Merge pull request #99709 from NixOS/staging-next

Staging next

doc/stdenv/stdenv.xml

@@ -1833,6 +1833,19 @@ addEnvHooks "$hostOffset" myBashFunction
       </para>
      </listitem>
     </varlistentry>
+    <varlistentry>
+     <term>
+      <literal>move-systemd-user-units.sh</literal>
+     </term>
+     <listitem>
+      <para>
+       This setup hook moves any systemd user units installed in the lib
+       subdirectory into share. In addition, a link is provided from share to
+       lib for compatibility. This is needed for systemd to find user services
+       when installed into the user profile.
+      </para>
+     </listitem>
+    </varlistentry>
     <varlistentry>
      <term>
       <literal>set-source-date-epoch-to-latest.sh</literal>

lib/systems/examples.nix

@@ -179,8 +179,8 @@ rec {
   iphone64 = {
     config = "aarch64-apple-ios";
     # config = "aarch64-apple-darwin14";
-    sdkVer = "12.4";
+    sdkVer = "13.2";
-    xcodeVer = "10.3";
+    xcodeVer = "11.3.1";
     xcodePlatform = "iPhoneOS";
     useiOSPrebuilt = true;
     platform = {};
@@ -189,8 +189,8 @@ rec {
   iphone32 = {
     config = "armv7a-apple-ios";
     # config = "arm-apple-darwin10";
-    sdkVer = "12.4";
+    sdkVer = "13.2";
-    xcodeVer = "10.3";
+    xcodeVer = "11.3.1";
     xcodePlatform = "iPhoneOS";
     useiOSPrebuilt = true;
     platform = {};
@@ -199,8 +199,8 @@ rec {
   iphone64-simulator = {
     config = "x86_64-apple-ios";
     # config = "x86_64-apple-darwin14";
-    sdkVer = "12.4";
+    sdkVer = "13.2";
-    xcodeVer = "10.3";
+    xcodeVer = "11.3.1";
     xcodePlatform = "iPhoneSimulator";
     useiOSPrebuilt = true;
     platform = {};
@@ -209,8 +209,8 @@ rec {
   iphone32-simulator = {
     config = "i686-apple-ios";
     # config = "i386-apple-darwin11";
-    sdkVer = "12.4";
+    sdkVer = "13.2";
-    xcodeVer = "10.3";
+    xcodeVer = "11.3.1";
     xcodePlatform = "iPhoneSimulator";
     useiOSPrebuilt = true;
     platform = {};

nixos/doc/manual/release-notes/rl-2103.xml

@@ -65,10 +65,21 @@
    </listitem>
    <listitem>
     <para>
-      The option <option>fonts.enableFontDir</option> has been renamed to
+     If the <varname>services.dbus</varname> module is enabled, then
-      <xref linkend="opt-fonts.fontDir.enable"/>. The path of font directory
+     the user D-Bus session is now always socket activated. The
-      has also been changed to <literal>/run/current-system/sw/share/X11/fonts</literal>,
+     associated options <varname>services.dbus.socketActivated</varname>
-      for consistency with other X11 resources.
+     and <varname>services.xserver.startDbusSession</varname> have
+     therefore been removed and you will receive a warning if
+     they are present in your configuration. This change makes the
+     user D-Bus session available also for non-graphical logins.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The option <option>fonts.enableFontDir</option> has been renamed to
+     <xref linkend="opt-fonts.fontDir.enable"/>. The path of font directory
+     has also been changed to <literal>/run/current-system/sw/share/X11/fonts</literal>,
+     for consistency with other X11 resources.
     </para>
    </listitem>
    <listitem>

nixos/modules/config/system-path.nix

@@ -142,6 +142,7 @@ in
         "/share/kservices5"
         "/share/kservicetypes5"
         "/share/kxmlgui5"
+        "/share/systemd"
       ];
 
     system.path = pkgs.buildEnv {

nixos/modules/services/system/dbus.nix

@@ -19,6 +19,12 @@ in
 
 {
 
+  imports = [
+    (mkRemovedOptionModule
+      [ "services" "dbus" "socketActivated" ]
+      "The user D-Bus session is now always socket activated and this option can safely be removed.")
+  ];
+
   ###### interface
 
   options = {
@@ -51,14 +57,6 @@ in
           <filename><replaceable>pkg</replaceable>/share/dbus-1/services</filename>
         '';
       };
-
-      socketActivated = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Make the user instance socket activated.
-        '';
-      };
     };
   };
 
@@ -108,7 +106,7 @@ in
         reloadIfChanged = true;
         restartTriggers = [ configDir ];
       };
-      sockets.dbus.wantedBy = mkIf cfg.socketActivated [ "sockets.target" ];
+      sockets.dbus.wantedBy = [ "sockets.target" ];
     };
 
     environment.pathsToLink = [ "/etc/dbus-1" "/share/dbus-1" ];

nixos/modules/services/x11/display-managers/default.nix

@@ -37,13 +37,6 @@ let
       . /etc/profile
       cd "$HOME"
 
-      ${optionalString cfg.startDbusSession ''
-        if test -z "$DBUS_SESSION_BUS_ADDRESS"; then
-          /run/current-system/systemd/bin/systemctl --user start dbus.socket
-          export `/run/current-system/systemd/bin/systemctl --user show-environment | grep '^DBUS_SESSION_BUS_ADDRESS'`
-        fi
-      ''}
-
       ${optionalString cfg.displayManager.job.logToJournal ''
         if [ -z "$_DID_SYSTEMD_CAT" ]; then
           export _DID_SYSTEMD_CAT=1

nixos/modules/services/x11/xserver.nix

@@ -152,6 +152,9 @@ in
       ./desktop-managers/default.nix
       (mkRemovedOptionModule [ "services" "xserver" "startGnuPGAgent" ]
         "See the 16.09 release notes for more information.")
+      (mkRemovedOptionModule
+        [ "services" "xserver" "startDbusSession" ]
+        "The user D-Bus session is now always socket activated and this option can safely be removed.")
       (mkRemovedOptionModule ["services" "xserver" "useXFS" ]
         "Use services.xserver.fontPath instead of useXFS")
     ];
@@ -299,14 +302,6 @@ in
         description = "DPI resolution to use for X server.";
       };
 
-      startDbusSession = mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-          Whether to start a new DBus session when you log in with dbus-launch.
-        '';
-      };
-
       updateDbusEnvironment = mkOption {
         type = types.bool;
         default = false;

nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py

@@ -200,9 +200,7 @@ def main():
     else:
         # Update bootloader to latest if needed
         systemd_version = subprocess.check_output(["@systemd@/bin/bootctl", "--version"], universal_newlines=True).split()[1]
-        # Ideally this should use check_output as well, but as a temporary
+        sdboot_status = subprocess.check_output(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "status"], universal_newlines=True)
-        # work-around for #97433 we ignore any errors.
-        sdboot_status = subprocess.run(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "status"], universal_newlines=True, stdout=subprocess.PIPE).stdout
 
         # See status_binaries() in systemd bootctl.c for code which generates this
         m = re.search("^\W+File:.*/EFI/(BOOT|systemd)/.*\.efi \(systemd-boot (\d+)\)$",

pkgs/applications/audio/mopidy/mpris.nix

@@ -2,12 +2,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "mopidy-mpris";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = python3Packages.fetchPypi {
     inherit version;
     pname = "Mopidy-MPRIS";
-    sha256 = "0qk46aq5r92qgkldzl41x09naww1gv92l4c4hknyl7yymyvm9lr2";
+    sha256 = "0mmdaikw00f43gzjdbvlcvzff6yppm7v8mv012r79adzd992q9y0";
   };
 
   propagatedBuildInputs = [
@@ -18,7 +18,7 @@ python3Packages.buildPythonApplication rec {
   doCheck = false;
 
   meta = with stdenv.lib; {
-    homepage = https://www.mopidy.com/;
+    homepage = "https://www.mopidy.com/";
     description = "Mopidy extension for controlling Mopidy through D-Bus using the MPRIS specification";
     license = licenses.asl20;
     maintainers = [ maintainers.nickhu ];

pkgs/applications/gis/grass/default.nix

@@ -3,6 +3,8 @@
 , proj, gdal, geos, sqlite, postgresql, libmysqlclient, python2Packages, libLAS, proj-datumgrid
 }:
 
+let inherit (stdenv) lib; in
+
 stdenv.mkDerivation rec {
   name = "grass";
   version = "7.6.1";
@@ -42,7 +44,7 @@ stdenv.mkDerivation rec {
     "--with-postgres-libs=${postgresql.lib}/lib/"
     # it complains about missing libmysqld but doesn't really seem to need it
     "--with-mysql"
-    "--with-mysql-includes=${libmysqlclient}/include/mysql"
+    "--with-mysql-includes=${lib.getDev libmysqlclient}/include/mysql"
     "--with-mysql-libs=${libmysqlclient}/lib/mysql"
     "--with-blas"
     "--with-liblas=${libLAS}/bin/liblas-config"

pkgs/applications/misc/gsimplecal/default.nix

@@ -9,6 +9,10 @@ stdenv.mkDerivation rec {
     sha256 = "1sa05ifjp41xipfspk5n6l3wzpzmp3i45q88l01p4l6k6drsq336";
   };
 
+  postPatch = ''
+    sed -ie '/sys\/sysctl.h/d' src/Unique.cpp
+  '';
+
   enableParallelBuilding = true;
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/applications/networking/ids/snort/default.nix

@@ -1,16 +1,20 @@
-{stdenv, pkgconfig, luajit, openssl, fetchurl, libpcap, pcre, libdnet, daq, zlib, flex, bison, makeWrapper}:
+{stdenv, pkgconfig, luajit, openssl, fetchurl, libpcap, pcre, libdnet, daq, zlib, flex, bison, makeWrapper
+, libtirpc
+}:
 
 stdenv.mkDerivation rec {
   version = "2.9.16.1";
   pname = "snort";
-  
+
   src = fetchurl {
     name = "${pname}-${version}.tar.gz";
     url = "https://snort.org/downloads/archive/snort/${pname}-${version}.tar.gz";
     sha256 = "13lzvjli6kbsnkd7lf0rm71l2mnz38pxk76ia9yrjb6clfhlbb73";
   };
-  
+
-  buildInputs = [ makeWrapper pkgconfig luajit openssl libpcap pcre libdnet daq zlib flex bison ];
+  buildInputs = [ makeWrapper pkgconfig luajit openssl libpcap pcre libdnet daq zlib flex bison libtirpc ];
+
+  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
 
   enableParallelBuilding = true;
 
@@ -24,7 +28,7 @@ stdenv.mkDerivation rec {
   postInstall = ''
     wrapProgram $out/bin/snort --add-flags "--daq-dir ${daq}/lib/daq --dynamic-preprocessor-lib-dir $out/lib/snort_dynamicpreprocessor/ --dynamic-engine-lib-dir $out/lib/snort_dynamicengine"
   '';
-  
+
   meta = {
     description = "Network intrusion prevention and detection system (IDS/IPS)";
     homepage = "https://www.snort.org";

pkgs/applications/networking/irc/communi/default.nix

@@ -19,16 +19,17 @@ stdenv.mkDerivation rec {
 
   preConfigure = ''
     export QMAKEFEATURES=${libcommuni}/features
-    qmakeFlags="$qmakeFlags \
-      COMMUNI_INSTALL_PREFIX=$out \
-      COMMUNI_INSTALL_BINS=$out/bin \
-      COMMUNI_INSTALL_PLUGINS=$out/lib/communi/plugins \
-      COMMUNI_INSTALL_ICONS=$out/share/icons/hicolor \
-      COMMUNI_INSTALL_DESKTOP=$out/share/applications \
-      COMMUNI_INSTALL_THEMES=$out/share/communi/themes
-    "
   '';
 
+  qmakeFlags = [
+    "COMMUNI_INSTALL_PREFIX=${placeholder "out"}"
+    "COMMUNI_INSTALL_BINS=${placeholder "out"}/bin"
+    "COMMUNI_INSTALL_PLUGINS=${placeholder "out"}/lib/communi/plugins"
+    "COMMUNI_INSTALL_ICONS=${placeholder "out"}/share/icons/hicolor"
+    "COMMUNI_INSTALL_DESKTOP=${placeholder "out"}/share/applications"
+    "COMMUNI_INSTALL_THEMES=${placeholder "out"}/share/communi/themes"
+  ];
+
   postInstall = stdenv.lib.optionalString stdenv.isLinux ''
     substituteInPlace "$out/share/applications/communi.desktop" \
       --replace "/usr/bin" "$out/bin"

pkgs/applications/networking/sync/rsync/base.nix

@@ -1,16 +1,16 @@
 { stdenv, fetchurl }:
 
 rec {
-  version = "3.1.3";
+  version = "3.2.3";
   src = fetchurl {
     # signed with key 0048 C8B0 26D4 C96F 0E58  9C2F 6C85 9FB1 4B96 A8C5
     url = "mirror://samba/rsync/src/rsync-${version}.tar.gz";
-    sha256 = "1h0011dj6jgqpgribir4anljjv7bbrdcs8g91pbsmzf5zr75bk2m";
+    sha256 = "03p5dha9g9krq61mdbcrjkpz5nglri0009ks2vs9k97f9i83rk5y";
   };
   upstreamPatchTarball = fetchurl {
     # signed with key 0048 C8B0 26D4 C96F 0E58  9C2F 6C85 9FB1 4B96 A8C5
     url = "mirror://samba/rsync/rsync-patches-${version}.tar.gz";
-    sha256 = "167vk463bb3xl9c4gsbxms111dk1ip7pq8y361xc0xfa427q9hhd";
+    sha256 = "1wj21v57v135n6fnmlm2dxmb9lhrrg62jgkggldp1gb7d6s4arny";
   };
 
   meta = with stdenv.lib; {

pkgs/applications/networking/sync/rsync/default.nix

@@ -1,8 +1,18 @@
 { stdenv, fetchurl, perl, libiconv, zlib, popt
-, enableACLs ? !(stdenv.isDarwin || stdenv.isSunOS || stdenv.isFreeBSD)
+, enableACLs ? !(stdenv.isDarwin || stdenv.isSunOS || stdenv.isFreeBSD), acl ? null
-, acl ? null, enableCopyDevicesPatch ? false, nixosTests }:
+, enableLZ4 ? true, lz4 ? null
+, enableOpenSSL ? true, openssl ? null
+, enableXXHash ? true, xxHash ? null
+, enableZstd ? true, zstd ? null
+, enableCopyDevicesPatch ? false
+, nixosTests
+}:
 
 assert enableACLs -> acl != null;
+assert enableLZ4 -> lz4 != null;
+assert enableOpenSSL -> openssl != null;
+assert enableXXHash -> xxHash != null;
+assert enableZstd -> zstd != null;
 
 let
   base = import ./base.nix { inherit stdenv fetchurl; };
@@ -17,7 +27,12 @@ stdenv.mkDerivation rec {
   srcs = [mainSrc] ++ stdenv.lib.optional enableCopyDevicesPatch patchesSrc;
   patches = stdenv.lib.optional enableCopyDevicesPatch "./patches/copy-devices.diff";
 
