From 21c0a5bedb2e7daa1d7e5bd99028bd522977ddf0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 21 Oct 2022 19:32:30 +0000
Subject: [PATCH 001/231] libavif: 0.10.0 -> 0.11.1

---
 pkgs/development/libraries/libavif/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libavif/default.nix b/pkgs/development/libraries/libavif/default.nix
index d5a2a686b893..bdb384f2496c 100644
--- a/pkgs/development/libraries/libavif/default.nix
+++ b/pkgs/development/libraries/libavif/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libavif";
-  version = "0.10.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "AOMediaCodec";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-EGu2avkqQXHFX4gKWsVfVdQN99f4J7Hm86C0sAhuP1Y=";
+    sha256 = "sha256-mUi0DU99XV3FzUZ8/9uJZU+W3fc6Bk6+y6Z78IRZ9Qs=";
   };
 
   # reco: encode libaom slowest but best, decode dav1d fastest

From a5eb3b03ffff6e709412c7f3e1e57e04df2349ed Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Mon, 28 Nov 2022 14:46:44 +0100
Subject: [PATCH 002/231] cups: fix cups.socket unit

The cups.socket unit shouldn't be part of cups.service: stopping the
service would stop the socket and break subsequent socket activations.

See https://github.com/apple/cups/issues/6005
---
 pkgs/misc/cups/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index c844dbffee40..a9c818a12f57 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -57,6 +57,11 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace cups/testfile.c \
       --replace 'cupsFileFind("cat", "/bin' 'cupsFileFind("cat", "${coreutils}/bin'
+
+      # The cups.socket unit shouldn't be part of cups.service: stopping the
+      # service would stop the socket and break subsequent socket activations.
+      # See https://github.com/apple/cups/issues/6005
+      sed -i '/PartOf=cups.service/d' scheduler/cups.socket.in
   '';
 
   nativeBuildInputs = [ pkg-config removeReferencesTo ];

From f5b5432450264c8a2c571061259d9cfe0f65a1ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 20 Nov 2022 13:50:53 +0100
Subject: [PATCH 003/231] ruby: fix cross compiling extensions

Update pkgs/development/interpreters/ruby/default.nix

Co-authored-by: Artturi <Artturin@artturin.com>
---
 pkgs/development/interpreters/ruby/default.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index dc7594da17d9..538d78b8494b 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -187,6 +187,18 @@ let
               sed -i '/CC_VERSION_MESSAGE/d' $rbConfig
             ''
           }
+
+          # Allow to override compiler. This is important for cross compiling as
+          # we need to set a compiler that is different from the build one.
+          awk -i inplace -F' = ' \
+            ' # operate on the line starting with
+              /^  CONFIG\["CC"\]/ {
+                # replace the right hand side
+                sub($2, "ENV[\"CC\"] || \"1\"")
+              }; { print }' "$rbConfig"
+          # test that the line isn't mangled in case upstream made the above unnecessary
+          grep -qx '  CONFIG\["CC"\] = ENV\["CC"\] || "1"' "$rbConfig"
+
           # Remove unnecessary external intermediate files created by gems
           extMakefiles=$(find $out/lib/ruby/gems -name Makefile)
           for makefile in $extMakefiles; do

From d402e05f6a6a2b87b15cde6d04cf251d6ee94407 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 4 Dec 2022 10:26:22 +0100
Subject: [PATCH 004/231] libdevil: cleanup, add proper option for X support

---
 .../libraries/libdevil/default.nix            | 46 ++++++++++++-------
 pkgs/top-level/all-packages.nix               |  3 +-
 2 files changed, 31 insertions(+), 18 deletions(-)

diff --git a/pkgs/development/libraries/libdevil/default.nix b/pkgs/development/libraries/libdevil/default.nix
index a79e5371c01b..35637512e0a5 100644
--- a/pkgs/development/libraries/libdevil/default.nix
+++ b/pkgs/development/libraries/libdevil/default.nix
@@ -1,23 +1,37 @@
-{ lib, stdenv, fetchurl, libjpeg, libpng, libmng, lcms1, libtiff, openexr, libGL
-, libX11, pkg-config, OpenGL
+{ lib
+, stdenv
+, fetchurl
+, libjpeg
+, libpng
+, libmng
+, lcms1
+, libtiff
+, openexr
+, libGL
+, libX11
+, pkg-config
+, OpenGL
+, runtimeShell
+, withXorg ? true
 }:
 
 stdenv.mkDerivation rec {
-
   pname = "libdevil";
   version = "1.7.8";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchurl {
     url = "mirror://sourceforge/openil/DevIL-${version}.tar.gz";
     sha256 = "1zd850nn7nvkkhasrv7kn17kzgslr5ry933v6db62s4lr0zzlbv8";
   };
 
-  outputs = [ "out" "dev" ];
-
-  buildInputs = [ libjpeg libpng libmng lcms1 libtiff openexr libGL libX11 ]
-    ++ lib.optionals stdenv.isDarwin [ OpenGL ];
   nativeBuildInputs = [ pkg-config ];
 
+  buildInputs = [ libjpeg libpng libmng lcms1 libtiff openexr ]
+    ++ lib.optionals withXorg [ libX11 libGL ]
+    ++ lib.optionals stdenv.isDarwin [ OpenGL ];
+
   configureFlags = [ "--enable-ILU" "--enable-ILUT" ];
 
   preConfigure = ''
@@ -31,29 +45,29 @@ stdenv.mkDerivation rec {
     sed -i '/RESTRICT_KEYWORD/d' include/IL/config.h
   '';
 
-  patches =
-    [ ( fetchurl {
+  patches = [
+    (fetchurl {
         url = "https://sources.debian.org/data/main/d/devil/1.7.8-10/debian/patches/03_CVE-2009-3994.diff";
         sha256 = "0qkx2qfv02igbrmsn6z5a3lbrbwjfh3rb0c2sj54wy0j1f775hbc";
-      } )
-      ./ftbfs-libpng15.patch
-      ./il_endian.h.patch
-    ];
+    })
+    ./ftbfs-libpng15.patch
+    ./il_endian.h.patch
+  ];
 
   enableParallelBuilding = true;
 
   postPatch = ''
     for a in test/Makefile.in test/format_test/format_checks.sh.in ; do
       substituteInPlace $a \
-        --replace /bin/bash ${stdenv.shell}
+        --replace /bin/bash ${runtimeShell}
     done
   '';
 
   meta = with lib; {
-    homepage = "http://openil.sourceforge.net/";
+    homepage = "https://openil.sourceforge.net/";
     description = "An image library which can can load, save, convert, manipulate, filter and display a wide variety of image formats";
     license = licenses.lgpl2;
     platforms = platforms.mesaPlatforms;
-    maintainers = [ ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5f7e3a7f6002..5cee437b21ab 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20275,8 +20275,7 @@ with pkgs;
   };
 
   libdevil-nox = libdevil.override {
-    libX11 = null;
-    libGL = null;
+    withXorg = false;
   };
 
   libdecor = callPackage ../development/libraries/libdecor { };

From 7c473eb699d1c92db5f8aa1fe96d79eb2ae4aebc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 4 Dec 2022 10:38:20 +0100
Subject: [PATCH 005/231] gd: add withXorg flag, little cleanups

---
 pkgs/development/libraries/gd/default.nix | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/libraries/gd/default.nix b/pkgs/development/libraries/gd/default.nix
index 7ea8ce6d29b4..c9845feb9678 100644
--- a/pkgs/development/libraries/gd/default.nix
+++ b/pkgs/development/libraries/gd/default.nix
@@ -1,4 +1,6 @@
-{ lib, stdenv, fetchurl
+{ lib
+, stdenv
+, fetchurl
 , fetchpatch
 , autoconf
 , automake
@@ -8,6 +10,7 @@
 , libjpeg
 , libwebp
 , libtiff
+, withXorg ? true
 , libXpm
 , libavif
 , fontconfig
@@ -33,20 +36,22 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  configureFlags =
-    [
-      "--enable-gd-formats"
-    ]
+  configureFlags = [
+    "--enable-gd-formats"
+  ]
     # -pthread gets passed to clang, causing warnings
     ++ lib.optional stdenv.isDarwin "--enable-werror=no";
 
   nativeBuildInputs = [ autoconf automake pkg-config ];
 
-  buildInputs = [ zlib fontconfig freetype libpng libjpeg libwebp libtiff libXpm libavif ];
+  buildInputs = [ zlib fontconfig freetype libpng libjpeg libwebp libtiff libavif ]
+    ++ lib.optional withXorg libXpm;
 
   outputs = [ "bin" "dev" "out" ];
 
-  postFixup = ''moveToOutput "bin/gdlib-config" $dev'';
+  postFixup = ''
+    moveToOutput "bin/gdlib-config" $dev
+  '';
 
   enableParallelBuilding = true;
 
@@ -57,5 +62,6 @@ stdenv.mkDerivation rec {
     description = "A dynamic image creation library";
     license = licenses.free; # some custom license
     platforms = platforms.unix;
+    maintainers = with maintainers; [ ];
   };
 }

From 88800d588b6ccc28ff8dfa0bd7420945996e7cec Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 5 Dec 2022 08:29:16 +0000
Subject: [PATCH 006/231] dnsmasq: 2.87 -> 2.88

---
 pkgs/tools/networking/dnsmasq/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/dnsmasq/default.nix b/pkgs/tools/networking/dnsmasq/default.nix
index 1eb8b85166fe..6d4e28f6cb6b 100644
--- a/pkgs/tools/networking/dnsmasq/default.nix
+++ b/pkgs/tools/networking/dnsmasq/default.nix
@@ -18,11 +18,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "dnsmasq";
-  version = "2.87";
+  version = "2.88";
 
   src = fetchurl {
     url = "https://www.thekelleys.org.uk/dnsmasq/${pname}-${version}.tar.xz";
-    sha256 = "sha256-AijANkp/I1b9fn8VSZN8vzCZp407LrG6W7DDHiuJ3no=";
+    sha256 = "sha256-I1RN7aEDQMBTvqbxWpP+1up/WqqFMWv8Zx/6bSL7wbM=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''

From 8a041c63c00ab9f03cfc468dcdecf2138e31513e Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Sun, 4 Dec 2022 20:52:06 -0500
Subject: [PATCH 007/231] rustPlatform.buildRustPackage: build auditable
 binaries

---
 .../rust/build-rust-package/default.nix       |  6 +++
 .../rust/hooks/cargo-build-hook.sh            |  2 +-
 .../rust/hooks/cargo-check-hook.sh            |  2 +-
 .../rust/hooks/cargo-nextest-hook.sh          |  2 +-
 pkgs/development/compilers/rust/cargo.nix     |  3 ++
 .../tools/rust/cargo-auditable/default.nix    | 51 ++++++++++++-------
 6 files changed, 45 insertions(+), 21 deletions(-)

diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index 679e10a3442e..a7a9d9b52fc0 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -11,6 +11,7 @@
 , cargoInstallHook
 , cargoNextestHook
 , cargoSetupHook
+, cargo-auditable
 , rustc
 , libiconv
 , windows
@@ -42,6 +43,7 @@
 , buildFeatures ? [ ]
 , checkFeatures ? buildFeatures
 , useNextest ? false
+, auditable ? true
 , depsExtraArgs ? {}
 
 # Toggles whether a custom sysroot is created when the target is a .json file.
@@ -113,6 +115,8 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoUpdateHook" "carg
 
   cargoCheckFeatures = checkFeatures;
 
+  cargoCommand = if auditable then "cargo auditable" else "cargo";
+
   patchRegistryDeps = ./patch-registry-deps;
 
   nativeBuildInputs = nativeBuildInputs ++ [
@@ -123,6 +127,8 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoUpdateHook" "carg
     cargoInstallHook
     cargoSetupHook
     rustc
+  ] ++ lib.optionals auditable [
+    cargo-auditable
   ];
 
   buildInputs = buildInputs
diff --git a/pkgs/build-support/rust/hooks/cargo-build-hook.sh b/pkgs/build-support/rust/hooks/cargo-build-hook.sh
index 7503fae4cd7f..0fe07d6e856e 100644
--- a/pkgs/build-support/rust/hooks/cargo-build-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-build-hook.sh
@@ -31,7 +31,7 @@ cargoBuildHook() {
       "CXX_@rustBuildPlatform@=@cxxForBuild@" \
       "CC_@rustTargetPlatform@=@ccForHost@" \
       "CXX_@rustTargetPlatform@=@cxxForHost@" \
-      cargo build -j $NIX_BUILD_CORES \
+      ${cargoCommand-cargo} build -j $NIX_BUILD_CORES \
         --target @rustTargetPlatformSpec@ \
         --frozen \
         ${cargoBuildProfileFlag} \
diff --git a/pkgs/build-support/rust/hooks/cargo-check-hook.sh b/pkgs/build-support/rust/hooks/cargo-check-hook.sh
index 57fc2779cfe9..c2a909c76f6f 100644
--- a/pkgs/build-support/rust/hooks/cargo-check-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-check-hook.sh
@@ -33,7 +33,7 @@ cargoCheckHook() {
 
     (
         set -x
-        cargo test \
+        ${cargoCommand-cargo} test \
               -j $NIX_BUILD_CORES \
               ${argstr} -- \
               --test-threads=${threads} \
diff --git a/pkgs/build-support/rust/hooks/cargo-nextest-hook.sh b/pkgs/build-support/rust/hooks/cargo-nextest-hook.sh
index de85683ead2a..a4ab778c298a 100644
--- a/pkgs/build-support/rust/hooks/cargo-nextest-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-nextest-hook.sh
@@ -33,7 +33,7 @@ cargoNextestHook() {
 
     (
         set -x
-        cargo nextest run \
+        ${cargoCommand-cargo} nextest run \
               -j ${threads} \
               ${argstr} -- \
               ${checkFlags} \
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index 2c9a3b1af472..ec80533cc069 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -2,6 +2,7 @@
 , file, curl, pkg-config, python3, openssl, cmake, zlib
 , installShellFiles, makeWrapper, cacert, rustPlatform, rustc
 , libiconv, CoreFoundation, Security
+, auditable ? true
 }:
 
 rustPlatform.buildRustPackage {
@@ -12,6 +13,8 @@ rustPlatform.buildRustPackage {
   cargoVendorDir = "vendor";
   buildAndTestSubdir = "src/tools/cargo";
 
+  inherit auditable;
+
   passthru = {
     rustc = rustc;
     inherit (rustc) tests;
diff --git a/pkgs/development/tools/rust/cargo-auditable/default.nix b/pkgs/development/tools/rust/cargo-auditable/default.nix
index 64580d8ad8b3..52d647b2b0a5 100644
--- a/pkgs/development/tools/rust/cargo-auditable/default.nix
+++ b/pkgs/development/tools/rust/cargo-auditable/default.nix
@@ -1,23 +1,38 @@
-{ lib, rustPlatform, fetchFromGitHub }:
+{ lib, fetchFromGitHub, makeRustPlatform, rustc, cargo }:
 
-rustPlatform.buildRustPackage rec {
-  pname = "cargo-auditable";
-  version = "0.5.5";
+let
+  args = rec {
+    pname = "cargo-auditable";
+    version = "0.5.5";
 
-  src = fetchFromGitHub {
-    owner = "rust-secure-code";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-mEmTgd7sC2jmYeb5pEO985v/aWWKlq/mSQUAGi32loY=";
+    src = fetchFromGitHub {
+      owner = "rust-secure-code";
+      repo = pname;
+      rev = "v${version}";
+      sha256 = "sha256-mEmTgd7sC2jmYeb5pEO985v/aWWKlq/mSQUAGi32loY=";
+    };
+
+    cargoSha256 = "sha256-G72UUqvFaTY/GQSkpz1wIzjb7vIWuAjvKMZosUB6YsA=";
+
+    meta = with lib; {
+      description = "A tool to make production Rust binaries auditable";
+      homepage = "https://github.com/rust-secure-code/cargo-auditable";
+      changelog = "https://github.com/rust-secure-code/cargo-auditable/blob/v${version}/cargo-auditable/CHANGELOG.md";
+      license = with licenses; [ mit /* or */ asl20 ];
+      maintainers = with maintainers; [ figsoda ];
+    };
   };
 
-  cargoSha256 = "sha256-G72UUqvFaTY/GQSkpz1wIzjb7vIWuAjvKMZosUB6YsA=";
-
-  meta = with lib; {
-    description = "A tool to make production Rust binaries auditable";
-    homepage = "https://github.com/rust-secure-code/cargo-auditable";
-    changelog = "https://github.com/rust-secure-code/cargo-auditable/blob/v${version}/cargo-auditable/CHANGELOG.md";
-    license = with licenses; [ mit /* or */ asl20 ];
-    maintainers = with maintainers; [ figsoda ];
+  rustPlatform = makeRustPlatform {
+    inherit rustc;
+    cargo = cargo.override {
+      auditable = false;
+    };
   };
-}
+
+  bootstrap = rustPlatform.buildRustPackage (args // {
+    auditable = false;
+  });
+in
+
+rustPlatform.buildRustPackage.override { cargo-auditable = bootstrap; } args

From 6c01681679f7d2da1d300b6d16d11d58ba8b2286 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Tue, 6 Dec 2022 00:05:28 +0200
Subject: [PATCH 008/231] make-symlinks-relative: fix no such file or directory
 if output is created in postFixup

wlroots(and others) have
```
wlroots> +++ find /nix/store/3a0xwszw8n5dzzhsgfnilvsqi4hk565s-wlroots-0.15.1-examples -type l -print0
wlroots> find: '/nix/store/3a0xwszw8n5dzzhsgfnilvsqi4hk565s-wlroots-0.15.1-examples': No such file or directory
```

because the examples output is created in postFixup while this hook runs in fixupPhase
---
 pkgs/build-support/setup-hooks/make-symlinks-relative.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/setup-hooks/make-symlinks-relative.sh b/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
index 0608d3ca81c4..cd9c2eaa2d80 100644
--- a/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
+++ b/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
@@ -1,4 +1,4 @@
-fixupOutputHooks+=(_makeSymlinksRelative)
+postFixupHooks+=(_makeSymlinksRelative)
 
 # For every symlink in $output that refers to another file in $output
 # ensure that the symlink is relative. This removes references to the output

From 0e5137f267ecf7dc0c9d68cc1b6fde13f5dc77ef Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Mon, 5 Dec 2022 18:43:06 -0500
Subject: [PATCH 009/231] rustPlatform.buildRustPackage: make it not auditable
 by default

---
 pkgs/build-support/rust/build-rust-package/default.nix  | 3 ++-
 pkgs/development/compilers/rust/cargo.nix               | 2 +-
 pkgs/development/tools/rust/cargo-auditable/default.nix | 4 +++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index a7a9d9b52fc0..6da9566f8813 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -43,7 +43,8 @@
 , buildFeatures ? [ ]
 , checkFeatures ? buildFeatures
 , useNextest ? false
-, auditable ? true
+, auditable ? false # TODO: change to true
+
 , depsExtraArgs ? {}
 
 # Toggles whether a custom sysroot is created when the target is a .json file.
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index ec80533cc069..5571918fdc62 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -2,7 +2,7 @@
 , file, curl, pkg-config, python3, openssl, cmake, zlib
 , installShellFiles, makeWrapper, cacert, rustPlatform, rustc
 , libiconv, CoreFoundation, Security
-, auditable ? true
+, auditable ? false # TODO: change to true when this is the default
 }:
 
 rustPlatform.buildRustPackage {
diff --git a/pkgs/development/tools/rust/cargo-auditable/default.nix b/pkgs/development/tools/rust/cargo-auditable/default.nix
index 52d647b2b0a5..6d8424040d02 100644
--- a/pkgs/development/tools/rust/cargo-auditable/default.nix
+++ b/pkgs/development/tools/rust/cargo-auditable/default.nix
@@ -35,4 +35,6 @@ let
   });
 in
 
-rustPlatform.buildRustPackage.override { cargo-auditable = bootstrap; } args
+rustPlatform.buildRustPackage.override { cargo-auditable = bootstrap; } (args // {
+  auditable = true; # TODO: remove when this is the default
+})

From 0024ffa7c26ecaff146cae9f04f465dd5ee144cc Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Mon, 5 Dec 2022 18:43:34 -0500
Subject: [PATCH 010/231] alacritty: make auditable

---
 pkgs/applications/terminal-emulators/alacritty/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/applications/terminal-emulators/alacritty/default.nix b/pkgs/applications/terminal-emulators/alacritty/default.nix
index 7c0bd8b6410a..272b875cd7a8 100644
--- a/pkgs/applications/terminal-emulators/alacritty/default.nix
+++ b/pkgs/applications/terminal-emulators/alacritty/default.nix
@@ -60,6 +60,8 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-t6ckX0PYI8UHfXhGRpcX8ly3DzE9A6i9P6f3Ny3DBzw=";
 
+  auditable = true; # TODO: remove when this is the default
+
   nativeBuildInputs = [
     cmake
     installShellFiles

From 6f52f4b6776cb711ff2fe93128767d828bd066af Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Mon, 5 Dec 2022 18:43:48 -0500
Subject: [PATCH 011/231] rust-analyzer: make auditable

---
 pkgs/development/tools/rust/rust-analyzer/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/tools/rust/rust-analyzer/default.nix b/pkgs/development/tools/rust/rust-analyzer/default.nix
index f9ec10f34301..e70d7b955b14 100644
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@@ -22,6 +22,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-D0YwkSqwtD08twtCtN5q0a8S0Y26kgDWg1ruRNEQEOw=";
   };
 
+  auditable = true; # TODO: remove when this is the default
+
   cargoBuildFlags = [ "--bin" "rust-analyzer" "--bin" "rust-analyzer-proc-macro-srv" ];
   cargoTestFlags = [ "--package" "rust-analyzer" "--package" "proc-macro-srv-cli" ];
 

From e4186ccd21b5e7c4253ec12768648f77180fb03b Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Mon, 5 Dec 2022 18:44:07 -0500
Subject: [PATCH 012/231] jumpy: make auditable

---
 pkgs/games/jumpy/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/games/jumpy/default.nix b/pkgs/games/jumpy/default.nix
index 645069e4354d..4fea663af533 100644
--- a/pkgs/games/jumpy/default.nix
+++ b/pkgs/games/jumpy/default.nix
@@ -24,6 +24,8 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-AXaGuRqSFiq+Uiy+UaqPdPVyDhCogC64KZZ0Ah1Yo7A=";
 
+  auditable = true; # TODO: remove when this is the default
+
   nativeBuildInputs = lib.optionals stdenv.isLinux [
     pkg-config
   ];

From 506762f643c53fc3687bd72821e9f88b52243596 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Mon, 5 Dec 2022 18:44:22 -0500
Subject: [PATCH 013/231] fd: make auditable

---
 pkgs/tools/misc/fd/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/tools/misc/fd/default.nix b/pkgs/tools/misc/fd/default.nix
index 6dd0e7a6e7cb..dc640dc438a6 100644
--- a/pkgs/tools/misc/fd/default.nix
+++ b/pkgs/tools/misc/fd/default.nix
@@ -13,6 +13,8 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-QFh47Pr+7lIdT++huziKgMJxvsZElTTwu11c7/wjyHE=";
 
+  auditable = true; # TODO: remove when this is the default
+
   nativeBuildInputs = [ installShellFiles ];
 
   preFixup = ''

From f053bc8339e2fa2598eac55814ef10d4ce7cd157 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Mon, 5 Dec 2022 18:44:30 -0500
Subject: [PATCH 014/231] ripgrep: make auditable

---
 pkgs/tools/text/ripgrep/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/tools/text/ripgrep/default.nix b/pkgs/tools/text/ripgrep/default.nix
index 022f8bd25bb7..be989994dbff 100644
--- a/pkgs/tools/text/ripgrep/default.nix
+++ b/pkgs/tools/text/ripgrep/default.nix
@@ -22,6 +22,8 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1kfdgh8dra4jxgcdb0lln5wwrimz0dpp33bq3h7jgs8ngaq2a9wp";
 
+  auditable = true; # TODO: remove when this is the default
+
   nativeBuildInputs = [ asciidoctor installShellFiles ]
     ++ lib.optional withPCRE2 pkg-config;
   buildInputs = lib.optional withPCRE2 pcre2

From b632d78aeacc6259065e4471c1817d3a99b4f305 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Mon, 5 Dec 2022 18:57:49 -0500
Subject: [PATCH 015/231] rav1e: make auditable

---
 pkgs/tools/video/rav1e/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index ed6a8f542343..b664f32b4df9 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -13,17 +13,19 @@ in rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-V9QbztkFj3t5yBV+yySysDy3Q6IUY4gNzBL8h23aEg4=";
 
+  auditable = true; # TODO: remove when this is the default
+
   nativeBuildInputs = [ nasm cargo-c ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
 
   checkType = "debug";
 
   postBuild = ''
-    cargo cbuild --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    $cargoCommand cbuild --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
   '';
 
   postInstall = ''
-    cargo cinstall --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    $cargoCommand cinstall --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
   '';
 
   meta = with lib; {

From 9e3db33a6b05806ec098f54d89d2bdb74fdbbfb1 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Mon, 5 Dec 2022 19:10:32 -0500
Subject: [PATCH 016/231] mdbook: make auditable

---
 pkgs/tools/text/mdbook/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/tools/text/mdbook/default.nix b/pkgs/tools/text/mdbook/default.nix
index 56d60eb7fb55..3376937880c1 100644
--- a/pkgs/tools/text/mdbook/default.nix
+++ b/pkgs/tools/text/mdbook/default.nix
@@ -13,6 +13,8 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-KVoMC8ypikABVkIj5dCSHzYZ9CV8UMuAFxSEYLaQTSk=";
 
+  auditable = true; # TODO: remove when this is the default
+
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
   # Tests rely on unset 'RUST_LOG' value to emit INFO messages.

From ac17e99f6c3022ce5d8fae790dc98431395a105e Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Tue, 6 Dec 2022 23:15:57 -0500
Subject: [PATCH 017/231] cargo-auditable: 0.5.5 -> unstable-2022-12-07

Diff: https://github.com/rust-secure-code/cargo-auditable/compare/v0.5.5...246468da22d619c816227797fb176c44026c7105
---
 pkgs/development/tools/rust/cargo-auditable/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/tools/rust/cargo-auditable/default.nix b/pkgs/development/tools/rust/cargo-auditable/default.nix
index 6d8424040d02..b60c0fe62050 100644
--- a/pkgs/development/tools/rust/cargo-auditable/default.nix
+++ b/pkgs/development/tools/rust/cargo-auditable/default.nix
@@ -3,16 +3,16 @@
 let
   args = rec {
     pname = "cargo-auditable";
-    version = "0.5.5";
+    version = "unstable-2022-12-07";
 
     src = fetchFromGitHub {
       owner = "rust-secure-code";
       repo = pname;
-      rev = "v${version}";
-      sha256 = "sha256-mEmTgd7sC2jmYeb5pEO985v/aWWKlq/mSQUAGi32loY=";
+      rev = "246468da22d619c816227797fb176c44026c7105";
+      sha256 = "sha256-tZ6qA20TM+mZa2bYWWdFeM+6104e+hVE9Swst2n6Mx8=";
     };
 
-    cargoSha256 = "sha256-G72UUqvFaTY/GQSkpz1wIzjb7vIWuAjvKMZosUB6YsA=";
+    cargoSha256 = "sha256-LkFP/m/pTIDnIueNDwM89lk7FNXnT4Fl8EIdXgR9oOg=";
 
     meta = with lib; {
       description = "A tool to make production Rust binaries auditable";

From a6137b73f9656c0c5d7c8422c0f7444abbdfc14b Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Wed, 7 Dec 2022 00:18:58 -0500
Subject: [PATCH 018/231] cargo-auditable-cargo-wrapper: init

---
 .../rust/build-rust-package/default.nix             | 11 ++++++-----
 pkgs/build-support/rust/hooks/cargo-build-hook.sh   |  2 +-
 pkgs/build-support/rust/hooks/cargo-check-hook.sh   |  2 +-
 pkgs/build-support/rust/hooks/cargo-nextest-hook.sh |  2 +-
 .../tools/rust/cargo-auditable/cargo-wrapper.nix    | 13 +++++++++++++
 pkgs/tools/video/rav1e/default.nix                  |  4 ++--
 pkgs/top-level/all-packages.nix                     |  1 +
 7 files changed, 25 insertions(+), 10 deletions(-)
 create mode 100644 pkgs/development/tools/rust/cargo-auditable/cargo-wrapper.nix

diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index 6da9566f8813..20fb41d0aaa7 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -12,6 +12,7 @@
 , cargoNextestHook
 , cargoSetupHook
 , cargo-auditable
+, cargo-auditable-cargo-wrapper
 , rustc
 , libiconv
 , windows
@@ -116,11 +117,13 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoUpdateHook" "carg
 
   cargoCheckFeatures = checkFeatures;
 
-  cargoCommand = if auditable then "cargo auditable" else "cargo";
-
   patchRegistryDeps = ./patch-registry-deps;
 
-  nativeBuildInputs = nativeBuildInputs ++ [
+  nativeBuildInputs = nativeBuildInputs ++ lib.optionals auditable [
+    (cargo-auditable-cargo-wrapper.override {
+      inherit cargo-auditable;
+    })
+  ] ++ [
     cacert
     git
     cargoBuildHook
@@ -128,8 +131,6 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoUpdateHook" "carg
     cargoInstallHook
     cargoSetupHook
     rustc
-  ] ++ lib.optionals auditable [
-    cargo-auditable
   ];
 
   buildInputs = buildInputs
diff --git a/pkgs/build-support/rust/hooks/cargo-build-hook.sh b/pkgs/build-support/rust/hooks/cargo-build-hook.sh
index 0fe07d6e856e..7503fae4cd7f 100644
--- a/pkgs/build-support/rust/hooks/cargo-build-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-build-hook.sh
@@ -31,7 +31,7 @@ cargoBuildHook() {
       "CXX_@rustBuildPlatform@=@cxxForBuild@" \
       "CC_@rustTargetPlatform@=@ccForHost@" \
       "CXX_@rustTargetPlatform@=@cxxForHost@" \
-      ${cargoCommand-cargo} build -j $NIX_BUILD_CORES \
+      cargo build -j $NIX_BUILD_CORES \
         --target @rustTargetPlatformSpec@ \
         --frozen \
         ${cargoBuildProfileFlag} \
diff --git a/pkgs/build-support/rust/hooks/cargo-check-hook.sh b/pkgs/build-support/rust/hooks/cargo-check-hook.sh
index c2a909c76f6f..57fc2779cfe9 100644
--- a/pkgs/build-support/rust/hooks/cargo-check-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-check-hook.sh
@@ -33,7 +33,7 @@ cargoCheckHook() {
 
     (
         set -x
-        ${cargoCommand-cargo} test \
+        cargo test \
               -j $NIX_BUILD_CORES \
               ${argstr} -- \
               --test-threads=${threads} \
diff --git a/pkgs/build-support/rust/hooks/cargo-nextest-hook.sh b/pkgs/build-support/rust/hooks/cargo-nextest-hook.sh
index a4ab778c298a..de85683ead2a 100644
--- a/pkgs/build-support/rust/hooks/cargo-nextest-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-nextest-hook.sh
@@ -33,7 +33,7 @@ cargoNextestHook() {
 
     (
         set -x
-        ${cargoCommand-cargo} nextest run \
+        cargo nextest run \
               -j ${threads} \
               ${argstr} -- \
               ${checkFlags} \
diff --git a/pkgs/development/tools/rust/cargo-auditable/cargo-wrapper.nix b/pkgs/development/tools/rust/cargo-auditable/cargo-wrapper.nix
new file mode 100644
index 000000000000..3afa59739a37
--- /dev/null
+++ b/pkgs/development/tools/rust/cargo-auditable/cargo-wrapper.nix
@@ -0,0 +1,13 @@
+{ lib, writeShellApplication, cargo, cargo-auditable }:
+
+(writeShellApplication {
+  name = "cargo";
+  runtimeInputs = [ cargo cargo-auditable ];
+  text = ''
+    CARGO_AUDITABLE_IGNORE_UNSUPPORTED=1 cargo auditable "$@"
+  '';
+}) // {
+  meta = cargo-auditable.meta // {
+    mainProgram = "cargo";
+  };
+}
diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index b664f32b4df9..c1b5643f6733 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -21,11 +21,11 @@ in rustPlatform.buildRustPackage rec {
   checkType = "debug";
 
   postBuild = ''
-    $cargoCommand cbuild --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    cargo cbuild --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
   '';
 
   postInstall = ''
-    $cargoCommand cinstall --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    cargo cinstall --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
   '';
 
   meta = with lib; {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 141d3bb52acb..b63e54d04125 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15206,6 +15206,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
   cargo-auditable = callPackage ../development/tools/rust/cargo-auditable { };
+  cargo-auditable-cargo-wrapper = callPackage ../development/tools/rust/cargo-auditable/cargo-wrapper.nix { };
   cargo-bisect-rustc = callPackage ../development/tools/rust/cargo-bisect-rustc {
     inherit (darwin.apple_sdk.frameworks) Security;
     openssl = openssl_1_1;

From 4ab0618bc585ce69c2f34c0e1f12c7d86522f114 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Wed, 7 Dec 2022 00:21:46 -0500
Subject: [PATCH 019/231] librsvg: make auditable

---
 pkgs/development/libraries/librsvg/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 6b174a7dfa4d..a60da602e070 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -15,7 +15,7 @@
 , rustPlatform
 , rustc
 , rust
-, cargo
+, cargo-auditable-cargo-wrapper
 , gi-docgen
 , python3Packages
 , gnome
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     gdk-pixbuf
     pkg-config
     rustc
-    cargo
+    cargo-auditable-cargo-wrapper
     python3Packages.docutils
     vala
     rustPlatform.cargoSetupHook

From e1b4c1f7bdf9a568c034839998a2dd37671ded5d Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 7 Dec 2022 12:19:51 +0100
Subject: [PATCH 020/231] ghostscript_headless: init

---
 pkgs/top-level/all-packages.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 734cb670af49..e9b4d188a1da 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -36639,6 +36639,11 @@ with pkgs;
     x11Support = true;
   };
 
+  ghostscript_headless = ghostscript.override {
+    cupsSupport = false;
+    x11Support = false;
+  };
+
   glava = callPackage ../applications/misc/glava {};
 
   gnuk = callPackage ../misc/gnuk {

From d896fa5370e423b5d7dd5b51ffb12620c5da813e Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 7 Dec 2022 12:19:39 +0100
Subject: [PATCH 021/231] texlive: Use ghostscriptX -> ghostscript_headless

The code and typical use case suggest that ghostscript is not used
graphically. Removing this dependency reduces the build closure of
many tools that use texlive for documentation.

If this needs to be reverted, please state the graphical use case
in a comment, so we don't make this mistake again.
---
 pkgs/tools/typesetting/tex/texlive/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index e58bdde501a6..180897e0bce2 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -3,7 +3,7 @@
   - current html: https://nixos.org/nixpkgs/manual/#sec-language-texlive
 */
 { stdenv, lib, fetchurl, runCommand, writeText, buildEnv
-, callPackage, ghostscriptX, harfbuzz
+, callPackage, ghostscript_headless, harfbuzz
 , makeWrapper, python3, ruby, perl, gnused, gnugrep, coreutils
 , libfaketime
 , useFixedHashes ? true
@@ -12,7 +12,7 @@
 let
   # various binaries (compiled)
   bin = callPackage ./bin.nix {
-    ghostscript = ghostscriptX;
+    ghostscript = ghostscript_headless;
     harfbuzz = harfbuzz.override {
       withIcu = true; withGraphite2 = true;
     };
@@ -25,7 +25,7 @@ let
   combine = import ./combine.nix {
     inherit bin combinePkgs buildEnv lib makeWrapper writeText
       stdenv python3 ruby perl gnused gnugrep coreutils libfaketime;
-    ghostscript = ghostscriptX; # could be without X, probably, but we use X above
+    ghostscript = ghostscript_headless;
   };
 
   # the set of TeX Live packages, collections, and schemes; using upstream naming

From 64c6e21de5a3eb05303912eec356d9e1b6727119 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 7 Dec 2022 12:20:09 +0100
Subject: [PATCH 022/231] matplotlib: Use ghostscript_headless

matplotlib does not seem to use ghostscript in its graphical /
interactive capacity, based on quick scan through the docs and
github code search.

If this needs to be reverted, please state the graphical use case
in a comment, so we don't make this mistake again.
---
 pkgs/top-level/python-packages.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 99221acb73b1..705d12f26414 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5594,6 +5594,7 @@ self: super: with self; {
   matplotlib = callPackage ../development/python-modules/matplotlib {
     stdenv = if stdenv.isDarwin then pkgs.clangStdenv else pkgs.stdenv;
     inherit (pkgs.darwin.apple_sdk.frameworks) Cocoa;
+    ghostscript = pkgs.ghostscript_headless;
   };
 
   matplotlib-inline = callPackage ../development/python-modules/matplotlib-inline { };

From 47d9e7d3d7d8ad19e29be1445171726bf7d602b6 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Mon, 28 Nov 2022 14:50:41 +0100
Subject: [PATCH 023/231] nixos/hardware/printers: stop cupsd when unneeded

If socket activation is enable (the default) and printers are configured
declaratively, the ensure-printers service will always start cupsd and
leave it running, thus defeating the point of socket activation.

With this change ensure-printers continues to start the cups.service at
boot, but automatically stops it afterwards if socket activation is
enabled.

Note: Later restarts of ensure-printers will also restart cupsd, but
it's not an issue since it will be reactivate, if necessary.
---
 nixos/modules/hardware/printers.nix | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/nixos/modules/hardware/printers.nix b/nixos/modules/hardware/printers.nix
index 64c29bb0a5b3..a8211b8c17cd 100644
--- a/nixos/modules/hardware/printers.nix
+++ b/nixos/modules/hardware/printers.nix
@@ -110,21 +110,26 @@ in {
   };
 
   config = mkIf (cfg.ensurePrinters != [] && config.services.printing.enable) {
-    systemd.services.ensure-printers = let
-      cupsUnit = if config.services.printing.startWhenNeeded then "cups.socket" else "cups.service";
-    in {
+    systemd.services.ensure-printers = {
       description = "Ensure NixOS-configured CUPS printers";
       wantedBy = [ "multi-user.target" ];
-      requires = [ cupsUnit ];
-      after = [ cupsUnit ];
+      wants = [ "cups.service" ];
+      after = [ "cups.service" ];
 
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
       };
 
-      script = concatMapStringsSep "\n" ensurePrinter cfg.ensurePrinters
-        + optionalString (cfg.ensureDefaultPrinter != null) (ensureDefaultPrinter cfg.ensureDefaultPrinter);
+      script = concatStringsSep "\n" [
+        (concatMapStrings ensurePrinter cfg.ensurePrinters)
+        (optionalString (cfg.ensureDefaultPrinter != null)
+          (ensureDefaultPrinter cfg.ensureDefaultPrinter))
+        # Note: if cupsd is "stateless" the service can't be stopped,
+        # otherwise the configuration will be wiped on the next start.
+        (optionalString (with config.services.printing; startWhenNeeded && !stateless)
+          "systemctl stop cups.service")
+      ];
     };
   };
 }

From 43cb1eb2f9b02356f130637dabcdc7fe10ee20fe Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Wed, 30 Nov 2022 16:11:13 +0100
Subject: [PATCH 024/231] nixos/cupsd: stop managing /run/cups directory

The directory is already set up by cups.socket: managing it with
RuntimeDirectory in cups.service is unnecesary and has the unwanted
effect that upon stopping cupsd systemd will remove it. This includes
the /run/cups/cups.sock socket, so it breaks socket activation.
---
 nixos/modules/services/printing/cupsd.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/nixos/modules/services/printing/cupsd.nix b/nixos/modules/services/printing/cupsd.nix
index ae59dcc226de..009f0fb030f7 100644
--- a/nixos/modules/services/printing/cupsd.nix
+++ b/nixos/modules/services/printing/cupsd.nix
@@ -395,10 +395,7 @@ in
             ''}
           '';
 
-          serviceConfig = {
-            PrivateTmp = true;
-            RuntimeDirectory = [ "cups" ];
-          };
+          serviceConfig.PrivateTmp = true;
       };
 
     systemd.services.cups-browsed = mkIf avahiEnabled

From 28034190def8d40c7cce31fb98960072a84a9a1a Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Wed, 7 Dec 2022 15:31:09 +0100
Subject: [PATCH 025/231] nixos/cupsd: fix /var/run/ warning in cups.socket
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Silence the systemd warning

    ListenStream= references a path below legacy directory /var/run/, updating /var/run/cups/cups.sock → /run/cups/cups.sock; please update the unit file accordingly

by resetting the value coming from the upstream unit.
---
 nixos/modules/services/printing/cupsd.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/printing/cupsd.nix b/nixos/modules/services/printing/cupsd.nix
index 009f0fb030f7..9ac89e057620 100644
--- a/nixos/modules/services/printing/cupsd.nix
+++ b/nixos/modules/services/printing/cupsd.nix
@@ -341,7 +341,7 @@ in
 
     systemd.sockets.cups = mkIf cfg.startWhenNeeded {
       wantedBy = [ "sockets.target" ];
-      listenStreams = [ "/run/cups/cups.sock" ]
+      listenStreams = [ "" "/run/cups/cups.sock" ]
         ++ map (x: replaceStrings ["localhost"] ["127.0.0.1"] (removePrefix "*:" x)) cfg.listenAddresses;
     };
 

From 4f67365482305a0fec444b725b131c82c563982b Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Wed, 7 Dec 2022 15:52:08 +0100
Subject: [PATCH 026/231] nixos/tests/printing: split into service/socket

This splits the tests into two: one where cups.socket is started
normally, the order with socket activation.

Why? It's almost impossible to follow the test with 4 different
machines printing at the same time. It should also be more efficient
because only two VMs at a time were needed anyway.
---
 nixos/release-combined.nix |   3 +-
 nixos/tests/all-tests.nix  |   3 +-
 nixos/tests/printing.nix   | 177 ++++++++++++++++++-------------------
 3 files changed, 89 insertions(+), 94 deletions(-)

diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index 337b5192776f..ed698b63ee63 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -146,7 +146,8 @@ in rec {
         (onFullSupported "nixos.tests.predictable-interface-names.predictable")
         (onFullSupported "nixos.tests.predictable-interface-names.unpredictableNetworkd")
         (onFullSupported "nixos.tests.predictable-interface-names.unpredictable")
-        (onFullSupported "nixos.tests.printing")
+        (onFullSupported "nixos.tests.printing-service")
+        (onFullSupported "nixos.tests.printing-socket")
         (onFullSupported "nixos.tests.proxy")
         (onFullSupported "nixos.tests.sddm.default")
         (onFullSupported "nixos.tests.shadow")
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 726884d7cd9c..6a14c575662d 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -525,7 +525,8 @@ in {
   power-profiles-daemon = handleTest ./power-profiles-daemon.nix {};
   pppd = handleTest ./pppd.nix {};
   predictable-interface-names = handleTest ./predictable-interface-names.nix {};
-  printing = handleTest ./printing.nix {};
+  printing-socket = handleTest ./printing.nix { socket = true; };
+  printing-service = handleTest ./printing.nix { socket = false; };
   privacyidea = handleTest ./privacyidea.nix {};
   privoxy = handleTest ./privoxy.nix {};
   prometheus = handleTest ./prometheus.nix {};
diff --git a/nixos/tests/printing.nix b/nixos/tests/printing.nix
index cfebe232d92a..7df042e72e90 100644
--- a/nixos/tests/printing.nix
+++ b/nixos/tests/printing.nix
@@ -1,19 +1,31 @@
 # Test printing via CUPS.
 
-import ./make-test-python.nix ({pkgs, ... }:
-let
-  printingServer = startWhenNeeded: {
-    services.printing.enable = true;
-    services.printing.stateless = true;
-    services.printing.startWhenNeeded = startWhenNeeded;
-    services.printing.listenAddresses = [ "*:631" ];
-    services.printing.defaultShared = true;
-    services.printing.extraConf = ''
-      <Location />
-        Order allow,deny
-        Allow from all
-      </Location>
-    '';
+import ./make-test-python.nix (
+{ pkgs
+, socket ? true # whether to use socket activation
+, ...
+}:
+
+{
+  name = "printing";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ domenkozar eelco matthewbauer ];
+  };
+
+  nodes.server = { ... }: {
+    services.printing = {
+      enable = true;
+      stateless = true;
+      startWhenNeeded = socket;
+      listenAddresses = [ "*:631" ];
+      defaultShared = true;
+      extraConf = ''
+        <Location />
+          Order allow,deny
+          Allow from all
+        </Location>
+      '';
+    };
     networking.firewall.allowedTCPPorts = [ 631 ];
     # Add a HP Deskjet printer connected via USB to the server.
     hardware.printers.ensurePrinters = [{
@@ -22,32 +34,19 @@ let
       model = "drv:///sample.drv/deskjet.ppd";
     }];
   };
-  printingClient = startWhenNeeded: {
+
+  nodes.client = { ... }: {
     services.printing.enable = true;
-    services.printing.startWhenNeeded = startWhenNeeded;
+    services.printing.startWhenNeeded = socket;
     # Add printer to the client as well, via IPP.
     hardware.printers.ensurePrinters = [{
       name = "DeskjetRemote";
-      deviceUri = "ipp://${if startWhenNeeded then "socketActivatedServer" else "serviceServer"}/printers/DeskjetLocal";
+      deviceUri = "ipp://server/printers/DeskjetLocal";
       model = "drv:///sample.drv/deskjet.ppd";
     }];
     hardware.printers.ensureDefaultPrinter = "DeskjetRemote";
   };
 
-in {
-  name = "printing";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ domenkozar eelco matthewbauer ];
-  };
-
-  nodes = {
-    socketActivatedServer = { ... }: (printingServer true);
-    serviceServer = { ... }: (printingServer false);
-
-    socketActivatedClient = { ... }: (printingClient true);
-    serviceClient = { ... }: (printingClient false);
-  };
-
   testScript = ''
     import os
     import re
@@ -55,75 +54,69 @@ in {
     start_all()
 
     with subtest("Make sure that cups is up on both sides and printers are set up"):
-        serviceServer.wait_for_unit("cups.service")
-        serviceClient.wait_for_unit("cups.service")
-        socketActivatedClient.wait_for_unit("ensure-printers.service")
+        server.wait_for_unit("cups.${if socket then "socket" else "service"}")
+        client.wait_for_unit("cups.${if socket then "socket" else "service"}")
 
+    assert "scheduler is running" in client.succeed("lpstat -r")
 
-    def test_printing(client, server):
-        assert "scheduler is running" in client.succeed("lpstat -r")
+    with subtest("UNIX socket is used for connections"):
+        assert "/var/run/cups/cups.sock" in client.succeed("lpstat -H")
 
-        with subtest("UNIX socket is used for connections"):
-            assert "/var/run/cups/cups.sock" in client.succeed("lpstat -H")
-        with subtest("HTTP server is available too"):
-            client.succeed("curl --fail http://localhost:631/")
-            client.succeed(f"curl --fail http://{server.name}:631/")
-            server.fail(f"curl --fail --connect-timeout 2 http://{client.name}:631/")
+    with subtest("HTTP server is available too"):
+        client.succeed("curl --fail http://localhost:631/")
+        client.succeed(f"curl --fail http://{server.name}:631/")
+        server.fail(f"curl --fail --connect-timeout 2 http://{client.name}:631/")
 
-        with subtest("LP status checks"):
-            assert "DeskjetRemote accepting requests" in client.succeed("lpstat -a")
-            assert "DeskjetLocal accepting requests" in client.succeed(
-                f"lpstat -h {server.name}:631 -a"
-            )
-            client.succeed("cupsdisable DeskjetRemote")
-            out = client.succeed("lpq")
-            print(out)
-            assert re.search(
-                "DeskjetRemote is not ready.*no entries",
-                client.succeed("lpq"),
-                flags=re.DOTALL,
-            )
-            client.succeed("cupsenable DeskjetRemote")
-            assert re.match(
-                "DeskjetRemote is ready.*no entries", client.succeed("lpq"), flags=re.DOTALL
+    with subtest("LP status checks"):
+        assert "DeskjetRemote accepting requests" in client.succeed("lpstat -a")
+        assert "DeskjetLocal accepting requests" in client.succeed(
+            f"lpstat -h {server.name}:631 -a"
+        )
+        client.succeed("cupsdisable DeskjetRemote")
+        out = client.succeed("lpq")
+        print(out)
+        assert re.search(
+            "DeskjetRemote is not ready.*no entries",
+            client.succeed("lpq"),
+            flags=re.DOTALL,
+        )
+        client.succeed("cupsenable DeskjetRemote")
+        assert re.match(
+            "DeskjetRemote is ready.*no entries", client.succeed("lpq"), flags=re.DOTALL
+        )
+
+    # Test printing various file types.
+    for file in [
+        "${pkgs.groff.doc}/share/doc/*/examples/mom/penguin.pdf",
+        "${pkgs.groff.doc}/share/doc/*/meref.ps",
+        "${pkgs.cups.out}/share/doc/cups/images/cups.png",
+        "${pkgs.pcre.doc}/share/doc/pcre/pcre.txt",
+    ]:
+        file_name = os.path.basename(file)
+        with subtest(f"print {file_name}"):
+            # Print the file on the client.
+            print(client.succeed("lpq"))
+            client.succeed(f"lp {file}")
+            client.wait_until_succeeds(
+                f"lpq; lpq | grep -q -E 'active.*root.*{file_name}'"
             )
 
-        # Test printing various file types.
-        for file in [
-            "${pkgs.groff.doc}/share/doc/*/examples/mom/penguin.pdf",
-            "${pkgs.groff.doc}/share/doc/*/meref.ps",
-            "${pkgs.cups.out}/share/doc/cups/images/cups.png",
-            "${pkgs.pcre.doc}/share/doc/pcre/pcre.txt",
-        ]:
-            file_name = os.path.basename(file)
-            with subtest(f"print {file_name}"):
-                # Print the file on the client.
-                print(client.succeed("lpq"))
-                client.succeed(f"lp {file}")
-                client.wait_until_succeeds(
-                    f"lpq; lpq | grep -q -E 'active.*root.*{file_name}'"
-                )
+            # Ensure that a raw PCL file appeared in the server's queue
+            # (showing that the right filters have been applied).  Of
+            # course, since there is no actual USB printer attached, the
+            # file will stay in the queue forever.
+            server.wait_for_file("/var/spool/cups/d*-001")
+            server.wait_until_succeeds(f"lpq -a | grep -q -E '{file_name}'")
 
-                # Ensure that a raw PCL file appeared in the server's queue
-                # (showing that the right filters have been applied).  Of
-                # course, since there is no actual USB printer attached, the
-                # file will stay in the queue forever.
-                server.wait_for_file("/var/spool/cups/d*-001")
-                server.wait_until_succeeds(f"lpq -a | grep -q -E '{file_name}'")
+            # Delete the job on the client.  It should disappear on the
+            # server as well.
+            client.succeed("lprm")
+            client.wait_until_succeeds("lpq -a | grep -q -E 'no entries'")
 
-                # Delete the job on the client.  It should disappear on the
-                # server as well.
-                client.succeed("lprm")
-                client.wait_until_succeeds("lpq -a | grep -q -E 'no entries'")
+            retry(lambda _: "no entries" in server.succeed("lpq -a"))
 
-                retry(lambda _: "no entries" in server.succeed("lpq -a"))
-
-                # The queue is empty already, so this should be safe.
-                # Otherwise, pairs of "c*"-"d*-001" files might persist.
-                server.execute("rm /var/spool/cups/*")
-
-
-    test_printing(serviceClient, serviceServer)
-    test_printing(socketActivatedClient, socketActivatedServer)
+            # The queue is empty already, so this should be safe.
+            # Otherwise, pairs of "c*"-"d*-001" files might persist.
+            server.execute("rm /var/spool/cups/*")
   '';
 })

From 06c51c4604dc73feea77dd612ea4b3d85097fcc5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Tue, 6 Dec 2022 21:19:24 +0100
Subject: [PATCH 027/231] boehmgc: little cleanup

---
 pkgs/development/libraries/boehm-gc/default.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/boehm-gc/default.nix b/pkgs/development/libraries/boehm-gc/default.nix
index 34e26f547093..de5aff6c3b6e 100644
--- a/pkgs/development/libraries/boehm-gc/default.nix
+++ b/pkgs/development/libraries/boehm-gc/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, autoreconfHook
 # doc: https://github.com/ivmai/bdwgc/blob/v8.2.2/doc/README.macros (LARGE_CONFIG)
 , enableLargeConfig ? false
 , enableMmap ? true
@@ -36,14 +35,14 @@ stdenv.mkDerivation (finalAttrs: {
   # don't forget to disable the fix (and if the next release does
   # not fix the problem the test failure will be a reminder to
   # extend the set of versions requiring the workaround).
-  makeFlags = if (stdenv.hostPlatform.isPower64 &&
+  makeFlags = lib.optionals (stdenv.hostPlatform.isPower64 &&
                   finalAttrs.version == "8.2.2")
-    then [
+    [
       # do not use /proc primitives to track dirty bits; see:
       # https://github.com/ivmai/bdwgc/issues/479#issuecomment-1279687537
       # https://github.com/ivmai/bdwgc/blob/54522af853de28f45195044dadfd795c4e5942aa/include/private/gcconfig.h#L741
       "CFLAGS_EXTRA=-DNO_SOFT_VDB"
-    ] else null;
+    ];
 
   # `gctest` fails under emulation on aarch64-darwin
   doCheck = !(stdenv.isDarwin && stdenv.isx86_64);

From fa132338fd56264bc85019e5bb441b68d03fc3d0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Wed, 7 Dec 2022 23:13:14 +0100
Subject: [PATCH 028/231] python310Packages.jsonschema: 4.17.0 -> 4.17.3

---
 pkgs/development/python-modules/jsonschema/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/jsonschema/default.nix b/pkgs/development/python-modules/jsonschema/default.nix
index 69dba8bd472e..833a76399edd 100644
--- a/pkgs/development/python-modules/jsonschema/default.nix
+++ b/pkgs/development/python-modules/jsonschema/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "jsonschema";
-  version = "4.17.0";
+  version = "4.17.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-W/zyvKFqCHreF+ArKC00r3zNdJ73YkHn+b18DLipQk0=";
+    sha256 = "sha256-D4ZEN6uLYHa6ZwdFPvj5imoNUSqA6T+KvbZ29zfstg0=";
   };
 
   postPatch = ''

From 0f4a7276c4840bfe1db3dd4467eece3e76d4ee43 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Wed, 7 Dec 2022 18:01:08 -0500
Subject: [PATCH 029/231] cargo-auditable: unstable-2022-12-07 -> 0.6.0

---
 pkgs/development/tools/rust/cargo-auditable/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/tools/rust/cargo-auditable/default.nix b/pkgs/development/tools/rust/cargo-auditable/default.nix
index b60c0fe62050..1c621276021a 100644
--- a/pkgs/development/tools/rust/cargo-auditable/default.nix
+++ b/pkgs/development/tools/rust/cargo-auditable/default.nix
@@ -3,16 +3,16 @@
 let
   args = rec {
     pname = "cargo-auditable";
-    version = "unstable-2022-12-07";
+    version = "0.6.0";
 
     src = fetchFromGitHub {
       owner = "rust-secure-code";
       repo = pname;
-      rev = "246468da22d619c816227797fb176c44026c7105";
-      sha256 = "sha256-tZ6qA20TM+mZa2bYWWdFeM+6104e+hVE9Swst2n6Mx8=";
+      rev = "v${version}";
+      sha256 = "sha256-mSiEC+9QtRjWmywJnGgUqp+q8fhY0qUYrgjrAVaY114=";
     };
 
-    cargoSha256 = "sha256-LkFP/m/pTIDnIueNDwM89lk7FNXnT4Fl8EIdXgR9oOg=";
+    cargoSha256 = "sha256-Wz5My/QxPpZVsPBUe3KHT3ttD6CTU8NCY8rhFEC+UlA=";
 
     meta = with lib; {
       description = "A tool to make production Rust binaries auditable";

From 238a6053c43f7ac2e3dcc3d3c7f29f1e0c0be589 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Wed, 1 Jun 2022 00:34:59 +0300
Subject: [PATCH 030/231] stdenv: support opt-in __structuredAttrs

Co-authored-by: Robin Gloster <mail@glob.in>

stdenv: print message if structuredAttrs is enabled

stdenv: add _append

reduces the chance of a user doing it wrong

fix nix develop issue

output hooks don't work yet in nix develop though

making $outputs be the same on non-structuredAttrs and structuredAttrs
is too much trouble.

lets instead make a function that gets the output names

reading environment file '/nix/store/2x7m69a2sm2kh0r6v0q5s9z1dh41m4xf-xz-5.2.5-env-bin'
nix: src/nix/develop.cc:299: std::string Common::makeRcScript(nix::ref<nix::Store>, const BuildEnvironment&, const Path&): Assertion `outputs != buildEnvironment.vars.end()' failed.

use a function to get all output names instead of using $outputs

copy env functionality from https://github.com/NixOS/nixpkgs/pull/76732/commits
---
 .../cluster/nomad-autoscaler/default.nix      |   2 +-
 .../bintools-wrapper/default.nix              |   4 +-
 pkgs/build-support/release/nix-build.nix      |   2 +-
 .../setup-hooks/auto-patchelf.sh              |   2 +-
 pkgs/build-support/setup-hooks/move-docs.sh   |  12 +-
 .../setup-hooks/multiple-outputs.sh           |  32 ++-
 .../patch-ppd-files/patch-ppd-hook.sh         |   2 +-
 pkgs/build-support/setup-hooks/strip.sh       |  21 +-
 .../build-support/setup-hooks/win-dll-link.sh |   2 +-
 pkgs/build-support/testers/expect-failure.sh  |   2 +-
 .../data/icons/catppuccin-cursors/default.nix |   2 +-
 pkgs/data/icons/comixcursors/default.nix      |   2 +-
 pkgs/desktops/gnome/core/gdm/default.nix      |   2 +-
 pkgs/development/compilers/openjdk/11.nix     |   4 +-
 pkgs/development/compilers/openjdk/12.nix     |   4 +-
 pkgs/development/compilers/openjdk/13.nix     |   4 +-
 pkgs/development/compilers/openjdk/14.nix     |   4 +-
 pkgs/development/compilers/openjdk/15.nix     |   4 +-
 pkgs/development/compilers/openjdk/16.nix     |   4 +-
 pkgs/development/compilers/openjdk/17.nix     |   4 +-
 pkgs/development/compilers/openjdk/18.nix     |   4 +-
 pkgs/development/compilers/openjdk/19.nix     |   4 +-
 pkgs/development/compilers/openjdk/8.nix      |   4 +-
 pkgs/development/libraries/polkit/default.nix |   2 +-
 .../darwin/signing-utils/auto-sign-hook.sh    |   2 +-
 pkgs/stdenv/generic/default-builder.sh        |   4 +
 pkgs/stdenv/generic/make-derivation.nix       |  31 ++-
 pkgs/stdenv/generic/setup.sh                  | 222 +++++++++++++-----
 pkgs/tools/typesetting/tex/texlive/bin.nix    |   2 +-
 29 files changed, 271 insertions(+), 119 deletions(-)

diff --git a/pkgs/applications/networking/cluster/nomad-autoscaler/default.nix b/pkgs/applications/networking/cluster/nomad-autoscaler/default.nix
index 6329ff9ed11c..eb185f9743c1 100644
--- a/pkgs/applications/networking/cluster/nomad-autoscaler/default.nix
+++ b/pkgs/applications/networking/cluster/nomad-autoscaler/default.nix
@@ -45,7 +45,7 @@ let
       mv bin/nomad-autoscaler $bin/bin
       ln -s $bin/bin/nomad-autoscaler $out/bin/nomad-autoscaler
 
-      for d in $outputs; do
+      for d in $(getAllOutputNames); do
         mkdir -p ''${!d}/share
       done
       rmdir $bin/share
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 121b50fe0f52..ea925e90fa47 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -68,7 +68,7 @@ let
   # The dynamic linker has different names on different platforms. This is a
   # shell glob that ought to match it.
   dynamicLinker =
-    /**/ if sharedLibraryLoader == null then null
+    /**/ if sharedLibraryLoader == null then ""
     else if targetPlatform.libc == "musl"             then "${sharedLibraryLoader}/lib/ld-musl-*"
     else if targetPlatform.libc == "uclibc"           then "${sharedLibraryLoader}/lib/ld*-uClibc.so.1"
     else if (targetPlatform.libc == "bionic" && targetPlatform.is32bit) then "/system/bin/linker"
@@ -87,7 +87,7 @@ let
     else if targetPlatform.isDarwin                   then "/usr/lib/dyld"
     else if targetPlatform.isFreeBSD                  then "/libexec/ld-elf.so.1"
     else if lib.hasSuffix "pc-gnu" targetPlatform.config then "ld.so.1"
-    else null;
+    else "";
 
   expand-response-params =
     if buildPackages ? stdenv && buildPackages.stdenv.hasCC && buildPackages.stdenv.cc != "/dev/null"
diff --git a/pkgs/build-support/release/nix-build.nix b/pkgs/build-support/release/nix-build.nix
index ac51b90e0163..5ed2b0752efc 100644
--- a/pkgs/build-support/release/nix-build.nix
+++ b/pkgs/build-support/release/nix-build.nix
@@ -124,7 +124,7 @@ stdenv.mkDerivation (
       echo "$system" > $out/nix-support/system
 
       if [ -z "${toString doingAnalysis}" ]; then
-          for i in $outputs; do
+          for i in $(getAllOutputNames); do
               if [ "$i" = out ]; then j=none; else j="$i"; fi
               mkdir -p ''${!i}/nix-support
               echo "nix-build $j ''${!i}" >> ''${!i}/nix-support/hydra-build-products
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.sh b/pkgs/build-support/setup-hooks/auto-patchelf.sh
index 7f5ff146e30b..8a74a69bdceb 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.sh
@@ -84,7 +84,7 @@ autoPatchelf() {
 # (Expressions don't expand in single quotes, use double quotes for that.)
 postFixupHooks+=('
     if [ -z "${dontAutoPatchelf-}" ]; then
-        autoPatchelf -- $(for output in $outputs; do
+        autoPatchelf -- $(for output in $(getAllOutputNames); do
             [ -e "${!output}" ] || continue
             echo "${!output}"
         done)
diff --git a/pkgs/build-support/setup-hooks/move-docs.sh b/pkgs/build-support/setup-hooks/move-docs.sh
index e4460f98816d..833113aa0fc8 100644
--- a/pkgs/build-support/setup-hooks/move-docs.sh
+++ b/pkgs/build-support/setup-hooks/move-docs.sh
@@ -5,10 +5,17 @@
 preFixupHooks+=(_moveToShare)
 
 _moveToShare() {
-    forceShare=${forceShare:=man doc info}
+    if [ -n "$__structuredAttrs" ]; then
+        if [ -z "${forceShare-}" ]; then
+            forceShare=( man doc info )
+        fi
+    else
+        forceShare=( ${forceShare:-man doc info} )
+    fi
+
     if [[ -z "$out" ]]; then return; fi
 
-    for d in $forceShare; do
+    for d in "${forceShare[@]}"; do
         if [ -d "$out/$d" ]; then
             if [ -d "$out/share/$d" ]; then
                 echo "both $d/ and share/$d/ exist!"
@@ -20,4 +27,3 @@ _moveToShare() {
         fi
     done
 }
-
diff --git a/pkgs/build-support/setup-hooks/multiple-outputs.sh b/pkgs/build-support/setup-hooks/multiple-outputs.sh
index 881cf6c90f48..8a2fc2f915e9 100644
--- a/pkgs/build-support/setup-hooks/multiple-outputs.sh
+++ b/pkgs/build-support/setup-hooks/multiple-outputs.sh
@@ -47,7 +47,7 @@ _overrideFirst outputInfo "info" "$outputBin"
 
 # Add standard flags to put files into the desired outputs.
 _multioutConfig() {
-    if [ "$outputs" = "out" ] || [ -z "${setOutputFlags-1}" ]; then return; fi;
+    if [ "$(getAllOutputNames)" = "out" ] || [ -z "${setOutputFlags-1}" ]; then return; fi;
 
     # try to detect share/doc/${shareDocName}
     # Note: sadly, $configureScript detection comes later in configurePhase,
@@ -66,19 +66,17 @@ _multioutConfig() {
         fi
     fi
 
-    configureFlags="\
-        --bindir=${!outputBin}/bin --sbindir=${!outputBin}/sbin \
-        --includedir=${!outputInclude}/include --oldincludedir=${!outputInclude}/include \
-        --mandir=${!outputMan}/share/man --infodir=${!outputInfo}/share/info \
-        --docdir=${!outputDoc}/share/doc/${shareDocName} \
-        --libdir=${!outputLib}/lib --libexecdir=${!outputLib}/libexec \
-        --localedir=${!outputLib}/share/locale \
-        $configureFlags"
+    prependToVar configureFlags \
+        --bindir="${!outputBin}"/bin --sbindir="${!outputBin}"/sbin \
+        --includedir="${!outputInclude}"/include --oldincludedir="${!outputInclude}"/include \
+        --mandir="${!outputMan}"/share/man --infodir="${!outputInfo}"/share/info \
+        --docdir="${!outputDoc}"/share/doc/"${shareDocName}" \
+        --libdir="${!outputLib}"/lib --libexecdir="${!outputLib}"/libexec \
+        --localedir="${!outputLib}"/share/locale
 
-    installFlags="\
-        pkgconfigdir=${!outputDev}/lib/pkgconfig \
-        m4datadir=${!outputDev}/share/aclocal aclocaldir=${!outputDev}/share/aclocal \
-        $installFlags"
+    prependToVar installFlags \
+        pkgconfigdir="${!outputDev}"/lib/pkgconfig \
+        m4datadir="${!outputDev}"/share/aclocal aclocaldir="${!outputDev}"/share/aclocal
 }
 
 
@@ -94,7 +92,7 @@ moveToOutput() {
     local patt="$1"
     local dstOut="$2"
     local output
-    for output in $outputs; do
+    for output in $(getAllOutputNames); do
         if [ "${!output}" = "$dstOut" ]; then continue; fi
         local srcPath
         for srcPath in "${!output}"/$patt; do
@@ -149,7 +147,7 @@ _multioutDocs() {
 
 # Move development-only stuff to the desired outputs.
 _multioutDevs() {
-    if [ "$outputs" = "out" ] || [ -z "${moveToDev-1}" ]; then return; fi;
+    if [ "$(getAllOutputNames)" = "out" ] || [ -z "${moveToDev-1}" ]; then return; fi;
     moveToOutput include "${!outputInclude}"
     # these files are sometimes provided even without using the corresponding tool
     moveToOutput lib/pkgconfig "${!outputDev}"
@@ -166,10 +164,10 @@ _multioutDevs() {
 
 # Make the "dev" propagate other outputs needed for development.
 _multioutPropagateDev() {
-    if [ "$outputs" = "out" ]; then return; fi;
+    if [ "$(getAllOutputNames)" = "out" ]; then return; fi;
 
     local outputFirst
-    for outputFirst in $outputs; do
+    for outputFirst in $(getAllOutputNames); do
         break
     done
     local propagaterOutput="$outputDev"
diff --git a/pkgs/build-support/setup-hooks/patch-ppd-files/patch-ppd-hook.sh b/pkgs/build-support/setup-hooks/patch-ppd-files/patch-ppd-hook.sh
index a450ecd7f963..77322b245b27 100644
--- a/pkgs/build-support/setup-hooks/patch-ppd-files/patch-ppd-hook.sh
+++ b/pkgs/build-support/setup-hooks/patch-ppd-files/patch-ppd-hook.sh
@@ -70,7 +70,7 @@ patchPpdFileCommands () {
     # * outputs of current build before buildInputs
     # * `/lib/cups/filter' before `/bin`
     # * add HOST_PATH at end, so we don't miss anything
-    for path in $outputs; do
+    for path in $(getAllOutputNames); do
         addToSearchPath cupspath "${!path}/lib/cups/filter"
         addToSearchPath cupspath "${!path}/bin"
     done
diff --git a/pkgs/build-support/setup-hooks/strip.sh b/pkgs/build-support/setup-hooks/strip.sh
index 9bd7b24cab54..104b5515b3db 100644
--- a/pkgs/build-support/setup-hooks/strip.sh
+++ b/pkgs/build-support/setup-hooks/strip.sh
@@ -12,11 +12,20 @@ _doStrip() {
     local -ra stripCmds=(STRIP STRIP_FOR_TARGET)
     local -ra ranlibCmds=(RANLIB RANLIB_FOR_TARGET)
 
+    # TODO(structured-attrs): This doesn't work correctly if one of
+    #   the items in strip*List or strip*Flags contains a space,
+    #   even with structured attrs enabled.  This is OK for now
+    #   because very few packages set any of these, and it doesn't
+    #   affect any of them.
+    #
+    #   After __structuredAttrs = true is universal, come back and
+    #   push arrays all the way through this logic.
+
     # Strip only host paths by default. Leave targets as is.
-    stripDebugList=${stripDebugList:-lib lib32 lib64 libexec bin sbin}
-    stripDebugListTarget=${stripDebugListTarget:-}
-    stripAllList=${stripAllList:-}
-    stripAllListTarget=${stripAllListTarget:-}
+    stripDebugList=${stripDebugList[*]:-lib lib32 lib64 libexec bin sbin}
+    stripDebugListTarget=${stripDebugListTarget[*]:-}
+    stripAllList=${stripAllList[*]:-}
+    stripAllListTarget=${stripAllListTarget[*]:-}
 
     local i
     for i in ${!stripCmds[@]}; do
@@ -30,8 +39,8 @@ _doStrip() {
         if [[ "${dontStrip-}" || "${flag-}" ]] || ! type -f "${stripCmd-}" 2>/dev/null
         then continue; fi
 
-        stripDirs "$stripCmd" "$ranlibCmd" "$debugDirList" "${stripDebugFlags:--S}"
-        stripDirs "$stripCmd" "$ranlibCmd" "$allDirList" "${stripAllFlags:--s}"
+        stripDirs "$stripCmd" "$ranlibCmd" "$debugDirList" "${stripDebugFlags[*]:--S}"
+        stripDirs "$stripCmd" "$ranlibCmd" "$allDirList" "${stripAllFlags[*]:--s}"
     done
 }
 
diff --git a/pkgs/build-support/setup-hooks/win-dll-link.sh b/pkgs/build-support/setup-hooks/win-dll-link.sh
index 6130f32bef86..ca4cbb349b6c 100644
--- a/pkgs/build-support/setup-hooks/win-dll-link.sh
+++ b/pkgs/build-support/setup-hooks/win-dll-link.sh
@@ -15,7 +15,7 @@ _linkDLLs() {
     #   prefix $PATH by currently-built outputs
     local DLLPATH=""
     local outName
-    for outName in $outputs; do
+    for outName in $(getAllOutputNames); do
         addToSearchPath DLLPATH "${!outName}/bin"
     done
     DLLPATH="$DLLPATH:$PATH"
diff --git a/pkgs/build-support/testers/expect-failure.sh b/pkgs/build-support/testers/expect-failure.sh
index 0e1bbe9a678c..052ee8527176 100644
--- a/pkgs/build-support/testers/expect-failure.sh
+++ b/pkgs/build-support/testers/expect-failure.sh
@@ -35,7 +35,7 @@ echo "testBuildFailure: Original builder produced exit code: $r"
 # -----------------------------------------
 # Write the build log to the default output
 
-outs=( $outputs )
+outs=( $(getAllOutputNames) )
 defOut=${outs[0]}
 defOutPath=${!defOut}
 
diff --git a/pkgs/data/icons/catppuccin-cursors/default.nix b/pkgs/data/icons/catppuccin-cursors/default.nix
index d9eccc96a029..4559705c169b 100644
--- a/pkgs/data/icons/catppuccin-cursors/default.nix
+++ b/pkgs/data/icons/catppuccin-cursors/default.nix
@@ -50,7 +50,7 @@ stdenvNoCC.mkDerivation {
   installPhase = ''
     runHook preInstall
 
-    for output in $outputs; do
+    for output in $(getAllOutputNames); do
       if [ "$output" != "out" ]; then
         local outputDir="''${!output}"
         local iconsDir="$outputDir"/share/icons
diff --git a/pkgs/data/icons/comixcursors/default.nix b/pkgs/data/icons/comixcursors/default.nix
index b63877b28209..1c4fdc195180 100644
--- a/pkgs/data/icons/comixcursors/default.nix
+++ b/pkgs/data/icons/comixcursors/default.nix
@@ -52,7 +52,7 @@ stdenvNoCC.mkDerivation rec {
   '';
 
   installPhase = ''
-    for outputName in $outputs ; do
+    for outputName in $(getAllOutputNames) ; do
       if [ $outputName != out ]; then
         local outputDir=''${!outputName};
         local iconsDir=$outputDir/share/icons
diff --git a/pkgs/desktops/gnome/core/gdm/default.nix b/pkgs/desktops/gnome/core/gdm/default.nix
index f1fbe7e49d30..a2265387e1ef 100644
--- a/pkgs/desktops/gnome/core/gdm/default.nix
+++ b/pkgs/desktops/gnome/core/gdm/default.nix
@@ -143,7 +143,7 @@ stdenv.mkDerivation rec {
     # We use rsync to merge the directories.
     rsync --archive "${DESTDIR}/etc" "$out"
     rm --recursive "${DESTDIR}/etc"
-    for o in $outputs; do
+    for o in $(getAllOutputNames); do
         if [[ "$o" = "debug" ]]; then continue; fi
         rsync --archive "${DESTDIR}/''${!o}" "$(dirname "''${!o}")"
         rm --recursive "${DESTDIR}/''${!o}"
diff --git a/pkgs/development/compilers/openjdk/11.nix b/pkgs/development/compilers/openjdk/11.nix
index 95abb373272c..33c3177d2927 100644
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@@ -132,12 +132,12 @@ let
     postFixup = ''
       # Build the set of output library directories to rpath against
       LIBDIRS=""
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort | uniq | tr '\n' ':'):$LIBDIRS"
       done
       # Add the local library paths to remove dependencies on the bootstrap
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         OUTPUTDIR=$(eval echo \$$output)
         BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
diff --git a/pkgs/development/compilers/openjdk/12.nix b/pkgs/development/compilers/openjdk/12.nix
index 60100a5ecc16..f56cf4a79220 100644
--- a/pkgs/development/compilers/openjdk/12.nix
+++ b/pkgs/development/compilers/openjdk/12.nix
@@ -136,12 +136,12 @@ let
     postFixup = ''
       # Build the set of output library directories to rpath against
       LIBDIRS=""
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort | uniq | tr '\n' ':'):$LIBDIRS"
       done
       # Add the local library paths to remove dependencies on the bootstrap
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         OUTPUTDIR=$(eval echo \$$output)
         BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
diff --git a/pkgs/development/compilers/openjdk/13.nix b/pkgs/development/compilers/openjdk/13.nix
index 68a0a9fa7007..ce84d334b426 100644
--- a/pkgs/development/compilers/openjdk/13.nix
+++ b/pkgs/development/compilers/openjdk/13.nix
@@ -136,12 +136,12 @@ let
     postFixup = ''
       # Build the set of output library directories to rpath against
       LIBDIRS=""
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort | uniq | tr '\n' ':'):$LIBDIRS"
       done
       # Add the local library paths to remove dependencies on the bootstrap
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         OUTPUTDIR=$(eval echo \$$output)
         BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
diff --git a/pkgs/development/compilers/openjdk/14.nix b/pkgs/development/compilers/openjdk/14.nix
index 37c3a6a3de3a..8e92b906189c 100644
--- a/pkgs/development/compilers/openjdk/14.nix
+++ b/pkgs/development/compilers/openjdk/14.nix
@@ -132,12 +132,12 @@ let
     postFixup = ''
       # Build the set of output library directories to rpath against
       LIBDIRS=""
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort | uniq | tr '\n' ':'):$LIBDIRS"
       done
       # Add the local library paths to remove dependencies on the bootstrap
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         OUTPUTDIR=$(eval echo \$$output)
         BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
diff --git a/pkgs/development/compilers/openjdk/15.nix b/pkgs/development/compilers/openjdk/15.nix
index 6ea1d0b1dd31..c33e937f9f24 100644
--- a/pkgs/development/compilers/openjdk/15.nix
+++ b/pkgs/development/compilers/openjdk/15.nix
@@ -131,12 +131,12 @@ let
     postFixup = ''
       # Build the set of output library directories to rpath against
       LIBDIRS=""
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort | uniq | tr '\n' ':'):$LIBDIRS"
       done
       # Add the local library paths to remove dependencies on the bootstrap
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         OUTPUTDIR=$(eval echo \$$output)
         BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
diff --git a/pkgs/development/compilers/openjdk/16.nix b/pkgs/development/compilers/openjdk/16.nix
index 0e1911bb1a70..461cd724144e 100644
--- a/pkgs/development/compilers/openjdk/16.nix
+++ b/pkgs/development/compilers/openjdk/16.nix
@@ -138,12 +138,12 @@ let
     postFixup = ''
       # Build the set of output library directories to rpath against
       LIBDIRS=""
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort | uniq | tr '\n' ':'):$LIBDIRS"
       done
       # Add the local library paths to remove dependencies on the bootstrap
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         OUTPUTDIR=$(eval echo \$$output)
         BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
diff --git a/pkgs/development/compilers/openjdk/17.nix b/pkgs/development/compilers/openjdk/17.nix
index bc92b1393fdb..6d8087d7e948 100644
--- a/pkgs/development/compilers/openjdk/17.nix
+++ b/pkgs/development/compilers/openjdk/17.nix
@@ -149,12 +149,12 @@ let
     postFixup = ''
       # Build the set of output library directories to rpath against
       LIBDIRS=""
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort -u | tr '\n' ':'):$LIBDIRS"
       done
       # Add the local library paths to remove dependencies on the bootstrap
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         OUTPUTDIR=$(eval echo \$$output)
         BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
diff --git a/pkgs/development/compilers/openjdk/18.nix b/pkgs/development/compilers/openjdk/18.nix
index 5be60eb94875..fd620aaaf9a5 100644
--- a/pkgs/development/compilers/openjdk/18.nix
+++ b/pkgs/development/compilers/openjdk/18.nix
@@ -140,12 +140,12 @@ let
     postFixup = ''
       # Build the set of output library directories to rpath against
       LIBDIRS=""
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort -u | tr '\n' ':'):$LIBDIRS"
       done
       # Add the local library paths to remove dependencies on the bootstrap
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         OUTPUTDIR=$(eval echo \$$output)
         BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
diff --git a/pkgs/development/compilers/openjdk/19.nix b/pkgs/development/compilers/openjdk/19.nix
index 11b2fa60c733..9537b0d3ce52 100644
--- a/pkgs/development/compilers/openjdk/19.nix
+++ b/pkgs/development/compilers/openjdk/19.nix
@@ -140,12 +140,12 @@ let
     postFixup = ''
       # Build the set of output library directories to rpath against
       LIBDIRS=""
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort -u | tr '\n' ':'):$LIBDIRS"
       done
       # Add the local library paths to remove dependencies on the bootstrap
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         OUTPUTDIR=$(eval echo \$$output)
         BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
diff --git a/pkgs/development/compilers/openjdk/8.nix b/pkgs/development/compilers/openjdk/8.nix
index c232b1f01f16..5558a77ad90b 100644
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@@ -187,12 +187,12 @@ let
     postFixup = ''
       # Build the set of output library directories to rpath against
       LIBDIRS=""
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort | uniq | tr '\n' ':'):$LIBDIRS"
       done
       # Add the local library paths to remove dependencies on the bootstrap
-      for output in $outputs; do
+      for output in $(getAllOutputNames); do
         if [ "$output" = debug ]; then continue; fi
         OUTPUTDIR=$(eval echo \$$output)
         BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index a0344d68a12b..6ab7a4bb9c3a 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -167,7 +167,7 @@ stdenv.mkDerivation rec {
     rsync --archive "${DESTDIR}${system}"/* "$out"
     rm --recursive "${DESTDIR}${system}"/*
     rmdir --parents --ignore-fail-on-non-empty "${DESTDIR}${system}"
-    for o in $outputs; do
+    for o in $(getAllOutputNames); do
         rsync --archive "${DESTDIR}/''${!o}" "$(dirname "''${!o}")"
         rm --recursive "${DESTDIR}/''${!o}"
     done
diff --git a/pkgs/os-specific/darwin/signing-utils/auto-sign-hook.sh b/pkgs/os-specific/darwin/signing-utils/auto-sign-hook.sh
index cca65661f8a9..6a254cd82123 100644
--- a/pkgs/os-specific/darwin/signing-utils/auto-sign-hook.sh
+++ b/pkgs/os-specific/darwin/signing-utils/auto-sign-hook.sh
@@ -25,7 +25,7 @@ signDarwinBinariesIn() {
 signDarwinBinariesInAllOutputs() {
   local output
 
-  for output in $outputs; do
+  for output in $(getAllOutputNames); do
      signDarwinBinariesIn "${!output}"
   done
 }
diff --git a/pkgs/stdenv/generic/default-builder.sh b/pkgs/stdenv/generic/default-builder.sh
index 273fc55c7552..8c6fec7873b6 100644
--- a/pkgs/stdenv/generic/default-builder.sh
+++ b/pkgs/stdenv/generic/default-builder.sh
@@ -1,2 +1,6 @@
+if [ -f .attrs.sh ]; then
+    . .attrs.sh
+fi
+
 source $stdenv/setup
 genericBuild
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 510537aac9f3..09a71da93b6e 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -154,6 +154,12 @@ let
   (! attrs ? outputHash) # Fixed-output drvs can't be content addressed too
   && config.contentAddressedByDefault
 
+# Experimental.  For simple packages mostly just works,
+# but for anything complex, be prepared to debug if enabling.
+, __structuredAttrs ? false
+
+, env ? { }
+
 , ... } @ attrs:
 
 let
@@ -259,13 +265,16 @@ else let
     lib.unique (lib.concatMap (input: input.__propagatedImpureHostDeps or [])
       (lib.concatLists propagatedDependencies));
 
+  envIsExportable = lib.isAttrs env && !lib.isDerivation env;
+
   derivationArg =
     (removeAttrs attrs
-      ["meta" "passthru" "pos"
+      (["meta" "passthru" "pos"
        "checkInputs" "installCheckInputs"
        "__darwinAllowLocalNetworking"
        "__impureHostDeps" "__propagatedImpureHostDeps"
-       "sandboxProfile" "propagatedSandboxProfile"])
+       "sandboxProfile" "propagatedSandboxProfile"]
+       ++ lib.optionals envIsExportable [ "env" ]))
     // (lib.optionalAttrs (attrs ? name || (attrs ? pname && attrs ? version)) {
       name =
         let
@@ -289,7 +298,7 @@ else let
           then attrs.name + hostSuffix
           else "${attrs.pname}${staticMarker}${hostSuffix}-${attrs.version}"
         );
-    }) // {
+    }) // lib.optionalAttrs (envIsExportable && __structuredAttrs) { env = checkedEnv; } // {
       builder = attrs.realBuilder or stdenv.shell;
       args = attrs.args or ["-e" (attrs.builder or ./default-builder.sh)];
       inherit stdenv;
@@ -304,8 +313,7 @@ else let
 
       userHook = config.stdenv.userHook or null;
       __ignoreNulls = true;
-
-      inherit strictDeps;
+      inherit __structuredAttrs strictDeps;
 
       depsBuildBuild              = lib.elemAt (lib.elemAt dependencies 0) 0;
       nativeBuildInputs           = lib.elemAt (lib.elemAt dependencies 0) 1;
@@ -473,6 +481,17 @@ else let
                    else true);
     };
 
+  checkedEnv =
+    let
+      overlappingNames = lib.intersectLists (lib.attrNames env) (lib.attrNames derivationArg);
+    in
+    assert lib.assertMsg (overlappingNames == [ ])
+      "The ‘env’ attribute set cannot contain any attributes passed to derivation. The following attributes are overlapping: ${lib.concatStringsSep ", " overlappingNames}";
+    lib.mapAttrs
+      (n: v: assert lib.assertMsg (lib.isString v || lib.isBool v || lib.isInt v)
+        "The ‘env’ attribute set can only contain string, boolean or integer attributes. The ‘${n}’ attribute is of type ${builtins.typeOf v}."; v)
+      env;
+
 in
 
 lib.extendDerivation
@@ -509,7 +528,7 @@ lib.extendDerivation
    # should be made available to Nix expressions using the
    # derivation (e.g., in assertions).
    passthru)
-  (derivation derivationArg);
+  (derivation (derivationArg // lib.optionalAttrs envIsExportable checkedEnv));
 
 in
   fnOrAttrs:
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index c6cdb6c3df75..de1dad5a1697 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -15,8 +15,29 @@ if (( "${NIX_DEBUG:-0}" >= 6 )); then
     set -x
 fi
 
-: ${outputs:=out}
+if [ -f .attrs.sh ]; then
+    __structuredAttrs=1
+    echo "structuredAttrs is enabled"
+else
+    __structuredAttrs=
+fi
 
+if [ -n "$__structuredAttrs" ]; then
+    for outputName in "${!outputs[@]}"; do
+        # ex: out=/nix/store/...
+        export "$outputName=${outputs[$outputName]}"
+    done
+else
+    : ${outputs:=out}
+fi
+
+getAllOutputNames() {
+    if [ -n "$__structuredAttrs" ]; then
+        echo "${!outputs[*]}"
+    else
+        echo "$outputs"
+    fi
+}
 
 ######################################################################
 # Hook handling.
@@ -175,6 +196,63 @@ addToSearchPath() {
     addToSearchPathWithCustomDelimiter ":" "$@"
 }
 
+# Prepend elements to variable "$1", which may come from an attr.
+#
+# This is useful in generic setup code, which must (for now) support
+# both derivations with and without __structuredAttrs true, so the
+# variable may be an array or a space-separated string.
+#
+# Expressions for individual packages should simply switch to array
+# syntax when they switch to setting __structuredAttrs = true.
+prependToVar() {
+    local -n nameref="$1"; shift
+    if [ -n "$__structuredAttrs" ]; then
+        nameref=( "$@" ${nameref+"${nameref[@]}"} )
+    else
+        nameref="$* ${nameref-}"
+    fi
+}
+
+# Same as above
+appendToVar() {
+    local -n nameref="$1"; shift
+    if [ -n "$__structuredAttrs" ]; then
+        nameref=( ${nameref+"${nameref[@]}"} "$@" )
+    else
+        nameref="${nameref-} $*"
+    fi
+}
+
+# Accumulate into `flagsArray` the flags from the named variables.
+#
+# If __structuredAttrs, the variables are all treated as arrays
+# and simply concatenated onto `flagsArray`.
+#
+# If not __structuredAttrs, then:
+#   * Each variable is treated as a string, and split on whitespace;
+#   * except variables whose names end in "Array", which are treated
+#     as arrays.
+_accumFlagsArray() {
+    local name
+    if [ -n "$__structuredAttrs" ]; then
+        for name in "$@"; do
+            local -n nameref="$name"
+            flagsArray+=( ${nameref+"${nameref[@]}"} )
+        done
+    else
+        for name in "$@"; do
+            local -n nameref="$name"
+            case "$name" in
+                *Array)
+                    flagsArray+=( ${nameref+"${nameref[@]}"} ) ;;
+                *)
+                    flagsArray+=( ${nameref-} ) ;;
+            esac
+        done
+    fi
+
+}
+
 # Add $1/lib* into rpaths.
 # The function is used in multiple-outputs.sh hook,
 # so it is defined here but tried after the hook.
@@ -255,6 +333,11 @@ printWords() {
 ######################################################################
 # Initialisation.
 
