From ebd4619053711ffb317a36dca4b118ae33f17828 Mon Sep 17 00:00:00 2001
From: Ivan Trubach <mr.trubach@icloud.com>
Date: Mon, 19 Jun 2023 08:56:21 +0300
Subject: [PATCH 001/154] patch-shebangs: add a flag to update shebangs with
 store paths

This change adds a flag to update shebang paths that point to the Nix
store. This is particularly useful when a cross-compiled package uses
same script at compile-time and run-time, but the interpreter must be
changed since hostPlatform != buildPlatform.
---
 .../setup-hooks/patch-shebangs.sh             | 42 ++++++++++++++-----
 pkgs/test/stdenv/patch-shebangs.nix           | 19 ++++++++-
 2 files changed, 50 insertions(+), 11 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/patch-shebangs.sh b/pkgs/build-support/setup-hooks/patch-shebangs.sh
index 9a48440debec3..e6872db1acd70 100644
--- a/pkgs/build-support/setup-hooks/patch-shebangs.sh
+++ b/pkgs/build-support/setup-hooks/patch-shebangs.sh
@@ -11,11 +11,12 @@ fixupOutputHooks+=(patchShebangsAuto)
 
 # Run patch shebangs on a directory or file.
 # Can take multiple paths as arguments.
-# patchShebangs [--build | --host] PATH...
+# patchShebangs [--build | --host | --update] [--] PATH...
 
 # Flags:
 # --build : Lookup commands available at build-time
 # --host  : Lookup commands available at runtime
+# --update : Update shebang paths that are in Nix store
 
 # Example use cases,
 # $ patchShebangs --host /nix/store/...-hello-1.0/bin
@@ -23,14 +24,35 @@ fixupOutputHooks+=(patchShebangsAuto)
 
 patchShebangs() {
     local pathName
-
-    if [[ "$1" == "--host" ]]; then
-        pathName=HOST_PATH
-        shift
-    elif [[ "$1" == "--build" ]]; then
-        pathName=PATH
-        shift
-    fi
+    local update
+
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+        --host)
+            pathName=HOST_PATH
+            shift
+            ;;
+        --build)
+            pathName=PATH
+            shift
+            ;;
+        --update)
+            update=true
+            shift
+            ;;
+        --)
+            shift
+            break
+            ;;
+        -*|--*)
+            echo "Unknown option $1 supplied to patchShebangs" >&2
+            return 1
+            ;;
+        *)
+            break
+            ;;
+        esac
+    done
 
     echo "patching script interpreter paths in $@"
     local f
@@ -93,7 +115,7 @@ patchShebangs() {
         newInterpreterLine="$newPath $args"
         newInterpreterLine=${newInterpreterLine%${newInterpreterLine##*[![:space:]]}}
 
-        if [[ -n "$oldPath" && "${oldPath:0:${#NIX_STORE}}" != "$NIX_STORE" ]]; then
+        if [[ -n "$oldPath" && ( "$update" == true || "${oldPath:0:${#NIX_STORE}}" != "$NIX_STORE" ) ]]; then
             if [[ -n "$newPath" && "$newPath" != "$oldPath" ]]; then
                 echo "$f: interpreter directive changed from \"$oldInterpreterLine\" to \"$newInterpreterLine\""
                 # escape the escape chars so that sed doesn't interpret them
diff --git a/pkgs/test/stdenv/patch-shebangs.nix b/pkgs/test/stdenv/patch-shebangs.nix
index fb52f38ecc91b..888d4a53a2733 100644
--- a/pkgs/test/stdenv/patch-shebangs.nix
+++ b/pkgs/test/stdenv/patch-shebangs.nix
@@ -39,6 +39,23 @@ let
       };
     };
 
+    updates-nix-store = stdenv.mkDerivation {
+      name = "updates-nix-store";
+      strictDeps = false;
+      dontUnpack = true;
+      installPhase = ''
+        mkdir -p $out/bin
+        echo "#!$NIX_STORE/path/to/bash" > $out/bin/test
+        echo "echo -n hello" >> $out/bin/test
+        chmod +x $out/bin/test
+        patchShebangs --update $out/bin/test
+        dontPatchShebangs=1
+      '';
+      passthru = {
+        assertion = "grep '^#!${stdenv.shell}' $out/bin/test > /dev/null";
+      };
+    };
+
     split-string = stdenv.mkDerivation {
       name = "split-string";
       strictDeps = false;
@@ -59,7 +76,7 @@ let
 in
 stdenv.mkDerivation {
   name = "test-patch-shebangs";
-  passthru = { inherit (tests) bad-shebang ignores-nix-store split-string; };
+  passthru = { inherit (tests) bad-shebang ignores-nix-store updates-nix-store split-string; };
   buildCommand = ''
     validate() {
       local name=$1

From 732e4469cbcfeef847f46c99f3cddb7b6558021d Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Tue, 11 Jul 2023 13:19:47 -0600
Subject: [PATCH 002/154] darwin.adv_cmds: fix build with clang 16

darwin.Libc conflicts with libc++ 16. adv_cmds only needs `msgcat.h`, so
provide only that in `buildInputs` instead of all of Libc.
---
 .../apple-source-releases/adv_cmds/default.nix   | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
index e44241171c60b..3ac338d5c619d 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
@@ -1,5 +1,17 @@
-{ lib, appleDerivation, xcbuild, ncurses, libutil, Libc }:
+{ stdenv, lib, appleDerivation, xcbuild, ncurses, libutil, Libc }:
 
+let
+  # Libc conflicts with libc++ 16, so provide only the header from it that’s needed to build.
+  msgcat = stdenv.mkDerivation {
+    pname = "Libc-msgcat";
+    version = lib.getVersion Libc;
+
+    buildCommand = ''
+      mkdir -p "$out/include"
+      ln -s ${lib.getDev Libc}/include/msgcat.h "$out/include/"
+    '';
+  };
+in
 appleDerivation {
   # We can't just run the root build, because https://github.com/facebook/xcbuild/issues/264
 
@@ -44,7 +56,7 @@ appleDerivation {
   '';
 
   nativeBuildInputs = [ xcbuild ];
-  buildInputs = [ ncurses libutil Libc ];
+  buildInputs = [ ncurses libutil msgcat ];
 
   meta = {
     platforms = lib.platforms.darwin;

From 065de168f785f25a446236a4376a3a2a0a812d76 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Mon, 17 Jul 2023 04:20:00 +0000
Subject: [PATCH 003/154] python310Packages.mock: 4.0.3 -> 5.1.0

---
 .../python-modules/mock/default.nix           | 21 +++++++------------
 1 file changed, 7 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/python-modules/mock/default.nix b/pkgs/development/python-modules/mock/default.nix
index e12ed6d6b04b1..8b75a1436704d 100644
--- a/pkgs/development/python-modules/mock/default.nix
+++ b/pkgs/development/python-modules/mock/default.nix
@@ -1,35 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
-, python
 , pythonOlder
-, pytest
-, unittestCheckHook
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "mock";
-  version = "4.0.3";
+  version = "5.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7d3fbbde18228f4ff2f1f119a45cdffa458b4c0dee32eb4d2bb2f82554bac7bc";
+    sha256 = "sha256-Xpaq1czaRxjgointlLICTfdcwtVVdbpXYtMfV2e4dn0=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/testing-cabal/mock/commit/f3e3d82aab0ede7e25273806dc0505574d85eae2.patch";
-      hash = "sha256-wPrv1/WeICZHn31UqFlICFsny2knvn3+Xg8BZoaGbwQ=";
-    })
+  nativeCheckInputs = [
+    pytestCheckHook
   ];
 
-  nativeCheckInputs = [
-    unittestCheckHook
-    pytest
+  pythonImportsCheck = [
+    "mock"
   ];
 
   meta = with lib; {

From cb91c4cc3dac3c67b3e0ce733fe69d2ebbf4c627 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Mon, 17 Jul 2023 04:20:00 +0000
Subject: [PATCH 004/154] python310Packages.mock: update meta

---
 pkgs/development/python-modules/mock/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/mock/default.nix b/pkgs/development/python-modules/mock/default.nix
index 8b75a1436704d..7e5a72a47fadd 100644
--- a/pkgs/development/python-modules/mock/default.nix
+++ b/pkgs/development/python-modules/mock/default.nix
@@ -26,8 +26,10 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "Mock objects for Python";
+    description = "Rolling backport of unittest.mock for all Pythons";
     homepage = "https://github.com/testing-cabal/mock";
+    changelog = "https://github.com/testing-cabal/mock/blob/${version}/CHANGELOG.rst";
     license = licenses.bsd2;
+    maintainers = [ ];
   };
 }

From ce52bf9cc39c66850a399cb573b50bce809658c5 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Mon, 17 Jul 2023 20:11:18 +0800
Subject: [PATCH 005/154] meson: 1.1.1 -> 1.2.0

Release Note: https://mesonbuild.com/Release-notes-for-1-2-0.html
Diff: https://github.com/mesonbuild/meson/compare/1.1.1...1.2.0
---
 .../meson/darwin-case-sensitive-fs.patch      | 51 -------------------
 .../tools/build-managers/meson/default.nix    | 16 +++---
 2 files changed, 7 insertions(+), 60 deletions(-)
 delete mode 100644 pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch

diff --git a/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch b/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch
deleted file mode 100644
index 2de9484226b12..0000000000000
--- a/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 1643ed0d8a9201732905bee51b096605d26aaaac Mon Sep 17 00:00:00 2001
-From: Randy Eckenrode <randy@largeandhighquality.com>
-Date: Fri, 26 May 2023 00:10:45 -0400
-Subject: [PATCH] Fix test failures on Darwin on a case-sensitive fs
-
-This issue was encounetered while working on a contribution to nixpkgs.
-Nix allows the store to be installed on a separate, case-sensitive APFS
-volume. When the store is on a case-sensitive volume, these tests fail
-because they try to use `foundation` instead of `Foundation`.
----
- .../failing/78 framework dependency with version/meson.build    | 2 +-
- test cases/objc/2 nsstring/meson.build                          | 2 +-
- test cases/osx/6 multiframework/meson.build                     | 2 +-
- 3 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/test cases/failing/78 framework dependency with version/meson.build b/test cases/failing/78 framework dependency with version/meson.build
-index b7e04bab446..ee315ebcbd7 100644
---- a/test cases/failing/78 framework dependency with version/meson.build	
-+++ b/test cases/failing/78 framework dependency with version/meson.build	
-@@ -5,4 +5,4 @@ if host_machine.system() != 'darwin'
- endif
- 
- # do individual frameworks have a meaningful version to test?  And multiple frameworks might be listed...
--dep = dependency('appleframeworks', modules: 'foundation', version: '>0')
-+dep = dependency('appleframeworks', modules: 'Foundation', version: '>0')
-diff --git a/test cases/objc/2 nsstring/meson.build b/test cases/objc/2 nsstring/meson.build
-index 94d2cf18ab4..2c483d50d68 100644
---- a/test cases/objc/2 nsstring/meson.build	
-+++ b/test cases/objc/2 nsstring/meson.build	
-@@ -1,7 +1,7 @@
- project('nsstring', 'objc')
- 
- if host_machine.system() == 'darwin'
--  dep = dependency('appleframeworks', modules : 'foundation')
-+  dep = dependency('appleframeworks', modules : 'Foundation')
- elif host_machine.system() == 'cygwin'
-   error('MESON_SKIP_TEST GNUstep is not packaged for Cygwin.')
- else
-diff --git a/test cases/osx/6 multiframework/meson.build b/test cases/osx/6 multiframework/meson.build
-index 28846243b21..57e5d61560b 100644
---- a/test cases/osx/6 multiframework/meson.build	
-+++ b/test cases/osx/6 multiframework/meson.build	
-@@ -4,7 +4,7 @@ project('multiframework', 'objc')
- # that causes a build failure when defining two modules. The
- # arguments for the latter module overwrote the arguments for
- # the first one rather than adding to them.
--cocoa_dep = dependency('appleframeworks', modules : ['AppKit', 'foundation'])
-+cocoa_dep = dependency('appleframeworks', modules : ['AppKit', 'Foundation'])
- 
- executable('deptester',
-   'main.m',
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 58468ccee5b81..aa09a5d2358ed 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchPypi
+, fetchFromGitHub
 , fetchpatch
 , installShellFiles
 , ninja
@@ -18,18 +18,16 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.1.1";
+  version = "1.2.0";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-0EtUH5fKQ5+4L6t9DUgJiL5L1OYlY6XKNfrbVAByexw=";
+  src = fetchFromGitHub {
+    owner = "mesonbuild";
+    repo = "meson";
+    rev = "refs/tags/${version}";
+    hash = "sha256-bJAmkE+sL9DqKpcjZdBf4/z9lz+m/o0Z87hlAwbVbTY=";
   };
 
   patches = [
-    # Fix Meson tests that fail when the Nix store is case-sensitive APFS.
-    # https://github.com/mesonbuild/meson/pull/11820
-    ./darwin-case-sensitive-fs.patch
-
     # Meson is currently inspecting fewer variables than autoconf does, which
     # makes it harder for us to use setup hooks, etc.  Taken from
     # https://github.com/mesonbuild/meson/pull/6827

From 99e148dd2719749c3e4c141161ca62dd177276a2 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 24 Jul 2023 23:23:14 +0100
Subject: [PATCH 006/154] bash: fix parallel build failure on unwind_prot.o

As reported by Robert Scott in https://github.com/NixOS/nixpkgs/pull/245066
without the change `make -j8` build of `make` occasionally fails to
buildin parallel. The simplest reproducer is:

    $$ ./configure
    $$ make unwind_prot.o
    ...
    In file included from unwind_prot.c:51:
    In file included from ./bashintl.h:30:
    ./include/gettext.h:27:11: fatal error: 'libintl.h' file not found
    # include <libintl.h>
              ^~~~~~~~~~~
    1 error generated.
    make: * [Makefile:106: unwind_prot.o] Error 1

The change adds missing ttransitive `${LIBINTL_H}` dependency for
unwind_prot.o.
---
 pkgs/shells/bash/5.nix          |  4 ++++
 pkgs/shells/bash/parallel.patch | 12 ++++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 pkgs/shells/bash/parallel.patch

diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 00b4a707ed08c..6b126390c9f6e 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -61,6 +61,10 @@ stdenv.mkDerivation rec {
       url = "https://cgit.freebsd.org/ports/plain/shells/bash/files/patch-configure?id=3e147a1f594751a68fea00a28090d0792bee0b51";
       sha256 = "XHFMQ6eXTReNoywdETyrfQEv1rKF8+XFbQZP4YoVKFk=";
     })
+    # Apply parallel build fix pending upstream inclusion:
+    #   https://savannah.gnu.org/patch/index.php?10373
+    # Had to fetch manually to workaround -p0 default.
+    ./parallel.patch
   ];
 
   configureFlags = [
diff --git a/pkgs/shells/bash/parallel.patch b/pkgs/shells/bash/parallel.patch
new file mode 100644
index 0000000000000..d9a0cc28ce045
--- /dev/null
+++ b/pkgs/shells/bash/parallel.patch
@@ -0,0 +1,12 @@
+From https://savannah.gnu.org/patch/index.php?10373
+  https://savannah.gnu.org/patch/download.php?file_id=54964
+--- Makefile.in
++++ Makefile.in
+@@ -1432,6 +1432,7 @@ siglist.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
+ subst.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
+ test.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
+ trap.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
++unwind_prot.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
+ variables.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
+ version.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
+ xmalloc.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h

From a38770bd69115aff3afde572bbce804df62fdaee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
Date: Fri, 30 Oct 2020 22:40:53 +0100
Subject: [PATCH 007/154] libavif: build gdk-pixbuf loader and thumbnailer

https://github.com/AOMediaCodec/libavif/pull/182
https://github.com/AOMediaCodec/libavif/pull/977

Mostly mirrors webp-pixbuf-loader.

Also use prefixed names for `loaders.cache` so that users can install
multiple loaders in a profile without collisions, and move
`bin/webp-thumbnailer` to `libexec/gdk-pixbuf-thumbnailer-webp` (and
similarly for avif).
---
 .../libraries/gdk-pixbuf/default.nix          |  5 ++--
 .../development/libraries/libavif/default.nix | 28 +++++++++++++++++++
 .../libraries/webp-pixbuf-loader/default.nix  |  9 ++----
 3 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index bece2287c055a..d982b77297065 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -143,8 +143,9 @@ stdenv.mkDerivation (finalAttrs: {
       pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
     };
 
-    # gdk_pixbuf_moduledir variable from gdk-pixbuf-2.0.pc
-    moduleDir = "lib/gdk-pixbuf-2.0/2.10.0/loaders";
+    # gdk_pixbuf_binarydir and gdk_pixbuf_moduledir variables from gdk-pixbuf-2.0.pc
+    binaryDir = "lib/gdk-pixbuf-2.0/2.10.0";
+    moduleDir = "${finalAttrs.passthru.binaryDir}/loaders";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libavif/default.nix b/pkgs/development/libraries/libavif/default.nix
index dca45186d4ce4..eb8a8b1e3b542 100644
--- a/pkgs/development/libraries/libavif/default.nix
+++ b/pkgs/development/libraries/libavif/default.nix
@@ -8,8 +8,15 @@
 , libjpeg
 , dav1d
 , libyuv
+, gdk-pixbuf
+, makeWrapper
 }:
 
+let
+  gdkPixbufModuleDir = "${placeholder "out"}/${gdk-pixbuf.moduleDir}";
+  gdkPixbufModuleFile = "${placeholder "out"}/${gdk-pixbuf.binaryDir}/avif-loaders.cache";
+in
+
 stdenv.mkDerivation rec {
   pname = "libavif";
   version = "0.11.1";
@@ -29,14 +36,18 @@ stdenv.mkDerivation rec {
     "-DAVIF_CODEC_DAV1D=ON" # best decoder (fast)
     "-DAVIF_CODEC_AOM_DECODE=OFF"
     "-DAVIF_BUILD_APPS=ON"
+    "-DAVIF_BUILD_GDK_PIXBUF=ON"
   ];
 
   nativeBuildInputs = [
     cmake
     pkg-config
+    gdk-pixbuf
+    makeWrapper
   ];
 
   buildInputs = [
+    gdk-pixbuf
     libaom
     zlib
     libpng
@@ -45,6 +56,23 @@ stdenv.mkDerivation rec {
     libyuv
   ];
 
+  postPatch = ''
+    substituteInPlace contrib/gdk-pixbuf/avif.thumbnailer.in \
+      --replace '@CMAKE_INSTALL_FULL_BINDIR@/gdk-pixbuf-thumbnailer' "$out/libexec/gdk-pixbuf-thumbnailer-avif"
+  '';
+
+  env.PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = gdkPixbufModuleDir;
+
+  postInstall = ''
+    GDK_PIXBUF_MODULEDIR=${gdkPixbufModuleDir} \
+    GDK_PIXBUF_MODULE_FILE=${gdkPixbufModuleFile} \
+    gdk-pixbuf-query-loaders --update-cache
+
+    mkdir -p "$out/bin"
+    makeWrapper ${gdk-pixbuf}/bin/gdk-pixbuf-thumbnailer "$out/libexec/gdk-pixbuf-thumbnailer-avif" \
+      --set GDK_PIXBUF_MODULE_FILE ${gdkPixbufModuleFile}
+  '';
+
   meta = with lib; {
     description  = "C implementation of the AV1 Image File Format";
     longDescription = ''
diff --git a/pkgs/development/libraries/webp-pixbuf-loader/default.nix b/pkgs/development/libraries/webp-pixbuf-loader/default.nix
index bf2c8c28dbdbe..1f36ffc1c666b 100644
--- a/pkgs/development/libraries/webp-pixbuf-loader/default.nix
+++ b/pkgs/development/libraries/webp-pixbuf-loader/default.nix
@@ -11,10 +11,7 @@
 
 let
   inherit (gdk-pixbuf) moduleDir;
-
-  # turning lib/gdk-pixbuf-#.#/#.#.#/loaders into lib/gdk-pixbuf-#.#/#.#.#/loaders.cache
-  # removeSuffix is just in case moduleDir gets a trailing slash
-  loadersPath = (lib.strings.removeSuffix "/" gdk-pixbuf.moduleDir) + ".cache";
+  loadersPath = "${gdk-pixbuf.binaryDir}/webp-loaders.cache";
 in
 stdenv.mkDerivation rec {
   pname = "webp-pixbuf-loader";
@@ -47,7 +44,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     # It looks for gdk-pixbuf-thumbnailer in this package's bin rather than the gdk-pixbuf bin. We need to patch that.
     substituteInPlace webp-pixbuf.thumbnailer.in \
-      --replace "@bindir@/gdk-pixbuf-thumbnailer" "$out/bin/webp-thumbnailer"
+      --replace "@bindir@/gdk-pixbuf-thumbnailer" "$out/libexec/gdk-pixbuf-thumbnailer-webp"
   '';
 
   postInstall = ''
@@ -58,7 +55,7 @@ stdenv.mkDerivation rec {
     # It assumes gdk-pixbuf-thumbnailer can find the webp loader in the loaders.cache referenced by environment variable, breaking containment.
     # So we replace it with a wrapped executable.
     mkdir -p "$out/bin"
-    makeWrapper "${gdk-pixbuf}/bin/gdk-pixbuf-thumbnailer" "$out/bin/webp-thumbnailer" \
+    makeWrapper "${gdk-pixbuf}/bin/gdk-pixbuf-thumbnailer" "$out/libexec/gdk-pixbuf-thumbnailer-webp" \
       --set GDK_PIXBUF_MODULE_FILE "$out/${loadersPath}"
   '';
 

From 2e45100c5c7230f30bc9eddef8a7fc8f813c6adf Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Tue, 25 Jul 2023 21:25:46 -0400
Subject: [PATCH 008/154] darwin-stdenv: revert `NIX_CC_NO_RESPONSE_FILE` logic

To work around intermitent build failures with clang 16, the stdenv
attempted to pass arguments on the command-line on newer versions of
macOS. Unfortunately, the larger `ARG_MAX` is still not large enough to
build qtwebengine. This commit reverts the `NIX_CC_NO_RESPONSE_FILE`
logic in the stdenv. The changes to cc-wrapper in #245282 are needed for
clang 16 to prevent the above-mentioned build failures.
---
 pkgs/stdenv/darwin/default.nix | 65 +++++++++-------------------------
 1 file changed, 17 insertions(+), 48 deletions(-)

diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 7e6a707776305..418cc915fdc5e 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -65,11 +65,7 @@ let
   isBuiltByBootstrapFilesCompiler =
     pkg: isFromNixpkgs pkg && isFromBootstrapFiles pkg.stdenv.cc.cc;
 
-  commonPreHook = pkgs: lib.optionalString (pkgs.darwin.system_cmds != null) ''
-    # Only use a response file on older systems with a small ARG_MAX (less than 1 MiB).
-    export NIX_CC_USE_RESPONSE_FILE=$(( "$("${lib.getBin pkgs.darwin.system_cmds}/bin/getconf" ARG_MAX)" < 1048576 ))
-    export NIX_LD_USE_RESPONSE_FILE=$NIX_CC_USE_RESPONSE_FILE
-  '' + ''
+  commonPreHook = ''
     export NIX_ENFORCE_NO_NATIVE=''${NIX_ENFORCE_NO_NATIVE-1}
     export NIX_ENFORCE_PURITY=''${NIX_ENFORCE_PURITY-1}
     export NIX_IGNORE_LD_THROUGH_GCC=1
@@ -166,7 +162,7 @@ let
           # dependencies on the bootstrapTools in the final stdenv.
           dontPatchShebangs=1
         '' + ''
-          ${commonPreHook prevStage}
+          ${commonPreHook}
           ${extraPreHook}
         '' + lib.optionalString (prevStage.darwin ? locale) ''
           export PATH_LOCALE=${prevStage.darwin.locale}/share/locale
@@ -216,7 +212,6 @@ in
       print-reexports = null;
       rewrite-tbd = null;
       sigtool = null;
-      system_cmds = null;
       CF = null;
       Libsystem = null;
     };
@@ -300,27 +295,6 @@ in
         rewrite-tbd = bootstrapTools;
 
         sigtool = bootstrapTools;
-
-        # The bootstrap only needs `getconf` from system_cmds, and it only needs to be able to
-        # query `ARG_MAX`. Using a small value here should be fine for the initial stage 1 build.
-        system_cmds = self.stdenv.mkDerivation {
-          name = "bootstrap-stage0-system_cmds";
-          buildCommand = ''
-            mkdir -p "$out/bin"
-            cat <<block > "$out/bin/getconf"
-            #!${bootstrapTools}/bin/bash
-            case "\$1" in
-              ARG_MAX)
-                echo "262144"
-                ;;
-              *)
-                exit 1
-            esac
-            block
-            chmod a+x "$out/bin/getconf"
-          '';
-          passthru.isFromBootstrapFiles = true;
-        };
       } // lib.optionalAttrs (! useAppleSDKLibs) {
         CF = self.stdenv.mkDerivation {
           name = "bootstrap-stage0-CF";
@@ -453,7 +427,7 @@ in
     assert lib.all isFromBootstrapFiles (with prevStage; [ bash coreutils cpio gnugrep pbzx ]);
 
     assert lib.all isFromBootstrapFiles (with prevStage.darwin; [
-      binutils-unwrapped cctools print-reexports rewrite-tbd sigtool system_cmds
+      binutils-unwrapped cctools print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isFromBootstrapFiles (with prevStage.darwin; [ CF Libsystem ]);
@@ -486,8 +460,6 @@ in
       python3 = super.python3Minimal;
 
       darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
-        inherit (prevStage.darwin) system_cmds;
-
         signingUtils = prevStage.darwin.signingUtils.override {
           inherit (selfDarwin) sigtool;
         };
@@ -536,7 +508,7 @@ in
     '';
   })
 
-  # Build sysctl, system_cmds and Python for use by LLVM’s check phase. These must be built in their
+  # Build sysctl and Python for use by LLVM’s check phase. These must be built in their
   # own stage, or an infinite recursion results on x86_64-darwin when using the source-based SDK.
   (prevStage:
     # previous stage1 stdenv:
@@ -553,8 +525,6 @@ in
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
       binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool
     ]);
-    assert lib.all isFromBootstrapFiles (with prevStage.darwin; [ system_cmds ]);
-
     assert (! useAppleSDKLibs) -> lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [ CF Libsystem configd ]);
     assert    useAppleSDKLibs  -> lib.all                   isFromNixpkgs (with prevStage.darwin; [ CF Libsystem libobjc]);
     assert lib.all isFromNixpkgs (with prevStage.darwin; [ dyld launchd xnu ]);
@@ -651,7 +621,7 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool system_cmds
+      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [ CF Libsystem configd ]);
@@ -679,8 +649,7 @@ in
       darwin = super.darwin.overrideScope (_: superDarwin: {
         inherit (prevStage.darwin)
           CF Libsystem configd darwin-stubs dyld launchd libclosure libdispatch libobjc
-          locale objc4 postLinkSignHook print-reexports rewrite-tbd signingUtils sigtool
-          system_cmds;
+          locale objc4 postLinkSignHook print-reexports rewrite-tbd signingUtils sigtool;
 
         # Avoid building unnecessary Python dependencies due to building LLVM manpages.
         cctools-llvm = superDarwin.cctools-llvm.override { enableManpages = false; };
@@ -749,7 +718,7 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool system_cmds
+      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [ CF Libsystem configd ]);
@@ -786,7 +755,7 @@ in
       darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
         inherit (prevStage.darwin)
           CF binutils-unwrapped cctools configd darwin-stubs launchd libobjc libtapi locale
-          objc4 print-reexports rewrite-tbd signingUtils sigtool system_cmds;
+          objc4 print-reexports rewrite-tbd signingUtils sigtool;
       });
 
       llvmPackages = super.llvmPackages // (
@@ -848,7 +817,7 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool system_cmds
+      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [ CF configd ]);
@@ -882,7 +851,7 @@ in
       darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
         inherit (prevStage.darwin)
           Libsystem configd darwin-stubs launchd locale print-reexports rewrite-tbd
-          signingUtils sigtool system_cmds;
+          signingUtils sigtool;
 
         # Rewrap binutils so it uses the rebuilt Libsystem.
         binutils = superDarwin.binutils.override {
@@ -971,7 +940,7 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      locale print-reexports rewrite-tbd sigtool system_cmds
+      locale print-reexports rewrite-tbd sigtool
     ]);
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.darwin; [
       binutils-unwrapped cctools libtapi
@@ -1011,7 +980,7 @@ in
         inherit (prevStage.darwin)
           CF Libsystem binutils binutils-unwrapped cctools cctools-llvm cctools-port configd
           darwin-stubs dyld launchd libclosure libdispatch libobjc libtapi locale objc4
-          postLinkSignHook print-reexports rewrite-tbd signingUtils sigtool system_cmds;
+          postLinkSignHook print-reexports rewrite-tbd signingUtils sigtool;
       });
 
       llvmPackages = super.llvmPackages // (
@@ -1051,7 +1020,7 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      locale print-reexports rewrite-tbd sigtool system_cmds
+      locale print-reexports rewrite-tbd sigtool
     ]);
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.darwin; [
       binutils-unwrapped cctools libtapi
@@ -1191,7 +1160,7 @@ in
     ]);
 
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools libtapi locale print-reexports rewrite-tbd sigtool system_cmds
+      binutils-unwrapped cctools libtapi locale print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isBuiltByNixpkgsCompiler (with prevStage.darwin; [ CF Libsystem configd ]);
@@ -1226,7 +1195,8 @@ in
 
       inherit config;
 
-      preHook = (commonPreHook prevStage) + ''
+      preHook = ''
+        ${commonPreHook}
         stripDebugFlags="-S" # llvm-strip does not support "-p" for Mach-O
         export PATH_LOCALE=${prevStage.darwin.locale}/share/locale
       '';
@@ -1324,7 +1294,6 @@ in
         dyld
         libtapi
         locale
-        system_cmds
       ]
       ++ lib.optional useAppleSDKLibs [ objc4 ]
       ++ lib.optionals doSign [ postLinkSignHook sigtool signingUtils ]);
@@ -1341,7 +1310,7 @@ in
 
         darwin = super.darwin.overrideScope (_: _: {
           inherit (prevStage.darwin)
-            CF ICU Libsystem darwin-stubs dyld locale libobjc libtapi system_cmds xnu;
+            CF ICU Libsystem darwin-stubs dyld locale libobjc libtapi xnu;
         } // lib.optionalAttrs (super.stdenv.targetPlatform == localSystem) {
           inherit (prevStage.darwin) binutils binutils-unwrapped cctools-llvm cctools-port;
         });

From 9513725990ae41829f1461d86598d3c67d74caea Mon Sep 17 00:00:00 2001
From: Lancelot SIX <lsix@lancelotsix.com>
Date: Wed, 26 Jul 2023 10:41:16 +0100
Subject: [PATCH 009/154] gdb: disable sim by default
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Out of the box, building GDB will also build the GNU simulator
project[1].  When building GDB with --enable-target=all, this result in
all simulators to be built, which accounts for a significant amount of
space.

This patch makes the default GDB package to not bundle sim.  Sim can be
enabled using `enableSim = true`;

As a result, the default GDB install is now about 40M v.s. 650M when all
simulators are included.

[1] https://sourceware.org/gdb/wiki/Sim
---
 pkgs/development/tools/misc/gdb/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index 129b55e740980..f627f3db2c8ef 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -10,6 +10,7 @@
 , enableDebuginfod ? lib.meta.availableOn stdenv.hostPlatform elfutils, elfutils
 , guile ? null
 , hostCpuOnly ? false
+, enableSim ? false
 , safePaths ? [
    # $debugdir:$datadir/auto-load are whitelisted by default by GDB
    "$debugdir" "$datadir/auto-load"
@@ -112,7 +113,8 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional (!pythonSupport) "--without-python"
     ++ lib.optional stdenv.hostPlatform.isMusl "--disable-nls"
     ++ lib.optional stdenv.hostPlatform.isStatic "--disable-inprocess-agent"
-    ++ lib.optional enableDebuginfod "--with-debuginfod=yes";
+    ++ lib.optional enableDebuginfod "--with-debuginfod=yes"
+    ++ lib.optional (!enableSim) "--disable-sim";
 
   postInstall =
     '' # Remove Info files already provided by Binutils and other packages.

From 30e58da8aa5d8595c8cbce90cef9ea0f5e71d14c Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 27 Jul 2023 16:42:56 -0400
Subject: [PATCH 010/154] tix: fix build with clang 16

Fixes two issues:

* incompatible function pointer conversions that are an error with clang 16; and
* implicit declaration of `panic` on Darwin.
---
 pkgs/development/libraries/tix/default.nix    |   3 +
 .../libraries/tix/fix-clang16.patch           | 215 ++++++++++++++++++
 2 files changed, 218 insertions(+)
 create mode 100644 pkgs/development/libraries/tix/fix-clang16.patch

diff --git a/pkgs/development/libraries/tix/default.nix b/pkgs/development/libraries/tix/default.nix
index 80b93823df946..a46b2499964c3 100644
--- a/pkgs/development/libraries/tix/default.nix
+++ b/pkgs/development/libraries/tix/default.nix
@@ -21,6 +21,9 @@ tcl.mkTclDerivation {
     })
     # Remove duplicated definition of XLowerWindow
     ./duplicated-xlowerwindow.patch
+    # Fix incompatible function pointer conversions and implicit definition of `panic`.
+    # `panic` is just `Tcl_Panic`, but it is not defined on Darwin due to a conflict with `mach/mach.h`.
+    ./fix-clang16.patch
   ] ++ lib.optional (tcl.release == "8.6")
   (fetchpatch {
     name = "tix-8.4.3-tcl8.6.patch";
diff --git a/pkgs/development/libraries/tix/fix-clang16.patch b/pkgs/development/libraries/tix/fix-clang16.patch
new file mode 100644
index 0000000000000..f5d8a5337de07
--- /dev/null
+++ b/pkgs/development/libraries/tix/fix-clang16.patch
@@ -0,0 +1,215 @@
+diff -ur a/generic/tixDItem.c b/generic/tixDItem.c
+--- a/generic/tixDItem.c	2004-03-27 19:44:56.000000000 -0700
++++ b/generic/tixDItem.c	2023-07-11 14:49:51.583894242 -0600
+@@ -30,7 +30,7 @@
+ 		Tcl_Interp *interp, Tk_Window tkwin, CONST84 char *value,
+ 		char *widRec, int offset));
+ 
+-static char *DItemPrintProc _ANSI_ARGS_((
++static const char *DItemPrintProc _ANSI_ARGS_((
+ 		ClientData clientData, Tk_Window tkwin, char *widRec,
+ 		int offset, Tcl_FreeProc **freeProcPtr));
+ 
+@@ -548,7 +548,7 @@
+     return TCL_OK;
+ }
+ 
+-static char *DItemPrintProc(clientData, tkwin, widRec,offset, freeProcPtr)
++static const char *DItemPrintProc(clientData, tkwin, widRec,offset, freeProcPtr)
+     ClientData clientData;
+     Tk_Window tkwin;
+     char *widRec;
+diff -ur a/generic/tixDiStyle.c b/generic/tixDiStyle.c
+--- a/generic/tixDiStyle.c	2004-03-27 19:44:56.000000000 -0700
++++ b/generic/tixDiStyle.c	2023-07-11 15:02:45.245210252 -0600
+@@ -31,7 +31,7 @@
+ static int   		DItemStyleParseProc _ANSI_ARGS_((ClientData clientData,
+ 			    Tcl_Interp *interp, Tk_Window tkwin,
+ 			    CONST84 char *value,char *widRec, int offset));
+-static char *		DItemStylePrintProc _ANSI_ARGS_((
++static const char *		DItemStylePrintProc _ANSI_ARGS_((
+ 			    ClientData clientData, Tk_Window tkwin, 
+ 			    char *widRec, int offset,
+ 			    Tcl_FreeProc **freeProcPtr));
+@@ -785,7 +785,7 @@
+ 
+     hashPtr = Tcl_CreateHashEntry(&stylePtr->base.items, (char*)iPtr, &isNew);
+     if (!isNew) {
+-	panic("DItem is already associated with style");
++	Tcl_Panic("DItem is already associated with style");
+     } else {
+ 	Tcl_SetHashValue(hashPtr, (char*)iPtr);
+     }
+@@ -801,7 +801,7 @@
+ 
+     hashPtr = Tcl_FindHashEntry(&stylePtr->base.items, (char*)iPtr);
+     if (hashPtr == NULL) {
+-	panic("DItem is not associated with style");
++	Tcl_Panic("DItem is not associated with style");
+     }
+     Tcl_DeleteHashEntry(hashPtr);
+     stylePtr->base.refCount--;
+@@ -998,7 +998,7 @@
+     return TCL_ERROR;
+ }
+ 
+-static char *DItemStylePrintProc(clientData, tkwin, widRec,offset, freeProcPtr)
++static const char *DItemStylePrintProc(clientData, tkwin, widRec,offset, freeProcPtr)
+     ClientData clientData;
+     Tk_Window tkwin;
+     char *widRec;
+diff -ur a/generic/tixForm.c b/generic/tixForm.c
+--- a/generic/tixForm.c	2004-03-27 19:44:56.000000000 -0700
++++ b/generic/tixForm.c	2023-07-11 14:53:45.695753419 -0600
+@@ -802,7 +802,7 @@
+      * Now set all the client's geometry
+      */
+     if (PlaceAllClients(masterPtr) != TCL_OK) {
+-	panic("circular dependency");
++	Tcl_Panic("circular dependency");
+     }
+ 
+     for (clientPtr = masterPtr->client; clientPtr; clientPtr=clientPtr->next) {
+diff -ur a/generic/tixGrData.c b/generic/tixGrData.c
+--- a/generic/tixGrData.c	2004-03-27 19:44:56.000000000 -0700
++++ b/generic/tixGrData.c	2023-07-11 14:54:19.644741199 -0600
+@@ -296,7 +296,7 @@
+ 	Tcl_DeleteHashEntry(cy);
+     }
+     else {
+-	panic("Inconsistent grid dataset: (%d,%d) : %x %x", x, y, cx, cy);
++	Tcl_Panic("Inconsistent grid dataset: (%d,%d) : %x %x", x, y, cx, cy);
+     }
+ 
+     return 1;
+diff -ur a/generic/tixGrid.c b/generic/tixGrid.c
+--- a/generic/tixGrid.c	2008-02-27 21:10:43.000000000 -0700
++++ b/generic/tixGrid.c	2023-07-11 14:53:59.283841038 -0600
+@@ -831,7 +831,7 @@
+ 	 * All mapped windows should have been unmapped when the
+ 	 * the entries were deleted
+ 	 */
+-	panic("tixGrid: mappedWindows not NULL");
++	Tcl_Panic("tixGrid: mappedWindows not NULL");
+     }
+ 
+     Tk_FreeOptions(configSpecs, (char *) wPtr, wPtr->dispData.display, 0);
+diff -ur a/generic/tixHList.c b/generic/tixHList.c
+--- a/generic/tixHList.c	2008-02-27 21:05:29.000000000 -0700
++++ b/generic/tixHList.c	2023-07-11 14:55:20.699375202 -0600
+@@ -2036,7 +2036,7 @@
+ 	    break;
+ 	}
+ 	if (wPtr->headerWin != NULL) {
+-	    panic("HList: header subwindow deleted illegally\n");
++	    Tcl_Panic("HList: header subwindow deleted illegally\n");
+ 	}
+ #endif
+ 	break;
+@@ -2117,7 +2117,7 @@
+ 	 * All mapped windows should have been unmapped when the
+ 	 * the entries were deleted
+ 	 */
+-	panic("tixHList: mappedWindows not NULL");
++	Tcl_Panic("tixHList: mappedWindows not NULL");
+     }
+     if (wPtr->headerWin) {
+ 	wPtr->headerWin = NULL;
+diff -ur a/generic/tixImgCmp.c b/generic/tixImgCmp.c
+--- a/generic/tixImgCmp.c	2008-02-27 21:05:29.000000000 -0700
++++ b/generic/tixImgCmp.c	2023-07-11 14:59:16.429640785 -0600
+@@ -142,8 +142,8 @@
+  * The type record for bitmap images:
+  */
+ static int		ImgCmpCreate _ANSI_ARGS_((Tcl_Interp *interp,
+-			    char *name, int argc, Tcl_Obj *CONST objv[],
+-			    Tk_ImageType *typePtr, Tk_ImageMaster master,
++			    const char *name, int argc, Tcl_Obj *CONST objv[],
++			    const Tk_ImageType *typePtr, Tk_ImageMaster master,
+ 			    ClientData *clientDataPtr));
+ static ClientData	ImgCmpGet _ANSI_ARGS_((Tk_Window tkwin,
+ 			    ClientData clientData));
+@@ -378,11 +378,11 @@
+ ImgCmpCreate(interp, name, argc, objv, typePtr, master, clientDataPtr)
+     Tcl_Interp *interp;		/* Interpreter for application containing
+ 				 * image. */
+-    char *name;			/* Name to use for image. */
++    const char *name;		/* Name to use for image. */
+     int argc;			/* Number of arguments. */
+     Tcl_Obj *CONST objv[];	/* Argument strings for options (doesn't
+ 				 * include image name or type). */
+-    Tk_ImageType *typePtr;	/* Pointer to our type record (not used). */
++    const Tk_ImageType *typePtr;/* Pointer to our type record (not used). */
+     Tk_ImageMaster master;	/* Token for image, to be used by us in
+ 				 * later callbacks. */
+     ClientData *clientDataPtr;	/* Store manager's token for image here;
+diff -ur a/generic/tixImgXpm.c b/generic/tixImgXpm.c
+--- a/generic/tixImgXpm.c	2023-07-11 15:01:05.887387236 -0600
++++ b/generic/tixImgXpm.c	2023-07-11 15:00:37.209042328 -0600
+@@ -22,8 +22,8 @@
+  */
+ 
+ static int		ImgXpmCreate _ANSI_ARGS_((Tcl_Interp *interp,
+-			    char *name, int argc, Tcl_Obj *CONST objv[],
+-			    Tk_ImageType *typePtr, Tk_ImageMaster master,
++			    const char *name, int argc, Tcl_Obj *CONST objv[],
++			    const Tk_ImageType *typePtr, Tk_ImageMaster master,
+ 			    ClientData *clientDataPtr));
+ static ClientData	ImgXpmGet _ANSI_ARGS_((Tk_Window tkwin,
+ 			    ClientData clientData));
+@@ -115,11 +115,11 @@
+ ImgXpmCreate(interp, name, argc, objv, typePtr, master, clientDataPtr)
+     Tcl_Interp *interp;		/* Interpreter for application containing
+ 				 * image. */
+-    char *name;			/* Name to use for image. */
++    const char *name;		/* Name to use for image. */
+     int argc;			/* Number of arguments. */
+     Tcl_Obj *CONST objv[];	/* Argument strings for options (doesn't
+ 				 * include image name or type). */
+-    Tk_ImageType *typePtr;	/* Pointer to our type record (not used). */
++    const Tk_ImageType *typePtr;/* Pointer to our type record (not used). */
+     Tk_ImageMaster master;	/* Token for image, to be used by us in
+ 				 * later callbacks. */
+     ClientData *clientDataPtr;	/* Store manager's token for image here;
+@@ -1213,7 +1213,7 @@
+     PixmapMaster *masterPtr = (PixmapMaster *) masterData;
+ 
+     if (masterPtr->instancePtr != NULL) {
+-	panic("tried to delete pixmap image when instances still exist");
++	Tcl_Panic("tried to delete pixmap image when instances still exist");
+     }
+     masterPtr->tkMaster = NULL;
+     if (masterPtr->imageCmd != NULL) {
+diff -ur a/generic/tixTList.c b/generic/tixTList.c
+--- a/generic/tixTList.c	2008-02-27 21:05:29.000000000 -0700
++++ b/generic/tixTList.c	2023-07-11 14:55:35.960761327 -0600
+@@ -1208,7 +1208,7 @@
+ 	    sprintf(buff, "%d", i);
+ 	    Tcl_AppendResult(interp, buff, NULL);
+ 	} else {
+-	    panic("TList list entry is invalid");
++	    Tcl_Panic("TList list entry is invalid");
+ 	}
+     } else {
+ 	Tcl_ResetResult(interp);
+diff -ur a/generic/tixUtils.c b/generic/tixUtils.c
+--- a/generic/tixUtils.c	2008-02-27 21:29:17.000000000 -0700
++++ b/generic/tixUtils.c	2023-07-11 15:01:43.718202631 -0600
+@@ -24,7 +24,7 @@
+ static int	ReliefParseProc(ClientData clientData,
+ 	Tcl_Interp *interp, Tk_Window tkwin, CONST84 char *value,
+ 	char *widRec, int offset);
+-static char *	ReliefPrintProc(ClientData clientData,
++static const char *	ReliefPrintProc(ClientData clientData,
+ 	Tk_Window tkwin, char *widRec, int offset,
+ 	Tix_FreeProc **freeProcPtr);
+ 
+@@ -637,7 +637,7 @@
+     return TCL_ERROR;
+ }
+ 
+-static char *
++static const char *
+ ReliefPrintProc(clientData, tkwin, widRec,offset, freeProcPtr)
+     ClientData clientData;
+     Tk_Window tkwin;

From c200f5e411fc738780000bb6eafe8105993ad488 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:46:14 -0700
Subject: [PATCH 011/154] partial revert of f3719756b550

---
 pkgs/os-specific/linux/kernel/manual-config.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 07325f0e10b07..60175f805a688 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -409,11 +409,10 @@ stdenv.mkDerivation ({
   meta = {
     description =
       "The Linux kernel" +
-      (lib.optionalString (kernelPatches != []) (
+      (if kernelPatches == [] then "" else
         " (with patches: "
         + lib.concatStringsSep ", " (map (x: x.name) kernelPatches)
-        + ")"
-      ));
+        + ")");
     license = lib.licenses.gpl2Only;
     homepage = "https://www.kernel.org/";
     maintainers = lib.teams.linux-kernel.members ++ [

From 17d25bf7621334f0534b59422903984183223585 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:46:20 -0700
Subject: [PATCH 012/154] Revert "linuxManualConfig: restore functionality of
 isModular and buildDTBs"

This reverts commit 284d76ee3ddfde84bcc491f45d7e322da02bbae6.
---
 pkgs/os-specific/linux/kernel/manual-config.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 60175f805a688..677cc9363da43 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -232,10 +232,7 @@ stdenv.mkDerivation ({
     # replicated here to apply to older versions.
     # Makes __FILE__ relative to the build directory.
     "KCPPFLAGS=-fmacro-prefix-map=$(sourceRoot)/="
-    kernelConf.target
-  ] ++ optional isModular "modules"
-    ++ optional buildDTBs "dtbs"
-    ++ extraMakeFlags;
+  ] ++ extraMakeFlags;
 
   installFlags = [
     "INSTALL_PATH=$(out)"

From 007f794167df4387bcf5f2c37f6881667805cad1 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:46:26 -0700
Subject: [PATCH 013/154] Revert "lib/systems: strip kernel to avoid reference
 cycles"

This reverts commit 2458c94c9e177ad92aedc8b128a1e92e4dc3bd56.
---
 pkgs/os-specific/linux/kernel/manual-config.nix | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 677cc9363da43..1c244664975bc 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -373,20 +373,11 @@ stdenv.mkDerivation ({
 
     # Remove reference to kmod
     sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
-  ''
-  # unfortunately linux/arch/mips/Makefile does not understand installkernel
-  # and simply copies to $(INSTALL_PATH)/vmlinux-$(KERNELRELEASE)
-  + lib.optionalString stdenv.hostPlatform.isMips ''
-    mv $out/vmlinux-* $out/vmlinux || true
-    mv $out/vmlinuz-* $out/vmlinuz || true
-    mv $out/System.map-* $out/System.map
   '';
 
   preFixup = ''
     # Don't strip $dev/lib/modules/*/vmlinux
     stripDebugList="$(cd $dev && echo lib/modules/*/build/*/)"
-  '' + lib.optionalString (stdenv.hostPlatform.isMips) ''
-    $STRIP -s $out/vmlinux || true
   '';
 
   enableParallelBuilding = true;

From c801a96a0db9609b2ebfa4ed2a8577cbe90ff9a1 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:46:47 -0700
Subject: [PATCH 014/154] Revert "linuxManualConfig: set badPlatforms"

This reverts commit 5c5e5e2f1f47d9b0e6c48defe25aeba0bbf04d2c.
---
 pkgs/os-specific/linux/kernel/manual-config.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 1c244664975bc..d7ea4ac2c4988 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -407,9 +407,6 @@ stdenv.mkDerivation ({
       maintainers.thoughtpolice
     ];
     platforms = platforms.linux;
-    badPlatforms =
-      lib.optionals (lib.versionOlder version "4.15") [ "riscv32-linux" "riscv64-linux" ] ++
-      lib.optional (lib.versionOlder version "5.19") "loongarch64-linux";
     timeout = 14400; # 4 hours
   } // extraMeta;
 } // optionalAttrs (pos != null) {

From eecef61ba5c8f3f6ec21752b7f5c15c91a04a7b5 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:46:54 -0700
Subject: [PATCH 015/154] Revert "linux.configfile: remove unused kernelTarget
 attr"

This reverts commit 01b36425890182d3a1898c27d479189a7c496646.
---
 pkgs/os-specific/linux/kernel/generic.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 6605213490539..04f6cfc70ad33 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -130,6 +130,8 @@ let
 
     # e.g. "defconfig"
     kernelBaseConfig = if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig or "defconfig";
+    # e.g. "bzImage"
+    kernelTarget = stdenv.hostPlatform.linux-kernel.target or "vmlinux";
 
     makeFlags = lib.optionals (stdenv.hostPlatform.linux-kernel ? makeFlags) stdenv.hostPlatform.linux-kernel.makeFlags
       ++ extraMakeFlags;

From 06f20db451844c5f048e99e3e3f6870ae998c9e5 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:37:12 -0700
Subject: [PATCH 016/154] Revert "linuxManualConfig: always depend on
 ubootTools"

This reverts commit e5e02f3214ae381142606cf5defc35888d73f883.
---
 pkgs/os-specific/linux/kernel/manual-config.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index d7ea4ac2c4988..9908d22c4112b 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, buildPackages, runCommand, nettools, bc, bison, flex, perl, rsync, gmp, libmpc, mpfr, openssl
-, libelf, cpio, elfutils, zstd, python3Minimal, zlib, pahole, ubootTools
+, libelf, cpio, elfutils, zstd, python3Minimal, zlib, pahole
 , fetchpatch
 }:
 
@@ -101,13 +101,13 @@ stdenv.mkDerivation ({
   inherit version src;
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [
-    bc gmp libmpc mpfr nettools openssl perl python3Minimal rsync ubootTools
-    zstd
-  ] ++ optional  (lib.versionOlder version "5.8") libelf
-    ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
-    ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
-    ++ optional  (lib.versionAtLeast version "5.8")  elfutils;
+  nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal ]
+      ++ optional  (target == "uImage") buildPackages.ubootTools
+      ++ optional  (lib.versionOlder version "5.8") libelf
+      ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
+      ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
+      ++ optional  (lib.versionAtLeast version "5.8")  elfutils
+      ;
 
   patches =
     map (p: p.patch) kernelPatches

From ddaa949afe18949396a1de532df60ffaea5bf2a3 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:41:57 -0700
Subject: [PATCH 017/154] Revert "linux: default
 stdenv.hostPlatform.linux-kernel"

This reverts commit febe4776287fd81b9dc0fd88a8bcb686765c8a6b.
---
 pkgs/os-specific/linux/kernel/generic.nix       | 9 +++++----
 pkgs/os-specific/linux/kernel/manual-config.nix | 9 ++++-----
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 04f6cfc70ad33..56d89f67c64a9 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -47,7 +47,7 @@
   # symbolic name and `patch' is the actual patch.  The patch may
   # optionally be compressed with gzip or bzip2.
   kernelPatches ? []
-, ignoreConfigErrors ? stdenv.hostPlatform.linux-kernel.name or "" != "pc"
+, ignoreConfigErrors ? stdenv.hostPlatform.linux-kernel.name != "pc"
 , extraMeta ? {}
 
