From 48ecbdfa9a871b57ed131c146c26523cdc098166 Mon Sep 17 00:00:00 2001
From: Jan Malakhovski <oxij@oxij.org>
Date: Thu, 28 Nov 2024 12:00:00 +0000
Subject: [PATCH 1/5] fetchurl: improve GNU Savannah mirrors

---
 pkgs/build-support/fetchurl/mirrors.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index ea6ee11b23b3f..3971302634cfa 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -221,7 +221,13 @@
 
   # GNU Savannah
   savannah = [
-    # Mirrors from https://download-mirror.savannah.gnu.org/releases/00_MIRRORS.html
+    # Try the official HTTP(S) dispatchers first.
+    # These generate redirects to mirrors appropriate for the user.
+    "https://download.savannah.gnu.org/releases/"
+    "https://download.savannah.nongnu.org/releases/"
+
+    # If the above fail, try some individual mirrors.
+    # These are taken from https://download-mirror.savannah.gnu.org/releases/00_MIRRORS.html
     "https://mirror.easyname.at/nongnu/"
     "https://savannah.c3sl.ufpr.br/"
     "https://mirror.csclub.uwaterloo.ca/nongnu/"

From da78730cf62f51c5204c46dd2a733ec9db0aadea Mon Sep 17 00:00:00 2001
From: Jan Malakhovski <oxij@oxij.org>
Date: Thu, 28 Nov 2024 13:00:00 +0000
Subject: [PATCH 2/5] treewide: use `mirror://savannah` when possible

... and improve some related `meta` URLs
---
 pkgs/applications/misc/devilspie2/default.nix          | 2 +-
 pkgs/applications/radio/klog/default.nix               | 2 +-
 pkgs/by-name/cu/cuyo/package.nix                       | 2 +-
 pkgs/by-name/fa/fastjar/package.nix                    | 2 +-
 pkgs/by-name/gu/guile-reader/package.nix               | 2 +-
 pkgs/by-name/m1/m17n_db/package.nix                    | 2 +-
 pkgs/by-name/mi/mi2ly/package.nix                      | 2 +-
 pkgs/by-name/nm/nmh/package.nix                        | 4 ++--
 pkgs/by-name/sk/skribilo/package.nix                   | 2 +-
 pkgs/by-name/st/storeBackup/package.nix                | 2 +-
 pkgs/by-name/xl/xlog/package.nix                       | 2 +-
 pkgs/development/python-modules/matplotlib/default.nix | 2 +-
 pkgs/tools/inputmethods/m17n-lib/default.nix           | 2 +-
 pkgs/tools/inputmethods/m17n-lib/otf.nix               | 2 +-
 14 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/pkgs/applications/misc/devilspie2/default.nix b/pkgs/applications/misc/devilspie2/default.nix
index 89af855c78625..e71b189e8e7c7 100644
--- a/pkgs/applications/misc/devilspie2/default.nix
+++ b/pkgs/applications/misc/devilspie2/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   version = "0.44";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/devilspie2/devilspie2-${version}.tar.xz";
+    url = "mirror://savannah/${pname}/${pname}-${version}.tar.xz";
     sha256 = "Cp8erdKyKjGBY+QYAGXUlSIboaQ60gIepoZs0RgEJkA=";
   };
 
diff --git a/pkgs/applications/radio/klog/default.nix b/pkgs/applications/radio/klog/default.nix
index 9ac067a418970..f4729c183ed97 100644
--- a/pkgs/applications/radio/klog/default.nix
+++ b/pkgs/applications/radio/klog/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   version = "1.3.2";
 
   src = fetchurl {
-    url = "https://download.savannah.nongnu.org/releases/klog/${pname}-${version}.tar.gz";
+    url = "mirror://savannah/${pname}/${pname}-${version}.tar.gz";
     sha256 = "1d5x7rq0mgfrqws3q1y4z8wh2qa3gvsmd0ssf2yqgkyq3fhdrb5c";
   };
 
diff --git a/pkgs/by-name/cu/cuyo/package.nix b/pkgs/by-name/cu/cuyo/package.nix
index f95a9d3b5a91e..1f816b9fa00c3 100644
--- a/pkgs/by-name/cu/cuyo/package.nix
+++ b/pkgs/by-name/cu/cuyo/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   version = "2.1.0";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/cuyo/cuyo-2.1.0.tar.gz";
+    url = "mirror://savannah/cuyo/cuyo-2.1.0.tar.gz";
     sha256 = "17yqv924x7yvwix7yz9jdhgyar8lzdhqvmpvv0any8rdkajhj23c";
   };
 