+# export all vars that should be in the ENV
+for envVar in "${!env[@]}"; do
+    declare -x "${envVar}=${env[${envVar}]}"
+done
+
 
 # Set a fallback default value for SOURCE_DATE_EPOCH, used by some build tools
 # to provide a deterministic substitute for the "current" time. Note that
@@ -469,6 +552,10 @@ findInputs() {
     done
 }
 
+# The way we handle deps* and *Inputs works with structured attrs
+# either enabled or disabled.  For this it's convenient that the items
+# in each list must be store paths, and therefore space-free.
+
 # Make sure all are at least defined as empty
 : ${depsBuildBuild=} ${depsBuildBuildPropagated=}
 : ${nativeBuildInputs=} ${propagatedNativeBuildInputs=} ${defaultNativeBuildInputs=}
@@ -477,29 +564,29 @@ findInputs() {
 : ${buildInputs=} ${propagatedBuildInputs=} ${defaultBuildInputs=}
 : ${depsTargetTarget=} ${depsTargetTargetPropagated=}
 
-for pkg in $depsBuildBuild $depsBuildBuildPropagated; do
+for pkg in ${depsBuildBuild[@]} ${depsBuildBuildPropagated[@]}; do
     findInputs "$pkg" -1 -1
 done
-for pkg in $nativeBuildInputs $propagatedNativeBuildInputs; do
+for pkg in ${nativeBuildInputs[@]} ${propagatedNativeBuildInputs[@]}; do
     findInputs "$pkg" -1  0
 done
-for pkg in $depsBuildTarget $depsBuildTargetPropagated; do
+for pkg in ${depsBuildTarget[@]} ${depsBuildTargetPropagated[@]}; do
     findInputs "$pkg" -1  1
 done
-for pkg in $depsHostHost $depsHostHostPropagated; do
+for pkg in ${depsHostHost[@]} ${depsHostHostPropagated[@]}; do
     findInputs "$pkg"  0  0
 done
-for pkg in $buildInputs $propagatedBuildInputs ; do
+for pkg in ${buildInputs[@]} ${propagatedBuildInputs[@]} ; do
     findInputs "$pkg"  0  1
 done
-for pkg in $depsTargetTarget $depsTargetTargetPropagated; do
+for pkg in ${depsTargetTarget[@]} ${depsTargetTargetPropagated[@]}; do
     findInputs "$pkg"  1  1
 done
 # Default inputs must be processed last
-for pkg in $defaultNativeBuildInputs; do
+for pkg in ${defaultNativeBuildInputs[@]}; do
     findInputs "$pkg" -1  0
 done
-for pkg in $defaultBuildInputs; do
+for pkg in ${defaultBuildInputs[@]}; do
     findInputs "$pkg"  0  1
 done
 
@@ -909,6 +996,13 @@ unpackPhase() {
         srcs="$src"
     fi
 
+    local -a srcsArray
+    if [ -n "$__structuredAttrs" ]; then
+        srcsArray=( "${srcs[@]}" )
+    else
+        srcsArray=( $srcs )
+    fi
+
     # To determine the source directory created by unpacking the
     # source archives, we record the contents of the current
     # directory, then look below which directory got added.  Yeah,
@@ -921,7 +1015,7 @@ unpackPhase() {
     done
 
     # Unpack all source archives.
-    for i in $srcs; do
+    for i in "${srcsArray[@]}"; do
         unpackFile "$i"
     done
 
@@ -971,7 +1065,14 @@ unpackPhase() {
 patchPhase() {
     runHook prePatch
 
-    for i in ${patches:-}; do
+    local -a patchesArray
+    if [ -n "$__structuredAttrs" ]; then
+        patchesArray=( ${patches:+"${patches[@]}"} )
+    else
+        patchesArray=( ${patches:-} )
+    fi
+
+    for i in "${patchesArray[@]}"; do
         header "applying patch $i" 3
         local uncompress=cat
         case "$i" in
@@ -988,9 +1089,17 @@ patchPhase() {
                 uncompress="lzma -d"
                 ;;
         esac
+
+        local -a flagsArray
+        if [ -n "$__structuredAttrs" ]; then
+            flagsArray=( "${patchFlags[@]:--p1}" )
+        else
+            # shellcheck disable=SC2086
+            flagsArray=( ${patchFlags:--p1} )
+        fi
         # "2>&1" is a hack to make patch fail if the decompressor fails (nonexistent patch, etc.)
         # shellcheck disable=SC2086
-        $uncompress < "$i" 2>&1 | patch ${patchFlags:--p1}
+        $uncompress < "$i" 2>&1 | patch "${flagsArray[@]}"
     done
 
     runHook postPatch
@@ -1018,7 +1127,6 @@ configurePhase() {
 
     # set to empty if unset
     : ${configureScript=}
-    : ${configureFlags=}
 
     if [[ -z "$configureScript" && -x ./configure ]]; then
         configureScript=./configure
@@ -1049,31 +1157,29 @@ configurePhase() {
     fi
 
     if [[ -z "${dontAddPrefix:-}" && -n "$prefix" ]]; then
-        configureFlags="${prefixKey:---prefix=}$prefix $configureFlags"
+        prependToVar configureFlags "${prefixKey:---prefix=}$prefix"
     fi
 
     if [[ -f "$configureScript" ]]; then
         # Add --disable-dependency-tracking to speed up some builds.
         if [ -z "${dontAddDisableDepTrack:-}" ]; then
             if grep -q dependency-tracking "$configureScript"; then
-                configureFlags="--disable-dependency-tracking $configureFlags"
+                prependToVar configureFlags --disable-dependency-tracking
             fi
         fi
 
         # By default, disable static builds.
         if [ -z "${dontDisableStatic:-}" ]; then
             if grep -q enable-static "$configureScript"; then
-                configureFlags="--disable-static $configureFlags"
+                prependToVar configureFlags --disable-static
             fi
         fi
     fi
 
     if [ -n "$configureScript" ]; then
-        # Old bash empty array hack
-        # shellcheck disable=SC2086
-        local flagsArray=(
-            $configureFlags "${configureFlagsArray[@]}"
-        )
+        local -a flagsArray
+        _accumFlagsArray configureFlags configureFlagsArray
+
         echoCmd 'configure flags' "${flagsArray[@]}"
         # shellcheck disable=SC2086
         $configureScript "${flagsArray[@]}"
@@ -1089,22 +1195,17 @@ configurePhase() {
 buildPhase() {
     runHook preBuild
 
-    # set to empty if unset
-    : ${makeFlags=}
-
-    if [[ -z "$makeFlags" && -z "${makefile:-}" && ! ( -e Makefile || -e makefile || -e GNUmakefile ) ]]; then
+    if [[ -z "${makeFlags-}" && -z "${makefile:-}" && ! ( -e Makefile || -e makefile || -e GNUmakefile ) ]]; then
         echo "no Makefile, doing nothing"
     else
         foundMakefile=1
 
-        # Old bash empty array hack
         # shellcheck disable=SC2086
         local flagsArray=(
             ${enableParallelBuilding:+-j${NIX_BUILD_CORES}}
             SHELL=$SHELL
-            $makeFlags "${makeFlagsArray[@]}"
-            $buildFlags "${buildFlagsArray[@]}"
         )
+        _accumFlagsArray makeFlags makeFlagsArray buildFlags buildFlagsArray
 
         echoCmd 'build flags' "${flagsArray[@]}"
         make ${makefile:+-f $makefile} "${flagsArray[@]}"
@@ -1141,11 +1242,17 @@ checkPhase() {
         local flagsArray=(
             ${enableParallelChecking:+-j${NIX_BUILD_CORES}}
             SHELL=$SHELL
-            $makeFlags "${makeFlagsArray[@]}"
-            ${checkFlags:-VERBOSE=y} "${checkFlagsArray[@]}"
-            ${checkTarget}
         )
 
+        _accumFlagsArray makeFlags makeFlagsArray
+        if [ -n "$__structuredAttrs" ]; then
+            flagsArray+=( "${checkFlags[@]:-VERBOSE=y}" )
+        else
+            flagsArray+=( ${checkFlags:-VERBOSE=y} )
+        fi
+        _accumFlagsArray checkFlagsArray
+        flagsArray+=( ${checkTarget} )
+
         echoCmd 'check flags' "${flagsArray[@]}"
         make ${makefile:+-f $makefile} "${flagsArray[@]}"
 
@@ -1163,14 +1270,16 @@ installPhase() {
         mkdir -p "$prefix"
     fi
 
-    # Old bash empty array hack
     # shellcheck disable=SC2086
     local flagsArray=(
         SHELL=$SHELL
-        $makeFlags "${makeFlagsArray[@]}"
-        $installFlags "${installFlagsArray[@]}"
-        ${installTargets:-install}
     )
+    _accumFlagsArray makeFlags makeFlagsArray installFlags installFlagsArray
+    if [ -n "$__structuredAttrs" ]; then
+        flagsArray+=( "${installTargets[@]:-install}" )
+    else
+        flagsArray+=( ${installTargets:-install} )
+    fi
 
     echoCmd 'install flags' "${flagsArray[@]}"
     make ${makefile:+-f $makefile} "${flagsArray[@]}"
@@ -1186,7 +1295,7 @@ installPhase() {
 fixupPhase() {
     # Make sure everything is writable so "strip" et al. work.
     local output
-    for output in $outputs; do
+    for output in $(getAllOutputNames); do
         if [ -e "${!output}" ]; then chmod -R u+w "${!output}"; fi
     done
 
@@ -1194,7 +1303,7 @@ fixupPhase() {
 
     # Apply fixup to each output.
     local output
-    for output in $outputs; do
+    for output in $(getAllOutputNames); do
         prefix="${!output}" runHook fixupOutput
     done
 
@@ -1239,7 +1348,10 @@ fixupPhase() {
     if [ -n "${setupHooks:-}" ]; then
         mkdir -p "${!outputDev}/nix-support"
         local hook
-        for hook in $setupHooks; do
+        # have to use ${setupHooks[@]} without quotes because it needs to support setupHooks being a array or a whitespace separated string
+        # # values of setupHooks won't have spaces so it won't cause problems
+        # shellcheck disable=2068
+        for hook in ${setupHooks[@]}; do
             local content
             consumeEntire content < "$hook"
             substituteAllStream content "file '$hook'" >> "${!outputDev}/nix-support/setup-hook"
@@ -1275,11 +1387,12 @@ installCheckPhase() {
         local flagsArray=(
             ${enableParallelChecking:+-j${NIX_BUILD_CORES}}
             SHELL=$SHELL
-            $makeFlags "${makeFlagsArray[@]}"
-            $installCheckFlags "${installCheckFlagsArray[@]}"
-            ${installCheckTarget:-installcheck}
         )
 
+        _accumFlagsArray makeFlags makeFlagsArray \
+          installCheckFlags installCheckFlagsArray
+        flagsArray+=( ${installCheckTarget:-installcheck} )
+
         echoCmd 'installcheck flags' "${flagsArray[@]}"
         make ${makefile:+-f $makefile} "${flagsArray[@]}"
         unset flagsArray
@@ -1292,11 +1405,9 @@ installCheckPhase() {
 distPhase() {
     runHook preDist
 
-    # Old bash empty array hack
-    # shellcheck disable=SC2086
-    local flagsArray=(
-        $distFlags "${distFlagsArray[@]}" ${distTarget:-dist}
-    )
+    local flagsArray=()
+    _accumFlagsArray distFlags distFlagsArray
+    flagsArray+=( ${distTarget:-dist} )
 
     echo 'dist flags: %q' "${flagsArray[@]}"
     make ${makefile:+-f $makefile} "${flagsArray[@]}"
@@ -1307,7 +1418,7 @@ distPhase() {
         # Note: don't quote $tarballs, since we explicitly permit
         # wildcards in there.
         # shellcheck disable=SC2086
-        cp -pvd ${tarballs:-*.tar.gz} "$out/tarballs"
+        cp -pvd ${tarballs[*]:-*.tar.gz} "$out/tarballs"
     fi
 
     runHook postDist
@@ -1357,14 +1468,18 @@ genericBuild() {
         return
     fi
 
-    if [ -z "${phases:-}" ]; then
-        phases="${prePhases:-} unpackPhase patchPhase ${preConfigurePhases:-} \
-            configurePhase ${preBuildPhases:-} buildPhase checkPhase \
-            ${preInstallPhases:-} installPhase ${preFixupPhases:-} fixupPhase installCheckPhase \
-            ${preDistPhases:-} distPhase ${postPhases:-}";
+    if [ -z "${phases[*]:-}" ]; then
+        phases="${prePhases[*]:-} unpackPhase patchPhase ${preConfigurePhases[*]:-} \
+            configurePhase ${preBuildPhases[*]:-} buildPhase checkPhase \
+            ${preInstallPhases[*]:-} installPhase ${preFixupPhases[*]:-} fixupPhase installCheckPhase \
+            ${preDistPhases[*]:-} distPhase ${postPhases[*]:-}";
     fi
 
-    for curPhase in $phases; do
+    # The use of ${phases[*]} gives the correct behavior both with and
+    # without structured attrs.  This relies on the fact that each
+    # phase name is space-free, which it must be because it's the name
+    # of either a shell variable or a shell function.
+    for curPhase in ${phases[*]}; do
         if [[ "$curPhase" = unpackPhase && -n "${dontUnpack:-}" ]]; then continue; fi
         if [[ "$curPhase" = patchPhase && -n "${dontPatch:-}" ]]; then continue; fi
         if [[ "$curPhase" = configurePhase && -n "${dontConfigure:-}" ]]; then continue; fi
@@ -1414,6 +1529,7 @@ runHook userHook
 
 dumpVars
 
+
 # Restore the original options for nix-shell
 [[ $__nixpkgs_setup_set_original == *e* ]] || set +e
 [[ $__nixpkgs_setup_set_original == *u* ]] || set +u
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index 6c7d8880a316..d874f443f4a3 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -247,7 +247,7 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
     "xetex"
   ];
   postInstall = ''
-    for output in $outputs; do
+    for output in $(getAllOutputNames); do
       mkdir -p "''${!output}/bin"
     done
 

From 1c4820efdd26a7ff2a06871ccc614781c31bd4a3 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Wed, 29 Jun 2022 03:41:13 +0300
Subject: [PATCH 031/231] work around a nix bug

---
 pkgs/stdenv/generic/setup.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index de1dad5a1697..40905c8dfd07 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -27,6 +27,10 @@ if [ -n "$__structuredAttrs" ]; then
         # ex: out=/nix/store/...
         export "$outputName=${outputs[$outputName]}"
     done
+    # $NIX_ATTRS_JSON_FILE points to the wrong location in sandbox
+    # https://github.com/NixOS/nix/issues/6736
+    export NIX_ATTRS_JSON_FILE="$NIX_BUILD_TOP/.attrs.json"
+    export NIX_ATTRS_SH_FILE="$NIX_BUILD_TOP/.attrs.sh"
 else
     : ${outputs:=out}
 fi

From 8ad0103a349b827b48bfaa908dbf5cd7a9371076 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 17 Nov 2022 18:30:58 +0200
Subject: [PATCH 032/231] config.structuredAttrsByDefault: add option

---
 pkgs/stdenv/generic/make-derivation.nix | 2 +-
 pkgs/top-level/config.nix               | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 09a71da93b6e..2f02bc7d1d78 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -156,7 +156,7 @@ let
 
 # Experimental.  For simple packages mostly just works,
 # but for anything complex, be prepared to debug if enabling.
-, __structuredAttrs ? false
+, __structuredAttrs ? config.structuredAttrsByDefault or false
 
 , env ? { }
 
diff --git a/pkgs/top-level/config.nix b/pkgs/top-level/config.nix
index a47655f11424..1de93a9f3fde 100644
--- a/pkgs/top-level/config.nix
+++ b/pkgs/top-level/config.nix
@@ -47,6 +47,10 @@ let
       feature = "set `strictDeps` to true by default";
     };
 
+    structuredAttrsByDefault = mkMassRebuild {
+      feature = "set `__structuredAttrs` to true by default";
+    };
+
     enableParallelBuildingByDefault = mkMassRebuild {
       feature = "set `enableParallelBuilding` to true by default";
     };

From 734d7df2351ac1a10774e665447c5cdc286fc16e Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Wed, 7 Dec 2022 00:08:33 +0200
Subject: [PATCH 033/231] allow derivation attributes in env

derivations can be coerced to their output paths
---
 .../build-support/bintools-wrapper/default.nix | 18 +++++++++---------
 pkgs/build-support/cc-wrapper/default.nix      | 15 +++++++++------
 pkgs/stdenv/generic/make-derivation.nix        |  4 ++--
 3 files changed, 20 insertions(+), 17 deletions(-)

diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index ea925e90fa47..d41eaabe51a1 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -103,15 +103,12 @@ stdenv.mkDerivation {
 
   preferLocalBuild = true;
 
-  inherit bintools_bin libc_bin libc_dev libc_lib coreutils_bin;
-  shell = getBin shell + shell.shellPath or "";
-  gnugrep_bin = if nativeTools then "" else gnugrep;
-
-  inherit targetPrefix suffixSalt;
+  inherit bintools_bin libc_bin libc_dev libc_lib;
 
   outputs = [ "out" ] ++ optionals propagateDoc ([ "man" ] ++ optional (bintools ? info) "info");
 
   passthru = {
+    inherit targetPrefix suffixSalt;
     inherit bintools libc nativeTools nativeLibc nativePrefix;
 
     emacsBufferSetup = pkgs: ''
@@ -366,10 +363,13 @@ stdenv.mkDerivation {
     ##
     + extraBuildCommands;
 
-  inherit dynamicLinker;
-
-  # for substitution in utils.bash
-  expandResponseParams = "${expand-response-params}/bin/expand-response-params";
+  env = {
+    # for substitution in utils.bash
+    expandResponseParams = "${expand-response-params}/bin/expand-response-params";
+    shell = getBin shell + shell.shellPath or "";
+    gnugrep_bin = if nativeTools then "" else gnugrep;
+    inherit dynamicLinker suffixSalt coreutils_bin;
+  };
 
   meta =
     let bintools_ = if bintools != null then bintools else {}; in
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index a59505d08258..851b36fc2241 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -131,16 +131,14 @@ stdenv.mkDerivation {
 
   preferLocalBuild = true;
 
-  inherit cc libc_bin libc_dev libc_lib bintools coreutils_bin;
-  shell = getBin shell + shell.shellPath or "";
-  gnugrep_bin = if nativeTools then "" else gnugrep;
+  inherit cc libc_bin libc_dev libc_lib;
 
-  inherit targetPrefix suffixSalt;
   inherit darwinPlatformForCC darwinMinVersion darwinMinVersionVariable;
 
   outputs = [ "out" ] ++ optionals propagateDoc [ "man" "info" ];
 
   passthru = {
+    inherit targetPrefix suffixSalt;
     # "cc" is the generic name for a C compiler, but there is no one for package
     # providing the linker and related tools. The two we use now are GNU
     # Binutils, and Apple's "cctools"; "bintools" as an attempt to find an
@@ -538,8 +536,13 @@ stdenv.mkDerivation {
         nixSupport);
 
 
-  # for substitution in utils.bash
-  expandResponseParams = "${expand-response-params}/bin/expand-response-params";
+  env = {
+    # for substitution in utils.bash
+    expandResponseParams = "${expand-response-params}/bin/expand-response-params";
+    shell = getBin shell + shell.shellPath or "";
+    gnugrep_bin = if nativeTools then "" else gnugrep;
+    inherit suffixSalt coreutils_bin bintools;
+  };
 
   meta =
     let cc_ = if cc != null then cc else {}; in
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 2f02bc7d1d78..12aa25ac307c 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -488,8 +488,8 @@ else let
     assert lib.assertMsg (overlappingNames == [ ])
       "The ‘env’ attribute set cannot contain any attributes passed to derivation. The following attributes are overlapping: ${lib.concatStringsSep ", " overlappingNames}";
     lib.mapAttrs
-      (n: v: assert lib.assertMsg (lib.isString v || lib.isBool v || lib.isInt v)
-        "The ‘env’ attribute set can only contain string, boolean or integer attributes. The ‘${n}’ attribute is of type ${builtins.typeOf v}."; v)
+      (n: v: assert lib.assertMsg (lib.isString v || lib.isBool v || lib.isInt v || lib.isDerivation v)
+        "The ‘env’ attribute set can only contain derivation, string, boolean or integer attributes. The ‘${n}’ attribute is of type ${builtins.typeOf v}."; v)
       env;
 
 in

From 0cc87ab901909ae949d22caf071e446bed83e47a Mon Sep 17 00:00:00 2001
From: Leorize <leorize+oss@disroot.org>
Date: Wed, 7 Dec 2022 18:31:05 -0600
Subject: [PATCH 034/231] nixos/systemd/userdbd: add method to enable service

This is recommended to enable in conjunction with systemd-homed.
---
 nixos/modules/module-list.nix                 |  1 +
 nixos/modules/system/boot/systemd/userdbd.nix | 18 +++++++++++
 nixos/tests/all-tests.nix                     |  1 +
 nixos/tests/systemd-userdbd.nix               | 32 +++++++++++++++++++
 4 files changed, 52 insertions(+)
 create mode 100644 nixos/modules/system/boot/systemd/userdbd.nix
 create mode 100644 nixos/tests/systemd-userdbd.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 9faa58409b19..587cb2319e97 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1275,6 +1275,7 @@
   ./system/boot/systemd/shutdown.nix
   ./system/boot/systemd/tmpfiles.nix
   ./system/boot/systemd/user.nix
+  ./system/boot/systemd/userdbd.nix
   ./system/boot/timesyncd.nix
   ./system/boot/tmp.nix
   ./system/boot/uvesafb.nix
diff --git a/nixos/modules/system/boot/systemd/userdbd.nix b/nixos/modules/system/boot/systemd/userdbd.nix
new file mode 100644
index 000000000000..994aa3ca3b8c
--- /dev/null
+++ b/nixos/modules/system/boot/systemd/userdbd.nix
@@ -0,0 +1,18 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.services.userdbd;
+in
+{
+  options.services.userdbd.enable = lib.mkEnableOption (lib.mdDoc ''
+    Enables the systemd JSON user/group record lookup service
+  '');
+  config = lib.mkIf cfg.enable {
+    systemd.additionalUpstreamSystemUnits = [
+      "systemd-userdbd.socket"
+      "systemd-userdbd.service"
+    ];
+
+    systemd.sockets.systemd-userdbd.wantedBy = [ "sockets.target" ];
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 895cbe4290dc..31243f59bb98 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -636,6 +636,7 @@ in {
   systemd-shutdown = handleTest ./systemd-shutdown.nix {};
   systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
   systemd-misc = handleTest ./systemd-misc.nix {};
+  systemd-userdbd = handleTest ./systemd-userdbd.nix {};
   tandoor-recipes = handleTest ./tandoor-recipes.nix {};
   taskserver = handleTest ./taskserver.nix {};
   tayga = handleTest ./tayga.nix {};
diff --git a/nixos/tests/systemd-userdbd.nix b/nixos/tests/systemd-userdbd.nix
new file mode 100644
index 000000000000..5d0233ffd9fb
--- /dev/null
+++ b/nixos/tests/systemd-userdbd.nix
@@ -0,0 +1,32 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "systemd-userdbd";
+  nodes.machine = { config, pkgs, ... }: {
+    services.userdbd.enable = true;
+
+    users.users.test-user-nss = {
+      isNormalUser = true;
+    };
+
+    environment.etc."userdb/test-user-dropin.user".text = builtins.toJSON {
+      userName = "test-user-dropin";
+    };
+
+    environment.systemPackages = with pkgs; [ libvarlink ];
+  };
+  testScript = ''
+    import json
+    from shlex import quote
+
+    def getUserRecord(name):
+      Interface = "unix:/run/systemd/userdb/io.systemd.Multiplexer/io.systemd.UserDatabase"
+      payload = json.dumps({
+        "service": "io.systemd.Multiplexer",
+        "userName": name
+      })
+      return json.loads(machine.succeed(f"varlink call {Interface}.GetUserRecord {quote(payload)}"))
+
+    machine.wait_for_unit("systemd-userdbd.socket")
+    getUserRecord("test-user-nss")
+    getUserRecord("test-user-dropin")
+  '';
+})

From adc8900df1758eda56abd68f7d781d1df74fa531 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Wed, 7 Dec 2022 06:16:50 +0200
Subject: [PATCH 035/231] treewide: fix some core package structuredAttrs

---
 .../bintools-wrapper/default.nix              | 14 ++++++-------
 pkgs/build-support/cc-wrapper/default.nix     | 19 ++++++++----------
 .../build-support/nuke-references/default.nix | 10 ++++++----
 .../pkg-config-wrapper/default.nix            | 13 ++++++------
 pkgs/development/compilers/gcc/builder.sh     |  1 +
 .../interpreters/python/cpython/default.nix   | 20 ++++++++++---------
 .../interpreters/python/setup-hook.nix        |  4 +++-
 .../development/libraries/gettext/default.nix |  4 +++-
 pkgs/development/libraries/glibc/common.nix   | 15 +++++++-------
 .../perl-modules/generic/builder.sh           |  3 +++
 .../perl-modules/generic/default.nix          |  9 ++++++---
 11 files changed, 62 insertions(+), 50 deletions(-)

diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index d41eaabe51a1..be2e3567da85 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -55,9 +55,9 @@ let
   bintoolsVersion = lib.getVersion bintools;
   bintoolsName = lib.removePrefix targetPrefix (lib.getName bintools);
 
-  libc_bin = if libc == null then null else getBin libc;
-  libc_dev = if libc == null then null else getDev libc;
-  libc_lib = if libc == null then null else getLib libc;
+  libc_bin = if libc == null then "" else getBin libc;
+  libc_dev = if libc == null then "" else getDev libc;
+  libc_lib = if libc == null then "" else getLib libc;
   bintools_bin = if nativeTools then "" else getBin bintools;
   # The wrapper scripts use 'cat' and 'grep', so we may need coreutils.
   coreutils_bin = if nativeTools then "" else getBin coreutils;
@@ -103,8 +103,6 @@ stdenv.mkDerivation {
 
   preferLocalBuild = true;
 
-  inherit bintools_bin libc_bin libc_dev libc_lib;
-
   outputs = [ "out" ] ++ optionals propagateDoc ([ "man" ] ++ optional (bintools ? info) "info");
 
   passthru = {
@@ -190,8 +188,6 @@ stdenv.mkDerivation {
   strictDeps = true;
   depsTargetTargetPropagated = extraPackages;
 
-  wrapperName = "BINTOOLS_WRAPPER";
-
   setupHooks = [
     ../setup-hooks/role.bash
     ./setup-hook.sh
@@ -368,7 +364,9 @@ stdenv.mkDerivation {
     expandResponseParams = "${expand-response-params}/bin/expand-response-params";
     shell = getBin shell + shell.shellPath or "";
     gnugrep_bin = if nativeTools then "" else gnugrep;
-    inherit dynamicLinker suffixSalt coreutils_bin;
+    wrapperName = "BINTOOLS_WRAPPER";
+    inherit dynamicLinker targetPrefix suffixSalt coreutils_bin;
+    inherit bintools_bin libc_bin libc_dev libc_lib;
   };
 
   meta =
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 851b36fc2241..abc88910c36d 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -42,9 +42,9 @@ let
   ccVersion = lib.getVersion cc;
   ccName = lib.removePrefix targetPrefix (lib.getName cc);
 
-  libc_bin = if libc == null then null else getBin libc;
-  libc_dev = if libc == null then null else getDev libc;
-  libc_lib = if libc == null then null else getLib libc;
+  libc_bin = if libc == null then "" else getBin libc;
+  libc_dev = if libc == null then "" else getDev libc;
+  libc_lib = if libc == null then "" else getLib libc;
   cc_solib = getLib cc
     + optionalString (targetPlatform != hostPlatform) "/${targetPlatform.config}";
 
@@ -131,10 +131,6 @@ stdenv.mkDerivation {
 
   preferLocalBuild = true;
 
-  inherit cc libc_bin libc_dev libc_lib;
-
-  inherit darwinPlatformForCC darwinMinVersion darwinMinVersionVariable;
-
   outputs = [ "out" ] ++ optionals propagateDoc [ "man" "info" ];
 
   passthru = {
@@ -144,7 +140,7 @@ stdenv.mkDerivation {
     # Binutils, and Apple's "cctools"; "bintools" as an attempt to find an
     # unused middle-ground name that evokes both.
     inherit bintools;
-    inherit libc nativeTools nativeLibc nativePrefix isGNU isClang;
+    inherit cc libc nativeTools nativeLibc nativePrefix isGNU isClang;
 
     emacsBufferSetup = pkgs: ''
       ; We should handle propagation here too
@@ -268,8 +264,6 @@ stdenv.mkDerivation {
   propagatedBuildInputs = [ bintools ] ++ extraTools ++ optionals cc.langD or false [ zlib ];
   depsTargetTargetPropagated = optional (libcxx != null) libcxx ++ extraPackages;
 
-  wrapperName = "CC_WRAPPER";
-
   setupHooks = [
     ../setup-hooks/role.bash
   ] ++ lib.optional (cc.langC or true) ./setup-hook.sh
@@ -541,7 +535,10 @@ stdenv.mkDerivation {
     expandResponseParams = "${expand-response-params}/bin/expand-response-params";
     shell = getBin shell + shell.shellPath or "";
     gnugrep_bin = if nativeTools then "" else gnugrep;
-    inherit suffixSalt coreutils_bin bintools;
+    wrapperName = "CC_WRAPPER";
+    inherit suffixSalt coreutils_bin bintools cc;
+    inherit libc_bin libc_dev libc_lib;
+    inherit darwinPlatformForCC darwinMinVersion darwinMinVersionVariable;
   };
 
   meta =
diff --git a/pkgs/build-support/nuke-references/default.nix b/pkgs/build-support/nuke-references/default.nix
index 8dd9704aa4b4..c2dfe27b2c60 100644
--- a/pkgs/build-support/nuke-references/default.nix
+++ b/pkgs/build-support/nuke-references/default.nix
@@ -32,8 +32,10 @@ stdenvNoCC.mkDerivation {
   '';
 
   # FIXME: get rid of perl dependency.
-  inherit perl;
-  inherit (builtins) storeDir;
-  shell = lib.getBin shell + (shell.shellPath or "");
-  signingUtils = if darwinCodeSign then signingUtils else null;
+  env = {
+    inherit perl;
+    inherit (builtins) storeDir;
+    shell = lib.getBin shell + (shell.shellPath or "");
+    signingUtils = if darwinCodeSign then signingUtils else "";
+  };
 }
diff --git a/pkgs/build-support/pkg-config-wrapper/default.nix b/pkgs/build-support/pkg-config-wrapper/default.nix
index 312d2fe02610..ca14a4495fed 100644
--- a/pkgs/build-support/pkg-config-wrapper/default.nix
+++ b/pkgs/build-support/pkg-config-wrapper/default.nix
@@ -36,13 +36,10 @@ stdenv.mkDerivation {
 
   preferLocalBuild = true;
 
-  shell = getBin stdenvNoCC.shell + stdenvNoCC.shell.shellPath or "";
-
-  inherit targetPrefix suffixSalt baseBinName;
-
   outputs = [ "out" ] ++ optionals propagateDoc ([ "man" ] ++ optional (pkg-config ? doc) "doc");
 
   passthru = {
+    inherit targetPrefix suffixSalt;
     inherit pkg-config;
   };
 
@@ -83,8 +80,6 @@ stdenv.mkDerivation {
       ln -s ${pkg-config}/share $out/share
     '';
 
-  wrapperName = "PKG_CONFIG_WRAPPER";
-
   setupHooks = [
     ../setup-hooks/role.bash
     ./setup-hook.sh
@@ -120,6 +115,12 @@ stdenv.mkDerivation {
     ##
     + extraBuildCommands;
 
+  env = {
+    shell = getBin stdenvNoCC.shell + stdenvNoCC.shell.shellPath or "";
+    wrapperName = "PKG_CONFIG_WRAPPER";
+    inherit targetPrefix suffixSalt baseBinName;
+  };
+
   meta =
     let pkg-config_ = if pkg-config != null then pkg-config else {}; in
     (if pkg-config_ ? meta then removeAttrs pkg-config.meta ["priority"] else {}) //
diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
index c73e9e0c1075..113bd83ea53f 100644
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index fb6bffd2594f..b99f3f40dfe7 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -281,15 +281,17 @@ in with passthru; stdenv.mkDerivation {
     substituteInPlace "Lib/tkinter/tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
   '';
 
-  CPPFLAGS = concatStringsSep " " (map (p: "-I${getDev p}/include") buildInputs);
-  LDFLAGS = concatStringsSep " " (map (p: "-L${getLib p}/lib") buildInputs);
-  LIBS = "${optionalString (!stdenv.isDarwin) "-lcrypt"}";
-  NIX_LDFLAGS = lib.optionalString (stdenv.cc.isGNU && !stdenv.hostPlatform.isStatic) ({
-    "glibc" = "-lgcc_s";
-    "musl" = "-lgcc_eh";
-  }."${stdenv.hostPlatform.libc}" or "");
-  # Determinism: We fix the hashes of str, bytes and datetime objects.
-  PYTHONHASHSEED=0;
+  env = {
+    CPPFLAGS = concatStringsSep " " (map (p: "-I${getDev p}/include") buildInputs);
+    LDFLAGS = concatStringsSep " " (map (p: "-L${getLib p}/lib") buildInputs);
+    LIBS = "${optionalString (!stdenv.isDarwin) "-lcrypt"}";
+    NIX_LDFLAGS = lib.optionalString (stdenv.cc.isGNU && !stdenv.hostPlatform.isStatic) ({
+      "glibc" = "-lgcc_s";
+      "musl" = "-lgcc_eh";
+    }."${stdenv.hostPlatform.libc}" or "");
+    # Determinism: We fix the hashes of str, bytes and datetime objects.
+    PYTHONHASHSEED=0;
+  };
 
   configureFlags = [
     "--without-ensurepip"
diff --git a/pkgs/development/interpreters/python/setup-hook.nix b/pkgs/development/interpreters/python/setup-hook.nix
index 29ce079317f0..8cfb9dd46784 100644
--- a/pkgs/development/interpreters/python/setup-hook.nix
+++ b/pkgs/development/interpreters/python/setup-hook.nix
@@ -6,7 +6,9 @@ let
   hook = ./setup-hook.sh;
 in runCommand "python-setup-hook.sh" {
   strictDeps = true;
-  inherit sitePackages;
+  env = {
+    inherit sitePackages;
+  };
 } ''
   cp ${hook} hook.sh
   substituteAllInPlace hook.sh
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index a1270af259cd..ae5b9f48293a 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -60,7 +60,9 @@ stdenv.mkDerivation rec {
     ../../../build-support/setup-hooks/role.bash
     ./gettext-setup-hook.sh
   ];
-  gettextNeedsLdflags = stdenv.hostPlatform.libc != "glibc" && !stdenv.hostPlatform.isMusl;
+  env = {
+    gettextNeedsLdflags = stdenv.hostPlatform.libc != "glibc" && !stdenv.hostPlatform.isMusl;
+  };
 
   enableParallelBuilding = true;
   enableParallelChecking = false; # fails sometimes
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index d7155ec946c9..db2ef06c0f59 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -54,9 +54,6 @@ assert withGd -> gd != null && libpng != null;
 
 stdenv.mkDerivation ({
   version = version + patchSuffix;
-  linuxHeaders = if withLinuxHeaders then linuxHeaders else null;
-
-  inherit (stdenv) is64bit;
 
   enableParallelBuilding = true;
 
@@ -175,10 +172,14 @@ stdenv.mkDerivation ({
   nativeBuildInputs = [ bison python3Minimal ] ++ extraNativeBuildInputs;
   buildInputs = [ linuxHeaders ] ++ lib.optionals withGd [ gd libpng ] ++ extraBuildInputs;
 
-  # Needed to install share/zoneinfo/zone.tab.  Set to impure /bin/sh to
-  # prevent a retained dependency on the bootstrap tools in the stdenv-linux
-  # bootstrap.
-  BASH_SHELL = "/bin/sh";
+  env = {
+    linuxHeaders = if withLinuxHeaders then linuxHeaders else "";
+    inherit (stdenv) is64bit;
+    # Needed to install share/zoneinfo/zone.tab.  Set to impure /bin/sh to
+    # prevent a retained dependency on the bootstrap tools in the stdenv-linux
+    # bootstrap.
+    BASH_SHELL = "/bin/sh";
+  };
 
   # Used by libgcc, elf-header, and others to determine ABI
   passthru = { inherit version; minorRelease = version; };
diff --git a/pkgs/development/perl-modules/generic/builder.sh b/pkgs/development/perl-modules/generic/builder.sh
index 9b42401fc4dc..e56d7ec10b21 100644
--- a/pkgs/development/perl-modules/generic/builder.sh
+++ b/pkgs/development/perl-modules/generic/builder.sh
@@ -1,3 +1,6 @@
+if [ -f .attrs.sh ]; then
+    . .attrs.sh
+fi
 source $stdenv/setup
 
 PERL5LIB="$PERL5LIB${PERL5LIB:+:}$out/lib/perl5/site_perl"
diff --git a/pkgs/development/perl-modules/generic/default.nix b/pkgs/development/perl-modules/generic/default.nix
index 2d1c550d3168..3dca6550ad68 100644
--- a/pkgs/development/perl-modules/generic/default.nix
+++ b/pkgs/development/perl-modules/generic/default.nix
@@ -24,6 +24,8 @@
 # https://metacpan.org/pod/release/XSAWYERX/perl-5.26.0/pod/perldelta.pod#Removal-of-the-current-directory-%28%22.%22%29-from-@INC
 , PERL_USE_UNSAFE_INC ? "1"
 
+, env ? {}
+
 , ...
 }@attrs:
 
@@ -43,10 +45,11 @@ lib.throwIf (attrs ? name) "buildPerlPackage: `name` (\"${attrs.name}\") is depr
     buildInputs = buildInputs ++ [ perl ];
     nativeBuildInputs = nativeBuildInputs ++ [ (perl.mini or perl) ];
 
-    fullperl = buildPerl;
-
     inherit outputs src doCheck checkTarget enableParallelBuilding;
-    inherit PERL_AUTOINSTALL AUTOMATED_TESTING PERL_USE_UNSAFE_INC;
+    env = {
+      inherit PERL_AUTOINSTALL AUTOMATED_TESTING PERL_USE_UNSAFE_INC;
+      fullperl = buildPerl;
+    } // env;
 
     meta = defaultMeta // (attrs.meta or { });
   });

From 18d00c5814ce49b64a228ab78b8e834900db0519 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Wed, 7 Dec 2022 05:55:45 +0200
Subject: [PATCH 036/231] tests.stdenv: add some env attrset tests

---
 pkgs/test/default.nix        |   1 +
 pkgs/test/stdenv/default.nix | 107 +++++++++++++++++++++++++++++++++++
 2 files changed, 108 insertions(+)
 create mode 100644 pkgs/test/stdenv/default.nix

diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 3a39d247c8fe..6c89ba5638e0 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -21,6 +21,7 @@ with pkgs;
   cc-wrapper-clang-9 = callPackage ./cc-wrapper { stdenv = llvmPackages_9.stdenv; };
   cc-wrapper-libcxx-9 = callPackage ./cc-wrapper { stdenv = llvmPackages_9.libcxxStdenv; };
   stdenv-inputs = callPackage ./stdenv-inputs { };
+  stdenv = callPackage ./stdenv { };
 
   config = callPackage ./config.nix { };
 
diff --git a/pkgs/test/stdenv/default.nix b/pkgs/test/stdenv/default.nix
new file mode 100644
index 000000000000..01f0e0fe8b83
--- /dev/null
+++ b/pkgs/test/stdenv/default.nix
@@ -0,0 +1,107 @@
+# To run these tests:
+# nix-build -A tests.stdenv
+
+{ stdenv
+, pkgs
+, lib
+,
+}:
+
+let
+  # use a early stdenv so when hacking on stdenv this test can be run quickly
+  bootStdenv = stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv;
+  pkgsStructured = import pkgs.path { config = { structuredAttrsByDefault = true; }; inherit (stdenv.hostPlatform) system; };
+  bootStdenvStructuredAttrsByDefault = pkgsStructured.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv;
+in
+
+{
+  test-env-attrset = bootStdenv.mkDerivation {
+    name = "test-env-attrset";
+    dontUnpack = true;
+    dontConfigure = true;
+    dontBuild = true;
+    dontPatch = true;
+    dontFixup = true;
+    env = {
+      string = "testing-string";
+    };
+
+    installPhase = ''
+      declare -p string
+      echo "env.string = $string"
+      [[ $string == "testing-string" ]] || (echo "string was not testing-string" && false)
+      touch $out
+    '';
+  };
+
+  test-structured-env-attrset = bootStdenv.mkDerivation {
+    name = "test-structured-env-attrset";
+    dontUnpack = true;
+    dontConfigure = true;
+    dontBuild = true;
+    dontPatch = true;
+    dontFixup = true;
+    __structuredAttrs = true;
+    env = {
+      string = "testing-string";
+    };
+
+    installPhase = ''
+      declare -p string
+      echo "env.string = $string"
+      [[ $string == "testing-string" ]] || (echo "string was not testing-string" && false)
+      touch $out
+    '';
+  };
+
+  test-cc-wrapper-substitutions = bootStdenv.cc.overrideAttrs (previousAttrs: {
+    name = "test-cc-wrapper-substitutions";
+
+    postFixup = previousAttrs.postFixup + ''
+      declare -p wrapperName
+      echo "env.wrapperName = $wrapperName"
+      [[ $wrapperName == "CC_WRAPPER" ]] || (echo "wrapperName was not CC_WRAPPER" && false)
+      touch $out
+    '';
+  });
+
+  structuredAttrsByDefault = lib.recurseIntoAttrs {
+
+    test-cc-wrapper-substitutions = bootStdenvStructuredAttrsByDefault.cc.overrideAttrs (previousAttrs: {
+      name = "test-cc-wrapper-substitutions-structuredAttrsByDefault";
+
+      postFixup = previousAttrs.postFixup + ''
+        declare -p wrapperName
+        echo "env.wrapperName = $wrapperName"
+        [[ $wrapperName == "CC_WRAPPER" ]] || (echo "wrapperName was not CC_WRAPPER" && false)
+        declare -p suffixSalt
+        echo "env.suffixSalt = $suffixSalt"
+        [[ $suffixSalt == "${bootStdenvStructuredAttrsByDefault.cc.suffixSalt}" ]] || (echo "wrapperName was not ${bootStdenvStructuredAttrsByDefault.cc.suffixSalt}" && false)
+
+        grep -q "@out@" $out/bin/cc || echo "@out@ in $out/bin/cc was substituted"
+        grep -q "@suffixSalt@" $out/bin/cc && (echo "$out/bin/cc contains unsubstituted variables" && false)
+
+        touch $out
+      '';
+    });
+
+    test-structured-env-attrset = bootStdenvStructuredAttrsByDefault.mkDerivation {
+      name = "test-structured-env-attrset-structuredAttrsByDefault";
+      dontUnpack = true;
+      dontConfigure = true;
+      dontBuild = true;
+      dontPatch = true;
+      dontFixup = true;
+      env = {
+        string = "testing-string";
+      };
+
+      installPhase = ''
+        declare -p string
+        echo "env.string = $string"
+        [[ $string == "testing-string" ]] || (echo "string was not testing-string" && false)
+        touch $out
+      '';
+    };
+  };
+}

From bb914d8676e8e0261bcd4d604c653618f53ffbd8 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Wed, 7 Dec 2022 23:49:00 +0200
Subject: [PATCH 037/231] stdenv: export system pname name version for
 substituteAll

so we don't have to add these to the env attrset
---
 pkgs/stdenv/generic/setup.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 40905c8dfd07..182f849cf525 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -878,6 +878,10 @@ substituteInPlace() {
 }
 
 _allFlags() {
+    # export some local variables for the awk below
+    # so some substitutions such as name don't have to be in the env attrset
+    # when __structuredAttrs is enabled
+    export system pname name version
     for varName in $(awk 'BEGIN { for (v in ENVIRON) if (v ~ /^[a-z][a-zA-Z0-9_]*$/) print v }'); do
         if (( "${NIX_DEBUG:-0}" >= 1 )); then
             printf "@%s@ -> %q\n" "${varName}" "${!varName}"

From c01f509e4438fd50faae0fa0175277b7b16728dc Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 8 Dec 2022 01:51:03 +0200
Subject: [PATCH 038/231] treewide: source .attrs in builders

if theres a source $stdenv then this is needed

for structuredAttrs
---
 nixos/modules/services/networking/ircd-hybrid/builder.sh      | 1 +
 nixos/modules/services/web-servers/jboss/builder.sh           | 1 +
 pkgs/applications/misc/adobe-reader/builder.sh                | 1 +
 pkgs/applications/office/libreoffice/download-list-builder.sh | 1 +
 pkgs/build-support/fetchbzr/builder.sh                        | 1 +
 pkgs/build-support/fetchcvs/builder.sh                        | 1 +
 pkgs/build-support/fetchdarcs/builder.sh                      | 1 +
 pkgs/build-support/fetchdocker/fetchdocker-builder.sh         | 3 ++-
 pkgs/build-support/fetchfossil/builder.sh                     | 1 +
 pkgs/build-support/fetchgit/builder.sh                        | 2 ++
 pkgs/build-support/fetchhg/builder.sh                         | 1 +
 pkgs/build-support/fetchipfs/builder.sh                       | 1 +
 pkgs/build-support/fetchmtn/builder.sh                        | 1 +
 pkgs/build-support/fetchsvn/builder.sh                        | 1 +
 pkgs/build-support/fetchsvnssh/builder.sh                     | 1 +
 pkgs/build-support/fetchurl/builder.sh                        | 1 +
 pkgs/desktops/gnustep/make/builder.sh                         | 1 +
 pkgs/development/compilers/aspectj/builder.sh                 | 1 +
 pkgs/development/compilers/chicken/4/fetchegg/builder.sh      | 1 +
 pkgs/development/compilers/chicken/5/fetchegg/builder.sh      | 1 +
 pkgs/development/compilers/fpc/binary-builder-darwin.sh       | 1 +
 pkgs/development/compilers/fpc/binary-builder.sh              | 1 +
 pkgs/development/compilers/ios-cross-compile/9.2_builder.sh   | 1 +
 pkgs/development/compilers/ocaml/builder.sh                   | 1 +
 pkgs/development/libraries/glibc/locales-builder.sh           | 1 +
 pkgs/development/libraries/gtk-sharp/builder.sh               | 1 +
 pkgs/development/libraries/wtk/builder.sh                     | 1 +
 pkgs/development/nim-packages/fetch-nimble/builder.sh         | 1 +
 pkgs/development/perl-modules/generic/builder.sh              | 4 +---
 pkgs/development/tools/build-managers/apache-maven/builder.sh | 1 +
 pkgs/development/tools/build-managers/boot/builder.sh         | 1 +
 pkgs/development/tools/misc/automake/builder.sh               | 1 +
 pkgs/development/tools/parsing/antlr/builder.sh               | 1 +
 pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh             | 1 +
 pkgs/os-specific/linux/nvidia-x11/builder.sh                  | 1 +
 pkgs/os-specific/linux/opengl/xorg-sys/builder.sh             | 1 +
 pkgs/servers/http/tomcat/axis2/builder.sh                     | 1 +
 pkgs/servers/x11/xorg/builder.sh                              | 1 +
 pkgs/test/simple/builder.sh                                   | 1 +
 pkgs/tools/typesetting/lout/builder.sh                        | 1 +
 40 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/networking/ircd-hybrid/builder.sh b/nixos/modules/services/networking/ircd-hybrid/builder.sh
index 38312210df25..d9d2e4264dfd 100644
--- a/nixos/modules/services/networking/ircd-hybrid/builder.sh
+++ b/nixos/modules/services/networking/ircd-hybrid/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 doSub() {
diff --git a/nixos/modules/services/web-servers/jboss/builder.sh b/nixos/modules/services/web-servers/jboss/builder.sh
index 0e5af324c13f..ac573089cd5a 100644
--- a/nixos/modules/services/web-servers/jboss/builder.sh
+++ b/nixos/modules/services/web-servers/jboss/builder.sh
@@ -1,5 +1,6 @@
 set -e
 
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 mkdir -p $out/bin
diff --git a/pkgs/applications/misc/adobe-reader/builder.sh b/pkgs/applications/misc/adobe-reader/builder.sh
index 41281385c990..6047c0826430 100644
--- a/pkgs/applications/misc/adobe-reader/builder.sh
+++ b/pkgs/applications/misc/adobe-reader/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 echo "unpacking $src..."
diff --git a/pkgs/applications/office/libreoffice/download-list-builder.sh b/pkgs/applications/office/libreoffice/download-list-builder.sh
index c054e2c72cbe..31cab28fd82e 100644
--- a/pkgs/applications/office/libreoffice/download-list-builder.sh
+++ b/pkgs/applications/office/libreoffice/download-list-builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 tar --extract --file=$src libreoffice-$version/download.lst -O > $out
diff --git a/pkgs/build-support/fetchbzr/builder.sh b/pkgs/build-support/fetchbzr/builder.sh
index e424fd92d51e..163f6fc60eea 100644
--- a/pkgs/build-support/fetchbzr/builder.sh
+++ b/pkgs/build-support/fetchbzr/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source "$stdenv/setup"
 
 header "exporting \`$url' (revision $rev) into \`$out'"
diff --git a/pkgs/build-support/fetchcvs/builder.sh b/pkgs/build-support/fetchcvs/builder.sh
index fe1019aafc2f..90363275b973 100644
--- a/pkgs/build-support/fetchcvs/builder.sh
+++ b/pkgs/build-support/fetchcvs/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 (echo "#!$SHELL"; \
diff --git a/pkgs/build-support/fetchdarcs/builder.sh b/pkgs/build-support/fetchdarcs/builder.sh
index 301deb98307f..018852770504 100644
--- a/pkgs/build-support/fetchdarcs/builder.sh
+++ b/pkgs/build-support/fetchdarcs/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 tagtext=""
diff --git a/pkgs/build-support/fetchdocker/fetchdocker-builder.sh b/pkgs/build-support/fetchdocker/fetchdocker-builder.sh
index 7443591e6569..e5a1a61b78d3 100644
--- a/pkgs/build-support/fetchdocker/fetchdocker-builder.sh
+++ b/pkgs/build-support/fetchdocker/fetchdocker-builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source "${stdenv}/setup"
 header "exporting ${repository}/${imageName} (tag: ${tag}) into ${out}"
 mkdir -p "${out}"
@@ -8,7 +9,7 @@ cat <<EOF > "${out}/compositeImage.sh"
 # Create a tar archive of a docker image's layers, docker image config
 # json, manifest.json, and repositories json; this streams directly to
 # stdout and is intended to be used in concert with docker load, i.e:
-# 
+#
 # ${out}/compositeImage.sh | docker load
 
 # The first character follow the 's' command for sed becomes the
diff --git a/pkgs/build-support/fetchfossil/builder.sh b/pkgs/build-support/fetchfossil/builder.sh
index 5f08aca424fe..009b23c406d6 100644
--- a/pkgs/build-support/fetchfossil/builder.sh
+++ b/pkgs/build-support/fetchfossil/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 header "Cloning Fossil $url [$rev] into $out"
 
diff --git a/pkgs/build-support/fetchgit/builder.sh b/pkgs/build-support/fetchgit/builder.sh
index 66b6c168e41d..acb970639ab1 100644
--- a/pkgs/build-support/fetchgit/builder.sh
+++ b/pkgs/build-support/fetchgit/builder.sh
@@ -2,6 +2,8 @@
 # - no revision specified and remote has a HEAD which is used
 # - revision specified and remote has a HEAD
 # - revision specified and remote without HEAD
+#
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 header "exporting $url (rev $rev) into $out"
diff --git a/pkgs/build-support/fetchhg/builder.sh b/pkgs/build-support/fetchhg/builder.sh
index 847f18fa5975..cec0e441f229 100644
--- a/pkgs/build-support/fetchhg/builder.sh
+++ b/pkgs/build-support/fetchhg/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 header "getting $url${rev:+ ($rev)} into $out"
 
diff --git a/pkgs/build-support/fetchipfs/builder.sh b/pkgs/build-support/fetchipfs/builder.sh
index 7a6a517566f5..ca77962b5384 100644
--- a/pkgs/build-support/fetchipfs/builder.sh
+++ b/pkgs/build-support/fetchipfs/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 # Curl flags to handle redirects, not use EPSV, handle cookies for
diff --git a/pkgs/build-support/fetchmtn/builder.sh b/pkgs/build-support/fetchmtn/builder.sh
index 73eff9c27252..7db66730dab8 100644
--- a/pkgs/build-support/fetchmtn/builder.sh
+++ b/pkgs/build-support/fetchmtn/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 set -x
diff --git a/pkgs/build-support/fetchsvn/builder.sh b/pkgs/build-support/fetchsvn/builder.sh
index ed3e65f07695..b58e5a88b3cd 100644
--- a/pkgs/build-support/fetchsvn/builder.sh
+++ b/pkgs/build-support/fetchsvn/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 header "exporting $url (r$rev) into $out"
diff --git a/pkgs/build-support/fetchsvnssh/builder.sh b/pkgs/build-support/fetchsvnssh/builder.sh
index d9c6dc7da31a..b0441299dd2c 100644
--- a/pkgs/build-support/fetchsvnssh/builder.sh
+++ b/pkgs/build-support/fetchsvnssh/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 header "exporting $url (r$rev) into $out"
diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh
index 5ca09b6fc77d..dd987f41b446 100644
--- a/pkgs/build-support/fetchurl/builder.sh
+++ b/pkgs/build-support/fetchurl/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 source $mirrorsFile
diff --git a/pkgs/desktops/gnustep/make/builder.sh b/pkgs/desktops/gnustep/make/builder.sh
index 39bd77038281..e5c277e796af 100644
--- a/pkgs/desktops/gnustep/make/builder.sh
+++ b/pkgs/desktops/gnustep/make/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 preConfigure() {
diff --git a/pkgs/development/compilers/aspectj/builder.sh b/pkgs/development/compilers/aspectj/builder.sh
index 3b4393720042..7ea0a40d3748 100755
--- a/pkgs/development/compilers/aspectj/builder.sh
+++ b/pkgs/development/compilers/aspectj/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 export JAVA_HOME=$jre
diff --git a/pkgs/development/compilers/chicken/4/fetchegg/builder.sh b/pkgs/development/compilers/chicken/4/fetchegg/builder.sh
index 204661063090..5f41a36263a9 100644
--- a/pkgs/development/compilers/chicken/4/fetchegg/builder.sh
+++ b/pkgs/development/compilers/chicken/4/fetchegg/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 header "exporting egg ${eggName} (version $version) into $out"
diff --git a/pkgs/development/compilers/chicken/5/fetchegg/builder.sh b/pkgs/development/compilers/chicken/5/fetchegg/builder.sh
index d9adf510f22d..f02e01757787 100644
--- a/pkgs/development/compilers/chicken/5/fetchegg/builder.sh
+++ b/pkgs/development/compilers/chicken/5/fetchegg/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 header "exporting egg ${eggName} (version $version) into $out"
diff --git a/pkgs/development/compilers/fpc/binary-builder-darwin.sh b/pkgs/development/compilers/fpc/binary-builder-darwin.sh
index f9bdf18e7d68..39db0518281d 100755
--- a/pkgs/development/compilers/fpc/binary-builder-darwin.sh
+++ b/pkgs/development/compilers/fpc/binary-builder-darwin.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 pkgdir=$(pwd)/pkg
diff --git a/pkgs/development/compilers/fpc/binary-builder.sh b/pkgs/development/compilers/fpc/binary-builder.sh
index 4308c1ed211a..c471378c275f 100755
--- a/pkgs/development/compilers/fpc/binary-builder.sh
+++ b/pkgs/development/compilers/fpc/binary-builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 tar xf $src
diff --git a/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh b/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh
index 68ba3ed3a920..47459664af0a 100644
--- a/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh
+++ b/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh
@@ -1,4 +1,5 @@
 # -*- shell-script -*-
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 function extract
diff --git a/pkgs/development/compilers/ocaml/builder.sh b/pkgs/development/compilers/ocaml/builder.sh
index a1807682d867..88acc0654cf2 100644
--- a/pkgs/development/compilers/ocaml/builder.sh
+++ b/pkgs/development/compilers/ocaml/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 configureFlags="-prefix $out $configureFlags"
diff --git a/pkgs/development/libraries/glibc/locales-builder.sh b/pkgs/development/libraries/glibc/locales-builder.sh
index d732e208fa22..d91f936c937b 100644
--- a/pkgs/development/libraries/glibc/locales-builder.sh
+++ b/pkgs/development/libraries/glibc/locales-builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 # Glibc cannot have itself in its RPATH.
 export NIX_NO_SELF_RPATH=1
 
diff --git a/pkgs/development/libraries/gtk-sharp/builder.sh b/pkgs/development/libraries/gtk-sharp/builder.sh
index 4b8f757540b5..73914495d6d4 100644
--- a/pkgs/development/libraries/gtk-sharp/builder.sh
+++ b/pkgs/development/libraries/gtk-sharp/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 genericBuild
diff --git a/pkgs/development/libraries/wtk/builder.sh b/pkgs/development/libraries/wtk/builder.sh
index 86f2719537cd..c3ad173b0933 100644
--- a/pkgs/development/libraries/wtk/builder.sh
+++ b/pkgs/development/libraries/wtk/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 mkdir unzipped
diff --git a/pkgs/development/nim-packages/fetch-nimble/builder.sh b/pkgs/development/nim-packages/fetch-nimble/builder.sh
index 693ab339408e..bc2f9bfc94f1 100644
--- a/pkgs/development/nim-packages/fetch-nimble/builder.sh
+++ b/pkgs/development/nim-packages/fetch-nimble/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 export HOME=$NIX_BUILD_TOP
 
diff --git a/pkgs/development/perl-modules/generic/builder.sh b/pkgs/development/perl-modules/generic/builder.sh
index e56d7ec10b21..110094ad8a49 100644
--- a/pkgs/development/perl-modules/generic/builder.sh
+++ b/pkgs/development/perl-modules/generic/builder.sh
@@ -1,6 +1,4 @@
-if [ -f .attrs.sh ]; then
-    . .attrs.sh
-fi
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 PERL5LIB="$PERL5LIB${PERL5LIB:+:}$out/lib/perl5/site_perl"
diff --git a/pkgs/development/tools/build-managers/apache-maven/builder.sh b/pkgs/development/tools/build-managers/apache-maven/builder.sh
index dcc38b9ec74a..96fe8ebfac29 100644
--- a/pkgs/development/tools/build-managers/apache-maven/builder.sh
+++ b/pkgs/development/tools/build-managers/apache-maven/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 unpackPhase
diff --git a/pkgs/development/tools/build-managers/boot/builder.sh b/pkgs/development/tools/build-managers/boot/builder.sh
index c1481dc6a144..e007cbac9582 100644
--- a/pkgs/development/tools/build-managers/boot/builder.sh
+++ b/pkgs/development/tools/build-managers/boot/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 boot_bin=$out/bin/boot
diff --git a/pkgs/development/tools/misc/automake/builder.sh b/pkgs/development/tools/misc/automake/builder.sh
index e54a2acca67e..0cb1d5d61e33 100644
--- a/pkgs/development/tools/misc/automake/builder.sh
+++ b/pkgs/development/tools/misc/automake/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 # Wrap the given `aclocal' program, appending extra `-I' flags
diff --git a/pkgs/development/tools/parsing/antlr/builder.sh b/pkgs/development/tools/parsing/antlr/builder.sh
index b8e7791b6fc9..55259b932124 100644
--- a/pkgs/development/tools/parsing/antlr/builder.sh
+++ b/pkgs/development/tools/parsing/antlr/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 tar zxvf $src
diff --git a/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh b/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh
index f750df6e5063..bdb522744182 100644
--- a/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh
+++ b/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 arch=$(uname -m)
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder.sh b/pkgs/os-specific/linux/nvidia-x11/builder.sh
index eadf88fd1168..1cf1400f996b 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 unpackManually() {
diff --git a/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh b/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh
index cd21899e60e7..34f9b1579455 100644
--- a/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh
+++ b/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 mkdir -p $out/lib
diff --git a/pkgs/servers/http/tomcat/axis2/builder.sh b/pkgs/servers/http/tomcat/axis2/builder.sh
index 2e36367e9dcf..d334ab6f927f 100644
--- a/pkgs/servers/http/tomcat/axis2/builder.sh
+++ b/pkgs/servers/http/tomcat/axis2/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
 unzip $src
diff --git a/pkgs/servers/x11/xorg/builder.sh b/pkgs/servers/x11/xorg/builder.sh
index 5a832cb14d53..9ee81091584b 100644
--- a/pkgs/servers/x11/xorg/builder.sh
+++ b/pkgs/servers/x11/xorg/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 # This is the builder for all X.org components.
 source $stdenv/setup
 
diff --git a/pkgs/test/simple/builder.sh b/pkgs/test/simple/builder.sh
index 65f7e4c11ba1..908faec3c388 100644
--- a/pkgs/test/simple/builder.sh
+++ b/pkgs/test/simple/builder.sh
@@ -1,3 +1,4 @@
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 set -x
 
 export NIX_DEBUG=1
diff --git a/pkgs/tools/typesetting/lout/builder.sh b/pkgs/tools/typesetting/lout/builder.sh
index eab37c3c68fb..cd513337f6f3 100755
--- a/pkgs/tools/typesetting/lout/builder.sh
+++ b/pkgs/tools/typesetting/lout/builder.sh
@@ -1,6 +1,7 @@
 # Prepare a makefile specifying the appropriate output directories.
 #
 # Written by Ludovic Courtès <ludo@gnu.org>.
+if [ -e .attrs.sh ]; then source .attrs.sh; fi
 
 source "$stdenv/setup" || exit 1
 

From 02e3f51d27417f2775982281fc39e31a4978ae39 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 8 Dec 2022 04:30:26 +0200
Subject: [PATCH 039/231] darwin: use // for binutils-unwrapped and cctools to
 preserve the other attributes

---
 pkgs/stdenv/darwin/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 9a7cd9aa9dee..76c44870f4ad 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -262,11 +262,12 @@ rec {
           ln -s ${bootstrapTools}/bin/rewrite-tbd $out/bin
         '';
 
-        binutils-unwrapped = { name = "bootstrap-stage0-binutils"; outPath = bootstrapTools; };
+        binutils-unwrapped = bootstrapTools // {
+          name = "bootstrap-stage0-binutils";
+        };
 
-        cctools = {
+        cctools = bootstrapTools // {
           name = "bootstrap-stage0-cctools";
-          outPath = bootstrapTools;
           targetPrefix = "";
         };
 

From c41cc9e762a97c20ec3be01db254787c046510e2 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 8 Dec 2022 04:52:11 +0200
Subject: [PATCH 040/231] treewide: move some perl vars to env attrset

---
 pkgs/development/libraries/xapian/default.nix | 2 +-
 pkgs/servers/monitoring/munin/default.nix     | 2 +-
 pkgs/top-level/perl-packages.nix              | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/xapian/default.nix b/pkgs/development/libraries/xapian/default.nix
index 700fa1d13dd1..3c0a555dd978 100644
--- a/pkgs/development/libraries/xapian/default.nix
+++ b/pkgs/development/libraries/xapian/default.nix
@@ -26,7 +26,7 @@ let
     nativeBuildInputs = [ autoreconfHook ];
 
     doCheck = true;
-    AUTOMATED_TESTING = true; # https://trac.xapian.org/changeset/8be35f5e1/git
+    env.AUTOMATED_TESTING = true; # https://trac.xapian.org/changeset/8be35f5e1/git
 
     patches = lib.optionals stdenv.isDarwin [ ./skip-flaky-darwin-test.patch ];
 
diff --git a/pkgs/servers/monitoring/munin/default.nix b/pkgs/servers/monitoring/munin/default.nix
index 0bfc868167cb..2016bbe9ed3b 100644
--- a/pkgs/servers/monitoring/munin/default.nix
+++ b/pkgs/servers/monitoring/munin/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
   ];
 
   # needs to find a local perl module during build
-  PERL_USE_UNSAFE_INC = "1";
+  env.PERL_USE_UNSAFE_INC = "1";
 
   # TODO: tests are failing https://munin-monitoring.org/ticket/1390#comment:1
   # NOTE: important, test command always exits with 0, think of a way to abort the build once tests pass
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index e0cecf43d264..63d31a6cf57f 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -23029,7 +23029,7 @@ let
 
     # For some crazy reason Makefile.PL doesn't generate a Makefile if
     # AUTOMATED_TESTING is set.
-    AUTOMATED_TESTING = false;
+    env.AUTOMATED_TESTING = false;
 
     # Makefile.PL looks for ncurses in Glibc's prefix.
     preConfigure =
@@ -27058,7 +27058,7 @@ let
         hash = "sha256-gxxY8549/ebS3QORjSs8IgdBs2aD05Tu+9Bn70gu7gQ=";
       })
     ];
-    AUTOMATED_TESTING = false;
+    env.AUTOMATED_TESTING = false;
     nativeBuildInputs = [ pkgs.pkg-config ];
     buildInputs = [ pkgs.xorg.libxcb pkgs.xorg.xcbproto pkgs.xorg.xcbutil pkgs.xorg.xcbutilwm ExtUtilsDepends ExtUtilsPkgConfig TestDeep TestException XSObjectMagic ];
     propagatedBuildInputs = [ DataDump MouseXNativeTraits XMLDescent XMLSimple ];

From c577eb6892a1128c1dd52846596217653ea87f14 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 8 Dec 2022 04:59:55 +0200
Subject: [PATCH 041/231] wrapNonDeterministicGcc: fix
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

nix-repl> legacyPackages.x86_64-linux.fastStdenv
error: The ‘env’ attribute set cannot contain any attributes passed to derivation. The following attributes are overlapping: cc
«derivation
---
 pkgs/top-level/all-packages.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 44de96911273..23db6e1f2f7a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13933,9 +13933,11 @@ with pkgs;
 
   wrapNonDeterministicGcc = stdenv: ccWrapper:
     if ccWrapper.isGNU then ccWrapper.overrideAttrs(old: {
-      cc = old.cc.override {
-        reproducibleBuild = false;
-        profiledCompiler = with stdenv; (!isDarwin && hostPlatform.isx86);
+      env = old.env // {
+        cc = old.env.cc.override {
+          reproducibleBuild = false;
+          profiledCompiler = with stdenv; (!isDarwin && hostPlatform.isx86);
+        };
       };
     }) else ccWrapper;
 

From 89dc806f131ae9318d47d43befbe9a3ef7f7a765 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 8 Dec 2022 21:11:35 +0200
Subject: [PATCH 042/231] what to do about attrs.env or {} maybe have a empty
 env attrset always so no need to use `or`

---
 pkgs/stdenv/linux/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index dbaff342fb1a..6a1211f9cc48 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -249,7 +249,7 @@ in
         # Apparently iconv won't work with bootstrap glibc, but it will be used
         # with glibc built later where we keep *this* build of libunistring,
         # so we need to trick it into supporting libiconv.
-        am_cv_func_iconv_works = "yes";
+        env = attrs.env or {} // { am_cv_func_iconv_works = "yes"; };
       });
       libidn2 = super.libidn2.overrideAttrs (attrs: {
         postFixup = attrs.postFixup or "" + ''

From 11b49fa7915f35251e18fe967fc63b4900dbad81 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Fri, 9 Dec 2022 08:45:38 +0200
Subject: [PATCH 043/231] 
 tests.hooks.default-stdenv-hooks.make-symlinks-relative: init

---
 pkgs/test/default.nix       |  2 ++
 pkgs/test/hooks/default.nix | 28 ++++++++++++++++++++++++++++
 2 files changed, 30 insertions(+)
 create mode 100644 pkgs/test/hooks/default.nix

diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 3a39d247c8fe..6913415138ad 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -26,6 +26,8 @@ with pkgs;
 
   haskell = callPackage ./haskell { };
 
+  hooks = callPackage ./hooks { };
+
   cc-multilib-gcc = callPackage ./cc-wrapper/multilib.nix { stdenv = gccMultiStdenv; };
   cc-multilib-clang = callPackage ./cc-wrapper/multilib.nix { stdenv = clangMultiStdenv; };
 
diff --git a/pkgs/test/hooks/default.nix b/pkgs/test/hooks/default.nix
new file mode 100644
index 000000000000..fe3a9b2a2167
--- /dev/null
+++ b/pkgs/test/hooks/default.nix
@@ -0,0 +1,28 @@
+# To run these tests:
+# nix-build -A tests.hooks
+
+{ stdenv, pkgs, lib }:
+
+{
+  # this attrset is for hooks in `stdenv.defaultNativeBuildInputs`
+  default-stdenv-hooks = lib.recurseIntoAttrs {
+    make-symlinks-relative = stdenv.mkDerivation {
+      name = "test-make-symlinks-relative";
+      passAsFile = [ "buildCommand" ];
+      buildCommand = ''
+        mkdir -p $out/{bar,baz}
+        source1="$out/bar/foo"
+        destination1="$out/baz/foo"
+        echo foo > $source1
+        ln -s $source1 $destination1
+        echo "symlink before patching: $(readlink $destination1)"
+
+        _makeSymlinksRelative
+
+        echo "symlink after patching: $(readlink $destination1)"
+        ([[ -e $destination1 ]] && echo "symlink isn't broken") || (echo "symlink is broken" && exit 1)
+        ([[ $(readlink $destination1) == "../bar/foo" ]] && echo "absolute symlink was made relative") || (echo "symlink was not made relative" && exit 1)
+      '';
+    };
+  };
+}

From 7180c66687dd21546d904f916234e1f70f1c3590 Mon Sep 17 00:00:00 2001
From: Isabelle <hi@f2k1.de>
Date: Wed, 7 Dec 2022 15:23:17 +0100
Subject: [PATCH 044/231] ffmpeg: 4.4.2 -> 4.4.3

https://github.com/FFmpeg/FFmpeg/blob/n4.4.3/Changelog
---
 pkgs/development/libraries/ffmpeg/4.nix | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index e37e90d553a3..ac88df930768 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -1,15 +1,8 @@
-{ callPackage, fetchpatch, ... }@args:
+{ callPackage, ... }@args:
 
 callPackage ./generic.nix (rec {
-  version = "4.4.2";
+  version = "4.4.3";
   branch = version;
-  sha256 = "sha256-+YpIJSDEdQdSGpB5FNqp77wThOBZG1r8PaGKqJfeKUg=";
+  sha256 = "sha256-M7jC281TD+HbVxBBU0Vgm0yiJ70NoeOpMy27DxH9Jzo=";
 
-  patches = [
-    # SDL2 recently changed their versioning
-    (fetchpatch {
-      url = "https://git.videolan.org/?p=ffmpeg.git;a=patch;h=e5163b1d34381a3319214a902ef1df923dd2eeba";
-      hash = "sha256-nLhP2+34cj5EgpnUrePZp60nYAxmbhZAEDfay4pBVk0=";
-    })
-  ];
 } // args)

From 6459f8f88f36c55b9b7bf4b5d90dadf792ee1202 Mon Sep 17 00:00:00 2001
From: Infinidoge <infinidoge@doge-inc.net>
Date: Sat, 29 Oct 2022 19:01:14 -0400
Subject: [PATCH 045/231] rhash: 1.4.2 -> 1.4.3

Removed patch, as per the comment
---
 pkgs/tools/security/rhash/default.nix | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/pkgs/tools/security/rhash/default.nix b/pkgs/tools/security/rhash/default.nix
index b539772213bb..4b4103ff9fb1 100644
--- a/pkgs/tools/security/rhash/default.nix
+++ b/pkgs/tools/security/rhash/default.nix
@@ -1,30 +1,21 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , which
 , enableStatic ? stdenv.hostPlatform.isStatic
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.4.2";
+  version = "1.4.3";
   pname = "rhash";
 
   src = fetchFromGitHub {
     owner = "rhash";
     repo = "RHash";
     rev = "v${version}";
-    sha256 = "sha256-HkDgWwHoRWCNtWyfP4sj3veEd+KT5J7yL4J4Z/hJcrE=";
+    sha256 = "sha256-R+dHYG0DBI1uo+yF/pxoTv/V9WSfph043bH6erZjeCE=";
   };
 
-  patches = [
-    # Fix clang configuration; remove with next release
-    (fetchpatch {
-      url = "https://github.com/rhash/RHash/commit/4dc506066cf1727b021e6352535a8bb315c3f8dc.patch";
-      sha256 = "0i5jz2s37h278c8d36pzphhp8rjy660zmhpg2cqlp960f6ny8wwj";
-    })
-  ];
-
   nativeBuildInputs = [ which ];
 
   # configure script is not autotools-based, doesn't support these options

From 9578c26172e2881eba2af08c5a34904c654ea719 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <alyssa.ross@unikie.com>
Date: Fri, 9 Dec 2022 15:54:32 +0000
Subject: [PATCH 046/231] libdrm: mark unsupported on Darwin

Unlike many other Unixes, Darwin does not implement DRM.
---
 pkgs/development/libraries/libdrm/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index c96bc4e41afc..83a426a2afa4 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
       the Mesa drivers, the X drivers, libva and similar projects.
     '';
     license = licenses.mit;
-    platforms = platforms.unix;
+    platforms = lib.subtractLists platforms.darwin platforms.unix;
     maintainers = with maintainers; [ primeos ];
   };
 }

From 8bf18f7862ea9c10c1669f6e82e6d0b4e7600ea8 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <alyssa.ross@unikie.com>
Date: Fri, 9 Dec 2022 15:55:06 +0000
Subject: [PATCH 047/231] mesa: use libdrm on all supported platforms

libdrm is not Linux-specific.  It is also used on (at least) every BSD
and illumos.
---
 pkgs/development/libraries/mesa/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 113f3be326a3..4cf7a8069a89 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -40,6 +40,8 @@ let
   version = "22.2.4";
   branch  = versions.major version;
 
+  withLibdrm = lib.meta.availableOn stdenv.hostPlatform libdrm;
+
 self = stdenv.mkDerivation {
   pname = "mesa";
   inherit version;
@@ -150,7 +152,7 @@ self = stdenv.mkDerivation {
 
   propagatedBuildInputs = with xorg; [
     libXdamage libXxf86vm
-  ] ++ optional stdenv.isLinux libdrm
+  ] ++ optional withLibdrm libdrm
     ++ optionals stdenv.isDarwin [ OpenGL Xplugin ];
 
   doCheck = false;
@@ -242,10 +244,11 @@ self = stdenv.mkDerivation {
   ];
 
   passthru = {
-    inherit libdrm;
     inherit (libglvnd) driverLink;
     inherit llvmPackages;
 
+    libdrm = if withLibdrm then libdrm else null;
+
     tests = lib.optionalAttrs stdenv.isLinux {
       devDoesNotDependOnLLVM = stdenv.mkDerivation {
         name = "mesa-dev-does-not-depend-on-llvm";

From 93b89c7bfcb67f45a660e017f034974c911ae874 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <alyssa.ross@unikie.com>
Date: Fri, 9 Dec 2022 15:56:36 +0000
Subject: [PATCH 048/231] wayland: disable tests if libraries are disabled

This fixes the withLibraries = false build.
---
 pkgs/development/libraries/wayland/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/wayland/default.nix b/pkgs/development/libraries/wayland/default.nix
index c9d0a7ad3b7c..87af23a97e0e 100644
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -48,8 +48,9 @@ stdenv.mkDerivation rec {
   separateDebugInfo = true;
 
   mesonFlags = [
-    "-Dlibraries=${lib.boolToString withLibraries}"
     "-Ddocumentation=${lib.boolToString withDocumentation}"
+    "-Dlibraries=${lib.boolToString withLibraries}"
+    "-Dtests=${lib.boolToString withLibraries}"
   ];
 
   depsBuildBuild = [

From 11dffd155d01d30e07d4dbfe6c6d6de05383be3a Mon Sep 17 00:00:00 2001
From: Alyssa Ross <alyssa.ross@unikie.com>
Date: Fri, 9 Dec 2022 15:58:27 +0000
Subject: [PATCH 049/231] Revert "wayland: broken for darwin"

This reverts commit c5ef87542626ce9836144b8eb50f1c24d69aa465.

Doesn't seem to be a problem any more.
---
 pkgs/development/libraries/wayland/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/libraries/wayland/default.nix b/pkgs/development/libraries/wayland/default.nix
index 87af23a97e0e..e3fc9c06c9d0 100644
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -110,8 +110,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit; # Expat version
     platforms = if withLibraries then platforms.linux else platforms.unix;
     maintainers = with maintainers; [ primeos codyopel qyliss ];
-    # big sur doesn't support gcc stdenv and wayland doesn't build with clang
-    broken = stdenv.isDarwin;
   };
 
   passthru.version = version;

From 53b6c15df2ed9ff30b22016da87d76841aa866bc Mon Sep 17 00:00:00 2001
From: Alyssa Ross <alyssa.ross@unikie.com>
Date: Fri, 9 Dec 2022 15:59:16 +0000
Subject: [PATCH 050/231] wayland-protocols: only run tests with libwayland

---
 pkgs/development/libraries/wayland/default.nix   | 2 ++
 pkgs/development/libraries/wayland/protocols.nix | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/wayland/default.nix b/pkgs/development/libraries/wayland/default.nix
index e3fc9c06c9d0..bb764d641436 100644
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -96,6 +96,8 @@ stdenv.mkDerivation rec {
     EOF
   '';
 
+  passthru = { inherit withLibraries; };
+
   meta = with lib; {
     description = "Core Wayland window system code and protocol";
     longDescription = ''
diff --git a/pkgs/development/libraries/wayland/protocols.nix b/pkgs/development/libraries/wayland/protocols.nix
index 1d4b62788935..8629c8bec0fc 100644
--- a/pkgs/development/libraries/wayland/protocols.nix
+++ b/pkgs/development/libraries/wayland/protocols.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
   pname = "wayland-protocols";
   version = "1.31";
 
-  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+  doCheck = stdenv.hostPlatform == stdenv.buildPlatform && wayland.withLibraries;
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/wayland/${pname}/-/releases/${version}/downloads/${pname}-${version}.tar.xz";

From 2017fba3a2552519dbf918a19251a452ea90d4cc Mon Sep 17 00:00:00 2001
From: Alyssa Ross <alyssa.ross@unikie.com>
Date: Fri, 9 Dec 2022 16:00:02 +0000
Subject: [PATCH 051/231] wayland-protocols: broaden platforms

It's just some XML files!
---
 pkgs/development/libraries/wayland/protocols.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/wayland/protocols.nix b/pkgs/development/libraries/wayland/protocols.nix
index 8629c8bec0fc..bd94cc6b47ed 100644
--- a/pkgs/development/libraries/wayland/protocols.nix
+++ b/pkgs/development/libraries/wayland/protocols.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     '';
     homepage    = "https://gitlab.freedesktop.org/wayland/wayland-protocols";
     license     = lib.licenses.mit; # Expat version
-    platforms   = lib.platforms.linux;
+    platforms   = lib.platforms.all;
     maintainers = with lib.maintainers; [ primeos ];
   };
 

From e79dbb918a261599e2e0bfc32548494681de1561 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <alyssa.ross@unikie.com>
Date: Fri, 9 Dec 2022 16:16:31 +0000
Subject: [PATCH 052/231] mesa-demos: fix build on Darwin

---
 pkgs/tools/graphics/mesa-demos/default.nix | 23 ++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/pkgs/tools/graphics/mesa-demos/default.nix b/pkgs/tools/graphics/mesa-demos/default.nix
index 11ca657ebfed..efc58c370736 100644
--- a/pkgs/tools/graphics/mesa-demos/default.nix
+++ b/pkgs/tools/graphics/mesa-demos/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv, fetchurl, freeglut, glew, libGL, libGLU, libX11, libXext, mesa
+{ lib, stdenv, fetchurl, fetchpatch
+, freeglut, glew, libGL, libGLU, libX11, libXext, mesa
 , meson, ninja, pkg-config, wayland, wayland-protocols }:
 
 stdenv.mkDerivation rec {
@@ -13,21 +14,31 @@ stdenv.mkDerivation rec {
   patches = [
     # https://gitlab.freedesktop.org/mesa/demos/-/merge_requests/83
     ./demos-data-dir.patch
+
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/mesa/demos/-/commit/b6d183f9943a275990aef7f08773e54c597572e5.patch";
+      sha256 = "4UdV+cxvNRqoT+Pdy0gkCPXJbhFr6CSCw/UOOB+rvuw=";
+    })
   ];
 
   buildInputs = [
-    freeglut glew libX11 libXext libGL libGLU mesa mesa.osmesa wayland
+    freeglut glew libX11 libXext libGL libGLU mesa wayland
     wayland-protocols
-  ];
+  ] ++ lib.optional (mesa ? osmesa) mesa.osmesa ;
   nativeBuildInputs = [ meson ninja pkg-config ];
 
-  mesonFlags = [ "-Dwith-system-data-files=true" ];
+  mesonFlags = [
+    "-Degl=${if stdenv.isDarwin then "disabled" else "auto"}"
+    "-Dlibdrm=${if mesa.libdrm == null then "disabled" else "enabled"}"
+    "-Dosmesa=${if mesa ? osmesa then "enabled" else "disabled"}"
+    "-Dwayland=${if wayland.withLibraries then "enabled" else "disabled"}"
+    "-Dwith-system-data-files=true"
+  ];
 
   meta = with lib; {
+    inherit (mesa.meta) homepage platforms;
     description = "Collection of demos and test programs for OpenGL and Mesa";
-    homepage = "https://www.mesa3d.org/";
     license = licenses.mit;
-    platforms = platforms.linux;
     maintainers = with maintainers; [ andersk ];
   };
 }

From 05420f34cf7b8eb6acb1e18d918b1a9a78762473 Mon Sep 17 00:00:00 2001
From: Leorize <leorize+oss@disroot.org>
Date: Thu, 8 Dec 2022 02:49:12 -0600
Subject: [PATCH 053/231] nixos: add systemd-homed support

As a start, it's not very configurable, but works pretty well.
---
 nixos/modules/module-list.nix               |  1 +
 nixos/modules/security/pam.nix              | 27 +++++-
 nixos/modules/system/boot/systemd.nix       |  2 +-
 nixos/modules/system/boot/systemd/homed.nix | 43 +++++++++
 nixos/tests/all-tests.nix                   |  1 +
 nixos/tests/systemd-homed.nix               | 99 +++++++++++++++++++++
 pkgs/os-specific/linux/systemd/default.nix  |  2 +-
 pkgs/top-level/all-packages.nix             |  1 +
 8 files changed, 171 insertions(+), 5 deletions(-)
 create mode 100644 nixos/modules/system/boot/systemd/homed.nix
 create mode 100644 nixos/tests/systemd-homed.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 587cb2319e97..3196bfad8336 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1276,6 +1276,7 @@
   ./system/boot/systemd/tmpfiles.nix
   ./system/boot/systemd/user.nix
   ./system/boot/systemd/userdbd.nix
+  ./system/boot/systemd/homed.nix
   ./system/boot/timesyncd.nix
   ./system/boot/tmp.nix
   ./system/boot/uvesafb.nix
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 21e1749d8503..ccc484198279 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -488,6 +488,9 @@ let
             account [success=ok ignore=ignore default=die] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so
             account [success=ok default=ignore] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_admin.so
           '' +
+          optionalString config.services.homed.enable ''
+            account sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so
+          '' +
           # The required pam_unix.so module has to come after all the sufficient modules
           # because otherwise, the account lookup will fail if the user does not exist
           # locally, for example with MySQL- or LDAP-auth.
@@ -541,8 +544,10 @@ let
           # after it succeeds. Certain modules need to run after pam_unix
           # prompts the user for password so we run it once with 'optional' at an
           # earlier point and it will run again with 'sufficient' further down.
-          # We use try_first_pass the second time to avoid prompting password twice
-          (optionalString (cfg.unixAuth &&
+          # We use try_first_pass the second time to avoid prompting password twice.
+          #
+          # The same principle applies to systemd-homed
+          (optionalString ((cfg.unixAuth || config.services.homed.enable) &&
             (config.security.pam.enableEcryptfs
               || config.security.pam.enableFscrypt
               || cfg.pamMount
@@ -553,7 +558,10 @@ let
               || cfg.failDelay.enable
               || cfg.duoSecurity.enable))
             (
-              ''
+              optionalString config.services.homed.enable ''
+                auth optional ${config.systemd.package}/lib/security/pam_systemd_home.so
+              '' +
+              optionalString cfg.unixAuth ''
                 auth optional pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth
               '' +
               optionalString config.security.pam.enableEcryptfs ''
@@ -584,6 +592,9 @@ let
                 auth required ${pkgs.duo-unix}/lib/security/pam_duo.so
               ''
             )) +
+          optionalString config.services.homed.enable ''
+            auth sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so
+          '' +
           optionalString cfg.unixAuth ''
             auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth try_first_pass
           '' +
@@ -605,6 +616,10 @@ let
             auth required pam_deny.so
 
             # Password management.
+          '' +
+          optionalString config.services.homed.enable ''
+            password sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so
+          '' + ''
             password sufficient pam_unix.so nullok sha512
           '' +
           optionalString config.security.pam.enableEcryptfs ''
@@ -650,6 +665,9 @@ let
           ++ optional (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"
           ++ optional (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"
           )) +
+          optionalString config.services.homed.enable ''
+            session required ${config.systemd.package}/lib/security/pam_systemd_home.so
+          '' +
           optionalString cfg.makeHomeDir ''
             session required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=0077
           '' +
@@ -1345,6 +1363,9 @@ in
       '' +
       optionalString config.virtualisation.lxc.lxcfs.enable ''
         mr ${pkgs.lxc}/lib/security/pam_cgfs.so
+      '' +
+      optionalString config.services.homed.enable ''
+        mr ${config.systemd.package}/lib/security/pam_systemd_home.so
       '';
   };
 
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index e37ed8531810..679a663362b6 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -450,7 +450,7 @@ in
         (mkAfter [ "systemd" ])
       ]);
       group = (mkMerge [
-        (mkAfter [ "systemd" ])
+        (mkAfter [ "[success=merge] systemd" ]) # need merge so that NSS won't stop at file-based groups
       ]);
     };
 
diff --git a/nixos/modules/system/boot/systemd/homed.nix b/nixos/modules/system/boot/systemd/homed.nix
new file mode 100644
index 000000000000..403d1690124d
--- /dev/null
+++ b/nixos/modules/system/boot/systemd/homed.nix
@@ -0,0 +1,43 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.homed;
+in
+{
+  options.services.homed.enable = lib.mkEnableOption (lib.mdDoc ''
+    Enable systemd home area/user account manager
+  '');
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.services.nscd.enable;
+        message = "systemd-homed requires the use of systemd nss module. services.nscd.enable must be set to true,";
+      }
+    ];
+
+    systemd.additionalUpstreamSystemUnits = [
+      "systemd-homed.service"
+      "systemd-homed-activate.service"
+    ];
+
+    # This is mentioned in homed's [Install] section.
+    #
+    # While homed appears to work without it, it's probably better
+    # to follow upstream recommendations.
+    services.userdbd.enable = lib.mkDefault true;
+
+    systemd.services = {
+      systemd-homed = {
+        # These packages are required to manage encrypted volumes
+        path = config.system.fsPackages;
+        aliases = [ "dbus-org.freedesktop.home1.service" ];
+        wantedBy = [ "multi-user.target" ];
+      };
+
+      systemd-homed-activate = {
+        wantedBy = [ "systemd-homed.service" ];
+      };
+    };
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 31243f59bb98..1eab790887d5 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -637,6 +637,7 @@ in {
   systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
   systemd-misc = handleTest ./systemd-misc.nix {};
   systemd-userdbd = handleTest ./systemd-userdbd.nix {};
+  systemd-homed = handleTest ./systemd-homed.nix {};
   tandoor-recipes = handleTest ./tandoor-recipes.nix {};
   taskserver = handleTest ./taskserver.nix {};
   tayga = handleTest ./tayga.nix {};
diff --git a/nixos/tests/systemd-homed.nix b/nixos/tests/systemd-homed.nix
new file mode 100644
index 000000000000..ecc92e98eddc
--- /dev/null
+++ b/nixos/tests/systemd-homed.nix
@@ -0,0 +1,99 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+let
+  password = "foobar";
+  newPass = "barfoo";
+in
+{
+  name = "systemd-homed";
+  nodes.machine = { config, pkgs, ... }: {
+    services.homed.enable = true;
+
+    users.users.test-normal-user = {
+      extraGroups = [ "wheel" ];
+      isNormalUser = true;
+      initialPassword = password;
+    };
+  };
+  testScript = ''
+    def switchTTY(number):
+      machine.send_key(f"alt-f{number}")
+      machine.wait_until_succeeds(f"[ $(fgconsole) = {number} ]")
+      machine.wait_for_unit(f"getty@tty{number}.service")
+      machine.wait_until_succeeds(f"pgrep -f 'agetty.*tty{number}'")
+
+    machine.wait_for_unit("multi-user.target")
+
+    # Smoke test to make sure the pam changes didn't break regular users.
+    machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+    with subtest("login as regular user"):
+      switchTTY(2)
+      machine.wait_until_tty_matches("2", "login: ")
+      machine.send_chars("test-normal-user\n")
+      machine.wait_until_tty_matches("2", "login: test-normal-user")
+      machine.wait_until_tty_matches("2", "Password: ")
+      machine.send_chars("${password}\n")
+      machine.wait_until_succeeds("pgrep -u test-normal-user bash")
+      machine.send_chars("whoami > /tmp/1\n")
+      machine.wait_for_file("/tmp/1")
+      assert "test-normal-user" in machine.succeed("cat /tmp/1")
+
+    with subtest("create homed encrypted user"):
+      # TODO: Figure out how to pass password manually.
+      #
+      # This environment variable is used for homed internal testing
+      # and is not documented.
+      machine.succeed("NEWPASSWORD=${password} homectl create --shell=/run/current-system/sw/bin/bash --storage=luks -G wheel test-homed-user")
+
+    with subtest("login as homed user"):
+      switchTTY(3)
+      machine.wait_until_tty_matches("3", "login: ")
+      machine.send_chars("test-homed-user\n")
+      machine.wait_until_tty_matches("3", "login: test-homed-user")
+      machine.wait_until_tty_matches("3", "Password: ")
+      machine.send_chars("${password}\n")
+      machine.wait_until_succeeds("pgrep -t tty3 -u test-homed-user bash")
+      machine.send_chars("whoami > /tmp/2\n")
+      machine.wait_for_file("/tmp/2")
+      assert "test-homed-user" in machine.succeed("cat /tmp/2")
+
+    with subtest("change homed user password"):
+      switchTTY(4)
+      machine.wait_until_tty_matches("4", "login: ")
+      machine.send_chars("test-homed-user\n")
+      machine.wait_until_tty_matches("4", "login: test-homed-user")
+      machine.wait_until_tty_matches("4", "Password: ")
+      machine.send_chars("${password}\n")
+      machine.wait_until_succeeds("pgrep -t tty4 -u test-homed-user bash")
+      machine.send_chars("passwd\n")
+      # homed does it in a weird order, it asks for new passes, then it asks
+      # for the old one.
+      machine.sleep(2)
+      machine.send_chars("${newPass}\n")
+      machine.sleep(2)
+      machine.send_chars("${newPass}\n")
+      machine.sleep(4)
+      machine.send_chars("${password}\n")
+      machine.wait_until_fails("pgrep -t tty4 passwd")
+
+      @polling_condition
+      def not_logged_in_tty5():
+        machine.fail("pgrep -t tty5 bash")
+
+      switchTTY(5)
+      with not_logged_in_tty5: # type: ignore[union-attr]
+        machine.wait_until_tty_matches("5", "login: ")
+        machine.send_chars("test-homed-user\n")
+        machine.wait_until_tty_matches("5", "login: test-homed-user")
+        machine.wait_until_tty_matches("5", "Password: ")
+        machine.send_chars("${password}\n")
+        machine.wait_until_tty_matches("5", "Password incorrect or not sufficient for authentication of user test-homed-user.")
+        machine.wait_until_tty_matches("5", "Sorry, try again: ")
+      machine.send_chars("${newPass}\n")
+      machine.send_chars("whoami > /tmp/4\n")
+      machine.wait_for_file("/tmp/4")
+      assert "test-homed-user" in machine.succeed("cat /tmp/4")
+
+    with subtest("homed user should be in wheel according to NSS"):
+      machine.succeed("userdbctl group wheel -s io.systemd.NameServiceSwitch | grep test-homed-user")
+  '';
+})
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 7c57d9edf601..47d42c39c124 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -81,7 +81,7 @@
 , withDocumentation ? true
 , withEfi ? stdenv.hostPlatform.isEfi
 , withFido2 ? true
-, withHomed ? false
+, withHomed ? true
 , withHostnamed ? true
 , withHwdb ? true
 , withImportd ? !stdenv.hostPlatform.isMusl
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 734cb670af49..bceb86fa66d9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -25973,6 +25973,7 @@ with pkgs;
     withEfi = false;
     withFido2 = false;
     withHostnamed = false;
+    withHomed = false;
     withHwdb = false;
     withImportd = false;
     withLibBPF = false;

From 3046b67ec7a41654c8ecec0087110670a4ffdaf3 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 9 Dec 2022 19:22:23 +0100
Subject: [PATCH 054/231] python310Packages.aiosignal: 1.3.1 -> 1.3.1

Diff: https://github.com/aio-libs/aiosignal/compare/v1.3.1...v1.3.1

Changelog: https://github.com/aio-libs/aiosignal/blob/v1.3.1/CHANGES.rst
---
 .../python-modules/aiosignal/default.nix           | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/aiosignal/default.nix b/pkgs/development/python-modules/aiosignal/default.nix
index 9d815dfac059..2cb61f4f9719 100644
--- a/pkgs/development/python-modules/aiosignal/default.nix
+++ b/pkgs/development/python-modules/aiosignal/default.nix
@@ -9,14 +9,16 @@
 
 buildPythonPackage rec {
   pname = "aiosignal";
-  version = "1.2.0";
-  disabled = pythonOlder "3.6";
+  version = "1.3.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1pamfc2l95s1q86jvmbp17chjy129gk01kwy8xm88d2ijy8s1caq";
+    hash = "sha256-vx3Fe28r+0it1UFwyDSD9NNyeIN4tywTyr4pVp49WuU=";
   };
 
   propagatedBuildInputs = [
@@ -29,12 +31,14 @@ buildPythonPackage rec {
   ];
 
   postPatch = ''
-    substituteInPlace pytest.ini \
+    substituteInPlace setup.cfg \
       --replace "filterwarnings = error" "" \
       --replace "--cov=aiosignal" ""
   '';
 
-  pythonImportsCheck = [ "aiosignal" ];
+  pythonImportsCheck = [
+    "aiosignal"
+  ];
 
   meta = with lib; {
     description = "Python list of registered asynchronous callbacks";

From 519da3c1633c446cfcc2d97c0382e64123e59bcb Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 9 Dec 2022 19:24:35 +0100
Subject: [PATCH 055/231] python310Packages.aiosignal: add changelog to meta

---
 pkgs/development/python-modules/aiosignal/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/aiosignal/default.nix b/pkgs/development/python-modules/aiosignal/default.nix
index 2cb61f4f9719..b7a3bc9d9dee 100644
--- a/pkgs/development/python-modules/aiosignal/default.nix
+++ b/pkgs/development/python-modules/aiosignal/default.nix
@@ -43,6 +43,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python list of registered asynchronous callbacks";
     homepage = "https://github.com/aio-libs/aiosignal";
+    changelog = "https://github.com/aio-libs/aiosignal/blob/v${version}/CHANGES.rst";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };

From 6be612f64b5c41623a6f5c4ac3aa4835fef79bfa Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Fri, 9 Dec 2022 23:32:03 +0100
Subject: [PATCH 056/231] fluidsynth: fix build on aarch64-darwin

---
 pkgs/applications/audio/fluidsynth/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/audio/fluidsynth/default.nix b/pkgs/applications/audio/fluidsynth/default.nix
index 09abaa862f51..cbed4b36181e 100644
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@@ -20,7 +20,11 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isLinux [ alsa-lib libpulseaudio ]
     ++ lib.optionals stdenv.isDarwin [ AudioUnit CoreAudio CoreMIDI CoreServices ];
 
-  cmakeFlags = [ "-Denable-framework=off" ];
+  cmakeFlags = [
+    "-Denable-framework=off"
+    # set CMAKE_INSTALL_NAME_DIR to correct value on darwin
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+  ];
 
   meta = with lib; {
     description = "Real-time software synthesizer based on the SoundFont 2 specifications";

From b6346180fcd1e40b1fb9e39077796bc91cc45915 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Fri, 9 Dec 2022 14:46:55 -0800
Subject: [PATCH 057/231] python310Packages.h2: fix tests on python 3.11

---
 pkgs/development/python-modules/h2/default.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/development/python-modules/h2/default.nix b/pkgs/development/python-modules/h2/default.nix
index 97ccb7b91206..c33a959d9e70 100644
--- a/pkgs/development/python-modules/h2/default.nix
+++ b/pkgs/development/python-modules/h2/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
+, fetchpatch
 , hpack
 , hyperframe
 , pytestCheckHook
@@ -20,6 +21,15 @@ buildPythonPackage rec {
     sha256 = "sha256-qDrKCPvnqst5/seIycC6yTY0NWDtnsGLgqE6EsKNKrs=";
   };
 
+  patches = [
+    # https://github.com/python-hyper/h2/pull/1274
+    (fetchpatch {
+      name = "fix-tests-in-python-3.11.patch";
+      url = "https://github.com/python-hyper/h2/commit/8952c91606cd014720ccf202a25b5ee1fbed1591.patch";
+      hash = "sha256-skAdAVHMZo1xJEqqKa6FOKPvoQQbGUgGsQjE11jIjtw=";
+    })
+  ];
+
   propagatedBuildInputs = [
     hpack
     hyperframe

From 515c893cdac14b28075e61b1135ffb61c6ca5a3b Mon Sep 17 00:00:00 2001
From: Damjan Georgievski <gdamjan@gmail.com>
Date: Sat, 10 Dec 2022 02:11:05 +0100
Subject: [PATCH 058/231] nghttp2: 1.49.0 -> 1.51.0

fixes `curl: (92) HTTP/2 stream 0 was not closed cleanly: PROTOCOL_ERROR (err 1)` when
`curl https://www.nginx.com/`

Changes:
* https://nghttp2.org/blog/2022/09/21/nghttp2-v1-50-0/
> This release adds nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation
> which disables checking leading and trailing white spaces against HTTP field value.