-  buildInputs = [libiconv zlib popt] ++ stdenv.lib.optional enableACLs acl;
+  buildInputs = [libiconv zlib popt]
+                ++ stdenv.lib.optional enableACLs acl
+                ++ stdenv.lib.optional enableZstd zstd
+                ++ stdenv.lib.optional enableLZ4 lz4
+                ++ stdenv.lib.optional enableOpenSSL openssl
+                ++ stdenv.lib.optional enableXXHash xxHash;
   nativeBuildInputs = [perl];
 
   configureFlags = ["--with-nobody-group=nogroup"];

pkgs/applications/networking/tcpkali/default.nix

@@ -11,6 +11,9 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     sha256 = "09ky3cccaphcqc6nhfs00pps99lasmzc2pf5vk0gi8hlqbbhilxf";
   };
+  postPatch = ''
+    sed -ie '/sys\/sysctl\.h/d' src/tcpkali_syslimits.c
+  '';
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ bison];
   meta = {

pkgs/applications/science/physics/sherpa/default.nix

@@ -9,6 +9,10 @@ stdenv.mkDerivation rec {
     sha256 = "1iwa17s8ipj6a2b8zss5csb1k5y9s5js38syvq932rxcinbyjsl4";
   };
 
+  postPatch = ''
+    sed -ie '/sys\/sysctl.h/d' ATOOLS/Org/Run_Parameter.C
+  '';
+
   buildInputs = [ gfortran sqlite lhapdf rivet ];
 
   enableParallelBuilding = true;

pkgs/applications/science/physics/xfitter/default.nix

@@ -1,4 +1,6 @@
-{ stdenv, fetchurl, apfel, apfelgrid, applgrid, blas, gfortran, lhapdf, lapack, libyaml, lynx, mela, root5, qcdnum, which }:
+{ stdenv, fetchurl, apfel, apfelgrid, applgrid, blas, gfortran, lhapdf, lapack, libyaml, lynx
+, mela, root5, qcdnum, which, libtirpc
+}:
 
 stdenv.mkDerivation rec {
   pname = "xfitter";
@@ -37,7 +39,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ gfortran which ];
   buildInputs =
-    [ apfel apfelgrid applgrid blas lhapdf lapack mela root5 qcdnum ]
+    [ apfel apfelgrid applgrid blas lhapdf lapack mela root5 qcdnum libtirpc ]
     # pdf2yaml requires fmemopen and open_memstream which are not readily available on Darwin
     ++ stdenv.lib.optional (!stdenv.isDarwin) libyaml
     ;
@@ -47,6 +49,9 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
+  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
+  NIX_LDFLAGS = [ "-ltirpc" ];
+
   meta = with stdenv.lib; {
     description = "The xFitter project is an open source QCD fit framework ready to extract PDFs and assess the impact of new data";
     license     = licenses.gpl3;

pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -155,12 +155,6 @@ stdenv.mkDerivation {
       ln -s $out/share/git/contrib/completion/git-completion.bash $out/share/bash-completion/completions/git
       mkdir -p $out/etc/bash_completion.d
       ln -s $out/share/git/contrib/completion/git-prompt.sh $out/etc/bash_completion.d/
-      mkdir -p $out/share/zsh/site-functions
-      ln -s $out/share/git/contrib/completion/git-completion.zsh $out/share/zsh/site-functions/_git
-
-      # Patch the zsh completion script so it can find the Bash completion script.
-      sed -i -e "/locations=(/a \${"\t\t"}'$out/share/git/contrib/completion/git-completion.bash'" \
-        $out/share/git/contrib/completion/git-completion.zsh
 
       # grep is a runtime dependency, need to patch so that it's found
       substituteInPlace $out/libexec/git-core/git-sh-setup \

pkgs/applications/video/xawtv/0001-Fix-build-for-glibc-2.32.patch

@@ -0,0 +1,63 @@
+From 009c426ab37ef7f8d9d8e30f45096225203d694a Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Tue, 11 Aug 2020 11:27:21 +0200
+Subject: [PATCH] Fix build for glibc-2.32
+
+The `sys_siglist`-array has been removed. Instead, `strsignal` should be
+used.
+---
+ console/fbtools.c | 2 +-
+ console/record.c  | 2 +-
+ x11/rootv.c       | 4 ++--
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/console/fbtools.c b/console/fbtools.c
+index 9f876df..07739ff 100644
+--- a/console/fbtools.c
++++ b/console/fbtools.c
+@@ -520,6 +520,6 @@ fb_catch_exit_signals(void)
+ 
+     /* cleanup */
+     fb_cleanup();
+-    fprintf(stderr,"Oops: %s\n",sys_siglist[termsig]);
++    fprintf(stderr,"Oops: %s\n",strsignal(termsig));
+     exit(42);
+ }
+diff --git a/console/record.c b/console/record.c
+index 685221b..90f0c85 100644
+--- a/console/record.c
++++ b/console/record.c
+@@ -429,7 +429,7 @@ ctrlc(int signal)
+ {
+     if (verbose)
+ 	fprintf(stderr,"\n%s - exiting\n",
+-		sys_siglist[signal]);
++		strsignal(signal));
+     stop = 1;
+ }
+ 
+diff --git a/x11/rootv.c b/x11/rootv.c
+index 60a8406..4bf458b 100644
+--- a/x11/rootv.c
++++ b/x11/rootv.c
+@@ -133,7 +133,7 @@ catch_sig(int signal)
+     termsig = signal;
+     if (verbose)
+ 	fprintf(stderr,"received signal %d [%s]\n",
+-		termsig,sys_siglist[termsig]);
++		termsig,strsignal(termsig));
+ }
+ 
+ static void usage(FILE *fp)
+@@ -422,7 +422,7 @@ main(int argc, char *argv[])
+     }
+     if (verbose && termsig)
+ 	fprintf(stderr,"exiting on signal %d [%s]\n",
+-		termsig,sys_siglist[termsig]);
++		termsig,strsignal(termsig));
+     if (do_mute && have_mute)
+ 	XvSetPortAttribute(dpy,port,XV_MUTE,1);
+     XvStopVideo(dpy,port,win);
+-- 
+2.25.4
+

pkgs/applications/video/xawtv/default.nix

@@ -26,6 +26,10 @@ stdenv.mkDerivation rec {
     sha256 = "055p0wia0xsj073l8mg4ifa6m81dmv6p45qyh99brramq5iylfy5";
   };
 
+  patches = [
+    ./0001-Fix-build-for-glibc-2.32.patch
+  ];
+
   buildInputs = [
     ncurses
     libjpeg

pkgs/build-support/libredirect/libredirect.c

@@ -121,6 +121,13 @@ FILE * fopen(const char * path, const char * mode)
     return fopen_real(rewrite(path, buf), mode);
 }
 
+FILE * __nss_files_fopen(const char * path)
+{
+    FILE * (*__nss_files_fopen_real) (const char *) = dlsym(RTLD_NEXT, "__nss_files_fopen");
+    char buf[PATH_MAX];
+    return __nss_files_fopen_real(rewrite(path, buf));
+}
+
 FILE * fopen64(const char * path, const char * mode)
 {
     FILE * (*fopen64_real) (const char *, const char *) = dlsym(RTLD_NEXT, "fopen64");

pkgs/build-support/setup-hooks/move-systemd-user-units.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+# This setup hook, for each output, moves everything in
+# $output/lib/systemd/user to $output/share/systemd/user, and replaces
+# $output/lib/systemd/user with a symlink to
+# $output/share/systemd/user.
+
+fixupOutputHooks+=(_moveSystemdUserUnits)
+
+_moveSystemdUserUnits() {
+    if [ "${dontMoveSystemdUserUnits:-0}" = 1 ]; then return; fi
+    if [ ! -e "${prefix:?}/lib/systemd/user" ]; then return; fi
+    local source="$prefix/lib/systemd/user"
+    local target="$prefix/share/systemd/user"
+    echo "moving $source/* to $target"
+    mkdir -p "$target"
+    (
+      shopt -s dotglob
+      for i in "$source"/*; do
+          mv "$i" "$target"
+      done
+    )
+    rmdir "$source"
+    ln -s "$target" "$source"
+}

pkgs/build-support/wrapper-common/utils.bash

@@ -69,9 +69,13 @@ badPath() {
     # directory (including the build directory).
     test \
         "$p" != "/dev/null" -a \
-        "${p:0:${#NIX_STORE}}" != "$NIX_STORE" -a \
+        "${p#${NIX_STORE}}"     = "$p" -a \
-        "${p:0:4}" != "/tmp" -a \
+        "${p#${NIX_BUILD_TOP}}" = "$p" -a \
-        "${p:0:${#NIX_BUILD_TOP}}" != "$NIX_BUILD_TOP"
+        "${p#/tmp}"             = "$p" -a \
+        "${p#${TMP:-/tmp}}"     = "$p" -a \
+        "${p#${TMPDIR:-/tmp}}"  = "$p" -a \
+        "${p#${TEMP:-/tmp}}"    = "$p" -a \
+        "${p#${TEMPDIR:-/tmp}}" = "$p"
 }
 
 expandResponseParams() {

pkgs/development/compilers/rust/1_44.nix

@@ -1,43 +0,0 @@
-# New rust versions should first go to staging.
-# Things to check after updating:
-# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
-#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
-#    This testing can be also done by other volunteers as part of the pull
-#    request review, in case platforms cannot be covered.
-# 2. The LLVM version used for building should match with rust upstream.
-# 3. Firefox and Thunderbird should still build on x86_64-linux.
-
-{ stdenv, lib
-, buildPackages
-, newScope, callPackage
-, CoreFoundation, Security
-, llvmPackages_5
-, pkgsBuildTarget, pkgsBuildBuild
-, makeRustPlatform
-} @ args:
-
-import ./default.nix {
-  rustcVersion = "1.44.1";
-  rustcSha256 = "0ww4z2v3gxgn3zddqzwqya1gln04p91ykbrflnpdbmcd575n8bky";
-
-  # Note: the version MUST be one version prior to the version we're
-  # building
-  bootstrapVersion = "1.43.1";
-
-  # fetch hashes by running `print-hashes.sh 1.44.1`
-  bootstrapHashes = {
-    i686-unknown-linux-gnu = "0626fa8a6a2387021413d740543f7496656d81115e2284e4ef73217128398990";
-    x86_64-unknown-linux-gnu = "25cd71b95bba0daef56bad8c943a87368c4185b90983f4412f46e3e2418c0505";
-    arm-unknown-linux-gnueabihf = "16b9c4861565a195323d144fd0f54c0ae794ee3d2a867682f8aedbdacaad5a6c";
-    armv7-unknown-linux-gnueabihf = "0c32a5958a358a031e6ca52074cfd45256688dc334db315199f5dbbf7562e5b1";
-    aarch64-unknown-linux-gnu = "fbb612387a64c9da2869725afffc1f66a72d6e7ba6667ba717cd52c33080b7fb";
-    x86_64-apple-darwin = "e1c3e1426a9e615079159d6b619319235e3ca7b395e7603330375bfffcbb7003";
-  };
-
-  selectRustPackage = pkgs: pkgs.rust_1_44;
-
-  rustcPatches = [
-  ];
-}
-
-(builtins.removeAttrs args [ "fetchpatch" ])

pkgs/development/compilers/rust/1_45.nix

@@ -11,7 +11,7 @@
 , buildPackages
 , newScope, callPackage
 , CoreFoundation, Security
-, llvmPackages_5
+, llvmPackages
 , pkgsBuildTarget, pkgsBuildBuild
 , makeRustPlatform
 } @ args:

pkgs/development/compilers/rust/1_46.nix

@@ -0,0 +1,45 @@
+# New rust versions should first go to staging.
+# Things to check after updating:
+# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
+#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
+#    This testing can be also done by other volunteers as part of the pull
+#    request review, in case platforms cannot be covered.
+# 2. The LLVM version used for building should match with rust upstream.
+#    Check the version number in the src/llvm-project git submodule in:
+#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
+# 3. Firefox and Thunderbird should still build on x86_64-linux.
+
+{ stdenv, lib
+, buildPackages
+, newScope, callPackage
+, CoreFoundation, Security
+, llvmPackages
+, pkgsBuildTarget, pkgsBuildBuild
+, makeRustPlatform
+} @ args:
+
+import ./default.nix {
+  rustcVersion = "1.46.0";
+  rustcSha256 = "0a17jby2pd050s24cy4dfc0gzvgcl585v3vvyfilniyvjrqknsid";
+
+  # Note: the version MUST be one version prior to the version we're
+  # building
+  bootstrapVersion = "1.45.2";
+
+  # fetch hashes by running `print-hashes.sh 1.45.2`
+  bootstrapHashes = {
+    i686-unknown-linux-gnu = "5b2050dde23152750de89f7e59acaab6bf088d0beb5854c69c9a545fd254b936";
+    x86_64-unknown-linux-gnu = "860feed955726a4d96ffe40758a110053326b9ae11c9e1ee059e9c6222f25643";
+    arm-unknown-linux-gnueabihf = "ddb5f59bbdef84e0b7c83049461e003ed031dd881a4622365c3d475102535c60";
+    armv7-unknown-linux-gnueabihf = "7a556581f87602705f9c89b04cce621cfbba9050b6fbe478166e91d164567531";
+    aarch64-unknown-linux-gnu = "151fad66442d28a4e4786753d1afb559c4a3d359081c64769273a31c2f0f4d30";
+    x86_64-apple-darwin = "6e8067624ede10aa23081d62e0086c6f42f7228cc0d00fb5ff24d4dac65249d6";
+  };
+
+  selectRustPackage = pkgs: pkgs.rust_1_46;
+
+  rustcPatches = [
+  ];
+}
+
+(builtins.removeAttrs args [ "fetchpatch" ])

pkgs/development/compilers/rust/default.nix

@@ -10,7 +10,7 @@
 , buildPackages
 , newScope, callPackage
 , CoreFoundation, Security
-, llvmPackages_5
+, llvmPackages
 , pkgsBuildTarget, pkgsBuildBuild
 , makeRustPlatform
 }: rec {
@@ -74,10 +74,10 @@
         # Use boot package set to break cycle
         rustPlatform = bootRustPlatform;
       } // lib.optionalAttrs (stdenv.cc.isClang && stdenv.hostPlatform == stdenv.buildPlatform) {
-        stdenv = llvmPackages_5.stdenv;
+        stdenv = llvmPackages.stdenv;
-        pkgsBuildBuild = pkgsBuildBuild // { targetPackages.stdenv = llvmPackages_5.stdenv; };
+        pkgsBuildBuild = pkgsBuildBuild // { targetPackages.stdenv = llvmPackages.stdenv; };
-        pkgsBuildHost = pkgsBuildBuild // { targetPackages.stdenv = llvmPackages_5.stdenv; };
+        pkgsBuildHost = pkgsBuildBuild // { targetPackages.stdenv = llvmPackages.stdenv; };
-        pkgsBuildTarget = pkgsBuildTarget // { targetPackages.stdenv = llvmPackages_5.stdenv; };
+        pkgsBuildTarget = pkgsBuildTarget // { targetPackages.stdenv = llvmPackages.stdenv; };
       });
       rustfmt = self.callPackage ./rustfmt.nix { inherit Security; };
       cargo = self.callPackage ./cargo.nix {

pkgs/development/compilers/swift/default.nix

@@ -245,6 +245,10 @@ stdenv.mkDerivation {
       --replace usr "$PREFIX"
     substituteInPlace swift-corelibs-xctest/build_script.py \
       --replace usr "$PREFIX"
+    substituteInPlace swift-corelibs-foundation/CoreFoundation/PlugIn.subproj/CFBundle_InfoPlist.c \
+      --replace "if !TARGET_OS_ANDROID" "if TARGET_OS_MAC || TARGET_OS_BSD"
+    substituteInPlace swift-corelibs-foundation/CoreFoundation/PlugIn.subproj/CFBundle_Resources.c \
+      --replace "if !TARGET_OS_ANDROID" "if TARGET_OS_MAC || TARGET_OS_BSD"
   '';
 
   configurePhase = ''

pkgs/development/interpreters/perl/default.nix

@@ -36,8 +36,7 @@ let
     patches =
       [
         # Do not look in /usr etc. for dependencies.
-        (if (versionOlder version "5.29.6") then ./no-sys-dirs-5.26.patch
+        (if (versionOlder version "5.31.1") then ./no-sys-dirs-5.29.patch
-         else if (versionOlder version "5.31.1") then ./no-sys-dirs-5.29.patch
          else ./no-sys-dirs-5.31.patch)
       ]
       ++ optional (versionOlder version "5.29.6")

pkgs/development/interpreters/perl/no-sys-dirs-5.26.patch

@@ -1,250 +0,0 @@
-diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/Configure perl-5.20.0/Configure
---- perl-5.20.0-orig/Configure	2014-05-26 15:34:18.000000000 +0200
-+++ perl-5.20.0/Configure	2014-06-25 10:43:35.368285986 +0200
-@@ -106,15 +106,7 @@
- fi
- 
- : Proper PATH setting
--paths='/bin /usr/bin /usr/local/bin /usr/ucb /usr/local /usr/lbin'
--paths="$paths /opt/bin /opt/local/bin /opt/local /opt/lbin"
--paths="$paths /usr/5bin /etc /usr/gnu/bin /usr/new /usr/new/bin /usr/nbin"
--paths="$paths /opt/gnu/bin /opt/new /opt/new/bin /opt/nbin"
--paths="$paths /sys5.3/bin /sys5.3/usr/bin /bsd4.3/bin /bsd4.3/usr/ucb"
--paths="$paths /bsd4.3/usr/bin /usr/bsd /bsd43/bin /opt/ansic/bin /usr/ccs/bin"
--paths="$paths /etc /usr/lib /usr/ucblib /lib /usr/ccs/lib"
--paths="$paths /sbin /usr/sbin /usr/libexec"
--paths="$paths /system/gnu_library/bin"
-+paths=''
- 
- for p in $paths
- do
-@@ -1337,8 +1329,7 @@
- archname=''
- : Possible local include directories to search.
- : Set locincpth to "" in a hint file to defeat local include searches.
--locincpth="/usr/local/include /opt/local/include /usr/gnu/include"
--locincpth="$locincpth /opt/gnu/include /usr/GNU/include /opt/GNU/include"
-+locincpth=""
- :
- : no include file wanted by default
- inclwanted=''
-@@ -1349,17 +1340,12 @@
- 
- libnames=''
- : change the next line if compiling for Xenix/286 on Xenix/386
--xlibpth='/usr/lib/386 /lib/386'
-+xlibpth=''
- : Possible local library directories to search.
--loclibpth="/usr/local/lib /opt/local/lib /usr/gnu/lib"
--loclibpth="$loclibpth /opt/gnu/lib /usr/GNU/lib /opt/GNU/lib"
-+loclibpth=""
- 
- : general looking path for locating libraries
--glibpth="/lib /usr/lib $xlibpth"
--glibpth="$glibpth /usr/ccs/lib /usr/ucblib /usr/local/lib"
--test -f /usr/shlib/libc.so && glibpth="/usr/shlib $glibpth"
--test -f /shlib/libc.so     && glibpth="/shlib $glibpth"
--test -d /usr/lib64         && glibpth="$glibpth /lib64 /usr/lib64 /usr/local/lib64"
-+glibpth=""
- 
- : Private path used by Configure to find libraries.  Its value
- : is prepended to libpth. This variable takes care of special
-@@ -1391,8 +1377,6 @@
- libswanted="$libswanted m crypt sec util c cposix posix ucb bsd BSD"
- : We probably want to search /usr/shlib before most other libraries.
- : This is only used by the lib/ExtUtils/MakeMaker.pm routine extliblist.
--glibpth=`echo " $glibpth " | sed -e 's! /usr/shlib ! !'`
--glibpth="/usr/shlib $glibpth"
- : Do not use vfork unless overridden by a hint file.
- usevfork=false
- 
-@@ -2446,7 +2430,6 @@
- zip
- "
- pth=`echo $PATH | sed -e "s/$p_/ /g"`
--pth="$pth $sysroot/lib $sysroot/usr/lib"
- for file in $loclist; do
- 	eval xxx=\$$file
- 	case "$xxx" in
-@@ -4936,7 +4919,7 @@
- : Set private lib path
- case "$plibpth" in
- '') if ./mips; then
--	plibpth="$incpath/usr/lib $sysroot/usr/local/lib $sysroot/usr/ccs/lib"
-+	plibpth="$incpath/usr/lib"
-     fi;;
- esac
- case "$libpth" in
-@@ -8600,13 +8583,8 @@
- echo " "
- case "$sysman" in
- '')
--	syspath='/usr/share/man/man1 /usr/man/man1'
--	syspath="$syspath /usr/man/mann /usr/man/manl /usr/man/local/man1"
--	syspath="$syspath /usr/man/u_man/man1"
--	syspath="$syspath /usr/catman/u_man/man1 /usr/man/l_man/man1"
--	syspath="$syspath /usr/local/man/u_man/man1 /usr/local/man/l_man/man1"
--	syspath="$syspath /usr/man/man.L /local/man/man1 /usr/local/man/man1"
--	sysman=`./loc . /usr/man/man1 $syspath`
-+	syspath=''
-+	sysman=''
- 	;;
- esac
- if $test -d "$sysman"; then
-@@ -19900,9 +19878,10 @@
- case "$full_ar" in
- '') full_ar=$ar ;;
- esac
-+full_ar=ar
- 
- : Store the full pathname to the sed program for use in the C program
--full_sed=$sed
-+full_sed=sed
- 
- : see what type gids are declared as in the kernel
- echo " "
-Only in perl-5.20.0/: Configure.orig
-diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/ext/Errno/Errno_pm.PL perl-5.20.0/ext/Errno/Errno_pm.PL
---- perl-5.20.0-orig/ext/Errno/Errno_pm.PL	2014-05-26 15:34:20.000000000 +0200
-+++ perl-5.20.0/ext/Errno/Errno_pm.PL	2014-06-25 10:31:24.317970047 +0200
-@@ -126,11 +126,7 @@
- 	if ($dep =~ /(\S+errno\.h)/) {
- 	     $file{$1} = 1;
- 	}
--    } elsif ($^O eq 'linux' &&
--	      $Config{gccversion} ne '' && 
--	      $Config{gccversion} !~ /intel/i
--	      # might be using, say, Intel's icc
--	     ) {
-+    } elsif (0) {
-     # When cross-compiling we may store a path for gcc's "sysroot" option:
-     my $sysroot = $Config{sysroot} || '';
- 	# Some Linuxes have weird errno.hs which generate
-Only in perl-5.20.0/ext/Errno: Errno_pm.PL.orig
-diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/hints/freebsd.sh perl-5.20.0/hints/freebsd.sh
---- perl-5.20.0-orig/hints/freebsd.sh	2014-01-31 22:55:51.000000000 +0100
-+++ perl-5.20.0/hints/freebsd.sh	2014-06-25 10:25:53.263964680 +0200
-@@ -119,21 +119,21 @@
-         objformat=`/usr/bin/objformat`
-         if [ x$objformat = xaout ]; then
-             if [ -e /usr/lib/aout ]; then
--                libpth="/usr/lib/aout /usr/local/lib /usr/lib"
--                glibpth="/usr/lib/aout /usr/local/lib /usr/lib"
-+                libpth=""
-+                glibpth=""
-             fi
-             lddlflags='-Bshareable'
-         else
--            libpth="/usr/lib /usr/local/lib"
--            glibpth="/usr/lib /usr/local/lib"
-+            libpth=""
-+            glibpth=""
-             ldflags="-Wl,-E "
-             lddlflags="-shared "
-         fi
-         cccdlflags='-DPIC -fPIC'
-         ;;
- *)
--       libpth="/usr/lib /usr/local/lib"
--       glibpth="/usr/lib /usr/local/lib"
-+       libpth=""
-+       glibpth=""
-        ldflags="-Wl,-E "
-         lddlflags="-shared "
-         cccdlflags='-DPIC -fPIC'
-diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/hints/linux.sh perl-5.20.0/hints/linux.sh
---- perl-5.20.0-orig/hints/linux.sh	2014-05-26 15:34:20.000000000 +0200
-+++ perl-5.20.0/hints/linux.sh	2014-06-25 10:33:47.354883843 +0200
-@@ -150,25 +150,6 @@
-     ;;
- esac
- 
--# Ubuntu 11.04 (and later, presumably) doesn't keep most libraries
--# (such as -lm) in /lib or /usr/lib.  So we have to ask gcc to tell us
--# where to look.  We don't want gcc's own libraries, however, so we
--# filter those out.
--# This could be conditional on Unbuntu, but other distributions may
--# follow suit, and this scheme seems to work even on rather old gcc's.
--# This unconditionally uses gcc because even if the user is using another
--# compiler, we still need to find the math library and friends, and I don't
--# know how other compilers will cope with that situation.
--# Morever, if the user has their own gcc earlier in $PATH than the system gcc,
--# we don't want its libraries. So we try to prefer the system gcc
--# Still, as an escape hatch, allow Configure command line overrides to
--# plibpth to bypass this check.
--if [ -x /usr/bin/gcc ] ; then
--    gcc=/usr/bin/gcc
--else
--    gcc=gcc
--fi
--
- case "$plibpth" in
- '') plibpth=`LANG=C LC_ALL=C $gcc $ccflags $ldflags -print-search-dirs | grep libraries |
- 	cut -f2- -d= | tr ':' $trnl | grep -v 'gcc' | sed -e 's:/$::'`
-@@ -178,32 +159,6 @@
-     ;;
- esac
- 
--case "$libc" in
--'')
--# If you have glibc, then report the version for ./myconfig bug reporting.
--# (Configure doesn't need to know the specific version since it just uses
--# gcc to load the library for all tests.)
--# We don't use __GLIBC__ and  __GLIBC_MINOR__ because they
--# are insufficiently precise to distinguish things like
--# libc-2.0.6 and libc-2.0.7.
--    for p in $plibpth
--    do
--        for trylib in libc.so.6 libc.so
--        do
--            if $test -e $p/$trylib; then
--                libc=`ls -l $p/$trylib | awk '{print $NF}'`
--                if $test "X$libc" != X; then
--                    break
--                fi
--            fi
--        done
--        if $test "X$libc" != X; then
--            break
--        fi
--    done
--    ;;
--esac
--
- if ${sh:-/bin/sh} -c exit; then
-   echo ''
-   echo 'You appear to have a working bash.  Good.'
-@@ -367,33 +322,6 @@
- 	;;
- esac
- 
--# SuSE8.2 has /usr/lib/libndbm* which are ld scripts rather than
--# true libraries. The scripts cause binding against static
--# version of -lgdbm which is a bad idea. So if we have 'nm'
--# make sure it can read the file
--# NI-S 2003/08/07
--case "$nm" in
--    '') ;;
--    *)
--    for p in $plibpth
--    do
--        if $test -r $p/libndbm.so; then
--            if $nm $p/libndbm.so >/dev/null 2>&1 ; then
--                echo 'Your shared -lndbm seems to be a real library.'
--                _libndbm_real=1
--                break
--            fi
--        fi
--    done
--    if $test "X$_libndbm_real" = X; then
--        echo 'Your shared -lndbm is not a real library.'
--        set `echo X "$libswanted "| sed -e 's/ ndbm / /'`
--        shift
--        libswanted="$*"
--    fi
--    ;;
--esac
--
- # Linux on Synology.
- if [ -f /etc/synoinfo.conf -a -d /usr/syno ]; then
-     # Tested on Synology DS213 and DS413

