,7 @@ in
 assert x11Support -> (filter (x: x == null) ([ gtk2 libart_lgpl ] ++ xlibs)) == [];
 
 stdenv.mkDerivation ({
-  pname = "${crossNameAddon}${name}${if stripped then "" else "-debug"}";
+  pname = "${crossNameAddon}${name}";
   inherit version;
 
   builder = ../builder.sh;
@@ -218,7 +215,7 @@ stdenv.mkDerivation ({
 
   preConfigure = import ../common/pre-configure.nix {
     inherit lib;
-    inherit version targetPlatform hostPlatform langJava langGo;
+    inherit version targetPlatform hostPlatform langJava langGo crossStageStatic;
   };
 
   dontDisableStatic = true;
@@ -258,12 +255,14 @@ stdenv.mkDerivation ({
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
     (if profiledCompiler then "profiledbootstrap" else "bootstrap");
 
-  dontStrip = !stripped;
+  inherit
+    (import ../common/strip-attributes.nix { inherit stdenv; })
+    stripDebugList
+    stripDebugListTarget
+    preFixup;
 
   doCheck = false; # requires a lot of tools, causes a dependency cycle for stdenv
 
-  installTargets = optional stripped "install-strip";
-
   # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
 
@@ -316,8 +315,7 @@ stdenv.mkDerivation ({
   meta = {
     homepage = "https://gcc.gnu.org/";
     license = lib.licenses.gpl3Plus;  # runtime support libraries are typically LGPLv3+
-    description = "GNU Compiler Collection, version ${version}"
-      + (if stripped then "" else " (with debugging info)");
+    description = "GNU Compiler Collection, version ${version}";
 
     longDescription = ''
       The GNU Compiler Collection includes compiler front ends for C, C++,

pkgs/development/compilers/gcc/6/default.nix

@@ -31,9 +31,6 @@
 , libcCross ? null
 , threadsCross ? null # for MinGW
 , crossStageStatic ? false
-, # Strip kills static libs of other archs (hence no cross)
-  stripped ? stdenv.hostPlatform.system == stdenv.buildPlatform.system
-          && stdenv.targetPlatform.system == stdenv.hostPlatform.system
 , gnused ? null
 , cloog # unused; just for compat with gcc4, as we override the parameter on some places
 , buildPackages
@@ -121,7 +118,7 @@ in
 assert x11Support -> (filter (x: x == null) ([ gtk2 libart_lgpl ] ++ xlibs)) == [];
 
 stdenv.mkDerivation ({
-  pname = "${crossNameAddon}${name}${if stripped then "" else "-debug"}";
+  pname = "${crossNameAddon}${name}";
   inherit version;
 
   builder = ../builder.sh;
@@ -230,7 +227,7 @@ stdenv.mkDerivation ({
 
   preConfigure = import ../common/pre-configure.nix {
     inherit lib;
-    inherit version targetPlatform hostPlatform gnatboot langJava langAda langGo;
+    inherit version targetPlatform hostPlatform gnatboot langJava langAda langGo crossStageStatic;
   };
 
   dontDisableStatic = true;
@@ -270,12 +267,14 @@ stdenv.mkDerivation ({
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
     (if profiledCompiler then "profiledbootstrap" else "bootstrap");
 
-  dontStrip = !stripped;
+  inherit
+    (import ../common/strip-attributes.nix { inherit stdenv; })
+    stripDebugList
+    stripDebugListTarget
+    preFixup;
 
   doCheck = false; # requires a lot of tools, causes a dependency cycle for stdenv
 
-  installTargets = optional stripped "install-strip";
-
   # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
 
@@ -328,8 +327,7 @@ stdenv.mkDerivation ({
   meta = {
     homepage = "https://gcc.gnu.org/";
     license = lib.licenses.gpl3Plus;  # runtime support libraries are typically LGPLv3+
-    description = "GNU Compiler Collection, version ${version}"
-      + (if stripped then "" else " (with debugging info)");
+    description = "GNU Compiler Collection, version ${version}";
 
     longDescription = ''
       The GNU Compiler Collection includes compiler front ends for C, C++,

pkgs/development/compilers/gcc/7/default.nix

@@ -21,9 +21,6 @@
 , libcCross ? null
 , threadsCross ? null # for MinGW
 , crossStageStatic ? false
-, # Strip kills static libs of other archs (hence no cross)
-  stripped ? stdenv.hostPlatform.system == stdenv.buildPlatform.system
-          && stdenv.targetPlatform.system == stdenv.hostPlatform.system
 , gnused ? null
 , cloog # unused; just for compat with gcc4, as we override the parameter on some places
 , buildPackages
@@ -94,7 +91,7 @@ let majorVersion = "7";
 in
 
 stdenv.mkDerivation ({
-  pname = "${crossNameAddon}${name}${if stripped then "" else "-debug"}";
+  pname = "${crossNameAddon}${name}";
   inherit version;
 
   builder = ../builder.sh;
@@ -197,7 +194,7 @@ stdenv.mkDerivation ({
 
   preConfigure = import ../common/pre-configure.nix {
     inherit lib;
-    inherit version targetPlatform hostPlatform langGo;
+    inherit version targetPlatform hostPlatform langGo crossStageStatic;
   };
 
   dontDisableStatic = true;
@@ -237,12 +234,14 @@ stdenv.mkDerivation ({
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
     (if profiledCompiler then "profiledbootstrap" else "bootstrap");
 
-  dontStrip = !stripped;
+  inherit
+    (import ../common/strip-attributes.nix { inherit stdenv; })
+    stripDebugList
+    stripDebugListTarget
+    preFixup;
 
   doCheck = false; # requires a lot of tools, causes a dependency cycle for stdenv
 
-  installTargets = optional stripped "install-strip";
-
   # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
 
@@ -282,8 +281,7 @@ stdenv.mkDerivation ({
   meta = {
     homepage = "https://gcc.gnu.org/";
     license = lib.licenses.gpl3Plus;  # runtime support libraries are typically LGPLv3+
-    description = "GNU Compiler Collection, version ${version}"
-      + (if stripped then "" else " (with debugging info)");
+    description = "GNU Compiler Collection, version ${version}";
 
     longDescription = ''
       The GNU Compiler Collection includes compiler front ends for C, C++,

pkgs/development/compilers/gcc/8/default.nix

@@ -21,9 +21,6 @@
 , libcCross ? null
 , threadsCross ? null # for MinGW
 , crossStageStatic ? false
-, # Strip kills static libs of other archs (hence no cross)
-  stripped ? stdenv.hostPlatform.system == stdenv.buildPlatform.system
-          && stdenv.targetPlatform.system == stdenv.hostPlatform.system
 , gnused ? null
 , cloog # unused; just for compat with gcc4, as we override the parameter on some places
 , buildPackages
@@ -78,7 +75,7 @@ let majorVersion = "8";
 in
 
 stdenv.mkDerivation ({
-  pname = "${crossNameAddon}${name}${if stripped then "" else "-debug"}";
+  pname = "${crossNameAddon}${name}";
   inherit version;
 
   builder = ../builder.sh;
@@ -180,7 +177,7 @@ stdenv.mkDerivation ({
 
   preConfigure = import ../common/pre-configure.nix {
     inherit lib;
-    inherit version targetPlatform hostPlatform langGo;
+    inherit version targetPlatform hostPlatform langGo crossStageStatic;
   };
 
   dontDisableStatic = true;
@@ -218,9 +215,11 @@ stdenv.mkDerivation ({
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
     (if profiledCompiler then "profiledbootstrap" else "bootstrap");
 
-  dontStrip = !stripped;
-
-  installTargets = optional stripped "install-strip";
+  inherit
+    (import ../common/strip-attributes.nix { inherit stdenv; })
+    stripDebugList
+    stripDebugListTarget
+    preFixup;
 
   # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
@@ -261,8 +260,7 @@ stdenv.mkDerivation ({
   meta = {
     homepage = "https://gcc.gnu.org/";
     license = lib.licenses.gpl3Plus;  # runtime support libraries are typically LGPLv3+
-    description = "GNU Compiler Collection, version ${version}"
-      + (if stripped then "" else " (with debugging info)");
+    description = "GNU Compiler Collection, version ${version}";
 
     longDescription = ''
       The GNU Compiler Collection includes compiler front ends for C, C++,

pkgs/development/compilers/gcc/9/default.nix

@@ -24,9 +24,6 @@
 , libcCross ? null
 , threadsCross ? null # for MinGW
 , crossStageStatic ? false
-, # Strip kills static libs of other archs (hence no cross)
-  stripped ? stdenv.hostPlatform.system == stdenv.buildPlatform.system
-          && stdenv.targetPlatform.system == stdenv.hostPlatform.system
 , gnused ? null
 , cloog # unused; just for compat with gcc4, as we override the parameter on some places
 , buildPackages
@@ -89,7 +86,7 @@ let majorVersion = "9";
 in
 
 stdenv.mkDerivation ({
-  pname = "${crossNameAddon}${name}${if stripped then "" else "-debug"}";
+  pname = "${crossNameAddon}${name}";
   inherit version;
 
   builder = ../builder.sh;
@@ -193,7 +190,7 @@ stdenv.mkDerivation ({
 
   preConfigure = import ../common/pre-configure.nix {
     inherit lib;
-    inherit version targetPlatform hostPlatform gnatboot langAda langGo langJit;
+    inherit version targetPlatform hostPlatform gnatboot langAda langGo langJit crossStageStatic;
   };
 
   dontDisableStatic = true;
@@ -233,9 +230,11 @@ stdenv.mkDerivation ({
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
     (if profiledCompiler then "profiledbootstrap" else "bootstrap");
 
-  dontStrip = !stripped;
-
-  installTargets = optional stripped "install-strip";
+  inherit
+    (import ../common/strip-attributes.nix { inherit stdenv; })
+    stripDebugList
+    stripDebugListTarget
+    preFixup;
 
   # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
@@ -276,8 +275,7 @@ stdenv.mkDerivation ({
   meta = {
     homepage = "https://gcc.gnu.org/";
     license = lib.licenses.gpl3Plus;  # runtime support libraries are typically LGPLv3+
-    description = "GNU Compiler Collection, version ${version}"
-      + (if stripped then "" else " (with debugging info)");
+    description = "GNU Compiler Collection, version ${version}";
 
     longDescription = ''
       The GNU Compiler Collection includes compiler front ends for C, C++,

pkgs/development/compilers/gcc/builder.sh

@@ -147,11 +147,6 @@ if test "$noSysDirs" = "1"; then
     fi
 fi
 
-if [ -n "${targetConfig-}" ]; then
-    # if stripping gcc, include target directory too
-    stripDebugList="${stripDebugList-lib lib32 lib64 libexec bin sbin} $targetConfig"
-fi
-
 eval "$oldOpts"
 
 providedPreConfigure="$preConfigure";
@@ -171,15 +166,6 @@ preConfigure() {
         rm -Rf zlib
     fi
 
-    if test -f "$NIX_CC/nix-support/orig-libc"; then
-        # Patch the configure script so it finds glibc headers.  It's
-        # important for example in order not to get libssp built,
-        # because its functionality is in glibc already.
-        sed -i \
-            -e "s,glibc_header_dir=/usr/include,glibc_header_dir=$libc_dev/include", \
-            gcc/configure
-    fi
-
     if test -n "$crossMingw" -a -n "$crossStageStatic"; then
         mkdir -p ../mingw
         # --with-build-sysroot expects that:

pkgs/development/compilers/gcc/common/configure-flags.nix

@@ -111,8 +111,30 @@ let
       "--with-mpc=${libmpc}"
     ]
     ++ lib.optional (libelf != null) "--with-libelf=${libelf}"
-    ++ lib.optional (!(crossMingw && crossStageStatic))
-      "--with-native-system-header-dir=${lib.getDev stdenv.cc.libc}/include"
+    ++ lib.optionals (!crossStageStatic) [
+      (if libcCross == null
+       then "--with-native-system-header-dir=${lib.getDev stdenv.cc.libc}/include"
+       else "--with-native-system-header-dir=${lib.getDev libcCross}${libcCross.incdir or "/include"}")
+      # gcc builds for cross-compilers (build != host) or cross-built
+      # gcc (host != target) always apply the offset prefix to disentangle
+      # target headers from build or host headers:
+      #     ${with_build_sysroot}${native_system_header_dir}
+      #  or ${test_exec_prefix}/${target_noncanonical}/sys-include
+      #  or ${with_sysroot}${native_system_header_dir}
+      # While native build (build == host == target) uses passed headers
+      # path as is:
+      #    ${native_system_header_dir}
+      #
+      # Nixpkgs uses flat directory structure for both native and cross
+      # cases. As a result libc headers don't get found for cross case
+      # and many modern features get disabled (libssp is used instead of
+      # target-specific implementations and similar). More details at:
+      #   https://github.com/NixOS/nixpkgs/pull/181802#issuecomment-1186822355
+      #
+      # We pick "/" path to effectively avoid sysroot offset and make it work
+      # as a native case.
+      "--with-build-sysroot=/"
+    ]
 
