From 833aa51924cc1d817b0cba4da85932eac21e0f0d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 28 Feb 2022 10:26:11 +0000
Subject: [PATCH 01/34] lrzip: 0.641 -> 0.650

---
 pkgs/tools/compression/lrzip/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/compression/lrzip/default.nix b/pkgs/tools/compression/lrzip/default.nix
index 4fe5512b4c6f..b14fb347d210 100644
--- a/pkgs/tools/compression/lrzip/default.nix
+++ b/pkgs/tools/compression/lrzip/default.nix
@@ -5,13 +5,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "lrzip";
-  version = "0.641";
+  version = "0.650";
 
   src = fetchFromGitHub {
     owner = "ckolivas";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-253CH6TiHWyr13C76y9PXjyB7gj2Bhd2VRgJ5r+cm/g=";
+    sha256 = "sha256-rHjaTgNVGfnGio4geuWRfPds5BqcXJu7p8XJh83rRTs=";
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''

From e434e215ed3325b26818f0d98a38125743a3db19 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <stig@stig.io>
Date: Sat, 5 Mar 2022 20:55:26 +0100
Subject: [PATCH 02/34] perlPackages.DigestSRI: init at 0.02

---
 pkgs/top-level/perl-packages.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index d6745c559e15..6fb9358bfd5a 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6881,6 +6881,20 @@ let
     };
   };
 
+  DigestSRI = buildPerlPackage {
+    pname = "Digest-SRI";
+    version = "0.02";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/H/HA/HAUKEX/Digest-SRI-0.02.tar.gz";
+      sha256 = "sha256-VITN/m68OYwkZfeBx3w++1OKOULNSyDWiBjG//kHT8c=";
+    };
+    meta = {
+      homepage = "https://github.com/haukex/Digest-SRI";
+      description = "Calculate and verify Subresource Integrity hashes (SRI)";
+      license = lib.licenses.gpl3Plus;
+    };
+  };
+
   DirManifest = buildPerlModule {
     pname = "Dir-Manifest";
     version = "0.6.1";

From fdbc2c45bc067b07061db31be1cd78e04c8d754b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 20 Mar 2022 15:01:35 +0000
Subject: [PATCH 03/34] ipfs: 0.12.0 -> 0.12.1

---
 pkgs/applications/networking/ipfs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/ipfs/default.nix b/pkgs/applications/networking/ipfs/default.nix
index 2cceddf0bd7c..6f63205d4b5a 100644
--- a/pkgs/applications/networking/ipfs/default.nix
+++ b/pkgs/applications/networking/ipfs/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "ipfs";
-  version = "0.12.0"; # When updating, also check if the repo version changed and adjust repoVersion below
+  version = "0.12.1"; # When updating, also check if the repo version changed and adjust repoVersion below
   rev = "v${version}";
 
   repoVersion = "12"; # Also update ipfs-migrator when changing the repo version
@@ -10,7 +10,7 @@ buildGoModule rec {
   # go-ipfs makes changes to it's source tarball that don't match the git source.
   src = fetchurl {
     url = "https://github.com/ipfs/go-ipfs/releases/download/${rev}/go-ipfs-source.tar.gz";
-    sha256 = "jWoMm/xIp3Zn/FiHWQ5/q39i6Lh4Fdoi9OdnRVc51Xk=";
+    sha256 = "sha256-fUExCvE6x5VFBl66y52DGvr8ZNSXZ6MYpVQP/D7X328=";
   };
 
   # tarball contains multiple files/directories

From 336602768a96b540c58bb581719875af8d7d9a57 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 23 Mar 2022 07:57:46 +0000
Subject: [PATCH 04/34] bitwig-studio: 4.2 -> 4.2.1

---
 pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
index 7b527139e919..6f438a106ffb 100644
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bitwig-studio";
-  version = "4.2";
+  version = "4.2.1";
 
   src = fetchurl {
     url = "https://downloads.bitwig.com/stable/${version}/${pname}-${version}.deb";
-    sha256 = "sha256-hIIEVj5sM/NdhBiwerFvyIXqj0R8EvcxwM6UZ0CE428=";
+    sha256 = "sha256-kkpb8tLuj4QO+TBW2yNDugS4c6dCQ9Lddv6Z8NS0uio=";
   };
 
   nativeBuildInputs = [ dpkg makeWrapper wrapGAppsHook ];

From fd78240ac82ada2b598d4491dbf6ff8622bd3dff Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 25 Mar 2022 15:33:21 +0000
Subject: [PATCH 05/34] treewide: use lib.getLib for OpenSSL libraries

At some point, I'd like to make another attempt at
71f1f4884b5 ("openssl: stop static binaries referencing libs"), which
was reverted in 195c7da07df.  One problem with my previous attempt is
that I moved OpenSSL's libraries to a lib output, but many dependent
packages were hardcoding the out output as the location of the
libraries.  This patch fixes every such case I could find in the tree.
It won't have any effect immediately, but will mean these packages
will automatically use an OpenSSL lib output if it is reintroduced in
future.

This patch should cause very few rebuilds, because it shouldn't make
any change at all to most packages I'm touching.  The few rebuilds
that are introduced come from when I've changed a package builder not
to use variable names like openssl.out in scripts / substitution
patterns, which would be confusing since they don't hardcode the
output any more.

I started by making the following global replacements:

    ${pkgs.openssl.out}/lib -> ${lib.getLib pkgs.openssl}/lib
    ${openssl.out}/lib -> ${lib.getLib openssl}/lib

Then I removed the ".out" suffix when part of the argument to
lib.makeLibraryPath, since that function uses lib.getLib internally.

Then I fixed up cases where openssl was part of the -L flag to the
compiler/linker, since that unambigously is referring to libraries.

Then I manually investigated and fixed the following packages:

 - pycurl
 - citrix-workspace
 - ppp
 - wraith
 - unbound
 - gambit
 - acl2

I'm reasonably confindent in my fixes for all of them.

For acl2, since the openssl library paths are manually provided above
anyway, I don't think openssl is required separately as a build input
at all.  Removing it doesn't make a difference to the output size, the
file list, or the closure.

I've tested evaluation with the OfBorg meta checks, to protect against
introducing evaluation failures.
---
 nixos/modules/system/boot/luksroot.nix             |  2 +-
 pkgs/applications/audio/spotify/default.nix        |  4 ++--
 pkgs/applications/blockchains/snarkos/default.nix  |  2 +-
 pkgs/applications/blockchains/solana/default.nix   |  2 +-
 pkgs/applications/editors/kodestudio/default.nix   |  2 +-
 pkgs/applications/editors/sublime/3/common.nix     |  2 +-
 .../extensions/ms-dotnettools-csharp/default.nix   |  2 +-
 .../networking/irc/wraith/configure.patch          |  2 +-
 .../applications/networking/irc/wraith/default.nix |  6 +++---
 .../networking/mailreaders/mailspring/default.nix  |  2 +-
 .../networking/remote/citrix-workspace/generic.nix |  2 +-
 .../version-management/subversion/default.nix      |  2 +-
 pkgs/development/compilers/gambit/build.nix        |  4 ++--
 pkgs/development/compilers/urweb/default.nix       |  2 +-
 pkgs/development/interpreters/acl2/default.nix     |  6 +++---
 pkgs/development/libraries/apr-util/default.nix    |  2 +-
 .../development/libraries/aqbanking/gwenhywfar.nix |  2 +-
 .../libraries/ggz_base_libs/default.nix            |  2 +-
 pkgs/development/libraries/libarchive/default.nix  |  2 +-
 pkgs/development/libraries/live555/default.nix     |  4 ++--
 pkgs/development/libraries/openldap/default.nix    |  2 +-
 pkgs/development/libraries/qt-5/modules/qtbase.nix |  2 +-
 .../libraries/unixODBCDrivers/default.nix          |  2 +-
 .../lisp-modules/quicklisp-to-nix-overrides.nix    |  2 +-
 .../python-modules/bitcoinlib/default.nix          |  2 +-
 .../python-modules/proton-client/default.nix       |  2 +-
 pkgs/development/python-modules/pycurl/default.nix |  2 +-
 .../python-modules/telethon/default.nix            |  2 +-
 pkgs/development/r-modules/default.nix             |  6 +++---
 pkgs/development/tools/clpm/default.nix            |  4 ++--
 .../tools/database/prisma-engines/default.nix      |  2 +-
 pkgs/servers/dns/bind/default.nix                  |  2 +-
 pkgs/servers/monitoring/net-snmp/default.nix       |  2 +-
 pkgs/servers/openxpki/default.nix                  |  2 +-
 pkgs/servers/web-apps/lemmy/server.nix             |  2 +-
 pkgs/stdenv/darwin/make-bootstrap-tools.nix        |  2 +-
 pkgs/tools/admin/salt/default.nix                  |  2 +-
 pkgs/tools/filesystems/xtreemfs/default.nix        |  2 +-
 pkgs/tools/networking/drill/default.nix            |  2 +-
 pkgs/tools/networking/ntp/default.nix              |  2 +-
 pkgs/tools/networking/ppp/default.nix              |  2 +-
 pkgs/tools/networking/ppp/nix-purity.patch         |  2 +-
 pkgs/tools/networking/unbound/default.nix          |  4 ++--
 pkgs/tools/networking/uwimap/default.nix           |  2 +-
 pkgs/tools/security/eid-mw/default.nix             |  2 +-
 pkgs/tools/security/pcsc-safenet/default.nix       |  2 +-
 pkgs/tools/security/quill/default.nix              |  2 +-
 pkgs/tools/security/rbw/default.nix                |  2 +-
 pkgs/tools/system/monit/default.nix                |  2 +-
 pkgs/top-level/perl-packages.nix                   | 14 +++++++-------
 50 files changed, 67 insertions(+), 67 deletions(-)

diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index f0d3170dc5ac..dde07571b3e7 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -877,7 +877,7 @@ in
         copy_bin_and_libs ${pkgs.yubikey-personalization}/bin/ykinfo
         copy_bin_and_libs ${pkgs.openssl.bin}/bin/openssl
 
-        cc -O3 -I${pkgs.openssl.dev}/include -L${pkgs.openssl.out}/lib ${./pbkdf2-sha512.c} -o pbkdf2-sha512 -lcrypto
+        cc -O3 -I${pkgs.openssl.dev}/include -L${lib.getLib pkgs.openssl}/lib ${./pbkdf2-sha512.c} -o pbkdf2-sha512 -lcrypto
         strip -s pbkdf2-sha512
         copy_bin_and_libs pbkdf2-sha512
 
diff --git a/pkgs/applications/audio/spotify/default.nix b/pkgs/applications/audio/spotify/default.nix
index aa04eba7fe8a..d2fe381ac6ae 100644
--- a/pkgs/applications/audio/spotify/default.nix
+++ b/pkgs/applications/audio/spotify/default.nix
@@ -126,8 +126,8 @@ stdenv.mkDerivation {
       # Work around Spotify referring to a specific minor version of
       # OpenSSL.
 
-      ln -s ${openssl.out}/lib/libssl.so $libdir/libssl.so.1.0.0
-      ln -s ${openssl.out}/lib/libcrypto.so $libdir/libcrypto.so.1.0.0
+      ln -s ${lib.getLib openssl}/lib/libssl.so $libdir/libssl.so.1.0.0
+      ln -s ${lib.getLib openssl}/lib/libcrypto.so $libdir/libcrypto.so.1.0.0
       ln -s ${nspr.out}/lib/libnspr4.so $libdir/libnspr4.so
       ln -s ${nspr.out}/lib/libplc4.so $libdir/libplc4.so
 
diff --git a/pkgs/applications/blockchains/snarkos/default.nix b/pkgs/applications/blockchains/snarkos/default.nix
index c52780c9564e..82c3555f64d6 100644
--- a/pkgs/applications/blockchains/snarkos/default.nix
+++ b/pkgs/applications/blockchains/snarkos/default.nix
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage rec {
 
   # Needed to get openssl-sys to use pkg-config.
   OPENSSL_NO_VENDOR = 1;
-  OPENSSL_LIB_DIR = "${openssl.out}/lib";
+  OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
   OPENSSL_DIR="${lib.getDev openssl}";
 
   LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib";
diff --git a/pkgs/applications/blockchains/solana/default.nix b/pkgs/applications/blockchains/solana/default.nix
index bfa9382b245a..0eb48b19c88f 100644
--- a/pkgs/applications/blockchains/solana/default.nix
+++ b/pkgs/applications/blockchains/solana/default.nix
@@ -37,7 +37,7 @@ rustPlatform.buildRustPackage rec {
   # checkInputs = lib.optionals stdenv.isDarwin [ pkg-config rustfmt ];
   # Needed to get openssl-sys to use pkg-config.
   # OPENSSL_NO_VENDOR = 1;
-  # OPENSSL_LIB_DIR = "${openssl.out}/lib";
+  # OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
   # OPENSSL_DIR="${lib.getDev openssl}";
   # LLVM_CONFIG_PATH="${llvm}/bin/llvm-config";
   # LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib";
diff --git a/pkgs/applications/editors/kodestudio/default.nix b/pkgs/applications/editors/kodestudio/default.nix
index e975678591c7..2620a87ce425 100644
--- a/pkgs/applications/editors/kodestudio/default.nix
+++ b/pkgs/applications/editors/kodestudio/default.nix
@@ -57,7 +57,7 @@ in
           $out/kodestudio
       patchelf \
           --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-          --set-rpath ".:${stdenv.cc.libc}/lib:${xorg.libXinerama}/lib:${xorg.libX11}/lib:${alsa-lib}/lib:${libGL}/lib:${libGLU}/lib:${openssl.out}/lib" \
+          --set-rpath ".:${stdenv.cc.libc}/lib:${xorg.libXinerama}/lib:${xorg.libX11}/lib:${alsa-lib}/lib:${libGL}/lib:${libGLU}/lib:${lib.getLib openssl}/lib" \
           $out/resources/app/extensions/krom/Krom/linux/Krom
       patchelf \
           --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
diff --git a/pkgs/applications/editors/sublime/3/common.nix b/pkgs/applications/editors/sublime/3/common.nix
index b4bfc6c9ea73..a5cf2d560c01 100644
--- a/pkgs/applications/editors/sublime/3/common.nix
+++ b/pkgs/applications/editors/sublime/3/common.nix
@@ -101,7 +101,7 @@ in let
         "''${gappsWrapperArgs[@]}"
 
       # Without this, plugin_host crashes, even though it has the rpath
-      wrapProgram $out/plugin_host --prefix LD_PRELOAD : ${stdenv.cc.cc.lib}/lib${lib.optionalString stdenv.is64bit "64"}/libgcc_s.so.1:${openssl.out}/lib/libssl.so:${bzip2.out}/lib/libbz2.so
+      wrapProgram $out/plugin_host --prefix LD_PRELOAD : ${stdenv.cc.cc.lib}/lib${lib.optionalString stdenv.is64bit "64"}/libgcc_s.so.1:${lib.getLib openssl}/lib/libssl.so:${bzip2.out}/lib/libbz2.so
     '';
   };
 in stdenv.mkDerivation (rec {
diff --git a/pkgs/applications/editors/vscode/extensions/ms-dotnettools-csharp/default.nix b/pkgs/applications/editors/vscode/extensions/ms-dotnettools-csharp/default.nix
index d91cbccb8083..b1a3917417d9 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-dotnettools-csharp/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-dotnettools-csharp/default.nix
@@ -107,7 +107,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
       patchelf_add_icu_as_needed "$elf"
       patchelf --add-needed "libssl.so" "$elf"
       patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "${lib.makeLibraryPath [ stdenv.cc.cc openssl.out icu.out ]}:\$ORIGIN" \
+        --set-rpath "${lib.makeLibraryPath [ stdenv.cc.cc openssl icu.out ]}:\$ORIGIN" \
         "$elf"
     }
 
diff --git a/pkgs/applications/networking/irc/wraith/configure.patch b/pkgs/applications/networking/irc/wraith/configure.patch
index 16e65be00a25..2ecba77920eb 100644
--- a/pkgs/applications/networking/irc/wraith/configure.patch
+++ b/pkgs/applications/networking/irc/wraith/configure.patch
@@ -52,7 +52,7 @@
 -fi
 -unset cf_openssl_basedir
 +SSL_INCLUDES="-I@openssl.dev@/include"
-+SSL_LIBS="-L@openssl.out@/lib"
++SSL_LIBS="-L@openssl-lib@/lib"
  
  save_CXX="$CXX"
  CXX="$CXX $SSL_INCLUDES"
diff --git a/pkgs/applications/networking/irc/wraith/default.nix b/pkgs/applications/networking/irc/wraith/default.nix
index 30aec18c107f..a8923042c7d6 100644
--- a/pkgs/applications/networking/irc/wraith/default.nix
+++ b/pkgs/applications/networking/irc/wraith/default.nix
@@ -12,9 +12,9 @@ stdenv.mkDerivation rec {
   patches = [ ./configure.patch ./dlopen.patch ];
   postPatch = ''
     substituteInPlace configure        --subst-var-by openssl.dev ${openssl.dev} \
-                                       --subst-var-by openssl.out ${openssl.out}
-    substituteInPlace src/libssl.cc    --subst-var-by openssl ${openssl.out}
-    substituteInPlace src/libcrypto.cc --subst-var-by openssl ${openssl.out}
+                                       --subst-var-by openssl-lib ${lib.getLib openssl}
+    substituteInPlace src/libssl.cc    --subst-var-by openssl ${lib.getLib openssl}
+    substituteInPlace src/libcrypto.cc --subst-var-by openssl ${lib.getLib openssl}
   '';
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/networking/mailreaders/mailspring/default.nix b/pkgs/applications/networking/mailreaders/mailspring/default.nix
index d2e5beb17180..9b51545083ba 100644
--- a/pkgs/applications/networking/mailreaders/mailspring/default.nix
+++ b/pkgs/applications/networking/mailreaders/mailspring/default.nix
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
       --replace dirname ${coreutils}/bin/dirname
 
     ln -s $out/share/mailspring/mailspring $out/bin/mailspring
-    ln -s ${openssl.out}/lib/libcrypto.so $out/lib/libcrypto.so.1.0.0
+    ln -s ${lib.getLib openssl}/lib/libcrypto.so $out/lib/libcrypto.so.1.0.0
 
     runHook postInstall
   '';
diff --git a/pkgs/applications/networking/remote/citrix-workspace/generic.nix b/pkgs/applications/networking/remote/citrix-workspace/generic.nix
index ac0030961183..bfd9e402f956 100644
--- a/pkgs/applications/networking/remote/citrix-workspace/generic.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/generic.nix
@@ -14,7 +14,7 @@ let
   openssl' = symlinkJoin {
     name = "openssl-backwards-compat";
     nativeBuildInputs = [ makeWrapper ];
-    paths = [ openssl.out ];
+    paths = [ (lib.getLib openssl) ];
     postBuild = ''
       ln -sf $out/lib/libcrypto.so $out/lib/libcrypto.so.1.0.0
       ln -sf $out/lib/libssl.so $out/lib/libssl.so.1.0.0
diff --git a/pkgs/applications/version-management/subversion/default.nix b/pkgs/applications/version-management/subversion/default.nix
index 2e7484327674..4789d654ae68 100644
--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@@ -92,7 +92,7 @@ let
           --replace "${expat.dev}/lib" "${expat.out}/lib" \
           --replace "${zlib.dev}/lib" "${zlib.out}/lib" \
           --replace "${sqlite.dev}/lib" "${sqlite.out}/lib" \
-          --replace "${openssl.dev}/lib" "${openssl.out}/lib"
+          --replace "${openssl.dev}/lib" "${lib.getLib openssl}/lib"
       done
     '';
 
diff --git a/pkgs/development/compilers/gambit/build.nix b/pkgs/development/compilers/gambit/build.nix
index e592107adeca..9f2907057183 100644
--- a/pkgs/development/compilers/gambit/build.nix
+++ b/pkgs/development/compilers/gambit/build.nix
@@ -86,8 +86,8 @@ gccStdenv.mkDerivation rec {
 
     # OS-specific paths are hardcoded in ./configure
     substituteInPlace config.status \
-      --replace "/usr/local/opt/openssl@1.1" "${openssl.out}" \
-      --replace "/usr/local/opt/openssl" "${openssl.out}"
+      --replace "/usr/local/opt/openssl@1.1" "${lib.getLib openssl}" \
+      --replace "/usr/local/opt/openssl" "${lib.getLib openssl}"
 
     ./config.status
   '';
diff --git a/pkgs/development/compilers/urweb/default.nix b/pkgs/development/compilers/urweb/default.nix
index e2d9d1f226e7..67ebaa04699e 100644
--- a/pkgs/development/compilers/urweb/default.nix
+++ b/pkgs/development/compilers/urweb/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
     export CC="${gcc}/bin/gcc";
     export CCARGS="-I$out/include \
-                   -L${openssl.out}/lib \
+                   -L${lib.getLib openssl}/lib \
                    -L${libmysqlclient}/lib \
                    -L${postgresql.lib}/lib \
                    -L${sqlite.out}/lib";
diff --git a/pkgs/development/interpreters/acl2/default.nix b/pkgs/development/interpreters/acl2/default.nix
index 51b1cfa11414..422d999cad75 100644
--- a/pkgs/development/interpreters/acl2/default.nix
+++ b/pkgs/development/interpreters/acl2/default.nix
@@ -36,8 +36,8 @@ in stdenv.mkDerivation rec {
   patches = [(substituteAll {
     src = ./0001-Fix-some-paths-for-Nix-build.patch;
     libipasir = "${libipasir}/lib/${libipasir.libname}";
-    libssl = "${openssl.out}/lib/libssl${stdenv.hostPlatform.extensions.sharedLibrary}";
-    libcrypto = "${openssl.out}/lib/libcrypto${stdenv.hostPlatform.extensions.sharedLibrary}";
+    libssl = "${lib.getLib openssl}/lib/libssl${stdenv.hostPlatform.extensions.sharedLibrary}";
+    libcrypto = "${lib.getLib openssl}/lib/libcrypto${stdenv.hostPlatform.extensions.sharedLibrary}";
   })];
 
   buildInputs = [
@@ -47,7 +47,7 @@ in stdenv.mkDerivation rec {
     # To build community books, we need Perl and a couple of utilities:
     which perl hostname makeWrapper
     # Some of the books require one or more of these external tools:
-    openssl.out glucose minisat abc-verifier libipasir
+    glucose minisat abc-verifier libipasir
     z3 (python2.withPackages (ps: [ ps.z3 ]))
   ];
 
diff --git a/pkgs/development/libraries/apr-util/default.nix b/pkgs/development/libraries/apr-util/default.nix
index 57bf47f3abf1..b9756e0e1a1a 100644
--- a/pkgs/development/libraries/apr-util/default.nix
+++ b/pkgs/development/libraries/apr-util/default.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
       substituteInPlace $f \
         --replace "${expat.dev}/lib" "${expat.out}/lib" \
         --replace "${db.dev}/lib" "${db.out}/lib" \
-        --replace "${openssl.dev}/lib" "${openssl.out}/lib"
+        --replace "${openssl.dev}/lib" "${lib.getLib openssl}/lib"
     done
 
