From 0c0e1a46650af7cf77febf1b55c40aa210c05b53 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 5 Nov 2023 18:05:47 +0000
Subject: [PATCH 01/45] iproute2: 6.5.0 -> 6.6.0

---
 pkgs/os-specific/linux/iproute/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index a86af7e6db26..1fae93c53251 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "6.5.0";
+  version = "6.6.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-pwF5CF+huW08M7BAyAm3XitXVjrcUFpK0F4mCd83NGM=";
+    hash = "sha256-hzjIBK/Qnwv3VpN/DD3iMReDKpjYy79QOGz1AFzWE84=";
   };
 
   postPatch = ''

From ca5de5d9a3001ffe60d4a3c5e6e657405724a243 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Tue, 26 Sep 2023 01:18:09 +0200
Subject: [PATCH 02/45] spirv-llvm-translator: 14.0.0 ->
 14.0.0+unstable-2023-06-22

---
 .../spirv-llvm-translator/default.nix         | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/compilers/spirv-llvm-translator/default.nix b/pkgs/development/compilers/spirv-llvm-translator/default.nix
index c6c743ce1e59..f0a17b8f066a 100644
--- a/pkgs/development/compilers/spirv-llvm-translator/default.nix
+++ b/pkgs/development/compilers/spirv-llvm-translator/default.nix
@@ -28,11 +28,11 @@ let
       rev = "v${version}";
       hash = "sha256-OsDohXRxovtEXaWiRGp8gJ0dXmoALyO+ZimeSO8aPVI=";
     } else if llvmMajor == "14" then rec{
-      version = "14.0.0";
-      rev = "v${version}";
-      hash = "sha256-BhNAApgZ/w/92XjpoDY6ZEIhSTwgJ4D3/EfNvPmNM2o=";
+      version = "14.0.0+unstable-2023-06-22";
+      rev = "23f398bf369093b1fd67459db8071ffcc6b92658";
+      hash = "sha256-o7cVj5/ZMER2CvfxL4pRb2qCIxC/HFUPiitf2fKtCyk=";
     } else if llvmMajor == "11" then {
-      version = "unstable-2022-05-04";
+      version = "11.0.0+unstable-2022-05-04";
       rev = "4ef524240833abfeee1c5b9fff6b1bd53f4806b3"; # 267 commits ahead of v11.0.0
       hash = "sha256-NoIoa20+2sH41rEnr8lsMhtfesrtdPINiXtUnxYVm8s=";
     } else throw "Incompatible LLVM version.";
@@ -47,12 +47,19 @@ stdenv.mkDerivation {
     inherit (branch) rev hash;
   };
 
-  patches = lib.optionals (llvmMajor == "16")[
+  patches = lib.optionals (llvmMajor == "16") [
     # Fixes builds that link against external LLVM dynamic library
     (fetchpatch {
       url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/f3b9b604d7eda18d0d1029d94a6eebd33aa3a3fe.patch";
       hash = "sha256-opDjyZcy7O4wcSfm/A51NCIiDyIvbcmbv9ns1njdJbc=";
     })
+  ] ++ lib.optionals (llvmMajor == "14") [
+    (fetchpatch {
+      # tries to install llvm-spirv into llvm nix store path
+      url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/cce9a2f130070d799000cac42fe24789d2b777ab.patch";
+      revert = true;
+      hash = "sha256-GbFacttZRDCgA0jkUoFA4/B3EDn3etweKvM09OwICJ8=";
+    })
   ];
 
   nativeBuildInputs = [ pkg-config cmake spirv-tools ]
@@ -70,7 +77,7 @@ stdenv.mkDerivation {
     "-DLLVM_SPIRV_BUILD_EXTERNAL=YES"
     # RPATH of binary /nix/store/.../bin/llvm-spirv contains a forbidden reference to /build/
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
-  ] ++ lib.optionals (llvmMajor != "11") [ "-DLLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR=${spirv-headers.src}" ];
+  ] ++ lib.optional (llvmMajor != "11") "-DLLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR=${spirv-headers.src}";
 
   # FIXME: CMake tries to run "/llvm-lit" which of course doesn't exist
   doCheck = false;

From 4ddb0b4b677fd55acab809b2559a722f5b33a517 Mon Sep 17 00:00:00 2001
From: Alois Wohlschlager <alois1@gmx-topmail.de>
Date: Sun, 19 Nov 2023 14:35:04 +0100
Subject: [PATCH 03/45] polkit: remove rsync build dependency

It the polkit post-install, the files that are supposed to live under /etc and
/run/current-system/sw/share have to be merged into the package at the correct
location. Previously, rsync was used for this job. By being a bit careful about
the ordering, it is possible to use plain mv instead. The main advantage is
that the number of transitive reverse dependencies of rsync is reduced
significantly, so rsync changes will no longer need to go through staging.
---
 pkgs/development/libraries/polkit/default.nix | 22 +++++++------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index 80badcdd4dbd..dabba056b487 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -9,7 +9,6 @@
 , mesonEmulatorHook
 , ninja
 , perl
-, rsync
 , python3
 , fetchpatch
 , gettext
@@ -72,7 +71,6 @@ stdenv.mkDerivation rec {
     meson
     ninja
     perl
-    rsync
 
     # man pages
     libxslt
@@ -131,7 +129,7 @@ stdenv.mkDerivation rec {
   # at install time but Meson does not support this
   # so we need to convince it to install all files to a temporary
   # location using DESTDIR and then move it to proper one in postInstall.
-  DESTDIR = "${placeholder "out"}/dest";
+  env.DESTDIR = "dest";
 
   inherit doCheck;
 
@@ -165,19 +163,15 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     # Move stuff from DESTDIR to proper location.
-    # We use rsync to merge the directories.
-    rsync --archive "${DESTDIR}/etc" "$out"
-    rm --recursive "${DESTDIR}/etc"
-    rsync --archive "${DESTDIR}${system}"/* "$out"
-    rm --recursive "${DESTDIR}${system}"/*
-    rmdir --parents --ignore-fail-on-non-empty "${DESTDIR}${system}"
+    # We need to be careful with the ordering to merge without conflicts.
     for o in $(getAllOutputNames); do
-        rsync --archive "${DESTDIR}/''${!o}" "$(dirname "''${!o}")"
-        rm --recursive "${DESTDIR}/''${!o}"
+        mv "$DESTDIR/''${!o}" "''${!o}"
     done
-    # Ensure the DESTDIR is removed.
-    destdirContainer="$(dirname "${DESTDIR}")"
-    pushd "$destdirContainer"; rmdir --parents "''${DESTDIR##$destdirContainer/}${builtins.storeDir}"; popd
+    mv "$DESTDIR/etc" "$out"
+    mv "$DESTDIR${system}/share"/* "$out/share"
+    # Ensure we did not forget to install anything.
+    rmdir --parents --ignore-fail-on-non-empty "$DESTDIR${builtins.storeDir}" "$DESTDIR${system}/share"
+    ! test -e "$DESTDIR"
   '';
 
   meta = with lib; {

From fbc7955d726169ae9a12c337ef0519a69dcf8edb Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 1 Dec 2023 16:21:08 +0000
Subject: [PATCH 04/45] libimobiledevice: pull upstream fix for `clang-16`
 support

Without the change the build fails on `clang-16` and upcoming `gcc-14`
as:

    $ nix build --impure --expr 'with import ./. {}; libimobiledevice.override { stdenv = clangStdenv; }' -L
    ...
    libimobiledevice> #define __usleep(x) usleep(x)
    libimobiledevice>                     ^
    libimobiledevice> idevicedevmodectl.c:416:6: error: call to undeclared function 'usleep'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
---
 .../libraries/libimobiledevice/default.nix            | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/development/libraries/libimobiledevice/default.nix b/pkgs/development/libraries/libimobiledevice/default.nix
index 000649100313..a229bb1fef08 100644
--- a/pkgs/development/libraries/libimobiledevice/default.nix
+++ b/pkgs/development/libraries/libimobiledevice/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 , pkg-config
 , openssl
@@ -26,6 +27,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-mIsB+EaGJlGMOpz3OLrs0nAmhOY1BwMs83saFBaejwc=";
   };
 
+  patches = [
+    # Pull upstream fix for clang-16 and upcoming gcc-14 support:
+    #   https://github.com/libimobiledevice/libimobiledevice/pull/1444
+    (fetchpatch {
+      name = "usleep-decl.patch";
+      url = "https://github.com/libimobiledevice/libimobiledevice/commit/db623184c0aa09c27697f5a2e81025db223075d5.patch";
+      hash = "sha256-TgdgBkEDXzQDSgJxcZc+pZncfmBVXarhHOByGFs6p0Q=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config

From a18a8b5c7ba930e3982e212a9fc0c422a155f206 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 3 Dec 2023 22:41:56 +0000
Subject: [PATCH 05/45] gdb: 13.2 -> 14.1

Changes: https://www.mail-archive.com/info-gnu@gnu.org/msg03236.html
---
 pkgs/development/tools/misc/gdb/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index 93d61b638bea..125a4cd5f140 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -30,11 +30,11 @@ assert pythonSupport -> python3 != null;
 
 stdenv.mkDerivation rec {
   pname = targetPrefix + basename + lib.optionalString hostCpuOnly "-host-cpu-only";
-  version = "13.2";
+  version = "14.1";
 
   src = fetchurl {
     url = "mirror://gnu/gdb/${basename}-${version}.tar.xz";
-    hash = "sha256-/Vvrt74YM6vbbgI8L0mKNUSYKB350FUj2JFbq+uJPwo=";
+    hash = "sha256-1m31EnYUNFH8v/RkzIcj1o8enfRaai1WNaVOcWQ+24A=";
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''

From d70de0641d58e50889befa84afaf222ad51c570d Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 4 Dec 2023 11:42:37 +0000
Subject: [PATCH 06/45] lcms: 2.15 -> 2.16

Changes: https://github.com/mm2/Little-CMS/releases/tag/lcms2.16
---
 pkgs/development/libraries/lcms2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/lcms2/default.nix b/pkgs/development/libraries/lcms2/default.nix
index e1f6c3d2212c..ab984884073a 100644
--- a/pkgs/development/libraries/lcms2/default.nix
+++ b/pkgs/development/libraries/lcms2/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lcms2";
-  version = "2.15";
+  version = "2.16";
 
   src = fetchurl {
     url = "mirror://sourceforge/lcms/${pname}-${version}.tar.gz";
-    sha256 = "sha256-sgy8vQ9QNDO+Kk6BRiEG+mEFCjUHTcJKTjVnktlxqzk=";
+    hash = "sha256-2HPTSti5tM6gEGMfGmIo0gh0deTcXnY+uBrMI9nUWlE=";
   };
 
   outputs = [ "bin" "dev" "out" ];

From 7fcbd1d046c93239a5a7081c5c58de6d55c8bbc7 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 4 Dec 2023 12:41:04 +0000
Subject: [PATCH 07/45] libao: backport upstream patch for `clang-16` support

Without the change `libao` fails the build on `clang-16` as:

    $ nix build --impure --expr 'with import ./. {}; libao.override {stdenv = clangStdenv;}' -L
    ...
    libao>   CC       ao_pulse.lo
    libao> warning: optimization level '-O20' is not supported; using '-O3' instead
    libao> ao_pulse.c:309:17: error: call to undeclared function 'nanosleep'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
    libao>           while(nanosleep(&sleep,&wake)<0){
    libao>                 ^
---
 pkgs/development/libraries/libao/default.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/libao/default.nix b/pkgs/development/libraries/libao/default.nix
index 4a07ba9da7d8..b5c413bfc54a 100644
--- a/pkgs/development/libraries/libao/default.nix
+++ b/pkgs/development/libraries/libao/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, lib, fetchFromGitHub, autoreconfHook, pkg-config, libpulseaudio, alsa-lib, libcap
+{ stdenv, lib, fetchFromGitHub, fetchpatch
+, autoreconfHook, pkg-config, libpulseaudio, alsa-lib, libcap
 , CoreAudio, CoreServices, AudioUnit
 , usePulseAudio }:
 
@@ -14,6 +15,15 @@ stdenv.mkDerivation rec {
     sha256 = "0svgk4sc9kdhcsfyvbvgm5vpbg3sfr6z5rliflrw49v3x2i4vxq5";
   };
 
+  patches = [
+    # Upstream fix for clang-16 compatibility
+    (fetchpatch {
+      name = "clang-16.patch";
+      url = "https://github.com/xiph/libao/commit/1f998f5d6d77674dad01b181811638578ad68242.patch";
+      hash = "sha256-cvlyhQq1YS4pVya44LfsKD1R6iSOONsHJGRbP5LlanQ=";
+    })
+  ];
+
   configureFlags = [
     "--disable-broken-oss"
     "--enable-alsa-mmap"

From d2ec10f49a4d27cd05cbb8795dafbf7491abda22 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 5 Dec 2023 11:38:28 +0000
Subject: [PATCH 08/45] Update pkgs/development/libraries/libao/default.nix

Co-authored-by: a-n-n-a-l-e-e <150648636+a-n-n-a-l-e-e@users.noreply.github.com>
---
 pkgs/development/libraries/libao/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libao/default.nix b/pkgs/development/libraries/libao/default.nix
index b5c413bfc54a..63cb0401aae4 100644
--- a/pkgs/development/libraries/libao/default.nix
+++ b/pkgs/development/libraries/libao/default.nix
@@ -16,9 +16,9 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    # Upstream fix for clang-16 compatibility
+    # add header time.h for nanosecond
     (fetchpatch {
-      name = "clang-16.patch";
+      name = "nanosecond-header.patch";
       url = "https://github.com/xiph/libao/commit/1f998f5d6d77674dad01b181811638578ad68242.patch";
       hash = "sha256-cvlyhQq1YS4pVya44LfsKD1R6iSOONsHJGRbP5LlanQ=";
     })

From 96027ca2d7a16699ece15df6f6144ac747160d63 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 5 Dec 2023 11:53:32 +0000
Subject: [PATCH 09/45] gdb: add `xz` to buildInputs to enable `lzma` support

The change added support for `lzma`-compressed sections:

    $ nix run -f. gdb -- --configuration |& fgrep lzma
             --with-lzma
---
 pkgs/development/tools/misc/gdb/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index 125a4cd5f140..849f44ea9bc0 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -4,7 +4,7 @@
 , fetchurl, fetchpatch, pkg-config, perl, texinfo, setupDebugInfoDirs, buildPackages
 
 # Run time
-, ncurses, readline, gmp, mpfr, expat, libipt, zlib, zstd, dejagnu, sourceHighlight, libiconv
+, ncurses, readline, gmp, mpfr, expat, libipt, zlib, zstd, xz, dejagnu, sourceHighlight, libiconv
 
 , pythonSupport ? stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.hostPlatform.isCygwin, python3 ? null
 , enableDebuginfod ? lib.meta.availableOn stdenv.hostPlatform elfutils, elfutils
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config texinfo perl setupDebugInfoDirs ];
 
-  buildInputs = [ ncurses readline gmp mpfr expat libipt zlib zstd guile sourceHighlight ]
+  buildInputs = [ ncurses readline gmp mpfr expat libipt zlib zstd xz guile sourceHighlight ]
     ++ lib.optional pythonSupport python3
     ++ lib.optional doCheck dejagnu
     ++ lib.optional enableDebuginfod (elfutils.override { enableDebuginfod = true; })

From 02f7cdc1e450ce92d0069a5c021c7d0407372cd7 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 5 Dec 2023 19:04:41 +0000
Subject: [PATCH 10/45] util-linux: 2.39.2 -> 2.39.3

