Merge branch 'staging' into staging-next

doc/hooks/versionCheckHook.section.md

@@ -30,7 +30,7 @@ The variables that this phase control are:
 
 - `dontVersionCheck`: Disable adding this hook to the [`preInstallCheckHooks`](#ssec-installCheck-phase). Useful if you do want to load the bash functions of the hook, but run them differently.
 - `versionCheckProgram`: The full path to the program that should print the `${version}` string. Defaults to using the first non-empty value `$binary` out of `${NIX_MAIN_PROGRAM}` and `${pname}`, in that order, to build roughly `${placeholder "out"}/bin/$binary`. `${NIX_MAIN_PROGRAM}`'s value comes from `meta.mainProgram`, and does not normally need to be set explicitly. When setting `versionCheckProgram`, using `$out` directly won't work, as environment variables from this variable are not expanded by the hook. Hence using `placeholder "out"` is unavoidable.
-- `versionCheckProgramArg`: The argument that needs to be passed to `versionCheckProgram`. If undefined the hook tries first `--help` and then `--version`. Examples: `version`, `-V`, `-v`.
+- `versionCheckProgramArg`: The argument that needs to be passed to `versionCheckProgram`. If undefined the hook tries first `--version` and then `--help`. Examples: `version`, `-V`, `-v`.
 - `versionCheckKeepEnvironment`: A list of environment variables to keep and pass to the command. Only those variables should be added to this list that are actually required for the version command to work. If it is not feasible to explicitly list all these environment variables you can set this parameter to the special value `"*"` to disable the `--ignore-environment` flag and thus keep all environment variables.
 - `preVersionCheck`: A hook to run before the check is done.
 - `postVersionCheck`: A hook to run after the check is done.

doc/languages-frameworks/perl.section.md

@@ -71,7 +71,7 @@ To install it with `nix-env` instead: `nix-env -f. -iA perlPackages.ClassC3`.
 So what does `buildPerlPackage` do? It does the following:
 
 1. In the configure phase, it calls `perl Makefile.PL` to generate a Makefile. You can set the variable `makeMakerFlags` to pass flags to `Makefile.PL`
-2. It adds the contents of the `PERL5LIB` environment variable to `#! .../bin/perl` line of Perl scripts as `-Idir` flags. This ensures that a script can find its dependencies. (This can cause this shebang line to become too long for Darwin to handle; see the note below.)
+2. It adds the contents of the `PERL5LIB` environment variable to a use lib statement at the start of Perl scripts. This ensures that a script can find its dependencies.
 3. In the fixup phase, it writes the propagated build inputs (`propagatedBuildInputs`) to the file `$out/nix-support/propagated-user-env-packages`. `nix-env` recursively installs all packages listed in this file when you install a package that has it. This ensures that a Perl package can find its dependencies.
 
 `buildPerlPackage` is built on top of `stdenv`, so everything can be customised in the usual way. For instance, the `BerkeleyDB` module has a `preConfigure` hook to generate a configuration file used by `Makefile.PL`:
@@ -120,37 +120,6 @@ Dependencies on other Perl packages can be specified in the `buildInputs` and `p
 }
 ```
 
-On Darwin, if a script has too many `-Idir` flags in its first line (its “shebang line”), it will not run. This can be worked around by calling the `shortenPerlShebang` function from the `postInstall` phase:
-
-```nix
-{
-  lib,
-  stdenv,
-  buildPerlPackage,
-  fetchurl,
-  shortenPerlShebang,
-}:
-
-{
-  ImageExifTool = buildPerlPackage {
-    pname = "Image-ExifTool";
-    version = "12.50";
-
-    src = fetchurl {
-      url = "https://exiftool.org/Image-ExifTool-${version}.tar.gz";
-      hash = "sha256-vOhB/FwQMC8PPvdnjDvxRpU6jAZcC6GMQfc0AH4uwKg=";
-    };
-
-    nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin shortenPerlShebang;
-    postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
-      shortenPerlShebang $out/bin/exiftool
-    '';
-  };
-}
-```
-
-This will remove the `-I` flags from the shebang line, rewrite them in the `use lib` form, and put them on the next line instead. This function can be given any number of Perl scripts as arguments; it will modify them in-place.
-
 ### Generation from CPAN {#ssec-generation-from-CPAN}
 
 Nix expressions for Perl packages can be generated (almost) automatically from CPAN. This is done by the program `nix-generate-from-cpan`, which can be installed as follows:

doc/languages-frameworks/qt.section.md

@@ -25,15 +25,7 @@ stdenv.mkDerivation {
 
 The same goes for Qt 5 where libraries and tools are under `libsForQt5`.
 
-Any Qt package should include `wrapQtAppsHook` or `wrapQtAppsNoGuiHook` in `nativeBuildInputs`, or explicitly set `dontWrapQtApps` to bypass generating the wrappers.
-
-::: {.note}
-
-`wrapQtAppsHook` propagates plugins and QML components from `qtwayland` on platforms that support it, to allow applications to act as native Wayland clients. It should be used for all graphical applications.
-
-`wrapQtAppsNoGuiHook` does not propagate `qtwayland` to reduce closure size for purely command-line applications.
-
-:::
+Any Qt package should include `wrapQtAppsHook` in `nativeBuildInputs`, or explicitly set `dontWrapQtApps` to bypass generating the wrappers.
 
 ## Packages supporting multiple Qt versions {#qt-versions}
 

doc/languages-frameworks/typst.section.md

@@ -22,7 +22,7 @@ Since **Typst Universe** does not provide a way to fetch a package with a specif
 ```nix
 typst.withPackages.override
   (old: {
-    typstPackages = old.typstPackages.extend (
+    typstPackages = old.typstPackages.overrideScope (
       _: previous: {
         polylux_0_4_0 = previous.polylux_0_4_0.overrideAttrs (oldPolylux: {
           src = oldPolylux.src.overrideAttrs { outputHash = YourUpToDatePolyluxHash; };

doc/release-notes/rl-2605.section.md

@@ -3,7 +3,11 @@
 ## Highlights {#sec-nixpkgs-release-26.05-highlights}
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Create the first release note entry in this section!
+- GCC has been updated from GCC 14 to GCC 15.
+  This introduces some backwards incompatible changes; Refer to the [upstream porting guide](https://gcc.gnu.org/gcc-15/porting_to.html) for details.
+
+- Node.js default version has been updated from 22 LTS to 24 LTS.
+  This introduces some breaking changes; Refer to the [upstream migration article](https://nodejs.org/en/blog/migrations/v22-to-v24) for details.
 
 ## Backward Incompatibilities {#sec-nixpkgs-release-26.05-incompatibilities}
 

lib/licenses.nix

@@ -64,6 +64,11 @@ lib.mapAttrs mkLicense (
       free = false;
     };
 
+    adobeDisplayPostScript = {
+      spdxId = "Adobe-Display-PostScript";
+      fullName = "Adobe Display PostScript License";
+    };
+
     adobeUtopia = {
       fullName = "Adobe Utopia Font License";
       spdxId = "Adobe-Utopia";
@@ -501,6 +506,11 @@ lib.mapAttrs mkLicense (
       fullName = "curl License";
     };
 
+    dec3Clause = {
+      spdxId = "DEC-3-Clause";
+      fullName = "DEC 3-Clause License";
+    };
+
     doc = {
       spdxId = "DOC";
       fullName = "DOC License";
@@ -727,6 +737,11 @@ lib.mapAttrs mkLicense (
       spdxId = "HPND-sell-variant";
     };
 
+    hpndSellVariantMitDisclaimerXserver = {
+      spdxId = "HPND-sell-MIT-disclaimer-xserver";
+      fullName = "Historical Permission Notice and Disclaimer - sell xserver variant with MIT disclaimer";
+    };
+
     hpndDec = {
       fullName = "Historical Permission Notice and Disclaimer - DEC variant";
       spdxId = "HPND-DEC";
@@ -1113,6 +1128,13 @@ lib.mapAttrs mkLicense (
       fullName = "Non-Profit Open Software License 3.0";
     };
 
