Merge branch 'staging' into staging-next

doc/stdenv/stdenv.chapter.md

@@ -518,8 +518,10 @@ There are a number of variables that control what phases are executed and in wha
 
 Specifies the phases. You can change the order in which phases are executed, or add new phases, by setting this variable. If it’s not set, the default value is used, which is `$prePhases unpackPhase patchPhase $preConfigurePhases configurePhase $preBuildPhases buildPhase checkPhase $preInstallPhases installPhase fixupPhase installCheckPhase $preDistPhases distPhase $postPhases`.
 
+The elements of `phases` must not contain spaces. If `phases` is specified as a Nix Language attribute, it should be specified as lists instead of strings. The same rules apply to the `*Phases` variables.
+
 It is discouraged to set this variable, as it is easy to miss some important functionality hidden in some of the less obviously needed phases (like `fixupPhase` which patches the shebang of scripts).
-Usually, if you just want to add a few phases, it’s more convenient to set one of the variables below (such as `preInstallPhases`).
+Usually, if you just want to add a few phases, it’s more convenient to set one of the `*Phases` variables below.
 
 ##### `prePhases` {#var-stdenv-prePhases}
 

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -17,6 +17,8 @@
     [2.24](https://nix.dev/manual/nix/latest/release-notes/rl-2.24).
   Notable changes include improvements to Git fetching, documentation comment support in `nix-repl> :doc`, as well as many quality of life improvements.
 
+- GCC now defaults to major version 14 from previous 13. ([GCC Porting Guide](https://gcc.gnu.org/gcc-14/porting_to.html))
+
 - Convenience options for `amdgpu`, open source driver for Radeon cards, is now available under `hardware.amdgpu`.
 
 - [AMDVLK](https://github.com/GPUOpen-Drivers/AMDVLK), AMD's open source Vulkan driver, is now available to be configured as `hardware.amdgpu.amdvlk` option.
@@ -212,6 +214,11 @@
 
 - The nvidia driver no longer defaults to the proprietary driver starting with version 560. You will need to manually set `hardware.nvidia.open` to select the proprietary or open driver.
 
+- The dhcpcd service (`networking.useDHCP`) has been hardened and now runs exclusively as the "dhcpcd" user.
+  Users that were relying on the root privileges in `networking.dhcpcd.runHook` will have to write specific [sudo](security.sudo.extraRules) or [polkit](security.polkit.extraConfig) rules to allow dhcpcd to perform privileged actions.
+
+  As part of these changes, the DHCP lease files directory has also been moved from `/var/db/dhcpcd` to `/var/lib/dhcpcd`. This migration is performed automatically, but users may have to update their backup configuration.
+
 - `singularity-tools` have the `storeDir` argument removed from its override interface and use `builtins.storeDir` instead.
 
 - Two build helpers in `singularity-tools`, i.e., `mkLayer` and `shellScript`, are deprecated, as they are no longer involved in image-building. Maintainers will remove them in future releases.
@@ -428,9 +435,6 @@
 - The `services.mxisd` module has been removed as both [mxisd](https://github.com/kamax-matrix/mxisd) and [ma1sd](https://github.com/ma1uta/ma1sd) are not maintained any longer.
   Consequently the package `pkgs.ma1sd` has also been removed.
 
-- `ffmpeg_5` has been removed. Please use the unversioned `ffmpeg`,
-  pin a newer version, or if necessary pin `ffmpeg_4` for compatibility.
-
 - The `xdg.portal.gtkUsePortal` option has been removed, as it had been deprecated for over 2 years. Using the `GTK_USE_PORTAL` environment variable in this manner is not intended nor encouraged by the GTK developers, but can still be done manually via `environment.sessionVariables`.
 
 - The `services.trust-dns` module has been renamed to `services.hickory-dns`.
@@ -470,6 +474,16 @@
 - Minimal installer ISOs are no longer built on the small channel.
   Please obtain installer images from the full release channels.
 
+- The default FFmpeg version is now 7, and FFmpeg 5 has been removed.
+  Please prefer using the package variants without a version suffix,
+  or pin FFmpeg 6 or 4 if necessary for compatibility.
+  Note that we keep old versions around only as required
+  to support packages in the tree,
+  and FFmpeg 4 especially should be avoided in favour of newer versions
+  as it may be removed soon.
+
+- `openssl` now defaults to the latest version line `3.3.x`, instead of `3.0.x` before. While there should be no major code incompatibilities, newer OpenSSL versions typically strengthen the default security level. This means that you may have to explicitly allow weak ciphers, hashes and key lengths if necessary. See: [OpenSSL security level documentation](https://docs.openssl.org/3.3/man3/SSL_CTX_set_security_level/).
+
 - The `isync` package has been updated to version `1.5.0`, which introduces some breaking changes. See the [compatibility concerns](https://sourceforge.net/projects/isync/files/isync/1.5.0/) for more details.
 
 ## Other Notable Changes {#sec-release-24.11-notable-changes}

nixos/modules/config/resolvconf.nix

@@ -132,6 +132,8 @@ in
     }
 
     (lib.mkIf cfg.enable {
+      users.groups.resolvconf = {};
+
       networking.resolvconf.package = pkgs.openresolv;
 
       environment.systemPackages = [ cfg.package ];
@@ -143,12 +145,13 @@ in
         wants = [ "network-pre.target" ];
         wantedBy = [ "multi-user.target" ];
         restartTriggers = [ config.environment.etc."resolvconf.conf".source ];
+        serviceConfig.RemainAfterExit = true;
 
-        serviceConfig = {
-          Type = "oneshot";
-          ExecStart = "${cfg.package}/bin/resolvconf -u";
-          RemainAfterExit = true;
-        };
+        script = ''
+          ${lib.getExe cfg.package} -u
+          chgrp -R resolvconf /etc/resolv.conf /run/resolvconf
+          chmod -R g=u /etc/resolv.conf /run/resolvconf
+        '';
       };
 
     })

nixos/modules/services/networking/dhcpcd.nix

@@ -10,7 +10,7 @@ let
   enableDHCP = config.networking.dhcpcd.enable &&
         (config.networking.useDHCP || lib.any (i: i.useDHCP == true) interfaces);
 
-  enableNTPService = (config.services.ntp.enable || config.services.ntpd-rs.enable || config.services.openntpd.enable || config.services.chrony.enable);
+  useResolvConf = config.networking.resolvconf.enable;
 
   # Don't start dhcpcd on explicitly configured interfaces or on
   # interfaces that are part of a bridge, bond or sit device.
@@ -88,23 +88,6 @@ let
       ${cfg.extraConfig}
     '';
 
-  exitHook = pkgs.writeText "dhcpcd.exit-hook" ''
-    ${lib.optionalString enableNTPService ''
-      if [ "$reason" = BOUND -o "$reason" = REBOOT ]; then
-        # Restart ntpd. We need to restart it to make sure that it will actually do something:
-        # if ntpd cannot resolve the server hostnames in its config file, then it will never do
-        # anything ever again ("couldn't resolve ..., giving up on it"), so we silently lose
-        # time synchronisation. This also applies to openntpd.
-        ${lib.optionalString config.services.ntp.enable "/run/current-system/systemd/bin/systemctl try-reload-or-restart ntpd.service || true"}
-        ${lib.optionalString config.services.ntpd-rs.enable "/run/current-system/systemd/bin/systemctl try-reload-or-restart ntpd-rs.service || true"}
-        ${lib.optionalString config.services.openntpd.enable "/run/current-system/systemd/bin/systemctl try-reload-or-restart openntpd.service || true"}
-        ${lib.optionalString config.services.chrony.enable "/run/current-system/systemd/bin/systemctl try-reload-or-restart chronyd.service || true"}
-      fi
-    ''}
-
-    ${cfg.runHook}
-  '';
-
 in
 
 {
@@ -181,6 +164,19 @@ in
       description = ''
          Shell code that will be run after all other hooks. See
          `man dhcpcd-run-hooks` for details on what is possible.
+
+         ::: {.note}
+         To use sudo or similar tools in your script you may have to set:
+
+             systemd.services.dhcpcd.serviceConfig.NoNewPrivileges = false;
+
+         In addition, as most of the filesystem is inaccessible to dhcpcd
+         by default, you may want to define some exceptions, e.g.
+
+             systemd.services.dhcpcd.serviceConfig.ReadOnlyPaths = [
+               "/run/user/1000/bus"  # to send desktop notifications
+             ];
+         :::
       '';
     };
 
@@ -206,22 +202,6 @@ in
 
   config = lib.mkIf enableDHCP {
 
-    assertions = [ {
-      # dhcpcd doesn't start properly with malloc ∉ [ libc scudo ]
-      # see https://github.com/NixOS/nixpkgs/issues/151696
-      assertion =
-        dhcpcd.enablePrivSep
-          -> lib.elem config.environment.memoryAllocator.provider [ "libc" "scudo" ];
-      message = ''
-        dhcpcd with privilege separation is incompatible with chosen system malloc.
-          Currently only the `libc` and `scudo` allocators are known to work.
-          To disable dhcpcd's privilege separation, overlay Nixpkgs and override dhcpcd
-          to set `enablePrivSep = false`.
-      '';
-    } ];
-
-    environment.etc."dhcpcd.conf".source = dhcpcdConf;
-
     systemd.services.dhcpcd = let
       cfgN = config.networking;
       hasDefaultGatewaySet = (cfgN.defaultGateway != null && cfgN.defaultGateway.address != "")
@@ -233,7 +213,7 @@ in
         wants = [ "network.target" ];
         before = [ "network-online.target" ];
 
-        restartTriggers = lib.optional (enableNTPService || cfg.runHook != "") [ exitHook ];
+        restartTriggers = [ cfg.runHook ];
 
