From c09e02a3e1c45a9051034d2376e26d76b79bfa31 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Sun, 24 Feb 2019 10:19:49 -0600
Subject: [PATCH 001/144] boost,boost16x: 1.67 -> 1.69 (upgrade default boost
 version)

---
 pkgs/top-level/all-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c86af673e6e9..d3cc005daad5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10372,7 +10372,7 @@ in
   boost167 = callPackage ../development/libraries/boost/1.67.nix { };
   boost168 = callPackage ../development/libraries/boost/1.68.nix { };
   boost169 = callPackage ../development/libraries/boost/1.69.nix { };
-  boost16x = boost167;
+  boost16x = boost169;
   boost170 = callPackage ../development/libraries/boost/1.70.nix { };
   boost17x = boost170;
   boost = boost16x;

From e74d57584fca7e1a4480feaced887c50538a3363 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Sun, 24 Feb 2019 10:41:39 -0600
Subject: [PATCH 002/144] remove a few boost overrides optimistically

Build-tested the changes packages.

May be more that can be cleaned up.
---
 pkgs/top-level/all-packages.nix | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d3cc005daad5..aee984452a09 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3877,9 +3877,7 @@ in
 
   i2p = callPackage ../tools/networking/i2p {};
 
-  i2pd = callPackage ../tools/networking/i2pd {
-    boost = boost165;
-  };
+  i2pd = callPackage ../tools/networking/i2pd { };
 
   i-score = libsForQt5.callPackage ../applications/audio/i-score { };
 
@@ -4458,9 +4456,7 @@ in
 
   file-rename = callPackage ../tools/filesystems/file-rename { };
 
-  kea = callPackage ../tools/networking/kea {
-    boost = boost165;
-  };
+  kea = callPackage ../tools/networking/kea { };
 
   ispell = callPackage ../tools/text/ispell {};
 
@@ -15110,9 +15106,7 @@ in
     libtool = darwin.cctools;
   };
 
-  rippled = callPackage ../servers/rippled {
-    boost = boost167;
-  };
+  rippled = callPackage ../servers/rippled { };
 
   rippled-validator-keys-tool = callPackage ../servers/rippled/validator-keys-tool.nix {
     boost = boost167.override {
@@ -18963,7 +18957,7 @@ in
   k3d = callPackage ../applications/graphics/k3d {
     inherit (pkgs.gnome2) gtkglext;
     stdenv = gcc6Stdenv;
-    boost = boost166.override { enablePython = true; };
+    boost = boost.override { enablePython = true; };
   };
 
   k9copy = libsForQt5.callPackage ../applications/video/k9copy {};

From 1601a7fcce389ae3f1b1b36676fd5545035566af Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Thu, 26 Sep 2019 18:47:38 -0400
Subject: [PATCH 003/144] generic/setup.sh: Unset locally defined variables

setup.sh adds a bunch of variables that only it needs. To avoid
polluting environments, we should unset these as soon as we are done
with them.
---
 pkgs/stdenv/generic/setup.sh | 35 ++++++++++++++++++++++-------------
 1 file changed, 22 insertions(+), 13 deletions(-)

diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 311292169ecd..95aef80fe7e8 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -280,6 +280,8 @@ for i in $initialPath; do
     fi
 done
 
+unset i
+
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
     echo "initial path: $PATH"
 fi
@@ -309,11 +311,11 @@ declare -a pkgsBuildBuild pkgsBuildHost pkgsBuildTarget
 declare -a pkgsHostHost pkgsHostTarget
 declare -a pkgsTargetTarget
 
-declare -ra pkgBuildAccumVars=(pkgsBuildBuild pkgsBuildHost pkgsBuildTarget)
-declare -ra pkgHostAccumVars=(pkgsHostHost pkgsHostTarget)
-declare -ra pkgTargetAccumVars=(pkgsTargetTarget)
+declare -a pkgBuildAccumVars=(pkgsBuildBuild pkgsBuildHost pkgsBuildTarget)
+declare -a pkgHostAccumVars=(pkgsHostHost pkgsHostTarget)
+declare -a pkgTargetAccumVars=(pkgsTargetTarget)
 
-declare -ra pkgAccumVarVars=(pkgBuildAccumVars pkgHostAccumVars pkgTargetAccumVars)
+declare -a pkgAccumVarVars=(pkgBuildAccumVars pkgHostAccumVars pkgTargetAccumVars)
 
 
 # Hooks
@@ -322,11 +324,11 @@ declare -a envBuildBuildHooks envBuildHostHooks envBuildTargetHooks
 declare -a envHostHostHooks envHostTargetHooks
 declare -a envTargetTargetHooks
 
-declare -ra pkgBuildHookVars=(envBuildBuildHook envBuildHostHook envBuildTargetHook)
-declare -ra pkgHostHookVars=(envHostHostHook envHostTargetHook)
-declare -ra pkgTargetHookVars=(envTargetTargetHook)
+declare -a pkgBuildHookVars=(envBuildBuildHook envBuildHostHook envBuildTargetHook)
+declare -a pkgHostHookVars=(envHostHostHook envHostTargetHook)
+declare -a pkgTargetHookVars=(envTargetTargetHook)
 
-declare -ra pkgHookVarVars=(pkgBuildHookVars pkgHostHookVars pkgTargetHookVars)
+declare -a pkgHookVarVars=(pkgBuildHookVars pkgHostHookVars pkgTargetHookVars)
 
 # Add env hooks for all sorts of deps with the specified host offset.
 addEnvHooks() {
@@ -342,26 +344,26 @@ addEnvHooks() {
 
 # Propagated dep files
 
-declare -ra propagatedBuildDepFiles=(
+declare -a propagatedBuildDepFiles=(
     propagated-build-build-deps
     propagated-native-build-inputs # Legacy name for back-compat
     propagated-build-target-deps
 )
-declare -ra propagatedHostDepFiles=(
+declare -a propagatedHostDepFiles=(
     propagated-host-host-deps
     propagated-build-inputs # Legacy name for back-compat
 )
-declare -ra propagatedTargetDepFiles=(
+declare -a propagatedTargetDepFiles=(
     propagated-target-target-deps
 )
-declare -ra propagatedDepFilesVars=(
+declare -a propagatedDepFilesVars=(
     propagatedBuildDepFiles
     propagatedHostDepFiles
     propagatedTargetDepFiles
 )
 
 # Platform offsets: build = -1, host = 0, target = 1
-declare -ra allPlatOffsets=(-1 0 1)
+declare -a allPlatOffsets=(-1 0 1)
 
 
 # Mutually-recursively find all build inputs. See the dependency section of the
@@ -605,6 +607,13 @@ _addToEnv() {
 _addToEnv
 
 
+# Unset setup-specific declared variables
+unset allPlatOffsets
+unset pkgBuildAccumVars pkgHostAccumVars pkgTargetAccumVars pkgAccumVarVars
+unset pkgBuildHookVars pkgHostHookVars pkgTargetHookVars pkgHookVarVars
+unset propagatedBuildDepFiles propagatedHostDepFiles propagatedTargetDepFiles propagatedDepFilesVars
+
+
 _addRpathPrefix "$out"
 
 

From e494de20b3bde5d670a11f7f6d0e6c5beb2ee590 Mon Sep 17 00:00:00 2001
From: Nicolas Mattia <nicolas@nmattia.com>
Date: Wed, 2 Oct 2019 13:28:04 +0200
Subject: [PATCH 004/144] libcxxapi: don't produce shared libs on musl

---
 pkgs/development/compilers/llvm/7/libc++abi.nix | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/compilers/llvm/7/libc++abi.nix b/pkgs/development/compilers/llvm/7/libc++abi.nix
index 522c8d1a163b..9067bf43a8fa 100644
--- a/pkgs/development/compilers/llvm/7/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/7/libc++abi.nix
@@ -1,4 +1,6 @@
-{ stdenv, cmake, fetch, libcxx, llvm, version }:
+{ stdenv, cmake, fetch, libcxx, llvm, version
+  # on musl the shared objects don't build
+, enableShared ? ! stdenv.hostPlatform.isMusl }:
 
 stdenv.mkDerivation {
   pname = "libc++abi";
@@ -11,13 +13,15 @@ stdenv.mkDerivation {
   postUnpack = ''
     unpackFile ${libcxx.src}
     unpackFile ${llvm.src}
-    export cmakeFlags="-DLLVM_PATH=$PWD/$(ls -d llvm-*) -DLIBCXXABI_LIBCXX_PATH=$PWD/$(ls -d libcxx-*)"
+    cmakeFlagsArray=($cmakeFlagsArray -DLLVM_PATH=$PWD/$(ls -d llvm-*) -DLIBCXXABI_LIBCXX_PATH=$PWD/$(ls -d libcxx-*) )
   '' + stdenv.lib.optionalString stdenv.isDarwin ''
     export TRIPLE=x86_64-apple-darwin
   '' + stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -d $(ls -d libcxx-*) -i ${../libcxx-0001-musl-hacks.patch}
   '';
 
+  cmakeFlags = stdenv.lib.optional (!enableShared) "-DLIBCXXABI_ENABLE_SHARED=OFF";
+
   installPhase = if stdenv.isDarwin
     then ''
       for file in lib/*.dylib; do
@@ -34,10 +38,10 @@ stdenv.mkDerivation {
     else ''
       install -d -m 755 $out/include $out/lib
       install -m 644 lib/libc++abi.a $out/lib
-      install -m 644 lib/libc++abi.so.1.0 $out/lib
+      ${stdenv.lib.optionalString enableShared "install -m 644 lib/libc++abi.so.1.0 $out/lib"}
       install -m 644 ../include/cxxabi.h $out/include
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1
+      ${stdenv.lib.optionalString enableShared "ln -s libc++abi.so.1.0 $out/lib/libc++abi.so"}
+      ${stdenv.lib.optionalString enableShared "ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1"}
     '';
 
   meta = {

From fadd37ba4688e024fbe57f08b0209a42dd6fba3e Mon Sep 17 00:00:00 2001
From: Nicolas Mattia <nicolas@nmattia.com>
Date: Wed, 2 Oct 2019 13:28:21 +0200
Subject: [PATCH 005/144] libcxx: don't produce shared libs on musl

---
 pkgs/development/compilers/llvm/7/libc++/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/llvm/7/libc++/default.nix b/pkgs/development/compilers/llvm/7/libc++/default.nix
index 7a0716a6eb38..f6f9970d7a6e 100644
--- a/pkgs/development/compilers/llvm/7/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/7/libc++/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv, fetch, cmake, python, libcxxabi, fixDarwinDylibNames, version }:
+{ lib, stdenv, fetch, cmake, python, libcxxabi, fixDarwinDylibNames, version
+, enableShared ? ! stdenv.hostPlatform.isMusl }:
 
 stdenv.mkDerivation {
   pname = "libc++";
@@ -31,7 +32,8 @@ stdenv.mkDerivation {
     "-DLIBCXX_LIBCXXABI_LIB_PATH=${libcxxabi}/lib"
     "-DLIBCXX_LIBCPPABI_VERSION=2"
     "-DLIBCXX_CXX_ABI=libcxxabi"
-  ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl "-DLIBCXX_HAS_MUSL_LIBC=1";
+  ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl "-DLIBCXX_HAS_MUSL_LIBC=1"
+  ++ stdenv.lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF" ;
 
   enableParallelBuilding = true;
 

From 4d33b41d3d1a6ab5107ff60edd16d5ea0bab1e56 Mon Sep 17 00:00:00 2001
From: Thorsten Weber <cpt.chaos83@googlemail.com>
Date: Sat, 19 Oct 2019 21:15:58 +0200
Subject: [PATCH 006/144] unzip: CVE-2019-13232

---
 pkgs/tools/archivers/unzip/default.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/pkgs/tools/archivers/unzip/default.nix b/pkgs/tools/archivers/unzip/default.nix
index cdf189e82df5..7bbcc906292d 100644
--- a/pkgs/tools/archivers/unzip/default.nix
+++ b/pkgs/tools/archivers/unzip/default.nix
@@ -26,6 +26,21 @@ stdenv.mkDerivation {
     ./CVE-2016-9844.patch
     ./CVE-2018-18384.patch
     ./dont-hardcode-cc.patch
+    (fetchurl {
+      url = "https://github.com/madler/unzip/commit/41beb477c5744bc396fa1162ee0c14218ec12213.patch";
+      name = "CVE-2019-13232-1.patch";
+      sha256 = "04jzd6chg9fw4l5zadkfsrfm5llrd7vhd1dgdjjd29nrvkrjyn14";
+    })
+    (fetchurl {
+      url = "https://github.com/madler/unzip/commit/47b3ceae397d21bf822bc2ac73052a4b1daf8e1c.patch";
+      name = "CVE-2019-13232-2.patch";
+      sha256 = "0iy2wcjyvzwrjk02iszwcpg85fkjxs1bvb9isvdiywszav4yjs32";
+    })
+    (fetchurl {
+      url = "https://github.com/madler/unzip/commit/6d351831be705cc26d897db44f878a978f4138fc.patch";
+      name = "CVE-2019-13232-3.patch";
+      sha256 = "1jvs7dkdqs97qnsqc6hk088alhv8j4c638k65dbib9chh40jd7pf";
+    })
   ] ++ stdenv.lib.optional enableNLS
     (fetchurl {
       url = "http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/app-arch/unzip/files/unzip-6.0-natspec.patch?revision=1.1";

From 1d1cbbc3e6265b12c83bbfb8c8dcfb16310db9be Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Tue, 22 Oct 2019 20:04:04 -0700
Subject: [PATCH 007/144] libsForQt5.phonon: 4.10.3 -> 4.11.1

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/phonon-qt5/versions
---
 pkgs/development/libraries/phonon/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/phonon/default.nix b/pkgs/development/libraries/phonon/default.nix
index dc32c4ebfb05..dd163571a1bd 100644
--- a/pkgs/development/libraries/phonon/default.nix
+++ b/pkgs/development/libraries/phonon/default.nix
@@ -6,7 +6,7 @@
 with lib;
 
 let
-  v = "4.10.3";
+  v = "4.11.1";
 
   soname = if withQt5 then "phonon4qt5" else "phonon";
   buildsystemdir = "share/cmake/${soname}";
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://kde/stable/phonon/${v}/phonon-${v}.tar.xz";
-    sha256 = "15f2vndpqfcivifzl1s07r0wkavpfrjln1p46cwfk85gd5b192rf";
+    sha256 = "0bfy8iqmjhlg3ma3iqd3kxjc2zkzpjgashbpf5x17y0dc2i1whxl";
   };
 
   buildInputs =

From 640677c30d977dfaaebea4b4c303b39ea0a8cd52 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Tue, 29 Oct 2019 12:42:35 -0500
Subject: [PATCH 008/144] sudo: 1.8.28 -> 1.8.29

https://www.sudo.ws/stable.html#1.8.29

Build tweak: fix build failure when attempting to check that
the "existing" sudoers file on $out/etc/sudoers parses clean--
this update changed precondition for this test to check if
DESTDIR is non-empty instead of previous behavior
"does the file exist".
---
 pkgs/tools/security/sudo/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index c3e464da5169..a0922f4df738 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -5,14 +5,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "sudo-1.8.28";
+  name = "sudo-1.8.29";
 
   src = fetchurl {
     urls =
       [ "ftp://ftp.sudo.ws/pub/sudo/${name}.tar.gz"
         "ftp://ftp.sudo.ws/pub/sudo/OLD/${name}.tar.gz"
       ];
-    sha256 = "188k3w67aflbmi4b5z23pxrvzfcfndi22b84w86gzjh8b9sglaci";
+    sha256 = "0z4wyadh9cks17gdpfgx4kvbrlnyb6nai2sd6chk7qh4jsngylyf";
   };
 
   prePatch = ''
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
       #define _PATH_MV "${coreutils}/bin/mv"
     EOF
     makeFlags="install_uid=$(id -u) install_gid=$(id -g)"
-    installFlags="sudoers_uid=$(id -u) sudoers_gid=$(id -g) sysconfdir=$out/etc rundir=$TMPDIR/dummy vardir=$TMPDIR/dummy"
+    installFlags="sudoers_uid=$(id -u) sudoers_gid=$(id -g) sysconfdir=$out/etc rundir=$TMPDIR/dummy vardir=$TMPDIR/dummy DESTDIR=/"
     '';
 
   nativeBuildInputs = [ groff ];

From 43a98868ae1c202e6151e05e25f5d038c17cbd4e Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 29 Oct 2019 19:42:31 -0400
Subject: [PATCH 009/144] common setup hooks: set -u robustness

Explicitly handle `dont*` and friends not being defined.
---
 pkgs/build-support/setup-hooks/audit-tmpdir.sh        | 2 +-
 pkgs/build-support/setup-hooks/compress-man-pages.sh  | 2 +-
 pkgs/build-support/setup-hooks/move-lib64.sh          | 2 +-
 pkgs/build-support/setup-hooks/move-sbin.sh           | 2 +-
 pkgs/build-support/setup-hooks/multiple-outputs.sh    | 6 +++---
 pkgs/build-support/setup-hooks/prune-libtool-files.sh | 2 +-
 pkgs/build-support/setup-hooks/strip.sh               | 4 ++--
 7 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/audit-tmpdir.sh b/pkgs/build-support/setup-hooks/audit-tmpdir.sh
index 5264ce398511..c9dd32d1dd22 100644
--- a/pkgs/build-support/setup-hooks/audit-tmpdir.sh
+++ b/pkgs/build-support/setup-hooks/audit-tmpdir.sh
@@ -7,7 +7,7 @@
 # the moment that would produce too many spurious errors (e.g. debug
 # info or assertion messages that refer to $TMPDIR).
 
-fixupOutputHooks+=('if [ -z "$noAuditTmpdir" -a -e "$prefix" ]; then auditTmpdir "$prefix"; fi')
+fixupOutputHooks+=('if [[ -z "${noAuditTmpdir-}" && -e "$prefix" ]]; then auditTmpdir "$prefix"; fi')
 
 auditTmpdir() {
     local dir="$1"
diff --git a/pkgs/build-support/setup-hooks/compress-man-pages.sh b/pkgs/build-support/setup-hooks/compress-man-pages.sh
index d10a898d6e46..82e48cd8aa77 100644
--- a/pkgs/build-support/setup-hooks/compress-man-pages.sh
+++ b/pkgs/build-support/setup-hooks/compress-man-pages.sh
@@ -1,4 +1,4 @@
-fixupOutputHooks+=('if [ -z "$dontGzipMan" ]; then compressManPages "$prefix"; fi')
+fixupOutputHooks+=('if [ -z "${dontGzipMan-}" ]; then compressManPages "$prefix"; fi')
 
 compressManPages() {
     local dir="$1"
diff --git a/pkgs/build-support/setup-hooks/move-lib64.sh b/pkgs/build-support/setup-hooks/move-lib64.sh
index 7724be369c9c..9517af797323 100644
--- a/pkgs/build-support/setup-hooks/move-lib64.sh
+++ b/pkgs/build-support/setup-hooks/move-lib64.sh
@@ -8,7 +8,7 @@
 fixupOutputHooks+=(_moveLib64)
 
 _moveLib64() {
-    if [ "$dontMoveLib64" = 1 ]; then return; fi
+    if [ "${dontMoveLib64-}" = 1 ]; then return; fi
     if [ ! -e "$prefix/lib64" -o -L "$prefix/lib64" ]; then return; fi
     echo "moving $prefix/lib64/* to $prefix/lib"
     mkdir -p $prefix/lib
diff --git a/pkgs/build-support/setup-hooks/move-sbin.sh b/pkgs/build-support/setup-hooks/move-sbin.sh
index cc51c27cafdf..1c0c4dc9f2d9 100644
--- a/pkgs/build-support/setup-hooks/move-sbin.sh
+++ b/pkgs/build-support/setup-hooks/move-sbin.sh
@@ -5,7 +5,7 @@
 fixupOutputHooks+=(_moveSbin)
 
 _moveSbin() {
-    if [ "$dontMoveSbin" = 1 ]; then return; fi
+    if [ "${dontMoveSbin-}" = 1 ]; then return; fi
     if [ ! -e "$prefix/sbin" -o -L "$prefix/sbin" ]; then return; fi
     echo "moving $prefix/sbin/* to $prefix/bin"
     mkdir -p $prefix/bin
diff --git a/pkgs/build-support/setup-hooks/multiple-outputs.sh b/pkgs/build-support/setup-hooks/multiple-outputs.sh
index d43b18776742..32d4e065875b 100644
--- a/pkgs/build-support/setup-hooks/multiple-outputs.sh
+++ b/pkgs/build-support/setup-hooks/multiple-outputs.sh
@@ -9,8 +9,8 @@ _assignFirst() {
     local varName="$1"
     local REMOVE=REMOVE # slightly hacky - we allow REMOVE (i.e. not a variable name)
     shift
-    while [ $# -ge 1 ]; do
-        if [ -n "${!1}" ]; then eval "${varName}"="$1"; return; fi
+	while (( $# )); do
+        if [ -n "${!1-}" ]; then eval "${varName}"="$1"; return; fi
         shift
     done
     echo "Error: _assignFirst found no valid variant!"
@@ -19,7 +19,7 @@ _assignFirst() {
 
 # Same as _assignFirst, but only if "$1" = ""
 _overrideFirst() {
-    if [ -z "${!1}" ]; then
+    if [ -z "${!1-}" ]; then
         _assignFirst "$@"
     fi
 }
diff --git a/pkgs/build-support/setup-hooks/prune-libtool-files.sh b/pkgs/build-support/setup-hooks/prune-libtool-files.sh
index 5d7432e8f09a..0ec56549645c 100644
--- a/pkgs/build-support/setup-hooks/prune-libtool-files.sh
+++ b/pkgs/build-support/setup-hooks/prune-libtool-files.sh
@@ -8,7 +8,7 @@
 fixupOutputHooks+=(_pruneLibtoolFiles)
 
 _pruneLibtoolFiles() {
-    if [ "$dontPruneLibtoolFiles" ] || [ ! -e "$prefix" ]; then
+    if [ "${dontPruneLibtoolFiles-}" ] || [ ! -e "$prefix" ]; then
        return
     fi
 
diff --git a/pkgs/build-support/setup-hooks/strip.sh b/pkgs/build-support/setup-hooks/strip.sh
index fc4c7bfbaf95..f5fa9378fd7e 100644
--- a/pkgs/build-support/setup-hooks/strip.sh
+++ b/pkgs/build-support/setup-hooks/strip.sh
@@ -10,7 +10,7 @@ _doStrip() {
     local -ra stripCmds=(STRIP TARGET_STRIP)
 
     # Optimization
-    if [[ "$STRIP" == "$TARGET_STRIP" ]]; then
+    if [[ "${STRIP-}" == "${TARGET_STRIP-}" ]]; then
         dontStripTarget+=1
     fi
 
@@ -20,7 +20,7 @@ _doStrip() {
         local -n stripCmd="${stripCmds[$i]}"
 
         # `dontStrip` disables them all
-        if [[ "$dontStrip" || "$flag" ]] || ! type -f "$stripCmd" 2>/dev/null
+        if [[ "${dontStrip-}" || "${flag-}" ]] || ! type -f "${stripCmd-}" 2>/dev/null
         then continue; fi
 
         stripDebugList=${stripDebugList:-lib lib32 lib64 libexec bin sbin}

From 545e7518a808081261a6331c19ec9c5cffea4a81 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 29 Oct 2019 19:44:44 -0400
Subject: [PATCH 010/144] bintools-wrapper: Don't stop `set -u`-ing

Same justification as previous commit.
---
 pkgs/build-support/bintools-wrapper/default.nix | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index e02e77de45e4..9f5395b635e0 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -111,17 +111,13 @@ stdenv.mkDerivation {
 
   installPhase =
     ''
-      set -u
-
       mkdir -p $out/bin $out/nix-support
 
       wrap() {
         local dst="$1"
         local wrapper="$2"
         export prog="$3"
-        set +u
         substituteAll "$wrapper" "$out/bin/$dst"
-        set -u
         chmod +x "$out/bin/$dst"
       }
     ''
@@ -163,8 +159,6 @@ stdenv.mkDerivation {
         [[ -e "$underlying" ]] || continue
         wrap ${targetPrefix}$variant ${./ld-wrapper.sh} $underlying
       done
-
-      set +u
     '';
 
   emulation = let
@@ -307,7 +301,6 @@ stdenv.mkDerivation {
     ''
 
     + ''
-      set +u
       substituteAll ${./add-flags.sh} $out/nix-support/add-flags.sh
       substituteAll ${./add-hardening.sh} $out/nix-support/add-hardening.sh
       substituteAll ${../wrapper-common/utils.bash} $out/nix-support/utils.bash

From d21a66064209083a2f14957792028c864cc8b8cf Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 29 Oct 2019 19:58:57 -0400
Subject: [PATCH 011/144] gettext, libiconv: `dontAddExtraLibs` can be
 legitimately undefined

---
 pkgs/development/libraries/gettext/gettext-setup-hook.sh | 2 +-
 pkgs/development/libraries/libiconv/setup-hook.sh        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gettext/gettext-setup-hook.sh b/pkgs/development/libraries/gettext/gettext-setup-hook.sh
index ad3763c29b64..69020146f84d 100644
--- a/pkgs/development/libraries/gettext/gettext-setup-hook.sh
+++ b/pkgs/development/libraries/gettext/gettext-setup-hook.sh
@@ -10,7 +10,7 @@ addEnvHooks "$hostOffset" gettextDataDirsHook
 
 # libintl must be listed in load flags on non-Glibc
 # it doesn't hurt to have it in Glibc either though
-if [ -n "@gettextNeedsLdflags@" -a -z "$dontAddExtraLibs" ]; then
+if [ -n "@gettextNeedsLdflags@" -a -z "${dontAddExtraLibs-}" ]; then
     # See pkgs/build-support/setup-hooks/role.bash
     getHostRole
     export NIX_${role_pre}LDFLAGS+=" -lintl"
diff --git a/pkgs/development/libraries/libiconv/setup-hook.sh b/pkgs/development/libraries/libiconv/setup-hook.sh
index f89361a62998..120cf06c61b5 100644
--- a/pkgs/development/libraries/libiconv/setup-hook.sh
+++ b/pkgs/development/libraries/libiconv/setup-hook.sh
@@ -2,7 +2,7 @@
 # it doesn't hurt to have it in Glibc either though
 
 # See pkgs/build-support/setup-hooks/role.bash
-if [ -z "$dontAddExtraLibs" ]; then
+if [ -z "${dontAddExtraLibs-}" ]; then
     getHostRole
     export NIX_${role_pre}LDFLAGS+=" -liconv"
 fi

From 3835442cf0973f435b6f543977fe40b7a2b9c51c Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 30 Oct 2019 14:40:07 +0000
Subject: [PATCH 012/144] patchelf: `dontPatchELF` in setup hook is allowed to
 be undefined

---
 pkgs/development/tools/misc/patchelf/setup-hook.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/misc/patchelf/setup-hook.sh b/pkgs/development/tools/misc/patchelf/setup-hook.sh
index bc1cddd4879c..576b9ca2103e 100644
--- a/pkgs/development/tools/misc/patchelf/setup-hook.sh
+++ b/pkgs/development/tools/misc/patchelf/setup-hook.sh
@@ -2,7 +2,7 @@
 # directories from the RPATH of every library or executable in every
 # output.
 
-fixupOutputHooks+=('if [ -z "$dontPatchELF" ]; then patchELF "$prefix"; fi')
+fixupOutputHooks+=('if [ -z "${dontPatchELF-}" ]; then patchELF "$prefix"; fi')
 
 patchELF() {
     local dir="$1"

From 1290e532eac8f8a1815c0aedee94796509e04e3d Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 30 Oct 2019 15:16:20 +0000
Subject: [PATCH 013/144] treewide: Make more `dont*` variables OK to be
 undefined in setup hooks

---
 .../libraries/qt-5/hooks/qtbase-setup-hook.sh          |  2 +-
 .../tools/build-managers/cmake/setup-hook.sh           | 10 +++++-----
 pkgs/development/tools/build-managers/gn/setup-hook.sh |  2 +-
 .../tools/build-managers/meson/setup-hook.sh           |  4 ++--
 .../tools/build-managers/ninja/setup-hook.sh           |  6 +++---
 .../tools/build-managers/scons/setup-hook.sh           |  2 +-
 pkgs/servers/x11/xorg/imake-setup-hook.sh              |  2 +-
 7 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh b/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh
index 436c2e1d032a..836e154148be 100644
--- a/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh
@@ -61,6 +61,6 @@ postPatchMkspecs() {
         fixQtBuiltinPaths "$dev/mkspecs" '*.pr?'
     fi
 }
-if [ -z "$dontPatchMkspecs" ]; then
+if [ -z "${dontPatchMkspecs-}" ]; then
     postPhases="${postPhases}${postPhases:+ }postPatchMkspecs"
 fi
diff --git a/pkgs/development/tools/build-managers/cmake/setup-hook.sh b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
index b8716c5251eb..dbd40bf71242 100755
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
@@ -20,17 +20,17 @@ cmakeConfigurePhase() {
         export CTEST_PARALLEL_LEVEL=$NIX_BUILD_CORES
     fi
 
-    if [ -z "$dontFixCmake" ]; then
+    if [ -z "${dontFixCmake-}" ]; then
         fixCmakeFiles .
     fi
 
-    if [ -z "$dontUseCmakeBuildDir" ]; then
+    if [ -z "${dontUseCmakeBuildDir-}" ]; then
         mkdir -p build
         cd build
         cmakeDir=${cmakeDir:-..}
     fi
 
-    if [ -z "$dontAddPrefix" ]; then
+    if [ -z "${dontAddPrefix-}" ]; then
         cmakeFlags="-DCMAKE_INSTALL_PREFIX=$prefix $cmakeFlags"
     fi
 
@@ -84,7 +84,7 @@ cmakeConfigurePhase() {
     cmakeFlags="-DCMAKE_INSTALL_LOCALEDIR=${!outputLib}/share/locale $cmakeFlags"
 
     # Don’t build tests when doCheck = false
-    if [ -z "$doCheck" ]; then
+    if [ -z "${doCheck-}" ]; then
         cmakeFlags="-DBUILD_TESTING=OFF $cmakeFlags"
     fi
 
@@ -115,7 +115,7 @@ cmakeConfigurePhase() {
     runHook postConfigure
 }
 
-if [ -z "$dontUseCmakeConfigure" -a -z "$configurePhase" ]; then
+if [ -z "${dontUseCmakeConfigure-}" -a -z "$configurePhase" ]; then
     setOutputFlags=
     configurePhase=cmakeConfigurePhase
 fi
diff --git a/pkgs/development/tools/build-managers/gn/setup-hook.sh b/pkgs/development/tools/build-managers/gn/setup-hook.sh
index 75d2edcaf1c6..4f772d2369ba 100644
--- a/pkgs/development/tools/build-managers/gn/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/gn/setup-hook.sh
@@ -9,6 +9,6 @@ gnConfigurePhase() {
     runHook postConfigure
 }
 
-if [ -z "$dontUseGnConfigure" -a -z "$configurePhase" ]; then
+if [ -z "${dontUseGnConfigure-}" -a -z "$configurePhase" ]; then
     configurePhase=gnConfigurePhase
 fi
diff --git a/pkgs/development/tools/build-managers/meson/setup-hook.sh b/pkgs/development/tools/build-managers/meson/setup-hook.sh
index 6e8d94523e14..bfb40303cd85 100644
--- a/pkgs/development/tools/build-managers/meson/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/meson/setup-hook.sh
@@ -1,7 +1,7 @@
 mesonConfigurePhase() {
     runHook preConfigure
 
-    if [ -z "$dontAddPrefix" ]; then
+    if [ -z "${dontAddPrefix-}" ]; then
         mesonFlags="--prefix=$prefix $mesonFlags"
     fi
 
@@ -36,7 +36,7 @@ mesonConfigurePhase() {
     runHook postConfigure
 }
 
-if [ -z "$dontUseMesonConfigure" -a -z "$configurePhase" ]; then
+if [ -z "${dontUseMesonConfigure-}" -a -z "$configurePhase" ]; then
     setOutputFlags=
     configurePhase=mesonConfigurePhase
 fi
diff --git a/pkgs/development/tools/build-managers/ninja/setup-hook.sh b/pkgs/development/tools/build-managers/ninja/setup-hook.sh
index e3c67bd139dd..76de25aaabf1 100644
--- a/pkgs/development/tools/build-managers/ninja/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/ninja/setup-hook.sh
@@ -19,7 +19,7 @@ ninjaBuildPhase() {
     runHook postBuild
 }
 
-if [ -z "$dontUseNinjaBuild" -a -z "$buildPhase" ]; then
+if [ -z "${dontUseNinjaBuild-}" -a -z "$buildPhase" ]; then
     buildPhase=ninjaBuildPhase
 fi
 
@@ -38,7 +38,7 @@ ninjaInstallPhase() {
     runHook postInstall
 }
 
-if [ -z "$dontUseNinjaInstall" -a -z "$installPhase" ]; then
+if [ -z "${dontUseNinjaInstall-}" -a -z "$installPhase" ]; then
     installPhase=ninjaInstallPhase
 fi
 
@@ -73,6 +73,6 @@ ninjaCheckPhase() {
     runHook postCheck
 }
 
-if [ -z "$dontUseNinjaCheck" -a -z "$checkPhase" ]; then
+if [ -z "${dontUseNinjaCheck-}" -a -z "$checkPhase" ]; then
     checkPhase=ninjaCheckPhase
 fi
diff --git a/pkgs/development/tools/build-managers/scons/setup-hook.sh b/pkgs/development/tools/build-managers/scons/setup-hook.sh
index 55159aa5a93a..428852ac574a 100644
--- a/pkgs/development/tools/build-managers/scons/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/scons/setup-hook.sh
@@ -75,7 +75,7 @@ if [ -z "$buildPhase" ]; then
     buildPhase=sconsBuildPhase
 fi
 
-if [ -z "$dontUseSconsInstall" -a -z "$installPhase" ]; then
+if [ -z "${dontUseSconsInstall-}" -a -z "$installPhase" ]; then
     installPhase=sconsInstallPhase
 fi
 
diff --git a/pkgs/servers/x11/xorg/imake-setup-hook.sh b/pkgs/servers/x11/xorg/imake-setup-hook.sh
index 10f54198f7fb..e743093af0ec 100644
--- a/pkgs/servers/x11/xorg/imake-setup-hook.sh
+++ b/pkgs/servers/x11/xorg/imake-setup-hook.sh
@@ -14,6 +14,6 @@ imakeConfigurePhase() {
     runHook postConfigure
 }
 
-if [ -z "$dontUseImakeConfigure" -a -z "$configurePhase" ]; then
+if [ -z "${dontUseImakeConfigure-}" -a -z "$configurePhase" ]; then
     configurePhase=imakeConfigurePhase
 fi

From 2811b032d639684d3983282e9d10d89f37d161d5 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 31 Oct 2019 16:50:15 +0000
Subject: [PATCH 014/144] treewide: Make still dont* Variables are optional in
 most cases

Go beyond the obvious setup hooks now, with a bit of sed, with a skipped case:

 - cc-wrapper's `dontlink`, because it already is handled.

Also, in nix files escaping was manually added.