     # Give apr1 access to sed for runtime invocations.
diff --git a/pkgs/development/libraries/aqbanking/gwenhywfar.nix b/pkgs/development/libraries/aqbanking/gwenhywfar.nix
index 527db0e2c1e6..2eb67a022b82 100644
--- a/pkgs/development/libraries/aqbanking/gwenhywfar.nix
+++ b/pkgs/development/libraries/aqbanking/gwenhywfar.nix
@@ -23,7 +23,7 @@ in stdenv.mkDerivation rec {
 
   configureFlags = [
     "--with-openssl-includes=${openssl.dev}/include"
-    "--with-openssl-libs=${openssl.out}/lib"
+    "--with-openssl-libs=${lib.getLib openssl}/lib"
   ];
 
   preConfigure = ''
diff --git a/pkgs/development/libraries/ggz_base_libs/default.nix b/pkgs/development/libraries/ggz_base_libs/default.nix
index 025423ecd8a4..cafb86935490 100644
--- a/pkgs/development/libraries/ggz_base_libs/default.nix
+++ b/pkgs/development/libraries/ggz_base_libs/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   patchPhase = ''
     substituteInPlace configure \
       --replace "/usr/local/ssl/include" "${openssl.dev}/include" \
-      --replace "/usr/local/ssl/lib" "${openssl.out}/lib"
+      --replace "/usr/local/ssl/lib" "${lib.getLib openssl}/lib"
   '';
 
   configureFlags = [
diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index 1cc6fe6f521e..dbeceaaf5581 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
 
   preFixup = ''
     sed -i $lib/lib/libarchive.la \
-      -e 's|-lcrypto|-L${openssl.out}/lib -lcrypto|' \
+      -e 's|-lcrypto|-L${lib.getLib openssl}/lib -lcrypto|' \
       -e 's|-llzo2|-L${lzo}/lib -llzo2|'
   '';
 
diff --git a/pkgs/development/libraries/live555/default.nix b/pkgs/development/libraries/live555/default.nix
index 1c1b57f39cb1..217ea7408d22 100644
--- a/pkgs/development/libraries/live555/default.nix
+++ b/pkgs/development/libraries/live555/default.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace config.macosx-catalina \
-      --replace '/usr/lib/libssl.46.dylib' "${openssl.out}/lib/libssl.dylib" \
-      --replace '/usr/lib/libcrypto.44.dylib' "${openssl.out}/lib/libcrypto.dylib"
+      --replace '/usr/lib/libssl.46.dylib' "${lib.getLib openssl}/lib/libssl.dylib" \
+      --replace '/usr/lib/libcrypto.44.dylib' "${lib.getLib openssl}/lib/libcrypto.dylib"
     sed -i -e 's|/bin/rm|rm|g' genMakefiles
     sed -i \
       -e 's/$(INCLUDES) -I. -O2 -DSOCKLEN_T/$(INCLUDES) -I. -O2 -I. -fPIC -DRTSPCLIENT_SYNCHRONOUS_INTERFACE=1 -DSOCKLEN_T/g' \
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index f9e2b3c0b3fc..4ecfc569ae16 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
     rm -r libraries/*/.libs
     rm -r contrib/slapd-modules/passwd/*/.libs
     for f in $out/lib/libldap.la $out/lib/libldap_r.la; do
-      substituteInPlace "$f" --replace '-lssl' '-L${openssl.out}/lib -lssl'
+      substituteInPlace "$f" --replace '-lssl' '-L${lib.getLib openssl}/lib -lssl'
   '' + lib.optionalString withCyrusSasl ''
       substituteInPlace "$f" --replace '-lsasl2' '-L${cyrus_sasl.out}/lib -lsasl2'
   '' + ''
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index 5e2bb41c40f1..0222a708bb87 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -261,7 +261,7 @@ stdenv.mkDerivation {
     "-I" "${harfbuzz.dev}/include"
     "-system-pcre"
     "-openssl-linked"
-    "-L" "${openssl.out}/lib"
+    "-L" "${lib.getLib openssl}/lib"
     "-I" "${openssl.dev}/include"
     "-system-sqlite"
     ''-${if libmysqlclient != null then "plugin" else "no"}-sql-mysql''
diff --git a/pkgs/development/libraries/unixODBCDrivers/default.nix b/pkgs/development/libraries/unixODBCDrivers/default.nix
index 958e417ca17c..9b4173a6da13 100644
--- a/pkgs/development/libraries/unixODBCDrivers/default.nix
+++ b/pkgs/development/libraries/unixODBCDrivers/default.nix
@@ -157,7 +157,7 @@
     '';
 
     postFixup = ''
-      patchelf --set-rpath ${lib.makeLibraryPath [ unixODBC openssl.out libkrb5 libuuid stdenv.cc.cc ]} \
+      patchelf --set-rpath ${lib.makeLibraryPath [ unixODBC openssl libkrb5 libuuid stdenv.cc.cc ]} \
         $out/lib/libmsodbcsql-${versionMajor}.${versionMinor}.so.${versionAdditional}
     '';
 
diff --git a/pkgs/development/lisp-modules/quicklisp-to-nix-overrides.nix b/pkgs/development/lisp-modules/quicklisp-to-nix-overrides.nix
index b68a2b2c2fb7..6b0e72032126 100644
--- a/pkgs/development/lisp-modules/quicklisp-to-nix-overrides.nix
+++ b/pkgs/development/lisp-modules/quicklisp-to-nix-overrides.nix
@@ -64,7 +64,7 @@ in
     propagatedBuildInputs = [pkgs.openssl];
     overrides = y: (x.overrides y) // {
       prePatch = ''
-        sed 's|libssl.so|${pkgs.openssl.out}/lib/libssl.so|' -i src/reload.lisp
+        sed 's|libssl.so|${pkgs.lib.getLib pkgs.openssl}/lib/libssl.so|' -i src/reload.lisp
       '';
     };
   };
diff --git a/pkgs/development/python-modules/bitcoinlib/default.nix b/pkgs/development/python-modules/bitcoinlib/default.nix
index 71b032a34e49..f3eb86c7bbb1 100644
--- a/pkgs/development/python-modules/bitcoinlib/default.nix
+++ b/pkgs/development/python-modules/bitcoinlib/default.nix
@@ -17,7 +17,7 @@ in buildPythonPackage rec {
   postPatch = ''
     substituteInPlace bitcoin/core/key.py --replace \
       "ctypes.util.find_library('ssl') or 'libeay32'" \
-      "'${openssl.out}/lib/libssl.${ext}'"
+      "'${lib.getLib openssl}/lib/libssl.${ext}'"
   '';
 
   meta = {
diff --git a/pkgs/development/python-modules/proton-client/default.nix b/pkgs/development/python-modules/proton-client/default.nix
index 0f84f324dcf9..01ebed36c72b 100644
--- a/pkgs/development/python-modules/proton-client/default.nix
+++ b/pkgs/development/python-modules/proton-client/default.nix
@@ -34,7 +34,7 @@ buildPythonPackage rec {
   # but it is not working as intended.
   #patchPhase = ''
   #  substituteInPlace proton/srp/_ctsrp.py --replace \
-  #    "ctypes.cdll.LoadLibrary('libssl.so.10')" "'${openssl.out}/lib/libssl.so'"
+  #    "ctypes.cdll.LoadLibrary('libssl.so.10')" "'${lib.getLib openssl}/lib/libssl.so'"
   #'';
   # Regarding the issue above, I'm disabling tests for now
   doCheck = false;
diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index 3585148b31c0..5b62b3bb016b 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage rec {
 
   buildInputs = [
     curl
-    openssl.out
+    openssl
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/telethon/default.nix b/pkgs/development/python-modules/telethon/default.nix
index a7ee01105a67..137f6b136a78 100644
--- a/pkgs/development/python-modules/telethon/default.nix
+++ b/pkgs/development/python-modules/telethon/default.nix
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   patchPhase = ''
     substituteInPlace telethon/crypto/libssl.py --replace \
-      "ctypes.util.find_library('ssl')" "'${openssl.out}/lib/libssl.so'"
+      "ctypes.util.find_library('ssl')" "'${lib.getLib openssl}/lib/libssl.so'"
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index ffe277582392..fce57c0893e8 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -1083,12 +1083,12 @@ let
         patchShebangs configure
       '';
       PKGCONFIG_CFLAGS = "-I${pkgs.openssl.dev}/include";
-      PKGCONFIG_LIBS = "-Wl,-rpath,${pkgs.openssl.out}/lib -L${pkgs.openssl.out}/lib -lssl -lcrypto";
+      PKGCONFIG_LIBS = "-Wl,-rpath,${lib.getLib pkgs.openssl}/lib -L${lib.getLib pkgs.openssl}/lib -lssl -lcrypto";
     });
 
     websocket = old.websocket.overrideDerivation (attrs: {
       PKGCONFIG_CFLAGS = "-I${pkgs.openssl.dev}/include";
-      PKGCONFIG_LIBS = "-Wl,-rpath,${pkgs.openssl.out}/lib -L${pkgs.openssl.out}/lib -lssl -lcrypto";
+      PKGCONFIG_LIBS = "-Wl,-rpath,${lib.getLib pkgs.openssl}/lib -L${lib.getLib pkgs.openssl}/lib -lssl -lcrypto";
     });
 
     Rserve = old.Rserve.overrideDerivation (attrs: {
@@ -1193,7 +1193,7 @@ let
         patchShebangs configure
         '';
       PKGCONFIG_CFLAGS = "-I${pkgs.openssl.dev}/include -I${pkgs.cyrus_sasl.dev}/include -I${pkgs.zlib.dev}/include";
-      PKGCONFIG_LIBS = "-Wl,-rpath,${pkgs.openssl.out}/lib -L${pkgs.openssl.out}/lib -L${pkgs.cyrus_sasl.out}/lib -L${pkgs.zlib.out}/lib -lssl -lcrypto -lsasl2 -lz";
+      PKGCONFIG_LIBS = "-Wl,-rpath,${lib.getLib pkgs.openssl}/lib -L${lib.getLib pkgs.openssl}/lib -L${pkgs.cyrus_sasl.out}/lib -L${pkgs.zlib.out}/lib -lssl -lcrypto -lsasl2 -lz";
     });
 
     ps = old.ps.overrideDerivation (attrs: {
diff --git a/pkgs/development/tools/clpm/default.nix b/pkgs/development/tools/clpm/default.nix
index 53fc548df53c..c58079d0e876 100644
--- a/pkgs/development/tools/clpm/default.nix
+++ b/pkgs/development/tools/clpm/default.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     # patch cl-plus-ssl to ensure that it finds libssl and libcrypto
-    sed 's|libssl.so|${openssl.out}/lib/libssl.so|' -i ext/cl-plus-ssl/src/reload.lisp
-    sed 's|libcrypto.so|${openssl.out}/lib/libcrypto.so|' -i ext/cl-plus-ssl/src/reload.lisp
+    sed 's|libssl.so|${lib.getLib openssl}/lib/libssl.so|' -i ext/cl-plus-ssl/src/reload.lisp
+    sed 's|libcrypto.so|${lib.getLib openssl}/lib/libcrypto.so|' -i ext/cl-plus-ssl/src/reload.lisp
     # patch dexador to avoid error due to dexador being loaded multiple times
     sed -i 's/defpackage/uiop:define-package/g' ext/dexador/src/dexador.lisp
   '';
diff --git a/pkgs/development/tools/database/prisma-engines/default.nix b/pkgs/development/tools/database/prisma-engines/default.nix
index 18614291d587..1ee35b515f62 100644
--- a/pkgs/development/tools/database/prisma-engines/default.nix
+++ b/pkgs/development/tools/database/prisma-engines/default.nix
@@ -33,7 +33,7 @@ rustPlatform.buildRustPackage rec {
 
   preBuild = ''
     export OPENSSL_DIR=${lib.getDev openssl}
-    export OPENSSL_LIB_DIR=${openssl.out}/lib
+    export OPENSSL_LIB_DIR=${lib.getLib openssl}/lib
 
     export PROTOC=${protobuf}/bin/protoc
     export PROTOC_INCLUDE="${protobuf}/include";
diff --git a/pkgs/servers/dns/bind/default.nix b/pkgs/servers/dns/bind/default.nix
index 81722805e273..8e5a67016959 100644
--- a/pkgs/servers/dns/bind/default.nix
+++ b/pkgs/servers/dns/bind/default.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
     moveToOutput bin/nsupdate $dnsutils
 
     for f in "$lib/lib/"*.la "$dev/bin/"bind*-config; do
-      sed -i "$f" -e 's|-L${openssl.dev}|-L${openssl.out}|g'
+      sed -i "$f" -e 's|-L${openssl.dev}|-L${lib.getLib openssl}|g'
     done
   '';
 
diff --git a/pkgs/servers/monitoring/net-snmp/default.nix b/pkgs/servers/monitoring/net-snmp/default.nix
index 884b358644ac..432542a11206 100644
--- a/pkgs/servers/monitoring/net-snmp/default.nix
+++ b/pkgs/servers/monitoring/net-snmp/default.nix
@@ -53,7 +53,7 @@ in stdenv.mkDerivation rec {
 
   postInstall = ''
     for f in "$lib/lib/"*.la $bin/bin/net-snmp-config $bin/bin/net-snmp-create-v3-user; do
-      sed 's|-L${openssl.dev}|-L${openssl.out}|g' -i $f
+      sed 's|-L${openssl.dev}|-L${lib.getLib openssl}|g' -i $f
     done
     mkdir $dev/bin
     mv $bin/bin/net-snmp-config $dev/bin
diff --git a/pkgs/servers/openxpki/default.nix b/pkgs/servers/openxpki/default.nix
index 1477e07ee441..52464afb9abb 100644
--- a/pkgs/servers/openxpki/default.nix
+++ b/pkgs/servers/openxpki/default.nix
@@ -53,7 +53,7 @@ perlPackages.buildPerlPackage {
   preConfigure = ''
     substituteInPlace core/server/Makefile.PL \
       --replace "my \$openssl_inc_dir = ''';" "my \$openssl_inc_dir = '${openssl.dev}/include';" \
-      --replace "my \$openssl_lib_dir = ''';" "my \$openssl_lib_dir = '${openssl.out}/lib';" \
+      --replace "my \$openssl_lib_dir = ''';" "my \$openssl_lib_dir = '${lib.getLib openssl}/lib';" \
       --replace "my \$openssl_binary  = ''';" "my \$openssl_binary  = '${openssl.bin}/bin/openssl';"
     substituteInPlace tools/vergen --replace "#!/usr/bin/perl" "#!${perl}/bin/perl"
     cp ${./vergen_revision_state} .vergen_revision_state
diff --git a/pkgs/servers/web-apps/lemmy/server.nix b/pkgs/servers/web-apps/lemmy/server.nix
index b58851f99030..843e6f711654 100644
--- a/pkgs/servers/web-apps/lemmy/server.nix
+++ b/pkgs/servers/web-apps/lemmy/server.nix
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {
   # As of version 0.10.35 rust-openssl looks for openssl on darwin
   # with a hardcoded path to /usr/lib/libssl.x.x.x.dylib
   # https://github.com/sfackler/rust-openssl/blob/master/openssl-sys/build/find_normal.rs#L115
-  OPENSSL_LIB_DIR = "${openssl.out}/lib";
+  OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
   OPENSSL_INCLUDE_DIR = "${openssl.dev}/include";
 
   PROTOC = "${protobuf}/bin/protoc";
diff --git a/pkgs/stdenv/darwin/make-bootstrap-tools.nix b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
index 9bbdcbf81d5a..1fed692fd1ce 100644
--- a/pkgs/stdenv/darwin/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
@@ -80,7 +80,7 @@ in rec {
       cp ${curl_.bin}/bin/curl $out/bin
       cp -d ${curl_.out}/lib/libcurl*.dylib $out/lib
       cp -d ${libssh2.out}/lib/libssh*.dylib $out/lib
-      cp -d ${openssl.out}/lib/*.dylib $out/lib
+      cp -d ${lib.getLib openssl}/lib/*.dylib $out/lib
 
       cp -d ${gnugrep.pcre.out}/lib/libpcre*.dylib $out/lib
       cp -d ${lib.getLib libiconv}/lib/lib*.dylib $out/lib
diff --git a/pkgs/tools/admin/salt/default.nix b/pkgs/tools/admin/salt/default.nix
index 6f7b86f04489..30e1ad708a14 100644
--- a/pkgs/tools/admin/salt/default.nix
+++ b/pkgs/tools/admin/salt/default.nix
@@ -46,7 +46,7 @@ py.pkgs.buildPythonApplication rec {
 
   postPatch = ''
     substituteInPlace "salt/utils/rsax931.py" \
-      --subst-var-by "libcrypto" "${openssl.out}/lib/libcrypto.so"
+      --subst-var-by "libcrypto" "${lib.getLib openssl}/lib/libcrypto.so"
     substituteInPlace requirements/base.txt \
       --replace contextvars ""
   '';
diff --git a/pkgs/tools/filesystems/xtreemfs/default.nix b/pkgs/tools/filesystems/xtreemfs/default.nix
index 5825f8b25eeb..5f942c925071 100644
--- a/pkgs/tools/filesystems/xtreemfs/default.nix
+++ b/pkgs/tools/filesystems/xtreemfs/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
     export BOOST_INCLUDEDIR=${boost.dev}/include
     export BOOST_LIBRARYDIR=${boost.out}/lib
     export CMAKE_INCLUDE_PATH=${openssl.dev}/include
-    export CMAKE_LIBRARY_PATH=${openssl.out}/lib
+    export CMAKE_LIBRARY_PATH=${lib.getLib openssl}/lib
 
     substituteInPlace cpp/cmake/FindValgrind.cmake \
       --replace "/usr/local" "${valgrind}"
diff --git a/pkgs/tools/networking/drill/default.nix b/pkgs/tools/networking/drill/default.nix
index 7e5d1ac1e00e..ff2c26cb4cbc 100644
--- a/pkgs/tools/networking/drill/default.nix
+++ b/pkgs/tools/networking/drill/default.nix
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  OPENSSL_LIB_DIR = "${openssl.out}/lib";
+  OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
   OPENSSL_DIR="${lib.getDev openssl}";
 
   buildInputs = lib.optionals stdenv.isLinux [
diff --git a/pkgs/tools/networking/ntp/default.nix b/pkgs/tools/networking/ntp/default.nix
index 92a6005e2a66..91e1767b75c1 100644
--- a/pkgs/tools/networking/ntp/default.nix
+++ b/pkgs/tools/networking/ntp/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"
-    "--with-openssl-libdir=${openssl.out}/lib"
+    "--with-openssl-libdir=${lib.getLib openssl}/lib"
     "--with-openssl-incdir=${openssl.dev}/include"
     "--enable-ignore-dns-errors"
     "--with-yielding-select=yes"
diff --git a/pkgs/tools/networking/ppp/default.nix b/pkgs/tools/networking/ppp/default.nix
index 5608b032ac50..d39607338e74 100644
--- a/pkgs/tools/networking/ppp/default.nix
+++ b/pkgs/tools/networking/ppp/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
       src = ./nix-purity.patch;
       glibc = stdenv.cc.libc.dev or stdenv.cc.libc;
       openssl_dev = openssl.dev;
-      openssl_out = openssl.out;
+      openssl_lib = lib.getLib openssl;
     })
     # Without nonpriv.patch, pppd --version doesn't work when not run as root.
     ./nonpriv.patch
diff --git a/pkgs/tools/networking/ppp/nix-purity.patch b/pkgs/tools/networking/ppp/nix-purity.patch
index c3363e0ccb64..1673376f9b6f 100644
--- a/pkgs/tools/networking/ppp/nix-purity.patch
+++ b/pkgs/tools/networking/ppp/nix-purity.patch
@@ -9,7 +9,7 @@ index 22837c5..6f6fff5 100644
 -CFLAGS	+= -DUSE_SRP -DOPENSSL -I/usr/local/ssl/include
 -LIBS	+= -lsrp -L/usr/local/ssl/lib
 +CFLAGS	+= -DUSE_SRP -DOPENSSL -I@openssl_dev@/include/openssl
-+LIBS	+= -lsrp -L@openssl_out@/lib
++LIBS	+= -lsrp -L@openssl_lib@/lib
  NEEDCRYPTOLIB = y
  TARGETS	+= srp-entry
  EXTRAINSTALL = $(INSTALL) -c -m 555 srp-entry $(BINDIR)/srp-entry
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 416d8863cb4a..b2d577dab330 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -32,7 +32,7 @@
 , withDNSTAP ? false
 , withTFO ? false
 , withRedis ? false
-# Avoid .lib depending on openssl.out
+# Avoid .lib depending on lib.getLib openssl
 # The build gets a little hacky, so in some cases we disable this approach.
 , withSlimLib ? stdenv.isLinux && !stdenv.hostPlatform.isMusl && !withDNSTAP
 , libnghttp2
@@ -110,7 +110,7 @@ stdenv.mkDerivation rec {
 
   preFixup = lib.optionalString withSlimLib
     # Build libunbound again, but only against nettle instead of openssl.
-    # This avoids gnutls.out -> unbound.lib -> openssl.out.
+    # This avoids gnutls.out -> unbound.lib -> lib.getLib openssl.
     ''
       configureFlags="$configureFlags --with-nettle=${nettle.dev} --with-libunbound-only"
       configurePhase
diff --git a/pkgs/tools/networking/uwimap/default.nix b/pkgs/tools/networking/uwimap/default.nix
index 78480bbc3dff..a10a779097a5 100644
--- a/pkgs/tools/networking/uwimap/default.nix
+++ b/pkgs/tools/networking/uwimap/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     sed -i src/osdep/unix/Makefile -e 's,/usr/local/ssl,${openssl.dev},'
     sed -i src/osdep/unix/Makefile -e 's,^SSLCERTS=.*,SSLCERTS=/etc/ssl/certs,'
-    sed -i src/osdep/unix/Makefile -e 's,^SSLLIB=.*,SSLLIB=${openssl.out}/lib,'
+    sed -i src/osdep/unix/Makefile -e 's,^SSLLIB=.*,SSLLIB=${lib.getLib openssl}/lib,'
   '';
 
   NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin
diff --git a/pkgs/tools/security/eid-mw/default.nix b/pkgs/tools/security/eid-mw/default.nix
index 925931e6a3e3..e05f96ef4be7 100644
--- a/pkgs/tools/security/eid-mw/default.nix
+++ b/pkgs/tools/security/eid-mw/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ curl gtk3 libassuan libbsd libproxy libxml2 openssl p11-kit pcsclite ];
   preConfigure = ''
     mkdir openssl
-    ln -s ${openssl.out}/lib openssl
+    ln -s ${lib.getLib openssl}/lib openssl
     ln -s ${openssl.bin}/bin openssl
     ln -s ${openssl.dev}/include openssl
     export SSL_PREFIX=$(realpath openssl)
diff --git a/pkgs/tools/security/pcsc-safenet/default.nix b/pkgs/tools/security/pcsc-safenet/default.nix
index 3610343fc273..639aafee23c5 100644
--- a/pkgs/tools/security/pcsc-safenet/default.nix
+++ b/pkgs/tools/security/pcsc-safenet/default.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
     ln -sf libAksIfdh.so.10.0 libAksIfdh.so
     ln -sf libAksIfdh.so.10.0 libAksIfdh.so.10
 
