From 9b3b562ff59257ad5deb8b4a7f4d399f0029ebdd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 20 Jan 2023 01:15:18 +0000
Subject: [PATCH 001/154] patchelfStable: 0.15.0 -> 0.17.2

---
 pkgs/development/tools/misc/patchelf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/misc/patchelf/default.nix b/pkgs/development/tools/misc/patchelf/default.nix
index fc71c4aa4ea4..ce50543cec8d 100644
--- a/pkgs/development/tools/misc/patchelf/default.nix
+++ b/pkgs/development/tools/misc/patchelf/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "patchelf";
-  version = "0.15.0";
+  version = "0.17.2";
 
   src = fetchurl {
     url = "https://github.com/NixOS/${pname}/releases/download/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-9ANtPuTY4ijewb7/8PbkbYpA6eVw4AaOOdd+YuLIvcI=";
+    sha256 = "sha256-uuLqN2By5CLBliGN2b3vBUjMwI2k3p82tGct+E6i2OI=";
   };
 
   strictDeps = true;

From 6323dc433f93741ba1ab8e927320638627fd540b Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Fri, 24 Feb 2023 04:20:00 +0000
Subject: [PATCH 002/154] rubygems: 3.3.20 -> 3.4.7

---
 .../ruby/rubygems/0002-binaries-with-env-shebang.patch | 10 +++++-----
 .../development/interpreters/ruby/rubygems/default.nix |  4 ++--
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch b/pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch
index d6eba67e1065..6b7b20934877 100644
--- a/pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch
+++ b/pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch
@@ -18,11 +18,11 @@ index 34620860..00ab31d9 100644
    extend Gem::Deprecate
  
    DEFAULT_OPTIONS = { # :nodoc:
--    :env_shebang         => false,
-+    :env_shebang         => true,
-     :document            => %w[ri],
-     :domain              => :both, # HACK dup
-     :force               => false,
+-    :env_shebang => false,
++    :env_shebang => true,
+     :document => %w[ri],
+     :domain => :both, # HACK dup
+     :force => false,
 -- 
 2.21.0
 
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index 257d589df6c3..18850b45b32d 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.3.20";
+  version = "3.4.7";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    sha256 = "sha256-VTUMZ2mqbszM7uXOYV6Grg7dkeGAGVXYjBX0hA/vOTg=";
+    sha256 = "sha256-h2nEu+e6uEcYu6gSFzzCIvSuCE5Vm5sZEzuT7BiMCyM=";
   };
 
   patches = [

From 2f22789063096c2690c3310f487f3a799ed09f87 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Fri, 24 Feb 2023 04:20:00 +0000
Subject: [PATCH 003/154] rvm-patchsets: drop

---
 pkgs/development/interpreters/ruby/default.nix | 12 ++----------
 .../interpreters/ruby/patchsets.nix            | 18 ------------------
 .../interpreters/ruby/rvm-patchsets.nix        |  8 --------
 3 files changed, 2 insertions(+), 36 deletions(-)
 delete mode 100644 pkgs/development/interpreters/ruby/patchsets.nix
 delete mode 100644 pkgs/development/interpreters/ruby/rvm-patchsets.nix

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 73c6e286aa92..19ca74ffa048 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -12,7 +12,6 @@ let
   op = lib.optional;
   ops = lib.optionals;
   opString = lib.optionalString;
-  patchSet = import ./rvm-patchsets.nix { inherit fetchFromGitHub; };
   config = import ./config.nix { inherit fetchFromSavannah; };
   rubygems = import ./rubygems { inherit stdenv lib fetchurl; };
 
@@ -25,7 +24,6 @@ let
     self = lib.makeOverridable (
       { stdenv, buildPackages, lib
       , fetchurl, fetchpatch, fetchFromSavannah, fetchFromGitHub
-      , useRailsExpress ? true
       , rubygemsSupport ? true
       , zlib, zlibSupport ? true
       , openssl, openssl_1_1, opensslSupport ? true
@@ -51,11 +49,10 @@ let
       , libiconv, libobjc, libunwind, Foundation
       , makeBinaryWrapper, buildRubyGem, defaultGemConfig
       , baseRuby ? buildPackages.ruby_3_1.override {
-          useRailsExpress = false;
           docSupport = false;
           rubygemsSupport = false;
         }
-      , useBaseRuby ? stdenv.hostPlatform != stdenv.buildPlatform || useRailsExpress
+      , useBaseRuby ? stdenv.hostPlatform != stdenv.buildPlatform
       }:
       stdenv.mkDerivation rec {
         pname = "ruby";
@@ -93,12 +90,7 @@ let
 
         enableParallelBuilding = true;
 
-        patches =
-          (import ./patchsets.nix {
-            inherit patchSet useRailsExpress ops fetchpatch;
-            patchLevel = ver.patchLevel;
-          }).${ver.majMinTiny}
-          ++ op (lib.versionOlder ver.majMin "3.1") ./do-not-regenerate-revision.h.patch
+        patches = op (lib.versionOlder ver.majMin "3.1") ./do-not-regenerate-revision.h.patch
           ++ op (atLeast30 && useBaseRuby) ./do-not-update-gems-baseruby.patch
           ++ ops (ver.majMin == "3.0") [
             # Ruby 3.0 adds `-fdeclspec` to $CC instead of $CFLAGS. Fixed in later versions.
diff --git a/pkgs/development/interpreters/ruby/patchsets.nix b/pkgs/development/interpreters/ruby/patchsets.nix
deleted file mode 100644
index 2bf5bc7296c6..000000000000
--- a/pkgs/development/interpreters/ruby/patchsets.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ patchSet, useRailsExpress, ops, patchLevel, fetchpatch }:
-
-{
-  "2.7.7" = ops useRailsExpress [
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/01-fix-broken-tests-caused-by-ad.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/02-improve-gc-stats.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/03-more-detailed-stacktrace.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/04-malloc-trim.patch"
-  ];
-  "3.0.5" = ops useRailsExpress [
-    "${patchSet}/patches/ruby/3.0/head/railsexpress/01-improve-gc-stats.patch"
-    "${patchSet}/patches/ruby/3.0/head/railsexpress/02-malloc-trim.patch"
-  ];
-  "3.1.2" = ops useRailsExpress [
-    "${patchSet}/patches/ruby/3.1/head/railsexpress/01-improve-gc-stats.patch"
-    "${patchSet}/patches/ruby/3.1/head/railsexpress/02-malloc-trim.patch"
-  ];
-}
diff --git a/pkgs/development/interpreters/ruby/rvm-patchsets.nix b/pkgs/development/interpreters/ruby/rvm-patchsets.nix
deleted file mode 100644
index fbbfd4c97302..000000000000
--- a/pkgs/development/interpreters/ruby/rvm-patchsets.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{ fetchFromGitHub }:
-
-fetchFromGitHub {
-  owner  = "skaes";
-  repo   = "rvm-patchsets";
-  rev    = "e6574c54a34fe6e4d45aa1433872a22ddfe14cf3";
-  hash   = "sha256-x2KvhgRVJ4Nc5v1j4DggKO1u3otG8HVMxhq4yuUKnds=";
-}

From 52ffebb7a7a6fb1ad2d64e8099451d0cbb281e68 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Fri, 24 Feb 2023 04:20:00 +0000
Subject: [PATCH 004/154] ruby: add strictDeps

---
 pkgs/development/interpreters/ruby/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 19ca74ffa048..15c3fd036315 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -68,6 +68,8 @@ let
 
         outputs = [ "out" ] ++ lib.optional docSupport "devdoc";
 
+        strictDeps = true;
+
         nativeBuildInputs = [ autoreconfHook bison ]
           ++ (op docSupport groff)
           ++ (ops (dtraceSupport && stdenv.isLinux) [ systemtap libsystemtap ])

From fec0d7798d3016e6b6abff542eaeb8c9013829cc Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Fri, 24 Feb 2023 04:20:00 +0000
Subject: [PATCH 005/154] ruby_3_1: 3.1.2 -> 3.1.3

https://www.ruby-lang.org/en/news/2022/11/24/ruby-3-1-3-released/
---
 pkgs/development/interpreters/ruby/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 15c3fd036315..c08a93662e42 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -202,7 +202,7 @@ let
           for makefile in $extMakefiles; do
             make -C "$(dirname "$makefile")" distclean
           done
-          find "$out/${passthru.gemPath}" -name gem_make.out -delete
+          find "$out/${passthru.gemPath}" \( -name gem_make.out -o -name mkmf.log \) -delete
           # Bundler tries to create this directory
           mkdir -p $out/nix-support
           cat > $out/nix-support/setup-hook <<EOF
@@ -296,7 +296,7 @@ in {
   };
 
   ruby_3_1 = generic {
-    version = rubyVersion "3" "1" "2" "";
-    sha256 = "0gm84ipk6mrfw94852w5h7xxk2lqrxjbnlwb88svf0lz70933131";
+    version = rubyVersion "3" "1" "3" "";
+    sha256 = "sha256-XqSYo19M0Vh1IApS3eQrbrF54SZOF9eHMsOlfNHGq54=";
   };
 }

From 0ce320c93328bd400a9727bd8c643fc8adff1997 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Fri, 24 Feb 2023 04:20:00 +0000
Subject: [PATCH 006/154] ruby_3_2: init at 3.2.1

https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/
https://www.ruby-lang.org/en/news/2023/02/08/ruby-3-2-1-released/
---
 pkgs/development/interpreters/ruby/default.nix | 5 +++++
 pkgs/top-level/all-packages.nix                | 4 +++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index c08a93662e42..6c8b8eb03724 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -299,4 +299,9 @@ in {
     version = rubyVersion "3" "1" "3" "";
     sha256 = "sha256-XqSYo19M0Vh1IApS3eQrbrF54SZOF9eHMsOlfNHGq54=";
   };
+
+  ruby_3_2 = generic {
+    version = rubyVersion "3" "2" "1" "";
+    sha256 = "sha256-E9Z5AWYO4yF9vZ3VYFk0a9QhLOZKacMG71LfZJNfjb0=";
+  };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 53f98f0a1ce6..791b308555d3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16949,7 +16949,8 @@ with pkgs;
     mkRuby
     ruby_2_7
     ruby_3_0
-    ruby_3_1;
+    ruby_3_1
+    ruby_3_2;
 
   ruby = ruby_2_7;
   rubyPackages = rubyPackages_2_7;
@@ -16957,6 +16958,7 @@ with pkgs;
   rubyPackages_2_7 = recurseIntoAttrs ruby_2_7.gems;
   rubyPackages_3_0 = recurseIntoAttrs ruby_3_0.gems;
   rubyPackages_3_1 = recurseIntoAttrs ruby_3_1.gems;
+  rubyPackages_3_2 = recurseIntoAttrs ruby_3_2.gems;
 
   mruby = callPackage ../development/compilers/mruby { };
 

From 188e51d08cea930f3f7956167f22e36255f941e8 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Fri, 24 Feb 2023 04:20:00 +0000
Subject: [PATCH 007/154] ruby_3_2: build with YJIT support by default

---
 .../development/interpreters/ruby/default.nix | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 6c8b8eb03724..0297839e7da4 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -2,7 +2,7 @@
 , fetchurl, fetchpatch, fetchFromSavannah, fetchFromGitHub
 , zlib, gdbm, ncurses, readline, groff, libyaml, libffi, jemalloc, autoreconfHook, bison
 , autoconf, libiconv, libobjc, libunwind, Foundation
-, buildEnv, bundler, bundix
+, buildEnv, bundler, bundix, rustPlatform
 , makeBinaryWrapper, buildRubyGem, defaultGemConfig, removeReferencesTo
 , openssl, openssl_1_1
 , linuxPackages, libsystemtap
@@ -18,9 +18,10 @@ let
   # Contains the ruby version heuristics
   rubyVersion = import ./ruby-version.nix { inherit lib; };
 
-  generic = { version, sha256 }: let
+  generic = { version, sha256, cargoSha256 ? null }: let
     ver = version;
     atLeast30 = lib.versionAtLeast ver.majMin "3.0";
+    atLeast32 = lib.versionAtLeast ver.majMin "3.2";
     self = lib.makeOverridable (
       { stdenv, buildPackages, lib
       , fetchurl, fetchpatch, fetchFromSavannah, fetchFromGitHub
@@ -43,7 +44,8 @@ let
       #   Or (usually):
       #     $(nix-build -A ruby)/lib/ruby/2.6.0/x86_64-linux/rbconfig.rb
       # - In $out/lib/libruby.so and/or $out/lib/libruby.dylib
-      , removeReferencesTo, jitSupport ? false
+      , removeReferencesTo, jitSupport ? yjitSupport
+      , rustPlatform, yjitSupport ? atLeast32
       , autoreconfHook, bison, autoconf
       , buildEnv, bundler, bundix
       , libiconv, libobjc, libunwind, Foundation
@@ -73,6 +75,7 @@ let
         nativeBuildInputs = [ autoreconfHook bison ]
           ++ (op docSupport groff)
           ++ (ops (dtraceSupport && stdenv.isLinux) [ systemtap libsystemtap ])
+          ++ ops yjitSupport [ rustPlatform.cargoSetupHook rustPlatform.rust.cargo rustPlatform.rust.rustc ]
           ++ op useBaseRuby baseRuby;
         buildInputs = [ autoconf ]
           ++ (op fiddleSupport libffi)
@@ -117,6 +120,14 @@ let
             })
           ];
 
+        cargoRoot = opString yjitSupport "yjit";
+
+        cargoDeps = if yjitSupport then rustPlatform.fetchCargoTarball {
+          inherit src;
+          sourceRoot = "${pname}-${version}/${cargoRoot}";
+          sha256 = cargoSha256;
+        } else null;
+
         postUnpack = opString rubygemsSupport ''
           rm -rf $sourceRoot/{lib,test}/rubygems*
           cp -r ${rubygems}/lib/rubygems* $sourceRoot/lib
@@ -140,6 +151,7 @@ let
           (lib.withFeatureAs useBaseRuby "baseruby" "${baseRuby}/bin/ruby")
           (lib.enableFeature dtraceSupport "dtrace")
           (lib.enableFeature jitSupport "jit-support")
+          (lib.enableFeature yjitSupport "yjit")
           (lib.enableFeature docSupport "install-doc")
           (lib.withFeature jemallocSupport "jemalloc")
           (lib.withFeatureAs docSupport "ridir" "${placeholder "devdoc"}/share/ri")
@@ -303,5 +315,6 @@ in {
   ruby_3_2 = generic {
     version = rubyVersion "3" "2" "1" "";
     sha256 = "sha256-E9Z5AWYO4yF9vZ3VYFk0a9QhLOZKacMG71LfZJNfjb0=";
+    cargoSha256 = "sha256-6du7RJo0DH+eYMOoh3L31F3aqfR5+iG1iKauSV1uNcQ=";
   };
 }

From c3547bc6ebce55124a5c9a53c81686efbdd7a957 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Wed, 22 Feb 2023 22:25:58 -0800
Subject: [PATCH 008/154] gcc/{11,12}: update buildFlags for
 `--disable-bootstrap` case

This commit updates the `buildFlags`, which is a single string with
one of four possibilities:

  - ""
  - "profiled"
  - "bootstrap"
  - "profiledbootstrap"

Previously only the last two were possible.  Since
2ea34825020a74e5d62fb1a2fe819b165803ffd1 all four are possible.
---
 pkgs/development/compilers/gcc/11/default.nix | 6 +++---
 pkgs/development/compilers/gcc/12/default.nix | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/compilers/gcc/11/default.nix b/pkgs/development/compilers/gcc/11/default.nix
index 3919fbe89f38..2f6e986f3eb8 100644
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@@ -249,9 +249,9 @@ stdenv.mkDerivation ({
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
 
-  buildFlags = optional
-    (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
-    (if profiledCompiler then "profiledbootstrap" else "bootstrap");
+  buildFlags =
+    lib.optionalString (profiledCompiler) "profiled" +
+    lib.optionalString (targetPlatform == hostPlatform && hostPlatform == buildPlatform && !disableBootstrap) "bootstrap";
 
   inherit (callFile ../common/strip-attributes.nix { })
     stripDebugList
diff --git a/pkgs/development/compilers/gcc/12/default.nix b/pkgs/development/compilers/gcc/12/default.nix
index 562d7113b6a2..ea3c6b2b16b5 100644
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@@ -281,9 +281,9 @@ stdenv.mkDerivation ({
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
 
-  buildFlags = optional
-    (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
-    (if profiledCompiler then "profiledbootstrap" else "bootstrap");
+  buildFlags =
+    lib.optionalString (profiledCompiler) "profiled" +
+    lib.optionalString (targetPlatform == hostPlatform && hostPlatform == buildPlatform && !disableBootstrap) "bootstrap";
 
   inherit (callFile ../common/strip-attributes.nix { })
     stripDebugList

From 71abb2c0854a20dc68c31e818b7be781cf365cc8 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 26 Feb 2023 09:55:45 +0100
Subject: [PATCH 009/154] multiple-outputs.sh: Allow `var` as an output name

---
 pkgs/build-support/setup-hooks/multiple-outputs.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/multiple-outputs.sh b/pkgs/build-support/setup-hooks/multiple-outputs.sh
index 3a318933f138..9781a8d1bc03 100644
--- a/pkgs/build-support/setup-hooks/multiple-outputs.sh
+++ b/pkgs/build-support/setup-hooks/multiple-outputs.sh
@@ -15,8 +15,8 @@ _assignFirst() {
     local varName="$1"
     local REMOVE=REMOVE # slightly hacky - we allow REMOVE (i.e. not a variable name)
     shift
-    for var in "$@"; do
-        if [ -n "${!var-}" ]; then eval "${varName}"="${var}"; return; fi
+    for _var in "$@"; do
+        if [ -n "${!_var-}" ]; then eval "${varName}"="${_var}"; return; fi
     done
     echo
     echo "error: _assignFirst: could not find a non-empty variable to assign to ${varName}."

From 6e91cb046e210ff2a33ba3f8b597050c350a5301 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 26 Feb 2023 09:57:00 +0100
Subject: [PATCH 010/154] multiple-outputs.sh: Do not leak `_var` variable from
 _assignFirst

---
 pkgs/build-support/setup-hooks/multiple-outputs.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/build-support/setup-hooks/multiple-outputs.sh b/pkgs/build-support/setup-hooks/multiple-outputs.sh
index 9781a8d1bc03..61e2ee7643f7 100644
--- a/pkgs/build-support/setup-hooks/multiple-outputs.sh
+++ b/pkgs/build-support/setup-hooks/multiple-outputs.sh
@@ -13,6 +13,7 @@ postFixupHooks+=(_multioutPropagateDev)
 # specific to this function's use case, which is setting up the output variables.
 _assignFirst() {
     local varName="$1"
+    local _var
     local REMOVE=REMOVE # slightly hacky - we allow REMOVE (i.e. not a variable name)
     shift
     for _var in "$@"; do

From c8b7048233f84c62ece9212888578f16a93ad1b3 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 26 Feb 2023 09:57:19 +0100
Subject: [PATCH 011/154] multiple-outputs.sh: Make _assignFirst message more
 accurate

---
 pkgs/build-support/setup-hooks/multiple-outputs.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/setup-hooks/multiple-outputs.sh b/pkgs/build-support/setup-hooks/multiple-outputs.sh
index 61e2ee7643f7..118fd21efd0c 100644
--- a/pkgs/build-support/setup-hooks/multiple-outputs.sh
+++ b/pkgs/build-support/setup-hooks/multiple-outputs.sh
@@ -20,7 +20,7 @@ _assignFirst() {
         if [ -n "${!_var-}" ]; then eval "${varName}"="${_var}"; return; fi
     done
     echo
-    echo "error: _assignFirst: could not find a non-empty variable to assign to ${varName}."
+    echo "error: _assignFirst: could not find a non-empty variable whose name to assign to ${varName}."
     echo "       The following variables were all unset or empty:"
     echo "           $*"
     if [ -z "${out:-}" ]; then

From 69cf5181c31c691e9fb225ada9a33f54208d914b Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 21 Feb 2023 19:50:48 +0000
Subject: [PATCH 012/154] stdenv/generic/setup.sh: enable parallel installs by
 default

The primary motivating example is openssl:

Before the change full package build took 1m54s minutes.
After the change full package build takes 59s.

About a 2x speedup.

The difference is visible because openssl builds hundreds of manpages
spawning a perl process per manual in `install` phase. Such a workload
is very easy to parallelize.

Another example would be `autotools`+`libtool` based build system where
install step requires relinking. The more binaries there are to relink
the more gain it will be to do it in parallel.

The change enables parallel installs by default only for buiilds that
already have parallel builds enabled. There is a high chance those build
systems already handle parallelism well but some packages will fail.

Consistently propagated the enableParallelBuilding to:
- cmake (enabled by default, similar to builds)
- ninja (set parallelism explicitly, don't rely on default)
- bmake (enable when requested)
- scons (enable when requested)
- meson (set parallelism explicitly, don't rely on default)
- waf (set parallelism explicitly, don't rely on default)
- qmake-4/5/6 (enable by default, similar to builds)
- xorg (always enable, similar to builds)
---
 pkgs/development/libraries/qt-4.x/4.8/qmake-hook.sh       | 5 +++++
 pkgs/development/libraries/qt-5/hooks/qmake-hook.sh       | 5 +++++
 pkgs/development/libraries/qt-6/hooks/qmake-hook.sh       | 5 +++++
 pkgs/development/tools/build-managers/bmake/setup-hook.sh | 1 +
 pkgs/development/tools/build-managers/cmake/setup-hook.sh | 5 +++++
 pkgs/development/tools/build-managers/meson/setup-hook.sh | 5 +++++
 pkgs/development/tools/build-managers/ninja/setup-hook.sh | 8 ++++++++
 pkgs/development/tools/build-managers/scons/setup-hook.sh | 1 +
 .../tools/build-managers/wafHook/setup-hook.sh            | 6 ++++++
 pkgs/servers/x11/xorg/builder.sh                          | 1 +
 pkgs/stdenv/generic/make-derivation.nix                   | 1 +
 pkgs/stdenv/generic/setup.sh                              | 1 +
 12 files changed, 44 insertions(+)

diff --git a/pkgs/development/libraries/qt-4.x/4.8/qmake-hook.sh b/pkgs/development/libraries/qt-4.x/4.8/qmake-hook.sh
index f288e99dd12a..b024f52f2046 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/qmake-hook.sh
+++ b/pkgs/development/libraries/qt-4.x/4.8/qmake-hook.sh
@@ -8,6 +8,11 @@ qmakeConfigurePhase() {
         echo "qmake4Hook: enabled parallel building"
     fi
 
+    if ! [[ -v enableParallelInstalling ]]; then
+        enableParallelInstalling=1
+        echo "qmake: enabled parallel installing"
+    fi
+
     runHook postConfigure
 }
 
diff --git a/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh b/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
index 741225a5aa81..0d30f0e26653 100644
--- a/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
@@ -38,6 +38,11 @@ qmakeConfigurePhase() {
         echo "qmake: enabled parallel building"
     fi
 
+    if ! [[ -v enableParallelInstalling ]]; then
+        enableParallelInstalling=1
+        echo "qmake: enabled parallel installing"
+    fi
+
     runHook postConfigure
 }
 
diff --git a/pkgs/development/libraries/qt-6/hooks/qmake-hook.sh b/pkgs/development/libraries/qt-6/hooks/qmake-hook.sh
index ec1d2ea6124e..8c4ce096443f 100644
--- a/pkgs/development/libraries/qt-6/hooks/qmake-hook.sh
+++ b/pkgs/development/libraries/qt-6/hooks/qmake-hook.sh
@@ -40,6 +40,11 @@ qmakeConfigurePhase() {
         echo "qmake: enabled parallel building"
     fi
 
+    if ! [[ -v enableParallelInstalling ]]; then
+        enableParallelInstalling=1
+        echo "qmake: enabled parallel installing"
+    fi
+
     runHook postConfigure
 }
 
diff --git a/pkgs/development/tools/build-managers/bmake/setup-hook.sh b/pkgs/development/tools/build-managers/bmake/setup-hook.sh
index c5ca27dd9105..f477a96d57ab 100644
--- a/pkgs/development/tools/build-managers/bmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/bmake/setup-hook.sh
@@ -76,6 +76,7 @@ bmakeInstallPhase() {
 
     # shellcheck disable=SC2086
     local flagsArray=(
+        ${enableParallelInstalling:+-j${NIX_BUILD_CORES}}
         SHELL=$SHELL
         # Old bash empty array hack
         $makeFlags ${makeFlagsArray+"${makeFlagsArray[@]}"}
diff --git a/pkgs/development/tools/build-managers/cmake/setup-hook.sh b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
index 1d25887754ad..b28ed42b6896 100755
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
@@ -130,6 +130,11 @@ cmakeConfigurePhase() {
         echo "cmake: enabled parallel building"
     fi
 
+    if ! [[ -v enableParallelInstalling ]]; then
+        enableParallelInstalling=1
+        echo "cmake: enabled parallel installing"
+    fi
+
     runHook postConfigure
 }
 
diff --git a/pkgs/development/tools/build-managers/meson/setup-hook.sh b/pkgs/development/tools/build-managers/meson/setup-hook.sh
index ded9c3c63b84..6305a405af21 100644
--- a/pkgs/development/tools/build-managers/meson/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/meson/setup-hook.sh
@@ -28,6 +28,11 @@ mesonConfigurePhase() {
         echo "meson: enabled parallel building"
     fi
 
+    if ! [[ -v enableParallelInstalling ]]; then
+        enableParallelInstalling=1
+        echo "meson: enabled parallel installing"
+    fi
+
     runHook postConfigure
 }
 
diff --git a/pkgs/development/tools/build-managers/ninja/setup-hook.sh b/pkgs/development/tools/build-managers/ninja/setup-hook.sh
index ecaa8b88c1aa..7fa5e4675f39 100644
--- a/pkgs/development/tools/build-managers/ninja/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/ninja/setup-hook.sh
@@ -53,8 +53,16 @@ ninjaCheckPhase() {
 ninjaInstallPhase() {
     runHook preInstall
 
+    local buildCores=1
+
+    # Parallel building is enabled by default.
+    if [ "${enableParallelInstalling-1}" ]; then
+        buildCores="$NIX_BUILD_CORES"
+    fi
+
     # shellcheck disable=SC2086
     local flagsArray=(
+        -j$buildCores
         $ninjaFlags "${ninjaFlagsArray[@]}"
         ${installTargets:-install}
     )
diff --git a/pkgs/development/tools/build-managers/scons/setup-hook.sh b/pkgs/development/tools/build-managers/scons/setup-hook.sh
index 0b908f68286b..67358ee843d1 100644
--- a/pkgs/development/tools/build-managers/scons/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/scons/setup-hook.sh
@@ -33,6 +33,7 @@ sconsInstallPhase() {
     fi
 
     local flagsArray=(
+        ${enableParallelInstalling:+-j${NIX_BUILD_CORES}}
         $sconsFlags ${sconsFlagsArray[@]}
         $installFlags ${installFlagsArray[@]}
         ${installTargets:-install}
diff --git a/pkgs/development/tools/build-managers/wafHook/setup-hook.sh b/pkgs/development/tools/build-managers/wafHook/setup-hook.sh
index e2f6714a32d4..4d95c28de1f1 100644
--- a/pkgs/development/tools/build-managers/wafHook/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/wafHook/setup-hook.sh
@@ -30,6 +30,11 @@ wafConfigurePhase() {
         echo "waf: enabled parallel building"
     fi
 
+    if ! [[ -v enableParallelInstalling ]]; then
+        enableParallelInstalling=1
+        echo "waf: enabled parallel installing"
+    fi
+
     runHook postConfigure
 }
 
@@ -68,6 +73,7 @@ wafInstallPhase() {
     fi
 
     local flagsArray=(
+        ${enableParallelInstalling:+-j ${NIX_BUILD_CORES}}
         $wafFlags ${wafFlagsArray[@]}
         $installFlags ${installFlagsArray[@]}
         ${installTargets:-install}
diff --git a/pkgs/servers/x11/xorg/builder.sh b/pkgs/servers/x11/xorg/builder.sh
index 9ee81091584b..a9c607ae35ea 100644
--- a/pkgs/servers/x11/xorg/builder.sh
+++ b/pkgs/servers/x11/xorg/builder.sh
@@ -37,5 +37,6 @@ fi
 
 
 enableParallelBuilding=1
+enableParallelInstalling=1
 
 genericBuild
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 6bf319d07308..50487b9f2e22 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -433,6 +433,7 @@ else let
     } // lib.optionalAttrs (enableParallelBuilding) {
       inherit enableParallelBuilding;
       enableParallelChecking = attrs.enableParallelChecking or true;
+      enableParallelInstalling = attrs.enableParallelInstalling or true;
     } // lib.optionalAttrs (hardeningDisable != [] || hardeningEnable != [] || stdenv.hostPlatform.isMusl) {
       NIX_HARDENING_ENABLE = enabledHardeningOptions;
     } // lib.optionalAttrs (stdenv.hostPlatform.isx86_64 && stdenv.hostPlatform ? gcc.arch) {
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 1a637bf13fdd..734abb890c24 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1376,6 +1376,7 @@ installPhase() {
 
     # shellcheck disable=SC2086
     local flagsArray=(
+        ${enableParallelInstalling:+-j${NIX_BUILD_CORES}}
         SHELL=$SHELL
     )
     _accumFlagsArray makeFlags makeFlagsArray installFlags installFlagsArray

From 8a99bbab4478b1a3ecb21916b856ea0955fc7449 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 22 Feb 2023 23:51:49 +0000
Subject: [PATCH 013/154] net-snmp: disable install parallelism

Without the change install phase fails as:

    installing
    install flags: -j16 ...
    ...
    ./.libs/libnetsnmpagent.so: file not recognized: file format not recognized
    collect2: error: ld returned 1 exit status
    make[1]: *** [Makefile:1012: libnetsnmpmibs.la] Error 1
    make[1]: *** Waiting for unfinished jobs....
---
 pkgs/servers/monitoring/net-snmp/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/servers/monitoring/net-snmp/default.nix b/pkgs/servers/monitoring/net-snmp/default.nix
index e4447d7a844c..6f7e696c5d6d 100644
--- a/pkgs/servers/monitoring/net-snmp/default.nix
+++ b/pkgs/servers/monitoring/net-snmp/default.nix
@@ -49,6 +49,9 @@ in stdenv.mkDerivation rec {
     ++ lib.optional withPerlTools perlWithPkgs;
 
   enableParallelBuilding = true;
+  # Missing dependencies during relinking:
+  #   ./.libs/libnetsnmpagent.so: file not recognized: file format not recognized
+  enableParallelInstalling = false;
   doCheck = false;  # tries to use networking
 
   postInstall = ''

From 0026b4a08718af34f59e90ffc3257960e27a3f7e Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 23 Feb 2023 07:53:15 +0000
Subject: [PATCH 014/154] xfsprogs: disable install parallelism

Without the change install phase fails as:

    Installing libxfs-install
    ../../install-sh -o nixbld -g nixbld -m 644 ioctl_xfs_ag_geometry.2 /nix/store/chymzkiiv6c2rgl2gqrn4bqv5azhx9vf-xfsprogs-6.1.1-bin/share/man/man2/ioctl_xfs_ag_geometry.2
    make[1]: *** No rule to make target '\', needed by 'kmem.lo'.  Stop.
    make[1]: *** Waiting for unfinished jobs....
    make: *** [Makefile:148: libxfs-install] Error 2
    make: *** Waiting for unfinished jobs....
---
 pkgs/tools/filesystems/xfsprogs/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/tools/filesystems/xfsprogs/default.nix b/pkgs/tools/filesystems/xfsprogs/default.nix
index 7c31657dd946..c8f4b7d93116 100644
--- a/pkgs/tools/filesystems/xfsprogs/default.nix
+++ b/pkgs/tools/filesystems/xfsprogs/default.nix
@@ -23,6 +23,9 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ libuuid ]; # Dev headers include <uuid/uuid.h>
 
   enableParallelBuilding = true;
+  # Install fails as:
+  #   make[1]: *** No rule to make target '\', needed by 'kmem.lo'.  Stop.
+  enableParallelInstalling = false;
 
   # @sbindir@ is replaced with /run/current-system/sw/bin to fix dependency cycles
   preConfigure = ''

From 82c5a2b62eed1ab585eeb2694b6327ccf09c423b Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 23 Feb 2023 09:59:44 +0000
Subject: [PATCH 015/154] sssd: disable parallel installs

Without the change parallel install fails as:

    install flags: -j16
    ...
    libbtool:   error: error: relink '_py3sss.la' with the above command before installing it
    libtool: warning: '/build/source/libsss_cert.la' has not been installed in '/nix/store/apyk9a6q7bc7d1fnn81vqrwil4waw9cd-sssd-2.8.2/lib/sssd'
    make[3]: *** [Makefile:13362: install-py3execLTLIBRARIES] Error 1
---
 pkgs/os-specific/linux/sssd/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/os-specific/linux/sssd/default.nix b/pkgs/os-specific/linux/sssd/default.nix
index 328098dbea33..b56748a94697 100644
--- a/pkgs/os-specific/linux/sssd/default.nix
+++ b/pkgs/os-specific/linux/sssd/default.nix
@@ -54,6 +54,9 @@ stdenv.mkDerivation rec {
   '';
 
   enableParallelBuilding = true;
+  # Disable parallel install due to missing depends:
+  #   libtool:   error: error: relink '_py3sss.la' with the above command before installing i
+  enableParallelInstalling = false;
   nativeBuildInputs = [ autoreconfHook makeWrapper pkg-config doxygen ];
   buildInputs = [ augeas dnsutils c-ares curl cyrus_sasl ding-libs libnl libunistring nss
                   samba nfs-utils p11-kit python3 popt

From 3193ea682eb5251691220f2d6dade6d48fc2043b Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Wed, 1 Mar 2023 10:26:26 +0200
Subject: [PATCH 016/154] openblas: Fix include path in generated .pc file

---
 pkgs/development/libraries/science/math/openblas/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 0477f859eef5..2de466907304 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -183,6 +183,7 @@ stdenv.mkDerivation rec {
     FC = "${stdenv.cc.targetPrefix}gfortran";
     CC = "${stdenv.cc.targetPrefix}${if stdenv.cc.isClang then "clang" else "cc"}";
     PREFIX = placeholder "out";
+    OPENBLAS_INCLUDE_DIR = "${placeholder "dev"}/include";
     NUM_THREADS = 64;
     INTERFACE64 = blas64;
     NO_STATIC = !enableStatic;
@@ -218,7 +219,7 @@ stdenv.mkDerivation rec {
 Name: $alias
 Version: ${version}
 Description: $alias provided by the OpenBLAS package.
-Cflags: -I$out/include
+Cflags: -I$dev/include
 Libs: -L$out/lib -lopenblas
 EOF
     done

From 6e422a0fbaca1d8be112f606edcf8a48fbe0eb2f Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 2 Mar 2023 14:40:45 +0200
Subject: [PATCH 017/154] tests.stdenv.outputs-no-out: cause less rebuilds

now gcc isn't built
---
 pkgs/test/stdenv/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/test/stdenv/default.nix b/pkgs/test/stdenv/default.nix
index ba9ea8cb75b2..3e8e1423532d 100644
--- a/pkgs/test/stdenv/default.nix
+++ b/pkgs/test/stdenv/default.nix
@@ -4,18 +4,20 @@
 { stdenv
 , pkgs
 , lib
-, runCommand
 , testers
 }:
 
 let
   # early enough not to rebuild gcc but late enough to have patchelf
   earlyPkgs = stdenv.__bootPackages.stdenv.__bootPackages;
+  earlierPkgs = stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages;
   # use a early stdenv so when hacking on stdenv this test can be run quickly
   bootStdenv = stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv;
   pkgsStructured = import pkgs.path { config = { structuredAttrsByDefault = true; }; inherit (stdenv.hostPlatform) system; };
   bootStdenvStructuredAttrsByDefault = pkgsStructured.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv;
 
+  runCommand = earlierPkgs.runCommand;
+
 
   ccWrapperSubstitutionsTest = { name, stdenv', extraAttrs ? { } }:
 
@@ -101,7 +103,7 @@ in
   hooks = lib.recurseIntoAttrs (import ./hooks.nix { stdenv = bootStdenv; pkgs = earlyPkgs; inherit lib; });
 
   outputs-no-out = runCommand "outputs-no-out-assert" {
-    result = testers.testBuildFailure (stdenv.mkDerivation {
+    result = earlierPkgs.testers.testBuildFailure (bootStdenv.mkDerivation {
       NIX_DEBUG = 1;
       name = "outputs-no-out";
       outputs = ["foo"];

From a4e1cf6d13004d19957bbecdf0d3940d4708460d Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 2 Mar 2023 14:42:16 +0200
Subject: [PATCH 018/154] tests.stdenv.outputs-no-out: update expectedMsg

---
 pkgs/test/stdenv/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/test/stdenv/default.nix b/pkgs/test/stdenv/default.nix
index 3e8e1423532d..7648b430c5f8 100644
--- a/pkgs/test/stdenv/default.nix
+++ b/pkgs/test/stdenv/default.nix
@@ -115,7 +115,7 @@ in
 
     # Assumption: the first output* variable to be configured is
     #   _overrideFirst outputDev "dev" "out"
-    expectedMsg = "error: _assignFirst: could not find a non-empty variable to assign to outputDev.\n       The following variables were all unset or empty:\n           dev out";
+    expectedMsg = "error: _assignFirst: could not find a non-empty variable whose name to assign to outputDev.\n       The following variables were all unset or empty:\n           dev out";
   } ''
     grep -F "$expectedMsg" $result/testBuildFailure.log >/dev/null
     touch $out

From ea80b3925f202dc49d258d07838ff813779824d9 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 2 Mar 2023 21:52:26 +0000
Subject: [PATCH 019/154] subversion: disable parallel installs

Without the change parallel install fails as:

    $ install flags: -j16 ...
    ...
    collect2: error: ld returned 1 exit status
    libtool:   error: error: relink 'libsvn_ra_serf-1.la' with the above command before installing it
    make: *** [build-outputs.mk:1316: install-serf-lib] Error 1
    make: *** Waiting for unfinished jobs....
    /nix/store/1qasgqvab0xh2jcy00x9b1zh39dw7m8f-bin
---
 pkgs/applications/version-management/subversion/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/applications/version-management/subversion/default.nix b/pkgs/applications/version-management/subversion/default.nix
index 613872721d20..25e3983c2b0a 100644
--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@@ -100,6 +100,10 @@ let
     inherit perlBindings pythonBindings;
 
     enableParallelBuilding = true;
+    # Missing install dependencies:
+    # libtool:   error: error: relink 'libsvn_ra_serf-1.la' with the above command before installing it
+    # make: *** [build-outputs.mk:1316: install-serf-lib] Error 1
+    enableParallelInstalling = false;
 
     nativeCheckInputs = [ python3 ];
     doCheck = false; # fails 10 out of ~2300 tests

From 7b8d86277d08ddaf071eb54c9b6c5d94531b02be Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 2 Mar 2023 22:00:52 +0000
Subject: [PATCH 020/154] ocaml: disable parallel installs

Without the change parallel install fails as:

    $ install flags: -j16 ...
    ...
    install: target '...-ocaml-4.14.0/lib/ocaml/threads': No such file or directory
    make[1]: *** [Makefile:140: installopt] Error 1
---
 pkgs/development/compilers/ocaml/generic.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/compilers/ocaml/generic.nix b/pkgs/development/compilers/ocaml/generic.nix
index c2cc7bb40b5f..7b9efb8a2c0f 100644
--- a/pkgs/development/compilers/ocaml/generic.nix
+++ b/pkgs/development/compilers/ocaml/generic.nix
@@ -87,6 +87,11 @@ stdenv.mkDerivation (args // {
   #  make[2]: *** [Makefile:199: backup] Error 1
   enableParallelBuilding = lib.versionAtLeast version "4.08";
 
+  # Workaround missing dependencies for install parallelism:
+  #  install: target '...-ocaml-4.14.0/lib/ocaml/threads': No such file or directory
+  #  make[1]: *** [Makefile:140: installopt] Error 1
+  enableParallelInstalling = false;
+
   # Workaround lack of parallelism support among top-level targets:
   # we place nixpkgs-specific targets to a separate file and set
   # sequential order among them as a single rule.

From dfc95e08f5c0376a896741327afc4f6dab8647e7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 3 Mar 2023 10:43:52 +0000
Subject: [PATCH 021/154] libwpe: 1.14.0 -> 1.14.1

---
 pkgs/development/libraries/libwpe/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libwpe/default.nix b/pkgs/development/libraries/libwpe/default.nix
index 7f7b202576f6..408d082a00de 100644
--- a/pkgs/development/libraries/libwpe/default.nix
+++ b/pkgs/development/libraries/libwpe/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libwpe";
-  version = "1.14.0";
+  version = "1.14.1";
 
   src = fetchurl {
     url = "https://wpewebkit.org/releases/libwpe-${version}.tar.xz";
-    sha256 = "wHMwW7rF9EAswcikdTv6PWOkCJAfhhggUeqlp13YnAA=";
+    sha256 = "sha256-sdDNzw+Nu0lOZbD3kT41cQbamg1X9Pu3udEjim2+mt4=";
   };
 
   nativeBuildInputs = [

From 51b39d7b8b6ea9a4faecf761ad692114f19294b5 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 3 Mar 2023 22:24:41 +0000
Subject: [PATCH 022/154] eresi: disable parallel installs

Without the change parallel installs fail as:

    install flags: -j2
    ...
    ln: failed to create symbolic link '...-eresi-0.83-a3-phoenix//bin/elfsh': No such file or directory
    make: *** [Makefile:108: install64] Error 1
---
 pkgs/development/tools/analysis/eresi/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/tools/analysis/eresi/default.nix b/pkgs/development/tools/analysis/eresi/default.nix
index 9d1487ea99b6..3d5571ddea42 100644
--- a/pkgs/development/tools/analysis/eresi/default.nix
+++ b/pkgs/development/tools/analysis/eresi/default.nix
@@ -60,6 +60,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ which ];
   buildInputs = [ openssl readline ];
   enableParallelBuilding = true;
+  # ln: failed to create symbolic link '...-eresi-0.83-a3-phoenix//bin/elfsh': No such file or directory
+  # make: *** [Makefile:108: install64] Error 1
+  enableParallelInstalling = false;
 
   installTargets = lib.singleton "install"
                 ++ lib.optional stdenv.is64bit "install64";

From 915a1920232aa1447d2804e3f04c91e933d680b1 Mon Sep 17 00:00:00 2001
From: Alexandre Iooss <erdnaxe@crans.org>
Date: Sat, 4 Mar 2023 10:55:55 +0100
Subject: [PATCH 023/154] ncurses: enable strictDeps

---
 pkgs/development/libraries/ncurses/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 4e2c731d7e2b..c79f1c908993 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -53,6 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
   # Only the C compiler, and explicitly not C++ compiler needs this flag on solaris:
   CFLAGS = lib.optionalString stdenv.isSunOS "-D_XOPEN_SOURCE_EXTENDED";
 
+  strictDeps = true;
   depsBuildBuild = [
     buildPackages.stdenv.cc
   ];

From 2c8cfc60c63b5f3a27d8f141020fa36f46e83d56 Mon Sep 17 00:00:00 2001
From: Alexandre Iooss <erdnaxe@crans.org>
Date: Sat, 4 Mar 2023 10:56:08 +0100
Subject: [PATCH 024/154] readline: enable strictDeps

---
 pkgs/development/libraries/readline/6.3.nix | 3 ++-
 pkgs/development/libraries/readline/7.0.nix | 3 ++-
 pkgs/development/libraries/readline/8.2.nix | 3 ++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/readline/6.3.nix b/pkgs/development/libraries/readline/6.3.nix
index 88ad884bd489..853078b5561c 100644
--- a/pkgs/development/libraries/readline/6.3.nix
+++ b/pkgs/development/libraries/readline/6.3.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
 
   outputs = [ "out" "dev" "man" "doc" "info" ];
 
-  propagatedBuildInputs = [ncurses];
+  strictDeps = true;
+  propagatedBuildInputs = [ ncurses ];
 
   patchFlags = [ "-p0" ];
 
diff --git a/pkgs/development/libraries/readline/7.0.nix b/pkgs/development/libraries/readline/7.0.nix
index 25ef4b97a863..3b643a9e15fe 100644
--- a/pkgs/development/libraries/readline/7.0.nix
+++ b/pkgs/development/libraries/readline/7.0.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man" "doc" "info" ];
 
-  propagatedBuildInputs = [ncurses];
+  strictDeps = true;
+  propagatedBuildInputs = [ ncurses ];
 
   patchFlags = [ "-p0" ];
 
diff --git a/pkgs/development/libraries/readline/8.2.nix b/pkgs/development/libraries/readline/8.2.nix
index 0fedcdc9397f..1c53da3cdfa4 100644
--- a/pkgs/development/libraries/readline/8.2.nix
+++ b/pkgs/development/libraries/readline/8.2.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man" "doc" "info" ];
 
-  propagatedBuildInputs = [ncurses];
+  strictDeps = true;
+  propagatedBuildInputs = [ ncurses ];
 
   patchFlags = [ "-p0" ];
 

From 92b9dce61b89475164f82f5fa070afd409a9294d Mon Sep 17 00:00:00 2001
From: Alexandre Iooss <erdnaxe@crans.org>
Date: Sat, 4 Mar 2023 13:10:09 +0100
Subject: [PATCH 025/154] tracker: enable strictDeps

Enable strictDeps and fix "dbus-run-session: command not found" error
during test phase.
---
 pkgs/development/libraries/tracker/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/libraries/tracker/default.nix b/pkgs/development/libraries/tracker/default.nix
index f66c08684d10..2cf6cdf7ddbd 100644
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@@ -44,6 +44,8 @@ stdenv.mkDerivation rec {
     patchShebangs utils/data-generators/cc/generate
   '';
 
+  strictDeps = true;
+
   depsBuildBuild = [
     pkg-config
   ];
@@ -79,6 +81,10 @@ stdenv.mkDerivation rec {
     systemd
   ];
 
+  nativeCheckInputs = [
+    dbus
+  ];
+
   mesonFlags = [
     "-Ddocs=true"
     (lib.mesonEnable "introspection" withIntrospection)

From 78367e1bffa0fe7d60472d5367b65cc1e3bfeda8 Mon Sep 17 00:00:00 2001
From: Maxine Aubrey <maxeaubrey@gmail.com>
Date: Sat, 4 Mar 2023 13:15:03 +0100
Subject: [PATCH 026/154] networkmanager: 1.40.12 -> 1.40.16

---
 pkgs/tools/networking/networkmanager/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index 5cd15525da72..89cc38ca34a5 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -58,11 +58,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "networkmanager";
-  version = "1.40.12";
+  version = "1.40.16";
 
   src = fetchurl {
     url = "mirror://gnome/sources/NetworkManager/${lib.versions.majorMinor version}/NetworkManager-${version}.tar.xz";
-    sha256 = "sha256-wCJ+BKttAylmLfoKftxGbgQGJek2odjo4CoFM6cRca8=";
+    sha256 = "sha256-fhDT76j9TzYzJlFyU9HniXd0WN5MvbTMG7XUYf+cq0s=";
   };
 
   outputs = [ "out" "dev" "devdoc" "man" "doc" ];

From 9c72ea872567c9d92ed0cad1be88726f3e461f97 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 2 Mar 2023 16:23:34 +0200
Subject: [PATCH 027/154] multiple-outputs.sh: silence 'rmdir: failed to remove
 ... Directory not empty'

++ rmdir /nix/store/6f233lsgbqv87w4nmzpsdaydwhyapps6-at-spi2-core-aarch64-unknown-linux-gnu-2.46.0/lib
rmdir: failed to remove '/nix/store/6f233lsgbqv87w4nmzpsdaydwhyapps6-at-spi2-core-aarch64-unknown-linux-gnu-2.46.0/lib': Directory not empty
---
 pkgs/build-support/setup-hooks/multiple-outputs.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/multiple-outputs.sh b/pkgs/build-support/setup-hooks/multiple-outputs.sh
index 3a318933f138..44579209c688 100644
--- a/pkgs/build-support/setup-hooks/multiple-outputs.sh
+++ b/pkgs/build-support/setup-hooks/multiple-outputs.sh
@@ -138,9 +138,9 @@ moveToOutput() {
 
             # remove empty directories, printing iff at least one gets removed
             local srcParent="$(readlink -m "$srcPath/..")"
-            if rmdir "$srcParent"; then
+            if [ -n "$(find "$srcParent" -maxdepth 0 -type d -empty 2>/dev/null)" ]; then
                 echo "Removing empty $srcParent/ and (possibly) its parents"
-                rmdir -p --ignore-fail-on-non-empty "$(readlink -m "$srcParent/..")" \
+                rmdir -p --ignore-fail-on-non-empty "$srcParent" \
                     2> /dev/null || true # doesn't ignore failure for some reason
             fi
         done

From b3d8d75db86efe821d80f86d986d3c7808fa11aa Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 4 Mar 2023 15:08:58 +0000
Subject: [PATCH 028/154] s9fes: disable install parallelism

Without the change parallel installs fail as:

    install flags: -j16
    install -d -m 0755 ...-s9fes-20181205/share/s9fes
    sed -e "s|^#! /usr/local|#! ...-s9fes-20181205|" <prog/s9help.scm >...-s9fes-20181205/bin/s9help
    ...-bash-5.2-p15/bin/bash: line 1: ...-s9fes-20181205/bin/s9help: No such file or directory
    make: *** [Makefile:157: install-util] Error 1
    make: *** Waiting for unfinished jobs....
---
 pkgs/development/interpreters/s9fes/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/interpreters/s9fes/default.nix b/pkgs/development/interpreters/s9fes/default.nix
index a05dde8f1f51..7cf60b00eb9b 100644
--- a/pkgs/development/interpreters/s9fes/default.nix
+++ b/pkgs/development/interpreters/s9fes/default.nix
@@ -24,6 +24,9 @@ stdenv.mkDerivation rec {
   buildInputs = [ ncurses ];
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" "PREFIX=$(out)" ];
   enableParallelBuilding = true;
+  # ...-bash-5.2-p15/bin/bash: line 1: ...-s9fes-20181205/bin/s9help: No such file or directory
+  # make: *** [Makefile:157: install-util] Error 1
+  enableParallelInstalling = false;
 
   meta = with lib; {
     description = "Scheme 9 From Empty Space, an interpreter for R4RS Scheme";

From d3b862c457039208bd98f61cf6730dd87c0fee36 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 5 Mar 2023 00:47:39 +0000
Subject: [PATCH 029/154] libpcap: 1.10.1 -> 1.10.3

---
 pkgs/development/libraries/libpcap/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libpcap/default.nix b/pkgs/development/libraries/libpcap/default.nix
index 312e1dbf87cd..0f429062e48c 100644
--- a/pkgs/development/libraries/libpcap/default.nix
+++ b/pkgs/development/libraries/libpcap/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libpcap";
-  version = "1.10.1";
+  version = "1.10.3";
 
   src = fetchurl {
     url = "https://www.tcpdump.org/release/${pname}-${version}.tar.gz";
-    sha256 = "sha256-7ShfSsyvBTRPkJdXV7Pb/ncrpB0cQBwmSLf6RbcRvdQ=";
+    sha256 = "sha256-KoiFxANRbPewkz7UsU1sqjDgIFJInr1BTcdaxS51WeY=";
   };
 
   buildInputs = lib.optionals withRemote [ libxcrypt ];

From 575fddf25b672b8ed5d5294ab10a8a22d579bc3b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=94=D0=B0=D0=BC=D1=98=D0=B0=D0=BD=20=D0=93=D0=B5=D0=BE?=
 =?UTF-8?q?=D1=80=D0=B3=D0=B8=D0=B5=D0=B2=D1=81=D0=BA=D0=B8?=
 <gdamjan@gmail.com>
Date: Fri, 17 Feb 2023 18:03:01 +0100
Subject: [PATCH 030/154] systemd: 252.5 -> 253

systemd v253 changelog/NEWS:
https://github.com/systemd/systemd/blob/v253/NEWS

NixOS changes:
0007-hostnamed-localed-timedated-disable-methods-that-cha.patch was
dropped, because systemd gained support to handle read-only /etc.

*-add-rootprefix-to-lookup-dir-paths.patch required some updates too,
as src/basic/def.h moved to src/basic/constants.h.

systemd/systemd#25771 switched p11kit to become
dlopen()'ed, so we need to patch that path.

added a note to the 23.05 release notes to recommend `nixos-rebuild boot`

Co-authored-by: Florian Klink <flokli@flokli.de>
---
 .../manual/release-notes/rl-2305.section.md   |   4 +
 ...on-t-try-to-unmount-nix-or-nix-store.patch |   8 +-
 .../systemd/0003-Fix-NixOS-containers.patch   |   6 +-
 ...004-Look-for-fsck-in-the-right-place.patch |   6 +-
 ...some-NixOS-specific-unit-directories.patch |   2 +-
 ...f-a-useless-message-in-user-sessions.patch |   4 +-
 ...-paths.patch => 0007-Fix-hwdb-paths.patch} |   2 +-
 ...d-timedated-disable-methods-that-cha.patch | 105 ------------------
 ...-usr-share-zoneinfo-to-etc-zoneinfo.patch} |  20 ++--
 ...alectl-use-etc-X11-xkb-for-list-x11.patch} |   4 +-
 ...e-statedir-and-don-t-touch-prefixdi.patch} |   4 +-
 ...-add-rootprefix-to-lookup-dir-paths.patch} |  12 +-
 ...execute-scripts-in-etc-systemd-syst.patch} |   4 +-
 ...cute-scripts-in-etc-systemd-system-.patch} |   2 +-
 ...placeholder-for-DEFAULT_PATH_NORMAL.patch} |   2 +-
 ...kg-config-derive-prefix-from-prefix.patch} |   0
 ...environment-when-calling-generators.patch} |   4 +-
 ...17-core-don-t-taint-on-unmerged-usr.patch} |   4 +-
 ...ntext_init-fix-driver-name-checking.patch} |  11 +-
 pkgs/os-specific/linux/systemd/default.nix    |  36 +++---
 20 files changed, 69 insertions(+), 171 deletions(-)
 rename pkgs/os-specific/linux/systemd/{0008-Fix-hwdb-paths.patch => 0007-Fix-hwdb-paths.patch} (96%)
 delete mode 100644 pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
 rename pkgs/os-specific/linux/systemd/{0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch => 0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch} (90%)
 rename pkgs/os-specific/linux/systemd/{0010-localectl-use-etc-X11-xkb-for-list-x11.patch => 0009-localectl-use-etc-X11-xkb-for-list-x11.patch} (88%)
 rename pkgs/os-specific/linux/systemd/{0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch => 0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch} (89%)
 rename pkgs/os-specific/linux/systemd/{0012-add-rootprefix-to-lookup-dir-paths.patch => 0011-add-rootprefix-to-lookup-dir-paths.patch} (85%)
 rename pkgs/os-specific/linux/systemd/{0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch => 0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch} (89%)
 rename pkgs/os-specific/linux/systemd/{0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch => 0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch} (94%)
 rename pkgs/os-specific/linux/systemd/{0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch => 0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch} (97%)
 rename pkgs/os-specific/linux/systemd/{0016-pkg-config-derive-prefix-from-prefix.patch => 0015-pkg-config-derive-prefix-from-prefix.patch} (100%)
 rename pkgs/os-specific/linux/systemd/{0017-inherit-systemd-environment-when-calling-generators.patch => 0016-inherit-systemd-environment-when-calling-generators.patch} (94%)
 rename pkgs/os-specific/linux/systemd/{0018-core-don-t-taint-on-unmerged-usr.patch => 0017-core-don-t-taint-on-unmerged-usr.patch} (92%)
 rename pkgs/os-specific/linux/systemd/{0019-tpm2_context_init-fix-driver-name-checking.patch => 0018-tpm2_context_init-fix-driver-name-checking.patch} (87%)

diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 3e63ddced611..ba4055bbaf49 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -12,6 +12,10 @@ In addition to numerous new and upgraded packages, this release has the followin
 
   - default linux: 5.15 -\> 6.1, all supported kernels available
 
+  - systemd has been updated to v253.1, see [the pull request](https://github.com/NixOS/nixpkgs/pull/216826) for more info.
+    It's recommended to use `nixos-rebuild boot` and `reboot`, rather than `nixos-rebuild switch` - since in some rare cases
+    the switch of a live system might fail.
+
 - Cinnamon has been updated to 5.6, see [the pull request](https://github.com/NixOS/nixpkgs/pull/201328#issue-1449910204) for what is changed.
 