pkgs/development/interpreters/python/default.nix

@@ -94,10 +94,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "8";
-      patch = "5";
+      patch = "6";
       suffix = "";
     };
-    sha256 = "1c43dbv9lvlp3ynqmgdi4rh8q94swanhqarqrdx62zmigpakw073";
+    sha256 = "qeC3nSeqBW65zOjWOkJ7X5urFGXe4/lC3P2yWoL0q4o=";
     inherit (darwin) configd;
     inherit passthruFun;
   };

pkgs/development/libraries/ace/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ace";
-  version = "6.5.7";
+  version = "6.5.10";
 
   src = fetchurl {
     url = "http://download.dre.vanderbilt.edu/previous_versions/ACE-${version}.tar.bz2";
-    sha256 = "0hvd7y3hs8r3r7qbllfaqrva3jrx5razcnwlws822k66v4r10cbx";
+    sha256 = "1qnq63r9cnaaqb5yrbb7apr7kjl6x31wfclizplri3lj4rwl7plh";
   };
 
   enableParallelBuilding = true;
@@ -14,6 +14,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig libtool ];
   buildInputs = [ perl ];
 
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=format-security"
+  ];
+
   patchPhase = ''substituteInPlace ./MPC/prj_install.pl \
     --replace /usr/bin/perl "${perl}/bin/perl"'';
 

pkgs/development/libraries/at-spi2-core/default.nix

@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation rec {
   pname = "at-spi2-core";
-  version = "2.36.0";
+  version = "2.36.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0nn0lnf07ayysq8c8irmvc91c2dszn04m5qs6jy60g3y1bg5gnl8";
+    sha256 = "0m3crrdbc9vdn9dr4lssdwrjmm8z5wxs2qhhnbkh1w5vkn87nhcp";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/c-blosc/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "c-blosc";
-  version = "1.20.0";
+  version = "1.20.1";
 
   src = fetchFromGitHub {
     owner = "Blosc";
     repo = "c-blosc";
     rev = "v${version}";
-    sha256 = "1rhv9na9cdp2j81a981s2y69c7m9apdiylf9j51dij0lm1m0ljdr";
+    sha256 = "0a3yrig78plzjbazfqcfrzqhnw17xd0dcayvp4z4kp415kgs2a3s";
   };
 
   buildInputs = [ cmake ];

pkgs/development/libraries/chipmunk/default.nix

@@ -1,20 +1,27 @@
 { stdenv, fetchurl, cmake, freeglut, libGLU, libGL, glfw2, glew, libX11, xorgproto
-, libXi, libXmu
+, libXi, libXmu, fetchpatch, libXrandr
 }:
 
 stdenv.mkDerivation rec {
   pname = "chipmunk";
   majorVersion = "7";
-  version = "${majorVersion}.0.1";
+  version = "${majorVersion}.0.3";
 
   src = fetchurl {
     url = "https://chipmunk-physics.net/release/Chipmunk-${majorVersion}.x/Chipmunk-${version}.tgz";
-    sha256 = "0q4jwv1icz8spcjkp0v3bnygi6hq2zmnsgcxkwm8i2bxfxjb8m7y";
+    sha256 = "06j9cfxsyrrnyvl7hsf55ac5mgff939mmijliampphlizyg0r2q4";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/slembcke/Chipmunk2D/commit/9a051e6fb970c7afe09ce2d564c163b81df050a8.patch";
+      sha256 = "0ps8bjba1k544vcdx5w0qk7gcjq94yfigxf67j50s63yf70k2n70";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
   buildInputs =
-    [ freeglut libGLU libGL glfw2 glew libX11 xorgproto libXi libXmu ];
+    [ freeglut libGLU libGL glfw2 glew libX11 xorgproto libXi libXmu libXrandr ];
 
   postInstall = ''
     mkdir -p $out/bin

pkgs/development/libraries/cimg/default.nix

@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     owner = "dtschump";
     repo = "CImg";
     rev = "v.${version}";
-    sha256 = "sha256-7v8651yDkxTdRMoGhEl4d/k7mxYwfIwW/rkuyjqVGwY=";
+    sha256 = "01hvjlxclbmrzqb8qz1h2sdkpybpg14q81na8kfi94w3bkkkmzzf";
   };
 
   installPhase = ''

pkgs/development/libraries/dbus/default.nix

@@ -10,6 +10,9 @@
 , libSM ? null
 , x11Support ? (stdenv.isLinux || stdenv.isDarwin)
 , dbus
+, docbook_xml_dtd_44
+, docbook-xsl-nons
+, xmlto
 }:
 
 assert
@@ -43,10 +46,13 @@ stdenv.mkDerivation rec {
       --replace 'DBUS_DAEMONDIR"/dbus-daemon"' '"/run/current-system/sw/bin/dbus-daemon"'
   '';
 
-  outputs = [ "out" "dev" "lib" "doc" ];
+  outputs = [ "out" "dev" "lib" "doc" "man" ];
 
   nativeBuildInputs = [
     pkgconfig
+    docbook_xml_dtd_44
+    docbook-xsl-nons
+    xmlto
   ];
 
   propagatedBuildInputs = [
@@ -63,6 +69,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--enable-user-session"
+    "--enable-xml-docs"
     "--libexecdir=${placeholder ''out''}/libexec"
     "--datadir=/etc"
     "--localstatedir=/var"

pkgs/development/libraries/gdal/2.4.0.nix

@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     "--with-poppler=${poppler.dev}" # optional
     "--with-libz=${zlib.dev}"       # optional
     "--with-pg=${postgresql}/bin/pg_config"
-    "--with-mysql=${libmysqlclient}/bin/mysql_config"
+    "--with-mysql=${getDev libmysqlclient}/bin/mysql_config"
     "--with-geotiff=${libgeotiff.dev}"
     "--with-sqlite3=${sqlite.dev}"
     "--with-spatialite=${libspatialite}"

pkgs/development/libraries/gdal/default.nix

@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     "--with-poppler=${poppler.dev}" # optional
     "--with-libz=${zlib.dev}" # optional
     "--with-pg=yes" # since gdal 3.0 doesn't use ${postgresql}/bin/pg_config
-    "--with-mysql=${libmysqlclient}/bin/mysql_config"
+    "--with-mysql=${getDev libmysqlclient}/bin/mysql_config"
     "--with-geotiff=${libgeotiff}"
     "--with-sqlite3=${sqlite.dev}"
     "--with-spatialite=${libspatialite}"

pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch

@@ -1,62 +0,0 @@
-From: Andreas Schwab <schwab@suse.de>
-Date: Wed, 19 Feb 2020 16:21:46 +0000 (+0100)
-Subject: Fix use-after-free in glob when expanding ~user (bug 25414)
-X-Git-Url: https://sourceware.org/git/?p=glibc.git;a=commitdiff_plain;h=da97c6b88eb03fb834e92964b0895c2ac8d61f63;hp=dd34bce38c822b67fcc42e73969bf6699d6874b6
-
-Fix use-after-free in glob when expanding ~user (bug 25414)
-
-The value of `end_name' points into the value of `dirname', thus don't
-deallocate the latter before the last use of the former.
-
-(cherry picked from commit ddc650e9b3dc916eab417ce9f79e67337b05035c)
----
-
-diff --git a/posix/glob.c b/posix/glob.c
-index e73e35c510..c6cbd0eb43 100644
---- a/posix/glob.c
-+++ b/posix/glob.c
-@@ -827,31 +827,32 @@ __glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
- 	      {
- 		size_t home_len = strlen (p->pw_dir);
- 		size_t rest_len = end_name == NULL ? 0 : strlen (end_name);
--		char *d;
-+		char *d, *newp;
-+		bool use_alloca = glob_use_alloca (alloca_used,
-+						   home_len + rest_len + 1);
- 
--		if (__glibc_unlikely (malloc_dirname))
--		  free (dirname);
--		malloc_dirname = 0;
--
--		if (glob_use_alloca (alloca_used, home_len + rest_len + 1))
--		  dirname = alloca_account (home_len + rest_len + 1,
--					    alloca_used);
-+		if (use_alloca)
-+		  newp = alloca_account (home_len + rest_len + 1, alloca_used);
- 		else
- 		  {
--		    dirname = malloc (home_len + rest_len + 1);
--		    if (dirname == NULL)
-+		    newp = malloc (home_len + rest_len + 1);
-+		    if (newp == NULL)
- 		      {
- 			scratch_buffer_free (&pwtmpbuf);
- 			retval = GLOB_NOSPACE;
- 			goto out;
- 		      }
--		    malloc_dirname = 1;
- 		  }
--		d = mempcpy (dirname, p->pw_dir, home_len);
-+		d = mempcpy (newp, p->pw_dir, home_len);
- 		if (end_name != NULL)
- 		  d = mempcpy (d, end_name, rest_len);
- 		*d = '\0';
- 
-+		if (__glibc_unlikely (malloc_dirname))
-+		  free (dirname);
-+		dirname = newp;
-+		malloc_dirname = !use_alloca;
-+
- 		dirlen = home_len + rest_len;
- 		dirname_modified = 1;
- 	      }

pkgs/development/libraries/glibc/2.31-cve-2020-10029.patch

@@ -1,79 +0,0 @@
-diff --git a/sysdeps/ieee754/ldbl-96/Makefile b/sysdeps/ieee754/ldbl-96/Makefile
-index 995e90d6da..318628aed6 100644
---- a/sysdeps/ieee754/ldbl-96/Makefile
-+++ b/sysdeps/ieee754/ldbl-96/Makefile
-@@ -17,5 +17,6 @@
- # <https://www.gnu.org/licenses/>.
- 
- ifeq ($(subdir),math)
--tests += test-canonical-ldbl-96 test-totalorderl-ldbl-96
-+tests += test-canonical-ldbl-96 test-totalorderl-ldbl-96 test-sinl-pseudo
-+CFLAGS-test-sinl-pseudo.c += -fstack-protector-all
- endif
-diff --git a/sysdeps/ieee754/ldbl-96/e_rem_pio2l.c b/sysdeps/ieee754/ldbl-96/e_rem_pio2l.c
-index 5f742321ae..bcdf20179f 100644
---- a/sysdeps/ieee754/ldbl-96/e_rem_pio2l.c
-+++ b/sysdeps/ieee754/ldbl-96/e_rem_pio2l.c
-@@ -210,6 +210,18 @@ __ieee754_rem_pio2l (long double x, long double *y)
-       return 0;
-     }
- 
-+  if ((i0 & 0x80000000) == 0)
-+    {
-+      /* Pseudo-zero and unnormal representations are not valid
-+	 representations of long double.  We need to avoid stack
-+	 corruption in __kernel_rem_pio2, which expects input in a
-+	 particular normal form, but those representations do not need
-+	 to be consistently handled like any particular floating-point
-+	 value.  */
-+      y[1] = y[0] = __builtin_nanl ("");
-+      return 0;
-+    }
-+
-   /* Split the 64 bits of the mantissa into three 24-bit integers
-      stored in a double array.  */
-   exp = j0 - 23;
---- /dev/null
-+++ b/sysdeps/ieee754/ldbl-96/test-sinl-pseudo.c
-@@ -0,0 +1,41 @@
-+/* Test sinl for pseudo-zeros and unnormals for ldbl-96 (bug 25487).
-+   Copyright (C) 2020 Free Software Foundation, Inc.
-+   This file is part of the GNU C Library.
-+
-+   The GNU C Library is free software; you can redistribute it and/or
-+   modify it under the terms of the GNU Lesser General Public
-+   License as published by the Free Software Foundation; either
-+   version 2.1 of the License, or (at your option) any later version.
-+
-+   The GNU C Library is distributed in the hope that it will be useful,
-+   but WITHOUT ANY WARRANTY; without even the implied warranty of
-+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+   Lesser General Public License for more details.
-+
-+   You should have received a copy of the GNU Lesser General Public
-+   License along with the GNU C Library; if not, see
-+   <https://www.gnu.org/licenses/>.  */
-+
-+#include <math.h>
-+#include <math_ldbl.h>
-+#include <stdint.h>
-+
-+static int
-+do_test (void)
-+{
-+  for (int i = 0; i < 64; i++)
-+    {
-+      uint64_t sig = i == 63 ? 0 : 1ULL << i;
-+      long double ld;
-+      SET_LDOUBLE_WORDS (ld, 0x4141,
-+			 sig >> 32, sig & 0xffffffffULL);
-+      /* The requirement is that no stack overflow occurs when the
-+	 pseudo-zero or unnormal goes through range reduction.  */
-+      volatile long double ldr;
-+      ldr = sinl (ld);
-+      (void) ldr;
-+    }
-+  return 0;
-+}
-+
-+#include <support/test-driver.c>