+    # NTP is basically HPND, but spdx and the OSI recognize it
+    # hpnd says "and without fee", ntp "with or without fee"
+    ntp = {
+      spdxId = "NTP";
+      fullName = "NTP License";
+    };
+
     nvidiaCuda = {
       shortName = "CUDA EULA";
       fullName = "CUDA Toolkit End User License Agreement (EULA)";

maintainers/maintainer-list.nix

@@ -29355,6 +29355,12 @@
     email = "rasmus@liaskar.net";
     githubId = 152716976;
   };
+  zivarah = {
+    name = "Brian Lyles";
+    github = "zivarah";
+    email = "brianmlyles@gmail.com";
+    githubId = 1123282;
+  };
   zlepper = {
     name = "Rasmus Hansen";
     github = "zlepper";

nixos/tests/lvm2/default.nix

@@ -4,11 +4,11 @@
   pkgs ? import ../../.. { inherit system config; },
   lib ? pkgs.lib,
   kernelVersionsToTest ? [
-    "5.4"
     "5.10"
     "5.15"
     "6.1"
     "6.6"
+    "6.12"
     "latest"
   ],
 }:

pkgs/applications/blockchains/bitcoin-knots/default.nix

@@ -187,7 +187,6 @@ stdenv.mkDerivation (finalAttrs: {
     versionCheckHook
   ];
   versionCheckProgram = "${placeholder "out"}/bin/bitcoin-cli";
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   meta = {

pkgs/applications/blockchains/bitcoin/default.nix

@@ -187,7 +187,6 @@ stdenv.mkDerivation (finalAttrs: {
     versionCheckHook
   ];
   versionCheckProgram = "${placeholder "out"}/bin/bitcoin-cli";
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru.tests = {

pkgs/applications/editors/vim/common.nix

@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.1869";
+  version = "9.1.1918";
 
   outputs = [
     "out"
@@ -11,7 +11,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-AHx4AHsJAsEE5LRzKgBeV3LoCaoHUB+0/gq7kOHObMk=";
+    hash = "sha256-NU/A7yWcLaC+wqsfiHYVhnSZHGDao6+Oib/bSFNSVyQ=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/plugins/non-generated/cord-nvim/default.nix

@@ -32,7 +32,6 @@ let
     nativeInstallCheckInputs = [
       versionCheckHook
     ];
-    versionCheckProgramArg = "--version";
     doInstallCheck = false;
 
     meta.mainProgram = "cord";

pkgs/applications/emulators/wine/sources.nix

@@ -133,9 +133,9 @@ rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "10.18";
+    version = "10.19";
     url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
-    hash = "sha256-Uftyc9ZdCd6gMsSl4hl7EnJLJ8o2DhpiKyNz0e5QrXs=";
+    hash = "sha256-fOxYMjxvKq7nrKk1Fzecu/75biwsWAxo/4XdAAy73UY=";
 
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -145,7 +145,7 @@ rec {
     # see https://gitlab.winehq.org/wine/wine-staging
     staging = fetchFromGitLab {
       inherit version;
-      hash = "sha256-vhIjeEbWLpcKtkBd/KeAeaLKOUZt7LAkH6GTebs3ROM=";
+      hash = "sha256-GmHeqHZPnFZkntMOJJzRDUN9H+G1qXdacy/Al6T5eZU=";
       domain = "gitlab.winehq.org";
       owner = "wine";
       repo = "wine-staging";

pkgs/applications/gis/qgis/default.nix

@@ -14,14 +14,12 @@
 }:
 let
   qgis-unwrapped = libsForQt5.callPackage ./unwrapped.nix {
-    withGrass = withGrass;
-    withServer = withServer;
-    withWebKit = withWebKit;
+    inherit withGrass withServer withWebKit;
   };
 in
 
 symlinkJoin {
-  inherit (qgis-unwrapped) version src;
+  inherit (qgis-unwrapped) version outputs src;
   pname = "qgis";
 
   paths = [ qgis-unwrapped ];
@@ -42,6 +40,8 @@ symlinkJoin {
         --prefix PATH : $program_PATH \
         --set PYTHONPATH $program_PYTHONPATH
     done
+
+    ln -s ${qgis-unwrapped.man} $man
   '';
 
   passthru = {

pkgs/applications/gis/qgis/unwrapped.nix

@@ -83,6 +83,10 @@ in
 mkDerivation rec {
   version = "3.44.5";
   pname = "qgis-unwrapped";
+  outputs = [
+    "out"
+    "man"
+  ];
 
   src = fetchFromGitHub {
     owner = "qgis";
@@ -181,7 +185,7 @@ mkDerivation rec {
   dontWrapGApps = true; # wrapper params passed below
 
   postFixup = lib.optionalString withGrass ''
-    # GRASS has to be availble on the command line even though we baked in
+    # GRASS has to be available on the command line even though we baked in
     # the path at build time using GRASS_PREFIX.
     # Using wrapGAppsHook also prevents file dialogs from crashing the program
     # on non-NixOS.

pkgs/applications/graphics/ImageMagick/default.nix

@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-8";
+  version = "7.1.2-10";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-2jSQ59Wi6/1dbS/AgM1DfW6WlwoYuJlnTLoM8Mc6Ji8=";
+    hash = "sha256-96lhd0B4yV2s/zVazKrqAcDZvn+yIiXxp8fqyKSfxLc=";
   };
 
   outputs = [

pkgs/applications/networking/cluster/helm/plugins/helm-schema.nix

@@ -46,7 +46,6 @@ buildGoModule (finalAttrs: {
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgram = "${placeholder "out"}/helm-schema/bin/schema";
-  versionCheckProgramArg = "--version";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/applications/networking/cluster/k3s/builder.nix

@@ -456,7 +456,6 @@ buildGoModule (finalAttrs: {
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
 
   passthru = {
     inherit

pkgs/applications/networking/cluster/kubectl-view-allocations/default.nix

@@ -21,7 +21,6 @@ rustPlatform.buildRustPackage rec {
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
 
   meta = {
     description = "kubectl plugin to list allocations (cpu, memory, gpu,... X utilization, requested, limit, allocatable,...)";

pkgs/applications/networking/irc/weechat/default.nix

@@ -174,7 +174,6 @@ stdenv.mkDerivation rec {
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
 
   passthru.updateScript = writeScript "update-weechat" ''
     #!/usr/bin/env nix-shell

pkgs/applications/networking/mullvad/mullvad.nix

@@ -110,7 +110,6 @@ rustPlatform.buildRustPackage rec {
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru = {

pkgs/applications/radio/gnuradio/shared.nix

@@ -27,6 +27,10 @@ let
   cross = stdenv.hostPlatform != stdenv.buildPlatform;
 in
 {
+  outputs = [
+    "out"
+    "man"
+  ];
   src =
     if overrideSrc != { } then
       overrideSrc

pkgs/applications/radio/gnuradio/wrapper.nix

@@ -79,7 +79,7 @@ let
   pythonEnv = unwrapped.python.withPackages (ps: pythonPkgs);
 
   pname = unwrapped.pname + "-wrapped";
-  inherit (unwrapped) version;
+  inherit (unwrapped) outputs version;
   makeWrapperArgs = builtins.concatStringsSep " " (
     [
     ]
@@ -214,15 +214,21 @@ let
   self =
     if doWrap then
       stdenv.mkDerivation {
-        inherit pname version passthru;
-        nativeBuildInputs = [ makeWrapper ];
-        buildInputs = [
+        inherit
+          pname
+          outputs
+          version
+          passthru
+          ;
+        nativeBuildInputs = [
+          makeWrapper
           xorg.lndir
         ];
         buildCommand = ''
           mkdir $out
           cd $out
-          lndir -silent ${unwrapped}
+          lndir -silent ${unwrapped.out}
+          lndir -silent ${unwrapped.man}
           ${lib.optionalString (extraPackages != [ ]) (
             builtins.concatStringsSep "\n" (
               map (pkg: ''

pkgs/applications/science/math/R/default.nix

@@ -59,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   outputs = [
     "out"
+    "man"
     "tex"
   ];
 

pkgs/applications/virtualization/docker/default.nix

@@ -356,7 +356,6 @@ let
 
         doInstallCheck = true;
         nativeInstallCheckInputs = [ versionCheckHook ];
-        versionCheckProgramArg = "--version";
 
         passthru = {
           # Exposed for tarsum build on non-linux systems (build-support/docker/default.nix)