     # Basic configuration
     ++ [

pkgs/development/compilers/gcc/common/pre-configure.nix

@@ -3,7 +3,9 @@
 , langAda ? false
 , langJava ? false
 , langJit ? false
-, langGo }:
+, langGo
+, crossStageStatic
+}:
 
 assert langJava -> lib.versionOlder version "7";
 assert langAda -> gnatboot != null; let
@@ -67,3 +69,12 @@ in lib.optionalString (hostPlatform.isSunOS && hostPlatform.is64bit) ''
 + lib.optionalString (targetPlatform.config == hostPlatform.config && targetPlatform != hostPlatform) ''
   substituteInPlace configure --replace is_cross_compiler=no is_cross_compiler=yes
 ''
+
+# Normally (for host != target case) --without-headers automatically
+# enables 'inhibit_libc=true' in gcc's gcc/configure.ac. But case of
+# gcc->clang "cross"-compilation manages to evade it: there
+# hostPlatform != targetPlatform, hostPlatform.config == targetPlatform.config.
+# We explicitly inhibit libc headers use in this case as well.
++ lib.optionalString (targetPlatform != hostPlatform && crossStageStatic) ''
+  export inhibit_libc=true
+''

pkgs/development/compilers/gcc/common/strip-attributes.nix

@@ -0,0 +1,53 @@
+{ stdenv }:
+
+{
+  # Note [Cross-compiler stripping]
+  # gcc requires delicate stripping as it installs ELF files for both
+  # HOST and TARGET platforms. It requires according strip tool otherwise
+  # strip could remove sections it's not aware of.
+  # Example ARM breakage by x86_64 strip: https://bugs.gentoo.org/697428
+  #
+  # Let's recap the file layout for directories with object files for a
+  # cross-compiler (host != target):
+  # `- bin: HOST
+  #    lib/*.{a,o}: HOST
+  #      `- gcc/<TARGET>/<VERSION>/*.{a,o}: TARGET
+  #                               `- plugin/: HOST
+  #  `- lib{,32,64,x32}: symlink to lib or identical layout
+  #  `- libexec/: HOST
+  #  `- <TARGET>/: TARGET
+  #
+  # (host == target) has identical directory layout.
+
+  # The rest of stripDebugList{Host,Target} will be populated in
+  # postInstall.
+  stripDebugList = [ "bin" "libexec" ];
+  stripDebugListTarget = [ stdenv.targetPlatform.config ];
+
+  preFixup = ''
+    # Populate most delicated lib/ part of stripDebugList{,Target}
+    updateDebugListPaths() {
+      local oldOpts
+      oldOpts="$(shopt -p nullglob)" || true
+      shopt -s nullglob
+
+      pushd $out
+
+      local -ar hostFiles=(
+        lib{,32,64}/*.{a.o}
+        lib{,32,64}/gcc/${stdenv.targetPlatform.config}/*/plugin
+      )
+      local -ar targetFiles=(
+        lib{,32,64}/gcc/${stdenv.targetPlatform.config}/*/*.{a.o}
+      )
+
+      stripDebugList="$stripDebugList ''${hostFiles[*]}"
+      stripDebugListTarget="$stripDebugListTarget ''${targetFiles[*]}"
+
+      popd
+
+      eval "$oldOpts"
+    }
+    updateDebugListPaths
+  '';
+}

pkgs/development/compilers/go/1.18.nix

@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, fetchpatch
 , fetchurl
 , tzdata
 , iana-etc
@@ -172,7 +173,11 @@ stdenv.mkDerivation rec {
     touch $TMPDIR/group $TMPDIR/hosts $TMPDIR/passwd
   '';
 
-  patches = [
+  patches = let
+    fetchBase64Patch = args: (fetchpatch args).overrideAttrs (o: {
+      postFetch = "mv $out p; base64 -d p > $out; " + o.postFetch;
+    });
+  in [
     ./remove-tools-1.11.patch
     ./ssl-cert-file-1.16.patch
     ./remove-test-pie-1.15.patch
@@ -182,6 +187,12 @@ stdenv.mkDerivation rec {
     ./skip-nohup-tests.patch
     ./skip-cgo-tests-1.15.patch
     ./go_no_vendor_checks-1.16.patch
+
+    # https://go-review.googlesource.com/c/go/+/417615/
+    (fetchBase64Patch {
+      url = "https://go-review.googlesource.com/changes/go~417615/revisions/3/patch";
+      sha256 = "sha256-Gu5eZUwGGch7et75A/BNynbs4VlQUBClVUxjxPkdjOs=";
+    })
   ];
 
   postPatch = ''

pkgs/development/compilers/vala/default.nix

@@ -103,8 +103,8 @@ in rec {
   };
 
   vala_0_56 = generic {
-    version = "0.56.1";
-    sha256 = "xRi4Hf3agtHN9Yaz+bIyMWLLlr08taLANlDOoCXZH7k=";
+    version = "0.56.2";
+    sha256 = "Zslhm7F4Wf0aw6ugpXlwYT44/Soe4wVBF0JgyfuQEkw=";
   };
 
   vala = vala_0_56;

pkgs/development/go-modules/generic/default.nix

@@ -249,6 +249,8 @@ let
     doCheck = args.doCheck or true;
     checkPhase = args.checkPhase or ''
       runHook preCheck
+      # We do not set trimpath for tests, in case they reference test assets
+      export GOFLAGS=''${GOFLAGS//-trimpath/}
 
       for pkg in $(getGoDirs test); do
         buildGoDir test "$pkg"

pkgs/development/go-packages/generic/default.nix

@@ -233,6 +233,8 @@ let
     doCheck = args.doCheck or false;
     checkPhase = args.checkPhase or ''
       runHook preCheck
+      # We do not set trimpath for tests, in case they reference test assets
+      export GOFLAGS=''${GOFLAGS//-trimpath/}
 
       for pkg in $(getGoDirs test); do
         buildGoDir test "$pkg"

pkgs/development/libraries/SDL2/default.nix

@@ -29,7 +29,7 @@
 , libxkbcommon
 , dbusSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
 , dbus
-, udevSupport ? false
+, udevSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
 , udev
 , ibusSupport ? false
 , ibus

pkgs/development/libraries/accountsservice/default.nix

@@ -10,6 +10,7 @@
 , systemd
 , coreutils
 , meson
+, mesonEmulatorHook
 , dbus
 , ninja
 , python3
@@ -47,7 +48,6 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    dbus
     gettext
     gobject-introspection
     meson
@@ -55,9 +55,14 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    #  meson.build:88:2: ERROR: Can not run test applications in this cross environment.
+    mesonEmulatorHook
   ];
 
   buildInputs = [
+    gobject-introspection
+    dbus
     glib
     polkit
     systemd

pkgs/development/libraries/glibc/0001-Revert-Remove-all-usage-of-BASH-or-BASH-in-installed.patch

@@ -1,6 +1,6 @@
-From f81744bae4442345ff6f40d80fdb8adaba8b330f Mon Sep 17 00:00:00 2001
-From: Maximilian Bosch <maximilian@mbosch.me>
-Date: Fri, 27 Aug 2021 17:19:27 +0200
+From faeeb0f353f5540da2015a41cb60fe43d199a1ac Mon Sep 17 00:00:00 2001
+From: Bernardo Meurer <bernardo@meurer.org>
+Date: Fri, 22 Jul 2022 22:11:07 -0700
 Subject: [PATCH] Revert "Remove all usage of @BASH@ or ${BASH} in installed
  files, and hardcode /bin/bash instead"
 
@@ -8,6 +8,8 @@ We need the ability to override to use `/bin/sh` here to avoid having
 some bootstrap tools in a final build product.
 
 This reverts commit 5188a9d0265cc6f7235a8af1d31ab02e4a24853d.
+
+Co-authored-by: Maximilian Bosch <maximilian@mbosch.me>
 ---
  debug/Makefile     | 5 +++--
  debug/xtrace.sh    | 2 +-
@@ -20,10 +22,10 @@ This reverts commit 5188a9d0265cc6f7235a8af1d31ab02e4a24853d.
  8 files changed, 15 insertions(+), 10 deletions(-)
 
 diff --git a/debug/Makefile b/debug/Makefile
-index 6893111cbf..3f66666c6c 100644
+index 96029f32ee..cbbdeda277 100644
 --- a/debug/Makefile
 +++ b/debug/Makefile
-@@ -216,7 +216,8 @@ $(objpfx)pcprofiledump: $(objpfx)pcprofiledump.o
+@@ -238,7 +238,8 @@ $(objpfx)pcprofiledump: $(objpfx)pcprofiledump.o
  
  $(objpfx)xtrace: xtrace.sh
  	rm -f $@.new
@@ -35,20 +37,20 @@ index 6893111cbf..3f66666c6c 100644
  	    -e 's|@REPORT_BUGS_TO@|$(REPORT_BUGS_TO)|' $^ > $@.new \
  	&& rm -f $@ && mv $@.new $@ && chmod +x $@
 diff --git a/debug/xtrace.sh b/debug/xtrace.sh
-index 9697fbe0b4..279fe59ac6 100755
+index 8c56e01449..c760391a33 100755
 --- a/debug/xtrace.sh
 +++ b/debug/xtrace.sh
 @@ -1,4 +1,4 @@
 -#!/bin/bash
 +#! @BASH@
- # Copyright (C) 1999-2021 Free Software Foundation, Inc.
+ # Copyright (C) 1999-2022 Free Software Foundation, Inc.
  # This file is part of the GNU C Library.
- # Contributed by Ulrich Drepper <drepper@gnu.org>, 1999.
+ 
 diff --git a/elf/Makefile b/elf/Makefile
-index d05f410592..9264409fdd 100644
+index 3536b6af5e..83521d9dbc 100644
 --- a/elf/Makefile
 +++ b/elf/Makefile
-@@ -144,7 +144,8 @@ $(objpfx)sotruss-lib.so: $(common-objpfx)libc.so $(objpfx)ld.so \
+@@ -256,7 +256,8 @@ $(objpfx)sotruss-lib.so: $(common-objpfx)libc.so $(objpfx)ld.so \
  	$(common-objpfx)libc_nonshared.a
  
  $(objpfx)sotruss: sotruss.sh $(common-objpfx)config.make
@@ -58,7 +60,7 @@ index d05f410592..9264409fdd 100644
  	    -e 's%@TEXTDOMAINDIR@%$(localedir)%g' \
  	    -e 's%@PREFIX@%$(prefix)%g' \
  	    -e 's|@PKGVERSION@|$(PKGVERSION)|g' \
-@@ -659,6 +660,7 @@ ldd-rewrite = -e 's%@RTLD@%$(rtlddir)/$(rtld-installed-name)%g' \
+@@ -1363,6 +1364,7 @@ ldd-rewrite = -e 's%@RTLD@%$(rtlddir)/$(rtld-installed-name)%g' \
  	      -e 's%@VERSION@%$(version)%g' \
  	      -e 's|@PKGVERSION@|$(PKGVERSION)|g' \
  	      -e 's|@REPORT_BUGS_TO@|$(REPORT_BUGS_TO)|g' \
@@ -67,30 +69,30 @@ index d05f410592..9264409fdd 100644
  
  ifeq ($(ldd-rewrite-script),no)
 diff --git a/elf/ldd.bash.in b/elf/ldd.bash.in
-index ba736464ac..57442bc3f2 100644
+index 3253b32ef8..127eb59206 100644
 --- a/elf/ldd.bash.in
 +++ b/elf/ldd.bash.in
 @@ -1,4 +1,4 @@
 -#!/bin/bash
 +#! @BASH@
- # Copyright (C) 1996-2021 Free Software Foundation, Inc.
+ # Copyright (C) 1996-2022 Free Software Foundation, Inc.
  # This file is part of the GNU C Library.
  
 diff --git a/elf/sotruss.sh b/elf/sotruss.sh
-index 003cf4d825..fd4da80244 100755
+index 22327eac5c..7d15bf4fc8 100755
 --- a/elf/sotruss.sh
 +++ b/elf/sotruss.sh
 @@ -1,4 +1,4 @@
 -#!/bin/bash
 +#! @BASH@
- # Copyright (C) 2011-2021 Free Software Foundation, Inc.
+ # Copyright (C) 2011-2022 Free Software Foundation, Inc.
  # This file is part of the GNU C Library.
  
 diff --git a/malloc/Makefile b/malloc/Makefile
-index 9b70831d38..90ecadff6c 100644
+index 2329cf718a..5d7de4bee7 100644
 --- a/malloc/Makefile
 +++ b/malloc/Makefile
-@@ -271,8 +271,9 @@ $(objpfx)mtrace: mtrace.pl
+@@ -307,8 +307,9 @@ $(objpfx)mtrace: mtrace.pl
  
  $(objpfx)memusage: memusage.sh
  	rm -f $@.new
@@ -103,21 +105,21 @@ index 9b70831d38..90ecadff6c 100644
  	&& rm -f $@ && mv $@.new $@ && chmod +x $@
  
 diff --git a/malloc/memusage.sh b/malloc/memusage.sh
-index 0645f09911..c1cd4e23b7 100755
+index f447160b7d..faa4936639 100755
 --- a/malloc/memusage.sh
 +++ b/malloc/memusage.sh
 @@ -1,4 +1,4 @@
 -#!/bin/bash
 +#! @BASH@
- # Copyright (C) 1999-2021 Free Software Foundation, Inc.
+ # Copyright (C) 1999-2022 Free Software Foundation, Inc.
  # This file is part of the GNU C Library.
- # Contributed by Ulrich Drepper <drepper@gnu.org>, 1999.
+ 
 diff --git a/timezone/Makefile b/timezone/Makefile
-index c624a189b3..395abfeebd 100644
+index a789c22d26..d65bdf2391 100644
 --- a/timezone/Makefile
 +++ b/timezone/Makefile
-@@ -123,7 +123,8 @@ $(testdata)/XT%: testdata/XT%
- 	cp $< $@
+@@ -130,7 +130,8 @@ $(testdata)/XT5: testdata/gen-XT5.sh
+ 	mv $@.tmp $@
  