 , isZen      ? false
@@ -55,7 +55,7 @@
 , isHardened ? false
 
 # easy overrides to stdenv.hostPlatform.linux-kernel members
-, autoModules ? stdenv.hostPlatform.linux-kernel.autoModules or true
+, autoModules ? stdenv.hostPlatform.linux-kernel.autoModules
 , preferBuiltin ? stdenv.hostPlatform.linux-kernel.preferBuiltin or false
 , kernelArch ? stdenv.hostPlatform.linuxArch
 , kernelTests ? []
@@ -128,10 +128,11 @@ let
       ++ lib.optionals (lib.versionAtLeast version "4.16") [ bison flex ]
       ++ lib.optional (lib.versionAtLeast version "5.2") pahole;
 
+    platformName = stdenv.hostPlatform.linux-kernel.name;
     # e.g. "defconfig"
-    kernelBaseConfig = if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig or "defconfig";
+    kernelBaseConfig = if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig;
     # e.g. "bzImage"
-    kernelTarget = stdenv.hostPlatform.linux-kernel.target or "vmlinux";
+    kernelTarget = stdenv.hostPlatform.linux-kernel.target;
 
     makeFlags = lib.optionals (stdenv.hostPlatform.linux-kernel ? makeFlags) stdenv.hostPlatform.linux-kernel.makeFlags
       ++ extraMakeFlags;
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 9908d22c4112b..4a623fda9becf 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -87,8 +87,7 @@ let
 
   isModular = config.isYes "MODULES";
 
-  kernelConf = stdenv.hostPlatform.linux-kernel;
-  target = kernelConf.target or "vmlinux";
+  kernelConf =  stdenv.hostPlatform.linux-kernel;
 
   buildDTBs = kernelConf.DTB or false;
 in
@@ -102,7 +101,7 @@ stdenv.mkDerivation ({
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal ]
-      ++ optional  (target == "uImage") buildPackages.ubootTools
+      ++ optional  (kernelConf.target == "uImage") buildPackages.ubootTools
       ++ optional  (lib.versionOlder version "5.8") libelf
       ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
       ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
@@ -298,8 +297,8 @@ stdenv.mkDerivation ({
   # Some image types need special install targets (e.g. uImage is installed with make uinstall)
   installTargets = [
     (kernelConf.installTarget or (
-      /**/ if target == "uImage" then "uinstall"
-      else if target == "zImage" || target == "Image.gz" then "zinstall"
+      /**/ if kernelConf.target == "uImage" then "uinstall"
+      else if kernelConf.target == "zImage" || kernelConf.target == "Image.gz" then "zinstall"
       else "install"))
   ];
 

From 479dd15b5f076f48dc367c5d97e6ee13f80cd694 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:42:15 -0700
Subject: [PATCH 018/154] Revert "linux: manual-config: use a non-random path
 for $buildRoot"

This reverts commit a695425e46a89a879fbe290a4ffa162c2b4a20c9.
---
 pkgs/os-specific/linux/kernel/manual-config.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 4a623fda9becf..6d1ad766d6849 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -179,8 +179,7 @@ stdenv.mkDerivation ({
   configurePhase = ''
     runHook preConfigure
 
-    export buildRoot=$TMPDIR/kernel-buildroot
-    mkdir -p $buildRoot
+    export buildRoot=$(mktemp -d)
 
     echo "manual-config configurePhase buildRoot=$buildRoot pwd=$PWD"
 

From 92f7beccb29bb68443cbcb81b05e4df6bb91f2e9 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:42:21 -0700
Subject: [PATCH 019/154] Revert "linuxManualConfig: fix inaccurate FIXME
 comment"

This reverts commit 4d15632cafdcd748d32076fd3f0ad0744f5dd7ec.
---
 pkgs/os-specific/linux/kernel/manual-config.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 6d1ad766d6849..656ca70863117 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -141,7 +141,7 @@ stdenv.mkDerivation ({
   postPatch = ''
     sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
 
-    # fixup for pre-4.15 kernels using the $(cd $foo && /bin/pwd) pattern
+    # fixup for pre-5.4 kernels using the $(cd $foo && /bin/pwd) pattern
     # FIXME: remove when no longer needed
     substituteInPlace Makefile tools/scripts/Makefile.include --replace /bin/pwd pwd
 

From 37eb25a4285919205f311d26952c752913e2cd1c Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:42:25 -0700
Subject: [PATCH 020/154] Revert "linuxManualConfig: get rid of drvAttrs"

This reverts commit f521f4613355f8628fe378dad4c41d3fd8886966.
---
 .../linux/kernel/manual-config.nix            | 632 +++++++++---------
 1 file changed, 314 insertions(+), 318 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 656ca70863117..46407eccf0572 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -52,10 +52,6 @@ in lib.makeOverridable ({
   features ? null, lib ? lib_, stdenv ? stdenv_,
 }:
 
-let
-  config_ = config;
-in
-
 let
   inherit (lib)
     hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
@@ -69,143 +65,333 @@ let
     (buildPackages.deterministic-uname.override { inherit modDirVersion; })
   ] ++ optional (lib.versionAtLeast version "5.13") zstd;
 
-  config = let attrName = attr: "CONFIG_" + attr; in {
-    isSet = attr: hasAttr (attrName attr) config;
-
-    getValue = attr: if config.isSet attr then getAttr (attrName attr) config else null;
-
-    isYes = attr: (config.getValue attr) == "y";
-
-    isNo = attr: (config.getValue attr) == "n";
-
-    isModule = attr: (config.getValue attr) == "m";
-
-    isEnabled = attr: (config.isModule attr) || (config.isYes attr);
-
-    isDisabled = attr: (!(config.isSet attr)) || (config.isNo attr);
-  } // config_;
-
-  isModular = config.isYes "MODULES";
-
-  kernelConf =  stdenv.hostPlatform.linux-kernel;
-
-  buildDTBs = kernelConf.DTB or false;
+  drvAttrs = config_: kernelConf: kernelPatches: configfile:
+    let
+      config = let attrName = attr: "CONFIG_" + attr; in {
+        isSet = attr: hasAttr (attrName attr) config;
+
+        getValue = attr: if config.isSet attr then getAttr (attrName attr) config else null;
+
+        isYes = attr: (config.getValue attr) == "y";
+
+        isNo = attr: (config.getValue attr) == "n";
+
+        isModule = attr: (config.getValue attr) == "m";
+
+        isEnabled = attr: (config.isModule attr) || (config.isYes attr);
+
+        isDisabled = attr: (!(config.isSet attr)) || (config.isNo attr);
+      } // config_;
+
+      isModular = config.isYes "MODULES";
+
+      buildDTBs = kernelConf.DTB or false;
+
+    in (optionalAttrs isModular { outputs = [ "out" "dev" ]; }) // {
+      passthru = rec {
+        inherit version modDirVersion config kernelPatches configfile
+          moduleBuildDependencies stdenv;
+        inherit isZen isHardened isLibre;
+        isXen = lib.warn "The isXen attribute is deprecated. All Nixpkgs kernels that support it now have Xen enabled." true;
+        baseVersion = lib.head (lib.splitString "-rc" version);
+        kernelOlder = lib.versionOlder baseVersion;
+        kernelAtLeast = lib.versionAtLeast baseVersion;
+      };
+
+      inherit src;
+
+      patches =
+        map (p: p.patch) kernelPatches
+        # Required for deterministic builds along with some postPatch magic.
+        ++ optional (lib.versionOlder version "5.19") ./randstruct-provide-seed.patch
+        ++ optional (lib.versionAtLeast version "5.19") ./randstruct-provide-seed-5.19.patch
+        # Linux 5.12 marked certain PowerPC-only symbols as GPL, which breaks
+        # OpenZFS; this was fixed in Linux 5.19 so we backport the fix
+        # https://github.com/openzfs/zfs/pull/13367
+        ++ optional (lib.versionAtLeast version "5.12" &&
+                     lib.versionOlder version "5.19" &&
+                     stdenv.hostPlatform.isPower)
+          (fetchpatch {
+            url = "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/patch/?id=d9e5c3e9e75162f845880535957b7fd0b4637d23";
+            hash = "sha256-bBOyJcP6jUvozFJU0SPTOf3cmnTQ6ZZ4PlHjiniHXLU=";
+          });
+
+      preUnpack = ''
+        # The same preUnpack is used to build the configfile,
+        # which does not have $dev.
+        if [ -n "$dev" ]; then
+            mkdir -p $dev/lib/modules/${modDirVersion}
+            cd $dev/lib/modules/${modDirVersion}
+        fi
+      '';
+
+      postUnpack = ''
+        mv -Tv "$sourceRoot" source 2>/dev/null || :
+        export sourceRoot=$PWD/source
+      '';
+
+      postPatch = ''
+        sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
+
+        # fixup for pre-5.4 kernels using the $(cd $foo && /bin/pwd) pattern
+        # FIXME: remove when no longer needed
+        substituteInPlace Makefile tools/scripts/Makefile.include --replace /bin/pwd pwd
+
+        # Don't include a (random) NT_GNU_BUILD_ID, to make the build more deterministic.
+        # This way kernels can be bit-by-bit reproducible depending on settings
+        # (e.g. MODULE_SIG and SECURITY_LOCKDOWN_LSM need to be disabled).
+        # See also https://kernelnewbies.org/BuildId
+        sed -i Makefile -e 's|--build-id=[^ ]*|--build-id=none|'
+
+        # Some linux-hardened patches now remove certain files in the scripts directory, so the file may not exist.
+        [[ -f scripts/ld-version.sh ]] && patchShebangs scripts/ld-version.sh
+
+        # Set randstruct seed to a deterministic but diversified value. Note:
+        # we could have instead patched gen-random-seed.sh to take input from
+        # the buildFlags, but that would require also patching the kernel's
+        # toplevel Makefile to add a variable export. This would be likely to
+        # cause future patch conflicts.
+        for file in scripts/gen-randstruct-seed.sh scripts/gcc-plugins/gen-random-seed.sh; do
+          if [ -f "$file" ]; then
+            substituteInPlace "$file" \
+              --replace NIXOS_RANDSTRUCT_SEED \
+              $(echo ${randstructSeed}${src} ${placeholder "configfile"} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
+            break
+          fi
+        done
+
+        patchShebangs scripts
+
+        # also patch arch-specific install scripts
+        for i in $(find arch -name install.sh); do
+            patchShebangs "$i"
+        done
+      '';
+
+      configurePhase = ''
+        runHook preConfigure
+
+        export buildRoot=$(mktemp -d)
+
+        echo "manual-config configurePhase buildRoot=$buildRoot pwd=$PWD"
+
+        if [ -f "$buildRoot/.config" ]; then
+          echo "Could not link $buildRoot/.config : file exists"
+          exit 1
+        fi
+        ln -sv ${configfile} $buildRoot/.config
+
+        # reads the existing .config file and prompts the user for options in
+        # the current kernel source that are not found in the file.
+        make $makeFlags "''${makeFlagsArray[@]}" oldconfig
+        runHook postConfigure
+
+        make $makeFlags "''${makeFlagsArray[@]}" prepare
+        actualModDirVersion="$(cat $buildRoot/include/config/kernel.release)"
+        if [ "$actualModDirVersion" != "${modDirVersion}" ]; then
+          echo "Error: modDirVersion ${modDirVersion} specified in the Nix expression is wrong, it should be: $actualModDirVersion"
+          exit 1
+        fi
+
+        buildFlagsArray+=("KBUILD_BUILD_TIMESTAMP=$(date -u -d @$SOURCE_DATE_EPOCH)")
+
+        cd $buildRoot
+      '';
+
+      buildFlags = [
+        "DTC_FLAGS=-@"
+        "KBUILD_BUILD_VERSION=1-NixOS"
+
+        # Set by default in the kernel since a73619a845d5,
+        # replicated here to apply to older versions.
+        # Makes __FILE__ relative to the build directory.
+        "KCPPFLAGS=-fmacro-prefix-map=$(sourceRoot)/="
+      ] ++ extraMakeFlags;
+
+      installFlags = [
+        "INSTALL_PATH=$(out)"
+      ] ++ (optional isModular "INSTALL_MOD_PATH=$(out)")
+      ++ optionals buildDTBs ["dtbs_install" "INSTALL_DTBS_PATH=$(out)/dtbs"];
+
+      preInstall = let
+        # All we really need to do here is copy the final image and System.map to $out,
+        # and use the kernel's modules_install, firmware_install, dtbs_install, etc. targets
+        # for the rest. Easy, right?
+        #
+        # Unfortunately for us, the obvious way of getting the built image path,
+        # make -s image_name, does not work correctly, because some architectures
+        # (*cough* aarch64 *cough*) change KBUILD_IMAGE on the fly in their install targets,
+        # so we end up attempting to install the thing we didn't actually build.
+        #
+        # Thankfully, there's a way out that doesn't involve just hardcoding everything.
+        #
+        # The kernel has an install target, which runs a pretty simple shell script
+        # (located at scripts/install.sh or arch/$arch/boot/install.sh, depending on
+        # which kernel version you're looking at) that tries to do something sensible.
+        #
+        # (it would be great to hijack this script immediately, as it has all the
+        #   information we need passed to it and we don't need it to try and be smart,
+        #   but unfortunately, the exact location of the scripts differs between kernel
+        #   versions, and they're seemingly not considered to be public API at all)
+        #
+        # One of the ways it tries to discover what "something sensible" actually is
+        # is by delegating to what's supposed to be a user-provided install script
+        # located at ~/bin/installkernel.
+        #
+        # (the other options are:
+        #   - a distribution-specific script at /sbin/installkernel,
+        #        which we can't really create in the sandbox easily
+        #   - an architecture-specific script at arch/$arch/boot/install.sh,
+        #        which attempts to guess _something_ and usually guesses very wrong)
+        #
+        # More specifically, the install script exec's into ~/bin/installkernel, if one
+        # exists, with the following arguments:
+        #
+        # $1: $KERNELRELEASE - full kernel version string
+        # $2: $KBUILD_IMAGE - the final image path
+        # $3: System.map - path to System.map file, seemingly hardcoded everywhere
+        # $4: $INSTALL_PATH - path to the destination directory as specified in installFlags
+        #
+        # $2 is exactly what we want, so hijack the script and use the knowledge given to it
+        # by the makefile overlords for our own nefarious ends.
+        #
+        # Note that the makefiles specifically look in ~/bin/installkernel, and
+        # writeShellScriptBin writes the script to <store path>/bin/installkernel,
+        # so HOME needs to be set to just the store path.
+        #
+        # FIXME: figure out a less roundabout way of doing this.
+        installkernel = buildPackages.writeShellScriptBin "installkernel" ''
+          cp -av $2 $4
+          cp -av $3 $4
+        '';
+      in ''
+        installFlagsArray+=("-j$NIX_BUILD_CORES")
+        export HOME=${installkernel}
+      '';
+
+      # Some image types need special install targets (e.g. uImage is installed with make uinstall)
+      installTargets = [
+        (kernelConf.installTarget or (
+          /**/ if kernelConf.target == "uImage" then "uinstall"
+          else if kernelConf.target == "zImage" || kernelConf.target == "Image.gz" then "zinstall"
+          else "install"))
+      ];
+
+      postInstall = optionalString isModular ''
+        if [ -z "''${dontStrip-}" ]; then
+          installFlagsArray+=("INSTALL_MOD_STRIP=1")
+        fi
+        make modules_install $makeFlags "''${makeFlagsArray[@]}" \
+          $installFlags "''${installFlagsArray[@]}"
+        unlink $out/lib/modules/${modDirVersion}/build
+        unlink $out/lib/modules/${modDirVersion}/source
+
+        mkdir $dev/lib/modules/${modDirVersion}/build
+
+        cd $dev/lib/modules/${modDirVersion}/source
+
+        cp $buildRoot/{.config,Module.symvers} $dev/lib/modules/${modDirVersion}/build
+        make modules_prepare $makeFlags "''${makeFlagsArray[@]}" O=$dev/lib/modules/${modDirVersion}/build
+
+        # For reproducibility, removes accidental leftovers from a `cc1` call
+        # from a `try-run` call from the Makefile
+        rm -f $dev/lib/modules/${modDirVersion}/build/.[0-9]*.d
+
+        # Keep some extra files
+        for f in arch/powerpc/lib/crtsavres.o arch/arm64/kernel/ftrace-mod.o \
+                 scripts/gdb/linux vmlinux vmlinux-gdb.py
+        do
+          if [ -e "$buildRoot/$f" ]; then
+            mkdir -p "$(dirname "$dev/lib/modules/${modDirVersion}/build/$f")"
+            cp -HR $buildRoot/$f $dev/lib/modules/${modDirVersion}/build/$f
+          fi
+        done
+        ln -s $dev/lib/modules/${modDirVersion}/build/vmlinux $dev
+
+        # !!! No documentation on how much of the source tree must be kept
+        # If/when kernel builds fail due to missing files, you can add
+        # them here. Note that we may see packages requiring headers
+        # from drivers/ in the future; it adds 50M to keep all of its
+        # headers on 3.10 though.
+
+        chmod u+w -R ..
+        arch=$(cd $dev/lib/modules/${modDirVersion}/build/arch; ls)
+
+        # Remove unused arches
+        for d in $(cd arch/; ls); do
+          if [ "$d" = "$arch" ]; then continue; fi
+          if [ "$arch" = arm64 ] && [ "$d" = arm ]; then continue; fi
+          rm -rf arch/$d
+        done
+
+        # Remove all driver-specific code (50M of which is headers)
+        rm -fR drivers
+
+        # Keep all headers
+        find .  -type f -name '*.h' -print0 | xargs -0 -r chmod u-w
+
+        # Keep linker scripts (they are required for out-of-tree modules on aarch64)
+        find .  -type f -name '*.lds' -print0 | xargs -0 -r chmod u-w
+
+        # Keep root and arch-specific Makefiles
+        chmod u-w Makefile arch/"$arch"/Makefile*
+
+        # Keep whole scripts dir
+        chmod u-w -R scripts
+
+        # Delete everything not kept
+        find . -type f -perm -u=w -print0 | xargs -0 -r rm
+
+        # Delete empty directories
+        find -empty -type d -delete
+
+        # Remove reference to kmod
+        sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
+      '';
+
+      preFixup = ''
+        # Don't strip $dev/lib/modules/*/vmlinux
+        stripDebugList="$(cd $dev && echo lib/modules/*/build/*/)"
+      '';
+
+      requiredSystemFeatures = [ "big-parallel" ];
+
+      meta = {
+        description =
+          "The Linux kernel" +
+          (if kernelPatches == [] then "" else
+            " (with patches: "
+            + lib.concatStringsSep ", " (map (x: x.name) kernelPatches)
+            + ")");
+        license = lib.licenses.gpl2Only;
+        homepage = "https://www.kernel.org/";
+        maintainers = lib.teams.linux-kernel.members ++ [
+          maintainers.thoughtpolice
+        ];
+        platforms = platforms.linux;
+        timeout = 14400; # 4 hours
+      } // extraMeta;
+    };
 in
 
 assert lib.versionOlder version "5.8" -> libelf != null;
 assert lib.versionAtLeast version "5.8" -> elfutils != null;
 
-stdenv.mkDerivation ({
+stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPatches configfile) // {
   pname = "linux";
-  inherit version src;
+  inherit version;
+
+  enableParallelBuilding = true;
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal ]
-      ++ optional  (kernelConf.target == "uImage") buildPackages.ubootTools
+      ++ optional  (stdenv.hostPlatform.linux-kernel.target == "uImage") buildPackages.ubootTools
       ++ optional  (lib.versionOlder version "5.8") libelf
       ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
       ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
       ++ optional  (lib.versionAtLeast version "5.8")  elfutils
       ;
 
-  patches =
-    map (p: p.patch) kernelPatches
-    # Required for deterministic builds along with some postPatch magic.
-    ++ optional (lib.versionOlder version "5.19") ./randstruct-provide-seed.patch
-    ++ optional (lib.versionAtLeast version "5.19") ./randstruct-provide-seed-5.19.patch
-    # Linux 5.12 marked certain PowerPC-only symbols as GPL, which breaks
-    # OpenZFS; this was fixed in Linux 5.19 so we backport the fix
-    # https://github.com/openzfs/zfs/pull/13367
-    ++ optional (lib.versionAtLeast version "5.12" &&
-                 lib.versionOlder version "5.19" &&
-                 stdenv.hostPlatform.isPower)
-      (fetchpatch {
-        url = "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/patch/?id=d9e5c3e9e75162f845880535957b7fd0b4637d23";
-        hash = "sha256-bBOyJcP6jUvozFJU0SPTOf3cmnTQ6ZZ4PlHjiniHXLU=";
-      });
-
-  preUnpack = ''
-    # The same preUnpack is used to build the configfile,
-    # which does not have $dev.
-    if [ -n "$dev" ]; then
-        mkdir -p $dev/lib/modules/${modDirVersion}
-        cd $dev/lib/modules/${modDirVersion}
-    fi
-  '';
-
-  postUnpack = ''
-    mv -Tv "$sourceRoot" source 2>/dev/null || :
-    export sourceRoot=$PWD/source
-  '';
-
-  postPatch = ''
-    sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
-
-    # fixup for pre-5.4 kernels using the $(cd $foo && /bin/pwd) pattern
-    # FIXME: remove when no longer needed
-    substituteInPlace Makefile tools/scripts/Makefile.include --replace /bin/pwd pwd
-
-    # Don't include a (random) NT_GNU_BUILD_ID, to make the build more deterministic.
-    # This way kernels can be bit-by-bit reproducible depending on settings
-    # (e.g. MODULE_SIG and SECURITY_LOCKDOWN_LSM need to be disabled).
-    # See also https://kernelnewbies.org/BuildId
-    sed -i Makefile -e 's|--build-id=[^ ]*|--build-id=none|'
-
-    # Some linux-hardened patches now remove certain files in the scripts directory, so the file may not exist.
-    [[ -f scripts/ld-version.sh ]] && patchShebangs scripts/ld-version.sh
-
-    # Set randstruct seed to a deterministic but diversified value. Note:
-    # we could have instead patched gen-random-seed.sh to take input from
-    # the buildFlags, but that would require also patching the kernel's
-    # toplevel Makefile to add a variable export. This would be likely to
-    # cause future patch conflicts.
-    for file in scripts/gen-randstruct-seed.sh scripts/gcc-plugins/gen-random-seed.sh; do
-      if [ -f "$file" ]; then
-        substituteInPlace "$file" \
-          --replace NIXOS_RANDSTRUCT_SEED \
-          $(echo ${randstructSeed}${src} ${placeholder "configfile"} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
-        break
-      fi
-    done
-
-    patchShebangs scripts
-
-    # also patch arch-specific install scripts
-    for i in $(find arch -name install.sh); do
-        patchShebangs "$i"
-    done
-  '';
-
-  configurePhase = ''
-    runHook preConfigure
-
-    export buildRoot=$(mktemp -d)
-
-    echo "manual-config configurePhase buildRoot=$buildRoot pwd=$PWD"
-
-    if [ -f "$buildRoot/.config" ]; then
-      echo "Could not link $buildRoot/.config : file exists"
-      exit 1
-    fi
-    ln -sv ${configfile} $buildRoot/.config
-
-    # reads the existing .config file and prompts the user for options in
-    # the current kernel source that are not found in the file.
-    make $makeFlags "''${makeFlagsArray[@]}" oldconfig
-    runHook postConfigure
-
-    make $makeFlags "''${makeFlagsArray[@]}" prepare
-    actualModDirVersion="$(cat $buildRoot/include/config/kernel.release)"
-    if [ "$actualModDirVersion" != "${modDirVersion}" ]; then
-      echo "Error: modDirVersion ${modDirVersion} specified in the Nix expression is wrong, it should be: $actualModDirVersion"
-      exit 1
-    fi
-
-    buildFlagsArray+=("KBUILD_BUILD_TIMESTAMP=$(date -u -d @$SOURCE_DATE_EPOCH)")
-
-    cd $buildRoot
-  '';
-
   hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" "pie" ];
 
   # Absolute paths for compilers avoid any PATH-clobbering issues.
@@ -217,198 +403,8 @@ stdenv.mkDerivation ({
     "ARCH=${stdenv.hostPlatform.linuxArch}"
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
-  ] ++ (kernelConf.makeFlags or [])
+  ] ++ (stdenv.hostPlatform.linux-kernel.makeFlags or [])
     ++ extraMakeFlags;
 
   karch = stdenv.hostPlatform.linuxArch;
-
-  buildFlags = [
-    "DTC_FLAGS=-@"
-    "KBUILD_BUILD_VERSION=1-NixOS"
-
-    # Set by default in the kernel since a73619a845d5,
-    # replicated here to apply to older versions.
-    # Makes __FILE__ relative to the build directory.
-    "KCPPFLAGS=-fmacro-prefix-map=$(sourceRoot)/="
-  ] ++ extraMakeFlags;
-
-  installFlags = [
-    "INSTALL_PATH=$(out)"
-  ] ++ (optional isModular "INSTALL_MOD_PATH=$(out)")
-  ++ optionals buildDTBs ["dtbs_install" "INSTALL_DTBS_PATH=$(out)/dtbs"];
-
-  preInstall = let
-    # All we really need to do here is copy the final image and System.map to $out,
-    # and use the kernel's modules_install, firmware_install, dtbs_install, etc. targets
-    # for the rest. Easy, right?
-    #
-    # Unfortunately for us, the obvious way of getting the built image path,
-    # make -s image_name, does not work correctly, because some architectures
-    # (*cough* aarch64 *cough*) change KBUILD_IMAGE on the fly in their install targets,
-    # so we end up attempting to install the thing we didn't actually build.
-    #
-    # Thankfully, there's a way out that doesn't involve just hardcoding everything.
-    #
-    # The kernel has an install target, which runs a pretty simple shell script
-    # (located at scripts/install.sh or arch/$arch/boot/install.sh, depending on
-    # which kernel version you're looking at) that tries to do something sensible.
-    #
-    # (it would be great to hijack this script immediately, as it has all the
-    #   information we need passed to it and we don't need it to try and be smart,
-    #   but unfortunately, the exact location of the scripts differs between kernel
-    #   versions, and they're seemingly not considered to be public API at all)
-    #
-    # One of the ways it tries to discover what "something sensible" actually is
-    # is by delegating to what's supposed to be a user-provided install script
-    # located at ~/bin/installkernel.
-    #
-    # (the other options are:
-    #   - a distribution-specific script at /sbin/installkernel,
-    #        which we can't really create in the sandbox easily
-    #   - an architecture-specific script at arch/$arch/boot/install.sh,
-    #        which attempts to guess _something_ and usually guesses very wrong)
-    #
-    # More specifically, the install script exec's into ~/bin/installkernel, if one
-    # exists, with the following arguments:
-    #
-    # $1: $KERNELRELEASE - full kernel version string
-    # $2: $KBUILD_IMAGE - the final image path
-    # $3: System.map - path to System.map file, seemingly hardcoded everywhere
-    # $4: $INSTALL_PATH - path to the destination directory as specified in installFlags
-    #
-    # $2 is exactly what we want, so hijack the script and use the knowledge given to it
-    # by the makefile overlords for our own nefarious ends.
-    #
-    # Note that the makefiles specifically look in ~/bin/installkernel, and
-    # writeShellScriptBin writes the script to <store path>/bin/installkernel,
-    # so HOME needs to be set to just the store path.
-    #
-    # FIXME: figure out a less roundabout way of doing this.
-    installkernel = buildPackages.writeShellScriptBin "installkernel" ''
-      cp -av $2 $4
-      cp -av $3 $4
-    '';
-  in ''
-    installFlagsArray+=("-j$NIX_BUILD_CORES")
-    export HOME=${installkernel}
-  '';
-
-  # Some image types need special install targets (e.g. uImage is installed with make uinstall)
-  installTargets = [
-    (kernelConf.installTarget or (
-      /**/ if kernelConf.target == "uImage" then "uinstall"
-      else if kernelConf.target == "zImage" || kernelConf.target == "Image.gz" then "zinstall"
-      else "install"))
-  ];
-
-  postInstall = optionalString isModular ''
-    if [ -z "''${dontStrip-}" ]; then
-      installFlagsArray+=("INSTALL_MOD_STRIP=1")
-    fi
-    make modules_install $makeFlags "''${makeFlagsArray[@]}" \
-      $installFlags "''${installFlagsArray[@]}"
-    unlink $out/lib/modules/${modDirVersion}/build
-    unlink $out/lib/modules/${modDirVersion}/source
-
-    mkdir $dev/lib/modules/${modDirVersion}/build
-
-    cd $dev/lib/modules/${modDirVersion}/source
-
-    cp $buildRoot/{.config,Module.symvers} $dev/lib/modules/${modDirVersion}/build
-    make modules_prepare $makeFlags "''${makeFlagsArray[@]}" O=$dev/lib/modules/${modDirVersion}/build
-
-    # For reproducibility, removes accidental leftovers from a `cc1` call
-    # from a `try-run` call from the Makefile
-    rm -f $dev/lib/modules/${modDirVersion}/build/.[0-9]*.d
-
-    # Keep some extra files
-    for f in arch/powerpc/lib/crtsavres.o arch/arm64/kernel/ftrace-mod.o \
-             scripts/gdb/linux vmlinux vmlinux-gdb.py
-    do
-      if [ -e "$buildRoot/$f" ]; then
-        mkdir -p "$(dirname "$dev/lib/modules/${modDirVersion}/build/$f")"
-        cp -HR $buildRoot/$f $dev/lib/modules/${modDirVersion}/build/$f
-      fi
-    done
-    ln -s $dev/lib/modules/${modDirVersion}/build/vmlinux $dev
-
-    # !!! No documentation on how much of the source tree must be kept
-    # If/when kernel builds fail due to missing files, you can add
-    # them here. Note that we may see packages requiring headers
-    # from drivers/ in the future; it adds 50M to keep all of its
-    # headers on 3.10 though.
-
-    chmod u+w -R ..
-    arch=$(cd $dev/lib/modules/${modDirVersion}/build/arch; ls)
-
-    # Remove unused arches
-    for d in $(cd arch/; ls); do
-      if [ "$d" = "$arch" ]; then continue; fi
-      if [ "$arch" = arm64 ] && [ "$d" = arm ]; then continue; fi
-      rm -rf arch/$d
-    done
-
-    # Remove all driver-specific code (50M of which is headers)
-    rm -fR drivers
-
-    # Keep all headers
-    find .  -type f -name '*.h' -print0 | xargs -0 -r chmod u-w
-
-    # Keep linker scripts (they are required for out-of-tree modules on aarch64)
-    find .  -type f -name '*.lds' -print0 | xargs -0 -r chmod u-w
-
-    # Keep root and arch-specific Makefiles
-    chmod u-w Makefile arch/"$arch"/Makefile*
-
-    # Keep whole scripts dir
-    chmod u-w -R scripts
-
-    # Delete everything not kept
-    find . -type f -perm -u=w -print0 | xargs -0 -r rm
-
-    # Delete empty directories
-    find -empty -type d -delete
-
-    # Remove reference to kmod
-    sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
-  '';
-
-  preFixup = ''
-    # Don't strip $dev/lib/modules/*/vmlinux
-    stripDebugList="$(cd $dev && echo lib/modules/*/build/*/)"
-  '';
-
-  enableParallelBuilding = true;
-
-  passthru = rec {
-    inherit version modDirVersion config kernelPatches configfile
-      moduleBuildDependencies stdenv;
-    inherit isZen isHardened isLibre;
-    isXen = lib.warn "The isXen attribute is deprecated. All Nixpkgs kernels that support it now have Xen enabled." true;
-    baseVersion = lib.head (lib.splitString "-rc" version);
-    kernelOlder = lib.versionOlder baseVersion;
-    kernelAtLeast = lib.versionAtLeast baseVersion;
-  };
-
-  requiredSystemFeatures = [ "big-parallel" ];
-
-  meta = {
-    description =
-      "The Linux kernel" +
-      (if kernelPatches == [] then "" else
-        " (with patches: "
-        + lib.concatStringsSep ", " (map (x: x.name) kernelPatches)
-        + ")");
-    license = lib.licenses.gpl2Only;
-    homepage = "https://www.kernel.org/";
-    maintainers = lib.teams.linux-kernel.members ++ [
-      maintainers.thoughtpolice
-    ];
-    platforms = platforms.linux;
-    timeout = 14400; # 4 hours
-  } // extraMeta;
-} // optionalAttrs (pos != null) {
-  inherit pos;
-} // optionalAttrs isModular {
-  outputs = [ "out" "dev" ];
-}))
+} // (optionalAttrs (pos != null) { inherit pos; })))

From 3aff6553615124198331f845ce3f07ddd731c2c5 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:42:37 -0700
Subject: [PATCH 021/154] Revert "linuxManualConfig: install GDB scripts"

This reverts commit d57568fcad7e3a9364850cb1c25d7a34693c02d5.
---
 .../os-specific/linux/kernel/common-config.nix |  7 ++++---
 .../os-specific/linux/kernel/manual-config.nix | 18 +++++-------------
 2 files changed, 9 insertions(+), 16 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 688c13499b1ab..a95a0ac2ede06 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -36,7 +36,10 @@ let
 
     debug = {
       # Necessary for BTF
-      DEBUG_INFO                = yes;
+      DEBUG_INFO                = mkMerge [
+        (whenOlder "5.2" (if (features.debug or false) then yes else no))
+        (whenBetween "5.2" "5.18" yes)
+      ];
       DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT = whenAtLeast "5.18" yes;
       # Reduced debug info conflict with BTF and have been enabled in
       # aarch64 defconfig since 5.13
@@ -59,8 +62,6 @@ let
       SUNRPC_DEBUG              = yes;
       # Provide access to tunables like sched_migration_cost_ns
       SCHED_DEBUG               = yes;
-
-      GDB_SCRIPTS               = yes;
     };
 
     power-management = {
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 46407eccf0572..4005dda4374a0 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -278,6 +278,7 @@ let
       ];
 
       postInstall = optionalString isModular ''
+        cp vmlinux $dev/
         if [ -z "''${dontStrip-}" ]; then
           installFlagsArray+=("INSTALL_MOD_STRIP=1")
         fi
@@ -297,16 +298,12 @@ let
         # from a `try-run` call from the Makefile
         rm -f $dev/lib/modules/${modDirVersion}/build/.[0-9]*.d
 
-        # Keep some extra files
-        for f in arch/powerpc/lib/crtsavres.o arch/arm64/kernel/ftrace-mod.o \
-                 scripts/gdb/linux vmlinux vmlinux-gdb.py
-        do
-          if [ -e "$buildRoot/$f" ]; then
-            mkdir -p "$(dirname "$dev/lib/modules/${modDirVersion}/build/$f")"
-            cp -HR $buildRoot/$f $dev/lib/modules/${modDirVersion}/build/$f
+        # Keep some extra files on some arches (powerpc, aarch64)
+        for f in arch/powerpc/lib/crtsavres.o arch/arm64/kernel/ftrace-mod.o; do
+          if [ -f "$buildRoot/$f" ]; then
+            cp $buildRoot/$f $dev/lib/modules/${modDirVersion}/build/$f
           fi
         done
-        ln -s $dev/lib/modules/${modDirVersion}/build/vmlinux $dev
 
         # !!! No documentation on how much of the source tree must be kept
         # If/when kernel builds fail due to missing files, you can add
@@ -349,11 +346,6 @@ let
         sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
       '';
 
-      preFixup = ''
-        # Don't strip $dev/lib/modules/*/vmlinux
-        stripDebugList="$(cd $dev && echo lib/modules/*/build/*/)"
-      '';
-
       requiredSystemFeatures = [ "big-parallel" ];
 
       meta = {

From 12a06dc2b8507b01c5ba96f94e8f4bf241df6a0d Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:42:43 -0700
Subject: [PATCH 022/154] Revert "linuxManualConfig: use the default make
 target"

This reverts commit 41f788b1217b05d8661ebb77bfc9d9f3f65b5dd2.
---
 pkgs/os-specific/linux/kernel/manual-config.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 4005dda4374a0..d4eff7b7e4532 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -199,14 +199,18 @@ let
       '';
 
       buildFlags = [
-        "DTC_FLAGS=-@"
         "KBUILD_BUILD_VERSION=1-NixOS"
 
         # Set by default in the kernel since a73619a845d5,
         # replicated here to apply to older versions.
         # Makes __FILE__ relative to the build directory.
         "KCPPFLAGS=-fmacro-prefix-map=$(sourceRoot)/="
-      ] ++ extraMakeFlags;
+
+        kernelConf.target
+        "vmlinux"  # for "perf" and things like that
+      ] ++ optional isModular "modules"
+        ++ optionals buildDTBs ["dtbs" "DTC_FLAGS=-@"]
+      ++ extraMakeFlags;
 
       installFlags = [
         "INSTALL_PATH=$(out)"

From 93021f12c3bb97448bb40d75c29401d49333b531 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:42:49 -0700
Subject: [PATCH 023/154] Revert "linuxManualConfig: unpack directly into $dev"

This reverts commit 7de3f08ce38aca9fddb5db7bcb7741fd389be9ef.
---
 .../linux/kernel/manual-config.nix            | 28 +++++--------------
 1 file changed, 7 insertions(+), 21 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index d4eff7b7e4532..3480928aa5b9c 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -116,20 +116,6 @@ let
             hash = "sha256-bBOyJcP6jUvozFJU0SPTOf3cmnTQ6ZZ4PlHjiniHXLU=";
           });
 
-      preUnpack = ''
-        # The same preUnpack is used to build the configfile,
-        # which does not have $dev.
-        if [ -n "$dev" ]; then
-            mkdir -p $dev/lib/modules/${modDirVersion}
-            cd $dev/lib/modules/${modDirVersion}
-        fi
-      '';
-
-      postUnpack = ''
-        mv -Tv "$sourceRoot" source 2>/dev/null || :
-        export sourceRoot=$PWD/source
-      '';
-
       postPatch = ''
         sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
 
@@ -200,12 +186,6 @@ let
 
       buildFlags = [
         "KBUILD_BUILD_VERSION=1-NixOS"
-
-        # Set by default in the kernel since a73619a845d5,
-        # replicated here to apply to older versions.
-        # Makes __FILE__ relative to the build directory.
-        "KCPPFLAGS=-fmacro-prefix-map=$(sourceRoot)/="
-
         kernelConf.target
         "vmlinux"  # for "perf" and things like that
       ] ++ optional isModular "modules"
@@ -282,6 +262,7 @@ let
       ];
 
       postInstall = optionalString isModular ''
+        mkdir -p $dev
         cp vmlinux $dev/
         if [ -z "''${dontStrip-}" ]; then
           installFlagsArray+=("INSTALL_MOD_STRIP=1")
@@ -291,7 +272,12 @@ let
         unlink $out/lib/modules/${modDirVersion}/build
         unlink $out/lib/modules/${modDirVersion}/source
 
-        mkdir $dev/lib/modules/${modDirVersion}/build
+        mkdir -p $dev/lib/modules/${modDirVersion}/{build,source}
+
+        # To save space, exclude a bunch of unneeded stuff when copying.
+        (cd "$NIX_BUILD_TOP" && cd "$sourceRoot" &&
+         rsync --archive --prune-empty-dirs \
+            * $dev/lib/modules/${modDirVersion}/source/)
 
         cd $dev/lib/modules/${modDirVersion}/source
 

From dbe0d20b573e7e4536169456cb55f691d5f678ec Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Tue, 25 Jul 2023 14:42:53 -0700
Subject: [PATCH 024/154] Revert "linuxManualConfig: don't build inside source
 tree"

This reverts commit d75cff2ee3bb6d91c818d43d1ba7603bb6dacd59.
---
 pkgs/os-specific/linux/kernel/manual-config.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 3480928aa5b9c..61013ef090af0 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -157,7 +157,8 @@ let
       configurePhase = ''
         runHook preConfigure
 
-        export buildRoot=$(mktemp -d)
+        mkdir build
+        export buildRoot="$(pwd)/build"
 
         echo "manual-config configurePhase buildRoot=$buildRoot pwd=$PWD"
 
@@ -275,8 +276,8 @@ let
         mkdir -p $dev/lib/modules/${modDirVersion}/{build,source}
 
         # To save space, exclude a bunch of unneeded stuff when copying.
-        (cd "$NIX_BUILD_TOP" && cd "$sourceRoot" &&
-         rsync --archive --prune-empty-dirs \
+        (cd .. && rsync --archive --prune-empty-dirs \
+            --exclude='/build/' \
             * $dev/lib/modules/${modDirVersion}/source/)
 
         cd $dev/lib/modules/${modDirVersion}/source

From 43da9e8fff25822b6a5ba54e242ff94177b77f0f Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 29 Jul 2023 14:37:11 +0100
Subject: [PATCH 025/154] glibcLocales: disable parallelism to restore
 deterministic locales

The way `nixpkgs` runs parallel `localedef` instances shares
`--prefix=/build` flag. As a result `localedef` processes
non-deterministically extend the file with new locales (hopefully
without data corruption):

    https://github.com/NixOS/nixpkgs/issues/245360

Co-authored-by: Adam Joseph <54836058+amjoseph-nixpkgs@users.noreply.github.com>
---
 pkgs/development/libraries/glibc/locales.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/glibc/locales.nix b/pkgs/development/libraries/glibc/locales.nix
index 86d6d1438b2dc..d2db9cd71b200 100644
--- a/pkgs/development/libraries/glibc/locales.nix
+++ b/pkgs/development/libraries/glibc/locales.nix
@@ -60,7 +60,11 @@
       echo SUPPORTED-LOCALES='${toString locales}' > ../glibc-2*/localedata/SUPPORTED
     '';
 
-  enableParallelBuilding = true;
+  # Current `nixpkgs` way of building locales is not compatible with
+  # parallel install. `locale-archive` is updated in parallel with
+  # multiple `localedef` processes and causes non-deterministic result:
+  #   https://github.com/NixOS/nixpkgs/issues/245360
+  enableParallelBuilding = false;
 
   makeFlags = (previousAttrs.makeFlags or []) ++ [
     "localedata/install-locales"

From 7adf0a4eeb0ac19b07ca17f27e20ca4cee12df3d Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 30 Jul 2023 09:43:09 +0100
Subject: [PATCH 026/154] setup-hooks/strip: resolve/uniq symlinks before
 stripping

Before the change the hook had a chance to run `strip` against the same
file using multiple link paths. In case of `gcc` `libgcc.a` was stripped
multiple times in parallel and produces corrupted archive.

The change runs inputs via `realpath | uniq` to make sure we don't
attempt to strip the same files multiple times.
---
 pkgs/build-support/setup-hooks/strip.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/build-support/setup-hooks/strip.sh b/pkgs/build-support/setup-hooks/strip.sh
index 1d65c10c52308..5f53e7e95b2ef 100644
--- a/pkgs/build-support/setup-hooks/strip.sh
+++ b/pkgs/build-support/setup-hooks/strip.sh
@@ -68,6 +68,11 @@ stripDirs() {
         striperr="$(mktemp 'striperr.XXXXXX')"
         # Do not strip lib/debug. This is a directory used by setup-hooks/separate-debug-info.sh.
         find $paths -type f -a '!' -path "$prefix/lib/debug/*" -print0 |
+            # Make sure we process files under symlinks only once. Otherwise
+            # 'strip` can corrupt files when writes to them in parallel:
+            #   https://github.com/NixOS/nixpkgs/issues/246147#issuecomment-1657072039
+            xargs -r -0 -n1 -- realpath -z | sort -u -z |
+
             xargs -r -0 -n1 -P "$NIX_BUILD_CORES" -- $cmd $stripFlags 2>"$striperr" || exit_code=$?
         # xargs exits with status code 123 if some but not all of the
         # processes fail. We don't care if some of the files couldn't

From 2141d9879ad46ff7cb518e9bfd9b3a4312e8591a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 31 Jul 2023 11:20:15 +0200
Subject: [PATCH 027/154] Revert "stdenv: use improved strip.sh for
 aarch64-linux"

This reverts commit 39919b8f215110c1516f5c6b300f5ee69df23fd4.
The parent merge resolved this more properly.
---
 .../setup-hooks/strip-tmp-aarch64.sh          | 90 -------------------
 pkgs/stdenv/generic/default.nix               |  5 +-
 2 files changed, 1 insertion(+), 94 deletions(-)
 delete mode 100644 pkgs/build-support/setup-hooks/strip-tmp-aarch64.sh

diff --git a/pkgs/build-support/setup-hooks/strip-tmp-aarch64.sh b/pkgs/build-support/setup-hooks/strip-tmp-aarch64.sh
deleted file mode 100644
index 5f53e7e95b2ef..0000000000000
--- a/pkgs/build-support/setup-hooks/strip-tmp-aarch64.sh
+++ /dev/null
@@ -1,90 +0,0 @@
-# This setup hook strips libraries and executables in the fixup phase.
-
-fixupOutputHooks+=(_doStrip)
-
-_doStrip() {
-    # We don't bother to strip build platform code because it shouldn't make it
-    # to $out anyways---if it does, that's a bigger problem that a lack of
-    # stripping will help catch.
-    local -ra flags=(dontStripHost dontStripTarget)
-    local -ra debugDirs=(stripDebugList stripDebugListTarget)
-    local -ra allDirs=(stripAllList stripAllListTarget)
-    local -ra stripCmds=(STRIP STRIP_FOR_TARGET)
-    local -ra ranlibCmds=(RANLIB RANLIB_FOR_TARGET)
-
-    # TODO(structured-attrs): This doesn't work correctly if one of
-    #   the items in strip*List or strip*Flags contains a space,
-    #   even with structured attrs enabled.  This is OK for now
-    #   because very few packages set any of these, and it doesn't
-    #   affect any of them.
-    #
-    #   After __structuredAttrs = true is universal, come back and
-    #   push arrays all the way through this logic.
-
-    # Strip only host paths by default. Leave targets as is.
-    stripDebugList=${stripDebugList[*]:-lib lib32 lib64 libexec bin sbin}
-    stripDebugListTarget=${stripDebugListTarget[*]:-}
-    stripAllList=${stripAllList[*]:-}
-    stripAllListTarget=${stripAllListTarget[*]:-}
-
-    local i
-    for i in ${!stripCmds[@]}; do
-        local -n flag="${flags[$i]}"
-        local -n debugDirList="${debugDirs[$i]}"
-        local -n allDirList="${allDirs[$i]}"
-        local -n stripCmd="${stripCmds[$i]}"
-        local -n ranlibCmd="${ranlibCmds[$i]}"
-
-        # `dontStrip` disables them all
-        if [[ "${dontStrip-}" || "${flag-}" ]] || ! type -f "${stripCmd-}" 2>/dev/null 1>&2
-        then continue; fi
-
-        stripDirs "$stripCmd" "$ranlibCmd" "$debugDirList" "${stripDebugFlags[*]:--S -p}"
-        stripDirs "$stripCmd" "$ranlibCmd" "$allDirList" "${stripAllFlags[*]:--s -p}"
-    done
-}
-
-stripDirs() {
-    local cmd="$1"
-    local ranlibCmd="$2"
-    local paths="$3"
-    local stripFlags="$4"
-    local pathsNew=
-
-    [ -z "$cmd" ] && echo "stripDirs: Strip command is empty" 1>&2 && exit 1
-    [ -z "$ranlibCmd" ] && echo "stripDirs: Ranlib command is empty" 1>&2 && exit 1
-
-    local p
-    for p in ${paths}; do
-        if [ -e "$prefix/$p" ]; then
-            pathsNew="${pathsNew} $prefix/$p"
-        fi
-    done
-    paths=${pathsNew}
-
-    if [ -n "${paths}" ]; then
-        echo "stripping (with command $cmd and flags $stripFlags) in $paths"
-        local striperr
-        striperr="$(mktemp 'striperr.XXXXXX')"
-        # Do not strip lib/debug. This is a directory used by setup-hooks/separate-debug-info.sh.
-        find $paths -type f -a '!' -path "$prefix/lib/debug/*" -print0 |
-            # Make sure we process files under symlinks only once. Otherwise
-            # 'strip` can corrupt files when writes to them in parallel:
-            #   https://github.com/NixOS/nixpkgs/issues/246147#issuecomment-1657072039
-            xargs -r -0 -n1 -- realpath -z | sort -u -z |
-
-            xargs -r -0 -n1 -P "$NIX_BUILD_CORES" -- $cmd $stripFlags 2>"$striperr" || exit_code=$?
-        # xargs exits with status code 123 if some but not all of the
-        # processes fail. We don't care if some of the files couldn't
-        # be stripped, so ignore specifically this code.
-        [[ "$exit_code" = 123 || -z "$exit_code" ]] || (cat "$striperr" 1>&2 && exit 1)
-
-        rm "$striperr"
-        # 'strip' does not normally preserve archive index in .a files.
-        # This usually causes linking failures against static libs like:
-        #   ld: ...-i686-w64-mingw32-stage-final-gcc-13.0.0-lib/i686-w64-mingw32/lib/libstdc++.dll.a:
-        #     error adding symbols: archive has no index; run ranlib to add one
-        # Restore the index by running 'ranlib'.
-        find $paths -name '*.a' -type f -exec $ranlibCmd '{}' \; 2>/dev/null
-    fi
-}
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index 0d9ae8d3c4fb9..cf194be92bd75 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -70,10 +70,7 @@ let
       ../../build-support/setup-hooks/prune-libtool-files.sh
       ../../build-support/setup-hooks/reproducible-builds.sh
       ../../build-support/setup-hooks/set-source-date-epoch-to-latest.sh
-      (with buildPlatform; if isAarch64 && isLinux
-        then ../../build-support/setup-hooks/strip-tmp-aarch64.sh
-        else ../../build-support/setup-hooks/strip.sh
-      )
+      ../../build-support/setup-hooks/strip.sh
     ] ++ lib.optionals hasCC [ cc ];
 
   defaultBuildInputs = extraBuildInputs;

From e66c968210752c7fe25033264b683c2ab820c223 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 31 Jul 2023 13:31:53 +0200
Subject: [PATCH 028/154] librsvg: use installShellCompletion, little cleanup

---
 .../development/libraries/librsvg/default.nix | 22 +++++++++----------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 6542fdfb14fea..bece97ac482de 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -4,6 +4,7 @@
 , pkg-config
 , glib
 , gdk-pixbuf
+, installShellFiles
 , pango
 , cairo
 , libxml2
@@ -59,6 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     gdk-pixbuf
+    installShellFiles
     pkg-config
     rustc
     cargo-auditable-cargo-wrapper
@@ -121,12 +123,10 @@ stdenv.mkDerivation (finalAttrs: {
   postConfigure = ''
     GDK_PIXBUF=$out/lib/gdk-pixbuf-2.0/2.10.0
     mkdir -p $GDK_PIXBUF/loaders
-    sed -e "s#gdk_pixbuf_moduledir = .*#gdk_pixbuf_moduledir = $GDK_PIXBUF/loaders#" \
-        -i gdk-pixbuf-loader/Makefile
-    sed -e "s#gdk_pixbuf_cache_file = .*#gdk_pixbuf_cache_file = $GDK_PIXBUF/loaders.cache#" \
-        -i gdk-pixbuf-loader/Makefile
-    sed -e "s#\$(GDK_PIXBUF_QUERYLOADERS)#GDK_PIXBUF_MODULEDIR=$GDK_PIXBUF/loaders \$(GDK_PIXBUF_QUERYLOADERS)#" \
-         -i gdk-pixbuf-loader/Makefile
+    sed -i gdk-pixbuf-loader/Makefile \
+      -e "s#gdk_pixbuf_moduledir = .*#gdk_pixbuf_moduledir = $GDK_PIXBUF/loaders#" \
+      -e "s#gdk_pixbuf_cache_file = .*#gdk_pixbuf_cache_file = $GDK_PIXBUF/loaders.cache#" \
+      -e "s#\$(GDK_PIXBUF_QUERYLOADERS)#GDK_PIXBUF_MODULEDIR=$GDK_PIXBUF/loaders \$(GDK_PIXBUF_QUERYLOADERS)#"
 
     # Fix thumbnailer path
     sed -e "s#@bindir@\(/gdk-pixbuf-thumbnailer\)#${gdk-pixbuf}/bin\1#g" \
@@ -147,12 +147,10 @@ stdenv.mkDerivation (finalAttrs: {
       cat ${lib.getLib gdk-pixbuf}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache $GDK_PIXBUF/loaders.cache > $GDK_PIXBUF/loaders.cache.tmp
       mv $GDK_PIXBUF/loaders.cache.tmp $GDK_PIXBUF/loaders.cache
 
-      mkdir -p "$out/share/bash-completion/completions/"
-      ${emulator} $out/bin/rsvg-convert --completion bash > "$out/share/bash-completion/completions/rsvg-convert"
-      mkdir -p "$out/share/zsh/site-functions/"
-      ${emulator} $out/bin/rsvg-convert --completion zsh > "$out/share/zsh/site-functions/_rsvg-convert"
-      mkdir -p "$out/share/fish/vendor_completions.d/"
-      ${emulator} $out/bin/rsvg-convert --completion fish > "$out/share/fish/vendor_completions.d/rsvg-convert.fish"
+      installShellCompletion --cmd rsvg-convert \
+        --bash <(${emulator} $out/bin/rsvg-convert --completion bash) \
+        --fish <(${emulator} $out/bin/rsvg-convert --completion fish) \
+        --zsh <(${emulator} $out/bin/rsvg-convert --completion zsh)
     '';
 
   postFixup = lib.optionalString withIntrospection ''

From bb89f903f4e5fc365dac2791a2f124e86d770875 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 31 Jul 2023 18:07:09 +0200
Subject: [PATCH 029/154] Revert "libhwy: apply the new patch conditionally"

This reverts commit 8fd0ff15837347ed488abdb8232ad0ae40c52971.
---
 pkgs/development/libraries/libhwy/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/libhwy/default.nix b/pkgs/development/libraries/libhwy/default.nix
index afbbf69966bd8..4373f7474339a 100644
--- a/pkgs/development/libraries/libhwy/default.nix
+++ b/pkgs/development/libraries/libhwy/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     rev = version;
     hash = "sha256-Gym2iHq5ws9kuG4HWSQndD8hVugV4USZt6dUFnEkLwY=";
   };
-  patches = lib.optionals (with stdenv; isAarch64 && isLinux) [ # conditional, temporarily
+  patches = [
     # backport for compilation issue on aarch64
     # https://github.com/google/highway/issues/1613
     (fetchpatch {

From f0f53431d187a3e10b3caae3f1439faab39e14e1 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Fri, 7 Jul 2023 07:15:41 -0600
Subject: [PATCH 030/154] djvulibre: fix build with clang 16

This fixes the build with clang 16, which defaults to C++17. In C++17,
the `register` storage class specifier was removed.
---
 .../misc/djvulibre/c++17-register-class.patch | 21 +++++++++++++++++++
 pkgs/applications/misc/djvulibre/default.nix  |  4 ++++
 2 files changed, 25 insertions(+)
 create mode 100644 pkgs/applications/misc/djvulibre/c++17-register-class.patch

diff --git a/pkgs/applications/misc/djvulibre/c++17-register-class.patch b/pkgs/applications/misc/djvulibre/c++17-register-class.patch
new file mode 100644
index 0000000000000..88251b34f7732
--- /dev/null
+++ b/pkgs/applications/misc/djvulibre/c++17-register-class.patch
@@ -0,0 +1,21 @@
+diff -ur a/libdjvu/GBitmap.h b/libdjvu/GBitmap.h
+--- a/libdjvu/GBitmap.h	2020-11-20 09:57:32.000000000 -0700
++++ b/libdjvu/GBitmap.h	2023-07-07 07:07:45.519912414 -0600
+@@ -620,7 +620,7 @@
+ inline int
+ GBitmap::read_run(unsigned char *&data)
+ {
+-  register int z=*data++;
++  int z=*data++;
+   return (z>=RUNOVERFLOWVALUE)?
+     ((z&~RUNOVERFLOWVALUE)<<8)|(*data++):z;
+ }
+@@ -628,7 +628,7 @@
+ inline int
+ GBitmap::read_run(const unsigned char *&data)
+ {
+-  register int z=*data++;
++  int z=*data++;
+   return (z>=RUNOVERFLOWVALUE)?
+     ((z&~RUNOVERFLOWVALUE)<<8)|(*data++):z;
+ }
diff --git a/pkgs/applications/misc/djvulibre/default.nix b/pkgs/applications/misc/djvulibre/default.nix
index ad85c9c79d1d2..65591c8d82545 100644
--- a/pkgs/applications/misc/djvulibre/default.nix
+++ b/pkgs/applications/misc/djvulibre/default.nix
@@ -30,6 +30,10 @@ stdenv.mkDerivation rec {
     bash
   ];
 
+  # Remove uses of the `register` storage class specifier, which was removed in C++17.
+  # Fixes compilation with clang 16, which defaults to C++17.
+  patches = [ ./c++17-register-class.patch ];
+
   enableParallelBuilding = true;
 
   meta = with lib; {

From 6f2b3ba027f0d74614ba1b21f15ea45b0beb0385 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Mon, 24 Jul 2023 17:07:50 -0400
Subject: [PATCH 031/154] cc-wrapper: use a temporary file for reponse file

The Darwin stdenv rework conditionally sets `NIX_CC_USE_RESPONSE_FILE`
depending on the `ARG_MAX` of the build system. If it is at least 1 MiB,
the stdenv passes the arguments on the command-line (like Linux).
Otherwise, it falls back to the response file. This was done to prevent
intermitent failures with clang 16 being unable to read the response
file. Unfortunately, this breaks `gccStdenv` on older Darwin platforms.