diff --git a/pkgs/by-name/fa/fastjar/package.nix b/pkgs/by-name/fa/fastjar/package.nix
index c2d5f56dd08df..f7489cabea26f 100644
--- a/pkgs/by-name/fa/fastjar/package.nix
+++ b/pkgs/by-name/fa/fastjar/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchzip {
     pname = "fastjar-source";
     inherit (finalAttrs) version;
-    url = "https://download.savannah.gnu.org/releases/fastjar/fastjar-${finalAttrs.version}.tar.gz";
+    url = "mirror://savannah/fastjar/fastjar-${finalAttrs.version}.tar.gz";
     hash = "sha256-8VyKNQaPLrXAy/UEm2QkBx56SSSoLdU/7w4IwrxbsQc=";
   };
 
diff --git a/pkgs/by-name/gu/guile-reader/package.nix b/pkgs/by-name/gu/guile-reader/package.nix
index 8dc4a06fe0804..ab79f2232cc33 100644
--- a/pkgs/by-name/gu/guile-reader/package.nix
+++ b/pkgs/by-name/gu/guile-reader/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   version = "0.6.3";
 
   src = fetchurl {
-    url = "http://download.savannah.nongnu.org/releases/${pname}/${pname}-${version}.tar.gz";
+    url = "mirror://savannah/${pname}/${pname}-${version}.tar.gz";
     hash = "sha256-OMK0ROrbuMDKt42QpE7D6/9CvUEMW4SpEBjO5+tk0rs=";
   };
 
diff --git a/pkgs/by-name/m1/m17n_db/package.nix b/pkgs/by-name/m1/m17n_db/package.nix
index 4109b37a3613a..4029a1bac1ddb 100644
--- a/pkgs/by-name/m1/m17n_db/package.nix
+++ b/pkgs/by-name/m1/m17n_db/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   version = "1.8.9";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/m17n/m17n-db-${version}.tar.gz";
+    url = "mirror://savannah/m17n/${pname}-${version}.tar.gz";
     sha256 = "sha256-SBJUo4CqnGbX9Ow6o3Kn4dL+R/w53252BEvUQBfEJKQ=";
   };
 
diff --git a/pkgs/by-name/mi/mi2ly/package.nix b/pkgs/by-name/mi/mi2ly/package.nix
index 56fb4f5b3a877..1676e0de0b828 100644
--- a/pkgs/by-name/mi/mi2ly/package.nix
+++ b/pkgs/by-name/mi/mi2ly/package.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   version = "0.12";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/mi2ly/mi2ly.${version}.tar.bz2";
+    url = "mirror://savannah/${pname}/${pname}.${version}.tar.bz2";
     sha256 = "sha256-lFbqH+syFaQDMbXfb+OUcWnyKnjfVz9yl7DbTTn7JKw=";
   };
 
diff --git a/pkgs/by-name/nm/nmh/package.nix b/pkgs/by-name/nm/nmh/package.nix
index 0eebc1cb85e02..1faefd68d6c66 100644
--- a/pkgs/by-name/nm/nmh/package.nix
+++ b/pkgs/by-name/nm/nmh/package.nix
@@ -60,8 +60,8 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "New MH Mail Handling System";
     homepage = "https://nmh.nongnu.org/";
-    downloadPage = "http://download.savannah.nongnu.org/releases/nmh/";
-    changelog = "http://savannah.nongnu.org/news/?group=nmh";
+    downloadPage = "https://download.savannah.nongnu.org/releases/nmh/";
+    changelog = "https://savannah.nongnu.org/news/?group=nmh";
     license = [ lib.licenses.bsd3 ];
     longDescription = ''
       This is the nmh mail user agent (reader/sender), a command-line based
diff --git a/pkgs/by-name/sk/skribilo/package.nix b/pkgs/by-name/sk/skribilo/package.nix
index 2fe0eb835f7a9..35e715b3aece0 100644
--- a/pkgs/by-name/sk/skribilo/package.nix
+++ b/pkgs/by-name/sk/skribilo/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   version = "0.10.0";
 
   src = fetchurl {
-    url = "http://download.savannah.nongnu.org/releases/skribilo/skribilo-${finalAttrs.version}.tar.gz";
+    url = "mirror://savannah/skribilo/skribilo-${finalAttrs.version}.tar.gz";
     hash = "sha256-jP9I7hds7f1QMmSaNJpGlSvqUOwGcg+CnBzMopIS9Q4=";
   };
 
diff --git a/pkgs/by-name/st/storeBackup/package.nix b/pkgs/by-name/st/storeBackup/package.nix
index 8a58698c0cdfb..35610056b2a50 100644
--- a/pkgs/by-name/st/storeBackup/package.nix
+++ b/pkgs/by-name/st/storeBackup/package.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ perl ];
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/storebackup/storeBackup-${version}.tar.bz2";
+    url = "mirror://savannah/storebackup/storeBackup-${version}.tar.bz2";
     hash = "sha256-Ki1DT2zypFFiiMVd9Y8eSX7T+yr8moWMoALmAexjqWU=";
   };
 
diff --git a/pkgs/by-name/xl/xlog/package.nix b/pkgs/by-name/xl/xlog/package.nix
index 5b3d66411233e..1f6b01a76fb6b 100644
--- a/pkgs/by-name/xl/xlog/package.nix
+++ b/pkgs/by-name/xl/xlog/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   version = "2.0.25";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/xlog/${pname}-${version}.tar.gz";
+    url = "mirror://savannah/${pname}/${pname}-${version}.tar.gz";
     sha256 = "sha256-NYC3LgoLXnJQURcZTc2xHOzOleotrWtOETMBgadf2qU=";
   };
 