 - KDE Plasma has been updated to v5.27, see [the release notes](https://kde.org/announcements/plasma/5/5.27.0/) for what is changed.
diff --git a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
index 42a580695811..138823ec68f5 100644
--- a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@@ -12,10 +12,10 @@ https://github.com/NixOS/nixos/issues/126
  2 files changed, 4 insertions(+)
 
 diff --git a/src/shared/fstab-util.c b/src/shared/fstab-util.c
-index f683f05981..5a04c2c2a6 100644
+index 164e71a150..68e0766594 100644
 --- a/src/shared/fstab-util.c
 +++ b/src/shared/fstab-util.c
-@@ -40,6 +40,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
+@@ -41,6 +41,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
          /* Don't bother with the OS data itself */
          if (PATH_IN_SET(mount,
                          "/",
@@ -25,10 +25,10 @@ index f683f05981..5a04c2c2a6 100644
                          "/etc"))
                  return true;
 diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
-index e650b82170..5d0d41aa28 100644
+index 61bd9d2601..a6243da417 100644
 --- a/src/shutdown/umount.c
 +++ b/src/shutdown/umount.c
-@@ -522,6 +522,8 @@ static int delete_md(MountPoint *m) {
+@@ -531,6 +531,8 @@ static int delete_md(MountPoint *m) {
  
  static bool nonunmountable_path(const char *path) {
          return path_equal(path, "/")
diff --git a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
index 8cc2e22d7615..349194fda45a 100644
--- a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
+++ b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
@@ -10,10 +10,10 @@ container, so checking early whether it exists will fail.
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 01a67b5553..86dd2cea84 100644
+index 36d336dfc8..d62c5173ca 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -5636,6 +5636,7 @@ static int run(int argc, char *argv[]) {
+@@ -5634,6 +5634,7 @@ static int run(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
@@ -21,7 +21,7 @@ index 01a67b5553..86dd2cea84 100644
                          _cleanup_free_ char *p = NULL;
  
                          if (arg_pivot_root_new)
-@@ -5650,6 +5651,7 @@ static int run(int argc, char *argv[]) {
+@@ -5648,6 +5649,7 @@ static int run(int argc, char *argv[]) {
                                                      "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
                                  goto finish;
                          }
diff --git a/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch b/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
index 1e602fdee6b9..c31b9122b900 100644
--- a/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
+++ b/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] Look for fsck in the right place
  1 file changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/src/fsck/fsck.c b/src/fsck/fsck.c
-index 73c76fceea..d00cea7158 100644
+index e25c5d5efa..26f4e5669e 100644
 --- a/src/fsck/fsck.c
 +++ b/src/fsck/fsck.c
-@@ -352,6 +352,7 @@ static int run(int argc, char *argv[]) {
+@@ -351,6 +351,7 @@ static int run(int argc, char *argv[]) {
          if (r == 0) {
                  char dash_c[STRLEN("-C") + DECIMAL_STR_MAX(int) + 1];
                  int progress_socket = -1;
@@ -19,7 +19,7 @@ index 73c76fceea..d00cea7158 100644
                  const char *cmdline[9];
                  int i = 0;
  
-@@ -372,7 +373,10 @@ static int run(int argc, char *argv[]) {
+@@ -371,7 +372,10 @@ static int run(int argc, char *argv[]) {
                  } else
                          dash_c[0] = 0;
  
diff --git a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
index 081615774c75..b4a0da30c8f6 100644
--- a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
@@ -14,7 +14,7 @@ Also, remove /usr and /lib as these don't exist on NixOS.
  2 files changed, 6 insertions(+), 19 deletions(-)
 
 diff --git a/src/basic/path-lookup.c b/src/basic/path-lookup.c
-index 36f386254b..a968d28dfc 100644
+index c99e9d8786..b9f85d1f8c 100644
 --- a/src/basic/path-lookup.c
 +++ b/src/basic/path-lookup.c
 @@ -92,11 +92,7 @@ int xdg_user_data_dir(char **ret, const char *suffix) {
diff --git a/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
index 9b5afcaba9d4..336e2b8831e7 100644
--- a/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
+++ b/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
@@ -13,10 +13,10 @@ in containers.
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index a59afafb58..d9e7d77913 100644
+index 7b394794b0..50d092042c 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -1432,7 +1432,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
+@@ -1437,7 +1437,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
                  if (!unit_is_bound_by_inactive(u, &culprit))
                          continue;
  
diff --git a/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch b/pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch
similarity index 96%
rename from pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
rename to pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch
index 69bd1cc97b27..49e94b019c78 100644
--- a/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch
@@ -9,7 +9,7 @@ Patch by vcunat.
  1 file changed, 2 insertions(+), 5 deletions(-)
 
 diff --git a/src/libsystemd/sd-hwdb/hwdb-internal.h b/src/libsystemd/sd-hwdb/hwdb-internal.h
-index 62d27f7b89..87318e041b 100644
+index 5302679a62..c681f3a984 100644
 --- a/src/libsystemd/sd-hwdb/hwdb-internal.h
 +++ b/src/libsystemd/sd-hwdb/hwdb-internal.h
 @@ -83,8 +83,5 @@ struct trie_value_entry2_f {
diff --git a/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
deleted file mode 100644
index f23d805fdac3..000000000000
--- a/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Gabriel Ebner <gebner@gebner.org>
-Date: Sun, 6 Dec 2015 14:26:36 +0100
-Subject: [PATCH] hostnamed, localed, timedated: disable methods that change
- system settings.
-
----
- src/hostname/hostnamed.c |  6 ++++++
- src/locale/localed.c     |  9 +++++++++
- src/timedate/timedated.c | 10 ++++++++++
- 3 files changed, 25 insertions(+)
-
-diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
-index 486b093062..580e933f14 100644
---- a/src/hostname/hostnamed.c
-+++ b/src/hostname/hostnamed.c
-@@ -906,6 +906,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
-         if (r < 0)
-                 return r;
- 
-+        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
-+            "Changing system settings via systemd is not supported on NixOS.");
-+
-         name = empty_to_null(name);
- 
-         context_read_etc_hostname(c);
-@@ -969,6 +972,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
-         if (r < 0)
-                 return r;
- 
-+        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
-+            "Changing system settings via systemd is not supported on NixOS.");
-+
-         name = empty_to_null(name);
- 
-         context_read_machine_info(c);
-diff --git a/src/locale/localed.c b/src/locale/localed.c
-index 7aa47f18c2..0a8ef68931 100644
---- a/src/locale/localed.c
-+++ b/src/locale/localed.c
-@@ -309,6 +309,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
-         if (r < 0)
-                 return r;
- 
-+        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
-+                                 "Changing system settings via systemd is not supported on NixOS.");
-+
-         use_localegen = locale_gen_check_available();
- 
-         /* If single locale without variable name is provided, then we assume it is LANG=. */
-@@ -423,6 +426,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
-         if (r < 0)
-                 return r;
- 
-+        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
-+            "Changing system settings via systemd is not supported on NixOS.");
-+
-         keymap = empty_to_null(keymap);
-         keymap_toggle = empty_to_null(keymap_toggle);
- 
-@@ -602,6 +608,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
-         if (r < 0)
-                 return r;
- 
-+        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
-+            "Changing system settings via systemd is not supported on NixOS.");
-+
-         layout = empty_to_null(layout);
-         model = empty_to_null(model);
-         variant = empty_to_null(variant);
-diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index 373574cc06..6dbf73eb42 100644
---- a/src/timedate/timedated.c
-+++ b/src/timedate/timedated.c
-@@ -665,6 +665,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
-         if (r < 0)
-                 return r;
- 
-+        if (getenv("NIXOS_STATIC_TIMEZONE"))
-+                return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
-+                    "Changing timezone via systemd is not supported when it is set in NixOS configuration.");
-+
-         if (!timezone_is_valid(z, LOG_DEBUG))
-                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z);
- 
-@@ -743,6 +747,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
-         if (r < 0)
-                 return r;
- 
-+        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
-+            "Changing system settings via systemd is not supported on NixOS.");
-+
-         if (lrtc == c->local_rtc && !fix_system)
-                 return sd_bus_reply_method_return(m, NULL);
- 
-@@ -923,6 +930,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
-         if (r < 0)
-                 return r;
- 
-+        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
-+            "Changing system settings via systemd is not supported on NixOS.");
-+
-         r = context_update_ntp_status(c, bus, m);
-         if (r < 0)
-                 return r;
diff --git a/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
similarity index 90%
rename from pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
rename to pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index cc40140b284b..69823095a59d 100644
--- a/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -35,10 +35,10 @@ index e486474c44..5f373d0723 100644
      <literal>Etc/UTC</literal>. The resulting link should lead to the
      corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index 71b2f67350..465f1c0b15 100644
+index b700f364ef..116b1cec63 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
-@@ -1280,7 +1280,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
+@@ -1282,7 +1282,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
  
          assert(ret);
  
@@ -47,7 +47,7 @@ index 71b2f67350..465f1c0b15 100644
          if (!f)
                  return -errno;
  
-@@ -1319,7 +1319,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
+@@ -1321,7 +1321,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
          _cleanup_strv_free_ char **zones = NULL;
          int r;
  
@@ -56,7 +56,7 @@ index 71b2f67350..465f1c0b15 100644
          if (!f)
                  return -errno;
  
-@@ -1431,7 +1431,7 @@ int verify_timezone(const char *name, int log_level) {
+@@ -1433,7 +1433,7 @@ int verify_timezone(const char *name, int log_level) {
          if (p - name >= PATH_MAX)
                  return -ENAMETOOLONG;
  
@@ -65,7 +65,7 @@ index 71b2f67350..465f1c0b15 100644
  
          fd = open(t, O_RDONLY|O_CLOEXEC);
          if (fd < 0)
-@@ -1489,7 +1489,7 @@ int get_timezone(char **ret) {
+@@ -1491,7 +1491,7 @@ int get_timezone(char **ret) {
          if (r < 0)
                  return r; /* returns EINVAL if not a symlink */
  
@@ -75,10 +75,10 @@ index 71b2f67350..465f1c0b15 100644
                  return -EINVAL;
  
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index 065ee896cd..1b260416c8 100644
+index 9e79f84691..1a1c75718c 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -510,7 +510,7 @@ static int process_timezone(void) {
+@@ -512,7 +512,7 @@ static int process_timezone(void) {
          if (isempty(arg_timezone))
                  return 0;
  
@@ -88,10 +88,10 @@ index 065ee896cd..1b260416c8 100644
          (void) mkdir_parents(etc_localtime, 0755);
          r = symlink_atomic(e, etc_localtime);
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 86dd2cea84..4e5f03669d 100644
+index d62c5173ca..84beac064b 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1905,8 +1905,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
+@@ -1915,8 +1915,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
@@ -103,7 +103,7 @@ index 86dd2cea84..4e5f03669d 100644
  
  static bool etc_writable(void) {
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index 6dbf73eb42..a36dd459d2 100644
+index ad483301ef..a7f22b1c86 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
 @@ -282,7 +282,7 @@ static int context_read_data(Context *c) {
diff --git a/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch b/pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch
similarity index 88%
rename from pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
rename to pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch
index 4f652d45a42c..fac9916cf3b4 100644
--- a/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
+++ b/pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch
@@ -10,10 +10,10 @@ NixOS has an option to link the xkb data files to /etc/X11, but not to
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/locale/localectl.c b/src/locale/localectl.c
-index c23f1fa3f6..ad2eba82ad 100644
+index fb83881cc7..c47a33134a 100644
 --- a/src/locale/localectl.c
 +++ b/src/locale/localectl.c
-@@ -299,7 +299,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
+@@ -297,7 +297,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
          } state = NONE, look_for;
          int r;
  
diff --git a/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch b/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
similarity index 89%
rename from pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
rename to pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
index eabb80c39fa8..01874c2be8e3 100644
--- a/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+++ b/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] build: don't create statedir and don't touch prefixdir
  1 file changed, 3 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index 76ad51d3fb..839dcef437 100644
+index bfc86857d6..84e3e4c1db 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -4067,9 +4067,6 @@ install_data('LICENSE.GPL2',
+@@ -4277,9 +4277,6 @@ install_data('LICENSE.GPL2',
  install_subdir('LICENSES',
                 install_dir : docdir)
  
diff --git a/pkgs/os-specific/linux/systemd/0012-add-rootprefix-to-lookup-dir-paths.patch b/pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch
similarity index 85%
rename from pkgs/os-specific/linux/systemd/0012-add-rootprefix-to-lookup-dir-paths.patch
rename to pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch
index 32ee37d78fa1..6f64dce5e4b9 100644
--- a/pkgs/os-specific/linux/systemd/0012-add-rootprefix-to-lookup-dir-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch
@@ -8,14 +8,14 @@ discovery default udev rules. By adding `$out/lib` to the lookup paths
 we should again be able to discover the udev rules amongst other default
 files that I might have missed.
 ---
- src/basic/def.h | 6 ++++--
+ src/basic/constants.h | 6 ++++--
  1 file changed, 4 insertions(+), 2 deletions(-)
 
-diff --git a/src/basic/def.h b/src/basic/def.h
-index 2b4de29021..1bd61dc45f 100644
---- a/src/basic/def.h
-+++ b/src/basic/def.h
-@@ -44,13 +44,15 @@
+diff --git a/src/basic/constants.h b/src/basic/constants.h
+index 5d68cc6332..a2ccc315e1 100644
+--- a/src/basic/constants.h
++++ b/src/basic/constants.h
+@@ -73,13 +73,15 @@
          "/run/" n "\0"                          \
          "/usr/local/lib/" n "\0"                \
          "/usr/lib/" n "\0"                      \
diff --git a/pkgs/os-specific/linux/systemd/0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
similarity index 89%
rename from pkgs/os-specific/linux/systemd/0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
rename to pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
index 78d1e48f6cf7..84ac0d882d6d 100644
--- a/pkgs/os-specific/linux/systemd/0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+++ b/pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@@ -10,10 +10,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
-index dcee0f9006..24b03d6948 100644
+index 42111d2772..53467ac229 100644
 --- a/src/shutdown/shutdown.c
 +++ b/src/shutdown/shutdown.c
-@@ -334,6 +334,7 @@ static void init_watchdog(void) {
+@@ -335,6 +335,7 @@ static void init_watchdog(void) {
  int main(int argc, char *argv[]) {
          static const char* const dirs[] = {
                  SYSTEM_SHUTDOWN_PATH,
diff --git a/pkgs/os-specific/linux/systemd/0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
similarity index 94%
rename from pkgs/os-specific/linux/systemd/0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
rename to pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
index b496dde75619..99c0d93facb7 100644
--- a/pkgs/os-specific/linux/systemd/0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+++ b/pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
@@ -9,7 +9,7 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index 3461d3e45f..d7d0ec2a7a 100644
+index 9c51a3367f..75d6b76a87 100644
 --- a/src/sleep/sleep.c
 +++ b/src/sleep/sleep.c
 @@ -184,6 +184,7 @@ static int execute(
diff --git a/pkgs/os-specific/linux/systemd/0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
similarity index 97%
rename from pkgs/os-specific/linux/systemd/0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
rename to pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
index 06efb13ff6f2..b3d1db340ef8 100644
--- a/pkgs/os-specific/linux/systemd/0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@@ -10,7 +10,7 @@ systemd itself uses extensively.
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index 22d3632e6e..1e8bbb242b 100644
+index 56f01f41d8..f9b8627388 100644
 --- a/src/basic/path-util.h
 +++ b/src/basic/path-util.h
 @@ -24,11 +24,11 @@
diff --git a/pkgs/os-specific/linux/systemd/0016-pkg-config-derive-prefix-from-prefix.patch b/pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch
similarity index 100%
rename from pkgs/os-specific/linux/systemd/0016-pkg-config-derive-prefix-from-prefix.patch
rename to pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch
diff --git a/pkgs/os-specific/linux/systemd/0017-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch
similarity index 94%
rename from pkgs/os-specific/linux/systemd/0017-inherit-systemd-environment-when-calling-generators.patch
rename to pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch
index eaebb623d922..1cfd939a6392 100644
--- a/pkgs/os-specific/linux/systemd/0017-inherit-systemd-environment-when-calling-generators.patch
+++ b/pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch
@@ -16,10 +16,10 @@ executables that are being called from managers.
  1 file changed, 8 insertions(+)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index d9e7d77913..ba3ce14bf0 100644
+index 50d092042c..898f9ed2f1 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -3693,9 +3693,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
+@@ -3714,9 +3714,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
           * adjust generated units to that. Let's pass down some bits of information that are easy for us to
           * determine (but a bit harder for generator scripts to determine), as environment variables. */
  
diff --git a/pkgs/os-specific/linux/systemd/0018-core-don-t-taint-on-unmerged-usr.patch b/pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch
similarity index 92%
rename from pkgs/os-specific/linux/systemd/0018-core-don-t-taint-on-unmerged-usr.patch
rename to pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch
index d40bdbde8ef1..7a2e8dc670b0 100644
--- a/pkgs/os-specific/linux/systemd/0018-core-don-t-taint-on-unmerged-usr.patch
+++ b/pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch
@@ -17,10 +17,10 @@ See also: https://github.com/systemd/systemd/issues/24191
  1 file changed, 4 deletions(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index ba3ce14bf0..03bf66ff74 100644
+index 898f9ed2f1..5040d5b105 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -4493,10 +4493,6 @@ char* manager_taint_string(const Manager *m) {
+@@ -4543,10 +4543,6 @@ char* manager_taint_string(const Manager *m) {
          if (m->taint_usr)
                  stage[n++] = "split-usr";
  
diff --git a/pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch b/pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch
similarity index 87%
rename from pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch
rename to pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch
index c64fdd8d34c0..115ce78d7134 100644
--- a/pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch
+++ b/pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch
@@ -1,4 +1,4 @@
-From 236e9281cb158be3191c500524fbc5f397a25e03 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Nick Cao <nickcao@nichi.co>
 Date: Sun, 15 Jan 2023 20:15:55 +0800
 Subject: [PATCH] tpm2_context_init: fix driver name checking
@@ -27,10 +27,10 @@ filename_is_valid with path_is_valid.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
-index ba8dfb041d..7de5d5fc77 100644
+index 259f280e0f..142e70a740 100644
 --- a/src/shared/tpm2-util.c
 +++ b/src/shared/tpm2-util.c
-@@ -192,7 +192,7 @@ int tpm2_context_init(const char *device, struct tpm2_context *ret) {
+@@ -176,7 +176,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
                  fn = strjoina("libtss2-tcti-", driver, ".so.0");
  
                  /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */
@@ -38,7 +38,4 @@ index ba8dfb041d..7de5d5fc77 100644
 +                if (!path_is_valid(fn))
                          return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 driver name '%s' not valid, refusing.", driver);
  
-                 dl = dlopen(fn, RTLD_NOW);
--- 
-2.39.0
-
+                 context->tcti_dl = dlopen(fn, RTLD_NOW);
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 9dda9cd2d4ae..80d140458559 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -133,13 +133,13 @@ assert withHomed -> withCryptsetup;
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "252.5";
+  version = "253";
 
   # Bump this variable on every (major) version change. See below (in the meson options list) for why.
   # command:
   #  $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \
   #     jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
-  releaseTimestamp = "1667246393";
+  releaseTimestamp = "1676488940";
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname version;
@@ -150,7 +150,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    hash = "sha256-cNZRTuYFMR1z6KpELeQoJahMhRl4fKuRuc3xXH3KzlM=";
+    hash = "sha256-K1h4nnDYB25URcJrS5HF4gYVDzEUCABpTxlEt7JKKa4=";
   };
 
   # On major changes, or when otherwise required, you *must* reformat the patches,
@@ -165,19 +165,18 @@ stdenv.mkDerivation (finalAttrs: {
     ./0004-Look-for-fsck-in-the-right-place.patch
     ./0005-Add-some-NixOS-specific-unit-directories.patch
     ./0006-Get-rid-of-a-useless-message-in-user-sessions.patch
-    ./0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
-    ./0008-Fix-hwdb-paths.patch
-    ./0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
-    ./0010-localectl-use-etc-X11-xkb-for-list-x11.patch
-    ./0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
-    ./0012-add-rootprefix-to-lookup-dir-paths.patch
-    ./0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
-    ./0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
-    ./0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
-    ./0016-pkg-config-derive-prefix-from-prefix.patch
-    ./0017-inherit-systemd-environment-when-calling-generators.patch
-    ./0018-core-don-t-taint-on-unmerged-usr.patch
-    ./0019-tpm2_context_init-fix-driver-name-checking.patch
+    ./0007-Fix-hwdb-paths.patch
+    ./0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+    ./0009-localectl-use-etc-X11-xkb-for-list-x11.patch
+    ./0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+    ./0011-add-rootprefix-to-lookup-dir-paths.patch
+    ./0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+    ./0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+    ./0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+    ./0015-pkg-config-derive-prefix-from-prefix.patch
+    ./0016-inherit-systemd-environment-when-calling-generators.patch
+    ./0017-core-don-t-taint-on-unmerged-usr.patch
+    ./0018-tpm2_context_init-fix-driver-name-checking.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
@@ -295,6 +294,9 @@ stdenv.mkDerivation (finalAttrs: {
           # inspect-elf support
           { name = "libelf.so.1"; pkg = opt withCoredump elfutils; }
           { name = "libdw.so.1"; pkg = opt withCoredump elfutils; }
+
+          # Support for PKCS#11 in systemd-cryptsetup, systemd-cryptenroll and systemd-homed
+          { name = "libp11-kit.so.0"; pkg = opt (withHomed || withCryptsetup) p11-kit; }
         ];
 
       patchDlOpen = dl:
@@ -402,7 +404,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional withPCRE2 pcre2
     ++ lib.optional withSelinux libselinux
     ++ lib.optional withRemote libmicrohttpd
-    ++ lib.optionals withHomed [ p11-kit ]
+    ++ lib.optionals (withHomed || withCryptsetup) [ p11-kit ]
     ++ lib.optionals (withHomed || withCryptsetup) [ libfido2 ]
     ++ lib.optionals withLibBPF [ libbpf ]
     ++ lib.optional withTpm2Tss tpm2-tss

From f7ce1d22ebbeeff8784fbdff8d5dd52454fd917a Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Fri, 3 Mar 2023 23:59:37 +0100
Subject: [PATCH 031/154] systemd: 253 -> 253.1

Changelog:

```
6c327d74aa hwdb: update to 11875a98e4f1c31e247d99e00c7774ea3653bafd
0b81fcd16d chase-symlinks: Always open a dirfd to the root directory
aa20a210a0 chase-symlinks: chase_symlinks_at() AT_FDCWD fixes
bb3e44323b escape: add missing non-NULL parameter assertions
c4e7cf2bd7 test-escape: Add tests for escaping bogus UTF-8 sequences
e906fd2421 escape: Ensure that output is always valid UTF-8
1a22006574 virt: correctly detect QEMU emulated pSeries guests
5ee19fdfa0 psi-util: fix error handling
9ffa0d439f journald: remove triplicate logging about failure to write log lines
4f7f93cc6a journald: downgrade various log messages from LOG_WARNING to LOG_INFO
a2dc51cd8c journald: make sure shall_try_append_again() logs about all return codes passed in, not just some
144ac494ec systemctl: print better message if default target is masked
791754f683 Revert "dissect-image: don't probe swap partitions needlessly"
d0e7841dce rules: remove redundant duplicate comparisons
dc98d58dd8 man: add two missing commands to synopsys
e093acd062 core/dbus-socket: check the socket path is absolute
a719c2ec2f sd-event: fix error handling
58c821af60 sd-event: always initialize sd_event.perturb
2bfb07b22f systemctl: show "Until:" field only for service and scope units
d9abd8babe tmpfiles.d: drop misleading comment
0f4dbe6367 Enable TPM by default with SetCredentialEncrypted
8d8240bdf6 stub: Fix unaligned read
44c2ff5b1e efi: drop executable-stack bit from .elf file
f2460b78b9 logind-session: make stopping of idle session visible to admins
1947b9939c sleep: check if we're on AC power before checking battery capacity
452cad62c8 install: fail early if specifier expansion failed
eae11e3f06 homectl: add missing break
9024afb994 core/manager: falling back to execute generators without sandboxing
aac692160e man/tmpfiles.d: adjust the table in synopsis, improve spelling
d2739b8c14 test: disable pipefail when testing interactive firstboot
755431b233 ukify: Set fast_load option when parsing PE files
343e90462f core: permit sending augmented enable/disable methods
ba1cb4156b process-util: show requested process name in the log
5140da8937 systemctl: edit: fix double free of instanced name
c4cdbb978f journalctl: fix output when --lines is used with --grep
6dafcad55c loop-util: fix error condition and return value
ec6c1fbf7d Correct journal misspell
6b6df9a845 cryptsetup: check the existence of salt by salt_size > 0
cd5de2811a boot: Fix assertion failure
01b90e1588 pid1: generate compat warning for SystemCallArchitectures= if seccomp is off
a3177cbe54 core/mount: fix default target for /sysusr/usr and its child
3168bda640 mkosi: configure multiarch libdir in debian/ubuntu builds
51b7acfcef tpm2: fix build failure without openssl
a88e35bf95 resolved: Fall back to TCP if UDP is blocked
```
---
 pkgs/os-specific/linux/systemd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 80d140458559..3c0104d5d7cb 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -133,7 +133,7 @@ assert withHomed -> withCryptsetup;
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "253";
+  version = "253.1";
 
   # Bump this variable on every (major) version change. See below (in the meson options list) for why.
   # command:
@@ -150,7 +150,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    hash = "sha256-K1h4nnDYB25URcJrS5HF4gYVDzEUCABpTxlEt7JKKa4=";
+    hash = "sha256-PyAhkLxDkT5gVocCXh8bst6PBgguASjnA82xinQOtjw=";
   };
 
   # On major changes, or when otherwise required, you *must* reformat the patches,

From d2837a9cb3d11187e12db193becffe4cb7c8d1ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=94=D0=B0=D0=BC=D1=98=D0=B0=D0=BD=20=D0=93=D0=B5=D0=BE?=
 =?UTF-8?q?=D1=80=D0=B3=D0=B8=D0=B5=D0=B2=D1=81=D0=BA=D0=B8?=
 <gdamjan@gmail.com>
Date: Sun, 5 Mar 2023 04:38:58 +0100
Subject: [PATCH 032/154] nixos/systemd-initrd: create the /tmp mount point in
 the initrd

systemd now requires the /tmp mount point in the initrd cpio archive
since https://github.com/systemd/systemd/pull/25723

setting `"/tmp/.keep".text` will create the directory.

this fixes a boot failure:
```
(sd-gens): Failed to overmount /tmp/: No such file or directory
```
---
 nixos/modules/system/boot/systemd/initrd.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index f937581b76f6..1ec460714691 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -371,6 +371,7 @@ in {
       managerEnvironment.PATH = "/bin:/sbin";
 
       contents = {
+        "/tmp/.keep".text = "systemd requires the /tmp mount point in the initrd cpio archive";
         "/init".source = "${cfg.package}/lib/systemd/systemd";
         "/etc/systemd/system".source = stage1Units;
 

From 9b8a0e5f7ae4bed2b39d0595a2defef1edd8bcb0 Mon Sep 17 00:00:00 2001
From: Dmitry Bogatov <serenity@kaction.cc>
Date: Thu, 5 Jan 2023 21:16:13 -0500
Subject: [PATCH 033/154] python3.pkgs.pynacl: build offline documentation

---
 pkgs/development/python-modules/pynacl/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/pynacl/default.nix b/pkgs/development/python-modules/pynacl/default.nix
index 68bd546cd36c..bd92adf25011 100644
--- a/pkgs/development/python-modules/pynacl/default.nix
+++ b/pkgs/development/python-modules/pynacl/default.nix
@@ -3,6 +3,7 @@
 , buildPythonPackage
 , fetchPypi
 , pytestCheckHook
+, sphinxHook
 , pythonOlder
 , libsodium
 , cffi
@@ -12,6 +13,7 @@
 buildPythonPackage rec {
   pname = "pynacl";
   version = "1.5.0";
+  outputs = [ "out" "doc" ];
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -22,6 +24,10 @@ buildPythonPackage rec {
     sha256 = "8ac7448f09ab85811607bdd21ec2464495ac8b7c66d146bf545b0f08fb9220ba";
   };
 
+  nativeBuildInputs = [
+    sphinxHook
+  ];
+
   buildInputs = [
     libsodium
   ];

From c541bf5ee65f8d6ca44f43b2f361df8e17ca44fc Mon Sep 17 00:00:00 2001
From: Maxine Aubrey <maxeaubrey@gmail.com>
Date: Sun, 5 Mar 2023 14:29:19 +0100
Subject: [PATCH 034/154] networkmanager: 1.40.16 -> 1.42.2

---
 .../networking/networkmanager/default.nix     |  5 ++-
 .../networkmanager/fix-install-paths.patch    |  4 +-
 .../networking/networkmanager/fix-paths.patch | 38 +++++++++----------
 3 files changed, 24 insertions(+), 23 deletions(-)

diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index 89cc38ca34a5..8bb2335ba6f8 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -58,11 +58,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "networkmanager";
-  version = "1.40.16";
+  version = "1.42.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/NetworkManager/${lib.versions.majorMinor version}/NetworkManager-${version}.tar.xz";
-    sha256 = "sha256-fhDT76j9TzYzJlFyU9HniXd0WN5MvbTMG7XUYf+cq0s=";
+    sha256 = "sha256-3P6cXJCdOMga6VzP6JWjKKKhTBHaz7f1B760Be/OBYA=";
   };
 
   outputs = [ "out" "dev" "devdoc" "man" "doc" ];
@@ -113,6 +113,7 @@ stdenv.mkDerivation rec {
     "-Dfirewalld_zone=false"
     "-Dtests=no"
     "-Dcrypto=gnutls"
+    "-Dmobile_broadband_provider_info_database=${mobile-broadband-provider-info}/share/mobile-broadband-provider-info/serviceproviders.xml"
   ];
 
   patches = [
diff --git a/pkgs/tools/networking/networkmanager/fix-install-paths.patch b/pkgs/tools/networking/networkmanager/fix-install-paths.patch
index 3a2973060a1d..71fbd4842c2e 100644
--- a/pkgs/tools/networking/networkmanager/fix-install-paths.patch
+++ b/pkgs/tools/networking/networkmanager/fix-install-paths.patch
@@ -1,8 +1,8 @@
 diff --git a/meson.build b/meson.build
-index 300e71319c..2a9fba7116 100644
+index 6813e52ac1..ecdb78ca54 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -996,9 +996,9 @@ meson.add_install_script(
+@@ -999,9 +999,9 @@ meson.add_install_script(
    join_paths('tools', 'meson-post-install.sh'),
    nm_datadir,
    nm_bindir,
diff --git a/pkgs/tools/networking/networkmanager/fix-paths.patch b/pkgs/tools/networking/networkmanager/fix-paths.patch
index 5b099e134849..2491b099c9f1 100644
--- a/pkgs/tools/networking/networkmanager/fix-paths.patch
+++ b/pkgs/tools/networking/networkmanager/fix-paths.patch
@@ -24,13 +24,13 @@ index e23b3a5282..c7246a3b61 100644
  ExecStart=@sbindir@/NetworkManager --no-daemon
  Restart=on-failure
 diff --git a/src/core/devices/nm-device.c b/src/core/devices/nm-device.c
-index c51da9ac82..ad67a301ef 100644
+index 3565c04d59..52c58fec24 100644
 --- a/src/core/devices/nm-device.c
 +++ b/src/core/devices/nm-device.c
-@@ -13879,14 +13879,14 @@ nm_device_start_ip_check(NMDevice *self)
+@@ -14005,14 +14005,14 @@ nm_device_start_ip_check(NMDevice *self)
              gw = nm_l3_config_data_get_best_default_route(l3cd, AF_INET);
              if (gw) {
-                 _nm_utils_inet4_ntop(NMP_OBJECT_CAST_IP4_ROUTE(gw)->gateway, buf);
+                 nm_inet4_ntop(NMP_OBJECT_CAST_IP4_ROUTE(gw)->gateway, buf);
 -                ping_binary = nm_utils_find_helper("ping", "/usr/bin/ping", NULL);
 +                ping_binary = "@iputils@/bin/ping";
                  log_domain  = LOGD_IP4;
@@ -38,17 +38,17 @@ index c51da9ac82..ad67a301ef 100644
          } else if (priv->ip_data_6.state == NM_DEVICE_IP_STATE_READY) {
              gw = nm_l3_config_data_get_best_default_route(l3cd, AF_INET6);
              if (gw) {
-                 _nm_utils_inet6_ntop(&NMP_OBJECT_CAST_IP6_ROUTE(gw)->gateway, buf);
+                 nm_inet6_ntop(&NMP_OBJECT_CAST_IP6_ROUTE(gw)->gateway, buf);
 -                ping_binary = nm_utils_find_helper("ping6", "/usr/bin/ping6", NULL);
 +                ping_binary = "@iputils@/bin/ping";
                  log_domain  = LOGD_IP6;
              }
          }
 diff --git a/src/libnm-client-impl/meson.build b/src/libnm-client-impl/meson.build
-index 46464a6328..d943d4351a 100644
+index 143126c51a..a7143443ec 100644
 --- a/src/libnm-client-impl/meson.build
 +++ b/src/libnm-client-impl/meson.build
-@@ -171,7 +171,6 @@ if enable_introspection
+@@ -172,7 +172,6 @@ if enable_introspection
        input: libnm_core_settings_sources,
        output: 'nm-propery-infos-' + info + '.xml',
        command: [
@@ -56,7 +56,7 @@ index 46464a6328..d943d4351a 100644
          join_paths(meson.source_root(), 'tools', 'generate-docs-nm-property-infos.py'),
          info,
          '@OUTPUT@',
-@@ -228,7 +227,6 @@ if enable_introspection
+@@ -229,7 +228,6 @@ if enable_introspection
        'env',
        'GI_TYPELIB_PATH=' + gi_typelib_path,
        'LD_LIBRARY_PATH=' + ld_library_path,
@@ -78,7 +78,7 @@ index bebc53a851..93710455d5 100644
      g_ptr_array_add(argv, (char *) arg1);
  
 diff --git a/src/libnmc-base/nm-vpn-helpers.c b/src/libnmc-base/nm-vpn-helpers.c
-index 7ad5bee509..2641dbf637 100644
+index 476fbe518e..2641dbf637 100644
 --- a/src/libnmc-base/nm-vpn-helpers.c
 +++ b/src/libnmc-base/nm-vpn-helpers.c
 @@ -198,25 +198,8 @@ nm_vpn_openconnect_authenticate_helper(const char *host,
@@ -86,13 +86,13 @@ index 7ad5bee509..2641dbf637 100644
      const char *const   *iter;
      const char          *path;
 -    const char *const    DEFAULT_PATHS[] = {
--           "/sbin/",
--           "/usr/sbin/",
--           "/usr/local/sbin/",
--           "/bin/",
--           "/usr/bin/",
--           "/usr/local/bin/",
--           NULL,
+-        "/sbin/",
+-        "/usr/sbin/",
+-        "/usr/local/sbin/",
+-        "/bin/",
+-        "/usr/bin/",
+-        "/usr/local/bin/",
+-        NULL,
 -    };
  
 -    path = nm_utils_file_search_in_paths("openconnect",
@@ -109,7 +109,7 @@ index 7ad5bee509..2641dbf637 100644
      if (!g_spawn_sync(NULL,
                        (char **) NM_MAKE_STRV(path, "--authenticate", host),
 diff --git a/src/libnmc-setting/meson.build b/src/libnmc-setting/meson.build
-index 49314cad2e..6d52624699 100644
+index cf8a21fc80..61b992a50e 100644
 --- a/src/libnmc-setting/meson.build
 +++ b/src/libnmc-setting/meson.build
 @@ -7,7 +7,6 @@ if enable_docs
@@ -121,7 +121,7 @@ index 49314cad2e..6d52624699 100644
        '@OUTPUT@',
        nm_property_infos_xml['nmcli'],
 diff --git a/src/tests/client/meson.build b/src/tests/client/meson.build
-index b2e455bbbd..a12ebf212a 100644
+index 6dc0f2a2c8..0a32977a59 100644
 --- a/src/tests/client/meson.build
 +++ b/src/tests/client/meson.build
 @@ -6,7 +6,6 @@ test(
@@ -129,6 +129,6 @@ index b2e455bbbd..a12ebf212a 100644
      build_root,
      source_root,
 -    python.path(),
+     '--',
    ],
-   timeout: 120,
- )
+   env: [

From 764dd10ac0d7700d065571c438953a12aea84cf3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 5 Mar 2023 14:33:00 +0000
Subject: [PATCH 035/154] iproute2: 6.1.0 -> 6.2.0

---
 pkgs/os-specific/linux/iproute/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 9a63a28a7a96..dbb45a1f80f8 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "6.1.0";
+  version = "6.2.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-XOEqD+xrIScl7yGHNZQbLat2JE235yZGp2AhsFN7Q6s=";
+    sha256 = "sha256-TXJzAgDsWyqrqhovIFU8Z0gpLwZdmhVMfV4iVZ35/WI=";
   };
 
   patches = [

From 9c64da6ed40c9de48c17d4742318e2389e276126 Mon Sep 17 00:00:00 2001
From: Maxine Aubrey <maxeaubrey@gmail.com>
Date: Sun, 5 Mar 2023 17:49:18 +0100
Subject: [PATCH 036/154] modemmanager: 1.20.4 -> 1.20.6

---
 pkgs/tools/networking/modemmanager/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/modemmanager/default.nix b/pkgs/tools/networking/modemmanager/default.nix
index 752cd74d77ab..d66c277f1dac 100644
--- a/pkgs/tools/networking/modemmanager/default.nix
+++ b/pkgs/tools/networking/modemmanager/default.nix
@@ -23,14 +23,14 @@
 
 stdenv.mkDerivation rec {
   pname = "modemmanager";
-  version = "1.20.4";
+  version = "1.20.6";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mobile-broadband";
     repo = "ModemManager";
     rev = version;
-    hash = "sha256-OWP23EQ7a8rghhV7AC9yinCxRI0xwcntB5dl9XtgK6M=";
+    hash = "sha256-/A4WTsUQVeZDi5ei6qBvqoWYLKdRcZaYZU8/qWOPrvM=";
   };
 
   patches = [

From 83f65146ab1d5d55548d1dbe87a93d9ee8081ee0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=94=D0=B0=D0=BC=D1=98=D0=B0=D0=BD=20=D0=93=D0=B5=D0=BE?=
 =?UTF-8?q?=D1=80=D0=B3=D0=B8=D0=B5=D0=B2=D1=81=D0=BA=D0=B8?=
 <gdamjan@gmail.com>
Date: Sun, 5 Mar 2023 20:05:00 +0100
Subject: [PATCH 037/154] nixos/systemd: systemd-growfs* units are real files
 now

`systemd-growfs@.service` and `systemd-growfs-root.service` became real units since:
https://github.com/systemd/systemd/pull/25006/commits/50072ccf1bfee8a53563a083a3a52b26f0d5678f

we need to add them to the nixos module so growfs works again
---
 nixos/modules/system/boot/systemd.nix        | 2 ++
 nixos/modules/system/boot/systemd/initrd.nix | 1 +
 2 files changed, 3 insertions(+)

diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 679a663362b6..895766a33610 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -79,6 +79,8 @@ let
       # Filesystems.
       "systemd-fsck@.service"
       "systemd-fsck-root.service"
+      "systemd-growfs@.service"
+      "systemd-growfs-root.service"
       "systemd-remount-fs.service"
       "systemd-pstore.service"
       "local-fs.target"
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index 1ec460714691..ffe96f3ad9c3 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -56,6 +56,7 @@ let
     "systemd-ask-password-console.path"
     "systemd-ask-password-console.service"
     "systemd-fsck@.service"
+    "systemd-growfs@.service"
     "systemd-halt.service"
     "systemd-hibernate-resume@.service"
     "systemd-journald-audit.socket"

From 18b4f46cb6f84092e0a19264e30b0f83c7c73129 Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Thu, 16 Feb 2023 19:49:54 +0100
Subject: [PATCH 038/154] bundler: 2.4.6 -> 2.4.7

---
 pkgs/development/ruby-modules/bundler/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index 0483feccb6ef..675dd498ef33 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.4.6";
-  source.sha256 = "sha256-MI/g13w5NMoHQ78AJ11BlKhulroUI6xNPqQ19iH51P8=";
+  version = "2.4.7";
+  source.sha256 = "sha256-sZQdZAWJD7PaH8qs+NDWTu5Cd3YBnOGIVs+GOxP9H7k=";
   dontPatchShebangs = true;
 
   postFixup = ''

From 7df4387ebdc9f5293fad04480391e8743c312a3b Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 6 Mar 2023 07:46:25 +0000
Subject: [PATCH 039/154] gcc: do not install sys-include headers for
 cross-compilers.

Before the change include headers for cross-compilers like `pkgsStatic`
looked like this:

    $ nix build -L --impure --expr 'with import ./. {}; pkgsStatic.stdenv.mkDerivation { name = "probe"; buildCommand = "echo | $CXX -x c++ -E -v - |& fgrep -B10 search; exit 1"; }' |& unnix

    #include "..." search starts here:
    #include <...> search starts here:
     /<<NIX>>/x86_64-unknown-linux-musl-stage-final-gcc-13.0.0/lib/gcc/x86_64-unknown-linux-musl/13.0.1/../../../../x86_64-unknown-linux-musl/include/c++/13.0.1
     /<<NIX>>/x86_64-unknown-linux-musl-stage-final-gcc-13.0.0/lib/gcc/x86_64-unknown-linux-musl/13.0.1/../../../../x86_64-unknown-linux-musl/include/c++/13.0.1/x86_64-unknown-linux-musl
     /<<NIX>>/x86_64-unknown-linux-musl-stage-final-gcc-13.0.0/lib/gcc/x86_64-unknown-linux-musl/13.0.1/../../../../x86_64-unknown-linux-musl/include/c++/13.0.1/backward
     /<<NIX>>/x86_64-unknown-linux-musl-stage-final-gcc-13.0.0/lib/gcc/x86_64-unknown-linux-musl/13.0.1/../../../../x86_64-unknown-linux-musl/sys-include
     /<<NIX>>/x86_64-unknown-linux-musl-stage-final-gcc-13.0.0/lib/gcc/x86_64-unknown-linux-musl/13.0.1/../../../../x86_64-unknown-linux-musl/include
     /<<NIX>>/x86_64-unknown-linux-musl-stage-final-gcc-13.0.0/lib/gcc/x86_64-unknown-linux-musl/13.0.1/include
     /<<NIX>>/musl-static-x86_64-unknown-linux-musl-1.2.3-dev/include
     /<<NIX>>/x86_64-unknown-linux-musl-stage-final-gcc-13.0.0/lib/gcc/x86_64-unknown-linux-musl/13.0.1/include-fixed
    End of search list.

Note that `.../sys-include` inhibits the effect of `musl-static-x86_64-unknown-linux-musl-1.2.3-dev/include`.

After the change the paths look as expected:

    $ nix build -L --impure --expr 'with import ./. {}; pkgsStatic.stdenv.mkDerivation { name = "probe"; buildCommand = "echo | $CXX -x c++ -E -v - |& fgrep -B10 search; exit 1"; }' |& unnix

    #include "..." search starts here:
    #include <...> search starts here:
     /<<NIX>>/x86_64-unknown-linux-musl-stage-final-gcc-13.0.0/lib/gcc/x86_64-unknown-linux-musl/13.0.1/../../../../x86_64-unknown-linux-musl/include/c++/13.0.1
     /<<NIX>>/x86_64-unknown-linux-musl-stage-final-gcc-13.0.0/lib/gcc/x86_64-unknown-linux-musl/13.0.1/../../../../x86_64-unknown-linux-musl/include/c++/13.0.1/x86_64-unknown-linux-musl
     /<<NIX>>/x86_64-unknown-linux-musl-stage-final-gcc-13.0.0/lib/gcc/x86_64-unknown-linux-musl/13.0.1/../../../../x86_64-unknown-linux-musl/include/c++/13.0.1/backward
     /<<NIX>>/x86_64-unknown-linux-musl-stage-final-gcc-13.0.0/lib/gcc/x86_64-unknown-linux-musl/13.0.1/../../../../x86_64-unknown-linux-musl/include
     /<<NIX>>/x86_64-unknown-linux-musl-stage-final-gcc-13.0.0/lib/gcc/x86_64-unknown-linux-musl/13.0.1/include
     /<<NIX>>/musl-static-x86_64-unknown-linux-musl-1.2.3-dev/include
     /<<NIX>>/x86_64-unknown-linux-musl-stage-final-gcc-13.0.0/lib/gcc/x86_64-unknown-linux-musl/13.0.1/include-fixed
    End of search list.
---
 pkgs/development/compilers/gcc/builder.sh | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
index 2d7a058fa015..52e044ad6b58 100644
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@@ -250,6 +250,17 @@ postInstall() {
         done
     fi
 
+    # Cross-compiler specific:
+    # --with-headers=$dir option triggers gcc to make a private copy
+    # of $dir headers and use it later as `-isysroot`. This prevents
+    # cc-wrapper from overriding libc headers with `-idirafter`.
+    # It should be safe to drop it and rely solely on the cc-wrapper.
+    local sysinc_dir=$out/${targetConfig+$targetConfig/}sys-include
+    if [ -d "$sysinc_dir" ]; then
+        chmod -R u+w "$out/${targetConfig+$targetConfig/}sys-include"
+        rm -rfv "$out/${targetConfig+$targetConfig/}sys-include"
+    fi
+
     # Get rid of some "fixed" header files
     rm -rfv $out/lib/gcc/*/*/include-fixed/{root,linux}
 

From c68f2c937a2aedbc182bab4c9dbbdc8830256f62 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 6 Mar 2023 15:51:47 +0000
Subject: [PATCH 040/154] libopenmpt: 0.6.8 -> 0.6.9

---
 pkgs/development/libraries/audio/libopenmpt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/audio/libopenmpt/default.nix b/pkgs/development/libraries/audio/libopenmpt/default.nix
index 4eaa95384d31..b53fec3f9e63 100644
--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.6.8";
+  version = "0.6.9";
 
   outputs = [ "out" "dev" "bin" ];
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "HGGLPf8afLaiT0MXVZIPokN1YmgTj/ox09t8YHwsLWk=";
+    sha256 = "R56XWrt9wPqcrUG90x8lXXjUPgcmVGIIBY08P897blo=";
   };
 
   enableParallelBuilding = true;

From 740ab71253c1e052422925355252654078848e94 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Mar 2023 01:16:32 +0000
Subject: [PATCH 041/154] liburcu: 0.13.2 -> 0.14.0

---
 pkgs/development/libraries/liburcu/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/liburcu/default.nix b/pkgs/development/libraries/liburcu/default.nix
index 8eab8d6beeef..a7204b913175 100644
--- a/pkgs/development/libraries/liburcu/default.nix
+++ b/pkgs/development/libraries/liburcu/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, perl }:
 
 stdenv.mkDerivation rec {
-  version = "0.13.2";
+  version = "0.14.0";
   pname = "liburcu";
 
   src = fetchurl {
     url = "https://lttng.org/files/urcu/userspace-rcu-${version}.tar.bz2";
-    sha256 = "sha256-EhP9nxsLdNp94rt0M1t2CY25c4/sXTzcB8DFJPNPwDI=";
+    sha256 = "sha256-ykO/Jh1NOSz/IN+uRAg2YDvwCfziT9ybJpfYN6IjnU8=";
   };
 
   nativeCheckInputs = [ perl ];

From 4a3699c08b5184eaf6576e3de105e66d68fcd252 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Mon, 6 Mar 2023 18:07:21 -0500
Subject: [PATCH 042/154] cargo-auditable: 0.6.0 -> 0.6.1

Diff: https://github.com/rust-secure-code/cargo-auditable/compare/v0.6.0...v0.6.1

Changelog: https://github.com/rust-secure-code/cargo-auditable/blob/v0.6.1/cargo-auditable/CHANGELOG.md
---
 .../compilers/rust/cargo-auditable.nix        | 21 +++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/compilers/rust/cargo-auditable.nix b/pkgs/development/compilers/rust/cargo-auditable.nix
index 1c621276021a..1745ae266c28 100644
--- a/pkgs/development/compilers/rust/cargo-auditable.nix
+++ b/pkgs/development/compilers/rust/cargo-auditable.nix
@@ -1,18 +1,23 @@
-{ lib, fetchFromGitHub, makeRustPlatform, rustc, cargo }:
+{ lib, fetchFromGitHub, makeRustPlatform, rustc, cargo, installShellFiles }:
 
 let
   args = rec {
     pname = "cargo-auditable";
-    version = "0.6.0";
+    version = "0.6.1";
 
     src = fetchFromGitHub {
       owner = "rust-secure-code";
       repo = pname;
       rev = "v${version}";
-      sha256 = "sha256-mSiEC+9QtRjWmywJnGgUqp+q8fhY0qUYrgjrAVaY114=";
+      sha256 = "sha256-MKMPLv8jeST0l4tq+MMPC18qfZMmBixdj6Ng19YKepU=";
     };
 
-    cargoSha256 = "sha256-Wz5My/QxPpZVsPBUe3KHT3ttD6CTU8NCY8rhFEC+UlA=";
+    cargoSha256 = "sha256-6/f7pNaTL+U6bI6jMakU/lfwYYxN/EM3WkKZcydsyLk=";
+
+    # Cargo.lock is outdated
+    preConfigure = ''
+      cargo update --offline
+    '';
 
     meta = with lib; {
       description = "A tool to make production Rust binaries auditable";
@@ -37,4 +42,12 @@ in
 
 rustPlatform.buildRustPackage.override { cargo-auditable = bootstrap; } (args // {
   auditable = true; # TODO: remove when this is the default
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  postInstall = ''
+    installManPage cargo-auditable/cargo-auditable.1
+  '';
 })

From aaa11f72106e7c8bc5716f813bf5f96a8421a9ea Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Tue, 7 Mar 2023 04:20:00 +0000
Subject: [PATCH 043/154] ruby: add rubygems to expression passthru

---
 pkgs/development/interpreters/ruby/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 0297839e7da4..3b051eac87b0 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -281,6 +281,7 @@ let
             ruby = self;
           };
 
+          inherit rubygems;
           inherit (import ../../ruby-modules/with-packages {
             inherit lib stdenv makeBinaryWrapper buildRubyGem buildEnv;
             gemConfig = defaultGemConfig;

From 708dcbce926fdfb40a08ff625148fe11b6fe601d Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Tue, 7 Mar 2023 04:20:00 +0000
Subject: [PATCH 044/154] nodejs-18_x: 18.14.2 -> 18.15.0

https://github.com/nodejs/node/releases/tag/v18.15.0
---
 pkgs/development/web/nodejs/v18.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/web/nodejs/v18.nix b/pkgs/development/web/nodejs/v18.nix
index 766fabc3c9e1..988a4ea5263c 100644
--- a/pkgs/development/web/nodejs/v18.nix
+++ b/pkgs/development/web/nodejs/v18.nix
@@ -9,10 +9,11 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "18.14.2";
-  sha256 = "sha256-+8Nk3SX+4srMDyAz2y2GEV/AdXUxDqDmRAi4Fw0JxoU=";
+  version = "18.15.0";
+  sha256 = "sha256-jkTWUBj/lzKEGVwjGGRpoOpAgul+xCAOX1cG1VhNqjc=";
   patches = [
     ./disable-darwin-v8-system-instrumentation.patch
     ./bypass-darwin-xcrun-node16.patch
+    ./revert-arm64-pointer-auth.patch
   ];
 }

From 35d43b45f7419c6db6f6aa49e9da376befd31606 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Tue, 7 Mar 2023 04:20:00 +0000
Subject: [PATCH 045/154] ruby.rubygems: 3.4.7 -> 3.4.8

---
 pkgs/development/interpreters/ruby/rubygems/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index 18850b45b32d..2ff5b6985747 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.4.7";
+  version = "3.4.8";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    sha256 = "sha256-h2nEu+e6uEcYu6gSFzzCIvSuCE5Vm5sZEzuT7BiMCyM=";
+    sha256 = "sha256-0FlDZJNJJGVkvBmKWNBqNRaTto6ciCOuQEK6uq6dotQ=";
   };
 
   patches = [
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Package management framework for Ruby";
+    changelog = "https://github.com/rubygems/rubygems/blob/v${version}/CHANGELOG.md";
     homepage = "https://rubygems.org/";
     license = with licenses; [ mit /* or */ ruby ];
     maintainers = with maintainers; [ zimbatm ];

From 7590ada96f561c77b9c5b9e564ab684b9eb34d97 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Tue, 7 Mar 2023 04:20:00 +0000
Subject: [PATCH 046/154] liburcu: add changelog to meta

---
 pkgs/development/libraries/liburcu/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/libraries/liburcu/default.nix b/pkgs/development/libraries/liburcu/default.nix
index a7204b913175..22e2c2a248a9 100644
--- a/pkgs/development/libraries/liburcu/default.nix
+++ b/pkgs/development/libraries/liburcu/default.nix
@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Userspace RCU (read-copy-update) library";
     homepage = "https://lttng.org/urcu";
+    changelog = "https://github.com/urcu/userspace-rcu/raw/v${version}/ChangeLog";
     license = licenses.lgpl21Plus;
     platforms = platforms.unix;
     maintainers = [ maintainers.bjornfor ];

From 49000d52e01fd1caf6490f8148bd270c3563a4f9 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 7 Mar 2023 07:34:51 +0000
Subject: [PATCH 047/154] vpnc: disable install parallelism

Without the change parallel installs fail as:

    install flags: -j1
    ...
    install -m644 src/doc/*.md ...-vpnc-unstable-2021-11-04/share/doc/vpnc
    install: target '...-vpnc-unstable-2021-11-04/share/doc/vpnc': No such file or directory
---
 pkgs/tools/networking/vpnc/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/tools/networking/vpnc/default.nix b/pkgs/tools/networking/vpnc/default.nix
index 4fbb26eba21d..f9507cf459c7 100644
--- a/pkgs/tools/networking/vpnc/default.nix
+++ b/pkgs/tools/networking/vpnc/default.nix
@@ -32,6 +32,10 @@ stdenv.mkDerivation {
   '';
 
   enableParallelBuilding = true;
+  # Missing install depends:
+  #   install: target '...-vpnc-unstable-2021-11-04/share/doc/vpnc': No such file or directory
+  #   make: *** [Makefile:149: install-doc] Error 1
+  enableParallelInstalling = false;
 
   meta = with lib; {
     homepage = "https://davidepucci.it/doc/vpnc/";

From af189bd3de5da15b5fc0baf23c84aacd7192a848 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Sun, 26 Feb 2023 09:21:48 -0800
Subject: [PATCH 048/154] spandsp: fix cross compilation

This commit adds `autoreconfHook` and cherry-picks a patch submitted
upstream in order to fix cross compilation.