Note: While the stdenv logic will also be reverted, this change is
needed for compatibility with clang 16.

GCC is capable of using a response file, but it does not work correctly
when the response file is a file descriptor. This can be reproduced
using the following sequence of commands:

    $ nix shell nixpkgs#gcc; NIX_CC_USE_RESPONSE_FILE=1 gcc
    # Linux
    /nix/store/9n9gjvzci75gp2sh1c4rh626dhizqynl-binutils-2.39/bin/ld: unrecognized option '-B/nix/store/vnwdak3n1w2jjil119j65k8mw1z23p84-glibc-2.35-224/lib/'
    /nix/store/9n9gjvzci75gp2sh1c4rh626dhizqynl-binutils-2.39/bin/ld: use the --help option for usage information
    collect2: error: ld returned 1 exit status
    # Darwin
    ld: unknown option: -mmacosx-version-min=11.0
    collect2: error: ld returned 1 exit status

Instead of using process substitution, create a temporary file and
remove it in a trap. This should also prevent the intermitent build
failures with clang 16 on older Darwin systems.

Fixes #245167
---
 pkgs/build-support/cc-wrapper/cc-wrapper.sh | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 5350fc3cc9ae5..244a0bb6623b8 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -246,10 +246,13 @@ if [[ -e @out@/nix-support/cc-wrapper-hook ]]; then
 fi
 
 if (( "${NIX_CC_USE_RESPONSE_FILE:-@use_response_file_by_default@}" >= 1 )); then
-    exec @prog@ @<(printf "%q\n" \
+    responseFile=$(mktemp --tmpdir cc-params.XXXXXX)
+    trap 'rm -f -- "$responseFile"' EXIT
+    printf "%q\n" \
        ${extraBefore+"${extraBefore[@]}"} \
        ${params+"${params[@]}"} \
-       ${extraAfter+"${extraAfter[@]}"})
+       ${extraAfter+"${extraAfter[@]}"} > "$responseFile"
+    @prog@ "@$responseFile"
 else
     exec @prog@ \
        ${extraBefore+"${extraBefore[@]}"} \

From 7110fa6dc4dd96bb5e593c5a5dd34dcee3bbf278 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Tue, 1 Aug 2023 13:00:48 +0200
Subject: [PATCH 032/154] openldap: 2.6.5 -> 2.6.6

---
 pkgs/development/libraries/openldap/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index eded5f1b5b963..483e4390a7cde 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "openldap";
-  version = "2.6.5";
+  version = "2.6.6";
 
   src = fetchurl {
     url = "https://www.openldap.org/software/download/OpenLDAP/openldap-release/${pname}-${version}.tgz";
-    hash = "sha256-Lieo1PTCr4/oQLVzJxwgqhY+JJh/l2UhRkQpD1vrONk=";
+    hash = "sha256-CC6ZjPVCmE1DY0RC2+EdqGB1nlEJBxUupXm9xC/jnqA=";
   };
 
   # TODO: separate "out" and "bin"

From 62b8af17d8bda579ef9e2c319533e136868dcc1c Mon Sep 17 00:00:00 2001
From: Samuel Tardieu <sam@rfc1149.net>
Date: Tue, 1 Aug 2023 10:45:31 +0200
Subject: [PATCH 033/154] autogen: apply more patches to avoid crashes

autogen is an old software and triggers many checks, notably in getdefs,
when used with _FORTIFY_SOURCE. Apply more correctness patches coming
from Suse through Debian.
---
 .../tools/misc/autogen/default.nix            | 26 +++++++++++++++----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/tools/misc/autogen/default.nix b/pkgs/development/tools/misc/autogen/default.nix
index 61df38f68ce98..e88d15a84335b 100644
--- a/pkgs/development/tools/misc/autogen/default.nix
+++ b/pkgs/development/tools/misc/autogen/default.nix
@@ -10,24 +10,40 @@ stdenv.mkDerivation rec {
   };
 
   patches = let
-    dp = { ver ? "1%255.18.16-4", pname, name ? (pname + ".diff"), sha256 }: fetchurl {
+    dp = { ver ? "1%255.18.16-5", name, sha256 }: fetchurl {
       url = "https://salsa.debian.org/debian/autogen/-/raw/debian/${ver}"
-          + "/debian/patches/${pname}.diff?inline=false";
+          + "/debian/patches/${name}?inline=false";
       inherit name sha256;
     };
   in [
     (dp {
-      pname = "20_no_Werror";
+      name = "20_no_Werror.diff";
       sha256 = "08z4s2ifiqyaacjpd9pzr59w8m4j3548kkaq1bwvp2gjn29m680x";
     })
     (dp {
-      pname = "30_ag_macros.m4_syntax_error";
+      name = "30_ag_macros.m4_syntax_error.diff";
       sha256 = "1z8vmbwbkz3505wd33i2xx91mlf8rwsa7klndq37nw821skxwyh3";
     })
     (dp {
-      pname = "31_allow_overriding_AGexe_for_crossbuild";
+      name = "31_allow_overriding_AGexe_for_crossbuild.diff";
       sha256 = "0h9wkc9bqb509knh8mymi43hg6n6sxg2lixvjlchcx7z0j7p8xkf";
     })
+    (dp {
+      name = "40_suse_01-autogen-catch-race-error.patch";
+      sha256 = "1cfkym2zds1f85md1m74snxzqmzlj7wd5jivgmyl342856848xav";
+    })
+    (dp {
+      name = "40_suse_03-gcc9-fix-wrestrict.patch";
+      sha256 = "1ifdwi6gf96jc78jw7q4bfi5fgdldlf2nl55y20h6xb78kv0pznd";
+    })
+    (dp {
+      name = "40_suse_05-sprintf-overflow.patch";
+      sha256 = "136m62k68w1h5k7iapynvbyipidw35js6pq21lsc6rpxvgp0n469";
+    })
+    (dp {
+      name = "40_suse_06-autogen-avoid-GCC-code-analysis-bug.patch";
+      sha256 = "1d65zygzw2rpa00s0jy2y1bg29vkbhnjwlb5pv22rfv87zbk6z9q";
+    })
     # Next upstream release will contain guile-3 support. We apply non-invasive
     # patch meanwhile.
     (fetchpatch {

From b889dfdb3447f03ae1e2c8e6fa63dbeb85f3d258 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Tue, 1 Aug 2023 16:24:15 +0200
Subject: [PATCH 034/154] openssl: 3.0.9 -> 3.0.10

https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-309-and-openssl-3010-1-aug-2023
---
 .../libraries/openssl/3.0/CVE-2023-2975.patch | 54 -------------------
 .../development/libraries/openssl/default.nix |  7 +--
 2 files changed, 2 insertions(+), 59 deletions(-)
 delete mode 100644 pkgs/development/libraries/openssl/3.0/CVE-2023-2975.patch

diff --git a/pkgs/development/libraries/openssl/3.0/CVE-2023-2975.patch b/pkgs/development/libraries/openssl/3.0/CVE-2023-2975.patch
deleted file mode 100644
index d1622977b64dc..0000000000000
--- a/pkgs/development/libraries/openssl/3.0/CVE-2023-2975.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc Mon Sep 17 00:00:00 2001
-From: Tomas Mraz <tomas@openssl.org>
-Date: Tue, 4 Jul 2023 17:30:35 +0200
-Subject: [PATCH] Do not ignore empty associated data with AES-SIV mode
-
-The AES-SIV mode allows for multiple associated data items
-authenticated separately with any of these being 0 length.
-
-The provided implementation ignores such empty associated data
-which is incorrect in regards to the RFC 5297 and is also
-a security issue because such empty associated data then become
-unauthenticated if an application expects to authenticate them.
-
-Fixes CVE-2023-2975
-
-Reviewed-by: Matt Caswell <matt@openssl.org>
-Reviewed-by: Paul Dale <pauli@openssl.org>
-(Merged from https://github.com/openssl/openssl/pull/21384)
-
-(cherry picked from commit c426c281cfc23ab182f7d7d7a35229e7db1494d9)
----
- .../implementations/ciphers/cipher_aes_siv.c   | 18 +++++++++++-------
- 1 file changed, 11 insertions(+), 7 deletions(-)
-
-diff --git a/providers/implementations/ciphers/cipher_aes_siv.c b/providers/implementations/ciphers/cipher_aes_siv.c
-index 45010b90db2a..b396c8651a32 100644
---- a/providers/implementations/ciphers/cipher_aes_siv.c
-+++ b/providers/implementations/ciphers/cipher_aes_siv.c
-@@ -120,14 +120,18 @@ static int siv_cipher(void *vctx, unsigned char *out, size_t *outl,
-     if (!ossl_prov_is_running())
-         return 0;
- 
--    if (inl == 0) {
--        *outl = 0;
--        return 1;
--    }
-+    /* Ignore just empty encryption/decryption call and not AAD. */
-+    if (out != NULL) {
-+        if (inl == 0) {
-+            if (outl != NULL)
-+                *outl = 0;
-+            return 1;
-+        }
- 
--    if (outsize < inl) {
--        ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
--        return 0;
-+        if (outsize < inl) {
-+            ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
-+            return 0;
-+        }
-     }
- 
-     if (ctx->hw->cipher(ctx, out, in, inl) <= 0)
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index df741fd26aa9e..c9f7b46a6cad2 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -254,8 +254,8 @@ in {
   };
 
   openssl_3 = common {
-    version = "3.0.9";
-    sha256 = "sha256-6xqwR4FHQ2D3fDGKuJ2MWgOrw45j1lpgPKu/GwCh3JA=";
+    version = "3.0.10";
+    sha256 = "sha256-F2HU9bE6ECi5tvPUuOF/6wztyTcPav5h1xk9LNzoMyM=";
     patches = [
       ./3.0/nix-ssl-cert-file.patch
 
@@ -263,9 +263,6 @@ in {
       # This patch disables build-time detection.
       ./3.0/openssl-disable-kernel-detection.patch
 
-      # https://www.openssl.org/news/secadv/20230714.txt
-      ./3.0/CVE-2023-2975.patch
-
       (if stdenv.hostPlatform.isDarwin
        then ./use-etc-ssl-certs-darwin.patch
        else ./use-etc-ssl-certs.patch)

From 9a424242d7db53b835e34dee4b8e8c20ec0bd3e5 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 17 Jun 2023 00:58:21 +1000
Subject: [PATCH 035/154] go_1_21: init at 1.21rc3

---
 pkgs/development/compilers/go/1.21.nix        | 182 ++++++++++++++++++
 .../go/go_no_vendor_checks-1.21.patch         |  23 +++
 pkgs/top-level/all-packages.nix               |  11 ++
 3 files changed, 216 insertions(+)
 create mode 100644 pkgs/development/compilers/go/1.21.nix
 create mode 100644 pkgs/development/compilers/go/go_no_vendor_checks-1.21.patch

diff --git a/pkgs/development/compilers/go/1.21.nix b/pkgs/development/compilers/go/1.21.nix
new file mode 100644
index 0000000000000..faf9920f719dd
--- /dev/null
+++ b/pkgs/development/compilers/go/1.21.nix
@@ -0,0 +1,182 @@
+{ lib
+, stdenv
+, fetchurl
+, tzdata
+, substituteAll
+, iana-etc
+, Security
+, Foundation
+, xcbuild
+, mailcap
+, buildPackages
+, pkgsBuildTarget
+, threadsCross
+, testers
+, skopeo
+, buildGo121Module
+}:
+
+let
+  useGccGoBootstrap = stdenv.buildPlatform.isMusl || stdenv.buildPlatform.isRiscV;
+  goBootstrap = if useGccGoBootstrap then buildPackages.gccgo12 else buildPackages.callPackage ./bootstrap117.nix { };
+
+  skopeoTest = skopeo.override { buildGoModule = buildGo121Module; };
+
+  goarch = platform: {
+    "aarch64" = "arm64";
+    "arm" = "arm";
+    "armv5tel" = "arm";
+    "armv6l" = "arm";
+    "armv7l" = "arm";
+    "i686" = "386";
+    "mips" = "mips";
+    "mips64el" = "mips64le";
+    "mipsel" = "mipsle";
+    "powerpc64le" = "ppc64le";
+    "riscv64" = "riscv64";
+    "s390x" = "s390x";
+    "x86_64" = "amd64";
+  }.${platform.parsed.cpu.name} or (throw "Unsupported system: ${platform.parsed.cpu.name}");
+
+  # We need a target compiler which is still runnable at build time,
+  # to handle the cross-building case where build != host == target
+  targetCC = pkgsBuildTarget.targetPackages.stdenv.cc;
+
+  isCross = stdenv.buildPlatform != stdenv.targetPlatform;
+in
+stdenv.mkDerivation rec {
+  pname = "go";
+  version = "1.21rc3";
+
+  src = fetchurl {
+    url = "https://go.dev/dl/go${version}.src.tar.gz";
+    hash = "sha256-nelqLxUZapxpy5qxIsnCquzKMOyUSMqnFUPq6xnKkas=";
+  };
+
+  strictDeps = true;
+  buildInputs = [ ]
+    ++ lib.optionals stdenv.isLinux [ stdenv.cc.libc.out ]
+    ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
+
+  depsTargetTargetPropagated = lib.optionals stdenv.targetPlatform.isDarwin [ Foundation Security xcbuild ];
+
+  depsBuildTarget = lib.optional isCross targetCC;
+
+  depsTargetTarget = lib.optional stdenv.targetPlatform.isWindows threadsCross.package;
+
+  postPatch = ''
+    patchShebangs .
+  '';
+
+  patches = [
+    (substituteAll {
+      src = ./iana-etc-1.17.patch;
+      iana = iana-etc;
+    })
+    # Patch the mimetype database location which is missing on NixOS.
+    # but also allow static binaries built with NixOS to run outside nix
+    (substituteAll {
+      src = ./mailcap-1.17.patch;
+      inherit mailcap;
+    })
+    # prepend the nix path to the zoneinfo files but also leave the original value for static binaries
+    # that run outside a nix server
+    (substituteAll {
+      src = ./tzdata-1.19.patch;
+      inherit tzdata;
+    })
+    ./remove-tools-1.11.patch
+    ./go_no_vendor_checks-1.21.patch
+  ];
+
+  GOOS = stdenv.targetPlatform.parsed.kernel.name;
+  GOARCH = goarch stdenv.targetPlatform;
+  # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
+  # Go will nevertheless build a for host system that we will copy over in
+  # the install phase.
+  GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
+  GOHOSTARCH = goarch stdenv.buildPlatform;
+
+  # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
+  # to be different from CC/CXX
+  CC_FOR_TARGET =
+    if isCross then
+      "${targetCC}/bin/${targetCC.targetPrefix}cc"
+    else
+      null;
+  CXX_FOR_TARGET =
+    if isCross then
+      "${targetCC}/bin/${targetCC.targetPrefix}c++"
+    else
+      null;
+
+  GOARM = toString (lib.intersectLists [ (stdenv.hostPlatform.parsed.cpu.version or "") ] [ "5" "6" "7" ]);
+  GO386 = "softfloat"; # from Arch: don't assume sse2 on i686
+  CGO_ENABLED = 1;
+
+  GOROOT_BOOTSTRAP = if useGccGoBootstrap then goBootstrap else "${goBootstrap}/share/go";
+
+  buildPhase = ''
+    runHook preBuild
+    export GOCACHE=$TMPDIR/go-cache
+    # this is compiled into the binary
+    export GOROOT_FINAL=$out/share/go
+
+    export PATH=$(pwd)/bin:$PATH
+
+    ${lib.optionalString isCross ''
+    # Independent from host/target, CC should produce code for the building system.
+    # We only set it when cross-compiling.
+    export CC=${buildPackages.stdenv.cc}/bin/cc
+    ''}
+    ulimit -a
+
+    pushd src
+    ./make.bash
+    popd
+    runHook postBuild
+  '';
+
+  preInstall = ''
+    # Contains the wrong perl shebang when cross compiling,
+    # since it is not used for anything we can deleted as well.
+    rm src/regexp/syntax/make_perl_groups.pl
+  '' + (if (stdenv.buildPlatform.system != stdenv.hostPlatform.system) then ''
+    mv bin/*_*/* bin
+    rmdir bin/*_*
+    ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
+      rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
+    ''}
+  '' else lib.optionalString (stdenv.hostPlatform.system != stdenv.targetPlatform.system) ''
+    rm -rf bin/*_*
+    ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
+      rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
+    ''}
+  '');
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $GOROOT_FINAL
+    cp -a bin pkg src lib misc api doc $GOROOT_FINAL
+    ln -s $GOROOT_FINAL/bin $out/bin
+    runHook postInstall
+  '';
+
+  disallowedReferences = [ goBootstrap ];
+
+  passthru = {
+    inherit goBootstrap skopeoTest;
+    tests = {
+      skopeo = testers.testVersion { package = skopeoTest; };
+    };
+  };
+
+  meta = with lib; {
+    changelog = "https://go.dev/doc/devel/release#go${lib.versions.majorMinor version}";
+    description = "The Go Programming language";
+    homepage = "https://go.dev/";
+    license = licenses.bsd3;
+    maintainers = teams.golang.members;
+    platforms = platforms.darwin ++ platforms.linux;
+  };
+}
diff --git a/pkgs/development/compilers/go/go_no_vendor_checks-1.21.patch b/pkgs/development/compilers/go/go_no_vendor_checks-1.21.patch
new file mode 100644
index 0000000000000..1adbf46398c5c
--- /dev/null
+++ b/pkgs/development/compilers/go/go_no_vendor_checks-1.21.patch
@@ -0,0 +1,23 @@
+Starting from go1.14, go verifes that vendor/modules.txt matches the requirements
+and replacements listed in the main module go.mod file, and it is a hard failure if
+vendor/modules.txt is missing.
+
+Relax module consistency checks and switch back to pre go1.14 behaviour if
+vendor/modules.txt is missing regardless of go version requirement in go.mod.
+
+This has been ported from FreeBSD: https://reviews.freebsd.org/D24122
+See https://github.com/golang/go/issues/37948 for discussion.
+
+diff --git a/src/cmd/go/internal/modload/vendor.go b/src/cmd/go/internal/modload/vendor.go
+index ffc79bb93f..2d0311975d 100644
+--- a/src/cmd/go/internal/modload/vendor.go
++++ b/src/cmd/go/internal/modload/vendor.go
+@@ -144,7 +144,7 @@ func checkVendorConsistency(index *modFileIndex, modFile *modfile.File) {
+ 	readVendorList(MainModules.mustGetSingleMainModule())
+
+ 	pre114 := false
+-	if gover.Compare(index.goVersion, "1.14") < 0 {
++	if gover.Compare(index.goVersion, "1.14") < 0 || (os.Getenv("GO_NO_VENDOR_CHECKS") == "1" && len(vendorMeta) == 0) {
+ 		// Go versions before 1.14 did not include enough information in
+ 		// vendor/modules.txt to check for consistency.
+ 		// If we know that we're on an earlier version, relax the consistency check.
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2018475b58c87..fd4e7c3daf591 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -25584,6 +25584,17 @@ with pkgs;
     go = buildPackages.go_1_20;
   };
 
+  # requires a newer Apple SDK
+  go_1_21 = darwin.apple_sdk_11_0.callPackage ../development/compilers/go/1.21.nix {
+    inherit (darwin.apple_sdk_11_0.frameworks) Foundation Security;
+  };
+  buildGo121Module = darwin.apple_sdk_11_0.callPackage ../build-support/go/module.nix {
+    go = buildPackages.go_1_21;
+  };
+  buildGo121Package = darwin.apple_sdk_11_0.callPackage ../build-support/go/package.nix {
+    go = buildPackages.go_1_21;
+  };
+
   go2nix = callPackage ../development/tools/go2nix { };
 
   leaps = callPackage ../development/tools/leaps { };

From 41ccfa322e0f2e6719f805c73384f9ae4f542107 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sun, 2 Jul 2023 11:25:47 +1000
Subject: [PATCH 036/154] buildGoModule: refactor GO111MODULE

---
 pkgs/build-support/go/module.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index 6c2284a7a98de..b27a22d6702bb 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -52,6 +52,8 @@ assert (args' ? vendorHash && args' ? vendorSha256) -> throw "both `vendorHash`
 let
   args = removeAttrs args' [ "overrideModAttrs" "vendorSha256" "vendorHash" ];
 
+  GO111MODULE = "on";
+
   goModules = if (vendorHash == null) then "" else
   (stdenv.mkDerivation {
     name = "${name}-go-modules";
@@ -60,6 +62,7 @@ let
 
     inherit (args) src;
     inherit (go) GOOS GOARCH;
+    inherit GO111MODULE;
 
     # The following inheritence behavior is not trivial to expect, and some may
     # argue it's not ideal. Changing it may break vendor hashes in Nixpkgs and
@@ -73,8 +76,6 @@ let
     postBuild = args.modPostBuild or "";
     sourceRoot = args.sourceRoot or "";
 
-    GO111MODULE = "on";
-
     impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
       "GIT_PROXY_COMMAND"
       "SOCKS_SERVER"
@@ -149,9 +150,8 @@ let
 
     inherit (go) GOOS GOARCH;
 
-    GO111MODULE = "on";
     GOFLAGS = lib.optionals (!proxyVendor) [ "-mod=vendor" ] ++ lib.optionals (!allowGoReference) [ "-trimpath" ];
-    inherit CGO_ENABLED enableParallelBuilding;
+    inherit CGO_ENABLED enableParallelBuilding GO111MODULE;
 
     configurePhase = args.configurePhase or (''
       runHook preConfigure

From 86cd7e0948fd14e1a0dc3356132d666c60fc2bbd Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sun, 2 Jul 2023 11:26:43 +1000
Subject: [PATCH 037/154] buildGo{Module,Package}: set GOTOOLCHAIN to local

prevent go from downloading another toolchain
---
 pkgs/build-support/go/module.nix  | 5 +++--
 pkgs/build-support/go/package.nix | 1 +
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index b27a22d6702bb..09b43063fb96a 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -53,6 +53,7 @@ let
   args = removeAttrs args' [ "overrideModAttrs" "vendorSha256" "vendorHash" ];
 
   GO111MODULE = "on";
+  GOTOOLCHAIN = "local";
 
   goModules = if (vendorHash == null) then "" else
   (stdenv.mkDerivation {
@@ -62,7 +63,7 @@ let
 
     inherit (args) src;
     inherit (go) GOOS GOARCH;
-    inherit GO111MODULE;
+    inherit GO111MODULE GOTOOLCHAIN;
 
     # The following inheritence behavior is not trivial to expect, and some may
     # argue it's not ideal. Changing it may break vendor hashes in Nixpkgs and
@@ -151,7 +152,7 @@ let
     inherit (go) GOOS GOARCH;
 
     GOFLAGS = lib.optionals (!proxyVendor) [ "-mod=vendor" ] ++ lib.optionals (!allowGoReference) [ "-trimpath" ];
-    inherit CGO_ENABLED enableParallelBuilding GO111MODULE;
+    inherit CGO_ENABLED enableParallelBuilding GO111MODULE GOTOOLCHAIN;
 
     configurePhase = args.configurePhase or (''
       runHook preConfigure
diff --git a/pkgs/build-support/go/package.nix b/pkgs/build-support/go/package.nix
index b4cb264d9f242..7e099b76f0b76 100644
--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@@ -86,6 +86,7 @@ let
     inherit CGO_ENABLED enableParallelBuilding;
 
     GO111MODULE = "off";
+    GOTOOLCHAIN = "local";
     GOFLAGS = lib.optionals (!allowGoReference) [ "-trimpath" ];
 
     GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);

From 3392d56b728983d5437cf50b0872515c24b87a05 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sun, 2 Jul 2023 11:30:48 +1000
Subject: [PATCH 038/154] buildGoModule: set GOPROXY to go default

---
 pkgs/build-support/go/module.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index 09b43063fb96a..586af56bd98f8 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -87,6 +87,9 @@ let
       runHook preConfigure
       export GOCACHE=$TMPDIR/go-cache
       export GOPATH="$TMPDIR/go"
+      # fixes 'GOPROXY list is not the empty string, but contains no entries'
+      # "https://proxy.golang.org,direct" is the go default
+      export GOPROXY="''${GOPROXY:-"https://proxy.golang.org,direct"}" # respect impureEnvVars
       cd "${modRoot}"
       runHook postConfigure
     '';

From 8e912feb2939866ef68d57fc00bab73b5f84f7c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Simon=20=C5=BDlender?= <pub.git@zlender.si>
Date: Sat, 8 Jul 2023 11:44:20 +0200
Subject: [PATCH 039/154] codesign_allocate: reference cctools

---
 pkgs/build-support/writers/scripts.nix             |  7 +------
 .../darwin/signing-utils/post-link-sign-hook.nix   | 13 +++++++++++++
 pkgs/stdenv/darwin/default.nix                     |  4 ++++
 pkgs/top-level/darwin-packages.nix                 | 14 ++------------
 4 files changed, 20 insertions(+), 18 deletions(-)
 create mode 100644 pkgs/os-specific/darwin/signing-utils/post-link-sign-hook.nix

diff --git a/pkgs/build-support/writers/scripts.nix b/pkgs/build-support/writers/scripts.nix
index 7fc47fbcdf94d..a5b24abf0f2fd 100644
--- a/pkgs/build-support/writers/scripts.nix
+++ b/pkgs/build-support/writers/scripts.nix
@@ -79,16 +79,11 @@ rec {
     let
       name = last (builtins.split "/" nameOrPath);
     in
-    pkgs.runCommand name ((if (types.str.check content) then {
+    pkgs.runCommand name (if (types.str.check content) then {
       inherit content;
       passAsFile = [ "content" ];
     } else {
       contentPath = content;
-    }) // lib.optionalAttrs (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) {
-      # post-link-hook expects codesign_allocate to be in PATH
-      # https://github.com/NixOS/nixpkgs/issues/154203
-      # https://github.com/NixOS/nixpkgs/issues/148189
-      nativeBuildInputs = [ stdenv.cc.bintools ];
     }) ''
       ${compileScript}
       ${lib.optionalString strip
diff --git a/pkgs/os-specific/darwin/signing-utils/post-link-sign-hook.nix b/pkgs/os-specific/darwin/signing-utils/post-link-sign-hook.nix
new file mode 100644
index 0000000000000..13595e3771a7a
--- /dev/null
+++ b/pkgs/os-specific/darwin/signing-utils/post-link-sign-hook.nix
@@ -0,0 +1,13 @@
+{ writeTextFile, cctools, sigtool }:
+
+writeTextFile {
+  name = "post-link-sign-hook";
+  executable = true;
+
+  text = ''
+    if [ "$linkerOutput" != "/dev/null" ]; then
+      CODESIGN_ALLOCATE=${cctools}/bin/${cctools.targetPrefix}codesign_allocate \
+        ${sigtool}/bin/codesign -f -s - "$linkerOutput"
+    fi
+  '';
+}
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 418cc915fdc5e..25a80fd11aa2d 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -464,6 +464,10 @@ in
           inherit (selfDarwin) sigtool;
         };
 
+        postLinkSignHook = prevStage.darwin.postLinkSignHook.override {
+          inherit (selfDarwin) sigtool;
+        };
+
         binutils = superDarwin.binutils.override {
           inherit (self) coreutils;
           inherit (selfDarwin) postLinkSignHook signingUtils;
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index ef4240955b9c6..ee962d3667118 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -133,20 +133,10 @@ impure-cmds // appleSourcePackages // chooseLibs // {
 
   sigtool = callPackage ../os-specific/darwin/sigtool { };
 
-  postLinkSignHook = pkgs.writeTextFile {
-    name = "post-link-sign-hook";
-    executable = true;
-
-    text = ''
-      if [ "$linkerOutput" != "/dev/null" ]; then
-        CODESIGN_ALLOCATE=${targetPrefix}codesign_allocate \
-          ${self.sigtool}/bin/codesign -f -s - "$linkerOutput"
-      fi
-    '';
-  };
-
   signingUtils = callPackage ../os-specific/darwin/signing-utils { };
 
+  postLinkSignHook = callPackage ../os-specific/darwin/signing-utils/post-link-sign-hook.nix { };
+
   autoSignDarwinBinariesHook = pkgs.makeSetupHook {
     name = "auto-sign-darwin-binaries-hook";
     propagatedBuildInputs = [ self.signingUtils ];

From 4b428f7689e27048b9a13df22a0c7fd7975cfb8e Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Wed, 2 Aug 2023 09:17:37 +1000
Subject: [PATCH 040/154] go_1_20: 1.20.6 -> 1.20.7

Changelog: https://go.dev/doc/devel/release#go1.20
---
 pkgs/development/compilers/go/1.20.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.20.nix b/pkgs/development/compilers/go/1.20.nix
index 18fa8db98792e..bd226f32157a9 100644
--- a/pkgs/development/compilers/go/1.20.nix
+++ b/pkgs/development/compilers/go/1.20.nix
@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.20.6";
+  version = "1.20.7";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    hash = "sha256-Yu5bxvtVuLro9wXgy434bWRTYmtOz5MnnihnCS4Lf3A=";
+    hash = "sha256-LF7pyeweczsNu8K9/tP2IwblHYFyvzj09OVCsnUg9Zc=";
   };
 
   strictDeps = true;

From c407e3cbbaaba05db64c8e1ec929c75cfa4eba50 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Tue, 11 Jul 2023 10:33:43 -0600
Subject: [PATCH 041/154] zip: fix build with clang 16

Fix implicit declarations of `memset` and `open/closedir` resulting in
incorrect feature detection and conflicts with libc headers.
---
 pkgs/tools/archivers/zip/default.nix          | 11 ++++++++--
 .../zip/fix-implicit-declarations.patch       | 21 +++++++++++++++++++
 .../archivers/zip/fix-memset-detection.patch  | 15 +++++++++++++
 3 files changed, 45 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/tools/archivers/zip/fix-implicit-declarations.patch
 create mode 100644 pkgs/tools/archivers/zip/fix-memset-detection.patch

diff --git a/pkgs/tools/archivers/zip/default.nix b/pkgs/tools/archivers/zip/default.nix
index 82329537251e8..75a7c81f3276c 100644
--- a/pkgs/tools/archivers/zip/default.nix
+++ b/pkgs/tools/archivers/zip/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     ];
     sha256 = "0sb3h3067pzf3a7mlxn1hikpcjrsvycjcnj9hl9b1c3ykcgvps7h";
   };
-  patchPhase = ''
+  prePatch = ''
     substituteInPlace unix/Makefile --replace 'CC = cc' ""
   '';
 
@@ -26,7 +26,14 @@ stdenv.mkDerivation rec {
     "INSTALL=cp"
   ];
 
-  patches = lib.optionals (enableNLS && !stdenv.isCygwin) [ ./natspec-gentoo.patch.bz2 ];
+  patches = [
+    # Trying to use `memset` without declaring it is flagged as an error with clang 16, causing
+    # the `configure` script to incorrectly define `ZMEM`. That causes the build to fail due to
+    # incompatible redeclarations of `memset`, `memcpy`, and `memcmp` in `zip.h`.
+    ./fix-memset-detection.patch
+    # Implicit declaration of `closedir` and `opendir` cause dirent detection to fail with clang 16.
+    ./fix-implicit-declarations.patch
+  ] ++ lib.optionals (enableNLS && !stdenv.isCygwin) [ ./natspec-gentoo.patch.bz2 ];
 
   buildInputs = lib.optional enableNLS libnatspec
     ++ lib.optional stdenv.isCygwin libiconv;
diff --git a/pkgs/tools/archivers/zip/fix-implicit-declarations.patch b/pkgs/tools/archivers/zip/fix-implicit-declarations.patch
new file mode 100644
index 0000000000000..df19bf1722f93
--- /dev/null
+++ b/pkgs/tools/archivers/zip/fix-implicit-declarations.patch
@@ -0,0 +1,21 @@
+--- a/unix/configure	2009-04-16 15:25:12.000000000 -0400
++++ b/unix/configure	2023-05-30 15:18:33.670321348 -0400
+@@ -408,7 +408,7 @@
+ echo Check for errno declaration
+ cat > conftest.c << _EOF_
+ #include <errno.h>
+-main()
++int main()
+ {
+   errno = 0;
+   return 0;
+@@ -419,6 +419,8 @@
+ 
+ echo Check for directory libraries
+ cat > conftest.c << _EOF_
++#include <sys/types.h>
++#include <dirent.h>
+ int main() { return closedir(opendir(".")); }
+ _EOF_
+ 
+
diff --git a/pkgs/tools/archivers/zip/fix-memset-detection.patch b/pkgs/tools/archivers/zip/fix-memset-detection.patch
new file mode 100644
index 0000000000000..55bda33a25730
--- /dev/null
+++ b/pkgs/tools/archivers/zip/fix-memset-detection.patch
@@ -0,0 +1,15 @@
+diff -ur a/unix/configure b/unix/configure
+--- a/unix/configure	2008-06-19 21:32:20.000000000 -0600
++++ b/unix/configure	2023-07-11 10:02:57.809867694 -0600
+@@ -519,7 +519,10 @@
+ 
+ 
+ echo Check for memset
+-echo "int main(){ char k; memset(&k,0,0); return 0; }" > conftest.c
++cat > conftest.c << _EOF_
++#include <string.h>
++int main(){ char k; memset(&k,0,0); return 0; }
++_EOF_
+ $CC -o conftest conftest.c >/dev/null 2>/dev/null
+ [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DZMEM"
+ 

From 644f2a109a31eb0d745b41f96aa08987e1bde9ad Mon Sep 17 00:00:00 2001
From: Henri Rosten <henri.rosten@unikie.com>
Date: Wed, 2 Aug 2023 13:49:28 +0300
Subject: [PATCH 042/154] librsvg: 2.56.2 -> 2.56.3

Signed-off-by: Henri Rosten <henri.rosten@unikie.com>
---
 pkgs/development/libraries/librsvg/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 6542fdfb14fea..6419f5a595786 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -32,7 +32,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "librsvg";
-  version = "2.56.2";
+  version = "2.56.3";
 
   outputs = [ "out" "dev" ] ++ lib.optionals withIntrospection [
     "devdoc"
@@ -40,13 +40,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/librsvg/${lib.versions.majorMinor finalAttrs.version}/librsvg-${finalAttrs.version}.tar.xz";
-    sha256 = "PsPE2Pc+C6S5EwAmlp6DccCStzQpjTbi/bPrSvzsEgA=";
+    hash = "sha256-WjKASKAtAUZFzSf2EUD04LESgPssfyohhk/gxZrBzog=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit (finalAttrs) src;
     name = "librsvg-deps-${finalAttrs.version}";
-    hash = "sha256-GIEpZ5YMvmYQLcaLXseXQ6gIF7ICtUKq28JCVJ3PEYk=";
+    hash = "sha256-s7eNMSdajr2VhB/BPVUFftHhHKCqpR9sTfxfWwag1mI=";
     # TODO: move this to fetchCargoTarball
     dontConfigure = true;
   };

From c2e7e06037377a0efbe46c72416e053f5594a2e9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 2 Aug 2023 16:47:34 +0000
Subject: [PATCH 043/154] umockdev: 0.17.17 -> 0.17.18

---
 pkgs/development/libraries/umockdev/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/umockdev/default.nix b/pkgs/development/libraries/umockdev/default.nix
index cb1a8dccffd18..1cae2c62b33c0 100644
--- a/pkgs/development/libraries/umockdev/default.nix
+++ b/pkgs/development/libraries/umockdev/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "umockdev";
-  version = "0.17.17";
+  version = "0.17.18";
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "https://github.com/martinpitt/umockdev/releases/download/${finalAttrs.version}/umockdev-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-IOYhseRYsyADz+qZc5tngkuGZShUqLzjPiYSTjR/32w=";
+    sha256 = "sha256-RmrT4McV5W9Q6mqWUWWCPQc6hBN6y4oeObZlc2SKmF8=";
   };
 
   patches = [

From 7197b9f03beca59576cdaddc2c0de8d0161ccf85 Mon Sep 17 00:00:00 2001
From: Yureka <yuka@yuka.dev>
Date: Wed, 2 Aug 2023 21:02:33 +0200
Subject: [PATCH 044/154] glibcLocales: fix extraNativeBuildInputs definition
 (#246537)

---
 pkgs/development/libraries/glibc/locales.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/glibc/locales.nix b/pkgs/development/libraries/glibc/locales.nix
index 86d6d1438b2dc..6a33464c672a5 100644
--- a/pkgs/development/libraries/glibc/locales.nix
+++ b/pkgs/development/libraries/glibc/locales.nix
@@ -12,14 +12,13 @@
 
 (callPackage ./common.nix { inherit stdenv; } {
   pname = "glibc-locales";
+  extraNativeBuildInputs = [ glibc ];
 }).overrideAttrs(finalAttrs: previousAttrs: {
 
   builder = ./locales-builder.sh;
 
   outputs = [ "out" ];
 
-  extraNativeBuildInputs = [ glibc ];
-
   LOCALEDEF_FLAGS = [
     (if stdenv.hostPlatform.isLittleEndian
     then "--little-endian"

From 23275b7891b78451509b88cad7b1f2ccfa2ceb17 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 2 Aug 2023 22:13:33 +0100
Subject: [PATCH 045/154] gmp: 6.2.1 -> 6.3.0

The highlight is loongarch64 support.

Changes: https://gmplib.org/gmp6.3
---
 .../libraries/gmp/6.2.1-CVE-2021-43618.patch  | 19 -------------------
 pkgs/development/libraries/gmp/6.x.nix        |  6 ++----
 2 files changed, 2 insertions(+), 23 deletions(-)
 delete mode 100644 pkgs/development/libraries/gmp/6.2.1-CVE-2021-43618.patch

diff --git a/pkgs/development/libraries/gmp/6.2.1-CVE-2021-43618.patch b/pkgs/development/libraries/gmp/6.2.1-CVE-2021-43618.patch
deleted file mode 100644
index eec8206dba05c..0000000000000
--- a/pkgs/development/libraries/gmp/6.2.1-CVE-2021-43618.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-https://gmplib.org/repo/gmp-6.2/raw-rev/561a9c25298e
-
-diff -r e1fd9db13b47 -r 561a9c25298e mpz/inp_raw.c
---- a/mpz/inp_raw.c	Tue Dec 22 23:49:51 2020 +0100
-+++ b/mpz/inp_raw.c	Thu Oct 21 19:06:49 2021 +0200
-@@ -88,8 +88,11 @@
- 
-   abs_csize = ABS (csize);
- 
-+  if (UNLIKELY (abs_csize > ~(mp_bitcnt_t) 0 / 8))
-+    return 0; /* Bit size overflows */
-+
-   /* round up to a multiple of limbs */
--  abs_xsize = BITS_TO_LIMBS (abs_csize*8);
-+  abs_xsize = BITS_TO_LIMBS ((mp_bitcnt_t) abs_csize * 8);
- 
-   if (abs_xsize != 0)
-     {
-
diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index 7857bfa0e3557..44874246b6ea4 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -13,15 +13,13 @@ let inherit (lib) optional; in
 
 let self = stdenv.mkDerivation rec {
   pname = "gmp${lib.optionalString cxx "-with-cxx"}";
-  version = "6.2.1";
+  version = "6.3.0";
 
   src = fetchurl { # we need to use bz2, others aren't in bootstrapping stdenv
     urls = [ "mirror://gnu/gmp/gmp-${version}.tar.bz2" "ftp://ftp.gmplib.org/pub/gmp-${version}/gmp-${version}.tar.bz2" ];
-    sha256 = "0z2ddfiwgi0xbf65z4fg4hqqzlhv0cc6hdcswf3c6n21xdmk5sga";
+    hash = "sha256-rCghGnz7YJuuLiyNYFjWbI/pZDT3QM9v4uR7AA0cIMs=";
   };
 
-  patches = [ ./6.2.1-CVE-2021-43618.patch ];
-
   #outputs TODO: split $cxx due to libstdc++ dependency
   # maybe let ghc use a version with *.so shared with rest of nixpkgs and *.a added
   # - see #5855 for related discussion

From 95c1cbdae9211fb92893939bd5824e523223bd5b Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 3 Aug 2023 00:14:13 +1000
Subject: [PATCH 046/154] go_1_21: 1.21rc3 -> 1.21rc4

Changelog: https://go.dev/doc/devel/release#go1.21
---
 pkgs/development/compilers/go/1.21.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.21.nix b/pkgs/development/compilers/go/1.21.nix
index faf9920f719dd..cdd91ab1e6320 100644
--- a/pkgs/development/compilers/go/1.21.nix
+++ b/pkgs/development/compilers/go/1.21.nix
@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.21rc3";
+  version = "1.21rc4";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    hash = "sha256-nelqLxUZapxpy5qxIsnCquzKMOyUSMqnFUPq6xnKkas=";
+    hash = "sha256-IyTyDxERKuw+XV5CjQRoYaNOT5neCrgqjZFNJrj7Af0=";
   };
 
   strictDeps = true;

From dc2fae9f69a0828c1b23fb41d768f60dede359cb Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 3 Aug 2023 10:06:40 +0100
Subject: [PATCH 047/154] xz: 5.4.3 -> 5.4.4

Changes: https://github.com/tukaani-project/xz/releases/tag/v5.4.4
---
 pkgs/tools/compression/xz/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/compression/xz/default.nix b/pkgs/tools/compression/xz/default.nix
index 44bee00d0842f..adc73d926c905 100644
--- a/pkgs/tools/compression/xz/default.nix
+++ b/pkgs/tools/compression/xz/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xz";
-  version = "5.4.3";
+  version = "5.4.4";
 
   src = fetchurl {
     url = "https://tukaani.org/xz/xz-${version}.tar.bz2";
-    sha256 = "sha256-kkOgRZjXpwwfVnoBQ6JVWBrFxksUD9Vf1cvB4AsOb5A=";
+    sha256 = "sha256-C2/N4aw46QQzolVvUAwGWVC5vNLWAgBu/DNHgr3+YpY=";
   };
 
   strictDeps = true;

From f699824f6e0525ec3873fefa557ee49a18478ed4 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 25 Jul 2023 22:14:59 +0200
Subject: [PATCH 048/154] python310Packages.django: migrate to django_4

3.2 LTS ran out of mainstream support in 2021/12 and we should probably
stay on the latest LTS release, that receives mainstream support.
---
 nixos/doc/manual/release-notes/rl-2311.section.md | 12 ++++++++++++
 pkgs/top-level/python-packages.nix                |  7 +++----
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 80b2066582a37..3d82c4a7beb82 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -158,6 +158,18 @@ The module update takes care of the new config syntax and the data itself (user
 
 ## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals}
 
+- The `django` alias in the python package set was upgraded to Django 4.x.
+  Applications that consume Django should always pin their python environment
+  to a compatible major version, so they can move at their own pace.
+
+  ```nix
+  python = python3.override {
+    packageOverrides = self: super: {
+      django = super.django_3;
+    };
+  };
+  ```
+
 - The `qemu-vm.nix` module by default now identifies block devices via
   persistent names available in `/dev/disk/by-*`. Because the rootDevice is
   identfied by its filesystem label, it needs to be formatted before the VM is
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 83b45cde21b35..cda5a120314ad 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2727,12 +2727,11 @@ self: super: with self; {
 
   distutils_extra = callPackage ../development/python-modules/distutils_extra { };
 
-  django = self.django_3;
-
-  # Current LTS
+  # LTS in extended support phase
   django_3 = callPackage ../development/python-modules/django/3.nix { };
 
-  # Current latest
+  # LTS with mainsteam support
+  django = self.django_4;
   django_4 = callPackage ../development/python-modules/django/4.nix { };
 
   django-admin-datta = callPackage ../development/python-modules/django-admin-datta { };

From 27b8b774748938d727895fb8b3d3a534707b545a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 25 Jul 2023 23:07:48 +0200
Subject: [PATCH 049/154] python310Packages.django-scim2: 0.17.3 -> 0.19.0

https://github.com/15five/django-scim2/blob/refs/tags/0.19.0/CHANGES.txt
---
 .../python-modules/django-scim2/default.nix   | 31 ++++++++++++-------
 1 file changed, 20 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/python-modules/django-scim2/default.nix b/pkgs/development/python-modules/django-scim2/default.nix
index 90db4fe633d38..536d851a4099f 100644
--- a/pkgs/development/python-modules/django-scim2/default.nix
+++ b/pkgs/development/python-modules/django-scim2/default.nix
@@ -2,37 +2,43 @@
 , buildPythonPackage
 , fetchFromGitHub
 
+# build-system
+, poetry-core
+
 # propagates
 , django
-, python-dateutil
 , scim2-filter-parser
-, gssapi
-, python-ldap
-, sssd
 
 # tests
 , mock
+, pytest-django
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "django-scim2";
-  version = "0.17.3";
-  format = "setuptools";
+  version = "0.19.0";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "15five";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-5zdGPpjooiFoj+2OoglXhhKsPFB/KOHvrZWZd+1nZqU=";
+    hash = "sha256-larDh4f9/xVr11/n/WfkJ2Tx45DMQqyK3ZzkWAvzeig=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "poetry.masonry.api" "poetry.core.masonry.api"
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   propagatedBuildInputs = [
     django
-    python-dateutil
     scim2-filter-parser
-    gssapi
-    python-ldap
-    sssd
   ];
 
   pythonImportsCheck = [
@@ -41,9 +47,12 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     mock
+    pytest-django
+    pytestCheckHook
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/15five/django-scim2/blob/${src.rev}/CHANGES.txt";
     description = "A SCIM 2.0 Service Provider Implementation (for Django)";
     homepage = "https://github.com/15five/django-scim2";
     license = licenses.mit;

From 79105aad78e10f7bffc0cdace35ca5b0d6bdf324 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 00:08:53 +0200
Subject: [PATCH 050/154] python310Packages.django-cachalot: 2.5.3 -> 2.6.1

https://github.com/noripyt/django-cachalot/blob/v2.6.1/CHANGELOG.rst
---
 pkgs/development/python-modules/django-cachalot/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django-cachalot/default.nix b/pkgs/development/python-modules/django-cachalot/default.nix
index f52a3aa46e62a..33d9e484f1146 100644
--- a/pkgs/development/python-modules/django-cachalot/default.nix
+++ b/pkgs/development/python-modules/django-cachalot/default.nix
@@ -6,18 +6,19 @@
 , psycopg2
 , beautifulsoup4
 , python
+, pytz
 }:
 
 buildPythonPackage rec {
   pname = "django-cachalot";
-  version = "2.5.3";
+  version = "2.6.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "noripyt";
     repo = "django-cachalot";
     rev = "v${version}";
-    hash = "sha256-ayAN+PgK3aIpt4R8aeC6c6mRGTnfObycmkoXPTjx4WI=";
+    hash = "sha256-bCiIZkh02+7xL6aSWE9by+4dFDsanr0iXuO9QKpLOjw=";
   };
 
   patches = [
@@ -34,6 +35,7 @@ buildPythonPackage rec {
     beautifulsoup4
     django-debug-toolbar
     psycopg2
+    pytz
   ];
 
   pythonImportsCheck = [ "cachalot" ];

From 0116a04d7b64299bf64dfdc50afb3d58ebb2bbfa Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 00:27:44 +0200
Subject: [PATCH 051/154] python310Packages.django-mailman: fix build

---
 .../django-mailman3/default.nix               | 41 +++++++++++++++----
 1 file changed, 32 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/django-mailman3/default.nix b/pkgs/development/python-modules/django-mailman3/default.nix
index 32bfe947c82f8..6639257740bc9 100644
--- a/pkgs/development/python-modules/django-mailman3/default.nix
+++ b/pkgs/development/python-modules/django-mailman3/default.nix
@@ -1,27 +1,50 @@
-{ lib, buildPythonPackage, fetchPypi, django-gravatar2, django-compressor
-, django-allauth, mailmanclient, django, mock
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# propagates
+, django-gravatar2
+, django-allauth
+, mailmanclient
+, pytz
+
+# tests
+, django
+, pytest-django
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "django-mailman3";
   version = "1.3.9";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-GpI1W0O9aJpLF/mcS23ktJDZsP69S2zQy7drOiWBnTM=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace 'django>=3.2,<4.2' 'django>=3.2,<4.3'
+  '';
+
   propagatedBuildInputs = [
-    django-gravatar2 django-compressor django-allauth mailmanclient
+    django-allauth
+    django-gravatar2
+    mailmanclient
+    pytz
   ];
-  nativeCheckInputs = [ django mock ];
 