Changes: https://github.com/util-linux/util-linux/compare/v2.39.2...v2.39.3
---
 .../linux/util-linux/bcachefs-patch-set.patch | 277 ------------------
 pkgs/os-specific/linux/util-linux/default.nix |   5 +-
 2 files changed, 2 insertions(+), 280 deletions(-)
 delete mode 100644 pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch

diff --git a/pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch b/pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch
deleted file mode 100644
index 068744d4f32d..000000000000
--- a/pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch
+++ /dev/null
@@ -1,277 +0,0 @@
-commit 68564ebb50f8afab5a9527c534417e247cca0b27
-Author: Filipe Manana <fdmanana@kernel.org>
-Date:   Thu Aug 17 10:20:13 2023 +0100
-
-    libmount: Fix regression when mounting with atime
-    
-    A regression was introduced in v2.39 that causes mounting with the atime
-    option to fail:
-    
-      $ mkfs.ext4 -F /dev/sdi
-      $ mount -o atime /dev/sdi /mnt/sdi
-      mount: /mnt/sdi: not mount point or bad option.
-             dmesg(1) may have more information after failed mount system call.
-    
-    The failure comes from the mount_setattr(2) call returning -EINVAL. This
-    is because we pass an invalid value for the attr_clr argument. From a
-    strace capture we have:
-    
-      mount_setattr(4, "", AT_EMPTY_PATH, {attr_set=0, attr_clr=MOUNT_ATTR_NOATIME, propagation=0 /* MS_??? */, userns_fd=0}, 32) = -1 EINVAL (Invalid argument)
-    
-    We can't pass MOUNT_ATTR_NOATIME to mount_setattr(2) through the attr_clr
-    argument because all atime options are exclusive, so in order to set atime
-    one has to pass MOUNT_ATTR__ATIME to attr_clr and leave attr_set as
-    MOUNT_ATTR_RELATIME (which is defined as a value of 0).
-    
-    This can be read from the man page for mount_setattr(2) and also from the
-    kernel source:
-    
-      $ cat fs/namespace.c
-      static int build_mount_kattr(const struct mount_attr *attr, size_t usize,
-                                   struct mount_kattr *kattr, unsigned int flags)
-      {
-          (...)
-          /*
-           * Since the MOUNT_ATTR_<atime> values are an enum, not a bitmap,
-           * users wanting to transition to a different atime setting cannot
-           * simply specify the atime setting in @attr_set, but must also
-           * specify MOUNT_ATTR__ATIME in the @attr_clr field.
-           * So ensure that MOUNT_ATTR__ATIME can't be partially set in
-           * @attr_clr and that @attr_set can't have any atime bits set if
-           * MOUNT_ATTR__ATIME isn't set in @attr_clr.
-           */
-          if (attr->attr_clr & MOUNT_ATTR__ATIME) {
-              if ((attr->attr_clr & MOUNT_ATTR__ATIME) != MOUNT_ATTR__ATIME)
-                  return -EINVAL;
-    
-                  /*
-                   * Clear all previous time settings as they are mutually
-                   * exclusive.
-                   */
-                  kattr->attr_clr |= MNT_RELATIME | MNT_NOATIME;
-                  switch (attr->attr_set & MOUNT_ATTR__ATIME) {
-                  case MOUNT_ATTR_RELATIME:
-                      kattr->attr_set |= MNT_RELATIME;
-                      break;
-                  case MOUNT_ATTR_NOATIME:
-                      kattr->attr_set |= MNT_NOATIME;
-                      break;
-                  case MOUNT_ATTR_STRICTATIME:
-                      break;
-                  default:
-                      return -EINVAL;
-                  }
-        (...)
-    
-    So fix this by setting attr_clr MOUNT_ATTR__ATIME if we want to clear any
-    atime related option.
-    
-    Signed-off-by: Filipe Manana <fdmanana@kernel.org>
-
-diff --git a/libmount/src/optlist.c b/libmount/src/optlist.c
-index 1e962ec6d..0702adae7 100644
---- a/libmount/src/optlist.c
-+++ b/libmount/src/optlist.c
-@@ -875,7 +875,18 @@ int mnt_optlist_get_attrs(struct libmnt_optlist *ls, uint64_t *set, uint64_t *cl
- 
- 		if (opt->ent->mask & MNT_INVERT) {
- 			DBG(OPTLIST, ul_debugobj(ls, " clr: %s", opt->ent->name));
--			*clr |= x;
-+			/*
-+			 * All atime settings are mutually exclusive so *clr must
-+			 * have MOUNT_ATTR__ATIME set.
-+			 *
-+			 * See the function fs/namespace.c:build_mount_kattr()
-+			 * in the linux kernel source.
-+			 */
-+			if (x == MOUNT_ATTR_RELATIME || x == MOUNT_ATTR_NOATIME ||
-+			    x == MOUNT_ATTR_STRICTATIME)
-+				*clr |= MOUNT_ATTR__ATIME;
-+			else
-+				*clr |= x;
- 		} else {
- 			DBG(OPTLIST, ul_debugobj(ls, " set: %s", opt->ent->name));
- 			*set |= x;
-diff --git a/tests/expected/libmount/context-mount-flags b/tests/expected/libmount/context-mount-flags
-index 960641863..eb71323dd 100644
---- a/tests/expected/libmount/context-mount-flags
-+++ b/tests/expected/libmount/context-mount-flags
-@@ -3,3 +3,6 @@ ro,nosuid,noexec
- successfully mounted
- rw,nosuid,noexec
- successfully umounted
-+successfully mounted
-+rw,relatime
-+successfully umounted
-diff --git a/tests/ts/libmount/context b/tests/ts/libmount/context
-index f5b47185e..a5d2e81a3 100755
---- a/tests/ts/libmount/context
-+++ b/tests/ts/libmount/context
-@@ -116,8 +116,15 @@ $TS_CMD_FINDMNT --kernel --mountpoint $MOUNTPOINT -o VFS-OPTIONS -n >> $TS_OUTPU
- 
- ts_run $TESTPROG --umount $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
- is_mounted $DEVICE && echo "$DEVICE still mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
--ts_finalize_subtest
- 
-+# Test that the atime option works after the migration to use the new kernel mount APIs.
-+ts_run $TESTPROG --mount -o atime $DEVICE $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
-+$TS_CMD_FINDMNT --kernel --mountpoint $MOUNTPOINT -o VFS-OPTIONS -n >> $TS_OUTPUT 2>> $TS_ERRLOG
-+is_mounted $DEVICE || echo "$DEVICE not mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
-+ts_run $TESTPROG --umount $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
-+is_mounted $DEVICE && echo "$DEVICE still mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
-+
-+ts_finalize_subtest
- 
- ts_init_subtest "mount-loopdev"
- mkdir -p $MOUNTPOINT &> /dev/null
-
-commit 1ec71634aa4ef5ddca23d65c8a296f3614231e8a
-Author: Colin Gillespie <colin@cgillespie.xyz>
-Date:   Wed Aug 9 18:28:07 2023 +1000
-
-    libblkid: (bcachefs) fix not detecting large superblocks
-    
-    Probing does not detect bcachefs filesystems with a superblock larger
-    than 4KiB. Bcachefs superblocks grow in size and can become much larger
-    than this.
-    
-    Increase the superblock maximum size limit to 1MiB.
-    
-    Validate the superblock isn't larger than the maximum size defined in
-    the superblocks layout section.
-    
-    (cherry picked from commit 48d573797797650d96456979797c0155d58f61cb)
-
-diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
-index 40e702d75..236877042 100644
---- a/libblkid/src/superblocks/bcache.c
-+++ b/libblkid/src/superblocks/bcache.c
-@@ -102,6 +102,15 @@ union bcachefs_sb_csum {
- 	uint8_t raw[16];
- } __attribute__((packed));
- 
-+struct bcachefs_sb_layout {
-+	uint8_t		magic[16];
-+	uint8_t		layout_type;
-+	uint8_t		sb_max_size_bits;
-+	uint8_t		nr_superblocks;
-+	uint8_t		pad[5];
-+	uint64_t	sb_offset[61];
-+} __attribute__((packed));
-+
- struct bcachefs_super_block {
- 	union bcachefs_sb_csum	csum;
- 	uint16_t	version;
-@@ -123,7 +132,7 @@ struct bcachefs_super_block {
- 	uint64_t	flags[8];
- 	uint64_t	features[2];
- 	uint64_t	compat[2];
--	uint8_t		layout[512];
-+	struct bcachefs_sb_layout layout;
- 	struct bcachefs_sb_field _start[];
- }  __attribute__((packed));
- 
-@@ -143,7 +152,7 @@ struct bcachefs_super_block {
- /* granularity of offset and length fields within superblock */
- #define BCACHEFS_SECTOR_SIZE   512
- /* maximum superblock size */
--#define BCACHEFS_SB_MAX_SIZE   4096
-+#define BCACHEFS_SB_MAX_SIZE   0x100000
- /* fields offset within super block */
- #define BCACHEFS_SB_FIELDS_OFF offsetof(struct bcachefs_super_block, _start)
- /* tag value for members field */
-@@ -302,6 +311,9 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
- 		return BLKID_PROBE_NONE;
- 
- 	sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
-+	if (sb_size > BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits)
-+		return BLKID_PROBE_NONE;
-+
- 	if (sb_size > BCACHEFS_SB_MAX_SIZE)
- 		return BLKID_PROBE_NONE;
- 
-
-commit acbf17ae8f8ee0f941fe98ed12f115f2b349bba8
-Author: Karel Zak <kzak@redhat.com>
-Date:   Wed Aug 23 11:53:45 2023 +0200
-
-    libblkid: (bcachefs) fix compiler warning [-Werror=sign-compare]
-    
-    Addresses: https://github.com/util-linux/util-linux/pull/2427
-    Signed-off-by: Karel Zak <kzak@redhat.com>
-    (cherry picked from commit 17873d38fc97913c0a31d4bd08cfbfe45c4de5be)
-
-diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
-index 236877042..6ab3fe9d4 100644
---- a/libblkid/src/superblocks/bcache.c
-+++ b/libblkid/src/superblocks/bcache.c
-@@ -311,7 +311,7 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
- 		return BLKID_PROBE_NONE;
- 
- 	sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
--	if (sb_size > BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits)
-+	if (sb_size > ((uint64_t) BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
- 		return BLKID_PROBE_NONE;
- 
- 	if (sb_size > BCACHEFS_SB_MAX_SIZE)
-
-commit 6b9fda87c4e5d0c6f945d7565197f157b9fa3d5f
-Author: Thomas Weißschuh <thomas@t-8ch.de>
-Date:   Wed Aug 23 11:58:33 2023 +0200
-
-    libblkid: (bcachefs) fix size validation
-    
-    Avoid signed shift out-of-bounds.
-    
-    Also mark the constants explitly as unsigned instead of casting.
-    
-    Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de>
-    (cherry picked from commit befe455f59de8c7bc66b85ed52aae8cbc95325fa)
-
-diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
-index 6ab3fe9d4..28ac4b52b 100644
---- a/libblkid/src/superblocks/bcache.c
-+++ b/libblkid/src/superblocks/bcache.c
-@@ -142,17 +142,19 @@ struct bcachefs_super_block {
- /* magic string len */
- #define BCACHE_SB_MAGIC_LEN (sizeof(BCACHE_SB_MAGIC) - 1)
- /* super block offset */
--#define BCACHE_SB_OFF       0x1000
-+#define BCACHE_SB_OFF       0x1000U
- /* supper block offset in kB */
- #define BCACHE_SB_KBOFF     (BCACHE_SB_OFF >> 10)
- /* magic string offset within super block */
- #define BCACHE_SB_MAGIC_OFF offsetof(struct bcache_super_block, magic)
- /* start of checksummed data within superblock */
--#define BCACHE_SB_CSUMMED_START 8
-+#define BCACHE_SB_CSUMMED_START 8U
- /* granularity of offset and length fields within superblock */
--#define BCACHEFS_SECTOR_SIZE   512
-+#define BCACHEFS_SECTOR_SIZE   512U
-+/* maximum superblock size shift */
-+#define BCACHEFS_SB_MAX_SIZE_SHIFT   0x10U
- /* maximum superblock size */
--#define BCACHEFS_SB_MAX_SIZE   0x100000
-+#define BCACHEFS_SB_MAX_SIZE   (1U << BCACHEFS_SB_MAX_SIZE_SHIFT)
- /* fields offset within super block */
- #define BCACHEFS_SB_FIELDS_OFF offsetof(struct bcachefs_super_block, _start)
- /* tag value for members field */
-@@ -311,12 +313,16 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
- 		return BLKID_PROBE_NONE;
- 
- 	sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
--	if (sb_size > ((uint64_t) BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
--		return BLKID_PROBE_NONE;
- 
- 	if (sb_size > BCACHEFS_SB_MAX_SIZE)
- 		return BLKID_PROBE_NONE;
- 
-+	if (bcs->layout.sb_max_size_bits > BCACHEFS_SB_MAX_SIZE_SHIFT)
-+		return BLKID_PROBE_NONE;
-+
-+	if (sb_size > (BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
-+		return BLKID_PROBE_NONE;
-+
- 	sb = blkid_probe_get_sb_buffer(pr, mag, sb_size);
- 	if (!sb)
- 		return BLKID_PROBE_NONE;
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index d710fabb7ace..ba989b41a6ca 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -20,16 +20,15 @@
 
 stdenv.mkDerivation rec {
   pname = "util-linux" + lib.optionalString (!nlsSupport && !ncursesSupport && !systemdSupport) "-minimal";
-  version = "2.39.2";
+  version = "2.39.3";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor version}/util-linux-${version}.tar.xz";
-    hash = "sha256-h6vfqo5JD4vm3el298gLm1/58wHhtn44meHwWlmhUx8=";
+    hash = "sha256-e2YF5I0aSfQ8xLTPxZ8xPQ3VQC+kC5aBC9Vy4Wff7Q8=";
   };
 
   patches = [
     ./rtcwake-search-PATH-for-shutdown.patch
-    ./bcachefs-patch-set.patch
   ];
 
   # We separate some of the utilities into their own outputs. This

From 178dca3d9b8e20040a101ba8dbbd92661b696cec Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 6 Dec 2023 11:02:42 +0000
Subject: [PATCH 11/45] libseccomp: 2.5.4 -> 2.5.5

Changes: https://github.com/seccomp/libseccomp/releases/tag/v2.5.5
---
 pkgs/development/libraries/libseccomp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libseccomp/default.nix b/pkgs/development/libraries/libseccomp/default.nix
index aadaad561db0..ec24d7dcf051 100644
--- a/pkgs/development/libraries/libseccomp/default.nix
+++ b/pkgs/development/libraries/libseccomp/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libseccomp";
-  version = "2.5.4";
+  version = "2.5.5";
 
   src = fetchurl {
     url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
-    sha256 = "sha256-2CkCQAQFzwBoV07z3B/l9ZJiB1Q7oa5vjnoVdjUdy9s=";
+    hash = "sha256-JIosik2bmFiqa69ScSw0r+/PnJ6Ut23OAsHJqiX7M3U=";
   };
 
   outputs = [ "out" "lib" "dev" "man" "pythonsrc" ];

From 37784412276ad1af3719a6fe15de0b05374a5447 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 7 Dec 2023 03:24:43 +0100
Subject: [PATCH 12/45] buildcatrust: use pep517 builder

Up until now this project was build using the setup.yp shim, that flit
creates for tools that don't support PEP 517 yet.

On top of that an implicit format implies setuptools and makes a call to
`python setup.py install`, which is deprecated.

Added some light reformatting on top.
---
 .../python-modules/buildcatrust/default.nix        | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/buildcatrust/default.nix b/pkgs/development/python-modules/buildcatrust/default.nix
index b875185ed2ff..cb997ab80134 100644
--- a/pkgs/development/python-modules/buildcatrust/default.nix
+++ b/pkgs/development/python-modules/buildcatrust/default.nix
@@ -1,27 +1,37 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, flit-core
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "buildcatrust";
   version = "0.1.3";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256:0s0m0fy943dakw9cbd40h46qmrhhgrcp292kppyb34m6y27sbagy";
+    hash = "sha256:0s0m0fy943dakw9cbd40h46qmrhhgrcp292kppyb34m6y27sbagy";
   };
 
+  nativeBuildInputs = [
+    flit-core
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
+
   disabledTestPaths = [
     # Non-hermetic, needs internet access (e.g. attempts to retrieve NSS store).
     "buildcatrust/tests/test_nonhermetic.py"
   ];
 
-  pythonImportsCheck = [ "buildcatrust" "buildcatrust.cli" ];
+  pythonImportsCheck = [
+    "buildcatrust"
+    "buildcatrust.cli"
+  ];
 
   meta = with lib; {
     description = "Build SSL/TLS trust stores";

From 5448caf9476e5e1675bbc12eb438834ec00f6ea0 Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Wed, 29 Nov 2023 14:27:05 -0300
Subject: [PATCH 13/45] scons_3_1_2: use github instead of sourceforge direct
 link

---
 .../tools/build-managers/scons/3.1.2.nix       | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/tools/build-managers/scons/3.1.2.nix b/pkgs/development/tools/build-managers/scons/3.1.2.nix
index 097a8ffd519e..0bac0685b0d1 100644
--- a/pkgs/development/tools/build-managers/scons/3.1.2.nix
+++ b/pkgs/development/tools/build-managers/scons/3.1.2.nix
@@ -1,16 +1,25 @@
-{ lib, fetchurl, python3 }:
+{ lib, fetchFromGitHub, python3 }:
 
 let
   pname = "scons";
   version = "3.1.2";
-  src = fetchurl {
-    url = "mirror://sourceforge/scons/scons-${version}.tar.gz";
-    hash = "sha256-eAHz9i9lRSjict94C+EMDpM36JdlC2Ldzunzn94T+Ps=";
+  src = fetchFromGitHub {
+    owner = "Scons";
+    repo = "scons";
+    rev = version;
+    hash = "sha256-C3U4N7+9vplzoJoevQe5Zeuz0TDmB6/miMwBJLzA3WA=";
   };
 in
 python3.pkgs.buildPythonApplication {
   inherit pname version src;
 