EMP
---
 pkgs/build-support/build-dotnet-package/default.nix       | 8 ++++----
 pkgs/build-support/setup-hooks/auto-patchelf.sh           | 2 +-
 pkgs/build-support/setup-hooks/patch-shebangs.sh          | 2 +-
 .../setup-hooks/update-autotools-gnu-config-scripts.sh    | 2 +-
 pkgs/build-support/setup-hooks/wrap-gapps-hook.sh         | 2 +-
 .../interpreters/python/hooks/flit-build-hook.sh          | 2 +-
 .../interpreters/python/hooks/pip-build-hook.sh           | 2 +-
 .../interpreters/python/hooks/pip-install-hook.sh         | 2 +-
 .../interpreters/python/hooks/pytest-check-hook.sh        | 2 +-
 .../python/hooks/python-catch-conflicts-hook.sh           | 2 +-
 .../python/hooks/python-imports-check-hook.sh             | 2 +-
 .../python/hooks/python-remove-bin-bytecode-hook.sh       | 2 +-
 .../interpreters/python/hooks/setuptools-build-hook.sh    | 4 ++--
 .../interpreters/python/hooks/setuptools-check-hook.sh    | 2 +-
 .../interpreters/python/hooks/wheel-unpack-hook.sh        | 2 +-
 pkgs/development/libraries/qt-5/hooks/qmake-hook.sh       | 2 +-
 .../development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh | 4 ++--
 pkgs/development/node-packages/node-env.nix               | 2 +-
 pkgs/development/python-modules/pythonnet/default.nix     | 4 ++--
 pkgs/development/ruby-modules/gem/default.nix             | 2 +-
 pkgs/development/tools/ocaml/opam/opam-shebangs.patch     | 2 +-
 pkgs/os-specific/linux/kernel/manual-config.nix           | 2 +-
 pkgs/stdenv/cygwin/rebase-i686.sh                         | 2 +-
 pkgs/stdenv/cygwin/rebase-x86_64.sh                       | 2 +-
 24 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/pkgs/build-support/build-dotnet-package/default.nix b/pkgs/build-support/build-dotnet-package/default.nix
index f36c69e43392..dae9ed888c75 100644
--- a/pkgs/build-support/build-dotnet-package/default.nix
+++ b/pkgs/build-support/build-dotnet-package/default.nix
@@ -29,9 +29,9 @@ attrsOrig @
       configurePhase = ''
         runHook preConfigure
 
-        [ -z "$dontPlacateNuget" ] && placate-nuget.sh
-        [ -z "$dontPlacatePaket" ] && placate-paket.sh
-        [ -z "$dontPatchFSharpTargets" ] && patch-fsharp-targets.sh
+        [ -z "''${dontPlacateNuget-}" ] && placate-nuget.sh
+        [ -z "''${dontPlacatePaket-}" ] && placate-paket.sh
+        [ -z "''${dontPatchFSharpTargets-}" ] && patch-fsharp-targets.sh
 
         runHook postConfigure
       '';
@@ -69,7 +69,7 @@ attrsOrig @
 
         cp -rv ${arrayToShell outputFiles} "''${outputFilesArray[@]}" "$target"
 
-        if [ -z "$dontRemoveDuplicatedDlls" ]
+        if [ -z "''${dontRemoveDuplicatedDlls-}" ]
         then
           pushd "$out"
           remove-duplicated-dlls.sh
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.sh b/pkgs/build-support/setup-hooks/auto-patchelf.sh
index 6af8eb1aed99..52c50091d08c 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.sh
@@ -228,7 +228,7 @@ autoPatchelf() {
 # behaviour as fixupOutputHooks because the setup hook for patchelf is run in
 # fixupOutput and the postFixup hook runs later.
 postFixupHooks+=('
-    if [ -z "$dontAutoPatchelf" ]; then
+    if [ -z "${dontAutoPatchelf-}" ]; then
         autoPatchelf -- $(for output in $outputs; do
             [ -e "${!output}" ] || continue
             echo "${!output}"
diff --git a/pkgs/build-support/setup-hooks/patch-shebangs.sh b/pkgs/build-support/setup-hooks/patch-shebangs.sh
index 3e900d0704cf..29fed7ad7940 100644
--- a/pkgs/build-support/setup-hooks/patch-shebangs.sh
+++ b/pkgs/build-support/setup-hooks/patch-shebangs.sh
@@ -105,7 +105,7 @@ patchShebangs() {
 }
 
 patchShebangsAuto () {
-    if [ -z "$dontPatchShebangs" -a -e "$prefix" ]; then
+    if [ -z "${dontPatchShebangs-}" -a -e "$prefix" ]; then
 
         # Dev output will end up being run on the build platform. An
         # example case of this is sdl2-config. Otherwise, we can just
diff --git a/pkgs/build-support/setup-hooks/update-autotools-gnu-config-scripts.sh b/pkgs/build-support/setup-hooks/update-autotools-gnu-config-scripts.sh
index 66f4e91c7bb6..ebd3afa05d94 100644
--- a/pkgs/build-support/setup-hooks/update-autotools-gnu-config-scripts.sh
+++ b/pkgs/build-support/setup-hooks/update-autotools-gnu-config-scripts.sh
@@ -1,7 +1,7 @@
 preConfigurePhases+=" updateAutotoolsGnuConfigScriptsPhase"
 
 updateAutotoolsGnuConfigScriptsPhase() {
-    if [ -n "$dontUpdateAutotoolsGnuConfigScripts" ]; then return; fi
+    if [ -n "${dontUpdateAutotoolsGnuConfigScripts-}" ]; then return; fi
 
     for script in config.sub config.guess; do
         for f in $(find . -type f -name "$script"); do
diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh b/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh
index 717740f1f20f..a05d4f689db9 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh
@@ -15,7 +15,7 @@ wrapGApp() {
     wrapProgram "$program" "${gappsWrapperArgs[@]}" "$@"
 }
 
-# Note: $gappsWrapperArgs still gets defined even if $dontWrapGApps is set.
+# Note: $gappsWrapperArgs still gets defined even if ${dontWrapGApps-} is set.
 wrapGAppsHook() {
   # guard against running multiple times (e.g. due to propagation)
   [ -z "$wrapGAppsHookHasRun" ] || return 0
diff --git a/pkgs/development/interpreters/python/hooks/flit-build-hook.sh b/pkgs/development/interpreters/python/hooks/flit-build-hook.sh
index 48295dc36430..23198bd711b8 100644
--- a/pkgs/development/interpreters/python/hooks/flit-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/flit-build-hook.sh
@@ -9,7 +9,7 @@ flitBuildPhase () {
     echo "Finished executing flitBuildPhase"
 }
 
-if [ -z "$dontUseFlitBuild" ] && [ -z "$buildPhase" ]; then
+if [ -z "${dontUseFlitBuild-}" ] && [ -z "$buildPhase" ]; then
     echo "Using flitBuildPhase"
     buildPhase=flitBuildPhase
 fi
diff --git a/pkgs/development/interpreters/python/hooks/pip-build-hook.sh b/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
index c297bfffb1e2..ac025165410a 100644
--- a/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
@@ -31,7 +31,7 @@ pipShellHook() {
     echo "Finished executing pipShellHook"
 }
 
-if [ -z "$dontUsePipBuild" ] && [ -z "$buildPhase" ]; then
+if [ -z "${dontUsePipBuild-}" ] && [ -z "$buildPhase" ]; then
     echo "Using pipBuildPhase"
     buildPhase=pipBuildPhase
 fi
diff --git a/pkgs/development/interpreters/python/hooks/pip-install-hook.sh b/pkgs/development/interpreters/python/hooks/pip-install-hook.sh
index f528ec63cb8e..ca5aa2f983b2 100644
--- a/pkgs/development/interpreters/python/hooks/pip-install-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pip-install-hook.sh
@@ -18,7 +18,7 @@ pipInstallPhase() {
     echo "Finished executing pipInstallPhase"
 }
 
-if [ -z "$dontUsePipInstall" ] && [ -z "$installPhase" ]; then
+if [ -z "${dontUsePipInstall-}" ] && [ -z "$installPhase" ]; then
     echo "Using pipInstallPhase"
     installPhase=pipInstallPhase
 fi
diff --git a/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh b/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
index 24510b9f9931..9065b69fc09c 100644
--- a/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
@@ -43,7 +43,7 @@ function pytestCheckPhase() {
     echo "Finished executing pytestCheckPhase"
 }
 
-if [ -z "$dontUsePytestCheck" ] && [ -z "$installCheckPhase" ]; then
+if [ -z "${dontUsePytestCheck-}" ] && [ -z "$installCheckPhase" ]; then
     echo "Using pytestCheckPhase"
     preDistPhases+=" pytestCheckPhase"
 fi
diff --git a/pkgs/development/interpreters/python/hooks/python-catch-conflicts-hook.sh b/pkgs/development/interpreters/python/hooks/python-catch-conflicts-hook.sh
index e9065cf17934..374a2eddb407 100644
--- a/pkgs/development/interpreters/python/hooks/python-catch-conflicts-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-catch-conflicts-hook.sh
@@ -5,6 +5,6 @@ pythonCatchConflictsPhase() {
     @pythonInterpreter@ @catchConflicts@
 }
 
-if [ -z "$dontUsePythonCatchConflicts" ]; then
+if [ -z "${dontUsePythonCatchConflicts-}" ]; then
     preDistPhases+=" pythonCatchConflictsPhase"
 fi
diff --git a/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh b/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
index 7e2b3f69d6dd..0fc55145a8eb 100644
--- a/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
@@ -10,7 +10,7 @@ pythonImportsCheckPhase () {
     fi
 }
 
-if [ -z "$dontUsePythonImportsCheck" ]; then
+if [ -z "${dontUsePythonImportsCheck-}" ]; then
     echo "Using pythonImportsCheckPhase"
     preDistPhases+=" pythonImportsCheckPhase"
 fi
diff --git a/pkgs/development/interpreters/python/hooks/python-remove-bin-bytecode-hook.sh b/pkgs/development/interpreters/python/hooks/python-remove-bin-bytecode-hook.sh
index 960de767be79..2add23f23165 100644
--- a/pkgs/development/interpreters/python/hooks/python-remove-bin-bytecode-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-remove-bin-bytecode-hook.sh
@@ -12,6 +12,6 @@ pythonRemoveBinBytecodePhase () {
     fi
 }
 
-if [ -z "$dontUsePythonRemoveBinBytecode" ]; then
+if [ -z "${dontUsePythonRemoveBinBytecode-}" ]; then
     preDistPhases+=" pythonRemoveBinBytecodePhase"
 fi
diff --git a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
index c99ef313c102..648f19efb363 100644
--- a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
@@ -36,12 +36,12 @@ setuptoolsShellHook() {
     echo "Finished executing setuptoolsShellHook"
 }
 
-if [ -z "$dontUseSetuptoolsBuild" ] && [ -z "$buildPhase" ]; then
+if [ -z "${dontUseSetuptoolsBuild-}" ] && [ -z "$buildPhase" ]; then
     echo "Using setuptoolsBuildPhase"
     buildPhase=setuptoolsBuildPhase
 fi
 
-if [ -z "$dontUseSetuptoolsShellHook" ] && [ -z "$shellHook" ]; then
+if [ -z "${dontUseSetuptoolsShellHook-}" ] && [ -z "$shellHook" ]; then
     echo "Using setuptoolsShellHook"
     shellHook=setuptoolsShellHook
 fi
diff --git a/pkgs/development/interpreters/python/hooks/setuptools-check-hook.sh b/pkgs/development/interpreters/python/hooks/setuptools-check-hook.sh
index 71bb036a91ad..5b07155ff4d6 100644
--- a/pkgs/development/interpreters/python/hooks/setuptools-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/setuptools-check-hook.sh
@@ -12,7 +12,7 @@ setuptoolsCheckPhase() {
     echo "Finished executing setuptoolsCheckPhase"
 }
 
-if [ -z "$dontUseSetuptoolsCheck" ] && [ -z "$installCheckPhase" ]; then
+if [ -z "${dontUseSetuptoolsCheck-}" ] && [ -z "$installCheckPhase" ]; then
     echo "Using setuptoolsCheckPhase"
     preDistPhases+=" setuptoolsCheckPhase"
 fi
diff --git a/pkgs/development/interpreters/python/hooks/wheel-unpack-hook.sh b/pkgs/development/interpreters/python/hooks/wheel-unpack-hook.sh
index 6dd0c5be4cb2..81efdb0d4110 100644
--- a/pkgs/development/interpreters/python/hooks/wheel-unpack-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/wheel-unpack-hook.sh
@@ -12,7 +12,7 @@ wheelUnpackPhase(){
     echo "Finished executing wheelUnpackPhase"
 }
 
-if [ -z "$dontUseWheelUnpack" ] && [ -z "$unpackPhase" ]; then
+if [ -z "${dontUseWheelUnpack-}" ] && [ -z "$unpackPhase" ]; then
     echo "Using wheelUnpackPhase"
     unpackPhase=wheelUnpackPhase
 fi
diff --git a/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh b/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
index c3373983e325..fc4a0be62826 100644
--- a/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
@@ -31,6 +31,6 @@ qmakeConfigurePhase() {
     runHook postConfigure
 }
 
-if [ -z "$dontUseQmakeConfigure" -a -z "$configurePhase" ]; then
+if [ -z "${dontUseQmakeConfigure-}" -a -z "$configurePhase" ]; then
     configurePhase=qmakeConfigurePhase
 fi
diff --git a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
index d2aadbd956a8..d9e5880289dc 100644
--- a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
@@ -64,10 +64,10 @@ qtOwnPathsHook() {
 
 preFixupPhases+=" qtOwnPathsHook"
 
-# Note: $qtWrapperArgs still gets defined even if $dontWrapQtApps is set.
+# Note: $qtWrapperArgs still gets defined even if ${dontWrapQtApps-} is set.
 wrapQtAppsHook() {
     # skip this hook when requested
-    [ -z "$dontWrapQtApps" ] || return 0
+    [ -z "${dontWrapQtApps-}" ] || return 0
 
     # guard against running multiple times (e.g. due to propagation)
     [ -z "$wrapQtAppsHookHasRun" ] || return 0
diff --git a/pkgs/development/node-packages/node-env.nix b/pkgs/development/node-packages/node-env.nix
index 670556bf271a..7cc212c41bd6 100644
--- a/pkgs/development/node-packages/node-env.nix
+++ b/pkgs/development/node-packages/node-env.nix
@@ -363,7 +363,7 @@ let
 
         npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${stdenv.lib.optionalString production "--production"} rebuild
 
-        if [ "$dontNpmInstall" != "1" ]
+        if [ "''${dontNpmInstall-}" != "1" ]
         then
             # NPM tries to download packages even when they already exist if npm-shrinkwrap is used.
             rm -f npm-shrinkwrap.json
diff --git a/pkgs/development/python-modules/pythonnet/default.nix b/pkgs/development/python-modules/pythonnet/default.nix
index 9bcbaf3e6f72..f916ec63b30b 100644
--- a/pkgs/development/python-modules/pythonnet/default.nix
+++ b/pkgs/development/python-modules/pythonnet/default.nix
@@ -43,8 +43,8 @@ buildPythonPackage rec {
   '';
 
   preConfigure = ''
-    [ -z "$dontPlacateNuget" ] && placate-nuget.sh
-    [ -z "$dontPlacatePaket" ] && placate-paket.sh
+    [ -z "''${dontPlacateNuget-}" ] && placate-nuget.sh
+    [ -z "''${dontPlacatePaket-}" ] && placate-paket.sh
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ruby-modules/gem/default.nix b/pkgs/development/ruby-modules/gem/default.nix
index 7b92a586b54c..af38160a5fa2 100644
--- a/pkgs/development/ruby-modules/gem/default.nix
+++ b/pkgs/development/ruby-modules/gem/default.nix
@@ -99,7 +99,7 @@ stdenv.mkDerivation ((builtins.removeAttrs attrs ["source"]) // {
     runHook preUnpack
 
     if [[ -f $src && $src == *.gem ]]; then
-      if [[ -z "$dontBuild" ]]; then
+      if [[ -z "''${dontBuild-}" ]]; then
         # we won't know the name of the directory that RubyGems creates,
         # so we'll just use a glob to find it and move it over.
         gempkg="$src"
diff --git a/pkgs/development/tools/ocaml/opam/opam-shebangs.patch b/pkgs/development/tools/ocaml/opam/opam-shebangs.patch
index f74ac84ca6b2..13aa7a895708 100644
--- a/pkgs/development/tools/ocaml/opam/opam-shebangs.patch
+++ b/pkgs/development/tools/ocaml/opam/opam-shebangs.patch
@@ -64,7 +64,7 @@ index 00000000..3ea84e2d
 +header() { echo "$1"; }
 +stopNest() { true; }
 +
-+fixupOutputHooks+=('if [ -z "$dontPatchShebangs" -a -e "$prefix" ]; then patchShebangs "$prefix"; fi')
++fixupOutputHooks+=('if [ -z "${dontPatchShebangs-}" -a -e "$prefix" ]; then patchShebangs "$prefix"; fi')
 +
 +patchShebangs() {
 +    local dir="$1"
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 87fa9c8f08e2..d206910732c2 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -179,7 +179,7 @@ let
       '' else "") + (if isModular then ''
         mkdir -p $dev
         cp vmlinux $dev/
-        if [ -z "$dontStrip" ]; then
+        if [ -z "''${dontStrip-}" ]; then
           installFlagsArray+=("INSTALL_MOD_STRIP=1")
         fi
         make modules_install $makeFlags "''${makeFlagsArray[@]}" \
diff --git a/pkgs/stdenv/cygwin/rebase-i686.sh b/pkgs/stdenv/cygwin/rebase-i686.sh
index 091c9044d93f..6b8ec441ca7f 100644
--- a/pkgs/stdenv/cygwin/rebase-i686.sh
+++ b/pkgs/stdenv/cygwin/rebase-i686.sh
@@ -1,7 +1,7 @@
 fixupOutputHooks+=(_cygwinFixAutoImageBase)
 
 _cygwinFixAutoImageBase() {
-    if [ "$dontRebase" == 1 ] || [ ! -d "$prefix" ]; then
+    if [ "${dontRebase-}" == 1 ] || [ ! -d "$prefix" ]; then
         return
     fi
     find "$prefix" -name "*.dll" -type f | while read DLL; do
diff --git a/pkgs/stdenv/cygwin/rebase-x86_64.sh b/pkgs/stdenv/cygwin/rebase-x86_64.sh
index 4c8f8ebd7eb2..6dccdc40c722 100644
--- a/pkgs/stdenv/cygwin/rebase-x86_64.sh
+++ b/pkgs/stdenv/cygwin/rebase-x86_64.sh
@@ -1,7 +1,7 @@
 fixupOutputHooks+=(_cygwinFixAutoImageBase)
 
 _cygwinFixAutoImageBase() {
-    if [ "$dontRebase" == 1 ] || [ ! -d "$prefix" ]; then
+    if [ "${dontRebase-}" == 1 ] || [ ! -d "$prefix" ]; then
         return
     fi
     find "$prefix" -name "*.dll" -type f | while read DLL; do

From 7eecf4f8fb288dcc4a32595036421bfcc38699e6 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 31 Oct 2019 17:57:33 +0000
Subject: [PATCH 015/144] find-xml-catalogues: Ensure XML_CATALOG_FILES is
 defined

---
 pkgs/build-support/setup-hooks/find-xml-catalogs.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/find-xml-catalogs.sh b/pkgs/build-support/setup-hooks/find-xml-catalogs.sh
index 85364a61f612..f446a6f27fd9 100644
--- a/pkgs/build-support/setup-hooks/find-xml-catalogs.sh
+++ b/pkgs/build-support/setup-hooks/find-xml-catalogs.sh
@@ -11,12 +11,12 @@ addXMLCatalogs () {
     done
 }
 
-if [ -z "$libxmlHookDone" ]; then
+if [ -z "${libxmlHookDone-}" ]; then
     libxmlHookDone=1
 
     # Set up XML_CATALOG_FILES.  An empty initial value prevents
     # xmllint and xsltproc from looking in /etc/xml/catalog.
-    export XML_CATALOG_FILES
+    export XML_CATALOG_FILES=''
     if [ -z "$XML_CATALOG_FILES" ]; then XML_CATALOG_FILES=" "; fi
     addEnvHooks "$hostOffset" addXMLCatalogs
 fi

From b7f4bda2827e4adc76dd30d6fd5257ed4f49b21d Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 31 Oct 2019 17:59:18 +0000
Subject: [PATCH 016/144] treewide: `*Phase(s)?` variables are optional

If these aren't defined, the stdenv defaults are used in the `*Phase`
case, or no extra phases are done, in the `*Phases` case.
---
 .../interpreters/python/hooks/flit-build-hook.sh            | 2 +-
 .../development/interpreters/python/hooks/pip-build-hook.sh | 2 +-
 .../interpreters/python/hooks/pip-install-hook.sh           | 2 +-
 .../interpreters/python/hooks/pytest-check-hook.sh          | 2 +-
 .../interpreters/python/hooks/setuptools-build-hook.sh      | 4 ++--
 .../interpreters/python/hooks/setuptools-check-hook.sh      | 2 +-
 .../interpreters/python/hooks/wheel-unpack-hook.sh          | 2 +-
 .../libraries/gtk/hooks/drop-icon-theme-cache.sh            | 2 +-
 pkgs/development/libraries/qt-5/hooks/qmake-hook.sh         | 2 +-
 pkgs/development/tools/build-managers/cmake/setup-hook.sh   | 4 ++--
 pkgs/development/tools/build-managers/gn/setup-hook.sh      | 2 +-
 pkgs/development/tools/build-managers/meson/setup-hook.sh   | 2 +-
 pkgs/development/tools/build-managers/ninja/setup-hook.sh   | 6 +++---
 pkgs/development/tools/build-managers/scons/setup-hook.sh   | 6 +++---
 pkgs/development/tools/misc/premake/setup-hook.sh           | 2 +-
 pkgs/development/tools/xcbuild/setup-hook.sh                | 2 +-
 pkgs/servers/x11/xorg/imake-setup-hook.sh                   | 2 +-
 pkgs/tools/misc/desktop-file-utils/setup-hook.sh            | 2 +-
 18 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/pkgs/development/interpreters/python/hooks/flit-build-hook.sh b/pkgs/development/interpreters/python/hooks/flit-build-hook.sh
index 23198bd711b8..45893aae00f4 100644
--- a/pkgs/development/interpreters/python/hooks/flit-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/flit-build-hook.sh
@@ -9,7 +9,7 @@ flitBuildPhase () {
     echo "Finished executing flitBuildPhase"
 }
 
-if [ -z "${dontUseFlitBuild-}" ] && [ -z "$buildPhase" ]; then
+if [ -z "${dontUseFlitBuild-}" ] && [ -z "${buildPhase-}" ]; then
     echo "Using flitBuildPhase"
     buildPhase=flitBuildPhase
 fi
diff --git a/pkgs/development/interpreters/python/hooks/pip-build-hook.sh b/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
index ac025165410a..a58c01ce808c 100644
--- a/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
@@ -31,7 +31,7 @@ pipShellHook() {
     echo "Finished executing pipShellHook"
 }
 
-if [ -z "${dontUsePipBuild-}" ] && [ -z "$buildPhase" ]; then
+if [ -z "${dontUsePipBuild-}" ] && [ -z "${buildPhase-}" ]; then
     echo "Using pipBuildPhase"
     buildPhase=pipBuildPhase
 fi
diff --git a/pkgs/development/interpreters/python/hooks/pip-install-hook.sh b/pkgs/development/interpreters/python/hooks/pip-install-hook.sh
index ca5aa2f983b2..4eefe22d3f28 100644
--- a/pkgs/development/interpreters/python/hooks/pip-install-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pip-install-hook.sh
@@ -18,7 +18,7 @@ pipInstallPhase() {
     echo "Finished executing pipInstallPhase"
 }
 
-if [ -z "${dontUsePipInstall-}" ] && [ -z "$installPhase" ]; then
+if [ -z "${dontUsePipInstall-}" ] && [ -z "${installPhase-}" ]; then
     echo "Using pipInstallPhase"
     installPhase=pipInstallPhase
 fi
diff --git a/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh b/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
index 9065b69fc09c..18f05b6d218c 100644
--- a/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
@@ -43,7 +43,7 @@ function pytestCheckPhase() {
     echo "Finished executing pytestCheckPhase"
 }
 
-if [ -z "${dontUsePytestCheck-}" ] && [ -z "$installCheckPhase" ]; then
+if [ -z "${dontUsePytestCheck-}" ] && [ -z "${installCheckPhase-}" ]; then
     echo "Using pytestCheckPhase"
     preDistPhases+=" pytestCheckPhase"
 fi
diff --git a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
index 648f19efb363..ebda9e8b5230 100644
--- a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
@@ -36,12 +36,12 @@ setuptoolsShellHook() {
     echo "Finished executing setuptoolsShellHook"
 }
 
-if [ -z "${dontUseSetuptoolsBuild-}" ] && [ -z "$buildPhase" ]; then
+if [ -z "${dontUseSetuptoolsBuild-}" ] && [ -z "${buildPhase-}" ]; then
     echo "Using setuptoolsBuildPhase"
     buildPhase=setuptoolsBuildPhase
 fi
 
-if [ -z "${dontUseSetuptoolsShellHook-}" ] && [ -z "$shellHook" ]; then
+if [ -z "${dontUseSetuptoolsShellHook-}" ] && [ -z "${shellHook-}" ]; then
     echo "Using setuptoolsShellHook"
     shellHook=setuptoolsShellHook
 fi
diff --git a/pkgs/development/interpreters/python/hooks/setuptools-check-hook.sh b/pkgs/development/interpreters/python/hooks/setuptools-check-hook.sh
index 5b07155ff4d6..88b7b11931b0 100644
--- a/pkgs/development/interpreters/python/hooks/setuptools-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/setuptools-check-hook.sh
@@ -12,7 +12,7 @@ setuptoolsCheckPhase() {
     echo "Finished executing setuptoolsCheckPhase"
 }
 
-if [ -z "${dontUseSetuptoolsCheck-}" ] && [ -z "$installCheckPhase" ]; then
+if [ -z "${dontUseSetuptoolsCheck-}" ] && [ -z "${installCheckPhase-}" ]; then
     echo "Using setuptoolsCheckPhase"
     preDistPhases+=" setuptoolsCheckPhase"
 fi
diff --git a/pkgs/development/interpreters/python/hooks/wheel-unpack-hook.sh b/pkgs/development/interpreters/python/hooks/wheel-unpack-hook.sh
index 81efdb0d4110..fca808a933ba 100644
--- a/pkgs/development/interpreters/python/hooks/wheel-unpack-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/wheel-unpack-hook.sh
@@ -12,7 +12,7 @@ wheelUnpackPhase(){
     echo "Finished executing wheelUnpackPhase"
 }
 
-if [ -z "${dontUseWheelUnpack-}" ] && [ -z "$unpackPhase" ]; then
+if [ -z "${dontUseWheelUnpack-}" ] && [ -z "${unpackPhase-}" ]; then
     echo "Using wheelUnpackPhase"
     unpackPhase=wheelUnpackPhase
 fi
diff --git a/pkgs/development/libraries/gtk/hooks/drop-icon-theme-cache.sh b/pkgs/development/libraries/gtk/hooks/drop-icon-theme-cache.sh
index 8f2cb8a334ae..f28a856c4f50 100644
--- a/pkgs/development/libraries/gtk/hooks/drop-icon-theme-cache.sh
+++ b/pkgs/development/libraries/gtk/hooks/drop-icon-theme-cache.sh
@@ -16,4 +16,4 @@ dropIconThemeCache() {
     fi
 }
 
-preFixupPhases="$preFixupPhases dropIconThemeCache"
+preFixupPhases="${preFixupPhases-} dropIconThemeCache"
diff --git a/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh b/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
index fc4a0be62826..b785a779c8bc 100644
--- a/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
@@ -31,6 +31,6 @@ qmakeConfigurePhase() {
     runHook postConfigure
 }
 
-if [ -z "${dontUseQmakeConfigure-}" -a -z "$configurePhase" ]; then
+if [ -z "${dontUseQmakeConfigure-}" -a -z "${configurePhase-}" ]; then
     configurePhase=qmakeConfigurePhase
 fi
diff --git a/pkgs/development/tools/build-managers/cmake/setup-hook.sh b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
index dbd40bf71242..8bd54d3bc13d 100755
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
@@ -99,7 +99,7 @@ cmakeConfigurePhase() {
     cmakeFlags="-DCMAKE_FIND_PACKAGE_NO_PACKAGE_REGISTRY=ON $cmakeFlags"
     cmakeFlags="-DCMAKE_FIND_PACKAGE_NO_SYSTEM_PACKAGE_REGISTRY=ON $cmakeFlags"
 
-    if [ "$buildPhase" = ninjaBuildPhase ]; then
+    if [ "${buildPhase-}" = ninjaBuildPhase ]; then
         cmakeFlags="-GNinja $cmakeFlags"
     fi
 
@@ -115,7 +115,7 @@ cmakeConfigurePhase() {
     runHook postConfigure
 }
 
-if [ -z "${dontUseCmakeConfigure-}" -a -z "$configurePhase" ]; then
+if [ -z "${dontUseCmakeConfigure-}" -a -z "${configurePhase-}" ]; then
     setOutputFlags=
     configurePhase=cmakeConfigurePhase
 fi
diff --git a/pkgs/development/tools/build-managers/gn/setup-hook.sh b/pkgs/development/tools/build-managers/gn/setup-hook.sh
index 4f772d2369ba..850f18948cad 100644
--- a/pkgs/development/tools/build-managers/gn/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/gn/setup-hook.sh
@@ -9,6 +9,6 @@ gnConfigurePhase() {
     runHook postConfigure
 }
 
-if [ -z "${dontUseGnConfigure-}" -a -z "$configurePhase" ]; then
+if [ -z "${dontUseGnConfigure-}" -a -z "${configurePhase-}" ]; then
     configurePhase=gnConfigurePhase
 fi
diff --git a/pkgs/development/tools/build-managers/meson/setup-hook.sh b/pkgs/development/tools/build-managers/meson/setup-hook.sh
index bfb40303cd85..8d76ecdaf32b 100644
--- a/pkgs/development/tools/build-managers/meson/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/meson/setup-hook.sh
@@ -36,7 +36,7 @@ mesonConfigurePhase() {
     runHook postConfigure
 }
 
-if [ -z "${dontUseMesonConfigure-}" -a -z "$configurePhase" ]; then
+if [ -z "${dontUseMesonConfigure-}" -a -z "${configurePhase-}" ]; then
     setOutputFlags=
     configurePhase=mesonConfigurePhase
 fi
diff --git a/pkgs/development/tools/build-managers/ninja/setup-hook.sh b/pkgs/development/tools/build-managers/ninja/setup-hook.sh
index 76de25aaabf1..7d8087ad1342 100644
--- a/pkgs/development/tools/build-managers/ninja/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/ninja/setup-hook.sh
@@ -19,7 +19,7 @@ ninjaBuildPhase() {
     runHook postBuild
 }
 
-if [ -z "${dontUseNinjaBuild-}" -a -z "$buildPhase" ]; then
+if [ -z "${dontUseNinjaBuild-}" -a -z "${buildPhase-}" ]; then
     buildPhase=ninjaBuildPhase
 fi
 
@@ -38,7 +38,7 @@ ninjaInstallPhase() {
     runHook postInstall
 }
 
-if [ -z "${dontUseNinjaInstall-}" -a -z "$installPhase" ]; then
+if [ -z "${dontUseNinjaInstall-}" -a -z "${installPhase-}" ]; then
     installPhase=ninjaInstallPhase
 fi
 
@@ -73,6 +73,6 @@ ninjaCheckPhase() {
     runHook postCheck
 }
 
-if [ -z "${dontUseNinjaCheck-}" -a -z "$checkPhase" ]; then
+if [ -z "${dontUseNinjaCheck-}" -a -z "${checkPhase-}" ]; then
     checkPhase=ninjaCheckPhase
 fi
diff --git a/pkgs/development/tools/build-managers/scons/setup-hook.sh b/pkgs/development/tools/build-managers/scons/setup-hook.sh
index 428852ac574a..0b908f68286b 100644
--- a/pkgs/development/tools/build-managers/scons/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/scons/setup-hook.sh
@@ -71,14 +71,14 @@ sconsCheckPhase() {
     runHook postCheck
 }
 
-if [ -z "$buildPhase" ]; then
+if [ -z "${buildPhase-}" ]; then
     buildPhase=sconsBuildPhase
 fi
 
-if [ -z "${dontUseSconsInstall-}" -a -z "$installPhase" ]; then
+if [ -z "${dontUseSconsInstall-}" -a -z "${installPhase-}" ]; then
     installPhase=sconsInstallPhase
 fi
 
-if [ -z "$checkPhase" ]; then
+if [ -z "${checkPhase-}" ]; then
     checkPhase=sconsCheckPhase
 fi
diff --git a/pkgs/development/tools/misc/premake/setup-hook.sh b/pkgs/development/tools/misc/premake/setup-hook.sh
index ba06ea2c7617..6e65e9e8c73f 100644
--- a/pkgs/development/tools/misc/premake/setup-hook.sh
+++ b/pkgs/development/tools/misc/premake/setup-hook.sh
@@ -14,6 +14,6 @@ premakeConfigurePhase() {
     runHook postConfigure
 }
 
-if [ -z "$configurePhase" ]; then
+if [ -z "${configurePhase-}" ]; then
     configurePhase=premakeConfigurePhase
 fi
diff --git a/pkgs/development/tools/xcbuild/setup-hook.sh b/pkgs/development/tools/xcbuild/setup-hook.sh
index 9dc03a61f62e..f4b5abf2d8d3 100644
--- a/pkgs/development/tools/xcbuild/setup-hook.sh
+++ b/pkgs/development/tools/xcbuild/setup-hook.sh
@@ -20,7 +20,7 @@ xcbuildInstallPhase () {
 }
 
 buildPhase=xcbuildBuildPhase
-if [ -z "$installPhase" ]; then
+if [ -z "${installPhase-}" ]; then
     installPhase=xcbuildInstallPhase
 fi
 
diff --git a/pkgs/servers/x11/xorg/imake-setup-hook.sh b/pkgs/servers/x11/xorg/imake-setup-hook.sh
index e743093af0ec..351ffab34d0f 100644
--- a/pkgs/servers/x11/xorg/imake-setup-hook.sh
+++ b/pkgs/servers/x11/xorg/imake-setup-hook.sh
@@ -14,6 +14,6 @@ imakeConfigurePhase() {
     runHook postConfigure
 }
 
-if [ -z "${dontUseImakeConfigure-}" -a -z "$configurePhase" ]; then
+if [ -z "${dontUseImakeConfigure-}" -a -z "${configurePhase-}" ]; then
     configurePhase=imakeConfigurePhase
 fi
diff --git a/pkgs/tools/misc/desktop-file-utils/setup-hook.sh b/pkgs/tools/misc/desktop-file-utils/setup-hook.sh
index 004d635cff0e..728070e34581 100644
--- a/pkgs/tools/misc/desktop-file-utils/setup-hook.sh
+++ b/pkgs/tools/misc/desktop-file-utils/setup-hook.sh
@@ -3,4 +3,4 @@ mimeinfoPreFixupPhase() {
     rm -f $out/share/applications/mimeinfo.cache
 }
 
-preFixupPhases="$preFixupPhases mimeinfoPreFixupPhase"
+preFixupPhases="${preFixupPhases-} mimeinfoPreFixupPhase"

From 45e5e68c5352768b877c52e79536b4e95e3fb32e Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 1 Nov 2019 11:09:02 -0400
Subject: [PATCH 017/144] rust: Allow IN_NIX_SHELL to be undefined

---
 pkgs/development/compilers/rust/setup-hook.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/rust/setup-hook.sh b/pkgs/development/compilers/rust/setup-hook.sh
index 7078ec7060b9..5d4eb642fec0 100644
--- a/pkgs/development/compilers/rust/setup-hook.sh
+++ b/pkgs/development/compilers/rust/setup-hook.sh
@@ -1,4 +1,4 @@
 # Fix 'failed to open: /homeless-shelter/.cargo/.package-cache' in rust 1.36.
-if [[ -z $IN_NIX_SHELL && -z $CARGO_HOME ]]; then
+if [[ -z ${IN_NIX_SHELL-} && -z ${CARGO_HOME-} ]]; then
     export CARGO_HOME=$TMPDIR
 fi

From 373236ccfffe7053b1503a8992ddff7ebae3ed6f Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 1 Nov 2019 15:30:09 -0400
Subject: [PATCH 018/144] treewide: JAVA_HOME may not always be defined

---
 .../compilers/adoptopenjdk-bin/jdk-darwin-base.nix            | 2 +-
 .../development/compilers/adoptopenjdk-bin/jdk-linux-base.nix | 2 +-
 pkgs/development/compilers/graalvm/default.nix                | 2 +-
 pkgs/development/compilers/graalvm/enterprise-edition.nix     | 2 +-
 pkgs/development/compilers/openjdk/11.nix                     | 2 +-
 pkgs/development/compilers/openjdk/8.nix                      | 2 +-
 pkgs/development/compilers/openjdk/darwin/11.nix              | 2 +-
 pkgs/development/compilers/openjdk/darwin/8.nix               | 2 +-
 pkgs/development/compilers/openjdk/darwin/default.nix         | 2 +-
 pkgs/development/compilers/openjdk/default.nix                | 2 +-
 pkgs/development/compilers/oraclejdk/jdk-linux-base.nix       | 2 +-
 pkgs/development/compilers/zulu/8.nix                         | 2 +-
 pkgs/development/compilers/zulu/default.nix                   | 2 +-
 pkgs/development/tools/build-managers/apache-ant/1.9.nix      | 4 ++--
 pkgs/development/tools/build-managers/apache-ant/default.nix  | 4 ++--
 15 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/pkgs/development/compilers/adoptopenjdk-bin/jdk-darwin-base.nix b/pkgs/development/compilers/adoptopenjdk-bin/jdk-darwin-base.nix
index 03857627952d..3b9cb752b9b8 100644
--- a/pkgs/development/compilers/adoptopenjdk-bin/jdk-darwin-base.nix
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk-darwin-base.nix
@@ -37,7 +37,7 @@ let cpuName = stdenv.hostPlatform.parsed.cpu.name;
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> $out/nix-support/setup-hook
-    if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+    if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
   '';
 
diff --git a/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix b/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
index 509050209fb2..fe38f2b21633 100644
--- a/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
@@ -54,7 +54,7 @@ let result = stdenv.mkDerivation rec {
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> "$out/nix-support/setup-hook"
-    if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+    if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
   '';
 
diff --git a/pkgs/development/compilers/graalvm/default.nix b/pkgs/development/compilers/graalvm/default.nix
index 61e3b6c16aee..5108ce185449 100644
--- a/pkgs/development/compilers/graalvm/default.nix
+++ b/pkgs/development/compilers/graalvm/default.nix
@@ -270,7 +270,7 @@ in rec {
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support
       cat <<EOF > $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
       EOF
     '';
     postFixup = openjdk.postFixup or null;
diff --git a/pkgs/development/compilers/graalvm/enterprise-edition.nix b/pkgs/development/compilers/graalvm/enterprise-edition.nix
index 84cb38aa8d11..e180455cb7cd 100644
--- a/pkgs/development/compilers/graalvm/enterprise-edition.nix
+++ b/pkgs/development/compilers/graalvm/enterprise-edition.nix
@@ -72,7 +72,7 @@ let
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support
       cat <<EOF > $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
       EOF
     '';
 
diff --git a/pkgs/development/compilers/openjdk/11.nix b/pkgs/development/compilers/openjdk/11.nix
index 57911f2d58e6..e365b9b28b35 100644
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@@ -106,7 +106,7 @@ let
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support
       cat <<EOF > $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out/lib/openjdk; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out/lib/openjdk; fi
       EOF
     '';
 
diff --git a/pkgs/development/compilers/openjdk/8.nix b/pkgs/development/compilers/openjdk/8.nix
index 1a5848cd1a68..ff3d03321e21 100644
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@@ -231,7 +231,7 @@ let
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support
       cat <<EOF > $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out/lib/openjdk; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out/lib/openjdk; fi
       EOF
     '';
 
diff --git a/pkgs/development/compilers/openjdk/darwin/11.nix b/pkgs/development/compilers/openjdk/darwin/11.nix
index 4c808302b4fa..0b659b95aa8b 100644
--- a/pkgs/development/compilers/openjdk/darwin/11.nix
+++ b/pkgs/development/compilers/openjdk/darwin/11.nix
@@ -44,7 +44,7 @@ let
 
       # Set JAVA_HOME automatically.
       cat <<EOF >> $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
       EOF
     '';
 
diff --git a/pkgs/development/compilers/openjdk/darwin/8.nix b/pkgs/development/compilers/openjdk/darwin/8.nix
index 045901b1bae6..f804046b83dd 100644
--- a/pkgs/development/compilers/openjdk/darwin/8.nix
+++ b/pkgs/development/compilers/openjdk/darwin/8.nix
@@ -44,7 +44,7 @@ let
 
       # Set JAVA_HOME automatically.
       cat <<EOF >> $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
       EOF
     '';
 
diff --git a/pkgs/development/compilers/openjdk/darwin/default.nix b/pkgs/development/compilers/openjdk/darwin/default.nix
index 58e4ba990149..c954a8e2cf85 100644
--- a/pkgs/development/compilers/openjdk/darwin/default.nix
+++ b/pkgs/development/compilers/openjdk/darwin/default.nix
@@ -44,7 +44,7 @@ let
 
       # Set JAVA_HOME automatically.
       cat <<EOF >> $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
       EOF
     '';
 
diff --git a/pkgs/development/compilers/openjdk/default.nix b/pkgs/development/compilers/openjdk/default.nix
index 094bd57e6e98..03121daf961f 100644
--- a/pkgs/development/compilers/openjdk/default.nix
+++ b/pkgs/development/compilers/openjdk/default.nix
@@ -114,7 +114,7 @@ let
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support
       cat <<EOF > $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out/lib/openjdk; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out/lib/openjdk; fi
       EOF
     '';
 
diff --git a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
index e80d81dc5a00..2f1e827a26a5 100644
--- a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
+++ b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
@@ -156,7 +156,7 @@ let result = stdenv.mkDerivation rec {
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> $out/nix-support/setup-hook
-    if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+    if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
   '';
 
diff --git a/pkgs/development/compilers/zulu/8.nix b/pkgs/development/compilers/zulu/8.nix
index d4caabc6cb83..d05ec1a682aa 100644
--- a/pkgs/development/compilers/zulu/8.nix
+++ b/pkgs/development/compilers/zulu/8.nix
@@ -58,7 +58,7 @@ in stdenv.mkDerivation {
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> $out/nix-support/setup-hook
-    if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+    if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
   '';
 
diff --git a/pkgs/development/compilers/zulu/default.nix b/pkgs/development/compilers/zulu/default.nix
index 5f345c87355f..5fe2473bac6d 100644
--- a/pkgs/development/compilers/zulu/default.nix
+++ b/pkgs/development/compilers/zulu/default.nix
@@ -55,7 +55,7 @@ in stdenv.mkDerivation {
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> $out/nix-support/setup-hook
-    if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+    if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
   '';
 
diff --git a/pkgs/development/tools/build-managers/apache-ant/1.9.nix b/pkgs/development/tools/build-managers/apache-ant/1.9.nix
index 0a86aaeb6ca0..661e16d83e82 100644
--- a/pkgs/development/tools/build-managers/apache-ant/1.9.nix
+++ b/pkgs/development/tools/build-managers/apache-ant/1.9.nix
@@ -46,14 +46,14 @@ stdenv.mkDerivation {
       # JRE by looking for java.  The latter allows just the JRE to be
       # used with (say) ECJ as the compiler.  Finally, allow the GNU
       # JVM.
-      if [ -z "\$JAVA_HOME" ]; then
+      if [ -z "\''${JAVA_HOME-}" ]; then
           for i in javac java gij; do
               if p="\$(type -p \$i)"; then
                   export JAVA_HOME="\$(${coreutils}/bin/dirname \$(${coreutils}/bin/dirname \$(${coreutils}/bin/readlink -f \$p)))"
                   break
               fi
           done
-          if [ -z "\$JAVA_HOME" ]; then
+          if [ -z "\''${JAVA_HOME-}" ]; then
               echo "\$0: cannot find the JDK or JRE" >&2
               exit 1
           fi
diff --git a/pkgs/development/tools/build-managers/apache-ant/default.nix b/pkgs/development/tools/build-managers/apache-ant/default.nix
index 8d1e09eeb338..28e86e291755 100644
--- a/pkgs/development/tools/build-managers/apache-ant/default.nix
+++ b/pkgs/development/tools/build-managers/apache-ant/default.nix
@@ -46,14 +46,14 @@ stdenv.mkDerivation {
       # JRE by looking for java.  The latter allows just the JRE to be
       # used with (say) ECJ as the compiler.  Finally, allow the GNU
       # JVM.
-      if [ -z "\$JAVA_HOME" ]; then
+      if [ -z "\''${JAVA_HOME-}" ]; then
           for i in javac java gij; do
               if p="\$(type -p \$i)"; then
                   export JAVA_HOME="\$(${coreutils}/bin/dirname \$(${coreutils}/bin/dirname \$(${coreutils}/bin/readlink -f \$p)))"
                   break
               fi
           done
-          if [ -z "\$JAVA_HOME" ]; then
+          if [ -z "\''${JAVA_HOME-}" ]; then
               echo "\$0: cannot find the JDK or JRE" >&2
               exit 1
           fi