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 9e520493597b7..269cf74879da4 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -192,7 +192,7 @@ buildPythonPackage rec {
       doCheck = true;
       freetype = freetype.overrideAttrs (_: {
         src = fetchurl {
-          url = "https://download.savannah.gnu.org/releases/freetype/freetype-old/freetype-2.6.1.tar.gz";
+          url = "mirror://savannah/freetype/freetype-old/freetype-2.6.1.tar.gz";
           sha256 = "sha256-Cjx9+9ptoej84pIy6OltmHq6u79x68jHVlnkEyw2cBQ=";
         };
         patches = [ ];
diff --git a/pkgs/tools/inputmethods/m17n-lib/default.nix b/pkgs/tools/inputmethods/m17n-lib/default.nix
index cf8bc4ea0a1a9..0148e07407ba4 100644
--- a/pkgs/tools/inputmethods/m17n-lib/default.nix
+++ b/pkgs/tools/inputmethods/m17n-lib/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   version = "1.8.4";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/m17n/m17n-lib-${version}.tar.gz";
+    url = "mirror://savannah/m17n/${pname}-${version}.tar.gz";
     hash = "sha256-xqJYLG5PKowueihE+lx+s2Oq0lOLBS8gPHEGSd1CHMg=";
   };
 
diff --git a/pkgs/tools/inputmethods/m17n-lib/otf.nix b/pkgs/tools/inputmethods/m17n-lib/otf.nix
index b92b57746e851..92dc9f5d06831 100644
--- a/pkgs/tools/inputmethods/m17n-lib/otf.nix
+++ b/pkgs/tools/inputmethods/m17n-lib/otf.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   version = "0.9.16";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/m17n/${pname}-${version}.tar.gz";
+    url = "mirror://savannah/m17n/${pname}-${version}.tar.gz";
     sha256 = "0sq6g3xaxw388akws6qrllp3kp2sxgk2dv4j79k6mm52rnihrnv8";
   };
 

From f585b6c33a92ecc38e0ba387ba9808868e1d202a Mon Sep 17 00:00:00 2001
From: Jan Malakhovski <oxij@oxij.org>
Date: Wed, 19 Mar 2025 18:20:00 +0000
Subject: [PATCH 3/5] fetchurl: update samba mirrors' URLs

---
 pkgs/build-support/fetchurl/mirrors.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index 3971302634cfa..731ad01042066 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -215,8 +215,8 @@
 
   # SAMBA
   samba = [
-    "https://www.samba.org/ftp/"
-    "http://www.samba.org/ftp/"
+    "https://download.samba.org/pub/"
+    "http://download.samba.org/pub/"
   ];
 
   # GNU Savannah

From 241ee0fa7a4a754c45203eb0eac24ae218cde454 Mon Sep 17 00:00:00 2001
From: Jan Malakhovski <oxij@oxij.org>
Date: Wed, 19 Mar 2025 10:00:00 +0000
Subject: [PATCH 4/5] xmlsec: add a URL for older releases

---
 pkgs/by-name/xm/xmlsec/package.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/xm/xmlsec/package.nix b/pkgs/by-name/xm/xmlsec/package.nix
index 80a6ed8b6ea72..08109f4a00d74 100644
--- a/pkgs/by-name/xm/xmlsec/package.nix
+++ b/pkgs/by-name/xm/xmlsec/package.nix
@@ -21,7 +21,12 @@ lib.fix (
     version = "1.3.7";
 
     src = fetchurl {
-      url = "https://www.aleksey.com/xmlsec/download/xmlsec1-${version}.tar.gz";
+      urls = [
+        "https://www.aleksey.com/xmlsec/download/xmlsec1-${version}.tar.gz"
+
+        # for when the ${version} gets older than the last two
+        "https://www.aleksey.com/xmlsec/download/older-releases/xmlsec1-${version}.tar.gz"
+      ];
       sha256 = "sha256-2C6TtpuKogWmFrYpF6JpMiv2Oj6q+zd1AU5hdSsgE+o=";
     };
 

