From ebd4619053711ffb317a36dca4b118ae33f17828 Mon Sep 17 00:00:00 2001
From: Ivan Trubach <mr.trubach@icloud.com>
Date: Mon, 19 Jun 2023 08:56:21 +0300
Subject: [PATCH 001/115] patch-shebangs: add a flag to update shebangs with
 store paths

This change adds a flag to update shebang paths that point to the Nix
store. This is particularly useful when a cross-compiled package uses
same script at compile-time and run-time, but the interpreter must be
changed since hostPlatform != buildPlatform.
---
 .../setup-hooks/patch-shebangs.sh             | 40 ++++++++++++++-----
 pkgs/test/stdenv/patch-shebangs.nix           | 19 ++++++++-
 2 files changed, 49 insertions(+), 10 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/patch-shebangs.sh b/pkgs/build-support/setup-hooks/patch-shebangs.sh
index 9a48440debec..e6872db1acd7 100644
--- a/pkgs/build-support/setup-hooks/patch-shebangs.sh
+++ b/pkgs/build-support/setup-hooks/patch-shebangs.sh
@@ -11,11 +11,12 @@ fixupOutputHooks+=(patchShebangsAuto)
 
 # Run patch shebangs on a directory or file.
 # Can take multiple paths as arguments.
-# patchShebangs [--build | --host] PATH...
+# patchShebangs [--build | --host | --update] [--] PATH...
 
 # Flags:
 # --build : Lookup commands available at build-time
 # --host  : Lookup commands available at runtime
+# --update : Update shebang paths that are in Nix store
 
 # Example use cases,
 # $ patchShebangs --host /nix/store/...-hello-1.0/bin
@@ -23,14 +24,35 @@ fixupOutputHooks+=(patchShebangsAuto)
 
 patchShebangs() {
     local pathName
+    local update
 
-    if [[ "$1" == "--host" ]]; then
-        pathName=HOST_PATH
-        shift
-    elif [[ "$1" == "--build" ]]; then
-        pathName=PATH
-        shift
-    fi
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+        --host)
+            pathName=HOST_PATH
+            shift
+            ;;
+        --build)
+            pathName=PATH
+            shift
+            ;;
+        --update)
+            update=true
+            shift
+            ;;
+        --)
+            shift
+            break
+            ;;
+        -*|--*)
+            echo "Unknown option $1 supplied to patchShebangs" >&2
+            return 1
+            ;;
+        *)
+            break
+            ;;
+        esac
+    done
 
     echo "patching script interpreter paths in $@"
     local f
@@ -93,7 +115,7 @@ patchShebangs() {
         newInterpreterLine="$newPath $args"
         newInterpreterLine=${newInterpreterLine%${newInterpreterLine##*[![:space:]]}}
 
-        if [[ -n "$oldPath" && "${oldPath:0:${#NIX_STORE}}" != "$NIX_STORE" ]]; then
+        if [[ -n "$oldPath" && ( "$update" == true || "${oldPath:0:${#NIX_STORE}}" != "$NIX_STORE" ) ]]; then
             if [[ -n "$newPath" && "$newPath" != "$oldPath" ]]; then
                 echo "$f: interpreter directive changed from \"$oldInterpreterLine\" to \"$newInterpreterLine\""
                 # escape the escape chars so that sed doesn't interpret them
diff --git a/pkgs/test/stdenv/patch-shebangs.nix b/pkgs/test/stdenv/patch-shebangs.nix
index fb52f38ecc91..888d4a53a273 100644
--- a/pkgs/test/stdenv/patch-shebangs.nix
+++ b/pkgs/test/stdenv/patch-shebangs.nix
@@ -39,6 +39,23 @@ let
       };
     };
 
+    updates-nix-store = stdenv.mkDerivation {
+      name = "updates-nix-store";
+      strictDeps = false;
+      dontUnpack = true;
+      installPhase = ''
+        mkdir -p $out/bin
+        echo "#!$NIX_STORE/path/to/bash" > $out/bin/test
+        echo "echo -n hello" >> $out/bin/test
+        chmod +x $out/bin/test
+        patchShebangs --update $out/bin/test
+        dontPatchShebangs=1
+      '';
+      passthru = {
+        assertion = "grep '^#!${stdenv.shell}' $out/bin/test > /dev/null";
+      };
+    };
+
     split-string = stdenv.mkDerivation {
       name = "split-string";
       strictDeps = false;
@@ -59,7 +76,7 @@ let
 in
 stdenv.mkDerivation {
   name = "test-patch-shebangs";
-  passthru = { inherit (tests) bad-shebang ignores-nix-store split-string; };
+  passthru = { inherit (tests) bad-shebang ignores-nix-store updates-nix-store split-string; };
   buildCommand = ''
     validate() {
       local name=$1

From 732e4469cbcfeef847f46c99f3cddb7b6558021d Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Tue, 11 Jul 2023 13:19:47 -0600
Subject: [PATCH 002/115] darwin.adv_cmds: fix build with clang 16

darwin.Libc conflicts with libc++ 16. adv_cmds only needs `msgcat.h`, so
provide only that in `buildInputs` instead of all of Libc.
---
 .../apple-source-releases/adv_cmds/default.nix   | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
index e44241171c60..3ac338d5c619 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
@@ -1,5 +1,17 @@
-{ lib, appleDerivation, xcbuild, ncurses, libutil, Libc }:
+{ stdenv, lib, appleDerivation, xcbuild, ncurses, libutil, Libc }:
 
+let
+  # Libc conflicts with libc++ 16, so provide only the header from it that’s needed to build.
+  msgcat = stdenv.mkDerivation {
+    pname = "Libc-msgcat";
+    version = lib.getVersion Libc;
+
+    buildCommand = ''
+      mkdir -p "$out/include"
+      ln -s ${lib.getDev Libc}/include/msgcat.h "$out/include/"
+    '';
+  };
+in
 appleDerivation {
   # We can't just run the root build, because https://github.com/facebook/xcbuild/issues/264
 
@@ -44,7 +56,7 @@ appleDerivation {
   '';
 
   nativeBuildInputs = [ xcbuild ];
-  buildInputs = [ ncurses libutil Libc ];
+  buildInputs = [ ncurses libutil msgcat ];
 
   meta = {
     platforms = lib.platforms.darwin;

From 065de168f785f25a446236a4376a3a2a0a812d76 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Mon, 17 Jul 2023 04:20:00 +0000
Subject: [PATCH 003/115] python310Packages.mock: 4.0.3 -> 5.1.0

---
 .../python-modules/mock/default.nix           | 21 +++++++------------
 1 file changed, 7 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/python-modules/mock/default.nix b/pkgs/development/python-modules/mock/default.nix
index e12ed6d6b04b..8b75a1436704 100644
--- a/pkgs/development/python-modules/mock/default.nix
+++ b/pkgs/development/python-modules/mock/default.nix
@@ -1,35 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
-, python
 , pythonOlder
-, pytest
-, unittestCheckHook
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "mock";
-  version = "4.0.3";
+  version = "5.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7d3fbbde18228f4ff2f1f119a45cdffa458b4c0dee32eb4d2bb2f82554bac7bc";
+    sha256 = "sha256-Xpaq1czaRxjgointlLICTfdcwtVVdbpXYtMfV2e4dn0=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/testing-cabal/mock/commit/f3e3d82aab0ede7e25273806dc0505574d85eae2.patch";
-      hash = "sha256-wPrv1/WeICZHn31UqFlICFsny2knvn3+Xg8BZoaGbwQ=";
-    })
+  nativeCheckInputs = [
+    pytestCheckHook
   ];
 
-  nativeCheckInputs = [
-    unittestCheckHook
-    pytest
+  pythonImportsCheck = [
+    "mock"
   ];
 
   meta = with lib; {

From cb91c4cc3dac3c67b3e0ce733fe69d2ebbf4c627 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Mon, 17 Jul 2023 04:20:00 +0000
Subject: [PATCH 004/115] python310Packages.mock: update meta

---
 pkgs/development/python-modules/mock/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/mock/default.nix b/pkgs/development/python-modules/mock/default.nix
index 8b75a1436704..7e5a72a47fad 100644
--- a/pkgs/development/python-modules/mock/default.nix
+++ b/pkgs/development/python-modules/mock/default.nix
@@ -26,8 +26,10 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "Mock objects for Python";
+    description = "Rolling backport of unittest.mock for all Pythons";
     homepage = "https://github.com/testing-cabal/mock";
+    changelog = "https://github.com/testing-cabal/mock/blob/${version}/CHANGELOG.rst";
     license = licenses.bsd2;
+    maintainers = [ ];
   };
 }

From ce52bf9cc39c66850a399cb573b50bce809658c5 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Mon, 17 Jul 2023 20:11:18 +0800
Subject: [PATCH 005/115] meson: 1.1.1 -> 1.2.0

Release Note: https://mesonbuild.com/Release-notes-for-1-2-0.html
Diff: https://github.com/mesonbuild/meson/compare/1.1.1...1.2.0
---
 .../meson/darwin-case-sensitive-fs.patch      | 51 -------------------
 .../tools/build-managers/meson/default.nix    | 16 +++---
 2 files changed, 7 insertions(+), 60 deletions(-)
 delete mode 100644 pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch

diff --git a/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch b/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch
deleted file mode 100644
index 2de9484226b1..000000000000
--- a/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 1643ed0d8a9201732905bee51b096605d26aaaac Mon Sep 17 00:00:00 2001
-From: Randy Eckenrode <randy@largeandhighquality.com>
-Date: Fri, 26 May 2023 00:10:45 -0400
-Subject: [PATCH] Fix test failures on Darwin on a case-sensitive fs
-
-This issue was encounetered while working on a contribution to nixpkgs.
-Nix allows the store to be installed on a separate, case-sensitive APFS
-volume. When the store is on a case-sensitive volume, these tests fail
-because they try to use `foundation` instead of `Foundation`.
----
- .../failing/78 framework dependency with version/meson.build    | 2 +-
- test cases/objc/2 nsstring/meson.build                          | 2 +-
- test cases/osx/6 multiframework/meson.build                     | 2 +-
- 3 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/test cases/failing/78 framework dependency with version/meson.build b/test cases/failing/78 framework dependency with version/meson.build
-index b7e04bab446..ee315ebcbd7 100644
---- a/test cases/failing/78 framework dependency with version/meson.build	
-+++ b/test cases/failing/78 framework dependency with version/meson.build	
-@@ -5,4 +5,4 @@ if host_machine.system() != 'darwin'
- endif
- 
- # do individual frameworks have a meaningful version to test?  And multiple frameworks might be listed...
--dep = dependency('appleframeworks', modules: 'foundation', version: '>0')
-+dep = dependency('appleframeworks', modules: 'Foundation', version: '>0')
-diff --git a/test cases/objc/2 nsstring/meson.build b/test cases/objc/2 nsstring/meson.build
-index 94d2cf18ab4..2c483d50d68 100644
---- a/test cases/objc/2 nsstring/meson.build	
-+++ b/test cases/objc/2 nsstring/meson.build	
-@@ -1,7 +1,7 @@
- project('nsstring', 'objc')
- 
- if host_machine.system() == 'darwin'
--  dep = dependency('appleframeworks', modules : 'foundation')
-+  dep = dependency('appleframeworks', modules : 'Foundation')
- elif host_machine.system() == 'cygwin'
-   error('MESON_SKIP_TEST GNUstep is not packaged for Cygwin.')
- else
-diff --git a/test cases/osx/6 multiframework/meson.build b/test cases/osx/6 multiframework/meson.build
-index 28846243b21..57e5d61560b 100644
---- a/test cases/osx/6 multiframework/meson.build	
-+++ b/test cases/osx/6 multiframework/meson.build	
-@@ -4,7 +4,7 @@ project('multiframework', 'objc')
- # that causes a build failure when defining two modules. The
- # arguments for the latter module overwrote the arguments for
- # the first one rather than adding to them.
--cocoa_dep = dependency('appleframeworks', modules : ['AppKit', 'foundation'])
-+cocoa_dep = dependency('appleframeworks', modules : ['AppKit', 'Foundation'])
- 
- executable('deptester',
-   'main.m',
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 58468ccee5b8..aa09a5d2358e 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchPypi
+, fetchFromGitHub
 , fetchpatch
 , installShellFiles
 , ninja
@@ -18,18 +18,16 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.1.1";
+  version = "1.2.0";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-0EtUH5fKQ5+4L6t9DUgJiL5L1OYlY6XKNfrbVAByexw=";
+  src = fetchFromGitHub {
+    owner = "mesonbuild";
+    repo = "meson";
+    rev = "refs/tags/${version}";
+    hash = "sha256-bJAmkE+sL9DqKpcjZdBf4/z9lz+m/o0Z87hlAwbVbTY=";
   };
 
   patches = [
-    # Fix Meson tests that fail when the Nix store is case-sensitive APFS.
-    # https://github.com/mesonbuild/meson/pull/11820
-    ./darwin-case-sensitive-fs.patch
-
     # Meson is currently inspecting fewer variables than autoconf does, which
     # makes it harder for us to use setup hooks, etc.  Taken from
     # https://github.com/mesonbuild/meson/pull/6827

From 99e148dd2719749c3e4c141161ca62dd177276a2 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 24 Jul 2023 23:23:14 +0100
Subject: [PATCH 006/115] bash: fix parallel build failure on unwind_prot.o

As reported by Robert Scott in https://github.com/NixOS/nixpkgs/pull/245066
without the change `make -j8` build of `make` occasionally fails to
buildin parallel. The simplest reproducer is:

    $$ ./configure
    $$ make unwind_prot.o
    ...
    In file included from unwind_prot.c:51:
    In file included from ./bashintl.h:30:
    ./include/gettext.h:27:11: fatal error: 'libintl.h' file not found
    # include <libintl.h>
              ^~~~~~~~~~~
    1 error generated.
    make: * [Makefile:106: unwind_prot.o] Error 1

The change adds missing ttransitive `${LIBINTL_H}` dependency for
unwind_prot.o.
---
 pkgs/shells/bash/5.nix          |  4 ++++
 pkgs/shells/bash/parallel.patch | 12 ++++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 pkgs/shells/bash/parallel.patch

diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 00b4a707ed08..6b126390c9f6 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -61,6 +61,10 @@ stdenv.mkDerivation rec {
       url = "https://cgit.freebsd.org/ports/plain/shells/bash/files/patch-configure?id=3e147a1f594751a68fea00a28090d0792bee0b51";
       sha256 = "XHFMQ6eXTReNoywdETyrfQEv1rKF8+XFbQZP4YoVKFk=";
     })
+    # Apply parallel build fix pending upstream inclusion:
+    #   https://savannah.gnu.org/patch/index.php?10373
+    # Had to fetch manually to workaround -p0 default.
+    ./parallel.patch
   ];
 
   configureFlags = [
diff --git a/pkgs/shells/bash/parallel.patch b/pkgs/shells/bash/parallel.patch
new file mode 100644
index 000000000000..d9a0cc28ce04
--- /dev/null
+++ b/pkgs/shells/bash/parallel.patch
@@ -0,0 +1,12 @@
+From https://savannah.gnu.org/patch/index.php?10373
+  https://savannah.gnu.org/patch/download.php?file_id=54964
+--- Makefile.in
++++ Makefile.in
+@@ -1432,6 +1432,7 @@ siglist.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
+ subst.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
+ test.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
+ trap.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
++unwind_prot.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
+ variables.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
+ version.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
+ xmalloc.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h

From a38770bd69115aff3afde572bbce804df62fdaee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
Date: Fri, 30 Oct 2020 22:40:53 +0100
Subject: [PATCH 007/115] libavif: build gdk-pixbuf loader and thumbnailer

https://github.com/AOMediaCodec/libavif/pull/182
https://github.com/AOMediaCodec/libavif/pull/977

Mostly mirrors webp-pixbuf-loader.

Also use prefixed names for `loaders.cache` so that users can install
multiple loaders in a profile without collisions, and move
`bin/webp-thumbnailer` to `libexec/gdk-pixbuf-thumbnailer-webp` (and
similarly for avif).
---
 .../libraries/gdk-pixbuf/default.nix          |  5 ++--
 .../development/libraries/libavif/default.nix | 28 +++++++++++++++++++
 .../libraries/webp-pixbuf-loader/default.nix  |  9 ++----
 3 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index bece2287c055..d982b7729706 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -143,8 +143,9 @@ stdenv.mkDerivation (finalAttrs: {
       pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
     };
 
-    # gdk_pixbuf_moduledir variable from gdk-pixbuf-2.0.pc
-    moduleDir = "lib/gdk-pixbuf-2.0/2.10.0/loaders";
+    # gdk_pixbuf_binarydir and gdk_pixbuf_moduledir variables from gdk-pixbuf-2.0.pc
+    binaryDir = "lib/gdk-pixbuf-2.0/2.10.0";
+    moduleDir = "${finalAttrs.passthru.binaryDir}/loaders";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libavif/default.nix b/pkgs/development/libraries/libavif/default.nix
index dca45186d4ce..eb8a8b1e3b54 100644
--- a/pkgs/development/libraries/libavif/default.nix
+++ b/pkgs/development/libraries/libavif/default.nix
@@ -8,8 +8,15 @@
 , libjpeg
 , dav1d
 , libyuv
+, gdk-pixbuf
+, makeWrapper
 }:
 
+let
+  gdkPixbufModuleDir = "${placeholder "out"}/${gdk-pixbuf.moduleDir}";
+  gdkPixbufModuleFile = "${placeholder "out"}/${gdk-pixbuf.binaryDir}/avif-loaders.cache";
+in
+
 stdenv.mkDerivation rec {
   pname = "libavif";
   version = "0.11.1";
@@ -29,14 +36,18 @@ stdenv.mkDerivation rec {
     "-DAVIF_CODEC_DAV1D=ON" # best decoder (fast)
     "-DAVIF_CODEC_AOM_DECODE=OFF"
     "-DAVIF_BUILD_APPS=ON"
+    "-DAVIF_BUILD_GDK_PIXBUF=ON"
   ];
 
   nativeBuildInputs = [
     cmake
     pkg-config
+    gdk-pixbuf
+    makeWrapper
   ];
 
   buildInputs = [
+    gdk-pixbuf
     libaom
     zlib
     libpng
@@ -45,6 +56,23 @@ stdenv.mkDerivation rec {
     libyuv
   ];
 
+  postPatch = ''
+    substituteInPlace contrib/gdk-pixbuf/avif.thumbnailer.in \
+      --replace '@CMAKE_INSTALL_FULL_BINDIR@/gdk-pixbuf-thumbnailer' "$out/libexec/gdk-pixbuf-thumbnailer-avif"
+  '';
+
+  env.PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = gdkPixbufModuleDir;
+
+  postInstall = ''
+    GDK_PIXBUF_MODULEDIR=${gdkPixbufModuleDir} \
+    GDK_PIXBUF_MODULE_FILE=${gdkPixbufModuleFile} \
+    gdk-pixbuf-query-loaders --update-cache
+
+    mkdir -p "$out/bin"
+    makeWrapper ${gdk-pixbuf}/bin/gdk-pixbuf-thumbnailer "$out/libexec/gdk-pixbuf-thumbnailer-avif" \
+      --set GDK_PIXBUF_MODULE_FILE ${gdkPixbufModuleFile}
+  '';
+
   meta = with lib; {
     description  = "C implementation of the AV1 Image File Format";
     longDescription = ''
diff --git a/pkgs/development/libraries/webp-pixbuf-loader/default.nix b/pkgs/development/libraries/webp-pixbuf-loader/default.nix
index bf2c8c28dbdb..1f36ffc1c666 100644
--- a/pkgs/development/libraries/webp-pixbuf-loader/default.nix
+++ b/pkgs/development/libraries/webp-pixbuf-loader/default.nix
@@ -11,10 +11,7 @@
 
 let
   inherit (gdk-pixbuf) moduleDir;
-
-  # turning lib/gdk-pixbuf-#.#/#.#.#/loaders into lib/gdk-pixbuf-#.#/#.#.#/loaders.cache
-  # removeSuffix is just in case moduleDir gets a trailing slash
-  loadersPath = (lib.strings.removeSuffix "/" gdk-pixbuf.moduleDir) + ".cache";
+  loadersPath = "${gdk-pixbuf.binaryDir}/webp-loaders.cache";
 in
 stdenv.mkDerivation rec {
   pname = "webp-pixbuf-loader";
@@ -47,7 +44,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     # It looks for gdk-pixbuf-thumbnailer in this package's bin rather than the gdk-pixbuf bin. We need to patch that.
     substituteInPlace webp-pixbuf.thumbnailer.in \
-      --replace "@bindir@/gdk-pixbuf-thumbnailer" "$out/bin/webp-thumbnailer"
+      --replace "@bindir@/gdk-pixbuf-thumbnailer" "$out/libexec/gdk-pixbuf-thumbnailer-webp"
   '';
 
   postInstall = ''
@@ -58,7 +55,7 @@ stdenv.mkDerivation rec {
     # It assumes gdk-pixbuf-thumbnailer can find the webp loader in the loaders.cache referenced by environment variable, breaking containment.
     # So we replace it with a wrapped executable.
     mkdir -p "$out/bin"
-    makeWrapper "${gdk-pixbuf}/bin/gdk-pixbuf-thumbnailer" "$out/bin/webp-thumbnailer" \
+    makeWrapper "${gdk-pixbuf}/bin/gdk-pixbuf-thumbnailer" "$out/libexec/gdk-pixbuf-thumbnailer-webp" \
       --set GDK_PIXBUF_MODULE_FILE "$out/${loadersPath}"
   '';
 

From 2e45100c5c7230f30bc9eddef8a7fc8f813c6adf Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Tue, 25 Jul 2023 21:25:46 -0400
Subject: [PATCH 008/115] darwin-stdenv: revert `NIX_CC_NO_RESPONSE_FILE` logic

To work around intermitent build failures with clang 16, the stdenv
attempted to pass arguments on the command-line on newer versions of
macOS. Unfortunately, the larger `ARG_MAX` is still not large enough to
build qtwebengine. This commit reverts the `NIX_CC_NO_RESPONSE_FILE`
logic in the stdenv. The changes to cc-wrapper in #245282 are needed for
clang 16 to prevent the above-mentioned build failures.
---
 pkgs/stdenv/darwin/default.nix | 65 +++++++++-------------------------
 1 file changed, 17 insertions(+), 48 deletions(-)

diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 7e6a70777630..418cc915fdc5 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -65,11 +65,7 @@ let
   isBuiltByBootstrapFilesCompiler =
     pkg: isFromNixpkgs pkg && isFromBootstrapFiles pkg.stdenv.cc.cc;
 
-  commonPreHook = pkgs: lib.optionalString (pkgs.darwin.system_cmds != null) ''
-    # Only use a response file on older systems with a small ARG_MAX (less than 1 MiB).
-    export NIX_CC_USE_RESPONSE_FILE=$(( "$("${lib.getBin pkgs.darwin.system_cmds}/bin/getconf" ARG_MAX)" < 1048576 ))
-    export NIX_LD_USE_RESPONSE_FILE=$NIX_CC_USE_RESPONSE_FILE
-  '' + ''
+  commonPreHook = ''
     export NIX_ENFORCE_NO_NATIVE=''${NIX_ENFORCE_NO_NATIVE-1}
     export NIX_ENFORCE_PURITY=''${NIX_ENFORCE_PURITY-1}
     export NIX_IGNORE_LD_THROUGH_GCC=1
@@ -166,7 +162,7 @@ let
           # dependencies on the bootstrapTools in the final stdenv.
           dontPatchShebangs=1
         '' + ''
-          ${commonPreHook prevStage}
+          ${commonPreHook}
           ${extraPreHook}
         '' + lib.optionalString (prevStage.darwin ? locale) ''
           export PATH_LOCALE=${prevStage.darwin.locale}/share/locale
@@ -216,7 +212,6 @@ in
       print-reexports = null;
       rewrite-tbd = null;
       sigtool = null;
-      system_cmds = null;
       CF = null;
       Libsystem = null;
     };
@@ -300,27 +295,6 @@ in
         rewrite-tbd = bootstrapTools;
 
         sigtool = bootstrapTools;
-
-        # The bootstrap only needs `getconf` from system_cmds, and it only needs to be able to
-        # query `ARG_MAX`. Using a small value here should be fine for the initial stage 1 build.
-        system_cmds = self.stdenv.mkDerivation {
-          name = "bootstrap-stage0-system_cmds";
-          buildCommand = ''
-            mkdir -p "$out/bin"
-            cat <<block > "$out/bin/getconf"
-            #!${bootstrapTools}/bin/bash
-            case "\$1" in
-              ARG_MAX)
-                echo "262144"
-                ;;
-              *)
-                exit 1
-            esac
-            block
-            chmod a+x "$out/bin/getconf"
-          '';
-          passthru.isFromBootstrapFiles = true;
-        };
       } // lib.optionalAttrs (! useAppleSDKLibs) {
         CF = self.stdenv.mkDerivation {
           name = "bootstrap-stage0-CF";
@@ -453,7 +427,7 @@ in
     assert lib.all isFromBootstrapFiles (with prevStage; [ bash coreutils cpio gnugrep pbzx ]);
 
     assert lib.all isFromBootstrapFiles (with prevStage.darwin; [
-      binutils-unwrapped cctools print-reexports rewrite-tbd sigtool system_cmds
+      binutils-unwrapped cctools print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isFromBootstrapFiles (with prevStage.darwin; [ CF Libsystem ]);
@@ -486,8 +460,6 @@ in
       python3 = super.python3Minimal;
 
       darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
-        inherit (prevStage.darwin) system_cmds;
-
         signingUtils = prevStage.darwin.signingUtils.override {
           inherit (selfDarwin) sigtool;
         };
@@ -536,7 +508,7 @@ in
     '';
   })
 
-  # Build sysctl, system_cmds and Python for use by LLVM’s check phase. These must be built in their
+  # Build sysctl and Python for use by LLVM’s check phase. These must be built in their
   # own stage, or an infinite recursion results on x86_64-darwin when using the source-based SDK.
   (prevStage:
     # previous stage1 stdenv:
@@ -553,8 +525,6 @@ in
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
       binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool
     ]);
-    assert lib.all isFromBootstrapFiles (with prevStage.darwin; [ system_cmds ]);
-
     assert (! useAppleSDKLibs) -> lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [ CF Libsystem configd ]);
     assert    useAppleSDKLibs  -> lib.all                   isFromNixpkgs (with prevStage.darwin; [ CF Libsystem libobjc]);
     assert lib.all isFromNixpkgs (with prevStage.darwin; [ dyld launchd xnu ]);
@@ -651,7 +621,7 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool system_cmds
+      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [ CF Libsystem configd ]);
@@ -679,8 +649,7 @@ in
       darwin = super.darwin.overrideScope (_: superDarwin: {
         inherit (prevStage.darwin)
           CF Libsystem configd darwin-stubs dyld launchd libclosure libdispatch libobjc
-          locale objc4 postLinkSignHook print-reexports rewrite-tbd signingUtils sigtool
-          system_cmds;
+          locale objc4 postLinkSignHook print-reexports rewrite-tbd signingUtils sigtool;
 
         # Avoid building unnecessary Python dependencies due to building LLVM manpages.
         cctools-llvm = superDarwin.cctools-llvm.override { enableManpages = false; };
@@ -749,7 +718,7 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool system_cmds
+      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [ CF Libsystem configd ]);
@@ -786,7 +755,7 @@ in
       darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
         inherit (prevStage.darwin)
           CF binutils-unwrapped cctools configd darwin-stubs launchd libobjc libtapi locale
-          objc4 print-reexports rewrite-tbd signingUtils sigtool system_cmds;
+          objc4 print-reexports rewrite-tbd signingUtils sigtool;
       });
 
       llvmPackages = super.llvmPackages // (
@@ -848,7 +817,7 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool system_cmds
+      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [ CF configd ]);
@@ -882,7 +851,7 @@ in
       darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
         inherit (prevStage.darwin)
           Libsystem configd darwin-stubs launchd locale print-reexports rewrite-tbd
-          signingUtils sigtool system_cmds;
+          signingUtils sigtool;
 
         # Rewrap binutils so it uses the rebuilt Libsystem.
         binutils = superDarwin.binutils.override {
@@ -971,7 +940,7 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      locale print-reexports rewrite-tbd sigtool system_cmds
+      locale print-reexports rewrite-tbd sigtool
     ]);
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.darwin; [
       binutils-unwrapped cctools libtapi
@@ -1011,7 +980,7 @@ in
         inherit (prevStage.darwin)
           CF Libsystem binutils binutils-unwrapped cctools cctools-llvm cctools-port configd
           darwin-stubs dyld launchd libclosure libdispatch libobjc libtapi locale objc4
-          postLinkSignHook print-reexports rewrite-tbd signingUtils sigtool system_cmds;
+          postLinkSignHook print-reexports rewrite-tbd signingUtils sigtool;
       });
 
       llvmPackages = super.llvmPackages // (
@@ -1051,7 +1020,7 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      locale print-reexports rewrite-tbd sigtool system_cmds
+      locale print-reexports rewrite-tbd sigtool
     ]);
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.darwin; [
       binutils-unwrapped cctools libtapi
@@ -1191,7 +1160,7 @@ in
     ]);
 
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools libtapi locale print-reexports rewrite-tbd sigtool system_cmds
+      binutils-unwrapped cctools libtapi locale print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isBuiltByNixpkgsCompiler (with prevStage.darwin; [ CF Libsystem configd ]);
@@ -1226,7 +1195,8 @@ in
 
       inherit config;
 
-      preHook = (commonPreHook prevStage) + ''
+      preHook = ''
+        ${commonPreHook}
         stripDebugFlags="-S" # llvm-strip does not support "-p" for Mach-O
         export PATH_LOCALE=${prevStage.darwin.locale}/share/locale
       '';
@@ -1324,7 +1294,6 @@ in
         dyld
         libtapi
         locale
-        system_cmds
       ]
       ++ lib.optional useAppleSDKLibs [ objc4 ]
       ++ lib.optionals doSign [ postLinkSignHook sigtool signingUtils ]);
@@ -1341,7 +1310,7 @@ in
 
         darwin = super.darwin.overrideScope (_: _: {
           inherit (prevStage.darwin)
-            CF ICU Libsystem darwin-stubs dyld locale libobjc libtapi system_cmds xnu;
+            CF ICU Libsystem darwin-stubs dyld locale libobjc libtapi xnu;
         } // lib.optionalAttrs (super.stdenv.targetPlatform == localSystem) {
           inherit (prevStage.darwin) binutils binutils-unwrapped cctools-llvm cctools-port;
         });

From 9513725990ae41829f1461d86598d3c67d74caea Mon Sep 17 00:00:00 2001
From: Lancelot SIX <lsix@lancelotsix.com>
Date: Wed, 26 Jul 2023 10:41:16 +0100
Subject: [PATCH 009/115] gdb: disable sim by default
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Out of the box, building GDB will also build the GNU simulator
project[1].  When building GDB with --enable-target=all, this result in
all simulators to be built, which accounts for a significant amount of
space.

This patch makes the default GDB package to not bundle sim.  Sim can be
enabled using `enableSim = true`;

As a result, the default GDB install is now about 40M v.s. 650M when all
simulators are included.

[1] https://sourceware.org/gdb/wiki/Sim
---
 pkgs/development/tools/misc/gdb/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index 129b55e74098..f627f3db2c8e 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -10,6 +10,7 @@
 , enableDebuginfod ? lib.meta.availableOn stdenv.hostPlatform elfutils, elfutils
 , guile ? null
 , hostCpuOnly ? false
+, enableSim ? false
 , safePaths ? [
    # $debugdir:$datadir/auto-load are whitelisted by default by GDB
    "$debugdir" "$datadir/auto-load"
@@ -112,7 +113,8 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional (!pythonSupport) "--without-python"
     ++ lib.optional stdenv.hostPlatform.isMusl "--disable-nls"
     ++ lib.optional stdenv.hostPlatform.isStatic "--disable-inprocess-agent"
-    ++ lib.optional enableDebuginfod "--with-debuginfod=yes";
+    ++ lib.optional enableDebuginfod "--with-debuginfod=yes"
+    ++ lib.optional (!enableSim) "--disable-sim";
 
   postInstall =
     '' # Remove Info files already provided by Binutils and other packages.

From 30e58da8aa5d8595c8cbce90cef9ea0f5e71d14c Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 27 Jul 2023 16:42:56 -0400
Subject: [PATCH 010/115] tix: fix build with clang 16

Fixes two issues:

* incompatible function pointer conversions that are an error with clang 16; and
* implicit declaration of `panic` on Darwin.
---
 pkgs/development/libraries/tix/default.nix    |   3 +
 .../libraries/tix/fix-clang16.patch           | 215 ++++++++++++++++++
 2 files changed, 218 insertions(+)
 create mode 100644 pkgs/development/libraries/tix/fix-clang16.patch