- https://github.com/freeswitch/spandsp/pull/47
---
 pkgs/development/libraries/spandsp/3.nix       | 17 ++++++++++++++++-
 pkgs/development/libraries/spandsp/default.nix | 14 +++++++++++++-
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/spandsp/3.nix b/pkgs/development/libraries/spandsp/3.nix
index ceb53e05744e..92af122386fb 100644
--- a/pkgs/development/libraries/spandsp/3.nix
+++ b/pkgs/development/libraries/spandsp/3.nix
@@ -1,4 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, audiofile, libtiff, autoreconfHook }:
+{ lib, stdenv, fetchFromGitHub, audiofile, libtiff, autoreconfHook
+, fetchpatch
+, buildPackages }:
 stdenv.mkDerivation rec {
   version = "3.0.0";
   pname = "spandsp";
@@ -9,11 +11,24 @@ stdenv.mkDerivation rec {
     sha256 = "03w0s99y3zibi5fnvn8lk92dggfgrr0mz5255745jfbz28b2d5y7";
   };
 
+  patches = [
+    # submitted upstream: https://github.com/freeswitch/spandsp/pull/47
+    (fetchpatch {
+      url = "https://github.com/freeswitch/spandsp/commit/1f810894804d3fa61ab3fc2f3feb0599145a3436.patch";
+      hash = "sha256-Cf8aaoriAvchh5cMb75yP2gsZbZaOLha/j5mq3xlkVA=";
+    })
+  ];
+
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ autoreconfHook ];
   propagatedBuildInputs = [ audiofile libtiff ];
 
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "CC_FOR_BUILD=${buildPackages.stdenv.cc}/bin/cc"
+  ];
+
   meta = {
     description = "A portable and modular SIP User-Agent with audio and video support";
     homepage = "https://github.com/freeswitch/spandsp";
diff --git a/pkgs/development/libraries/spandsp/default.nix b/pkgs/development/libraries/spandsp/default.nix
index 2c96e60c6d37..c4ba98275aaa 100644
--- a/pkgs/development/libraries/spandsp/default.nix
+++ b/pkgs/development/libraries/spandsp/default.nix
@@ -1,7 +1,18 @@
-{ lib, stdenv, fetchurl, audiofile, libtiff, buildPackages }:
+{ lib, stdenv, fetchurl, audiofile, libtiff, buildPackages
+, fetchpatch
+, autoreconfHook }:
 stdenv.mkDerivation rec {
   version = "0.0.6";
   pname = "spandsp";
+
+  patches = [
+    # submitted upstream: https://github.com/freeswitch/spandsp/pull/47
+    (fetchpatch {
+      url = "https://github.com/freeswitch/spandsp/commit/1f810894804d3fa61ab3fc2f3feb0599145a3436.patch";
+      hash = "sha256-Cf8aaoriAvchh5cMb75yP2gsZbZaOLha/j5mq3xlkVA=";
+    })
+  ];
+
   src=fetchurl {
     url = "https://www.soft-switch.org/downloads/spandsp/spandsp-${version}.tar.gz";
     sha256 = "0rclrkyspzk575v8fslzjpgp4y2s4x7xk3r55ycvpi4agv33l1fc";
@@ -21,6 +32,7 @@ stdenv.mkDerivation rec {
   ];
 
   strictDeps = true;
+  nativeBuildInputs = [ autoreconfHook ];
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   propagatedBuildInputs = [audiofile libtiff];
   meta = {

From 6b0e09670d4b0edb7ac3d24503a2a9a5a081dc5a Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Sun, 26 Feb 2023 10:10:22 -0800
Subject: [PATCH 049/154] 
 https://github.com/NixOS/nixpkgs/pull/218477#discussion_r1118125573

---
 pkgs/development/libraries/spandsp/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/libraries/spandsp/default.nix b/pkgs/development/libraries/spandsp/default.nix
index c4ba98275aaa..b7fa9388e75c 100644
--- a/pkgs/development/libraries/spandsp/default.nix
+++ b/pkgs/development/libraries/spandsp/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv, fetchurl, audiofile, libtiff, buildPackages
 , fetchpatch
 , autoreconfHook }:
+
 stdenv.mkDerivation rec {
   version = "0.0.6";
   pname = "spandsp";

From 8a05f77b5d4d8422624828f9744daee1b9b213d4 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 7 Mar 2023 02:04:27 -0800
Subject: [PATCH 050/154] 
 https://github.com/NixOS/nixpkgs/pull/217995#pullrequestreview-1318620540

---
 pkgs/development/compilers/gcc/11/default.nix | 6 ++++--
 pkgs/development/compilers/gcc/12/default.nix | 6 ++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/compilers/gcc/11/default.nix b/pkgs/development/compilers/gcc/11/default.nix
index 2f6e986f3eb8..b2330abd4b75 100644
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@@ -250,8 +250,10 @@ stdenv.mkDerivation ({
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
 
   buildFlags =
-    lib.optionalString (profiledCompiler) "profiled" +
-    lib.optionalString (targetPlatform == hostPlatform && hostPlatform == buildPlatform && !disableBootstrap) "bootstrap";
+    let target =
+          lib.optionalString (profiledCompiler) "profiled" +
+          lib.optionalString (targetPlatform == hostPlatform && hostPlatform == buildPlatform && !disableBootstrap) "bootstrap";
+    in lib.optional (target != "") target;
 
   inherit (callFile ../common/strip-attributes.nix { })
     stripDebugList
diff --git a/pkgs/development/compilers/gcc/12/default.nix b/pkgs/development/compilers/gcc/12/default.nix
index ea3c6b2b16b5..f83c8398cd0f 100644
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@@ -282,8 +282,10 @@ stdenv.mkDerivation ({
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
 
   buildFlags =
-    lib.optionalString (profiledCompiler) "profiled" +
-    lib.optionalString (targetPlatform == hostPlatform && hostPlatform == buildPlatform && !disableBootstrap) "bootstrap";
+    let target =
+          lib.optionalString (profiledCompiler) "profiled" +
+          lib.optionalString (targetPlatform == hostPlatform && hostPlatform == buildPlatform && !disableBootstrap) "bootstrap";
+    in lib.optional (target != "") target;
 
   inherit (callFile ../common/strip-attributes.nix { })
     stripDebugList

From 1e5a594e686f5154b706dfab68550f9f3bde675e Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Sun, 26 Feb 2023 09:26:49 -0800
Subject: [PATCH 051/154] spandsp: enableParallelBuilding = true

This commit sets `enableParallelBuilding = true` for spandsp.
---
 pkgs/development/libraries/spandsp/3.nix       | 2 ++
 pkgs/development/libraries/spandsp/default.nix | 1 +
 2 files changed, 3 insertions(+)

diff --git a/pkgs/development/libraries/spandsp/3.nix b/pkgs/development/libraries/spandsp/3.nix
index ceb53e05744e..4bb56ed9d548 100644
--- a/pkgs/development/libraries/spandsp/3.nix
+++ b/pkgs/development/libraries/spandsp/3.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
+  enableParallelBuilding = true;
+
   nativeBuildInputs = [ autoreconfHook ];
   propagatedBuildInputs = [ audiofile libtiff ];
 
diff --git a/pkgs/development/libraries/spandsp/default.nix b/pkgs/development/libraries/spandsp/default.nix
index 2c96e60c6d37..32b963f019d0 100644
--- a/pkgs/development/libraries/spandsp/default.nix
+++ b/pkgs/development/libraries/spandsp/default.nix
@@ -8,6 +8,7 @@ stdenv.mkDerivation rec {
   };
 
   outputs = [ "out" "dev" ];
+  enableParallelBuilding = true;
   makeFlags = [
     "CC=${stdenv.cc.targetPrefix}cc"
     "CC_FOR_BUILD=${buildPackages.stdenv.cc}/bin/cc"

From 0070f29a1327858c5ca976f341496b86597e5c2d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Mar 2023 17:12:51 +0000
Subject: [PATCH 052/154] dnsmasq: 2.88 -> 2.89

---
 pkgs/tools/networking/dnsmasq/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/dnsmasq/default.nix b/pkgs/tools/networking/dnsmasq/default.nix
index 766bb68e0f7b..f4398cdd0393 100644
--- a/pkgs/tools/networking/dnsmasq/default.nix
+++ b/pkgs/tools/networking/dnsmasq/default.nix
@@ -17,11 +17,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "dnsmasq";
-  version = "2.88";
+  version = "2.89";
 
   src = fetchurl {
     url = "https://www.thekelleys.org.uk/dnsmasq/${pname}-${version}.tar.xz";
-    sha256 = "sha256-I1RN7aEDQMBTvqbxWpP+1up/WqqFMWv8Zx/6bSL7wbM=";
+    sha256 = "sha256-Ar0jA0bPC51ZCfXhUd8WiycHEDeF62FrVmhYVa3rtgk=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''

From 38daa6bb44d8f9a3d1442c9f334ae5a38c6c86d8 Mon Sep 17 00:00:00 2001
From: OPNA2608 <christoph.neidahl@gmail.com>
Date: Tue, 7 Mar 2023 20:06:34 +0100
Subject: [PATCH 053/154] python3Packages.appnope: Make available on
 non-Darwin, styling, update homepage

---
 .../python-modules/appnope/default.nix        | 22 +++++++++++++------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/appnope/default.nix b/pkgs/development/python-modules/appnope/default.nix
index ea358f96e479..68ada3b4b4cd 100644
--- a/pkgs/development/python-modules/appnope/default.nix
+++ b/pkgs/development/python-modules/appnope/default.nix
@@ -1,21 +1,29 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "appnope";
   version = "0.1.3";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Ar2RxN6Gn7seHFCq/ECYgnp6VKsvOdncumyVR+2SDiQ=";
+  src = fetchFromGitHub {
+    owner = "minrk";
+    repo = "appnope";
+    rev = version;
+    hash = "sha256-JYzNOPD1ofOrtZK5TTKxbF1ausmczsltR7F1Vwss8Sw=";
   };
 
+  checkInputs = [
+    pytestCheckHook
+  ];
+
   meta = {
     description = "Disable App Nap on macOS";
-    homepage    = "https://pypi.python.org/pypi/appnope";
-    platforms   = lib.platforms.darwin;
-    license     = lib.licenses.bsd3;
+    homepage = "https://github.com/minrk/appnope";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ OPNA2608 ];
+    # Not Darwin-specific because dummy fallback may be used cross-platform
   };
 }

From 9eb7621cbb8d0ae7a140c9516f99c6cbdc844095 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Mar 2023 05:12:16 +0000
Subject: [PATCH 054/154] libmbim: 1.28.2 -> 1.28.4

---
 pkgs/development/libraries/libmbim/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libmbim/default.nix b/pkgs/development/libraries/libmbim/default.nix
index f9f15b683946..2a26b4dfad9f 100644
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libmbim";
-  version = "1.28.2";
+  version = "1.28.4";
 
   outputs = [ "out" "dev" "man" ];
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     owner = "mobile-broadband";
     repo = "libmbim";
     rev = version;
-    hash = "sha256-EtjUaSNBT1e/eeTX4oHzQolGrisbsGKBK8Cfl3rRQTQ=";
+    hash = "sha256-aaYjvJ2OMTzkUyqWCyHdmsKJ3VGqBmKQzb1DWK/1cPU=";
   };
 
   mesonFlags = [

From a8da8df295b9468f2ab34bf237b70ab49cd61e64 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Wed, 8 Mar 2023 05:13:00 +0000
Subject: [PATCH 055/154] libmbim: add changelog to meta

---
 pkgs/development/libraries/libmbim/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/libraries/libmbim/default.nix b/pkgs/development/libraries/libmbim/default.nix
index 2a26b4dfad9f..6ac8b8eccf80 100644
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@@ -57,6 +57,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.freedesktop.org/wiki/Software/libmbim/";
     description = "Library for talking to WWAN modems and devices which speak the Mobile Interface Broadband Model (MBIM) protocol";
+    changelog = "https://gitlab.freedesktop.org/mobile-broadband/libmbim/-/raw/${version}/NEWS";
     maintainers = teams.freedesktop.members;
     platforms = platforms.linux;
     license = licenses.gpl2Plus;

From fe201024e97fd7e5a852373e5a950883947217bc Mon Sep 17 00:00:00 2001
From: Garry Filakhtov <filakhtov@gmail.com>
Date: Sun, 19 Feb 2023 13:23:36 +1100
Subject: [PATCH 056/154] systemd: make libidn2 optional

Expose a new `withLibidn2` flag (defauts to true for backwards compatibility) to be able to conditionally enable and disable integration with `libidn2`, which is used by the `systemd-network` and `systemd-resolved` to support internationalized domain names.
---
 pkgs/os-specific/linux/systemd/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 9dda9cd2d4ae..209bb427b603 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -97,6 +97,7 @@
 , withLibBPF ? lib.versionAtLeast buildPackages.llvmPackages.clang.version "10.0"
     && stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6" # assumes hard floats
     && !stdenv.hostPlatform.isMips64   # see https://github.com/NixOS/nixpkgs/pull/194149#issuecomment-1266642211
+, withLibidn2 ? true
 , withLocaled ? true
 , withLogind ? true
 , withMachined ? true
@@ -278,7 +279,7 @@ stdenv.mkDerivation (finalAttrs: {
           # Systemd does this decision during configure time and uses ifdef's to
           # enable specific branches. We can safely ignore (nuke) the libidn "v1"
           # libraries.
-          { name = "libidn2.so.0"; pkg = libidn2; }
+          { name = "libidn2.so.0"; pkg = opt withLibidn2 libidn2; }
           { name = "libidn.so.12"; pkg = null; }
           { name = "libidn.so.11"; pkg = null; }
 
@@ -381,7 +382,6 @@ stdenv.mkDerivation (finalAttrs: {
       kmod
       libxcrypt
       libcap
-      libidn2
       libuuid
       linuxHeaders
       pam
@@ -397,6 +397,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional withCryptsetup (lib.getDev cryptsetup.dev)
     ++ lib.optional withEfi gnu-efi
     ++ lib.optional withKexectools kexec-tools
+    ++ lib.optional withLibidn2 libidn2
     ++ lib.optional withLibseccomp libseccomp
     ++ lib.optional withNetworkd iptables
     ++ lib.optional withPCRE2 pcre2
@@ -461,7 +462,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dsplit-usr=false"
     "-Dlibcurl=${lib.boolToString wantCurl}"
     "-Dlibidn=false"
-    "-Dlibidn2=true"
+    "-Dlibidn2=${lib.boolToString withLibidn2}"
     "-Dquotacheck=false"
     "-Dldconfig=false"
     "-Dsmack=true"

From d37221dd4b2b8497d3144b0313e9c1ca25df50bb Mon Sep 17 00:00:00 2001
From: Garry Filakhtov <filakhtov@gmail.com>
Date: Sun, 19 Feb 2023 15:11:25 +1100
Subject: [PATCH 057/154] systemd: make libacl optional

Expose a new `withAcl` flag (defaults to true for backwards compatibility) to be able to conditionally enable and disable an integration with `libacl` library, which is used by variety of systemd tools and daemon, e.g. `journald` will check ACLs in addition to regular permissions when accessing journal files and `systemd-nspawn` will update ACL entries when used with the `--private-users-chown` flag.
---
 pkgs/os-specific/linux/systemd/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 209bb427b603..a3d64b5562e4 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -82,6 +82,7 @@
 , bpftools
 , libbpf
 
+, withAcl ? true
 , withAnalyze ? true
 , withApparmor ? true
 , withCompression ? true  # adds bzip2, lz4, xz and zstd
@@ -377,7 +378,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs =
     [
-      acl
       audit
       kmod
       libxcrypt
@@ -390,6 +390,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     ++ lib.optionals wantGcrypt [ libgcrypt libgpg-error ]
     ++ lib.optional withTests glib
+    ++ lib.optional withAcl acl
     ++ lib.optional withApparmor libapparmor
     ++ lib.optional wantCurl (lib.getDev curl)
     ++ lib.optionals withCompression [ bzip2 lz4 xz zstd ]
@@ -436,6 +437,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dglib=${lib.boolToString withTests}"
     # while we do not run tests we should also not build them. Removes about 600 targets
     "-Dtests=false"
+    "-Dacl=${lib.boolToString withAcl}"
     "-Danalyze=${lib.boolToString withAnalyze}"
     "-Dgcrypt=${lib.boolToString wantGcrypt}"
     "-Dimportd=${lib.boolToString withImportd}"

From 86aff5f32fe9cb44730d839c168af6c5b0b317ed Mon Sep 17 00:00:00 2001
From: Garry Filakhtov <filakhtov@gmail.com>
Date: Tue, 21 Feb 2023 18:17:24 +1100
Subject: [PATCH 058/154] systemd: make libaudit optional

Expose a new `withAudit` flag (defaults to `true` for backwards compatibility) to be able to conditionally enable and disable an integration with the `libaudit` library, which is used to integrate with Linux Audit Framework for logging various security-relevant events.
---
 pkgs/os-specific/linux/systemd/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index a3d64b5562e4..f8f2375a1506 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -85,6 +85,7 @@
 , withAcl ? true
 , withAnalyze ? true
 , withApparmor ? true
+, withAudit ? true
 , withCompression ? true  # adds bzip2, lz4, xz and zstd
 , withCoredump ? true
 , withCryptsetup ? true
@@ -378,7 +379,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs =
     [
-      audit
       kmod
       libxcrypt
       libcap
@@ -392,6 +392,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional withTests glib
     ++ lib.optional withAcl acl
     ++ lib.optional withApparmor libapparmor
+    ++ lib.optional withAudit audit
     ++ lib.optional wantCurl (lib.getDev curl)
     ++ lib.optionals withCompression [ bzip2 lz4 xz zstd ]
     ++ lib.optional withCoredump elfutils
@@ -439,6 +440,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dtests=false"
     "-Dacl=${lib.boolToString withAcl}"
     "-Danalyze=${lib.boolToString withAnalyze}"
+    "-Daudit=${lib.boolToString withAudit}"
     "-Dgcrypt=${lib.boolToString wantGcrypt}"
     "-Dimportd=${lib.boolToString withImportd}"
     "-Dlz4=${lib.boolToString withCompression}"

From 2d17a968053a968667457f06971577fe002385c0 Mon Sep 17 00:00:00 2001
From: Garry Filakhtov <filakhtov@gmail.com>
Date: Tue, 21 Feb 2023 18:30:26 +1100
Subject: [PATCH 059/154] systemd: make PAM integration optional

Expose a new `withPam` option to allow enabling and disabling
integration with PAM stack, including the `systemd-user-sessions` daemon
and the associated `.service` file, as well as `pam_systemd.so` PAM
module for integration with `systemd-logind` and user session
registration with the systemd cgroup hierarchy.
---
 pkgs/os-specific/linux/systemd/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index f8f2375a1506..9b119c10f5f2 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -106,6 +106,7 @@
 , withNetworkd ? true
 , withNss ? !stdenv.hostPlatform.isMusl
 , withOomd ? true
+, withPam ? true
 , withPCRE2 ? true
 , withPolkit ? true
 , withPortabled ? !stdenv.hostPlatform.isMusl
@@ -132,6 +133,7 @@
 assert withImportd -> withCompression;
 assert withCoredump -> withCompression;
 assert withHomed -> withCryptsetup;
+assert withHomed -> withPam;
 
 let
   wantCurl = withRemote || withImportd;
@@ -384,7 +386,6 @@ stdenv.mkDerivation (finalAttrs: {
       libcap
       libuuid
       linuxHeaders
-      pam
       bashInteractive # for patch shebangs
     ]
 
@@ -402,6 +403,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional withLibidn2 libidn2
     ++ lib.optional withLibseccomp libseccomp
     ++ lib.optional withNetworkd iptables
+    ++ lib.optional withPam pam
     ++ lib.optional withPCRE2 pcre2
     ++ lib.optional withSelinux libselinux
     ++ lib.optional withRemote libmicrohttpd
@@ -427,6 +429,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-Ddbuspolicydir=${placeholder "out"}/share/dbus-1/system.d"
     "-Ddbussessionservicedir=${placeholder "out"}/share/dbus-1/services"
     "-Ddbussystemservicedir=${placeholder "out"}/share/dbus-1/system-services"
+    "-Dpam=${lib.boolToString withPam}"
     "-Dpamconfdir=${placeholder "out"}/etc/pam.d"
     "-Drootprefix=${placeholder "out"}"
     "-Dpkgconfiglibdir=${placeholder "dev"}/lib/pkgconfig"

From 3be2b599651b3d7ed39ec52df25915a9b7a39218 Mon Sep 17 00:00:00 2001
From: Garry Filakhtov <filakhtov@gmail.com>
Date: Tue, 21 Feb 2023 18:48:27 +1100
Subject: [PATCH 060/154] systemd: optional kmod integration

Expose a new `withKmod` option to be able to enable and disable kmod
integration, including the `systemd-modules-load` tool for automatic
modules loading during the system boot sequence.
---
 pkgs/os-specific/linux/systemd/default.nix | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 9b119c10f5f2..073fd3af01f4 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -96,6 +96,7 @@
 , withHostnamed ? true
 , withHwdb ? true
 , withImportd ? !stdenv.hostPlatform.isMusl
+, withKmod ? true
 , withLibBPF ? lib.versionAtLeast buildPackages.llvmPackages.clang.version "10.0"
     && stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6" # assumes hard floats
     && !stdenv.hostPlatform.isMips64   # see https://github.com/NixOS/nixpkgs/pull/194149#issuecomment-1266642211
@@ -381,7 +382,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs =
     [
-      kmod
       libxcrypt
       libcap
       libuuid
@@ -400,6 +400,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional withCryptsetup (lib.getDev cryptsetup.dev)
     ++ lib.optional withEfi gnu-efi
     ++ lib.optional withKexectools kexec-tools
+    ++ lib.optional withKmod kmod
     ++ lib.optional withLibidn2 libidn2
     ++ lib.optional withLibseccomp libseccomp
     ++ lib.optional withNetworkd iptables
@@ -496,7 +497,6 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dsysvinit-path="
     "-Dsysvrcnd-path="
 
-    "-Dkmod-path=${kmod}/bin/kmod"
     "-Dsulogin-path=${util-linux}/bin/sulogin"
     "-Dmount-path=${util-linux}/bin/mount"
     "-Dumount-path=${util-linux}/bin/umount"
@@ -530,6 +530,9 @@ stdenv.mkDerivation (finalAttrs: {
   ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     "-Dgshadow=false"
     "-Didn=false"
+  ] ++ lib.optionals withKmod [
+    "-Dkmod=true"
+    "-Dkmod-path=${kmod}/bin/kmod"
   ];
   preConfigure =
     let
@@ -564,7 +567,6 @@ stdenv.mkDerivation (finalAttrs: {
           replacement = "${coreutils}/bin/cat";
           where = [ "test/create-busybox-container" "test/test-execute/exec-noexecpaths-simple.service" "src/journal/cat.c" ];
         }
-        { search = "/sbin/modprobe"; replacement = "${lib.getBin kmod}/sbin/modprobe"; where = [ "units/modprobe@.service" ]; }
         {
           search = "/usr/lib/systemd/systemd-fsck";
           replacement = "$out/lib/systemd/systemd-fsck";
@@ -598,6 +600,8 @@ stdenv.mkDerivation (finalAttrs: {
             "src/import/pull-tar.c"
           ];
         }
+      ] ++ lib.optionals withKmod [
+        { search = "/sbin/modprobe"; replacement = "${lib.getBin kmod}/sbin/modprobe"; where = [ "units/modprobe@.service" ]; }
       ];
 
       # { replacement, search, where } -> List[str]
@@ -669,7 +673,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   postInstall = ''
     mkdir -p $out/example/systemd
-    mv $out/lib/{modules-load.d,binfmt.d,sysctl.d,tmpfiles.d} $out/example
+    mv $out/lib/{binfmt.d,sysctl.d,tmpfiles.d} $out/example
     mv $out/lib/systemd/{system,user} $out/example/systemd
 
     rm -rf $out/etc/systemd/system
@@ -685,6 +689,8 @@ stdenv.mkDerivation (finalAttrs: {
     find $out -name "*kernel-install*" -exec rm {} \;
   '' + lib.optionalString (!withDocumentation) ''
     rm -rf $out/share/doc
+  '' + lib.optionalString withKmod ''
+    mv $out/lib/modules-load.d $out/example
   '';
 
   # Avoid *.EFI binary stripping. At least on aarch64-linux strip
@@ -719,7 +725,7 @@ stdenv.mkDerivation (finalAttrs: {
     # runtime; otherwise we can't and we need to reboot.
     interfaceVersion = 2;
 
-    inherit withCryptsetup withHostnamed withImportd withLocaled withMachined withPortabled withTimedated withUtmp util-linux kmod kbd;
+    inherit withCryptsetup withHostnamed withImportd withKmod withLocaled withMachined withPortabled withTimedated withUtmp util-linux kmod kbd;
 
     tests = {
       inherit (nixosTests) switchTest;

From 38bdc13b6dae2c99a83f389639fee44bf2d3e766 Mon Sep 17 00:00:00 2001
From: Garry Filakhtov <filakhtov@gmail.com>
Date: Tue, 21 Feb 2023 18:59:11 +1100
Subject: [PATCH 061/154] systemd: disable dependencies for minimal build

The `systemdMinimal` build is used purely for Udev and therefore does
not require all the extra dependencies that are needed for normal
operation. As more flags were exposed to allow disabling additional
opional dependencies the `systemdMinimal` will now take advantage of
those.
---
 pkgs/top-level/all-packages.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 99611ae1cfa5..5064548b20c5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -26880,8 +26880,10 @@ with pkgs;
   };
   systemdMinimal = systemd.override {
     pname = "systemd-minimal";
+    withAcl = false;
     withAnalyze = false;
     withApparmor = false;
+    withAudit = false;
     withCompression = false;
     withCoredump = false;
     withCryptsetup = false;
@@ -26892,7 +26894,9 @@ with pkgs;
     withHomed = false;
     withHwdb = false;
     withImportd = false;
+    withKmod = false;
     withLibBPF = false;
+    withLibidn2 = false;
     withLocaled = false;
     withLogind = false;
     withMachined = false;
@@ -26900,6 +26904,7 @@ with pkgs;
     withNss = false;
     withOomd = false;
     withPCRE2 = false;
+    withPam = false;
     withPolkit = false;
     withPortabled = false;
     withRemote = false;
@@ -26912,13 +26917,17 @@ with pkgs;
   };
   systemdStage1 = systemdMinimal.override {
     pname = "systemd-stage-1";
+    withAcl = true;
     withCryptsetup = true;
     withFido2 = true;
+    withKmod = true;
+    withPam = true;
     withTpm2Tss = true;
   };
   systemdStage1Network = systemdStage1.override {
     pname = "systemd-stage-1-network";
     withNetworkd = true;
+    withLibidn2 = true;
   };
 
 

From 2d29fbd4b6ec03b53d63dc126ce27f7e45e083bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Karel=20Ko=C4=8D=C3=AD?= <cynerd@email.cz>
Date: Mon, 6 Mar 2023 14:31:18 +0100
Subject: [PATCH 062/154] sphinx-rtd-theme: fix missing docutils for cross
 compilation

The tests are disabled when cross compiling. The effect of adding
pythonRelaxDepsHook to check inputs is that it is skipped when cross
compiling or when checks are disabled.
---
 pkgs/development/python-modules/sphinx-rtd-theme/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/sphinx-rtd-theme/default.nix b/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
index 3ec142f14035..613f19981216 100644
--- a/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
+++ b/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
@@ -31,9 +31,12 @@ buildPythonPackage rec {
     sphinxcontrib-jquery
   ];
 
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
-    pythonRelaxDepsHook
     readthedocs-sphinx-ext
   ];
 

From dbdebe125f049c0baf844e09fb57497ddf3d7084 Mon Sep 17 00:00:00 2001
From: Potato Hatsue <1793913507@qq.com>
Date: Tue, 7 Mar 2023 00:19:47 -0500
Subject: [PATCH 063/154] pandoc: remove reference to warp

---
 pkgs/development/tools/pandoc/default.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/tools/pandoc/default.nix b/pkgs/development/tools/pandoc/default.nix
index c64e47686cf5..31396f800a1e 100644
--- a/pkgs/development/tools/pandoc/default.nix
+++ b/pkgs/development/tools/pandoc/default.nix
@@ -9,10 +9,20 @@ in
     buildDepends = drv.buildDepends or [] ++ [haskellPackages.file-embed];
     buildTools = (drv.buildTools or []) ++ [ removeReferencesTo ];
 
+    # Normally, the static linked executable shouldn't refer to any library or the compiler.
+    # This is not always the case when the dependency has Paths_* module generated by Cabal,
+    # where bindir, datadir, and libdir contain the path to the library, and thus make the
+    # executable indirectly refer to GHC. However, most Haskell programs only use Paths_*.version for
+    # getting the version at runtime, so it's safe to remove the references to them.
+    # This is true so far for pandoc-types and warp.
+    # For details see: https://github.com/NixOS/nixpkgs/issues/34376
     postInstall = drv.postInstall or "" + ''
       remove-references-to \
         -t ${haskellPackages.pandoc-types} \
         $out/bin/pandoc
+      remove-references-to \
+        -t ${haskellPackages.warp} \
+        $out/bin/pandoc
     '' + lib.optionalString (stdenv.buildPlatform == stdenv.hostPlatform) ''
       mkdir -p $out/share/bash-completion/completions
       $out/bin/pandoc --bash-completion > $out/share/bash-completion/completions/pandoc
@@ -25,5 +35,5 @@ in
     # lead to a transitive runtime dependency on the whole GHC distribution.
     # This should ideally be fixed in haskellPackages (or even Cabal),
     # but a minimal pandoc is important enough to patch it manually.
-    disallowedReferences = [ haskellPackages.pandoc-types ];
+    disallowedReferences = [ haskellPackages.pandoc-types haskellPackages.warp ];
   })

From 98ebcd28e1235ddb4ee127a8e96310e554afdc13 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Tue, 6 Dec 2022 15:22:40 -0500
Subject: [PATCH 064/154] compiler-rt: fix build on ARMv6

compiler-rt has accumulated several regressions that prevent it from building
on ARMv6. It is important to note that there are two major versions of ARMv6:
base ARMv6 and ARMv6K. ARMv6K includes several important new instructions,
such as non-word size atomic operations (ldrexd, strexd, etc.) and the yield
instruction. Most ARMv6 CPUs actually implement ARMv6K, including all those used
in Raspberry Pis, but nixpkgs' "raspberryPi" platform targets base ARMv6.

compiler-rt versions 8-14 fail to build on ARMv6 and ARMv6K. compiler-rt 15 (not
yet in nixpkgs) builds on ARMv6K but not ARMv6. This patch fixes versions 9-14
on both ARMv6 variants. The patches don't apply cleanly to version 8, and I
figured it wasn't worth carrying another version of the patches for such an old
version.

A total of five patches are required to get compiler-rt building on ARMv6:
* armv6-mcr-dmb.patch: use `mcr` to provide the equivalent of `dmb` on ARMv6.
  Included in LLVM 15.
* armv6-sync-ops-no-thumb.patch: prevent certain atomic operation functions
  from using Thumb mode. Included in LLVM 15.
* armv6-no-ldrexd-strexd.patch: don't use ldrexd or strexd, which are not
  available in base ARMv6. Submitted upstream by me.
* armv6-scudo-no-yield.patch: use nop instead of yield on ARMv6 in standalone
  scudo. Required by versions >=13, since they enable standalone scudo.
  Submitted upstream by me.
* armv6-scudo-libatomic.patch: link standlone scudo to libatomic on ARMv6 (and
  any other platforms that need it). Not yet submitted because the backport is
  a bit different from the upstream version and I need to test it.
---
 .../compilers/llvm/10/compiler-rt/default.nix |   4 +
 .../compilers/llvm/11/compiler-rt/default.nix |   4 +
 .../compilers/llvm/12/compiler-rt/default.nix |   4 +
 .../compilers/llvm/13/compiler-rt/default.nix |   6 +
 .../compilers/llvm/14/compiler-rt/default.nix |   6 +
 .../compilers/llvm/9/compiler-rt/default.nix  |   4 +
 .../common/compiler-rt/armv6-mcr-dmb.patch    |  75 ++++++++
 .../compiler-rt/armv6-no-ldrexd-strexd.patch  | 162 ++++++++++++++++++
 .../compiler-rt/armv6-scudo-libatomic.patch   |  65 +++++++
 .../compiler-rt/armv6-scudo-no-yield.patch    |  34 ++++
 .../compiler-rt/armv6-sync-ops-no-thumb.patch |  52 ++++++
 pkgs/top-level/all-packages.nix               |   1 -
 12 files changed, 416 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/compilers/llvm/common/compiler-rt/armv6-mcr-dmb.patch
 create mode 100644 pkgs/development/compilers/llvm/common/compiler-rt/armv6-no-ldrexd-strexd.patch
 create mode 100644 pkgs/development/compilers/llvm/common/compiler-rt/armv6-scudo-libatomic.patch
 create mode 100644 pkgs/development/compilers/llvm/common/compiler-rt/armv6-scudo-no-yield.patch
 create mode 100644 pkgs/development/compilers/llvm/common/compiler-rt/armv6-sync-ops-no-thumb.patch

diff --git a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
index f113e55f2849..9af786c96049 100644
--- a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
@@ -61,6 +61,10 @@ stdenv.mkDerivation {
     ./gnu-install-dirs.patch
     ../../common/compiler-rt/libsanitizer-no-cyclades-11.patch
     ./X86-support-extension.patch # backported from LLVM 11
+    # Fix build on armv6l
+    ../../common/compiler-rt/armv6-mcr-dmb.patch
+    ../../common/compiler-rt/armv6-sync-ops-no-thumb.patch
+    ../../common/compiler-rt/armv6-no-ldrexd-strexd.patch
   ] ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
index 979ec9e23f65..61ee5fefd264 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
@@ -66,6 +66,10 @@ stdenv.mkDerivation {
     ../../common/compiler-rt/libsanitizer-no-cyclades-11.patch
     ../../common/compiler-rt/darwin-plistbuddy-workaround.patch
     ./armv7l.patch
+    # Fix build on armv6l
+    ../../common/compiler-rt/armv6-mcr-dmb.patch
+    ../../common/compiler-rt/armv6-sync-ops-no-thumb.patch
+    ../../common/compiler-rt/armv6-no-ldrexd-strexd.patch
   ];
 
   preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
index 22e2ab9d5b2b..8a9f878bc3ab 100644
--- a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
@@ -66,6 +66,10 @@ stdenv.mkDerivation {
     ./normalize-var.patch
     ../../common/compiler-rt/darwin-plistbuddy-workaround.patch
     ./armv7l.patch
+    # Fix build on armv6l
+    ../../common/compiler-rt/armv6-mcr-dmb.patch
+    ../../common/compiler-rt/armv6-sync-ops-no-thumb.patch
+    ../../common/compiler-rt/armv6-no-ldrexd-strexd.patch
   ];
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
diff --git a/pkgs/development/compilers/llvm/13/compiler-rt/default.nix b/pkgs/development/compilers/llvm/13/compiler-rt/default.nix
index 02ddabad6769..feae499b843d 100644
--- a/pkgs/development/compilers/llvm/13/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/13/compiler-rt/default.nix
@@ -71,6 +71,12 @@ stdenv.mkDerivation {
     ./darwin-targetconditionals.patch
     ../../common/compiler-rt/darwin-plistbuddy-workaround.patch
     ./armv7l.patch
+    # Fix build on armv6l
+    ../../common/compiler-rt/armv6-mcr-dmb.patch
+    ../../common/compiler-rt/armv6-sync-ops-no-thumb.patch
+    ../../common/compiler-rt/armv6-no-ldrexd-strexd.patch
+    ../../common/compiler-rt/armv6-scudo-no-yield.patch
+    ../../common/compiler-rt/armv6-scudo-libatomic.patch
   ];
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
diff --git a/pkgs/development/compilers/llvm/14/compiler-rt/default.nix b/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
index aff2722074ee..021eba5a7b63 100644
--- a/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
@@ -81,6 +81,12 @@ stdenv.mkDerivation {
     ./darwin-targetconditionals.patch
     ../../common/compiler-rt/darwin-plistbuddy-workaround.patch
     ./armv7l.patch
+    # Fix build on armv6l
+    ../../common/compiler-rt/armv6-mcr-dmb.patch
+    ../../common/compiler-rt/armv6-sync-ops-no-thumb.patch
+    ../../common/compiler-rt/armv6-no-ldrexd-strexd.patch
+    ../../common/compiler-rt/armv6-scudo-no-yield.patch
+    ../../common/compiler-rt/armv6-scudo-libatomic.patch
   ];
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
diff --git a/pkgs/development/compilers/llvm/9/compiler-rt/default.nix b/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
index be7380470ce9..7e24ab399a81 100644
--- a/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
@@ -60,6 +60,10 @@ stdenv.mkDerivation {
     ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./gnu-install-dirs.patch
     ../../common/compiler-rt/libsanitizer-no-cyclades-9.patch
+    # Fix build on armv6l
+    ../../common/compiler-rt/armv6-mcr-dmb.patch
+    ../../common/compiler-rt/armv6-sync-ops-no-thumb.patch
+    ../../common/compiler-rt/armv6-no-ldrexd-strexd.patch
   ] ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
diff --git a/pkgs/development/compilers/llvm/common/compiler-rt/armv6-mcr-dmb.patch b/pkgs/development/compilers/llvm/common/compiler-rt/armv6-mcr-dmb.patch
new file mode 100644
index 000000000000..acdcc9e983b8
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common/compiler-rt/armv6-mcr-dmb.patch
@@ -0,0 +1,75 @@
+From a11d1cc41c725ec6dee58f75e4a852a658dd7543 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Thu, 10 Mar 2022 19:30:00 -0800
+Subject: [PATCH] [builtins] Use mcr for dmb instruction on armv6
+
+At present compiler-rt cross compiles for armv6 ( -march=armv6 ) but includes
+dmb instructions which are only available in armv7+ this causes SIGILL on
+clang+compiler-rt compiled components on rpi0w platforms.
+
+Reviewed By: MaskRay
+
+Differential Revision: https://reviews.llvm.org/D99282
+---
+ compiler-rt/lib/builtins/arm/sync-ops.h | 8 ++++----
+ compiler-rt/lib/builtins/assembly.h     | 8 ++++++++
+ 2 files changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/lib/builtins/arm/sync-ops.h b/lib/builtins/arm/sync-ops.h
+index c9623249e5d20..7a26170741ad2 100644
+--- a/lib/builtins/arm/sync-ops.h
++++ b/lib/builtins/arm/sync-ops.h
+@@ -19,14 +19,14 @@
+   .thumb;                                                                      \
+   .syntax unified;                                                             \
+   DEFINE_COMPILERRT_THUMB_FUNCTION(__sync_fetch_and_##op)                      \
+-  dmb;                                                                         \
++  DMB;                                                                         \
+   mov r12, r0;                                                                 \
+   LOCAL_LABEL(tryatomic_##op) : ldrex r0, [r12];                               \
+   op(r2, r0, r1);                                                              \
+   strex r3, r2, [r12];                                                         \
+   cmp r3, #0;                                                                  \
+   bne LOCAL_LABEL(tryatomic_##op);                                             \
+-  dmb;                                                                         \
++  DMB;                                                                         \
+   bx lr
+ 
+ #define SYNC_OP_8(op)                                                          \
+@@ -35,14 +35,14 @@
+   .syntax unified;                                                             \
+   DEFINE_COMPILERRT_THUMB_FUNCTION(__sync_fetch_and_##op)                      \
+   push {r4, r5, r6, lr};                                                       \
+-  dmb;                                                                         \
++  DMB;                                                                         \
+   mov r12, r0;                                                                 \
+   LOCAL_LABEL(tryatomic_##op) : ldrexd r0, r1, [r12];                          \
+   op(r4, r5, r0, r1, r2, r3);                                                  \
+   strexd r6, r4, r5, [r12];                                                    \
+   cmp r6, #0;                                                                  \
+   bne LOCAL_LABEL(tryatomic_##op);                                             \
+-  dmb;                                                                         \
++  DMB;                                                                         \
+   pop { r4, r5, r6, pc }
+ 
+ #define MINMAX_4(rD, rN, rM, cmp_kind)                                         \
+diff --git a/lib/builtins/assembly.h b/lib/builtins/assembly.h
+index 69a3d8620f924..06aa18162e3b4 100644
+--- a/lib/builtins/assembly.h
++++ b/lib/builtins/assembly.h
+@@ -189,6 +189,14 @@
+   JMP(ip)
+ #endif
+ 
++#if __ARM_ARCH >= 7
++#define DMB dmb
++#elif __ARM_ARCH >= 6
++#define DMB mcr p15, #0, r0, c7, c10, #5
++#else
++#error only supported on ARMv6+
++#endif
++
+ #if defined(USE_THUMB_2)
+ #define WIDE(op) op.w
+ #else
+
diff --git a/pkgs/development/compilers/llvm/common/compiler-rt/armv6-no-ldrexd-strexd.patch b/pkgs/development/compilers/llvm/common/compiler-rt/armv6-no-ldrexd-strexd.patch
new file mode 100644
index 000000000000..2537ae1fae12
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common/compiler-rt/armv6-no-ldrexd-strexd.patch
@@ -0,0 +1,162 @@
+From 4fe3f21bf8b20c766877d2251d61118d0ff36688 Mon Sep 17 00:00:00 2001
+From: Ben Wolsieffer <benwolsieffer@gmail.com>
+Date: Wed, 7 Dec 2022 14:56:51 -0500
+Subject: [PATCH] [compiler-rt][builtins] Do not use ldrexd or strexd on ARMv6
+
+The ldrexd and strexd instructions are not available on base ARMv6, and were
+only added in ARMv6K (see [1]). This patch solves this problem once and for all
+using the __ARM_FEATURE_LDREX macro (see [2]) defined in the ARM C Language
+Extensions (ACLE). Although this macro is technically deprecated in the ACLE,
+it allows compiler-rt to reliably detect whether ldrexd and strexd are supported
+without complicated conditionals to detect different ARM architecture variants.
+
+[1] https://developer.arm.com/documentation/dht0008/a/ch01s02s01
+[2] https://arm-software.github.io/acle/main/acle.html#ldrexstrex
+
+Differential Revision: https://reviews.llvm.org/D139585
+---
+ compiler-rt/lib/builtins/arm/sync_fetch_and_add_8.S  | 2 +-
+ compiler-rt/lib/builtins/arm/sync_fetch_and_and_8.S  | 2 +-
+ compiler-rt/lib/builtins/arm/sync_fetch_and_max_8.S  | 2 +-
+ compiler-rt/lib/builtins/arm/sync_fetch_and_min_8.S  | 2 +-
+ compiler-rt/lib/builtins/arm/sync_fetch_and_nand_8.S | 2 +-
+ compiler-rt/lib/builtins/arm/sync_fetch_and_or_8.S   | 2 +-
+ compiler-rt/lib/builtins/arm/sync_fetch_and_sub_8.S  | 2 +-
+ compiler-rt/lib/builtins/arm/sync_fetch_and_umax_8.S | 2 +-
+ compiler-rt/lib/builtins/arm/sync_fetch_and_umin_8.S | 2 +-
+ compiler-rt/lib/builtins/arm/sync_fetch_and_xor_8.S  | 2 +-
+ 10 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/lib/builtins/arm/sync_fetch_and_add_8.S b/lib/builtins/arm/sync_fetch_and_add_8.S
+index 18bdd875b8b7..bee6f7ba0f34 100644
+--- a/lib/builtins/arm/sync_fetch_and_add_8.S
++++ b/lib/builtins/arm/sync_fetch_and_add_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define add_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI) \
+     adds rD_LO, rN_LO, rM_LO ; \
+     adc rD_HI, rN_HI, rM_HI
+diff --git a/lib/builtins/arm/sync_fetch_and_and_8.S b/lib/builtins/arm/sync_fetch_and_and_8.S
+index 3716eff809d5..b4e77a54edf6 100644
+--- a/lib/builtins/arm/sync_fetch_and_and_8.S
++++ b/lib/builtins/arm/sync_fetch_and_and_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define and_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI) \
+     and rD_LO, rN_LO, rM_LO ; \
+     and rD_HI, rN_HI, rM_HI
+diff --git a/lib/builtins/arm/sync_fetch_and_max_8.S b/lib/builtins/arm/sync_fetch_and_max_8.S
+index 06115ab55246..1813274cc649 100644
+--- a/lib/builtins/arm/sync_fetch_and_max_8.S
++++ b/lib/builtins/arm/sync_fetch_and_max_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define max_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI)         MINMAX_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI, gt)
+ 
+ SYNC_OP_8(max_8)
+diff --git a/lib/builtins/arm/sync_fetch_and_min_8.S b/lib/builtins/arm/sync_fetch_and_min_8.S
+index 4f3e299d95cc..fa8f3477757b 100644
+--- a/lib/builtins/arm/sync_fetch_and_min_8.S
++++ b/lib/builtins/arm/sync_fetch_and_min_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define min_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI)         MINMAX_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI, lt)
+ 
+ SYNC_OP_8(min_8)
+diff --git a/lib/builtins/arm/sync_fetch_and_nand_8.S b/lib/builtins/arm/sync_fetch_and_nand_8.S
+index 425c94474af7..fb27219ee200 100644
+--- a/lib/builtins/arm/sync_fetch_and_nand_8.S
++++ b/lib/builtins/arm/sync_fetch_and_nand_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define nand_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI) \
+     bic rD_LO, rN_LO, rM_LO ; \
+     bic rD_HI, rN_HI, rM_HI
+diff --git a/lib/builtins/arm/sync_fetch_and_or_8.S b/lib/builtins/arm/sync_fetch_and_or_8.S
+index 4f18dcf84df9..3b077c8737b1 100644
+--- a/lib/builtins/arm/sync_fetch_and_or_8.S
++++ b/lib/builtins/arm/sync_fetch_and_or_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define or_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI) \
+     orr rD_LO, rN_LO, rM_LO ; \
+     orr rD_HI, rN_HI, rM_HI
+diff --git a/lib/builtins/arm/sync_fetch_and_sub_8.S b/lib/builtins/arm/sync_fetch_and_sub_8.S
+index 25a4a1076555..c171607eabd8 100644
+--- a/lib/builtins/arm/sync_fetch_and_sub_8.S
++++ b/lib/builtins/arm/sync_fetch_and_sub_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define sub_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI) \
+     subs rD_LO, rN_LO, rM_LO ; \
+     sbc rD_HI, rN_HI, rM_HI
+diff --git a/lib/builtins/arm/sync_fetch_and_umax_8.S b/lib/builtins/arm/sync_fetch_and_umax_8.S
+index aa5213ff1def..d1224f758049 100644
+--- a/lib/builtins/arm/sync_fetch_and_umax_8.S
++++ b/lib/builtins/arm/sync_fetch_and_umax_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define umax_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI)         MINMAX_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI, hi)
+ 
+ SYNC_OP_8(umax_8)
+diff --git a/lib/builtins/arm/sync_fetch_and_umin_8.S b/lib/builtins/arm/sync_fetch_and_umin_8.S
+index 8b40541ab47d..595444e6d053 100644
+--- a/lib/builtins/arm/sync_fetch_and_umin_8.S
++++ b/lib/builtins/arm/sync_fetch_and_umin_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define umin_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI)         MINMAX_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI, lo)
+ 
+ SYNC_OP_8(umin_8)
+diff --git a/lib/builtins/arm/sync_fetch_and_xor_8.S b/lib/builtins/arm/sync_fetch_and_xor_8.S
+index 7436eb1d4cae..9fc3d85cef75 100644
+--- a/lib/builtins/arm/sync_fetch_and_xor_8.S
++++ b/lib/builtins/arm/sync_fetch_and_xor_8.S
+@@ -13,7 +13,7 @@
+ 
+ #include "sync-ops.h"
+ 
+-#if __ARM_ARCH_PROFILE != 'M'
++#if __ARM_FEATURE_LDREX & 8
+ #define xor_8(rD_LO, rD_HI, rN_LO, rN_HI, rM_LO, rM_HI) \
+     eor rD_LO, rN_LO, rM_LO ; \
+     eor rD_HI, rN_HI, rM_HI
+-- 
+2.38.1
+
diff --git a/pkgs/development/compilers/llvm/common/compiler-rt/armv6-scudo-libatomic.patch b/pkgs/development/compilers/llvm/common/compiler-rt/armv6-scudo-libatomic.patch
new file mode 100644
index 000000000000..13b67eb2a41c
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common/compiler-rt/armv6-scudo-libatomic.patch
@@ -0,0 +1,65 @@
+From a56bb19a9dc303a50ef12d83cd24c2395bf81076 Mon Sep 17 00:00:00 2001
+From: Ben Wolsieffer <benwolsieffer@gmail.com>
+Date: Wed, 7 Dec 2022 21:25:46 -0500
+Subject: [PATCH] [scudo][standalone] Use CheckAtomic to decide to link to
+ libatomic
+
+Standalone scudo uses the atomic operation builtin functions, which require
+linking to libatomic on some platforms. Currently, this is done in an ad-hoc
+manner. MIPS platforms always link to libatomic, and the tests are always linked
+to it as well. libatomic is required on base ARMv6 (but not ARMv6K), but it is
+currently not linked, causing the build to fail.
+
+This patch replaces this ad-hoc logic with the CheckAtomic CMake module already
+used in other parts of LLVM. The CheckAtomic module checks whether std::atomic
+requires libatomic, which is not strictly the same as checking the atomic
+builtins, but should have the same results as far as I know. If this is
+problematic, a custom version of CheckAtomic could be used to specifically test
+the builtins.
+---
+ compiler-rt/lib/scudo/standalone/CMakeLists.txt       | 7 +++++++
+ compiler-rt/lib/scudo/standalone/tests/CMakeLists.txt | 4 +---
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/lib/scudo/standalone/CMakeLists.txt b/lib/scudo/standalone/CMakeLists.txt
+index ae5c354768c8..eb27374ca520 100644
+--- a/lib/scudo/standalone/CMakeLists.txt
++++ b/lib/scudo/standalone/CMakeLists.txt
+@@ -1,5 +1,8 @@
+ add_compiler_rt_component(scudo_standalone)
+ 
++include(DetermineGCCCompatible)
++include(CheckAtomic)
++
+ include_directories(../.. include)
+ 
+ set(SCUDO_CFLAGS)
+@@ -34,6 +37,10 @@ list(APPEND SCUDO_LINK_FLAGS -Wl,-z,defs,-z,now,-z,relro)
+ 
+ list(APPEND SCUDO_LINK_FLAGS -ffunction-sections -fdata-sections -Wl,--gc-sections)
+ 
++if(HAVE_CXX_ATOMICS_WITH_LIB OR HAVE_CXX_ATOMICS64_WITH_LIB)
++  list(APPEND SCUDO_LINK_FLAGS -latomic)
++endif()
++
+ # We don't use the C++ standard library, so avoid including it by mistake.
+ append_list_if(COMPILER_RT_HAS_NOSTDLIBXX_FLAG -nostdlib++ SCUDO_LINK_FLAGS)
+ 
+diff --git a/lib/scudo/standalone/tests/CMakeLists.txt b/lib/scudo/standalone/tests/CMakeLists.txt
+index 6d0936cbb5c1..70a5a7e959c1 100644
+--- a/lib/scudo/standalone/tests/CMakeLists.txt
++++ b/lib/scudo/standalone/tests/CMakeLists.txt
+@@ -38,9 +38,7 @@ set(LINK_FLAGS
+   ${SANITIZER_TEST_CXX_LIBRARIES}
+   )
+ list(APPEND LINK_FLAGS -pthread)
+-# Linking against libatomic is required with some compilers
+-check_library_exists(atomic __atomic_load_8 "" COMPILER_RT_HAS_LIBATOMIC)
+-if (COMPILER_RT_HAS_LIBATOMIC)
++if(HAVE_CXX_ATOMICS_WITH_LIB OR HAVE_CXX_ATOMICS64_WITH_LIB)
+   list(APPEND LINK_FLAGS -latomic)
+ endif()
+ 
+-- 
+2.38.1
+
diff --git a/pkgs/development/compilers/llvm/common/compiler-rt/armv6-scudo-no-yield.patch b/pkgs/development/compilers/llvm/common/compiler-rt/armv6-scudo-no-yield.patch
new file mode 100644
index 000000000000..2fd48eda6518
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common/compiler-rt/armv6-scudo-no-yield.patch
@@ -0,0 +1,34 @@
+From ff0b373b959165477f45d9f5f9a8da471ae111ab Mon Sep 17 00:00:00 2001
+From: Ben Wolsieffer <benwolsieffer@gmail.com>
+Date: Wed, 7 Dec 2022 18:03:56 -0500
+Subject: [PATCH] [scudo][standalone] Only use yield on ARMv6K and newer
+
+The yield instruction is only available in ARMv6K and newer. It behaves as a
+nop on single threaded platforms anyway, so use nop instead on unsupported
+architectures.
+
+Differential Revision: https://reviews.llvm.org/D139600
+---
+ compiler-rt/lib/scudo/standalone/common.h | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/lib/scudo/standalone/common.h b/lib/scudo/standalone/common.h
+index bc3dfec6dbba..862cda1d4bc4 100644
+--- a/lib/scudo/standalone/common.h
++++ b/lib/scudo/standalone/common.h
+@@ -109,7 +109,12 @@ inline void yieldProcessor(u8 Count) {
+ #elif defined(__aarch64__) || defined(__arm__)
+   __asm__ __volatile__("" ::: "memory");
+   for (u8 I = 0; I < Count; I++)
++#if __ARM_ARCH >= 6 && !defined(__ARM_ARCH_6__)
++    // yield is supported on ARMv6K and newer
+     __asm__ __volatile__("yield");
++#else
++    __asm__ __volatile__("nop");
++#endif
+ #endif
+   __asm__ __volatile__("" ::: "memory");
+ }
+-- 
+2.38.1
+
diff --git a/pkgs/development/compilers/llvm/common/compiler-rt/armv6-sync-ops-no-thumb.patch b/pkgs/development/compilers/llvm/common/compiler-rt/armv6-sync-ops-no-thumb.patch
new file mode 100644
index 000000000000..098a155d448c
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common/compiler-rt/armv6-sync-ops-no-thumb.patch
@@ -0,0 +1,52 @@
+From 5017de8ba4b1fe985169cf54590e858a9019a91f Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Fri, 11 Mar 2022 16:25:49 -0800
+Subject: [PATCH] [builtins] Do not force thumb mode directive in
+ arm/sync-ops.h
+
+.thumb_func was not switching mode until [1]
+so it did not show up but now that .thumb_func (without argument) is
+switching mode, its causing build failures on armv6 ( rpi0 ) even when
+build is explicitly asking for this file to be built with -marm (ARM
+mode), therefore use DEFINE_COMPILERRT_FUNCTION macro to add function
+header which considers arch and mode from compiler cmdline to decide if
+the function is built using thumb mode or arm mode.
+
+[1] https://reviews.llvm.org/D101975
+
+Note that it also needs https://reviews.llvm.org/D99282
+
+Reviewed By: peter.smith, MaskRay
+
+Differential Revision: https://reviews.llvm.org/D104183
+---
+ compiler-rt/lib/builtins/arm/sync-ops.h | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/lib/builtins/arm/sync-ops.h b/lib/builtins/arm/sync-ops.h
+index 7a26170741ad2..d914f9d3a1093 100644
+--- a/lib/builtins/arm/sync-ops.h
++++ b/lib/builtins/arm/sync-ops.h
+@@ -16,9 +16,8 @@
+ 
+ #define SYNC_OP_4(op)                                                          \
+   .p2align 2;                                                                  \
+-  .thumb;                                                                      \
+   .syntax unified;                                                             \
+-  DEFINE_COMPILERRT_THUMB_FUNCTION(__sync_fetch_and_##op)                      \
++  DEFINE_COMPILERRT_FUNCTION(__sync_fetch_and_##op)                            \
+   DMB;                                                                         \
+   mov r12, r0;                                                                 \
+   LOCAL_LABEL(tryatomic_##op) : ldrex r0, [r12];                               \
+@@ -31,9 +30,8 @@
+ 
+ #define SYNC_OP_8(op)                                                          \
+   .p2align 2;                                                                  \
+-  .thumb;                                                                      \
+   .syntax unified;                                                             \
+-  DEFINE_COMPILERRT_THUMB_FUNCTION(__sync_fetch_and_##op)                      \
++  DEFINE_COMPILERRT_FUNCTION(__sync_fetch_and_##op)                            \
+   push {r4, r5, r6, lr};                                                       \
+   DMB;                                                                         \
+   mov r12, r0;                                                                 \
+
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ba48c480a541..6cf32a80561c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15348,7 +15348,6 @@ with pkgs;
       /**/ if platform.isDarwin then 11
       else if platform.isFreeBSD then 12
       else if platform.isAndroid then 12
-      else if platform.system == "armv6l-linux" then 7  # This fixes armv6 cross-compilation
       else if platform.isLinux then 11
       else if platform.isWasm then 12
       else latest_version;

From 8fc5d9f3b06fa0890d212edd57ebc15af8d4b8bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 9 Mar 2023 00:48:58 +0100
Subject: [PATCH 065/154] python310Packages.more-itertools: 9.0.0 -> 9.1.0

Changelog: https://more-itertools.readthedocs.io/en/stable/versions.html
---
 pkgs/development/python-modules/more-itertools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/more-itertools/default.nix b/pkgs/development/python-modules/more-itertools/default.nix
index a4a02d65ac9c..f52432361893 100644
--- a/pkgs/development/python-modules/more-itertools/default.nix
+++ b/pkgs/development/python-modules/more-itertools/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "more-itertools";
-  version = "9.0.0";
+  version = "9.1.0";
   format = "flit";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-WmJX5Ah47wUgsYA5kOPiIwOkG1cUAGwyo/2DBLJuoas=";
+    hash = "sha256-yrqjQa0DieqDwXqUVmpTrkydBzSYYeyxTcbQNFz5rF0=";
   };
 
   nativeBuildInouts = [

From aa0d89d55ab2b26974d338c98848db3577bca903 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 9 Mar 2023 04:39:36 +0000
Subject: [PATCH 066/154] lcms2: 2.13.1 -> 2.15

---
 pkgs/development/libraries/lcms2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/lcms2/default.nix b/pkgs/development/libraries/lcms2/default.nix
index 14579bc59156..e1f6c3d2212c 100644
--- a/pkgs/development/libraries/lcms2/default.nix
+++ b/pkgs/development/libraries/lcms2/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lcms2";
-  version = "2.13.1";
+  version = "2.15";
 
   src = fetchurl {
     url = "mirror://sourceforge/lcms/${pname}-${version}.tar.gz";
-    sha256 = "sha256-1HPnlueyfFrwG9bRVS1CtFtDRX5xgs6ZA/OLt0ggO4g=";
+    sha256 = "sha256-sgy8vQ9QNDO+Kk6BRiEG+mEFCjUHTcJKTjVnktlxqzk=";
   };
 
   outputs = [ "bin" "dev" "out" ];

From 68cd5bdc83d0e2c77895a1e6747e0db6cc291019 Mon Sep 17 00:00:00 2001
From: Garry Filakhtov <filakhtov@gmail.com>
Date: Thu, 9 Mar 2023 16:26:51 +1100
Subject: [PATCH 067/154] systemdStage1: disable PAM