-  checkPhase = ''
-    cd $NIX_BUILD_TOP/$sourceRoot
-    PYTHONPATH=.:$PYTHONPATH django-admin.py test --settings=django_mailman3.tests.settings_test
-  '';
+  nativeCheckInputs = [
+    django
+    pytest-django
+    pytestCheckHook
+  ];
 
-  pythonImportsCheck = [ "django_mailman3" ];
+  pythonImportsCheck = [
+    "django_mailman3"
+  ];
 
   meta = with lib; {
     description = "Django library for Mailman UIs";

From b528b277579e2a9a2e99a58725e967960d80eca1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 01:12:37 +0200
Subject: [PATCH 052/154] python310Packages.django-compat: drop

Not useful any longer and started failing to build with django 4.
---
 .../python-modules/django-compat/default.nix  | 42 --------------
 .../django-compat/fix-tests.diff              | 56 -------------------
 .../python-modules/django-hijack/default.nix  |  2 -
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 -
 5 files changed, 1 insertion(+), 102 deletions(-)
 delete mode 100644 pkgs/development/python-modules/django-compat/default.nix
 delete mode 100644 pkgs/development/python-modules/django-compat/fix-tests.diff

diff --git a/pkgs/development/python-modules/django-compat/default.nix b/pkgs/development/python-modules/django-compat/default.nix
deleted file mode 100644
index d33a4be2817f1..0000000000000
--- a/pkgs/development/python-modules/django-compat/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib, buildPythonPackage, fetchFromGitHub, python,
-  django, six
-}:
-
-buildPythonPackage rec {
-  pname = "django-compat";
-  version = "1.0.15";
-
-  # the pypi packages don't include everything required for the tests
-  src = fetchFromGitHub {
-    owner = "arteria";
-    repo = "django-compat";
-    rev = "v${version}";
-    sha256 = "1pr6v38ahrsvxlgmcx69s4b5q5082f44gzi4h3c32sccdc4pwqxp";
-  };
-
-  patches = [
-    ./fix-tests.diff
-  ];
-
-  checkPhase = ''
-    runHook preCheck
-
-    # to convince the tests to run against the installed package, not the source directory, we extract the
-    # tests directory from it then dispose of the actual source
-    mv compat/tests .
-    rm -r compat
-    substituteInPlace runtests.py --replace compat.tests tests
-    ${python.interpreter} runtests.py
-
-    runHook postCheck
-  '';
-
-  propagatedBuildInputs = [ django six ];
-
-  meta = with lib; {
-    description = "Forward and backwards compatibility layer for Django 1.4, 1.7, 1.8, 1.9, 1.10 and 1.11";
-    homepage = "https://github.com/arteria/django-compat";
-    license = licenses.mit;
-    maintainers = with maintainers; [ ris ];
-  };
-}
diff --git a/pkgs/development/python-modules/django-compat/fix-tests.diff b/pkgs/development/python-modules/django-compat/fix-tests.diff
deleted file mode 100644
index 58165db96a87b..0000000000000
--- a/pkgs/development/python-modules/django-compat/fix-tests.diff
+++ /dev/null
@@ -1,56 +0,0 @@
-diff -ur a/compat/tests/settings.py b/compat/tests/settings.py
---- a/compat/tests/settings.py	2020-03-06 15:32:07.548482597 +0100
-+++ b/compat/tests/settings.py	2020-03-06 22:19:25.422934249 +0100
-@@ -16,11 +16,12 @@
-     'django.contrib.admin',
-     'django.contrib.auth',
-     'django.contrib.contenttypes',
-+    'django.contrib.messages',
-     'compat',
-     'compat.tests.test_app',
- ]
- 
--MIDDLEWARE_CLASSES = (
-+MIDDLEWARE = (
-     'django.contrib.sessions.middleware.SessionMiddleware',
-     'django.middleware.common.CommonMiddleware',
-     'django.middleware.csrf.CsrfViewMiddleware',
-@@ -43,6 +44,7 @@
-                 'django.template.context_processors.i18n',
-                 'django.template.context_processors.tz',
-                 'django.template.context_processors.request',
-+                'django.contrib.messages.context_processors.messages',
-             ],
-             'loaders': [
-                 'django.template.loaders.filesystem.Loader',
-diff -ur a/compat/tests/test_compat.py b/compat/tests/test_compat.py
---- a/compat/tests/test_compat.py	2020-03-06 15:32:07.548482597 +0100
-+++ b/compat/tests/test_compat.py	2020-03-06 15:37:39.202835075 +0100
-@@ -9,7 +9,7 @@
- from django.core.serializers.json import DjangoJSONEncoder
- from django.test import TestCase, SimpleTestCase
- from django.test.client import RequestFactory
--from django.contrib.auth.views import logout
-+from django.contrib.auth.views import auth_logout
- try:
-     from django.urls import NoReverseMatch
- except ImportError:
-@@ -103,7 +103,7 @@
-         Tests that passing a view name to ``resolve_url`` will result in the
-         URL path mapping to that view name.
-         """
--        resolved_url = resolve_url(logout)
-+        resolved_url = resolve_url(auth_logout)
-         self.assertEqual('/accounts/logout/', resolved_url)
- 
-     '''
-diff -ur a/compat/tests/urls.py b/compat/tests/urls.py
---- a/compat/tests/urls.py	2020-03-06 15:32:07.548482597 +0100
-+++ b/compat/tests/urls.py	2020-03-06 15:34:25.962377799 +0100
-@@ -2,5 +2,5 @@
- from django.contrib.auth import views
- 
- urlpatterns = [
--    url(r'^accounts/logout/$', views.logout, name='logout'),
-+    url(r'^accounts/logout/$', views.auth_logout, name='logout'),
- ]
diff --git a/pkgs/development/python-modules/django-hijack/default.nix b/pkgs/development/python-modules/django-hijack/default.nix
index 18ef2e3ace79b..ef77abefeeae0 100644
--- a/pkgs/development/python-modules/django-hijack/default.nix
+++ b/pkgs/development/python-modules/django-hijack/default.nix
@@ -11,7 +11,6 @@
 
 # dependencies
 , django
-, django-compat
 
 # tests
 , pytest-django
@@ -54,7 +53,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     django
-    django-compat
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index a6ef2838bcb68..87ea55ac064ea 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -93,6 +93,7 @@ mapAliases ({
   django_classytags = django-classy-tags; # added 2023-07-25
   django_colorful = django-colorful; # added 2023-07-25
   django_compat = django-compat; # added 2023-07-25
+  django-compat = throw "django-compat has been removed. It provided forward/backport compat for django 1.x, which is long end of life."; # added 2023-07-26
   django_contrib_comments = django-contrib-comments; # added 2023-07-25
   django-discover-runner = throw "django-discover-runner was removed because it is no longer maintained."; # added 2022-11-21
   django_environ = django-environ; # added 2021-12-25
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index cda5a120314ad..b600ade3f23cc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2774,8 +2774,6 @@ self: super: with self; {
 
   django-colorful = callPackage ../development/python-modules/django-colorful { };
 
-  django-compat = callPackage ../development/python-modules/django-compat { };
-
   django-compressor = callPackage ../development/python-modules/django-compressor { };
 
   django-compression-middleware = callPackage ../development/python-modules/django-compression-middleware { };

From 7a56f3863fad43458141dbafff68679a056ad561 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 01:50:51 +0200
Subject: [PATCH 053/154] python310Packages.django-haystack: disable tests on
 django_4

A few failing tests, but disabling individual ones is not straight
forward.
---
 .../django-haystack/default.nix               | 25 ++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/django-haystack/default.nix b/pkgs/development/python-modules/django-haystack/default.nix
index e85d27f907bd3..d9d6fb8ecd6fc 100644
--- a/pkgs/development/python-modules/django-haystack/default.nix
+++ b/pkgs/development/python-modules/django-haystack/default.nix
@@ -4,12 +4,14 @@
 , fetchPypi
 
 # build dependencies
+, setuptools
 , setuptools-scm
 
 # dependencies
 , django
 
 # tests
+, elasticsearch
 , geopy
 , nose
 , pysolr
@@ -21,7 +23,8 @@
 buildPythonPackage rec {
   pname = "django-haystack";
   version = "3.2.1";
-  format = "setuptools";
+  format = "pyproject";
+
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
@@ -35,13 +38,22 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
-  propagatedBuildInputs = [
+  buildInputs = [
     django
   ];
 
+  passthru.optional-dependencies = {
+    elasticsearch = [
+      elasticsearch
+    ];
+  };
+
+  doCheck = lib.versionOlder django.version "4";
+
   nativeCheckInputs = [
     geopy
     nose
@@ -49,7 +61,14 @@ buildPythonPackage rec {
     python-dateutil
     requests
     whoosh
-  ];
+  ]
+  ++ passthru.optional-dependencies.elasticsearch;
+
+  checkPhase = ''
+    runHook preCheck
+    python test_haystack/run_tests.py
+    runHook postCheck
+  '';
 
   meta = with lib; {
     description = "Pluggable search for Django";

From 002f6c08cb5280ee93ad2295d422bd8f79e21e8f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 01:55:30 +0200
Subject: [PATCH 054/154] python310Packages.mezzanine: propagate pytz

Previously propagated by django_3, but not anymore by django_4.
---
 pkgs/development/python-modules/mezzanine/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/mezzanine/default.nix b/pkgs/development/python-modules/mezzanine/default.nix
index 9eda32b4e48a4..46bf44bf8ad90 100644
--- a/pkgs/development/python-modules/mezzanine/default.nix
+++ b/pkgs/development/python-modules/mezzanine/default.nix
@@ -14,6 +14,7 @@
 , pillow
 , pyflakes
 , pythonOlder
+, pytz
 , requests
 , requests-oauthlib
 , tzlocal
@@ -47,6 +48,7 @@ buildPythonPackage rec {
     future
     grappelli_safe
     pillow
+    pytz
     requests
     requests-oauthlib
     tzlocal

From bff5a07ef86c1ac3ff7d83631d94fffa78578d83 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 01:59:37 +0200
Subject: [PATCH 055/154] python310Packages.django-sites: mark broken with
 django_4

Uses API functions deprecated in Django 3.0 and removed in 4.0.
---
 pkgs/development/python-modules/django-sites/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/django-sites/default.nix b/pkgs/development/python-modules/django-sites/default.nix
index 5587014c57403..3a9255daecdf2 100644
--- a/pkgs/development/python-modules/django-sites/default.nix
+++ b/pkgs/development/python-modules/django-sites/default.nix
@@ -37,5 +37,7 @@ buildPythonPackage rec {
     description = "Alternative implementation of django sites framework";
     homepage = "https://github.com/niwinz/django-sites";
     license = lib.licenses.bsd3;
+    # has not been updated for django>=4.0
+    broken = lib.versionAtLeast django.version "4";
   };
 }

From fe50817d1035e24c124ab6578d9080f388c4a784 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 02:08:43 +0200
Subject: [PATCH 056/154] python310Packages.django-modelcluster: disable
 failing test

One failing test with Django 4.2, that I reported upstream.

Also migrate tests to pytest, so I can disable the failing test easily.
---
 .../django-modelcluster/default.nix           | 33 ++++++++++++-------
 1 file changed, 22 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/python-modules/django-modelcluster/default.nix b/pkgs/development/python-modules/django-modelcluster/default.nix
index b7fbc9f2b1796..5ad43dfc9b1f8 100644
--- a/pkgs/development/python-modules/django-modelcluster/default.nix
+++ b/pkgs/development/python-modules/django-modelcluster/default.nix
@@ -1,11 +1,18 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
+
+# dependencies
 , django
-, django-taggit
 , pytz
-, pythonOlder
-, python
+
+# optionals
+, django-taggit
+
+# tests
+, pytest-django
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -17,8 +24,8 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "wagtail";
-    repo = pname;
-    rev = "v${version}";
+    repo = "modelcluster";
+    rev = "refs/tags/v${version}";
     hash = "sha256-p6hvOkPWRVJYLHvwyn9nS05wblikRFmlSYZuLiCcuqc=";
   };
 
@@ -31,13 +38,17 @@ buildPythonPackage rec {
     django-taggit
   ];
 
-  nativeCheckInputs = passthru.optional-dependencies.taggit;
+  env.DJANGO_SETTINGS_MODULE = "tests.settings";
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} ./runtests.py --noinput
-    runHook postCheck
-  '';
+  nativeCheckInputs = [
+    pytest-django
+    pytestCheckHook
+  ] ++ passthru.optional-dependencies.taggit;
+
+  # https://github.com/wagtail/django-modelcluster/issues/173
+  disabledTests = lib.optionals (lib.versionAtLeast django.version "4.2") [
+    "test_formfield_callback"
+  ];
 
   meta = with lib; {
     description = "Django extension to allow working with 'clusters' of models as a single unit, independently of the database";

From ca5c50bcf94e3f9af6f3e3456a5155ffb61bfea0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 02:24:49 +0200
Subject: [PATCH 057/154] python310Packages.drf-nested-routers: fix django4
 compat

by backporting patches, that have not yet made it into a new release.

Move django into buildInputs, because we require consumers to bring
their own django version anyway.

Migrate tests to pytest, because they work very well and are easier to
maintain.
---
 .../drf-nested-routers/default.nix            | 42 ++++++++++++++-----
 1 file changed, 32 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/python-modules/drf-nested-routers/default.nix b/pkgs/development/python-modules/drf-nested-routers/default.nix
index 15676ed304b62..849fe8bb130c4 100644
--- a/pkgs/development/python-modules/drf-nested-routers/default.nix
+++ b/pkgs/development/python-modules/drf-nested-routers/default.nix
@@ -1,33 +1,55 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, setuptools
+, fetchpatch
 , django
 , djangorestframework
-, pytest
-, pytest-cov
+, pytestCheckHook
 , pytest-django
 , ipdb
-, python
 }:
 
 buildPythonPackage rec {
   pname = "drf-nested-routers";
   version = "0.93.4";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "alanjds";
     repo = "drf-nested-routers";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-qlXNDydoQJ9FZB6G7yV/pNmx3BEo+lvRqsfjrvlbdNY=";
   };
 
-  propagatedBuildInputs = [ django djangorestframework setuptools ];
-  nativeCheckInputs = [ pytest pytest-cov pytest-django ipdb ];
+  patches = [
+    # django4 compatibility
+    (fetchpatch {
+      url = "https://github.com/alanjds/drf-nested-routers/commit/59764cc356f7f593422b26845a9dfac0ad196120.patch";
+      hash = "sha256-mq3vLHzQlGl2EReJ5mVVQMMcYgGIVt/T+qi1STtQ0aI=";
+    })
+    (fetchpatch {
+      url = "https://github.com/alanjds/drf-nested-routers/commit/723a5729dd2ffcb66fe315f229789ca454986fa4.patch";
+      hash = "sha256-UCbBjwlidqsJ9vEEWlGzfqqMOr0xuB2TAaUxHsLzFfU=";
+    })
+    (fetchpatch {
+      url = "https://github.com/alanjds/drf-nested-routers/commit/38e49eb73759bc7dcaaa9166169590f5315e1278.patch";
+      hash = "sha256-IW4BLhHHhXDUZqHaXg46qWoQ89pMXv0ZxKjOCTnDcI0=";
+    })
+  ];
 
-  checkPhase = ''
-    ${python.interpreter} runtests.py --nolint
-  '';
+  buildInputs = [
+    django
+  ];
+
+  propagatedBuildInputs = [
+    djangorestframework
+  ];
+
+  nativeCheckInputs = [
+    ipdb
+    pytestCheckHook
+    pytest-django
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/alanjds/drf-nested-routers";

From 008c1402d2f372bc15603edaf5f1ef2a78ed0b14 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 02:51:59 +0200
Subject: [PATCH 058/154] python310Packages.djangorestframework-guardian: mark
 broken with django4

and point people to the guardian2 fork.
---
 .../python-modules/djangorestframework-guardian/default.nix    | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/djangorestframework-guardian/default.nix b/pkgs/development/python-modules/djangorestframework-guardian/default.nix
index fdc6b3184d981..4358a61b3452a 100644
--- a/pkgs/development/python-modules/djangorestframework-guardian/default.nix
+++ b/pkgs/development/python-modules/djangorestframework-guardian/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, django
 , django-guardian
 , djangorestframework
 }:
@@ -37,5 +38,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/rpkilby/django-rest-framework-guardian";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ];
+    # unmaintained, last compatible version is 3.x, use djangorestframework-guardian2 instead
+    broken = lib.versionAtLeast django.version "4";
   };
 }

From a8932746670c00d542e51416bb080b248faecf68 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 26 Jul 2023 03:15:36 +0200
Subject: [PATCH 059/154] python310Packages.django-pattern-library: mark broken
 with django4

---
 .../python-modules/django-pattern-library/default.nix           | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/django-pattern-library/default.nix b/pkgs/development/python-modules/django-pattern-library/default.nix
index 40cc4f64188ab..00b6fe9c978f6 100644
--- a/pkgs/development/python-modules/django-pattern-library/default.nix
+++ b/pkgs/development/python-modules/django-pattern-library/default.nix
@@ -51,5 +51,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/torchbox/django-pattern-library/blob/v${version}/CHANGELOG.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [ sephi ];
+    # https://github.com/torchbox/django-pattern-library/issues/212
+    broken = lib.versionAtLeast django.version "4.2";
   };
 }

From f1bc601c44eb23d1f263ef37918418d9918557e5 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 28 Jul 2023 17:49:13 +0200
Subject: [PATCH 060/154] python310Packages.wagtail: 4.2.2 -> 5.0.2

https://github.com/wagtail/wagtail/blob/v5.0.2/CHANGELOG.txt
---
 pkgs/development/python-modules/wagtail/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/wagtail/default.nix b/pkgs/development/python-modules/wagtail/default.nix
index c01464f27ceb7..54c30dabc7811 100644
--- a/pkgs/development/python-modules/wagtail/default.nix
+++ b/pkgs/development/python-modules/wagtail/default.nix
@@ -24,19 +24,20 @@
 
 buildPythonPackage rec {
   pname = "wagtail";
-  version = "4.2.2";
+  version = "5.0.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-s89gs3H//Dc3k6BLZUC4APyDgiWY9LetWAkI+kXQTf8=";
+    hash = "sha256-3r0h34el2zRF1l/94S7xTjBqJPWtSQFQvtVW8Mjq0rs=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "beautifulsoup4>=4.8,<4.12" "beautifulsoup4>=4.8"
+      --replace "beautifulsoup4>=4.8,<4.12" "beautifulsoup4>=4.8" \
+      --replace "Pillow>=4.0.0,<10.0.0" "Pillow>=9.1.0,<11.0.0"
   '';
 
   propagatedBuildInputs = [

From 87f04f12a469f9da4f34f161314a076a1a2df144 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 28 Jul 2023 17:44:46 +0200
Subject: [PATCH 061/154] python310Packages.willow: 1.4.1 -> 1.5.1

---
 .../python-modules/willow/default.nix           | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/willow/default.nix b/pkgs/development/python-modules/willow/default.nix
index d4d297d68d4d8..f7030f7c874eb 100644
--- a/pkgs/development/python-modules/willow/default.nix
+++ b/pkgs/development/python-modules/willow/default.nix
@@ -2,22 +2,29 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, six
-, pillow
+
+# dependencies
+, filetype
+, defusedxml,
 }:
 
 buildPythonPackage rec {
   pname = "willow";
-  version = "1.4.1";
+  version = "1.5.1";
+  format = "setuptools";
+
   disabled = pythonOlder "2.7";
 
   src = fetchPypi {
     pname = "Willow";
     inherit version;
-    hash = "sha256-Dfj/UoUx4AtI1Av3Ltgb6sHcgvLULlu+1K/wIYvvjA0=";
+    hash = "sha256-t6SQkRATP9seIodZLgZzzCVeAobhzVNCfuaN8ckiDEw=";
   };
 
-  propagatedBuildInputs = [ six pillow ];
+  propagatedBuildInputs = [
+    filetype
+    defusedxml
+  ];
 
   # Test data is not included
   # https://github.com/torchbox/Willow/issues/34

From 7cb5d0503cdcf616f2c0ab09827cf31f82f52837 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 2 Aug 2023 03:55:21 +0200
Subject: [PATCH 062/154] python310Packages.qcodes: disable timing-sensitive
 test

---
 pkgs/development/python-modules/qcodes/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/qcodes/default.nix b/pkgs/development/python-modules/qcodes/default.nix
index db565e11d02df..3dd8342ec1cd2 100644
--- a/pkgs/development/python-modules/qcodes/default.nix
+++ b/pkgs/development/python-modules/qcodes/default.nix
@@ -124,6 +124,11 @@ buildPythonPackage rec {
     "--durations=20"
   ];
 
+  disabledTests = [
+    # timing sensitive
+    "test_access_channels_by_slice"
+  ];
+
   disabledTestPaths = [
     # depends on qcodes-loop, causing a cyclic dependency
     "qcodes/tests/dataset/measurement/test_load_legacy_data.py"

From 84f6a6755a0832ca0e9b22c158a13869f3805132 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 2 Aug 2023 04:35:34 +0200
Subject: [PATCH 063/154] mailmanPackages: pin to django_3

---
 pkgs/servers/mail/mailman/python.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/servers/mail/mailman/python.nix b/pkgs/servers/mail/mailman/python.nix
index 288e48d814e42..dfd8790302fde 100644
--- a/pkgs/servers/mail/mailman/python.nix
+++ b/pkgs/servers/mail/mailman/python.nix
@@ -2,6 +2,8 @@
 
 python3.override {
   packageOverrides = self: super: {
+    django = super.django_3;
+
     # does not find tests
     alembic = super.alembic.overridePythonAttrs (oldAttrs: {
       doCheck = false;

From f4d64ea14978c37a74d5086a8b0bf25fcae65e52 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 2 Aug 2023 04:57:48 +0200
Subject: [PATCH 064/154] baserow: pin django_3

---
 pkgs/servers/baserow/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/servers/baserow/default.nix b/pkgs/servers/baserow/default.nix
index 92007bd6ee441..a91e6ba774dc9 100644
--- a/pkgs/servers/baserow/default.nix
+++ b/pkgs/servers/baserow/default.nix
@@ -29,6 +29,8 @@ let
 
         doCheck = false;
       };
+
+      django = super.django_3;
     };
   };
 in

From dc9e777948aacad8ad054b7306984de7db98819a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 2 Aug 2023 05:25:22 +0200
Subject: [PATCH 065/154] python310Packages.nplusone: mark broken with django_4

---
 pkgs/development/python-modules/nplusone/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/nplusone/default.nix b/pkgs/development/python-modules/nplusone/default.nix
index ecf2255b3593d..5a31394c2d356 100644
--- a/pkgs/development/python-modules/nplusone/default.nix
+++ b/pkgs/development/python-modules/nplusone/default.nix
@@ -1,6 +1,7 @@
 { lib
 , blinker
 , buildPythonPackage
+, django
 , fetchFromGitHub
 , flake8
 , flask-sqlalchemy
@@ -79,5 +80,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/jmcarp/nplusone";
     maintainers = with maintainers; [ cript0nauta ];
     license = licenses.mit;
+    broken = lib.versionAtLeast django.version "4";
   };
 }

From 99dca946e6f8daa0e9626e42f402023db0cf0def Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 3 Aug 2023 03:26:10 +0200
Subject: [PATCH 066/154] privacyidea: pin to django_3

---
 pkgs/applications/misc/privacyidea/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/applications/misc/privacyidea/default.nix b/pkgs/applications/misc/privacyidea/default.nix
index 74efc4c1db020..2a7f6c50c7330 100644
--- a/pkgs/applications/misc/privacyidea/default.nix
+++ b/pkgs/applications/misc/privacyidea/default.nix
@@ -9,6 +9,8 @@ let
 
   python3' = python310.override {
     packageOverrides = self: super: {
+      django = super.django_3;
+
       sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
         version = "1.3.24";
         src = fetchPypi {

From 99524a94ff31e1443a09d4b5326f5e69dd698b71 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 3 Aug 2023 06:33:36 -0700
Subject: [PATCH 067/154] python3.pkgs.ninja-python: add tjni as a maintainer
 of this stub

---
 pkgs/development/python-modules/ninja/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/ninja/default.nix b/pkgs/development/python-modules/ninja/default.nix
index d3ab12c29a55b..056c7663fb213 100644
--- a/pkgs/development/python-modules/ninja/default.nix
+++ b/pkgs/development/python-modules/ninja/default.nix
@@ -67,6 +67,6 @@ buildPythonPackage rec {
     description = "A small build system with a focus on speed";
     homepage = "https://github.com/scikit-build/ninja-python-distributions";
     license = licenses.asl20;
-    maintainers = with maintainers; [ _999eagle ];
+    maintainers = with maintainers; [ _999eagle tjni ];
   };
 }

From d36556b8a5db361933833d33876f4e8a815d1e0d Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 3 Aug 2023 06:06:34 -0700
Subject: [PATCH 068/154] python3.pkgs.ninja-python: replace with a stub
 implementation

Instead of packaging the upstream package, which downloads Ninja from
the web, we can stub it out to use ninja from nixpkgs.
---
 .../python-modules/ninja/default.nix          | 69 ++++++-------------
 .../python-modules/ninja/no-download.patch    | 10 ---
 .../ninja/stub/ninja/__init__.py              |  9 +++
 .../python-modules/ninja/stub/pyproject.toml  | 11 +++
 4 files changed, 42 insertions(+), 57 deletions(-)
 delete mode 100644 pkgs/development/python-modules/ninja/no-download.patch
 create mode 100644 pkgs/development/python-modules/ninja/stub/ninja/__init__.py
 create mode 100644 pkgs/development/python-modules/ninja/stub/pyproject.toml

diff --git a/pkgs/development/python-modules/ninja/default.nix b/pkgs/development/python-modules/ninja/default.nix
index 056c7663fb213..0ff6785693029 100644
--- a/pkgs/development/python-modules/ninja/default.nix
+++ b/pkgs/development/python-modules/ninja/default.nix
@@ -1,70 +1,45 @@
 { lib
 , buildPythonPackage
-, fetchFromGitHub
-, fetchurl
-, cmake
-, setuptools-scm
-, scikit-build
-, pytestCheckHook
-, pytest-virtualenv
+, flit-core
+, ninja
 }:
-let
-  # these must match NinjaUrls.cmake
-  ninja_src_url = "https://github.com/Kitware/ninja/archive/v1.11.1.g95dee.kitware.jobserver-1.tar.gz";
-  ninja_src_sha256 = "7ba84551f5b315b4270dc7c51adef5dff83a2154a3665a6c9744245c122dd0db";
-  ninja_src = fetchurl {
-    url = ninja_src_url;
-    sha256 = ninja_src_sha256;
-  };
-in
+
 buildPythonPackage rec {
   pname = "ninja";
-  version = "1.11.1";
+  inherit (ninja) version;
   format = "pyproject";
 
-  src = fetchFromGitHub {
-    owner = "scikit-build";
-    repo = "ninja-python-distributions";
-    rev = version;
-    hash = "sha256-scCYsSEyN+u3qZhNhWYqHpJCl+JVJJbKz+T34gOXGJM=";
-  };
-  patches = [
-    # make sure cmake doesn't try to download the ninja sources
-    ./no-download.patch
-  ];
+  src = ./stub;
 
-  inherit ninja_src;
   postUnpack = ''
-    # assume that if the hash matches, the source should be fine
-    if ! grep "${ninja_src_sha256}" $sourceRoot/NinjaUrls.cmake; then
-      echo "ninja_src_sha256 doesn't match the hash in NinjaUrls.cmake!"
-      exit 1
-    fi
-    mkdir -p "$sourceRoot/Ninja-src"
-    pushd "$sourceRoot/Ninja-src"
-    tar -xavf ${ninja_src} --strip-components 1
-    popd
-  '';
+    substituteInPlace "$sourceRoot/pyproject.toml" \
+      --subst-var version
 
-  postPatch = ''
-    sed -i '/cov/d' setup.cfg
+    substituteInPlace "$sourceRoot/ninja/__init__.py" \
+      --subst-var-by BIN_DIR "${ninja}/bin"
   '';
 
-  dontUseCmakeConfigure = true;
+  inherit (ninja) setupHook;
 
   nativeBuildInputs = [
-    setuptools-scm
-    scikit-build
-    cmake
+    flit-core
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-    pytest-virtualenv
+  preBuild = ''
+    cp "${ninja.src}/misc/ninja_syntax.py" ninja/ninja_syntax.py
+  '';
+
+  pythonImportsCheck = [
+    "ninja"
+    "ninja.ninja_syntax"
   ];
 
   meta = with lib; {
     description = "A small build system with a focus on speed";
+    longDescription = ''
+      This is a stub of the ninja package on PyPI that uses the ninja program
+      provided by nixpkgs instead of downloading ninja from the web.
+    '';
     homepage = "https://github.com/scikit-build/ninja-python-distributions";
     license = licenses.asl20;
     maintainers = with maintainers; [ _999eagle tjni ];
diff --git a/pkgs/development/python-modules/ninja/no-download.patch b/pkgs/development/python-modules/ninja/no-download.patch
deleted file mode 100644
index 0937a5fde1ea9..0000000000000
--- a/pkgs/development/python-modules/ninja/no-download.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -64,6 +64,7 @@
-   # Download selected source archive
-   ExternalProject_add(download_ninja_source
-     SOURCE_DIR ${Ninja_SOURCE_DIR}
-+    DOWNLOAD_COMMAND ""
-     URL ${${src_archive}_url}
-     URL_HASH SHA256=${${src_archive}_sha256}
-     DOWNLOAD_DIR ${ARCHIVE_DOWNLOAD_DIR}
diff --git a/pkgs/development/python-modules/ninja/stub/ninja/__init__.py b/pkgs/development/python-modules/ninja/stub/ninja/__init__.py
new file mode 100644
index 0000000000000..d85e4b6dab344
--- /dev/null
+++ b/pkgs/development/python-modules/ninja/stub/ninja/__init__.py
@@ -0,0 +1,9 @@
+import os
+import subprocess
+import sys
+
+def _program(name, args):
+    return subprocess.call([os.path.join('@BIN_DIR@', name)] + args, close_fds=False)
+
+def ninja():
+    raise SystemExit(_program('ninja', sys.argv[1:]))
diff --git a/pkgs/development/python-modules/ninja/stub/pyproject.toml b/pkgs/development/python-modules/ninja/stub/pyproject.toml
new file mode 100644
index 0000000000000..0a8a6314288a6
--- /dev/null
+++ b/pkgs/development/python-modules/ninja/stub/pyproject.toml
@@ -0,0 +1,11 @@
+[build-system]
+requires = ["flit_core"]
+build-backend = "flit_core.buildapi"
+
+[project]
+name = "ninja"
+version = "@version@"
+description = "Ninja is a small build system with a focus on speed"
+
+[project.scripts]
+ninja = "ninja:ninja"

From a586a9e55fcb0c3e961c49f9945f1078fb60ea7f Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 3 Aug 2023 20:04:15 -0700
Subject: [PATCH 069/154] python3.pkgs.ninja: rename from ninja-python

I am hoping this can be a transparent shim for most if not all Python
packages that acts as a proxy to the actual ninja package in nixpkgs.
If this works, doing it this way simplifies rolling out the new Python
build hooks that do stricter build dependency validation.
---
 pkgs/tools/misc/nanoemoji/default.nix | 4 ++--
 pkgs/top-level/python-aliases.nix     | 1 +
 pkgs/top-level/python-packages.nix    | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/misc/nanoemoji/default.nix b/pkgs/tools/misc/nanoemoji/default.nix
index 93817ff847987..401783bcc4a1a 100644
--- a/pkgs/tools/misc/nanoemoji/default.nix
+++ b/pkgs/tools/misc/nanoemoji/default.nix
@@ -36,7 +36,7 @@ python3.pkgs.buildPythonApplication rec {
     absl-py
     fonttools
     lxml
-    ninja-python
+    ninja
     picosvg
     pillow
     regex
@@ -50,7 +50,7 @@ python3.pkgs.buildPythonApplication rec {
   nativeCheckInputs = with python3.pkgs; [
     pytestCheckHook
 
-    ninja-python
+    ninja
     picosvg
   ];
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 21f3ee1f4a4b2..34839da3c1e89 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -209,6 +209,7 @@ mapAliases ({
   mutmut = throw "mutmut has been promoted to a top-level attribute"; # added 2022-10-02
   net2grid = gridnet; # add 2022-04-22
   nghttp2 = throw "in 1.52.0 removed deprecated python bindings."; # added 2023-06-08
+  ninja-python = ninja; # add 2022-08-03
   nose-cover3 = throw "nose-cover3 has been removed, it was using setuptools 2to3 translation feature, which has been removed in setuptools 58"; # added 2022-02-16
   nose_progressive = throw "nose_progressive has been removed, it was using setuptools 2to3 translation feature, which has been removed in setuptools 58"; #added 2023-02-21
   notifymuch = throw "notifymuch has been promoted to a top-level attribute"; # added 2022-10-02
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 008e5ecd4247d..7424e43e9c805 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7036,7 +7036,7 @@ self: super: with self; {
 
   nine = callPackage ../development/python-modules/nine { };
 
-  ninja-python = callPackage ../development/python-modules/ninja { };
+  ninja = callPackage ../development/python-modules/ninja { inherit (pkgs) ninja; };
 
   nipy = callPackage ../development/python-modules/nipy { };
 

From 39dd3d18bc2819b332d480aa1dd8d1084d0a635a Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 3 Aug 2023 22:12:05 -0700
Subject: [PATCH 070/154] python3.pkgs.meson-python: depend on top-level ninja

This is a build tool that depends on a ninja binary directly, not
through the ninja PyPI package.
---
 pkgs/development/python-modules/meson-python/default.nix | 7 -------
 pkgs/top-level/python-packages.nix                       | 4 +++-
 2 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/meson-python/default.nix b/pkgs/development/python-modules/meson-python/default.nix
index 866512a4cfdd6..4b45ee4e77d34 100644
--- a/pkgs/development/python-modules/meson-python/default.nix
+++ b/pkgs/development/python-modules/meson-python/default.nix
@@ -43,13 +43,6 @@ buildPythonPackage rec {
     ./add-build-flags.sh
   ];
 
-  # Ugly work-around. Drop ninja dependency.
-  # We already have ninja, but it comes without METADATA.
-  # Building ninja-python-distributions is the way to go.
-  postPatch = ''
-    substituteInPlace pyproject.toml --replace "'ninja'," ""
-  '';
-
   meta = {
     changelog = "https://github.com/mesonbuild/meson-python/blob/${version}/CHANGELOG.rst";
     description = "Meson Python build backend (PEP 517)";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7424e43e9c805..9d7df6be84d2e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6442,7 +6442,9 @@ self: super: with self; {
 
   mesonpep517 = callPackage ../development/python-modules/mesonpep517 { };
 
-  meson-python = callPackage ../development/python-modules/meson-python { };
+  meson-python = callPackage ../development/python-modules/meson-python {
+    inherit (pkgs) ninja;
+  };
 
   messagebird = callPackage ../development/python-modules/messagebird { };
 

From 7110f64a3c500efeeafeb216a52c748235b99148 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 4 Aug 2023 15:31:19 +0300
Subject: [PATCH 071/154] pipewire: 0.3.76 -> 0.3.77

Diff: https://gitlab.freedesktop.org/pipewire/pipewire/-/compare/0.3.76...0.3.77

Changelog: https://gitlab.freedesktop.org/pipewire/pipewire/-/releases/0.3.77
---
 pkgs/development/libraries/pipewire/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index aa226674d76ba..08b92288e5447 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -75,7 +75,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.76";
+    version = "0.3.77";
 
     outputs = [
       "out"
@@ -93,7 +93,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-3nD5etLohEIM4/5RDxaBzNxSngY817R6AzT2fqwjMiU=";
+      sha256 = "sha256-dRAo/GzWvXKVCGLM12YyTQmgXHEYn3QbOyaZKmlqTYY=";
     };
 
     patches = [

From ca73fb024a757f3ddf1a32a2e88cc2bccb88479c Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Fri, 4 Aug 2023 10:14:20 -0700
Subject: [PATCH 072/154] makeBinaryWrapper: remove cc dependency on
 aarch64-darwin

---
 .../setup-hooks/make-binary-wrapper/default.nix            | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
index 17b97b1082e93..62ba3705be20d 100644
--- a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
@@ -1,5 +1,4 @@
-{ stdenv
-, targetPackages
+{ targetPackages
 , lib
 , makeSetupHook
 , dieHook
@@ -11,9 +10,7 @@
 
 makeSetupHook {
   name = "make-binary-wrapper-hook";
-  propagatedBuildInputs = [ dieHook ]
-    # https://github.com/NixOS/nixpkgs/issues/148189
-    ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64) cc;
+  propagatedBuildInputs = [ dieHook ];
 
   substitutions = {
     cc = "${cc}/bin/${cc.targetPrefix}cc ${lib.escapeShellArgs (map (s: "-fsanitize=${s}") sanitizers)}";

From 166ff8fe1f7e9fd3fc5322dc2893105e5e790704 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Tue, 1 Aug 2023 00:01:21 -0700
Subject: [PATCH 073/154] treewide: fix sandbox darwin build

---
 .../python-modules/adguardhome/default.nix      |  2 ++
 .../aio-geojson-client/default.nix              |  2 ++
 .../aio-geojson-generic-client/default.nix      |  2 ++
 .../aio-geojson-geonetnz-quakes/default.nix     |  2 ++
 .../aio-geojson-geonetnz-volcano/default.nix    |  2 ++
 .../aio-geojson-nsw-rfs-incidents/default.nix   |  2 ++
 .../aio-geojson-usgs-earthquakes/default.nix    |  2 ++
 .../aio-georss-client/default.nix               |  2 ++
 .../python-modules/aio-georss-gdacs/default.nix |  2 ++
 .../python-modules/aiohttp-retry/default.nix    |  2 ++
 .../python-modules/aiojobs/default.nix          |  2 ++
 .../development/python-modules/amqp/default.nix |  4 ++++
 .../python-modules/asyncssh/default.nix         |  2 ++
 .../python-modules/curio/default.nix            | 17 ++++++++++-------
 .../python-modules/datadog/default.nix          |  2 ++
 .../python-modules/devolo-plc-api/default.nix   |  2 ++
 .../python-modules/django-cacheops/default.nix  |  2 ++
 .../python-modules/falcon/default.nix           |  2 ++
 .../python-modules/feedparser/default.nix       |  2 ++
 .../google-auth-httplib2/default.nix            |  2 ++
 .../python-modules/graphene-django/default.nix  |  8 ++++++--
 .../python-modules/httplib2/default.nix         | 10 ++++++----
 .../python-modules/httpx-socks/default.nix      |  2 ++
 .../development/python-modules/moto/default.nix |  2 ++
 .../python-modules/nose2/default.nix            |  2 ++
 .../python-modules/nvchecker/default.nix        |  2 ++
 .../prometheus-client/default.nix               |  2 ++
 .../python-modules/pycurl/default.nix           |  2 ++
 .../python-modules/pyquery/default.nix          |  2 ++
 .../python-modules/pyro5/default.nix            |  2 ++
 .../python-modules/pytest-recording/default.nix |  2 ++
 .../pytest-remotedata/default.nix               |  2 ++
 .../python-modules/pytest-tornasync/default.nix |  2 ++
 .../python-modules/pywemo/default.nix           |  2 ++
 .../python-modules/pyzipper/default.nix         |  2 ++
 .../python-modules/rangehttpserver/default.nix  |  2 ++
 .../development/python-modules/rope/default.nix |  2 ++
 .../python-modules/snakeviz/default.nix         |  2 ++
 .../python-modules/sockio/default.nix           |  2 ++
 .../python-modules/sshfs/default.nix            | 12 +++++++++++-
 .../python-modules/terminado/default.nix        |  3 ++-
 .../python-modules/umodbus/default.nix          |  2 ++
 .../python-modules/unearth/default.nix          |  2 ++
 .../python-modules/wandb/default.nix            |  2 ++
 .../python-modules/wsgidav/default.nix          |  2 ++
 45 files changed, 117 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/python-modules/adguardhome/default.nix b/pkgs/development/python-modules/adguardhome/default.nix
index 28af1269c180f..5c32d588428f8 100644
--- a/pkgs/development/python-modules/adguardhome/default.nix
+++ b/pkgs/development/python-modules/adguardhome/default.nix
@@ -42,6 +42,8 @@ buildPythonPackage rec {
     yarl
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
diff --git a/pkgs/development/python-modules/aio-geojson-client/default.nix b/pkgs/development/python-modules/aio-geojson-client/default.nix
index ad0a641c35f5d..22c59bd64d9d8 100644
--- a/pkgs/development/python-modules/aio-geojson-client/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-client/default.nix
@@ -31,6 +31,8 @@ buildPythonPackage rec {
     haversine
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     mock
diff --git a/pkgs/development/python-modules/aio-geojson-generic-client/default.nix b/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
index 56e5f8475cbc4..4ff502a2cf83a 100644
--- a/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
@@ -30,6 +30,8 @@ buildPythonPackage rec {
     pytz
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
diff --git a/pkgs/development/python-modules/aio-geojson-geonetnz-quakes/default.nix b/pkgs/development/python-modules/aio-geojson-geonetnz-quakes/default.nix
index 90645327c046a..f8daf10c3c1fa 100644
--- a/pkgs/development/python-modules/aio-geojson-geonetnz-quakes/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-geonetnz-quakes/default.nix
@@ -30,6 +30,8 @@ buildPythonPackage rec {
     pytz
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
diff --git a/pkgs/development/python-modules/aio-geojson-geonetnz-volcano/default.nix b/pkgs/development/python-modules/aio-geojson-geonetnz-volcano/default.nix
index fed8b6374a7ea..d97070df5907a 100644
--- a/pkgs/development/python-modules/aio-geojson-geonetnz-volcano/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-geonetnz-volcano/default.nix
@@ -31,6 +31,8 @@ buildPythonPackage rec {
     pytz
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     mock
diff --git a/pkgs/development/python-modules/aio-geojson-nsw-rfs-incidents/default.nix b/pkgs/development/python-modules/aio-geojson-nsw-rfs-incidents/default.nix
index b7c205179fd76..bf18c2bf184b6 100644
--- a/pkgs/development/python-modules/aio-geojson-nsw-rfs-incidents/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-nsw-rfs-incidents/default.nix
@@ -30,6 +30,8 @@ buildPythonPackage rec {
     pytz
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
diff --git a/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix b/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
index 1cb1125839354..89a1fd75b8f26 100644
--- a/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
@@ -30,6 +30,8 @@ buildPythonPackage rec {
     pytz
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/aio-georss-client/default.nix b/pkgs/development/python-modules/aio-georss-client/default.nix
index 6fb1ec42631bc..9c3cda759039a 100644
--- a/pkgs/development/python-modules/aio-georss-client/default.nix
+++ b/pkgs/development/python-modules/aio-georss-client/default.nix
@@ -35,6 +35,8 @@ buildPythonPackage rec {
     dateparser
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     mock
diff --git a/pkgs/development/python-modules/aio-georss-gdacs/default.nix b/pkgs/development/python-modules/aio-georss-gdacs/default.nix
index 3816b591544da..f55a42b5dd227 100644
--- a/pkgs/development/python-modules/aio-georss-gdacs/default.nix
+++ b/pkgs/development/python-modules/aio-georss-gdacs/default.nix
@@ -28,6 +28,8 @@ buildPythonPackage rec {
     dateparser
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
diff --git a/pkgs/development/python-modules/aiohttp-retry/default.nix b/pkgs/development/python-modules/aiohttp-retry/default.nix
index bf3c251b4fb84..262fcef8e442b 100644
--- a/pkgs/development/python-modules/aiohttp-retry/default.nix
+++ b/pkgs/development/python-modules/aiohttp-retry/default.nix
@@ -25,6 +25,8 @@ buildPythonPackage rec {
     aiohttp
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest-aiohttp
     pytestCheckHook
diff --git a/pkgs/development/python-modules/aiojobs/default.nix b/pkgs/development/python-modules/aiojobs/default.nix
index 320593f79370d..a3b982e22d5a9 100644
--- a/pkgs/development/python-modules/aiojobs/default.nix
+++ b/pkgs/development/python-modules/aiojobs/default.nix
@@ -37,6 +37,8 @@ buildPythonPackage rec {
     async-timeout
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
     pytest-aiohttp
diff --git a/pkgs/development/python-modules/amqp/default.nix b/pkgs/development/python-modules/amqp/default.nix
index bd834b9e14915..bad99ab8f02ac 100644
--- a/pkgs/development/python-modules/amqp/default.nix
+++ b/pkgs/development/python-modules/amqp/default.nix
@@ -3,6 +3,7 @@
 , case
 , fetchPypi
 , pytestCheckHook
+, pytest-rerunfailures
 , pythonOlder
 , vine
 }:
@@ -23,9 +24,12 @@ buildPythonPackage rec {
     vine
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     case
     pytestCheckHook
+    pytest-rerunfailures
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/asyncssh/default.nix b/pkgs/development/python-modules/asyncssh/default.nix
index 3f52c3acd354d..bdc436c8fdc47 100644
--- a/pkgs/development/python-modules/asyncssh/default.nix
+++ b/pkgs/development/python-modules/asyncssh/default.nix
@@ -58,6 +58,8 @@ buildPythonPackage rec {
     ];
   };
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     openssh
     openssl
diff --git a/pkgs/development/python-modules/curio/default.nix b/pkgs/development/python-modules/curio/default.nix
index e067e134d04cd..501cdd442ab92 100644
--- a/pkgs/development/python-modules/curio/default.nix
+++ b/pkgs/development/python-modules/curio/default.nix
@@ -26,13 +26,16 @@ buildPythonPackage rec {
   __darwinAllowLocalNetworking = true;
 
   disabledTests = [
-     "test_aside_basic" # times out
-     "test_write_timeout" # flaky, does not always time out
-     "test_aside_cancel" # fails because modifies PYTHONPATH and cant find pytest
-     "test_ssl_outgoing" # touches network
-     "test_unix_echo" # socket bind error on hydra when built with other packages
-     "test_unix_ssl_server" # socket bind error on hydra when built with other packages
-   ];
+    "test_aside_basic" # times out
+    "test_write_timeout" # flaky, does not always time out
+    "test_aside_cancel" # fails because modifies PYTHONPATH and cant find pytest
+    "test_ssl_outgoing" # touches network
+    "test_unix_echo" # socket bind error on hydra when built with other packages
+    "test_unix_ssl_server" # socket bind error on hydra when built with other packages
+  ] ++ lib.optionals stdenv.isDarwin [
+    # connects to python.org:1, expects an OsError, hangs in the darwin sandbox
+    "test_create_bad_connection"
+  ];
 
   pythonImportsCheck = [ "curio" ];
 
diff --git a/pkgs/development/python-modules/datadog/default.nix b/pkgs/development/python-modules/datadog/default.nix
index d382794523176..fb3271af586fa 100644
--- a/pkgs/development/python-modules/datadog/default.nix
+++ b/pkgs/development/python-modules/datadog/default.nix
@@ -34,6 +34,8 @@ buildPythonPackage rec {
     requests
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     click
     freezegun
diff --git a/pkgs/development/python-modules/devolo-plc-api/default.nix b/pkgs/development/python-modules/devolo-plc-api/default.nix
index d352925308cbe..c6d5b7df26607 100644
--- a/pkgs/development/python-modules/devolo-plc-api/default.nix
+++ b/pkgs/development/python-modules/devolo-plc-api/default.nix
@@ -44,6 +44,8 @@ buildPythonPackage rec {
     zeroconf
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest-asyncio
     pytest-httpx
diff --git a/pkgs/development/python-modules/django-cacheops/default.nix b/pkgs/development/python-modules/django-cacheops/default.nix
index 566eb06f50436..4c6c4e786ade6 100644
--- a/pkgs/development/python-modules/django-cacheops/default.nix
+++ b/pkgs/development/python-modules/django-cacheops/default.nix
@@ -42,6 +42,8 @@ buildPythonPackage rec {
     six
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
     pytest-django
diff --git a/pkgs/development/python-modules/falcon/default.nix b/pkgs/development/python-modules/falcon/default.nix
index 341d3c6615068..b0880c384dba1 100644
--- a/pkgs/development/python-modules/falcon/default.nix
+++ b/pkgs/development/python-modules/falcon/default.nix
@@ -45,6 +45,8 @@ buildPythonPackage rec {
     cython
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   preCheck = ''
     export HOME=$TMPDIR
     cp -R tests examples $TMPDIR
diff --git a/pkgs/development/python-modules/feedparser/default.nix b/pkgs/development/python-modules/feedparser/default.nix
index 02396ec834313..7eaf65b371dff 100644
--- a/pkgs/development/python-modules/feedparser/default.nix
+++ b/pkgs/development/python-modules/feedparser/default.nix
@@ -22,6 +22,8 @@ buildPythonPackage rec {
     sgmllib3k
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   checkPhase = ''
     # Tests are failing
     # AssertionError: unexpected '~' char in declaration
diff --git a/pkgs/development/python-modules/google-auth-httplib2/default.nix b/pkgs/development/python-modules/google-auth-httplib2/default.nix
index e185a88858d58..c35297f6b5cf4 100644
--- a/pkgs/development/python-modules/google-auth-httplib2/default.nix
+++ b/pkgs/development/python-modules/google-auth-httplib2/default.nix
@@ -27,6 +27,8 @@ buildPythonPackage rec {
     httplib2
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     flask
     mock
diff --git a/pkgs/development/python-modules/graphene-django/default.nix b/pkgs/development/python-modules/graphene-django/default.nix
index 0e85af5045b2f..3e9055157220a 100644
--- a/pkgs/development/python-modules/graphene-django/default.nix
+++ b/pkgs/development/python-modules/graphene-django/default.nix
@@ -1,4 +1,5 @@
-{ lib
+{ stdenv
+, lib
 , buildPythonPackage
 , pythonAtLeast
 , pythonOlder
@@ -61,11 +62,14 @@ buildPythonPackage rec {
   ];
 
   disabledTests = lib.optionals (pythonAtLeast "3.11") [
-    # Pèython 3.11 support, https://github.com/graphql-python/graphene-django/pull/1365
+    # Python 3.11 support, https://github.com/graphql-python/graphene-django/pull/1365
     "test_django_objecttype_convert_choices_enum_naming_collisions"
     "test_django_objecttype_choices_custom_enum_name"
     "test_django_objecttype_convert_choices_enum_list"
     "test_schema_representation"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # this test touches files in the "/" directory and fails in darwin sandbox
+    "test_should_filepath_convert_string"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/httplib2/default.nix b/pkgs/development/python-modules/httplib2/default.nix
index 99dd53ddd0a90..c201bc3126c83 100644
--- a/pkgs/development/python-modules/httplib2/default.nix
+++ b/pkgs/development/python-modules/httplib2/default.nix
@@ -26,6 +26,10 @@ buildPythonPackage rec {
     hash = "sha256-1Pl+l28J7crfO2UY/9/D019IzOHWOwjR+UvVEHICTqU=";
   };
 
+  postPatch = ''
+    sed -i "/--cov/d" setup.cfg
+  '';
+
   propagatedBuildInputs = [
     pyparsing
   ];
@@ -40,13 +44,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   # Don't run tests for older Pythons
   doCheck = pythonAtLeast "3.9";
 