pkgs/applications/virtualization/qemu/force-uid0-on-9p.patch

@@ -9,7 +9,7 @@ index 45e9a1f9b0..494ee00c66 100644
 +static int is_in_store_path(const char *path)
 +{
 +    static char *store_path = NULL;
-+    int store_path_len = -1;
++    static ssize_t store_path_len = -1;
 +
 +    if (store_path_len == -1) {
 +        if ((store_path = getenv("NIX_STORE")) != NULL)
@@ -19,7 +19,7 @@ index 45e9a1f9b0..494ee00c66 100644
 +    }
 +
 +    if (store_path_len > 0)
-+        return strncmp(path, store_path, strlen(store_path)) == 0;
++        return strncmp(path, store_path, store_path_len) == 0;
 +    return 0;
 +}
 +

pkgs/applications/virtualization/singularity/generic.nix

@@ -277,7 +277,6 @@ in
     versionCheckHook
   ];
   versionCheckProgram = "${placeholder "out"}/bin/${projectName}";
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   meta = {

pkgs/build-support/build-mozilla-mach/default.nix

@@ -59,7 +59,9 @@ in
   pkgsCross, # wasm32 rlbox
   python3,
   runCommand,
+  rustc,
   rust-cbindgen,
+  rustPlatform,
   unzip,
   which,
   wrapGAppsHook3,
@@ -201,25 +203,9 @@ assert elfhackSupport -> isElfhackPlatform stdenv;
 let
   inherit (lib) enableFeature;
 
-  rustPackages =
-    pkgs:
-    (pkgs.rust.override (
-      # aarch64-darwin firefox crashes on loading favicons due to a llvm 21 bug:
-      # https://github.com/NixOS/nixpkgs/issues/453372
-      # https://bugzilla.mozilla.org/show_bug.cgi?id=1995582#c16
-      lib.optionalAttrs (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) {
-        llvmPackages = pkgs.llvmPackages_20;
-      }
-    )).packages.stable;
-
-  toRustC = pkgs: (rustPackages pkgs).rustc;
-
-  rustc = toRustC pkgs;
-  inherit (rustPackages pkgs) rustPlatform;
-
   # Target the LLVM version that rustc is built with for LTO.
   llvmPackages0 = rustc.llvmPackages;
-  llvmPackagesBuildBuild0 = (toRustC pkgsBuildBuild).llvmPackages;
+  llvmPackagesBuildBuild0 = pkgsBuildBuild.rustc.llvmPackages;
 
   # Force the use of lld and other llvm tools for LTO
   llvmPackages = llvmPackages0.override {
@@ -234,7 +220,7 @@ let
   # LTO requires LLVM bintools including ld.lld and llvm-ar.
   buildStdenv = overrideCC llvmPackages.stdenv (
     llvmPackages.stdenv.cc.override {
-      bintools = if ltoSupport then (toRustC buildPackages).llvmPackages.bintools else stdenv.cc.bintools;
+      bintools = if ltoSupport then buildPackages.rustc.llvmPackages.bintools else stdenv.cc.bintools;
     }
   );
 

pkgs/build-support/buildenv/builder.pl

@@ -74,7 +74,7 @@ sub findFiles;
 
 sub findFilesInDir($relName, $target, $ignoreCollisions, $checkCollisionContents, $priority, $ignoreSingleFileOutputs) {
     opendir DIR, "$target" or die "cannot open `$target': $!";
-    my @names = readdir DIR or die;
+    my @names = readdir DIR;
     closedir DIR;
 
     foreach my $name (@names) {

pkgs/build-support/rust/build-rust-package/default.nix

@@ -89,17 +89,20 @@ lib.extendMkDerivation {
       "buildRustPackage: `useFetchCargoVendor` is non‐optional and enabled by default as of 25.05, remove it"
       true;
     {
-      env = {
-        PKG_CONFIG_ALLOW_CROSS = if stdenv.buildPlatform != stdenv.hostPlatform then 1 else 0;
-        RUST_LOG = logLevel;
-        RUSTFLAGS =
-          lib.optionalString (
-            stdenv.hostPlatform.isDarwin && buildType == "debug"
-          ) "-C split-debuginfo=packed "
-          # Workaround the existing RUSTFLAGS specified as a list.
-          + interpolateString (args.RUSTFLAGS or "");
-      }
-      // args.env or { };
+      env =
+        let
+          isDarwinDebug = stdenv.hostPlatform.isDarwin && buildType == "debug";
+        in
+        {
+          PKG_CONFIG_ALLOW_CROSS = if stdenv.buildPlatform != stdenv.hostPlatform then 1 else 0;
+          RUST_LOG = logLevel;
+          # Prevent shadowing *_RUSTFLAGS environment variables
+          ${if args ? RUSTFLAGS || isDarwinDebug then "RUSTFLAGS" else null} =
+            lib.optionalString isDarwinDebug "-C split-debuginfo=packed "
+            # Workaround the existing RUSTFLAGS specified as a list.
+            + interpolateString (args.RUSTFLAGS or "");
+        }
+        // args.env or { };
 
       cargoDeps =
         if cargoVendorDir != null then

pkgs/build-support/rust/hooks/maturin-build-hook.sh

@@ -23,11 +23,16 @@ maturinBuildHook() {
         "--target" "@rustcTargetSpec@"
         "--manylinux" "off"
         "--strip"
-        "--release"
         "--out" "$dist"
         "--interpreter" "$interpreter_name"
     )
 
+    if [ -n "${maturinBuildProfile}" ]; then
+      flagsArray+=("--profile" "${maturinBuildProfile}")
+    else
+      flagsArray+=("--release")
+    fi
+
     concatTo flagsArray maturinBuildFlags
 
     echoCmd 'maturinBuildHook flags' "${flagsArray[@]}"

pkgs/build-support/setup-hooks/make-symlinks-relative.sh

@@ -1,37 +1,35 @@
 # symlinks are often created in postFixup
 # don't use fixupOutputHooks, it is before postFixup
-postFixupHooks+=(_makeSymlinksRelativeInAllOutputs)
+if [[ -z "${dontRewriteSymlinks-}" ]]; then
+  postFixupHooks+=(_makeSymlinksRelative)
+fi
+
 
 # For every symlink in $output that refers to another file in $output
-# ensure that the symlink is relative. This removes references to the output
-# has from the resulting store paths and thus the NAR files.
+# ensure that the symlink is relative.
+# This increases the chance that NAR files can be deduplicated.
 _makeSymlinksRelative() {
-    local symlinkTarget
-
-    if [ "${dontRewriteSymlinks-}" ] || [ ! -e "$prefix" ]; then
-       return
-    fi
-
-    while IFS= read -r -d $'\0' f; do
-        symlinkTarget=$(readlink "$f")
-        if [[ "$symlinkTarget"/ != "$prefix"/* ]]; then
-            # skip this symlink as it doesn't point to $prefix
-            continue
-        fi
-
-        if [ ! -e "$symlinkTarget" ]; then
-            echo "the symlink $f is broken, it points to $symlinkTarget (which is missing)"
-        fi
-
-        echo "rewriting symlink $f to be relative to $prefix"
-        ln -snrf "$symlinkTarget" "$f"
-
-    done < <(find $prefix -type l -print0)
-}
-
-_makeSymlinksRelativeInAllOutputs() {
-  local output
+  local prefixes
+  prefixes=()
   for output in $(getAllOutputNames); do
-    prefix="${!output}" _makeSymlinksRelative
+    [ ! -e "${!output}" ] && continue
+    prefixes+=( "${!output}" )
   done
+  find "${prefixes[@]}" -type l -printf '%H\0%p\0' \
+    | xargs -0 -n2 -r -P "$NIX_BUILD_CORES" sh -c '
+      output="$1"
+      link="$2"
+
+      linkTarget=$(readlink "$link")
+
+      # only touch links that point inside the same output tree
+      [[ $linkTarget == "$output"/* ]] || exit 0
+
+      if [ ! -e "$linkTarget" ]; then
+        echo "the symlink $link is broken, it points to $linkTarget (which is missing)"
+      fi
+
+      echo "making symlink relative: $link"
+      ln -snrf "$linkTarget" "$link"
+    ' _
 }