From 4c9993c5a4ad3730d1c247a6387cef7c7fe97261 Mon Sep 17 00:00:00 2001
From: Jan Malakhovski <oxij@oxij.org>
Date: Wed, 19 Mar 2025 14:40:00 +0000
Subject: [PATCH 5/5] treewide: use `hash = "sha256-.*"` in all touched files
 whenever possible

... but only when it does not require editing the hash itself, i.e.,  keeping
non-`base64` hashes as-is.
---
 pkgs/applications/misc/devilspie2/default.nix          | 2 +-
 pkgs/by-name/m1/m17n_db/package.nix                    | 2 +-
 pkgs/by-name/mi/mi2ly/package.nix                      | 2 +-
 pkgs/by-name/xl/xlog/package.nix                       | 2 +-
 pkgs/by-name/xm/xmlsec/package.nix                     | 2 +-
 pkgs/development/python-modules/matplotlib/default.nix | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/misc/devilspie2/default.nix b/pkgs/applications/misc/devilspie2/default.nix
index e71b189e8e7c7..8fc86ff3a3bab 100644
--- a/pkgs/applications/misc/devilspie2/default.nix
+++ b/pkgs/applications/misc/devilspie2/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://savannah/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "Cp8erdKyKjGBY+QYAGXUlSIboaQ60gIepoZs0RgEJkA=";
+    hash = "sha256-Cp8erdKyKjGBY+QYAGXUlSIboaQ60gIepoZs0RgEJkA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/m1/m17n_db/package.nix b/pkgs/by-name/m1/m17n_db/package.nix
index 4029a1bac1ddb..416479917efca 100644
--- a/pkgs/by-name/m1/m17n_db/package.nix
+++ b/pkgs/by-name/m1/m17n_db/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://savannah/m17n/${pname}-${version}.tar.gz";
-    sha256 = "sha256-SBJUo4CqnGbX9Ow6o3Kn4dL+R/w53252BEvUQBfEJKQ=";
+    hash = "sha256-SBJUo4CqnGbX9Ow6o3Kn4dL+R/w53252BEvUQBfEJKQ=";
   };
 
   nativeBuildInputs = [ gettext ];
diff --git a/pkgs/by-name/mi/mi2ly/package.nix b/pkgs/by-name/mi/mi2ly/package.nix
index 1676e0de0b828..f78d1df79a5e0 100644
--- a/pkgs/by-name/mi/mi2ly/package.nix
+++ b/pkgs/by-name/mi/mi2ly/package.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://savannah/${pname}/${pname}.${version}.tar.bz2";
-    sha256 = "sha256-lFbqH+syFaQDMbXfb+OUcWnyKnjfVz9yl7DbTTn7JKw=";
+    hash = "sha256-lFbqH+syFaQDMbXfb+OUcWnyKnjfVz9yl7DbTTn7JKw=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/xl/xlog/package.nix b/pkgs/by-name/xl/xlog/package.nix
index 1f6b01a76fb6b..a424c48df43f1 100644
--- a/pkgs/by-name/xl/xlog/package.nix
+++ b/pkgs/by-name/xl/xlog/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://savannah/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-NYC3LgoLXnJQURcZTc2xHOzOleotrWtOETMBgadf2qU=";
+    hash = "sha256-NYC3LgoLXnJQURcZTc2xHOzOleotrWtOETMBgadf2qU=";
   };
 
   # glib-2.62 deprecations
diff --git a/pkgs/by-name/xm/xmlsec/package.nix b/pkgs/by-name/xm/xmlsec/package.nix
index 08109f4a00d74..f1b8f9b472e34 100644
--- a/pkgs/by-name/xm/xmlsec/package.nix
+++ b/pkgs/by-name/xm/xmlsec/package.nix
@@ -27,7 +27,7 @@ lib.fix (
         # for when the ${version} gets older than the last two
         "https://www.aleksey.com/xmlsec/download/older-releases/xmlsec1-${version}.tar.gz"
       ];
-      sha256 = "sha256-2C6TtpuKogWmFrYpF6JpMiv2Oj6q+zd1AU5hdSsgE+o=";
+      hash = "sha256-2C6TtpuKogWmFrYpF6JpMiv2Oj6q+zd1AU5hdSsgE+o=";
     };
 
     patches = [
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 269cf74879da4..735e13d741426 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -193,7 +193,7 @@ buildPythonPackage rec {
       freetype = freetype.overrideAttrs (_: {
         src = fetchurl {
           url = "mirror://savannah/freetype/freetype-old/freetype-2.6.1.tar.gz";
-          sha256 = "sha256-Cjx9+9ptoej84pIy6OltmHq6u79x68jHVlnkEyw2cBQ=";
+          hash = "sha256-Cjx9+9ptoej84pIy6OltmHq6u79x68jHVlnkEyw2cBQ=";
         };
         patches = [ ];
       });