From 9df7efe0c6bf936240d2cc83b57331c1c565ad01 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 29 Oct 2019 19:43:34 -0400
Subject: [PATCH 019/144] stdenv: Don't stop `set -u`-ing

Before, we very carefully unapplied and reapplied `set -u` so the rest
of Nixpkgs could continue to not fail on undefined variables. Let's rip
off the band-aid.
---
 nixos/doc/manual/release-notes/rl-2003.xml |  7 ++++
 pkgs/stdenv/generic/setup.sh               | 45 ++--------------------
 2 files changed, 10 insertions(+), 42 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2003.xml b/nixos/doc/manual/release-notes/rl-2003.xml
index f001a18b1c1f..3e6a5d6d6fa5 100644
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@@ -125,6 +125,13 @@
       <link linkend="opt-networking.interfaces">networking.interfaces.&lt;name&gt;.…</link> options.
     </para>
    </listitem>
+   <listitem>
+    <para>
+      The stdenv now runs all bash with <literal>set -u</literal>, to catch the use of undefined variables.
+      Before, it itself used <literal>set -u</literal> but was careful to unset it so other packages' code ran as before.
+      Now, all bash code is held to the same high standard, and the rather complex stateful manipulation of the options can be discarded.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 0962a1ec2fc0..c381f6e106ec 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -17,10 +17,6 @@ fi
 # code). The hooks for <hookName> are the shell function or variable
 # <hookName>, and the values of the shell array ‘<hookName>Hooks’.
 runHook() {
-    local oldOpts="-u"
-    shopt -qo nounset || oldOpts="+u"
-    set -u # May be called from elsewhere, so do `set -u`.
-
     local hookName="$1"
     shift
     local hooksSlice="${hookName%Hook}Hooks[@]"
@@ -30,10 +26,8 @@ runHook() {
     # undefined.
     for hook in "_callImplicitHook 0 $hookName" ${!hooksSlice+"${!hooksSlice}"}; do
         _eval "$hook" "$@"
-        set -u # To balance `_eval`
     done
 
-    set "$oldOpts"
     return 0
 }
 
@@ -41,10 +35,6 @@ runHook() {
 # Run all hooks with the specified name, until one succeeds (returns a
 # zero exit code). If none succeed, return a non-zero exit code.
 runOneHook() {
-    local oldOpts="-u"
-    shopt -qo nounset || oldOpts="+u"
-    set -u # May be called from elsewhere, so do `set -u`.
-
     local hookName="$1"
     shift
     local hooksSlice="${hookName%Hook}Hooks[@]"
@@ -56,10 +46,8 @@ runOneHook() {
             ret=0
             break
         fi
-        set -u # To balance `_eval`
     done
 
-    set "$oldOpts"
     return "$ret"
 }
 
@@ -70,17 +58,13 @@ runOneHook() {
 # environment variables) and from shell scripts (as functions). If you
 # want to allow multiple hooks, use runHook instead.
 _callImplicitHook() {
-    set -u
     local def="$1"
     local hookName="$2"
     if declare -F "$hookName" > /dev/null; then
-        set +u
         "$hookName"
     elif type -p "$hookName" > /dev/null; then
-        set +u
         source "$hookName"
     elif [ -n "${!hookName:-}" ]; then
-        set +u
         eval "${!hookName}"
     else
         return "$def"
@@ -96,13 +80,10 @@ _callImplicitHook() {
 # command can take them
 _eval() {
     if declare -F "$1" > /dev/null 2>&1; then
-        set +u
         "$@" # including args
     else
-        set +u
         eval "$1"
     fi
-    # `run*Hook` reenables `set -u`
 }
 
 
@@ -190,12 +171,12 @@ addToSearchPath() {
 # so it is defined here but tried after the hook.
 _addRpathPrefix() {
     if [ "${NIX_NO_SELF_RPATH:-0}" != 1 ]; then
-        export NIX_LDFLAGS="-rpath $1/lib $NIX_LDFLAGS"
+        export NIX_LDFLAGS="-rpath $1/lib ${NIX_LDFLAGS-}"
         if [ -n "${NIX_LIB64_IN_SELF_RPATH:-}" ]; then
-            export NIX_LDFLAGS="-rpath $1/lib64 $NIX_LDFLAGS"
+            export NIX_LDFLAGS="-rpath $1/lib64 ${NIX_LDFLAGS-}"
         fi
         if [ -n "${NIX_LIB32_IN_SELF_RPATH:-}" ]; then
-            export NIX_LDFLAGS="-rpath $1/lib32 $NIX_LDFLAGS"
+            export NIX_LDFLAGS="-rpath $1/lib32 ${NIX_LDFLAGS-}"
         fi
     fi
 }
@@ -489,11 +470,7 @@ activatePackage() {
     (( "$hostOffset" <= "$targetOffset" )) || exit -1
 
     if [ -f "$pkg" ]; then
-        local oldOpts="-u"
-        shopt -qo nounset || oldOpts="+u"
-        set +u
         source "$pkg"
-        set "$oldOpts"
     fi
 
     # Only dependencies whose host platform is guaranteed to match the
@@ -512,11 +489,7 @@ activatePackage() {
     fi
 
     if [[ -f "$pkg/nix-support/setup-hook" ]]; then
-        local oldOpts="-u"
-        shopt -qo nounset || oldOpts="+u"
-        set +u
         source "$pkg/nix-support/setup-hook"
-        set "$oldOpts"
     fi
 }
 
@@ -1264,19 +1237,11 @@ showPhaseHeader() {
 
 genericBuild() {
     if [ -f "${buildCommandPath:-}" ]; then
-        local oldOpts="-u"
-        shopt -qo nounset || oldOpts="+u"
-        set +u
         source "$buildCommandPath"
-        set "$oldOpts"
         return
     fi
     if [ -n "${buildCommand:-}" ]; then
-        local oldOpts="-u"
-        shopt -qo nounset || oldOpts="+u"
-        set +u
         eval "$buildCommand"
-        set "$oldOpts"
         return
     fi
 
@@ -1306,11 +1271,7 @@ genericBuild() {
 
         # Evaluate the variable named $curPhase if it exists, otherwise the
         # function named $curPhase.
-        local oldOpts="-u"
-        shopt -qo nounset || oldOpts="+u"
-        set +u
         eval "${!curPhase:-$curPhase}"
-        set "$oldOpts"
 
         if [ "$curPhase" = unpackPhase ]; then
             cd "${sourceRoot:-.}"

From d254966a78d4fdd0423ef60357212c8de7a66348 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 2 Nov 2019 06:15:23 -0700
Subject: [PATCH 020/144] mpg123: 1.25.12 -> 1.25.13

---
 pkgs/applications/audio/mpg123/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index 0d5445650a0a..6c4b9a431768 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "mpg123-1.25.12";
+  name = "mpg123-1.25.13";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/${name}.tar.bz2";
-    sha256 = "1l9iwwgqzw6yg5zk9pqmlbfyq6d8dqysbmj0j3m8dyrxd34wgzhz";
+    sha256 = "02l915jq0ymndb082g6w89bpf66z04ifa1lr7ga3yycw6m46hc4h";
   };
 
   buildInputs = stdenv.lib.optional (!stdenv.isDarwin) alsaLib;

From d1270ac85b811c476ae3bff22a60b11b1788b7db Mon Sep 17 00:00:00 2001
From: wucke13 <wucke13@gmail.com>
Date: Mon, 21 Oct 2019 01:37:16 +0200
Subject: [PATCH 021/144] gnugp: adding option for minimal build

Basically a flavour of gnugpg, which solely containts `bin/gnupg`.
---
 pkgs/tools/security/gnupg/22.nix | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index f62f10c8cf9d..e54a1e1c5db9 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -1,17 +1,17 @@
 { fetchurl, fetchpatch, stdenv, pkgconfig, libgcrypt, libassuan, libksba
-, libgpgerror, libiconv, npth, gettext, texinfo, pcsclite, sqlite
-, buildPackages
+, libgpgerror, libiconv, npth, gettext, texinfo, buildPackages
 
 # Each of the dependencies below are optional.
 # Gnupg can be built without them at the cost of reduced functionality.
-, pinentry ? null, guiSupport ? false
-, adns ? null, gnutls ? null, libusb ? null, openldap ? null
-, readline ? null, zlib ? null, bzip2 ? null
+, guiSupport ? true, enableMinimal ? false
+, adns ? null , bzip2 ? null , gnutls ? null , libusb ? null , openldap ? null
+, pcsclite ? null , pinentry ? null , readline ? null , sqlite ? null , zlib ?
+null
 }:
 
 with stdenv.lib;
 
-assert guiSupport -> pinentry != null;
+assert guiSupport -> pinentry != null && enableMinimal == false;
 
 stdenv.mkDerivation rec {
   pname = "gnupg";
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     sed -i 's,hkps://hkps.pool.sks-keyservers.net,hkps://keys.openpgp.org,g' \
         configure doc/dirmngr.texi doc/gnupg.info-1
-  '' + stdenv.lib.optionalString stdenv.isLinux ''
+  '' + stdenv.lib.optionalString ( stdenv.isLinux && pcsclite != null) ''
     sed -i 's,"libpcsclite\.so[^"]*","${stdenv.lib.getLib pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c
   ''; #" fix Emacs syntax highlighting :-(
 
@@ -50,7 +50,14 @@ stdenv.mkDerivation rec {
     "--with-npth-prefix=${npth}"
   ] ++ optional guiSupport "--with-pinentry-pgm=${pinentry}/${pinentryBinaryPath}";
 
-  postInstall = ''
+  postInstall = if enableMinimal
+  then ''
+    rm -r $out/{libexec,sbin,share}
+    for f in `find $out/bin -type f -not -name gpg`
+    do
+      rm $f
+    done
+  '' else ''
     mkdir -p $out/lib/systemd/user
     for f in doc/examples/systemd-user/*.{service,socket} ; do
       substitute $f $out/lib/systemd/user/$(basename $f) \

From 29ac2262253cb2d1d330ed261353b98d3e03c706 Mon Sep 17 00:00:00 2001
From: wucke13 <wucke13@gmail.com>
Date: Thu, 3 Oct 2019 22:24:15 +0200
Subject: [PATCH 022/144] systemd: adding support for systemd-importd

Adding `systemd-importd` to the build, so that `machinectl`s `import-.*`
may actually do anything. Currently they fail with

```
Failed to transfer image: The name org.freedesktop.import1 was not provided by any .service files
```
as `systemd-importd` is not built. Also registers the regarding dbus
api and service in the systemd module.
---
 nixos/modules/system/boot/systemd.nix      |  2 ++
 pkgs/os-specific/linux/systemd/default.nix | 33 ++++++++++++++++++----
 2 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 33b350902a1a..9e3c6149f922 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -63,6 +63,7 @@ let
       "systemd-logind.service"
       "autovt@.service"
       "systemd-user-sessions.service"
+      "dbus-org.freedesktop.import1.service"
       "dbus-org.freedesktop.machine1.service"
       "user@.service"
       "user-runtime-dir@.service"
@@ -145,6 +146,7 @@ let
       "user.slice"
       "machine.slice"
       "machines.target"
+      "systemd-importd.service"
       "systemd-machined.service"
       "systemd-nspawn@.service"
 
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index a9fc0c6f4b54..d14985d07edf 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap, kmod
-, xz, pam, acl, libuuid, m4, utillinux, libffi
+{ stdenv, lib, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap
+, curl, kmod, gnupg, gnutar, xz, pam, acl, libuuid, m4, utillinux, libffi
 , glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libidn2, libapparmor
 , audit, lz4, bzip2, libmicrohttpd, pcre2
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
@@ -15,7 +15,21 @@
 , withKexectools ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) kexectools.meta.platforms, kexectools
 }:
 
-stdenv.mkDerivation {
+let gnupg-minimal = gnupg.override {
+  enableMinimal = true;
+  guiSupport = false;
+  pcsclite = null;
+  sqlite = null;
+  pinentry = null;
+  adns = null;
+  gnutls = null;
+  libusb = null;
+  openldap = null;
+  readline = null;
+  zlib = null;
+  bzip2 = null;
+};
+in stdenv.mkDerivation {
   version = "243";
   pname = "systemd";
 
@@ -41,7 +55,7 @@ stdenv.mkDerivation {
       (buildPackages.python3Packages.python.withPackages ( ps: with ps; [ python3Packages.lxml ]))
     ];
   buildInputs =
-    [ linuxHeaders libcap kmod xz pam acl
+    [ linuxHeaders libcap curl.dev kmod xz pam acl
       /* cryptsetup */ libuuid glib libgcrypt libgpgerror libidn2
       libmicrohttpd pcre2 ] ++
       stdenv.lib.optional withKexectools kexectools ++
@@ -67,6 +81,7 @@ stdenv.mkDerivation {
     "-Ddebug-shell=${bashInteractive}/bin/bash"
     # while we do not run tests we should also not build them. Removes about 600 targets
     "-Dtests=false"
+    "-Dimportd=true"
     "-Dlz4=true"
     "-Dhostnamed=true"
     "-Dnetworkd=true"
@@ -77,7 +92,7 @@ stdenv.mkDerivation {
     "-Dlocaled=true"
     "-Dresolve=true"
     "-Dsplit-usr=false"
-    "-Dlibcurl=false"
+    "-Dlibcurl=true"
     "-Dlibidn=false"
     "-Dlibidn2=true"
     "-Dquotacheck=false"
@@ -144,6 +159,14 @@ stdenv.mkDerivation {
       patchShebangs $dir
     done
 
+    # absolute paths to gpg & tar
+    substituteInPlace src/import/pull-common.c \
+      --replace '"gpg"' '"${gnupg-minimal}/bin/gpg"'
+    for file in src/import/{{export,import,pull}-tar,import-common}.c; do
+      substituteInPlace $file \
+        --replace '"tar"' '"${gnutar}/bin/tar"'
+    done
+
     substituteInPlace src/journal/catalog.c \
       --replace /usr/lib/systemd/catalog/ $out/lib/systemd/catalog/
   '';

From 9b274e2962d9d133930a4fd03b2691fc4f6f56cd Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Sat, 2 Nov 2019 19:22:36 -0400
Subject: [PATCH 023/144] qtbase-setup-hook: `postPhases` may be undefined

My earlier sed missed this because it already had `{..}`.
---
 pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh b/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh
index 836e154148be..9f2a9f06f1ab 100644
--- a/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh
@@ -62,5 +62,5 @@ postPatchMkspecs() {
     fi
 }
 if [ -z "${dontPatchMkspecs-}" ]; then
-    postPhases="${postPhases}${postPhases:+ }postPatchMkspecs"
+    postPhases="${postPhases-}${postPhases:+ }postPatchMkspecs"
 fi

From 02c3bcee61b6bbe61f34b043c1b511776039ed00 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sun, 3 Nov 2019 01:49:38 -0800
Subject: [PATCH 024/144] vim: 8.1.2188 -> 8.1.2237

---
 pkgs/applications/editors/vim/common.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 9d22cdbf4a86..0a099ea630d3 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.1.2188";
+  version = "8.1.2237";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "0ixq96l991b84sj66v63ds61yr75gx5zz411213yn6bz3s2fvlcv";
+    sha256 = "1qwh3cw5zmjmnk07g0nc8nz8k5nlq9ilvvygnfdjy1fqg69q8p0h";
   };
 
   enableParallelBuilding = true;

From 52ed193ec7f167579b8acbb27d02283ae9e92eff Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Sat, 2 Nov 2019 19:55:41 +0100
Subject: [PATCH 025/144] nixosTests.systemd-nspawn: add test

This adds a test downloading an nspawn container via http, and ensures
sha256sum verification and gpg signature verification work.
---
 nixos/tests/all-tests.nix      |  1 +
 nixos/tests/systemd-nspawn.nix | 58 ++++++++++++++++++++++++++++++++++
 2 files changed, 59 insertions(+)
 create mode 100644 nixos/tests/systemd-nspawn.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 10564e063c69..67766cc1512d 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -269,6 +269,7 @@ in
   systemd-confinement = handleTest ./systemd-confinement.nix {};
   systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
   systemd-networkd-wireguard = handleTest ./systemd-networkd-wireguard.nix {};
+  systemd-nspawn = handleTest ./systemd-nspawn.nix {};
   pdns-recursor = handleTest ./pdns-recursor.nix {};
   taskserver = handleTest ./taskserver.nix {};
   telegraf = handleTest ./telegraf.nix {};
diff --git a/nixos/tests/systemd-nspawn.nix b/nixos/tests/systemd-nspawn.nix
new file mode 100644
index 000000000000..c2039bb5980c
--- /dev/null
+++ b/nixos/tests/systemd-nspawn.nix
@@ -0,0 +1,58 @@
+import ./make-test.nix ({pkgs, lib, ...}:
+let
+  gpgKeyring = (pkgs.runCommand "gpg-keyring" { buildInputs = [ pkgs.gnupg ]; } ''
+    mkdir -p $out
+    export GNUPGHOME=$out
+    cat > foo <<EOF
+      %echo Generating a basic OpenPGP key
+      %no-protection
+      Key-Type: DSA
+      Key-Length: 1024
+      Subkey-Type: ELG-E
+      Subkey-Length: 1024
+      Name-Real: Joe Tester
+      Name-Email: joe@foo.bar
+      Expire-Date: 0
+      # Do a commit here, so that we can later print "done"
+      %commit
+      %echo done
+    EOF
+    gpg --batch --generate-key foo
+    rm $out/S.gpg-agent $out/S.gpg-agent.*
+    gpg --export joe@foo.bar -a > $out/pubkey.gpg
+  '');
+
+  nspawnImages = (pkgs.runCommand "localhost" { buildInputs = [ pkgs.coreutils pkgs.gnupg ]; } ''
+    mkdir -p $out
+    cd $out
+    dd if=/dev/urandom of=$out/testimage.raw bs=$((1024*1024+7)) count=5
+    sha256sum testimage.raw > SHA256SUMS
+    export GNUPGHOME="$(mktemp -d)"
+    cp -R ${gpgKeyring}/* $GNUPGHOME
+    gpg --batch --sign --detach-sign --output SHA256SUMS.gpg SHA256SUMS
+  '');
+in {
+  name = "opensmtpd";
+
+  nodes = {
+    server = { pkgs, ... }: {
+      networking.firewall.allowedTCPPorts = [ 80 ];
+      services.nginx = {
+        enable = true;
+        virtualHosts."server".root = nspawnImages;
+      };
+    };
+    client = { pkgs, ... }: {
+      environment.etc."systemd/import-pubring.gpg".source = "${gpgKeyring}/pubkey.gpg";
+    };
+  };
+
+  testScript = ''
+    startAll;
+
+    $server->waitForUnit("nginx.service");
+    $client->waitForUnit("network-online.target");
+    $client->succeed("machinectl pull-raw --verify=signature http://server/testimage.raw");
+    $client->succeed("cmp /var/lib/machines/testimage.raw ${nspawnImages}/testimage.raw");
+  '';
+})

From e88fb2dca24d8cb09dd8db12a3c7cec3f74365db Mon Sep 17 00:00:00 2001
From: worldofpeace <worldofpeace@protonmail.ch>
Date: Thu, 31 Oct 2019 08:13:49 -0400
Subject: [PATCH 026/144] networkmanager: fix PPPD_PATH

Fixes #72330

Upstream MR: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/merge_requests/323
---
 pkgs/tools/networking/network-manager/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/tools/networking/network-manager/default.nix b/pkgs/tools/networking/network-manager/default.nix
index e18b5970370f..b03a47e8ce2c 100644
--- a/pkgs/tools/networking/network-manager/default.nix
+++ b/pkgs/tools/networking/network-manager/default.nix
@@ -61,6 +61,13 @@ in stdenv.mkDerivation rec {
     # Meson does not support using different directories during build and
     # for installation like Autotools did with flags passed to make install.
     ./fix-install-paths.patch
+
+    # Fixes https://github.com/NixOS/nixpkgs/issues/72330
+    # Upstream MR: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/merge_requests/323
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/commit/4c11364201c094ad19ab9980ea6051a82bd2a550.patch";
+      sha256 = "14dgb6ijxyzcglrk67is2fn49iwrhljf2sld8w557i6zkypilmsv";
+    })
   ];
 
   buildInputs = [

From d1d380729b3f498545c8f9f43117e995b5ae2494 Mon Sep 17 00:00:00 2001
From: worldofpeace <worldofpeace@protonmail.ch>
Date: Thu, 31 Oct 2019 11:29:14 -0400
Subject: [PATCH 027/144] networkmanager: add worldofpeace to maintainers

---
 pkgs/tools/networking/network-manager/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/tools/networking/network-manager/default.nix b/pkgs/tools/networking/network-manager/default.nix
index b03a47e8ce2c..4805d01deadd 100644
--- a/pkgs/tools/networking/network-manager/default.nix
+++ b/pkgs/tools/networking/network-manager/default.nix
@@ -111,7 +111,7 @@ in stdenv.mkDerivation rec {
     homepage = https://wiki.gnome.org/Projects/NetworkManager;
     description = "Network configuration and management tool";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ phreedom domenkozar obadz ];
+    maintainers = with maintainers; [ phreedom domenkozar obadz worldofpeace ];
     platforms = platforms.linux;
   };
 }

From 4b63c915afab8c40520389b86687a05e7bc08b4b Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Tue, 22 Oct 2019 18:38:42 +0000
Subject: [PATCH 028/144] git: drop extraneous sysconfdir trailing slash

I noticed while strace-ing that Git was trying to open
/etc//gitconfig.  Not a big deal, but it is definitely more correct
without the trailing slash.
---
 .../version-management/git-and-tools/git/default.nix            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 46bbc72fb3bd..a62668a2091b 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -93,7 +93,7 @@ stdenv.mkDerivation {
   ++ (if perlSupport then ["PERL_PATH=${perlPackages.perl}/bin/perl"] else ["NO_PERL=1"])
   ++ (if pythonSupport then ["PYTHON_PATH=${python}/bin/python"] else ["NO_PYTHON=1"])
   ++ stdenv.lib.optionals stdenv.isSunOS ["INSTALL=install" "NO_INET_NTOP=" "NO_INET_PTON="]
-  ++ (if stdenv.isDarwin then ["NO_APPLE_COMMON_CRYPTO=1"] else ["sysconfdir=/etc/"])
+  ++ (if stdenv.isDarwin then ["NO_APPLE_COMMON_CRYPTO=1"] else ["sysconfdir=/etc"])
   ++ stdenv.lib.optionals stdenv.hostPlatform.isMusl ["NO_SYS_POLL_H=1" "NO_GETTEXT=YesPlease"]
   ++ stdenv.lib.optional withpcre2 "USE_LIBPCRE2=1";
 

From 0a9e548b2f8c2a65ba5ee7b9b7695293c633af3b Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Mon, 4 Nov 2019 09:35:15 -0500
Subject: [PATCH 029/144] git: 2.23.0 -> 2.24.0

---
 .../version-management/git-and-tools/git/default.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index a62668a2091b..a6b53561771d 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -21,7 +21,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.23.0";
+  version = "2.24.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "0rv0y45gcd3h191isppn77acih695v4pipdj031jvs9rd1ds0kr3";
+    sha256 = "06rpakbwzck85ncfsgv4xmq3iwab9d4f5y6dqhl8nvb2fccxcwcz";
   };
 
   outputs = [ "out" ];

From c5cf0099967e0f5011b9188d56de22c376465b88 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 4 Nov 2019 19:51:04 -0500
Subject: [PATCH 030/144] multiple-outputs setup hook: Remove accidentally
 added tab

I don't want to just rebase this away because the original commit is
also in #72074.
---
 pkgs/build-support/setup-hooks/multiple-outputs.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/setup-hooks/multiple-outputs.sh b/pkgs/build-support/setup-hooks/multiple-outputs.sh
index 32d4e065875b..2e95495c96fd 100644
--- a/pkgs/build-support/setup-hooks/multiple-outputs.sh
+++ b/pkgs/build-support/setup-hooks/multiple-outputs.sh
@@ -9,7 +9,7 @@ _assignFirst() {
     local varName="$1"
     local REMOVE=REMOVE # slightly hacky - we allow REMOVE (i.e. not a variable name)
     shift
-	while (( $# )); do
+    while (( $# )); do
         if [ -n "${!1-}" ]; then eval "${varName}"="$1"; return; fi
         shift
     done

From fae8d2627db00bd07d0a80669be26648161c86c0 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 4 Nov 2019 19:57:14 -0500
Subject: [PATCH 031/144] cc-wrapper, bintools-wrapper: Remove now unneeded
 `set {+,-}u`

---
 pkgs/build-support/bintools-wrapper/default.nix   | 6 +-----
 pkgs/build-support/bintools-wrapper/setup-hook.sh | 3 ---
 pkgs/build-support/cc-wrapper/default.nix         | 4 ----
 pkgs/build-support/cc-wrapper/setup-hook.sh       | 3 ---
 4 files changed, 1 insertion(+), 15 deletions(-)

diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 9f5395b635e0..4a56f00db49e 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -199,11 +199,7 @@ stdenv.mkDerivation {
   ];
 
   postFixup =
-    ''
-      set -u
-    ''
-
-    + optionalString (libc != null) (''
+    optionalString (libc != null) (''
       ##
       ## General libc support
       ##
diff --git a/pkgs/build-support/bintools-wrapper/setup-hook.sh b/pkgs/build-support/bintools-wrapper/setup-hook.sh
index 2e15fa95c794..a714bd151c90 100644
--- a/pkgs/build-support/bintools-wrapper/setup-hook.sh
+++ b/pkgs/build-support/bintools-wrapper/setup-hook.sh
@@ -2,8 +2,6 @@
 #
 # See comments in cc-wrapper's setup hook. This works exactly the same way.
 
-set -u
-
 # Skip setup hook if we're neither a build-time dep, nor, temporarily, doing a
 # native compile.
 #
@@ -73,4 +71,3 @@ export NIX_HARDENING_ENABLE
 
 # No local scope in sourced file
 unset -v role_pre role_post cmd upper_case
-set +u
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index cf2d38cd9978..d6037552ef6e 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -134,8 +134,6 @@ stdenv.mkDerivation {
 
   installPhase =
     ''
-      set -u
-
       mkdir -p $out/bin $out/nix-support
 
       wrap() {
@@ -224,8 +222,6 @@ stdenv.mkDerivation {
 
   postFixup =
     ''
-      set -u
-
       # Backwards compatability for packages expecting this file, e.g. with
       # `$NIX_CC/nix-support/dynamic-linker`.
       #
diff --git a/pkgs/build-support/cc-wrapper/setup-hook.sh b/pkgs/build-support/cc-wrapper/setup-hook.sh
index 211b50632914..5b13f2683097 100644
--- a/pkgs/build-support/cc-wrapper/setup-hook.sh
+++ b/pkgs/build-support/cc-wrapper/setup-hook.sh
@@ -54,8 +54,6 @@
 # For more details, read the individual files where the mechanisms used to
 # accomplish this will be individually documented.
 
-set -u
-
 # Skip setup hook if we're neither a build-time dep, nor, temporarily, doing a
 # native compile.
 #
@@ -120,4 +118,3 @@ export NIX_HARDENING_ENABLE
 
 # No local scope in sourced file
 unset -v role_pre role_post
-set +u

From 49afaab294367f87a28f84e46667f12582fbde60 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Thu, 1 Aug 2019 21:27:55 -0400
Subject: [PATCH 032/144] perl: fix errant references when cross-compiling

---
 .../development/interpreters/perl/default.nix | 26 ++++++++++++-------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 2ecc5cbb2ef6..4503fd0bf49b 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -1,5 +1,5 @@
 { config, lib, stdenv, fetchurl, pkgs, buildPackages, callPackage
-, enableThreading ? stdenv ? glibc, makeWrapper
+, enableThreading ? stdenv ? glibc, coreutils, makeWrapper
 }:
 
 with lib;
@@ -35,7 +35,7 @@ let
 
     # TODO: Add a "dev" output containing the header files.
     outputs = [ "out" "man" "devdoc" ] ++
-      stdenv.lib.optional crossCompiling "dev";
+      optional crossCompiling "dev";
     setOutputFlags = false;
 
     disallowedReferences = [ stdenv.cc ];
@@ -57,12 +57,20 @@ let
       ++ optionals stdenv.isDarwin [ ./cpp-precomp.patch ./sw_vers.patch ]
       ++ optional crossCompiling ./MakeMaker-cross.patch;
 
-    postPatch = ''
-      pwd="$(type -P pwd)"
+    # This is not done for native builds because pwd may need to come from
+    # bootstrap tools when building bootstrap perl.
+    postPatch = (if crossCompiling then ''
       substituteInPlace dist/PathTools/Cwd.pm \
-        --replace "/bin/pwd" "$pwd"
-    '' + stdenv.lib.optionalString crossCompiling ''
+        --replace "/bin/pwd" '${coreutils}/bin/pwd'
       substituteInPlace cnf/configure_tool.sh --replace "cc -E -P" "cc -E"
+    '' else ''
+      substituteInPlace dist/PathTools/Cwd.pm \
+        --replace "/bin/pwd" "$(type -P pwd)"
+    '') +
+    # Perl's build system uses the src variable, and its value may end up in
+    # the output in some cases (when cross-compiling)
+    ''
+      unset src
     '';
 
     # Build a thread-safe Perl with a dynamic libperls.o.  We need the
@@ -85,7 +93,7 @@ let
       ++ optional stdenv.isSunOS "-Dcc=gcc"
       ++ optional enableThreading "-Dusethreads";
 
-    configureScript = stdenv.lib.optionalString (!crossCompiling) "${stdenv.shell} ./Configure";
+    configureScript = optionalString (!crossCompiling) "${stdenv.shell} ./Configure";
 
     dontAddPrefix = !crossCompiling;
 
@@ -140,7 +148,7 @@ let
             }" /no-such-path \
           --replace "${stdenv.cc}" /no-such-path \
           --replace "$man" /no-such-path
-      '' + stdenv.lib.optionalString crossCompiling
+      '' + optionalString crossCompiling
       ''
         mkdir -p $dev/lib/perl5/cross_perl/${version}
         for dir in cnf/{stub,cpan}; do
@@ -172,7 +180,7 @@ let
       platforms = platforms.all;
       priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
     };
-  } // stdenv.lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
+  } // optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
     crossVersion = "980998f7d11baf97284426ca91f84681d49a08f5"; # Jul 20, 2019
 
     perl-cross-src = fetchurl {

From b7b3d3a2641091146a20452a1c8ef026f8553e33 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 5 Nov 2019 16:10:26 +0100
Subject: [PATCH 033/144] gcr: Clean up

* Format with nixpkgs-format
* Correct license
* Explicitly specify patched shebangs
* Build in parallel
* Drop unnecessary dependencies
---
 pkgs/development/libraries/gcr/default.nix | 67 ++++++++++++++++------
 1 file changed, 51 insertions(+), 16 deletions(-)

diff --git a/pkgs/development/libraries/gcr/default.nix b/pkgs/development/libraries/gcr/default.nix
index 1947d40dc85d..dfe53668c79f 100644
--- a/pkgs/development/libraries/gcr/default.nix
+++ b/pkgs/development/libraries/gcr/default.nix
@@ -1,7 +1,21 @@
-{ stdenv, fetchurl, pkgconfig, gettext, gnupg, p11-kit, glib
-, libgcrypt, libtasn1, dbus-glib, gtk3, pango, gdk-pixbuf, atk
-, gobject-introspection, makeWrapper, libxslt, vala, gnome3
-, python3 }:
+{ stdenv
+, fetchurl
+, pkgconfig
+, gettext
+, gnupg
+, p11-kit
+, glib
+, libgcrypt
+, libtasn1
+, gtk3
+, pango
+, gobject-introspection
+, makeWrapper
+, libxslt
+, vala
+, gnome3
+, python3
+}:
 
 stdenv.mkDerivation rec {
   pname = "gcr";
@@ -12,38 +26,59 @@ stdenv.mkDerivation rec {
     sha256 = "1hf06p4qfyywnb6334ysnr6aqxik3srb37glclvr4yhb3wzrjqnm";
   };
 
-  passthru = {
-    updateScript = gnome3.updateScript { packageName = pname; };
-  };
-
   postPatch = ''
-    patchShebangs .
+    patchShebangs build/ gcr/fixtures/
   '';
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ pkgconfig gettext gobject-introspection libxslt makeWrapper vala ];
+  nativeBuildInputs = [
+    pkgconfig
+    gettext
+    gobject-introspection
+    libxslt
+    makeWrapper
+    vala
+  ];
 
-  buildInputs = [ gnupg libgcrypt libtasn1 dbus-glib pango gdk-pixbuf atk ];
+  buildInputs = [
+    gnupg
+    libgcrypt
+    libtasn1
+    pango
+  ];
 
-  propagatedBuildInputs = [ glib gtk3 p11-kit ];
+  propagatedBuildInputs = [
+    glib
+    gtk3
+    p11-kit
+  ];
+
+  checkInputs = [
+    python3
+  ];
 
-  checkInputs = [ python3 ];
   doCheck = false; # fails 21 out of 603 tests, needs dbus daemon
 
-  #enableParallelBuilding = true; issues on hydra
+  enableParallelBuilding = true;
 
   preFixup = ''
     wrapProgram "$out/bin/gcr-viewer" \
       --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
   '';
 
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
   meta = with stdenv.lib; {
     platforms = platforms.linux;
     maintainers = gnome3.maintainers;
     description = "GNOME crypto services (daemon and tools)";
-    homepage    = https://gitlab.gnome.org/GNOME/gcr;
-    license     = licenses.gpl2;
+    homepage = "https://gitlab.gnome.org/GNOME/gcr";
+    license = licenses.lgpl2Plus;
 
     longDescription = ''
       GCR is a library for displaying certificates, and crypto UI, accessing

From 03f7753a8906f15f0b2323d63625d3c162b163be Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 5 Nov 2019 16:04:46 +0100
Subject: [PATCH 034/144] =?UTF-8?q?gcr:=203.33.4=20=E2=86=92=203.34.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://download.gnome.org/sources/gcr/3.34/gcr-3.34.0.news
---
 pkgs/development/libraries/gcr/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gcr/default.nix b/pkgs/development/libraries/gcr/default.nix
index dfe53668c79f..cf0f22fdd408 100644
--- a/pkgs/development/libraries/gcr/default.nix
+++ b/pkgs/development/libraries/gcr/default.nix
@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gcr";
-  version = "3.33.4";
+  version = "3.34.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1hf06p4qfyywnb6334ysnr6aqxik3srb37glclvr4yhb3wzrjqnm";
+    sha256 = "0925snsixzkwh49xiayqmj6fcrmklqk8kyy0jkv7m64h9abm1pr9";
   };
 
   postPatch = ''

From 901e851fe9f3abbf7c25bc4c38cbc7903856f712 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Tue, 5 Nov 2019 00:43:07 -0500
Subject: [PATCH 035/144] gnu-efi: apply patch to fix build on armv6l

---
 pkgs/development/libraries/gnu-efi/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/gnu-efi/default.nix b/pkgs/development/libraries/gnu-efi/default.nix
index 6ae1f47e38cd..e218729821fb 100644
--- a/pkgs/development/libraries/gnu-efi/default.nix
+++ b/pkgs/development/libraries/gnu-efi/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPackages, fetchurl, pciutils }:
+{ stdenv, buildPackages, fetchurl, fetchpatch, pciutils }:
 
 with stdenv.lib;
 
@@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
     sha256 = "1w3p4aqlc5j93q44la7dc8cr3hky20zvsd0h0k2lyzhwmrzfl5b7";
   };
 
+  patches = [
+    # Fix build on armv6l
+    (fetchpatch {
+      url = "https://sourceforge.net/p/gnu-efi/patches/_discuss/thread/25bb273a18/9c4d/attachment/0001-Fix-ARCH-on-armv6-and-other-32-bit-ARM-platforms.patch";
+      sha256 = "0pj03h20g2bbz6fr753bj1scry6919h57l1h86z3b6q7hqfj0b4r";
+    })
+  ];
+
   buildInputs = [ pciutils ];
 
   hardeningDisable = [ "stackprotector" ];

From cdbbaa91edc3179abee15b4597b8710aa8d0ca87 Mon Sep 17 00:00:00 2001
From: John Ericson <git@JohnEricson.me>
Date: Tue, 5 Nov 2019 09:55:39 -0500
Subject: [PATCH 036/144] cmake: CMAKE_*_PATH can be undefined

---
 .../tools/build-managers/cmake/setup-hook.sh           | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/tools/build-managers/cmake/setup-hook.sh b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
index 8bd54d3bc13d..d5e88d773f67 100755
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
@@ -128,22 +128,22 @@ makeCmakeFindLibs(){
   for flag in $NIX_CFLAGS_COMPILE $NIX_LDFLAGS; do
     if test -n "$isystem_seen" && test -d "$flag"; then
       isystem_seen=
-      export CMAKE_INCLUDE_PATH="$CMAKE_INCLUDE_PATH${CMAKE_INCLUDE_PATH:+:}${flag}"
+      export CMAKE_INCLUDE_PATH="${CMAKE_INCLUDE_PATH-}${CMAKE_INCLUDE_PATH:+:}${flag}"
     elif test -n "$iframework_seen" && test -d "$flag"; then
       iframework_seen=
-      export CMAKE_FRAMEWORK_PATH="$CMAKE_FRAMEWORK_PATH${CMAKE_FRAMEWORK_PATH:+:}${flag}"
+      export CMAKE_FRAMEWORK_PATH="${CMAKE_FRAMEWORK_PATH-}${CMAKE_FRAMEWORK_PATH:+:}${flag}"
     else
       isystem_seen=
       iframework_seen=
       case $flag in
         -I*)
-          export CMAKE_INCLUDE_PATH="$CMAKE_INCLUDE_PATH${CMAKE_INCLUDE_PATH:+:}${flag:2}"
+          export CMAKE_INCLUDE_PATH="${CMAKE_INCLUDE_PATH-}${CMAKE_INCLUDE_PATH:+:}${flag:2}"
           ;;
         -L*)
-          export CMAKE_LIBRARY_PATH="$CMAKE_LIBRARY_PATH${CMAKE_LIBRARY_PATH:+:}${flag:2}"
+          export CMAKE_LIBRARY_PATH="${CMAKE_LIBRARY_PATH-}${CMAKE_LIBRARY_PATH:+:}${flag:2}"
           ;;
         -F*)
-          export CMAKE_FRAMEWORK_PATH="$CMAKE_FRAMEWORK_PATH${CMAKE_FRAMEWORK_PATH:+:}${flag:2}"
+          export CMAKE_FRAMEWORK_PATH="${CMAKE_FRAMEWORK_PATH-}${CMAKE_FRAMEWORK_PATH:+:}${flag:2}"
           ;;
         -isystem)
           isystem_seen=1

From 2c1d9d8bc1222abe8e597277eb1c3f1af2ac4423 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 5 Nov 2019 14:21:42 -0500
Subject: [PATCH 037/144] i-score: CMAKE_PREFIX_PATH can be undefined

---
 pkgs/applications/audio/i-score/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/audio/i-score/default.nix b/pkgs/applications/audio/i-score/default.nix
index 2cc39e649434..f3928499413c 100644
--- a/pkgs/applications/audio/i-score/default.nix
+++ b/pkgs/applications/audio/i-score/default.nix
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
   ];
 
   preConfigure = ''
-    export CMAKE_PREFIX_PATH="$CMAKE_PREFIX_PATH:$(echo "${jamomacore}/jamoma/share/cmake/Jamoma")"
+    export CMAKE_PREFIX_PATH="''${CMAKE_PREFIX_PATH-}:$(echo "${jamomacore}/jamoma/share/cmake/Jamoma")"
   '';
 
   postInstall = ''rm $out/bin/i-score.sh'';

From 5b6da99ea09a166ad8d79fc2fb2c371958a9bd93 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 5 Nov 2019 16:30:40 -0500
Subject: [PATCH 038/144] stdenv: Don't unset propagated*DepFiles before main
 phases

A bunch of stdenv-internal variables were deleted in
1601a7fcce389ae3f1b1b36676fd5545035566af, but these are needed in the
fixup phase, whereas the rest are just needed for the initial work
(findInputs, etc) before the user phases.