+  outputs = [ "out" "man" ];
+
+  preConfigure = ''
+    python bootstrap.py
+    cd build/scons
+  '';
+
   setupHook = ./setup-hook.sh;
 
   doCheck = true;
@@ -36,3 +45,4 @@ python3.pkgs.buildPythonApplication {
     maintainers = with lib.maintainers; [ AndersonTorres ];
   };
 }
+# TODO: patch to get rid of distutils and other deprecations

From 2d13423feb195aa787332f79759d72591aa54b93 Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Wed, 29 Nov 2023 14:27:54 -0300
Subject: [PATCH 14/45] scons_4_1_0: use github instead of sourceforge direct
 link

---
 .../tools/build-managers/scons/4.1.0.nix      | 23 ++++++++++++-------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/tools/build-managers/scons/4.1.0.nix b/pkgs/development/tools/build-managers/scons/4.1.0.nix
index 65499280c2c4..f2edf5161aaf 100644
--- a/pkgs/development/tools/build-managers/scons/4.1.0.nix
+++ b/pkgs/development/tools/build-managers/scons/4.1.0.nix
@@ -1,25 +1,32 @@
-{ lib, fetchurl, python3 }:
+{ lib, fetchFromGitHub, python3 }:
 
 let
   pname = "scons";
   version = "4.1.0";
-  src = fetchurl {
-    url = "mirror://sourceforge/scons/scons-${version}.tar.gz";
-    hash = "sha256-ctKNdi4hJnh/Fz49WeCJI5+LL06e8xFNV/ELEgaYXYU=";
+  src = fetchFromGitHub {
+    owner = "Scons";
+    repo = "scons";
+    rev = version;
+    hash = "sha256-ldus/9ghqAMB7A+NrHiCQm7saCdIpqzufGCLxWRhYKU=";
   };
 in
 python3.pkgs.buildPythonApplication {
   inherit pname version src;
 
+  outputs = [ "out" "man" ];
+
   postPatch = ''
     substituteInPlace setup.cfg \
-      --replace "build/dist" "dist" \
-      --replace "build/doc/man/" ""
+      --replace "build/dist" "dist"
+  '';
+
+  preConfigure = ''
+    python scripts/scons.py
   '';
 
   postInstall = ''
-    mkdir -p "$out/share/man/man1"
-    mv "$out/"*.1 "$out/share/man/man1/"
+    mkdir -pv "$man/share/man/man1"
+    mv -v "$out/"*.1 "$man/share/man/man1/"
   '';
 
   setupHook = ./setup-hook.sh;

From 70b907a49601af69b909b72d2d9c53697e4fbf9d Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Wed, 29 Nov 2023 14:37:28 -0300
Subject: [PATCH 15/45] scons_4_5_2: use github instead of sourceforge direct
 link

---
 .../tools/build-managers/scons/4.5.2.nix      | 20 +++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/tools/build-managers/scons/4.5.2.nix b/pkgs/development/tools/build-managers/scons/4.5.2.nix
index 61d1719642e0..f63702cb7ef4 100644
--- a/pkgs/development/tools/build-managers/scons/4.5.2.nix
+++ b/pkgs/development/tools/build-managers/scons/4.5.2.nix
@@ -1,16 +1,20 @@
-{ lib, fetchurl, python3 }:
+{ lib, fetchFromGitHub, python3 }:
 
 let
   pname = "scons";
   version = "4.5.2";
-  src = fetchurl {
-    url = "mirror://sourceforge/project/scons/scons/${version}/SCons-${version}.tar.gz";
-    hash = "sha256-ziaqyV01CnmkGSGWsL6sPLJPTMq84BI+so0zcPV28HI=";
+  src = fetchFromGitHub {
+    owner = "Scons";
+    repo = "scons";
+    rev = version;
+    hash = "sha256-vxJsz24jDsPcttwPXq9+ztc/N7W4Gkydgykk/FLgZLo=";
   };
 in
 python3.pkgs.buildPythonApplication {
   inherit pname version src;
 
+  outputs = [ "out" "man" ];
+
   patches = [
     ./env.patch
   ];
@@ -21,9 +25,13 @@ python3.pkgs.buildPythonApplication {
       --replace "build/doc/man/" ""
   '';
 
+  preConfigure = ''
+    python scripts/scons.py
+  '';
+
   postInstall = ''
-    mkdir -p "$out/share/man/man1"
-    mv "$out/"*.1 "$out/share/man/man1/"
+    mkdir -p "$man/share/man/man1"
+    mv "$out/"*.1 "$man/share/man/man1/"
   '';
 
   setupHook = ./setup-hook.sh;

From 6db6c6df7b29062f980150435cf357efee22d13b Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Tue, 12 Dec 2023 16:49:07 +0100
Subject: [PATCH 16/45] llvmPackages_*: update name for LLVMgold patch for
 clang >= 11

It no longer applies to clang >= 16, let's make the name correspond to
the versions it applies to.
---
 pkgs/development/compilers/llvm/11/clang/default.nix            | 2 +-
 pkgs/development/compilers/llvm/12/clang/default.nix            | 2 +-
 pkgs/development/compilers/llvm/13/clang/default.nix            | 2 +-
 pkgs/development/compilers/llvm/14/clang/default.nix            | 2 +-
 pkgs/development/compilers/llvm/15/clang/default.nix            | 2 +-
 ...1-12-LLVMgold-path.patch => clang-11-15-LLVMgold-path.patch} | 0
 6 files changed, 5 insertions(+), 5 deletions(-)
 rename pkgs/development/compilers/llvm/{clang-11-12-LLVMgold-path.patch => clang-11-15-LLVMgold-path.patch} (100%)

diff --git a/pkgs/development/compilers/llvm/11/clang/default.nix b/pkgs/development/compilers/llvm/11/clang/default.nix
index a4fe7199e080..0e61930f1c0e 100644
--- a/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@@ -50,7 +50,7 @@ let
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
       (substituteAll {
-        src = ../../clang-11-12-LLVMgold-path.patch;
+        src = ../../clang-11-15-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
       })
     ];
diff --git a/pkgs/development/compilers/llvm/12/clang/default.nix b/pkgs/development/compilers/llvm/12/clang/default.nix
index 7ecd4efc0837..c46776d38ac3 100644
--- a/pkgs/development/compilers/llvm/12/clang/default.nix
+++ b/pkgs/development/compilers/llvm/12/clang/default.nix
@@ -47,7 +47,7 @@ let
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
       (substituteAll {
-        src = ../../clang-11-12-LLVMgold-path.patch;
+        src = ../../clang-11-15-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
       })
     ];
diff --git a/pkgs/development/compilers/llvm/13/clang/default.nix b/pkgs/development/compilers/llvm/13/clang/default.nix
index a070e64c7ddd..6604ae0efc3f 100644
--- a/pkgs/development/compilers/llvm/13/clang/default.nix
+++ b/pkgs/development/compilers/llvm/13/clang/default.nix
@@ -43,7 +43,7 @@ let
       ./revert-malloc-alignment-assumption.patch
       ../../common/clang/add-nostdlibinc-flag.patch
       (substituteAll {
-        src = ../../clang-11-12-LLVMgold-path.patch;
+        src = ../../clang-11-15-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
       })
     ];
diff --git a/pkgs/development/compilers/llvm/14/clang/default.nix b/pkgs/development/compilers/llvm/14/clang/default.nix
index 976ff7580ac3..9f0da7a9f46c 100644
--- a/pkgs/development/compilers/llvm/14/clang/default.nix
+++ b/pkgs/development/compilers/llvm/14/clang/default.nix
@@ -46,7 +46,7 @@ let
       ./gnu-install-dirs.patch
       ../../common/clang/add-nostdlibinc-flag.patch
       (substituteAll {
-        src = ../../clang-11-12-LLVMgold-path.patch;
+        src = ../../clang-11-15-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
       })
     ];
diff --git a/pkgs/development/compilers/llvm/15/clang/default.nix b/pkgs/development/compilers/llvm/15/clang/default.nix
index 894db1a4975f..c49d6368cb97 100644
--- a/pkgs/development/compilers/llvm/15/clang/default.nix
+++ b/pkgs/development/compilers/llvm/15/clang/default.nix
@@ -52,7 +52,7 @@ let
       ./gnu-install-dirs.patch
       ../../common/clang/add-nostdlibinc-flag.patch
       (substituteAll {
-        src = ../../clang-11-12-LLVMgold-path.patch;
+        src = ../../clang-11-15-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
       })
     ];
diff --git a/pkgs/development/compilers/llvm/clang-11-12-LLVMgold-path.patch b/pkgs/development/compilers/llvm/clang-11-15-LLVMgold-path.patch
similarity index 100%
rename from pkgs/development/compilers/llvm/clang-11-12-LLVMgold-path.patch
rename to pkgs/development/compilers/llvm/clang-11-15-LLVMgold-path.patch

From 3e8355df84c7352c908bfbe3ac0231c9d6ea24a2 Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Tue, 12 Dec 2023 17:34:08 +0100
Subject: [PATCH 17/45] llvmPackages_{16,17,git}: reenable LLVMgold plugin

See https://github.com/nixos/nixpkgs/issues/123361 for context regarding
the clang patch.

Seems like the https://github.com/llvm/llvm-project/issues/61350 crash
no longer occurs in the test suite and we can reenable the gold plugin
by default.
---
 .../compilers/llvm/16/clang/default.nix            | 11 +++++------
 .../development/compilers/llvm/16/llvm/default.nix |  3 ++-
 .../compilers/llvm/17/clang/default.nix            | 11 +++++------
 .../development/compilers/llvm/17/llvm/default.nix | 10 +++++-----
 .../llvm/clang-at-least-16-LLVMgold-path.patch     | 14 ++++++++++++++
 .../compilers/llvm/git/clang/default.nix           | 11 +++++------
 .../compilers/llvm/git/llvm/default.nix            |  9 ++++-----
 7 files changed, 40 insertions(+), 29 deletions(-)
 create mode 100644 pkgs/development/compilers/llvm/clang-at-least-16-LLVMgold-path.patch

diff --git a/pkgs/development/compilers/llvm/16/clang/default.nix b/pkgs/development/compilers/llvm/16/clang/default.nix
index b801bdda5292..5f28e810f603 100644
--- a/pkgs/development/compilers/llvm/16/clang/default.nix
+++ b/pkgs/development/compilers/llvm/16/clang/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, llvm_meta
 , monorepoSrc, runCommand
-, cmake, ninja, libxml2, libllvm, version, python3
+, substituteAll, cmake, ninja, libxml2, libllvm, version, python3
 , buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
@@ -51,11 +51,10 @@ let
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
       ../../common/clang/add-nostdlibinc-flag.patch
-      # FIMXE: do we need this patch?
-      # (substituteAll {
-      #   src = ../../clang-11-12-LLVMgold-path.patch;
-      #  libllvmLibdir = "${libllvm.lib}/lib";
-      # })
+      (substituteAll {
+        src = ../../clang-at-least-16-LLVMgold-path.patch;
+       libllvmLibdir = "${libllvm.lib}/lib";
+      })
     ];
 
     postPatch = ''
diff --git a/pkgs/development/compilers/llvm/16/llvm/default.nix b/pkgs/development/compilers/llvm/16/llvm/default.nix
index 9994076bbdab..a6faf9fd635d 100644
--- a/pkgs/development/compilers/llvm/16/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/16/llvm/default.nix
@@ -325,7 +325,8 @@ in
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (false) [
+  ] ++ optionals enableGoldPlugin [
+    # For LLVMgold plugin
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/17/clang/default.nix b/pkgs/development/compilers/llvm/17/clang/default.nix
index a576c07d3661..3184437830a2 100644
--- a/pkgs/development/compilers/llvm/17/clang/default.nix
+++ b/pkgs/development/compilers/llvm/17/clang/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, llvm_meta
 , monorepoSrc, runCommand
-, cmake, ninja, libxml2, libllvm, version, python3
+, substituteAll, cmake, ninja, libxml2, libllvm, version, python3
 , buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
@@ -52,11 +52,10 @@ let
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
       ../../common/clang/add-nostdlibinc-flag.patch
-      # FIMXE: do we need this patch?
-      # (substituteAll {
-      #   src = ../../clang-11-12-LLVMgold-path.patch;
-      #  libllvmLibdir = "${libllvm.lib}/lib";
-      # })
+      (substituteAll {
+        src = ../../clang-at-least-16-LLVMgold-path.patch;
+       libllvmLibdir = "${libllvm.lib}/lib";
+      })
     ];
 
     postPatch = ''
diff --git a/pkgs/development/compilers/llvm/17/llvm/default.nix b/pkgs/development/compilers/llvm/17/llvm/default.nix
index 3d05837d45da..b38fef333135 100644
--- a/pkgs/development/compilers/llvm/17/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/17/llvm/default.nix
@@ -8,8 +8,7 @@
 , python3
 , python3Packages
 , libffi
-# TODO: Gold plugin on LLVM16 has a severe memory corruption bug: https://github.com/llvm/llvm-project/issues/61350.
-, enableGoldPlugin ? false
+, enableGoldPlugin ? true
 , libbfd
 , libpfm
 , libxml2
@@ -66,8 +65,8 @@ let
   else python3;
 
 in
-  assert (lib.assertMsg (!enableGoldPlugin) "Gold plugin cannot be enabled on LLVM16 due to a upstream issue: https://github.com/llvm/llvm-project/issues/61350");
-  stdenv.mkDerivation (rec {
+
+stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
@@ -325,7 +324,8 @@ in
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (false) [
+  ] ++ optionals enableGoldPlugin [
+    # For LLVMgold plugin
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/clang-at-least-16-LLVMgold-path.patch b/pkgs/development/compilers/llvm/clang-at-least-16-LLVMgold-path.patch
new file mode 100644
index 000000000000..74cdbacc8a71
--- /dev/null
+++ b/pkgs/development/compilers/llvm/clang-at-least-16-LLVMgold-path.patch
@@ -0,0 +1,14 @@
+diff --git a/lib/Driver/ToolChains/CommonArgs.cpp b/lib/Driver/ToolChains/CommonArgs.cpp
+index 34640b3c450d..93c4a4f4ec5c 100644
+--- a/lib/Driver/ToolChains/CommonArgs.cpp
++++ b/lib/Driver/ToolChains/CommonArgs.cpp
+@@ -589,8 +589,7 @@ void tools::addLTOOptions(const ToolChain &ToolChain, const ArgList &Args,
+ #endif
+ 
+     SmallString<1024> Plugin;
+-    llvm::sys::path::native(Twine(D.Dir) +
+-                                "/../" CLANG_INSTALL_LIBDIR_BASENAME +
++    llvm::sys::path::native(Twine("@libllvmLibdir@") +
+                                 PluginName + Suffix,
+                             Plugin);
+     CmdArgs.push_back(Args.MakeArgString(Twine(PluginPrefix) + Plugin));
diff --git a/pkgs/development/compilers/llvm/git/clang/default.nix b/pkgs/development/compilers/llvm/git/clang/default.nix
index b193ebba3d6d..d8fe08569f3f 100644
--- a/pkgs/development/compilers/llvm/git/clang/default.nix
+++ b/pkgs/development/compilers/llvm/git/clang/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, llvm_meta
 , monorepoSrc, runCommand
-, cmake, ninja, libxml2, libllvm, version, python3
+, substituteAll, cmake, ninja, libxml2, libllvm, version, python3
 , buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
@@ -52,11 +52,10 @@ let
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
       ../../common/clang/add-nostdlibinc-flag.patch
-      # FIMXE: do we need this patch?
-      # (substituteAll {
-      #   src = ../../clang-11-12-LLVMgold-path.patch;
-      #  libllvmLibdir = "${libllvm.lib}/lib";
-      # })
+      (substituteAll {
+        src = ../../clang-at-least-16-LLVMgold-path.patch;
+       libllvmLibdir = "${libllvm.lib}/lib";
+      })
     ];
 
     postPatch = ''
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 3d05837d45da..36edfee8a091 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -8,8 +8,7 @@
 , python3
 , python3Packages
 , libffi
-# TODO: Gold plugin on LLVM16 has a severe memory corruption bug: https://github.com/llvm/llvm-project/issues/61350.
-, enableGoldPlugin ? false
+, enableGoldPlugin ? true
 , libbfd
 , libpfm
 , libxml2
@@ -66,8 +65,8 @@ let
   else python3;
 
 in
-  assert (lib.assertMsg (!enableGoldPlugin) "Gold plugin cannot be enabled on LLVM16 due to a upstream issue: https://github.com/llvm/llvm-project/issues/61350");
-  stdenv.mkDerivation (rec {
+
+stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
@@ -325,7 +324,7 @@ in
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (false) [
+  ] ++ optionals enableGoldPlugin [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"