-    ln -sf ${openssl.out}/lib/libcrypto.so $out/lib/libcrypto.so.1.0.0
+    ln -sf ${lib.getLib openssl}/lib/libcrypto.so $out/lib/libcrypto.so.1.0.0
   '';
 
   dontAutoPatchelf = true;
diff --git a/pkgs/tools/security/quill/default.nix b/pkgs/tools/security/quill/default.nix
index 9cf0f2f0c09c..b7f414ea87ef 100644
--- a/pkgs/tools/security/quill/default.nix
+++ b/pkgs/tools/security/quill/default.nix
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage rec {
     export IC_NNS_COMMON_PROTO_INCLUDES=${ic}/rs/nns/common/proto
     export PROTOC=${buildPackages.protobuf}/bin/protoc
     export OPENSSL_DIR=${openssl.dev}
-    export OPENSSL_LIB_DIR=${openssl.out}/lib
+    export OPENSSL_LIB_DIR=${lib.getLib openssl}/lib
   '';
 
   cargoSha256 = "sha256-YxuBABGaZ+ti31seEYR6bB+OMgrSvl1lZyu4bqdxPIk=";
diff --git a/pkgs/tools/security/rbw/default.nix b/pkgs/tools/security/rbw/default.nix
index 9e3f0523473a..a5eb83f1e0b5 100644
--- a/pkgs/tools/security/rbw/default.nix
+++ b/pkgs/tools/security/rbw/default.nix
@@ -66,7 +66,7 @@ rustPlatform.buildRustPackage rec {
 
   preConfigure = ''
     export OPENSSL_INCLUDE_DIR="${openssl.dev}/include"
-    export OPENSSL_LIB_DIR="${openssl.out}/lib"
+    export OPENSSL_LIB_DIR="${lib.getLib openssl}/lib"
   '';
 
   postInstall = ''
diff --git a/pkgs/tools/system/monit/default.nix b/pkgs/tools/system/monit/default.nix
index 0f116c046184..0923aedbcebe 100644
--- a/pkgs/tools/system/monit/default.nix
+++ b/pkgs/tools/system/monit/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     (lib.withFeature usePAM "pam")
   ] ++ (if useSSL then [
     "--with-ssl-incl-dir=${openssl.dev}/include"
-    "--with-ssl-lib-dir=${openssl.out}/lib"
+    "--with-ssl-lib-dir=${lib.getLib openssl}/lib"
   ] else [
     "--without-ssl"
   ]) ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 8c14b875ae85..56922c8523e1 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -4709,7 +4709,7 @@ let
       sha256 = "b66fab514edf97fc32f58da257582704a210c2b35e297d5c31b7fa2ffd08e908";
     };
     NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
+    NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
     meta = with lib; {
       description = "Perl wrapper around OpenSSL's AES library";
       license = with licenses; [ artistic1 gpl1Plus ];
@@ -4724,7 +4724,7 @@ let
       sha256 = "1p22znbajq91lbk2k3yg12ig7hy5b4vy8igxwqkmbm4nhgxp4ki3";
     };
     NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
+    NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
   };
 
   CryptOpenSSLGuess = buildPerlPackage {
@@ -4749,7 +4749,7 @@ let
       sha256 = "1x6ffps8q7mnawmcfq740llzy7i10g3319vap0wiw4d33fm6z1zh";
     };
     NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
+    NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
     buildInputs = [ CryptOpenSSLGuess ];
   };
 
@@ -4762,7 +4762,7 @@ let
     };
     propagatedBuildInputs = [ CryptOpenSSLRandom ];
     NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
+    NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
     buildInputs = [ CryptOpenSSLGuess ];
   };
 
@@ -4774,7 +4774,7 @@ let
       sha256 = "684bd888d2ed4c748f8f6dd8e87c14afa2974b12ee01faa082ad9cfa1e321e62";
     };
     NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
+    NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
     meta = {
       homepage = "https://github.com/dsully/perl-crypt-openssl-x509";
       description = "Perl extension to OpenSSL's X509 API";
@@ -4843,7 +4843,7 @@ let
       sha256 = "0b159lw3ia5r87qsgff3qhdnz3l09xcz04rbk4ji7fbyr12wmv7q";
     };
 
-    makeMakerFlags = "--libpath=${pkgs.openssl.out}/lib --incpath=${pkgs.openssl.dev}/include";
+    makeMakerFlags = "--libpath=${lib.getLib pkgs.openssl}/lib --incpath=${pkgs.openssl.dev}/include";
     buildInputs = [ PathClass ];
     propagatedBuildInputs = [ BytesRandomSecure LWPProtocolHttps ];
   };
@@ -16739,7 +16739,7 @@ let
     doCheck = false; # Test performs network access.
     preConfigure = ''
       mkdir openssl
-      ln -s ${pkgs.openssl.out}/lib openssl
+      ln -s ${lib.getLib pkgs.openssl}/lib openssl
       ln -s ${pkgs.openssl.bin}/bin openssl
       ln -s ${pkgs.openssl.dev}/include openssl
       export OPENSSL_PREFIX=$(realpath openssl)

From fa5712c0b77803bbebf8b5652c86c5eb1b2b002c Mon Sep 17 00:00:00 2001
From: Thibault Gagnaux <tgagnaux@gmail.com>
Date: Mon, 28 Mar 2022 08:06:08 +0200
Subject: [PATCH 06/34] graalvmXX-ce: new update script

---
 .../graalvm/community-edition/default.nix     |  36 ++++-
 .../graalvm11-ce-sources.json                 |  64 +++++++++
 .../graalvm17-ce-sources.json                 |  64 +++++++++
 .../graalvm/community-edition/mkGraal.nix     |  53 ++++---
 .../graalvm/community-edition/update.nix      | 129 ++++++++++++++++++
 5 files changed, 323 insertions(+), 23 deletions(-)
 create mode 100644 pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
 create mode 100644 pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
 create mode 100644 pkgs/development/compilers/graalvm/community-edition/update.nix

diff --git a/pkgs/development/compilers/graalvm/community-edition/default.nix b/pkgs/development/compilers/graalvm/community-edition/default.nix
index f53e9a038963..fa1d074866c5 100644
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@@ -4,14 +4,36 @@ let
   mkGraal = opts: callPackage (import ./mkGraal.nix opts) {
     inherit Foundation;
   };
+
+  commonProducts = [
+    "graalvm-ce"
+    "native-image-installable-svm"
+    "ruby-installable-svm"
+    "wasm-installable-svm"
+  ];
+
 in
 {
   inherit mkGraal;
 
   graalvm11-ce = mkGraal rec {
+    config = {
+      x86_64-darwin = {
+        arch = "darwin-amd64";
+        products = commonProducts ++ [ "python-installable-svm" ];
+      };
+      x86_64-linux = {
+        arch = "linux-amd64";
+        products = commonProducts ++ [ "python-installable-svm" ];
+      };
+      aarch64-linux = {
+        arch = "linux-aarch64";
+        products = commonProducts;
+      };
+    };
     version = "22.0.0.2";
     javaVersion = "11";
-    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
+    platforms = builtins.attrNames config;
   };
 
   # TODO: fix aarch64-linux, failing during Native Image compilation
@@ -20,8 +42,18 @@ in
   # directory"/tmp/SVM-4194439592488143713"): error=0, Failed to exec spawn
   # helper: pid: 19865, exit value: 1"
   graalvm17-ce = mkGraal rec {
+    config = {
+      x86_64-darwin = {
+        arch = "darwin-amd64";
+        products = commonProducts ++ [ "python-installable-svm" ];
+      };
+      x86_64-linux = {
+        arch = "linux-amd64";
+        products = commonProducts ++ [ "python-installable-svm" ];
+      };
+    };
     version = "22.0.0.2";
     javaVersion = "17";
-    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+    platforms = builtins.attrNames config;
   };
 }
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json b/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
new file mode 100644
index 000000000000..deb4c59a1b2b
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
@@ -0,0 +1,64 @@
+{
+  "darwin-amd64": {
+    "graalvm-ce_java11_22.0.0.2": {
+      "sha256": "8280159b8a66c51a839c8079d885928a7f759d5da0632f3af7300df2b63a6323",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java11-darwin-amd64-22.0.0.2.tar.gz"
+    },
+    "native-image-installable-svm_java11_22.0.0.2": {
+      "sha256": "03c27de6cce61ee8073e89252212457f3fbac2c0bc9bfa4acbff12176476c176",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java11-darwin-amd64-22.0.0.2.jar"
+    },
+    "python-installable-svm_java11_22.0.0.2": {
+      "sha256": "67ee2f1cc10b0189e359344c31b22f423e636ff4ec2dd7d9437c3eb0ef54e601",
+      "url": "https://github.com/graalvm/graalpython/releases/download/vm-22.0.0.2/python-installable-svm-java11-darwin-amd64-22.0.0.2.jar"
+    },
+    "ruby-installable-svm_java11_22.0.0.2": {
+      "sha256": "a25c0099a21ca1ca9904dd3acdeef509f67a13b96c6135b6de199e9805330df9",
+      "url": "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java11-darwin-amd64-22.0.0.2.jar"
+    },
+    "wasm-installable-svm_java11_22.0.0.2": {
+      "sha256": "d74c210a8a87b8eb0c4d18a65fde6f2c03ebc94d9bf7ed87bbb9cacc460006d7",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java11-darwin-amd64-22.0.0.2.jar"
+    }
+  },
+  "linux-aarch64": {
+    "graalvm-ce_java11_22.0.0.2": {
+      "sha256": "1cc0263d95f642dada4e290dca7f49c0456cefa7b690b67e3e5c159b537b2c58",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java11-linux-aarch64-22.0.0.2.tar.gz"
+    },
+    "native-image-installable-svm_java11_22.0.0.2": {
+      "sha256": "51d41e890a5aabf8e7b9d4f4e0f88206ee70a261f7dbb0315d51770ab8f3009e",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java11-linux-aarch64-22.0.0.2.jar"
+    },
+    "ruby-installable-svm_java11_22.0.0.2": {
+      "sha256": "e0fb582a9c6b4167e7dc267c58ca1968bd1c471b3bc5c56061b436f175486d80",
+      "url": "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java11-linux-aarch64-22.0.0.2.jar"
+    },
+    "wasm-installable-svm_java11_22.0.0.2": {
+      "sha256": "a48470ae391c75cb2805b7fe27cde2c925c0466fdbc0623dfbb67c54f19dbf8c",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java11-linux-aarch64-22.0.0.2.jar"
+    }
+  },
+  "linux-amd64": {
+    "graalvm-ce_java11_22.0.0.2": {
+      "sha256": "bc86083bb7e2778c7e4fe4f55d74790e42255b96f7806a7fefa51d06f3bc7103",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java11-linux-amd64-22.0.0.2.tar.gz"
+    },
+    "native-image-installable-svm_java11_22.0.0.2": {
+      "sha256": "8504a3441f5b28b8fd625f676674a9216f082ae63a4e30d43930c80f9672e71d",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java11-linux-amd64-22.0.0.2.jar"
+    },
+    "python-installable-svm_java11_22.0.0.2": {
+      "sha256": "2f01d1bbc2ed2c507952d8ceaab1cb2176fc67e2d8c4b3bf5864e8d930c60c55",
+      "url": "https://github.com/graalvm/graalpython/releases/download/vm-22.0.0.2/python-installable-svm-java11-linux-amd64-22.0.0.2.jar"
+    },
+    "ruby-installable-svm_java11_22.0.0.2": {
+      "sha256": "e90f7ebc13b6c1f8e3f98881bb4fe2336870744174b2b6d41dc672d15f0b9a40",
+      "url": "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java11-linux-amd64-22.0.0.2.jar"
+    },
+    "wasm-installable-svm_java11_22.0.0.2": {
+      "sha256": "c0fdfc40374b70f6f1597dd21660535c813dc5c3948c8a6ea9559a20f4d3fb5e",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java11-linux-amd64-22.0.0.2.jar"
+    }
+  }
+}
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json b/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
new file mode 100644
index 000000000000..8712d25c9e34
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
@@ -0,0 +1,64 @@
+{
+  "darwin-amd64": {
+    "graalvm-ce_java17_22.0.0.2": {
+      "sha256": "d54af9d1f4d0d351827395a714ed84d2489b023b74a9c13a431cc9d31d1e8f9a",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java17-darwin-amd64-22.0.0.2.tar.gz"
+    },
+    "native-image-installable-svm_java17_22.0.0.2": {
+      "sha256": "007fa742cd139d447f83d776b6d78e717c9df11d56a61061a5937547c20028b7",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java17-darwin-amd64-22.0.0.2.jar"
+    },
+    "python-installable-svm_java17_22.0.0.2": {
+      "sha256": "af887b0304d5ec98fab1be2cd1fca2aa3b10e84e823142a7f274560b1e0ea7c1",
+      "url": "https://github.com/graalvm/graalpython/releases/download/vm-22.0.0.2/python-installable-svm-java17-darwin-amd64-22.0.0.2.jar"
+    },
+    "ruby-installable-svm_java17_22.0.0.2": {
+      "sha256": "fc5eb6f833136ae3fda61f46fe0af66a8454ca2f803ca35eaff7336521cb468d",
+      "url": "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java17-darwin-amd64-22.0.0.2.jar"
+    },
+    "wasm-installable-svm_java17_22.0.0.2": {
+      "sha256": "b76e6d872ce07ca9facd5b997dbb6e557ba72aa369ddd5f1664431bd11b98796",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java17-darwin-amd64-22.0.0.2.jar"
+    }
+  },
+  "linux-aarch64": {
+    "graalvm-ce_java17_22.0.0.2": {
+      "sha256": "c7d78387d2a144944f26773697c1b61d3478a081a1c5e7fc20f47f1f5f3c82c7",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java17-linux-aarch64-22.0.0.2.tar.gz"
+    },
+    "native-image-installable-svm_java17_22.0.0.2": {
+      "sha256": "798947d0a93988929d2b8e3555f7c65225e789124cd99fbc0c3aae5f350175db",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java17-linux-aarch64-22.0.0.2.jar"
+    },
+    "ruby-installable-svm_java17_22.0.0.2": {
+      "sha256": "38cd733334efdecb040087341bccf0aed8031d70eccd857695eaee6b274a5a6d",
+      "url": "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java17-linux-aarch64-22.0.0.2.jar"
+    },
+    "wasm-installable-svm_java17_22.0.0.2": {
+      "sha256": "5a4d85324b0565c647b0a31f2a12c9192c9bdc49fca3fe57fdb95370e01c325e",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java17-linux-aarch64-22.0.0.2.jar"
+    }
+  },
+  "linux-amd64": {
+    "graalvm-ce_java17_22.0.0.2": {
+      "sha256": "4f743e0ed3d974b7d619ca2ed6014554e8c12e5ebbb38b9bc9e820b182169bd4",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java17-linux-amd64-22.0.0.2.tar.gz"
+    },
+    "native-image-installable-svm_java17_22.0.0.2": {
+      "sha256": "8c25f650d58c2649c97061cb806dfaec9e685d5d2b80afc7cf72fe61d6891831",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java17-linux-amd64-22.0.0.2.jar"
+    },
+    "python-installable-svm_java17_22.0.0.2": {
+      "sha256": "b3b78a15bd29b4eaaf0f2607e21181ca2a5b41b38ba43a3ff2656c2f6effda8a",
+      "url": "https://github.com/graalvm/graalpython/releases/download/vm-22.0.0.2/python-installable-svm-java17-linux-amd64-22.0.0.2.jar"
+    },
+    "ruby-installable-svm_java17_22.0.0.2": {
+      "sha256": "d86c9ad50cbed980fa69d69b2eccd47d31880d8c55553483f59ce9eda15628bd",
+      "url": "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java17-linux-amd64-22.0.0.2.jar"
+    },
+    "wasm-installable-svm_java17_22.0.0.2": {
+      "sha256": "7f7e51e4a24384b3dd960c12ab9b05b1fea58a0457d6b80e3797228fab93c0bd",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java17-linux-amd64-22.0.0.2.jar"
+    }
+  }
+}
diff --git a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
index ee016e71d312..3c45c9c8a7b0 100644
--- a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
@@ -1,7 +1,7 @@
 { version
 , javaVersion
 , platforms
-, hashes ? import ./hashes.nix
+, config
 , useMusl ? false
 }:
 
@@ -33,16 +33,19 @@
 , cairo
 , glib
 , gtk3
+, writeScript
+, jq
+, runtimeShell
+, callPackage
 }:
 
 assert useMusl -> stdenv.isLinux;
 
 let
-  platform = {
-    aarch64-linux = "linux-aarch64";
-    x86_64-linux = "linux-amd64";
-    x86_64-darwin = "darwin-amd64";
-  }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
+  platform = config.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  name = "graalvm${javaVersion}-ce";
+  sourcesFilename = "${name}-sources.json";
+  sources = builtins.fromJSON (builtins.readFile (./. + "/${sourcesFilename}"));
 
   runtimeLibraryPath = lib.makeLibraryPath
     ([ cups ] ++ lib.optionals gtkSupport [ cairo glib gtk3 ]);
@@ -56,21 +59,20 @@ let
     (writeShellScriptBin "${stdenv.system}-musl-gcc" ''${lib.getDev musl}/bin/musl-gcc "$@"'')
   ]);
 
-  javaVersionPlatform = "${javaVersion}-${platform}";
+  javaVersionPlatform = "${javaVersion}-${platform.arch}";
 
   graalvmXXX-ce = stdenv.mkDerivation rec {
-    inherit version;
-    name = "graalvm${javaVersion}-ce";
-    srcs =
-      let
-        # Some platforms doesn't have all GraalVM features
-        # e.g.: GraalPython on aarch64-linux
-        # When the platform doesn't have a feature, sha256 is null on hashes.nix
-        # To update hashes.nix file, run `./update.sh <graalvm-ce-version>`
-        maybeFetchUrl = url: if url.sha256 != null then (fetchurl url) else null;
+    inherit version name;
+    srcs = map fetchurl (builtins.attrValues sources.${platform.arch});
+    /*let
+      # Some platforms doesn't have all GraalVM features
+      # e.g.: GraalPython on aarch64-linux
+      # When the platform doesn't have a feature, sha256 is null on hashes.nix
+      # To update hashes.nix file, run `./update.sh <graalvm-ce-version>`
+      maybeFetchUrl = url: if url.sha256 != null then (fetchurl url) else null;
       in
       (lib.remove null
-        (map maybeFetchUrl (hashes { inherit javaVersionPlatform; })));
+      (map maybeFetchUrl (hashes { inherit javaVersionPlatform; })));*/
 
     buildInputs = lib.optionals stdenv.isLinux [
       alsa-lib # libasound.so wanted by lib/libjsound.so
@@ -86,7 +88,7 @@ let
       zlib
     ];
 
-    nativeBuildInputs = [ unzip perl autoPatchelfHook makeWrapper ];
+    nativeBuildInputs = [ unzip perl makeWrapper ] ++ lib.optional stdenv.isLinux [ autoPatchelfHook ];
 
     unpackPhase = ''
       unpack_jar() {
@@ -149,7 +151,7 @@ let
             else
               "for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do"
           }
-            ln -s $f ${basepath}/${platform}/$(basename $f)
+            ln -s $f ${basepath}/${platform.arch}/$(basename $f)
           done
         '';
         copyClibrariesToLib = ''
@@ -185,6 +187,7 @@ let
         '';
         "11-darwin-amd64" = "";
         "17-darwin-amd64" = "";
+        "17-darwin-aarch64" = "";
       }.${javaVersionPlatform} + ''
         # ensure that $lib/lib exists to avoid breaking builds
         mkdir -p $lib/lib
@@ -281,7 +284,7 @@ let
       }
 
       ${
-        lib.optionalString (platform != "linux-aarch64") ''
+        lib.optionalString (platform.arch != "linux-aarch64" && platform.arch != "darwin-aarch64") ''
           echo "Testing GraalPython"
           $out/bin/graalpython -c 'print(1 + 1)'
           echo '1 + 1' | $out/bin/graalpython
@@ -289,10 +292,14 @@ let
       }
 
       echo "Testing TruffleRuby"
+      ${
+        lib.optionalString (platform != "darwin-aarch64") ''
       # Hide warnings about wrong locale
       export LANG=C
       export LC_ALL=C
       $out/bin/ruby -e 'puts(1 + 1)'
+      ''
+      }
       ${# FIXME: irb is broken in all platforms
         # TODO: `irb` on MacOS gives an error saying "Could not find OpenSSL
         # headers, install via Homebrew or MacPorts or set OPENSSL_PREFIX", even
@@ -311,7 +318,11 @@ let
 
     passthru = {
       home = graalvmXXX-ce;
-      updateScript = ./update.sh;
+      updateScript = import ./update.nix {
+        inherit lib writeScript jq runtimeShell sourcesFilename config;
+        graalVersion = version;
+        javaVersion = "java${javaVersion}";
+      };
     };
 
     meta = with lib; {
diff --git a/pkgs/development/compilers/graalvm/community-edition/update.nix b/pkgs/development/compilers/graalvm/community-edition/update.nix
new file mode 100644
index 000000000000..2be8fff134f6
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/update.nix
@@ -0,0 +1,129 @@
+{
+  javaVersion,
+  graalVersion,
+  config,
+  sourcesFilename,
+  lib,
+  writeScript,
+  jq,
+  runtimeShell
+}:
+
+let
+  # getArchString :: String -> String
+  getArchString = nixArchString:
+    {
+      "aarch64-linux" = "linux-aarch64";
+      "x86_64-linux" = "linux-amd64";
+      "x86_64-darwin" = "darwin-amd64";
+    }.${nixArchString};
+
+
+  # getProductSuffix :: String -> String
+    getProductSuffix = productName:
+      let suffixes = {
+        "graalvm-ce" = ".tar.gz";
+        "native-image-installable-svm" = ".jar";
+        "ruby-installable-svm" = ".jar";
+        "wasm-installable-svm" = ".jar";
+        "python-installable-svm" = ".jar";
+      };
+      in
+      suffixes.${productName};
+
+  # getProductSuffix :: String -> String
+    getProductBaseUrl = productName:
+      let baseUrls = {
+        "graalvm-ce" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
+        "native-image-installable-svm" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
+        "ruby-installable-svm" = "https://github.com/oracle/truffleruby/releases/download";
+        "wasm-installable-svm" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
+        "python-installable-svm" = "https://github.com/graalvm/graalpython/releases/download";
+      };
+      in
+      baseUrls.${productName};
+
+  # generateUrl :: AttrSet -> String
+    generateUrl = { arch, graalVersion, product, javaVersion }:
+
+    let baseUrl = getProductBaseUrl product;
+    in
+    "${baseUrl}/vm-${graalVersion}/${product}-${javaVersion}-${arch}-${graalVersion}${getProductSuffix product}";
+
+  # downloadSha256 :: AttrSet -> String
+    downloadSha256 = args@{ arch, graalVersion, product, javaVersion }:
+      let url = generateUrl args + ".sha256";
+      in
+        builtins.readFile (builtins.fetchurl url);
+
+  # cartesianZipListsWith :: (a -> b -> c) -> [a] -> [b] -> [c]
+    cartesianZipListsWith = f: fst: snd:
+      let cartesianProduct = lib.cartesianProductOfSets { a = fst; b = snd; };
+          fst' = builtins.catAttrs "a" cartesianProduct;
+          snd' = builtins.catAttrs "b" cartesianProduct;
+      in
+      lib.zipListsWith f fst' snd';
+
+  # zipListsToAttrs :: [a] -> [b] -> AttrSet
+    zipListsToAttrs = names: values:
+      lib.listToAttrs (
+        lib.zipListsWith (name: value: { inherit name value; }) names values
+      );
+
+  # genProductJavaVersionGraalVersionAttrSet :: String -> AttrSet
+    genProductJavaVersionGraalVersionAttrSet = product_javaVersion_graalVersion:
+       let attrNames  = [ "product" "javaVersion" "graalVersion" ];
+           attrValues = lib.splitString "_" product_javaVersion_graalVersion;
+        in zipListsToAttrs attrNames attrValues;
+
+  # genUrlAndSha256 :: String -> String -> AttrSet
+    genUrlAndSha256 = arch: product_javaVersion_graalVersion:
+      let
+        productJavaVersionGraalVersion =
+          (genProductJavaVersionGraalVersionAttrSet product_javaVersion_graalVersion)
+            // { inherit arch; };
+        url = generateUrl productJavaVersionGraalVersion;
+        sha256 = downloadSha256 productJavaVersionGraalVersion;
+      in
+      {
+        ${arch} = {
+          ${product_javaVersion_graalVersion} = {
+            inherit sha256 url;
+          };
+        };
+      };
+
+  # genArchProductVersionPairs :: String -> AttrSet -> [AttrSet]
+    genArchProductVersionList = javaGraalVersion: archProducts:
+      let
+        arch = archProducts.arch;
+        products = archProducts.products;
+        productJavaGraalVersionList =
+          cartesianZipListsWith (a: b: a + "_" + b) products [ javaGraalVersion ];
+      in
+        cartesianZipListsWith (genUrlAndSha256) [ arch ] productJavaGraalVersionList;
+
+
+  # genSources :: String -> String -> AttrSet -> Path String
+    genSources = graalVersion: javaVersion: config:
+      let
+        javaGraalVersion = javaVersion + "_" + graalVersion; # java17_20.2.0.2
+        archProducts = builtins.attrValues config;
+        sourcesList = builtins.concatMap (genArchProductVersionList javaGraalVersion) archProducts;
+        sourcesAttr = builtins.foldl' (lib.recursiveUpdate) {} sourcesList;
+      in
+        builtins.toFile "sources.json" (builtins.toJSON sourcesAttr);
+
+    sourcesJson = genSources graalVersion javaVersion config;
+
+in
+  writeScript "update-graal.sh" ''
+    #!${runtimeShell}
+    set -o errexit
+    set -o nounset
+    set -o pipefail
+
+    export PATH="${lib.makeBinPath [ jq ]}:$PATH"
+
+     jq . ${sourcesJson} > ${lib.strings.escapeShellArg ./.}/${sourcesFilename}
+  ''