diff --git a/pkgs/development/libraries/tix/default.nix b/pkgs/development/libraries/tix/default.nix
index 80b93823df94..a46b2499964c 100644
--- a/pkgs/development/libraries/tix/default.nix
+++ b/pkgs/development/libraries/tix/default.nix
@@ -21,6 +21,9 @@ tcl.mkTclDerivation {
     })
     # Remove duplicated definition of XLowerWindow
     ./duplicated-xlowerwindow.patch
+    # Fix incompatible function pointer conversions and implicit definition of `panic`.
+    # `panic` is just `Tcl_Panic`, but it is not defined on Darwin due to a conflict with `mach/mach.h`.
+    ./fix-clang16.patch
   ] ++ lib.optional (tcl.release == "8.6")
   (fetchpatch {
     name = "tix-8.4.3-tcl8.6.patch";
diff --git a/pkgs/development/libraries/tix/fix-clang16.patch b/pkgs/development/libraries/tix/fix-clang16.patch
new file mode 100644
index 000000000000..f5d8a5337de0
--- /dev/null
+++ b/pkgs/development/libraries/tix/fix-clang16.patch
@@ -0,0 +1,215 @@
+diff -ur a/generic/tixDItem.c b/generic/tixDItem.c
+--- a/generic/tixDItem.c	2004-03-27 19:44:56.000000000 -0700
++++ b/generic/tixDItem.c	2023-07-11 14:49:51.583894242 -0600
+@@ -30,7 +30,7 @@
+ 		Tcl_Interp *interp, Tk_Window tkwin, CONST84 char *value,
+ 		char *widRec, int offset));
+ 
+-static char *DItemPrintProc _ANSI_ARGS_((
++static const char *DItemPrintProc _ANSI_ARGS_((
+ 		ClientData clientData, Tk_Window tkwin, char *widRec,
+ 		int offset, Tcl_FreeProc **freeProcPtr));
+ 
+@@ -548,7 +548,7 @@
+     return TCL_OK;
+ }
+ 
+-static char *DItemPrintProc(clientData, tkwin, widRec,offset, freeProcPtr)
++static const char *DItemPrintProc(clientData, tkwin, widRec,offset, freeProcPtr)
+     ClientData clientData;
+     Tk_Window tkwin;
+     char *widRec;
+diff -ur a/generic/tixDiStyle.c b/generic/tixDiStyle.c
+--- a/generic/tixDiStyle.c	2004-03-27 19:44:56.000000000 -0700
++++ b/generic/tixDiStyle.c	2023-07-11 15:02:45.245210252 -0600
+@@ -31,7 +31,7 @@
+ static int   		DItemStyleParseProc _ANSI_ARGS_((ClientData clientData,
+ 			    Tcl_Interp *interp, Tk_Window tkwin,
+ 			    CONST84 char *value,char *widRec, int offset));
+-static char *		DItemStylePrintProc _ANSI_ARGS_((
++static const char *		DItemStylePrintProc _ANSI_ARGS_((
+ 			    ClientData clientData, Tk_Window tkwin, 
+ 			    char *widRec, int offset,
+ 			    Tcl_FreeProc **freeProcPtr));
+@@ -785,7 +785,7 @@
+ 
+     hashPtr = Tcl_CreateHashEntry(&stylePtr->base.items, (char*)iPtr, &isNew);
+     if (!isNew) {
+-	panic("DItem is already associated with style");
++	Tcl_Panic("DItem is already associated with style");
+     } else {
+ 	Tcl_SetHashValue(hashPtr, (char*)iPtr);
+     }
+@@ -801,7 +801,7 @@
+ 
+     hashPtr = Tcl_FindHashEntry(&stylePtr->base.items, (char*)iPtr);
+     if (hashPtr == NULL) {
+-	panic("DItem is not associated with style");
++	Tcl_Panic("DItem is not associated with style");
+     }
+     Tcl_DeleteHashEntry(hashPtr);
+     stylePtr->base.refCount--;
+@@ -998,7 +998,7 @@
+     return TCL_ERROR;
+ }
+ 
+-static char *DItemStylePrintProc(clientData, tkwin, widRec,offset, freeProcPtr)
++static const char *DItemStylePrintProc(clientData, tkwin, widRec,offset, freeProcPtr)
+     ClientData clientData;
+     Tk_Window tkwin;
+     char *widRec;
+diff -ur a/generic/tixForm.c b/generic/tixForm.c
+--- a/generic/tixForm.c	2004-03-27 19:44:56.000000000 -0700
++++ b/generic/tixForm.c	2023-07-11 14:53:45.695753419 -0600
+@@ -802,7 +802,7 @@
+      * Now set all the client's geometry
+      */
+     if (PlaceAllClients(masterPtr) != TCL_OK) {
+-	panic("circular dependency");
++	Tcl_Panic("circular dependency");
+     }
+ 
+     for (clientPtr = masterPtr->client; clientPtr; clientPtr=clientPtr->next) {
+diff -ur a/generic/tixGrData.c b/generic/tixGrData.c
+--- a/generic/tixGrData.c	2004-03-27 19:44:56.000000000 -0700
++++ b/generic/tixGrData.c	2023-07-11 14:54:19.644741199 -0600
+@@ -296,7 +296,7 @@
+ 	Tcl_DeleteHashEntry(cy);
+     }
+     else {
+-	panic("Inconsistent grid dataset: (%d,%d) : %x %x", x, y, cx, cy);
++	Tcl_Panic("Inconsistent grid dataset: (%d,%d) : %x %x", x, y, cx, cy);
+     }
+ 
+     return 1;
+diff -ur a/generic/tixGrid.c b/generic/tixGrid.c
+--- a/generic/tixGrid.c	2008-02-27 21:10:43.000000000 -0700
++++ b/generic/tixGrid.c	2023-07-11 14:53:59.283841038 -0600
+@@ -831,7 +831,7 @@
+ 	 * All mapped windows should have been unmapped when the
+ 	 * the entries were deleted
+ 	 */
+-	panic("tixGrid: mappedWindows not NULL");
++	Tcl_Panic("tixGrid: mappedWindows not NULL");
+     }
+ 
+     Tk_FreeOptions(configSpecs, (char *) wPtr, wPtr->dispData.display, 0);
+diff -ur a/generic/tixHList.c b/generic/tixHList.c
+--- a/generic/tixHList.c	2008-02-27 21:05:29.000000000 -0700
++++ b/generic/tixHList.c	2023-07-11 14:55:20.699375202 -0600
+@@ -2036,7 +2036,7 @@
+ 	    break;
+ 	}
+ 	if (wPtr->headerWin != NULL) {
+-	    panic("HList: header subwindow deleted illegally\n");
++	    Tcl_Panic("HList: header subwindow deleted illegally\n");
+ 	}
+ #endif
+ 	break;
+@@ -2117,7 +2117,7 @@
+ 	 * All mapped windows should have been unmapped when the
+ 	 * the entries were deleted
+ 	 */
+-	panic("tixHList: mappedWindows not NULL");
++	Tcl_Panic("tixHList: mappedWindows not NULL");
+     }
+     if (wPtr->headerWin) {
+ 	wPtr->headerWin = NULL;
+diff -ur a/generic/tixImgCmp.c b/generic/tixImgCmp.c
+--- a/generic/tixImgCmp.c	2008-02-27 21:05:29.000000000 -0700
++++ b/generic/tixImgCmp.c	2023-07-11 14:59:16.429640785 -0600
+@@ -142,8 +142,8 @@
+  * The type record for bitmap images:
+  */
+ static int		ImgCmpCreate _ANSI_ARGS_((Tcl_Interp *interp,
+-			    char *name, int argc, Tcl_Obj *CONST objv[],
+-			    Tk_ImageType *typePtr, Tk_ImageMaster master,
++			    const char *name, int argc, Tcl_Obj *CONST objv[],
++			    const Tk_ImageType *typePtr, Tk_ImageMaster master,
+ 			    ClientData *clientDataPtr));
+ static ClientData	ImgCmpGet _ANSI_ARGS_((Tk_Window tkwin,
+ 			    ClientData clientData));
+@@ -378,11 +378,11 @@
+ ImgCmpCreate(interp, name, argc, objv, typePtr, master, clientDataPtr)
+     Tcl_Interp *interp;		/* Interpreter for application containing
+ 				 * image. */
+-    char *name;			/* Name to use for image. */
++    const char *name;		/* Name to use for image. */
+     int argc;			/* Number of arguments. */
+     Tcl_Obj *CONST objv[];	/* Argument strings for options (doesn't
+ 				 * include image name or type). */
+-    Tk_ImageType *typePtr;	/* Pointer to our type record (not used). */
++    const Tk_ImageType *typePtr;/* Pointer to our type record (not used). */
+     Tk_ImageMaster master;	/* Token for image, to be used by us in
+ 				 * later callbacks. */
+     ClientData *clientDataPtr;	/* Store manager's token for image here;
+diff -ur a/generic/tixImgXpm.c b/generic/tixImgXpm.c
+--- a/generic/tixImgXpm.c	2023-07-11 15:01:05.887387236 -0600
++++ b/generic/tixImgXpm.c	2023-07-11 15:00:37.209042328 -0600
+@@ -22,8 +22,8 @@
+  */
+ 
+ static int		ImgXpmCreate _ANSI_ARGS_((Tcl_Interp *interp,
+-			    char *name, int argc, Tcl_Obj *CONST objv[],
+-			    Tk_ImageType *typePtr, Tk_ImageMaster master,
++			    const char *name, int argc, Tcl_Obj *CONST objv[],
++			    const Tk_ImageType *typePtr, Tk_ImageMaster master,
+ 			    ClientData *clientDataPtr));
+ static ClientData	ImgXpmGet _ANSI_ARGS_((Tk_Window tkwin,
+ 			    ClientData clientData));
+@@ -115,11 +115,11 @@
+ ImgXpmCreate(interp, name, argc, objv, typePtr, master, clientDataPtr)
+     Tcl_Interp *interp;		/* Interpreter for application containing
+ 				 * image. */
+-    char *name;			/* Name to use for image. */
++    const char *name;		/* Name to use for image. */
+     int argc;			/* Number of arguments. */
+     Tcl_Obj *CONST objv[];	/* Argument strings for options (doesn't
+ 				 * include image name or type). */
+-    Tk_ImageType *typePtr;	/* Pointer to our type record (not used). */
++    const Tk_ImageType *typePtr;/* Pointer to our type record (not used). */
+     Tk_ImageMaster master;	/* Token for image, to be used by us in
+ 				 * later callbacks. */
+     ClientData *clientDataPtr;	/* Store manager's token for image here;
+@@ -1213,7 +1213,7 @@
+     PixmapMaster *masterPtr = (PixmapMaster *) masterData;
+ 
+     if (masterPtr->instancePtr != NULL) {
+-	panic("tried to delete pixmap image when instances still exist");
++	Tcl_Panic("tried to delete pixmap image when instances still exist");
+     }
+     masterPtr->tkMaster = NULL;
+     if (masterPtr->imageCmd != NULL) {
+diff -ur a/generic/tixTList.c b/generic/tixTList.c
+--- a/generic/tixTList.c	2008-02-27 21:05:29.000000000 -0700
++++ b/generic/tixTList.c	2023-07-11 14:55:35.960761327 -0600
+@@ -1208,7 +1208,7 @@
+ 	    sprintf(buff, "%d", i);
+ 	    Tcl_AppendResult(interp, buff, NULL);
+ 	} else {
+-	    panic("TList list entry is invalid");
++	    Tcl_Panic("TList list entry is invalid");
+ 	}
+     } else {
+ 	Tcl_ResetResult(interp);
+diff -ur a/generic/tixUtils.c b/generic/tixUtils.c
+--- a/generic/tixUtils.c	2008-02-27 21:29:17.000000000 -0700
++++ b/generic/tixUtils.c	2023-07-11 15:01:43.718202631 -0600
+@@ -24,7 +24,7 @@
+ static int	ReliefParseProc(ClientData clientData,
+ 	Tcl_Interp *interp, Tk_Window tkwin, CONST84 char *value,
+ 	char *widRec, int offset);
+-static char *	ReliefPrintProc(ClientData clientData,
++static const char *	ReliefPrintProc(ClientData clientData,
+ 	Tk_Window tkwin, char *widRec, int offset,
+ 	Tix_FreeProc **freeProcPtr);
+ 
+@@ -637,7 +637,7 @@
+     return TCL_ERROR;
+ }
+ 
+-static char *
++static const char *
+ ReliefPrintProc(clientData, tkwin, widRec,offset, freeProcPtr)
+     ClientData clientData;
+     Tk_Window tkwin;

From c200f5e411fc738780000bb6eafe8105993ad488 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:46:14 -0700
Subject: [PATCH 011/115] partial revert of f3719756b550

---
 pkgs/os-specific/linux/kernel/manual-config.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 07325f0e10b0..60175f805a68 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -409,11 +409,10 @@ stdenv.mkDerivation ({
   meta = {
     description =
       "The Linux kernel" +
-      (lib.optionalString (kernelPatches != []) (
+      (if kernelPatches == [] then "" else
         " (with patches: "
         + lib.concatStringsSep ", " (map (x: x.name) kernelPatches)
-        + ")"
-      ));
+        + ")");
     license = lib.licenses.gpl2Only;
     homepage = "https://www.kernel.org/";
     maintainers = lib.teams.linux-kernel.members ++ [

From 17d25bf7621334f0534b59422903984183223585 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:46:20 -0700
Subject: [PATCH 012/115] Revert "linuxManualConfig: restore functionality of
 isModular and buildDTBs"

This reverts commit 284d76ee3ddfde84bcc491f45d7e322da02bbae6.
---
 pkgs/os-specific/linux/kernel/manual-config.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 60175f805a68..677cc9363da4 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -232,10 +232,7 @@ stdenv.mkDerivation ({
     # replicated here to apply to older versions.
     # Makes __FILE__ relative to the build directory.
     "KCPPFLAGS=-fmacro-prefix-map=$(sourceRoot)/="
-    kernelConf.target
-  ] ++ optional isModular "modules"
-    ++ optional buildDTBs "dtbs"
-    ++ extraMakeFlags;
+  ] ++ extraMakeFlags;
 
   installFlags = [
     "INSTALL_PATH=$(out)"

From 007f794167df4387bcf5f2c37f6881667805cad1 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:46:26 -0700
Subject: [PATCH 013/115] Revert "lib/systems: strip kernel to avoid reference
 cycles"

This reverts commit 2458c94c9e177ad92aedc8b128a1e92e4dc3bd56.
---
 pkgs/os-specific/linux/kernel/manual-config.nix | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 677cc9363da4..1c244664975b 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -373,20 +373,11 @@ stdenv.mkDerivation ({
 
     # Remove reference to kmod
     sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
-  ''
-  # unfortunately linux/arch/mips/Makefile does not understand installkernel
-  # and simply copies to $(INSTALL_PATH)/vmlinux-$(KERNELRELEASE)
-  + lib.optionalString stdenv.hostPlatform.isMips ''
-    mv $out/vmlinux-* $out/vmlinux || true
-    mv $out/vmlinuz-* $out/vmlinuz || true
-    mv $out/System.map-* $out/System.map
   '';
 
   preFixup = ''
     # Don't strip $dev/lib/modules/*/vmlinux
     stripDebugList="$(cd $dev && echo lib/modules/*/build/*/)"
-  '' + lib.optionalString (stdenv.hostPlatform.isMips) ''
-    $STRIP -s $out/vmlinux || true
   '';
 
   enableParallelBuilding = true;

From c801a96a0db9609b2ebfa4ed2a8577cbe90ff9a1 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:46:47 -0700
Subject: [PATCH 014/115] Revert "linuxManualConfig: set badPlatforms"

This reverts commit 5c5e5e2f1f47d9b0e6c48defe25aeba0bbf04d2c.
---
 pkgs/os-specific/linux/kernel/manual-config.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 1c244664975b..d7ea4ac2c498 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -407,9 +407,6 @@ stdenv.mkDerivation ({
       maintainers.thoughtpolice
     ];
     platforms = platforms.linux;
-    badPlatforms =
-      lib.optionals (lib.versionOlder version "4.15") [ "riscv32-linux" "riscv64-linux" ] ++
-      lib.optional (lib.versionOlder version "5.19") "loongarch64-linux";
     timeout = 14400; # 4 hours
   } // extraMeta;
 } // optionalAttrs (pos != null) {

From eecef61ba5c8f3f6ec21752b7f5c15c91a04a7b5 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:46:54 -0700
Subject: [PATCH 015/115] Revert "linux.configfile: remove unused kernelTarget
 attr"

This reverts commit 01b36425890182d3a1898c27d479189a7c496646.
---
 pkgs/os-specific/linux/kernel/generic.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 660521349053..04f6cfc70ad3 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -130,6 +130,8 @@ let
 
     # e.g. "defconfig"
     kernelBaseConfig = if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig or "defconfig";
+    # e.g. "bzImage"
+    kernelTarget = stdenv.hostPlatform.linux-kernel.target or "vmlinux";
 
     makeFlags = lib.optionals (stdenv.hostPlatform.linux-kernel ? makeFlags) stdenv.hostPlatform.linux-kernel.makeFlags
       ++ extraMakeFlags;

From 06f20db451844c5f048e99e3e3f6870ae998c9e5 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:37:12 -0700
Subject: [PATCH 016/115] Revert "linuxManualConfig: always depend on
 ubootTools"

This reverts commit e5e02f3214ae381142606cf5defc35888d73f883.
---
 pkgs/os-specific/linux/kernel/manual-config.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index d7ea4ac2c498..9908d22c4112 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, buildPackages, runCommand, nettools, bc, bison, flex, perl, rsync, gmp, libmpc, mpfr, openssl
-, libelf, cpio, elfutils, zstd, python3Minimal, zlib, pahole, ubootTools
+, libelf, cpio, elfutils, zstd, python3Minimal, zlib, pahole
 , fetchpatch
 }:
 
@@ -101,13 +101,13 @@ stdenv.mkDerivation ({
   inherit version src;
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [
-    bc gmp libmpc mpfr nettools openssl perl python3Minimal rsync ubootTools
-    zstd
-  ] ++ optional  (lib.versionOlder version "5.8") libelf
-    ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
-    ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
-    ++ optional  (lib.versionAtLeast version "5.8")  elfutils;
+  nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal ]
+      ++ optional  (target == "uImage") buildPackages.ubootTools
+      ++ optional  (lib.versionOlder version "5.8") libelf
+      ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
+      ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
+      ++ optional  (lib.versionAtLeast version "5.8")  elfutils
+      ;
 
   patches =
     map (p: p.patch) kernelPatches

From ddaa949afe18949396a1de532df60ffaea5bf2a3 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:41:57 -0700
Subject: [PATCH 017/115] Revert "linux: default
 stdenv.hostPlatform.linux-kernel"

This reverts commit febe4776287fd81b9dc0fd88a8bcb686765c8a6b.
---
 pkgs/os-specific/linux/kernel/generic.nix       | 9 +++++----
 pkgs/os-specific/linux/kernel/manual-config.nix | 9 ++++-----
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 04f6cfc70ad3..56d89f67c64a 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -47,7 +47,7 @@
   # symbolic name and `patch' is the actual patch.  The patch may
   # optionally be compressed with gzip or bzip2.
   kernelPatches ? []
-, ignoreConfigErrors ? stdenv.hostPlatform.linux-kernel.name or "" != "pc"
+, ignoreConfigErrors ? stdenv.hostPlatform.linux-kernel.name != "pc"
 , extraMeta ? {}
 
 , isZen      ? false
@@ -55,7 +55,7 @@
 , isHardened ? false
 
 # easy overrides to stdenv.hostPlatform.linux-kernel members
-, autoModules ? stdenv.hostPlatform.linux-kernel.autoModules or true
+, autoModules ? stdenv.hostPlatform.linux-kernel.autoModules
 , preferBuiltin ? stdenv.hostPlatform.linux-kernel.preferBuiltin or false
 , kernelArch ? stdenv.hostPlatform.linuxArch
 , kernelTests ? []
@@ -128,10 +128,11 @@ let
       ++ lib.optionals (lib.versionAtLeast version "4.16") [ bison flex ]
       ++ lib.optional (lib.versionAtLeast version "5.2") pahole;
 
+    platformName = stdenv.hostPlatform.linux-kernel.name;
     # e.g. "defconfig"
-    kernelBaseConfig = if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig or "defconfig";
+    kernelBaseConfig = if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig;
     # e.g. "bzImage"
-    kernelTarget = stdenv.hostPlatform.linux-kernel.target or "vmlinux";
+    kernelTarget = stdenv.hostPlatform.linux-kernel.target;
 
     makeFlags = lib.optionals (stdenv.hostPlatform.linux-kernel ? makeFlags) stdenv.hostPlatform.linux-kernel.makeFlags
       ++ extraMakeFlags;
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 9908d22c4112..4a623fda9bec 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -87,8 +87,7 @@ let
 
   isModular = config.isYes "MODULES";
 
-  kernelConf = stdenv.hostPlatform.linux-kernel;
-  target = kernelConf.target or "vmlinux";
+  kernelConf =  stdenv.hostPlatform.linux-kernel;
 
   buildDTBs = kernelConf.DTB or false;
 in
@@ -102,7 +101,7 @@ stdenv.mkDerivation ({
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal ]
-      ++ optional  (target == "uImage") buildPackages.ubootTools
+      ++ optional  (kernelConf.target == "uImage") buildPackages.ubootTools
       ++ optional  (lib.versionOlder version "5.8") libelf
       ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
       ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
@@ -298,8 +297,8 @@ stdenv.mkDerivation ({
   # Some image types need special install targets (e.g. uImage is installed with make uinstall)
   installTargets = [
     (kernelConf.installTarget or (
-      /**/ if target == "uImage" then "uinstall"
-      else if target == "zImage" || target == "Image.gz" then "zinstall"
+      /**/ if kernelConf.target == "uImage" then "uinstall"
+      else if kernelConf.target == "zImage" || kernelConf.target == "Image.gz" then "zinstall"
       else "install"))
   ];
 

From 479dd15b5f076f48dc367c5d97e6ee13f80cd694 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:42:15 -0700
Subject: [PATCH 018/115] Revert "linux: manual-config: use a non-random path
 for $buildRoot"

This reverts commit a695425e46a89a879fbe290a4ffa162c2b4a20c9.
---
 pkgs/os-specific/linux/kernel/manual-config.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 4a623fda9bec..6d1ad766d684 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -179,8 +179,7 @@ stdenv.mkDerivation ({
   configurePhase = ''
     runHook preConfigure
 
-    export buildRoot=$TMPDIR/kernel-buildroot
-    mkdir -p $buildRoot
+    export buildRoot=$(mktemp -d)
 
     echo "manual-config configurePhase buildRoot=$buildRoot pwd=$PWD"
 

From 92f7beccb29bb68443cbcb81b05e4df6bb91f2e9 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:42:21 -0700
Subject: [PATCH 019/115] Revert "linuxManualConfig: fix inaccurate FIXME
 comment"

This reverts commit 4d15632cafdcd748d32076fd3f0ad0744f5dd7ec.
---
 pkgs/os-specific/linux/kernel/manual-config.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 6d1ad766d684..656ca7086311 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -141,7 +141,7 @@ stdenv.mkDerivation ({
   postPatch = ''
     sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
 
-    # fixup for pre-4.15 kernels using the $(cd $foo && /bin/pwd) pattern
+    # fixup for pre-5.4 kernels using the $(cd $foo && /bin/pwd) pattern
     # FIXME: remove when no longer needed
     substituteInPlace Makefile tools/scripts/Makefile.include --replace /bin/pwd pwd
 

From 37eb25a4285919205f311d26952c752913e2cd1c Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:42:25 -0700
Subject: [PATCH 020/115] Revert "linuxManualConfig: get rid of drvAttrs"

This reverts commit f521f4613355f8628fe378dad4c41d3fd8886966.
---
 .../linux/kernel/manual-config.nix            | 614 +++++++++---------
 1 file changed, 305 insertions(+), 309 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 656ca7086311..46407eccf057 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -52,10 +52,6 @@ in lib.makeOverridable ({
   features ? null, lib ? lib_, stdenv ? stdenv_,
 }:
 
-let
-  config_ = config;
-in
-
 let
   inherit (lib)
     hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
@@ -69,143 +65,333 @@ let
     (buildPackages.deterministic-uname.override { inherit modDirVersion; })
   ] ++ optional (lib.versionAtLeast version "5.13") zstd;
 
-  config = let attrName = attr: "CONFIG_" + attr; in {
-    isSet = attr: hasAttr (attrName attr) config;
+  drvAttrs = config_: kernelConf: kernelPatches: configfile:
+    let
+      config = let attrName = attr: "CONFIG_" + attr; in {
+        isSet = attr: hasAttr (attrName attr) config;
 
-    getValue = attr: if config.isSet attr then getAttr (attrName attr) config else null;
+        getValue = attr: if config.isSet attr then getAttr (attrName attr) config else null;
 
-    isYes = attr: (config.getValue attr) == "y";
+        isYes = attr: (config.getValue attr) == "y";
 
-    isNo = attr: (config.getValue attr) == "n";
+        isNo = attr: (config.getValue attr) == "n";
 
-    isModule = attr: (config.getValue attr) == "m";
+        isModule = attr: (config.getValue attr) == "m";
 
-    isEnabled = attr: (config.isModule attr) || (config.isYes attr);
+        isEnabled = attr: (config.isModule attr) || (config.isYes attr);
 
-    isDisabled = attr: (!(config.isSet attr)) || (config.isNo attr);
-  } // config_;
+        isDisabled = attr: (!(config.isSet attr)) || (config.isNo attr);
+      } // config_;
 
-  isModular = config.isYes "MODULES";
+      isModular = config.isYes "MODULES";
 
-  kernelConf =  stdenv.hostPlatform.linux-kernel;
+      buildDTBs = kernelConf.DTB or false;
 
-  buildDTBs = kernelConf.DTB or false;
+    in (optionalAttrs isModular { outputs = [ "out" "dev" ]; }) // {
+      passthru = rec {
+        inherit version modDirVersion config kernelPatches configfile
+          moduleBuildDependencies stdenv;
+        inherit isZen isHardened isLibre;
+        isXen = lib.warn "The isXen attribute is deprecated. All Nixpkgs kernels that support it now have Xen enabled." true;
+        baseVersion = lib.head (lib.splitString "-rc" version);
+        kernelOlder = lib.versionOlder baseVersion;
+        kernelAtLeast = lib.versionAtLeast baseVersion;
+      };
+
+      inherit src;
+
+      patches =
+        map (p: p.patch) kernelPatches
+        # Required for deterministic builds along with some postPatch magic.
+        ++ optional (lib.versionOlder version "5.19") ./randstruct-provide-seed.patch
+        ++ optional (lib.versionAtLeast version "5.19") ./randstruct-provide-seed-5.19.patch
+        # Linux 5.12 marked certain PowerPC-only symbols as GPL, which breaks
+        # OpenZFS; this was fixed in Linux 5.19 so we backport the fix
+        # https://github.com/openzfs/zfs/pull/13367
+        ++ optional (lib.versionAtLeast version "5.12" &&
+                     lib.versionOlder version "5.19" &&
+                     stdenv.hostPlatform.isPower)
+          (fetchpatch {
+            url = "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/patch/?id=d9e5c3e9e75162f845880535957b7fd0b4637d23";
+            hash = "sha256-bBOyJcP6jUvozFJU0SPTOf3cmnTQ6ZZ4PlHjiniHXLU=";
+          });
+
+      preUnpack = ''
+        # The same preUnpack is used to build the configfile,
+        # which does not have $dev.
+        if [ -n "$dev" ]; then
+            mkdir -p $dev/lib/modules/${modDirVersion}
+            cd $dev/lib/modules/${modDirVersion}
+        fi
+      '';
+
+      postUnpack = ''
+        mv -Tv "$sourceRoot" source 2>/dev/null || :
+        export sourceRoot=$PWD/source
+      '';
+
+      postPatch = ''
+        sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
+
+        # fixup for pre-5.4 kernels using the $(cd $foo && /bin/pwd) pattern
+        # FIXME: remove when no longer needed
+        substituteInPlace Makefile tools/scripts/Makefile.include --replace /bin/pwd pwd
+
+        # Don't include a (random) NT_GNU_BUILD_ID, to make the build more deterministic.
+        # This way kernels can be bit-by-bit reproducible depending on settings
+        # (e.g. MODULE_SIG and SECURITY_LOCKDOWN_LSM need to be disabled).
+        # See also https://kernelnewbies.org/BuildId
+        sed -i Makefile -e 's|--build-id=[^ ]*|--build-id=none|'
+
+        # Some linux-hardened patches now remove certain files in the scripts directory, so the file may not exist.
+        [[ -f scripts/ld-version.sh ]] && patchShebangs scripts/ld-version.sh
+
+        # Set randstruct seed to a deterministic but diversified value. Note:
+        # we could have instead patched gen-random-seed.sh to take input from
+        # the buildFlags, but that would require also patching the kernel's
+        # toplevel Makefile to add a variable export. This would be likely to
+        # cause future patch conflicts.
+        for file in scripts/gen-randstruct-seed.sh scripts/gcc-plugins/gen-random-seed.sh; do
+          if [ -f "$file" ]; then
+            substituteInPlace "$file" \
+              --replace NIXOS_RANDSTRUCT_SEED \
+              $(echo ${randstructSeed}${src} ${placeholder "configfile"} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
+            break
+          fi
+        done
+
+        patchShebangs scripts
+
+        # also patch arch-specific install scripts
+        for i in $(find arch -name install.sh); do
+            patchShebangs "$i"
+        done
+      '';
+
+      configurePhase = ''
+        runHook preConfigure
+
+        export buildRoot=$(mktemp -d)
+
+        echo "manual-config configurePhase buildRoot=$buildRoot pwd=$PWD"
+
+        if [ -f "$buildRoot/.config" ]; then
+          echo "Could not link $buildRoot/.config : file exists"
+          exit 1
+        fi
+        ln -sv ${configfile} $buildRoot/.config
+
+        # reads the existing .config file and prompts the user for options in
+        # the current kernel source that are not found in the file.
+        make $makeFlags "''${makeFlagsArray[@]}" oldconfig
+        runHook postConfigure
+
+        make $makeFlags "''${makeFlagsArray[@]}" prepare
+        actualModDirVersion="$(cat $buildRoot/include/config/kernel.release)"
+        if [ "$actualModDirVersion" != "${modDirVersion}" ]; then
+          echo "Error: modDirVersion ${modDirVersion} specified in the Nix expression is wrong, it should be: $actualModDirVersion"
+          exit 1
+        fi
+
+        buildFlagsArray+=("KBUILD_BUILD_TIMESTAMP=$(date -u -d @$SOURCE_DATE_EPOCH)")
+
+        cd $buildRoot
+      '';
+
+      buildFlags = [
+        "DTC_FLAGS=-@"
+        "KBUILD_BUILD_VERSION=1-NixOS"
+
+        # Set by default in the kernel since a73619a845d5,
+        # replicated here to apply to older versions.
+        # Makes __FILE__ relative to the build directory.
+        "KCPPFLAGS=-fmacro-prefix-map=$(sourceRoot)/="
+      ] ++ extraMakeFlags;
+
+      installFlags = [
+        "INSTALL_PATH=$(out)"
+      ] ++ (optional isModular "INSTALL_MOD_PATH=$(out)")
+      ++ optionals buildDTBs ["dtbs_install" "INSTALL_DTBS_PATH=$(out)/dtbs"];
+
+      preInstall = let
+        # All we really need to do here is copy the final image and System.map to $out,
+        # and use the kernel's modules_install, firmware_install, dtbs_install, etc. targets
+        # for the rest. Easy, right?
+        #
+        # Unfortunately for us, the obvious way of getting the built image path,
+        # make -s image_name, does not work correctly, because some architectures
+        # (*cough* aarch64 *cough*) change KBUILD_IMAGE on the fly in their install targets,
+        # so we end up attempting to install the thing we didn't actually build.
+        #
+        # Thankfully, there's a way out that doesn't involve just hardcoding everything.
+        #
+        # The kernel has an install target, which runs a pretty simple shell script
+        # (located at scripts/install.sh or arch/$arch/boot/install.sh, depending on
+        # which kernel version you're looking at) that tries to do something sensible.
+        #
+        # (it would be great to hijack this script immediately, as it has all the
+        #   information we need passed to it and we don't need it to try and be smart,
+        #   but unfortunately, the exact location of the scripts differs between kernel
+        #   versions, and they're seemingly not considered to be public API at all)
+        #
+        # One of the ways it tries to discover what "something sensible" actually is
+        # is by delegating to what's supposed to be a user-provided install script
+        # located at ~/bin/installkernel.
+        #
+        # (the other options are:
+        #   - a distribution-specific script at /sbin/installkernel,
+        #        which we can't really create in the sandbox easily
+        #   - an architecture-specific script at arch/$arch/boot/install.sh,
+        #        which attempts to guess _something_ and usually guesses very wrong)
+        #
+        # More specifically, the install script exec's into ~/bin/installkernel, if one
+        # exists, with the following arguments:
+        #
+        # $1: $KERNELRELEASE - full kernel version string
+        # $2: $KBUILD_IMAGE - the final image path
+        # $3: System.map - path to System.map file, seemingly hardcoded everywhere
+        # $4: $INSTALL_PATH - path to the destination directory as specified in installFlags
+        #
+        # $2 is exactly what we want, so hijack the script and use the knowledge given to it
+        # by the makefile overlords for our own nefarious ends.
+        #
+        # Note that the makefiles specifically look in ~/bin/installkernel, and
+        # writeShellScriptBin writes the script to <store path>/bin/installkernel,
+        # so HOME needs to be set to just the store path.
+        #
+        # FIXME: figure out a less roundabout way of doing this.
+        installkernel = buildPackages.writeShellScriptBin "installkernel" ''
+          cp -av $2 $4
+          cp -av $3 $4
+        '';
+      in ''
+        installFlagsArray+=("-j$NIX_BUILD_CORES")
+        export HOME=${installkernel}
+      '';
+
+      # Some image types need special install targets (e.g. uImage is installed with make uinstall)
+      installTargets = [
+        (kernelConf.installTarget or (
+          /**/ if kernelConf.target == "uImage" then "uinstall"
+          else if kernelConf.target == "zImage" || kernelConf.target == "Image.gz" then "zinstall"
+          else "install"))
+      ];
+
+      postInstall = optionalString isModular ''
+        if [ -z "''${dontStrip-}" ]; then
+          installFlagsArray+=("INSTALL_MOD_STRIP=1")
+        fi
+        make modules_install $makeFlags "''${makeFlagsArray[@]}" \
+          $installFlags "''${installFlagsArray[@]}"
+        unlink $out/lib/modules/${modDirVersion}/build
+        unlink $out/lib/modules/${modDirVersion}/source
+
+        mkdir $dev/lib/modules/${modDirVersion}/build
+
+        cd $dev/lib/modules/${modDirVersion}/source
+
+        cp $buildRoot/{.config,Module.symvers} $dev/lib/modules/${modDirVersion}/build
+        make modules_prepare $makeFlags "''${makeFlagsArray[@]}" O=$dev/lib/modules/${modDirVersion}/build
+
+        # For reproducibility, removes accidental leftovers from a `cc1` call
+        # from a `try-run` call from the Makefile
+        rm -f $dev/lib/modules/${modDirVersion}/build/.[0-9]*.d
+
+        # Keep some extra files
+        for f in arch/powerpc/lib/crtsavres.o arch/arm64/kernel/ftrace-mod.o \
+                 scripts/gdb/linux vmlinux vmlinux-gdb.py
+        do
+          if [ -e "$buildRoot/$f" ]; then
+            mkdir -p "$(dirname "$dev/lib/modules/${modDirVersion}/build/$f")"
+            cp -HR $buildRoot/$f $dev/lib/modules/${modDirVersion}/build/$f
+          fi
+        done
+        ln -s $dev/lib/modules/${modDirVersion}/build/vmlinux $dev
+
+        # !!! No documentation on how much of the source tree must be kept
+        # If/when kernel builds fail due to missing files, you can add
+        # them here. Note that we may see packages requiring headers
+        # from drivers/ in the future; it adds 50M to keep all of its
+        # headers on 3.10 though.
+
+        chmod u+w -R ..
+        arch=$(cd $dev/lib/modules/${modDirVersion}/build/arch; ls)
+
+        # Remove unused arches
+        for d in $(cd arch/; ls); do
+          if [ "$d" = "$arch" ]; then continue; fi
+          if [ "$arch" = arm64 ] && [ "$d" = arm ]; then continue; fi
+          rm -rf arch/$d
+        done
+
+        # Remove all driver-specific code (50M of which is headers)
+        rm -fR drivers
+
+        # Keep all headers
+        find .  -type f -name '*.h' -print0 | xargs -0 -r chmod u-w
+
+        # Keep linker scripts (they are required for out-of-tree modules on aarch64)
+        find .  -type f -name '*.lds' -print0 | xargs -0 -r chmod u-w
+
+        # Keep root and arch-specific Makefiles
+        chmod u-w Makefile arch/"$arch"/Makefile*
+
+        # Keep whole scripts dir
+        chmod u-w -R scripts
+
+        # Delete everything not kept
+        find . -type f -perm -u=w -print0 | xargs -0 -r rm
+
+        # Delete empty directories
+        find -empty -type d -delete
+
+        # Remove reference to kmod
+        sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
+      '';
+
+      preFixup = ''
+        # Don't strip $dev/lib/modules/*/vmlinux
+        stripDebugList="$(cd $dev && echo lib/modules/*/build/*/)"
+      '';
+
+      requiredSystemFeatures = [ "big-parallel" ];
+
+      meta = {
+        description =
+          "The Linux kernel" +
+          (if kernelPatches == [] then "" else
+            " (with patches: "
+            + lib.concatStringsSep ", " (map (x: x.name) kernelPatches)
+            + ")");
+        license = lib.licenses.gpl2Only;
+        homepage = "https://www.kernel.org/";
+        maintainers = lib.teams.linux-kernel.members ++ [
+          maintainers.thoughtpolice
+        ];
+        platforms = platforms.linux;
+        timeout = 14400; # 4 hours
+      } // extraMeta;
+    };
 in
 
 assert lib.versionOlder version "5.8" -> libelf != null;
 assert lib.versionAtLeast version "5.8" -> elfutils != null;
 
-stdenv.mkDerivation ({
+stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPatches configfile) // {
   pname = "linux";
-  inherit version src;
+  inherit version;
+
+  enableParallelBuilding = true;
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal ]
-      ++ optional  (kernelConf.target == "uImage") buildPackages.ubootTools
+      ++ optional  (stdenv.hostPlatform.linux-kernel.target == "uImage") buildPackages.ubootTools
       ++ optional  (lib.versionOlder version "5.8") libelf
       ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
       ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
       ++ optional  (lib.versionAtLeast version "5.8")  elfutils
       ;
 
-  patches =
-    map (p: p.patch) kernelPatches
-    # Required for deterministic builds along with some postPatch magic.
-    ++ optional (lib.versionOlder version "5.19") ./randstruct-provide-seed.patch
-    ++ optional (lib.versionAtLeast version "5.19") ./randstruct-provide-seed-5.19.patch
-    # Linux 5.12 marked certain PowerPC-only symbols as GPL, which breaks
-    # OpenZFS; this was fixed in Linux 5.19 so we backport the fix
-    # https://github.com/openzfs/zfs/pull/13367
-    ++ optional (lib.versionAtLeast version "5.12" &&
-                 lib.versionOlder version "5.19" &&
-                 stdenv.hostPlatform.isPower)
-      (fetchpatch {
-        url = "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/patch/?id=d9e5c3e9e75162f845880535957b7fd0b4637d23";
-        hash = "sha256-bBOyJcP6jUvozFJU0SPTOf3cmnTQ6ZZ4PlHjiniHXLU=";
-      });
-
-  preUnpack = ''
-    # The same preUnpack is used to build the configfile,
-    # which does not have $dev.
-    if [ -n "$dev" ]; then
-        mkdir -p $dev/lib/modules/${modDirVersion}
-        cd $dev/lib/modules/${modDirVersion}
-    fi
-  '';
-
-  postUnpack = ''
-    mv -Tv "$sourceRoot" source 2>/dev/null || :
-    export sourceRoot=$PWD/source
-  '';
-
-  postPatch = ''
-    sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
-
-    # fixup for pre-5.4 kernels using the $(cd $foo && /bin/pwd) pattern
-    # FIXME: remove when no longer needed
-    substituteInPlace Makefile tools/scripts/Makefile.include --replace /bin/pwd pwd
-
-    # Don't include a (random) NT_GNU_BUILD_ID, to make the build more deterministic.
-    # This way kernels can be bit-by-bit reproducible depending on settings
-    # (e.g. MODULE_SIG and SECURITY_LOCKDOWN_LSM need to be disabled).
-    # See also https://kernelnewbies.org/BuildId
-    sed -i Makefile -e 's|--build-id=[^ ]*|--build-id=none|'
-
-    # Some linux-hardened patches now remove certain files in the scripts directory, so the file may not exist.
-    [[ -f scripts/ld-version.sh ]] && patchShebangs scripts/ld-version.sh
-
-    # Set randstruct seed to a deterministic but diversified value. Note:
-    # we could have instead patched gen-random-seed.sh to take input from
-    # the buildFlags, but that would require also patching the kernel's
-    # toplevel Makefile to add a variable export. This would be likely to
-    # cause future patch conflicts.
-    for file in scripts/gen-randstruct-seed.sh scripts/gcc-plugins/gen-random-seed.sh; do
-      if [ -f "$file" ]; then
-        substituteInPlace "$file" \
-          --replace NIXOS_RANDSTRUCT_SEED \
-          $(echo ${randstructSeed}${src} ${placeholder "configfile"} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
-        break
-      fi
-    done
-
-    patchShebangs scripts
-
-    # also patch arch-specific install scripts
-    for i in $(find arch -name install.sh); do
-        patchShebangs "$i"
-    done
-  '';
-
-  configurePhase = ''
-    runHook preConfigure
-
-    export buildRoot=$(mktemp -d)
-
-    echo "manual-config configurePhase buildRoot=$buildRoot pwd=$PWD"
-
-    if [ -f "$buildRoot/.config" ]; then
-      echo "Could not link $buildRoot/.config : file exists"
-      exit 1
-    fi
-    ln -sv ${configfile} $buildRoot/.config
-
-    # reads the existing .config file and prompts the user for options in
-    # the current kernel source that are not found in the file.
-    make $makeFlags "''${makeFlagsArray[@]}" oldconfig
-    runHook postConfigure
-
-    make $makeFlags "''${makeFlagsArray[@]}" prepare
-    actualModDirVersion="$(cat $buildRoot/include/config/kernel.release)"
-    if [ "$actualModDirVersion" != "${modDirVersion}" ]; then
-      echo "Error: modDirVersion ${modDirVersion} specified in the Nix expression is wrong, it should be: $actualModDirVersion"
-      exit 1
-    fi
-
-    buildFlagsArray+=("KBUILD_BUILD_TIMESTAMP=$(date -u -d @$SOURCE_DATE_EPOCH)")
-
-    cd $buildRoot
-  '';
-
   hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" "pie" ];
 