-  postPatch = ''
-    sed -i "/--cov/d" setup.cfg
-  '';
-
   disabledTests = [
     # ValueError: Unable to load PEM file.
     # https://github.com/httplib2/httplib2/issues/192#issuecomment-993165140
diff --git a/pkgs/development/python-modules/httpx-socks/default.nix b/pkgs/development/python-modules/httpx-socks/default.nix
index 996db8ec1b301..992ddf1c69327 100644
--- a/pkgs/development/python-modules/httpx-socks/default.nix
+++ b/pkgs/development/python-modules/httpx-socks/default.nix
@@ -54,6 +54,8 @@ buildPythonPackage rec {
     ];
   };
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     flask
     hypercorn
diff --git a/pkgs/development/python-modules/moto/default.nix b/pkgs/development/python-modules/moto/default.nix
index b029f9cad44e0..c30fc5311d040 100644
--- a/pkgs/development/python-modules/moto/default.nix
+++ b/pkgs/development/python-modules/moto/default.nix
@@ -79,6 +79,8 @@ buildPythonPackage rec {
     xmltodict
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     freezegun
     pytestCheckHook
diff --git a/pkgs/development/python-modules/nose2/default.nix b/pkgs/development/python-modules/nose2/default.nix
index b3dfdda218f33..648d954be7d04 100644
--- a/pkgs/development/python-modules/nose2/default.nix
+++ b/pkgs/development/python-modules/nose2/default.nix
@@ -24,6 +24,8 @@ buildPythonPackage rec {
     six
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   checkPhase = ''
     ${python.interpreter} -m unittest
   '';
diff --git a/pkgs/development/python-modules/nvchecker/default.nix b/pkgs/development/python-modules/nvchecker/default.nix
index 20802a73176fa..ca327c3e54e0a 100644
--- a/pkgs/development/python-modules/nvchecker/default.nix
+++ b/pkgs/development/python-modules/nvchecker/default.nix
@@ -49,6 +49,8 @@ buildPythonPackage rec {
     tomli
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     flaky
     pytest-asyncio
diff --git a/pkgs/development/python-modules/prometheus-client/default.nix b/pkgs/development/python-modules/prometheus-client/default.nix
index 9a9c2f7cce186..f86e0bbc3238a 100644
--- a/pkgs/development/python-modules/prometheus-client/default.nix
+++ b/pkgs/development/python-modules/prometheus-client/default.nix
@@ -19,6 +19,8 @@ buildPythonPackage rec {
     hash = "sha256-0qh6OorIIs3WfneZavzwTTZFwIRXCJzezks/qihu8xo=";
   };
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index 45e5d8f13a151..cacb67496c8ca 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -46,6 +46,8 @@ buildPythonPackage rec {
     curl
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     bottle
     pytestCheckHook
diff --git a/pkgs/development/python-modules/pyquery/default.nix b/pkgs/development/python-modules/pyquery/default.nix
index 4e3b1442ee317..699bcd0fbc592 100644
--- a/pkgs/development/python-modules/pyquery/default.nix
+++ b/pkgs/development/python-modules/pyquery/default.nix
@@ -33,6 +33,8 @@ buildPythonPackage rec {
     lxml
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [ "pyquery" ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/pyro5/default.nix b/pkgs/development/python-modules/pyro5/default.nix
index 7c469595ab74f..93ea78d692c8f 100644
--- a/pkgs/development/python-modules/pyro5/default.nix
+++ b/pkgs/development/python-modules/pyro5/default.nix
@@ -24,6 +24,8 @@ buildPythonPackage rec {
     serpent
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/pytest-recording/default.nix b/pkgs/development/python-modules/pytest-recording/default.nix
index fe68e9ee46b08..87c0e8d33a026 100644
--- a/pkgs/development/python-modules/pytest-recording/default.nix
+++ b/pkgs/development/python-modules/pytest-recording/default.nix
@@ -33,6 +33,8 @@ buildPythonPackage rec {
     attrs
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   checkInputs = [
     pytestCheckHook
     pytest-httpbin
diff --git a/pkgs/development/python-modules/pytest-remotedata/default.nix b/pkgs/development/python-modules/pytest-remotedata/default.nix
index 544a2e3400799..bc8c89caacc14 100644
--- a/pkgs/development/python-modules/pytest-remotedata/default.nix
+++ b/pkgs/development/python-modules/pytest-remotedata/default.nix
@@ -32,6 +32,8 @@ buildPythonPackage rec {
     six
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/pytest-tornasync/default.nix b/pkgs/development/python-modules/pytest-tornasync/default.nix
index ac2cf07736c5c..9fca8d8602620 100644
--- a/pkgs/development/python-modules/pytest-tornasync/default.nix
+++ b/pkgs/development/python-modules/pytest-tornasync/default.nix
@@ -21,6 +21,8 @@ buildPythonPackage rec {
     tornado
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest
     tornado
diff --git a/pkgs/development/python-modules/pywemo/default.nix b/pkgs/development/python-modules/pywemo/default.nix
index f10288cd381a8..dee664897bc0e 100644
--- a/pkgs/development/python-modules/pywemo/default.nix
+++ b/pkgs/development/python-modules/pywemo/default.nix
@@ -37,6 +37,8 @@ buildPythonPackage rec {
     lxml
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     hypothesis
     pytest-vcr
diff --git a/pkgs/development/python-modules/pyzipper/default.nix b/pkgs/development/python-modules/pyzipper/default.nix
index d12e396e2db16..a0ad73fb8a3b4 100644
--- a/pkgs/development/python-modules/pyzipper/default.nix
+++ b/pkgs/development/python-modules/pyzipper/default.nix
@@ -24,6 +24,8 @@ buildPythonPackage rec {
     pycryptodomex
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/rangehttpserver/default.nix b/pkgs/development/python-modules/rangehttpserver/default.nix
index 010b959edad3e..bab8f73b412b0 100644
--- a/pkgs/development/python-modules/rangehttpserver/default.nix
+++ b/pkgs/development/python-modules/rangehttpserver/default.nix
@@ -22,6 +22,8 @@ buildPythonPackage rec {
     setuptools
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
     requests
diff --git a/pkgs/development/python-modules/rope/default.nix b/pkgs/development/python-modules/rope/default.nix
index 3a9c947a118d1..1168529eea683 100644
--- a/pkgs/development/python-modules/rope/default.nix
+++ b/pkgs/development/python-modules/rope/default.nix
@@ -30,6 +30,8 @@ buildPythonPackage rec {
     pytoolconfig
   ] ++ pytoolconfig.optional-dependencies.global;
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest-timeout
     pytestCheckHook
diff --git a/pkgs/development/python-modules/snakeviz/default.nix b/pkgs/development/python-modules/snakeviz/default.nix
index 0b37679449853..1b8c1c81183bd 100644
--- a/pkgs/development/python-modules/snakeviz/default.nix
+++ b/pkgs/development/python-modules/snakeviz/default.nix
@@ -31,6 +31,8 @@ buildPythonPackage rec {
     tornado
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     ipython
     pytestCheckHook
diff --git a/pkgs/development/python-modules/sockio/default.nix b/pkgs/development/python-modules/sockio/default.nix
index 5e1fcbe2a7f1c..8ce561b781f93 100644
--- a/pkgs/development/python-modules/sockio/default.nix
+++ b/pkgs/development/python-modules/sockio/default.nix
@@ -27,6 +27,8 @@ buildPythonPackage rec {
       --replace "--durations=2 --verbose" ""
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest-asyncio
     pytestCheckHook
diff --git a/pkgs/development/python-modules/sshfs/default.nix b/pkgs/development/python-modules/sshfs/default.nix
index 653b30f14d0c9..f1b47d75b8c50 100644
--- a/pkgs/development/python-modules/sshfs/default.nix
+++ b/pkgs/development/python-modules/sshfs/default.nix
@@ -1,4 +1,5 @@
-{ lib
+{ stdenv
+, lib
 , asyncssh
 , bcrypt
 , buildPythonPackage
@@ -7,6 +8,7 @@
 , mock-ssh-server
 , pytest-asyncio
 , pytestCheckHook
+, setuptools
 , setuptools-scm
 }:
 
@@ -24,6 +26,7 @@ buildPythonPackage rec {
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
@@ -33,12 +36,19 @@ buildPythonPackage rec {
     fsspec
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     mock-ssh-server
     pytest-asyncio
     pytestCheckHook
   ];
 
+  disabledTests = lib.optionals stdenv.isDarwin [
+    # test fails with sandbox enabled
+    "test_checksum"
+  ];
+
   pythonImportsCheck = [
     "sshfs"
   ];
diff --git a/pkgs/development/python-modules/terminado/default.nix b/pkgs/development/python-modules/terminado/default.nix
index 1031ff5b14231..3c75305e9078f 100644
--- a/pkgs/development/python-modules/terminado/default.nix
+++ b/pkgs/development/python-modules/terminado/default.nix
@@ -31,12 +31,13 @@ buildPythonPackage rec {
     "terminado"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest-timeout
     pytestCheckHook
   ];
 
-
   meta = with lib; {
     description = "Terminals served by Tornado websockets";
     homepage = "https://github.com/jupyter/terminado";
diff --git a/pkgs/development/python-modules/umodbus/default.nix b/pkgs/development/python-modules/umodbus/default.nix
index 331a4b1306d29..7ce4997342036 100644
--- a/pkgs/development/python-modules/umodbus/default.nix
+++ b/pkgs/development/python-modules/umodbus/default.nix
@@ -25,6 +25,8 @@ buildPythonPackage rec {
     pyserial
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/unearth/default.nix b/pkgs/development/python-modules/unearth/default.nix
index cf9e95e41bb29..f1a61014e4968 100644
--- a/pkgs/development/python-modules/unearth/default.nix
+++ b/pkgs/development/python-modules/unearth/default.nix
@@ -36,6 +36,8 @@ buildPythonPackage rec {
     cached-property
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     flask
     pytest-httpserver
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index fa57b00728929..25f7e4b98dd91 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -97,6 +97,8 @@ buildPythonPackage rec {
     shortuuid
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     azure-containerregistry
     azure-core
diff --git a/pkgs/development/python-modules/wsgidav/default.nix b/pkgs/development/python-modules/wsgidav/default.nix
index f1b81599c396e..9dc51364bc654 100644
--- a/pkgs/development/python-modules/wsgidav/default.nix
+++ b/pkgs/development/python-modules/wsgidav/default.nix
@@ -40,6 +40,8 @@ buildPythonPackage rec {
     pyyaml
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     cheroot
     pytestCheckHook

From 8eff2eea8cbe5893055e1dc831f49c4a40d60179 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Sat, 5 Aug 2023 01:15:48 +0300
Subject: [PATCH 074/154] Revert "Revert "python3: splice python within
 python3Packages.callPackage""

This reverts commit 2ffca30cded859fdbde6f1ae4685e29f92c20424.

`793cc9d982415b71cdba729cf779bfc49e9d2ae7` `python3: splice python within python3Packages.callPackage`
Was reverted because it broke
`pkgsCross.aarch64-multiplatform.python3Packages.cryptography`

But by reverting the revert `pkgsCross.aarch64-multiplatform.python3Packages.cryptography` still builds.

I tried reverting the 2 cryptography update commits, and it still
worked, so I do not know why this would work now.
---
 pkgs/development/interpreters/python/hooks/default.nix | 8 ++++----
 pkgs/development/interpreters/python/passthrufun.nix   | 5 +++--
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index bd29d493ebb8c..a653ada4837d4 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -1,9 +1,9 @@
-self: super: with self;
+self: dontUse: with self;
 
 let
-  pythonInterpreter = super.python.pythonForBuild.interpreter;
-  pythonSitePackages = super.python.sitePackages;
-  pythonCheckInterpreter = super.python.interpreter;
+  pythonInterpreter = python.pythonForBuild.interpreter;
+  pythonSitePackages = python.sitePackages;
+  pythonCheckInterpreter = python.interpreter;
   setuppy = ../run_setup.py;
 in {
   makePythonHook = args: pkgs.makeSetupHook ({passthru.provides.setupHook = true; } // args);
diff --git a/pkgs/development/interpreters/python/passthrufun.nix b/pkgs/development/interpreters/python/passthrufun.nix
index aa63f354e085d..b73885b5e29e1 100644
--- a/pkgs/development/interpreters/python/passthrufun.nix
+++ b/pkgs/development/interpreters/python/passthrufun.nix
@@ -47,12 +47,13 @@
         selfTargetTarget = pythonOnTargetForTarget.pkgs or {}; # There is no Python TargetTarget.
       };
       hooks = import ./hooks/default.nix;
-      keep = lib.extends hooks pythonPackagesFun;
+      keep = self: hooks self {};
       extra = _: {};
       optionalExtensions = cond: as: lib.optionals cond as;
       pythonExtension = import ../../../top-level/python-packages.nix;
       python2Extension = import ../../../top-level/python2-packages.nix;
       extensions = lib.composeManyExtensions ([
+        hooks
         pythonExtension
       ] ++ (optionalExtensions (!self.isPy3k) [
         python2Extension
@@ -64,7 +65,7 @@
       otherSplices
       keep
       extra
-      (lib.extends (lib.composeExtensions aliases extensions) keep))
+      (lib.extends (lib.composeExtensions aliases extensions) pythonPackagesFun))
     {
       overrides = packageOverrides;
       python = self;

From b067d888c88512a94f476ac9aa25db27e61572f2 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Sat, 5 Aug 2023 02:02:08 +0200
Subject: [PATCH 075/154] openjdk{8-20}: bump darwin version

---
 .../compilers/openjdk/darwin/11.nix           | 24 +++++++++----------
 .../compilers/openjdk/darwin/16.nix           | 24 +++++++++----------
 .../compilers/openjdk/darwin/17.nix           | 19 +++++++--------
 .../compilers/openjdk/darwin/18.nix           | 19 +++++++--------
 .../compilers/openjdk/darwin/19.nix           | 19 +++++++--------
 .../compilers/openjdk/darwin/20.nix           | 19 +++++++--------
 .../compilers/openjdk/darwin/8.nix            | 24 +++++++++----------
 7 files changed, 72 insertions(+), 76 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/darwin/11.nix b/pkgs/development/compilers/openjdk/darwin/11.nix
index 1ca2901b048dd..48de376793853 100644
--- a/pkgs/development/compilers/openjdk/darwin/11.nix
+++ b/pkgs/development/compilers/openjdk/darwin/11.nix
@@ -11,26 +11,26 @@ let
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "11.48.21";
-      jdkVersion = "11.0.11";
-      sha256 =
-        if enableJavaFX then "18bd9cd66d6abc6f8c627bc70278dc8fd4860e138e1dc9e170eddb89727ccc7b"
-        else "0v0n7h7i04pvna41wpdq2k9qiy70sbbqzqzvazfdvgm3gb22asw6";
+      zuluVersion = "11.66.15";
+      jdkVersion = "11.0.20";
+      hash =
+        if enableJavaFX then "sha256-pVgCJkgYTlFeL7nkkMWLeJ/J8ELhgvWb7gzf3erZP7Y="
+        else "sha256-vKqxHP5Yb651g8bZ0xHGQ4Q1T7JjjrmgEuykw/Gh2f0=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "11.48.21";
-      jdkVersion = "11.0.11";
-      sha256 =
-        if enableJavaFX then "ef0de2705c6c2d586812f7f3736b70e22b069545b38034816016f9f264ad43f9"
-        else "066whglrxx81c95grv2kxdbvyh32728ixhml2v44ildh549n4lhc";
+      zuluVersion = "11.66.15";
+      jdkVersion = "11.0.20";
+      hash =
+        if enableJavaFX then "sha256-VoZo34SCUU+HHnTl6iLe0QBC+4VDkPP14N98oqSg9EQ="
+        else "sha256-djK8Kfikt9SSuT87x1p7YWMIlNuF0TZFYDWrKiTTiIU=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
     url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
   javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
@@ -41,7 +41,7 @@ let
 
     src = fetchurl {
       url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/openjdk/darwin/16.nix b/pkgs/development/compilers/openjdk/darwin/16.nix
index b8f6b2d62ad4f..657b3eeafeabd 100644
--- a/pkgs/development/compilers/openjdk/darwin/16.nix
+++ b/pkgs/development/compilers/openjdk/darwin/16.nix
@@ -11,26 +11,26 @@ let
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "16.30.15";
-      jdkVersion = "16.0.1";
-      sha256 =
-        if enableJavaFX then "cbb3b96d80a0675893f21dc51ba3f532049c501bd7dc4c8d1ee930e63032c745"
-        else "1jihn125dmxr9y5h9jq89zywm3z6rbwv5q7msfzsf2wzrr13jh0z";
+      zuluVersion = "16.32.15";
+      jdkVersion = "16.0.2";
+      hash =
+        if enableJavaFX then "sha256-6URaSBNHQWLauO//kCuKXb4Z7AqyshWnoeJEyVRKgaY="
+        else "sha256-NXgBj/KixTknaCYbo3B+rOo11NImH5CDUIU0LhTCtMo=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "16.30.19";
-      jdkVersion = "16.0.1";
-      sha256 =
-        if enableJavaFX then "a49b23abfd83784d2ac935fc24e25ab7cb09b8ffc8e47c32ed446e05b8a21396"
-        else "1i0bcjx3acb5dhslf6cabdcnd6mrz9728vxw9hb4al5y3f5fll4w";
+      zuluVersion = "16.32.15";
+      jdkVersion = "16.0.2";
+      hash =
+        if enableJavaFX then "sha256-QuyhIAxUY3Vv1adGihW+LIsXtpDX2taCmFsMFj9o5vs="
+        else "sha256-3bUfDcLLyahLeURFAgLAVapBZHvqtam8GHbWTA6MQog=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
     url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
   javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
@@ -41,7 +41,7 @@ let
 
     src = fetchurl {
       url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/openjdk/darwin/17.nix b/pkgs/development/compilers/openjdk/darwin/17.nix
index 51f12864de82e..a9a0e73ee1503 100644
--- a/pkgs/development/compilers/openjdk/darwin/17.nix
+++ b/pkgs/development/compilers/openjdk/darwin/17.nix
@@ -5,23 +5,22 @@ let
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "17.34.19";
-      jdkVersion = "17.0.3";
-      sha256 = "sha256-qImyxVC2y2QhxuVZwamKPyo46+n+7ytIFXpYI0e6w2c=";
+      zuluVersion = "17.44.15";
+      jdkVersion = "17.0.8";
+      hash = "sha256-Ci18gBkAv/UUIQw9KlnfibcQMXwQRGx6K7L/NBB7b7Q=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "17.34.19";
-      jdkVersion = "17.0.3";
-      sha256 = "sha256-eaRX8Qa/Mqr9JhpHSEcf0Q9c4qmqLMgWqRhkEEwAjf8=";
+      zuluVersion = "17.44.15";
+      jdkVersion = "17.0.8";
+      hash = "sha256-8b81QY6DGXVOsTKM8QDzJnYjXV0ipCbYWaaz6oF2A6k=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
-    # Ugh, unversioned URLs... I hope this doesn't change often enough to cause pain before we move to a Darwin source build of OpenJDK!
-    url = "http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
   jdk = stdenv.mkDerivation rec {
@@ -30,7 +29,7 @@ let
 
     src = fetchurl {
       url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-ca-jdk${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/openjdk/darwin/18.nix b/pkgs/development/compilers/openjdk/darwin/18.nix
index 4744407e5fd24..6d934a30f18a9 100644
--- a/pkgs/development/compilers/openjdk/darwin/18.nix
+++ b/pkgs/development/compilers/openjdk/darwin/18.nix
@@ -5,23 +5,22 @@ let
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "18.28.13";
-      jdkVersion = "18.0.0";
-      sha256 = "0hc5m3d4q3n7sighq3pxkdg93vsrgj1kzla1py9nfnm9pnj9l2kq";
+      zuluVersion = "18.32.13";
+      jdkVersion = "18.0.2.1";
+      hash = "sha256-uHPcyOgxUdTgzmIVRp/awtwve9zSt+1TZNef7DUuoRg=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "18.28.13";
-      jdkVersion = "18.0.0";
-      sha256 = "0ch4jp2d4pjvxbmbswvjwf7w2flajrvjg5f16ggiy80y8l0y15cm";
+      zuluVersion = "18.32.13";
+      jdkVersion = "18.0.2.1";
+      hash = "sha256-jAZDgxtWMq/74yKAxA69oOU0C9nXvKG5MjmZLsK04iM=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
-    # Ugh, unversioned URLs... I hope this doesn't change often enough to cause pain before we move to a Darwin source build of OpenJDK!
-    url = "http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
   jdk = stdenv.mkDerivation rec {
@@ -30,7 +29,7 @@ let
 
     src = fetchurl {
       url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-ca-jdk${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/openjdk/darwin/19.nix b/pkgs/development/compilers/openjdk/darwin/19.nix
index e582c4016a542..f98ce511c594a 100644
--- a/pkgs/development/compilers/openjdk/darwin/19.nix
+++ b/pkgs/development/compilers/openjdk/darwin/19.nix
@@ -5,23 +5,22 @@ let
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "19.30.11";
-      jdkVersion = "19.0.1";
-      sha256 = "1h0qj0xgpxjy506ikbgdn74pi4860lsnh5n3q3bayfmn0pxc5ksn";
+      zuluVersion = "19.32.13";
+      jdkVersion = "19.0.2";
+      hash = "sha256-KARXWumsY+OcqpEOV2EL9SsPni1nGSipjRji/Mn2KsE=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "19.30.11";
-      jdkVersion = "19.0.1";
-      sha256 = "0g8i371h5fv686xhiff0431sgvdk80lbp2lkz86jpfdv9lgg0qnk";
+      zuluVersion = "19.32.13";
+      jdkVersion = "19.0.2";
+      hash = "sha256-F30FjZaLL756X/Xs6xjNwW9jds4pEATxoxOeeLL7Y5E=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
-    # Ugh, unversioned URLs... I hope this doesn't change often enough to cause pain before we move to a Darwin source build of OpenJDK!
-    url = "http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
   jdk = stdenv.mkDerivation rec {
@@ -30,7 +29,7 @@ let
 
     src = fetchurl {
       url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-ca-jdk${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/openjdk/darwin/20.nix b/pkgs/development/compilers/openjdk/darwin/20.nix
index e26592462e500..db8c93d23772e 100644
--- a/pkgs/development/compilers/openjdk/darwin/20.nix
+++ b/pkgs/development/compilers/openjdk/darwin/20.nix
@@ -5,23 +5,22 @@ let
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "20.30.11";
-      jdkVersion = "20.0.1";
-      sha256 = "0hg2n2mdbpxsgpw3c58w8y1f3im6schvfqahji352p9ljbdykzmy";
+      zuluVersion = "20.32.11";
+      jdkVersion = "20.0.2";
+      hash = "sha256-Ev9KG6DvuBnsZrOguLsO1KQzudHCBcJNwKh45Inpnfo=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "20.30.11";
-      jdkVersion = "20.0.1";
-      sha256 = "0bc9h1y0b2azyfl3f5sqj19sh02xs995d1kdn55m4lfhc00rzr81";
+      zuluVersion = "20.32.11";
+      jdkVersion = "20.0.2";
+      hash = "sha256-15uNZ6uMfSASV3QU2q2oA/jBk2PCHOfSjn1GY7/7qIY=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
-    # Ugh, unversioned URLs... I hope this doesn't change often enough to cause pain before we move to a Darwin source build of OpenJDK!
-    url = "http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
   jdk = stdenv.mkDerivation rec {
@@ -30,7 +29,7 @@ let
 
     src = fetchurl {
       url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-ca-jdk${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/openjdk/darwin/8.nix b/pkgs/development/compilers/openjdk/darwin/8.nix
index 3048c53f10f2d..9bfd9a8db1a39 100644
--- a/pkgs/development/compilers/openjdk/darwin/8.nix
+++ b/pkgs/development/compilers/openjdk/darwin/8.nix
@@ -11,26 +11,26 @@ let
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "8.54.0.21";
-      jdkVersion = "8.0.292";
-      sha256 =
-        if enableJavaFX then "e671f8990229b1ca2a76faabb21ba2f1a9e1f7211392e0f657225559be9b05c8"
-        else "1pgl0bir4r5v349gkxk54k6v62w241q7vw4gjxhv2g6pfq6hv7in";
+      zuluVersion = "8.72.0.17";
+      jdkVersion = "8.0.382";
+      hash =
+        if enableJavaFX then "sha256-/x8FqygivzddXsOwIV8aj/u+LPXMmokgu97vLAVEv80="
+        else "sha256-3dTPIPGUeT6nb3gncNvEa4VTRyQIBJpp8oZadrT2ToE=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "8.54.0.21";
-      jdkVersion = "8.0.292";
-      sha256 =
-        if enableJavaFX then "8e901075cde2c31f531a34e8321ea4201970936abf54240a232e9389952afe84"
-        else "05w89wfjlfbpqfjnv6wisxmaf13qb28b2223f9264jyx30qszw1c";
+      zuluVersion = "8.72.0.17";
+      jdkVersion = "8.0.382";
+      hash =
+        if enableJavaFX then "sha256-FkQ+0MzSZWUzc/HmiDVZEHGOrdKAVCdK5pm9wXXzzaU="
+        else "sha256-rN5AI4xAWppE4kJlzMod0JmGyHdHjTXYtx8/wOW6CFk=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
     url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
   javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
@@ -44,7 +44,7 @@ let
 
     src = fetchurl {
       url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 

From 26afb65e0e9f1cf70ae728a327784203baa579a2 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 5 Aug 2023 02:38:30 +0200
Subject: [PATCH 076/154] python311Packages.responses: 0.23.1 -> 0.23.3

Diff: https://github.com/getsentry/responses/compare/refs/tags/0.23.1...0.23.3

Changelog: https://github.com/getsentry/responses/blob/0.23.3/CHANGES
---
 pkgs/development/python-modules/responses/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/responses/default.nix b/pkgs/development/python-modules/responses/default.nix
index a1e21b8fbcdc2..a35b03680a448 100644
--- a/pkgs/development/python-modules/responses/default.nix
+++ b/pkgs/development/python-modules/responses/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "responses";
-  version = "0.23.1";
+  version = "0.23.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "getsentry";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-BU90nUZVqowFMn78KfbBEf59X7Q/1itvkGFdOzy4D2c=";
+    hash = "sha256-VJmcRMn0O+3mDwzkCwxIX7RU3/I9T9p9N8t6USWDZJQ=";
   };
 
   propagatedBuildInputs = [

From dc5cd92e5074a9c95ed1c99e125cff44c58faf7c Mon Sep 17 00:00:00 2001
From: Tobias Mayer <tobim@fastmail.fm>
Date: Thu, 20 Jul 2023 20:17:15 +0200
Subject: [PATCH 077/154] abseil-cpp_202301: install test helpers

---
 pkgs/development/libraries/abseil-cpp/202301.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/libraries/abseil-cpp/202301.nix b/pkgs/development/libraries/abseil-cpp/202301.nix
index a1c42c5df4b4f..da5f1fc029e16 100644
--- a/pkgs/development/libraries/abseil-cpp/202301.nix
+++ b/pkgs/development/libraries/abseil-cpp/202301.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , cmake
+, gtest
 , static ? stdenv.hostPlatform.isStatic
 , cxxStandard ? null
 }:
@@ -18,13 +19,19 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cmakeFlags = [
+    "-DABSL_BUILD_TEST_HELPERS=ON"
+    "-DABSL_USE_EXTERNAL_GOOGLETEST=ON"
     "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
   ] ++ lib.optionals (cxxStandard != null) [
     "-DCMAKE_CXX_STANDARD=${cxxStandard}"
   ];
 
+  strictDeps = true;
+
   nativeBuildInputs = [ cmake ];
 
+  buildInputs = [ gtest ];
+
   meta = with lib; {
     description = "An open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";

From 9e397b9d0042839420047a4154e6e33fd634a846 Mon Sep 17 00:00:00 2001
From: Tobias Mayer <tobim@fastmail.fm>
Date: Thu, 20 Jul 2023 20:19:31 +0200
Subject: [PATCH 078/154] protobuf3: 21.12 -> 24.4

---
 pkgs/development/libraries/protobuf/3.23.nix             | 6 ++++++
 pkgs/development/libraries/protobuf/generic-v3-cmake.nix | 6 ++----
 pkgs/top-level/all-packages.nix                          | 3 ++-
 3 files changed, 10 insertions(+), 5 deletions(-)
 create mode 100644 pkgs/development/libraries/protobuf/3.23.nix

diff --git a/pkgs/development/libraries/protobuf/3.23.nix b/pkgs/development/libraries/protobuf/3.23.nix
new file mode 100644
index 0000000000000..2d658d57419ba
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/3.23.nix
@@ -0,0 +1,6 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic-v3-cmake.nix ({
+  version = "3.23.4";
+  sha256 = "sha256-eI+mrsZAOLEsdyTC3B+K+GjD3r16CmPx1KJ2KhCwFdg=";
+} // args)
diff --git a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
index dfe2a6d7a965d..cca7a1eaa92c5 100644
--- a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
+++ b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
@@ -72,12 +72,10 @@ let
       zlib
     ];
 
-    # After 3.20, CMakeLists.txt can now be found at the top-level, however
-    # a stub cmake/CMakeLists.txt still exists for compatibility with previous build assumptions
-    cmakeDir = "../cmake";
+    cmakeDir = if lib.versionOlder version "3.22" then "../cmake" else null;
     cmakeFlags = [
       "-Dprotobuf_ABSL_PROVIDER=package"
-      ] ++ lib.optionals (!stdenv.targetPlatform.isStatic) [
+    ] ++ lib.optionals (!stdenv.targetPlatform.isStatic) [
       "-Dprotobuf_BUILD_SHARED_LIBS=ON"
     ]
     # Tests fail to build on 32-bit platforms; fixed in 3.22
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2dfa00a2dcc2a..843fdfdf26652 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -24162,8 +24162,9 @@ with pkgs;
 
   prospector = callPackage ../development/tools/prospector { };
 
-  protobuf = protobuf3_21;
+  protobuf = protobuf3_23;
 
+  protobuf3_23 = callPackage ../development/libraries/protobuf/3.23.nix { };
   protobuf3_21 = callPackage ../development/libraries/protobuf/3.21.nix {
     abseil-cpp = abseil-cpp_202103;
   };

From 9d5713843f65cd0dcf06d40dd34d8b1f2bd25da8 Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Sat, 29 Jul 2023 00:35:01 -0300
Subject: [PATCH 079/154] ed: refactor

A crazy refactor that factors the sources to a separate file, in order to
accomodate extra sources in parallel to the stable one.
---
 pkgs/applications/editors/ed/default.nix | 55 ++++++------------------
 pkgs/applications/editors/ed/generic.nix | 30 +++++++++++++
 pkgs/applications/editors/ed/sources.nix | 34 +++++++++++++++
 pkgs/top-level/all-packages.nix          |  3 +-
 4 files changed, 79 insertions(+), 43 deletions(-)
 create mode 100644 pkgs/applications/editors/ed/generic.nix
 create mode 100644 pkgs/applications/editors/ed/sources.nix

diff --git a/pkgs/applications/editors/ed/default.nix b/pkgs/applications/editors/ed/default.nix
index af6c8f7c6f8d5..cf27d772596f3 100644
--- a/pkgs/applications/editors/ed/default.nix
+++ b/pkgs/applications/editors/ed/default.nix
@@ -1,42 +1,13 @@
-{ lib, stdenv, fetchurl, lzip }:
-
-# Note: this package is used for bootstrapping fetchurl, and thus
-# cannot use fetchpatch! All mutable patches (generated by GitHub or
-# cgit) that are needed here should be included directly in Nixpkgs as
-# files.
-
-stdenv.mkDerivation rec {
-  pname = "ed";
-  version = "1.19";
-
-  src = fetchurl {
-    url = "mirror://gnu/ed/${pname}-${version}.tar.lz";
-    hash = "sha256-zi8uXEJHkKqW0J2suT2bv9wLfrYknJy3U4RS6Ox3zUg=";
-  };
-
-  nativeBuildInputs = [ lzip ];
-
-  configureFlags = [
-    "CC=${stdenv.cc.targetPrefix}cc"
-  ];
-
-  doCheck = true;
-
-  meta = {
-    description = "An implementation of the standard Unix editor";
-    longDescription = ''
-      GNU ed is a line-oriented text editor.  It is used to create,
-      display, modify and otherwise manipulate text files, both
-      interactively and via shell scripts.  A restricted version of ed,
-      red, can only edit files in the current directory and cannot
-      execute shell commands.  Ed is the "standard" text editor in the
-      sense that it is the original editor for Unix, and thus widely
-      available.  For most purposes, however, it is superseded by
-      full-screen editors such as GNU Emacs or GNU Moe.
-    '';
-    license = lib.licenses.gpl3Plus;
-    homepage = "https://www.gnu.org/software/ed/";
-    maintainers = [ ];
-    platforms = lib.platforms.unix;
-  };
-}
+{ lib, pkgs }:
+
+lib.makeScope pkgs.newScope (self:
+  let
+    inherit (self) callPackage;
+  in {
+    sources = import ./sources.nix {
+      inherit lib;
+      inherit (pkgs) fetchurl;
+    };
+
+    ed = callPackage (self.sources.ed) { };
+  })
diff --git a/pkgs/applications/editors/ed/generic.nix b/pkgs/applications/editors/ed/generic.nix
new file mode 100644
index 0000000000000..70ec6badf25ec
--- /dev/null
+++ b/pkgs/applications/editors/ed/generic.nix
@@ -0,0 +1,30 @@
+{ pname
+, version
+, src
+, patches ? [ ]
+, meta
+}:
+
+# Note: this package is used for bootstrapping fetchurl, and thus cannot use
+# fetchpatch! All mutable patches (generated by GitHub or cgit) that are needed
+# here should be included directly in Nixpkgs as files.
+
+{ lib
+, stdenv
+, fetchurl
+, lzip
+}:
+
+stdenv.mkDerivation {
+  inherit pname version src patches;
+
+  nativeBuildInputs = [ lzip ];
+
+  configureFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
+
+  doCheck = true;
+
+  inherit meta;
+}
diff --git a/pkgs/applications/editors/ed/sources.nix b/pkgs/applications/editors/ed/sources.nix
new file mode 100644
index 0000000000000..5d3535a834dc2
--- /dev/null
+++ b/pkgs/applications/editors/ed/sources.nix
@@ -0,0 +1,34 @@
+{ lib
+, fetchurl
+}:
+
+let
+  meta = {
+    description = "The GNU implementation of the standard Unix editor";
+    longDescription = ''
+      GNU ed is a line-oriented text editor. It is used to create, display,
+      modify and otherwise manipulate text files, both interactively and via
+      shell scripts. A restricted version of ed, red, can only edit files in the
+      current directory and cannot execute shell commands. Ed is the 'standard'
+      text editor in the sense that it is the original editor for Unix, and thus
+      widely available. For most purposes, however, it is superseded by
+      full-screen editors such as GNU Emacs or GNU Moe.
+    '';
+    license = lib.licenses.gpl3Plus;
+    homepage = "https://www.gnu.org/software/ed/";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
+  };
+in
+{
+  ed = let
+    pname = "ed";
+    version = "1.19";
+    src = fetchurl {
+      url = "mirror://gnu/ed/ed-${version}.tar.lz";
+      hash = "sha256-zi8uXEJHkKqW0J2suT2bv9wLfrYknJy3U4RS6Ox3zUg=";
+    };
+  in import ./generic.nix {
+    inherit pname version src meta;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 53d510124184f..3b74a7ae8cb15 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30991,7 +30991,8 @@ with pkgs;
 
   ecs-agent = callPackage ../applications/virtualization/ecs-agent { };
 
-  ed = callPackage ../applications/editors/ed { };
+  inherit (recurseIntoAttrs (callPackage ../applications/editors/ed { }))
+    ed;
 
   edbrowse = callPackage ../applications/editors/edbrowse { };
 

From 06a4aa3cdf162b54a5f914903750f3871dabea5e Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Sat, 29 Jul 2023 00:44:34 -0300
Subject: [PATCH 080/154] edUnstable: init at 1.20-pre2

---
 pkgs/applications/editors/ed/default.nix |  1 +
 pkgs/applications/editors/ed/sources.nix | 11 +++++++++++
 pkgs/top-level/all-packages.nix          |  2 +-
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/editors/ed/default.nix b/pkgs/applications/editors/ed/default.nix
index cf27d772596f3..c1f99de71057c 100644
--- a/pkgs/applications/editors/ed/default.nix
+++ b/pkgs/applications/editors/ed/default.nix
@@ -10,4 +10,5 @@ lib.makeScope pkgs.newScope (self:
     };
 
     ed = callPackage (self.sources.ed) { };
+    edUnstable = callPackage (self.sources.edUnstable) { };
   })
diff --git a/pkgs/applications/editors/ed/sources.nix b/pkgs/applications/editors/ed/sources.nix
index 5d3535a834dc2..5cb7501830532 100644
--- a/pkgs/applications/editors/ed/sources.nix
+++ b/pkgs/applications/editors/ed/sources.nix
@@ -31,4 +31,15 @@ in
   in import ./generic.nix {
     inherit pname version src meta;
   };
+
+  edUnstable = let
+    pname = "ed";
+    version = "1.20-pre2";
+    src = fetchurl {
+      url = "http://download.savannah.gnu.org/releases/ed/ed-${version}.tar.lz";
+      hash = "sha256-bHTDeMhVNNo3qqDNoBNaBA+DHDa4WJpfQNcTvAUPgsY=";
+    };
+  in import ./generic.nix {
+    inherit pname version src meta;
+  };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3b74a7ae8cb15..f878df61904fb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30992,7 +30992,7 @@ with pkgs;
   ecs-agent = callPackage ../applications/virtualization/ecs-agent { };
 
   inherit (recurseIntoAttrs (callPackage ../applications/editors/ed { }))
-    ed;
+    ed edUnstable;
 
   edbrowse = callPackage ../applications/editors/edbrowse { };
 

From 842726c6dc3bea1bbed2c3227fc9ed360196e301 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Mon, 27 Feb 2023 23:13:16 +0000
Subject: [PATCH 081/154] fortify-headers: init at 1.1alpine1

---
 .../libraries/fortify-headers/default.nix     | 34 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 ++
 2 files changed, 36 insertions(+)
 create mode 100644 pkgs/development/libraries/fortify-headers/default.nix

diff --git a/pkgs/development/libraries/fortify-headers/default.nix b/pkgs/development/libraries/fortify-headers/default.nix
new file mode 100644
index 0000000000000..befead87e6a13
--- /dev/null
+++ b/pkgs/development/libraries/fortify-headers/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, stdenv
+, fetchurl
+}:
+
+stdenv.mkDerivation {
+  pname = "fortify-headers";
+  version = "1.1alpine1";
+
+  # upstream only accessible via git - unusable during bootstrap, hence
+  # extract from the alpine package
+  src = fetchurl {
+    url = "https://dl-cdn.alpinelinux.org/alpine/v3.17/main/x86_64/fortify-headers-1.1-r1.apk";
+    name = "fortify-headers.tar.gz";  # ensure it's extracted as a .tar.gz
+    hash = "sha256-A67NzUv+dldARY+MTaoVnezTg+Es8ZK/b7XOxA6KzpI=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp -r include/fortify $out/include
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Standalone header-based fortify-source implementation";
+    homepage = "https://git.2f30.org/fortify-headers";
+    license = lib.licenses.bsd0;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ ris ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4ed0ff4e5ffe7..9676e7e62c7fa 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -21096,6 +21096,8 @@ with pkgs;
 
   folks = callPackage ../development/libraries/folks { };
 
+  fortify-headers = callPackage ../development/libraries/fortify-headers { };
+
   makeFontsConf = let fontconfig_ = fontconfig; in {fontconfig ? fontconfig_, fontDirectories}:
     callPackage ../development/libraries/fontconfig/make-fonts-conf.nix {
       inherit fontconfig fontDirectories;

From 2b8a7515d884ede294f1ce66558952e80cdf6091 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Sat, 5 Aug 2023 18:13:47 -0700
Subject: [PATCH 082/154] python3.pkgs.gunicorn: replace setuptools with
 packaging dependency

---
 pkgs/development/python-modules/gunicorn/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/gunicorn/default.nix b/pkgs/development/python-modules/gunicorn/default.nix
index 26822853ee28c..85023bceedda4 100644
--- a/pkgs/development/python-modules/gunicorn/default.nix
+++ b/pkgs/development/python-modules/gunicorn/default.nix
@@ -4,8 +4,8 @@
 , pythonOlder
 , eventlet
 , gevent
+, packaging
 , pytestCheckHook
-, setuptools
 }:
 
 buildPythonPackage rec {
@@ -27,7 +27,7 @@ buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [
-    setuptools
+    packaging
   ];
 
   nativeCheckInputs = [

From a1429b7bc2b9b4beef3f8d68c9f0ea7bc9418589 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sun, 6 Aug 2023 04:20:00 +0000
Subject: [PATCH 083/154] ruby.rubygems: 3.4.17 -> 3.4.18

Changelog: https://github.com/rubygems/rubygems/blob/v3.4.18/CHANGELOG.md
---
 pkgs/development/interpreters/ruby/rubygems/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index e99155f0f3a7b..11119b768825c 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.4.17";
+  version = "3.4.18";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-SvqqlGPiqHeZQ0Mvulbgc5bM7E1O3HK7BtnbiscG0vE=";
+    hash = "sha256-+yHTJWedZNCkkRMIRT103QMTFJODlbJ2PwVbTghEo0M=";
   };
 
   patches = [

From f3bb6aa4b5e6bfc14649ff869f853b0731d1a1f0 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sun, 6 Aug 2023 04:20:00 +0000
Subject: [PATCH 084/154] bundler: 2.4.17 -> 2.4.18

Changelog: https://github.com/rubygems/rubygems/blob/bundler-v2.4.18/bundler/CHANGELOG.md
---
 pkgs/development/ruby-modules/bundler/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index da157c30a1504..2a9ad50c80441 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.4.17";
-  source.sha256 = "sha256-2EV6XnbJ0VPUuw/R/9Kj9Y+/CQyzRIub16Ah0T8ORK0=";
+  version = "2.4.18";
+  source.sha256 = "sha256-tvfScSHUmHSmnJGU1PjvVWsjkMzuxBY1zPTzxYBp9w4=";
   dontPatchShebangs = true;
 
   postFixup = ''

From aa6f3286bc72f4694afbcacdab9258eb63ae74af Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Mon, 31 Jul 2023 23:17:02 +0000
Subject: [PATCH 085/154] gupnp: fix compilation

meson 1.1.1 -> 1.2.0 had a few breaking changes.
upstream fixed it on both the main 1.6 and legacy 1.4 branches,
but only published a release for `gupnp_1_6`: for the legacy `gupnp` we
have to cherry-pick that fix.
---
 pkgs/development/libraries/gupnp/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/libraries/gupnp/default.nix b/pkgs/development/libraries/gupnp/default.nix
index 4bff529a5156b..4a8b250d26444 100644
--- a/pkgs/development/libraries/gupnp/default.nix
+++ b/pkgs/development/libraries/gupnp/default.nix
@@ -35,9 +35,18 @@ stdenv.mkDerivation rec {
     # Bring .pc file in line with our patched pkg-config.
     ./0001-pkg-config-Declare-header-dependencies-as-public.patch
 
+    # Unbreak build with Meson 1.2.0
+    # https://gitlab.gnome.org/GNOME/gupnp/-/merge_requests/33
+    (fetchpatch2 {
+      name = "meson-1.2-fix.patch";
+      url = "https://gitlab.gnome.org/GNOME/gupnp/-/commit/85c0244cfbf933d3e90d50ab68394c68d86f9ed5.patch";
+      hash = "sha256-poDhkEgDTpgGnTbbZLPwx8Alf0h81vmzJyx3izWmDGw=";
+    })
+
     # Fix build against libxml2 2.11
     # https://gitlab.gnome.org/GNOME/gupnp/-/merge_requests/34
     (fetchpatch2 {
+      name = "libxml2-2.11-fix.patch";
       url = "https://gitlab.gnome.org/GNOME/gupnp/-/commit/bc56f02b0f89e96f2bd74af811903d9931965f58.patch";
       hash = "sha256-KCHlq7Es+WLIWKgIgGVTaHarVQIiZPEi5r6nMAhXTgY=";
     })

From da269e3c82bfedf580b861d6a001f3992e5b6e05 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Thu, 3 Aug 2023 11:55:40 +0000
Subject: [PATCH 086/154] gupnp_1_6: 1.6.4 -> 1.6.5

this fixes the build with meson 1.2.0, and nothing more:
- <https://gitlab.gnome.org/GNOME/gupnp/-/commits/gupnp-1.6.5>
---
 pkgs/development/libraries/gupnp/1.6.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gupnp/1.6.nix b/pkgs/development/libraries/gupnp/1.6.nix
index da830a6366c93..8f5e002653fd8 100644
--- a/pkgs/development/libraries/gupnp/1.6.nix
+++ b/pkgs/development/libraries/gupnp/1.6.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gupnp";
-  version = "1.6.4";
+  version = "1.6.5";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gupnp/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-1sPQNYOET6UqvgAwQxhgB/DIQUX+OwD6slmVvtqb5Vo=";
+    hash = "sha256-Q33/lwFC6EBwh6iYVfcX4g0nydduBbTNUX32IcfYiM0=";
   };
 
   depsBuildBuild = [

From 524c7521b054ea7217daf501f6c9062dc52b1dbf Mon Sep 17 00:00:00 2001
From: Gabriel Arazas <foodogsquared@foodogsquared.one>
Date: Sun, 23 Apr 2023 13:57:48 +0800
Subject: [PATCH 087/154] guile: cleanup setup hook

---
 .../interpreters/guile/setup-hook-1.8.sh       |  2 +-
 .../interpreters/guile/setup-hook-2.0.sh       | 12 ++++++------
 .../interpreters/guile/setup-hook-2.2.sh       | 12 ++++++------
 .../interpreters/guile/setup-hook-3.0.sh       | 18 +++++++++---------
 4 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/pkgs/development/interpreters/guile/setup-hook-1.8.sh b/pkgs/development/interpreters/guile/setup-hook-1.8.sh
index 946e595ac0bf5..9a6ffb793a78b 100644
--- a/pkgs/development/interpreters/guile/setup-hook-1.8.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-1.8.sh
@@ -1,6 +1,6 @@
 addGuileLibPath () {
     if test -d "$1/share/guile/site"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site"
     fi
 }
 
diff --git a/pkgs/development/interpreters/guile/setup-hook-2.0.sh b/pkgs/development/interpreters/guile/setup-hook-2.0.sh
index d83f9c6470573..9ef0fae011b58 100644
--- a/pkgs/development/interpreters/guile/setup-hook-2.0.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-2.0.sh
@@ -1,18 +1,18 @@
 addGuileLibPath () {
     if test -d "$1/share/guile/site/2.0"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/2.0"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/2.0"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site/2.0"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/share/guile/site/2.0"
     elif test -d "$1/share/guile/site"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/share/guile/site"
     fi
 
     if test -d "$1/lib/guile/2.0/ccache"; then
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.0/ccache"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/lib/guile/2.0/ccache"
     fi
 
     if test -d "$1/lib/guile/2.0/site-ccache"; then
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.0/site-ccache"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/lib/guile/2.0/site-ccache"
     fi
 }
 
diff --git a/pkgs/development/interpreters/guile/setup-hook-2.2.sh b/pkgs/development/interpreters/guile/setup-hook-2.2.sh
index d6bb23e7949a5..932a5b6c41e64 100644
--- a/pkgs/development/interpreters/guile/setup-hook-2.2.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-2.2.sh
@@ -1,18 +1,18 @@
 addGuileLibPath () {
     if test -d "$1/share/guile/site/2.2"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/2.2"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/2.2"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site/2.2"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/share/guile/site/2.2"
     elif test -d "$1/share/guile/site"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/share/guile/site"
     fi
 
     if test -d "$1/lib/guile/2.2/ccache"; then
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.2/ccache"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/lib/guile/2.2/ccache"
     fi
 
     if test -d "$1/lib/guile/2.2/site-ccache"; then
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.2/site-ccache"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/lib/guile/2.2/site-ccache"
     fi
 }
 
diff --git a/pkgs/development/interpreters/guile/setup-hook-3.0.sh b/pkgs/development/interpreters/guile/setup-hook-3.0.sh
index 903a1ebfb2357..1a71e82d13a22 100644
--- a/pkgs/development/interpreters/guile/setup-hook-3.0.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-3.0.sh
@@ -1,24 +1,24 @@
 addGuileLibPath () {
     if test -d "$1/share/guile/site/3.0"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/3.0"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/3.0"
-        export GUILE_EXTENSIONS_PATH="${GUILE_EXTENSIONS_PATH-}${GUILE_EXTENSIONS_PATH:+:}$1/share/guile/site/3.0"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site/3.0"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/share/guile/site/3.0"
+        addToSearchPath GUILE_EXTENSIONS_PATH "$1/share/guile/site/3.0"
     elif test -d "$1/share/guile/site"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
-        export GUILE_EXTENSIONS_PATH="${GUILE_EXTENSIONS_PATH-}${GUILE_EXTENSIONS_PATH:+:}$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/share/guile/site"
+        addToSearchPath GUILE_EXTENSIONS_PATH "$1/share/guile/site"
     fi
 
     if test -d "$1/lib/guile/3.0/ccache"; then
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/3.0/ccache"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/lib/guile/3.0/ccache"
     fi
 
     if test -d "$1/lib/guile/3.0/site-ccache"; then
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/3.0/site-ccache"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/lib/guile/3.0/site-ccache"
     fi
 
     if test -d "$1/lib/guile/3.0/extensions"; then
-        export GUILE_EXTENSIONS_PATH="${GUILE_EXTENSIONS_PATH-}${GUILE_EXTENSIONS_PATH:+:}$1/lib/guile/3.0/extensions"
+        addToSearchPath GUILE_EXTENSIONS_PATH "$1/lib/guile/3.0/extensions"
     fi
 }
 

From 95c4a1fe96f2f6f406b805754099cb724aafdf42 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Tue, 28 Feb 2023 18:18:51 +0000
Subject: [PATCH 088/154] cc-wrapper: include fortify-headers before libc
 includes for musl

---
 pkgs/build-support/cc-wrapper/default.nix | 18 ++++++++++++++++++
 pkgs/stdenv/linux/default.nix             |  3 +++
 2 files changed, 21 insertions(+)

diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 53141cac5dfbb..b4104f351cae7 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -51,6 +51,8 @@
 
 # the derivation at which the `-B` and `-L` flags added by `useCcForLibs` will point
 , gccForLibs ? if useCcForLibs then cc else null
+, fortify-headers ? null
+, includeFortifyHeaders ? null
 }:
 
 with lib;
@@ -65,6 +67,10 @@ let
   stdenv = stdenvNoCC;
   inherit (stdenv) hostPlatform targetPlatform;
 
+  includeFortifyHeaders' = if includeFortifyHeaders != null
+    then includeFortifyHeaders
+    else targetPlatform.libc == "musl";
+
   # Prefix for binaries. Customarily ends with a dash separator.
   #
   # TODO(@Ericson2314) Make unconditional, or optional but always true by
@@ -165,6 +171,8 @@ let
     stdenv.targetPlatform.darwinMinVersionVariable;
 in
 
+assert includeFortifyHeaders' -> fortify-headers != null;
+
 # Ensure bintools matches
 assert libc_bin == bintools.libc_bin;
 assert libc_dev == bintools.libc_dev;
@@ -414,6 +422,16 @@ stdenv.mkDerivation {
 
       echo "${libc_lib}" > $out/nix-support/orig-libc
       echo "${libc_dev}" > $out/nix-support/orig-libc-dev
+    ''
+    # fortify-headers is a set of wrapper headers that augment libc
+    # and use #include_next to pass through to libc's true
+    # implementations, so must appear before them in search order.
+    # in theory a correctly placed -idirafter could be used, but in
+    # practice the compiler may have been built with a --with-headers
+    # like option that forces the libc headers before all -idirafter,
+    # hence -isystem here.
+    + optionalString includeFortifyHeaders' ''
+      echo "-isystem ${fortify-headers}/include" >> $out/nix-support/libc-cflags
     '')
 
     ##
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 0e483321b9357..34fffd36aa6ab 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -194,6 +194,7 @@ let
           inherit lib;
           inherit (prevStage) coreutils gnugrep;
           stdenvNoCC = prevStage.ccWrapperStdenv;
+          fortify-headers = prevStage.fortify-headers;
         }).overrideAttrs(a: lib.optionalAttrs (prevStage.gcc-unwrapped.passthru.isXgcc or false) {
           # This affects only `xgcc` (the compiler which compiles the final compiler).
           postFixup = (a.postFixup or "") + ''
@@ -568,6 +569,7 @@ in
         inherit lib;
         inherit (self) stdenvNoCC coreutils gnugrep;
         shell = self.bash + "/bin/bash";
+        fortify-headers = self.fortify-headers;
       };
     };
     extraNativeBuildInputs = [
@@ -645,6 +647,7 @@ in
         ++  [ linuxHeaders # propagated from .dev
             binutils gcc gcc.cc gcc.cc.lib gcc.expand-response-params gcc.cc.libgcc glibc.passthru.libgcc
           ]
+        ++ lib.optionals (localSystem.libc == "musl") [ fortify-headers ]
         ++ [ prevStage.updateAutotoolsGnuConfigScriptsHook prevStage.gnu-config ]
         ++ (with gcc-unwrapped.passthru; [
           gmp libmpc mpfr isl

From 1f4b42aa79fcaff595139ed33bf60014424e30bb Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Sat, 5 Aug 2023 13:10:55 +0200
Subject: [PATCH 089/154] gnu-config: give sources a name

Should be a little bit less of a mess and no shell wildcard symbols in
the store path.
---
 pkgs/development/libraries/gnu-config/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/gnu-config/default.nix b/pkgs/development/libraries/gnu-config/default.nix
index c0a3219808eb7..ca197ad8cf1f1 100644
--- a/pkgs/development/libraries/gnu-config/default.nix
+++ b/pkgs/development/libraries/gnu-config/default.nix
@@ -10,10 +10,12 @@ let
 
   # Don't use fetchgit as this is needed during Aarch64 bootstrapping
   configGuess = fetchurl {
+    name = "config.guess-${builtins.substring 0 7 rev}";
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.guess?id=${rev}";
     sha256 = "049qgfh4xjd4fxd7ygm1phd5faqphfvhfcv8dsdldprsp86lf55v";
   };
   configSub = fetchurl {
+    name = "config.sub-${builtins.substring 0 7 rev}";
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.sub?id=${rev}";
     sha256 = "1rk30y27mzls49wyfdb5jhzjr08hkxl7xqhnxmhcmkvqlmpsjnxl";
   };

From 9e34d8ec273f4b2c14b7ba01f4e90e03dbc1ef18 Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Sat, 5 Aug 2023 13:11:33 +0200
Subject: [PATCH 090/154] gnu-config: use install(1) to make buildCommand
 simpler

---
 pkgs/development/libraries/gnu-config/default.nix | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/gnu-config/default.nix b/pkgs/development/libraries/gnu-config/default.nix
index ca197ad8cf1f1..a3a0c770245e4 100644
--- a/pkgs/development/libraries/gnu-config/default.nix
+++ b/pkgs/development/libraries/gnu-config/default.nix
@@ -24,11 +24,8 @@ in stdenv.mkDerivation {
   version = "2023-01-21";
 
   buildCommand = ''
-    mkdir -p $out
-    cp ${configGuess} $out/config.guess
-    cp ${configSub} $out/config.sub
-
-    chmod +x $out/config.*
+    install -Dm755 ${configGuess} $out/config.guess
+    install -Dm755 ${configSub} $out/config.sub
   '';
 
   meta = with lib; {

From 9e910fdd8b11b421a3ed4535874f97d1f4715aef Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Sat, 5 Aug 2023 13:11:55 +0200
Subject: [PATCH 091/154] gnu-config: 2023-01-21 -> 2023-07-31

The most interesting change for us is that gnu-config can now [accept]
`*-unknown-none-elf` which means we can use target triples for
lib.systems.*-embedded that are interpreted in the same way by both
nixpkgs and gnu-config.