From c6203291c8226d2e52b2a64074f4a626475d07f3 Mon Sep 17 00:00:00 2001
From: Thibault Gagnaux <tgagnaux@gmail.com>
Date: Tue, 29 Mar 2022 12:36:39 +0200
Subject: [PATCH 07/34] graalvm17-ce-dev: init with aarch64-darwin

---
 .../graalvm/community-edition/default.nix     | 15 +++++
 .../graalvm11-ce-sources.json                 | 28 ++++----
 .../graalvm17-ce-dev-sources.json             | 12 ++++
 .../graalvm17-ce-sources.json                 | 38 +++--------
 .../graalvm/community-edition/mkGraal.nix     | 60 +++++++----------
 .../graalvm/community-edition/update.nix      | 66 ++++++++++++-------
 pkgs/top-level/all-packages.nix               |  1 +
 7 files changed, 117 insertions(+), 103 deletions(-)
 create mode 100644 pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-dev-sources.json

diff --git a/pkgs/development/compilers/graalvm/community-edition/default.nix b/pkgs/development/compilers/graalvm/community-edition/default.nix
index fa1d074866c5..5a3a9e4d6ca6 100644
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@@ -56,4 +56,19 @@ in
     javaVersion = "17";
     platforms = builtins.attrNames config;
   };
+
+  graalvm17-ce-dev = mkGraal rec {
+    config = {
+      aarch64-darwin = {
+        arch = "darwin-aarch64";
+        products = [
+          "graalvm-ce"
+          "native-image-installable-svm"
+        ];
+      };
+    };
+    version = "22.2.0-dev-20220326_0133";
+    javaVersion = "17";
+    platforms = builtins.attrNames config;
+  };
 }
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json b/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
index deb4c59a1b2b..9a4d31dbc93a 100644
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
+++ b/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
@@ -1,62 +1,62 @@
 {
   "darwin-amd64": {
-    "graalvm-ce_java11_22.0.0.2": {
+    "graalvm-ce|java11|22.0.0.2": {
       "sha256": "8280159b8a66c51a839c8079d885928a7f759d5da0632f3af7300df2b63a6323",
       "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java11-darwin-amd64-22.0.0.2.tar.gz"
     },
-    "native-image-installable-svm_java11_22.0.0.2": {
+    "native-image-installable-svm|java11|22.0.0.2": {
       "sha256": "03c27de6cce61ee8073e89252212457f3fbac2c0bc9bfa4acbff12176476c176",
       "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java11-darwin-amd64-22.0.0.2.jar"
     },
-    "python-installable-svm_java11_22.0.0.2": {
+    "python-installable-svm|java11|22.0.0.2": {
       "sha256": "67ee2f1cc10b0189e359344c31b22f423e636ff4ec2dd7d9437c3eb0ef54e601",
       "url": "https://github.com/graalvm/graalpython/releases/download/vm-22.0.0.2/python-installable-svm-java11-darwin-amd64-22.0.0.2.jar"
     },
-    "ruby-installable-svm_java11_22.0.0.2": {
+    "ruby-installable-svm|java11|22.0.0.2": {
       "sha256": "a25c0099a21ca1ca9904dd3acdeef509f67a13b96c6135b6de199e9805330df9",
       "url": "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java11-darwin-amd64-22.0.0.2.jar"
     },
-    "wasm-installable-svm_java11_22.0.0.2": {
+    "wasm-installable-svm|java11|22.0.0.2": {
       "sha256": "d74c210a8a87b8eb0c4d18a65fde6f2c03ebc94d9bf7ed87bbb9cacc460006d7",
       "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java11-darwin-amd64-22.0.0.2.jar"
     }
   },
   "linux-aarch64": {
-    "graalvm-ce_java11_22.0.0.2": {
+    "graalvm-ce|java11|22.0.0.2": {
       "sha256": "1cc0263d95f642dada4e290dca7f49c0456cefa7b690b67e3e5c159b537b2c58",
       "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java11-linux-aarch64-22.0.0.2.tar.gz"
     },
-    "native-image-installable-svm_java11_22.0.0.2": {
+    "native-image-installable-svm|java11|22.0.0.2": {
       "sha256": "51d41e890a5aabf8e7b9d4f4e0f88206ee70a261f7dbb0315d51770ab8f3009e",
       "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java11-linux-aarch64-22.0.0.2.jar"
     },
-    "ruby-installable-svm_java11_22.0.0.2": {
+    "ruby-installable-svm|java11|22.0.0.2": {
       "sha256": "e0fb582a9c6b4167e7dc267c58ca1968bd1c471b3bc5c56061b436f175486d80",
       "url": "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java11-linux-aarch64-22.0.0.2.jar"
     },
-    "wasm-installable-svm_java11_22.0.0.2": {
+    "wasm-installable-svm|java11|22.0.0.2": {
       "sha256": "a48470ae391c75cb2805b7fe27cde2c925c0466fdbc0623dfbb67c54f19dbf8c",
       "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java11-linux-aarch64-22.0.0.2.jar"
     }
   },
   "linux-amd64": {
-    "graalvm-ce_java11_22.0.0.2": {
+    "graalvm-ce|java11|22.0.0.2": {
       "sha256": "bc86083bb7e2778c7e4fe4f55d74790e42255b96f7806a7fefa51d06f3bc7103",
       "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java11-linux-amd64-22.0.0.2.tar.gz"
     },
-    "native-image-installable-svm_java11_22.0.0.2": {
+    "native-image-installable-svm|java11|22.0.0.2": {
       "sha256": "8504a3441f5b28b8fd625f676674a9216f082ae63a4e30d43930c80f9672e71d",
       "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java11-linux-amd64-22.0.0.2.jar"
     },
-    "python-installable-svm_java11_22.0.0.2": {
+    "python-installable-svm|java11|22.0.0.2": {
       "sha256": "2f01d1bbc2ed2c507952d8ceaab1cb2176fc67e2d8c4b3bf5864e8d930c60c55",
       "url": "https://github.com/graalvm/graalpython/releases/download/vm-22.0.0.2/python-installable-svm-java11-linux-amd64-22.0.0.2.jar"
     },
-    "ruby-installable-svm_java11_22.0.0.2": {
+    "ruby-installable-svm|java11|22.0.0.2": {
       "sha256": "e90f7ebc13b6c1f8e3f98881bb4fe2336870744174b2b6d41dc672d15f0b9a40",
       "url": "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java11-linux-amd64-22.0.0.2.jar"
     },
-    "wasm-installable-svm_java11_22.0.0.2": {
+    "wasm-installable-svm|java11|22.0.0.2": {
       "sha256": "c0fdfc40374b70f6f1597dd21660535c813dc5c3948c8a6ea9559a20f4d3fb5e",
       "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java11-linux-amd64-22.0.0.2.jar"
     }
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-dev-sources.json b/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-dev-sources.json
new file mode 100644
index 000000000000..f3f15fdbc2c9
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-dev-sources.json
@@ -0,0 +1,12 @@
+{
+  "darwin-aarch64": {
+    "graalvm-ce|java17|22.2.0-dev-20220326_0133": {
+      "sha256": "72bab733783684dba422d9e04eb4fbd9103adb21db6937cf204c0c46e6ce5b7d",
+      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220326_0133/graalvm-ce-java17-darwin-aarch64-dev.tar.gz"
+    },
+    "native-image-installable-svm|java17|22.2.0-dev-20220326_0133": {
+      "sha256": "397fd17fef67456f66820cbdae9493d16785499b91002d20fdef6e5aaf067ba7",
+      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220326_0133/native-image-installable-svm-java17-darwin-aarch64-dev.jar"
+    }
+  }
+}
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json b/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
index 8712d25c9e34..b4bfde2dc50c 100644
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
+++ b/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
@@ -1,62 +1,44 @@
 {
   "darwin-amd64": {
-    "graalvm-ce_java17_22.0.0.2": {
+    "graalvm-ce|java17|22.0.0.2": {
       "sha256": "d54af9d1f4d0d351827395a714ed84d2489b023b74a9c13a431cc9d31d1e8f9a",
       "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java17-darwin-amd64-22.0.0.2.tar.gz"
     },
-    "native-image-installable-svm_java17_22.0.0.2": {
+    "native-image-installable-svm|java17|22.0.0.2": {
       "sha256": "007fa742cd139d447f83d776b6d78e717c9df11d56a61061a5937547c20028b7",
       "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java17-darwin-amd64-22.0.0.2.jar"
     },
-    "python-installable-svm_java17_22.0.0.2": {
+    "python-installable-svm|java17|22.0.0.2": {
       "sha256": "af887b0304d5ec98fab1be2cd1fca2aa3b10e84e823142a7f274560b1e0ea7c1",
       "url": "https://github.com/graalvm/graalpython/releases/download/vm-22.0.0.2/python-installable-svm-java17-darwin-amd64-22.0.0.2.jar"
     },
-    "ruby-installable-svm_java17_22.0.0.2": {
+    "ruby-installable-svm|java17|22.0.0.2": {
       "sha256": "fc5eb6f833136ae3fda61f46fe0af66a8454ca2f803ca35eaff7336521cb468d",
       "url": "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java17-darwin-amd64-22.0.0.2.jar"
     },
-    "wasm-installable-svm_java17_22.0.0.2": {
+    "wasm-installable-svm|java17|22.0.0.2": {
       "sha256": "b76e6d872ce07ca9facd5b997dbb6e557ba72aa369ddd5f1664431bd11b98796",
       "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java17-darwin-amd64-22.0.0.2.jar"
     }
   },
-  "linux-aarch64": {
-    "graalvm-ce_java17_22.0.0.2": {
-      "sha256": "c7d78387d2a144944f26773697c1b61d3478a081a1c5e7fc20f47f1f5f3c82c7",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java17-linux-aarch64-22.0.0.2.tar.gz"
-    },
-    "native-image-installable-svm_java17_22.0.0.2": {
-      "sha256": "798947d0a93988929d2b8e3555f7c65225e789124cd99fbc0c3aae5f350175db",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java17-linux-aarch64-22.0.0.2.jar"
-    },
-    "ruby-installable-svm_java17_22.0.0.2": {
-      "sha256": "38cd733334efdecb040087341bccf0aed8031d70eccd857695eaee6b274a5a6d",
-      "url": "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java17-linux-aarch64-22.0.0.2.jar"
-    },
-    "wasm-installable-svm_java17_22.0.0.2": {
-      "sha256": "5a4d85324b0565c647b0a31f2a12c9192c9bdc49fca3fe57fdb95370e01c325e",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java17-linux-aarch64-22.0.0.2.jar"
-    }
-  },
   "linux-amd64": {
-    "graalvm-ce_java17_22.0.0.2": {
+    "graalvm-ce|java17|22.0.0.2": {
       "sha256": "4f743e0ed3d974b7d619ca2ed6014554e8c12e5ebbb38b9bc9e820b182169bd4",
       "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java17-linux-amd64-22.0.0.2.tar.gz"
     },
-    "native-image-installable-svm_java17_22.0.0.2": {
+    "native-image-installable-svm|java17|22.0.0.2": {
       "sha256": "8c25f650d58c2649c97061cb806dfaec9e685d5d2b80afc7cf72fe61d6891831",
       "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java17-linux-amd64-22.0.0.2.jar"
     },
-    "python-installable-svm_java17_22.0.0.2": {
+    "python-installable-svm|java17|22.0.0.2": {
       "sha256": "b3b78a15bd29b4eaaf0f2607e21181ca2a5b41b38ba43a3ff2656c2f6effda8a",
       "url": "https://github.com/graalvm/graalpython/releases/download/vm-22.0.0.2/python-installable-svm-java17-linux-amd64-22.0.0.2.jar"
     },
-    "ruby-installable-svm_java17_22.0.0.2": {
+    "ruby-installable-svm|java17|22.0.0.2": {
       "sha256": "d86c9ad50cbed980fa69d69b2eccd47d31880d8c55553483f59ce9eda15628bd",
       "url": "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java17-linux-amd64-22.0.0.2.jar"
     },
-    "wasm-installable-svm_java17_22.0.0.2": {
+    "wasm-installable-svm|java17|22.0.0.2": {
       "sha256": "7f7e51e4a24384b3dd960c12ab9b05b1fea58a0457d6b80e3797228fab93c0bd",
       "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java17-linux-amd64-22.0.0.2.jar"
     }
diff --git a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
index 3c45c9c8a7b0..cc8027dd128d 100644
--- a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
@@ -43,7 +43,9 @@ assert useMusl -> stdenv.isLinux;
 
 let
   platform = config.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  name = "graalvm${javaVersion}-ce";
+  name = if lib.hasInfix "dev" version
+    then "graalvm${javaVersion}-ce-dev"
+    else "graalvm${javaVersion}-ce";
   sourcesFilename = "${name}-sources.json";
   sources = builtins.fromJSON (builtins.readFile (./. + "/${sourcesFilename}"));
 
@@ -164,43 +166,25 @@ let
           done
         '';
       in
-      {
-        "11-linux-amd64" = ''
-          ${copyClibrariesToOut "$out/lib/svm/clibraries"}
+        ''
+          # ensure that $lib/lib exists to avoid breaking builds
+          mkdir -p $lib/lib
+          # jni.h expects jni_md.h to be in the header search path.
+          ln -s $out/include/linux/*_md.h $out/include/
 
-          ${copyClibrariesToLib}
+          # copy-paste openjdk's preFixup
+          # Set JAVA_HOME automatically.
+          mkdir -p $out/nix-support
+          cat > $out/nix-support/setup-hook << EOF
+            if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
+          EOF
+          ${
+          lib.optionalString (stdenv.isLinux) ''
+            ${copyClibrariesToOut "$out/lib/svm/clibraries"}
+            ${copyClibrariesToLib}
+          ''
+          }
         '';
-        "17-linux-amd64" = ''
-          ${copyClibrariesToOut "$out/lib/svm/clibraries"}
-
-          ${copyClibrariesToLib}
-        '';
-        "11-linux-aarch64" = ''
-          ${copyClibrariesToOut "$out/lib/svm/clibraries"}
-
-          ${copyClibrariesToLib}
-        '';
-        "17-linux-aarch64" = ''
-          ${copyClibrariesToOut "$out/lib/svm/clibraries"}
-
-          ${copyClibrariesToLib}
-        '';
-        "11-darwin-amd64" = "";
-        "17-darwin-amd64" = "";
-        "17-darwin-aarch64" = "";
-      }.${javaVersionPlatform} + ''
-        # ensure that $lib/lib exists to avoid breaking builds
-        mkdir -p $lib/lib
-        # jni.h expects jni_md.h to be in the header search path.
-        ln -s $out/include/linux/*_md.h $out/include/
-
-        # copy-paste openjdk's preFixup
-        # Set JAVA_HOME automatically.
-        mkdir -p $out/nix-support
-        cat <<EOF > $out/nix-support/setup-hook
-          if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-        EOF
-      '';
 
     dontStrip = true;
 
@@ -284,7 +268,7 @@ let
       }
 
       ${
-        lib.optionalString (platform.arch != "linux-aarch64" && platform.arch != "darwin-aarch64") ''
+        lib.optionalString (builtins.any (a: a == "python-installable-svm") platform.products) ''
           echo "Testing GraalPython"
           $out/bin/graalpython -c 'print(1 + 1)'
           echo '1 + 1' | $out/bin/graalpython
@@ -293,7 +277,7 @@ let
 
       echo "Testing TruffleRuby"
       ${
-        lib.optionalString (platform != "darwin-aarch64") ''
+        lib.optionalString (builtins.any (a: a == "ruby-installable-svm") platform.products) ''
       # Hide warnings about wrong locale
       export LANG=C
       export LC_ALL=C
diff --git a/pkgs/development/compilers/graalvm/community-edition/update.nix b/pkgs/development/compilers/graalvm/community-edition/update.nix
index 2be8fff134f6..efb46fe838dc 100644
--- a/pkgs/development/compilers/graalvm/community-edition/update.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/update.nix
@@ -10,6 +10,7 @@
 }:
 
 let
+  productJavaVersionGraalVersionSep = "|";
   # getArchString :: String -> String
   getArchString = nixArchString:
     {
@@ -21,40 +22,58 @@ let
 
   # getProductSuffix :: String -> String
     getProductSuffix = productName:
-      let suffixes = {
+      {
         "graalvm-ce" = ".tar.gz";
         "native-image-installable-svm" = ".jar";
         "ruby-installable-svm" = ".jar";
         "wasm-installable-svm" = ".jar";
         "python-installable-svm" = ".jar";
-      };
-      in
-      suffixes.${productName};
+      }.${productName};
 
   # getProductSuffix :: String -> String
     getProductBaseUrl = productName:
-      let baseUrls = {
+      {
         "graalvm-ce" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
         "native-image-installable-svm" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
         "ruby-installable-svm" = "https://github.com/oracle/truffleruby/releases/download";
         "wasm-installable-svm" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
         "python-installable-svm" = "https://github.com/graalvm/graalpython/releases/download";
-      };
+      }.${productName};
+
+  # getDevUrl :: String
+    getDevUrl = { arch, graalVersion, product, javaVersion }:
+      let
+        baseUrl = https://github.com/graalvm/graalvm-ce-dev-builds/releases/download;
       in
-      baseUrls.${productName};
+        "${baseUrl}/${graalVersion}/${product}-${javaVersion}-${arch}-dev${getProductSuffix product}";
 
-  # generateUrl :: AttrSet -> String
-    generateUrl = { arch, graalVersion, product, javaVersion }:
-
-    let baseUrl = getProductBaseUrl product;
-    in
-    "${baseUrl}/vm-${graalVersion}/${product}-${javaVersion}-${arch}-${graalVersion}${getProductSuffix product}";
-
-  # downloadSha256 :: AttrSet -> String
-    downloadSha256 = args@{ arch, graalVersion, product, javaVersion }:
-      let url = generateUrl args + ".sha256";
+  # getReleaseUrl :: AttrSet -> String
+    getReleaseUrl = { arch, graalVersion, product, javaVersion }:
+      let baseUrl = getProductBaseUrl product;
       in
-        builtins.readFile (builtins.fetchurl url);
+      "${baseUrl}/vm-${graalVersion}/${product}-${javaVersion}-${arch}-${graalVersion}${getProductSuffix product}";
+
+  # getUrl :: AttrSet -> String
+    getUrl = args@{ arch, graalVersion, product, javaVersion }:
+      if lib.hasInfix "dev" graalVersion
+        then getDevUrl args
+        else getReleaseUrl args;
+
+  # computeSha256 :: String -> String
+    computeSha256 = url:
+      builtins.hashFile "sha256" (builtins.fetchurl url);
+
+  # downloadSha256 :: String -> String
+    downloadSha256 = url:
+      let sha256Url = url + ".sha256";
+      in
+        builtins.readFile (builtins.fetchurl sha256Url);
+
+  # getSha256 :: String -> String -> String
+    getSha256 = graalVersion: url:
+      if lib.hasInfix "dev" graalVersion
+        then computeSha256 url
+        else downloadSha256 url;
 
   # cartesianZipListsWith :: (a -> b -> c) -> [a] -> [b] -> [c]
     cartesianZipListsWith = f: fst: snd:
@@ -73,7 +92,7 @@ let
   # genProductJavaVersionGraalVersionAttrSet :: String -> AttrSet
     genProductJavaVersionGraalVersionAttrSet = product_javaVersion_graalVersion:
        let attrNames  = [ "product" "javaVersion" "graalVersion" ];
-           attrValues = lib.splitString "_" product_javaVersion_graalVersion;
+           attrValues = lib.splitString productJavaVersionGraalVersionSep product_javaVersion_graalVersion;
         in zipListsToAttrs attrNames attrValues;
 