When PAM was made optional initially, we decided to keep it enabled for stage 1, but as was later pointed out during the code review it is unnecessary, because we never use PAM in stage 1, even in network-enabled stage 1 with OpenSSH we have `UsePAM` set to `no`, so disabling it now.
---
 pkgs/top-level/all-packages.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5064548b20c5..a03562b58965 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -26921,7 +26921,6 @@ with pkgs;
     withCryptsetup = true;
     withFido2 = true;
     withKmod = true;
-    withPam = true;
     withTpm2Tss = true;
   };
   systemdStage1Network = systemdStage1.override {

From 57ecdd6abdcb5bfc250785b2640ec943104e0401 Mon Sep 17 00:00:00 2001
From: Andrew Childs <lorne@cons.org.nz>
Date: Thu, 9 Mar 2023 17:55:45 +0900
Subject: [PATCH 068/154] ruby: fix cross compilation

---
 .../development/interpreters/ruby/default.nix | 21 ++++++++++++++++++-
 .../do-not-update-gems-baseruby-3.2.patch     | 13 ++++++++++++
 .../ruby/dont-refer-to-build-dir.patch        | 12 +++++++++++
 3 files changed, 45 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/interpreters/ruby/do-not-update-gems-baseruby-3.2.patch
 create mode 100644 pkgs/development/interpreters/ruby/dont-refer-to-build-dir.patch

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 3b051eac87b0..96d73d45c261 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -21,6 +21,7 @@ let
   generic = { version, sha256, cargoSha256 ? null }: let
     ver = version;
     atLeast30 = lib.versionAtLeast ver.majMin "3.0";
+    atLeast31 = lib.versionAtLeast ver.majMin "3.1";
     atLeast32 = lib.versionAtLeast ver.majMin "3.2";
     self = lib.makeOverridable (
       { stdenv, buildPackages, lib
@@ -96,7 +97,10 @@ let
         enableParallelBuilding = true;
 
         patches = op (lib.versionOlder ver.majMin "3.1") ./do-not-regenerate-revision.h.patch
-          ++ op (atLeast30 && useBaseRuby) ./do-not-update-gems-baseruby.patch
+          ++ op (atLeast30 && useBaseRuby) (
+            if atLeast32 then ./do-not-update-gems-baseruby-3.2.patch
+            else ./do-not-update-gems-baseruby.patch
+          )
           ++ ops (ver.majMin == "3.0") [
             # Ruby 3.0 adds `-fdeclspec` to $CC instead of $CFLAGS. Fixed in later versions.
             (fetchpatch {
@@ -104,6 +108,14 @@ let
               sha256 = "sha256-43hI9L6bXfeujgmgKFVmiWhg7OXvshPCCtQ4TxqK1zk=";
             })
           ]
+          ++ ops (ver.majMin == "3.1") [
+            # Ruby 3.1.3 cannot find pkg-config in mkmf.rb
+            # https://bugs.ruby-lang.org/issues/19189
+            (fetchpatch {
+              url = "https://github.com/ruby/ruby/commit/613fca01486e47dee9364a2fd86b5f5e77fe23c8.patch";
+              sha256 = "sha256-0Ku7l6VEpcvxexL9QA5+mNER4v8gYZOJhAjhCL1WDpw=";
+            })
+          ]
           ++ ops (!atLeast30 && rubygemsSupport) [
             # We upgrade rubygems to a version that isn't compatible with the
             # ruby 2.7 installer. Backport the upstream fix.
@@ -118,6 +130,13 @@ let
               url = "https://github.com/ruby/ruby/commit/261d8dd20afd26feb05f00a560abd99227269c1c.patch";
               sha256 = "0wrii25cxcz2v8bgkrf7ibcanjlxwclzhayin578bf0qydxdm9qy";
             })
+          ]
+          ++ ops atLeast31 [
+            # When using a baseruby, ruby always sets "libdir" to the build
+            # directory, which nix rejects due to a reference in to /build/ in
+            # the final product. Removing this reference doesn't seem to break
+            # anything and fixes cross compliation.
+            ./dont-refer-to-build-dir.patch
           ];
 
         cargoRoot = opString yjitSupport "yjit";
diff --git a/pkgs/development/interpreters/ruby/do-not-update-gems-baseruby-3.2.patch b/pkgs/development/interpreters/ruby/do-not-update-gems-baseruby-3.2.patch
new file mode 100644
index 000000000000..21e8d0fffe6e
--- /dev/null
+++ b/pkgs/development/interpreters/ruby/do-not-update-gems-baseruby-3.2.patch
@@ -0,0 +1,13 @@
+diff --git a/common.mk b/common.mk
+index 3798f82bc6..4d07b28aa4 100644
+--- a/common.mk
++++ b/common.mk
+@@ -1374,7 +1374,7 @@ update-config_files: PHONY
+ 	    config.guess config.sub
+ 
+ refresh-gems: update-bundled_gems prepare-gems
+-prepare-gems: $(HAVE_BASERUBY:yes=update-gems) $(HAVE_BASERUBY:yes=extract-gems)
++prepare-gems:
+ extract-gems: $(HAVE_BASERUBY:yes=update-gems)
+ 
+ update-gems$(gnumake:yes=-sequential): PHONY
diff --git a/pkgs/development/interpreters/ruby/dont-refer-to-build-dir.patch b/pkgs/development/interpreters/ruby/dont-refer-to-build-dir.patch
new file mode 100644
index 000000000000..6198b3acc9e5
--- /dev/null
+++ b/pkgs/development/interpreters/ruby/dont-refer-to-build-dir.patch
@@ -0,0 +1,12 @@
+diff --git a/tool/fake.rb b/tool/fake.rb
+index 91dfb041c4..9c235f1e3a 100644
+--- a/tool/fake.rb
++++ b/tool/fake.rb
+@@ -48,7 +48,6 @@ class File
+   $builtruby ||= File.join(builddir, config['RUBY_INSTALL_NAME'] + config['EXEEXT'])
+   RbConfig.fire_update!("builddir", builddir)
+   RbConfig.fire_update!("buildlibdir", builddir)
+-  RbConfig.fire_update!("libdir", builddir)
+   RbConfig.fire_update!("prefix", $topdir)
+   RbConfig.fire_update!("top_srcdir", $top_srcdir ||= top_srcdir)
+   RbConfig.fire_update!("extout", $extout)

From e5b072eca165430efc4d7a179011a42aab4470a2 Mon Sep 17 00:00:00 2001
From: Ivan Trubach <mr.trubach@icloud.com>
Date: Fri, 3 Mar 2023 02:31:38 +0300
Subject: [PATCH 069/154] nixos/iso-image: add an option to disable BIOS boot

This change adds an option to disable legacy BIOS boot support for ISO
images. The implementation uses syslinux package that currently does not
support non-x86 platforms and thus cannot be cross-compiled, e.g. from
AArch64 system.
---
 .../installer/cd-dvd/installation-cd-base.nix |  3 +++
 nixos/modules/installer/cd-dvd/iso-image.nix  | 19 +++++++++++++------
 2 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/nixos/modules/installer/cd-dvd/installation-cd-base.nix b/nixos/modules/installer/cd-dvd/installation-cd-base.nix
index 3f92b779d60a..3c7c7e30a0bf 100644
--- a/nixos/modules/installer/cd-dvd/installation-cd-base.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-base.nix
@@ -21,6 +21,9 @@ with lib;
   # ISO naming.
   isoImage.isoName = "${config.isoImage.isoBaseName}-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.iso";
 
+  # BIOS booting
+  isoImage.makeBiosBootable = true;
+
   # EFI booting
   isoImage.makeEfiBootable = true;
 
diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index 86c2cd1a8c73..0245a522f7e1 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -535,6 +535,13 @@ in
       '';
     };
 
+    isoImage.makeBiosBootable = mkOption {
+      default = false;
+      description = lib.mdDoc ''
+        Whether the ISO image should be a BIOS-bootable disk.
+      '';
+    };
+
     isoImage.makeEfiBootable = mkOption {
       default = false;
       description = lib.mdDoc ''
@@ -693,7 +700,7 @@ in
     boot.loader.grub.enable = false;
 
     environment.systemPackages =  [ grubPkgs.grub2 grubPkgs.grub2_efi ]
-      ++ optional canx86BiosBoot pkgs.syslinux
+      ++ optional (config.isoImage.makeBiosBootable && canx86BiosBoot) pkgs.syslinux
     ;
 
     # In stage 1 of the boot, mount the CD as the root FS by label so
@@ -744,7 +751,7 @@ in
         { source = pkgs.writeText "version" config.system.nixos.label;
           target = "/version.txt";
         }
-      ] ++ optionals canx86BiosBoot [
+      ] ++ optionals (config.isoImage.makeBiosBootable && canx86BiosBoot) [
         { source = config.isoImage.splashImage;
           target = "/isolinux/background.png";
         }
@@ -771,7 +778,7 @@ in
         { source = config.isoImage.efiSplashImage;
           target = "/EFI/boot/efi-background.png";
         }
-      ] ++ optionals (config.boot.loader.grub.memtest86.enable && canx86BiosBoot) [
+      ] ++ optionals (config.boot.loader.grub.memtest86.enable && config.isoImage.makeBiosBootable && canx86BiosBoot) [
         { source = "${pkgs.memtest86plus}/memtest.bin";
           target = "/boot/memtest.bin";
         }
@@ -786,10 +793,10 @@ in
     # Create the ISO image.
     system.build.isoImage = pkgs.callPackage ../../../lib/make-iso9660-image.nix ({
       inherit (config.isoImage) isoName compressImage volumeID contents;
-      bootable = canx86BiosBoot;
+      bootable = config.isoImage.makeBiosBootable && canx86BiosBoot;
       bootImage = "/isolinux/isolinux.bin";
-      syslinux = if canx86BiosBoot then pkgs.syslinux else null;
-    } // optionalAttrs (config.isoImage.makeUsbBootable && canx86BiosBoot) {
+      syslinux = if config.isoImage.makeBiosBootable && canx86BiosBoot then pkgs.syslinux else null;
+    } // optionalAttrs (config.isoImage.makeUsbBootable && config.isoImage.makeBiosBootable && canx86BiosBoot) {
       usbBootable = true;
       isohybridMbrImage = "${pkgs.syslinux}/share/syslinux/isohdpfx.bin";
     } // optionalAttrs config.isoImage.makeEfiBootable {

From 905be9f8c5d0bcc95dbd26f9d5a53f61c48d9798 Mon Sep 17 00:00:00 2001
From: Ivan Trubach <mr.trubach@icloud.com>
Date: Thu, 9 Mar 2023 19:05:51 +0300
Subject: [PATCH 070/154] nixos/iso-image: s/efi/EFI in documentation

---
 nixos/modules/installer/cd-dvd/iso-image.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index 0245a522f7e1..8fa070b03db3 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -545,7 +545,7 @@ in
     isoImage.makeEfiBootable = mkOption {
       default = false;
       description = lib.mdDoc ''
-        Whether the ISO image should be an efi-bootable volume.
+        Whether the ISO image should be an EFI-bootable volume.
       '';
     };
 

From a16f3e6b3801ee0531497b3991d33860bb56487b Mon Sep 17 00:00:00 2001
From: Tobias Markus <tobias@miglix.eu>
Date: Thu, 9 Mar 2023 18:28:42 +0100
Subject: [PATCH 071/154] cmake: 3.25.2 -> 3.25.3

---
 pkgs/development/tools/build-managers/cmake/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index a8d47b1a11dc..82eafadd37a3 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -40,11 +40,11 @@ stdenv.mkDerivation rec {
     + lib.optionalString isBootstrap "-boot"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.25.2";
+  version = "3.25.3";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
-    sha256 = "0g6k9sa23smh9z5dz8v6dqy89887gxc7s24gchpm7p9ip4ng49n0";
+    sha256 = "sha256-zJlXAdWQym3rxCRemYmTkJnKUoJ91GtdNZLwk6/hkBw=";
   };
 
   patches = [

From 04cc3ff7d334fe5f064071e05990949e11f8aa88 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 9 Mar 2023 22:05:53 +0000
Subject: [PATCH 072/154] asymptote: disable install parallelism

Without the change parallel installs fail as:

    ...-coreutils-9.1/bin/install: cannot stat 'asy-keywords.el': No such file or directory
    make: *** [Makefile:272: install-asy] Error 1
---
 pkgs/tools/graphics/asymptote/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/tools/graphics/asymptote/default.nix b/pkgs/tools/graphics/asymptote/default.nix
index ec2e5ce64c93..9950d3c56f99 100644
--- a/pkgs/tools/graphics/asymptote/default.nix
+++ b/pkgs/tools/graphics/asymptote/default.nix
@@ -67,6 +67,10 @@ stdenv.mkDerivation rec {
   '';
 
   enableParallelBuilding = true;
+  # Missing install depends:
+  #   ...-coreutils-9.1/bin/install: cannot stat 'asy-keywords.el': No such file or directory
+  #   make: *** [Makefile:272: install-asy] Error 1
+  enableParallelInstalling = false;
 
   meta = with lib; {
     description =  "A tool for programming graphics intended to replace Metapost";

From 03be09d5181b43ffcf0c6085d795d9fad3d5f515 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 9 Mar 2023 22:29:59 +0000
Subject: [PATCH 073/154] gretl: disable install parallelism

Without the change parallel installs fail as:

    cp: cannot stat '...-gretl-2022c/share/gretl/data/plotbars': Not a directory
    make[1]: *** [Makefile:73: install_datafiles] Error 1
---
 pkgs/applications/science/math/gretl/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/applications/science/math/gretl/default.nix b/pkgs/applications/science/math/gretl/default.nix
index 315433feb1c2..026be6fa1a4d 100644
--- a/pkgs/applications/science/math/gretl/default.nix
+++ b/pkgs/applications/science/math/gretl/default.nix
@@ -28,6 +28,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
 
   enableParallelBuilding = true;
+  # Missing install depends:
+  #  cp: cannot stat '...-gretl-2022c/share/gretl/data/plotbars': Not a directory
+  #  make[1]: *** [Makefile:73: install_datafiles] Error 1
+  enableParallelInstalling = false;
 
   meta = with lib; {
     description = "A software package for econometric analysis";

From 41ddcc3898962edda8e49032d235d7edc47e31ee Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 9 Mar 2023 22:50:48 +0000
Subject: [PATCH 074/154] qsynth: disable install parallelism

Without the change parallel installs fail as:

    lrelease error: Parse error at src/translations/qsynth_ru.ts:1503:33: Premature end of document.
    make: *** [Makefile:107: src/translations/qsynth_ru.qm] Error 1
---
 pkgs/applications/audio/qsynth/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/applications/audio/qsynth/default.nix b/pkgs/applications/audio/qsynth/default.nix
index f9eaa890c57f..a24625ca7de8 100644
--- a/pkgs/applications/audio/qsynth/default.nix
+++ b/pkgs/applications/audio/qsynth/default.nix
@@ -16,6 +16,10 @@ mkDerivation  rec {
   buildInputs = [ alsa-lib fluidsynth libjack2 qtbase qttools qtx11extras ];
 
   enableParallelBuilding = true;
+  # Missing install depends:
+  #   lrelease error: Parse error at src/translations/qsynth_ru.ts:1503:33: Premature end of document.
+  #   make: *** [Makefile:107: src/translations/qsynth_ru.qm] Error 1
+  enableParallelInstalling = false;
 
   meta = with lib; {
     description = "Fluidsynth GUI";

From 91e20f108149be118c166eed2a4db44ca124d05b Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 9 Mar 2023 22:53:06 +0000
Subject: [PATCH 075/154] solanum: disable install parallelism

Without the change parallel installs fail as:

    ...-binutils-2.40/bin/ld: cannot find ./.libs/libircd.so: No such file or directory
    collect2: error: ld returned 1 exit status
    make[4]: *** [Makefile:634: solanum] Error 1
---
 pkgs/servers/irc/solanum/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/servers/irc/solanum/default.nix b/pkgs/servers/irc/solanum/default.nix
index df1218ba7920..14924e6656c9 100644
--- a/pkgs/servers/irc/solanum/default.nix
+++ b/pkgs/servers/irc/solanum/default.nix
@@ -57,6 +57,11 @@ stdenv.mkDerivation rec {
   doCheck = !stdenv.isDarwin;
 
   enableParallelBuilding = true;
+  # Missing install depends:
+  #   ...-binutils-2.40/bin/ld: cannot find ./.libs/libircd.so: No such file or directory
+  #   collect2: error: ld returned 1 exit status
+  #   make[4]: *** [Makefile:634: solanum] Error 1
+  enableParallelInstalling = false;
 
   meta = with lib; {
     description = "An IRCd for unified networks";

From ed1bc2f7b726183a07fb67106f47fb218f01d9e0 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Fri, 10 Mar 2023 04:20:00 +0000
Subject: [PATCH 076/154] libimagequant: 4.1.0 -> 4.1.1

---
 .../libraries/libimagequant/Cargo.lock        | 90 ++++++++-----------
 .../libraries/libimagequant/default.nix       |  4 +-
 2 files changed, 39 insertions(+), 55 deletions(-)

diff --git a/pkgs/development/libraries/libimagequant/Cargo.lock b/pkgs/development/libraries/libimagequant/Cargo.lock
index 6c1e8c61643a..e98ae261a70d 100644
--- a/pkgs/development/libraries/libimagequant/Cargo.lock
+++ b/pkgs/development/libraries/libimagequant/Cargo.lock
@@ -10,11 +10,11 @@ checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
 [[package]]
 name = "ahash"
-version = "0.7.6"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
+checksum = "2c99f64d1e06488f620f932677e24bc6e2897582980441ae90a671415bd7ec2f"
 dependencies = [
- "getrandom",
+ "cfg-if",
  "once_cell",
  "version_check",
 ]
@@ -39,9 +39,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bytemuck"
-version = "1.13.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c041d3eab048880cb0b86b256447da3f18859a163c3b8d8893f4e6368abe6393"
+checksum = "17febce684fd15d89027105661fec94afb475cb995fbc59d2865198446ba2eea"
 
 [[package]]
 name = "c_test"
@@ -53,9 +53,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.78"
+version = "1.0.79"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a20104e2335ce8a659d6dd92a51a767a0c062599c73b343fd152cb401e828c3d"
+checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
 
 [[package]]
 name = "cfg-if"
@@ -74,9 +74,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.6"
+version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2dd04ddaf88237dc3b8d8f9a3c1004b506b54b3313403944054d23c0870c521"
+checksum = "cf2b3e8478797446514c91ef04bafcb59faba183e621ad488df88983cc14128c"
 dependencies = [
  "cfg-if",
  "crossbeam-utils",
@@ -84,9 +84,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "715e8152b692bba2d374b53d4875445368fdf21a94751410af607a5ac677d1fc"
+checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef"
 dependencies = [
  "cfg-if",
  "crossbeam-epoch",
@@ -95,9 +95,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.13"
+version = "0.9.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01a9af1f4c2ef74bb8aa1f7e19706bc72d03598c8a570bb5de72243c7a9d9d5a"
+checksum = "46bd5f3f85273295a9d14aedfb86f6aadbff6d8f5295c4a9edb08e819dcf5695"
 dependencies = [
  "autocfg",
  "cfg-if",
@@ -108,24 +108,24 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.14"
+version = "0.8.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fb766fa798726286dbbb842f174001dab8abc7b627a1dd86e0b7222a95d929f"
+checksum = "3c063cd8cc95f5c377ed0d4b49a4b21f632396ff690e8470c29b3359b346984b"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "either"
-version = "1.8.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90e5c1c8368803113bf0c9584fc495a58b86dc8a29edbf8fe877d21d9507e797"
+checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
 
 [[package]]
 name = "fallible_collections"
-version = "0.4.6"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f57ccc32870366ae684be48b32a1a2e196f98a42a9b4361fe77e13fd4a34755"
+checksum = "9acf77205554f3cfeca94a4b910e159ad9824e8c2d164de02b3f12495cc1074d"
 dependencies = [
  "hashbrown",
 ]
@@ -140,22 +140,11 @@ dependencies = [
  "miniz_oxide",
 ]
 
-[[package]]
-name = "getrandom"
-version = "0.2.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c05aeb6a22b8f62540c194aac980f2115af067bfe15a0734d7277a768d396b31"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi",
-]
-
 [[package]]
 name = "hashbrown"
-version = "0.12.3"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+checksum = "43a3c133739dddd0d2990f9a4bdf8eb4b21ef50e4851ca85ab661199821d510e"
 dependencies = [
  "ahash",
 ]
@@ -171,7 +160,7 @@ dependencies = [
 
 [[package]]
 name = "imagequant"
-version = "4.1.0"
+version = "4.1.1"
 dependencies = [
  "arrayvec",
  "lodepng",
@@ -194,9 +183,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.139"
+version = "0.2.140"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "201de327520df007757c1f0adce6e827fe8562fbc28bfd9c15571c66ca1f5f79"
+checksum = "99227334921fae1a979cf0bfdfcc6b3e5ce376ef57e16fb6fb3ea2ed6095f80c"
 
 [[package]]
 name = "lodepng"
@@ -213,9 +202,9 @@ dependencies = [
 
 [[package]]
 name = "memoffset"
-version = "0.7.1"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
+checksum = "d61c719bcfbcf5d62b3a09efa6088de8c54bc0bfcd3ea7ae39fcc186108b8de1"
 dependencies = [
  "autocfg",
 ]
@@ -259,15 +248,15 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.17.0"
+version = "1.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f61fba1741ea2b3d6a1e3178721804bb716a68a6aeba1149b5d52e3d464ea66"
+checksum = "b7e5500299e16ebb147ae15a00a942af264cf3688f47923b8fc2cd5858f23ad3"
 
 [[package]]
 name = "rayon"
-version = "1.6.1"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db3a213adf02b3bcfd2d3846bb41cb22857d131789e01df434fb7e7bc0759b7"
+checksum = "1d2df5196e37bcc87abebc0053e20787d73847bb33134a69841207dd0a47f03b"
 dependencies = [
  "either",
  "rayon-core",
@@ -275,9 +264,9 @@ dependencies = [
 
 [[package]]
 name = "rayon-core"
-version = "1.10.2"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "356a0625f1954f730c0201cdab48611198dc6ce21f4acff55089b5a78e6e835b"
+checksum = "4b8f95bd6966f5c87776639160a66bd8ab9895d9d4ab01ddba9fc60661aebe8d"
 dependencies = [
  "crossbeam-channel",
  "crossbeam-deque",
@@ -287,9 +276,9 @@ dependencies = [
 
 [[package]]
 name = "rgb"
-version = "0.8.34"
+version = "0.8.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3603b7d71ca82644f79b5a06d1220e9a58ede60bd32255f698cb1af8838b8db3"
+checksum = "20ec2d3e3fc7a92ced357df9cebd5a10b6fb2aa1ee797bf7e9ce2f17dffc8f59"
 dependencies = [
  "bytemuck",
 ]
@@ -302,10 +291,11 @@ checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
 
 [[package]]
 name = "thread_local"
-version = "1.1.4"
+version = "1.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5516c27b78311c50bf42c071425c560ac799b11c30b31f87e3081965fe5e0180"
+checksum = "3fdd6f064ccff2d6567adcb3873ca630700f00b5ad3f060c25b5dcfd9a4ce152"
 dependencies = [
+ "cfg-if",
  "once_cell",
 ]
 
@@ -314,9 +304,3 @@ name = "version_check"
 version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
-
-[[package]]
-name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
diff --git a/pkgs/development/libraries/libimagequant/default.nix b/pkgs/development/libraries/libimagequant/default.nix
index 825c442eb6c9..8fb334e2a4d5 100644
--- a/pkgs/development/libraries/libimagequant/default.nix
+++ b/pkgs/development/libraries/libimagequant/default.nix
@@ -5,13 +5,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "libimagequant";
-  version = "4.1.0";
+  version = "4.1.1";
 
   src = fetchFromGitHub {
     owner = "ImageOptim";
     repo = pname;
     rev = version;
-    hash = "sha256-W9Q81AbFhWUe6c3csAnm8L5wLqURizrjwqcurWhPISI=";
+    hash = "sha256-sCxscs4D2p7LNDpcrKfAc315/NbxbQXtsyc33zUmccM=";
   };
 
   cargoLock = {

From 88cbe74d05cac6e037e934ee7fbe8b1f0d164f25 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Sun, 26 Feb 2023 10:10:22 -0800
Subject: [PATCH 077/154] spandsp: refactor

The `spandsp` derivation has the clauses in the wrong order
(e.g. `makeFlags` before `configureFlags`) which makes it hard to
understand.

This commit fixes the clause order, factors out `common.nix` from
the two versions of spandsp, and also tries to normalize the coding
style.
---
 pkgs/development/libraries/spandsp/3.nix      | 47 +++++-----------
 pkgs/development/libraries/spandsp/common.nix | 52 ++++++++++++++++++
 .../development/libraries/spandsp/default.nix | 54 +++++--------------
 3 files changed, 77 insertions(+), 76 deletions(-)
 create mode 100644 pkgs/development/libraries/spandsp/common.nix

diff --git a/pkgs/development/libraries/spandsp/3.nix b/pkgs/development/libraries/spandsp/3.nix
index 74eb099227e9..24cfc3fc83b6 100644
--- a/pkgs/development/libraries/spandsp/3.nix
+++ b/pkgs/development/libraries/spandsp/3.nix
@@ -1,41 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, audiofile, libtiff, autoreconfHook
+{ lib
+, stdenv
+, fetchFromGitHub
+, audiofile
+, libtiff
+, autoreconfHook
 , fetchpatch
-, buildPackages }:
-stdenv.mkDerivation rec {
+, buildPackages
+, callPackage
+}:
+
+(callPackage ./common.nix {}).overrideAttrs(finalAttrs: {
   version = "3.0.0";
-  pname = "spandsp";
   src = fetchFromGitHub {
     owner = "freeswitch";
-    repo = pname;
+    repo = finalAttrs.pname;
     rev = "6ec23e5a7e411a22d59e5678d12c4d2942c4a4b6"; # upstream does not seem to believe in tags
     sha256 = "03w0s99y3zibi5fnvn8lk92dggfgrr0mz5255745jfbz28b2d5y7";
   };
-
-  patches = [
-    # submitted upstream: https://github.com/freeswitch/spandsp/pull/47
-    (fetchpatch {
-      url = "https://github.com/freeswitch/spandsp/commit/1f810894804d3fa61ab3fc2f3feb0599145a3436.patch";
-      hash = "sha256-Cf8aaoriAvchh5cMb75yP2gsZbZaOLha/j5mq3xlkVA=";
-    })
-  ];
-
-  outputs = [ "out" "dev" ];
-
-  enableParallelBuilding = true;
-
-  nativeBuildInputs = [ autoreconfHook ];
-  propagatedBuildInputs = [ audiofile libtiff ];
-
-  makeFlags = [
-    "CC=${stdenv.cc.targetPrefix}cc"
-    "CC_FOR_BUILD=${buildPackages.stdenv.cc}/bin/cc"
-  ];
-
-  meta = {
-    description = "A portable and modular SIP User-Agent with audio and video support";
-    homepage = "https://github.com/freeswitch/spandsp";
-    platforms = with lib.platforms; unix;
-    maintainers = with lib.maintainers; [ ajs124 misuzu ];
-    license = lib.licenses.gpl2;
-  };
-}
+})
diff --git a/pkgs/development/libraries/spandsp/common.nix b/pkgs/development/libraries/spandsp/common.nix
new file mode 100644
index 000000000000..73422ed57d65
--- /dev/null
+++ b/pkgs/development/libraries/spandsp/common.nix
@@ -0,0 +1,52 @@
+{ lib
+, stdenv
+, fetchurl
+, audiofile
+, libtiff
+, buildPackages
+, fetchpatch
+, autoreconfHook
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "spandsp";
+
+  patches = [
+    # submitted upstream: https://github.com/freeswitch/spandsp/pull/47
+    (fetchpatch {
+      url = "https://github.com/freeswitch/spandsp/commit/1f810894804d3fa61ab3fc2f3feb0599145a3436.patch";
+      hash = "sha256-Cf8aaoriAvchh5cMb75yP2gsZbZaOLha/j5mq3xlkVA=";
+    })
+  ];
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [ autoreconfHook ];
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  propagatedBuildInputs = [ audiofile libtiff ];
+
+  configureFlags = [
+    # This flag is required to prevent linking error in the cross-compilation case.
+    # I think it's fair to assume that realloc(NULL, size) will return a valid memory
+    # block for most libc implementation, so let's just assume that and hope for the best.
+    "ac_cv_func_malloc_0_nonnull=yes"
+  ];
+
+  enableParallelBuilding = true;
+
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "CC_FOR_BUILD=${buildPackages.stdenv.cc}/bin/cc"
+  ];
+
+  strictDeps = true;
+
+  meta = {
+    description = "A portable and modular SIP User-Agent with audio and video support";
+    homepage = "https://github.com/freeswitch/spandsp";
+    platforms = with lib.platforms; unix;
+    maintainers = with lib.maintainers; [ ajs124 misuzu ];
+    license = lib.licenses.gpl2;
+    downloadPage = "http://www.soft-switch.org/downloads/spandsp/";
+  };
+})
diff --git a/pkgs/development/libraries/spandsp/default.nix b/pkgs/development/libraries/spandsp/default.nix
index baa6a93856b6..cf5e53c3f911 100644
--- a/pkgs/development/libraries/spandsp/default.nix
+++ b/pkgs/development/libraries/spandsp/default.nix
@@ -1,48 +1,18 @@
-{ lib, stdenv, fetchurl, audiofile, libtiff, buildPackages
+{ lib
+, stdenv
+, fetchurl
+, audiofile
+, libtiff
+, buildPackages
 , fetchpatch
-, autoreconfHook }:
+, autoreconfHook
+, callPackage
+}:
 
-stdenv.mkDerivation rec {
+(callPackage ./common.nix {}).overrideAttrs(_: rec {
   version = "0.0.6";
-  pname = "spandsp";
-
-  patches = [
-    # submitted upstream: https://github.com/freeswitch/spandsp/pull/47
-    (fetchpatch {
-      url = "https://github.com/freeswitch/spandsp/commit/1f810894804d3fa61ab3fc2f3feb0599145a3436.patch";
-      hash = "sha256-Cf8aaoriAvchh5cMb75yP2gsZbZaOLha/j5mq3xlkVA=";
-    })
-  ];
-
-  src=fetchurl {
+  src = fetchurl {
     url = "https://www.soft-switch.org/downloads/spandsp/spandsp-${version}.tar.gz";
     sha256 = "0rclrkyspzk575v8fslzjpgp4y2s4x7xk3r55ycvpi4agv33l1fc";
   };
-
-  outputs = [ "out" "dev" ];
-  enableParallelBuilding = true;
-  makeFlags = [
-    "CC=${stdenv.cc.targetPrefix}cc"
-    "CC_FOR_BUILD=${buildPackages.stdenv.cc}/bin/cc"
-  ];
-
-  configureFlags = [
-    # This flag is required to prevent linking error in the cross-compilation case.
-    # I think it's fair to assume that realloc(NULL, size) will return a valid memory
-    # block for most libc implementation, so let's just assume that and hope for the best.
-    "ac_cv_func_malloc_0_nonnull=yes"
-  ];
-
-  strictDeps = true;
-  nativeBuildInputs = [ autoreconfHook ];
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  propagatedBuildInputs = [audiofile libtiff];
-  meta = {
-    description = "A portable and modular SIP User-Agent with audio and video support";
-    homepage = "http://www.creytiv.com/baresip.html";
-    platforms = with lib.platforms; linux;
-    maintainers = with lib.maintainers; [raskin];
-    license = lib.licenses.gpl2;
-    downloadPage = "http://www.soft-switch.org/downloads/spandsp/";
-  };
-}
+})

From b27cf6ace4e687b073d05a8f397a9c944e5ee967 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Tue, 28 Feb 2023 13:20:11 +0000
Subject: [PATCH 078/154] llvm_14,llvmPackages_git.llvm: enable polly by
 default
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Port of 2a58596dd24 ("llvmPackages_15.llvm: enable polly by default").

It should be ported all the back to LLVM 12, but I haven't done that
here because going further back than 14 requires fixing patches, and
I'm focused on my goal of getting the delta between LLVM 15 and LLVM
git under control — it's going to be hard enough to accomplish that.
---
 .../development/compilers/llvm/14/default.nix |  6 +-
 .../compilers/llvm/14/llvm/default.nix        |  5 +-
 .../llvm/14/llvm/gnu-install-dirs-polly.patch | 91 +------------------
 .../compilers/llvm/git/default.nix            |  6 +-
 .../compilers/llvm/git/llvm/default.nix       |  5 +-
 .../git/llvm/gnu-install-dirs-polly.patch     | 91 +------------------
 6 files changed, 20 insertions(+), 184 deletions(-)

diff --git a/pkgs/development/compilers/llvm/14/default.nix b/pkgs/development/compilers/llvm/14/default.nix
index 314a882db8ef..944b8f0b3d02 100644
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ b/pkgs/development/compilers/llvm/14/default.nix
@@ -1,6 +1,6 @@
 { lowPrio, newScope, pkgs, lib, stdenv, cmake
 , gccForLibs, preLibcCrossHeaders
-, libxml2, python3, isl, fetchFromGitHub, overrideCC, wrapCCWith, wrapBintoolsWith
+, libxml2, python3, fetchFromGitHub, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 , targetLlvm
@@ -41,7 +41,7 @@ let
   };
 
   tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version monorepoSrc buildLlvmTools; });
+    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 release_version version monorepoSrc buildLlvmTools; });
     mkExtraBuildCommands0 = cc: ''
       rsrc="$out/resource-root"
       mkdir "$rsrc"
@@ -221,7 +221,7 @@ let
   });
 
   libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version monorepoSrc; });
+    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 release_version version monorepoSrc; });
   in {
 
     compiler-rt-libc = callPackage ./compiler-rt {
diff --git a/pkgs/development/compilers/llvm/14/llvm/default.nix b/pkgs/development/compilers/llvm/14/llvm/default.nix
index d8010ecf893d..9bd24b9ac068 100644
--- a/pkgs/development/compilers/llvm/14/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/14/llvm/default.nix
@@ -22,7 +22,7 @@
 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
 # broken for the armv7l builder
 , enablePFM ? stdenv.isLinux && !stdenv.hostPlatform.isAarch
-, enablePolly ? false
+, enablePolly ? true
 } @args:
 
 let
@@ -42,7 +42,8 @@ in stdenv.mkDerivation (rec {
     cp -r ${monorepoSrc}/${pname} "$out"
     cp -r ${monorepoSrc}/third-party "$out"
   '' + lib.optionalString enablePolly ''
-    cp -r ${monorepoSrc}/polly "$out/llvm/tools"
+    chmod u+w "$out/${pname}/tools"
+    cp -r ${monorepoSrc}/polly "$out/${pname}/tools"
   '');
 
   sourceRoot = "${src.name}/${pname}";
diff --git a/pkgs/development/compilers/llvm/14/llvm/gnu-install-dirs-polly.patch b/pkgs/development/compilers/llvm/14/llvm/gnu-install-dirs-polly.patch
index 98e998e65a96..b01363e98aa0 100644
--- a/pkgs/development/compilers/llvm/14/llvm/gnu-install-dirs-polly.patch
+++ b/pkgs/development/compilers/llvm/14/llvm/gnu-install-dirs-polly.patch
@@ -1,77 +1,7 @@
-diff --git a/tools/polly/CMakeLists.txt b/tools/polly/CMakeLists.txt
-index ca7c04c565bb..6a6155806ffa 100644
---- a/tools/polly/CMakeLists.txt
-+++ b/tools/polly/CMakeLists.txt
-@@ -3,6 +3,8 @@ if (NOT DEFINED LLVM_MAIN_SRC_DIR)
-   project(Polly)
-   cmake_minimum_required(VERSION 3.13.4)
- 
-+  include(GNUInstallDirs)
-+
-   # Where is LLVM installed?
-   find_package(LLVM CONFIG REQUIRED)
-   set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} ${LLVM_CMAKE_DIR})
-@@ -122,13 +124,13 @@ include_directories(
- 
- if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
-   install(DIRECTORY include/
--    DESTINATION include
-+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
-     FILES_MATCHING
-     PATTERN "*.h"
-     )
- 
-   install(DIRECTORY ${POLLY_BINARY_DIR}/include/
--    DESTINATION include
-+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
-     FILES_MATCHING
-     PATTERN "*.h"
-     PATTERN "CMakeFiles" EXCLUDE
-diff --git a/tools/polly/cmake/CMakeLists.txt b/tools/polly/cmake/CMakeLists.txt
-index 7cc129ba2e90..137be25e4b80 100644
---- a/tools/polly/cmake/CMakeLists.txt
-+++ b/tools/polly/cmake/CMakeLists.txt
-@@ -79,18 +79,18 @@ file(GENERATE
- 
- # Generate PollyConfig.cmake for the install tree.
- unset(POLLY_EXPORTS)
--set(POLLY_INSTALL_PREFIX "${CMAKE_INSTALL_PREFIX}")
-+set(POLLY_INSTALL_PREFIX "")
- set(POLLY_CONFIG_LLVM_CMAKE_DIR "${LLVM_BINARY_DIR}/${LLVM_INSTALL_PACKAGE_DIR}")
--set(POLLY_CONFIG_CMAKE_DIR "${POLLY_INSTALL_PREFIX}/${POLLY_INSTALL_PACKAGE_DIR}")
--set(POLLY_CONFIG_LIBRARY_DIRS "${POLLY_INSTALL_PREFIX}/lib${LLVM_LIBDIR_SUFFIX}")
-+set(POLLY_CONFIG_CMAKE_DIR "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_PREFIX}/${POLLY_INSTALL_PACKAGE_DIR}")
-+set(POLLY_CONFIG_LIBRARY_DIRS "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
- if (POLLY_BUNDLED_ISL)
-   set(POLLY_CONFIG_INCLUDE_DIRS
--    "${POLLY_INSTALL_PREFIX}/include"
--    "${POLLY_INSTALL_PREFIX}/include/polly"
-+    "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_LIBDIR}"
-+    "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_LIBDIR}/polly"
-     )
- else()
-   set(POLLY_CONFIG_INCLUDE_DIRS
--    "${POLLY_INSTALL_PREFIX}/include"
-+    "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_INCLUDEDIR}"
-     ${ISL_INCLUDE_DIRS}
-     )
- endif()
-@@ -100,12 +100,12 @@ endif()
- foreach(tgt IN LISTS POLLY_CONFIG_EXPORTED_TARGETS)
-   get_target_property(tgt_type ${tgt} TYPE)
-   if (tgt_type STREQUAL "EXECUTABLE")
--    set(tgt_prefix "bin/")
-+    set(tgt_prefix "${CMAKE_INSTALL_BINDIR}/")
-   else()
--    set(tgt_prefix "lib/")
-+    set(tgt_prefix "${CMAKE_INSTALL_LIBDIR}/")
-   endif()
- 
--  set(tgt_path "${CMAKE_INSTALL_PREFIX}/${tgt_prefix}$<TARGET_FILE_NAME:${tgt}>")
-+  set(tgt_path "${tgt_prefix}$<TARGET_FILE_NAME:${tgt}>")
-   file(RELATIVE_PATH tgt_path ${POLLY_CONFIG_CMAKE_DIR} ${tgt_path})
- 
-   if (NOT tgt_type STREQUAL "INTERFACE_LIBRARY")
+This is the one remaining Polly install dirs related change that hasn't made it
+into upstream yet; previously this patch file also included:
+https://reviews.llvm.org/D117541
+
 diff --git a/tools/polly/cmake/polly_macros.cmake b/tools/polly/cmake/polly_macros.cmake
 index 518a09b45a42..bd9d6f5542ad 100644
 --- a/tools/polly/cmake/polly_macros.cmake
@@ -87,16 +17,3 @@ index 518a09b45a42..bd9d6f5542ad 100644
    endif()
    set_property(GLOBAL APPEND PROPERTY LLVM_EXPORTS ${name})
  endmacro(add_polly_library)
-diff --git a/tools/polly/lib/External/CMakeLists.txt b/tools/polly/lib/External/CMakeLists.txt
-index e3a5683fccdc..293b482eb28a 100644
---- a/tools/polly/lib/External/CMakeLists.txt
-+++ b/tools/polly/lib/External/CMakeLists.txt
-@@ -290,7 +290,7 @@ if (POLLY_BUNDLED_ISL)
-     install(DIRECTORY
-       ${ISL_SOURCE_DIR}/include/
-       ${ISL_BINARY_DIR}/include/
--      DESTINATION include/polly
-+      DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/polly
-       FILES_MATCHING
-       PATTERN "*.h"
-       PATTERN "CMakeFiles" EXCLUDE
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index 79cf81f0816e..635886e256ae 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -1,6 +1,6 @@
 { lowPrio, newScope, pkgs, lib, stdenv, cmake, ninja
 , gccForLibs, preLibcCrossHeaders
-, libxml2, python3, isl, fetchFromGitHub, overrideCC, wrapCCWith, wrapBintoolsWith
+, libxml2, python3, fetchFromGitHub, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 # This is the default binutils, but with *this* version of LLD rather
@@ -40,7 +40,7 @@ let
   };
 
   tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake ninja libxml2 python3 isl release_version version monorepoSrc buildLlvmTools; });
+    callPackage = newScope (tools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc buildLlvmTools; });
     mkExtraBuildCommands0 = cc: ''
       rsrc="$out/resource-root"
       mkdir "$rsrc"
@@ -220,7 +220,7 @@ let
   });
 
   libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake ninja libxml2 python3 isl release_version version monorepoSrc; });
+    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc; });
   in {
 
     compiler-rt-libc = callPackage ./compiler-rt {
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 6651d6347e6e..140c2db71f54 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -24,7 +24,7 @@
   || stdenv.isAarch64 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
   || stdenv.isAarch32 # broken for the armv7l builder
 )
-, enablePolly ? false
+, enablePolly ? true
 } @args:
 
 let
@@ -44,7 +44,8 @@ in stdenv.mkDerivation (rec {
     cp -r ${monorepoSrc}/${pname} "$out"
     cp -r ${monorepoSrc}/third-party "$out"
   '' + lib.optionalString enablePolly ''
-    cp -r ${monorepoSrc}/polly "$out/llvm/tools"
+    chmod u+w "$out/${pname}/tools"
+    cp -r ${monorepoSrc}/polly "$out/${pname}/tools"
   '');
 
   sourceRoot = "${src.name}/${pname}";
diff --git a/pkgs/development/compilers/llvm/git/llvm/gnu-install-dirs-polly.patch b/pkgs/development/compilers/llvm/git/llvm/gnu-install-dirs-polly.patch
index 98e998e65a96..b01363e98aa0 100644
--- a/pkgs/development/compilers/llvm/git/llvm/gnu-install-dirs-polly.patch
+++ b/pkgs/development/compilers/llvm/git/llvm/gnu-install-dirs-polly.patch
@@ -1,77 +1,7 @@
-diff --git a/tools/polly/CMakeLists.txt b/tools/polly/CMakeLists.txt
-index ca7c04c565bb..6a6155806ffa 100644
---- a/tools/polly/CMakeLists.txt
-+++ b/tools/polly/CMakeLists.txt
-@@ -3,6 +3,8 @@ if (NOT DEFINED LLVM_MAIN_SRC_DIR)
-   project(Polly)
-   cmake_minimum_required(VERSION 3.13.4)
- 
-+  include(GNUInstallDirs)
-+
-   # Where is LLVM installed?
-   find_package(LLVM CONFIG REQUIRED)
-   set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} ${LLVM_CMAKE_DIR})
-@@ -122,13 +124,13 @@ include_directories(
- 
- if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
-   install(DIRECTORY include/
--    DESTINATION include
-+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
-     FILES_MATCHING
-     PATTERN "*.h"
-     )
- 
-   install(DIRECTORY ${POLLY_BINARY_DIR}/include/
--    DESTINATION include
-+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
-     FILES_MATCHING
-     PATTERN "*.h"
-     PATTERN "CMakeFiles" EXCLUDE
-diff --git a/tools/polly/cmake/CMakeLists.txt b/tools/polly/cmake/CMakeLists.txt
-index 7cc129ba2e90..137be25e4b80 100644
---- a/tools/polly/cmake/CMakeLists.txt
-+++ b/tools/polly/cmake/CMakeLists.txt
-@@ -79,18 +79,18 @@ file(GENERATE
- 
- # Generate PollyConfig.cmake for the install tree.
- unset(POLLY_EXPORTS)
--set(POLLY_INSTALL_PREFIX "${CMAKE_INSTALL_PREFIX}")
-+set(POLLY_INSTALL_PREFIX "")
- set(POLLY_CONFIG_LLVM_CMAKE_DIR "${LLVM_BINARY_DIR}/${LLVM_INSTALL_PACKAGE_DIR}")
--set(POLLY_CONFIG_CMAKE_DIR "${POLLY_INSTALL_PREFIX}/${POLLY_INSTALL_PACKAGE_DIR}")
--set(POLLY_CONFIG_LIBRARY_DIRS "${POLLY_INSTALL_PREFIX}/lib${LLVM_LIBDIR_SUFFIX}")
-+set(POLLY_CONFIG_CMAKE_DIR "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_PREFIX}/${POLLY_INSTALL_PACKAGE_DIR}")
-+set(POLLY_CONFIG_LIBRARY_DIRS "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
- if (POLLY_BUNDLED_ISL)
-   set(POLLY_CONFIG_INCLUDE_DIRS
--    "${POLLY_INSTALL_PREFIX}/include"
--    "${POLLY_INSTALL_PREFIX}/include/polly"
-+    "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_LIBDIR}"
-+    "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_LIBDIR}/polly"
-     )
- else()
-   set(POLLY_CONFIG_INCLUDE_DIRS
--    "${POLLY_INSTALL_PREFIX}/include"
-+    "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_INCLUDEDIR}"
-     ${ISL_INCLUDE_DIRS}
-     )
- endif()
-@@ -100,12 +100,12 @@ endif()
- foreach(tgt IN LISTS POLLY_CONFIG_EXPORTED_TARGETS)
-   get_target_property(tgt_type ${tgt} TYPE)
-   if (tgt_type STREQUAL "EXECUTABLE")
--    set(tgt_prefix "bin/")
-+    set(tgt_prefix "${CMAKE_INSTALL_BINDIR}/")
-   else()
--    set(tgt_prefix "lib/")
-+    set(tgt_prefix "${CMAKE_INSTALL_LIBDIR}/")
-   endif()
- 
--  set(tgt_path "${CMAKE_INSTALL_PREFIX}/${tgt_prefix}$<TARGET_FILE_NAME:${tgt}>")
-+  set(tgt_path "${tgt_prefix}$<TARGET_FILE_NAME:${tgt}>")
-   file(RELATIVE_PATH tgt_path ${POLLY_CONFIG_CMAKE_DIR} ${tgt_path})
- 
-   if (NOT tgt_type STREQUAL "INTERFACE_LIBRARY")
+This is the one remaining Polly install dirs related change that hasn't made it
+into upstream yet; previously this patch file also included:
+https://reviews.llvm.org/D117541
+
 diff --git a/tools/polly/cmake/polly_macros.cmake b/tools/polly/cmake/polly_macros.cmake
 index 518a09b45a42..bd9d6f5542ad 100644
 --- a/tools/polly/cmake/polly_macros.cmake
@@ -87,16 +17,3 @@ index 518a09b45a42..bd9d6f5542ad 100644
    endif()
    set_property(GLOBAL APPEND PROPERTY LLVM_EXPORTS ${name})
  endmacro(add_polly_library)
-diff --git a/tools/polly/lib/External/CMakeLists.txt b/tools/polly/lib/External/CMakeLists.txt
-index e3a5683fccdc..293b482eb28a 100644
---- a/tools/polly/lib/External/CMakeLists.txt
-+++ b/tools/polly/lib/External/CMakeLists.txt
-@@ -290,7 +290,7 @@ if (POLLY_BUNDLED_ISL)
-     install(DIRECTORY
-       ${ISL_SOURCE_DIR}/include/
-       ${ISL_BINARY_DIR}/include/
--      DESTINATION include/polly
-+      DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/polly
-       FILES_MATCHING
-       PATTERN "*.h"
-       PATTERN "CMakeFiles" EXCLUDE

From c5f758174b1cd78402dbf32511c4b9532a4bc1ae Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 27 Feb 2023 11:08:50 +0000
Subject: [PATCH 079/154] clang: drop the C++ std version `-DCMAKE_CXX_FLAG`

Port of 404ef6b6c92 ("llvmPackages_15.clang: drop the C++ std version
`-DCMAKE_CXX_FLAG`").  The commit mentioned as removing the need for
the override[1] first appeared in LLVM 10.

[1]: https://github.com/llvm/llvm-project/commit/2724d9e12960cc1d93eeabbfc9aa1bffffa041cc
---
 pkgs/development/compilers/llvm/10/clang/default.nix  | 1 -
 pkgs/development/compilers/llvm/11/clang/default.nix  | 1 -
 pkgs/development/compilers/llvm/12/clang/default.nix  | 1 -
 pkgs/development/compilers/llvm/13/clang/default.nix  | 1 -
 pkgs/development/compilers/llvm/14/clang/default.nix  | 1 -
 pkgs/development/compilers/llvm/git/clang/default.nix | 1 -
 6 files changed, 6 deletions(-)

diff --git a/pkgs/development/compilers/llvm/10/clang/default.nix b/pkgs/development/compilers/llvm/10/clang/default.nix
index 8a48436680ea..3d503c9b9139 100644
--- a/pkgs/development/compilers/llvm/10/clang/default.nix
+++ b/pkgs/development/compilers/llvm/10/clang/default.nix
@@ -26,7 +26,6 @@ let
     buildInputs = [ libxml2 libllvm ];
 
     cmakeFlags = [
-      "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
     ] ++ lib.optionals enableManpages [
diff --git a/pkgs/development/compilers/llvm/11/clang/default.nix b/pkgs/development/compilers/llvm/11/clang/default.nix
index 65554d0bfd4c..a721c243b46a 100644
--- a/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@@ -28,7 +28,6 @@ let
     buildInputs = [ libxml2 libllvm ];
 
     cmakeFlags = [
-      "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
     ] ++ lib.optionals enableManpages [
diff --git a/pkgs/development/compilers/llvm/12/clang/default.nix b/pkgs/development/compilers/llvm/12/clang/default.nix
index a70da922d941..acccb55c2f89 100644
--- a/pkgs/development/compilers/llvm/12/clang/default.nix
+++ b/pkgs/development/compilers/llvm/12/clang/default.nix
@@ -29,7 +29,6 @@ let
     buildInputs = [ libxml2 libllvm ];
 
     cmakeFlags = [
-      "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
     ] ++ lib.optionals enableManpages [
diff --git a/pkgs/development/compilers/llvm/13/clang/default.nix b/pkgs/development/compilers/llvm/13/clang/default.nix
index 783188c03573..f1a3e74fa6bc 100644
--- a/pkgs/development/compilers/llvm/13/clang/default.nix
+++ b/pkgs/development/compilers/llvm/13/clang/default.nix
@@ -19,7 +19,6 @@ let
     buildInputs = [ libxml2 libllvm ];
 
     cmakeFlags = [
-      "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
     ] ++ lib.optionals enableManpages [
diff --git a/pkgs/development/compilers/llvm/14/clang/default.nix b/pkgs/development/compilers/llvm/14/clang/default.nix
index f325a55a2703..901e41a58fa7 100644
--- a/pkgs/development/compilers/llvm/14/clang/default.nix
+++ b/pkgs/development/compilers/llvm/14/clang/default.nix
@@ -27,7 +27,6 @@ let
     buildInputs = [ libxml2 libllvm ];
 
     cmakeFlags = [
-      "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
     ] ++ lib.optionals enableManpages [
diff --git a/pkgs/development/compilers/llvm/git/clang/default.nix b/pkgs/development/compilers/llvm/git/clang/default.nix
index 1fbbf4cbd642..4963d0ecce60 100644
--- a/pkgs/development/compilers/llvm/git/clang/default.nix
+++ b/pkgs/development/compilers/llvm/git/clang/default.nix
@@ -28,7 +28,6 @@ let
 
     cmakeFlags = [
       "-DCLANG_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/cmake/clang"
-      "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
     ] ++ lib.optionals enableManpages [

From c1a2a95aacd4a5c4b5fd278b31977b09d758b259 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Stanis=C5=82aw=20Pitucha?= <git@viraptor.info>
Date: Wed, 8 Mar 2023 16:50:57 +1100
Subject: [PATCH 080/154] ruby_3_1,ruby_3_0,ruby_2_7: allow enabling dtrace
 support on linux

---
 pkgs/development/interpreters/ruby/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 2bab78ecd419..bdb34a49e870 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -5,6 +5,7 @@
 , buildEnv, bundler, bundix
 , makeWrapper, buildRubyGem, defaultGemConfig, removeReferencesTo
 , openssl, openssl_1_1
+, linuxPackages, libsystemtap
 } @ args:
 
 let
@@ -34,6 +35,7 @@ let
       , libyaml, yamlSupport ? true
       , libffi, fiddleSupport ? true
       , jemalloc, jemallocSupport ? false
+      , linuxPackages, systemtap ? linuxPackages.systemtap, libsystemtap, dtraceSupport ? false
       # By default, ruby has 3 observed references to stdenv.cc:
       #
       # - If you run:
@@ -71,6 +73,7 @@ let
 
         nativeBuildInputs = [ autoreconfHook bison ]
           ++ (op docSupport groff)
+          ++ (ops (dtraceSupport && stdenv.isLinux) [ systemtap libsystemtap ])
           ++ op useBaseRuby baseRuby;
         buildInputs = [ autoconf ]
           ++ (op fiddleSupport libffi)
@@ -141,6 +144,7 @@ let
           (lib.enableFeature true "pthread")
           (lib.withFeatureAs true "soname" "ruby-${version}")
           (lib.withFeatureAs useBaseRuby "baseruby" "${baseRuby}/bin/ruby")
+          (lib.enableFeature dtraceSupport "dtrace")
           (lib.enableFeature jitSupport "jit-support")
           (lib.enableFeature docSupport "install-doc")
           (lib.withFeature jemallocSupport "jemalloc")

From 3816765e472a98482e26d0831a84d3b27cb56db8 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Tue, 28 Feb 2023 15:22:07 +0000
Subject: [PATCH 081/154] llvm: add in a missing check dep

Port of 6d0c87602fe ("llvmPackages_15.llvm: add in a missing check
dep").