pkgs/development/libraries/glibc/common.nix

@@ -41,9 +41,9 @@
 } @ args:
 
 let
-  version = "2.31";
+  version = "2.32";
   patchSuffix = "";
-  sha256 = "05zxkyz9bv3j9h0xyid1rhvh3klhsmrpkf3bcs6frvlgyr2gwilj";
+  sha256 = "0di848ibffrnwq7g2dvgqrnn4xqhj3h96csn69q4da51ymafl9qn";
 in
 
 assert withLinuxHeaders -> linuxHeaders != null;
@@ -59,9 +59,6 @@ stdenv.mkDerivation ({
 
   patches =
     [
-      /* Have rpcgen(1) look for cpp(1) in $PATH.  */
-      ./rpcgen-path.patch
-
       /* Allow NixOS and Nix to handle the locale-archive. */
       ./nix-locale-archive.patch
 
@@ -113,8 +110,6 @@ stdenv.mkDerivation ({
       })
 
       ./fix-x64-abi.patch
-      ./2.30-cve-2020-1752.patch
-      ./2.31-cve-2020-10029.patch
     ]
     ++ lib.optional stdenv.hostPlatform.isMusl ./fix-rpc-types-musl-conflicts.patch
     ++ lib.optional stdenv.buildPlatform.isDarwin ./darwin-cross-build.patch;
@@ -146,8 +141,6 @@ stdenv.mkDerivation ({
   configureFlags =
     [ "-C"
       "--enable-add-ons"
-      "--enable-obsolete-nsl"
-      "--enable-obsolete-rpc"
       "--sysconfdir=/etc"
       "--enable-stackguard-randomization"
       (lib.withFeatureAs withLinuxHeaders "headers" "${linuxHeaders}/include")
@@ -226,7 +219,7 @@ stdenv.mkDerivation ({
 
   doCheck = false; # fails
 
-  meta = {
+  meta = with lib; {
     homepage = "https://www.gnu.org/software/libc/";
     description = "The GNU C Library";
 
@@ -239,10 +232,10 @@ stdenv.mkDerivation ({
          most systems with the Linux kernel.
       '';
 
-    license = lib.licenses.lgpl2Plus;
+    license = licenses.lgpl2Plus;
 
-    maintainers = [ lib.maintainers.eelco ];
+    maintainers = with maintainers; [ eelco ma27 ];
-    platforms = lib.platforms.linux;
+    platforms = platforms.linux;
   } // meta;
 }
 

pkgs/development/libraries/glpk/default.nix

@@ -1,6 +1,7 @@
 { stdenv
 , fetchurl
 , fetchpatch
+, libmysqlclient
 # Excerpt from glpk's INSTALL file:
 # This feature allows the exact simplex solver to use the GNU MP
 # bignum library. If it is disabled, the exact simplex solver uses the
@@ -21,9 +22,11 @@ stdenv.mkDerivation rec {
     sha256 = "040sfaa9jclg2nqdh83w71sv9rc1sznpnfiripjdyr48cady50a2";
   };
 
-  buildInputs = stdenv.lib.optionals withGmp [
+  buildInputs =
-    gmp
+    [ libmysqlclient
-  ];
+    ] ++ stdenv.lib.optionals withGmp [
+      gmp
+    ];
 
   configureFlags = stdenv.lib.optionals withGmp [
     "--with-gmp"
@@ -47,6 +50,13 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  postPatch =
+    # Do not hardcode the include path for libmysqlclient.
+    ''
+      substituteInPlace configure \
+        --replace '-I/usr/include/mysql' '$(mysql_config --include)'
+    '';
+
   doCheck = true;
 
   meta = {

pkgs/development/libraries/gnutls/default.nix

@@ -8,7 +8,7 @@
 
 assert guileBindings -> guile != null;
 let
-  version = "3.6.14";
+  version = "3.6.15";
 
   # XXX: Gnulib's `test-select' fails on FreeBSD:
   # https://hydra.nixos.org/build/2962084/nixlog/1/raw .
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://gnupg/gnutls/v3.6/gnutls-${version}.tar.xz";
-    sha256 = "0qwxsfizynly0ns537vnhnlm5lh03la4vbsmz675n0n7vqd7ac2n";
+    sha256 = "0n0m93ymzd0q9hbknxc2ycanz49sqlkyyf73g9fk7n787llc7a0f";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];

pkgs/development/libraries/grpc/default.nix

@@ -1,4 +1,6 @@
-{ stdenv, fetchFromGitHub, fetchpatch, cmake, zlib, c-ares, pkgconfig, openssl, protobuf, gflags, abseil-cpp }:
+{ stdenv, fetchFromGitHub, fetchpatch, cmake, zlib, c-ares, pkgconfig, openssl, protobuf
+, gflags, abseil-cpp, libnsl
+}:
 
 stdenv.mkDerivation rec {
   version = "1.32.0"; # N.B: if you change this, change pythonPackages.grpcio-tools to a matching version too
@@ -19,7 +21,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ cmake pkgconfig ];
-  buildInputs = [ zlib c-ares c-ares.cmake-config openssl protobuf gflags abseil-cpp ];
+  buildInputs = [ zlib c-ares c-ares.cmake-config openssl protobuf gflags abseil-cpp libnsl ];
 
   cmakeFlags =
     [ "-DgRPC_ZLIB_PROVIDER=package"

pkgs/development/libraries/gts/default.nix

@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, pkgconfig, autoreconfHook, gettext, glib }:
+{ fetchurl, stdenv, pkgconfig, autoreconfHook, gettext, glib, buildPackages }:
 
 
 stdenv.mkDerivation rec {
@@ -12,12 +12,26 @@ stdenv.mkDerivation rec {
     sha256 = "07mqx09jxh8cv9753y2d2jsv7wp8vjmrd7zcfpbrddz3wc9kx705";
   };
 
-  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  nativeBuildInputs = [
+    pkgconfig
+    autoreconfHook
+    glib  # required to satisfy AM_PATH_GLIB_2_0
+  ];
   buildInputs = [ gettext ];
   propagatedBuildInputs = [ glib ];
 
   doCheck = false; # fails with "permission denied"
 
+  preBuild = stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+    pushd src
+    make CC=${buildPackages.stdenv.cc}/bin/cc predicates_init
+    mv predicates_init predicates_init_build
+    make clean
+    popd
+
+    substituteInPlace src/Makefile --replace "./predicates_init" "./predicates_init_build"
+  '';
+
   meta = {
     homepage = "http://gts.sourceforge.net/";
     license = stdenv.lib.licenses.lgpl2Plus;

pkgs/development/libraries/irrlicht/default.nix

@@ -10,6 +10,10 @@ stdenv.mkDerivation rec {
 
   src = common.src;
 
+  postPatch = ''
+    sed -ie '/sys\/sysctl.h/d' source/Irrlicht/COSOperator.cpp
+  '';
+
   preConfigure = ''
     cd source/Irrlicht
   '';

pkgs/development/libraries/kde-frameworks/kconfigwidgets/default.nix

@@ -12,4 +12,7 @@ mkDerivation {
   patches = [ ./0001-qdiriterator-follow-symlinks.patch ];
   outputs = [ "out" "dev" ];
   outputBin = "dev";
+  postInstall = ''
+    moveToOutput ''${qtPluginPrefix:?}/designer/kconfigwidgets5widgets.so "$out"
+  '';
 }

pkgs/development/libraries/libchop/0001-Fix-RPC-compilation-when-using-libtirpc-rather-than-.patch

@@ -0,0 +1,41 @@
+From 86fd3be1d31d2e7c09603aa3a8966537ac01bb07 Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Tue, 11 Aug 2020 20:30:16 +0200
+Subject: [PATCH] Fix RPC compilation when using libtirpc rather than glibc
+
+---
+ src/block-server.c        | 3 +++
+ utils/chop-block-server.c | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/src/block-server.c b/src/block-server.c
+index 3f97417..29b299e 100644
+--- a/src/block-server.c
++++ b/src/block-server.c
+@@ -18,6 +18,9 @@
+ 
+ /* Server-side stubs.  */
+ 
++#include <rpc/types.h>
++#include <rpc/xdr.h>
++#include <rpc/auth.h>
+ #include <rpc/svc.h>
+ #include <chop/block-server.h>
+ 
+diff --git a/utils/chop-block-server.c b/utils/chop-block-server.c
+index a2076c0..9462f5d 100644
+--- a/utils/chop-block-server.c
++++ b/utils/chop-block-server.c
+@@ -19,6 +19,9 @@
+    store, e.g. a GDBM block store, and serves it remotely.  A lot of code is
+    borrowed from `chop-archiver.c'.  */
+ 
++#include <rpc/types.h>
++#include <rpc/xdr.h>
++#include <rpc/auth.h>
+ #include <chop/chop-config.h>
+ 
+ #include <alloca.h>
+-- 
+2.25.4
+

pkgs/development/libraries/libchop/default.nix

@@ -1,6 +1,6 @@
 { fetchurl, stdenv, zlib, bzip2, libgcrypt
 , gdbm, gperf, tdb, gnutls, db, libuuid
-, lzo, pkgconfig, guile
+, lzo, pkgconfig, guile, rpcsvc-proto, libtirpc
 }:
 
 stdenv.mkDerivation rec {
@@ -11,16 +11,19 @@ stdenv.mkDerivation rec {
     sha256 = "0fpdyxww41ba52d98blvnf543xvirq1v9xz1i3x1gm9lzlzpmc2g";
   };
 
-  patches = [ ./gets-undeclared.patch ./size_t.patch ];
+  patches = [ ./gets-undeclared.patch ./size_t.patch ./0001-Fix-RPC-compilation-when-using-libtirpc-rather-than-.patch ];
 
-  nativeBuildInputs = [ pkgconfig gperf ];
+  nativeBuildInputs = [ pkgconfig gperf rpcsvc-proto ];
+
+  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
+  NIX_LDFLAGS = [ "-ltirpc" ];
 
   buildInputs =
     [ zlib bzip2 lzo
       libgcrypt
       gdbm db tdb
       gnutls libuuid
-      guile
+      guile libtirpc
     ];
 
   doCheck = false;

pkgs/development/libraries/libdap/default.nix

@@ -18,5 +18,6 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl2;
     maintainers = [ maintainers.bzizou ];
     platforms = platforms.linux;
+    broken = true;
   };
 }

pkgs/development/libraries/libdbi-drivers/default.nix

@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     "--with-dbi-libdir=${libdbi}/lib"
   ] ++ optionals (libmysqlclient != null) [
     "--with-mysql"
-    "--with-mysql-incdir=${libmysqlclient}/include/mysql"
+    "--with-mysql-incdir=${getDev libmysqlclient}/include/mysql"
     "--with-mysql-libdir=${libmysqlclient}/lib/mysql"
   ] ++ optionals (sqlite != null) [
     "--with-sqlite3"

pkgs/development/libraries/libde265/default.nix

@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.6";
+  version = "1.0.7";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     rev = "v${version}";
-    sha256 = "0ipccyavlgf7hfzx1g8bvzg62xq10vcxvwgq70r3z3j6mdvmrzjp";
+    sha256 = "0x7g9771457z49qvzpk4iswfhq018i0mzsflv9gg8if5hjqhfdp0";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];

pkgs/development/libraries/libfido2/default.nix

@@ -11,10 +11,10 @@
 
 stdenv.mkDerivation rec {
   pname = "libfido2";
-  version = "1.4.0";
+  version = "1.5.0";
   src = fetchurl {
     url = "https://developers.yubico.com/${pname}/Releases/${pname}-${version}.tar.gz";
-    sha256 = "0v1a3n0qljmrp8y9pmnmbsdsy79l3z84qmhyjx50xdsbgnz1z4md";
+    sha256 = "08iizxq3w8mpkwfrfpl59csffc20yz8x398bl3kf23rrr4izk42r";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
@@ -22,14 +22,6 @@ stdenv.mkDerivation rec {
   buildInputs = [ hidapi libcbor openssl ]
     ++ stdenv.lib.optionals stdenv.isLinux [ udev ];
 