         # Stopping dhcpcd during a reconfiguration is undesirable
         # because it brings down the network interfaces configured by
@@ -247,13 +227,62 @@ in
         serviceConfig =
           { Type = "forking";
             PIDFile = "/run/dhcpcd/pid";
+            SupplementaryGroups = lib.optional useResolvConf "resolvconf";
+            User = "dhcpcd";
+            Group = "dhcpcd";
+            StateDirectory = "dhcpcd";
             RuntimeDirectory = "dhcpcd";
+
+            ExecStartPre = "+${pkgs.writeShellScript "migrate-dhcpcd" ''
+              # migrate from old database directory
+              if test -f /var/db/dhcpcd/duid; then
+                echo 'migrating DHCP leases from /var/db/dhcpcd to /var/lib/dhcpcd ...'
+                mv /var/db/dhcpcd/* -t /var/lib/dhcpcd
+                chown dhcpcd:dhcpcd /var/lib/dhcpcd/*
+                rmdir /var/db/dhcpcd || true
+                echo done
+              fi
+            ''}";
+
             ExecStart = "@${dhcpcd}/sbin/dhcpcd dhcpcd --quiet ${lib.optionalString cfg.persistent "--persistent"} --config ${dhcpcdConf}";
             ExecReload = "${dhcpcd}/sbin/dhcpcd --rebind";
             Restart = "always";
+            AmbientCapabilities = [ "CAP_NET_ADMIN" "CAP_NET_RAW" "CAP_NET_BIND_SERVICE" ];
+            ReadWritePaths = [ "/proc/sys/net/ipv6" ]
+              ++ lib.optionals useResolvConf [ "/etc/resolv.conf" "/run/resolvconf" ];
+            DeviceAllow = "";
+            LockPersonality = true;
+            MemoryDenyWriteExecute = true;
+            NoNewPrivileges = lib.mkDefault true;  # may be disabled for sudo in runHook
+            PrivateDevices = true;
+            PrivateMounts = true;
+            PrivateTmp = true;
+            PrivateUsers = false;
+            ProtectClock = true;
+            ProtectControlGroups = true;
+            ProtectHome = "tmpfs";  # allow exceptions to be added to ReadOnlyPaths, etc.
+            ProtectHostname = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectSystem = "strict";
+            RemoveIPC = true;
+            RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" "AF_NETLINK" "AF_PACKET" ];
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+            SystemCallFilter = [
+              "@system-service"
+              "~@aio" "~@chown" "~@keyring" "~@memlock"
+            ];
+            SystemCallArchitectures = "native";
           };
       };
 
+    # Note: the service could run with `DynamicUser`, however that makes
+    # impossible (for no good reason, see systemd issue #20495) to disable
+    # `NoNewPrivileges` or `ProtectHome`, which users may want to in order
+    # to run certain scripts in `networking.dhcpcd.runHook`.
     users.users.dhcpcd = {
       isSystemUser = true;
       group = "dhcpcd";
@@ -262,9 +291,7 @@ in
 
     environment.systemPackages = [ dhcpcd ];
 
-    environment.etc."dhcpcd.exit-hook" = lib.mkIf (enableNTPService || cfg.runHook != "") {
-      source = exitHook;
-    };
+    environment.etc."dhcpcd.exit-hook".text = cfg.runHook;
 
     powerManagement.resumeCommands = lib.mkIf config.systemd.services.dhcpcd.enable
       ''

nixos/modules/services/video/go2rtc/default.nix

@@ -55,8 +55,8 @@ in
           ffmpeg = {
             bin = mkOption {
               type = path;
-              default = lib.getExe pkgs.ffmpeg_7-headless;
-              defaultText = literalExpression "lib.getExe pkgs.ffmpeg_7-headless";
+              default = lib.getExe pkgs.ffmpeg-headless;
+              defaultText = literalExpression "lib.getExe pkgs.ffmpeg-headless";
               description = ''
                 The ffmpeg package to use for transcoding.
               '';

nixos/tests/all-tests.nix

@@ -1056,6 +1056,7 @@ in {
   unbound = handleTest ./unbound.nix {};
   unifi = handleTest ./unifi.nix {};
   unit-php = handleTest ./web-servers/unit-php.nix {};
+  unit-perl = handleTest ./web-servers/unit-perl.nix {};
   upnp.iptables = handleTest ./upnp.nix { useNftables = false; };
   upnp.nftables = handleTest ./upnp.nix { useNftables = true; };
   uptermd = handleTest ./uptermd.nix {};

nixos/tests/chrony.nix

@@ -13,8 +13,6 @@ import ./make-test-python.nix ({ lib, ... }:
       specialisation.hardened.configuration = {
         services.chrony.enableMemoryLocking = true;
         environment.memoryAllocator.provider = "graphene-hardened";
-        # dhcpcd privsep is incompatible with graphene-hardened
-        networking.useNetworkd = true;
       };
     };
   };

nixos/tests/hardened.nix

@@ -11,11 +11,6 @@ import ./make-test-python.nix ({ pkgs, ... } : {
       imports = [ ../modules/profiles/hardened.nix ];
       environment.memoryAllocator.provider = "graphene-hardened";
       nix.settings.sandbox = false;
-      nixpkgs.overlays = [
-        (final: super: {
-          dhcpcd = super.dhcpcd.override { enablePrivSep = false; };
-        })
-      ];
       virtualisation.emptyDiskImages = [ 4096 ];
       boot.initrd.postDeviceCommands = ''
         ${pkgs.dosfstools}/bin/mkfs.vfat -n EFISYS /dev/vdb

nixos/tests/installed-tests/geocode-glib.nix

@@ -4,8 +4,10 @@ makeInstalledTest {
   testConfig = {
     i18n.supportedLocales = [
       "en_US.UTF-8/UTF-8"
-      # The tests require this locale available.
+      # The tests require these locales.
       "en_GB.UTF-8/UTF-8"
+      "cs_CZ.UTF-8/UTF-8"
+      "sv_SE.UTF-8/UTF-8"
     ];
   };
 

nixos/tests/networking/networkd-and-scripted.nix

@@ -132,6 +132,10 @@ let
               client.wait_until_succeeds("ip addr show dev enp2s0 | grep -q '192.168.2'")
               client.wait_until_succeeds("ip addr show dev enp2s0 | grep -q 'fd00:1234:5678:2:'")
 
+          with subtest("Wait until we have received the nameservers"):
+              client.wait_until_succeeds("grep -q 2001:db8::1 /etc/resolv.conf")
+              client.wait_until_succeeds("grep -q 192.168.2.1 /etc/resolv.conf")
+
           with subtest("Test vlan 1"):
               client.wait_until_succeeds("ping -c 1 192.168.1.1")
               client.wait_until_succeeds("ping -c 1 fd00:1234:5678:1::1")

nixos/tests/networking/networkmanager.nix

@@ -121,6 +121,7 @@ let
         static.wait_for_unit("NetworkManager.service")
 
         dynamic.wait_until_succeeds("cat /etc/resolv.conf | grep -q '192.168.1.1'")
+        dynamic.wait_until_succeeds("cat /etc/resolv.conf | grep -q '2001:db8::1'")
         static.wait_until_succeeds("cat /etc/resolv.conf | grep -q '10.10.10.10'")
         static.wait_until_fails("cat /etc/resolv.conf | grep -q '192.168.1.1'")
       '';

nixos/tests/networking/router.nix

@@ -72,6 +72,7 @@
           AdvSendAdvert on;
           AdvManagedFlag on;
           AdvOtherConfigFlag on;
+          RDNSS 2001:db8::1 {};
 
           prefix fd00:1234:5678:${toString n}::/64 {
             AdvAutonomous off;

nixos/tests/web-servers/unit-perl.nix

@@ -0,0 +1,46 @@
+import ../make-test-python.nix (
+  { pkgs, ... }:
+  let
+    testdir = pkgs.writeTextDir "www/app.psgi" ''
+      my $app = sub {
+          return [
+              "200",
+              [ "Content-Type" => "text/plain" ],
+              [ "Hello, Perl on Unit!" ],
+          ];
+      };
+    '';
+
+  in
+  {
+    name = "unit-perl-test";
+    meta.maintainers = with pkgs.lib.maintainers; [ sgo ];
+
+    nodes.machine =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        services.unit = {
+          enable = true;
+          config = pkgs.lib.strings.toJSON {
+            listeners."*:8080".application = "perl";
+            applications.perl = {
+              type = "perl";
+              script = "${testdir}/www/app.psgi";
+            };
+          };
+        };
+      };
+    testScript = ''
+      machine.wait_for_unit("unit.service")
+      machine.wait_for_open_port(8080)
+
+      response = machine.succeed("curl -f -vvv -s http://127.0.0.1:8080/")
+      assert "Hello, Perl on Unit!" in response, "Hello world"
+    '';
+  }
+)

pkgs/applications/audio/audacity/default.nix

@@ -30,7 +30,7 @@
 , libid3tag
 , libopus
 , libuuid
-, ffmpeg_7
+, ffmpeg
 , soundtouch
 , pcre
 , portaudio # given up fighting their portaudio.patch?
@@ -95,7 +95,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     expat
-    ffmpeg_7
+    ffmpeg
     file
     flac
     gtk3
@@ -179,7 +179,7 @@ stdenv.mkDerivation rec {
   postFixup = lib.optionalString stdenv.isLinux ''
     wrapProgram "$out/bin/audacity" \
       "''${gappsWrapperArgs[@]}" \
-      --prefix LD_LIBRARY_PATH : "$out/lib/audacity":${lib.makeLibraryPath [ ffmpeg_7 ]} \
+      --prefix LD_LIBRARY_PATH : "$out/lib/audacity":${lib.makeLibraryPath [ ffmpeg ]} \
       --suffix AUDACITY_MODULES_PATH : "$out/lib/audacity/modules" \
       --suffix AUDACITY_PATH : "$out/share/audacity"
   '' + lib.optionalString stdenv.isDarwin ''

pkgs/applications/audio/fluidsynth/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluidsynth";
-  version = "2.3.5";
+  version = "2.3.6";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     rev = "v${version}";
-    hash = "sha256-CzKfvQzhF4Mz2WZaJM/Nt6XjF6ThlX4jyQSaXfZukG8=";
+    hash = "sha256-bmA4eUh7MC4dXPsOOi9Q5jneSE5OGUWrztv+46LxaW0=";
   };
 
   outputs = [ "out" "dev" "man" ];

pkgs/applications/audio/keyfinder-cli/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, ffmpeg_7, libkeyfinder, fftw }:
+{ lib, stdenv, fetchFromGitHub, ffmpeg, libkeyfinder, fftw }:
 
 stdenv.mkDerivation rec {
   pname = "keyfinder-cli";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-9/+wzPTaQ5PfPiqTZ5EuHdswXJgfgnvAul/FeeDbbJA=";
   };
 
-  buildInputs = [ ffmpeg_7 libkeyfinder fftw ];
+  buildInputs = [ ffmpeg libkeyfinder fftw ];
 
   makeFlags = [ "PREFIX=$(out)" ];
 

pkgs/applications/audio/mbrola/default.nix

@@ -26,6 +26,10 @@ let
     # required for cross compilation
     makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
 