From 271a204ced19f1db030ed40b6b0f22844ec345b2 Mon Sep 17 00:00:00 2001
From: Nicolas Benes <nbenes.gh@xandea.de>
Date: Sun, 19 Nov 2023 16:47:56 +0100
Subject: [PATCH 18/45] json-c: 0.16 -> 0.17

https://github.com/json-c/json-c/blob/json-c-0.17-20230812/ChangeLog
---
 pkgs/development/libraries/json-c/default.nix | 29 +++++++++----------
 1 file changed, 13 insertions(+), 16 deletions(-)

diff --git a/pkgs/development/libraries/json-c/default.nix b/pkgs/development/libraries/json-c/default.nix
index 785548c211a9..ab3d2be6f010 100644
--- a/pkgs/development/libraries/json-c/default.nix
+++ b/pkgs/development/libraries/json-c/default.nix
@@ -1,24 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "json-c";
-  version = "0.16";
+  version = "0.17";
 
   src = fetchFromGitHub {
     owner = "json-c";
     repo = "json-c";
-    rev = "json-c-0.16-20220414";
-    sha256 = "sha256-KbnUWLgpg6/1wvXhUoYswyqDcgiwEcvgaWCPjNcX20o=";
+    rev = "json-c-0.17-20230812";
+    hash = "sha256-R5KIJ0xVgGqffjzJaZvvvhAneJ+ZBuanyF6KYTTxb58=";
   };
 
-  patches = [
-    # needed for emscripten, which uses LLVM 15+
-    (fetchpatch {
-      url = "https://github.com/json-c/json-c/commit/6eca65617aacd19f4928acd5766b8dd20eda0b34.patch";
-      sha256 = "sha256-fyugX+HgYlt/4AVtfNDaKS+blyUt8JYTNqkmhURb9dk=";
-    })
-  ];
-
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ cmake ];
@@ -31,9 +27,10 @@ stdenv.mkDerivation rec {
       and parse JSON formatted strings back into the C representation of JSON
       objects.
     '';
-    homepage    = "https://github.com/json-c/json-c/wiki";
+    homepage = "https://github.com/json-c/json-c/wiki";
+    changelog = "https://github.com/json-c/json-c/blob/${finalAttrs.src.rev}/ChangeLog";
     maintainers = with maintainers; [ lovek323 ];
-    platforms   = platforms.unix;
+    platforms = platforms.unix;
     license = licenses.mit;
   };
-}
+})

From 59169c5dc342c8a8a660bf1ed5854da0966bb74c Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 2 Dec 2023 13:24:11 +0000
Subject: [PATCH 19/45] xsimd: 11.2.0 -> 12.1.1

Changes: https://github.com/xtensor-stack/xsimd/compare/11.2.0...12.1.1
---
 pkgs/development/libraries/xsimd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/xsimd/default.nix b/pkgs/development/libraries/xsimd/default.nix
index 3a9a90fbe2bc..87da2c546b86 100644
--- a/pkgs/development/libraries/xsimd/default.nix
+++ b/pkgs/development/libraries/xsimd/default.nix
@@ -7,12 +7,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xsimd";
-  version = "11.2.0";
+  version = "12.1.1";
   src = fetchFromGitHub {
     owner = "xtensor-stack";
     repo = "xsimd";
     rev = finalAttrs.version;
-    sha256 = "sha256-CzgfxXGZXoJ56dX+mDPsHZC31YudrZXpX2tovh/Vjr0=";
+    hash = "sha256-ofUFieeRtpnzNv3Ad5oYwKWb2XcqQHoj601TIhydJyI=";
   };
   patches = [
     # Ideally, Accelerate/Accelerate.h should be used for this implementation,

From 9faad7fb0b2a3a20aa0632573e78af02ff928f29 Mon Sep 17 00:00:00 2001
From: Connor Baker <connor.baker@tweag.io>
Date: Thu, 7 Dec 2023 19:26:39 +0000
Subject: [PATCH 20/45] auto-patchelf: add support for __structuredAttrs

---
 pkgs/build-support/setup-hooks/auto-patchelf.sh | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.sh b/pkgs/build-support/setup-hooks/auto-patchelf.sh
index 371389df427b..6930fcec9d1d 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.sh
@@ -53,7 +53,18 @@ autoPatchelf() {
         esac
     done
 
-    readarray -td' ' ignoreMissingDepsArray < <(echo -n "$autoPatchelfIgnoreMissingDeps")
+    if [ -n "$__structuredAttrs" ]; then
+        local ignoreMissingDepsArray=( "${autoPatchelfIgnoreMissingDeps[@]}" )
+        local appendRunpathsArray=( "${appendRunpaths[@]}" )
+        local runtimeDependenciesArray=( "${runtimeDependencies[@]}" )
+        local patchelfFlagsArray=( "${patchelfFlags[@]}" )
+    else
+        readarray -td' ' ignoreMissingDepsArray < <(echo -n "$autoPatchelfIgnoreMissingDeps")
+        local appendRunpathsArray=($appendRunpaths)
+        local runtimeDependenciesArray=($runtimeDependencies)
+        local patchelfFlagsArray=($patchelfFlags)
+    fi
+
     if [ "$autoPatchelfIgnoreMissingDeps" == "1" ]; then
         echo "autoPatchelf: WARNING: setting 'autoPatchelfIgnoreMissingDeps" \
              "= true;' is deprecated and will be removed in a future release." \
@@ -61,9 +72,6 @@ autoPatchelf() {
         ignoreMissingDepsArray=( "*" )
     fi
 
-    local appendRunpathsArray=($appendRunpaths)
-    local runtimeDependenciesArray=($runtimeDependencies)
-    local patchelfFlagsArray=($patchelfFlags)
     @pythonInterpreter@ @autoPatchelfScript@                            \
         ${norecurse:+--no-recurse}                                      \
         --ignore-missing "${ignoreMissingDepsArray[@]}"                 \

From 45901c42fc91c1d1d46a811b9578b4d92da98135 Mon Sep 17 00:00:00 2001
From: Connor Baker <connor.baker@tweag.io>
Date: Thu, 14 Dec 2023 16:53:34 +0000
Subject: [PATCH 21/45] auto-patchelf: improve deprecation check by searching
 all elements

---
 pkgs/build-support/setup-hooks/auto-patchelf.sh | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.sh b/pkgs/build-support/setup-hooks/auto-patchelf.sh
index 6930fcec9d1d..9f6366b3feae 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.sh
@@ -65,12 +65,17 @@ autoPatchelf() {
         local patchelfFlagsArray=($patchelfFlags)
     fi
 
-    if [ "$autoPatchelfIgnoreMissingDeps" == "1" ]; then
-        echo "autoPatchelf: WARNING: setting 'autoPatchelfIgnoreMissingDeps" \
-             "= true;' is deprecated and will be removed in a future release." \
-             "Use 'autoPatchelfIgnoreMissingDeps = [ \"*\" ];' instead." >&2
-        ignoreMissingDepsArray=( "*" )
-    fi
+    # Check if ignoreMissingDepsArray contains "1" and if so, replace it with
+    # "*", printing a deprecation warning.
+    for dep in "${ignoreMissingDepsArray[@]}"; do
+        if [ "$dep" == "1" ]; then
+            echo "autoPatchelf: WARNING: setting 'autoPatchelfIgnoreMissingDeps" \
+                 "= true;' is deprecated and will be removed in a future release." \
+                 "Use 'autoPatchelfIgnoreMissingDeps = [ \"*\" ];' instead." >&2
+            ignoreMissingDepsArray=( "*" )
+            break
+        fi
+    done
 
     @pythonInterpreter@ @autoPatchelfScript@                            \
         ${norecurse:+--no-recurse}                                      \

From 3d39b8561d1cd8d2af029b868f08db6dceec526a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 13 Dec 2023 16:04:30 -0800
Subject: [PATCH 22/45] libwacom: 2.8.0 -> 2.9.0

Diff: https://github.com/linuxwacom/libwacom/compare/libwacom-2.8.0...libwacom-2.9.0

Changelog: https://github.com/linuxwacom/libwacom/blob/libwacom-2.9.0/NEWS
---
 .../libraries/libwacom/default.nix            | 22 +++++++++++++------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/libraries/libwacom/default.nix b/pkgs/development/libraries/libwacom/default.nix
index 2fbb29347d42..58356cf5c75d 100644
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -6,14 +6,16 @@
 , glib
 , pkg-config
 , udev
+, libevdev
 , libgudev
+, libxml2
 , python3
 , valgrind
 }:
 
 stdenv.mkDerivation rec {
   pname = "libwacom";
-  version = "2.8.0";
+  version = "2.9.0";
 
   outputs = [ "out" "dev" ];
 
@@ -21,7 +23,7 @@ stdenv.mkDerivation rec {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    hash = "sha256-VjFZBlOIG1L4dXPJ8DWxrbfVqdQC+X7zVXFryo43FFc=";
+    hash = "sha256-oM3dd22hQaAXdNoO2Q2JvO2lJCkmfw8f0NWxYcVT3lA=";
   };
 
   postPatch = ''
@@ -38,6 +40,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     glib
     udev
+    libevdev
     libgudev
   ];
 
@@ -50,13 +53,18 @@ stdenv.mkDerivation rec {
     "-Dtests=${if doCheck then "enabled" else "disabled"}"
   ];
 
+  checkInputs = [
+    libxml2
+  ];
+
   nativeCheckInputs = [
     valgrind
-  ] ++ (with python3.pkgs; [
-    libevdev
-    pytest
-    pyudev
-  ]);
+    (python3.withPackages (ps: with ps; [
+      ps.libevdev
+      pytest
+      pyudev
+    ]))
+  ];
 
   meta = with lib; {
     platforms = platforms.linux;

From ad98277a948005906d49c8234b5ff18bf8bc2b06 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 14 Dec 2023 12:22:26 -0800
Subject: [PATCH 23/45] libwacom: correct license

---
 pkgs/development/libraries/libwacom/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/libwacom/default.nix b/pkgs/development/libraries/libwacom/default.nix
index 58356cf5c75d..ed5413464e1d 100644
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -72,6 +72,6 @@ stdenv.mkDerivation rec {
     changelog = "https://github.com/linuxwacom/libwacom/blob/${src.rev}/NEWS";
     description = "Libraries, configuration, and diagnostic tools for Wacom tablets running under Linux";
     maintainers = teams.freedesktop.members;
-    license = licenses.mit;
+    license = licenses.hpnd;
   };
 }

From 3d69cf4bdda871fc03033a2fddd4a601bf097b5a Mon Sep 17 00:00:00 2001
From: "Alexander V. Nikolaev" <avn@avnik.info>
Date: Sun, 17 Dec 2023 17:53:12 +0200
Subject: [PATCH 24/45] jbig2dec: fix cross-compilation

---
 pkgs/development/libraries/jbig2dec/default.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/development/libraries/jbig2dec/default.nix b/pkgs/development/libraries/jbig2dec/default.nix
index 13059088d25c..af99944dae72 100644
--- a/pkgs/development/libraries/jbig2dec/default.nix
+++ b/pkgs/development/libraries/jbig2dec/default.nix
@@ -13,10 +13,6 @@ stdenv.mkDerivation rec {
     patchShebangs test_jbig2dec.py
   '';
 
-  preConfigure = ''
-    ./autogen.sh
-  '';
-
   nativeBuildInputs = [ autoconf automake libtool ];
 
   # `autogen.sh` runs `configure`, and expects that any flags needed

From 21714bc071d192f02277ecb0ca9e0f2740c42582 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 18 Dec 2023 19:18:03 +0000
Subject: [PATCH 25/45] unittest-cpp: fix 'Version:' field in .pc file

Before the change project built using `cmake` had Version field empty:

    Version:

After the change version is set as expected:

    Version: 2.1.0

Noticed as as a build failure of `echant-2.6.4` which failed to find the
package using `pkg-config --exists --print-errors "UnitTest++ >= 1.6"`
expression.
---
 pkgs/development/libraries/unittest-cpp/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/libraries/unittest-cpp/default.nix b/pkgs/development/libraries/unittest-cpp/default.nix
index e9f67a74f9a3..6a6407eb32ff 100644
--- a/pkgs/development/libraries/unittest-cpp/default.nix
+++ b/pkgs/development/libraries/unittest-cpp/default.nix
@@ -24,6 +24,10 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  # Fix 'Version:' setting in .pc file. TODO: remove once upstreamed:
+  #     https://github.com/unittest-cpp/unittest-cpp/pull/188
+  cmakeFlags = [ "-DPACKAGE_VERSION=${version}" ];
+
   nativeBuildInputs = [ cmake ];
 
   doCheck = false;

From 2e223c782a8fcf954b6e35a63815d17a779c91a5 Mon Sep 17 00:00:00 2001
From: Ingo Blechschmidt <iblech@speicherleck.de>
Date: Mon, 18 Dec 2023 21:06:23 +0100
Subject: [PATCH 26/45] procps: enable 8bit support, thereby fix #275220

---
 pkgs/os-specific/linux/procps-ng/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index 56a92ffa44ef..e4d245fdc7ce 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -48,8 +48,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  # Too red
-  configureFlags = [ "--disable-modern-top" ]
+  # Too red; 8bit support for fixing https://github.com/NixOS/nixpkgs/issues/275220
+  configureFlags = [ "--disable-modern-top" "--enable-watch8bit" ]
     ++ lib.optional withSystemd "--with-systemd"
     ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "ac_cv_func_malloc_0_nonnull=yes"

From 6008246790d4b3eb27c02d3a9b9424b91f55a8b4 Mon Sep 17 00:00:00 2001
From: Yuri Nesterov <yuriy.nesterov@unikie.com>
Date: Thu, 22 Jun 2023 15:17:42 +0300
Subject: [PATCH 27/45] systemd: disable NSCD when DNSSEC validation is
 disabled in timesyncd

When a system has a wrong date and time timesyncd is unable to synchronize it
because DNSSEC doesn't work. In order to break this chicken and egg problem
systemd-timesync disables DNSSEC validation by setting
SYSTEMD_NSS_RESOLVE_VALIDATE=0 in the unit file. However, it doesn't work in
NixOS because it uses NSCD. This patch disables NSCD in systemd-timesyncd when
SYSTEMD_NSS_RESOLVE_VALIDATE is set to 0 so that it uses NSS libraries
directly. In order for it to be able to find the libnss_resolve.so.2 library
this patch adds the systemd directory in the nix store to the LD_LIBRARY_PATH.
---
 nixos/modules/system/boot/timesyncd.nix       |  7 +++
 nixos/tests/all-tests.nix                     |  1 +
 nixos/tests/systemd-timesyncd-nscd-dnssec.nix | 61 +++++++++++++++++++
 ...e-NSCD-when-DNSSEC-validation-is-dis.patch | 46 ++++++++++++++
 pkgs/os-specific/linux/systemd/default.nix    |  1 +
 5 files changed, 116 insertions(+)
 create mode 100644 nixos/tests/systemd-timesyncd-nscd-dnssec.nix
 create mode 100644 pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch

diff --git a/nixos/modules/system/boot/timesyncd.nix b/nixos/modules/system/boot/timesyncd.nix
index 7487cf97fe53..2666e4cd6b28 100644
--- a/nixos/modules/system/boot/timesyncd.nix
+++ b/nixos/modules/system/boot/timesyncd.nix
@@ -46,6 +46,13 @@ with lib;
       wantedBy = [ "sysinit.target" ];
       aliases = [ "dbus-org.freedesktop.timesync1.service" ];
       restartTriggers = [ config.environment.etc."systemd/timesyncd.conf".source ];
+      # systemd-timesyncd disables DNSSEC validation in the nss-resolve module by setting SYSTEMD_NSS_RESOLVE_VALIDATE to 0 in the unit file.
+      # This is required in order to solve the chicken-and-egg problem when DNSSEC validation needs the correct time to work, but to set the
+      # correct time, we need to connect to an NTP server, which usually requires resolving its hostname.
+      # In order for nss-resolve to be able to read this environment variable we patch systemd-timesyncd to disable NSCD and use NSS modules directly.
+      # This means that systemd-timesyncd needs to have NSS modules path in LD_LIBRARY_PATH. When systemd-resolved is disabled we still need to set
+      # NSS module path so that systemd-timesyncd keeps using other NSS modules that are configured in the system.
+      environment.LD_LIBRARY_PATH = config.system.nssModules.path;
 