   # genUrlAndSha256 :: String -> String -> AttrSet
@@ -82,8 +101,8 @@ let
         productJavaVersionGraalVersion =
           (genProductJavaVersionGraalVersionAttrSet product_javaVersion_graalVersion)
             // { inherit arch; };
-        url = generateUrl productJavaVersionGraalVersion;
-        sha256 = downloadSha256 productJavaVersionGraalVersion;
+        url = getUrl productJavaVersionGraalVersion;
+        sha256 = getSha256 productJavaVersionGraalVersion.graalVersion url;
       in
       {
         ${arch} = {
@@ -99,7 +118,8 @@ let
         arch = archProducts.arch;
         products = archProducts.products;
         productJavaGraalVersionList =
-          cartesianZipListsWith (a: b: a + "_" + b) products [ javaGraalVersion ];
+          cartesianZipListsWith (a: b: a + productJavaVersionGraalVersionSep + b)
+            products [ javaGraalVersion ];
       in
         cartesianZipListsWith (genUrlAndSha256) [ arch ] productJavaGraalVersionList;
 
@@ -107,7 +127,7 @@ let
   # genSources :: String -> String -> AttrSet -> Path String
     genSources = graalVersion: javaVersion: config:
       let
-        javaGraalVersion = javaVersion + "_" + graalVersion; # java17_20.2.0.2
+        javaGraalVersion = javaVersion + productJavaVersionGraalVersionSep + graalVersion;
         archProducts = builtins.attrValues config;
         sourcesList = builtins.concatMap (genArchProductVersionList javaGraalVersion) archProducts;
         sourcesAttr = builtins.foldl' (lib.recursiveUpdate) {} sourcesList;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5d52bf43efcb..64bfff82d9c2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12864,6 +12864,7 @@ with pkgs;
     });
   graalvm11-ce = graalvmCEPackages.graalvm11-ce;
   graalvm17-ce = graalvmCEPackages.graalvm17-ce;
+  graalvm17-ce-dev = graalvmCEPackages.graalvm17-ce-dev;
   buildGraalvmNativeImage = callPackage ../build-support/build-graalvm-native-image { };
 
   inherit (callPackages ../development/compilers/graalvm/enterprise-edition.nix { })

From 50f6c0dfa78b0ef081059953df6aad0769c7a0e1 Mon Sep 17 00:00:00 2001
From: Thibault Gagnaux <tgagnaux@gmail.com>
Date: Tue, 29 Mar 2022 16:59:42 +0200
Subject: [PATCH 08/34] graalvmXX-ce: refactor and clean up of update.nix

The update script fetches the latest versions and only
computes/downloads the sha256 if there is a new version to improve runtime.
---
 .../graalvm/community-edition/default.nix     |   6 +-
 .../graalvm17-ce-dev-sources.json             |  12 +-
 .../graalvm/community-edition/hashes.nix      |  57 ----
 .../graalvm/community-edition/mkGraal.nix     |  55 ++--
 .../graalvm/community-edition/update.nix      | 272 +++++++++++-------
 .../graalvm/community-edition/update.sh       |  81 ------
 6 files changed, 204 insertions(+), 279 deletions(-)
 delete mode 100644 pkgs/development/compilers/graalvm/community-edition/hashes.nix
 delete mode 100755 pkgs/development/compilers/graalvm/community-edition/update.sh

diff --git a/pkgs/development/compilers/graalvm/community-edition/default.nix b/pkgs/development/compilers/graalvm/community-edition/default.nix
index 5a3a9e4d6ca6..d45b600d8401 100644
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@@ -1,4 +1,8 @@
 { lib, callPackage, Foundation }:
+/*
+Add new graal versions and products here and then see update.nix on how to
+generate the sources.
+*/
 
 let
   mkGraal = opts: callPackage (import ./mkGraal.nix opts) {
@@ -67,7 +71,7 @@ in
         ];
       };
     };
-    version = "22.2.0-dev-20220326_0133";
+    version = "22.2.0-dev-20220330_2302";
     javaVersion = "17";
     platforms = builtins.attrNames config;
   };
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-dev-sources.json b/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-dev-sources.json
index f3f15fdbc2c9..fba77c58b74a 100644
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-dev-sources.json
+++ b/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-dev-sources.json
@@ -1,12 +1,12 @@
 {
   "darwin-aarch64": {
-    "graalvm-ce|java17|22.2.0-dev-20220326_0133": {
-      "sha256": "72bab733783684dba422d9e04eb4fbd9103adb21db6937cf204c0c46e6ce5b7d",
-      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220326_0133/graalvm-ce-java17-darwin-aarch64-dev.tar.gz"
+    "graalvm-ce|java17|22.2.0-dev-20220330_2302": {
+      "sha256": "e072cdcdf1dcc7884cfe53806e997649ae829a30e1efe19b0b77a91800da79c3",
+      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220330_2302/graalvm-ce-java17-darwin-aarch64-dev.tar.gz"
     },
-    "native-image-installable-svm|java17|22.2.0-dev-20220326_0133": {
-      "sha256": "397fd17fef67456f66820cbdae9493d16785499b91002d20fdef6e5aaf067ba7",
-      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220326_0133/native-image-installable-svm-java17-darwin-aarch64-dev.jar"
+    "native-image-installable-svm|java17|22.2.0-dev-20220330_2302": {
+      "sha256": "fb554d9de8252630e8bde122ca98a75d39e200390384ddb410b3c3af3898ba6a",
+      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220330_2302/native-image-installable-svm-java17-darwin-aarch64-dev.jar"
     }
   }
 }
diff --git a/pkgs/development/compilers/graalvm/community-edition/hashes.nix b/pkgs/development/compilers/graalvm/community-edition/hashes.nix
deleted file mode 100644
index f21fdb252708..000000000000
--- a/pkgs/development/compilers/graalvm/community-edition/hashes.nix
+++ /dev/null
@@ -1,57 +0,0 @@
-# Generated by ./update.sh script
-{ javaVersionPlatform, ... }:
-[
-  {
-    sha256 = {
-      "11-linux-aarch64" = "0n1cgd9rn5aw7rzbd45nlzpnqif095zwl3999vddlhpnjlyjdh0w";
-      "17-linux-aarch64" = "1iw27igiyzzl43yfgid1h6h7hd0xnv0rfdkp4r7r8i51sa3q7my7";
-      "11-linux-amd64" = "00vipkrhc7d5xxznm07pjrdjahhfg5s5vxg49xz8qxz2nwxhi1mw";
-      "17-linux-amd64" = "1m4v2s1b2878r6dqpcxvbqpc3s2l8l0xcbna37bbfx6rsc73wx2g";
-      "11-darwin-amd64" = "08v37avg439hywx2yqx0bnfpazwaja2xhyc0kj1imib6iadib042";
-      "17-darwin-amd64" = "16lg3qfx7j8w8cxc3abl7c19nj6jhkni99wmff153lyhyk8zjjnm";
-    }.${javaVersionPlatform} or null;
-    url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java${javaVersionPlatform}-22.0.0.2.tar.gz";
-  }
-  {
-    sha256 = {
-      "11-linux-aarch64" = "17h0yfw0lxsiblqv1nzpc6i71vh6hbwf1x6lp7kziass1a4ixm2i";
-      "17-linux-aarch64" = "1nvm04smzbis1jy9znac2a4yf9ajqvvmadcf5ffr521rm784g2br";
-      "11-linux-amd64" = "07g7fab0zj1h77a30kiswqm0hvr1m5s6crszcbyvha2v3x2a6145";
-      "17-linux-amd64" = "0c8qi7b63zkjrz3sz01bbmfni7pcz9nq1jv1f34lj9lcsm8gc9cc";
-      "11-darwin-amd64" = "0xn1frj1f4pzrd5gm6xwq31blgvz8l9249c97q3yh7p6rkk7vhh3";
-      "17-darwin-amd64" = "1dr80314fxcklmhi19jn3pqrsz3iivbvcxnphdzl978krm1afzq0";
-    }.${javaVersionPlatform} or null;
-    url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java${javaVersionPlatform}-22.0.0.2.jar";
-  }
-  {
-    sha256 = {
-      "11-linux-aarch64" = "103d91sz2dmlc5hcbi9v3d3irgb83755hz16vkknfhbbkhm5iyz0";
-      "17-linux-aarch64" = "0vas98knpvpajmv8bkgcf0fh7n5fy361nd47002cpppg6hrp7k9q";
-      "11-linux-amd64" = "0h4s1dgx2wn63pabdckl85s70s1kw97vp0c8z7izihdn2fy7w3z9";
-      "17-linux-amd64" = "1g98ashyvscwyn1k8mamih6qhcbxsk62x6ynd7x81ndy1karlv6q";
-      "11-darwin-amd64" = "1y8d6c2ri7hrvsv3aqbcp49pmxh9yppcsfnx0jcwm88wlach0p52";
-      "17-darwin-amd64" = "13a6rchnaczpmxga6g405z55913ayq5gwihzlvyy6shk6gwbcppw";
-    }.${javaVersionPlatform} or null;
-    url = "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java${javaVersionPlatform}-22.0.0.2.jar";
-  }
-  {
-    sha256 = {
-      "11-linux-aarch64" = "135zkpqm8z5nzcyn5h6vdx3c09f9wb6jgzmp0llcnx8w76p71154";
-      "17-linux-aarch64" = "0pij3kh70lxrzmbzx8zw97f9nb0rr492l7x3n13wcr859cr8akas";
-      "11-linux-amd64" = "0ppvsgs216jmm5p8m34lqg2kv0awadh1dlkxb7qzcw2b6x0grzf0";
-      "17-linux-amd64" = "1gf0jfmqy8lp6w7bimjp0j5abzmi0ndsn4hcjvfv7123lbj52zkz";
-      "11-darwin-amd64" = "1mq6013crjmrpf3yvxwv9p4yn0rcdzg5z9hq9l6fpf47i8522k6p";
-      "17-darwin-amd64" = "15l7p48vsca4cvqxbpb9lcmafysmdsxpv6avrpxajz705j3nsvmp";
-    }.${javaVersionPlatform} or null;
-    url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java${javaVersionPlatform}-22.0.0.2.jar";
-  }
-  {
-    sha256 = {
-      "11-linux-amd64" = "0m8cqqqdks34b2zv7i6qw9kzqxi1rfqsmknqa9wm0b7dqaxx209g";
-      "17-linux-amd64" = "12nszxp2yv35y8zkm94bnd0mnanah48y41r61ypymd19plaqmdxk";
-      "11-darwin-amd64" = "00g6akpv0gkw8gcxfbgcyipn6gj25yr32k1lb7iqj08bq4f2zvk7";
-      "17-darwin-amd64" = "1hd71qg0nmklyakl4cc29vl10fxalbyd2b5yn7x9iv6m0h1pp25g";
-    }.${javaVersionPlatform} or null;
-    url = "https://github.com/graalvm/graalpython/releases/download/vm-22.0.0.2/python-installable-svm-java${javaVersionPlatform}-22.0.0.2.jar";
-  }
-]
diff --git a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
index cc8027dd128d..ea4fd89bbcbe 100644
--- a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
@@ -36,14 +36,15 @@
 , writeScript
 , jq
 , runtimeShell
-, callPackage
+, gawk
 }:
 
 assert useMusl -> stdenv.isLinux;
 
 let
   platform = config.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  name = if lib.hasInfix "dev" version
+  name =
+    if lib.hasInfix "dev" version
     then "graalvm${javaVersion}-ce-dev"
     else "graalvm${javaVersion}-ce";
   sourcesFilename = "${name}-sources.json";
@@ -61,20 +62,10 @@ let
     (writeShellScriptBin "${stdenv.system}-musl-gcc" ''${lib.getDev musl}/bin/musl-gcc "$@"'')
   ]);
 
-  javaVersionPlatform = "${javaVersion}-${platform.arch}";
-
   graalvmXXX-ce = stdenv.mkDerivation rec {
     inherit version name;
+
     srcs = map fetchurl (builtins.attrValues sources.${platform.arch});
-    /*let
-      # Some platforms doesn't have all GraalVM features
-      # e.g.: GraalPython on aarch64-linux
-      # When the platform doesn't have a feature, sha256 is null on hashes.nix
-      # To update hashes.nix file, run `./update.sh <graalvm-ce-version>`
-      maybeFetchUrl = url: if url.sha256 != null then (fetchurl url) else null;
-      in
-      (lib.remove null
-      (map maybeFetchUrl (hashes { inherit javaVersionPlatform; })));*/
 
     buildInputs = lib.optionals stdenv.isLinux [
       alsa-lib # libasound.so wanted by lib/libjsound.so
@@ -166,25 +157,25 @@ let
           done
         '';
       in
-        ''
-          # ensure that $lib/lib exists to avoid breaking builds
-          mkdir -p $lib/lib
-          # jni.h expects jni_md.h to be in the header search path.
-          ln -s $out/include/linux/*_md.h $out/include/
+      ''
+        # ensure that $lib/lib exists to avoid breaking builds
+        mkdir -p $lib/lib
+        # jni.h expects jni_md.h to be in the header search path.
+        ln -s $out/include/linux/*_md.h $out/include/
 
-          # copy-paste openjdk's preFixup
-          # Set JAVA_HOME automatically.
-          mkdir -p $out/nix-support
-          cat > $out/nix-support/setup-hook << EOF
-            if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-          EOF
-          ${
-          lib.optionalString (stdenv.isLinux) ''
-            ${copyClibrariesToOut "$out/lib/svm/clibraries"}
-            ${copyClibrariesToLib}
-          ''
-          }
-        '';
+        # copy-paste openjdk's preFixup
+        # Set JAVA_HOME automatically.
+        mkdir -p $out/nix-support
+        cat > $out/nix-support/setup-hook << EOF
+          if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
+        EOF
+        ${
+        lib.optionalString (stdenv.isLinux) ''
+          ${copyClibrariesToOut "$out/lib/svm/clibraries"}
+          ${copyClibrariesToLib}
+        ''
+        }
+      '';
 
     dontStrip = true;
 
@@ -303,7 +294,7 @@ let
     passthru = {
       home = graalvmXXX-ce;
       updateScript = import ./update.nix {
-        inherit lib writeScript jq runtimeShell sourcesFilename config;
+        inherit lib writeScript jq runtimeShell sourcesFilename name config gawk;
         graalVersion = version;
         javaVersion = "java${javaVersion}";
       };
diff --git a/pkgs/development/compilers/graalvm/community-edition/update.nix b/pkgs/development/compilers/graalvm/community-edition/update.nix
index efb46fe838dc..e9d32cf7bdeb 100644
--- a/pkgs/development/compilers/graalvm/community-edition/update.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/update.nix
@@ -1,16 +1,53 @@
-{
-  javaVersion,
-  graalVersion,
-  config,
-  sourcesFilename,
-  lib,
-  writeScript,
-  jq,
-  runtimeShell
+{ javaVersion
+, graalVersion
+, config
+, sourcesFilename
+, name
+, lib
+, writeScript
+, jq
+, runtimeShell
+, gawk
 }:
 
+/*
+  How to  use:
+  run `nix-shell maintainers/scripts/update.nix --argstr package graalvmXX-ce`
+  to update the graalvmXX-ce-sources.json file.
+  E.g: nix-shell maintainers/scripts/update.nix --argstr package graalvm17-ce
+
+  Basic idea:
+  If we know the platform, product, javaVersion and graalVersion
+  we can create the url. This leads to the following json structure:
+  {
+  "platform/arch1": {
+  "product1|javaVersion|graalVersion": { "sha256": "...", "url": "..."},
+  "product2|javaVersion|graalVersion": { "sha256": "...", "url": "..."},
+  ...
+  },
+  "platform/arch2": {
+  ...
+  }
+  }
+*/
+
 let
   productJavaVersionGraalVersionSep = "|";
+
+  # isDev :: String -> Boolean
+  isDev = version:
+    lib.hasInfix "dev" version;
+
+  # getLatestVersion :: String -> String
+  getLatestVersion = currentVersion:
+    let
+      dev = if isDev currentVersion then "dev-" else "";
+      url = "https://api.github.com/repos/graalvm/graalvm-ce-${dev}builds/releases/latest";
+      file = builtins.fetchurl url;
+      json = builtins.fromJSON (builtins.readFile file);
+    in
+    lib.removePrefix "vm-" json.tag_name;
+
   # getArchString :: String -> String
   getArchString = nixArchString:
     {
@@ -21,129 +58,160 @@ let
 
 
   # getProductSuffix :: String -> String
-    getProductSuffix = productName:
-      {
-        "graalvm-ce" = ".tar.gz";
-        "native-image-installable-svm" = ".jar";
-        "ruby-installable-svm" = ".jar";
-        "wasm-installable-svm" = ".jar";
-        "python-installable-svm" = ".jar";
-      }.${productName};
+  getProductSuffix = productName:
+    {
+      "graalvm-ce" = ".tar.gz";
+      "native-image-installable-svm" = ".jar";
+      "ruby-installable-svm" = ".jar";
+      "wasm-installable-svm" = ".jar";
+      "python-installable-svm" = ".jar";
+    }.${productName};
 
   # getProductSuffix :: String -> String
-    getProductBaseUrl = productName:
-      {
-        "graalvm-ce" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
-        "native-image-installable-svm" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
-        "ruby-installable-svm" = "https://github.com/oracle/truffleruby/releases/download";
-        "wasm-installable-svm" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
-        "python-installable-svm" = "https://github.com/graalvm/graalpython/releases/download";
-      }.${productName};
+  getProductBaseUrl = productName:
+    {
+      "graalvm-ce" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
+      "native-image-installable-svm" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
+      "ruby-installable-svm" = "https://github.com/oracle/truffleruby/releases/download";
+      "wasm-installable-svm" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
+      "python-installable-svm" = "https://github.com/graalvm/graalpython/releases/download";
+    }.${productName};
 
   # getDevUrl :: String
-    getDevUrl = { arch, graalVersion, product, javaVersion }:
-      let
-        baseUrl = https://github.com/graalvm/graalvm-ce-dev-builds/releases/download;
-      in
-        "${baseUrl}/${graalVersion}/${product}-${javaVersion}-${arch}-dev${getProductSuffix product}";
+  getDevUrl = { arch, graalVersion, product, javaVersion }:
+    let
+      baseUrl = https://github.com/graalvm/graalvm-ce-dev-builds/releases/download;
+    in
+    "${baseUrl}/${graalVersion}/${product}-${javaVersion}-${arch}-dev${getProductSuffix product}";
 
   # getReleaseUrl :: AttrSet -> String
-    getReleaseUrl = { arch, graalVersion, product, javaVersion }:
-      let baseUrl = getProductBaseUrl product;
-      in
-      "${baseUrl}/vm-${graalVersion}/${product}-${javaVersion}-${arch}-${graalVersion}${getProductSuffix product}";
+  getReleaseUrl = { arch, graalVersion, product, javaVersion }:
+    let baseUrl = getProductBaseUrl product;
+    in
+    "${baseUrl}/vm-${graalVersion}/${product}-${javaVersion}-${arch}-${graalVersion}${getProductSuffix product}";
 
   # getUrl :: AttrSet -> String
-    getUrl = args@{ arch, graalVersion, product, javaVersion }:
-      if lib.hasInfix "dev" graalVersion
-        then getDevUrl args
-        else getReleaseUrl args;
+  getUrl = args@{ arch, graalVersion, product, javaVersion }:
+    if isDev graalVersion
+    then getDevUrl args
+    else getReleaseUrl args;
 
   # computeSha256 :: String -> String
-    computeSha256 = url:
-      builtins.hashFile "sha256" (builtins.fetchurl url);
+  computeSha256 = url:
+    builtins.hashFile "sha256" (builtins.fetchurl url);
 
   # downloadSha256 :: String -> String
-    downloadSha256 = url:
-      let sha256Url = url + ".sha256";
-      in
-        builtins.readFile (builtins.fetchurl sha256Url);
+  downloadSha256 = url:
+    let sha256Url = url + ".sha256";
+    in
+    builtins.readFile (builtins.fetchurl sha256Url);
 
   # getSha256 :: String -> String -> String
-    getSha256 = graalVersion: url:
-      if lib.hasInfix "dev" graalVersion
-        then computeSha256 url
-        else downloadSha256 url;
+  getSha256 = graalVersion: url:
+    if isDev graalVersion
+    then computeSha256 url
+    else downloadSha256 url;
 
   # cartesianZipListsWith :: (a -> b -> c) -> [a] -> [b] -> [c]
-    cartesianZipListsWith = f: fst: snd:
-      let cartesianProduct = lib.cartesianProductOfSets { a = fst; b = snd; };
-          fst' = builtins.catAttrs "a" cartesianProduct;
-          snd' = builtins.catAttrs "b" cartesianProduct;
-      in
-      lib.zipListsWith f fst' snd';
+  cartesianZipListsWith = f: fst: snd:
+    let
+      cartesianProduct = lib.cartesianProductOfSets { a = fst; b = snd; };
+      fst' = builtins.catAttrs "a" cartesianProduct;
+      snd' = builtins.catAttrs "b" cartesianProduct;
+    in
+    lib.zipListsWith f fst' snd';
 
   # zipListsToAttrs :: [a] -> [b] -> AttrSet
-    zipListsToAttrs = names: values:
-      lib.listToAttrs (
-        lib.zipListsWith (name: value: { inherit name value; }) names values
-      );
+  zipListsToAttrs = names: values:
+    lib.listToAttrs (
+      lib.zipListsWith (name: value: { inherit name value; }) names values
+    );
 
   # genProductJavaVersionGraalVersionAttrSet :: String -> AttrSet
-    genProductJavaVersionGraalVersionAttrSet = product_javaVersion_graalVersion:
-       let attrNames  = [ "product" "javaVersion" "graalVersion" ];
-           attrValues = lib.splitString productJavaVersionGraalVersionSep product_javaVersion_graalVersion;
-        in zipListsToAttrs attrNames attrValues;
+  genProductJavaVersionGraalVersionAttrSet = product_javaVersion_graalVersion:
+    let
+      attrNames = [ "product" "javaVersion" "graalVersion" ];
+      attrValues = lib.splitString productJavaVersionGraalVersionSep product_javaVersion_graalVersion;
+    in
+    zipListsToAttrs attrNames attrValues;
 
   # genUrlAndSha256 :: String -> String -> AttrSet
-    genUrlAndSha256 = arch: product_javaVersion_graalVersion:
-      let
-        productJavaVersionGraalVersion =
-          (genProductJavaVersionGraalVersionAttrSet product_javaVersion_graalVersion)
-            // { inherit arch; };
-        url = getUrl productJavaVersionGraalVersion;
-        sha256 = getSha256 productJavaVersionGraalVersion.graalVersion url;
-      in
-      {
-        ${arch} = {
-          ${product_javaVersion_graalVersion} = {
-            inherit sha256 url;
-          };
+  genUrlAndSha256 = arch: product_javaVersion_graalVersion:
+    let
+      productJavaVersionGraalVersion =
+        (genProductJavaVersionGraalVersionAttrSet product_javaVersion_graalVersion)
+        // { inherit arch; };
+      url = getUrl productJavaVersionGraalVersion;
+      sha256 = getSha256 productJavaVersionGraalVersion.graalVersion url;
+    in
+    {
+      ${arch} = {
+        ${product_javaVersion_graalVersion} = {
+          inherit sha256 url;
         };
       };
+    };
 