CC @matthewbauer
---
 pkgs/stdenv/generic/setup.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index a95bdc12095f..730e77c20f90 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -575,7 +575,7 @@ _addToEnv
 unset allPlatOffsets
 unset pkgBuildAccumVars pkgHostAccumVars pkgTargetAccumVars pkgAccumVarVars
 unset pkgBuildHookVars pkgHostHookVars pkgTargetHookVars pkgHookVarVars
-unset propagatedBuildDepFiles propagatedHostDepFiles propagatedTargetDepFiles propagatedDepFilesVars
+unset propagatedDepFilesVars
 
 
 _addRpathPrefix "$out"

From c8bfae0819a1343bd435d7a6e22671594ecb5e5d Mon Sep 17 00:00:00 2001
From: Red Davies <red@infect.me>
Date: Tue, 5 Nov 2019 20:28:30 -0500
Subject: [PATCH 039/144] icu: bugfix #71142 - Fixes icu-config reporting bad
 location

---
 pkgs/development/libraries/icu/base.nix | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/icu/base.nix b/pkgs/development/libraries/icu/base.nix
index 0a8cb7d46843..47ca63fca990 100644
--- a/pkgs/development/libraries/icu/base.nix
+++ b/pkgs/development/libraries/icu/base.nix
@@ -63,10 +63,16 @@ let
     # remove dependency on bootstrap-tools in early stdenv build
     postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
       sed -i 's/INSTALL_CMD=.*install/INSTALL_CMD=install/' $out/lib/icu/${version}/pkgdata.inc
-    '' + ''
+    '' + (let
+      replacements = [
+        { from = "\${prefix}/include"; to = "${placeholder "dev"}/include"; } # --cppflags-searchpath
+        { from = "\${pkglibdir}/Makefile.inc"; to = "${placeholder "dev"}/lib/icu/Makefile.inc"; } # --incfile
+        { from = "\${pkglibdir}/pkgdata.inc"; to = "${placeholder "dev"}/lib/icu/pkgdata.inc"; } # --incpkgdatafile
+      ];
+    in ''
       substituteInPlace "$dev/bin/icu-config" \
-        --replace \''${pkglibdir}/Makefile.inc "$dev/lib/icu/Makefile.inc"
-    '';
+        ${lib.concatMapStringsSep " " (r: "--replace '${r.from}' '${r.to}'") replacements}
+    '');
 
     postFixup = ''moveToOutput lib/icu "$dev" '';
   };

From 5270c3a03ee5657551f16b31da057dda81c8b0f9 Mon Sep 17 00:00:00 2001
From: Daniel Schaefer <git@danielschaefer.me>
Date: Sun, 27 Oct 2019 14:41:42 +0100
Subject: [PATCH 040/144] libtiff: Patch CVE-2019-7663

---
 pkgs/development/libraries/libtiff/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index c35923071b0b..fba174d171f6 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -23,6 +23,11 @@ stdenv.mkDerivation rec {
       name = "CVE-2019-6128.patch";
       sha256 = "03yvsfq6dxjd3v8ypfwz6cpz2iymqwcbawqqlmkh40dayi7fgizr";
     })
+    (fetchurl {
+      url = "https://gitlab.com/libtiff/libtiff/commit/802d3cbf3043be5dce5317e140ccb1c17a6a2d39.patch";
+      name = "CVE-2019-7663.patch";
+      sha256 = "01nq5z1l55clasy4aqr0r2rgiaxay1108vni2nzd8lx4qc5q09hx";
+    })
     # Manual backport of https://gitlab.com/libtiff/libtiff/commit/1b5e3b6a23827c33acf19ad50ce5ce78f12b3773.patch
     ./CVE-2019-14973.patch
   ];

From 2223e618b84e4015f0ac37049a8a23920248fdd8 Mon Sep 17 00:00:00 2001
From: Daniel Schaefer <git@danielschaefer.me>
Date: Wed, 6 Nov 2019 17:04:00 +0100
Subject: [PATCH 041/144] libtiff: 4.0.10 -> 4.1.0

---
 .../libraries/libtiff/CVE-2019-14973.patch    | 384 ------------------
 .../development/libraries/libtiff/default.nix |  19 +-
 2 files changed, 2 insertions(+), 401 deletions(-)
 delete mode 100644 pkgs/development/libraries/libtiff/CVE-2019-14973.patch

diff --git a/pkgs/development/libraries/libtiff/CVE-2019-14973.patch b/pkgs/development/libraries/libtiff/CVE-2019-14973.patch
deleted file mode 100644
index 1dc75246902e..000000000000
--- a/pkgs/development/libraries/libtiff/CVE-2019-14973.patch
+++ /dev/null
@@ -1,384 +0,0 @@
-diff -ru tiff-4.0.10-orig/libtiff/tif_aux.c tiff-4.0.10/libtiff/tif_aux.c
---- tiff-4.0.10-orig/libtiff/tif_aux.c	2017-12-02 16:21:47.305709555 +0100
-+++ tiff-4.0.10/libtiff/tif_aux.c	2019-10-02 22:35:17.392184463 +0200
-@@ -57,18 +57,57 @@
- 	return bytes;
- }
- 
-+tmsize_t
-+_TIFFMultiplySSize(TIFF* tif, tmsize_t first, tmsize_t second, const char* where)
-+{
-+    if( first <= 0 || second <= 0 )
-+    {
-+        if( tif != NULL && where != NULL )
-+        {
-+            TIFFErrorExt(tif->tif_clientdata, where,
-+                        "Invalid argument to _TIFFMultiplySSize() in %s", where);
-+        }
-+        return 0;
-+    }
-+
-+    if( first > TIFF_TMSIZE_T_MAX / second )
-+    {
-+        if( tif != NULL && where != NULL )
-+        {
-+            TIFFErrorExt(tif->tif_clientdata, where,
-+                        "Integer overflow in %s", where);
-+        }
-+        return 0;
-+    }
-+    return first * second;
-+}
-+
-+tmsize_t _TIFFCastUInt64ToSSize(TIFF* tif, uint64 val, const char* module)
-+{
-+    if( val > (uint64)TIFF_TMSIZE_T_MAX )
-+    {
-+        if( tif != NULL && module != NULL )
-+        {
-+            TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
-+        }
-+        return 0;
-+    }
-+    return (tmsize_t)val;
-+}
-+
- void*
- _TIFFCheckRealloc(TIFF* tif, void* buffer,
- 		  tmsize_t nmemb, tmsize_t elem_size, const char* what)
- {
- 	void* cp = NULL;
--	tmsize_t bytes = nmemb * elem_size;
--
-+        tmsize_t count = _TIFFMultiplySSize(tif, nmemb, elem_size, NULL);
- 	/*
--	 * XXX: Check for integer overflow.
-+	 * Check for integer overflow.
- 	 */
--	if (nmemb && elem_size && bytes / elem_size == nmemb)
--		cp = _TIFFrealloc(buffer, bytes);
-+	if (count != 0)
-+	{
-+		cp = _TIFFrealloc(buffer, count);
-+	}
- 
- 	if (cp == NULL) {
- 		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
-diff -ru tiff-4.0.10-orig/libtiff/tiffiop.h tiff-4.0.10/libtiff/tiffiop.h
---- tiff-4.0.10-orig/libtiff/tiffiop.h	2018-11-03 15:28:37.748910968 +0100
-+++ tiff-4.0.10/libtiff/tiffiop.h	2019-10-02 22:35:17.396184535 +0200
-@@ -77,6 +77,9 @@
- #define	FALSE	0
- #endif
- 
-+#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0))
-+#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1)
-+
- typedef struct client_info {
-     struct client_info *next;
-     void *data;
-@@ -258,7 +261,7 @@
- #define TIFFhowmany8_64(x) (((x)&0x07)?((uint64)(x)>>3)+1:(uint64)(x)>>3)
- #define TIFFroundup_64(x, y) (TIFFhowmany_64(x,y)*(y))
- 
--/* Safe multiply which returns zero if there is an integer overflow */
-+/* Safe multiply which returns zero if there is an *unsigned* integer overflow. This macro is not safe for *signed* integer types */
- #define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0)
- 
- #define TIFFmax(A,B) ((A)>(B)?(A):(B))
-@@ -368,6 +371,8 @@
- 
- extern uint32 _TIFFMultiply32(TIFF*, uint32, uint32, const char*);
- extern uint64 _TIFFMultiply64(TIFF*, uint64, uint64, const char*);
-+extern tmsize_t _TIFFMultiplySSize(TIFF*, tmsize_t, tmsize_t, const char*);
-+extern tmsize_t _TIFFCastUInt64ToSSize(TIFF*, uint64, const char*);
- extern void* _TIFFCheckMalloc(TIFF*, tmsize_t, tmsize_t, const char*);
- extern void* _TIFFCheckRealloc(TIFF*, void*, tmsize_t, tmsize_t, const char*);
- 
-diff -ru tiff-4.0.10-orig/libtiff/tif_getimage.c tiff-4.0.10/libtiff/tif_getimage.c
---- tiff-4.0.10-orig/libtiff/tif_getimage.c	2017-12-02 16:21:47.654716127 +0100
-+++ tiff-4.0.10/libtiff/tif_getimage.c	2019-10-02 22:35:17.393184481 +0200
-@@ -755,9 +755,8 @@
- 	uint32 leftmost_tw;
- 
- 	tilesize = TIFFTileSize(tif);  
--	bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,tilesize);
-+	bufsize = _TIFFMultiplySSize(tif, alpha?4:3,tilesize, "gtTileSeparate");
- 	if (bufsize == 0) {
--		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate");
- 		return (0);
- 	}
- 
-@@ -1019,9 +1018,8 @@
-         uint16 colorchannels;
- 
- 	stripsize = TIFFStripSize(tif);  
--	bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,stripsize);
-+	bufsize = _TIFFMultiplySSize(tif,alpha?4:3,stripsize, "gtStripSeparate");
- 	if (bufsize == 0) {
--		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate");
- 		return (0);
- 	}
- 
-diff -ru tiff-4.0.10-orig/libtiff/tif_luv.c tiff-4.0.10/libtiff/tif_luv.c
---- tiff-4.0.10-orig/libtiff/tif_luv.c	2018-05-05 15:50:35.884596907 +0200
-+++ tiff-4.0.10/libtiff/tif_luv.c	2019-10-02 22:35:17.393184481 +0200
-@@ -1264,16 +1264,10 @@
- 	return (SGILOGDATAFMT_UNKNOWN);
- }
- 
--
--#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0))
--#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1)
--
- static tmsize_t
- multiply_ms(tmsize_t m1, tmsize_t m2)
- {
--        if( m1 == 0 || m2 > TIFF_TMSIZE_T_MAX / m1 )
--            return 0;
--        return m1 * m2;
-+        return _TIFFMultiplySSize(NULL, m1, m2, NULL);
- }
- 
- static int
-diff -ru tiff-4.0.10-orig/libtiff/tif_pixarlog.c tiff-4.0.10/libtiff/tif_pixarlog.c
---- tiff-4.0.10-orig/libtiff/tif_pixarlog.c	2017-12-02 16:21:47.841162432 +0100
-+++ tiff-4.0.10/libtiff/tif_pixarlog.c	2019-10-02 22:36:01.223970118 +0200
-@@ -634,15 +634,10 @@
- 	return guess;
- }
- 
--#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0))
--#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1)
--
- static tmsize_t
- multiply_ms(tmsize_t m1, tmsize_t m2)
- {
--        if( m1 == 0 || m2 > TIFF_TMSIZE_T_MAX / m1 )
--            return 0;
--        return m1 * m2;
-+        return _TIFFMultiplySSize(NULL, m1, m2, NULL);
- }
- 
- static tmsize_t
-diff -ru tiff-4.0.10-orig/libtiff/tif_read.c tiff-4.0.10/libtiff/tif_read.c
---- tiff-4.0.10-orig/libtiff/tif_read.c	2018-10-14 21:15:27.551093695 +0200
-+++ tiff-4.0.10/libtiff/tif_read.c	2019-10-02 22:41:09.387290927 +0200
-@@ -29,9 +29,6 @@
- #include "tiffiop.h"
- #include <stdio.h>
- 
--#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0))
--#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1)
--
- int TIFFFillStrip(TIFF* tif, uint32 strip);
- int TIFFFillTile(TIFF* tif, uint32 tile);
- static int TIFFStartStrip(TIFF* tif, uint32 strip);
-@@ -49,6 +46,8 @@
- #define THRESHOLD_MULTIPLIER 10
- #define MAX_THRESHOLD (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * INITIAL_THRESHOLD)
- 
-+#define TIFF_INT64_MAX ((((int64)0x7FFFFFFF) << 32) | 0xFFFFFFFF)
-+
- /* Read 'size' bytes in tif_rawdata buffer starting at offset 'rawdata_offset'
-  * Returns 1 in case of success, 0 otherwise. */
- static int TIFFReadAndRealloc( TIFF* tif, tmsize_t size,
-@@ -734,23 +733,8 @@
- 		return ((tmsize_t)(-1));
- 	}
- 	bytecount = td->td_stripbytecount[strip];
--	if ((int64)bytecount <= 0) {
--#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
--		TIFFErrorExt(tif->tif_clientdata, module,
--			     "%I64u: Invalid strip byte count, strip %lu",
--			     (unsigned __int64) bytecount,
--			     (unsigned long) strip);
--#else
--		TIFFErrorExt(tif->tif_clientdata, module,
--			     "%llu: Invalid strip byte count, strip %lu",
--			     (unsigned long long) bytecount,
--			     (unsigned long) strip);
--#endif
--		return ((tmsize_t)(-1));
--	}
--	bytecountm = (tmsize_t)bytecount;
--	if ((uint64)bytecountm!=bytecount) {
--		TIFFErrorExt(tif->tif_clientdata, module, "Integer overflow");
-+	bytecountm =  _TIFFCastUInt64ToSSize(tif, bytecount, module);
-+	if (bytecountm == 0) {
- 		return ((tmsize_t)(-1));
- 	}
- 	if (size != (tmsize_t)(-1) && size < bytecountm)
-@@ -774,7 +758,7 @@
- 	if ((tif->tif_flags&TIFF_NOREADRAW)==0)
- 	{
- 		uint64 bytecount = td->td_stripbytecount[strip];
--		if ((int64)bytecount <= 0) {
-+		if( bytecount == 0 || bytecount > (uint64)TIFF_INT64_MAX ) {
- #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
- 			TIFFErrorExt(tif->tif_clientdata, module,
- 				"Invalid strip byte count %I64u, strip %lu",
-@@ -801,7 +785,7 @@
- 			    (bytecount - 4096) / 10 > (uint64)stripsize  )
- 			{
- 				uint64 newbytecount = (uint64)stripsize * 10 + 4096;
--				if( (int64)newbytecount >= 0 )
-+				if( newbytecount == 0 || newbytecount > (uint64)TIFF_INT64_MAX )
- 				{
- #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
- 					TIFFWarningExt(tif->tif_clientdata, module,
-@@ -1196,10 +1180,8 @@
- 	bytecount64 = td->td_stripbytecount[tile];
- 	if (size != (tmsize_t)(-1) && (uint64)size < bytecount64)
- 		bytecount64 = (uint64)size;
--	bytecountm = (tmsize_t)bytecount64;
--	if ((uint64)bytecountm!=bytecount64)
--	{
--		TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
-+	bytecountm = _TIFFCastUInt64ToSSize(tif, bytecount64, module);
-+        if( bytecountm == 0 ) {
- 		return ((tmsize_t)(-1));
- 	}
- 	return (TIFFReadRawTile1(tif, tile, buf, bytecountm, module));
-@@ -1221,7 +1203,7 @@
- 	if ((tif->tif_flags&TIFF_NOREADRAW)==0)
- 	{
- 		uint64 bytecount = td->td_stripbytecount[tile];
--		if ((int64)bytecount <= 0) {
-+		if( bytecount == 0 || bytecount > (uint64)TIFF_INT64_MAX ) {
- #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
- 			TIFFErrorExt(tif->tif_clientdata, module,
- 				"%I64u: Invalid tile byte count, tile %lu",
-@@ -1248,7 +1230,7 @@
- 			    (bytecount - 4096) / 10 > (uint64)stripsize  )
- 			{
- 				uint64 newbytecount = (uint64)stripsize * 10 + 4096;
--				if( (int64)newbytecount >= 0 )
-+				if( newbytecount == 0 || newbytecount > (uint64)TIFF_INT64_MAX )
- 				{
- #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
- 					TIFFWarningExt(tif->tif_clientdata, module,
-diff -ru tiff-4.0.10-orig/libtiff/tif_strip.c tiff-4.0.10/libtiff/tif_strip.c
---- tiff-4.0.10-orig/libtiff/tif_strip.c	2017-12-02 16:21:47.947867167 +0100
-+++ tiff-4.0.10/libtiff/tif_strip.c	2019-10-02 22:35:17.395184517 +0200
-@@ -129,15 +129,8 @@
- {
- 	static const char module[] = "TIFFVStripSize";
- 	uint64 m;
--	tmsize_t n;
- 	m=TIFFVStripSize64(tif,nrows);
--	n=(tmsize_t)m;
--	if ((uint64)n!=m)
--	{
--		TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
--		n=0;
--	}
--	return(n);
-+        return _TIFFCastUInt64ToSSize(tif, m, module);
- }
- 
- /*
-@@ -211,15 +204,8 @@
- {
- 	static const char module[] = "TIFFStripSize";
- 	uint64 m;
--	tmsize_t n;
- 	m=TIFFStripSize64(tif);
--	n=(tmsize_t)m;
--	if ((uint64)n!=m)
--	{
--		TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
--		n=0;
--	}
--	return(n);
-+	return _TIFFCastUInt64ToSSize(tif, m, module);
- }
- 
- /*
-@@ -330,14 +316,8 @@
- {
- 	static const char module[] = "TIFFScanlineSize";
- 	uint64 m;
--	tmsize_t n;
- 	m=TIFFScanlineSize64(tif);
--	n=(tmsize_t)m;
--	if ((uint64)n!=m) {
--		TIFFErrorExt(tif->tif_clientdata,module,"Integer arithmetic overflow");
--		n=0;
--	}
--	return(n);
-+	return _TIFFCastUInt64ToSSize(tif, m, module);
- }
- 
- /*
-@@ -366,15 +346,8 @@
- {
- 	static const char module[] = "TIFFRasterScanlineSize";
- 	uint64 m;
--	tmsize_t n;
- 	m=TIFFRasterScanlineSize64(tif);
--	n=(tmsize_t)m;
--	if ((uint64)n!=m)
--	{
--		TIFFErrorExt(tif->tif_clientdata,module,"Integer arithmetic overflow");
--		n=0;
--	}
--	return(n);
-+	return _TIFFCastUInt64ToSSize(tif, m, module);
- }
- 
- /* vim: set ts=8 sts=8 sw=8 noet: */
-diff -ru tiff-4.0.10-orig/libtiff/tif_tile.c tiff-4.0.10/libtiff/tif_tile.c
---- tiff-4.0.10-orig/libtiff/tif_tile.c	2017-12-02 16:21:47.993972977 +0100
-+++ tiff-4.0.10/libtiff/tif_tile.c	2019-10-02 22:35:17.395184517 +0200
-@@ -181,15 +181,8 @@
- {
- 	static const char module[] = "TIFFTileRowSize";
- 	uint64 m;
--	tmsize_t n;
- 	m=TIFFTileRowSize64(tif);
--	n=(tmsize_t)m;
--	if ((uint64)n!=m)
--	{
--		TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
--		n=0;
--	}
--	return(n);
-+	return _TIFFCastUInt64ToSSize(tif, m, module);
- }
- 
- /*
-@@ -248,15 +241,8 @@
- {
- 	static const char module[] = "TIFFVTileSize";
- 	uint64 m;
--	tmsize_t n;
- 	m=TIFFVTileSize64(tif,nrows);
--	n=(tmsize_t)m;
--	if ((uint64)n!=m)
--	{
--		TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
--		n=0;
--	}
--	return(n);
-+	return _TIFFCastUInt64ToSSize(tif, m, module);
- }
- 
- /*
-@@ -272,15 +258,8 @@
- {
- 	static const char module[] = "TIFFTileSize";
- 	uint64 m;
--	tmsize_t n;
- 	m=TIFFTileSize64(tif);
--	n=(tmsize_t)m;
--	if ((uint64)n!=m)
--	{
--		TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
--		n=0;
--	}
--	return(n);
-+	return _TIFFCastUInt64ToSSize(tif, m, module);
- }
- 
- /*
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index fba174d171f6..795ed439093b 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -9,29 +9,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "4.0.10";
+  version = "4.1.0";
   pname = "libtiff";
 
   src = fetchurl {
     url = "https://download.osgeo.org/libtiff/tiff-${version}.tar.gz";
-    sha256 = "1r4np635gr6zlc0bic38dzvxia6iqzcrary4n1ylarzpr8fd2lic";
+    sha256 = "0d46bdvxdiv59lxnb0xz9ywm8arsr6xsapi5s6y6vnys2wjz6aax";
   };
 
-  patches = [
-    (fetchurl {
-      url = "https://gitlab.com/libtiff/libtiff/commit/0c74a9f49b8d7a36b17b54a7428b3526d20f88a8.patch";
-      name = "CVE-2019-6128.patch";
-      sha256 = "03yvsfq6dxjd3v8ypfwz6cpz2iymqwcbawqqlmkh40dayi7fgizr";
-    })
-    (fetchurl {
-      url = "https://gitlab.com/libtiff/libtiff/commit/802d3cbf3043be5dce5317e140ccb1c17a6a2d39.patch";
-      name = "CVE-2019-7663.patch";
-      sha256 = "01nq5z1l55clasy4aqr0r2rgiaxay1108vni2nzd8lx4qc5q09hx";
-    })
-    # Manual backport of https://gitlab.com/libtiff/libtiff/commit/1b5e3b6a23827c33acf19ad50ce5ce78f12b3773.patch
-    ./CVE-2019-14973.patch
-  ];
-
   outputs = [ "bin" "dev" "out" "man" "doc" ];
 
   nativeBuildInputs = [ pkgconfig ];

From d3cf60344bedc94b7f83528c8059cf19637c1a0a Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Thu, 7 Nov 2019 14:29:28 -0800
Subject: [PATCH 042/144] zotero: 5.0.73 -> 5.0.77 (#72693)

---
 pkgs/applications/office/zotero/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/office/zotero/default.nix b/pkgs/applications/office/zotero/default.nix
index 334a380d9147..34dace1cadb0 100644
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@@ -34,11 +34,11 @@
 
 stdenv.mkDerivation rec {
   pname = "zotero";
-  version = "5.0.73";
+  version = "5.0.77";
 
   src = fetchurl {
     url = "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    sha256 = "0m2i3l0gy22h6c7rk39cd17vyksyz5l5py2fn9pza8lcbypkwf3l";
+    sha256 = "1dgxzprpb8f5wpmvlvkxix0xxckfgjsi3wfcy9mb221a17cv0029";
   };
 
   buildInputs= [ wrapGAppsHook gsettings-desktop-schemas gtk3 gnome3.adwaita-icon-theme gnome3.dconf ];

From 770a4c7946a1c55bf6295a34a42e1c4b657d1088 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 5 Nov 2019 19:11:37 -0500
Subject: [PATCH 043/144] glib: Fix setup hook

It was not robust against multiple matching directories, as the called
function takes exactly 3 arguments.
---
 pkgs/development/libraries/glib/setup-hook.sh | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/glib/setup-hook.sh b/pkgs/development/libraries/glib/setup-hook.sh
index a1cb1f40c58a..20714ea7ab87 100644
--- a/pkgs/development/libraries/glib/setup-hook.sh
+++ b/pkgs/development/libraries/glib/setup-hook.sh
@@ -1,9 +1,11 @@
 
 make_glib_find_gsettings_schemas() {
     # For packages that need gschemas of other packages (e.g. empathy)
-    if [ -d "$1"/share/gsettings-schemas/*/glib-2.0/schemas ]; then
-        addToSearchPath GSETTINGS_SCHEMAS_PATH "$1/share/gsettings-schemas/"*
-    fi
+    for maybe_dir in "$1"/share/gsettings-schemas/*/glib-2.0; do
+        if [[ -d "$maybe_dir/schemas" ]]; then
+            addToSearchPath GSETTINGS_SCHEMAS_PATH "$maybe_dir"
+        fi
+    done
 }
 addEnvHooks "$hostOffset" make_glib_find_gsettings_schemas
 

From 42ffaf5290ec7c896c73d160151526041165115b Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 5 Nov 2019 19:16:36 -0500
Subject: [PATCH 044/144] cmake: NIX_CFLAGS_COMPILE NIX_LDFLAG could be
 undefined

---
 pkgs/development/tools/build-managers/cmake/setup-hook.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/build-managers/cmake/setup-hook.sh b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
index d5e88d773f67..52b9c3ab5f55 100755
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
@@ -125,7 +125,7 @@ addEnvHooks "$targetOffset" addCMakeParams
 makeCmakeFindLibs(){
   isystem_seen=
   iframework_seen=
-  for flag in $NIX_CFLAGS_COMPILE $NIX_LDFLAGS; do
+  for flag in ${NIX_CFLAGS_COMPILE-} ${NIX_LDFLAGS-}; do
     if test -n "$isystem_seen" && test -d "$flag"; then
       isystem_seen=
       export CMAKE_INCLUDE_PATH="${CMAKE_INCLUDE_PATH-}${CMAKE_INCLUDE_PATH:+:}${flag}"

From 9167482d1275f2b17416ffcb18873237739f68c2 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 5 Nov 2019 19:19:14 -0500
Subject: [PATCH 045/144] opensp: `sgmlHookDone` can be undefined

---
 pkgs/tools/text/sgml/opensp/setup-hook.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/tools/text/sgml/opensp/setup-hook.sh b/pkgs/tools/text/sgml/opensp/setup-hook.sh
index 753a3ea64287..5bace3c66889 100644
--- a/pkgs/tools/text/sgml/opensp/setup-hook.sh
+++ b/pkgs/tools/text/sgml/opensp/setup-hook.sh
@@ -6,7 +6,7 @@ addSGMLCatalogs () {
       fi
 }
 
-if test -z "$sgmlHookDone"; then
+if test -z "${sgmlHookDone-}"; then
     sgmlHookDone=1
 
     # Set http_proxy and ftp_proxy to a invalid host to prevent

From 67cc85ec679eb16dc38908dfe78218544e637ee8 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 5 Nov 2019 19:43:24 -0500
Subject: [PATCH 046/144] OCaml findlib: OCAMLPATH could be undefined

---
 pkgs/development/tools/ocaml/findlib/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/ocaml/findlib/default.nix b/pkgs/development/tools/ocaml/findlib/default.nix
index fb1eb4276d62..7d95963209a3 100644
--- a/pkgs/development/tools/ocaml/findlib/default.nix
+++ b/pkgs/development/tools/ocaml/findlib/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   setupHook = writeText "setupHook.sh" ''
     addOCamlPath () {
         if test -d "''$1/lib/ocaml/${ocaml.version}/site-lib"; then
-            export OCAMLPATH="''${OCAMLPATH}''${OCAMLPATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/"
+            export OCAMLPATH="''${OCAMLPATH-}''${OCAMLPATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/"
         fi
         if test -d "''$1/lib/ocaml/${ocaml.version}/site-lib/stublibs"; then
             export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/stublibs"

From 0b90a7f67f4df722a5c29773fcf8376d631f1fc8 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 5 Nov 2019 19:45:48 -0500
Subject: [PATCH 047/144] lispPackages.clwrapper: NIX_LISP_LD_LIBRARY_PATH
 might be undefined

---
 pkgs/development/lisp-modules/clwrapper/setup-hook.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/lisp-modules/clwrapper/setup-hook.sh b/pkgs/development/lisp-modules/clwrapper/setup-hook.sh
index 8975ada53206..da2303a18bfb 100644
--- a/pkgs/development/lisp-modules/clwrapper/setup-hook.sh
+++ b/pkgs/development/lisp-modules/clwrapper/setup-hook.sh
@@ -27,7 +27,7 @@ setLisp () {
 
 collectNixLispLDLP () {
      if echo "$1/lib"/lib*.so* | grep . > /dev/null; then
-	 export NIX_LISP_LD_LIBRARY_PATH="$NIX_LISP_LD_LIBRARY_PATH${NIX_LISP_LD_LIBRARY_PATH:+:}$1/lib"
+	 export NIX_LISP_LD_LIBRARY_PATH="${NIX_LISP_LD_LIBRARY_PATH-}${NIX_LISP_LD_LIBRARY_PATH:+:}$1/lib"
      fi
 }
 

From aaf0fd2c445d9d3bd686702d4b644d24ed3b10f3 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 5 Nov 2019 19:50:42 -0500
Subject: [PATCH 048/144] lua-5 setup hook: LUA_PATH and LUA_CPATH can be
 undefined

---
 pkgs/development/interpreters/lua-5/setup-hook.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/lua-5/setup-hook.sh b/pkgs/development/interpreters/lua-5/setup-hook.sh
index f7e56b62ac90..1c445b82afde 100644
--- a/pkgs/development/interpreters/lua-5/setup-hook.sh
+++ b/pkgs/development/interpreters/lua-5/setup-hook.sh
@@ -20,7 +20,7 @@ addToLuaSearchPathWithCustomDelimiter() {
   if [[ ! -d "$topDir" ]]; then return; fi
 
   # export only if we haven't already got this dir in the search path
-  if [[ ${!varName} == *"$absPattern"* ]]; then return; fi
+  if [[ ${!varName-} == *"$absPattern"* ]]; then return; fi
 
   export "${varName}=${!varName:+${!varName};}${absPattern}"
 }

From b78e84097fab550f365d39ca715632c7b9abd379 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 7 Nov 2019 15:05:23 -0500
Subject: [PATCH 049/144] gdk-pixbuf setup hook: GDK_PIXBUF_MODULE_FILE might
 not be defined

Also switch to [[ ... ]] because it is more robust w.r.t. empty
arguments.
---
 pkgs/development/libraries/gdk-pixbuf/setup-hook.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh b/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
index 5a7dcd792996..8b6c80867a03 100644
--- a/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
+++ b/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
@@ -2,9 +2,9 @@ findGdkPixbufLoaders() {
 
 	# choose the longest loaders.cache
 	local loadersCache="$1/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"
-	if [ -f "$loadersCache" ]; then
-		if [ -f "$GDK_PIXBUF_MODULE_FILE" ]; then
-			if [ $(cat "$loadersCache"|wc -l) -gt $(cat "$GDK_PIXBUF_MODULE_FILE"|wc -l) ]; then
+	if [[ -f "$loadersCache" ]]; then
+		if [[ -f "${GDK_PIXBUF_MODULE_FILE-}" ]]; then
+			if [[ "$(cat "$loadersCache" | wc -l)" > "$(cat "$GDK_PIXBUF_MODULE_FILE" | wc -l)" ]]; then
 				export GDK_PIXBUF_MODULE_FILE="$loadersCache"
 			fi
 		else

From beda0365a64f025c26212cb69ffbb09f3ef329fd Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 7 Nov 2019 15:12:29 -0500
Subject: [PATCH 050/144] darwin private frameworks setup hook:
 NIX_CFLAGS_COMPILE may be undefined

---
 .../darwin/apple-sdk/private-frameworks-setup-hook.sh           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh
index fbd977f8552d..a351c39de130 100644
--- a/pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh
+++ b/pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh
@@ -1,6 +1,6 @@
 addPrivateFrameworks() {
     flag="-F/System/Library/PrivateFrameworks"
-    if [[ "$NIX_CFLAGS_COMPILE" != *$flag* ]]; then
+    if [[ "${NIX_CFLAGS_COMPILE-}" != *$flag* ]]; then
         NIX_CFLAGS_COMPILE+=" $flag"
     fi
 }

From 12a85a7046503e6ff602663a1d054407a4e3f184 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 7 Nov 2019 15:20:02 -0500
Subject: [PATCH 051/144] SDL, SDL2: SDL{,2}_PATH may be undefined

---
 pkgs/development/libraries/SDL/setup-hook.sh  | 2 +-
 pkgs/development/libraries/SDL2/setup-hook.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/SDL/setup-hook.sh b/pkgs/development/libraries/SDL/setup-hook.sh
index 20382f18f529..32a7d0d95548 100644
--- a/pkgs/development/libraries/SDL/setup-hook.sh
+++ b/pkgs/development/libraries/SDL/setup-hook.sh
@@ -1,6 +1,6 @@
 addSDLPath () {
   if [ -e "$1/include/SDL" ]; then
-    export SDL_PATH="$SDL_PATH $1/include/SDL"
+    export SDL_PATH="${SDL_PATH-}${SDL_PATH:+ }$1/include/SDL"
   fi
 }
 
diff --git a/pkgs/development/libraries/SDL2/setup-hook.sh b/pkgs/development/libraries/SDL2/setup-hook.sh
index 3acce9d473c5..0119926491af 100644
--- a/pkgs/development/libraries/SDL2/setup-hook.sh
+++ b/pkgs/development/libraries/SDL2/setup-hook.sh
@@ -1,6 +1,6 @@
 addSDL2Path () {
   if [ -e "$1/include/SDL2" ]; then
-    export SDL2_PATH="$SDL2_PATH $1/include/SDL2"
+    export SDL2_PATH="${SDL2_PATH-}${SDL2_PATH:+ }$1/include/SDL2"
   fi
 }
 

From 908b143e510a0d6275d1960334e488173241251c Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 7 Nov 2019 16:31:55 -0500
Subject: [PATCH 052/144] gstreamer: GST_PLUGIN_SYSTEM_PATH.* may be undefined

---
 pkgs/development/libraries/gstreamer/core/setup-hook.sh         | 2 +-
 .../libraries/gstreamer/legacy/gstreamer/setup-hook.sh          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/core/setup-hook.sh b/pkgs/development/libraries/gstreamer/core/setup-hook.sh
index b8c741af578f..026a4e5f55a0 100644
--- a/pkgs/development/libraries/gstreamer/core/setup-hook.sh
+++ b/pkgs/development/libraries/gstreamer/core/setup-hook.sh
@@ -1,7 +1,7 @@
 addGstreamer1LibPath () {
     if test -d "$1/lib/gstreamer-1.0"
     then
-        export GST_PLUGIN_SYSTEM_PATH_1_0="${GST_PLUGIN_SYSTEM_PATH_1_0}${GST_PLUGIN_SYSTEM_PATH_1_0:+:}$1/lib/gstreamer-1.0"
+        export GST_PLUGIN_SYSTEM_PATH_1_0="${GST_PLUGIN_SYSTEM_PATH_1_0-}${GST_PLUGIN_SYSTEM_PATH_1_0:+:}$1/lib/gstreamer-1.0"
     fi
 }
 
diff --git a/pkgs/development/libraries/gstreamer/legacy/gstreamer/setup-hook.sh b/pkgs/development/libraries/gstreamer/legacy/gstreamer/setup-hook.sh
index 65ce26112519..636e20b732b4 100644
--- a/pkgs/development/libraries/gstreamer/legacy/gstreamer/setup-hook.sh
+++ b/pkgs/development/libraries/gstreamer/legacy/gstreamer/setup-hook.sh
@@ -1,7 +1,7 @@
 addGstreamerLibPath () {
     if test -d "$1/lib/gstreamer-0.10"
     then
-        export GST_PLUGIN_SYSTEM_PATH="${GST_PLUGIN_SYSTEM_PATH}${GST_PLUGIN_SYSTEM_PATH:+:}$1/lib/gstreamer-0.10"
+        export GST_PLUGIN_SYSTEM_PATH="${GST_PLUGIN_SYSTEM_PATH-}${GST_PLUGIN_SYSTEM_PATH:+:}$1/lib/gstreamer-0.10"
     fi
 }
 

From 6fb526b32c86bb3e5fdf5694e23f2f53d7d892ce Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 7 Nov 2019 17:12:25 -0500
Subject: [PATCH 053/144] findlib setup hook: `createFindlibDestdir` may not be
 defined

---
 pkgs/development/tools/ocaml/findlib/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/ocaml/findlib/default.nix b/pkgs/development/tools/ocaml/findlib/default.nix
index 7d95963209a3..4398d8e41881 100644
--- a/pkgs/development/tools/ocaml/findlib/default.nix
+++ b/pkgs/development/tools/ocaml/findlib/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
             export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/stublibs"
         fi
         export OCAMLFIND_DESTDIR="''$out/lib/ocaml/${ocaml.version}/site-lib/"
-        if test -n "$createFindlibDestdir"; then
+        if test -n "''${createFindlibDestdir-}"; then
           mkdir -p $OCAMLFIND_DESTDIR
         fi
     }

From f1481f2c9084d61cb5ebc55d4fa7edbc756128d3 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 7 Nov 2019 17:17:41 -0500
Subject: [PATCH 054/144] apple-sdk setup hooks: NIX_CFLAGS_COMPILE may be
 undefined

---
 pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh       | 2 +-
 pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh
index 66e24fe58770..86c241cd0f56 100644
--- a/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh
+++ b/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh
@@ -1,5 +1,5 @@
 linkSystemCoreFoundationFramework() {
-  NIX_CFLAGS_COMPILE="-F@out@/Library/Frameworks $NIX_CFLAGS_COMPILE"
+  NIX_CFLAGS_COMPILE="-F@out@/Library/Frameworks${NIX_CFLAGS_COMPILE:+ }${NIX_CFLAGS_COMPILE-}"
   # gross! many symbols (such as _OBJC_CLASS_$_NSArray) are defined in system CF, but not
   # in the opensource release
   # if the package needs private headers, we assume they also want to link with system CF
diff --git a/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh
index ed9bdbd912db..35cea773f98b 100644
--- a/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh
+++ b/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh
@@ -2,7 +2,7 @@ noDeprecatedDeclarations() {
   # Security.framework has about 2000 deprecated constants, all of which the user will be
   # warned about at compilation time
   flag="-Wno-deprecated-declarations"
-  if [[ "$NIX_CFLAGS_COMPILE" != *$flag* ]]; then
+  if [[ "${NIX_CFLAGS_COMPILE-}" != *$flag* ]]; then
     NIX_CFLAGS_COMPILE+=" $flag"
   fi
 }

From ca782498a9532c48d8e12ce402813486ab90e7f0 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 7 Nov 2019 18:24:49 -0500
Subject: [PATCH 055/144] emacs package setup hook: Fix

1. Make the test more robust

2. EMACSLOADPATH may be initially undefined.

3. did `targetOffset` twice when meant `hostOffset` too
---
 pkgs/build-support/emacs/setup-hook.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/build-support/emacs/setup-hook.sh b/pkgs/build-support/emacs/setup-hook.sh
index e1db3e828fd7..b55c18738023 100644
--- a/pkgs/build-support/emacs/setup-hook.sh
+++ b/pkgs/build-support/emacs/setup-hook.sh
@@ -1,11 +1,11 @@
 addEmacsVars () {
-  if test -d $1/share/emacs/site-lisp; then
-      export EMACSLOADPATH="$1/share/emacs/site-lisp:$EMACSLOADPATH"
+  if [[ -d "$1/share/emacs/site-lisp" ]]; then
+      export EMACSLOADPATH="$1/share/emacs/site-lisp${EMACSLOADPATH:+:}${EMACSLOADPATH-}"
   fi
 }
 
 # If this is for a wrapper derivation, emacs and the dependencies are all
 # run-time dependencies. If this is for precompiling packages into bytecode,
 # emacs is a compile-time dependency of the package.
-addEnvHooks "$targetOffset" addEmacsVars
+addEnvHooks "$hostOffset" addEmacsVars
 addEnvHooks "$targetOffset" addEmacsVars

From 784c3dc0f96ca85561e3a6805b0261d4bfb9f7e0 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 7 Nov 2019 19:39:03 -0500
Subject: [PATCH 056/144] qt5 qmake setup hook: `qmakeFlags` may be undefined

---
 pkgs/development/libraries/qt-5/hooks/qmake-hook.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh b/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
index b785a779c8bc..7f6ddb76ad57 100644
--- a/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
@@ -1,6 +1,6 @@
 . @fix_qmake_libtool@
 
-qmakeFlags=( $qmakeFlags )
+qmakeFlags=( ${qmakeFlags-} )
 
 qmakePrePhase() {
     qmakeFlags=( \

From 57908c1624f93fd5c77b5d6cd094ab6bca8577e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
Date: Sun, 3 Nov 2019 18:36:28 +0100
Subject: [PATCH 057/144] SDL2: Keep .a files on `dontDisableStatic`; don't
 move them to $dev; prune .la.