       preStart = (
         # Ensure that we have some stored time to prevent
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 6f5ada84701f..85027eb1a71b 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -847,6 +847,7 @@ in {
   systemd-shutdown = handleTest ./systemd-shutdown.nix {};
   systemd-sysupdate = runTest ./systemd-sysupdate.nix;
   systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
+  systemd-timesyncd-nscd-dnssec = handleTest ./systemd-timesyncd-nscd-dnssec.nix {};
   systemd-user-tmpfiles-rules = handleTest ./systemd-user-tmpfiles-rules.nix {};
   systemd-misc = handleTest ./systemd-misc.nix {};
   systemd-userdbd = handleTest ./systemd-userdbd.nix {};
diff --git a/nixos/tests/systemd-timesyncd-nscd-dnssec.nix b/nixos/tests/systemd-timesyncd-nscd-dnssec.nix
new file mode 100644
index 000000000000..697dd824e345
--- /dev/null
+++ b/nixos/tests/systemd-timesyncd-nscd-dnssec.nix
@@ -0,0 +1,61 @@
+# This test verifies that systemd-timesyncd can resolve the NTP server hostname when DNSSEC validation
+# fails even though it is enforced in the systemd-resolved settings. It is required in order to solve
+# the chicken-and-egg problem when DNSSEC validation needs the correct time to work, but to set the
+# correct time, we need to connect to an NTP server, which usually requires resolving its hostname.
+#
+# This test does the following:
+# - Sets up a DNS server (tinydns) listening on the eth1 ip addess, serving .ntp and fake.ntp records.
+# - Configures that DNS server as a resolver and enables DNSSEC in systemd-resolved settings.
+# - Configures systemd-timesyncd to use fake.ntp hostname as an NTP server.
+# - Performs a regular DNS lookup, to ensure it fails due to broken DNSSEC.
+# - Waits until systemd-timesyncd resolves fake.ntp by checking its debug output.
+#   Here, we don't expect systemd-timesyncd to connect and synchronize time because there is no NTP
+#   server running. For this test to succeed, we only need to ensure that systemd-timesyncd
+#   resolves the IP address of the fake.ntp host.
+
+import ./make-test-python.nix ({ pkgs, ... }:
+
+let
+  ntpHostname = "fake.ntp";
+  ntpIP = "192.0.2.1";
+in
+{
+  name = "systemd-timesyncd";
+  nodes.machine = { pkgs, lib, config, ... }:
+    let
+      eth1IP = (lib.head config.networking.interfaces.eth1.ipv4.addresses).address;
+    in
+    {
+      # Setup a local DNS server for the NTP domain on the eth1 IP address
+      services.tinydns = {
+        enable = true;
+        ip = eth1IP;
+        data = ''
+          .ntp:${eth1IP}
+          +.${ntpHostname}:${ntpIP}
+        '';
+      };
+
+      # Enable systemd-resolved with DNSSEC and use the local DNS as a name server
+      services.resolved.enable = true;
+      services.resolved.dnssec = "true";
+      networking.nameservers = [ eth1IP ];
+
+      # Configure systemd-timesyncd to use our NTP hostname
+      services.timesyncd.enable = lib.mkForce true;
+      services.timesyncd.servers = [ ntpHostname ];
+      services.timesyncd.extraConfig = ''
+        FallbackNTP=${ntpHostname}
+      '';
+
+      # The debug output is necessary to determine whether systemd-timesyncd successfully resolves our NTP hostname or not
+      systemd.services.systemd-timesyncd.environment.SYSTEMD_LOG_LEVEL = "debug";
+    };
+
+  testScript = ''
+    machine.wait_for_unit("tinydns.service")
+    machine.wait_for_unit("systemd-timesyncd.service")
+    machine.fail("resolvectl query ${ntpHostname}")
+    machine.wait_until_succeeds("journalctl -u systemd-timesyncd.service --grep='Resolved address ${ntpIP}:123 for ${ntpHostname}'")
+  '';
+})
diff --git a/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch b/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
new file mode 100644
index 000000000000..68ae22644835
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
@@ -0,0 +1,46 @@
+From 7a27556920fe1feefd17096841c8f3ca1294a1b3 Mon Sep 17 00:00:00 2001
+From: Yuri Nesterov <yuriy.nesterov@unikie.com>
+Date: Wed, 21 Jun 2023 17:17:38 +0300
+Subject: [PATCH] timesyncd: disable NSCD when DNSSEC validation is disabled
+
+Systemd-timesyncd sets SYSTEMD_NSS_RESOLVE_VALIDATE=0 in the unit file
+to disable DNSSEC validation but it doesn't work when NSCD is used in
+the system. This patch disabes NSCD in systemd-timesyncd when
+SYSTEMD_NSS_RESOLVE_VALIDATE is set to 0 so that it uses NSS libraries
+directly.
+---
+ src/timesync/timesyncd.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/src/timesync/timesyncd.c b/src/timesync/timesyncd.c
+index 1d8ebecc91..2b0ae361ff 100644
+--- a/src/timesync/timesyncd.c
++++ b/src/timesync/timesyncd.c
+@@ -21,6 +21,11 @@
+ #include "timesyncd-conf.h"
+ #include "timesyncd-manager.h"
+ #include "user-util.h"
++#include "env-util.h"
++
++struct traced_file;
++extern void __nss_disable_nscd(void (*)(size_t, struct traced_file *));
++static void register_traced_file(size_t dbidx, struct traced_file *finfo) {}
+ 
+ static int advance_tstamp(int fd, const struct stat *st) {
+         assert_se(fd >= 0);
+@@ -198,6 +203,12 @@ static int run(int argc, char *argv[]) {
+         if (r < 0)
+                 return log_error_errno(r, "Failed to parse fallback server strings: %m");
+ 
++        r = getenv_bool_secure("SYSTEMD_NSS_RESOLVE_VALIDATE");
++        if (r == 0) {
++                log_info("Disabling NSCD because DNSSEC validation is turned off");
++                __nss_disable_nscd(register_traced_file);
++        }
++
+         log_debug("systemd-timesyncd running as pid " PID_FMT, getpid_cached());
+ 
+         notify_message = notify_start("READY=1\n"
+-- 
+2.34.1
+
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index ff2c22881819..a2f77f231fd3 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -206,6 +206,7 @@ stdenv.mkDerivation (finalAttrs: {
     ./0017-core-don-t-taint-on-unmerged-usr.patch
     ./0018-tpm2_context_init-fix-driver-name-checking.patch
     ./0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+    ./0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {

From 1bfeb1412bfce712a489c4f1b4a32466320fedd0 Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Wed, 20 Dec 2023 14:04:09 +0100
Subject: [PATCH 28/45] libssh2: apply patch for CVE-2023-48795

---
 .../libraries/libssh2/CVE-2023-48795.patch    | 459 ++++++++++++++++++
 .../development/libraries/libssh2/default.nix |   6 +
 2 files changed, 465 insertions(+)
 create mode 100644 pkgs/development/libraries/libssh2/CVE-2023-48795.patch

diff --git a/pkgs/development/libraries/libssh2/CVE-2023-48795.patch b/pkgs/development/libraries/libssh2/CVE-2023-48795.patch
new file mode 100644
index 000000000000..c89e4a137b72
--- /dev/null
+++ b/pkgs/development/libraries/libssh2/CVE-2023-48795.patch
@@ -0,0 +1,459 @@
+From d34d9258b8420b19ec3f97b4cc5bf7aa7d98e35a Mon Sep 17 00:00:00 2001
+From: Michael Buckley <michael@buckleyisms.com>
+Date: Thu, 30 Nov 2023 15:08:02 -0800
+Subject: [PATCH] src: add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack"
+
+Refs:
+https://terrapin-attack.com/
+https://seclists.org/oss-sec/2023/q4/292
+https://osv.dev/list?ecosystem=&q=CVE-2023-48795
+https://github.com/advisories/GHSA-45x7-px36-x8w8
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795
+
+Fixes #1290
+Closes #1291
+---
+ src/kex.c          | 63 +++++++++++++++++++++++------------
+ src/libssh2_priv.h | 18 +++++++---
+ src/packet.c       | 83 +++++++++++++++++++++++++++++++++++++++++++---
+ src/packet.h       |  2 +-
+ src/session.c      |  3 ++
+ src/transport.c    | 12 ++++++-
+ 6 files changed, 149 insertions(+), 32 deletions(-)
+
+diff --git a/src/kex.c b/src/kex.c
+index 8e7b7f0af3..a7b301e157 100644
+--- a/src/kex.c
++++ b/src/kex.c
+@@ -3032,6 +3032,13 @@ kex_method_extension_negotiation = {
+     0,
+ };
+ 
++static const LIBSSH2_KEX_METHOD
++kex_method_strict_client_extension = {
++    "kex-strict-c-v00@openssh.com",
++    NULL,
++    0,
++};
++
+ static const LIBSSH2_KEX_METHOD *libssh2_kex_methods[] = {
+ #if LIBSSH2_ED25519
+     &kex_method_ssh_curve25519_sha256,
+@@ -3050,6 +3057,7 @@ static const LIBSSH2_KEX_METHOD *libssh2_kex_methods[] = {
+     &kex_method_diffie_helman_group1_sha1,
+     &kex_method_diffie_helman_group_exchange_sha1,
+     &kex_method_extension_negotiation,
++    &kex_method_strict_client_extension,
+     NULL
+ };
+ 
+@@ -3302,13 +3310,13 @@ static int kexinit(LIBSSH2_SESSION * session)
+     return 0;
+ }
+ 
+-/* kex_agree_instr
++/* _libssh2_kex_agree_instr
+  * Kex specific variant of strstr()
+  * Needle must be preceded by BOL or ',', and followed by ',' or EOL
+  */
+-static unsigned char *
+-kex_agree_instr(unsigned char *haystack, size_t haystack_len,
+-                const unsigned char *needle, size_t needle_len)
++unsigned char *
++_libssh2_kex_agree_instr(unsigned char *haystack, size_t haystack_len,
++                         const unsigned char *needle, size_t needle_len)
+ {
+     unsigned char *s;
+     unsigned char *end_haystack;
+@@ -3393,7 +3401,7 @@ static int kex_agree_hostkey(LIBSSH2_SESSION * session,
+         while(s && *s) {
+             unsigned char *p = (unsigned char *) strchr((char *) s, ',');
+             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
+-            if(kex_agree_instr(hostkey, hostkey_len, s, method_len)) {
++            if(_libssh2_kex_agree_instr(hostkey, hostkey_len, s, method_len)) {
+                 const LIBSSH2_HOSTKEY_METHOD *method =
+                     (const LIBSSH2_HOSTKEY_METHOD *)
+                     kex_get_method_by_name((char *) s, method_len,
+@@ -3427,9 +3435,9 @@ static int kex_agree_hostkey(LIBSSH2_SESSION * session,
+     }
+ 
+     while(hostkeyp && (*hostkeyp) && (*hostkeyp)->name) {
+-        s = kex_agree_instr(hostkey, hostkey_len,
+-                            (unsigned char *) (*hostkeyp)->name,
+-                            strlen((*hostkeyp)->name));
++        s = _libssh2_kex_agree_instr(hostkey, hostkey_len,
++                                     (unsigned char *) (*hostkeyp)->name,
++                                     strlen((*hostkeyp)->name));
+         if(s) {
+             /* So far so good, but does it suit our purposes? (Encrypting vs
+                Signing) */
+@@ -3463,6 +3471,12 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex,
+ {
+     const LIBSSH2_KEX_METHOD **kexp = libssh2_kex_methods;
+     unsigned char *s;
++    const unsigned char *strict =
++        (unsigned char *)"kex-strict-s-v00@openssh.com";
++
++    if(_libssh2_kex_agree_instr(kex, kex_len, strict, 28)) {
++        session->kex_strict = 1;
++    }
+ 
+     if(session->kex_prefs) {
+         s = (unsigned char *) session->kex_prefs;
+@@ -3470,7 +3484,7 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex,
+         while(s && *s) {
+             unsigned char *q, *p = (unsigned char *) strchr((char *) s, ',');
+             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
+-            q = kex_agree_instr(kex, kex_len, s, method_len);
++            q = _libssh2_kex_agree_instr(kex, kex_len, s, method_len);
+             if(q) {
+                 const LIBSSH2_KEX_METHOD *method = (const LIBSSH2_KEX_METHOD *)
+                     kex_get_method_by_name((char *) s, method_len,
+@@ -3504,9 +3518,9 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex,
+     }
+ 
+     while(*kexp && (*kexp)->name) {
+-        s = kex_agree_instr(kex, kex_len,
+-                            (unsigned char *) (*kexp)->name,
+-                            strlen((*kexp)->name));
++        s = _libssh2_kex_agree_instr(kex, kex_len,
++                                     (unsigned char *) (*kexp)->name,
++                                     strlen((*kexp)->name));
+         if(s) {
+             /* We've agreed on a key exchange method,
+              * Can we agree on a hostkey that works with this kex?
+@@ -3550,7 +3564,7 @@ static int kex_agree_crypt(LIBSSH2_SESSION * session,
+             unsigned char *p = (unsigned char *) strchr((char *) s, ',');
+             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
+ 
+-            if(kex_agree_instr(crypt, crypt_len, s, method_len)) {
++            if(_libssh2_kex_agree_instr(crypt, crypt_len, s, method_len)) {
+                 const LIBSSH2_CRYPT_METHOD *method =
+                     (const LIBSSH2_CRYPT_METHOD *)
+                     kex_get_method_by_name((char *) s, method_len,
+@@ -3572,9 +3586,9 @@ static int kex_agree_crypt(LIBSSH2_SESSION * session,
+     }
+ 
+     while(*cryptp && (*cryptp)->name) {
+-        s = kex_agree_instr(crypt, crypt_len,
+-                            (unsigned char *) (*cryptp)->name,
+-                            strlen((*cryptp)->name));
++        s = _libssh2_kex_agree_instr(crypt, crypt_len,
++                                     (unsigned char *) (*cryptp)->name,
++                                     strlen((*cryptp)->name));
+         if(s) {
+             endpoint->crypt = *cryptp;
+             return 0;
+@@ -3614,7 +3628,7 @@ static int kex_agree_mac(LIBSSH2_SESSION * session,
+             unsigned char *p = (unsigned char *) strchr((char *) s, ',');
+             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
+ 
+-            if(kex_agree_instr(mac, mac_len, s, method_len)) {
++            if(_libssh2_kex_agree_instr(mac, mac_len, s, method_len)) {
+                 const LIBSSH2_MAC_METHOD *method = (const LIBSSH2_MAC_METHOD *)
+                     kex_get_method_by_name((char *) s, method_len,
+                                            (const LIBSSH2_COMMON_METHOD **)
+@@ -3635,8 +3649,9 @@ static int kex_agree_mac(LIBSSH2_SESSION * session,
+     }
+ 
+     while(*macp && (*macp)->name) {
+-        s = kex_agree_instr(mac, mac_len, (unsigned char *) (*macp)->name,
+-                            strlen((*macp)->name));
++        s = _libssh2_kex_agree_instr(mac, mac_len,
++                                     (unsigned char *) (*macp)->name,
++                                     strlen((*macp)->name));
+         if(s) {
+             endpoint->mac = *macp;
+             return 0;
+@@ -3667,7 +3682,7 @@ static int kex_agree_comp(LIBSSH2_SESSION *session,
+             unsigned char *p = (unsigned char *) strchr((char *) s, ',');
+             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
+ 
+-            if(kex_agree_instr(comp, comp_len, s, method_len)) {
++            if(_libssh2_kex_agree_instr(comp, comp_len, s, method_len)) {
+                 const LIBSSH2_COMP_METHOD *method =
+                     (const LIBSSH2_COMP_METHOD *)
+                     kex_get_method_by_name((char *) s, method_len,
+@@ -3689,8 +3704,9 @@ static int kex_agree_comp(LIBSSH2_SESSION *session,
+     }
+ 
+     while(*compp && (*compp)->name) {
+-        s = kex_agree_instr(comp, comp_len, (unsigned char *) (*compp)->name,
+-                            strlen((*compp)->name));
++        s = _libssh2_kex_agree_instr(comp, comp_len,
++                                     (unsigned char *) (*compp)->name,
++                                     strlen((*compp)->name));
+         if(s) {
+             endpoint->comp = *compp;
+             return 0;
+@@ -3871,6 +3887,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
+                 session->local.kexinit = key_state->oldlocal;
+                 session->local.kexinit_len = key_state->oldlocal_len;
+                 key_state->state = libssh2_NB_state_idle;
++                session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
+                 session->state &= ~LIBSSH2_STATE_KEX_ACTIVE;
+                 session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
+                 return -1;
+@@ -3896,6 +3913,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
+                 session->local.kexinit = key_state->oldlocal;
+                 session->local.kexinit_len = key_state->oldlocal_len;
+                 key_state->state = libssh2_NB_state_idle;
++                session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
+                 session->state &= ~LIBSSH2_STATE_KEX_ACTIVE;
+                 session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
+                 return -1;
+@@ -3944,6 +3962,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
+         session->remote.kexinit = NULL;
+     }
+ 
++    session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
+     session->state &= ~LIBSSH2_STATE_KEX_ACTIVE;
+     session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
+ 
+diff --git a/src/libssh2_priv.h b/src/libssh2_priv.h
+index 7660366954..18d9ab2130 100644
+--- a/src/libssh2_priv.h
++++ b/src/libssh2_priv.h
+@@ -736,6 +736,9 @@ struct _LIBSSH2_SESSION
+     /* key signing algorithm preferences -- NULL yields server order */
+     char *sign_algo_prefs;
+ 
++    /* Whether to use the OpenSSH Strict KEX extension */
++    int kex_strict;
++
+     /* (remote as source of data -- packet_read ) */
+     libssh2_endpoint_data remote;
+ 
+@@ -908,6 +911,7 @@ struct _LIBSSH2_SESSION
+     int fullpacket_macstate;
+     size_t fullpacket_payload_len;
+     int fullpacket_packet_type;
++    uint32_t fullpacket_required_type;
+ 
+     /* State variables used in libssh2_sftp_init() */
+     libssh2_nonblocking_states sftpInit_state;
+@@ -948,10 +952,11 @@ struct _LIBSSH2_SESSION
+ };
+ 
+ /* session.state bits */
+-#define LIBSSH2_STATE_EXCHANGING_KEYS   0x00000001
+-#define LIBSSH2_STATE_NEWKEYS           0x00000002
+-#define LIBSSH2_STATE_AUTHENTICATED     0x00000004
+-#define LIBSSH2_STATE_KEX_ACTIVE        0x00000008
++#define LIBSSH2_STATE_INITIAL_KEX       0x00000001
++#define LIBSSH2_STATE_EXCHANGING_KEYS   0x00000002
++#define LIBSSH2_STATE_NEWKEYS           0x00000004
++#define LIBSSH2_STATE_AUTHENTICATED     0x00000008
++#define LIBSSH2_STATE_KEX_ACTIVE        0x00000010
+ 
+ /* session.flag helpers */
+ #ifdef MSG_NOSIGNAL
+@@ -1182,6 +1187,11 @@ ssize_t _libssh2_send(libssh2_socket_t socket, const void *buffer,
+ int _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
+                           key_exchange_state_t * state);
+ 
++unsigned char *_libssh2_kex_agree_instr(unsigned char *haystack,
++                                        size_t haystack_len,
++                                        const unsigned char *needle,
++                                        size_t needle_len);
++
+ /* Let crypt.c/hostkey.c expose their method structs */
+ const LIBSSH2_CRYPT_METHOD **libssh2_crypt_methods(void);
+ const LIBSSH2_HOSTKEY_METHOD **libssh2_hostkey_methods(void);
+diff --git a/src/packet.c b/src/packet.c
+index eccb8c56a8..6da14e9fa1 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -624,14 +624,13 @@ packet_authagent_open(LIBSSH2_SESSION * session,
+  * layer when it has received a packet.
+  *
+  * The input pointer 'data' is pointing to allocated data that this function
+- * is asked to deal with so on failure OR success, it must be freed fine.
+- * The only exception is when the return code is LIBSSH2_ERROR_EAGAIN.
++ * will be freed unless return the code is LIBSSH2_ERROR_EAGAIN.
+  *
+  * This function will always be called with 'datalen' greater than zero.
+  */
+ int
+ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+-                    size_t datalen, int macstate)
++                    size_t datalen, int macstate, uint32_t seq)
+ {
+     int rc = 0;
+     unsigned char *message = NULL;
+@@ -676,6 +675,70 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+         break;
+     }
+ 
++    if(session->state & LIBSSH2_STATE_INITIAL_KEX) {
++        if(msg == SSH_MSG_KEXINIT) {
++            if(!session->kex_strict) {
++                if(datalen < 17) {
++                    LIBSSH2_FREE(session, data);
++                    session->packAdd_state = libssh2_NB_state_idle;
++                    return _libssh2_error(session,
++                                          LIBSSH2_ERROR_BUFFER_TOO_SMALL,
++                                          "Data too short extracting kex");
++                }
++                else {
++                    const unsigned char *strict =
++                    (unsigned char *)"kex-strict-s-v00@openssh.com";
++                    struct string_buf buf;
++                    unsigned char *algs = NULL;
++                    size_t algs_len = 0;
++
++                    buf.data = (unsigned char *)data;
++                    buf.dataptr = buf.data;
++                    buf.len = datalen;
++                    buf.dataptr += 17; /* advance past type and cookie */
++
++                    if(_libssh2_get_string(&buf, &algs, &algs_len)) {
++                        LIBSSH2_FREE(session, data);
++                        session->packAdd_state = libssh2_NB_state_idle;
++                        return _libssh2_error(session,
++                                              LIBSSH2_ERROR_BUFFER_TOO_SMALL,
++                                              "Algs too short");
++                    }
++
++                    if(algs_len == 0 ||
++                       _libssh2_kex_agree_instr(algs, algs_len, strict, 28)) {
++                        session->kex_strict = 1;
++                    }
++                }
++            }
++
++            if(session->kex_strict && seq) {
++                LIBSSH2_FREE(session, data);
++                session->socket_state = LIBSSH2_SOCKET_DISCONNECTED;
++                session->packAdd_state = libssh2_NB_state_idle;
++                libssh2_session_disconnect(session, "strict KEX violation: "
++                                           "KEXINIT was not the first packet");
++
++                return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT,
++                                      "strict KEX violation: "
++                                      "KEXINIT was not the first packet");
++            }
++        }
++
++        if(session->kex_strict && session->fullpacket_required_type &&
++            session->fullpacket_required_type != msg) {
++            LIBSSH2_FREE(session, data);
++            session->socket_state = LIBSSH2_SOCKET_DISCONNECTED;
++            session->packAdd_state = libssh2_NB_state_idle;
++            libssh2_session_disconnect(session, "strict KEX violation: "
++                                       "unexpected packet type");
++
++            return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT,
++                                  "strict KEX violation: "
++                                  "unexpected packet type");
++        }
++    }
++
+     if(session->packAdd_state == libssh2_NB_state_allocated) {
+         /* A couple exceptions to the packet adding rule: */
+         switch(msg) {
+@@ -1364,6 +1427,15 @@ _libssh2_packet_ask(LIBSSH2_SESSION * session, unsigned char packet_type,
+ 
+             return 0;
+         }
++        else if(session->kex_strict &&
++                (session->state & LIBSSH2_STATE_INITIAL_KEX)) {
++            libssh2_session_disconnect(session, "strict KEX violation: "
++                                       "unexpected packet type");
++
++            return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT,
++                                  "strict KEX violation: "
++                                  "unexpected packet type");
++        }
+         packet = _libssh2_list_next(&packet->node);
+     }
+     return -1;
+@@ -1425,7 +1497,10 @@ _libssh2_packet_require(LIBSSH2_SESSION * session, unsigned char packet_type,
+     }
+ 
+     while(session->socket_state == LIBSSH2_SOCKET_CONNECTED) {
+-        int ret = _libssh2_transport_read(session);
++        int ret;
++        session->fullpacket_required_type = packet_type;
++        ret = _libssh2_transport_read(session);
++        session->fullpacket_required_type = 0;
+         if(ret == LIBSSH2_ERROR_EAGAIN)
+             return ret;
+         else if(ret < 0) {
+diff --git a/src/packet.h b/src/packet.h
+index 1d90b8af12..955351e5f6 100644
+--- a/src/packet.h
++++ b/src/packet.h
+@@ -72,6 +72,6 @@ int _libssh2_packet_burn(LIBSSH2_SESSION * session,
+ int _libssh2_packet_write(LIBSSH2_SESSION * session, unsigned char *data,
+                           unsigned long data_len);
+ int _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+-                        size_t datalen, int macstate);
++                        size_t datalen, int macstate, uint32_t seq);
+ 
+ #endif /* LIBSSH2_PACKET_H */
+diff --git a/src/session.c b/src/session.c
+index 35e7929fe7..9d89ade8ec 100644
+--- a/src/session.c
++++ b/src/session.c
+@@ -469,6 +469,8 @@ libssh2_session_init_ex(LIBSSH2_ALLOC_FUNC((*my_alloc)),
+         session->abstract = abstract;
+         session->api_timeout = 0; /* timeout-free API by default */
+         session->api_block_mode = 1; /* blocking API by default */
++        session->state = LIBSSH2_STATE_INITIAL_KEX;
++        session->fullpacket_required_type = 0;
+         session->packet_read_timeout = LIBSSH2_DEFAULT_READ_TIMEOUT;
+         session->flag.quote_paths = 1; /* default behavior is to quote paths
+                                           for the scp subsystem */
+@@ -1223,6 +1225,7 @@ libssh2_session_disconnect_ex(LIBSSH2_SESSION *session, int reason,
+                               const char *desc, const char *lang)
+ {
+     int rc;
++    session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
+     session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
+     BLOCK_ADJUST(rc, session,
+                  session_disconnect(session, reason, desc, lang));
+diff --git a/src/transport.c b/src/transport.c
+index 21be9d2b80..a8bb588a4b 100644
+--- a/src/transport.c
++++ b/src/transport.c
+@@ -186,6 +186,7 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
+     struct transportpacket *p = &session->packet;
+     int rc;
+     int compressed;
++    uint32_t seq = session->remote.seqno;
+ 
+     if(session->fullpacket_state == libssh2_NB_state_idle) {
+         session->fullpacket_macstate = LIBSSH2_MAC_CONFIRMED;
+@@ -317,7 +318,7 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
+     if(session->fullpacket_state == libssh2_NB_state_created) {
+         rc = _libssh2_packet_add(session, p->payload,
+                                  session->fullpacket_payload_len,
+-                                 session->fullpacket_macstate);
++                                 session->fullpacket_macstate, seq);
+         if(rc == LIBSSH2_ERROR_EAGAIN)
+             return rc;
+         if(rc) {
+@@ -328,6 +329,11 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
+ 
+     session->fullpacket_state = libssh2_NB_state_idle;
+ 
++    if(session->kex_strict &&
++        session->fullpacket_packet_type == SSH_MSG_NEWKEYS) {
++        session->remote.seqno = 0;
++    }
++
+     return session->fullpacket_packet_type;
+ }
+ 
+@@ -1093,6 +1099,10 @@ int _libssh2_transport_send(LIBSSH2_SESSION *session,
+ 
+     session->local.seqno++;
+ 
++    if(session->kex_strict && data[0] == SSH_MSG_NEWKEYS) {
++        session->local.seqno = 0;
++    }
++
+     ret = LIBSSH2_SEND(session, p->outbuf, total_length,
+                        LIBSSH2_SOCKET_SEND_FLAGS(session));
+     if(ret < 0)
diff --git a/pkgs/development/libraries/libssh2/default.nix b/pkgs/development/libraries/libssh2/default.nix
index 091885a1f084..f7a51da9fa67 100644
--- a/pkgs/development/libraries/libssh2/default.nix
+++ b/pkgs/development/libraries/libssh2/default.nix
@@ -9,6 +9,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-NzYWHkHiaTMk3rOMJs/cPv5iCdY0ukJY2xzs/2pa1GE=";
   };
 