pkgs/build-support/setup-hooks/shorten-perl-shebang.sh

@@ -1,88 +1,4 @@
-# This setup hook modifies a Perl script so that any "-I" flags in its shebang
-# line are rewritten into a "use lib ..." statement on the next line. This gets
-# around a limitation in Darwin, which will not properly handle a script whose
-# shebang line exceeds 511 characters.
-#
-# Each occurrence of "-I /path/to/lib1" or "-I/path/to/lib2" is removed from
-# the shebang line, along with the single space that preceded it. These library
-# paths are placed into a new line of the form
-#
-#     use lib "/path/to/lib1", "/path/to/lib2";
-#
-# immediately following the shebang line. If a library appeared in the original
-# list more than once, only its first occurrence will appear in the output
-# list. In other words, the libraries are deduplicated, but the ordering of the
-# first appearance of each one is preserved.
-#
-# Any flags other than "-I" in the shebang line are left as-is, and the
-# interpreter is also left alone (although the script will abort if the
-# interpreter does not seem to be either "perl" or else "env" with "perl" as
-# its argument). Each line after the shebang line is left unchanged. Each file
-# is modified in place.
-#
-# Usage:
-#     shortenPerlShebang SCRIPT...
-
+# Deprecated. Invocation in derivations can be safely removed.
 shortenPerlShebang() {
-    while [ $# -gt 0 ]; do
-        _shortenPerlShebang "$1"
-        shift
-    done
-}
-
-_shortenPerlShebang() {
-    local program="$1"
-
-    echo "shortenPerlShebang: rewriting shebang line in $program"
-
-    if ! isScript "$program"; then
-        die "shortenPerlShebang: refusing to modify $program because it is not a script"
-    fi
-
-    local temp="$(mktemp)"
-
-    gawk '
-        (NR == 1) {
-            if (!($0 ~ /\/(perl|env +perl)\>/)) {
-                print "shortenPerlShebang: script does not seem to be a Perl script" > "/dev/stderr"
-                exit 1
-            }
-            idx = 0
-            while (match($0, / -I ?([^ ]+)/, pieces)) {
-                matches[idx] = pieces[1]
-                idx++
-                $0 = gensub(/ -I ?[^ ]+/, "", 1, $0)
-            }
-            print $0
-            if (idx > 0) {
-                prefix = "use lib "
-                for (idx in matches) {
-                    path = matches[idx]
-                    if (!(path in seen)) {
-                        printf "%s\"%s\"", prefix, path
-                        seen[path] = 1
-                        prefix = ", "
-                    }
-                }
-                print ";"
-            }
-        }
-        (NR > 1 ) {
-            print
-        }
-    ' "$program" > "$temp" || die
-    # Preserve the mode of the original file
-    cp --preserve=mode --attributes-only "$program" "$temp"
-    mv "$temp" "$program"
-
-    # Measure the new shebang line length and make sure it's okay. We subtract
-    # one to account for the trailing newline that "head" included in its
-    # output.
-    local new_length=$(( $(head -n 1 "$program" | wc -c) - 1 ))
-
-    # Darwin is okay when the shebang line contains 511 characters, but not
-    # when it contains 512 characters.
-    if [ $new_length -ge 512 ]; then
-        die "shortenPerlShebang: shebang line is $new_length characters--still too long for Darwin!"
-    fi
+  :
 }

pkgs/by-name/_1/_1password-cli/package.nix

@@ -80,7 +80,6 @@ stdenv.mkDerivation {
   doInstallCheck = true;
 
   versionCheckProgram = "${placeholder "out"}/bin/op";
-  versionCheckProgramArg = "--version";
 
   passthru = {
     updateScript = ./update.sh;

pkgs/by-name/ad/addDriverRunpath/package.nix

@@ -1,14 +1,14 @@
-{ lib, stdenv }:
+{
+  lib,
+  stdenv,
+  makeSetupHook,
+}:
+makeSetupHook {
+  name = "add-driver-runpath-hook";
 
-stdenv.mkDerivation {
-  name = "add-driver-runpath";
-
-  # Named "opengl-driver" for legacy reasons, but it is the path to
-  # hardware drivers installed by NixOS
-  driverLink = "/run/opengl-driver" + lib.optionalString stdenv.hostPlatform.isi686 "-32";
-
-  buildCommand = ''
-    mkdir -p $out/nix-support
-    substituteAll ${./setup-hook.sh} $out/nix-support/setup-hook
-  '';
-}
+  substitutions = {
+    # Named "opengl-driver" for legacy reasons, but it is the path to
+    # hardware drivers installed by NixOS
+    driverLink = "/run/opengl-driver" + lib.optionalString stdenv.hostPlatform.isi686 "-32";
+  };
+} ./setup-hook.sh

pkgs/by-name/ae/aerc/package.nix

@@ -78,7 +78,6 @@ buildGoModule (finalAttrs: {
   '';
 
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/ah/ahoy/package.nix

@@ -28,8 +28,6 @@ buildGoModule (finalAttrs: {
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
-  versionCheckProgramArg = "--version";
-
   passthru.updateScript = nix-update-script { };
 
   meta = {

pkgs/by-name/ai/aichat/package.nix

@@ -33,7 +33,6 @@ rustPlatform.buildRustPackage rec {
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru = {

pkgs/by-name/ai/air-formatter/package.nix

@@ -24,7 +24,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     versionCheckHook
   ];
   versionCheckProgram = "${placeholder "out"}/bin/air";
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   cargoBuildFlags = [ "-p air" ];

pkgs/by-name/al/alertmanager-gotify-bridge/package.nix

@@ -26,7 +26,6 @@ buildGoModule rec {
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgram = "${placeholder "out"}/bin/alertmanager_gotify_bridge";
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/am/amazon-q-cli/package.nix

@@ -72,7 +72,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgram = "${placeholder "out"}/bin/amazon-q";
-  versionCheckProgramArg = "--version";
 
   meta = {
     description = "Amazon Q Developer AI coding agent CLI";

pkgs/by-name/am/amd-blis/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   perl,
   python3,
 
@@ -36,6 +37,18 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     # Set the date stamp to $SOURCE_DATE_EPOCH
     ./build-date.patch
+    # backporting a fix for a GCC15 build error
+    # ./frame/include/bli_x86_asm_macros.h:102:21: error: 'asm' operand has impossible constraints or there are not enough registers
+    (fetchpatch {
+      name = "amd-blis-gcc-15-fix-1.patch";
+      url = "https://github.com/amd/blis/commit/14e46ad83bac5fd82569a43c7cbd3e791a1eacc8.patch";
+      hash = "sha256-3vk9NSnhT64J6PUabeP58Gn7p1zheGbPxSRjVEX7WNg=";
+    })
+    (fetchpatch {
+      name = "amd-blis-gcc-15-fix-2.patch";
+      url = "https://github.com/amd/blis/commit/30c42202d78fd5ee5e54d50ad57348e5e541a7d5.patch";
+      hash = "sha256-FCMWQzfzQxCQqngULoXfh35BFGaNTu732iu3HctNcFM=";
+    })
   ];
 
   inherit blas64;

pkgs/by-name/am/ameba-ls/package.nix

@@ -44,7 +44,6 @@ crystal.buildCrystalPackage rec {
   ];
   doInstallCheck = true;
   versionCheckProgram = "${placeholder "out"}/bin/ameba-ls";
-  versionCheckProgramArg = "--version";
 
   meta = {
     description = "Crystal language server powered by Ameba linter";

pkgs/by-name/an/andcli/package.nix

@@ -32,7 +32,6 @@ buildGoModule (finalAttrs: {
     writableTmpDirAsHomeHook
     versionCheckHook
   ];
-  versionCheckProgramArg = "--version";
   versionCheckKeepEnvironment = [ "HOME" ];
   doInstallCheck = true;
 

pkgs/by-name/an/ansible-doctor/package.nix

@@ -48,8 +48,6 @@ python3Packages.buildPythonApplication rec {
   # ansible.errors.AnsibleError: Unable to create local directories(/private/var/empty/.ansible/tmp)
   nativeCheckInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ versionCheckHook ];
 