Reference #165836.

[accept]: https://git.savannah.gnu.org/cgit/config.git/commit/?id=998ba1414387b4ce1a519be234e1609bc7912e0c
---
 pkgs/development/libraries/gnu-config/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/gnu-config/default.nix b/pkgs/development/libraries/gnu-config/default.nix
index a3a0c770245e4..75a20bbbc355a 100644
--- a/pkgs/development/libraries/gnu-config/default.nix
+++ b/pkgs/development/libraries/gnu-config/default.nix
@@ -6,22 +6,22 @@
 # files.
 
 let
-  rev = "63acb96f92473ceb5e21d873d7c0aee266b3d6d3";
+  rev = "d4e37b5868ef910e3e52744c34408084bb13051c";
 
   # Don't use fetchgit as this is needed during Aarch64 bootstrapping
   configGuess = fetchurl {
     name = "config.guess-${builtins.substring 0 7 rev}";
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.guess?id=${rev}";
-    sha256 = "049qgfh4xjd4fxd7ygm1phd5faqphfvhfcv8dsdldprsp86lf55v";
+    sha256 = "191czpnbc1nxrygg8fd3839y1f4m9x43rp57vgrsas6p07zzh3c1";
   };
   configSub = fetchurl {
     name = "config.sub-${builtins.substring 0 7 rev}";
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.sub?id=${rev}";
-    sha256 = "1rk30y27mzls49wyfdb5jhzjr08hkxl7xqhnxmhcmkvqlmpsjnxl";
+    sha256 = "0148p54gw10p6sk2rn3gi9vvqm89rk8kcvl9335ckayhanx31381";
   };
 in stdenv.mkDerivation {
   pname = "gnu-config";
-  version = "2023-01-21";
+  version = "2023-07-31";
 
   buildCommand = ''
     install -Dm755 ${configGuess} $out/config.guess

From 91d0b754b83a292eeda83e10e247f4e464df41ad Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 7 Aug 2023 00:23:23 +0000
Subject: [PATCH 092/154] roc-toolkit: 0.2.4 -> 0.2.5

---
 pkgs/development/libraries/audio/roc-toolkit/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/audio/roc-toolkit/default.nix b/pkgs/development/libraries/audio/roc-toolkit/default.nix
index 878f499ccbbb2..c2cdd5285aa3a 100644
--- a/pkgs/development/libraries/audio/roc-toolkit/default.nix
+++ b/pkgs/development/libraries/audio/roc-toolkit/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "roc-toolkit";
-  version = "0.2.4";
+  version = "0.2.5";
 
   outputs = [ "out" "dev" ];
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "roc-streaming";
     repo = "roc-toolkit";
     rev = "v${version}";
-    hash = "sha256-x4+/MIFKcos9xWhvSNWdsUQA2oLiyYS0MJE60HY/3hQ=";
+    hash = "sha256-vosw4H3YTTCXdDOnQQYRNZgufPo1BxUtfg6jutArzTI=";
   };
 
   nativeBuildInputs = [

From 039571384104482363a3ea46be13f55aee9eb383 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 7 Aug 2023 00:45:57 +0000
Subject: [PATCH 093/154] openexr_3: 3.1.7 -> 3.1.10

---
 pkgs/development/libraries/openexr/3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/openexr/3.nix b/pkgs/development/libraries/openexr/3.nix
index 243d8830565d2..1bd8e63d37f9e 100644
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "3.1.7";
+  version = "3.1.10";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    sha256 = "sha256-Kl+aOA797aZvrvW4ZQNHdSU7YFPieZEzX3aYeaoH6eU=";
+    sha256 = "sha256-8oV7Himk9AS2e2Z3OREE7KQgFIUysXwATlUN51dDe5M=";
   };
 
   outputs = [ "bin" "dev" "out" "doc" ];

From decf1f8d738b37b71162f7b17731f666ffc6cc60 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Mon, 7 Aug 2023 00:15:30 -0700
Subject: [PATCH 094/154] python3.pkgs.flit-core: remove passthru tests
 (#245671)

These tests are run as part of building the "flit" application. There
are no flit-core specific tests.
---
 .../python-modules/flit-core/default.nix      | 18 ++-------------
 .../python-modules/flit-core/tests.nix        | 22 -------------------
 2 files changed, 2 insertions(+), 38 deletions(-)
 delete mode 100644 pkgs/development/python-modules/flit-core/tests.nix

diff --git a/pkgs/development/python-modules/flit-core/default.nix b/pkgs/development/python-modules/flit-core/default.nix
index c81a8567de2f9..16c15e4249cb0 100644
--- a/pkgs/development/python-modules/flit-core/default.nix
+++ b/pkgs/development/python-modules/flit-core/default.nix
@@ -1,6 +1,5 @@
 { lib
 , buildPythonPackage
-, callPackage
 , flit
 }:
 
@@ -9,28 +8,15 @@ buildPythonPackage rec {
   inherit (flit) version;
   format = "pyproject";
 
-  outputs = [
-    "out"
-    "testsout"
-  ];
-
   inherit (flit) src patches;
 
-  preConfigure = ''
-    cd flit_core
-  '';
-
-  postInstall = ''
-    mkdir $testsout
-    cp -R ../tests $testsout/tests
-  '';
+  sourceRoot = "source/flit_core";
 
-  # check in passthru.tests.pytest to escape infinite recursion with setuptools-scm
+  # Tests are run in the "flit" package.
   doCheck = false;
 
   passthru.tests = {
     inherit flit;
-    pytest = callPackage ./tests.nix { };
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/flit-core/tests.nix b/pkgs/development/python-modules/flit-core/tests.nix
deleted file mode 100644
index 49d6ac89fce66..0000000000000
--- a/pkgs/development/python-modules/flit-core/tests.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ buildPythonPackage
-, flit
-, flit-core
-, pytestCheckHook
-, testpath
-}:
-
-buildPythonPackage {
-  pname = "flit-core";
-  inherit (flit-core) version;
-
-  src = flit-core.testsout;
-
-  dontBuild = true;
-  dontInstall = true;
-
-  nativeCheckInputs = [
-    flit
-    pytestCheckHook
-    testpath
-  ];
-}

From 1b66a9059256ee6873fda5955db11e1dbb4613b5 Mon Sep 17 00:00:00 2001
From: Sebastian Sellmeier <mail@sebastian-sellmeier.de>
Date: Thu, 3 Aug 2023 10:08:09 +0200
Subject: [PATCH 095/154] go: Don't symlink bin-directory but binaries instead
 to avoid breaking pkgs.symlinkJoin without error-message

---
 pkgs/development/compilers/go/1.18.nix | 3 ++-
 pkgs/development/compilers/go/1.19.nix | 3 ++-
 pkgs/development/compilers/go/1.20.nix | 3 ++-
 pkgs/development/compilers/go/1.21.nix | 3 ++-
 4 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/compilers/go/1.18.nix b/pkgs/development/compilers/go/1.18.nix
index de74e99d9bb4e..5490bc1fc598c 100644
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@@ -166,7 +166,8 @@ stdenv.mkDerivation rec {
     runHook preInstall
     mkdir -p $GOROOT_FINAL
     cp -a bin pkg src lib misc api doc $GOROOT_FINAL
-    ln -s $GOROOT_FINAL/bin $out/bin
+    mkdir -p $out/bin
+    ln -s $GOROOT_FINAL/bin/* $out/bin
     runHook postInstall
   '';
 
diff --git a/pkgs/development/compilers/go/1.19.nix b/pkgs/development/compilers/go/1.19.nix
index 0ce8fcc659a88..d123c69319ee5 100644
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@@ -166,7 +166,8 @@ stdenv.mkDerivation rec {
     runHook preInstall
     mkdir -p $GOROOT_FINAL
     cp -a bin pkg src lib misc api doc $GOROOT_FINAL
-    ln -s $GOROOT_FINAL/bin $out/bin
+    mkdir -p $out/bin
+    ln -s $GOROOT_FINAL/bin/* $out/bin
     runHook postInstall
   '';
 
diff --git a/pkgs/development/compilers/go/1.20.nix b/pkgs/development/compilers/go/1.20.nix
index bd226f32157a9..3364ea3540194 100644
--- a/pkgs/development/compilers/go/1.20.nix
+++ b/pkgs/development/compilers/go/1.20.nix
@@ -158,7 +158,8 @@ stdenv.mkDerivation rec {
     runHook preInstall
     mkdir -p $GOROOT_FINAL
     cp -a bin pkg src lib misc api doc $GOROOT_FINAL
-    ln -s $GOROOT_FINAL/bin $out/bin
+    mkdir -p $out/bin
+    ln -s $GOROOT_FINAL/bin/* $out/bin
     runHook postInstall
   '';
 
diff --git a/pkgs/development/compilers/go/1.21.nix b/pkgs/development/compilers/go/1.21.nix
index cdd91ab1e6320..1c9404faadc62 100644
--- a/pkgs/development/compilers/go/1.21.nix
+++ b/pkgs/development/compilers/go/1.21.nix
@@ -158,7 +158,8 @@ stdenv.mkDerivation rec {
     runHook preInstall
     mkdir -p $GOROOT_FINAL
     cp -a bin pkg src lib misc api doc $GOROOT_FINAL
-    ln -s $GOROOT_FINAL/bin $out/bin
+    mkdir -p $out/bin
+    ln -s $GOROOT_FINAL/bin/* $out/bin
     runHook postInstall
   '';
 

From 1b6e441e020a40edd7fdeed8a19f8dda0f8fc104 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Anselm=20Sch=C3=BCler?= <mail@anselmschueler.com>
Date: Sun, 6 Aug 2023 21:39:37 +0200
Subject: [PATCH 096/154] graphviz: 8.0.5 -> 8.1.0

---
 pkgs/tools/graphics/graphviz/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/graphics/graphviz/default.nix b/pkgs/tools/graphics/graphviz/default.nix
index 1b7fd162dba5f..71892916ad7a6 100644
--- a/pkgs/tools/graphics/graphviz/default.nix
+++ b/pkgs/tools/graphics/graphviz/default.nix
@@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "graphviz";
-  version = "8.0.5";
+  version = "8.1.0";
 
   src = fetchFromGitLab {
     owner = "graphviz";
     repo = "graphviz";
     rev = version;
-    hash = "sha256-s3AUOLZhehxs2GcDCsq87RVvsDli1NvvQtwI0AyUs4k=";
+    hash = "sha256-xTdrtwSpizqf5tNRX0Q0w10mEk4S0X7cmxHj3Us14kY=";
   };
 
   nativeBuildInputs = [

From 6d54e6346c880ca67819cd787893275851008d0f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 7 Aug 2023 11:40:46 +0200
Subject: [PATCH 097/154] gnutls: 3.8.0 -> 3.8.1

https://lists.gnupg.org/pipermail/gnutls-help/2023-August/004834.html
---
 pkgs/development/libraries/gnutls/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 2a6d0d1088ba3..1ac761514ad1d 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -33,11 +33,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnutls";
-  version = "3.8.0";
+  version = "3.8.1";
 
   src = fetchurl {
     url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
-    sha256 = "sha256-DqDRGhZgoeY/lg8Vexl6vm0MjLMlW+JOH7OBWTC5vcU=";
+    hash = "sha256-uoueFa4gq6iPRGYZePW1hjSUMW/n5yLt6dBp/mKUgpw=";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];

From 520a544ee5f90541b8a457b12d3d17f74f80d515 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Mon, 7 Aug 2023 18:20:56 +0300
Subject: [PATCH 098/154] setup-hooks/strip: Create the log file in '$TMDPIR'

vcunat said

> This invocation of mktemp creates the file in the current directory, which is bad practice. We should add "--tmpdir=$TMPDIR" or make the template absolute.

> I noticed because one package did cd $src during installing, which is a read-only path...
---
 pkgs/build-support/setup-hooks/strip.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/setup-hooks/strip.sh b/pkgs/build-support/setup-hooks/strip.sh
index 5f53e7e95b2ef..d2422bb84234f 100644
--- a/pkgs/build-support/setup-hooks/strip.sh
+++ b/pkgs/build-support/setup-hooks/strip.sh
@@ -65,7 +65,7 @@ stripDirs() {
     if [ -n "${paths}" ]; then
         echo "stripping (with command $cmd and flags $stripFlags) in $paths"
         local striperr
-        striperr="$(mktemp 'striperr.XXXXXX')"
+        striperr="$(mktemp --tmpdir="$TMPDIR" 'striperr.XXXXXX')"
         # Do not strip lib/debug. This is a directory used by setup-hooks/separate-debug-info.sh.
         find $paths -type f -a '!' -path "$prefix/lib/debug/*" -print0 |
             # Make sure we process files under symlinks only once. Otherwise

From 3e7b01767fd23c2a330602e8b89a461095944464 Mon Sep 17 00:00:00 2001
From: pacien <pacien.trangirard@pacien.net>
Date: Mon, 7 Aug 2023 17:54:41 +0200
Subject: [PATCH 099/154] mercurial: 6.5 -> 6.5.1

Changelog: https://wiki.mercurial-scm.org/Release6.5
---
 pkgs/applications/version-management/mercurial/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 258bc5d71ddc6..f347ed884eff5 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -21,11 +21,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.5";
+    version = "6.5.1";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "sha256-pWA9DTlev2f+XSeruzvTf8wBhx7POUx5NnLSweaL5+c=";
+      sha256 = "sha256-M/fejYs2B/orQIzeS4cl4RfrCtQZJqeH6qtAnKik/C8=";
     };
 
     format = "other";
@@ -35,7 +35,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "mercurial-${version}";
-      sha256 = "sha256-umjOU3OmTdPmLS4IWncqmKxSa6J4KXwTlGhylFt6TQo=";
+      sha256 = "sha256-tPv0UeZOsHDGKzXWeA/fFio7d3EN+KGioDu/1WH1drc=";
       sourceRoot = "mercurial-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;

From e6990d6cc40484fe09ce7309b955dbd85a6f0d32 Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Mon, 18 Jul 2022 01:32:12 +0200
Subject: [PATCH 100/154] python3Packages.ffmpy: init at 0.3.1

Co-authored-by: Yt <happysalada@tuta.io>
---
 .../python-modules/ffmpy/default.nix          | 55 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 57 insertions(+)
 create mode 100644 pkgs/development/python-modules/ffmpy/default.nix

diff --git a/pkgs/development/python-modules/ffmpy/default.nix b/pkgs/development/python-modules/ffmpy/default.nix
new file mode 100644
index 0000000000000..c3b0c6078f42f
--- /dev/null
+++ b/pkgs/development/python-modules/ffmpy/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, go
+, ffmpeg-headless
+}:
+
+buildPythonPackage rec {
+  pname = "ffmpy";
+  version = "0.3.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "Ch00k";
+    repo = "ffmpy";
+    rev = "refs/tags/${version}";
+    hash = "sha256-kuLhmCG80BmXdqpW67UanBnuYiL2Oh1jKt7IgmVNEAM=";
+  };
+
+  postPatch = ''
+    # default to store ffmpeg
+    substituteInPlace ffmpy.py \
+      --replace 'executable="ffmpeg",' 'executable="${ffmpeg-headless}/bin/ffmpeg",'
+
+    #  The tests test a mock that does not behave like ffmpeg. If we default to the nix-store ffmpeg they fail.
+    for fname in tests/*.py; do
+      echo 'FFmpeg.__init__.__defaults__ = ("ffmpeg", *FFmpeg.__init__.__defaults__[1:])' >>"$fname"
+    done
+  '';
+
+  pythonImportsCheck = [ "ffmpy" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    go
+  ];
+
+  # the vendored ffmpeg mock binary assumes FHS
+  preCheck = ''
+    rm -v tests/ffmpeg/ffmpeg
+    HOME=$(mktemp -d) go build -o ffmpeg tests/ffmpeg/ffmpeg.go
+    export PATH=".:$PATH"
+  '';
+
+  meta = with lib; {
+    description = "A simple python interface for FFmpeg/FFprobe";
+    homepage = "https://github.com/Ch00k/ffmpy";
+    license = licenses.mit;
+    maintainers = with maintainers; [ pbsds ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 68844e9cf7802..b391d4b864831 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3673,6 +3673,8 @@ self: super: with self; {
 
   ffmpeg-progress-yield = callPackage ../development/python-modules/ffmpeg-progress-yield { };
 
+  ffmpy = callPackage ../development/python-modules/ffmpy { };
+
   fiblary3-fork = callPackage ../development/python-modules/fiblary3-fork { };
 
   fido2 = callPackage ../development/python-modules/fido2 { };

From c0c84051fd74e070509dd4e4fcb86c5af39f636c Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Mon, 26 Jun 2023 22:04:00 +0200
Subject: [PATCH 101/154] python3Packages.markdown-it-py: fix linkify extra

linkify-it-py is on version 2.0.0, while markdown-it-py[linkify] depends on linkify-it-py~=1.0
---
 pkgs/development/python-modules/markdown-it-py/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/python-modules/markdown-it-py/default.nix b/pkgs/development/python-modules/markdown-it-py/default.nix
index 38d92159f3b2e..3330817fb8a46 100644
--- a/pkgs/development/python-modules/markdown-it-py/default.nix
+++ b/pkgs/development/python-modules/markdown-it-py/default.nix
@@ -19,6 +19,7 @@
 , stdenv
 , pytest-regressions
 , pytestCheckHook
+, pythonRelaxDepsHook
 , pythonOlder
 }:
 
@@ -36,7 +37,13 @@ buildPythonPackage rec {
     hash = "sha256-qdRU1BxczFDGoIEtl0ZMkKNn4p5tec8YuPt5ZwX5fYM=";
   };
 
+  # fix downstrem usage of markdown-it-py[linkify]
+  pythonRelaxDeps = [
+    "linkify-it-py"
+  ];
+
   nativeBuildInputs = [
+    pythonRelaxDepsHook
     flit-core
   ];
 

From 94ea536fc7a8fcba4b6e15f0c0d90a53c0ef2425 Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Mon, 18 Jul 2022 02:35:11 +0200
Subject: [PATCH 102/154] python3Packages.gradio: init at 3.20.1

Co-authored-by: Yt <happysalada@tuta.io>
---
 .../gradio/conftest-skip-network-errors.py    |  57 ++++++
 .../python-modules/gradio/default.nix         | 175 ++++++++++++++++++
 pkgs/top-level/python-packages.nix            |   2 +
 3 files changed, 234 insertions(+)
 create mode 100644 pkgs/development/python-modules/gradio/conftest-skip-network-errors.py
 create mode 100644 pkgs/development/python-modules/gradio/default.nix

diff --git a/pkgs/development/python-modules/gradio/conftest-skip-network-errors.py b/pkgs/development/python-modules/gradio/conftest-skip-network-errors.py
new file mode 100644
index 0000000000000..4738de3175526
--- /dev/null
+++ b/pkgs/development/python-modules/gradio/conftest-skip-network-errors.py
@@ -0,0 +1,57 @@
+# This is a pytest hook that skips tests that tries to access the network.
+# These tests will immediately fail, then get marked as "Expected fail" (xfail).
+
+from _pytest.runner import pytest_runtest_makereport as orig_pytest_runtest_makereport
+
+# We use BaseException to minimize the chance it gets caught and 'pass'ed
+class NixNetworkAccessDeniedError(BaseException):
+    pass
+
+def pytest_runtest_makereport(item, call):
+    """
+    Modifies test results after-the-fact. The function name is magic, see:
+    https://docs.pytest.org/en/7.1.x/reference/reference.html?highlight=pytest_runtest_makereport#std-hook-pytest_runtest_makereport
+    """
+
+    def iterate_exc_chain(exc: Exception):
+        """
+        Recurses through exception chain, yielding all exceptions
+        """
+        yield exc
+        if getattr(exc, "__context__", None) is not None:
+            yield from iterate_exc_chain(exc.__context__)
+        if getattr(exc, "__cause__", None) is not None:
+            yield from iterate_exc_chain(exc.__cause__)
+
+    tr = orig_pytest_runtest_makereport(item, call)
+    if call.excinfo is not None:
+        for exc in iterate_exc_chain(call.excinfo.value):
+            if isinstance(exc, NixNetworkAccessDeniedError):
+                tr.outcome, tr.wasxfail = 'skipped', "reason: Requires network access."
+            if isinstance(exc, FileNotFoundError):  # gradio specific
+                tr.outcome, tr.wasxfail = 'skipped', "reason: Pypi dist bad."
+    return tr
+
+# replace network access with exception
+
+def deny_network_access(*a, **kw):
+    raise NixNetworkAccessDeniedError
+
+import httpx
+import requests
+import socket
+import urllib
+import urllib3
+import websockets
+
+httpx.AsyncClient.get = deny_network_access
+httpx.AsyncClient.head = deny_network_access
+httpx.Request = deny_network_access
+requests.get = deny_network_access
+requests.head = deny_network_access
+requests.post = deny_network_access
+socket.socket.connect = deny_network_access
+urllib.request.Request = deny_network_access
+urllib.request.urlopen = deny_network_access
+urllib3.connection.HTTPSConnection._new_conn = deny_network_access
+websockets.connect = deny_network_access
diff --git a/pkgs/development/python-modules/gradio/default.nix b/pkgs/development/python-modules/gradio/default.nix
new file mode 100644
index 0000000000000..ffb99d7293287
--- /dev/null
+++ b/pkgs/development/python-modules/gradio/default.nix
@@ -0,0 +1,175 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, pythonRelaxDepsHook
+, writeText
+
+# pyproject
+, hatchling
+, hatch-requirements-txt
+, hatch-fancy-pypi-readme
+
+# runtime
+, setuptools
+, aiofiles
+, aiohttp
+, altair
+, fastapi
+, ffmpy
+, markdown-it-py
+, mdit-py-plugins
+, markupsafe
+, matplotlib
+, numpy
+, orjson
+, pandas
+, pillow
+, pycryptodome
+, python-multipart
+, pydub
+, pyyaml
+, requests
+, uvicorn
+, jinja2
+, fsspec
+, httpx
+, pydantic
+, websockets
+, typing-extensions
+
+# check
+, pytestCheckHook
+, pytest-asyncio
+, mlflow
+, huggingface-hub
+, transformers
+, wandb
+, respx
+, scikit-image
+, ipython
+, ffmpeg
+, vega_datasets
+, boto3
+}:
+
+buildPythonPackage rec {
+  pname = "gradio";
+  version = "3.20.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  # We use the Pypi release, as it provides prebuilt webui assets,
+  # and has more frequent releases compared to github tags
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-oG97GwehyBWjWXzDqyfj+x2mAfM6OQhYKdA3j0Rv8Vs=";
+  };
+
+  pythonRelaxDeps = [
+    "mdit-py-plugins"
+  ];
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    hatchling
+    hatch-requirements-txt
+    hatch-fancy-pypi-readme
+  ];
+
+  propagatedBuildInputs = [
+    setuptools # needs pkg_resources
+    aiofiles
+    aiohttp
+    altair
+    fastapi
+    ffmpy
+    markdown-it-py
+    mdit-py-plugins
+    markupsafe
+    matplotlib
+    numpy
+    orjson
+    pandas
+    pillow
+    pycryptodome
+    python-multipart
+    pydub
+    pyyaml
+    requests
+    uvicorn
+    jinja2
+    fsspec
+    httpx
+    pydantic
+    websockets
+    typing-extensions
+  ] ++ markdown-it-py.optional-dependencies.linkify;
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+    mlflow
+    #comet-ml # FIXME: enable once packaged
+    huggingface-hub
+    transformers
+    wandb
+    respx
+    scikit-image
+    ipython
+    ffmpeg
+    vega_datasets
+    boto3
+    # shap is needed as well, but breaks too often
+  ];
+
+  # Add a pytest hook skipping tests that access network, marking them as "Expected fail" (xfail).
+  # We additionally xfail FileNotFoundError, since the gradio devs often fail to upload test assets to pypi.
+  preCheck = let
+  in ''
+    export HOME=$TMPDIR
+    cat ${./conftest-skip-network-errors.py} >> test/conftest.py
+  '';
+
+  disabledTests = [
+    # Actually broken
+    "test_mount_gradio_app"
+
+    # FIXME: enable once comet-ml is packaged
+    "test_inline_display"
+    "test_integration_comet"
+
+    # Flaky, tries to pin dependency behaviour. Sensitive to dep versions
+    # These error only affect downstream use of the check dependencies.
+    "test_no_color"
+    "test_in_interface_as_output"
+    "test_should_warn_url_not_having_version"
+
+    # Flaky, unknown reason
+    "test_in_interface"
+
+    # shap is too often broken in nixpkgs
+    "test_shapley_text"
+  ];
+  disabledTestPaths = [
+    # makes pytest freeze 50% of the time
+    "test/test_interfaces.py"
+  ];
+  #pytestFlagsArray = [ "-x" "-W" "ignore" ]; # uncomment for debugging help
+
+  # check the binary works outside the build env
+  doInstallCheck = true;
+  postInstallCheck = ''
+    env --ignore-environment $out/bin/gradio --help >/dev/null
+  '';
+
+  pythonImportsCheck = [ "gradio" ];
+
+  meta = with lib; {
+    homepage = "https://www.gradio.app/";
+    description = "Python library for easily interacting with trained machine learning models";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ pbsds ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b391d4b864831..8f3191230641e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4475,6 +4475,8 @@ self: super: with self; {
 
   gradient_statsd = callPackage ../development/python-modules/gradient_statsd { };
 
+  gradio = callPackage ../development/python-modules/gradio { };
+
   grammalecte = callPackage ../development/python-modules/grammalecte { };
 
   grandalf = callPackage ../development/python-modules/grandalf { };

From f6332ded451f1acc9b176a6dd180b1a073f8b509 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Tue, 8 Aug 2023 03:45:14 -0700
Subject: [PATCH 103/154] python3.pkgs.ansi2html: dependency cleanup (#247246)

Some dependencies can be removed, and some build dependencies need to
be added to prepare for stricter dependency validation.
---
 .../python-modules/ansi2html/default.nix      | 32 +++++++++++++++----
 1 file changed, 26 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/ansi2html/default.nix b/pkgs/development/python-modules/ansi2html/default.nix
index 97553b1b31e1e..192ecaf2eab4c 100644
--- a/pkgs/development/python-modules/ansi2html/default.nix
+++ b/pkgs/development/python-modules/ansi2html/default.nix
@@ -1,22 +1,42 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k, six, mock, pytestCheckHook, setuptools, setuptools-scm }:
+{ lib
+, buildPythonPackage
+, fetchpatch
+, fetchPypi
+, pytestCheckHook
+, setuptools
+, setuptools-scm
+, wheel
+}:
 
 buildPythonPackage rec {
   pname = "ansi2html";
   version = "1.8.0";
   format = "pyproject";
 
-  disabled = !isPy3k;
-
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-OLgqKYSCofomE/D5yb6z23Ko+DLurFjrLke/Ms039tU=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
-  propagatedBuildInputs = [ six setuptools ];
+  patches = [
+    (fetchpatch {
+      name = "update-build-requirements.patch";
+      url = "https://github.com/pycontribs/ansi2html/commit/be9c47dd39e500b2e34e95efde90d0a3b44daaee.patch";
+      hash = "sha256-nvOclsgysg+4sK694ppls0BLfq5MCJJQW3V/Ru30D/k=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
 
   preCheck = "export PATH=$PATH:$out/bin";
-  nativeCheckInputs = [ mock pytestCheckHook ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "ansi2html" ];
 

From 72b94272c96eef5fe866d10fd76544e54789759c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Thu, 10 Aug 2023 10:49:37 +0200
Subject: [PATCH 104/154] python3Packages.oscrypto: fixup with openssl 3.0.10

---
 pkgs/development/python-modules/oscrypto/default.nix  |  4 ++++
 .../oscrypto/support-openssl-3.0.10.patch             | 11 +++++++++++
 2 files changed, 15 insertions(+)
 create mode 100644 pkgs/development/python-modules/oscrypto/support-openssl-3.0.10.patch

diff --git a/pkgs/development/python-modules/oscrypto/default.nix b/pkgs/development/python-modules/oscrypto/default.nix
index 3f368ba7f1abe..92edbdf84eb9e 100644
--- a/pkgs/development/python-modules/oscrypto/default.nix
+++ b/pkgs/development/python-modules/oscrypto/default.nix
@@ -22,6 +22,10 @@ buildPythonPackage rec {
     hash = "sha256-CmDypmlc/kb6ONCUggjT1Iqd29xNSLRaGh5Hz36dvOw=";
   };
 
+  patches = [
+    ./support-openssl-3.0.10.patch
+  ];
+
   postPatch = ''
     for file in oscrypto/_openssl/_lib{crypto,ssl}_c{ffi,types}.py; do
       substituteInPlace $file \
diff --git a/pkgs/development/python-modules/oscrypto/support-openssl-3.0.10.patch b/pkgs/development/python-modules/oscrypto/support-openssl-3.0.10.patch
new file mode 100644
index 0000000000000..585eb64eaa473
--- /dev/null
+++ b/pkgs/development/python-modules/oscrypto/support-openssl-3.0.10.patch
@@ -0,0 +1,11 @@
+https://github.com/wbond/oscrypto/issues/75
+--- a/oscrypto/_openssl/_libcrypto_cffi.py
++++ b/oscrypto/_openssl/_libcrypto_cffi.py
+@@ -37,1 +37,1 @@
+-version_match = re.search('\\b(\\d\\.\\d\\.\\d[a-z]*)\\b', version_string)
++version_match = re.search('\\b(\\d\\.\\d\\.\\d+[a-z]*)\\b', version_string)
+--- a/oscrypto/_openssl/_libcrypto_ctypes.py
++++ b/oscrypto/_openssl/_libcrypto_ctypes.py
+@@ -40,1 +40,1 @@
+-version_match = re.search('\\b(\\d\\.\\d\\.\\d[a-z]*)\\b', version_string)
++version_match = re.search('\\b(\\d\\.\\d\\.\\d+[a-z]*)\\b', version_string)

From e9b39616ec078addaf9cf23d175eff2506559ef7 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 10 Aug 2023 17:17:28 +0300
Subject: [PATCH 105/154] qt5: 5.15.9 -> 5.15.10

---
 .../libraries/qt-5/5.15/srcs-generated.json   | 160 +++++++++---------
 pkgs/development/libraries/qt-5/5.15/srcs.nix |   2 +-
 2 files changed, 81 insertions(+), 81 deletions(-)

diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index 20649c6f83a1d..f67f9d66da7ce 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -1,118 +1,118 @@
 {
   "qt3d": {
     "url": "https://invent.kde.org/qt/qt/qt3d.git",
-    "rev": "e94b0fa39a2f4bf260969fb18bf075dba39b2df1",
-    "sha256": "0mc7rym5pngpwpjghih7afjlyvvrlpdzw1wrbggykpmm8vrk5hzv"
+    "rev": "01aa0a9cb22ce5ed2b7ead03ed9cbeb5f978e897",
+    "sha256": "0r1bicsjn4addsf0cw2vkf26kxlf8z1fh65w19gnqmcwkrr8hnja"
   },
   "qtactiveqt": {
     "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
-    "rev": "38635c3b343ce30b71e44c5a59f2f7393fba8259",
-    "sha256": "010jh2vdlymaxs1wd0agzb2gvgms9xrhs4vb5bjiiq5pys1sgkbp"
+    "rev": "7a04a93e97390de2d91e89dc907e8240dd5a0c4f",
+    "sha256": "1bqy5cmimnlmgd02zpv0ipf74nx350fk0d4pm2j4pqipq1spq3bh"
   },
   "qtandroidextras": {
     "url": "https://invent.kde.org/qt/qt/qtandroidextras.git",
-    "rev": "b458aee3f907f2ce1880ad4031abecb2a1eab90a",
-    "sha256": "14vn9k80ilc2smaflnamyg5k0ddj3n4m123yfwb79rfg3lddhvs5"
+    "rev": "1170e17043ff51590ccee30447bef1e43a999b0d",
+    "sha256": "0qhlhz7ng35mb5pmva9ivpxq1ib30dz8f1p93yil78cyl9mwqbbi"
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "a196623892558623e467f20b67edb78794252a09",
-    "sha256": "0yna2k1w595xwh9bk268h31fjl2ff8cm185dmm0v5gr4w8h9yr4g"
+    "rev": "e24dc54b2b4054413650904288aa7a363eee23a7",
+    "sha256": "0gpg0avl06jbamgk5f9034cfqwyifgv4nyqx49rp0r9wm2m1cgxb"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
-    "rev": "3d4a84eb6d62ce22a47794f309f9268729ac375f",
-    "sha256": "047hl5hd0l337b7bsc28lfx9p9jbrnqswfdk80ndvgvp96ziblg5"
+    "rev": "7ce22b0633eb9d1eb59854fee4f2f545e1b842e0",
+    "sha256": "0q173ql5xyacwb5lwyrzhgch1bbjq4mmsfwhyssm3a9phqcj083m"
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "e6d37133affc71451129d84790c6c22227e64aff",
-    "sha256": "1bc1d0h2f1q0xfvr8p5fq1580bl8cs0qhdncm600v590z56cyika"
+    "rev": "eeaf42bccd49e8161fbae82d110026d25a5a9a7f",
+    "sha256": "0daa72yizb6v28bci72fw1w8y8al0mhb9k7kxn7vg22fbb3iyksf"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
-    "rev": "7636478bb30f0af8afe9af429eb8512d6fbcc11b",
-    "sha256": "08xkhxwp5mlcp4q45adqn58p37wn2z2zabw23f51qvfw8rir9g62"
+    "rev": "d366b0aad8454355acac79eddbab445c1108b1e9",
+    "sha256": "15ad1cbfdwnl6lnafgd4chdsl9wnwfcqqnd2m0dwj10n2lsa3nmw"
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "039ce261b0f8061f8485f9c2eaf497a4d4395baa",
-    "sha256": "1kp2pnwfcwsxhy2w1sdg722d0kb1i6kx3a9r42gl1i9d73k8afi2"
+    "rev": "3e98cdb2780d052fce3d7a3694596a690cd76aca",
+    "sha256": "15fn0zjfz7jnjgc7m368sna2mvhcp33r85r2kwc9hy7zkp1is6a1"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
-    "rev": "701325d57940c6e54353d0d4b6c3ebac6f9688a3",
-    "sha256": "01x2075d71z3ag99dppixs1y85zrr0vck0piah62l9n0v3wz4r6p"
+    "rev": "9dfbbfb9971db22d51eb40d6636583df5913be01",
+    "sha256": "1l192k1w5mjw14zq3h3pjb3m0zl56fhgxdjfxhmbncjx0ym98wzr"
   },
   "qtgamepad": {
     "url": "https://invent.kde.org/qt/qt/qtgamepad.git",
-    "rev": "7c05744e38d44afac687df3349d548c8790837db",
-    "sha256": "0j8rak512f96i0wy4n0d4fjsgfzn283k2kfpn93d2blld4r2rd5s"
+    "rev": "f90bd729eb70d4a0770efed3f9bb1b6dbe67d37c",
+    "sha256": "1vbfmyb51lv3ms0iyizi05jiba688scjwxwvyrr8qnmg4qrjqjd5"
   },
   "qtgraphicaleffects": {
     "url": "https://invent.kde.org/qt/qt/qtgraphicaleffects.git",
-    "rev": "06cfcbb6940d2729f5a6575e264873ce65ac99c3",
-    "sha256": "02jc7q7ijmhmffdp2ql2j3fw8ag7q98xlq40pywmzgrf1ggb34sw"
+    "rev": "500ae59f809877e0ada9a68601564882f2733145",
+    "sha256": "0p8vxp5l7iihd1xww94asnb9xv2v94p9whqbljzn6gwr56wvys5l"
   },
   "qtimageformats": {
     "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
-    "rev": "c249f58541afa45955c23b75c1fb88c5e3e4d18b",
-    "sha256": "025fxiy6ahgfqw3w7a08r2ff4ry2m1qn65haimpnn6bmi4vp88m8"
+    "rev": "5aa33ec870977863c400103db94da452edbaf414",
+    "sha256": "02i3ns2ijiiy0jfad3lxrvvlr38bgarl8246ka0y8aa8by1ih35b"
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "30fb93cf8521f2c0b3803903153d9034b7d7bcc2",
-    "sha256": "1b027hfc1m2nz0v906w08srmpyci3362arxc18cin334yhgghbx1"
+    "rev": "664701dc3acfca37500bc84ba03eed4953b684e9",
+    "sha256": "0nlzjksfzkjhla89warkj7c5h8z2h5ivnhnq1sw2385gfd4q5d8w"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
-    "rev": "f9f123a97989638c36b5c2b03f4ff6261ddaed9a",
-    "sha256": "06b5rjzqd1630c87spldxxd0bvkb94sbnaxwxbi7ac74k35ydq7s"
+    "rev": "f65b6a268832fc86e1263a6597f2e369aefecd19",
+    "sha256": "157in9bvnd9q2jigrrl955y7d2gpj308g8mg7k19r1vaz6h4zlm7"
   },
   "qtmacextras": {
     "url": "https://invent.kde.org/qt/qt/qtmacextras.git",
-    "rev": "209e3ddcf0a6b48ff47a7dc97f2ea38470c8780d",
-    "sha256": "09aipbnalb44w6g3kzm9dc84ls2xmp1clwmy5zd012xsvjwqd3h5"
+    "rev": "ca5e5fdca44e8e56dafaac2a5bd886cad2a5c0f5",
+    "sha256": "1yrk7kj5dvfcha8w0abvh8xfjn6nbl4njm1r2h2776l3sf46xd4c"
   },
   "qtmultimedia": {
     "url": "https://invent.kde.org/qt/qt/qtmultimedia.git",
-    "rev": "ff4c7bc3bf7ba4b748fdeb9d09887271c2b28505",
-    "sha256": "14wx49mkqqzvwzhbx3jhbrjngq4vb3x2kmgzrq7f6nri0g7dpss8"
+    "rev": "78d05cfcec57a9e890cb5ddbea604f194e04315d",
+    "sha256": "1vf0gmf6bh3hadrrk0922dbagmvxi1il3pjiyhmz087bm80km1md"
   },
   "qtnetworkauth": {
     "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git",
-    "rev": "59311ee7d78a8b19d3dbe61cf49d42c5bd7c934a",
-    "sha256": "1rdgfmfsqp3hdkkq6bi8vdxgrh45xzf1b2nryhnk8pid81wa2bzq"
+    "rev": "a0f23c6a1f11bd7c6a8e4fd34f10bdb0a35789fa",
+    "sha256": "0sy2s7xnq2xmqm3lcp439wn6zk6znzja489gh531mmkaj13kiqa9"
   },
   "qtpurchasing": {
     "url": "https://invent.kde.org/qt/qt/qtpurchasing.git",
-    "rev": "5737c10128c6eeb28c10df569c8492bb2e8f4230",
-    "sha256": "0iny9npc7w7b1rz9yx659bva66rllhbfqh4af9wdwbi9ssr4x5pc"
+    "rev": "a3e675872e4b323f89b94b90b66caa945b576b2e",
+    "sha256": "0b6da91fja6w3mphsfydp0plcwmk8nywhd5v8irgc98v1hw114dg"
   },
   "qtquick3d": {
     "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
-    "rev": "ccd0284235e9e3e1f97d808125af5024d3f04140",
-    "sha256": "1mfw97v60fdszab0gqxjydw00f89rx8clw3dq72zx1rgv8rn2s67"
+    "rev": "353f50a9851518eb637181c00302cd354e0ae98b",
+    "sha256": "1y269yamhlf46rwcvwzhdqhajyqj41xxf9x0l1nrcr4n07l4mbr8"
   },
   "qtquickcontrols": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
-    "rev": "eb9dead185ae209dd2364d09db74d8ab613d982d",
-    "sha256": "1pza9cjv49x59lvzyv45hwz01z8l9zzn8a3ssazycxvcq3w0pncb"
+    "rev": "0ea7cfdfbfa72d467fe542cc48ab3206c177a387",
+    "sha256": "1bvg32cz4x00j9333yas7cmfzx8rlhika4a9vwdikrr5a64awsl9"
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "68a48018e34322edaf611639710b3edbe389e8c2",
-    "sha256": "04hswsamjmwgn63gs3rhxygvwjfqx5f0qifzp3gp6q4fw8lkgwpf"
+    "rev": "0472a07a8f39587052216d85a7ed235c531eba2c",
+    "sha256": "1psal4kldwbhfgg0b234dhgm30s5q83g2krcik1p4sifrzgrry3r"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
-    "rev": "dd5d4af65890baad8baa85a445a752a877a4f7e3",
-    "sha256": "1m096pskaxhzxyvz17lksg1qlni7qacvqf3z71wvwvxzgjvs5bqh"
+    "rev": "4956b556ccb021e4691f314ab907ea2ebb1ca8a6",
+    "sha256": "0d6w36pvnk616ps7k1ykpk2ahcvn746svwmv3dxvf4capfij96rj"
   },
   "qtremoteobjects": {
     "url": "https://invent.kde.org/qt/qt/qtremoteobjects.git",
-    "rev": "27b496d5aff650e4cf9a3148857c723dce10ef25",
-    "sha256": "0wyf1nb6wjh4jd2n8cng7a6lzv1dkwrniabsvn1adl1nqknq7asv"
+    "rev": "d10e7673218fa2b00191a82ad20cd3304a711fa6",
+    "sha256": "0z5dzgdr92yw3y5vx6l9r9kz81r0vvwi264la9r7j20jqb75i2a5"
   },
   "qtscript": {
     "url": "https://invent.kde.org/qt/qt/qtscript.git",
@@ -121,87 +121,87 @@
   },
   "qtscxml": {
     "url": "https://invent.kde.org/qt/qt/qtscxml.git",
-    "rev": "d30a77111835395828fdcaa89a88110c5d9f6857",
-    "sha256": "1yid5653653qlpk305y276gdrifdxpjzfa1629csq2b8hpwkddc2"
+    "rev": "7f276be586be79d41213a8dd05ef31144313d440",
+    "sha256": "0yiryqzs44nx5lg54gbs7gf5n2d5chybya71kcv0iwn48dbzy33n"
   },
   "qtsensors": {
     "url": "https://invent.kde.org/qt/qt/qtsensors.git",
-    "rev": "391c710b88865a3e0311b61d93fcdbbfd6996d46",
-    "sha256": "19myf3w6g64clj9msy71is7b9krkfrzcqlyza37m3pimy7x305a0"
+    "rev": "45c04582b15a9bb4be01ae99aa7fda1bbba7d0df",
+    "sha256": "0wp9ddna0zidl18707nrqsg8sybaggam0hmm9yxyyfnsr39wms4m"
   },
   "qtserialbus": {
     "url": "https://invent.kde.org/qt/qt/qtserialbus.git",
-    "rev": "f8684ae6b0c12b6b21f1547fabe38b60c39f8893",
-    "sha256": "0k60wibb2xis7gvx9d7q14a3sq1ij1m196ax4rfwwrzsz2vviir0"
+    "rev": "b3081c36baee48b43b6285b4811dc6da451e2390",
+    "sha256": "167bmp5wrp9mflvzhgc2am9nnyw1vb58skdxjn7ag8jq88fhv0zz"
   },
   "qtserialport": {
     "url": "https://invent.kde.org/qt/qt/qtserialport.git",
-    "rev": "7fb308ec721f034a0d673784d951577d764a8e67",
-    "sha256": "1f8sjyd7ksy4420lr6vn18mzb64jm0p8mml5d2vpgp344w2jbqm0"
+    "rev": "af58a4c62415fbfd997c43422acf93e2e6ab5155",
+    "sha256": "1ihjj7gqjy75ccf4qniilddyiknjklc88mxns6sy8wz3ymr58vfh"
   },
   "qtspeech": {
     "url": "https://invent.kde.org/qt/qt/qtspeech.git",
-    "rev": "4856b6e231d7e2373ec8f89e861603a0d815793a",
-    "sha256": "0v8lx6g43apfnyn37ccgjnq7abayplgnihx62fncgl2cpmy9nkha"
+    "rev": "75142c77cda8ef3a5c1cae69863e963797c667b5",
+    "sha256": "0iaw13vx80yfcchkmrmp6n79i0i6b9rv7k69xxp3wb3l5d3n0ng0"
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "837b5163e17edbd3a9f098e9a1ab73febab419b4",
-    "sha256": "082i9q36d44g5a3jbw3ahvmmxikfai50wd2yq8xvkh8kr8xr7n5z"
+    "rev": "37b2c764fb599c96fc415049208e871c729217c8",
+    "sha256": "11h0n9k6l4r97x6h1m09nzsblwmmkkj46nl80dnvjimb395d71ri"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",
-    "rev": "5649efd376ed7dbb171905e9edebbd547d1f73eb",
-    "sha256": "1c49v7pni6bljnf4ppxrrdr0h0hpw4i7s6an91m7ca18s8x4m1rb"
+    "rev": "9f7af2d08eea7c2a2a2bfe7e6a9b73d1b99f5123",
+    "sha256": "1vb6s9zy8nw6gd0kmk77bjvxwpnfbhaifrznp019zccckibzffsg"
   },
   "qttranslations": {
     "url": "https://invent.kde.org/qt/qt/qttranslations.git",
-    "rev": "2b802231af3eb21c3c781753aba804217f855e86",
-    "sha256": "1xdp1x6qkdm0xz8yg1j2c1fpav54c1rwxlpfj116xspfik4zy7gf"
+    "rev": "a680686754d84b91d4cc4252a2fb8af0c58f5f49",
+    "sha256": "1i92mk6f2ldwq12qa4wnlz52zya4nlpjm3r2vy95vkj69xi2bfk3"
   },
   "qtvirtualkeyboard": {
     "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
-    "rev": "4191fd9098ae25ffd5917370427460842e73f0cb",
-    "sha256": "0jl9dw1azh961hcakmyxavfm0w7g1a89lyj2bal8dqvv9y3089cj"
+    "rev": "72373522141dd3206183eb5fa56ae1c36a6d4c2b",
+    "sha256": "1ndgy8jxn9f7dwg9kydhlbll20qdivfbvdlcxk8qpzilpccd2l3z"
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "c4c3fc69250c01cb35aaae5ea1ea2bcc8236dff0",
-    "sha256": "040wgrxr2kkshpyg3gwcggdxlxrjd7pbnr3fj8v63byx34sz2w9b"
+    "rev": "d4f650b6c29c621c58bc7b7e7c9ddcbbbc72e3b4",
+    "sha256": "11xqpj36mfyfhcip89i82dyclbkvs77byffax2kscv1kdj3x7w2l"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
-    "rev": "c508ffb1996eeddfd10dda493974746e6b375080",
-    "sha256": "0hs7cqfiwc0mdsa9zngackfljy7d5306mpn3rwjfi5rawd85xsp0"
+    "rev": "74c0625337c8a8de0a465878c7e7d238e8d979ed",
+    "sha256": "0yz2sg8k3l88ngsgyfb6cljh8x5sicww59m447xk7yngxgyaj75m"
   },
   "qtwebglplugin": {
     "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
-    "rev": "64beacdd2d0f6fe0796bd291c9ab33f206a333c3",
-    "sha256": "1vqmxkfzggsalq2ic2b902jy0b47zkgzl95gg8dia8089vfny4kn"
+    "rev": "13202e8a8c0c6d39026344b5a19a0148592160bc",
+    "sha256": "0gki7hc3684qhqbq7i4wa3w7szy3j6af0yfd50q2mxb1lbxjsdrx"
   },
   "qtwebsockets": {
     "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "ed7416b1b8af9de9926388408469a35f2ad6a795",
-    "sha256": "1434bqqb1hm49b1acwb22b2lc9p936dlylg0m56h2pl4vv9w0v3b"
+    "rev": "89fbe461e7091ae6a4689b7791293a06c9167776",
+    "sha256": "15vkh80rma5l9mrmg41vhxvqxlzqjzl8x20k33xm11lw2kjsszm5"
   },
   "qtwebview": {
     "url": "https://invent.kde.org/qt/qt/qtwebview.git",
-    "rev": "23d67d0de3301dbed5d8c5880b6cf60bfa9eeb2a",
-    "sha256": "16rqz6jiiswaiwa7hn6pn0cq9la8843b4jxi8di30ymq9ysivbqq"
+    "rev": "7e941648610ff4033ae8f9709077edd0595364f0",
+    "sha256": "082w4r674fq7ks5jbh3pj3xb3sqlhn4giy7fy0h3vw170lmcqz0m"
   },
   "qtwinextras": {
     "url": "https://invent.kde.org/qt/qt/qtwinextras.git",
-    "rev": "44d18eaff83b7491a130e41678cadcc3ba836a8d",
-    "sha256": "10fky86gcma9fwdbk3s733x7gqgxzsg6iaf9j42b0f8c2n5jhql3"
+    "rev": "5afc77f5347113b607ca0262505f3406e1be5bf4",
+    "sha256": "1a7dm0dxqq817pib1y6m0f09sc2cqd1qkfb9anznsgpmzynvfp6r"
   },
   "qtx11extras": {
     "url": "https://invent.kde.org/qt/qt/qtx11extras.git",
-    "rev": "8bba77a558049727d1bc88736dd03d1b5c41cead",
-    "sha256": "1lk4jm2pp0n8disxpcr1520bd798lif23fisnmkzysxcrlw1dflh"
+    "rev": "74f81f0bfe17e5aabcebafcb0cf36f739133554c",
+    "sha256": "1akp4mwvfspxdq5akpyphf6p3ay0z9pzaigiiy198w9q0yvrkgl7"
   },
   "qtxmlpatterns": {
     "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
-    "rev": "fa0c41677ab43bc50bc4d086dfce96602060b7e0",
-    "sha256": "1wrh1m9s4pdbvlgy93jv6acn9k1an6jb086cbxscgimgw3kb867p"
+    "rev": "0c1dcfe344c03d48d753aeb58f139bc990f2611c",
+    "sha256": "1cab7y9asivdg9ypwc951pczf4ddgni60l1ajlfsprk48rypr7w1"
   }
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index d47f9705d2124..40ed49d0fdc9b 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -1,7 +1,7 @@
 { lib, fetchgit, fetchFromGitHub }:
 
 let
-  version = "5.15.9";
+  version = "5.15.10";
   overrides = {};
 
   mk = name: args:

From 61f38f6046f0441bf59b008b0597920d94263ddf Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 10 Aug 2023 00:14:13 -0700
Subject: [PATCH 106/154] protobuf: move abseil-cpp to propagatedBuildInputs

---
 pkgs/development/libraries/protobuf/generic-v3-cmake.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
index cca7a1eaa92c5..7270f0cbf6075 100644
--- a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
+++ b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
@@ -68,10 +68,13 @@ let
     ];
 
     buildInputs = [
-      abseil-cpp
       zlib
     ];
 
+    propagatedBuildInputs = [
+      abseil-cpp
+    ];
+
     cmakeDir = if lib.versionOlder version "3.22" then "../cmake" else null;
     cmakeFlags = [
       "-Dprotobuf_ABSL_PROVIDER=package"

From 71f1732d40df62d4a9467890e745424a28a27144 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 10 Aug 2023 00:14:27 -0700
Subject: [PATCH 107/154] protobufc: 1.4.1 -> unstable-2023-07-08

---
 .../development/libraries/protobufc/default.nix | 17 ++++-------------
 1 file changed, 4 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/libraries/protobufc/default.nix b/pkgs/development/libraries/protobufc/default.nix
index dc3b2c92f1913..d152512783f0e 100644
--- a/pkgs/development/libraries/protobufc/default.nix
+++ b/pkgs/development/libraries/protobufc/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , autoreconfHook
 , pkg-config
 , protobuf
@@ -11,28 +10,20 @@
 
 stdenv.mkDerivation rec {
   pname = "protobuf-c";
-  version = "1.4.1";
+  version = "unstable-2023-07-08";
 
   src = fetchFromGitHub {
     owner = "protobuf-c";
     repo = "protobuf-c";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-TJCLzxozuZ8ynrBQ2lKyk03N+QA/lbOwywUjDUdTlbM=";
+    rev = "fa86fddbd000316772d1deb5a8d1201fa7599ef7";
+    hash = "sha256-pmqZYFREPgSrWPekymTglhtAv6gQR1gP3dOl3hqjYig=";
   };
 
-  patches = [
-    # https://github.com/protobuf-c/protobuf-c/pull/534
-    (fetchpatch {
-      url = "https://github.com/protobuf-c/protobuf-c/commit/a6c9ea5207aeac61c57b446ddf5a6b68308881d8.patch";
-      hash = "sha256-wTb8+YbvrCrOVpgthI5SJdG/CpQcOzCX4Bv47FPY804=";
-    })
-  ];
-
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [ protobuf zlib ];
 
-  PROTOC = lib.getExe buildPackages.protobuf;
+  env.PROTOC = lib.getExe buildPackages.protobuf;
 
   meta = with lib; {
     homepage = "https://github.com/protobuf-c/protobuf-c/";

From b606993d672e031e07d64f96489104877ab3617a Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 10 Aug 2023 16:51:57 +0200
Subject: [PATCH 108/154] postgresql_11: 11.20 -> 11.21

https://www.postgresql.org/docs/release/11.21/
---
 pkgs/servers/sql/postgresql/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 307c9f5f4e328..7398b68f23b7c 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -307,10 +307,12 @@ let
   };
 
   mkPackages = self: {
+    # TODO: remove ahead of 23.11 branchoff
+    # "PostgreSQL 11 will stop receiving fixes on November 9, 2023"
     postgresql_11 = self.callPackage generic {
-      version = "11.20";
+      version = "11.21";
       psqlSchema = "11.1"; # should be 11, but changing it is invasive
-      hash = "sha256-PXyIgvZKfphTSgRCV9/uerrXelt9oSUI2F1yK5i1rM4=";
+      hash = "sha256-B7CDdHHV3XeyUWazRxjzuhCBa2rWHmkeb8VHzz/P+FA=";
       this = self.postgresql_11;
       thisAttr = "postgresql_11";
       inherit self;

From 363048444bd07577fcdc6ec911b9fedd20d94c64 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 10 Aug 2023 16:52:39 +0200
Subject: [PATCH 109/154] postgresql_12: 12.15 -> 12.16

https://www.postgresql.org/docs/release/12.16/
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 7398b68f23b7c..94416ffcd3b89 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -319,9 +319,9 @@ let
     };
 
     postgresql_12 = self.callPackage generic {
-      version = "12.15";
+      version = "12.16";
       psqlSchema = "12";
-      hash = "sha256-u1IG4oZMHEV5k4uW6mCW0VXyKr8tLMKqV1cePEyxKzY=";
+      hash = "sha256-xfH/96D5Ph7DdGQXsFlCkOzmF7SZXtlbjVJ68LoOOPM=";
       this = self.postgresql_12;
       thisAttr = "postgresql_12";
       inherit self;

From f256648786200f9604385b99abf6a570b48ae475 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 10 Aug 2023 16:52:51 +0200
Subject: [PATCH 110/154] postgresql_13: 13.11 -> 13.12

https://www.postgresql.org/docs/release/13.12/
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 94416ffcd3b89..5eac546328f55 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -328,9 +328,9 @@ let
     };
 
     postgresql_13 = self.callPackage generic {
-      version = "13.11";
+      version = "13.12";
       psqlSchema = "13";
-      hash = "sha256-SZL/ZHIDVmtnDU5U3FMXSZomhWyTV20OqVG99r7lC/s=";
+      hash = "sha256-DaHtzuNRS3vHum268MAEmeisFZBmjoeJxQJTpiSfIYs=";
       this = self.postgresql_13;
       thisAttr = "postgresql_13";
       inherit self;

From 8f5976b479152ae8c5372a29ba9b7d38fd420431 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 10 Aug 2023 16:53:04 +0200
Subject: [PATCH 111/154] postgresql_14: 14.8 -> 14.9

https://www.postgresql.org/docs/release/14.9/
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 5eac546328f55..9f77782424ee4 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -337,9 +337,9 @@ let
     };
 
     postgresql_14 = self.callPackage generic {
-      version = "14.8";
+      version = "14.9";
       psqlSchema = "14";
-      hash = "sha256-OdOPADBzftA4Nd6+7+47N9M1RizkmV4kl7w41iHr5Fo=";
+      hash = "sha256-sf47qbGn86ljfdFlbf2tKIkBYHP9TTXxO1AUPLu2qO8=";
       this = self.postgresql_14;
       thisAttr = "postgresql_14";
       inherit self;

From 061c96b486cc471185b38b56cd0c962c122336cc Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 10 Aug 2023 16:53:16 +0200
Subject: [PATCH 112/154] postgresql_15: 15.3 -> 15.4

https://www.postgresql.org/docs/release/15.4/
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 9f77782424ee4..6d9bf528c07cd 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -346,9 +346,9 @@ let
     };
 
     postgresql_15 = self.callPackage generic {
-      version = "15.3";
+      version = "15.4";
       psqlSchema = "15";
-      hash = "sha256-/8fUiR8A/79cP06rf7vO2EYLjA7mPFpRZxM7nmWZ2TI=";
+      hash = "sha256-uuxaS9xENzNmU7bLXZ7Ym+W9XAxYuU4L7O4KmZ5jyPk=";
       this = self.postgresql_15;
       thisAttr = "postgresql_15";
       inherit self;

From 0869c1bef76d6237130c180b3b8f8355884e6a81 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 10 Aug 2023 22:38:13 -0700
Subject: [PATCH 113/154] python3.pkgs.dbus-fast: build cython optimized
 version (#247308)

---
 pkgs/development/python-modules/dbus-fast/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/development/python-modules/dbus-fast/default.nix b/pkgs/development/python-modules/dbus-fast/default.nix
index ec01d5ab3327b..747deb2a4eb78 100644
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@@ -1,12 +1,14 @@
 { lib
 , async-timeout
 , buildPythonPackage
+, cython_3
 , fetchFromGitHub
 , poetry-core
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
 , setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -23,9 +25,15 @@ buildPythonPackage rec {
     hash = "sha256-B+NW7ORKIBtjxeR0W0tX7V1MgBtNoyGFX35TXUl7rVE=";
   };
 
+  # The project can build both an optimized cython version and an unoptimized
+  # python version. This ensures we fail if we build the wrong one.
+  env.REQUIRE_CYTHON = 1;
+
   nativeBuildInputs = [
+    cython_3
     poetry-core
     setuptools
+    wheel
   ];
 
   propagatedBuildInputs = [

From 4f6efcf85a79385e33694ffbab7a95135d58f498 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 10 Aug 2023 22:39:09 -0700
Subject: [PATCH 114/154] python3.pkgs.bluetooth-data-tools: 1.6.1 -> 1.7.0
 (#247272)

At the same time, switch to using the Cython version for better
performance.
---
 .../python-modules/bluetooth-data-tools/default.nix  | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/bluetooth-data-tools/default.nix b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
index 918cba4f54b1a..a68f8c8da4304 100644
--- a/pkgs/development/python-modules/bluetooth-data-tools/default.nix
+++ b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, cython_3
 , poetry-core
 , pytestCheckHook
 , pythonOlder
@@ -9,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "bluetooth-data-tools";
-  version = "1.6.1";
+  version = "1.7.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -18,10 +19,15 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-A3zdM2kVmz8cUix9JT8cnIABZK64r6yiZisvb8A1RSQ=";
+    hash = "sha256-EmZPiZKm/80nJpPnJWhI9i4I6MhgQMifLOEUBFLqbSw=";
   };
 
+  # The project can build both an optimized cython version and an unoptimized
+  # python version. This ensures we fail if we build the wrong one.
+  env.REQUIRE_CYTHON = 1;
+
   nativeBuildInputs = [
+    cython_3
     poetry-core
     setuptools
   ];
@@ -43,7 +49,7 @@ buildPythonPackage rec {
     description = "Library for converting bluetooth data and packets";
     homepage = "https://github.com/Bluetooth-Devices/bluetooth-data-tools";
     changelog = "https://github.com/Bluetooth-Devices/bluetooth-data-tools/blob/v${version}/CHANGELOG.md";
-    license = with licenses; [ asl20 ];
+    license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
 }

From 03ef7028ce6e181b48f11c8e8a5b8c71c6c452c5 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 10 Aug 2023 22:47:18 -0700
Subject: [PATCH 115/154] python3.pkgs.orjson: 3.9.2 -> 3.9.4 (#248273)

---
 pkgs/development/python-modules/orjson/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/orjson/default.nix b/pkgs/development/python-modules/orjson/default.nix
index bdcd705268696..934b65298f4e5 100644
--- a/pkgs/development/python-modules/orjson/default.nix
+++ b/pkgs/development/python-modules/orjson/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "orjson";
-  version = "3.9.2";
+  version = "3.9.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,13 +25,13 @@ buildPythonPackage rec {
     owner = "ijl";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-uEwlrWPQbctCMiIz4fdXe2GDr2SSHaMzmYzzrECerxg=";
+    hash = "sha256-WS4qynQmJIVdDf0sYK/HFVQ+F5nfoJwx/zzmaL6YTRc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-U/WenkO7ecZQOGEppBlLtlXGtbpbS7e+Ic1hg/AnKSk=";
+    hash = "sha256-hGUXPTiKvKygxQzxXAO/+bD34eLnpkhQ7r/g27E+d4I=";
   };
 
   nativeBuildInputs = [

From 9dd8601a6dea9c4217a1b494cc802377d89c45fa Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 10 Aug 2023 22:52:16 -0700
Subject: [PATCH 116/154] python3.pkgs.josepy: fix tests with setuptools
 67.5.0+ (#246920)

---
 pkgs/development/python-modules/josepy/default.nix | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/josepy/default.nix b/pkgs/development/python-modules/josepy/default.nix
index 76004df63bc8f..f8a76641f537b 100644
--- a/pkgs/development/python-modules/josepy/default.nix
+++ b/pkgs/development/python-modules/josepy/default.nix
@@ -1,11 +1,11 @@
 { lib
 , buildPythonPackage
 , cryptography
+, fetchpatch
 , fetchPypi
 , pyopenssl
 , pytestCheckHook
 , pythonOlder
-, setuptools
 }:
 
 buildPythonPackage rec {
@@ -20,10 +20,19 @@ buildPythonPackage rec {
     hash = "sha256-iTHa84+KTIUnSg6LfLJa3f2NHyj5+4++0FPdUa7HXck=";
   };
 
+  patches = [
+    # https://github.com/certbot/josepy/pull/158
+    (fetchpatch {
+      name = "fix-setuptools-deprecation.patch";
+      url = "https://github.com/certbot/josepy/commit/8f1b4b57a29a868a87fd6eee19a67a7ebfc07ea1.patch";
+      hash = "sha256-9d+Bk/G4CJXpnjJU0YkXLsg0G3tPxR8YN2niqriQQkI=";
+      includes = [ "tests/test_util.py" ];
+    })
+  ];
+
   propagatedBuildInputs = [
     pyopenssl
     cryptography
-    setuptools
   ];
 
   nativeCheckInputs = [

From b5fde732b417a6e53262b197f905346242c1bfe2 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Thu, 10 Aug 2023 22:53:24 -0700
Subject: [PATCH 117/154] python3.pkgs.aiohttp: fix tests with setuptools
 67.5.0+ (#247310)

---
 .../python-modules/aiohttp/default.nix        |  4 +++
 .../setuptools-67.5.0-compatibility.diff      | 27 +++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 pkgs/development/python-modules/aiohttp/setuptools-67.5.0-compatibility.diff

diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index e2e2ebac9ae5f..b988abe60108f 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -6,6 +6,7 @@
 , pythonOlder
 # build_requires
 , setuptools
+, wheel
 # install_requires
 , attrs
 , charset-normalizer
@@ -49,6 +50,8 @@ buildPythonPackage rec {
       url = "https://github.com/aio-libs/aiohttp/commit/7dcc235cafe0c4521bbbf92f76aecc82fee33e8b.patch";
       hash = "sha256-ZzhlE50bmA+e2XX2RH1FuWQHZIAa6Dk/hZjxPoX5t4g=";
     })
+    # https://github.com/aio-libs/aiohttp/pull/7454 but does not merge cleanly
+    ./setuptools-67.5.0-compatibility.diff
   ];
 
   postPatch = ''
@@ -57,6 +60,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aiohttp/setuptools-67.5.0-compatibility.diff b/pkgs/development/python-modules/aiohttp/setuptools-67.5.0-compatibility.diff
new file mode 100644
index 0000000000000..2f75b6b4c1363
--- /dev/null
+++ b/pkgs/development/python-modules/aiohttp/setuptools-67.5.0-compatibility.diff
@@ -0,0 +1,27 @@
+diff --git a/setup.cfg b/setup.cfg
+index 6944b7e2..dfa65d69 100644
+--- a/setup.cfg
++++ b/setup.cfg
+@@ -128,6 +128,7 @@ filterwarnings =
+ 	ignore:Creating a LegacyVersion has been deprecated and will be removed in the next major release:DeprecationWarning::
+ 	ignore:module 'sre_constants' is deprecated:DeprecationWarning:pkg_resources._vendor.pyparsing
+ 	ignore:path is deprecated. Use files.. instead. Refer to https.//importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy for migration advice.:DeprecationWarning:certifi.core
++	ignore:pkg_resources is deprecated as an API:DeprecationWarning
+ junit_suite_name = aiohttp_test_suite
+ norecursedirs = dist docs build .tox .eggs
+ minversion = 3.8.2
+diff --git a/tests/test_circular_imports.py b/tests/test_circular_imports.py
+index 22e5ea47..a655fd1d 100644
+--- a/tests/test_circular_imports.py
++++ b/tests/test_circular_imports.py
+@@ -113,6 +113,10 @@ def test_no_warnings(import_path: str) -> None:
+         "-W",
+         "ignore:Creating a LegacyVersion has been deprecated and will "
+         "be removed in the next major release:DeprecationWarning:",
++        # Deprecation warning emitted by setuptools v67.5.0+ triggered by importing
++        # `gunicorn.util`.
++        "-W", "ignore:pkg_resources is deprecated as an API:"
++        "DeprecationWarning",
+         "-c", f"import {import_path!s}",
+         # fmt: on
+     )

From 0aaf677516f0960222c6fe7326d58f1408e3eca0 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 10 Aug 2023 17:17:35 +0300
Subject: [PATCH 118/154] qtwebengine: 5.15.13 -> 5.15.14, remove hack

---
 .../qt-5/5.15/qtwebengine-darwin-checks.patch |  8 ++---
 pkgs/development/libraries/qt-5/5.15/srcs.nix | 36 ++++---------------
 2 files changed, 11 insertions(+), 33 deletions(-)

diff --git a/pkgs/development/libraries/qt-5/5.15/qtwebengine-darwin-checks.patch b/pkgs/development/libraries/qt-5/5.15/qtwebengine-darwin-checks.patch
index 0d4154837829f..213fb624dab19 100644
--- a/pkgs/development/libraries/qt-5/5.15/qtwebengine-darwin-checks.patch
+++ b/pkgs/development/libraries/qt-5/5.15/qtwebengine-darwin-checks.patch
@@ -1,5 +1,5 @@
 diff --git a/configure.pri b/configure.pri
-index e072961f0..ac0861c01 100644
+index 3a33bdc82..c1460b8b5 100644
 --- a/configure.pri
 +++ b/configure.pri
 @@ -442,24 +442,6 @@ defineTest(qtwebengine_isWindowsPlatformSupported) {
@@ -24,6 +24,6 @@ index e072961f0..ac0861c01 100644
 -        qtwebengine_platformError("requires a macOS SDK version of 10.13 or newer. Current version is $${WEBENGINE_OSX_SDK_PRODUCT_VERSION}.")
 -        return(false)
 -    }
-     return(true)
- }
- 
+     CONFIG(debug, debug|release):isUniversal(){
+         qtwebengine_platformError("Universal builds can not be done with debug configuration due to large binary size.")
+         return(false)
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index 40ed49d0fdc9b..67403f3beba9a 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -74,37 +74,15 @@ lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
     hash = "sha256-LPfBCEB5tJOljXpptsNk0sHGtJf/wIRL7fccN79Nh6o=";
   };
 
-  qtwebengine =
-    let
-      branchName = "5.15.13";
-      rev = "v${branchName}-lts";
-    in
-    {
-      version = branchName;
+  qtwebengine = rec {
+      version = "5.15.14";
 
-      src = fetchgit {
-        url = "https://github.com/qt/qtwebengine.git";
-        sha256 = "sha256-gZmhJTA5A3+GeySJoppYGffNC6Ych2pOYlsu3w+fnmw=";
-        inherit rev branchName;
+      src = fetchFromGitHub {
+        owner = "qt";
+        repo = "qtwebengine";
+        rev = "v${version}-lts";
+        hash = "sha256-jIoNwRdr0bZ2p0UMp/KDQuwgNjhzzGlb91UGjQgT60Y=";
         fetchSubmodules = true;
-        leaveDotGit = true;
-        name = "qtwebengine-${lib.substring 0 8 rev}.tar.gz";
-        postFetch = ''
-          # remove submodule .git directory
-          rm -rf "$out/src/3rdparty/.git"
-
-          # compress to not exceed the 2GB output limit
-          # try to make a deterministic tarball
-          tar -I 'gzip -n' \
-            --sort=name \
-            --mtime=1970-01-01 \
-            --owner=root --group=root \
-            --numeric-owner --mode=go=rX,u+rw,a-s \
-            --transform='s@^@source/@' \
-            -cf temp  -C "$out" .
-          rm -r "$out"
-          mv temp "$out"
-        '';
       };
     };
 }

From 92dff845fa01423dc250d2e6e7062786e7ce4999 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Fri, 11 Aug 2023 09:19:40 +0200
Subject: [PATCH 119/154] gnutls: patch an API breakage from last update

https://github.com/NixOS/nixpkgs/pull/247704#issuecomment-1672810322
---
 pkgs/development/libraries/gnutls/default.nix | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 1ac761514ad1d..d50edb1ce983a 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -1,5 +1,6 @@
 { config, lib, stdenv, fetchurl, zlib, lzo, libtasn1, nettle, pkg-config, lzip
 , perl, gmp, autoconf, automake, libidn2, libiconv
+, fetchpatch, texinfo
 , unbound, dns-root-data, gettext, util-linux
 , cxxBindings ? !stdenv.hostPlatform.isStatic # tries to link libstdc++.so
 , tpmSupport ? false, trousers, which, nettools, libunistring
@@ -45,7 +46,15 @@ stdenv.mkDerivation rec {
   outputInfo = "devdoc";
   outputDoc  = "devdoc";
 
-  patches = [ ./nix-ssl-cert-file.patch ];
+  patches = [
+    (fetchpatch { #TODO: when updating drop this patch and texinfo
+      name = "GNUTLS_NO_EXTENSIONS.patch";
+      url = "https://gitlab.com/gnutls/gnutls/-/commit/abfa8634db940115a11a07596ce53c8f9c4f87d2.diff";
+      hash = "sha256-3M5WdNoVx9gUwTUPgu/sXmsaNg+j5d6liXs0UZz8fGU=";
+    })
+
+    ./nix-ssl-cert-file.patch
+  ];
 
   # Skip some tests:
   #  - pkg-config: building against the result won't work before installing (3.5.11)
@@ -80,7 +89,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional (withP11-kit) p11-kit
     ++ lib.optional (tpmSupport && stdenv.isLinux) trousers;
 
-  nativeBuildInputs = [ perl pkg-config ]
+  nativeBuildInputs = [ perl pkg-config texinfo ]
     ++ lib.optionals doCheck [ which nettools util-linux ];
 
   propagatedBuildInputs = [ nettle ]

From 09d32e2612b01472cd48a0b48bfab5479ac3811d Mon Sep 17 00:00:00 2001
From: James Baker <j.baker@outlook.com>
Date: Fri, 11 Aug 2023 09:49:25 +0100
Subject: [PATCH 120/154] nixos/virtualisation.docker: Do not assert 32 bit
 libraries available on ARM (#246179)

---
 nixos/modules/virtualisation/docker.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/virtualisation/docker.nix b/nixos/modules/virtualisation/docker.nix
index 20f47a76c87b9..6fe460316091b 100644
--- a/nixos/modules/virtualisation/docker.nix
+++ b/nixos/modules/virtualisation/docker.nix
@@ -236,8 +236,8 @@ in
       };
 
       assertions = [
-        { assertion = cfg.enableNvidia -> config.hardware.opengl.driSupport32Bit or false;
-          message = "Option enableNvidia requires 32bit support libraries";
+        { assertion = cfg.enableNvidia && pkgs.stdenv.isx86_64 -> config.hardware.opengl.driSupport32Bit or false;
+          message = "Option enableNvidia on x86_64 requires 32bit support libraries";
         }];
 
       virtualisation.docker.daemon.settings = {

From 39ed10c9100edb9c11943fa7d0eb7bd7968f4052 Mon Sep 17 00:00:00 2001
From: Tobias Mayer <tobim@fastmail.fm>
Date: Fri, 11 Aug 2023 15:32:35 +0200
Subject: [PATCH 121/154] grpc: 1.54.2 -> 1.57.0

---
 pkgs/development/libraries/grpc/default.nix               | 4 ++--
 pkgs/development/python-modules/grpcio-status/default.nix | 4 ++--
 pkgs/development/python-modules/grpcio-tools/default.nix  | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index 7ba6ec214cd04..7435ac723f7d0 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "grpc";
-  version = "1.54.2"; # N.B: if you change this, please update:
+  version = "1.57.0"; # N.B: if you change this, please update:
     # pythonPackages.grpcio-tools
     # pythonPackages.grpcio-status
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-OIRqH+h8Kjbw3X5slpdCfNN0f027WuvHG3q7KUuSWo8=";
+    hash = "sha256-ZPhPi4ODAAohCySVKeypaDID4ZUXvnfidOGK5EMXvh4=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/grpcio-status/default.nix b/pkgs/development/python-modules/grpcio-status/default.nix
index 27a2fb54da8d7..991549ea9ed9f 100644
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.54.2";
+  version = "1.57.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MlXL7Ft8cGyqPU3VhGBsCA5kFeFWMbsvYhXitwBVg20=";
+    hash = "sha256-sJjamd8e6+WDN/j3jlDfmQJzzKzBIm/d60fFkOPfngI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index 6012a9eb135c5..78e3cdaae7f1d 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.54.2";
+  version = "1.57.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4RwsKu5T80CZLo5NalkXLLu9AZPxNR3pjE+BClBB1co=";
+    hash = "sha256-LxYTDYac4n7NYjGUVHtkndZXMz7H6GRMxXHGRXgam4U=";
   };
 
   postPatch = ''

From bab20c7df7025b680038b276408546ac14b7afd4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Fri, 11 Aug 2023 16:51:03 +0200
Subject: [PATCH 122/154] gcc10: 10.4.0 -> 10.5.0

This dropped file now seems unused.
---
 pkgs/development/compilers/gcc/10/default.nix |  5 +--
 ...ix-struct-redefinition-on-glibc-2.36.patch | 41 -------------------
 2 files changed, 2 insertions(+), 44 deletions(-)
 delete mode 100644 pkgs/development/compilers/gcc/11/fix-struct-redefinition-on-glibc-2.36.patch

diff --git a/pkgs/development/compilers/gcc/10/default.nix b/pkgs/development/compilers/gcc/10/default.nix
index ff473019de775..e4444110adab2 100644
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@@ -48,14 +48,13 @@ with lib;
 with builtins;
 
 let majorVersion = "10";
-    version = "${majorVersion}.4.0";
+    version = "${majorVersion}.5.0";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
     patches = [
       # Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80431
       ../fix-bug-80431.patch
-      ../11/fix-struct-redefinition-on-glibc-2.36.patch
     ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
       ++ optional (noSysDirs && hostPlatform.isRiscV) ../no-sys-dirs-riscv.patch
@@ -150,7 +149,7 @@ lib.pipe ((callFile ../common/builder.nix {}) ({
 
   src = fetchurl {
     url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = "1wg4xdizkksmwi66mvv2v4pk3ja8x64m7v9gzhykzd3wrmdpsaf9";
+    hash = "sha256-JRCVQ/30bzl8NHtdi3osflaUpaUczkucbh6opxyjB8E=";
   };
 
   inherit patches;
diff --git a/pkgs/development/compilers/gcc/11/fix-struct-redefinition-on-glibc-2.36.patch b/pkgs/development/compilers/gcc/11/fix-struct-redefinition-on-glibc-2.36.patch
deleted file mode 100644
index 3f5f64a3d0748..0000000000000
--- a/pkgs/development/compilers/gcc/11/fix-struct-redefinition-on-glibc-2.36.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From d2356ebb0084a0d80dbfe33040c9afe938c15d19 Mon Sep 17 00:00:00 2001
-From: Martin Liska <mliska@suse.cz>
-Date: Mon, 11 Jul 2022 22:03:14 +0200
-Subject: [PATCH] libsanitizer: cherry-pick 9cf13067cb5088626ba7 from upstream
-
-9cf13067cb5088626ba7ee1ec4c42ec59c7995a0 [sanitizer] Remove #include <linux/fs.h> to resolve fsconfig_command/mount_attr conflict with glibc 2.36
-
-(cherry picked from commit 2701442d0cf6292f6624443c15813d6d1a3562fe)
----
- .../sanitizer_platform_limits_posix.cpp                | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp b/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp
-index 025e575b5bc7..5743516c0460 100644
---- a/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp
-+++ b/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp
-@@ -72,7 +72,9 @@
- #include <sys/vt.h>
- #include <linux/cdrom.h>
- #include <linux/fd.h>
-+#if SANITIZER_ANDROID
- #include <linux/fs.h>
-+#endif
- #include <linux/hdreg.h>
- #include <linux/input.h>
- #include <linux/ioctl.h>
-@@ -828,10 +830,10 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
-   unsigned IOCTL_EVIOCGPROP = IOCTL_NOT_PRESENT;
-   unsigned IOCTL_EVIOCSKEYCODE_V2 = IOCTL_NOT_PRESENT;
- #endif
--  unsigned IOCTL_FS_IOC_GETFLAGS = FS_IOC_GETFLAGS;
--  unsigned IOCTL_FS_IOC_GETVERSION = FS_IOC_GETVERSION;
--  unsigned IOCTL_FS_IOC_SETFLAGS = FS_IOC_SETFLAGS;
--  unsigned IOCTL_FS_IOC_SETVERSION = FS_IOC_SETVERSION;
-+  unsigned IOCTL_FS_IOC_GETFLAGS = _IOR('f', 1, long);
-+  unsigned IOCTL_FS_IOC_GETVERSION = _IOR('v', 1, long);
-+  unsigned IOCTL_FS_IOC_SETFLAGS = _IOW('f', 2, long);
-+  unsigned IOCTL_FS_IOC_SETVERSION = _IOW('v', 2, long);
-   unsigned IOCTL_GIO_CMAP = GIO_CMAP;
-   unsigned IOCTL_GIO_FONT = GIO_FONT;
-   unsigned IOCTL_GIO_UNIMAP = GIO_UNIMAP;

From 287a5b6baafd99677c267c780c6649f920b43720 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Fri, 11 Aug 2023 17:05:11 +0200
Subject: [PATCH 123/154] gcc10: apply a patch more often

As usual, just to earlier detect when it stops applying.
---
 pkgs/development/compilers/gcc/10/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/gcc/10/default.nix b/pkgs/development/compilers/gcc/10/default.nix
index e4444110adab2..0ab4819107f91 100644
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@@ -57,7 +57,7 @@ let majorVersion = "10";
       ../fix-bug-80431.patch
     ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
-      ++ optional (noSysDirs && hostPlatform.isRiscV) ../no-sys-dirs-riscv.patch
+      ++ optional noSysDirs ../no-sys-dirs-riscv.patch
       /* ++ optional (hostPlatform != buildPlatform) (fetchpatch { # XXX: Refine when this should be applied
         url = "https://git.busybox.net/buildroot/plain/package/gcc/${version}/0900-remove-selftests.patch?id=11271540bfe6adafbc133caf6b5b902a816f5f02";
         sha256 = ""; # TODO: uncomment and check hash when available.

From dc1e382f94f90b0fa8559a42d034f1742a8f94c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Fri, 11 Aug 2023 17:27:37 +0200
Subject: [PATCH 124/154] gcc13: 13.1.0 -> 13.2.0

The patch would no longer apply, as the the changed part is no longer
exactly at the end of the file.  There's more content now, but it
suffices to just add a preserved empty line into the diff.
---
 pkgs/development/compilers/gcc/13/default.nix       |  6 +++---
 .../compilers/gcc/13/no-sys-dirs-riscv.patch        | 13 +++++++++++++
 2 files changed, 16 insertions(+), 3 deletions(-)
 create mode 100644 pkgs/development/compilers/gcc/13/no-sys-dirs-riscv.patch

diff --git a/pkgs/development/compilers/gcc/13/default.nix b/pkgs/development/compilers/gcc/13/default.nix
index 82b30a0e5102d..b32f8f2ece1b7 100644
--- a/pkgs/development/compilers/gcc/13/default.nix
+++ b/pkgs/development/compilers/gcc/13/default.nix
@@ -55,7 +55,7 @@ with lib;
 with builtins;
 
 let majorVersion = "13";
-    version = "${majorVersion}.1.0";
+    version = "${majorVersion}.2.0";
     disableBootstrap = !stdenv.hostPlatform.isDarwin && !profiledCompiler;
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
@@ -63,7 +63,7 @@ let majorVersion = "13";
     patches =
          optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional noSysDirs ../gcc-12-no-sys-dirs.patch
-      ++ optional noSysDirs ../no-sys-dirs-riscv.patch
+      ++ optional noSysDirs ./no-sys-dirs-riscv.patch
       ++ [
         ../gnat-cflags-11.patch
         ../gcc-12-gfortran-driving.patch
@@ -201,7 +201,7 @@ lib.pipe ((callFile ../common/builder.nix {}) ({
 
   src = fetchurl {
     url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = "sha256-YdaE8Kpedqxlha2ImKJCeq3ol57V5/hUkihsTfwT7oY=";
+    hash = "sha256-4nXnZEKmBnNBon8Exca4PYYTFEAEwEE1KIY9xrXHQ9o=";
   };
 
   inherit patches;
diff --git a/pkgs/development/compilers/gcc/13/no-sys-dirs-riscv.patch b/pkgs/development/compilers/gcc/13/no-sys-dirs-riscv.patch
new file mode 100644
index 0000000000000..add4d59b41aef
--- /dev/null
+++ b/pkgs/development/compilers/gcc/13/no-sys-dirs-riscv.patch
@@ -0,0 +1,13 @@
+--- a/gcc/config/riscv/linux.h
++++ b/gcc/config/riscv/linux.h
+@@ -69,9 +69,5 @@
+ 
+ #define TARGET_ASM_FILE_END file_end_indicate_exec_stack
+ 
+-#define STARTFILE_PREFIX_SPEC 			\
+-   "/lib" XLEN_SPEC "/" ABI_SPEC "/ "		\
+-   "/usr/lib" XLEN_SPEC "/" ABI_SPEC "/ "	\
+-   "/lib/ "					\
+-   "/usr/lib/ "
++#define STARTFILE_PREFIX_SPEC ""
+ 

From e795ddf93d380e1f185498d06770839d5e406324 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Fri, 11 Aug 2023 12:22:58 -0700
Subject: [PATCH 125/154] javaPackages.compiler.openjdk17: add zulu javaFX java
 package on darwin

---
 .../compilers/openjdk/darwin/17.nix           | 22 ++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/darwin/17.nix b/pkgs/development/compilers/openjdk/darwin/17.nix
index a9a0e73ee1503..3034e164e640e 100644
--- a/pkgs/development/compilers/openjdk/darwin/17.nix
+++ b/pkgs/development/compilers/openjdk/darwin/17.nix
@@ -1,4 +1,10 @@
-{ lib, stdenv, fetchurl, unzip, setJavaClassPath }:
+{ lib
+, stdenv
+, fetchurl
+, unzip
+, setJavaClassPath
+, enableJavaFX ? false
+}:
 let
   # Details from https://www.azul.com/downloads/?version=java-17-lts&os=macos&package=jdk
   # Note that the latest build may differ by platform
@@ -7,14 +13,18 @@ let
       arch = "x64";
       zuluVersion = "17.44.15";
       jdkVersion = "17.0.8";
-      hash = "sha256-Ci18gBkAv/UUIQw9KlnfibcQMXwQRGx6K7L/NBB7b7Q=";
+      hash =
+        if enableJavaFX then "sha256-gmDku/AkWzO+eDRitezM9wCtTYDrUMtXyMulxqi9tNI="
+        else "sha256-Ci18gBkAv/UUIQw9KlnfibcQMXwQRGx6K7L/NBB7b7Q=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
       zuluVersion = "17.44.15";
       jdkVersion = "17.0.8";
-      hash = "sha256-8b81QY6DGXVOsTKM8QDzJnYjXV0ipCbYWaaz6oF2A6k=";
+      hash =
+        if enableJavaFX then "sha256-mvyfqpnAoA05HJB9EBewW2MDuhQBOvp6svzyayV1irI="
+        else "sha256-8b81QY6DGXVOsTKM8QDzJnYjXV0ipCbYWaaz6oF2A6k=";
     };
   }."${stdenv.hostPlatform.system}";
 
@@ -23,12 +33,14 @@ let
     hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
+  javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
+
   jdk = stdenv.mkDerivation rec {
-    pname = "zulu${dist.zuluVersion}-ca-jdk";
+    pname = "zulu${dist.zuluVersion}-${javaPackage}";
     version = dist.jdkVersion;
 
     src = fetchurl {
-      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-ca-jdk${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
+      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
       inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };

From b89c4a12c24e5dcc7a05e8e4fe5140db97442964 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Fri, 11 Aug 2023 12:24:03 -0700
Subject: [PATCH 126/154] javaPackages.compiler.openjdk18: add zulu javaFX java
 package on darwin

---
 .../compilers/openjdk/darwin/18.nix           | 22 ++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/darwin/18.nix b/pkgs/development/compilers/openjdk/darwin/18.nix
index 6d934a30f18a9..30a61b4b1faaf 100644
--- a/pkgs/development/compilers/openjdk/darwin/18.nix
+++ b/pkgs/development/compilers/openjdk/darwin/18.nix
@@ -1,4 +1,10 @@
-{ lib, stdenv, fetchurl, unzip, setJavaClassPath }:
+{ lib
+, stdenv
+, fetchurl
+, unzip
+, setJavaClassPath
+, enableJavaFX ? false
+}:
 let
   # Details from https://www.azul.com/downloads/?version=java-18-sts&os=macos&package=jdk
   # Note that the latest build may differ by platform
@@ -7,14 +13,18 @@ let
       arch = "x64";
       zuluVersion = "18.32.13";
       jdkVersion = "18.0.2.1";
-      hash = "sha256-uHPcyOgxUdTgzmIVRp/awtwve9zSt+1TZNef7DUuoRg=";
+      hash =
+        if enableJavaFX then "sha256-ZVZ1gbpJwxTduq2PPOCKqbSl+shq2NTFgqG++OXvFcg="
+        else "sha256-uHPcyOgxUdTgzmIVRp/awtwve9zSt+1TZNef7DUuoRg=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
       zuluVersion = "18.32.13";
       jdkVersion = "18.0.2.1";
-      hash = "sha256-jAZDgxtWMq/74yKAxA69oOU0C9nXvKG5MjmZLsK04iM=";
+      hash =
+        if enableJavaFX then "sha256-tNx0a1u9iamcN9VFOJ3eqDEA6C204dtIBJZvuAH2Vjk="
+        else "sha256-jAZDgxtWMq/74yKAxA69oOU0C9nXvKG5MjmZLsK04iM=";
     };
   }."${stdenv.hostPlatform.system}";
 
@@ -23,12 +33,14 @@ let
     hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
+  javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
+
   jdk = stdenv.mkDerivation rec {
-    pname = "zulu${dist.zuluVersion}-ca-jdk";
+    pname = "zulu${dist.zuluVersion}-${javaPackage}";
     version = dist.jdkVersion;
 
     src = fetchurl {
-      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-ca-jdk${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
+      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
       inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };

From 12871db0eef625d989ab47476acc2daac8b6972f Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Fri, 11 Aug 2023 12:24:16 -0700
Subject: [PATCH 127/154] javaPackages.compiler.openjdk19: add zulu javaFX java
 package on darwin

---
 .../compilers/openjdk/darwin/19.nix           | 26 ++++++++++++++-----
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/darwin/19.nix b/pkgs/development/compilers/openjdk/darwin/19.nix
index f98ce511c594a..a087de1b5727f 100644
--- a/pkgs/development/compilers/openjdk/darwin/19.nix
+++ b/pkgs/development/compilers/openjdk/darwin/19.nix
@@ -1,20 +1,30 @@
-{ lib, stdenv, fetchurl, unzip, setJavaClassPath }:
+{ lib
+, stdenv
+, fetchurl
+, unzip
+, setJavaClassPath
+, enableJavaFX ? false
+}:
 let
   # Details from https://www.azul.com/downloads/?version=java-19-sts&os=macos&package=jdk
   # Note that the latest build may differ by platform
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "19.32.13";
+      zuluVersion = if enableJavaFX then "19.32.15" else "19.32.13";
       jdkVersion = "19.0.2";
-      hash = "sha256-KARXWumsY+OcqpEOV2EL9SsPni1nGSipjRji/Mn2KsE=";
+      hash =
+        if enableJavaFX then "sha256-AwLcIId0gH5D6DUU8CgJ3qnKVQm28LXYirBeXBHwPYE="
+        else "sha256-KARXWumsY+OcqpEOV2EL9SsPni1nGSipjRji/Mn2KsE=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "19.32.13";
+      zuluVersion = if enableJavaFX then "19.32.15" else "19.32.13";
       jdkVersion = "19.0.2";
-      hash = "sha256-F30FjZaLL756X/Xs6xjNwW9jds4pEATxoxOeeLL7Y5E=";
+      hash =
+        if enableJavaFX then "sha256-/R2rrcBr64qPGEtvhruXBhPwnvurt/hiR1ICzZAdYxE="
+        else "sha256-F30FjZaLL756X/Xs6xjNwW9jds4pEATxoxOeeLL7Y5E=";
     };
   }."${stdenv.hostPlatform.system}";
 
@@ -23,12 +33,14 @@ let
     hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
+  javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
+
   jdk = stdenv.mkDerivation rec {
-    pname = "zulu${dist.zuluVersion}-ca-jdk";
+    pname = "zulu${dist.zuluVersion}-${javaPackage}";
     version = dist.jdkVersion;
 
     src = fetchurl {
-      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-ca-jdk${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
+      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
       inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };

From ef0add88ddb471f39233164f6fcd8d0516505dfc Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Fri, 11 Aug 2023 12:24:36 -0700
Subject: [PATCH 128/154] javaPackages.compiler.openjdk20: add zulu javaFX java
 package on darwin

---
 .../compilers/openjdk/darwin/20.nix           | 22 ++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/darwin/20.nix b/pkgs/development/compilers/openjdk/darwin/20.nix
index db8c93d23772e..b0c62aafd78d5 100644
--- a/pkgs/development/compilers/openjdk/darwin/20.nix
+++ b/pkgs/development/compilers/openjdk/darwin/20.nix
@@ -1,4 +1,10 @@
-{ lib, stdenv, fetchurl, unzip, setJavaClassPath }:
+{ lib
+, stdenv
+, fetchurl
+, unzip
+, setJavaClassPath
+, enableJavaFX ? false
+}:
 let
   # Details from https://www.azul.com/downloads/?version=java-19-sts&os=macos&package=jdk
   # Note that the latest build may differ by platform
@@ -7,14 +13,18 @@ let
       arch = "x64";
       zuluVersion = "20.32.11";
       jdkVersion = "20.0.2";
-      hash = "sha256-Ev9KG6DvuBnsZrOguLsO1KQzudHCBcJNwKh45Inpnfo=";
+      hash =
+        if enableJavaFX then "sha256-hyxQAivZAXtqMebe30L+EYa7p+TdSdKNYj7Rl/ZwRNQ="
+        else "sha256-Ev9KG6DvuBnsZrOguLsO1KQzudHCBcJNwKh45Inpnfo=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
       zuluVersion = "20.32.11";
       jdkVersion = "20.0.2";
-      hash = "sha256-15uNZ6uMfSASV3QU2q2oA/jBk2PCHOfSjn1GY7/7qIY=";
+      hash =
+        if enableJavaFX then "sha256-iPQzZS4CwaoqT8cSzg4kWCT1OyGBSJLq+NETcbucLo4="
+        else "sha256-15uNZ6uMfSASV3QU2q2oA/jBk2PCHOfSjn1GY7/7qIY=";
     };
   }."${stdenv.hostPlatform.system}";
 
@@ -23,12 +33,14 @@ let
     hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
+  javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
+
   jdk = stdenv.mkDerivation rec {
-    pname = "zulu${dist.zuluVersion}-ca-jdk";
+    pname = "zulu${dist.zuluVersion}-${javaPackage}";
     version = dist.jdkVersion;
 
     src = fetchurl {
-      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-ca-jdk${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
+      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
       inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };

From c958dcee0230a6b5c00c62629c267405c9f9bc61 Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Fri, 11 Aug 2023 23:14:58 -0700
Subject: [PATCH 129/154] python3.pkgs.protobuf: fix build after updating
 protobuf to 3.23.4 (#248231)

---
 .../libraries/protobuf/generic-v3-cmake.nix   |  2 ++
 .../python-modules/protobuf/default.nix       | 35 +++++++++++++++++++
 .../protobuf/use-nixpkgs-abseil-cpp.patch     | 13 +++++++
 3 files changed, 50 insertions(+)
 create mode 100644 pkgs/development/python-modules/protobuf/use-nixpkgs-abseil-cpp.patch

diff --git a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
index 7270f0cbf6075..384d2d0decb4c 100644
--- a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
+++ b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
@@ -96,6 +96,8 @@ let
           protobuf = self;
         });
       };
+
+      inherit abseil-cpp;
     };
 
     meta = {
diff --git a/pkgs/development/python-modules/protobuf/default.nix b/pkgs/development/python-modules/protobuf/default.nix
index f2615499f7ba3..38db9ef067e69 100644
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@@ -3,9 +3,11 @@
 , fetchpatch
 , isPyPy
 , lib
+, numpy
 , protobuf
 , pytestCheckHook
 , pythonAtLeast
+, substituteAll
 , tzdata
 }:
 
@@ -32,6 +34,12 @@ buildPythonPackage {
       extraPrefix = "";
       hash = "sha256-a/12C6yIe1tEKjsMxcfDAQ4JHolA8CzkN7sNG8ZspPs=";
     })
+  ] ++ lib.optionals (lib.versionAtLeast protobuf.version "3.22") [
+    # Replace the vendored abseil-cpp with nixpkgs'
+    (substituteAll {
+      src = ./use-nixpkgs-abseil-cpp.patch;
+      abseil_cpp_include_path = "${lib.getDev protobuf.abseil-cpp}/include";
+    })
   ];
 
   prePatch = ''
@@ -41,6 +49,19 @@ buildPythonPackage {
     fi
   '';
 
+  # Remove the line in setup.py that forces compiling with C++14. Upstream's
+  # CMake build has been updated to support compiling with other versions of
+  # C++, but the Python build has not. Without this, we observe compile-time
+  # errors using GCC.
+  #
+  # Fedora appears to do the same, per this comment:
+  #
+  #   https://github.com/protocolbuffers/protobuf/issues/12104#issuecomment-1542543967
+  #
+  postPatch = ''
+    sed -i "/extra_compile_args.append('-std=c++14')/d" setup.py
+  '';
+
   nativeBuildInputs = lib.optional isPyPy tzdata;
 
   buildInputs = [ protobuf ];
@@ -54,6 +75,8 @@ buildPythonPackage {
 
   nativeCheckInputs = [
     pytestCheckHook
+  ] ++ lib.optionals (lib.versionAtLeast protobuf.version "3.22") [
+    numpy
   ];
 
   disabledTests = lib.optionals isPyPy [
@@ -66,6 +89,18 @@ buildPythonPackage {
     "testStrictUtf8Check"
   ];
 
+  disabledTestPaths = lib.optionals (lib.versionAtLeast protobuf.version "3.23") [
+    # The following commit (I think) added some internal test logic for Google
+    # that broke generator_test.py. There is a new proto file that setup.py is
+    # not generating into a .py file. However, adding this breaks a bunch of
+    # conflict detection in descriptor_test.py that I don't understand. So let's
+    # just disable generator_test.py for now.
+    #
+    #   https://github.com/protocolbuffers/protobuf/commit/5abab0f47e81ac085f0b2d17ec3b3a3b252a11f1
+    #
+    "google/protobuf/internal/generator_test.py"
+  ];
+
   pythonImportsCheck = [
     "google.protobuf"
     "google.protobuf.internal._api_implementation" # Verify that --cpp_implementation worked
diff --git a/pkgs/development/python-modules/protobuf/use-nixpkgs-abseil-cpp.patch b/pkgs/development/python-modules/protobuf/use-nixpkgs-abseil-cpp.patch
new file mode 100644
index 0000000000000..cbc92bb76ab85
--- /dev/null
+++ b/pkgs/development/python-modules/protobuf/use-nixpkgs-abseil-cpp.patch
@@ -0,0 +1,13 @@
+diff --git a/setup.py b/setup.py
+index e65631013..d511c2996 100755
+--- a/setup.py
++++ b/setup.py
+@@ -412,7 +412,7 @@ if __name__ == '__main__':
+         Extension(
+             'google.protobuf.pyext._message',
+             glob.glob('google/protobuf/pyext/*.cc'),
+-            include_dirs=['.', '../src', '../third_party/abseil-cpp'],
++            include_dirs=['.', '../src', '@abseil_cpp_include_path@'],
+             libraries=libraries,
+             extra_objects=extra_objects,
+             extra_link_args=message_extra_link_args,

From 34f1f577054ad2f15d19c31016e90a654809bc7b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sat, 12 Aug 2023 08:10:10 +0200
Subject: [PATCH 130/154] Revert "Merge #244853: mesa: 23.1.3 -> 23.1.4"

This reverts commit 166a5ba0f43fb354326827d610dd4e2e2d513ef3, reversing
changes made to fea92808f88e2d2d91c5b574237293e22185b1ea.