   # Absolute paths for compilers avoid any PATH-clobbering issues.
@@ -217,198 +403,8 @@ stdenv.mkDerivation ({
     "ARCH=${stdenv.hostPlatform.linuxArch}"
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
-  ] ++ (kernelConf.makeFlags or [])
+  ] ++ (stdenv.hostPlatform.linux-kernel.makeFlags or [])
     ++ extraMakeFlags;
 
   karch = stdenv.hostPlatform.linuxArch;
-
-  buildFlags = [
-    "DTC_FLAGS=-@"
-    "KBUILD_BUILD_VERSION=1-NixOS"
-
-    # Set by default in the kernel since a73619a845d5,
-    # replicated here to apply to older versions.
-    # Makes __FILE__ relative to the build directory.
-    "KCPPFLAGS=-fmacro-prefix-map=$(sourceRoot)/="
-  ] ++ extraMakeFlags;
-
-  installFlags = [
-    "INSTALL_PATH=$(out)"
-  ] ++ (optional isModular "INSTALL_MOD_PATH=$(out)")
-  ++ optionals buildDTBs ["dtbs_install" "INSTALL_DTBS_PATH=$(out)/dtbs"];
-
-  preInstall = let
-    # All we really need to do here is copy the final image and System.map to $out,
-    # and use the kernel's modules_install, firmware_install, dtbs_install, etc. targets
-    # for the rest. Easy, right?
-    #
-    # Unfortunately for us, the obvious way of getting the built image path,
-    # make -s image_name, does not work correctly, because some architectures
-    # (*cough* aarch64 *cough*) change KBUILD_IMAGE on the fly in their install targets,
-    # so we end up attempting to install the thing we didn't actually build.
-    #
-    # Thankfully, there's a way out that doesn't involve just hardcoding everything.
-    #
-    # The kernel has an install target, which runs a pretty simple shell script
-    # (located at scripts/install.sh or arch/$arch/boot/install.sh, depending on
-    # which kernel version you're looking at) that tries to do something sensible.
-    #
-    # (it would be great to hijack this script immediately, as it has all the
-    #   information we need passed to it and we don't need it to try and be smart,
-    #   but unfortunately, the exact location of the scripts differs between kernel
-    #   versions, and they're seemingly not considered to be public API at all)
-    #
-    # One of the ways it tries to discover what "something sensible" actually is
-    # is by delegating to what's supposed to be a user-provided install script
-    # located at ~/bin/installkernel.
-    #
-    # (the other options are:
-    #   - a distribution-specific script at /sbin/installkernel,
-    #        which we can't really create in the sandbox easily
-    #   - an architecture-specific script at arch/$arch/boot/install.sh,
-    #        which attempts to guess _something_ and usually guesses very wrong)
-    #
-    # More specifically, the install script exec's into ~/bin/installkernel, if one
-    # exists, with the following arguments:
-    #
-    # $1: $KERNELRELEASE - full kernel version string
-    # $2: $KBUILD_IMAGE - the final image path
-    # $3: System.map - path to System.map file, seemingly hardcoded everywhere
-    # $4: $INSTALL_PATH - path to the destination directory as specified in installFlags
-    #
-    # $2 is exactly what we want, so hijack the script and use the knowledge given to it
-    # by the makefile overlords for our own nefarious ends.
-    #
-    # Note that the makefiles specifically look in ~/bin/installkernel, and
-    # writeShellScriptBin writes the script to <store path>/bin/installkernel,
-    # so HOME needs to be set to just the store path.
-    #
-    # FIXME: figure out a less roundabout way of doing this.
-    installkernel = buildPackages.writeShellScriptBin "installkernel" ''
-      cp -av $2 $4
-      cp -av $3 $4
-    '';
-  in ''
-    installFlagsArray+=("-j$NIX_BUILD_CORES")
-    export HOME=${installkernel}
-  '';
-
-  # Some image types need special install targets (e.g. uImage is installed with make uinstall)
-  installTargets = [
-    (kernelConf.installTarget or (
-      /**/ if kernelConf.target == "uImage" then "uinstall"
-      else if kernelConf.target == "zImage" || kernelConf.target == "Image.gz" then "zinstall"
-      else "install"))
-  ];
-
-  postInstall = optionalString isModular ''
-    if [ -z "''${dontStrip-}" ]; then
-      installFlagsArray+=("INSTALL_MOD_STRIP=1")
-    fi
-    make modules_install $makeFlags "''${makeFlagsArray[@]}" \
-      $installFlags "''${installFlagsArray[@]}"
-    unlink $out/lib/modules/${modDirVersion}/build
-    unlink $out/lib/modules/${modDirVersion}/source
-
-    mkdir $dev/lib/modules/${modDirVersion}/build
-
-    cd $dev/lib/modules/${modDirVersion}/source
-
-    cp $buildRoot/{.config,Module.symvers} $dev/lib/modules/${modDirVersion}/build
-    make modules_prepare $makeFlags "''${makeFlagsArray[@]}" O=$dev/lib/modules/${modDirVersion}/build
-
-    # For reproducibility, removes accidental leftovers from a `cc1` call
-    # from a `try-run` call from the Makefile
-    rm -f $dev/lib/modules/${modDirVersion}/build/.[0-9]*.d
-
-    # Keep some extra files
-    for f in arch/powerpc/lib/crtsavres.o arch/arm64/kernel/ftrace-mod.o \
-             scripts/gdb/linux vmlinux vmlinux-gdb.py
-    do
-      if [ -e "$buildRoot/$f" ]; then
-        mkdir -p "$(dirname "$dev/lib/modules/${modDirVersion}/build/$f")"
-        cp -HR $buildRoot/$f $dev/lib/modules/${modDirVersion}/build/$f
-      fi
-    done
-    ln -s $dev/lib/modules/${modDirVersion}/build/vmlinux $dev
-
-    # !!! No documentation on how much of the source tree must be kept
-    # If/when kernel builds fail due to missing files, you can add
-    # them here. Note that we may see packages requiring headers
-    # from drivers/ in the future; it adds 50M to keep all of its
-    # headers on 3.10 though.
-
-    chmod u+w -R ..
-    arch=$(cd $dev/lib/modules/${modDirVersion}/build/arch; ls)
-
-    # Remove unused arches
-    for d in $(cd arch/; ls); do
-      if [ "$d" = "$arch" ]; then continue; fi
-      if [ "$arch" = arm64 ] && [ "$d" = arm ]; then continue; fi
-      rm -rf arch/$d
-    done
-
-    # Remove all driver-specific code (50M of which is headers)
-    rm -fR drivers
-
-    # Keep all headers
-    find .  -type f -name '*.h' -print0 | xargs -0 -r chmod u-w
-
-    # Keep linker scripts (they are required for out-of-tree modules on aarch64)
-    find .  -type f -name '*.lds' -print0 | xargs -0 -r chmod u-w
-
-    # Keep root and arch-specific Makefiles
-    chmod u-w Makefile arch/"$arch"/Makefile*
-
-    # Keep whole scripts dir
-    chmod u-w -R scripts
-
-    # Delete everything not kept
-    find . -type f -perm -u=w -print0 | xargs -0 -r rm
-
-    # Delete empty directories
-    find -empty -type d -delete
-
-    # Remove reference to kmod
-    sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
-  '';
-
-  preFixup = ''
-    # Don't strip $dev/lib/modules/*/vmlinux
-    stripDebugList="$(cd $dev && echo lib/modules/*/build/*/)"
-  '';
-
-  enableParallelBuilding = true;
-
-  passthru = rec {
-    inherit version modDirVersion config kernelPatches configfile
-      moduleBuildDependencies stdenv;
-    inherit isZen isHardened isLibre;
-    isXen = lib.warn "The isXen attribute is deprecated. All Nixpkgs kernels that support it now have Xen enabled." true;
-    baseVersion = lib.head (lib.splitString "-rc" version);
-    kernelOlder = lib.versionOlder baseVersion;
-    kernelAtLeast = lib.versionAtLeast baseVersion;
-  };
-
-  requiredSystemFeatures = [ "big-parallel" ];
-
-  meta = {
-    description =
-      "The Linux kernel" +
-      (if kernelPatches == [] then "" else
-        " (with patches: "
-        + lib.concatStringsSep ", " (map (x: x.name) kernelPatches)
-        + ")");
-    license = lib.licenses.gpl2Only;
-    homepage = "https://www.kernel.org/";
-    maintainers = lib.teams.linux-kernel.members ++ [
-      maintainers.thoughtpolice
-    ];
-    platforms = platforms.linux;
-    timeout = 14400; # 4 hours
-  } // extraMeta;
-} // optionalAttrs (pos != null) {
-  inherit pos;
-} // optionalAttrs isModular {
-  outputs = [ "out" "dev" ];
-}))
+} // (optionalAttrs (pos != null) { inherit pos; })))

From 3aff6553615124198331f845ce3f07ddd731c2c5 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:42:37 -0700
Subject: [PATCH 021/115] Revert "linuxManualConfig: install GDB scripts"

This reverts commit d57568fcad7e3a9364850cb1c25d7a34693c02d5.
---
 .../os-specific/linux/kernel/common-config.nix |  7 ++++---
 .../os-specific/linux/kernel/manual-config.nix | 18 +++++-------------
 2 files changed, 9 insertions(+), 16 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 688c13499b1a..a95a0ac2ede0 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -36,7 +36,10 @@ let
 
     debug = {
       # Necessary for BTF
-      DEBUG_INFO                = yes;
+      DEBUG_INFO                = mkMerge [
+        (whenOlder "5.2" (if (features.debug or false) then yes else no))
+        (whenBetween "5.2" "5.18" yes)
+      ];
       DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT = whenAtLeast "5.18" yes;
       # Reduced debug info conflict with BTF and have been enabled in
       # aarch64 defconfig since 5.13
@@ -59,8 +62,6 @@ let
       SUNRPC_DEBUG              = yes;
       # Provide access to tunables like sched_migration_cost_ns
       SCHED_DEBUG               = yes;
-
-      GDB_SCRIPTS               = yes;
     };
 
     power-management = {
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 46407eccf057..4005dda4374a 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -278,6 +278,7 @@ let
       ];
 
       postInstall = optionalString isModular ''
+        cp vmlinux $dev/
         if [ -z "''${dontStrip-}" ]; then
           installFlagsArray+=("INSTALL_MOD_STRIP=1")
         fi
@@ -297,16 +298,12 @@ let
         # from a `try-run` call from the Makefile
         rm -f $dev/lib/modules/${modDirVersion}/build/.[0-9]*.d
 
-        # Keep some extra files
-        for f in arch/powerpc/lib/crtsavres.o arch/arm64/kernel/ftrace-mod.o \
-                 scripts/gdb/linux vmlinux vmlinux-gdb.py
-        do
-          if [ -e "$buildRoot/$f" ]; then
-            mkdir -p "$(dirname "$dev/lib/modules/${modDirVersion}/build/$f")"
-            cp -HR $buildRoot/$f $dev/lib/modules/${modDirVersion}/build/$f
+        # Keep some extra files on some arches (powerpc, aarch64)
+        for f in arch/powerpc/lib/crtsavres.o arch/arm64/kernel/ftrace-mod.o; do
+          if [ -f "$buildRoot/$f" ]; then
+            cp $buildRoot/$f $dev/lib/modules/${modDirVersion}/build/$f
           fi
         done
-        ln -s $dev/lib/modules/${modDirVersion}/build/vmlinux $dev
 
         # !!! No documentation on how much of the source tree must be kept
         # If/when kernel builds fail due to missing files, you can add
@@ -349,11 +346,6 @@ let
         sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
       '';
 
-      preFixup = ''
-        # Don't strip $dev/lib/modules/*/vmlinux
-        stripDebugList="$(cd $dev && echo lib/modules/*/build/*/)"
-      '';
-
       requiredSystemFeatures = [ "big-parallel" ];
 
       meta = {

From 12a06dc2b8507b01c5ba96f94e8f4bf241df6a0d Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:42:43 -0700
Subject: [PATCH 022/115] Revert "linuxManualConfig: use the default make
 target"

This reverts commit 41f788b1217b05d8661ebb77bfc9d9f3f65b5dd2.
---
 pkgs/os-specific/linux/kernel/manual-config.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 4005dda4374a..d4eff7b7e453 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -199,14 +199,18 @@ let
       '';
 
       buildFlags = [
-        "DTC_FLAGS=-@"
         "KBUILD_BUILD_VERSION=1-NixOS"
 
         # Set by default in the kernel since a73619a845d5,
         # replicated here to apply to older versions.
         # Makes __FILE__ relative to the build directory.
         "KCPPFLAGS=-fmacro-prefix-map=$(sourceRoot)/="
-      ] ++ extraMakeFlags;
+
+        kernelConf.target
+        "vmlinux"  # for "perf" and things like that
+      ] ++ optional isModular "modules"
+        ++ optionals buildDTBs ["dtbs" "DTC_FLAGS=-@"]
+      ++ extraMakeFlags;
 
       installFlags = [
         "INSTALL_PATH=$(out)"

From 93021f12c3bb97448bb40d75c29401d49333b531 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:42:49 -0700
Subject: [PATCH 023/115] Revert "linuxManualConfig: unpack directly into $dev"

This reverts commit 7de3f08ce38aca9fddb5db7bcb7741fd389be9ef.
---
 .../linux/kernel/manual-config.nix            | 28 +++++--------------
 1 file changed, 7 insertions(+), 21 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index d4eff7b7e453..3480928aa5b9 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -116,20 +116,6 @@ let
             hash = "sha256-bBOyJcP6jUvozFJU0SPTOf3cmnTQ6ZZ4PlHjiniHXLU=";
           });
 
-      preUnpack = ''
-        # The same preUnpack is used to build the configfile,
-        # which does not have $dev.
-        if [ -n "$dev" ]; then
-            mkdir -p $dev/lib/modules/${modDirVersion}
-            cd $dev/lib/modules/${modDirVersion}
-        fi
-      '';
-
-      postUnpack = ''
-        mv -Tv "$sourceRoot" source 2>/dev/null || :
-        export sourceRoot=$PWD/source
-      '';
-
       postPatch = ''
         sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
 
@@ -200,12 +186,6 @@ let
 
       buildFlags = [
         "KBUILD_BUILD_VERSION=1-NixOS"
-
-        # Set by default in the kernel since a73619a845d5,
-        # replicated here to apply to older versions.
-        # Makes __FILE__ relative to the build directory.
-        "KCPPFLAGS=-fmacro-prefix-map=$(sourceRoot)/="
-
         kernelConf.target
         "vmlinux"  # for "perf" and things like that
       ] ++ optional isModular "modules"
@@ -282,6 +262,7 @@ let
       ];
 
       postInstall = optionalString isModular ''
+        mkdir -p $dev
         cp vmlinux $dev/
         if [ -z "''${dontStrip-}" ]; then
           installFlagsArray+=("INSTALL_MOD_STRIP=1")
@@ -291,7 +272,12 @@ let
         unlink $out/lib/modules/${modDirVersion}/build
         unlink $out/lib/modules/${modDirVersion}/source
 
-        mkdir $dev/lib/modules/${modDirVersion}/build
+        mkdir -p $dev/lib/modules/${modDirVersion}/{build,source}
+
+        # To save space, exclude a bunch of unneeded stuff when copying.
+        (cd "$NIX_BUILD_TOP" && cd "$sourceRoot" &&
+         rsync --archive --prune-empty-dirs \
+            * $dev/lib/modules/${modDirVersion}/source/)
 
         cd $dev/lib/modules/${modDirVersion}/source
 

From dbe0d20b573e7e4536169456cb55f691d5f678ec Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:42:53 -0700
Subject: [PATCH 024/115] Revert "linuxManualConfig: don't build inside source
 tree"

This reverts commit d75cff2ee3bb6d91c818d43d1ba7603bb6dacd59.
---
 pkgs/os-specific/linux/kernel/manual-config.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 3480928aa5b9..61013ef090af 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -157,7 +157,8 @@ let
       configurePhase = ''
         runHook preConfigure
 
-        export buildRoot=$(mktemp -d)
+        mkdir build
+        export buildRoot="$(pwd)/build"
 
         echo "manual-config configurePhase buildRoot=$buildRoot pwd=$PWD"
 
@@ -275,8 +276,8 @@ let
         mkdir -p $dev/lib/modules/${modDirVersion}/{build,source}
 
         # To save space, exclude a bunch of unneeded stuff when copying.
-        (cd "$NIX_BUILD_TOP" && cd "$sourceRoot" &&
-         rsync --archive --prune-empty-dirs \
+        (cd .. && rsync --archive --prune-empty-dirs \
+            --exclude='/build/' \
             * $dev/lib/modules/${modDirVersion}/source/)
 
         cd $dev/lib/modules/${modDirVersion}/source

From 43da9e8fff25822b6a5ba54e242ff94177b77f0f Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 29 Jul 2023 14:37:11 +0100
Subject: [PATCH 025/115] glibcLocales: disable parallelism to restore
 deterministic locales

The way `nixpkgs` runs parallel `localedef` instances shares
`--prefix=/build` flag. As a result `localedef` processes
non-deterministically extend the file with new locales (hopefully
without data corruption):

    https://github.com/NixOS/nixpkgs/issues/245360

Co-authored-by: Adam Joseph <54836058+amjoseph-nixpkgs@users.noreply.github.com>
---
 pkgs/development/libraries/glibc/locales.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/glibc/locales.nix b/pkgs/development/libraries/glibc/locales.nix
index 86d6d1438b2d..d2db9cd71b20 100644
--- a/pkgs/development/libraries/glibc/locales.nix
+++ b/pkgs/development/libraries/glibc/locales.nix
@@ -60,7 +60,11 @@
       echo SUPPORTED-LOCALES='${toString locales}' > ../glibc-2*/localedata/SUPPORTED
     '';
 
-  enableParallelBuilding = true;
+  # Current `nixpkgs` way of building locales is not compatible with
+  # parallel install. `locale-archive` is updated in parallel with
+  # multiple `localedef` processes and causes non-deterministic result:
+  #   https://github.com/NixOS/nixpkgs/issues/245360
+  enableParallelBuilding = false;
 
   makeFlags = (previousAttrs.makeFlags or []) ++ [
     "localedata/install-locales"

From 7adf0a4eeb0ac19b07ca17f27e20ca4cee12df3d Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 30 Jul 2023 09:43:09 +0100
Subject: [PATCH 026/115] setup-hooks/strip: resolve/uniq symlinks before
 stripping

Before the change the hook had a chance to run `strip` against the same
file using multiple link paths. In case of `gcc` `libgcc.a` was stripped
multiple times in parallel and produces corrupted archive.

The change runs inputs via `realpath | uniq` to make sure we don't
attempt to strip the same files multiple times.
---
 pkgs/build-support/setup-hooks/strip.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/build-support/setup-hooks/strip.sh b/pkgs/build-support/setup-hooks/strip.sh
index 1d65c10c5230..5f53e7e95b2e 100644
--- a/pkgs/build-support/setup-hooks/strip.sh
+++ b/pkgs/build-support/setup-hooks/strip.sh
@@ -68,6 +68,11 @@ stripDirs() {
         striperr="$(mktemp 'striperr.XXXXXX')"
         # Do not strip lib/debug. This is a directory used by setup-hooks/separate-debug-info.sh.
         find $paths -type f -a '!' -path "$prefix/lib/debug/*" -print0 |
+            # Make sure we process files under symlinks only once. Otherwise
+            # 'strip` can corrupt files when writes to them in parallel:
+            #   https://github.com/NixOS/nixpkgs/issues/246147#issuecomment-1657072039
+            xargs -r -0 -n1 -- realpath -z | sort -u -z |
+
             xargs -r -0 -n1 -P "$NIX_BUILD_CORES" -- $cmd $stripFlags 2>"$striperr" || exit_code=$?
         # xargs exits with status code 123 if some but not all of the
         # processes fail. We don't care if some of the files couldn't

From 2141d9879ad46ff7cb518e9bfd9b3a4312e8591a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 31 Jul 2023 11:20:15 +0200
Subject: [PATCH 027/115] Revert "stdenv: use improved strip.sh for
 aarch64-linux"

This reverts commit 39919b8f215110c1516f5c6b300f5ee69df23fd4.
The parent merge resolved this more properly.
---
 .../setup-hooks/strip-tmp-aarch64.sh          | 90 -------------------
 pkgs/stdenv/generic/default.nix               |  5 +-
 2 files changed, 1 insertion(+), 94 deletions(-)
 delete mode 100644 pkgs/build-support/setup-hooks/strip-tmp-aarch64.sh

diff --git a/pkgs/build-support/setup-hooks/strip-tmp-aarch64.sh b/pkgs/build-support/setup-hooks/strip-tmp-aarch64.sh
deleted file mode 100644
index 5f53e7e95b2e..000000000000
--- a/pkgs/build-support/setup-hooks/strip-tmp-aarch64.sh
+++ /dev/null
@@ -1,90 +0,0 @@
-# This setup hook strips libraries and executables in the fixup phase.
-
-fixupOutputHooks+=(_doStrip)
-
-_doStrip() {
-    # We don't bother to strip build platform code because it shouldn't make it
-    # to $out anyways---if it does, that's a bigger problem that a lack of
-    # stripping will help catch.
-    local -ra flags=(dontStripHost dontStripTarget)
-    local -ra debugDirs=(stripDebugList stripDebugListTarget)
-    local -ra allDirs=(stripAllList stripAllListTarget)
-    local -ra stripCmds=(STRIP STRIP_FOR_TARGET)
-    local -ra ranlibCmds=(RANLIB RANLIB_FOR_TARGET)
-
-    # TODO(structured-attrs): This doesn't work correctly if one of
-    #   the items in strip*List or strip*Flags contains a space,
-    #   even with structured attrs enabled.  This is OK for now
-    #   because very few packages set any of these, and it doesn't
-    #   affect any of them.
-    #
-    #   After __structuredAttrs = true is universal, come back and
-    #   push arrays all the way through this logic.
-
-    # Strip only host paths by default. Leave targets as is.
-    stripDebugList=${stripDebugList[*]:-lib lib32 lib64 libexec bin sbin}
-    stripDebugListTarget=${stripDebugListTarget[*]:-}
-    stripAllList=${stripAllList[*]:-}
-    stripAllListTarget=${stripAllListTarget[*]:-}
-
-    local i
-    for i in ${!stripCmds[@]}; do
-        local -n flag="${flags[$i]}"
-        local -n debugDirList="${debugDirs[$i]}"
-        local -n allDirList="${allDirs[$i]}"
-        local -n stripCmd="${stripCmds[$i]}"
-        local -n ranlibCmd="${ranlibCmds[$i]}"
-
-        # `dontStrip` disables them all
-        if [[ "${dontStrip-}" || "${flag-}" ]] || ! type -f "${stripCmd-}" 2>/dev/null 1>&2
-        then continue; fi
-
-        stripDirs "$stripCmd" "$ranlibCmd" "$debugDirList" "${stripDebugFlags[*]:--S -p}"
-        stripDirs "$stripCmd" "$ranlibCmd" "$allDirList" "${stripAllFlags[*]:--s -p}"
-    done
-}
-
-stripDirs() {
-    local cmd="$1"
-    local ranlibCmd="$2"
-    local paths="$3"
-    local stripFlags="$4"
-    local pathsNew=
-
-    [ -z "$cmd" ] && echo "stripDirs: Strip command is empty" 1>&2 && exit 1
-    [ -z "$ranlibCmd" ] && echo "stripDirs: Ranlib command is empty" 1>&2 && exit 1
-
-    local p
-    for p in ${paths}; do
-        if [ -e "$prefix/$p" ]; then
-            pathsNew="${pathsNew} $prefix/$p"
-        fi
-    done
-    paths=${pathsNew}
-
-    if [ -n "${paths}" ]; then
-        echo "stripping (with command $cmd and flags $stripFlags) in $paths"
-        local striperr
-        striperr="$(mktemp 'striperr.XXXXXX')"
-        # Do not strip lib/debug. This is a directory used by setup-hooks/separate-debug-info.sh.
-        find $paths -type f -a '!' -path "$prefix/lib/debug/*" -print0 |
-            # Make sure we process files under symlinks only once. Otherwise
-            # 'strip` can corrupt files when writes to them in parallel:
-            #   https://github.com/NixOS/nixpkgs/issues/246147#issuecomment-1657072039
-            xargs -r -0 -n1 -- realpath -z | sort -u -z |
-
-            xargs -r -0 -n1 -P "$NIX_BUILD_CORES" -- $cmd $stripFlags 2>"$striperr" || exit_code=$?
-        # xargs exits with status code 123 if some but not all of the
-        # processes fail. We don't care if some of the files couldn't
-        # be stripped, so ignore specifically this code.
-        [[ "$exit_code" = 123 || -z "$exit_code" ]] || (cat "$striperr" 1>&2 && exit 1)
-
-        rm "$striperr"
-        # 'strip' does not normally preserve archive index in .a files.
-        # This usually causes linking failures against static libs like:
-        #   ld: ...-i686-w64-mingw32-stage-final-gcc-13.0.0-lib/i686-w64-mingw32/lib/libstdc++.dll.a:
-        #     error adding symbols: archive has no index; run ranlib to add one
-        # Restore the index by running 'ranlib'.
-        find $paths -name '*.a' -type f -exec $ranlibCmd '{}' \; 2>/dev/null
-    fi
-}
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index 0d9ae8d3c4fb..cf194be92bd7 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -70,10 +70,7 @@ let
       ../../build-support/setup-hooks/prune-libtool-files.sh
       ../../build-support/setup-hooks/reproducible-builds.sh
       ../../build-support/setup-hooks/set-source-date-epoch-to-latest.sh
-      (with buildPlatform; if isAarch64 && isLinux
-        then ../../build-support/setup-hooks/strip-tmp-aarch64.sh
-        else ../../build-support/setup-hooks/strip.sh
-      )
+      ../../build-support/setup-hooks/strip.sh
     ] ++ lib.optionals hasCC [ cc ];
 
   defaultBuildInputs = extraBuildInputs;

From e66c968210752c7fe25033264b683c2ab820c223 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 31 Jul 2023 13:31:53 +0200
Subject: [PATCH 028/115] librsvg: use installShellCompletion, little cleanup

---
 .../development/libraries/librsvg/default.nix | 22 +++++++++----------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 6542fdfb14fe..bece97ac482d 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -4,6 +4,7 @@
 , pkg-config
 , glib
 , gdk-pixbuf
+, installShellFiles
 , pango
 , cairo
 , libxml2
@@ -59,6 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     gdk-pixbuf
+    installShellFiles
     pkg-config
     rustc
     cargo-auditable-cargo-wrapper
@@ -121,12 +123,10 @@ stdenv.mkDerivation (finalAttrs: {
   postConfigure = ''
     GDK_PIXBUF=$out/lib/gdk-pixbuf-2.0/2.10.0
     mkdir -p $GDK_PIXBUF/loaders
-    sed -e "s#gdk_pixbuf_moduledir = .*#gdk_pixbuf_moduledir = $GDK_PIXBUF/loaders#" \
-        -i gdk-pixbuf-loader/Makefile
-    sed -e "s#gdk_pixbuf_cache_file = .*#gdk_pixbuf_cache_file = $GDK_PIXBUF/loaders.cache#" \
-        -i gdk-pixbuf-loader/Makefile
-    sed -e "s#\$(GDK_PIXBUF_QUERYLOADERS)#GDK_PIXBUF_MODULEDIR=$GDK_PIXBUF/loaders \$(GDK_PIXBUF_QUERYLOADERS)#" \
-         -i gdk-pixbuf-loader/Makefile
+    sed -i gdk-pixbuf-loader/Makefile \
+      -e "s#gdk_pixbuf_moduledir = .*#gdk_pixbuf_moduledir = $GDK_PIXBUF/loaders#" \
+      -e "s#gdk_pixbuf_cache_file = .*#gdk_pixbuf_cache_file = $GDK_PIXBUF/loaders.cache#" \
+      -e "s#\$(GDK_PIXBUF_QUERYLOADERS)#GDK_PIXBUF_MODULEDIR=$GDK_PIXBUF/loaders \$(GDK_PIXBUF_QUERYLOADERS)#"
 
     # Fix thumbnailer path
     sed -e "s#@bindir@\(/gdk-pixbuf-thumbnailer\)#${gdk-pixbuf}/bin\1#g" \
@@ -147,12 +147,10 @@ stdenv.mkDerivation (finalAttrs: {
       cat ${lib.getLib gdk-pixbuf}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache $GDK_PIXBUF/loaders.cache > $GDK_PIXBUF/loaders.cache.tmp
       mv $GDK_PIXBUF/loaders.cache.tmp $GDK_PIXBUF/loaders.cache
 
-      mkdir -p "$out/share/bash-completion/completions/"
-      ${emulator} $out/bin/rsvg-convert --completion bash > "$out/share/bash-completion/completions/rsvg-convert"
-      mkdir -p "$out/share/zsh/site-functions/"
-      ${emulator} $out/bin/rsvg-convert --completion zsh > "$out/share/zsh/site-functions/_rsvg-convert"
-      mkdir -p "$out/share/fish/vendor_completions.d/"
-      ${emulator} $out/bin/rsvg-convert --completion fish > "$out/share/fish/vendor_completions.d/rsvg-convert.fish"
+      installShellCompletion --cmd rsvg-convert \
+        --bash <(${emulator} $out/bin/rsvg-convert --completion bash) \
+        --fish <(${emulator} $out/bin/rsvg-convert --completion fish) \
+        --zsh <(${emulator} $out/bin/rsvg-convert --completion zsh)
     '';
 
   postFixup = lib.optionalString withIntrospection ''

From bb89f903f4e5fc365dac2791a2f124e86d770875 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 31 Jul 2023 18:07:09 +0200
Subject: [PATCH 029/115] Revert "libhwy: apply the new patch conditionally"

This reverts commit 8fd0ff15837347ed488abdb8232ad0ae40c52971.
---
 pkgs/development/libraries/libhwy/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/libhwy/default.nix b/pkgs/development/libraries/libhwy/default.nix
index afbbf69966bd..4373f7474339 100644
--- a/pkgs/development/libraries/libhwy/default.nix
+++ b/pkgs/development/libraries/libhwy/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     rev = version;
     hash = "sha256-Gym2iHq5ws9kuG4HWSQndD8hVugV4USZt6dUFnEkLwY=";
   };
-  patches = lib.optionals (with stdenv; isAarch64 && isLinux) [ # conditional, temporarily
+  patches = [
     # backport for compilation issue on aarch64
     # https://github.com/google/highway/issues/1613
     (fetchpatch {

From f0f53431d187a3e10b3caae3f1439faab39e14e1 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Fri, 7 Jul 2023 07:15:41 -0600
Subject: [PATCH 030/115] djvulibre: fix build with clang 16

This fixes the build with clang 16, which defaults to C++17. In C++17,
the `register` storage class specifier was removed.
---
 .../misc/djvulibre/c++17-register-class.patch | 21 +++++++++++++++++++
 pkgs/applications/misc/djvulibre/default.nix  |  4 ++++
 2 files changed, 25 insertions(+)
 create mode 100644 pkgs/applications/misc/djvulibre/c++17-register-class.patch

diff --git a/pkgs/applications/misc/djvulibre/c++17-register-class.patch b/pkgs/applications/misc/djvulibre/c++17-register-class.patch
new file mode 100644
index 000000000000..88251b34f773
--- /dev/null
+++ b/pkgs/applications/misc/djvulibre/c++17-register-class.patch
@@ -0,0 +1,21 @@
+diff -ur a/libdjvu/GBitmap.h b/libdjvu/GBitmap.h
+--- a/libdjvu/GBitmap.h	2020-11-20 09:57:32.000000000 -0700
++++ b/libdjvu/GBitmap.h	2023-07-07 07:07:45.519912414 -0600
+@@ -620,7 +620,7 @@
+ inline int
+ GBitmap::read_run(unsigned char *&data)
+ {
+-  register int z=*data++;
++  int z=*data++;
+   return (z>=RUNOVERFLOWVALUE)?
+     ((z&~RUNOVERFLOWVALUE)<<8)|(*data++):z;
+ }
+@@ -628,7 +628,7 @@
+ inline int
+ GBitmap::read_run(const unsigned char *&data)
+ {
+-  register int z=*data++;
++  int z=*data++;
+   return (z>=RUNOVERFLOWVALUE)?
+     ((z&~RUNOVERFLOWVALUE)<<8)|(*data++):z;
+ }
diff --git a/pkgs/applications/misc/djvulibre/default.nix b/pkgs/applications/misc/djvulibre/default.nix
index ad85c9c79d1d..65591c8d8254 100644
--- a/pkgs/applications/misc/djvulibre/default.nix
+++ b/pkgs/applications/misc/djvulibre/default.nix
@@ -30,6 +30,10 @@ stdenv.mkDerivation rec {
     bash
   ];
 
+  # Remove uses of the `register` storage class specifier, which was removed in C++17.
+  # Fixes compilation with clang 16, which defaults to C++17.
+  patches = [ ./c++17-register-class.patch ];
+
   enableParallelBuilding = true;
 
   meta = with lib; {

From 6f2b3ba027f0d74614ba1b21f15ea45b0beb0385 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Mon, 24 Jul 2023 17:07:50 -0400
Subject: [PATCH 031/115] cc-wrapper: use a temporary file for reponse file

The Darwin stdenv rework conditionally sets `NIX_CC_USE_RESPONSE_FILE`
depending on the `ARG_MAX` of the build system. If it is at least 1 MiB,
the stdenv passes the arguments on the command-line (like Linux).
Otherwise, it falls back to the response file. This was done to prevent
intermitent failures with clang 16 being unable to read the response
file. Unfortunately, this breaks `gccStdenv` on older Darwin platforms.

Note: While the stdenv logic will also be reverted, this change is
needed for compatibility with clang 16.

GCC is capable of using a response file, but it does not work correctly
when the response file is a file descriptor. This can be reproduced
using the following sequence of commands:

    $ nix shell nixpkgs#gcc; NIX_CC_USE_RESPONSE_FILE=1 gcc
    # Linux
    /nix/store/9n9gjvzci75gp2sh1c4rh626dhizqynl-binutils-2.39/bin/ld: unrecognized option '-B/nix/store/vnwdak3n1w2jjil119j65k8mw1z23p84-glibc-2.35-224/lib/'
    /nix/store/9n9gjvzci75gp2sh1c4rh626dhizqynl-binutils-2.39/bin/ld: use the --help option for usage information
    collect2: error: ld returned 1 exit status
    # Darwin
    ld: unknown option: -mmacosx-version-min=11.0
    collect2: error: ld returned 1 exit status

Instead of using process substitution, create a temporary file and
remove it in a trap. This should also prevent the intermitent build
failures with clang 16 on older Darwin systems.