Most other packages don't move `.a` files to "$dev", and that is because
it makes the pkg-config `.pc` file wrong (the `libdir` is the non-dev one).

Keeping them in the main output makes static linking of SDL2 work.

See added comment about pruning of `.la` files.
---
 pkgs/development/libraries/SDL2/default.nix | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 8fe6bbe61130..e02ea05a7262 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -75,9 +75,21 @@ stdenv.mkDerivation rec {
     ++ optional alsaSupport "--with-alsa-prefix=${alsaLib.out}/lib"
     ++ optional stdenv.isDarwin "--disable-sdltest";
 
+  # We remove libtool .la files when static libs are requested,
+  # because they make the builds of downstream libs like `SDL_tff`
+  # fail with `cannot find -lXext, `-lXcursor` etc. linker errors
+  # because the `.la` files are not pruned if static libs exist
+  # (see https://github.com/NixOS/nixpkgs/commit/fd97db43bcb05e37f6bb77f363f1e1e239d9de53)
+  # and they also don't carry the necessary `-L` paths of their
+  # X11 dependencies.
+  # For static linking, it is better to rely on `pkg-config` `.pc`
+  # files.
   postInstall = ''
-    moveToOutput lib/libSDL2main.a "$dev"
-    rm $out/lib/*.a
+    if [ "$dontDisableStatic" -eq "1" ]; then
+      rm $out/lib/*.la
+    else
+      rm $out/lib/*.a
+    fi
     moveToOutput bin/sdl2-config "$dev"
   '';
 

From 832f46a703ac46d93e3f5be6c1a39a9fb7f7e9f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sat, 9 Nov 2019 07:50:11 +0100
Subject: [PATCH 058/144] gst-plugins-base: use fetchpatch for better hash
 stability

/cc original PR #70283.
---
 .../libraries/gstreamer/legacy/gst-plugins-base/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix
index 5a942b49cc03..eed9d423fdb9 100644
--- a/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix
+++ b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, pkgconfig, gstreamer, xorg, alsaLib, cdparanoia
+{ fetchurl, fetchpatch, stdenv, pkgconfig, gstreamer, xorg, alsaLib, cdparanoia
 , libogg, libtheora, libvorbis, freetype, pango, liboil, glib, cairo, orc
 , libintl
 , ApplicationServices
@@ -20,10 +20,10 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./gcc-4.9.patch
-    (fetchurl {
+    (fetchpatch {
       url = "https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/f672277509705c4034bc92a141eefee4524d15aa.patch";
       name = "CVE-2019-9928.patch";
-      sha256 = "0hz3lsq3ppmaf329sbyi05y1qniqfj9vlp2f3z918383pvrcms4i";
+      sha256 = "1dlamsmyr7chrb6vqqmwikqvvqcx5l7k72p98448qm6k59ndnimc";
     })
   ];
 

From f6eb4b065b2011d0a45cba8c77d3caccff9911de Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:28:41 +0000
Subject: [PATCH 059/144] kodi: Don't use libGLU_combined

---
 pkgs/applications/video/kodi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/video/kodi/default.nix b/pkgs/applications/video/kodi/default.nix
index 7953cde24139..8edc99c5f028 100644
--- a/pkgs/applications/video/kodi/default.nix
+++ b/pkgs/applications/video/kodi/default.nix
@@ -8,7 +8,7 @@
 , libXt, libXmu, libXext
 , libXinerama, libXrandr
 , libXtst, libXfixes, systemd
-, alsaLib, libGLU_combined, glew, fontconfig, freetype, ftgl
+, alsaLib, libGLU, libGL, glew, fontconfig, freetype, ftgl
 , libjpeg, jasper, libpng, libtiff
 , libmpeg2, libsamplerate, libmad
 , libogg, libvorbis, flac, libxslt
@@ -156,7 +156,7 @@ in stdenv.mkDerivation {
       openssl gperf tinyxml2 taglib libssh swig jre
       libX11 xorgproto libXt libXmu libXext
       libXinerama libXrandr libXtst libXfixes
-      alsaLib libGLU_combined glew fontconfig freetype ftgl
+      alsaLib libGL libGLU glew fontconfig freetype ftgl
       libjpeg jasper libpng libtiff
       libmpeg2 libsamplerate libmad
       libogg libvorbis flac libxslt systemd

From 13acfd0e28ddd2ad942d3b210e5bea4940b42aab Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:29:02 +0000
Subject: [PATCH 060/144] maim: Don't use libGLU_combined

---
 pkgs/tools/graphics/maim/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/graphics/maim/default.nix b/pkgs/tools/graphics/maim/default.nix
index 63758e23b150..8f3a4dc5c659 100644
--- a/pkgs/tools/graphics/maim/default.nix
+++ b/pkgs/tools/graphics/maim/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig
-, zlib, libpng, libjpeg, libGLU_combined, glm
+, zlib, libpng, libjpeg, libGLU, libGL, glm
 , libX11, libXext, libXfixes, libXrandr, libXcomposite, slop, icu
 }:
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs =
-    [ zlib libpng libjpeg libGLU_combined glm
+    [ zlib libpng libjpeg libGLU libGL glm
       libX11 libXext libXfixes libXrandr libXcomposite slop icu ];
 
   doCheck = false;

From 5e433b48dc48d56040baf87a603a8f0ac15e0f7a Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:29:26 +0000
Subject: [PATCH 061/144] retroarch: Don't use libGLU_combined

---
 pkgs/misc/emulators/retroarch/cores.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/misc/emulators/retroarch/cores.nix b/pkgs/misc/emulators/retroarch/cores.nix
index ced26333f4cd..9cc8a74c5d7e 100644
--- a/pkgs/misc/emulators/retroarch/cores.nix
+++ b/pkgs/misc/emulators/retroarch/cores.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchgit, fetchFromGitHub, fetchFromGitLab, cmake, pkgconfig, makeWrapper, python27, python37, retroarch
-, alsaLib, fluidsynth, curl, hidapi, libGLU_combined, gettext, glib, gtk2, portaudio, SDL
+, alsaLib, fluidsynth, curl, hidapi, libGLU, gettext, glib, gtk2, portaudio, SDL, libGL
 , ffmpeg, pcre, libevdev, libpng, libjpeg, udev, libvorbis
 , miniupnpc, sfml, xorg, zlib, nasm, libpcap, boost }:
 
@@ -152,7 +152,7 @@ in with stdenv.lib.licenses;
     buildPhase = "make";
     name = "beetle-pce-fast-${der.version}";
   };
-  
+
   beetle-pcfx = (mkLibRetroCore rec {
     core = "mednafen-pcfx";
     src = fetchRetro {
@@ -197,7 +197,7 @@ in with stdenv.lib.licenses;
     name = "beetle-saturn-${der.version}";
     meta.platforms = [ "x86_64-linux" "aarch64-linux" ];
   };
-  
+
   beetle-supergrafx = (mkLibRetroCore rec {
     core = "mednafen-supergrafx";
     src = fetchRetro {
@@ -323,7 +323,7 @@ in with stdenv.lib.licenses;
       "-DENABLE_QT=OFF"
       "-DENABLE_LTO=OFF"
       "-DUSE_UPNP=OFF"
-      "-DUSE_DISCORD_PRESENCE=OFF" 
+      "-DUSE_DISCORD_PRESENCE=OFF"
     ];
     dontUseCmakeBuildDir = "yes";
     buildPhase = "make";
@@ -380,7 +380,7 @@ in with stdenv.lib.licenses;
     };
     description = "Flycast libretro port";
     license = gpl2;
-    extraBuildInputs = [ libGLU_combined ];
+    extraBuildInputs = [ libGL libGLU ];
   }).override {
     makefile = "Makefile";
     buildPhase = "make";
@@ -633,7 +633,7 @@ in with stdenv.lib.licenses;
     makefile = "libretro/Makefile";
     buildPhase = "cd libretro && make";
   };
- 
+
   o2em = (mkLibRetroCore rec {
     core = "o2em";
     src = fetchRetro {
@@ -647,7 +647,7 @@ in with stdenv.lib.licenses;
     makefile = "Makefile";
     buildPhase = "make";
   };
- 
+
   parallel-n64 = (mkLibRetroCore rec {
     core = "parallel-n64";
     src = fetchRetro {
@@ -677,7 +677,7 @@ in with stdenv.lib.licenses;
     configurePhase = "rm configure";
     buildPhase = "make -f Makefile.libretro";
   };
-  
+
   picodrive = (mkLibRetroCore rec {
     core = "picodrive";
     src = fetchRetro {

From d053944e7baadffd3e443ff7e76c87be86cc0d53 Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:30:37 +0000
Subject: [PATCH 062/144] octave: Don't use libGLU_combined

---
 pkgs/development/interpreters/octave/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/octave/default.nix b/pkgs/development/interpreters/octave/default.nix
index cc9f6fcc3c90..66f717385371 100644
--- a/pkgs/development/interpreters/octave/default.nix
+++ b/pkgs/development/interpreters/octave/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, gfortran, readline, ncurses, perl, flex, texinfo, qhull
-, libsndfile, portaudio, libX11, graphicsmagick, pcre, pkgconfig, libGLU_combined, fltk
+, libsndfile, portaudio, libX11, graphicsmagick, pcre, pkgconfig, libGL, libGLU, fltk
 , fftw, fftwSinglePrec, zlib, curl, qrupdate, openblas, arpack, libwebp
 , qt ? null, qscintilla ? null, ghostscript ? null, llvm ? null, hdf5 ? null,glpk ? null
 , suitesparse ? null, gnuplot ? null, jdk ? null, python ? null, overridePlatforms ? null
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     ++ (stdenv.lib.optional (jdk != null) jdk)
     ++ (stdenv.lib.optional (gnuplot != null) gnuplot)
     ++ (stdenv.lib.optional (python != null) python)
-    ++ (stdenv.lib.optionals (!stdenv.isDarwin) [ libGLU_combined libX11 ])
+    ++ (stdenv.lib.optionals (!stdenv.isDarwin) [ libGL libGLU libX11 ])
     ;
 
   # makeinfo is required by Octave at runtime to display help

From cd1a02a4ba453833829a0fa870d2f42cc59d929e Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:31:13 +0000
Subject: [PATCH 063/144] pythonPackages.pyside: Add missing input libGL

---
 pkgs/development/python-modules/pyside/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyside/default.nix b/pkgs/development/python-modules/pyside/default.nix
index 37ffd8e76e30..3f20a6ae4781 100644
--- a/pkgs/development/python-modules/pyside/default.nix
+++ b/pkgs/development/python-modules/pyside/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, cmake, buildPythonPackage, pysideGeneratorrunner, pysideShiboken, qt4, mesa }:
+{ lib, fetchurl, cmake, buildPythonPackage, pysideGeneratorrunner, pysideShiboken, qt4, mesa, libGL }:
 
 # This derivation provides a Python module and should therefore be called via `python-packages.nix`.
 buildPythonPackage rec {
@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ cmake pysideGeneratorrunner pysideShiboken qt4 ];
 
-  buildInputs = [ mesa ];
+  buildInputs = [ mesa libGL ];
 
   makeFlags = "QT_PLUGIN_PATH=" + pysideShiboken + "/lib/generatorrunner";
 

From 5d24b1e97a3e17603edd5cc5bc086f526b548fe0 Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:32:21 +0000
Subject: [PATCH 064/144] webkitgtk: Don't use libGLU_combined

---
 .../libraries/webkitgtk/default.nix           |   6 +-
 .../webkitgtk/libglvnd-headers.patch          | 586 ++++++++++++++++++
 2 files changed, 590 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/development/libraries/webkitgtk/libglvnd-headers.patch

diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 7d48b68d14c7..34b83d12d09f 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -2,7 +2,7 @@
 , pkgconfig, gettext, gobject-introspection, libnotify, gnutls, libgcrypt
 , gtk3, wayland, libwebp, enchant2, xorg, libxkbcommon, epoxy, at-spi2-core
 , libxml2, libsoup, libsecret, libxslt, harfbuzz, libpthreadstubs, pcre, nettle, libtasn1, p11-kit
-, libidn, libedit, readline, libGLU_combined, libintl, openjpeg
+, libidn, libedit, readline, libGL, libGLU, libintl, openjpeg
 , enableGeoLocation ? true, geoclue2, sqlite
 , enableGtk2Plugins ? false, gtk2 ? null
 , gst-plugins-base, gst-plugins-bad, woff2
@@ -37,6 +37,7 @@ stdenv.mkDerivation rec {
       src = ./fix-bubblewrap-paths.patch;
       inherit (builtins) storeDir;
     })
+    ./libglvnd-headers.patch
   ];
 
   postPatch = ''
@@ -74,10 +75,11 @@ stdenv.mkDerivation rec {
     libintl libwebp enchant2 libnotify gnutls pcre nettle libidn libgcrypt woff2
     libxml2 libsecret libxslt harfbuzz libpthreadstubs libtasn1 p11-kit openjpeg
     sqlite gst-plugins-base gst-plugins-bad libxkbcommon epoxy at-spi2-core
+    libGL libGLU
   ] ++ optional enableGeoLocation geoclue2
     ++ optional enableGtk2Plugins gtk2
     ++ (with xorg; [ libXdmcp libXt libXtst libXdamage ])
-    ++ optionals stdenv.isDarwin [ libedit readline libGLU_combined ]
+    ++ optionals stdenv.isDarwin [ libedit readline ]
     ++ optionals stdenv.isLinux [
       wayland bubblewrap libseccomp xdg-dbus-proxy
   ];
diff --git a/pkgs/development/libraries/webkitgtk/libglvnd-headers.patch b/pkgs/development/libraries/webkitgtk/libglvnd-headers.patch
new file mode 100644
index 000000000000..17264f3b5886
--- /dev/null
+++ b/pkgs/development/libraries/webkitgtk/libglvnd-headers.patch
@@ -0,0 +1,586 @@
+diff --git a/Source/ThirdParty/ANGLE/scripts/generate_loader.py b/Source/ThirdParty/ANGLE/scripts/generate_loader.py
+index a408dac4..92ddca90 100644
+--- a/Source/ThirdParty/ANGLE/scripts/generate_loader.py
++++ b/Source/ThirdParty/ANGLE/scripts/generate_loader.py
+@@ -201,6 +201,8 @@ def main():
+ 
+ libegl_preamble = """#include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
++#include <EGL/eglmesaext.h>
+ """
+ 
+ util_gles_preamble = """#if defined(GL_GLES_PROTOTYPES) && GL_GLES_PROTOTYPES
+@@ -215,6 +217,8 @@ util_egl_preamble = """#include "util/util_export.h"
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
++#include <EGL/eglmesaext.h>
+ """
+ 
+ util_wgl_preamble = """
+diff --git a/Source/ThirdParty/ANGLE/src/common/PackedEGLEnums_autogen.h b/Source/ThirdParty/ANGLE/src/common/PackedEGLEnums_autogen.h
+index 68c65d8b..0dc9c8e3 100644
+--- a/Source/ThirdParty/ANGLE/src/common/PackedEGLEnums_autogen.h
++++ b/Source/ThirdParty/ANGLE/src/common/PackedEGLEnums_autogen.h
+@@ -14,6 +14,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <angle_gl.h>
+ 
+ #include <cstdint>
+diff --git a/Source/ThirdParty/ANGLE/src/common/PackedGLEnums_autogen.h b/Source/ThirdParty/ANGLE/src/common/PackedGLEnums_autogen.h
+index cd651150..17719bc2 100644
+--- a/Source/ThirdParty/ANGLE/src/common/PackedGLEnums_autogen.h
++++ b/Source/ThirdParty/ANGLE/src/common/PackedGLEnums_autogen.h
+@@ -14,6 +14,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <angle_gl.h>
+ 
+ #include <cstdint>
+diff --git a/Source/ThirdParty/ANGLE/src/common/gen_packed_gl_enums.py b/Source/ThirdParty/ANGLE/src/common/gen_packed_gl_enums.py
+index 2f77e725..5ea54f1f 100644
+--- a/Source/ThirdParty/ANGLE/src/common/gen_packed_gl_enums.py
++++ b/Source/ThirdParty/ANGLE/src/common/gen_packed_gl_enums.py
+@@ -71,6 +71,7 @@ header_template = """// GENERATED FILE - DO NOT EDIT.
+ #include <angle_gl.h>
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include <cstdint>
+ 
+diff --git a/Source/ThirdParty/ANGLE/src/common/utilities.h b/Source/ThirdParty/ANGLE/src/common/utilities.h
+index 7a1429a4..dd20bcca 100644
+--- a/Source/ThirdParty/ANGLE/src/common/utilities.h
++++ b/Source/ThirdParty/ANGLE/src/common/utilities.h
+@@ -11,6 +11,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include <math.h>
+ #include <string>
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/Config.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/Config.cpp
+index 4134226d..5dd1065f 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/Config.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/Config.cpp
+@@ -15,6 +15,7 @@
+ #include <vector>
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include "angle_gl.h"
+ 
+ #include "common/debug.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/Device.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/Device.cpp
+index 13ae4e61..b964b755 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/Device.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/Device.cpp
+@@ -12,6 +12,7 @@
+ #include <iterator>
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <platform/Platform.h>
+ 
+ #include "common/debug.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/Display.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/Display.cpp
+index 21064073..a46628bd 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/Display.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/Display.cpp
+@@ -17,6 +17,7 @@
+ #include <vector>
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <platform/Platform.h>
+ 
+ #include "common/debug.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/Error.h b/Source/ThirdParty/ANGLE/src/libANGLE/Error.h
+index 37df5b0c..b2e3885b 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/Error.h
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/Error.h
+@@ -11,6 +11,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include "angle_gl.h"
+ #include "common/angleutils.h"
+ #include "common/debug.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/Stream.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/Stream.cpp
+index b7bc84c8..538cb3e0 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/Stream.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/Stream.cpp
+@@ -10,6 +10,7 @@
+ #include "libANGLE/Stream.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <platform/Platform.h>
+ 
+ #include "common/debug.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/Stream.h b/Source/ThirdParty/ANGLE/src/libANGLE/Stream.h
+index 9157aa51..d8e58f2d 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/Stream.h
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/Stream.h
+@@ -14,6 +14,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "common/angleutils.h"
+ #include "libANGLE/AttributeMap.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/Surface.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/Surface.cpp
+index 6daec4f6..941f34ca 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/Surface.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/Surface.cpp
+@@ -11,6 +11,7 @@
+ #include "libANGLE/Surface.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "libANGLE/Config.h"
+ #include "libANGLE/Context.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/SurfaceImpl.h b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/SurfaceImpl.h
+index ea1a0510..db7cf0c8 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/SurfaceImpl.h
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/SurfaceImpl.h
+@@ -11,6 +11,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "common/angleutils.h"
+ #include "libANGLE/Error.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/DeviceD3D.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/DeviceD3D.cpp
+index ba5cf532..43304da5 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/DeviceD3D.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/DeviceD3D.cpp
+@@ -13,6 +13,7 @@
+ #include "libANGLE/Display.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ namespace rx
+ {
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/DisplayD3D.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/DisplayD3D.cpp
+index de60dfff..93b5bdf8 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/DisplayD3D.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/DisplayD3D.cpp
+@@ -9,6 +9,7 @@
+ #include "libANGLE/renderer/d3d/DisplayD3D.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "libANGLE/Config.h"
+ #include "libANGLE/Context.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/EGLImageD3D.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/EGLImageD3D.cpp
+index a7255d0d..a7e37777 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/EGLImageD3D.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/EGLImageD3D.cpp
+@@ -20,6 +20,7 @@
+ #include "libANGLE/renderer/d3d/TextureStorage.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ namespace rx
+ {
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/SurfaceD3D.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/SurfaceD3D.cpp
+index 61dc8ffa..87276514 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/SurfaceD3D.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/SurfaceD3D.cpp
+@@ -19,6 +19,7 @@
+ #include "libANGLE/renderer/d3d/d3d11/formatutils11.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <tchar.h>
+ #include <algorithm>
+ 
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/SwapChainD3D.h b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/SwapChainD3D.h
+index 443cadd6..e64bdfc4 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/SwapChainD3D.h
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/SwapChainD3D.h
+@@ -12,6 +12,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <GLES2/gl2.h>
+ 
+ #include "common/angleutils.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Renderer11.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Renderer11.cpp
+index 33dfa6b0..eb3393d2 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Renderer11.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Renderer11.cpp
+@@ -9,6 +9,7 @@
+ #include "libANGLE/renderer/d3d/d3d11/Renderer11.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <versionhelpers.h>
+ #include <sstream>
+ 
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/SwapChain11.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/SwapChain11.cpp
+index fe4def6e..2550b52c 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/SwapChain11.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/SwapChain11.cpp
+@@ -9,6 +9,7 @@
+ #include "libANGLE/renderer/d3d/d3d11/SwapChain11.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "libANGLE/features.h"
+ #include "libANGLE/renderer/d3d/DisplayD3D.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d9/Renderer9.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d9/Renderer9.cpp
+index f4a4ce43..0cad5540 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d9/Renderer9.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d9/Renderer9.cpp
+@@ -9,6 +9,7 @@
+ #include "libANGLE/renderer/d3d/d3d9/Renderer9.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <sstream>
+ 
+ #include "common/utilities.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/DisplayGL.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/DisplayGL.cpp
+index a89e1365..0fe4fa98 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/DisplayGL.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/DisplayGL.cpp
+@@ -18,6 +18,7 @@
+ #include "libANGLE/renderer/gl/SurfaceGL.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ namespace rx
+ {
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/RendererGL.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/RendererGL.cpp
+index 10b15594..7ae1ac6b 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/RendererGL.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/RendererGL.cpp
+@@ -9,6 +9,7 @@
+ #include "libANGLE/renderer/gl/RendererGL.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "common/debug.h"
+ #include "libANGLE/AttributeMap.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/egl/FunctionsEGL.h b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/egl/FunctionsEGL.h
+index 115a7afb..abb200e6 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/egl/FunctionsEGL.h
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/egl/FunctionsEGL.h
+@@ -11,6 +11,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include <string>
+ #include <vector>
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/egl/ozone/DisplayOzone.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/egl/ozone/DisplayOzone.cpp
+index 47ed6ce0..9d11560c 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/egl/ozone/DisplayOzone.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/egl/ozone/DisplayOzone.cpp
+@@ -14,6 +14,7 @@
+ #include <unistd.h>
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include <drm_fourcc.h>
+ #include <gbm.h>
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/glx/DisplayGLX.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/glx/DisplayGLX.cpp
+index 23b4a5c5..daeb5789 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/glx/DisplayGLX.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/glx/DisplayGLX.cpp
+@@ -9,6 +9,7 @@
+ #include "libANGLE/renderer/gl/glx/DisplayGLX.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <algorithm>
+ #include <cstring>
+ #include <fstream>
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/renderergl_utils.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/renderergl_utils.cpp
+index 698b51e2..32e6126f 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/renderergl_utils.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/renderergl_utils.cpp
+@@ -27,6 +27,7 @@
+ #include "libANGLE/renderer/gl/formatutilsgl.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <algorithm>
+ #include <sstream>
+ 
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/wgl/DXGISwapChainWindowSurfaceWGL.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/wgl/DXGISwapChainWindowSurfaceWGL.cpp
+index 5b686321..16ae890f 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/wgl/DXGISwapChainWindowSurfaceWGL.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/wgl/DXGISwapChainWindowSurfaceWGL.cpp
+@@ -18,6 +18,7 @@
+ #include "libANGLE/renderer/gl/wgl/FunctionsWGL.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ namespace rx
+ {
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/wgl/DisplayWGL.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/wgl/DisplayWGL.cpp
+index 12679ba7..93503812 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/wgl/DisplayWGL.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/wgl/DisplayWGL.cpp
+@@ -28,6 +28,7 @@
+ #include "platform/Platform.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <sstream>
+ #include <string>
+ 
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/RendererVk.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/RendererVk.cpp
+index df900f4d..4385be88 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/RendererVk.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/RendererVk.cpp
+@@ -13,6 +13,7 @@
+ #include "libANGLE/renderer/vulkan/vk_utils.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "common/debug.h"
+ #include "common/platform.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/validationEGL.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/validationEGL.cpp
+index 1c0b25f4..64e96f73 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/validationEGL.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/validationEGL.cpp
+@@ -22,6 +22,7 @@
+ #include "libANGLE/formatutils.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ namespace egl
+ {
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/validationEGL.h b/Source/ThirdParty/ANGLE/src/libANGLE/validationEGL.h
+index a671bb0d..248f0ae8 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/validationEGL.h
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/validationEGL.h
+@@ -15,6 +15,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ namespace gl
+ {
+diff --git a/Source/ThirdParty/ANGLE/src/libEGL/egl_loader_autogen.h b/Source/ThirdParty/ANGLE/src/libEGL/egl_loader_autogen.h
+index ae4a427c..a802b65d 100644
+--- a/Source/ThirdParty/ANGLE/src/libEGL/egl_loader_autogen.h
++++ b/Source/ThirdParty/ANGLE/src/libEGL/egl_loader_autogen.h
+@@ -13,6 +13,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ extern PFNEGLCHOOSECONFIGPROC EGL_ChooseConfig;
+ extern PFNEGLCOPYBUFFERSPROC EGL_CopyBuffers;
+diff --git a/Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_egl_ext.h b/Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_egl_ext.h
+index 3c64b290..96201b31 100644
+--- a/Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_egl_ext.h
++++ b/Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_egl_ext.h
+@@ -11,6 +11,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <export.h>
+ 
+ extern "C" {
+diff --git a/Source/ThirdParty/ANGLE/src/tests/deqp_support/tcuANGLENativeDisplayFactory.cpp b/Source/ThirdParty/ANGLE/src/tests/deqp_support/tcuANGLENativeDisplayFactory.cpp
+index 777b09e1..dbb0bd2f 100644
+--- a/Source/ThirdParty/ANGLE/src/tests/deqp_support/tcuANGLENativeDisplayFactory.cpp
++++ b/Source/ThirdParty/ANGLE/src/tests/deqp_support/tcuANGLENativeDisplayFactory.cpp
+@@ -24,6 +24,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "deClock.h"
+ #include "deMemory.h"
+diff --git a/Source/ThirdParty/ANGLE/src/tests/deqp_support/tcuANGLEPlatform.cpp b/Source/ThirdParty/ANGLE/src/tests/deqp_support/tcuANGLEPlatform.cpp
+index 6b4a25bf..1c4ac864 100644
+--- a/Source/ThirdParty/ANGLE/src/tests/deqp_support/tcuANGLEPlatform.cpp
++++ b/Source/ThirdParty/ANGLE/src/tests/deqp_support/tcuANGLEPlatform.cpp
+@@ -22,6 +22,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "egluGLContextFactory.hpp"
+ #include "tcuANGLENativeDisplayFactory.h"
+diff --git a/Source/ThirdParty/ANGLE/src/tests/egl_tests/EGLX11VisualTest.cpp b/Source/ThirdParty/ANGLE/src/tests/egl_tests/EGLX11VisualTest.cpp
+index 90abb931..aea4e153 100644
+--- a/Source/ThirdParty/ANGLE/src/tests/egl_tests/EGLX11VisualTest.cpp
++++ b/Source/ThirdParty/ANGLE/src/tests/egl_tests/EGLX11VisualTest.cpp
+@@ -10,6 +10,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <X11/Xlib.h>
+ 
+ #include "test_utils/ANGLETest.h"
+diff --git a/Source/ThirdParty/ANGLE/src/tests/gles_conformance_tests/gles_conformance_tests.h b/Source/ThirdParty/ANGLE/src/tests/gles_conformance_tests/gles_conformance_tests.h
+index e888a239..71606b8c 100644
+--- a/Source/ThirdParty/ANGLE/src/tests/gles_conformance_tests/gles_conformance_tests.h
++++ b/Source/ThirdParty/ANGLE/src/tests/gles_conformance_tests/gles_conformance_tests.h
+@@ -11,6 +11,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include <string>
+ 
+diff --git a/Source/ThirdParty/ANGLE/src/tests/gles_conformance_tests/gles_conformance_tests_main.cpp b/Source/ThirdParty/ANGLE/src/tests/gles_conformance_tests/gles_conformance_tests_main.cpp
+index 7fdddcc6..e40b8905 100644
+--- a/Source/ThirdParty/ANGLE/src/tests/gles_conformance_tests/gles_conformance_tests_main.cpp
++++ b/Source/ThirdParty/ANGLE/src/tests/gles_conformance_tests/gles_conformance_tests_main.cpp
+@@ -10,6 +10,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include <map>
+ #include <string>
+diff --git a/Source/ThirdParty/ANGLE/src/tests/test_utils/angle_test_configs.h b/Source/ThirdParty/ANGLE/src/tests/test_utils/angle_test_configs.h
+index 7bc7a027..ebb2827b 100644
+--- a/Source/ThirdParty/ANGLE/src/tests/test_utils/angle_test_configs.h
++++ b/Source/ThirdParty/ANGLE/src/tests/test_utils/angle_test_configs.h
+@@ -16,6 +16,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "GLSLANG/ShaderLang.h"
+ #include "angle_test_instantiate.h"
+diff --git a/Source/ThirdParty/ANGLE/util/OSPixmap.h b/Source/ThirdParty/ANGLE/util/OSPixmap.h
+index ba6ccf4a..563d2578 100644
+--- a/Source/ThirdParty/ANGLE/util/OSPixmap.h
++++ b/Source/ThirdParty/ANGLE/util/OSPixmap.h
+@@ -13,6 +13,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "util/Event.h"
+ #include "util/util_export.h"
+diff --git a/Source/ThirdParty/ANGLE/util/OSWindow.h b/Source/ThirdParty/ANGLE/util/OSWindow.h
+index 3cdb458c..3178fa44 100644
+--- a/Source/ThirdParty/ANGLE/util/OSWindow.h
++++ b/Source/ThirdParty/ANGLE/util/OSWindow.h
+@@ -15,6 +15,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "util/Event.h"
+ #include "util/util_export.h"
+diff --git a/Source/ThirdParty/ANGLE/util/egl_loader_autogen.h b/Source/ThirdParty/ANGLE/util/egl_loader_autogen.h
+index 5fbec82f..77a30330 100644
+--- a/Source/ThirdParty/ANGLE/util/egl_loader_autogen.h
++++ b/Source/ThirdParty/ANGLE/util/egl_loader_autogen.h
+@@ -15,6 +15,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ ANGLE_UTIL_EXPORT extern PFNEGLCHOOSECONFIGPROC eglChooseConfig;
+ ANGLE_UTIL_EXPORT extern PFNEGLCOPYBUFFERSPROC eglCopyBuffers;
+diff --git a/Source/WebCore/platform/graphics/egl/GLContextEGL.cpp b/Source/WebCore/platform/graphics/egl/GLContextEGL.cpp
+index a8a82d70..050893a9 100644
+--- a/Source/WebCore/platform/graphics/egl/GLContextEGL.cpp
++++ b/Source/WebCore/platform/graphics/egl/GLContextEGL.cpp
+@@ -29,6 +29,7 @@
+ #else
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #endif
+ 
+ #if USE(CAIRO)
+diff --git a/Source/WebCore/platform/graphics/wayland/PlatformDisplayWayland.cpp b/Source/WebCore/platform/graphics/wayland/PlatformDisplayWayland.cpp
+index 05f92c22..636df34a 100644
+--- a/Source/WebCore/platform/graphics/wayland/PlatformDisplayWayland.cpp
++++ b/Source/WebCore/platform/graphics/wayland/PlatformDisplayWayland.cpp
+@@ -35,6 +35,7 @@
+ #include <wayland-egl.h>
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <wtf/Assertions.h>
+ 
+ namespace WebCore {
+diff --git a/Source/WebCore/platform/graphics/x11/PlatformDisplayX11.cpp b/Source/WebCore/platform/graphics/x11/PlatformDisplayX11.cpp
+index 8c81119b..bf9ed4bd 100644
+--- a/Source/WebCore/platform/graphics/x11/PlatformDisplayX11.cpp
++++ b/Source/WebCore/platform/graphics/x11/PlatformDisplayX11.cpp
+@@ -38,6 +38,7 @@
+ #if USE(EGL)
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #endif
+ 
+ namespace WebCore {
+diff --git a/Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreWayland.cpp b/Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreWayland.cpp
+index 973b3168..5586236a 100644
+--- a/Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreWayland.cpp
++++ b/Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreWayland.cpp
+@@ -35,6 +35,7 @@
+ #include <gdk/gdkwayland.h>
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <WebCore/CairoUtilities.h>
+ #include <WebCore/GLContext.h>
+ 
+diff --git a/Source/WebKit/UIProcess/gtk/WaylandCompositor.cpp b/Source/WebKit/UIProcess/gtk/WaylandCompositor.cpp
+index 8d848ce4..46d42c11 100644
+--- a/Source/WebKit/UIProcess/gtk/WaylandCompositor.cpp
++++ b/Source/WebKit/UIProcess/gtk/WaylandCompositor.cpp
+@@ -31,6 +31,7 @@
+ #include "WebKitWaylandServerProtocol.h"
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <WebCore/GLContext.h>
+ #include <WebCore/PlatformDisplayWayland.h>
+ #include <WebCore/Region.h>

From 52997f11caeccccadf896ca57077d0f3a96483bd Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:32:59 +0000
Subject: [PATCH 065/144] coin3d: Don't use libGLU_combined

---
 pkgs/development/libraries/coin3d/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/coin3d/default.nix b/pkgs/development/libraries/coin3d/default.nix
index 74fd12ffea26..634ac27058bb 100644
--- a/pkgs/development/libraries/coin3d/default.nix
+++ b/pkgs/development/libraries/coin3d/default.nix
@@ -1,4 +1,4 @@
-{ fetchFromBitbucket, stdenv, boost, cmake, libGLU_combined }:
+{ fetchFromBitbucket, stdenv, boost, cmake, libGL, libGLU }:
 
 stdenv.mkDerivation {
   pname = "coin";
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
   '';
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ boost libGLU_combined ];
+  buildInputs = [ boost libGL libGLU ];
 
   meta = {
     homepage = "https://bitbucket.org/Coin3D/coin/wiki/Home";

From 1733a6f94156b849a8b8b567607cd693615ff6b1 Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:34:34 +0000
Subject: [PATCH 066/144] mesa: 19.2.1 -> 19.2.3

---
 pkgs/development/libraries/mesa/default.nix | 4 ++--
 pkgs/development/libraries/mesa/stubs.nix   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index caeb8dba8a63..1e7a716fcea8 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -27,7 +27,7 @@
 with stdenv.lib;
 
 let
-  version = "19.2.1";
+  version = "19.2.3";
   branch  = versions.major version;
 in
 
@@ -42,7 +42,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
     ];
-    sha256 = "4cc53ca1a8d12c6ff0e5ea44a5213c05c88447ab50d7e28bb350cd29199f01e9";
+    sha256 = "0ish3izys9rr8rpr8h56a0jmnrvacn16k8pblv4xqhgy0hjy9rjy";
   };
 
   prePatch = "patchShebangs .";
diff --git a/pkgs/development/libraries/mesa/stubs.nix b/pkgs/development/libraries/mesa/stubs.nix
index 5cb6ac3d4d13..a53f2dc28e77 100644
--- a/pkgs/development/libraries/mesa/stubs.nix
+++ b/pkgs/development/libraries/mesa/stubs.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation {
     ln -s ${libglvnd.out}/lib $out/lib
 
     mkdir -p $dev/{,lib/pkgconfig,nix-support}
-    echo "$out" > $dev/nix-support/propagated-build-inputs
+    echo "$out ${libglvnd} ${libglvnd.dev}" > $dev/nix-support/propagated-build-inputs
     ln -s ${mesa.dev}/include $dev/include
 
     genPkgConfig() {
@@ -63,7 +63,7 @@ stdenv.mkDerivation {
     Description: $lib library
     Version: ${mesa.version}
     Libs: -L${libglvnd.out}/lib -l$lib
-    Cflags: -I${mesa.dev}/include
+    Cflags: -I${mesa.dev}/include -I${libglvnd.dev}/include
     EOF
     }
 

From a6929e9ff3f8e521bd0d2b892c57a50c7e660553 Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:35:04 +0000
Subject: [PATCH 067/144] xorg.xorgserver: Fix build with mesa 19.2.3

---
 pkgs/servers/x11/xorg/default.nix   |  2 +-
 pkgs/servers/x11/xorg/overrides.nix | 12 +++++++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 8ad6867a8907..ec7246c4eb0d 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -2691,7 +2691,7 @@ lib.makeScope newScope (self: with self; {
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
-  xorgserver = callPackage ({ stdenv, pkgconfig, fetchurl, xorgproto, openssl, libX11, libXau, libXaw, libxcb, xcbutil, xcbutilwm, xcbutilimage, xcbutilkeysyms, xcbutilrenderutil, libXdmcp, libXfixes, libxkbfile, libXmu, libXpm, libXrender, libXres, libXt }: stdenv.mkDerivation {
+  xorgserver = callPackage ({ stdenv, fetchpatch, pkgconfig, fetchurl, xorgproto, openssl, libX11, libXau, libXaw, libxcb, xcbutil, xcbutilwm, xcbutilimage, xcbutilkeysyms, xcbutilrenderutil, libXdmcp, libXfixes, libxkbfile, libXmu, libXpm, libXrender, libXres, libXt }: stdenv.mkDerivation {
     name = "xorg-server-1.20.5";
     builder = ./builder.sh;
     src = fetchurl {
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index e6a94daee106..71ac752a6cf6 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -592,6 +592,16 @@ self: super:
         propagatedBuildInputs = [ libpciaccess epoxy ] ++ commonPropagatedBuildInputs ++ lib.optionals stdenv.isLinux [
           udev
         ];
+        # patchPhase is not working, this is a hack but we can remove it in the next xorg-server release
+        preConfigure = let
+          headerFix = fetchpatch {
+            url = "https://gitlab.freedesktop.org/xorg/xserver/commit/741bd73429e337071f49509ddcc5fb392e20b0f6.patch";
+            sha256 = "0qjiin9pkggl3c33lfkpn9a9z8ldjpb3y47cflsjkfn868gsk8ri";
+            excludes = [ "hw/xwayland/xwayland-glx.c" ];  # File not in release yet
+          };
+        in ''
+          patch -p1 < ${headerFix}
+        '';
         prePatch = stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
           export CFLAGS+=" -D__uid_t=uid_t -D__gid_t=gid_t"
         '';
@@ -629,8 +639,8 @@ self: super:
           libAppleWM xorgproto
         ];
 
-        # XQuartz patchset
         patches = [
+          # XQuartz patchset
           (fetchpatch {
             url = "https://github.com/XQuartz/xorg-server/commit/e88fd6d785d5be477d5598e70d105ffb804771aa.patch";
             sha256 = "1q0a30m1qj6ai924afz490xhack7rg4q3iig2gxsjjh98snikr1k";