At least for now, until issues around this are clearer:
https://github.com/NixOS/nixpkgs/issues/248439
---
 pkgs/development/libraries/mesa/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 392786524a875..75649eabaede7 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -86,8 +86,8 @@
 */
 
 let
-  version = "23.1.4";
-  hash = "sha256-cmGhf7lIZ+PcWpDYofEA+gSwy73lHSUwLAhytemhCVk=";
+  version = "23.1.3";
+  hash = "sha256-L21zgbwQ+9LWJjrRAieFuLURBGwakEFi+PfaGO6ortk=";
 
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule

From 13bd5d4dbd23db80eb16c7af2dab362a92f42fbe Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 13 Aug 2023 09:25:06 +0300
Subject: [PATCH 131/154] qt5.qtscript: fix version

No upstream changes so the version number stayed at 5.15.9 I guess?
---
 pkgs/development/libraries/qt-5/5.15/srcs.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index 67403f3beba9a..6729c7c31af3b 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -2,7 +2,9 @@
 
 let
   version = "5.15.10";
-  overrides = {};
+  overrides = {
+    qtscript.version = "5.15.9";
+  };
 
   mk = name: args:
     let

From 195ccf5b40b9d789a234e61f21a079efdb51d86e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sun, 13 Aug 2023 09:18:13 +0200
Subject: [PATCH 132/154] mesa: 23.1.3 -> 23.1.5

https://docs.mesa3d.org/relnotes/23.1.5.html
The issues we heard about >= 23.1.4 appear to have been just
the usual sensitivity to version mismatches in NixOS mesa.
---
 pkgs/development/libraries/mesa/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 75649eabaede7..550cb7f673f81 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -86,8 +86,8 @@
 */
 
 let
-  version = "23.1.3";
-  hash = "sha256-L21zgbwQ+9LWJjrRAieFuLURBGwakEFi+PfaGO6ortk=";
+  version = "23.1.5";
+  hash = "sha256-PPiFdv3r8k/EBHBnk2ExyQy2VBwnNlmWt5tmHewfsVM=";
 
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule

From 69ea1516caa6cd439b7b3d1ee9b60c05897d205c Mon Sep 17 00:00:00 2001
From: Tobias Mayer <tobim@fastmail.fm>
Date: Fri, 11 Aug 2023 15:38:05 +0200
Subject: [PATCH 133/154] google-cloud-cpp: 2.4.0 -> 2.14.0

---
 .../libraries/google-cloud-cpp/default.nix    |  8 +-
 .../google-cloud-cpp/skipped_tests.toml       | 78 ++++++++++++-------
 2 files changed, 52 insertions(+), 34 deletions(-)

diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index cb626ffac968c..f285aee0b7cff 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -18,25 +18,25 @@
 , staticOnly ? stdenv.hostPlatform.isStatic
 }:
 let
-  googleapisRev = "13d5b3f3f9412f38427c8ad48068f04ad1ee9808";
+  googleapisRev = "85f8c758016c279fb7fa8f0d51ddc7ccc0dd5e05";
   googleapis = fetchFromGitHub {
     name = "googleapis-src";
     owner = "googleapis";
     repo = "googleapis";
     rev = googleapisRev;
-    hash = "sha256-SiU7N1EQ/7LWhUwgf4c0CBfUzNGiLe4sSbbJmJF3sao=";
+    hash = "sha256-4Qiz0pBgW3OZi+Z8Zq6k9E94+8q6/EFMwPh8eQxDjdI=";
   };
   excludedTests = builtins.fromTOML (builtins.readFile ./skipped_tests.toml);
 in
 stdenv.mkDerivation rec {
   pname = "google-cloud-cpp";
-  version = "2.4.0";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-cpp";
     rev = "v${version}";
-    sha256 = "sha256-o8aURM8fvxn0FZjuqJGclq9Brss8LOFZzD0FV2j/lUc=";
+    sha256 = "sha256-0SoOaAqvk8cVC5W3ejTfe4O/guhrro3uAzkeIpAkCpg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml b/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
index 71529bfb45500..d4ac469fbcffe 100644
--- a/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
+++ b/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
@@ -1,56 +1,71 @@
 whole = [
-  "bigquery_bigquery_read_integration_test",
+  "common_samples_samples",
+  "common_internal_grpc_impersonate_service_account_integration_test",
+  "common_internal_unified_rest_credentials_integration_test",
+  "iam_samples_iam_credentials_samples",
+  "iam_samples_iam_samples",
+  "iam_admin_v1_samples_iam_client_samples",
+  "iam_credentials_v1_samples_iam_credentials_client_samples",
+  "iam_v1_samples_iam_policy_client_samples",
+  "iam_v2_samples_policies_client_samples",
   "bigtable_admin_admin_iam_policy_integration_test",
-  "bigtable_admin_iam_policy_integration_test",
-  "bigtable_admin_integration_test",
+  "bigtable_bigtable_instance_admin_client_samples",
+  "bigtable_bigtable_table_admin_client_samples",
   "bigtable_apply_read_latency_benchmark",
-  "bigtable_data_async_future_integration_test",
-  "bigtable_data_integration_test",
   "bigtable_endurance_benchmark",
-  "bigtable_filters_integration_test",
   "bigtable_mutation_batcher_throughput_benchmark",
-  "bigtable_mutations_integration_test",
   "bigtable_read_sync_vs_async_benchmark",
   "bigtable_scan_throughput_benchmark",
+  "bigtable_admin_iam_policy_integration_test",
+  "bigtable_data_async_future_integration_test",
+  "bigtable_data_integration_test",
+  "bigtable_filters_integration_test",
+  "bigtable_mutations_integration_test",
   "bigtable_table_sample_rows_integration_test",
-  "common_grpc_utils_internal_grpc_impersonate_service_account_integration_test",
-  "iam_iam_credentials_integration_test",
-  "iam_iam_integration_test",
+  "bigquery_samples_bigquery_read_samples",
+  "bigquery_analyticshub_v1_samples_analytics_hub_client_samples",
+  "bigquery_biglake_v1_samples_metastore_client_samples",
+  "bigquery_connection_v1_samples_connection_client_samples",
+  "bigquery_datapolicies_v1_samples_data_policy_client_samples",
+  "bigquery_datatransfer_v1_samples_data_transfer_client_samples",
+  "bigquery_migration_v2_samples_migration_client_samples",
+  "bigquery_reservation_v1_samples_reservation_client_samples",
+  "bigquery_storage_v1_samples_bigquery_read_client_samples",
+  "bigquery_storage_v1_samples_bigquery_write_client_samples",
   "logging_quickstart",
+  "logging_v2_samples_config_service_v2_client_samples",
+  "logging_v2_samples_logging_service_v2_client_samples",
+  "logging_v2_samples_metrics_service_v2_client_samples",
   "pubsub_endurance",
-  "pubsub_schema_admin_integration_test",
+  "pubsub_throughput",
   "pubsub_subscriber_integration_test",
   "pubsub_subscription_admin_integration_test",
-  "pubsub_throughput",
   "pubsub_topic_admin_integration_test",
-  "rest_internal_internal_curl_rest_client_integration_test",
-  "rest_internal_internal_unified_rest_credentials_integration_test",
-  "spanner_admin_backup_extra_integration_test",
-  "spanner_admin_database_admin_integration_test",
-  "spanner_admin_instance_admin_integration_test",
-  "spanner_backup_extra_integration_test",
   "spanner_client_integration_test",
   "spanner_client_stress_test",
   "spanner_data_types_integration_test",
   "spanner_database_admin_integration_test",
   "spanner_instance_admin_integration_test",
-  "spanner_multiple_rows_cpu_benchmark",
-  "spanner_rpc_failure_threshold_integration_test",
   "spanner_session_pool_integration_test",
+  "spanner_admin_database_admin_integration_test",
+  "spanner_admin_instance_admin_integration_test",
+  "spanner_database_admin_client_samples",
+  "spanner_instance_admin_client_samples",
+  "spanner_multiple_rows_cpu_benchmark",
   "spanner_single_row_throughput_benchmark",
-  "storage_aggregate_download_throughput_benchmark",
-  "storage_aggregate_upload_throughput_benchmark",
   "storage_alternative_endpoint_integration_test",
   "storage_auto_finalize_integration_test",
   "storage_bucket_integration_test",
   "storage_create_client_integration_test",
-  "storage_create_dataset",
-  "storage_curl_download_request_integration_test",
-  "storage_curl_request_integration_test",
-  "storage_curl_resumable_upload_session_integration_test",
   "storage_curl_sign_blob_integration_test",
   "storage_decompressive_transcoding_integration_test",
+  "storage_grpc_bucket_acl_integration_test",
+  "storage_grpc_bucket_metadata_integration_test",
+  "storage_grpc_default_object_acl_integration_test",
   "storage_grpc_integration_test",
+  "storage_grpc_object_acl_integration_test",
+  "storage_grpc_object_media_integration_test",
+  "storage_grpc_object_metadata_integration_test",
   "storage_key_file_integration_test",
   "storage_minimal_iam_credentials_rest_integration_test",
   "storage_object_basic_crud_integration_test",
@@ -79,13 +94,16 @@ whole = [
   "storage_service_account_integration_test",
   "storage_signed_url_integration_test",
   "storage_small_reads_integration_test",
-  "storage_storage_file_transfer_benchmark",
-  "storage_storage_parallel_uploads_benchmark",
-  "storage_storage_throughput_vs_cpu_benchmark",
   "storage_thread_integration_test",
-  "storage_throughput_experiment_test",
   "storage_tracing_integration_test",
   "storage_unified_credentials_integration_test",
+  "storage_aggregate_download_throughput_benchmark",
+  "storage_aggregate_upload_throughput_benchmark",
+  "storage_create_dataset",
+  "storage_storage_file_transfer_benchmark",
+  "storage_storage_parallel_uploads_benchmark",
+  "storage_storage_throughput_vs_cpu_benchmark",
+  "storage_throughput_experiment_test"
 ]
 cases = [
   "BackupExtraIntegrationTest.CreateBackupWithExpiredVersionTime",

From 54e9994a6b5f48d761f1dc6cefbe9c14f4ddda50 Mon Sep 17 00:00:00 2001
From: Tobias Mayer <tobim@fastmail.fm>
Date: Mon, 14 Aug 2023 08:57:36 +0200
Subject: [PATCH 134/154] grpc: refactor cxxStandard selection

GRPC is less aggressive in overriding `CMAKE_CXX_STANDARD` nowadays.
This allows us to take a less invasive approach to ensure that the
provided abseil package is configured with the same implementation
for the provided c++17 compatibility shims.
Instead of always setting `CMAKE_CXX_STANDARD`, we only do it to
override hard-coded downgrade on darwin. With that, we can use the
default configuration for abseil-cpp, reducing the number of instances
of that library in the build closure to one.
---
 .../libraries/arrow-cpp/default.nix           |  7 ++---
 .../libraries/google-cloud-cpp/default.nix    |  1 -
 pkgs/development/libraries/grpc/default.nix   | 27 ++++++++++---------
 pkgs/top-level/all-packages.nix               |  7 +----
 4 files changed, 17 insertions(+), 25 deletions(-)

diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index f61d9aa221589..4d89ce1396719 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -39,11 +39,8 @@
 , enableShared ? !stdenv.hostPlatform.isStatic
 , enableFlight ? true
 , enableJemalloc ? !stdenv.isDarwin
-  # boost/process is broken in 1.69 on darwin, but fixed in 1.70 and
-  # non-existent in older versions
-  # see https://github.com/boostorg/process/issues/55
-, enableS3 ? (!stdenv.isDarwin) || (lib.versionOlder boost.version "1.69" || lib.versionAtLeast boost.version "1.70")
-, enableGcs ? (!stdenv.isDarwin) && (lib.versionAtLeast grpc.cxxStandard "17") # google-cloud-cpp is not supported on darwin, needs to support C++17
+, enableS3 ? true
+, enableGcs ? !stdenv.isDarwin
 }:
 
 assert lib.asserts.assertMsg
diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index f285aee0b7cff..9aa1284bbee9d 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -120,7 +120,6 @@ stdenv.mkDerivation rec {
     # this adds a good chunk of time to the build
     "-DBUILD_TESTING:BOOL=ON"
     "-DGOOGLE_CLOUD_CPP_ENABLE_EXAMPLES:BOOL=OFF"
-    "-DCMAKE_CXX_STANDARD=${grpc.cxxStandard}"
   ] ++ lib.optionals (apis != [ "*" ]) [
     "-DGOOGLE_CLOUD_CPP_ENABLE=${lib.concatStringsSep ";" apis}"
   ];
diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index 7435ac723f7d0..70034f2d2e4f3 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -56,10 +56,22 @@ stdenv.mkDerivation rec {
     "-DgRPC_PROTOBUF_PROVIDER=package"
     "-DgRPC_ABSL_PROVIDER=package"
     "-DBUILD_SHARED_LIBS=ON"
-    "-DCMAKE_CXX_STANDARD=${passthru.cxxStandard}"
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "-D_gRPC_PROTOBUF_PROTOC_EXECUTABLE=${buildPackages.protobuf}/bin/protoc"
-  ];
+  ]
+  # The build scaffold defaults to c++14 on darwin, even when the compiler uses
+  # a more recent c++ version by default [1]. However, downgrades are
+  # problematic, because the compatibility types in abseil will have different
+  # interface definitions than the ones used for building abseil itself.
+  # [1] https://github.com/grpc/grpc/blob/v1.57.0/CMakeLists.txt#L239-L243
+  ++ (let
+    defaultCxxIsOlderThan17 =
+      (stdenv.cc.isClang && lib.versionAtLeast stdenv.cc.cc.version "16.0")
+       || (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.cc.version "11.0");
+    in lib.optionals (stdenv.hostPlatform.isDarwin && defaultCxxIsOlderThan17)
+  [
+    "-DCMAKE_CXX_STANDARD=17"
+  ]);
 
   # CMake creates a build directory by default, this conflicts with the
   # basel BUILD file on case-insensitive filesystems.
@@ -81,17 +93,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilds = true;
 
-  passthru.cxxStandard =
-    let
-      # Needs to be compiled with -std=c++11 for clang < 11. Interestingly this is
-      # only an issue with the useLLVM stdenv, not the darwin stdenv…
-      # https://github.com/grpc/grpc/issues/26473#issuecomment-860885484
-      useLLVMAndOldCC = (stdenv.hostPlatform.useLLVM or false) && lib.versionOlder stdenv.cc.cc.version "11.0";
-      # With GCC 9 (current aarch64-linux) it fails with c++17 but OK with c++14.
-      useOldGCC = !(stdenv.hostPlatform.useLLVM or false) && lib.versionOlder stdenv.cc.cc.version "10";
-    in
-    (if useLLVMAndOldCC then "11" else if useOldGCC then "14" else "17");
-
   passthru.tests = {
     inherit (python3.pkgs) grpcio-status grpcio-tools;
     inherit arrow-cpp;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7f636a5ae622c..2c6a00a2867bd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -21597,12 +21597,7 @@ with pkgs;
 
   grilo-plugins = callPackage ../development/libraries/grilo-plugins { };
 
-  grpc = callPackage ../development/libraries/grpc {
-    # grpc builds with c++17 so abseil must also be built that way
-    abseil-cpp = abseil-cpp_202206.override {
-      cxxStandard = grpc.cxxStandard;
-    };
-  };
+  grpc = callPackage ../development/libraries/grpc { };
 
   gsettings-qt = libsForQt5.callPackage ../development/libraries/gsettings-qt { };
 

From 6506716f46197c5050ca7ebeb557392d5574715f Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Sat, 12 Aug 2023 20:59:15 -0700
Subject: [PATCH 135/154] python3.pkgs.ninja: export BIN_DIR constant

---
 pkgs/development/python-modules/ninja/stub/ninja/__init__.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/ninja/stub/ninja/__init__.py b/pkgs/development/python-modules/ninja/stub/ninja/__init__.py
index d85e4b6dab344..fcf70f10ba310 100644
--- a/pkgs/development/python-modules/ninja/stub/ninja/__init__.py
+++ b/pkgs/development/python-modules/ninja/stub/ninja/__init__.py
@@ -2,8 +2,10 @@
 import subprocess
 import sys
 
+BIN_DIR = '@BIN_DIR@'
+
 def _program(name, args):
-    return subprocess.call([os.path.join('@BIN_DIR@', name)] + args, close_fds=False)
+    return subprocess.call([os.path.join(BIN_DIR, name)] + args, close_fds=False)
 
 def ninja():
     raise SystemExit(_program('ninja', sys.argv[1:]))

From df5f5099c8831d8b05bb67c79fde682abe1201c6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 14 Aug 2023 20:08:30 +0200
Subject: [PATCH 136/154] python311Packages.protobuf: drop extraneous patch

https://hydra.nixos.org/build/231540486/nixlog/1/tail
---
 pkgs/development/python-modules/protobuf/default.nix | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/protobuf/default.nix b/pkgs/development/python-modules/protobuf/default.nix
index 38db9ef067e69..d0f8e3bba99d3 100644
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@@ -27,14 +27,7 @@ buildPythonPackage {
 
   sourceRoot = "${protobuf.src.name}/python";
 
-  patches = lib.optionals (pythonAtLeast "3.11") [
-    (fetchpatch {
-      url = "https://github.com/protocolbuffers/protobuf/commit/da973aff2adab60a9e516d3202c111dbdde1a50f.patch";
-      stripLen = 2;
-      extraPrefix = "";
-      hash = "sha256-a/12C6yIe1tEKjsMxcfDAQ4JHolA8CzkN7sNG8ZspPs=";
-    })
-  ] ++ lib.optionals (lib.versionAtLeast protobuf.version "3.22") [
+  patches = lib.optionals (lib.versionAtLeast protobuf.version "3.22") [
     # Replace the vendored abseil-cpp with nixpkgs'
     (substituteAll {
       src = ./use-nixpkgs-abseil-cpp.patch;

From bb945f3cea0f2d2fa2812381262fc90f6211730c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Tue, 15 Aug 2023 07:55:47 +0200
Subject: [PATCH 137/154] opencv(4), opencv3: switch to older protobuf

https://hydra.nixos.org/build/231540730
https://hydra.nixos.org/build/231464517
---
 pkgs/development/libraries/opencv/3.x.nix | 4 ++--
 pkgs/development/libraries/opencv/4.x.nix | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/opencv/3.x.nix b/pkgs/development/libraries/opencv/3.x.nix
index 0188e5e1ae965..d295efe6feed4 100644
--- a/pkgs/development/libraries/opencv/3.x.nix
+++ b/pkgs/development/libraries/opencv/3.x.nix
@@ -2,7 +2,7 @@
 , fetchFromGitHub
 , fetchpatch
 , cmake, pkg-config, unzip, zlib, pcre, hdf5
-, glog, boost, gflags, protobuf
+, glog, boost, gflags, protobuf3_21
 , config
 
 , enableJPEG      ? true, libjpeg
@@ -187,7 +187,7 @@ stdenv.mkDerivation {
 
   buildInputs =
        [ zlib pcre hdf5 glog boost gflags ]
-    ++ lib.optional useSystemProtobuf protobuf
+    ++ lib.optional useSystemProtobuf protobuf3_21
     ++ lib.optional enablePython pythonPackages.python
     ++ lib.optional enableGtk2 gtk2
     ++ lib.optional enableGtk3 gtk3
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index c82f0a0065b68..2bc3954f8ab94 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -11,7 +11,7 @@
 , hdf5
 , boost
 , gflags
-, protobuf
+, protobuf3_21
 , config
 , ocl-icd
 , buildPackages
@@ -317,7 +317,7 @@ stdenv.mkDerivation {
     echo '"(build info elided)"' > modules/core/version_string.inc
   '';
 
-  buildInputs = [ zlib pcre boost gflags protobuf ]
+  buildInputs = [ zlib pcre boost gflags protobuf3_21 ]
     ++ lib.optional enablePython pythonPackages.python
     ++ lib.optional (stdenv.buildPlatform == stdenv.hostPlatform) hdf5
     ++ lib.optional enableGtk2 gtk2
@@ -369,7 +369,7 @@ stdenv.mkDerivation {
     "-DOPENCV_GENERATE_PKGCONFIG=ON"
     "-DWITH_OPENMP=ON"
     "-DBUILD_PROTOBUF=OFF"
-    "-DProtobuf_PROTOC_EXECUTABLE=${lib.getExe buildPackages.protobuf}"
+    "-DProtobuf_PROTOC_EXECUTABLE=${lib.getExe buildPackages.protobuf3_21}"
     "-DPROTOBUF_UPDATE_FILES=ON"
     "-DOPENCV_ENABLE_NONFREE=${printEnabled enableUnfree}"
     "-DBUILD_TESTS=${printEnabled runAccuracyTests}"

From 1da9ecb9dc2cfa20928ddc66357f276b0040e07f Mon Sep 17 00:00:00 2001
From: Tobias Mayer <tobim@fastmail.fm>
Date: Wed, 16 Aug 2023 01:49:48 +0200
Subject: [PATCH 138/154] arrow-cpp: fixup after protobuf bump

---
 .../arrow-cpp/cmake-find-protobuf.patch        | 18 ++++++++++++++++++
 .../libraries/arrow-cpp/default.nix            |  2 ++
 2 files changed, 20 insertions(+)
 create mode 100644 pkgs/development/libraries/arrow-cpp/cmake-find-protobuf.patch

diff --git a/pkgs/development/libraries/arrow-cpp/cmake-find-protobuf.patch b/pkgs/development/libraries/arrow-cpp/cmake-find-protobuf.patch
new file mode 100644
index 0000000000000..5655c151e2f68
--- /dev/null
+++ b/pkgs/development/libraries/arrow-cpp/cmake-find-protobuf.patch
@@ -0,0 +1,18 @@
+diff --git a/cmake_modules/FindProtobufAlt.cmake b/cmake_modules/FindProtobufAlt.cmake
+index d29f757ae..61c6e16e1 100644
+--- a/cmake_modules/FindProtobufAlt.cmake
++++ b/cmake_modules/FindProtobufAlt.cmake
+@@ -22,11 +22,8 @@ else()
+ endif()
+ 
+ set(find_package_args)
+-if(ProtobufAlt_FIND_VERSION)
+-  list(APPEND find_package_args ${ProtobufAlt_FIND_VERSION})
+-endif()
+ if(ProtobufAlt_FIND_QUIETLY)
+   list(APPEND find_package_args QUIET)
+ endif()
+-find_package(Protobuf ${find_package_args})
+-set(ProtobufAlt_FOUND ${Protobuf_FOUND})
++find_package(protobuf ${find_package_args})
++set(ProtobufAlt_FOUND ${protobuf_FOUND})
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index 4d89ce1396719..c1bbc3e303d15 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -122,6 +122,7 @@ stdenv.mkDerivation rec {
   patches = [
     # patch to fix python-test
     ./darwin.patch
+    ./cmake-find-protobuf.patch
   ];
 
   nativeBuildInputs = [
@@ -169,6 +170,7 @@ stdenv.mkDerivation rec {
   '';
 
   cmakeFlags = [
+    "-DCMAKE_FIND_PACKAGE_PREFER_CONFIG=ON"
     "-DARROW_BUILD_SHARED=${if enableShared then "ON" else "OFF"}"
     "-DARROW_BUILD_STATIC=${if enableShared then "OFF" else "ON"}"
     "-DARROW_BUILD_TESTS=ON"

From 0af8d1510cf5108c5488a88729247133b59b77ab Mon Sep 17 00:00:00 2001
From: Theodore Ni <3806110+tjni@users.noreply.github.com>
Date: Tue, 15 Aug 2023 21:02:28 -0700
Subject: [PATCH 139/154] python3.pkgs.qcodes: fix bad merge that duplicated
 disabledTests attribute

---
 pkgs/development/python-modules/qcodes/default.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/pkgs/development/python-modules/qcodes/default.nix b/pkgs/development/python-modules/qcodes/default.nix
index 7fbb1bb3d5593..fb70d6d1f7882 100644
--- a/pkgs/development/python-modules/qcodes/default.nix
+++ b/pkgs/development/python-modules/qcodes/default.nix
@@ -133,11 +133,6 @@ buildPythonPackage rec {
     "--durations=20"
   ];
 
-  disabledTests = [
-    # timing sensitive
-    "test_access_channels_by_slice"
-  ];
-
   disabledTestPaths = [
     # Test depends on qcodes-loop, causing a cyclic dependency
     "qcodes/tests/dataset/measurement/test_load_legacy_data.py"

From 87d0c2819023d1bd948e6e0de51ea850a50dc8c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Wed, 16 Aug 2023 16:58:10 +0200
Subject: [PATCH 140/154] ibus-engines.mozc: fix build by pinning protobuf

The overidden protobuf would no longer build after update
https://hydra.nixos.org/build/231653253/nixlog/2/tail
---
 pkgs/top-level/all-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 057c053e3c61c..1f4c175b4fe42 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6882,7 +6882,7 @@ with pkgs;
 
     mozc = callPackage ../tools/inputmethods/ibus-engines/ibus-mozc {
       stdenv = clangStdenv;
-      protobuf = pkgs.protobuf.overrideDerivation (_: { stdenv = clangStdenv; });
+      protobuf = pkgs.protobuf3_21.overrideDerivation (_: { stdenv = clangStdenv; });
     };
 
     rime = callPackage ../tools/inputmethods/ibus-engines/ibus-rime { };

From ec1e6d834ae803f02a353914843e096c2091d233 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Wed, 16 Aug 2023 19:18:17 +0200
Subject: [PATCH 141/154] python3Packages.onnx: fix by pinning to protobuf3

https://hydra.nixos.org/build/231651653
---
 pkgs/top-level/python-packages.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6739dcd35d261..273d193e080c5 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7354,7 +7354,9 @@ self: super: with self; {
 
   onlykey-solo-python = callPackage ../development/python-modules/onlykey-solo-python { };
 
-  onnx = callPackage ../development/python-modules/onnx { };
+  onnx = callPackage ../development/python-modules/onnx {
+    protobuf = protobuf3;
+  };
 
   onnxconverter-common = callPackage ../development/python-modules/onnxconverter-common { };
 

From 5ecef4a6afb7e6276e7b02abb2e5cdf5eb946e62 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Thu, 17 Aug 2023 08:15:43 +0200
Subject: [PATCH 142/154] gcc13: update aarch64-darwin patch

---
 pkgs/development/compilers/gcc/13/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/gcc/13/default.nix b/pkgs/development/compilers/gcc/13/default.nix
index b32f8f2ece1b7..03d8e394ed6ae 100644
--- a/pkgs/development/compilers/gcc/13/default.nix
+++ b/pkgs/development/compilers/gcc/13/default.nix
@@ -73,8 +73,8 @@ let majorVersion = "13";
       # a foreign one: https://github.com/iains/gcc-12-branch/issues/18
       ++ optional (stdenv.isDarwin && stdenv.isAarch64 && buildPlatform == hostPlatform && hostPlatform == targetPlatform) (fetchpatch {
         name = "gcc-13-darwin-aarch64-support.patch";
-        url = "https://github.com/Homebrew/formula-patches/raw/5c206c47e2a08d522ec9795bb314346fff5fc4c5/gcc/gcc-13.1.0.diff";
-        sha256 = "sha256-sMgA7nwE2ULa54t5g6VE6eJQYa69XvQrefi9U9f2t4g=";
+        url = "https://raw.githubusercontent.com/Homebrew/formula-patches/3c5cbc8e9cf444a1967786af48e430588e1eb481/gcc/gcc-13.2.0.diff";
+        sha256 = "sha256-Y5r3U3dwAFG6+b0TNCFd18PNxYu2+W/5zDbZ5cHvv+U=";
       })
       ++ optional langD ../libphobos.patch
 

From fbea8bb3e888a9b534bd3a809e6c7bcbf5ecd09b Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 18 Aug 2023 08:49:06 +0300
Subject: [PATCH 143/154] mumble: disable grpc, pin old protobuf version

---
 pkgs/applications/networking/mumble/default.nix | 7 ++-----
 pkgs/top-level/all-packages.nix                 | 3 ++-
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/networking/mumble/default.nix b/pkgs/applications/networking/mumble/default.nix
index fdc649bd0b2ca..27fdde3c2a660 100644
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@@ -7,7 +7,6 @@
 , flac
 , libogg
 , libvorbis
-, grpcSupport ? false, grpc, which
 , iceSupport ? true, zeroc-ice
 , jackSupport ? false, libjack2
 , pipewireSupport ? true, pipewire
@@ -100,12 +99,10 @@ let
         "-D Ice_HOME=${lib.getDev zeroc-ice};${lib.getLib zeroc-ice}"
         "-D CMAKE_PREFIX_PATH=${lib.getDev zeroc-ice};${lib.getLib zeroc-ice}"
         "-D Ice_SLICE_DIR=${lib.getDev zeroc-ice}/share/ice/slice"
-      ]
-      ++ lib.optional grpcSupport "-D grpc=ON";
+      ];
 
     buildInputs = [ libcap ]
-      ++ lib.optional iceSupport zeroc-ice
-      ++ lib.optionals grpcSupport [ grpc which ];
+      ++ lib.optional iceSupport zeroc-ice;
   } source;
 
   source = rec {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b750d1c3d852a..da9c9c8615d5c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -33835,13 +33835,14 @@ with pkgs;
       avahi = avahi-compat;
       pulseSupport = config.pulseaudio or false;
       iceSupport = config.murmur.iceSupport or true;
-      grpcSupport = config.murmur.grpcSupport or true;
+      protobuf = protobuf3_21;
     }).murmur;
 
   mumble = (callPackages ../applications/networking/mumble {
       avahi = avahi-compat;
       jackSupport = config.mumble.jackSupport or false;
       speechdSupport = config.mumble.speechdSupport or false;
+      protobuf = protobuf3_21;
     }).mumble;
 
   mumble_overlay = callPackage ../applications/networking/mumble/overlay.nix {

From 3ff55b6c89e8895580e93b7d6aae9de18bd87f76 Mon Sep 17 00:00:00 2001
From: Tobias Mayer <tobim@fastmail.fm>
Date: Thu, 17 Aug 2023 09:15:25 +0200
Subject: [PATCH 144/154] android-tools: Fix build with protobuf-3.23

---
 pkgs/tools/misc/android-tools/default.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/tools/misc/android-tools/default.nix b/pkgs/tools/misc/android-tools/default.nix
index 6436e692ae441..6276d50c73d42 100644
--- a/pkgs/tools/misc/android-tools/default.nix
+++ b/pkgs/tools/misc/android-tools/default.nix
@@ -16,6 +16,19 @@ stdenv.mkDerivation rec {
     hash = "sha256-YCNOy8oZoXp+L0akWBlg1kW3xVuHDZJKIUlMdqb1SOw=";
   };
 
+  patches = [
+    # Fix building with newer protobuf versions.
+    (fetchurl {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/android-tools/-/raw/295ad7d5cb1e3b4c75bd40281d827f9168bbaa57/protobuf-23.patch";
+      hash = "sha256-KznGgZdYT6e5wG3gtfJ6i93bYfp/JFygLW/ZzvXUA0Y=";
+    })
+  ];
+
+  # Fix linking with private abseil-cpp libraries.
+  postPatch = ''
+    sed -i '/^find_package(Protobuf REQUIRED)$/i find_package(protobuf CONFIG)' vendor/CMakeLists.txt
+  '';
+
   nativeBuildInputs = [ cmake pkg-config perl go ];
   buildInputs = [ protobuf zlib gtest brotli lz4 zstd libusb1 pcre2 ];
   propagatedBuildInputs = [ pythonEnv ];

From 399769897b1f1b8b32ecadf5cb69f9cadbc009cd Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 17 Aug 2023 18:48:28 +0300
Subject: [PATCH 145/154] grpc: fix generated config file

Taken from PR #249752
---
 pkgs/development/libraries/grpc/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index 70034f2d2e4f3..77bba280df966 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -40,6 +40,12 @@ stdenv.mkDerivation rec {
       url = "https://github.com/lopsided98/grpc/commit/164f55260262c816e19cd2c41b564486097d62fe.patch";
       hash = "sha256-d6kMyjL5ZnEnEz4XZfRgXJBH53gp1r7q1tlwh+HM6+Y=";
     })
+    # Fix generated CMake config file
+    # FIXME: remove when merged
+    (fetchpatch {
+      url = "https://github.com/grpc/grpc/pull/33361/commits/117dc80eb43021dd5619023ef6d02d0d6ec7ae7a.patch";
+      hash = "sha256-VBk3ZD5h9uOQVN0st+quUQK/wXqvfFNk8G8AN4f2MQo=";
+    })
   ];
 
   nativeBuildInputs = [ cmake pkg-config ]

From e631034b7097ea69ccf4ac7427252af33bb87a26 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 17 Aug 2023 18:06:18 +0300
Subject: [PATCH 146/154] treewide: pin packages that don't build with new
 protobuf to old protobuf

---
 pkgs/applications/kde/marble.nix | 4 ++--
 pkgs/top-level/all-packages.nix  | 7 ++++++-
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/kde/marble.nix b/pkgs/applications/kde/marble.nix
index 7fe3aa529fa24..f36d91df5978a 100644
--- a/pkgs/applications/kde/marble.nix
+++ b/pkgs/applications/kde/marble.nix
@@ -2,7 +2,7 @@
 , extra-cmake-modules, kdoctools
 , qtscript, qtsvg, qtquickcontrols, qtwebengine
 , krunner, shared-mime-info, kparts, knewstuff
-, gpsd, perl
+, gpsd, perl, protobuf3_21
 }:
 
 mkDerivation {
@@ -15,7 +15,7 @@ mkDerivation {
   outputs = [ "out" "dev" ];
   nativeBuildInputs = [ extra-cmake-modules kdoctools perl ];
   propagatedBuildInputs = [
-    qtscript qtsvg qtquickcontrols qtwebengine shared-mime-info krunner kparts
+    protobuf3_21 qtscript qtsvg qtquickcontrols qtwebengine shared-mime-info krunner kparts
     knewstuff gpsd
   ];
   preConfigure = ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9d7913467cd97..6ef9507a603e8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6709,6 +6709,7 @@ with pkgs;
   clementine = libsForQt5.callPackage ../applications/audio/clementine {
     gst_plugins =
       with gst_all_1; [ gst-plugins-base gst-plugins-good gst-plugins-ugly gst-libav ];
+    protobuf = protobuf3_21;
   };
 
   mellowplayer = libsForQt5.callPackage ../applications/audio/mellowplayer { };
@@ -10039,6 +10040,7 @@ with pkgs;
 
   netdata = callPackage ../tools/system/netdata {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation IOKit;
+    protobuf = protobuf3_21;
   };
   # Exposed here so the bots can auto-upgrade it
   netdata-go-plugins = callPackage ../tools/system/netdata/go.d.plugin.nix { };
@@ -10739,7 +10741,9 @@ with pkgs;
     electron = electron_22;
   };
 
-  mosh = callPackage ../tools/networking/mosh { };
+  mosh = callPackage ../tools/networking/mosh {
+    protobuf = protobuf3_21;
+  };
 
   motrix = callPackage ../tools/networking/motrix { };
 
@@ -26862,6 +26866,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) CoreServices;
     boost = boost177; # Configure checks for specific version.
     icu = icu69;
+    protobuf = protobuf3_21;
   };
 
   mysql_jdbc = callPackage ../servers/sql/mysql/jdbc { };

From b4b986693bb6a13b56bb43f849776f61162c5e84 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 18 Aug 2023 20:09:06 +0300
Subject: [PATCH 147/154] treewide: more protobuf downgrades

---
 pkgs/applications/misc/ola/default.nix |   2 +-
 pkgs/top-level/all-packages.nix        | 101 +++++++++++++++++++------
 pkgs/top-level/python-packages.nix     |   2 +-
 3 files changed, 79 insertions(+), 26 deletions(-)

diff --git a/pkgs/applications/misc/ola/default.nix b/pkgs/applications/misc/ola/default.nix
index 14055463fa3f1..b016aa8719c70 100644
--- a/pkgs/applications/misc/ola/default.nix
+++ b/pkgs/applications/misc/ola/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     python3
   ];
   propagatedBuildInputs = [
-    python3.pkgs.protobuf
+    (python3.pkgs.protobuf.override { protobuf = protobuf; })
     python3.pkgs.numpy
   ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6ef9507a603e8..8a7d60f13c092 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -731,7 +731,9 @@ with pkgs;
 
   protoc-gen-go-vtproto = callPackage ../development/tools/protoc-gen-go-vtproto { };
 
-  protoc-gen-grpc-web = callPackage ../development/tools/protoc-gen-grpc-web { };
+  protoc-gen-grpc-web = callPackage ../development/tools/protoc-gen-grpc-web {
+    protobuf = protobuf3_21;
+  };
 
   protoc-gen-connect-go = callPackage ../development/tools/protoc-gen-connect-go { };
 
@@ -2566,7 +2568,9 @@ with pkgs;
 
   gensgs = pkgsi686Linux.callPackage ../applications/emulators/gens-gs { };
 
-  goldberg-emu = callPackage ../applications/emulators/goldberg-emu { };
+  goldberg-emu = callPackage ../applications/emulators/goldberg-emu {
+    protobuf = protobuf3_21;
+  };
 
   gopsuinfo = callPackage ../tools/system/gopsuinfo { };
 
@@ -4059,7 +4063,9 @@ with pkgs;
 
   amoco = callPackage ../tools/security/amoco { };
 
-  anbox = callPackage ../os-specific/linux/anbox { };
+  anbox = callPackage ../os-specific/linux/anbox {
+    protobuf = protobuf3_21;
+  };
 
   androidenv = callPackage ../development/mobile/androidenv { };
 
@@ -4613,7 +4619,9 @@ with pkgs;
 
   common-licenses = callPackage ../data/misc/common-licenses { };
 
-  compactor = callPackage ../applications/networking/compactor { };
+  compactor = callPackage ../applications/networking/compactor {
+    protobuf = protobuf3_21;
+  };
 
   consul = callPackage ../servers/consul { };
 
@@ -5421,8 +5429,9 @@ with pkgs;
 
   ghdorker = callPackage ../tools/security/ghdorker { };
 
-  ghidra = if stdenv.isDarwin then darwin.apple_sdk_11_0.callPackage ../tools/security/ghidra/build.nix {}
-  else callPackage ../tools/security/ghidra/build.nix { };
+  ghidra = darwin.apple_sdk_11_0.callPackage ../tools/security/ghidra/build.nix {
+    protobuf = protobuf3_21;
+  };
 
   ghidra-bin = callPackage ../tools/security/ghidra { };
 
@@ -11188,7 +11197,9 @@ with pkgs;
 
   nq = callPackage ../tools/system/nq { };
 
-  nsjail = callPackage ../tools/security/nsjail { };
+  nsjail = callPackage ../tools/security/nsjail {
+    protobuf = protobuf3_21;
+  };
 
   nss_pam_ldapd = callPackage ../tools/networking/nss-pam-ldapd { };
 
@@ -11320,7 +11331,9 @@ with pkgs;
 
   oh-my-zsh = callPackage ../shells/zsh/oh-my-zsh { };
 
-  ola = callPackage ../applications/misc/ola { };
+  ola = callPackage ../applications/misc/ola {
+    protobuf = protobuf3_21;
+  };
 
   olive-editor = qt6Packages.callPackage ../applications/video/olive-editor {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation;
@@ -11591,7 +11604,9 @@ with pkgs;
 
   p3x-onenote = callPackage ../applications/office/p3x-onenote { };
 
-  p4c = callPackage ../development/compilers/p4c { };
+  p4c = callPackage ../development/compilers/p4c {
+    protobuf = protobuf3_21;
+  };
 
   p7zip = callPackage ../tools/archivers/p7zip { };
 
@@ -14956,7 +14971,9 @@ with pkgs;
 
   zasm = callPackage ../development/compilers/zasm { };
 
-  zbackup = callPackage ../tools/backup/zbackup { };
+  zbackup = callPackage ../tools/backup/zbackup {
+    protobuf = protobuf3_21;
+  };
 
   zbar = libsForQt5.callPackage ../tools/graphics/zbar {
     inherit (darwin.apple_sdk.frameworks) Foundation;
@@ -20045,9 +20062,14 @@ with pkgs;
     flex = flex_2_5_35;
   };
 
-  spoofer = callPackage ../tools/networking/spoofer { };
+  spoofer = callPackage ../tools/networking/spoofer {
+    protobuf = protobuf3_21;
+  };
 
-  spoofer-gui = callPackage ../tools/networking/spoofer { withGUI = true; };
+  spoofer-gui = callPackage ../tools/networking/spoofer {
+    withGUI = true;
+    protobuf = protobuf3_21;
+  };
 
   spooles = callPackage ../development/libraries/science/math/spooles { };
 
@@ -20763,7 +20785,9 @@ with pkgs;
 
   cmrt = callPackage ../development/libraries/cmrt { };
 
-  codecserver = callPackage ../applications/audio/codecserver { };
+  codecserver = callPackage ../applications/audio/codecserver {
+    protobuf = protobuf3_21;
+  };
 
   coeurl = callPackage ../development/libraries/coeurl { };
 
@@ -21271,7 +21295,9 @@ with pkgs;
 
   gallia = callPackage ../tools/security/gallia { };
 
-  gamenetworkingsockets = callPackage ../development/libraries/gamenetworkingsockets { };
+  gamenetworkingsockets = callPackage ../development/libraries/gamenetworkingsockets {
+    protobuf = protobuf3_21;
+  };
 
   game-music-emu = callPackage ../development/libraries/audio/game-music-emu { };
 
@@ -23284,7 +23310,9 @@ with pkgs;
 
   libptytty = callPackage ../development/libraries/libptytty { };
 
-  libpulsar = callPackage ../development/libraries/libpulsar { };
+  libpulsar = callPackage ../development/libraries/libpulsar {
+    protobuf = protobuf3_21;
+  };
 
   libpwquality = callPackage ../development/libraries/libpwquality {
     python = python3;
@@ -23689,7 +23717,9 @@ with pkgs;
 
   lightspark = callPackage ../misc/lightspark { };
 
-  lightstep-tracer-cpp = callPackage ../development/libraries/lightstep-tracer-cpp { };
+  lightstep-tracer-cpp = callPackage ../development/libraries/lightstep-tracer-cpp {
+    protobuf = protobuf3_21;
+  };
 
   ligolo-ng = callPackage ../tools/networking/ligolo-ng { };
 
@@ -27146,6 +27176,7 @@ with pkgs;
   rethinkdb = callPackage ../servers/nosql/rethinkdb {
     stdenv = clangStdenv;
     libtool = darwin.cctools;
+    protobuf = protobuf3_21;
   };
 
   rippled = callPackage ../servers/rippled {
@@ -28591,7 +28622,9 @@ with pkgs;
 
   sgx-ssl = callPackage ../os-specific/linux/sgx/ssl { };
 
-  sgx-psw = callPackage ../os-specific/linux/sgx/psw { };
+  sgx-psw = callPackage ../os-specific/linux/sgx/psw {
+    protobuf = protobuf3_21;
+  };
 
   shadow = callPackage ../os-specific/linux/shadow { };
 
@@ -30361,6 +30394,7 @@ with pkgs;
 
   astroid = callPackage ../applications/networking/mailreaders/astroid {
     vim = vim-full.override { features = "normal"; };
+    protobuf = protobuf3_21;
   };
 
   aucatctl = callPackage ../applications/audio/aucatctl { };
@@ -32374,7 +32408,9 @@ with pkgs;
     extra-packages = [ csound ];
   };
 
-  hyperion-ng = libsForQt5.callPackage ../applications/video/hyperion-ng { };
+  hyperion-ng = libsForQt5.callPackage ../applications/video/hyperion-ng {
+    protobuf = protobuf3_21;
+  };
 
   hyperledger-fabric = callPackage ../tools/misc/hyperledger-fabric { };
 
@@ -33981,7 +34017,9 @@ with pkgs;
 
   osm2pgsql = callPackage ../tools/misc/osm2pgsql { };
 
-  ostinato = libsForQt5.callPackage ../applications/networking/ostinato { };
+  ostinato = libsForQt5.callPackage ../applications/networking/ostinato {
+    protobuf = protobuf3_21;
+  };
 
   p4 = callPackage ../applications/version-management/p4 {
     inherit (darwin.apple_sdk.frameworks) CoreServices Foundation Security;
@@ -34085,6 +34123,7 @@ with pkgs;
 
   shogun = callPackage ../applications/science/machine-learning/shogun {
     opencv = opencv3;
+    protobuf = protobuf3_21;
   };
 
   smplayer = libsForQt5.callPackage ../applications/video/smplayer { };
@@ -34968,7 +35007,9 @@ with pkgs;
 
   rgp = libsForQt5.callPackage ../development/tools/rgp { };
 
-  ricochet = libsForQt5.callPackage ../applications/networking/instant-messengers/ricochet { };
+  ricochet = libsForQt5.callPackage ../applications/networking/instant-messengers/ricochet {
+    protobuf = protobuf3_21;
+  };
 
   ries = callPackage ../applications/science/math/ries { };
 
@@ -35292,7 +35333,10 @@ with pkgs;
 
   curaengine_stable = callPackage ../applications/misc/curaengine/stable.nix { };
 
-  curaengine = callPackage ../applications/misc/curaengine { inherit (python3.pkgs) libarcus; };
+  curaengine = callPackage ../applications/misc/curaengine {
+    inherit (python3.pkgs) libarcus;
+    protobuf = protobuf3_21;
+  };
 
   cura = libsForQt5.callPackage ../applications/misc/cura { };
 
@@ -35673,7 +35717,9 @@ with pkgs;
 
   tijolo = callPackage ../applications/editors/tijolo { };
 
-  tilemaker = callPackage ../applications/misc/tilemaker { };
+  tilemaker = callPackage ../applications/misc/tilemaker {
+    protobuf = protobuf3_21;
+  };
 
   timbreid = callPackage ../applications/audio/pd-plugins/timbreid {
     fftw = fftwSinglePrec;
@@ -36864,9 +36910,11 @@ with pkgs;
 
   bitcoin-abc  = libsForQt5.callPackage ../applications/blockchains/bitcoin-abc {
     withGui = true;
+    protobuf = protobuf3_21;
   };
   bitcoind-abc = callPackage ../applications/blockchains/bitcoin-abc {
     mkDerivation = stdenv.mkDerivation;
+    protobuf = protobuf3_21;
     withGui = false;
   };
 
@@ -37430,7 +37478,9 @@ with pkgs;
 
   ckan = callPackage ../games/ckan { };
 
-  cockatrice = libsForQt5.callPackage ../games/cockatrice {  };
+  cockatrice = libsForQt5.callPackage ../games/cockatrice {
+    protobuf = protobuf3_21;
+  };
 
   commandergenius = callPackage ../games/commandergenius { };
 
@@ -38020,10 +38070,13 @@ with pkgs;
 
   pong3d = callPackage ../games/pong3d { };
 
-  pokerth = libsForQt5.callPackage ../games/pokerth { };
+  pokerth = libsForQt5.callPackage ../games/pokerth {
+    protobuf = protobuf3_21;
+  };
 
   pokerth-server = libsForQt5.callPackage ../games/pokerth {
     target = "server";
+    protobuf = protobuf3_21;
   };
 
   pokete = callPackage ../games/pokete { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 29cbdf6d97b49..ca60dd3aa43da 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5868,7 +5868,7 @@ self: super: with self; {
   };
 
   libarcus = callPackage ../development/python-modules/libarcus {
-    inherit (pkgs) protobuf;
+    protobuf = pkgs.protobuf3_21;
   };
 
   libasyncns = callPackage ../development/python-modules/libasyncns {

From 0e6f4634b677c1c2a9732fc2aef3a481b86454de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sat, 19 Aug 2023 10:00:46 +0200
Subject: [PATCH 148/154] coeurl: fixup build with new meson

https://hydra.nixos.org/build/231336088/nixlog/4/tail
https://github.com/mesonbuild/meson/commit/6f4973abad9eec9fcc915117f1c3d1a93ccc948c
---
 pkgs/development/libraries/coeurl/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/libraries/coeurl/default.nix b/pkgs/development/libraries/coeurl/default.nix
index 9e779dea6d895..b0743e032c6ea 100644
--- a/pkgs/development/libraries/coeurl/default.nix
+++ b/pkgs/development/libraries/coeurl/default.nix
@@ -37,6 +37,9 @@ stdenv.mkDerivation rec {
       hash = "sha256-a52Id7Nm3Mmmwv7eL58j6xovjlkpAO4KahVM/Q3H65w=";
     })
   ];
+  postPatch = ''
+    substituteInPlace subprojects/curl.wrap --replace '[provides]' '[provide]'
+  '';
 
   nativeBuildInputs = [ ninja pkg-config meson ];
 

From d90b1cd83c2b7052a2e00bf2138cc052c34715ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sat, 19 Aug 2023 10:40:28 +0200
Subject: [PATCH 149/154] python311.protobuf3: fix build by upstream patch

Protobuf 3.22 supports python 3.11 already by including the same patch.
---
 pkgs/development/python-modules/protobuf/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/development/python-modules/protobuf/default.nix b/pkgs/development/python-modules/protobuf/default.nix
index d0f8e3bba99d3..2676dc90d68ba 100644
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@@ -33,6 +33,14 @@ buildPythonPackage {
       src = ./use-nixpkgs-abseil-cpp.patch;
       abseil_cpp_include_path = "${lib.getDev protobuf.abseil-cpp}/include";
     })
+  ]
+  ++ lib.optionals (pythonAtLeast "3.11" && lib.versionOlder protobuf.version "3.22") [
+    (fetchpatch {
+      name = "support-python311.patch";
+      url = "https://github.com/protocolbuffers/protobuf/commit/2206b63c4649cf2e8a06b66c9191c8ef862ca519.diff";
+      stripLen = 1; # because sourceRoot above
+      hash = "sha256-3GaoEyZIhS3QONq8LEvJCH5TdO9PKnOgcQF0GlEiwFo=";
+    })
   ];
 
   prePatch = ''

From bb4a69c2ad0c72965de60d1459ec7b193749d15c Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 19 Aug 2023 17:11:42 +0300
Subject: [PATCH 150/154] python3Packages.scikit-build-core: skip test that
 doesn't work with our ninja stub

---
 .../python-modules/scikit-build-core/default.nix            | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/scikit-build-core/default.nix b/pkgs/development/python-modules/scikit-build-core/default.nix
index c3fac4ea34df0..bf0d3b28c9bb7 100644
--- a/pkgs/development/python-modules/scikit-build-core/default.nix
+++ b/pkgs/development/python-modules/scikit-build-core/default.nix
@@ -74,6 +74,12 @@ buildPythonPackage rec {
     "tests/test_setuptools_pep518.py"
   ];
 
+  # Tries to access ninja.__version__ which our stub doesn't have.
+  # FIXME: remove for next cycle
+  disabledTests = [
+    "test_get_ninja_programs_cmake_module"
+  ];
+
   pythonImportsCheck = [
     "scikit_build_core"
   ];

From d66d4939f4d61b047077c33f6afbe75a71e1c715 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 19 Aug 2023 17:26:14 +0300
Subject: [PATCH 151/154] treewide: more protobuf downgrades

---
 pkgs/top-level/all-packages.nix    | 4 +++-
 pkgs/top-level/python-packages.nix | 8 ++++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6e93759d3241e..8dfc025321974 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -24697,7 +24697,9 @@ with pkgs;
 
   qm-dsp = callPackage ../development/libraries/audio/qm-dsp { };
 
-  qradiolink = callPackage ../applications/radio/qradiolink { };
+  qradiolink = callPackage ../applications/radio/qradiolink {
+    protobuf = protobuf3_21;
+  };
 
   qrupdate = callPackage ../development/libraries/qrupdate { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index fdf95807fa629..2a9df76c315e8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7371,7 +7371,9 @@ self: super: with self; {
     protobuf = protobuf3;
   };
 
-  onnxconverter-common = callPackage ../development/python-modules/onnxconverter-common { };
+  onnxconverter-common = callPackage ../development/python-modules/onnxconverter-common {
+    protobuf = protobuf3;
+  };
 
   onnxmltools = callPackage ../development/python-modules/onnxmltools { };
 
@@ -11708,7 +11710,9 @@ self: super: with self; {
 
   skidl = callPackage ../development/python-modules/skidl { };
 
-  skl2onnx = callPackage ../development/python-modules/skl2onnx { };
+  skl2onnx = callPackage ../development/python-modules/skl2onnx {
+    protobuf = protobuf3;
+  };
 
   sklearn-deap = callPackage ../development/python-modules/sklearn-deap { };
 

From ce17978b1ac125e9e32cce49d9d5cd5493c47cea Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 19 Aug 2023 17:59:36 +0300
Subject: [PATCH 152/154] python3Packages.coffea: relax numpy version
 constraint

---
 pkgs/development/python-modules/coffea/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/coffea/default.nix b/pkgs/development/python-modules/coffea/default.nix
index ac0c293e29ab2..ba60cc47a8c39 100644
--- a/pkgs/development/python-modules/coffea/default.nix
+++ b/pkgs/development/python-modules/coffea/default.nix
@@ -43,7 +43,8 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "numba>=0.57.0" "numba"
+      --replace "numba>=0.57.0" "numba" \
+      --replace "numpy>=1.22.0,<1.25" "numpy"
   '';
 
   nativeBuildInputs = [

From e7cf9a7c458ba188fba69f703c349c22bc42c6f4 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sun, 20 Aug 2023 00:17:10 -0400
Subject: [PATCH 153/154] swift: update for cc-wrapper changes

The Swift compiler derivation modifies the clang wrapper to use
`exec -a "$0"` to allow it to use the same binary for both `clang` and
`clang++`. The sed script it uses to do this fails after the cc-wrapper
changes in 6f2b3ba027f0d74614ba1b21f15ea45b0beb0385 were merged.

This is fixed by updating `makeClangWrapper` to work with the cc-wrapper
changes by having Bash invoke a simple script that uses `exec -a "$0"`
to set the required name for clang.

This fixes the staging-next build failures with Swift on Darwin and Linux.

https://github.com/NixOS/nixpkgs/pull/248496#issuecomment-1676831102
---
 pkgs/development/compilers/swift/compiler/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/swift/compiler/default.nix b/pkgs/development/compilers/swift/compiler/default.nix
index 821d61229d8d2..30fb18db8fd22 100644
--- a/pkgs/development/compilers/swift/compiler/default.nix
+++ b/pkgs/development/compilers/swift/compiler/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , callPackage
 , cmake
+, bash
 , coreutils
 , gnugrep
 , perl
@@ -133,7 +134,8 @@ let
     sed < '${clang}/bin/clang' > "$targetFile" \
       -e 's|^\s*exec|exec -a "$0"|g' \
       -e 's|^\[\[ "${clang.cc}/bin/clang" = \*++ ]]|[[ "$0" = *++ ]]|' \
-      -e "s|${clang.cc}/bin/clang|$unwrappedClang|g"
+      -e "s|${clang.cc}/bin/clang|$unwrappedClang|g" \
+      -e "s|^\(\s*\)\($unwrappedClang\) \"@\\\$responseFile\"|\1argv0=\$0\n\1${bash}/bin/bash -c \"exec -a '\$argv0' \2 '@\$responseFile'\"|"
     chmod a+x "$targetFile"
   '';
 

From d121cf41354d58a2f814cc807d922ff8ceea6f0c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sun, 20 Aug 2023 21:33:25 +0200
Subject: [PATCH 154/154] libtensorflow: mark as broken and vulnerable

https://github.com/NixOS/nixpkgs/issues/250245
---
 pkgs/development/python-modules/tensorflow/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/tensorflow/default.nix b/pkgs/development/python-modules/tensorflow/default.nix
index 8d16f6921d2f8..348f5197a9d6e 100644
--- a/pkgs/development/python-modules/tensorflow/default.nix
+++ b/pkgs/development/python-modules/tensorflow/default.nix
@@ -448,7 +448,10 @@ let
       license = licenses.asl20;
       maintainers = with maintainers; [ abbradar ];
       platforms = with platforms; linux ++ darwin;
-      broken = !(xlaSupport -> cudaSupport) || python.pythonVersion == "3.11";
+      # More vulnerabilities in 2.11.1 really; https://github.com/tensorflow/tensorflow/releases
+      knownVulnerabilities = [ "CVE-2023-33976" ];
+      broken = true || # most likely needs dealing with protobuf/abseil updates
+        !(xlaSupport -> cudaSupport) || python.pythonVersion == "3.11";
     } // lib.optionalAttrs stdenv.isDarwin {
       timeout = 86400; # 24 hours
       maxSilent = 14400; # 4h, double the default of 7200s