Fixes #245167
---
 pkgs/build-support/cc-wrapper/cc-wrapper.sh | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 5350fc3cc9ae..244a0bb6623b 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -246,10 +246,13 @@ if [[ -e @out@/nix-support/cc-wrapper-hook ]]; then
 fi
 
 if (( "${NIX_CC_USE_RESPONSE_FILE:-@use_response_file_by_default@}" >= 1 )); then
-    exec @prog@ @<(printf "%q\n" \
+    responseFile=$(mktemp --tmpdir cc-params.XXXXXX)
+    trap 'rm -f -- "$responseFile"' EXIT
+    printf "%q\n" \
        ${extraBefore+"${extraBefore[@]}"} \
        ${params+"${params[@]}"} \
-       ${extraAfter+"${extraAfter[@]}"})
+       ${extraAfter+"${extraAfter[@]}"} > "$responseFile"
+    @prog@ "@$responseFile"
 else
     exec @prog@ \
        ${extraBefore+"${extraBefore[@]}"} \

From 7110fa6dc4dd96bb5e593c5a5dd34dcee3bbf278 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Tue, 1 Aug 2023 13:00:48 +0200
Subject: [PATCH 032/115] openldap: 2.6.5 -> 2.6.6

---
 pkgs/development/libraries/openldap/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index eded5f1b5b96..483e4390a7cd 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "openldap";
-  version = "2.6.5";
+  version = "2.6.6";
 
   src = fetchurl {
     url = "https://www.openldap.org/software/download/OpenLDAP/openldap-release/${pname}-${version}.tgz";
-    hash = "sha256-Lieo1PTCr4/oQLVzJxwgqhY+JJh/l2UhRkQpD1vrONk=";
+    hash = "sha256-CC6ZjPVCmE1DY0RC2+EdqGB1nlEJBxUupXm9xC/jnqA=";
   };
 
   # TODO: separate "out" and "bin"

From 62b8af17d8bda579ef9e2c319533e136868dcc1c Mon Sep 17 00:00:00 2001
From: Samuel Tardieu <sam@rfc1149.net>
Date: Tue, 1 Aug 2023 10:45:31 +0200
Subject: [PATCH 033/115] autogen: apply more patches to avoid crashes

autogen is an old software and triggers many checks, notably in getdefs,
when used with _FORTIFY_SOURCE. Apply more correctness patches coming
from Suse through Debian.
---
 .../tools/misc/autogen/default.nix            | 26 +++++++++++++++----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/tools/misc/autogen/default.nix b/pkgs/development/tools/misc/autogen/default.nix
index 61df38f68ce9..e88d15a84335 100644
--- a/pkgs/development/tools/misc/autogen/default.nix
+++ b/pkgs/development/tools/misc/autogen/default.nix
@@ -10,24 +10,40 @@ stdenv.mkDerivation rec {
   };
 
   patches = let
-    dp = { ver ? "1%255.18.16-4", pname, name ? (pname + ".diff"), sha256 }: fetchurl {
+    dp = { ver ? "1%255.18.16-5", name, sha256 }: fetchurl {
       url = "https://salsa.debian.org/debian/autogen/-/raw/debian/${ver}"
-          + "/debian/patches/${pname}.diff?inline=false";
+          + "/debian/patches/${name}?inline=false";
       inherit name sha256;
     };
   in [
     (dp {
-      pname = "20_no_Werror";
+      name = "20_no_Werror.diff";
       sha256 = "08z4s2ifiqyaacjpd9pzr59w8m4j3548kkaq1bwvp2gjn29m680x";
     })
     (dp {
-      pname = "30_ag_macros.m4_syntax_error";
+      name = "30_ag_macros.m4_syntax_error.diff";
       sha256 = "1z8vmbwbkz3505wd33i2xx91mlf8rwsa7klndq37nw821skxwyh3";
     })
     (dp {
-      pname = "31_allow_overriding_AGexe_for_crossbuild";
+      name = "31_allow_overriding_AGexe_for_crossbuild.diff";
       sha256 = "0h9wkc9bqb509knh8mymi43hg6n6sxg2lixvjlchcx7z0j7p8xkf";
     })
+    (dp {
+      name = "40_suse_01-autogen-catch-race-error.patch";
+      sha256 = "1cfkym2zds1f85md1m74snxzqmzlj7wd5jivgmyl342856848xav";
+    })
+    (dp {
+      name = "40_suse_03-gcc9-fix-wrestrict.patch";
+      sha256 = "1ifdwi6gf96jc78jw7q4bfi5fgdldlf2nl55y20h6xb78kv0pznd";
+    })
+    (dp {
+      name = "40_suse_05-sprintf-overflow.patch";
+      sha256 = "136m62k68w1h5k7iapynvbyipidw35js6pq21lsc6rpxvgp0n469";
+    })
+    (dp {
+      name = "40_suse_06-autogen-avoid-GCC-code-analysis-bug.patch";
+      sha256 = "1d65zygzw2rpa00s0jy2y1bg29vkbhnjwlb5pv22rfv87zbk6z9q";
+    })
     # Next upstream release will contain guile-3 support. We apply non-invasive
     # patch meanwhile.
     (fetchpatch {

From b889dfdb3447f03ae1e2c8e6fa63dbeb85f3d258 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Tue, 1 Aug 2023 16:24:15 +0200
Subject: [PATCH 034/115] openssl: 3.0.9 -> 3.0.10

https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-309-and-openssl-3010-1-aug-2023
---
 .../libraries/openssl/3.0/CVE-2023-2975.patch | 54 -------------------
 .../development/libraries/openssl/default.nix |  7 +--
 2 files changed, 2 insertions(+), 59 deletions(-)
 delete mode 100644 pkgs/development/libraries/openssl/3.0/CVE-2023-2975.patch

diff --git a/pkgs/development/libraries/openssl/3.0/CVE-2023-2975.patch b/pkgs/development/libraries/openssl/3.0/CVE-2023-2975.patch
deleted file mode 100644
index d1622977b64d..000000000000
--- a/pkgs/development/libraries/openssl/3.0/CVE-2023-2975.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc Mon Sep 17 00:00:00 2001
-From: Tomas Mraz <tomas@openssl.org>
-Date: Tue, 4 Jul 2023 17:30:35 +0200
-Subject: [PATCH] Do not ignore empty associated data with AES-SIV mode
-
-The AES-SIV mode allows for multiple associated data items
-authenticated separately with any of these being 0 length.
-
-The provided implementation ignores such empty associated data
-which is incorrect in regards to the RFC 5297 and is also
-a security issue because such empty associated data then become
-unauthenticated if an application expects to authenticate them.
-
-Fixes CVE-2023-2975
-
-Reviewed-by: Matt Caswell <matt@openssl.org>
-Reviewed-by: Paul Dale <pauli@openssl.org>
-(Merged from https://github.com/openssl/openssl/pull/21384)
-
-(cherry picked from commit c426c281cfc23ab182f7d7d7a35229e7db1494d9)
----
- .../implementations/ciphers/cipher_aes_siv.c   | 18 +++++++++++-------
- 1 file changed, 11 insertions(+), 7 deletions(-)
-
-diff --git a/providers/implementations/ciphers/cipher_aes_siv.c b/providers/implementations/ciphers/cipher_aes_siv.c
-index 45010b90db2a..b396c8651a32 100644
---- a/providers/implementations/ciphers/cipher_aes_siv.c
-+++ b/providers/implementations/ciphers/cipher_aes_siv.c
-@@ -120,14 +120,18 @@ static int siv_cipher(void *vctx, unsigned char *out, size_t *outl,
-     if (!ossl_prov_is_running())
-         return 0;
- 
--    if (inl == 0) {
--        *outl = 0;
--        return 1;
--    }
-+    /* Ignore just empty encryption/decryption call and not AAD. */
-+    if (out != NULL) {
-+        if (inl == 0) {
-+            if (outl != NULL)
-+                *outl = 0;
-+            return 1;
-+        }
- 
--    if (outsize < inl) {
--        ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
--        return 0;
-+        if (outsize < inl) {
-+            ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
-+            return 0;
-+        }
-     }
- 
-     if (ctx->hw->cipher(ctx, out, in, inl) <= 0)
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index df741fd26aa9..c9f7b46a6cad 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -254,8 +254,8 @@ in {
   };
 
   openssl_3 = common {
-    version = "3.0.9";
-    sha256 = "sha256-6xqwR4FHQ2D3fDGKuJ2MWgOrw45j1lpgPKu/GwCh3JA=";
+    version = "3.0.10";
+    sha256 = "sha256-F2HU9bE6ECi5tvPUuOF/6wztyTcPav5h1xk9LNzoMyM=";
     patches = [
       ./3.0/nix-ssl-cert-file.patch
 
@@ -263,9 +263,6 @@ in {
       # This patch disables build-time detection.
       ./3.0/openssl-disable-kernel-detection.patch
 
-      # https://www.openssl.org/news/secadv/20230714.txt
-      ./3.0/CVE-2023-2975.patch
-
       (if stdenv.hostPlatform.isDarwin
        then ./use-etc-ssl-certs-darwin.patch
        else ./use-etc-ssl-certs.patch)

From 9a424242d7db53b835e34dee4b8e8c20ec0bd3e5 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 17 Jun 2023 00:58:21 +1000
Subject: [PATCH 035/115] go_1_21: init at 1.21rc3

---
 pkgs/development/compilers/go/1.21.nix        | 182 ++++++++++++++++++
 .../go/go_no_vendor_checks-1.21.patch         |  23 +++
 pkgs/top-level/all-packages.nix               |  11 ++
 3 files changed, 216 insertions(+)
 create mode 100644 pkgs/development/compilers/go/1.21.nix
 create mode 100644 pkgs/development/compilers/go/go_no_vendor_checks-1.21.patch

diff --git a/pkgs/development/compilers/go/1.21.nix b/pkgs/development/compilers/go/1.21.nix
new file mode 100644
index 000000000000..faf9920f719d
--- /dev/null
+++ b/pkgs/development/compilers/go/1.21.nix
@@ -0,0 +1,182 @@
+{ lib
+, stdenv
+, fetchurl
+, tzdata
+, substituteAll
+, iana-etc
+, Security
+, Foundation
+, xcbuild
+, mailcap
+, buildPackages
+, pkgsBuildTarget
+, threadsCross
+, testers
+, skopeo
+, buildGo121Module
+}:
+
+let
+  useGccGoBootstrap = stdenv.buildPlatform.isMusl || stdenv.buildPlatform.isRiscV;
+  goBootstrap = if useGccGoBootstrap then buildPackages.gccgo12 else buildPackages.callPackage ./bootstrap117.nix { };
+
+  skopeoTest = skopeo.override { buildGoModule = buildGo121Module; };
+
+  goarch = platform: {
+    "aarch64" = "arm64";
+    "arm" = "arm";
+    "armv5tel" = "arm";
+    "armv6l" = "arm";
+    "armv7l" = "arm";
+    "i686" = "386";
+    "mips" = "mips";
+    "mips64el" = "mips64le";
+    "mipsel" = "mipsle";
+    "powerpc64le" = "ppc64le";
+    "riscv64" = "riscv64";
+    "s390x" = "s390x";
+    "x86_64" = "amd64";
+  }.${platform.parsed.cpu.name} or (throw "Unsupported system: ${platform.parsed.cpu.name}");
+
+  # We need a target compiler which is still runnable at build time,
+  # to handle the cross-building case where build != host == target
+  targetCC = pkgsBuildTarget.targetPackages.stdenv.cc;
+
+  isCross = stdenv.buildPlatform != stdenv.targetPlatform;
+in
+stdenv.mkDerivation rec {
+  pname = "go";
+  version = "1.21rc3";
+
+  src = fetchurl {
+    url = "https://go.dev/dl/go${version}.src.tar.gz";
+    hash = "sha256-nelqLxUZapxpy5qxIsnCquzKMOyUSMqnFUPq6xnKkas=";
+  };
+
+  strictDeps = true;
+  buildInputs = [ ]
+    ++ lib.optionals stdenv.isLinux [ stdenv.cc.libc.out ]
+    ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
+
+  depsTargetTargetPropagated = lib.optionals stdenv.targetPlatform.isDarwin [ Foundation Security xcbuild ];
+
+  depsBuildTarget = lib.optional isCross targetCC;
+
+  depsTargetTarget = lib.optional stdenv.targetPlatform.isWindows threadsCross.package;
+
+  postPatch = ''
+    patchShebangs .
+  '';
+
+  patches = [
+    (substituteAll {
+      src = ./iana-etc-1.17.patch;
+      iana = iana-etc;
+    })
+    # Patch the mimetype database location which is missing on NixOS.
+    # but also allow static binaries built with NixOS to run outside nix
+    (substituteAll {
+      src = ./mailcap-1.17.patch;
+      inherit mailcap;
+    })
+    # prepend the nix path to the zoneinfo files but also leave the original value for static binaries
+    # that run outside a nix server
+    (substituteAll {
+      src = ./tzdata-1.19.patch;
+      inherit tzdata;
+    })
+    ./remove-tools-1.11.patch
+    ./go_no_vendor_checks-1.21.patch
+  ];
+
+  GOOS = stdenv.targetPlatform.parsed.kernel.name;
+  GOARCH = goarch stdenv.targetPlatform;
+  # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
+  # Go will nevertheless build a for host system that we will copy over in
+  # the install phase.
+  GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
+  GOHOSTARCH = goarch stdenv.buildPlatform;
+
+  # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
+  # to be different from CC/CXX
+  CC_FOR_TARGET =
+    if isCross then
+      "${targetCC}/bin/${targetCC.targetPrefix}cc"
+    else
+      null;
+  CXX_FOR_TARGET =
+    if isCross then
+      "${targetCC}/bin/${targetCC.targetPrefix}c++"
+    else
+      null;
+
+  GOARM = toString (lib.intersectLists [ (stdenv.hostPlatform.parsed.cpu.version or "") ] [ "5" "6" "7" ]);
+  GO386 = "softfloat"; # from Arch: don't assume sse2 on i686
+  CGO_ENABLED = 1;
+
+  GOROOT_BOOTSTRAP = if useGccGoBootstrap then goBootstrap else "${goBootstrap}/share/go";
+
+  buildPhase = ''
+    runHook preBuild
+    export GOCACHE=$TMPDIR/go-cache
+    # this is compiled into the binary
+    export GOROOT_FINAL=$out/share/go
+
+    export PATH=$(pwd)/bin:$PATH
+
+    ${lib.optionalString isCross ''
+    # Independent from host/target, CC should produce code for the building system.
+    # We only set it when cross-compiling.
+    export CC=${buildPackages.stdenv.cc}/bin/cc
+    ''}
+    ulimit -a
+
+    pushd src
+    ./make.bash
+    popd
+    runHook postBuild
+  '';
+
+  preInstall = ''
+    # Contains the wrong perl shebang when cross compiling,
+    # since it is not used for anything we can deleted as well.
+    rm src/regexp/syntax/make_perl_groups.pl
+  '' + (if (stdenv.buildPlatform.system != stdenv.hostPlatform.system) then ''
+    mv bin/*_*/* bin
+    rmdir bin/*_*
+    ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
+      rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
+    ''}
+  '' else lib.optionalString (stdenv.hostPlatform.system != stdenv.targetPlatform.system) ''
+    rm -rf bin/*_*
+    ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
+      rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
+    ''}
+  '');
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $GOROOT_FINAL
+    cp -a bin pkg src lib misc api doc $GOROOT_FINAL
+    ln -s $GOROOT_FINAL/bin $out/bin
+    runHook postInstall
+  '';
+
+  disallowedReferences = [ goBootstrap ];
+
+  passthru = {
+    inherit goBootstrap skopeoTest;
+    tests = {
+      skopeo = testers.testVersion { package = skopeoTest; };
+    };
+  };
+
+  meta = with lib; {
+    changelog = "https://go.dev/doc/devel/release#go${lib.versions.majorMinor version}";
+    description = "The Go Programming language";
+    homepage = "https://go.dev/";
+    license = licenses.bsd3;
+    maintainers = teams.golang.members;
+    platforms = platforms.darwin ++ platforms.linux;
+  };
+}
diff --git a/pkgs/development/compilers/go/go_no_vendor_checks-1.21.patch b/pkgs/development/compilers/go/go_no_vendor_checks-1.21.patch
new file mode 100644
index 000000000000..1adbf46398c5
--- /dev/null
+++ b/pkgs/development/compilers/go/go_no_vendor_checks-1.21.patch
@@ -0,0 +1,23 @@
+Starting from go1.14, go verifes that vendor/modules.txt matches the requirements
+and replacements listed in the main module go.mod file, and it is a hard failure if
+vendor/modules.txt is missing.
+
+Relax module consistency checks and switch back to pre go1.14 behaviour if
+vendor/modules.txt is missing regardless of go version requirement in go.mod.
+
+This has been ported from FreeBSD: https://reviews.freebsd.org/D24122
+See https://github.com/golang/go/issues/37948 for discussion.
+
+diff --git a/src/cmd/go/internal/modload/vendor.go b/src/cmd/go/internal/modload/vendor.go
+index ffc79bb93f..2d0311975d 100644
+--- a/src/cmd/go/internal/modload/vendor.go
++++ b/src/cmd/go/internal/modload/vendor.go
+@@ -144,7 +144,7 @@ func checkVendorConsistency(index *modFileIndex, modFile *modfile.File) {
+ 	readVendorList(MainModules.mustGetSingleMainModule())
+
+ 	pre114 := false
+-	if gover.Compare(index.goVersion, "1.14") < 0 {
++	if gover.Compare(index.goVersion, "1.14") < 0 || (os.Getenv("GO_NO_VENDOR_CHECKS") == "1" && len(vendorMeta) == 0) {
+ 		// Go versions before 1.14 did not include enough information in
+ 		// vendor/modules.txt to check for consistency.
+ 		// If we know that we're on an earlier version, relax the consistency check.
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2018475b58c8..fd4e7c3daf59 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -25584,6 +25584,17 @@ with pkgs;
     go = buildPackages.go_1_20;
   };
 
+  # requires a newer Apple SDK
+  go_1_21 = darwin.apple_sdk_11_0.callPackage ../development/compilers/go/1.21.nix {
+    inherit (darwin.apple_sdk_11_0.frameworks) Foundation Security;
+  };
+  buildGo121Module = darwin.apple_sdk_11_0.callPackage ../build-support/go/module.nix {
+    go = buildPackages.go_1_21;
+  };
+  buildGo121Package = darwin.apple_sdk_11_0.callPackage ../build-support/go/package.nix {
+    go = buildPackages.go_1_21;
+  };
+
   go2nix = callPackage ../development/tools/go2nix { };
 
   leaps = callPackage ../development/tools/leaps { };

From 41ccfa322e0f2e6719f805c73384f9ae4f542107 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sun, 2 Jul 2023 11:25:47 +1000
Subject: [PATCH 036/115] buildGoModule: refactor GO111MODULE

---
 pkgs/build-support/go/module.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index 6c2284a7a98d..b27a22d6702b 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -52,6 +52,8 @@ assert (args' ? vendorHash && args' ? vendorSha256) -> throw "both `vendorHash`
 let
   args = removeAttrs args' [ "overrideModAttrs" "vendorSha256" "vendorHash" ];
 
+  GO111MODULE = "on";
+
   goModules = if (vendorHash == null) then "" else
   (stdenv.mkDerivation {
     name = "${name}-go-modules";
@@ -60,6 +62,7 @@ let
 
     inherit (args) src;
     inherit (go) GOOS GOARCH;
+    inherit GO111MODULE;
 
     # The following inheritence behavior is not trivial to expect, and some may
     # argue it's not ideal. Changing it may break vendor hashes in Nixpkgs and
@@ -73,8 +76,6 @@ let
     postBuild = args.modPostBuild or "";
     sourceRoot = args.sourceRoot or "";
 
-    GO111MODULE = "on";
-
     impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
       "GIT_PROXY_COMMAND"
       "SOCKS_SERVER"
@@ -149,9 +150,8 @@ let
 
     inherit (go) GOOS GOARCH;
 
-    GO111MODULE = "on";
     GOFLAGS = lib.optionals (!proxyVendor) [ "-mod=vendor" ] ++ lib.optionals (!allowGoReference) [ "-trimpath" ];
-    inherit CGO_ENABLED enableParallelBuilding;
+    inherit CGO_ENABLED enableParallelBuilding GO111MODULE;
 
     configurePhase = args.configurePhase or (''
       runHook preConfigure

From 86cd7e0948fd14e1a0dc3356132d666c60fc2bbd Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sun, 2 Jul 2023 11:26:43 +1000
Subject: [PATCH 037/115] buildGo{Module,Package}: set GOTOOLCHAIN to local

prevent go from downloading another toolchain
---
 pkgs/build-support/go/module.nix  | 5 +++--
 pkgs/build-support/go/package.nix | 1 +
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index b27a22d6702b..09b43063fb96 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -53,6 +53,7 @@ let
   args = removeAttrs args' [ "overrideModAttrs" "vendorSha256" "vendorHash" ];
 
   GO111MODULE = "on";
+  GOTOOLCHAIN = "local";
 
   goModules = if (vendorHash == null) then "" else
   (stdenv.mkDerivation {
@@ -62,7 +63,7 @@ let
 
     inherit (args) src;
     inherit (go) GOOS GOARCH;
-    inherit GO111MODULE;
+    inherit GO111MODULE GOTOOLCHAIN;
 
     # The following inheritence behavior is not trivial to expect, and some may
     # argue it's not ideal. Changing it may break vendor hashes in Nixpkgs and
@@ -151,7 +152,7 @@ let
     inherit (go) GOOS GOARCH;
 
     GOFLAGS = lib.optionals (!proxyVendor) [ "-mod=vendor" ] ++ lib.optionals (!allowGoReference) [ "-trimpath" ];
-    inherit CGO_ENABLED enableParallelBuilding GO111MODULE;
+    inherit CGO_ENABLED enableParallelBuilding GO111MODULE GOTOOLCHAIN;
 
     configurePhase = args.configurePhase or (''
       runHook preConfigure
diff --git a/pkgs/build-support/go/package.nix b/pkgs/build-support/go/package.nix
index b4cb264d9f24..7e099b76f0b7 100644
--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@@ -86,6 +86,7 @@ let
     inherit CGO_ENABLED enableParallelBuilding;
 
     GO111MODULE = "off";
+    GOTOOLCHAIN = "local";
     GOFLAGS = lib.optionals (!allowGoReference) [ "-trimpath" ];
 
     GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);

From 3392d56b728983d5437cf50b0872515c24b87a05 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sun, 2 Jul 2023 11:30:48 +1000
Subject: [PATCH 038/115] buildGoModule: set GOPROXY to go default

---
 pkgs/build-support/go/module.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index 09b43063fb96..586af56bd98f 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -87,6 +87,9 @@ let
       runHook preConfigure
       export GOCACHE=$TMPDIR/go-cache
       export GOPATH="$TMPDIR/go"
+      # fixes 'GOPROXY list is not the empty string, but contains no entries'
+      # "https://proxy.golang.org,direct" is the go default
+      export GOPROXY="''${GOPROXY:-"https://proxy.golang.org,direct"}" # respect impureEnvVars
       cd "${modRoot}"
       runHook postConfigure
     '';

From 8e912feb2939866ef68d57fc00bab73b5f84f7c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Simon=20=C5=BDlender?= <pub.git@zlender.si>
Date: Sat, 8 Jul 2023 11:44:20 +0200
Subject: [PATCH 039/115] codesign_allocate: reference cctools

---
 pkgs/build-support/writers/scripts.nix             |  7 +------
 .../darwin/signing-utils/post-link-sign-hook.nix   | 13 +++++++++++++
 pkgs/stdenv/darwin/default.nix                     |  4 ++++
 pkgs/top-level/darwin-packages.nix                 | 14 ++------------
 4 files changed, 20 insertions(+), 18 deletions(-)
 create mode 100644 pkgs/os-specific/darwin/signing-utils/post-link-sign-hook.nix

diff --git a/pkgs/build-support/writers/scripts.nix b/pkgs/build-support/writers/scripts.nix
index 7fc47fbcdf94..a5b24abf0f2f 100644
--- a/pkgs/build-support/writers/scripts.nix
+++ b/pkgs/build-support/writers/scripts.nix
@@ -79,16 +79,11 @@ rec {
     let
       name = last (builtins.split "/" nameOrPath);
     in
-    pkgs.runCommand name ((if (types.str.check content) then {
+    pkgs.runCommand name (if (types.str.check content) then {
       inherit content;
       passAsFile = [ "content" ];
     } else {
       contentPath = content;
-    }) // lib.optionalAttrs (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) {
-      # post-link-hook expects codesign_allocate to be in PATH
-      # https://github.com/NixOS/nixpkgs/issues/154203
-      # https://github.com/NixOS/nixpkgs/issues/148189
-      nativeBuildInputs = [ stdenv.cc.bintools ];
     }) ''
       ${compileScript}
       ${lib.optionalString strip
diff --git a/pkgs/os-specific/darwin/signing-utils/post-link-sign-hook.nix b/pkgs/os-specific/darwin/signing-utils/post-link-sign-hook.nix
new file mode 100644
index 000000000000..13595e3771a7
--- /dev/null
+++ b/pkgs/os-specific/darwin/signing-utils/post-link-sign-hook.nix
@@ -0,0 +1,13 @@
+{ writeTextFile, cctools, sigtool }:
+
+writeTextFile {
+  name = "post-link-sign-hook";
+  executable = true;
+
+  text = ''
+    if [ "$linkerOutput" != "/dev/null" ]; then
+      CODESIGN_ALLOCATE=${cctools}/bin/${cctools.targetPrefix}codesign_allocate \
+        ${sigtool}/bin/codesign -f -s - "$linkerOutput"
+    fi
+  '';
+}
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 418cc915fdc5..25a80fd11aa2 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -464,6 +464,10 @@ in
           inherit (selfDarwin) sigtool;
         };
 
+        postLinkSignHook = prevStage.darwin.postLinkSignHook.override {
+          inherit (selfDarwin) sigtool;
+        };
+
         binutils = superDarwin.binutils.override {
           inherit (self) coreutils;
           inherit (selfDarwin) postLinkSignHook signingUtils;
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index ef4240955b9c..ee962d366711 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -133,20 +133,10 @@ impure-cmds // appleSourcePackages // chooseLibs // {
 
   sigtool = callPackage ../os-specific/darwin/sigtool { };
 
-  postLinkSignHook = pkgs.writeTextFile {
-    name = "post-link-sign-hook";
-    executable = true;
-
-    text = ''
-      if [ "$linkerOutput" != "/dev/null" ]; then
-        CODESIGN_ALLOCATE=${targetPrefix}codesign_allocate \
-          ${self.sigtool}/bin/codesign -f -s - "$linkerOutput"
-      fi
-    '';
-  };
-
   signingUtils = callPackage ../os-specific/darwin/signing-utils { };
 
+  postLinkSignHook = callPackage ../os-specific/darwin/signing-utils/post-link-sign-hook.nix { };
+
   autoSignDarwinBinariesHook = pkgs.makeSetupHook {
     name = "auto-sign-darwin-binaries-hook";
     propagatedBuildInputs = [ self.signingUtils ];

From 4b428f7689e27048b9a13df22a0c7fd7975cfb8e Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Wed, 2 Aug 2023 09:17:37 +1000
Subject: [PATCH 040/115] go_1_20: 1.20.6 -> 1.20.7

Changelog: https://go.dev/doc/devel/release#go1.20
---
 pkgs/development/compilers/go/1.20.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.20.nix b/pkgs/development/compilers/go/1.20.nix
index 18fa8db98792..bd226f32157a 100644
--- a/pkgs/development/compilers/go/1.20.nix
+++ b/pkgs/development/compilers/go/1.20.nix
@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.20.6";
+  version = "1.20.7";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    hash = "sha256-Yu5bxvtVuLro9wXgy434bWRTYmtOz5MnnihnCS4Lf3A=";
+    hash = "sha256-LF7pyeweczsNu8K9/tP2IwblHYFyvzj09OVCsnUg9Zc=";
   };
 
   strictDeps = true;

From c407e3cbbaaba05db64c8e1ec929c75cfa4eba50 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Tue, 11 Jul 2023 10:33:43 -0600
Subject: [PATCH 041/115] zip: fix build with clang 16

Fix implicit declarations of `memset` and `open/closedir` resulting in
incorrect feature detection and conflicts with libc headers.
---
 pkgs/tools/archivers/zip/default.nix          | 11 ++++++++--
 .../zip/fix-implicit-declarations.patch       | 21 +++++++++++++++++++
 .../archivers/zip/fix-memset-detection.patch  | 15 +++++++++++++
 3 files changed, 45 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/tools/archivers/zip/fix-implicit-declarations.patch
 create mode 100644 pkgs/tools/archivers/zip/fix-memset-detection.patch

diff --git a/pkgs/tools/archivers/zip/default.nix b/pkgs/tools/archivers/zip/default.nix
index 82329537251e..75a7c81f3276 100644
--- a/pkgs/tools/archivers/zip/default.nix
+++ b/pkgs/tools/archivers/zip/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     ];
     sha256 = "0sb3h3067pzf3a7mlxn1hikpcjrsvycjcnj9hl9b1c3ykcgvps7h";
   };
-  patchPhase = ''
+  prePatch = ''
     substituteInPlace unix/Makefile --replace 'CC = cc' ""
   '';
 
@@ -26,7 +26,14 @@ stdenv.mkDerivation rec {
     "INSTALL=cp"
   ];
 
-  patches = lib.optionals (enableNLS && !stdenv.isCygwin) [ ./natspec-gentoo.patch.bz2 ];
+  patches = [
+    # Trying to use `memset` without declaring it is flagged as an error with clang 16, causing
+    # the `configure` script to incorrectly define `ZMEM`. That causes the build to fail due to
+    # incompatible redeclarations of `memset`, `memcpy`, and `memcmp` in `zip.h`.
+    ./fix-memset-detection.patch
+    # Implicit declaration of `closedir` and `opendir` cause dirent detection to fail with clang 16.
+    ./fix-implicit-declarations.patch
+  ] ++ lib.optionals (enableNLS && !stdenv.isCygwin) [ ./natspec-gentoo.patch.bz2 ];
 
   buildInputs = lib.optional enableNLS libnatspec
     ++ lib.optional stdenv.isCygwin libiconv;
diff --git a/pkgs/tools/archivers/zip/fix-implicit-declarations.patch b/pkgs/tools/archivers/zip/fix-implicit-declarations.patch
new file mode 100644
index 000000000000..df19bf1722f9
--- /dev/null
+++ b/pkgs/tools/archivers/zip/fix-implicit-declarations.patch
@@ -0,0 +1,21 @@
+--- a/unix/configure	2009-04-16 15:25:12.000000000 -0400
++++ b/unix/configure	2023-05-30 15:18:33.670321348 -0400
+@@ -408,7 +408,7 @@
+ echo Check for errno declaration
+ cat > conftest.c << _EOF_
+ #include <errno.h>
+-main()
++int main()
+ {
+   errno = 0;
+   return 0;
+@@ -419,6 +419,8 @@
+ 
+ echo Check for directory libraries
+ cat > conftest.c << _EOF_
++#include <sys/types.h>
++#include <dirent.h>
+ int main() { return closedir(opendir(".")); }
+ _EOF_
+ 
+
diff --git a/pkgs/tools/archivers/zip/fix-memset-detection.patch b/pkgs/tools/archivers/zip/fix-memset-detection.patch
new file mode 100644
index 000000000000..55bda33a2573
--- /dev/null
+++ b/pkgs/tools/archivers/zip/fix-memset-detection.patch
@@ -0,0 +1,15 @@
+diff -ur a/unix/configure b/unix/configure
+--- a/unix/configure	2008-06-19 21:32:20.000000000 -0600
++++ b/unix/configure	2023-07-11 10:02:57.809867694 -0600
+@@ -519,7 +519,10 @@
+ 
+ 
+ echo Check for memset
+-echo "int main(){ char k; memset(&k,0,0); return 0; }" > conftest.c
++cat > conftest.c << _EOF_
++#include <string.h>
++int main(){ char k; memset(&k,0,0); return 0; }
++_EOF_
+ $CC -o conftest conftest.c >/dev/null 2>/dev/null
+ [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DZMEM"
+ 

From 644f2a109a31eb0d745b41f96aa08987e1bde9ad Mon Sep 17 00:00:00 2001
From: Henri Rosten <henri.rosten@unikie.com>
Date: Wed, 2 Aug 2023 13:49:28 +0300
Subject: [PATCH 042/115] librsvg: 2.56.2 -> 2.56.3

Signed-off-by: Henri Rosten <henri.rosten@unikie.com>
---
 pkgs/development/libraries/librsvg/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 6542fdfb14fe..6419f5a59578 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -32,7 +32,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "librsvg";
-  version = "2.56.2";
+  version = "2.56.3";
 
   outputs = [ "out" "dev" ] ++ lib.optionals withIntrospection [
     "devdoc"
@@ -40,13 +40,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/librsvg/${lib.versions.majorMinor finalAttrs.version}/librsvg-${finalAttrs.version}.tar.xz";
-    sha256 = "PsPE2Pc+C6S5EwAmlp6DccCStzQpjTbi/bPrSvzsEgA=";
+    hash = "sha256-WjKASKAtAUZFzSf2EUD04LESgPssfyohhk/gxZrBzog=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit (finalAttrs) src;
     name = "librsvg-deps-${finalAttrs.version}";
-    hash = "sha256-GIEpZ5YMvmYQLcaLXseXQ6gIF7ICtUKq28JCVJ3PEYk=";
+    hash = "sha256-s7eNMSdajr2VhB/BPVUFftHhHKCqpR9sTfxfWwag1mI=";
     # TODO: move this to fetchCargoTarball
     dontConfigure = true;
   };

From c2e7e06037377a0efbe46c72416e053f5594a2e9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 2 Aug 2023 16:47:34 +0000
Subject: [PATCH 043/115] umockdev: 0.17.17 -> 0.17.18

---
 pkgs/development/libraries/umockdev/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/umockdev/default.nix b/pkgs/development/libraries/umockdev/default.nix
index cb1a8dccffd1..1cae2c62b33c 100644
--- a/pkgs/development/libraries/umockdev/default.nix
+++ b/pkgs/development/libraries/umockdev/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "umockdev";
-  version = "0.17.17";
+  version = "0.17.18";
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "https://github.com/martinpitt/umockdev/releases/download/${finalAttrs.version}/umockdev-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-IOYhseRYsyADz+qZc5tngkuGZShUqLzjPiYSTjR/32w=";
+    sha256 = "sha256-RmrT4McV5W9Q6mqWUWWCPQc6hBN6y4oeObZlc2SKmF8=";
   };
 
   patches = [

From 7197b9f03beca59576cdaddc2c0de8d0161ccf85 Mon Sep 17 00:00:00 2001
From: Yureka <yuka@yuka.dev>
Date: Wed, 2 Aug 2023 21:02:33 +0200
Subject: [PATCH 044/115] glibcLocales: fix extraNativeBuildInputs definition
 (#246537)

---
 pkgs/development/libraries/glibc/locales.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/glibc/locales.nix b/pkgs/development/libraries/glibc/locales.nix
index 86d6d1438b2d..6a33464c672a 100644
--- a/pkgs/development/libraries/glibc/locales.nix
+++ b/pkgs/development/libraries/glibc/locales.nix
@@ -12,14 +12,13 @@
 
 (callPackage ./common.nix { inherit stdenv; } {
   pname = "glibc-locales";
+  extraNativeBuildInputs = [ glibc ];
 }).overrideAttrs(finalAttrs: previousAttrs: {
 
   builder = ./locales-builder.sh;
 
   outputs = [ "out" ];
 
-  extraNativeBuildInputs = [ glibc ];
-
   LOCALEDEF_FLAGS = [
     (if stdenv.hostPlatform.isLittleEndian
     then "--little-endian"

From 23275b7891b78451509b88cad7b1f2ccfa2ceb17 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 2 Aug 2023 22:13:33 +0100
Subject: [PATCH 045/115] gmp: 6.2.1 -> 6.3.0

The highlight is loongarch64 support.

Changes: https://gmplib.org/gmp6.3
---
 .../libraries/gmp/6.2.1-CVE-2021-43618.patch  | 19 -------------------
 pkgs/development/libraries/gmp/6.x.nix        |  6 ++----
 2 files changed, 2 insertions(+), 23 deletions(-)
 delete mode 100644 pkgs/development/libraries/gmp/6.2.1-CVE-2021-43618.patch

diff --git a/pkgs/development/libraries/gmp/6.2.1-CVE-2021-43618.patch b/pkgs/development/libraries/gmp/6.2.1-CVE-2021-43618.patch
deleted file mode 100644
index eec8206dba05..000000000000
--- a/pkgs/development/libraries/gmp/6.2.1-CVE-2021-43618.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-https://gmplib.org/repo/gmp-6.2/raw-rev/561a9c25298e
-
-diff -r e1fd9db13b47 -r 561a9c25298e mpz/inp_raw.c
---- a/mpz/inp_raw.c	Tue Dec 22 23:49:51 2020 +0100
-+++ b/mpz/inp_raw.c	Thu Oct 21 19:06:49 2021 +0200
-@@ -88,8 +88,11 @@
- 
-   abs_csize = ABS (csize);
- 
-+  if (UNLIKELY (abs_csize > ~(mp_bitcnt_t) 0 / 8))
-+    return 0; /* Bit size overflows */
-+
-   /* round up to a multiple of limbs */
--  abs_xsize = BITS_TO_LIMBS (abs_csize*8);
-+  abs_xsize = BITS_TO_LIMBS ((mp_bitcnt_t) abs_csize * 8);
- 
-   if (abs_xsize != 0)
-     {
-
diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index 7857bfa0e355..44874246b6ea 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -13,15 +13,13 @@ let inherit (lib) optional; in
 
 let self = stdenv.mkDerivation rec {
   pname = "gmp${lib.optionalString cxx "-with-cxx"}";
-  version = "6.2.1";
+  version = "6.3.0";
 
   src = fetchurl { # we need to use bz2, others aren't in bootstrapping stdenv
     urls = [ "mirror://gnu/gmp/gmp-${version}.tar.bz2" "ftp://ftp.gmplib.org/pub/gmp-${version}/gmp-${version}.tar.bz2" ];
-    sha256 = "0z2ddfiwgi0xbf65z4fg4hqqzlhv0cc6hdcswf3c6n21xdmk5sga";
+    hash = "sha256-rCghGnz7YJuuLiyNYFjWbI/pZDT3QM9v4uR7AA0cIMs=";
   };
 
-  patches = [ ./6.2.1-CVE-2021-43618.patch ];
-
   #outputs TODO: split $cxx due to libstdc++ dependency
   # maybe let ghc use a version with *.so shared with rest of nixpkgs and *.a added
   # - see #5855 for related discussion

From 95c1cbdae9211fb92893939bd5824e523223bd5b Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 3 Aug 2023 00:14:13 +1000
Subject: [PATCH 046/115] go_1_21: 1.21rc3 -> 1.21rc4

Changelog: https://go.dev/doc/devel/release#go1.21
---
 pkgs/development/compilers/go/1.21.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.21.nix b/pkgs/development/compilers/go/1.21.nix
index faf9920f719d..cdd91ab1e632 100644
--- a/pkgs/development/compilers/go/1.21.nix
+++ b/pkgs/development/compilers/go/1.21.nix
@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.21rc3";
+  version = "1.21rc4";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    hash = "sha256-nelqLxUZapxpy5qxIsnCquzKMOyUSMqnFUPq6xnKkas=";
+    hash = "sha256-IyTyDxERKuw+XV5CjQRoYaNOT5neCrgqjZFNJrj7Af0=";
   };
 
   strictDeps = true;

From dc2fae9f69a0828c1b23fb41d768f60dede359cb Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 3 Aug 2023 10:06:40 +0100
Subject: [PATCH 047/115] xz: 5.4.3 -> 5.4.4

Changes: https://github.com/tukaani-project/xz/releases/tag/v5.4.4
---
 pkgs/tools/compression/xz/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/compression/xz/default.nix b/pkgs/tools/compression/xz/default.nix
index 44bee00d0842..adc73d926c90 100644
--- a/pkgs/tools/compression/xz/default.nix
+++ b/pkgs/tools/compression/xz/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xz";
-  version = "5.4.3";
+  version = "5.4.4";
 
   src = fetchurl {
     url = "https://tukaani.org/xz/xz-${version}.tar.bz2";
-    sha256 = "sha256-kkOgRZjXpwwfVnoBQ6JVWBrFxksUD9Vf1cvB4AsOb5A=";
+    sha256 = "sha256-C2/N4aw46QQzolVvUAwGWVC5vNLWAgBu/DNHgr3+YpY=";
   };
 
   strictDeps = true;

From f699824f6e0525ec3873fefa557ee49a18478ed4 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 25 Jul 2023 22:14:59 +0200
Subject: [PATCH 048/115] python310Packages.django: migrate to django_4

3.2 LTS ran out of mainstream support in 2021/12 and we should probably
stay on the latest LTS release, that receives mainstream support.
---
 nixos/doc/manual/release-notes/rl-2311.section.md | 12 ++++++++++++
 pkgs/top-level/python-packages.nix                |  7 +++----
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 80b2066582a3..3d82c4a7beb8 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -158,6 +158,18 @@ The module update takes care of the new config syntax and the data itself (user
 
 ## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals}
 
+- The `django` alias in the python package set was upgraded to Django 4.x.
+  Applications that consume Django should always pin their python environment
+  to a compatible major version, so they can move at their own pace.
+
+  ```nix
+  python = python3.override {
+    packageOverrides = self: super: {
+      django = super.django_3;
+    };
+  };
+  ```
+
 - The `qemu-vm.nix` module by default now identifies block devices via
   persistent names available in `/dev/disk/by-*`. Because the rootDevice is
   identfied by its filesystem label, it needs to be formatted before the VM is
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 83b45cde21b3..cda5a120314a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2727,12 +2727,11 @@ self: super: with self; {
 
   distutils_extra = callPackage ../development/python-modules/distutils_extra { };
 
-  django = self.django_3;
-
-  # Current LTS
+  # LTS in extended support phase
   django_3 = callPackage ../development/python-modules/django/3.nix { };
 
-  # Current latest
+  # LTS with mainsteam support
+  django = self.django_4;
   django_4 = callPackage ../development/python-modules/django/4.nix { };
 
   django-admin-datta = callPackage ../development/python-modules/django-admin-datta { };

From 27b8b774748938d727895fb8b3d3a534707b545a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 25 Jul 2023 23:07:48 +0200
Subject: [PATCH 049/115] python310Packages.django-scim2: 0.17.3 -> 0.19.0

https://github.com/15five/django-scim2/blob/refs/tags/0.19.0/CHANGES.txt
---
 .../python-modules/django-scim2/default.nix   | 31 ++++++++++++-------
 1 file changed, 20 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/python-modules/django-scim2/default.nix b/pkgs/development/python-modules/django-scim2/default.nix
index 90db4fe633d3..536d851a4099 100644
--- a/pkgs/development/python-modules/django-scim2/default.nix
+++ b/pkgs/development/python-modules/django-scim2/default.nix
@@ -2,37 +2,43 @@
 , buildPythonPackage
 , fetchFromGitHub
 
+# build-system
+, poetry-core
+
 # propagates
 , django
-, python-dateutil
 , scim2-filter-parser
-, gssapi
-, python-ldap
-, sssd
 
 # tests
 , mock
+, pytest-django
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "django-scim2";
-  version = "0.17.3";
-  format = "setuptools";
+  version = "0.19.0";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "15five";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-5zdGPpjooiFoj+2OoglXhhKsPFB/KOHvrZWZd+1nZqU=";
+    hash = "sha256-larDh4f9/xVr11/n/WfkJ2Tx45DMQqyK3ZzkWAvzeig=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "poetry.masonry.api" "poetry.core.masonry.api"
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   propagatedBuildInputs = [
     django
-    python-dateutil
     scim2-filter-parser
-    gssapi
-    python-ldap
-    sssd
   ];
 
   pythonImportsCheck = [
@@ -41,9 +47,12 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     mock
+    pytest-django
+    pytestCheckHook
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/15five/django-scim2/blob/${src.rev}/CHANGES.txt";
     description = "A SCIM 2.0 Service Provider Implementation (for Django)";
     homepage = "https://github.com/15five/django-scim2";
     license = licenses.mit;