I did not include the sysctl nativeCheckInputs change from that
commit, as it looks like it was included by mistake and was supposed
to be in c7231c0b6d8 ("llvmPackages_15.llvm: run the tests on macOS").
I've also included the doCheck default from that commit (without the
change to run on non-Linux), as 6d0c87602fe just set it to true.
---
 .../compilers/llvm/10/llvm/default.nix        | 30 +++++++++++++++++--
 .../compilers/llvm/11/llvm/default.nix        | 30 +++++++++++++++++--
 .../compilers/llvm/12/llvm/default.nix        | 30 +++++++++++++++++--
 .../compilers/llvm/13/llvm/default.nix        | 30 +++++++++++++++++--
 .../compilers/llvm/14/llvm/default.nix        | 30 +++++++++++++++++--
 .../compilers/llvm/6/llvm/default.nix         | 30 +++++++++++++++++--
 .../compilers/llvm/7/llvm/default.nix         | 30 +++++++++++++++++--
 .../compilers/llvm/8/llvm/default.nix         | 30 +++++++++++++++++--
 .../compilers/llvm/9/llvm/default.nix         | 30 +++++++++++++++++--
 .../compilers/llvm/git/llvm/default.nix       | 30 +++++++++++++++++--
 10 files changed, 270 insertions(+), 30 deletions(-)

diff --git a/pkgs/development/compilers/llvm/10/llvm/default.nix b/pkgs/development/compilers/llvm/10/llvm/default.nix
index 41c20ac47ebf..fba387adf867 100644
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@@ -15,6 +15,8 @@
 , zlib
 , buildLlvmTools
 , debugVersion ? false
+, doCheck ? stdenv.isLinux && (!stdenv.isx86_32)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
@@ -30,6 +32,29 @@ let
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitString "." release_version));
 
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
+
 in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
@@ -48,7 +73,7 @@ in stdenv.mkDerivation (rec {
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake python3 ]
+  nativeBuildInputs = [ cmake python ]
     ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
 
   buildInputs = [ libxml2 libffi ]
@@ -255,8 +280,7 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/11/llvm/default.nix b/pkgs/development/compilers/llvm/11/llvm/default.nix
index 93cf2757c652..df9749fe1c27 100644
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@@ -15,6 +15,8 @@
 , zlib
 , buildLlvmTools
 , debugVersion ? false
+, doCheck ? stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl) && (!stdenv.hostPlatform.isRiscV)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
@@ -30,6 +32,29 @@ let
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitString "." release_version));
 
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
+
 in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
@@ -48,7 +73,7 @@ in stdenv.mkDerivation (rec {
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake python3 ]
+  nativeBuildInputs = [ cmake python ]
     ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
 
   buildInputs = [ libxml2 libffi ]
@@ -267,8 +292,7 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl) && (!stdenv.hostPlatform.isRiscV)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/12/llvm/default.nix b/pkgs/development/compilers/llvm/12/llvm/default.nix
index 3d5592e19ee5..2d7f70540dd8 100644
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/12/llvm/default.nix
@@ -15,6 +15,8 @@
 , zlib
 , buildLlvmTools
 , debugVersion ? false
+, doCheck ? stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
@@ -30,6 +32,29 @@ let
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitString "." release_version));
 
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
+
 in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
@@ -48,7 +73,7 @@ in stdenv.mkDerivation (rec {
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake python3 ]
+  nativeBuildInputs = [ cmake python ]
     ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
 
   buildInputs = [ libxml2 libffi ]
@@ -255,8 +280,7 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/13/llvm/default.nix b/pkgs/development/compilers/llvm/13/llvm/default.nix
index e2d6da816f32..f3a9ced70e19 100644
--- a/pkgs/development/compilers/llvm/13/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/13/llvm/default.nix
@@ -16,6 +16,8 @@
 , which
 , buildLlvmTools
 , debugVersion ? false
+, doCheck ? stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
@@ -31,6 +33,29 @@ let
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitString "." release_version));
 
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
+
 in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
@@ -40,7 +65,7 @@ in stdenv.mkDerivation (rec {
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake python3 ]
+  nativeBuildInputs = [ cmake python ]
     ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
 
   buildInputs = [ libxml2 libffi ]
@@ -217,8 +242,7 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/14/llvm/default.nix b/pkgs/development/compilers/llvm/14/llvm/default.nix
index 9bd24b9ac068..e4c004d24ac3 100644
--- a/pkgs/development/compilers/llvm/14/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/14/llvm/default.nix
@@ -17,6 +17,8 @@
 , which
 , buildLlvmTools
 , debugVersion ? false
+, doCheck ? stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
@@ -32,6 +34,29 @@ let
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitString "." release_version));
 
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
+
 in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
@@ -50,7 +75,7 @@ in stdenv.mkDerivation (rec {
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake python3 ]
+  nativeBuildInputs = [ cmake python ]
     ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
 
   buildInputs = [ libxml2 libffi ]
@@ -230,8 +255,7 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/6/llvm/default.nix b/pkgs/development/compilers/llvm/6/llvm/default.nix
index 954887cd2368..22a3970f76ce 100644
--- a/pkgs/development/compilers/llvm/6/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/6/llvm/default.nix
@@ -13,6 +13,8 @@
 , zlib
 , buildLlvmTools
 , fetchpatch
+, doCheck ? stdenv.isLinux && (!stdenv.isi686)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , debugVersion ? false
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
@@ -26,6 +28,29 @@ let
   versionSuffixes = with lib;
     let parts = splitVersion release_version; in
     imap (i: _: concatStringsSep "." (take i parts)) parts;
+
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
 in
 
 stdenv.mkDerivation (rec {
@@ -46,7 +71,7 @@ stdenv.mkDerivation (rec {
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake python3 ]
+  nativeBuildInputs = [ cmake python ]
     ++ optional enableManpages python3.pkgs.sphinx;
 
   buildInputs = [ libxml2 libffi ];
@@ -227,8 +252,7 @@ stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isi686)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/7/llvm/default.nix b/pkgs/development/compilers/llvm/7/llvm/default.nix
index eaeef3c2ef50..185ae884442e 100644
--- a/pkgs/development/compilers/llvm/7/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/7/llvm/default.nix
@@ -15,6 +15,8 @@
 , zlib
 , buildLlvmTools
 , debugVersion ? false
+, doCheck ? stdenv.isLinux && (!stdenv.isx86_32)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
@@ -31,6 +33,29 @@ let
     let parts = splitVersion release_version; in
     imap (i: _: concatStringsSep "." (take i parts)) parts;
 
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
+
 in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
@@ -49,7 +74,7 @@ in stdenv.mkDerivation (rec {
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake python3 ]
+  nativeBuildInputs = [ cmake python ]
     ++ optional enableManpages python3.pkgs.sphinx;
 
   buildInputs = [ libxml2 libffi ]
@@ -245,8 +270,7 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/8/llvm/default.nix b/pkgs/development/compilers/llvm/8/llvm/default.nix
index aa76fc0c3cf7..3b0877115e06 100644
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@@ -15,6 +15,8 @@
 , zlib
 , buildLlvmTools
 , debugVersion ? false
+, doCheck ? stdenv.isLinux && (!stdenv.isx86_32)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
@@ -30,6 +32,29 @@ let
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitVersion release_version));
 
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
+
 in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
@@ -48,7 +73,7 @@ in stdenv.mkDerivation (rec {
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake python3 ]
+  nativeBuildInputs = [ cmake python ]
     ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
 
   buildInputs = [ libxml2 libffi ]
@@ -237,8 +262,7 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/9/llvm/default.nix b/pkgs/development/compilers/llvm/9/llvm/default.nix
index 89bc014f5c65..0838fd8c5844 100644
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@@ -15,6 +15,8 @@
 , zlib
 , buildLlvmTools
 , debugVersion ? false
+, doCheck ? stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isRiscV)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
@@ -30,6 +32,29 @@ let
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitString "." release_version));
 
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
+
 in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
@@ -48,7 +73,7 @@ in stdenv.mkDerivation (rec {
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake python3 ]
+  nativeBuildInputs = [ cmake python ]
     ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
 
   buildInputs = [ libxml2 libffi ]
@@ -252,8 +277,7 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isRiscV)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 140c2db71f54..1daeb745e588 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -18,6 +18,8 @@
 , which
 , buildLlvmTools
 , debugVersion ? false
+, doCheck ? stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
 , enablePFM ? !(stdenv.isDarwin
@@ -34,6 +36,29 @@ let
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitString "." release_version));
 
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in python3.withPackages checkDeps
+  else python3;
+
 in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
@@ -52,7 +77,7 @@ in stdenv.mkDerivation (rec {
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake ninja python3 ]
+  nativeBuildInputs = [ cmake ninja python ]
     ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
 
   buildInputs = [ libxml2 libffi ]
@@ -217,8 +242,7 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
+  inherit doCheck;
 
   checkTarget = "check-all";
 

From 0fd04a591802cb92a244528eb1c65d68417df55d Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 27 Feb 2023 21:06:11 +0000
Subject: [PATCH 082/154] llvmPackages.compiler-rt: enable
 libclang_rt.profile-....a build

Port of 94cad6ec1ad ("llvm 14 compiler-rt: enable
libclang_rt.profile-....a build").
---
 pkgs/development/compilers/llvm/10/compiler-rt/default.nix  | 1 +
 pkgs/development/compilers/llvm/11/compiler-rt/default.nix  | 1 +
 pkgs/development/compilers/llvm/12/compiler-rt/default.nix  | 3 ++-
 pkgs/development/compilers/llvm/13/compiler-rt/default.nix  | 3 ++-
 pkgs/development/compilers/llvm/15/compiler-rt/default.nix  | 2 +-
 pkgs/development/compilers/llvm/5/compiler-rt/default.nix   | 1 +
 pkgs/development/compilers/llvm/6/compiler-rt/default.nix   | 1 +
 pkgs/development/compilers/llvm/7/compiler-rt/default.nix   | 1 +
 pkgs/development/compilers/llvm/8/compiler-rt/default.nix   | 1 +
 pkgs/development/compilers/llvm/9/compiler-rt/default.nix   | 1 +
 pkgs/development/compilers/llvm/git/compiler-rt/default.nix | 3 ++-
 11 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
index f113e55f2849..5c9658f18946 100644
--- a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
@@ -33,6 +33,7 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+  ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals ((useLLVM || bareMetal) && !haveLibc) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
index 979ec9e23f65..a52d4d7bdb72 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+  ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals (!haveLibc || bareMetal) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
diff --git a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
index 22e2ab9d5b2b..81889c721859 100644
--- a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
@@ -34,8 +34,9 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
-    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
     "-DCOMPILER_RT_BUILD_MEMPROF=OFF"
+  ] ++ lib.optionals (useLLVM || bareMetal) [
+    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals ((useLLVM && !haveLibc) || bareMetal) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
     "-DCMAKE_CXX_COMPILER_WORKS=ON"
diff --git a/pkgs/development/compilers/llvm/13/compiler-rt/default.nix b/pkgs/development/compilers/llvm/13/compiler-rt/default.nix
index 02ddabad6769..7c5592bd1235 100644
--- a/pkgs/development/compilers/llvm/13/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/13/compiler-rt/default.nix
@@ -37,9 +37,10 @@ stdenv.mkDerivation {
   ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
-    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
     "-DCOMPILER_RT_BUILD_MEMPROF=OFF"
     "-DCOMPILER_RT_BUILD_ORC=OFF" # may be possible to build with musl if necessary
+  ] ++ lib.optionals (useLLVM || bareMetal) [
+    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals ((useLLVM && !haveLibc) || bareMetal) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
     "-DCMAKE_CXX_COMPILER_WORKS=ON"
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/default.nix b/pkgs/development/compilers/llvm/15/compiler-rt/default.nix
index 18ff90b6ff00..a3f2355c6a0b 100644
--- a/pkgs/development/compilers/llvm/15/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/15/compiler-rt/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_BUILD_MEMPROF=OFF"
     "-DCOMPILER_RT_BUILD_ORC=OFF" # may be possible to build with musl if necessary
   ] ++ lib.optionals (useLLVM || bareMetal) [
-     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
+    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals ((useLLVM && !haveLibc) || bareMetal) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
     "-DCMAKE_CXX_COMPILER_WORKS=ON"
diff --git a/pkgs/development/compilers/llvm/5/compiler-rt/default.nix b/pkgs/development/compilers/llvm/5/compiler-rt/default.nix
index bf3edf5258a0..fede3347e42b 100644
--- a/pkgs/development/compilers/llvm/5/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/5/compiler-rt/default.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+  ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
diff --git a/pkgs/development/compilers/llvm/6/compiler-rt/default.nix b/pkgs/development/compilers/llvm/6/compiler-rt/default.nix
index ce7d6161f620..1288bd9bd0f2 100644
--- a/pkgs/development/compilers/llvm/6/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/6/compiler-rt/default.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+  ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
diff --git a/pkgs/development/compilers/llvm/7/compiler-rt/default.nix b/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
index 2de67dc04386..4b4c30a43235 100644
--- a/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+  ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals ((useLLVM || bareMetal) && !haveLibc) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
diff --git a/pkgs/development/compilers/llvm/8/compiler-rt/default.nix b/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
index eadb46acd709..2ac116f68988 100644
--- a/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+  ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals ((useLLVM || bareMetal) && !haveLibc) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
diff --git a/pkgs/development/compilers/llvm/9/compiler-rt/default.nix b/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
index be7380470ce9..6e7ab5a29ff9 100644
--- a/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+  ] ++ lib.optionals (useLLVM || bareMetal) [
     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals ((useLLVM || bareMetal) && !haveLibc) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
diff --git a/pkgs/development/compilers/llvm/git/compiler-rt/default.nix b/pkgs/development/compilers/llvm/git/compiler-rt/default.nix
index aee403d6a695..1abb0a411655 100644
--- a/pkgs/development/compilers/llvm/git/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/git/compiler-rt/default.nix
@@ -45,9 +45,10 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
-    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
     "-DCOMPILER_RT_BUILD_MEMPROF=OFF"
     "-DCOMPILER_RT_BUILD_ORC=OFF" # may be possible to build with musl if necessary
+  ] ++ lib.optionals (useLLVM || bareMetal) [
+    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
   ] ++ lib.optionals ((useLLVM && !haveLibc) || bareMetal) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
     "-DCMAKE_CXX_COMPILER_WORKS=ON"

From d23059ce150f9dc4fbb1694bbcf1ef7199c1cc40 Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Fri, 10 Mar 2023 20:28:39 +0100
Subject: [PATCH 083/154] bundler: 2.4.7 -> 2.4.8

---
 pkgs/development/ruby-modules/bundler/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index 675dd498ef33..749ccf0a29c7 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.4.7";
-  source.sha256 = "sha256-sZQdZAWJD7PaH8qs+NDWTu5Cd3YBnOGIVs+GOxP9H7k=";
+  version = "2.4.8";
+  source.sha256 = "sha256-/oLW+JPyFz4TIykm4rnOtvZwJ8fxZr/B49bsfZaZoWQ=";
   dontPatchShebangs = true;
 
   postFixup = ''

From 925510b397b2fa27d44109ac4704a9a354e34e79 Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Fri, 10 Mar 2023 21:44:00 +0100
Subject: [PATCH 084/154] w3m: 0.5.3+git20220429 -> 0.5.3+git20230121

---
 .../networking/browsers/w3m/default.nix             | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/w3m/default.nix b/pkgs/applications/networking/browsers/w3m/default.nix
index 1f53c184b3b0..e4a064e79059 100644
--- a/pkgs/applications/networking/browsers/w3m/default.nix
+++ b/pkgs/applications/networking/browsers/w3m/default.nix
@@ -5,6 +5,7 @@
 , x11Support ? graphicsSupport, libX11
 , mouseSupport ? !stdenv.isDarwin, gpm-ncurses
 , perl, man, pkg-config, buildPackages, w3m
+, testers
 }:
 
 let
@@ -19,13 +20,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "w3m";
-  version = "0.5.3+git20220429";
+  version = "0.5.3+git20230121";
 
   src = fetchFromGitHub {
     owner = "tats";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-aPPLZjjL3A5Tk0hv0NoAwJnjemC7a5RUoubhUr3lQE4=";
+    hash = "sha256-upb5lWqhC1jRegzTncIz5e21v4Pw912FyVn217HucFs=";
   };
 
   NIX_LDFLAGS = lib.optionalString stdenv.isSunOS "-lsocket -lnsl";
@@ -84,11 +85,19 @@ in stdenv.mkDerivation rec {
   # see: https://bbs.archlinux.org/viewtopic.php?id=196093
   LIBS = lib.optionalString x11Support "-lX11";
 
+  passthru.tests.version = testers.testVersion {
+    inherit version;
+    package = w3m;
+    command = "w3m -version";
+  };
+
   meta = with lib; {
     homepage = "https://w3m.sourceforge.net/";
+    changelog = "https://github.com/tats/w3m/blob/v${version}/ChangeLog";
     description = "A text-mode web browser";
     maintainers = with maintainers; [ cstrahan anthonyroussel ];
     platforms = platforms.unix;
     license = licenses.mit;
+    mainProgram = "w3m";
   };
 }

From 279a5e27d0a5fbe61e1dd30c3658408fb93732ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lo=C3=AFc=20Reynier?= <loic@loicreynier.fr>
Date: Fri, 10 Mar 2023 21:35:04 +0100
Subject: [PATCH 085/154] python3Packages.myst-parser: 0.19.1 -> 1.0.0

---
 pkgs/development/python-modules/myst-parser/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/myst-parser/default.nix b/pkgs/development/python-modules/myst-parser/default.nix
index 8ae2ca918bc8..043ee2992bd0 100644
--- a/pkgs/development/python-modules/myst-parser/default.nix
+++ b/pkgs/development/python-modules/myst-parser/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "myst-parser";
-  version = "0.19.1";
+  version = "1.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "executablebooks";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-dmvtRvVOF6lxeC+CC/dwkIs4VRDAZtlmblh9uaV+lW0=";
+    hash = "sha256-Kewd6/4yawpRuyCe8Na0BGUMo59tr2fc97VlGbVJ8mI=";
   };
 
   nativeBuildInputs = [ flit-core ];

From 8e8be88067fc568d81f88ad6a93fd03218d9ca60 Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Sat, 11 Mar 2023 11:52:03 -0300
Subject: [PATCH 086/154] SDL2: 2.26.3 -> 2.26.4

Release: https://github.com/libsdl-org/SDL/releases/tag/release-2.26.4
---
 pkgs/development/libraries/SDL2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 91f0af4e7ea1..6bf606c5a233 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -57,11 +57,11 @@
 
 stdenv.mkDerivation rec {
   pname = "SDL2";
-  version = "2.26.3";
+  version = "2.26.4";
 
   src = fetchurl {
     url = "https://www.libsdl.org/release/${pname}-${version}.tar.gz";
-    sha256 = "sha256-xmEgWlU7fSUkJfS3Uf8TIJ5eAguHa7+hWYSUr2F5AFc=";
+    sha256 = "sha256-Gg9oZJj7dorZ8/gLOQN6fQBurAk6rTnLTrzIMqiIcjE=";
   };
   dontDisableStatic = if withStatic then 1 else 0;
   outputs = [ "out" "dev" ];

From 490e77ce0aca322268bd64c3508e26be2fc784f1 Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Sat, 11 Mar 2023 11:55:48 -0300
Subject: [PATCH 087/154] SDL2: add superherointj as maintainer

---
 pkgs/development/libraries/SDL2/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 6bf606c5a233..520a3fd8af3f 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -173,6 +173,6 @@ stdenv.mkDerivation rec {
     homepage = "http://www.libsdl.org/";
     license = licenses.zlib;
     platforms = platforms.all;
-    maintainers = with maintainers; [ cpages ];
+    maintainers = with maintainers; [ cpages superherointj ];
   };
 }

From 4ffa52ebdf80bb217929ab94148a8021d58cb4fa Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Thu, 23 Feb 2023 14:59:48 +0000
Subject: [PATCH 088/154] llvmPackages_git.libcxx: use clang from git instead
 of the stdenv's compiler

Port of ca59a201ca1 ("llvmPackages_15.libcxx: use clang 15 instead of
the stdenv's compiler").
---
 .../compilers/llvm/git/default.nix            | 34 +++++++++++++------
 .../compilers/llvm/git/libcxxabi/default.nix  |  7 ++++
 2 files changed, 30 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index d7a5fb4c913f..27fdea9d4553 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -257,27 +257,39 @@ let
 
     libcxxStdenv = overrideCC stdenv buildLlvmTools.libcxxClang;
 
-    libcxx = callPackage ./libcxx {
-      inherit llvm_meta;
-      stdenv = if stdenv.hostPlatform.useLLVM or false
-               then overrideCC stdenv buildLlvmTools.clangNoLibcxx
-               else stdenv;
-    };
-
     libcxxabi = let
-      stdenv_ = if stdenv.hostPlatform.useLLVM or false
-               then overrideCC stdenv buildLlvmTools.clangNoLibcxx
-               else stdenv;
+      # CMake will "require" a compiler capable of compiling C++ programs
+      # cxx-header's build does not actually use one so it doesn't really matter
+      # what stdenv we use here, as long as CMake is happy.
       cxx-headers = callPackage ./libcxx {
         inherit llvm_meta;
-        stdenv = stdenv_;
         headersOnly = true;
       };
+
+      # `libcxxabi` *doesn't* need a compiler with a working C++ stdlib but it
+      # *does* need a relatively modern C++ compiler (see:
+      # https://releases.llvm.org/15.0.0/projects/libcxx/docs/index.html#platform-and-compiler-support).
+      #
+      # So, we use the clang from this LLVM package set, like libc++
+      # "boostrapping builds" do:
+      # https://releases.llvm.org/15.0.0/projects/libcxx/docs/BuildingLibcxx.html#bootstrapping-build
+      #
+      # We cannot use `clangNoLibcxx` because that contains `compiler-rt` which,
+      # on macOS, depends on `libcxxabi`, thus forming a cycle.
+      stdenv_ = overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc;
     in callPackage ./libcxxabi {
       stdenv = stdenv_;
       inherit llvm_meta cxx-headers;
     };
 
+    # Like `libcxxabi` above, `libcxx` requires a fairly modern C++ compiler,
+    # so: we use the clang from this LLVM package set instead of the regular
+    # stdenv's compiler.
+    libcxx = callPackage ./libcxx {
+      inherit llvm_meta;
+      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
+    };
+
     libunwind = callPackage ./libunwind {
       inherit llvm_meta;
       stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
diff --git a/pkgs/development/compilers/llvm/git/libcxxabi/default.nix b/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
index a36fb10b00ee..65c585181a70 100644
--- a/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
@@ -58,6 +58,13 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-DLLVM_ENABLE_RUNTIMES=libcxxabi"
     "-DLIBCXXABI_LIBCXX_INCLUDES=${cxx-headers}/include/c++/v1"
+
+    # `libcxxabi`'s build does not need a toolchain with a c++ stdlib attached
+    # (we specify the headers it should use explicitly above).
+    #
+    # CMake however checks for this anyways; this flag tells it not to. See:
+    # https://github.com/llvm/llvm-project/blob/4bd3f3759259548e159aeba5c76efb9a0864e6fa/llvm/runtimes/CMakeLists.txt#L243
+    "-DCMAKE_CXX_COMPILER_WORKS=ON"
   ] ++ lib.optionals (stdenv.hostPlatform.useLLVM or false) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"

From 011c454a6d55e729b59532fa93109596d3fe9721 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Mar 2023 11:13:59 +0000
Subject: [PATCH 089/154] libedit: 20210910-3.1 -> 20221030-3.1

---
 pkgs/development/libraries/libedit/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libedit/default.nix b/pkgs/development/libraries/libedit/default.nix
index 0e65ca8a6ff4..c36d882c0aeb 100644
--- a/pkgs/development/libraries/libedit/default.nix
+++ b/pkgs/development/libraries/libedit/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libedit";
-  version = "20210910-3.1";
+  version = "20221030-3.1";
 
   src = fetchurl {
     url = "https://thrysoee.dk/editline/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Z5KmqZIFB2LtzKKP8zGM233jfcz3vDDbWfzXAX7tE8U=";
+    sha256 = "sha256-8JJaWt9LG/EW7hl2a32qdmkXrsGYdHlDscTt9npL4rs=";
   };
 
   outputs = [ "out" "dev" ];

From 94c7bf576a44829a676fb172bfceaefff4eb90f0 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sun, 12 Mar 2023 12:00:00 +0000
Subject: [PATCH 090/154] separate-debug-info.sh: succeed when output does not
 contain elf files

Currently, separate-debug-info adds a debug output, and the build fail when it is
not created. the output is only created when at least one elf file is
stripped.
As a result, adding separateDebugInfo = true on a lib will break the
static build (unless the lib also contains an executable). In order to
not have to remember to add an exception every time, let's just create
the debug output unconditionally.
---
 pkgs/build-support/setup-hooks/separate-debug-info.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/build-support/setup-hooks/separate-debug-info.sh b/pkgs/build-support/setup-hooks/separate-debug-info.sh
index 3c8c9c294c3e..ca651b4393a1 100644
--- a/pkgs/build-support/setup-hooks/separate-debug-info.sh
+++ b/pkgs/build-support/setup-hooks/separate-debug-info.sh
@@ -11,6 +11,9 @@ _separateDebugInfo() {
     local dst="${debug:-$out}"
     if [ "$prefix" = "$dst" ]; then return 0; fi
 
+    # in case there is nothing to strip, don't fail the build
+    mkdir -p "$dst"
+
     dst="$dst/lib/debug/.build-id"
 
     # Find executables and dynamic libraries.

From 6ab299b3a36c656065d92cab3385a29e43404879 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 12 Mar 2023 11:24:11 +0000
Subject: [PATCH 091/154] openjdk: port to gnumake-4.4.1

Revert 41a6b03b89552c "revert back to gnumake-4.4 as gnumake-4.4.1
breaks the build" and aply the fix from

https://github.com/openjdk/jdk/pull/12992
---
 pkgs/development/compilers/openjdk/19.nix | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/19.nix b/pkgs/development/compilers/openjdk/19.nix
index 1ac3796cf9bb..903155cfcc58 100644
--- a/pkgs/development/compilers/openjdk/19.nix
+++ b/pkgs/development/compilers/openjdk/19.nix
@@ -9,9 +9,6 @@
 , headless ? stdenv.targetPlatform.isGhcjs
 , enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
-# Hold back make-4.4 as 4.4.1 breaks the build:
-#   https://github.com/NixOS/nixpkgs/issues/219513
-, gnumake44
 }:
 
 let
@@ -32,7 +29,7 @@ let
       hash = "sha256-pBEHmBtIgG4Czou4C/zpBBYZEDImvXiLoA5CjOzpeyI=";
     };
 
-    nativeBuildInputs = [ gnumake44 pkg-config autoconf unzip ensureNewerSourcesForZipFilesHook ];
+    nativeBuildInputs = [ pkg-config autoconf unzip ensureNewerSourcesForZipFilesHook ];
     buildInputs = [
       cpio file which zip perl zlib cups freetype alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
@@ -63,6 +60,14 @@ let
         url = "https://git.alpinelinux.org/aports/plain/testing/openjdk19/FixNullPtrCast.patch?id=93dc07f97ff716b647c5f57c6224901ea06da560";
         hash = "sha256-H4X3Yip5bCpXMH7MSu9BgXIOYRVUBMZPZW8EvZSWI5k=";
       })
+
+      # Fix build for gnumake-4.4.1:
+      #   https://github.com/openjdk/jdk/pull/12992
+      (fetchpatch {
+        name = "gnumake-4.4.1";
+        url = "https://github.com/openjdk/jdk/commit/9341d135b855cc208d48e47d30cd90aafa354c36.patch";
+        hash = "sha256-Qcm3ZmGCOYLZcskNjj7DYR85R4v07vYvvavrVOYL8vg=";
+      })
     ] ++ lib.optionals (!headless && enableGnome2) [
       ./swing-use-gtk-jdk13.patch
     ];

From 544ef3138a7f383a260f421eb7999dd917a0c414 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 12 Mar 2023 12:05:46 +0000
Subject: [PATCH 092/154] openjdk: port to gnumake-4.4.1

Revert e6d4aecb97 "revert back to gnumake-4.4 as gnumake-4.4.1
breaks the build" and aply the fix from

https://github.com/openjdk/jdk/pull/12992
---
 pkgs/development/compilers/openjdk/17.nix | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/17.nix b/pkgs/development/compilers/openjdk/17.nix
index c085d669971a..2eac6e33116a 100644
--- a/pkgs/development/compilers/openjdk/17.nix
+++ b/pkgs/development/compilers/openjdk/17.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, fetchFromGitHub, bash, pkg-config, autoconf, cpio
+{ stdenv, lib, fetchurl, fetchpatch, fetchFromGitHub, bash, pkg-config, autoconf, cpio
 , file, which, unzip, zip, perl, cups, freetype, harfbuzz, alsa-lib, libjpeg, giflib
 , libpng, zlib, lcms2, libX11, libICE, libXrender, libXext, libXt, libXtst
 , libXi, libXinerama, libXcursor, libXrandr, fontconfig, openjdk17-bootstrap
@@ -6,9 +6,6 @@
 , headless ? false
 , enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
-# Hold back make-4.4 as 4.4.1 breaks the build:
-#   https://github.com/NixOS/nixpkgs/issues/219513
-, gnumake44
 }:
 
 let
@@ -29,7 +26,7 @@ let
       sha256 = "sha256-zPpINi++3Ct0PCwlwlfhceh/ploMkclw+MgeI9dULdc=";
     };
 
-    nativeBuildInputs = [ gnumake44 pkg-config autoconf unzip ];
+    nativeBuildInputs = [ pkg-config autoconf unzip ];
     buildInputs = [
       cpio file which zip perl zlib cups freetype harfbuzz alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
@@ -61,6 +58,14 @@ let
         url = "https://git.alpinelinux.org/aports/plain/community/openjdk17/FixNullPtrCast.patch?id=41e78a067953e0b13d062d632bae6c4f8028d91c";
         sha256 = "sha256-LzmSew51+DyqqGyyMw2fbXeBluCiCYsS1nCjt9hX6zo=";
       })
+
+      # Fix build for gnumake-4.4.1:
+      #   https://github.com/openjdk/jdk/pull/12992
+      (fetchpatch {
+        name = "gnumake-4.4.1";
+        url = "https://github.com/openjdk/jdk/commit/9341d135b855cc208d48e47d30cd90aafa354c36.patch";
+        hash = "sha256-Qcm3ZmGCOYLZcskNjj7DYR85R4v07vYvvavrVOYL8vg=";
+      })
     ] ++ lib.optionals (!headless && enableGnome2) [
       ./swing-use-gtk-jdk13.patch
     ];

From 7b53fc52419ec55419853c324cfad7d1dfac79ec Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 12 Mar 2023 12:06:40 +0000
Subject: [PATCH 093/154] openjdk11: port to gnumake-4.4.1

Revert e6d4aecb97 "revert back to gnumake-4.4 as gnumake-4.4.1
breaks the build" and aply the fix from

https://github.com/openjdk/jdk/pull/12992
---
 pkgs/development/compilers/openjdk/11.nix | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/11.nix b/pkgs/development/compilers/openjdk/11.nix
index 75e2d9c17148..808b0ef2e12e 100644
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, bash, pkg-config, autoconf, cpio, file, which, unzip
+{ stdenv, lib, fetchpatch, fetchFromGitHub, bash, pkg-config, autoconf, cpio, file, which, unzip
 , zip, perl, cups, freetype, harfbuzz, alsa-lib, libjpeg, giflib, libpng, zlib, lcms2
 , libX11, libICE, libXrender, libXext, libXt, libXtst, libXi, libXinerama
 , libXcursor, libXrandr, fontconfig, openjdk11-bootstrap
@@ -6,9 +6,6 @@
 , headless ? false
 , enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
-# Hold back make-4.4 as 4.4.1 breaks the build:
-#   https://github.com/NixOS/nixpkgs/issues/219513
-, gnumake44
 }:
 
 let
@@ -28,7 +25,7 @@ let
       sha256 = "sha256-QGOpMIrWwOtIcUY/CLbTRDvcVTG2xioZu46v+n+IIQ4=";
     };
 
-    nativeBuildInputs = [ gnumake44 pkg-config autoconf unzip ];
+    nativeBuildInputs = [ pkg-config autoconf unzip ];
     buildInputs = [
       cpio file which zip perl zlib cups freetype harfbuzz alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
@@ -43,6 +40,14 @@ let
       ./currency-date-range-jdk10.patch
       ./increase-javadoc-heap.patch
       ./fix-library-path-jdk11.patch
+
+      # Fix build for gnumake-4.4.1:
+      #   https://github.com/openjdk/jdk/pull/12992
+      (fetchpatch {
+        name = "gnumake-4.4.1";
+        url = "https://github.com/openjdk/jdk/commit/9341d135b855cc208d48e47d30cd90aafa354c36.patch";
+        hash = "sha256-Qcm3ZmGCOYLZcskNjj7DYR85R4v07vYvvavrVOYL8vg=";
+      })
     ] ++ lib.optionals (!headless && enableGnome2) [
       ./swing-use-gtk-jdk10.patch
     ];

From bec778740ca0ccbc57ab7ac171a6423f563f7217 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 12 Mar 2023 12:08:45 +0000
Subject: [PATCH 094/154] gnumake44: revert "reintrocude older 4.4 version for
 openjdk"

This reverts commit d78148fb3944aca23adc5e72c782384ce9208f15.

openjdk{11,17,19} were ported to latest gnumake-4.4.1.
---
 .../gnumake/4.4/0001-No-impure-bin-sh.patch   | 35 ---------
 .../gnumake/4.4/0002-remove-impure-dirs.patch | 40 ----------
 .../build-managers/gnumake/4.4/default.nix    | 75 -------------------
 pkgs/top-level/all-packages.nix               |  2 -
 4 files changed, 152 deletions(-)
 delete mode 100644 pkgs/development/tools/build-managers/gnumake/4.4/0001-No-impure-bin-sh.patch
 delete mode 100644 pkgs/development/tools/build-managers/gnumake/4.4/0002-remove-impure-dirs.patch
 delete mode 100644 pkgs/development/tools/build-managers/gnumake/4.4/default.nix

diff --git a/pkgs/development/tools/build-managers/gnumake/4.4/0001-No-impure-bin-sh.patch b/pkgs/development/tools/build-managers/gnumake/4.4/0001-No-impure-bin-sh.patch
deleted file mode 100644
index 58ee2d6fe09b..000000000000
--- a/pkgs/development/tools/build-managers/gnumake/4.4/0001-No-impure-bin-sh.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From e00a5257a6ca5fedbf68b09eee7df3502971a057 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Sat, 24 Apr 2021 10:11:40 +0200
-Subject: [PATCH 1/2] No impure bin sh
-
-default_shell is used to populuate default shell used to execute jobs.
-Unless SHELL is set to a different value this would be /bin/sh.
-Our stdenv provides sh in form of bash anyway. Having this value not
-hard-coded has some advantages:
-
-- It would ensure that on all systems it uses sh from its PATH rather
-  than /bin/sh, which helps as different systems might have different
-  shells there (bash vs. dash)
-- In the past I had issues with LD_PRELOAD with BEAR, where /bin/sh
-  used a different glibc than BEAR which came from my development shell.
----
- src/job.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/job.c b/src/job.c
-index ae1f18b..6b4ddb3 100644
---- a/src/job.c
-+++ b/src/job.c
-@@ -77,7 +77,7 @@ char * vms_strsignal (int status);
- 
- #else
- 
--const char *default_shell = "/bin/sh";
-+const char *default_shell = "sh";
- int batch_mode_shell = 0;
- 
- #endif
--- 
-2.31.1
-
diff --git a/pkgs/development/tools/build-managers/gnumake/4.4/0002-remove-impure-dirs.patch b/pkgs/development/tools/build-managers/gnumake/4.4/0002-remove-impure-dirs.patch
deleted file mode 100644
index e62aee7d9993..000000000000
--- a/pkgs/development/tools/build-managers/gnumake/4.4/0002-remove-impure-dirs.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 795d63d3c8b5c0dbb7e544954f75507b371b7228 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Sat, 24 Apr 2021 10:20:16 +0200
-Subject: [PATCH 2/2] remove impure dirs
-
----
- src/read.c   | 3 ---
- src/remake.c | 2 --
- 2 files changed, 5 deletions(-)
-
-diff --git a/src/read.c b/src/read.c
-index fa197fb..defacfb 100644
---- a/src/read.c
-+++ b/src/read.c
-@@ -109,9 +109,6 @@ static const char *default_include_directories[] =
- #endif
-     INCLUDEDIR,
- #ifndef _AMIGA
--    "/usr/gnu/include",
--    "/usr/local/include",
--    "/usr/include",
- #endif
-     0
-   };
-diff --git a/src/remake.c b/src/remake.c
-index fb237c5..94bff7d 100644
---- a/src/remake.c
-+++ b/src/remake.c
-@@ -1601,8 +1601,6 @@ library_search (const char *lib, FILE_TIMESTAMP *mtime_ptr)
-   static const char *dirs[] =
-     {
- #ifndef _AMIGA
--      "/lib",
--      "/usr/lib",
- #endif
- #if defined(WINDOWS32) && !defined(LIBDIR)
- /*
--- 
-2.31.1
-
diff --git a/pkgs/development/tools/build-managers/gnumake/4.4/default.nix b/pkgs/development/tools/build-managers/gnumake/4.4/default.nix
deleted file mode 100644
index 3057a0a4d40b..000000000000
--- a/pkgs/development/tools/build-managers/gnumake/4.4/default.nix
+++ /dev/null
@@ -1,75 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, guileSupport ? false, guile
-# avoid guile depend on bootstrap to prevent dependency cycles
-, inBootstrap ? false
-, pkg-config
-, gnumake
-}:
-
-let
-  guileEnabled = guileSupport && !inBootstrap;
-in
-
-stdenv.mkDerivation rec {
-  pname = "gnumake";
-  version = "4.4";
-
-  src = fetchurl {
-    url = "mirror://gnu/make/make-${version}.tar.gz";
-    hash = "sha256-WB9NToctp0s5Qch0IViYp9NYAvA3Mr3M7h1KeXkQXRg=";
-  };
-
-  # to update apply these patches with `git am *.patch` to https://git.savannah.gnu.org/git/make.git
-  patches = [
-    # Replaces /bin/sh with sh, see patch file for reasoning
-    ./0001-No-impure-bin-sh.patch
-    # Purity: don't look for library dependencies (of the form `-lfoo') in /lib
-    # and /usr/lib. It's a stupid feature anyway. Likewise, when searching for
-    # included Makefiles, don't look in /usr/include and friends.
-    ./0002-remove-impure-dirs.patch
-  ];
-
-  nativeBuildInputs = lib.optionals guileEnabled [ pkg-config ];
-  buildInputs = lib.optionals guileEnabled [ guile ];
-
-  configureFlags = lib.optional guileEnabled "--with-guile"
-
-    # Make uses this test to decide whether it should keep track of
-    # subseconds. Apple made this possible with APFS and macOS 10.13.
-    # However, we still support macOS 10.11 and 10.12. Binaries built
-    # in Nixpkgs will be unable to use futimens to set mtime less than
-    # a second. So, tell Make to ignore nanoseconds in mtime here by
-    # overriding the autoconf test for the struct.
-    # See https://github.com/NixOS/nixpkgs/issues/51221 for discussion.
-    ++ lib.optional stdenv.isDarwin "ac_cv_struct_st_mtim_nsec=no";
-
-  outputs = [ "out" "man" "info" ];
-  separateDebugInfo = true;
-
-  passthru.tests = {
-    # make sure that the override doesn't break bootstrapping
-    gnumakeWithGuile = gnumake.override { guileSupport = true; };
-  };
-
-  meta = with lib; {
-    description = "A tool to control the generation of non-source files from sources";
-    longDescription = ''
-      Make is a tool which controls the generation of executables and
-      other non-source files of a program from the program's source files.
-
-      Make gets its knowledge of how to build your program from a file
-      called the makefile, which lists each of the non-source files and
-      how to compute it from other files. When you write a program, you
-      should write a makefile for it, so that it is possible to use Make
-      to build and install the program.
-    '';
-    homepage = "https://www.gnu.org/software/make/";
-
-    license = licenses.gpl3Plus;
-    maintainers = [ maintainers.vrthra ];
-    mainProgram = "make";
-    platforms = platforms.all;
-  };
-}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a66fd786ca95..4c986690beba 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -18068,8 +18068,6 @@ with pkgs;
 
   gnumake = callPackage ../development/tools/build-managers/gnumake { };
   gnumake42 = callPackage ../development/tools/build-managers/gnumake/4.2 { };
-  # openjdk-17 fails on 4.4.1. Provide 4.4 until we fix it.
-  gnumake44 = callPackage ../development/tools/build-managers/gnumake/4.4 { };
 
   go-licenses = callPackage ../development/tools/misc/go-licenses  { };
 

From 91dd01a3065dbf60df1725681899b02afa444f18 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=94=D0=B0=D0=BC=D1=98=D0=B0=D0=BD=20=D0=93=D0=B5=D0=BE?=
 =?UTF-8?q?=D1=80=D0=B3=D0=B8=D0=B5=D0=B2=D1=81=D0=BA=D0=B8?=
 <gdamjan@gmail.com>
Date: Sun, 12 Mar 2023 23:55:03 +0100
Subject: [PATCH 095/154] systemd: disable the ukify tool

disable it just temporarily, until a solution is found for the
cross-compilation dependency on python

see https://github.com/NixOS/nixpkgs/pull/216826#issuecomment-1465228824
for more context
---
 pkgs/os-specific/linux/systemd/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 3c0104d5d7cb..f5c64fa68e2b 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -502,6 +502,9 @@ stdenv.mkDerivation (finalAttrs: {
     # more frequent development builds
     "-Dman=true"
 
+    # Temporary disable the ukify tool. see https://github.com/NixOS/nixpkgs/pull/216826#issuecomment-1465228824
+    "-Dukify=false"
+
     "-Defi=${lib.boolToString withEfi}"
     "-Dgnu-efi=${lib.boolToString withEfi}"
   ] ++ lib.optionals withEfi [

From 4e300e071b97e1e3a6ba4d856cc65e5386366f6f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 10 Mar 2023 19:25:45 +0100
Subject: [PATCH 096/154] libxcrypt: Build only with strong hashes

Effectively removes support for the following hashing algorithms
as announced in the NixOS 22.11 release notes:

- bcrypt_x ($2x$)
- sha256crypt ($5$)
- sha1crypt ($sha1$)
- sunmd5 ($md5$)
- md5crypt ($1$)
- nt ($3$)
- bdiscrypt (_)
- bigcrypt (:)
- descrypt (:)

And exposes the crypt scheme ids for enabled algorithms, so they can be
reused for validation in the users-groups module.
---
 .../manual/release-notes/rl-2305.section.md   |  2 ++
 .../libraries/libxcrypt/default.nix           | 19 ++++++++++++++++---
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 1bd8906cf64f..affa11f3b9a7 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -18,6 +18,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `nixos-rebuild` now supports an extra `--specialisation` option that can be used to change specialisation for `switch` and `test` commands.
 
+- `libxcrypt`, the library providing the `crypt(3)` password hashing function, is now built without support for algorithms not flagged [`strong`](https://github.com/besser82/libxcrypt/blob/v4.4.33/lib/hashes.conf#L48). This affects the availability of password hashing algorithms used for system login (`login(1)`, `passwd(1)`), but also Apache2 Basic-Auth, Samba, OpenLDAP, and [many other packages](https://github.com/search?q=repo%3ANixOS%2Fnixpkgs%20libxcrypt&type=code).
+
 ## New Services {#sec-release-23.05-new-services}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/pkgs/development/libraries/libxcrypt/default.nix b/pkgs/development/libraries/libxcrypt/default.nix
index 86bb12ee3d1f..769994a5cdfd 100644
--- a/pkgs/development/libraries/libxcrypt/default.nix
+++ b/pkgs/development/libraries/libxcrypt/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
   ];
 
   configureFlags = [
-    "--enable-hashes=all"
+    # Update the enabled crypt scheme ids in passthru when the enabled hashes change
+    "--enable-hashes=strong"
     "--enable-obsolete-api=glibc"
     "--disable-failure-tokens"
   ] ++ lib.optionals (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.libc == "bionic") [
@@ -30,8 +31,20 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  passthru.tests = {
-    inherit (nixosTests) login shadow;
+  passthru = {
+    tests = {
+      inherit (nixosTests) login shadow;
+    };
+    enabledCryptSchemeIds = [
+      # https://github.com/besser82/libxcrypt/blob/v4.4.33/lib/hashes.conf
+      "y"   # yescrypt
+      "gy"  # gost_yescrypt
+      "7"   # scrypt
+      "2b"  # bcrypt
+      "2y"  # bcrypt_y
+      "2a"  # bcrypt_a
+      "6"   # sha512crypt
+    ];
   };
 
   meta = with lib; {

From 0d7cd666520621ebb3f2fb0e590064e8621e249e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 11 Mar 2023 22:29:16 +0100
Subject: [PATCH 097/154] nixos/users-groups: Update password scheme validation

Updates the warnings message for statefully set up passwords, now that
weak algorithms have been removed from our libxcrypt package.

Additionall we now add proper validation for hashing schemes used in
`hashedPassword`.

Neither will prevent a rebuiild, but instead issue a warning, that this
requires immediate remediation, or else users will be unable to login.

Reuses the crypt scheme ids as provided by the libxcrypt package.
---
 nixos/modules/config/users-groups.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index ee4692fc6a6a..5fb38a4e2ff8 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -539,7 +539,9 @@ in {
 
   ###### implementation
 
-  config = {
+  config = let
+    cryptSchemeIdPatternGroup = "(${lib.concatStringsSep "|" pkgs.libxcrypt.enabledCryptSchemeIds})";
+  in {
 
     users.users = {
       root = {
@@ -601,15 +603,16 @@ in {
       text = ''
         users=()
         while IFS=: read -r user hash tail; do
-          if [[ "$hash" = "$"* && ! "$hash" =~ ^\$(y|gy|7|2b|2y|2a|6)\$ ]]; then
+          if [[ "$hash" = "$"* && ! "$hash" =~ ^\''$${cryptSchemeIdPatternGroup}\$ ]]; then
             users+=("$user")
           fi
         done </etc/shadow
 
         if (( "''${#users[@]}" )); then
           echo "
-        WARNING: The following user accounts rely on password hashes that will
-        be removed in NixOS 23.05. They should be renewed as soon as possible."
+        WARNING: The following user accounts rely on password hashing algorithms
+        that have been removed. They need to be renewed as soon as possible, as
+        they do prevent their users from logging in."
           printf ' - %s\n' "''${users[@]}"
         fi
       '';
@@ -716,7 +719,7 @@ in {
         let
           sep = "\\$";
           base64 = "[a-zA-Z0-9./]+";
-          id = "[a-z0-9-]+";
+          id = cryptSchemeIdPatternGroup;
           value = "[a-zA-Z0-9/+.-]+";
           options = "${id}(=${value})?(,${id}=${value})*";
           scheme  = "${id}(${sep}${options})?";

From 909f394f28c637a6d5a269d893b77e095b2812eb Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 12 Mar 2023 17:58:19 +0100
Subject: [PATCH 098/154] pam: Make libxcrypt a non-optional dependency

Our PAM configuration now defaults to yescrypt, which requires
libxcrypt.
---
 pkgs/os-specific/linux/pam/default.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix
index 22e7057e343f..8b068100f32a 100644
--- a/pkgs/os-specific/linux/pam/default.nix
+++ b/pkgs/os-specific/linux/pam/default.nix
@@ -1,6 +1,5 @@
-{ lib, stdenv, buildPackages, fetchurl, flex, cracklib, db4, gettext, audit
+{ lib, stdenv, buildPackages, fetchurl, flex, cracklib, db4, gettext, audit, libxcrypt
 , nixosTests
-, withLibxcrypt ? true, libxcrypt
 }:
 
 stdenv.mkDerivation rec {
@@ -20,9 +19,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ flex ]
     ++ lib.optional stdenv.buildPlatform.isDarwin gettext;
 
-  buildInputs = [ cracklib db4 ]
-    ++ lib.optional stdenv.buildPlatform.isLinux audit
-    ++ lib.optional withLibxcrypt libxcrypt;
+  buildInputs = [ cracklib db4 libxcrypt ]
+    ++ lib.optional stdenv.buildPlatform.isLinux audit;
 
   enableParallelBuilding = true;
 

From 4472cf44eba4991e46904c588e07dfe8e6fcceb8 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 12 Mar 2023 17:59:01 +0100
Subject: [PATCH 099/154] treewide: Make yescrypt the default algorithm for
 pam_unix.so

This ensures `passwd` will default to yescrypt for newly generated
passwords.
---
 nixos/modules/security/pam.nix                          | 2 +-
 nixos/modules/services/x11/display-managers/gdm.nix     | 2 +-
 nixos/modules/services/x11/display-managers/lightdm.nix | 2 +-
 nixos/tests/pam/test_chfn.py                            | 2 +-
 pkgs/build-support/docker/default.nix                   | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 4224722f8792..d57dec36c328 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -620,7 +620,7 @@ let
           optionalString config.services.homed.enable ''
             password sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so
           '' + ''
-            password sufficient pam_unix.so nullok sha512
+            password sufficient pam_unix.so nullok yescrypt
           '' +
           optionalString config.security.pam.enableEcryptfs ''
             password optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so
diff --git a/nixos/modules/services/x11/display-managers/gdm.nix b/nixos/modules/services/x11/display-managers/gdm.nix
index 1c3881bef2de..f8f82bda3fa4 100644
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@@ -323,7 +323,7 @@ in
 
         account   sufficient    pam_unix.so
 
-        password  requisite     pam_unix.so nullok sha512
+        password  requisite     pam_unix.so nullok yescrypt
 
         session   optional      pam_keyinit.so revoke
         session   include       login
diff --git a/nixos/modules/services/x11/display-managers/lightdm.nix b/nixos/modules/services/x11/display-managers/lightdm.nix
index 65f414705fc5..548d3c5bc46a 100644
--- a/nixos/modules/services/x11/display-managers/lightdm.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm.nix
@@ -302,7 +302,7 @@ in
 
         account   sufficient    pam_unix.so
 
-        password  requisite     pam_unix.so nullok sha512
+        password  requisite     pam_unix.so nullok yescrypt
 
         session   optional      pam_keyinit.so revoke
         session   include       login
diff --git a/nixos/tests/pam/test_chfn.py b/nixos/tests/pam/test_chfn.py
index b108a9423caf..a48438b8d305 100644
--- a/nixos/tests/pam/test_chfn.py
+++ b/nixos/tests/pam/test_chfn.py
@@ -8,7 +8,7 @@ expected_lines = {
     "auth sufficient pam_rootok.so",
     "auth sufficient pam_unix.so   likeauth try_first_pass",
     "password sufficient @@pam_krb5@@/lib/security/pam_krb5.so use_first_pass",
-    "password sufficient pam_unix.so nullok sha512",
+    "password sufficient pam_unix.so nullok yescrypt",
     "session optional @@pam_krb5@@/lib/security/pam_krb5.so",
     "session required pam_env.so conffile=/etc/pam/environment readenv=0",
     "session required pam_unix.so",
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index 7fa5aeafc8e3..5f48fb9f7bdb 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -190,7 +190,7 @@ rec {
       cat > /etc/pam.d/other <<EOF
     account sufficient pam_unix.so
     auth sufficient pam_rootok.so
-    password requisite pam_unix.so nullok sha512
+    password requisite pam_unix.so nullok yescrypt
     session required pam_unix.so
     EOF
     fi

From 23f23a89b325b06e3f7ff6c0a45e06271db49ead Mon Sep 17 00:00:00 2001
From: Tungsten842 <886724vf@anonaddy.me>
Date: Mon, 13 Mar 2023 12:31:32 +0100
Subject: [PATCH 100/154] fftw: enable optimizations unconditionally and build
 with mtune=generic

---
 pkgs/development/libraries/fftw/default.nix | 39 ++++++++++-----------
 1 file changed, 19 insertions(+), 20 deletions(-)

diff --git a/pkgs/development/libraries/fftw/default.nix b/pkgs/development/libraries/fftw/default.nix
index 9d83fdb4878e..e09786976f74 100644
--- a/pkgs/development/libraries/fftw/default.nix
+++ b/pkgs/development/libraries/fftw/default.nix
@@ -5,10 +5,6 @@
 , perl
 , llvmPackages
 , precision ? "double"
-, enableAvx ? stdenv.hostPlatform.avxSupport
-, enableAvx2 ? stdenv.hostPlatform.avx2Support
-, enableAvx512 ? stdenv.hostPlatform.avx512Support
-, enableFma ? stdenv.hostPlatform.fmaSupport
 , enableMpi ? false
 , mpi
 , withDoc ? stdenv.cc.isGNU
@@ -40,22 +36,25 @@ stdenv.mkDerivation (finalAttrs: {
     llvmPackages.openmp
   ] ++ lib.optional enableMpi mpi;
 
-  configureFlags =
-    [ "--enable-shared"
-      "--enable-threads"
-    ]
-    ++ lib.optional (precision != "double") "--enable-${precision}"
-    # all x86_64 have sse2
-    # however, not all float sizes fit
-    ++ lib.optional (stdenv.isx86_64 && (precision == "single" || precision == "double") )  "--enable-sse2"
-    ++ lib.optional enableAvx "--enable-avx"
-    ++ lib.optional enableAvx2 "--enable-avx2"
-    ++ lib.optional enableAvx512 "--enable-avx512"
-    ++ lib.optional enableFma "--enable-fma"
-    ++ [ "--enable-openmp" ]
-    ++ lib.optional enableMpi "--enable-mpi"
-    # doc generation causes Fortran wrapper generation which hard-codes gcc
-    ++ lib.optional (!withDoc) "--disable-doc";
+  configureFlags = [
+    "--enable-shared"
+    "--enable-threads"
+    "--enable-openmp"
+  ]
+
+  ++ lib.optional (precision != "double") "--enable-${precision}"
+  # https://www.fftw.org/fftw3_doc/SIMD-alignment-and-fftw_005fmalloc.html
+  # FFTW will try to detect at runtime whether the CPU supports these extensions
+  ++ lib.optional (stdenv.isx86_64 && (precision == "single" || precision == "double"))
+    "--enable-sse2 --enable-avx --enable-avx2 --enable-avx512 --enable-avx128-fma"
+  ++ lib.optional enableMpi "--enable-mpi"
+  # doc generation causes Fortran wrapper generation which hard-codes gcc
+  ++ lib.optional (!withDoc) "--disable-doc";
+
+  # fftw builds with -mtune=native by default
+  postPatch = ''
+    substituteInPlace configure --replace "-mtune=native" "-mtune=generic"
+  '';
 
   enableParallelBuilding = true;
 

From a9b7d738fc1437f8d796607ed31093921685b2b4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 13 Mar 2023 14:40:12 +0100
Subject: [PATCH 101/154] Revert "python3Packages.babel: revert test fixes for
 now"

This reverts commit 3607a737006fe222c1eff66ae78bbc1ea5993fb4.
i.e. it reapplies commits 86fc053269358 and cebf6aa8fd0d.
---
 .../python-modules/babel/default.nix          | 36 +++++++++++++++++--
 1 file changed, 33 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/babel/default.nix b/pkgs/development/python-modules/babel/default.nix
index 09fb69a7658e..1393a7084e1f 100644
--- a/pkgs/development/python-modules/babel/default.nix
+++ b/pkgs/development/python-modules/babel/default.nix
@@ -1,8 +1,20 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, pythonOlder, pytz, pytestCheckHook, freezegun }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonAtLeast
+, pythonOlder
+
+# tests
+, freezegun
+, pytestCheckHook
+, pytz
+}:
 
 buildPythonPackage rec {
   pname = "babel";
   version = "2.12.1";
+  format = "setuptools";
+
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
@@ -11,12 +23,30 @@ buildPythonPackage rec {
     hash = "sha256-zC2ZmZzQHURCCuclohyeNxGzqtx5dtYUf2IthYGWNFU=";
   };
 
-  propagatedBuildInputs = lib.optional (pythonOlder "3.9") pytz;
+  propagatedBuildInputs = lib.optionals (pythonOlder "3.9") [
+    pytz
+  ];
 
-  nativeCheckInputs = [ pytestCheckHook freezegun ];
+  # including backports.zoneinfo for python<3.9 yields infinite recursion
+  doCheck = pythonAtLeast "3.9";
+
+  nativeCheckInputs = [
+    # via setup.py
+    freezegun
+    pytestCheckHook
+    # via tox.ini
+    pytz
+  ];
+
+  disabledTests = [
+    # fails on days switching from and to daylight saving time in EST
+    # https://github.com/python-babel/babel/issues/988
+    "test_format_time"
+  ];
 
   meta = with lib; {
     homepage = "https://babel.pocoo.org/";
+    changelog = "https://github.com/python-babel/babel/releases/tag/v${version}";
     description = "Collection of internationalizing tools";
     license = licenses.bsd3;
     maintainers = with maintainers; [ SuperSandro2000 ];

From fab17d210d14e11adba8255cc0767cec0ff9e6b8 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Mon, 13 Mar 2023 18:23:40 +0200
Subject: [PATCH 102/154] gtk2: read configuration from /etc/gtk-2.0/gtkrc

fixes issue 31702
---
 pkgs/development/libraries/gtk/2.x.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/libraries/gtk/2.x.nix b/pkgs/development/libraries/gtk/2.x.nix
index 88dfc54094f3..1f66917d3b2a 100644
--- a/pkgs/development/libraries/gtk/2.x.nix
+++ b/pkgs/development/libraries/gtk/2.x.nix
@@ -68,6 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
   '' else null;
 
   configureFlags = [
+    "--sysconfdir=/etc"
     "--with-gdktarget=${gdktarget}"
     "--with-xinput=yes"
   ] ++ lib.optionals stdenv.isDarwin [
@@ -79,6 +80,10 @@ stdenv.mkDerivation (finalAttrs: {
     "ac_cv_path_GDK_PIXBUF_CSOURCE=${buildPackages.gdk-pixbuf.dev}/bin/gdk-pixbuf-csource"
   ];
 
+  installFlags = [
+    "sysconfdir=${placeholder "out"}/etc"
+  ];
+
   doCheck = false; # needs X11
 
   postInstall = ''

From b830681bfbf1058e2893411a3a8e0a448f3f82cf Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 13 Mar 2023 19:11:15 +0000
Subject: [PATCH 103/154] python310Packages.sqlalchemy: 2.0.4 -> 2.0.6

Changelog: https://github.com/sqlalchemy/sqlalchemy/releases/tag/rel_2_0_6
---
 pkgs/development/python-modules/sqlalchemy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 47ce2d42d94f..85bfccf8e0eb 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -40,14 +40,14 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "2.0.4";
+  version = "2.0.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-laGOGmryEU29nuTxaK0zBw1jF+Ebr6KNmDzHtYX+kAs=";
+    hash = "sha256-w0PwtUZJX116I5xwv1CpmkjXMhwWW4Kvr6hIO56+v24=";
   };
 
   nativeBuildInputs =[

From 711e9cfd493296681b84147a650972ea78e948c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= <fabianhjr@protonmail.com>
Date: Sat, 25 Feb 2023 13:06:51 -0600
Subject: [PATCH 104/154] =?UTF-8?q?ffmpeg:=20ffmpeg=5F4=20=E2=86=92=20ffmp?=
 =?UTF-8?q?eg=5F5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/top-level/all-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9496e82a6d86..bbcc8261f6aa 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -19856,9 +19856,9 @@ with pkgs;
   # update to ffmpeg
   # Packages which use ffmpeg as a library, should pin to the relevant major
   # version number which the upstream support.
-  ffmpeg = ffmpeg_4;
-  ffmpeg-headless = ffmpeg_4-headless;
-  ffmpeg-full = ffmpeg_4-full;
+  ffmpeg = ffmpeg_5;
+  ffmpeg-headless = ffmpeg_5-headless;
+  ffmpeg-full = ffmpeg_5-full;
 
   ffmpegthumbnailer = callPackage ../development/libraries/ffmpegthumbnailer { };
 

From 9bd2506458ea053ccbcde6e622d7cec9993d8f36 Mon Sep 17 00:00:00 2001
From: Atemu <atemu.main@gmail.com>
Date: Fri, 3 Mar 2023 19:41:10 +0100
Subject: [PATCH 105/154] treewide: make ffmpeg_4-dependant packages depend on
 ffmpeg_4

These packages were identified as broken when ffmpeg = ffmpeg_5.