  $(objpfx)tzselect: tzselect.ksh $(common-objpfx)config.make
 -	sed -e 's|TZDIR=[^}]*|TZDIR=$(zonedir)|' \
@@ -127,5 +129,5 @@ index c624a189b3..395abfeebd 100644
  	    -e '/PKGVERSION=/s|=.*|="$(PKGVERSION)"|' \
  	    -e '/REPORT_BUGS_TO=/s|=.*|="$(REPORT_BUGS_TO)"|' \
 -- 
-2.31.1
+2.37.0
 

pkgs/development/libraries/glibc/common.nix

@@ -43,9 +43,9 @@
 } @ args:
 
 let
-  version = "2.34";
-  patchSuffix = "-210";
-  sha256 = "sha256-RNJqH+ILiFOkj0cOrQHkJ56GmsFJsZXdpORKGV2YGrI=";
+  version = "2.35";
+  patchSuffix = "-163";
+  sha256 = "sha256-USNzL2tnzNMZMF79OZlx1YWSEivMKmUYob0lEN0M9S4=";
 in
 
 assert withLinuxHeaders -> linuxHeaders != null;
@@ -62,14 +62,14 @@ stdenv.mkDerivation ({
   patches =
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
-          $ git fetch --all -p && git checkout origin/release/2.34/master && git describe
-          glibc-2.34-210-ge123f08ad5
-          $ git show --minimal --reverse glibc-2.34.. | gzip -9n --rsyncable - > 2.34-master.patch.gz
+          $ git fetch --all -p && git checkout origin/release/2.35/master && git describe
+          glibc-2.35-210-ge123f08ad5
+          $ git show --minimal --reverse glibc-2.35.. | gzip -9n --rsyncable - > 2.35-master.patch.gz
 
          To compare the archive contents zdiff can be used.
-          $ zdiff -u 2.34-master.patch.gz ../nixpkgs/pkgs/development/libraries/glibc/2.34-master.patch.gz
+          $ zdiff -u 2.35-master.patch.gz ../nixpkgs/pkgs/development/libraries/glibc/2.35-master.patch.gz
        */
-      ./2.34-master.patch.gz
+      ./2.35-master.patch.gz
 
       /* Allow NixOS and Nix to handle the locale-archive. */
       ./nix-locale-archive.patch
@@ -115,33 +115,12 @@ stdenv.mkDerivation ({
         sha256 = "091bk3kyrx1gc380gryrxjzgcmh1ajcj8s2rjhp2d2yzd5mpd5ps";
       })
 
-      /* Provide utf-8 locales by default, so we can use it in stdenv without depending on our large locale-archive. */
-      (fetchurl {
-        url = "https://salsa.debian.org/glibc-team/glibc/raw/49767c9f7de4828220b691b29de0baf60d8a54ec/debian/patches/localedata/locale-C.diff";
-        sha256 = "0irj60hs2i91ilwg5w7sqrxb695c93xg0ik7yhhq9irprd7fidn4";
-      })
-
       ./fix-x64-abi.patch
 
       /* https://github.com/NixOS/nixpkgs/pull/137601 */
       ./nix-nss-open-files.patch
 
       ./0001-Revert-Remove-all-usage-of-BASH-or-BASH-in-installed.patch
-
-      /* Fix segfault in getpwuid when stat fails
-         https://sourceware.org/bugzilla/show_bug.cgi?id=28752 */
-      (fetchurl {
-        url = "https://patchwork.sourceware.org/project/glibc/patch/20220314175316.3239120-2-sam@gentoo.org/raw/";
-        sha256 = "sq0BoPqXHQ69Vq4zJobCspe4XRfnAiuac/wqzVQJESc=";
-      })
-
-      /* Patch pending upstream inclusion to fix string.h syntax for older gcc.
-         Needed to unbreak gnat bootstrap against old gcc in nixpkgs:
-           https://patchwork.sourceware.org/project/glibc/patch/20220520150609.346566-1-slyfox@gentoo.org/ */
-      (fetchurl {
-        url = "https://patchwork.sourceware.org/project/glibc/patch/20220520150609.346566-1-slyfox@gentoo.org/raw/";
-        sha256 = "x3/eO1EHJXBIrH2WXHRRD1swtWv+btFVjvMt5tj/wDA=";
-      })
     ]
     ++ lib.optional stdenv.hostPlatform.isMusl ./fix-rpc-types-musl-conflicts.patch
     ++ lib.optional stdenv.buildPlatform.isDarwin ./darwin-cross-build.patch;
@@ -178,7 +157,7 @@ stdenv.mkDerivation ({
     [ "-C"
       "--enable-add-ons"
       "--sysconfdir=/etc"
-      "--enable-stackguard-randomization"
+      "--enable-stack-protector=strong"
       "--enable-bind-now"
       (lib.withFeatureAs withLinuxHeaders "headers" "${linuxHeaders}/include")
       (lib.enableFeature profilingLibraries "profile")
@@ -188,6 +167,9 @@ stdenv.mkDerivation ({
       # and on aarch64 with binutils 2.30 or later.
       # https://sourceware.org/glibc/wiki/PortStatus
       "--enable-static-pie"
+    ] ++ lib.optionals stdenv.hostPlatform.isx86 [
+      # Enable Intel Control-flow Enforcement Technology (CET) support
+      "--enable-cet"
     ] ++ lib.optionals withLinuxHeaders [
       "--enable-kernel=3.2.0" # can't get below with glibc >= 2.26
     ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [

pkgs/development/libraries/gobject-introspection/default.nix

@@ -90,7 +90,13 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dcairo=disabled"
     "-Dgtk_doc=${lib.boolToString (stdenv.hostPlatform == stdenv.buildPlatform)}"
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "-Dgi_cross_ldd_wrapper=${buildPackages.prelink}/bin/prelink-rtld"
+    "-Dgi_cross_ldd_wrapper=${substituteAll {
+      name = "g-ir-scanner-lddwrapper";
+      isExecutable = true;
+      src = ./wrappers/g-ir-scanner-lddwrapper.sh;
+      inherit (buildPackages) bash;
+      buildobjdump = "${buildPackages.stdenv.cc.bintools}/bin/objdump";
+    }}"
     "-Dgi_cross_use_prebuilt_gi=true"
     "-Dgi_cross_binary_wrapper=${stdenv.hostPlatform.emulator buildPackages}"
   ];

pkgs/development/libraries/gobject-introspection/giscanner-ignore-error-return-codes-from-ldd-wrapper.patch

@@ -1,32 +0,0 @@
-From e0fc4a2a5161a36483ddc518be9bb14390f11b19 Mon Sep 17 00:00:00 2001
-From: Alexander Kanavin <alex.kanavin@gmail.com>
-Date: Wed, 5 Sep 2018 16:46:52 +0200
-Subject: [PATCH] giscanner: ignore error return codes from ldd-wrapper
-
-prelink-rtld, which we use instead of ldd returns 127 when it can't find a library.
-It is not an error per se, but it breaks subprocess.check_output().
-
-Upstream-Status: Inappropriate [oe-core specific]
-Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
-Signed-off-by: Adam Duskett <aduskett@gmail.com>
----
- giscanner/shlibs.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/giscanner/shlibs.py b/giscanner/shlibs.py
-index 9f8ab5df..7a1a72fe 100644
---- a/giscanner/shlibs.py
-+++ b/giscanner/shlibs.py
-@@ -103,7 +103,7 @@ def _resolve_non_libtool(options, binary, libraries):
-             args.extend(['otool', '-L', binary.args[0]])
-         else:
-             args.extend(['ldd', binary.args[0]])
--        output = subprocess.check_output(args)
-+        output = subprocess.run(args, check=False, stdout=subprocess.PIPE).stdout
-         if isinstance(output, bytes):
-             output = output.decode("utf-8", "replace")
- 
--- 
-2.25.1
-
-

pkgs/development/libraries/gobject-introspection/wrapper.nix

@@ -18,24 +18,23 @@ in
 
 (gobject-introspection-unwrapped.override args).overrideAttrs (previousAttrs: {
   pname = "gobject-introspection-wrapped";
-  # failure in e.g. pkgsCross.aarch64-multiplatform.polkit
-  # subprocess.CalledProcessError: Command '['/nix/store/...-prelink-unstable-2019-06-24/bin/prelink-rtld', '/build/source/build/tmp-introspectzp2ldkyk/PolkitAgent-1.0']' returned non-zero exit status 127.
-  patches = previousAttrs.patches ++ [ ./giscanner-ignore-error-return-codes-from-ldd-wrapper.patch ];
   postFixup = (previousAttrs.postFixup or "") + ''
     mv $dev/bin/g-ir-compiler $dev/bin/.g-ir-compiler-wrapped
     mv $dev/bin/g-ir-scanner $dev/bin/.g-ir-scanner-wrapped
 
     (
-      export bash="${buildPackages.bash}/bin/bash"
+      export bash="${buildPackages.bash}"
       export emulator=${lib.escapeShellArg (stdenv.targetPlatform.emulator buildPackages)}
-      export buildprelink="${buildPackages.prelink}/bin/prelink-rtld"
+      export buildobjdump="${buildPackages.stdenv.cc.bintools}/bin/objdump"
 
       export targetgir="${lib.getDev (targetPackages.gobject-introspection-unwrapped.override argsForTarget)}"
 
       substituteAll "${./wrappers/g-ir-compiler.sh}" "$dev/bin/g-ir-compiler"
       substituteAll "${./wrappers/g-ir-scanner.sh}" "$dev/bin/g-ir-scanner"
+      substituteAll "${./wrappers/g-ir-scanner-lddwrapper.sh}" "$dev/bin/g-ir-scanner-lddwrapper"
       chmod +x "$dev/bin/g-ir-compiler"
       chmod +x "$dev/bin/g-ir-scanner"
+      chmod +x "$dev/bin/g-ir-scanner-lddwrapper"
     )
   ''
   # when cross-compiling and using the wrapper then when a package looks up the g_ir_X

pkgs/development/libraries/gobject-introspection/wrappers/g-ir-compiler.sh

@@ -1,4 +1,4 @@
-#! @bash@
+#! @bash@/bin/bash
 # shellcheck shell=bash
 
 exec @emulator@ @targetgir@/bin/g-ir-compiler "$@"

pkgs/development/libraries/gobject-introspection/wrappers/g-ir-scanner-lddwrapper.sh

@@ -0,0 +1,4 @@
+#! @bash@/bin/bash
+# shellcheck shell=bash
+
+exec @buildobjdump@ -p "$@"

pkgs/development/libraries/gobject-introspection/wrappers/g-ir-scanner.sh

@@ -1,7 +1,7 @@
-#! @bash@
+#! @bash@/bin/bash
 # shellcheck shell=bash
 
 exec @dev@/bin/.g-ir-scanner-wrapped \
     --use-binary-wrapper=@emulator@ \
-    --use-ldd-wrapper=@buildprelink@ \
+    --use-ldd-wrapper=@dev@/bin/g-ir-scanner-lddwrapper \
     "$@"

pkgs/development/libraries/harfbuzz/default.nix

@@ -30,7 +30,7 @@
 }:
 
 let
-  version = "3.3.2";
+  version = "5.0.1";
   inherit (lib) optional optionals optionalString;
   mesonFeatureFlag = opt: b:
     "-D${opt}=${if b then "enabled" else "disabled"}";
@@ -44,7 +44,7 @@ stdenv.mkDerivation {
     owner = "harfbuzz";
     repo = "harfbuzz";
     rev = version;
-    sha256 = "sha256-UbYqV7Ch9ugTIwSsCpjnS8H7tcv4P3OVpFDFDZtQCk0=";
+    sha256 = "sha256-01hpSTesPpUO2T9v1sq3VvCSFEOMyaxbHhX0vS1ms/k=";
   };
 
   postPatch = ''

pkgs/development/libraries/libqrtr-glib/default.nix

@@ -2,6 +2,7 @@
 , stdenv
 , fetchFromGitLab
 , meson
+, mesonEmulatorHook
 , ninja
 , pkg-config
 , gobject-introspection
@@ -39,16 +40,15 @@ stdenv.mkDerivation rec {
     gtk-doc
     docbook-xsl-nons
     docbook_xml_dtd_43
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    mesonEmulatorHook
   ];
 
   buildInputs = [
+    gobject-introspection
     glib
   ];
 
-  mesonFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-    "-Dgtk_doc=false"
-  ];
-
   meta = with lib; {
     homepage = "https://gitlab.freedesktop.org/mobile-broadband/libqrtr-glib";
     description = "Qualcomm IPC Router protocol helper library";

pkgs/development/libraries/libva/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libva" + lib.optionalString minimal "-minimal";
-  version = "2.14.0";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "libva";
     rev    = version;
-    sha256 = "0q395lg6gp05mwf04zbrwgj6q9073lahh3wrcfa2i8ll60cfq9fg";
+    sha256 = "sha256-NJA2FTPrhLj9+vmkBy+GcTiH57gBEQnYhZzYk3sEOBo=";
   };
 
   outputs = [ "dev" "out" ];

pkgs/development/libraries/libwacom/default.nix

@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libwacom";
-  version = "2.2.0";
+  version = "2.4.0";
 
   outputs = [ "out" "dev" ];
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    sha256 = "sha256-SqKXxmyP31kb6ikMQRqPaKNIpeLcMLLEGInCGIx5jWM=";
+    sha256 = "sha256-9uhnO+MqB7tAnSXjBcJWCzHGiz9izun4nVjFb17G8Gg=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/libxml2/default.nix