From 79105aad78e10f7bffc0cdace35ca5b0d6bdf324 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 00:08:53 +0200
Subject: [PATCH 050/115] python310Packages.django-cachalot: 2.5.3 -> 2.6.1

https://github.com/noripyt/django-cachalot/blob/v2.6.1/CHANGELOG.rst
---
 pkgs/development/python-modules/django-cachalot/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django-cachalot/default.nix b/pkgs/development/python-modules/django-cachalot/default.nix
index f52a3aa46e62..33d9e484f114 100644
--- a/pkgs/development/python-modules/django-cachalot/default.nix
+++ b/pkgs/development/python-modules/django-cachalot/default.nix
@@ -6,18 +6,19 @@
 , psycopg2
 , beautifulsoup4
 , python
+, pytz
 }:
 
 buildPythonPackage rec {
   pname = "django-cachalot";
-  version = "2.5.3";
+  version = "2.6.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "noripyt";
     repo = "django-cachalot";
     rev = "v${version}";
-    hash = "sha256-ayAN+PgK3aIpt4R8aeC6c6mRGTnfObycmkoXPTjx4WI=";
+    hash = "sha256-bCiIZkh02+7xL6aSWE9by+4dFDsanr0iXuO9QKpLOjw=";
   };
 
   patches = [
@@ -34,6 +35,7 @@ buildPythonPackage rec {
     beautifulsoup4
     django-debug-toolbar
     psycopg2
+    pytz
   ];
 
   pythonImportsCheck = [ "cachalot" ];

From 0116a04d7b64299bf64dfdc50afb3d58ebb2bbfa Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 00:27:44 +0200
Subject: [PATCH 051/115] python310Packages.django-mailman: fix build

---
 .../django-mailman3/default.nix               | 45 ++++++++++++++-----
 1 file changed, 34 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/python-modules/django-mailman3/default.nix b/pkgs/development/python-modules/django-mailman3/default.nix
index 32bfe947c82f..6639257740bc 100644
--- a/pkgs/development/python-modules/django-mailman3/default.nix
+++ b/pkgs/development/python-modules/django-mailman3/default.nix
@@ -1,27 +1,50 @@
-{ lib, buildPythonPackage, fetchPypi, django-gravatar2, django-compressor
-, django-allauth, mailmanclient, django, mock
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# propagates
+, django-gravatar2
+, django-allauth
+, mailmanclient
+, pytz
+
+# tests
+, django
+, pytest-django
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "django-mailman3";
   version = "1.3.9";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-GpI1W0O9aJpLF/mcS23ktJDZsP69S2zQy7drOiWBnTM=";
   };
 
-  propagatedBuildInputs = [
-    django-gravatar2 django-compressor django-allauth mailmanclient
-  ];
-  nativeCheckInputs = [ django mock ];
-
-  checkPhase = ''
-    cd $NIX_BUILD_TOP/$sourceRoot
-    PYTHONPATH=.:$PYTHONPATH django-admin.py test --settings=django_mailman3.tests.settings_test
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace 'django>=3.2,<4.2' 'django>=3.2,<4.3'
   '';
 
-  pythonImportsCheck = [ "django_mailman3" ];
+  propagatedBuildInputs = [
+    django-allauth
+    django-gravatar2
+    mailmanclient
+    pytz
+  ];
+
+  nativeCheckInputs = [
+    django
+    pytest-django
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "django_mailman3"
+  ];
 
   meta = with lib; {
     description = "Django library for Mailman UIs";

From b528b277579e2a9a2e99a58725e967960d80eca1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 01:12:37 +0200
Subject: [PATCH 052/115] python310Packages.django-compat: drop

Not useful any longer and started failing to build with django 4.
---
 .../python-modules/django-compat/default.nix  | 42 --------------
 .../django-compat/fix-tests.diff              | 56 -------------------
 .../python-modules/django-hijack/default.nix  |  2 -
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 -
 5 files changed, 1 insertion(+), 102 deletions(-)
 delete mode 100644 pkgs/development/python-modules/django-compat/default.nix
 delete mode 100644 pkgs/development/python-modules/django-compat/fix-tests.diff

diff --git a/pkgs/development/python-modules/django-compat/default.nix b/pkgs/development/python-modules/django-compat/default.nix
deleted file mode 100644
index d33a4be2817f..000000000000
--- a/pkgs/development/python-modules/django-compat/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib, buildPythonPackage, fetchFromGitHub, python,
-  django, six
-}:
-
-buildPythonPackage rec {
-  pname = "django-compat";
-  version = "1.0.15";
-
-  # the pypi packages don't include everything required for the tests
-  src = fetchFromGitHub {
-    owner = "arteria";
-    repo = "django-compat";
-    rev = "v${version}";
-    sha256 = "1pr6v38ahrsvxlgmcx69s4b5q5082f44gzi4h3c32sccdc4pwqxp";
-  };
-
-  patches = [
-    ./fix-tests.diff
-  ];
-
-  checkPhase = ''
-    runHook preCheck
-
-    # to convince the tests to run against the installed package, not the source directory, we extract the
-    # tests directory from it then dispose of the actual source
-    mv compat/tests .
-    rm -r compat
-    substituteInPlace runtests.py --replace compat.tests tests
-    ${python.interpreter} runtests.py
-
-    runHook postCheck
-  '';
-
-  propagatedBuildInputs = [ django six ];
-
-  meta = with lib; {
-    description = "Forward and backwards compatibility layer for Django 1.4, 1.7, 1.8, 1.9, 1.10 and 1.11";
-    homepage = "https://github.com/arteria/django-compat";
-    license = licenses.mit;
-    maintainers = with maintainers; [ ris ];
-  };
-}
diff --git a/pkgs/development/python-modules/django-compat/fix-tests.diff b/pkgs/development/python-modules/django-compat/fix-tests.diff
deleted file mode 100644
index 58165db96a87..000000000000
--- a/pkgs/development/python-modules/django-compat/fix-tests.diff
+++ /dev/null
@@ -1,56 +0,0 @@
-diff -ur a/compat/tests/settings.py b/compat/tests/settings.py
---- a/compat/tests/settings.py	2020-03-06 15:32:07.548482597 +0100
-+++ b/compat/tests/settings.py	2020-03-06 22:19:25.422934249 +0100
-@@ -16,11 +16,12 @@
-     'django.contrib.admin',
-     'django.contrib.auth',
-     'django.contrib.contenttypes',
-+    'django.contrib.messages',
-     'compat',
-     'compat.tests.test_app',
- ]
- 
--MIDDLEWARE_CLASSES = (
-+MIDDLEWARE = (
-     'django.contrib.sessions.middleware.SessionMiddleware',
-     'django.middleware.common.CommonMiddleware',
-     'django.middleware.csrf.CsrfViewMiddleware',
-@@ -43,6 +44,7 @@
-                 'django.template.context_processors.i18n',
-                 'django.template.context_processors.tz',
-                 'django.template.context_processors.request',
-+                'django.contrib.messages.context_processors.messages',
-             ],
-             'loaders': [
-                 'django.template.loaders.filesystem.Loader',
-diff -ur a/compat/tests/test_compat.py b/compat/tests/test_compat.py
---- a/compat/tests/test_compat.py	2020-03-06 15:32:07.548482597 +0100
-+++ b/compat/tests/test_compat.py	2020-03-06 15:37:39.202835075 +0100
-@@ -9,7 +9,7 @@
- from django.core.serializers.json import DjangoJSONEncoder
- from django.test import TestCase, SimpleTestCase
- from django.test.client import RequestFactory
--from django.contrib.auth.views import logout
-+from django.contrib.auth.views import auth_logout
- try:
-     from django.urls import NoReverseMatch
- except ImportError:
-@@ -103,7 +103,7 @@
-         Tests that passing a view name to ``resolve_url`` will result in the
-         URL path mapping to that view name.
-         """
--        resolved_url = resolve_url(logout)
-+        resolved_url = resolve_url(auth_logout)
-         self.assertEqual('/accounts/logout/', resolved_url)
- 
-     '''
-diff -ur a/compat/tests/urls.py b/compat/tests/urls.py
---- a/compat/tests/urls.py	2020-03-06 15:32:07.548482597 +0100
-+++ b/compat/tests/urls.py	2020-03-06 15:34:25.962377799 +0100
-@@ -2,5 +2,5 @@
- from django.contrib.auth import views
- 
- urlpatterns = [
--    url(r'^accounts/logout/$', views.logout, name='logout'),
-+    url(r'^accounts/logout/$', views.auth_logout, name='logout'),
- ]
diff --git a/pkgs/development/python-modules/django-hijack/default.nix b/pkgs/development/python-modules/django-hijack/default.nix
index 18ef2e3ace79..ef77abefeeae 100644
--- a/pkgs/development/python-modules/django-hijack/default.nix
+++ b/pkgs/development/python-modules/django-hijack/default.nix
@@ -11,7 +11,6 @@
 
 # dependencies
 , django
-, django-compat
 
 # tests
 , pytest-django
@@ -54,7 +53,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     django
-    django-compat
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index a6ef2838bcb6..87ea55ac064e 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -93,6 +93,7 @@ mapAliases ({
   django_classytags = django-classy-tags; # added 2023-07-25
   django_colorful = django-colorful; # added 2023-07-25
   django_compat = django-compat; # added 2023-07-25
+  django-compat = throw "django-compat has been removed. It provided forward/backport compat for django 1.x, which is long end of life."; # added 2023-07-26
   django_contrib_comments = django-contrib-comments; # added 2023-07-25
   django-discover-runner = throw "django-discover-runner was removed because it is no longer maintained."; # added 2022-11-21
   django_environ = django-environ; # added 2021-12-25
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index cda5a120314a..b600ade3f23c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2774,8 +2774,6 @@ self: super: with self; {
 
   django-colorful = callPackage ../development/python-modules/django-colorful { };
 
-  django-compat = callPackage ../development/python-modules/django-compat { };
-
   django-compressor = callPackage ../development/python-modules/django-compressor { };
 
   django-compression-middleware = callPackage ../development/python-modules/django-compression-middleware { };

From 7a56f3863fad43458141dbafff68679a056ad561 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 01:50:51 +0200
Subject: [PATCH 053/115] python310Packages.django-haystack: disable tests on
 django_4

A few failing tests, but disabling individual ones is not straight
forward.
---
 .../django-haystack/default.nix               | 25 ++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/django-haystack/default.nix b/pkgs/development/python-modules/django-haystack/default.nix
index e85d27f907bd..d9d6fb8ecd6f 100644
--- a/pkgs/development/python-modules/django-haystack/default.nix
+++ b/pkgs/development/python-modules/django-haystack/default.nix
@@ -4,12 +4,14 @@
 , fetchPypi
 
 # build dependencies
+, setuptools
 , setuptools-scm
 
 # dependencies
 , django
 
 # tests
+, elasticsearch
 , geopy
 , nose
 , pysolr
@@ -21,7 +23,8 @@
 buildPythonPackage rec {
   pname = "django-haystack";
   version = "3.2.1";
-  format = "setuptools";
+  format = "pyproject";
+
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
@@ -35,13 +38,22 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
-  propagatedBuildInputs = [
+  buildInputs = [
     django
   ];
 
+  passthru.optional-dependencies = {
+    elasticsearch = [
+      elasticsearch
+    ];
+  };
+
+  doCheck = lib.versionOlder django.version "4";
+
   nativeCheckInputs = [
     geopy
     nose
@@ -49,7 +61,14 @@ buildPythonPackage rec {
     python-dateutil
     requests
     whoosh
-  ];
+  ]
+  ++ passthru.optional-dependencies.elasticsearch;
+
+  checkPhase = ''
+    runHook preCheck
+    python test_haystack/run_tests.py
+    runHook postCheck
+  '';
 
   meta = with lib; {
     description = "Pluggable search for Django";

From 002f6c08cb5280ee93ad2295d422bd8f79e21e8f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 01:55:30 +0200
Subject: [PATCH 054/115] python310Packages.mezzanine: propagate pytz

Previously propagated by django_3, but not anymore by django_4.
---
 pkgs/development/python-modules/mezzanine/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/mezzanine/default.nix b/pkgs/development/python-modules/mezzanine/default.nix
index 9eda32b4e48a..46bf44bf8ad9 100644
--- a/pkgs/development/python-modules/mezzanine/default.nix
+++ b/pkgs/development/python-modules/mezzanine/default.nix
@@ -14,6 +14,7 @@
 , pillow
 , pyflakes
 , pythonOlder
+, pytz
 , requests
 , requests-oauthlib
 , tzlocal
@@ -47,6 +48,7 @@ buildPythonPackage rec {
     future
     grappelli_safe
     pillow
+    pytz
     requests
     requests-oauthlib
     tzlocal

From bff5a07ef86c1ac3ff7d83631d94fffa78578d83 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 01:59:37 +0200
Subject: [PATCH 055/115] python310Packages.django-sites: mark broken with
 django_4

Uses API functions deprecated in Django 3.0 and removed in 4.0.
---
 pkgs/development/python-modules/django-sites/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/django-sites/default.nix b/pkgs/development/python-modules/django-sites/default.nix
index 5587014c5740..3a9255daecdf 100644
--- a/pkgs/development/python-modules/django-sites/default.nix
+++ b/pkgs/development/python-modules/django-sites/default.nix
@@ -37,5 +37,7 @@ buildPythonPackage rec {
     description = "Alternative implementation of django sites framework";
     homepage = "https://github.com/niwinz/django-sites";
     license = lib.licenses.bsd3;
+    # has not been updated for django>=4.0
+    broken = lib.versionAtLeast django.version "4";
   };
 }

From fe50817d1035e24c124ab6578d9080f388c4a784 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 02:08:43 +0200
Subject: [PATCH 056/115] python310Packages.django-modelcluster: disable
 failing test

One failing test with Django 4.2, that I reported upstream.

Also migrate tests to pytest, so I can disable the failing test easily.
---
 .../django-modelcluster/default.nix           | 35 ++++++++++++-------
 1 file changed, 23 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/python-modules/django-modelcluster/default.nix b/pkgs/development/python-modules/django-modelcluster/default.nix
index b7fbc9f2b179..5ad43dfc9b1f 100644
--- a/pkgs/development/python-modules/django-modelcluster/default.nix
+++ b/pkgs/development/python-modules/django-modelcluster/default.nix
@@ -1,11 +1,18 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, django
-, django-taggit
-, pytz
 , pythonOlder
-, python
+
+# dependencies
+, django
+, pytz
+
+# optionals
+, django-taggit
+
+# tests
+, pytest-django
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -17,8 +24,8 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "wagtail";
-    repo = pname;
-    rev = "v${version}";
+    repo = "modelcluster";
+    rev = "refs/tags/v${version}";
     hash = "sha256-p6hvOkPWRVJYLHvwyn9nS05wblikRFmlSYZuLiCcuqc=";
   };
 
@@ -31,13 +38,17 @@ buildPythonPackage rec {
     django-taggit
   ];
 
-  nativeCheckInputs = passthru.optional-dependencies.taggit;
+  env.DJANGO_SETTINGS_MODULE = "tests.settings";
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} ./runtests.py --noinput
-    runHook postCheck
-  '';
+  nativeCheckInputs = [
+    pytest-django
+    pytestCheckHook
+  ] ++ passthru.optional-dependencies.taggit;
+
+  # https://github.com/wagtail/django-modelcluster/issues/173
+  disabledTests = lib.optionals (lib.versionAtLeast django.version "4.2") [
+    "test_formfield_callback"
+  ];
 
   meta = with lib; {
     description = "Django extension to allow working with 'clusters' of models as a single unit, independently of the database";

From ca5c50bcf94e3f9af6f3e3456a5155ffb61bfea0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 02:24:49 +0200
Subject: [PATCH 057/115] python310Packages.drf-nested-routers: fix django4
 compat

by backporting patches, that have not yet made it into a new release.

Move django into buildInputs, because we require consumers to bring
their own django version anyway.

Migrate tests to pytest, because they work very well and are easier to
maintain.
---
 .../drf-nested-routers/default.nix            | 42 ++++++++++++++-----
 1 file changed, 32 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/python-modules/drf-nested-routers/default.nix b/pkgs/development/python-modules/drf-nested-routers/default.nix
index 15676ed304b6..849fe8bb130c 100644
--- a/pkgs/development/python-modules/drf-nested-routers/default.nix
+++ b/pkgs/development/python-modules/drf-nested-routers/default.nix
@@ -1,33 +1,55 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, setuptools
+, fetchpatch
 , django
 , djangorestframework
-, pytest
-, pytest-cov
+, pytestCheckHook
 , pytest-django
 , ipdb
-, python
 }:
 
 buildPythonPackage rec {
   pname = "drf-nested-routers";
   version = "0.93.4";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "alanjds";
     repo = "drf-nested-routers";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-qlXNDydoQJ9FZB6G7yV/pNmx3BEo+lvRqsfjrvlbdNY=";
   };
 
-  propagatedBuildInputs = [ django djangorestframework setuptools ];
-  nativeCheckInputs = [ pytest pytest-cov pytest-django ipdb ];
+  patches = [
+    # django4 compatibility
+    (fetchpatch {
+      url = "https://github.com/alanjds/drf-nested-routers/commit/59764cc356f7f593422b26845a9dfac0ad196120.patch";
+      hash = "sha256-mq3vLHzQlGl2EReJ5mVVQMMcYgGIVt/T+qi1STtQ0aI=";
+    })
+    (fetchpatch {
+      url = "https://github.com/alanjds/drf-nested-routers/commit/723a5729dd2ffcb66fe315f229789ca454986fa4.patch";
+      hash = "sha256-UCbBjwlidqsJ9vEEWlGzfqqMOr0xuB2TAaUxHsLzFfU=";
+    })
+    (fetchpatch {
+      url = "https://github.com/alanjds/drf-nested-routers/commit/38e49eb73759bc7dcaaa9166169590f5315e1278.patch";
+      hash = "sha256-IW4BLhHHhXDUZqHaXg46qWoQ89pMXv0ZxKjOCTnDcI0=";
+    })
+  ];
 
-  checkPhase = ''
-    ${python.interpreter} runtests.py --nolint
-  '';
+  buildInputs = [
+    django
+  ];
+
+  propagatedBuildInputs = [
+    djangorestframework
+  ];
+
+  nativeCheckInputs = [
+    ipdb
+    pytestCheckHook
+    pytest-django
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/alanjds/drf-nested-routers";

From 008c1402d2f372bc15603edaf5f1ef2a78ed0b14 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 02:51:59 +0200
Subject: [PATCH 058/115] python310Packages.djangorestframework-guardian: mark
 broken with django4

and point people to the guardian2 fork.
---
 .../python-modules/djangorestframework-guardian/default.nix    | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/djangorestframework-guardian/default.nix b/pkgs/development/python-modules/djangorestframework-guardian/default.nix
index fdc6b3184d98..4358a61b3452 100644
--- a/pkgs/development/python-modules/djangorestframework-guardian/default.nix
+++ b/pkgs/development/python-modules/djangorestframework-guardian/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, django
 , django-guardian
 , djangorestframework
 }:
@@ -37,5 +38,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/rpkilby/django-rest-framework-guardian";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ];
+    # unmaintained, last compatible version is 3.x, use djangorestframework-guardian2 instead
+    broken = lib.versionAtLeast django.version "4";
   };
 }

From a8932746670c00d542e51416bb080b248faecf68 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 03:15:36 +0200
Subject: [PATCH 059/115] python310Packages.django-pattern-library: mark broken
 with django4

---
 .../python-modules/django-pattern-library/default.nix           | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/django-pattern-library/default.nix b/pkgs/development/python-modules/django-pattern-library/default.nix
index 40cc4f64188a..00b6fe9c978f 100644
--- a/pkgs/development/python-modules/django-pattern-library/default.nix
+++ b/pkgs/development/python-modules/django-pattern-library/default.nix
@@ -51,5 +51,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/torchbox/django-pattern-library/blob/v${version}/CHANGELOG.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [ sephi ];
+    # https://github.com/torchbox/django-pattern-library/issues/212
+    broken = lib.versionAtLeast django.version "4.2";
   };
 }

From f1bc601c44eb23d1f263ef37918418d9918557e5 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 28 Jul 2023 17:49:13 +0200
Subject: [PATCH 060/115] python310Packages.wagtail: 4.2.2 -> 5.0.2

https://github.com/wagtail/wagtail/blob/v5.0.2/CHANGELOG.txt
---
 pkgs/development/python-modules/wagtail/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/wagtail/default.nix b/pkgs/development/python-modules/wagtail/default.nix
index c01464f27ceb..54c30dabc781 100644
--- a/pkgs/development/python-modules/wagtail/default.nix
+++ b/pkgs/development/python-modules/wagtail/default.nix
@@ -24,19 +24,20 @@
 
 buildPythonPackage rec {
   pname = "wagtail";
-  version = "4.2.2";
+  version = "5.0.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-s89gs3H//Dc3k6BLZUC4APyDgiWY9LetWAkI+kXQTf8=";
+    hash = "sha256-3r0h34el2zRF1l/94S7xTjBqJPWtSQFQvtVW8Mjq0rs=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "beautifulsoup4>=4.8,<4.12" "beautifulsoup4>=4.8"
+      --replace "beautifulsoup4>=4.8,<4.12" "beautifulsoup4>=4.8" \
+      --replace "Pillow>=4.0.0,<10.0.0" "Pillow>=9.1.0,<11.0.0"
   '';
 
   propagatedBuildInputs = [

From 87f04f12a469f9da4f34f161314a076a1a2df144 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 28 Jul 2023 17:44:46 +0200
Subject: [PATCH 061/115] python310Packages.willow: 1.4.1 -> 1.5.1

---
 .../python-modules/willow/default.nix           | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/willow/default.nix b/pkgs/development/python-modules/willow/default.nix
index d4d297d68d4d..f7030f7c874e 100644
--- a/pkgs/development/python-modules/willow/default.nix
+++ b/pkgs/development/python-modules/willow/default.nix
@@ -2,22 +2,29 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, six
-, pillow
+
+# dependencies
+, filetype
+, defusedxml,
 }:
 
 buildPythonPackage rec {
   pname = "willow";
-  version = "1.4.1";
+  version = "1.5.1";
+  format = "setuptools";
+
   disabled = pythonOlder "2.7";
 
   src = fetchPypi {
     pname = "Willow";
     inherit version;
-    hash = "sha256-Dfj/UoUx4AtI1Av3Ltgb6sHcgvLULlu+1K/wIYvvjA0=";
+    hash = "sha256-t6SQkRATP9seIodZLgZzzCVeAobhzVNCfuaN8ckiDEw=";
   };
 
-  propagatedBuildInputs = [ six pillow ];
+  propagatedBuildInputs = [
+    filetype
+    defusedxml
+  ];
 
   # Test data is not included
   # https://github.com/torchbox/Willow/issues/34

From 7cb5d0503cdcf616f2c0ab09827cf31f82f52837 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 2 Aug 2023 03:55:21 +0200
Subject: [PATCH 062/115] python310Packages.qcodes: disable timing-sensitive
 test

---
 pkgs/development/python-modules/qcodes/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/qcodes/default.nix b/pkgs/development/python-modules/qcodes/default.nix
index db565e11d02d..3dd8342ec1cd 100644
--- a/pkgs/development/python-modules/qcodes/default.nix
+++ b/pkgs/development/python-modules/qcodes/default.nix
@@ -124,6 +124,11 @@ buildPythonPackage rec {
     "--durations=20"
   ];
 
+  disabledTests = [
+    # timing sensitive
+    "test_access_channels_by_slice"
+  ];
+
   disabledTestPaths = [
     # depends on qcodes-loop, causing a cyclic dependency
     "qcodes/tests/dataset/measurement/test_load_legacy_data.py"

From 84f6a6755a0832ca0e9b22c158a13869f3805132 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 2 Aug 2023 04:35:34 +0200
Subject: [PATCH 063/115] mailmanPackages: pin to django_3

---
 pkgs/servers/mail/mailman/python.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/servers/mail/mailman/python.nix b/pkgs/servers/mail/mailman/python.nix
index 288e48d814e4..dfd8790302fd 100644
--- a/pkgs/servers/mail/mailman/python.nix
+++ b/pkgs/servers/mail/mailman/python.nix
@@ -2,6 +2,8 @@
 
 python3.override {
   packageOverrides = self: super: {
+    django = super.django_3;
+
     # does not find tests
     alembic = super.alembic.overridePythonAttrs (oldAttrs: {
       doCheck = false;

From f4d64ea14978c37a74d5086a8b0bf25fcae65e52 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 2 Aug 2023 04:57:48 +0200
Subject: [PATCH 064/115] baserow: pin django_3

---
 pkgs/servers/baserow/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/servers/baserow/default.nix b/pkgs/servers/baserow/default.nix
index 92007bd6ee44..a91e6ba774dc 100644
--- a/pkgs/servers/baserow/default.nix
+++ b/pkgs/servers/baserow/default.nix
@@ -29,6 +29,8 @@ let
 
         doCheck = false;
       };
+
+      django = super.django_3;
     };
   };
 in

From dc9e777948aacad8ad054b7306984de7db98819a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 2 Aug 2023 05:25:22 +0200
Subject: [PATCH 065/115] python310Packages.nplusone: mark broken with django_4

---
 pkgs/development/python-modules/nplusone/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/nplusone/default.nix b/pkgs/development/python-modules/nplusone/default.nix
index ecf2255b3593..5a31394c2d35 100644
--- a/pkgs/development/python-modules/nplusone/default.nix
+++ b/pkgs/development/python-modules/nplusone/default.nix
@@ -1,6 +1,7 @@
 { lib
 , blinker
 , buildPythonPackage
+, django
 , fetchFromGitHub
 , flake8
 , flask-sqlalchemy
@@ -79,5 +80,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/jmcarp/nplusone";
     maintainers = with maintainers; [ cript0nauta ];
     license = licenses.mit;
+    broken = lib.versionAtLeast django.version "4";
   };
 }

From 99dca946e6f8daa0e9626e42f402023db0cf0def Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 3 Aug 2023 03:26:10 +0200
Subject: [PATCH 066/115] privacyidea: pin to django_3

---
 pkgs/applications/misc/privacyidea/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/applications/misc/privacyidea/default.nix b/pkgs/applications/misc/privacyidea/default.nix
index 74efc4c1db02..2a7f6c50c733 100644
--- a/pkgs/applications/misc/privacyidea/default.nix
+++ b/pkgs/applications/misc/privacyidea/default.nix
@@ -9,6 +9,8 @@ let
 
   python3' = python310.override {
     packageOverrides = self: super: {
+      django = super.django_3;
+
       sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
         version = "1.3.24";
         src = fetchPypi {

From 99524a94ff31e1443a09d4b5326f5e69dd698b71 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 3 Aug 2023 06:33:36 -0700
Subject: [PATCH 067/115] python3.pkgs.ninja-python: add tjni as a maintainer
 of this stub

---
 pkgs/development/python-modules/ninja/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/ninja/default.nix b/pkgs/development/python-modules/ninja/default.nix
index d3ab12c29a55..056c7663fb21 100644
--- a/pkgs/development/python-modules/ninja/default.nix
+++ b/pkgs/development/python-modules/ninja/default.nix
@@ -67,6 +67,6 @@ buildPythonPackage rec {
     description = "A small build system with a focus on speed";
     homepage = "https://github.com/scikit-build/ninja-python-distributions";
     license = licenses.asl20;
-    maintainers = with maintainers; [ _999eagle ];
+    maintainers = with maintainers; [ _999eagle tjni ];
   };
 }

From d36556b8a5db361933833d33876f4e8a815d1e0d Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 3 Aug 2023 06:06:34 -0700
Subject: [PATCH 068/115] python3.pkgs.ninja-python: replace with a stub
 implementation

Instead of packaging the upstream package, which downloads Ninja from
the web, we can stub it out to use ninja from nixpkgs.
---
 .../python-modules/ninja/default.nix          | 71 ++++++-------------
 .../python-modules/ninja/no-download.patch    | 10 ---
 .../ninja/stub/ninja/__init__.py              |  9 +++
 .../python-modules/ninja/stub/pyproject.toml  | 11 +++
 4 files changed, 43 insertions(+), 58 deletions(-)
 delete mode 100644 pkgs/development/python-modules/ninja/no-download.patch
 create mode 100644 pkgs/development/python-modules/ninja/stub/ninja/__init__.py
 create mode 100644 pkgs/development/python-modules/ninja/stub/pyproject.toml

diff --git a/pkgs/development/python-modules/ninja/default.nix b/pkgs/development/python-modules/ninja/default.nix
index 056c7663fb21..0ff678569302 100644
--- a/pkgs/development/python-modules/ninja/default.nix
+++ b/pkgs/development/python-modules/ninja/default.nix
@@ -1,70 +1,45 @@
 { lib
 , buildPythonPackage
-, fetchFromGitHub
-, fetchurl
-, cmake
-, setuptools-scm
-, scikit-build
-, pytestCheckHook
-, pytest-virtualenv
+, flit-core
+, ninja
 }:
-let
-  # these must match NinjaUrls.cmake
-  ninja_src_url = "https://github.com/Kitware/ninja/archive/v1.11.1.g95dee.kitware.jobserver-1.tar.gz";
-  ninja_src_sha256 = "7ba84551f5b315b4270dc7c51adef5dff83a2154a3665a6c9744245c122dd0db";
-  ninja_src = fetchurl {
-    url = ninja_src_url;
-    sha256 = ninja_src_sha256;
-  };
-in
+
 buildPythonPackage rec {
   pname = "ninja";
-  version = "1.11.1";
+  inherit (ninja) version;
   format = "pyproject";
 
-  src = fetchFromGitHub {
-    owner = "scikit-build";
-    repo = "ninja-python-distributions";
-    rev = version;
-    hash = "sha256-scCYsSEyN+u3qZhNhWYqHpJCl+JVJJbKz+T34gOXGJM=";
-  };
-  patches = [
-    # make sure cmake doesn't try to download the ninja sources
-    ./no-download.patch
-  ];
+  src = ./stub;
 
-  inherit ninja_src;
   postUnpack = ''
-    # assume that if the hash matches, the source should be fine
-    if ! grep "${ninja_src_sha256}" $sourceRoot/NinjaUrls.cmake; then
-      echo "ninja_src_sha256 doesn't match the hash in NinjaUrls.cmake!"
-      exit 1
-    fi
-    mkdir -p "$sourceRoot/Ninja-src"
-    pushd "$sourceRoot/Ninja-src"
-    tar -xavf ${ninja_src} --strip-components 1
-    popd
+    substituteInPlace "$sourceRoot/pyproject.toml" \
+      --subst-var version
+
+    substituteInPlace "$sourceRoot/ninja/__init__.py" \
+      --subst-var-by BIN_DIR "${ninja}/bin"
   '';
 
-  postPatch = ''
-    sed -i '/cov/d' setup.cfg
-  '';
-
-  dontUseCmakeConfigure = true;
+  inherit (ninja) setupHook;
 
   nativeBuildInputs = [
-    setuptools-scm
-    scikit-build
-    cmake
+    flit-core
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-    pytest-virtualenv
+  preBuild = ''
+    cp "${ninja.src}/misc/ninja_syntax.py" ninja/ninja_syntax.py
+  '';
+
+  pythonImportsCheck = [
+    "ninja"
+    "ninja.ninja_syntax"
   ];
 
   meta = with lib; {
     description = "A small build system with a focus on speed";
+    longDescription = ''
+      This is a stub of the ninja package on PyPI that uses the ninja program
+      provided by nixpkgs instead of downloading ninja from the web.
+    '';
     homepage = "https://github.com/scikit-build/ninja-python-distributions";
     license = licenses.asl20;
     maintainers = with maintainers; [ _999eagle tjni ];
diff --git a/pkgs/development/python-modules/ninja/no-download.patch b/pkgs/development/python-modules/ninja/no-download.patch
deleted file mode 100644
index 0937a5fde1ea..000000000000
--- a/pkgs/development/python-modules/ninja/no-download.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -64,6 +64,7 @@
-   # Download selected source archive
-   ExternalProject_add(download_ninja_source
-     SOURCE_DIR ${Ninja_SOURCE_DIR}
-+    DOWNLOAD_COMMAND ""
-     URL ${${src_archive}_url}
-     URL_HASH SHA256=${${src_archive}_sha256}
-     DOWNLOAD_DIR ${ARCHIVE_DOWNLOAD_DIR}
diff --git a/pkgs/development/python-modules/ninja/stub/ninja/__init__.py b/pkgs/development/python-modules/ninja/stub/ninja/__init__.py
new file mode 100644
index 000000000000..d85e4b6dab34
--- /dev/null
+++ b/pkgs/development/python-modules/ninja/stub/ninja/__init__.py
@@ -0,0 +1,9 @@
+import os
+import subprocess
+import sys
+
+def _program(name, args):
+    return subprocess.call([os.path.join('@BIN_DIR@', name)] + args, close_fds=False)
+
+def ninja():
+    raise SystemExit(_program('ninja', sys.argv[1:]))
diff --git a/pkgs/development/python-modules/ninja/stub/pyproject.toml b/pkgs/development/python-modules/ninja/stub/pyproject.toml
new file mode 100644
index 000000000000..0a8a6314288a
--- /dev/null
+++ b/pkgs/development/python-modules/ninja/stub/pyproject.toml
@@ -0,0 +1,11 @@
+[build-system]
+requires = ["flit_core"]
+build-backend = "flit_core.buildapi"
+
+[project]
+name = "ninja"
+version = "@version@"
+description = "Ninja is a small build system with a focus on speed"
+
+[project.scripts]
+ninja = "ninja:ninja"

From a586a9e55fcb0c3e961c49f9945f1078fb60ea7f Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 3 Aug 2023 20:04:15 -0700
Subject: [PATCH 069/115] python3.pkgs.ninja: rename from ninja-python

I am hoping this can be a transparent shim for most if not all Python
packages that acts as a proxy to the actual ninja package in nixpkgs.
If this works, doing it this way simplifies rolling out the new Python
build hooks that do stricter build dependency validation.
---
 pkgs/tools/misc/nanoemoji/default.nix | 4 ++--
 pkgs/top-level/python-aliases.nix     | 1 +
 pkgs/top-level/python-packages.nix    | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/misc/nanoemoji/default.nix b/pkgs/tools/misc/nanoemoji/default.nix
index 93817ff84798..401783bcc4a1 100644
--- a/pkgs/tools/misc/nanoemoji/default.nix
+++ b/pkgs/tools/misc/nanoemoji/default.nix
@@ -36,7 +36,7 @@ python3.pkgs.buildPythonApplication rec {
     absl-py
     fonttools
     lxml
-    ninja-python
+    ninja
     picosvg
     pillow
     regex
@@ -50,7 +50,7 @@ python3.pkgs.buildPythonApplication rec {
   nativeCheckInputs = with python3.pkgs; [
     pytestCheckHook
 
-    ninja-python
+    ninja
     picosvg
   ];
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 21f3ee1f4a4b..34839da3c1e8 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -209,6 +209,7 @@ mapAliases ({
   mutmut = throw "mutmut has been promoted to a top-level attribute"; # added 2022-10-02
   net2grid = gridnet; # add 2022-04-22
   nghttp2 = throw "in 1.52.0 removed deprecated python bindings."; # added 2023-06-08
+  ninja-python = ninja; # add 2022-08-03
   nose-cover3 = throw "nose-cover3 has been removed, it was using setuptools 2to3 translation feature, which has been removed in setuptools 58"; # added 2022-02-16
   nose_progressive = throw "nose_progressive has been removed, it was using setuptools 2to3 translation feature, which has been removed in setuptools 58"; #added 2023-02-21
   notifymuch = throw "notifymuch has been promoted to a top-level attribute"; # added 2022-10-02
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 008e5ecd4247..7424e43e9c80 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7036,7 +7036,7 @@ self: super: with self; {
 
   nine = callPackage ../development/python-modules/nine { };
 
-  ninja-python = callPackage ../development/python-modules/ninja { };
+  ninja = callPackage ../development/python-modules/ninja { inherit (pkgs) ninja; };
 
   nipy = callPackage ../development/python-modules/nipy { };
 

From 39dd3d18bc2819b332d480aa1dd8d1084d0a635a Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 3 Aug 2023 22:12:05 -0700
Subject: [PATCH 070/115] python3.pkgs.meson-python: depend on top-level ninja

This is a build tool that depends on a ninja binary directly, not
through the ninja PyPI package.
---
 pkgs/development/python-modules/meson-python/default.nix | 7 -------
 pkgs/top-level/python-packages.nix                       | 4 +++-
 2 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/meson-python/default.nix b/pkgs/development/python-modules/meson-python/default.nix
index 866512a4cfdd..4b45ee4e77d3 100644
--- a/pkgs/development/python-modules/meson-python/default.nix
+++ b/pkgs/development/python-modules/meson-python/default.nix
@@ -43,13 +43,6 @@ buildPythonPackage rec {
     ./add-build-flags.sh
   ];
 
-  # Ugly work-around. Drop ninja dependency.
-  # We already have ninja, but it comes without METADATA.
-  # Building ninja-python-distributions is the way to go.
-  postPatch = ''
-    substituteInPlace pyproject.toml --replace "'ninja'," ""
-  '';
-
   meta = {
     changelog = "https://github.com/mesonbuild/meson-python/blob/${version}/CHANGELOG.rst";
     description = "Meson Python build backend (PEP 517)";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7424e43e9c80..9d7df6be84d2 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6442,7 +6442,9 @@ self: super: with self; {
 
   mesonpep517 = callPackage ../development/python-modules/mesonpep517 { };
 
-  meson-python = callPackage ../development/python-modules/meson-python { };
+  meson-python = callPackage ../development/python-modules/meson-python {
+    inherit (pkgs) ninja;
+  };
 
   messagebird = callPackage ../development/python-modules/messagebird { };
 

From 7110f64a3c500efeeafeb216a52c748235b99148 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 4 Aug 2023 15:31:19 +0300
Subject: [PATCH 071/115] pipewire: 0.3.76 -> 0.3.77

Diff: https://gitlab.freedesktop.org/pipewire/pipewire/-/compare/0.3.76...0.3.77

Changelog: https://gitlab.freedesktop.org/pipewire/pipewire/-/releases/0.3.77
---
 pkgs/development/libraries/pipewire/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index aa226674d76b..08b92288e544 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -75,7 +75,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.76";
+    version = "0.3.77";
 
     outputs = [
       "out"
@@ -93,7 +93,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-3nD5etLohEIM4/5RDxaBzNxSngY817R6AzT2fqwjMiU=";
+      sha256 = "sha256-dRAo/GzWvXKVCGLM12YyTQmgXHEYn3QbOyaZKmlqTYY=";
     };
 
     patches = [

From ca73fb024a757f3ddf1a32a2e88cc2bccb88479c Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Fri, 4 Aug 2023 10:14:20 -0700
Subject: [PATCH 072/115] makeBinaryWrapper: remove cc dependency on
 aarch64-darwin