+    env = lib.optionalAttrs stdenv.cc.isGNU {
+      NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+    };
+
     installPhase = ''
       runHook preInstall
       install -D Bin/mbrola $out/bin/mbrola
@@ -49,4 +53,3 @@ in
       ln -s '${mbrola-voices}/data' "$out/share/mbrola/voices"
       ln -s '${bin}/bin' "$out/"
     ''
-

pkgs/applications/audio/moc/default.nix

@@ -16,7 +16,7 @@
 , musepackSupport ? true, libmpc, libmpcdec, taglib
 , vorbisSupport ? true, libvorbis
 , speexSupport ? true, speex
-, ffmpegSupport ? true, ffmpeg_7
+, ffmpegSupport ? true, ffmpeg
 , sndfileSupport ? true, libsndfile
 , wavpackSupport ? true, wavpack
 # Misc
@@ -74,7 +74,7 @@ stdenv.mkDerivation {
     ++ lib.optionals musepackSupport [ libmpc libmpcdec taglib ]
     ++ lib.optional vorbisSupport libvorbis
     ++ lib.optional speexSupport speex
-    ++ lib.optional ffmpegSupport ffmpeg_7
+    ++ lib.optional ffmpegSupport ffmpeg
     ++ lib.optional sndfileSupport libsndfile
     ++ lib.optional wavpackSupport wavpack
     # Misc

pkgs/applications/audio/mpg123/default.nix

@@ -22,11 +22,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation rec {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.32.6";
+  version = "1.32.7";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-zN0dCrwx1z2LQ1/GWMeQSdCpBbMGabakKgOtFp3GCeY=";
+    hash = "sha256-PIkZJDcHlRysDjw5u/KGU7yv/EPJj/FoAaJzUNuPDyE=";
   };
 
   outputs = [ "out" "dev" "man" ] ++ lib.optional withConplay "conplay";

pkgs/applications/audio/pianobar/default.nix

@@ -1,4 +1,4 @@
-{ fetchFromGitHub, lib, stdenv, pkg-config, libao, json_c, libgcrypt, ffmpeg_7, curl }:
+{ fetchFromGitHub, lib, stdenv, pkg-config, libao, json_c, libgcrypt, ffmpeg, curl }:
 
 stdenv.mkDerivation rec {
   pname = "pianobar";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
-    libao json_c libgcrypt ffmpeg_7 curl
+    libao json_c libgcrypt ffmpeg curl
   ];
 
   makeFlags = [ "PREFIX=$(out)" ];

pkgs/applications/editors/emacs/build-support/emacs-funcs.sh

@@ -20,15 +20,4 @@ addEmacsVars () {
   if [ -n "${addEmacsNativeLoadPath:-}" ]; then
     addToEmacsNativeLoadPath "$1/share/emacs/native-lisp"
   fi
-
-  # Add sub paths to the Emacs load path if it is a directory
-  # containing .el files. This is necessary to build some packages,
-  # e.g., using trivialBuild.
-  for lispDir in \
-      "$1/share/emacs/site-lisp/"* \
-      "$1/share/emacs/site-lisp/elpa/"*; do
-    if [[ -d $lispDir && "$(echo "$lispDir"/*.el)" ]] ; then
-      addToEmacsLoadPath "$lispDir"
-    fi
-  done
 }

pkgs/applications/editors/emacs/build-support/generic.nix

@@ -33,7 +33,7 @@ libBuildHelper.extendMkDerivation' stdenv.mkDerivation (finalAttrs:
 , postInstall ? ""
 , meta ? {}
 , turnCompilationWarningToError ? false
-, ignoreCompilationError ? true
+, ignoreCompilationError ? false
 , ...
 }@args:
 
@@ -86,10 +86,16 @@ libBuildHelper.extendMkDerivation' stdenv.mkDerivation (finalAttrs:
     source ${./emacs-funcs.sh}
     addEmacsVars "$out"
 
-    find $out/share/emacs -type f -name '*.el' -print0 \
+    # package-activate-all is used to activate packages.  In other builder
+    # helpers, package-initialize is used for this purpose because
+    # package-activate-all is not available before Emacs 27.
+    find $out/share/emacs -type f -name '*.el' -not -name ".dir-locals.el" -print0 \
       | xargs --verbose -0 -I {} -n 1 -P $NIX_BUILD_CORES sh -c \
           "emacs \
              --batch \
+             -f package-activate-all \
+             --eval '(setq native-comp-eln-load-path (cdr native-comp-eln-load-path))' \
+             --eval '(let ((default-directory \"$out/share/emacs/site-lisp\")) (normal-top-level-add-subdirs-to-load-path))' \
              --eval '(setq large-file-warning-threshold nil)' \
              --eval '(setq byte-compile-error-on-warn ${if finalAttrs.turnCompilationWarningToError then "t" else "nil"})' \
              -f batch-native-compile {} \

pkgs/applications/editors/emacs/build-support/melpa.nix

@@ -12,8 +12,8 @@ let
     src = fetchFromGitHub {
       owner = "melpa";
       repo = "package-build";
-      rev = "c48aa078c01b4f07b804270c4583a0a58ffea1c0";
-      sha256 = "sha256-MzPj375upIiYXdQR+wWXv3A1zMqbSrZlH0taLuxx/1M=";
+      rev = "d5661f1f1996a893fbcbacb4d290c57acab4fb0e";
+      hash = "sha256-zVhFR2kLLkCKC+esPBbIk3qOa033YND1HF9GiNI4JM8=";
     };
 
     patches = [ ./package-build-dont-use-mtime.patch ];

pkgs/applications/editors/emacs/build-support/melpa2nix.el

@@ -1,6 +1,3 @@
-(require 'package)
-(package-initialize)
-
 (require 'package-recipe)
 (require 'package-build)
 

pkgs/applications/editors/emacs/build-support/trivial.nix

@@ -19,7 +19,7 @@ args:
       foundMakefile=1
     fi
 
-    emacs -L . --batch -f batch-byte-compile *.el
+    emacs -l package -f package-initialize -L . --batch -f batch-byte-compile *.el
 
     runHook postBuild
   '';

pkgs/applications/editors/emacs/elisp-packages/lib-override-helper.nix

@@ -25,4 +25,14 @@ rec {
         broken = true;
       };
     });
+
+  mkHome =
+    pkg:
+    pkg.overrideAttrs (previousAttrs: {
+      preInstall =
+        ''
+          HOME=$(mktemp -d)
+        ''
+        + previousAttrs.preInstall or "";
+    });
 }

pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json

@@ -123226,8 +123226,8 @@
  },
  {
   "ename": "ttl-mode",
-  "commit": "0575169e8fb9a2537582f5aa77fc9950f1f1384c",
-  "sha256": "1fi8xxzwz3h7kgn69h4p1wlvhvia0v8qqh7k64pgh44b2fq040p1",
+  "commit": "8a7d0c7287d157f45ebcb7a6ba2a776b3ee2bc2d",
+  "sha256": "1v34axc96n5aqsm9w2j94z8h9mqfa41300lx8aqccwj8a5qwk90k",
   "fetcher": "github",
   "repo": "nxg/ttl-mode",
   "unstable": {

pkgs/applications/editors/vim/macvim.nix

@@ -8,7 +8,7 @@
 , cscope
 , ruby_3_2
 , tcl
-, perl536
+, perl540
 , luajit
 , darwin
 , libiconv
@@ -17,8 +17,7 @@
 
 # Try to match MacVim's documented script interface compatibility
 let
-  # Perl 5.30 - closest we get is 5.36. 5.38 is currently failing
-  perl = perl536;
+  perl = perl540;
   # Ruby 3.2
   ruby = ruby_3_2;
 
@@ -35,13 +34,13 @@ in
 stdenv.mkDerivation (finalAttrs: {
   pname = "macvim";
 
-  version = "178";
+  version = "179";
 
   src = fetchFromGitHub {
     owner = "macvim-dev";
     repo = "macvim";
     rev = "release-${finalAttrs.version}";
-    hash = "sha256-JYh5fyaYuME/Lk67vrf1hYOIcAkEbwtslcnI9KRzHa8=";
+    hash = "sha256-L9LVXyeA09aMtNf+b/Oo+eLpeVEKTD1/oNWCiFn5FbU=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/plugins/neovim-require-check-hook.sh

@@ -10,12 +10,12 @@ neovimRequireCheckHook () {
 		# editorconfig-checker-disable
         export HOME="$TMPDIR"
         @nvimBinary@ -es --headless -n -u NONE -i NONE --clean -V1 \
-            --cmd "set rtp+=$out,${dependencies/ /,}" \
+            --cmd "set rtp+=$out,${dependencies// /,}" \
             --cmd "lua require('$nvimRequireCheck')"
     fi
 }
 
 echo "Using neovimRequireCheckHook"
-preDistPhases+=" neovimRequireCheckHook"
+appendToVar preDistPhases neovimRequireCheckHook
 
 

pkgs/applications/editors/vim/plugins/vim-command-check-hook.sh

@@ -21,5 +21,5 @@ vimCommandCheckHook () {
 }
 
 echo "Using vimCommandCheckHook"
-preDistPhases+=" vimCommandCheckHook"
+appendToVar preDistPhases vimCommandCheckHook
 

pkgs/applications/emulators/retroarch/default.nix

@@ -8,7 +8,7 @@
 , alsa-lib
 , dbus
 , fetchFromGitHub
-, ffmpeg_7
+, ffmpeg
 , flac
 , freetype
 , gamemode
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     lib.optional (runtimeLibs != [ ]) makeWrapper;
 
   buildInputs = [
-    ffmpeg_7
+    ffmpeg
     flac
     freetype
     libGL

pkgs/applications/graphics/gimp/default.nix

@@ -168,7 +168,11 @@ in stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
 
   env = {
-    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-DGDK_OSX_BIG_SUR=16";
+    NIX_CFLAGS_COMPILE = toString (
+      [ ]
+      ++ lib.optionals stdenv.cc.isGNU [ "-Wno-error=incompatible-pointer-types" ]
+      ++ lib.optionals stdenv.isDarwin [ "-DGDK_OSX_BIG_SUR=16" ]
+    );
 