-  patches = [
-    # make build reproducible
-    (fetchpatch {
-      url = "https://github.com/Yubico/libfido2/commit/e79f7d7996e70d6b2ae9826fce81d61659cab4f6.patch";
-      sha256 = "0jwg69f95qqf0ym24q1ka50d3d3338cyw4fdfzpw4sab0shiaq9v";
-    })
-  ];
-
   cmakeFlags = [
     "-DUDEV_RULES_DIR=${placeholder "out"}/etc/udev/rules.d"
     "-DUSE_HIDAPI=1"

pkgs/development/libraries/libguestfs/default.nix

@@ -3,6 +3,7 @@
 , acl, libcap, libcap_ng, libconfig, systemd, fuse, yajl, libvirt, hivex, db
 , gmp, readline, file, numactl, xen, libapparmor, jansson
 , getopt, perlPackages, ocamlPackages
+, libtirpc
 , appliance ? null
 , javaSupport ? false, jdk ? null }:
 
@@ -24,6 +25,7 @@ stdenv.mkDerivation rec {
     cdrkit flex bison qemu pcre augeas libxml2 acl libcap libcap_ng libconfig
     systemd fuse yajl libvirt gmp readline file hivex db
     numactl xen libapparmor getopt perlPackages.ModuleBuild
+    libtirpc
   ] ++ (with perlPackages; [ perl libintl_perl GetoptLong SysVirt ])
     ++ (with ocamlPackages; [ ocaml findlib ocamlbuild ocaml_libvirt gettext-stub ounit ])
     ++ stdenv.lib.optional javaSupport jdk;

pkgs/development/libraries/libheif/default.nix

@@ -1,8 +1,9 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, libde265, x265, libpng, libjpeg }:
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, libde265, x265, libpng,
+  libjpeg, libaom }:
 
 stdenv.mkDerivation rec {
   pname = "libheif";
-  version = "1.8.0";
+  version = "1.9.1";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
@@ -10,11 +11,12 @@ stdenv.mkDerivation rec {
     owner = "strukturag";
     repo = "libheif";
     rev = "v${version}";
-    sha256 = "15az44qdqp2vncdfv1bzdl30977kvqxcb2bhx4x3q6vcxnm1xfgg";
+    sha256 = "0hjs1i076jmy4ryj8y2zs293wx53kzg38y8i42cbcsqydvsdp6hz";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
-  buildInputs = [ libde265 x265 libpng libjpeg ];
+  buildInputs = [ libde265 x265 libpng libjpeg libaom ];
+  # TODO: enable dav1d and rav1e codecs when libheif can find them via pkg-config
 
   enableParallelBuilding = true;
 

pkgs/development/libraries/libjpeg-turbo/default.nix

@@ -1,30 +1,18 @@
-{ stdenv, fetchurl, fetchpatch, cmake, nasm, enableStatic ? false, enableShared ? true }:
+{ stdenv, fetchFromGitHub, cmake, nasm, enableStatic ? false, enableShared ? true }:
 
 stdenv.mkDerivation rec {
 
   pname = "libjpeg-turbo";
-  version = "2.0.4";
+  version = "2.0.5";
 
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
+    owner = "libjpeg-turbo";
-    sha256 = "01ill8bgjyk582wipx7sh7gj2nidylpbzvwhx0wkcm6mxx3qbp9k";
+    repo = "libjpeg-turbo";
+    rev = version;
+    sha256 = "0p32yivybxdicm01qa9h1vj91apygzxpvnklrjmbx8z9z2l3qxc9";
   };
 
   patches =
-    [
-      # Fixes race in tests that causes "jpegtran-shared-icc" to fail
-      # https://github.com/libjpeg-turbo/libjpeg-turbo/pull/425
-      (fetchpatch {
-        url = "https://github.com/libjpeg-turbo/libjpeg-turbo/commit/a2291b252de1413a13db61b21863ae7aea0946f3.patch";
-        sha256 = "0nc5vcch5h52gpi07h08zf8br58q8x81q2hv871hrn0dinb53vym";
-      })
-
-      (fetchpatch {
-        name = "cve-2020-13790.patch";
-        url = "https://github.com/libjpeg-turbo/libjpeg-turbo/commit/3de15e0c344d.diff";
-        sha256 = "0hm5i6qir5w3zxb0xvqdh4jyvbfg7xnd28arhyfsaclfz9wdb0pb";
-      })
-    ] ++
     stdenv.lib.optional (stdenv.hostPlatform.libc or null == "msvcrt")
       ./mingw-boolean.patch;
 
@@ -41,7 +29,7 @@ stdenv.mkDerivation rec {
   installCheckTarget = "test";
 
   meta = with stdenv.lib; {
-    homepage = "http://libjpeg-turbo.virtualgl.org/";
+    homepage = "https://libjpeg-turbo.org/";
     description = "A faster (using SIMD) libjpeg implementation";
     license = licenses.ijg; # and some parts under other BSD-style licenses
     maintainers = with maintainers; [ vcunat colemickens ];

pkgs/development/libraries/libuv/default.nix

@@ -1,14 +1,14 @@
 { stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, pkgconfig, ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.38.1";
+  version = "1.40.0";
   pname = "libuv";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "0cvabjhi53qw94zyjkqamx0c607ayydfb4f3djx2gj8ab2p7s29n";
+    sha256 = "1hd0x6i80ca3j0c3a7laygzab5qkgxjkz692jwzrsinsfhvbq0pg";
   };
 
   postPatch = let
@@ -66,7 +66,8 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A multi-platform support library with a focus on asynchronous I/O";
-    homepage    = "https://github.com/libuv/libuv";
+    homepage    = "https://libuv.org/";
+    changelog   = "https://github.com/libuv/libuv/blob/v${version}/ChangeLog";
     maintainers = with maintainers; [ cstrahan ];
     platforms   = with platforms; linux ++ darwin;
     license     = with licenses; [ mit isc bsd2 bsd3 cc-by-40 ];

pkgs/development/libraries/libva/default.nix

@@ -7,14 +7,13 @@
 
 stdenv.mkDerivation rec {
   name = "libva-${lib.optionalString minimal "minimal-"}${version}";
-  version = "2.8.0"; # Also update the hash for libva-utils!
+  version = "2.9.0"; # Also update the hash for libva-utils!
 
-  # update libva-utils and vaapiIntel as well
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "libva";
     rev    = version;
-    sha256 = "190cq173jzp5rkrczi8gzbwa0y3xk253v4wd205a5ilfngm7srns";
+    sha256 = "17m8k8fn41vzi1lzh9idf2mn4x73bwlkw60kl5zj396kpw4n1z1r";
   };
 
   outputs = [ "dev" "out" ];

pkgs/development/libraries/libva/utils.nix

@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner  = "intel";
     repo   = "libva-utils";
     rev    = version;
-    sha256 = "081hw2jnj64bpqwh9p41n5caqzm6dnj1ggnvvc5wrf4m2z1h2bjb";
+    sha256 = "1xylc940ffhqay9lyy48872cfw61ziky8dw21vm69psngfz3zs9n";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config ];

pkgs/development/libraries/libvirt/5.9.0.nix

@@ -4,7 +4,7 @@
 , iproute, iptables, readline, lvm2, utillinux, systemd, libpciaccess, gettext
 , libtasn1, ebtables, libgcrypt, yajl, pmutils, libcap_ng, libapparmor
 , dnsmasq, libnl, libpcap, libxslt, xhtml1, numad, numactl, perlPackages
-, curl, libiconv, gmp, zfs, parted, bridge-utils, dmidecode, glib
+, curl, libiconv, gmp, zfs, parted, bridge-utils, dmidecode, glib, rpcsvc-proto, libtirpc
 , enableXen ? false, xen ? null
 , enableIscsi ? false, openiscsi
 , enableCeph ? false, ceph
@@ -33,10 +33,10 @@ in stdenv.mkDerivation rec {
         fetchSubmodules = true;
       };
 
-  nativeBuildInputs = [ makeWrapper pkgconfig ];
+  nativeBuildInputs = [ makeWrapper pkgconfig rpcsvc-proto ];
   buildInputs = [
     libxml2 gnutls perl python2 readline gettext libtasn1 libgcrypt yajl
-    libxslt xhtml1 perlPackages.XMLXPath curl libpcap glib
+    libxslt xhtml1 perlPackages.XMLXPath curl libpcap glib libtirpc
   ] ++ optionals (!buildFromTarball) [
     libtool autoconf automake
   ] ++ optionals stdenv.isLinux [
@@ -76,6 +76,7 @@ in stdenv.mkDerivation rec {
     "QEMU_BRIDGE_HELPER=/run/wrappers/bin/qemu-bridge-helper"
     "QEMU_PR_HELPER=/run/libvirt/nix-helpers/qemu-pr-helper"
     "EBTABLES_PATH=${ebtables}/bin/ebtables-legacy"
+    "CFLAGS=-I${libtirpc.dev}/include/tirpc"
     "--with-attr"
     "--with-apparmor"
     "--with-secdriver-apparmor"

pkgs/development/libraries/libvirt/default.nix

@@ -4,7 +4,7 @@
 , iproute, iptables, readline, lvm2, utillinux, systemd, libpciaccess, gettext
 , libtasn1, ebtables, libgcrypt, yajl, pmutils, libcap_ng, libapparmor
 , dnsmasq, libnl, libpcap, libxslt, xhtml1, numad, numactl, perlPackages
-, curl, libiconv, gmp, zfs, parted, bridge-utils, dmidecode, dbus
+, curl, libiconv, gmp, zfs, parted, bridge-utils, dmidecode, dbus, libtirpc, rpcsvc-proto, darwin
 , enableXen ? false, xen ? null
 , enableIscsi ? false, openiscsi
 , enableCeph ? false, ceph
@@ -17,29 +17,38 @@ let
   buildFromTarball = stdenv.isDarwin;
 in stdenv.mkDerivation rec {
   pname = "libvirt";
-  version = "6.3.0";
+  version = "6.6.0";
 
   src =
     if buildFromTarball then
       fetchurl {
-        url = "http://libvirt.org/sources/${pname}-${version}.tar.xz";
+        url = "https://libvirt.org/sources/${pname}-${version}.tar.xz";
-        sha256 = "1xcng497hs1gary3pz3fp590a4r1kqs4d0d8k5p370j0scw981kl";
+        sha256 = "1y8y13zvh820f4b15287wb77wq7ra7kbfnpblzhm1dki5pfjvrcl";
       }
     else
       fetchgit {
-        url = "git://libvirt.org/libvirt.git";
+        url = "https://gitlab.com/libvirt/libvirt.git";
         rev = "v${version}";
-        sha256 = "129b3p72jlb40dsidak3nvpssv75xx2v99y63gzp5k074fp8y8x4";
+        sha256 = "09hsbm2qmx0jfmm418rf5lx374g85bwgg0kzlga62x5180jhsssn";
         fetchSubmodules = true;
       };
 
-  nativeBuildInputs = [ makeWrapper pkgconfig docutils ] ++ optionals (!buildFromTarball) [ autoreconfHook ];
+  nativeBuildInputs = [
+    makeWrapper pkgconfig docutils
+  ] ++ optionals (!buildFromTarball) [
+    autoreconfHook
+  ] ++ optional (!stdenv.isDarwin) [
+    rpcsvc-proto
+  ] ++ optionals stdenv.isDarwin [
+    darwin.developer_cmds # needed for rpcgen
+  ];
+
   buildInputs = [
     libxml2 gnutls perl python2 readline gettext libtasn1 libgcrypt yajl
     libxslt xhtml1 perlPackages.XMLXPath curl libpcap glib dbus
   ] ++ optionals stdenv.isLinux [
     libpciaccess lvm2 utillinux systemd libnl numad zfs
-    libapparmor libcap_ng numactl attr parted
+    libapparmor libcap_ng numactl attr parted libtirpc
   ] ++ optionals (enableXen && stdenv.isLinux && stdenv.isx86_64) [
     xen
   ] ++ optionals enableIscsi [
@@ -65,7 +74,7 @@ in stdenv.mkDerivation rec {
   dontAddDisableDepTrack = true;
 
   configureFlags = [
-    "--with-runstatedir=/run" # TODO: remove when autoconf 1.70 is released
+    "--with-runstatedir=/run" # TODO: remove when autoconf 2.70 is released
     "--localstatedir=/var"
     "--sysconfdir=/var/lib"
     "--with-libpcap"
@@ -80,6 +89,7 @@ in stdenv.mkDerivation rec {
     "QEMU_BRIDGE_HELPER=/run/wrappers/bin/qemu-bridge-helper"
     "QEMU_PR_HELPER=/run/libvirt/nix-helpers/qemu-pr-helper"
     "EBTABLES_PATH=${ebtables}/bin/ebtables-legacy"
+    "CFLAGS=-I${libtirpc.dev}/include/tirpc"
     "--with-attr"
     "--with-apparmor"
     "--with-secdriver-apparmor"
@@ -124,10 +134,8 @@ in stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = "-fno-stack-protector";
-
   meta = {
-    homepage = "http://libvirt.org/";
+    homepage = "https://libvirt.org/";
     repositories.git = "git://libvirt.org/libvirt.git";
     description = ''
       A toolkit to interact with the virtualization capabilities of recent

pkgs/development/libraries/libvorbis/default.nix

@@ -1,28 +1,15 @@
-{ stdenv, fetchurl, libogg, pkgconfig, fetchpatch }:
+{ stdenv, fetchurl, libogg, pkgconfig }:
 
 stdenv.mkDerivation rec {
-  name = "libvorbis-1.3.6";
+  name = "libvorbis-1.3.7";
 
   src = fetchurl {
     url = "http://downloads.xiph.org/releases/vorbis/${name}.tar.xz";
-    sha256 = "05dlzjkdpv46zb837wysxqyn8l636x3dw8v8ymlrwz2fg1dbn05g";
+    sha256 = "0jwmf87x5sdis64rbv0l87mdpah1rbilkkxszipbzg128f9w8g5k";
   };
 
   outputs = [ "out" "dev" "doc" ];
 