+  patches = [
+    # fetchpatch cannot be used due to infinite recursion
+    # https://github.com/libssh2/libssh2/commit/d34d9258b8420b19ec3f97b4cc5bf7aa7d98e35a
+    ./CVE-2023-48795.patch
+  ];
+
   outputs = [ "out" "dev" "devdoc" ];
 
   propagatedBuildInputs = [ openssl ]; # see Libs: in libssh2.pc

From e2702f5aee1b6719d93e89de8acd69430de4bf1a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Tue, 12 Sep 2023 17:07:58 +0200
Subject: [PATCH 29/45] treewide: don't use python3Minimal where it is not
 required

Building a python environment with python3Minimal requires hydra
to bootstrap pip and build all packages used in the environment
which would otherwise not be built. This reduces cache re-use and duplicates things.

Also common dependencies normally included in python itself
are not properly checked and can cause hard to debug errors
because everyone just assumes those modules are there.
---
 nixos/lib/make-options-doc/default.nix       | 2 +-
 nixos/tests/installer.nix                    | 8 +-------
 nixos/tests/os-prober.nix                    | 2 +-
 pkgs/tools/nix/nixos-render-docs/default.nix | 9 +--------
 4 files changed, 4 insertions(+), 17 deletions(-)

diff --git a/nixos/lib/make-options-doc/default.nix b/nixos/lib/make-options-doc/default.nix
index 99515b5b8276..284934a7608e 100644
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@@ -120,7 +120,7 @@ in rec {
     { meta.description = "List of NixOS options in JSON format";
       nativeBuildInputs = [
         pkgs.brotli
-        pkgs.python3Minimal
+        pkgs.python3
       ];
       options = builtins.toFile "options.json"
         (builtins.unsafeDiscardStringContext (builtins.toJSON optionsNix));
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index f7fc168eba8c..c7711d151ddd 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -510,14 +510,8 @@ let
             ntp
             perlPackages.ListCompare
             perlPackages.XMLLibXML
-            python3Minimal
             # make-options-doc/default.nix
-            (let
-                self = (pkgs.python3Minimal.override {
-                  inherit self;
-                  includeSiteCustomize = true;
-                });
-              in self.withPackages (p: [ p.mistune ]))
+            python3.withPackages (p: [ p.mistune ])
             shared-mime-info
             sudo
             texinfo
diff --git a/nixos/tests/os-prober.nix b/nixos/tests/os-prober.nix
index dae1306bd69d..034de0620d88 100644
--- a/nixos/tests/os-prober.nix
+++ b/nixos/tests/os-prober.nix
@@ -95,7 +95,7 @@ in {
           ntp
           perlPackages.ListCompare
           perlPackages.XMLLibXML
-          python3Minimal
+          python3
           shared-mime-info
           stdenv
           sudo
diff --git a/pkgs/tools/nix/nixos-render-docs/default.nix b/pkgs/tools/nix/nixos-render-docs/default.nix
index d2b8f1a0614b..b08abfe069f7 100644
--- a/pkgs/tools/nix/nixos-render-docs/default.nix
+++ b/pkgs/tools/nix/nixos-render-docs/default.nix
@@ -1,18 +1,11 @@
 { lib
 , stdenv
 , python3
-, python3Minimal
 , runCommand
 }:
 
 let
-  # python3Minimal can't be overridden with packages on Darwin, due to a missing framework.
-  # Instead of modifying stdenv, we take the easy way out, since most people on Darwin will
-  # just be hacking on the Nixpkgs manual (which also uses make-options-doc).
-  python = ((if stdenv.isDarwin then python3 else python3Minimal).override {
-    self = python;
-    includeSiteCustomize = true;
-  }).override {
+  python = python3.override {
     packageOverrides = final: prev: {
       markdown-it-py = prev.markdown-it-py.overridePythonAttrs (_: {
         doCheck = false;

From e5c34ed85e938bb42728cf3d2e16eed8d7c445d3 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Wed, 20 Dec 2023 15:09:02 +0100
Subject: [PATCH 30/45] pkgsStatic.srt: fix build

---
 pkgs/development/libraries/srt/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/libraries/srt/default.nix b/pkgs/development/libraries/srt/default.nix
index d25aab35da22..5ba8039ccff8 100644
--- a/pkgs/development/libraries/srt/default.nix
+++ b/pkgs/development/libraries/srt/default.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
     # (setting it to an absolute path causes include files to go to $out/$out/include,
     #  because the absolute path is interpreted with root at $out).
     "-DCMAKE_INSTALL_INCLUDEDIR=include"
+    "-DENABLE_SHARED=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
     # TODO Remove this when https://github.com/Haivision/srt/issues/538 is fixed and available to nixpkgs
     # Workaround for the fact that srt incorrectly disables GNUInstallDirs when LIBDIR is specified,
     # see https://github.com/NixOS/nixpkgs/pull/54463#discussion_r249878330

From 00d0418804e96e381d40a07bf784e408c4d206f4 Mon Sep 17 00:00:00 2001
From: Yann Hamdaoui <yann.hamdaoui@tweag.io>
Date: Wed, 20 Dec 2023 18:08:22 +0100
Subject: [PATCH 31/45] Test __structuredAttrs support in autoPatchelf