     # Check if librsvg was built with --disable-pixbuf-loader.
     PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = "${librsvg}/${gdk-pixbuf.moduleDir}";

pkgs/applications/graphics/gimp/plugins/default.nix

@@ -17,7 +17,7 @@ let
   pluginDerivation = attrs: let
     name = attrs.name or "${attrs.pname}-${attrs.version}";
   in stdenv.mkDerivation ({
-    prePhases = "extraLib";
+    prePhases = [ "extraLib" ];
     extraLib = ''
       installScripts(){
         mkdir -p $out/${gimp.targetScriptDir}/${name};
@@ -54,7 +54,7 @@ let
   });
 
   scriptDerivation = {src, ...}@attrs : pluginDerivation ({
-    prePhases = "extraLib";
+    prePhases = [ "extraLib" ];
     dontUnpack = true;
     installPhase = ''
       runHook preInstall

pkgs/applications/graphics/openboard/default.nix

@@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub, fetchpatch2, copyDesktopItems, makeDesktopItem, qmake
 , qtbase, qtxmlpatterns, qttools, qtwebengine, libGL, fontconfig, openssl, poppler, wrapQtAppsHook
-, ffmpeg_7, libva, alsa-lib, SDL, x264, libvpx, libvorbis, libtheora, libogg
+, ffmpeg, libva, alsa-lib, SDL, x264, libvpx, libvorbis, libtheora, libogg
 , libopus, lame, fdk_aac, libass, quazip, libXext, libXfixes }:
 
 let
@@ -68,7 +68,7 @@ in stdenv.mkDerivation (finalAttrs: {
     fontconfig
     openssl
     poppler
-    ffmpeg_7
+    ffmpeg
     libva
     alsa-lib
     SDL

pkgs/applications/kde/ffmpegthumbs.nix

@@ -1,7 +1,7 @@
 {
   mkDerivation, lib,
   extra-cmake-modules,
-  ffmpeg_7, kio, taglib
+  ffmpeg, kio, taglib
 }:
 
 mkDerivation {
@@ -11,5 +11,5 @@ mkDerivation {
     maintainers = [ lib.maintainers.ttuegel ];
   };
   nativeBuildInputs = [ extra-cmake-modules ];
-  buildInputs = [ ffmpeg_7 kio taglib ];
+  buildInputs = [ ffmpeg kio taglib ];
 }

pkgs/applications/misc/mupdf/0002-Add-Darwin-deps.patch

@@ -1,57 +0,0 @@
-From 0f0ccfc01cfe72d96eafee57ec6c5107f09c7238 Mon Sep 17 00:00:00 2001
-From: toonn <toonn@toonn.io>
-Date: Wed, 9 Mar 2022 00:08:28 +0100
-Subject: [PATCH 2/2] Add Darwin deps
-
----
- Makerules | 34 ++++++++++++++++++++++++++++++++++
- 1 file changed, 34 insertions(+)
-
-diff --git a/Makerules b/Makerules
-index 6d52cca..a6bd0ed 100644
---- a/Makerules
-+++ b/Makerules
-@@ -153,6 +153,40 @@ else ifeq ($(OS),MACOS)
- 	  LIBCRYPTO_CFLAGS := $(shell pkg-config --cflags libcrypto) -DHAVE_LIBCRYPTO
- 	  LIBCRYPTO_LIBS := $(shell pkg-config --libs libcrypto)
-     endif
-+    # Required for mupdf-gl
-+    ifeq ($(shell pkg-config --exists harfbuzz && echo yes),yes)
-+          SYS_HARFBUZZ_CFLAGS := $(shell pkg-config --cflags harfbuzz)
-+          SYS_HARFBUZZ_LIBS := $(shell pkg-config --libs harfbuzz)
-+    endif
-+    ifeq ($(shell pkg-config --exists libopenjp2 && echo yes),yes)
-+          SYS_OPENJPEG_CFLAGS := $(shell pkg-config --cflags libopenjp2)
-+          SYS_OPENJPEG_LIBS := $(shell pkg-config --libs libopenjp2)
-+    endif
-+    ifeq ($(shell pkg-config --exists freetype2 && echo yes),yes)
-+          SYS_FREETYPE_CFLAGS := $(shell pkg-config --cflags freetype2)
-+          SYS_FREETYPE_LIBS := $(shell pkg-config --libs freetype2)
-+    endif
-+    ifeq ($(shell pkg-config --exists gumbo && echo yes),yes)
-+          SYS_GUMBO_CFLAGS := $(shell pkg-config --cflags gumbo)
-+          SYS_GUMBO_LIBS := $(shell pkg-config --libs gumbo)
-+    endif
-+    # Required for mupdf-x11
-+    HAVE_X11 := $(shell pkg-config --exists x11 xext && echo yes)
-+    ifeq ($(HAVE_X11),yes)
-+          X11_CFLAGS := $(shell pkg-config --cflags x11 xext)
-+          X11_LIBS := $(shell pkg-config --libs x11 xext)
-+    endif
-+    # Required for mupdf-x11-curl
-+    HAVE_SYS_CURL := $(shell pkg-config --exists libcurl && echo yes)
-+    ifeq ($(HAVE_SYS_CURL),yes)
-+          SYS_CURL_CFLAGS := $(shell pkg-config --cflags libcurl)
-+          SYS_CURL_LIBS := $(shell pkg-config --libs libcurl)
-+    endif
-+    HAVE_PTHREAD := yes
-+    ifeq ($(HAVE_PTHREAD),yes)
-+          PTHREAD_CFLAGS :=
-+          PTHREAD_LIBS := -lpthread
-+    endif
-   endif
- 
- else ifeq ($(OS),Linux)
--- 
-2.17.2 (Apple Git-113)
-

pkgs/applications/misc/mupdf/default.nix

@@ -59,18 +59,23 @@ let
   });
 
 in
+
 stdenv.mkDerivation rec {
-  version = "1.24.8";
+  version = "1.24.9";
   pname = "mupdf";
 
   src = fetchurl {
     url = "https://mupdf.com/downloads/archive/${pname}-${version}-source.tar.gz";
-    hash = "sha256-pRjZvpds2yAG1FOC1/+xubjWS8P9PLc8picNdS+n9Eg=";
+    hash = "sha256-C0RqoO7MEU6ZadzNcMl4k1j8y2WJqB1HDclBoIdNqYo=";
   };
 
   patches = [
-    ./0002-Add-Darwin-deps.patch
-    ./0003-Fix-cpp-build.patch
+    # Upstream makefile does not work with system deps on macOS by default, so
+    # we reuse the Linux section instead.
+    ./fix-darwin-system-deps.patch
+    # Upstream C++ wrap script only defines fixed-sized integers on macOS but
+    # this is required on aarch64-linux too.
+    ./fix-cpp-build.patch
   ];
 
   postPatch = ''
@@ -99,7 +104,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ]
     ++ lib.optional (enableGL || enableX11) copyDesktopItems
     ++ lib.optional (stdenv.isDarwin && (enableGL || enableX11)) desktopToDarwinBundle
-    ++ lib.optionals (enableCxx || enablePython) [ python3 python3.pkgs.setuptools python3.pkgs.libclang ]
+    ++ lib.optionals (enableCxx || enablePython) [ (python3.pythonOnBuildForHost.withPackages (ps: [ ps.setuptools ps.libclang ])) ]
     ++ lib.optionals (enablePython) [ which swig ]
     ++ lib.optionals stdenv.isDarwin [ fixDarwinDylibNames xcbuild ];
 
@@ -114,6 +119,7 @@ stdenv.mkDerivation rec {
     )
     ++ lib.optionals enableOcr [ leptonica tesseract ]
   ;
+
   outputs = [ "bin" "dev" "out" "man" "doc" ];
 
   preConfigure = ''
@@ -166,7 +172,6 @@ stdenv.mkDerivation rec {
     EOF
 
     moveToOutput "bin" "$bin"
-    cp ./build/shared-release/libmupdf${stdenv.hostPlatform.extensions.sharedLibrary}* $out/lib
   '' + (lib.optionalString (stdenv.isDarwin) ''
     for exe in $bin/bin/*; do
       install_name_tool -change build/shared-release/libmupdf.dylib $out/lib/libmupdf.dylib "$exe"
@@ -180,17 +185,19 @@ stdenv.mkDerivation rec {
     ln -s "$bin/bin/mupdf-x11" "$bin/bin/mupdf"
   '') + (lib.optionalString (enableCxx) ''
     cp platform/c++/include/mupdf/*.h $out/include/mupdf
-    cp build/*/libmupdfcpp.so* $out/lib
+    cp build/*/libmupdfcpp.so $out/lib
   '') + (lib.optionalString (enablePython) (''
     mkdir -p $out/${python3.sitePackages}/mupdf
-    cp build/*/_mupdf.so $out/${python3.sitePackages}
+    cp build/*/_mupdf.so $out/${python3.sitePackages}/mupdf
     cp build/*/mupdf.py $out/${python3.sitePackages}/mupdf/__init__.py
   '' + lib.optionalString (stdenv.isDarwin) ''
-    install_name_tool -add_rpath $out/lib $out/${python3.sitePackages}/_mupdf.so
+    install_name_tool -add_rpath $out/lib $out/${python3.sitePackages}/mupdf/_mupdf.so
   ''));
 
   enableParallelBuilding = true;
 
+  env.USE_SONAME = "no";
+
   passthru = {
     tests = {
       inherit cups-filters zathura;
@@ -212,8 +219,5 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ fpletz ];
     platforms = platforms.unix;
     mainProgram = "mupdf";
-    # ImportError: cannot import name '_mupdf' from partially initialized module 'mupdf'
-    # (most likely due to a circular import)
-    broken = enablePython;
   };
 }

pkgs/applications/misc/mupdf/fix-darwin-system-deps.patch

@@ -0,0 +1,60 @@
+diff --git a/Makerules b/Makerules
+index f582dc061..2da5680b6 100644
+--- a/Makerules
++++ b/Makerules
+@@ -178,39 +178,20 @@ ifneq "$(CLUSTER)" ""
+ endif
+ 
+ ifeq ($(OS),Linux)
+-    LINUX_OR_OPENBSD := yes
++    LINUX_OR_OPENBSD_OR_MACOS := yes
+ endif
+ ifeq ($(OS),OpenBSD)
+-    LINUX_OR_OPENBSD := yes
++    LINUX_OR_OPENBSD_OR_MACOS := yes
++endif
++ifeq ($(OS),MACOS)
++    LINUX_OR_OPENBSD_OR_MACOS := yes
+ endif
+ 
+ ifeq ($(OS),MINGW)
+   WINDRES := windres
+   HAVE_WIN32 := yes
+ 
+-else ifeq ($(OS),MACOS)
+-  HAVE_GLUT := yes
+-  SYS_GLUT_CFLAGS := -Wno-deprecated-declarations
+-  SYS_GLUT_LIBS := -framework GLUT -framework OpenGL
+-  CC = xcrun cc
+-  AR = xcrun ar
+-  LD = xcrun ld
+-  RANLIB = xcrun ranlib
+-
+-  ifneq ($(ARCHFLAGS),)
+-    $(warning "MacOS with ARCHFLAGS set. Assuming we are building for arm64, and setting HAVE_LIBCRYPTO to no.")
+-    HAVE_LIBCRYPTO := no
+-  else ifeq (, $(shell command -v pkg-config))
+-    $(warning "No pkg-config found, install it for proper integration of libcrypto")
+-  else
+-    HAVE_LIBCRYPTO := $(shell pkg-config --exists 'libcrypto >= 1.1.0' && echo yes)
+-    ifeq ($(HAVE_LIBCRYPTO),yes)
+-	  LIBCRYPTO_CFLAGS := $(shell pkg-config --cflags libcrypto) -DHAVE_LIBCRYPTO
+-	  LIBCRYPTO_LIBS := $(shell pkg-config --libs libcrypto)
+-    endif
+-  endif
+-
+-else ifeq ($(LINUX_OR_OPENBSD),yes)
++else ifeq ($(LINUX_OR_OPENBSD_OR_MACOS),yes)
+ 
+   ifeq ($(OS),Linux)
+     HAVE_OBJCOPY := yes
+@@ -274,6 +255,9 @@ else ifeq ($(LINUX_OR_OPENBSD),yes)
+     ifeq ($(OS),OpenBSD)
+       SYS_GLUT_CFLAGS := $(shell pkg-config --cflags glut gl)
+       SYS_GLUT_LIBS := $(shell pkg-config --libs glut gl)
++    else ifeq ($(OS),MACOS)
++      SYS_GLUT_CFLAGS := -Wno-deprecated-declarations
++      SYS_GLUT_LIBS := -framework GLUT -framework OpenGL
+     else
+       SYS_GLUT_CFLAGS :=
+       SYS_GLUT_LIBS := -lglut -lGL

pkgs/applications/misc/ola/default.nix

@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     python3
   ];
   propagatedBuildInputs = [
-    (python3.pkgs.protobuf.override { protobuf = protobuf; })
+    (python3.pkgs.protobuf4.override { protobuf = protobuf; })
     python3.pkgs.numpy
   ];
 

pkgs/applications/networking/browsers/lynx/default.nix

@@ -46,6 +46,10 @@ stdenv.mkDerivation rec {
     nuke-refs cfg_defs.h
   '';
 