@@ -94,8 +94,10 @@ stdenv.mkDerivation rec {
 
   doCheck =
     (stdenv.hostPlatform == stdenv.buildPlatform) &&
-    !stdenv.isDarwin &&
     stdenv.hostPlatform.libc != "musl";
+  preCheck = lib.optional stdenv.isDarwin ''
+    export DYLD_LIBRARY_PATH="$PWD/.libs:$DYLD_LIBRARY_PATH"
+  '';
 
   preConfigure = lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11") ''
     MACOSX_DEPLOYMENT_TARGET=10.16

pkgs/development/libraries/nettle/default.nix

@@ -1,10 +1,10 @@
 { callPackage, fetchurl }:
 
 callPackage ./generic.nix rec {
-  version = "3.7.3";
+  version = "3.8";
 
   src = fetchurl {
     url = "mirror://gnu/nettle/nettle-${version}.tar.gz";
-    sha256 = "1w5wwc3q0r97d2ifhx77cw7y8s20bm8x52is9j93p2h47yq5w7v6";
+    hash = "sha256-dXbGhIHBmPZEsIwWDRpIULqUSeMIBpRVtSEzGfI06OY=";
   };
 }

pkgs/development/libraries/openal-soft/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openal-soft";
-  version = "1.22.0";
+  version = "1.22.2";
 
   src = fetchFromGitHub {
     owner = "kcat";
     repo = "openal-soft";
     rev = version;
-    sha256 = "sha256-Y2KhPkwtG6tBzUhSqwV2DVnOjZwxPihidLKahjaIvyU=";
+    sha256 = "sha256-MVM0qCZDWcO7/Hnco+0dBqzBLcWD279xjx0slxxlc4w=";
   };
 
   # this will make it find its own data files (e.g. HRTF profiles)

pkgs/development/libraries/opencv/4.x.nix

@@ -26,6 +26,8 @@
 , enableEXR ? !stdenv.isDarwin
 , openexr
 , ilmbase
+, enableJPEG2000 ? true
+, openjpeg
 , enableEigen ? true
 , eigen
 , enableOpenblas ? true
@@ -256,6 +258,7 @@ stdenv.mkDerivation {
     ++ lib.optional enableTIFF libtiff
     ++ lib.optional enableWebP libwebp
     ++ lib.optionals enableEXR [ openexr ilmbase ]
+    ++ lib.optional enableJPEG2000 openjpeg
     ++ lib.optional enableFfmpeg ffmpeg
     ++ lib.optionals (enableFfmpeg && stdenv.isDarwin)
       [ VideoDecodeAcceleration bzip2 ]
@@ -307,6 +310,8 @@ stdenv.mkDerivation {
     (opencvFlag "JPEG" enableJPEG)
     (opencvFlag "PNG" enablePNG)
     (opencvFlag "OPENEXR" enableEXR)
+    (opencvFlag "OPENJPEG" enableJPEG2000)
+    "-DWITH_JASPER=OFF" # OpenCV falls back to a vendored copy of Jasper when OpenJPEG is disabled
     (opencvFlag "CUDA" enableCuda)
     (opencvFlag "CUBLAS" enableCuda)
     (opencvFlag "TBB" enableTbb)

pkgs/development/libraries/openldap/default.nix

@@ -15,46 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openldap";
-  version = "2.6.2";
+  version = "2.6.3";
 
   src = fetchurl {
     url = "https://www.openldap.org/software/download/OpenLDAP/openldap-release/${pname}-${version}.tgz";
-    hash = "sha256-gdCTRSMutiSG7PWsrNLFbAxFtKbIwGZhLn9CGiOhz4c";
+    hash = "sha256-0qKh1x3z13OWscFq11AuZ030RuBgcrDlpOlBw9BsDUY=";
   };
 
-  patches = [
-    # ITS#9840 - ldif-filter: fix parallel build failure
-    (fetchpatch {
-      url = "https://github.com/openldap/openldap/commit/7d977f51e6dfa570a471d163b9e8255bdd3dc12f.patch";
-      hash = "sha256:1vid6pj2gmqywbghnd380x19ml241ldc1fyslb6br6q27zpgbdlp";
-    })
-    # ITS#9840 - libraries/Makefile.in: ignore the mkdir errors
-    (fetchpatch {
-      url = "https://github.com/openldap/openldap/commit/71f24015c312171c00ce94c9ff9b9c6664bdca8d.patch";
-      hash = "sha256:1a81vv6nkhgiadnj4g1wyzgzdp2zd151h0vkwvv9gzmqvhwcnc04";
-    })
-    # ITS#7165 back-mdb: check for stale readers on
-    (fetchpatch {
-      url = "https://github.com/openldap/openldap/commit/7e7f01c301db454e8c507999c77b55a1d97efc21.patch";
-      hash = "sha256:1fc2yck2gn3zlpfqjdn56ar206npi8cmb8yg5ny4lww0ygmyzdfz";
-    })
-    # ITS#9858 back-mdb: delay indexer task startup
-    (fetchpatch {
-      url = "https://github.com/openldap/openldap/commit/ac061c684cc79d64ab4089fe3020921a0064a307.patch";
-      hash = "sha256:01f0y50zlcj6n5mfkmb0di4p5vrlgn31zccx4a9k5m8vzxaqmw9d";
-    })
-    # ITS#9858 back-mdb: fix index reconfig
-    (fetchpatch {
-      url = "https://github.com/openldap/openldap/commit/c43c7a937cfb3a781f99b458b7ad71eb564a2bc2.patch";
-      hash = "sha256:02yh0c8cyx14iir5qhfam5shrg5d3115s2nv0pmqdj6najrqc5mm";
-    })
-    # ITS#9157: check for NULL ld
-    (fetchpatch {
-      url = "https://github.com/openldap/openldap/commit/6675535cd6ad01f9519ecd5d75061a74bdf095c7.patch";
-      hash = "sha256:0dali5ifcwba8400s065f0fizl9h44i0mzb06qgxhygff6yfrgif";
-    })
-  ];
-
   # TODO: separate "out" and "bin"
   outputs = [
     "out"
@@ -93,18 +60,18 @@ stdenv.mkDerivation rec {
     "ac_cv_func_memcmp_working=yes"
   ] ++ lib.optional stdenv.isFreeBSD "--with-pic";
 
-  makeFlags = [
+  NIX_CFLAGS_COMPILE = [ "-DLDAPI_SOCK=\"/run/openldap/ldapi\"" ];
+
+  makeFlags= [
     "CC=${stdenv.cc.targetPrefix}cc"
     "STRIP="  # Disable install stripping as it breaks cross-compiling. We strip binaries anyway in fixupPhase.
+    "STRIP_OPTS="
     "prefix=${placeholder "out"}"
-    "sysconfdir=${placeholder "out"}/etc"
+    "sysconfdir=/etc"
     "systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
     # contrib modules require these
     "moduledir=${placeholder "out"}/lib/modules"
     "mandir=${placeholder "out"}/share/man"
-  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-    # Can be unconditional, doing it like this to prevent a mass rebuild.
-    "STRIP_OPTS="
   ];
 
   extraContribModules = [
@@ -134,6 +101,7 @@ stdenv.mkDerivation rec {
 
   installFlags = [
     "prefix=${placeholder "out"}"
+    "sysconfdir=${placeholder "out"}/etc"
     "moduledir=${placeholder "out"}/lib/modules"
     "INSTALL=install"
   ];

pkgs/development/libraries/openssl/default.nix

@@ -44,9 +44,23 @@ let
       substituteInPlace crypto/async/arch/async_posix.h \
         --replace '!defined(__ANDROID__) && !defined(__OpenBSD__)' \
                   '!defined(__ANDROID__) && !defined(__OpenBSD__) && 0'
+    ''
+    # Move ENGINESDIR into OPENSSLDIR for static builds, in order to move
+    # it to the separate etc output.
+    + lib.optionalString static ''
+      substituteInPlace Configurations/unix-Makefile.tmpl \
+        --replace 'ENGINESDIR=$(libdir)/engines-{- $sover_dirname -}' \
+                  'ENGINESDIR=$(OPENSSLDIR)/engines-{- $sover_dirname -}'
     '';
 
-    outputs = [ "bin" "dev" "out" "man" ] ++ lib.optional withDocs "doc";
+    outputs = [ "bin" "dev" "out" "man" ]
+      ++ lib.optional withDocs "doc"
+      # Separate output for the runtime dependencies of the static build.
+      # Specifically, move OPENSSLDIR into this output, as its path will be
+      # compiled into 'libcrypto.a'. This makes it a runtime dependency of
+      # any package that statically links openssl, so we want to keep that
+      # output minimal.
+      ++ lib.optional static "etc";
     setOutputFlags = false;
     separateDebugInfo =
       !stdenv.hostPlatform.isDarwin &&
@@ -102,7 +116,14 @@ let
     configureFlags = [
       "shared" # "shared" builds both shared and static libraries
       "--libdir=lib"
-      "--openssldir=etc/ssl"
+      (if !static then
+         "--openssldir=etc/ssl"
+       else
+         # Move OPENSSLDIR to the 'etc' output for static builds. Prepend '/.'
+         # to the path to make it appear absolute before variable expansion,
+         # else the 'prefix' would be prepended to it.
+         "--openssldir=/.$(etc)/etc/ssl"
+      )
     ] ++ lib.optionals withCryptodev [
       "-DHAVE_CRYPTODEV"
       "-DUSE_CRYPTODEV_DIGESTS"
@@ -140,6 +161,9 @@ let
       if [ -n "$(echo $out/lib/*.so $out/lib/*.dylib $out/lib/*.dll)" ]; then
           rm "$out/lib/"*.a
       fi
+
+      # 'etc' is a separate output on static builds only.
+      etc=$out
     '') + lib.optionalString (!stdenv.hostPlatform.isWindows)
       # Fix bin/c_rehash's perl interpreter line
       #
@@ -161,14 +185,15 @@ let
       mv $out/include $dev/
 
       # remove dependency on Perl at runtime
-      rm -r $out/etc/ssl/misc
+      rm -r $etc/etc/ssl/misc
 
-      rmdir $out/etc/ssl/{certs,private}
+      rmdir $etc/etc/ssl/{certs,private}
     '';
 
     postFixup = lib.optionalString (!stdenv.hostPlatform.isWindows) ''
-      # Check to make sure the main output doesn't depend on perl
-      if grep -r '${buildPackages.perl}' $out; then
+      # Check to make sure the main output and the static runtime dependencies
+      # don't depend on perl
+      if grep -r '${buildPackages.perl}' $out $etc; then
         echo "Found an erroneous dependency on perl ^^^" >&2
         exit 1
       fi

pkgs/development/libraries/qt-5/5.12/default.nix

@@ -164,7 +164,7 @@ let
         inherit bison cups harfbuzz libGL;
         withGtk3 = !stdenv.isDarwin; inherit dconf gtk3;
         inherit debug developerBuild decryptSslTraffic;
-        inherit (darwin.apple_sdk.frameworks) AGL AppKit ApplicationServices Carbon Cocoa CoreAudio CoreBluetooth
+        inherit (darwin.apple_sdk.frameworks) AGL AppKit ApplicationServices AVFoundation Carbon Cocoa CoreAudio CoreBluetooth
           CoreLocation CoreServices DiskArbitration Foundation OpenGL MetalKit IOKit;
         inherit (darwin) libobjc;
       };

pkgs/development/libraries/qt-5/5.14/default.nix

@@ -162,7 +162,7 @@ let
         inherit bison cups harfbuzz libGL;
         withGtk3 = !stdenv.isDarwin; inherit dconf gtk3;
         inherit debug developerBuild decryptSslTraffic;
-        inherit (darwin.apple_sdk.frameworks) AGL AppKit ApplicationServices Carbon Cocoa CoreAudio CoreBluetooth
+        inherit (darwin.apple_sdk.frameworks) AGL AppKit ApplicationServices AVFoundation Carbon Cocoa CoreAudio CoreBluetooth
           CoreLocation CoreServices DiskArbitration Foundation OpenGL MetalKit IOKit;
         inherit (darwin) libobjc;
       };

pkgs/development/libraries/qt-5/5.15/default.nix

@@ -43,6 +43,8 @@ let
       # Patch framework detection to support X.framework/X.tbd,
       # extending the current support for X.framework/X.
       ./qtbase.patch.d/0012-qtbase-tbd-frameworks.patch
+
+      ./qtbase.patch.d/0014-aarch64-darwin.patch
     ] ++ [
       ./qtbase.patch.d/0003-qtbase-mkspecs.patch
       ./qtbase.patch.d/0004-qtbase-replace-libdir.patch
@@ -119,7 +121,7 @@ let
         inherit bison cups harfbuzz libGL;
         withGtk3 = !stdenv.isDarwin; inherit dconf gtk3;
         inherit developerBuild decryptSslTraffic;
-        inherit (darwin.apple_sdk.frameworks) AGL AppKit ApplicationServices Carbon Cocoa CoreAudio CoreBluetooth
+        inherit (darwin.apple_sdk.frameworks) AGL AppKit ApplicationServices AVFoundation Carbon Cocoa CoreAudio CoreBluetooth
           CoreLocation CoreServices DiskArbitration Foundation OpenGL MetalKit IOKit;
         inherit (darwin) libobjc;
       };

pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/0014-aarch64-darwin.patch

@@ -0,0 +1,287 @@
+From abc52460201bc5c7603505bb187138b0c59291aa Mon Sep 17 00:00:00 2001
+From: Mushroom <mushroom@watchingyour.tv>
+Date: Sun, 20 Dec 2020 00:11:41 +0000
+Subject: [PATCH] [QtBase] Split macOS platforms by architecture
+
+Currently macOS only has one platform, which forces the default arch to
+x86_64. This patch splits the platforms by architecture, and defaults to
+the same as the host.
+
+This stops M1-based macs from compiling x64 binaries by default,
+instead making them compile native binaries.
+
+[ChangeLog][QtBase][Platform Specific Changes][OS X] Split macOS
+platforms so it doesn't default to the x64 architecture every time
+
+Change-Id: I34891b107bb24f68371df1c8f087eb0ad5b5dd95
+---
+ configure                                     |  9 +++-
+ .../clang-macx-desktop.conf}                  |  8 ++--
+ mkspecs/common/macx.conf                      |  1 -
+ .../Info.plist.app                            |  0
+ .../Info.plist.dSYM.in                        |  0
+ .../Info.plist.disable_highdpi                |  0
+ .../Info.plist.lib                            |  0
+ mkspecs/macx-clang-arm64/qmake.conf           |  7 ++++
+ .../qplatformdefs.h                           |  0
+ mkspecs/macx-clang-x64/Info.plist.app         | 24 +++++++++++
+ mkspecs/macx-clang-x64/Info.plist.dSYM.in     | 18 ++++++++
+ .../macx-clang-x64/Info.plist.disable_highdpi |  8 ++++
+ mkspecs/macx-clang-x64/Info.plist.lib         | 20 +++++++++
+ mkspecs/macx-clang-x64/qmake.conf             |  7 ++++
+ mkspecs/macx-clang-x64/qplatformdefs.h        | 41 +++++++++++++++++++
+ 15 files changed, 137 insertions(+), 6 deletions(-)
+ rename mkspecs/{macx-clang/qmake.conf => common/clang-macx-desktop.conf} (83%)
+ rename mkspecs/{macx-clang => macx-clang-arm64}/Info.plist.app (100%)
+ rename mkspecs/{macx-clang => macx-clang-arm64}/Info.plist.dSYM.in (100%)
+ rename mkspecs/{macx-clang => macx-clang-arm64}/Info.plist.disable_highdpi (100%)
+ rename mkspecs/{macx-clang => macx-clang-arm64}/Info.plist.lib (100%)
+ create mode 100644 mkspecs/macx-clang-arm64/qmake.conf
+ rename mkspecs/{macx-clang => macx-clang-arm64}/qplatformdefs.h (100%)
+ create mode 100644 mkspecs/macx-clang-x64/Info.plist.app
+ create mode 100644 mkspecs/macx-clang-x64/Info.plist.dSYM.in
+ create mode 100644 mkspecs/macx-clang-x64/Info.plist.disable_highdpi
+ create mode 100644 mkspecs/macx-clang-x64/Info.plist.lib
+ create mode 100644 mkspecs/macx-clang-x64/qmake.conf
+ create mode 100644 mkspecs/macx-clang-x64/qplatformdefs.h
+
+diff --git a/configure b/configure
+index b6c9b462f24..a86f2ceaa5b 100755
+--- a/configure
++++ b/configure
+@@ -556,7 +556,14 @@ PLATFORM_NOTES=
+ if [ -z "$PLATFORM" ]; then
+     case "$UNAME_SYSTEM:$UNAME_RELEASE" in
+      Darwin:*)
+-        PLATFORM=macx-clang
++        case "$UNAME_MACHINE" in
++            arm64)
++                PLATFORM=macx-clang-arm64
++                ;;
++            *)
++                PLATFORM=macx-clang-x64
++                ;;
++        esac
+         ;;
+      AIX:*)
+         #PLATFORM=aix-g++
+diff --git a/mkspecs/macx-clang/qmake.conf b/mkspecs/common/clang-macx-desktop.conf
+similarity index 83%
+rename from mkspecs/macx-clang/qmake.conf
+rename to mkspecs/common/clang-macx-desktop.conf
+index 0cf1f31b60d..042319a2aa3 100644
+--- a/mkspecs/macx-clang/qmake.conf
++++ b/mkspecs/common/clang-macx-desktop.conf
+@@ -24,9 +24,9 @@ QMAKE_LIBS_X11 = -lX11 -lXext -lm
+ QMAKE_LIBDIR_X11 = /opt/X11/lib
+ QMAKE_INCDIR_X11 = /opt/X11/include
+ 
+-include(../common/macx.conf)
+-include(../common/gcc-base-mac.conf)
+-include(../common/clang.conf)
+-include(../common/clang-mac.conf)
++include(macx.conf)
++include(gcc-base-mac.conf)
++include(clang.conf)
++include(clang-mac.conf)
+ 
+ load(qt_config)
+diff --git a/mkspecs/common/macx.conf b/mkspecs/common/macx.conf
+index d16b77acb8e..4ba0a8eaa36 100644
+--- a/mkspecs/common/macx.conf
++++ b/mkspecs/common/macx.conf
+@@ -6,7 +6,6 @@ QMAKE_PLATFORM         += macos osx macx
+ QMAKE_MAC_SDK           = macosx
+ 
+ QMAKE_MACOSX_DEPLOYMENT_TARGET = 10.13
+-QMAKE_APPLE_DEVICE_ARCHS = x86_64
+ 
+ # Should be 10.15, but as long as the CI builds with
+ # older SDKs we have to keep this.
+diff --git a/mkspecs/macx-clang/Info.plist.app b/mkspecs/macx-clang-arm64/Info.plist.app
+similarity index 100%
+rename from mkspecs/macx-clang/Info.plist.app
+rename to mkspecs/macx-clang-arm64/Info.plist.app
+diff --git a/mkspecs/macx-clang/Info.plist.dSYM.in b/mkspecs/macx-clang-arm64/Info.plist.dSYM.in
+similarity index 100%
+rename from mkspecs/macx-clang/Info.plist.dSYM.in
+rename to mkspecs/macx-clang-arm64/Info.plist.dSYM.in
+diff --git a/mkspecs/macx-clang/Info.plist.disable_highdpi b/mkspecs/macx-clang-arm64/Info.plist.disable_highdpi
+similarity index 100%
+rename from mkspecs/macx-clang/Info.plist.disable_highdpi
+rename to mkspecs/macx-clang-arm64/Info.plist.disable_highdpi
+diff --git a/mkspecs/macx-clang/Info.plist.lib b/mkspecs/macx-clang-arm64/Info.plist.lib
+similarity index 100%
+rename from mkspecs/macx-clang/Info.plist.lib
+rename to mkspecs/macx-clang-arm64/Info.plist.lib
+diff --git a/mkspecs/macx-clang-arm64/qmake.conf b/mkspecs/macx-clang-arm64/qmake.conf
+new file mode 100644
+index 00000000000..0cc2361e696
+--- /dev/null
++++ b/mkspecs/macx-clang-arm64/qmake.conf
+@@ -0,0 +1,7 @@
++#
++# qmake configuration for Clang on OS X (arm64)
++#
++
++QMAKE_APPLE_DEVICE_ARCHS=arm64
++
++include(../common/clang-macx-desktop.conf)
+diff --git a/mkspecs/macx-clang/qplatformdefs.h b/mkspecs/macx-clang-arm64/qplatformdefs.h
+similarity index 100%
+rename from mkspecs/macx-clang/qplatformdefs.h
+rename to mkspecs/macx-clang-arm64/qplatformdefs.h
+diff --git a/mkspecs/macx-clang-x64/Info.plist.app b/mkspecs/macx-clang-x64/Info.plist.app
+new file mode 100644
+index 00000000000..fa592af0897
+--- /dev/null
++++ b/mkspecs/macx-clang-x64/Info.plist.app
+@@ -0,0 +1,24 @@
++<?xml version="1.0" encoding="UTF-8"?>
++<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
++<plist version="1.0">
++<dict>
++	<key>CFBundleExecutable</key>
++	<string>${EXECUTABLE_NAME}</string>
++	<key>CFBundleIconFile</key>
++	<string>${ASSETCATALOG_COMPILER_APPICON_NAME}</string>
++	<key>CFBundleIdentifier</key>
++	<string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
++	<key>CFBundlePackageType</key>
++	<string>APPL</string>
++	<key>CFBundleSignature</key>
++	<string>${QMAKE_PKGINFO_TYPEINFO}</string>
++	<key>LSMinimumSystemVersion</key>
++	<string>${MACOSX_DEPLOYMENT_TARGET}</string>
++	<key>NOTE</key>
++	<string>This file was generated by Qt/QMake.</string>
++	<key>NSPrincipalClass</key>
++	<string>NSApplication</string>
++	<key>NSSupportsAutomaticGraphicsSwitching</key>
++	<true/>
++</dict>
++</plist>
+diff --git a/mkspecs/macx-clang-x64/Info.plist.dSYM.in b/mkspecs/macx-clang-x64/Info.plist.dSYM.in
+new file mode 100644
+index 00000000000..a8c8d0d4fb5
+--- /dev/null
++++ b/mkspecs/macx-clang-x64/Info.plist.dSYM.in
+@@ -0,0 +1,18 @@
++<?xml version=\"1.0\" encoding=\"UTF-8\"?>
++<!DOCTYPE plist PUBLIC \"-//Apple Computer//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">
++<plist version=\"1.0\">
++	<dict>
++		<key>CFBundleIdentifier</key>
++		<string>com.apple.xcode.dsym.$${BUNDLEIDENTIFIER}</string>
++		<key>CFBundlePackageType</key>
++		<string>dSYM</string>
++		<key>CFBundleSignature</key>
++		<string>????</string>
++!!IF !isEmpty(VERSION)
++		<key>CFBundleShortVersionString</key>
++		<string>$${VER_MAJ}.$${VER_MIN}</string>
++		<key>CFBundleVersion</key>
++		<string>$${VER_MAJ}.$${VER_MIN}.$${VER_PAT}</string>
++!!ENDIF
++	</dict>
++</plist>
+diff --git a/mkspecs/macx-clang-x64/Info.plist.disable_highdpi b/mkspecs/macx-clang-x64/Info.plist.disable_highdpi
+new file mode 100644
+index 00000000000..a9b89888ad4
+--- /dev/null
++++ b/mkspecs/macx-clang-x64/Info.plist.disable_highdpi
+@@ -0,0 +1,8 @@
++<?xml version="1.0" encoding="UTF-8"?>
++<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
++<plist version="1.0">
++<dict>
++	<key>NSHighResolutionCapable</key>
++	<string>NO</string>
++</dict>
++</plist>
+diff --git a/mkspecs/macx-clang-x64/Info.plist.lib b/mkspecs/macx-clang-x64/Info.plist.lib
+new file mode 100644
+index 00000000000..34752ec40d9
+--- /dev/null
++++ b/mkspecs/macx-clang-x64/Info.plist.lib
+@@ -0,0 +1,20 @@
++<?xml version="1.0" encoding="UTF-8"?>
++<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
++<plist version="1.0">
++<dict>
++	<key>CFBundleExecutable</key>
++	<string>${EXECUTABLE_NAME}</string>
++	<key>CFBundleIdentifier</key>
++	<string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
++	<key>CFBundlePackageType</key>
++	<string>FMWK</string>
++	<key>CFBundleShortVersionString</key>
++	<string>${QMAKE_SHORT_VERSION}</string>
++	<key>CFBundleSignature</key>
++	<string>${QMAKE_PKGINFO_TYPEINFO}</string>
++	<key>CFBundleVersion</key>
++	<string>${QMAKE_FULL_VERSION}</string>
++	<key>NOTE</key>
++	<string>Please, do NOT change this file -- It was generated by Qt/QMake.</string>
++</dict>
++</plist>
+diff --git a/mkspecs/macx-clang-x64/qmake.conf b/mkspecs/macx-clang-x64/qmake.conf
+new file mode 100644
+index 00000000000..1ac373b53b4
+--- /dev/null
++++ b/mkspecs/macx-clang-x64/qmake.conf
+@@ -0,0 +1,7 @@
++#
++# qmake configuration for Clang on OS X (arm64)
++#
++
++QMAKE_APPLE_DEVICE_ARCHS=x86_64
++
++include(../common/clang-macx-desktop.conf)
+diff --git a/mkspecs/macx-clang-x64/qplatformdefs.h b/mkspecs/macx-clang-x64/qplatformdefs.h
+new file mode 100644
+index 00000000000..063491dd900
+--- /dev/null
++++ b/mkspecs/macx-clang-x64/qplatformdefs.h
+@@ -0,0 +1,41 @@
++/****************************************************************************
++**
++** Copyright (C) 2016 The Qt Company Ltd.
++** Contact: https://www.qt.io/licensing/
++**
++** This file is part of the qmake spec of the Qt Toolkit.
++**
++** $QT_BEGIN_LICENSE:LGPL$
++** Commercial License Usage
++** Licensees holding valid commercial Qt licenses may use this file in
++** accordance with the commercial license agreement provided with the
++** Software or, alternatively, in accordance with the terms contained in
++** a written agreement between you and The Qt Company. For licensing terms
++** and conditions see https://www.qt.io/terms-conditions. For further
++** information use the contact form at https://www.qt.io/contact-us.
++**
++** GNU Lesser General Public License Usage
++** Alternatively, this file may be used under the terms of the GNU Lesser
++** General Public License version 3 as published by the Free Software
++** Foundation and appearing in the file LICENSE.LGPL3 included in the
++** packaging of this file. Please review the following information to
++** ensure the GNU Lesser General Public License version 3 requirements
++** will be met: https://www.gnu.org/licenses/lgpl-3.0.html.
++**
++** GNU General Public License Usage
++** Alternatively, this file may be used under the terms of the GNU
++** General Public License version 2.0 or (at your option) the GNU General
++** Public license version 3 or any later version approved by the KDE Free
++** Qt Foundation. The licenses are as published by the Free Software
++** Foundation and appearing in the file LICENSE.GPL2 and LICENSE.GPL3
++** included in the packaging of this file. Please review the following
++** information to ensure the GNU General Public License requirements will
++** be met: https://www.gnu.org/licenses/gpl-2.0.html and
++** https://www.gnu.org/licenses/gpl-3.0.html.
++**
++** $QT_END_LICENSE$
++**
++****************************************************************************/
++
++#include "../common/mac/qplatformdefs.h"
++