This commit adds a test for the newly added support for
__structuredAttrs in autoPatchelf(hook). It copied a reasonably
small-closure binary derivation that makes use of autoPatchelf, stripped
it down for the purpose of the test, and check that autoPatchelf
correctly set the interpreter and runpath whether __structuredAttrs is
set to true or not.
---
 pkgs/test/auto-patchelf-hook/default.nix |  6 ++
 pkgs/test/auto-patchelf-hook/package.nix | 96 ++++++++++++++++++++++++
 pkgs/test/default.nix                    |  2 +
 3 files changed, 104 insertions(+)
 create mode 100644 pkgs/test/auto-patchelf-hook/default.nix
 create mode 100644 pkgs/test/auto-patchelf-hook/package.nix

diff --git a/pkgs/test/auto-patchelf-hook/default.nix b/pkgs/test/auto-patchelf-hook/default.nix
new file mode 100644
index 000000000000..6e05e729fba8
--- /dev/null
+++ b/pkgs/test/auto-patchelf-hook/default.nix
@@ -0,0 +1,6 @@
+{ lib, callPackage }:
+
+lib.recurseIntoAttrs {
+  withStructuredAttrs = callPackage ./package.nix { __structuredAttrs = true; };
+  withoutStructuredAttrs = callPackage ./package.nix { __structuredAttrs = false; };
+}
diff --git a/pkgs/test/auto-patchelf-hook/package.nix b/pkgs/test/auto-patchelf-hook/package.nix
new file mode 100644
index 000000000000..be03ee68c039
--- /dev/null
+++ b/pkgs/test/auto-patchelf-hook/package.nix
@@ -0,0 +1,96 @@
+# This is a test for autoPatchelfHook. To test it, we just need a simple binary
+# which uses the hook. We took the derivation from tonelib-jam, which sounds
+# like a good candidate with a small closure, and trimmed it down.
+
+{ stdenv
+, lib
+, fetchurl
+, autoPatchelfHook
+, dpkg
+, freetype
+, curl
+# This test checks that the behavior of autoPatchelfHook is correct whether
+# __structuredAttrs
+# (https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-structuredAttrs)
+# is set or not. Hence __structuredAttrs is provided as a parameter.
+, __structuredAttrs
+}:
+
+let runtimeDependencies = [
+  (lib.getLib curl)
+  "/some/dep"
+  "/some/other/dep"
+]
+# A dependency with space only works with __structuredAttrs set to true.
+++ lib.lists.optional __structuredAttrs "/some/dep with space";
+in
+
+stdenv.mkDerivation {
+  name = "auto-patchelf-test";
+
+  src = fetchurl {
+    url = "https://tonelib.net/download/221222/ToneLib-Jam-amd64.deb";
+    sha256 = "sha256-c6At2lRPngQPpE7O+VY/Hsfw+QfIb3COIuHfbqqIEuM=";
+  };
+
+  unpackCmd = ''
+    dpkg -x $curSrc source
+  '';
+
+  nativeBuildInputs = [
+    dpkg
+    autoPatchelfHook
+  ];
+
+  installPhase = ''
+    mv usr $out
+  '';
+
+  buildInputs = [
+    freetype
+  ];
+
+  autoPatchelfIgnoreMissingDeps = [
+    "libGL.so.1"
+    "libasound.so.2"
+  ];
+
+  inherit runtimeDependencies;
+
+  # Additional phase performing the actual test.
+  installCheckPhase =
+    let allDeps = runtimeDependencies ++ [ (lib.getLib freetype) ];
+    in
+    ''
+      local binary="$out/bin/ToneLib-Jam"
+      local interpreter=$(patchelf --print-interpreter $binary)
+      local runpath=$(patchelf --print-rpath $binary)
+      local glibcStorePath="${stdenv.cc.libc}"
+
+      # Check that the glibc path is a prefix of the interpreter. If
+      # autoPatchelfHook ran correctly, the binary should have set the interpreter
+      # to point to the store.
+      echo "[auto-patchelf-hook-test]: Check that the interpreter is in the store"
+      test "''${interpreter#$glibcStorePath}" != "$interpreter"
+
+      readarray -td':' runpathArray < <(echo -n "$runpath")
+
+      echo "[auto-patchelf-hook-test]: Check that the runpath has the right number of entries"
+      test "''${#runpathArray[@]}" -eq ${builtins.toString (builtins.length allDeps)}
+
+      echo "[auto-patchelf-hook-test]: Check that the runpath contains the expected runtime deps"
+    ''
+    + lib.strings.concatStringsSep "\n"
+      (lib.lists.imap0
+        (i: path:
+          let iAsStr = builtins.toString i; in
+          ''
+            echo "[auto-patchelf-hook-test]: Check that entry ${iAsStr} is ${path}"
+            test "''${paths[${iAsStr}]}" = "$path"
+          '')
+        allDeps
+      );
+
+  doInstallCheck = true;
+  inherit __structuredAttrs;
+}
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 29dc4b5192ec..3aed10deacf2 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -167,4 +167,6 @@ with pkgs;
   pkgs-lib = recurseIntoAttrs (import ../pkgs-lib/tests { inherit pkgs; });
 
   nixpkgs-check-by-name = callPackage ./nixpkgs-check-by-name { };
+
+  auto-patchelf-hook = callPackage ./auto-patchelf-hook { };
 }

From ac3b49ff8bc5d7f3dec3e1b51c331bc99292bf8d Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 22 Dec 2023 20:05:54 +0000
Subject: [PATCH 32/45] libdrm: 2.4.118 -> 2.4.119

Changes: https://lists.x.org/archives/xorg-announce/2023-December/003438.html
---
 pkgs/development/libraries/libdrm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index a7ead8f22747..5cb8f2cbad8e 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.118";
+  version = "2.4.119";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-p3e9hfK1/JxX+IbIIFgwBXgxfK/bx30Kdp1+mpVnq4g=";
+    hash = "sha256-CknxLwm1tuaOqq/z8Cynz/mqkmk5shLTQxYdPorFYpE=";
   };
 
   outputs = [ "out" "dev" "bin" ];

From 089557273fe237cbf9738dc78b61638845bceb41 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 22 Dec 2023 20:12:35 +0000
Subject: [PATCH 33/45] aspell: 0.60.8 -> 0.60.8.1

Changes: http://aspell.net/man-html/ChangeLog.html
---
 pkgs/development/libraries/aspell/default.nix | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/libraries/aspell/default.nix b/pkgs/development/libraries/aspell/default.nix
index b839092228b3..8c152d32ef6c 100644
--- a/pkgs/development/libraries/aspell/default.nix
+++ b/pkgs/development/libraries/aspell/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, fetchzip, perl, ncurses
+{ lib, stdenv, fetchurl, fetchzip, perl, ncurses
 
   # for tests
 , aspell, glibc, runCommand
@@ -20,21 +20,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "aspell";
-  version = "0.60.8";
+  version = "0.60.8.1";
 
   src = fetchurl {
     url = "mirror://gnu/aspell/aspell-${version}.tar.gz";
-    sha256 = "1wi60ankalmh8ds7nplz434jd7j94gdvbahdwsr539rlad8pxdzr";
+    hash = "sha256-1toSs01C1Ff6YE5DWtSEp0su/80SD/QKzWuz+yiH0hs=";
   };
 
-  patches = [
-    (fetchpatch {
-      #  objstack: assert that the alloc size will fit within a chunk
-      name = "CVE-2019-25051.patch";
-      url = "https://github.com/gnuaspell/aspell/commit/0718b375425aad8e54e1150313b862e4c6fd324a.patch";
-      sha256 = "03z259xrk41x3j190gaprf3mqysyfgh3a04rjmch3h625vj95x39";
-    })
-  ] ++ lib.optional searchNixProfiles ./data-dirs-from-nix-profiles.patch;
+  patches = lib.optional searchNixProfiles ./data-dirs-from-nix-profiles.patch;
 
   postPatch = ''
     patch interfaces/cc/aspell.h < ${./clang.patch}

From a72beef6622722388c71a69f8f18b94eb3f44d04 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 22 Dec 2023 20:53:50 +0000
Subject: [PATCH 34/45] tzdata: 2023c -> 2023d

Changes: http://mm.icann.org/pipermail/tz/2023-December/033391.html
---
 pkgs/data/misc/tzdata/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
index f04005af7452..b90a560045bb 100644
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "tzdata";
-  version = "2023c";
+  version = "2023d";
 
   srcs = [
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-      hash = "sha256-P1ELXRtK6bs45IWqMCp3azF/s2N722QExK33tsrdllw=";
+      hash = "sha256-28ohlwsKi4wM7O7B17kfqQO+D27KWucytTKWciMqCPM=";
     })
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-      hash = "sha256-RtF/K7Ga1zKQ8DogMAYVLg+g17EeW3FGfEqCOBGyFOc=";
+      hash = "sha256-6aX54RiIbS3pK2K7BVEKKMxsBY15HJO9a4TTKSw8Fh4=";
     })
   ];
 

From 44cf75ac564016a3479a61e434bf500b1e88fa9f Mon Sep 17 00:00:00 2001
From: Aaron Jheng <wentworth@outlook.com>
Date: Sat, 23 Dec 2023 01:07:22 +0000
Subject: [PATCH 35/45] iputils: 20221126 -> 20231222

---
 pkgs/os-specific/linux/iputils/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/iputils/default.nix b/pkgs/os-specific/linux/iputils/default.nix
index 8396fd5e3d33..56ac85fa0b7a 100644
--- a/pkgs/os-specific/linux/iputils/default.nix
+++ b/pkgs/os-specific/linux/iputils/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iputils";
-  version = "20221126";
+  version = "20231222";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    hash = "sha256-XVoQhdjBmEK8TbCpaKLjebPw7ZT8iEvyLJDTCkzezeE=";
+    hash = "sha256-/blxT6k79fgbxX8qCQuJMf7zDPwMjJUt7FCscaMXx6U=";
   };
 
   outputs = [ "out" "apparmor" ];

From 5136d413f5958343caa8859e41be27b9a3172746 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sat, 23 Dec 2023 04:20:00 +0000
Subject: [PATCH 36/45] ruby.rubygems: 3.4.22 -> 3.5.3

Changelog: https://github.com/rubygems/rubygems/blob/v3.5.3/CHANGELOG.md
---
 pkgs/development/interpreters/ruby/default.nix       |  1 -
 .../rubygems/0002-binaries-with-env-shebang.patch    | 12 ++++++------
 .../rubygems/0003-gem-install-default-to-user.patch  | 10 +++++-----
 .../interpreters/ruby/rubygems/default.nix           |  4 ++--
 4 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 2269ff2b61c1..d390a52b7543 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -148,7 +148,6 @@ let
         postUnpack = opString rubygemsSupport ''
           rm -rf $sourceRoot/{lib,test}/rubygems*
           cp -r ${rubygems}/lib/rubygems* $sourceRoot/lib
-          cp -r ${rubygems}/test/rubygems $sourceRoot/test
         '';
 
         postPatch = ''
diff --git a/pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch b/pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch
index 6b7b20934877..fef2c558e246 100644
--- a/pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch
+++ b/pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch
@@ -14,15 +14,15 @@ diff --git a/lib/rubygems/dependency_installer.rb b/lib/rubygems/dependency_inst
 index 34620860..00ab31d9 100644
 --- a/lib/rubygems/dependency_installer.rb
 +++ b/lib/rubygems/dependency_installer.rb
-@@ -18,7 +18,7 @@ class Gem::DependencyInstaller
+@@ -17,7 +17,7 @@ class Gem::DependencyInstaller
    extend Gem::Deprecate
  
    DEFAULT_OPTIONS = { # :nodoc:
--    :env_shebang => false,
-+    :env_shebang => true,
-     :document => %w[ri],
-     :domain => :both, # HACK dup
-     :force => false,
+-    env_shebang: false,
++    env_shebang: true,
+     document: %w[ri],
+     domain: :both, # HACK: dup
+     force: false,
 -- 
 2.21.0
 
diff --git a/pkgs/development/interpreters/ruby/rubygems/0003-gem-install-default-to-user.patch b/pkgs/development/interpreters/ruby/rubygems/0003-gem-install-default-to-user.patch
index 138d432c8203..e155ff27b916 100644
--- a/pkgs/development/interpreters/ruby/rubygems/0003-gem-install-default-to-user.patch
+++ b/pkgs/development/interpreters/ruby/rubygems/0003-gem-install-default-to-user.patch
@@ -12,15 +12,15 @@ diff --git a/lib/rubygems/path_support.rb b/lib/rubygems/path_support.rb
 index ed680d65..749b9ea6 100644
 --- a/lib/rubygems/path_support.rb
 +++ b/lib/rubygems/path_support.rb
-@@ -23,7 +23,7 @@ class Gem::PathSupport
+@@ -24,7 +24,7 @@ class Gem::PathSupport
    # hashtable, or defaults to ENV, the system environment.
    #
    def initialize(env)
--    @home = env["GEM_HOME"] || Gem.default_dir
-+    @home = env["GEM_HOME"] || Gem.user_dir
+-    @home = normalize_home_dir(env["GEM_HOME"] || Gem.default_dir)
++    @home = normalize_home_dir(env["GEM_HOME"] || Gem.user_dir || Gem.default_dir)
+     @path = split_gem_path env["GEM_PATH"], @home
  
-     if File::ALT_SEPARATOR
-       @home = @home.gsub(File::ALT_SEPARATOR, File::SEPARATOR)
+     @spec_cache_dir = env["GEM_SPEC_CACHE"] || Gem.default_spec_cache_dir
 -- 
 2.21.0
 
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index 8e9e35dae59a..95a6fb077eb1 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.4.22";
+  version = "3.5.3";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-gD+nd3bRHT0btWOCZhbIERJEJeAzGtH9mDxBRARqYVY=";
+    hash = "sha256-8xFe6AgJkvJXwBYbgR4HsBLyAXXtiTSfsayYl33cXJw=";
   };
 
   patches = [

From bbb03d02c533aaba9d0aa046296d818390804538 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sat, 23 Dec 2023 04:20:00 +0000
Subject: [PATCH 37/45] bundler: 2.4.22 -> 2.5.3

Changelog: https://github.com/rubygems/rubygems/blob/bundler-v2.5.3/bundler/CHANGELOG.md
---
 pkgs/development/ruby-modules/bundler/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index c4c3cd8b8d23..05d1bfbf64e6 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.4.22";
-  source.sha256 = "sha256-dHulCw5n3yXL07SPlYMad6TVOlgdVfBjly/LFG0ULF8=";
+  version = "2.5.3";
+  source.sha256 = "sha256-JJzQdaxPM1rnD3iMm+D0wYgJOk2n0FvVO+K67z8l58s=";
   dontPatchShebangs = true;
 
   postFixup = ''

From c32a8776b07d15e491f3ba5a8ebefca718e0662d Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Wed, 20 Dec 2023 22:01:37 +0100
Subject: [PATCH 38/45] libde265: 1.0.14 -> 1.0.15

Fixes CVE-2023-49465, CVE-2023-49467 and CVE-2023-49468

https://github.com/strukturag/libde265/releases/tag/v1.0.15
---
 pkgs/development/libraries/libde265/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libde265/default.nix b/pkgs/development/libraries/libde265/default.nix
index 3071bd2a8ca0..6259fa5b4839 100644
--- a/pkgs/development/libraries/libde265/default.nix
+++ b/pkgs/development/libraries/libde265/default.nix
@@ -14,14 +14,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: rec {
-  version = "1.0.14";
+  version = "1.0.15";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     rev = "refs/tags/v${version}";
-    hash = "sha256-aZRtF4wYWxi/6ORNu7yVxFFdkvJTvBwPinL5lC0Mlqg=";
+    hash = "sha256-guiLM4RNe5O0qpeCoQUbs1Z7j0wp8iK9za2+6NIB8yY=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];

From 788c681581e927971a8369a24ed7e24182877c29 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Wed, 20 Dec 2023 18:38:05 +0000
Subject: [PATCH 39/45] =?UTF-8?q?gtk3:=203.24.38=20=E2=86=92=203.24.39?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/GNOME/gtk/-/compare/3.24.38...3.24.39
---
 pkgs/development/libraries/gtk/3.x.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index 27afba7833e8..c244414c5508 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -64,7 +64,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gtk+3";
-  version = "3.24.38";
+  version = "3.24.39";
 
   outputs = [ "out" "dev" ] ++ lib.optional withIntrospection "devdoc";
   outputBin = "dev";
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version;
   in fetchurl {
     url = "mirror://gnome/sources/gtk+/${lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
-    sha256 = "sha256-zhHezwGLJb3YUFVEpPhyQoVOyIvgVNmt5fOiBETdjuc=";
+    sha256 = "sha256-HKw+VmubLzZTpFjAjC3N/cqfkIA3rAPJ2FZLQpV3jXk=";
   };
 
   patches = [

From 1d204f975843494995b5a0d2919875da8087df55 Mon Sep 17 00:00:00 2001
From: Dylan Simon <dylan@dylex.net>
Date: Mon, 18 Dec 2023 12:54:46 -0500
Subject: [PATCH 40/45] haskell.compiler.ghc*Binary: add missing #! patch

inplace/bin/mkdirhier needs #!/bin/sh patched
---
 pkgs/development/compilers/ghc/8.10.2-binary.nix | 2 ++
 pkgs/development/compilers/ghc/8.10.7-binary.nix | 2 ++
 pkgs/development/compilers/ghc/8.6.5-binary.nix  | 2 ++
 pkgs/development/compilers/ghc/9.2.4-binary.nix  | 2 ++
 4 files changed, 8 insertions(+)

diff --git a/pkgs/development/compilers/ghc/8.10.2-binary.nix b/pkgs/development/compilers/ghc/8.10.2-binary.nix
index d04e85777775..c8d645cfa361 100644
--- a/pkgs/development/compilers/ghc/8.10.2-binary.nix
+++ b/pkgs/development/compilers/ghc/8.10.2-binary.nix
@@ -252,6 +252,8 @@ stdenv.mkDerivation rec {
     ''
       patchShebangs ghc-${version}/utils/
       patchShebangs ghc-${version}/configure
+      test -d ghc-${version}/inplace/bin && \
+        patchShebangs ghc-${version}/inplace/bin
     '' +
     # We have to patch the GMP paths for the integer-gmp package.
     # Note [musl bindists have no .buildinfo]
diff --git a/pkgs/development/compilers/ghc/8.10.7-binary.nix b/pkgs/development/compilers/ghc/8.10.7-binary.nix
index f373d963ed28..3376671d65b4 100644
--- a/pkgs/development/compilers/ghc/8.10.7-binary.nix
+++ b/pkgs/development/compilers/ghc/8.10.7-binary.nix
@@ -250,6 +250,8 @@ stdenv.mkDerivation rec {
     ''
       patchShebangs ghc-${version}/utils/
       patchShebangs ghc-${version}/configure
+      test -d ghc-${version}/inplace/bin && \
+        patchShebangs ghc-${version}/inplace/bin
     '' +
     # We have to patch the GMP paths for the integer-gmp package.
     # Note that musl bindists do not contain them,
diff --git a/pkgs/development/compilers/ghc/8.6.5-binary.nix b/pkgs/development/compilers/ghc/8.6.5-binary.nix
index 58e61604cd61..5f9d6c824d42 100644
--- a/pkgs/development/compilers/ghc/8.6.5-binary.nix
+++ b/pkgs/development/compilers/ghc/8.6.5-binary.nix
@@ -102,6 +102,8 @@ stdenv.mkDerivation rec {
     ''
       patchShebangs ghc-${version}/utils/
       patchShebangs ghc-${version}/configure
+      test -d ghc-${version}/inplace/bin && \
+        patchShebangs ghc-${version}/inplace/bin
     '' +
 