   # genArchProductVersionPairs :: String -> AttrSet -> [AttrSet]
-    genArchProductVersionList = javaGraalVersion: archProducts:
-      let
-        arch = archProducts.arch;
-        products = archProducts.products;
-        productJavaGraalVersionList =
-          cartesianZipListsWith (a: b: a + productJavaVersionGraalVersionSep + b)
-            products [ javaGraalVersion ];
-      in
-        cartesianZipListsWith (genUrlAndSha256) [ arch ] productJavaGraalVersionList;
+  genArchProductVersionList = javaGraalVersion: archProducts:
+    let
+      arch = archProducts.arch;
+      products = archProducts.products;
+      productJavaGraalVersionList =
+        cartesianZipListsWith (a: b: a + productJavaVersionGraalVersionSep + b)
+          products [ javaGraalVersion ];
+    in
+    cartesianZipListsWith (genUrlAndSha256) [ arch ] productJavaGraalVersionList;
 
 
   # genSources :: String -> String -> AttrSet -> Path String
-    genSources = graalVersion: javaVersion: config:
-      let
-        javaGraalVersion = javaVersion + productJavaVersionGraalVersionSep + graalVersion;
-        archProducts = builtins.attrValues config;
-        sourcesList = builtins.concatMap (genArchProductVersionList javaGraalVersion) archProducts;
-        sourcesAttr = builtins.foldl' (lib.recursiveUpdate) {} sourcesList;
-      in
-        builtins.toFile "sources.json" (builtins.toJSON sourcesAttr);
+  genSources = graalVersion: javaVersion: config:
+    let
+      javaGraalVersion = javaVersion + productJavaVersionGraalVersionSep + graalVersion;
+      archProducts = builtins.attrValues config;
+      sourcesList = builtins.concatMap (genArchProductVersionList javaGraalVersion) archProducts;
+      sourcesAttr = builtins.foldl' (lib.recursiveUpdate) { } sourcesList;
+    in
+    builtins.toFile "sources.json" (builtins.toJSON sourcesAttr);
 
-    sourcesJson = genSources graalVersion javaVersion config;
+  # isNew :: String -> String -> Boolean
+  isNew = newVersion: currentVersion:
+    {
+      "-1" = false;
+      "0" = false;
+      "1" = true;
+    }.${builtins.toString (builtins.compareVersions newVersion currentVersion)};
+
+  newVersion = getLatestVersion graalVersion;
+  sourcesJson = genSources newVersion javaVersion config;
+  sourcesJsonPath = lib.strings.escapeShellArg ././${sourcesFilename};
+  defaultNixPath = lib.strings.escapeShellArg ././default.nix;
+
+  /*
+    updateScriptText :: String -> String -> String
+    Writes the json file, finds the line number of the current derivation
+    name, which wants to update with awk and replace the first version match
+    after that line.
+  */
+  updateScriptText = newVersion: currentVersion:
+    if isNew newVersion currentVersion
+    then
+      ''
+        echo "New version found. Updating ${currentVersion} -> ${newVersion}".
+        export PATH="${lib.makeBinPath [ jq gawk ]}:$PATH"
+        jq . ${sourcesJson} > ${sourcesJsonPath}
+        drvName=$(awk '/${name}/{ print NR; exit }' ${defaultNixPath})
+        awk -v drvName="$drvName" -i inplace \
+        'NR>drvName {sub(/${graalVersion}/, "${newVersion}")} 1' ${defaultNixPath}
+      ''
+    else ''echo "No new version found. Skip updating."'';
 
 in
-  writeScript "update-graal.sh" ''
-    #!${runtimeShell}
-    set -o errexit
-    set -o nounset
-    set -o pipefail
+writeScript "update-graal.sh" ''
+  #!${runtimeShell}
+  set -o errexit
+  set -o nounset
+  set -o pipefail
 
-    export PATH="${lib.makeBinPath [ jq ]}:$PATH"
-
-     jq . ${sourcesJson} > ${lib.strings.escapeShellArg ./.}/${sourcesFilename}
-  ''
+  ${updateScriptText newVersion graalVersion}
+''
diff --git a/pkgs/development/compilers/graalvm/community-edition/update.sh b/pkgs/development/compilers/graalvm/community-edition/update.sh
deleted file mode 100755
index c821c83a59c8..000000000000
--- a/pkgs/development/compilers/graalvm/community-edition/update.sh
+++ /dev/null
@@ -1,81 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -p coreutils curl nix jq gnused -i bash
-
-set -eou pipefail
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-info() { echo "[INFO] $*"; }
-
-echo_file() { echo "$@" >> hashes.nix; }
-
-verlte() {
-    [  "$1" = "$(echo -e "$1\n$2" | sort -V | head -n1)" ]
-}
-
-readonly nixpkgs=../../../../..
-
-readonly old_version="$(nix-instantiate "$nixpkgs" --eval --strict -A graalvm11-ce.version)"
-
-if [[ -z "${1:-}" ]]; then
-  readonly gh_version="$(curl \
-      ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
-      -s https://api.github.com/repos/graalvm/graalvm-ce-builds/releases/latest | \
-      jq --raw-output .tag_name)"
-  readonly new_version="${gh_version//vm-/}"
-else
-  readonly new_version="$1"
-fi
-
-if verlte "$old_version" "$new_version"; then
-  info "graalvm-ce $old_version is up-to-date."
-  [[ -z "${FORCE:-}" ]]  && exit 0
-else
-  info "graalvm-ce $old_version is out-of-date. Updating..."
-fi
-
-readonly urls=(
-  "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/graalvm-ce-java@platform@-${new_version}.tar.gz"
-  "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/native-image-installable-svm-java@platform@-${new_version}.jar"
-  "https://github.com/oracle/truffleruby/releases/download/vm-${new_version}/ruby-installable-svm-java@platform@-${new_version}.jar"
-  "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/wasm-installable-svm-java@platform@-${new_version}.jar"
-  "https://github.com/graalvm/graalpython/releases/download/vm-${new_version}/python-installable-svm-java@platform@-${new_version}.jar"
-)
-
-readonly platforms=(
-  "11-linux-aarch64"
-  "17-linux-aarch64"
-  "11-linux-amd64"
-  "17-linux-amd64"
-  "11-darwin-amd64"
-  "17-darwin-amd64"
-)
-
-info "Deleting old hashes.nix file..."
-rm -f hashes.nix
-info "Generating hashes.nix file for 'graalvm-ce' $new_version. This will take a while..."
-
-echo_file "# Generated by $0 script"
-echo_file "{ javaVersionPlatform, ... }:"
-echo_file "["
-
-for url in "${urls[@]}"; do
-  echo_file "  {"
-  echo_file "    sha256 = {"
-  for platform in "${platforms[@]}"; do
-    if hash="$(nix-prefetch-url "${url//@platform@/$platform}")"; then
-      echo_file "      \"$platform\" = \"$hash\";"
-    fi
-  done
-  echo_file '    }.${javaVersionPlatform} or null;'
-  echo_file "    url = \"${url//@platform@/\$\{javaVersionPlatform\}}\";"
-  echo_file "  }"
-done
-
-echo_file "]"
-
-info "Updating graalvm-ce version..."
-# update-source-version does not work here since it expects src attribute
-sed "s|$old_version|\"$new_version\"|" -i default.nix
-
-info "Done!"

From f31038ab7f728ca3de54cbc1966aaaa8283f24cd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 31 Mar 2022 20:33:47 +0000
Subject: [PATCH 09/34] restic: 0.12.1 -> 0.13.0

---
 pkgs/tools/backup/restic/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/backup/restic/default.nix b/pkgs/tools/backup/restic/default.nix
index 0cf25941e907..e2e16f9f69a2 100644
--- a/pkgs/tools/backup/restic/default.nix
+++ b/pkgs/tools/backup/restic/default.nix
@@ -3,13 +3,13 @@
 
 buildGoModule rec {
   pname = "restic";
-  version = "0.12.1";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "restic";
     repo = "restic";
     rev = "v${version}";
-    sha256 = "19lzccipbpxdkay60zdqfq8dgah0sbxzjcfcx285c28js2zpp85m";
+    sha256 = "sha256-pbCN262gyS5BSUTN9QU+x2Nnrc8mmCSQH6Inng4OS8c=";
   };
 
   patches = [
@@ -17,7 +17,7 @@ buildGoModule rec {
     ./0001-Skip-testing-restore-with-permission-failure.patch
   ];
 
-  vendorSha256 = "0sdswihiy4r3lw9a87xj2qm3nf28cw56yfm56mva6b8lr3vk93l6";
+  vendorSha256 = "sha256-DWfCjGXjZnZa2mXPmXQmvGDtXb0H1wJqCgVsDjdVy9U=";
 
   subPackages = [ "cmd/restic" ];
 

From 8a21b4ea923dded54c529122476bb1c9f5f39acf Mon Sep 17 00:00:00 2001
From: illustris <rharikrishnan95@gmail.com>
Date: Fri, 1 Apr 2022 11:44:43 +0530
Subject: [PATCH 10/34] spark: mark 2.4 as vulnerable

---
 pkgs/applications/networking/cluster/spark/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/spark/default.nix b/pkgs/applications/networking/cluster/spark/default.nix
index 69cdcc8d1316..594567c459e4 100644
--- a/pkgs/applications/networking/cluster/spark/default.nix
+++ b/pkgs/applications/networking/cluster/spark/default.nix
@@ -14,7 +14,7 @@
 with lib;
 
 let
-  spark = { pname, version, sha256 }:
+  spark = { pname, version, sha256, extraMeta ? {} }:
     stdenv.mkDerivation rec {
       inherit pname version;
       src = fetchzip {
@@ -63,7 +63,7 @@ let
         license = lib.licenses.asl20;
         platforms = lib.platforms.all;
         maintainers = with maintainers; [ thoughtpolice offline kamilchm illustris ];
-      };
+      } // extraMeta;
     };
 in
 {
@@ -81,5 +81,6 @@ in
     pname = "spark";
     version = "2.4.8";
     sha256 = "1mkyq0gz9fiav25vr0dba5ivp0wh0mh7kswwnx8pvsmb6wbwyfxv";
+    extraMeta.knownVulnerabilities = [ "CVE-2021-38296" ];
   };
 }

From ff86a2f24f26bf8846a90e43f273d56e75103ab8 Mon Sep 17 00:00:00 2001
From: illustris <rharikrishnan95@gmail.com>
Date: Fri, 1 Apr 2022 12:01:00 +0530
Subject: [PATCH 11/34] spark: 3.1.2 -> 3.1.3

---
 pkgs/applications/networking/cluster/spark/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/spark/default.nix b/pkgs/applications/networking/cluster/spark/default.nix
index 594567c459e4..057be75aeb34 100644
--- a/pkgs/applications/networking/cluster/spark/default.nix
+++ b/pkgs/applications/networking/cluster/spark/default.nix
@@ -74,8 +74,8 @@ in
   };
   spark_3_1 = spark rec {
     pname = "spark";
-    version = "3.1.2";
-    sha256 = "1bgh2y6jm7wqy6yc40rx68xkki31i3jiri2yixb1bm0i9pvsj9yf";
+    version = "3.1.3";
+    sha256 = "sha256-RIQyN5YjxFLfNIrETR3Vv99zsHxt77rhOXHIThCI2Y8=";
   };
   spark_2_4 = spark rec {
     pname = "spark";

From a21282a02da691716813c0719f5c3ca62e6aa1c3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 1 Apr 2022 07:08:35 +0000
Subject: [PATCH 12/34] python310Packages.plaid-python: 9.1.1 -> 9.2.0

---
 pkgs/development/python-modules/plaid-python/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/plaid-python/default.nix b/pkgs/development/python-modules/plaid-python/default.nix
index d36ba25ba474..ac635fe4db5e 100644
--- a/pkgs/development/python-modules/plaid-python/default.nix
+++ b/pkgs/development/python-modules/plaid-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "plaid-python";
-  version = "9.1.1";
+  version = "9.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vHJ35MvMw3G1k/A2gifaE97GayoVEOQ9lR6yG6ZkzS4=";
+    hash = "sha256-3yFfANMkn8CXCheNHU77WGeYxPV4gs2jvOl/rV+/6vY=";
   };
 
   propagatedBuildInputs = [

From 4b4d3759e96624c72fc7dfe9a52295998fb0cf49 Mon Sep 17 00:00:00 2001
From: Thibault Gagnaux <tgagnaux@gmail.com>
Date: Fri, 1 Apr 2022 12:59:37 +0200
Subject: [PATCH 13/34] graalvmXX-ce: remove graalvmXX-ce-dev and use dev
 version in graalvmXX-ce on aarch64-darwin

---
 .../graalvm/community-edition/default.nix     | 39 ++++++++++-----
 .../graalvm11-ce-sources.json                 | 10 ++++
 .../graalvm17-ce-dev-sources.json             | 12 -----
 .../graalvm17-ce-sources.json                 | 10 ++++
 .../graalvm/community-edition/mkGraal.nix     | 22 ++++-----
 .../graalvm/community-edition/update.nix      | 49 ++++++++++---------
 pkgs/top-level/all-packages.nix               |  1 -
 7 files changed, 83 insertions(+), 60 deletions(-)
 delete mode 100644 pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-dev-sources.json

diff --git a/pkgs/development/compilers/graalvm/community-edition/default.nix b/pkgs/development/compilers/graalvm/community-edition/default.nix
index d45b600d8401..d480c29317f0 100644
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@@ -1,7 +1,7 @@
-{ lib, callPackage, Foundation }:
+{ callPackage, Foundation }:
 /*
-Add new graal versions and products here and then see update.nix on how to
-generate the sources.
+  Add new graal versions and products here and then see update.nix on how to
+  generate the sources.
 */
 
 let
@@ -16,6 +16,15 @@ let
     "wasm-installable-svm"
   ];
 
+  /*
+    Looks a bit ugly but makes version update in the update script using sed
+    much easier
+  */
+  graalvm11-ce-release-version = "22.0.0.2";
+  graalvm17-ce-release-version = "22.0.0.2";
+  graalvm11-ce-dev-version = "22.2.0-dev-20220331_1955";
+  graalvm17-ce-dev-version = "22.2.0-dev-20220331_1955";
+
 in
 {
   inherit mkGraal;
@@ -25,17 +34,27 @@ in
       x86_64-darwin = {
         arch = "darwin-amd64";
         products = commonProducts ++ [ "python-installable-svm" ];
+        version = graalvm11-ce-release-version;
       };
       x86_64-linux = {
         arch = "linux-amd64";
         products = commonProducts ++ [ "python-installable-svm" ];
+        version = graalvm11-ce-release-version;
       };
       aarch64-linux = {
         arch = "linux-aarch64";
         products = commonProducts;
+        version = graalvm11-ce-release-version;
+      };
+      aarch64-darwin = {
+        arch = "darwin-aarch64";
+        products = [
+          "graalvm-ce"
+          "native-image-installable-svm"
+        ];
+        version = graalvm11-ce-dev-version;
       };
     };
-    version = "22.0.0.2";
     javaVersion = "11";
     platforms = builtins.attrNames config;
   };
@@ -50,28 +69,22 @@ in
       x86_64-darwin = {
         arch = "darwin-amd64";
         products = commonProducts ++ [ "python-installable-svm" ];
+        version = graalvm17-ce-release-version;
       };
       x86_64-linux = {
         arch = "linux-amd64";
         products = commonProducts ++ [ "python-installable-svm" ];
+        version = graalvm17-ce-release-version;
       };
-    };
-    version = "22.0.0.2";
-    javaVersion = "17";
-    platforms = builtins.attrNames config;
-  };
-
-  graalvm17-ce-dev = mkGraal rec {
-    config = {
       aarch64-darwin = {
         arch = "darwin-aarch64";
         products = [
           "graalvm-ce"
           "native-image-installable-svm"
         ];
+        version = graalvm17-ce-dev-version;
       };
     };
-    version = "22.2.0-dev-20220330_2302";
     javaVersion = "17";
     platforms = builtins.attrNames config;
   };
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json b/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
index 9a4d31dbc93a..d12df716e05a 100644
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
+++ b/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
@@ -1,4 +1,14 @@
 {
+  "darwin-aarch64": {
+    "graalvm-ce|java11|22.2.0-dev-20220331_1955": {
+      "sha256": "a1229931575bd90256f5453ce9c880cf2286db117d4cbfec92c033813b017035",
+      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220331_1955/graalvm-ce-java11-darwin-aarch64-dev.tar.gz"
+    },
+    "native-image-installable-svm|java11|22.2.0-dev-20220331_1955": {
+      "sha256": "813f9cc417415801e3d7d6468bb06e45487c76fe35b56202b66b6c9fa3ce3456",
+      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220331_1955/native-image-installable-svm-java11-darwin-aarch64-dev.jar"
+    }
+  },
   "darwin-amd64": {
     "graalvm-ce|java11|22.0.0.2": {
       "sha256": "8280159b8a66c51a839c8079d885928a7f759d5da0632f3af7300df2b63a6323",
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-dev-sources.json b/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-dev-sources.json
deleted file mode 100644
index fba77c58b74a..000000000000
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-dev-sources.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "darwin-aarch64": {
-    "graalvm-ce|java17|22.2.0-dev-20220330_2302": {
-      "sha256": "e072cdcdf1dcc7884cfe53806e997649ae829a30e1efe19b0b77a91800da79c3",
-      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220330_2302/graalvm-ce-java17-darwin-aarch64-dev.tar.gz"
-    },
-    "native-image-installable-svm|java17|22.2.0-dev-20220330_2302": {
-      "sha256": "fb554d9de8252630e8bde122ca98a75d39e200390384ddb410b3c3af3898ba6a",
-      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220330_2302/native-image-installable-svm-java17-darwin-aarch64-dev.jar"
-    }
-  }
-}
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json b/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
index b4bfde2dc50c..ebc87f1e7970 100644
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
+++ b/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
@@ -1,4 +1,14 @@
 {
+  "darwin-aarch64": {
+    "graalvm-ce|java17|22.2.0-dev-20220331_1955": {
+      "sha256": "bb217a3bd53a488ef3672920fd47b9a0d800243eb385a7ceae9ddbd4350c0b27",
+      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220331_1955/graalvm-ce-java17-darwin-aarch64-dev.tar.gz"
+    },
+    "native-image-installable-svm|java17|22.2.0-dev-20220331_1955": {
+      "sha256": "eee405e704792794f45e619372e72e0343ba2caf8ace0e4c7abd8baa69e56bcf",
+      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220331_1955/native-image-installable-svm-java17-darwin-aarch64-dev.jar"
+    }
+  },
   "darwin-amd64": {
     "graalvm-ce|java17|22.0.0.2": {
       "sha256": "d54af9d1f4d0d351827395a714ed84d2489b023b74a9c13a431cc9d31d1e8f9a",
diff --git a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
index ea4fd89bbcbe..7642f25ac2ca 100644
--- a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
@@ -1,5 +1,4 @@
-{ version
-, javaVersion
+{ javaVersion
 , platforms
 , config
 , useMusl ? false
@@ -33,20 +32,17 @@
 , cairo
 , glib
 , gtk3
-, writeScript
+, writeShellScript
 , jq
-, runtimeShell
-, gawk
+, gnused
 }:
 
 assert useMusl -> stdenv.isLinux;
 
 let
   platform = config.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  name =
-    if lib.hasInfix "dev" version
-    then "graalvm${javaVersion}-ce-dev"
-    else "graalvm${javaVersion}-ce";
+  version = platform.version;
+  name = "graalvm${javaVersion}-ce";
   sourcesFilename = "${name}-sources.json";
   sources = builtins.fromJSON (builtins.readFile (./. + "/${sourcesFilename}"));
 
@@ -63,7 +59,8 @@ let
   ]);
 
   graalvmXXX-ce = stdenv.mkDerivation rec {
-    inherit version name;
+    inherit version;
+    pname = name;
 
     srcs = map fetchurl (builtins.attrValues sources.${platform.arch});
 
@@ -81,7 +78,8 @@ let
       zlib
     ];
 
-    nativeBuildInputs = [ unzip perl makeWrapper ] ++ lib.optional stdenv.isLinux [ autoPatchelfHook ];
+    nativeBuildInputs = [ unzip perl makeWrapper ]
+      ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
 
     unpackPhase = ''
       unpack_jar() {
@@ -294,7 +292,7 @@ let
     passthru = {
       home = graalvmXXX-ce;
       updateScript = import ./update.nix {
-        inherit lib writeScript jq runtimeShell sourcesFilename name config gawk;
+        inherit lib writeShellScript jq sourcesFilename name config gnused;
         graalVersion = version;
         javaVersion = "java${javaVersion}";
       };
diff --git a/pkgs/development/compilers/graalvm/community-edition/update.nix b/pkgs/development/compilers/graalvm/community-edition/update.nix
index e9d32cf7bdeb..724282e7b92c 100644
--- a/pkgs/development/compilers/graalvm/community-edition/update.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/update.nix
@@ -4,10 +4,9 @@
 , sourcesFilename
 , name
 , lib
-, writeScript
+, writeShellScript
 , jq
-, runtimeShell
-, gawk
+, gnused
 }:
 
 /*
@@ -32,7 +31,7 @@
 */
 
 let
-  productJavaVersionGraalVersionSep = "|";
+  separator = "|";
 
   # isDev :: String -> Boolean
   isDev = version:
@@ -131,7 +130,7 @@ let
   genProductJavaVersionGraalVersionAttrSet = product_javaVersion_graalVersion:
     let
       attrNames = [ "product" "javaVersion" "graalVersion" ];
-      attrValues = lib.splitString productJavaVersionGraalVersionSep product_javaVersion_graalVersion;
+      attrValues = lib.splitString separator product_javaVersion_graalVersion;
     in
     zipListsToAttrs attrNames attrValues;
 
@@ -153,23 +152,23 @@ let
     };
 
   # genArchProductVersionPairs :: String -> AttrSet -> [AttrSet]
-  genArchProductVersionList = javaGraalVersion: archProducts:
+  genArchProductVersionList = javaVersion: archProducts:
     let
       arch = archProducts.arch;
       products = archProducts.products;
+      javaGraalVersion = javaVersion + separator + (getLatestVersion archProducts.version);
       productJavaGraalVersionList =
-        cartesianZipListsWith (a: b: a + productJavaVersionGraalVersionSep + b)
+        cartesianZipListsWith (a: b: a + separator + b)
           products [ javaGraalVersion ];
     in
     cartesianZipListsWith (genUrlAndSha256) [ arch ] productJavaGraalVersionList;
 
 
-  # genSources :: String -> String -> AttrSet -> Path String
-  genSources = graalVersion: javaVersion: config:
+  # genSources :: String -> AttrSet -> Path String
+  genSources = javaVersion: config:
     let
-      javaGraalVersion = javaVersion + productJavaVersionGraalVersionSep + graalVersion;
       archProducts = builtins.attrValues config;
-      sourcesList = builtins.concatMap (genArchProductVersionList javaGraalVersion) archProducts;
+      sourcesList = builtins.concatMap (genArchProductVersionList javaVersion) archProducts;
       sourcesAttr = builtins.foldl' (lib.recursiveUpdate) { } sourcesList;
     in
     builtins.toFile "sources.json" (builtins.toJSON sourcesAttr);
@@ -183,32 +182,38 @@ let
     }.${builtins.toString (builtins.compareVersions newVersion currentVersion)};
 
   newVersion = getLatestVersion graalVersion;
-  sourcesJson = genSources newVersion javaVersion config;
+  sourcesJson = genSources javaVersion config;
   sourcesJsonPath = lib.strings.escapeShellArg ././${sourcesFilename};
-  defaultNixPath = lib.strings.escapeShellArg ././default.nix;
+
+  # versionKeyInDefaultNix String -> String
+  versionKeyInDefaultNix = graalVersion:
+    if isDev graalVersion
+    then "${name}-dev-version"
+    else "${name}-release-version";
 