pkgs/development/libraries/qt-5/modules/qtbase.nix

@@ -4,7 +4,7 @@
 , coreutils, bison, flex, gdb, gperf, lndir, perl, pkg-config, python3
 , which
   # darwin support
-, libiconv, libobjc, xcbuild, AGL, AppKit, ApplicationServices, Carbon, Cocoa, CoreAudio, CoreBluetooth
+, libiconv, libobjc, xcbuild, AGL, AppKit, ApplicationServices, AVFoundation, Carbon, Cocoa, CoreAudio, CoreBluetooth
 , CoreLocation, CoreServices, DiskArbitration, Foundation, OpenGL, MetalKit, IOKit
 
 , dbus, fontconfig, freetype, glib, harfbuzz, icu, libdrm, libX11, libXcomposite
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
   ] ++ (
     if stdenv.isDarwin then [
       # TODO: move to buildInputs, this should not be propagated.
-      AGL AppKit ApplicationServices Carbon Cocoa CoreAudio CoreBluetooth
+      AGL AppKit ApplicationServices AVFoundation Carbon Cocoa CoreAudio CoreBluetooth
       CoreLocation CoreServices DiskArbitration Foundation OpenGL
       libobjc libiconv MetalKit IOKit
     ] else [
@@ -284,7 +284,6 @@ stdenv.mkDerivation {
   ] ++ lib.optional (compareVersion "5.15.0" < 0) "-v"
     ++ (
       if stdenv.isDarwin then [
-      "-platform macx-clang"
       "-no-fontconfig"
       "-qt-freetype"
       "-qt-libpng"
@@ -377,7 +376,7 @@ stdenv.mkDerivation {
     #   error: unknown target CPU 'armv8.3-a+crypto+sha2+aes+crc+fp16+lse+simd+ras+rdm+rcpc'
     #   note: valid target CPU values are: nocona, core2, penryn, ..., znver1, znver2, x86-64
     # it seems the qmake/cmake passes x86_64 as preferred architecture somewhere
-    broken = stdenv.isDarwin && stdenv.isAarch64;
+    broken = stdenv.isDarwin && stdenv.isAarch64 && (compareVersion "5.15.3" < 0);
   };
 
 }

pkgs/development/libraries/sqlite/default.nix

@@ -17,13 +17,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${optionalString interactive "-interactive"}";
-  version = "3.39.1";
+  version = "3.39.2";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2022/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "sha256-h8jnp/oMaKso4gi6SfOiKlYADb9TpvkCBuK8WEOTHMQ=";
+    sha256 = "sha256-hSvophg6F7pHzuC7/3QAt6pa/9KDvzvu/DT80IiiOd4=";
   };
 
   outputs = [ "bin" "dev" "out" ];

pkgs/development/libraries/sqlite/tools.nix

@@ -4,12 +4,12 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.39.1";
+    version = "3.39.2";
 
     # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2022/sqlite-src-${archiveVersion version}.zip";
-      sha256 = "sha256-Nmx6u+5dvoiCzXV4phpu0/XQjF9t41NaAAMSW0ZGzFc=";
+      sha256 = "sha256-6TPXcAD0Xz+8hgXwBQWGowE1Bajem0QDK9AO1y8VhvA=";
     };
 
     nativeBuildInputs = [ unzip ];

pkgs/development/python-modules/prompt-toolkit/default.nix

@@ -30,6 +30,8 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
+    # tests/test_completion.py:206: AssertionError
+    # https://github.com/prompt-toolkit/python-prompt-toolkit/issues/1657
     "test_pathcompleter_can_expanduser"
   ];
 

pkgs/development/python-modules/pygobject/3.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pygobject";
-  version = "3.42.1";
+  version = "3.42.2";
 
   outputs = [ "out" "dev" ];
 
@@ -27,7 +27,7 @@ buildPythonPackage rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "HzS192JN415E61p+tCg1MoW9AwBNVRMaX39/qbkPPMk=";
+    sha256 = "rehpXipwc4Sd0DFtMdhyjhXh4Lxx2f9tHAnoa+UryVc=";
   };
 
   depsBuildBuild = [

pkgs/development/python-modules/tomlkit/default.nix

@@ -1,5 +1,11 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27
-, enum34, functools32, typing ? null
+{ lib
+, buildPythonPackage
+, fetchPypi
+, isPy27
+, enum34
+, functools32, typing ? null
+, pytestCheckHook
+, pyaml
 }:
 
 buildPythonPackage rec {
@@ -15,10 +21,12 @@ buildPythonPackage rec {
     lib.optionals isPy27 [ enum34 functools32 ]
     ++ lib.optional isPy27 typing;
 
-  # The Pypi tarball doesn't include tests, and the GitHub source isn't
-  # buildable until we bootstrap poetry, see
-  # https://github.com/NixOS/nixpkgs/pull/53599#discussion_r245855665
-  doCheck = false;
+  checkInputs = [
+    pyaml
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "tomlkit" ];
 
   meta = with lib; {
     homepage = "https://github.com/sdispater/tomlkit";

pkgs/development/tools/misc/prelink/default.nix

@@ -31,16 +31,8 @@ stdenv.mkDerivation rec {
     libiberty
   ];
 
-  # Disable some tests because they're failing
-  preCheck = ''
-    for f in reloc2 layout1 unprel1 tls3 cxx2 cxx3 quick1 quick2 deps1 deps2; do
-      echo '#' > testsuite/''${f}.sh
-    done
-    patchShebangs --build testsuite
-  '';
-
   # most tests fail
-  doCheck = !stdenv.isAarch64;
+  doCheck = false;
 
   enableParallelBuilding = true;
 

pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix

@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alsa-lib";
-  version = "1.2.7.1";
+  version = "1.2.7.2";
 
   src = fetchurl {
     url = "mirror://alsa/lib/${pname}-${version}.tar.bz2";
-    hash = "sha256-BG3ELfz60mkhe+BZVGhhN+XnOX8wQTcvjG3NfXlGHmE=";
+    hash = "sha256-ijW3IY5Q8qLHk0LQ3pje2BQ5zhnhKAk4Xsm+lZbefC8=";
   };
 
   patches = [

pkgs/os-specific/linux/kmod/darwin.patch

@@ -1,138 +0,0 @@
-diff --git a/Makefile.am b/Makefile.am
-index 194e111..0a095b5 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -80,8 +80,7 @@ EXTRA_DIST += libkmod/README \
- 	libkmod/COPYING testsuite/COPYING tools/COPYING COPYING
- 
- libkmod_libkmod_la_LDFLAGS = $(AM_LDFLAGS) \
--	-version-info $(LIBKMOD_CURRENT):$(LIBKMOD_REVISION):$(LIBKMOD_AGE) \
--	-Wl,--version-script=$(top_srcdir)/libkmod/libkmod.sym
-+	-version-info $(LIBKMOD_CURRENT):$(LIBKMOD_REVISION):$(LIBKMOD_AGE)
- libkmod_libkmod_la_DEPENDENCIES = \
- 	shared/libshared.la \
- 	${top_srcdir}/libkmod/libkmod.sym
-@@ -91,8 +90,7 @@ libkmod_libkmod_la_LIBADD = \
- 
- noinst_LTLIBRARIES += libkmod/libkmod-internal.la
- libkmod_libkmod_internal_la_SOURCES = $(libkmod_libkmod_la_SOURCES)
--libkmod_libkmod_internal_la_LDFLAGS = $(AM_LDFLAGS) \
--	-Wl,--version-script=$(top_srcdir)/libkmod/libkmod.sym
-+libkmod_libkmod_internal_la_LDFLAGS = $(AM_LDFLAGS)
- libkmod_libkmod_internal_la_DEPENDENCIES  = $(libkmod_libkmod_la_DEPENDENCIES)
- libkmod_libkmod_internal_la_LIBADD = $(libkmod_libkmod_la_LIBADD)
- 
-diff --git a/libkmod/libkmod-module.c b/libkmod/libkmod-module.c
-index 889f264..6f0a285 100644
---- a/libkmod/libkmod-module.c
-+++ b/libkmod/libkmod-module.c
-@@ -787,7 +787,11 @@ KMOD_EXPORT int kmod_module_remove_module(struct kmod_module *mod,
- 	flags &= KMOD_REMOVE_FORCE;
- 	flags |= KMOD_REMOVE_NOWAIT;
- 
-+#if defined(__linux__)
- 	err = delete_module(mod->name, flags);
-+#else
-+	err = -1;
-+#endif
- 	if (err != 0) {
- 		err = -errno;
- 		ERR(mod->ctx, "could not remove '%s': %m\n", mod->name);
-@@ -879,7 +883,11 @@ KMOD_EXPORT int kmod_module_insert_module(struct kmod_module *mod,
- 	}
- 	size = kmod_file_get_size(mod->file);
- 
-+#if defined(__linux__)
- 	err = init_module(mem, size, args);
-+#else
-+	err = -1;
-+#endif
- init_finished:
- 	if (err < 0) {
- 		err = -errno;
-diff --git a/libkmod/libkmod-signature.c b/libkmod/libkmod-signature.c
-index 429ffbd..17a3b9c 100644
---- a/libkmod/libkmod-signature.c
-+++ b/libkmod/libkmod-signature.c
-@@ -17,7 +17,10 @@
-  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
-  */
- 
-+#if defined(__linux__)
- #include <endian.h>
-+#endif
-+
- #include <inttypes.h>
- #include <stdio.h>
- #include <stdlib.h>
-diff --git a/shared/macro.h b/shared/macro.h
-index 4fc5405..b5a2702 100644
---- a/shared/macro.h
-+++ b/shared/macro.h
-@@ -53,6 +53,10 @@
- #define CONCATENATE(x, y) XCONCATENATE(x, y)
- #define UNIQ(x) CONCATENATE(x, __COUNTER__)
-
-+#if !defined(__linux__)
-+#define program_invocation_short_name getprogname()
-+#endif
-+
- /* Temporaries for importing index handling */
- #define NOFAIL(x) (x)
- #define fatal(x...) do { } while (0)
-diff --git a/shared/missing.h b/shared/missing.h
-index 4c0d136..ad8ec0f 100644
---- a/shared/missing.h
-+++ b/shared/missing.h
-@@ -45,6 +45,9 @@ static inline int finit_module(int fd, const char *uargs, int flags)
- #endif
- 
- #if !HAVE_DECL_BE32TOH
-+
-+#if defined(__linux__)
-+
- #include <endian.h>
- #include <byteswap.h>
- #if __BYTE_ORDER == __LITTLE_ENDIAN
-@@ -52,4 +55,16 @@ static inline int finit_module(int fd, const char *uargs, int flags)
- #else
- #define be32toh(x) (x)
- #endif
-+
-+#elif defined(__APPLE__)
-+
-+#include <libkern/OSByteOrder.h>
-+#define be32toh(x) OSSwapBigToHostInt32(x)
-+
-+#else
-+
-+#error No be32toh known for platform
-+
-+#endif
-+
- #endif
-diff --git a/shared/util.c b/shared/util.c
-index fd2028d..ecb0141 100644
---- a/shared/util.c
-+++ b/shared/util.c
-@@ -367,7 +367,7 @@ char *path_make_absolute_cwd(const char *p)
- 	if (path_is_absolute(p))
- 		return strdup(p);
- 
--	cwd = get_current_dir_name();
-+	cwd = getcwd(NULL, 0);
- 	if (!cwd)
- 		return NULL;
- 
---- a/shared/util.h	2018-01-31 18:10:59.000000000 +0100
-+++ b/shared/util.h	2020-12-28 19:48:21.000000000 +0100
-@@ -7,6 +7,9 @@
- #include <stdio.h>
- #include <sys/types.h>
- #include <sys/stat.h>
-+#ifdef __APPLE__
-+#include <libgen.h>
-+#endif
- 
- #include <shared/macro.h>
- 

pkgs/os-specific/linux/kmod/default.nix

@@ -31,7 +31,7 @@ in stdenv.mkDerivation rec {
 
     docbook_xml_dtd_42 # for the man pages
   ] ++ lib.optionals withDevdoc [ docbook_xml_dtd_43 gtk-doc ];
-  buildInputs = [ xz zstd ] ++ lib.optional stdenv.isDarwin elf-header;
+  buildInputs = [ xz zstd ];
 
   preConfigure = ''
     ./autogen.sh
@@ -46,7 +46,6 @@ in stdenv.mkDerivation rec {
   ] ++ lib.optional withStatic "--enable-static";
 
   patches = [ ./module-dir.patch ]
-    ++ lib.optional stdenv.isDarwin ./darwin.patch
     ++ lib.optional withStatic ./enable-static.patch;
 
   postInstall = ''
@@ -77,7 +76,7 @@ in stdenv.mkDerivation rec {
     downloadPage = "https://www.kernel.org/pub/linux/utils/kernel/kmod/";
     changelog = "https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git/plain/NEWS?h=v${version}";
     license = with licenses; [ lgpl21Plus gpl2Plus ]; # GPLv2+ for tools
-    platforms = platforms.unix;
+    platforms = platforms.linux;
     maintainers = with maintainers; [ artturin ];
   };
 }

pkgs/os-specific/linux/libbpf/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "libbpf";
     rev = "v${version}";
-    sha256 = "sha256-D2ASqSZFNShCdRCH8LDocLP/O4sME9nT73rk1KsJeJE=";
+    sha256 = "sha256-daVS+TErmDU8ksThOvcepg1A61iD8N8GIkC40cmc9/8=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/os-specific/linux/linux-wifi-hotspot/default.nix