Tested _only_ by building them. If you are a maintainer of one of these
packages, please test whether your package still works.
---
 pkgs/applications/audio/moc/default.nix                |  4 ++--
 pkgs/applications/audio/musly/default.nix              |  4 ++--
 pkgs/applications/audio/spek/default.nix               |  4 ++--
 pkgs/applications/audio/tenacity/default.nix           |  4 ++--
 pkgs/applications/emulators/attract-mode/default.nix   |  4 ++--
 pkgs/applications/emulators/citra/generic.nix          |  4 ++--
 pkgs/applications/emulators/pcsxr/default.nix          |  4 ++--
 pkgs/applications/emulators/ppsspp/default.nix         |  4 ++--
 pkgs/applications/emulators/retroarch/cores.nix        |  3 ++-
 pkgs/applications/graphics/digikam/default.nix         |  4 ++--
 .../telegram/kotatogram-desktop/default.nix            |  4 ++--
 .../science/biology/febio-studio/default.nix           |  4 ++--
 pkgs/applications/science/networking/sumo/default.nix  |  4 ++--
 pkgs/applications/video/bino3d/default.nix             |  4 ++--
 pkgs/applications/video/bombono/default.nix            |  6 +++---
 pkgs/applications/video/ccextractor/default.nix        |  4 ++--
 pkgs/applications/video/dvdstyler/default.nix          |  4 ++--
 pkgs/applications/video/mplayer/default.nix            |  4 ++--
 pkgs/applications/video/olive-editor/default.nix       |  4 ++--
 .../video/simplescreenrecorder/default.nix             |  4 ++--
 pkgs/applications/video/webcamoid/default.nix          |  4 ++--
 pkgs/development/libraries/libextractor/default.nix    |  4 ++--
 pkgs/development/libraries/libqtav/default.nix         |  4 ++--
 pkgs/development/libraries/mediastreamer/default.nix   |  4 ++--
 pkgs/development/libraries/pangolin/default.nix        |  4 ++--
 pkgs/development/libraries/xine-lib/default.nix        | 10 ++--------
 pkgs/development/octave-modules/video/default.nix      |  4 ++--
 .../python-modules/ffmpeg-python/default.nix           |  4 ++--
 pkgs/games/hedgewars/default.nix                       |  4 ++--
 pkgs/games/openrw/default.nix                          |  4 ++--
 pkgs/games/performous/default.nix                      |  4 ++--
 pkgs/games/stepmania/default.nix                       |  4 ++--
 pkgs/games/ultrastardx/default.nix                     |  9 ++++-----
 pkgs/misc/screensavers/electricsheep/default.nix       |  4 ++--
 pkgs/os-specific/linux/guvcview/default.nix            |  4 ++--
 pkgs/servers/hydron/default.nix                        |  4 ++--
 pkgs/servers/misc/oven-media-engine/default.nix        |  4 ++--
 pkgs/servers/tvheadend/default.nix                     |  4 ++--
 pkgs/tools/audio/acoustid-fingerprinter/default.nix    |  4 ++--
 pkgs/tools/audio/loudgain/default.nix                  |  4 ++--
 pkgs/tools/graphics/vulkan-cts/default.nix             |  4 ++--
 pkgs/tools/video/harvid/default.nix                    |  4 ++--
 pkgs/tools/video/untrunc-anthwlock/default.nix         |  4 ++--
 pkgs/tools/video/xjadeo/default.nix                    |  4 ++--
 44 files changed, 91 insertions(+), 97 deletions(-)

diff --git a/pkgs/applications/audio/moc/default.nix b/pkgs/applications/audio/moc/default.nix
index bd524b6d9317..ddd868c71ce7 100644
--- a/pkgs/applications/audio/moc/default.nix
+++ b/pkgs/applications/audio/moc/default.nix
@@ -15,7 +15,7 @@
 , musepackSupport ? true, libmpc, libmpcdec, taglib
 , vorbisSupport ? true, libvorbis
 , speexSupport ? true, speex
-, ffmpegSupport ? true, ffmpeg
+, ffmpegSupport ? true, ffmpeg_4
 , sndfileSupport ? true, libsndfile
 , wavpackSupport ? true, wavpack
 # Misc
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals musepackSupport [ libmpc libmpcdec taglib ]
     ++ lib.optional vorbisSupport libvorbis
     ++ lib.optional speexSupport speex
-    ++ lib.optional ffmpegSupport ffmpeg
+    ++ lib.optional ffmpegSupport ffmpeg_4
     ++ lib.optional sndfileSupport libsndfile
     ++ lib.optional wavpackSupport wavpack
     # Misc
diff --git a/pkgs/applications/audio/musly/default.nix b/pkgs/applications/audio/musly/default.nix
index 470d5c105075..1ae6624637a1 100644
--- a/pkgs/applications/audio/musly/default.nix
+++ b/pkgs/applications/audio/musly/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, eigen, ffmpeg }:
+{ lib, stdenv, fetchFromGitHub, cmake, eigen, ffmpeg_4 }:
 stdenv.mkDerivation {
   pname = "musly";
   version = "unstable-2017-04-26";
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
     sha256 = "1q42wvdwy2pac7bhfraqqj2czw7w2m33ms3ifjl8phm7d87i8825";
   };
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ eigen ffmpeg ];
+  buildInputs = [ eigen ffmpeg_4 ];
   fixupPhase = lib.optionalString stdenv.isDarwin ''
     install_name_tool -change libmusly.dylib $out/lib/libmusly.dylib $out/bin/musly
     install_name_tool -change libmusly_resample.dylib $out/lib/libmusly_resample.dylib $out/bin/musly
diff --git a/pkgs/applications/audio/spek/default.nix b/pkgs/applications/audio/spek/default.nix
index 0c1aa5fa0e2f..0ce5eb2cfab0 100644
--- a/pkgs/applications/audio/spek/default.nix
+++ b/pkgs/applications/audio/spek/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, intltool, pkg-config, ffmpeg, wxGTK32, gtk3, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, intltool, pkg-config, ffmpeg_4, wxGTK32, gtk3, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "spek";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook intltool pkg-config wrapGAppsHook ];
 
-  buildInputs = [ ffmpeg wxGTK32 gtk3 ];
+  buildInputs = [ ffmpeg_4 wxGTK32 gtk3 ];
 
   meta = with lib; {
     description = "Analyse your audio files by showing their spectrogram";
diff --git a/pkgs/applications/audio/tenacity/default.nix b/pkgs/applications/audio/tenacity/default.nix
index c27e3864d27f..ae4454a6dc00 100644
--- a/pkgs/applications/audio/tenacity/default.nix
+++ b/pkgs/applications/audio/tenacity/default.nix
@@ -30,7 +30,7 @@
 , expat
 , libid3tag
 , libopus
-, ffmpeg
+, ffmpeg_4
 , soundtouch
 , pcre
 , portaudio
@@ -110,7 +110,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     alsa-lib
     expat
-    ffmpeg
+    ffmpeg_4
     file
     flac
     glib
diff --git a/pkgs/applications/emulators/attract-mode/default.nix b/pkgs/applications/emulators/attract-mode/default.nix
index 4f560e64a1ab..0bd1b4b062ab 100644
--- a/pkgs/applications/emulators/attract-mode/default.nix
+++ b/pkgs/applications/emulators/attract-mode/default.nix
@@ -1,4 +1,4 @@
-{ expat, fetchFromGitHub, ffmpeg, fontconfig, freetype, libarchive, libjpeg
+{ expat, fetchFromGitHub, ffmpeg_4, fontconfig, freetype, libarchive, libjpeg
 , libGLU, libGL, openal, pkg-config, sfml, lib, stdenv, zlib
 }:
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = [
-    expat ffmpeg fontconfig freetype libarchive libjpeg libGLU libGL openal sfml zlib
+    expat ffmpeg_4 fontconfig freetype libarchive libjpeg libGLU libGL openal sfml zlib
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/emulators/citra/generic.nix b/pkgs/applications/emulators/citra/generic.nix
index ee34286c3d15..95f66294deb5 100644
--- a/pkgs/applications/emulators/citra/generic.nix
+++ b/pkgs/applications/emulators/citra/generic.nix
@@ -20,7 +20,7 @@
 , enableCubeb ? true, libpulseaudio
 , enableFfmpegAudioDecoder ? true
 , enableFfmpegVideoDumper ? true
-, ffmpeg
+, ffmpeg_4
 , useDiscordRichPresence ? true, rapidjson
 , enableFdk ? false, fdk_aac
 }:
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional enableSdl2 SDL2
     ++ lib.optional enableQtTranslation qttools
     ++ lib.optional enableCubeb libpulseaudio
-    ++ lib.optional (enableFfmpegAudioDecoder || enableFfmpegVideoDumper) ffmpeg
+    ++ lib.optional (enableFfmpegAudioDecoder || enableFfmpegVideoDumper) ffmpeg_4
     ++ lib.optional useDiscordRichPresence rapidjson
     ++ lib.optional enableFdk fdk_aac;
 
diff --git a/pkgs/applications/emulators/pcsxr/default.nix b/pkgs/applications/emulators/pcsxr/default.nix
index 88a058865ead..101fb829c6e3 100644
--- a/pkgs/applications/emulators/pcsxr/default.nix
+++ b/pkgs/applications/emulators/pcsxr/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, autoreconfHook, intltool, pkg-config, gtk3, SDL2, xorg
-, wrapGAppsHook, libcdio, nasm, ffmpeg, file
+, wrapGAppsHook, libcdio, nasm, ffmpeg_4, file
 , fetchpatch }:
 
 stdenv.mkDerivation rec {
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook intltool pkg-config wrapGAppsHook ];
   buildInputs = [
-    gtk3 SDL2 xorg.libXv xorg.libXtst libcdio nasm ffmpeg file
+    gtk3 SDL2 xorg.libXv xorg.libXtst libcdio nasm ffmpeg_4 file
     xorg.libXxf86vm
   ];
 
diff --git a/pkgs/applications/emulators/ppsspp/default.nix b/pkgs/applications/emulators/ppsspp/default.nix
index 7713c145948c..29b64ebb6bd8 100644
--- a/pkgs/applications/emulators/ppsspp/default.nix
+++ b/pkgs/applications/emulators/ppsspp/default.nix
@@ -4,7 +4,7 @@
 , SDL2
 , cmake
 , copyDesktopItems
-, ffmpeg
+, ffmpeg_4
 , glew
 , libffi
 , libsForQt5
@@ -59,7 +59,7 @@ stdenv.mkDerivation (self: {
 
   buildInputs = [
     SDL2
-    ffmpeg
+    ffmpeg_4
     (glew.override { enableEGL = forceWayland; })
     libzip
     snappy
diff --git a/pkgs/applications/emulators/retroarch/cores.nix b/pkgs/applications/emulators/retroarch/cores.nix
index ed6b75ad406a..043cd41d7a04 100644
--- a/pkgs/applications/emulators/retroarch/cores.nix
+++ b/pkgs/applications/emulators/retroarch/cores.nix
@@ -7,6 +7,7 @@
 , curl
 , fetchFromGitHub
 , ffmpeg
+, ffmpeg_4
 , fluidsynth
 , gettext
 , hexdump
@@ -759,7 +760,7 @@ in
   ppsspp = mkLibretroCore {
     core = "ppsspp";
     extraNativeBuildInputs = [ cmake pkg-config python3 ];
-    extraBuildInputs = [ libGLU libGL libzip ffmpeg snappy xorg.libX11 ];
+    extraBuildInputs = [ libGLU libGL libzip ffmpeg_4 snappy xorg.libX11 ];
     makefile = "Makefile";
     cmakeFlags = [
       "-DLIBRETRO=ON"
diff --git a/pkgs/applications/graphics/digikam/default.nix b/pkgs/applications/graphics/digikam/default.nix
index 19d0f5242e06..9f68964f424e 100644
--- a/pkgs/applications/graphics/digikam/default.nix
+++ b/pkgs/applications/graphics/digikam/default.nix
@@ -24,7 +24,7 @@
 , boost
 , eigen
 , exiv2
-, ffmpeg
+, ffmpeg_4
 , flex
 , graphviz
 , imagemagick
@@ -70,7 +70,7 @@ mkDerivation rec {
     boost
     eigen
     exiv2
-    ffmpeg
+    ffmpeg_4
     flex
     graphviz
     imagemagick
diff --git a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
index 6e3a9e54f0db..d780ddad3448 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
@@ -16,7 +16,7 @@
 , kwayland
 , lz4
 , xxHash
-, ffmpeg
+, ffmpeg_4
 , openalSoft
 , minizip
 , libopus
@@ -132,7 +132,7 @@ stdenv.mkDerivation rec {
     qtsvg
     lz4
     xxHash
-    ffmpeg
+    ffmpeg_4
     openalSoft
     minizip
     libopus
diff --git a/pkgs/applications/science/biology/febio-studio/default.nix b/pkgs/applications/science/biology/febio-studio/default.nix
index e334637f243c..550d221c74eb 100644
--- a/pkgs/applications/science/biology/febio-studio/default.nix
+++ b/pkgs/applications/science/biology/febio-studio/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, cmake, zlib, libglvnd, libGLU, wrapQtAppsHook
 , sshSupport ? true, openssl, libssh
 , tetgenSupport ? true, tetgen
-, ffmpegSupport ? true, ffmpeg
+, ffmpegSupport ? true, ffmpeg_4
 , dicomSupport  ? false, dcmtk
 , withModelRepo ? true
 , withCadFeatures ? false
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ zlib libglvnd libGLU openssl libssh ]
     ++ lib.optional sshSupport openssl
     ++ lib.optional tetgenSupport tetgen
-    ++ lib.optional ffmpegSupport ffmpeg
+    ++ lib.optional ffmpegSupport ffmpeg_4
     ++ lib.optional dicomSupport dcmtk
   ;
 
diff --git a/pkgs/applications/science/networking/sumo/default.nix b/pkgs/applications/science/networking/sumo/default.nix
index 92f64fbfb916..7ed79f478cf1 100644
--- a/pkgs/applications/science/networking/sumo/default.nix
+++ b/pkgs/applications/science/networking/sumo/default.nix
@@ -1,4 +1,4 @@
-{ lib, bzip2, cmake, eigen, fetchFromGitHub, ffmpeg, fox_1_6, gdal,
+{ lib, bzip2, cmake, eigen, fetchFromGitHub, ffmpeg_4, fox_1_6, gdal,
   git, gl2ps, gpp , gtest, jdk, libGL, libGLU, libX11, libjpeg,
   libpng, libtiff, libxcrypt, openscenegraph , proj, python3,
   python3Packages, stdenv, swig, xercesc, xorg, zlib }:
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     bzip2
     eigen
-    ffmpeg
+    ffmpeg_4
     fox_1_6
     gdal
     gl2ps
diff --git a/pkgs/applications/video/bino3d/default.nix b/pkgs/applications/video/bino3d/default.nix
index b1f5a693de42..d15d649b841b 100644
--- a/pkgs/applications/video/bino3d/default.nix
+++ b/pkgs/applications/video/bino3d/default.nix
@@ -1,4 +1,4 @@
-{ mkDerivation, lib, fetchurl, pkg-config, ffmpeg, glew, libass, openal, qtbase }:
+{ mkDerivation, lib, fetchurl, pkg-config, ffmpeg_4, glew, libass, openal, qtbase }:
 
 mkDerivation rec {
   pname = "bino";
@@ -11,7 +11,7 @@ mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ ffmpeg glew libass openal qtbase ];
+  buildInputs = [ ffmpeg_4 glew libass openal qtbase ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/video/bombono/default.nix b/pkgs/applications/video/bombono/default.nix
index e39d09b6fe72..3990aeb662f1 100644
--- a/pkgs/applications/video/bombono/default.nix
+++ b/pkgs/applications/video/bombono/default.nix
@@ -8,7 +8,7 @@
 , dvdplusrwtools
 , enca
 , cdrkit
-, ffmpeg
+, ffmpeg_4
 , gettext
 , gtk2
 , gtkmm2
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
     dvdauthor
     dvdplusrwtools
     enca
-    ffmpeg
+    ffmpeg_4
     gtk2
     gtkmm2
     libdvdread
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
     # fix iso authoring
     install -Dt  $out/share/bombono/resources/scons_authoring tools/scripts/SConsTwin.py
 
-    wrapProgram $out/bin/bombono-dvd --prefix PATH : ${lib.makeBinPath [ ffmpeg dvdauthor cdrkit ]}
+    wrapProgram $out/bin/bombono-dvd --prefix PATH : ${lib.makeBinPath [ ffmpeg_4 dvdauthor cdrkit ]}
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/video/ccextractor/default.nix b/pkgs/applications/video/ccextractor/default.nix
index 3d6238463470..8b2f185a55bd 100644
--- a/pkgs/applications/video/ccextractor/default.nix
+++ b/pkgs/applications/video/ccextractor/default.nix
@@ -9,7 +9,7 @@
 , makeWrapper
 , tesseract4
 , leptonica
-, ffmpeg
+, ffmpeg_4
 }:
 
 stdenv.mkDerivation rec {
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ zlib ]
     ++ lib.optional (!stdenv.isLinux) libiconv
-    ++ lib.optionals enableOcr [ leptonica tesseract4 ffmpeg ];
+    ++ lib.optionals enableOcr [ leptonica tesseract4 ffmpeg_4 ];
 
   cmakeFlags = [
     # file RPATH_CHANGE could not write new RPATH:
diff --git a/pkgs/applications/video/dvdstyler/default.nix b/pkgs/applications/video/dvdstyler/default.nix
index ba0d4945385e..8d7d5a6611d3 100644
--- a/pkgs/applications/video/dvdstyler/default.nix
+++ b/pkgs/applications/video/dvdstyler/default.nix
@@ -7,7 +7,7 @@
 , docbook-xsl-nons
 , dvdauthor
 , dvdplusrwtools
-, ffmpeg
+, ffmpeg_4
 , flex
 , fontconfig
 , gettext
@@ -61,7 +61,7 @@ in stdenv.mkDerivation rec {
     cdrtools
     dvdauthor
     dvdplusrwtools
-    ffmpeg
+    ffmpeg_4
     fontconfig
     glib
     libexif
diff --git a/pkgs/applications/video/mplayer/default.nix b/pkgs/applications/video/mplayer/default.nix
index 6d280e71b861..e384c1f5c194 100644
--- a/pkgs/applications/video/mplayer/default.nix
+++ b/pkgs/applications/video/mplayer/default.nix
@@ -1,4 +1,4 @@
-{ config, lib, stdenv, fetchurl, fetchsvn, pkg-config, freetype, yasm, ffmpeg
+{ config, lib, stdenv, fetchurl, fetchsvn, pkg-config, freetype, yasm, ffmpeg_4
 , aalibSupport ? true, aalib
 , fontconfigSupport ? true, fontconfig, freefont_ttf
 , fribidiSupport ? true, fribidi
@@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ pkg-config yasm ];
   buildInputs = with lib;
-    [ freetype ffmpeg ]
+    [ freetype ffmpeg_4 ]
     ++ optional aalibSupport aalib
     ++ optional fontconfigSupport fontconfig
     ++ optional fribidiSupport fribidi
diff --git a/pkgs/applications/video/olive-editor/default.nix b/pkgs/applications/video/olive-editor/default.nix
index 87056a1598d7..68a3d5565774 100644
--- a/pkgs/applications/video/olive-editor/default.nix
+++ b/pkgs/applications/video/olive-editor/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub
 , pkg-config, which, qmake, wrapQtAppsHook
-, qtmultimedia, frei0r, opencolorio_1, ffmpeg-full, CoreFoundation }:
+, qtmultimedia, frei0r, opencolorio_1, ffmpeg_4, CoreFoundation }:
 
 stdenv.mkDerivation rec {
   pname = "olive-editor";
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    ffmpeg-full
+    ffmpeg_4
     frei0r
     opencolorio_1
     qtmultimedia
diff --git a/pkgs/applications/video/simplescreenrecorder/default.nix b/pkgs/applications/video/simplescreenrecorder/default.nix
index 7778e7c22240..cbeb325e7ce0 100644
--- a/pkgs/applications/video/simplescreenrecorder/default.nix
+++ b/pkgs/applications/video/simplescreenrecorder/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, mkDerivation, fetchFromGitHub, alsa-lib, ffmpeg, libjack2, libX11, libXext, libXinerama, qtx11extras
+{ lib, stdenv, mkDerivation, fetchFromGitHub, alsa-lib, ffmpeg_4, libjack2, libX11, libXext, libXinerama, qtx11extras
 , libXfixes, libGLU, libGL, pkg-config, libpulseaudio, libv4l, qtbase, qttools, cmake, ninja
 }:
 
@@ -30,7 +30,7 @@ mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config cmake ninja ];
   buildInputs = [
-    alsa-lib ffmpeg libjack2 libX11 libXext libXfixes libXinerama libGLU libGL
+    alsa-lib ffmpeg_4 libjack2 libX11 libXext libXfixes libXinerama libGLU libGL
     libpulseaudio libv4l qtbase qttools qtx11extras
   ];
 
diff --git a/pkgs/applications/video/webcamoid/default.nix b/pkgs/applications/video/webcamoid/default.nix
index b9c21b7ad7d1..62954313213c 100644
--- a/pkgs/applications/video/webcamoid/default.nix
+++ b/pkgs/applications/video/webcamoid/default.nix
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub, pkg-config, libxcb, mkDerivation, cmake
 , qtbase, qtdeclarative, qtquickcontrols, qtquickcontrols2
-, ffmpeg-full, gst_all_1, libpulseaudio, alsa-lib, jack2
+, ffmpeg_4, gst_all_1, libpulseaudio, alsa-lib, jack2
 , v4l-utils }:
 mkDerivation rec {
   pname = "webcamoid";
@@ -16,7 +16,7 @@ mkDerivation rec {
   buildInputs = [
     libxcb
     qtbase qtdeclarative qtquickcontrols qtquickcontrols2
-    ffmpeg-full
+    ffmpeg_4
     gst_all_1.gstreamer gst_all_1.gst-plugins-base
     alsa-lib libpulseaudio jack2
     v4l-utils
diff --git a/pkgs/development/libraries/libextractor/default.nix b/pkgs/development/libraries/libextractor/default.nix
index 3df4a8f91e3c..a6f96160487c 100644
--- a/pkgs/development/libraries/libextractor/default.nix
+++ b/pkgs/development/libraries/libextractor/default.nix
@@ -13,7 +13,7 @@
 # '';
 # See also <https://nixos.org/nixpkgs/manual/#sec-language-gnome>.
 , gtkSupport ? true, glib, gtk3
-, videoSupport ? true, ffmpeg, libmpeg2
+, videoSupport ? true, ffmpeg_4, libmpeg2
 }:
 
 stdenv.mkDerivation rec {
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
    ] ++ lib.optionals gstreamerSupport
           ([ gst_all_1.gstreamer ] ++ gstPlugins gst_all_1)
      ++ lib.optionals gtkSupport [ glib gtk3 ]
-     ++ lib.optionals videoSupport [ ffmpeg libmpeg2 ];
+     ++ lib.optionals videoSupport [ ffmpeg_4 libmpeg2 ];
 
   configureFlags = [
     "--disable-ltdl-install"
diff --git a/pkgs/development/libraries/libqtav/default.nix b/pkgs/development/libraries/libqtav/default.nix
index 10f4b43f9890..4a17bd951aa8 100644
--- a/pkgs/development/libraries/libqtav/default.nix
+++ b/pkgs/development/libraries/libqtav/default.nix
@@ -10,7 +10,7 @@
 , libX11
 , libass
 , openal
-, ffmpeg
+, ffmpeg_4
 , libuchardet
 , alsa-lib
 , libpulseaudio
@@ -30,7 +30,7 @@ mkDerivation rec {
     libX11
     libass
     openal
-    ffmpeg
+    ffmpeg_4
     libuchardet
     alsa-lib
     libpulseaudio
diff --git a/pkgs/development/libraries/mediastreamer/default.nix b/pkgs/development/libraries/mediastreamer/default.nix
index fade17507ca4..75c8017145da 100644
--- a/pkgs/development/libraries/mediastreamer/default.nix
+++ b/pkgs/development/libraries/mediastreamer/default.nix
@@ -2,7 +2,7 @@
 , bzrtp
 , cmake
 , fetchFromGitLab
-, ffmpeg
+, ffmpeg_4
 , glew
 , gsm
 , lib
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
     bzrtp
     ortp
 
-    ffmpeg
+    ffmpeg_4
     glew
     libX11
     libXext
diff --git a/pkgs/development/libraries/pangolin/default.nix b/pkgs/development/libraries/pangolin/default.nix
index 468da57b1a90..727f41ca344b 100644
--- a/pkgs/development/libraries/pangolin/default.nix
+++ b/pkgs/development/libraries/pangolin/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, cmake, pkg-config, doxygen, libGL, glew
-, xorg, ffmpeg, libjpeg, libpng, libtiff, eigen
+, xorg, ffmpeg_4, libjpeg, libpng, libtiff, eigen
 , Carbon ? null, Cocoa ? null
 }:
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     libGL
     glew
     xorg.libX11
-    ffmpeg
+    ffmpeg_4
     libjpeg
     libpng
     libtiff
diff --git a/pkgs/development/libraries/xine-lib/default.nix b/pkgs/development/libraries/xine-lib/default.nix
index 263b6cd59590..837cc0d48b57 100644
--- a/pkgs/development/libraries/xine-lib/default.nix
+++ b/pkgs/development/libraries/xine-lib/default.nix
@@ -5,7 +5,7 @@
 , aalib
 , alsa-lib
 , autoconf
-, ffmpeg
+, ffmpeg_4
 , flac
 , libGL
 , libGLU
@@ -42,12 +42,6 @@ stdenv.mkDerivation rec {
       url = "https://raw.githubusercontent.com/archlinux/svntogit-community/209ae10d59d29c13633b75aa327cf937f3ff0725/trunk/010-xine-lib-libcaca-0.99.beta20-fix.patch";
       sha256 = "088141x1yp84y09x3s01v21yzas2bwavxz9v30z5hyq6c3syrmgr";
     })
-    # Fix build with ffmpeg 5.0 ; remove for xine-lib 1.2.12
-    (fetchpatch {
-      name = "xine-lib-ffmpeg-5.0-fix.patch";
-      url = "https://raw.githubusercontent.com/archlinux/svntogit-community/209ae10d59d29c13633b75aa327cf937f3ff0725/trunk/020-xine-lib-ffmpeg-5.0-fix.patch";
-      sha256 = "15ff15bqxq1nqqazfbmfq6swrdjr2raxyq7hx6k0r61izhf0g8ld";
-    })
   ];
 
   nativeBuildInputs = [
@@ -58,7 +52,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     aalib
     alsa-lib
-    ffmpeg
+    ffmpeg_4 # xine-lib 1.2.12 should support ffmpeg_5
     flac
     libGL
     libGLU
diff --git a/pkgs/development/octave-modules/video/default.nix b/pkgs/development/octave-modules/video/default.nix
index 57868e83f55e..d814e769ec62 100644
--- a/pkgs/development/octave-modules/video/default.nix
+++ b/pkgs/development/octave-modules/video/default.nix
@@ -3,7 +3,7 @@
 , lib
 , fetchurl
 , pkg-config
-, ffmpeg
+, ffmpeg_4
 }:
 
 buildOctavePackage rec {
@@ -20,7 +20,7 @@ buildOctavePackage rec {
   ];
 
   propagatedBuildInputs = [
-    ffmpeg
+    ffmpeg_4
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/ffmpeg-python/default.nix b/pkgs/development/python-modules/ffmpeg-python/default.nix
index 6f54fb16061a..0fb0c68d4cba 100644
--- a/pkgs/development/python-modules/ffmpeg-python/default.nix
+++ b/pkgs/development/python-modules/ffmpeg-python/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, ffmpeg
+, ffmpeg_4
 , future
 , pytest-mock
 , pytestCheckHook
@@ -36,7 +36,7 @@ buildPythonPackage rec {
   patches = [
     (substituteAll {
       src = ./ffmpeg-location.patch;
-      inherit ffmpeg;
+      ffmpeg = ffmpeg_4;
     })
   ];
 
diff --git a/pkgs/games/hedgewars/default.nix b/pkgs/games/hedgewars/default.nix
index 4c4914190ed4..6674c85c3323 100644
--- a/pkgs/games/hedgewars/default.nix
+++ b/pkgs/games/hedgewars/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, SDL2_image, SDL2_ttf, SDL2_net, fpc, ghcWithPackages, ffmpeg, freeglut
+{ stdenv, SDL2_image, SDL2_ttf, SDL2_net, fpc, ghcWithPackages, ffmpeg_4, freeglut
 , lib, fetchurl, cmake, pkg-config, lua5_1, SDL2, SDL2_mixer
 , zlib, libpng, libGL, libGLU, physfs
 , qtbase, qttools, wrapQtAppsHook
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     SDL2_ttf SDL2_net SDL2 SDL2_mixer SDL2_image
     fpc lua5_1
     llvm # hard-requirement on aarch64, for some reason not strictly necessary on x86-64
-    ffmpeg freeglut physfs
+    ffmpeg_4 freeglut physfs
     qtbase
   ] ++ lib.optional withServer ghc;
 
diff --git a/pkgs/games/openrw/default.nix b/pkgs/games/openrw/default.nix
index cd7d9cc1ae03..23475f8a55d2 100644
--- a/pkgs/games/openrw/default.nix
+++ b/pkgs/games/openrw/default.nix
@@ -11,7 +11,7 @@
 , openal
 , SDL2
 , boost
-, ffmpeg
+, ffmpeg_4
 , Cocoa
 , OpenAL }:
 
@@ -35,7 +35,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake ];
 
   buildInputs = [
-    sfml libGLU libGL bullet glm libmad openal SDL2 boost ffmpeg
+    sfml libGLU libGL bullet glm libmad openal SDL2 boost ffmpeg_4
   ] ++ lib.optionals stdenv.isDarwin [ OpenAL Cocoa ];
 
   meta = with lib; {
diff --git a/pkgs/games/performous/default.nix b/pkgs/games/performous/default.nix
index 7a58cc8e6008..2faa90006b55 100644
--- a/pkgs/games/performous/default.nix
+++ b/pkgs/games/performous/default.nix
@@ -5,7 +5,7 @@
 , aubio
 , boost
 , cmake
-, ffmpeg
+, ffmpeg_4
 , gettext
 , git
 , glew
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
     SDL2
     aubio
     boost
-    ffmpeg
+    ffmpeg_4
     glew
     glibmm
     glm
diff --git a/pkgs/games/stepmania/default.nix b/pkgs/games/stepmania/default.nix
index 6cb7a23dff5f..3ba39fde9c6c 100644
--- a/pkgs/games/stepmania/default.nix
+++ b/pkgs/games/stepmania/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, cmake, nasm
-, gtk2, glib, ffmpeg, alsa-lib, libmad, libogg, libvorbis
+, gtk2, glib, ffmpeg_4, alsa-lib, libmad, libogg, libvorbis
 , glew, libpulseaudio, udev
 }:
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake nasm ];
 
   buildInputs = [
-    gtk2 glib ffmpeg alsa-lib libmad libogg libvorbis
+    gtk2 glib ffmpeg_4 alsa-lib libmad libogg libvorbis
     glew libpulseaudio udev
   ];
 
diff --git a/pkgs/games/ultrastardx/default.nix b/pkgs/games/ultrastardx/default.nix
index 1d6f199480de..b0991af79cbe 100644
--- a/pkgs/games/ultrastardx/default.nix
+++ b/pkgs/games/ultrastardx/default.nix
@@ -14,7 +14,7 @@
 , SDL2_gfx
 , SDL2_mixer
 , SDL2_net, SDL2_ttf
-, ffmpeg
+, ffmpeg_4
 , sqlite
 , zlib
 , libX11
@@ -26,7 +26,7 @@ let
   sharedLibs = [
     pcre portaudio freetype
     SDL2 SDL2_image SDL2_gfx SDL2_mixer SDL2_net SDL2_ttf
-    sqlite lua zlib libX11 libGLU libGL ffmpeg
+    sqlite lua zlib libX11 libGLU libGL ffmpeg_4
   ];
 
 in stdenv.mkDerivation rec {
@@ -48,9 +48,8 @@ in stdenv.mkDerivation rec {
 
     # ultrastardx binds to libffmpeg (and sublibs), specifying a very restrictive
     # upper bounds on the minor versions of .so files.
-    # We can assume ffmpeg won’t break any major ABI compatibility, since their
-    # patch version seems to always stay at 100,
-    # and their minor version changes quite frequently.
+    # We can assume ffmpeg_4 won’t break any major ABI compatibility, since it's
+    # effectively EOL
     sed \
       -e 's/^  LIBAVCODEC_MAX_VERSION_MINOR.*$/  LIBAVCODEC_MAX_VERSION_MINOR = 1000;/' \
       -i src/lib/ffmpeg-4.0/avcodec.pas
diff --git a/pkgs/misc/screensavers/electricsheep/default.nix b/pkgs/misc/screensavers/electricsheep/default.nix
index 35155559531a..feef4e156e57 100644
--- a/pkgs/misc/screensavers/electricsheep/default.nix
+++ b/pkgs/misc/screensavers/electricsheep/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , autoreconfHook
 , wxGTK32
-, ffmpeg
+, ffmpeg_4
 , lua5_1
 , curl
 , libpng
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     wxGTK32
-    ffmpeg
+    ffmpeg_4
     lua5_1
     curl
     libpng
diff --git a/pkgs/os-specific/linux/guvcview/default.nix b/pkgs/os-specific/linux/guvcview/default.nix
index 43d8de62991a..6e073662c4e6 100644
--- a/pkgs/os-specific/linux/guvcview/default.nix
+++ b/pkgs/os-specific/linux/guvcview/default.nix
@@ -5,7 +5,7 @@
 , pkg-config
 , portaudio
 , SDL2
-, ffmpeg
+, ffmpeg_4
 , udev
 , libusb1
 , libv4l
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     SDL2
     alsa-lib
-    ffmpeg
+    ffmpeg_4
     libusb1
     libv4l
     portaudio
diff --git a/pkgs/servers/hydron/default.nix b/pkgs/servers/hydron/default.nix
index 453557d109ac..d0614dec6c10 100644
--- a/pkgs/servers/hydron/default.nix
+++ b/pkgs/servers/hydron/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , gitUpdater
 , pkg-config
-, ffmpeg
+, ffmpeg_4
 }:
 
 buildGoModule rec {
@@ -21,7 +21,7 @@ buildGoModule rec {
   proxyVendor = true;
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ ffmpeg ];
+  buildInputs = [ ffmpeg_4 ];
 
   passthru.updateScript = gitUpdater {
     rev-prefix = "v";
diff --git a/pkgs/servers/misc/oven-media-engine/default.nix b/pkgs/servers/misc/oven-media-engine/default.nix
index 42d86bedfc54..457dd4e9a51b 100644
--- a/pkgs/servers/misc/oven-media-engine/default.nix
+++ b/pkgs/servers/misc/oven-media-engine/default.nix
@@ -7,7 +7,7 @@
 , perl
 , openssl
 , zlib
-, ffmpeg
+, ffmpeg_4
 , libvpx
 , libopus
 , libuuid
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   nativeBuildInputs = [ bc pkg-config perl ];
-  buildInputs = [ openssl srt zlib ffmpeg libvpx libopus srtp jemalloc pcre2 libuuid hiredis ];
+  buildInputs = [ openssl srt zlib ffmpeg_4 libvpx libopus srtp jemalloc pcre2 libuuid hiredis ];
 
   preBuild = ''
     patchShebangs core/colorg++
diff --git a/pkgs/servers/tvheadend/default.nix b/pkgs/servers/tvheadend/default.nix
index 75466c0ee21c..573a857becd7 100644
--- a/pkgs/servers/tvheadend/default.nix
+++ b/pkgs/servers/tvheadend/default.nix
@@ -14,7 +14,7 @@
 , bzip2
 , dbus
 , dtv-scan-tables
-, ffmpeg
+, ffmpeg_4
 , gettext
 , gnutar
 , gzip
@@ -64,7 +64,7 @@ in stdenv.mkDerivation {
     avahi
     bzip2
     dbus
-    ffmpeg
+    ffmpeg_4 # depends on libav
     gettext
     gzip
     libiconv
diff --git a/pkgs/tools/audio/acoustid-fingerprinter/default.nix b/pkgs/tools/audio/acoustid-fingerprinter/default.nix
index 4fc3d957e13d..21dc009e33dd 100644
--- a/pkgs/tools/audio/acoustid-fingerprinter/default.nix
+++ b/pkgs/tools/audio/acoustid-fingerprinter/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, cmake, pkg-config, qt4, taglib, chromaprint, ffmpeg }:
+{ lib, stdenv, fetchurl, fetchpatch, cmake, pkg-config, qt4, taglib, chromaprint, ffmpeg_4 }:
 
 stdenv.mkDerivation rec {
   pname = "acoustid-fingerprinter";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ qt4 taglib chromaprint ffmpeg ];
+  buildInputs = [ qt4 taglib chromaprint ffmpeg_4 ];
 
   cmakeFlags = [ "-DTAGLIB_MIN_VERSION=${lib.getVersion taglib}" ];
 
diff --git a/pkgs/tools/audio/loudgain/default.nix b/pkgs/tools/audio/loudgain/default.nix
index 9d4a9444b7fc..caf1294c751f 100644
--- a/pkgs/tools/audio/loudgain/default.nix
+++ b/pkgs/tools/audio/loudgain/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, ffmpeg, libebur128
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, ffmpeg_4, libebur128
 , libresample, taglib, zlib }:
 
 stdenv.mkDerivation rec {
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ ffmpeg libebur128 libresample taglib zlib ];
+  buildInputs = [ ffmpeg_4 libebur128 libresample taglib zlib ];
 
   postInstall = ''
     sed -e "1aPATH=$out/bin:\$PATH" -i "$out/bin/rgbpm"
diff --git a/pkgs/tools/graphics/vulkan-cts/default.nix b/pkgs/tools/graphics/vulkan-cts/default.nix
index 003a3c18bfbf..0835540d92d8 100644
--- a/pkgs/tools/graphics/vulkan-cts/default.nix
+++ b/pkgs/tools/graphics/vulkan-cts/default.nix
@@ -2,7 +2,7 @@
 , fetchFromGitHub
 , fetchurl
 , cmake
-, ffmpeg
+, ffmpeg_4
 , libdrm
 , libglvnd
 , libffi
@@ -103,7 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   buildInputs = [
-    ffmpeg
+    ffmpeg_4
     libdrm
     libffi
     libglvnd
diff --git a/pkgs/tools/video/harvid/default.nix b/pkgs/tools/video/harvid/default.nix
index 90ed6d425869..655d1ba3874f 100644
--- a/pkgs/tools/video/harvid/default.nix
+++ b/pkgs/tools/video/harvid/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, ffmpeg, libjpeg, libpng, pkg-config }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, ffmpeg_4, libjpeg, libpng, pkg-config }:
 
 stdenv.mkDerivation rec {
   pname = "harvid";
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ ffmpeg libjpeg libpng ];
+  buildInputs = [ ffmpeg_4 libjpeg libpng ];
 
   makeFlags = [ "DESTDIR=$(out)" "libdir=\"/lib\"" ];
 
diff --git a/pkgs/tools/video/untrunc-anthwlock/default.nix b/pkgs/tools/video/untrunc-anthwlock/default.nix
index c127bfe8740e..33ec940aebc4 100644
--- a/pkgs/tools/video/untrunc-anthwlock/default.nix
+++ b/pkgs/tools/video/untrunc-anthwlock/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, ffmpeg, libui }:
+{ lib, stdenv, fetchFromGitHub, ffmpeg_4, libui }:
 
 stdenv.mkDerivation {
   pname = "untrunc-anthwlock";
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "14i2lq68q990hnm2kkfamlsi67bcml85zl8yjsyxc5h8ncc2f3dp";
   };
 
-  buildInputs = [ ffmpeg libui ];
+  buildInputs = [ ffmpeg_4 libui ];
 
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/tools/video/xjadeo/default.nix b/pkgs/tools/video/xjadeo/default.nix
index e638278f8ba8..e7c237e1698e 100644
--- a/pkgs/tools/video/xjadeo/default.nix
+++ b/pkgs/tools/video/xjadeo/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, autoreconfHook, fetchFromGitHub, ffmpeg, freetype, libGLU
+{ lib, stdenv, autoreconfHook, fetchFromGitHub, ffmpeg_4, freetype, libGLU
 , libjack2, liblo, libX11, libXv, pkg-config, portmidi, xorg }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [
-    ffmpeg
+    ffmpeg_4
     libjack2
     libX11
     xorg.libXext

From f8264a5b1e7832d93d8a22816f5133ff891724b6 Mon Sep 17 00:00:00 2001
From: Atemu <atemu.main@gmail.com>
Date: Fri, 3 Mar 2023 19:43:12 +0100
Subject: [PATCH 106/154] tree-wide: mark broken packages as such

Found while changing ffmpeg from 4 to 5; these all depend on ffmpeg either
directly or transitively.
---
 pkgs/applications/blockchains/bitcoin-unlimited/default.nix | 2 +-
 pkgs/applications/blockchains/dogecoin/default.nix          | 1 +
 pkgs/applications/blockchains/pivx/default.nix              | 2 +-
 pkgs/applications/graphics/fluxus/default.nix               | 1 +
 pkgs/applications/graphics/gnome-decoder/default.nix        | 1 +
 pkgs/applications/terminal-emulators/syncterm/default.nix   | 3 ++-
 pkgs/applications/video/rtabmap/default.nix                 | 1 +
 pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix   | 2 +-
 pkgs/development/libraries/openhmd/default.nix              | 1 +
 pkgs/development/python-modules/apache-beam/default.nix     | 1 +
 pkgs/development/python-modules/pims/default.nix            | 1 +
 pkgs/development/python-modules/pydevd/default.nix          | 1 +
 pkgs/development/python-modules/python-efl/default.nix      | 1 +
 pkgs/development/python-modules/spectral-cube/default.nix   | 2 +-
 pkgs/development/python-modules/sunpy/default.nix           | 1 +
 pkgs/development/python-modules/wxPython/4.0.nix            | 1 +
 pkgs/development/python-modules/wxPython/4.1.nix            | 1 +
 pkgs/development/tools/shadered/default.nix                 | 1 +
 pkgs/games/openclonk/default.nix                            | 1 +
 pkgs/games/spring/default.nix                               | 1 +
 20 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/blockchains/bitcoin-unlimited/default.nix b/pkgs/applications/blockchains/bitcoin-unlimited/default.nix
index 3fbf9615f7db..033c3d6ed9bf 100644
--- a/pkgs/applications/blockchains/bitcoin-unlimited/default.nix
+++ b/pkgs/applications/blockchains/bitcoin-unlimited/default.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.bitcoinunlimited.info/";
     maintainers = with maintainers; [ DmitryTsygankov ];
     license = licenses.mit;
-    broken = stdenv.isDarwin;
+    broken = true;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/blockchains/dogecoin/default.nix b/pkgs/applications/blockchains/dogecoin/default.nix
index 421c2fe667e0..1c6a7212e2ed 100644
--- a/pkgs/applications/blockchains/dogecoin/default.nix
+++ b/pkgs/applications/blockchains/dogecoin/default.nix
@@ -54,5 +54,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = with maintainers; [ edwtjo offline ];
     platforms = platforms.unix;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/blockchains/pivx/default.nix b/pkgs/applications/blockchains/pivx/default.nix
index 55fa6f96a751..7b03cc494b50 100644
--- a/pkgs/applications/blockchains/pivx/default.nix
+++ b/pkgs/applications/blockchains/pivx/default.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
+    broken = true;
     description = "An open source crypto-currency focused on fast private transactions";
     longDescription = ''
       PIVX is an MIT licensed, open source, blockchain-based cryptocurrency with
diff --git a/pkgs/applications/graphics/fluxus/default.nix b/pkgs/applications/graphics/fluxus/default.nix
index 971ce42c03f9..b51fe8284780 100644
--- a/pkgs/applications/graphics/fluxus/default.nix
+++ b/pkgs/applications/graphics/fluxus/default.nix
@@ -72,5 +72,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     homepage = "http://www.pawfal.org/fluxus/";
     maintainers = [ maintainers.brainrape ];
+    broken = true;
   };
 }
diff --git a/pkgs/applications/graphics/gnome-decoder/default.nix b/pkgs/applications/graphics/gnome-decoder/default.nix
index 3e365d299f9a..47cd856c79ba 100644
--- a/pkgs/applications/graphics/gnome-decoder/default.nix
+++ b/pkgs/applications/graphics/gnome-decoder/default.nix
@@ -78,5 +78,6 @@ clangStdenv.mkDerivation rec {
     platforms = platforms.linux;
     mainProgram = "decoder";
     maintainers = with maintainers; [ zendo ];
+    broken = true;
   };
 }
diff --git a/pkgs/applications/terminal-emulators/syncterm/default.nix b/pkgs/applications/terminal-emulators/syncterm/default.nix
index e2b51614633d..59e0b3a735e0 100644
--- a/pkgs/applications/terminal-emulators/syncterm/default.nix
+++ b/pkgs/applications/terminal-emulators/syncterm/default.nix
@@ -32,7 +32,8 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     # error: unsupported option '-fsanitize=safe-stack' for target 'x86_64-apple-darwin'
-    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
+    # broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
+    broken = true; # sendmsg.c:(.text+0x1099): undefined reference to `pthread_yield'
     homepage = "https://syncterm.bbsdev.net/";
     description = "BBS terminal emulator";
     maintainers = with maintainers; [ embr ];
diff --git a/pkgs/applications/video/rtabmap/default.nix b/pkgs/applications/video/rtabmap/default.nix
index 30c364578eb0..cecf6a3e4d3d 100644
--- a/pkgs/applications/video/rtabmap/default.nix
+++ b/pkgs/applications/video/rtabmap/default.nix
@@ -60,5 +60,6 @@ stdenv.mkDerivation rec {
     license = licenses.bsd3;
     maintainers = with maintainers; [ ckie ];
     platforms = with platforms; linux;
+    broken = true;
   };
 }
diff --git a/pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix b/pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix
index 759fd1d9bfe3..32486875dc58 100644
--- a/pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix
+++ b/pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix
@@ -32,6 +32,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ doronbehar ];
     platforms = platforms.linux;
+    broken = true;
   };
 }
-
diff --git a/pkgs/development/libraries/openhmd/default.nix b/pkgs/development/libraries/openhmd/default.nix
index ce0630bee62f..cb6a54b7dff1 100644
--- a/pkgs/development/libraries/openhmd/default.nix
+++ b/pkgs/development/libraries/openhmd/default.nix
@@ -60,5 +60,6 @@ stdenv.mkDerivation rec {
     license = licenses.boost;
     maintainers = with maintainers; [ oxij ];
     platforms = platforms.unix;
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/apache-beam/default.nix b/pkgs/development/python-modules/apache-beam/default.nix
index 2fb7d3efcdc2..468da0499aef 100644
--- a/pkgs/development/python-modules/apache-beam/default.nix
+++ b/pkgs/development/python-modules/apache-beam/default.nix
@@ -207,5 +207,6 @@ buildPythonPackage rec {
     homepage = "https://beam.apache.org/";
     license = licenses.asl20;
     maintainers = with maintainers; [ ndl ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/pims/default.nix b/pkgs/development/python-modules/pims/default.nix
index 19052eb49342..531cad0bc069 100644
--- a/pkgs/development/python-modules/pims/default.nix
+++ b/pkgs/development/python-modules/pims/default.nix
@@ -53,5 +53,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/soft-matter/pims";
     license = licenses.bsd3;
     maintainers = with maintainers; [ costrouc ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/pydevd/default.nix b/pkgs/development/python-modules/pydevd/default.nix
index f595eb5d0b26..db022588f392 100644
--- a/pkgs/development/python-modules/pydevd/default.nix
+++ b/pkgs/development/python-modules/pydevd/default.nix
@@ -53,5 +53,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/fabioz/PyDev.Debugger";
     license = licenses.epl10;
     maintainers = with maintainers; [ onny ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/python-efl/default.nix b/pkgs/development/python-modules/python-efl/default.nix
index 046b32c2177a..77e6266ffd37 100644
--- a/pkgs/development/python-modules/python-efl/default.nix
+++ b/pkgs/development/python-modules/python-efl/default.nix
@@ -48,5 +48,6 @@ buildPythonPackage rec {
     platforms = platforms.linux;
     license = with licenses; [ gpl3 lgpl3 ];
     maintainers = with maintainers; [ matejc ftrvxmtrx ] ++ teams.enlightenment.members;
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/spectral-cube/default.nix b/pkgs/development/python-modules/spectral-cube/default.nix
index eb208528c980..298ac0a27106 100644
--- a/pkgs/development/python-modules/spectral-cube/default.nix
+++ b/pkgs/development/python-modules/spectral-cube/default.nix
@@ -46,6 +46,6 @@ buildPythonPackage rec {
     license = lib.licenses.bsd3;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ smaret ];
+    broken = true;
   };
 }
-
diff --git a/pkgs/development/python-modules/sunpy/default.nix b/pkgs/development/python-modules/sunpy/default.nix
index d316598946d1..829c4ee6b2bc 100644
--- a/pkgs/development/python-modules/sunpy/default.nix
+++ b/pkgs/development/python-modules/sunpy/default.nix
@@ -159,5 +159,6 @@ buildPythonPackage rec {
     homepage = "https://sunpy.org";
     license = licenses.bsd2;
     maintainers = with maintainers; [ costrouc ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/wxPython/4.0.nix b/pkgs/development/python-modules/wxPython/4.0.nix
index 64123cafd4a1..6be18811adab 100644
--- a/pkgs/development/python-modules/wxPython/4.0.nix
+++ b/pkgs/development/python-modules/wxPython/4.0.nix
@@ -83,6 +83,7 @@ buildPythonPackage rec {
     description = "Cross platform GUI toolkit for Python, Phoenix version";
     homepage = "http://wxpython.org/";
     license = lib.licenses.wxWindows;
+    broken = true;
   };
 
 }
diff --git a/pkgs/development/python-modules/wxPython/4.1.nix b/pkgs/development/python-modules/wxPython/4.1.nix
index 4b3e62a2eece..f3a5ca9061b8 100644
--- a/pkgs/development/python-modules/wxPython/4.1.nix
+++ b/pkgs/development/python-modules/wxPython/4.1.nix
@@ -142,5 +142,6 @@ buildPythonPackage rec {
     homepage = "http://wxpython.org/";
     license = licenses.wxWindows;
     maintainers = with maintainers; [ tfmoraes ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/tools/shadered/default.nix b/pkgs/development/tools/shadered/default.nix
index 07397f48ad15..cebb9704d180 100644
--- a/pkgs/development/tools/shadered/default.nix
+++ b/pkgs/development/tools/shadered/default.nix
@@ -45,5 +45,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/dfranx/SHADERed";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ Scriptkiddi ];
+    broken = true;
   };
 }
diff --git a/pkgs/games/openclonk/default.nix b/pkgs/games/openclonk/default.nix
index 9dc267032ae7..4b526975349b 100644
--- a/pkgs/games/openclonk/default.nix
+++ b/pkgs/games/openclonk/default.nix
@@ -41,5 +41,6 @@ in stdenv.mkDerivation rec {
     license = if enableSoundtrack then licenses.unfreeRedistributable else licenses.isc;
     maintainers = with maintainers; [ lheckemann ];
     platforms = [ "x86_64-linux" "i686-linux" ];
+    broken = true;
   };
 }
diff --git a/pkgs/games/spring/default.nix b/pkgs/games/spring/default.nix
index 8577db773e3f..0a2eb6cfc911 100644
--- a/pkgs/games/spring/default.nix
+++ b/pkgs/games/spring/default.nix
@@ -87,5 +87,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ qknight domenkozar sorki ];
     platforms = [ "x86_64-linux" ];
+    broken = true;
   };
 }

From a3d10c676f813f6393e38c4bbe01b640fb791947 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 11 Mar 2023 08:35:43 +1000
Subject: [PATCH 107/154] sqlite: 3.41.0 -> 3.41.1

https://www.sqlite.org/releaselog/3_41_1.html
---
 pkgs/development/libraries/sqlite/default.nix | 4 ++--
 pkgs/development/libraries/sqlite/tools.nix   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 981a0c9cebb5..162a5f7b2c6e 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -15,13 +15,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${lib.optionalString interactive "-interactive"}";
-  version = "3.41.0";
+  version = "3.41.1";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2023/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    hash = "sha256-Sfd6xT/Zql1zlfJJnLgWQQ5WIZhKEhuFjMygUxCwXHA=";
+    hash = "sha256-Ta376rn44WxpXU+7xRwWsvd/uX/0wcPROZGd/AOMnjM=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 50c246464bd1..27dc3c02b70b 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -4,12 +4,12 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.41.0";
+    version = "3.41.1";
 
     # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2023/sqlite-src-${archiveVersion version}.zip";
-      hash = "sha256-ZKdjijXoa5kfDBWujigwBjtpSygGi491lTWOMgWp62Y=";
+      hash = "sha256-25KQEvkAnn8Hlg5/AX6DLYeJop9LIDBxtP15Ip59eiA=";
     };
 
     nativeBuildInputs = [ unzip ];

From 3e331bf5b3978e68597a320d55712e8f75196dad Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Mar 2023 17:18:04 +0000
Subject: [PATCH 108/154] directx-headers: 1.608.2 -> 1.608.2b

---
 pkgs/development/libraries/directx-headers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/directx-headers/default.nix b/pkgs/development/libraries/directx-headers/default.nix
index 3ac15bb85e24..6d3cc1975464 100644
--- a/pkgs/development/libraries/directx-headers/default.nix
+++ b/pkgs/development/libraries/directx-headers/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, meson, ninja }:
 stdenv.mkDerivation rec {
   pname = "directx-headers";
-  version = "1.608.2";
+  version = "1.608.2b";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "DirectX-Headers";
     rev = "v${version}";
-    hash = "sha256-F0riTDJpydqe4yhE9GKSSvnRI0Sl3oY2sOP+H/vDHG0=";
+    hash = "sha256-o4p8L2VKvMHdu1L2I1JI6pwIRtnyVCoKebg9yKTk1T8=";
   };
 
   nativeBuildInputs = [ meson ninja ];

From ef6952158cb5b31d1505f217d9fa0f55e4999120 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 9 Mar 2023 15:32:19 +0300
Subject: [PATCH 109/154] tinycompress: init at 1.2.8

Will be used by Pipewire later.
---
 .../libraries/tinycompress/default.nix        | 22 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 ++
 2 files changed, 24 insertions(+)
 create mode 100644 pkgs/development/libraries/tinycompress/default.nix

diff --git a/pkgs/development/libraries/tinycompress/default.nix b/pkgs/development/libraries/tinycompress/default.nix
new file mode 100644
index 000000000000..96b82bc696fc
--- /dev/null
+++ b/pkgs/development/libraries/tinycompress/default.nix
@@ -0,0 +1,22 @@
+{ lib
+, stdenv
+, fetchurl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "tinycompress";
+  version = "1.2.8";
+
+  src = fetchurl {
+    url = "mirror://alsa/tinycompress/${pname}-${version}.tar.bz2";
+    hash = "sha256-L4l+URLNO8pnkLXOz9puBmLIvF7g+6uXKyR6DMYg1mw=";
+  };
+
+  meta = with lib; {
+    homepage = "http://www.alsa-project.org/";
+    description = "a userspace library for anyone who wants to use the ALSA compressed APIs";
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ k900 ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 53f98f0a1ce6..9687396f1154 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12747,6 +12747,8 @@ with pkgs;
 
   tinycbor = callPackage ../development/libraries/tinycbor { };
 
+  tinycompress = callPackage ../development/libraries/tinycompress { };
+
   tinyfecvpn = callPackage ../tools/networking/tinyfecvpn { };
 
   tinygltf = callPackage ../development/libraries/tinygltf { };

From 6ff293ecbc181c2339a085ed615d1a50727cc7a3 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 9 Mar 2023 15:32:35 +0300
Subject: [PATCH 110/154] pipewire: enable compress-offload

---
 pkgs/development/libraries/pipewire/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 29db9019b11c..6679085e2a79 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -63,6 +63,7 @@
 , xorg
 , mysofaSupport ? true
 , libmysofa
+, tinycompress
 }:
 
 let
@@ -132,6 +133,7 @@ let
       vulkan-headers
       vulkan-loader
       webrtc-audio-processing
+      tinycompress
     ] ++ (if enableSystemd then [ systemd ] else [ eudev ])
     ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
     ++ lib.optionals libcameraSupport [ libcamera libdrm ]
@@ -180,6 +182,7 @@ let
       "-Dlibmysofa=${mesonEnableFeature mysofaSupport}"
       "-Dsdl2=disabled" # required only to build examples, causes dependency loop
       "-Drlimits-install=false" # installs to /etc, we won't use this anyway
+      "-Dcompress-offload=enabled"
     ];
 
     # Fontconfig error: Cannot load default config file

From b8ac3f9a93cac7a54aafc366f221b372dd59b463 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 9 Mar 2023 15:34:16 +0300
Subject: [PATCH 111/154] pipewire: 0.3.66 -> 0.3.67

---
 .../modules/services/desktops/pipewire/daemon/jack.conf.json  | 3 ++-
 pkgs/development/libraries/pipewire/default.nix               | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/desktops/pipewire/daemon/jack.conf.json b/nixos/modules/services/desktops/pipewire/daemon/jack.conf.json
index f2e396dd28d7..3186e67f0cf1 100644
--- a/nixos/modules/services/desktops/pipewire/daemon/jack.conf.json
+++ b/nixos/modules/services/desktops/pipewire/daemon/jack.conf.json
@@ -54,8 +54,9 @@
       ],
       "actions": {
         "update-props": {
+          "node.always-process": false,
           "node.pause-on-idle": false,
-          "node.passive": true
+          "node.passive": "out"
         }
       }
     },
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 6679085e2a79..db8dc38c4bdd 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -71,7 +71,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.66";
+    version = "0.3.67";
 
     outputs = [
       "out"
@@ -89,7 +89,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-qx4mgNRhMdha+8ap+FhVfxpsHE9TcTx29uwQIHLyMHA=";
+      sha256 = "sha256-YM1WOv/SqaGnYevwoFxoOQhF6loFVx/fVPHQY3mpaH0=";
     };
 
     patches = [

From 1fab86929f7df5cdd60bcf65b4c78f4058777a03 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 9 Mar 2023 15:44:23 +0300
Subject: [PATCH 112/154] nixos/pipewire: spring cleaning

- drop media-session (rip :skull:)
- stop trying to let people override default configs, those never got merged correctly
- drop all the complexity arising from having to vendor default config files
- build docs in sandbox as we no longer recurse
---
 .../manual/release-notes/rl-2305.section.md   |  85 +++++++++++
 nixos/modules/module-list.nix                 |   1 -
 .../pipewire/daemon/client-rt.conf.json       |  54 -------
 .../desktops/pipewire/daemon/client.conf.json |  31 ----
 .../pipewire/daemon/filter-chain.conf.json    |  28 ----
 .../desktops/pipewire/daemon/jack.conf.json   |  76 ----------
 .../pipewire/daemon/minimal.conf.json         | 120 ---------------
 .../pipewire/daemon/pipewire-aes67.conf.json  |  38 -----
 .../pipewire/daemon/pipewire-avb.conf.json    |  38 -----
 .../pipewire/daemon/pipewire-pulse.conf.json  | 106 -------------
 .../pipewire/daemon/pipewire.conf.json        | 110 --------------
 .../media-session/alsa-monitor.conf.json      |  34 -----
 .../media-session/bluez-monitor.conf.json     |  36 -----
 .../media-session/media-session.conf.json     |  68 ---------
 .../media-session/v4l2-monitor.conf.json      |  30 ----
 .../pipewire/pipewire-media-session.nix       | 141 ------------------
 .../services/desktops/pipewire/pipewire.nix   | 111 ++------------
 .../desktops/pipewire/wireplumber.nix         |   4 -
 .../libraries/pipewire/default.nix            |  38 +----
 .../libraries/pipewire/media-session.nix      | 109 --------------
 .../libraries/pipewire/test-paths.nix         |  23 ---
 .../pipewire/update-media-session.sh          |  24 ---
 .../libraries/pipewire/update-pipewire.sh     |  25 ----
 pkgs/top-level/aliases.nix                    |   1 +
 pkgs/top-level/all-packages.nix               |   2 -
 25 files changed, 99 insertions(+), 1234 deletions(-)
 delete mode 100644 nixos/modules/services/desktops/pipewire/daemon/client-rt.conf.json
 delete mode 100644 nixos/modules/services/desktops/pipewire/daemon/client.conf.json
 delete mode 100644 nixos/modules/services/desktops/pipewire/daemon/filter-chain.conf.json
 delete mode 100644 nixos/modules/services/desktops/pipewire/daemon/jack.conf.json
 delete mode 100644 nixos/modules/services/desktops/pipewire/daemon/minimal.conf.json
 delete mode 100644 nixos/modules/services/desktops/pipewire/daemon/pipewire-aes67.conf.json
 delete mode 100644 nixos/modules/services/desktops/pipewire/daemon/pipewire-avb.conf.json
 delete mode 100644 nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json
 delete mode 100644 nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json
 delete mode 100644 nixos/modules/services/desktops/pipewire/media-session/alsa-monitor.conf.json
 delete mode 100644 nixos/modules/services/desktops/pipewire/media-session/bluez-monitor.conf.json
 delete mode 100644 nixos/modules/services/desktops/pipewire/media-session/media-session.conf.json
 delete mode 100644 nixos/modules/services/desktops/pipewire/media-session/v4l2-monitor.conf.json
 delete mode 100644 nixos/modules/services/desktops/pipewire/pipewire-media-session.nix
 delete mode 100644 pkgs/development/libraries/pipewire/media-session.nix
 delete mode 100644 pkgs/development/libraries/pipewire/test-paths.nix
 delete mode 100755 pkgs/development/libraries/pipewire/update-media-session.sh
 delete mode 100755 pkgs/development/libraries/pipewire/update-pipewire.sh

diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index ff01d7228df3..62ddb6c9530d 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -157,6 +157,9 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - conntrack helper autodetection has been removed from kernels 6.0 and up upstream, and an assertion was added to ensure things don't silently stop working. Migrate your configuration to assign helpers explicitly or use an older LTS kernel branch as a temporary workaround.
 