+  env = lib.optionalAttrs stdenv.cc.isGNU {
+    NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+  };
+
   meta = with lib; {
     description = "Text-mode web browser";
     homepage = "https://lynx.invisible-island.net/";

pkgs/applications/networking/instant-messengers/jackline/default.nix

@@ -15,7 +15,7 @@ buildDunePackage rec {
     hash = "sha256-G2jjsc/i9Qgo0TP+ZE4gB/1cjuZ9l8R7e59K2DGD5GY=";
   };
 
-  nativeBuildInpts = [
+  nativeBuildInputs = [
     ppx_sexp_conv
     ppx_deriving
   ];

pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/tg_owt.nix

@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch2
 , pkg-config
 , cmake
 , ninja
@@ -42,6 +43,18 @@ stdenv.mkDerivation {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # Remove usage of AVCodecContext::reordered_opaque
+    (fetchpatch2 {
+      name = "webrtc-ffmpeg-7.patch";
+      url = "https://webrtc.googlesource.com/src/+/e7d10047096880feb5e9846375f2da54aef91202%5E%21/?format=TEXT";
+      decode = "base64 -d";
+      stripLen = 1;
+      extraPrefix = "src/";
+      hash = "sha256-EdwHeVko8uDsP5GTw2ryWiQgRVCAdPc1me6hySdiwMU=";
+    })
+  ];
+
   postPatch = lib.optionalString stdenv.isLinux ''
     substituteInPlace src/modules/desktop_capture/linux/wayland/egl_dmabuf.cc \
       --replace '"libEGL.so.1"' '"${libGL}/lib/libEGL.so.1"' \

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   pkg-config,
   cmake,
   crc32c,
@@ -41,6 +42,18 @@ stdenv.mkDerivation {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # Remove usage of AVCodecContext::reordered_opaque
+    (fetchpatch2 {
+      name = "webrtc-ffmpeg-7.patch";
+      url = "https://webrtc.googlesource.com/src/+/e7d10047096880feb5e9846375f2da54aef91202%5E%21/?format=TEXT";
+      decode = "base64 -d";
+      stripLen = 1;
+      extraPrefix = "src/";
+      hash = "sha256-EdwHeVko8uDsP5GTw2ryWiQgRVCAdPc1me6hySdiwMU=";
+    })
+  ];
+
   outputs = [
     "out"
     "dev"

pkgs/applications/science/molecular-dynamics/raspa/data.nix

@@ -1,6 +1,5 @@
 { lib
 , stdenvNoCC
-, gzip
 , raspa
 }:
 
@@ -10,8 +9,6 @@ stdenvNoCC.mkDerivation rec {
 
   outputs = [ "out" "doc" ];
 
-  nativeBuildInpuhs = [ gzip ];
-
   installPhase = ''
     runHook preInstall
     mkdir -p "$out/share/raspa"

pkgs/applications/science/networking/sumo/default.nix

@@ -1,4 +1,4 @@
-{ lib, bzip2, cmake, eigen, fetchFromGitHub, ffmpeg_7, fox_1_6, gdal,
+{ lib, bzip2, cmake, eigen, fetchFromGitHub, ffmpeg, fox_1_6, gdal,
   git, gl2ps, gpp , gtest, jdk, libGL, libGLU, libX11, libjpeg,
   libpng, libtiff, libxcrypt, openscenegraph , proj, python3,
   python3Packages, stdenv, swig, xercesc, xorg, zlib }:
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     bzip2
     eigen
-    ffmpeg_7
+    ffmpeg
     fox_1_6
     gdal
     gl2ps

pkgs/applications/terminal-emulators/xterm/default.nix

@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   pname = "xterm";
-  version = "393";
+  version = "394";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/xterm/${pname}-${version}.tgz"
       "https://invisible-mirror.net/archives/xterm/${pname}-${version}.tgz"
     ];
-    hash = "sha256-3Dq/Uz1mrj20nmeDsOHinw5NBFtLPax5el6Tvic17Hs=";
+    hash = "sha256-oqDLIG6wQj3tw0eU9cLTjIM5DS3REGtmq6CWDDqXbHo=";
   };
 
   patches = [ ./sixel-256.support.patch ];

pkgs/applications/version-management/git/default.nix

@@ -29,7 +29,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.46.0";
+  version = "2.46.1";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    hash = "sha256-fxI0YqKLfKPr4mB0hfcWhVTCsQ38FVx+xGMAZmrCf5U=";
+    hash = "sha256-iIyvuL1qtMu+vBaAQKiFDrCI+B3DrCYXGVz8CHfw9UM=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";

pkgs/applications/video/mplayer/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, stdenv, fetchurl, fetchsvn, pkg-config, freetype, yasm, ffmpeg_7
+{ config, lib, stdenv, fetchurl, fetchsvn, pkg-config, freetype, yasm, ffmpeg
 , aalibSupport ? true, aalib
 , fontconfigSupport ? true, fontconfig, freefont_ttf
 , fribidiSupport ? true, fribidi
@@ -86,7 +86,7 @@ stdenv.mkDerivation rec {
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ pkg-config yasm ];
-  buildInputs = [ freetype ffmpeg_7 ]
+  buildInputs = [ freetype ffmpeg ]
     ++ lib.optional aalibSupport aalib
     ++ lib.optional fontconfigSupport fontconfig
     ++ lib.optional fribidiSupport fribidi

pkgs/applications/video/obs-studio/default.nix

@@ -162,6 +162,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=sign-compare" # https://github.com/obsproject/obs-studio/issues/10200
+    "-Wno-error=stringop-overflow="
   ];
 
   dontWrapGApps = true;

pkgs/applications/video/simplescreenrecorder/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, mkDerivation, fetchFromGitHub, alsa-lib, ffmpeg_7, libjack2, libX11, libXext, libXinerama, qtx11extras
+{ lib, stdenv, mkDerivation, fetchFromGitHub, alsa-lib, ffmpeg, libjack2, libX11, libXext, libXinerama, qtx11extras
 , libXfixes, libGLU, libGL, pkg-config, libpulseaudio, libv4l, qtbase, qttools, cmake, ninja, nix-update-script
 }:
 
@@ -29,7 +29,7 @@ mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config cmake ninja ];
   buildInputs = [
-    alsa-lib ffmpeg_7 libjack2 libX11 libXext libXfixes libXinerama libGLU libGL
+    alsa-lib ffmpeg libjack2 libX11 libXext libXfixes libXinerama libGLU libGL
     libpulseaudio libv4l qtbase qttools qtx11extras
   ];
 

pkgs/applications/video/webcamoid/default.nix

@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub, fetchpatch2, pkg-config, libxcb, mkDerivation, cmake
 , qtbase, qtdeclarative, qtquickcontrols, qtquickcontrols2
-, ffmpeg_7, gst_all_1, libpulseaudio, alsa-lib, jack2
+, ffmpeg, gst_all_1, libpulseaudio, alsa-lib, jack2
 , v4l-utils }:
 mkDerivation rec {
   pname = "webcamoid";
@@ -24,7 +24,7 @@ mkDerivation rec {
   buildInputs = [
     libxcb
     qtbase qtdeclarative qtquickcontrols qtquickcontrols2
-    ffmpeg_7
+    ffmpeg
     gst_all_1.gstreamer gst_all_1.gst-plugins-base
     alsa-lib libpulseaudio jack2
     v4l-utils

pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix

@@ -208,7 +208,7 @@ let
     chmod u+w -R lib64/
 
     # symlink 32-bit ld-linux.so
-    ln -Ls ${staticUsrProfileTarget}/lib/32/ld-linux.so.2 lib/
+    ln -Lsf ${staticUsrProfileTarget}/lib/32/ld-linux.so.2 lib/
   '';
 
   setupLibDirs = if isTargetBuild

pkgs/build-support/buildenv/builder.pl

@@ -255,6 +255,21 @@ while (scalar(keys %postponed) > 0) {
     }
 }
 
+my $extraPathsFilePath = $ENV{"extraPathsFrom"};
+if ($extraPathsFilePath) {
+    open FILE, $extraPathsFilePath or die "cannot open extra paths file $extraPathsFilePath: $!";
+
+    while(my $line = <FILE>) {
+        chomp $line;
+        addPkg($line,
+               $ENV{"ignoreCollisions"} eq "1",
+               $ENV{"checkCollisionContents"} eq "1",
+               1000)
+            if -d $line;
+    }
+
+    close FILE;
+}
 
 # Create the symlinks.
 my $nrLinks = 0;

pkgs/build-support/buildenv/default.nix

@@ -1,7 +1,7 @@
 # buildEnv creates a tree of symlinks to the specified paths.  This is
 # a fork of the hardcoded buildEnv in the Nix distribution.
 