     # We have to patch the GMP paths for the integer-gmp package.
diff --git a/pkgs/development/compilers/ghc/9.2.4-binary.nix b/pkgs/development/compilers/ghc/9.2.4-binary.nix
index 909d090c1704..77d70d295070 100644
--- a/pkgs/development/compilers/ghc/9.2.4-binary.nix
+++ b/pkgs/development/compilers/ghc/9.2.4-binary.nix
@@ -236,6 +236,8 @@ stdenv.mkDerivation rec {
     ''
       patchShebangs ghc-${version}/utils/
       patchShebangs ghc-${version}/configure
+      test -d ghc-${version}/inplace/bin && \
+        patchShebangs ghc-${version}/inplace/bin
     '' +
     # We have to patch the GMP paths for the integer-gmp package.
     ''

From 02217618d34566536b1d859d2716187978983370 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Thu, 21 Dec 2023 17:34:46 +0100
Subject: [PATCH 41/45] sox: enable parallel building

Tested at -j64.
---
 pkgs/applications/misc/audio/sox/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/applications/misc/audio/sox/default.nix b/pkgs/applications/misc/audio/sox/default.nix
index 1b8e0541346a..bb751ae01c9d 100644
--- a/pkgs/applications/misc/audio/sox/default.nix
+++ b/pkgs/applications/misc/audio/sox/default.nix
@@ -79,6 +79,8 @@ stdenv.mkDerivation rec {
     ++ lib.optional enableLibpulseaudio libpulseaudio
     ++ lib.optional stdenv.isDarwin CoreAudio;
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "Sample Rate Converter for audio";
     homepage = "https://sox.sourceforge.net/";

From 66e33c14d960a5a6c1c1853cb79ca2ecce9589a0 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 29 Dec 2023 16:35:19 +0100
Subject: [PATCH 42/45] libxml2: 2.12.3 -> 2.12.3-unstable-2023-12-14

This includes a fix for a use after free, which fixes the build of
perlPackages.XMLLibXML.
---
 pkgs/development/libraries/libxml2/default.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index f4a7c6f0e975..d06c45e81990 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchFromGitLab
 , zlib
 , pkg-config
 , autoreconfHook
@@ -34,16 +35,19 @@ in
 let
 libxml = stdenv.mkDerivation rec {
   pname = "libxml2";
-  version = "2.12.3";
+  version = "2.12.3-unstable-2023-12-14";
 
   outputs = [ "bin" "dev" "out" "doc" ]
     ++ lib.optional pythonSupport "py"
     ++ lib.optional (enableStatic && enableShared) "static";
   outputMan = "bin";
 
-  src = fetchurl {
-    url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
-    hash = "sha256-jI8QkjQKif8yvEStXJaTr/m8ino+FhuyOWZuXRWsmqo=";
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = "libxml2";
+    rev = "f006355eda722cae204606b9f95ba51f5ce9189b";
+    hash = "sha256-3WE90KDZq4Uaawuulc3t2+R8duCqgjEGUDN4HSXxohY=";
   };
 
   strictDeps = true;

From 48c54f64cad293451bb189a8d7f83617f72a7517 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Thu, 21 Dec 2023 16:55:11 +0100
Subject: [PATCH 43/45] pkgsStatic.lilv: fix build

---
 pkgs/development/libraries/audio/lilv/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/audio/lilv/default.nix b/pkgs/development/libraries/audio/lilv/default.nix
index 9827e6f52a77..3c691c245ce5 100644
--- a/pkgs/development/libraries/audio/lilv/default.nix
+++ b/pkgs/development/libraries/audio/lilv/default.nix
@@ -31,7 +31,11 @@ stdenv.mkDerivation rec {
   buildInputs = [ libsndfile serd sord sratom ];
   propagatedBuildInputs = [ lv2 ];
 
-  mesonFlags = [ "-Ddocs=disabled" ];
+  mesonFlags = [
+    "-Ddocs=disabled"
+    # Tests require building a shared library.
+    (lib.mesonEnable "tests" (!stdenv.hostPlatform.isStatic))
+  ];
 
   passthru = {
     tests = {

From 28d97a5286681bd2d023854fe6ecdbd5a80c927d Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 29 Dec 2023 15:46:55 +0100
Subject: [PATCH 44/45] rustc,cargo: 1.74.1 -> 1.75.0

---
 pkgs/development/compilers/rust/1_74.nix | 61 ------------------------
 pkgs/development/compilers/rust/1_75.nix | 61 ++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix          | 10 ++--
 3 files changed, 66 insertions(+), 66 deletions(-)
 delete mode 100644 pkgs/development/compilers/rust/1_74.nix
 create mode 100644 pkgs/development/compilers/rust/1_75.nix

diff --git a/pkgs/development/compilers/rust/1_74.nix b/pkgs/development/compilers/rust/1_74.nix
deleted file mode 100644
index 6156576f4a8a..000000000000
--- a/pkgs/development/compilers/rust/1_74.nix
+++ /dev/null
@@ -1,61 +0,0 @@
-# New rust versions should first go to staging.
-# Things to check after updating:
-# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
-#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
-#    This testing can be also done by other volunteers as part of the pull
-#    request review, in case platforms cannot be covered.
-# 2. The LLVM version used for building should match with rust upstream.
-#    Check the version number in the src/llvm-project git submodule in:
-#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
-# 3. Firefox and Thunderbird should still build on x86_64-linux.
-
-{ stdenv, lib
-, buildPackages
-, targetPackages
-, newScope, callPackage
-, CoreFoundation, Security, SystemConfiguration
-, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
-, makeRustPlatform
-, wrapRustcWith
-, llvmPackages_16, llvm_16
-} @ args:
-
-import ./default.nix {
-  rustcVersion = "1.74.1";
-  rustcSha256 = "sha256-Z9s+IvyZIciFuq5ZU7oUT8R0zeKexpq1bUPOdkIGIx0=";
-
-  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForHost = pkgsBuildHost.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
-
-  # For use at runtime
-  llvmShared = llvm_16.override { enableSharedLibraries = true; };
-
-  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
-  llvmPackages = llvmPackages_16;
-
-  # Note: the version MUST be one version prior to the version we're
-  # building
-  bootstrapVersion = "1.73.0";
-
-  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
-  bootstrapHashes = {
-    i686-unknown-linux-gnu = "6a088acbbda734d27e8b431499f1d746de7781673b88fead3aeae072be1d1a5a";
-    x86_64-unknown-linux-gnu = "aa4cf0b7e66a9f5b7c623d4b340bb1ac2864a5f2c2b981f39f796245dc84f2cb";
-    x86_64-unknown-linux-musl = "c888457d106ccd40288ca8db1cb966b23d719c9a128daca701ecc574c53773d4";
-    arm-unknown-linux-gnueabihf = "9c29bb42786aedbb16ea71564eb06068a8b01cca6c6b8857f0c37f91dfba7134";
-    armv7-unknown-linux-gnueabihf = "092b32b82c602c18279d76d9a96763e85030aa62cda64c1bc73fc1f6355bb99c";
-    aarch64-unknown-linux-gnu = "e54d7d886ba413ae573151f668e76ea537f9a44406d3d29598269a4a536d12f6";
-    aarch64-unknown-linux-musl = "f4e9ff895aa55558777585ad4debe2ccf3c0298cb5d65db67814f62428de4a5b";
-    x86_64-apple-darwin = "ece9646bb153d4bc0f7f1443989de0cbcd8989a7d0bf3b7fb9956e1223954f0c";
-    aarch64-apple-darwin = "9c96e4c57328fb438ee2d87aa75970ce89b4426b49780ccb3c16af0d7c617cc6";
-    powerpc64le-unknown-linux-gnu = "8fa215ee3e274fb64364e7084613bc570369488fa22cf5bc8e0fe6dc810fe2b9";
-    riscv64gc-unknown-linux-gnu = "381379a2381835428b2e7a396b3046581517356b7cc851e39e385aebd5700623";
-  };
-
-  selectRustPackage = pkgs: pkgs.rust_1_74;
-
-  rustcPatches = [ ];
-}
-
-(builtins.removeAttrs args [ "pkgsBuildTarget" "pkgsBuildHost" "llvmPackages_16" "llvm_16"])
diff --git a/pkgs/development/compilers/rust/1_75.nix b/pkgs/development/compilers/rust/1_75.nix
new file mode 100644
index 000000000000..829b26cac367
--- /dev/null
+++ b/pkgs/development/compilers/rust/1_75.nix
@@ -0,0 +1,61 @@
+# New rust versions should first go to staging.
+# Things to check after updating:
+# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
+#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
+#    This testing can be also done by other volunteers as part of the pull
+#    request review, in case platforms cannot be covered.
+# 2. The LLVM version used for building should match with rust upstream.
+#    Check the version number in the src/llvm-project git submodule in:
+#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
+# 3. Firefox and Thunderbird should still build on x86_64-linux.
+
+{ stdenv, lib
+, buildPackages
+, targetPackages
+, newScope, callPackage
+, CoreFoundation, Security, SystemConfiguration
+, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
+, makeRustPlatform
+, wrapRustcWith
+, llvmPackages_17, llvm_17
+} @ args:
+
+import ./default.nix {
+  rustcVersion = "1.75.0";
+  rustcSha256 = "sha256-W3OfRbydNB4tHFcNZdI3VZHiLC0j71uKN3EaA4arwIg=";
+
+  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForHost = pkgsBuildHost.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
+
+  # For use at runtime
+  llvmShared = llvm_17.override { enableSharedLibraries = true; };
+
+  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
+  llvmPackages = llvmPackages_17;
+
+  # Note: the version MUST be one version prior to the version we're
+  # building
+  bootstrapVersion = "1.74.1";
+
+  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
+  bootstrapHashes = {
+    i686-unknown-linux-gnu = "b883b98372c91bc6aa9dc6ebb2b4e02e7dacbbc2ac1ebe55923dc37134df70a4";
+    x86_64-unknown-linux-gnu = "d206888a2a9d55113940151ba16117ce2456d7de021bab18cfcb06dc48d3157c";
+    x86_64-unknown-linux-musl = "5af3115a1f16431630f288821bd7f3be8cf7e08a7611b3c3bce3976774aa6cd2";
+    arm-unknown-linux-gnueabihf = "1dd7d835af4afe9adb7f785046c907090ace66f1c975cfe9e8886847310d8ec9";
+    armv7-unknown-linux-gnueabihf = "a5038ae004bf86eed64ef67329f7ba047bb4d188663bfd260320d53a2fed33c4";
+    aarch64-unknown-linux-gnu = "0dbdfce647f3c7d9ff00a7aa5d6dbbd7010486f803a9749cff46189f5ecb438c";
+    aarch64-unknown-linux-musl = "02674b8e4311780464313c5773d43606fbf6880d5c4512930d59b6d5d369f0de";
+    x86_64-apple-darwin = "54e1ef01d73f6031fbee36bbecd9af4209eb682dea478696e8282ca64d5792e5";
+    aarch64-apple-darwin = "af6a982cbed85807fb8e5c4ba85b8a76162b58945f4787e0a7dec32e901e8b3b";
+    powerpc64le-unknown-linux-gnu = "bb1c9f0ab1016a2817afe8f72c03f8f1787fe44d0f9999669e0c1957a08e6213";
+    riscv64gc-unknown-linux-gnu = "86561a8d630f634fdd7cb5899d40027103c907d9763a32770b7e2fd57dbd8473";
+  };
+
+  selectRustPackage = pkgs: pkgs.rust_1_75;
+
+  rustcPatches = [ ];
+}
+
+(builtins.removeAttrs args [ "pkgsBuildTarget" "pkgsBuildHost" "llvmPackages_17" "llvm_17"])
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 973986aae2f8..5ee829e82047 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16965,11 +16965,11 @@ with pkgs;
   wrapRustcWith = { rustc-unwrapped, ... } @ args: callPackage ../build-support/rust/rustc-wrapper args;
   wrapRustc = rustc-unwrapped: wrapRustcWith { inherit rustc-unwrapped; };
 
-  rust_1_74 = callPackage ../development/compilers/rust/1_74.nix {
+  rust_1_75 = callPackage ../development/compilers/rust/1_75.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
-    llvm_16 = llvmPackages_16.libllvm;
+    llvm_17 = llvmPackages_17.libllvm;
   };
-  rust = rust_1_74;
+  rust = rust_1_75;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@@ -16977,8 +16977,8 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  rustPackages_1_74 = rust_1_74.packages.stable;
-  rustPackages = rustPackages_1_74;
+  rustPackages_1_75 = rust_1_75.packages.stable;
+  rustPackages = rustPackages_1_75;
 
   inherit (rustPackages) cargo cargo-auditable cargo-auditable-cargo-wrapper clippy rustc rustPlatform;
 

From 84563fcd998e115ad3e4d0d84920ecc444caf9c4 Mon Sep 17 00:00:00 2001
From: annalee <150648636+a-n-n-a-l-e-e@users.noreply.github.com>
Date: Fri, 29 Dec 2023 06:37:00 +0000
Subject: [PATCH 45/45] curl: fix ipv6 detection compile error in configure
 script

---
 .../curl/configure-ipv6-autodetect.diff       | 46 +++++++++++++++++++
 pkgs/tools/networking/curl/default.nix        |  6 +++
 2 files changed, 52 insertions(+)
 create mode 100644 pkgs/tools/networking/curl/configure-ipv6-autodetect.diff

diff --git a/pkgs/tools/networking/curl/configure-ipv6-autodetect.diff b/pkgs/tools/networking/curl/configure-ipv6-autodetect.diff
new file mode 100644
index 000000000000..9797d2c16d11
--- /dev/null
+++ b/pkgs/tools/networking/curl/configure-ipv6-autodetect.diff
@@ -0,0 +1,46 @@
+diff --git a/configure b/configure
+index 04d1de1..5de1b41 100755
+--- a/configure
++++ b/configure
+@@ -24949,15 +24949,12 @@ else $as_nop
+ # include <netinet/in6.h>
+ #endif
+ #endif
+-#include <stdlib.h> /* for exit() */
+-main()
++
++int main(void)
+ {
+  struct sockaddr_in6 s;
+  (void)s;
+- if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
+-   exit(1);
+- else
+-   exit(0);
++ return socket(AF_INET6, SOCK_STREAM, 0) < 0;
+ }
+ 
+ 
+diff --git a/configure.ac b/configure.ac
+index 2d71c83..bd38dd9 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1679,15 +1679,12 @@ AS_HELP_STRING([--disable-ipv6],[Disable IPv6 support]),
+ # include <netinet/in6.h>
+ #endif
+ #endif
+-#include <stdlib.h> /* for exit() */
+-main()
++
++int main(void)
+ {
+  struct sockaddr_in6 s;
+  (void)s;
+- if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
+-   exit(1);
+- else
+-   exit(0);
++ return socket(AF_INET6, SOCK_STREAM, 0) < 0;
+ }
+ ]])
+ ],
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 48bf59e25266..01208f0a121c 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -57,6 +57,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-FsYqnErw9wPSi9pte783ukcFWtNBTXDexj4uYzbyqC0=";
   };
 
+  patches = [
+    # fix ipv6 autodetect compile error in configure script
+    # remove once https://github.com/curl/curl/pull/12607 released (8.6.0)
+    ./configure-ipv6-autodetect.diff
+  ];
+
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
   separateDebugInfo = stdenv.isLinux;