   /*
     updateScriptText :: String -> String -> String
-    Writes the json file, finds the line number of the current derivation
-    name, which wants to update with awk and replace the first version match
-    after that line.
+    Writes the json file and updates the version in default.nix using sed
+    because update-source-version does not work srcs.
   */
   updateScriptText = newVersion: currentVersion:
+
     if isNew newVersion currentVersion
     then
+      let
+        versionKey = versionKeyInDefaultNix currentVersion;
+      in
       ''
         echo "New version found. Updating ${currentVersion} -> ${newVersion}".
-        export PATH="${lib.makeBinPath [ jq gawk ]}:$PATH"
+        export PATH="${lib.makeBinPath [ jq gnused ]}:$PATH"
         jq . ${sourcesJson} > ${sourcesJsonPath}
-        drvName=$(awk '/${name}/{ print NR; exit }' ${defaultNixPath})
-        awk -v drvName="$drvName" -i inplace \
-        'NR>drvName {sub(/${graalVersion}/, "${newVersion}")} 1' ${defaultNixPath}
+        sed -i 's|${versionKey} = "${currentVersion}";|${versionKey} = "${newVersion}";|' \
+          ${lib.strings.escapeShellArg ././default.nix}
       ''
     else ''echo "No new version found. Skip updating."'';
 
 in
-writeScript "update-graal.sh" ''
-  #!${runtimeShell}
+writeShellScript "update-graal.sh" ''
   set -o errexit
   set -o nounset
   set -o pipefail
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 64bfff82d9c2..5d52bf43efcb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12864,7 +12864,6 @@ with pkgs;
     });
   graalvm11-ce = graalvmCEPackages.graalvm11-ce;
   graalvm17-ce = graalvmCEPackages.graalvm17-ce;
-  graalvm17-ce-dev = graalvmCEPackages.graalvm17-ce-dev;
   buildGraalvmNativeImage = callPackage ../build-support/build-graalvm-native-image { };
 
   inherit (callPackages ../development/compilers/graalvm/enterprise-edition.nix { })

From 440d4f9ff71f173ebcc6f0c878681eac8006459c Mon Sep 17 00:00:00 2001
From: Thibault Gagnaux <tgagnaux@gmail.com>
Date: Fri, 1 Apr 2022 18:38:26 +0200
Subject: [PATCH 14/34] graalvmXX-ce: extract common config

---
 .../graalvm/community-edition/default.nix     | 76 ++++++++-----------
 1 file changed, 30 insertions(+), 46 deletions(-)

diff --git a/pkgs/development/compilers/graalvm/community-edition/default.nix b/pkgs/development/compilers/graalvm/community-edition/default.nix
index d480c29317f0..634844a2b209 100644
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@@ -9,13 +9,6 @@ let
     inherit Foundation;
   };
 
-  commonProducts = [
-    "graalvm-ce"
-    "native-image-installable-svm"
-    "ruby-installable-svm"
-    "wasm-installable-svm"
-  ];
-
   /*
     Looks a bit ugly but makes version update in the update script using sed
     much easier
@@ -25,35 +18,45 @@ let
   graalvm11-ce-dev-version = "22.2.0-dev-20220331_1955";
   graalvm17-ce-dev-version = "22.2.0-dev-20220331_1955";
 
+  commonProducts = [
+    "graalvm-ce"
+    "native-image-installable-svm"
+    "ruby-installable-svm"
+    "wasm-installable-svm"
+  ];
+
+  baseConfig = {
+    x86_64-darwin = {
+      arch = "darwin-amd64";
+      products = commonProducts ++ [ "python-installable-svm" ];
+      version = graalvm17-ce-release-version;
+    };
+    x86_64-linux = {
+      arch = "linux-amd64";
+      products = commonProducts ++ [ "python-installable-svm" ];
+      version = graalvm17-ce-release-version;
+    };
+    aarch64-darwin = {
+      arch = "darwin-aarch64";
+      products = [
+        "graalvm-ce"
+        "native-image-installable-svm"
+      ];
+      version = graalvm17-ce-dev-version;
+    };
+  };
+
 in
 {
   inherit mkGraal;
 
   graalvm11-ce = mkGraal rec {
-    config = {
-      x86_64-darwin = {
-        arch = "darwin-amd64";
-        products = commonProducts ++ [ "python-installable-svm" ];
-        version = graalvm11-ce-release-version;
-      };
-      x86_64-linux = {
-        arch = "linux-amd64";
-        products = commonProducts ++ [ "python-installable-svm" ];
-        version = graalvm11-ce-release-version;
-      };
+    config = baseConfig // {
       aarch64-linux = {
         arch = "linux-aarch64";
         products = commonProducts;
         version = graalvm11-ce-release-version;
       };
-      aarch64-darwin = {
-        arch = "darwin-aarch64";
-        products = [
-          "graalvm-ce"
-          "native-image-installable-svm"
-        ];
-        version = graalvm11-ce-dev-version;
-      };
     };
     javaVersion = "11";
     platforms = builtins.attrNames config;
@@ -65,26 +68,7 @@ in
   # directory"/tmp/SVM-4194439592488143713"): error=0, Failed to exec spawn
   # helper: pid: 19865, exit value: 1"
   graalvm17-ce = mkGraal rec {
-    config = {
-      x86_64-darwin = {
-        arch = "darwin-amd64";
-        products = commonProducts ++ [ "python-installable-svm" ];
-        version = graalvm17-ce-release-version;
-      };
-      x86_64-linux = {
-        arch = "linux-amd64";
-        products = commonProducts ++ [ "python-installable-svm" ];
-        version = graalvm17-ce-release-version;
-      };
-      aarch64-darwin = {
-        arch = "darwin-aarch64";
-        products = [
-          "graalvm-ce"
-          "native-image-installable-svm"
-        ];
-        version = graalvm17-ce-dev-version;
-      };
-    };
+    config = baseConfig;
     javaVersion = "17";
     platforms = builtins.attrNames config;
   };

From c736289b8a9a043ff8e2762c140747d340924620 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 1 Apr 2022 23:18:58 +0000
Subject: [PATCH 15/34] gummy: 0.1 -> 0.2

---
 pkgs/tools/misc/gummy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/gummy/default.nix b/pkgs/tools/misc/gummy/default.nix
index f7950650f7fc..cc1b68b7c0e8 100644
--- a/pkgs/tools/misc/gummy/default.nix
+++ b/pkgs/tools/misc/gummy/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gummy";
-  version = "0.1";
+  version = "0.2";
 
   src = fetchFromGitHub {
     owner = "fushko";
     repo = "gummy";
     rev = version;
-    sha256 = "sha256-CbZFuvFMmbFVX8k3duhhsg0fd9kVmhsj0VeFYil9YiE=";
+    sha256 = "sha256-nX5wEJ4HmgFHIgJP2MstBzQjU/9lrXOXoIl1vlolqak=";
   };
 
   nativeBuildInputs = [

From 8d8100073ad6c3cdd6422b2050ebb2916a8f5bb5 Mon Sep 17 00:00:00 2001
From: Anders Kaseorg <andersk@mit.edu>
Date: Fri, 1 Apr 2022 18:08:31 -0700
Subject: [PATCH 16/34] =?UTF-8?q?zulip:=205.8.1=20=E2=86=92=205.9.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
---
 .../networking/instant-messengers/zulip/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/zulip/default.nix b/pkgs/applications/networking/instant-messengers/zulip/default.nix
index 1fce1a6b6e52..3c43715dd981 100644
--- a/pkgs/applications/networking/instant-messengers/zulip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zulip/default.nix
@@ -5,12 +5,12 @@
 
 let
   pname = "zulip";
-  version = "5.8.1";
+  version = "5.9.0";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://github.com/zulip/zulip-desktop/releases/download/v${version}/Zulip-${version}-x86_64.AppImage";
-    sha256 = "02m18y5j6jmmlygv8ycwaaq6n7mvj97ljhd3l9pvii0adwcvrpfz";
+    hash = "sha256-qiGkZuGJsKuquMuAcO+9wbU4KW++uyOb4TKb9lCgZmI=";
     name="${pname}-${version}.AppImage";
   };
 

From 02d7b7a7a0085a1e882419d901583e41536ba08a Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Sat, 2 Apr 2022 07:52:20 +0200
Subject: [PATCH 17/34] obliv-c: fix build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Disable “fortify” hardening
---
 pkgs/development/compilers/obliv-c/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/compilers/obliv-c/default.nix b/pkgs/development/compilers/obliv-c/default.nix
index b7ec54ace7aa..f1cebcaa3ec8 100644
--- a/pkgs/development/compilers/obliv-c/default.nix
+++ b/pkgs/development/compilers/obliv-c/default.nix
@@ -12,6 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "1ib21ngn7zr58xxq4sjigrpaxb0wx35x3k9l4qvwflzrmvnman20";
   };
 
+  hardeningDisable = [ "fortify" ];
+
   patches = [ ./ignore-complex-float128.patch ];
 
   preBuild = ''

From 3d3e4fc4989546412270f2c410de2e334935bd7f Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Sat, 2 Apr 2022 07:53:11 +0200
Subject: [PATCH 18/34] =?UTF-8?q?obliv-c:=200.0pre20180624=20=E2=86=92=200?=
 =?UTF-8?q?.0pre20210621?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/compilers/obliv-c/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/obliv-c/default.nix b/pkgs/development/compilers/obliv-c/default.nix
index f1cebcaa3ec8..af895131dec9 100644
--- a/pkgs/development/compilers/obliv-c/default.nix
+++ b/pkgs/development/compilers/obliv-c/default.nix
@@ -1,15 +1,15 @@
 { lib, stdenv, libgcrypt, fetchFromGitHub, ocamlPackages, perl }:
 stdenv.mkDerivation rec {
   pname = "obliv-c";
-  version = "0.0pre20180624";
+  version = "0.0pre20210621";
   buildInputs = [ perl ]
   ++ (with ocamlPackages; [ ocaml findlib ocamlbuild ]);
   propagatedBuildInputs = [ libgcrypt ];
   src = fetchFromGitHub {
     owner = "samee";
     repo = "obliv-c";
-    rev = "3d6804ca0fd85868207a0ccbd2509ec064723ac2";
-    sha256 = "1ib21ngn7zr58xxq4sjigrpaxb0wx35x3k9l4qvwflzrmvnman20";
+    rev = "e02e5c590523ef4dae06e167a7fa00037bb3fdaf";
+    sha256 = "sha256:02vyr4689f4dmwqqs0q1mrack9h3g8jz3pj8zqiz987dk0r5mz7a";
   };
 
   hardeningDisable = [ "fortify" ];

From bfc501493fd792d5e9a874db54e15d4f51dfe5b7 Mon Sep 17 00:00:00 2001
From: Thibault Gagnaux <tgagnaux@gmail.com>
Date: Sat, 2 Apr 2022 10:54:44 +0200
Subject: [PATCH 19/34] graalvmXX-ce: add review suggestions

Co-authored-by: Thiago Kenji Okada <thiagokokada@gmail.com>
---
 .../graalvm/community-edition/mkGraal.nix     | 72 +++++++++----------
 .../graalvm/community-edition/update.nix      |  4 +-
 2 files changed, 34 insertions(+), 42 deletions(-)

diff --git a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
index 7642f25ac2ca..2986baca4e9a 100644
--- a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
@@ -44,7 +44,7 @@ let
   version = platform.version;
   name = "graalvm${javaVersion}-ce";
   sourcesFilename = "${name}-sources.json";
-  sources = builtins.fromJSON (builtins.readFile (./. + "/${sourcesFilename}"));
+  sources = builtins.fromJSON (builtins.readFile (./${sourcesFilename}));
 
   runtimeLibraryPath = lib.makeLibraryPath
     ([ cups ] ++ lib.optionals gtkSupport [ cairo glib gtk3 ]);
@@ -132,48 +132,40 @@ let
 
     outputs = [ "out" "lib" ];
 
-    installPhase =
-      let
-        copyClibrariesToOut = basepath: ''
-          # provide libraries needed for static compilation
-          ${
-            if useMusl then
-              "for f in ${musl.stdenv.cc.cc}/lib/* ${musl}/lib/* ${zlib.static}/lib/*; do"
-            else
-              "for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do"
-          }
-            ln -s $f ${basepath}/${platform.arch}/$(basename $f)
-          done
-        '';
-        copyClibrariesToLib = ''
-          # add those libraries to $lib output too, so we can use them with
-          # `native-image -H:CLibraryPath=''${lib.getLib graalvm11-ce}/lib ...` and reduce
-          # closure size by not depending on GraalVM $out (that is much bigger)
-          mkdir -p $lib/lib
-          for f in ${glibc}/lib/*; do
-            ln -s $f $lib/lib/$(basename $f)
-          done
-        '';
-      in
-      ''
-        # ensure that $lib/lib exists to avoid breaking builds
-        mkdir -p $lib/lib
-        # jni.h expects jni_md.h to be in the header search path.
-        ln -s $out/include/linux/*_md.h $out/include/
+    installPhase = ''
+      # ensure that $lib/lib exists to avoid breaking builds
+      mkdir -p $lib/lib
+      # jni.h expects jni_md.h to be in the header search path.
+      ln -s $out/include/linux/*_md.h $out/include/
 
-        # copy-paste openjdk's preFixup
-        # Set JAVA_HOME automatically.
-        mkdir -p $out/nix-support
-        cat > $out/nix-support/setup-hook << EOF
-          if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-        EOF
+      # copy-paste openjdk's preFixup
+      # Set JAVA_HOME automatically.
+      mkdir -p $out/nix-support
+      cat > $out/nix-support/setup-hook << EOF
+        if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
+      EOF
+      ${
+      lib.optionalString (stdenv.isLinux) ''
+        # provide libraries needed for static compilation
         ${
-        lib.optionalString (stdenv.isLinux) ''
-          ${copyClibrariesToOut "$out/lib/svm/clibraries"}
-          ${copyClibrariesToLib}
-        ''
+          if useMusl then
+            "for f in ${musl.stdenv.cc.cc}/lib/* ${musl}/lib/* ${zlib.static}/lib/*; do"
+          else
+            "for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do"
         }
-      '';
+          ln -s $f $out/lib/svm/clibraries/${platform.arch}/$(basename $f)
+        done
+
+        # add those libraries to $lib output too, so we can use them with
+        # `native-image -H:CLibraryPath=''${lib.getLib graalvmXX-ce}/lib ...` and reduce
+        # closure size by not depending on GraalVM $out (that is much bigger)
+        mkdir -p $lib/lib
+        for f in ${glibc}/lib/*; do
+          ln -s $f $lib/lib/$(basename $f)
+        done
+      ''
+      }
+    '';
 
     dontStrip = true;
 
diff --git a/pkgs/development/compilers/graalvm/community-edition/update.nix b/pkgs/development/compilers/graalvm/community-edition/update.nix
index 724282e7b92c..a687667eff53 100644
--- a/pkgs/development/compilers/graalvm/community-edition/update.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/update.nix
@@ -183,7 +183,7 @@ let
 
   newVersion = getLatestVersion graalVersion;
   sourcesJson = genSources javaVersion config;
-  sourcesJsonPath = lib.strings.escapeShellArg ././${sourcesFilename};
+  sourcesJsonPath = lib.strings.escapeShellArg ./${sourcesFilename};
 
   # versionKeyInDefaultNix String -> String
   versionKeyInDefaultNix = graalVersion:
@@ -208,7 +208,7 @@ let
         export PATH="${lib.makeBinPath [ jq gnused ]}:$PATH"
         jq . ${sourcesJson} > ${sourcesJsonPath}
         sed -i 's|${versionKey} = "${currentVersion}";|${versionKey} = "${newVersion}";|' \
-          ${lib.strings.escapeShellArg ././default.nix}
+          ${lib.strings.escapeShellArg ./default.nix}
       ''
     else ''echo "No new version found. Skip updating."'';
 

From dfdab81577d516aa81b50a97f8d0d853fb99a832 Mon Sep 17 00:00:00 2001
From: OPNA2608 <christoph.neidahl@gmail.com>
Date: Sat, 2 Apr 2022 11:17:42 +0200
Subject: [PATCH 20/34] palemoon: 29.4.5 -> 29.4.5.1, add version test

---
 .../networking/browsers/palemoon/default.nix  | 35 +++++++++++--------
 1 file changed, 21 insertions(+), 14 deletions(-)

diff --git a/pkgs/applications/networking/browsers/palemoon/default.nix b/pkgs/applications/networking/browsers/palemoon/default.nix
index 0a0a7f341c06..cce3f39d3c31 100644
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@@ -31,6 +31,8 @@
 , zip
 , zlib
 , withGTK3 ? true, gtk3, gtk2
+, testVersion
+, palemoon
 }:
 
 # Only specific GCC versions are supported with branding
@@ -44,12 +46,12 @@ assert with lib.strings; (
 
 stdenv.mkDerivation rec {
   pname = "palemoon";
-  version = "29.4.5";
+  version = "29.4.5.1";
 
   src = fetchzip {
     name = "${pname}-${version}";
     url = "http://archive.palemoon.org/source/${pname}-${version}.source.tar.xz";
-    sha256 = "sha256-ls4uhfFaiFHkmAVbwwBenm71sNm6Tql2tMpzk9D2b5Y=";
+    sha256 = "sha256-IC7E88dECAz2diVLEEdjMltpNMBhPTlPvbz05BniBMI=";
   };
 
   nativeBuildInputs = [
@@ -194,18 +196,23 @@ stdenv.mkDerivation rec {
     platforms = [ "i686-linux" "x86_64-linux" ];
   };
 
-  passthru.updateScript = writeScript "update-${pname}" ''
-    #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p common-updater-scripts curl libxml2
+  passthru = {
+    updateScript = writeScript "update-${pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts curl libxml2
 
-    set -eu -o pipefail
+      set -eu -o pipefail
 
-    # Only release note announcement == finalized release
-    version="$(
-      curl -s 'http://www.palemoon.org/releasenotes.shtml' |
-      xmllint --html --xpath 'html/body/table/tbody/tr/td/h3/text()' - 2>/dev/null | head -n1 |
-      sed 's/v\(\S*\).*/\1/'
-    )"
-    update-source-version ${pname} "$version"
-  '';
+      # Only release note announcement == finalized release
+      version="$(
+        curl -s 'http://www.palemoon.org/releasenotes.shtml' |
+        xmllint --html --xpath 'html/body/table/tbody/tr/td/h3/text()' - 2>/dev/null | head -n1 |
+        sed 's/v\(\S*\).*/\1/'
+      )"
+      update-source-version ${pname} "$version"
+    '';
+    tests.version = testVersion {
+      package = palemoon;
+    };
+  };
 }

From 2d7d3692c125cc07954b342f84c797019c37633c Mon Sep 17 00:00:00 2001
From: Thibault Gagnaux <tgagnaux@gmail.com>
Date: Sat, 2 Apr 2022 11:33:07 +0200
Subject: [PATCH 21/34] graalvmXX-ce: use the release version as
 `defaultVersion`

---
 .../graalvm/community-edition/default.nix     | 65 +++++++++++--------
 .../graalvm11-ce-sources.json                 | 12 ++--
 .../graalvm17-ce-sources.json                 | 12 ++--
 .../graalvm/community-edition/mkGraal.nix     |  5 +-
 .../graalvm/community-edition/update.nix      | 15 +++--
 5 files changed, 62 insertions(+), 47 deletions(-)

diff --git a/pkgs/development/compilers/graalvm/community-edition/default.nix b/pkgs/development/compilers/graalvm/community-edition/default.nix
index 634844a2b209..6f42bfcc4539 100644
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@@ -15,8 +15,8 @@ let
   */
   graalvm11-ce-release-version = "22.0.0.2";
   graalvm17-ce-release-version = "22.0.0.2";
-  graalvm11-ce-dev-version = "22.2.0-dev-20220331_1955";
-  graalvm17-ce-dev-version = "22.2.0-dev-20220331_1955";
+  graalvm11-ce-dev-version = "22.2.0-dev-20220401_1942";
+  graalvm17-ce-dev-version = "22.2.0-dev-20220401_1942";
 
   commonProducts = [
     "graalvm-ce"
@@ -25,39 +25,34 @@ let
     "wasm-installable-svm"
   ];
 