* https://nghttp2.org/blog/2022/11/13/nghttp2-v1-51-0/
---
 pkgs/development/libraries/nghttp2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/nghttp2/default.nix b/pkgs/development/libraries/nghttp2/default.nix
index 8e3264dcbc51..f118467b56cf 100644
--- a/pkgs/development/libraries/nghttp2/default.nix
+++ b/pkgs/development/libraries/nghttp2/default.nix
@@ -31,11 +31,11 @@ assert enableJemalloc -> enableApp;
 
 stdenv.mkDerivation rec {
   pname = "nghttp2";
-  version = "1.49.0";
+  version = "1.51.0";
 
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-LNTbfXX3FJQVMknL6UoJLaTG7NdCQPirGM9kTZ1l9u4=";
+    sha256 = "sha256-6z6m9bYMbT7b8GXgT0NOjtYpGlyxoHkZxBcwqx/MAOA=";
   };
 
   outputs = [ "bin" "out" "dev" "lib" ]

From fda61e9066f545fca1eb440d249131edac040c30 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 8 Dec 2022 21:50:32 +0200
Subject: [PATCH 059/231] add docs for prependToVar and appendToVar

---
 doc/stdenv/stdenv.chapter.md | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index e3d874ef507e..78560a29a337 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -990,6 +990,32 @@ Convenience function for `makeWrapper` that replaces `<\executable\>` with a wra
 
 If you will apply it multiple times, it will overwrite the wrapper file and you will end up with double wrapping, which should be avoided.
 
+### `prependToVar` \<variableName\> \<elements...\> {#fun-prependToVar}
+
+Prepend elements to a variable.
+
+Example:
+
+```shellSession
+$ configureFlags="--disable-static"
+$ prependToVar configureFlags --disable-dependency-tracking --enable-foo
+$ echo $configureFlags
+--disable-dependency-tracking --enable-foo --disable-static
+```
+
+### `appendToVar` \<variableName\> \<elements...\> {#fun-appendToVar}
+
+Append elements to a variable.
+
+Example:
+
+```shellSession
+$ configureFlags="--disable-static"
+$ appendToVar configureFlags --disable-dependency-tracking --enable-foo
+$ echo $configureFlags
+--disable-static --disable-dependency-tracking --enable-foo
+```
+
 ## Package setup hooks {#ssec-setup-hooks}
 
 Nix itself considers a build-time dependency as merely something that should previously be built and accessible at build time—packages themselves are on their own to perform any additional setup. In most cases, that is fine, and the downstream derivation can deal with its own dependencies. But for a few common tasks, that would result in almost every package doing the same sort of setup work—depending not on the package itself, but entirely on which dependencies were used.

From 68fb254bf22178bee1c3009348bc7206bac59fa6 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Fri, 9 Dec 2022 20:07:12 +0200
Subject: [PATCH 060/231] tests.stdenv: deduplicate

---
 pkgs/test/stdenv/default.nix | 107 +++++++++++------------------------
 1 file changed, 34 insertions(+), 73 deletions(-)

diff --git a/pkgs/test/stdenv/default.nix b/pkgs/test/stdenv/default.nix
index 01f0e0fe8b83..2af4bcdfb731 100644
--- a/pkgs/test/stdenv/default.nix
+++ b/pkgs/test/stdenv/default.nix
@@ -12,63 +12,12 @@ let
   bootStdenv = stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv;
   pkgsStructured = import pkgs.path { config = { structuredAttrsByDefault = true; }; inherit (stdenv.hostPlatform) system; };
   bootStdenvStructuredAttrsByDefault = pkgsStructured.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv;
-in
 
-{
-  test-env-attrset = bootStdenv.mkDerivation {
-    name = "test-env-attrset";
-    dontUnpack = true;
-    dontConfigure = true;
-    dontBuild = true;
-    dontPatch = true;
-    dontFixup = true;
-    env = {
-      string = "testing-string";
-    };
 
-    installPhase = ''
-      declare -p string
-      echo "env.string = $string"
-      [[ $string == "testing-string" ]] || (echo "string was not testing-string" && false)
-      touch $out
-    '';
-  };
+  ccWrapperSubstitutionsTest = { name, stdenv', extraAttrs ? { } }:
 
-  test-structured-env-attrset = bootStdenv.mkDerivation {
-    name = "test-structured-env-attrset";
-    dontUnpack = true;
-    dontConfigure = true;
-    dontBuild = true;
-    dontPatch = true;
-    dontFixup = true;
-    __structuredAttrs = true;
-    env = {
-      string = "testing-string";
-    };
-
-    installPhase = ''
-      declare -p string
-      echo "env.string = $string"
-      [[ $string == "testing-string" ]] || (echo "string was not testing-string" && false)
-      touch $out
-    '';
-  };
-
-  test-cc-wrapper-substitutions = bootStdenv.cc.overrideAttrs (previousAttrs: {
-    name = "test-cc-wrapper-substitutions";
-
-    postFixup = previousAttrs.postFixup + ''
-      declare -p wrapperName
-      echo "env.wrapperName = $wrapperName"
-      [[ $wrapperName == "CC_WRAPPER" ]] || (echo "wrapperName was not CC_WRAPPER" && false)
-      touch $out
-    '';
-  });
-
-  structuredAttrsByDefault = lib.recurseIntoAttrs {
-
-    test-cc-wrapper-substitutions = bootStdenvStructuredAttrsByDefault.cc.overrideAttrs (previousAttrs: {
-      name = "test-cc-wrapper-substitutions-structuredAttrsByDefault";
+    stdenv'.cc.overrideAttrs (previousAttrs: ({
+      inherit name;
 
       postFixup = previousAttrs.postFixup + ''
         declare -p wrapperName
@@ -76,32 +25,44 @@ in
         [[ $wrapperName == "CC_WRAPPER" ]] || (echo "wrapperName was not CC_WRAPPER" && false)
         declare -p suffixSalt
         echo "env.suffixSalt = $suffixSalt"
-        [[ $suffixSalt == "${bootStdenvStructuredAttrsByDefault.cc.suffixSalt}" ]] || (echo "wrapperName was not ${bootStdenvStructuredAttrsByDefault.cc.suffixSalt}" && false)
+        [[ $suffixSalt == "${stdenv'.cc.suffixSalt}" ]] || (echo "wrapperName was not ${stdenv'.cc.suffixSalt}" && false)
 
         grep -q "@out@" $out/bin/cc || echo "@out@ in $out/bin/cc was substituted"
         grep -q "@suffixSalt@" $out/bin/cc && (echo "$out/bin/cc contains unsubstituted variables" && false)
 
         touch $out
       '';
-    });
+    } // extraAttrs));
 
-    test-structured-env-attrset = bootStdenvStructuredAttrsByDefault.mkDerivation {
-      name = "test-structured-env-attrset-structuredAttrsByDefault";
-      dontUnpack = true;
-      dontConfigure = true;
-      dontBuild = true;
-      dontPatch = true;
-      dontFixup = true;
-      env = {
-        string = "testing-string";
-      };
+  testEnvAttrset = { name, stdenv', extraAttrs ? { } }:
+    stdenv'.mkDerivation
+      ({
+        inherit name;
+        env = {
+          string = "testing-string";
+        };
 
-      installPhase = ''
-        declare -p string
-        echo "env.string = $string"
-        [[ $string == "testing-string" ]] || (echo "string was not testing-string" && false)
-        touch $out
-      '';
-    };
+        passAsFile = [ "buildCommand" ];
+        buildCommand = ''
+          declare -p string
+          echo "env.string = $string"
+          [[ $string == "testing-string" ]] || (echo "string was not testing-string" && false)
+          touch $out
+        '';
+      } // extraAttrs);
+
+in
+
+{
+  test-env-attrset = testEnvAttrset { name = "test-env-attrset"; stdenv' = bootStdenv; };
+
+  test-structured-env-attrset = testEnvAttrset { name = "test-structured-env-attrset"; stdenv' = bootStdenv; extraAttrs = { __structuredAttrs = true; }; };
+
+  test-cc-wrapper-substitutions = ccWrapperSubstitutionsTest { name = "test-cc-wrapper-substitutions"; stdenv' = bootStdenv; };
+
+  structuredAttrsByDefault = lib.recurseIntoAttrs {
+    test-cc-wrapper-substitutions = ccWrapperSubstitutionsTest { name = "test-cc-wrapper-substitutions-structuredAttrsByDefault"; stdenv' = bootStdenvStructuredAttrsByDefault; };
+
+    test-structured-env-attrset = testEnvAttrset { name = "test-structured-env-attrset-structuredAttrsByDefault"; stdenv' = bootStdenvStructuredAttrsByDefault; };
   };
 }

From bf972f18736478dad213ce2c409239af36417787 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Fri, 9 Dec 2022 22:22:31 +0200
Subject: [PATCH 061/231] tests.stdenv: add tests for prependToVar and
 appendToVar

---
 pkgs/test/stdenv/default.nix | 94 +++++++++++++++++++++++++++++++++---
 1 file changed, 87 insertions(+), 7 deletions(-)

diff --git a/pkgs/test/stdenv/default.nix b/pkgs/test/stdenv/default.nix
index 2af4bcdfb731..c5af468655ff 100644
--- a/pkgs/test/stdenv/default.nix
+++ b/pkgs/test/stdenv/default.nix
@@ -22,10 +22,10 @@ let
       postFixup = previousAttrs.postFixup + ''
         declare -p wrapperName
         echo "env.wrapperName = $wrapperName"
-        [[ $wrapperName == "CC_WRAPPER" ]] || (echo "wrapperName was not CC_WRAPPER" && false)
+        [[ $wrapperName == "CC_WRAPPER" ]] || (echo "'\$wrapperName' was not 'CC_WRAPPER'" && false)
         declare -p suffixSalt
         echo "env.suffixSalt = $suffixSalt"
-        [[ $suffixSalt == "${stdenv'.cc.suffixSalt}" ]] || (echo "wrapperName was not ${stdenv'.cc.suffixSalt}" && false)
+        [[ $suffixSalt == "${stdenv'.cc.suffixSalt}" ]] || (echo "'\$suffxSalt' was not '${stdenv'.cc.suffixSalt}'" && false)
 
         grep -q "@out@" $out/bin/cc || echo "@out@ in $out/bin/cc was substituted"
         grep -q "@suffixSalt@" $out/bin/cc && (echo "$out/bin/cc contains unsubstituted variables" && false)
@@ -46,7 +46,35 @@ let
         buildCommand = ''
           declare -p string
           echo "env.string = $string"
-          [[ $string == "testing-string" ]] || (echo "string was not testing-string" && false)
+          [[ $string == "testing-string" ]] || (echo "'\$string' was not 'testing-string'" && false)
+          touch $out
+        '';
+      } // extraAttrs);
+
+  testPrependAndAppendToVar = { name, stdenv', extraAttrs ? { } }:
+    stdenv'.mkDerivation
+      ({
+        inherit name;
+        env = {
+          string = "testing-string";
+        };
+
+        passAsFile = [ "buildCommand" ] ++ lib.optionals (extraAttrs ? extraTest) [ "extraTest" ];
+        # FIXME: with structuredAttrs string is converted to a indexed array
+        # should a/pToVar check if the passed variable is a array or a string?
+        # declare -x string="testing-string"
+        # declare -ax string=([0]="world" [1]="testing-string" [2]="hello")
+        buildCommand = ''
+          declare -p string
+          appendToVar string hello
+          # test that quoted strings work
+          prependToVar string "world"
+          declare -p string
+
+          [[ $string == "world testing-string hello" ]] || (echo "'\$string' was not 'world testing-string hello'" && false)
+
+          eval "$extraTest"
+
           touch $out
         '';
       } // extraAttrs);
@@ -56,13 +84,65 @@ in
 {
   test-env-attrset = testEnvAttrset { name = "test-env-attrset"; stdenv' = bootStdenv; };
 
-  test-structured-env-attrset = testEnvAttrset { name = "test-structured-env-attrset"; stdenv' = bootStdenv; extraAttrs = { __structuredAttrs = true; }; };
+  test-prepend-append-to-var = testPrependAndAppendToVar {
+    name = "test-prepend-append-to-var";
+    stdenv' = bootStdenv;
+  };
 
-  test-cc-wrapper-substitutions = ccWrapperSubstitutionsTest { name = "test-cc-wrapper-substitutions"; stdenv' = bootStdenv; };
+  test-structured-env-attrset = testEnvAttrset {
+    name = "test-structured-env-attrset";
+    stdenv' = bootStdenv;
+    extraAttrs = { __structuredAttrs = true; };
+  };
+
+  test-cc-wrapper-substitutions = ccWrapperSubstitutionsTest {
+    name = "test-cc-wrapper-substitutions";
+    stdenv' = bootStdenv;
+  };
 
   structuredAttrsByDefault = lib.recurseIntoAttrs {
-    test-cc-wrapper-substitutions = ccWrapperSubstitutionsTest { name = "test-cc-wrapper-substitutions-structuredAttrsByDefault"; stdenv' = bootStdenvStructuredAttrsByDefault; };
+    test-cc-wrapper-substitutions = ccWrapperSubstitutionsTest {
+      name = "test-cc-wrapper-substitutions-structuredAttrsByDefault";
+      stdenv' = bootStdenvStructuredAttrsByDefault;
+    };
 
-    test-structured-env-attrset = testEnvAttrset { name = "test-structured-env-attrset-structuredAttrsByDefault"; stdenv' = bootStdenvStructuredAttrsByDefault; };
+    test-structured-env-attrset = testEnvAttrset {
+      name = "test-structured-env-attrset-structuredAttrsByDefault";
+      stdenv' = bootStdenvStructuredAttrsByDefault;
+    };
+
+    test-prepend-append-to-var = testPrependAndAppendToVar {
+      name = "test-prepend-append-to-var-structuredAttrsByDefault";
+      stdenv' = bootStdenvStructuredAttrsByDefault;
+      extraAttrs = {
+        # will be a bash indexed array in attrs.sh
+        # declare -a list=('a' 'b' )
+        # and a json array in attrs.json
+        # "list":["a","b"]
+        list = [ "a" "b" ];
+        # will be a bash associative array(dictionary) in attrs.sh
+        # declare -A array=(['a']='1' ['b']='2' )
+        # and a json object in attrs.json
+        # {"array":{"a":"1","b":"2"}
+        array = { a = "1"; b = "2"; };
+        extraTest = ''
+          declare -p array
+          array+=(["c"]="3")
+          declare -p array
+
+          [[ "''${array[c]}" == "3" ]] || (echo "c element of '\$array' was not '3'" && false)
+
+          declare -p list
+          prependToVar list hello
+          # test that quoted strings work
+          appendToVar list "world"
+          declare -p list
+
+          [[ "''${list[0]}" == "hello" ]] || (echo "first element of '\$list' was not 'hello'" && false)
+          [[ "''${list[1]}" == "a" ]] || (echo "first element of '\$list' was not 'a'" && false)
+          [[ "''${list[-1]}" == "world" ]] || (echo "last element of '\$list' was not 'world'" && false)
+        '';
+      };
+    };
   };
 }

From 11c3127e38dafdf95ca71a85b1591a29b67e0c09 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Sat, 10 Dec 2022 01:09:40 +0200
Subject: [PATCH 062/231] stdenv: detect the type of variable in
 {prepend,append}ToVar

stdenv: error if using {prepend,append}ToVar on associative array

i don't know how to prepend to associative array
---
 pkgs/stdenv/generic/setup.sh | 50 ++++++++++++++++++++++++++++++++++--
 pkgs/test/stdenv/default.nix | 19 +++++++++++---
 2 files changed, 63 insertions(+), 6 deletions(-)

diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 182f849cf525..5a64625e10d1 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -209,8 +209,31 @@ addToSearchPath() {
 # Expressions for individual packages should simply switch to array
 # syntax when they switch to setting __structuredAttrs = true.
 prependToVar() {
-    local -n nameref="$1"; shift
+    local -n nameref="$1"
+
+    useArray=
     if [ -n "$__structuredAttrs" ]; then
+        useArray=true
+    else
+        useArray=false
+    fi
+
+    # check if variable already exist and if it does then do extra checks
+    if declare -p "$1" 2> /dev/null | grep -q '^'; then
+        type="$(declare -p "$1")"
+        if [[ "$type" =~ "declare -A" ]]; then
+            echo "prependToVar(): ERROR: trying to use prependToVar on an associative array." >&2
+            return 1
+        elif [[ "$type" =~ "declare -a" ]]; then
+            useArray=true
+        else
+            useArray=false
+        fi
+    fi
+
+    shift
+
+    if $useArray; then
         nameref=( "$@" ${nameref+"${nameref[@]}"} )
     else
         nameref="$* ${nameref-}"
@@ -219,8 +242,31 @@ prependToVar() {
 
 # Same as above
 appendToVar() {
-    local -n nameref="$1"; shift
+    local -n nameref="$1"
+
+    useArray=
     if [ -n "$__structuredAttrs" ]; then
+        useArray=true
+    else
+        useArray=false
+    fi
+
+    # check if variable already exist and if it does then do extra checks
+    if declare -p "$1" 2> /dev/null | grep -q '^'; then
+        type="$(declare -p "$1")"
+        if [[ "$type" =~ "declare -A" ]]; then
+            echo "appendToVar(): ERROR: trying to use appendToVar on an associative array, use variable+=([\"X\"]=\"Y\") instead." >&2
+            return 1
+        elif [[ "$type" =~ "declare -a" ]]; then
+            useArray=true
+        else
+            useArray=false
+        fi
+    fi
+
+    shift
+
+    if $useArray; then
         nameref=( ${nameref+"${nameref[@]}"} "$@" )
     else
         nameref="${nameref-} $*"
diff --git a/pkgs/test/stdenv/default.nix b/pkgs/test/stdenv/default.nix
index c5af468655ff..08e8eed118f9 100644
--- a/pkgs/test/stdenv/default.nix
+++ b/pkgs/test/stdenv/default.nix
@@ -60,10 +60,6 @@ let
         };
 
         passAsFile = [ "buildCommand" ] ++ lib.optionals (extraAttrs ? extraTest) [ "extraTest" ];
-        # FIXME: with structuredAttrs string is converted to a indexed array
-        # should a/pToVar check if the passed variable is a array or a string?
-        # declare -x string="testing-string"
-        # declare -ax string=([0]="world" [1]="testing-string" [2]="hello")
         buildCommand = ''
           declare -p string
           appendToVar string hello
@@ -71,8 +67,23 @@ let
           prependToVar string "world"
           declare -p string
 
+          declare -A associativeArray=(["X"]="Y")
+          [[ $(appendToVar associativeArray "fail" 2>&1) =~ "trying to use" ]] || (echo "prependToVar did not catch prepending associativeArray" && false)
+          [[ $(prependToVar associativeArray "fail" 2>&1) =~ "trying to use" ]] || (echo "prependToVar did not catch prepending associativeArray" && false)
+
           [[ $string == "world testing-string hello" ]] || (echo "'\$string' was not 'world testing-string hello'" && false)
 
+          # test appending to a unset variable
+          appendToVar nonExistant created hello
+          typeset -p nonExistant
+          if [[ -n $__structuredAttrs ]]; then
+            [[ "''${nonExistant[@]}" == "created hello" ]]
+          else
+            # there's a extra " " in front here and a extra " " in the end of prependToVar
+            # shouldn't matter because these functions will mostly be used for $*Flags and the Flag variable will in most cases already exit
+            [[ "$nonExistant" == " created hello" ]]
+          fi
+
           eval "$extraTest"
 
           touch $out

From ba25f45c729cf7fed14b683f2cd6cea44e281646 Mon Sep 17 00:00:00 2001
From: Luiz Irber <contact+github@luizirber.org>
Date: Wed, 7 Dec 2022 21:31:08 -0800
Subject: [PATCH 063/231] maturin: 0.13.0 -> 0.14.5

---
 pkgs/development/tools/rust/maturin/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/rust/maturin/default.nix b/pkgs/development/tools/rust/maturin/default.nix
index b276a618110f..384030c903d9 100644
--- a/pkgs/development/tools/rust/maturin/default.nix
+++ b/pkgs/development/tools/rust/maturin/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "0.13.0";
+  version = "0.14.5";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-uKpYI+Oc49xgoIZCh72baBMZLcpMXk7g2Jb1DQxW9lk=";
+    hash = "sha256-3TEEmraQ9KGx29ok7IUdVzTW0ilaAci1dOZUlKvQYJE=";
   };
 
-  cargoHash = "sha256-levBWghFIXOXe+NGXvwBqQpPmWeUK53ruSyLik1urSU=";
+  cargoHash = "sha256-/biWBTNIysg6HDozyF8UdKoxlgkHl9tnyean8+333hI=";
 
   nativeBuildInputs = [ pkg-config ];
 

From 662c9e2187c312cf3a3c94525bbd48f4d60f2463 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Nov 2022 01:35:17 +0100
Subject: [PATCH 064/231] python310Packages.platformdirs: add changelog to meta

---
 pkgs/development/python-modules/platformdirs/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/platformdirs/default.nix b/pkgs/development/python-modules/platformdirs/default.nix
index e206c33d34ca..c140d1babc38 100644
--- a/pkgs/development/python-modules/platformdirs/default.nix
+++ b/pkgs/development/python-modules/platformdirs/default.nix
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = version;
-    sha256 = "sha256-OAvhbgmwGhElszUPksXkOgB5Dp/Wcf4s8807CcT7eyM=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-OAvhbgmwGhElszUPksXkOgB5Dp/Wcf4s8807CcT7eyM=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -41,8 +41,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "Python module for determining appropriate platform-specific directories";
+    description = "Module for determining appropriate platform-specific directories";
     homepage = "https://platformdirs.readthedocs.io/";
+    changelog = "https://github.com/platformdirs/platformdirs/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };

From a3166adae7e45b9f5f96e30d6766ae2157637682 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 10 Dec 2022 11:20:00 +0100
Subject: [PATCH 065/231] python310Packages.platformdirs: 2.5.3 -> 2.5.4

Diff: https://github.com/platformdirs/platformdirs/compare/refs/tags/2.5.3...2.5.4

Changelog: https://github.com/platformdirs/platformdirs/releases/tag/2.5.4
---
 pkgs/development/python-modules/platformdirs/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/platformdirs/default.nix b/pkgs/development/python-modules/platformdirs/default.nix
index c140d1babc38..53939421de2f 100644
--- a/pkgs/development/python-modules/platformdirs/default.nix
+++ b/pkgs/development/python-modules/platformdirs/default.nix
@@ -2,16 +2,16 @@
 , appdirs
 , buildPythonPackage
 , fetchFromGitHub
+, hatch-vcs
+, hatchling
 , pytest-mock
 , pytestCheckHook
 , pythonOlder
-, hatchling
-, hatch-vcs
 }:
 
 buildPythonPackage rec {
   pname = "platformdirs";
-  version = "2.5.3";
+  version = "2.5.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-OAvhbgmwGhElszUPksXkOgB5Dp/Wcf4s8807CcT7eyM=";
+    hash = "sha256-H+pcIv9ABwQioe6U24JNo6OyqoQ367lmAm+SQMUM4Kk=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From e502357e1255403f403689dfa7627a3bb592dc55 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 10 Dec 2022 11:20:26 +0100
Subject: [PATCH 066/231] python310Packages.platformdirs: 2.5.4 -> 2.6.0

Diff: https://github.com/platformdirs/platformdirs/compare/refs/tags/2.5.4...2.6.0

Changelog: https://github.com/platformdirs/platformdirs/releases/tag/2.6.0
---
 pkgs/development/python-modules/platformdirs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/platformdirs/default.nix b/pkgs/development/python-modules/platformdirs/default.nix
index 53939421de2f..8c0bdb3cb43a 100644
--- a/pkgs/development/python-modules/platformdirs/default.nix
+++ b/pkgs/development/python-modules/platformdirs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "platformdirs";
-  version = "2.5.4";
+  version = "2.6.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-H+pcIv9ABwQioe6U24JNo6OyqoQ367lmAm+SQMUM4Kk=";
+    hash = "sha256-qh5pv+rAFRMMJHr4nhKQ9Ndyvjd2QuSlkIeVcrXPrQI=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From bef9c1c3b2e0357e28156a43702313cd3fc18b95 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 10 Dec 2022 14:11:35 +0100
Subject: [PATCH 067/231] python310Packages.urllib3: add changelog to meta

---
 .../python-modules/urllib3/default.nix         | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index ec63f5f21ed9..772799eefa3a 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -64,15 +64,27 @@ buildPythonPackage rec {
   ];
 
   passthru.optional-dependencies = {
-    brotli = if isPyPy then [ brotlicffi ] else [ brotli ];
+    brotli = if isPyPy then [
+      brotlicffi
+    ] else [
+      brotli
+    ];
     # Use carefully since pyopenssl is not supported aarch64-darwin
-    secure = [ certifi cryptography idna pyopenssl ];
-    socks = [ pysocks ];
+    secure = [
+      certifi
+      cryptography
+      idna
+      pyopenssl
+    ];
+    socks = [
+      pysocks
+    ];
   };
 
   meta = with lib; {
     description = "Powerful, sanity-friendly HTTP client for Python";
     homepage = "https://github.com/shazow/urllib3";
+    changelog = "https://github.com/urllib3/urllib3/blob/${version}/CHANGES.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };

From c033f340de6b9ea78cc5fbc3c296b99b27354dd5 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 10 Dec 2022 14:12:01 +0100
Subject: [PATCH 068/231] python310Packages.urllib3: 1.26.12 -> 1.26.13

Changelog: https://github.com/urllib3/urllib3/blob/1.26.13/CHANGES.rst
---
 pkgs/development/python-modules/urllib3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index 772799eefa3a..86083a4cc573 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -20,12 +20,12 @@
 
 buildPythonPackage rec {
   pname = "urllib3";
-  version = "1.26.12";
+  version = "1.26.13";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-P6ls9CPmmHmX/DJq6N85bbKot8ZndH1H3djsupH0p04=";
+    hash = "sha256-wIPdDc5o2/vhEp1SccuQ+UR96n1SCXxuASYSDFId3qg=";
   };
 
   # FIXME: remove backwards compatbility hack

From 54705413479d6deb288bc3c95308163ddfbf5261 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 8 Dec 2022 20:29:44 +0200
Subject: [PATCH 069/231] oniguruma,jq: add artturin as maintainer

---
 pkgs/development/libraries/oniguruma/default.nix | 2 +-
 pkgs/development/tools/jq/default.nix            | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/oniguruma/default.nix b/pkgs/development/libraries/oniguruma/default.nix
index bc084829e7bb..cffa14fdc46b 100644
--- a/pkgs/development/libraries/oniguruma/default.nix
+++ b/pkgs/development/libraries/oniguruma/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/kkos/oniguruma";
     description = "Regular expressions library";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ artturin ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/jq/default.nix b/pkgs/development/tools/jq/default.nix
index 5671f5dbe641..dab6831cefd3 100644
--- a/pkgs/development/tools/jq/default.nix
+++ b/pkgs/development/tools/jq/default.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
     description = "A lightweight and flexible command-line JSON processor";
     homepage = "https://stedolan.github.io/jq/";
     license = licenses.mit;
-    maintainers = with maintainers; [ raskin globin ];
+    maintainers = with maintainers; [ raskin globin artturin ];
     platforms = platforms.unix;
     downloadPage = "https://stedolan.github.io/jq/download/";
   };

From aae20cf5c05f9478c1933471f2ac1e841376eb91 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 8 Dec 2022 20:46:54 +0200
Subject: [PATCH 070/231] jq,oniguruma: make suitable for inclusion in
 common-path.nix

---
 .../libraries/oniguruma/default.nix           | 16 ++++----
 pkgs/development/tools/jq/default.nix         | 18 +++------
 ...when-building-without-regex-supports.patch | 38 +++++++++++++++++++
 3 files changed, 53 insertions(+), 19 deletions(-)
 create mode 100644 pkgs/development/tools/jq/fix-tests-when-building-without-regex-supports.patch

diff --git a/pkgs/development/libraries/oniguruma/default.nix b/pkgs/development/libraries/oniguruma/default.nix
index cffa14fdc46b..3062c3cb4e11 100644
--- a/pkgs/development/libraries/oniguruma/default.nix
+++ b/pkgs/development/libraries/oniguruma/default.nix
@@ -1,16 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook }:
+{ lib, stdenv, fetchurl, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  pname = "onig";
+  pname = "oniguruma";
   version = "6.9.8";
 
-  src = fetchFromGitHub {
-    owner = "kkos";
-    repo = "oniguruma";
-    rev = "v${version}";
-    sha256 = "sha256-8aFZdhh6ovLCR0A17rvWq/Oif66rSMnHcCYHjClNElw=";
+  # Note: do not use fetchpatch or fetchFromGitHub to keep this package available in __bootPackages
+  src = fetchurl {
+    url = "https://github.com/kkos/oniguruma/releases/download/v${version}/onig-${version}.tar.gz";
+    sha256 = "sha256-KM1iwUZGI8eRBWX7HMqqAQSy/osSvNZG6B9ztHU1IT4=";
   };
 
+  outputs = [ "dev" "lib" "out" ];
+  outputBin = "dev"; # onig-config
+
   nativeBuildInputs = [ autoreconfHook ];
   configureFlags = [ "--enable-posix-api=yes" ];
 
diff --git a/pkgs/development/tools/jq/default.nix b/pkgs/development/tools/jq/default.nix
index dab6831cefd3..6b41cc9862b9 100644
--- a/pkgs/development/tools/jq/default.nix
+++ b/pkgs/development/tools/jq/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
-, fetchpatch
-, fetchFromGitHub
+, fetchurl
 , autoreconfHook
 , onigurumaSupport ? true
 , oniguruma
@@ -11,19 +10,14 @@ stdenv.mkDerivation rec {
   pname = "jq";
   version = "1.6";
 
-  src = fetchFromGitHub {
-    owner = "stedolan";
-    repo = "jq";
-    rev = "${pname}-${version}";
-    hash = "sha256-CIE8vumQPGK+TFAncmpBijANpFALLTadOvkob0gVzro";
+  # Note: do not use fetchpatch or fetchFromGitHub to keep this package available in __bootPackages
+  src = fetchurl {
+    url = "https://github.com/stedolan/jq/releases/download/jq-${version}/jq-${version}.tar.gz";
+    sha256 = "sha256-XejI4pqqP7nMa0e7JymfJxNU67clFOOsytx9OLW7qnI=";
   };
 
   patches = [
-    (fetchpatch {
-      name = "fix-tests-when-building-without-regex-supports.patch";
-      url = "https://github.com/stedolan/jq/pull/2292/commits/f6a69a6e52b68a92b816a28eb20719a3d0cb51ae.patch";
-      sha256 = "pTM5FZ6hFs5Rdx+W2dICSS2lcoLY1Q//Lan3Hu8Gr58=";
-    })
+    ./fix-tests-when-building-without-regex-supports.patch
   ];
 
   outputs = [ "bin" "doc" "man" "dev" "lib" "out" ];
diff --git a/pkgs/development/tools/jq/fix-tests-when-building-without-regex-supports.patch b/pkgs/development/tools/jq/fix-tests-when-building-without-regex-supports.patch
new file mode 100644
index 000000000000..ac7614ed80b2
--- /dev/null
+++ b/pkgs/development/tools/jq/fix-tests-when-building-without-regex-supports.patch
@@ -0,0 +1,38 @@
+From f6a69a6e52b68a92b816a28eb20719a3d0cb51ae Mon Sep 17 00:00:00 2001
+From: Dmitry Bogatov <git#v1@kaction.cc>
+Date: Sat, 27 Mar 2021 00:00:00 +0000
+Subject: [PATCH] Disable some tests when building without regex support
+
+---
+ Makefile.am  | 5 ++++-
+ configure.ac | 1 +
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index f5c1db594..f3f44bb9e 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -130,7 +130,10 @@ endif
+ 
+ ### Tests (make check)
+ 
+-TESTS = tests/optionaltest tests/mantest tests/jqtest tests/onigtest tests/shtest tests/utf8test tests/base64test
++TESTS = tests/optionaltest tests/jqtest tests/shtest tests/utf8test tests/base64test
++if WITH_ONIGURUMA
++TESTS += tests/mantest tests/onigtest
++endif
+ TESTS_ENVIRONMENT = NO_VALGRIND=$(NO_VALGRIND)
+ 
+ # This is a magic make variable that causes it to treat tests/man.test as a
+diff --git a/configure.ac b/configure.ac
+index 0441d4a2c..987d94e0a 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -278,6 +278,7 @@ AC_SUBST(onig_CFLAGS)
+ AC_SUBST(onig_LDFLAGS)
+ 
+ AM_CONDITIONAL([BUILD_ONIGURUMA], [test "x$build_oniguruma" = xyes])
++AM_CONDITIONAL([WITH_ONIGURUMA], [test "x$with_oniguruma" = xyes])
+ AC_SUBST([BUNDLER], ["$bundle_cmd"])
+ 
+ AC_CONFIG_MACRO_DIR([config/m4])

From 84a7cadfd2d419b00148b5b826568c5ba59b93d5 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Sun, 11 Dec 2022 12:57:16 +0200
Subject: [PATCH 071/231] tests.stdenv: add test-golden-example-structuredAttrs

examples copied from https://nixos.mayflower.consulting/blog/2020/01/20/structured-attrs/

nix has tests for structuredAttrs but i figured it'd be good to have a
golden test here too

https://github.com/NixOS/nix/blob/master/tests/structured-attrs.nix
https://github.com/NixOS/nix/blob/master/tests/structured-attrs-shell.nix
---
 pkgs/test/stdenv/default.nix | 71 ++++++++++++++++++++++++++++++++++++
 1 file changed, 71 insertions(+)

diff --git a/pkgs/test/stdenv/default.nix b/pkgs/test/stdenv/default.nix
index 08e8eed118f9..0a29f91ce049 100644
--- a/pkgs/test/stdenv/default.nix
+++ b/pkgs/test/stdenv/default.nix
@@ -8,6 +8,8 @@
 }:
 
 let
+  # early enough not to rebuild gcc but late enough to have patchelf
+  earlyPkgs = stdenv.__bootPackages.stdenv.__bootPackages;
   # use a early stdenv so when hacking on stdenv this test can be run quickly
   bootStdenv = stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv;
   pkgsStructured = import pkgs.path { config = { structuredAttrsByDefault = true; }; inherit (stdenv.hostPlatform) system; };
@@ -155,5 +157,74 @@ in
         '';
       };
     };
+
+    test-golden-example-structuredAttrs =
+      let
+        goldenSh = earlyPkgs.writeText "goldenSh" ''
+          declare -A EXAMPLE_ATTRS=(['foo']='bar' )
+          declare EXAMPLE_BOOL_FALSE=
+          declare EXAMPLE_BOOL_TRUE=1
+          declare EXAMPLE_INT=123
+          declare EXAMPLE_INT_NEG=-123
+          declare -a EXAMPLE_LIST=('foo' 'bar' )
+          declare EXAMPLE_STR='foo bar'
+        '';
+        goldenJson = earlyPkgs.writeText "goldenSh" ''
+          {
+            "EXAMPLE_ATTRS": {
+              "foo": "bar"
+            },
+            "EXAMPLE_BOOL_FALSE": false,
+            "EXAMPLE_BOOL_TRUE": true,
+            "EXAMPLE_INT": 123,
+            "EXAMPLE_INT_NEG": -123,
+            "EXAMPLE_LIST": [
+              "foo",
+              "bar"
+            ],
+            "EXAMPLE_NESTED_ATTRS": {
+              "foo": {
+                "bar": "baz"
+              }
+            },
+            "EXAMPLE_NESTED_LIST": [
+              [
+                "foo",
+                "bar"
+              ],
+              [
+                "baz"
+              ]
+            ],
+            "EXAMPLE_STR": "foo bar"
+          }
+        '';
+      in
+      bootStdenvStructuredAttrsByDefault.mkDerivation {
+        name = "test-golden-example-structuredAttrsByDefault";
+        nativeBuildInputs = [ earlyPkgs.jq ];
+
+        EXAMPLE_BOOL_TRUE = true;
+        EXAMPLE_BOOL_FALSE = false;
+        EXAMPLE_INT = 123;
+        EXAMPLE_INT_NEG = -123;
+        EXAMPLE_STR = "foo bar";
+        EXAMPLE_LIST = [ "foo" "bar" ];
+        EXAMPLE_NESTED_LIST = [ [ "foo" "bar" ] [ "baz" ] ];
+        EXAMPLE_ATTRS = { foo = "bar"; };
+        EXAMPLE_NESTED_ATTRS = { foo.bar = "baz"; };
+
+        inherit goldenSh;
+        inherit goldenJson;
+
+        buildCommand = ''
+          mkdir -p $out
+          cat $NIX_ATTRS_SH_FILE | grep "EXAMPLE" | grep -v -E 'installPhase|jq' > $out/sh
+          jq 'with_entries(select(.key|match("EXAMPLE")))' $NIX_ATTRS_JSON_FILE > $out/json
+          diff $out/sh $goldenSh
+          diff $out/json $goldenJson
+        '';
+      };
+
   };
 }

From 9cb5662187377146daf2b2abd54f4bce9ab59343 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Sun, 11 Dec 2022 13:31:50 +0200
Subject: [PATCH 072/231] tests: move stdenv hook tests to stdenv.hooks

---
 pkgs/test/hooks/default.nix  | 24 ++----------------------
 pkgs/test/stdenv/default.nix |  6 ++++++
 pkgs/test/stdenv/hooks.nix   | 35 +++++++++++++++++++++++++++++++++++
 3 files changed, 43 insertions(+), 22 deletions(-)
 create mode 100644 pkgs/test/stdenv/hooks.nix

diff --git a/pkgs/test/hooks/default.nix b/pkgs/test/hooks/default.nix
index fe3a9b2a2167..aabf939b6865 100644
--- a/pkgs/test/hooks/default.nix
+++ b/pkgs/test/hooks/default.nix
@@ -1,28 +1,8 @@
 # To run these tests:
 # nix-build -A tests.hooks
 
-{ stdenv, pkgs, lib }:
+{ stdenv, tests, lib }:
 
 {
-  # this attrset is for hooks in `stdenv.defaultNativeBuildInputs`
-  default-stdenv-hooks = lib.recurseIntoAttrs {
-    make-symlinks-relative = stdenv.mkDerivation {
-      name = "test-make-symlinks-relative";
-      passAsFile = [ "buildCommand" ];
-      buildCommand = ''
-        mkdir -p $out/{bar,baz}
-        source1="$out/bar/foo"
-        destination1="$out/baz/foo"
-        echo foo > $source1
-        ln -s $source1 $destination1
-        echo "symlink before patching: $(readlink $destination1)"
-
-        _makeSymlinksRelative
-
-        echo "symlink after patching: $(readlink $destination1)"
-        ([[ -e $destination1 ]] && echo "symlink isn't broken") || (echo "symlink is broken" && exit 1)
-        ([[ $(readlink $destination1) == "../bar/foo" ]] && echo "absolute symlink was made relative") || (echo "symlink was not made relative" && exit 1)
-      '';
-    };
-  };
+  default-stdenv-hooks = lib.recurseIntoAttrs tests.stdenv.hooks;
 }
diff --git a/pkgs/test/stdenv/default.nix b/pkgs/test/stdenv/default.nix
index 0a29f91ce049..c9653b324eb9 100644
--- a/pkgs/test/stdenv/default.nix
+++ b/pkgs/test/stdenv/default.nix
@@ -95,6 +95,9 @@ let
 in
 
 {
+  # tests for hooks in `stdenv.defaultNativeBuildInputs`
+  hooks = lib.recurseIntoAttrs (import ./hooks.nix { stdenv = bootStdenv; });
+
   test-env-attrset = testEnvAttrset { name = "test-env-attrset"; stdenv' = bootStdenv; };
 
   test-prepend-append-to-var = testPrependAndAppendToVar {
@@ -114,6 +117,9 @@ in
   };
 
   structuredAttrsByDefault = lib.recurseIntoAttrs {
+
+    hooks = lib.recurseIntoAttrs (import ./hooks.nix { stdenv = bootStdenvStructuredAttrsByDefault; });
+
     test-cc-wrapper-substitutions = ccWrapperSubstitutionsTest {
       name = "test-cc-wrapper-substitutions-structuredAttrsByDefault";
       stdenv' = bootStdenvStructuredAttrsByDefault;
diff --git a/pkgs/test/stdenv/hooks.nix b/pkgs/test/stdenv/hooks.nix
new file mode 100644
index 000000000000..f63ca054e083
--- /dev/null
+++ b/pkgs/test/stdenv/hooks.nix
@@ -0,0 +1,35 @@
+{ stdenv }:
+
+# ordering should match defaultNativeBuildInputs
+
+{
+  move-docs = stdenv.mkDerivation {
+    name = "test-move-docs";
+    buildCommand = ''
+      mkdir -p $out/{man,doc,info}
+      touch $out/{man,doc,info}/foo
+      cat $out/{man,doc,info}/foo
+
+      _moveToShare
+
+      (cat $out/share/{man,doc,info}/foo 2>/dev/null && echo "man,doc,info were moved") || (echo "man,doc,info were not moved" && exit 1)
+    '';
+  };
+  make-symlinks-relative = stdenv.mkDerivation {
+    name = "test-make-symlinks-relative";
+    buildCommand = ''
+      mkdir -p $out/{bar,baz}
+      source1="$out/bar/foo"
+      destination1="$out/baz/foo"
+      echo foo > $source1
+      ln -s $source1 $destination1
+      echo "symlink before patching: $(readlink $destination1)"
+
+      _makeSymlinksRelative
+
+      echo "symlink after patching: $(readlink $destination1)"
+      ([[ -e $destination1 ]] && echo "symlink isn't broken") || (echo "symlink is broken" && exit 1)
+      ([[ $(readlink $destination1) == "../bar/foo" ]] && echo "absolute symlink was made relative") || (echo "symlink was not made relative" && exit 1)
+    '';
+  };
+}

From daab80e08d43830c17b693f1b09eef1e2b59994c Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Sun, 11 Dec 2022 14:13:38 +0200
Subject: [PATCH 073/231] move-docs.sh: update comment

_multioutDocs is in multiple-outputs.sh
---
 pkgs/build-support/setup-hooks/move-docs.sh | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/move-docs.sh b/pkgs/build-support/setup-hooks/move-docs.sh
index 833113aa0fc8..3f961155d201 100644
--- a/pkgs/build-support/setup-hooks/move-docs.sh
+++ b/pkgs/build-support/setup-hooks/move-docs.sh
@@ -1,6 +1,4 @@
-# This setup hook moves $out/{man,doc,info} to $out/share; moves
-# $out/share/man to $man/share/man; and moves $out/share/doc to
-# $man/share/doc.
+# This setup hook moves $out/{man,doc,info} to $out/share.
 
 preFixupHooks+=(_moveToShare)
 

From 60b1f09aa4e5e0a5c7fe95e72c323ba1a2471e08 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Sun, 11 Dec 2022 14:44:10 +0200
Subject: [PATCH 074/231] tests.stdenv.hooks: add more tests

---
 pkgs/test/stdenv/default.nix |  4 +-
 pkgs/test/stdenv/hooks.nix   | 97 +++++++++++++++++++++++++++++++++++-
 2 files changed, 98 insertions(+), 3 deletions(-)

diff --git a/pkgs/test/stdenv/default.nix b/pkgs/test/stdenv/default.nix
index c9653b324eb9..b27fc25356a5 100644
--- a/pkgs/test/stdenv/default.nix
+++ b/pkgs/test/stdenv/default.nix
@@ -96,7 +96,7 @@ in
 
 {
   # tests for hooks in `stdenv.defaultNativeBuildInputs`
-  hooks = lib.recurseIntoAttrs (import ./hooks.nix { stdenv = bootStdenv; });
+  hooks = lib.recurseIntoAttrs (import ./hooks.nix { stdenv = bootStdenv; pkgs = earlyPkgs; });
 
   test-env-attrset = testEnvAttrset { name = "test-env-attrset"; stdenv' = bootStdenv; };
 
@@ -118,7 +118,7 @@ in
 
   structuredAttrsByDefault = lib.recurseIntoAttrs {
 
-    hooks = lib.recurseIntoAttrs (import ./hooks.nix { stdenv = bootStdenvStructuredAttrsByDefault; });
+    hooks = lib.recurseIntoAttrs (import ./hooks.nix { stdenv = bootStdenvStructuredAttrsByDefault; pkgs = earlyPkgs; });
 
     test-cc-wrapper-substitutions = ccWrapperSubstitutionsTest {
       name = "test-cc-wrapper-substitutions-structuredAttrsByDefault";
diff --git a/pkgs/test/stdenv/hooks.nix b/pkgs/test/stdenv/hooks.nix
index f63ca054e083..de6b294fc847 100644
--- a/pkgs/test/stdenv/hooks.nix
+++ b/pkgs/test/stdenv/hooks.nix
@@ -1,4 +1,4 @@
-{ stdenv }:
+{ stdenv, pkgs }:
 
 # ordering should match defaultNativeBuildInputs
 
@@ -32,4 +32,99 @@
       ([[ $(readlink $destination1) == "../bar/foo" ]] && echo "absolute symlink was made relative") || (echo "symlink was not made relative" && exit 1)
     '';
   };
+  compress-man-pages =
+    let
+      manFile = pkgs.writeText "small-man" ''
+        .TH HELLO "1" "May 2022" "hello 2.12.1" "User Commands"
+        .SH NAME
+        hello - friendly greeting program
+      '';
+    in
+    stdenv.mkDerivation {
+      name = "test-compress-man-pages";
+      buildCommand = ''
+        mkdir -p $out/share/man
+        cp ${manFile} $out/share/man/small-man.1
+        compressManPages $out
+        [[ -e $out/share/man/small-man.1.gz ]]
+      '';
+    };
+
+  # TODO: add strip
+  # TODO: move patch-shebangs test from pkgs/test/patch-shebangs/default.nix to here
+  prune-libtool-files =
+    let
+      libFoo = pkgs.writeText "libFoo" ''
+        # Generated by libtool (GNU libtool) 2.4.6
+        old_library='''
+        dependency_libs=' -Lbar.la -Lbaz.la'
+      '';
+    in
+    stdenv.mkDerivation {
+      name = "test-prune-libtool-files";
+      buildCommand = ''
+        mkdir -p $out/lib
+        cp ${libFoo} $out/lib/libFoo.la
+        _pruneLibtoolFiles
+        grep "^dependency_libs=''' #pruned" $out/lib/libFoo.la
+        # confirm file doesn't only contain the above
+        grep "^old_library='''" $out/lib/libFoo.la
+      '';
+    };
+  # TODO: add audit-tmpdir
+  # TODO: add multiple-outputs
+  move-sbin = stdenv.mkDerivation {
+    name = "test-move-sbin";
+    buildCommand = ''
+      mkdir -p $out/sbin
+      touch $out/sbin/foo
+      cat $out/sbin/foo
+
+      _moveSbin
+
+      # check symlink
+      [[ -h $out/sbin ]]
+      ([[ -e $out/sbin ]] && echo "symlink isn't broken") || (echo "symlink is broken" && exit 1)
+      [[ -e $out/bin/foo ]]
+    '';
+  };
+
+  move-lib64 = stdenv.mkDerivation {
+    name = "test-move-lib64";
+    buildCommand = ''
+      mkdir -p $out/lib64
+      touch $out/lib64/foo
+      cat $out/lib64/foo
+
+      _moveLib64
+
+      # check symlink
+      [[ -h $out/lib64 ]]
+      ([[ -e $out/lib64 ]] && echo "symlink isn't broken") || (echo "symlink is broken" && exit 1)
+      [[ -e $out/lib/foo ]]
+    '';
+  };
+
+  set-source-date-epoch-to-latest = stdenv.mkDerivation {
+    name = "test-set-source-date-epoch-to-latest";
+    buildCommand = ''
+      sourceRoot=$NIX_BUILD_TOP/source
+      mkdir -p $sourceRoot
+      touch --date=1/1/2015 $sourceRoot/foo
+
+      _updateSourceDateEpochFromSourceRoot
+
+      [[ $SOURCE_DATE_EPOCH == "1420070400" ]]
+      touch $out
+    '';
+  };
+
+  reproducible-builds = stdenv.mkDerivation {
+    name = "test-reproducible-builds";
+    buildCommand = ''
+      # can't be tested more precisely because the value of random-seed changes depending on the output
+      [[ $NIX_CFLAGS_COMPILE =~ "-frandom-seed=" ]]
+      touch $out
+    '';
+  };
 }

From 04701ab5f5c0e7320361c97061f1014027cd6582 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 12 Dec 2022 22:10:43 +0100
Subject: [PATCH 075/231] python310Packages.h2: disable timing sensitive test

---
 pkgs/development/python-modules/h2/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/h2/default.nix b/pkgs/development/python-modules/h2/default.nix
index 97ccb7b91206..cb03a837194e 100644
--- a/pkgs/development/python-modules/h2/default.nix
+++ b/pkgs/development/python-modules/h2/default.nix
@@ -30,6 +30,11 @@ buildPythonPackage rec {
     hypothesis
   ];
 
+  disabledTests = [
+    # timing sensitive
+    "test_changing_max_frame_size"
+  ];
+
   pythonImportsCheck = [
     "h2.connection"
     "h2.config"

From af70ba03d30779f965bd2c776e2dced6a82c9430 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Tue, 13 Dec 2022 00:24:33 +0200
Subject: [PATCH 076/231] build-support/setup-hooks: change shebang to
 shellcheck directive

---
 pkgs/build-support/setup-hooks/auto-patchelf.sh            | 2 +-
 pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh | 2 +-
 pkgs/build-support/setup-hooks/move-systemd-user-units.sh  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.sh b/pkgs/build-support/setup-hooks/auto-patchelf.sh
index 8a74a69bdceb..55467b9ec7b8 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+# shellcheck shell=bash
 
 declare -a autoPatchelfLibs
 declare -a extraAutoPatchelfLibs
diff --git a/pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh b/pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh
index 74c8f6d0b333..83ea7de3ee21 100644
--- a/pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh
+++ b/pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+# shellcheck shell=bash
 fixupOutputHooks+=('convertDesktopFiles $prefix')
 
 # Get a param out of a desktop file. First parameter is the file and the second
diff --git a/pkgs/build-support/setup-hooks/move-systemd-user-units.sh b/pkgs/build-support/setup-hooks/move-systemd-user-units.sh
index 5963d87c7515..33e89898262f 100755
--- a/pkgs/build-support/setup-hooks/move-systemd-user-units.sh
+++ b/pkgs/build-support/setup-hooks/move-systemd-user-units.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+# shellcheck shell=bash
 
 # This setup hook, for each output, moves everything in
 # $output/lib/systemd/user to $output/share/systemd/user, and replaces

From 7866db71cc4e6c31b3ba1b6dae3bb9394128ad74 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Tue, 13 Dec 2022 00:34:48 +0200
Subject: [PATCH 077/231] stdenv/generic: fix todo

---
 pkgs/stdenv/generic/default.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index 81255726284b..a2f052113ae6 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -76,9 +76,7 @@ let
       ../../build-support/setup-hooks/move-lib64.sh
       ../../build-support/setup-hooks/set-source-date-epoch-to-latest.sh
       ../../build-support/setup-hooks/reproducible-builds.sh
-      # TODO use lib.optional instead
-      (if hasCC then cc else null)
-    ];
+    ] ++ lib.optionals hasCC [ cc ];
 
   defaultBuildInputs = extraBuildInputs;
 

From 3b3ef7b7666e8881478582443847322b6c2354c1 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Tue, 13 Dec 2022 00:57:35 +0200
Subject: [PATCH 078/231] audit-tmpdir.sh: fix on darwin

compress-man-pages.sh uses `find ... | while ...; do...` so this works
on darwin

vcunat says the following in https://github.com/NixOS/nixpkgs/commit/94d164dd7#r22030369

> Unfortunately, process substitution doesn't work during early darwin bootstrap. http://hydra.nixos.org/build/52433342 We've run into that before.
> I think it should work to have `find ... | while ...; do...`
---
 pkgs/build-support/setup-hooks/audit-tmpdir.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/audit-tmpdir.sh b/pkgs/build-support/setup-hooks/audit-tmpdir.sh
index c9dd32d1dd22..9c03bc2ee935 100644
--- a/pkgs/build-support/setup-hooks/audit-tmpdir.sh
+++ b/pkgs/build-support/setup-hooks/audit-tmpdir.sh
@@ -16,7 +16,7 @@ auditTmpdir() {
     header "checking for references to $TMPDIR/ in $dir..."
 
     local i
-    while IFS= read -r -d $'\0' i; do
+    find "$dir" -type f -print0 | while IFS= read -r -d $'\0' i; do
         if [[ "$i" =~ .build-id ]]; then continue; fi
 
         if isELF "$i"; then
@@ -35,7 +35,7 @@ auditTmpdir() {
             fi
         fi
 
-    done < <(find "$dir" -type f -print0)
+    done
 
     stopNest
 }

From b3717f6c143be42b3abb8f18302901df5372fbe9 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Tue, 13 Dec 2022 01:04:29 +0200
Subject: [PATCH 079/231] stdenv: remove now unneeded linux conditional

---
 pkgs/stdenv/generic/default.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index a2f052113ae6..efbfc95ff1c5 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -63,14 +63,8 @@ let
       ../../build-support/setup-hooks/strip.sh
       ../../build-support/setup-hooks/patch-shebangs.sh
       ../../build-support/setup-hooks/prune-libtool-files.sh
-    ]
-      # FIXME this on Darwin; see
-      # https://github.com/NixOS/nixpkgs/commit/94d164dd7#commitcomment-22030369
-    ++ lib.optionals hostPlatform.isLinux [
       ../../build-support/setup-hooks/audit-tmpdir.sh
       ../../build-support/setup-hooks/move-systemd-user-units.sh
-    ]
-    ++ [
       ../../build-support/setup-hooks/multiple-outputs.sh
       ../../build-support/setup-hooks/move-sbin.sh
       ../../build-support/setup-hooks/move-lib64.sh

From 29c4626da89036f157ea7784fdcc38b5f79929d8 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 12 Dec 2022 22:09:40 +0000
Subject: [PATCH 080/231] linuxHeaders: 6.0 -> 6.1

---
 pkgs/os-specific/linux/kernel-headers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index d8bfb59bf12a..34fbde9d676a 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -114,12 +114,12 @@ let
 in {
   inherit makeLinuxHeaders;
 
-  linuxHeaders = let version = "6.0"; in
+  linuxHeaders = let version = "6.1"; in
     makeLinuxHeaders {
       inherit version;
       src = fetchurl {
         url = "mirror://kernel/linux/kernel/v${lib.versions.major version}.x/linux-${version}.tar.xz";
-        sha256 = "sha256-XCRDpVON5SaI77VcJ6sFOcH161jAz9FqK5+7CP2BeI4=";
+        sha256 = "sha256-LKHxcFGkMPb+0RluSVJxdQcXGs/ZfZZXchJQJwOyXes=";
       };
       patches = [
          ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms

From 630bb71ac5216135f4f576f03be465ccdc16d46a Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Tue, 13 Dec 2022 01:10:52 +0200
Subject: [PATCH 081/231] stdenv: sort defaultNativeBuildInputs alphabetically

---
 pkgs/stdenv/generic/default.nix |  19 ++---
 pkgs/test/stdenv/hooks.nix      | 136 ++++++++++++++++----------------
 2 files changed, 76 insertions(+), 79 deletions(-)

diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index efbfc95ff1c5..cf194be92bd7 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -57,19 +57,20 @@ argsStdenv@{ name ? "stdenv", preHook ? "", initialPath
 
 let
   defaultNativeBuildInputs = extraNativeBuildInputs ++
-    [ ../../build-support/setup-hooks/move-docs.sh
-      ../../build-support/setup-hooks/make-symlinks-relative.sh
-      ../../build-support/setup-hooks/compress-man-pages.sh
-      ../../build-support/setup-hooks/strip.sh
-      ../../build-support/setup-hooks/patch-shebangs.sh
-      ../../build-support/setup-hooks/prune-libtool-files.sh
+    [
       ../../build-support/setup-hooks/audit-tmpdir.sh
+      ../../build-support/setup-hooks/compress-man-pages.sh
+      ../../build-support/setup-hooks/make-symlinks-relative.sh
+      ../../build-support/setup-hooks/move-docs.sh
+      ../../build-support/setup-hooks/move-lib64.sh
+      ../../build-support/setup-hooks/move-sbin.sh
       ../../build-support/setup-hooks/move-systemd-user-units.sh
       ../../build-support/setup-hooks/multiple-outputs.sh
-      ../../build-support/setup-hooks/move-sbin.sh
-      ../../build-support/setup-hooks/move-lib64.sh
-      ../../build-support/setup-hooks/set-source-date-epoch-to-latest.sh
+      ../../build-support/setup-hooks/patch-shebangs.sh
+      ../../build-support/setup-hooks/prune-libtool-files.sh
       ../../build-support/setup-hooks/reproducible-builds.sh
+      ../../build-support/setup-hooks/set-source-date-epoch-to-latest.sh
+      ../../build-support/setup-hooks/strip.sh
     ] ++ lib.optionals hasCC [ cc ];
 
   defaultBuildInputs = extraBuildInputs;
diff --git a/pkgs/test/stdenv/hooks.nix b/pkgs/test/stdenv/hooks.nix
index de6b294fc847..7f25d7dbd2db 100644
--- a/pkgs/test/stdenv/hooks.nix
+++ b/pkgs/test/stdenv/hooks.nix
@@ -3,35 +3,7 @@
 # ordering should match defaultNativeBuildInputs
 
 {
-  move-docs = stdenv.mkDerivation {
-    name = "test-move-docs";
-    buildCommand = ''
-      mkdir -p $out/{man,doc,info}
-      touch $out/{man,doc,info}/foo
-      cat $out/{man,doc,info}/foo
-
-      _moveToShare
-
-      (cat $out/share/{man,doc,info}/foo 2>/dev/null && echo "man,doc,info were moved") || (echo "man,doc,info were not moved" && exit 1)
-    '';
-  };
-  make-symlinks-relative = stdenv.mkDerivation {
-    name = "test-make-symlinks-relative";
-    buildCommand = ''
-      mkdir -p $out/{bar,baz}
-      source1="$out/bar/foo"
-      destination1="$out/baz/foo"
-      echo foo > $source1
-      ln -s $source1 $destination1
-      echo "symlink before patching: $(readlink $destination1)"
-
-      _makeSymlinksRelative
-
-      echo "symlink after patching: $(readlink $destination1)"
-      ([[ -e $destination1 ]] && echo "symlink isn't broken") || (echo "symlink is broken" && exit 1)
-      ([[ $(readlink $destination1) == "../bar/foo" ]] && echo "absolute symlink was made relative") || (echo "symlink was not made relative" && exit 1)
-    '';
-  };
+  # TODO: add audit-tmpdir
   compress-man-pages =
     let
       manFile = pkgs.writeText "small-man" ''
@@ -49,8 +21,66 @@
         [[ -e $out/share/man/small-man.1.gz ]]
       '';
     };
+  make-symlinks-relative = stdenv.mkDerivation {
+    name = "test-make-symlinks-relative";
+    buildCommand = ''
+      mkdir -p $out/{bar,baz}
+      source1="$out/bar/foo"
+      destination1="$out/baz/foo"
+      echo foo > $source1
+      ln -s $source1 $destination1
+      echo "symlink before patching: $(readlink $destination1)"
 
-  # TODO: add strip
+      _makeSymlinksRelative
+
+      echo "symlink after patching: $(readlink $destination1)"
+      ([[ -e $destination1 ]] && echo "symlink isn't broken") || (echo "symlink is broken" && exit 1)
+      ([[ $(readlink $destination1) == "../bar/foo" ]] && echo "absolute symlink was made relative") || (echo "symlink was not made relative" && exit 1)
+    '';
+  };
+  move-docs = stdenv.mkDerivation {
+    name = "test-move-docs";
+    buildCommand = ''
+      mkdir -p $out/{man,doc,info}
+      touch $out/{man,doc,info}/foo
+      cat $out/{man,doc,info}/foo
+
+      _moveToShare
+
+      (cat $out/share/{man,doc,info}/foo 2>/dev/null && echo "man,doc,info were moved") || (echo "man,doc,info were not moved" && exit 1)
+    '';
+  };
+  move-lib64 = stdenv.mkDerivation {
+    name = "test-move-lib64";
+    buildCommand = ''
+      mkdir -p $out/lib64
+      touch $out/lib64/foo
+      cat $out/lib64/foo
+
+      _moveLib64
+
+      # check symlink
+      [[ -h $out/lib64 ]]
+      ([[ -e $out/lib64 ]] && echo "symlink isn't broken") || (echo "symlink is broken" && exit 1)
+      [[ -e $out/lib/foo ]]
+    '';
+  };
+  move-sbin = stdenv.mkDerivation {
+    name = "test-move-sbin";
+    buildCommand = ''
+      mkdir -p $out/sbin
+      touch $out/sbin/foo
+      cat $out/sbin/foo
+
+      _moveSbin
+
+      # check symlink
+      [[ -h $out/sbin ]]
+      ([[ -e $out/sbin ]] && echo "symlink isn't broken") || (echo "symlink is broken" && exit 1)
+      [[ -e $out/bin/foo ]]
+    '';
+  };
+  # TODO: add multiple-outputs
   # TODO: move patch-shebangs test from pkgs/test/patch-shebangs/default.nix to here
   prune-libtool-files =
     let
@@ -71,40 +101,14 @@
         grep "^old_library='''" $out/lib/libFoo.la
       '';
     };
-  # TODO: add audit-tmpdir
-  # TODO: add multiple-outputs
-  move-sbin = stdenv.mkDerivation {
-    name = "test-move-sbin";
+  reproducible-builds = stdenv.mkDerivation {
+    name = "test-reproducible-builds";
     buildCommand = ''
-      mkdir -p $out/sbin
-      touch $out/sbin/foo
-      cat $out/sbin/foo
-
-      _moveSbin
-
-      # check symlink
-      [[ -h $out/sbin ]]
-      ([[ -e $out/sbin ]] && echo "symlink isn't broken") || (echo "symlink is broken" && exit 1)
-      [[ -e $out/bin/foo ]]
+      # can't be tested more precisely because the value of random-seed changes depending on the output
+      [[ $NIX_CFLAGS_COMPILE =~ "-frandom-seed=" ]]
+      touch $out
     '';
   };
-
-  move-lib64 = stdenv.mkDerivation {
-    name = "test-move-lib64";
-    buildCommand = ''
-      mkdir -p $out/lib64
-      touch $out/lib64/foo
-      cat $out/lib64/foo
-
-      _moveLib64
-
-      # check symlink
-      [[ -h $out/lib64 ]]
-      ([[ -e $out/lib64 ]] && echo "symlink isn't broken") || (echo "symlink is broken" && exit 1)
-      [[ -e $out/lib/foo ]]
-    '';
-  };
-
   set-source-date-epoch-to-latest = stdenv.mkDerivation {
     name = "test-set-source-date-epoch-to-latest";
     buildCommand = ''
@@ -118,13 +122,5 @@
       touch $out
     '';
   };
-
-  reproducible-builds = stdenv.mkDerivation {
-    name = "test-reproducible-builds";
-    buildCommand = ''
-      # can't be tested more precisely because the value of random-seed changes depending on the output
-      [[ $NIX_CFLAGS_COMPILE =~ "-frandom-seed=" ]]
-      touch $out
-    '';
-  };
+  # TODO: add strip
 }

From 64b335ce75a0115920adb033d7d2d90288fc2294 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Thu, 8 Dec 2022 18:53:39 +0000
Subject: [PATCH 082/231] openjdk8: 322-ga -> 352-ga

---
 pkgs/development/compilers/openjdk/8.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/8.nix b/pkgs/development/compilers/openjdk/8.nix
index 5558a77ad90b..c65a9fcc66b6 100644
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@@ -20,7 +20,7 @@ let
     powerpc64le-linux = "ppc64le";
   }.${stdenv.system} or (throw "Unsupported platform ${stdenv.system}");
 
-  update = "322";
+  update = "352";
   build = "ga";
 
   openjdk8 = stdenv.mkDerivation rec {
@@ -31,7 +31,7 @@ let
       owner = "openjdk";
       repo = "jdk8u";
       rev = "jdk${version}";
-      sha256 = "sha256-e39Yv+NDQG7z6fGmpKEnkKd5MoHZ50SXlq/Q7lzWcDA=";
+      sha256 = "sha256-xDiiALDjStD9IPhbBr997rm/v2Q/WdS10cILBCmdJIQ=";
     };
     outputs = [ "out" "jre" ];
 

From 951304c4598f293b1028c76f2d30d66d1a595246 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Thu, 8 Dec 2022 18:53:53 +0000
Subject: [PATCH 083/231] openjdk11: 11.0.15+10 -> 11.0.17+8

---
 pkgs/development/compilers/openjdk/11.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/11.nix b/pkgs/development/compilers/openjdk/11.nix
index 850902cfd804..72b25bff777b 100644
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@@ -11,8 +11,8 @@
 let
   major = "11";
   minor = "0";
-  update = "15";
-  build = "10";
+  update = "17";
+  build = "8";
 
   openjdk = stdenv.mkDerivation rec {
     pname = "openjdk" + lib.optionalString headless "-headless";
@@ -22,7 +22,7 @@ let
       owner = "openjdk";
       repo = "jdk${major}u";
       rev = "jdk-${version}";
-      sha256 = "le2JDxPJPSuga4JxLJNRZwCaodptSb2kh4TsJXumTXs=";
+      sha256 = "sha256-kvgLYqQZPqyuigVyzbDHc3TMff0clvzM8IdzYLYcxPU=";
     };
 
     nativeBuildInputs = [ pkg-config autoconf unzip ];

From 9e5e9c57bb8958004134806eef8e31aed9375ea6 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Thu, 8 Dec 2022 19:35:02 +0000
Subject: [PATCH 084/231] openjfx11: 11.0.11+1 -> 11.0.17+1

---
 .../compilers/openjdk/openjfx/11.nix          | 29 ++++++++-----------
 1 file changed, 12 insertions(+), 17 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/openjfx/11.nix b/pkgs/development/compilers/openjdk/openjfx/11.nix
index 1bbb4e42dbc5..164677c3b8dc 100644
--- a/pkgs/development/compilers/openjdk/openjfx/11.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/11.nix
@@ -1,13 +1,13 @@
-{ stdenv, lib, fetchurl, writeText, gradle_4, pkg-config, perl, cmake
-, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg_4-headless, python3, ruby
+{ stdenv, lib, fetchFromGitHub, writeText, gradle_7, pkg-config, perl, cmake
+, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg_4-headless, python3, ruby, icu68
 , openjdk11-bootstrap }:
 
 let
   major = "11";
-  update = ".0.11";
+  update = ".0.17";
   build = "1";
   repover = "${major}${update}+${build}";
-  gradle_ = (gradle_4.override {
+  gradle_ = (gradle_7.override {
     java = openjdk11-bootstrap;
   });
 
@@ -24,12 +24,14 @@ let
   makePackage = args: stdenv.mkDerivation ({
     version = "${major}${update}-${build}";
 
-    src = fetchurl {
-      url = "https://hg.openjdk.java.net/openjfx/${major}-dev/rt/archive/${repover}.tar.gz";
-      sha256 = "sha256-mbEALUxuwbtlGeZ2Xsm3m3aNDdthLYWd6QHmdkAILxc=";
+    src = fetchFromGitHub {
+      owner = "openjdk";
+      repo = "jfx${major}u";
+      rev = repover;
+      sha256 = "sha256-uKb6k+tIFdwy1BYiHWeGmKNz82X4CZjFlGYqLDpSFY0=";
     };
 
-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless ];
+    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless icu68 ];
     nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];
 
     dontUseCmakeConfigure = true;
@@ -44,8 +46,6 @@ let
       JDK_HOME = ${openjdk11-bootstrap.home}
     '' + args.gradleProperties or "");
 
-    inherit NIX_CFLAGS_COMPILE;
-
     buildPhase = ''
       runHook preBuild
 
@@ -74,10 +74,7 @@ let
 
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    # Downloaded AWT jars differ by platform.
-    outputHash = {
-      x86_64-linux = "sha256-syceJMUEknBDCHK8eGs6rUU3IQn+HnQfURfCrDxYPa8=";
-    }.${stdenv.system} or (throw "Unsupported platform");
+    outputHash = "sha256-syceJMUEknBDCHK8eGs6rUU3IQn+HnQfURfCrDxYPa9=";
   };
 
 in makePackage {
@@ -85,7 +82,7 @@ in makePackage {
 
   gradleProperties = ''
     COMPILE_MEDIA = true
-    COMPILE_WEBKIT = true
+    COMPILE_WEBKIT = false
   '';
 
   preBuild = ''
@@ -99,8 +96,6 @@ in makePackage {
     cp -r build/modular-sdk $out
   '';
 
-  inherit NIX_CFLAGS_COMPILE;
-
   stripDebugList = [ "." ];
 
   postFixup = ''

From e1451322584ed86b40165a96ed2c14f6b0342491 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Thu, 8 Dec 2022 19:39:53 +0000
Subject: [PATCH 085/231] openjfx15: mark it as EOL

---
 pkgs/development/compilers/openjdk/openjfx/15.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/compilers/openjdk/openjfx/15.nix b/pkgs/development/compilers/openjdk/openjfx/15.nix
index d2903c685a90..8c041988296f 100644
--- a/pkgs/development/compilers/openjdk/openjfx/15.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/15.nix
@@ -120,6 +120,9 @@ in makePackage {
     license = licenses.gpl2;
     description = "The next-generation Java client toolkit";
     maintainers = with maintainers; [ abbradar ];
+    knownVulnerabilities = [
+      "This OpenJFX version has reached its end of life."
+    ];
     platforms = [ "x86_64-linux" ];
   };
 }

From f2cd590cfbeea458910dfc238aa9b28dca538b84 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Thu, 8 Dec 2022 19:47:22 +0000
Subject: [PATCH 086/231] openjfx17: 17.0.0.1+1 -> 17.0.5+1

---
 pkgs/development/compilers/openjdk/openjfx/17.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/openjfx/17.nix b/pkgs/development/compilers/openjdk/openjfx/17.nix
index 1c1fb89ce8e1..8d4d47df32e7 100644
--- a/pkgs/development/compilers/openjdk/openjfx/17.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/17.nix
@@ -4,7 +4,7 @@
 
 let
   major = "17";
-  update = ".0.0.1";
+  update = ".0.5";
   build = "+1";
   repover = "${major}${update}${build}";
   gradle_ = (gradle_7.override {
@@ -16,9 +16,9 @@ let
 
     src = fetchFromGitHub {
       owner = "openjdk";
-      repo = "jfx";
+      repo = "jfx${major}u";
       rev = repover;
-      sha256 = "sha256-PSiE9KbF/4u9VyBl9PAMLGzKyGFB86/XByeh7vhL6Kw=";
+      sha256 = "sha256-jzLOlWuhkUS0/4+nXtjd1/IYbAHHnJrusFRTh7aPt8U=";
     };
 
     buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless icu68 ];

From 2ee1577a1a91b6ba1577ef70ed31670a1e1836ca Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Sat, 10 Dec 2022 13:45:22 +0000
Subject: [PATCH 087/231] openjfx15: gradle_5 -> gradle_6

---
 pkgs/development/compilers/openjdk/openjfx/15.nix | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/openjfx/15.nix b/pkgs/development/compilers/openjdk/openjfx/15.nix
index 8c041988296f..788baabde848 100644
--- a/pkgs/development/compilers/openjdk/openjfx/15.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/15.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, writeText, openjdk11_headless, gradle_5
+{ stdenv, lib, fetchFromGitHub, writeText, openjdk11_headless, gradle_6
 , pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib
 , ffmpeg_4-headless, python3, ruby }:
 
@@ -7,7 +7,7 @@ let
   update = ".0.1";
   build = "+1";
   repover = "${major}${update}${build}";
-  gradle_ = (gradle_5.override {
+  gradle_ = (gradle_6.override {
     java = openjdk11_headless;
   });
 
@@ -69,10 +69,7 @@ let
 
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    # Downloaded AWT jars differ by platform.
-    outputHash = {
-      x86_64-linux = "0hmyr5nnjgwyw3fcwqf0crqg9lny27jfirycg3xmkzbcrwqd6qkw";
-    }.${stdenv.system} or (throw "Unsupported platform");
+    outputHash = "sha256-fGLTMM9s/Vn7eMzn6OQR3tL0cGbAYc7c4J4/aW3JvkI=";
   };
 
 in makePackage {
@@ -80,7 +77,7 @@ in makePackage {
 
   gradleProperties = ''
     COMPILE_MEDIA = true
-    COMPILE_WEBKIT = true
+    COMPILE_WEBKIT = false
   '';
 
   preBuild = ''

From fa8c56b8c747493f18b70ba6436e162e32b311c7 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Tue, 13 Dec 2022 17:33:47 +0100
Subject: [PATCH 088/231] openssl_3: patch CVE-2022-3996

https://www.openssl.org/news/secadv/20221213.txt
---
 .../libraries/openssl/3.0/CVE-2022-3996.patch | 36 +++++++++++++++++++
 .../development/libraries/openssl/default.nix |  3 ++
 2 files changed, 39 insertions(+)
 create mode 100644 pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch

diff --git a/pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch b/pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch
new file mode 100644
index 000000000000..2acedda0e3a4
--- /dev/null
+++ b/pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch
@@ -0,0 +1,36 @@
+From 7725e7bfe6f2ce8146b6552b44e0d226be7638e7 Mon Sep 17 00:00:00 2001
+From: Pauli <pauli@openssl.org>
+Date: Fri, 11 Nov 2022 09:40:19 +1100
+Subject: [PATCH] x509: fix double locking problem
+
+This reverts commit 9aa4be691f5c73eb3c68606d824c104550c053f7 and removed the
+redundant flag setting.
+
+Fixes #19643
+
+Fixes LOW CVE-2022-3996
+
+Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
+Reviewed-by: Tomas Mraz <tomas@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/19652)
+
+(cherry picked from commit 4d0340a6d2f327700a059f0b8f954d6160f8eef5)
+---
+ crypto/x509/pcy_map.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/crypto/x509/pcy_map.c b/crypto/x509/pcy_map.c
+index 05406c6493fc..60dfd1e3203b 100644
+--- a/crypto/x509/pcy_map.c
++++ b/crypto/x509/pcy_map.c
+@@ -73,10 +73,6 @@ int ossl_policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
+ 
+     ret = 1;
+  bad_mapping:
+-    if (ret == -1 && CRYPTO_THREAD_write_lock(x->lock)) {
+-        x->ex_flags |= EXFLAG_INVALID_POLICY;
+-        CRYPTO_THREAD_unlock(x->lock);
+-    }
+     sk_POLICY_MAPPING_pop_free(maps, POLICY_MAPPING_free);
+     return ret;
+ 
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 45a34971c8f0..4c322997963a 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -241,6 +241,9 @@ in {
       (if stdenv.hostPlatform.isDarwin
        then ./use-etc-ssl-certs-darwin.patch
        else ./use-etc-ssl-certs.patch)
+
+       # Remove with 3.0.8 release
+       ./3.0/CVE-2022-3996.patch
     ];
 
     withDocs = true;

From ed9e8cd687b08a4e8f3d673f25c12e345afd65cb Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Tue, 13 Dec 2022 17:21:24 +0000
Subject: [PATCH 089/231] systemd: 252.1 -> 252.3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes sd-boot on (some?) Intel Macbooks, as reported in
https://github.com/NixOS/nixpkgs/pull/201558#issuecomment-1348823127.