-  patches = [
-    (fetchpatch {
-      url = "https://gitlab.xiph.org/xiph/vorbis/commit/018ca26dece618457dd13585cad52941193c4a25.patch";
-      sha256 = "18k4vp0nmrxxpis641ylnw6dgwxrymh5bf74njr6v8dizmmz1bkj";
-      name = "CVE-2017-14160+CVE-2018-10393.patch";
-    })
-    (fetchpatch {
-      url = "https://gitlab.xiph.org/xiph/vorbis/commit/112d3bd0aaacad51305e1464d4b381dabad0e88b.diff";
-      sha256 = "1k77y3q36npy8mkkz40f6cb46l2ldrwyrd191m29s8rnbhnafdf7";
-      name = "CVE-2018-10392.patch";
-    })
-  ];
-
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ libogg ];
 

pkgs/development/libraries/mesa/default.nix

@@ -31,7 +31,7 @@ with stdenv.lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "20.1.7";
+  version = "20.1.9";
   branch  = versions.major version;
 in
 
@@ -46,7 +46,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "1252mgwiy05nz8mm4gjkzmnjfvdz5yv1shnsr837cdnan86dvsad";
+    sha256 = "10kk8a8k7f4ip8yaiqdyrx162nbw8pw4h3b4hs4ha8mpd43wlldj";
   };
 
   prePatch = "patchShebangs .";

pkgs/development/libraries/nspr/default.nix

@@ -2,7 +2,7 @@
 , CoreServices ? null
 , buildPackages }:
 
-let version = "4.28"; in
+let version = "4.29"; in
 
 stdenv.mkDerivation {
   pname = "nspr";
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://mozilla/nspr/releases/v${version}/src/nspr-${version}.tar.gz";
-    sha256 = "0miv8ggil1xdywxw2sxaa05kqw7ahjgaimf7zjc6y2x8367grpk3";
+    sha256 = "22286bdb8059d74632cc7c2865c139e63953ecfb33bf4362ab58827e86e92582";
   };
 
   patches = [

pkgs/development/libraries/nss/default.nix

@@ -5,7 +5,7 @@ let
     url = "http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz";
     sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
   };
-  version = "3.56";
+  version = "3.57";
   underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
 
 in stdenv.mkDerivation rec {
@@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "174f0ki2f8szkgv02jlsg2ci332sl9dabr2vcwnyjp1vxplf0xgq";
+    sha256 = "55a86c01be860381d64bb4e5b94eb198df9b0f098a8af0e58c014df398bdc382";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];

pkgs/development/libraries/ntirpc/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, cmake
-, krb5, liburcu , libtirpc
+, krb5, liburcu , libtirpc, libnsl
 } :
 
 stdenv.mkDerivation rec {
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ krb5 liburcu ];
+  buildInputs = [ krb5 liburcu libnsl ];
 
   postInstall = ''
     mkdir -p $out/etc

pkgs/development/libraries/nvidia-texture-tools/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake }:
+{ stdenv, fetchFromGitHub, cmake, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "nvidia-texture-tools";
@@ -11,6 +11,13 @@ stdenv.mkDerivation rec {
     sha256 = "1qzyr3ib5dpxyq1y33lq02qv4cww075sm9bm4f651d34q5x38sk3";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/castano/nvidia-texture-tools/commit/6474f2593428d89ec152da2502aa136ababe66ca.patch";
+      sha256 = "0akbkvm55hiv58jx71h9hj173rbnqlb5a430y9azjiix7zga42vd";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   outputs = [ "out" "dev" "lib" ];

pkgs/development/libraries/opencv/default.nix

@@ -87,5 +87,6 @@ stdenv.mkDerivation rec {
     license = licenses.bsd3;
     maintainers = with maintainers; [ ];
     platforms = platforms.linux;
+    broken = true;
   };
 }

pkgs/development/libraries/opendbx/default.nix

@@ -1,5 +1,7 @@
 { stdenv, fetchurl, readline, libmysqlclient, postgresql, sqlite }:
 
+let inherit (stdenv.lib) getDev; in
+
 stdenv.mkDerivation rec {
   name = "opendbx-1.4.6";
 
@@ -9,7 +11,7 @@ stdenv.mkDerivation rec {
   };
 
   preConfigure = ''
-    export CPPFLAGS="-I${libmysqlclient}/include/mysql"
+    export CPPFLAGS="-I${getDev libmysqlclient}/include/mysql"
     export LDFLAGS="-L${libmysqlclient}/lib/mysql -L${postgresql}/lib"
     configureFlagsArray=(--with-backends="mysql pgsql sqlite3")
   '';

pkgs/development/libraries/physics/cernlib/0001-Use-strerror-rather-than-sys_errlist-to-fix-compilat.patch

@@ -0,0 +1,94 @@
+From a69607c511b6da94cde477283b129cbc9cfdd5a3 Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Tue, 11 Aug 2020 12:32:06 +0200
+Subject: [PATCH] Use `strerror` rather than `sys_errlist` to fix compilation
+ w/glibc-2.32
+
+To quote the release-notes[1]:
+
+  All programs should use
+  strerror or strerror_r instead.
+
+[1] https://sourceware.org/pipermail/libc-announce/2020/000029.html
+---
+ 2006/src/packlib/cspack/sysreq/serror.c         | 10 +---------
+ 2006/src/packlib/cspack/sysreq/socket.c         |  2 +-
+ 2006/src/packlib/kernlib/kernbit/z268/systems.c |  4 ++--
+ 2006/src/pawlib/paw/piafs/piafc.c               |  5 +----
+ 4 files changed, 5 insertions(+), 16 deletions(-)
+
+diff --git a/2006/src/packlib/cspack/sysreq/serror.c b/2006/src/packlib/cspack/sysreq/serror.c
+index 3667c42a..c560e499 100644
+--- a/2006/src/packlib/cspack/sysreq/serror.c
++++ b/2006/src/packlib/cspack/sysreq/serror.c
+@@ -176,15 +176,7 @@ int     n;
+         }
+         else {
+ #if !defined(vms)
+-                if ((n>0) && (n<sys_nerr)) {
+-                        return(sys_errlist[n]);
+-                }
+-                else {
+-                        (void) sprintf(buf,"%s: %d\n",
+- sys_serrlist[SEMAXERR+1-SEBASEOFF],
+-                            n);
+-                        return(buf);
+-                }
++          return strerror(n);
+ #else /* vms */
+ /*
+  * There are (were) some bugs is DEC C compilers (/OPT), just check
+diff --git a/2006/src/packlib/cspack/sysreq/socket.c b/2006/src/packlib/cspack/sysreq/socket.c
+index ceb5bd63..34c2a7bc 100644
+--- a/2006/src/packlib/cspack/sysreq/socket.c
++++ b/2006/src/packlib/cspack/sysreq/socket.c
+@@ -412,7 +412,7 @@ char *
+ s_errmsg()                              /* return last error message    */
+ {
+ #if !defined(vms)
+-        return(sys_errlist[errno]);
++        return(strerror(errno));
+ #else /* vms */
+ #if defined(MULTINET) && (MULTINET == 1)
+         return(vms_errno_string());
+diff --git a/2006/src/packlib/kernlib/kernbit/z268/systems.c b/2006/src/packlib/kernlib/kernbit/z268/systems.c
+index 98459459..d1ad63ed 100644
+--- a/2006/src/packlib/kernlib/kernbit/z268/systems.c
++++ b/2006/src/packlib/kernlib/kernbit/z268/systems.c
+@@ -134,7 +134,7 @@ int     *ovflw;
+ #endif /* hpux */
+ 
+ 	if ( (ps=(FILE *)popen(command,"r"))==NULL ) {
+-		fprintf(stderr,"systems(): popen(): %s\n",sys_errlist[errno] );
++		fprintf(stderr,"systems(): popen(): %s\n",strerror(errno) );
+ 		*rc= -errno;
+ 		*chars=0        ;
+                 *l=0        ;
+@@ -144,7 +144,7 @@ int     *ovflw;
+ 	rcode = fread(buf, 1, buflen , ps );
+ 	if ( rcode < 0 ) {
+ 		fprintf(stderr,"systems(): pipe fread(): %s\n",
+-                                                       sys_errlist[errno] );
++                                                       strerror(errno) );
+ 		buf[0]='\n';
+ 		*rc= -errno;
+                 *chars=0        ;
+diff --git a/2006/src/pawlib/paw/piafs/piafc.c b/2006/src/pawlib/paw/piafs/piafc.c
+index b163f80c..4d8d5528 100644
+--- a/2006/src/pawlib/paw/piafs/piafc.c
++++ b/2006/src/pawlib/paw/piafs/piafc.c
+@@ -1795,10 +1795,7 @@ static void fatalperror(char *msg)
+    extern char  *sys_errlist[];
+ #endif
+ 
+-   if ((unsigned) errno < sys_nerr)
+-      sprintf(buf, "%s: %s", msg, sys_errlist[errno]);
+-   else
+-      sprintf(buf, "%s: Error %d", msg, errno);
++   sprintf(buf, "%s: %s", msg, strerror(errno));
+ 
+    fatal(buf);
+ }
+-- 
+2.25.4
+

pkgs/development/libraries/physics/cernlib/default.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ gnumake imake makedepend ];
   sourceRoot = ".";
 
-  patches = [ ./patch.patch ];
+  patches = [ ./patch.patch ./0001-Use-strerror-rather-than-sys_errlist-to-fix-compilat.patch ];
 
   postPatch = ''
     substituteInPlace 2006/src/config/site.def \

pkgs/development/libraries/qt-5/hooks/fix-qmake-libtool.sh

@@ -5,8 +5,19 @@
 fixQmakeLibtool() {
     if [ -d "$1" ]; then
         find "$1" -name '*.la' | while read la; do
+            set +e
+            framework_libs=$(grep '^dependency_libs' "$la" | grep -Eo -- '-framework +\w+' | tr '\n' ' ')
+            set -e
             sed -i "$la" \
-                -e '/^dependency_libs/ s,\(/[^ ]\+\)/lib\([^/ ]\+\)\.so,-L\1 -l\2,g'
+                -e '/^dependency_libs/ s,\(/[^ ]\+\)/lib\([^/ ]\+\)\.so,-L\1 -l\2,g' \
+                -e '/^dependency_libs/ s,-framework \+\w\+,,g'
+            if [ ! -z "$framework_libs" ]; then
+                if grep '^inherited_linker_flags=' $la >/dev/null; then
+                    sed -i "$la" -e "s/^\(inherited_linker_flags='[^']*\)/\1 $framework_libs/"
+                else
+                    echo "inherited_linker_flags='$framework_libs'" >> "$la"
+                fi
+            fi
         done
     fi
 }

pkgs/development/libraries/science/math/openblas/default.nix

@@ -107,6 +107,9 @@ in
 stdenv.mkDerivation rec {
   pname = "openblas";
   version = "0.3.10";
+
+  outputs = [ "out" "dev" ];
+
   src = fetchFromGitHub {
     owner = "xianyi";
     repo = "OpenBLAS";

pkgs/development/libraries/ti-rpc/default.nix

@@ -1,21 +1,19 @@
 { fetchurl, stdenv, autoreconfHook, libkrb5 }:
 
 stdenv.mkDerivation rec {
-  name = "libtirpc-1.2.6";
+  pname = "libtirpc";
+  version = "1.2.7-rc4";
 
   src = fetchurl {
-    url = "mirror://sourceforge/libtirpc/${name}.tar.bz2";
+    url = "http://git.linux-nfs.org/?p=steved/libtirpc.git;a=snapshot;h=5ca4ca92f629d9d83e83544b9239abaaacf0a527;sf=tgz";
-    sha256 = "1k6i6wma3xs7gmp54z587nd4yi5wrvg2ycl5g36zjnhx32jyjy22";
+    sha256 = "0w26yf9bwkpqj52sqd3n250dg9jlqnr8bjv0kc4fl5hkrv8akj8i";
+    name = "${pname}-${version}.tar.gz";
   };
 
   outputs = [ "out" "dev" ];
 
   postPatch = ''
     sed '1i#include <stdint.h>' -i src/xdr_sizeof.c
-  '' + stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
-    substituteInPlace tirpc/rpc/types.h \
-      --replace '#if defined __APPLE_CC__ || defined __FreeBSD__' \
-                '#if defined __APPLE_CC__ || defined __FreeBSD__ || !defined __GLIBC__'
   '';
 
   KRB5_CONFIG = "${libkrb5.dev}/bin/krb5-config";

pkgs/development/libraries/x265/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, cmake, nasm, numactl
+{ stdenv, fetchFromBitbucket, cmake, nasm, numactl
 , numaSupport ? stdenv.hostPlatform.isLinux && (stdenv.hostPlatform.isx86 || stdenv.hostPlatform.isAarch64)  # Enabled by default on NUMA platforms
 , debugSupport ? false # Run-time sanity checks (debugging)
 , werrorSupport ? false # Warnings as errors
@@ -25,31 +25,23 @@ let
     "-DENABLE_ALTIVEC=OFF"
   ];
 