---
 .../setup-hooks/make-binary-wrapper/default.nix            | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
index 17b97b1082e9..62ba3705be20 100644
--- a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
@@ -1,5 +1,4 @@
-{ stdenv
-, targetPackages
+{ targetPackages
 , lib
 , makeSetupHook
 , dieHook
@@ -11,9 +10,7 @@
 
 makeSetupHook {
   name = "make-binary-wrapper-hook";
-  propagatedBuildInputs = [ dieHook ]
-    # https://github.com/NixOS/nixpkgs/issues/148189
-    ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64) cc;
+  propagatedBuildInputs = [ dieHook ];
 
   substitutions = {
     cc = "${cc}/bin/${cc.targetPrefix}cc ${lib.escapeShellArgs (map (s: "-fsanitize=${s}") sanitizers)}";

From 166ff8fe1f7e9fd3fc5322dc2893105e5e790704 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Tue, 1 Aug 2023 00:01:21 -0700
Subject: [PATCH 073/115] treewide: fix sandbox darwin build

---
 .../python-modules/adguardhome/default.nix      |  2 ++
 .../aio-geojson-client/default.nix              |  2 ++
 .../aio-geojson-generic-client/default.nix      |  2 ++
 .../aio-geojson-geonetnz-quakes/default.nix     |  2 ++
 .../aio-geojson-geonetnz-volcano/default.nix    |  2 ++
 .../aio-geojson-nsw-rfs-incidents/default.nix   |  2 ++
 .../aio-geojson-usgs-earthquakes/default.nix    |  2 ++
 .../aio-georss-client/default.nix               |  2 ++
 .../python-modules/aio-georss-gdacs/default.nix |  2 ++
 .../python-modules/aiohttp-retry/default.nix    |  2 ++
 .../python-modules/aiojobs/default.nix          |  2 ++
 .../development/python-modules/amqp/default.nix |  4 ++++
 .../python-modules/asyncssh/default.nix         |  2 ++
 .../python-modules/curio/default.nix            | 17 ++++++++++-------
 .../python-modules/datadog/default.nix          |  2 ++
 .../python-modules/devolo-plc-api/default.nix   |  2 ++
 .../python-modules/django-cacheops/default.nix  |  2 ++
 .../python-modules/falcon/default.nix           |  2 ++
 .../python-modules/feedparser/default.nix       |  2 ++
 .../google-auth-httplib2/default.nix            |  2 ++
 .../python-modules/graphene-django/default.nix  |  8 ++++++--
 .../python-modules/httplib2/default.nix         | 10 ++++++----
 .../python-modules/httpx-socks/default.nix      |  2 ++
 .../development/python-modules/moto/default.nix |  2 ++
 .../python-modules/nose2/default.nix            |  2 ++
 .../python-modules/nvchecker/default.nix        |  2 ++
 .../prometheus-client/default.nix               |  2 ++
 .../python-modules/pycurl/default.nix           |  2 ++
 .../python-modules/pyquery/default.nix          |  2 ++
 .../python-modules/pyro5/default.nix            |  2 ++
 .../python-modules/pytest-recording/default.nix |  2 ++
 .../pytest-remotedata/default.nix               |  2 ++
 .../python-modules/pytest-tornasync/default.nix |  2 ++
 .../python-modules/pywemo/default.nix           |  2 ++
 .../python-modules/pyzipper/default.nix         |  2 ++
 .../python-modules/rangehttpserver/default.nix  |  2 ++
 .../development/python-modules/rope/default.nix |  2 ++
 .../python-modules/snakeviz/default.nix         |  2 ++
 .../python-modules/sockio/default.nix           |  2 ++
 .../python-modules/sshfs/default.nix            | 12 +++++++++++-
 .../python-modules/terminado/default.nix        |  3 ++-
 .../python-modules/umodbus/default.nix          |  2 ++
 .../python-modules/unearth/default.nix          |  2 ++
 .../python-modules/wandb/default.nix            |  2 ++
 .../python-modules/wsgidav/default.nix          |  2 ++
 45 files changed, 117 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/python-modules/adguardhome/default.nix b/pkgs/development/python-modules/adguardhome/default.nix
index 28af1269c180..5c32d588428f 100644
--- a/pkgs/development/python-modules/adguardhome/default.nix
+++ b/pkgs/development/python-modules/adguardhome/default.nix
@@ -42,6 +42,8 @@ buildPythonPackage rec {
     yarl
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
diff --git a/pkgs/development/python-modules/aio-geojson-client/default.nix b/pkgs/development/python-modules/aio-geojson-client/default.nix
index ad0a641c35f5..22c59bd64d9d 100644
--- a/pkgs/development/python-modules/aio-geojson-client/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-client/default.nix
@@ -31,6 +31,8 @@ buildPythonPackage rec {
     haversine
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     mock
diff --git a/pkgs/development/python-modules/aio-geojson-generic-client/default.nix b/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
index 56e5f8475cbc..4ff502a2cf83 100644
--- a/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
@@ -30,6 +30,8 @@ buildPythonPackage rec {
     pytz
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
diff --git a/pkgs/development/python-modules/aio-geojson-geonetnz-quakes/default.nix b/pkgs/development/python-modules/aio-geojson-geonetnz-quakes/default.nix
index 90645327c046..f8daf10c3c1f 100644
--- a/pkgs/development/python-modules/aio-geojson-geonetnz-quakes/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-geonetnz-quakes/default.nix
@@ -30,6 +30,8 @@ buildPythonPackage rec {
     pytz
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
diff --git a/pkgs/development/python-modules/aio-geojson-geonetnz-volcano/default.nix b/pkgs/development/python-modules/aio-geojson-geonetnz-volcano/default.nix
index fed8b6374a7e..d97070df5907 100644
--- a/pkgs/development/python-modules/aio-geojson-geonetnz-volcano/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-geonetnz-volcano/default.nix
@@ -31,6 +31,8 @@ buildPythonPackage rec {
     pytz
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     mock
diff --git a/pkgs/development/python-modules/aio-geojson-nsw-rfs-incidents/default.nix b/pkgs/development/python-modules/aio-geojson-nsw-rfs-incidents/default.nix
index b7c205179fd7..bf18c2bf184b 100644
--- a/pkgs/development/python-modules/aio-geojson-nsw-rfs-incidents/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-nsw-rfs-incidents/default.nix
@@ -30,6 +30,8 @@ buildPythonPackage rec {
     pytz
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
diff --git a/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix b/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
index 1cb112583935..89a1fd75b8f2 100644
--- a/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
@@ -30,6 +30,8 @@ buildPythonPackage rec {
     pytz
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/aio-georss-client/default.nix b/pkgs/development/python-modules/aio-georss-client/default.nix
index 6fb1ec42631b..9c3cda759039 100644
--- a/pkgs/development/python-modules/aio-georss-client/default.nix
+++ b/pkgs/development/python-modules/aio-georss-client/default.nix
@@ -35,6 +35,8 @@ buildPythonPackage rec {
     dateparser
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     mock
diff --git a/pkgs/development/python-modules/aio-georss-gdacs/default.nix b/pkgs/development/python-modules/aio-georss-gdacs/default.nix
index 3816b591544d..f55a42b5dd22 100644
--- a/pkgs/development/python-modules/aio-georss-gdacs/default.nix
+++ b/pkgs/development/python-modules/aio-georss-gdacs/default.nix
@@ -28,6 +28,8 @@ buildPythonPackage rec {
     dateparser
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
diff --git a/pkgs/development/python-modules/aiohttp-retry/default.nix b/pkgs/development/python-modules/aiohttp-retry/default.nix
index bf3c251b4fb8..262fcef8e442 100644
--- a/pkgs/development/python-modules/aiohttp-retry/default.nix
+++ b/pkgs/development/python-modules/aiohttp-retry/default.nix
@@ -25,6 +25,8 @@ buildPythonPackage rec {
     aiohttp
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest-aiohttp
     pytestCheckHook
diff --git a/pkgs/development/python-modules/aiojobs/default.nix b/pkgs/development/python-modules/aiojobs/default.nix
index 320593f79370..a3b982e22d5a 100644
--- a/pkgs/development/python-modules/aiojobs/default.nix
+++ b/pkgs/development/python-modules/aiojobs/default.nix
@@ -37,6 +37,8 @@ buildPythonPackage rec {
     async-timeout
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
     pytest-aiohttp
diff --git a/pkgs/development/python-modules/amqp/default.nix b/pkgs/development/python-modules/amqp/default.nix
index bd834b9e1491..bad99ab8f02a 100644
--- a/pkgs/development/python-modules/amqp/default.nix
+++ b/pkgs/development/python-modules/amqp/default.nix
@@ -3,6 +3,7 @@
 , case
 , fetchPypi
 , pytestCheckHook
+, pytest-rerunfailures
 , pythonOlder
 , vine
 }:
@@ -23,9 +24,12 @@ buildPythonPackage rec {
     vine
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     case
     pytestCheckHook
+    pytest-rerunfailures
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/asyncssh/default.nix b/pkgs/development/python-modules/asyncssh/default.nix
index 3f52c3acd354..bdc436c8fdc4 100644
--- a/pkgs/development/python-modules/asyncssh/default.nix
+++ b/pkgs/development/python-modules/asyncssh/default.nix
@@ -58,6 +58,8 @@ buildPythonPackage rec {
     ];
   };
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     openssh
     openssl
diff --git a/pkgs/development/python-modules/curio/default.nix b/pkgs/development/python-modules/curio/default.nix
index e067e134d04c..501cdd442ab9 100644
--- a/pkgs/development/python-modules/curio/default.nix
+++ b/pkgs/development/python-modules/curio/default.nix
@@ -26,13 +26,16 @@ buildPythonPackage rec {
   __darwinAllowLocalNetworking = true;
 
   disabledTests = [
-     "test_aside_basic" # times out
-     "test_write_timeout" # flaky, does not always time out
-     "test_aside_cancel" # fails because modifies PYTHONPATH and cant find pytest
-     "test_ssl_outgoing" # touches network
-     "test_unix_echo" # socket bind error on hydra when built with other packages
-     "test_unix_ssl_server" # socket bind error on hydra when built with other packages
-   ];
+    "test_aside_basic" # times out
+    "test_write_timeout" # flaky, does not always time out
+    "test_aside_cancel" # fails because modifies PYTHONPATH and cant find pytest
+    "test_ssl_outgoing" # touches network
+    "test_unix_echo" # socket bind error on hydra when built with other packages
+    "test_unix_ssl_server" # socket bind error on hydra when built with other packages
+  ] ++ lib.optionals stdenv.isDarwin [
+    # connects to python.org:1, expects an OsError, hangs in the darwin sandbox
+    "test_create_bad_connection"
+  ];
 
   pythonImportsCheck = [ "curio" ];
 
diff --git a/pkgs/development/python-modules/datadog/default.nix b/pkgs/development/python-modules/datadog/default.nix
index d38279452317..fb3271af586f 100644
--- a/pkgs/development/python-modules/datadog/default.nix
+++ b/pkgs/development/python-modules/datadog/default.nix
@@ -34,6 +34,8 @@ buildPythonPackage rec {
     requests
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     click
     freezegun
diff --git a/pkgs/development/python-modules/devolo-plc-api/default.nix b/pkgs/development/python-modules/devolo-plc-api/default.nix
index d352925308cb..c6d5b7df2660 100644
--- a/pkgs/development/python-modules/devolo-plc-api/default.nix
+++ b/pkgs/development/python-modules/devolo-plc-api/default.nix
@@ -44,6 +44,8 @@ buildPythonPackage rec {
     zeroconf
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest-asyncio
     pytest-httpx
diff --git a/pkgs/development/python-modules/django-cacheops/default.nix b/pkgs/development/python-modules/django-cacheops/default.nix
index 566eb06f5043..4c6c4e786ade 100644
--- a/pkgs/development/python-modules/django-cacheops/default.nix
+++ b/pkgs/development/python-modules/django-cacheops/default.nix
@@ -42,6 +42,8 @@ buildPythonPackage rec {
     six
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
     pytest-django
diff --git a/pkgs/development/python-modules/falcon/default.nix b/pkgs/development/python-modules/falcon/default.nix
index 341d3c661506..b0880c384dba 100644
--- a/pkgs/development/python-modules/falcon/default.nix
+++ b/pkgs/development/python-modules/falcon/default.nix
@@ -45,6 +45,8 @@ buildPythonPackage rec {
     cython
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   preCheck = ''
     export HOME=$TMPDIR
     cp -R tests examples $TMPDIR
diff --git a/pkgs/development/python-modules/feedparser/default.nix b/pkgs/development/python-modules/feedparser/default.nix
index 02396ec83431..7eaf65b371df 100644
--- a/pkgs/development/python-modules/feedparser/default.nix
+++ b/pkgs/development/python-modules/feedparser/default.nix
@@ -22,6 +22,8 @@ buildPythonPackage rec {
     sgmllib3k
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   checkPhase = ''
     # Tests are failing
     # AssertionError: unexpected '~' char in declaration
diff --git a/pkgs/development/python-modules/google-auth-httplib2/default.nix b/pkgs/development/python-modules/google-auth-httplib2/default.nix
index e185a88858d5..c35297f6b5cf 100644
--- a/pkgs/development/python-modules/google-auth-httplib2/default.nix
+++ b/pkgs/development/python-modules/google-auth-httplib2/default.nix
@@ -27,6 +27,8 @@ buildPythonPackage rec {
     httplib2
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     flask
     mock
diff --git a/pkgs/development/python-modules/graphene-django/default.nix b/pkgs/development/python-modules/graphene-django/default.nix
index 0e85af5045b2..3e9055157220 100644
--- a/pkgs/development/python-modules/graphene-django/default.nix
+++ b/pkgs/development/python-modules/graphene-django/default.nix
@@ -1,4 +1,5 @@
-{ lib
+{ stdenv
+, lib
 , buildPythonPackage
 , pythonAtLeast
 , pythonOlder
@@ -61,11 +62,14 @@ buildPythonPackage rec {
   ];
 
   disabledTests = lib.optionals (pythonAtLeast "3.11") [
-    # Pèython 3.11 support, https://github.com/graphql-python/graphene-django/pull/1365
+    # Python 3.11 support, https://github.com/graphql-python/graphene-django/pull/1365
     "test_django_objecttype_convert_choices_enum_naming_collisions"
     "test_django_objecttype_choices_custom_enum_name"
     "test_django_objecttype_convert_choices_enum_list"
     "test_schema_representation"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # this test touches files in the "/" directory and fails in darwin sandbox
+    "test_should_filepath_convert_string"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/httplib2/default.nix b/pkgs/development/python-modules/httplib2/default.nix
index 99dd53ddd0a9..c201bc3126c8 100644
--- a/pkgs/development/python-modules/httplib2/default.nix
+++ b/pkgs/development/python-modules/httplib2/default.nix
@@ -26,6 +26,10 @@ buildPythonPackage rec {
     hash = "sha256-1Pl+l28J7crfO2UY/9/D019IzOHWOwjR+UvVEHICTqU=";
   };
 
+  postPatch = ''
+    sed -i "/--cov/d" setup.cfg
+  '';
+
   propagatedBuildInputs = [
     pyparsing
   ];
@@ -40,13 +44,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   # Don't run tests for older Pythons
   doCheck = pythonAtLeast "3.9";
 
-  postPatch = ''
-    sed -i "/--cov/d" setup.cfg
-  '';
-
   disabledTests = [
     # ValueError: Unable to load PEM file.
     # https://github.com/httplib2/httplib2/issues/192#issuecomment-993165140
diff --git a/pkgs/development/python-modules/httpx-socks/default.nix b/pkgs/development/python-modules/httpx-socks/default.nix
index 996db8ec1b30..992ddf1c6932 100644
--- a/pkgs/development/python-modules/httpx-socks/default.nix
+++ b/pkgs/development/python-modules/httpx-socks/default.nix
@@ -54,6 +54,8 @@ buildPythonPackage rec {
     ];
   };
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     flask
     hypercorn
diff --git a/pkgs/development/python-modules/moto/default.nix b/pkgs/development/python-modules/moto/default.nix
index b029f9cad44e..c30fc5311d04 100644
--- a/pkgs/development/python-modules/moto/default.nix
+++ b/pkgs/development/python-modules/moto/default.nix
@@ -79,6 +79,8 @@ buildPythonPackage rec {
     xmltodict
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     freezegun
     pytestCheckHook
diff --git a/pkgs/development/python-modules/nose2/default.nix b/pkgs/development/python-modules/nose2/default.nix
index b3dfdda218f3..648d954be7d0 100644
--- a/pkgs/development/python-modules/nose2/default.nix
+++ b/pkgs/development/python-modules/nose2/default.nix
@@ -24,6 +24,8 @@ buildPythonPackage rec {
     six
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   checkPhase = ''
     ${python.interpreter} -m unittest
   '';
diff --git a/pkgs/development/python-modules/nvchecker/default.nix b/pkgs/development/python-modules/nvchecker/default.nix
index 20802a73176f..ca327c3e54e0 100644
--- a/pkgs/development/python-modules/nvchecker/default.nix
+++ b/pkgs/development/python-modules/nvchecker/default.nix
@@ -49,6 +49,8 @@ buildPythonPackage rec {
     tomli
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     flaky
     pytest-asyncio
diff --git a/pkgs/development/python-modules/prometheus-client/default.nix b/pkgs/development/python-modules/prometheus-client/default.nix
index 9a9c2f7cce18..f86e0bbc3238 100644
--- a/pkgs/development/python-modules/prometheus-client/default.nix
+++ b/pkgs/development/python-modules/prometheus-client/default.nix
@@ -19,6 +19,8 @@ buildPythonPackage rec {
     hash = "sha256-0qh6OorIIs3WfneZavzwTTZFwIRXCJzezks/qihu8xo=";
   };
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index 45e5d8f13a15..cacb67496c8c 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -46,6 +46,8 @@ buildPythonPackage rec {
     curl
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     bottle
     pytestCheckHook
diff --git a/pkgs/development/python-modules/pyquery/default.nix b/pkgs/development/python-modules/pyquery/default.nix
index 4e3b1442ee31..699bcd0fbc59 100644
--- a/pkgs/development/python-modules/pyquery/default.nix
+++ b/pkgs/development/python-modules/pyquery/default.nix
@@ -33,6 +33,8 @@ buildPythonPackage rec {
     lxml
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [ "pyquery" ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/pyro5/default.nix b/pkgs/development/python-modules/pyro5/default.nix
index 7c469595ab74..93ea78d692c8 100644
--- a/pkgs/development/python-modules/pyro5/default.nix
+++ b/pkgs/development/python-modules/pyro5/default.nix
@@ -24,6 +24,8 @@ buildPythonPackage rec {
     serpent
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/pytest-recording/default.nix b/pkgs/development/python-modules/pytest-recording/default.nix
index fe68e9ee46b0..87c0e8d33a02 100644
--- a/pkgs/development/python-modules/pytest-recording/default.nix
+++ b/pkgs/development/python-modules/pytest-recording/default.nix
@@ -33,6 +33,8 @@ buildPythonPackage rec {
     attrs
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   checkInputs = [
     pytestCheckHook
     pytest-httpbin
diff --git a/pkgs/development/python-modules/pytest-remotedata/default.nix b/pkgs/development/python-modules/pytest-remotedata/default.nix
index 544a2e340079..bc8c89caacc1 100644
--- a/pkgs/development/python-modules/pytest-remotedata/default.nix
+++ b/pkgs/development/python-modules/pytest-remotedata/default.nix
@@ -32,6 +32,8 @@ buildPythonPackage rec {
     six
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/pytest-tornasync/default.nix b/pkgs/development/python-modules/pytest-tornasync/default.nix
index ac2cf07736c5..9fca8d860262 100644
--- a/pkgs/development/python-modules/pytest-tornasync/default.nix
+++ b/pkgs/development/python-modules/pytest-tornasync/default.nix
@@ -21,6 +21,8 @@ buildPythonPackage rec {
     tornado
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest
     tornado
diff --git a/pkgs/development/python-modules/pywemo/default.nix b/pkgs/development/python-modules/pywemo/default.nix
index f10288cd381a..dee664897bc0 100644
--- a/pkgs/development/python-modules/pywemo/default.nix
+++ b/pkgs/development/python-modules/pywemo/default.nix
@@ -37,6 +37,8 @@ buildPythonPackage rec {
     lxml
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     hypothesis
     pytest-vcr
diff --git a/pkgs/development/python-modules/pyzipper/default.nix b/pkgs/development/python-modules/pyzipper/default.nix
index d12e396e2db1..a0ad73fb8a3b 100644
--- a/pkgs/development/python-modules/pyzipper/default.nix
+++ b/pkgs/development/python-modules/pyzipper/default.nix
@@ -24,6 +24,8 @@ buildPythonPackage rec {
     pycryptodomex
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/rangehttpserver/default.nix b/pkgs/development/python-modules/rangehttpserver/default.nix
index 010b959edad3..bab8f73b412b 100644
--- a/pkgs/development/python-modules/rangehttpserver/default.nix
+++ b/pkgs/development/python-modules/rangehttpserver/default.nix
@@ -22,6 +22,8 @@ buildPythonPackage rec {
     setuptools
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
     requests
diff --git a/pkgs/development/python-modules/rope/default.nix b/pkgs/development/python-modules/rope/default.nix
index 3a9c947a118d..1168529eea68 100644
--- a/pkgs/development/python-modules/rope/default.nix
+++ b/pkgs/development/python-modules/rope/default.nix
@@ -30,6 +30,8 @@ buildPythonPackage rec {
     pytoolconfig
   ] ++ pytoolconfig.optional-dependencies.global;
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest-timeout
     pytestCheckHook
diff --git a/pkgs/development/python-modules/snakeviz/default.nix b/pkgs/development/python-modules/snakeviz/default.nix
index 0b3767944985..1b8c1c81183b 100644
--- a/pkgs/development/python-modules/snakeviz/default.nix
+++ b/pkgs/development/python-modules/snakeviz/default.nix
@@ -31,6 +31,8 @@ buildPythonPackage rec {
     tornado
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     ipython
     pytestCheckHook
diff --git a/pkgs/development/python-modules/sockio/default.nix b/pkgs/development/python-modules/sockio/default.nix
index 5e1fcbe2a7f1..8ce561b781f9 100644
--- a/pkgs/development/python-modules/sockio/default.nix
+++ b/pkgs/development/python-modules/sockio/default.nix
@@ -27,6 +27,8 @@ buildPythonPackage rec {
       --replace "--durations=2 --verbose" ""
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest-asyncio
     pytestCheckHook
diff --git a/pkgs/development/python-modules/sshfs/default.nix b/pkgs/development/python-modules/sshfs/default.nix
index 653b30f14d0c..f1b47d75b8c5 100644
--- a/pkgs/development/python-modules/sshfs/default.nix
+++ b/pkgs/development/python-modules/sshfs/default.nix
@@ -1,4 +1,5 @@
-{ lib
+{ stdenv
+, lib
 , asyncssh
 , bcrypt
 , buildPythonPackage
@@ -7,6 +8,7 @@
 , mock-ssh-server
 , pytest-asyncio
 , pytestCheckHook
+, setuptools
 , setuptools-scm
 }:
 
@@ -24,6 +26,7 @@ buildPythonPackage rec {
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
@@ -33,12 +36,19 @@ buildPythonPackage rec {
     fsspec
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     mock-ssh-server
     pytest-asyncio
     pytestCheckHook
   ];
 
+  disabledTests = lib.optionals stdenv.isDarwin [
+    # test fails with sandbox enabled
+    "test_checksum"
+  ];
+
   pythonImportsCheck = [
     "sshfs"
   ];
diff --git a/pkgs/development/python-modules/terminado/default.nix b/pkgs/development/python-modules/terminado/default.nix
index 1031ff5b1423..3c75305e9078 100644
--- a/pkgs/development/python-modules/terminado/default.nix
+++ b/pkgs/development/python-modules/terminado/default.nix
@@ -31,12 +31,13 @@ buildPythonPackage rec {
     "terminado"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest-timeout
     pytestCheckHook
   ];
 
-
   meta = with lib; {
     description = "Terminals served by Tornado websockets";
     homepage = "https://github.com/jupyter/terminado";
diff --git a/pkgs/development/python-modules/umodbus/default.nix b/pkgs/development/python-modules/umodbus/default.nix
index 331a4b1306d2..7ce499734203 100644
--- a/pkgs/development/python-modules/umodbus/default.nix
+++ b/pkgs/development/python-modules/umodbus/default.nix
@@ -25,6 +25,8 @@ buildPythonPackage rec {
     pyserial
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/unearth/default.nix b/pkgs/development/python-modules/unearth/default.nix
index cf9e95e41bb2..f1a61014e496 100644
--- a/pkgs/development/python-modules/unearth/default.nix
+++ b/pkgs/development/python-modules/unearth/default.nix
@@ -36,6 +36,8 @@ buildPythonPackage rec {
     cached-property
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     flask
     pytest-httpserver
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index fa57b0072892..25f7e4b98dd9 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -97,6 +97,8 @@ buildPythonPackage rec {
     shortuuid
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     azure-containerregistry
     azure-core
diff --git a/pkgs/development/python-modules/wsgidav/default.nix b/pkgs/development/python-modules/wsgidav/default.nix
index f1b81599c396..9dc51364bc65 100644
--- a/pkgs/development/python-modules/wsgidav/default.nix
+++ b/pkgs/development/python-modules/wsgidav/default.nix
@@ -40,6 +40,8 @@ buildPythonPackage rec {
     pyyaml
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     cheroot
     pytestCheckHook

From 8eff2eea8cbe5893055e1dc831f49c4a40d60179 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Sat, 5 Aug 2023 01:15:48 +0300
Subject: [PATCH 074/115] Revert "Revert "python3: splice python within
 python3Packages.callPackage""

This reverts commit 2ffca30cded859fdbde6f1ae4685e29f92c20424.

`793cc9d982415b71cdba729cf779bfc49e9d2ae7` `python3: splice python within python3Packages.callPackage`
Was reverted because it broke
`pkgsCross.aarch64-multiplatform.python3Packages.cryptography`

But by reverting the revert `pkgsCross.aarch64-multiplatform.python3Packages.cryptography` still builds.

I tried reverting the 2 cryptography update commits, and it still
worked, so I do not know why this would work now.
---
 pkgs/development/interpreters/python/hooks/default.nix | 8 ++++----
 pkgs/development/interpreters/python/passthrufun.nix   | 5 +++--
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index bd29d493ebb8..a653ada4837d 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -1,9 +1,9 @@
-self: super: with self;
+self: dontUse: with self;
 
 let
-  pythonInterpreter = super.python.pythonForBuild.interpreter;
-  pythonSitePackages = super.python.sitePackages;
-  pythonCheckInterpreter = super.python.interpreter;
+  pythonInterpreter = python.pythonForBuild.interpreter;
+  pythonSitePackages = python.sitePackages;
+  pythonCheckInterpreter = python.interpreter;
   setuppy = ../run_setup.py;
 in {
   makePythonHook = args: pkgs.makeSetupHook ({passthru.provides.setupHook = true; } // args);
diff --git a/pkgs/development/interpreters/python/passthrufun.nix b/pkgs/development/interpreters/python/passthrufun.nix
index aa63f354e085..b73885b5e29e 100644
--- a/pkgs/development/interpreters/python/passthrufun.nix
+++ b/pkgs/development/interpreters/python/passthrufun.nix
@@ -47,12 +47,13 @@
         selfTargetTarget = pythonOnTargetForTarget.pkgs or {}; # There is no Python TargetTarget.
       };
       hooks = import ./hooks/default.nix;
-      keep = lib.extends hooks pythonPackagesFun;
+      keep = self: hooks self {};
       extra = _: {};
       optionalExtensions = cond: as: lib.optionals cond as;
       pythonExtension = import ../../../top-level/python-packages.nix;
       python2Extension = import ../../../top-level/python2-packages.nix;
       extensions = lib.composeManyExtensions ([
+        hooks
         pythonExtension
       ] ++ (optionalExtensions (!self.isPy3k) [
         python2Extension
@@ -64,7 +65,7 @@
       otherSplices
       keep
       extra
-      (lib.extends (lib.composeExtensions aliases extensions) keep))
+      (lib.extends (lib.composeExtensions aliases extensions) pythonPackagesFun))
     {
       overrides = packageOverrides;
       python = self;

From b067d888c88512a94f476ac9aa25db27e61572f2 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Sat, 5 Aug 2023 02:02:08 +0200
Subject: [PATCH 075/115] openjdk{8-20}: bump darwin version

---
 .../compilers/openjdk/darwin/11.nix           | 24 +++++++++----------
 .../compilers/openjdk/darwin/16.nix           | 24 +++++++++----------
 .../compilers/openjdk/darwin/17.nix           | 19 +++++++--------
 .../compilers/openjdk/darwin/18.nix           | 19 +++++++--------
 .../compilers/openjdk/darwin/19.nix           | 19 +++++++--------
 .../compilers/openjdk/darwin/20.nix           | 19 +++++++--------
 .../compilers/openjdk/darwin/8.nix            | 24 +++++++++----------
 7 files changed, 72 insertions(+), 76 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/darwin/11.nix b/pkgs/development/compilers/openjdk/darwin/11.nix
index 1ca2901b048d..48de37679385 100644
--- a/pkgs/development/compilers/openjdk/darwin/11.nix
+++ b/pkgs/development/compilers/openjdk/darwin/11.nix
@@ -11,26 +11,26 @@ let
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "11.48.21";
-      jdkVersion = "11.0.11";
-      sha256 =
-        if enableJavaFX then "18bd9cd66d6abc6f8c627bc70278dc8fd4860e138e1dc9e170eddb89727ccc7b"
-        else "0v0n7h7i04pvna41wpdq2k9qiy70sbbqzqzvazfdvgm3gb22asw6";
+      zuluVersion = "11.66.15";
+      jdkVersion = "11.0.20";
+      hash =
+        if enableJavaFX then "sha256-pVgCJkgYTlFeL7nkkMWLeJ/J8ELhgvWb7gzf3erZP7Y="
+        else "sha256-vKqxHP5Yb651g8bZ0xHGQ4Q1T7JjjrmgEuykw/Gh2f0=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "11.48.21";
-      jdkVersion = "11.0.11";
-      sha256 =
-        if enableJavaFX then "ef0de2705c6c2d586812f7f3736b70e22b069545b38034816016f9f264ad43f9"
-        else "066whglrxx81c95grv2kxdbvyh32728ixhml2v44ildh549n4lhc";
+      zuluVersion = "11.66.15";
+      jdkVersion = "11.0.20";
+      hash =
+        if enableJavaFX then "sha256-VoZo34SCUU+HHnTl6iLe0QBC+4VDkPP14N98oqSg9EQ="
+        else "sha256-djK8Kfikt9SSuT87x1p7YWMIlNuF0TZFYDWrKiTTiIU=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
     url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
   javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
@@ -41,7 +41,7 @@ let
 
     src = fetchurl {
       url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/openjdk/darwin/16.nix b/pkgs/development/compilers/openjdk/darwin/16.nix
index b8f6b2d62ad4..657b3eeafeab 100644
--- a/pkgs/development/compilers/openjdk/darwin/16.nix
+++ b/pkgs/development/compilers/openjdk/darwin/16.nix
@@ -11,26 +11,26 @@ let
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "16.30.15";
-      jdkVersion = "16.0.1";
-      sha256 =
-        if enableJavaFX then "cbb3b96d80a0675893f21dc51ba3f532049c501bd7dc4c8d1ee930e63032c745"
-        else "1jihn125dmxr9y5h9jq89zywm3z6rbwv5q7msfzsf2wzrr13jh0z";
+      zuluVersion = "16.32.15";
+      jdkVersion = "16.0.2";
+      hash =
+        if enableJavaFX then "sha256-6URaSBNHQWLauO//kCuKXb4Z7AqyshWnoeJEyVRKgaY="
+        else "sha256-NXgBj/KixTknaCYbo3B+rOo11NImH5CDUIU0LhTCtMo=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "16.30.19";
-      jdkVersion = "16.0.1";
-      sha256 =
-        if enableJavaFX then "a49b23abfd83784d2ac935fc24e25ab7cb09b8ffc8e47c32ed446e05b8a21396"
-        else "1i0bcjx3acb5dhslf6cabdcnd6mrz9728vxw9hb4al5y3f5fll4w";
+      zuluVersion = "16.32.15";
+      jdkVersion = "16.0.2";
+      hash =
+        if enableJavaFX then "sha256-QuyhIAxUY3Vv1adGihW+LIsXtpDX2taCmFsMFj9o5vs="
+        else "sha256-3bUfDcLLyahLeURFAgLAVapBZHvqtam8GHbWTA6MQog=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
     url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
   javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
@@ -41,7 +41,7 @@ let
 
     src = fetchurl {
       url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/openjdk/darwin/17.nix b/pkgs/development/compilers/openjdk/darwin/17.nix
index 51f12864de82..a9a0e73ee150 100644
--- a/pkgs/development/compilers/openjdk/darwin/17.nix
+++ b/pkgs/development/compilers/openjdk/darwin/17.nix
@@ -5,23 +5,22 @@ let
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "17.34.19";
-      jdkVersion = "17.0.3";
-      sha256 = "sha256-qImyxVC2y2QhxuVZwamKPyo46+n+7ytIFXpYI0e6w2c=";
+      zuluVersion = "17.44.15";
+      jdkVersion = "17.0.8";
+      hash = "sha256-Ci18gBkAv/UUIQw9KlnfibcQMXwQRGx6K7L/NBB7b7Q=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "17.34.19";
-      jdkVersion = "17.0.3";
-      sha256 = "sha256-eaRX8Qa/Mqr9JhpHSEcf0Q9c4qmqLMgWqRhkEEwAjf8=";
+      zuluVersion = "17.44.15";
+      jdkVersion = "17.0.8";
+      hash = "sha256-8b81QY6DGXVOsTKM8QDzJnYjXV0ipCbYWaaz6oF2A6k=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
-    # Ugh, unversioned URLs... I hope this doesn't change often enough to cause pain before we move to a Darwin source build of OpenJDK!
-    url = "http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
   jdk = stdenv.mkDerivation rec {
@@ -30,7 +29,7 @@ let
 
     src = fetchurl {
       url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-ca-jdk${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/openjdk/darwin/18.nix b/pkgs/development/compilers/openjdk/darwin/18.nix
index 4744407e5fd2..6d934a30f18a 100644
--- a/pkgs/development/compilers/openjdk/darwin/18.nix
+++ b/pkgs/development/compilers/openjdk/darwin/18.nix
@@ -5,23 +5,22 @@ let
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "18.28.13";
-      jdkVersion = "18.0.0";
-      sha256 = "0hc5m3d4q3n7sighq3pxkdg93vsrgj1kzla1py9nfnm9pnj9l2kq";
+      zuluVersion = "18.32.13";
+      jdkVersion = "18.0.2.1";
+      hash = "sha256-uHPcyOgxUdTgzmIVRp/awtwve9zSt+1TZNef7DUuoRg=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "18.28.13";
-      jdkVersion = "18.0.0";
-      sha256 = "0ch4jp2d4pjvxbmbswvjwf7w2flajrvjg5f16ggiy80y8l0y15cm";
+      zuluVersion = "18.32.13";
+      jdkVersion = "18.0.2.1";
+      hash = "sha256-jAZDgxtWMq/74yKAxA69oOU0C9nXvKG5MjmZLsK04iM=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
-    # Ugh, unversioned URLs... I hope this doesn't change often enough to cause pain before we move to a Darwin source build of OpenJDK!
-    url = "http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
   jdk = stdenv.mkDerivation rec {
@@ -30,7 +29,7 @@ let
 
     src = fetchurl {
       url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-ca-jdk${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/openjdk/darwin/19.nix b/pkgs/development/compilers/openjdk/darwin/19.nix
index e582c4016a54..f98ce511c594 100644
--- a/pkgs/development/compilers/openjdk/darwin/19.nix
+++ b/pkgs/development/compilers/openjdk/darwin/19.nix
@@ -5,23 +5,22 @@ let
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "19.30.11";
-      jdkVersion = "19.0.1";
-      sha256 = "1h0qj0xgpxjy506ikbgdn74pi4860lsnh5n3q3bayfmn0pxc5ksn";
+      zuluVersion = "19.32.13";
+      jdkVersion = "19.0.2";
+      hash = "sha256-KARXWumsY+OcqpEOV2EL9SsPni1nGSipjRji/Mn2KsE=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "19.30.11";
-      jdkVersion = "19.0.1";
-      sha256 = "0g8i371h5fv686xhiff0431sgvdk80lbp2lkz86jpfdv9lgg0qnk";
+      zuluVersion = "19.32.13";
+      jdkVersion = "19.0.2";
+      hash = "sha256-F30FjZaLL756X/Xs6xjNwW9jds4pEATxoxOeeLL7Y5E=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
-    # Ugh, unversioned URLs... I hope this doesn't change often enough to cause pain before we move to a Darwin source build of OpenJDK!
-    url = "http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
   jdk = stdenv.mkDerivation rec {
@@ -30,7 +29,7 @@ let
 
     src = fetchurl {
       url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-ca-jdk${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/openjdk/darwin/20.nix b/pkgs/development/compilers/openjdk/darwin/20.nix
index e26592462e50..db8c93d23772 100644
--- a/pkgs/development/compilers/openjdk/darwin/20.nix
+++ b/pkgs/development/compilers/openjdk/darwin/20.nix
@@ -5,23 +5,22 @@ let
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "20.30.11";
-      jdkVersion = "20.0.1";
-      sha256 = "0hg2n2mdbpxsgpw3c58w8y1f3im6schvfqahji352p9ljbdykzmy";
+      zuluVersion = "20.32.11";
+      jdkVersion = "20.0.2";
+      hash = "sha256-Ev9KG6DvuBnsZrOguLsO1KQzudHCBcJNwKh45Inpnfo=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "20.30.11";
-      jdkVersion = "20.0.1";
-      sha256 = "0bc9h1y0b2azyfl3f5sqj19sh02xs995d1kdn55m4lfhc00rzr81";
+      zuluVersion = "20.32.11";
+      jdkVersion = "20.0.2";
+      hash = "sha256-15uNZ6uMfSASV3QU2q2oA/jBk2PCHOfSjn1GY7/7qIY=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
-    # Ugh, unversioned URLs... I hope this doesn't change often enough to cause pain before we move to a Darwin source build of OpenJDK!
-    url = "http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
   jdk = stdenv.mkDerivation rec {
@@ -30,7 +29,7 @@ let
 
     src = fetchurl {
       url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-ca-jdk${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/openjdk/darwin/8.nix b/pkgs/development/compilers/openjdk/darwin/8.nix
index 3048c53f10f2..9bfd9a8db1a3 100644
--- a/pkgs/development/compilers/openjdk/darwin/8.nix
+++ b/pkgs/development/compilers/openjdk/darwin/8.nix
@@ -11,26 +11,26 @@ let
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "8.54.0.21";
-      jdkVersion = "8.0.292";
-      sha256 =
-        if enableJavaFX then "e671f8990229b1ca2a76faabb21ba2f1a9e1f7211392e0f657225559be9b05c8"
-        else "1pgl0bir4r5v349gkxk54k6v62w241q7vw4gjxhv2g6pfq6hv7in";
+      zuluVersion = "8.72.0.17";
+      jdkVersion = "8.0.382";
+      hash =
+        if enableJavaFX then "sha256-/x8FqygivzddXsOwIV8aj/u+LPXMmokgu97vLAVEv80="
+        else "sha256-3dTPIPGUeT6nb3gncNvEa4VTRyQIBJpp8oZadrT2ToE=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "8.54.0.21";
-      jdkVersion = "8.0.292";
-      sha256 =
-        if enableJavaFX then "8e901075cde2c31f531a34e8321ea4201970936abf54240a232e9389952afe84"
-        else "05w89wfjlfbpqfjnv6wisxmaf13qb28b2223f9264jyx30qszw1c";
+      zuluVersion = "8.72.0.17";
+      jdkVersion = "8.0.382";
+      hash =
+        if enableJavaFX then "sha256-FkQ+0MzSZWUzc/HmiDVZEHGOrdKAVCdK5pm9wXXzzaU="
+        else "sha256-rN5AI4xAWppE4kJlzMod0JmGyHdHjTXYtx8/wOW6CFk=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
     url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
   javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
@@ -44,7 +44,7 @@ let
 
     src = fetchurl {
       url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 

From 26afb65e0e9f1cf70ae728a327784203baa579a2 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 5 Aug 2023 02:38:30 +0200
Subject: [PATCH 076/115] python311Packages.responses: 0.23.1 -> 0.23.3