Full log:

```
13de548fca network: manage addresses in the way the kernel does
fcc174cbdd import: wire up SYSTEMD_IMPORT_BTRFS_{SUBVOL,QUOTA} to importd
6cb0724a06 machine-pool: simplify return values from setup_machine_directory()
1c9e7fc8f2 boot: Only do full driver initialization in VMs
79b97ec652 boot: improve support for qemu (helpers only)
87add68b39 boot: Make sure all partitions drivers are connected
989f0c52e1 boot: Use EFI_BOOT_MANAGER_POLICY_PROTOCOL to connect console devices
b89be71bf4 network: unset Link.ndisc_configured only when a new address or route is requested
fc4f804b07 network: fix indentation
fc60072926 dissect: rework DISSECT_IMAGE_ADD_PARTITION_DEVICES + DISSECT_IMAGE_OPEN_PARTITION_DEVICES
1267b35273 fuzz: shorten filename of testcase
7fc478f751 resolve: optimize conversion of TXT fields to json
772e89452e hexdecoct: fix NULL pointer dereferences in hexmem()
002fc46688 hexdecoct: add missing NULL check
be1088b7a0 test: add tests for base64_append()
acb0414a1f hexdecoct: several cleanups for base64_append()
9410eb20eb cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED
1c8abb343a man: mention that DefaultRouteOnDevice= create the IPv4 default route
6c869ad3bd selinux: accept the fact that getxyzcon() can return success and NULL
0fdeb7c640 oomd: print dry run output at INFO level
4119d25e62 journald: prevent segfault on empty attr/current
6fdf196f99 core: use correct scope of looking up units
6d7b0dacc6 test-network: add test for bond mac address config
6405eba4b6 network: Fix set bond device MAC address failed
dbc59253ec test-fs-util: Add relative path chase_symlinks() tests
6e99f9c8fb chase-symlink: when converting directory O_PATH fd to real fd, don't bother with /proc/
bc6fc812fd test: add basic tests for octescape()
2ea5de7881 escape: fix wrong octescape of bad character
8999727a82 network: drop REMOVING flag when a netlink message is sent to kernel
a064abff76 dissect: show color in log output
278a97708b log: Switch logging to runtime when FS becomes read-only
44984e15bb resolve: format zero-length RDATA according to rfc3597
d59009dc1d manager: do not append '\n' when writing sysctl settings
2a66b4c894 test: check if we can use SHA1 MD for signing before using it
d0b80bf81e dissect-image: log expected UUID for /var
b0b97848e8 bootspec: fix null-dereference-read
0ba8e9ecff virt: Support detection of LMHS SRE guests
787b2c32f3 terminal-util: Set OPOST when setting ONLCR
c7bf13b2d9 units: change Requires=systemd-networkd.service → BindsTo= one more time
e3d9376692 core/device: verify device syspath on switching root
9523f85b2e core/device: also serialize/deserialize device syspath
10b3ce781b core/device: update comment
2505010178 sd-netlink: fix segfault
4b885f3591 test: Add tests for systemd-cgtop args parsing
b97c1c427c cgtop: Do not rewrite -P or -k options
6cbf72a8d9 logind: Properly unescape names of lingering users
01a39e96b5 units: Use BindsTo=systemd-networkd in systemd-networkd-wait-online.service
b0c39ffc54 resolved: remove inappropriate assert()
e0521346ec stub: Detect empty LoadOptions when run from EFI shell
7ca40a8b08  stub: Fix cmdline handling
b39f2ab98f boot: Use xstr8_to_16 for path conversion
6387a74d2c boot: Use xstr8_to_16
ff7469af96 boot: Add xstrn8_to_16
475c130003 core: update audit messages
c74bc2cd49 dissect: fix fsck
ce55eb4ebd process-util: add new FORK_CLOEXEC_OFF flag for disabling O_CLOEXEC on remaining fds
36c3c4172d fd-util: add new fd_cloexec_many() helper
57b4329b38 fd-util: make fd_in_set() (and thus close_all_fds()) handle invalidated fds in the array
12c41564cd tmpfiles: log at info level when some allowed failures occur
77f524dda0 find-esp: include device sysname in the log message
8d23210a2e find-esp: downgrade and ignore error on retrieving PART_ENTRY_SCHEME when searching
eea92b179d sd-bus: Use goto finish instead of return in bus_add_match_full
0916514b8c strv: Make sure strv_make_nulstr() always returns a valid nulstr
2ddd7b5def bootctl: rework how we handle referenced but absent EFI boot entries
2daecc7179 bootctl: downgrade log message when firmware reports non-existent or invalid boot entry
9a7186e92a bootctl: make boot entry id logged in hex
62f58d94f8 dissect-image: do not try to close invalid fd
c1dd021d16 boot: Silence driver reconnect errors
a09a41c2f7 meson: install test-kernel-install only when -Dkernel-install=true
9b6f12262f udev: make sure auto-root logic also works in UKIs booted from XBOOTLDR
d5e3625a61 repart: respect --discard=no also for block devices
79f161ac65 portable: add a few more useful debug log messages
bcd42b3c88 oomd: fix unreachable test case in test-oomd-util
2bdf5b0382 oomd: always allow root-owned cgroups to set ManagedOOMPreference
da01d83ab4 network: wifi: try to reconfigure when connected
595dd9b2b9 resolved: Fix OpenSSL error messages
2ecb8fc841 basic/strv: check printf arguments to strv_extendf()
81e2c87a47 manager: fix format strings for trigger metadata
d337ac02d6 resolved: when configuring 127.0.0.1 as per-interface DNS server, contact it via "lo" always
813d52dbf8 resolved: use right conditionalization when setting unicast ifindex on UDP sockets
2b52748d45 nspawn: allow sched_rr_get_interval_time64 through seccomp filter
5c34bc9bc3 boot/measure: fix oom check
f68be4fd79 fuzz: fuzz-compress: fix copy-and-paste error: buf -> buf2 (#25431)
132f0ec7de Handle MACHINE_ID=uninitialized
25fcbdae7e shared/tpm2-util: Fix "Error: Esys invalid ESAPI handle (40000001)" warning
6189505d79 boot: Correctly handle @saved default patterns
148b2d8ad3 Revert "journal: Make sd_journal_previous/next() return 0 at HEAD/TAIL"
d34ea410f4 Fix reading /etc/machine-id in kernel-install (#25388)
7b99f68f1c systemctl: do not show unit properties with --all
f791ecd0c5 ac-power: check battery existence and status
c2620a6bdb pid1: skip cleanup if root is not tmpfs/ramfs
83a772aae2 Revert "initrd: extend SYSTEMD_IN_INITRD to accept non-ramfs rootfs"
4d11c9b3cd networkd-ipv4acd.c: Use net/if.h for getting IFF_LOOPBACK definition
aff1caf3fd boot: Replace firmware security hooks directly
f9d9a68ecc boot: Rework security arch override
c6d7b4014c boot: Manually convert filepaths if needed
c8c5b79fb6 boot: Do not require a loaded image path
5894d4bd79 boot: Fix memory leak
5c0b918c02 boot: Fix error message
542dbc623e tpm2: add some extra validation of device string before using it
b3228085ba tpm2-util: force default TCTI to be "device" with parameter "/dev/tpmrm0"
31c2abd305 Create CNAME
2ec3187d6c test: compile test-utmp.c only if UTMP is enabled
````
`
---
 pkgs/os-specific/linux/systemd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 0178cd7d6d45..d2cf9fc8db3a 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -123,7 +123,7 @@ assert withHomed -> withCryptsetup;
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "252.1";
+  version = "252.3";
 
   # Bump this variable on every (major) version change. See below (in the meson options list) for why.
   # command:
@@ -140,7 +140,7 @@ stdenv.mkDerivation {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    hash = "sha256-G43qbNF7znTITSM78sOL0qi8nqaA7qIhmiqP/rZKjXY=";
+    hash = "sha256-F2wtg12amigd5KNCWmG3b9Yu6PUOby9mQgZ2VFtxl5A==";
   };
 
   # On major changes, or when otherwise required, you *must* reformat the patches,

From 29b38799e9ddd054411cf9fe79c981964a772e68 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 9 Dec 2022 13:16:46 -0800
Subject: [PATCH 090/231] python310Packages.poetry-core: 1.3.2 -> 1.4.0

https://github.com/python-poetry/poetry-core/releases/tag/1.4.0
---
 pkgs/development/python-modules/poetry-core/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/poetry-core/default.nix b/pkgs/development/python-modules/poetry-core/default.nix
index e90529dac6d0..c669de8b03f6 100644
--- a/pkgs/development/python-modules/poetry-core/default.nix
+++ b/pkgs/development/python-modules/poetry-core/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "poetry-core";
-  version = "1.3.2";
+  version = "1.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "python-poetry";
     repo = pname;
     rev = version;
-    hash = "sha256-3Ryfq0MwrL/mKP8DmkhLOyFlulf3c73z9fFIzMuqOrg=";
+    hash = "sha256-SCzs2v0LIgx3vBYTavPqc7uwAQdWsdmkbDyHgIjOxrk=";
   };
 
   propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
@@ -58,6 +58,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/python-poetry/poetry-core/blob/${src.rev}/CHANGELOG.md";
     description = "Core utilities for Poetry";
     homepage = "https://github.com/python-poetry/poetry-core/";
     license = licenses.mit;

From 95c657b15f252d26020e91fd1a2cc60b600103aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 9 Dec 2022 13:04:49 -0800
Subject: [PATCH 091/231] python310Packages.poetry-plugin-export: 1.1.2 ->
 1.2.0

https://github.com/python-poetry/poetry-plugin-export/blob/1.2.0/CHANGELOG.md
---
 .../python-modules/poetry-plugin-export/default.nix          | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/poetry-plugin-export/default.nix b/pkgs/development/python-modules/poetry-plugin-export/default.nix
index bbf6013e4fd3..8711a4a527d0 100644
--- a/pkgs/development/python-modules/poetry-plugin-export/default.nix
+++ b/pkgs/development/python-modules/poetry-plugin-export/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "poetry-plugin-export";
-  version = "1.1.2";
+  version = "1.2.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "python-poetry";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-+BDBQwYaiddq3OQDHKmLap3ehWJe+Gh5D3TwuNXycjg=";
+    hash = "sha256-xrAGjHFYRT6n+r/16b0xyoI7+1Q1Hsw3lEK92UabIqo=";
   };
 
   postPatch = ''
@@ -29,6 +29,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [];
 
   meta = with lib; {
+    changelog = "https://github.com/python-poetry/poetry-plugin-export/blob/${src.rev}/CHANGELOG.md";
     description = "Poetry plugin to export the dependencies to various formats";
     license = licenses.mit;
     homepage = "https://github.com/python-poetry/poetry-plugin-export";

From 6de86a0981d48bbb4d426797eac5e4036022223b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 9 Dec 2022 13:10:37 -0800
Subject: [PATCH 092/231] python310Packages.trove-classifiers: init at
 2022.12.1

---
 .../trove-classifiers/default.nix             | 35 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 37 insertions(+)
 create mode 100644 pkgs/development/python-modules/trove-classifiers/default.nix

diff --git a/pkgs/development/python-modules/trove-classifiers/default.nix b/pkgs/development/python-modules/trove-classifiers/default.nix
new file mode 100644
index 000000000000..4e87963e9e8d
--- /dev/null
+++ b/pkgs/development/python-modules/trove-classifiers/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, calver
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "trove-classifiers";
+  version = "2022.12.1";
+
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "8eccd9c075038ef2ec73276e2422d0dbf4d632f9133f029632d0df35374caf77";
+  };
+
+  nativeBuildInputs = [
+    calver
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "trove_classifiers" ];
+
+  meta = {
+    description = "Canonical source for classifiers on PyPI";
+    homepage = "https://github.com/pypa/trove-classifiers";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 55d515af160d..af567721e3d4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11360,6 +11360,8 @@ self: super: with self; {
 
   troposphere = callPackage ../development/python-modules/troposphere { };
 
+  trove-classifiers = callPackage ../development/python-modules/trove-classifiers { };
+
   trueskill = callPackage ../development/python-modules/trueskill { };
 
   trustme = callPackage ../development/python-modules/trustme { };

From 3186183ec05cb44818647678db9810952e953479 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 9 Dec 2022 13:03:23 -0800
Subject: [PATCH 093/231] python310Packages.poetry: 1.2.2 -> 1.3.0

https://github.com/python-poetry/poetry/blob/1.3.0/CHANGELOG.md
---
 .../python-modules/poetry/default.nix         | 20 ++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/poetry/default.nix b/pkgs/development/python-modules/poetry/default.nix
index 2e81f7e55312..ff5d4c91a5d6 100644
--- a/pkgs/development/python-modules/poetry/default.nix
+++ b/pkgs/development/python-modules/poetry/default.nix
@@ -8,6 +8,7 @@
 , deepdiff
 , dulwich
 , fetchFromGitHub
+, filelock
 , flatdict
 , html5lib
 , httpretty
@@ -32,7 +33,9 @@
 , requests-toolbelt
 , shellingham
 , stdenv
+, tomli
 , tomlkit
+, trove-classifiers
 , urllib3
 , virtualenv
 , xattr
@@ -40,7 +43,7 @@
 
 buildPythonPackage rec {
   pname = "poetry";
-  version = "1.2.2";
+  version = "1.3.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -49,25 +52,19 @@ buildPythonPackage rec {
     owner = "python-poetry";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-huIjLv1T42HEmePCQNJpKnNxJKdyD9MlEtc2WRPOjRE=";
+    hash = "sha256-e60lGOu/g3SahArQXUuW8nIFgReILF5/lPOfOn0qz5o=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'crashtest = "^0.3.0"' 'crashtest = "*"' \
-      --replace 'xattr = { version = "^0.9.7"' 'xattr = { version = "^0.10.0"'
-  '';
-
   nativeBuildInputs = [
     installShellFiles
   ];
 
   propagatedBuildInputs = [
     cachecontrol
-    cachy
     cleo
     crashtest
     dulwich
+    filelock
     html5lib
     jsonschema
     keyring
@@ -81,9 +78,12 @@ buildPythonPackage rec {
     requests-toolbelt
     shellingham
     tomlkit
+    trove-classifiers
     virtualenv
   ] ++ lib.optionals (stdenv.isDarwin) [
     xattr
+  ] ++ lib.optionals (pythonOlder "3.11") [
+    tomli
   ] ++ lib.optionals (pythonOlder "3.10") [
     importlib-metadata
   ] ++ lib.optionals (pythonOlder "3.8") [
@@ -98,6 +98,7 @@ buildPythonPackage rec {
   '';
 
   checkInputs = [
+    cachy
     deepdiff
     flatdict
     pytestCheckHook
@@ -142,6 +143,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/python-poetry/poetry/blob/${src.rev}/CHANGELOG.md";
     homepage = "https://python-poetry.org/";
     description = "Python dependency management and packaging made easy";
     license = licenses.mit;

From 047b5821350ec8ae4fc6fb725b13d4d725c7f62c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 13 Dec 2022 20:17:53 +0000
Subject: [PATCH 094/231] libarchive: 3.6.1 -> 3.6.2

---
 pkgs/development/libraries/libarchive/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index 066ea8b60ddc..c7e9f117f94c 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -28,13 +28,13 @@ assert xarSupport -> libxml2 != null;
 
 stdenv.mkDerivation rec {
   pname = "libarchive";
-  version = "3.6.1";
+  version = "3.6.2";
 
   src = fetchFromGitHub {
     owner = "libarchive";
     repo = "libarchive";
     rev = "v${version}";
-    hash = "sha256-G4wL5DDbX0FqaA4cnOlVLZ25ObN8dNsRtxyas29tpDA=";
+    hash = "sha256-wQbA6vlXH8pnpY7LJLkjrRFEBpcaPR1SqxnK71UVwxg=";
   };
 
   postPatch = ''

From 6a5211f123c14f95cbbb6d17c21d9e78cb178952 Mon Sep 17 00:00:00 2001
From: Winter <winter@winter.cafe>
Date: Thu, 8 Dec 2022 17:29:33 -0500
Subject: [PATCH 095/231] nodejs-{16,18,19}_x: backport `npm pack` fixes from
 npm v9

---
 pkgs/development/web/nodejs/npm-patches.nix | 23 +++++++++++++++++++++
 pkgs/development/web/nodejs/v16.nix         |  4 +++-
 pkgs/development/web/nodejs/v18.nix         |  4 +++-
 pkgs/development/web/nodejs/v19.nix         |  4 +++-
 4 files changed, 32 insertions(+), 3 deletions(-)
 create mode 100644 pkgs/development/web/nodejs/npm-patches.nix

diff --git a/pkgs/development/web/nodejs/npm-patches.nix b/pkgs/development/web/nodejs/npm-patches.nix
new file mode 100644
index 000000000000..28432f806dc6
--- /dev/null
+++ b/pkgs/development/web/nodejs/npm-patches.nix
@@ -0,0 +1,23 @@
+{ fetchpatch }:
+
+[
+  # Makes `npm pack` obey `--foreground-scripts`
+  (fetchpatch {
+    name = "libnpmpack-obey-foreground-scripts.patch";
+    url = "https://github.com/npm/cli/commit/e4e8ae20aef9e27e57282e87e8757d5b364abb39.patch";
+    hash = "sha256-NQ8CZBfRqAOMe0Ysg3cq1FiferWKTzXC1QXgzX+f8OU=";
+    stripLen = 2;
+    extraPrefix = "deps/npm/node_modules/";
+    includes = [ "deps/npm/node_modules/libnpmpack/lib/index.js" ];
+  })
+
+  # Makes `npm pack` obey `--ignore-scripts`
+  (fetchpatch {
+    name = "libnpmpack-obey-ignore-scripts.patch";
+    url = "https://github.com/npm/cli/commit/a990c3c9a0e67f0a8b6454213675e159fe49432d.patch";
+    hash = "sha256-eA5YST9RxMMjk5FCwEbl1HQUpXZuwWZkx5WC4yJium8=";
+    stripLen = 2;
+    extraPrefix = "deps/npm/node_modules/";
+    includes = [ "deps/npm/node_modules/libnpmpack/lib/index.js" ];
+  })
+]
diff --git a/pkgs/development/web/nodejs/v16.nix b/pkgs/development/web/nodejs/v16.nix
index a35c347c3d14..8483e7251b4e 100644
--- a/pkgs/development/web/nodejs/v16.nix
+++ b/pkgs/development/web/nodejs/v16.nix
@@ -5,6 +5,8 @@ let
     inherit openssl;
     python = python3;
   };
+
+  npmPatches = callPackage ./npm-patches.nix { };
 in
   buildNodejs {
     inherit enableNpm;
@@ -13,5 +15,5 @@ in
     patches = [
       ./disable-darwin-v8-system-instrumentation.patch
       ./bypass-darwin-xcrun-node16.patch
-    ];
+    ] ++ npmPatches;
   }
diff --git a/pkgs/development/web/nodejs/v18.nix b/pkgs/development/web/nodejs/v18.nix
index 29f133a81105..b91f2c9f2c2b 100644
--- a/pkgs/development/web/nodejs/v18.nix
+++ b/pkgs/development/web/nodejs/v18.nix
@@ -5,6 +5,8 @@ let
     inherit openssl;
     python = python3;
   };
+
+  npmPatches = callPackage ./npm-patches.nix { };
 in
 buildNodejs {
   inherit enableNpm;
@@ -21,5 +23,5 @@ buildNodejs {
 
     ./disable-darwin-v8-system-instrumentation.patch
     ./bypass-darwin-xcrun-node16.patch
-  ];
+  ] ++ npmPatches;
 }
diff --git a/pkgs/development/web/nodejs/v19.nix b/pkgs/development/web/nodejs/v19.nix
index cbed3bbef9aa..335477aa7ddc 100644
--- a/pkgs/development/web/nodejs/v19.nix
+++ b/pkgs/development/web/nodejs/v19.nix
@@ -5,6 +5,8 @@ let
     inherit openssl;
     python = python3;
   };
+
+  npmPatches = callPackage ./npm-patches.nix { };
 in
 buildNodejs {
   inherit enableNpm;
@@ -14,5 +16,5 @@ buildNodejs {
     ./revert-arm64-pointer-auth.patch
     ./disable-darwin-v8-system-instrumentation-node19.patch
     ./bypass-darwin-xcrun-node16.patch
-  ];
+  ] ++ npmPatches;
 }

From f1292b31d60bb804b1a9cc486a7cfd06b47c9a11 Mon Sep 17 00:00:00 2001
From: Winter <winter@winter.cafe>
Date: Thu, 8 Dec 2022 17:36:27 -0500
Subject: [PATCH 096/231] doc/languages-frameworks/javascript: use
 --ignore-scripts flag in example

Presenting an example with a patch (without even providing that patch!) is not ideal. Since `npm pack` now obeys `--ignore-scripts`, we can use that instead.
---
 doc/languages-frameworks/javascript.section.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index e4e6643dd66a..76cf6e03c257 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -175,10 +175,11 @@ buildNpmPackage rec {
     hash = "sha256-BR+ZGkBBfd0dSQqAvujsbgsEPFYw/ThrylxUbOksYxM=";
   };
 
-  patches = [ ./remove-prepack-script.patch ];
-
   npmDepsHash = "sha256-tuEfyePwlOy2/mOPdXbqJskO6IowvAP4DWg8xSZwbJw=";
 
+  # The prepack script runs the build script, which we'd rather do in the build phase.
+  npmPackFlags = [ "--ignore-scripts" ];
+
   NODE_OPTIONS = "--openssl-legacy-provider";
 
   meta = with lib; {

From a37c3a6b942ef752d937afd407de87a3e3e47f99 Mon Sep 17 00:00:00 2001
From: Winter <winter@winter.cafe>
Date: Sat, 10 Dec 2022 13:03:00 -0500
Subject: [PATCH 097/231] ansible-language-server: use `npm pack
 --ignore-scripts`

---
 pkgs/development/tools/ansible-language-server/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/ansible-language-server/default.nix b/pkgs/development/tools/ansible-language-server/default.nix
index 8d9b1f0ca50f..4daa90a80a54 100644
--- a/pkgs/development/tools/ansible-language-server/default.nix
+++ b/pkgs/development/tools/ansible-language-server/default.nix
@@ -18,7 +18,7 @@ buildNpmPackage rec {
   npmDepsHash = "sha256-8FP6hF85w1Zbhiwi2V350ZWFAykAfvsXRGL8bvGk1XE=";
   npmBuildScript = "compile";
 
-  # We remove the prepare and prepack scripts because they run the
+  # We remove/ignore the prepare and prepack scripts because they run the
   # build script, and therefore are redundant.
   #
   # Additionally, the prepack script runs npm ci in addition to the
@@ -27,9 +27,10 @@ buildNpmPackage rec {
   # wiping out node_modules, which causes a mysterious error stating that tsc isn't installed.
   postPatch = ''
     sed -i '/"prepare"/d' package.json
-    sed -i '/"prepack"/d' package.json
   '';
 
+  npmPackFlags = [ "--ignore-scripts" ];
+
   passthru.updateScript = nix-update-script {
     attrPath = pname;
   };

From 44ab6c7eebcaa704093918c9eeb3179e9f478b62 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 14 Dec 2022 06:09:03 +0000
Subject: [PATCH 098/231] pcre2: 10.40 -> 10.42

---
 pkgs/development/libraries/pcre2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/pcre2/default.nix b/pkgs/development/libraries/pcre2/default.nix
index 226b92ccfdd3..82fc33670bc5 100644
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pcre2";
-  version = "10.40";
+  version = "10.42";
 
   src = fetchurl {
     url = "https://github.com/PhilipHazel/pcre2/releases/download/pcre2-${version}/pcre2-${version}.tar.bz2";
-    hash = "sha256-FOS4PEeDkz3BfpZDGOYyT3yuG8ddjzx5vGlp8AwVnWg=";
+    hash = "sha256-jTbNjLbqKkwrs1j/ZBGwx4hjOipF2rvxrrS3AdG16EA=";
   };
 
   configureFlags = [

From cf63ef8b34724aed31e3b4702865bcd4260c23d5 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Wed, 14 Dec 2022 14:20:06 +0100
Subject: [PATCH 099/231] glib: Pick security patches

https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835
https://discourse.gnome.org/t/fixes-for-gdbusmenumodel-crashes-in-glib/12846
---
 pkgs/development/libraries/glib/default.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 12f46af022fc..4bd223158f63 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -118,6 +118,20 @@ stdenv.mkDerivation (finalAttrs: {
     # Disable flaky test.
     # https://gitlab.gnome.org/GNOME/glib/-/issues/820
     ./skip-timer-test.patch
+
+    # GVariant security fixes
+    # https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3126.patch";
+      sha256 = "CNCxouYy8xNHt4eJtPZ2eOi9b0SxzI2DkklNfQMk3d8=";
+    })
+
+    # Menu model security fix
+    # https://discourse.gnome.org/t/fixes-for-gdbusmenumodel-crashes-in-glib/12846
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/glib/-/commit/4f4d770a1e40f719d5a310cffdac29cbb4e20c11.patch";
+      sha256 = "+S44AnC86HfbMwkRe1ll54IK9pLxaFD3LqiVhPelnXI=";
+    })
   ];
 
   outputs = [ "bin" "out" "dev" "devdoc" ];

From 6ba4739114dee7d0374f6acc38d26d666f50fc8d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 15 Dec 2022 00:20:17 +0100
Subject: [PATCH 100/231] python310Packages.limits: 2.7.0 -> 2.7.2

Diff: https://github.com/alisaifee/limits/compare/2.7.0...2.7.2
---
 pkgs/development/python-modules/limits/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/limits/default.nix b/pkgs/development/python-modules/limits/default.nix
index 2b4499e29e8e..f298bef4892f 100644
--- a/pkgs/development/python-modules/limits/default.nix
+++ b/pkgs/development/python-modules/limits/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "limits";
-  version = "2.7.0";
+  version = "2.7.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/limits/_version.py"
     '';
-    hash = "sha256-TBZElCogPtoR2qX1YjBgpYh99LhrvLHFtr2ogemo9/c=";
+    hash = "sha256-sL4/BE1qNfR33rZwBcwHo3UeVMfkNz7rwBNF4LBtSIw=";
   };
 
   propagatedBuildInputs = [

From 9551ca33185d70acefd9cdc84f9ccc6b12df0b0c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 9 Dec 2022 11:00:20 -0800
Subject: [PATCH 101/231] python310Packages.six: run tests

---
 .../python-modules/six/default.nix            | 21 ++++++++++---------
 pkgs/top-level/python2-packages.nix           |  4 ++++
 2 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/python-modules/six/default.nix b/pkgs/development/python-modules/six/default.nix
index 24fe639211d1..61e6a178660d 100644
--- a/pkgs/development/python-modules/six/default.nix
+++ b/pkgs/development/python-modules/six/default.nix
@@ -1,30 +1,31 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytest
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "six";
   version = "1.16.0";
 
+  format = "setuptools";
+
   src = fetchPypi {
     inherit pname version;
     sha256 = "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926";
   };
 
-  checkInputs = [ pytest ];
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-  checkPhase = ''
-    py.test test_six.py
-  '';
-
-  # To prevent infinite recursion with pytest
-  doCheck = false;
+  pythonImportsCheck = [ "six" ];
 
   meta = {
-    description = "A Python 2 and 3 compatibility library";
-    homepage = "https://pypi.python.org/pypi/six/";
+    changelog = "https://github.com/benjaminp/six/blob/${version}/CHANGES";
+    description = "Python 2 and 3 compatibility library";
+    homepage = "https://github.com/benjaminp/six";
     license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/top-level/python2-packages.nix b/pkgs/top-level/python2-packages.nix
index bfa5a304807f..45610c7aa7fd 100644
--- a/pkgs/top-level/python2-packages.nix
+++ b/pkgs/top-level/python2-packages.nix
@@ -75,6 +75,10 @@ with self; with super; {
 
   setuptools-scm = callPackage ../development/python2-modules/setuptools-scm { };
 
+  six = super.six.overridePythonAttrs (_: {
+    doCheck = false;  # circular dependency with pytest
+  });
+
   zeek = disabled super.zeek;
 
   zipp = callPackage ../development/python2-modules/zipp { };

From 3954989b5b2843db6905309a1e955513df4ad136 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 9 Dec 2022 23:19:41 -0800
Subject: [PATCH 102/231] python310Packages.yarl: 1.8.1 -> 1.8.2

https://github.com/aio-libs/yarl/blob/v1.8.2/CHANGES.rst
---
 pkgs/development/python-modules/yarl/default.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/yarl/default.nix b/pkgs/development/python-modules/yarl/default.nix
index 249bf974322e..171f6569cfd8 100644
--- a/pkgs/development/python-modules/yarl/default.nix
+++ b/pkgs/development/python-modules/yarl/default.nix
@@ -10,11 +10,15 @@
 
 buildPythonPackage rec {
   pname = "yarl";
-  version = "1.8.1";
+  version = "1.8.2";
+
+  disabled = pythonOlder "3.7";
+
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-r4h4RbjC4GDrVgX/crby3SqrenYTeTc/2J0xT0dSq78=";
+    hash = "sha256-SdQ0AsbjATrQl4YCv2v1MoU1xI0ZIwS5G5ejxnkLFWI=";
   };
 
   postPatch = ''
@@ -44,6 +48,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "yarl" ];
 
   meta = with lib; {
+    changelog = "https://github.com/aio-libs/yarl/blob/v${version}/CHANGES.rst";
     description = "Yet another URL library";
     homepage = "https://github.com/aio-libs/yarl";
     license = licenses.asl20;

From 31c93ff0b873add319265cb2dd9ce41a57a2a5ff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 10 Dec 2022 11:38:40 -0800
Subject: [PATCH 103/231] python310Packages.multidict: 6.0.2 -> 6.0.3

https://github.com/aio-libs/multidict/releases/tag/v6.0.3
---
 pkgs/development/python-modules/multidict/default.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/multidict/default.nix b/pkgs/development/python-modules/multidict/default.nix
index 6ee071732691..ebc4daae0bc1 100644
--- a/pkgs/development/python-modules/multidict/default.nix
+++ b/pkgs/development/python-modules/multidict/default.nix
@@ -7,13 +7,15 @@
 
 buildPythonPackage rec {
   pname = "multidict";
-  version = "6.0.2";
+  version = "6.0.3";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
+
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-X/O9dfOOTEPx9HDy33pNQwuCHEziK+OE4UWctX1rsBM=";
+    hash = "sha256-JSOikAbANGh+zNPucAk6aXEpo//ocyU107Lfak7MJ50=";
   };
 
   postPatch = ''
@@ -25,6 +27,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "multidict" ];
 
   meta = with lib; {
+    changelog = "https://github.com/aio-libs/multidict/blob/v${version}/CHANGES.rst";
     description = "Multidict implementation";
     homepage = "https://github.com/aio-libs/multidict/";
     license = licenses.asl20;

From 804a0f037d4ebad40d6f21713eec01a8f951a35a Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 2 Dec 2022 18:15:31 +0300
Subject: [PATCH 104/231] libclc: 12.0.1 -> 14.0.6

---
 pkgs/development/libraries/libclc/default.nix | 4 ++--
 pkgs/top-level/all-packages.nix               | 4 +++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/libclc/default.nix b/pkgs/development/libraries/libclc/default.nix
index a53450e11773..14a20a957967 100644
--- a/pkgs/development/libraries/libclc/default.nix
+++ b/pkgs/development/libraries/libclc/default.nix
@@ -7,13 +7,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libclc";
-  version = "12.0.1";
+  version = "14.0.6";
 
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "llvm-project";
     rev = "llvmorg-${version}";
-    sha256 = "08s5w2db9imb2yaqsvxs6pg21csi1cf6wa35rf8x6q07mam7j8qv";
+    sha256 = "sha256-vffu4HilvYwtzwgq+NlS26m65DGbp6OSSne2aje1yJE=";
   };
   sourceRoot = "source/libclc";
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a084bc1815dd..cbbb50b4bab7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20275,7 +20275,9 @@ with pkgs;
 
   libcint = callPackage ../development/libraries/libcint { };
 
-  libclc = callPackage ../development/libraries/libclc { };
+  libclc = callPackage ../development/libraries/libclc {
+    llvmPackages = llvmPackages_latest;
+  };
 
   libcli = callPackage ../development/libraries/libcli { };
 

From cd53c071f2ce8ed43365c519aad49bf58ec5dd97 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 2 Dec 2022 18:15:42 +0300
Subject: [PATCH 105/231] mesa: 22.2.5 -> 22.3.1, enable rusticl

---
 pkgs/development/libraries/mesa/default.nix  | 24 +++++++----
 pkgs/development/libraries/mesa/opencl.patch | 42 ++++++++++++++++----
 2 files changed, 51 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 78230898d7fc..8d8562468757 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -19,6 +19,10 @@
 , enablePatentEncumberedCodecs ? true
 , libclc
 , jdupes
+, cmake
+, rustc
+, rust-bindgen
+, spirv-llvm-translator_14
 }:
 
 /** Packaging design:
@@ -37,9 +41,15 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "22.2.5";
+  version = "22.3.1";
   branch  = versions.major version;
 
+  rust-bindgen' = rust-bindgen.override {
+    rust-bindgen-unwrapped = rust-bindgen.unwrapped.override {
+      clang = llvmPackages.clang;
+    };
+  };
+
 self = stdenv.mkDerivation {
   pname = "mesa";
   inherit version;
@@ -52,7 +62,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "sha256-hQ8GMUb467JirsBPZmwsHlYj8qGYfdok5DYbF7kSxzs=";
+    sha256 = "sha256-PJzWEcCFnTB6ugZZgzOGq9ykyGFi08J1ulvmLRbPMes=";
   };
 
   # TODO:
@@ -105,7 +115,6 @@ self = stdenv.mkDerivation {
 
     "-Ddri-drivers-path=${placeholder "drivers"}/lib/dri"
     "-Dvdpau-libs-path=${placeholder "drivers"}/lib/vdpau"
-    "-Dxvmc-libs-path=${placeholder "drivers"}/lib"
     "-Domx-libs-path=${placeholder "drivers"}/lib/bellagio"
     "-Dva-libs-path=${placeholder "drivers"}/lib/dri"
     "-Dd3d-drivers-path=${placeholder "drivers"}/lib/d3d"
@@ -119,6 +128,7 @@ self = stdenv.mkDerivation {
     "-Dglvnd=true"
   ] ++ optionals enableOpenCL [
     "-Dgallium-opencl=icd" # Enable the gallium OpenCL frontend
+    "-Dgallium-rusticl=true" "-Drust_std=2021"
     "-Dclang-libdir=${llvmPackages.clang-unwrapped.lib}/lib"
   ] ++ optional enablePatentEncumberedCodecs
     "-Dvideo-codecs=h264dec,h264enc,h265dec,h265enc,vc1dec"
@@ -132,7 +142,7 @@ self = stdenv.mkDerivation {
   ] ++ lib.optionals (elem "wayland" eglPlatforms) [ wayland wayland-protocols ]
     ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal ]
     ++ lib.optionals stdenv.isDarwin [ libunwind ]
-    ++ lib.optionals enableOpenCL [ libclc llvmPackages.clang llvmPackages.clang-unwrapped ]
+    ++ lib.optionals enableOpenCL [ libclc llvmPackages.clang llvmPackages.clang-unwrapped rustc rust-bindgen' spirv-llvm-translator_14 ]
     ++ lib.optional withValgrind valgrind-light
     # Mesa will not build zink when gallium-drivers=auto
     ++ lib.optional (elem "zink" galliumDrivers) vulkan-loader;
@@ -188,12 +198,12 @@ self = stdenv.mkDerivation {
     mkdir -p $opencl/lib
     mv -t "$opencl/lib/"     \
       $out/lib/gallium-pipe   \
-      $out/lib/libMesaOpenCL*
+      $out/lib/lib*OpenCL*
 
-    # We construct our own .icd file that contains an absolute path.
-    rm -r $out/etc/OpenCL
+    # We construct our own .icd files that contain absolute paths.
     mkdir -p $opencl/etc/OpenCL/vendors/
     echo $opencl/lib/libMesaOpenCL.so > $opencl/etc/OpenCL/vendors/mesa.icd
+    echo $opencl/lib/libRusticlOpenCL.so > $opencl/etc/OpenCL/vendors/rusticl.icd
   '' + lib.optionalString enableOSMesa ''
     # move libOSMesa to $osmesa, as it's relatively big
     mkdir -p $osmesa/lib
diff --git a/pkgs/development/libraries/mesa/opencl.patch b/pkgs/development/libraries/mesa/opencl.patch
index d220239770d5..02558aaa825d 100644
--- a/pkgs/development/libraries/mesa/opencl.patch
+++ b/pkgs/development/libraries/mesa/opencl.patch
@@ -1,5 +1,18 @@
+diff --git a/meson.build b/meson.build
+index e32338b3f9a..fae804fd41e 100644
+--- a/meson.build
++++ b/meson.build
+@@ -1894,7 +1894,7 @@ endif
+ 
+ dep_clang = null_dep
+ if with_clc
+-  llvm_libdir = dep_llvm.get_variable(cmake : 'LLVM_LIBRARY_DIR', configtool: 'libdir')
++  llvm_libdir = get_option('clang-libdir')
+ 
+   dep_clang = cpp.find_library('clang-cpp', dirs : llvm_libdir, required : false)
+ 
 diff --git a/meson_options.txt b/meson_options.txt
-index b8f753e2e1a..2163e3ab7ee 100644
+index 6f307018815..ab84eb1006c 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
 @@ -18,6 +18,12 @@
@@ -16,7 +29,7 @@ index b8f753e2e1a..2163e3ab7ee 100644
    'platforms',
    type : 'array',
 diff --git a/src/gallium/targets/opencl/meson.build b/src/gallium/targets/opencl/meson.build
-index 14df6b86f7f..adcd5110342 100644
+index 7af210b5693..ff6ac8c61ca 100644
 --- a/src/gallium/targets/opencl/meson.build
 +++ b/src/gallium/targets/opencl/meson.build
 @@ -30,6 +30,7 @@ if with_ld_version_script
@@ -29,7 +42,7 @@ index 14df6b86f7f..adcd5110342 100644
  polly_dep = null_dep
 @@ -60,19 +61,19 @@ else
  endif
- if not (dep_clang.found() and dep_clang_usable)
+ if not _shared_llvm or not (dep_clang.found() and dep_clang_usable)
    dep_clang = [
 -    cpp.find_library('clangCodeGen', dirs : llvm_libdir),
 -    cpp.find_library('clangFrontendTool', dirs : llvm_libdir),
@@ -60,12 +73,25 @@ index 14df6b86f7f..adcd5110342 100644
      polly_dep, polly_isl_dep,
    ]
    # check clang once more
-@@ -112,7 +113,7 @@ if with_opencl_icd
+@@ -119,7 +120,7 @@ if with_opencl_icd
+     configuration : _config,
      input : 'mesa.icd.in',
      output : 'mesa.icd',
-     install : true,
--    install_dir : join_paths(get_option('sysconfdir'), 'OpenCL', 'vendors'),
-+    install_dir : join_paths(get_option('prefix'), 'etc', 'OpenCL', 'vendors'),
+-    install : true,
++    install : false,
+     install_dir : join_paths(get_option('sysconfdir'), 'OpenCL', 'vendors'),
    )
  
-   if meson.version().version_compare('>= 0.58')
+diff --git a/src/gallium/targets/rusticl/meson.build b/src/gallium/targets/rusticl/meson.build
+index a968dee52db..69475cf3133 100644
+--- a/src/gallium/targets/rusticl/meson.build
++++ b/src/gallium/targets/rusticl/meson.build
+@@ -58,7 +58,7 @@ configure_file(
+   configuration : _config,
+   input : 'rusticl.icd.in',
+   output : 'rusticl.icd',
+-  install : true,
++  install : false,
+   install_dir : join_paths(get_option('sysconfdir'), 'OpenCL', 'vendors'),
+ )
+ 

From fde44ef915f67047277fbc601fac320a7c3955f0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Thu, 15 Dec 2022 12:48:29 +0100
Subject: [PATCH 106/231] x265: only disable assembly on riscv-cross builds

---
 pkgs/development/libraries/x265/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/x265/default.nix b/pkgs/development/libraries/x265/default.nix
index 7e81d8ff6115..b63b0101d54b 100644
--- a/pkgs/development/libraries/x265/default.nix
+++ b/pkgs/development/libraries/x265/default.nix
@@ -35,8 +35,7 @@ let
     (mkFlag vtuneSupport "ENABLE_VTUNE")
     (mkFlag werrorSupport "WARNINGS_AS_ERRORS")
     # Potentially riscv cross could be fixed by providing the correct CMAKE_SYSTEM_PROCESSOR flag
-    (mkFlag (!(isCross && stdenv.hostPlatform.isRiscV)) "ENABLE_ASSEMBLY")
-  ];
+  ] ++ lib.optional (isCross && stdenv.hostPlatform.isRiscV) "-DENABLE_ASSEMBLY=OFF";
 
   cmakeStaticLibFlags = [
     "-DHIGH_BIT_DEPTH=ON"

From e14de22618dc6c547f7c89f57eefe98e9e0bb8c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Tue, 13 Dec 2022 18:12:04 +0100
Subject: [PATCH 107/231] stdenv: handle `env` gracefully

Derivations not using `__structuredAttrs` should not attempt to set
environment variables from `env`.

Derivations using `__structuredAttrs` should fail if `env` is not
exportable.
---
 pkgs/stdenv/generic/make-derivation.nix |  6 ++++--
 pkgs/stdenv/generic/setup.sh            | 11 +++++++----
 pkgs/test/stdenv/default.nix            | 19 +++++++++++++++++++
 3 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 12aa25ac307c..db6d7e83f595 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -274,7 +274,7 @@ else let
        "__darwinAllowLocalNetworking"
        "__impureHostDeps" "__propagatedImpureHostDeps"
        "sandboxProfile" "propagatedSandboxProfile"]
-       ++ lib.optionals envIsExportable [ "env" ]))
+       ++ lib.optional (__structuredAttrs || envIsExportable) "env"))
     // (lib.optionalAttrs (attrs ? name || (attrs ? pname && attrs ? version)) {
       name =
         let
@@ -298,7 +298,7 @@ else let
           then attrs.name + hostSuffix
           else "${attrs.pname}${staticMarker}${hostSuffix}-${attrs.version}"
         );
-    }) // lib.optionalAttrs (envIsExportable && __structuredAttrs) { env = checkedEnv; } // {
+    }) // lib.optionalAttrs __structuredAttrs { env = checkedEnv; } // {
       builder = attrs.realBuilder or stdenv.shell;
       args = attrs.args or ["-e" (attrs.builder or ./default-builder.sh)];
       inherit stdenv;
@@ -485,6 +485,8 @@ else let
     let
       overlappingNames = lib.intersectLists (lib.attrNames env) (lib.attrNames derivationArg);
     in
+    assert lib.assertMsg envIsExportable
+      "When using structured attributes, `env` must be an attribute set of environment variables.";
     assert lib.assertMsg (overlappingNames == [ ])
       "The ‘env’ attribute set cannot contain any attributes passed to derivation. The following attributes are overlapping: ${lib.concatStringsSep ", " overlappingNames}";
     lib.mapAttrs
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 5a64625e10d1..b07420bb4185 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -383,10 +383,13 @@ printWords() {
 ######################################################################
 # Initialisation.
 
-# export all vars that should be in the ENV
-for envVar in "${!env[@]}"; do
-    declare -x "${envVar}=${env[${envVar}]}"
-done
+# If using structured attributes, export variables from `env` to the environment.
+# When not using structured attributes, those variables are already exported.
+if [[ -n $__structuredAttrs ]]; then
+    for envVar in "${!env[@]}"; do
+        declare -x "${envVar}=${env[${envVar}]}"
+    done
+fi
 
 
 # Set a fallback default value for SOURCE_DATE_EPOCH, used by some build tools
diff --git a/pkgs/test/stdenv/default.nix b/pkgs/test/stdenv/default.nix
index 08e8eed118f9..ab5f98890bd3 100644
--- a/pkgs/test/stdenv/default.nix
+++ b/pkgs/test/stdenv/default.nix
@@ -95,6 +95,25 @@ in
 {
   test-env-attrset = testEnvAttrset { name = "test-env-attrset"; stdenv' = bootStdenv; };
 
+  # Test compatibility with derivations using `env` as a regular variable.
+  test-env-derivation = bootStdenv.mkDerivation rec {
+    name = "test-env-derivation";
+    env = bootStdenv.mkDerivation {
+      name = "foo";
+      buildCommand = ''
+        mkdir "$out"
+        touch "$out/bar"
+      '';
+    };
+
+    passAsFile = [ "buildCommand" ];
+    buildCommand = ''
+      declare -p env
+      [[ $env == "${env}" ]]
+      touch "$out"
+    '';
+  };
+
   test-prepend-append-to-var = testPrependAndAppendToVar {
     name = "test-prepend-append-to-var";
     stdenv' = bootStdenv;

From 9b1e8d7267ad7999677ea1900a5613ee1f23d0fc Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 15 Dec 2022 07:16:18 +0200
Subject: [PATCH 108/231] tests.stdenv: check that attrs in env are exported

---
 pkgs/test/stdenv/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/test/stdenv/default.nix b/pkgs/test/stdenv/default.nix
index ab5f98890bd3..3289b7e11e2e 100644
--- a/pkgs/test/stdenv/default.nix
+++ b/pkgs/test/stdenv/default.nix
@@ -47,6 +47,7 @@ let
           declare -p string
           echo "env.string = $string"
           [[ $string == "testing-string" ]] || (echo "'\$string' was not 'testing-string'" && false)
+          [[ "$(declare -p string)" == 'declare -x string="testing-string"' ]] || (echo "'\$string' was not exported" && false)
           touch $out
         '';
       } // extraAttrs);

From 1ffbdda604b5c0daf6cbd521aa09b21cdc72f55c Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Thu, 15 Dec 2022 11:24:06 -0500
Subject: [PATCH 109/231] rustc: 1.65.0 -> 1.66.0

---
 .../compilers/rust/{1_65.nix => 1_66.nix}     | 32 +++++++++----------
 pkgs/top-level/all-packages.nix               |  8 ++---
 2 files changed, 20 insertions(+), 20 deletions(-)
 rename pkgs/development/compilers/rust/{1_65.nix => 1_66.nix} (56%)

diff --git a/pkgs/development/compilers/rust/1_65.nix b/pkgs/development/compilers/rust/1_66.nix
similarity index 56%
rename from pkgs/development/compilers/rust/1_65.nix
rename to pkgs/development/compilers/rust/1_66.nix
index 5b2397b5de48..ada9054973fa 100644
--- a/pkgs/development/compilers/rust/1_65.nix
+++ b/pkgs/development/compilers/rust/1_66.nix
@@ -20,8 +20,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.65.0";
-  rustcSha256 = "sha256-WCi7Z/Z36r+MOEAgWCsM56+IThyEOJSE9/jQDdgsADg=";
+  rustcVersion = "1.66.0";
+  rustcSha256 = "sha256-OzzT6lqCombnXQs18LVMFgIVdtnreNOEBSF1p3KTWkg=";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
@@ -37,25 +37,25 @@ import ./default.nix {
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.64.0";
+  bootstrapVersion = "1.65.0";
 
   # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "177b4f95c8cdaa34bb29e69950cbfe236e123757078af4792779c43ee3818199";
-    x86_64-unknown-linux-gnu = "a893977f238291370ab96726a74b6b9ae854dc75fbf5730954d901a93843bf9b";
-    x86_64-unknown-linux-musl = "d5c4293a8fe1b34d857bec4124229c39711f8759aa2f6108c8b6c22a308f96bb";
-    arm-unknown-linux-gnueabihf = "0d7c9c746f7b98f1f99e4cf720f9a32b2f5cdf22cb1d9f677b41c1dca62f14f8";
-    armv7-unknown-linux-gnueabihf = "0be29740f565ca8835ba260691274585733a7f4130ec872bfa37654a08013828";
-    aarch64-unknown-linux-gnu = "7d8860572431bd4ee1b9cd0cd77cf7ff29fdd5b91ed7c92a820f872de6ced558";
-    aarch64-unknown-linux-musl = "9e7cfd960fb8ad3e1f51ef667c56032d3d4d9d9f573a06bbcf65a7c7a96ab430";
-    x86_64-apple-darwin = "b6003d49fb857ff8dc105a3ccba98b851cd3e7d874005acb92284fd1113adc0d";
-    aarch64-apple-darwin = "e1a37dc5991304716e260144311fd291d8fb514042e45c244c582b3454477038";
-    powerpc64le-unknown-linux-gnu = "9d4591033eac22093d107991a68fffccea087b26bb54115d46cc544fbf5ef66c";
-    riscv64gc-unknown-linux-gnu = "f63981d9c1057cb20cf30871757d42475a1cd0c187b3dcce5fabb0cce0f80c5b";
-    mips64el-unknown-linux-gnuabi64 = "47488e4c53cca5c99b5837474a880f6c2368a7fe8368560dd8077bddb94959b5";
+    i686-unknown-linux-gnu = "b29869f8e2c7029150a929b2c4e26843f363846ad99253a25be6abcfa8e84f46";
+    x86_64-unknown-linux-gnu = "8f754fdd5af783fe9020978c64e414cb45f3ad0a6f44d045219bbf2210ca3cb9";
+    x86_64-unknown-linux-musl = "716984def5509a844c2dde1c7be42bfadeb179f751d5c1a30c9c7198c8c089cd";
+    arm-unknown-linux-gnueabihf = "e27f835c16bfcb66ad022a17d5c4602899e021e483a432ca4cc2cb4ecd39e938";
+    armv7-unknown-linux-gnueabihf = "5376d467a29b32cacb771e0c76dc280bd623852709e7ffd92caabab076d5475f";
+    aarch64-unknown-linux-gnu = "f406136010e6a1cdce3fb6573506f00d23858af49dd20a46723c3fa5257b7796";
+    aarch64-unknown-linux-musl = "4b701dc3cbac04ebf0e336cff2f4ce5fc1a1984c183226863c9ed911eb00b07e";
+    x86_64-apple-darwin = "139087a3937799415fd829e5a88162a69a32c23725a44457f9c96b98e4d64a7c";
+    aarch64-apple-darwin = "7ddc335bd10fc32d3039ef36248a5d0c4865db2437c8aad20a2428a6cf41df09";
+    powerpc64le-unknown-linux-gnu = "3f1d0d5bb13213348dc65e373f8c412fc0a12ee55abc1c864f7e0300932fc687";
+    riscv64gc-unknown-linux-gnu = "aac7067348d218faa452b4bdc735778a51570a310ad645313ec767b5d7c88492";
+    mips64el-unknown-linux-gnuabi64 = "d91ed3857c5256720da890f6533684b684e880bf9006dc4e4f4181213a5c4a09";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_65;
+  selectRustPackage = pkgs: pkgs.rust_1_66;
 
   rustcPatches = [
   ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a084bc1815dd..3ba342af198a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15214,11 +15214,11 @@ with pkgs;
     inherit (darwin) apple_sdk;
   };
 
-  rust_1_65 = callPackage ../development/compilers/rust/1_65.nix {
+  rust_1_66 = callPackage ../development/compilers/rust/1_66.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
     llvm_14 = llvmPackages_14.libllvm;
   };
-  rust = rust_1_65;
+  rust = rust_1_66;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@@ -15227,8 +15227,8 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  rustPackages_1_65 = rust_1_65.packages.stable;
-  rustPackages = rustPackages_1_65;
+  rustPackages_1_66 = rust_1_66.packages.stable;
+  rustPackages = rustPackages_1_66;
 
   inherit (rustPackages) cargo clippy rustc rustPlatform;
 

From 931fc456ded386d80b81cd62730cda5c0631df99 Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Mon, 5 Dec 2022 13:15:08 +0300
Subject: [PATCH 110/231] shadow: 4.11.1 -> 4.13

---
 pkgs/os-specific/linux/shadow/default.nix | 33 +++++++++++------------
 1 file changed, 16 insertions(+), 17 deletions(-)

diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index c6fd417d0d6f..9ba8984bb032 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -10,22 +10,17 @@ let
     then glibcCross
     else assert stdenv.hostPlatform.libc == "glibc"; stdenv.cc.libc;
 
-  dots_in_usernames = fetchpatch {
-    url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-apps/shadow/files/shadow-4.1.3-dots-in-usernames.patch";
-    sha256 = "1fj3rg6x3jppm5jvi9y7fhd2djbi4nc5pgwisw00xlh4qapgz692";
-  };
-
 in
 
 stdenv.mkDerivation rec {
   pname = "shadow";
-  version = "4.11.1";
+  version = "4.13";
 
   src = fetchFromGitHub {
     owner = "shadow-maint";
-    repo = "shadow";
-    rev = "v${version}";
-    sha256 = "sha256-PxLX5V0t18JftT5wT41krNv18Ew7Kz3MfZkOi/80ODA=";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-L54DhdBYthfB9436t/XWXiqKhW7rfd0GLS7pYGB32rA=";
   };
 
   buildInputs = [ libxcrypt ]
@@ -34,13 +29,17 @@ stdenv.mkDerivation rec {
     docbook_xml_dtd_45 docbook_xsl flex bison itstool
     ];
 
-  patches =
-    [ ./keep-path.patch
-      # Obtain XML resources from XML catalog (patch adapted from gtk-doc)
-      ./respect-xml-catalog-files-var.patch
-      dots_in_usernames
-      ./runtime-shell.patch
-    ];
+  patches = [
+    ./keep-path.patch
+    # Obtain XML resources from XML catalog (patch adapted from gtk-doc)
+    ./respect-xml-catalog-files-var.patch
+    ./runtime-shell.patch
+    # Fix HAVE_SHADOWGRP configure check
+    (fetchpatch {
+      url = "https://github.com/shadow-maint/shadow/commit/a281f241b592aec636d1b93a99e764499d68c7ef.patch";
+      sha256 = "sha256-GJWg/8ggTnrbIgjI+HYa26DdVbjTHTk/IHhy7GU9G5w=";
+    })
+  ];
 
   RUNTIME_SHELL = runtimeShell;
 
@@ -49,7 +48,7 @@ stdenv.mkDerivation rec {
     ''sed 's/^\(s[ug]idperms\) = [0-9]755/\1 = 0755/' -i src/Makefile.am
     '';
 
-  outputs = [ "out" "su" "man" ];
+  outputs = [ "out" "su" "dev" "man" ];
 
   enableParallelBuilding = true;
 

From c72dd6887516c762d73dfb6ee35aad5ffb88a29f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?PedroHLC=20=E2=98=AD?= <root@pedrohlc.com>
Date: Fri, 16 Dec 2022 08:07:44 -0300
Subject: [PATCH 111/231] vulkan-headers: 1.3.231.0 -> 1.3.236.0

---
 pkgs/development/libraries/vulkan-headers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/vulkan-headers/default.nix b/pkgs/development/libraries/vulkan-headers/default.nix
index 47cdccf41fc1..b640941428d4 100644
--- a/pkgs/development/libraries/vulkan-headers/default.nix
+++ b/pkgs/development/libraries/vulkan-headers/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "vulkan-headers";
-  version = "1.3.231.0";
+  version = "1.3.236.0";
 
   nativeBuildInputs = [ cmake ];
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "sdk-${version}";
-    hash = "sha256-EoD48jBoJmIet4BDC6bYxOsKK2358SZ/NcZeM61q/5g=";
+    hash = "sha256-b1q9QugFH4lieS8CTOyZ3uoQ7bd44G8NPEwRtUPD+24=";
   };
 
   meta = with lib; {

From 7a28a0b6593403633b93c8396818fb78f610f768 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?PedroHLC=20=E2=98=AD?= <root@pedrohlc.com>
Date: Fri, 16 Dec 2022 08:08:37 -0300
Subject: [PATCH 112/231] spirv-headers: 1.3.231.0 -> 1.3.236.0

---
 pkgs/development/libraries/spirv-headers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/spirv-headers/default.nix b/pkgs/development/libraries/spirv-headers/default.nix
index 8abdea5249b7..78dc373d4ab6 100644
--- a/pkgs/development/libraries/spirv-headers/default.nix
+++ b/pkgs/development/libraries/spirv-headers/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-headers";
-  version = "1.3.231.0";
+  version = "1.3.236.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
     rev = "sdk-${version}";
-    hash = "sha256-lUWgZYGPu+IaLUrbtyC7R0o3Hq/q7C7BE8r7DAsiC30=";
+    hash = "sha256-eWI1MyIWxcg1JepRsnHBmitehDigDa+dR8kXvIkYejY=";
   };
 
   nativeBuildInputs = [ cmake ];

From 705ca8e2b23a5c8595bc49798203d0192ed5112b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?PedroHLC=20=E2=98=AD?= <root@pedrohlc.com>
Date: Fri, 16 Dec 2022 08:09:15 -0300
Subject: [PATCH 113/231] spirv-tools: 1.3.231.0 -> 1.3.236.0

---
 pkgs/development/tools/spirv-tools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/spirv-tools/default.nix b/pkgs/development/tools/spirv-tools/default.nix
index 7edba948586e..6f95ded63e15 100644
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-tools";
-  version = "1.3.231.0";
+  version = "1.3.236.0";
 
   src = (assert version == spirv-headers.version;
     fetchFromGitHub {
       owner = "KhronosGroup";
       repo = "SPIRV-Tools";
       rev = "sdk-${version}";
-      hash = "sha256-sqjQoz9v9alSPc0ujEcWZxDAWh2S6oAPP1+JZmNCpA0=";
+      hash = "sha256-BV7V/jS782zdvtuw/wNY5fyAdx8Z2niWSocNaW0Atho=";
     }
   );
 

From ca81eb8452393ef7380b0f33708e3a664bc4d188 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?PedroHLC=20=E2=98=AD?= <root@pedrohlc.com>
Date: Fri, 16 Dec 2022 08:09:40 -0300
Subject: [PATCH 114/231] glslang: 1.3.231.0 -> 1.3.236.0

---
 pkgs/development/compilers/glslang/default.nix | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/compilers/glslang/default.nix b/pkgs/development/compilers/glslang/default.nix
index d93f647f8462..f5f46ff9f4f7 100644
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "glslang";
-  version = "1.3.231.0";
+  version = "1.3.236.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     rev = "sdk-${version}";
-    hash = "sha256-huPrQr+lPi7QCF8CufAavHEKGDDimGrcskiojhH9QYk=";
+    hash = "sha256-iVcx1j7OMJEU4cPydNwQSFufTUiqq7GKp69Y6pEt7Wc=";
   };
 
   # These get set at all-packages, keep onto them for child drvs
@@ -28,12 +28,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake python3 bison jq ];
 
   patches = [
-    # https://github.com/NixOS/nixpkgs/pull/201747
-    (fetchpatch {
-      name = "Fix-locations-of-cmake-files-in-side-compat-shims.patch";
-      url = "https://github.com/KhronosGroup/glslang/commit/88fd417b0bb7d91755961c70e846d274c182f2b0.patch";
-      hash = "sha256-rjeaPX5Ieem6zkICNvPd2SjvvLzG5wBERZfDLZEJsAk=";
-    })
     (fetchpatch {
       name = "Use-CMAKE_INSTALL_FULL_LIBDIR-in-compat-cmake-files.patch";
       url = "https://github.com/KhronosGroup/glslang/commit/7627bd89583c5aafb8b38c81c15494019271fabf.patch";

From c08c7dda802473d436e199518e2b240e0d500b20 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?PedroHLC=20=E2=98=AD?= <root@pedrohlc.com>
Date: Fri, 16 Dec 2022 08:10:04 -0300
Subject: [PATCH 115/231] vulkan-loader: 1.3.231.0 -> 1.3.236.0

---
 pkgs/development/libraries/vulkan-loader/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/vulkan-loader/default.nix b/pkgs/development/libraries/vulkan-loader/default.nix
index 27c1423d94e5..8d38f725a64d 100644
--- a/pkgs/development/libraries/vulkan-loader/default.nix
+++ b/pkgs/development/libraries/vulkan-loader/default.nix
@@ -3,14 +3,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-loader";
-  version = "1.3.231.0";
+  version = "1.3.236.0";
 
   src = (assert version == vulkan-headers.version;
     fetchFromGitHub {
       owner = "KhronosGroup";
       repo = "Vulkan-Loader";
       rev = "sdk-${version}";
-      hash = "sha256-HWaa3JT0znhvqbvZdcsAwy8Dr6HDQp4rgpVmMOuCo0s=";
+      hash = "sha256-Y6OakowZlb40ZatITQCFBK/qSZqSdgTNew1XUFD/jMo=";
     });
 
   patches = [ ./fix-pkgconfig.patch ];

From 57e6c338f17f8565334da75da88b302403a241c5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?PedroHLC=20=E2=98=AD?= <root@pedrohlc.com>
Date: Fri, 16 Dec 2022 08:10:33 -0300
Subject: [PATCH 116/231] vulkan-validation-layers: 1.3.231.0 -> 1.3.236.0

---
 pkgs/development/tools/vulkan-validation-layers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/vulkan-validation-layers/default.nix b/pkgs/development/tools/vulkan-validation-layers/default.nix
index 4f6a766e5e96..17e898301956 100644
--- a/pkgs/development/tools/vulkan-validation-layers/default.nix
+++ b/pkgs/development/tools/vulkan-validation-layers/default.nix
@@ -22,7 +22,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "vulkan-validation-layers";
-  version = "1.3.231.0";
+  version = "1.3.236.0";
 
   # If we were to use "dev" here instead of headers, the setupHook would be
   # placed in that output instead of "out".
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
       owner = "KhronosGroup";
       repo = "Vulkan-ValidationLayers";
       rev = "sdk-${version}";
-      hash = "sha256-5bzUauu8081zyRaWmRUtOxHjUU4gc1GWoJtU783Msh0=";
+      hash = "sha256-+VbiXtxzYaF5o+wIrJ+09LmgBdaLv/0VJGFDnBkrXms=";
     });
 
   # Include absolute paths to layer libraries in their associated

From 4beaa32eaec4d8401f753ee846c0bc774867f4ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?PedroHLC=20=E2=98=AD?= <root@pedrohlc.com>
Date: Fri, 16 Dec 2022 08:11:16 -0300
Subject: [PATCH 117/231] vulkan-tools: 1.3.231.0 -> 1.3.236.0

---
 pkgs/tools/graphics/vulkan-tools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/graphics/vulkan-tools/default.nix b/pkgs/tools/graphics/vulkan-tools/default.nix
index cb3fb8456a8d..8e94997db6c8 100644
--- a/pkgs/tools/graphics/vulkan-tools/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.3.231.0";
+  version = "1.3.236.0";
 
   # It's not strictly necessary to have matching versions here, however
   # since we're using the SDK version we may as well be consistent with
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
       owner = "KhronosGroup";
       repo = "Vulkan-Tools";
       rev = "sdk-${version}";
-      hash = "sha256-6oimP4ISa0dX4bLU3Nch8Ur6MzEMQscnL8EfRrqT/Es=";
+      hash = "sha256-PmNTpdAkXJkARLohRtUOuKTZPoKgeVF4DAo1wsAq5xE=";
     });
 
   nativeBuildInputs = [

From eaaafb78663b8c988f8f77a02d13cc654a277bb9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?PedroHLC=20=E2=98=AD?= <root@pedrohlc.com>
Date: Fri, 16 Dec 2022 08:13:24 -0300
Subject: [PATCH 118/231] vulkan-extension-layer: 1.3.231.0 -> 1.3.236.0

---
 pkgs/tools/graphics/vulkan-extension-layer/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/graphics/vulkan-extension-layer/default.nix b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
index 6a8056dfe41d..bf60e8ed85f3 100644
--- a/pkgs/tools/graphics/vulkan-extension-layer/default.nix
+++ b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-extension-layer";
-  version = "1.3.231.0";
+  version = "1.3.236.0";
 
   src = (assert version == vulkan-headers.version;
     fetchFromGitHub {
       owner = "KhronosGroup";
       repo = "Vulkan-ExtensionLayer";
       rev = "sdk-${version}";
-      hash = "sha256-8Z9w+3WFPYp8QKEUVkEQCGy9LXMWYlZDgGt8i34T5DU=";
+      hash = "sha256-NlBS7UuV2AZPY5VyoqTnTf63M7fHIPQDZRtMZ4XwMzA=";
     });
 
   nativeBuildInputs = [ cmake jq ];

From d9f6f43d2b4be0a324e05cd10902fde374570e25 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?PedroHLC=20=E2=98=AD?= <root@pedrohlc.com>
Date: Fri, 16 Dec 2022 08:15:49 -0300
Subject: [PATCH 119/231] vulkan-tools-lunarg: 1.3.231.0 -> 1.3.236.0

---
 pkgs/tools/graphics/vulkan-tools-lunarg/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
index e8d3907251ba..11cef8eeb886 100644
--- a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
@@ -11,6 +11,7 @@
 , libffi
 , libxcb
 , wayland
+, which
 , xcbutilkeysyms
 , xcbutilwm
 , vulkan-headers
@@ -23,18 +24,18 @@
 stdenv.mkDerivation rec {
   pname = "vulkan-tools-lunarg";
   # The version must match that in vulkan-headers
-  version = "1.3.231.0";
+  version = "1.3.236.0";
 
   src = (assert version == vulkan-headers.version;
     fetchFromGitHub {
       owner = "LunarG";
       repo = "VulkanTools";
       rev = "sdk-${version}";
-      hash = "sha256-qomhouuKVv4Dat9Sv7X68Dw6bRnaUjj6iEXC9pCqX4E=";
+      hash = "sha256-0dGD3InmEd9hO8+uVGMqBHXXfyX8tswyuOaZCftudz0=";
       fetchSubmodules = true;
     });
 
-  nativeBuildInputs = [ cmake python3 jq ];
+  nativeBuildInputs = [ cmake python3 jq which ];
 
   buildInputs = [
     expat

From 620c7eaeeeaed47156d51b04e50ea220614cfa62 Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Fri, 16 Dec 2022 23:17:24 +0100
Subject: [PATCH 120/231] python310Packages.tomlkit: 0.11.4 -> 0.11.6

---
 pkgs/development/python-modules/tomlkit/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tomlkit/default.nix b/pkgs/development/python-modules/tomlkit/default.nix
index 6bd461db75a2..03ccef3a7832 100644
--- a/pkgs/development/python-modules/tomlkit/default.nix
+++ b/pkgs/development/python-modules/tomlkit/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "tomlkit";
-  version = "0.11.4";
+  version = "0.11.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-MjWpAQ+uVDI+cnw6wG+3IHUv5mNbNCbjedrsYPvUSoM=";
+    hash = "sha256-cblS5XIWiJN/sCz501TbzweFBmFJ0oVeRFMevdK2XXM=";
   };
 
   propagatedBuildInputs =
@@ -30,6 +30,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     homepage = "https://github.com/sdispater/tomlkit";
+    changelog = "https://github.com/sdispater/tomlkit/blob/${version}/CHANGELOG.md";
     description = "Style-preserving TOML library for Python";
     license = licenses.mit;
     maintainers = with maintainers; [ jakewaksbaum ];

From 0e32191623d9827d58b627a9cb0f2a37756c77ff Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Tue, 6 Dec 2022 21:23:56 +0300
Subject: [PATCH 121/231] shadow: add tcb support

---
 pkgs/os-specific/linux/shadow/default.nix     |  8 ++++--
 .../linux/shadow/fix-install-with-tcb.patch   | 28 +++++++++++++++++++
 2 files changed, 34 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/os-specific/linux/shadow/fix-install-with-tcb.patch

diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index 9ba8984bb032..96dfd3b4bd8f 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv, nixosTests, fetchpatch, fetchFromGitHub, autoreconfHook, libxslt
 , libxml2 , docbook_xml_dtd_45, docbook_xsl, itstool, flex, bison, runtimeShell
 , libxcrypt, pam ? null, glibcCross ? null
+, withTcb ? stdenv.isLinux, tcb
 }:
 
 let
@@ -24,7 +25,8 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ libxcrypt ]
-    ++ lib.optional (pam != null && stdenv.isLinux) pam;
+    ++ lib.optional (pam != null && stdenv.isLinux) pam
+    ++ lib.optional withTcb tcb;
   nativeBuildInputs = [autoreconfHook libxslt libxml2
     docbook_xml_dtd_45 docbook_xsl flex bison itstool
     ];
@@ -34,6 +36,7 @@ stdenv.mkDerivation rec {
     # Obtain XML resources from XML catalog (patch adapted from gtk-doc)
     ./respect-xml-catalog-files-var.patch
     ./runtime-shell.patch
+    ./fix-install-with-tcb.patch
     # Fix HAVE_SHADOWGRP configure check
     (fetchpatch {
       url = "https://github.com/shadow-maint/shadow/commit/a281f241b592aec636d1b93a99e764499d68c7ef.patch";
@@ -64,7 +67,8 @@ stdenv.mkDerivation rec {
     "--with-group-name-max-length=32"
     "--with-bcrypt"
     "--with-yescrypt"
-  ] ++ lib.optional (stdenv.hostPlatform.libc != "glibc") "--disable-nscd";
+  ] ++ lib.optional (stdenv.hostPlatform.libc != "glibc") "--disable-nscd"
+    ++ lib.optional withTcb "--with-tcb";
 
   preBuild = lib.optionalString (stdenv.hostPlatform.libc == "glibc")
     ''
diff --git a/pkgs/os-specific/linux/shadow/fix-install-with-tcb.patch b/pkgs/os-specific/linux/shadow/fix-install-with-tcb.patch
new file mode 100644
index 000000000000..ff6166b92f1d
--- /dev/null
+++ b/pkgs/os-specific/linux/shadow/fix-install-with-tcb.patch
@@ -0,0 +1,28 @@
+diff --git a/src/Makefile.am b/src/Makefile.am
+index a1a2e4e..fa17f9d 100644
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -74,10 +74,6 @@ suidubins += newgidmap newuidmap
+ endif
+ endif
+ 
+-if WITH_TCB
+-shadowsgidubins = passwd
+-endif
+-
+ LDADD          = $(INTLLIBS) \
+ 		 $(top_builddir)/libmisc/libmisc.la \
+ 		 $(top_builddir)/lib/libshadow.la \
+@@ -146,12 +142,6 @@ install-am: all-am
+ 	set -e; for i in $(suidusbins); do \
+ 		chmod $(suidperms) $(DESTDIR)$(usbindir)/$$i; \
+ 	done
+-if WITH_TCB
+-	set -e; for i in $(shadowsgidubins); do \
+-		chown root:shadow $(DESTDIR)$(ubindir)/$$i; \
+-		chmod $(sgidperms) $(DESTDIR)$(ubindir)/$$i; \
+-	done
+-endif
+ if ENABLE_SUBIDS
+ if FCAPS
+ 	setcap cap_setuid+ep $(DESTDIR)$(ubindir)/newuidmap

From 05046655d84faf0fc6031bf78a384160050a3fc0 Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Sat, 17 Dec 2022 08:09:41 +0300
Subject: [PATCH 122/231] shadow: cleanup

---
 pkgs/os-specific/linux/shadow/default.nix | 67 ++++++++++++-----------
 1 file changed, 35 insertions(+), 32 deletions(-)

diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index 96dfd3b4bd8f..2d0e60716290 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -1,14 +1,16 @@
-{ lib, stdenv, nixosTests, fetchpatch, fetchFromGitHub, autoreconfHook, libxslt
-, libxml2 , docbook_xml_dtd_45, docbook_xsl, itstool, flex, bison, runtimeShell
-, libxcrypt, pam ? null, glibcCross ? null
+{ lib, stdenv, fetchFromGitHub
+, runtimeShell, nixosTests, fetchpatch
+, autoreconfHook, bison, flex
+, docbook_xml_dtd_45, docbook_xsl
+, itstool , libxml2, libxslt
+, libxcrypt
+, glibcCross ? null
+, pam ? null
 , withTcb ? stdenv.isLinux, tcb
 }:
-
 let
-
   glibc =
-    if stdenv.hostPlatform != stdenv.buildPlatform
-    then glibcCross
+    if stdenv.hostPlatform != stdenv.buildPlatform then glibcCross
     else assert stdenv.hostPlatform.libc == "glibc"; stdenv.cc.libc;
 
 in
@@ -24,12 +26,19 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-L54DhdBYthfB9436t/XWXiqKhW7rfd0GLS7pYGB32rA=";
   };
 
+  outputs = [ "out" "su" "dev" "man" ];
+
+  RUNTIME_SHELL = runtimeShell;
+
+  nativeBuildInputs = [
+    autoreconfHook bison flex
+    docbook_xml_dtd_45 docbook_xsl
+    itstool libxml2 libxslt
+  ];
+
   buildInputs = [ libxcrypt ]
     ++ lib.optional (pam != null && stdenv.isLinux) pam
     ++ lib.optional withTcb tcb;
-  nativeBuildInputs = [autoreconfHook libxslt libxml2
-    docbook_xml_dtd_45 docbook_xsl flex bison itstool
-    ];
 
   patches = [
     ./keep-path.patch
@@ -44,16 +53,10 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  RUNTIME_SHELL = runtimeShell;
-
   # The nix daemon often forbids even creating set[ug]id files.
-  postPatch =
-    ''sed 's/^\(s[ug]idperms\) = [0-9]755/\1 = 0755/' -i src/Makefile.am
-    '';
-
-  outputs = [ "out" "su" "dev" "man" ];
-
-  enableParallelBuilding = true;
+  postPatch = ''
+    sed 's/^\(s[ug]idperms\) = [0-9]755/\1 = 0755/' -i src/Makefile.am
+  '';
 
   # Assume System V `setpgrp (void)', which is the default on GNU variants
   # (`AC_FUNC_SETPGRP' is not cross-compilation capable.)
@@ -70,21 +73,21 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional (stdenv.hostPlatform.libc != "glibc") "--disable-nscd"
     ++ lib.optional withTcb "--with-tcb";
 
-  preBuild = lib.optionalString (stdenv.hostPlatform.libc == "glibc")
-    ''
-      substituteInPlace lib/nscd.c --replace /usr/sbin/nscd ${glibc.bin}/bin/nscd
-    '';
+  preBuild = lib.optionalString (stdenv.hostPlatform.libc == "glibc") ''
+    substituteInPlace lib/nscd.c --replace /usr/sbin/nscd ${glibc.bin}/bin/nscd
+  '';
 
-  postInstall =
-    ''
-      # Don't install ‘groups’, since coreutils already provides it.
-      rm $out/bin/groups
-      rm $man/share/man/man1/groups.*
+  postInstall = ''
+    # Don't install ‘groups’, since coreutils already provides it.
+    rm $out/bin/groups
+    rm $man/share/man/man1/groups.*
 
-      # Move the su binary into the su package
-      mkdir -p $su/bin
-      mv $out/bin/su $su/bin
-    '';
+    # Move the su binary into the su package
+    mkdir -p $su/bin
+    mv $out/bin/su $su/bin
+  '';
+
+  enableParallelBuilding = true;
 
   disallowedReferences = lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) stdenv.shellPackage;
 

From 0b067316d40845426bc6f6dd44aa74c0b7f66028 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Sat, 17 Dec 2022 12:55:44 +0100
Subject: [PATCH 123/231] stdenv: use `intersectAttrs` instead of
 `intersectLists`

Better complexity.
---
 pkgs/stdenv/generic/make-derivation.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index db6d7e83f595..34bd70ad2624 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -483,7 +483,7 @@ else let
 
   checkedEnv =
     let
-      overlappingNames = lib.intersectLists (lib.attrNames env) (lib.attrNames derivationArg);
+      overlappingNames = lib.attrNames (builtins.intersectAttrs env derivationArg);
     in
     assert lib.assertMsg envIsExportable
       "When using structured attributes, `env` must be an attribute set of environment variables.";

From 428107f8376695a51c2eb1376ca968f781cf965f Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 17 Dec 2022 22:21:07 +0000
Subject: [PATCH 124/231] stdenv: set `enableParallelBuilding` explicitly if
 `enableParallelBuildingByDefault` is set

Without the change we don't propagate `enableParallelBuilding = true`
and leave most builds sequential.

Noticed on `mythtv` package which did not specify parallelism and
`config.enableParallelBuildingByDefault = true` had no effect.
---
 pkgs/stdenv/generic/make-derivation.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 34bd70ad2624..81fc31d67289 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -418,6 +418,7 @@ else let
       outputHashAlgo = attrs.outputHashAlgo or "sha256";
       outputHashMode = attrs.outputHashMode or "recursive";
     } // lib.optionalAttrs (enableParallelBuilding) {
+      inherit enableParallelBuilding;
       enableParallelChecking = attrs.enableParallelChecking or true;
     } // lib.optionalAttrs (hardeningDisable != [] || hardeningEnable != [] || stdenv.hostPlatform.isMusl) {
       NIX_HARDENING_ENABLE = enabledHardeningOptions;

From d8b734f6a4658b004711c98370d673d6e6317be6 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 18 Dec 2022 13:02:10 +0000
Subject: [PATCH 125/231] pciutils: add trivial updater

---
 pkgs/tools/system/pciutils/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/tools/system/pciutils/default.nix b/pkgs/tools/system/pciutils/default.nix
index 66bcde737146..af49aaba8fb4 100644
--- a/pkgs/tools/system/pciutils/default.nix
+++ b/pkgs/tools/system/pciutils/default.nix
@@ -2,6 +2,7 @@
 , hwdata
 , static ? stdenv.hostPlatform.isStatic
 , IOKit
+, gitUpdater
 }:
 
 stdenv.mkDerivation rec {
@@ -43,6 +44,12 @@ stdenv.mkDerivation rec {
     cp --reflink=auto ${hwdata}/share/hwdata/pci.ids $out/share/pci.ids
   '';
 
+  passthru.updateScript = gitUpdater {
+    # No nicer place to find latest release.
+    url = "https://github.com/pciutils/pciutils.git";
+    rev-prefix = "v";
+  };
+
   meta = with lib; {
     homepage = "https://mj.ucw.cz/sw/pciutils/";
     description = "A collection of programs for inspecting and manipulating configuration of PCI devices";

From 21337279c1478c3660b9be1fd05c2a27a60ff962 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 18 Dec 2022 13:04:38 +0000
Subject: [PATCH 126/231] pciutils: 3.8.0 -> 3.9.0

Changes: https://github.com/pciutils/pciutils/compare/v3.8.0...v3.9.0
---
 pkgs/tools/system/pciutils/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/system/pciutils/default.nix b/pkgs/tools/system/pciutils/default.nix
index af49aaba8fb4..9b0b09066438 100644
--- a/pkgs/tools/system/pciutils/default.nix
+++ b/pkgs/tools/system/pciutils/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pciutils";
-  version = "3.8.0"; # with release-date database
+  version = "3.9.0"; # with release-date database
 
   src = fetchurl {
     url = "mirror://kernel/software/utils/pciutils/pciutils-${version}.tar.xz";
-    sha256 = "sha256-ke29BCmoRwXJrRVtT/OMzHJNQepUxMW4jjjplvijTwU=";
+    sha256 = "sha256-zep66XI53uIySaCcaKGaKHo/EJ++ssIy67YWyzhZkBI=";
   };
 
   nativeBuildInputs = [ pkg-config ];

From 73e6d3ed00b6452eb55cc7f9c40c00c6deba0320 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 18 Dec 2022 13:28:51 +0000
Subject: [PATCH 127/231] xz: 5.2.9 -> 5.4.0

Changes: https://git.tukaani.org/?p=xz.git;a=blob;f=NEWS;hb=HEAD

While at it fixed the updater to pick single first (most recent)
version.
---
 pkgs/tools/compression/xz/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/compression/xz/default.nix b/pkgs/tools/compression/xz/default.nix
index abc19356c950..59f1901bd9fd 100644
--- a/pkgs/tools/compression/xz/default.nix
+++ b/pkgs/tools/compression/xz/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xz";
-  version = "5.2.9";
+  version = "5.4.0";
 
   src = fetchurl {
     url = "https://tukaani.org/xz/xz-${version}.tar.bz2";
-    sha256 = "sZRQf7o6Rip1PFUxSczaoWgze8t97v3dBnuph8g9/OY=";
+    sha256 = "eV6gSUxm1QmwUt3DbcY71jTln/Kg85wWo7VkTdAdh+Y=";
   };
 
   strictDeps = true;
@@ -45,7 +45,8 @@ stdenv.mkDerivation rec {
       # Expect the text in format of '>xz-5.2.6.tar.bz2</a>'
       # We pick first match where a stable release goes first.
       new_version="$(curl -s https://tukaani.org/xz/ |
-          pcregrep -o1 '>xz-([0-9.]+)[.]tar[.]bz2</a>')"
+          pcregrep -o1 '>xz-([0-9.]+)[.]tar[.]bz2</a>' |
+          head -n1)"
       update-source-version ${pname} "$new_version"
     '';
   };

From d1e7498dbbc7d8fe5419110aa1f1fe57ffb8d1d8 Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Fri, 16 Dec 2022 23:17:11 +0100
Subject: [PATCH 128/231] commitizen: 2.37.0 -> 2.38.0

---
 pkgs/applications/version-management/commitizen/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/version-management/commitizen/default.nix b/pkgs/applications/version-management/commitizen/default.nix
index 3c0cf0ecec04..115912f71a3b 100644
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@@ -18,17 +18,18 @@
 , typing-extensions
 , argcomplete
 , nix-update-script
+, pre-commit
 }:
 
 buildPythonApplication rec {
   pname = "commitizen";
-  version = "2.37.0";
+  version = "2.38.0";
 
   src = fetchFromGitHub {
     owner = "commitizen-tools";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-wo1I6QDWLxByHISmkPdass+BcKh0oxR5hD31UN/5+WQ=";
+    hash = "sha256-Fri5WdLfDCn3NOtCGneKnAN+eOkLAJgPYBR+WBmc/bo=";
     deepClone = true;
   };
 
@@ -52,6 +53,7 @@ buildPythonApplication rec {
   doCheck = true;
 
   checkInputs = [
+    pre-commit
     pytestCheckHook
     pytest-freezegun
     pytest-mock

From 61ac4200206f23026e198aa98779f28ae05ba389 Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Sun, 18 Dec 2022 02:02:35 -0600
Subject: [PATCH 129/231] sphinx-automodapi: fix tests

---
 pkgs/development/python-modules/sphinx-automodapi/default.nix | 3 +++
 pkgs/top-level/python-packages.nix                            | 4 +++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/sphinx-automodapi/default.nix b/pkgs/development/python-modules/sphinx-automodapi/default.nix
index c8b586d0fc6e..9145cc416e79 100644
--- a/pkgs/development/python-modules/sphinx-automodapi/default.nix
+++ b/pkgs/development/python-modules/sphinx-automodapi/default.nix
@@ -36,6 +36,9 @@ buildPythonPackage rec {
   postPatch = ''
     substituteInPlace "sphinx_automodapi/tests/helpers.py" \
       --replace '[0]), None)' "[0]), (None, '${testInventory}'))"
+
+    substituteInPlace "sphinx_automodapi/tests/test_cases.py" \
+      --replace '[0]), None)' "[0]), (None, '${testInventory}'))"
   '';
 
   checkInputs = [
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 077c04a8c2f1..b01fe6539998 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10571,7 +10571,9 @@ self: super: with self; {
 
   spinners = callPackage ../development/python-modules/spinners { };
 
-  sphinx-automodapi = callPackage ../development/python-modules/sphinx-automodapi { };
+  sphinx-automodapi = callPackage ../development/python-modules/sphinx-automodapi {
+    graphviz = pkgs.graphviz;
+  };
 
   sphinx-better-theme = callPackage ../development/python-modules/sphinx-better-theme { };
 

From 7f864b4a32f0c556e85400d6b0a7659576c48045 Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Sun, 11 Dec 2022 20:28:53 -0600
Subject: [PATCH 130/231] lit: 14.0.0 -> 15.0.6

---
 pkgs/development/tools/misc/lit/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/misc/lit/default.nix b/pkgs/development/tools/misc/lit/default.nix
index aa991e8ea978..5a255df46806 100644
--- a/pkgs/development/tools/misc/lit/default.nix
+++ b/pkgs/development/tools/misc/lit/default.nix
@@ -2,11 +2,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "lit";
-  version = "14.0.0";
+  version = "15.0.6";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "45e08ce87b0ea56ab632aa02fa857418a5dd241a711c7c756878b73a130c3efe";
+    hash = "sha256-S06OQfDmDyutls21HxyQ016ku3FTTsDOP8Di67d9f+k=";
   };
 
   passthru = {
@@ -14,6 +14,9 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   # Non-standard test suite. Needs custom checkPhase.
+  # Needs LLVM's `FileCheck` and `not`: `$out/bin/lit tests`
+  # There should be `llvmPackages.lit` since older LLVM versions may
+  # have the possibility of not correctly interfacing with newer lit versions
   doCheck = false;
 
   meta = {

From 8be466f7444daaef4d308a46dae2671c006a9cdb Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Mon, 12 Dec 2022 04:42:41 -0600
Subject: [PATCH 131/231] spirv-llvm-translator: allow rocm versioning

---
 .../compilers/spirv-llvm-translator/default.nix    | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/compilers/spirv-llvm-translator/default.nix b/pkgs/development/compilers/spirv-llvm-translator/default.nix
index 971b3e8399df..052df63aecb0 100644
--- a/pkgs/development/compilers/spirv-llvm-translator/default.nix
+++ b/pkgs/development/compilers/spirv-llvm-translator/default.nix
@@ -10,12 +10,14 @@
 
 let
   llvmMajor = lib.versions.major llvm.version;
+  isROCm = lib.hasPrefix "rocm" llvm.pname;
 
+  # ROCm will always be at the latest version
   branch =
-    if llvmMajor == "15" then rec {
+    if llvmMajor == "15" || isROCm then rec {
       version = "15.0.0";
       rev = "v${version}";
-      hash = "sha256-111yL6Wh8hykoGz1QmT1F7lfGDEmG4U3iqmqrJxizOg=";
+      hash = "sha256-OsDohXRxovtEXaWiRGp8gJ0dXmoALyO+ZimeSO8aPVI=";
     } else if llvmMajor == "14" then rec{
       version = "14.0.0";
       rev = "v${version}";
@@ -36,15 +38,17 @@ stdenv.mkDerivation {
     inherit (branch) rev hash;
   };
 
-  nativeBuildInputs = [ pkg-config cmake llvm.dev spirv-tools ];
+  nativeBuildInputs = [ pkg-config cmake spirv-tools ]
+    ++ (if isROCm then [ llvm ] else [ llvm.dev ]);
 
-  buildInputs = [ spirv-headers llvm ];
+  buildInputs = [ spirv-headers ]
+    ++ lib.optionals (!isROCm) [ llvm ];
 
   checkInputs = [ lit ];
 
   cmakeFlags = [
     "-DLLVM_INCLUDE_TESTS=ON"
-    "-DLLVM_DIR=${llvm.dev}"
+    "-DLLVM_DIR=${(if isROCm then llvm else llvm.dev)}"
     "-DBUILD_SHARED_LIBS=YES"
     "-DLLVM_SPIRV_BUILD_EXTERNAL=YES"
     # RPATH of binary /nix/store/.../bin/llvm-spirv contains a forbidden reference to /build/

From 3b271b7ebc25648daa08997e7758dad11e321d21 Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Mon, 12 Dec 2022 16:50:22 -0600
Subject: [PATCH 132/231] python3Packages: sphinx-markdown-tables: init at
 0.0.17

---
 .../sphinx-markdown-tables/default.nix        | 30 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 32 insertions(+)
 create mode 100644 pkgs/development/python-modules/sphinx-markdown-tables/default.nix

diff --git a/pkgs/development/python-modules/sphinx-markdown-tables/default.nix b/pkgs/development/python-modules/sphinx-markdown-tables/default.nix
new file mode 100644
index 000000000000..55fb0b41f43e
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-markdown-tables/default.nix
@@ -0,0 +1,30 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, sphinx
+, markdown
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-markdown-tables";
+  version = "0.0.17";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-a8bT1ADqzP7r0ohEa8CN2DCDNnxYuF1A/mwS1371kvE=";
+  };
+
+  propagatedBuildInputs = [
+    sphinx
+    markdown
+  ];
+
+  pythonImportsCheck = [ "sphinx_markdown_tables" ];
+
+  meta = with lib; {
+    description = "Sphinx extension for rendering tables written in markdown";
+    homepage = "https://github.com/ryanfox/sphinx-markdown-tables";
+    maintainers = with maintainers; [ Madouura ];
+    license = licenses.gpl3;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b01fe6539998..b14d5cd23b8b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10679,6 +10679,8 @@ self: super: with self; {
 
   sphinx-markdown-parser = callPackage ../development/python-modules/sphinx-markdown-parser { };
 
+  sphinx-markdown-tables = callPackage ../development/python-modules/sphinx-markdown-tables { };
+
   sphinx-material = callPackage ../development/python-modules/sphinx-material { };
 
   sphinx-navtree = callPackage ../development/python-modules/sphinx-navtree { };

From 0ee533a8e00d7131b7a7d5d6d5f605f18af07426 Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Sat, 10 Dec 2022 13:31:55 -0600
Subject: [PATCH 133/231] rocm-llvm: rewrite and separate