From 4b616ab19af9eb41f614efd3609bab76437e812f Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:35:46 +0000
Subject: [PATCH 068/144] mutter: Fix build with mesa 19.2.3

---
 pkgs/desktops/gnome-3/core/mutter/3.28.nix    |  2 +
 pkgs/desktops/gnome-3/core/mutter/default.nix |  5 ++
 .../gnome-3/core/mutter/libglvnd-328.patch    | 63 +++++++++++++++++++
 3 files changed, 70 insertions(+)
 create mode 100644 pkgs/desktops/gnome-3/core/mutter/libglvnd-328.patch

diff --git a/pkgs/desktops/gnome-3/core/mutter/3.28.nix b/pkgs/desktops/gnome-3/core/mutter/3.28.nix
index cc00fc5ece44..85208163415b 100644
--- a/pkgs/desktops/gnome-3/core/mutter/3.28.nix
+++ b/pkgs/desktops/gnome-3/core/mutter/3.28.nix
@@ -56,6 +56,8 @@ stdenv.mkDerivation rec {
     })
     # See patch commit message
     ./0001-Revert-ClutterActor-Preserve-valid-paint-volumes-til.patch
+    # Fix build with libglvnd provided headers
+    ./libglvnd-328.patch
   ];
 
   configureFlags = [
diff --git a/pkgs/desktops/gnome-3/core/mutter/default.nix b/pkgs/desktops/gnome-3/core/mutter/default.nix
index c8b1ac7e4661..b39376a30928 100644
--- a/pkgs/desktops/gnome-3/core/mutter/default.nix
+++ b/pkgs/desktops/gnome-3/core/mutter/default.nix
@@ -60,6 +60,11 @@ stdenv.mkDerivation rec {
       src = ./fix-paths.patch;
       inherit zenity;
     })
+    # Fix build with libglvnd provided headers
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/mutter/commit/a444a4c5f58ea516ad3cd9d6ddc0056c3ca9bc90.patch";
+      sha256 = "0imy2j8af9477jliwdq4jc40yw1cifsjjf196gnmwxr9rkj0hbrd";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/desktops/gnome-3/core/mutter/libglvnd-328.patch b/pkgs/desktops/gnome-3/core/mutter/libglvnd-328.patch
new file mode 100644
index 000000000000..96e275598288
--- /dev/null
+++ b/pkgs/desktops/gnome-3/core/mutter/libglvnd-328.patch
@@ -0,0 +1,63 @@
+diff --git a/cogl/configure.ac b/cogl/configure.ac
+index 3be282f..d338cd1 100644
+--- a/cogl/configure.ac
++++ b/cogl/configure.ac
+@@ -490,6 +490,11 @@ AS_IF([test "x$enable_gles1" = "xyes"],
+ #include <EGL/eglext.h>"],
+                              [],
+                              [$COGL_EGL_INCLUDES])
++            AC_CHECK_HEADERS([EGL/eglmesaext.h],
++                             [COGL_EGL_INCLUDES="$COGL_EGL_INCLUDE
++#include <EGL/eglmesaext.h>"],
++                             [],
++                             [$COGL_EGL_INCLUDES])
+ 
+             # Check for a GLES 1.x Common Profile library with/without EGL.
+             #
+@@ -759,7 +764,9 @@ AS_IF([test "x$NEED_EGL" = "xyes" && test "x$EGL_CHECKED" != "xyes"],
+           )
+ 
+         COGL_EGL_INCLUDES="#include <EGL/egl.h>
+-#include <EGL/eglext.h>"
++#include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
++"
+         AC_SUBST([COGL_EGL_INCLUDES])
+       ])
+ 
+diff --git a/src/backends/meta-egl-ext.h b/src/backends/meta-egl-ext.h
+index 8705e7d..db0b74f 100644
+--- a/src/backends/meta-egl-ext.h
++++ b/src/backends/meta-egl-ext.h
+@@ -29,6 +29,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ /*
+  * This is a little different to the tests shipped with EGL implementations,
+diff --git a/src/backends/meta-egl.c b/src/backends/meta-egl.c
+index 755ec49..bd253c9 100644
+--- a/src/backends/meta-egl.c
++++ b/src/backends/meta-egl.c
+@@ -31,6 +31,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <gio/gio.h>
+ #include <glib.h>
+ #include <glib-object.h>
+diff --git a/src/backends/meta-egl.h b/src/backends/meta-egl.h
+index 060c7cd..2fef264 100644
+--- a/src/backends/meta-egl.h
++++ b/src/backends/meta-egl.h
+@@ -27,6 +27,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <glib-object.h>
+ 
+ #define META_EGL_ERROR meta_egl_error_quark ()

From 2de37c469869c673c7960f7b3aa79a4bb88b1cde Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:36:20 +0000
Subject: [PATCH 069/144] openscenegraph: Don't use libGLU_combined

---
 pkgs/development/libraries/openscenegraph/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/openscenegraph/default.nix b/pkgs/development/libraries/openscenegraph/default.nix
index 1398e829dd5c..9be5018dc29b 100644
--- a/pkgs/development/libraries/openscenegraph/default.nix
+++ b/pkgs/development/libraries/openscenegraph/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, cmake, pkgconfig, doxygen,
-  libX11, libXinerama, libXrandr, libGLU_combined,
+  libX11, libXinerama, libXrandr, libGLU, libGL,
   glib, ilmbase, libxml2, pcre, zlib,
   jpegSupport ? true, libjpeg,
   jasperSupport ? true, jasper,
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig cmake doxygen ];
 
   buildInputs = [
-    libX11 libXinerama libXrandr libGLU_combined
+    libX11 libXinerama libXrandr libGLU libGL
     glib ilmbase libxml2 pcre zlib
   ] ++ lib.optional jpegSupport libjpeg
     ++ lib.optional jasperSupport jasper

From 46ff2efc72a27b9431fbdcbffa6fda7cc7bdf08d Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:36:47 +0000
Subject: [PATCH 070/144] libtxc_dxtn: Don't use libGLU_combined

---
 pkgs/development/libraries/libtxc_dxtn/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libtxc_dxtn/default.nix b/pkgs/development/libraries/libtxc_dxtn/default.nix
index 5ac456a60f61..600b1fb510ad 100644
--- a/pkgs/development/libraries/libtxc_dxtn/default.nix
+++ b/pkgs/development/libraries/libtxc_dxtn/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, autoreconfHook, libGLU_combined }:
+{ stdenv, fetchurl, autoreconfHook, libGL, libGLU }:
 
 let version = "1.0.1"; in
 
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [ libGLU_combined ];
+  buildInputs = [ libGL libGLU ];
 
   meta = with stdenv.lib; {
     homepage = http://dri.freedesktop.org/wiki/S3TC;

From 1dc80934f0be86542c043c6632f6b66c9c1bc421 Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:37:02 +0000
Subject: [PATCH 071/144] libtxc_dxtn_s2tc: Don't use libGLU_combined

---
 pkgs/development/libraries/libtxc_dxtn_s2tc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libtxc_dxtn_s2tc/default.nix b/pkgs/development/libraries/libtxc_dxtn_s2tc/default.nix
index 4959674f0ad2..f9f44f5a6531 100644
--- a/pkgs/development/libraries/libtxc_dxtn_s2tc/default.nix
+++ b/pkgs/development/libraries/libtxc_dxtn_s2tc/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, autoreconfHook, libGLU_combined }:
+{ stdenv, fetchurl, autoreconfHook, libGL, libGLU }:
 
 let version = "1.0"; in
 
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [ libGLU_combined ];
+  buildInputs = [ libGL libGLU ];
 
   meta = {
     description = "A patent-free S3TC compatible implementation";

From 87e4e71e0ff2b921c6d75b79acb4493738186cbf Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:37:13 +0000
Subject: [PATCH 072/144] vtk: Fix build with mesa 19.2.3

---
 pkgs/development/libraries/vtk/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/vtk/default.nix b/pkgs/development/libraries/vtk/default.nix
index 3cb8998485a9..482d691fc7c6 100644
--- a/pkgs/development/libraries/vtk/default.nix
+++ b/pkgs/development/libraries/vtk/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, libGLU_combined, libX11, xorgproto, libXt, libtiff
+{ stdenv, fetchurl, cmake, libGLU, libGL, libX11, xorgproto, libXt, libtiff
 , qtLib ? null
 # Darwin support
 , Cocoa, CoreServices, DiskArbitration, IOKit, CFNetwork, Security, GLUT, OpenGL
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libtiff ]
     ++ optional (qtLib != null) qtLib
-    ++ optionals stdenv.isLinux [ libGLU_combined libX11 xorgproto libXt ]
+    ++ optionals stdenv.isLinux [ libGLU libGL libX11 xorgproto libXt ]
     ++ optionals stdenv.isDarwin [ xpc Cocoa CoreServices DiskArbitration IOKit
                                    CFNetwork Security ApplicationServices CoreText
                                    IOSurface ImageIO OpenGL GLUT ];
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
   # built and requiring one of the shared objects.
   # At least, we use -fPIC for other packages to be able to use this in shared
   # objects.
-  cmakeFlags = [ "-DCMAKE_C_FLAGS=-fPIC" "-DCMAKE_CXX_FLAGS=-fPIC" "-DVTK_USE_SYSTEM_TIFF=1" ]
+  cmakeFlags = [ "-DCMAKE_C_FLAGS=-fPIC" "-DCMAKE_CXX_FLAGS=-fPIC" "-DVTK_USE_SYSTEM_TIFF=1" "-DOPENGL_INCLUDE_DIR=${libGL}/include" ]
     ++ optional (qtLib != null) [ "-DVTK_USE_QT:BOOL=ON" ]
     ++ optional stdenv.isDarwin "-DOPENGL_INCLUDE_DIR=${OpenGL}/Library/Frameworks";
 

From f509874f9107f3e9aa475b0ebe7608f57bfae690 Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:37:33 +0000
Subject: [PATCH 073/144] libglvnd: Apply patches to work with mesa 19.2.3

---
 pkgs/development/libraries/libglvnd/default.nix | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/pkgs/development/libraries/libglvnd/default.nix b/pkgs/development/libraries/libglvnd/default.nix
index 30b27d9329a5..5df1246a0eb4 100644
--- a/pkgs/development/libraries/libglvnd/default.nix
+++ b/pkgs/development/libraries/libglvnd/default.nix
@@ -14,6 +14,22 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkgconfig python2 addOpenGLRunpath ];
   buildInputs = [ libX11 libXext xorgproto ];
 
+  # The following 3 patches should be removed once libglvnd >1.2.0 is released
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/NVIDIA/libglvnd/commit/6f52473dac08c44b081b792874b4ce73122096da.patch";
+      sha256 = "0rd9ihl8n33cm0rya5a7ki0hn31fh52r0gaj5d4w80jrsah2ayij";
+    })
+    (fetchpatch {
+      url = "https://github.com/NVIDIA/libglvnd/commit/51233cc52cbcbe25f8461830913c06f5b5bc9508.patch";
+      sha256 = "1qx3nw8vq5xcrixmi7xw1vpy4gbf7kmx38rx8wg8x046g4mv8ijj";
+    })
+    (fetchpatch {
+      url = "https://github.com/NVIDIA/libglvnd/commit/5dfdc5a6dc60a3bdc63cd4510dabacba388da13a.patch";
+      sha256 = "0gmb3619yz3z7n22afjh8p2y13bmsky4r0z0csm14is3wvdi64ya";
+    })
+  ];
+
   postPatch = lib.optionalString stdenv.isDarwin ''
     substituteInPlace src/GLX/Makefile.am \
       --replace "-Wl,-Bsymbolic " ""

From 2f292f0bdad908015927ae057a66537a2a3612ce Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:38:01 +0000
Subject: [PATCH 074/144] gle: Don't use libGLU_combined

---
 pkgs/development/libraries/gle/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gle/default.nix b/pkgs/development/libraries/gle/default.nix
index dd72637f2eb0..d656473ba807 100644
--- a/pkgs/development/libraries/gle/default.nix
+++ b/pkgs/development/libraries/gle/default.nix
@@ -1,7 +1,7 @@
-{stdenv, fetchurl, libGLU_combined, freeglut, libX11, libXt, libXmu, libXi, libXext}:
+{stdenv, fetchurl, freeglut, libX11, libXt, libXmu, libXi, libXext, libGL, libGLU}:
 stdenv.mkDerivation {
   name = "gle-3.1.0";
-  buildInputs = [libGLU_combined freeglut libX11 libXt libXmu libXi libXext];
+  buildInputs = [libGLU libGL freeglut libX11 libXt libXmu libXi libXext];
   src = fetchurl {
     urls = [
       "mirror://sourceforge/project/gle/gle/gle-3.1.0/gle-3.1.0.tar.gz"

From 53731cbe78276d65d7862f0bcc5c9b78cdddf6c9 Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:38:49 +0000
Subject: [PATCH 075/144] leptonica: Don't use libGLU_combined

---
 pkgs/development/libraries/leptonica/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/leptonica/default.nix b/pkgs/development/libraries/leptonica/default.nix
index 62c01e4f3560..e26f4f6022aa 100644
--- a/pkgs/development/libraries/leptonica/default.nix
+++ b/pkgs/development/libraries/leptonica/default.nix
@@ -16,7 +16,9 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   checkInputs = [ which gnuplot ];
-  doCheck = !stdenv.isDarwin;
+
+  # Fails on pngio_reg for unknown reason
+  doCheck = false; # !stdenv.isDarwin;
 
   meta = {
     description = "Image processing and analysis library";

From 317958d27bda023f5cab5d811910baaa931ae7a2 Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:39:02 +0000
Subject: [PATCH 076/144] ftgl: Don't use libGLU_combined

---
 pkgs/development/libraries/ftgl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/ftgl/default.nix b/pkgs/development/libraries/ftgl/default.nix
index 289a57399854..a99228efcf4d 100644
--- a/pkgs/development/libraries/ftgl/default.nix
+++ b/pkgs/development/libraries/ftgl/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, freetype, libGLU_combined, OpenGL }:
+{ stdenv, fetchurl, freetype, libGL, libGLU, OpenGL }:
 
 let
   name = "ftgl-2.1.3-rc5";
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
     ++ (if stdenv.isDarwin then
       [ OpenGL ]
     else
-      [ libGLU_combined ])
+      [ libGL libGLU ])
     ;
 
   enableParallelBuilding = true;

From 803f9cce9d90d5e67b88d08409092472ad565c4b Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:39:41 +0000
Subject: [PATCH 077/144] fltk: Don't use libGLU_combined

---
 pkgs/development/libraries/fltk/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/fltk/default.nix b/pkgs/development/libraries/fltk/default.nix
index a22b5eef8d2e..6f185e38d839 100644
--- a/pkgs/development/libraries/fltk/default.nix
+++ b/pkgs/development/libraries/fltk/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, xlibsWrapper, xorgproto, libXi
-, freeglut, libGLU_combined, libjpeg, zlib, libXft, libpng
+, freeglut, libGL, libGLU, libjpeg, zlib, libXft, libpng
 , libtiff, freetype, Cocoa, AGL, GLUT
 }:
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   patches = stdenv.lib.optionals stdenv.isDarwin [ ./nsosv.patch ];
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libGLU_combined libjpeg zlib libpng libXft ]
+  buildInputs = [ libGLU libGL libjpeg zlib libpng libXft ]
     ++ stdenv.lib.optional stdenv.isDarwin [ AGL Cocoa GLUT ];
 
   propagatedBuildInputs = [ xorgproto ]

From ec8fc7b97f06c0d189fd9c1f6923c5eed556f536 Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:41:26 +0000
Subject: [PATCH 078/144] cogl: Apply patches to work with mesa 19.2.3

---
 pkgs/development/libraries/cogl/default.nix | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/cogl/default.nix b/pkgs/development/libraries/cogl/default.nix
index 4700d9e2418e..e122c1e7b120 100644
--- a/pkgs/development/libraries/cogl/default.nix
+++ b/pkgs/development/libraries/cogl/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, fetchpatch, pkgconfig, libGL, glib, gdk-pixbuf, xorg, libintl
 , pangoSupport ? true, pango, cairo, gobject-introspection, wayland, gnome3
-, mesa
+, mesa, automake, autoconf
 , gstreamerSupport ? true, gst_all_1 }:
 
 let
@@ -29,11 +29,17 @@ in stdenv.mkDerivation rec {
       url = https://bug787443.bugzilla-attachments.gnome.org/attachment.cgi?id=361056;
       sha256 = "09fyrdci4727fg6qm5aaapsbv71sf4wgfaqz8jqlyy61dibgg490";
     })
+
+    # Fix build with libglvnd headers (these headers used to be provided by mesa)
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/cogl/commit/9c4764224aded552fb855b1c2b85b26d2b894adf.patch";
+      sha256 = "1v9drpzgcd5pq2shhdcw5px7mdiggk6ga13qjbklq8xpd92ac0i1";
+    })
   ];
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ pkgconfig libintl ];
+  nativeBuildInputs = [ pkgconfig libintl automake autoconf ];
 
   configureFlags = [
     "--enable-introspection"
@@ -41,7 +47,7 @@ in stdenv.mkDerivation rec {
     "--enable-wayland-egl-platform"
     "--enable-wayland-egl-server"
   ] ++ stdenv.lib.optional gstreamerSupport "--enable-cogl-gst"
-    ++ stdenv.lib.optionals (!stdenv.isDarwin) [ "--enable-gles1" "--enable-gles2" ];
+  ++ stdenv.lib.optionals (!stdenv.isDarwin) [ "--enable-gles1" "--enable-gles2" ];
 
   propagatedBuildInputs = with xorg; [
       glib gdk-pixbuf gobject-introspection wayland mesa

From 01543a484379a24ebe472c86a0b9c16bf277bce3 Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 16:41:50 +0000
Subject: [PATCH 079/144] clutter: Don't use libGLU_combined

---
 pkgs/development/libraries/clutter/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/clutter/default.nix b/pkgs/development/libraries/clutter/default.nix
index 7095a808540f..32e723671e8c 100644
--- a/pkgs/development/libraries/clutter/default.nix
+++ b/pkgs/development/libraries/clutter/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, libGLU_combined, libX11, libXext, libXfixes
+{ stdenv, fetchurl, pkgconfig, libGLU, libGL, libX11, libXext, libXfixes
 , libXdamage, libXcomposite, libXi, libxcb, cogl, pango, atk, json-glib
 , gobject-introspection, gtk3, gnome3, libinput, libgudev, libxkbcommon
 }:
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ gtk3 ];
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs =
-    [ libX11 libGLU_combined libXext libXfixes libXdamage libXcomposite libXi cogl pango
+    [ libX11 libGL libGLU libXext libXfixes libXdamage libXcomposite libXi cogl pango
       atk json-glib gobject-introspection libxcb libinput libgudev libxkbcommon
     ];
 

From 7668f680da515eac57a9b9805da5331dcc725428 Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 7 Nov 2019 20:31:41 +0000
Subject: [PATCH 080/144] libretro: Dont use libGLU_combined

---
 pkgs/misc/emulators/retroarch/cores.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/misc/emulators/retroarch/cores.nix b/pkgs/misc/emulators/retroarch/cores.nix
index 9cc8a74c5d7e..c8171f6c2337 100644
--- a/pkgs/misc/emulators/retroarch/cores.nix
+++ b/pkgs/misc/emulators/retroarch/cores.nix
@@ -276,7 +276,7 @@ in with stdenv.lib.licenses;
     };
     description = "libretro wrapper for desmume NDS emulator";
     license = gpl2;
-    extraBuildInputs = [ libpcap libGLU_combined xorg.libX11 ];
+    extraBuildInputs = [ libpcap libGLU libGL xorg.libX11 ];
   }).override {
     makefile = "desmume/src/frontend/libretro/Makefile.libretro";
     configurePhase = "cd desmume/src/frontend/libretro";
@@ -292,7 +292,7 @@ in with stdenv.lib.licenses;
     };
     description = "libretro wrapper for desmume NDS emulator from 2015";
     license = gpl2;
-    extraBuildInputs = [ libpcap libGLU_combined xorg.libX11 ];
+    extraBuildInputs = [ libpcap libGLU libGL xorg.libX11 ];
   }).override {
     makefile = "desmume/Makefile.libretro";
     configurePhase = "cd desmume";
@@ -311,7 +311,7 @@ in with stdenv.lib.licenses;
     broken = true;
 
     extraBuildInputs = [
-      cmake curl libGLU_combined pcre pkgconfig sfml
+      cmake curl libGLU libGL pcre pkgconfig sfml
       gettext hidapi
       libevdev udev
     ] ++ (with xorg; [ libSM libX11 libXi libpthreadstubs libxcb xcbutil libXext libXrandr libXinerama libXxf86vm ]);
@@ -478,7 +478,7 @@ in with stdenv.lib.licenses;
     description = "Port of MAME to libretro";
     license = gpl2Plus;
 
-    extraBuildInputs = [ alsaLib libGLU_combined portaudio python27 xorg.libX11 ];
+    extraBuildInputs = [ alsaLib libGLU libGL portaudio python27 xorg.libX11 ];
   }).override {
     postPatch = ''
       # Prevent the failure during the parallel building of:
@@ -614,7 +614,7 @@ in with stdenv.lib.licenses;
     description = "Libretro port of Mupen64 Plus, GL only";
     license = gpl2;
 
-    extraBuildInputs = [ libGLU_combined libpng nasm xorg.libX11 ];
+    extraBuildInputs = [ libGLU libGL libpng nasm xorg.libX11 ];
   }).override {
     makefile = "Makefile";
     buildPhase = "make";
@@ -658,7 +658,7 @@ in with stdenv.lib.licenses;
     description = "Parallel Mupen64plus rewrite for libretro.";
     license = gpl2;
 
-    extraBuildInputs = [ libGLU_combined libpng ];
+    extraBuildInputs = [ libGLU libGL libpng ];
   }).override {
     makefile = "Makefile";
     buildPhase = "make";
@@ -718,7 +718,7 @@ in with stdenv.lib.licenses;
     };
     description = "ppsspp libretro port";
     license = gpl2;
-    extraBuildInputs = [ cmake libGLU_combined ffmpeg python37 xorg.libX11 ];
+    extraBuildInputs = [ cmake libGLU libGL ffmpeg python37 xorg.libX11 ];
   }).override {
     cmakeFlags = "-DLIBRETRO=ON";
     makefile = "Makefile";
@@ -778,7 +778,7 @@ in with stdenv.lib.licenses;
     };
     description = "Libretro port of ScummVM";
     license = gpl2;
-    extraBuildInputs = [ fluidsynth libjpeg libvorbis libGLU_combined SDL ];
+    extraBuildInputs = [ fluidsynth libjpeg libvorbis libGLU libGL SDL ];
   }).override {
     makefile = "backends/platform/libretro/build/Makefile";
     buildPhase = "cd backends/platform/libretro/build && make";

From dfac4a0f439562b2d16e7732ba96358d39cc77e1 Mon Sep 17 00:00:00 2001
From: Roman Timushev <rtimush@gmail.com>
Date: Fri, 8 Nov 2019 18:16:10 +0100
Subject: [PATCH 081/144] cfn-lint: propagate setuptools

---
 pkgs/development/python-modules/cfn-lint/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/cfn-lint/default.nix b/pkgs/development/python-modules/cfn-lint/default.nix
index 15133257738a..5dc84e07eb0c 100644
--- a/pkgs/development/python-modules/cfn-lint/default.nix
+++ b/pkgs/development/python-modules/cfn-lint/default.nix
@@ -8,6 +8,7 @@
 , jsonpatch
 , jsonschema
 , pathlib2
+, setuptools
 }:
 
 buildPythonPackage rec {
@@ -27,6 +28,7 @@ buildPythonPackage rec {
     jsonpatch
     jsonschema
     pathlib2
+    setuptools
   ];
 
   # No tests included in archive

From c9774cb6e509938b112fb7cd3a7928e90e4bccb5 Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Sun, 10 Nov 2019 12:29:08 +0000
Subject: [PATCH 082/144] qt512.qtbase: Fix darwin build

---
 pkgs/development/libraries/qt-5/5.12/default.nix |  1 +
 .../0013-define-kiosurfacesuccess.patch          | 16 ++++++++++++++++
 .../libraries/qt-5/modules/qtbase.nix            |  2 +-
 3 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/libraries/qt-5/5.12/qtbase.patch.d/0013-define-kiosurfacesuccess.patch

diff --git a/pkgs/development/libraries/qt-5/5.12/default.nix b/pkgs/development/libraries/qt-5/5.12/default.nix
index 2800f2d77978..8d27f3a0d4ba 100644
--- a/pkgs/development/libraries/qt-5/5.12/default.nix
+++ b/pkgs/development/libraries/qt-5/5.12/default.nix
@@ -54,6 +54,7 @@ let
       optionals stdenv.isDarwin [
         ./qtbase.patch.d/0001-qtbase-mkspecs-mac.patch
         ./qtbase.patch.d/0002-qtbase-mac.patch
+        ./qtbase.patch.d/0013-define-kiosurfacesuccess.patch
       ]
       ++ [
         ./qtbase.patch.d/0003-qtbase-mkspecs.patch
diff --git a/pkgs/development/libraries/qt-5/5.12/qtbase.patch.d/0013-define-kiosurfacesuccess.patch b/pkgs/development/libraries/qt-5/5.12/qtbase.patch.d/0013-define-kiosurfacesuccess.patch
new file mode 100644
index 000000000000..a43a46d8a69b
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtbase.patch.d/0013-define-kiosurfacesuccess.patch
@@ -0,0 +1,16 @@
+diff --git a/src/plugins/platforms/cocoa/qiosurfacegraphicsbuffer.mm b/src/plugins/platforms/cocoa/qiosurfacegraphicsbuffer.mm
+index a367487e..c3aeca1d 100644
+--- a/src/plugins/platforms/cocoa/qiosurfacegraphicsbuffer.mm
++++ b/src/plugins/platforms/cocoa/qiosurfacegraphicsbuffer.mm
+@@ -49,6 +49,11 @@
+ // but was only added in the 10.14 SDK, so declare it just in case.
+ extern "C" CFPropertyListRef CGColorSpaceCopyPropertyList(CGColorSpaceRef space);
+ 
++// Introduced in 10.13: http://codeworkshop.net/objc-diff/sdkdiffs/macos/10.13/IOSurface.html
++#if !defined(kIOSurfaceSuccess)
++#define kIOSurfaceSuccess KERN_SUCCESS
++#endif
++
+ QT_BEGIN_NAMESPACE
+ 
+ Q_LOGGING_CATEGORY(lcQpaIOSurface, "qt.qpa.backingstore.iosurface");
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index d1ec209c95d0..3dbdb2a9770b 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation {
           # TODO: move to buildInputs, this should not be propagated.
           AGL AppKit ApplicationServices Carbon Cocoa CoreAudio CoreBluetooth
           CoreLocation CoreServices DiskArbitration Foundation OpenGL
-          darwin.libobjc libiconv MetalKit
+          darwin.libobjc libiconv MetalKit IOKit
         ]
       else
         [

From d5937a80967073eac2b53072d59aeece4a18c52e Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Sun, 10 Nov 2019 12:32:58 +0000
Subject: [PATCH 083/144] qt5/libsForQt5: Switch MacOS to Qt 5.12 by default

Qt 5.11 does not build after the latest mesa update
---
 pkgs/top-level/all-packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c274c71dc38b..1b0e972b8fda 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13476,8 +13476,8 @@ in
   libsForQt512 = recurseIntoAttrs (lib.makeScope qt512.newScope mkLibsForQt5);
 
   # TODO bump to 5.12 on darwin once it's not broken
-  qt5 = if stdenv.isDarwin then qt511 else qt512;
-  libsForQt5 = if stdenv.isDarwin then libsForQt511 else libsForQt512;
+  qt5 = qt512;
+  libsForQt5 = libsForQt512;
 
   qt5ct = libsForQt5.callPackage ../tools/misc/qt5ct { };
 

From 92edb0610923fab5a9dcc59b94652f1e8a5ea1ed Mon Sep 17 00:00:00 2001
From: c0bw3b <c0bw3b@users.noreply.github.com>
Date: Mon, 11 Nov 2019 17:45:28 +0100
Subject: [PATCH 084/144] libmad: fix three CVE from 2017

* add patch for CVE-2017-8372 and CVE-2017-8373
* add patch for CVE-2017-8374
* add patch for x86_64 platforms
* fetch existing patches from remote sources
---
 .../001-mips_removal_h_constraint.patch       |  73 -----------
 pkgs/development/libraries/libmad/default.nix |  56 +++++++--
 .../libraries/libmad/optimize.diff            |  77 ------------
 .../libraries/libmad/pkgconfig.patch          | 117 ------------------
 4 files changed, 43 insertions(+), 280 deletions(-)
 delete mode 100644 pkgs/development/libraries/libmad/001-mips_removal_h_constraint.patch
 delete mode 100644 pkgs/development/libraries/libmad/optimize.diff
 delete mode 100644 pkgs/development/libraries/libmad/pkgconfig.patch

diff --git a/pkgs/development/libraries/libmad/001-mips_removal_h_constraint.patch b/pkgs/development/libraries/libmad/001-mips_removal_h_constraint.patch
deleted file mode 100644
index 1d8b385e0c57..000000000000
--- a/pkgs/development/libraries/libmad/001-mips_removal_h_constraint.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-Taken from openwrt:
-https://dev.openwrt.org/browser/packages/libs/libmad/patches/001-mips_removal_h_constraint.patch?rev=18548
-
-diff -ur libmad-0.15.1b-orig/fixed.h libmad-0.15.1b/fixed.h
---- libmad-0.15.1b-orig/fixed.h	2004-02-17 12:32:03.000000000 +1030
-+++ libmad-0.15.1b/fixed.h	2009-08-05 10:46:30.000000000 +0930
-@@ -299,6 +299,23 @@
- 
- # elif defined(FPM_MIPS)
- 
-+/* Test for gcc >= maj.min, as per __GNUC_PREREQ in glibc */
-+#if defined (__GNUC__) && defined (__GNUC_MINOR__)
-+#define __GNUC_PREREQ(maj, min) \
-+	((__GNUC__ << 16) + __GNUC_MINOR__ >= ((maj) << 16) + (min))
-+#else
-+#define __GNUC_PREREQ(maj, min)  0
-+#endif
-+
-+#if __GNUC_PREREQ(4,4)
-+  typedef unsigned int u64_di_t __attribute__ ((mode (DI)));
-+# define MAD_F_MLX(hi, lo, x, y) \
-+   do { \
-+      u64_di_t __ll = (u64_di_t) (x) * (y); \
-+      hi = __ll >> 32; \
-+      lo = __ll; \
-+   } while (0) 
-+#else
- /*
-  * This MIPS version is fast and accurate; the disposition of the least
-  * significant bit depends on OPT_ACCURACY via mad_f_scale64().
-@@ -328,6 +345,7 @@
- 	 : "%r" ((x) >> 12), "r" ((y) >> 16))
- #  define MAD_F_MLZ(hi, lo)  ((mad_fixed_t) (lo))
- # endif
-+#endif /* __GNU_PREREQ(4,4) */
- 
- # if defined(OPT_SPEED)
- #  define mad_f_scale64(hi, lo)  \
-diff -ur libmad-0.15.1b-orig/mad.h libmad-0.15.1b/mad.h
---- libmad-0.15.1b-orig/mad.h	2004-02-17 13:25:44.000000000 +1030
-+++ libmad-0.15.1b/mad.h	2009-08-05 10:42:40.000000000 +0930
-@@ -344,6 +344,23 @@
- 
- # elif defined(FPM_MIPS)
- 
-+/* Test for gcc >= maj.min, as per __GNUC_PREREQ in glibc */
-+#if defined (__GNUC__) && defined (__GNUC_MINOR__)
-+#define __GNUC_PREREQ(maj, min) \
-+	((__GNUC__ << 16) + __GNUC_MINOR__ >= ((maj) << 16) + (min))
-+#else
-+#define __GNUC_PREREQ(maj, min)  0
-+#endif
-+
-+#if __GNUC_PREREQ(4,4)
-+  typedef unsigned int u64_di_t __attribute__ ((mode (DI)));
-+# define MAD_F_MLX(hi, lo, x, y) \
-+   do { \
-+      u64_di_t __ll = (u64_di_t) (x) * (y); \
-+      hi = __ll >> 32; \
-+      lo = __ll; \
-+   } while (0) 
-+#else
- /*
-  * This MIPS version is fast and accurate; the disposition of the least
-  * significant bit depends on OPT_ACCURACY via mad_f_scale64().
-@@ -373,6 +390,7 @@
- 	 : "%r" ((x) >> 12), "r" ((y) >> 16))
- #  define MAD_F_MLZ(hi, lo)  ((mad_fixed_t) (lo))
- # endif
-+#endif /* __GNU_PREREQ(4,4) */
- 
- # if defined(OPT_SPEED)
- #  define mad_f_scale64(hi, lo)  \
diff --git a/pkgs/development/libraries/libmad/default.nix b/pkgs/development/libraries/libmad/default.nix
index f6df090e8b5d..40d90f46288a 100644
--- a/pkgs/development/libraries/libmad/default.nix
+++ b/pkgs/development/libraries/libmad/default.nix
@@ -1,27 +1,57 @@
-{stdenv, fetchurl, autoconf}:
+{ stdenv, fetchurl, fetchpatch, autoconf }:
 
 stdenv.mkDerivation rec {
-  name = "libmad-0.15.1b";
-  
+  pname = "libmad";
+  version = "0.15.1b";
+
   src = fetchurl {
-    url = "mirror://sourceforge/mad/${name}.tar.gz";
-    sha256 = "bbfac3ed6bfbc2823d3775ebb931087371e142bb0e9bb1bee51a76a6e0078690";
+    url = "mirror://sourceforge/mad/${pname}-${version}.tar.gz";
+    sha256 = "14460zhacxhswnzb36qfpd1f2wbk10qvksvm6wyq5hpvdgnw7ymv";
   };
 
-  patches = [ ./001-mips_removal_h_constraint.patch ./pkgconfig.patch ]
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/001-mips_removal_h_constraint.patch";
+      sha256 = "0layswr6qg6axf4vyz6xrv73jwga34mkma3ifk9w9vrk41454hr5";
+    })
+    (fetchpatch {
+      url = "https://github.com/KaOSx/main/raw/1270b8080f37fb6cca562829a521991800b0a497/libmad/libmad.patch";
+      sha256 = "0rysq0sn3dfdz6pa6bfqkmk4ymc4rzk5ym7p16dyk37sldg1pbzs";
+    })
+    (fetchpatch {
+      url = "https://github.com/KaOSx/main/raw/1270b8080f37fb6cca562829a521991800b0a497/libmad/amd64-64bit.diff";
+      sha256 = "0mx56dmkbvw3zxnqd2hjng48q0d7q7473pns4n0ksdam29b0c5ar";
+    })
+    (fetchpatch {
+      name = "CVE-2017-8372-CVE-2017-8373.patch";
+      url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/102-CVE-2017-8373-CVE-2017-8372-md-size.patch";
+      sha256 = "0p6mkpn66h1ds8jvww28q4vlr58jwm58m9vb7pkvvyvy764agqnk";
+    })
+    (fetchpatch {
+      name = "CVE-2017-8374.patch";
+      url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/101-CVE-2017-8374-length-check.patch";
+      sha256 = "1j1ssxwmx9nfahzl62frbzck93xrjc2v3w30c12vmk29iflf1890";
+    })
+  ]
   # optimize.diff is taken from https://projects.archlinux.org/svntogit/packages.git/tree/trunk/optimize.diff?h=packages/libmad
   # It is included here in order to fix a build failure in Clang
   # But it may be useful to fix other, currently unknown problems as well
-  ++ stdenv.lib.optional stdenv.cc.isClang [ ./optimize.diff ];
+  ++ stdenv.lib.optionals stdenv.cc.isClang [
+    (fetchpatch {
+      url = "https://github.com/KaOSx/main/raw/1270b8080f37fb6cca562829a521991800b0a497/libmad/optimize.diff";
+      sha256 = "0ciyaj1acg08g8hpzqx6whayq206fvf4whksz2pjgxlv207lqgjh";
+    })
+  ];
+
+  # The -fforce-mem flag has been removed in GCC 4.3.
+  postPatch = ''
+    substituteInPlace configure.ac --replace "-fforce-mem" ""
+    substituteInPlace configure.ac --replace "arch=\"-march=i486\"" ""
+  '';
 
   nativeBuildInputs = [ autoconf ];
 