Diff: https://github.com/getsentry/responses/compare/refs/tags/0.23.1...0.23.3

Changelog: https://github.com/getsentry/responses/blob/0.23.3/CHANGES
---
 pkgs/development/python-modules/responses/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/responses/default.nix b/pkgs/development/python-modules/responses/default.nix
index a1e21b8fbcdc..a35b03680a44 100644
--- a/pkgs/development/python-modules/responses/default.nix
+++ b/pkgs/development/python-modules/responses/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "responses";
-  version = "0.23.1";
+  version = "0.23.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "getsentry";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-BU90nUZVqowFMn78KfbBEf59X7Q/1itvkGFdOzy4D2c=";
+    hash = "sha256-VJmcRMn0O+3mDwzkCwxIX7RU3/I9T9p9N8t6USWDZJQ=";
   };
 
   propagatedBuildInputs = [

From dc5cd92e5074a9c95ed1c99e125cff44c58faf7c Mon Sep 17 00:00:00 2001
From: Tobias Mayer <tobim@fastmail.fm>
Date: Thu, 20 Jul 2023 20:17:15 +0200
Subject: [PATCH 077/115] abseil-cpp_202301: install test helpers

---
 pkgs/development/libraries/abseil-cpp/202301.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/libraries/abseil-cpp/202301.nix b/pkgs/development/libraries/abseil-cpp/202301.nix
index a1c42c5df4b4..da5f1fc029e1 100644
--- a/pkgs/development/libraries/abseil-cpp/202301.nix
+++ b/pkgs/development/libraries/abseil-cpp/202301.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , cmake
+, gtest
 , static ? stdenv.hostPlatform.isStatic
 , cxxStandard ? null
 }:
@@ -18,13 +19,19 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cmakeFlags = [
+    "-DABSL_BUILD_TEST_HELPERS=ON"
+    "-DABSL_USE_EXTERNAL_GOOGLETEST=ON"
     "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
   ] ++ lib.optionals (cxxStandard != null) [
     "-DCMAKE_CXX_STANDARD=${cxxStandard}"
   ];
 
+  strictDeps = true;
+
   nativeBuildInputs = [ cmake ];
 
+  buildInputs = [ gtest ];
+
   meta = with lib; {
     description = "An open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";

From 9e397b9d0042839420047a4154e6e33fd634a846 Mon Sep 17 00:00:00 2001
From: Tobias Mayer <tobim@fastmail.fm>
Date: Thu, 20 Jul 2023 20:19:31 +0200
Subject: [PATCH 078/115] protobuf3: 21.12 -> 24.4

---
 pkgs/development/libraries/protobuf/3.23.nix             | 6 ++++++
 pkgs/development/libraries/protobuf/generic-v3-cmake.nix | 6 ++----
 pkgs/top-level/all-packages.nix                          | 3 ++-
 3 files changed, 10 insertions(+), 5 deletions(-)
 create mode 100644 pkgs/development/libraries/protobuf/3.23.nix

diff --git a/pkgs/development/libraries/protobuf/3.23.nix b/pkgs/development/libraries/protobuf/3.23.nix
new file mode 100644
index 000000000000..2d658d57419b
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/3.23.nix
@@ -0,0 +1,6 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic-v3-cmake.nix ({
+  version = "3.23.4";
+  sha256 = "sha256-eI+mrsZAOLEsdyTC3B+K+GjD3r16CmPx1KJ2KhCwFdg=";
+} // args)
diff --git a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
index dfe2a6d7a965..cca7a1eaa92c 100644
--- a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
+++ b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
@@ -72,12 +72,10 @@ let
       zlib
     ];
 
-    # After 3.20, CMakeLists.txt can now be found at the top-level, however
-    # a stub cmake/CMakeLists.txt still exists for compatibility with previous build assumptions
-    cmakeDir = "../cmake";
+    cmakeDir = if lib.versionOlder version "3.22" then "../cmake" else null;
     cmakeFlags = [
       "-Dprotobuf_ABSL_PROVIDER=package"
-      ] ++ lib.optionals (!stdenv.targetPlatform.isStatic) [
+    ] ++ lib.optionals (!stdenv.targetPlatform.isStatic) [
       "-Dprotobuf_BUILD_SHARED_LIBS=ON"
     ]
     # Tests fail to build on 32-bit platforms; fixed in 3.22
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2dfa00a2dcc2..843fdfdf2665 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -24162,8 +24162,9 @@ with pkgs;
 
   prospector = callPackage ../development/tools/prospector { };
 
-  protobuf = protobuf3_21;
+  protobuf = protobuf3_23;
 
+  protobuf3_23 = callPackage ../development/libraries/protobuf/3.23.nix { };
   protobuf3_21 = callPackage ../development/libraries/protobuf/3.21.nix {
     abseil-cpp = abseil-cpp_202103;
   };

From 9d5713843f65cd0dcf06d40dd34d8b1f2bd25da8 Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Sat, 29 Jul 2023 00:35:01 -0300
Subject: [PATCH 079/115] ed: refactor

A crazy refactor that factors the sources to a separate file, in order to
accomodate extra sources in parallel to the stable one.
---
 pkgs/applications/editors/ed/default.nix | 51 +++++-------------------
 pkgs/applications/editors/ed/generic.nix | 30 ++++++++++++++
 pkgs/applications/editors/ed/sources.nix | 34 ++++++++++++++++
 pkgs/top-level/all-packages.nix          |  3 +-
 4 files changed, 77 insertions(+), 41 deletions(-)
 create mode 100644 pkgs/applications/editors/ed/generic.nix
 create mode 100644 pkgs/applications/editors/ed/sources.nix

diff --git a/pkgs/applications/editors/ed/default.nix b/pkgs/applications/editors/ed/default.nix
index af6c8f7c6f8d..cf27d772596f 100644
--- a/pkgs/applications/editors/ed/default.nix
+++ b/pkgs/applications/editors/ed/default.nix
@@ -1,42 +1,13 @@
-{ lib, stdenv, fetchurl, lzip }:
+{ lib, pkgs }:
 
-# Note: this package is used for bootstrapping fetchurl, and thus
-# cannot use fetchpatch! All mutable patches (generated by GitHub or
-# cgit) that are needed here should be included directly in Nixpkgs as
-# files.
+lib.makeScope pkgs.newScope (self:
+  let
+    inherit (self) callPackage;
+  in {
+    sources = import ./sources.nix {
+      inherit lib;
+      inherit (pkgs) fetchurl;
+    };
 
-stdenv.mkDerivation rec {
-  pname = "ed";
-  version = "1.19";
-
-  src = fetchurl {
-    url = "mirror://gnu/ed/${pname}-${version}.tar.lz";
-    hash = "sha256-zi8uXEJHkKqW0J2suT2bv9wLfrYknJy3U4RS6Ox3zUg=";
-  };
-
-  nativeBuildInputs = [ lzip ];
-
-  configureFlags = [
-    "CC=${stdenv.cc.targetPrefix}cc"
-  ];
-
-  doCheck = true;
-
-  meta = {
-    description = "An implementation of the standard Unix editor";
-    longDescription = ''
-      GNU ed is a line-oriented text editor.  It is used to create,
-      display, modify and otherwise manipulate text files, both
-      interactively and via shell scripts.  A restricted version of ed,
-      red, can only edit files in the current directory and cannot
-      execute shell commands.  Ed is the "standard" text editor in the
-      sense that it is the original editor for Unix, and thus widely
-      available.  For most purposes, however, it is superseded by
-      full-screen editors such as GNU Emacs or GNU Moe.
-    '';
-    license = lib.licenses.gpl3Plus;
-    homepage = "https://www.gnu.org/software/ed/";
-    maintainers = [ ];
-    platforms = lib.platforms.unix;
-  };
-}
+    ed = callPackage (self.sources.ed) { };
+  })
diff --git a/pkgs/applications/editors/ed/generic.nix b/pkgs/applications/editors/ed/generic.nix
new file mode 100644
index 000000000000..70ec6badf25e
--- /dev/null
+++ b/pkgs/applications/editors/ed/generic.nix
@@ -0,0 +1,30 @@
+{ pname
+, version
+, src
+, patches ? [ ]
+, meta
+}:
+
+# Note: this package is used for bootstrapping fetchurl, and thus cannot use
+# fetchpatch! All mutable patches (generated by GitHub or cgit) that are needed
+# here should be included directly in Nixpkgs as files.
+
+{ lib
+, stdenv
+, fetchurl
+, lzip
+}:
+
+stdenv.mkDerivation {
+  inherit pname version src patches;
+
+  nativeBuildInputs = [ lzip ];
+
+  configureFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
+
+  doCheck = true;
+
+  inherit meta;
+}
diff --git a/pkgs/applications/editors/ed/sources.nix b/pkgs/applications/editors/ed/sources.nix
new file mode 100644
index 000000000000..5d3535a834dc
--- /dev/null
+++ b/pkgs/applications/editors/ed/sources.nix
@@ -0,0 +1,34 @@
+{ lib
+, fetchurl
+}:
+
+let
+  meta = {
+    description = "The GNU implementation of the standard Unix editor";
+    longDescription = ''
+      GNU ed is a line-oriented text editor. It is used to create, display,
+      modify and otherwise manipulate text files, both interactively and via
+      shell scripts. A restricted version of ed, red, can only edit files in the
+      current directory and cannot execute shell commands. Ed is the 'standard'
+      text editor in the sense that it is the original editor for Unix, and thus
+      widely available. For most purposes, however, it is superseded by
+      full-screen editors such as GNU Emacs or GNU Moe.
+    '';
+    license = lib.licenses.gpl3Plus;
+    homepage = "https://www.gnu.org/software/ed/";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
+  };
+in
+{
+  ed = let
+    pname = "ed";
+    version = "1.19";
+    src = fetchurl {
+      url = "mirror://gnu/ed/ed-${version}.tar.lz";
+      hash = "sha256-zi8uXEJHkKqW0J2suT2bv9wLfrYknJy3U4RS6Ox3zUg=";
+    };
+  in import ./generic.nix {
+    inherit pname version src meta;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 53d510124184..3b74a7ae8cb1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30991,7 +30991,8 @@ with pkgs;
 
   ecs-agent = callPackage ../applications/virtualization/ecs-agent { };
 
-  ed = callPackage ../applications/editors/ed { };
+  inherit (recurseIntoAttrs (callPackage ../applications/editors/ed { }))
+    ed;
 
   edbrowse = callPackage ../applications/editors/edbrowse { };
 

From 06a4aa3cdf162b54a5f914903750f3871dabea5e Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Sat, 29 Jul 2023 00:44:34 -0300
Subject: [PATCH 080/115] edUnstable: init at 1.20-pre2

---
 pkgs/applications/editors/ed/default.nix |  1 +
 pkgs/applications/editors/ed/sources.nix | 11 +++++++++++
 pkgs/top-level/all-packages.nix          |  2 +-
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/editors/ed/default.nix b/pkgs/applications/editors/ed/default.nix
index cf27d772596f..c1f99de71057 100644
--- a/pkgs/applications/editors/ed/default.nix
+++ b/pkgs/applications/editors/ed/default.nix
@@ -10,4 +10,5 @@ lib.makeScope pkgs.newScope (self:
     };
 
     ed = callPackage (self.sources.ed) { };
+    edUnstable = callPackage (self.sources.edUnstable) { };
   })
diff --git a/pkgs/applications/editors/ed/sources.nix b/pkgs/applications/editors/ed/sources.nix
index 5d3535a834dc..5cb750183053 100644
--- a/pkgs/applications/editors/ed/sources.nix
+++ b/pkgs/applications/editors/ed/sources.nix
@@ -31,4 +31,15 @@ in
   in import ./generic.nix {
     inherit pname version src meta;
   };
+
+  edUnstable = let
+    pname = "ed";
+    version = "1.20-pre2";
+    src = fetchurl {
+      url = "http://download.savannah.gnu.org/releases/ed/ed-${version}.tar.lz";
+      hash = "sha256-bHTDeMhVNNo3qqDNoBNaBA+DHDa4WJpfQNcTvAUPgsY=";
+    };
+  in import ./generic.nix {
+    inherit pname version src meta;
+  };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3b74a7ae8cb1..f878df61904f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30992,7 +30992,7 @@ with pkgs;
   ecs-agent = callPackage ../applications/virtualization/ecs-agent { };
 
   inherit (recurseIntoAttrs (callPackage ../applications/editors/ed { }))
-    ed;
+    ed edUnstable;
 
   edbrowse = callPackage ../applications/editors/edbrowse { };
 

From 842726c6dc3bea1bbed2c3227fc9ed360196e301 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Mon, 27 Feb 2023 23:13:16 +0000
Subject: [PATCH 081/115] fortify-headers: init at 1.1alpine1

---
 .../libraries/fortify-headers/default.nix     | 34 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 ++
 2 files changed, 36 insertions(+)
 create mode 100644 pkgs/development/libraries/fortify-headers/default.nix

diff --git a/pkgs/development/libraries/fortify-headers/default.nix b/pkgs/development/libraries/fortify-headers/default.nix
new file mode 100644
index 000000000000..befead87e6a1
--- /dev/null
+++ b/pkgs/development/libraries/fortify-headers/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, stdenv
+, fetchurl
+}:
+
+stdenv.mkDerivation {
+  pname = "fortify-headers";
+  version = "1.1alpine1";
+
+  # upstream only accessible via git - unusable during bootstrap, hence
+  # extract from the alpine package
+  src = fetchurl {
+    url = "https://dl-cdn.alpinelinux.org/alpine/v3.17/main/x86_64/fortify-headers-1.1-r1.apk";
+    name = "fortify-headers.tar.gz";  # ensure it's extracted as a .tar.gz
+    hash = "sha256-A67NzUv+dldARY+MTaoVnezTg+Es8ZK/b7XOxA6KzpI=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp -r include/fortify $out/include
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Standalone header-based fortify-source implementation";
+    homepage = "https://git.2f30.org/fortify-headers";
+    license = lib.licenses.bsd0;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ ris ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4ed0ff4e5ffe..9676e7e62c7f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -21096,6 +21096,8 @@ with pkgs;
 
   folks = callPackage ../development/libraries/folks { };
 
+  fortify-headers = callPackage ../development/libraries/fortify-headers { };
+
   makeFontsConf = let fontconfig_ = fontconfig; in {fontconfig ? fontconfig_, fontDirectories}:
     callPackage ../development/libraries/fontconfig/make-fonts-conf.nix {
       inherit fontconfig fontDirectories;

From 2b8a7515d884ede294f1ce66558952e80cdf6091 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Sat, 5 Aug 2023 18:13:47 -0700
Subject: [PATCH 082/115] python3.pkgs.gunicorn: replace setuptools with
 packaging dependency

---
 pkgs/development/python-modules/gunicorn/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/gunicorn/default.nix b/pkgs/development/python-modules/gunicorn/default.nix
index 26822853ee28..85023bceedda 100644
--- a/pkgs/development/python-modules/gunicorn/default.nix
+++ b/pkgs/development/python-modules/gunicorn/default.nix
@@ -4,8 +4,8 @@
 , pythonOlder
 , eventlet
 , gevent
+, packaging
 , pytestCheckHook
-, setuptools
 }:
 
 buildPythonPackage rec {
@@ -27,7 +27,7 @@ buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [
-    setuptools
+    packaging
   ];
 
   nativeCheckInputs = [

From a1429b7bc2b9b4beef3f8d68c9f0ea7bc9418589 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sun, 6 Aug 2023 04:20:00 +0000
Subject: [PATCH 083/115] ruby.rubygems: 3.4.17 -> 3.4.18

Changelog: https://github.com/rubygems/rubygems/blob/v3.4.18/CHANGELOG.md
---
 pkgs/development/interpreters/ruby/rubygems/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index e99155f0f3a7..11119b768825 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.4.17";
+  version = "3.4.18";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-SvqqlGPiqHeZQ0Mvulbgc5bM7E1O3HK7BtnbiscG0vE=";
+    hash = "sha256-+yHTJWedZNCkkRMIRT103QMTFJODlbJ2PwVbTghEo0M=";
   };
 
   patches = [

From f3bb6aa4b5e6bfc14649ff869f853b0731d1a1f0 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sun, 6 Aug 2023 04:20:00 +0000
Subject: [PATCH 084/115] bundler: 2.4.17 -> 2.4.18

Changelog: https://github.com/rubygems/rubygems/blob/bundler-v2.4.18/bundler/CHANGELOG.md
---
 pkgs/development/ruby-modules/bundler/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index da157c30a150..2a9ad50c8044 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.4.17";
-  source.sha256 = "sha256-2EV6XnbJ0VPUuw/R/9Kj9Y+/CQyzRIub16Ah0T8ORK0=";
+  version = "2.4.18";
+  source.sha256 = "sha256-tvfScSHUmHSmnJGU1PjvVWsjkMzuxBY1zPTzxYBp9w4=";
   dontPatchShebangs = true;
 
   postFixup = ''

From 524c7521b054ea7217daf501f6c9062dc52b1dbf Mon Sep 17 00:00:00 2001
From: Gabriel Arazas <foodogsquared@foodogsquared.one>
Date: Sun, 23 Apr 2023 13:57:48 +0800
Subject: [PATCH 085/115] guile: cleanup setup hook

---
 .../interpreters/guile/setup-hook-1.8.sh       |  2 +-
 .../interpreters/guile/setup-hook-2.0.sh       | 12 ++++++------
 .../interpreters/guile/setup-hook-2.2.sh       | 12 ++++++------
 .../interpreters/guile/setup-hook-3.0.sh       | 18 +++++++++---------
 4 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/pkgs/development/interpreters/guile/setup-hook-1.8.sh b/pkgs/development/interpreters/guile/setup-hook-1.8.sh
index 946e595ac0bf..9a6ffb793a78 100644
--- a/pkgs/development/interpreters/guile/setup-hook-1.8.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-1.8.sh
@@ -1,6 +1,6 @@
 addGuileLibPath () {
     if test -d "$1/share/guile/site"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site"
     fi
 }
 
diff --git a/pkgs/development/interpreters/guile/setup-hook-2.0.sh b/pkgs/development/interpreters/guile/setup-hook-2.0.sh
index d83f9c647057..9ef0fae011b5 100644
--- a/pkgs/development/interpreters/guile/setup-hook-2.0.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-2.0.sh
@@ -1,18 +1,18 @@
 addGuileLibPath () {
     if test -d "$1/share/guile/site/2.0"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/2.0"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/2.0"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site/2.0"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/share/guile/site/2.0"
     elif test -d "$1/share/guile/site"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/share/guile/site"
     fi
 
     if test -d "$1/lib/guile/2.0/ccache"; then
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.0/ccache"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/lib/guile/2.0/ccache"
     fi
 
     if test -d "$1/lib/guile/2.0/site-ccache"; then
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.0/site-ccache"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/lib/guile/2.0/site-ccache"
     fi
 }
 
diff --git a/pkgs/development/interpreters/guile/setup-hook-2.2.sh b/pkgs/development/interpreters/guile/setup-hook-2.2.sh
index d6bb23e7949a..932a5b6c41e6 100644
--- a/pkgs/development/interpreters/guile/setup-hook-2.2.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-2.2.sh
@@ -1,18 +1,18 @@
 addGuileLibPath () {
     if test -d "$1/share/guile/site/2.2"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/2.2"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/2.2"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site/2.2"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/share/guile/site/2.2"
     elif test -d "$1/share/guile/site"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/share/guile/site"
     fi
 
     if test -d "$1/lib/guile/2.2/ccache"; then
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.2/ccache"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/lib/guile/2.2/ccache"
     fi
 
     if test -d "$1/lib/guile/2.2/site-ccache"; then
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.2/site-ccache"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/lib/guile/2.2/site-ccache"
     fi
 }
 
diff --git a/pkgs/development/interpreters/guile/setup-hook-3.0.sh b/pkgs/development/interpreters/guile/setup-hook-3.0.sh
index 903a1ebfb235..1a71e82d13a2 100644
--- a/pkgs/development/interpreters/guile/setup-hook-3.0.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-3.0.sh
@@ -1,24 +1,24 @@
 addGuileLibPath () {
     if test -d "$1/share/guile/site/3.0"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/3.0"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/3.0"
-        export GUILE_EXTENSIONS_PATH="${GUILE_EXTENSIONS_PATH-}${GUILE_EXTENSIONS_PATH:+:}$1/share/guile/site/3.0"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site/3.0"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/share/guile/site/3.0"
+        addToSearchPath GUILE_EXTENSIONS_PATH "$1/share/guile/site/3.0"
     elif test -d "$1/share/guile/site"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
-        export GUILE_EXTENSIONS_PATH="${GUILE_EXTENSIONS_PATH-}${GUILE_EXTENSIONS_PATH:+:}$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/share/guile/site"
+        addToSearchPath GUILE_EXTENSIONS_PATH "$1/share/guile/site"
     fi
 
     if test -d "$1/lib/guile/3.0/ccache"; then
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/3.0/ccache"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/lib/guile/3.0/ccache"
     fi
 
     if test -d "$1/lib/guile/3.0/site-ccache"; then
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/3.0/site-ccache"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/lib/guile/3.0/site-ccache"
     fi
 
     if test -d "$1/lib/guile/3.0/extensions"; then
-        export GUILE_EXTENSIONS_PATH="${GUILE_EXTENSIONS_PATH-}${GUILE_EXTENSIONS_PATH:+:}$1/lib/guile/3.0/extensions"
+        addToSearchPath GUILE_EXTENSIONS_PATH "$1/lib/guile/3.0/extensions"
     fi
 }
 

From 95c4a1fe96f2f6f406b805754099cb724aafdf42 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Tue, 28 Feb 2023 18:18:51 +0000
Subject: [PATCH 086/115] cc-wrapper: include fortify-headers before libc
 includes for musl

---
 pkgs/build-support/cc-wrapper/default.nix | 18 ++++++++++++++++++
 pkgs/stdenv/linux/default.nix             |  3 +++
 2 files changed, 21 insertions(+)

diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 53141cac5dfb..b4104f351cae 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -51,6 +51,8 @@
 
 # the derivation at which the `-B` and `-L` flags added by `useCcForLibs` will point
 , gccForLibs ? if useCcForLibs then cc else null
+, fortify-headers ? null
+, includeFortifyHeaders ? null
 }:
 
 with lib;
@@ -65,6 +67,10 @@ let
   stdenv = stdenvNoCC;
   inherit (stdenv) hostPlatform targetPlatform;
 
+  includeFortifyHeaders' = if includeFortifyHeaders != null
+    then includeFortifyHeaders
+    else targetPlatform.libc == "musl";
+
   # Prefix for binaries. Customarily ends with a dash separator.
   #
   # TODO(@Ericson2314) Make unconditional, or optional but always true by
@@ -165,6 +171,8 @@ let
     stdenv.targetPlatform.darwinMinVersionVariable;
 in
 
+assert includeFortifyHeaders' -> fortify-headers != null;
+
 # Ensure bintools matches
 assert libc_bin == bintools.libc_bin;
 assert libc_dev == bintools.libc_dev;
@@ -414,6 +422,16 @@ stdenv.mkDerivation {
 
       echo "${libc_lib}" > $out/nix-support/orig-libc
       echo "${libc_dev}" > $out/nix-support/orig-libc-dev
+    ''
+    # fortify-headers is a set of wrapper headers that augment libc
+    # and use #include_next to pass through to libc's true
+    # implementations, so must appear before them in search order.
+    # in theory a correctly placed -idirafter could be used, but in
+    # practice the compiler may have been built with a --with-headers
+    # like option that forces the libc headers before all -idirafter,
+    # hence -isystem here.
+    + optionalString includeFortifyHeaders' ''
+      echo "-isystem ${fortify-headers}/include" >> $out/nix-support/libc-cflags
     '')
 
     ##
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 0e483321b935..34fffd36aa6a 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -194,6 +194,7 @@ let
           inherit lib;
           inherit (prevStage) coreutils gnugrep;
           stdenvNoCC = prevStage.ccWrapperStdenv;
+          fortify-headers = prevStage.fortify-headers;
         }).overrideAttrs(a: lib.optionalAttrs (prevStage.gcc-unwrapped.passthru.isXgcc or false) {
           # This affects only `xgcc` (the compiler which compiles the final compiler).
           postFixup = (a.postFixup or "") + ''
@@ -568,6 +569,7 @@ in
         inherit lib;
         inherit (self) stdenvNoCC coreutils gnugrep;
         shell = self.bash + "/bin/bash";
+        fortify-headers = self.fortify-headers;
       };
     };
     extraNativeBuildInputs = [
@@ -645,6 +647,7 @@ in
         ++  [ linuxHeaders # propagated from .dev
             binutils gcc gcc.cc gcc.cc.lib gcc.expand-response-params gcc.cc.libgcc glibc.passthru.libgcc
           ]
+        ++ lib.optionals (localSystem.libc == "musl") [ fortify-headers ]
         ++ [ prevStage.updateAutotoolsGnuConfigScriptsHook prevStage.gnu-config ]
         ++ (with gcc-unwrapped.passthru; [
           gmp libmpc mpfr isl

From 1f4b42aa79fcaff595139ed33bf60014424e30bb Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Sat, 5 Aug 2023 13:10:55 +0200
Subject: [PATCH 087/115] gnu-config: give sources a name

Should be a little bit less of a mess and no shell wildcard symbols in
the store path.
---
 pkgs/development/libraries/gnu-config/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/gnu-config/default.nix b/pkgs/development/libraries/gnu-config/default.nix
index c0a3219808eb..ca197ad8cf1f 100644
--- a/pkgs/development/libraries/gnu-config/default.nix
+++ b/pkgs/development/libraries/gnu-config/default.nix
@@ -10,10 +10,12 @@ let
 
   # Don't use fetchgit as this is needed during Aarch64 bootstrapping
   configGuess = fetchurl {
+    name = "config.guess-${builtins.substring 0 7 rev}";
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.guess?id=${rev}";
     sha256 = "049qgfh4xjd4fxd7ygm1phd5faqphfvhfcv8dsdldprsp86lf55v";
   };
   configSub = fetchurl {
+    name = "config.sub-${builtins.substring 0 7 rev}";
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.sub?id=${rev}";
     sha256 = "1rk30y27mzls49wyfdb5jhzjr08hkxl7xqhnxmhcmkvqlmpsjnxl";
   };

From 9e34d8ec273f4b2c14b7ba01f4e90e03dbc1ef18 Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Sat, 5 Aug 2023 13:11:33 +0200
Subject: [PATCH 088/115] gnu-config: use install(1) to make buildCommand
 simpler

---
 pkgs/development/libraries/gnu-config/default.nix | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/gnu-config/default.nix b/pkgs/development/libraries/gnu-config/default.nix
index ca197ad8cf1f..a3a0c770245e 100644
--- a/pkgs/development/libraries/gnu-config/default.nix
+++ b/pkgs/development/libraries/gnu-config/default.nix
@@ -24,11 +24,8 @@ in stdenv.mkDerivation {
   version = "2023-01-21";
 
   buildCommand = ''
-    mkdir -p $out
-    cp ${configGuess} $out/config.guess
-    cp ${configSub} $out/config.sub
-
-    chmod +x $out/config.*
+    install -Dm755 ${configGuess} $out/config.guess
+    install -Dm755 ${configSub} $out/config.sub
   '';
 
   meta = with lib; {

From 9e910fdd8b11b421a3ed4535874f97d1f4715aef Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Sat, 5 Aug 2023 13:11:55 +0200
Subject: [PATCH 089/115] gnu-config: 2023-01-21 -> 2023-07-31

The most interesting change for us is that gnu-config can now [accept]
`*-unknown-none-elf` which means we can use target triples for
lib.systems.*-embedded that are interpreted in the same way by both
nixpkgs and gnu-config.

Reference #165836.

[accept]: https://git.savannah.gnu.org/cgit/config.git/commit/?id=998ba1414387b4ce1a519be234e1609bc7912e0c
---
 pkgs/development/libraries/gnu-config/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/gnu-config/default.nix b/pkgs/development/libraries/gnu-config/default.nix
index a3a0c770245e..75a20bbbc355 100644
--- a/pkgs/development/libraries/gnu-config/default.nix
+++ b/pkgs/development/libraries/gnu-config/default.nix
@@ -6,22 +6,22 @@
 # files.
 
 let
-  rev = "63acb96f92473ceb5e21d873d7c0aee266b3d6d3";
+  rev = "d4e37b5868ef910e3e52744c34408084bb13051c";
 
   # Don't use fetchgit as this is needed during Aarch64 bootstrapping
   configGuess = fetchurl {
     name = "config.guess-${builtins.substring 0 7 rev}";
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.guess?id=${rev}";
-    sha256 = "049qgfh4xjd4fxd7ygm1phd5faqphfvhfcv8dsdldprsp86lf55v";
+    sha256 = "191czpnbc1nxrygg8fd3839y1f4m9x43rp57vgrsas6p07zzh3c1";
   };
   configSub = fetchurl {
     name = "config.sub-${builtins.substring 0 7 rev}";
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.sub?id=${rev}";
-    sha256 = "1rk30y27mzls49wyfdb5jhzjr08hkxl7xqhnxmhcmkvqlmpsjnxl";
+    sha256 = "0148p54gw10p6sk2rn3gi9vvqm89rk8kcvl9335ckayhanx31381";
   };
 in stdenv.mkDerivation {
   pname = "gnu-config";
-  version = "2023-01-21";
+  version = "2023-07-31";
 
   buildCommand = ''
     install -Dm755 ${configGuess} $out/config.guess

From 91d0b754b83a292eeda83e10e247f4e464df41ad Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 7 Aug 2023 00:23:23 +0000
Subject: [PATCH 090/115] roc-toolkit: 0.2.4 -> 0.2.5

---
 pkgs/development/libraries/audio/roc-toolkit/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/audio/roc-toolkit/default.nix b/pkgs/development/libraries/audio/roc-toolkit/default.nix
index 878f499ccbbb..c2cdd5285aa3 100644
--- a/pkgs/development/libraries/audio/roc-toolkit/default.nix
+++ b/pkgs/development/libraries/audio/roc-toolkit/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "roc-toolkit";
-  version = "0.2.4";
+  version = "0.2.5";
 
   outputs = [ "out" "dev" ];
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "roc-streaming";
     repo = "roc-toolkit";
     rev = "v${version}";
-    hash = "sha256-x4+/MIFKcos9xWhvSNWdsUQA2oLiyYS0MJE60HY/3hQ=";
+    hash = "sha256-vosw4H3YTTCXdDOnQQYRNZgufPo1BxUtfg6jutArzTI=";
   };
 
   nativeBuildInputs = [

From 039571384104482363a3ea46be13f55aee9eb383 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 7 Aug 2023 00:45:57 +0000
Subject: [PATCH 091/115] openexr_3: 3.1.7 -> 3.1.10

---
 pkgs/development/libraries/openexr/3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/openexr/3.nix b/pkgs/development/libraries/openexr/3.nix
index 243d8830565d..1bd8e63d37f9 100644
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "3.1.7";
+  version = "3.1.10";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    sha256 = "sha256-Kl+aOA797aZvrvW4ZQNHdSU7YFPieZEzX3aYeaoH6eU=";
+    sha256 = "sha256-8oV7Himk9AS2e2Z3OREE7KQgFIUysXwATlUN51dDe5M=";
   };
 
   outputs = [ "bin" "dev" "out" "doc" ];

From decf1f8d738b37b71162f7b17731f666ffc6cc60 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Mon, 7 Aug 2023 00:15:30 -0700
Subject: [PATCH 092/115] python3.pkgs.flit-core: remove passthru tests
 (#245671)

These tests are run as part of building the "flit" application. There
are no flit-core specific tests.
---
 .../python-modules/flit-core/default.nix      | 18 ++-------------
 .../python-modules/flit-core/tests.nix        | 22 -------------------
 2 files changed, 2 insertions(+), 38 deletions(-)
 delete mode 100644 pkgs/development/python-modules/flit-core/tests.nix

diff --git a/pkgs/development/python-modules/flit-core/default.nix b/pkgs/development/python-modules/flit-core/default.nix
index c81a8567de2f..16c15e4249cb 100644
--- a/pkgs/development/python-modules/flit-core/default.nix
+++ b/pkgs/development/python-modules/flit-core/default.nix
@@ -1,6 +1,5 @@
 { lib
 , buildPythonPackage
-, callPackage
 , flit
 }:
 
@@ -9,28 +8,15 @@ buildPythonPackage rec {
   inherit (flit) version;
   format = "pyproject";
 
-  outputs = [
-    "out"
-    "testsout"
-  ];
-
   inherit (flit) src patches;
 
-  preConfigure = ''
-    cd flit_core
-  '';
+  sourceRoot = "source/flit_core";
 
-  postInstall = ''
-    mkdir $testsout
-    cp -R ../tests $testsout/tests
-  '';
-
-  # check in passthru.tests.pytest to escape infinite recursion with setuptools-scm
+  # Tests are run in the "flit" package.
   doCheck = false;
 
   passthru.tests = {
     inherit flit;
-    pytest = callPackage ./tests.nix { };
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/flit-core/tests.nix b/pkgs/development/python-modules/flit-core/tests.nix
deleted file mode 100644
index 49d6ac89fce6..000000000000
--- a/pkgs/development/python-modules/flit-core/tests.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ buildPythonPackage
-, flit
-, flit-core
-, pytestCheckHook
-, testpath
-}:
-
-buildPythonPackage {
-  pname = "flit-core";
-  inherit (flit-core) version;
-
-  src = flit-core.testsout;
-
-  dontBuild = true;
-  dontInstall = true;
-
-  nativeCheckInputs = [
-    flit
-    pytestCheckHook
-    testpath
-  ];
-}

From 1b66a9059256ee6873fda5955db11e1dbb4613b5 Mon Sep 17 00:00:00 2001
From: Sebastian Sellmeier <mail@sebastian-sellmeier.de>
Date: Thu, 3 Aug 2023 10:08:09 +0200
Subject: [PATCH 093/115] go: Don't symlink bin-directory but binaries instead
 to avoid breaking pkgs.symlinkJoin without error-message

---
 pkgs/development/compilers/go/1.18.nix | 3 ++-
 pkgs/development/compilers/go/1.19.nix | 3 ++-
 pkgs/development/compilers/go/1.20.nix | 3 ++-
 pkgs/development/compilers/go/1.21.nix | 3 ++-
 4 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/compilers/go/1.18.nix b/pkgs/development/compilers/go/1.18.nix
index de74e99d9bb4..5490bc1fc598 100644
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@@ -166,7 +166,8 @@ stdenv.mkDerivation rec {
     runHook preInstall
     mkdir -p $GOROOT_FINAL
     cp -a bin pkg src lib misc api doc $GOROOT_FINAL
-    ln -s $GOROOT_FINAL/bin $out/bin
+    mkdir -p $out/bin
+    ln -s $GOROOT_FINAL/bin/* $out/bin
     runHook postInstall
   '';
 
diff --git a/pkgs/development/compilers/go/1.19.nix b/pkgs/development/compilers/go/1.19.nix
index 0ce8fcc659a8..d123c69319ee 100644
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@@ -166,7 +166,8 @@ stdenv.mkDerivation rec {
     runHook preInstall
     mkdir -p $GOROOT_FINAL
     cp -a bin pkg src lib misc api doc $GOROOT_FINAL
-    ln -s $GOROOT_FINAL/bin $out/bin
+    mkdir -p $out/bin
+    ln -s $GOROOT_FINAL/bin/* $out/bin
     runHook postInstall
   '';
 
diff --git a/pkgs/development/compilers/go/1.20.nix b/pkgs/development/compilers/go/1.20.nix
index bd226f32157a..3364ea354019 100644
--- a/pkgs/development/compilers/go/1.20.nix
+++ b/pkgs/development/compilers/go/1.20.nix
@@ -158,7 +158,8 @@ stdenv.mkDerivation rec {
     runHook preInstall
     mkdir -p $GOROOT_FINAL
     cp -a bin pkg src lib misc api doc $GOROOT_FINAL
-    ln -s $GOROOT_FINAL/bin $out/bin
+    mkdir -p $out/bin
+    ln -s $GOROOT_FINAL/bin/* $out/bin
     runHook postInstall
   '';
 
diff --git a/pkgs/development/compilers/go/1.21.nix b/pkgs/development/compilers/go/1.21.nix
index cdd91ab1e632..1c9404faadc6 100644
--- a/pkgs/development/compilers/go/1.21.nix
+++ b/pkgs/development/compilers/go/1.21.nix
@@ -158,7 +158,8 @@ stdenv.mkDerivation rec {
     runHook preInstall
     mkdir -p $GOROOT_FINAL
     cp -a bin pkg src lib misc api doc $GOROOT_FINAL
-    ln -s $GOROOT_FINAL/bin $out/bin
+    mkdir -p $out/bin
+    ln -s $GOROOT_FINAL/bin/* $out/bin
     runHook postInstall
   '';
 

From 1b6e441e020a40edd7fdeed8a19f8dda0f8fc104 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Anselm=20Sch=C3=BCler?= <mail@anselmschueler.com>
Date: Sun, 6 Aug 2023 21:39:37 +0200
Subject: [PATCH 094/115] graphviz: 8.0.5 -> 8.1.0

---
 pkgs/tools/graphics/graphviz/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/graphics/graphviz/default.nix b/pkgs/tools/graphics/graphviz/default.nix
index 1b7fd162dba5..71892916ad7a 100644
--- a/pkgs/tools/graphics/graphviz/default.nix
+++ b/pkgs/tools/graphics/graphviz/default.nix
@@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "graphviz";
-  version = "8.0.5";
+  version = "8.1.0";
 
   src = fetchFromGitLab {
     owner = "graphviz";
     repo = "graphviz";
     rev = version;
-    hash = "sha256-s3AUOLZhehxs2GcDCsq87RVvsDli1NvvQtwI0AyUs4k=";
+    hash = "sha256-xTdrtwSpizqf5tNRX0Q0w10mEk4S0X7cmxHj3Us14kY=";
   };
 
   nativeBuildInputs = [

From 6d54e6346c880ca67819cd787893275851008d0f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 7 Aug 2023 11:40:46 +0200
Subject: [PATCH 095/115] gnutls: 3.8.0 -> 3.8.1

https://lists.gnupg.org/pipermail/gnutls-help/2023-August/004834.html
---
 pkgs/development/libraries/gnutls/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 2a6d0d1088ba..1ac761514ad1 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -33,11 +33,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnutls";
-  version = "3.8.0";
+  version = "3.8.1";
 
   src = fetchurl {
     url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
-    sha256 = "sha256-DqDRGhZgoeY/lg8Vexl6vm0MjLMlW+JOH7OBWTC5vcU=";
+    hash = "sha256-uoueFa4gq6iPRGYZePW1hjSUMW/n5yLt6dBp/mKUgpw=";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];

From 520a544ee5f90541b8a457b12d3d17f74f80d515 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Mon, 7 Aug 2023 18:20:56 +0300
Subject: [PATCH 096/115] setup-hooks/strip: Create the log file in '$TMDPIR'

vcunat said

> This invocation of mktemp creates the file in the current directory, which is bad practice. We should add "--tmpdir=$TMPDIR" or make the template absolute.