-  baseConfig = {
-    x86_64-darwin = {
-      arch = "darwin-amd64";
-      products = commonProducts ++ [ "python-installable-svm" ];
-      version = graalvm17-ce-release-version;
-    };
-    x86_64-linux = {
-      arch = "linux-amd64";
-      products = commonProducts ++ [ "python-installable-svm" ];
-      version = graalvm17-ce-release-version;
-    };
-    aarch64-darwin = {
-      arch = "darwin-aarch64";
-      products = [
-        "graalvm-ce"
-        "native-image-installable-svm"
-      ];
-      version = graalvm17-ce-dev-version;
-    };
-  };
-
 in
 {
   inherit mkGraal;
 
   graalvm11-ce = mkGraal rec {
-    config = baseConfig // {
+    config = {
+      x86_64-darwin = {
+        arch = "darwin-amd64";
+        products = commonProducts ++ [ "python-installable-svm" ];
+      };
+      x86_64-linux = {
+        arch = "linux-amd64";
+        products = commonProducts ++ [ "python-installable-svm" ];
+      };
+      aarch64-darwin = {
+        arch = "darwin-aarch64";
+        products = [
+          "graalvm-ce"
+          "native-image-installable-svm"
+        ];
+        version = graalvm11-ce-dev-version;
+      };
       aarch64-linux = {
         arch = "linux-aarch64";
         products = commonProducts;
-        version = graalvm11-ce-release-version;
       };
     };
+    defaultVersion = graalvm11-ce-release-version;
     javaVersion = "11";
     platforms = builtins.attrNames config;
   };
@@ -68,7 +63,25 @@ in
   # directory"/tmp/SVM-4194439592488143713"): error=0, Failed to exec spawn
   # helper: pid: 19865, exit value: 1"
   graalvm17-ce = mkGraal rec {
-    config = baseConfig;
+    config = {
+      x86_64-darwin = {
+        arch = "darwin-amd64";
+        products = commonProducts ++ [ "python-installable-svm" ];
+      };
+      x86_64-linux = {
+        arch = "linux-amd64";
+        products = commonProducts ++ [ "python-installable-svm" ];
+      };
+      aarch64-darwin = {
+        arch = "darwin-aarch64";
+        products = [
+          "graalvm-ce"
+          "native-image-installable-svm"
+        ];
+        version = graalvm17-ce-dev-version;
+      };
+    };
+    defaultVersion = graalvm17-ce-release-version;
     javaVersion = "17";
     platforms = builtins.attrNames config;
   };
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json b/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
index d12df716e05a..070c783d0336 100644
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
+++ b/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
@@ -1,12 +1,12 @@
 {
   "darwin-aarch64": {
-    "graalvm-ce|java11|22.2.0-dev-20220331_1955": {
-      "sha256": "a1229931575bd90256f5453ce9c880cf2286db117d4cbfec92c033813b017035",
-      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220331_1955/graalvm-ce-java11-darwin-aarch64-dev.tar.gz"
+    "graalvm-ce|java11|22.2.0-dev-20220401_1942": {
+      "sha256": "c83dee740ae148486598759e44a717b09d8124e4ea50f9da1e7d49d016572b89",
+      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220401_1942/graalvm-ce-java11-darwin-aarch64-dev.tar.gz"
     },
-    "native-image-installable-svm|java11|22.2.0-dev-20220331_1955": {
-      "sha256": "813f9cc417415801e3d7d6468bb06e45487c76fe35b56202b66b6c9fa3ce3456",
-      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220331_1955/native-image-installable-svm-java11-darwin-aarch64-dev.jar"
+    "native-image-installable-svm|java11|22.2.0-dev-20220401_1942": {
+      "sha256": "661311ae26bfd6c46360b9e65aabe9361dc5cd05878a404343adf16925ae78fa",
+      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220401_1942/native-image-installable-svm-java11-darwin-aarch64-dev.jar"
     }
   },
   "darwin-amd64": {
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json b/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
index ebc87f1e7970..65e28b8b11cc 100644
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
+++ b/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
@@ -1,12 +1,12 @@
 {
   "darwin-aarch64": {
-    "graalvm-ce|java17|22.2.0-dev-20220331_1955": {
-      "sha256": "bb217a3bd53a488ef3672920fd47b9a0d800243eb385a7ceae9ddbd4350c0b27",
-      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220331_1955/graalvm-ce-java17-darwin-aarch64-dev.tar.gz"
+    "graalvm-ce|java17|22.2.0-dev-20220401_1942": {
+      "sha256": "f0409c59adbce62da7be46ab7d0e01abe5c080ef97d0b555e6c773f94dbfdecf",
+      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220401_1942/graalvm-ce-java17-darwin-aarch64-dev.tar.gz"
     },
-    "native-image-installable-svm|java17|22.2.0-dev-20220331_1955": {
-      "sha256": "eee405e704792794f45e619372e72e0343ba2caf8ace0e4c7abd8baa69e56bcf",
-      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220331_1955/native-image-installable-svm-java17-darwin-aarch64-dev.jar"
+    "native-image-installable-svm|java17|22.2.0-dev-20220401_1942": {
+      "sha256": "3770dc4810d7ebae8f9ca2212e91112629096a964d3caea1667b0aaf5f70c1e0",
+      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220401_1942/native-image-installable-svm-java17-darwin-aarch64-dev.jar"
     }
   },
   "darwin-amd64": {
diff --git a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
index 2986baca4e9a..be4a0dc6dabe 100644
--- a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
@@ -1,4 +1,5 @@
 { javaVersion
+, defaultVersion
 , platforms
 , config
 , useMusl ? false
@@ -41,7 +42,7 @@ assert useMusl -> stdenv.isLinux;
 
 let
   platform = config.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  version = platform.version;
+  version = platform.version or defaultVersion;
   name = "graalvm${javaVersion}-ce";
   sourcesFilename = "${name}-sources.json";
   sources = builtins.fromJSON (builtins.readFile (./${sourcesFilename}));
@@ -284,7 +285,7 @@ let
     passthru = {
       home = graalvmXXX-ce;
       updateScript = import ./update.nix {
-        inherit lib writeShellScript jq sourcesFilename name config gnused;
+        inherit lib writeShellScript jq sourcesFilename name config gnused defaultVersion;
         graalVersion = version;
         javaVersion = "java${javaVersion}";
       };
diff --git a/pkgs/development/compilers/graalvm/community-edition/update.nix b/pkgs/development/compilers/graalvm/community-edition/update.nix
index a687667eff53..42c128cb4fba 100644
--- a/pkgs/development/compilers/graalvm/community-edition/update.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/update.nix
@@ -1,5 +1,6 @@
 { javaVersion
 , graalVersion
+, defaultVersion
 , config
 , sourcesFilename
 , name
@@ -151,12 +152,12 @@ let
       };
     };
 
-  # genArchProductVersionPairs :: String -> AttrSet -> [AttrSet]
-  genArchProductVersionList = javaVersion: archProducts:
+  # genArchProductVersionPairs :: String -> -> String -> AttrSet -> [AttrSet]
+  genArchProductVersionList = javaVersion: graalVersion: archProducts:
     let
       arch = archProducts.arch;
       products = archProducts.products;
-      javaGraalVersion = javaVersion + separator + (getLatestVersion archProducts.version);
+      javaGraalVersion = javaVersion + separator + (getLatestVersion (archProducts.version or graalVersion));
       productJavaGraalVersionList =
         cartesianZipListsWith (a: b: a + separator + b)
           products [ javaGraalVersion ];
@@ -164,11 +165,11 @@ let
     cartesianZipListsWith (genUrlAndSha256) [ arch ] productJavaGraalVersionList;
 
 
-  # genSources :: String -> AttrSet -> Path String
-  genSources = javaVersion: config:
+  # genSources :: String -> String -> AttrSet -> Path String
+  genSources = javaVersion: defaultVersion: config:
     let
       archProducts = builtins.attrValues config;
-      sourcesList = builtins.concatMap (genArchProductVersionList javaVersion) archProducts;
+      sourcesList = builtins.concatMap (genArchProductVersionList javaVersion defaultVersion) archProducts;
       sourcesAttr = builtins.foldl' (lib.recursiveUpdate) { } sourcesList;
     in
     builtins.toFile "sources.json" (builtins.toJSON sourcesAttr);
@@ -182,7 +183,7 @@ let
     }.${builtins.toString (builtins.compareVersions newVersion currentVersion)};
 
   newVersion = getLatestVersion graalVersion;
-  sourcesJson = genSources javaVersion config;
+  sourcesJson = genSources javaVersion defaultVersion config;
   sourcesJsonPath = lib.strings.escapeShellArg ./${sourcesFilename};
 
   # versionKeyInDefaultNix String -> String

From be1232ea2ff017f22ce3d37ba0edc9667f9cb4ee Mon Sep 17 00:00:00 2001
From: Thibault Gagnaux <tgagnaux@gmail.com>
Date: Sat, 2 Apr 2022 13:09:33 +0200
Subject: [PATCH 22/34] graalvmXX-ce: fix relative paths

---
 .../development/compilers/graalvm/community-edition/mkGraal.nix | 2 +-
 pkgs/development/compilers/graalvm/community-edition/update.nix | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
index be4a0dc6dabe..5b20890ced1b 100644
--- a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
@@ -45,7 +45,7 @@ let
   version = platform.version or defaultVersion;
   name = "graalvm${javaVersion}-ce";
   sourcesFilename = "${name}-sources.json";
-  sources = builtins.fromJSON (builtins.readFile (./${sourcesFilename}));
+  sources = builtins.fromJSON (builtins.readFile (./. + "/${sourcesFilename}"));
 
   runtimeLibraryPath = lib.makeLibraryPath
     ([ cups ] ++ lib.optionals gtkSupport [ cairo glib gtk3 ]);
diff --git a/pkgs/development/compilers/graalvm/community-edition/update.nix b/pkgs/development/compilers/graalvm/community-edition/update.nix
index 42c128cb4fba..191f3cb45a15 100644
--- a/pkgs/development/compilers/graalvm/community-edition/update.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/update.nix
@@ -184,7 +184,7 @@ let
 
   newVersion = getLatestVersion graalVersion;
   sourcesJson = genSources javaVersion defaultVersion config;
-  sourcesJsonPath = lib.strings.escapeShellArg ./${sourcesFilename};
+  sourcesJsonPath = lib.strings.escapeShellArg ./. + "/${sourcesFilename}";
 
   # versionKeyInDefaultNix String -> String
   versionKeyInDefaultNix = graalVersion:

From 1bab8ca98a788726e3eb9c0750e54b4d849ba506 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sat, 26 Mar 2022 18:33:57 +0100
Subject: [PATCH 23/34] d-spy: init at 1.2.0

---
 pkgs/development/tools/misc/d-spy/default.nix | 67 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 69 insertions(+)
 create mode 100644 pkgs/development/tools/misc/d-spy/default.nix

diff --git a/pkgs/development/tools/misc/d-spy/default.nix b/pkgs/development/tools/misc/d-spy/default.nix
new file mode 100644
index 000000000000..a1fbecd5b263
--- /dev/null
+++ b/pkgs/development/tools/misc/d-spy/default.nix
@@ -0,0 +1,67 @@
+{ stdenv
+, lib
+, desktop-file-utils
+, fetchpatch
+, fetchurl
+, glib
+, gtk4
+, libadwaita
+, meson
+, ninja
+, pkg-config
+, wrapGAppsHook4
+, gnome
+}:
+
+stdenv.mkDerivation rec {
+  pname = "d-spy";
+  version = "1.2.0";
+
+  outputs = [ "out" "lib" "dev" ];
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/dspy/${lib.versions.majorMinor version}/dspy-${version}.tar.xz";
+    sha256 = "XKL0z00w0va9m1OfuVq5YJyE1jzeynBxb50jc+O99tQ=";
+  };
+
+  patches = [
+    # Remove pointless dependencies
+    # https://gitlab.gnome.org/GNOME/d-spy/-/merge_requests/6
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/d-spy/-/commit/5a0ec8d53d006e95e93c6d6e32a381eb248b12a1.patch";
+      sha256 = "jalfdAXcH8GZ50qb2peG+2841cGan4EhwN88z5Ewf+k=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    desktop-file-utils
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    glib
+    gtk4
+    libadwaita
+  ];
+
+  passthru = {
+    updateScript = gnome.updateScript {
+      packageName = "dspy";
+      attrPath = "d-spy";
+    };
+  };
+
+  meta = with lib; {
+    description = "D-Bus exploration tool";
+    homepage = "https://gitlab.gnome.org/GNOME/d-spy";
+    license = with licenses; [
+      lgpl3Plus # library
+      gpl3Plus # app
+    ];
+    maintainers = teams.gnome.members;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index dedabba0e5a8..016e8ff24939 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15014,6 +15014,8 @@ with pkgs;
 
   dfeet = callPackage ../development/tools/misc/d-feet { };
 
+  d-spy = callPackage ../development/tools/misc/d-spy { };
+
   dfu-programmer = callPackage ../development/tools/misc/dfu-programmer { };
 
   dfu-util = callPackage ../development/tools/misc/dfu-util { };

From 4d628da3d72f3bfb4d6114c2dd1a5e7fa53ef58b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 1 Apr 2022 20:10:46 +0000
Subject: [PATCH 24/34] grails: 5.1.4 -> 5.1.6

---
 pkgs/development/web/grails/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/web/grails/default.nix b/pkgs/development/web/grails/default.nix
index 5caacbd0d507..c300062c5235 100644
--- a/pkgs/development/web/grails/default.nix
+++ b/pkgs/development/web/grails/default.nix
@@ -11,11 +11,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "grails";
-  version = "5.1.4";
+  version = "5.1.6";
 
   src = fetchurl {
     url = "https://github.com/grails/grails-core/releases/download/v${version}/grails-${version}.zip";
-    sha256 = "sha256-EoMSnT1MmYGeF82XC7Ed9woe8t+xzYJaylLBVpdFvoI=";
+    sha256 = "sha256-H4c/Nu6iOgaRLl/uV51nYnNQg5p9cjl/taexZnl4t+I=";
   };
 
   nativeBuildInputs = [ unzip ];

From 755c98a360808aae99490373e0fc2171529792c5 Mon Sep 17 00:00:00 2001
From: happysalada <raphael@megzari.com>
Date: Fri, 1 Apr 2022 22:09:37 -0400
Subject: [PATCH 25/34] python3.pkgs.kubernetes: fix darwin build

---
 pkgs/development/python-modules/kubernetes/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/kubernetes/default.nix b/pkgs/development/python-modules/kubernetes/default.nix
index 2342ec5bde4a..8508e5178f52 100644
--- a/pkgs/development/python-modules/kubernetes/default.nix
+++ b/pkgs/development/python-modules/kubernetes/default.nix
@@ -55,7 +55,7 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
+  disabledTests = lib.optionals stdenv.isDarwin [
     # AssertionError: <class 'urllib3.poolmanager.ProxyManager'> != <class 'urllib3.poolmanager.Poolmanager'>
     "test_rest_proxycare"
   ];

From 417c4d1c47e306664d7d020a0cb9647f26709fe3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 23 Mar 2022 04:28:18 +0000
Subject: [PATCH 26/34] argo: 3.3.0 -> 3.3.1

---
 pkgs/applications/networking/cluster/argo/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/argo/default.nix b/pkgs/applications/networking/cluster/argo/default.nix
index 503952fa59ad..de1310f55d74 100644
--- a/pkgs/applications/networking/cluster/argo/default.nix
+++ b/pkgs/applications/networking/cluster/argo/default.nix
@@ -19,13 +19,13 @@ let
 in
 buildGoModule rec {
   pname = "argo";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo";
     rev = "v${version}";
-    sha256 = "sha256-BDHbbb3WqQvRJB1A4NInfvujjB3r/AMmVvos8i/CnyU=";
+    sha256 = "sha256-IcKueb/bxPNwJ9bZWwmz4ywCtZGk0PSuH3KYDMp6Qd4=";
   };
 
   vendorSha256 = "sha256-YeSeaYOkNRjQgxsK9G7iPbVpfrPs4HRRFwfoUDxoCm0=";

From 4aac9fc8c3732e0f861d78bd11d76849d32036ae Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 30 Mar 2022 04:21:21 +0000
Subject: [PATCH 27/34] helmfile: 0.143.3 -> 0.143.5

---
 pkgs/applications/networking/cluster/helmfile/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/helmfile/default.nix b/pkgs/applications/networking/cluster/helmfile/default.nix
index b4c4fde53ed5..da3b85d89933 100644
--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "helmfile";
-  version = "0.143.3";
+  version = "0.143.5";
 
   src = fetchFromGitHub {
     owner = "roboll";
     repo = "helmfile";
     rev = "v${version}";
-    sha256 = "sha256-A0xpXsMWUaJYTzo9O4KkdyjonSGZ+FylTK140pqnJX8=";
+    sha256 = "sha256-48DbN3O5HVlNpHct6uKw9CjeaDlAZqY+/Tqd4a9mmUw=";
   };
 
-  vendorSha256 = "sha256-qolmWat7An4HFm4O5vSCYZe+w79nsRIrnBLJacUCeA4=";
+  vendorSha256 = "sha256-ddf3m0DGsjubzp/aERvhfJ51UKKSNMC1Xu7ybyif8HA=";
 
   doCheck = false;
 

From c1ecd4637e74e31ba821d3426eccd8bb7ca3ce09 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 1 Apr 2022 19:16:03 +0000
Subject: [PATCH 28/34] fluxctl: 1.24.3 -> 1.25.0

---
 pkgs/applications/networking/cluster/fluxctl/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/fluxctl/default.nix b/pkgs/applications/networking/cluster/fluxctl/default.nix
index af0db3f2c176..c132a09fce34 100644
--- a/pkgs/applications/networking/cluster/fluxctl/default.nix
+++ b/pkgs/applications/networking/cluster/fluxctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fluxctl";
-  version = "1.24.3";
+  version = "1.25.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = "flux";
     rev = version;
-    sha256 = "sha256-i86WwSR14hxaXWMesvG2mG8nqXd97M3TekK2FLTLL+Y=";
+    sha256 = "sha256-EFB8iAs7e4FigYnTvkh+dpZq6ymX7Qfy0cUDtUaPdmM=";
   };
 
-  vendorSha256 = "sha256-Fw3/SMO66eExlDNcIaHM+G2kB4zb1Cih7kp8xfel/iY=";
+  vendorSha256 = "sha256-9RyTeGjp7mEpmWnQeK2uG1krO6+1sK6fsID6JVrejHw=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From dd6d916ddd69edda03624695427adf4bba75c8d3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 20 Mar 2022 04:43:01 +0000
Subject: [PATCH 29/34] vcluster: 0.6.0 -> 0.7.0

---
 pkgs/applications/networking/cluster/vcluster/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/vcluster/default.nix b/pkgs/applications/networking/cluster/vcluster/default.nix
index 7f1476d7fbf8..18ca0709af57 100644
--- a/pkgs/applications/networking/cluster/vcluster/default.nix
+++ b/pkgs/applications/networking/cluster/vcluster/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "vcluster";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "loft-sh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kY12bsZyDb36KE2dWx6RVYlKTbJh+XFQcBpFXoCLgEM=";
+    sha256 = "sha256-Yf2ZLhB6yfXySvPajI9mvdcYQPPpKI+LZ6+PMvOS4qo=";
   };
 
   vendorSha256 = null;

From b652b434a4d0bb11411024648121b3666f1faa92 Mon Sep 17 00:00:00 2001
From: Ulrik Strid <ulrik.strid@outlook.com>
Date: Sat, 2 Apr 2022 08:20:46 +0200
Subject: [PATCH 30/34] davinci-resolve: unbreak

---
 pkgs/applications/video/davinci-resolve/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/video/davinci-resolve/default.nix b/pkgs/applications/video/davinci-resolve/default.nix
index 289fcdad5227..5a3e76ffcaf5 100644
--- a/pkgs/applications/video/davinci-resolve/default.nix
+++ b/pkgs/applications/video/davinci-resolve/default.nix
@@ -16,6 +16,7 @@
 , xkeyboard_config
 , glib
 , libarchive
+, python
 }:
 
 let

From 815601ff61555c150edaed35a07b20efdfb8bc95 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Fri, 1 Apr 2022 15:14:03 +0800
Subject: [PATCH 31/34] glib: use correct meson for cross compilation

---
 pkgs/development/libraries/glib/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index ecae47b3d2dd..a7b8f0d44bf6 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -115,7 +115,7 @@ stdenv.mkDerivation rec {
   strictDeps = true;
 
   nativeBuildInputs = [
-    (meson.override {
+    (buildPackages.meson.override {
       withDarwinFrameworksGtkDocPatch = stdenv.isDarwin;
     })
     ninja pkg-config perl python3 gettext gtk-doc docbook_xsl docbook_xml_dtd_45 libxml2

From 96674e9c3b55995ded1b99ec41599e8d6f7f436b Mon Sep 17 00:00:00 2001
From: matthewcroughan <matt@croughan.sh>
Date: Thu, 31 Mar 2022 21:14:47 +0100
Subject: [PATCH 32/34] qemu: add patch to fix MTP devices

Co-authored-by: Alyssa Ross <hi@alyssa.is>
---
 pkgs/applications/virtualization/qemu/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 8f22e499d359..954fd3f051a9 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -88,6 +88,11 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./fix-qemu-ga.patch
+    # MTP Devices were broken in QEMU 6.1.0, this patch fixes that.
+     (fetchpatch {
+       url = "https://gitlab.com/qemu-project/qemu/-/commit/9d30c78c7d3b994825cbe63fa277279ae3ef4248.patch";
+       sha256 = "sha256-AChB9HMEShrM+2UW2aOT9+MqlAm568sG3HxHK3nDC/M=";
+     })
     # Cocoa clipboard support only works on macOS 10.14+
     (fetchpatch {
       url = "https://gitlab.com/qemu-project/qemu/-/commit/7e3e20d89129614f4a7b2451fe321cc6ccca3b76.diff";

From 549a1bf9eb8bfa37526d4cefa82c019d92908565 Mon Sep 17 00:00:00 2001
From: Lev Livnev <lev@liv.nev.org.uk>
Date: Sat, 2 Apr 2022 16:16:31 +0200
Subject: [PATCH 33/34] cryptowatch-desktop: init at 0.5.0

---
 .../finance/cryptowatch/default.nix           | 57 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 59 insertions(+)
 create mode 100644 pkgs/applications/finance/cryptowatch/default.nix

diff --git a/pkgs/applications/finance/cryptowatch/default.nix b/pkgs/applications/finance/cryptowatch/default.nix
new file mode 100644
index 000000000000..09531e4650e8
--- /dev/null
+++ b/pkgs/applications/finance/cryptowatch/default.nix
@@ -0,0 +1,57 @@
+{ stdenv
+, lib
+, fetchurl
+, autoPatchelfHook
+, wrapGAppsHook
+, dbus
+, libGL
+, libX11
+, libXcursor
+, libXi
+, libXrandr
+, udev
+, unzip
+}:
+
+stdenv.mkDerivation rec {
+  pname = "cryptowatch-desktop";
+  version = "0.5.0";
+
+  src = fetchurl {
+    url = "https://cryptowat.ch/desktop/download/linux/${version}";
+    sha256 = "0lr5fsd0f44b1v9f2dvx0a0lmz9dyivyz5d98qx2gcv3jkngw34v";
+  };
+
+  unpackPhase = "unzip $src";
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    wrapGAppsHook
+    unzip
+  ];
+
+  buildInputs = [
+    dbus
+    udev
+  ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    install -m755 -D cryptowatch_desktop $out/bin/cryptowatch_desktop
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL libX11 libXcursor libXrandr libXi ]}"
+    )
+  '';
+
+  meta = with lib; {
+    homepage = "https://cryptowat.ch";
+    description = "Application for visualising real-time cryptocurrency market data";
+    platforms = platforms.linux;
+    license = licenses.unfree;
+    maintainers = with maintainers; [ livnev ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 016e8ff24939..ae84967a7479 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -335,6 +335,8 @@ with pkgs;
 
   crow-translate = libsForQt5.callPackage ../applications/misc/crow-translate { };
 
+  cryptowatch-desktop = callPackage ../applications/finance/cryptowatch { };
+
   dhallDirectoryToNix = callPackage ../build-support/dhall/directory-to-nix.nix { };
 
   dhallPackageToNix = callPackage ../build-support/dhall/package-to-nix.nix { };

From 376d67e1cd05d5ac8a64a3f47f17b80fb6394792 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 Apr 2022 16:08:44 +0000
Subject: [PATCH 34/34] prometheus-wireguard-exporter: 3.6.2 -> 3.6.3

---
 pkgs/servers/monitoring/prometheus/wireguard-exporter.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/monitoring/prometheus/wireguard-exporter.nix b/pkgs/servers/monitoring/prometheus/wireguard-exporter.nix
index 61cf36f882df..cfa2d1d43a15 100644
--- a/pkgs/servers/monitoring/prometheus/wireguard-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/wireguard-exporter.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wireguard-exporter";
-  version = "3.6.2";
+  version = "3.6.3";
 
   src = fetchFromGitHub {
     owner = "MindFlavor";
     repo = "prometheus_wireguard_exporter";
     rev = version;
-    sha256 = "sha256-eVGyBynKZLGlsaLwUOx7cJWdRHl65S0Wk1K5c9T8ysQ=";
+    sha256 = "sha256-m29/whlmhIkLin84NOWs2NVZcXNpVsyyHZ1CLp4FXd0=";
   };
 
-  cargoSha256 = "sha256-JbFoaMTs6TPYq2qgBkT7WX1itMXohgcWbC1UvaXOi8o=";
+  cargoSha256 = "sha256-XK4hjBIcOx6JMv61gOpIXaZy7Unw+Bk84TEb+8Fib6Q=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];