---
 .../compilers/llvm/rocm/0000-fix-openmp.patch |  18 +
 .../compilers/llvm/rocm/default.nix           | 620 ++++++++++++++++--
 pkgs/development/compilers/llvm/rocm/llvm.nix | 202 ++++--
 pkgs/top-level/all-packages.nix               |   1 +
 4 files changed, 737 insertions(+), 104 deletions(-)
 create mode 100644 pkgs/development/compilers/llvm/rocm/0000-fix-openmp.patch

diff --git a/pkgs/development/compilers/llvm/rocm/0000-fix-openmp.patch b/pkgs/development/compilers/llvm/rocm/0000-fix-openmp.patch
new file mode 100644
index 000000000000..2811df7d29f7
--- /dev/null
+++ b/pkgs/development/compilers/llvm/rocm/0000-fix-openmp.patch
@@ -0,0 +1,18 @@
+diff --git a/libomptarget/plugins/amdgpu/impl/impl.cpp b/libomptarget/plugins/amdgpu/impl/impl.cpp
+index 80e024789..3a14e0889 100644
+--- a/libomptarget/plugins/amdgpu/impl/impl.cpp
++++ b/libomptarget/plugins/amdgpu/impl/impl.cpp
+@@ -21,10 +21,11 @@ bool is_locked(void *ptr, hsa_status_t *err_p, void **agentBaseAddress) {
+   info.size = sizeof(hsa_amd_pointer_info_t);
+   err = hsa_amd_pointer_info(ptr, &info, nullptr, nullptr, nullptr);
+ 
+-  if (err != HSA_STATUS_SUCCESS)
++  if (err != HSA_STATUS_SUCCESS) {
+     DP("Error when getting pointer info\n");
+-  else
++  } else {
+     is_locked = (info.type == HSA_EXT_POINTER_TYPE_LOCKED);
++  }
+ 
+   if (is_locked && agentBaseAddress != nullptr) {
+     // When user passes in a basePtr+offset we need to fix the
diff --git a/pkgs/development/compilers/llvm/rocm/default.nix b/pkgs/development/compilers/llvm/rocm/default.nix
index 7ff3c4bfa110..4f96c567a631 100644
--- a/pkgs/development/compilers/llvm/rocm/default.nix
+++ b/pkgs/development/compilers/llvm/rocm/default.nix
@@ -1,54 +1,600 @@
-{ stdenv, lib, buildPackages, fetchFromGitHub, callPackage, wrapCCWith, overrideCC }:
+{ lib
+, stdenv
+, callPackage
+, overrideCC
+, wrapCCWith
+, wrapBintoolsWith
+, runCommand
+, lit
+, glibc
+, spirv-llvm-translator
+, xz
+, swig
+, lua5_3
+, gtest
+, hipcc
+, rocm-comgr
+, vulkan-loader
+, vulkan-headers
+, glslang
+, shaderc
+, perl
+, rocm-device-libs
+, rocm-runtime
+, elfutils
+, python3Packages
+}:
 
 let
-  version = "5.4.0";
-  src = fetchFromGitHub {
-    owner = "RadeonOpenCompute";
-    repo = "llvm-project";
-    rev = "rocm-${version}";
-    hash = "sha256-rlVo77h344PLGj/mIzsw+/ndWywsBsiKDXsEDpWSUno=";
+  # Stage 1
+  # Base
+  llvm = callPackage ./llvm.nix { };
+
+  # Projects
+  clang-unwrapped = callPackage ./llvm.nix rec {
+    targetName = "clang";
+    targetDir = targetName;
+    extraBuildInputs = [ llvm ];
+
+    extraCMakeFlags = [
+      "-DCMAKE_POLICY_DEFAULT_CMP0116=NEW"
+      "-DCLANG_INCLUDE_DOCS=ON"
+      "-DCLANG_INCLUDE_TESTS=ON"
+    ];
+
+    extraPostPatch = ''
+      # Looks like they forgot to add finding libedit to the standalone build
+      ln -s ../cmake/Modules/FindLibEdit.cmake cmake/modules
+
+      substituteInPlace CMakeLists.txt \
+        --replace "include(CheckIncludeFile)" "include(CheckIncludeFile)''\nfind_package(LibEdit)"
+
+      # `No such file or directory: '/build/source/clang/tools/scan-build/bin/scan-build'`
+      rm test/Analysis/scan-build/*.test
+      rm test/Analysis/scan-build/rebuild_index/rebuild_index.test
+
+      # `does not depend on a module exporting 'baz.h'`
+      rm test/Modules/header-attribs.cpp
+
+      # `fatal error: 'stdio.h' file not found`
+      rm test/OpenMP/amdgcn_emit_llvm.c
+    '';
+
+    extraPostInstall = ''
+      mv bin/clang-tblgen $out/bin
+    '';
   };
+
+  lld = callPackage ./llvm.nix rec {
+    buildMan = false; # No man pages to build
+    targetName = "lld";
+    targetDir = targetName;
+    extraBuildInputs = [ llvm ];
+    extraCMakeFlags = [ "-DCMAKE_POLICY_DEFAULT_CMP0116=NEW" ];
+    checkTargets = [ "check-lld" ];
+  };
+
+  # Runtimes
+  runtimes = callPackage ./llvm.nix {
+    buildDocs = false;
+    buildMan = false;
+    buildTests = false;
+    targetDir = "runtimes";
+
+    targetRuntimes = [
+      # "libc" https://github.com/llvm/llvm-project/issues/57719
+      "libunwind"
+      "libcxxabi"
+      "libcxx"
+      "compiler-rt"
+    ];
+
+    extraBuildInputs = [ llvm ];
+
+    extraCMakeFlags = [
+      "-DCMAKE_POLICY_DEFAULT_CMP0114=NEW"
+      "-DLIBCXX_INCLUDE_BENCHMARKS=OFF"
+      "-DLIBCXX_CXX_ABI=libcxxabi"
+    ];
+
+    extraLicenses = [ lib.licenses.mit ];
+  };
+
+  # Stage 2
+  # Helpers
+  rStdenv = overrideCC stdenv (wrapCCWith rec {
+    inherit bintools;
+    libcxx = runtimes;
+    cc = clang-unwrapped;
+
+    extraPackages = [
+      llvm
+      lld
+    ];
+
+    nixSupport.cc-cflags = [
+      "-resource-dir=$out/resource-root"
+      "-fuse-ld=lld"
+      "-rtlib=compiler-rt"
+      "-unwindlib=libunwind"
+      "-Wno-unused-command-line-argument"
+    ];
+
+    extraBuildCommands = ''
+      clang_version=`${cc}/bin/clang -v 2>&1 | grep "clang version " | grep -E -o "[0-9.-]+"`
+      mkdir -p $out/resource-root
+      ln -s ${cc}/lib/clang/$clang_version/include $out/resource-root
+      ln -s ${runtimes}/lib $out/resource-root
+    '';
+  });
+
+  bintools = wrapBintoolsWith { bintools = bintools-unwrapped; };
+
+  bintools-unwrapped = runCommand "rocm-llvm-binutils-${llvm.version}" { preferLocalBuild = true; } ''
+    mkdir -p $out/bin
+
+    for prog in ${lld}/bin/*; do
+      ln -s $prog $out/bin/$(basename $prog)
+    done
+
+    for prog in ${llvm}/bin/*; do
+      ln -sf $prog $out/bin/$(basename $prog)
+    done
+
+    ln -s ${llvm}/bin/llvm-ar $out/bin/ar
+    ln -s ${llvm}/bin/llvm-as $out/bin/as
+    ln -s ${llvm}/bin/llvm-dwp $out/bin/dwp
+    ln -s ${llvm}/bin/llvm-nm $out/bin/nm
+    ln -s ${llvm}/bin/llvm-objcopy $out/bin/objcopy
+    ln -s ${llvm}/bin/llvm-objdump $out/bin/objdump
+    ln -s ${llvm}/bin/llvm-ranlib $out/bin/ranlib
+    ln -s ${llvm}/bin/llvm-readelf $out/bin/readelf
+    ln -s ${llvm}/bin/llvm-size $out/bin/size
+    ln -s ${llvm}/bin/llvm-strip $out/bin/strip
+    ln -s ${lld}/bin/lld $out/bin/ld
+  '';
 in rec {
+  inherit
+  llvm
+  clang-unwrapped
+  lld
+  bintools
+  bintools-unwrapped;
+
+  # Runtimes
+  libc = callPackage ./llvm.nix rec {
+    stdenv = rStdenv;
+    targetName = "libc";
+    targetDir = "runtimes";
+    targetRuntimes = [ targetName ];
+    isBroken = true; # https://github.com/llvm/llvm-project/issues/57719
+  };
+
+  libunwind = callPackage ./llvm.nix rec {
+    stdenv = rStdenv;
+    buildMan = false; # No man pages to build
+    targetName = "libunwind";
+    targetDir = "runtimes";
+    targetRuntimes = [ targetName ];
+
+    extraCMakeFlags = [
+      "-DLIBUNWIND_INCLUDE_DOCS=ON"
+      "-DLIBUNWIND_INCLUDE_TESTS=ON"
+      "-DLIBUNWIND_USE_COMPILER_RT=ON"
+    ];
+  };
+
+  libcxxabi = callPackage ./llvm.nix rec {
+    stdenv = rStdenv;
+    buildDocs = false; # No documentation to build
+    buildMan = false; # No man pages to build
+    targetName = "libcxxabi";
+    targetDir = "runtimes";
+
+    targetRuntimes = [
+      "libunwind"
+      targetName
+      "libcxx"
+    ];
+
+    extraCMakeFlags = [
+      "-DLIBCXXABI_INCLUDE_TESTS=ON"
+      "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
+      "-DLIBCXXABI_USE_COMPILER_RT=ON"
+
+      # Workaround having to build combined
+      "-DLIBUNWIND_INCLUDE_DOCS=OFF"
+      "-DLIBUNWIND_INCLUDE_TESTS=OFF"
+      "-DLIBUNWIND_USE_COMPILER_RT=ON"
+      "-DLIBUNWIND_INSTALL_LIBRARY=OFF"
+      "-DLIBUNWIND_INSTALL_HEADERS=OFF"
+      "-DLIBCXX_INCLUDE_DOCS=OFF"
+      "-DLIBCXX_INCLUDE_TESTS=OFF"
+      "-DLIBCXX_USE_COMPILER_RT=ON"
+      "-DLIBCXX_CXX_ABI=libcxxabi"
+      "-DLIBCXX_INSTALL_LIBRARY=OFF"
+      "-DLIBCXX_INSTALL_HEADERS=OFF"
+    ];
+  };
+
+  libcxx = callPackage ./llvm.nix rec {
+    stdenv = rStdenv;
+    buildMan = false; # No man pages to build
+    targetName = "libcxx";
+    targetDir = "runtimes";
+
+    targetRuntimes = [
+      "libunwind"
+      "libcxxabi"
+      targetName
+    ];
+
+    extraCMakeFlags = [
+      "-DLIBCXX_INCLUDE_DOCS=ON"
+      "-DLIBCXX_INCLUDE_TESTS=ON"
+      "-DLIBCXX_USE_COMPILER_RT=ON"
+      "-DLIBCXX_CXX_ABI=libcxxabi"
+
+      # Workaround having to build combined
+      "-DLIBUNWIND_INCLUDE_DOCS=OFF"
+      "-DLIBUNWIND_INCLUDE_TESTS=OFF"
+      "-DLIBUNWIND_USE_COMPILER_RT=ON"
+      "-DLIBUNWIND_INSTALL_LIBRARY=OFF"
+      "-DLIBUNWIND_INSTALL_HEADERS=OFF"
+      "-DLIBCXXABI_INCLUDE_TESTS=OFF"
+      "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
+      "-DLIBCXXABI_USE_COMPILER_RT=ON"
+      "-DLIBCXXABI_INSTALL_LIBRARY=OFF"
+      "-DLIBCXXABI_INSTALL_HEADERS=OFF"
+    ];
+
+    # Most of these can't find `bash` or `mkdir`, might just be hard-coded paths, or PATH is altered
+    extraPostPatch = ''
+      chmod +w -R ../libcxx/test/{libcxx,std}
+      rm -rf ../libcxx/test/libcxx/input.output/filesystems
+      rm ../libcxx/test/libcxx/selftest/remote-substitutions.sh.cpp
+      rm ../libcxx/test/std/input.output/file.streams/fstreams/filebuf.virtuals/pbackfail.pass.cpp
+      rm ../libcxx/test/std/localization/locales/locale.convenience/conversions/conversions.buffer/pbackfail.pass.cpp
+      rm ../libcxx/test/std/utilities/optional/optional.object/optional.object.assign/emplace_initializer_list.pass.cpp
+      rm ../libcxx/test/std/utilities/optional/optional.object/optional.object.assign/nullopt_t.pass.cpp
+      rm -rf ../libcxx/test/std/utilities/optional/optional.object/optional.object.ctor
+      rm -rf ../libcxx/test/std/input.output/filesystems/{class.directory_entry,class.directory_iterator,class.rec.dir.itr,fs.op.funcs}
+    '';
+  };
+
+  compiler-rt = callPackage ./llvm.nix rec {
+    stdenv = rStdenv;
+    buildDocs = false; # No documentation to build
+    buildMan = false; # No man pages to build
+    targetName = "compiler-rt";
+    targetDir = "runtimes";
+
+    targetRuntimes = [
+      "libunwind"
+      "libcxxabi"
+      "libcxx"
+      targetName
+    ];
+
+    extraCMakeFlags = [
+      "-DCMAKE_POLICY_DEFAULT_CMP0114=NEW"
+      "-DCOMPILER_RT_INCLUDE_TESTS=ON"
+      "-DCOMPILER_RT_USE_LLVM_UNWINDER=ON"
+      "-DCOMPILER_RT_CXX_LIBRARY=libcxx"
+      "-DCOMPILER_RT_CAN_EXECUTE_TESTS=OFF" # We can't run most of these
+
+      # Workaround having to build combined
+      "-DLIBUNWIND_INCLUDE_DOCS=OFF"
+      "-DLIBUNWIND_INCLUDE_TESTS=OFF"
+      "-DLIBUNWIND_USE_COMPILER_RT=ON"
+      "-DLIBUNWIND_INSTALL_LIBRARY=OFF"
+      "-DLIBUNWIND_INSTALL_HEADERS=OFF"
+      "-DLIBCXXABI_INCLUDE_TESTS=OFF"
+      "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
+      "-DLIBCXXABI_USE_COMPILER_RT=ON"
+      "-DLIBCXXABI_INSTALL_LIBRARY=OFF"
+      "-DLIBCXXABI_INSTALL_HEADERS=OFF"
+      "-DLIBCXX_INCLUDE_DOCS=OFF"
+      "-DLIBCXX_INCLUDE_TESTS=OFF"
+      "-DLIBCXX_USE_COMPILER_RT=ON"
+      "-DLIBCXX_CXX_ABI=libcxxabi"
+      "-DLIBCXX_INSTALL_LIBRARY=OFF"
+      "-DLIBCXX_INSTALL_HEADERS=OFF"
+    ];
+
+    extraPostPatch = ''
+      # `No such file or directory: 'ldd'`
+      substituteInPlace ../compiler-rt/test/lit.common.cfg.py \
+        --replace "'ldd'," "'${glibc.bin}/bin/ldd',"
+
+      # We can run these
+      substituteInPlace ../compiler-rt/test/CMakeLists.txt \
+        --replace "endfunction()" "endfunction()''\nadd_subdirectory(builtins)''\nadd_subdirectory(shadowcallstack)"
+    '';
+
+    extraLicenses = [ lib.licenses.mit ];
+  };
+
+  # Stage 3
+  # Helpers
+  rocmClangStdenv = overrideCC stdenv clang;
+
   clang = wrapCCWith rec {
-    cc = llvm;
+    # inherit libc libcxx bintools;
+    inherit libcxx bintools;
+
+    # We do this to avoid HIP pathing problems, and mimic a monolithic install
+    cc = stdenv.mkDerivation (finalAttrs: {
+      inherit (clang-unwrapped) pname version;
+      dontUnpack = true;
+
+      installPhase = ''
+        runHook preInstall
+
+        clang_version=`${clang-unwrapped}/bin/clang -v 2>&1 | grep "clang version " | grep -E -o "[0-9.-]+"`
+        mkdir -p $out/{bin,include/c++/v1,lib/{cmake,clang/$clang_version/{include,lib}},libexec,share}
+
+        for path in ${llvm} ${clang-unwrapped} ${lld} ${libunwind} ${libcxxabi} ${libcxx} ${compiler-rt}; do
+          cp -as $path/* $out
+          chmod +w $out/{*,include/c++/v1,lib/{clang/$clang_version/include,cmake}}
+          rm -f $out/lib/libc++.so
+        done
+
+        ln -s $out/lib/* $out/lib/clang/$clang_version/lib
+        ln -s $out/include/* $out/lib/clang/$clang_version/include
+
+        runHook postInstall
+      '';
+
+      passthru.isClang = true;
+    });
+
+    extraPackages = [
+      llvm
+      lld
+      libunwind
+      libcxxabi
+      compiler-rt
+    ];
+
+    nixSupport.cc-cflags = [
+      "-resource-dir=$out/resource-root"
+      "-fuse-ld=lld"
+      "-rtlib=compiler-rt"
+      "-unwindlib=libunwind"
+      "-Wno-unused-command-line-argument"
+    ];
+
     extraBuildCommands = ''
       clang_version=`${cc}/bin/clang -v 2>&1 | grep "clang version " | grep -E -o "[0-9.-]+"`
-      rsrc="$out/resource-root"
-      mkdir "$rsrc"
-      ln -s "${cc}/lib/clang/$clang_version/include" "$rsrc"
-      ln -s "${cc}/lib/clang/$clang_version/lib" "$rsrc/lib"
-      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
-      echo "--gcc-toolchain=${stdenv.cc.cc}" >> $out/nix-support/cc-cflags
+      mkdir -p $out/resource-root
+      ln -s ${cc}/lib/clang/$clang_version/{include,lib} $out/resource-root
+
+      # Not sure why, but hardening seems to make things break
       rm $out/nix-support/add-hardening.sh
       touch $out/nix-support/add-hardening.sh
-      # GPU compilation uses builtin lld
-      substituteInPlace $out/bin/clang \
-        --replace '-MM) dontLink=1 ;;' $'-MM | --cuda-device-only) dontLink=1 ;;\n--cuda-host-only | --cuda-compile-host-device) dontLink=0 ;;'
-      substituteInPlace $out/bin/clang++ \
-        --replace '-MM) dontLink=1 ;;' $'-MM | --cuda-device-only) dontLink=1 ;;\n--cuda-host-only | --cuda-compile-host-device) dontLink=0 ;;'
+
+      # GPU compilation uses builtin `lld`
+      substituteInPlace $out/bin/{clang,clang++} \
+        --replace "-MM) dontLink=1 ;;" "-MM | --cuda-device-only) dontLink=1 ;;''\n--cuda-host-only | --cuda-compile-host-device) dontLink=0 ;;"
     '';
   };
 
-  clangNoCompilerRt = wrapCCWith rec {
-    cc = llvm;
-    extraBuildCommands = ''
-      clang_version=`${cc}/bin/clang -v 2>&1 | grep "clang version " | grep -E -o "[0-9.-]+"`
-      rsrc="$out/resource-root"
-      mkdir "$rsrc"
-      ln -s "${cc}/lib/clang/$clang_version/include" "$rsrc"
-      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
-      echo "--gcc-toolchain=${stdenv.cc.cc}" >> $out/nix-support/cc-cflags
-      rm $out/nix-support/add-hardening.sh
-      touch $out/nix-support/add-hardening.sh
-      # GPU compilation uses builtin lld
-      substituteInPlace $out/bin/clang \
-        --replace '-MM) dontLink=1 ;;' $'-MM | --cuda-device-only) dontLink=1 ;;\n--cuda-host-only | --cuda-compile-host-device) dontLink=0 ;;'
-      substituteInPlace $out/bin/clang++ \
-        --replace '-MM) dontLink=1 ;;' $'-MM | --cuda-device-only) dontLink=1 ;;\n--cuda-host-only | --cuda-compile-host-device) dontLink=0 ;;'
+  # Base
+  # Unfortunately, we cannot build `clang-tools-extra` separately.
+  clang-tools-extra = callPackage ./llvm.nix {
+    stdenv = rocmClangStdenv;
+    buildTests = false; # `invalid operands to binary expression ('std::basic_stringstream<char>' and 'const llvm::StringRef')`
+    targetName = "clang-tools-extra";
+
+    targetProjects = [
+      "clang"
+      "clang-tools-extra"
+    ];
+
+    extraBuildInputs = [ gtest ];
+
+    extraCMakeFlags = [
+      "-DLLVM_INCLUDE_DOCS=OFF"
+      "-DLLVM_INCLUDE_TESTS=OFF"
+      "-DCLANG_INCLUDE_DOCS=OFF"
+      "-DCLANG_INCLUDE_TESTS=ON"
+      "-DCLANG_TOOLS_EXTRA_INCLUDE_DOCS=ON"
+    ];
+
+    extraPostInstall = ''
+      # Remove LLVM and Clang
+      for path in `find ${llvm} ${clang-unwrapped}`; do
+        if [ $path != ${llvm} ] && [ $path != ${clang-unwrapped} ]; then
+          rm -f $out''${path#${llvm}} $out''${path#${clang-unwrapped}} || true
+        fi
+      done
+
+      # Cleanup empty directories
+      find $out -type d -empty -delete
     '';
   };
 
-  llvm = callPackage ./llvm.nix {
-    inherit src version;
+  # Projects
+  libclc = let
+    spirv = (spirv-llvm-translator.override { inherit llvm; });
+  in callPackage ./llvm.nix rec {
+    stdenv = rocmClangStdenv;
+    buildDocs = false; # No documentation to build
+    buildMan = false; # No man pages to build
+    targetName = "libclc";
+    targetDir = targetName;
+    extraBuildInputs = [ spirv ];
+
+    # `spirv-mesa3d` isn't compiling with LLVM 15.0.0, it does with LLVM 14.0.0
+    # Try removing the `spirv-mesa3d` and `clspv` patches next update
+    # `clspv` tests fail, unresolved calls
+    extraPostPatch = ''
+      substituteInPlace CMakeLists.txt \
+        --replace "find_program( LLVM_CLANG clang PATHS \''${LLVM_BINDIR} NO_DEFAULT_PATH )" \
+          "find_program( LLVM_CLANG clang PATHS \"${clang}/bin\" NO_DEFAULT_PATH )" \
+        --replace "find_program( LLVM_SPIRV llvm-spirv PATHS \''${LLVM_BINDIR} NO_DEFAULT_PATH )" \
+          "find_program( LLVM_SPIRV llvm-spirv PATHS \"${spirv}/bin\" NO_DEFAULT_PATH )" \
+        --replace "  spirv-mesa3d-" "" \
+        --replace "  spirv64-mesa3d-" "" \
+        --replace "NOT \''${t} MATCHES" \
+          "NOT \''${ARCH} STREQUAL \"clspv\" AND NOT \''${ARCH} STREQUAL \"clspv64\" AND NOT \''${t} MATCHES"
+    '';
+
+    checkTargets = [ ];
+  };
+
+  lldb = callPackage ./llvm.nix rec {
+    stdenv = rocmClangStdenv;
+    buildTests = false; # ld.lld: error: unable to find library -lllvm_gtest_main
+    targetName = "lldb";
+    targetDir = targetName;
+    extraNativeBuildInputs = [ python3Packages.sphinx-automodapi ];
+
+    extraBuildInputs = [
+      xz
+      swig
+      lua5_3
+      gtest
+    ];
+
+    extraCMakeFlags = [
+      "-DLLVM_EXTERNAL_LIT=${lit}/bin/.lit-wrapped"
+      "-DLLDB_INCLUDE_TESTS=ON"
+      "-DLLDB_INCLUDE_UNITTESTS=ON"
+    ];
+  };
+
+  mlir = callPackage ./llvm.nix rec {
+    stdenv = rocmClangStdenv;
+    buildDocs = false; # No decent way to hack this to work
+    buildMan = false; # No man pages to build
+    targetName = "mlir";
+    targetDir = targetName;
+    extraNativeBuildInputs = [ hipcc ];
+
+    extraBuildInputs = [
+      rocm-comgr
+      vulkan-headers
+      vulkan-loader
+      glslang
+      shaderc
+    ];
+
+    extraCMakeFlags = [
+      "-DCMAKE_POLICY_DEFAULT_CMP0116=NEW"
+      "-DMLIR_INCLUDE_DOCS=ON"
+      "-DMLIR_INCLUDE_TESTS=ON"
+      "-DMLIR_ENABLE_ROCM_RUNNER=ON"
+      "-DMLIR_ENABLE_SPIRV_CPU_RUNNER=ON"
+      "-DMLIR_ENABLE_VULKAN_RUNNER=ON"
+      "-DROCM_TEST_CHIPSET=gfx000" # CPU runner
+    ];
+
+    extraPostPatch = ''
+      chmod +w ../llvm
+      mkdir -p ../llvm/build/bin
+      ln -s ${lit}/bin/lit ../llvm/build/bin/llvm-lit
+
+      substituteInPlace test/CMakeLists.txt \
+        --replace "FileCheck count not" "" \
+        --replace "list(APPEND MLIR_TEST_DEPENDS mlir_rocm_runtime)" ""
+
+      substituteInPlace lib/ExecutionEngine/CMakeLists.txt \
+        --replace "return()" ""
+
+      # Remove problematic tests
+      rm test/CAPI/execution_engine.c
+      rm test/Target/LLVMIR/llvmir-intrinsics.mlir
+      rm test/Target/LLVMIR/llvmir.mlir
+      rm test/Target/LLVMIR/openmp-llvm.mlir
+      rm test/mlir-cpu-runner/*.mlir
+      rm test/mlir-vulkan-runner/*.mlir
+    '';
+
+    extraPostInstall = ''
+      mkdir -p $out/bin
+      mv bin/mlir-tblgen $out/bin
+    '';
+
+    checkTargets = [ "check-${targetName}" ];
+  };
+
+  polly = callPackage ./llvm.nix rec {
+    stdenv = rocmClangStdenv;
+    targetName = "polly";
+    targetDir = targetName;
+    checkTargets = [ "check-${targetName}" ];
+  };
+
+  flang = callPackage ./llvm.nix rec {
+    stdenv = rocmClangStdenv;
+    buildTests = false; # `Executable "flang1" doesn't exist!`
+    targetName = "flang";
+    targetDir = targetName;
+    extraNativeBuildInputs = [ python3Packages.sphinx-markdown-tables ];
+    extraBuildInputs = [ mlir ];
+
+    extraCMakeFlags = [
+      "-DCMAKE_POLICY_DEFAULT_CMP0116=NEW"
+      "-DCLANG_DIR=${clang-unwrapped}/lib/cmake/clang"
+      "-DFLANG_INCLUDE_TESTS=OFF"
+      "-DMLIR_TABLEGEN_EXE=${mlir}/bin/mlir-tblgen"
+    ];
+
+    extraPostPatch = ''
+      substituteInPlace test/CMakeLists.txt \
+        --replace "FileCheck" "" \
+        --replace "count" "" \
+        --replace "not" ""
+
+      substituteInPlace docs/CMakeLists.txt \
+        --replace "CLANG_TABLEGEN_EXE clang-tblgen" "CLANG_TABLEGEN_EXE ${clang-unwrapped}/bin/clang-tblgen"
+    '';
+  };
+
+  openmp = callPackage ./llvm.nix rec {
+    stdenv = rocmClangStdenv;
+    buildTests = false; # Too many failures, most pass
+    targetName = "openmp";
+    targetDir = targetName;
+    extraPatches = [ ./0000-fix-openmp.patch ];
+    extraNativeBuildInputs = [ perl ];
+
+    extraBuildInputs = [
+      rocm-device-libs
+      rocm-runtime
+      elfutils
+    ];
+
+    extraCMakeFlags = [
+      "-DCMAKE_MODULE_PATH=/build/source/llvm/cmake/modules" # For docs
+      "-DCLANG_TOOL=${clang}/bin/clang"
+      "-DCLANG_OFFLOAD_BUNDLER_TOOL=${clang-unwrapped}/bin/clang-offload-bundler"
+      "-DOPENMP_LLVM_TOOLS_DIR=${llvm}/bin"
+      "-DOPENMP_LLVM_LIT_EXECUTABLE=${lit}/bin/.lit-wrapped"
+      "-DDEVICELIBS_ROOT=${rocm-device-libs.src}"
+    ];
+
+    extraPostPatch = ''
+      # We can't build this target at the moment
+      substituteInPlace libomptarget/DeviceRTL/CMakeLists.txt \
+        --replace "gfx1010" ""
+    '';
+
+    checkTargets = [ "check-${targetName}" ];
+    extraLicenses = [ lib.licenses.mit ];
+  };
+
+  # Runtimes
+  pstl = callPackage ./llvm.nix rec {
+    stdenv = rocmClangStdenv;
+    buildDocs = false; # No documentation to build
+    buildMan = false; # No man pages to build
+    buildTests = false; # Too many errors
+    targetName = "pstl";
+    targetDir = "runtimes";
+    targetRuntimes = [ targetName ];
+    checkTargets = [ "check-${targetName}" ];
   };
 }
diff --git a/pkgs/development/compilers/llvm/rocm/llvm.nix b/pkgs/development/compilers/llvm/rocm/llvm.nix
index b148b936ca56..82aee79cfe4a 100644
--- a/pkgs/development/compilers/llvm/rocm/llvm.nix
+++ b/pkgs/development/compilers/llvm/rocm/llvm.nix
@@ -1,22 +1,44 @@
-{ stdenv
-, lib
-, fetchgit
+{ lib
+, stdenv
 , fetchFromGitHub
-, writeScript
+, rocmUpdateScript
+, pkg-config
 , cmake
 , ninja
-, python3
+, git
+, doxygen
+, sphinx
+, lit
 , libxml2
-, libffi
-, libbfd
 , libxcrypt
-, ncurses
+, libedit
+, libffi
+, mpfr
 , zlib
-, debugVersion ? false
-, enableManpages ? false
-
-, version
-, src
+, ncurses
+, python3Packages
+, buildDocs ? true
+, buildMan ? true
+, buildTests ? true
+, targetName ? "llvm"
+, targetDir ? "llvm"
+, targetProjects ? [ ]
+, targetRuntimes ? [ ]
+, extraPatches ? [ ]
+, extraNativeBuildInputs ? [ ]
+, extraBuildInputs ? [ ]
+, extraCMakeFlags ? [ ]
+, extraPostPatch ? ""
+, checkTargets ? [(
+  lib.optionalString buildTests (
+    if targetDir == "runtimes"
+    then "check-runtimes"
+    else "check-all"
+  )
+)]
+, extraPostInstall ? ""
+, extraLicenses ? [ ]
+, isBroken ? false
 }:
 
 let
@@ -25,73 +47,119 @@ let
     else if stdenv.isAarch64 then "AArch64"
     else throw "Unsupported ROCm LLVM platform";
 in stdenv.mkDerivation (finalAttrs: {
-  inherit src version;
+  pname = "rocm-llvm-${targetName}";
+  version = "5.4.0";
 
-  pname = "rocm-llvm";
-
-  sourceRoot = "${src.name}/llvm";
-
-  nativeBuildInputs = [ cmake ninja python3 ];
-
-  buildInputs = [ libxml2 libxcrypt ];
-
-  propagatedBuildInputs = [ ncurses zlib ];
-
-  cmakeFlags = with stdenv; [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
-    "-DLLVM_INSTALL_UTILS=ON" # Needed by rustc
-    "-DLLVM_TARGETS_TO_BUILD=AMDGPU;${llvmNativeTarget}"
-    "-DLLVM_ENABLE_PROJECTS=clang;lld;compiler-rt"
-  ]
-  ++ lib.optionals enableManpages [
-    "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
-    "-DLLVM_BUILD_DOCS=ON"
-    "-DLLVM_ENABLE_SPHINX=ON"
-    "-DSPHINX_OUTPUT_MAN=ON"
-    "-DSPHINX_OUTPUT_HTML=OFF"
-    "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+  outputs = [
+    "out"
+  ] ++ lib.optionals buildDocs [
+    "doc"
+  ] ++ lib.optionals buildMan [
+    "man"
+    "info" # Avoid `attribute 'info' missing` when using with wrapCC
   ];
 
-  postPatch = ''
+  patches = extraPatches;
+
+  src = fetchFromGitHub {
+    owner = "RadeonOpenCompute";
+    repo = "llvm-project";
+    rev = "rocm-${finalAttrs.version}";
+    hash = "sha256-rlVo77h344PLGj/mIzsw+/ndWywsBsiKDXsEDpWSUno=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    ninja
+    git
+    python3Packages.python
+  ] ++ lib.optionals (buildDocs || buildMan) [
+    doxygen
+    sphinx
+    python3Packages.recommonmark
+  ] ++ lib.optionals (buildTests && !finalAttrs.passthru.isLLVM) [
+    lit
+  ] ++ extraNativeBuildInputs;
+
+  buildInputs = [
+    libxml2
+    libxcrypt
+    libedit
+    libffi
+    mpfr
+  ] ++ extraBuildInputs;
+
+  propagatedBuildInputs = lib.optionals finalAttrs.passthru.isLLVM [
+    zlib
+    ncurses
+  ];
+
+  sourceRoot = "${finalAttrs.src.name}/${targetDir}";
+
+  cmakeFlags = [
+    "-DLLVM_TARGETS_TO_BUILD=AMDGPU;${llvmNativeTarget}"
+  ] ++ lib.optionals (finalAttrs.passthru.isLLVM && targetProjects != [ ]) [
+    "-DLLVM_ENABLE_PROJECTS=${lib.concatStringsSep ";" targetProjects}"
+  ] ++ lib.optionals ((finalAttrs.passthru.isLLVM || targetDir == "runtimes") && targetRuntimes != [ ]) [
+    "-DLLVM_ENABLE_RUNTIMES=${lib.concatStringsSep ";" targetRuntimes}"
+  ] ++ lib.optionals (finalAttrs.passthru.isLLVM || finalAttrs.passthru.isClang) [
+    "-DLLVM_ENABLE_RTTI=ON"
+    "-DLLVM_ENABLE_EH=ON"
+  ] ++ lib.optionals (buildDocs || buildMan) [
+    "-DLLVM_INCLUDE_DOCS=ON"
+    "-DLLVM_BUILD_DOCS=ON"
+    # "-DLLVM_ENABLE_DOXYGEN=ON" Way too slow, only uses one core
+    "-DLLVM_ENABLE_SPHINX=ON"
+    "-DLLVM_ENABLE_OCAMLDOC=OFF"
+    "-DSPHINX_OUTPUT_HTML=ON"
+    "-DSPHINX_OUTPUT_MAN=ON"
+    "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+  ] ++ lib.optionals buildTests [
+    "-DLLVM_INCLUDE_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=ON"
+  ] ++ lib.optionals (buildTests && !finalAttrs.passthru.isLLVM) [
+    "-DLLVM_EXTERNAL_LIT=${lit}/bin/.lit-wrapped"
+  ] ++ extraCMakeFlags;
+
+  postPatch = lib.optionalString finalAttrs.passthru.isLLVM ''
     patchShebangs lib/OffloadArch/make_generated_offload_arch_h.sh
-    substituteInPlace ../clang/cmake/modules/CMakeLists.txt \
-      --replace 'FILES_MATCHING' 'NO_SOURCE_PERMISSIONS FILES_MATCHING'
-  '';
+  '' + lib.optionalString (buildTests && finalAttrs.passthru.isLLVM) ''
+    # FileSystem permissions tests fail with various special bits
+    rm test/tools/llvm-objcopy/ELF/mirror-permissions-unix.test
+    rm unittests/Support/Path.cpp
+
+    substituteInPlace unittests/Support/CMakeLists.txt \
+      --replace "Path.cpp" ""
+  '' + extraPostPatch;
+
+  doCheck = buildTests;
+  checkTarget = lib.concatStringsSep " " checkTargets;
+
+  postInstall = lib.optionalString finalAttrs.passthru.isLLVM ''
+    # `lit` expects these for some test suites
+    mv bin/{FileCheck,not,count,yaml2obj,obj2yaml} $out/bin
+  '' + lib.optionalString buildMan ''
+    mkdir -p $info
+  '' + extraPostInstall;
 
   passthru = {
-    isClang = true;
+    isLLVM = targetDir == "llvm";
+    isClang = targetDir == "clang" || builtins.elem "clang" targetProjects;
 
-    updateScript = writeScript "update.sh" ''
-      #!/usr/bin/env nix-shell
-      #!nix-shell -i bash -p curl jq common-updater-scripts nix-prefetch-github
-
-      version="$(curl ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
-        -sL "https://api.github.com/repos/RadeonOpenCompute/llvm-project/releases?per_page=1" | jq '.[0].tag_name | split("-") | .[1]' --raw-output)"
-
-      IFS='.' read -a version_arr <<< "$version"
-
-      if [ "''${#version_arr[*]}" == 2 ]; then
-        version="''${version}.0"
-      fi
-
-      current_version="$(grep "version =" pkgs/development/compilers/llvm/rocm/default.nix | cut -d'"' -f2)"
-      if [[ "$version" != "$current_version" ]]; then
-        tarball_meta="$(nix-prefetch-github RadeonOpenCompute llvm-project --rev "rocm-$version")"
-        tarball_hash="$(nix to-base64 sha256-$(jq -r '.sha256' <<< "$tarball_meta"))"
-        sed -i "pkgs/development/compilers/llvm/rocm/default.nix" \
-          -e 's,version = "\(.*\)",version = "'"$version"'",' \
-          -e 's,hash = "\(.*\)",hash = "sha256-'"$tarball_hash"'",'
-      else
-        echo rocm-llvm already up-to-date
-      fi
-    '';
+    updateScript = rocmUpdateScript {
+      name = finalAttrs.pname;
+      owner = finalAttrs.src.owner;
+      repo = finalAttrs.src.repo;
     };
+  };
 
   meta = with lib; {
     description = "ROCm fork of the LLVM compiler infrastructure";
     homepage = "https://github.com/RadeonOpenCompute/llvm-project";
-    license = with licenses; [ ncsa ];
+    license = with licenses; [ ncsa ] ++ extraLicenses;
     maintainers = with maintainers; [ acowley lovesegfault ] ++ teams.rocm.members;
     platforms = platforms.linux;
+    broken = isBroken;
   };
 })
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d55ddeeca6f9..22c43b4d3451 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13843,6 +13843,7 @@ with pkgs;
   clangStdenv = if stdenv.cc.isClang then stdenv else lowPrio llvmPackages.stdenv;
   clang-sierraHack-stdenv = overrideCC stdenv buildPackages.clang-sierraHack;
   libcxxStdenv = if stdenv.isDarwin then stdenv else lowPrio llvmPackages.libcxxStdenv;
+  rocmClangStdenv = llvmPackages_rocm.rocmClangStdenv;
 
   clasp-common-lisp = callPackage ../development/compilers/clasp {
     llvmPackages = llvmPackages_6;

From 785ed480aafdde6cbbffb7605f1cd988f8524dab Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Mon, 12 Dec 2022 17:36:53 -0600
Subject: [PATCH 134/231] rocm-related: standardize

rocminfo: standardize

rocm-thunk: standardize

rocm-opencl-icd: standardize

rocclr: standardize

rocm-device-libs: standardize

rocm-comgr: standardize

rocm-opencl-runtime: standardize

rocm-runtime: standardize

clang-ocl: standardize

composable_kernel: standardize

hipcub: standardize

hipsparse: standardize

miopengemm: standardize

rccl: standardize

rocfft: standardize

rocprim: standardize

rocsparse: standardize

rocmlir: standardize

rocrand: standardize

tensile: standardize

rocm-cmake: standardize

rocm-smi: standardize

miopen: standardize
---
 .../libraries/clang-ocl/default.nix           | 13 +--
 .../libraries/composable_kernel/default.nix   |  6 +-
 pkgs/development/libraries/hipcub/default.nix |  6 --
 .../libraries/hipsparse/default.nix           |  6 --
 pkgs/development/libraries/miopen/default.nix | 21 ++---
 .../libraries/miopengemm/default.nix          |  6 +-
 pkgs/development/libraries/rccl/default.nix   |  6 --
 pkgs/development/libraries/rocclr/default.nix | 11 ++-
 pkgs/development/libraries/rocfft/default.nix | 10 +--
 .../libraries/rocm-comgr/default.nix          | 35 ++++----
 .../libraries/rocm-device-libs/default.nix    | 29 ++++---
 .../libraries/rocm-opencl-icd/default.nix     | 10 ++-
 .../libraries/rocm-opencl-runtime/default.nix | 37 +++------
 .../libraries/rocm-runtime/default.nix        | 42 ++++++----
 .../libraries/rocm-thunk/default.nix          | 38 +++++----
 .../development/libraries/rocmlir/default.nix | 64 +++++++++++++--
 .../development/libraries/rocprim/default.nix |  9 +-
 .../development/libraries/rocrand/default.nix |  9 +-
 .../libraries/rocsparse/default.nix           |  6 --
 .../development/libraries/tensile/default.nix |  1 +
 .../build-managers/rocm-cmake/default.nix     |  1 +
 pkgs/development/tools/rocminfo/default.nix   | 33 ++++----
 pkgs/tools/system/rocm-smi/default.nix        |  1 +
 pkgs/top-level/all-packages.nix               | 82 +++++++++++++------
 24 files changed, 258 insertions(+), 224 deletions(-)

diff --git a/pkgs/development/libraries/clang-ocl/default.nix b/pkgs/development/libraries/clang-ocl/default.nix
index 3341bc680fb0..8cbace27d4fb 100644
--- a/pkgs/development/libraries/clang-ocl/default.nix
+++ b/pkgs/development/libraries/clang-ocl/default.nix
@@ -5,7 +5,6 @@
 , cmake
 , rocm-cmake
 , rocm-device-libs
-, clang
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -22,17 +21,9 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     rocm-cmake
-    clang
   ];
 
-  buildInputs = [
-    rocm-device-libs
-  ];
-
-  cmakeFlags = [
-    "-DCMAKE_C_COMPILER=clang"
-    "-DCMAKE_CXX_COMPILER=clang++"
-  ];
+  buildInputs = [ rocm-device-libs ];
 
   passthru.updateScript = rocmUpdateScript {
     name = finalAttrs.pname;
@@ -45,6 +36,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/RadeonOpenCompute/clang-ocl";
     license = with licenses; [ mit ];
     maintainers = teams.rocm.members;
-    broken = finalAttrs.version != clang.version;
+    broken = finalAttrs.version != stdenv.cc.cc.version;
   };
 })
diff --git a/pkgs/development/libraries/composable_kernel/default.nix b/pkgs/development/libraries/composable_kernel/default.nix
index f41a97b99ad7..82419873cbeb 100644
--- a/pkgs/development/libraries/composable_kernel/default.nix
+++ b/pkgs/development/libraries/composable_kernel/default.nix
@@ -6,6 +6,7 @@
 , rocm-cmake
 , hip
 , openmp
+, clang-tools-extra
 , gtest
 , buildTests ? false
 , buildExamples ? false
@@ -37,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     rocm-cmake
     hip
+    clang-tools-extra
   ];
 
   buildInputs = [
@@ -85,8 +87,8 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/ROCmSoftwarePlatform/composable_kernel";
     license = with licenses; [ mit ];
     maintainers = teams.rocm.members;
-    # Several tests seem to either not compile or have a race condition
-    # Undefined reference to symbol '_ZTIN7testing4TestE'
+    # Well, at least we're getting something that makes sense now
+    # undefined symbol: testing::Message::Message()
     # Try removing this next update
     broken = buildTests;
   };
diff --git a/pkgs/development/libraries/hipcub/default.nix b/pkgs/development/libraries/hipcub/default.nix
index 68f31e991d61..8a6ea0ca43c2 100644
--- a/pkgs/development/libraries/hipcub/default.nix
+++ b/pkgs/development/libraries/hipcub/default.nix
@@ -4,9 +4,6 @@
 , rocmUpdateScript
 , cmake
 , rocm-cmake
-, rocm-runtime
-, rocm-device-libs
-, rocm-comgr
 , rocprim
 , hip
 , gtest
@@ -42,9 +39,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    rocm-runtime
-    rocm-device-libs
-    rocm-comgr
     rocprim
   ] ++ lib.optionals buildTests [
     gtest
diff --git a/pkgs/development/libraries/hipsparse/default.nix b/pkgs/development/libraries/hipsparse/default.nix
index fc1e62e65208..a1582a4ee484 100644
--- a/pkgs/development/libraries/hipsparse/default.nix
+++ b/pkgs/development/libraries/hipsparse/default.nix
@@ -4,9 +4,6 @@
 , rocmUpdateScript
 , cmake
 , rocm-cmake
-, rocm-runtime
-, rocm-device-libs
-, rocm-comgr
 , rocsparse
 , hip
 , gfortran
@@ -41,9 +38,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    rocm-runtime
-    rocm-device-libs
-    rocm-comgr
     rocsparse
     git
   ] ++ lib.optionals buildTests [
diff --git a/pkgs/development/libraries/miopen/default.nix b/pkgs/development/libraries/miopen/default.nix
index d48adb09a04c..513b492ee981 100644
--- a/pkgs/development/libraries/miopen/default.nix
+++ b/pkgs/development/libraries/miopen/default.nix
@@ -6,14 +6,10 @@
 , pkg-config
 , cmake
 , rocm-cmake
-, rocm-runtime
-, rocm-device-libs
-, rocm-comgr
-, rocm-opencl-runtime
 , rocblas
 , rocmlir
 , hip
-, clang
+, clang-tools-extra
 , clang-ocl
 , llvm
 , miopengemm
@@ -84,15 +80,11 @@ in stdenv.mkDerivation (finalAttrs: {
     cmake
     rocm-cmake
     hip
-    clang
-    llvm
+    clang-tools-extra
   ];
 
   buildInputs = [
-    rocm-runtime
-    rocm-device-libs
-    rocm-comgr
-    rocm-opencl-runtime
+    llvm
     rocblas
     rocmlir
     clang-ocl
@@ -126,8 +118,6 @@ in stdenv.mkDerivation (finalAttrs: {
     "-DCMAKE_CXX_COMPILER=hipcc"
     "-DMIOPEN_BACKEND=HIP"
   ] ++ lib.optionals useOpenCL [
-    "-DCMAKE_C_COMPILER=${clang}/bin/clang"
-    "-DCMAKE_CXX_COMPILER=${clang}/bin/clang++"
     "-DMIOPEN_BACKEND=OpenCL"
   ] ++ lib.optionals buildTests [
     "-DBUILD_TESTS=ON"
@@ -148,8 +138,7 @@ in stdenv.mkDerivation (finalAttrs: {
       --replace "3 REQUIRED PATHS /opt/rocm)" "3 REQUIRED PATHS ${hip})" \
       --replace "hip REQUIRED PATHS /opt/rocm" "hip REQUIRED PATHS ${hip}" \
       --replace "rocblas REQUIRED PATHS /opt/rocm" "rocblas REQUIRED PATHS ${rocblas}" \
-      --replace "miopengemm PATHS /opt/rocm" "miopengemm PATHS ${miopengemm}" \
-      --replace "set(MIOPEN_TIDY_ERRORS ALL)" "" # Fix clang-tidy at some point
+      --replace "miopengemm PATHS /opt/rocm" "miopengemm PATHS ${miopengemm}"
   '' + lib.optionalString (!buildTests) ''
     substituteInPlace CMakeLists.txt \
       --replace "add_subdirectory(test)" ""
@@ -180,7 +169,7 @@ in stdenv.mkDerivation (finalAttrs: {
   '' + lib.optionalString buildTests ''
     mkdir -p $test/bin
     mv bin/test_* $test/bin
-    patchelf --set-rpath ${lib.makeLibraryPath (finalAttrs.buildInputs ++ [ hip ])}:$out/lib $test/bin/*
+    patchelf --set-rpath $out/lib:${lib.makeLibraryPath (finalAttrs.buildInputs ++ [ hip ])} $test/bin/*
   '';
 
   passthru.updateScript = rocmUpdateScript {
diff --git a/pkgs/development/libraries/miopengemm/default.nix b/pkgs/development/libraries/miopengemm/default.nix
index ecc5ba09aad8..03d30906f94a 100644
--- a/pkgs/development/libraries/miopengemm/default.nix
+++ b/pkgs/development/libraries/miopengemm/default.nix
@@ -5,7 +5,6 @@
 , cmake
 , rocm-cmake
 , rocm-opencl-runtime
-, clang
 , texlive
 , doxygen
 , sphinx
@@ -54,7 +53,6 @@ in stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     rocm-cmake
-    clang
   ];
 
   buildInputs = [
@@ -70,8 +68,6 @@ in stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
-    "-DCMAKE_C_COMPILER=clang"
-    "-DCMAKE_CXX_COMPILER=clang++"
     # Manually define CMAKE_INSTALL_<DIR>
     # See: https://github.com/NixOS/nixpkgs/pull/197838
     "-DCMAKE_INSTALL_BINDIR=bin"
@@ -121,6 +117,6 @@ in stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/ROCmSoftwarePlatform/MIOpenGEMM";
     license = with licenses; [ mit ];
     maintainers = teams.rocm.members;
-    broken = finalAttrs.version != clang.version;
+    broken = finalAttrs.version != stdenv.cc.version;
   };
 })
diff --git a/pkgs/development/libraries/rccl/default.nix b/pkgs/development/libraries/rccl/default.nix
index 6a9b48545749..4a8df477e15e 100644
--- a/pkgs/development/libraries/rccl/default.nix
+++ b/pkgs/development/libraries/rccl/default.nix
@@ -4,9 +4,6 @@
 , rocmUpdateScript
 , cmake
 , rocm-cmake
-, rocm-runtime
-, rocm-device-libs
-, rocm-comgr
 , rocm-smi
 , hip
 , gtest
@@ -38,9 +35,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    rocm-runtime
-    rocm-device-libs
-    rocm-comgr
     rocm-smi
     gtest
   ] ++ lib.optionals buildTests [
diff --git a/pkgs/development/libraries/rocclr/default.nix b/pkgs/development/libraries/rocclr/default.nix
index 2837f57897e7..bd0eb6bafbb6 100644
--- a/pkgs/development/libraries/rocclr/default.nix
+++ b/pkgs/development/libraries/rocclr/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , fetchpatch
 , rocmUpdateScript
@@ -26,18 +27,19 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
-  prePatch = ''
+  postPatch = ''
     substituteInPlace device/comgrctx.cpp \
       --replace "libamd_comgr.so" "${rocm-comgr}/lib/libamd_comgr.so"
   '';
 
-  buildPhase = "";
+  dontConfigure = true;
+  dontBuild = true;
 
   installPhase = ''
     runHook preInstall
 
     mkdir -p $out
-    cp -r * $out/
+    cp -a * $out/
 
     runHook postInstall
   '';
@@ -57,5 +59,6 @@ stdenv.mkDerivation (finalAttrs: {
     # to be supported yet by the build infrastructure. Recheck in
     # the future.
     platforms = [ "x86_64-linux" ];
+    broken = finalAttrs.version != stdenv.cc.version;
   };
 })
diff --git a/pkgs/development/libraries/rocfft/default.nix b/pkgs/development/libraries/rocfft/default.nix
index 8dbf5f16a447..b71f0dc5b07f 100644
--- a/pkgs/development/libraries/rocfft/default.nix
+++ b/pkgs/development/libraries/rocfft/default.nix
@@ -4,17 +4,14 @@
 , rocmUpdateScript
 , cmake
 , rocm-cmake
-, rocm-runtime
-, rocm-device-libs
-, rocm-comgr
 , hip
+, openmp
 , sqlite
 , python3
 , gtest
 , boost
 , fftw
 , fftwFloat
-, llvmPackages
 , buildTests ? false
 , buildBenchmarks ? false
 }:
@@ -45,9 +42,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    rocm-runtime
-    rocm-device-libs
-    rocm-comgr
     sqlite
     python3
   ] ++ lib.optionals buildTests [
@@ -56,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     boost
     fftw
     fftwFloat
-    llvmPackages.openmp
+    openmp
   ];
 
   propogatedBuildInputs = lib.optionals buildTests [
diff --git a/pkgs/development/libraries/rocm-comgr/default.nix b/pkgs/development/libraries/rocm-comgr/default.nix
index 2d26f72fc1b0..93c56f5178d8 100644
--- a/pkgs/development/libraries/rocm-comgr/default.nix
+++ b/pkgs/development/libraries/rocm-comgr/default.nix
@@ -3,12 +3,17 @@
 , fetchFromGitHub
 , rocmUpdateScript
 , cmake
-, clang
+, rocm-cmake
 , rocm-device-libs
-, llvm
+, libxml2
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+let
+  llvmNativeTarget =
+    if stdenv.isx86_64 then "X86"
+    else if stdenv.isAarch64 then "AArch64"
+    else throw "Unsupported ROCm LLVM platform";
+in stdenv.mkDerivation (finalAttrs: {
   pname = "rocm-comgr";
   version = "5.4.0";
 
@@ -19,21 +24,20 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-qLsrBTeSop7lIQv8gZDwgpvGZJOAq90zsvMi1QpfbAs=";
   };
 
-  sourceRoot = "source/lib/comgr";
+  patches = [ ./cmake.patch ];
+  sourceRoot = "${finalAttrs.src.name}/lib/comgr";
 
-  nativeBuildInputs = [ cmake ];
-
-  buildInputs = [ clang rocm-device-libs llvm ];
-
-  cmakeFlags = [
-    "-DCMAKE_C_COMPILER=${clang}/bin/clang"
-    "-DCMAKE_CXX_COMPILER=${clang}/bin/clang++"
-    "-DCMAKE_PREFIX_PATH=${llvm}/lib/cmake/llvm"
-    "-DLLD_INCLUDE_DIRS=${llvm}/include"
-    "-DLLVM_TARGETS_TO_BUILD=\"AMDGPU;X86\""
+  nativeBuildInputs = [
+    cmake
+    rocm-cmake
   ];
 
-  patches = [ ./cmake.patch ];
+  buildInputs = [
+    rocm-device-libs
+    libxml2
+  ];
+
+  cmakeFlags = [ "-DLLVM_TARGETS_TO_BUILD=AMDGPU;X86" ];
 
   passthru.updateScript = rocmUpdateScript {
     name = finalAttrs.pname;
@@ -47,5 +51,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.ncsa;
     maintainers = with maintainers; [ lovesegfault ] ++ teams.rocm.members;
     platforms = platforms.linux;
+    broken = finalAttrs.version != stdenv.cc.version;
   };
 })
diff --git a/pkgs/development/libraries/rocm-device-libs/default.nix b/pkgs/development/libraries/rocm-device-libs/default.nix
index b6245eea8449..e37baad6f891 100644
--- a/pkgs/development/libraries/rocm-device-libs/default.nix
+++ b/pkgs/development/libraries/rocm-device-libs/default.nix
@@ -1,12 +1,18 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , rocmUpdateScript
 , cmake
-, clang
-, llvm
+, rocm-cmake
+, libxml2
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+let
+  llvmNativeTarget =
+    if stdenv.isx86_64 then "X86"
+    else if stdenv.isAarch64 then "AArch64"
+    else throw "Unsupported ROCm LLVM platform";
+in stdenv.mkDerivation (finalAttrs: {
   pname = "rocm-device-libs";
   version = "5.4.0";
 
@@ -17,17 +23,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-8gxvgy2GlROxM5qKtZVu5Lxa1FmTIVlBTpfp8rxhNhk=";
   };
 
-  nativeBuildInputs = [ cmake ];
+  patches = [ ./cmake.patch ];
 
-  buildInputs = [ clang llvm ];
-
-  cmakeFlags = [
-    "-DCMAKE_PREFIX_PATH=${llvm}/lib/cmake/llvm;${llvm}/lib/cmake/clang"
-    "-DLLVM_TARGETS_TO_BUILD='AMDGPU;X86'"
-    "-DCLANG=${clang}/bin/clang"
+  nativeBuildInputs = [
+    cmake
+    rocm-cmake
   ];
 
-  patches = [ ./cmake.patch ];
+  buildInputs = [ libxml2 ];
+  cmakeFlags = [ "-DLLVM_TARGETS_TO_BUILD=AMDGPU;${llvmNativeTarget}" ];
 
   passthru.updateScript = rocmUpdateScript {
     name = finalAttrs.pname;
@@ -41,5 +45,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.ncsa;
     maintainers = with maintainers; [ lovesegfault ] ++ teams.rocm.members;
     platforms = platforms.linux;
+    broken = finalAttrs.version != stdenv.cc.version;
   };
 })
diff --git a/pkgs/development/libraries/rocm-opencl-icd/default.nix b/pkgs/development/libraries/rocm-opencl-icd/default.nix
index fb78c4f04dd0..4602d3646e47 100644
--- a/pkgs/development/libraries/rocm-opencl-icd/default.nix
+++ b/pkgs/development/libraries/rocm-opencl-icd/default.nix
@@ -1,4 +1,8 @@
-{ lib, callPackage, stdenv, rocm-opencl-runtime }:
+{ lib
+, stdenv
+, callPackage
+, rocm-opencl-runtime
+}:
 
 stdenv.mkDerivation rec {
   pname = "rocm-opencl-icd";
@@ -11,12 +15,12 @@ stdenv.mkDerivation rec {
     echo "${rocm-opencl-runtime}/lib/libamdocl64.so" > $out/etc/OpenCL/vendors/amdocl64.icd
   '';
 
-  passthru.impureTests = { rocm-opencl = callPackage ./test.nix {}; };
+  passthru.impureTests = { rocm-opencl = callPackage ./test.nix { }; };
 
   meta = with lib; {
     description = "OpenCL ICD definition for AMD GPUs using the ROCm stack";
     license = licenses.mit;
-    maintainers = with maintainers; [ lovesegfault ];
+    maintainers = with maintainers; [ lovesegfault ] ++ teams.rocm.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/rocm-opencl-runtime/default.nix b/pkgs/development/libraries/rocm-opencl-runtime/default.nix
index 1d250195c23c..ee588999a1b1 100644
--- a/pkgs/development/libraries/rocm-opencl-runtime/default.nix
+++ b/pkgs/development/libraries/rocm-opencl-runtime/default.nix
@@ -1,23 +1,15 @@
-{ stdenv
-, lib
+{ lib
+, stdenv
 , fetchFromGitHub
 , rocmUpdateScript
 , addOpenGLRunpath
 , cmake
-, rocm-cmake
-, clang
-, glew
-, libglvnd
-, libX11
-, llvm
-, mesa
-, numactl
-, python3
-, rocclr
 , rocm-comgr
-, rocm-device-libs
 , rocm-runtime
-, rocm-thunk
+, rocclr
+, glew
+, libX11
+, numactl
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -31,27 +23,19 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-E1+Y/fgp5b+7H1LN+O1fwVi0/XRCgvsiSxTY3u/q+8I=";
   };
 
-  nativeBuildInputs = [ cmake rocm-cmake ];
+  nativeBuildInputs = [ cmake ];
 
   buildInputs = [
-    clang
-    glew
-    libglvnd
-    libX11
-    llvm
-    mesa
-    numactl
-    python3
     rocm-comgr
-    rocm-device-libs
     rocm-runtime
-    rocm-thunk
+    glew
+    libX11
+    numactl
   ];
 
   cmakeFlags = [
     "-DAMD_OPENCL_PATH=${finalAttrs.src}"
     "-DROCCLR_PATH=${rocclr}"
-    "-DCPACK_PACKAGING_INSTALL_PREFIX=/opt/rocm/opencl"
   ];
 
   dontStrip = true;
@@ -80,5 +64,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = with licenses; [ asl20 mit ];
     maintainers = with maintainers; [ acowley lovesegfault ] ++ teams.rocm.members;
     platforms = platforms.linux;
+    broken = finalAttrs.version != stdenv.cc.version;
   };
 })
diff --git a/pkgs/development/libraries/rocm-runtime/default.nix b/pkgs/development/libraries/rocm-runtime/default.nix
index 86ddf5b77038..b7e1212fd1b1 100644
--- a/pkgs/development/libraries/rocm-runtime/default.nix
+++ b/pkgs/development/libraries/rocm-runtime/default.nix
@@ -1,17 +1,18 @@
-{ stdenv
-, lib
+{ lib
+, stdenv
 , fetchFromGitHub
 , rocmUpdateScript
-, addOpenGLRunpath
-, cmake
 , pkg-config
+, cmake
 , xxd
-, elfutils
-, libdrm
-, llvm
-, numactl
 , rocm-device-libs
-, rocm-thunk }:
+, rocm-thunk
+, libelf
+, libdrm
+, numactl
+, valgrind
+, libxml2
+}:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocm-runtime";
@@ -24,13 +25,22 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-M9kv1Oe5ZZfd9H/+KUJUoK9L1EdyS2qRp2mJDK0dnPE=";
   };
 
-  sourceRoot = "source/src";
+  sourceRoot = "${finalAttrs.src.name}/src";
 
-  nativeBuildInputs = [ cmake pkg-config xxd ];
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    xxd
+  ];
 
-  buildInputs = [ elfutils libdrm llvm numactl ];
-
-  cmakeFlags = [ "-DCMAKE_PREFIX_PATH=${rocm-thunk}" ];
+  buildInputs = [
+    rocm-thunk
+    libelf
+    libdrm
+    numactl
+    valgrind
+    libxml2
+  ];
 
   postPatch = ''
     patchShebangs image/blit_src/create_hsaco_ascii_file.sh
@@ -45,7 +55,8 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   fixupPhase = ''
-    rm -rf $out/hsa
+    rm -rf $out/hsa/*
+    ln -s $out/{include,lib} $out/hsa
   '';
 
   passthru.updateScript = rocmUpdateScript {
@@ -59,5 +70,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/RadeonOpenCompute/ROCR-Runtime";
     license = with licenses; [ ncsa ];
     maintainers = with maintainers; [ lovesegfault ] ++ teams.rocm.members;
+    broken = finalAttrs.version != stdenv.cc.version;
   };
 })
diff --git a/pkgs/development/libraries/rocm-thunk/default.nix b/pkgs/development/libraries/rocm-thunk/default.nix
index 6bca7a89fc48..bc966e501268 100644
--- a/pkgs/development/libraries/rocm-thunk/default.nix
+++ b/pkgs/development/libraries/rocm-thunk/default.nix
@@ -2,10 +2,12 @@
 , stdenv
 , fetchFromGitHub
 , rocmUpdateScript
-, cmake
 , pkg-config
+, cmake
+, rocm-cmake
 , libdrm
 , numactl
+, valgrind
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -19,24 +21,25 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-EU5toaKzVeZpdm/YhaQ0bXq0eoYwYQ5qGLUJzxgZVjE=";
   };
 
-  preConfigure = ''
-    export cmakeFlags="$cmakeFlags "
-  '';
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    rocm-cmake
+  ];
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [
+    libdrm
+    numactl
+    valgrind
+  ];
 
-  buildInputs = [ libdrm numactl ];
-
-  # https://github.com/RadeonOpenCompute/ROCT-Thunk-Interface/issues/75
-  postPatch = ''
-    substituteInPlace libhsakmt.pc.in \
-      --replace '$'{prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@ \
-      --replace '$'{prefix}/@CMAKE_INSTALL_INCLUDEDIR@ @CMAKE_INSTALL_FULL_INCLUDEDIR@
-  '';
-
-  postInstall = ''
-    cp -r $src/include $out
-  '';
+  cmakeFlags = [
+    # Manually define CMAKE_INSTALL_<DIR>
+    # See: https://github.com/NixOS/nixpkgs/pull/197838
+    "-DCMAKE_INSTALL_BINDIR=bin"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ];
 
   passthru.updateScript = rocmUpdateScript {
     name = finalAttrs.pname;
@@ -49,5 +52,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/RadeonOpenCompute/ROCT-Thunk-Interface";
     license = with licenses; [ bsd2 mit ];
     maintainers = with maintainers; [ lovesegfault ] ++ teams.rocm.members;
+    broken = finalAttrs.version != stdenv.cc.version;
   };
 })
diff --git a/pkgs/development/libraries/rocmlir/default.nix b/pkgs/development/libraries/rocmlir/default.nix
index e40eb1b813c1..90bb1ad211ce 100644
--- a/pkgs/development/libraries/rocmlir/default.nix
+++ b/pkgs/development/libraries/rocmlir/default.nix
@@ -3,17 +3,36 @@
 , fetchFromGitHub
 , rocmUpdateScript
 , cmake
-, clang
+, ninja
+, hip
+, rocminfo
 , git
 , libxml2
 , libedit
+, zlib
+, ncurses
 , python3
+, buildRockCompiler ? false
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+# Theoretically, we could have our MLIR have an output
+# with the source and built objects so that we can just
+# use it as the external LLVM repo for this
+let
+  llvmNativeTarget =
+    if stdenv.isx86_64 then "X86"
+    else if stdenv.isAarch64 then "AArch64"
+    else throw "Unsupported ROCm LLVM platform";
+in stdenv.mkDerivation (finalAttrs: {
   pname = "rocmlir";
   version = "5.4.0";
 
+  outputs = [
+    "out"
+  ] ++ lib.optionals (!buildRockCompiler) [
+    "external"
+  ];
+
   src = fetchFromGitHub {
     owner = "ROCmSoftwarePlatform";
     repo = "rocMLIR";
@@ -23,7 +42,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
-    clang
+    ninja
+  ] ++ lib.optionals (!buildRockCompiler) [
+    hip
   ];
 
   buildInputs = [
@@ -33,12 +54,39 @@ stdenv.mkDerivation (finalAttrs: {
     python3
   ];
 
-  cmakeFlags = [
-    "-DCMAKE_C_COMPILER=clang"
-    "-DCMAKE_CXX_COMPILER=clang++"
-    "-DBUILD_FAT_LIBROCKCOMPILER=ON"
+  propagatedBuildInputs = [
+    zlib
+    ncurses
   ];
 
+  cmakeFlags = [
+    "-DLLVM_TARGETS_TO_BUILD=AMDGPU;${llvmNativeTarget}"
+    "-DLLVM_ENABLE_ZLIB=ON"
+    "-DLLVM_ENABLE_TERMINFO=ON"
+  ] ++ lib.optionals buildRockCompiler [
+    "-DBUILD_FAT_LIBROCKCOMPILER=ON"
+  ] ++ lib.optionals (!buildRockCompiler) [
+    "-DROCM_PATH=${rocminfo}"
+    "-DROCM_TEST_CHIPSET=gfx000"
+  ];
+
+  dontBuild = true;
+  doCheck = true;
+
+  # Certain libs aren't being generated, try enabling tests next update
+  checkTarget = if buildRockCompiler
+                then "librockCompiler"
+                else "check-mlir-miopen-build-only";
+
+  postInstall = let
+    libPath = lib.makeLibraryPath [ zlib ncurses hip stdenv.cc.cc ];
+  in lib.optionals (!buildRockCompiler) ''
+    mkdir -p $external/lib
+    cp -a external/llvm-project/llvm/lib/{*.a*,*.so*} $external/lib
+    patchelf --set-rpath $external/lib:$out/lib:${libPath} $external/lib/*.so*
+    patchelf --set-rpath $out/lib:$external/lib:${libPath} $out/{bin/*,lib/*.so*}
+  '';
+
   passthru.updateScript = rocmUpdateScript {
     name = finalAttrs.pname;
     owner = finalAttrs.src.owner;
@@ -52,6 +100,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/ROCmSoftwarePlatform/rocMLIR";
     license = with licenses; [ asl20 ];
     maintainers = teams.rocm.members;
-    broken = finalAttrs.version != clang.version;
+    broken = finalAttrs.version != stdenv.cc.version;
   };
 })
diff --git a/pkgs/development/libraries/rocprim/default.nix b/pkgs/development/libraries/rocprim/default.nix
index 9b5fabf0fb00..3ad3871bbd3d 100644
--- a/pkgs/development/libraries/rocprim/default.nix
+++ b/pkgs/development/libraries/rocprim/default.nix
@@ -4,9 +4,6 @@
 , rocmUpdateScript
 , cmake
 , rocm-cmake
-, rocm-runtime
-, rocm-device-libs
-, rocm-comgr
 , hip
 , gtest
 , gbenchmark
@@ -39,11 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     hip
   ];
 
-  buildInputs = [
-    rocm-runtime
-    rocm-device-libs
-    rocm-comgr
-  ] ++ lib.optionals buildTests [
+  buildInputs = lib.optionals buildTests [
     gtest
   ] ++ lib.optionals buildBenchmarks [
     gbenchmark
diff --git a/pkgs/development/libraries/rocrand/default.nix b/pkgs/development/libraries/rocrand/default.nix
index f0b1cb3e69b6..a06615ec4122 100644
--- a/pkgs/development/libraries/rocrand/default.nix
+++ b/pkgs/development/libraries/rocrand/default.nix
@@ -4,9 +4,6 @@
 , rocmUpdateScript
 , cmake
 , rocm-cmake
-, rocm-runtime
-, rocm-device-libs
-, rocm-comgr
 , hip
 , gtest
 , gbenchmark
@@ -40,11 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     hip
   ];
 
-  buildInputs = [
-    rocm-runtime
-    rocm-device-libs
-    rocm-comgr
-  ] ++ lib.optionals buildTests [
+  buildInputs = lib.optionals buildTests [
     gtest
   ] ++ lib.optionals buildBenchmarks [
     gbenchmark
diff --git a/pkgs/development/libraries/rocsparse/default.nix b/pkgs/development/libraries/rocsparse/default.nix
index 0edee46cfeb3..c0ee717d4bfc 100644
--- a/pkgs/development/libraries/rocsparse/default.nix
+++ b/pkgs/development/libraries/rocsparse/default.nix
@@ -5,9 +5,6 @@
 , rocmUpdateScript
 , cmake
 , rocm-cmake
-, rocm-runtime
-, rocm-device-libs
-, rocm-comgr
 , rocprim
 , hip
 , gfortran
@@ -46,9 +43,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    rocm-runtime
-    rocm-device-libs
-    rocm-comgr
     rocprim
     git
   ] ++ lib.optionals (buildTests || buildBenchmarks) [
diff --git a/pkgs/development/libraries/tensile/default.nix b/pkgs/development/libraries/tensile/default.nix
index df3b580c059f..c45b15134f5f 100644
--- a/pkgs/development/libraries/tensile/default.nix
+++ b/pkgs/development/libraries/tensile/default.nix
@@ -36,5 +36,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/ROCmSoftwarePlatform/Tensile";
     license = with licenses; [ mit ];
     maintainers = teams.rocm.members;
+    broken = version != stdenv.cc.version;
   };
 }
diff --git a/pkgs/development/tools/build-managers/rocm-cmake/default.nix b/pkgs/development/tools/build-managers/rocm-cmake/default.nix
index 0a3e44e02299..0d7913543f10 100644
--- a/pkgs/development/tools/build-managers/rocm-cmake/default.nix
+++ b/pkgs/development/tools/build-managers/rocm-cmake/default.nix
@@ -30,5 +30,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.mit;
     maintainers = teams.rocm.members;
     platforms = platforms.unix;
+    broken = finalAttrs.version != stdenv.cc.version;
   };
 })
diff --git a/pkgs/development/tools/rocminfo/default.nix b/pkgs/development/tools/rocminfo/default.nix
index 34dcb52526bd..2a714829d91c 100644
--- a/pkgs/development/tools/rocminfo/default.nix
+++ b/pkgs/development/tools/rocminfo/default.nix
@@ -1,13 +1,12 @@
-{ stdenv
-, lib
+{ lib
+, stdenv
 , fetchFromGitHub
 , rocmUpdateScript
-, fetchpatch
 , cmake
-, rocm-runtime
-, python3
 , rocm-cmake
+, rocm-runtime
 , busybox
+, python3
 , gnugrep
   # rocminfo requires that the calling user have a password and be in
   # the video group. If we let rocm_agent_enumerator rely upon
@@ -29,25 +28,21 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-4wZTm5AZgG8xEd6uYqxWq4bWZgcSYZ2WYA1z4RAPF8U=";
   };
 
-  enableParallelBuilding = true;
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ rocm-cmake rocm-runtime ];
-
-  cmakeFlags = [
-    "-DROCM_DIR=${rocm-runtime}"
-    "-DROCRTST_BLD_TYPE=Release"
+  nativeBuildInputs = [
+    cmake
+    rocm-cmake
   ];
 
+  buildInputs = [ rocm-runtime ];
+  propagatedBuildInputs = [ python3 ];
+  cmakeFlags = [ "-DROCRTST_BLD_TYPE=Release" ];
+
   prePatch = ''
-    sed 's,#!/usr/bin/env python3,#!${python3}/bin/python,' -i rocm_agent_enumerator
+    patchShebangs rocm_agent_enumerator
     sed 's,lsmod | grep ,${busybox}/bin/lsmod | ${gnugrep}/bin/grep ,' -i rocminfo.cc
   '';
 
-  installPhase = ''
-    mkdir -p $out/bin
-    cp rocminfo $out/bin
-    cp rocm_agent_enumerator $out/bin
-  '' + lib.optionalString (defaultTargets != []) ''
+  postInstall = lib.optionalString (defaultTargets != [ ]) ''
     echo '${lib.concatStringsSep "\n" defaultTargets}' > $out/bin/target.lst
   '';
 
@@ -63,6 +58,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.ncsa;
     maintainers = with maintainers; [ lovesegfault ] ++ teams.rocm.members;
     platforms = platforms.linux;
-    broken = stdenv.isAarch64;
+    broken = stdenv.isAarch64 || finalAttrs.version != stdenv.cc.version;
   };
 })
diff --git a/pkgs/tools/system/rocm-smi/default.nix b/pkgs/tools/system/rocm-smi/default.nix
index 33bda1e56455..0f303cc78531 100644
--- a/pkgs/tools/system/rocm-smi/default.nix
+++ b/pkgs/tools/system/rocm-smi/default.nix
@@ -37,5 +37,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ lovesegfault ] ++ teams.rocm.members;
     platforms = [ "x86_64-linux" ];
+    broken = finalAttrs.version != stdenv.cc.version;
   };
 })
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 22c43b4d3451..511f5b705e08 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15133,66 +15133,100 @@ with pkgs;
   rml = callPackage ../development/compilers/rml { };
 
   composable_kernel = callPackage ../development/libraries/composable_kernel {
-    inherit (llvmPackages) openmp;
+    inherit (llvmPackages_rocm) openmp clang-tools-extra;
+    stdenv = rocmClangStdenv;
   };
 
   clang-ocl = callPackage ../development/libraries/clang-ocl {
-    inherit (llvmPackages_rocm) clang;
+    stdenv = rocmClangStdenv;
   };
 
   rgxg = callPackage ../tools/text/rgxg { };
 
-  rocclr = callPackage ../development/libraries/rocclr { };
+  rocclr = callPackage ../development/libraries/rocclr {
+    stdenv = rocmClangStdenv;
+  };
 
   hip = callPackage ../development/compilers/hip {
     inherit (llvmPackages_rocm) clang llvm;
   };
 
-  hipcub = callPackage ../development/libraries/hipcub { };
+  hipcub = callPackage ../development/libraries/hipcub {
+    stdenv = rocmClangStdenv;
+  };
 
-  hipsparse = callPackage ../development/libraries/hipsparse { };
+  hipsparse = callPackage ../development/libraries/hipsparse {
+    stdenv = rocmClangStdenv;
+  };
 
-  rccl = callPackage ../development/libraries/rccl { };
+  rccl = callPackage ../development/libraries/rccl {
+    stdenv = rocmClangStdenv;
+  };
 
-  rocm-cmake = callPackage ../development/tools/build-managers/rocm-cmake { };
+  rocm-cmake = callPackage ../development/tools/build-managers/rocm-cmake {
+    stdenv = rocmClangStdenv;
+  };
 
   rocm-comgr = callPackage ../development/libraries/rocm-comgr {
-    inherit (llvmPackages_rocm) clang llvm;
+    stdenv = rocmClangStdenv;
   };
 
   rocm-device-libs = callPackage ../development/libraries/rocm-device-libs {
-    inherit (llvmPackages_rocm) clang llvm;
+    stdenv = rocmClangStdenv;
   };
 
-  rocm-opencl-icd = callPackage ../development/libraries/rocm-opencl-icd { };
+  rocm-opencl-icd = callPackage ../development/libraries/rocm-opencl-icd {
+    stdenv = rocmClangStdenv;
+  };
 
   rocm-opencl-runtime = callPackage ../development/libraries/rocm-opencl-runtime {
-    inherit (llvmPackages_rocm) clang llvm;
+    stdenv = rocmClangStdenv;
   };
 
   rocm-runtime = callPackage ../development/libraries/rocm-runtime {
-    inherit (llvmPackages_rocm) llvm;
+    stdenv = rocmClangStdenv;
   };
 
-  rocm-smi = python3Packages.callPackage ../tools/system/rocm-smi { };
+  rocm-smi = python3Packages.callPackage ../tools/system/rocm-smi {
+    stdenv = rocmClangStdenv;
+  };
 
-  rocm-thunk = callPackage ../development/libraries/rocm-thunk { };
+  rocm-thunk = callPackage ../development/libraries/rocm-thunk {
+    stdenv = rocmClangStdenv;
+  };
 
-  rocminfo = callPackage ../development/tools/rocminfo { };
+  rocminfo = callPackage ../development/tools/rocminfo {
+    stdenv = rocmClangStdenv;
+  };
 
   rocmlir = callPackage ../development/libraries/rocmlir {
-    inherit (llvmPackages_rocm) clang;
+    stdenv = rocmClangStdenv;
   };
 
-  rocprim = callPackage ../development/libraries/rocprim { };
+  rocmlir-rock = rocmlir.override {
+    buildRockCompiler = true;
+  };
 
-  rocsparse = callPackage ../development/libraries/rocsparse { };
+  rocprim = callPackage ../development/libraries/rocprim {
+    stdenv = rocmClangStdenv;
+  };
 
-  rocfft = callPackage ../development/libraries/rocfft { };
+  rocsparse = callPackage ../development/libraries/rocsparse {
+    stdenv = rocmClangStdenv;
+  };
 
-  rocrand = callPackage ../development/libraries/rocrand { };
+  rocfft = callPackage ../development/libraries/rocfft {
+    inherit (llvmPackages_rocm) openmp;
+    stdenv = rocmClangStdenv;
+  };
 
-  tensile = python3Packages.callPackage ../development/libraries/tensile { };
+  rocrand = callPackage ../development/libraries/rocrand {
+    stdenv = rocmClangStdenv;
+  };
+
+  tensile = python3Packages.callPackage ../development/libraries/tensile {
+    stdenv = rocmClangStdenv;
+  };
 
   rocwmma = callPackage ../development/libraries/rocwmma {
     inherit (llvmPackages) openmp;
@@ -15203,13 +15237,15 @@ with pkgs;
   };
 
   miopengemm = callPackage ../development/libraries/miopengemm {
-    inherit (llvmPackages_rocm) clang;
+    stdenv = rocmClangStdenv;
   };
 
   rocthrust = callPackage ../development/libraries/rocthrust { };
 
   miopen = callPackage ../development/libraries/miopen {
-    inherit (llvmPackages_rocm) clang llvm;
+    inherit (llvmPackages_rocm) llvm clang-tools-extra;
+    stdenv = rocmClangStdenv;
+    rocmlir = rocmlir-rock;
     boost = boost.override { enableStatic = true; };
   };
 

From fb8a7b62bb3f0c3e381761eb3332c8abefbbd9e6 Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Fri, 16 Dec 2022 00:51:10 -0600
Subject: [PATCH 135/231] rocm-related: standardize and fix tests/benchmarks

rocblas: standardize and fix test/benchmarks

rocthrust: standardize and fix test/benchmarks

rocwmma: standardize and fix tests/benchmarks
---
 .../development/libraries/rocblas/default.nix | 55 ++++++++++---------
 .../libraries/rocthrust/default.nix           | 49 +++++++----------
 .../rocwmma/0000-dont-fetch-googletest.patch  | 28 +++++++---
 .../development/libraries/rocwmma/default.nix | 36 +++++++-----
 pkgs/top-level/all-packages.nix               | 10 +++-
 5 files changed, 98 insertions(+), 80 deletions(-)

diff --git a/pkgs/development/libraries/rocblas/default.nix b/pkgs/development/libraries/rocblas/default.nix
index 24ead8242005..41c0b188318c 100644
--- a/pkgs/development/libraries/rocblas/default.nix
+++ b/pkgs/development/libraries/rocblas/default.nix
@@ -2,20 +2,17 @@
 , stdenv
 , fetchFromGitHub
 , rocmUpdateScript
-, fetchpatch
 , cmake
 , rocm-cmake
-, rocm-runtime
-, rocm-device-libs
-, rocm-comgr
 , hip
 , python3
 , tensile
 , msgpack
 , libxml2
-, llvm
 , gtest
 , gfortran
+, openmp
+, amd-blis
 , python3Packages
 , buildTensile ? true
 , buildTests ? false
@@ -32,6 +29,14 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "rocblas";
   version = "5.4.0";
 
+  outputs = [
+    "out"
+  ] ++ lib.optionals buildTests [
+    "test"
+  ] ++ lib.optionals buildBenchmarks [
+    "benchmark"
+  ];
+
   src = fetchFromGitHub {
     owner = "ROCmSoftwarePlatform";
     repo = "rocBLAS";
@@ -39,16 +44,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-4art8/KwH2KDLwSYcyzn/m/xwdg5wQQvgHks73aB+60=";
   };
 
-  # We currently need this patch due to faulty toolchain includes
-  # See: https://github.com/ROCmSoftwarePlatform/rocBLAS/issues/1277
-  patches = [
-    (fetchpatch {
-      name = "only-std_norm-from-rocblas_complex.patch";
-      url = "https://github.com/ROCmSoftwarePlatform/rocBLAS/commit/44b99c6df26002139ca9ec68ee1fc8899c7b001f.patch";
-      hash = "sha256-vSZkVYY951fqfOThKFqnYBasWMblS6peEJZ6sFMCk9k=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     rocm-cmake
@@ -56,19 +51,19 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    rocm-runtime
-    rocm-device-libs
-    rocm-comgr
     python3
   ] ++ lib.optionals buildTensile [
     msgpack
     libxml2
-    llvm
-    python3Packages.pyyaml
     python3Packages.msgpack
   ] ++ lib.optionals buildTests [
     gtest
+  ] ++ lib.optionals (buildTests || buildBenchmarks) [
     gfortran
+    openmp
+    amd-blis
+  ] ++ lib.optionals (buildTensile || buildTests || buildBenchmarks) [
+    python3Packages.pyyaml
   ];
 
   cmakeFlags = [
@@ -95,12 +90,12 @@ stdenv.mkDerivation (finalAttrs: {
     "-DBUILD_CLIENTS_TESTS=ON"
   ] ++ lib.optionals buildBenchmarks [
     "-DBUILD_CLIENTS_BENCHMARKS=ON"
+  ] ++ lib.optionals (buildTests || buildBenchmarks) [
+    "-DCMAKE_CXX_FLAGS=-I${amd-blis}/include/blis"
   ];
 
   # Tensile REALLY wants to write to the nix directory if we include it normally
-  # We need to manually fixup the path so tensile will generate .co and .dat files
   postPatch = lib.optionalString buildTensile ''
-    export PATH=${llvm}/bin:$PATH
     cp -a ${tensile} tensile
     chmod +w -R tensile
 
@@ -113,6 +108,18 @@ stdenv.mkDerivation (finalAttrs: {
       --replace "virtualenv_install(\''${Tensile_TEST_LOCAL_PATH})" ""
   '';
 
+  postInstall = lib.optionalString buildTests ''
+    mkdir -p $test/bin
+    cp -a $out/bin/* $test/bin
+    rm $test/bin/*-bench || true
+  '' + lib.optionalString buildBenchmarks ''
+    mkdir -p $benchmark/bin
+    cp -a $out/bin/* $benchmark/bin
+    rm $benchmark/bin/*-test || true
+  '' + lib.optionalString (buildTests || buildBenchmarks ) ''
+    rm -rf $out/bin
+  '';
+
   passthru.updateScript = rocmUpdateScript {
     name = finalAttrs.pname;
     owner = finalAttrs.src.owner;
@@ -124,8 +131,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/ROCmSoftwarePlatform/rocBLAS";
     license = with licenses; [ mit ];
     maintainers = teams.rocm.members;
-    # Tests and benchmarks are a can of worms that I will tackle in a different PR
-    # It involves completely rewriting the amd-blis derivation
-    broken = finalAttrs.version != hip.version || buildTests || buildBenchmarks;
+    broken = finalAttrs.version != hip.version;
   };
 })
diff --git a/pkgs/development/libraries/rocthrust/default.nix b/pkgs/development/libraries/rocthrust/default.nix
index 281620780832..7a45a794ad2d 100644
--- a/pkgs/development/libraries/rocthrust/default.nix
+++ b/pkgs/development/libraries/rocthrust/default.nix
@@ -4,9 +4,6 @@
 , rocmUpdateScript
 , cmake
 , rocm-cmake
-, rocm-runtime
-, rocm-device-libs
-, rocm-comgr
 , rocprim
 , hip
 , gtest
@@ -18,14 +15,13 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "rocthrust";
   version = "5.4.0";
 
-  # Comment out these outputs until tests/benchmarks are fixed (upstream?)
-  # outputs = [
-  #   "out"
-  # ] ++ lib.optionals buildTests [
-  #   "test"
-  # ] ++ lib.optionals buildBenchmarks [
-  #   "benchmark"
-  # ];
+  outputs = [
+    "out"
+  ] ++ lib.optionals buildTests [
+    "test"
+  ] ++ lib.optionals buildBenchmarks [
+    "benchmark"
+  ];
 
   src = fetchFromGitHub {
     owner = "ROCmSoftwarePlatform";
@@ -41,11 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     hip
   ];
 
-  buildInputs = [
-    rocm-runtime
-    rocm-device-libs
-    rocm-comgr
-  ] ++ lib.optionals buildTests [
+  buildInputs = lib.optionals buildTests [
     gtest
   ];
 
@@ -61,18 +53,19 @@ stdenv.mkDerivation (finalAttrs: {
     "-DBUILD_TEST=ON"
   ] ++ lib.optionals buildBenchmarks [
     "-DBUILD_BENCHMARKS=ON"
+  ] ++ lib.optionals (buildTests || buildBenchmarks) [
+    "-DCMAKE_CXX_FLAGS=-Wno-deprecated-builtins" # Too much spam
   ];
 
-  # Comment out these outputs until tests/benchmarks are fixed (upstream?)
-  # postInstall = lib.optionalString buildTests ''
-  #   mkdir -p $test/bin
-  #   mv $out/bin/test_* $test/bin
-  # '' + lib.optionalString buildBenchmarks ''
-  #   mkdir -p $benchmark/bin
-  #   mv $out/bin/benchmark_* $benchmark/bin
-  # '' + lib.optionalString (buildTests || buildBenchmarks) ''
-  #   rmdir $out/bin
-  # '';
+  postInstall = lib.optionalString buildTests ''
+    mkdir -p $test/bin
+    mv $out/bin/{test_*,*.hip} $test/bin
+  '' + lib.optionalString buildBenchmarks ''
+    mkdir -p $benchmark/bin
+    mv $out/bin/benchmark_* $benchmark/bin
+  '' + lib.optionalString (buildTests || buildBenchmarks) ''
+    rm -rf $out/bin
+  '';
 
   passthru.updateScript = rocmUpdateScript {
     name = finalAttrs.pname;
@@ -85,8 +78,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/ROCmSoftwarePlatform/rocThrust";
     license = with licenses; [ asl20 ];
     maintainers = teams.rocm.members;
-    # Tests/Benchmarks don't seem to work, thousands of errors compiling with no clear fix
-    # Is this an upstream issue? We don't seem to be missing dependencies
-    broken = finalAttrs.version != hip.version || buildTests || buildBenchmarks;
+    broken = finalAttrs.version != hip.version;
   };
 })
diff --git a/pkgs/development/libraries/rocwmma/0000-dont-fetch-googletest.patch b/pkgs/development/libraries/rocwmma/0000-dont-fetch-googletest.patch
index 7208d20a2127..cee603679758 100644
--- a/pkgs/development/libraries/rocwmma/0000-dont-fetch-googletest.patch
+++ b/pkgs/development/libraries/rocwmma/0000-dont-fetch-googletest.patch
@@ -1,19 +1,31 @@
 diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
-index 7e0f2c8..db54eab 100644
+index e1160bb..2a5462e 100644
 --- a/test/CMakeLists.txt
 +++ b/test/CMakeLists.txt
-@@ -31,14 +31,6 @@ cmake_dependent_option( ROCWMMA_BUILD_BENCHMARK_TESTS "Build benchmarking tests"
+@@ -30,26 +30,6 @@ cmake_dependent_option( ROCWMMA_BUILD_VALIDATION_TESTS "Build validation tests"
+ cmake_dependent_option( ROCWMMA_BUILD_BENCHMARK_TESTS "Build benchmarking tests" OFF "ROCWMMA_BUILD_TESTS" OFF )
  cmake_dependent_option( ROCWMMA_BUILD_EXTENDED_TESTS "Build extended test parameter coverage" OFF "ROCWMMA_BUILD_TESTS" OFF )
  
- # Test/benchmark requires additional dependencies
+-# Test/benchmark requires additional dependencies
 -include( FetchContent )
 -
 -FetchContent_Declare(
 -  googletest
--  URL https://github.com/google/googletest/archive/609281088cfefc76f9d0ce82e1ff6c30cc3591e5.zip
+-  GIT_REPOSITORY https://github.com/google/googletest.git
+-  GIT_TAG 609281088cfefc76f9d0ce82e1ff6c30cc3591e5
 -)
--FetchContent_MakeAvailable(googletest)
--
- include(GoogleTest)
+-FetchContent_GetProperties(googletest)
+-if(NOT googletest_POPULATED)
+-  # Fetch the content using default details
+-  FetchContent_Populate(googletest)
+-  # Save the shared libs setting, then force to static libs
+-  set(BUILD_SHARED_LIBS_OLD ${BUILD_SHARED_LIBS})
+-  set(BUILD_SHARED_LIBS OFF CACHE INTERNAL "Build SHARED libraries" FORCE)
+-  # Add gtest targets as static libs
+-  add_subdirectory(${googletest_SOURCE_DIR} ${googletest_BINARY_DIR})
+-  # Restore shared libs setting
+-  set(BUILD_SHARED_LIBS ${BUILD_SHARED_LIBS_OLD} CACHE INTERNAL "Build SHARED libraries" FORCE)
+-endif()
  
- set(ROCWMMA_TEST_INCLUDE_DIR ${CMAKE_CURRENT_SOURCE_DIR})
+ set(ROCWMMA_TEST_INCLUDE_DIRS ${CMAKE_CURRENT_SOURCE_DIR})
+ set(ROCWMMA_COMMON_TEST_SOURCES ${CMAKE_CURRENT_SOURCE_DIR}/hip_device.cpp
diff --git a/pkgs/development/libraries/rocwmma/default.nix b/pkgs/development/libraries/rocwmma/default.nix
index 786d48ee80ca..818d915cc133 100644
--- a/pkgs/development/libraries/rocwmma/default.nix
+++ b/pkgs/development/libraries/rocwmma/default.nix
@@ -14,6 +14,8 @@
 , python3Packages
 , buildDocs ? true
 , buildTests ? false
+, buildExtendedTests ? false
+, buildBenchmarks ? false
 , buildSamples ? false
 , gpuTargets ? [ ] # gpuTargets = [ "gfx908:xnack-" "gfx90a:xnack-" "gfx90a:xnack+" ... ]
 }:
@@ -40,8 +42,10 @@ in stdenv.mkDerivation (finalAttrs: {
     "out"
   ] ++ lib.optionals buildDocs [
     "doc"
-  ] ++ lib.optionals buildTests [
+  ] ++ lib.optionals (buildTests || buildBenchmarks) [
     "test"
+  ] ++ lib.optionals buildBenchmarks [
+    "benchmark"
   ] ++ lib.optionals buildSamples [
     "sample"
   ];
@@ -53,7 +57,7 @@ in stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-HUJPb6IahBgl/v+W4kXludBTNAjRm8k6v0jxKAX+qZM=";
   };
 
-  patches = lib.optionals buildTests [
+  patches = lib.optionals (buildTests || buildBenchmarks) [
     ./0000-dont-fetch-googletest.patch
   ];
 
@@ -65,7 +69,7 @@ in stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     openmp
-  ] ++ lib.optionals buildTests [
+  ] ++ lib.optionals (buildTests || buildBenchmarks) [
     gtest
     rocblas
   ] ++ lib.optionals buildDocs [
@@ -78,8 +82,10 @@ in stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [
     "-DCMAKE_CXX_COMPILER=hipcc"
-    "-DROCWMMA_BUILD_TESTS=${if buildTests then "ON" else "OFF"}"
+    "-DROCWMMA_BUILD_TESTS=${if buildTests || buildBenchmarks then "ON" else "OFF"}"
+    "-DROCWMMA_BUILD_VALIDATION_TESTS=ON"
     "-DROCWMMA_BUILD_SAMPLES=${if buildSamples then "ON" else "OFF"}"
+    "-DROCWMMA_VALIDATE_WITH_ROCBLAS=ON"
     # Manually define CMAKE_INSTALL_<DIR>
     # See: https://github.com/NixOS/nixpkgs/pull/197838
     "-DCMAKE_INSTALL_BINDIR=bin"
@@ -87,11 +93,10 @@ in stdenv.mkDerivation (finalAttrs: {
     "-DCMAKE_INSTALL_INCLUDEDIR=include"
   ] ++ lib.optionals (gpuTargets != [ ]) [
     "-DGPU_TARGETS=${lib.concatStringsSep ";" gpuTargets}"
-  ] ++ lib.optionals buildTests [
-    "-DROCWMMA_BUILD_VALIDATION_TESTS=ON"
-    "-DROCWMMA_BUILD_BENCHMARK_TESTS=ON"
+  ] ++ lib.optionals buildExtendedTests [
     "-DROCWMMA_BUILD_EXTENDED_TESTS=ON"
-    "-DROCWMMA_VALIDATE_WITH_ROCBLAS=ON"
+  ] ++ lib.optionals buildBenchmarks [
+    "-DROCWMMA_BUILD_BENCHMARK_TESTS=ON"
     "-DROCWMMA_BENCHMARK_WITH_ROCBLAS=ON"
   ];
 
@@ -109,16 +114,19 @@ in stdenv.mkDerivation (finalAttrs: {
   postInstall = lib.optionalString buildDocs ''
     mv ../docs/source/_build/html $out/share/doc/rocwmma
     mv ../docs/source/_build/latex/rocWMMA.pdf $out/share/doc/rocwmma
-  '' + lib.optionalString buildTests ''
+  '' + lib.optionalString (buildTests || buildBenchmarks) ''
     mkdir -p $test/bin
-    mv $out/bin/*_test* $test/bin
+    mv $out/bin/{*_test,*-validate} $test/bin
+  '' + lib.optionalString buildBenchmarks ''
+    mkdir -p $benchmark/bin
+    mv $out/bin/*-bench $benchmark/bin
   '' + lib.optionalString buildSamples ''
     mkdir -p $sample/bin
     mv $out/bin/sgemmv $sample/bin
     mv $out/bin/simple_gemm $sample/bin
     mv $out/bin/simple_dlrm $sample/bin
-  '' + lib.optionalString (buildTests || buildSamples) ''
-    rmdir $out/bin
+  '' + lib.optionalString (buildTests || buildBenchmarks || buildSamples) ''
+    rm -rf $out/bin
   '';
 
   passthru.updateScript = rocmUpdateScript {
@@ -132,8 +140,6 @@ in stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/ROCmSoftwarePlatform/rocWMMA";
     license = with licenses; [ mit ];
     maintainers = teams.rocm.members;
-    # Building tests isn't working for now
-    # undefined reference to symbol '_ZTIN7testing4TestE'
-    broken = finalAttrs.version != hip.version || buildTests;
+    broken = finalAttrs.version != hip.version;
   };
 })
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 511f5b705e08..d128b3ca725d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15229,18 +15229,22 @@ with pkgs;
   };
 
   rocwmma = callPackage ../development/libraries/rocwmma {
-    inherit (llvmPackages) openmp;
+    inherit (llvmPackages_rocm) openmp;
+    stdenv = rocmClangStdenv;
   };
 
   rocblas = callPackage ../development/libraries/rocblas {
-    inherit (llvmPackages_rocm) llvm;
+    inherit (llvmPackages_rocm) openmp;
+    stdenv = rocmClangStdenv;
   };
 
   miopengemm = callPackage ../development/libraries/miopengemm {
     stdenv = rocmClangStdenv;
   };
 