> I noticed because one package did cd $src during installing, which is a read-only path...
---
 pkgs/build-support/setup-hooks/strip.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/setup-hooks/strip.sh b/pkgs/build-support/setup-hooks/strip.sh
index 5f53e7e95b2e..d2422bb84234 100644
--- a/pkgs/build-support/setup-hooks/strip.sh
+++ b/pkgs/build-support/setup-hooks/strip.sh
@@ -65,7 +65,7 @@ stripDirs() {
     if [ -n "${paths}" ]; then
         echo "stripping (with command $cmd and flags $stripFlags) in $paths"
         local striperr
-        striperr="$(mktemp 'striperr.XXXXXX')"
+        striperr="$(mktemp --tmpdir="$TMPDIR" 'striperr.XXXXXX')"
         # Do not strip lib/debug. This is a directory used by setup-hooks/separate-debug-info.sh.
         find $paths -type f -a '!' -path "$prefix/lib/debug/*" -print0 |
             # Make sure we process files under symlinks only once. Otherwise

From 3e7b01767fd23c2a330602e8b89a461095944464 Mon Sep 17 00:00:00 2001
From: pacien <pacien.trangirard@pacien.net>
Date: Mon, 7 Aug 2023 17:54:41 +0200
Subject: [PATCH 097/115] mercurial: 6.5 -> 6.5.1

Changelog: https://wiki.mercurial-scm.org/Release6.5
---
 pkgs/applications/version-management/mercurial/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 258bc5d71ddc..f347ed884eff 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -21,11 +21,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.5";
+    version = "6.5.1";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "sha256-pWA9DTlev2f+XSeruzvTf8wBhx7POUx5NnLSweaL5+c=";
+      sha256 = "sha256-M/fejYs2B/orQIzeS4cl4RfrCtQZJqeH6qtAnKik/C8=";
     };
 
     format = "other";
@@ -35,7 +35,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "mercurial-${version}";
-      sha256 = "sha256-umjOU3OmTdPmLS4IWncqmKxSa6J4KXwTlGhylFt6TQo=";
+      sha256 = "sha256-tPv0UeZOsHDGKzXWeA/fFio7d3EN+KGioDu/1WH1drc=";
       sourceRoot = "mercurial-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;

From e6990d6cc40484fe09ce7309b955dbd85a6f0d32 Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Mon, 18 Jul 2022 01:32:12 +0200
Subject: [PATCH 098/115] python3Packages.ffmpy: init at 0.3.1

Co-authored-by: Yt <happysalada@tuta.io>
---
 .../python-modules/ffmpy/default.nix          | 55 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 57 insertions(+)
 create mode 100644 pkgs/development/python-modules/ffmpy/default.nix

diff --git a/pkgs/development/python-modules/ffmpy/default.nix b/pkgs/development/python-modules/ffmpy/default.nix
new file mode 100644
index 000000000000..c3b0c6078f42
--- /dev/null
+++ b/pkgs/development/python-modules/ffmpy/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, go
+, ffmpeg-headless
+}:
+
+buildPythonPackage rec {
+  pname = "ffmpy";
+  version = "0.3.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "Ch00k";
+    repo = "ffmpy";
+    rev = "refs/tags/${version}";
+    hash = "sha256-kuLhmCG80BmXdqpW67UanBnuYiL2Oh1jKt7IgmVNEAM=";
+  };
+
+  postPatch = ''
+    # default to store ffmpeg
+    substituteInPlace ffmpy.py \
+      --replace 'executable="ffmpeg",' 'executable="${ffmpeg-headless}/bin/ffmpeg",'
+
+    #  The tests test a mock that does not behave like ffmpeg. If we default to the nix-store ffmpeg they fail.
+    for fname in tests/*.py; do
+      echo 'FFmpeg.__init__.__defaults__ = ("ffmpeg", *FFmpeg.__init__.__defaults__[1:])' >>"$fname"
+    done
+  '';
+
+  pythonImportsCheck = [ "ffmpy" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    go
+  ];
+
+  # the vendored ffmpeg mock binary assumes FHS
+  preCheck = ''
+    rm -v tests/ffmpeg/ffmpeg
+    HOME=$(mktemp -d) go build -o ffmpeg tests/ffmpeg/ffmpeg.go
+    export PATH=".:$PATH"
+  '';
+
+  meta = with lib; {
+    description = "A simple python interface for FFmpeg/FFprobe";
+    homepage = "https://github.com/Ch00k/ffmpy";
+    license = licenses.mit;
+    maintainers = with maintainers; [ pbsds ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 68844e9cf780..b391d4b86483 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3673,6 +3673,8 @@ self: super: with self; {
 
   ffmpeg-progress-yield = callPackage ../development/python-modules/ffmpeg-progress-yield { };
 
+  ffmpy = callPackage ../development/python-modules/ffmpy { };
+
   fiblary3-fork = callPackage ../development/python-modules/fiblary3-fork { };
 
   fido2 = callPackage ../development/python-modules/fido2 { };

From c0c84051fd74e070509dd4e4fcb86c5af39f636c Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Mon, 26 Jun 2023 22:04:00 +0200
Subject: [PATCH 099/115] python3Packages.markdown-it-py: fix linkify extra

linkify-it-py is on version 2.0.0, while markdown-it-py[linkify] depends on linkify-it-py~=1.0
---
 pkgs/development/python-modules/markdown-it-py/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/python-modules/markdown-it-py/default.nix b/pkgs/development/python-modules/markdown-it-py/default.nix
index 38d92159f3b2..3330817fb8a4 100644
--- a/pkgs/development/python-modules/markdown-it-py/default.nix
+++ b/pkgs/development/python-modules/markdown-it-py/default.nix
@@ -19,6 +19,7 @@
 , stdenv
 , pytest-regressions
 , pytestCheckHook
+, pythonRelaxDepsHook
 , pythonOlder
 }:
 
@@ -36,7 +37,13 @@ buildPythonPackage rec {
     hash = "sha256-qdRU1BxczFDGoIEtl0ZMkKNn4p5tec8YuPt5ZwX5fYM=";
   };
 
+  # fix downstrem usage of markdown-it-py[linkify]
+  pythonRelaxDeps = [
+    "linkify-it-py"
+  ];
+
   nativeBuildInputs = [
+    pythonRelaxDepsHook
     flit-core
   ];
 

From 94ea536fc7a8fcba4b6e15f0c0d90a53c0ef2425 Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Mon, 18 Jul 2022 02:35:11 +0200
Subject: [PATCH 100/115] python3Packages.gradio: init at 3.20.1

Co-authored-by: Yt <happysalada@tuta.io>
---
 .../gradio/conftest-skip-network-errors.py    |  57 ++++++
 .../python-modules/gradio/default.nix         | 175 ++++++++++++++++++
 pkgs/top-level/python-packages.nix            |   2 +
 3 files changed, 234 insertions(+)
 create mode 100644 pkgs/development/python-modules/gradio/conftest-skip-network-errors.py
 create mode 100644 pkgs/development/python-modules/gradio/default.nix

diff --git a/pkgs/development/python-modules/gradio/conftest-skip-network-errors.py b/pkgs/development/python-modules/gradio/conftest-skip-network-errors.py
new file mode 100644
index 000000000000..4738de317552
--- /dev/null
+++ b/pkgs/development/python-modules/gradio/conftest-skip-network-errors.py
@@ -0,0 +1,57 @@
+# This is a pytest hook that skips tests that tries to access the network.
+# These tests will immediately fail, then get marked as "Expected fail" (xfail).
+
+from _pytest.runner import pytest_runtest_makereport as orig_pytest_runtest_makereport
+
+# We use BaseException to minimize the chance it gets caught and 'pass'ed
+class NixNetworkAccessDeniedError(BaseException):
+    pass
+
+def pytest_runtest_makereport(item, call):
+    """
+    Modifies test results after-the-fact. The function name is magic, see:
+    https://docs.pytest.org/en/7.1.x/reference/reference.html?highlight=pytest_runtest_makereport#std-hook-pytest_runtest_makereport
+    """
+
+    def iterate_exc_chain(exc: Exception):
+        """
+        Recurses through exception chain, yielding all exceptions
+        """
+        yield exc
+        if getattr(exc, "__context__", None) is not None:
+            yield from iterate_exc_chain(exc.__context__)
+        if getattr(exc, "__cause__", None) is not None:
+            yield from iterate_exc_chain(exc.__cause__)
+
+    tr = orig_pytest_runtest_makereport(item, call)
+    if call.excinfo is not None:
+        for exc in iterate_exc_chain(call.excinfo.value):
+            if isinstance(exc, NixNetworkAccessDeniedError):
+                tr.outcome, tr.wasxfail = 'skipped', "reason: Requires network access."
+            if isinstance(exc, FileNotFoundError):  # gradio specific
+                tr.outcome, tr.wasxfail = 'skipped', "reason: Pypi dist bad."
+    return tr
+
+# replace network access with exception
+
+def deny_network_access(*a, **kw):
+    raise NixNetworkAccessDeniedError
+
+import httpx
+import requests
+import socket
+import urllib
+import urllib3
+import websockets
+
+httpx.AsyncClient.get = deny_network_access
+httpx.AsyncClient.head = deny_network_access
+httpx.Request = deny_network_access
+requests.get = deny_network_access
+requests.head = deny_network_access
+requests.post = deny_network_access
+socket.socket.connect = deny_network_access
+urllib.request.Request = deny_network_access
+urllib.request.urlopen = deny_network_access
+urllib3.connection.HTTPSConnection._new_conn = deny_network_access
+websockets.connect = deny_network_access
diff --git a/pkgs/development/python-modules/gradio/default.nix b/pkgs/development/python-modules/gradio/default.nix
new file mode 100644
index 000000000000..ffb99d729328
--- /dev/null
+++ b/pkgs/development/python-modules/gradio/default.nix
@@ -0,0 +1,175 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, pythonRelaxDepsHook
+, writeText
+
+# pyproject
+, hatchling
+, hatch-requirements-txt
+, hatch-fancy-pypi-readme
+
+# runtime
+, setuptools
+, aiofiles
+, aiohttp
+, altair
+, fastapi
+, ffmpy
+, markdown-it-py
+, mdit-py-plugins
+, markupsafe
+, matplotlib
+, numpy
+, orjson
+, pandas
+, pillow
+, pycryptodome
+, python-multipart
+, pydub
+, pyyaml
+, requests
+, uvicorn
+, jinja2
+, fsspec
+, httpx
+, pydantic
+, websockets
+, typing-extensions
+
+# check
+, pytestCheckHook
+, pytest-asyncio
+, mlflow
+, huggingface-hub
+, transformers
+, wandb
+, respx
+, scikit-image
+, ipython
+, ffmpeg
+, vega_datasets
+, boto3
+}:
+
+buildPythonPackage rec {
+  pname = "gradio";
+  version = "3.20.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  # We use the Pypi release, as it provides prebuilt webui assets,
+  # and has more frequent releases compared to github tags
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-oG97GwehyBWjWXzDqyfj+x2mAfM6OQhYKdA3j0Rv8Vs=";
+  };
+
+  pythonRelaxDeps = [
+    "mdit-py-plugins"
+  ];
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    hatchling
+    hatch-requirements-txt
+    hatch-fancy-pypi-readme
+  ];
+
+  propagatedBuildInputs = [
+    setuptools # needs pkg_resources
+    aiofiles
+    aiohttp
+    altair
+    fastapi
+    ffmpy
+    markdown-it-py
+    mdit-py-plugins
+    markupsafe
+    matplotlib
+    numpy
+    orjson
+    pandas
+    pillow
+    pycryptodome
+    python-multipart
+    pydub
+    pyyaml
+    requests
+    uvicorn
+    jinja2
+    fsspec
+    httpx
+    pydantic
+    websockets
+    typing-extensions
+  ] ++ markdown-it-py.optional-dependencies.linkify;
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+    mlflow
+    #comet-ml # FIXME: enable once packaged
+    huggingface-hub
+    transformers
+    wandb
+    respx
+    scikit-image
+    ipython
+    ffmpeg
+    vega_datasets
+    boto3
+    # shap is needed as well, but breaks too often
+  ];
+
+  # Add a pytest hook skipping tests that access network, marking them as "Expected fail" (xfail).
+  # We additionally xfail FileNotFoundError, since the gradio devs often fail to upload test assets to pypi.
+  preCheck = let
+  in ''
+    export HOME=$TMPDIR
+    cat ${./conftest-skip-network-errors.py} >> test/conftest.py
+  '';
+
+  disabledTests = [
+    # Actually broken
+    "test_mount_gradio_app"
+
+    # FIXME: enable once comet-ml is packaged
+    "test_inline_display"
+    "test_integration_comet"
+
+    # Flaky, tries to pin dependency behaviour. Sensitive to dep versions
+    # These error only affect downstream use of the check dependencies.
+    "test_no_color"
+    "test_in_interface_as_output"
+    "test_should_warn_url_not_having_version"
+
+    # Flaky, unknown reason
+    "test_in_interface"
+
+    # shap is too often broken in nixpkgs
+    "test_shapley_text"
+  ];
+  disabledTestPaths = [
+    # makes pytest freeze 50% of the time
+    "test/test_interfaces.py"
+  ];
+  #pytestFlagsArray = [ "-x" "-W" "ignore" ]; # uncomment for debugging help
+
+  # check the binary works outside the build env
+  doInstallCheck = true;
+  postInstallCheck = ''
+    env --ignore-environment $out/bin/gradio --help >/dev/null
+  '';
+
+  pythonImportsCheck = [ "gradio" ];
+
+  meta = with lib; {
+    homepage = "https://www.gradio.app/";
+    description = "Python library for easily interacting with trained machine learning models";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ pbsds ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b391d4b86483..8f3191230641 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4475,6 +4475,8 @@ self: super: with self; {
 
   gradient_statsd = callPackage ../development/python-modules/gradient_statsd { };
 
+  gradio = callPackage ../development/python-modules/gradio { };
+
   grammalecte = callPackage ../development/python-modules/grammalecte { };
 
   grandalf = callPackage ../development/python-modules/grandalf { };

From f6332ded451f1acc9b176a6dd180b1a073f8b509 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Tue, 8 Aug 2023 03:45:14 -0700
Subject: [PATCH 101/115] python3.pkgs.ansi2html: dependency cleanup (#247246)

Some dependencies can be removed, and some build dependencies need to
be added to prepare for stricter dependency validation.
---
 .../python-modules/ansi2html/default.nix      | 32 +++++++++++++++----
 1 file changed, 26 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/ansi2html/default.nix b/pkgs/development/python-modules/ansi2html/default.nix
index 97553b1b31e1..192ecaf2eab4 100644
--- a/pkgs/development/python-modules/ansi2html/default.nix
+++ b/pkgs/development/python-modules/ansi2html/default.nix
@@ -1,22 +1,42 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k, six, mock, pytestCheckHook, setuptools, setuptools-scm }:
+{ lib
+, buildPythonPackage
+, fetchpatch
+, fetchPypi
+, pytestCheckHook
+, setuptools
+, setuptools-scm
+, wheel
+}:
 
 buildPythonPackage rec {
   pname = "ansi2html";
   version = "1.8.0";
   format = "pyproject";
 
-  disabled = !isPy3k;
-
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-OLgqKYSCofomE/D5yb6z23Ko+DLurFjrLke/Ms039tU=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
-  propagatedBuildInputs = [ six setuptools ];
+  patches = [
+    (fetchpatch {
+      name = "update-build-requirements.patch";
+      url = "https://github.com/pycontribs/ansi2html/commit/be9c47dd39e500b2e34e95efde90d0a3b44daaee.patch";
+      hash = "sha256-nvOclsgysg+4sK694ppls0BLfq5MCJJQW3V/Ru30D/k=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
 
   preCheck = "export PATH=$PATH:$out/bin";
-  nativeCheckInputs = [ mock pytestCheckHook ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "ansi2html" ];
 

From 72b94272c96eef5fe866d10fd76544e54789759c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Thu, 10 Aug 2023 10:49:37 +0200
Subject: [PATCH 102/115] python3Packages.oscrypto: fixup with openssl 3.0.10

---
 pkgs/development/python-modules/oscrypto/default.nix  |  4 ++++
 .../oscrypto/support-openssl-3.0.10.patch             | 11 +++++++++++
 2 files changed, 15 insertions(+)
 create mode 100644 pkgs/development/python-modules/oscrypto/support-openssl-3.0.10.patch

diff --git a/pkgs/development/python-modules/oscrypto/default.nix b/pkgs/development/python-modules/oscrypto/default.nix
index 3f368ba7f1ab..92edbdf84eb9 100644
--- a/pkgs/development/python-modules/oscrypto/default.nix
+++ b/pkgs/development/python-modules/oscrypto/default.nix
@@ -22,6 +22,10 @@ buildPythonPackage rec {
     hash = "sha256-CmDypmlc/kb6ONCUggjT1Iqd29xNSLRaGh5Hz36dvOw=";
   };
 
+  patches = [
+    ./support-openssl-3.0.10.patch
+  ];
+
   postPatch = ''
     for file in oscrypto/_openssl/_lib{crypto,ssl}_c{ffi,types}.py; do
       substituteInPlace $file \
diff --git a/pkgs/development/python-modules/oscrypto/support-openssl-3.0.10.patch b/pkgs/development/python-modules/oscrypto/support-openssl-3.0.10.patch
new file mode 100644
index 000000000000..585eb64eaa47
--- /dev/null
+++ b/pkgs/development/python-modules/oscrypto/support-openssl-3.0.10.patch
@@ -0,0 +1,11 @@
+https://github.com/wbond/oscrypto/issues/75
+--- a/oscrypto/_openssl/_libcrypto_cffi.py
++++ b/oscrypto/_openssl/_libcrypto_cffi.py
+@@ -37,1 +37,1 @@
+-version_match = re.search('\\b(\\d\\.\\d\\.\\d[a-z]*)\\b', version_string)
++version_match = re.search('\\b(\\d\\.\\d\\.\\d+[a-z]*)\\b', version_string)
+--- a/oscrypto/_openssl/_libcrypto_ctypes.py
++++ b/oscrypto/_openssl/_libcrypto_ctypes.py
+@@ -40,1 +40,1 @@
+-version_match = re.search('\\b(\\d\\.\\d\\.\\d[a-z]*)\\b', version_string)
++version_match = re.search('\\b(\\d\\.\\d\\.\\d+[a-z]*)\\b', version_string)

From 61f38f6046f0441bf59b008b0597920d94263ddf Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 10 Aug 2023 00:14:13 -0700
Subject: [PATCH 103/115] protobuf: move abseil-cpp to propagatedBuildInputs

---
 pkgs/development/libraries/protobuf/generic-v3-cmake.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
index cca7a1eaa92c..7270f0cbf607 100644
--- a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
+++ b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
@@ -68,10 +68,13 @@ let
     ];
 
     buildInputs = [
-      abseil-cpp
       zlib
     ];
 
+    propagatedBuildInputs = [
+      abseil-cpp
+    ];
+
     cmakeDir = if lib.versionOlder version "3.22" then "../cmake" else null;
     cmakeFlags = [
       "-Dprotobuf_ABSL_PROVIDER=package"

From 71f1732d40df62d4a9467890e745424a28a27144 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 10 Aug 2023 00:14:27 -0700
Subject: [PATCH 104/115] protobufc: 1.4.1 -> unstable-2023-07-08

---
 .../development/libraries/protobufc/default.nix | 17 ++++-------------
 1 file changed, 4 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/libraries/protobufc/default.nix b/pkgs/development/libraries/protobufc/default.nix
index dc3b2c92f191..d152512783f0 100644
--- a/pkgs/development/libraries/protobufc/default.nix
+++ b/pkgs/development/libraries/protobufc/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , autoreconfHook
 , pkg-config
 , protobuf
@@ -11,28 +10,20 @@
 
 stdenv.mkDerivation rec {
   pname = "protobuf-c";
-  version = "1.4.1";
+  version = "unstable-2023-07-08";
 
   src = fetchFromGitHub {
     owner = "protobuf-c";
     repo = "protobuf-c";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-TJCLzxozuZ8ynrBQ2lKyk03N+QA/lbOwywUjDUdTlbM=";
+    rev = "fa86fddbd000316772d1deb5a8d1201fa7599ef7";
+    hash = "sha256-pmqZYFREPgSrWPekymTglhtAv6gQR1gP3dOl3hqjYig=";
   };
 
-  patches = [
-    # https://github.com/protobuf-c/protobuf-c/pull/534
-    (fetchpatch {
-      url = "https://github.com/protobuf-c/protobuf-c/commit/a6c9ea5207aeac61c57b446ddf5a6b68308881d8.patch";
-      hash = "sha256-wTb8+YbvrCrOVpgthI5SJdG/CpQcOzCX4Bv47FPY804=";
-    })
-  ];
-
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [ protobuf zlib ];
 
-  PROTOC = lib.getExe buildPackages.protobuf;
+  env.PROTOC = lib.getExe buildPackages.protobuf;
 
   meta = with lib; {
     homepage = "https://github.com/protobuf-c/protobuf-c/";

From b606993d672e031e07d64f96489104877ab3617a Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 10 Aug 2023 16:51:57 +0200
Subject: [PATCH 105/115] postgresql_11: 11.20 -> 11.21

https://www.postgresql.org/docs/release/11.21/
---
 pkgs/servers/sql/postgresql/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 307c9f5f4e32..7398b68f23b7 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -307,10 +307,12 @@ let
   };
 
   mkPackages = self: {
+    # TODO: remove ahead of 23.11 branchoff
+    # "PostgreSQL 11 will stop receiving fixes on November 9, 2023"
     postgresql_11 = self.callPackage generic {
-      version = "11.20";
+      version = "11.21";
       psqlSchema = "11.1"; # should be 11, but changing it is invasive
-      hash = "sha256-PXyIgvZKfphTSgRCV9/uerrXelt9oSUI2F1yK5i1rM4=";
+      hash = "sha256-B7CDdHHV3XeyUWazRxjzuhCBa2rWHmkeb8VHzz/P+FA=";
       this = self.postgresql_11;
       thisAttr = "postgresql_11";
       inherit self;

From 363048444bd07577fcdc6ec911b9fedd20d94c64 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 10 Aug 2023 16:52:39 +0200
Subject: [PATCH 106/115] postgresql_12: 12.15 -> 12.16

https://www.postgresql.org/docs/release/12.16/
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 7398b68f23b7..94416ffcd3b8 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -319,9 +319,9 @@ let
     };
 
     postgresql_12 = self.callPackage generic {
-      version = "12.15";
+      version = "12.16";
       psqlSchema = "12";
-      hash = "sha256-u1IG4oZMHEV5k4uW6mCW0VXyKr8tLMKqV1cePEyxKzY=";
+      hash = "sha256-xfH/96D5Ph7DdGQXsFlCkOzmF7SZXtlbjVJ68LoOOPM=";
       this = self.postgresql_12;
       thisAttr = "postgresql_12";
       inherit self;

From f256648786200f9604385b99abf6a570b48ae475 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 10 Aug 2023 16:52:51 +0200
Subject: [PATCH 107/115] postgresql_13: 13.11 -> 13.12

https://www.postgresql.org/docs/release/13.12/
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 94416ffcd3b8..5eac546328f5 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -328,9 +328,9 @@ let
     };
 
     postgresql_13 = self.callPackage generic {
-      version = "13.11";
+      version = "13.12";
       psqlSchema = "13";
-      hash = "sha256-SZL/ZHIDVmtnDU5U3FMXSZomhWyTV20OqVG99r7lC/s=";
+      hash = "sha256-DaHtzuNRS3vHum268MAEmeisFZBmjoeJxQJTpiSfIYs=";
       this = self.postgresql_13;
       thisAttr = "postgresql_13";
       inherit self;

From 8f5976b479152ae8c5372a29ba9b7d38fd420431 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 10 Aug 2023 16:53:04 +0200
Subject: [PATCH 108/115] postgresql_14: 14.8 -> 14.9

https://www.postgresql.org/docs/release/14.9/
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 5eac546328f5..9f77782424ee 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -337,9 +337,9 @@ let
     };
 
     postgresql_14 = self.callPackage generic {
-      version = "14.8";
+      version = "14.9";
       psqlSchema = "14";
-      hash = "sha256-OdOPADBzftA4Nd6+7+47N9M1RizkmV4kl7w41iHr5Fo=";
+      hash = "sha256-sf47qbGn86ljfdFlbf2tKIkBYHP9TTXxO1AUPLu2qO8=";
       this = self.postgresql_14;
       thisAttr = "postgresql_14";
       inherit self;

From 061c96b486cc471185b38b56cd0c962c122336cc Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 10 Aug 2023 16:53:16 +0200
Subject: [PATCH 109/115] postgresql_15: 15.3 -> 15.4

https://www.postgresql.org/docs/release/15.4/
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 9f77782424ee..6d9bf528c07c 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -346,9 +346,9 @@ let
     };
 
     postgresql_15 = self.callPackage generic {
-      version = "15.3";
+      version = "15.4";
       psqlSchema = "15";
-      hash = "sha256-/8fUiR8A/79cP06rf7vO2EYLjA7mPFpRZxM7nmWZ2TI=";
+      hash = "sha256-uuxaS9xENzNmU7bLXZ7Ym+W9XAxYuU4L7O4KmZ5jyPk=";
       this = self.postgresql_15;
       thisAttr = "postgresql_15";
       inherit self;

From 0869c1bef76d6237130c180b3b8f8355884e6a81 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 10 Aug 2023 22:38:13 -0700
Subject: [PATCH 110/115] python3.pkgs.dbus-fast: build cython optimized
 version (#247308)

---
 pkgs/development/python-modules/dbus-fast/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/development/python-modules/dbus-fast/default.nix b/pkgs/development/python-modules/dbus-fast/default.nix
index ec01d5ab3327..747deb2a4eb7 100644
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@@ -1,12 +1,14 @@
 { lib
 , async-timeout
 , buildPythonPackage
+, cython_3
 , fetchFromGitHub
 , poetry-core
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
 , setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -23,9 +25,15 @@ buildPythonPackage rec {
     hash = "sha256-B+NW7ORKIBtjxeR0W0tX7V1MgBtNoyGFX35TXUl7rVE=";
   };
 
+  # The project can build both an optimized cython version and an unoptimized
+  # python version. This ensures we fail if we build the wrong one.
+  env.REQUIRE_CYTHON = 1;
+
   nativeBuildInputs = [
+    cython_3
     poetry-core
     setuptools
+    wheel
   ];
 
   propagatedBuildInputs = [

From 4f6efcf85a79385e33694ffbab7a95135d58f498 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 10 Aug 2023 22:39:09 -0700
Subject: [PATCH 111/115] python3.pkgs.bluetooth-data-tools: 1.6.1 -> 1.7.0
 (#247272)

At the same time, switch to using the Cython version for better
performance.
---
 .../python-modules/bluetooth-data-tools/default.nix  | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/bluetooth-data-tools/default.nix b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
index 918cba4f54b1..a68f8c8da430 100644
--- a/pkgs/development/python-modules/bluetooth-data-tools/default.nix
+++ b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, cython_3
 , poetry-core
 , pytestCheckHook
 , pythonOlder
@@ -9,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "bluetooth-data-tools";
-  version = "1.6.1";
+  version = "1.7.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -18,10 +19,15 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-A3zdM2kVmz8cUix9JT8cnIABZK64r6yiZisvb8A1RSQ=";
+    hash = "sha256-EmZPiZKm/80nJpPnJWhI9i4I6MhgQMifLOEUBFLqbSw=";
   };
 
+  # The project can build both an optimized cython version and an unoptimized
+  # python version. This ensures we fail if we build the wrong one.
+  env.REQUIRE_CYTHON = 1;
+
   nativeBuildInputs = [
+    cython_3
     poetry-core
     setuptools
   ];
@@ -43,7 +49,7 @@ buildPythonPackage rec {
     description = "Library for converting bluetooth data and packets";
     homepage = "https://github.com/Bluetooth-Devices/bluetooth-data-tools";
     changelog = "https://github.com/Bluetooth-Devices/bluetooth-data-tools/blob/v${version}/CHANGELOG.md";
-    license = with licenses; [ asl20 ];
+    license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
 }

From 03ef7028ce6e181b48f11c8e8a5b8c71c6c452c5 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 10 Aug 2023 22:47:18 -0700
Subject: [PATCH 112/115] python3.pkgs.orjson: 3.9.2 -> 3.9.4 (#248273)

---
 pkgs/development/python-modules/orjson/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/orjson/default.nix b/pkgs/development/python-modules/orjson/default.nix
index bdcd70526869..934b65298f4e 100644
--- a/pkgs/development/python-modules/orjson/default.nix
+++ b/pkgs/development/python-modules/orjson/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "orjson";
-  version = "3.9.2";
+  version = "3.9.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,13 +25,13 @@ buildPythonPackage rec {
     owner = "ijl";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-uEwlrWPQbctCMiIz4fdXe2GDr2SSHaMzmYzzrECerxg=";
+    hash = "sha256-WS4qynQmJIVdDf0sYK/HFVQ+F5nfoJwx/zzmaL6YTRc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-U/WenkO7ecZQOGEppBlLtlXGtbpbS7e+Ic1hg/AnKSk=";
+    hash = "sha256-hGUXPTiKvKygxQzxXAO/+bD34eLnpkhQ7r/g27E+d4I=";
   };
 
   nativeBuildInputs = [

From 9dd8601a6dea9c4217a1b494cc802377d89c45fa Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 10 Aug 2023 22:52:16 -0700
Subject: [PATCH 113/115] python3.pkgs.josepy: fix tests with setuptools
 67.5.0+ (#246920)

---
 pkgs/development/python-modules/josepy/default.nix | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/josepy/default.nix b/pkgs/development/python-modules/josepy/default.nix
index 76004df63bc8..f8a76641f537 100644
--- a/pkgs/development/python-modules/josepy/default.nix
+++ b/pkgs/development/python-modules/josepy/default.nix
@@ -1,11 +1,11 @@
 { lib
 , buildPythonPackage
 , cryptography
+, fetchpatch
 , fetchPypi
 , pyopenssl
 , pytestCheckHook
 , pythonOlder
-, setuptools
 }:
 
 buildPythonPackage rec {
@@ -20,10 +20,19 @@ buildPythonPackage rec {
     hash = "sha256-iTHa84+KTIUnSg6LfLJa3f2NHyj5+4++0FPdUa7HXck=";
   };
 
+  patches = [
+    # https://github.com/certbot/josepy/pull/158
+    (fetchpatch {
+      name = "fix-setuptools-deprecation.patch";
+      url = "https://github.com/certbot/josepy/commit/8f1b4b57a29a868a87fd6eee19a67a7ebfc07ea1.patch";
+      hash = "sha256-9d+Bk/G4CJXpnjJU0YkXLsg0G3tPxR8YN2niqriQQkI=";
+      includes = [ "tests/test_util.py" ];
+    })
+  ];
+
   propagatedBuildInputs = [
     pyopenssl
     cryptography
-    setuptools
   ];
 
   nativeCheckInputs = [

From b5fde732b417a6e53262b197f905346242c1bfe2 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 10 Aug 2023 22:53:24 -0700
Subject: [PATCH 114/115] python3.pkgs.aiohttp: fix tests with setuptools
 67.5.0+ (#247310)

---
 .../python-modules/aiohttp/default.nix        |  4 +++
 .../setuptools-67.5.0-compatibility.diff      | 27 +++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 pkgs/development/python-modules/aiohttp/setuptools-67.5.0-compatibility.diff

diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index e2e2ebac9ae5..b988abe60108 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -6,6 +6,7 @@
 , pythonOlder
 # build_requires
 , setuptools
+, wheel
 # install_requires
 , attrs
 , charset-normalizer
@@ -49,6 +50,8 @@ buildPythonPackage rec {
       url = "https://github.com/aio-libs/aiohttp/commit/7dcc235cafe0c4521bbbf92f76aecc82fee33e8b.patch";
       hash = "sha256-ZzhlE50bmA+e2XX2RH1FuWQHZIAa6Dk/hZjxPoX5t4g=";
     })
+    # https://github.com/aio-libs/aiohttp/pull/7454 but does not merge cleanly
+    ./setuptools-67.5.0-compatibility.diff
   ];
 
   postPatch = ''
@@ -57,6 +60,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aiohttp/setuptools-67.5.0-compatibility.diff b/pkgs/development/python-modules/aiohttp/setuptools-67.5.0-compatibility.diff
new file mode 100644
index 000000000000..2f75b6b4c136
--- /dev/null
+++ b/pkgs/development/python-modules/aiohttp/setuptools-67.5.0-compatibility.diff
@@ -0,0 +1,27 @@
+diff --git a/setup.cfg b/setup.cfg
+index 6944b7e2..dfa65d69 100644
+--- a/setup.cfg
++++ b/setup.cfg
+@@ -128,6 +128,7 @@ filterwarnings =
+ 	ignore:Creating a LegacyVersion has been deprecated and will be removed in the next major release:DeprecationWarning::
+ 	ignore:module 'sre_constants' is deprecated:DeprecationWarning:pkg_resources._vendor.pyparsing
+ 	ignore:path is deprecated. Use files.. instead. Refer to https.//importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy for migration advice.:DeprecationWarning:certifi.core
++	ignore:pkg_resources is deprecated as an API:DeprecationWarning
+ junit_suite_name = aiohttp_test_suite
+ norecursedirs = dist docs build .tox .eggs
+ minversion = 3.8.2
+diff --git a/tests/test_circular_imports.py b/tests/test_circular_imports.py
+index 22e5ea47..a655fd1d 100644
+--- a/tests/test_circular_imports.py
++++ b/tests/test_circular_imports.py
+@@ -113,6 +113,10 @@ def test_no_warnings(import_path: str) -> None:
+         "-W",
+         "ignore:Creating a LegacyVersion has been deprecated and will "
+         "be removed in the next major release:DeprecationWarning:",
++        # Deprecation warning emitted by setuptools v67.5.0+ triggered by importing
++        # `gunicorn.util`.
++        "-W", "ignore:pkg_resources is deprecated as an API:"
++        "DeprecationWarning",
+         "-c", f"import {import_path!s}",
+         # fmt: on
+     )

From 92dff845fa01423dc250d2e6e7062786e7ce4999 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Fri, 11 Aug 2023 09:19:40 +0200
Subject: [PATCH 115/115] gnutls: patch an API breakage from last update

https://github.com/NixOS/nixpkgs/pull/247704#issuecomment-1672810322
---
 pkgs/development/libraries/gnutls/default.nix | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 1ac761514ad1..d50edb1ce983 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -1,5 +1,6 @@
 { config, lib, stdenv, fetchurl, zlib, lzo, libtasn1, nettle, pkg-config, lzip
 , perl, gmp, autoconf, automake, libidn2, libiconv
+, fetchpatch, texinfo
 , unbound, dns-root-data, gettext, util-linux
 , cxxBindings ? !stdenv.hostPlatform.isStatic # tries to link libstdc++.so
 , tpmSupport ? false, trousers, which, nettools, libunistring
@@ -45,7 +46,15 @@ stdenv.mkDerivation rec {
   outputInfo = "devdoc";
   outputDoc  = "devdoc";
 
-  patches = [ ./nix-ssl-cert-file.patch ];
+  patches = [
+    (fetchpatch { #TODO: when updating drop this patch and texinfo
+      name = "GNUTLS_NO_EXTENSIONS.patch";
+      url = "https://gitlab.com/gnutls/gnutls/-/commit/abfa8634db940115a11a07596ce53c8f9c4f87d2.diff";
+      hash = "sha256-3M5WdNoVx9gUwTUPgu/sXmsaNg+j5d6liXs0UZz8fGU=";
+    })
+
+    ./nix-ssl-cert-file.patch
+  ];
 
   # Skip some tests:
   #  - pkg-config: building against the result won't work before installing (3.5.11)
@@ -80,7 +89,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional (withP11-kit) p11-kit
     ++ lib.optional (tpmSupport && stdenv.isLinux) trousers;
 
-  nativeBuildInputs = [ perl pkg-config ]
+  nativeBuildInputs = [ perl pkg-config texinfo ]
     ++ lib.optionals doCheck [ which nettools util-linux ];
 
   propagatedBuildInputs = [ nettle ]