-{ buildPackages, runCommand, lib, substituteAll }:
+{ buildPackages, runCommand, lib, substituteAll, writeClosure }:
 
 let
   builder = substituteAll {
@@ -23,6 +23,9 @@ lib.makeOverridable
 , # Whether to ignore collisions or abort.
   ignoreCollisions ? false
 
+, # Whether to include closures of all input paths.
+  includeClosures ? false
+
 , # If there is a collision, check whether the contents and permissions match
   # and only if not, throw a collision error.
   checkCollisionContents ? true
@@ -49,27 +52,35 @@ lib.makeOverridable
 , passthru ? {}
 , meta ? {}
 }:
+let
+  chosenOutputs = map (drv: {
+    paths =
+      # First add the usual output(s): respect if user has chosen explicitly,
+      # and otherwise use `meta.outputsToInstall`. The attribute is guaranteed
+      # to exist in mkDerivation-created cases. The other cases (e.g. runCommand)
+      # aren't expected to have multiple outputs.
+      (if (! drv ? outputSpecified || ! drv.outputSpecified)
+          && drv.meta.outputsToInstall or null != null
+        then map (outName: drv.${outName}) drv.meta.outputsToInstall
+        else [ drv ])
+      # Add any extra outputs specified by the caller of `buildEnv`.
+      ++ lib.filter (p: p!=null)
+        (builtins.map (outName: drv.${outName} or null) extraOutputsToInstall);
+    priority = drv.meta.priority or lib.meta.defaultPriority;
+  }) paths;
 
-runCommand name
+  pathsForClosure = lib.pipe chosenOutputs [
+    (map (p: p.paths))
+    lib.flatten
+    (lib.remove null)
+  ];
+in runCommand name
   rec {
     inherit manifest ignoreCollisions checkCollisionContents passthru
             meta pathsToLink extraPrefix postBuild
             nativeBuildInputs buildInputs;
-    pkgs = builtins.toJSON (map (drv: {
-      paths =
-        # First add the usual output(s): respect if user has chosen explicitly,
-        # and otherwise use `meta.outputsToInstall`. The attribute is guaranteed
-        # to exist in mkDerivation-created cases. The other cases (e.g. runCommand)
-        # aren't expected to have multiple outputs.
-        (if (! drv ? outputSpecified || ! drv.outputSpecified)
-            && drv.meta.outputsToInstall or null != null
-          then map (outName: drv.${outName}) drv.meta.outputsToInstall
-          else [ drv ])
-        # Add any extra outputs specified by the caller of `buildEnv`.
-        ++ lib.filter (p: p!=null)
-          (builtins.map (outName: drv.${outName} or null) extraOutputsToInstall);
-      priority = drv.meta.priority or lib.meta.defaultPriority;
-    }) paths);
+    pkgs = builtins.toJSON chosenOutputs;
+    extraPathsFrom = lib.optional includeClosures (writeClosure pathsForClosure);
     preferLocalBuild = true;
     allowSubstitutes = false;
     # XXX: The size is somewhat arbitrary

pkgs/build-support/coq/default.nix

@@ -146,7 +146,7 @@ stdenv.mkDerivation (removeAttrs ({
 })
 // (optionalAttrs (args?useMelquiondRemake) rec {
   COQUSERCONTRIB = "$out/lib/coq/${coq.coq-version}/user-contrib";
-  preConfigurePhases = "autoconf";
+  preConfigurePhases = [ "autoconf" ];
   configureFlags = [ "--libdir=${COQUSERCONTRIB}/${useMelquiondRemake.logpath or ""}" ];
   buildPhase = "./remake -j$NIX_BUILD_CORES";
   installPhase = "./remake install";

pkgs/build-support/make-darwin-bundle/default.nix

@@ -22,5 +22,5 @@ writeShellScript "make-darwin-bundle-${name}" (''
     ${writeDarwinBundle}/bin/write-darwin-bundle "''${!outputBin}" "${name}" "${exec}"
   }
 
-  preDistPhases+=" makeDarwinBundlePhase"
+  appendToVar preDistPhases makeDarwinBundlePhase
 '')

pkgs/build-support/release/binary-tarball.nix

@@ -24,7 +24,7 @@ stdenv.mkDerivation (
 
     prefix = "/usr/local";
 
-    postPhases = "finalPhase";
+    postPhases = [ "finalPhase" ];
   }
 
   // args //

pkgs/build-support/release/debian-build.nix

@@ -18,7 +18,7 @@ vmTools.runInLinuxImage (stdenv.mkDerivation (
 
     prefix = "/usr";
 
-    prePhases = "installExtraDebsPhase sysInfoPhase";
+    prePhases = [ "installExtraDebsPhase" "sysInfoPhase" ];
   }
 
   // removeAttrs args ["vmTools" "lib"] //

pkgs/build-support/release/source-tarball.nix

@@ -31,8 +31,8 @@ stdenv.mkDerivation (
 
     showBuildStats = true;
 
-    preConfigurePhases = "autoconfPhase";
-    postPhases = "finalPhase";
+    preConfigurePhases = [ "autoconfPhase" ];
+    postPhases = [ "finalPhase" ];
 
     # Autoconfiscate the sources.
     autoconfPhase = ''

pkgs/build-support/rust/build-rust-package/default.nix

@@ -151,23 +151,10 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoUpdateHook" "carg
   strictDeps = true;
 
   meta = meta // {
-    badPlatforms = meta.badPlatforms or [] ++ [
-      # Rust is currently unable to target the n32 ABI
-      lib.systems.inspect.patterns.isMips64n32
-    ];
-  } // lib.optionalAttrs (rustc.meta ? platforms) {
+    badPlatforms = meta.badPlatforms or [] ++ rustc.badTargetPlatforms;
     # default to Rust's platforms
     platforms = lib.intersectLists
       meta.platforms or lib.platforms.all
-      (rustc.meta.platforms ++ [
-        # Platforms without host tools from
-        # https://doc.rust-lang.org/nightly/rustc/platform-support.html
-        "armv7a-darwin"
-        "armv5tel-linux" "armv7a-linux" "m68k-linux" "mips-linux"
-        "mips64-linux" "mipsel-linux" "mips64el-linux" "riscv32-linux"
-        "armv6l-netbsd" "mipsel-netbsd" "riscv64-netbsd"
-        "x86_64-redox"
-        "wasm32-wasi"
-      ]);
+      rustc.targetPlatforms;
   };
 })

pkgs/build-support/rust/fetch-cargo-tarball/default.nix

@@ -136,7 +136,7 @@ stdenv.mkDerivation (
 
       # Packages with git dependencies generate non-default cargo configs, so
       # always install it rather than trying to write a standard default template.
-      install -D $CARGO_CONFIG $name/.cargo/config;
+      install -D $CARGO_CONFIG $name/.cargo/config
 
       runHook postBuild
     '';

pkgs/build-support/rust/hooks/cargo-build-hook.sh

@@ -1,4 +1,4 @@
-declare -a cargoBuildFlags
+# shellcheck shell=bash disable=SC2154,SC2164
 
 cargoBuildHook() {
     echo "Executing cargoBuildHook"
@@ -9,44 +9,38 @@ cargoBuildHook() {
     # separateDebugInfo.
     export "CARGO_PROFILE_${cargoBuildType@U}_STRIP"=false
 
-    if [ ! -z "${buildAndTestSubdir-}" ]; then
+    if [ -n "${buildAndTestSubdir-}" ]; then
         # ensure the output doesn't end up in the subdirectory
-        export CARGO_TARGET_DIR="$(pwd)/target"
+        CARGO_TARGET_DIR="$(pwd)/target"
+        export CARGO_TARGET_DIR
 
         pushd "${buildAndTestSubdir}"
     fi
 
+    local flagsArray=(
+        "-j" "$NIX_BUILD_CORES"
+        "--target" "@rustHostPlatformSpec@"
+        "--offline"
+    )
+
     if [ "${cargoBuildType}" != "debug" ]; then
-        cargoBuildProfileFlag="--profile ${cargoBuildType}"
+        flagsArray+=("--profile" "${cargoBuildType}")
     fi
 
     if [ -n "${cargoBuildNoDefaultFeatures-}" ]; then
-        cargoBuildNoDefaultFeaturesFlag=--no-default-features
+        flagsArray+=("--no-default-features")
     fi
 
     if [ -n "${cargoBuildFeatures-}" ]; then
-        if [ -n "$__structuredAttrs" ]; then
-            OLDIFS="$IFS"
-            IFS=','; cargoBuildFeaturesFlag="--features=${cargoBuildFeatures[*]}"
-            IFS="$OLDIFS"
-            unset OLDIFS
-        else
-            cargoBuildFeaturesFlag="--features=${cargoBuildFeatures// /,}"
-        fi
+        flagsArray+=("--features=$(concatStringsSep "," cargoBuildFeatures)")
     fi
 
-    (
-    set -x
-    @setEnv@ cargo build -j $NIX_BUILD_CORES \
-        --target @rustHostPlatformSpec@ \
-        --offline \
-        ${cargoBuildProfileFlag} \
-        ${cargoBuildNoDefaultFeaturesFlag} \
-        ${cargoBuildFeaturesFlag} \
-        ${cargoBuildFlags}
-    )
+    concatTo flagsArray cargoBuildFlags
 
-    if [ ! -z "${buildAndTestSubdir-}" ]; then
+    echoCmd 'cargoBuildHook flags' "${flagsArray[@]}"
+    @setEnv@ cargo build "${flagsArray[@]}"
+
+    if [ -n "${buildAndTestSubdir-}" ]; then
         popd
     fi
 

pkgs/build-support/rust/hooks/cargo-check-hook.sh

@@ -1,5 +1,4 @@
-declare -a checkFlags
-declare -a cargoTestFlags
+# shellcheck shell=bash disable=SC2154,SC2164
 
 cargoCheckHook() {
     echo "Executing cargoCheckHook"
@@ -10,37 +9,37 @@ cargoCheckHook() {
         pushd "${buildAndTestSubdir}"
     fi
 
+    local flagsArray=("-j" "$NIX_BUILD_CORES")
+
     if [[ -z ${dontUseCargoParallelTests-} ]]; then
-        threads=$NIX_BUILD_CORES
+        prependToVar checkFlags "--test-threads=$NIX_BUILD_CORES"
     else
-        threads=1
+        prependToVar checkFlags "--test-threads=1"
     fi
 
     if [ "${cargoCheckType}" != "debug" ]; then
-        cargoCheckProfileFlag="--profile ${cargoCheckType}"
+        flagsArray+=("--profile" "${cargoCheckType}")
     fi
 
     if [ -n "${cargoCheckNoDefaultFeatures-}" ]; then
-        cargoCheckNoDefaultFeaturesFlag=--no-default-features
+        flagsArray+=("--no-default-features")
     fi
 
     if [ -n "${cargoCheckFeatures-}" ]; then
-        cargoCheckFeaturesFlag="--features=${cargoCheckFeatures// /,}"
+        flagsArray+=("--features=$(concatStringsSep "," cargoCheckFeatures)")
     fi
 
-    argstr="${cargoCheckProfileFlag} ${cargoCheckNoDefaultFeaturesFlag} ${cargoCheckFeaturesFlag}
-        --target @rustHostPlatformSpec@ --offline ${cargoTestFlags}"
-
-    (
-        set -x
-        cargo test \
-              -j $NIX_BUILD_CORES \
-              ${argstr} -- \
-              --test-threads=${threads} \
-              ${checkFlags} \
-              ${checkFlagsArray+"${checkFlagsArray[@]}"}
+    flagsArray+=(
+        "--target" "@rustHostPlatformSpec@"
+        "--offline"
     )
 