-  # The -fforce-mem flag has been removed in GCC 4.3.
-  preConfigure = ''
-    autoconf
-    substituteInPlace configure --replace "-fforce-mem" ""
-    substituteInPlace configure --replace "arch=\"-march=i486\"" ""
-  '';
+  preConfigure = "autoconf";
 
   meta = with stdenv.lib; {
     homepage    = https://sourceforge.net/projects/mad/;
diff --git a/pkgs/development/libraries/libmad/optimize.diff b/pkgs/development/libraries/libmad/optimize.diff
deleted file mode 100644
index 1418dc927073..000000000000
--- a/pkgs/development/libraries/libmad/optimize.diff
+++ /dev/null
@@ -1,77 +0,0 @@
-Index: libmad-0.15.1b/configure.ac
-===================================================================
---- libmad-0.15.1b.orig/configure.ac	2008-03-07 20:31:23.000000000 +0000
-+++ libmad-0.15.1b/configure.ac	2008-03-07 20:34:26.000000000 +0000
-@@ -124,71 +124,7 @@
- 
- if test "$GCC" = yes
- then
--    if test -z "$arch"
--    then
--	case "$host" in
--	    i386-*)           ;;
--	    i?86-*)           arch="-march=i486" ;;
--	    arm*-empeg-*)     arch="-march=armv4 -mtune=strongarm1100" ;;
--	    armv4*-*)         arch="-march=armv4 -mtune=strongarm" ;;
--	    powerpc-*)        ;;
--	    mips*-agenda-*)   arch="-mcpu=vr4100" ;;
--	    mips*-luxsonor-*) arch="-mips1 -mcpu=r3000 -Wa,-m4010" ;;
--	esac
--    fi
--
--    case "$optimize" in
--	-O|"-O "*)
--	    optimize="-O"
--	    optimize="$optimize -fforce-mem"
--	    optimize="$optimize -fforce-addr"
--	    : #x optimize="$optimize -finline-functions"
--	    : #- optimize="$optimize -fstrength-reduce"
--	    optimize="$optimize -fthread-jumps"
--	    optimize="$optimize -fcse-follow-jumps"
--	    optimize="$optimize -fcse-skip-blocks"
--	    : #x optimize="$optimize -frerun-cse-after-loop"
--	    : #x optimize="$optimize -frerun-loop-opt"
--	    : #x optimize="$optimize -fgcse"
--	    optimize="$optimize -fexpensive-optimizations"
--	    optimize="$optimize -fregmove"
--	    : #* optimize="$optimize -fdelayed-branch"
--	    : #x optimize="$optimize -fschedule-insns"
--	    optimize="$optimize -fschedule-insns2"
--	    : #? optimize="$optimize -ffunction-sections"
--	    : #? optimize="$optimize -fcaller-saves"
--	    : #> optimize="$optimize -funroll-loops"
--	    : #> optimize="$optimize -funroll-all-loops"
--	    : #x optimize="$optimize -fmove-all-movables"
--	    : #x optimize="$optimize -freduce-all-givs"
--	    : #? optimize="$optimize -fstrict-aliasing"
--	    : #* optimize="$optimize -fstructure-noalias"
--
--	    case "$host" in
--		arm*-*)
--		    optimize="$optimize -fstrength-reduce"
--		    ;;
--		mips*-*)
--		    optimize="$optimize -fstrength-reduce"
--		    optimize="$optimize -finline-functions"
--		    ;;
--		i?86-*)
--		    optimize="$optimize -fstrength-reduce"
--		    ;;
--		powerpc-apple-*)
--		    # this triggers an internal compiler error with gcc2
--		    : #optimize="$optimize -fstrength-reduce"
--
--		    # this is really only beneficial with gcc3
--		    : #optimize="$optimize -finline-functions"
--		    ;;
--		*)
--		    # this sometimes provokes bugs in gcc 2.95.2
--		    : #optimize="$optimize -fstrength-reduce"
--		    ;;
--	    esac
--	    ;;
--    esac
-+    optimize="-O2"
- fi
- 
- case "$host" in
diff --git a/pkgs/development/libraries/libmad/pkgconfig.patch b/pkgs/development/libraries/libmad/pkgconfig.patch
deleted file mode 100644
index 0ac88acb8415..000000000000
--- a/pkgs/development/libraries/libmad/pkgconfig.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-diff -ruN libmad-0.15.1b.orig/Makefile.am libmad-0.15.1b/Makefile.am
---- libmad-0.15.1b.orig/Makefile.am	2004-02-17 02:02:03.000000000 +0000
-+++ libmad-0.15.1b/Makefile.am	2005-08-25 12:08:04.000000000 +0000
-@@ -33,9 +33,12 @@
- minimad_INCLUDES =	
- minimad_LDADD =		libmad.la
- 
--EXTRA_DIST =		mad.h.sed  \
-+EXTRA_DIST =		mad.h.sed mad.pc.in \
- 			CHANGES COPYRIGHT CREDITS README TODO VERSION
- 
-+pkgconfigdir = $(libdir)/pkgconfig
-+pkgconfig_DATA= mad.pc
-+
- exported_headers =	version.h fixed.h bit.h timer.h stream.h frame.h  \
- 			synth.h decoder.h
- 
-diff -ruN libmad-0.15.1b.orig/Makefile.in libmad-0.15.1b/Makefile.in
---- libmad-0.15.1b.orig/Makefile.in	2004-02-17 02:33:23.000000000 +0000
-+++ libmad-0.15.1b/Makefile.in	2005-08-25 12:09:34.000000000 +0000
-@@ -14,6 +14,8 @@
- 
- @SET_MAKE@
- 
-+pkgconfigdir = $(libdir)/pkgconfig
-+pkgconfig_DATA = mad.pc
- 
- SOURCES = $(libmad_la_SOURCES) $(EXTRA_libmad_la_SOURCES) $(minimad_SOURCES)
- 
-@@ -43,7 +45,7 @@
- 	$(srcdir)/Makefile.am $(srcdir)/Makefile.in \
- 	$(srcdir)/config.h.in $(srcdir)/libmad.list.in \
- 	$(top_srcdir)/configure COPYING INSTALL TODO config.guess \
--	config.sub depcomp install-sh ltmain.sh missing mkinstalldirs
-+	config.sub depcomp install-sh ltmain.sh missing mkinstalldirs mad.pc.in
- subdir = .
- ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
- am__aclocal_m4_deps = $(top_srcdir)/configure.ac
-@@ -53,7 +55,7 @@
-  configure.lineno configure.status.lineno
- mkinstalldirs = $(SHELL) $(top_srcdir)/mkinstalldirs
- CONFIG_HEADER = config.h
--CONFIG_CLEAN_FILES = libmad.list
-+CONFIG_CLEAN_FILES = libmad.list mad.pc
- am__installdirs = $(DESTDIR)$(libdir) $(DESTDIR)$(includedir)
- libLTLIBRARIES_INSTALL = $(INSTALL)
- LTLIBRARIES = $(lib_LTLIBRARIES)
-@@ -218,7 +220,7 @@
- minimad_SOURCES = minimad.c
- minimad_INCLUDES = 
- minimad_LDADD = libmad.la
--EXTRA_DIST = mad.h.sed  \
-+EXTRA_DIST = mad.h.sed  mad.pc.in \
- 			CHANGES COPYRIGHT CREDITS README TODO VERSION
- 
- exported_headers = version.h fixed.h bit.h timer.h stream.h frame.h  \
-@@ -298,6 +300,28 @@
- 	rm -f stamp-h1
- 	touch $@
- 
-+mad.pc: $(top_builddir)/config.status mad.pc.in
-+	cd $(top_builddir) && CONFIG_FILES=$@ CONFIG_HEADERS= $(SHELL) ./config.status
-+
-+install-pkgconfigDATA: $(pkgconfig_DATA)
-+	@$(NORMAL_INSTALL)
-+	$(mkinstalldirs) $(DESTDIR)$(pkgconfigdir)
-+	@list='$(pkgconfig_DATA)'; for p in $$list; do \
-+	  if test -f $(srcdir)/$$p; then \
-+	    echo " $(INSTALL_DATA) $(srcdir)/$$p $(DESTDIR)$(pkgconfigdir)/$$p"; \
-+	    $(INSTALL_DATA) $(srcdir)/$$p $(DESTDIR)$(pkgconfigdir)/$$p; \
-+	  else if test -f $$p; then \
-+	    echo " $(INSTALL_DATA) $$p $(DESTDIR)$(pkgconfigdir)/$$p"; \
-+	    $(INSTALL_DATA) $$p $(DESTDIR)$(pkgconfigdir)/$$p; \
-+	  fi; fi; \
-+	done
-+
-+uninstall-pkgconfigDATA:
-+	@$(NORMAL_UNINSTALL)
-+	list='$(pkgconfig_DATA)'; for p in $$list; do \
-+	  rm -f $(DESTDIR)$(pkgconfigdir)/$$p; \
-+	done
-+
- distclean-hdr:
- 	-rm -f config.h stamp-h1
- libmad.list: $(top_builddir)/config.status $(srcdir)/libmad.list.in
-@@ -726,7 +750,7 @@
- 
- info-am:
- 
--install-data-am: install-includeHEADERS
-+install-data-am: install-includeHEADERS install-pkgconfigDATA
- 
- install-exec-am: install-libLTLIBRARIES
- 
-@@ -757,7 +781,7 @@
- ps-am:
- 
- uninstall-am: uninstall-includeHEADERS uninstall-info-am \
--	uninstall-libLTLIBRARIES
-+	uninstall-libLTLIBRARIES install-pkgconfigDATA
- 
- uninstall-info: uninstall-info-recursive
- 
-diff -ruN libmad-0.15.1b.orig/mad.pc.in libmad-0.15.1b/mad.pc.in
---- libmad-0.15.1b.orig/mad.pc.in	1970-01-01 00:00:00.000000000 +0000
-+++ libmad-0.15.1b/mad.pc.in	2005-08-25 12:08:04.000000000 +0000
-@@ -0,0 +1,10 @@
-+prefix=@prefix@
-+exec_prefix=@exec_prefix@
-+libdir=@libdir@
-+includedir=@includedir@
-+
-+Name: MAD
-+Description: libmad - MPEG audio decoder library
-+Version: @VERSION@
-+Libs: -L${libdir} -lmad
-+Cflags:

From 1289606e0236ff9b3bd35a08e3560f2d1fb8bc53 Mon Sep 17 00:00:00 2001
From: c0bw3b <c0bw3b@users.noreply.github.com>
Date: Mon, 11 Nov 2019 17:50:37 +0100
Subject: [PATCH 085/144] mpg321: fix CVE-2018-7263

Close #57154
Close #70105
---
 pkgs/applications/audio/mpg321/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/audio/mpg321/default.nix b/pkgs/applications/audio/mpg321/default.nix
index 65dfe3484b66..fdefcf7e77d6 100644
--- a/pkgs/applications/audio/mpg321/default.nix
+++ b/pkgs/applications/audio/mpg321/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, libao, libmad, libid3tag, zlib, alsaLib
+{stdenv, fetchurl, fetchpatch, libao, libmad, libid3tag, zlib, alsaLib
 # Specify default libao output plugin to use (e.g. "alsa", "pulse" …).
 # If null, it will use the libao system default.
 , defaultAudio ? null
@@ -13,6 +13,14 @@ stdenv.mkDerivation rec {
     sha256 = "0ki8mh76bbmdh77qsiw682dvi8y468yhbdabqwg05igmwc1wqvq5";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2018-7263.patch";
+      url = "https://sources.debian.org/data/main/m/mpg321/0.3.2-3/debian/patches/handle_illegal_bitrate_value.patch";
+      sha256 = "15simp5fjvm9b024ryfh441rkh2d5bcrizqkzlrh07n9sm7fkw6x";
+    })
+  ];
+
   hardeningDisable = [ "format" ];
 
   configureFlags =

From d45d6205de2e41b99405efae1066d36dcff71fbd Mon Sep 17 00:00:00 2001
From: Lily Ballard <lily@sb.org>
Date: Mon, 5 Aug 2019 21:27:21 -0700
Subject: [PATCH 086/144] setup.sh: rewrite stripHash

Rewrite the `stripHash` helper function with 2 differences:

* Paths starting with `--` will no longer produce an error.
* Use Bash string manipulation instead of shelling out to `grep` and
  `cut`. This should be faster.
---
 pkgs/stdenv/generic/setup.sh | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 730e77c20f90..5b8fdde57961 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -787,14 +787,17 @@ dumpVars() {
 # Utility function: echo the base name of the given path, with the
 # prefix `HASH-' removed, if present.
 stripHash() {
-    local strippedName
+    local strippedName casematchOpt=0
     # On separate line for `set -e`
-    strippedName="$(basename "$1")"
-    if echo "$strippedName" | grep -q '^[a-z0-9]\{32\}-'; then
-        echo "$strippedName" | cut -c34-
+    strippedName="$(basename -- "$1")"
+    shopt -q nocasematch && casematchOpt=1
+    shopt -u nocasematch
+    if [[ "$strippedName" =~ ^[a-z0-9]{32}- ]]; then
+        echo "${strippedName:33}"
     else
         echo "$strippedName"
     fi
+    if (( casematchOpt )); then shopt -s nocasematch; fi
 }
 
 

From c7fbf93ecc8d009c0b1598fb443fb3088b6489a8 Mon Sep 17 00:00:00 2001
From: Linus Arver <linusarver@gmail.com>
Date: Sun, 27 Oct 2019 19:16:43 -0700
Subject: [PATCH 087/144] ncurses: add infocmp utility

---
 pkgs/development/libraries/ncurses/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 708ba46b42eb..540ea71abfb8 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -141,6 +141,7 @@ stdenv.mkDerivation rec {
     moveToOutput "bin/tset" "$out"
     moveToOutput "bin/captoinfo" "$out"
     moveToOutput "bin/infotocap" "$out"
+    moveToOutput "bin/infocmp" "$out"
   '';
 
   preFixup = lib.optionalString (!stdenv.hostPlatform.isCygwin && !enableStatic) ''

From 30e428c96caa2e41472100a959ea68206e542998 Mon Sep 17 00:00:00 2001
From: Timothy DeHerrera <tim.deh@pm.me>
Date: Wed, 6 Nov 2019 14:22:59 -0700
Subject: [PATCH 088/144] ffmpeg: add options for QuickSync and libaom AV1

Allow users to optionally compile with support for Intel's QuickSync
hardware accelerated encoding, and libaom AV1 encoding. Set to false by
default.
---
 pkgs/development/libraries/ffmpeg/generic.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index b3310e44ae06..ccdf4662719a 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -3,6 +3,8 @@
 , libssh, libtheora, libva, libdrm, libvorbis, libvpx, lzma, libpulseaudio, soxr
 , x264, x265, xvidcore, zlib, libopus, speex, nv-codec-headers, dav1d
 , openglSupport ? false, libGLU_combined ? null
+, libmfxSupport ? false, intel-media-sdk ? null
+, libaomSupport ? false, libaom ? null
 # Build options
 , runtimeCpuDetectBuild ? true # Detect CPU capabilities at runtime
 , multithreadBuild ? true # Multithreading via pthreads/win32 threads
@@ -62,6 +64,8 @@ let
 in
 
 assert openglSupport -> libGLU_combined != null;
+assert libmfxSupport -> intel-media-sdk != null;
+assert libaomSupport -> libaom != null;
 
 stdenv.mkDerivation rec {
 
@@ -135,6 +139,8 @@ stdenv.mkDerivation rec {
       (ifMinVer "0.6" (enableFeature vpxSupport "libvpx"))
       (ifMinVer "2.4" "--enable-lzma")
       (ifMinVer "2.2" (enableFeature openglSupport "opengl"))
+      (ifMinVer "4.2" (enableFeature libmfxSupport "libmfx"))
+      (ifMinVer "4.2" (enableFeature libaomSupport "libaom"))
       (disDarwinOrArmFix (ifMinVer "0.9" "--enable-libpulse") "0.9" "--disable-libpulse")
       (ifMinVer "2.5" (if sdlSupport && reqMin "3.2" then "--enable-sdl2" else if sdlSupport then "--enable-sdl" else null)) # autodetected before 2.5, SDL1 support removed in 3.2 for SDL2
       (ifMinVer "1.2" "--enable-libsoxr")
@@ -163,6 +169,8 @@ stdenv.mkDerivation rec {
     bzip2 fontconfig freetype gnutls libiconv lame libass libogg libssh libtheora
     libvdpau libvorbis lzma soxr x264 x265 xvidcore zlib libopus speex nv-codec-headers
   ] ++ optional openglSupport libGLU_combined
+    ++ optional libmfxSupport intel-media-sdk
+    ++ optional vpxSupport libaom
     ++ optional vpxSupport libvpx
     ++ optionals (!isDarwin && !isAarch32) [ libpulseaudio ] # Need to be fixed on Darwin and ARM
     ++ optional ((isLinux || isFreeBSD) && !isAarch32) libva

From fe758f5fa368ebcdc03419c54412dd9abfd76b35 Mon Sep 17 00:00:00 2001
From: Lancelot SIX <lsix@lancelotsix.com>
Date: Wed, 6 Nov 2019 17:30:02 +0100
Subject: [PATCH 089/144] cpio: 2.12 -> 2.13

See https://lists.gnu.org/archive/html/info-gnu/2019-11/msg00002.html
for release information.

Fixes CVE-2019-14866
---
 .../CVE-2016-2037-out-of-bounds-write.patch   | 29 -------------------
 pkgs/tools/archivers/cpio/default.nix         | 20 ++-----------
 2 files changed, 3 insertions(+), 46 deletions(-)
 delete mode 100644 pkgs/tools/archivers/cpio/CVE-2016-2037-out-of-bounds-write.patch

diff --git a/pkgs/tools/archivers/cpio/CVE-2016-2037-out-of-bounds-write.patch b/pkgs/tools/archivers/cpio/CVE-2016-2037-out-of-bounds-write.patch
deleted file mode 100644
index 90ddeff9790e..000000000000
--- a/pkgs/tools/archivers/cpio/CVE-2016-2037-out-of-bounds-write.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-diff --git a/src/copyin.c b/src/copyin.c
-index cde911e..032d35f 100644
---- a/src/copyin.c
-+++ b/src/copyin.c
-@@ -1385,6 +1385,8 @@ process_copy_in ()
-          break;
-        }
-
-+      if (file_hdr.c_namesize <= 1)
-+        file_hdr.c_name = xrealloc(file_hdr.c_name, 2);
-       cpio_safer_name_suffix (file_hdr.c_name, false, !no_abs_paths_flag,
-                              false);
-
-diff --git a/src/util.c b/src/util.c
-index 6ff6032..2763ac1 100644
---- a/src/util.c
-+++ b/src/util.c
-@@ -1411,7 +1411,10 @@ set_file_times (int fd,
- }
-
- /* Do we have to ignore absolute paths, and if so, does the filename
--   have an absolute path?  */
-+   have an absolute path?
-+   Before calling this function make sure that the allocated NAME buffer has
-+   capacity at least 2 bytes to allow us to store the "." string inside.  */
-+
- void
- cpio_safer_name_suffix (char *name, bool link_target, bool absolute_names,
-                        bool strip_leading_dots)
diff --git a/pkgs/tools/archivers/cpio/default.nix b/pkgs/tools/archivers/cpio/default.nix
index 44943109ee18..3f6b3ba4598c 100644
--- a/pkgs/tools/archivers/cpio/default.nix
+++ b/pkgs/tools/archivers/cpio/default.nix
@@ -1,30 +1,16 @@
-{ stdenv, fetchurl, fetchpatch }:
+{ stdenv, fetchurl }:
 
 let
-  version = "2.12";
+  version = "2.13";
   name = "cpio-${version}";
 in stdenv.mkDerivation {
   inherit name;
 
   src = fetchurl {
     url = "mirror://gnu/cpio/${name}.tar.bz2";
-    sha256 = "0vi9q475h1rki53100zml75vxsykzyhrn70hidy41s5c2rc8r6bh";
+    sha256 = "0vbgnhkawdllgnkdn6zn1f56fczwk0518krakz2qbwhxmv2vvdga";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2015-1197-cpio-2.12.patch";
-      url = "https://gist.github.com/nckx/70b0bfa80ddfb86c2967/"
-        + "raw/e9b40d4d4b701f584f826775b75beb10751dc884/"
-        + "CVE-2015-1197-cpio-2.12.patch";
-      sha256 = "0ph43m4lavwkc4gnl5h9p3da4kb1pnhwk5l2qsky70dqri8pcr8v";
-    })
-
-    # Report: http://www.openwall.com/lists/oss-security/2016/01/19/4
-    # Patch from https://lists.gnu.org/archive/html/bug-cpio/2016-01/msg00005.html
-    ./CVE-2016-2037-out-of-bounds-write.patch
-  ];
-
   preConfigure = if stdenv.isCygwin then ''
     sed -i gnu/fpending.h -e 's,include <stdio_ext.h>,,'
   '' else null;

From 2cef6accb869ef4f5ff139e443b99c3c2fc4e4ff Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Fri, 8 Nov 2019 19:48:42 +0300
Subject: [PATCH 090/144] curl: 7.66.0 -> 7.67.0

---
 pkgs/tools/networking/curl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 817f3ccf19b9..24c3145c7db4 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -24,14 +24,14 @@ assert brotliSupport -> brotli != null;
 assert gssSupport -> libkrb5 != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.66.0";
+  name = "curl-7.67.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/${name}.tar.bz2"
       "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] name}/${name}.tar.bz2"
     ];
-    sha256 = "0hd1wwplw357hn876s4n2gk7dpmd1gfw5d2c3yi21i1m09726636";
+    sha256 = "0v2qb1c82m3qzkiyglsg1745qi791i9pl1jgnks8nm0sh9b6jpyx";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];

From 3e267ad39b2b4a412509f43afc80294b7dd05852 Mon Sep 17 00:00:00 2001
From: Lancelot SIX <lsix@lancelotsix.com>
Date: Wed, 6 Nov 2019 23:02:22 +0100
Subject: [PATCH 091/144] gettext: 0.19.8.1 -> 0.20.1

- 0.20 release information: https://lists.gnu.org/archive/html/info-gnu/2019-05/msg00006.html
- 0.20.1 release information: https://lists.gnu.org/archive/html/info-gnu/2019-05/msg00011.html
---
 .../gettext/CVE-2018-18751-bison.patch        | 323 ------------------
 .../development/libraries/gettext/default.nix |  23 +-
 2 files changed, 3 insertions(+), 343 deletions(-)
 delete mode 100644 pkgs/development/libraries/gettext/CVE-2018-18751-bison.patch

diff --git a/pkgs/development/libraries/gettext/CVE-2018-18751-bison.patch b/pkgs/development/libraries/gettext/CVE-2018-18751-bison.patch
deleted file mode 100644
index b734c1c8b027..000000000000
--- a/pkgs/development/libraries/gettext/CVE-2018-18751-bison.patch
+++ /dev/null
@@ -1,323 +0,0 @@
-This patch was generated by re-running Bison 3.0.4 on pro-gram-gen.y after
-applying CVE-2018-18751.patch. This patch removes the need to add bison to
-nativeBuildInputs.
-
---- a/gettext-tools/src/po-gram-gen.c
-+++ b/gettext-tools/src/po-gram-gen.c
-@@ -568,9 +568,9 @@ static const yytype_uint8 yytranslate[] =
- static const yytype_uint16 yyrline[] =
- {
-        0,   169,   169,   171,   172,   173,   174,   179,   187,   195,
--     216,   240,   249,   258,   269,   278,   292,   301,   315,   321,
--     332,   338,   350,   361,   372,   376,   391,   414,   422,   434,
--     442
-+     216,   237,   246,   255,   266,   275,   289,   298,   312,   318,
-+     329,   335,   347,   358,   369,   373,   388,   411,   419,   431,
-+     439
- };
- #endif
-
-@@ -1419,14 +1419,11 @@ yyreduce:
-                   check_obsolete ((yyvsp[-3].message_intro), (yyvsp[-1].string));
-                   check_obsolete ((yyvsp[-3].message_intro), (yyvsp[0].rhs));
-                   if (!(yyvsp[-3].message_intro).obsolete || pass_obsolete_entries)
--                    {
--                      do_callback_message ((yyvsp[-3].message_intro).ctxt, string2, &(yyvsp[-3].message_intro).pos, (yyvsp[-1].string).string,
--                                           (yyvsp[0].rhs).rhs.msgstr, (yyvsp[0].rhs).rhs.msgstr_len, &(yyvsp[0].rhs).pos,
--                                           (yyvsp[-3].message_intro).prev_ctxt,
--                                           (yyvsp[-3].message_intro).prev_id, (yyvsp[-3].message_intro).prev_id_plural,
--                                           (yyvsp[-3].message_intro).obsolete);
--                      free ((yyvsp[-1].string).string);
--                    }
-+                    do_callback_message ((yyvsp[-3].message_intro).ctxt, string2, &(yyvsp[-3].message_intro).pos, (yyvsp[-1].string).string,
-+                                         (yyvsp[0].rhs).rhs.msgstr, (yyvsp[0].rhs).rhs.msgstr_len, &(yyvsp[0].rhs).pos,
-+                                         (yyvsp[-3].message_intro).prev_ctxt,
-+                                         (yyvsp[-3].message_intro).prev_id, (yyvsp[-3].message_intro).prev_id_plural,
-+                                         (yyvsp[-3].message_intro).obsolete);
-                   else
-                     {
-                       free_message_intro ((yyvsp[-3].message_intro));
-@@ -1435,11 +1432,11 @@ yyreduce:
-                       free ((yyvsp[0].rhs).rhs.msgstr);
-                     }
-                 }
--#line 1439 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1436 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 11:
--#line 241 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 238 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].message_intro), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].message_intro), (yyvsp[0].string));
-@@ -1448,11 +1445,11 @@ yyreduce:
-                   string_list_destroy (&(yyvsp[-1].stringlist).stringlist);
-                   free ((yyvsp[0].string).string);
-                 }
--#line 1452 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1449 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 12:
--#line 250 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 247 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].message_intro), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].message_intro), (yyvsp[0].rhs));
-@@ -1461,22 +1458,22 @@ yyreduce:
-                   string_list_destroy (&(yyvsp[-1].stringlist).stringlist);
-                   free ((yyvsp[0].rhs).rhs.msgstr);
-                 }
--#line 1465 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1462 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 13:
--#line 259 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 256 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].message_intro), (yyvsp[0].stringlist));
-                   po_gram_error_at_line (&(yyvsp[-1].message_intro).pos, _("missing 'msgstr' section"));
-                   free_message_intro ((yyvsp[-1].message_intro));
-                   string_list_destroy (&(yyvsp[0].stringlist).stringlist);
-                 }
--#line 1476 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1473 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 14:
--#line 270 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 267 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   (yyval.message_intro).prev_ctxt = NULL;
-                   (yyval.message_intro).prev_id = NULL;
-@@ -1485,11 +1482,11 @@ yyreduce:
-                   (yyval.message_intro).pos = (yyvsp[0].string).pos;
-                   (yyval.message_intro).obsolete = (yyvsp[0].string).obsolete;
-                 }
--#line 1489 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1486 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 15:
--#line 279 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 276 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].prev), (yyvsp[0].string));
-                   (yyval.message_intro).prev_ctxt = (yyvsp[-1].prev).ctxt;
-@@ -1499,11 +1496,11 @@ yyreduce:
-                   (yyval.message_intro).pos = (yyvsp[0].string).pos;
-                   (yyval.message_intro).obsolete = (yyvsp[0].string).obsolete;
-                 }
--#line 1503 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1500 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 16:
--#line 293 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 290 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].string), (yyvsp[0].stringlist));
-                   (yyval.prev).ctxt = (yyvsp[-1].string).string;
-@@ -1512,11 +1509,11 @@ yyreduce:
-                   (yyval.prev).pos = (yyvsp[-1].string).pos;
-                   (yyval.prev).obsolete = (yyvsp[-1].string).obsolete;
-                 }
--#line 1516 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1513 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 17:
--#line 302 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 299 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].string), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].string), (yyvsp[0].string));
-@@ -1526,21 +1523,21 @@ yyreduce:
-                   (yyval.prev).pos = (yyvsp[-2].string).pos;
-                   (yyval.prev).obsolete = (yyvsp[-2].string).obsolete;
-                 }
--#line 1530 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1527 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 18:
--#line 316 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 313 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   (yyval.string).string = NULL;
-                   (yyval.string).pos = (yyvsp[0].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[0].pos).obsolete;
-                 }
--#line 1540 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1537 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 19:
--#line 322 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 319 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].pos), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].pos), (yyvsp[0].pos));
-@@ -1548,21 +1545,21 @@ yyreduce:
-                   (yyval.string).pos = (yyvsp[0].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[0].pos).obsolete;
-                 }
--#line 1552 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1549 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 20:
--#line 333 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 330 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   (yyval.string).string = NULL;
-                   (yyval.string).pos = (yyvsp[0].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[0].pos).obsolete;
-                 }
--#line 1562 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1559 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 21:
--#line 339 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 336 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].pos), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].pos), (yyvsp[0].pos));
-@@ -1570,11 +1567,11 @@ yyreduce:
-                   (yyval.string).pos = (yyvsp[0].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[0].pos).obsolete;
-                 }
--#line 1574 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1571 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 22:
--#line 351 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 348 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].pos), (yyvsp[0].stringlist));
-                   plural_counter = 0;
-@@ -1582,30 +1579,30 @@ yyreduce:
-                   (yyval.string).pos = (yyvsp[-1].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[-1].pos).obsolete;
-                 }
--#line 1586 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1583 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 23:
--#line 362 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 359 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].pos), (yyvsp[0].stringlist));
-                   (yyval.string).string = string_list_concat_destroy (&(yyvsp[0].stringlist).stringlist);
-                   (yyval.string).pos = (yyvsp[-1].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[-1].pos).obsolete;
-                 }
--#line 1597 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1594 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 24:
--#line 373 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 370 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   (yyval.rhs) = (yyvsp[0].rhs);
-                 }
--#line 1605 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1602 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 25:
--#line 377 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 374 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].rhs), (yyvsp[0].rhs));
-                   (yyval.rhs).rhs.msgstr = XNMALLOC ((yyvsp[-1].rhs).rhs.msgstr_len + (yyvsp[0].rhs).rhs.msgstr_len, char);
-@@ -1617,11 +1614,11 @@ yyreduce:
-                   (yyval.rhs).pos = (yyvsp[-1].rhs).pos;
-                   (yyval.rhs).obsolete = (yyvsp[-1].rhs).obsolete;
-                 }
--#line 1621 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1618 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 26:
--#line 392 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 389 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-4].pos), (yyvsp[-3].pos));
-                   check_obsolete ((yyvsp[-4].pos), (yyvsp[-2].number));
-@@ -1640,11 +1637,11 @@ yyreduce:
-                   (yyval.rhs).pos = (yyvsp[-4].pos).pos;
-                   (yyval.rhs).obsolete = (yyvsp[-4].pos).obsolete;
-                 }
--#line 1644 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1641 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 27:
--#line 415 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 412 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   string_list_init (&(yyval.stringlist).stringlist);
-                   string_list_append (&(yyval.stringlist).stringlist, (yyvsp[0].string).string);
-@@ -1652,11 +1649,11 @@ yyreduce:
-                   (yyval.stringlist).pos = (yyvsp[0].string).pos;
-                   (yyval.stringlist).obsolete = (yyvsp[0].string).obsolete;
-                 }
--#line 1656 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1653 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 28:
--#line 423 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 420 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].stringlist), (yyvsp[0].string));
-                   (yyval.stringlist).stringlist = (yyvsp[-1].stringlist).stringlist;
-@@ -1665,11 +1662,11 @@ yyreduce:
-                   (yyval.stringlist).pos = (yyvsp[-1].stringlist).pos;
-                   (yyval.stringlist).obsolete = (yyvsp[-1].stringlist).obsolete;
-                 }
--#line 1669 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1666 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 29:
--#line 435 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 432 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   string_list_init (&(yyval.stringlist).stringlist);
-                   string_list_append (&(yyval.stringlist).stringlist, (yyvsp[0].string).string);
-@@ -1677,11 +1674,11 @@ yyreduce:
-                   (yyval.stringlist).pos = (yyvsp[0].string).pos;
-                   (yyval.stringlist).obsolete = (yyvsp[0].string).obsolete;
-                 }
--#line 1681 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1678 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 30:
--#line 443 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 440 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].stringlist), (yyvsp[0].string));
-                   (yyval.stringlist).stringlist = (yyvsp[-1].stringlist).stringlist;
-@@ -1690,11 +1687,11 @@ yyreduce:
-                   (yyval.stringlist).pos = (yyvsp[-1].stringlist).pos;
-                   (yyval.stringlist).obsolete = (yyvsp[-1].stringlist).obsolete;
-                 }
--#line 1694 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1691 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-
--#line 1698 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1695 "po-gram-gen.c" /* yacc.c:1646  */
-       default: break;
-     }
-   /* User semantic actions sometimes alter yychar, and that requires
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index 9547c6c31ada..7a6129a68da5 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -1,24 +1,15 @@
-{ stdenv, lib, fetchurl, libiconv, xz, bison, automake115x, autoconf }:
+{ stdenv, lib, fetchurl, libiconv, xz }:
 
-let allowBisonDependency = !stdenv.isDarwin; in
 stdenv.mkDerivation rec {
   pname = "gettext";
-  version = "0.19.8.1";
+  version = "0.20.1";
 
   src = fetchurl {
     url = "mirror://gnu/gettext/${pname}-${version}.tar.gz";
-    sha256 = "0hsw28f9q9xaggjlsdp2qmbp2rbd1mp0njzan2ld9kiqwkq2m57z";
+    sha256 = "0p3zwkk27wm2m2ccfqm57nj7vqkmfpn7ja1nf65zmhz8qqs5chb6";
   };
   patches = [
     ./absolute-paths.diff
-    (fetchurl {
-      name = "CVE-2018-18751.patch";
-      url = "https://git.savannah.gnu.org/gitweb/?p=gettext.git;a=patch;h=dce3a16e5e9368245735e29bf498dcd5e3e474a4";
-      sha256 = "1lpjwwcjr1sb879faj0xyzw02kma0ivab6xwn3qciy13qy6fq5xn";
-    })
-  ] ++ lib.optionals (!allowBisonDependency) [
-    # Only necessary for CVE-2018-18751.patch:
-    ./CVE-2018-18751-bison.patch
   ];
 
   outputs = [ "out" "man" "doc" "info" ];
@@ -54,14 +45,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     xz
     xz.bin
-  ]
-  # Only necessary for CVE-2018-18751.patch (unless CVE-2018-18751-bison.patch
-  # is also applied):
-  ++ lib.optional allowBisonDependency bison
-  ++ [
-    # Only necessary for CVE-2018-18751.patch:
-    automake115x
-    autoconf
   ];
   # HACK, see #10874 (and 14664)
   buildInputs = stdenv.lib.optional (!stdenv.isLinux && !stdenv.hostPlatform.isCygwin) libiconv;

From 8bff1041149f8b8ebfe0aff27d5a34426fea16e5 Mon Sep 17 00:00:00 2001
From: Luka Blaskovic <lblasc@tvbeat.com>
Date: Sat, 31 Aug 2019 21:13:08 +0000
Subject: [PATCH 092/144] rustc: bump runtime LLVM to match upstream

```
rustc 1.38.0
binary: rustc
commit-hash: unknown
commit-date: unknown
host: x86_64-unknown-linux-gnu
release: 1.38.0
LLVM version: 9.0
```
---
 pkgs/development/compilers/rust/rustc.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 8a7d680010df..ceaf6f4c2258 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -1,6 +1,6 @@
 { stdenv, removeReferencesTo, pkgsBuildBuild, pkgsBuildHost, pkgsBuildTarget
 , fetchurl, file, python2
-, llvm_7, darwin, git, cmake, rustPlatform
+, llvm_9, darwin, git, cmake, rustPlatform
 , pkgconfig, openssl
 , which, libffi
 , withBundledLLVM ? false
@@ -12,12 +12,12 @@ let
   inherit (stdenv.lib) optional optionalString;
   inherit (darwin.apple_sdk.frameworks) Security;
 
-  llvmSharedForBuild = pkgsBuildBuild.llvm_7.override { enableSharedLibraries = true; };
-  llvmSharedForHost = pkgsBuildHost.llvm_7.override { enableSharedLibraries = true; };
-  llvmSharedForTarget = pkgsBuildTarget.llvm_7.override { enableSharedLibraries = true; };
+  llvmSharedForBuild = pkgsBuildBuild.llvm_9.override { enableSharedLibraries = true; };
+  llvmSharedForHost = pkgsBuildHost.llvm_9.override { enableSharedLibraries = true; };
+  llvmSharedForTarget = pkgsBuildTarget.llvm_9.override { enableSharedLibraries = true; };
 
   # For use at runtime
-  llvmShared = llvm_7.override { enableSharedLibraries = true; };
+  llvmShared = llvm_9.override { enableSharedLibraries = true; };
 in stdenv.mkDerivation rec {
   pname = "rustc";
   inherit version;

From 571c59fa4268f172da02554f1b54752dada50c56 Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Mon, 11 Nov 2019 22:29:01 +0300
Subject: [PATCH 093/144] mariadb-connector-c: 3.1.4 -> 3.1.5

---
 pkgs/servers/sql/mariadb/connector-c/3_1.nix     | 4 ++--
 pkgs/servers/sql/mariadb/connector-c/default.nix | 9 +--------
 2 files changed, 3 insertions(+), 10 deletions(-)

diff --git a/pkgs/servers/sql/mariadb/connector-c/3_1.nix b/pkgs/servers/sql/mariadb/connector-c/3_1.nix
index cac300cf15a3..257fa93d2b51 100644
--- a/pkgs/servers/sql/mariadb/connector-c/3_1.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/3_1.nix
@@ -1,6 +1,6 @@
 { callPackage, ... } @ args:
 
 callPackage ./. (args // {
-  version = "3.1.4";
-  sha256 = "05jkaq151a45rqpyh0vrn6xcpawayfxyzhwn1w32hk0fw3z746ks";
+  version = "3.1.5";
+  sha256 = "1mfrm595kfnpjladaq6m184npa3rxff9pr1vwa35r057s7nmzpm9";
 })
diff --git a/pkgs/servers/sql/mariadb/connector-c/default.nix b/pkgs/servers/sql/mariadb/connector-c/default.nix
index 01cf015c825c..af344d637217 100644
--- a/pkgs/servers/sql/mariadb/connector-c/default.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, fetchpatch
+{ stdenv, fetchurl, cmake
 , curl, openssl, zlib
 , libiconv
 , version, sha256, ...
@@ -18,13 +18,6 @@ stdenv.mkDerivation {
     inherit sha256;
   };
 
-  patches = stdenv.lib.optionals stdenv.isDarwin [
-    (fetchpatch {
-      url = "https://github.com/MariaDB/mariadb-connector-c/commit/ee91b2c98a63acb787114dee4f2694e154630928.patch";
-      sha256 = "05mlyv20kzn9bax4byv2ph1cf42541fcl1zcqzbfwqmynnisvdah";
-    })
-  ];
-
   cmakeFlags = [
     "-DMARIADB_UNIX_ADDR=/run/mysqld/mysqld.sock"
     "-DWITH_CURL=ON"

From 23fb174d82045f4e6348e44ba0d4883dece18568 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:37 +0100
Subject: [PATCH 094/144] python: mpi4py: 3.0.2 -> 3.0.3

---
 pkgs/development/python-modules/mpi4py/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mpi4py/default.nix b/pkgs/development/python-modules/mpi4py/default.nix
index e2028d9332b0..8cd639e520ce 100644
--- a/pkgs/development/python-modules/mpi4py/default.nix
+++ b/pkgs/development/python-modules/mpi4py/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "mpi4py";
-  version = "3.0.2";
+  version = "3.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1q28xl36difma1wq0acq111cqxjya32kn3lxp6fbidz3wg8jkmpq";
+    sha256 = "012d716c8b9ed1e513fcc4b18e5af16a8791f51e6d1716baccf988ad355c5a1f";
   };
 
   passthru = {

From 5c568360dc87765c5415c02e1bd80eef5c14210d Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:37 +0100
Subject: [PATCH 095/144] python: mwoauth: 0.3.5 -> 0.3.7

---
 pkgs/development/python-modules/mwoauth/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mwoauth/default.nix b/pkgs/development/python-modules/mwoauth/default.nix
index d643e71f258e..778a081992c1 100644
--- a/pkgs/development/python-modules/mwoauth/default.nix
+++ b/pkgs/development/python-modules/mwoauth/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "mwoauth";
-  version = "0.3.5";
+  version = "0.3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c7e4c56561a280e14ca4cc20b79ba4a9dd4ec752ff4c797cf29dad4460fb7832";
+    sha256 = "9e0d70a1fa6f452584de1cb853ae6c11f41233549f7839cfb879f99410f6ad46";
   };
 
   # package has no tests

From 89c2ae58d14d3ea1ac4fd93a0ae0e103c9b0944e Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:38 +0100
Subject: [PATCH 096/144] python: myfitnesspal: 1.13.3 -> 1.13.4

---
 pkgs/development/python-modules/myfitnesspal/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/myfitnesspal/default.nix b/pkgs/development/python-modules/myfitnesspal/default.nix
index b839fd2633e9..570d0c3e749c 100644
--- a/pkgs/development/python-modules/myfitnesspal/default.nix
+++ b/pkgs/development/python-modules/myfitnesspal/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "myfitnesspal";
-  version = "1.13.3";
+  version = "1.13.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4f785341f0499bad8d3400cfcfffd99b7fcf8aac3971390f8ec3dfaed8361b20";
+    sha256 = "552cc696e170f12f75fd12b1447be01fa2d0bfd85e14da5928afd9aab2277b98";
   };
 
   # Remove overly restrictive version constraints on keyring and keyrings.alt

From fbf69412c41ec099c62c38437385914ab4f9fc75 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:38 +0100
Subject: [PATCH 097/144] python: mysqlclient: 1.4.4 -> 1.4.5

---
 pkgs/development/python-modules/mysqlclient/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mysqlclient/default.nix b/pkgs/development/python-modules/mysqlclient/default.nix
index b37f191286e4..b2af7bded1c1 100644
--- a/pkgs/development/python-modules/mysqlclient/default.nix
+++ b/pkgs/development/python-modules/mysqlclient/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "mysqlclient";
-  version = "1.4.4";
+  version = "1.4.5";
 
   nativeBuildInputs = [
     libmysqlclient
@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1379hab7spjp9v5fypqgy0b8vr8vnalxahm9hcsxvj2xbb2pqwww";
+    sha256 = "e80109b0ae8d952b900b31b623181532e5e89376d707dcbeb63f99e69cefe559";
   };
 
   meta = with stdenv.lib; {

From 66693c76b2e07930e2f746fc3d062dceaa448977 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:38 +0100
Subject: [PATCH 098/144] python: nbconvert: 5.6.0 -> 5.6.1

---
 pkgs/development/python-modules/nbconvert/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/nbconvert/default.nix b/pkgs/development/python-modules/nbconvert/default.nix
index 965d3df0e91b..b0357c16165c 100644
--- a/pkgs/development/python-modules/nbconvert/default.nix
+++ b/pkgs/development/python-modules/nbconvert/default.nix
@@ -22,11 +22,11 @@
 
 buildPythonPackage rec {
   pname = "nbconvert";
-  version = "5.6.0";
+  version = "5.6.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "427a468ec26e7d68a529b95f578d5cbf018cb4c1f889e897681c2b6d11897695";
+    sha256 = "21fb48e700b43e82ba0e3142421a659d7739b65568cc832a13976a77be16b523";
   };
 
   checkInputs = [ nose pytest glibcLocales ];