-  rocthrust = callPackage ../development/libraries/rocthrust { };
+  rocthrust = callPackage ../development/libraries/rocthrust {
+    stdenv = rocmClangStdenv;
+  };
 
   miopen = callPackage ../development/libraries/miopen {
     inherit (llvmPackages_rocm) llvm clang-tools-extra;

From f6e28e20587fbfef6b84cedb13afe25860cb33b8 Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Wed, 14 Dec 2022 02:04:14 -0600
Subject: [PATCH 136/231] hip: rewrite and separate

hip-common: init at 5.4.0

hipcc: init at 5.4.1
---
 .../hip-common/0000-fixup-paths.patch         | 129 ++++++++
 .../compilers/hip-common/default.nix          |  59 ++++
 .../compilers/hip/0000-fixup-paths.patch      |  62 ++++
 pkgs/development/compilers/hip/default.nix    | 302 ++++++++----------
 .../compilers/hip/hip-config-paths.patch      |  35 --
 .../compilers/hip/hipamd-config-paths.patch   |  73 -----
 .../compilers/hipcc/0000-fixup-paths.patch    | 130 ++++++++
 pkgs/development/compilers/hipcc/default.nix  |  62 ++++
 .../compilers/llvm/rocm/default.nix           |   4 +-
 pkgs/top-level/all-packages.nix               |  22 +-
 10 files changed, 595 insertions(+), 283 deletions(-)
 create mode 100644 pkgs/development/compilers/hip-common/0000-fixup-paths.patch
 create mode 100644 pkgs/development/compilers/hip-common/default.nix
 create mode 100644 pkgs/development/compilers/hip/0000-fixup-paths.patch
 delete mode 100644 pkgs/development/compilers/hip/hip-config-paths.patch
 delete mode 100644 pkgs/development/compilers/hip/hipamd-config-paths.patch
 create mode 100644 pkgs/development/compilers/hipcc/0000-fixup-paths.patch
 create mode 100644 pkgs/development/compilers/hipcc/default.nix

diff --git a/pkgs/development/compilers/hip-common/0000-fixup-paths.patch b/pkgs/development/compilers/hip-common/0000-fixup-paths.patch
new file mode 100644
index 000000000000..f3fd73255520
--- /dev/null
+++ b/pkgs/development/compilers/hip-common/0000-fixup-paths.patch
@@ -0,0 +1,129 @@
+diff --git a/bin/hipcc.pl b/bin/hipcc.pl
+index da9559b..7aaa540 100755
+--- a/bin/hipcc.pl
++++ b/bin/hipcc.pl
+@@ -185,7 +185,7 @@ if ($HIP_PLATFORM eq "amd") {
+     chomp($HIP_CLANG_TARGET);
+ 
+     if (! defined $HIP_CLANG_INCLUDE_PATH) {
+-        $HIP_CLANG_INCLUDE_PATH = abs_path("$HIP_CLANG_PATH/../lib/clang/$HIP_CLANG_VERSION/include");
++        $HIP_CLANG_INCLUDE_PATH = abs_path("@clang@/resource-root/include");
+     }
+     if (! defined $HIP_INCLUDE_PATH) {
+         $HIP_INCLUDE_PATH = "$HIP_PATH/include";
+@@ -206,8 +206,8 @@ if ($HIP_PLATFORM eq "amd") {
+         print ("HIP_CLANG_TARGET=$HIP_CLANG_TARGET\n");
+     }
+ 
+-    $HIPCXXFLAGS .= " -isystem \"$HIP_CLANG_INCLUDE_PATH/..\"";
+-    $HIPCFLAGS .= " -isystem \"$HIP_CLANG_INCLUDE_PATH/..\"";
++    $HIPCXXFLAGS .= " -isystem \"$HIP_CLANG_INCLUDE_PATH\"";
++    $HIPCFLAGS .= " -isystem \"$HIP_CLANG_INCLUDE_PATH\"";
+     $HIPLDFLAGS .= " -L\"$HIP_LIB_PATH\"";
+     if ($isWindows) {
+       $HIPLDFLAGS .= " -lamdhip64";
+@@ -625,7 +625,7 @@ if($HIP_PLATFORM eq "amd"){
+             $targetsStr = $ENV{HCC_AMDGPU_TARGET};
+         } elsif (not $isWindows) {
+             # Else try using rocm_agent_enumerator
+-            $ROCM_AGENT_ENUM = "${ROCM_PATH}/bin/rocm_agent_enumerator";
++            $ROCM_AGENT_ENUM = "@rocminfo@/bin/rocm_agent_enumerator";
+             $targetsStr = `${ROCM_AGENT_ENUM} -t GPU`;
+             $targetsStr =~ s/\n/,/g;
+         }
+@@ -724,16 +724,16 @@ if ($HIP_PLATFORM eq "amd") {
+ 
+     if (not $isWindows  and not $compileOnly) {
+       if ($linkType eq 0) {
+-        $toolArgs = " -L$HIP_LIB_PATH -lamdhip64 -L$ROCM_PATH/lib -lhsa-runtime64 -ldl -lnuma " . ${toolArgs};
++        $toolArgs = " -L$HIP_LIB_PATH -lamdhip64 -L@rocm_runtime@/lib -lhsa-runtime64 -ldl -lnuma " . ${toolArgs};
+       } else {
+         $toolArgs = ${toolArgs} . " -Wl,-rpath=$HIP_LIB_PATH:$ROCM_PATH/lib -lamdhip64 ";
+       }
+       # To support __fp16 and _Float16, explicitly link with compiler-rt
+-      $HIP_CLANG_BUILTIN_LIB="$HIP_CLANG_PATH/../lib/clang/$HIP_CLANG_VERSION/lib/$HIP_CLANG_TARGET/libclang_rt.builtins.a";
++      $HIP_CLANG_BUILTIN_LIB="@clang@/resource-root/lib/$HIP_CLANG_TARGET/libclang_rt.builtins.a";
+       if (-e $HIP_CLANG_BUILTIN_LIB) {
+-        $toolArgs .= " -L$HIP_CLANG_PATH/../lib/clang/$HIP_CLANG_VERSION/lib/$HIP_CLANG_TARGET -lclang_rt.builtins "
++        $toolArgs .= " -L@clang@/resource-root/lib/$HIP_CLANG_TARGET -lclang_rt.builtins "
+       } else {
+-        $toolArgs .= " -L$HIP_CLANG_PATH/../lib/clang/$HIP_CLANG_VERSION/lib/linux -lclang_rt.builtins-x86_64 "
++        $toolArgs .= " -L@clang@/resource-root/lib/linux -lclang_rt.builtins-x86_64 "
+       }
+     }
+ }
+diff --git a/bin/hipconfig.pl b/bin/hipconfig.pl
+index 5ddb8e9..6a76a2e 100755
+--- a/bin/hipconfig.pl
++++ b/bin/hipconfig.pl
+@@ -77,7 +77,7 @@ if ($HIP_COMPILER eq "clang") {
+     $CPP_CONFIG = " -D__HIP_PLATFORM_HCC__= -D__HIP_PLATFORM_AMD__=";
+ 
+     $HIP_PATH_INCLUDE = $HIP_PATH."/include";
+-    $HIP_CLANG_INCLUDE = $HIP_CLANG_PATH."/../lib/clang/".$HIP_CLANG_VERSION;
++    $HIP_CLANG_INCLUDE = "@clang@/resource-root/include";
+     if($isWindows) {
+         $CPP_CONFIG .= " -I\"$HIP_PATH_INCLUDE\" -I\"$HIP_CLANG_INCLUDE\"";
+     } else {
+@@ -168,7 +168,7 @@ if (!$printed or $p_full) {
+             print ("HIP_CLANG_PATH   : $HIP_CLANG_PATH\n");
+             if ($isWindows) {
+                 system("\"$HIP_CLANG_PATH/clang++\" --version");
+-                system("\"$HIP_CLANG_PATH/llc\" --version");
++                system("\"@llvm@/bin/llc\" --version");
+                 printf("hip-clang-cxxflags : ");
+                 $win_output = `perl \"$HIP_PATH/bin/hipcc\" --cxxflags`;
+                 printf("$win_output \n");
+@@ -177,7 +177,7 @@ if (!$printed or $p_full) {
+                 printf("$win_output \n");
+             } else {
+                 system("$HIP_CLANG_PATH/clang++ --version");
+-                system("$HIP_CLANG_PATH/llc --version");
++                system("@llvm@/bin/llc --version");
+                 print ("hip-clang-cxxflags : ");
+                 system("$HIP_PATH/bin/hipcc --cxxflags");
+                 printf("\n");
+@@ -219,8 +219,8 @@ if (!$printed or $p_full) {
+         system ("uname -a");
+     }
+ 
+-    if (-e "/usr/bin/lsb_release") {
+-        system ("/usr/bin/lsb_release -a");
++    if (-e "@lsb_release@/bin/lsb_release") {
++        system ("@lsb_release@/bin/lsb_release -a");
+     }
+ 
+     print "\n" ;
+diff --git a/hip-lang-config.cmake.in b/hip-lang-config.cmake.in
+index 9250a68..f6e27b7 100644
+--- a/hip-lang-config.cmake.in
++++ b/hip-lang-config.cmake.in
+@@ -71,8 +71,8 @@ get_filename_component(_IMPORT_PREFIX "${_DIR}/../../../" REALPATH)
+ 
+ 
+ #need _IMPORT_PREFIX to be set #FILE_REORG_BACKWARD_COMPATIBILITY
+-file(GLOB HIP_CLANG_INCLUDE_SEARCH_PATHS "${_IMPORT_PREFIX}/../llvm/lib/clang/*/include")
+-file(GLOB HIP_CLANG_INCLUDE_SEARCH_PATHS_REORG "${_IMPORT_PREFIX}/llvm/lib/clang/*/include")
++file(GLOB HIP_CLANG_INCLUDE_SEARCH_PATHS "@clang@/resource-root/include")
++file(GLOB HIP_CLANG_INCLUDE_SEARCH_PATHS_REORG "@clang@/resource-root/include")
+ find_path(HIP_CLANG_INCLUDE_PATH __clang_cuda_math.h
+     HINTS ${HIP_CLANG_INCLUDE_SEARCH_PATHS}
+           ${HIP_CLANG_INCLUDE_SEARCH_PATHS_REORG}
+@@ -89,7 +89,7 @@ find_path(HSA_HEADER hsa/hsa.h
+   PATHS
+     "${_IMPORT_PREFIX}/../include" #FILE_REORG_BACKWARD_COMPATIBILITY
+     "${_IMPORT_PREFIX}/include"
+-    "${ROCM_PATH}/include"
++    "@rocm_runtime@/include"
+ )
+ 
+ if (NOT HSA_HEADER)
+@@ -97,7 +97,7 @@ if (NOT HSA_HEADER)
+ endif()
+ 
+ get_filename_component(HIP_COMPILER_INSTALL_PATH ${CMAKE_HIP_COMPILER} DIRECTORY)
+-file(GLOB HIP_CLANGRT_LIB_SEARCH_PATHS "${HIP_COMPILER_INSTALL_PATH}/../lib/clang/*/lib/*")
++file(GLOB HIP_CLANGRT_LIB_SEARCH_PATHS "@clang@/resource-root/lib/*")
+ find_library(CLANGRT_BUILTINS
+     NAMES
+       clang_rt.builtins
diff --git a/pkgs/development/compilers/hip-common/default.nix b/pkgs/development/compilers/hip-common/default.nix
new file mode 100644
index 000000000000..a6343c920376
--- /dev/null
+++ b/pkgs/development/compilers/hip-common/default.nix
@@ -0,0 +1,59 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rocmUpdateScript
+, substituteAll
+, llvm
+, rocm-runtime
+, rocminfo
+, lsb-release
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "hip-common";
+  version = "5.4.0";
+
+  src = fetchFromGitHub {
+    owner = "ROCm-Developer-Tools";
+    repo = "HIP";
+    rev = "rocm-${finalAttrs.version}";
+    hash = "sha256-34SJM2n3jZWIS2uwpboWOXVFhaVWGK5ELPKD/cJc1zw=";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./0000-fixup-paths.patch;
+      inherit llvm rocminfo;
+      clang = stdenv.cc;
+      rocm_runtime = rocm-runtime;
+      lsb_release = lsb-release;
+    })
+  ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    mv * $out
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = rocmUpdateScript {
+    name = finalAttrs.pname;
+    owner = finalAttrs.src.owner;
+    repo = finalAttrs.src.repo;
+  };
+
+  meta = with lib; {
+    description = "C++ Heterogeneous-Compute Interface for Portability";
+    homepage = "https://github.com/ROCm-Developer-Tools/HIP";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ lovesegfault ] ++ teams.rocm.members;
+    platforms = platforms.linux;
+    broken = finalAttrs.version != stdenv.cc.version;
+  };
+})
diff --git a/pkgs/development/compilers/hip/0000-fixup-paths.patch b/pkgs/development/compilers/hip/0000-fixup-paths.patch
new file mode 100644
index 000000000000..423857218ee7
--- /dev/null
+++ b/pkgs/development/compilers/hip/0000-fixup-paths.patch
@@ -0,0 +1,62 @@
+diff --git a/hip-config.cmake.in b/hip-config.cmake.in
+index 89d1224..dc9ba05 100755
+--- a/hip-config.cmake.in
++++ b/hip-config.cmake.in
+@@ -142,7 +142,7 @@ if(HIP_COMPILER STREQUAL "clang")
+       file(TO_CMAKE_PATH "${HIP_PATH}/../lc" HIP_CLANG_ROOT)
+     endif()
+   else()
+-    set(HIP_CLANG_ROOT "${ROCM_PATH}/llvm")
++    set(HIP_CLANG_ROOT "@clang@")
+   endif()
+   if(NOT HIP_CXX_COMPILER)
+     set(HIP_CXX_COMPILER ${CMAKE_CXX_COMPILER})
+@@ -171,7 +171,7 @@ if(HIP_COMPILER STREQUAL "clang")
+     get_filename_component(_HIP_CLANG_BIN_PATH "${_HIP_CLANG_REAL_PATH}" DIRECTORY)
+     get_filename_component(HIP_CLANG_ROOT "${_HIP_CLANG_BIN_PATH}" DIRECTORY)
+   endif()
+-  file(GLOB HIP_CLANG_INCLUDE_SEARCH_PATHS ${HIP_CLANG_ROOT}/lib/clang/*/include)
++  file(GLOB HIP_CLANG_INCLUDE_SEARCH_PATHS "@clang@/resource-root/include")
+   find_path(HIP_CLANG_INCLUDE_PATH stddef.h
+       HINTS
+           ${HIP_CLANG_INCLUDE_SEARCH_PATHS}
+@@ -209,7 +209,7 @@ if(NOT WIN32)
+       "${_IMPORT_PREFIX}/include"
+       #FILE_REORG_BACKWARD_COMPATIBILITY ${_IMPORT_PREFIX}/../include is for Backward compatibility
+       "${_IMPORT_PREFIX}/../include"
+-      ${ROCM_PATH}/include
++      "@rocm_runtime@/include"
+   )
+ 
+   if (NOT HSA_HEADER)
+@@ -291,7 +291,7 @@ if(HIP_COMPILER STREQUAL "clang")
+     endif()
+   endif()
+ 
+-  file(GLOB HIP_CLANGRT_LIB_SEARCH_PATHS "${HIP_CLANG_ROOT}/lib/clang/*/lib/*")
++  file(GLOB HIP_CLANGRT_LIB_SEARCH_PATHS "@clang@/resource-root/lib/*")
+   find_library(CLANGRT_BUILTINS
+     NAMES
+       clang_rt.builtins
+diff --git a/src/hip_embed_pch.sh b/src/hip_embed_pch.sh
+index 0a1572b..2feb19a 100755
+--- a/src/hip_embed_pch.sh
++++ b/src/hip_embed_pch.sh
+@@ -149,7 +149,7 @@ EOF
+ 
+   $LLVM_DIR/bin/clang -cc1 -O3 -emit-pch -triple amdgcn-amd-amdhsa -aux-triple x86_64-unknown-linux-gnu -fcuda-is-device -std=c++17 -fgnuc-version=4.2.1 -o $tmp/hip_wave64.pch -x hip-cpp-output - <$tmp/pch_wave64.cui &&
+ 
+-  $LLVM_DIR/bin/llvm-mc -o hip_pch.o $tmp/hip_pch.mcin --filetype=obj &&
++  @llvm@/bin/llvm-mc -o hip_pch.o $tmp/hip_pch.mcin --filetype=obj &&
+ 
+   rm -rf $tmp
+ }
+@@ -195,7 +195,7 @@ EOF
+   set -x
+   $LLVM_DIR/bin/clang -O3 --rocm-path=$HIP_INC_DIR/.. -std=c++14 -nogpulib --hip-version=4.4 -isystem $HIP_INC_DIR -isystem $HIP_BUILD_INC_DIR -isystem $HIP_AMD_INC_DIR --cuda-device-only -D__HIPCC_RTC__ -x hip $tmp/hipRTC_header.h -E -o $tmp/hiprtc &&
+   cat $macroFile >> $tmp/hiprtc &&
+-  $LLVM_DIR/bin/llvm-mc -o $tmp/hiprtc_header.o $tmp/hipRTC_header.mcin --filetype=obj &&
++  @llvm@/bin/llvm-mc -o $tmp/hiprtc_header.o $tmp/hipRTC_header.mcin --filetype=obj &&
+   $LLVM_DIR/bin/clang $tmp/hiprtc_header.o -o $rtc_shared_lib_out -shared &&
+   $LLVM_DIR/bin/clang -O3 --rocm-path=$HIP_INC_DIR/.. -std=c++14 -nogpulib -nogpuinc -emit-llvm -c -o $tmp/tmp.bc --cuda-device-only -D__HIPCC_RTC__ --offload-arch=gfx906 -x hip-cpp-output $tmp/hiprtc &&
+   rm -rf $tmp
diff --git a/pkgs/development/compilers/hip/default.nix b/pkgs/development/compilers/hip/default.nix
index 066fd906984d..ecb763cea83f 100644
--- a/pkgs/development/compilers/hip/default.nix
+++ b/pkgs/development/compilers/hip/default.nix
@@ -1,114 +1,62 @@
-{ stdenv
-, binutils-unwrapped
-, clang
-, cmake
+{ lib
+, stdenv
 , fetchFromGitHub
 , fetchpatch
-, file
-, lib
-, libglvnd
-, libX11
-, libxml2
-, llvm
+, rocmUpdateScript
+, substituteAll
 , makeWrapper
-, numactl
-, perl
-, python3
-, python3Packages
+, hip-common
+, hipcc
 , rocclr
+, roctracer
+, cmake
+, perl
+, llvm
+, rocminfo
+, rocm-thunk
 , rocm-comgr
 , rocm-device-libs
-, rocm-opencl-runtime
 , rocm-runtime
-, rocm-thunk
-, rocminfo
-, substituteAll
-, writeScript
-, writeText
+, rocm-opencl-runtime
+, cudatoolkit
+, numactl
+, libxml2
+, libX11
+, libglvnd
+, doxygen
+, graphviz
+, fontconfig
+, python3Packages
+, buildDocs ? true
+, buildTests ? false
+, useNVIDIA ? false
 }:
 
 let
-  hip = stdenv.mkDerivation (finalAttrs: {
-    pname = "hip";
-    version = "5.4.0";
+  hipPlatform = if useNVIDIA then "nvidia" else "amd";
 
-    src = fetchFromGitHub {
-      owner = "ROCm-Developer-Tools";
-      repo = "HIP";
-      rev = "rocm-${finalAttrs.version}";
-      hash = "sha256-34SJM2n3jZWIS2uwpboWOXVFhaVWGK5ELPKD/cJc1zw=";
-    };
-
-    patches = [
-      (substituteAll {
-        src = ./hip-config-paths.patch;
-        inherit llvm;
-        rocm_runtime = rocm-runtime;
-      })
-    ];
-
-    # - fix bash paths
-    # - fix path to rocm_agent_enumerator
-    # - fix hcc path
-    # - fix hcc version parsing
-    # - add linker flags for libhsa-runtime64 and hc_am since libhip_hcc
-    #   refers to them.
-    prePatch = ''
-      for f in $(find bin -type f); do
-        sed -e 's,#!/usr/bin/perl,#!${perl}/bin/perl,' \
-            -e 's,#!/bin/bash,#!${stdenv.shell},' \
-            -i "$f"
-      done
-
-      sed 's,#!/usr/bin/python,#!${python3.interpreter},' -i hip_prof_gen.py
-
-      sed -e 's,$ROCM_AGENT_ENUM = "''${ROCM_PATH}/bin/rocm_agent_enumerator";,$ROCM_AGENT_ENUM = "${rocminfo}/bin/rocm_agent_enumerator";,' \
-          -e 's,^\($DEVICE_LIB_PATH=\).*$,\1"${rocm-device-libs}/amdgcn/bitcode";,' \
-          -e 's,^\($HIP_COMPILER=\).*$,\1"clang";,' \
-          -e 's,^\($HIP_RUNTIME=\).*$,\1"ROCclr";,' \
-          -e 's,^\([[:space:]]*$HSA_PATH=\).*$,\1"${rocm-runtime}";,'g \
-          -e 's,^\([[:space:]]*\)$HIP_CLANG_INCLUDE_PATH = abs_path("$HIP_CLANG_PATH/../lib/clang/$HIP_CLANG_VERSION/include");,\1$HIP_CLANG_INCLUDE_PATH = "${llvm}/lib/clang/$HIP_CLANG_VERSION/include";,' \
-          -e 's,^\([[:space:]]*$HIPCXXFLAGS .= " -isystem \\"$HIP_CLANG_INCLUDE_PATH/..\\"\)";,\1 -isystem ${rocm-runtime}/include";,' \
-          -e 's,$HIP_CLANG_PATH/../lib/clang/$HIP_CLANG_VERSION,$HIP_CLANG_PATH/../resource-root,g' \
-          -e 's,`file,`${file}/bin/file,g' \
-          -e 's,`readelf,`${binutils-unwrapped}/bin/readelf,' \
-          -e 's, ar , ${binutils-unwrapped}/bin/ar ,g' \
-          -i bin/hipcc.pl
-
-      sed -e 's,^\($HSA_PATH=\).*$,\1"${rocm-runtime}";,' \
-          -e 's,^\($HIP_CLANG_PATH=\).*$,\1"${clang}/bin";,' \
-          -e 's,^\($HIP_PLATFORM=\).*$,\1"amd";,' \
-          -e 's,$HIP_CLANG_PATH/llc,${llvm}/bin/llc,' \
-          -e 's, abs_path, Cwd::abs_path,' \
-          -i bin/hipconfig.pl
-
-      sed -e 's, abs_path, Cwd::abs_path,' -i bin/hipvars.pm
-    '';
-
-    buildPhase = "";
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out
-      cp -r * $out/
-
-      runHook postInstall
-    '';
-
-    meta = with lib; {
-      description = "C++ Heterogeneous-Compute Interface for Portability";
-      homepage = "https://github.com/ROCm-Developer-Tools/HIP";
-      license = licenses.mit;
-      maintainers = with maintainers; [ lovesegfault ] ++ teams.rocm.members;
-      platforms = platforms.linux;
-    };
-  });
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "hip";
+  wrapperArgs = [
+    "--prefix PATH : $out/bin"
+    "--prefix LD_LIBRARY_PATH : ${rocm-runtime}"
+    "--set HIP_PLATFORM ${hipPlatform}"
+    "--set HIP_PATH $out"
+    "--set HIP_CLANG_PATH ${stdenv.cc}/bin"
+    "--set DEVICE_LIB_PATH ${rocm-device-libs}/amdgcn/bitcode"
+    "--set HSA_PATH ${rocm-runtime}"
+    "--set ROCM_PATH $out"
+  ] ++ lib.optionals useNVIDIA [
+    "--set CUDA_PATH ${cudatoolkit}"
+  ];
+in stdenv.mkDerivation (finalAttrs: {
+  pname = "hip-${hipPlatform}";
   version = "5.4.0";
 
+  outputs = [
+    "out"
+  ] ++ lib.optionals buildDocs [
+    "doc"
+  ];
+
   src = fetchFromGitHub {
     owner = "ROCm-Developer-Tools";
     repo = "hipamd";
@@ -116,105 +64,115 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-VL0vZVv099pZPX0J2pXPFvrhkVO/b6X+ZZDaD9B1hYI=";
   };
 
-  nativeBuildInputs = [ cmake python3 makeWrapper perl ];
-  buildInputs = [ libxml2 numactl libglvnd libX11 python3Packages.cppheaderparser ];
-  propagatedBuildInputs = [
-    clang
-    llvm
-    rocm-comgr
-    rocm-device-libs
-    rocm-runtime
-    rocm-thunk
-    rocminfo
-  ];
-
   patches = [
     (substituteAll {
-      src = ./hipamd-config-paths.patch;
-      inherit clang llvm hip;
+      src = ./0000-fixup-paths.patch;
+      inherit llvm;
+      clang = stdenv.cc;
       rocm_runtime = rocm-runtime;
     })
+
+    # https://github.com/ROCm-Developer-Tools/hipamd/commit/be33ec55acc104a59d01df5912261d007c7f3ee9
+    (fetchpatch {
+      url = "https://github.com/ROCm-Developer-Tools/hipamd/commit/be33ec55acc104a59d01df5912261d007c7f3ee9.patch";
+      hash = "sha256-eTC4mUIN1FwRce1n38uDOlITFL/vpcOhvnaZTo5R7lo=";
+    })
   ];
 
-  prePatch = ''
-    sed -e 's,#!/bin/bash,#!${stdenv.shell},' \
-        -i src/hip_embed_pch.sh
-  '';
+  nativeBuildInputs = [
+    makeWrapper
+    cmake
+    perl
+    python3Packages.python
+    python3Packages.cppheaderparser
+  ] ++ lib.optionals buildDocs [
+    doxygen
+    graphviz
+    fontconfig
+  ];
 
-  preConfigure = ''
-    export HIP_CLANG_PATH=${clang}/bin
-    export DEVICE_LIB_PATH=${rocm-device-libs}/lib
-  '';
+  buildInputs = [
+    numactl
+    libxml2
+    libX11
+    libglvnd
+  ];
+
+  propagatedBuildInputs = [
+    stdenv.cc
+    llvm
+    rocminfo
+    rocm-thunk
+    rocm-comgr
+    rocm-device-libs
+    rocm-runtime
+    rocm-opencl-runtime
+  ] ++ lib.optionals useNVIDIA [
+    cudatoolkit
+  ];
 
   cmakeFlags = [
-    "-DHIP_PLATFORM=amd"
-    "-DAMD_OPENCL_PATH=${rocm-opencl-runtime.src}"
-    "-DHIP_COMMON_DIR=${hip}"
+    "-DROCM_PATH=${rocminfo}"
+    "-DHIP_PLATFORM=${hipPlatform}"
+    "-DHIP_COMMON_DIR=${hip-common}"
+    "-DHIPCC_BIN_DIR=${hipcc}/bin"
+    "-DHIP_LLVM_ROOT=${stdenv.cc}"
     "-DROCCLR_PATH=${rocclr}"
-    "-DHIP_VERSION_BUILD_ID=0"
+    "-DAMD_OPENCL_PATH=${rocm-opencl-runtime.src}"
+    "-DPROF_API_HEADER_PATH=${roctracer.src}/inc/ext"
     # Temporarily set variables to work around upstream CMakeLists issue
     # Can be removed once https://github.com/ROCm-Developer-Tools/hipamd/issues/55 is fixed
     "-DCMAKE_INSTALL_BINDIR=bin"
     "-DCMAKE_INSTALL_INCLUDEDIR=include"
     "-DCMAKE_INSTALL_LIBDIR=lib"
+  ] ++ lib.optionals buildTests [
+    "-DHIP_CATCH_TEST=1"
   ];
 
+  postPatch = ''
+    export HIP_CLANG_PATH=${stdenv.cc}/bin
+    patchShebangs src
+  '' + lib.optionalString buildDocs ''
+    export HOME=$(mktemp -d)
+    export FONTCONFIG_FILE=${fontconfig.out}/etc/fonts/fonts.conf
+  '';
+
+  doCheck = buildTests;
+  checkTarget = "build_tests";
+
+  preCheck = lib.optionalString buildTests ''
+    export ROCM_PATH=$PWD
+    export DEVICE_LIB_PATH=${rocm-device-libs}/amdgcn/bitcode
+    patchShebangs bin
+  '';
+
   postInstall = ''
     patchShebangs $out/bin
-    wrapProgram $out/bin/hipcc --set HIP_PATH $out --set HSA_PATH ${rocm-runtime} --set HIP_CLANG_PATH ${clang}/bin --prefix PATH : ${llvm}/bin --set ROCM_PATH $out
-    wrapProgram $out/bin/hipconfig --set HIP_PATH $out --set HSA_PATH ${rocm-runtime} --set HIP_CLANG_PATH ${clang}/bin
+    cp -a $out/bin/hipcc $out/bin/hipcc-pl
+    cp -a $out/bin/hipconfig $out/bin/hipconfig-pl
+    wrapProgram $out/bin/hipcc --set HIP_USE_PERL_SCRIPTS 0
+    wrapProgram $out/bin/hipconfig --set HIP_USE_PERL_SCRIPTS 0
+    wrapProgram $out/bin/hipcc.bin ${lib.concatStringsSep " " wrapperArgs}
+    wrapProgram $out/bin/hipconfig.bin ${lib.concatStringsSep " " wrapperArgs}
+    wrapProgram $out/bin/hipcc-pl --set HIP_USE_PERL_SCRIPTS 1
+    wrapProgram $out/bin/hipconfig-pl --set HIP_USE_PERL_SCRIPTS 1
+    wrapProgram $out/bin/hipcc.pl ${lib.concatStringsSep " " wrapperArgs}
+    wrapProgram $out/bin/hipconfig.pl ${lib.concatStringsSep " " wrapperArgs}
   '';
 
-  # TODO: Separate HIP and hipamd into separate derivations
-  passthru.updateScript = writeScript "update.sh" ''
-    #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p curl jq common-updater-scripts nix-prefetch-github
-    version="$(curl ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
-      -sL "https://api.github.com/repos/ROCm-Developer-Tools/HIP/releases?per_page=1" | jq '.[0].tag_name | split("-") | .[1]' --raw-output)"
-
-    IFS='.' read -a version_arr <<< "$version"
-
-    if [ "''${#version_arr[*]}" == 2 ]; then
-      version="''${version}.0"
-    fi
-
-    current_version="$(grep "version =" pkgs/development/compilers/hip/default.nix | head -n1 | cut -d'"' -f2)"
-    if [[ "$version" != "$current_version" ]]; then
-      tarball_meta="$(nix-prefetch-github ROCm-Developer-Tools HIP --rev "rocm-$version")"
-      tarball_hash="$(nix to-base64 sha256-$(jq -r '.sha256' <<< "$tarball_meta"))"
-      sed -i -z "pkgs/development/compilers/hip/default.nix" \
-        -e 's,version = "[^'"'"'"]*",version = "'"$version"'",1' \
-        -e 's,hash = "[^'"'"'"]*",hash = "sha256-'"$tarball_hash"'",1'
-    else
-      echo hip already up-to-date
-    fi
-
-    version="$(curl ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
-      -sL "https://api.github.com/repos/ROCm-Developer-Tools/hipamd/releases?per_page=1" | jq '.[0].tag_name | split("-") | .[1]' --raw-output)"
-
-    IFS='.' read -a version_arr <<< "$version"
-
-    if [ "''${#version_arr[*]}" == 2 ]; then
-      version="''${version}.0"
-    fi
-
-    current_version="$(grep "version =" pkgs/development/compilers/hip/default.nix | tail -n1 | cut -d'"' -f2)"
-    if [[ "$version" != "$current_version" ]]; then
-      tarball_meta="$(nix-prefetch-github ROCm-Developer-Tools hipamd --rev "rocm-$version")"
-      tarball_hash="$(nix to-base64 sha256-$(jq -r '.sha256' <<< "$tarball_meta"))"
-      sed -i -z "pkgs/development/compilers/hip/default.nix" \
-        -e 's,version = "[^'"'"'"]*",version = "'"$version"'",2' \
-        -e 's,hash = "[^'"'"'"]*",hash = "sha256-'"$tarball_hash"'",2'
-    else
-      echo hipamd already up-to-date
-    fi
-  '';
+  passthru.updateScript = rocmUpdateScript {
+    name = finalAttrs.pname;
+    owner = finalAttrs.src.owner;
+    repo = finalAttrs.src.repo;
+  };
 
   meta = with lib; {
-    description = "C++ Heterogeneous-Compute Interface for Portability";
+    description = "C++ Heterogeneous-Compute Interface for Portability specifically for AMD platform";
     homepage = "https://github.com/ROCm-Developer-Tools/hipamd";
-    license = licenses.mit;
+    license = with licenses; [ mit ];
     maintainers = with maintainers; [ lovesegfault ] ++ teams.rocm.members;
     platforms = platforms.linux;
+    # Tests require GPU, also include issues
+    broken = finalAttrs.version != hip-common.version || finalAttrs.version != hipcc.version || buildTests;
   };
 })
diff --git a/pkgs/development/compilers/hip/hip-config-paths.patch b/pkgs/development/compilers/hip/hip-config-paths.patch
deleted file mode 100644
index 25fa3b8da95a..000000000000
--- a/pkgs/development/compilers/hip/hip-config-paths.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-diff --git a/hip-lang-config.cmake.in b/hip-lang-config.cmake.in
-index 1a72643a..7f35031f 100644
---- a/hip-lang-config.cmake.in
-+++ b/hip-lang-config.cmake.in
-@@ -71,8 +71,8 @@ get_filename_component(_IMPORT_PREFIX "${_DIR}/../../../" REALPATH)
- 
- 
- #need _IMPORT_PREFIX to be set #FILE_REORG_BACKWARD_COMPATIBILITY
--file(GLOB HIP_CLANG_INCLUDE_SEARCH_PATHS "${_IMPORT_PREFIX}/../llvm/lib/clang/*/include")
--file(GLOB HIP_CLANG_INCLUDE_SEARCH_PATHS_REORG "${_IMPORT_PREFIX}/llvm/lib/clang/*/include")
-+file(GLOB HIP_CLANG_INCLUDE_SEARCH_PATHS "@llvm@/lib/clang/*/include")
-+file(GLOB HIP_CLANG_INCLUDE_SEARCH_PATHS_REORG "@llvm@/lib/clang/*/include")
- find_path(HIP_CLANG_INCLUDE_PATH __clang_cuda_math.h
-     HINTS ${HIP_CLANG_INCLUDE_SEARCH_PATHS}
-           ${HIP_CLANG_INCLUDE_SEARCH_PATHS_REORG}
-@@ -87,9 +87,7 @@ endif()
- #if HSA is not under ROCm then provide CMAKE_PREFIX_PATH=<HSA_PATH>
- find_path(HSA_HEADER hsa/hsa.h
-   PATHS
--    "${_IMPORT_PREFIX}/../include" #FILE_REORG_BACKWARD_COMPATIBILITY
--    "${_IMPORT_PREFIX}/include"
--    "${ROCM_PATH}/include"
-+    "@rocm_runtime@/include"
- )
- 
- if (NOT HSA_HEADER)
-@@ -97,7 +94,7 @@ if (HSA_HEADER-NOTFOUND)
- endif()
- 
- get_filename_component(HIP_COMPILER_INSTALL_PATH ${CMAKE_HIP_COMPILER} DIRECTORY)
--file(GLOB HIP_CLANGRT_LIB_SEARCH_PATHS "${HIP_COMPILER_INSTALL_PATH}/../lib/clang/*/lib/*")
-+file(GLOB HIP_CLANGRT_LIB_SEARCH_PATHS "@llvm@/lib/clang/*/lib/*")
- find_library(CLANGRT_BUILTINS
-     NAMES
-       clang_rt.builtins
diff --git a/pkgs/development/compilers/hip/hipamd-config-paths.patch b/pkgs/development/compilers/hip/hipamd-config-paths.patch
deleted file mode 100644
index 78838836e9aa..000000000000
--- a/pkgs/development/compilers/hip/hipamd-config-paths.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-diff --git a/hip-config.cmake.in b/hip-config.cmake.in
-index 89d1224e..120b68c6 100755
---- a/hip-config.cmake.in
-+++ b/hip-config.cmake.in
-@@ -142,7 +142,7 @@ if(HIP_COMPILER STREQUAL "clang")
-       file(TO_CMAKE_PATH "${HIP_PATH}/../lc" HIP_CLANG_ROOT)
-     endif()
-   else()
--    set(HIP_CLANG_ROOT "${ROCM_PATH}/llvm")
-+    set(HIP_CLANG_ROOT "@clang@")
-   endif()
-   if(NOT HIP_CXX_COMPILER)
-     set(HIP_CXX_COMPILER ${CMAKE_CXX_COMPILER})
-@@ -206,10 +206,7 @@ if(NOT WIN32)
-   #if HSA is not under ROCm then provide CMAKE_PREFIX_PATH=<HSA_PATH>
-   find_path(HSA_HEADER hsa/hsa.h
-     PATHS
--      "${_IMPORT_PREFIX}/include"
--      #FILE_REORG_BACKWARD_COMPATIBILITY ${_IMPORT_PREFIX}/../include is for Backward compatibility
--      "${_IMPORT_PREFIX}/../include"
--      ${ROCM_PATH}/include
-+      "@rocm_runtime@/include"
-   )
-
-   if (NOT HSA_HEADER)
-@@ -224,8 +221,8 @@ set_target_properties(hip::host PROPERTIES
-
- if(HIP_RUNTIME MATCHES "rocclr")
-   set_target_properties(hip::amdhip64 PROPERTIES
--    INTERFACE_INCLUDE_DIRECTORIES "${_IMPORT_PREFIX}/include;${HSA_HEADER}"
--    INTERFACE_SYSTEM_INCLUDE_DIRECTORIES "${_IMPORT_PREFIX}/include;${HSA_HEADER}"
-+    INTERFACE_INCLUDE_DIRECTORIES "@hip@/include;${HSA_HEADER}"
-+    INTERFACE_SYSTEM_INCLUDE_DIRECTORIES "@hip@/include;${HSA_HEADER}"
-   )
-
-   get_target_property(amdhip64_type hip::amdhip64 TYPE)
-@@ -233,8 +230,8 @@ if(HIP_RUNTIME MATCHES "rocclr")
-
-   if(NOT WIN32)
-     set_target_properties(hip::device PROPERTIES
--      INTERFACE_INCLUDE_DIRECTORIES "${_IMPORT_PREFIX}/include"
--      INTERFACE_SYSTEM_INCLUDE_DIRECTORIES "${_IMPORT_PREFIX}/include"
-+      INTERFACE_INCLUDE_DIRECTORIES "@hip@/include"
-+      INTERFACE_SYSTEM_INCLUDE_DIRECTORIES "@hip@/include"
-     )
-   endif()
- endif()
-diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
-index 83866d83..4125d3aa 100644
---- a/src/CMakeLists.txt
-+++ b/src/CMakeLists.txt
-@@ -178,7 +178,7 @@ if(__HIP_ENABLE_PCH)
-       ${ROCM_PATH}/llvm)
-   # find_package(LLVM) returns the lib/cmake/llvm location. We require the root.
-   if(NOT DEFINED HIP_LLVM_ROOT)
--    set(HIP_LLVM_ROOT "${LLVM_DIR}/../../..")
-+    set(HIP_LLVM_ROOT "@clang@")
-   endif()
-
-   execute_process(COMMAND sh -c "${CMAKE_CURRENT_SOURCE_DIR}/hip_embed_pch.sh ${HIP_COMMON_INCLUDE_DIR} ${PROJECT_BINARY_DIR}/include ${PROJECT_SOURCE_DIR}/include ${HIP_LLVM_ROOT}" COMMAND_ECHO STDERR RESULT_VARIABLE EMBED_PCH_RC)
-diff --git a/src/hip_embed_pch.sh b/src/hip_embed_pch.sh
-index 0a1572b2..aa855d63 100755
---- a/src/hip_embed_pch.sh
-+++ b/src/hip_embed_pch.sh
-@@ -149,7 +149,7 @@ EOF
-
-   $LLVM_DIR/bin/clang -cc1 -O3 -emit-pch -triple amdgcn-amd-amdhsa -aux-triple x86_64-unknown-linux-gnu -fcuda-is-device -std=c++17 -fgnuc-version=4.2.1 -o $tmp/hip_wave64.pch -x hip-cpp-output - <$tmp/pch_wave64.cui &&
-
--  $LLVM_DIR/bin/llvm-mc -o hip_pch.o $tmp/hip_pch.mcin --filetype=obj &&
-+  @llvm@/bin/llvm-mc -o hip_pch.o $tmp/hip_pch.mcin --filetype=obj &&
-
-   rm -rf $tmp
- }
diff --git a/pkgs/development/compilers/hipcc/0000-fixup-paths.patch b/pkgs/development/compilers/hipcc/0000-fixup-paths.patch
new file mode 100644
index 000000000000..4f52c1ad11aa
--- /dev/null
+++ b/pkgs/development/compilers/hipcc/0000-fixup-paths.patch
@@ -0,0 +1,130 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index c21f247..5bd3e45 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -17,6 +17,6 @@ if (NOT WIN32) # C++17 does not require the std lib linking
+   target_link_libraries(hipconfig.bin ${LINK_LIBS} ) # for hipconfig.bin
+ endif()
+ 
+-set(HIP_VERSION_MAJOR 4 PARENT_SCOPE)
+-set(HIP_VERSION_MINOR 4 PARENT_SCOPE)
+-set(HIP_VERSION_PATCH 4 PARENT_SCOPE)
++set(HIP_VERSION_MAJOR @version_major@)
++set(HIP_VERSION_MINOR @version_minor@)
++set(HIP_VERSION_PATCH @version_patch@)
+diff --git a/src/hipBin_amd.h b/src/hipBin_amd.h
+index f94e4a5..f0b1b83 100644
+--- a/src/hipBin_amd.h
++++ b/src/hipBin_amd.h
+@@ -207,7 +207,7 @@ void HipBinAmd::initializeHipCXXFlags() {
+   hipClangIncludePath = getCompilerIncludePath();
+   hipCXXFlags += " -isystem \"" + hipClangIncludePath;
+   fs::path hipCXXFlagsTempFs = hipCXXFlags;
+-  hipCXXFlagsTempFs /= "..\"";
++  hipCXXFlagsTempFs /= "\"";
+   hipCXXFlags = hipCXXFlagsTempFs.string();
+   const EnvVariables& var = getEnvVariables();
+   // Allow __fp16 as function parameter and return type.
+@@ -266,7 +266,7 @@ void HipBinAmd::printCompilerInfo() const {
+     string cmd = hipClangPath + "/clang++ --version";
+     system(cmd.c_str());  // hipclang version
+     cout << "llc-version :" << endl;
+-    cmd = hipClangPath + "/llc --version";
++    cmd = "@llvm@/bin/llc --version";
+     system(cmd.c_str());  // llc version
+     cout << "hip-clang-cxxflags :" << endl;
+     cmd = hipPath + "/bin/hipcc  --cxxflags";
+@@ -278,7 +278,7 @@ void HipBinAmd::printCompilerInfo() const {
+   } else {
+     string cmd = hipClangPath + "/clang++ --version";
+     system(cmd.c_str());  // hipclang version
+-    cmd = hipClangPath + "/llc --version";
++    cmd = "@llvm@/bin/llc --version";
+     system(cmd.c_str());  // llc version
+     cout << "hip-clang-cxxflags :" << endl;
+     cmd = hipPath + "/bin/hipcc --cxxflags";
+@@ -331,10 +331,7 @@ string HipBinAmd::getCppConfig() {
+   hipPathInclude /= "include";
+ 
+   const string& compilerPath = getCompilerPath();
+-  hipClangInclude = compilerPath;
+-  hipClangInclude = hipClangInclude.parent_path();
+-  hipClangInclude /= "lib/clang/";
+-  hipClangInclude /= compilerVersion;
++  hipClangInclude = "@clang@/resource-root/include";
+   string hipClangPath = hipClangInclude.string();
+ 
+   const OsType& osInfo = getOSInfo();
+@@ -442,17 +439,7 @@ string HipBinAmd::getHipCC() const {
+ 
+ 
+ string HipBinAmd::getCompilerIncludePath() {
+-  string hipClangVersion, includePath, compilerIncludePath;
+-  const string& hipClangPath = getCompilerPath();
+-  hipClangVersion = getCompilerVersion();
+-  fs::path includePathfs = hipClangPath;
+-  includePathfs = includePathfs.parent_path();
+-  includePathfs /= "lib/clang/";
+-  includePathfs /= hipClangVersion;
+-  includePathfs /= "include";
+-  includePathfs = fs::absolute(includePathfs).string();
+-  compilerIncludePath = includePathfs.string();
+-  return compilerIncludePath;
++  return "@clang@/resource-root/include";
+ }
+ 
+ 
+@@ -506,8 +493,8 @@ void HipBinAmd::printFull() {
+   cout << endl << "== Envirnoment Variables" << endl;
+   printEnvironmentVariables();
+   getSystemInfo();
+-  if (fs::exists("/usr/bin/lsb_release"))
+-    system("/usr/bin/lsb_release -a");
++  if (fs::exists("@lsb_release@/bin/lsb_release"))
++    system("@lsb_release@/bin/lsb_release -a");
+   cout << endl;
+ }
+ 
+@@ -993,7 +980,7 @@ void HipBinAmd::executeHipCCCmd(vector<string> argv) {
+     } else if (os != windows) {
+       // Else try using rocm_agent_enumerator
+       string ROCM_AGENT_ENUM;
+-      ROCM_AGENT_ENUM = roccmPath + "/bin/rocm_agent_enumerator";
++      ROCM_AGENT_ENUM = "@rocminfo@/bin/rocm_agent_enumerator";
+       targetsStr = ROCM_AGENT_ENUM +" -t GPU";
+       SystemCmdOut sysOut = hipBinUtilPtr_->exec(targetsStr.c_str());
+       regex toReplace("\n+");
+@@ -1097,7 +1084,7 @@ void HipBinAmd::executeHipCCCmd(vector<string> argv) {
+     string hipClangVersion, toolArgTemp;
+     if (linkType == 0) {
+       toolArgTemp = " -L"+ hipLibPath + "-lamdhip64 -L" +
+-                      roccmPath+ "/lib -lhsa-runtime64 -ldl -lnuma " + toolArgs;
++                      "@rocm_runtime@/lib -lhsa-runtime64 -ldl -lnuma " + toolArgs;
+       toolArgs = toolArgTemp;
+     } else {
+       toolArgTemp =  toolArgs + " -Wl,--enable-new-dtags -Wl,-rpath=" + hipLibPath + ":"
+@@ -1107,8 +1094,7 @@ void HipBinAmd::executeHipCCCmd(vector<string> argv) {
+ 
+     hipClangVersion = getCompilerVersion();
+     // To support __fp16 and _Float16, explicitly link with compiler-rt
+-    toolArgs += " -L" + hipClangPath + "/../lib/clang/" +
+-                hipClangVersion + "/lib/linux -lclang_rt.builtins-x86_64 ";
++    toolArgs += " -L@clang@/resource-root/lib/linux -lclang_rt.builtins-x86_64 ";
+   }
+   if (!var.hipccCompileFlagsAppendEnv_.empty()) {
+     HIPCXXFLAGS += " " + var.hipccCompileFlagsAppendEnv_ + " ";
+diff --git a/src/hipBin_nvidia.h b/src/hipBin_nvidia.h
+index 6feb315..b61739d 100644
+--- a/src/hipBin_nvidia.h
++++ b/src/hipBin_nvidia.h
+@@ -157,8 +157,8 @@ void HipBinNvidia::printFull() {
+   cout << endl << "== Envirnoment Variables" << endl;
+   printEnvironmentVariables();
+   getSystemInfo();
+-  if (fs::exists("/usr/bin/lsb_release"))
+-    system("/usr/bin/lsb_release -a");
++  if (fs::exists("@lsb_release@/bin/lsb_release"))
++    system("@lsb_release@/bin/lsb_release -a");
+ }
+ 
+ // returns hip include
diff --git a/pkgs/development/compilers/hipcc/default.nix b/pkgs/development/compilers/hipcc/default.nix
new file mode 100644
index 000000000000..8351e3a29123
--- /dev/null
+++ b/pkgs/development/compilers/hipcc/default.nix
@@ -0,0 +1,62 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rocmUpdateScript
+, substituteAll
+, cmake
+, llvm
+, rocm-runtime
+, rocminfo
+, lsb-release
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "hipcc";
+  version = "5.4.1";
+
+  src = fetchFromGitHub {
+    owner = "ROCm-Developer-Tools";
+    repo = "HIPCC";
+    rev = "rocm-${finalAttrs.version}";
+    hash = "sha256-PEwue4O43MiMkF8UmTeHsmlikBG2V3/nFQLKmtHrRWQ=";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./0000-fixup-paths.patch;
+      inherit llvm rocminfo;
+      version_major = lib.versions.major finalAttrs.version;
+      version_minor = lib.versions.minor finalAttrs.version;
+      version_patch = lib.versions.patch finalAttrs.version;
+      clang = stdenv.cc;
+      rocm_runtime = rocm-runtime;
+      lsb_release = lsb-release;
+    })
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    mv *.bin $out/bin
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = rocmUpdateScript {
+    name = finalAttrs.pname;
+    owner = finalAttrs.src.owner;
+    repo = finalAttrs.src.repo;
+  };
+
+  meta = with lib; {
+    description = "Compiler driver utility that calls clang or nvcc";
+    homepage = "https://github.com/ROCm-Developer-Tools/HIPCC";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ lovesegfault ] ++ teams.rocm.members;
+    platforms = platforms.linux;
+    broken = finalAttrs.version != stdenv.cc.version;
+  };
+})
diff --git a/pkgs/development/compilers/llvm/rocm/default.nix b/pkgs/development/compilers/llvm/rocm/default.nix
index 4f96c567a631..75314a4b4633 100644
--- a/pkgs/development/compilers/llvm/rocm/default.nix
+++ b/pkgs/development/compilers/llvm/rocm/default.nix
@@ -12,7 +12,7 @@
 , swig
 , lua5_3
 , gtest
-, hipcc
+, hip
 , rocm-comgr
 , vulkan-loader
 , vulkan-headers
@@ -471,7 +471,7 @@ in rec {
     buildMan = false; # No man pages to build
     targetName = "mlir";
     targetDir = targetName;
-    extraNativeBuildInputs = [ hipcc ];
+    extraNativeBuildInputs = [ hip ];
 
     extraBuildInputs = [
       rocm-comgr
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d128b3ca725d..08f3d9f25ba2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15147,8 +15147,28 @@ with pkgs;
     stdenv = rocmClangStdenv;
   };
 
+  hip-common = callPackage ../development/compilers/hip-common {
+    inherit (llvmPackages_rocm) llvm;
+    stdenv = rocmClangStdenv;
+  };
+
+  hipcc = callPackage ../development/compilers/hipcc {
+    inherit (llvmPackages_rocm) llvm;
+    stdenv = rocmClangStdenv;
+  };
+
   hip = callPackage ../development/compilers/hip {
-    inherit (llvmPackages_rocm) clang llvm;
+    inherit (llvmPackages_rocm) llvm;
+    inherit (cudaPackages) cudatoolkit;
+    stdenv = rocmClangStdenv;
+  };
+
+  hip-amd = hip.override {
+    useNVIDIA = false;
+  };
+
+  hip-nvidia = hip.override {
+    useNVIDIA = true;
   };
 
   hipcub = callPackage ../development/libraries/hipcub {

From b943545109674c85163b9e034a6f4798262ef3c3 Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Fri, 16 Dec 2022 03:27:28 -0600
Subject: [PATCH 137/231] rocprofiler: init at 5.4.0

---
 ...0000-dont-require-hsa_amd_aqlprofile.patch | 20 ++++++
 .../libraries/rocprofiler/default.nix         | 65 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  4 ++
 3 files changed, 89 insertions(+)
 create mode 100644 pkgs/development/libraries/rocprofiler/0000-dont-require-hsa_amd_aqlprofile.patch
 create mode 100644 pkgs/development/libraries/rocprofiler/default.nix

diff --git a/pkgs/development/libraries/rocprofiler/0000-dont-require-hsa_amd_aqlprofile.patch b/pkgs/development/libraries/rocprofiler/0000-dont-require-hsa_amd_aqlprofile.patch
new file mode 100644
index 000000000000..b70163b08e48
--- /dev/null
+++ b/pkgs/development/libraries/rocprofiler/0000-dont-require-hsa_amd_aqlprofile.patch
@@ -0,0 +1,20 @@
+diff --git a/src/util/hsa_rsrc_factory.cpp b/src/util/hsa_rsrc_factory.cpp
+index 643ff16..c08d98f 100644
+--- a/src/util/hsa_rsrc_factory.cpp
++++ b/src/util/hsa_rsrc_factory.cpp
+@@ -127,15 +127,6 @@ HsaRsrcFactory::HsaRsrcFactory(bool initialize_hsa) : initialize_hsa_(initialize
+   if (cpu_pool_ == NULL) CHECK_STATUS("CPU memory pool is not found", HSA_STATUS_ERROR);
+   if (kern_arg_pool_ == NULL) CHECK_STATUS("Kern-arg memory pool is not found", HSA_STATUS_ERROR);
+
+-  // Get AqlProfile API table
+-  aqlprofile_api_ = {0};
+-#ifdef ROCP_LD_AQLPROFILE
+-  status = LoadAqlProfileLib(&aqlprofile_api_);
+-#else
+-  status = hsa_api_.hsa_system_get_major_extension_table(HSA_EXTENSION_AMD_AQLPROFILE, hsa_ven_amd_aqlprofile_VERSION_MAJOR, sizeof(aqlprofile_api_), &aqlprofile_api_);
+-#endif
+-  CHECK_STATUS("aqlprofile API table load failed", status);
+-
+   // Get Loader API table
+   loader_api_ = {0};
+   status = hsa_api_.hsa_system_get_major_extension_table(HSA_EXTENSION_AMD_LOADER, 1, sizeof(loader_api_), &loader_api_);
diff --git a/pkgs/development/libraries/rocprofiler/default.nix b/pkgs/development/libraries/rocprofiler/default.nix
new file mode 100644
index 000000000000..0d0639edbe53
--- /dev/null
+++ b/pkgs/development/libraries/rocprofiler/default.nix
@@ -0,0 +1,65 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rocmUpdateScript
+, cmake
+, rocm-runtime
+, rocm-thunk
+, roctracer
+, numactl
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "rocprofiler";
+  version = "5.4.0";
+
+  src = fetchFromGitHub {
+    owner = "ROCm-Developer-Tools";
+    repo = "rocprofiler";
+    rev = "rocm-${finalAttrs.version}";
+    hash = "sha256-CpD/+soMN8WTeSb5X7dsnZ596PMkw+4EVsVSvFtKCak=";
+  };
+
+  patches = [ ./0000-dont-require-hsa_amd_aqlprofile.patch ];
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [
+    rocm-thunk
+    rocm-runtime
+    numactl
+  ];
+
+  cmakeFlags = [
+    "-DPROF_API_HEADER_PATH=${roctracer.src}/inc/ext"
+    # Manually define CMAKE_INSTALL_<DIR>
+    # See: https://github.com/NixOS/nixpkgs/pull/197838
+    "-DCMAKE_INSTALL_BINDIR=bin"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ];
+
+  postPatch = ''
+    patchShebangs bin test
+
+    substituteInPlace cmake_modules/env.cmake \
+      --replace "FATAL_ERROR \"AQL_PROFILE" "WARNING \"AQL_PROFILE"
+  '';
+
+  postInstall = ''
+    patchelf --set-rpath $out/lib:${lib.makeLibraryPath finalAttrs.buildInputs} $out/lib/rocprofiler/librocprof-tool.so
+  '';
+
+  passthru.updateScript = rocmUpdateScript {
+    name = finalAttrs.pname;
+    owner = finalAttrs.src.owner;
+    repo = finalAttrs.src.repo;
+  };
+
+  meta = with lib; {
+    description = "Profiling with perf-counters and derived metrics";
+    homepage = "https://github.com/ROCm-Developer-Tools/rocprofiler";
+    license = with licenses; [ mit ]; # mitx11
+    maintainers = teams.rocm.members;
+    broken = finalAttrs.version != stdenv.cc.version;
+  };
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 08f3d9f25ba2..228dc4a6b4d6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15137,6 +15137,10 @@ with pkgs;
     stdenv = rocmClangStdenv;
   };
 
+  rocprofiler = callPackage ../development/libraries/rocprofiler {
+    stdenv = rocmClangStdenv;
+  };
+
   clang-ocl = callPackage ../development/libraries/clang-ocl {
     stdenv = rocmClangStdenv;
   };

From 5b74e4ef126b19831cdcaa6f3b7052fb4d637162 Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Fri, 16 Dec 2022 03:28:05 -0600
Subject: [PATCH 138/231] roctracer: init at 5.4.0

---
 .../libraries/roctracer/default.nix           | 97 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  5 +
 2 files changed, 102 insertions(+)
 create mode 100644 pkgs/development/libraries/roctracer/default.nix

diff --git a/pkgs/development/libraries/roctracer/default.nix b/pkgs/development/libraries/roctracer/default.nix
new file mode 100644
index 000000000000..b8d1902d468d
--- /dev/null
+++ b/pkgs/development/libraries/roctracer/default.nix
@@ -0,0 +1,97 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rocmUpdateScript
+, cmake
+, clang
+, hip
+, rocm-device-libs
+, rocprofiler
+, libxml2
+, doxygen
+, graphviz
+, python3Packages
+, buildDocs ? false # Nothing seems to be generated, so not making the output
+, buildTests ? false
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "roctracer";
+  version = "5.4.0";
+
+  outputs = [
+    "out"
+  ] ++ lib.optionals buildDocs [
+    "doc"
+  ] ++ lib.optionals buildTests [
+    "test"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "ROCm-Developer-Tools";
+    repo = "roctracer";
+    rev = "rocm-${finalAttrs.version}";
+    hash = "sha256-hDo/tz39/m6lKqLg3UJi3LWWF7/QUtVDymZY1O8L4IQ=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    clang
+    hip
+  ] ++ lib.optionals buildDocs [
+    doxygen
+    graphviz
+  ];
+
+  buildInputs = [
+    rocm-device-libs
+    rocprofiler
+    libxml2
+    python3Packages.python
+    python3Packages.cppheaderparser
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_MODULE_PATH=${hip}/hip/cmake"
+    # Manually define CMAKE_INSTALL_<DIR>
+    # See: https://github.com/NixOS/nixpkgs/pull/197838
+    "-DCMAKE_INSTALL_BINDIR=bin"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ];
+
+  postPatch = ''
+    export HIP_DEVICE_LIB_PATH=${rocm-device-libs}/amdgcn/bitcode
+  '' + lib.optionalString (!buildTests) ''
+    substituteInPlace CMakeLists.txt \
+      --replace "add_subdirectory(test)" ""
+  '';
+
+  # Tests always fail, probably need GPU
+  # doCheck = buildTests;
+
+  postInstall = lib.optionalString buildDocs ''
+    mkdir -p $doc
+  '' + lib.optionalString buildTests ''
+    mkdir -p $test/bin
+    # Not sure why this is an install target
+    find $out/test -executable -type f -exec mv {} $test/bin \;
+    rm $test/bin/{*.sh,*.py}
+    patchelf --set-rpath $out/lib:${lib.makeLibraryPath (finalAttrs.buildInputs ++ [ hip ])} $test/bin/*
+    rm -rf $out/test
+  '';
+
+  passthru.updateScript = rocmUpdateScript {
+    name = finalAttrs.pname;
+    owner = finalAttrs.src.owner;
+    repo = finalAttrs.src.repo;
+  };
+
+  meta = with lib; {
+    description = "Tracer callback/activity library";
+    homepage = "https://github.com/ROCm-Developer-Tools/roctracer";
+    license = with licenses; [ mit ]; # mitx11
+    maintainers = teams.rocm.members;
+    broken = finalAttrs.version != hip.version;
+  };
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 228dc4a6b4d6..f08c9638029f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15287,6 +15287,11 @@ with pkgs;
 
   rocmUpdateScript = callPackage ../development/rocm-modules/update-script { };
 
+  # Requires GCC
+  roctracer = callPackage ../development/libraries/roctracer {
+    inherit (llvmPackages_rocm) clang;
+  };
+
   rtags = callPackage ../development/tools/rtags {
     inherit (darwin) apple_sdk;
   };

From ecaaa49b651b8385ba86e9ede313a8e337289d93 Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Fri, 16 Dec 2022 06:00:57 -0600
Subject: [PATCH 139/231] rocsolver: init at 5.4.0

---
 .../libraries/rocsolver/default.nix           | 92 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  4 +
 2 files changed, 96 insertions(+)
 create mode 100644 pkgs/development/libraries/rocsolver/default.nix

diff --git a/pkgs/development/libraries/rocsolver/default.nix b/pkgs/development/libraries/rocsolver/default.nix
new file mode 100644
index 000000000000..dfb09f49cddc
--- /dev/null
+++ b/pkgs/development/libraries/rocsolver/default.nix
@@ -0,0 +1,92 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rocmUpdateScript
+, cmake
+, rocm-cmake
+, rocblas
+, hip
+, fmt
+, gtest
+, gfortran
+, lapack-reference
+, buildTests ? false
+, buildBenchmarks ? false
+, gpuTargets ? [ ] # gpuTargets = [ "gfx803" "gfx900" "gfx906:xnack-" ]
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "rocsolver";
+  version = "5.4.0";
+
+  outputs = [
+    "out"
+  ] ++ lib.optionals buildTests [
+    "test"
+  ] ++ lib.optionals buildBenchmarks [
+    "benchmark"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "ROCmSoftwarePlatform";
+    repo = "rocSOLVER";
+    rev = "rocm-${finalAttrs.version}";
+    hash = "sha256-UHUcA9CVPuYFpE2DTvRrRMMj51yNPo5wMTKnByL2RTg=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    rocm-cmake
+    hip
+  ] ++ lib.optionals (buildTests || buildBenchmarks) [
+    gfortran
+  ];
+
+  buildInputs = [
+    rocblas
+    fmt
+  ] ++ lib.optionals buildTests [
+    gtest
+  ] ++ lib.optionals (buildTests || buildBenchmarks) [
+    lapack-reference
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_CXX_COMPILER=hipcc"
+    # Manually define CMAKE_INSTALL_<DIR>
+    # See: https://github.com/NixOS/nixpkgs/pull/197838
+    "-DCMAKE_INSTALL_BINDIR=bin"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ] ++ lib.optionals (gpuTargets != [ ]) [
+    "-DAMDGPU_TARGETS=${lib.concatStringsSep ";" gpuTargets}"
+  ] ++ lib.optionals buildTests [
+    "-DBUILD_CLIENTS_TESTS=ON"
+  ] ++ lib.optionals buildBenchmarks [
+    "-DBUILD_CLIENTS_BENCHMARKS=ON"
+  ];
+
+  postInstall = lib.optionalString buildTests ''
+    mkdir -p $test/bin
+    mv $out/bin/rocsolver-test $test/bin
+  '' + lib.optionalString buildBenchmarks ''
+    mkdir -p $benchmark/bin
+    mv $out/bin/rocsolver-bench $benchmark/bin
+  '' + lib.optionalString (buildTests || buildBenchmarks) ''
+    rmdir $out/bin
+  '';
+
+  passthru.updateScript = rocmUpdateScript {
+    name = finalAttrs.pname;
+    owner = finalAttrs.src.owner;
+    repo = finalAttrs.src.repo;
+  };
+
+  meta = with lib; {
+    description = "ROCm LAPACK implementation";
+    homepage = "https://github.com/ROCmSoftwarePlatform/rocSOLVER";
+    license = with licenses; [ bsd2 ];
+    maintainers = teams.rocm.members;
+    broken = finalAttrs.version != hip.version;
+  };
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f08c9638029f..ae593144acc9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15203,6 +15203,10 @@ with pkgs;
     stdenv = rocmClangStdenv;
   };
 
+  rocsolver = callPackage ../development/libraries/rocsolver {
+    stdenv = rocmClangStdenv;
+  };
+
   rocm-opencl-runtime = callPackage ../development/libraries/rocm-opencl-runtime {
     stdenv = rocmClangStdenv;
   };

From f69c8df2f3b6f64e4432e5feeb0be12afc158f6a Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Fri, 16 Dec 2022 07:21:53 -0600
Subject: [PATCH 140/231] rocalution: init at 5.4.0

---
 .../libraries/rocalution/default.nix          | 114 ++++++++++++++++++
 pkgs/top-level/all-packages.nix               |   5 +
 2 files changed, 119 insertions(+)
 create mode 100644 pkgs/development/libraries/rocalution/default.nix

diff --git a/pkgs/development/libraries/rocalution/default.nix b/pkgs/development/libraries/rocalution/default.nix
new file mode 100644
index 000000000000..00d117f00fa9
--- /dev/null
+++ b/pkgs/development/libraries/rocalution/default.nix
@@ -0,0 +1,114 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rocmUpdateScript
+, cmake
+, rocm-cmake
+, rocblas
+, rocsparse
+, rocprim
+, rocrand
+, hip
+, git
+, openmp
+, openmpi
+, gtest
+, buildTests ? false
+, buildBenchmarks ? false
+, buildSamples ? false
+, gpuTargets ? [ ] # gpuTargets = [ "gfx803" "gfx900:xnack-" "gfx906:xnack-" ... ]
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "rocalution";
+  version = "5.4.0";
+
+  outputs = [
+    "out"
+  ] ++ lib.optionals buildTests [
+    "test"
+  ] ++ lib.optionals buildBenchmarks [
+    "benchmark"
+  ] ++ lib.optionals buildSamples [
+    "sample"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "ROCmSoftwarePlatform";
+    repo = "rocALUTION";
+    rev = "rocm-${finalAttrs.version}";
+    hash = "sha256-jovhodhNa7tr1bSqpZCKI/9xF7Ie96JB+giqAEfis2k=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    rocm-cmake
+    hip
+    git
+  ];
+
+  buildInputs = [
+    rocblas
+    rocsparse
+    rocprim
+    rocrand
+    openmp
+    openmpi
+  ] ++ lib.optionals buildTests [
+    gtest
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_CXX_COMPILER=hipcc"
+    "-DROCM_PATH=${hip}"
+    "-DHIP_ROOT_DIR=${hip}"
+    "-DSUPPORT_HIP=ON"
+    "-DSUPPORT_OMP=ON"
+    "-DSUPPORT_MPI=ON"
+    "-DBUILD_CLIENTS_SAMPLES=${if buildSamples then "ON" else "OFF"}"
+    # Manually define CMAKE_INSTALL_<DIR>
+    # See: https://github.com/NixOS/nixpkgs/pull/197838
+    "-DCMAKE_INSTALL_BINDIR=bin"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ] ++ lib.optionals (gpuTargets != [ ]) [
+    "-DAMDGPU_TARGETS=${lib.strings.concatStringsSep ";" gpuTargets}"
+  ] ++ lib.optionals buildTests [
+    "-DBUILD_CLIENTS_TESTS=ON"
+  ] ++ lib.optionals buildBenchmarks [
+    "-DBUILD_CLIENTS_BENCHMARKS=ON"
+  ];
+
+  postInstall = lib.optionalString buildTests ''
+    mkdir -p $test/bin
+    mv $out/bin/rocalution-test $test/bin
+  '' + lib.optionalString buildBenchmarks ''
+    mkdir -p $benchmark/bin
+    mv $out/bin/rocalution-bench $benchmark/bin
+  '' + lib.optionalString buildSamples ''
+    mkdir -p $sample/bin
+    mv clients/staging/* $sample/bin
+    rm $sample/bin/rocalution-test || true
+    rm $sample/bin/rocalution-bench || true
+
+    patchelf --set-rpath \
+      $out/lib:${lib.makeLibraryPath (finalAttrs.buildInputs ++ [ hip ])} \
+      $sample/bin/*
+  '' + lib.optionalString (buildTests || buildBenchmarks) ''
+    rmdir $out/bin
+  '';
+
+  passthru.updateScript = rocmUpdateScript {
+    name = finalAttrs.pname;
+    owner = finalAttrs.src.owner;
+    repo = finalAttrs.src.repo;
+  };
+
+  meta = with lib; {
+    description = "Iterative sparse solvers for ROCm";
+    homepage = "https://github.com/ROCmSoftwarePlatform/rocALUTION";
+    license = with licenses; [ mit ];
+    maintainers = teams.rocm.members;
+    broken = finalAttrs.version != hip.version;
+  };
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ae593144acc9..6765d94fb98a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15195,6 +15195,11 @@ with pkgs;
     stdenv = rocmClangStdenv;
   };
 
+  rocalution = callPackage ../development/libraries/rocalution {
+    inherit (llvmPackages_rocm) openmp;
+    stdenv = rocmClangStdenv;
+  };
+
   rocm-device-libs = callPackage ../development/libraries/rocm-device-libs {
     stdenv = rocmClangStdenv;
   };

From 9e0472e20658de07cbb16b3af6476ffde98fbf4f Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Fri, 16 Dec 2022 15:24:05 +0000
Subject: [PATCH 141/231] =?UTF-8?q?rocm-related:=205.4.0=20=E2=86=92=205.4?=
 =?UTF-8?q?.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

clang-ocl: 5.4.0 → 5.4.1

hipsparse: 5.4.0 → 5.4.1

composable_kernel: unstable-2022-12-08 → unstable-2022-12-15

llvmPackages_rocm.llvm: 5.4.0 → 5.4.1

miopen: 5.4.0 → 5.4.1

miopengemm: 5.4.0 → 5.4.1

rccl: 5.4.0 → 5.4.1

rocalution: 5.4.0 → 5.4.1

hipcub: 5.4.0 → 5.4.1

rocclr: 5.4.0 → 5.4.1

rocfft: 5.4.0 → 5.4.1

rocm-cmake: 5.4.0 → 5.4.1

rocm-comgr: 5.4.0 → 5.4.1

rocm-device-libs: 5.4.0 → 5.4.1

hip: 5.4.0 → 5.4.1

rocblas: 5.4.0 → 5.4.1

rocm-runtime: 5.4.0 → 5.4.1

rocm-opencl-runtime: 5.4.0 → 5.4.1

rocm-thunk: 5.4.0 → 5.4.1

rocprim: 5.4.0 → 5.4.1

rocm-smi: 5.4.0 → 5.4.1

rocminfo: 5.4.0 → 5.4.1

rocsolver: 5.4.0 → 5.4.1

rocrand: 5.4.0 → 5.4.1

rocthrust: 5.4.0 → 5.4.1

rocprofiler: 5.4.0 → 5.4.1

rocwmma: 5.4.0 → 5.4.1

roctracer: 5.4.0 → 5.4.1

rocsparse: 5.4.0 → 5.4.1

tensile: 5.4.0 → 5.4.1
---
 pkgs/development/compilers/hip-common/default.nix           | 4 ++--
 pkgs/development/compilers/hip/default.nix                  | 2 +-
 pkgs/development/compilers/llvm/rocm/llvm.nix               | 2 +-
 pkgs/development/libraries/clang-ocl/default.nix            | 2 +-
 pkgs/development/libraries/composable_kernel/default.nix    | 6 +++---
 pkgs/development/libraries/hipcub/default.nix               | 2 +-
 pkgs/development/libraries/hipsparse/default.nix            | 2 +-
 pkgs/development/libraries/miopen/default.nix               | 4 ++--
 pkgs/development/libraries/miopengemm/default.nix           | 2 +-
 pkgs/development/libraries/rccl/default.nix                 | 4 ++--
 pkgs/development/libraries/rocalution/default.nix           | 2 +-
 pkgs/development/libraries/rocblas/default.nix              | 2 +-
 pkgs/development/libraries/rocclr/default.nix               | 2 +-
 pkgs/development/libraries/rocfft/default.nix               | 4 ++--
 pkgs/development/libraries/rocm-comgr/default.nix           | 2 +-
 pkgs/development/libraries/rocm-device-libs/default.nix     | 2 +-
 pkgs/development/libraries/rocm-opencl-runtime/default.nix  | 2 +-
 pkgs/development/libraries/rocm-runtime/default.nix         | 4 ++--
 pkgs/development/libraries/rocm-thunk/default.nix           | 2 +-
 pkgs/development/libraries/rocprim/default.nix              | 2 +-
 pkgs/development/libraries/rocprofiler/default.nix          | 2 +-
 pkgs/development/libraries/rocrand/default.nix              | 2 +-
 pkgs/development/libraries/rocsolver/default.nix            | 2 +-
 pkgs/development/libraries/rocsparse/default.nix            | 2 +-
 pkgs/development/libraries/rocthrust/default.nix            | 2 +-
 pkgs/development/libraries/roctracer/default.nix            | 4 ++--
 pkgs/development/libraries/rocwmma/default.nix              | 2 +-
 pkgs/development/libraries/tensile/default.nix              | 2 +-
 .../development/tools/build-managers/rocm-cmake/default.nix | 2 +-
 pkgs/development/tools/rocminfo/default.nix                 | 2 +-
 pkgs/tools/system/rocm-smi/default.nix                      | 2 +-
 31 files changed, 39 insertions(+), 39 deletions(-)

diff --git a/pkgs/development/compilers/hip-common/default.nix b/pkgs/development/compilers/hip-common/default.nix
index a6343c920376..fc5e09a45982 100644
--- a/pkgs/development/compilers/hip-common/default.nix
+++ b/pkgs/development/compilers/hip-common/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hip-common";
-  version = "5.4.0";
+  version = "5.4.1";
 
   src = fetchFromGitHub {
     owner = "ROCm-Developer-Tools";
     repo = "HIP";
     rev = "rocm-${finalAttrs.version}";
-    hash = "sha256-34SJM2n3jZWIS2uwpboWOXVFhaVWGK5ELPKD/cJc1zw=";
+    hash = "sha256-JpHWTsR2Z8pXp1gNjO29pDYvH/cJvd5Dlpeig33UD28=";
   };
 
   patches = [
diff --git a/pkgs/development/compilers/hip/default.nix b/pkgs/development/compilers/hip/default.nix
index ecb763cea83f..5b3d2c8e0273 100644
--- a/pkgs/development/compilers/hip/default.nix
+++ b/pkgs/development/compilers/hip/default.nix
@@ -49,7 +49,7 @@ let
   ];
 in stdenv.mkDerivation (finalAttrs: {
   pname = "hip-${hipPlatform}";
-  version = "5.4.0";
+  version = "5.4.1";
 
   outputs = [
     "out"
diff --git a/pkgs/development/compilers/llvm/rocm/llvm.nix b/pkgs/development/compilers/llvm/rocm/llvm.nix
index 82aee79cfe4a..731c0557bf2e 100644
--- a/pkgs/development/compilers/llvm/rocm/llvm.nix
+++ b/pkgs/development/compilers/llvm/rocm/llvm.nix
@@ -48,7 +48,7 @@ let
     else throw "Unsupported ROCm LLVM platform";
 in stdenv.mkDerivation (finalAttrs: {
   pname = "rocm-llvm-${targetName}";
-  version = "5.4.0";
+  version = "5.4.1";
 
   outputs = [
     "out"
diff --git a/pkgs/development/libraries/clang-ocl/default.nix b/pkgs/development/libraries/clang-ocl/default.nix
index 8cbace27d4fb..1e844157e419 100644
--- a/pkgs/development/libraries/clang-ocl/default.nix
+++ b/pkgs/development/libraries/clang-ocl/default.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clang-ocl";
-  version = "5.4.0";
+  version = "5.4.1";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
diff --git a/pkgs/development/libraries/composable_kernel/default.nix b/pkgs/development/libraries/composable_kernel/default.nix
index 82419873cbeb..9d2abbdf37ba 100644
--- a/pkgs/development/libraries/composable_kernel/default.nix
+++ b/pkgs/development/libraries/composable_kernel/default.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "composable_kernel";
-  version = "unstable-2022-12-08";
+  version = "unstable-2022-12-15";
 
   outputs = [
     "out"
@@ -30,8 +30,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ROCmSoftwarePlatform";
     repo = "composable_kernel";
-    rev = "d58b7f5155b44c8b608f3edc6a6eab314493ec1a";
-    hash = "sha256-4nzyaWhPnY/0TygcoJAqVzdgfXOkf+o/BE2V9N+Bm7Q=";
+    rev = "0345963eef4f92e9c5eab608bb8557b5463a1dcb";
+    hash = "sha256-IJbUZ3/UIPbYO9H+BUPP6T2HyUnC+FVbVPXQE5bEjRg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/hipcub/default.nix b/pkgs/development/libraries/hipcub/default.nix
index 8a6ea0ca43c2..d0c7d9a1b053 100644
--- a/pkgs/development/libraries/hipcub/default.nix
+++ b/pkgs/development/libraries/hipcub/default.nix
@@ -15,7 +15,7 @@
 # CUB can also be used as a backend instead of rocPRIM.
 stdenv.mkDerivation (finalAttrs: {
   pname = "hipcub";
-  version = "5.4.0";
+  version = "5.4.1";
 
   outputs = [
     "out"
diff --git a/pkgs/development/libraries/hipsparse/default.nix b/pkgs/development/libraries/hipsparse/default.nix
index a1582a4ee484..def3466a952d 100644
--- a/pkgs/development/libraries/hipsparse/default.nix
+++ b/pkgs/development/libraries/hipsparse/default.nix
@@ -15,7 +15,7 @@
 # This can also use cuSPARSE as a backend instead of rocSPARSE
 stdenv.mkDerivation (finalAttrs: {
   pname = "hipsparse";
-  version = "5.4.0";
+  version = "5.4.1";
 
   outputs = [
     "out"
diff --git a/pkgs/development/libraries/miopen/default.nix b/pkgs/development/libraries/miopen/default.nix
index 513b492ee981..deed581b2fac 100644
--- a/pkgs/development/libraries/miopen/default.nix
+++ b/pkgs/development/libraries/miopen/default.nix
@@ -58,7 +58,7 @@ let
   };
 in stdenv.mkDerivation (finalAttrs: {
   pname = "miopen";
-  version = "5.4.0";
+  version = "5.4.1";
 
   outputs = [
     "out"
@@ -72,7 +72,7 @@ in stdenv.mkDerivation (finalAttrs: {
     owner = "ROCmSoftwarePlatform";
     repo = "MIOpen";
     rev = "rocm-${finalAttrs.version}";
-    hash = "sha256-EOe3LUafOeVLzRoahPdS6DMZ/+6WWeVI7jG25zfPrx8=";
+    hash = "sha256-GfXPCXiVJVve3d8sQCQcFLb/vEnKkVEn7xYUhHkEEVI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/miopengemm/default.nix b/pkgs/development/libraries/miopengemm/default.nix
index 03d30906f94a..45c83021162c 100644
--- a/pkgs/development/libraries/miopengemm/default.nix
+++ b/pkgs/development/libraries/miopengemm/default.nix
@@ -31,7 +31,7 @@ let
   };
 in stdenv.mkDerivation (finalAttrs: {
   pname = "miopengemm";
-  version = "5.4.0";
+  version = "5.4.1";
 
   outputs = [
     "out"
diff --git a/pkgs/development/libraries/rccl/default.nix b/pkgs/development/libraries/rccl/default.nix
index 4a8df477e15e..f501d0e8ced5 100644
--- a/pkgs/development/libraries/rccl/default.nix
+++ b/pkgs/development/libraries/rccl/default.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rccl";
-  version = "5.4.0";
+  version = "5.4.1";
 
   outputs = [
     "out"
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ROCmSoftwarePlatform";
     repo = "rccl";
     rev = "rocm-${finalAttrs.version}";
-    hash = "sha256-NbHzRmrUe4kJwkHZtZ+zHjIy2uk+dpN9caE0L5hUnbc=";
+    hash = "sha256-y9gTGk8LyX7owb2xdtb6VlnIXu/CYHOjnNa/wrNl02g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/rocalution/default.nix b/pkgs/development/libraries/rocalution/default.nix
index 00d117f00fa9..30d61391ec99 100644
--- a/pkgs/development/libraries/rocalution/default.nix
+++ b/pkgs/development/libraries/rocalution/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocalution";
-  version = "5.4.0";
+  version = "5.4.1";
 
   outputs = [
     "out"
diff --git a/pkgs/development/libraries/rocblas/default.nix b/pkgs/development/libraries/rocblas/default.nix
index 41c0b188318c..2d79024c94c9 100644
--- a/pkgs/development/libraries/rocblas/default.nix
+++ b/pkgs/development/libraries/rocblas/default.nix
@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocblas";
-  version = "5.4.0";
+  version = "5.4.1";
 
   outputs = [
     "out"
diff --git a/pkgs/development/libraries/rocclr/default.nix b/pkgs/development/libraries/rocclr/default.nix
index bd0eb6bafbb6..01c1522636af 100644
--- a/pkgs/development/libraries/rocclr/default.nix
+++ b/pkgs/development/libraries/rocclr/default.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocclr";
-  version = "5.4.0";
+  version = "5.4.1";
 
   src = fetchFromGitHub {
     owner = "ROCm-Developer-Tools";
diff --git a/pkgs/development/libraries/rocfft/default.nix b/pkgs/development/libraries/rocfft/default.nix
index b71f0dc5b07f..aad49db494e6 100644
--- a/pkgs/development/libraries/rocfft/default.nix
+++ b/pkgs/development/libraries/rocfft/default.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocfft";
-  version = "5.4.0";
+  version = "5.4.1";
 
   outputs = [
     "out"
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ROCmSoftwarePlatform";
     repo = "rocFFT";
     rev = "rocm-${finalAttrs.version}";
-    hash = "sha256-XlpWT6PS+VpJjA4iG8yaiFRxE63kugNG1ZyQXoQVJL8=";
+    hash = "sha256-NsYeEoBQ/0z31ZQ32l7N+qavWEVkH37snkTHntot7nE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/rocm-comgr/default.nix b/pkgs/development/libraries/rocm-comgr/default.nix
index 93c56f5178d8..fee10be5db50 100644
--- a/pkgs/development/libraries/rocm-comgr/default.nix
+++ b/pkgs/development/libraries/rocm-comgr/default.nix
@@ -15,7 +15,7 @@ let
     else throw "Unsupported ROCm LLVM platform";
 in stdenv.mkDerivation (finalAttrs: {
   pname = "rocm-comgr";
-  version = "5.4.0";
+  version = "5.4.1";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
diff --git a/pkgs/development/libraries/rocm-device-libs/default.nix b/pkgs/development/libraries/rocm-device-libs/default.nix
index e37baad6f891..6ed70a6565ac 100644
--- a/pkgs/development/libraries/rocm-device-libs/default.nix
+++ b/pkgs/development/libraries/rocm-device-libs/default.nix
@@ -14,7 +14,7 @@ let
     else throw "Unsupported ROCm LLVM platform";
 in stdenv.mkDerivation (finalAttrs: {
   pname = "rocm-device-libs";
-  version = "5.4.0";
+  version = "5.4.1";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
diff --git a/pkgs/development/libraries/rocm-opencl-runtime/default.nix b/pkgs/development/libraries/rocm-opencl-runtime/default.nix
index ee588999a1b1..5d37c8ad9f25 100644
--- a/pkgs/development/libraries/rocm-opencl-runtime/default.nix
+++ b/pkgs/development/libraries/rocm-opencl-runtime/default.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocm-opencl-runtime";
-  version = "5.4.0";
+  version = "5.4.1";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
diff --git a/pkgs/development/libraries/rocm-runtime/default.nix b/pkgs/development/libraries/rocm-runtime/default.nix
index b7e1212fd1b1..7b4bd6c11ae5 100644
--- a/pkgs/development/libraries/rocm-runtime/default.nix
+++ b/pkgs/development/libraries/rocm-runtime/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocm-runtime";
-  version = "5.4.0";
+  version = "5.4.1";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
     repo = "ROCR-Runtime";
     rev = "rocm-${finalAttrs.version}";
-    hash = "sha256-M9kv1Oe5ZZfd9H/+KUJUoK9L1EdyS2qRp2mJDK0dnPE=";
+    hash = "sha256-JkTXTQmdESHSFbA6HZdMK3pYEApz9aoAlMzdXayzdyY=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src";
diff --git a/pkgs/development/libraries/rocm-thunk/default.nix b/pkgs/development/libraries/rocm-thunk/default.nix
index bc966e501268..b5825996a44d 100644
--- a/pkgs/development/libraries/rocm-thunk/default.nix
+++ b/pkgs/development/libraries/rocm-thunk/default.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocm-thunk";
-  version = "5.4.0";
+  version = "5.4.1";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
diff --git a/pkgs/development/libraries/rocprim/default.nix b/pkgs/development/libraries/rocprim/default.nix
index 3ad3871bbd3d..88fad249b8c3 100644
--- a/pkgs/development/libraries/rocprim/default.nix
+++ b/pkgs/development/libraries/rocprim/default.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocprim";
-  version = "5.4.0";
+  version = "5.4.1";
 
   outputs = [
     "out"
diff --git a/pkgs/development/libraries/rocprofiler/default.nix b/pkgs/development/libraries/rocprofiler/default.nix
index 0d0639edbe53..d51e5de6966e 100644
--- a/pkgs/development/libraries/rocprofiler/default.nix
+++ b/pkgs/development/libraries/rocprofiler/default.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocprofiler";
-  version = "5.4.0";
+  version = "5.4.1";
 
   src = fetchFromGitHub {
     owner = "ROCm-Developer-Tools";
diff --git a/pkgs/development/libraries/rocrand/default.nix b/pkgs/development/libraries/rocrand/default.nix
index a06615ec4122..a3742a5d9725 100644
--- a/pkgs/development/libraries/rocrand/default.nix
+++ b/pkgs/development/libraries/rocrand/default.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocrand";
-  version = "5.4.0";
+  version = "5.4.1";
 
   outputs = [
     "out"
diff --git a/pkgs/development/libraries/rocsolver/default.nix b/pkgs/development/libraries/rocsolver/default.nix
index dfb09f49cddc..5b3ad6ce24c4 100644
--- a/pkgs/development/libraries/rocsolver/default.nix
+++ b/pkgs/development/libraries/rocsolver/default.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocsolver";
-  version = "5.4.0";
+  version = "5.4.1";
 
   outputs = [
     "out"
diff --git a/pkgs/development/libraries/rocsparse/default.nix b/pkgs/development/libraries/rocsparse/default.nix
index c0ee717d4bfc..0edb0bd14e5e 100644
--- a/pkgs/development/libraries/rocsparse/default.nix
+++ b/pkgs/development/libraries/rocsparse/default.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocsparse";
-  version = "5.4.0";
+  version = "5.4.1";
 
   outputs = [
     "out"
diff --git a/pkgs/development/libraries/rocthrust/default.nix b/pkgs/development/libraries/rocthrust/default.nix
index 7a45a794ad2d..0fc3726761a7 100644
--- a/pkgs/development/libraries/rocthrust/default.nix
+++ b/pkgs/development/libraries/rocthrust/default.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocthrust";
-  version = "5.4.0";
+  version = "5.4.1";
 
   outputs = [
     "out"
diff --git a/pkgs/development/libraries/roctracer/default.nix b/pkgs/development/libraries/roctracer/default.nix
index b8d1902d468d..c0655aaf7d4e 100644
--- a/pkgs/development/libraries/roctracer/default.nix
+++ b/pkgs/development/libraries/roctracer/default.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "roctracer";
-  version = "5.4.0";
+  version = "5.4.1";
 
   outputs = [
     "out"
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ROCm-Developer-Tools";
     repo = "roctracer";
     rev = "rocm-${finalAttrs.version}";
-    hash = "sha256-hDo/tz39/m6lKqLg3UJi3LWWF7/QUtVDymZY1O8L4IQ=";
+    hash = "sha256-5vYUNczylB2ehlvhq1u/H8KUXt8ku2E+jawKrKsU7LY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/rocwmma/default.nix b/pkgs/development/libraries/rocwmma/default.nix
index 818d915cc133..ecd802612550 100644
--- a/pkgs/development/libraries/rocwmma/default.nix
+++ b/pkgs/development/libraries/rocwmma/default.nix
@@ -36,7 +36,7 @@ let
   };
 in stdenv.mkDerivation (finalAttrs: {
   pname = "rocwmma";
-  version = "5.4.0";
+  version = "5.4.1";
 
   outputs = [
     "out"
diff --git a/pkgs/development/libraries/tensile/default.nix b/pkgs/development/libraries/tensile/default.nix
index c45b15134f5f..bfef4716e127 100644
--- a/pkgs/development/libraries/tensile/default.nix
+++ b/pkgs/development/libraries/tensile/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tensile";
-  version = "5.4.0";
+  version = "5.4.1";
 
   src = fetchFromGitHub {
     owner = "ROCmSoftwarePlatform";
diff --git a/pkgs/development/tools/build-managers/rocm-cmake/default.nix b/pkgs/development/tools/build-managers/rocm-cmake/default.nix
index 0d7913543f10..6fd4c2b58868 100644
--- a/pkgs/development/tools/build-managers/rocm-cmake/default.nix
+++ b/pkgs/development/tools/build-managers/rocm-cmake/default.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocm-cmake";
-  version = "5.4.0";
+  version = "5.4.1";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
diff --git a/pkgs/development/tools/rocminfo/default.nix b/pkgs/development/tools/rocminfo/default.nix
index 2a714829d91c..64368fa0c95a 100644
--- a/pkgs/development/tools/rocminfo/default.nix
+++ b/pkgs/development/tools/rocminfo/default.nix
@@ -18,7 +18,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "5.4.0";
+  version = "5.4.1";
   pname = "rocminfo";
 
   src = fetchFromGitHub {
diff --git a/pkgs/tools/system/rocm-smi/default.nix b/pkgs/tools/system/rocm-smi/default.nix
index 0f303cc78531..6b67ef13128b 100644
--- a/pkgs/tools/system/rocm-smi/default.nix
+++ b/pkgs/tools/system/rocm-smi/default.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocm-smi";
-  version = "5.4.0";
+  version = "5.4.1";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";

From 187452f58e6c5b0d4f50ca155c1a4b912006d630 Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Fri, 16 Dec 2022 09:32:53 -0600
Subject: [PATCH 142/231] rocmlir: don't enable broken as long as minor version
 is the same

---
 pkgs/development/libraries/rocmlir/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/rocmlir/default.nix b/pkgs/development/libraries/rocmlir/default.nix
index 90bb1ad211ce..98843fecfcc7 100644
--- a/pkgs/development/libraries/rocmlir/default.nix
+++ b/pkgs/development/libraries/rocmlir/default.nix
@@ -100,6 +100,7 @@ in stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/ROCmSoftwarePlatform/rocMLIR";
     license = with licenses; [ asl20 ];
     maintainers = teams.rocm.members;
-    broken = finalAttrs.version != stdenv.cc.version;
+    # Once again, they haven't updated the tags...
+    broken = lib.versions.minor finalAttrs.version != lib.versions.minor stdenv.cc.version;
   };
 })

From 93ec556b19a9cddc7798231536c7eed470e9da64 Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Sat, 17 Dec 2022 23:22:27 -0600
Subject: [PATCH 143/231] rocmUpdateScript: fix llvmPackages_rocm updating

---
 pkgs/development/rocm-modules/update-script/default.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/rocm-modules/update-script/default.nix b/pkgs/development/rocm-modules/update-script/default.nix
index 1d2b268a34b6..6188587de31a 100644
--- a/pkgs/development/rocm-modules/update-script/default.nix
+++ b/pkgs/development/rocm-modules/update-script/default.nix
@@ -1,4 +1,4 @@
-{ runtimeShell
+{ lib
 , writeScript
 }:
 
@@ -10,6 +10,11 @@
 }:
 
 let
+  pname =
+    if lib.hasPrefix "rocm-llvm-" name
+    then "llvmPackages_rocm.${lib.removePrefix "rocm-llvm-" name}"
+    else name;
+
   updateScript = writeScript "update.sh" ''
     #!/usr/bin/env nix-shell
     #!nix-shell -i bash -p curl jq common-updater-scripts
@@ -22,6 +27,6 @@ let
       version="''${version}.0"
     fi
 
-    update-source-version ${name} "$version" --ignore-same-hash
+    update-source-version ${pname} "$version" --ignore-same-hash
   '';
 in [ updateScript ]

From f84b81a23c4483f1b6b3309e9be5dedf6b22535b Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Sun, 18 Dec 2022 00:28:59 -0600
Subject: [PATCH 144/231] composable_kernel: fix tests, disable examples

---
 .../libraries/composable_kernel/default.nix   | 26 +++++--------------
 1 file changed, 7 insertions(+), 19 deletions(-)

diff --git a/pkgs/development/libraries/composable_kernel/default.nix b/pkgs/development/libraries/composable_kernel/default.nix
index 9d2abbdf37ba..2e74d8ba2765 100644
--- a/pkgs/development/libraries/composable_kernel/default.nix
+++ b/pkgs/development/libraries/composable_kernel/default.nix
@@ -43,8 +43,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     openmp
-  ] ++ lib.optionals buildTests [
-    gtest
   ];
 
   cmakeFlags = [
@@ -52,16 +50,12 @@ stdenv.mkDerivation (finalAttrs: {
     "-DCMAKE_CXX_COMPILER=hipcc"
   ] ++ lib.optionals (gpuTargets != [ ]) [
     "-DGPU_TARGETS=${lib.concatStringsSep ";" gpuTargets}"
+  ] ++ lib.optionals buildTests [
+    "-DGOOGLETEST_DIR=${gtest.src}" # Custom linker names
   ];
 
   # No flags to build selectively it seems...
-  postPatch = ''
-    substituteInPlace test/CMakeLists.txt \
-      --replace "include(googletest)" ""
-
-    substituteInPlace CMakeLists.txt \
-      --replace "enable_testing()" ""
-  '' + lib.optionalString (!buildTests) ''
+  postPatch = lib.optionalString (!buildTests) ''
     substituteInPlace CMakeLists.txt \
       --replace "add_subdirectory(test)" ""
   '' + lib.optionalString (!buildExamples) ''
@@ -69,15 +63,12 @@ stdenv.mkDerivation (finalAttrs: {
       --replace "add_subdirectory(example)" ""
   '';
 
-  postInstall = ''
-    mkdir -p $out/bin
-    mv bin/ckProfiler $out/bin
-  '' + lib.optionalString buildTests ''
+  postInstall = lib.optionalString buildTests ''
     mkdir -p $test/bin
-    mv bin/test_* $test/bin
+    mv $out/bin/test_* $test/bin
   '' + lib.optionalString buildExamples ''
     mkdir -p $example/bin
-    mv bin/example_* $example/bin
+    mv $out/bin/example_* $example/bin
   '';
 
   passthru.updateScript = unstableGitUpdater { };
@@ -87,9 +78,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/ROCmSoftwarePlatform/composable_kernel";
     license = with licenses; [ mit ];
     maintainers = teams.rocm.members;
-    # Well, at least we're getting something that makes sense now
-    # undefined symbol: testing::Message::Message()
-    # Try removing this next update
-    broken = buildTests;
+    broken = buildExamples; # bin/example_grouped_gemm_xdl_bfp16] Error 139
   };
 })

From e86c679d092b06e5edfd324eecc66b37f61b6d98 Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Sun, 18 Dec 2022 05:25:16 -0600
Subject: [PATCH 145/231] miopen: fixup, enable kdbs by default, symlink for
 hydra

---
 pkgs/development/libraries/miopen/default.nix | 43 +++++++++----------
 1 file changed, 20 insertions(+), 23 deletions(-)

diff --git a/pkgs/development/libraries/miopen/default.nix b/pkgs/development/libraries/miopen/default.nix
index deed581b2fac..0e9b9c2dc02b 100644
--- a/pkgs/development/libraries/miopen/default.nix
+++ b/pkgs/development/libraries/miopen/default.nix
@@ -23,17 +23,11 @@
 , doxygen
 , sphinx
 , zlib
+, gtest
 , python3Packages
 , buildDocs ? true
 , buildTests ? false
-# LFS isn't working, so we will manually fetch these
-# This isn't strictly required, but is recommended to enable
-# https://github.com/ROCmSoftwarePlatform/MIOpen/issues/1373
-#
-# MIOpen will produce a very large output due to KDBs fetched
-# Also possibly in the future because of KDB generation
-# This is disabled by default so we can cache on hydra
-, fetchKDBs ? false
+, fetchKDBs ? true
 , useOpenCL ? false
 }:
 
@@ -127,36 +121,35 @@ in stdenv.mkDerivation (finalAttrs: {
     "-DMIOPEN_TEST_GFX908=ON"
     "-DMIOPEN_TEST_GFX90A=ON"
     "-DMIOPEN_TEST_GFX103X=ON"
+    "-DGOOGLETEST_DIR=${gtest.src}" # Custom linker names
   ];
 
   postPatch = ''
     substituteInPlace CMakeLists.txt \
       --replace "enable_testing()" "" \
       --replace "MIOPEN_HIP_COMPILER MATCHES \".*clang\\\\+\\\\+$\"" "true" \
-      --replace "/opt/rocm/hip" "${hip}" \
-      --replace "/opt/rocm/llvm" "${llvm}" \
-      --replace "3 REQUIRED PATHS /opt/rocm)" "3 REQUIRED PATHS ${hip})" \
-      --replace "hip REQUIRED PATHS /opt/rocm" "hip REQUIRED PATHS ${hip}" \
-      --replace "rocblas REQUIRED PATHS /opt/rocm" "rocblas REQUIRED PATHS ${rocblas}" \
-      --replace "miopengemm PATHS /opt/rocm" "miopengemm PATHS ${miopengemm}"
+      --replace "set(MIOPEN_TIDY_ERRORS ALL)" "" # error: missing required key 'key'
+  '' + lib.optionalString buildTests ''
+    substituteInPlace test/gtest/CMakeLists.txt \
+      --replace "enable_testing()" ""
   '' + lib.optionalString (!buildTests) ''
     substituteInPlace CMakeLists.txt \
       --replace "add_subdirectory(test)" ""
   '' + lib.optionalString fetchKDBs ''
-    cp -a ${kdbs.gfx1030_36} src/kernels/gfx1030_36.kdb
-    cp -a ${kdbs.gfx900_56} src/kernels/gfx900_56.kdb
-    cp -a ${kdbs.gfx900_64} src/kernels/gfx900_64.kdb
-    cp -a ${kdbs.gfx906_60} src/kernels/gfx906_60.kdb
-    cp -a ${kdbs.gfx906_64} src/kernels/gfx906_64.kdb
-    cp -a ${kdbs.gfx90878} src/kernels/gfx90878.kdb
-    cp -a ${kdbs.gfx90a68} src/kernels/gfx90a68.kdb
-    cp -a ${kdbs.gfx90a6e} src/kernels/gfx90a6e.kdb
+    ln -sf ${kdbs.gfx1030_36} src/kernels/gfx1030_36.kdb
+    ln -sf ${kdbs.gfx900_56} src/kernels/gfx900_56.kdb
+    ln -sf ${kdbs.gfx900_64} src/kernels/gfx900_64.kdb
+    ln -sf ${kdbs.gfx906_60} src/kernels/gfx906_60.kdb
+    ln -sf ${kdbs.gfx906_64} src/kernels/gfx906_64.kdb
+    ln -sf ${kdbs.gfx90878} src/kernels/gfx90878.kdb
+    ln -sf ${kdbs.gfx90a68} src/kernels/gfx90a68.kdb
+    ln -sf ${kdbs.gfx90a6e} src/kernels/gfx90a6e.kdb
   '';
 
   # Unfortunately, it seems like we have to call make on these manually
   postBuild = lib.optionalString buildDocs ''
     export HOME=$(mktemp -d)
-    make doc
+    make -j$NIX_BUILD_CORES doc
   '' + lib.optionalString buildTests ''
     make -j$NIX_BUILD_CORES check
   '';
@@ -170,6 +163,10 @@ in stdenv.mkDerivation (finalAttrs: {
     mkdir -p $test/bin
     mv bin/test_* $test/bin
     patchelf --set-rpath $out/lib:${lib.makeLibraryPath (finalAttrs.buildInputs ++ [ hip ])} $test/bin/*
+  '' + lib.optionalString fetchKDBs ''
+    # Apparently gfx1030_40 wasn't generated so the developers suggest just renaming gfx1030_36 to it
+    # Should be fixed in the next miopen kernel generation batch
+    ln -s ${kdbs.gfx1030_36} $out/share/miopen/db/gfx1030_40.kdb
   '';
 
   passthru.updateScript = rocmUpdateScript {

From 8de23957e97b7bb04978829e62f53a4b848a500b Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Sun, 18 Dec 2022 12:41:25 -0600
Subject: [PATCH 146/231] rocm-related: add release notes

---
 .../from_md/release-notes/rl-2305.section.xml  | 18 ++++++++++++++++++
 .../manual/release-notes/rl-2305.section.md    |  4 ++++
 2 files changed, 22 insertions(+)

diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
index a3b711d1388e..eaeeed9c676c 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@@ -138,6 +138,17 @@
           or configure your firewall.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>llvmPackages_rocm.llvm</literal> will not contain
+          <literal>clang</literal> or <literal>compiler-rt</literal>.
+          <literal>llvmPackages_rocm.clang</literal> will not contain
+          <literal>llvm</literal>.
+          <literal>llvmPackages_rocm.clangNoCompilerRt</literal> has
+          been removed in favor of using
+          <literal>llvmPackages_rocm.clang-unwrapped</literal>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The EC2 image module previously detected and automatically
@@ -276,6 +287,13 @@
           option.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>hip</literal> has been separated into
+          <literal>hip</literal>, <literal>hip-common</literal> and
+          <literal>hipcc</literal>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           Resilio sync secret keys can now be provided using a secrets
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index d2cc43a5dffc..3573fcb79554 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -43,6 +43,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The [services.unifi-video.openFirewall](#opt-services.unifi-video.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitly set this option to `true`, or configure your firewall.
 