+    prependToVar checkFlags "--"
+    concatTo flagsArray cargoTestFlags checkFlags checkFlagsArray
+
+    echoCmd 'cargoCheckHook flags' "${flagsArray[@]}"
+    cargo test "${flagsArray[@]}"
+
     if [[ -n "${buildAndTestSubdir-}" ]]; then
         popd
     fi

pkgs/build-support/rust/hooks/cargo-nextest-hook.sh

@@ -1,5 +1,4 @@
-declare -a checkFlags
-declare -a cargoTestFlags
+# shellcheck shell=bash disable=SC2154,SC2164
 
 cargoNextestHook() {
     echo "Executing cargoNextestHook"
@@ -10,35 +9,34 @@ cargoNextestHook() {
         pushd "${buildAndTestSubdir}"
     fi
 
+    local flagsArray=(
+        "--target" "@rustHostPlatformSpec@"
+        "--offline"
+    )
+
     if [[ -z ${dontUseCargoParallelTests-} ]]; then
-        threads=$NIX_BUILD_CORES
+        flagsArray+=("-j" "$NIX_BUILD_CORES")
     else
-        threads=1
+        flagsArray+=("-j" "1")
     fi
 
     if [ "${cargoCheckType}" != "debug" ]; then
-        cargoCheckProfileFlag="--cargo-profile ${cargoCheckType}"
+        flagsArray+=("--cargo-profile" "${cargoCheckType}")
     fi
 
     if [ -n "${cargoCheckNoDefaultFeatures-}" ]; then
-        cargoCheckNoDefaultFeaturesFlag=--no-default-features
+        flagsArray+=("--no-default-features")
     fi
 
     if [ -n "${cargoCheckFeatures-}" ]; then
-        cargoCheckFeaturesFlag="--features=${cargoCheckFeatures// /,}"
+        flagsArray+=("--features=$(concatStringsSep "," cargoCheckFeatures)")
     fi
 
-    argstr="${cargoCheckProfileFlag} ${cargoCheckNoDefaultFeaturesFlag} ${cargoCheckFeaturesFlag}
-        --target @rustHostPlatformSpec@ --offline ${cargoTestFlags}"
+    prependToVar checkFlags "--"
+    concatTo flagsArray cargoTestFlags checkFlags checkFlagsArray
 
-    (
-        set -x
-        cargo nextest run \
-              -j ${threads} \
-              ${argstr} -- \
-              ${checkFlags} \
-              ${checkFlagsArray+"${checkFlagsArray[@]}"}
-    )
+    echoCmd 'cargoNextestHook flags' "${flagsArray[@]}"
+    cargo nextest run "${flagsArray[@]}"
 
     if [[ -n "${buildAndTestSubdir-}" ]]; then
         popd

pkgs/build-support/rust/hooks/cargo-setup-hook.sh

@@ -22,7 +22,7 @@ cargoSetupPostUnpackHook() {
         mkdir .cargo
     fi
 
-    config="$cargoDepsCopy/.cargo/config";
+    config="$cargoDepsCopy/.cargo/config.toml"
     if [[ ! -e $config ]]; then
       config=@defaultConfig@
     fi;
@@ -30,9 +30,9 @@ cargoSetupPostUnpackHook() {
     tmp_config=$(mktemp)
     substitute $config $tmp_config \
       --subst-var-by vendor "$cargoDepsCopy"
-    cat ${tmp_config} >> .cargo/config
+    cat ${tmp_config} >> .cargo/config.toml
 
-    cat >> .cargo/config <<'EOF'
+    cat >> .cargo/config.toml <<'EOF'
     @cargoConfig@
 EOF
 

pkgs/build-support/rust/hooks/maturin-build-hook.sh

@@ -1,3 +1,5 @@
+# shellcheck shell=bash disable=SC2154,SC2164
+
 maturinBuildHook() {
     echo "Executing maturinBuildHook"
 
@@ -6,24 +8,26 @@ maturinBuildHook() {
     # Put the wheel to dist/ so that regular Python tooling can find it.
     local dist="$PWD/dist"
 
-    if [ ! -z "${buildAndTestSubdir-}" ]; then
+    if [ -n "${buildAndTestSubdir-}" ]; then
         pushd "${buildAndTestSubdir}"
     fi
 
-    (
-    set -x
-    @setEnv@ maturin build \
-        --jobs=$NIX_BUILD_CORES \
-        --offline \
-        --target @rustTargetPlatformSpec@ \
-        --manylinux off \
-        --strip \
-        --release \
-        --out "$dist" \
-        ${maturinBuildFlags-}
+    local flagsArray=(
+        "--jobs=$NIX_BUILD_CORES"
+        "--offline"
+        "--target" "@rustTargetPlatformSpec@"
+        "--manylinux" "off"
+        "--strip"
+        "--release"
+        "--out" "$dist"
     )
 
-    if [ ! -z "${buildAndTestSubdir-}" ]; then
+    concatTo flagsArray maturinBuildFlags
+
+    echoCmd 'maturinBuildHook flags' "${flagsArray[@]}"
+    @setEnv@ maturin build "${flagsArray[@]}"
+
+    if [ -n "${buildAndTestSubdir-}" ]; then
         popd
     fi
 

pkgs/build-support/rust/import-cargo-lock.nix

@@ -229,7 +229,7 @@ let
       else "cp $lockFileContentsPath $out/Cargo.lock"
     }
 
-    cat > $out/.cargo/config <<EOF
+    cat > $out/.cargo/config.toml <<EOF
 [source.crates-io]
 replace-with = "vendored-sources"
 
@@ -240,7 +240,7 @@ EOF
     declare -A keysSeen
 
     for registry in ${toString (builtins.attrNames extraRegistries)}; do
-      cat >> $out/.cargo/config <<EOF
+      cat >> $out/.cargo/config.toml <<EOF
 
 [source."$registry"]
 registry = "$registry"
@@ -256,7 +256,7 @@ EOF
         key=$(sed 's/\[source\."\(.*\)"\]/\1/; t; d' < "$crate/.cargo-config")
         if [[ -z ''${keysSeen[$key]} ]]; then
           keysSeen[$key]=1
-          cat "$crate/.cargo-config" >> $out/.cargo/config
+          cat "$crate/.cargo-config" >> $out/.cargo/config.toml
         fi
       fi
     done

pkgs/build-support/rust/rustc-wrapper/default.nix

@@ -30,7 +30,9 @@ runCommand "${rustc-unwrapped.pname}-wrapper-${rustc-unwrapped.version}" {
   };
 
   passthru = {
-    inherit (rustc-unwrapped) pname version src llvm llvmPackages;
+    inherit (rustc-unwrapped)
+      pname version src llvm llvmPackages
+      tier1TargetPlatforms targetPlatforms badTargetPlatforms;
     unwrapped = rustc-unwrapped;
   };
 

pkgs/build-support/setup-hooks/auto-patchelf.sh

@@ -53,19 +53,11 @@ autoPatchelf() {
         esac
     done
 
-    if [ -n "$__structuredAttrs" ]; then
-        local ignoreMissingDepsArray=( "${autoPatchelfIgnoreMissingDeps[@]}" )
-        local appendRunpathsArray=( "${appendRunpaths[@]}" )
-        local runtimeDependenciesArray=( "${runtimeDependencies[@]}" )
-        local patchelfFlagsArray=( "${patchelfFlags[@]}" )
-        local autoPatchelfFlagsArray=( "${autoPatchelfFlags[@]}" )
-    else
-        readarray -td' ' ignoreMissingDepsArray < <(echo -n "$autoPatchelfIgnoreMissingDeps")
-        local appendRunpathsArray=($appendRunpaths)
-        local runtimeDependenciesArray=($runtimeDependencies)
-        local patchelfFlagsArray=($patchelfFlags)
-        local autoPatchelfFlagsArray=($autoPatchelfFlags)
-    fi
+    concatTo ignoreMissingDepsArray autoPatchelfIgnoreMissingDeps
+    concatTo appendRunpathsArray appendRunpaths
+    concatTo runtimeDependenciesArray runtimeDependencies
+    concatTo patchelfFlagsArray patchelfFlags
+    concatTo autoPatchelfFlagsArray autoPatchelfFlags
 
     # Check if ignoreMissingDepsArray contains "1" and if so, replace it with
     # "*", printing a deprecation warning.

pkgs/build-support/setup-hooks/autoreconf.sh

@@ -1,4 +1,4 @@
-preConfigurePhases="${preConfigurePhases:-} autoreconfPhase"
+appendToVar preConfigurePhases autoreconfPhase
 
 autoreconfPhase() {
     runHook preAutoreconf

pkgs/build-support/setup-hooks/enable-coverage-instrumentation.sh

@@ -1,4 +1,4 @@
-postPhases+=" cleanupBuildDir"
+appendToVar postPhases cleanupBuildDir
 
 # Force GCC to build with coverage instrumentation.  Also disable
 # optimisation, since it may confuse things.

pkgs/build-support/setup-hooks/keep-build-tree.sh

@@ -1,4 +1,4 @@
-prePhases+=" moveBuildDir"
+appendToVar prePhases moveBuildDir
 
 moveBuildDir() {
     mkdir -p $out/.build

pkgs/build-support/setup-hooks/make-coverage-analysis-report.sh

@@ -1,4 +1,4 @@
-postPhases+=" coverageReportPhase"
+appendToVar postPhases coverageReportPhase
 
 coverageReportPhase() {
     lcov --directory . --capture --output-file app.info

pkgs/build-support/setup-hooks/move-build-tree.sh

@@ -1,11 +1,11 @@
-prePhases+=" moveBuildDir"
+appendToVar prePhases moveBuildDir
 
 moveBuildDir() {
     mkdir -p $out/.build
     cd $out/.build
 }
 
-postPhases+=" removeBuildDir"
+appendToVar postPhases removeBuildDir
 
 removeBuildDir() {
     rm -rf $out/.build

pkgs/build-support/setup-hooks/update-autotools-gnu-config-scripts.sh

@@ -1,4 +1,4 @@
-preConfigurePhases+=" updateAutotoolsGnuConfigScriptsPhase"
+appendToVar preConfigurePhases updateAutotoolsGnuConfigScriptsPhase
 
 updateAutotoolsGnuConfigScriptsPhase() {
     if [ -n "${dontUpdateAutotoolsGnuConfigScripts-}" ]; then return; fi

pkgs/build-support/trivial-builders/default.nix

@@ -588,7 +588,7 @@ rec {
   makeSetupHook =
     { name ? lib.warn "calling makeSetupHook without passing a name is deprecated." "hook"
     , deps ? [ ]
-      # hooks go in nativeBuildInput so these will be nativeBuildInput
+      # hooks go in nativeBuildInputs so these will be nativeBuildInputs
     , propagatedBuildInputs ? [ ]
       # these will be buildInputs
     , depsTargetTargetPropagated ? [ ]