+- The `services.pipewire.config` options have been removed, as they have basically never worked correctly. All behavior defined by the default configuration can be overridden with drop-in files as necessary - see [below](#sec-release-23.05-migration-pipewire) for details.
+
+- `services.pipewire.media-session` and the `pipewire-media-session` package have been removed, as they are no longer supported upstream. Users are encouraged to use `services.pipewire.wireplumber` instead.
 ## Other Notable Changes {#sec-release-23.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -301,3 +304,85 @@ In addition to numerous new and upgraded packages, this release has the followin
 - The option `services.prometheus.exporters.pihole.interval` does not exist anymore and has been removed.
 
 - `k3s` can now be configured with an EnvironmentFile for its systemd service, allowing secrets to be provided without ending up in the Nix Store.
+
+## Detailed migration information {#sec-release-23.05-migration}
+
+### Pipewire configuration overrides {#sec-release-23.05-migration-pipewire}
+
+#### Why this change? {#sec-release-23.05-migration-pipewire-why}
+
+The Pipewire config semantics don't really match the NixOS module semantics, so it's extremely awkward to override the default config, especially when lists are involved. Vendoring the configuration files in nixpkgs also creates unnecessary maintenance overhead.
+
+Also, upstream added a lot of accomodations to allow doing most of the things you'd want to do with a config edit in better ways.
+
+#### Migrating your configuration {#sec-release-23.05-migration-pipewire-how}
+
+Compare your settings to [the defaults](https://gitlab.freedesktop.org/pipewire/pipewire/-/tree/master/src/daemon) and where your configuration differs from them.
+
+Then, create a drop-in JSON file in `/etc/pipewire/<config file name>.d/99-custom.conf` (the actual filename can be anything) and migrate your changes to it according to the following sections.
+
+Repeat for every file you've modified, changing the directory name accordingly.
+
+#### Things you can just copy over {#sec-release-23.05-migration-pipewire-simple}
+
+If you are:
+
+- setting properties via `*.properties`
+- loading a new module to `context.modules`
+- creating new objects with `context.objects`
+- declaring SPA libraries with `context.spa-libs`
+- running custom commands with `context.exec`
+- adding new rules with `*.rules`
+- running custom PulseAudio commands with `pulse.cmd`
+
+Simply move the definitions into the drop-in.
+
+Note that the use of `context.exec` is not recommended and other methods of running your thing are likely a better option.
+
+```json
+{
+  "context.properties": {
+    "your.property.name": "your.property.value"
+  },
+  "context.modules": [
+    { "name": "libpipewire-module-my-cool-thing" }
+  ],
+  "context.objects": [
+    { "factory": { ... } }
+  ],
+  "alsa.rules": [
+    { "matches: { ... }, "actions": { ... } }
+  ]
+}
+```
+
+#### Removing a module from `context.modules` {#sec-release-23.05-migration-pipewire-removing-modules}
+
+Look for an option to disable it via `context.properties` (`"module.x11.bell": "false"` is likely the most common use case here).
+If one is not available, proceed to [Nuclear option](#sec-release-23.05-migration-pipewire).
+
+#### Modifying a module's parameters in `context.modules` {#sec-release-23.05-migration-pipewire-modifying-modules}
+
+For most modules (e.g. `libpipewire-module-rt`) it's enough to load the module again with the new arguments, e.g.:
+
+```json
+{
+  "context.modules": [
+    {
+      "name": "libpipewire-module-rt",
+      "args": {
+        "rt.prio": 90
+      }
+    }
+  ]
+}
+```
+
+Note that `module-rt` specifically will generally use the highest values available by default, so setting limits on the `pipewire` systemd service is preferable to reloading.
+
+If reloading the module is not an option, proceed to [Nuclear option](#sec-release-23.05-migration-pipewire).
+
+#### Nuclear option {#sec-release-23.05-migration-pipewire-nuclear}
+If all else fails, you can still manually copy the contents of the default configuration file
+from `${pkgs.pipewire.lib}/share/pipewire` to `/etc/pipewire` and edit it to fully override the default.
+However, this should be done only as a last resort. Please talk to the Pipewire maintainers if you ever need to do this.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 60f3bbc98c0c..ae90adfb4e3c 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -429,7 +429,6 @@
   ./services/desktops/gvfs.nix
   ./services/desktops/malcontent.nix
   ./services/desktops/neard.nix
-  ./services/desktops/pipewire/pipewire-media-session.nix
   ./services/desktops/pipewire/pipewire.nix
   ./services/desktops/pipewire/wireplumber.nix
   ./services/desktops/profile-sync-daemon.nix
diff --git a/nixos/modules/services/desktops/pipewire/daemon/client-rt.conf.json b/nixos/modules/services/desktops/pipewire/daemon/client-rt.conf.json
deleted file mode 100644
index c204606193af..000000000000
--- a/nixos/modules/services/desktops/pipewire/daemon/client-rt.conf.json
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  "context.properties": {
-    "log.level": 0
-  },
-  "context.spa-libs": {
-    "audio.convert.*": "audioconvert/libspa-audioconvert",
-    "support.*": "support/libspa-support"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rt",
-      "args": {},
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-client-device"
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    },
-    {
-      "name": "libpipewire-module-metadata"
-    },
-    {
-      "name": "libpipewire-module-session-manager"
-    }
-  ],
-  "filter.properties": {},
-  "stream.properties": {},
-  "alsa.properties": {},
-  "alsa.rules": [
-    {
-      "matches": [
-        {
-          "application.process.binary": "resolve"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "alsa.buffer-bytes": 131072
-        }
-      }
-    }
-  ]
-}
diff --git a/nixos/modules/services/desktops/pipewire/daemon/client.conf.json b/nixos/modules/services/desktops/pipewire/daemon/client.conf.json
deleted file mode 100644
index 71294a0e78a2..000000000000
--- a/nixos/modules/services/desktops/pipewire/daemon/client.conf.json
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  "context.properties": {
-    "log.level": 0
-  },
-  "context.spa-libs": {
-    "audio.convert.*": "audioconvert/libspa-audioconvert",
-    "support.*": "support/libspa-support"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-client-device"
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    },
-    {
-      "name": "libpipewire-module-metadata"
-    },
-    {
-      "name": "libpipewire-module-session-manager"
-    }
-  ],
-  "filter.properties": {},
-  "stream.properties": {}
-}
diff --git a/nixos/modules/services/desktops/pipewire/daemon/filter-chain.conf.json b/nixos/modules/services/desktops/pipewire/daemon/filter-chain.conf.json
deleted file mode 100644
index 689fca88359b..000000000000
--- a/nixos/modules/services/desktops/pipewire/daemon/filter-chain.conf.json
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  "context.properties": {
-    "log.level": 0
-  },
-  "context.spa-libs": {
-    "audio.convert.*": "audioconvert/libspa-audioconvert",
-    "support.*": "support/libspa-support"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rt",
-      "args": {},
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    }
-  ]
-}
diff --git a/nixos/modules/services/desktops/pipewire/daemon/jack.conf.json b/nixos/modules/services/desktops/pipewire/daemon/jack.conf.json
deleted file mode 100644
index 3186e67f0cf1..000000000000
--- a/nixos/modules/services/desktops/pipewire/daemon/jack.conf.json
+++ /dev/null
@@ -1,76 +0,0 @@
-{
-  "context.properties": {
-    "log.level": 0
-  },
-  "context.spa-libs": {
-    "support.*": "support/libspa-support"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rt",
-      "args": {},
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-metadata"
-    }
-  ],
-  "jack.properties": {},
-  "jack.rules": [
-    {
-      "matches": [
-        {}
-      ],
-      "actions": {
-        "update-props": {}
-      }
-    },
-    {
-      "matches": [
-        {
-          "application.process.binary": "jack_bufsize"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "jack.global-buffer-size": true
-        }
-      }
-    },
-    {
-      "matches": [
-        {
-          "application.process.binary": "qsynth"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "node.always-process": false,
-          "node.pause-on-idle": false,
-          "node.passive": "out"
-        }
-      }
-    },
-    {
-      "matches": [
-        {
-          "client.name": "Mixxx"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "jack.merge-monitor": false
-        }
-      }
-    }
-  ]
-}
diff --git a/nixos/modules/services/desktops/pipewire/daemon/minimal.conf.json b/nixos/modules/services/desktops/pipewire/daemon/minimal.conf.json
deleted file mode 100644
index 0f1ebe5749c6..000000000000
--- a/nixos/modules/services/desktops/pipewire/daemon/minimal.conf.json
+++ /dev/null
@@ -1,120 +0,0 @@
-{
-  "context.properties": {
-    "link.max-buffers": 16,
-    "core.daemon": true,
-    "core.name": "pipewire-0",
-    "settings.check-quantum": true,
-    "settings.check-rate": true,
-    "vm.overrides": {
-      "default.clock.min-quantum": 1024
-    }
-  },
-  "context.spa-libs": {
-    "audio.convert.*": "audioconvert/libspa-audioconvert",
-    "api.alsa.*": "alsa/libspa-alsa",
-    "support.*": "support/libspa-support"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rt",
-      "args": {
-        "nice.level": -11
-      },
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-profiler"
-    },
-    {
-      "name": "libpipewire-module-metadata"
-    },
-    {
-      "name": "libpipewire-module-spa-node-factory"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-access",
-      "args": {}
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    },
-    {
-      "name": "libpipewire-module-link-factory"
-    }
-  ],
-  "context.objects": [
-    {
-      "factory": "metadata",
-      "args": {
-        "metadata.name": "default"
-      }
-    },
-    {
-      "factory": "spa-node-factory",
-      "args": {
-        "factory.name": "support.node.driver",
-        "node.name": "Dummy-Driver",
-        "node.group": "pipewire.dummy",
-        "priority.driver": 20000
-      }
-    },
-    {
-      "factory": "spa-node-factory",
-      "args": {
-        "factory.name": "support.node.driver",
-        "node.name": "Freewheel-Driver",
-        "priority.driver": 19000,
-        "node.group": "pipewire.freewheel",
-        "node.freewheel": true
-      }
-    },
-    {
-      "factory": "adapter",
-      "args": {
-        "factory.name": "api.alsa.pcm.source",
-        "node.name": "system",
-        "node.description": "system",
-        "media.class": "Audio/Source",
-        "api.alsa.path": "hw:0",
-        "node.suspend-on-idle": true,
-        "resample.disable": true,
-        "channelmix.disable": true,
-        "adapter.auto-port-config": {
-          "mode": "dsp",
-          "monitor": false,
-          "control": false,
-          "position": "unknown"
-        }
-      }
-    },
-    {
-      "factory": "adapter",
-      "args": {
-        "factory.name": "api.alsa.pcm.sink",
-        "node.name": "system",
-        "node.description": "system",
-        "media.class": "Audio/Sink",
-        "api.alsa.path": "hw:0",
-        "node.suspend-on-idle": true,
-        "resample.disable": true,
-        "channelmix.disable": true,
-        "adapter.auto-port-config": {
-          "mode": "dsp",
-          "monitor": false,
-          "control": false,
-          "position": "unknown"
-        }
-      }
-    }
-  ],
-  "context.exec": []
-}
diff --git a/nixos/modules/services/desktops/pipewire/daemon/pipewire-aes67.conf.json b/nixos/modules/services/desktops/pipewire/daemon/pipewire-aes67.conf.json
deleted file mode 100644
index aaffa93ca964..000000000000
--- a/nixos/modules/services/desktops/pipewire/daemon/pipewire-aes67.conf.json
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  "context.properties": {},
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rt",
-      "args": {
-        "nice.level": -11
-      },
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    },
-    {
-      "name": "libpipewire-module-rtp-source",
-      "args": {
-        "sap.ip": "239.255.255.255",
-        "sap.port": 9875,
-        "sess.latency.msec": 10,
-        "local.ifname": "eth0",
-        "stream.props": {
-          "media.class": "Audio/Source",
-          "node.virtual": false,
-          "device.api": "aes67"
-        }
-      }
-    }
-  ]
-}
diff --git a/nixos/modules/services/desktops/pipewire/daemon/pipewire-avb.conf.json b/nixos/modules/services/desktops/pipewire/daemon/pipewire-avb.conf.json
deleted file mode 100644
index 4f669895d87b..000000000000
--- a/nixos/modules/services/desktops/pipewire/daemon/pipewire-avb.conf.json
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  "context.properties": {},
-  "context.spa-libs": {
-    "audio.convert.*": "audioconvert/libspa-audioconvert",
-    "support.*": "support/libspa-support"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rt",
-      "args": {
-        "nice.level": -11
-      },
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    },
-    {
-      "name": "libpipewire-module-avb",
-      "args": {}
-    }
-  ],
-  "context.exec": [],
-  "stream.properties": {},
-  "avb.properties": {
-    "ifname": "enp3s0",
-    "vm.overrides": {}
-  }
-}
diff --git a/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json b/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json
deleted file mode 100644
index b1a864853325..000000000000
--- a/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json
+++ /dev/null
@@ -1,106 +0,0 @@
-{
-  "context.properties": {},
-  "context.spa-libs": {
-    "audio.convert.*": "audioconvert/libspa-audioconvert",
-    "support.*": "support/libspa-support"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rt",
-      "args": {
-        "nice.level": -11
-      },
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    },
-    {
-      "name": "libpipewire-module-metadata"
-    },
-    {
-      "name": "libpipewire-module-protocol-pulse",
-      "args": {}
-    }
-  ],
-  "context.exec": [],
-  "pulse.cmd": [
-    {
-      "cmd": "load-module",
-      "args": "module-always-sink",
-      "flags": []
-    }
-  ],
-  "stream.properties": {},
-  "pulse.properties": {
-    "server.address": [
-      "unix:native"
-    ],
-    "vm.overrides": {
-      "pulse.min.quantum": "1024/48000"
-    }
-  },
-  "pulse.rules": [
-    {
-      "matches": [
-        {}
-      ],
-      "actions": {
-        "update-props": {}
-      }
-    },
-    {
-      "matches": [
-        {
-          "application.process.binary": "teams"
-        },
-        {
-          "application.process.binary": "teams-insiders"
-        },
-        {
-          "application.process.binary": "skypeforlinux"
-        }
-      ],
-      "actions": {
-        "quirks": [
-          "force-s16-info"
-        ]
-      }
-    },
-    {
-      "matches": [
-        {
-          "application.process.binary": "firefox"
-        }
-      ],
-      "actions": {
-        "quirks": [
-          "remove-capture-dont-move"
-        ]
-      }
-    },
-    {
-      "matches": [
-        {
-          "application.name": "~speech-dispatcher.*"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "pulse.min.req": "512/48000",
-          "pulse.min.quantum": "512/48000",
-          "pulse.idle.timeout": 5
-        }
-      }
-    }
-  ]
-}
diff --git a/nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json b/nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json
deleted file mode 100644
index a47abe2213d9..000000000000
--- a/nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json
+++ /dev/null
@@ -1,110 +0,0 @@
-{
-  "context.properties": {
-    "link.max-buffers": 16,
-    "core.daemon": true,
-    "core.name": "pipewire-0",
-    "vm.overrides": {
-      "default.clock.min-quantum": 1024
-    },
-    "module.x11.bell": true
-  },
-  "context.spa-libs": {
-    "audio.convert.*": "audioconvert/libspa-audioconvert",
-    "avb.*": "avb/libspa-avb",
-    "api.alsa.*": "alsa/libspa-alsa",
-    "api.v4l2.*": "v4l2/libspa-v4l2",
-    "api.libcamera.*": "libcamera/libspa-libcamera",
-    "api.bluez5.*": "bluez5/libspa-bluez5",
-    "api.vulkan.*": "vulkan/libspa-vulkan",
-    "api.jack.*": "jack/libspa-jack",
-    "support.*": "support/libspa-support"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rt",
-      "args": {
-        "nice.level": -11
-      },
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-profiler"
-    },
-    {
-      "name": "libpipewire-module-metadata"
-    },
-    {
-      "name": "libpipewire-module-spa-device-factory"
-    },
-    {
-      "name": "libpipewire-module-spa-node-factory"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-client-device"
-    },
-    {
-      "name": "libpipewire-module-portal",
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-access",
-      "args": {}
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    },
-    {
-      "name": "libpipewire-module-link-factory"
-    },
-    {
-      "name": "libpipewire-module-session-manager"
-    },
-    {
-      "name": "libpipewire-module-x11-bell",
-      "args": {},
-      "flags": [
-        "ifexists",
-        "nofail"
-      ],
-      "condition": [
-        {
-          "module.x11.bell": true
-        }
-      ]
-    }
-  ],
-  "context.objects": [
-    {
-      "factory": "spa-node-factory",
-      "args": {
-        "factory.name": "support.node.driver",
-        "node.name": "Dummy-Driver",
-        "node.group": "pipewire.dummy",
-        "priority.driver": 20000
-      }
-    },
-    {
-      "factory": "spa-node-factory",
-      "args": {
-        "factory.name": "support.node.driver",
-        "node.name": "Freewheel-Driver",
-        "priority.driver": 19000,
-        "node.group": "pipewire.freewheel",
-        "node.freewheel": true
-      }
-    }
-  ],
-  "context.exec": []
-}
diff --git a/nixos/modules/services/desktops/pipewire/media-session/alsa-monitor.conf.json b/nixos/modules/services/desktops/pipewire/media-session/alsa-monitor.conf.json
deleted file mode 100644
index 53fc9cc96343..000000000000
--- a/nixos/modules/services/desktops/pipewire/media-session/alsa-monitor.conf.json
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  "properties": {},
-  "rules": [
-    {
-      "matches": [
-        {
-          "device.name": "~alsa_card.*"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "api.alsa.use-acp": true,
-          "api.acp.auto-profile": false,
-          "api.acp.auto-port": false
-        }
-      }
-    },
-    {
-      "matches": [
-        {
-          "node.name": "~alsa_input.*"
-        },
-        {
-          "node.name": "~alsa_output.*"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "node.pause-on-idle": false
-        }
-      }
-    }
-  ]
-}
diff --git a/nixos/modules/services/desktops/pipewire/media-session/bluez-monitor.conf.json b/nixos/modules/services/desktops/pipewire/media-session/bluez-monitor.conf.json
deleted file mode 100644
index 6d1c23e82569..000000000000
--- a/nixos/modules/services/desktops/pipewire/media-session/bluez-monitor.conf.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "properties": {},
-  "rules": [
-    {
-      "matches": [
-        {
-          "device.name": "~bluez_card.*"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "bluez5.auto-connect": [
-            "hfp_hf",
-            "hsp_hs",
-            "a2dp_sink"
-          ]
-        }
-      }
-    },
-    {
-      "matches": [
-        {
-          "node.name": "~bluez_input.*"
-        },
-        {
-          "node.name": "~bluez_output.*"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "node.pause-on-idle": false
-        }
-      }
-    }
-  ]
-}
diff --git a/nixos/modules/services/desktops/pipewire/media-session/media-session.conf.json b/nixos/modules/services/desktops/pipewire/media-session/media-session.conf.json
deleted file mode 100644
index 4b4e302af387..000000000000
--- a/nixos/modules/services/desktops/pipewire/media-session/media-session.conf.json
+++ /dev/null
@@ -1,68 +0,0 @@
-{
-  "context.properties": {},
-  "context.spa-libs": {
-    "api.bluez5.*": "bluez5/libspa-bluez5",
-    "api.alsa.*": "alsa/libspa-alsa",
-    "api.v4l2.*": "v4l2/libspa-v4l2",
-    "api.libcamera.*": "libcamera/libspa-libcamera"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rtkit",
-      "args": {},
-      "flags": [
-        "ifexists",
-        "nofail"
-      ]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-client-device"
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    },
-    {
-      "name": "libpipewire-module-metadata"
-    },
-    {
-      "name": "libpipewire-module-session-manager"
-    }
-  ],
-  "session.modules": {
-    "default": [
-      "flatpak",
-      "portal",
-      "v4l2",
-      "suspend-node",
-      "policy-node"
-    ],
-    "with-audio": [
-      "metadata",
-      "default-nodes",
-      "default-profile",
-      "default-routes",
-      "alsa-seq",
-      "alsa-monitor"
-    ],
-    "with-alsa": [
-      "with-audio"
-    ],
-    "with-jack": [
-      "with-audio"
-    ],
-    "with-pulseaudio": [
-      "with-audio",
-      "bluez5",
-      "bluez5-autoswitch",
-      "logind",
-      "restore-stream",
-      "streams-follow-default"
-    ]
-  }
-}
diff --git a/nixos/modules/services/desktops/pipewire/media-session/v4l2-monitor.conf.json b/nixos/modules/services/desktops/pipewire/media-session/v4l2-monitor.conf.json
deleted file mode 100644
index b08cba1b604b..000000000000
--- a/nixos/modules/services/desktops/pipewire/media-session/v4l2-monitor.conf.json
+++ /dev/null
@@ -1,30 +0,0 @@
-{
-  "properties": {},
-  "rules": [
-    {
-      "matches": [
-        {
-          "device.name": "~v4l2_device.*"
-        }
-      ],
-      "actions": {
-        "update-props": {}
-      }
-    },
-    {
-      "matches": [
-        {
-          "node.name": "~v4l2_input.*"
-        },
-        {
-          "node.name": "~v4l2_output.*"
-        }
-      ],
-      "actions": {
-        "update-props": {
-          "node.pause-on-idle": false
-        }
-      }
-    }
-  ]
-}
diff --git a/nixos/modules/services/desktops/pipewire/pipewire-media-session.nix b/nixos/modules/services/desktops/pipewire/pipewire-media-session.nix
deleted file mode 100644
index 203139294c6b..000000000000
--- a/nixos/modules/services/desktops/pipewire/pipewire-media-session.nix
+++ /dev/null
@@ -1,141 +0,0 @@
-# pipewire example session manager.
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  json = pkgs.formats.json {};
-  cfg = config.services.pipewire.media-session;
-  enable32BitAlsaPlugins = cfg.alsa.support32Bit
-                           && pkgs.stdenv.isx86_64
-                           && pkgs.pkgsi686Linux.pipewire != null;
-
-  # Use upstream config files passed through spa-json-dump as the base
-  # Patched here as necessary for them to work with this module
-  defaults = {
-    alsa-monitor = lib.importJSON ./media-session/alsa-monitor.conf.json;
-    bluez-monitor = lib.importJSON ./media-session/bluez-monitor.conf.json;
-    media-session = lib.importJSON ./media-session/media-session.conf.json;
-    v4l2-monitor = lib.importJSON ./media-session/v4l2-monitor.conf.json;
-  };
-
-  configs = {
-    alsa-monitor = recursiveUpdate defaults.alsa-monitor cfg.config.alsa-monitor;
-    bluez-monitor = recursiveUpdate defaults.bluez-monitor cfg.config.bluez-monitor;
-    media-session = recursiveUpdate defaults.media-session cfg.config.media-session;
-    v4l2-monitor = recursiveUpdate defaults.v4l2-monitor cfg.config.v4l2-monitor;
-  };
-in {
-
-  meta = {
-    maintainers = teams.freedesktop.members;
-    # uses attributes of the linked package
-    buildDocsInSandbox = false;
-  };
-
-  ###### interface
-  options = {
-    services.pipewire.media-session = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc "Whether to enable the deprecated example Pipewire session manager";
-      };
-
-      package = mkOption {
-        type = types.package;
-        default = pkgs.pipewire-media-session;
-        defaultText = literalExpression "pkgs.pipewire-media-session";
-        description = lib.mdDoc ''
-          The pipewire-media-session derivation to use.
-        '';
-      };
-
-      config = {
-        media-session = mkOption {
-          type = json.type;
-          description = lib.mdDoc ''
-            Configuration for the media session core. For details see
-            https://gitlab.freedesktop.org/pipewire/media-session/-/blob/${cfg.package.version}/src/daemon/media-session.d/media-session.conf
-          '';
-          default = defaults.media-session;
-        };
-
-        alsa-monitor = mkOption {
-          type = json.type;
-          description = lib.mdDoc ''
-            Configuration for the alsa monitor. For details see
-            https://gitlab.freedesktop.org/pipewire/media-session/-/blob/${cfg.package.version}/src/daemon/media-session.d/alsa-monitor.conf
-          '';
-          default = defaults.alsa-monitor;
-        };
-
-        bluez-monitor = mkOption {
-          type = json.type;
-          description = lib.mdDoc ''
-            Configuration for the bluez5 monitor. For details see
-            https://gitlab.freedesktop.org/pipewire/media-session/-/blob/${cfg.package.version}/src/daemon/media-session.d/bluez-monitor.conf
-          '';
-          default = defaults.bluez-monitor;
-        };
-
-        v4l2-monitor = mkOption {
-          type = json.type;
-          description = lib.mdDoc ''
-            Configuration for the V4L2 monitor. For details see
-            https://gitlab.freedesktop.org/pipewire/media-session/-/blob/${cfg.package.version}/src/daemon/media-session.d/v4l2-monitor.conf
-          '';
-          default = defaults.v4l2-monitor;
-        };
-      };
-    };
-  };
-
-  ###### implementation
-  config = mkIf cfg.enable {
-    environment.systemPackages = [ cfg.package ];
-    systemd.packages = [ cfg.package ];
-
-    # Enable either system or user units.
-    systemd.services.pipewire-media-session.enable = config.services.pipewire.systemWide;
-    systemd.user.services.pipewire-media-session.enable = !config.services.pipewire.systemWide;
-
-    systemd.services.pipewire-media-session.wantedBy = [ "pipewire.service" ];
-    systemd.user.services.pipewire-media-session.wantedBy = [ "pipewire.service" ];
-
-    environment.etc."pipewire/media-session.d/media-session.conf" = {
-      source = json.generate "media-session.conf" configs.media-session;
-    };
-    environment.etc."pipewire/media-session.d/v4l2-monitor.conf" = {
-      source = json.generate "v4l2-monitor.conf" configs.v4l2-monitor;
-    };
-
-    environment.etc."pipewire/media-session.d/with-audio" =
-      mkIf config.services.pipewire.audio.enable {
-        text = "";
-      };
-
-    environment.etc."pipewire/media-session.d/with-alsa" =
-      mkIf config.services.pipewire.alsa.enable {
-        text = "";
-      };
-    environment.etc."pipewire/media-session.d/alsa-monitor.conf" =
-      mkIf config.services.pipewire.alsa.enable {
-        source = json.generate "alsa-monitor.conf" configs.alsa-monitor;
-      };
-
-    environment.etc."pipewire/media-session.d/with-pulseaudio" =
-      mkIf config.services.pipewire.pulse.enable {
-        text = "";
-      };
-    environment.etc."pipewire/media-session.d/bluez-monitor.conf" =
-      mkIf config.services.pipewire.pulse.enable {
-        source = json.generate "bluez-monitor.conf" configs.bluez-monitor;
-      };
-
-    environment.etc."pipewire/media-session.d/with-jack" =
-      mkIf config.services.pipewire.jack.enable {
-        text = "";
-      };
-  };
-}
diff --git a/nixos/modules/services/desktops/pipewire/pipewire.nix b/nixos/modules/services/desktops/pipewire/pipewire.nix
index 09cec9a79109..ae695baf42c6 100644
--- a/nixos/modules/services/desktops/pipewire/pipewire.nix
+++ b/nixos/modules/services/desktops/pipewire/pipewire.nix
@@ -4,7 +4,6 @@
 with lib;
 
 let
-  json = pkgs.formats.json {};
   cfg = config.services.pipewire;
   enable32BitAlsaPlugins = cfg.alsa.support32Bit
                            && pkgs.stdenv.isx86_64
@@ -18,34 +17,8 @@ let
     mkdir -p "$out/lib"
     ln -s "${cfg.package.jack}/lib" "$out/lib/pipewire"
   '';
-
-  # Use upstream config files passed through spa-json-dump as the base
-  # Patched here as necessary for them to work with this module
-  defaults = {
-    client = lib.importJSON ./daemon/client.conf.json;
-    client-rt = lib.importJSON ./daemon/client-rt.conf.json;
-    jack = lib.importJSON ./daemon/jack.conf.json;
-    minimal = lib.importJSON ./daemon/minimal.conf.json;
-    pipewire = lib.importJSON ./daemon/pipewire.conf.json;
-    pipewire-pulse = lib.importJSON ./daemon/pipewire-pulse.conf.json;
-  };
-
-  useSessionManager = cfg.wireplumber.enable || cfg.media-session.enable;
-
-  configs = {
-    client = recursiveUpdate defaults.client cfg.config.client;
-    client-rt = recursiveUpdate defaults.client-rt cfg.config.client-rt;
-    jack = recursiveUpdate defaults.jack cfg.config.jack;
-    pipewire = recursiveUpdate (if useSessionManager then defaults.pipewire else defaults.minimal) cfg.config.pipewire;
-    pipewire-pulse = recursiveUpdate defaults.pipewire-pulse cfg.config.pipewire-pulse;
-  };
 in {
-
-  meta = {
-    maintainers = teams.freedesktop.members ++ [ lib.maintainers.k900 ];
-    # uses attributes of the linked package
-    buildDocsInSandbox = false;
-  };
+  meta.maintainers = teams.freedesktop.members ++ [ lib.maintainers.k900 ];
 
   ###### interface
   options = {
@@ -69,53 +42,6 @@ in {
         '';
       };
 
-      config = {
-        client = mkOption {
-          type = json.type;
-          default = {};
-          description = lib.mdDoc ''
-            Configuration for pipewire clients. For details see
-            https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/${cfg.package.version}/src/daemon/client.conf.in
-          '';
-        };
-
-        client-rt = mkOption {
-          type = json.type;
-          default = {};
-          description = lib.mdDoc ''
-            Configuration for realtime pipewire clients. For details see
-            https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/${cfg.package.version}/src/daemon/client-rt.conf.in
-          '';
-        };
-
-        jack = mkOption {
-          type = json.type;
-          default = {};
-          description = lib.mdDoc ''
-            Configuration for the pipewire daemon's jack module. For details see
-            https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/${cfg.package.version}/src/daemon/jack.conf.in
-          '';
-        };
-
-        pipewire = mkOption {
-          type = json.type;
-          default = {};
-          description = lib.mdDoc ''
-            Configuration for the pipewire daemon. For details see
-            https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/${cfg.package.version}/src/daemon/pipewire.conf.in
-          '';
-        };
-
-        pipewire-pulse = mkOption {
-          type = json.type;
-          default = {};
-          description = lib.mdDoc ''
-            Configuration for the pipewire-pulse daemon. For details see
-            https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/${cfg.package.version}/src/daemon/pipewire-pulse.conf.in
-          '';
-        };
-      };
-
       audio = {
         enable = lib.mkOption {
           type = lib.types.bool;
@@ -153,10 +79,20 @@ in {
           https://github.com/PipeWire/pipewire/blob/master/NEWS
         '';
       };
-
     };
   };
 
+  imports = [
+    (lib.mkRemovedOptionModule ["services" "pipewire" "config"] ''
+      Overriding default Pipewire configuration through NixOS options never worked correctly and is no longer supported.
+      Please create drop-in files in /etc/pipewire/pipewire.conf.d/ to make the desired setting changes instead.
+    '')
+
+    (lib.mkRemovedOptionModule ["services" "pipewire" "media-session"] ''
+      pipewire-media-session is no longer supported upstream and has been removed.
+      Please switch to `services.pipewire.wireplumber` instead.
+    '')
+  ];
 
   ###### implementation
   config = mkIf cfg.enable {
@@ -222,22 +158,6 @@ in {
       source = "${cfg.package}/share/alsa/alsa.conf.d/99-pipewire-default.conf";
     };
 
-    environment.etc."pipewire/client.conf" = {
-      source = json.generate "client.conf" configs.client;
-    };
-    environment.etc."pipewire/client-rt.conf" = {
-      source = json.generate "client-rt.conf" configs.client-rt;
-    };
-    environment.etc."pipewire/jack.conf" = {
-      source = json.generate "jack.conf" configs.jack;
-    };
-    environment.etc."pipewire/pipewire.conf" = {
-      source = json.generate "pipewire.conf" configs.pipewire;
-    };
-    environment.etc."pipewire/pipewire-pulse.conf" = mkIf cfg.pulse.enable {
-      source = json.generate "pipewire-pulse.conf" configs.pipewire-pulse;
-    };
-
     environment.sessionVariables.LD_LIBRARY_PATH =
       lib.mkIf cfg.jack.enable [ "${cfg.package.jack}/lib" ];
 
@@ -256,12 +176,5 @@ in {
       };
       groups.pipewire.gid = config.ids.gids.pipewire;
     };
-
-    # https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/464#note_723554
-    systemd.services.pipewire.environment."PIPEWIRE_LINK_PASSIVE" = "1";
-    systemd.user.services.pipewire.environment."PIPEWIRE_LINK_PASSIVE" = "1";
-
-    # pipewire-pulse default config expects pactl to be in PATH
-    systemd.user.services.pipewire-pulse.path = lib.mkIf cfg.pulse.enable [ pkgs.pulseaudio ];
   };
 }
diff --git a/nixos/modules/services/desktops/pipewire/wireplumber.nix b/nixos/modules/services/desktops/pipewire/wireplumber.nix
index 4b36b99aa7c1..95a7ece26c5d 100644
--- a/nixos/modules/services/desktops/pipewire/wireplumber.nix
+++ b/nixos/modules/services/desktops/pipewire/wireplumber.nix
@@ -28,10 +28,6 @@ in
 
   config = lib.mkIf cfg.enable {
     assertions = [
-      {
-        assertion = !config.services.pipewire.media-session.enable;
-        message = "WirePlumber and pipewire-media-session can't be enabled at the same time.";
-      }
       {
         assertion = !config.hardware.bluetooth.hsphfpd.enable;
         message = "Using Wireplumber conflicts with hsphfpd, as it provides the same functionality. `hardware.bluetooth.hsphfpd.enable` needs be set to false";
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index db8dc38c4bdd..8fa38c49de76 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -196,19 +196,6 @@ let
     '';
 
     postInstall = ''
-      mkdir $out/nix-support
-      ${if (stdenv.hostPlatform == stdenv.buildPlatform) then ''
-        pushd $lib/share/pipewire
-        for f in *.conf; do
-          echo "Generating JSON from $f"
-
-          $out/bin/spa-json-dump "$f" > "$out/nix-support/$f.json"
-        done
-        popd
-      '' else ''
-        cp ${buildPackages.pipewire}/nix-support/*.json "$out/nix-support"
-      ''}
-
       ${lib.optionalString enableSystemd ''
         moveToOutput "share/systemd/user/pipewire-pulse.*" "$pulse"
         moveToOutput "lib/systemd/user/pipewire-pulse.*" "$pulse"
@@ -219,30 +206,7 @@ let
       moveToOutput "bin/pw-jack" "$jack"
     '';
 
-    passthru = {
-      updateScript = ./update-pipewire.sh;
-      tests = {
-        installedTests = nixosTests.installed-tests.pipewire;
-
-        # This ensures that all the paths used by the NixOS module are found.
-        test-paths = callPackage ./test-paths.nix { package = self; } {
-          paths-out = [
-            "share/alsa/alsa.conf.d/50-pipewire.conf"
-            "nix-support/client-rt.conf.json"
-            "nix-support/client.conf.json"
-            "nix-support/jack.conf.json"
-            "nix-support/minimal.conf.json"
-            "nix-support/pipewire.conf.json"
-            "nix-support/pipewire-aes67.conf.json"
-            "nix-support/pipewire-pulse.conf.json"
-          ];
-          paths-lib = [
-            "lib/alsa-lib/libasound_module_pcm_pipewire.so"
-            "share/alsa-card-profile/mixer"
-          ];
-        };
-      };
-    };
+    passthru.tests = nixosTests.installed-tests.pipewire;
 
     meta = with lib; {
       description = "Server and user space API to deal with multimedia pipelines";
diff --git a/pkgs/development/libraries/pipewire/media-session.nix b/pkgs/development/libraries/pipewire/media-session.nix
deleted file mode 100644
index 19940d8d7477..000000000000
--- a/pkgs/development/libraries/pipewire/media-session.nix
+++ /dev/null
@@ -1,109 +0,0 @@
-{ stdenv
-, lib
-, fetchFromGitLab
-, fetchpatch
-, meson
-, ninja
-, pkg-config
-, doxygen
-, graphviz
-, systemd
-, pipewire
-, glib
-, dbus
-, alsa-lib
-, callPackage
-}:
-
-let
-  mesonEnable = b: if b then "enabled" else "disabled";
-  mesonList = l: "[" + lib.concatStringsSep "," l + "]";
-
-  self = stdenv.mkDerivation rec {
-    pname = "pipewire-media-session";
-    version = "0.4.1";
-
-    src = fetchFromGitLab {
-      domain = "gitlab.freedesktop.org";
-      owner = "pipewire";
-      repo = "media-session";
-      rev = version;
-      sha256 = "sha256-e537gTkiNYMz2YJrOff/MXYWVDgHZDkqkSn8Qh+7Wr4=";
-    };
-
-    patches = [
-      # Fix `ERROR: Tried to access unknown option "session-managers".`
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/pipewire/media-session/-/commit/dfa740175c83e1cd0d815ad423f90872de566437.diff";
-        sha256 = "01rfwq8ipm8wyv98rxal1s5zrkf0pn9hgrngiq2wdbwj6vjdnr1h";
-      })
-      # Fix attempt to put system service units into pkgs.systemd.
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/pipewire/media-session/-/commit/2ff6b0baec7325dde229013b9d37c93f8bc7edee.diff";
-        sha256 = "18gg7ca04ihl4ylnw78wdyrbvg66m8w43gg0wp258x4nv95gpps2";
-      })
-    ];
-
-    nativeBuildInputs = [
-      doxygen
-      graphviz
-      meson
-      ninja
-      pkg-config
-    ];
-
-    buildInputs = [
-      alsa-lib
-      dbus
-      glib
-      pipewire
-      systemd
-    ];
-
-    mesonFlags = [
-      "-Ddocs=enabled"
-      "-Dsystemd-system-service=enabled"
-      # We generate these empty files from the nixos module, don't bother installing them
-      "-Dwith-module-sets=[]"
-    ];
-
-    postUnpack = ''
-      patchShebangs source/doc/input-filter-h.sh
-      patchShebangs source/doc/input-filter.sh
-    '';
-
-    postInstall = ''
-      mkdir $out/nix-support
-      cd $out/share/pipewire/media-session.d
-      for f in *.conf; do
-        echo "Generating JSON from $f"
-        ${pipewire}/bin/spa-json-dump "$f" > "$out/nix-support/$f.json"
-      done
-    '';
-
-    passthru = {
-      updateScript = ./update-media-session.sh;
-      tests = {
-        test-paths = callPackage ./test-paths.nix { package = self; } {
-          paths-out = [
-            "nix-support/alsa-monitor.conf.json"
-            "nix-support/bluez-monitor.conf.json"
-            "nix-support/media-session.conf.json"
-            "nix-support/v4l2-monitor.conf.json"
-          ];
-          paths-lib = [];
-        };
-      };
-    };
-
-    meta = with lib; {
-      description = "Example session manager for PipeWire";
-      homepage = "https://pipewire.org";
-      license = licenses.mit;
-      platforms = platforms.linux;
-      maintainers = with maintainers; [ jtojnar kranzes ];
-    };
-  };
-
-in
-self
diff --git a/pkgs/development/libraries/pipewire/test-paths.nix b/pkgs/development/libraries/pipewire/test-paths.nix
deleted file mode 100644
index 1e3e5fef3a6e..000000000000
--- a/pkgs/development/libraries/pipewire/test-paths.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ lib, runCommand, package, paths-out, paths-lib }:
-
-let
-  check-path = output: path: ''
-    if [[ ! -f "${output}/${path}" && ! -d "${output}/${path}" ]]; then
-      printf "Missing: %s\n" "${output}/${path}" | tee -a $out
-      error=error
-    else
-      printf "Found: %s\n" "${output}/${path}" | tee -a $out
-    fi
-  '';
-
-  check-output = output: lib.concatMapStringsSep "\n" (check-path output);
-in runCommand "pipewire-test-paths" { } ''
-  touch $out
-
-  ${check-output package.lib paths-lib}
-  ${check-output package paths-out}
-
-  if [[ -n "$error" ]]; then
-    exit 1
-  fi
-''
diff --git a/pkgs/development/libraries/pipewire/update-media-session.sh b/pkgs/development/libraries/pipewire/update-media-session.sh
deleted file mode 100755
index c55745815759..000000000000
--- a/pkgs/development/libraries/pipewire/update-media-session.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -p nix-update -i bash
-# shellcheck shell=bash
-
-set -o errexit -o pipefail -o nounset -o errtrace
-shopt -s inherit_errexit
-shopt -s nullglob
-IFS=$'\n'
-
-NIXPKGS_ROOT="$(git rev-parse --show-toplevel)"
-
-cd "$NIXPKGS_ROOT"
-nix-update pipewire-media-session
-outputs=$(nix-build . -A pipewire-media-session)
-for p in $outputs; do
-    conf_files=$(find "$p/nix-support/" -name '*.conf.json')
-    for c in $conf_files; do
-        file_name=$(basename "$c")
-        if [[ ! -e "nixos/modules/services/desktops/pipewire/media-session/$file_name" ]]; then
-            echo "New file $file_name found! Add it to the module config and passthru tests!"
-        fi
-        install -m 0644 "$c" "nixos/modules/services/desktops/pipewire/media-session/"
-    done
-done
diff --git a/pkgs/development/libraries/pipewire/update-pipewire.sh b/pkgs/development/libraries/pipewire/update-pipewire.sh
deleted file mode 100755
index d94d39c76307..000000000000
--- a/pkgs/development/libraries/pipewire/update-pipewire.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -p nix-update -i bash
-# shellcheck shell=bash
-
-set -o errexit -o pipefail -o nounset -o errtrace
-shopt -s inherit_errexit
-shopt -s nullglob
-IFS=$'\n'
-
-NIXPKGS_ROOT="$(git rev-parse --show-toplevel)"
-
-cd "$NIXPKGS_ROOT"
-nix-update pipewire
-outputs=$(nix-build . -A pipewire)
-for p in $outputs; do
-    conf_files=$(find "$p/nix-support/" -name '*.conf.json')
-    for c in $conf_files; do
-        file_name=$(basename "$c")
-        if [[ ! -e "nixos/modules/services/desktops/pipewire/daemon/$file_name" ]]; then
-            echo "New file $file_name found! Add it to the module config and passthru tests!"
-        fi
-        install -m 0644 "$c" "nixos/modules/services/desktops/pipewire/daemon/"
-    done
-done
-
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index dd2c8c7735c1..c8b91abb8375 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1225,6 +1225,7 @@ mapAliases ({
   pidginwindowmerge = throw "'pidginwindowmerge' has been renamed to/replaced by 'pidgin-window-merge'"; # Converted to throw 2022-02-22
   pifi = throw "pifi has been removed from nixpkgs, as it is no longer developed"; # Added 2022-01-19
   ping = throw "'ping' does not build with recent valac and has been removed. If you are just looking for the 'ping' command use either 'iputils' or 'inetutils'"; # Added 2022-04-18
+  pipewire-media-session = throw "pipewire-media-session is no longer maintained and has been removed. Please use Wireplumber instead.";
   piwik = throw "'piwik' has been renamed to/replaced by 'matomo'"; # Converted to throw 2022-02-22
   pixie = throw "pixie has been removed: abandoned by upstream"; # Added 2022-04-21
   pkgconfig = pkg-config; # Added 2018-02-02, moved to aliases.nix 2021-01-18
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9687396f1154..bef37c6e5dbb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16883,8 +16883,6 @@ with pkgs;
     ffmpeg = ffmpeg-headless;
   };
 
-  pipewire-media-session = callPackage ../development/libraries/pipewire/media-session.nix { };
-
   pipewire_0_2 = callPackage ../development/libraries/pipewire/0.2.nix { };
   wireplumber = callPackage ../development/libraries/pipewire/wireplumber.nix { };
 

From c3a42a047cfe7d645fcf63b8cba04336bf3041ea Mon Sep 17 00:00:00 2001
From: Samuel Ainsworth <sam.ainsworth@getcruise.com>
Date: Tue, 14 Mar 2023 17:20:46 -0400
Subject: [PATCH 113/154] snappy: 1.1.9 -> 1.1.10

---
 pkgs/development/libraries/snappy/default.nix | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/libraries/snappy/default.nix b/pkgs/development/libraries/snappy/default.nix
index 7d70c500dfac..9621a3411560 100644
--- a/pkgs/development/libraries/snappy/default.nix
+++ b/pkgs/development/libraries/snappy/default.nix
@@ -5,21 +5,16 @@
 
 stdenv.mkDerivation rec {
   pname = "snappy";
-  version = "1.1.9";
+  version = "1.1.10";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "snappy";
     rev = version;
-    sha256 = "sha256-JXWl63KVP+CDNWIXYtz+EKqWLJbPKl3ifhr8dKAp/w8=";
+    hash = "sha256-wYZkKVDXKCugycx/ZYhjV0BjM/NrEM0R6A4WFhs/WPU=";
   };
 
   patches = [
-    (fetchpatch {
-      name = "clang-7-compat.patch";
-      url = "https://github.com/google/snappy/pull/142/commits/658cb2fcf67b626fff2122a3dbf7a3560c58f7ee.patch";
-      sha256 = "1kg3lxjwmhc7gjx36nylilnf444ddbnr3px1wpvyc6l1nh6zh4al";
-    })
     # Re-enable RTTI, without which other applications can't subclass
     # snappy::Source (this breaks Ceph, as one example)
     # https://tracker.ceph.com/issues/53060
@@ -34,6 +29,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
+  # See https://github.com/NixOS/nixpkgs/pull/219778#issuecomment-1464884412.
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.isAarch64 && stdenv.isDarwin) "-Wno-sign-compare";
+
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
     "-DSNAPPY_BUILD_TESTS=OFF"

From 39620acea8d86488e8ecb37424643ff94c5ea0a3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 15 Mar 2023 19:52:15 +0000
Subject: [PATCH 114/154] vim: 9.0.1369 -> 9.0.1403

---
 pkgs/applications/editors/vim/common.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 1a39a8ac8b0e..f963dfec66d0 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.1369";
+  version = "9.0.1403";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-2YjWd07RMyiITnuI3/L0D9MiAxl2+9QVT1nrMBA9/dI=";
+    hash = "sha256-z+zLRO0yqWu/l3eOzD7pmUvmqhmkH5W9z7wE9QWlsG0=";
   };
 
   enableParallelBuilding = true;

From 8dd301559ab120f96aec2a2a66164bfdb0d5fbed Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 16 Mar 2023 08:01:21 +0000
Subject: [PATCH 115/154] ruby: disable parallel install

Without the change parallel installs fail as:

    installing rdoc:                    ...-ruby-2.7.7-devdoc/share/ri/2.7.0/system
    Traceback (most recent call last):
            13: from ./tool/rbinstall.rb:954:in `<main>'
            12: from ./tool/rbinstall.rb:954:in `each'
            11: from ./tool/rbinstall.rb:957:in `block in <main>'
            10: from ./tool/rbinstall.rb:438:in `block in <main>'
             9: from ./tool/rbinstall.rb:262:in `install_recursive'
             8: from ./tool/rbinstall.rb:262:in `each'
             7: from ./tool/rbinstall.rb:271:in `block in install_recursive'
             6: from ./tool/rbinstall.rb:174:in `install'
             5: from /build/ruby-2.7.7/lib/fileutils.rb:876:in `install'
             4: from /build/ruby-2.7.7/lib/fileutils.rb:1587:in `fu_each_src_dest'
             3: from /build/ruby-2.7.7/lib/fileutils.rb:1605:in `fu_each_src_dest0'
             2: from /build/ruby-2.7.7/lib/fileutils.rb:1589:in `block in fu_each_src_dest'
             1: from /build/ruby-2.7.7/lib/fileutils.rb:882:in `block in install'
    /build/ruby-2.7.7/lib/fileutils.rb:882:in `chmod': No such file or directory @ apply2files - ...-ruby-2.7.7-devdoc/share/ri/2.7.0/system/ARGF/inspect-i.ri (Errno::ENOENT)
    make: *** [uncommon.mk:373: do-install-all] Error 1
    make: *** Waiting for unfinished jobs....
---
 pkgs/development/interpreters/ruby/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 96d73d45c261..f30b0e87fda4 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -95,6 +95,10 @@ let
         propagatedBuildInputs = op jemallocSupport jemalloc;
 
         enableParallelBuilding = true;
+        # /build/ruby-2.7.7/lib/fileutils.rb:882:in `chmod':
+        #   No such file or directory @ apply2files - ...-ruby-2.7.7-devdoc/share/ri/2.7.0/system/ARGF/inspect-i.ri (Errno::ENOENT)
+        # make: *** [uncommon.mk:373: do-install-all] Error 1
+        enableParallelInstalling = false;
 
         patches = op (lib.versionOlder ver.majMin "3.1") ./do-not-regenerate-revision.h.patch
           ++ op (atLeast30 && useBaseRuby) (

From 48f48c3101615e78fc28378ad818291c1ee8252a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Karel=20Ko=C4=8D=C3=AD?= <cynerd@email.cz>
Date: Wed, 15 Mar 2023 10:34:23 +0100
Subject: [PATCH 116/154] mesa: build dri for arm

The isAarch64 applies only to 64bit arm. The commit
e7a2c65ab54f096546c9aad6ae2e4e29e61f2885 missed support for 32bit arm.