+- `llvmPackages_rocm.llvm` will not contain `clang` or `compiler-rt`. `llvmPackages_rocm.clang` will not contain `llvm`. `llvmPackages_rocm.clangNoCompilerRt` has been removed in favor of using `llvmPackages_rocm.clang-unwrapped`.
+
 - The EC2 image module previously detected and automatically mounted ext3-formatted instance store devices and partitions in stage-1 (initramfs), storing `/tmp` on the first discovered device. This behaviour, which only catered to very specific use cases and could not be disabled, has been removed. Users relying on this should provide their own implementation, and probably use ext4 and perform the mount in stage-2.
 
 - The EC2 image module previously detected and activated swap-formatted instance store devices and partitions in stage-1 (initramfs). This behaviour has been removed. Users relying on this should provide their own implementation.
@@ -80,6 +82,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - Enabling global redirect in `services.nginx.virtualHosts` now allows one to add exceptions with the `locations` option.
 
+- `hip` has been separated into `hip`, `hip-common` and `hipcc`.
+
 - Resilio sync secret keys can now be provided using a secrets file at runtime, preventing these secrets from ending up in the Nix store.
 
 - The `services.fwupd` module now allows arbitrary daemon settings to be configured in a structured manner ([`services.fwupd.daemonSettings`](#opt-services.fwupd.daemonSettings)).

From 31c7a1b61466e9323973a487288e9b98fbb4d746 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Sun, 18 Dec 2022 15:20:45 -0800
Subject: [PATCH 147/231] python310Packages.trustme: remove aarch64-darwin
 workarounds

These are no longer necessary now that pyopenssl is no longer broken on
aarch64-darwin.
---
 .../python-modules/trustme/default.nix          | 17 ++---------------
 1 file changed, 2 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/python-modules/trustme/default.nix b/pkgs/development/python-modules/trustme/default.nix
index fb145ac9a99a..649e2de1c179 100644
--- a/pkgs/development/python-modules/trustme/default.nix
+++ b/pkgs/development/python-modules/trustme/default.nix
@@ -1,5 +1,4 @@
 { lib
-, stdenv
 , buildPythonPackage
 , fetchPypi
 , isPy3k
@@ -21,10 +20,9 @@ buildPythonPackage rec {
   };
 
   checkInputs = [
-    service-identity
-    pytestCheckHook
-  ] ++ lib.optionals (!stdenv.isDarwin || !stdenv.isAarch64) [
     pyopenssl
+    pytestCheckHook
+    service-identity
   ];
 
   propagatedBuildInputs = [
@@ -34,17 +32,6 @@ buildPythonPackage rec {
     futures
   ];
 
-  # aarch64-darwin forbids W+X memory, but this tests depends on it:
-  # * https://github.com/pyca/pyopenssl/issues/873
-  disabledTests = lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
-    "test_pyopenssl_end_to_end"
-  ];
-
-  postPatch = lib.optionalString (stdenv.isDarwin && stdenv.isAarch64) ''
-    substituteInPlace "tests/test_trustme.py" \
-      --replace "import OpenSSL.SSL" ""
-  '';
-
   # Some of the tests use localhost networking.
   __darwinAllowLocalNetworking = true;
 

From 967b87ea6e287814a099f2177f38dbc31211e000 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 19 Dec 2022 01:06:51 +0000
Subject: [PATCH 148/231] krb5: 1.20 -> 1.20.1

---
 pkgs/development/libraries/kerberos/krb5.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/development/libraries/kerberos/krb5.nix
index fc8fb7398701..f9a509ab4862 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/development/libraries/kerberos/krb5.nix
@@ -19,11 +19,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "${type}krb5";
-  version = "1.20";
+  version = "1.20.1";
 
   src = fetchurl {
     url = "https://kerberos.org/dist/krb5/${lib.versions.majorMinor version}/krb5-${version}.tar.gz";
-    sha256 = "sha256-fgIr3TyFGDAXP5+qoAaiMKDg/a1MlT6Fv/S/DaA24S8";
+    sha256 = "sha256-cErtSbGetacXizSyhzYg7CmdsIdS1qhXT5XUGHmriFE=";
   };
 
   outputs = [ "out" "dev" ];

From 8e80bc7dd2179cbb4733edfde76b00e103bae363 Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Sun, 18 Dec 2022 21:15:54 -0600
Subject: [PATCH 149/231] hipsparse: fixup samples

---
 pkgs/development/libraries/hipsparse/default.nix | 13 +++++++++++++
 pkgs/top-level/all-packages.nix                  |  1 +
 2 files changed, 14 insertions(+)

diff --git a/pkgs/development/libraries/hipsparse/default.nix b/pkgs/development/libraries/hipsparse/default.nix
index def3466a952d..a4f8a212310a 100644
--- a/pkgs/development/libraries/hipsparse/default.nix
+++ b/pkgs/development/libraries/hipsparse/default.nix
@@ -9,7 +9,9 @@
 , gfortran
 , git
 , gtest
+, openmp
 , buildTests ? false
+, buildSamples ? false
 }:
 
 # This can also use cuSPARSE as a backend instead of rocSPARSE
@@ -21,6 +23,8 @@ stdenv.mkDerivation (finalAttrs: {
     "out"
   ] ++ lib.optionals buildTests [
     "test"
+  ] ++ lib.optionals buildSamples [
+    "sample"
   ];
 
   src = fetchFromGitHub {
@@ -42,10 +46,14 @@ stdenv.mkDerivation (finalAttrs: {
     git
   ] ++ lib.optionals buildTests [
     gtest
+  ] ++ lib.optionals (buildTests || buildSamples) [
+    openmp
   ];
 
   cmakeFlags = [
+    "-DCMAKE_C_COMPILER=hipcc"
     "-DCMAKE_CXX_COMPILER=hipcc"
+    "-DBUILD_CLIENTS_SAMPLES=${if buildSamples then "ON" else "OFF"}"
     # Manually define CMAKE_INSTALL_<DIR>
     # See: https://github.com/NixOS/nixpkgs/pull/197838
     "-DCMAKE_INSTALL_BINDIR=bin"
@@ -104,6 +112,11 @@ stdenv.mkDerivation (finalAttrs: {
     mv $out/bin/hipsparse-test $test/bin
     mv /build/source/matrices $test
     rmdir $out/bin
+  '' + lib.optionalString buildSamples ''
+    mkdir -p $sample/bin
+    mv clients/staging/example_* $sample/bin
+    patchelf --set-rpath $out/lib:${lib.makeLibraryPath (
+      finalAttrs.buildInputs ++ [ hip gfortran.cc ])} $sample/bin/example_*
   '';
 
   passthru.updateScript = rocmUpdateScript {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6765d94fb98a..72178e65432f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15180,6 +15180,7 @@ with pkgs;
   };
 
   hipsparse = callPackage ../development/libraries/hipsparse {
+    inherit (llvmPackages_rocm) openmp;
     stdenv = rocmClangStdenv;
   };
 

From ce1fd653e3e02ba3420b1edfe5d2374b44b70e5c Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Sun, 18 Dec 2022 21:32:59 -0600
Subject: [PATCH 150/231] miopen: fixup tests

---
 pkgs/development/libraries/miopen/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/miopen/default.nix b/pkgs/development/libraries/miopen/default.nix
index 0e9b9c2dc02b..1e93c149da8c 100644
--- a/pkgs/development/libraries/miopen/default.nix
+++ b/pkgs/development/libraries/miopen/default.nix
@@ -24,6 +24,7 @@
 , sphinx
 , zlib
 , gtest
+, rocm-comgr
 , python3Packages
 , buildDocs ? true
 , buildTests ? false
@@ -162,7 +163,8 @@ in stdenv.mkDerivation (finalAttrs: {
   '' + lib.optionalString buildTests ''
     mkdir -p $test/bin
     mv bin/test_* $test/bin
-    patchelf --set-rpath $out/lib:${lib.makeLibraryPath (finalAttrs.buildInputs ++ [ hip ])} $test/bin/*
+    patchelf --set-rpath $out/lib:${lib.makeLibraryPath (finalAttrs.buildInputs ++
+      [ hip rocm-comgr ])} $test/bin/*
   '' + lib.optionalString fetchKDBs ''
     # Apparently gfx1030_40 wasn't generated so the developers suggest just renaming gfx1030_36 to it
     # Should be fixed in the next miopen kernel generation batch

From 3690ec3a8d4385cc34edbee0aab3828bc2f74656 Mon Sep 17 00:00:00 2001
From: Madoura <madouura@gmail.com>
Date: Sun, 18 Dec 2022 21:42:33 -0600
Subject: [PATCH 151/231] roctracer: fixup tests

---
 pkgs/development/libraries/roctracer/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/roctracer/default.nix b/pkgs/development/libraries/roctracer/default.nix
index c0655aaf7d4e..6b5b23fae9f5 100644
--- a/pkgs/development/libraries/roctracer/default.nix
+++ b/pkgs/development/libraries/roctracer/default.nix
@@ -10,6 +10,8 @@
 , libxml2
 , doxygen
 , graphviz
+, gcc-unwrapped
+, rocm-runtime
 , python3Packages
 , buildDocs ? false # Nothing seems to be generated, so not making the output
 , buildTests ? false
@@ -77,7 +79,8 @@ stdenv.mkDerivation (finalAttrs: {
     # Not sure why this is an install target
     find $out/test -executable -type f -exec mv {} $test/bin \;
     rm $test/bin/{*.sh,*.py}
-    patchelf --set-rpath $out/lib:${lib.makeLibraryPath (finalAttrs.buildInputs ++ [ hip ])} $test/bin/*
+    patchelf --set-rpath $out/lib:${lib.makeLibraryPath (
+      finalAttrs.buildInputs ++ [ hip gcc-unwrapped.lib rocm-runtime ])} $test/bin/*
     rm -rf $out/test
   '';
 

From aebf6f67c269dc383a4ceececf7e36458c348b53 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 11 Dec 2022 10:04:23 +0100
Subject: [PATCH 152/231] python310Packages.pycares: add changelog to meta

---
 pkgs/development/python-modules/pycares/default.nix | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pycares/default.nix b/pkgs/development/python-modules/pycares/default.nix
index 74dc59aefbe8..26fd9c2aa735 100644
--- a/pkgs/development/python-modules/pycares/default.nix
+++ b/pkgs/development/python-modules/pycares/default.nix
@@ -4,15 +4,19 @@
 , cffi
 , fetchPypi
 , idna
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pycares";
   version = "4.2.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-4fV6gAQ3AIBpS9b7lpof/JFxpZxoJNVPeRwbLk0pg4U=";
+    hash = "sha256-4fV6gAQ3AIBpS9b7lpof/JFxpZxoJNVPeRwbLk0pg4U=";
   };
 
   buildInputs = [
@@ -31,11 +35,14 @@ buildPythonPackage rec {
   # Requires network access
   doCheck = false;
 
-  pythonImportsCheck = [ "pycares" ];
+  pythonImportsCheck = [
+    "pycares"
+  ];
 
   meta = with lib; {
     description = "Python interface for c-ares";
     homepage = "https://github.com/saghul/pycares";
+    changelog = "https://github.com/saghul/pycares/releases/tag/pycares-${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };

From 1ca0fd7d6d623a8c5189d0ba18f09a09a791a167 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 11 Dec 2022 10:05:40 +0100
Subject: [PATCH 153/231] python310Packages.pycares: 4.2.2 -> 4.3.0

Changelog: https://github.com/saghul/pycares/releases/tag/pycares-4.3.0
---
 pkgs/development/python-modules/pycares/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pycares/default.nix b/pkgs/development/python-modules/pycares/default.nix
index 26fd9c2aa735..14345cfafcf3 100644
--- a/pkgs/development/python-modules/pycares/default.nix
+++ b/pkgs/development/python-modules/pycares/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pycares";
-  version = "4.2.2";
+  version = "4.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4fV6gAQ3AIBpS9b7lpof/JFxpZxoJNVPeRwbLk0pg4U=";
+    hash = "sha256-xUJpb22sl46dmRkjhHRaZfgKfZRQUBFR5KdWPgYBDUU=";
   };
 
   buildInputs = [

From 2b1696598917eef6d0e4d2f5467a9c208a6cacdd Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 19 Dec 2022 11:08:38 +0100
Subject: [PATCH 154/231] python310Packages.pycares: add passthru.tests

---
 pkgs/development/python-modules/pycares/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/pycares/default.nix b/pkgs/development/python-modules/pycares/default.nix
index 14345cfafcf3..84a7cbe1ba42 100644
--- a/pkgs/development/python-modules/pycares/default.nix
+++ b/pkgs/development/python-modules/pycares/default.nix
@@ -1,10 +1,12 @@
 { lib
+, aiodns
 , buildPythonPackage
 , c-ares
 , cffi
 , fetchPypi
 , idna
 , pythonOlder
+, tornado
 }:
 
 buildPythonPackage rec {
@@ -35,6 +37,10 @@ buildPythonPackage rec {
   # Requires network access
   doCheck = false;
 
+  passthru.tests = {
+    inherit aiodns tornado;
+  };
+
   pythonImportsCheck = [
     "pycares"
   ];

From 811a1563a0933254b909c41d7a7295232752e569 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 19 Dec 2022 10:46:53 +0100
Subject: [PATCH 155/231] python310Packages.watchdog: add changelog to meta

---
 .../python-modules/watchdog/default.nix       | 22 ++++++++++++-------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/watchdog/default.nix b/pkgs/development/python-modules/watchdog/default.nix
index f42645940aac..636b160dadde 100644
--- a/pkgs/development/python-modules/watchdog/default.nix
+++ b/pkgs/development/python-modules/watchdog/default.nix
@@ -1,14 +1,15 @@
 { lib
 , stdenv
 , buildPythonPackage
-, fetchPypi
-, pathtools
-, pyyaml
-, flaky
-, pytest-timeout
-, pytestCheckHook
 , CoreServices
 , fetchpatch
+, fetchPypi
+, flaky
+, pathtools
+, pytest-timeout
+, pytestCheckHook
+, pythonOlder
+, pyyaml
 }:
 
 buildPythonPackage rec {
@@ -16,9 +17,11 @@ buildPythonPackage rec {
   version = "2.1.9";
   format = "setuptools";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Q84g67NqUfIfo3b3bR1GkkUrJSfM1gGVDWntNrniFgk=";
+    hash = "sha256-Q84g67NqUfIfo3b3bR1GkkUrJSfM1gGVDWntNrniFgk=";
   };
 
   patches = lib.optionals (stdenv.isDarwin && !stdenv.isAarch64) [
@@ -31,7 +34,9 @@ buildPythonPackage rec {
     })
   ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
+  buildInputs = lib.optionals stdenv.isDarwin [
+    CoreServices
+  ];
 
   propagatedBuildInputs = [
     pathtools
@@ -70,6 +75,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python API and shell utilities to monitor file system events";
     homepage = "https://github.com/gorakhargosh/watchdog";
+    changelog = "https://github.com/gorakhargosh/watchdog/blob/v${version}/changelog.rst";
     license = licenses.asl20;
     maintainers = with maintainers; [ goibhniu ];
   };

From dbecef299504803e718f7e6b31f2c358f9365d0f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 19 Dec 2022 10:50:00 +0100
Subject: [PATCH 156/231] python310Packages.watchdog: 2.1.9 -> 2.2.0

Changelog: https://github.com/gorakhargosh/watchdog/blob/v2.2.0/changelog.rst
---
 pkgs/development/python-modules/watchdog/default.nix | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/watchdog/default.nix b/pkgs/development/python-modules/watchdog/default.nix
index 636b160dadde..b4c8dcaf6b0c 100644
--- a/pkgs/development/python-modules/watchdog/default.nix
+++ b/pkgs/development/python-modules/watchdog/default.nix
@@ -14,24 +14,18 @@
 
 buildPythonPackage rec {
   pname = "watchdog";
-  version = "2.1.9";
+  version = "2.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Q84g67NqUfIfo3b3bR1GkkUrJSfM1gGVDWntNrniFgk=";
+    hash = "sha256-g8+Lxg2cYTtmpMAYBRhz1ic9nkXQQO7QbWqWJBvY7AE=";
   };
 
   patches = lib.optionals (stdenv.isDarwin && !stdenv.isAarch64) [
     ./force-kqueue.patch
-  ] ++ [
-    (fetchpatch {
-      url = "https://github.com/gorakhargosh/watchdog/commit/255d1e45c17929dd5ba8a6f91aa28771109931cd.patch";
-      sha256 = "sha256-gGgEGuB/0g+4Pv1dXMvIdObjqKruWKkxtufS/dzSlY8=";
-      excludes = [ "changelog.rst" ];
-    })
   ];
 
   buildInputs = lib.optionals stdenv.isDarwin [

From c53bf3afbad0016428fda2bf6b0e605aa289ca57 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 19 Dec 2022 11:31:08 +0100
Subject: [PATCH 157/231] python310Packages.pyelftools: add changelog to meta

---
 pkgs/development/python-modules/pyelftools/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/pyelftools/default.nix b/pkgs/development/python-modules/pyelftools/default.nix
index 1f0bcc15b3ea..655f1f14fd4f 100644
--- a/pkgs/development/python-modules/pyelftools/default.nix
+++ b/pkgs/development/python-modules/pyelftools/default.nix
@@ -34,6 +34,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library for analyzing ELF files and DWARF debugging information";
     homepage = "https://github.com/eliben/pyelftools";
+    changelog = "https://github.com/eliben/pyelftools/blob/v${version}/CHANGES";
     license = licenses.publicDomain;
     maintainers = with maintainers; [ igsha pamplemousse ];
   };

From 1c45ce632716eaad9d002cb5bae65e0d0d5a3a15 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 19 Dec 2022 16:01:21 +0100
Subject: [PATCH 158/231] python310Packages.pyelftools: 0.28 -> 0.29

---
 pkgs/development/python-modules/pyelftools/default.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pyelftools/default.nix b/pkgs/development/python-modules/pyelftools/default.nix
index 655f1f14fd4f..817a39cedf9e 100644
--- a/pkgs/development/python-modules/pyelftools/default.nix
+++ b/pkgs/development/python-modules/pyelftools/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyelftools";
-  version = "0.28";
+  version = "0.29";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,14 +17,16 @@ buildPythonPackage rec {
     owner = "eliben";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-+T5C0ah2oj5E8fWaQbuzYRVgD5bSiUbaArrlxNLojvw=";
+    hash = "sha256-tPY0C5CoA9hGHeEA/KWQ1RAVT5kqMlAwuWpOSH+KJ9Y=";
   };
 
   doCheck = stdenv.hostPlatform.system == "x86_64-linux" && stdenv.hostPlatform.isGnu;
 
   checkPhase = ''
     patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" test/external_tools/readelf
-    ${python.interpreter} test/all_tests.py
+    ${python.interpreter} test/run_all_unittests.py
+    ${python.interpreter} test/run_examples_test.py
+    ${python.interpreter} test/run_readelf_tests.py --parallel
   '';
 
   pythonImportsCheck = [

From f8fa52c4edeeca248053a135c8110bb4689b9c18 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 19 Dec 2022 16:24:56 +0100
Subject: [PATCH 159/231] python310Packages.unidecode: add changelog to meta

---
 pkgs/development/python-modules/unidecode/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/unidecode/default.nix b/pkgs/development/python-modules/unidecode/default.nix
index 96e487871aa3..a15190908dbe 100644
--- a/pkgs/development/python-modules/unidecode/default.nix
+++ b/pkgs/development/python-modules/unidecode/default.nix
@@ -29,7 +29,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "ASCII transliterations of Unicode text";
-    homepage = "https://pypi.python.org/pypi/Unidecode/";
+    homepage = "https://github.com/avian2/unidecode";
+    changelog = "https://github.com/avian2/unidecode/blob/unidecode-${version}/ChangeLog";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ domenkozar ];
   };

From 8e63b88831614b507e22a4c4a3ca966aab5cd21e Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 19 Dec 2022 16:27:03 +0100
Subject: [PATCH 160/231] python310Packages.unidecode: 1.34 -> 1.3.6

Changelog: https://github.com/avian2/unidecode/blob/unidecode-1.3.6/ChangeLog
---
 pkgs/development/python-modules/unidecode/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/unidecode/default.nix b/pkgs/development/python-modules/unidecode/default.nix
index a15190908dbe..e2ac00de2177 100644
--- a/pkgs/development/python-modules/unidecode/default.nix
+++ b/pkgs/development/python-modules/unidecode/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "unidecode";
-  version = "1.3.4";
+  version = "1.3.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.5";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "avian2";
     repo = pname;
     rev = "${pname}-${version}";
-    hash = "sha256-2LRV6Egst2bdxefEzfuA9Ef8zMSWvmlCEV/sIzezyPw=";
+    hash = "sha256-75E2OlrGIxvwR9MeZEB4bDLdFd1SdprCVcBIJCPS3hM=";
   };
 
   checkInputs = [

From 7b9adf4dee7614a0621758819d2db601bf853bc1 Mon Sep 17 00:00:00 2001
From: AndersonTorres <torres.anderson.85@protonmail.com>
Date: Mon, 19 Dec 2022 15:01:10 -0300
Subject: [PATCH 161/231] libarchive: refactor

- Remove "override" references on all-packages.nix
- use finalAttrs style to get rid of rec
- refactor postPatch to use Nix code instead of shell script
---
 .../libraries/libarchive/default.nix          | 52 ++++++++++---------
 pkgs/top-level/all-packages.nix               |  4 +-
 2 files changed, 29 insertions(+), 27 deletions(-)

diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index c7e9f117f94c..381689f9cb65 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -22,44 +22,48 @@
 , cmake
 , nix
 , samba
+, buildPackages
 }:
 
+let
+  autoreconfHook = buildPackages.autoreconfHook269;
+in
 assert xarSupport -> libxml2 != null;
-
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libarchive";
   version = "3.6.2";
 
   src = fetchFromGitHub {
     owner = "libarchive";
     repo = "libarchive";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-wQbA6vlXH8pnpY7LJLkjrRFEBpcaPR1SqxnK71UVwxg=";
   };
 
-  postPatch = ''
+  outputs = [ "out" "lib" "dev" ];
+
+  postPatch = let
+    skipTestPaths = [
+      # test won't work in nix sandbox
+      "libarchive/test/test_write_disk_perms.c"
+      # the filesystem does not necessarily have sparse capabilities
+      "libarchive/test/test_sparse_basic.c"
+      # the filesystem does not necessarily have hardlink capabilities
+      "libarchive/test/test_write_disk_hardlink.c"
+      # access-time-related tests flakey on some systems
+      "cpio/test/test_option_a.c"
+      "cpio/test/test_option_t.c"
+    ];
+    removeTest = testPath: ''
+      substituteInPlace Makefile.am --replace "${testPath}" ""
+      rm "${testPath}"
+    '';
+  in ''
     substituteInPlace Makefile.am --replace '/bin/pwd' "$(type -P pwd)"
 
-    declare -a skip_test_paths=(
-      # test won't work in nix sandbox
-      'libarchive/test/test_write_disk_perms.c'
-      # can't be sure builder will have sparse-capable fs
-      'libarchive/test/test_sparse_basic.c'
-      # can't even be sure builder will have hardlink-capable fs
-      'libarchive/test/test_write_disk_hardlink.c'
-      # access-time-related tests flakey on some systems
-      'cpio/test/test_option_a.c'
-      'cpio/test/test_option_t.c'
-    )
-
-    for test_path in "''${skip_test_paths[@]}" ; do
-      substituteInPlace Makefile.am --replace "$test_path" ""
-      rm "$test_path"
-    done
+    ${lib.concatStringsSep "\n" (map removeTest skipTestPaths)}
   '';
 
-  outputs = [ "out" "lib" "dev" ];
-
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
@@ -105,7 +109,7 @@ stdenv.mkDerivation rec {
       includes implementations of the common tar, cpio, and zcat command-line
       tools that use the libarchive library.
     '';
-    changelog = "https://github.com/libarchive/libarchive/releases/tag/v${version}";
+    changelog = "https://github.com/libarchive/libarchive/releases/tag/v${finalAttrs.version}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ jcumming AndersonTorres ];
     platforms = platforms.all;
@@ -114,4 +118,4 @@ stdenv.mkDerivation rec {
   passthru.tests = {
     inherit cmake nix samba;
   };
-}
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0636572aa450..c9e3f6fd4a42 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20172,9 +20172,7 @@ with pkgs;
 
   libargs = callPackage ../development/libraries/libargs { };
 
-  libarchive = callPackage ../development/libraries/libarchive {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  libarchive = callPackage ../development/libraries/libarchive { };
 
   libarchive-qt = libsForQt5.callPackage ../development/libraries/libarchive-qt { };
 

From 47de6ecabb0609bc8b4212842fb01533b3616874 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=94=D0=B0=D0=BC=D1=98=D0=B0=D0=BD=20=D0=93=D0=B5=D0=BE?=
 =?UTF-8?q?=D1=80=D0=B3=D0=B8=D0=B5=D0=B2=D1=81=D0=BA=D0=B8?=
 <gdamjan@gmail.com>
Date: Wed, 21 Dec 2022 16:57:44 +0100
Subject: [PATCH 162/231] systemd: 252.3 -> 252.4

also fixes an security issue with systemd-coredump:
https://www.openwall.com/lists/oss-security/2022/12/21/3
---
 pkgs/os-specific/linux/systemd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 7a872c3b5456..eb9a43908fd3 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -123,7 +123,7 @@ assert withHomed -> withCryptsetup;
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "252.3";
+  version = "252.4";
 
   # Bump this variable on every (major) version change. See below (in the meson options list) for why.
   # command:
@@ -140,7 +140,7 @@ stdenv.mkDerivation {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    hash = "sha256-F2wtg12amigd5KNCWmG3b9Yu6PUOby9mQgZ2VFtxl5A==";
+    hash = "sha256-8ejSEt3QyCSARGGVbXWac2dB9jdUpC4eX2rN0iENQX0=";
   };
 
   # On major changes, or when otherwise required, you *must* reformat the patches,

From c44fb852ce2cf9edff9a8825419a820fc80884d8 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 21 Dec 2022 23:11:01 +0100
Subject: [PATCH 163/231] curl: 7.86.0 -> 7.87.0

https://daniel.haxx.se/blog/2022/12/21/curl-7-87-0/
https://curl.se/docs/CVE-2022-43551.html
https://curl.se/docs/CVE-2022-43552.html

Fixes: CVE-2022-43551, CVE-2022-43552
---
 pkgs/tools/networking/curl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 6d5f28e7a82f..311e9e1b8c76 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -47,14 +47,14 @@ assert !(opensslSupport && wolfsslSupport);
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "7.86.0";
+  version = "7.87.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.bz2"
       "https://github.com/curl/curl/releases/download/curl-${finalAttrs.version}/curl-${finalAttrs.version}.tar.bz2"
     ];
-    sha256 = "sha256-9cpp2wPuoX+ocFvfsan1jXakbJAQUYEJuzjzExN+Cig=";
+    hash = "sha256-XW4Sh2G3EQlG0Sdq/28PJm8rcm9eYZ9+CgV6R0FV8wc=";
   };
 
   patches = [

From bae75df20ec7f187b9995f4f27016de54f3ca02b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 21 Dec 2022 23:00:14 +0100
Subject: [PATCH 164/231] libksba: 1.6.2 -> 1.6.3

https://gnupg.org/blog/20221017-pepe-left-the-ksba.html

Fixes: CVE-2022-3515
---
 pkgs/development/libraries/libksba/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libksba/default.nix b/pkgs/development/libraries/libksba/default.nix
index 5bfb0d029cdf..d7f5aa24c155 100644
--- a/pkgs/development/libraries/libksba/default.nix
+++ b/pkgs/development/libraries/libksba/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libksba";
-  version = "1.6.2";
+  version = "1.6.3";
 
   src = fetchurl {
     url = "mirror://gnupg/libksba/libksba-${version}.tar.bz2";
-    sha256 = "fce01ccac59812bddadffacff017dac2e4762bdb6ebc6ffe06f6ed4f6192c971";
+    hash = "sha256-P3LGjbMJceu/FDZ1J3GUI/Ck1fgQP8n0ocAan6RA3lw=";
   };
 
   outputs = [ "out" "dev" "info" ];

From 5aef081f74333a74ee4d5022adf27d0c421f08ad Mon Sep 17 00:00:00 2001
From: Dominik Ritter <dominik.ritter@chefkoch.de>
Date: Wed, 21 Dec 2022 18:04:36 +0100
Subject: [PATCH 165/231] freetype: add brotli

---
 pkgs/development/libraries/freetype/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/freetype/default.nix b/pkgs/development/libraries/freetype/default.nix
index 9d94fe0c44ec..68907d798e19 100644
--- a/pkgs/development/libraries/freetype/default.nix
+++ b/pkgs/development/libraries/freetype/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl
 , buildPackages, pkgsHostHost
 , pkg-config, which, makeWrapper
-, zlib, bzip2, libpng, gnumake, glib
+, zlib, bzip2, brotli, libpng, gnumake, glib
 
 , # FreeType supports LCD filtering (colloquially referred to as sub-pixel rendering).
   # LCD filtering is also known as ClearType and covered by several Microsoft patents.
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-R2byAVfMTPDNKS+Av5F/ktHEObJDrDAY3r9rkUDEGn8=";
   };
 
-  propagatedBuildInputs = [ zlib bzip2 libpng ]; # needed when linking against freetype
+  propagatedBuildInputs = [ zlib bzip2 brotli libpng ]; # needed when linking against freetype
 
   # dependence on harfbuzz is looser than the reverse dependence
   nativeBuildInputs = [ pkg-config which makeWrapper ]

From 729c7fb1c8c610a360d652c7047ef0da10f6a04c Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Thu, 22 Dec 2022 17:43:24 +0100
Subject: [PATCH 166/231] nasm: 2.15.05 -> 2.16.01

Fixes CVE-2020-18974.

https://nasm.us/doc/nasmdocc.html
---
 pkgs/development/compilers/nasm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/nasm/default.nix b/pkgs/development/compilers/nasm/default.nix
index ce053e87130f..b9f0e856f65c 100644
--- a/pkgs/development/compilers/nasm/default.nix
+++ b/pkgs/development/compilers/nasm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nasm";
-  version = "2.15.05";
+  version = "2.16.01";
 
   src = fetchurl {
     url = "https://www.nasm.us/pub/nasm/releasebuilds/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0gqand86b0r86k3h46dh560lykxmxqqywz5m55kgjfq7q4lngbrw";
+    sha256 = "sha256-x3dF9IAjde/u4uxcCta38DfqnIfJKxSaljf/CZ8WJVg=";
   };
 
   nativeBuildInputs = [ perl ];

From cdf92e56f7e51e97c7acf3020977be20ba8086c4 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 23 Dec 2022 17:03:47 +0300
Subject: [PATCH 167/231] mesa: enable separateDebugInfo

It is generally useful, and it also makes rusticl work for ??? reasons ???
---
 pkgs/development/libraries/mesa/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 8d8562468757..067a71e2904b 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -93,6 +93,10 @@ self = stdenv.mkDerivation {
     ++ lib.optional stdenv.isLinux "driversdev"
     ++ lib.optional enableOpenCL "opencl";
 
+  # FIXME: this fixes rusticl/iris segfaulting on startup, _somehow_.
+  # Needs more investigating.
+  separateDebugInfo = true;
+
   preConfigure = ''
     PATH=${llvmPackages.libllvm.dev}/bin:$PATH
   '';

From b1834a461edf7abf4a6fb89db0ed65904a48a01c Mon Sep 17 00:00:00 2001
From: Winter <winter@winter.cafe>
Date: Thu, 15 Dec 2022 18:38:33 -0500
Subject: [PATCH 168/231] Revert "rustc: propagate libiconv on darwin"

This reverts commit b6fc00b8f4bc25a72c43320b70082bbee06321db.

Rust 1.66.0 contains a fix for libiconv being linked unconditionally on macOS, but this only applies to packages that don't depend on older versions of `libc`.

For now, let's go back to including libiconv in `buildInputs` by default for packages that use `buildRustPackage`. As packages bump their `libc` versions, we can eventually stop including it by default, and manually add it where needed.
---
 pkgs/build-support/rust/build-rust-package/default.nix | 1 +
 pkgs/development/compilers/rust/cargo.nix              | 4 ++--
 pkgs/development/compilers/rust/rustc.nix              | 4 +---
 3 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index 20fb41d0aaa7..e7eab34e45d9 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -134,6 +134,7 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoUpdateHook" "carg
   ];
 
   buildInputs = buildInputs
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ]
     ++ lib.optionals stdenv.hostPlatform.isMinGW [ windows.pthreads ];
 
   patches = cargoPatches ++ patches;
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index 5571918fdc62..291a64f2210c 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, pkgsHostHost
 , file, curl, pkg-config, python3, openssl, cmake, zlib
 , installShellFiles, makeWrapper, cacert, rustPlatform, rustc
-, libiconv, CoreFoundation, Security
+, CoreFoundation, Security
 , auditable ? false # TODO: change to true when this is the default
 }:
 
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage {
     (lib.getDev pkgsHostHost.curl)
   ];
   buildInputs = [ cacert file curl python3 openssl zlib ]
-    ++ lib.optionals stdenv.isDarwin [ libiconv CoreFoundation Security ];
+    ++ lib.optionals stdenv.isDarwin [ CoreFoundation Security ];
 
   # cargo uses git-rs which is made for a version of libgit2 from recent master that
   # is not compatible with the current version in nixpkgs.
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 8288cd5c61e3..06d9de15ab8d 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -163,11 +163,9 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [ openssl ]
-    ++ optionals stdenv.isDarwin [ Security ]
+    ++ optionals stdenv.isDarwin [ libiconv Security ]
     ++ optional (!withBundledLLVM) llvmShared;
 
-  depsTargetTargetPropagated = optionals stdenv.isDarwin [ libiconv ];
-
   outputs = [ "out" "man" "doc" ];
   setOutputFlags = false;
 

From edfbbaf28258d968de64b364d4a0868a80cdf1c2 Mon Sep 17 00:00:00 2001
From: Winter <winter@winter.cafe>
Date: Thu, 15 Dec 2022 18:49:05 -0500
Subject: [PATCH 169/231] rustc: add note about libiconv dependency

---
 pkgs/development/compilers/rust/rustc.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 06d9de15ab8d..43d603923c97 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -163,6 +163,7 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [ openssl ]
+    # TODO: remove libiconv once 1.66 is used to bootstrap
     ++ optionals stdenv.isDarwin [ libiconv Security ]
     ++ optional (!withBundledLLVM) llvmShared;
 

From f402b4b29e8c75f2fd0ea491b2c1a982fd5b0398 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 19 Dec 2022 10:30:42 -0800
Subject: [PATCH 170/231] python310Packages.pytz: 2022.6 -> 2022.7

---
 pkgs/development/python-modules/pytz/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytz/default.nix b/pkgs/development/python-modules/pytz/default.nix
index 79750bb2435b..374187f9b97e 100644
--- a/pkgs/development/python-modules/pytz/default.nix
+++ b/pkgs/development/python-modules/pytz/default.nix
@@ -2,11 +2,13 @@
 
 buildPythonPackage rec {
   pname = "pytz";
-  version = "2022.6";
+  version = "2022.7";
+
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-6JUSQGt5PKOfWXG8mZzFOM4SXA5RwnlBvvRWi0YAleI=";
+    hash = "sha256-fM+ue0ssBnRkpnM8YmFnP9uP0b6QVGA5a5egc+n6aDo=";
   };
 
   checkInputs = [ unittestCheckHook ];

From e07df68f1ecae8e74171aa459c836e6a6b9b5f26 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Tue, 13 Dec 2022 20:48:02 +0000
Subject: [PATCH 171/231] sqlite: add patch for CVE-2022-46908

(cherry-picked from commit a7a2489afd1a5d30a33d5673bcc46d700b224f32
on the staging-22.11 branch)
---
 .../3.39.4-autoconf-CVE-2022-46908.patch      | 25 +++++++++++++++++++
 pkgs/development/libraries/sqlite/default.nix |  4 +++
 2 files changed, 29 insertions(+)
 create mode 100644 pkgs/development/libraries/sqlite/3.39.4-autoconf-CVE-2022-46908.patch

diff --git a/pkgs/development/libraries/sqlite/3.39.4-autoconf-CVE-2022-46908.patch b/pkgs/development/libraries/sqlite/3.39.4-autoconf-CVE-2022-46908.patch
new file mode 100644
index 000000000000..27ab2af2014a
--- /dev/null
+++ b/pkgs/development/libraries/sqlite/3.39.4-autoconf-CVE-2022-46908.patch
@@ -0,0 +1,25 @@
+adapted for preprocessed source files from upstream
+https://sqlite.org/src/vpatch?from=a60e56627fc0ef88&to=cefc032473ac5ad2
+
+diff --git a/shell.c b/shell.c
+index e66ae08..d423278 100644
+--- a/shell.c
++++ b/shell.c
+@@ -12921,7 +12921,7 @@ static int safeModeAuth(
+     "zipfile",
+     "zipfile_cds",
+   };
+-  UNUSED_PARAMETER(zA2);
++  UNUSED_PARAMETER(zA1);
+   UNUSED_PARAMETER(zA3);
+   UNUSED_PARAMETER(zA4);
+   switch( op ){
+@@ -12936,7 +12936,7 @@ static int safeModeAuth(
+     case SQLITE_FUNCTION: {
+       int i;
+       for(i=0; i<ArraySize(azProhibitedFunctions); i++){
+-        if( sqlite3_stricmp(zA1, azProhibitedFunctions[i])==0 ){
++        if( sqlite3_stricmp(zA2, azProhibitedFunctions[i])==0 ){
+           failIfSafeMode(p, "cannot use the %s() function in safe mode",
+                          azProhibitedFunctions[i]);
+         }
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 5e3e8f362e03..3f4081acc044 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -26,6 +26,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-AzNVIHbScAx1NSJW6Rx4v1zWJJFYm6DGmu0KgYaJgOc=";
   };
 
+  patches = [
+    ./3.39.4-autoconf-CVE-2022-46908.patch
+  ];
+
   outputs = [ "bin" "dev" "out" ];
   separateDebugInfo = stdenv.isLinux;
 

From 02ffcc0ba31ed9d216b8c8ca0790b48573050ce8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 24 Dec 2022 03:02:07 +0000
Subject: [PATCH 172/231] gnused: 4.8 -> 4.9

---
 pkgs/tools/text/gnused/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/text/gnused/default.nix b/pkgs/tools/text/gnused/default.nix
index 32f6f30cb1ac..f493e4f358d6 100644
--- a/pkgs/tools/text/gnused/default.nix
+++ b/pkgs/tools/text/gnused/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnused";
-  version = "4.8";
+  version = "4.9";
 
   src = fetchurl {
     url = "mirror://gnu/sed/sed-${version}.tar.xz";
-    sha256 = "0cznxw73fzv1n3nj2zsq6nf73rvsbxndp444xkpahdqvlzz0r6zp";
+    sha256 = "sha256-biJrcy4c1zlGStaGK9Ghq6QteYKSLaelNRljHSSXUYE=";
   };
 
   outputs = [ "out" "info" ];

From 81465ba9497e05a3ef1c1dcb6a15223ca1cfa2a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 22 Dec 2022 03:19:20 -0800
Subject: [PATCH 173/231] python310Packages.pybind11: 2.10.1 -> 2.10.2

https://github.com/pybind/pybind11/blob/v2.10.2/docs/changelog.rst
---
 pkgs/development/python-modules/pybind11/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index 642d3c7e97f5..146ffce784fa 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.10.1";
+  version = "2.10.2";
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-9NS0/fLW2zEmEXhI9GfNN3C/CeI5xibFHwMoUebI90U=";
+    hash = "sha256-YxAkozyWNTKMCIEk3AhHZbRHtzhRrCSB3wh/Qy9CIyU=";
   };
 
   postPatch = ''

From 4b4777638c424fa29224330d078b065503806aad Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 24 Dec 2022 07:50:56 +0000
Subject: [PATCH 174/231] soundtouch: 2.3.1 -> 2.3.2

---
 pkgs/development/libraries/soundtouch/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/soundtouch/default.nix b/pkgs/development/libraries/soundtouch/default.nix
index 318ead830f9b..c337edfa0917 100644
--- a/pkgs/development/libraries/soundtouch/default.nix
+++ b/pkgs/development/libraries/soundtouch/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "soundtouch";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "soundtouch";
     repo = "soundtouch";
     rev = version;
-    sha256 = "10znckb8mrnmvwj7vq12732al873qhqw27fpb5f8r0bkjdpcj3vr";
+    sha256 = "sha256-+RprzCn0NCueHhDkk2Lgg7Ihw8JDzu25eIVoVZwF+BA=";
   };
 
   nativeBuildInputs = [ autoconf automake libtool ];

From a16c64bf42513ea5353d235a050b629e58517cd4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 24 Dec 2022 17:53:04 +0000
Subject: [PATCH 175/231] libbpf: 1.0.1 -> 1.1.0

---
 pkgs/os-specific/linux/libbpf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/libbpf/default.nix b/pkgs/os-specific/linux/libbpf/default.nix
index 04322a35b4fe..d6bb9d4a431b 100644
--- a/pkgs/os-specific/linux/libbpf/default.nix
+++ b/pkgs/os-specific/linux/libbpf/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "libbpf";
     rev = "v${version}";
-    sha256 = "sha256-2rzVah+CxCztKnlEWMIQrUS2JJTLiWscfIA1aOBtIzs=";
+    sha256 = "sha256-/vt6IA1o0gjFtXUWhEKIZ1DUWIN2LOvrhLfFzJBACGY=";
   };
 
   nativeBuildInputs = [ pkg-config ];

From b4b746ca00bb6ee7e21be8ed6826892fdf0ee4ed Mon Sep 17 00:00:00 2001
From: Fabian Hauser <fabian@fh2.ch>
Date: Tue, 20 Dec 2022 22:10:23 +0100
Subject: [PATCH 176/231] libcamera: 0.0.1 -> 0.0.3

libcamera 0.0.3 has been released
https://git.libcamera.org/libcamera/libcamera.git/tag/?h=v0.0.3
---
 pkgs/development/libraries/libcamera/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libcamera/default.nix b/pkgs/development/libraries/libcamera/default.nix
index ff7cd7a193e3..d03783f2fd90 100644
--- a/pkgs/development/libraries/libcamera/default.nix
+++ b/pkgs/development/libraries/libcamera/default.nix
@@ -21,12 +21,12 @@
 
 stdenv.mkDerivation rec {
   pname = "libcamera";
-  version = "0.0.1";
+  version = "0.0.3";
 
   src = fetchgit {
     url = "https://git.libcamera.org/libcamera/libcamera.git";
     rev = "v${version}";
-    hash = "sha256-u5FnfXBCjwSp8QBrH8KIkVGV32/9pff41ZWjWXOwuMI=";
+    hash = "sha256-0/wvH07bJRKFwYnOARRJNzH8enIX3TNnWQnJdfpfvgE=";
   };
 
   postPatch = ''

From 78c276f9b14436ca2ea45a90d53a3e221a7689d5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Wed, 21 Dec 2022 00:25:44 +0100
Subject: [PATCH 177/231] nixos/no-x-libs: add gst_all_1.gst-plugins-base, turn
 gstreamer back on for libextractor

---
 nixos/modules/config/no-x-libs.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index 70e265a65a60..3c964cb20913 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -33,10 +33,13 @@ with lib;
       ffmpeg_4 = super.ffmpeg_4-headless;
       ffmpeg_5 = super.ffmpeg_5-headless;
       gobject-introspection = super.gobject-introspection.override { x11Support = false; };
+      gst_all_1 = super.gst_all_1 // {
+        gst-plugins-base = super.gst_all_1.gst-plugins-base.override { enableX11 = false; };
+      };
       gpsd = super.gpsd.override { guiSupport = false; };
       imagemagick = super.imagemagick.override { libX11Support = false; libXtSupport = false; };
       imagemagickBig = super.imagemagickBig.override { libX11Support = false; libXtSupport = false; };
-      libextractor = super.libextractor.override { gstreamerSupport = false; gtkSupport = false; };
+      libextractor = super.libextractor.override { gtkSupport = false; };
       libva = super.libva-minimal;
       limesuite = super.limesuite.override { withGui = false; };
       msmtp = super.msmtp.override { withKeyring = false; };

From c5551f19e5d76d3ed1e83fbc659686a56a297cb4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Wed, 21 Dec 2022 18:53:04 +0100
Subject: [PATCH 178/231] nixos/no-x-libs: add mpv-unwrapped

---
 nixos/modules/config/no-x-libs.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index 3c964cb20913..9c83a44d7b0e 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -42,6 +42,7 @@ with lib;
       libextractor = super.libextractor.override { gtkSupport = false; };
       libva = super.libva-minimal;
       limesuite = super.limesuite.override { withGui = false; };
+      mpv-unwrapped = super.mpv-unwrapped.override { sdl2Support = false; x11Support = false; };
       msmtp = super.msmtp.override { withKeyring = false; };
       networkmanager-fortisslvpn = super.networkmanager-fortisslvpn.override { withGnome = false; };
       networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; };

From 1557d417975bd1369c11a72715e36e23cf982a33 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Wed, 21 Dec 2022 18:53:18 +0100
Subject: [PATCH 179/231] gst_all_1.gst-plugins-base: fix build without x11

---
 pkgs/development/libraries/gstreamer/base/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index dac712e82387..395708c2a680 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -79,17 +79,16 @@ stdenv.mkDerivation rec {
     libjpeg
     tremor
     libGL
+    pango
   ] ++ lib.optionals (!stdenv.isDarwin) [
     libvisual
   ] ++ lib.optionals stdenv.isDarwin [
-    pango
     OpenGL
   ] ++ lib.optionals enableAlsa [
     alsa-lib
   ] ++ lib.optionals enableX11 [
     libXext
     libXv
-    pango
   ] ++ lib.optionals enableWayland [
     wayland
     wayland-protocols

From a4a1e28e2d3fcbb9efa9e4f4fdc238623148a0d8 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 25 Dec 2022 20:51:57 +0100
Subject: [PATCH 180/231] python310Packages.pytest-httpserver: add changelog to
 meta

- switch to pyproject
- adjust inputs
---
 .../pytest-httpserver/default.nix             | 41 +++++++++++++------
 1 file changed, 28 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-httpserver/default.nix b/pkgs/development/python-modules/pytest-httpserver/default.nix
index cba9a9294e7c..eebbcacb5037 100644
--- a/pkgs/development/python-modules/pytest-httpserver/default.nix
+++ b/pkgs/development/python-modules/pytest-httpserver/default.nix
@@ -1,35 +1,50 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, pytest-cov
+, fetchFromGitHub
+, poetry-core
 , pytestCheckHook
+, pythonOlder
 , requests
+, toml
 , werkzeug
 }:
 
 buildPythonPackage rec {
   pname = "pytest-httpserver";
   version = "1.0.6";
+  format = "pyproject";
 
-  src = fetchPypi {
-    pname = "pytest_httpserver";
-    inherit version;
-    sha256 = "sha256-kEDQe/WaxF2N49sdRGj9LR1geXXk2kyHLswEAs2/ez4=";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "csernazs";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    hash = "sha256-LY5Ur0cIcsNrgvyQlY2E479ZzRcuwqTuiT2MtRupVcs=";
   };
 
-  propagatedBuildInputs = [ werkzeug ];
-
-  checkInputs = [
-    pytest-cov
-    pytestCheckHook
-    requests
+  nativeBuildInputs = [
+    poetry-core
   ];
 
-  pythonImportsCheck = [ "pytest_httpserver" ];
+  propagatedBuildInputs = [
+    werkzeug
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    requests
+    toml
+  ];
+
+  pythonImportsCheck = [
+    "pytest_httpserver"
+  ];
 
   meta = with lib; {
     description = "HTTP server for pytest to test HTTP clients";
     homepage = "https://www.github.com/csernazs/pytest-httpserver";
+    changelog = "https://github.com/csernazs/pytest-httpserver/blob/${version}/CHANGES.rst";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };

From 69ba914b99bc7c43f5d821f7afef8d28a4d73d22 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Mon, 12 Dec 2022 07:12:45 +1000
Subject: [PATCH 181/231] git: 2.38.1 -> 2.39.0

Changelog: https://github.com/git/git/blob/v2.39.0/Documentation/RelNotes/2.39.0.txt
---
 pkgs/applications/version-management/git/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/version-management/git/default.nix b/pkgs/applications/version-management/git/default.nix
index 2d63ae403791..19b9f97c17f7 100644
--- a/pkgs/applications/version-management/git/default.nix
+++ b/pkgs/applications/version-management/git/default.nix
@@ -28,7 +28,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.38.1";
+  version = "2.39.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "sha256-l9346liiueD7wlCOJFAoynWRG9ONFVFhaxSMGqV0Ctk=";
+    sha256 = "sha256-uhmbE/tamco97JF7C9c2vA61qd+Hc31DXt398Q1pJls=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";

From 67ce2eda82f8bc27b9abf9a63882532264f6bd3d Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 26 Dec 2022 14:45:00 +0000
Subject: [PATCH 182/231] tcb: fix cross-compilation of tcb

Without the change build fails to find `gcc`:

    $ nix build --no-link -f. pkgsCross.riscv64.shadow
    > make[1]: Entering directory '/build/source/libs'
    > gcc -O2  -I../include -Wall -Wextra -fPIC -c libtcb.c -o libtcb.o
    > /nix/store/b9jxsncywlygxjjyql0z5bq6z29m6j4r-bash-5.1-p16/bin/bash: line 1: gcc: command not found
---
 pkgs/tools/security/tcb/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/tools/security/tcb/default.nix b/pkgs/tools/security/tcb/default.nix
index 63b252be9521..b49f7767dcbd 100644
--- a/pkgs/tools/security/tcb/default.nix
+++ b/pkgs/tools/security/tcb/default.nix
@@ -26,6 +26,9 @@ stdenv.mkDerivation rec {
       --replace "PREFIX = /usr" "PREFIX = $out" \
       --replace "SBINDIR = /sbin" "SBINDIR = $bin/bin" \
       --replace "INCLUDEDIR = \$(PREFIX)/include" "INCLUDEDIR = $dev/include"
+
+    # Override default 'CC=gcc'
+    makeFlagsArray+=("CC=$CC")
   '';
 
   meta = with lib; {

From 37a44b41fcf1aebd06e4417bde5cbb1e5be3bc2b Mon Sep 17 00:00:00 2001
From: Andreas Rammhold <andreas@rammhold.de>
Date: Fri, 23 Dec 2022 16:47:20 +0100
Subject: [PATCH 183/231] git: set reasonable default features

Git should come with a reasonable set of baseline features. Arguable
git-send-email is one of them. Development flows, such as those of
Linux, depend on the tool being available.

The difference in closure size between this and the previous version
is is negligible. There are no additional build-time dependencies
pulled in and the runtime closure difference is about 1%.
---
 pkgs/applications/version-management/git/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/version-management/git/default.nix b/pkgs/applications/version-management/git/default.nix
index 19b9f97c17f7..56f7e697ec87 100644
--- a/pkgs/applications/version-management/git/default.nix
+++ b/pkgs/applications/version-management/git/default.nix
@@ -12,7 +12,7 @@
 , withManual ? true
 , pythonSupport ? true
 , withpcre2 ? true
-, sendEmailSupport ? false
+, sendEmailSupport ? perlSupport
 , Security, CoreServices
 , nixosTests
 , withLibsecret ? false

From 8f421eef7d265e53eb24aa33ba583bee19738a97 Mon Sep 17 00:00:00 2001
From: SnIcK <ido.samuelson@gmail.com>
Date: Mon, 26 Dec 2022 16:49:30 -0600
Subject: [PATCH 184/231] maintainers: add realsnick

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 99907a6877f8..0d7e7b238591 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11436,6 +11436,12 @@
     githubId = 1973389;
     name = "Reuben D'Netto";
   };
+  realsnick = {
+    name = "Ido Samuelson";
+    email = "ido.samuelson@gmail.com";
+    github = "realsnick";
+    githubId = 1440852;
+  };
   redbaron = {
     email = "ivanov.maxim@gmail.com";
     github = "redbaron";

From fff47fb03946e6036bad1a7e22de2d47aed1c211 Mon Sep 17 00:00:00 2001
From: SnIcK <ido.samuelson@gmail.com>
Date: Mon, 26 Dec 2022 16:50:13 -0600
Subject: [PATCH 185/231] libusb1: add option to build with examples

---
 pkgs/development/libraries/libusb1/default.nix | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/libusb1/default.nix b/pkgs/development/libraries/libusb1/default.nix
index f7f1633ed446..326ee3028158 100644
--- a/pkgs/development/libraries/libusb1/default.nix
+++ b/pkgs/development/libraries/libusb1/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , fetchpatch
 , autoreconfHook
@@ -8,6 +9,7 @@
 , libobjc
 , IOKit
 , Security
+, withExamples ? false
 , withStatic ? false
 }:
 
@@ -31,12 +33,20 @@ stdenv.mkDerivation rec {
 
   dontDisableStatic = withStatic;
 
-  configureFlags = lib.optional (!enableUdev) "--disable-udev";
+  configureFlags =
+    lib.optional (!enableUdev) "--disable-udev"
+    ++ lib.optional (withExamples) "--enable-examples-build";
 
   preFixup = lib.optionalString enableUdev ''
     sed 's,-ludev,-L${lib.getLib udev}/lib -ludev,' -i $out/lib/libusb-1.0.la
   '';
 
+  postInstall = lib.optionalString withExamples ''
+    mkdir -p $out/{bin,sbin,examples/bin}
+    cp -r examples/.libs/* $out/examples/bin
+    ln -s $out/examples/bin/fxload $out/sbin/fxload
+  '';
+
   meta = with lib; {
     homepage = "https://libusb.info/";
     description = "cross-platform user-mode USB device library";
@@ -45,6 +55,6 @@ stdenv.mkDerivation rec {
     '';
     platforms = platforms.all;
     license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ prusnak ];
+    maintainers = with maintainers; [ prusnak realsnick ];
   };
 }

From 6257a5ae5d24bbb23e37c65902875a65ae438f15 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Mon, 26 Dec 2022 18:16:40 +0800
Subject: [PATCH 186/231] gtk3: add missing libXdamage, explicitly add
 libXfixes

libXdamage is an optional dependency, however this is needed for XEmbed
tray icons on MATE to work properly. This is already enabled in gtk4.

https://gitlab.gnome.org/GNOME/gtk/-/blob/3.24.36/meson.build#L583
https://gitlab.gnome.org/search?search=xdamage&project_id=665&group_id=8&search_code=true&repository_ref=gtk-3-24

Also explicitly add libXfixes since gtk3 also optionally directly depends
on it.

https://gitlab.gnome.org/GNOME/gtk/-/blob/3.24.36/meson.build#L577
---
 pkgs/development/libraries/gtk/3.x.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index 282486dc88d5..112158a47276 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -145,6 +145,8 @@ stdenv.mkDerivation rec {
     libSM
     libXcomposite
     libXcursor
+    libXdamage
+    libXfixes
     libXi
     libXrandr
     libXrender

From 7843a268f214f89dba7fdab1030872bdc96b9606 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 25 Dec 2022 20:22:18 +0000
Subject: [PATCH 187/231] poetry2nix: drop unused pkgs.xlibsWrapper import

It's a cherry-pick of upstream
https://github.com/nix-community/poetry2nix/pull/897

Merging this earlier will allow removing `xlibsWrapper` entirely.
---
 .../tools/poetry2nix/poetry2nix/overrides/default.nix            | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
index 9979153842b1..36a66d091aeb 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
@@ -1669,7 +1669,6 @@ lib.composeManyExtensions [
 
             propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
               pkgs.cairo
-              pkgs.xlibsWrapper
             ];
 
             mesonFlags = [ "-Dpython=${if self.isPy3k then "python3" else "python"}" ];

From 3eec3c8fed0251563841e26e044600139c2f92eb Mon Sep 17 00:00:00 2001
From: Atemu <atemu.main@gmail.com>
Date: Mon, 12 Dec 2022 17:59:18 +0100
Subject: [PATCH 188/231] buildRustPackage: remove git from nativeBuildInputs

Having git in nativeBuildInputs causes thousands of rebuilds when git is touched
because every derivation that somehow transiently depends on a rust package will
change. See https://github.com/NixOS/nixpkgs/pull/205682 for instance.

AFAICT git is unused. Only the fetcher needs git which it has already.

Fixes https://github.com/NixOS/nixpkgs/issues/205804
---
 pkgs/build-support/rust/build-rust-package/default.nix | 2 --
 pkgs/development/compilers/rust/make-rust-platform.nix | 1 -
 2 files changed, 3 deletions(-)

diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index e7eab34e45d9..a24425bf27aa 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -5,7 +5,6 @@
 , stdenv
 , callPackage
 , cacert
-, git
 , cargoBuildHook
 , cargoCheckHook
 , cargoInstallHook
@@ -125,7 +124,6 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoUpdateHook" "carg
     })
   ] ++ [
     cacert
-    git
     cargoBuildHook
     (if useNextest then cargoNextestHook else cargoCheckHook)
     cargoInstallHook
diff --git a/pkgs/development/compilers/rust/make-rust-platform.nix b/pkgs/development/compilers/rust/make-rust-platform.nix
index 7e98684ecff1..fcfd02dcf6cd 100644
--- a/pkgs/development/compilers/rust/make-rust-platform.nix
+++ b/pkgs/development/compilers/rust/make-rust-platform.nix
@@ -13,7 +13,6 @@ rec {
   };
 
   buildRustPackage = callPackage ../../../build-support/rust/build-rust-package {
-    git = buildPackages.gitMinimal;
     inherit stdenv cargoBuildHook cargoCheckHook cargoInstallHook cargoNextestHook cargoSetupHook
       fetchCargoTarball importCargoLock rustc;
   };

From c88535bc54bd665d82172a581286f4ccc429becb Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 27 Dec 2022 17:04:20 +0300
Subject: [PATCH 189/231] pipewire: backport a few fixes

---
 pkgs/development/libraries/pipewire/default.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 8f0852b06a12..62b6536c047d 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -102,6 +102,19 @@ let
       ./0090-pipewire-config-template-paths.patch
       # Place SPA data files in lib output to avoid dependency cycles
       ./0095-spa-data-dir.patch
+
+      # FIXME: backports, remove after 0.3.64
+      # fix bluetooth issues
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/c7b3ef0d9ff16a1e69a299870860bebcb628e298.patch";
+        hash = "sha256-hiZ6VUhMu8NgwX5DZ/JRVl/g1Go0nZQSjQVrmqIzXoY=";
+      })
+
+      # fix routes getting lost
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/89ac6b353521fb9a6d6eb6bb74724c4fa968f75c.patch";
+        hash = "sha256-vzHiKWGmyuUF2iDS/ZQws+bCXVYYEl048JaMckY/fGI=";
+      })
     ];
 
     nativeBuildInputs = [

From b21655f6617e1c6eea3fa6b38ab1ec5934f9fb70 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 28 Dec 2022 04:15:03 +0000
Subject: [PATCH 190/231] ell: 0.54 -> 0.55

---
 pkgs/os-specific/linux/ell/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index 1e188fbe6074..3306d875272f 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.54";
+  version = "0.55";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    sha256 = "sha256-Oi+S4DWXuTUL36Xh3iWIZj9rdN2qUDHmZiFSH1csW+8=";
+    sha256 = "sha256-vMWs+0iaszq+p55Z9AhqkNHWeOwlgt2iq7uuA8xGjJ4=";
   };
 
   nativeBuildInputs = [

From 3fba3bf53f2412cc5e324c3ad19215c058de5617 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 23 Dec 2022 22:17:07 +0000
Subject: [PATCH 191/231] gawk: 5.1.1 -> 5.2.1

Had to pull in yet unreleased patch to avoid persistent memory alocator
on darwin as the hack in release relies on x86_64 emulation for aarch64
ports.

changelogs:
- 5.2.1: https://lists.gnu.org/archive/html/info-gnu/2022-11/msg00008.html
- 5.2.0: https://lists.gnu.org/archive/html/info-gnu/2022-09/msg00003.html
---
 pkgs/tools/text/gawk/darwin-no-pma.patch | 31 ++++++++++++++++++++++++
 pkgs/tools/text/gawk/default.nix         | 15 +++++++++---
 2 files changed, 43 insertions(+), 3 deletions(-)
 create mode 100644 pkgs/tools/text/gawk/darwin-no-pma.patch

diff --git a/pkgs/tools/text/gawk/darwin-no-pma.patch b/pkgs/tools/text/gawk/darwin-no-pma.patch
new file mode 100644
index 000000000000..f198acd41af1
--- /dev/null
+++ b/pkgs/tools/text/gawk/darwin-no-pma.patch
@@ -0,0 +1,31 @@
+https://git.savannah.gnu.org/cgit/gawk.git/patch/?id=e0b7737930f8a677d3c509f8ce72b9130965ec0a
+--- a/m4/pma.m4
++++ b/m4/pma.m4
+@@ -23,15 +23,18 @@ then
+ 				[LDFLAGS="${LDFLAGS} -no-pie"
+ 				export LDFLAGS])
+ 			;;
+-		*darwin*)
+-			# 23 October 2022: See README_d/README.macosx for
+-			# the details on what's happening here. See also
+-			# the manual.
+-
+-			# Compile as Intel binary all the time, even on M1.
+-			CFLAGS="${CFLAGS} -arch x86_64"
+-			LDFLAGS="${LDFLAGS} -Xlinker -no_pie"
+-			export CFLAGS LDFLAGS
++ 		*darwin*)
++			# 27 November 2022: PMA only works on Intel.
++			case $host in
++			x86_64-*)
++				LDFLAGS="${LDFLAGS} -Xlinker -no_pie"
++				export LDFLAGS
++				;;
++			*)
++				# disable on all other macOS systems
++				use_persistent_malloc=no
++				;;
++			esac
+ 			;;
+ 		*cygwin* | *CYGWIN* | *solaris2.11* | freebsd13.* | openbsd7.* )
+ 			true	# nothing do, exes on these systems are not PIE
diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index 3f91a301fd1b..f07da96aa48b 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -2,6 +2,7 @@
 # TODO: links -lsigsegv but loses the reference for some reason
 , withSigsegv ? (false && stdenv.hostPlatform.system != "x86_64-cygwin"), libsigsegv
 , interactive ? false, readline
+, autoreconfHook # no-pma fix
 
 /* Test suite broke on:
        stdenv.isCygwin # XXX: `test-dup2' segfaults on Cygwin 6.1
@@ -17,18 +18,26 @@ assert (doCheck && stdenv.isLinux) -> glibcLocales != null;
 
 stdenv.mkDerivation rec {
   pname = "gawk" + lib.optionalString interactive "-interactive";
-  version = "5.1.1";
+  version = "5.2.1";
 
   src = fetchurl {
     url = "mirror://gnu/gawk/gawk-${version}.tar.xz";
-    sha256 = "18kybw47fb1sdagav7aj95r9pp09r5gm202y3ahvwjw9dqw2jxnq";
+    hash = "sha256-ZzVTuR+eGMxXku1RB1341RDJBA9VCm904Jya3SQ6fk8=";
   };
 
+  patches = [
+    # Pull upstream fix for aarch64-darwin where pma does not work.
+    # Can be removed after next gawk release.
+    ./darwin-no-pma.patch
+  ];
+
   # When we do build separate interactive version, it makes sense to always include man.
   outputs = [ "out" "info" ]
     ++ lib.optional (!interactive) "man";
 
-  nativeBuildInputs = lib.optional (doCheck && stdenv.isLinux) glibcLocales;
+  nativeBuildInputs = lib.optional (doCheck && stdenv.isLinux) glibcLocales
+    # no-pma fix
+    ++ [ autoreconfHook ];
 
   buildInputs = lib.optional withSigsegv libsigsegv
     ++ lib.optional interactive readline

From 3c478e4b5db3bb02d981980e00b6470f6addea6f Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 27 Dec 2022 09:20:42 +0000
Subject: [PATCH 192/231] xlibsWrapper: remove deprecated and now unused
 wrapper package

There should be no reason to use this package as it's a remnant of
non-modular X. Chances are you do not want every single library it
used to pull in:

      freetype fontconfig xorg.xorgproto xorg.libX11 xorg.libXt
      xorg.libXft xorg.libXext xorg.libSM xorg.libICE

Just pick the ones you really need instead.

`nixpkgs` does not have any users of `xlibsWrapper`.

Closes: https://github.com/NixOS/nixpkgs/issues/194054
---
 .../from_md/release-notes/rl-2305.section.xml |  8 +++++++
 .../manual/release-notes/rl-2305.section.md   |  2 ++
 .../libraries/xlibs-wrapper/default.nix       | 21 -------------------
 pkgs/top-level/aliases.nix                    |  1 +
 pkgs/top-level/all-packages.nix               |  8 -------
 5 files changed, 11 insertions(+), 29 deletions(-)
 delete mode 100644 pkgs/development/libraries/xlibs-wrapper/default.nix

diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
index cceac682c3a0..4be8ef71367b 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@@ -242,6 +242,14 @@
           that it configures the NixOS boot process, not the Nix daemon.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          Deprecated <literal>xlibsWrapper</literal> transitional
+          package has been removed in favour of direct use of its
+          constitutents: <literal>xorg.libX11</literal>,
+          <literal>freetype</literal> and others.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-23.05-notable-changes">
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 89dc182361d5..d8a827c397c8 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -63,6 +63,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The `nix.readOnlyStore` option has been renamed to `boot.readOnlyNixStore` to clarify that it configures the NixOS boot process, not the Nix daemon.
 