-  versionCheckProgramArg = "--version";
-
   meta = {
     description = "Annotation based documentation for your Ansible roles";
     mainProgram = "ansible-doctor";

pkgs/by-name/ap/apache-orc/package.nix

@@ -3,32 +3,37 @@
   stdenv,
   fetchFromGitHub,
   fetchurl,
-  fetchpatch,
   cmake,
   gtest,
   lz4,
-  protobuf_30,
+  protobuf,
   snappy,
   zlib,
   zstd,
 }:
 
 let
-  orc-format = fetchurl {
-    name = "orc-format-1.1.0.tar.gz";
-    url = "https://www.apache.org/dyn/closer.lua/orc/orc-format-1.1.0/orc-format-1.1.0.tar.gz?action=download";
-    hash = "sha256-1KesdsVEKr9xGeLLhOcbZ34HWv9TUYqoZgVeLq0EUNc=";
-  };
+  orc-format =
+    let
+      version = "1.1.1";
+      name = "orc-format-${version}";
+      archiveName = "${name}.tar.gz";
+    in
+    fetchurl {
+      name = archiveName;
+      url = "https://www.apache.org/dyn/closer.lua/orc/${name}/${archiveName}?action=download";
+      hash = "sha256-WE3+KkIClGF4/Y/H0SOb54BbntRZarIELe5znniAmSs=";
+    };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "apache-orc";
-  version = "2.1.2";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "orc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hNKzqNOagBJOWQRebkVHIuvqfpk9Mi30bu4z7dGbsxk=";
+    hash = "sha256-H7nowl2pq31RIAmTUz15x48Wc99MljFJboc4F7Ln/zk=";
   };
 
   nativeBuildInputs = [
@@ -38,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     gtest
     lz4
-    protobuf_30
+    protobuf
     snappy
     zlib
     zstd
@@ -62,7 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
     GTEST_HOME = gtest.dev;
     LZ4_ROOT = lz4;
     ORC_FORMAT_URL = orc-format;
-    PROTOBUF_HOME = protobuf_30;
+    PROTOBUF_HOME = protobuf;
     SNAPPY_ROOT = snappy.dev;
     ZLIB_ROOT = zlib.dev;
     ZSTD_ROOT = zstd.dev;

pkgs/by-name/ar/arp-scan-rs/package.nix

@@ -30,8 +30,6 @@ rustPlatform.buildRustPackage rec {
 
   versionCheckProgram = [ "${placeholder "out"}/bin/arp-scan" ];
 
-  versionCheckProgramArg = "--version";
-
   doInstallCheck = true;
 
   passthru.updateScript = gitUpdater { };

pkgs/by-name/ar/arrow-cpp/package.nix

@@ -17,6 +17,7 @@
       "transfer"
     ];
   },
+  azure-sdk-for-cpp,
   boost,
   brotli,
   bzip2,
@@ -37,7 +38,7 @@
   openssl,
   perl,
   pkg-config,
-  protobuf_31,
+  protobuf,
   python3,
   rapidjson,
   re2,
@@ -58,7 +59,8 @@
     !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isAarch64 && !stdenv.hostPlatform.isRiscV64,
   enableS3 ? true,
   # google-cloud-cpp fails to build on RiscV
-  enableGcs ? !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isRiscV64,
+  enableGcs ? !stdenv.hostPlatform.isRiscV64,
+  enableAzure ? true,
 }:
 
 let
@@ -66,19 +68,19 @@ let
     name = "arrow-testing";
     owner = "apache";
     repo = "arrow-testing";
-    rev = "d2a13712303498963395318a4eb42872e66aead7";
-    hash = "sha256-c8FL37kG0uo7o0Zp71WjCl7FD5BnVgqUCCXXX9gI0lg=";
+    rev = "9a02925d1ba80bd493b6d4da6e8a777588d57ac4";
+    hash = "sha256-dEFCkeQpQrU61uCwJp/XB2umbQHjXtzado36BGChoc0=";
   };
 
   parquet-testing = fetchFromGitHub {
     name = "parquet-testing";
     owner = "apache";
     repo = "parquet-testing";
-    rev = "18d17540097fca7c40be3d42c167e6bfad90763c";
-    hash = "sha256-gKEQc2RKpVp39RmuZbIeIXAwiAXDHGnLXF6VQuJtnRA=";
+    rev = "a3d96a65e11e2bbca7d22a894e8313ede90a33a3";
+    hash = "sha256-Xd6o3RT6Q0tPutV77J0P1x3F6U3RHdCBOKGUKtkQCKk=";
   };
 
-  version = "20.0.0";
+  version = "22.0.0";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "arrow-cpp";
@@ -88,7 +90,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "apache";
     repo = "arrow";
     rev = "apache-arrow-${version}";
-    hash = "sha256-JFPdKraCU+xRkBTAHyY4QGnBVlOjQ1P5+gq9uxyqJtk=";
+    hash = "sha256-i4Smt43oi4sddUt3qH7ePjensBSfPW+w/ExLVcVNKic=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/cpp";
@@ -107,21 +109,21 @@ stdenv.mkDerivation (finalAttrs: {
   ARROW_MIMALLOC_URL = fetchFromGitHub {
     owner = "microsoft";
     repo = "mimalloc";
-    rev = "v2.0.6";
-    hash = "sha256-u2ITXABBN/dwU+mCIbL3tN1f4c17aBuSdNTV+Adtohc=";
+    tag = "v3.1.5";
+    hash = "sha256-fk6nfyBFS1G0sJwUJVgTC1+aKd0We/JjsIYTO+IOfyg=";
   };
 
   ARROW_XSIMD_URL = fetchFromGitHub {
     owner = "xtensor-stack";
     repo = "xsimd";
-    rev = "13.0.0";
+    tag = "13.0.0";
     hash = "sha256-qElJYW5QDj3s59L3NgZj5zkhnUMzIP2mBa1sPks3/CE=";
   };
 
   ARROW_SUBSTRAIT_URL = fetchFromGitHub {
     owner = "substrait-io";
     repo = "substrait";
-    rev = "v0.44.0";
+    tag = "v0.44.0";
     hash = "sha256-V739IFTGPtbGPlxcOi8sAaYSDhNUEpITvN9IqdPReug=";
   };
 
@@ -138,6 +140,7 @@ stdenv.mkDerivation (finalAttrs: {
     boost
     brotli
     bzip2
+    curl
     flatbuffers
     gflags
     glog
@@ -145,7 +148,7 @@ stdenv.mkDerivation (finalAttrs: {
     libbacktrace
     lz4
     nlohmann_json # alternative JSON parser to rapidjson
-    protobuf_31 # substrait requires protobuf
+    protobuf # substrait requires protobuf
     rapidjson
     re2
     snappy
@@ -157,7 +160,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals enableFlight [
     grpc
     openssl
-    protobuf_31
+    protobuf
     sqlite
   ]
   ++ lib.optionals enableS3 [
@@ -166,10 +169,14 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals enableGcs [
     crc32c
-    curl
     google-cloud-cpp
     grpc
     nlohmann_json
+  ]
+  ++ lib.optionals enableAzure [
+    azure-sdk-for-cpp.identity
+    azure-sdk-for-cpp.storage-blobs
+    azure-sdk-for-cpp.storage-files-datalake
   ];
 