pkgs/by-name/al/alsa-lib/package.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-lib";
-  version = "1.2.11";
+  version = "1.2.12";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-lib-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-nz8vabmV+a03NZBy+8aaOoi/uggfyD6b4w4UZieVu00=";
+    hash = "sha256-SGjNkIYnJ52lpjT0aHAWJb6MwlHYQmLH5baiGDka0NI=";
   };
 
   patches = [

pkgs/by-name/at/attract-mode/package.nix

@@ -4,7 +4,7 @@
   fetchFromGitHub,
   pkg-config,
   expat,
-  ffmpeg_7,
+  ffmpeg,
   freetype,
   libarchive,
   libjpeg,
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
   buildInputs =
     [
       expat
-      ffmpeg_7
+      ffmpeg
       freetype
       libarchive
       libjpeg

pkgs/by-name/bl/bluez/package.nix

@@ -11,7 +11,7 @@
 , json_c
 , libical
 , pkg-config
-, python3
+, python3Packages
 , readline
 , systemdMinimal
 , udev
@@ -24,28 +24,28 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bluez";
-  version = "5.76";
+  version = "5.78";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/bluez-${finalAttrs.version}.tar.xz";
-    hash = "sha256-VeLGRZCa2C2DPELOhewgQ04O8AcJQbHqtz+s3SQLvWM=";
+    hash = "sha256-gw/tGRXF03W43g9eb0X83qDcxf9f+z0x227Q8A1zxeM=";
   };
 
   patches = [
-    # hog-lib: Fix passing wrong parameters to bt_uhid_get_report_reply
-    (fetchpatch {
-      url = "https://github.com/bluez/bluez/commit/5ebaeab4164f80539904b9a520d9b7a8307e06e2.patch";
-      hash = "sha256-f1A8DmRPfm+zid4XMj1zsfcLZ0WTEax3YPbydKZF9RE=";
+    # Upstream fix is wrong:
+    # https://github.com/bluez/bluez/issues/843#issuecomment-2352696535
+    (fetchurl {
+      name = "basename.patch";
+      url = "https://github.com/void-linux/void-packages/raw/187b45d47d93b6857a95cae10c2132d76e4955fc/srcpkgs/bluez/patches/basename.patch";
+      hash = "sha256-Jb4u7rxIShDp1yUgaQVDJo2HJfZBzRoVlcDEWxooFgk=";
     })
-  ]
+  ] ++ lib.optional (stdenv.hostPlatform.isMusl && stdenv.hostPlatform.isx86_64)
     # Disable one failing test with musl libc, also seen by alpine
     # https://github.com/bluez/bluez/issues/726
-    ++ lib.optional (stdenv.hostPlatform.isMusl && stdenv.hostPlatform.isx86_64)
-      (fetchurl {
-        url = "https://git.alpinelinux.org/aports/plain/main/bluez/disable_aics_unit_testcases.patch?id=8e96f7faf01a45f0ad8449c1cd825db63a8dfd48";
-        hash = "sha256-1PJkipqBO3qxxOqRFQKfpWlne1kzTCgtnTFYI1cFQt4=";
-      })
-  ;
+    (fetchurl {
+      url = "https://git.alpinelinux.org/aports/plain/main/bluez/disable_aics_unit_testcases.patch?id=8e96f7faf01a45f0ad8449c1cd825db63a8dfd48";
+      hash = "sha256-1PJkipqBO3qxxOqRFQKfpWlne1kzTCgtnTFYI1cFQt4=";
+    });
 
   buildInputs = [
     alsa-lib
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     glib
     json_c
     libical
-    python3
+    python3Packages.python
     readline
     udev
   ];
@@ -62,7 +62,8 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     docutils
     pkg-config
-    python3.pkgs.wrapPython
+    python3Packages.pygments
+    python3Packages.wrapPython
   ];
 
   outputs = [ "out" "dev" ]
@@ -70,8 +71,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     substituteInPlace tools/hid2hci.rules \
-      --replace /sbin/udevadm ${systemdMinimal}/bin/udevadm \
-      --replace "hid2hci " "$out/lib/udev/hid2hci "
+      --replace-fail /sbin/udevadm ${systemdMinimal}/bin/udevadm \
+      --replace-fail "hid2hci " "$out/lib/udev/hid2hci "
   '' +
   # Disable some tests:
   # - test-mesh-crypto depends on the following kernel settings:
@@ -122,7 +123,7 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = stdenv.hostPlatform.isx86_64;
 
   postInstall = let
-    pythonPath = with python3.pkgs; [
+    pythonPath = with python3Packages; [
       dbus-python
       pygobject3
     ];

pkgs/by-name/cc/ccextractor/package.nix

@@ -18,7 +18,7 @@
   zlib,
   utf8proc,
   freetype,
-  ffmpeg_7,
+  ffmpeg,
   libarchive,
   curl,
   libiconv,
@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
       zlib
       utf8proc
       freetype
-      ffmpeg_7
+      ffmpeg
       libarchive
       curl
       libiconv
@@ -101,7 +101,7 @@ stdenv.mkDerivation (finalAttrs: {
     ];
 
   env = {
-    FFMPEG_INCLUDE_DIR = "${lib.getDev ffmpeg_7}/include";
+    FFMPEG_INCLUDE_DIR = "${lib.getDev ffmpeg}/include";
 
     # Upstream’s FFmpeg binding crate needs an explicit path to a shared
     # object to do dynamic linking. The key word is *an* explicit path;
@@ -120,7 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
           "swresample"
           "swscale"
         ];
-        ffmpegLibDir = "${lib.getLib ffmpeg_7}/lib";
+        ffmpegLibDir = "${lib.getLib ffmpeg}/lib";
         ffmpegLibExt = stdenv.hostPlatform.extensions.library;
         ffmpegLibPath = ffmpegLibName: "${ffmpegLibDir}/lib${ffmpegLibName}.${ffmpegLibExt}";
         ffmpegLinkerScript = writeTextFile {

pkgs/by-name/dv/dvdstyler/package.nix

@@ -7,7 +7,7 @@
 , docbook-xsl-nons
 , dvdauthor
 , dvdplusrwtools
-, ffmpeg_7
+, ffmpeg
 , flex
 , fontconfig
 , gettext
@@ -55,7 +55,7 @@ in stdenv.mkDerivation rec {
     cdrtools
     dvdauthor
     dvdplusrwtools
-    ffmpeg_7
+    ffmpeg
     fontconfig
     glib
     libexif

pkgs/by-name/fe/febio-studio/package.nix

@@ -16,7 +16,7 @@
   tetgenSupport ? true,
   tetgen,
   ffmpegSupport ? true,
-  ffmpeg_7,
+  ffmpeg,
   dicomSupport ? false,
   dcmtk,
   withModelRepo ? true,
@@ -75,7 +75,7 @@ stdenv'.mkDerivation (finalAttrs: {
       libssh
     ]
     ++ lib.optional tetgenSupport tetgen
-    ++ lib.optional ffmpegSupport ffmpeg_7
+    ++ lib.optional ffmpegSupport ffmpeg
     ++ lib.optional dicomSupport dcmtk;
 
   meta = {

pkgs/by-name/gn/gnome-font-viewer/package.nix

@@ -58,6 +58,10 @@ stdenv.mkDerivation rec {
   # Do not run meson-postinstall.sh
   preConfigure = "sed -i '2,$ d'  meson-postinstall.sh";
 
+  env = lib.optionalAttrs stdenv.cc.isGNU {
+    NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
+  };
+
   passthru = {
     updateScript = gnome.updateScript {
       packageName = "gnome-font-viewer";

pkgs/by-name/ha/hare/setup-hook.sh

@@ -18,7 +18,7 @@ echoCmd "HAREPATH" "$HAREPATH"
 echoCmd "hare" "$(command -v hare)"
 echoCmd "hare-native" "$(command -v hare-native)"
 '
-prePhases+=("hareSetStdlibPhase" "hareInfoPhase")
+appendToVar prePhases hareSetStdlibPhase hareInfoPhase
 
 readonly hare_unconditional_flags="@hare_unconditional_flags@"
 case "${hareBuildType:-"release"}" in

pkgs/by-name/li/lib3270/package.nix

@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     NOCONFIGURE=1 sh autogen.sh
   '';
 
-  enableParallelBuilds = true;
+  enableParallelBuilding = true;
 
   meta = with lib; {
     description = "TN3270 client Library";

pkgs/by-name/li/libarchive/package.nix

@@ -123,6 +123,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.bsd3;
     maintainers = with maintainers; [ jcumming AndersonTorres ];
     platforms = platforms.all;
+    inherit (acl.meta) badPlatforms;
   };
 
   passthru.tests = {

pkgs/by-name/li/libtiff/package.nix

@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libtiff";
-  version = "4.6.0";
+  version = "4.7.0";
 
   src = fetchFromGitLab {
     owner = "libtiff";
     repo = "libtiff";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-qCg5qjsPPynCHIg0JsPJldwVdcYkI68zYmyNAKUCoyw=";
+    hash = "sha256-SuK9/a6OUAumEe1kz1itFJGKxJzbmHkBVLMnyXhIwmQ=";
   };
 
   patches = [
@@ -44,15 +44,6 @@ stdenv.mkDerivation (finalAttrs: {
     # libc++abi 11 has an `#include <version>`, this picks up files name
     # `version` in the project's include paths
     ./rename-version.patch
-    # Fix static linking of `libtiff` via `pkg-config` not working
-    # because `libtiff` does not declare `Lerc` dependency.
-    # nixpkgs has `lerc` >= 4 which provides a `.pc` file.
-    # TODO: Close when https://gitlab.com/libtiff/libtiff/-/merge_requests/633 is merged and available
-    (fetchpatch {
-      name = "libtiff-4.pc-Fix-Requires.private-missing-Lerc.patch";
-      url = "https://gitlab.com/libtiff/libtiff/-/commit/ea882c3c240c14a897b9be38d815cc1893aafa59.patch";
-      hash = "sha256-C0xA3k1sgKmGJjEnyG9UxhXqYBYShKUDQsyjhbEDJbQ=";
-    })
   ];
 
   postPatch = ''

pkgs/by-name/li/libv3270/package.nix

@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     NOCONFIGURE=1 sh ./autogen.sh
   '';
 
-  enableParallelBuilds = true;
+  enableParallelBuilding = true;
 
   meta = with lib; {
     description = "3270 Virtual Terminal for GTK";

pkgs/by-name/li/libwacom/package.nix

@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libwacom";
-  version = "2.12.2";
+  version = "2.13.0";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${finalAttrs.version}";
-    hash = "sha256-dxnXh+O/8q8ShsPbpqvaBPNQR6lJBphBolYTmcJEF/0=";
+    hash = "sha256-OJQe0GdndgpvW4aJdgSKWw+u3ng1pn3FgdcA81jfmkQ=";
   };
 
   postPatch = ''