+- Deprecated `xlibsWrapper` transitional package has been removed in favour of direct use of its constitutents: `xorg.libX11`, `freetype` and others.
+
 ## Other Notable Changes {#sec-release-23.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/pkgs/development/libraries/xlibs-wrapper/default.nix b/pkgs/development/libraries/xlibs-wrapper/default.nix
deleted file mode 100644
index 5340306de79a..000000000000
--- a/pkgs/development/libraries/xlibs-wrapper/default.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{lib, stdenv, packages}:
-
-stdenv.mkDerivation {
-  name = "xlibs-wrapper";
-
-  dontBuild = true;
-
-  installPhase = "mkdir -p $out";
-  unpackPhase = "sourceRoot=.";
-
-  propagatedBuildInputs = packages;
-
-  preferLocalBuild = true;
-
-  # For compatability with XFree86.
-  passthru.buildClientLibs = true;
-
-  meta = {
-    platforms = lib.platforms.unix;
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 61448e77e798..6755dfac6700 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1627,6 +1627,7 @@ mapAliases ({
   xfceUnstable = throw "xfceUnstable has been removed, use xfce instead"; # added 2022-12-25
   xineLib = xine-lib; # Added 2021-04-27
   xineUI = xine-ui; # Added 2021-04-27
+  xlibsWrapper = throw "'xlibsWrapper' has been replaced by its constituents"; # Converted to throw 2022-12-27
   xmonad_log_applet_gnome3 = throw "'xmonad_log_applet_gnome3' has been renamed to/replaced by 'xmonad_log_applet'"; # Converted to throw 2022-02-22
   xmpp-client = throw "xmpp-client has been dropped due to the lack of maintanence from upstream since 2017"; # Added 2022-06-02
   xmpppy = throw "xmpppy has been removed from nixpkgs as it is unmaintained and python2-only";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1b2e4a5a2457..d100ac3ec34e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -23434,14 +23434,6 @@ with pkgs;
 
   xgeometry-select = callPackage ../tools/X11/xgeometry-select { };
 
-  # Avoid using this. It isn't really a wrapper anymore, but we keep the name.
-  xlibsWrapper = callPackage ../development/libraries/xlibs-wrapper {
-    packages = [
-      freetype fontconfig xorg.xorgproto xorg.libX11 xorg.libXt
-      xorg.libXft xorg.libXext xorg.libSM xorg.libICE
-    ];
-  };
-
   xmlada = callPackage ../development/libraries/ada/xmlada { };
 
   xmlrpc_c = callPackage ../development/libraries/xmlrpc-c { };

From 97b4a0e4a7cc205615d05a8e17f47e40c4cbcf23 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 28 Dec 2022 09:51:24 +0000
Subject: [PATCH 193/231] ansible-language-server: restore lost updater and
 prepactk handling on merge

---
 .../tools/language-servers/ansible-language-server/default.nix  | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/tools/language-servers/ansible-language-server/default.nix b/pkgs/development/tools/language-servers/ansible-language-server/default.nix
index 4b9fb6e6c05e..f9946ed45963 100644
--- a/pkgs/development/tools/language-servers/ansible-language-server/default.nix
+++ b/pkgs/development/tools/language-servers/ansible-language-server/default.nix
@@ -27,9 +27,11 @@ buildNpmPackage rec {
   # wiping out node_modules, which causes a mysterious error stating that tsc isn't installed.
   postPatch = ''
     sed -i '/"prepare"/d' package.json
+    sed -i '/"prepack"/d' package.json
   '';
 
   npmPackFlags = [ "--ignore-scripts" ];
+  passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
     changelog = "https://github.com/ansible/ansible-language-server/releases/tag/v${version}";

From 781c993a8ae7a813e88e1ff5a510d9fd2716d8ff Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Fri, 9 Dec 2022 23:38:51 +0100
Subject: [PATCH 194/231] python310Packages.boto3: 1.24.75 -> 1.26.38

---
 .../python-modules/boto3/default.nix          | 57 +++++++++++--------
 1 file changed, 32 insertions(+), 25 deletions(-)

diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
index 698f252909ef..b9aafb7621c2 100644
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@@ -1,50 +1,57 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , botocore
 , jmespath
 , s3transfer
-, futures ? null
-, docutils
-, nose
-, mock
-, isPy3k
+, setuptools
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "boto3";
-  version = "1.24.75"; # N.B: if you change this, change botocore and awscli to a matching version
+  version = "1.26.38"; # N.B: if you change this, change botocore and awscli to a matching version
+  format = "pyproject";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-e/oiQt+bH6c+F/TX959rIlYPVdXaLifleOWF725LFKc=";
+  src = fetchFromGitHub {
+    owner = "boto";
+    repo = pname;
+    rev = version;
+    hash = "sha256-/QkR6gL0XkXofnFDcKa7J0ZbZbgT0IKnqtq2wcilbEs=";
   };
 
-  propagatedBuildInputs = [ botocore jmespath s3transfer ] ++ lib.optionals (!isPy3k) [ futures ];
-  checkInputs = [ docutils nose mock ];
+  propagatedBuildInputs = [
+    botocore
+    jmespath
+    s3transfer
+    setuptools
+  ];
 
-  checkPhase = ''
-    runHook preCheck
-    # This method is not in mock. It might have appeared in some versions.
-    sed -i 's/action.assert_called_once()/self.assertEqual(action.call_count, 1)/' \
-      tests/unit/resources/test_factory.py
-    nosetests -d tests/unit --verbose
-    runHook postCheck
-  '';
+  doCheck = true;
 
-  # Network access
-  doCheck = false;
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-  pythonImportsCheck = [ "boto3" ];
+  pythonImportsCheck = [
+    "boto3"
+  ];
 
-  meta = {
+  disabledTestPaths = [
+    # Integration tests require networking
+    "tests/integration"
+  ];
+
+  meta = with lib; {
     homepage = "https://github.com/boto/boto3";
-    license = lib.licenses.asl20;
+    changelog = "https://github.com/boto/boto3/blob/${version}/CHANGELOG.rst";
+    license = licenses.asl20;
     description = "AWS SDK for Python";
     longDescription = ''
       Boto3 is the Amazon Web Services (AWS) Software Development Kit (SDK) for
       Python, which allows Python developers to write software that makes use of
       services like Amazon S3 and Amazon EC2.
     '';
+    maintainers = with maintainers; [ anthonyroussel ];
   };
 }

From 9a0aed0dc19b8fc31dd00183216c2fc29830c013 Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Fri, 9 Dec 2022 23:39:14 +0100
Subject: [PATCH 195/231] python310Packages.botocore: 1.27.75 -> 1.29.38

---
 .../python-modules/botocore/default.nix       | 34 ++++++++++++-------
 .../tools/virtualization/awsebcli/default.nix |  2 +-
 2 files changed, 22 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index c6905d2de667..1d101b368f93 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -4,43 +4,51 @@
 , python-dateutil
 , jmespath
 , docutils
-, simplejson
-, mock
-, nose
 , urllib3
+, pytestCheckHook
+, jsonschema
 }:
 
 buildPythonPackage rec {
   pname = "botocore";
-  version = "1.27.75"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.29.38"; # N.B: if you change this, change boto3 and awscli to a matching version
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-+LHaK0HojFjbUdsMbv9spWQliUjOSlrH6WrDWkabDU8=";
+    hash = "sha256-K5jH2oZozcAitNila1BoZFTQoQwRUYcC/eQYgdIGGLY=";
   };
 
   propagatedBuildInputs = [
     python-dateutil
     jmespath
     docutils
-    simplejson
     urllib3
   ];
 
-  checkInputs = [ mock nose ];
+  checkInputs = [
+    pytestCheckHook
+    jsonschema
+  ];
 
-  checkPhase = ''
-    nosetests -v
-  '';
+  doCheck = true;
 
-  # Network access
-  doCheck = false;
+  disabledTestPaths = [
+    # Integration tests require networking
+    "tests/integration"
 
-  pythonImportsCheck = [ "botocore" ];
+    # Disable slow tests (only run unit tests)
+    "tests/functional"
+  ];
+
+  pythonImportsCheck = [
+    "botocore"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/boto/botocore";
+    changelog = "https://github.com/boto/botocore/blob/${version}/CHANGELOG.rst";
     license = licenses.asl20;
     description = "A low-level interface to a growing number of Amazon Web Services";
+    maintainers = with maintainers; [ anthonyroussel ];
   };
 }
diff --git a/pkgs/tools/virtualization/awsebcli/default.nix b/pkgs/tools/virtualization/awsebcli/default.nix
index e9c4a6e40ebb..df6e76d63b8b 100644
--- a/pkgs/tools/virtualization/awsebcli/default.nix
+++ b/pkgs/tools/virtualization/awsebcli/default.nix
@@ -49,7 +49,7 @@ with localPython.pkgs; buildPythonApplication rec {
     substituteInPlace setup.py \
       --replace "six>=1.11.0,<1.15.0" "six==1.16.0" \
       --replace "requests>=2.20.1,<=2.26" "requests==2.28.1" \
-      --replace "botocore>1.23.41,<1.24.0" "botocore>1.23.41,<1.27.76" \
+      --replace "botocore>1.23.41,<1.24.0" "botocore>1.23.41,<2" \
       --replace "pathspec==0.9.0" "pathspec>=0.10.0,<0.11.0" \
       --replace "colorama>=0.2.5,<0.4.4" "colorama>=0.2.5,<=0.4.6" \
       --replace "termcolor == 1.1.0" "termcolor>=2.0.0,<2.1.0"

From 4e2ee61dfd04d98be1a9cae62391cc80ace112c5 Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Fri, 9 Dec 2022 23:39:27 +0100
Subject: [PATCH 196/231] awscli: 1.25.76 -> 1.27.38

---
 pkgs/tools/admin/awscli/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index 34fd3e45906f..3438580c7f22 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -28,11 +28,11 @@ let
 in
 with py.pkgs; buildPythonApplication rec {
   pname = "awscli";
-  version = "1.25.76"; # N.B: if you change this, change botocore and boto3 to a matching version too
+  version = "1.27.38"; # N.B: if you change this, change botocore and boto3 to a matching version too
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-PSr0zZEGXFxcFSN7QQ5Ux0Z4aCwwm9na+2hIv/gR6+s=";
+    hash = "sha256-SjeFBWwfd+9sXcZL9NdqFyuBIQtql3KB3lnygeVVHU0=";
   };
 
   # https://github.com/aws/aws-cli/issues/4837
@@ -82,6 +82,7 @@ with py.pkgs; buildPythonApplication rec {
 
   meta = with lib; {
     homepage = "https://aws.amazon.com/cli/";
+    changelog = "https://github.com/aws/aws-cli/blob/${version}/CHANGELOG.rst";
     description = "Unified tool to manage your AWS services";
     license = licenses.asl20;
     mainProgram = "aws";

From b1d1ff029af05d15838b273c299d5231c7b42095 Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Sun, 11 Dec 2022 20:25:23 +0100
Subject: [PATCH 197/231] python310Packages.moto: 4.0.3 -> 4.0.12

---
 pkgs/development/python-modules/moto/default.nix | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/moto/default.nix b/pkgs/development/python-modules/moto/default.nix
index ad8b8c13a692..6de072579772 100644
--- a/pkgs/development/python-modules/moto/default.nix
+++ b/pkgs/development/python-modules/moto/default.nix
@@ -20,7 +20,6 @@
 , openapi-spec-validator
 , python-dateutil
 , python-jose
-, pytz
 , pyyaml
 , requests
 , responses
@@ -37,21 +36,16 @@
 
 buildPythonPackage rec {
   pname = "moto";
-  version = "4.0.3";
+  version = "4.0.12";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-iutWdX5oavPkpj+Qr7yXPLIxrarYfFzonmiTbBCbC+k=";
+    hash = "sha256-MPjzFljxjNsV62JsjLOgdSDw2MIZMib7yzMmrhL7okY=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "werkzeug>=0.5,<2.2.0" "werkzeug>=0.5"
-  '';
-
   propagatedBuildInputs = [
     aws-xray-sdk
     boto3
@@ -68,7 +62,6 @@ buildPythonPackage rec {
     openapi-spec-validator
     python-dateutil
     python-jose
-    pytz
     pyyaml
     requests
     responses
@@ -139,6 +132,8 @@ buildPythonPackage rec {
     "tests/test_awslambda/test_lambda_eventsourcemapping.py"
     "tests/test_awslambda/test_lambda_invoke.py"
     "tests/test_batch/test_batch_jobs.py"
+    "tests/test_kinesis/test_kinesis.py"
+    "tests/test_kinesis/test_kinesis_stream_consumers.py"
   ];
 
   disabledTests = [

From 021eed6b752f466e7931fc1e63071a7a0ebe85d5 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Wed, 28 Dec 2022 21:33:16 +0200
Subject: [PATCH 198/231] opencv: 4.6.0 -> 4.7.0

https://github.com/opencv/opencv/releases/tag/4.7.0
---
 pkgs/development/libraries/opencv/4.x.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 664f39c0c6cd..55889ccab07b 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -76,20 +76,20 @@
 }:
 
 let
-  version = "4.6.0";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "opencv";
     repo = "opencv";
     rev = version;
-    sha256 = "sha256-zPkMc6xEDZU5TlBH3LAzvB17XgocSPeHVMG/U6kfpxg=";
+    sha256 = "sha256-jUeGsu8+jzzCnIFbVMCW8DcUeGv/t1yCY/WXyW+uGDI=";
   };
 
   contribSrc = fetchFromGitHub {
     owner = "opencv";
     repo = "opencv_contrib";
     rev = version;
-    sha256 = "sha256-hjRqT7V4Sz7t4IEy89F5M+b0x2ObBbqF8GWLKhWFXtE=";
+    sha256 = "sha256-meya0J3RdOIeMM46e/6IOVwrKn3t/c0rhwP2WQaybkE=";
   };
 
   # Contrib must be built in order to enable Tesseract support:

From 50adabdd60d590c951824974356a9ccb9bb73ffc Mon Sep 17 00:00:00 2001
From: Markus Napierkowski <markus.napierkowski@cyberus-technology.de>
Date: Wed, 21 Dec 2022 10:31:59 +0100
Subject: [PATCH 199/231] readline: 8.1 -> 8.2

---
 .../libraries/readline/{8.1.nix => 8.2.nix}         | 12 ++++++------
 .../libraries/readline/no-arch_only-8.2.patch       | 13 +++++++++++++
 .../libraries/readline/readline-8.1-patches.nix     |  6 ------
 .../libraries/readline/readline-8.2-patches.nix     |  5 +++++
 pkgs/top-level/all-packages.nix                     | 12 ++++--------
 5 files changed, 28 insertions(+), 20 deletions(-)
 rename pkgs/development/libraries/readline/{8.1.nix => 8.2.nix} (85%)
 create mode 100644 pkgs/development/libraries/readline/no-arch_only-8.2.patch
 delete mode 100644 pkgs/development/libraries/readline/readline-8.1-patches.nix
 create mode 100644 pkgs/development/libraries/readline/readline-8.2-patches.nix

diff --git a/pkgs/development/libraries/readline/8.1.nix b/pkgs/development/libraries/readline/8.2.nix
similarity index 85%
rename from pkgs/development/libraries/readline/8.1.nix
rename to pkgs/development/libraries/readline/8.2.nix
index 35835c1a1436..0fedcdc9397f 100644
--- a/pkgs/development/libraries/readline/8.1.nix
+++ b/pkgs/development/libraries/readline/8.2.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "readline";
-  version = "8.1p${toString (builtins.length upstreamPatches)}";
+  version = "8.2p${toString (builtins.length upstreamPatches)}";
 
   src = fetchurl {
     url = "mirror://gnu/readline/readline-${meta.branch}.tar.gz";
-    sha256 = "00ibp0n9crbwx15k9vvckq5wsipw98b1px8pd8i34chy2gpb9kpq";
+    sha256 = "sha256-P+txcfFqhO6CyhijbXub4QmlLAT0kqBTMx19EJUAfDU=";
   };
 
   outputs = [ "out" "dev" "man" "doc" "info" ];
@@ -20,15 +20,15 @@ stdenv.mkDerivation rec {
     (let
        patch = nr: sha256:
          fetchurl {
-           url = "mirror://gnu/readline/readline-${meta.branch}-patches/readline81-${nr}";
+           url = "mirror://gnu/readline/readline-${meta.branch}-patches/readline82-${nr}";
            inherit sha256;
          };
      in
-       import ./readline-8.1-patches.nix patch);
+       import ./readline-8.2-patches.nix patch);
 
   patches =
     [ ./link-against-ncurses.patch
-      ./no-arch_only-6.3.patch
+      ./no-arch_only-8.2.patch
     ]
     ++ upstreamPatches;
 
@@ -57,6 +57,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ dtzWill ];
 
     platforms = platforms.unix;
-    branch = "8.1";
+    branch = "8.2";
   };
 }
diff --git a/pkgs/development/libraries/readline/no-arch_only-8.2.patch b/pkgs/development/libraries/readline/no-arch_only-8.2.patch
new file mode 100644
index 000000000000..06f01ec0891f
--- /dev/null
+++ b/pkgs/development/libraries/readline/no-arch_only-8.2.patch
@@ -0,0 +1,13 @@
+diff -ru -x '*~' readline-6.3-orig/support/shobj-conf readline-6.3/support/shobj-conf
+--- support/shobj-conf	2014-02-24 03:06:29.000000000 +0100
++++ support/shobj-conf	2014-07-22 11:18:52.000000000 +0200
+@@ -159,9 +159,6 @@
+ 	# Darwin 8 == Mac OS X 10.4; Mac OS X 10.N == Darwin N+4
+ 	*)
+ 		case "${host_os}" in
+-		darwin[89]*|darwin1[012]*)
+-			SHOBJ_ARCHFLAGS=
+-			;;
+ 		 *) 	# Mac OS X 10.9 (Mavericks) and later
+ 			SHOBJ_ARCHFLAGS=
+ 			# for 32 and 64bit universal library
diff --git a/pkgs/development/libraries/readline/readline-8.1-patches.nix b/pkgs/development/libraries/readline/readline-8.1-patches.nix
deleted file mode 100644
index b2aaadf0e9b5..000000000000
--- a/pkgs/development/libraries/readline/readline-8.1-patches.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-# Automatically generated by `update-patch-set.sh'; do not edit.
-
-patch: [
-(patch "001" "0i4ikdqgcjnb40y2ss3lm09rq56zih5rzma3bib50dk3d1d4cak8")
-(patch "002" "1p15sfx5xg5k4lam12lyd0givk7dfjddqpnb1jdp3c4clray0nz5")
-]
diff --git a/pkgs/development/libraries/readline/readline-8.2-patches.nix b/pkgs/development/libraries/readline/readline-8.2-patches.nix
new file mode 100644
index 000000000000..48d2bd14badb
--- /dev/null
+++ b/pkgs/development/libraries/readline/readline-8.2-patches.nix
@@ -0,0 +1,5 @@
+# Automatically generated by `update-patch-set.sh'; do not edit.
+
+patch: [
+(patch "001" "1xxgfgr6hn3ads8m8xsrdi1kbx1f3s69k0danpd9x4haqhg7zydv")
+]
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e54165e6954a..2c4807866049 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1915,9 +1915,7 @@ with pkgs;
 
   thicket = callPackage ../applications/version-management/thicket { };
 
-  tig = callPackage ../applications/version-management/tig {
-    readline = readline81;
-  };
+  tig = callPackage ../applications/version-management/tig { };
 
   top-git = callPackage ../applications/version-management/topgit { };
 
@@ -22536,14 +22534,14 @@ with pkgs;
 
   raylib = callPackage ../development/libraries/raylib { };
 
-  readline = readline81;
+  readline = readline82;
   readline6 = readline63;
 
   readline63 = callPackage ../development/libraries/readline/6.3.nix { };
 
   readline70 = callPackage ../development/libraries/readline/7.0.nix { };
 
-  readline81 = callPackage ../development/libraries/readline/8.1.nix { };
+  readline82 = callPackage ../development/libraries/readline/8.2.nix { };
 
   readosm = callPackage ../development/libraries/readosm { };
 
@@ -25337,9 +25335,7 @@ with pkgs;
 
   drbd = callPackage ../os-specific/linux/drbd { };
 
-  dropwatch = callPackage ../os-specific/linux/dropwatch {
-    readline = readline81;
-  };
+  dropwatch = callPackage ../os-specific/linux/dropwatch { };
 
   dsd = callPackage ../applications/radio/dsd { };
 

From aae36e6869162e97b6ff02b6bdfdeb23e55f3c5d Mon Sep 17 00:00:00 2001
From: Markus Napierkowski <markus.napierkowski@cyberus-technology.de>
Date: Tue, 20 Dec 2022 17:29:59 +0100
Subject: [PATCH 200/231] bash: 5.1 -> 5.2

---
 pkgs/shells/bash/{5.1.nix => 5.nix}   | 21 +++++++++++----------
 pkgs/shells/bash/bash-5.1-patches.nix | 20 --------------------
 pkgs/shells/bash/bash-5.2-patches.nix | 19 +++++++++++++++++++
 pkgs/shells/bash/pgrp-pipe-5.1.patch  | 16 ----------------
 pkgs/shells/bash/pgrp-pipe-5.patch    | 15 +++++++++++++++
 pkgs/top-level/all-packages.nix       |  6 +++---
 6 files changed, 48 insertions(+), 49 deletions(-)
 rename pkgs/shells/bash/{5.1.nix => 5.nix} (85%)
 delete mode 100644 pkgs/shells/bash/bash-5.1-patches.nix
 create mode 100644 pkgs/shells/bash/bash-5.2-patches.nix
 delete mode 100644 pkgs/shells/bash/pgrp-pipe-5.1.patch
 create mode 100644 pkgs/shells/bash/pgrp-pipe-5.patch

diff --git a/pkgs/shells/bash/5.1.nix b/pkgs/shells/bash/5.nix
similarity index 85%
rename from pkgs/shells/bash/5.1.nix
rename to pkgs/shells/bash/5.nix
index 458210873a68..6e16c083bc7c 100644
--- a/pkgs/shells/bash/5.1.nix
+++ b/pkgs/shells/bash/5.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , buildPackages
 , fetchurl
 , binutils
@@ -14,25 +15,25 @@
 }:
 
 let
-  upstreamPatches = import ./bash-5.1-patches.nix (nr: sha256: fetchurl {
-    url = "mirror://gnu/bash/bash-5.1-patches/bash51-${nr}";
+  upstreamPatches = import ./bash-5.2-patches.nix (nr: sha256: fetchurl {
+    url = "mirror://gnu/bash/bash-5.2-patches/bash52-${nr}";
     inherit sha256;
   });
 in
 stdenv.mkDerivation rec {
   name = "bash-${lib.optionalString interactive "interactive-"}${version}-p${toString (builtins.length upstreamPatches)}";
-  version = "5.1";
+  version = "5.2";
 
   src = fetchurl {
     url = "mirror://gnu/bash/bash-${version}.tar.gz";
-    sha256 = "1alv68wplnfdm6mh39hm57060xgssb9vqca4yr1cyva0c342n0fc";
+    sha256 = "sha256-oTnBZt9/9EccXgczBRZC7lVWwcyKSnjxRVg8XIGrMvs=";
   };
 
   hardeningDisable = [ "format" ]
-  # bionic libc is super weird and has issues with fortify outside of its own libc, check this comment:
-  # https://github.com/NixOS/nixpkgs/pull/192630#discussion_r978985593
-  # or you can check libc/include/sys/cdefs.h in bionic source code
-  ++ lib.optional (stdenv.hostPlatform.libc == "bionic") "fortify";
+    # bionic libc is super weird and has issues with fortify outside of its own libc, check this comment:
+    # https://github.com/NixOS/nixpkgs/pull/192630#discussion_r978985593
+    # or you can check libc/include/sys/cdefs.h in bionic source code
+    ++ lib.optional (stdenv.hostPlatform.libc == "bionic") "fortify";
 
   outputs = [ "out" "dev" "man" "doc" "info" ];
 
@@ -50,7 +51,7 @@ stdenv.mkDerivation rec {
   patchFlags = [ "-p0" ];
 
   patches = upstreamPatches
-    ++ [ ./pgrp-pipe-5.1.patch ];
+    ++ [ ./pgrp-pipe-5.patch ];
 
   configureFlags = [
     (if interactive then "--with-installed-readline" else "--disable-readline")
diff --git a/pkgs/shells/bash/bash-5.1-patches.nix b/pkgs/shells/bash/bash-5.1-patches.nix
deleted file mode 100644
index 41eb92710588..000000000000
--- a/pkgs/shells/bash/bash-5.1-patches.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-# Automatically generated by `update-patch-set.sh'; do not edit.
-
-patch: [
-(patch "001" "1ymm8ppss6gyh9ifznjwiabrb4k91npd09c10y7mk66xp8yppc7b")
-(patch "002" "1gjx9zqcm407am3n2sh44b8dxm48kgm15rzfiijqxr01m0hn3shm")
-(patch "003" "1cdnpbfc64yhvkjj4d12s9ywp11g195vzfl1cab24sq55wkcrwi2")
-(patch "004" "11iwhy6v562bv0kk7lwj7f5jj65ma9bblivy0v02h3ggcibbdbls")
-(patch "005" "19bdyigdr81824nxvqr6a7k0cax60wq7376j6b91afbnwvlvbjyc")
-(patch "006" "051x8wlwrqk0yr0zg378vh824iklfl5g9pkmcdf62qp8gn9pvqbm")
-(patch "007" "0fir80pp1gmlpadmqcgkrv4y119pc7xllchjzg05fd7px73viz5c")
-(patch "008" "1lfjgshk8i9vch92p5wgc9r90j3phw79aa7gbai89w183b2z6b7j")
-(patch "009" "1vn36dzd9g4y1h3jiss6418crla0rbcd0d6wwsyv9d5l7aaxlp74")
-(patch "010" "0amfmvbzsand7bdypylkjdpcp88fa3cplfshn7vyzv2ff2rdgj52")
-(patch "011" "0yq24abb4fzfxqnwl20b330sxl9lr9ds0nc4yi30f81l94b1y6aq")
-(patch "012" "165bff97ffih49vfs4mkr5w3z5gn1w6zfyrf773iajkw6v48kw8h")
-(patch "013" "1bfmgv3lagbk3aq9a831d29xv7jz4sjq7jhn9hq89limyinvdb67")
-(patch "014" "1l43dw4kpddn7l41i8wmj406z9abxky1wb3rk8krcys33g4f0kka")
-(patch "015" "1w40vzadzx019v0zhs4q6yqycrk04x1k8xs6qb73vk7ny4p6jdqv")
-(patch "016" "0krqqljz4bkp9wrdnwfx51bxkb8rkwf8ivc93as1znx5fr7i96c8")
-]
diff --git a/pkgs/shells/bash/bash-5.2-patches.nix b/pkgs/shells/bash/bash-5.2-patches.nix
new file mode 100644
index 000000000000..e118f03e0300
--- /dev/null
+++ b/pkgs/shells/bash/bash-5.2-patches.nix
@@ -0,0 +1,19 @@
+# Automatically generated by `update-patch-set.sh'; do not edit.
+
+patch: [
+(patch "001" "02iibpd3jq8p1bhdzgik8ps6gi1145vr463a82gj1hivjbp2ybzl")
+(patch "002" "1f6p1z85qh1lavdp3xikgp0bfv0vqhvgpgwmdzlywl35hwdmxk25")
+(patch "003" "1zxsi869jd90hksx3nyypgyqwrxhw2ws3r6hmk76yc1lsgdhq2ba")
+(patch "004" "04i5liw5cg6dqkdxfgazqc2jrw40bmclx3dx45bwy259pcj7g0iq")
+(patch "005" "0mykflv9qnbx3jz71l4f7isadiw9knm4qimqkwsv9cv88dafpq7c")
+(patch "006" "13265akl8w6zyrg0l7f0x6arjgqjhllcwl6lk46rl53x4mm5dq6i")
+(patch "007" "146lrwkn5wgxzs6vx34wl47g69zsxdy032k40qzi626b47ya6015")
+(patch "008" "1s5i8hcayrv25lc8fxcr431v634yx5sii53b8fmip789s0pxjjvb")
+(patch "009" "1kfk25151ka9wkmk1myf12irgcmvhsd8b0nfifvhrszah9w82npr")
+(patch "010" "1kf1jrwm30js0v3d1r2rk4x09s1pyjp70wnd1qqhf9bmkw15ww67")
+(patch "011" "1x5nkvbj6hci7gx42q7qa72hg2a9wwxh85dk79gn521ypwjmy6w3")
+(patch "012" "0b6lcwzm7v5bzjiwaz2c8n5aj77w8ckhp2vwk4v3zsdq3z70gc9g")
+(patch "013" "1rkwpibd6j2ghppfhqsva2jm4kdni6b7jpdsxdps52643gc4yjq9")
+(patch "014" "09766vqqw4ffnmysm725v35qkhp1g9j4qgqag941xvq655pj9y9y")
+(patch "015" "12im449abnq5gaqjmdxr5i38kmp02fa8l8wffad3jryvd58r0wzg")
+]
diff --git a/pkgs/shells/bash/pgrp-pipe-5.1.patch b/pkgs/shells/bash/pgrp-pipe-5.1.patch
deleted file mode 100644
index 478327cafc45..000000000000
--- a/pkgs/shells/bash/pgrp-pipe-5.1.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff -u ./configure ../bash-5.0-fixed/configure
---- ./configure	2019-01-02 15:43:31.000000000 +0100
-+++ ../bash-5.0-fixed/configure	2020-01-08 14:18:21.017296179 +0100
-@@ -16312,11 +16312,7 @@
- solaris2*)	LOCAL_CFLAGS=-DSOLARIS ;;
- lynxos*)	LOCAL_CFLAGS=-DRECYCLES_PIDS ;;
- linux*)		LOCAL_LDFLAGS=-rdynamic		 # allow dynamic loading
--		case "`uname -r`" in
--		1.*|2.[0123]*)	: ;;
--		*)	$as_echo "#define PGRP_PIPE 1" >>confdefs.h
-- ;;
--		esac ;;
-+		$as_echo "#define PGRP_PIPE 1" >>confdefs.h ;;
- netbsd*|openbsd*)	LOCAL_CFLAGS="-DDEV_FD_STAT_BROKEN" ;;
- *qnx[67]*)	LOCAL_LIBS="-lncurses" ;;
- *qnx*)		LOCAL_CFLAGS="-Dqnx -F -3s" LOCAL_LDFLAGS="-3s" LOCAL_LIBS="-lunix -lncurses" ;;
diff --git a/pkgs/shells/bash/pgrp-pipe-5.patch b/pkgs/shells/bash/pgrp-pipe-5.patch
new file mode 100644
index 000000000000..71b397901cb0
--- /dev/null
+++ b/pkgs/shells/bash/pgrp-pipe-5.patch
@@ -0,0 +1,15 @@
+--- ./configure	2022-12-20 17:13:17.804045620 +0100
++++ ./configure-fixed	2022-12-20 17:16:00.444114824 +0100
+@@ -21723,11 +21723,7 @@
+ solaris2*)	LOCAL_CFLAGS=-DSOLARIS ;;
+ lynxos*)	LOCAL_CFLAGS=-DRECYCLES_PIDS ;;
+ linux*)		LOCAL_LDFLAGS=-rdynamic		 # allow dynamic loading
+-		case "`uname -r`" in
+-		1.*|2.[0123]*)	: ;;
+-		*)	printf "%s\n" "#define PGRP_PIPE 1" >>confdefs.h
+- ;;
+-		esac ;;
++		printf "%s\n" "#define PGRP_PIPE 1" >>confdefs.h ;;
+ netbsd*|openbsd*)	LOCAL_CFLAGS="-DDEV_FD_STAT_BROKEN" ;;
+ freebsd*|midnightbsd*)	LOCAL_CFLAGS='-DHEREDOC_PIPESIZE=4096' ;;
+ *qnx[67]*)	LOCAL_LIBS="-lncurses" ;;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2c4807866049..899560269b96 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13558,16 +13558,16 @@ with pkgs;
 
   any-nix-shell = callPackage ../shells/any-nix-shell { };
 
-  bash = lowPrio (callPackage ../shells/bash/5.1.nix {
+  bash = lowPrio (callPackage ../shells/bash/5.nix {
     binutils = stdenv.cc.bintools;
   });
   # WARNING: this attribute is used by nix-shell so it shouldn't be removed/renamed
-  bashInteractive = callPackage ../shells/bash/5.1.nix {
+  bashInteractive = callPackage ../shells/bash/5.nix {
     binutils = stdenv.cc.bintools;
     interactive = true;
     withDocs = true;
   };
-  bashInteractiveFHS = callPackage ../shells/bash/5.1.nix {
+  bashInteractiveFHS = callPackage ../shells/bash/5.nix {
     binutils = stdenv.cc.bintools;
     interactive = true;
     withDocs = true;

From e9f67d5ae55e2107ef0ece3a537b29375a1e9b00 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Wed, 28 Dec 2022 22:26:07 +0200
Subject: [PATCH 201/231] gst_all_1.gst-plugins-bad: bump opencv version range

---
 pkgs/development/libraries/gstreamer/bad/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index e9f324b24533..1d2ae340a806 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -323,6 +323,11 @@ stdenv.mkDerivation rec {
   postPatch = ''
     patchShebangs \
       scripts/extract-release-date-from-doap-file.py
+
+    # upstream bumps this version check one minor version at a time
+    # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/blob/main/subprojects/gst-plugins-bad/ext/opencv/meson.build#L74
+    substituteInPlace ext/opencv/meson.build \
+      --replace '< 4.7.0' '< 5.0.0'
   '';
 
   # This package has some `_("string literal")` string formats

From e30a8ca06cadad2e5aaa9ce25dbf10c2fac55c4c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 28 Dec 2022 22:08:05 +0100
Subject: [PATCH 202/231] python3Packages.sqlalchemy: 1.4.41 -> 1.4.45

https://github.com/sqlalchemy/sqlalchemy/releases/tag/rel_1_4_42
https://github.com/sqlalchemy/sqlalchemy/releases/tag/rel_1_4_43
https://github.com/sqlalchemy/sqlalchemy/releases/tag/rel_1_4_44
https://github.com/sqlalchemy/sqlalchemy/releases/tag/rel_1_4_45
---
 pkgs/development/python-modules/sqlalchemy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 7c842352eb02..989d0380f7a4 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -39,12 +39,12 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "1.4.41"; # TODO: check python3Packages.fastapi when updating to >= 1.4.42
+  version = "1.4.45"; # TODO: check python3Packages.fastapi when updating to >= 1.4.42
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ApL3DReX48VOhi5vMK5HQBRki8nHI+FKL9pzCtsKl5E=";
+    hash = "sha256-/WmFCGAJOj9p/v4KtW0EHt/f4YUQtT2aLq7LovFfp5U=";
   };
 
   nativeBuildInputs = lib.optionals (!isPyPy) [

From c1bd736beed16f5bc7e0827d4d40ea255d15b973 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 28 Dec 2022 22:09:20 +0100
Subject: [PATCH 203/231] python3Packages.databases: 0.6.2 -> 0.7.0

Diff: https://github.com/encode/databases/compare/refs/tags/0.6.2...0.7.0

Changelog: https://github.com/encode/databases/releases/tag/0.7.0
---
 pkgs/development/python-modules/databases/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/databases/default.nix b/pkgs/development/python-modules/databases/default.nix
index f5edffd3e442..78311fb6e30f 100644
--- a/pkgs/development/python-modules/databases/default.nix
+++ b/pkgs/development/python-modules/databases/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "databases";
-  version = "0.6.2";
+  version = "0.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "encode";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-3zgHfYGiO2xWualLa4h8A85qjC32ILadw/47Ul1GTmM=";
+    hash = "sha256-3RRHXkM8/GoIcO6Y1EZGbnp/X5gzYkW/PV4bzGay6ZI=";
   };
 
   propagatedBuildInputs = [

From 0201a0546956c4d55600ddd70481af6f85c4ce4b Mon Sep 17 00:00:00 2001
From: Maxine Aubrey <maxeaubrey@gmail.com>
Date: Thu, 29 Dec 2022 00:16:01 +0100
Subject: [PATCH 204/231] iwd: 2.0 -> 2.1

---
 pkgs/os-specific/linux/iwd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index b3895c286c56..54a9a53a0367 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -12,12 +12,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "2.0";
+  version = "2.1";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    sha256 = "sha256-9eQ2fW3ha69ngugYonbYdqrpERqt8aM0Ed4HM0CrmUU=";
+    sha256 = "sha256-Aq038SG8vuxCA6mYOP5I6VWCUty5vgdbpAa9J+bIfZM=";
   };
 
   outputs = [ "out" "man" "doc" ]

From fa3feb9f655e7f417bdd2fc83f5bf43085a64597 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 29 May 2022 03:35:59 +0000
Subject: [PATCH 205/231] python3Packages.pythonImportsCheck: set $PYTHONPATH

Don't rely on the installPhase doing so.
---
 pkgs/development/interpreters/python/hooks/default.nix          | 2 +-
 .../interpreters/python/hooks/python-imports-check-hook.sh      | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index d30876aa9fde..08dc3ea61ab7 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -93,7 +93,7 @@ in {
     makePythonHook {
       name = "python-imports-check-hook.sh";
       substitutions = {
-        inherit pythonCheckInterpreter;
+        inherit pythonCheckInterpreter pythonSitePackages;
       };
     } ./python-imports-check-hook.sh) {};
 
diff --git a/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh b/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
index f8ca84cd573a..7172ac498545 100644
--- a/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
@@ -6,6 +6,7 @@ pythonImportsCheckPhase () {
 
     if [ -n "$pythonImportsCheck" ]; then
         echo "Check whether the following modules can be imported: $pythonImportsCheck"
+        export PYTHONPATH="$out/@pythonSitePackages@:$PYTHONPATH"
         ( cd $out && eval "@pythonCheckInterpreter@ -c 'import os; import importlib; list(map(lambda mod: importlib.import_module(mod), os.environ[\"pythonImportsCheck\"].split()))'" )
     fi
 }

From 72c7d7c27ea766ebe2ba6447ea9686c73169b6b8 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 29 Dec 2022 15:26:58 +0200
Subject: [PATCH 206/231] opencv4: add reverse deps to tests

---
 pkgs/development/libraries/opencv/4.x.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 55889ccab07b..2c676e008f00 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -14,6 +14,7 @@
 , config
 , ocl-icd
 , buildPackages
+, qimgv
 
 , enableJPEG ? true
 , libjpeg
@@ -365,7 +366,12 @@ stdenv.mkDerivation {
     popd
   '';
 
-  passthru = lib.optionalAttrs enablePython { pythonPath = [ ]; };
+  passthru = {
+    tests = {
+      inherit qimgv;
+      inherit (gst_all_1) gst-plugins-bad;
+    } // lib.optionalAttrs (!enablePython) { pythonEnabled = pythonPackages.opencv4; };
+  } // lib.optionalAttrs enablePython { pythonPath = [ ]; };
 
   meta = with lib; {
     description = "Open Computer Vision Library with more than 500 algorithms";

From c2eda91e012577ef86faa358ad0940111357c1a0 Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Thu, 29 Dec 2022 23:48:40 +0100
Subject: [PATCH 207/231] libpng: 1.6.37 -> 1.6.39

---
 pkgs/development/libraries/libpng/default.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/libpng/default.nix b/pkgs/development/libraries/libpng/default.nix
index 2293dfc00a0c..b757d20b71d5 100644
--- a/pkgs/development/libraries/libpng/default.nix
+++ b/pkgs/development/libraries/libpng/default.nix
@@ -3,20 +3,20 @@
 assert zlib != null;
 
 let
-  patchVersion = "1.6.37";
+  patchVersion = "1.6.39";
   patch_src = fetchurl {
     url = "mirror://sourceforge/libpng-apng/libpng-${patchVersion}-apng.patch.gz";
-    sha256 = "1dh0250mw9b2hx7cdmnb2blk7ddl49n6vx8zz7jdmiwxy38v4fw2";
+    hash = "sha256-SsS26roAzeISxI22XLlCkQc/68oixcef2ocJFQLoDP0=";
   };
   whenPatched = lib.optionalString apngSupport;
 
 in stdenv.mkDerivation rec {
   pname = "libpng" + whenPatched "-apng";
-  version = "1.6.37";
+  version = "1.6.39";
 
   src = fetchurl {
     url = "mirror://sourceforge/libpng/libpng-${version}.tar.xz";
-    sha256 = "1jl8in381z0128vgxnvn33nln6hzckl7l7j9nqvkaf1m9n1p0pjh";
+    hash = "sha256-H0aWznC07l+F8eFiPcEimyEAKfpLeu5XPfPiunsDaTc=";
   };
   postPatch = whenPatched "gunzip < ${patch_src} | patch -Np1";
 
@@ -32,8 +32,9 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     description = "The official reference implementation for the PNG file format" + whenPatched " with animation patch";
     homepage = "http://www.libpng.org/pub/png/libpng.html";
+    changelog = "https://github.com/glennrp/libpng/blob/v1.6.39/CHANGES";
     license = licenses.libpng2;
     platforms = platforms.all;
-    maintainers = [ maintainers.vcunat ];
+    maintainers = with maintainers; [ vcunat ];
   };
 }

From 3f5d99e914f7878c124aa97bf2fe6bda27fbe802 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 30 Dec 2022 00:49:33 +0000
Subject: [PATCH 208/231] gdb: backport readline-8.2 fix

Without the change gdb fails build on `readline-8.2` as:

    ../../gdb/completer.c: In function 'char* gdb_completion_word_break_characters_throw()':
    ../../gdb/completer.c:2014:10: error: invalid conversion from 'const char*' to 'char*' [-fpermissive]
     2014 |   return rl_completer_word_break_characters;
          |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
          |          |
          |          const char*
---
 pkgs/development/tools/misc/gdb/default.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index 4486636a9f50..53b02cc16ea8 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, targetPackages
 
 # Build time
-, fetchurl, pkg-config, perl, texinfo, setupDebugInfoDirs, buildPackages
+, fetchurl, fetchpatch, pkg-config, perl, texinfo, setupDebugInfoDirs, buildPackages
 
 # Run time
 , ncurses, readline, gmp, mpfr, expat, libipt, zlib, dejagnu, sourceHighlight
@@ -47,6 +47,12 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./debug-info-from-env.patch
+    # backport readline=8.2 support
+    (fetchpatch {
+      name = "readline-8.2.patch";
+      url = "https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=1add37b567a7dee39d99f37b37802034c3fce9c4";
+      hash = "sha256-KmQXylPAWNGXF8wtXCCArhUzHi+GUY8ii2Xpx8R08jE=";
+    })
   ] ++ lib.optionals stdenv.isDarwin [
     ./darwin-target-match.patch
   # Does not nave to be conditional. We apply it conditionally

From 90af686ddb32dd565244ef53ce3a8d5e5cbae1be Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Fri, 30 Dec 2022 06:40:28 +0100
Subject: [PATCH 209/231] xorgcffiles: add aarch64-darwin support

---
 pkgs/servers/x11/xorg/overrides.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index ddd5acad7a1a..b6ad8670ec6c 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -1067,6 +1067,13 @@ self: super:
   });
 
   xorgcffiles = super.xorgcffiles.overrideAttrs (attrs: {
+    patches = [
+      (fetchpatch {
+        name = "add-aarch64-darwin-support.patch";
+        url = "https://gitlab.freedesktop.org/xorg/util/cf/-/commit/8d88c559b177e832b581c8ac0aa383b6cf79e0d0.patch";
+        sha256 = "sha256-wCijdmlUtVgOh9Rp/LJrg1ObYm4OPTke5Xwu0xC0ap4=";
+      })
+    ];
     postInstall = lib.optionalString stdenv.isDarwin ''
       substituteInPlace $out/lib/X11/config/darwin.cf --replace "/usr/bin/" ""
     '';

From 34878aa66d8346b5e84c6904a0445d44bb75ea79 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 22 Dec 2022 20:54:55 +0100
Subject: [PATCH 210/231] oneko: unbreak on aarch64-darwin

---
 pkgs/applications/misc/oneko/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/applications/misc/oneko/default.nix b/pkgs/applications/misc/oneko/default.nix
index e0af54b1e4e6..17a94511e3fc 100644
--- a/pkgs/applications/misc/oneko/default.nix
+++ b/pkgs/applications/misc/oneko/default.nix
@@ -35,7 +35,5 @@ stdenv.mkDerivation rec {
     license = with licenses; [ publicDomain ];
     maintainers = with maintainers; [ xaverdh irenes ];
     platforms = platforms.unix;
-    # never built on aarch64-darwin since first introduction in nixpkgs
-    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }

From e70ea256f42f71f9ca7e5376024e80eb469ad6c3 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 22 Dec 2022 20:55:01 +0100
Subject: [PATCH 211/231] xearth: unbreak on aarch64-darwin

---
 pkgs/applications/science/astronomy/xearth/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/applications/science/astronomy/xearth/default.nix b/pkgs/applications/science/astronomy/xearth/default.nix
index abcedf7ee7b9..bd92ae01ebb1 100644
--- a/pkgs/applications/science/astronomy/xearth/default.nix
+++ b/pkgs/applications/science/astronomy/xearth/default.nix
@@ -26,8 +26,6 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.mafo ];
     license = "xearth";
     platforms=platforms.unix;
-    # never built on aarch64-darwin since first introduction in nixpkgs
-    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 
 }

From 42e4d047d12f09bb6249b0385825a7e91f6b08ec Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 22 Dec 2022 20:55:07 +0100
Subject: [PATCH 212/231] xskat: unbreak on aarch64-darwin

---
 pkgs/games/xskat/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/games/xskat/default.nix b/pkgs/games/xskat/default.nix
index f8c5f539f7d2..74c2be586ceb 100644
--- a/pkgs/games/xskat/default.nix
+++ b/pkgs/games/xskat/default.nix
@@ -26,7 +26,5 @@ stdenv.mkDerivation rec {
     license = licenses.free;
     longDescription = "Play the german card game Skat against the AI or over IRC.";
     homepage = "http://www.xskat.de/";
-    # never built on aarch64-darwin since first introduction in nixpkgs
-    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }

From bdaff9db296aac8dc70448b921873ce2f2bf82e4 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 22 Dec 2022 20:55:14 +0100
Subject: [PATCH 213/231] xsok: unbreak on aarch64-darwin

---
 pkgs/games/xsok/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/games/xsok/default.nix b/pkgs/games/xsok/default.nix
index 80de216e8639..bb749b57d01e 100644
--- a/pkgs/games/xsok/default.nix
+++ b/pkgs/games/xsok/default.nix
@@ -42,7 +42,5 @@ stdenv.mkDerivation rec {
     maintainers = [lib.maintainers.raskin];
     platforms = lib.platforms.unix;
     homepage = "https://tracker.debian.org/pkg/xsok";
-    # never built on aarch64-darwin since first introduction in nixpkgs
-    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }

From 064207b723a0f0e2ccb2fb89a4326e672133905f Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 22 Dec 2022 20:55:29 +0100
Subject: [PATCH 214/231] x11_ssh_askpass: unbreak on aarch64-darwin

---
 pkgs/tools/networking/x11-ssh-askpass/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/tools/networking/x11-ssh-askpass/default.nix b/pkgs/tools/networking/x11-ssh-askpass/default.nix
index 2dc17936abc1..049154d64413 100644
--- a/pkgs/tools/networking/x11-ssh-askpass/default.nix
+++ b/pkgs/tools/networking/x11-ssh-askpass/default.nix
@@ -30,7 +30,5 @@ stdenv.mkDerivation rec {
     description = "Lightweight passphrase dialog for OpenSSH or other open variants of SSH";
     license = licenses.mit;
     platforms = platforms.unix;
-    # never built on aarch64-darwin since first introduction in nixpkgs
-    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }

From c730732bdafbfc931bfbf6a8cf4cdd5ea9d8dd45 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 29 Dec 2022 08:52:16 +1000
Subject: [PATCH 215/231] sqlite: 3.40.0 -> 3.40.1

https://www.sqlite.org/releaselog/3_40_1.html
---
 .../3.39.4-autoconf-CVE-2022-46908.patch      | 25 -------------------
 pkgs/development/libraries/sqlite/default.nix |  8 ++----
 pkgs/development/libraries/sqlite/tools.nix   |  4 +--
 3 files changed, 4 insertions(+), 33 deletions(-)
 delete mode 100644 pkgs/development/libraries/sqlite/3.39.4-autoconf-CVE-2022-46908.patch

diff --git a/pkgs/development/libraries/sqlite/3.39.4-autoconf-CVE-2022-46908.patch b/pkgs/development/libraries/sqlite/3.39.4-autoconf-CVE-2022-46908.patch
deleted file mode 100644
index 27ab2af2014a..000000000000
--- a/pkgs/development/libraries/sqlite/3.39.4-autoconf-CVE-2022-46908.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-adapted for preprocessed source files from upstream
-https://sqlite.org/src/vpatch?from=a60e56627fc0ef88&to=cefc032473ac5ad2
-
-diff --git a/shell.c b/shell.c
-index e66ae08..d423278 100644
---- a/shell.c
-+++ b/shell.c
-@@ -12921,7 +12921,7 @@ static int safeModeAuth(
-     "zipfile",
-     "zipfile_cds",
-   };
--  UNUSED_PARAMETER(zA2);
-+  UNUSED_PARAMETER(zA1);
-   UNUSED_PARAMETER(zA3);
-   UNUSED_PARAMETER(zA4);
-   switch( op ){
-@@ -12936,7 +12936,7 @@ static int safeModeAuth(
-     case SQLITE_FUNCTION: {
-       int i;
-       for(i=0; i<ArraySize(azProhibitedFunctions); i++){
--        if( sqlite3_stricmp(zA1, azProhibitedFunctions[i])==0 ){
-+        if( sqlite3_stricmp(zA2, azProhibitedFunctions[i])==0 ){
-           failIfSafeMode(p, "cannot use the %s() function in safe mode",
-                          azProhibitedFunctions[i]);
-         }
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 3f4081acc044..eb27c8c8b9eb 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -17,19 +17,15 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${optionalString interactive "-interactive"}";
-  version = "3.40.0";
+  version = "3.40.1";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2022/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "sha256-AzNVIHbScAx1NSJW6Rx4v1zWJJFYm6DGmu0KgYaJgOc=";
+    sha256 = "sha256-LF3qIH+lCNdlrx72ILY33LBlcq+m8B8IFb1bv4ZLM9k=";
   };
 
-  patches = [
-    ./3.39.4-autoconf-CVE-2022-46908.patch
-  ];
-
   outputs = [ "bin" "dev" "out" ];
   separateDebugInfo = stdenv.isLinux;
 
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 1b7fca210faf..bb0a1a7d7393 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -4,12 +4,12 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.40.0";
+    version = "3.40.1";
 
     # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2022/sqlite-src-${archiveVersion version}.zip";
-      sha256 = "sha256-SFUIKBQgUSk+F5/8aoUg9vv9guHNyni5N5L3ZsyJuOI=";
+      sha256 = "sha256-UGQSaqUNsgw1V4thK1bDEpQlwFBu1NFhDvpKDwG9+NA=";
     };
 
     nativeBuildInputs = [ unzip ];

From 05c8b62e27509f4808036ac8552e83869affc0de Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 31 Dec 2022 12:14:27 +0000
Subject: [PATCH 216/231] orc: 0.4.32 -> 0.4.33

---
 pkgs/development/compilers/orc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/orc/default.nix b/pkgs/development/compilers/orc/default.nix
index 5ea72781e41f..a752c994bbf5 100644
--- a/pkgs/development/compilers/orc/default.nix
+++ b/pkgs/development/compilers/orc/default.nix
@@ -5,11 +5,11 @@
   inherit (lib) optional optionals;
 in stdenv.mkDerivation rec {
   pname = "orc";
-  version = "0.4.32";
+  version = "0.4.33";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/orc/${pname}-${version}.tar.xz";
-    sha256 = "1w0qmyj3v9sb2g7ff39pp38b9850y9hyy0bag26ifrby5f7ksvm6";
+    sha256 = "sha256-hE5tfbgIb3k/V2GNPUto0p2ZsWA05xQw3zwhz9PDVCo=";
   };
 
   postPatch = lib.optionalString stdenv.isAarch32 ''

From 1e1b7c77654d7b907000b7bb73ad3e674aaa0539 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Sun, 1 Jan 2023 14:01:53 +0000
Subject: [PATCH 217/231] orc: add some key reverse-dependencies to
 passthru.tests

---
 pkgs/development/compilers/orc/default.nix | 23 ++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/orc/default.nix b/pkgs/development/compilers/orc/default.nix
index a752c994bbf5..771830d8b6ac 100644
--- a/pkgs/development/compilers/orc/default.nix
+++ b/pkgs/development/compilers/orc/default.nix
@@ -1,6 +1,19 @@
-{ lib, stdenv, fetchurl, meson, ninja
-, gtk-doc ? null, file, docbook_xsl
+{ lib
+, stdenv
+, fetchurl
+, meson
+, ninja
+, file
+, docbook_xsl
+, gtk-doc ? null
 , buildDevDoc ? gtk-doc != null
+
+# for passthru.tests
+, gnuradio
+, gst_all_1
+, qt6
+, vips
+
 }: let
   inherit (lib) optional optionals;
 in stdenv.mkDerivation rec {
@@ -35,6 +48,12 @@ in stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  passthru.tests = {
+    inherit (gst_all_1) gst-plugins-good gst-plugins-bad gst-plugins-ugly;
+    inherit gnuradio vips;
+    qt6-qtmultimedia = qt6.qtmultimedia;
+  };
+
   meta = with lib; {
     description = "The Oil Runtime Compiler";
     homepage = "https://gstreamer.freedesktop.org/projects/orc.html";

From 3cd6cd412043a513c04259d32468259332ff95d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sun, 1 Jan 2023 17:08:31 +0100
Subject: [PATCH 218/231] mesa: 22.3.1 -> 22.3.2

https://docs.mesa3d.org/relnotes/22.3.2.html
---
 pkgs/development/libraries/mesa/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index ab9153f8af15..ea290ed03317 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -41,7 +41,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "22.3.1";
+  version = "22.3.2";
   branch  = versions.major version;
 
   withLibdrm = lib.meta.availableOn stdenv.hostPlatform libdrm;
@@ -64,7 +64,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "sha256-PJzWEcCFnTB6ugZZgzOGq9ykyGFi08J1ulvmLRbPMes=";
+    sha256 = "c15df758a8795f53e57f2a228eb4593c22b16dffd9b38f83901f76cd9533140b";
   };
 
   # TODO:

From 624a0bc4cd19722f947a0ada959655fa0463ffaa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sun, 1 Jan 2023 22:40:07 +0100
Subject: [PATCH 219/231] python3Packages.psutil: disable a problematic test

Example: https://hydra.nixos.org/build/203686536
Also we encountered it on 22.11 recently: b12350f5007
---
 pkgs/development/python-modules/psutil/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index 01f48e627bd2..b0be35e0c7ba 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -52,6 +52,7 @@ buildPythonPackage rec {
     "disk_io_counters"
     "sensors_battery"
     "user"
+    "test_disk_partitions" # problematic on Hydra's Linux builders, apparently
   ];
 
   pythonImportsCheck = [

From 4d4af86db63955be68118f1507ce51e576b88016 Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Fri, 30 Dec 2022 22:12:44 +0100
Subject: [PATCH 220/231] libtiff: 4.4 -> 4.5

---
 .../development/libraries/libtiff/default.nix | 55 ++++++-------------
 .../libraries/libtiff/headers.patch           |  7 ++-
 .../libraries/libtiff/rename-version.patch    | 12 ++--
 3 files changed, 28 insertions(+), 46 deletions(-)

diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index ffed49235286..ac52349a3f13 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -1,9 +1,10 @@
 { lib, stdenv
-, fetchurl
-, fetchpatch
+, fetchFromGitLab
+, nix-update-script
 
 , autoreconfHook
 , pkg-config
+, sphinx
 
 , libdeflate
 , libjpeg
@@ -23,11 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libtiff";
-  version = "4.4.0";
+  version = "4.5.0";
 
-  src = fetchurl {
-    url = "https://download.osgeo.org/libtiff/tiff-${version}.tar.gz";
-    sha256 = "1vdbk3sc497c58kxmp02irl6nqkfm9rjs3br7g59m59qfnrj6wli";
+  src = fetchFromGitLab {
+    owner = "libtiff";
+    repo = "libtiff";
+    rev = "v${version}";
+    hash = "sha256-KG6rB940JMjFUTAgtkzg+Zh75gylPY6Q7/4gEbL0Hcs=";
   };
 
   patches = [
@@ -36,32 +39,6 @@ stdenv.mkDerivation rec {
     # libc++abi 11 has an `#include <version>`, this picks up files name
     # `version` in the project's include paths
     ./rename-version.patch
-    (fetchpatch {
-      name = "CVE-2022-34526.patch";
-      url = "https://gitlab.com/libtiff/libtiff/-/commit/275735d0354e39c0ac1dc3c0db2120d6f31d1990.patch";
-      sha256 = "sha256-faKsdJjvQwNdkAKjYm4vubvZvnULt9zz4l53zBFr67s=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2953.patch";
-      url = "https://gitlab.com/libtiff/libtiff/-/commit/48d6ece8389b01129e7d357f0985c8f938ce3da3.patch";
-      sha256 = "sha256-h9hulV+dnsUt/2Rsk4C1AKdULkvweM2ypIJXYQ3BqQU=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-3626.CVE-2022-3627.CVE-2022-3597.patch";
-      url = "https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c841047.patch";
-      excludes = [ "doc/tools/tiffcrop.rst" ];
-      sha256 = "sha256-L2EMmmfMM4oEYeLapO93wvNS+HlO0yXsKxijXH+Wuas=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-3598.CVE-2022-3570.patch";
-      url = "https://gitlab.com/libtiff/libtiff/-/commit/cfbb883bf6ea7bedcb04177cc4e52d304522fdff.patch";
-      sha256 = "sha256-SLq2+JaDEUOPZ5mY4GPB6uwhQOG5cD4qyL5o9i8CVVs=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-3970.patch";
-      url = "https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3be.patch";
-      sha256 = "sha256-pgItgS+UhMjoSjkDJH5y7iGFZ+yxWKqlL7BdT2mFcH0=";
-    })
   ];
 
   postPatch = ''
@@ -71,14 +48,15 @@ stdenv.mkDerivation rec {
   outputs = [ "bin" "dev" "dev_private" "out" "man" "doc" ];
 
   postFixup = ''
-    moveToOutput include/tif_dir.h $dev_private
     moveToOutput include/tif_config.h $dev_private
+    moveToOutput include/tif_dir.h $dev_private
+    moveToOutput include/tif_hash_set.h $dev_private
     moveToOutput include/tiffiop.h $dev_private
   '';
 
   # If you want to change to a different build system, please make
   # sure cross-compilation works first!
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  nativeBuildInputs = [ autoreconfHook pkg-config sphinx ];
 
   propagatedBuildInputs = [ libjpeg xz zlib ]; #TODO: opengl support (bogus configure detection)
 
@@ -88,9 +66,12 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  passthru.tests = {
-    inherit libgeotiff imagemagick graphicsmagick gdal openimageio freeimage imlib;
-    inherit (python3Packages) pillow imread;
+  passthru = {
+    tests = {
+      inherit libgeotiff imagemagick graphicsmagick gdal openimageio freeimage imlib;
+      inherit (python3Packages) pillow imread;
+    };
+    updateScript = nix-update-script { };
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libtiff/headers.patch b/pkgs/development/libraries/libtiff/headers.patch
index e1c681502b33..e0ef9f3478a6 100644
--- a/pkgs/development/libraries/libtiff/headers.patch
+++ b/pkgs/development/libraries/libtiff/headers.patch
@@ -2,15 +2,16 @@ diff --git i/libtiff/Makefile.am w/libtiff/Makefile.am
 index 44522b62..d66e5948 100644
 --- i/libtiff/Makefile.am
 +++ w/libtiff/Makefile.am
-@@ -36,8 +36,11 @@ EXTRA_DIST = \
+@@ -36,8 +36,12 @@ EXTRA_DIST = \
  	tiffconf.h.cmake.in
- 
+
  libtiffinclude_HEADERS = \
 +	tif_config.h \
 +	tif_dir.h \
++	tif_hash_set.h \
  	tiff.h \
  	tiffio.h \
 +	tiffiop.h \
  	tiffvers.h
- 
+
  if HAVE_CXX
diff --git a/pkgs/development/libraries/libtiff/rename-version.patch b/pkgs/development/libraries/libtiff/rename-version.patch
index 30601c0f04ee..ddd33ad49045 100644
--- a/pkgs/development/libraries/libtiff/rename-version.patch
+++ b/pkgs/development/libraries/libtiff/rename-version.patch
@@ -6,15 +6,15 @@
  	TODO \
 -	VERSION
 +	VERSION.txt
- 
+
  EXTRA_DIST = \
  	cmake \
-@@ -61,7 +61,7 @@ SUBDIRS = port libtiff tools build contrib test man html
- 
+@@ -61,7 +61,7 @@ SUBDIRS = port libtiff tools build contrib test doc
+
  release:
- 	(rm -f $(top_srcdir)/RELEASE-DATE && echo $(LIBTIFF_RELEASE_DATE) > $(top_srcdir)/RELEASE-DATE)
+	(rm -f $(top_srcdir)/RELEASE-DATE && echo $(LIBTIFF_RELEASE_DATE) > $(top_srcdir)/RELEASE-DATE)
 -	(rm -f $(top_srcdir)/VERSION && echo $(LIBTIFF_VERSION) > $(top_srcdir)/VERSION)
 +	(rm -f $(top_srcdir)/VERSION.txt && echo $(LIBTIFF_VERSION) > $(top_srcdir)/VERSION.txt)
- 	(rm -f $(top_srcdir)/libtiff/tiffvers.h && sed 's,LIBTIFF_VERSION,$(LIBTIFF_VERSION),;s,LIBTIFF_RELEASE_DATE,$(LIBTIFF_RELEASE_DATE),' $(top_srcdir)/libtiff/tiffvers.h.in > $(top_srcdir)/libtiff/tiffvers.h)
- 
+	(rm -f $(top_srcdir)/libtiff/tiffvers.h && sed 's,LIBTIFF_VERSION,$(LIBTIFF_VERSION),;s,LIBTIFF_RELEASE_DATE,$(LIBTIFF_RELEASE_DATE),;s,LIBTIFF_MAJOR_VERSION,$(LIBTIFF_MAJOR_VERSION),;s,LIBTIFF_MINOR_VERSION,$(LIBTIFF_MINOR_VERSION),;s,LIBTIFF_MICRO_VERSION,$(LIBTIFF_MICRO_VERSION),' $(top_srcdir)/libtiff/tiffvers.h.in > $(top_srcdir)/libtiff/tiffvers.h)
+
  pkgconfigdir = $(libdir)/pkgconfig

From e13ee020d26208f39d1eaead83c5de148e277c89 Mon Sep 17 00:00:00 2001
From: SnIcK <ido.samuelson@gmail.com>
Date: Thu, 29 Dec 2022 10:21:23 -0600
Subject: [PATCH 221/231] fxload: updated to newer version from libusb1

---
 pkgs/os-specific/linux/fxload/default.nix | 46 ++++++++++-------------
 1 file changed, 20 insertions(+), 26 deletions(-)

diff --git a/pkgs/os-specific/linux/fxload/default.nix b/pkgs/os-specific/linux/fxload/default.nix
index 8c1a778ec8bf..3c5443f3432f 100644
--- a/pkgs/os-specific/linux/fxload/default.nix
+++ b/pkgs/os-specific/linux/fxload/default.nix
@@ -1,37 +1,31 @@
-{lib, stdenv, fetchurl}:
+{ lib
+, stdenv
+, libusb1
+}:
 
 stdenv.mkDerivation rec {
   pname = "fxload";
-  version = "2002.04.11";
+  version = libusb1.version;
+  dontUnpack = true;
+  dontBuild = true;
+  dontConfigure = true;
+  dontInstall = true;
+  dontPatch = true;
+  dontPatchELF = true;
 
-  src = fetchurl {
-    url = "mirror://sourceforge/linux-hotplug/fxload-${lib.replaceStrings ["."] ["_"] version}.tar.gz";
-    sha256 = "1hql93bp3dxrv1p67nc63xsbqwljyynm997ysldrc3n9ifi6s48m";
-  };
-
-  patches = [
-    # Will be needed after linux-headers is updated to >= 2.6.21.
-    (fetchurl {
-      url = "http://sources.gentoo.org/viewcvs.py/*checkout*/gentoo-x86/sys-apps/fxload/files/fxload-20020411-linux-headers-2.6.21.patch?rev=1.1";
-      sha256 = "0ij0c8nr1rbyl5wmyv1cklhkxglvsqz32h21cjw4bjm151kgmk7p";
-    })
-  ];
-
-  preBuild = ''
-    substituteInPlace Makefile --replace /usr /
-    makeFlagsArray=(INSTALL=install prefix=$out)
-  '';
-
-  preInstall = ''
+  # fxload binary exist inside the `examples/bin` directory of `libusb1`
+  postFixup = ''
     mkdir -p $out/sbin
-    mkdir -p $out/share/man/man8
-    mkdir -p $out/share/usb
+    ln -s ${passthru.libusb}/examples/bin/fxload $out/sbin/fxload
   '';
 
+  passthru.libusb = libusb1.override { withExamples = true; };
+
   meta = with lib; {
-    homepage = "http://linux-hotplug.sourceforge.net/?selected=usb";
-    description = "Tool to upload firmware to Cypress EZ-USB microcontrollers";
-    license = licenses.gpl2;
+    homepage = "https://github.com/libusb/libusb";
+    description = "Tool to upload firmware to into an21, fx, fx2, fx2lp and fx3 ez-usb devices";
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
+    maintainers = with maintainers; [ realsnick ];
   };
 }

From 277a523ddaedd38e0017754b8425e12ebbabc409 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Tue, 3 Jan 2023 18:26:48 +0200
Subject: [PATCH 222/231] xorg: add wrapWithXFileSearchPathHook

supersedes PR 70239

Description from that PR

Make xorg apps look as intended. Most notable change: xmag color picker is usable now.

Before this commit, only two apps had properly configured resource paths: bitmap and xcalc. This commit automates and generalizes it to the rest of xorg.* apps.

xorg.bitmap: bin/bitmap-color is no longer installed. If you would like bitmap to be viewable in color, please refer to man 1 bitmap, selection COLORS. The described method is also applied to some other affected apps.
---
 pkgs/servers/x11/xorg/default.nix             | 64 +++++++++----------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  6 +-
 pkgs/servers/x11/xorg/overrides.nix           | 45 ++++++-------
 3 files changed, 56 insertions(+), 59 deletions(-)

diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 59d66abf994b..7cc5dfa6895d 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -38,7 +38,7 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  bitmap = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, xbitmaps, libXmu, xorgproto, libXt }: stdenv.mkDerivation {
+  bitmap = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, xbitmaps, libXmu, xorgproto, libXt, wrapWithXFileSearchPathHook }: stdenv.mkDerivation {
     pname = "bitmap";
     version = "1.0.9";
     builder = ./builder.sh;
@@ -48,13 +48,13 @@ self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
-    nativeBuildInputs = [ pkg-config ];
+    nativeBuildInputs = [ pkg-config wrapWithXFileSearchPathHook ];
     buildInputs = [ libX11 libXaw xbitmaps libXmu xorgproto libXt ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  editres = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, xorgproto, libXt }: stdenv.mkDerivation {
+  editres = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, xorgproto, libXt, wrapWithXFileSearchPathHook }: stdenv.mkDerivation {
     pname = "editres";
     version = "1.0.7";
     builder = ./builder.sh;
@@ -64,7 +64,7 @@ self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
-    nativeBuildInputs = [ pkg-config ];
+    nativeBuildInputs = [ pkg-config wrapWithXFileSearchPathHook ];
     buildInputs = [ libX11 libXaw libXmu xorgproto libXt ];
     meta.platforms = lib.platforms.unix;
   }) {};
@@ -1578,7 +1578,7 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  oclock = callPackage ({ stdenv, pkg-config, fetchurl, libxkbfile, libX11, libXext, libXmu, libXt }: stdenv.mkDerivation {
+  oclock = callPackage ({ stdenv, pkg-config, fetchurl, libxkbfile, libX11, libXext, libXmu, libXt, wrapWithXFileSearchPathHook }: stdenv.mkDerivation {
     pname = "oclock";
     version = "1.0.4";
     builder = ./builder.sh;
@@ -1588,7 +1588,7 @@ self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
-    nativeBuildInputs = [ pkg-config ];
+    nativeBuildInputs = [ pkg-config wrapWithXFileSearchPathHook ];
     buildInputs = [ libxkbfile libX11 libXext libXmu libXt ];
     meta.platforms = lib.platforms.unix;
   }) {};
@@ -1690,7 +1690,7 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  viewres = callPackage ({ stdenv, pkg-config, fetchurl, libXaw, libXmu, libXt }: stdenv.mkDerivation {
+  viewres = callPackage ({ stdenv, pkg-config, fetchurl, libXaw, libXmu, libXt, wrapWithXFileSearchPathHook }: stdenv.mkDerivation {
     pname = "viewres";
     version = "1.0.5";
     builder = ./builder.sh;
@@ -1700,7 +1700,7 @@ self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
-    nativeBuildInputs = [ pkg-config ];
+    nativeBuildInputs = [ pkg-config wrapWithXFileSearchPathHook ];
     buildInputs = [ libXaw libXmu libXt ];
     meta.platforms = lib.platforms.unix;
   }) {};
@@ -1770,7 +1770,7 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xcalc = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, xorgproto, libXt }: stdenv.mkDerivation {
+  xcalc = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, xorgproto, libXt, wrapWithXFileSearchPathHook }: stdenv.mkDerivation {
     pname = "xcalc";
     version = "1.1.0";
     builder = ./builder.sh;
@@ -1780,7 +1780,7 @@ self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
-    nativeBuildInputs = [ pkg-config ];
+    nativeBuildInputs = [ pkg-config wrapWithXFileSearchPathHook ];
     buildInputs = [ libX11 libXaw xorgproto libXt ];
     meta.platforms = lib.platforms.unix;
   }) {};
@@ -1914,7 +1914,7 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xclock = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXft, libxkbfile, libXmu, xorgproto, libXrender, libXt }: stdenv.mkDerivation {
+  xclock = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXft, libxkbfile, libXmu, xorgproto, libXrender, libXt, wrapWithXFileSearchPathHook }: stdenv.mkDerivation {
     pname = "xclock";
     version = "1.0.9";
     builder = ./builder.sh;
@@ -1924,7 +1924,7 @@ self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
-    nativeBuildInputs = [ pkg-config ];
+    nativeBuildInputs = [ pkg-config wrapWithXFileSearchPathHook ];
     buildInputs = [ libX11 libXaw libXft libxkbfile libXmu xorgproto libXrender libXt ];
     meta.platforms = lib.platforms.unix;
   }) {};
@@ -1962,7 +1962,7 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xconsole = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, xorgproto, libXt }: stdenv.mkDerivation {
+  xconsole = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, xorgproto, libXt, wrapWithXFileSearchPathHook }: stdenv.mkDerivation {
     pname = "xconsole";
     version = "1.0.7";
     builder = ./builder.sh;
@@ -1972,7 +1972,7 @@ self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
-    nativeBuildInputs = [ pkg-config ];
+    nativeBuildInputs = [ pkg-config wrapWithXFileSearchPathHook ];
     buildInputs = [ libX11 libXaw libXmu xorgproto libXt ];
     meta.platforms = lib.platforms.unix;
   }) {};
@@ -2010,7 +2010,7 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xdm = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXau, libXaw, libXdmcp, libXext, libXft, libXinerama, libXmu, libXpm, xorgproto, libXrender, libXt }: stdenv.mkDerivation {
+  xdm = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXau, libXaw, libXdmcp, libXext, libXft, libXinerama, libXmu, libXpm, xorgproto, libXrender, libXt, wrapWithXFileSearchPathHook }: stdenv.mkDerivation {
     pname = "xdm";
     version = "1.1.12";
     builder = ./builder.sh;
@@ -2020,7 +2020,7 @@ self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
-    nativeBuildInputs = [ pkg-config ];
+    nativeBuildInputs = [ pkg-config wrapWithXFileSearchPathHook ];
     buildInputs = [ libX11 libXau libXaw libXdmcp libXext libXft libXinerama libXmu libXpm xorgproto libXrender libXt ];
     meta.platforms = lib.platforms.unix;
   }) {};
@@ -2906,7 +2906,7 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xfd = callPackage ({ stdenv, pkg-config, fetchurl, libxkbfile, fontconfig, libXaw, libXft, libXmu, xorgproto, libXrender, libXt, gettext }: stdenv.mkDerivation {
+  xfd = callPackage ({ stdenv, pkg-config, fetchurl, libxkbfile, fontconfig, libXaw, libXft, libXmu, xorgproto, libXrender, libXt, gettext, wrapWithXFileSearchPathHook }: stdenv.mkDerivation {
     pname = "xfd";
     version = "1.1.3";
     builder = ./builder.sh;
@@ -2916,13 +2916,13 @@ self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
-    nativeBuildInputs = [ pkg-config gettext ];
+    nativeBuildInputs = [ pkg-config gettext wrapWithXFileSearchPathHook ];
     buildInputs = [ libxkbfile fontconfig libXaw libXft libXmu xorgproto libXrender libXt ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xfontsel = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, libXt }: stdenv.mkDerivation {
+  xfontsel = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, libXt, wrapWithXFileSearchPathHook }: stdenv.mkDerivation {
     pname = "xfontsel";
     version = "1.0.6";
     builder = ./builder.sh;
@@ -2932,7 +2932,7 @@ self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
-    nativeBuildInputs = [ pkg-config ];
+    nativeBuildInputs = [ pkg-config wrapWithXFileSearchPathHook ];
     buildInputs = [ libX11 libXaw libXmu libXt ];
     meta.platforms = lib.platforms.unix;
   }) {};
@@ -2986,7 +2986,7 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xgc = callPackage ({ stdenv, pkg-config, fetchurl, libXaw, libXt }: stdenv.mkDerivation {
+  xgc = callPackage ({ stdenv, pkg-config, fetchurl, libXaw, libXt, wrapWithXFileSearchPathHook }: stdenv.mkDerivation {
     pname = "xgc";
     version = "1.0.5";
     builder = ./builder.sh;
@@ -2996,7 +2996,7 @@ self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
-    nativeBuildInputs = [ pkg-config ];
+    nativeBuildInputs = [ pkg-config wrapWithXFileSearchPathHook ];
     buildInputs = [ libXaw libXt ];
     meta.platforms = lib.platforms.unix;
   }) {};
@@ -3146,7 +3146,7 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xload = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, xorgproto, libXt, gettext }: stdenv.mkDerivation {
+  xload = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, xorgproto, libXt, gettext, wrapWithXFileSearchPathHook }: stdenv.mkDerivation {
     pname = "xload";
     version = "1.1.3";
     builder = ./builder.sh;
@@ -3156,7 +3156,7 @@ self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
-    nativeBuildInputs = [ pkg-config gettext ];
+    nativeBuildInputs = [ pkg-config gettext wrapWithXFileSearchPathHook ];
     buildInputs = [ libX11 libXaw libXmu xorgproto libXt ];
     meta.platforms = lib.platforms.unix;
   }) {};
@@ -3210,7 +3210,7 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xmag = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, libXt }: stdenv.mkDerivation {
+  xmag = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, libXt, wrapWithXFileSearchPathHook }: stdenv.mkDerivation {
     pname = "xmag";
     version = "1.0.6";
     builder = ./builder.sh;
@@ -3220,13 +3220,13 @@ self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
-    nativeBuildInputs = [ pkg-config ];
+    nativeBuildInputs = [ pkg-config wrapWithXFileSearchPathHook ];
     buildInputs = [ libX11 libXaw libXmu libXt ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xmessage = callPackage ({ stdenv, pkg-config, fetchurl, libXaw, libXt }: stdenv.mkDerivation {
+  xmessage = callPackage ({ stdenv, pkg-config, fetchurl, libXaw, libXt, wrapWithXFileSearchPathHook }: stdenv.mkDerivation {
     pname = "xmessage";
     version = "1.0.5";
     builder = ./builder.sh;
@@ -3236,7 +3236,7 @@ self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
-    nativeBuildInputs = [ pkg-config ];
+    nativeBuildInputs = [ pkg-config wrapWithXFileSearchPathHook ];
     buildInputs = [ libXaw libXt ];
     meta.platforms = lib.platforms.unix;
   }) {};
@@ -3258,7 +3258,7 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xmore = callPackage ({ stdenv, pkg-config, fetchurl, libXaw, libXt }: stdenv.mkDerivation {
+  xmore = callPackage ({ stdenv, pkg-config, fetchurl, libXaw, libXt, wrapWithXFileSearchPathHook }: stdenv.mkDerivation {
     pname = "xmore";
     version = "1.0.3";
     builder = ./builder.sh;
@@ -3268,7 +3268,7 @@ self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
-    nativeBuildInputs = [ pkg-config ];
+    nativeBuildInputs = [ pkg-config wrapWithXFileSearchPathHook ];
     buildInputs = [ libXaw libXt ];
     meta.platforms = lib.platforms.unix;
   }) {};
@@ -3466,7 +3466,7 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xsm = callPackage ({ stdenv, pkg-config, fetchurl, libICE, libSM, libX11, libXaw, libXt }: stdenv.mkDerivation {
+  xsm = callPackage ({ stdenv, pkg-config, fetchurl, libICE, libSM, libX11, libXaw, libXt, wrapWithXFileSearchPathHook }: stdenv.mkDerivation {
     pname = "xsm";
     version = "1.0.4";
     builder = ./builder.sh;
@@ -3476,7 +3476,7 @@ self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
-    nativeBuildInputs = [ pkg-config ];
+    nativeBuildInputs = [ pkg-config wrapWithXFileSearchPathHook ];
     buildInputs = [ libICE libSM libX11 libXaw libXt ];
     meta.platforms = lib.platforms.unix;
   }) {};
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 987895ab6e1d..a3751bf16f00 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -23,7 +23,7 @@ my %pcMap;
 my %extraAttrs;
 
 
-my @missingPCs = ("fontconfig", "libdrm", "libXaw", "zlib", "perl", "python3", "mkfontscale", "bdftopcf", "libxslt", "openssl", "gperf", "m4", "libinput", "libevdev", "mtdev", "xorgproto", "cairo", "gettext", "meson", "ninja" );
+my @missingPCs = ("fontconfig", "libdrm", "libXaw", "zlib", "perl", "python3", "mkfontscale", "bdftopcf", "libxslt", "openssl", "gperf", "m4", "libinput", "libevdev", "mtdev", "xorgproto", "cairo", "gettext", "meson", "ninja", "wrapWithXFileSearchPathHook" );
 $pcMap{$_} = $_ foreach @missingPCs;
 $pcMap{"freetype2"} = "freetype";
 $pcMap{"libpng12"} = "libpng";
@@ -195,6 +195,10 @@ while (<>) {
         push @{$extraAttrs{$pkg}}, "postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`\$PKG_CONFIG' '';";
     }
 
+    if (@@ = glob("$tmpDir/*/app-defaults/")) {
+        push @nativeRequires, "wrapWithXFileSearchPathHook";
+    }
+
     sub process {
         my $requires = shift;
         my $s = shift;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 8b3129f5ae21..c86cbc137dd1 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -1,4 +1,5 @@
 { abiCompat ? null,
+  callPackage,
   lib, stdenv, makeWrapper, fetchurl, fetchpatch, fetchFromGitLab, buildPackages,
   automake, autoconf, gettext, libiconv, libtool, intltool,
   freetype, tradcpp, fontconfig, meson, ninja, ed, fontforge,
@@ -22,25 +23,28 @@ let
 in
 self: super:
 {
+  wrapWithXFileSearchPathHook = callPackage ({ makeBinaryWrapper, makeSetupHook, writeScript }: makeSetupHook {
+      name = "wrapWithXFileSearchPathHook";
+      deps = [ makeBinaryWrapper ];
+    } (writeScript "wrapWithXFileSearchPathHook.sh" ''
+      wrapWithXFileSearchPath() {
+        paths=(
+          "$out/share/X11/%T/%N"
+          "$out/include/X11/%T/%N"
+          "${xorg.xbitmaps}/include/X11/%T/%N"
+        )
+        for exe in $out/bin/*; do
+          wrapProgram "$exe" \
+            --suffix XFILESEARCHPATH : $(IFS=:; echo "''${paths[*]}")
+        done
+      }
+      postInstallHooks+=(wrapWithXFileSearchPath)
+  '')) {};
+
   bdftopcf = super.bdftopcf.overrideAttrs (attrs: {
     buildInputs = attrs.buildInputs ++ [ xorg.xorgproto ];
   });
 
-  bitmap = super.bitmap.overrideAttrs (attrs: {
-    nativeBuildInputs = attrs.nativeBuildInputs ++ [ makeWrapper ];
-    postInstall = ''
-      paths=(
-        "$out/share/X11/%T/%N"
-        "$out/include/X11/%T/%N"
-        "${xorg.xbitmaps}/include/X11/%T/%N"
-      )
-      wrapProgram "$out/bin/bitmap" \
-        --suffix XFILESEARCHPATH : $(IFS=:; echo "''${paths[*]}")
-      makeWrapper "$out/bin/bitmap" "$out/bin/bitmap-color" \
-        --suffix XFILESEARCHPATH : "$out/share/X11/%T/%N-color"
-    '';
-  });
-
   editres = super.editres.overrideAttrs (attrs: {
     hardeningDisable = [ "format" ];
   });
@@ -1091,17 +1095,6 @@ self: super:
     '';
   });
 
-  xcalc = super.xcalc.overrideAttrs (attrs: {
-    configureFlags = attrs.configureFlags or [] ++ [
-      "--with-appdefaultdir=${placeholder "out"}/share/X11/app-defaults"
-    ];
-    nativeBuildInputs = attrs.nativeBuildInputs or [] ++ [ makeWrapper ];
-    postInstall = ''
-      wrapProgram $out/bin/xcalc \
-        --set XAPPLRESDIR ${placeholder "out"}/share/X11/app-defaults
-    '';
-  });
-
   # convert Type1 vector fonts to OpenType fonts
   fontbitstreamtype1 = super.fontbitstreamtype1.overrideAttrs (attrs: {
     nativeBuildInputs = attrs.nativeBuildInputs ++ [ fontforge ];

From 659574008e1f07330b8f055927c2b538e2a9b383 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Tue, 3 Jan 2023 19:09:51 +0200
Subject: [PATCH 223/231] xorg.{libFS,libWindowsWM}: fix cross

---
 pkgs/servers/x11/xorg/overrides.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index c86cbc137dd1..6e9dd733e1b0 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -144,6 +144,14 @@ self: super:
     configureFlags = attrs.configureFlags or []
       ++ malloc0ReturnsNullCrossFlag;
   });
+  libFS = super.libFS.overrideAttrs (attrs: {
+    configureFlags = attrs.configureFlags or []
+      ++ malloc0ReturnsNullCrossFlag;
+  });
+  libWindowsWM = super.libWindowsWM.overrideAttrs (attrs: {
+    configureFlags = attrs.configureFlags or []
+      ++ malloc0ReturnsNullCrossFlag;
+  });
   xdpyinfo = super.xdpyinfo.overrideAttrs (attrs: {
     configureFlags = attrs.configureFlags or []
       ++ malloc0ReturnsNullCrossFlag;

From 68ed486d30487599d7ef85feec2c838036ce77cc Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Tue, 3 Jan 2023 19:31:00 +0200
Subject: [PATCH 224/231] xorg: remove unnecessary overrides

---
 pkgs/servers/x11/xorg/overrides.nix | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 6e9dd733e1b0..c8bd8f55428c 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -1,7 +1,7 @@
 { abiCompat ? null,
   callPackage,
   lib, stdenv, makeWrapper, fetchurl, fetchpatch, fetchFromGitLab, buildPackages,
-  automake, autoconf, gettext, libiconv, libtool, intltool,
+  automake, autoconf, libiconv, libtool, intltool,
   freetype, tradcpp, fontconfig, meson, ninja, ed, fontforge,
   libGL, spice-protocol, zlib, libGLU, dbus, libunwind, libdrm,
   mesa, udev, bootstrap_cmds, bison, flex, clangStdenv, autoreconfHook,
@@ -324,11 +324,6 @@ self: super:
   });
 
   libxshmfence = super.libxshmfence.overrideAttrs (attrs: {
-    name = "libxshmfence-1.3";
-    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libxshmfence-1.3.tar.bz2";
-      sha256 = "1ir0j92mnd1nk37mrv9bz5swnccqldicgszvfsh62jd14q6k115q";
-    };
     outputs = [ "out" "dev" ]; # mainly to avoid propagation
   });
 
@@ -717,10 +712,6 @@ self: super:
       postPatch   = with lib; concatStrings (mapAttrsToList patchIn layouts);
     });
 
-  xload = super.xload.overrideAttrs (attrs: {
-    nativeBuildInputs = attrs.nativeBuildInputs ++ [ gettext ];
-  });
-
   xlsfonts = super.xlsfonts.overrideAttrs (attrs: {
     meta = attrs.meta // { license = lib.licenses.mit; };
   });
@@ -1035,7 +1026,7 @@ self: super:
       rev = "31486f40f8e8f8923ca0799aea84b58799754564";
       sha256 = "sha256-nqT9VZDb2kAC72ot9UCdwEkM1uuP9NriJePulzrdZlM=";
     };
-    buildInputs = attrs.buildInputs ++ [ xorg.libXScrnSaver xorg.libXfixes xorg.libXv xorg.pixman xorg.utilmacros ];
+    buildInputs = attrs.buildInputs ++ [ xorg.libXScrnSaver xorg.libXv xorg.pixman xorg.utilmacros ];
     nativeBuildInputs = attrs.nativeBuildInputs ++ [autoreconfHook ];
     configureFlags = [ "--with-default-dri=3" "--enable-tools" ];
 

From 050a94b3df68f29ef6fc48706b7796e45bab5c30 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 27 Dec 2022 21:14:09 +0000
Subject: [PATCH 225/231] xorg.xauth: 1.1.0 -> 1.1.2

Changes:
- 1.1.1: https://lists.x.org/archives/xorg-announce/2021-November/003118.html
- 1.1.2: https://lists.x.org/archives/xorg-announce/2022-April/003158.html
---
 pkgs/servers/x11/xorg/default.nix   | 6 +++---
 pkgs/servers/x11/xorg/tarballs.list | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 7cc5dfa6895d..c9ad8d95da5f 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -1724,11 +1724,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xauth = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXau, libXext, libXmu, xorgproto }: stdenv.mkDerivation {
     pname = "xauth";
-    version = "1.1";
+    version = "1.1.2";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/xauth-1.1.tar.bz2";
-      sha256 = "032klzzw8r09z36x1272ssd79bcisz8j5p8gbdy111fiknvx27bd";
+      url = "mirror://xorg/individual/app/xauth-1.1.2.tar.xz";
+      sha256 = "0072ivzn4z59ysanz838nh8s4mcmdsx6q9xkvlfysv2k37ynmfkq";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index e6a9a3168897..0264f7185956 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -24,7 +24,7 @@ mirror://xorg/individual/app/transset-1.0.2.tar.bz2
 mirror://xorg/individual/app/twm-1.0.10.tar.bz2
 mirror://xorg/individual/app/viewres-1.0.5.tar.bz2
 mirror://xorg/individual/app/x11perf-1.6.1.tar.bz2
-mirror://xorg/individual/app/xauth-1.1.tar.bz2
+mirror://xorg/individual/app/xauth-1.1.2.tar.xz
 mirror://xorg/individual/app/xbacklight-1.2.3.tar.bz2
 mirror://xorg/individual/app/xcalc-1.1.0.tar.bz2
 mirror://xorg/individual/app/xclock-1.0.9.tar.bz2

From e349e79866e9d32091e0f2e03ac8f0b01fbb656a Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Tue, 3 Jan 2023 19:53:08 +0200
Subject: [PATCH 226/231] xorg.xf86videomga: 2.0.0 -> 2.0.1

includes a cross fix

https://lists.x.org/archives/xorg-announce/2022-July/003184.html
---
 pkgs/servers/x11/xorg/default.nix   | 6 +++---
 pkgs/servers/x11/xorg/tarballs.list | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index c9ad8d95da5f..0dc9e3c801ee 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -2460,11 +2460,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videomga = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libdrm, libpciaccess, xorgserver }: stdenv.mkDerivation {
     pname = "xf86-video-mga";
-    version = "2.0.0";
+    version = "2.0.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/driver/xf86-video-mga-2.0.0.tar.bz2";
-      sha256 = "0yaxpgyyj9398nzzr5vnsfxcis76z46p9814yzj8179yl7hld296";
+      url = "mirror://xorg/individual/driver/xf86-video-mga-2.0.1.tar.xz";
+      sha256 = "1aq3aqh2yg09gy864kkshfx5pjl5w05jdz97bx5bnrbrhdq3p8r7";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 0264f7185956..c1b545e35b6b 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -101,7 +101,7 @@ mirror://xorg/individual/driver/xf86-video-glint-1.2.9.tar.bz2
 mirror://xorg/individual/driver/xf86-video-i128-1.4.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-i740-1.4.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-intel-2.99.917.tar.bz2
-mirror://xorg/individual/driver/xf86-video-mga-2.0.0.tar.bz2
+mirror://xorg/individual/driver/xf86-video-mga-2.0.1.tar.xz
 mirror://xorg/individual/driver/xf86-video-neomagic-1.3.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-newport-0.2.4.tar.bz2
 https://gitlab.freedesktop.org/xorg/driver/xf86-video-nouveau/-/archive/3ee7cbca8f9144a3bb5be7f71ce70558f548d268/xf86-video-nouveau-3ee7cbca8f9144a3bb5be7f71ce70558f548d268.tar.bz2

From c42e7b71d294000d0c5d84a83a09590dc5410823 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Tue, 3 Jan 2023 19:58:22 +0200
Subject: [PATCH 227/231] xorg.xf86videor128: 6.11.0 -> 6.12.1

includes a cross fix

- 6.12.0: https://lists.x.org/archives/xorg-announce/2018-July/002909.html
- 6.12.1: https://lists.x.org/archives/xorg-announce/2022-December/003275.html
---
 pkgs/servers/x11/xorg/default.nix   | 6 +++---
 pkgs/servers/x11/xorg/tarballs.list | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 0dc9e3c801ee..ed9efb690fa8 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -2588,11 +2588,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videor128 = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libdrm, libpciaccess, xorgserver }: stdenv.mkDerivation {
     pname = "xf86-video-r128";
-    version = "6.11.0";
+    version = "6.12.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/driver/xf86-video-r128-6.11.0.tar.bz2";
-      sha256 = "0snvwmrh8dqyyaq7ggicym6yrsg4brygkx9156r0m095m7fp3rav";
+      url = "mirror://xorg/individual/driver/xf86-video-r128-6.12.1.tar.xz";
+      sha256 = "0hf7h54wxgs8njavp0kgadjq1787fhbd588j7pj685hz2wmkq0kx";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index c1b545e35b6b..608b66b093ea 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -109,7 +109,7 @@ mirror://xorg/individual/driver/xf86-video-nv-2.1.21.tar.bz2
 mirror://xorg/individual/driver/xf86-video-omap-0.4.5.tar.bz2
 mirror://xorg/individual/driver/xf86-video-openchrome-0.6.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-qxl-0.1.5.tar.bz2
-mirror://xorg/individual/driver/xf86-video-r128-6.11.0.tar.bz2
+mirror://xorg/individual/driver/xf86-video-r128-6.12.1.tar.xz
 mirror://xorg/individual/driver/xf86-video-rendition-4.2.7.tar.bz2
 mirror://xorg/individual/driver/xf86-video-s3virge-1.11.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-savage-2.3.9.tar.bz2

From 82ae2e8f068ee5b336c108816c5ace316b295ae0 Mon Sep 17 00:00:00 2001
From: Dmitry Bogatov <serenity@kaction.cc>
Date: Tue, 3 Jan 2023 20:23:31 -0500
Subject: [PATCH 228/231] python3.pkgs.sphinxHook: fix co-installability of
 generated documentation

Include full $name of the derivation into docdir, so documentation for
python package "foo" is installed into $out/share/doc/python3.10-foo-1.2.3
instead of just $out/share/doc/foo, where it may conflict with some
other package named "foo" and not-coinstallable with different
versions of the same python package.

Change from $name to $pname was introduced in [1ee5fca], probably as
unindented side-effect of adding support for formats other than html.
---
 pkgs/development/interpreters/python/hooks/sphinx-hook.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/python/hooks/sphinx-hook.sh b/pkgs/development/interpreters/python/hooks/sphinx-hook.sh
index ae386ca859f4..ca67fa9beabf 100644
--- a/pkgs/development/interpreters/python/hooks/sphinx-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/sphinx-hook.sh
@@ -57,7 +57,7 @@ installSphinxPhase() {
 
         else
             # shellcheck disable=2154
-            docdir="${doc:-$out}/share/doc/${pname}"
+            docdir="${doc:-$out}/share/doc/${name}"
 
             mkdir -p "$docdir"
 

From b066191d42b1a4313c34ee4d52e7916b98c6482d Mon Sep 17 00:00:00 2001
From: Marco Rebhan <me@dblsaiko.net>
Date: Tue, 20 Dec 2022 21:33:15 +0100
Subject: [PATCH 229/231] harfbuzz: 5.3.1 -> 6.0.0

https://github.com/harfbuzz/harfbuzz/releases/tag/6.0.0
---
 pkgs/development/libraries/harfbuzz/default.nix | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 977d39ba3568..9da8e8837bc1 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -32,23 +32,13 @@
 
 stdenv.mkDerivation rec {
   pname = "harfbuzz${lib.optionalString withIcu "-icu"}";
-  version = "5.3.1";
+  version = "6.0.0";
 
   src = fetchurl {
     url = "https://github.com/harfbuzz/harfbuzz/releases/download/${version}/harfbuzz-${version}.tar.xz";
-    sha256 = "sha256-Smzgl7dagSH6zEuoO1sIO/7GV/RbADzVo0JPKua0Q00=";
+    sha256 = "HRAQoXUdB21SkeQzwThQKnlNZ5p0mNEmjuIeLUoUDrQ=";
   };
 
-  patches = [
-    # Pick upstream patch for exported symbol test failing on darwin
-    # https://github.com/harfbuzz/harfbuzz/issues/3850
-    (fetchpatch {
-      name = "harfbuzz-fix-check-symbol-tests-lto-and-darwin.patch";
-      url = "https://github.com/harfbuzz/harfbuzz/commit/b0b7a65388da25ae3fa01e969ad6abc67eed4f49.patch";
-      sha256 = "0my064r88pikw6q70hbgf6hwfkw544b9f5ai73qhn2a3c83jqn06";
-    })
-  ];
-
   postPatch = ''
     patchShebangs src/*.py test
   '' + lib.optionalString stdenv.isDarwin ''

From 4835c7a74c1419837263c6c78fca10bb52138929 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Wed, 4 Jan 2023 17:50:06 +0100
Subject: [PATCH 230/231] glibc, python3Packages.twisted: resolve temporary
 workaround

It certainly seems better to patch the twisted test than glibc.
---
 pkgs/development/libraries/glibc/common.nix   |  3 -
 .../libraries/glibc/revert-mktime.patch       | 73 -------------------
 .../python-modules/twisted/default.nix        |  7 ++
 3 files changed, 7 insertions(+), 76 deletions(-)
 delete mode 100644 pkgs/development/libraries/glibc/revert-mktime.patch

diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 889ca7bf48fd..c9bc557eec19 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -69,9 +69,6 @@ stdenv.mkDerivation ({
        */
       ./2.35-master.patch.gz
 
-      /* Revert this patch contained in the previous bundle.  For now, until we know more. */
-      ./revert-mktime.patch
-
       /* Allow NixOS and Nix to handle the locale-archive. */
       ./nix-locale-archive.patch
 
diff --git a/pkgs/development/libraries/glibc/revert-mktime.patch b/pkgs/development/libraries/glibc/revert-mktime.patch
deleted file mode 100644
index d691213e8657..000000000000
--- a/pkgs/development/libraries/glibc/revert-mktime.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-commit f6d4c1ac648c4ff8baad94500df0bb13108a4f79
-Author: Paul Eggert <eggert@cs.ucla.edu>
-Date:   Thu Sep 8 20:08:32 2022 -0500
-
-    REVERT: mktime: improve heuristic for ca-1986 Indiana DST
-    
-    This patch syncs mktime.c from Gnulib, fixing a
-    problem reported by Mark Krenz <https://bugs.gnu.org/48085>,
-    and it should fix BZ#29035 too.
-    * time/mktime.c (__mktime_internal): Be more generous about
-    accepting arguments with the wrong value of tm_isdst, by falling
-    back to a one-hour DST difference if we find no nearby DST that is
-    unusual.  This fixes a problem where "1986-04-28 00:00 EDT" was
-    rejected when TZ="America/Indianapolis" because the nearest DST
-    timestamp occurred in 1970, a temporal distance too great for the
-    old heuristic.  This also also narrows the search a bit, which
-    is a minor performance win.
-    
-    (cherry picked from commit 83859e1115269cf56d21669361d4ddbe2687831c)
-
-diff --git b/time/mktime.c a/time/mktime.c
-index e9a6006710..494c89bf54 100644
---- b/time/mktime.c
-+++ a/time/mktime.c
-@@ -429,13 +429,8 @@ __mktime_internal (struct tm *tp,
- 	 time with the right value, and use its UTC offset.
- 
- 	 Heuristic: probe the adjacent timestamps in both directions,
--	 looking for the desired isdst.  If none is found within a
--	 reasonable duration bound, assume a one-hour DST difference.
--	 This should work for all real time zone histories in the tz
--	 database.  */
--
--      /* +1 if we wanted standard time but got DST, -1 if the reverse.  */
--      int dst_difference = (isdst == 0) - (tm.tm_isdst == 0);
-+	 looking for the desired isdst.  This should work for all real
-+	 time zone histories in the tz database.  */
- 
-       /* Distance between probes when looking for a DST boundary.  In
- 	 tzdata2003a, the shortest period of DST is 601200 seconds
-@@ -446,14 +441,12 @@ __mktime_internal (struct tm *tp,
- 	 periods when probing.  */
-       int stride = 601200;
- 
--      /* In TZDB 2021e, the longest period of DST (or of non-DST), in
--	 which the DST (or adjacent DST) difference is not one hour,
--	 is 457243209 seconds: e.g., America/Cambridge_Bay with leap
--	 seconds, starting 1965-10-31 00:00 in a switch from
--	 double-daylight time (-05) to standard time (-07), and
--	 continuing to 1980-04-27 02:00 in a switch from standard time
--	 (-07) to daylight time (-06).  */
--      int duration_max = 457243209;
-+      /* The longest period of DST in tzdata2003a is 536454000 seconds
-+	 (e.g., America/Jujuy starting 1946-10-01 01:00).  The longest
-+	 period of non-DST is much longer, but it makes no real sense
-+	 to search for more than a year of non-DST, so use the DST
-+	 max.  */
-+      int duration_max = 536454000;
- 
-       /* Search in both directions, so the maximum distance is half
- 	 the duration; add the stride to avoid off-by-1 problems.  */
-@@ -490,11 +483,6 @@ __mktime_internal (struct tm *tp,
- 	      }
- 	  }
- 
--      /* No unusual DST offset was found nearby.  Assume one-hour DST.  */
--      t += 60 * 60 * dst_difference;
--      if (mktime_min <= t && t <= mktime_max && convert_time (convert, t, &tm))
--	goto offset_found;
--
-       __set_errno (EOVERFLOW);
-       return -1;
-     }
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index 03a6045372bb..f90cdeec51cb 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -57,6 +57,13 @@ buildPythonPackage rec {
     hash = "sha256-Mqy9QKlPX0bntCwQm/riswIlCUVWF4Oot6BZBI8tTTE=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/twisted/twisted/pull/11787.diff";
+      hash = "sha256-bQgUmbvDa61Vg8p/o/ivfkOAHyj1lTgHkrRVEGLM9aU=";
+    })
+  ];
+
   __darwinAllowLocalNetworking = true;
 
   propagatedBuildInputs = [

From ccb3146bf27b954399648f7d12c3af8efeab1f13 Mon Sep 17 00:00:00 2001
From: clerie <clerie@users.noreply.github.com>
Date: Wed, 4 Jan 2023 21:50:22 +0100
Subject: [PATCH 231/231] iproute2: 6.0.0 -> 6.1.0 (#206932)

"Nothing major; lots of usual set of small fixes."

Changes: https://marc.info/?l=linux-netdev&m=167103481006660
---
 pkgs/os-specific/linux/iproute/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 89c191cb7f35..9a63a28a7a96 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "6.0.0";
+  version = "6.1.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "UjE56ecq7JljdPot50vkxT0t0FWJSIk00h/5e64ZWAo=";
+    sha256 = "sha256-XOEqD+xrIScl7yGHNZQbLat2JE235yZGp2AhsFN7Q6s=";
   };
 
   patches = [