   # apache-orc looks for things in caps
@@ -188,55 +195,61 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   cmakeFlags = [
-    "-DCMAKE_FIND_PACKAGE_PREFER_CONFIG=ON"
-    "-DARROW_BUILD_SHARED=${if enableShared then "ON" else "OFF"}"
-    "-DARROW_BUILD_STATIC=${if enableShared then "OFF" else "ON"}"
-    "-DARROW_BUILD_TESTS=${if enableShared then "ON" else "OFF"}"
-    "-DARROW_BUILD_INTEGRATION=ON"
-    "-DARROW_BUILD_UTILITIES=ON"
-    "-DARROW_EXTRA_ERROR_CONTEXT=ON"
-    "-DARROW_VERBOSE_THIRDPARTY_BUILD=ON"
-    "-DARROW_DEPENDENCY_SOURCE=SYSTEM"
-    "-Dxsimd_SOURCE=AUTO"
-    "-DARROW_DEPENDENCY_USE_SHARED=${if enableShared then "ON" else "OFF"}"
-    "-DARROW_COMPUTE=ON"
-    "-DARROW_CSV=ON"
-    "-DARROW_DATASET=ON"
-    "-DARROW_FILESYSTEM=ON"
-    "-DARROW_FLIGHT_SQL=${if enableFlight then "ON" else "OFF"}"
-    "-DARROW_HDFS=ON"
-    "-DARROW_IPC=ON"
-    "-DARROW_JEMALLOC=${if enableJemalloc then "ON" else "OFF"}"
-    "-DARROW_JSON=ON"
-    "-DARROW_USE_GLOG=ON"
-    "-DARROW_WITH_BACKTRACE=ON"
-    "-DARROW_WITH_BROTLI=ON"
-    "-DARROW_WITH_BZ2=ON"
-    "-DARROW_WITH_LZ4=ON"
-    "-DARROW_WITH_NLOHMANN_JSON=ON"
-    "-DARROW_WITH_SNAPPY=ON"
-    "-DARROW_WITH_UTF8PROC=ON"
-    "-DARROW_WITH_ZLIB=ON"
-    "-DARROW_WITH_ZSTD=ON"
-    "-DARROW_MIMALLOC=ON"
-    "-DARROW_SUBSTRAIT=ON"
-    "-DARROW_FLIGHT=${if enableFlight then "ON" else "OFF"}"
-    "-DARROW_FLIGHT_TESTING=${if enableFlight then "ON" else "OFF"}"
-    "-DARROW_S3=${if enableS3 then "ON" else "OFF"}"
-    "-DARROW_GCS=${if enableGcs then "ON" else "OFF"}"
-    "-DARROW_ORC=ON"
+    (lib.cmakeBool "CMAKE_FIND_PACKAGE_PREFER_CONFIG" true)
+    (lib.cmakeBool "ARROW_BUILD_SHARED" enableShared)
+    (lib.cmakeBool "ARROW_BUILD_STATIC" (!enableShared))
+    (lib.cmakeBool "ARROW_BUILD_TESTS" enableShared)
+    (lib.cmakeBool "ARROW_BUILD_INTEGRATION" true)
+    (lib.cmakeBool "ARROW_BUILD_UTILITIES" true)
+    (lib.cmakeBool "ARROW_EXTRA_ERROR_CONTEXT" true)
+    (lib.cmakeBool "ARROW_VERBOSE_THIRDPARTY_BUILD" true)
+    (lib.cmakeFeature "ARROW_DEPENDENCY_SOURCE" "SYSTEM")
+    (lib.cmakeFeature "xsimd_SOURCE" "AUTO")
+    (lib.cmakeBool "ARROW_DEPENDENCY_USE_SHARED" enableShared)
+    (lib.cmakeBool "ARROW_COMPUTE" true)
+    (lib.cmakeBool "ARROW_CSV" true)
+    (lib.cmakeBool "ARROW_DATASET" true)
+    (lib.cmakeBool "ARROW_FILESYSTEM" true)
+    (lib.cmakeBool "ARROW_FLIGHT_SQL" enableFlight)
+    (lib.cmakeBool "ARROW_HDFS" true)
+    (lib.cmakeBool "ARROW_IPC" true)
+    (lib.cmakeBool "ARROW_JEMALLOC" enableJemalloc)
+    (lib.cmakeBool "ARROW_JSON" true)
+    (lib.cmakeBool "ARROW_USE_GLOG" true)
+    (lib.cmakeBool "ARROW_WITH_BACKTRACE" true)
+    (lib.cmakeBool "ARROW_WITH_BROTLI" true)
+    (lib.cmakeBool "ARROW_WITH_BZ2" true)
+    (lib.cmakeBool "ARROW_WITH_LZ4" true)
+    (lib.cmakeBool "ARROW_WITH_NLOHMANN_JSON" true)
+    (lib.cmakeBool "ARROW_WITH_SNAPPY" true)
+    (lib.cmakeBool "ARROW_WITH_UTF8PROC" true)
+    (lib.cmakeBool "ARROW_WITH_ZLIB" true)
+    (lib.cmakeBool "ARROW_WITH_ZSTD" true)
+    (lib.cmakeBool "ARROW_MIMALLOC" true)
+    (lib.cmakeBool "ARROW_SUBSTRAIT" true)
+    (lib.cmakeBool "ARROW_FLIGHT" enableFlight)
+    (lib.cmakeBool "ARROW_FLIGHT_TESTING" enableFlight)
+    (lib.cmakeBool "ARROW_S3" enableS3)
+    (lib.cmakeBool "ARROW_GCS" enableGcs)
+    (lib.cmakeBool "ARROW_AZURE" enableAzure)
+    (lib.cmakeBool "ARROW_ORC" true)
     # Parquet options:
-    "-DARROW_PARQUET=ON"
-    "-DPARQUET_BUILD_EXECUTABLES=ON"
-    "-DPARQUET_REQUIRE_ENCRYPTION=ON"
+    (lib.cmakeBool "ARROW_PARQUET" true)
+    (lib.cmakeBool "PARQUET_BUILD_EXECUTABLES" true)
+    (lib.cmakeBool "PARQUET_REQUIRE_ENCRYPTION" true)
+  ]
+  ++ lib.optionals (!enableShared) [
+    (lib.cmakeFeature "ARROW_TEST_LINKAGE" "static")
   ]
-  ++ lib.optionals (!enableShared) [ "-DARROW_TEST_LINKAGE=static" ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    "-DCMAKE_INSTALL_RPATH=@loader_path/../lib" # needed for tools executables
+    # needed for tools executables
+    (lib.cmakeFeature "CMAKE_INSTALL_RPATH" "@loader_path/../lib")
+  ]
+  ++ lib.optionals (!stdenv.hostPlatform.isx86_64) [
+    (lib.cmakeBool "ARROW_USE_SIMD" false)
   ]
-  ++ lib.optionals (!stdenv.hostPlatform.isx86_64) [ "-DARROW_USE_SIMD=OFF" ]
   ++ lib.optionals enableS3 [
-    "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp-arrow}/include/aws/core/Aws.h"
+    (lib.cmakeFeature "AWSSDK_CORE_HEADER_FILE" "${aws-sdk-cpp-arrow}/include/aws/core/Aws.h")
   ];
 
   doInstallCheck = true;
@@ -259,13 +272,6 @@ stdenv.mkDerivation (finalAttrs: {
           "TestMinioServer.Connect"
           "TestS3FS.*"
           "TestS3FSGeneric.*"
-        ]
-        ++ lib.optionals stdenv.hostPlatform.isDarwin [
-          # TODO: revisit at 12.0.0 or when
-          # https://github.com/apache/arrow/commit/295c6644ca6b67c95a662410b2c7faea0920c989
-          # is available, see
-          # https://github.com/apache/arrow/pull/15288#discussion_r1071244661
-          "ExecPlanExecution.StressSourceSinkStopped"
         ];
     in
     lib.optionalString finalAttrs.doInstallCheck "-${lib.concatStringsSep ":" filteredTests}";
@@ -309,6 +315,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Cross-language development platform for in-memory data";
     homepage = "https://arrow.apache.org/docs/cpp/";
+    changelog = "https://arrow.apache.org/release/${finalAttrs.version}.html";
     license = lib.licenses.asl20;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [

pkgs/by-name/ar/arsenal/package.nix

@@ -30,7 +30,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   nativeCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
 
   pythonImportsCheck = [
     "arsenal"

pkgs/by-name/ar/arti/package.nix

@@ -63,7 +63,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru = {

pkgs/by-name/as/asciinema-agg/package.nix

@@ -22,7 +22,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
 
   meta = {
     description = "Command-line tool for generating animated GIF files from asciicast v2 files produced by asciinema terminal recorder";

pkgs/by-name/as/asciinema_3/package.nix

@@ -37,7 +37,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
 
   meta = {
     homepage = "https://asciinema.org/";

pkgs/by-name/as/ast-grep/package.nix

@@ -50,7 +50,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/as/astyle/package.nix

@@ -30,7 +30,6 @@ stdenv.mkDerivation rec {
   '';
 
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = !asLibrary;
 
   meta = {

pkgs/by-name/at/at-spi2-core/package.nix

@@ -28,7 +28,7 @@
 
 stdenv.mkDerivation rec {
   pname = "at-spi2-core";
-  version = "2.58.1";
+  version = "2.58.2";
 
   outputs = [
     "out"
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/at-spi2-core/${lib.versions.majorMinor version}/at-spi2-core-${version}.tar.xz";
-    hash = "sha256-fzdKajjNcP9LMsnToDEL+oBNlG/tTJ5pp9SfrNy5Xpw=";
+    hash = "sha256-ooI7li7RbN1csfxTZQKf0hg5TYUqzUCYsyGFS9ZpL24=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/au/audit/package.nix