@@ -14,7 +14,15 @@
 , iproute2
 , flock
 , iptables
-, gawk }:
+, gawk
+, coreutils
+, gnugrep
+, gnused
+, kmod
+, networkmanager
+, procps
+}:
+
 
 stdenv.mkDerivation rec {
   pname = "linux-wifi-hotspot";
@@ -56,7 +64,21 @@ stdenv.mkDerivation rec {
   postInstall = ''
     wrapProgram $out/bin/create_ap \
       --prefix PATH : ${lib.makeBinPath [
-          hostapd getopt iw which dnsmasq iproute2 flock iptables gawk
+          coreutils
+          dnsmasq
+          flock
+          gawk
+          getopt
+          gnugrep
+          gnused
+          hostapd
+          iproute2
+          iptables
+          iw
+          kmod
+          networkmanager
+          procps
+          which
         ]}
 
     wrapProgram $out/bin/wihotspot-gui \

pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch

@@ -1,7 +1,7 @@
-From c8b50208dce4c467c1f85c3db3e05bdcfd43c378 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Tue, 8 Jan 2013 15:46:30 +0100
-Subject: [PATCH 01/18] Start device units for uninitialised encrypted devices
+Subject: [PATCH] Start device units for uninitialised encrypted devices
 
 This is necessary because the NixOS service that initialises the
 filesystem depends on the appearance of the device unit.  Also, this
@@ -27,6 +27,3 @@ index 25b8a590a6..d18999ea87 100644
  # add symlink to GPT root disk
  SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}!="crypto_LUKS", SYMLINK+="gpt-auto-root"
  SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}=="crypto_LUKS", SYMLINK+="gpt-auto-root-luks"
--- 
-2.36.1
-

pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch

@@ -1,7 +1,7 @@
-From c884aee4c66c97f592ae0f8ebd97f48a39d8c53c Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Fri, 12 Apr 2013 13:16:57 +0200
-Subject: [PATCH 02/18] Don't try to unmount /nix or /nix/store
+Subject: [PATCH] Don't try to unmount /nix or /nix/store
 
 They'll still be remounted read-only.
 
@@ -37,6 +37,3 @@ index 820aa8e286..653e43053d 100644
  #if ! HAVE_SPLIT_USR
                  || path_equal(path, "/usr")
  #endif
--- 
-2.36.1
-

pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch

@@ -1,7 +1,7 @@
-From eb3ff76f95bfe248f517e029ea1b152f4983370a Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Wed, 16 Apr 2014 10:59:28 +0200
-Subject: [PATCH 03/18] Fix NixOS containers
+Subject: [PATCH] Fix NixOS containers
 
 In NixOS containers, the init script is bind-mounted into the
 container, so checking early whether it exists will fail.
@@ -10,7 +10,7 @@ container, so checking early whether it exists will fail.
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index c5fd978395..0fa415f5b5 100644
+index 4ce80bba70..bb149192bd 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
 @@ -5651,6 +5651,7 @@ static int run(int argc, char *argv[]) {
@@ -29,6 +29,3 @@ index c5fd978395..0fa415f5b5 100644
                  }
  
          } else {
--- 
-2.36.1
-

pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch

@@ -1,7 +1,7 @@
-From 789ca236fdc81dc3f514ddad3354eeb5fa8cc7d8 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Thu, 1 May 2014 14:10:10 +0200
-Subject: [PATCH 04/18] Look for fsck in the right place
+Subject: [PATCH] Look for fsck in the right place
 
 ---
  src/fsck/fsck.c | 2 +-
@@ -20,6 +20,3 @@ index 745d01ff50..dd4eef45c3 100644
                  cmdline[i++] =  arg_repair;
                  cmdline[i++] = "-T";
  
--- 
-2.36.1
-

pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch

@@ -1,7 +1,7 @@
-From 6871d9637bc653a976e04cd595697d7244a293e2 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Fri, 19 Dec 2014 14:46:17 +0100
-Subject: [PATCH 05/18] Add some NixOS-specific unit directories
+Subject: [PATCH] Add some NixOS-specific unit directories
 
 Look in `/nix/var/nix/profiles/default/lib/systemd/{system,user}` for
 units provided by packages installed into the default profile via
@@ -92,7 +92,7 @@ index 1f4331a8bf..4b9a8ae26e 100644
  
                  if (!add)
 diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index fc0f8c34fa..162432e77f 100644
+index 693433b34b..5932a21b5b 100644
 --- a/src/core/systemd.pc.in
 +++ b/src/core/systemd.pc.in
 @@ -38,10 +38,10 @@ systemdsystemconfdir=${systemd_system_conf_dir}
@@ -121,6 +121,3 @@ index fc0f8c34fa..162432e77f 100644
  systemdusergeneratorpath=${systemd_user_generator_path}
  
  systemd_sleep_dir=${root_prefix}/lib/systemd/system-sleep
--- 
-2.36.1
-

pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch

@@ -1,7 +1,7 @@
-From 67daf22c74a780e283a493a0f9fdbbea2ce0aaba Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Mon, 11 May 2015 15:39:38 +0200
-Subject: [PATCH 06/18] Get rid of a useless message in user sessions
+Subject: [PATCH] Get rid of a useless message in user sessions
 
 Namely lots of variants of
 
@@ -26,6 +26,3 @@ index 296b759959..71ef7f27b4 100644
  
                  /* If stopping a unit fails continuously we might enter a stop loop here, hence stop acting on the
                   * service being unnecessary after a while. */
--- 
-2.36.1
-

pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch

@@ -1,8 +1,8 @@
-From 21b9acb1d4202a022475a24db727055f9dd2532a Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Gabriel Ebner <gebner@gebner.org>
 Date: Sun, 6 Dec 2015 14:26:36 +0100
-Subject: [PATCH 07/18] hostnamed, localed, timedated: disable methods that
- change system settings.
+Subject: [PATCH] hostnamed, localed, timedated: disable methods that change
+ system settings.
 
 ---
  src/hostname/hostnamed.c |  6 ++++++
@@ -103,6 +103,3 @@ index 9ca5d37b75..e41d8d73df 100644
          r = context_update_ntp_status(c, bus, m);
          if (r < 0)
                  return r;
--- 
-2.36.1
-

pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch

@@ -1,7 +1,7 @@
-From 3894fcd76e5791e094c685c0095006b6867893c1 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Thu, 7 Jul 2016 02:47:13 +0300
-Subject: [PATCH 08/18] Fix hwdb paths
+Subject: [PATCH] Fix hwdb paths
 
 Patch by vcunat.
 ---
@@ -23,6 +23,3 @@ index 62d27f7b89..87318e041b 100644
 -        UDEVLIBEXECDIR "/hwdb.bin\0"
 +        "/etc/udev/hwdb.bin\0"
 +
--- 
-2.36.1
-

pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch

@@ -1,7 +1,7 @@
-From 322fe2a15ac92d38f6952a2f7fd66e56eaa0f1f4 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Tue, 11 Oct 2016 13:12:08 +0300
-Subject: [PATCH 09/18] Change /usr/share/zoneinfo to /etc/zoneinfo
+Subject: [PATCH] Change /usr/share/zoneinfo to /etc/zoneinfo
 
 NixOS uses this path.
 ---
@@ -35,7 +35,7 @@ index e486474c44..5f373d0723 100644
      <literal>Etc/UTC</literal>. The resulting link should lead to the
      corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index c309369406..e0d84a7cfa 100644
+index 0ad8de4b9a..b794c6c7d0 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
 @@ -1281,7 +1281,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
@@ -88,7 +88,7 @@ index 39160182ef..8dcc3307c8 100644
          (void) mkdir_parents(etc_localtime, 0755);
          if (symlink(e, etc_localtime) < 0)
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 0fa415f5b5..b4404fff49 100644
+index bb149192bd..08751ed944 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
 @@ -1901,8 +1901,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
@@ -136,6 +136,3 @@ index e41d8d73df..ff1a384b3b 100644
                  if (!p)
                          return -ENOMEM;
  
--- 
-2.36.1
-

pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch

@@ -1,7 +1,7 @@
-From 35dd77fafe73cc4a648f101163945cbcae8ed6b9 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Imuli <i@imu.li>
 Date: Wed, 19 Oct 2016 08:46:47 -0400
-Subject: [PATCH 10/18] localectl: use /etc/X11/xkb for list-x11-*
+Subject: [PATCH] localectl: use /etc/X11/xkb for list-x11-*
 
 NixOS has an option to link the xkb data files to /etc/X11, but not to
 /usr/share/X11.
@@ -22,6 +22,3 @@ index 661d54c27d..e98b578531 100644
          if (!f)
                  return log_error_errno(errno, "Failed to open keyboard mapping list. %m");
  
--- 
-2.36.1
-

pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch

@@ -1,17 +1,17 @@
-From 1928e1d8eda7d3e296170bb5bd813463cc3e679c Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Franz Pletz <fpletz@fnordicwalking.de>
 Date: Sun, 11 Feb 2018 04:37:44 +0100
-Subject: [PATCH 11/18] build: don't create statedir and don't touch prefixdir
+Subject: [PATCH] build: don't create statedir and don't touch prefixdir
 
 ---
  meson.build | 3 ---
  1 file changed, 3 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index 36cbfa4893..a10d6a3eb7 100644
+index 9c170acc0a..818b7a3eb5 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -3926,9 +3926,6 @@ install_data('LICENSE.GPL2',
+@@ -3928,9 +3928,6 @@ install_data('LICENSE.GPL2',
  install_subdir('LICENSES',
                 install_dir : docdir)
  
@@ -21,6 +21,3 @@ index 36cbfa4893..a10d6a3eb7 100644
  ############################################################
  
  # Ensure that changes to the docs/ directory do not break the
--- 
-2.36.1
-

pkgs/os-specific/linux/systemd/0012-add-rootprefix-to-lookup-dir-paths.patch

@@ -1,7 +1,7 @@
-From 201b588b4b30fb53aefaed43e5d434373a076cb0 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Andreas Rammhold <andreas@rammhold.de>
 Date: Thu, 9 May 2019 11:15:22 +0200
-Subject: [PATCH 12/18] add rootprefix to lookup dir paths
+Subject: [PATCH] add rootprefix to lookup dir paths
 
 systemd does not longer use the UDEVLIBEXEC directory as root for
 discovery default udev rules. By adding `$out/lib` to the lookup paths
@@ -33,6 +33,3 @@ index 0a1ae023a3..cc00ff6c68 100644
  
  #define CONF_PATHS(n)                           \
          CONF_PATHS_USR(n)                       \
--- 
-2.36.1
-

pkgs/os-specific/linux/systemd/0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch

@@ -1,7 +1,7 @@
-From 67434c58caddf7dd3cef66dd3e3f704d39e4bcb0 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Thu, 25 Jul 2019 20:45:55 +0300
-Subject: [PATCH 13/18] systemd-shutdown: execute scripts in
+Subject: [PATCH] systemd-shutdown: execute scripts in
  /etc/systemd/system-shutdown
 
 This is needed for NixOS to use such scripts as systemd directory is immutable.
@@ -22,6 +22,3 @@ index 2c3cbec02c..1b876203c6 100644
  
          /* The log target defaults to console, but the original systemd process will pass its log target in through a
           * command line argument, which will override this default. Also, ensure we'll never log to the journal or
--- 
-2.36.1
-

pkgs/os-specific/linux/systemd/0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch

@@ -1,8 +1,7 @@
-From db1280d020e6d46a994240e755ce369d895322c5 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Thu, 25 Jul 2019 20:46:58 +0300
-Subject: [PATCH 14/18] systemd-sleep: execute scripts in
- /etc/systemd/system-sleep
+Subject: [PATCH] systemd-sleep: execute scripts in /etc/systemd/system-sleep
 
 This is needed for NixOS to use such scripts as systemd directory is immutable.
 ---
@@ -21,6 +20,3 @@ index 65e391d02a..28af2f8bf5 100644
                  NULL
          };
  
--- 
-2.36.1
-

pkgs/os-specific/linux/systemd/0015-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch

@@ -1,27 +0,0 @@
-From ac9f97341e6fe3fb4b5fe22e72f43312ef5b1ca4 Mon Sep 17 00:00:00 2001
-From: Florian Klink <flokli@flokli.de>
-Date: Sat, 7 Mar 2020 22:40:27 +0100
-Subject: [PATCH 15/18] kmod-static-nodes.service: Update ConditionFileNotEmpty
-
-On NixOS, kernel modules of the currently booted systems are located at
-/run/booted-system/kernel-modules/lib/modules/%v/, not /lib/modules/%v/.
----
- units/kmod-static-nodes.service.in | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/units/kmod-static-nodes.service.in b/units/kmod-static-nodes.service.in
-index 777e82d16b..b6abc2bba0 100644
---- a/units/kmod-static-nodes.service.in
-+++ b/units/kmod-static-nodes.service.in
-@@ -12,7 +12,7 @@ Description=Create List of Static Device Nodes
- DefaultDependencies=no
- Before=sysinit.target systemd-tmpfiles-setup-dev.service
- ConditionCapability=CAP_SYS_MODULE
--ConditionFileNotEmpty=/lib/modules/%v/modules.devname
-+ConditionFileNotEmpty=/run/booted-system/kernel-modules/lib/modules/%v/modules.devname
- 
- [Service]
- Type=oneshot
--- 
-2.36.1
-

pkgs/os-specific/linux/systemd/0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch

@@ -1,7 +1,7 @@
-From 6f40d7a9d0029b5a805245b938ac62e7b150ea75 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Florian Klink <flokli@flokli.de>
 Date: Sun, 8 Mar 2020 01:05:54 +0100
-Subject: [PATCH 16/18] path-util.h: add placeholder for DEFAULT_PATH_NORMAL
+Subject: [PATCH] path-util.h: add placeholder for DEFAULT_PATH_NORMAL
 
 This will be the $PATH used to lookup ExecStart= etc. options, which
 systemd itself uses extensively.
@@ -28,6 +28,3 @@ index 553aa4fb58..46294f4bb1 100644
  
  #if HAVE_SPLIT_USR
  #  define DEFAULT_PATH DEFAULT_PATH_SPLIT_USR
--- 
-2.36.1
-

pkgs/os-specific/linux/systemd/0016-pkg-config-derive-prefix-from-prefix.patch

@@ -1,7 +1,7 @@
-From 8d9355264f11034a28ad78e4e70809908acfdb3e Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
 Date: Sun, 6 Dec 2020 08:34:19 +0100
-Subject: [PATCH 17/18] pkg-config: derive prefix from --prefix
+Subject: [PATCH] pkg-config: derive prefix from --prefix
 
 Point prefix to the one configured, instead of `/usr` `systemd` has limited
 support for making the pkgconfig prefix overridable, and interpolates those
@@ -16,7 +16,7 @@ Co-Authored-By: Florian Klink <flokli@flokli.de>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index 162432e77f..2fc20daf03 100644
+index 5932a21b5b..20bf8e316d 100644
 --- a/src/core/systemd.pc.in
 +++ b/src/core/systemd.pc.in
 @@ -11,7 +11,7 @@
@@ -28,6 +28,3 @@ index 162432e77f..2fc20daf03 100644
  root_prefix={{ROOTPREFIX_NOSLASH}}
  rootprefix=${root_prefix}
  sysconf_dir={{SYSCONF_DIR}}
--- 
-2.36.1
-

pkgs/os-specific/linux/systemd/0017-inherit-systemd-environment-when-calling-generators.patch

@@ -1,7 +1,7 @@
-From 291ead07daab980fa39fd18512c8266c23161540 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Yuriy Taraday <yorik.sar@gmail.com>
 Date: Fri, 17 Jun 2022 12:45:10 +0000
-Subject: [PATCH 18/18] inherit systemd environment when calling generators.
+Subject: [PATCH] inherit systemd environment when calling generators.
 
 Systemd generators need access to the environment configured in
 stage-2-init.sh since it schedules fsck and mkfs executions based on
@@ -37,6 +37,3 @@ index 71ef7f27b4..33ded94a7c 100644
  
          r = strv_env_assign(&nl, "SYSTEMD_SCOPE", MANAGER_IS_SYSTEM(m) ? "system" : "user");
          if (r < 0)
--- 
-2.36.1
-

pkgs/os-specific/linux/systemd/default.nix

@@ -149,7 +149,8 @@ stdenv.mkDerivation {
 
   # On major changes, or when otherwise required, you *must* reformat the patches,
   # `git am path/to/00*.patch` them into a systemd worktree, rebase to the more recent
-  # systemd version, and export the patches again via `git -c format.signoff=false format-patch v${version}`.
+  # systemd version, and export the patches again via
+  # `git -c format.signoff=false format-patch v${version} --no-numbered --zero-commit --no-signature`.
   # Use `find . -name "*.patch" | sort` to get an up-to-date listing of all patches
   patches = [
     ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch
@@ -166,10 +167,9 @@ stdenv.mkDerivation {
     ./0012-add-rootprefix-to-lookup-dir-paths.patch
     ./0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
     ./0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
-    ./0015-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
-    ./0016-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
-    ./0017-pkg-config-derive-prefix-from-prefix.patch
-    ./0018-inherit-systemd-environment-when-calling-generators.patch
+    ./0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+    ./0016-pkg-config-derive-prefix-from-prefix.patch
+    ./0017-inherit-systemd-environment-when-calling-generators.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {

pkgs/stdenv/generic/setup.sh

@@ -771,9 +771,18 @@ substitute() {
 }
 
 substituteInPlace() {
-    local fileName="$1"
-    shift
-    substitute "$fileName" "$fileName" "$@"
+    local -a fileNames=()
+    for arg in "$@"; do
+        if [[ "$arg" = "--"* ]]; then
+            break
+        fi
+        fileNames+=("$arg")
+        shift
+    done
+
+    for file in "${fileNames[@]}"; do
+        substitute "$file" "$file" "$@"
+    done
 }
 
 _allFlags() {

pkgs/tools/filesystems/ntfs-3g/default.nix

@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
     "--enable-extras"
     "--with-mount-helper=${mount}/bin/mount"
     "--with-umount-helper=${mount}/bin/umount"
+  ] ++ lib.optionals stdenv.isLinux [
     "--with-modprobe-helper=${kmod}/bin/modprobe"
   ];
 

pkgs/tools/system/pciutils/default.nix

@@ -14,10 +14,11 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ zlib kmod which ] ++
-    lib.optional stdenv.hostPlatform.isDarwin IOKit;
+  buildInputs = [ which zlib ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ IOKit ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [ kmod ];
 
-  preConfigure = if stdenv.cc.isGNU then null else ''
+  preConfigure = lib.optionalString (!stdenv.cc.isGNU) ''
     substituteInPlace Makefile --replace 'CC=$(CROSS_COMPILE)gcc' ""
   '';
 

pkgs/top-level/all-packages.nix

@@ -2607,44 +2607,15 @@ with pkgs;
 
   go-audit = callPackage ../tools/system/go-audit { };
 
-  gopass = callPackage ../tools/security/gopass {
-    buildGoModule = __buildGo118ModuleCL417615;
-  };
+  gopass = callPackage ../tools/security/gopass { };
 
-  gopass-hibp = callPackage ../tools/security/gopass/hibp.nix {
-    buildGoModule = __buildGo118ModuleCL417615;
-  };
+  gopass-hibp = callPackage ../tools/security/gopass/hibp.nix { };
 
-  gopass-jsonapi = callPackage ../tools/security/gopass/jsonapi.nix {
-    buildGoModule = __buildGo118ModuleCL417615;
-  };
+  gopass-jsonapi = callPackage ../tools/security/gopass/jsonapi.nix { };
 
-  git-credential-gopass = callPackage ../tools/security/gopass/git-credential.nix {
-    buildGoModule = __buildGo118ModuleCL417615;
-  };
+  git-credential-gopass = callPackage ../tools/security/gopass/git-credential.nix { };
 
-  gopass-summon-provider = callPackage ../tools/security/gopass/summon.nix {
-    buildGoModule = __buildGo118ModuleCL417615;
-  };
-
-  # custom override for go 1.18 including the revert of CL411617, CL417615.
-  # Can be dropped if/once go 1.18.5 is released with CL417615.
-  # or when staging go 1.18.4 includes the revert.
-  __buildGo118ModuleCL417615 = let
-    fetchBase64Patch = args: (fetchpatch args).overrideAttrs (o: {
-      postFetch = "mv $out p; base64 -d p > $out; " + o.postFetch;
-    });
-  in darwin.apple_sdk_11_0.callPackage ../development/go-modules/generic {
-    go = buildPackages.go_1_18.overrideAttrs (oldAttrs: rec {
-      patches = oldAttrs.patches or [] ++ [
-        # https://go-review.googlesource.com/c/go/+/417615/
-        (fetchBase64Patch {
-          url = "https://go-review.googlesource.com/changes/go~417615/revisions/3/patch";
-          sha256 = "sha256-Gu5eZUwGGch7et75A/BNynbs4VlQUBClVUxjxPkdjOs=";
-        })
-      ];
-    });
-  };
+  gopass-summon-provider = callPackage ../tools/security/gopass/summon.nix { };
 
   gosh = callPackage ../tools/security/gosh { };
 
@@ -13032,9 +13003,9 @@ with pkgs;
   clangMultiStdenv = overrideCC stdenv buildPackages.clang_multi;
   multiStdenv = if stdenv.cc.isClang then clangMultiStdenv else gccMultiStdenv;
 
-  gcc_debug = lowPrio (wrapCC (gcc.cc.override {
-    stripped = false;
-  }));
+  gcc_debug = lowPrio (wrapCC (gcc.cc.overrideAttrs (_: {
+    dontStrip = true;
+  })));
 
   gccCrossLibcStdenv = overrideCC stdenv buildPackages.gccCrossStageStatic;
 
@@ -27395,6 +27366,7 @@ with pkgs;
   gitMinimal = git.override {
     withManual = false;
     pythonSupport = false;
+    perlSupport = false;
     withpcre2 = false;
   };
 

pkgs/top-level/darwin-packages.nix

@@ -120,8 +120,10 @@ impure-cmds // appleSourcePackages // chooseLibs // {
     executable = true;
 
     text = ''
-      CODESIGN_ALLOCATE=${targetPrefix}codesign_allocate \
-        ${self.sigtool}/bin/codesign -f -s - "$linkerOutput"
+      if [ "$linkerOutput" != "/dev/null" ]; then
+        CODESIGN_ALLOCATE=${targetPrefix}codesign_allocate \
+          ${self.sigtool}/bin/codesign -f -s - "$linkerOutput"
+      fi
     '';
   };
 

pkgs/top-level/perl-packages.nix

@@ -13030,12 +13030,12 @@ let
 
   LWP = buildPerlPackage {
     pname = "libwww-perl";
-    version = "6.49";
+    version = "6.67";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/libwww-perl-6.49.tar.gz";
-      sha256 = "19k0cg4j4qz005a4ngy48z4r8dc99dxlpq8kvj7qnk15mvgd1r63";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/libwww-perl-6.67.tar.gz";
+      sha256 = "sha256-lu7ECj/QqhvYNBF75eshxDj3MJTYYaGn5XdPCxImtyM=";
     };
-    propagatedBuildInputs = [ FileListing HTMLParser HTTPCookies HTTPDaemon HTTPNegotiate NetHTTP TryTiny WWWRobotRules ];
+    propagatedBuildInputs = [ FileListing HTMLParser HTTPCookies HTTPNegotiate NetHTTP TryTiny WWWRobotRules ];
     # support cross-compilation by avoiding using `has_module` which does not work in miniperl (it requires B native module)
     postPatch = lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
       substituteInPlace Makefile.PL --replace 'if has_module' 'if 0; #'
@@ -13045,7 +13045,7 @@ let
       description = "The World-Wide Web library for Perl";
       license = with licenses; [ artistic1 gpl1Plus ];
     };
-    buildInputs = [ TestFatal TestNeeds TestRequiresInternet ];
+    checkInputs = [ HTTPDaemon TestFatal TestNeeds TestRequiresInternet ];
   };
 
   LWPAuthenOAuth = buildPerlPackage {
@@ -20028,6 +20028,7 @@ let
       license = with lib.licenses; [ artistic1 gpl1Plus ];
     };
     buildInputs = [ TestWarn XMLParserLite ];
+    checkInputs = [ HTTPDaemon ];
   };
 
   Socket6 = buildPerlPackage {
@@ -24473,6 +24474,7 @@ let
       IPCShareLite
       JSON
       LWP
+      HTTPDaemon
       pkgs.cairo
       pkgs.mapnik
       pkgs.zlib