This also removes kmsro as it is not used by Mesa meson.build file. The
kmsro is detected from other galium drivers. This might not be correct
and there probably should be a way to enable this in the upstream but
for now this does nothing.
---
 pkgs/development/libraries/mesa/default.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 83643e423f74..2676a3b740fd 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -10,7 +10,6 @@
   if stdenv.isLinux then
     [
       "d3d12" # WSL emulated GPU (aka Dozen)
-      "kmsro" # helper driver for display-only devices
       "nouveau" # Nvidia
       "radeonsi" # new AMD (GCN+)
       "r300" # very old AMD
@@ -19,15 +18,15 @@
       "svga" # VMWare virtualized GPU
       "virgl" # QEMU virtualized GPU (aka VirGL)
       "zink" # generic OpenGL over Vulkan, experimental
-    ]
-    ++ lib.optionals stdenv.isAarch64 [
+    ] ++ lib.optionals (stdenv.isAarch64 || stdenv.isAarch32) [
       "etnaviv" # Vivante GPU designs (mostly NXP/Marvell SoCs)
       "freedreno" # Qualcomm Adreno (all Qualcomm SoCs)
       "lima" # ARM Mali 4xx
       "panfrost" # ARM Mali Midgard and up (T/G series)
+      "vc4" # Broadcom VC4 (Raspberry Pi 0-3)
+    ] ++ lib.optionals stdenv.isAarch64 [
       "tegra" # Nvidia Tegra SoCs
       "v3d" # Broadcom VC5 (Raspberry Pi 4)
-      "vc4" # Broadcom VC4 (Raspberry Pi 0-3)
     ] ++ lib.optionals stdenv.hostPlatform.isx86 [
       "iris" # new Intel, could work on non-x86 with PCIe cards, but doesn't build as of 22.3.4
       "crocus" # Intel legacy, x86 only

From ef0e4e67ccf4e4838d7eb8a5e42e0b511a15500c Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 16 Mar 2023 22:42:24 +0100
Subject: [PATCH 117/154] python310Packages.json-stream-rs-tokenizer: 0.4.13 ->
 0.4.16

Diff: https://github.com/smheidrich/py-json-stream-rs-tokenizer/compare/refs/tags/v0.4.13...v0.4.16
---
 .../python-modules/json-stream-rs-tokenizer/default.nix     | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/json-stream-rs-tokenizer/default.nix b/pkgs/development/python-modules/json-stream-rs-tokenizer/default.nix
index 21277a176dbc..1bcfe740952f 100644
--- a/pkgs/development/python-modules/json-stream-rs-tokenizer/default.nix
+++ b/pkgs/development/python-modules/json-stream-rs-tokenizer/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "json-stream-rs-tokenizer";
-  version = "0.4.13";
+  version = "0.4.16";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "smheidrich";
     repo = "py-json-stream-rs-tokenizer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-9pJi80V7WKvsgtp0ffItWnjoOvFvfE/Sz6y2VlsU+wQ=";
+    hash = "sha256-MnYkCAI8x65kU0EoTRf4ZVsbjNravjokepX4yViu7go=";
   };
 
   postPatch = ''
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src postPatch;
     name = "${pname}-${version}";
-    hash = "sha256-TjRdHSXHmF6fzCshX1I4Sq+A/fEmBHDPGZvJUxL13aM=";
+    hash = "sha256-HwWH8/UWKWOdRmyCVQtNqJxXD55f6zxLY0LhR7JU9ro=";
   };
 
   nativeBuildInputs = [

From 20fe8b2871b3d53e3443d8e2a8f661fe0d46f3e9 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 17 Mar 2023 01:20:39 +0100
Subject: [PATCH 118/154] python310Packages.passlib: libxcrypt related failures
 also affect linux

---
 pkgs/development/python-modules/passlib/default.nix | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/passlib/default.nix b/pkgs/development/python-modules/passlib/default.nix
index f18307c50bf0..c9592f5fc9cb 100644
--- a/pkgs/development/python-modules/passlib/default.nix
+++ b/pkgs/development/python-modules/passlib/default.nix
@@ -1,20 +1,23 @@
 { lib
-, stdenv
 , buildPythonPackage
 , fetchPypi
 , argon2-cffi
 , bcrypt
 , cryptography
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "passlib";
   version = "1.7.4";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "defd50f72b65c5402ab2c573830a6978e5f202ad0d984793c8dde2c4152ebe04";
+    hash = "sha256-3v1Q9ytlxUAqssVzgwppeOXyAq0NmEeTyN3ixBUuvgQ";
   };
 
   passthru.optional-dependencies = {
@@ -29,11 +32,14 @@ buildPythonPackage rec {
   ++ passthru.optional-dependencies.bcrypt
   ++ passthru.optional-dependencies.totp;
 
+  pythonImportsCheck = [
+    "passlib"
+  ];
+
   disabledTests = [
     # timming sensitive
     "test_dummy_verify"
     "test_encrypt_cost_timing"
-  ] ++ lib.optionals stdenv.isDarwin [
     # These tests fail because they don't expect support for algorithms provided through libxcrypt
     "test_82_crypt_support"
   ];

From d2b2876373efd862748a92c7fe952ffb708dfd3f Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 17 Mar 2023 07:34:59 +0000
Subject: [PATCH 119/154] xorg.libXvMC: 1.0.12 -> 1.0.13

---
 pkgs/servers/x11/xorg/default.nix   | 6 +++---
 pkgs/servers/x11/xorg/tarballs.list | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 6333125a74c7..2070e708fdb8 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -1308,11 +1308,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXvMC = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext, libXv }: stdenv.mkDerivation {
     pname = "libXvMC";
-    version = "1.0.12";
+    version = "1.0.13";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXvMC-1.0.12.tar.bz2";
-      sha256 = "1kbdjsvkm5l7axv7g477qj18sab2wnqhliy6197syzizgfbsfgbb";
+      url = "mirror://xorg/individual/lib/libXvMC-1.0.13.tar.xz";
+      sha256 = "0z35xqna3dnrfxgn9aa1y6jx7mrwsn8vi8dcwm3sg23qx9nvx7ha";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index e9be26b40165..3ba6d1d02db9 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -204,7 +204,7 @@ mirror://xorg/individual/lib/libXTrap-1.0.1.tar.bz2
 mirror://xorg/individual/lib/libXt-1.2.1.tar.bz2
 mirror://xorg/individual/lib/libXtst-1.2.3.tar.bz2
 mirror://xorg/individual/lib/libXv-1.0.11.tar.bz2
-mirror://xorg/individual/lib/libXvMC-1.0.12.tar.bz2
+mirror://xorg/individual/lib/libXvMC-1.0.13.tar.xz
 mirror://xorg/individual/lib/libXxf86dga-1.1.5.tar.bz2
 mirror://xorg/individual/lib/libXxf86misc-1.0.4.tar.bz2
 mirror://xorg/individual/lib/libXxf86vm-1.1.5.tar.xz

From 17dcb69237457e78cfb7e2f8a13d99e315ea3f05 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 17 Mar 2023 11:39:49 +0000
Subject: [PATCH 120/154] python310Packages.twisted: Disable tests using legacy
 algos from crypt

The tests were unconiditonally using crypt methods that we don't
support anymore. The patch has also been submitted upstream.
---
 pkgs/development/python-modules/twisted/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index 0f0f455a4235..758b3f4eea0b 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -63,6 +63,12 @@ buildPythonPackage rec {
       url = "https://github.com/twisted/twisted/pull/11787.diff";
       hash = "sha256-bQgUmbvDa61Vg8p/o/ivfkOAHyj1lTgHkrRVEGLM9aU=";
     })
+    (fetchpatch {
+      # Conditionally skip tests that require METHOD_CRYPT
+      # https://github.com/twisted/twisted/pull/11827
+      url = "https://github.com/mweinelt/twisted/commit/e69e652de671aac0abf5c7e6c662fc5172758c5a.patch";
+      hash = "sha256-LmvKUTViZoY/TPBmSlx4S9FbJNZfB5cxzn/YcciDmoI=";
+    })
   ] ++ lib.optionals (pythonAtLeast "3.11") [
     (fetchpatch {
       url = "https://github.com/twisted/twisted/pull/11734.diff";

From 94f0ae85e1232261a88bb3509ababe7028d3f232 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 17 Mar 2023 12:26:23 +0000
Subject: [PATCH 121/154] python310Packages.passlib: Disable tests for
 unsupported algorithms

These tests have a fixed expectation, that they should be available on
Linux, but in fact they't don't have to be.
---
 pkgs/development/python-modules/passlib/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/python-modules/passlib/default.nix b/pkgs/development/python-modules/passlib/default.nix
index f18307c50bf0..e85d979ade79 100644
--- a/pkgs/development/python-modules/passlib/default.nix
+++ b/pkgs/development/python-modules/passlib/default.nix
@@ -38,6 +38,13 @@ buildPythonPackage rec {
     "test_82_crypt_support"
   ];
 
+  pytestFlagsArray = [
+    # hashing algorithms we don't support anymore
+    "--deselect=passlib/tests/test_handlers.py::des_crypt_os_crypt_test::test_82_crypt_support"
+    "--deselect=passlib/tests/test_handlers.py::md5_crypt_os_crypt_test::test_82_crypt_support"
+    "--deselect=passlib/tests/test_handlers.py::sha256_crypt_os_crypt_test::test_82_crypt_support"
+  ];
+
   meta = with lib; {
     description = "A password hashing library for Python";
     homepage = "https://foss.heptapod.net/python-libs/passlib";

From 476d75361354d7a011ead601787fef95eebfeb74 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 17 Mar 2023 12:44:44 +0000
Subject: [PATCH 122/154] python310Packages.y-py: Fix build on darwin

by providing libiconv.
---
 pkgs/development/python-modules/y-py/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/y-py/default.nix b/pkgs/development/python-modules/y-py/default.nix
index 12111407e525..f3c681eb4f88 100644
--- a/pkgs/development/python-modules/y-py/default.nix
+++ b/pkgs/development/python-modules/y-py/default.nix
@@ -1,7 +1,9 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchPypi
 , rustPlatform
+, libiconv
 , pytestCheckHook
 }:
 
@@ -29,6 +31,8 @@ buildPythonPackage rec {
     rust.rustc
   ];
 
+  buildInputs = lib.optional stdenv.isDarwin libiconv;
+
   pythonImportsCheck = [ "y_py" ];
 
   nativeCheckInputs = [

From 4bdbae5ad13b0c8c98232ebb70a288815ef5f012 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 17 Mar 2023 15:03:44 +0000
Subject: [PATCH 123/154] cc-wrapper: wrap `cpp` for cross lust like to native

Without this change $target-cpp is used unwrapped and is missing
standard header search paths among other things).

Example failure:

    $ nix build -f. -L pkgsStatic.netbsd.compat
    ...
       > checking how to run the C preprocessor... x86_64-unknown-linux-musl-cpp
       > configure: error: in `/build/cvs-export/tools/compat':
       > configure: error: C preprocessor "x86_64-unknown-linux-musl-cpp" fails sanity check
       > See `config.log' for more details
---
 pkgs/build-support/cc-wrapper/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 96fd8b66bb42..d2a1ed39ee07 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -228,6 +228,10 @@ stdenv.mkDerivation {
 
       if [ -e $ccPath/cpp ]; then
         wrap ${targetPrefix}cpp $wrapper $ccPath/cpp
+    '' + lib.optionalString (hostPlatform != targetPlatform) ''
+      elif [ -e $ccPath/${targetPrefix}cpp ]; then
+        wrap ${targetPrefix}cpp $wrapper $ccPath/${targetPrefix}cpp
+    '' + ''
       fi
     ''
 

From 114bccdafa4fa326f3658e475b1dc0463fe88d51 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 18 Mar 2023 21:19:23 +0000
Subject: [PATCH 124/154] emacs: use held back patchelf_0_15 to avoid upstream
 bug

patchelf-0.17.2 corrupts `$out/bin/emacs` binary. It has something to
do with program headers change. Let's pin `emcas` back to `0.15.0`
until `patchelf` is fixed.
---
 pkgs/applications/editors/emacs/generic.nix   |  4 +++
 pkgs/development/tools/misc/patchelf/0.15.nix | 36 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  5 +++
 3 files changed, 45 insertions(+)
 create mode 100644 pkgs/development/tools/misc/patchelf/0.15.nix

diff --git a/pkgs/applications/editors/emacs/generic.nix b/pkgs/applications/editors/emacs/generic.nix
index 7b71fccd6b8a..e985202fad23 100644
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@@ -15,6 +15,7 @@
 , recurseIntoAttrs, emacsPackagesFor
 , libgccjit, makeWrapper # native-comp params
 , fetchFromSavannah, fetchFromBitbucket
+, patchelf_0_15
 
   # macOS dependencies for NS and macPort
 , AppKit, Carbon, Cocoa, IOKit, OSAKit, Quartz, QuartzCore, WebKit
@@ -136,6 +137,9 @@ assert withTreeSitter -> tree-sitter != null;
   ];
 
   nativeBuildInputs = [ pkg-config makeWrapper ]
+    # TODO: remove once it's fixed upstream and released:
+    #   https://github.com/NixOS/patchelf/issues/482
+    ++ [ patchelf_0_15 ]
     ++ lib.optionals (srcRepo || withMacport) [ texinfo ]
     ++ lib.optionals srcRepo [ autoreconfHook ]
     ++ lib.optional (withX && (withGTK3 || withXwidgets)) wrapGAppsHook;
diff --git a/pkgs/development/tools/misc/patchelf/0.15.nix b/pkgs/development/tools/misc/patchelf/0.15.nix
new file mode 100644
index 000000000000..fc71c4aa4ea4
--- /dev/null
+++ b/pkgs/development/tools/misc/patchelf/0.15.nix
@@ -0,0 +1,36 @@
+{ lib, stdenv, fetchurl }:
+
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
+stdenv.mkDerivation rec {
+  pname = "patchelf";
+  version = "0.15.0";
+
+  src = fetchurl {
+    url = "https://github.com/NixOS/${pname}/releases/download/${version}/${pname}-${version}.tar.bz2";
+    sha256 = "sha256-9ANtPuTY4ijewb7/8PbkbYpA6eVw4AaOOdd+YuLIvcI=";
+  };
+
+  strictDeps = true;
+
+  setupHook = [ ./setup-hook.sh ];
+
+  enableParallelBuilding = true;
+
+  # fails 8 out of 24 tests, problems when loading libc.so.6
+  doCheck = stdenv.name == "stdenv-linux"
+    # test scripts require unprefixed bintools binaries
+    # https://github.com/NixOS/patchelf/issues/417
+    && stdenv.cc.targetPrefix == "";
+
+  meta = with lib; {
+    homepage = "https://github.com/NixOS/patchelf";
+    license = licenses.gpl3Plus;
+    description = "A small utility to modify the dynamic linker and RPATH of ELF executables";
+    maintainers = [ maintainers.eelco ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6bdc275e473c..31fa49e80170 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -18562,6 +18562,11 @@ with pkgs;
   patchelf_0_13 = callPackage ../development/tools/misc/patchelf/0.13.nix {
     patchelf = patchelfStable;
   };
+
+  # used by emacs which is not compatible to 0.17.2 release:
+  #   https://github.com/NixOS/patchelf/issues/482
+  patchelf_0_15 = callPackage ../development/tools/misc/patchelf/0.15.nix { };
+
   patchelfStable = callPackage ../development/tools/misc/patchelf { };
 
   patchelfUnstable = lowPrio (callPackage ../development/tools/misc/patchelf/unstable.nix { });

From a3f338ef5f0031b0748557bf7228cec9ad0202dc Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 20 Mar 2023 09:35:01 +0000
Subject: [PATCH 125/154] _389-ds-base: disable parallel installing

Without the change parallel installs fail occasionally as:

    ld: cannot find -lslapd: No such file or directory

Full build log example: https://hydra.nixos.org/log/h38bj77gav0r6jbi4bgzy1lfjq22k2wy-389-ds-base-2.3.1.drv
---
 pkgs/servers/ldap/389/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/servers/ldap/389/default.nix b/pkgs/servers/ldap/389/default.nix
index 4478c594330d..c14caa53175c 100644
--- a/pkgs/servers/ldap/389/default.nix
+++ b/pkgs/servers/ldap/389/default.nix
@@ -119,6 +119,10 @@ stdenv.mkDerivation rec {
   ];
 
   enableParallelBuilding = true;
+  # Disable parallel builds as those lack some dependencies:
+  #   ld: cannot find -lslapd: No such file or directory
+  # https://hydra.nixos.org/log/h38bj77gav0r6jbi4bgzy1lfjq22k2wy-389-ds-base-2.3.1.drv
+  enableParallelInstalling = false;
 
   doCheck = true;
 

From 9666d43d40b7688718df4303ca338a84ea900d6f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sun, 19 Mar 2023 15:05:33 +0100
Subject: [PATCH 126/154] dovecot: avoid testing DES-encrypted passwords

---
 nixos/doc/manual/release-notes/rl-2305.section.md | 2 +-
 pkgs/servers/mail/dovecot/default.nix             | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index e6a5a14a7772..2b5963e2340b 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -22,7 +22,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `nixos-rebuild` now supports an extra `--specialisation` option that can be used to change specialisation for `switch` and `test` commands.
 
-- `libxcrypt`, the library providing the `crypt(3)` password hashing function, is now built without support for algorithms not flagged [`strong`](https://github.com/besser82/libxcrypt/blob/v4.4.33/lib/hashes.conf#L48). This affects the availability of password hashing algorithms used for system login (`login(1)`, `passwd(1)`), but also Apache2 Basic-Auth, Samba, OpenLDAP, and [many other packages](https://github.com/search?q=repo%3ANixOS%2Fnixpkgs%20libxcrypt&type=code).
+- `libxcrypt`, the library providing the `crypt(3)` password hashing function, is now built without support for algorithms not flagged [`strong`](https://github.com/besser82/libxcrypt/blob/v4.4.33/lib/hashes.conf#L48). This affects the availability of password hashing algorithms used for system login (`login(1)`, `passwd(1)`), but also Apache2 Basic-Auth, Samba, OpenLDAP, Dovecot, and [many other packages](https://github.com/search?q=repo%3ANixOS%2Fnixpkgs%20libxcrypt&type=code).
 
 ## New Services {#sec-release-23.05-new-services}
 
diff --git a/pkgs/servers/mail/dovecot/default.nix b/pkgs/servers/mail/dovecot/default.nix
index 9eb9eff298ea..47b6e8571915 100644
--- a/pkgs/servers/mail/dovecot/default.nix
+++ b/pkgs/servers/mail/dovecot/default.nix
@@ -41,6 +41,9 @@ stdenv.mkDerivation rec {
     sed -i -s -E 's!\bcat\b!${coreutils}/bin/cat!g' src/lib-smtp/test-bin/*.sh
 
     patchShebangs src/config/settings-get.pl
+
+    # DES-encrypted passwords are not supported by NixPkgs anymore
+    sed '/test_password_scheme("CRYPT"/d' -i src/auth/test-libpassword.c
   '' + lib.optionalString stdenv.isLinux ''
     export systemdsystemunitdir=$out/etc/systemd/system
   '';

From ce15577ab4d047802e0dbf12c99e09adf21184d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 20 Mar 2023 16:00:53 +0100
Subject: [PATCH 127/154] Revert "Merge #211691: patchelfStable: 0.15.0 ->
 0.17.2"

This reverts commit 6d1fadff21a88aa588c4d59ed06dd7a888b6e7a4, reversing
changes made to 8cfd131abd5c8e5d99ebb85aa53ae7d8ee9bcf3d.
https://github.com/NixOS/patchelf/issues/482#issuecomment-1476083833
---
 pkgs/development/tools/misc/patchelf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/misc/patchelf/default.nix b/pkgs/development/tools/misc/patchelf/default.nix
index ce50543cec8d..fc71c4aa4ea4 100644
--- a/pkgs/development/tools/misc/patchelf/default.nix
+++ b/pkgs/development/tools/misc/patchelf/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "patchelf";
-  version = "0.17.2";
+  version = "0.15.0";
 
   src = fetchurl {
     url = "https://github.com/NixOS/${pname}/releases/download/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-uuLqN2By5CLBliGN2b3vBUjMwI2k3p82tGct+E6i2OI=";
+    sha256 = "sha256-9ANtPuTY4ijewb7/8PbkbYpA6eVw4AaOOdd+YuLIvcI=";
   };
 
   strictDeps = true;

From df0d3e3ea1a579aa994327a4c69b7f742e3ece63 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 20 Mar 2023 16:02:30 +0100
Subject: [PATCH 128/154] Revert "Merge #221900: emacs: use patchelf_0_15 to
 avoid upstream bug"

This reverts commit ce7e136b6a8cb9808c7b0fdb7fc6c5ed5adc7bc1, reversing
changes made to 4d82a453fbe31b1b5db47f0d3d00059f8aef3908.
---
 pkgs/applications/editors/emacs/generic.nix   |  4 ---
 pkgs/development/tools/misc/patchelf/0.15.nix | 36 -------------------
 pkgs/top-level/all-packages.nix               |  5 ---
 3 files changed, 45 deletions(-)
 delete mode 100644 pkgs/development/tools/misc/patchelf/0.15.nix

diff --git a/pkgs/applications/editors/emacs/generic.nix b/pkgs/applications/editors/emacs/generic.nix
index e985202fad23..7b71fccd6b8a 100644
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@@ -15,7 +15,6 @@
 , recurseIntoAttrs, emacsPackagesFor
 , libgccjit, makeWrapper # native-comp params
 , fetchFromSavannah, fetchFromBitbucket
-, patchelf_0_15
 
   # macOS dependencies for NS and macPort
 , AppKit, Carbon, Cocoa, IOKit, OSAKit, Quartz, QuartzCore, WebKit
@@ -137,9 +136,6 @@ assert withTreeSitter -> tree-sitter != null;
   ];
 
   nativeBuildInputs = [ pkg-config makeWrapper ]
-    # TODO: remove once it's fixed upstream and released:
-    #   https://github.com/NixOS/patchelf/issues/482
-    ++ [ patchelf_0_15 ]
     ++ lib.optionals (srcRepo || withMacport) [ texinfo ]
     ++ lib.optionals srcRepo [ autoreconfHook ]
     ++ lib.optional (withX && (withGTK3 || withXwidgets)) wrapGAppsHook;
diff --git a/pkgs/development/tools/misc/patchelf/0.15.nix b/pkgs/development/tools/misc/patchelf/0.15.nix
deleted file mode 100644
index fc71c4aa4ea4..000000000000
--- a/pkgs/development/tools/misc/patchelf/0.15.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ lib, stdenv, fetchurl }:
-
-# Note: this package is used for bootstrapping fetchurl, and thus
-# cannot use fetchpatch! All mutable patches (generated by GitHub or
-# cgit) that are needed here should be included directly in Nixpkgs as
-# files.
-
-stdenv.mkDerivation rec {
-  pname = "patchelf";
-  version = "0.15.0";
-
-  src = fetchurl {
-    url = "https://github.com/NixOS/${pname}/releases/download/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-9ANtPuTY4ijewb7/8PbkbYpA6eVw4AaOOdd+YuLIvcI=";
-  };
-
-  strictDeps = true;
-
-  setupHook = [ ./setup-hook.sh ];
-
-  enableParallelBuilding = true;
-
-  # fails 8 out of 24 tests, problems when loading libc.so.6
-  doCheck = stdenv.name == "stdenv-linux"
-    # test scripts require unprefixed bintools binaries
-    # https://github.com/NixOS/patchelf/issues/417
-    && stdenv.cc.targetPrefix == "";
-
-  meta = with lib; {
-    homepage = "https://github.com/NixOS/patchelf";
-    license = licenses.gpl3Plus;
-    description = "A small utility to modify the dynamic linker and RPATH of ELF executables";
-    maintainers = [ maintainers.eelco ];
-    platforms = platforms.all;
-  };
-}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0cacbe78ebd1..f6a1baa7e226 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -18570,11 +18570,6 @@ with pkgs;
   patchelf_0_13 = callPackage ../development/tools/misc/patchelf/0.13.nix {
     patchelf = patchelfStable;
   };
-
-  # used by emacs which is not compatible to 0.17.2 release:
-  #   https://github.com/NixOS/patchelf/issues/482
-  patchelf_0_15 = callPackage ../development/tools/misc/patchelf/0.15.nix { };
-
   patchelfStable = callPackage ../development/tools/misc/patchelf { };
 
   patchelfUnstable = lowPrio (callPackage ../development/tools/misc/patchelf/unstable.nix { });

From 97d4b225da9ed7bae07d148a4895b03844437d0b Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Wed, 1 Mar 2023 17:04:14 +0000
Subject: [PATCH 129/154] polkit: move test-only deps to nativeCheckInputs

(cherry picked from commit 1d9429faa0c864cae4e4f366818d47b18c32234e)
---
 pkgs/development/libraries/polkit/default.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index e5a556517125..a00b6bb07a54 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -73,13 +73,6 @@ stdenv.mkDerivation rec {
     ninja
     perl
     rsync
-    (python3.pythonForBuild.withPackages (pp: with pp; [
-      dbus-python
-      (python-dbusmock.overridePythonAttrs (attrs: {
-        # Avoid dependency cycle.
-        doCheck = false;
-      }))
-    ]))
 
     # man pages
     libxslt
@@ -108,6 +101,13 @@ stdenv.mkDerivation rec {
 
   nativeCheckInputs = [
     dbus
+    (python3.pythonForBuild.withPackages (pp: with pp; [
+      dbus-python
+      (python-dbusmock.overridePythonAttrs (attrs: {
+        # Avoid dependency cycle.
+        doCheck = false;
+      }))
+    ]))
   ];
 
   mesonFlags = [

From 280f14490eeff5285e9f5e79b81869ce720546db Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 20 Mar 2023 12:03:21 +0100
Subject: [PATCH 130/154] curl: 7.88.1 -> 8.0.1

https://curl.se/changes.html#8_0_0
https://daniel.haxx.se/blog/2023/03/20/curl-8-0-0-is-here/
https://daniel.haxx.se/blog/2023/03/20/curl-8-0-1-because-i-jinxed-it/

Fixes: CVE-2023-27533, CVE-2023-27534, CVE-2023-27535, CVE-2023-27536,
       CVE-2023-27537, CVE-2023-27538
---
 pkgs/tools/networking/curl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index fca190bde4ab..5979a32cac49 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -48,14 +48,14 @@ assert !(opensslSupport && wolfsslSupport);
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "7.88.1";
+  version = "8.0.1";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.bz2"
       "https://github.com/curl/curl/releases/download/curl-${finalAttrs.version}/curl-${finalAttrs.version}.tar.bz2"
     ];
-    hash = "sha256-giS0XM4Sq94DnBLcBxG36oWxBLmtU01uTFtOGIphyQc=";
+    hash = "sha256-m2selrdI0EuWh4a2vfQHqlx1q1Oj03wcjIHNtzZVXM8=";
   };
 
   patches = [

From 603cae0768edf341d75708f881f73abd04d8646d Mon Sep 17 00:00:00 2001
From: Artturi <Artturin@artturin.com>
Date: Mon, 20 Mar 2023 16:37:09 +0100
Subject: [PATCH 131/154] curl: Fix passthru tests evaluation

The override would previously clear the version attribute, which
likely started happening after 41877098.

Co-Authored-By: Martin Weinelt <hexa@darmstadt.ccc.de>
---
 pkgs/tools/networking/curl/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 5979a32cac49..3fc6d760bceb 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -168,7 +168,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit opensslSupport openssl;
     tests = {
       withCheck = finalAttrs.finalPackage.overrideAttrs (_: { doCheck = true; });
-      fetchpatch = tests.fetchpatch.simple.override { fetchpatch = fetchpatch.override { fetchurl = useThisCurl fetchurl; }; };
+      fetchpatch = tests.fetchpatch.simple.override { fetchpatch = (fetchpatch.override { fetchurl = useThisCurl fetchurl; }) // { version = 1; }; };
       curlpp = useThisCurl curlpp;
       coeurl = useThisCurl coeurl;
       haskell-curl = useThisCurl haskellPackages.curl;

From 9434136df388462ad7562f16b78cd94ff8a3c5e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Tue, 21 Mar 2023 09:52:12 +0100
Subject: [PATCH 132/154] ninja: patch issues on 32-bit platforms

Fixes #68241
> Value too large for defined data type
https://hydra.nixos.org/build/213266252
---
 pkgs/development/tools/build-managers/ninja/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/tools/build-managers/ninja/default.nix b/pkgs/development/tools/build-managers/ninja/default.nix
index 84897e43f786..7c2c79bf9e92 100644
--- a/pkgs/development/tools/build-managers/ninja/default.nix
+++ b/pkgs/development/tools/build-managers/ninja/default.nix
@@ -38,6 +38,15 @@ stdenv.mkDerivation rec {
     libxslt.bin
   ];
 
+  patches = lib.optionals stdenv.is32bit [
+    # Otherwise ninja may fail on some files in a larger FS.
+    (fetchpatch {
+      name = "stat64.patch";
+      url = "https://github.com/ninja-build/ninja/commit/7bba11ae704efc84cac5fde5e9be53f653f237d1.diff";
+      hash = "sha256-tINS57xLh1lwnYFWCQs5OudfgtIShaOh5zbmv7w5BnQ=";
+    })
+  ];
+
   postPatch = ''
     # write rebuild args to file after bootstrap
     substituteInPlace configure.py --replace "subprocess.check_call(rebuild_args)" "open('rebuild_args','w').write(rebuild_args[0])"

From bfbc0f56e55b1351423ebc4845cfd4f8e432a667 Mon Sep 17 00:00:00 2001
From: MaxHearnden <maxoscarhearnden@gmail.com>
Date: Tue, 21 Mar 2023 22:50:14 +0000
Subject: [PATCH 133/154] override test for curl version

---
 pkgs/applications/science/math/R/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/science/math/R/default.nix b/pkgs/applications/science/math/R/default.nix
index 580de87bdb23..c1c23616fc25 100644
--- a/pkgs/applications/science/math/R/default.nix
+++ b/pkgs/applications/science/math/R/default.nix
@@ -73,6 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
       FC="${gfortran}/bin/gfortran" F77="${gfortran}/bin/gfortran"
       JAVA_HOME="${jdk}"
       RANLIB=$(type -p ranlib)
+      r_cv_have_curl728=yes
       R_SHELL="${stdenv.shell}"
   '' + lib.optionalString stdenv.isDarwin ''
       --disable-R-framework

From ade83d316b9032c565bdcf33a872ac6072433e98 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Wed, 22 Mar 2023 16:06:43 +1000
Subject: [PATCH 134/154] nixos/doc/rl-2305: remove stray conflict marker

---
 nixos/doc/manual/release-notes/rl-2305.section.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 37b446d2e6f2..7ba3552b4e42 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -181,7 +181,6 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The `baget` package and module was removed due to being unmaintained.
 
->>>>>>> origin/master
 ## Other Notable Changes {#sec-release-23.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

From a9733393244300f603aa2d2f270ac1ec03424abe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Wed, 22 Mar 2023 13:48:40 +0100
Subject: [PATCH 135/154] perlPackages.AuthenSimple: don't test the "crypt"
 algo

---
 pkgs/top-level/perl-packages.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index a6e747abbeca..e0ca3b733b44 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -1350,6 +1350,20 @@ let
       url = "mirror://cpan/authors/id/C/CH/CHANSEN/Authen-Simple-0.5.tar.gz";
       hash = "sha256-As3atH+L8aHL1Mm/jSWPbQURFJnDP4MV5yRIEvcmE6o=";
     };
+    # Our C crypt() doesn't support this weak "crypt" algorithm anymore.
+    postPatch = ''
+      patch -p1 <<-EOF
+        --- a/t/09password.t
+        +++ b/t/09password.t
+        @@ -10 +10 @@
+        -use Test::More tests => 16;
+        +use Test::More tests => 14;
+        @@ -14 +13,0 @@
+        -    [ 'crypt',     'lk9Mh5KHGjAaM',                          'crypt'        ],
+        @@ -18 +16,0 @@
+        -    [ 'crypt',     '{CRYPT}lk9Mh5KHGjAaM',                   '{CRYPT}'      ],
+      EOF
+    '';
     propagatedBuildInputs = [ ClassAccessor ClassDataInheritable CryptPasswdMD5 ParamsValidate ];
     meta = {
       description = "Simple Authentication";

From e559231384ac6a2d2aefdb3d747d48d5fe530e2b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Wed, 22 Mar 2023 14:00:59 +0100
Subject: [PATCH 136/154] perlPackages.AuthenSimplePasswd: don't test the
 "crypt" algo

---
 pkgs/top-level/perl-packages.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index e0ca3b733b44..c8a19041c061 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -1378,6 +1378,10 @@ let
       url = "mirror://cpan/authors/id/C/CH/CHANSEN/Authen-Simple-Passwd-0.6.tar.gz";
       hash = "sha256-z1W8NiWe3w/Wr5rSusgbMdxbVqFixmBZDsuWnHwWdLI=";
     };
+    # Our C crypt() doesn't support this weak "crypt" algorithm anymore.
+    postPatch = ''
+      sed -e 's/tests => 8/tests => 7/' -e "/'crypt'/d" -i t/04basic.t
+    '';
     propagatedBuildInputs = [ AuthenSimple ];
     meta = {
       description = "Simple Passwd authentication";

From cb10bd6cb34e5cf093340b14852844dd82de0813 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Fri, 24 Mar 2023 08:57:05 +0100
Subject: [PATCH 137/154] lapack: force a rebuild on x86_64-darwin

I have no idea why, but Hydra cached a corrupted binary
/nix/store/h0412qmi29ivgrc42lfhi1x290d6l429-lapack-3/lib/liblapack.dylib
so rebuilding it fixes issues in various dependants, e.g.
https://hydra.nixos.org/log/nqfq62pqbbmsq08kb2pljdkz9ldyr57b-python3.10-numpy-1.24.2.drv
---
 pkgs/build-support/alternatives/lapack/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/build-support/alternatives/lapack/default.nix b/pkgs/build-support/alternatives/lapack/default.nix
index 9886a035e4ec..cbc7bf25c797 100644
--- a/pkgs/build-support/alternatives/lapack/default.nix
+++ b/pkgs/build-support/alternatives/lapack/default.nix
@@ -35,6 +35,9 @@ stdenv.mkDerivation {
     implementation = lapackImplementation;
   };
 
+  # TODO: drop this forced rebuild, as it was needed just once.
+  rebuild_salt = if stdenv.isDarwin && stdenv.isx86_64 then "J4AQ" else null;
+
   dontBuild = true;
   dontConfigure = true;
   unpackPhase = "src=$PWD";

From cd585031d3159ce83604050e984af6e56bfeb499 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Fri, 24 Mar 2023 16:34:28 +0100
Subject: [PATCH 138/154] ettercap: patch to accept curl 8

---
 .../networking/sniffers/ettercap/default.nix           | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/sniffers/ettercap/default.nix b/pkgs/applications/networking/sniffers/ettercap/default.nix
index a51f88ad5f7e..3554592fbe12 100644
--- a/pkgs/applications/networking/sniffers/ettercap/default.nix
+++ b/pkgs/applications/networking/sniffers/ettercap/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, libpcap, libnet, zlib, curl, pcre
+{ lib, stdenv, fetchFromGitHub, fetchpatch2, cmake, libpcap, libnet, zlib, curl, pcre
 , openssl, ncurses, glib, gtk3, atk, pango, flex, bison, geoip, harfbuzz
 , pkg-config }:
 
@@ -13,6 +13,14 @@ stdenv.mkDerivation rec {
     sha256 = "1sdf1ssa81ib6k0mc5m2jzbjl4jd1yv6ahv5dwx2x9w4b2pyqg1c";
   };
 
+  patches = [
+    (fetchpatch2 {
+      name = "curl-8.patch";
+      url = "https://github.com/Ettercap/ettercap/commit/9ec4066addc49483e40055e0738c2e0ef144702f.diff";
+      sha256 = "6D8lIxub0OS52BFr42yWRyqS2Q5CrpTLTt6rcItXFMM=";
+    })
+  ];
+
   strictDeps = true;
   nativeBuildInputs = [ cmake flex bison pkg-config ];
   buildInputs = [

From 2a21328f7e0b751c6ec1f2539cb07dc8e85c8e43 Mon Sep 17 00:00:00 2001
From: Samuel Ainsworth <sam.ainsworth@getcruise.com>
Date: Fri, 24 Mar 2023 13:22:44 -0400
Subject: [PATCH 139/154] snappy: fix x86_64-darwin build

See https://github.com/NixOS/nixpkgs/pull/221215#issuecomment-1482564003.
---
 pkgs/development/libraries/snappy/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/snappy/default.nix b/pkgs/development/libraries/snappy/default.nix
index 9621a3411560..a45d0a419e62 100644
--- a/pkgs/development/libraries/snappy/default.nix
+++ b/pkgs/development/libraries/snappy/default.nix
@@ -29,8 +29,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  # See https://github.com/NixOS/nixpkgs/pull/219778#issuecomment-1464884412.
-  env.NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.isAarch64 && stdenv.isDarwin) "-Wno-sign-compare";
+  # See https://github.com/NixOS/nixpkgs/pull/219778#issuecomment-1464884412
+  # and https://github.com/NixOS/nixpkgs/pull/221215#issuecomment-1482564003.
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-sign-compare";
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"

From 89c01366f924b066e284b287eb07168f94716d19 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Fri, 24 Mar 2023 18:57:43 +0100
Subject: [PATCH 140/154] bustle: Fix build with libpcap 1.10.2

---
 .../haskell-modules/configuration-common.nix          | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index f598758f4a0c..81cedafdf4c5 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -621,13 +621,20 @@ self: super: {
   Euterpea = doJailbreak super.Euterpea;
 
   # Install icons, metadata and cli program.
-  bustle = overrideCabal (drv: {
+  bustle = appendPatches [
+    # Fix build with libpcap 1.10.2
+    # https://gitlab.freedesktop.org/bustle/bustle/-/merge_requests/21
+    (pkgs.fetchpatch {
+      url = "https://gitlab.freedesktop.org/bustle/bustle/-/commit/77e2de892cd359f779c84739682431a66eb8cf31.patch";
+      hash = "sha256-sPb6/Z/ANids53aL9VsMHa/v5y+TA1ZY3jwAXlEH3Ec=";
+    })
+  ] (overrideCabal (drv: {
     buildDepends = [ pkgs.libpcap ];
     buildTools = with pkgs.buildPackages; [ gettext perl help2man ];
     postInstall = ''
       make install PREFIX=$out
     '';
-  }) super.bustle;
+  }) super.bustle);
 
   # Byte-compile elisp code for Emacs.
   ghc-mod = overrideCabal (drv: {

From 9a646316b1908c8611af534ebd0a79190dd44850 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Sat, 25 Mar 2023 10:16:43 +0800
Subject: [PATCH 141/154] qt6.qtwebengine: pin to ffmpeg_4

As Unmodified ffmpeg >= 5.0 is not supported by upstream
---
 pkgs/development/libraries/qt-6/modules/qtwebengine.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
index f8f52763496a..22d1e497f4ff 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
@@ -55,7 +55,7 @@
 , openbsm
 , runCommand
 , writeScriptBin
-, ffmpeg
+, ffmpeg_4
 , lib
 , stdenv
 , glib
@@ -173,7 +173,7 @@ qtModule {
     re2
 
     libevent
-    ffmpeg
+    ffmpeg_4
 
     dbus
     zlib

From eb157e657a60d84ad528f01a31931a6d009758fb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sat, 25 Mar 2023 09:34:05 +0100
Subject: [PATCH 142/154] ntirpc: fixup build (missing #include)

https://hydra.nixos.org/build/213259376
No idea why it regressed *now*, but I don't expect it matters.
---
 pkgs/development/libraries/ntirpc/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/libraries/ntirpc/default.nix b/pkgs/development/libraries/ntirpc/default.nix
index 4526814c3780..d1a795bcf9a5 100644
--- a/pkgs/development/libraries/ntirpc/default.nix
+++ b/pkgs/development/libraries/ntirpc/default.nix
@@ -15,6 +15,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace ntirpc/netconfig.h --replace "/etc/netconfig" "$out/etc/netconfig"
+    sed '1i#include <assert.h>' -i src/work_pool.c
   '';
 
   nativeBuildInputs = [ cmake ];

From f4933e2243b75daa16ff062f73cb6c5e750536a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sat, 25 Mar 2023 09:54:06 +0100
Subject: [PATCH 143/154] ndn-tools: fix build after libpcap update

---
 pkgs/tools/networking/ndn-tools/default.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/tools/networking/ndn-tools/default.nix b/pkgs/tools/networking/ndn-tools/default.nix
index 425ddb440435..1cbc6d403a9d 100644
--- a/pkgs/tools/networking/ndn-tools/default.nix
+++ b/pkgs/tools/networking/ndn-tools/default.nix
@@ -21,6 +21,17 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-28sPgo2nq5AhIzZmvDz38echGPzKDzNm2J6iIao4yL8=";
   };
 
+  # Hacky workaround for new pcap-config.
+  postPatch = ''
+    patch -p1 <<EOF
+      --- a/tools/dump/wscript
+      +++ b/tools/dump/wscript
+      @@ -5 +5 @@
+      -    conf.check_cfg(package='libpcap', uselib_store='PCAP',
+      +    conf.check_cfg(package="", uselib_store='PCAP',
+    EOF
+  '';
+
   nativeBuildInputs = [ pkg-config sphinx wafHook ];
   buildInputs = [ libpcap ndn-cxx openssl ];
 

From ea91658f851be21dace58a208b6557a83bb4530b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sat, 25 Mar 2023 09:58:22 +0100
Subject: [PATCH 144/154] multipath-tools: fixup build (missing #include)

---
 pkgs/os-specific/linux/multipath-tools/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/os-specific/linux/multipath-tools/default.nix b/pkgs/os-specific/linux/multipath-tools/default.nix
index 91363969ffe6..bb753e70aa98 100644
--- a/pkgs/os-specific/linux/multipath-tools/default.nix
+++ b/pkgs/os-specific/linux/multipath-tools/default.nix
@@ -40,6 +40,8 @@ stdenv.mkDerivation rec {
       kpartx/Makefile libmpathpersist/Makefile
     sed -i -e "s,GZIP,GZ," \
       $(find * -name Makefile\*)
+
+    sed '1i#include <assert.h>' -i tests/{util,vpd}.c
   '';
 
   nativeBuildInputs = [ pkg-config perl ];

From 3fbc1838ebd6ac0bfed0cb03c3781aa2a6daab43 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sat, 25 Mar 2023 10:03:18 +0100
Subject: [PATCH 145/154] hplip: disable parallel installing

> cannot find -lhpipp
https://hydra.nixos.org/log/s0c7hm2jpwd64msh8xqm6y6q1ihnplci-hplip-3.22.6.drv
---
 pkgs/misc/drivers/hplip/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/misc/drivers/hplip/default.nix b/pkgs/misc/drivers/hplip/default.nix
index 3b87a0ac12b1..b21d2daeb093 100644
--- a/pkgs/misc/drivers/hplip/default.nix
+++ b/pkgs/misc/drivers/hplip/default.nix
@@ -178,6 +178,7 @@ python3Packages.buildPythonApplication {
   '';
 
   enableParallelBuilding = true;
+  enableParallelInstalling = false;
 
   #
   # Running `hp-diagnose_plugin -g` can be used to diagnose

From 9b766dd41b9b49cb0c1b1f3317fc2273f1f8f3a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sat, 25 Mar 2023 10:44:21 +0100
Subject: [PATCH 146/154] libxcrypt: add -legacy variant

---
 pkgs/development/libraries/libxcrypt/default.nix | 9 ++++++---
 pkgs/top-level/all-packages.nix                  | 1 +
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/libxcrypt/default.nix b/pkgs/development/libraries/libxcrypt/default.nix
index 769994a5cdfd..9e03187e957a 100644
--- a/pkgs/development/libraries/libxcrypt/default.nix
+++ b/pkgs/development/libraries/libxcrypt/default.nix
@@ -1,4 +1,8 @@
-{ lib, stdenv, fetchurl, perl, nixosTests }:
+{ lib, stdenv, fetchurl, perl
+# Update the enabled crypt scheme ids in passthru when the enabled hashes change
+, enableHashes ? "strong"
+, nixosTests
+}:
 
 stdenv.mkDerivation rec {
   pname = "libxcrypt";
@@ -15,8 +19,7 @@ stdenv.mkDerivation rec {
   ];
 
   configureFlags = [
-    # Update the enabled crypt scheme ids in passthru when the enabled hashes change
-    "--enable-hashes=strong"
+    "--enable-hashes=${enableHashes}"
     "--enable-obsolete-api=glibc"
     "--disable-failure-tokens"
   ] ++ lib.optionals (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.libc == "bionic") [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6293b6dafce7..79468281c7d5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -22242,6 +22242,7 @@ with pkgs;
       fetchurl = stdenv.fetchurlBoot;
     };
   };
+  libxcrypt-legacy = libxcrypt.override { enableHashes = "all"; };
 
   libxdg_basedir = callPackage ../development/libraries/libxdg-basedir { };
 

From 34ec699ea0f55c36247a426cd102942f232ca8c5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sat, 25 Mar 2023 10:46:47 +0100
Subject: [PATCH 147/154] graalvmCEPackages.python-installable-svm-java*: fix
 by libxcrypt-legacy

https://hydra.nixos.org/build/213259071
---
 .../compilers/graalvm/community-edition/buildGraalvmProduct.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix b/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix
index 6037435d3aec..a9eb04cdb3c9 100644
--- a/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix
@@ -6,6 +6,7 @@
 , perl
 , unzip
 , zlib
+, libxcrypt-legacy
   # extra params
 , product
 , javaVersion
@@ -46,6 +47,7 @@ stdenv.mkDerivation ({
   buildInputs = [
     stdenv.cc.cc.lib # libstdc++.so.6
     zlib
+    libxcrypt-legacy # libcrypt.so.1 (default is .2 now)
   ] ++ extraBuildInputs;
 
   unpackPhase = ''

From 301d70dae8283d24283cb31bff937b91ec5c8630 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 25 Mar 2023 22:58:18 +0100
Subject: [PATCH 148/154] perlPackages.Plack: add patch to avoid DES encrypted
 passwords in tests

---
 .../Plack-test-replace-DES-hash-with-bcrypt.patch    | 12 ++++++++++++
 pkgs/top-level/perl-packages.nix                     |  3 +++
 2 files changed, 15 insertions(+)
 create mode 100644 pkgs/development/perl-modules/Plack-test-replace-DES-hash-with-bcrypt.patch

diff --git a/pkgs/development/perl-modules/Plack-test-replace-DES-hash-with-bcrypt.patch b/pkgs/development/perl-modules/Plack-test-replace-DES-hash-with-bcrypt.patch
new file mode 100644
index 000000000000..4f9918a5eeae
--- /dev/null
+++ b/pkgs/development/perl-modules/Plack-test-replace-DES-hash-with-bcrypt.patch
@@ -0,0 +1,12 @@
+Replaces the legacy DES crypt hash used in tests with a stronger
+bcrypt function, as crypt() in pkgs.perl no longer supports DES
+
+# htpasswd -nbB admin s3cr3t
+
+diff --git a/t/Plack-Middleware/htpasswd b/t/Plack-Middleware/htpasswd
+index b597da8..f80461d 100644
+--- a/t/Plack-Middleware/htpasswd
++++ b/t/Plack-Middleware/htpasswd
+@@ -1,1 +1,1 @@
+-admin:6iSeSVcVHgNQw
++admin:$2y$05$qO4lTUQMcE5mU6KI0t7j9uCjcTkpf6sAp0cv6oZiemD0MI8keeKPa
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 59b488bc018e..8b466e0ae38d 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -19593,6 +19593,9 @@ let
     };
     buildInputs = [ AuthenSimplePasswd CGIEmulatePSGI FileShareDirInstall HTTPRequestAsCGI HTTPServerSimplePSGI IOHandleUtil LWP LWPProtocolhttp10 LogDispatchArray MIMETypes TestMockTimeHiRes TestRequires TestSharedFork TestTCP ];
     propagatedBuildInputs = [ ApacheLogFormatCompiler CookieBaker DevelStackTraceAsHTML FileShareDir FilesysNotifySimple HTTPEntityParser HTTPHeadersFast HTTPMessage TryTiny ];
+    patches = [
+      ../development/perl-modules/Plack-test-replace-DES-hash-with-bcrypt.patch
+    ];
     meta = {
       description = "Perl Superglue for Web frameworks and Web Servers (PSGI toolkit)";
       homepage = "https://github.com/plack/Plack";

From f8af7d5b1cdd83c13e77142750fe90434176f22f Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sun, 26 Mar 2023 04:12:51 +0200
Subject: [PATCH 149/154] perlPackages.AuthenHtpasswd: removed failing DES
 crypt() tests

---
 pkgs/top-level/perl-packages.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 8b466e0ae38d..f86af1c78287 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -1180,6 +1180,10 @@ let
       hash = "sha256-tfr0fj+UikUoEGzLiMxxBIz+WY5bAmpEQ2i8fjk0gGc=";
     };
     propagatedBuildInputs = [ ClassAccessor CryptPasswdMD5 DigestSHA1 IOLockedFile ];
+    # Remove test files that fail after DES support was removed from crypt()
+    postPatch = ''
+      rm t/04core.t t/05edit.t
+    '';
     meta = {
       description = "Interface to read and modify Apache .htpasswd files";
       license = with lib.licenses; [ artistic1 gpl1Plus ];

From 33b7b0bf88d7d5ee13a7072b5b582b640babac61 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sun, 26 Mar 2023 04:14:40 +0200
Subject: [PATCH 150/154] perlPackages.CatalystAuthenticationStoreHtpasswd: add
 patch to avoid DES encrypted passwords in tests

---
 ...eHtpasswd-test-replace-DES-hash-with-bcrypt.patch | 12 ++++++++++++
 pkgs/top-level/perl-packages.nix                     |  3 +++
 2 files changed, 15 insertions(+)
 create mode 100644 pkgs/development/perl-modules/CatalystAuthenticationStoreHtpasswd-test-replace-DES-hash-with-bcrypt.patch

diff --git a/pkgs/development/perl-modules/CatalystAuthenticationStoreHtpasswd-test-replace-DES-hash-with-bcrypt.patch b/pkgs/development/perl-modules/CatalystAuthenticationStoreHtpasswd-test-replace-DES-hash-with-bcrypt.patch
new file mode 100644
index 000000000000..f3ce028ca59a
--- /dev/null
+++ b/pkgs/development/perl-modules/CatalystAuthenticationStoreHtpasswd-test-replace-DES-hash-with-bcrypt.patch
@@ -0,0 +1,12 @@
+Replaces the legacy DES crypt hash used in tests with a stronger
+bcrypt function, as crypt() in pkgs.perl no longer supports DES
+
+# htpasswd -nbB mufasa "Circle of Life"
+
+diff --git a/t/lib/TestApp/htpasswd b/t/lib/TestApp/htpasswd
+index 6cec784..91e5375 100644
+--- a/t/lib/TestApp/htpasswd
++++ b/t/lib/TestApp/htpasswd
+@@ -1 +1 @@
+-mufasa:Y7hn4ncIVPOuI
++mufasa:$2y$05$.KPC4Gja9L5AxJATDQBzs.lCHkm49l/9dcoyPcJg0JhyIvsD6Gqza
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index f86af1c78287..71772fe38fe3 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -2256,6 +2256,9 @@ let
     };
     buildInputs = [ ModuleBuildTiny TestLongString TestSimple13 TestWWWMechanize TestWWWMechanizeCatalyst ];
     propagatedBuildInputs = [ AuthenHtpasswd CatalystPluginAuthentication ];
+    patches = [
+      ../development/perl-modules/CatalystAuthenticationStoreHtpasswd-test-replace-DES-hash-with-bcrypt.patch
+    ];
     meta = {
       description = "Authen::Htpasswd based user storage/authentication";
       license = with lib.licenses; [ artistic1 gpl1Plus ];

From 2fb36b81eaf9a3051aaf2501f83a7ca02065e53b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sun, 26 Mar 2023 09:50:41 +0200
Subject: [PATCH 151/154] wmic-bin: fix by switching to libxcrypt-legacy

---
 pkgs/servers/monitoring/plugins/wmic-bin.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/monitoring/plugins/wmic-bin.nix b/pkgs/servers/monitoring/plugins/wmic-bin.nix
index 7ce7802eaf4a..4cfbcd254133 100644
--- a/pkgs/servers/monitoring/plugins/wmic-bin.nix
+++ b/pkgs/servers/monitoring/plugins/wmic-bin.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, autoPatchelfHook, popt, libxcrypt }:
+{ stdenv, lib, fetchFromGitHub, autoPatchelfHook, popt, libxcrypt-legacy }:
 
 stdenv.mkDerivation rec {
   pname = "wmic-bin";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1w1mdbiwz37wzry1q38h8dyjaa6iggmsb9wcyhhlawwm1vj50w48";
   };
 
-  buildInputs = [ popt libxcrypt ];
+  buildInputs = [ popt libxcrypt-legacy ];
 
   nativeBuildInputs = [ autoPatchelfHook ];
 

From 6f4400f8fd79756f2a90952e1bc7520056fa1d44 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sun, 26 Mar 2023 10:28:26 +0200
Subject: [PATCH 152/154] darwin.Csu: disable parallel installing

https://hydra.nixos.org/log/s3ndn08vzhfr0zfylbwjqz8fijna4pjl-Csu-85.drv
---
 pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix
index ac09a282f512..cc73c0ac9415 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix
@@ -18,6 +18,7 @@ appleDerivation' stdenv {
   '';
 
   installFlags = [ "DSTROOT=$(out)" ];
+  enableParallelInstalling = false; # cp: cannot create regular file '$out/lib/crt1.10.6.o'
 
   meta = with lib; {
     description = "Apple's common startup stubs for darwin";

From 4413ef0e0cc0ca677f28f1ec99e1e6262cb94d9a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 26 Mar 2023 15:05:16 +0200
Subject: [PATCH 153/154] radicale2: Disable weak crypt htpasswd test

With our recent libxcrypt changes we don't support a lot of weak
algorithms any longer, which made this test fail.
---
 pkgs/servers/radicale/2.x.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/radicale/2.x.nix b/pkgs/servers/radicale/2.x.nix
index 737582d76319..7e86322e31c6 100644
--- a/pkgs/servers/radicale/2.x.nix
+++ b/pkgs/servers/radicale/2.x.nix
@@ -26,8 +26,12 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   nativeCheckInputs = with python3.pkgs; [
-    pytest-runner
-    pytest
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # uses unsupported crypt method
+    "test_htpasswd_crypt"
   ];
 
   meta = with lib; {

From 8c4c762da229b5f7c83e3946eab8875df9dd88c6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 26 Mar 2023 15:58:08 +0200
Subject: [PATCH 154/154] lighttpd: Disable tests for DES and MD5

These are legacy ciphers, which we don't support any longer.
---
 pkgs/servers/http/lighttpd/default.nix        |  5 +++
 .../lighttpd/disable-legacy-crypt-tests.patch | 37 +++++++++++++++++++
 2 files changed, 42 insertions(+)
 create mode 100644 pkgs/servers/http/lighttpd/disable-legacy-crypt-tests.patch

diff --git a/pkgs/servers/http/lighttpd/default.nix b/pkgs/servers/http/lighttpd/default.nix
index ec727c464954..b942589b791c 100644
--- a/pkgs/servers/http/lighttpd/default.nix
+++ b/pkgs/servers/http/lighttpd/default.nix
@@ -22,6 +22,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-FqyNuV5xlim6YZSbmfiib+upRqgdGFIVsoN5u0EWsLQ=";
   };
 
+  patches = [
+    # disable tests for des/md5, which we don't support any more
+    ./disable-legacy-crypt-tests.patch
+  ];
+
   postPatch = ''
     patchShebangs tests
     # Linux sandbox has an empty hostname and not /etc/hosts, which fails some tests
diff --git a/pkgs/servers/http/lighttpd/disable-legacy-crypt-tests.patch b/pkgs/servers/http/lighttpd/disable-legacy-crypt-tests.patch
new file mode 100644
index 000000000000..3bf50551652e
--- /dev/null
+++ b/pkgs/servers/http/lighttpd/disable-legacy-crypt-tests.patch
@@ -0,0 +1,37 @@
+diff --git a/tests/mod-fastcgi.t b/tests/mod-fastcgi.t
+index 25016e60..e0427046 100755
+--- a/tests/mod-fastcgi.t
++++ b/tests/mod-fastcgi.t
+@@ -79,7 +79,7 @@ EOF
+ 	ok($tf->handle_http($t) == 0, 'FastCGI + bin-copy-environment');
+ 
+ SKIP: {
+-	skip "no crypt-des under openbsd", 2 if $^O eq 'openbsd';
++	skip "no crypt-des", 2;
+ 
+ 	$t->{REQUEST}  = ( <<EOF
+ GET /get-server-env.php?env=REMOTE_USER HTTP/1.0
+diff --git a/tests/request.t b/tests/request.t
+index f56a4300..36e67b88 100755
+--- a/tests/request.t
++++ b/tests/request.t
+@@ -1105,7 +1105,7 @@ $t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200 } ];
+ ok($tf->handle_http($t) == 0, 'Basic-Auth: Valid Auth-token - plain');
+ 
+ SKIP: {
+-	skip "no crypt-des under openbsd", 2 if $^O eq 'openbsd';
++	skip "no crypt-des", 2;
+ $t->{REQUEST}  = ( <<EOF
+ GET /server-config HTTP/1.0
+ Host: auth-htpasswd.example.org
+@@ -1162,9 +1162,7 @@ $t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 401 } ];
+ ok($tf->handle_http($t) == 0, 'Basic-Auth: Valid Auth-token - htpasswd (apr-md5, wrong password)');
+ 
+ SKIP: {
+-	skip "no crypt-md5 under cygwin", 1 if $^O eq 'cygwin';
+-	skip "no crypt-md5 under darwin", 1 if $^O eq 'darwin';
+-	skip "no crypt-md5 under openbsd",1 if $^O eq 'openbsd';
++	skip "no crypt-md5", 1;
+ $t->{REQUEST}  = ( <<EOF
+ GET /server-config HTTP/1.0
+ Host: auth-htpasswd.example.org