From 4c26c544549082a759bce23063f530e2f7428578 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:38 +0100
Subject: [PATCH 099/144] python: nbdime: 1.0.6 -> 1.0.7

---
 pkgs/development/python-modules/nbdime/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/nbdime/default.nix b/pkgs/development/python-modules/nbdime/default.nix
index 25605a217274..5bff17ee895c 100644
--- a/pkgs/development/python-modules/nbdime/default.nix
+++ b/pkgs/development/python-modules/nbdime/default.nix
@@ -24,12 +24,12 @@
 
 buildPythonPackage rec {
   pname = "nbdime";
-  version = "1.0.6";
+  version = "1.0.7";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "00nywb69kp9i0wl5mczgwqc5db8v70ihr9cjbwqppd2jkx4vf34j";
+    sha256 = "28615cb92d59e0511026bac4c916f16dc15981bcad4ddc3f7fdd6a289ea01242";
   };
 
   checkInputs = [

From b27b8ab803fe9395d6d7ebd19fd157fa98c18b50 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:38 +0100
Subject: [PATCH 100/144] python: notebook: 6.0.1 -> 6.0.2

---
 pkgs/development/python-modules/notebook/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/notebook/default.nix b/pkgs/development/python-modules/notebook/default.nix
index d196b6a69479..3c174288b82c 100644
--- a/pkgs/development/python-modules/notebook/default.nix
+++ b/pkgs/development/python-modules/notebook/default.nix
@@ -25,12 +25,12 @@
 
 buildPythonPackage rec {
   pname = "notebook";
-  version = "6.0.1";
+  version = "6.0.2";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "660976fe4fe45c7aa55e04bf4bccb9f9566749ff637e9020af3422f9921f9a5d";
+    sha256 = "399a4411e171170173344761e7fd4491a3625659881f76ce47c50231ed714d9b";
   };
 
   LC_ALL = "en_US.utf8";

From 30e2290a48660b7366a39b18598b4f3829dbf776 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:38 +0100
Subject: [PATCH 101/144] python: numcodecs: 0.6.3 -> 0.6.4

---
 pkgs/development/python-modules/numcodecs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/numcodecs/default.nix b/pkgs/development/python-modules/numcodecs/default.nix
index 775cfeded8b4..e49e6e192391 100644
--- a/pkgs/development/python-modules/numcodecs/default.nix
+++ b/pkgs/development/python-modules/numcodecs/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "numcodecs";
-  version = "0.6.3";
+  version = "0.6.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "086qwlyi01rpgyyyy8bmhh9i7hpksyz33ldci3wdwmhiblyl362y";
+    sha256 = "ef4843d5db4d074e607e9b85156835c10d006afc10e175bda62ff5412fca6e4d";
   };
 
   nativeBuildInputs = [

From 80ac560b483fb3dd5665498935e6eacea763a118 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:38 +0100
Subject: [PATCH 102/144] python: numpy: 1.17.3 -> 1.17.4

---
 pkgs/development/python-modules/numpy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index f5ce093cb495..fdc5e9b8f135 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -16,12 +16,12 @@ let
   };
 in buildPythonPackage rec {
   pname = "numpy";
-  version = "1.17.3";
+  version = "1.17.4";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "a0678793096205a4d784bd99f32803ba8100f639cf3b932dc63b21621390ea7e";
+    sha256 = "f58913e9227400f1395c7b800503ebfdb0772f1c33ff8cb4d6451c06cabdf316";
   };
 
   nativeBuildInputs = [ gfortran pytest ];

From 31f555030ba19caf6e423517b16f64749575dc06 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:38 +0100
Subject: [PATCH 103/144] python: pandas: 0.25.2 -> 0.25.3

---
 pkgs/development/python-modules/pandas/2.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pandas/2.nix b/pkgs/development/python-modules/pandas/2.nix
index 0ea27b04dcbe..42e6fe845e07 100644
--- a/pkgs/development/python-modules/pandas/2.nix
+++ b/pkgs/development/python-modules/pandas/2.nix
@@ -32,11 +32,11 @@ let
 
 in buildPythonPackage rec {
   pname = "pandas";
-  version = "0.25.2";
+  version = "0.25.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ca91a19d1f0a280874a24dca44aadce42da7f3a7edb7e9ab7c7baad8febee2be";
+    sha256 = "52da74df8a9c9a103af0a72c9d5fdc8e0183a90884278db7f386b5692a2220a4";
   };
 
   checkInputs = [ pytest glibcLocales moto hypothesis ];

From 689697ff13446dd119e940a40aeac599964d6a9c Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:38 +0100
Subject: [PATCH 104/144] python: pandas: 0.25.2 -> 0.25.3

---
 pkgs/development/python-modules/pandas/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index b3dcec637feb..218194812b86 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -30,11 +30,11 @@ let
 
 in buildPythonPackage rec {
   pname = "pandas";
-  version = "0.25.2";
+  version = "0.25.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ca91a19d1f0a280874a24dca44aadce42da7f3a7edb7e9ab7c7baad8febee2be";
+    sha256 = "52da74df8a9c9a103af0a72c9d5fdc8e0183a90884278db7f386b5692a2220a4";
   };
 
   checkInputs = [ pytest glibcLocales moto hypothesis ];

From f11407d4590c1aef550c44e0d729383020b41dc5 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:38 +0100
Subject: [PATCH 105/144] python: persistent: 4.5.0 -> 4.5.1

---
 pkgs/development/python-modules/persistent/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/persistent/default.nix b/pkgs/development/python-modules/persistent/default.nix
index 88008cd9530a..76d5441c048a 100644
--- a/pkgs/development/python-modules/persistent/default.nix
+++ b/pkgs/development/python-modules/persistent/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "persistent";
-  version = "4.5.0";
+  version = "4.5.1";
 
   nativeBuildInputs = [ sphinx manuel ];
   propagatedBuildInputs = [ zope_interface cffi ];
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0slbvq1m3rilgyhj6i522rsyv592xv9pmvm61mrmgkgf40kfnz69";
+    sha256 = "73862779577cb8637f2b68e7edee9a9b95cf33d0b83cb6e762f0f3fc12897aa6";
   };
 
   meta = {

From 0e17d026453ec1c32431934bcfdd7682c6e51b35 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:39 +0100
Subject: [PATCH 106/144] python: phonenumbers: 8.10.21 -> 8.10.22

---
 pkgs/development/python-modules/phonenumbers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/phonenumbers/default.nix b/pkgs/development/python-modules/phonenumbers/default.nix
index 288e33e05064..d37be90099cb 100644
--- a/pkgs/development/python-modules/phonenumbers/default.nix
+++ b/pkgs/development/python-modules/phonenumbers/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "phonenumbers";
-  version = "8.10.21";
+  version = "8.10.22";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "162301aa2ce7c1a7196d7b5b084e3263a0a5f55e3129fe2429f2a115c3ef16c3";
+    sha256 = "705dc7bbaa0d5932e9c010437c718bb3c0d7c93ab25b9710b4d9ae7370cc0121";
   };
 
   meta = {

From e3c848b15789b818842a60f09654dac015f0862e Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:39 +0100
Subject: [PATCH 107/144] python: pipdate: 0.3.2 -> 0.3.4

---
 pkgs/development/python-modules/pipdate/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pipdate/default.nix b/pkgs/development/python-modules/pipdate/default.nix
index 8628705ed4d6..08ed0c43a22b 100644
--- a/pkgs/development/python-modules/pipdate/default.nix
+++ b/pkgs/development/python-modules/pipdate/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "pipdate";
-  version = "0.3.2";
+  version = "0.3.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a27f64d13269adfd8594582f5a62c9f2151b426e701afdfc3b4f4019527b4121";
+    sha256 = "26bd12075e63ef7f8094da36c27bf5539d298f4ef2af6acba20e98b502439d6d";
   };
 
   propagatedBuildInputs = [

From c1ab98fcb6ce64199e1fa0c693b0f9a32c002c87 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:39 +0100
Subject: [PATCH 108/144] python: plac: 1.1.0 -> 1.1.3

---
 pkgs/development/python-modules/plac/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/plac/default.nix b/pkgs/development/python-modules/plac/default.nix
index 0622e41fa7e2..77bcf6cf4fc6 100644
--- a/pkgs/development/python-modules/plac/default.nix
+++ b/pkgs/development/python-modules/plac/default.nix
@@ -5,11 +5,11 @@
 }:
 buildPythonPackage rec {
   pname = "plac";
-  version = "1.1.0";
+  version = "1.1.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "10f0blwxn7k2qvd0vs4300jxb8n9r7jhngf9bx9bfxia8akwy5kw";
+    sha256 = "398cb947c60c4c25e275e1f1dadf027e7096858fb260b8ece3b33bcff90d985f";
   };
 
   checkPhase = ''

From 088824c5b8a6771ecd635e64326d24066773a6fd Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:39 +0100
Subject: [PATCH 109/144] python: psutil: 5.6.3 -> 5.6.5

---
 pkgs/development/python-modules/psutil/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index 37c19f5c14bd..a3d909bb3d46 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "psutil";
-  version = "5.6.3";
+  version = "5.6.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "863a85c1c0a5103a12c05a35e59d336e1d665747e531256e061213e2e90f63f3";
+    sha256 = "d051532ac944f1be0179e0506f6889833cf96e466262523e57a871de65a15147";
   };
 
   # No tests in archive

From 67d8bb50949057108f92db63f4f02ad7ae2fb10c Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:39 +0100
Subject: [PATCH 110/144] python: pyatmo: 2.3.2 -> 2.3.3

---
 pkgs/development/python-modules/pyatmo/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyatmo/default.nix b/pkgs/development/python-modules/pyatmo/default.nix
index 56467d1e4a5e..795f623ba53f 100644
--- a/pkgs/development/python-modules/pyatmo/default.nix
+++ b/pkgs/development/python-modules/pyatmo/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "pyatmo";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2c76740e5adbf8b14d8f41d4f84ce23c0e8e738b18b926dc60858c35bf2fa8f2";
+    sha256 = "b884402c62d589a38444e8f4b3892b18312e8f9442cd8d12e7ec01c698328f54";
   };
 
   propagatedBuildInputs = [ requests ];

From d3e83e2ef9b8b24f9ab98b975631af7fd80b9cf9 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:39 +0100
Subject: [PATCH 111/144] python: pybase64: 1.0.0 -> 1.0.1

---
 pkgs/development/python-modules/pybase64/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pybase64/default.nix b/pkgs/development/python-modules/pybase64/default.nix
index 544ce1826f34..6c32de593c1d 100644
--- a/pkgs/development/python-modules/pybase64/default.nix
+++ b/pkgs/development/python-modules/pybase64/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pybase64";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "71a729b10232b38cba001e621dbaa6dbba2302dc44a93706295f1ff760f40876";
+    sha256 = "6ced40531bffc81bafc790d5c0d2f752e281b3b00fd6ff4e79385c625e5dbab1";
   };
 
   propagatedBuildInputs = [ six ];

From 4237da930f00fc4bbd97f0906d78b04bad086028 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:39 +0100
Subject: [PATCH 112/144] python: pybids: 0.9.4 -> 0.9.5

---
 pkgs/development/python-modules/pybids/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pybids/default.nix b/pkgs/development/python-modules/pybids/default.nix
index 38108e6e659c..84f5a41c45b6 100644
--- a/pkgs/development/python-modules/pybids/default.nix
+++ b/pkgs/development/python-modules/pybids/default.nix
@@ -15,12 +15,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.9.4";
+  version = "0.9.5";
   pname = "pybids";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "08abd3573e823e536990caf54405ffef573a88ef9d019c2d94e0be995e21885f";
+    sha256 = "0e8f8466067ff3023f53661c390c02702fcd5fe712bdd5bf167ffb0c2b920430";
   };
 
   propagatedBuildInputs = [

From d0207fc14a33519db460cf4cb6a1b5ce18f1871d Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:39 +0100
Subject: [PATCH 113/144] python: pybullet: 2.5.6 -> 2.5.7

---
 pkgs/development/python-modules/pybullet/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pybullet/default.nix b/pkgs/development/python-modules/pybullet/default.nix
index 93be1fe4a035..f72f09a3328c 100644
--- a/pkgs/development/python-modules/pybullet/default.nix
+++ b/pkgs/development/python-modules/pybullet/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "pybullet";
-  version = "2.5.6";
+  version = "2.5.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ffeb00f393dcddc11d195a72623e3b06767a37e4fdfa06ef88fbd74c8d326adb";
+    sha256 = "82a235a8fe3c8dee753d765c295ff0da92bcb5096209d26a0cfc3f5c6054e374";
   };
 
   buildInputs = [

From 2bfa4759cff3173b6c6540e4d805a8ac14b9f42d Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:39 +0100
Subject: [PATCH 114/144] python: pycryptodome: 3.9.0 -> 3.9.2

---
 pkgs/development/python-modules/pycryptodome/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pycryptodome/default.nix b/pkgs/development/python-modules/pycryptodome/default.nix
index f07b33cf4777..c3b807ce43c3 100644
--- a/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/pkgs/development/python-modules/pycryptodome/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchPypi, buildPythonPackage }:
 
 buildPythonPackage rec {
-  version = "3.9.0";
+  version = "3.9.2";
   pname = "pycryptodome";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "dbeb08ad850056747aa7d5f33273b7ce0b9a77910604a1be7b7a6f2ef076213f";
+    sha256 = "e1e007d072d50844188c067c325af8b3ad31e4b87792381469b821e95bf14cd8";
   };
 
   meta = {

From 1a6ec3c485864e9d0dbe73a39ce181c0190a6f7f Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:39 +0100
Subject: [PATCH 115/144] python: pycryptodomex: 3.9.0 -> 3.9.2

---
 pkgs/development/python-modules/pycryptodomex/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pycryptodomex/default.nix b/pkgs/development/python-modules/pycryptodomex/default.nix
index 1ec636f9f321..7d3204e021a4 100644
--- a/pkgs/development/python-modules/pycryptodomex/default.nix
+++ b/pkgs/development/python-modules/pycryptodomex/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "pycryptodomex";
-  version = "3.9.0";
+  version = "3.9.2";
 
   meta = {
     description = "A self-contained cryptographic library for Python";
@@ -12,6 +12,6 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8b604f4fa1de456d6d19771b01c2823675a75a2c60e51a6b738f71fdfe865370";
+    sha256 = "137e8e2c7438184dae0b940cdf5d0d4f639b1df564a95dadbb7c4ec188850921";
   };
 }

From 4ff18fed9181a5e3869c77d3b54196bf2b1fb1f2 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:39 +0100
Subject: [PATCH 116/144] python: PyMuPDF: 1.16.5 -> 1.16.7

---
 pkgs/development/python-modules/pymupdf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pymupdf/default.nix b/pkgs/development/python-modules/pymupdf/default.nix
index f6c1cc61ebb4..dc9b38eec9b7 100644
--- a/pkgs/development/python-modules/pymupdf/default.nix
+++ b/pkgs/development/python-modules/pymupdf/default.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPythonPackage, fetchPypi, mupdf, swig }:
 buildPythonPackage rec {
   pname = "PyMuPDF";
-  version = "1.16.5";
+  version = "1.16.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9909b1db81952abb09a2c17cca8ffa17f4a05a864653d6e702ce86bfa70c6a23";
+    sha256 = "b16c85b2f89cc89e36b59fe734f14e5c939c8b24697bf33ff7a19584e8334976";
   };
 
   patchPhase = ''

From c29e6643bdc34297380900e16f62eef78923b71b Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:40 +0100
Subject: [PATCH 117/144] python: pyopencl: 2019.1.1 -> 2019.1.2

---
 pkgs/development/python-modules/pyopencl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyopencl/default.nix b/pkgs/development/python-modules/pyopencl/default.nix
index cbe9b111a2c0..0fd6253e5fdf 100644
--- a/pkgs/development/python-modules/pyopencl/default.nix
+++ b/pkgs/development/python-modules/pyopencl/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyopencl";
-  version = "2019.1.1";
+  version = "2019.1.2";
 
   checkInputs = [ pytest ];
   buildInputs = [ opencl-headers ocl-icd pybind11 ];
@@ -25,7 +25,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0g5n1c8gfqhfrfpzdypzwfj1q1nlqzcfjrx397cs6qqw67mg095k";
+    sha256 = "7803f3128dbd28ae6f5b851a80ef586a35b9575406ea7bb068b8e1516f8043f0";
   };
 
   # py.test is not needed during runtime, so remove it from `install_requires`

From 95cbd02c8b52898d8c00f2faf5eba4696f307c37 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:40 +0100
Subject: [PATCH 118/144] python: pyparsing: 2.4.2 -> 2.4.5

---
 pkgs/development/python-modules/pyparsing/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyparsing/default.nix b/pkgs/development/python-modules/pyparsing/default.nix
index 2fd3ca60ad82..854ca4d90eeb 100644
--- a/pkgs/development/python-modules/pyparsing/default.nix
+++ b/pkgs/development/python-modules/pyparsing/default.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPythonPackage, fetchPypi }:
 buildPythonPackage rec {
     pname = "pyparsing";
-    version = "2.4.2";
+    version = "2.4.5";
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "6f98a7b9397e206d78cc01df10131398f1c8b8510a2f4d97d9abd82e1aacdd80";
+      sha256 = "4ca62001be367f01bd3e92ecbb79070272a9d4964dce6a48a82ff0b8bc7e683a";
     };
 
     # Not everything necessary to run the tests is included in the distribution

From b30a5a6e2af758fb88cf908d7d33163cd87ffa28 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:40 +0100
Subject: [PATCH 119/144] python: pyrsistent: 0.15.4 -> 0.15.5

---
 pkgs/development/python-modules/pyrsistent/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyrsistent/default.nix b/pkgs/development/python-modules/pyrsistent/default.nix
index c8310c39441a..b4edb02258a1 100644
--- a/pkgs/development/python-modules/pyrsistent/default.nix
+++ b/pkgs/development/python-modules/pyrsistent/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "pyrsistent";
-  version = "0.15.4";
+  version = "0.15.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0cv5xvhfhlj88pb0ghdwivkfcmgi6503qjwxx4r6n06nd6hpzd1l";
+    sha256 = "eb6545dbeb1aa69ab1fb4809bfbf5a8705e44d92ef8fc7c2361682a47c46c778";
   };
 
   propagatedBuildInputs = [ six ];

From be48e82eeb5106fbb53d688e3e56c1b7008874f0 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:40 +0100
Subject: [PATCH 120/144] python: pytest-mypy: 0.4.1 -> 0.4.2

---
 pkgs/development/python-modules/pytest-mypy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-mypy/default.nix b/pkgs/development/python-modules/pytest-mypy/default.nix
index bca04ab7b36c..4fb2146d7a74 100644
--- a/pkgs/development/python-modules/pytest-mypy/default.nix
+++ b/pkgs/development/python-modules/pytest-mypy/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "pytest-mypy";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f6348a3aa08d7b38b05c12ed0965415e1b60d402d7ceb353f5116f6eaf7dac28";
+    sha256 = "5a5338cecff17f005b181546a13e282761754b481225df37f33d37f86ac5b304";
   };
 
   propagatedBuildInputs = [ pytest mypy ];

From fbe93c074ba1ba84b886aabe89d1169183a67eb0 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:40 +0100
Subject: [PATCH 121/144] python: pytest: 5.2.1 -> 5.2.2

---
 pkgs/development/python-modules/pytest/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index 6088d78bba5e..39eed4f13c60 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -3,7 +3,7 @@
 , atomicwrites, mock, writeText, pathlib2, wcwidth, packaging, isPyPy, python
 }:
 buildPythonPackage rec {
-  version = "5.2.1";
+  version = "5.2.2";
   pname = "pytest";
 
   disabled = !isPy3k;
@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ca563435f4941d0cb34767301c27bc65c510cb82e90b9ecf9cb52dc2c63caaa0";
+    sha256 = "27abc3fef618a01bebb1f0d6d303d2816a99aa87a5968ebc32fe971be91eb1e6";
   };
 
   checkInputs = [ hypothesis mock ];

From 0456dd3cd6a5655a4b232007828a339142e5ec13 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:40 +0100
Subject: [PATCH 122/144] python: python-daemon: 2.2.3 -> 2.2.4

---
 pkgs/development/python-modules/python-daemon/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-daemon/default.nix b/pkgs/development/python-modules/python-daemon/default.nix
index 93c051064049..41b7aa78bab9 100644
--- a/pkgs/development/python-modules/python-daemon/default.nix
+++ b/pkgs/development/python-modules/python-daemon/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "python-daemon";
-  version = "2.2.3";
+  version = "2.2.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "affeca9e5adfce2666a63890af9d6aff79f670f7511899edaddca7f96593cc25";
+    sha256 = "57c84f50a04d7825515e4dbf3a31c70cc44414394a71608dee6cfde469e81766";
   };
 
   # A test fail within chroot builds.

From e6ef3d4f13d21569ef8fbe7649eace8c73fe94b9 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:40 +0100
Subject: [PATCH 123/144] python: reportlab: 3.5.31 -> 3.5.32

---
 pkgs/development/python-modules/reportlab/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/reportlab/default.nix b/pkgs/development/python-modules/reportlab/default.nix
index eaa691a6b75c..2286ebbc4cc9 100644
--- a/pkgs/development/python-modules/reportlab/default.nix
+++ b/pkgs/development/python-modules/reportlab/default.nix
@@ -11,11 +11,11 @@ let
   ft = freetype.overrideAttrs (oldArgs: { dontDisableStatic = true; });
 in buildPythonPackage rec {
   pname = "reportlab";
-  version = "3.5.31";
+  version = "3.5.32";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3e2d2ea8ac3d63c918a2b40476c2745704d0364abe2b9c844c75992132a5eac7";
+    sha256 = "83ef44936ef4e9c432d62bc2b72ec8d772b87af319d123e827a72e9b6884c851";
   };
 
   checkInputs = [ glibcLocales ];

From e007ae5cfa4e25eff6743d4ab74c03fdc1f7afa1 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:40 +0100
Subject: [PATCH 124/144] python: rethinkdb: 2.4.4 -> 2.4.4.post1

---
 pkgs/development/python-modules/rethinkdb/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/rethinkdb/default.nix b/pkgs/development/python-modules/rethinkdb/default.nix
index a6087c9859cb..7eea5d2c39fc 100644
--- a/pkgs/development/python-modules/rethinkdb/default.nix
+++ b/pkgs/development/python-modules/rethinkdb/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "rethinkdb";
-  version = "2.4.4";
+  version = "2.4.4.post1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d01b39c1921498e22e3c9cae1adb39c37b68e4438ef77218abc0166fdfd2ea7a";
+    sha256 = "e1c1f8ad93bc1c6f2aaa73afc333c57d505d8cc08c437d78a5c1eb8dc4b7e8c2";
   };
 
   doCheck = false;

From c461edcdf21df79b1e234f2a8426e7845f52d140 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:40 +0100
Subject: [PATCH 125/144] python: runway-python: 0.5.0 -> 0.5.1

---
 pkgs/development/python-modules/runway-python/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/runway-python/default.nix b/pkgs/development/python-modules/runway-python/default.nix
index f46a35004ab9..62e0d2f0beba 100644
--- a/pkgs/development/python-modules/runway-python/default.nix
+++ b/pkgs/development/python-modules/runway-python/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "runway-python";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d3573a003899eb33c0edbc1d59c16c8c19c092512da0c75ceb1f46063a18c7e9";
+    sha256 = "00cf6fa9ea3b6a195e9eca96216a9d206b6884624d0214bd776f8654cd5e8fea";
   };
 
   propagatedBuildInputs = [ flask flask-cors numpy pillow gevent wget six colorcet ];

From 17a30b8968ebd9306231566e7992de4abb89db54 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:40 +0100
Subject: [PATCH 126/144] python: scipy: 1.3.1 -> 1.3.2

---
 pkgs/development/python-modules/scipy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 934889170174..dd561c548530 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "scipy";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2643cfb46d97b7797d1dbdb6f3c23fe3402904e3c90e6facfe6a9b98d808c1b5";
+    sha256 = "a03939b431994289f39373c57bbe452974a7da724ae7f9620a1beee575434da4";
   };
 
   checkInputs = [ nose pytest ];

From cc0f38e73cc314d0404d10dfb9b85f86490c98f3 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:41 +0100
Subject: [PATCH 127/144] python: sentry-sdk: 0.13.0 -> 0.13.2

---
 pkgs/development/python-modules/sentry-sdk/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sentry-sdk/default.nix b/pkgs/development/python-modules/sentry-sdk/default.nix
index 0705ed4bc83c..da729f5ab0ba 100644
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "sentry-sdk";
-  version = "0.13.0";
+  version = "0.13.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ff14935cc3053de0650128f124c36f34a4be120b8cc522c149f5cba342c1fd05";
+    sha256 = "ff1fa7fb85703ae9414c8b427ee73f8363232767c9cd19158f08f6e4f0b58fc7";
   };
 
   checkInputs = [ django flask tornado bottle rq falcon ]

From f0419119e31ec406dda12177279c324694c2ec68 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:41 +0100
Subject: [PATCH 128/144] python: soupsieve: 1.9.4 -> 1.9.5

---
 pkgs/development/python-modules/soupsieve/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/soupsieve/default.nix b/pkgs/development/python-modules/soupsieve/default.nix
index 737e9e0803a9..8995e98ca787 100644
--- a/pkgs/development/python-modules/soupsieve/default.nix
+++ b/pkgs/development/python-modules/soupsieve/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "soupsieve";
-  version = "1.9.4";
+  version = "1.9.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "605f89ad5fdbfefe30cdc293303665eff2d188865d4dbe4eb510bba1edfbfce3";
+    sha256 = "e2c1c5dee4a1c36bcb790e0fabd5492d874b8ebd4617622c4f6a731701060dda";
   };
 
   checkPhase = ''

From bab7fcfc7372ed6f0895dce6980efda56377ac1c Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:41 +0100
Subject: [PATCH 129/144] python: sqlmap: 1.3.10 -> 1.3.11

---
 pkgs/development/python-modules/sqlmap/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index 74d73638b1ea..56d2c6799b4f 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.3.10";
+  version = "1.3.11";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3f045e8e9ee1293e2d0ab4396950deed71f095a7762f063f3e5f54a839b8d5b4";
+    sha256 = "27ef900b1116776128d0d09bff21f8d2f6bb2ea887cd59fe1a32aec5563aacb0";
   };
 
   # No tests in archive

From 1f2790d71a3e5d99c36d8397aff6f979604a055b Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:41 +0100
Subject: [PATCH 130/144] python: starlette: 0.12.10 -> 0.12.13

---
 pkgs/development/python-modules/starlette/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/starlette/default.nix b/pkgs/development/python-modules/starlette/default.nix
index 1ccb8bcaf703..6580a87b2fee 100644
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@@ -18,12 +18,12 @@
 
 buildPythonPackage rec {
   pname = "starlette";
-  version = "0.12.10";
+  version = "0.12.13";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e41ef52e711a82ef95c195674e5d8d41c75c6b1d6f5a275637eedd4cc2150a7f";
+    sha256 = "9597bc28e3c4659107c1c4a45ec32dc45e947d78fe56230222be673b2c36454a";
   };
 
   propagatedBuildInputs = [

From ff2691ee424e77d1f22fe98504d1390967f52788 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:41 +0100
Subject: [PATCH 131/144] python: strictyaml: 1.0.5 -> 1.0.6

---
 pkgs/development/python-modules/strictyaml/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/strictyaml/default.nix b/pkgs/development/python-modules/strictyaml/default.nix
index 496ed66c1ac5..bb4824b5c026 100644
--- a/pkgs/development/python-modules/strictyaml/default.nix
+++ b/pkgs/development/python-modules/strictyaml/default.nix
@@ -6,12 +6,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.0.5";
+  version = "1.0.6";
   pname = "strictyaml";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "aad8d90c4d300c5bfa7678b9680ce456406319859c7279e98110548b596b5ae7";
+    sha256 = "dd687a32577e0b832619ce0552eac86d6afad5fa7b61ab041bb765881c6a1f36";
   };
 
   propagatedBuildInputs = [ ruamel_yaml python-dateutil ];

From 2cbf1676797100530590c852a1431373764143b9 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:41 +0100
Subject: [PATCH 132/144] python: tables: 3.6.0 -> 3.6.1

---
 pkgs/development/python-modules/tables/3.5.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tables/3.5.nix b/pkgs/development/python-modules/tables/3.5.nix
index 1123d4626c95..b27584d25d02 100644
--- a/pkgs/development/python-modules/tables/3.5.nix
+++ b/pkgs/development/python-modules/tables/3.5.nix
@@ -4,12 +4,12 @@
 with stdenv.lib;
 
 buildPythonPackage rec {
-  version = "3.6.0";
+  version = "3.6.1";
   pname = "tables";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "db3488214864fb313a611fca68bf1c9019afe4e7877be54d0e61c84416603d4d";
+    sha256 = "49a972b8a7c27a8a173aeb05f67acb45fe608b64cd8e9fa667c0962a60b71b49";
   };
 
   buildInputs = [ hdf5 cython bzip2 lzo c-blosc ];

From 76fbb5cf0f360202f0b8f0826d1eb88276405b5f Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:41 +0100
Subject: [PATCH 133/144] python: tenacity: 5.1.1 -> 5.1.5

---
 pkgs/development/python-modules/tenacity/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tenacity/default.nix b/pkgs/development/python-modules/tenacity/default.nix
index c03c2e1a30dd..254b91891c71 100644
--- a/pkgs/development/python-modules/tenacity/default.nix
+++ b/pkgs/development/python-modules/tenacity/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "tenacity";
-  version = "5.1.1";
+  version = "5.1.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a4eb168dbf55ed2cae27e7c6b2bd48ab54dabaf294177d998330cf59f294c112";
+    sha256 = "e664bd94f088b17f46da33255ae33911ca6a0fe04b156d334b601a4ef66d3c5f";
   };
 
   nativeBuildInputs = [ pbr setuptools_scm ];

From 116bd5d31ab9490128aa67413f180b1dc63787cd Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:41 +0100
Subject: [PATCH 134/144] python: testfixtures: 6.10.0 -> 6.10.1

---
 pkgs/development/python-modules/testfixtures/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/testfixtures/default.nix b/pkgs/development/python-modules/testfixtures/default.nix
index a08241332dcf..f429f72cc017 100644
--- a/pkgs/development/python-modules/testfixtures/default.nix
+++ b/pkgs/development/python-modules/testfixtures/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "testfixtures";
-  version = "6.10.0";
+  version = "6.10.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1kiv60i0s67v34x28j6cshby7n7mbhd7a7val639yvvlh1f0q8wx";
+    sha256 = "abbca7ed381d34a77699c6cb68be67919a1e7f5cf8728b57396145417fa34110";
   };
 
   checkInputs = [ pytest mock sybil zope_component twisted ];

From ad9c1d09d8bfca22d33509c2d3d519007c72cee9 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:41 +0100
Subject: [PATCH 135/144] python: testpath: 0.4.2 -> 0.4.4

---
 pkgs/development/python-modules/testpath/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/testpath/default.nix b/pkgs/development/python-modules/testpath/default.nix
index 8bdd50f52d25..c9d0e8f0ad2c 100644
--- a/pkgs/development/python-modules/testpath/default.nix
+++ b/pkgs/development/python-modules/testpath/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "testpath";
-  version = "0.4.2";
+  version = "0.4.4";
   format = "wheel";
 
   src = fetchPypi {
     inherit pname version format;
-    sha256 = "46c89ebb683f473ffe2aab0ed9f12581d4d078308a3cb3765d79c6b2317b0109";
+    sha256 = "bfcf9411ef4bf3db7579063e0546938b1edda3d69f4e1fb8756991f5951f85d4";
   };
 
   meta = with stdenv.lib; {

From 0f76036cb1a757c6b68c30956954e75cd196a969 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:41 +0100
Subject: [PATCH 136/144] python: tld: 0.9.6 -> 0.9.7

---
 pkgs/development/python-modules/tld/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tld/default.nix b/pkgs/development/python-modules/tld/default.nix
index 470a4bb40ddc..95c3756daded 100644
--- a/pkgs/development/python-modules/tld/default.nix
+++ b/pkgs/development/python-modules/tld/default.nix
@@ -2,11 +2,11 @@
 
 python.pkgs.buildPythonPackage rec {
   pname   = "tld";
-  version = "0.9.6";
+  version = "0.9.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0figmf80y715zv6viqan2nyzpg9aia5dyl25nskirpm5lh1s99w9";
+    sha256 = "cef15360ec42547a583d49ef5246936b3ace424a95c00b59c09dcbe44b289961";
   };
 
   propagatedBuildInputs = with python.pkgs; [ six ];

From e0b82e7087d5d7ab085518ccbf90efec4fdb2f7c Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:42 +0100
Subject: [PATCH 137/144] python: trustme: 0.5.2 -> 0.5.3

---
 pkgs/development/python-modules/trustme/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/trustme/default.nix b/pkgs/development/python-modules/trustme/default.nix
index 601e49759fd0..8784dad7ad16 100644
--- a/pkgs/development/python-modules/trustme/default.nix
+++ b/pkgs/development/python-modules/trustme/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "trustme";
-  version = "0.5.2";
+  version = "0.5.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "103f8n0c60593r0z8hh1zvk1bagxwnhrv3203xpiiddwqxalr04b";
+    sha256 = "f0f96a21b430cc29661644d3569a1112a397ca9cc8595b964d4ae71e5e957529";
   };
 
   checkInputs = [

From c9d25f2bd37fb9fbbf1f31c2dbca765d745faec6 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:42 +0100
Subject: [PATCH 138/144] python: typing_extensions: 3.7.4 -> 3.7.4.1

---
 pkgs/development/python-modules/typing-extensions/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/typing-extensions/default.nix b/pkgs/development/python-modules/typing-extensions/default.nix
index ef5fed689122..6c1e85eb93c1 100644
--- a/pkgs/development/python-modules/typing-extensions/default.nix
+++ b/pkgs/development/python-modules/typing-extensions/default.nix
@@ -4,11 +4,11 @@ let
 
 in buildPythonPackage rec {
   pname = "typing_extensions";
-  version = "3.7.4";
+  version = "3.7.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "15bx773a5zkk4hkwjl8nb5f8y5741vyyqb9q3jac6kxm1frk5mif";
+    sha256 = "091ecc894d5e908ac75209f10d5b4f118fbdb2eb1ede6a63544054bb1edb41f2";
   };
 
   checkInputs = lib.optional (pythonOlder "3.5") typing;

From 1552b222152f02606d2945f4c2fdf65a5e2ca59a Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:42 +0100
Subject: [PATCH 139/144] python: unittest-xml-reporting: 2.5.1 -> 2.5.2

---
 .../python-modules/unittest-xml-reporting/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/unittest-xml-reporting/default.nix b/pkgs/development/python-modules/unittest-xml-reporting/default.nix
index 624ff585c36c..8d815833a407 100644
--- a/pkgs/development/python-modules/unittest-xml-reporting/default.nix
+++ b/pkgs/development/python-modules/unittest-xml-reporting/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "unittest-xml-reporting";
-  version = "2.5.1";
+  version = "2.5.2";
 
   propagatedBuildInputs = [six];
 
@@ -11,7 +11,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0v6xcs8nx82yw037h296zk0vz5ka4idm4xdpxkcm4h4fnpj8428l";
+    sha256 = "9d28ddf6524cf0ff9293f61bd12e792de298f8561a5c945acea63fb437789e0e";
   };
   meta = with lib; {
     homepage = https://github.com/xmlrunner/unittest-xml-reporting/tree/master/;

From 9446eb46a42c0acf04f0979bd769d8bf72ed519f Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:42 +0100
Subject: [PATCH 140/144] python: uproot: 3.10.8 -> 3.10.10

---
 pkgs/development/python-modules/uproot/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/uproot/default.nix b/pkgs/development/python-modules/uproot/default.nix
index ff0e5d614822..6fd90fc3a18f 100644
--- a/pkgs/development/python-modules/uproot/default.nix
+++ b/pkgs/development/python-modules/uproot/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "uproot";
-  version = "3.10.8";
+  version = "3.10.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cf9b9a6824e82f2e45d44e2c9d8a230ce9f83972e74427543862fdff462fb121";
+    sha256 = "2c780472c5c328d2e34508db1da399038653142572fc3d0b5777b2311edabd83";
   };
 
   nativeBuildInputs = [ pytestrunner ];

From d9cfcfe112af99b602ce13247faea9404990eec2 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:42 +0100
Subject: [PATCH 141/144] python: vcrpy: 2.1.0 -> 2.1.1

---
 pkgs/development/python-modules/vcrpy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/vcrpy/default.nix b/pkgs/development/python-modules/vcrpy/default.nix
index 507a082f9a0c..ef3e92f01a75 100644
--- a/pkgs/development/python-modules/vcrpy/default.nix
+++ b/pkgs/development/python-modules/vcrpy/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "vcrpy";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0e79239441fb4c731da9f05aecbd062223ef1f4ab668d2400c63c347a7071414";
+    sha256 = "27cc696df66d77703eab5cdfa041b2f9877bbf2b54bcd390de89a4be964ca536";
   };
 
   checkInputs = [

From 363980e4c2fecd7a0336cf2e736d67af8d7f8fb3 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:42 +0100
Subject: [PATCH 142/144] python: whisper: 1.1.5 -> 1.1.6

---
 pkgs/development/python-modules/whisper/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/whisper/default.nix b/pkgs/development/python-modules/whisper/default.nix
index 407bb88fa2ae..134d797ecf81 100644
--- a/pkgs/development/python-modules/whisper/default.nix
+++ b/pkgs/development/python-modules/whisper/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "whisper";
-  version = "1.1.5";
+  version = "1.1.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "14013e7563102d808aae0cb5b3b2326979236d4bcd54c343ea636761629920cd";
+    sha256 = "8dbb3b7cf4a02a080162467fff5cd38bf77940c3e2b25f7c4f78529427ca9cfe";
   };
 
   propagatedBuildInputs = [ six ];

From 8a66f4dad3a9a3fd2c04fb714a5132f937a613a0 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:42 +0100
Subject: [PATCH 143/144] python: wxPython: 4.0.7 -> 4.0.7.post1

---
 pkgs/development/python-modules/wxPython/4.0.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/wxPython/4.0.nix b/pkgs/development/python-modules/wxPython/4.0.nix
index f03d1fb1e87d..bac478561f74 100644
--- a/pkgs/development/python-modules/wxPython/4.0.nix
+++ b/pkgs/development/python-modules/wxPython/4.0.nix
@@ -28,11 +28,11 @@
 
 buildPythonPackage rec {
   pname = "wxPython";
-  version = "4.0.7";
+  version = "4.0.7.post1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0cq2iyqm08ihazh5xzdsha5h22mba0w4a0y7iikn6c6yvszhiriv";
+    sha256 = "da43eaa2eea32c34a52531331b0a69bd791c237803a7c5df451509624766f7ca";
   };
 
   doCheck = false;

From 59817b77c58c9a3b8cfe5a2aa81049757a9afd1f Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 11 Nov 2019 12:13:42 +0100
Subject: [PATCH 144/144] python: zstd: 1.4.3.2 -> 1.4.4.0

---
 pkgs/development/python-modules/zstd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/zstd/default.nix b/pkgs/development/python-modules/zstd/default.nix
index 3f9dac6d42c7..6c1b9c2bb5b7 100644
--- a/pkgs/development/python-modules/zstd/default.nix
+++ b/pkgs/development/python-modules/zstd/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "zstd";
-  version = "1.4.3.2";
+  version = "1.4.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1h4wvzikar4ryhawm7clh29bvhbpy0ix1rlxhg9x195fpq56vsh7";
+    sha256 = "33f2c1fd8d3f9ac8e35fb3e199896afc54cceb68878570c6d4b72985dc6584a5";
   };
 
   postPatch = ''