@@ -87,6 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--disable-legacy-actions"
     "--with-arm"
     "--with-aarch64"
+    "--with-riscv"
     "--with-io_uring"
     # allows putting audit files in /run/audit, which removes the requirement
     # to wait for tmpfiles to set up the /var/run -> /run symlink

pkgs/by-name/au/automatic-timezoned/package.nix

@@ -21,7 +21,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
 
   doInstallCheck = true;
-  versionCheckProgramArg = "--version";
 
   meta = {
     description = "Automatically update system timezone based on location";

pkgs/by-name/av/avalanche-cli/package.nix

@@ -73,7 +73,6 @@ buildGoModule (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
   versionCheckProgram = "${placeholder "out"}/bin/avalanche";
-  versionCheckProgramArg = "--version";
 
   doCheck = false;
 

pkgs/by-name/av/avro-cpp/package.nix

@@ -43,7 +43,6 @@ stdenv.mkDerivation rec {
   ];
   doInstallCheck = true;
   versionCheckProgram = "${placeholder "out"}/bin/avrogencpp";
-  versionCheckProgramArg = "--version";
 
   meta = {
     description = "C++ library which implements parts of the Avro Specification";

pkgs/by-name/aw/await/package.nix

@@ -40,7 +40,6 @@ stdenv.mkDerivation rec {
     versionCheckHook
   ];
   doInstallCheck = true;
-  versionCheckProgramArg = "--version";
 
   meta = {
     changelog = "https://github.com/slavaGanzin/await/releases/tag/${version}";

pkgs/by-name/aw/aws-nuke/package.nix

@@ -46,8 +46,6 @@ buildGoModule rec {
     versionCheckHook
   ];
 
-  versionCheckProgramArg = "--version";
-
   postInstallCheck = ''
     $out/bin/aws-nuke resource-types | grep "IAMUser"
   '';

pkgs/by-name/aw/aws-sam-cli/package.nix

@@ -11,14 +11,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "aws-sam-cli";
-  version = "1.143.0";
+  version = "1.146.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-sam-cli";
     tag = "v${version}";
-    hash = "sha256-QnJQ45ucziHmOkQdAT29szOljBExiIXZ2zvhiKYXBxI=";
+    hash = "sha256-b0nXhhgQgV0TZ0PGYexKxsb1s7PIe+5dqjOWJiVlWJY=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
@@ -82,6 +82,12 @@ python3.pkgs.buildPythonApplication rec {
       xray
     ]);
 
+  # Remove after upstream bumps click > 8.1.8
+  postPatch = ''
+    substituteInPlace requirements/base.txt --replace-fail \
+      'click==8.1.8' 'click==${python3.pkgs.click.version}'
+  '';
+
   postFixup = ''
     # Disable telemetry: https://github.com/aws/aws-sam-cli/issues/1272
     wrapProgram $out/bin/sam \
@@ -125,7 +131,9 @@ python3.pkgs.buildPythonApplication rec {
     "tests/unit/lib/observability/cw_logs/"
     "tests/unit/lib/build_module/"
     # Disable flaky tests
-    "tests/unit/lib/samconfig/test_samconfig.py"
+    "tests/unit/cli/test_main.py"
+    "tests/unit/commands/samconfig/test_samconfig.py"
+    "tests/unit/local/docker/test_lambda_image.py"
   ];
 
   disabledTests = [

pkgs/by-name/aw/awsebcli/package.nix

@@ -72,7 +72,6 @@ python.pkgs.buildPythonApplication rec {
     pytestCheckHook
     versionCheckHook
   ];
-  versionCheckProgramArg = "--version";
 
   enabledTestPaths = [
     "tests/unit"

pkgs/by-name/az/azurehound/package.nix

@@ -29,8 +29,6 @@ buildGoModule rec {
 
   doInstallCheck = true;
 
-  versionCheckProgramArg = "--version";
-
   meta = {
     description = "Azure Data Exporter for BloodHound";
     homepage = "https://github.com/SpecterOps/AzureHound";

pkgs/by-name/ba/bacon/package.nix

@@ -52,7 +52,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   buildInputs = lib.optionals withSound soundDependencies;
 
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   postInstall =

pkgs/by-name/ba/bagr/package.nix

@@ -22,7 +22,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     versionCheckHook
   ];
   doInstallCheck = true;
-  versionCheckProgramArg = "--version";
 
   meta = {
     description = "Command line utility for interacting with BagIt bags (RFC 8493)";

pkgs/by-name/ba/bark/package.nix

@@ -45,7 +45,6 @@ rustPlatform.buildRustPackage (final: {
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/ba/basedpyright/package.nix

@@ -52,7 +52,6 @@ buildNpmPackage rec {
   '';
 
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru = {

pkgs/by-name/ba/bashunit/package.nix

@@ -62,7 +62,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
-  versionCheckProgramArg = "--version";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/ba/basilk/package.nix

@@ -23,7 +23,6 @@ rustPlatform.buildRustPackage rec {
     versionCheckHook
   ];
 
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru = {

pkgs/by-name/be/bento/package.nix

@@ -33,7 +33,6 @@ buildGoModule rec {
   ];
 
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/bf/bfg-repo-cleaner/package.nix

@@ -35,7 +35,6 @@ stdenv.mkDerivation rec {
   ];
   doInstallCheck = true;
   versionCheckProgram = "${placeholder "out"}/bin/${meta.mainProgram}";
-  versionCheckProgramArg = "--version";
 
   meta = {
     homepage = "https://rtyley.github.io/bfg-repo-cleaner/";

pkgs/by-name/bi/biber-ms/package.nix

@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   perlPackages,
-  shortenPerlShebang,
   texlive,
 }:
 
@@ -78,7 +77,6 @@ perlPackages.buildPerlModule {
     XMLWriter
     autovivification
   ];
-  nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin shortenPerlShebang;
 
   preConfigure = ''
     cp '${multiscriptBltxml}' t/tdata/multiscript.bltxml
@@ -86,9 +84,6 @@ perlPackages.buildPerlModule {
 
   postInstall = ''
     mv "$out"/bin/biber{,-ms}
-  ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    shortenPerlShebang "$out"/bin/biber-ms
   '';
 
   meta = {

pkgs/by-name/bi/biber/package.nix

@@ -3,7 +3,6 @@
   stdenv,
   fetchpatch,
   perlPackages,
-  shortenPerlShebang,
   texlive,
 }:
 
@@ -69,11 +68,6 @@ perlPackages.buildPerlModule {
     TestDifferences
     PerlIOutf8_strict
   ];
-  nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin shortenPerlShebang;
-
-  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    shortenPerlShebang $out/bin/biber
-  '';
 
   meta = {
     description = "Backend for BibLaTeX";

pkgs/by-name/bi/bitwarden-cli/package.nix

@@ -91,7 +91,6 @@ buildNpmPackage (finalAttrs: {
     versionCheckHook
   ];
   versionCheckKeepEnvironment = [ "HOME" ];
-  versionCheckProgramArg = "--version";
 
   passthru = {
     tests = {

pkgs/by-name/bm/bmputil/package.nix

@@ -37,7 +37,6 @@ rustPlatform.buildRustPackage rec {
     versionCheckHook
     udevCheckHook
   ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   meta = {

pkgs/by-name/bo/bootdev-cli/package.nix

@@ -41,7 +41,6 @@ buildGoModule rec {
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgram = "${placeholder "out"}/bin/bootdev";
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/bo/bottom/package.nix

@@ -47,7 +47,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
   versionCheckProgram = "${placeholder "out"}/bin/btm";
-  versionCheckProgramArg = "--version";
 
   passthru = {
     updateScript = nix-update-script { };

pkgs/by-name/br/broot/package.nix

@@ -79,7 +79,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/br/brotli/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   python3Packages,
   staticOnly ? stdenv.hostPlatform.isStatic,
@@ -11,26 +10,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "brotli";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "brotli";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-MvceRcle2dSkkucC2PlsCizsIf8iv95d8Xjqew266wc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-kl8ZHt71v17QR2bDP+ad/5uixf+GStEPLQ5ooFoC5i8=";
   };
 
-  patches = [
-    # revert runpath change, breaks curl on darwin:
-    #   https://github.com/NixOS/nixpkgs/pull/254532#issuecomment-1722337476
-    (fetchpatch {
-      name = "revert-runpath.patch";
-      url = "https://github.com/google/brotli/commit/f842c1bcf9264431cd3b15429a72b7dafbe80509.patch";
-      hash = "sha256-W3LY3EjoHP74YsKOOcYQrzo+f0HbooOvEbnOibtN6TM=";
-      revert = true;
-    })
-  ];
-
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = lib.optional staticOnly "-DBUILD_SHARED_LIBS=OFF";
@@ -60,6 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://github.com/google/brotli";
+    changelog = "https://github.com/google/brotli/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "General-purpose lossless compression library with CLI";
     longDescription = ''
       Brotli is a generic-purpose lossless compression algorithm that

pkgs/by-name/br/brush-splat/package.nix

@@ -59,7 +59,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru = {

pkgs/by-name/br/brush/package.nix

@@ -28,7 +28,6 @@ rustPlatform.buildRustPackage rec {
   ];
   doInstallCheck = true;
   versionCheckProgram = "${placeholder "out"}/bin/${meta.mainProgram}";
-  versionCheckProgramArg = "--version";
 
   # Found argument '--test-threads' which wasn't expected, or isn't valid in this context
   doCheck = false;

pkgs/by-name/bs/bsky-cli/package.nix

@@ -30,7 +30,6 @@ buildGoModule (finalAttrs: {
 
   doInstallCheck = true;
   versionCheckProgram = "${placeholder "out"}/bin/bsky";
-  versionCheckProgramArg = "--version";
   nativeBuildInputs = [ versionCheckHook ];
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/bt/btop/package.nix

@@ -53,7 +53,6 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/bu/buildah-unwrapped/package.nix

@@ -74,7 +74,6 @@ buildGoModule (finalAttrs: {
     writableTmpDirAsHomeHook
     versionCheckHook
   ];
-  versionCheckProgramArg = "--version";
   versionCheckKeepEnvironment = [ "HOME" ];
 
   meta = {

pkgs/by-name/bu/buildstream/package.nix

@@ -118,7 +118,6 @@ python3Packages.buildPythonApplication rec {
   '';
 
   versionCheckProgram = "${placeholder "out"}/bin/bst";
-  versionCheckProgramArg = "--version";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/bu/bulletty/package.nix

@@ -35,7 +35,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
 
   doInstallCheck = true;
-  versionCheckProgramArg = "--version";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/bu/bumpp/package.nix

@@ -48,7 +48,6 @@ stdenv.mkDerivation (finalAttrs: {
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/bu/bunbun/package.nix

@@ -22,7 +22,6 @@ rustPlatform.buildRustPackage rec {
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru = {

pkgs/by-name/bu/bundler/package.nix

@@ -25,7 +25,6 @@ buildRubyGem rec {
     versionCheckHook
   ];
   versionCheckProgram = "${placeholder "out"}/bin/bundler";
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru = {

pkgs/by-name/by/byacc/package.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchurl {
     urls = [
       "https://invisible-mirror.net/archives/byacc/byacc-${finalAttrs.version}.tgz"
-      "ftp://ftp.invisible-island.net/byacc/byacc-${finalAttrs.version}.tgz"
+      "https://invisible-island.net/archives/byacc/byacc-${finalAttrs.version}.tgz"
     ];
     hash = "sha256-GSwvrgSNTn9RS6RRYn+cTmEnZQmfgZwZGR+f3j5glnM=";
   };

pkgs/by-name/ca/cacert/package.nix

@@ -23,7 +23,7 @@ let
     lib.concatStringsSep "\n\n" extraCertificateStrings
   );
 
-  srcVersion = "3.115";
+  srcVersion = "3.117";
   version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = {
     homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -47,7 +47,7 @@ let
           owner = "nss-dev";
           repo = "nss";
           rev = "NSS_${lib.replaceStrings [ "." ] [ "_" ] version}_RTM";
-          hash = "sha256-8PeFeaIOtjBZJLBx3ONwZlK5SaLnjKEFoZWvVsu/3tA=";
+          hash = "sha256-sAs0TiV3TK/WtgHvEjl2KFAgebyWZYmcRcmxjpn2AME=";
         };
 
     dontBuild = true;

pkgs/by-name/ca/camilladsp/package.nix

@@ -44,7 +44,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
 
   meta = {
     description = "Flexible cross-platform IIR and FIR engine for crossovers, room correction etc";

pkgs/by-name/ca/carapace-bridge/package.nix

@@ -28,7 +28,6 @@ buildGoModule (finalAttrs: {
   '';
 
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/ca/cargo-aoc/package.nix

@@ -17,7 +17,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-q0kpo6DNR+8129+vJSLoOC/bUYjlfaB77YTht6+kT00=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/ca/cargo-auditable/builder.nix

@@ -0,0 +1,63 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  installShellFiles,
+  auditable-bootstrap,
+}:
+lib.extendMkDerivation {
+  constructDrv = rustPlatform.buildRustPackage.override { cargo-auditable = auditable-bootstrap; };
+
+  extendDrvArgs =
+    finalAttrs:
+    {
+      pname ? "cargo-auditable",
+      auditable ? true,
+      hash ? "",
+      cargoHash ? "",
+      ...
+    }:
+    {
+      inherit auditable pname;
+
+      src = fetchFromGitHub {
+        owner = "rust-secure-code";
+        repo = "cargo-auditable";
+        tag = "v${finalAttrs.version}";
+        inherit hash;
+      };
+
+      nativeBuildInputs = [
+        installShellFiles
+      ];
+
+      checkFlags = [
+        # requires wasm32-unknown-unknown target
+        "--skip=test_wasm"
+        # Seems to be a bug in tests of locked vs. semver compatible packages
+        # https://github.com/rust-secure-code/cargo-auditable/issues/235
+        "--skip=test_proc_macro"
+        "--skip=test_self_hosting"
+      ];
+
+      postInstall = ''
+        installManPage cargo-auditable/cargo-auditable.1
+      '';
+
+      passthru.bootstrap = auditable-bootstrap;
+
+      meta = {
+        description = "Tool to make production Rust binaries auditable";
+        mainProgram = "cargo-auditable";
+        homepage = "https://github.com/rust-secure-code/cargo-auditable";
+        changelog = "https://github.com/rust-secure-code/cargo-auditable/blob/v${finalAttrs.version}/cargo-auditable/CHANGELOG.md";
+        license = with lib.licenses; [
+          mit # or
+          asl20
+        ];
+        maintainers = with lib.maintainers; [ RossSmyth ];
+        broken = stdenv.hostPlatform != stdenv.buildPlatform;
+      };
+    };
+}

pkgs/by-name/ca/cargo-auditable/package.nix

@@ -0,0 +1,35 @@
+{
+  buildPackages,
+  callPackage,
+  makeRustPlatform,
+}:
+let
+  # Need to use the build platform rustc and Cargo so that
+  # we don't infrec
+  rustPlatform = makeRustPlatform {
+    inherit (buildPackages) rustc;
+    cargo = buildPackages.cargo.override {
+      auditable = false;
+    };
+  };
+
+  auditableBuilder = callPackage ./builder.nix {
+    inherit rustPlatform;
+    auditable-bootstrap = bootstrap;
+  };
+
+  version = "0.7.2";
+  hash = "sha256-hR6PjTOps8JSM7UbfGlCoZmmwtWExVqYwh4lxDiFWdc=";
+  cargoHash = "sha256-JEfnUJ9J6Xak3AOCwQCnu+v+3Wl3QbXX20qVFWB6040=";
+
+  # cargo-auditable cannot be built with cargo-auditable until cargo-auditable is built
+  bootstrap = auditableBuilder {
+    inherit version hash cargoHash;
+    pname = "cargo-auditable-bootstrap";
+    auditable = false;
+  };
+in
+auditableBuilder {
+  inherit version hash cargoHash;
+  auditable = true;
+}

pkgs/by-name/ca/cargo-expand/package.nix

@@ -20,7 +20,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-Di7Nnp8qYqpTkKmmUYoKxSkntepG80vVF2AkaN5yW+U=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/ca/cargo-hakari/package.nix

@@ -27,7 +27,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
-  versionCheckProgramArg = "--version";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/ca/cargo-llvm-cov/package.nix

@@ -93,7 +93,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
       CobaltCause
     ];
 
-    # The profiler runtime is (currently) disabled on non-Linux platforms
-    broken = !(stdenv.hostPlatform.isLinux && !stdenv.targetPlatform.isRedox);
+    broken = stdenv.targetPlatform.isRedox;
   };
 })