-  version = "3.2";
+  version = "3.4";
 
-  src = fetchurl {
+  src = fetchFromBitbucket {
-    urls = [
+    owner = "multicoreware";
-      "https://get.videolan.org/x265/x265_${version}.tar.gz"
+    repo = "x265_git";
-      "ftp://ftp.videolan.org/pub/videolan/x265/x265_${version}.tar.gz"
+    rev = "${version}";
-    ];
+    sha256 = "1jzgv2hxhcwmsdf6sbgyzm88a46dp09ll1fqj92g9vckvh9a7dsn";
-    sha256 = "0fqkhfhr22gzavxn60cpnj3agwdf5afivszxf3haj5k1sny7jk9n";
   };
 
-  patches = [
-    # Fix build on ARM (#406)
-    (fetchpatch {
-      url = "https://bitbucket.org/multicoreware/x265/issues/attachments/406/multicoreware/x265/1527562952.26/406/X265-2.8-asm-primitives.patch";
-      sha256 = "1vf8bpl37gbd9dcbassgkq9i0rp24qm3bl6hx9zv325174bn402v";
-    })
-  ];
-
   buildLib = has12Bit: stdenv.mkDerivation rec {
     name = "libx265-${if has12Bit then "12" else "10"}-${version}";
-    inherit src patches;
+    inherit src;
     enableParallelBuilding = true;
 
     postPatch = ''
       sed -i 's/unknown/${version}/g' source/cmake/version.cmake
+      sed -i 's/0.0/${version}/g' source/cmake/version.cmake
     '';
 
     cmakeLibFlags = [
@@ -74,12 +66,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "x265";
-  inherit version src patches;
+  inherit version src;
 
   enableParallelBuilding = true;
 
   postPatch = ''
     sed -i 's/unknown/${version}/g' source/cmake/version.cmake
+    sed -i 's/0.0/${version}/g' source/cmake/version.cmake
   '';
 
   cmakeFlags = [

pkgs/development/lua-modules/overrides.nix

@@ -169,7 +169,7 @@ with super;
   luadbi-mysql = super.luadbi-mysql.override({
     extraVariables = {
       # Can't just be /include and /lib, unfortunately needs the trailing 'mysql'
-      MYSQL_INCDIR="${pkgs.libmysqlclient}/include/mysql";
+      MYSQL_INCDIR="${pkgs.libmysqlclient.dev}/include/mysql";
       MYSQL_LIBDIR="${pkgs.libmysqlclient}/lib/mysql";
     };
     buildInputs = [

pkgs/development/perl-modules/xml-parser-0001-HACK-Assumes-Expat-paths-are-good.patch

@@ -16,30 +16,28 @@ diff --git a/Makefile.PL b/Makefile.PL
 index 505d1df..fc38b76 100644
 --- a/Makefile.PL
 +++ b/Makefile.PL
-@@ -28,12 +28,18 @@ foreach (@ARGV) {
+@@ -29,12 +29,17 @@ foreach (@ARGV) {
  @ARGV = @replacement_args;
  
  unless (
--  check_lib(     # fill in what you prompted the user for here
+-    check_lib(    # fill in what you prompted the user for here
--    lib => [qw(expat)],
+-        lib     => [qw(expat)],
--    header => ['expat.h'],
+-        header  => ['expat.h'],
--    incpath => $expat_incpath,
+-        incpath => $expat_incpath,
--    ($expat_libpath?
+-        ( $expat_libpath ? ( libpath => $expat_libpath ) : () ),
--    (libpath => $expat_libpath):()),
+-    )
--  )) {
++    #check_lib(    # fill in what you prompted the user for here
-+  #check_lib(     # fill in what you prompted the user for here
++    #    lib     => [qw(expat)],
-+  #  lib => [qw(expat)],
++    #    header  => ['expat.h'],
-+  #  header => ['expat.h'],
++    #    incpath => $expat_incpath,
-+  #  incpath => $expat_incpath,
++    #    ( $expat_libpath ? ( libpath => $expat_libpath ) : () ),
-+  #  ($expat_libpath?
++    #)
-+  #  (libpath => $expat_libpath):()),
++    # The check_lib implementation fails horribly with cross-compilation.
-+  #)
++    # We are giving known good paths to expat.
-+  # The check_lib implementation fails horribly with cross-compilation.
++    # And in all cases, the previous behaviour of not actually failing
-+  # We are giving known good paths to expat.
++    # seemed to work just fine :/.
-+  # And in all cases, the previous behaviour of not actually failing
++    false
-+  # seemed to work just fine :/.
+ ) {
-+  false
-+  ) {
      warn <<'Expat_Not_Installed;';
  
 -- 

pkgs/development/python-modules/Mako/default.nix

@@ -1,11 +1,10 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, python
-, markupsafe
-, nose
-, mock
 , isPyPy
+, markupsafe
+, mock
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -17,19 +16,25 @@ buildPythonPackage rec {
     sha256 = "8195c8c1400ceb53496064314c6736719c6f25e7479cd24c77be3d9361cddc27";
   };
 
-  checkInputs = [ markupsafe nose mock ];
   propagatedBuildInputs = [ markupsafe ];
+  checkInputs = [ pytestCheckHook markupsafe mock ];
 
-  doCheck = !isPyPy;  # https://bitbucket.org/zzzeek/mako/issue/238/2-tests-failed-on-pypy-24-25
+  disabledTests = lib.optionals isPyPy [
-  checkPhase = ''
+    # https://github.com/sqlalchemy/mako/issues/315
-    ${python.interpreter} -m unittest discover
+    "test_alternating_file_names"
-  '';
+    # https://github.com/sqlalchemy/mako/issues/238
+    "test_file_success"
+    "test_stdin_success"
+    # fails on pypy2.7
+    "test_bytestring_passthru"
+  ];
 
-  meta = {
+  meta = with lib; {
     description = "Super-fast templating language";
-    homepage = "http://www.makotemplates.org";
+    homepage = "https://www.makotemplates.org/";
-    license = lib.licenses.mit;
+    changelog = "https://docs.makotemplates.org/en/latest/changelog.html";
-    platforms = lib.platforms.unix;
+    license = licenses.mit;
-    maintainers = with lib.maintainers; [ domenkozar ];
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ domenkozar ];
   };
 }

pkgs/development/python-modules/anytree/default.nix

@@ -1,13 +1,15 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
 , substituteAll
-, fetchpatch
-, nose
 , six
 , withGraphviz ? true
 , graphviz
 , fontconfig
+# Tests
+, pytestCheckHook
+, nose
 }:
 
 buildPythonPackage rec {
@@ -26,10 +28,6 @@ buildPythonPackage rec {
     })
   ];
 
-  checkInputs = [
-    nose
-  ];
-
   propagatedBuildInputs = [
     six
   ];
@@ -42,13 +40,13 @@ buildPythonPackage rec {
   # circular dependency anytree → graphviz → pango → glib → gtk-doc → anytree
   doCheck = withGraphviz;
 
-  checkPhase = ''
+  checkInputs = [ pytestCheckHook nose ];
-    runHook preCheck
 
-    nosetests
+  pytestFlagsArray = lib.optionals (pythonOlder "3.4") [
-
+    # Use enums, which aren't available pre-python3.4
-    runHook postCheck
+    "--ignore=tests/test_resolver.py"
-  '';
+    "--ignore=tests/test_search.py"
+  ];
 
   meta = with lib; {
     description = "Powerful and Lightweight Python Tree Data Structure";

pkgs/development/python-modules/cryptography/default.nix

@@ -22,11 +22,11 @@
 
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "3.1"; # Also update the hash in vectors.nix
+  version = "3.1.1"; # Also update the hash in vectors.nix
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "021yccbqr446zh1c9l8yj79h9bgbd1cwv0ppj168w9y67i3rlh16";
+    sha256 = "0z81q4d1nangw3r0v5f41mfl4d9r04qnbayl5ll5v5jpcfhwd7wx";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/python-modules/cryptography/vectors.nix

@@ -7,7 +7,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "10hixzqf2ppw8j61f6p04rgnq8ra6pjml68330s5af8df8xbqq16";
+    sha256 = "1xp2j79c1y8qj4b97ygx451gzp8l4cp830hnvg3zw8j134bcaaam";
   };
 
   # No tests included

pkgs/development/python-modules/libvirt/default.nix

@@ -1,13 +1,14 @@
-{ stdenv, buildPythonPackage, fetchgit, pkgconfig, lxml, libvirt, nose }:
+{ stdenv, buildPythonPackage, fetchFromGitLab, pkgconfig, lxml, libvirt, nose }:
 
 buildPythonPackage rec {
   pname = "libvirt";
-  version = "6.3.0";
+  version = "6.6.0";
 
-  src = assert version == libvirt.version; fetchgit {
+  src = assert version == libvirt.version; fetchFromGitLab {
-    url = "git://libvirt.org/libvirt-python.git";
+    owner = "libvirt";
+    repo = "libvirt-python";
     rev = "v${version}";
-    sha256 = "088cksq59jxkkzbvmwl8jw9v2k3zibwksl7j57yb51bxaa2sa1cx";
+    sha256 = "0jj6b2nlx7qldwbvixz74abn3p0sq4lkf6ak74vynrv5xvlycb9v";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -19,7 +20,7 @@ buildPythonPackage rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = "http://www.libvirt.org/";
+    homepage = "https://libvirt.org/python.html";
     description = "libvirt Python bindings";
     license = licenses.lgpl2;
     maintainers = [ maintainers.fpletz ];

pkgs/development/tools/build-managers/bmake/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bmake";
-  version = "20200710";
+  version = "20200902";
 
   src = fetchurl {
     url    = "http://www.crufty.net/ftp/pub/sjg/${pname}-${version}.tar.gz";
-    sha256 = "0v5paqdc0wnqlw4dy45mnydkmabsky33nvd7viwd2ygg351zqf35";
+    sha256 = "1v1v81llsiy8qbpy38nml1x08dhrihwh040pqgwbwb9zy1108b08";
   };
 
   nativeBuildInputs = [ getopt ];

pkgs/development/tools/build-managers/meson/default.nix

@@ -9,21 +9,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "0.55.1";
+  version = "0.55.3";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "O1dB+ITgSSi9+hlHRn/wavpsmOYjwlzvda33HKOc4IA=";
+    sha256 = "19cjy24mfaswxyvqmns6rd7hx05ybqb663zlgklspfr8l4jjmvbb";
   };
 
   patches = [
-    # Meson 0.55.0 incorrectly considers skipped tests as failures,
-    # which makes some packages like gjs fail to build.
-    (fetchpatch {
-      url = "https://github.com/mesonbuild/meson/commit/7db49db67d4aa7582cf46feb7157235e66aa95b1.diff";
-      sha256 = "1chq52sgk24afdlswssr8n8p6fa2wz8rjlxvkjhpqg1kg3qnqc9p";
-    })
-
     # Upstream insists on not allowing bindir and other dir options
     # outside of prefix for some reason:
     # https://github.com/mesonbuild/meson/issues/2561

pkgs/development/tools/misc/dbench/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, autoconf, popt, zlib }:
+{ stdenv, fetchgit, autoconf, popt, zlib, rpcsvc-proto, libtirpc }:
 
 stdenv.mkDerivation {
   name = "dbench-2013-01-01";
@@ -9,7 +9,10 @@ stdenv.mkDerivation {
     sha256 = "16lcbwmmx8z5i73k3dnf54yffrpx7ql3y9k3cpkss9dcyxb1p83i";
   };
 
-  buildInputs = [ autoconf popt zlib ];
+  nativeBuildInputs = [ autoconf rpcsvc-proto ];
+  buildInputs = [ popt zlib libtirpc ];
+  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
+  NIX_LDFLAGS = [ "-ltirpc" ];
 
   patches = [
     # patch has been also sent upstream and might be included in future versions

pkgs/development/tools/misc/texinfo/common.nix

@@ -1,6 +1,6 @@
 { version, sha256 }:
 
-{ stdenv, buildPackages, fetchurl, perl, xz
+{ stdenv, buildPackages, fetchurl, perl, xz, gettext
 
 # we are a dependency of gcc, this simplifies bootstraping
 , interactive ? false, ncurses, procps
@@ -39,6 +39,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ xz.bin ]
     ++ optionals stdenv.isSunOS [ libiconv gawk ]
+    ++ optionals stdenv.isDarwin [ gettext ]
     ++ optional interactive ncurses;
 
   configureFlags = [ "PERL=${buildPackages.perl}/bin/perl" ]

pkgs/development/tools/parsing/bison/default.nix

@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bison";
-  version = "3.7.1";
+  version = "3.7.2";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "04vx6sah3bnr3a5n9knw306sb3y41pjfl7k9ihbsimghkj1m5n8x";
+    sha256 = "111ax2imnydvrpcys5ami8ixn0a50m7a5pims7cbyysi8h8djp21";
   };
 
   nativeBuildInputs = [ m4 perl ] ++ stdenv.lib.optional stdenv.isSunOS help2man;

pkgs/development/web/nodejs/v14.nix

@@ -8,6 +8,6 @@ let
 in
   buildNodejs {
     inherit enableNpm;
-    version = "14.9.0";
+    version = "14.12.0";
-    sha256 = "1xkfivr0qci50ksg66szyasdlbiwh2j7ia4n6qc5csih2nvzcbh1";
+    sha256 = "0c2mv208akyk10pmjfilxbdpi2gpb5zlb4h903lgqmr229kmnd3c";
   }

pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix

@@ -1,11 +1,18 @@
-{ stdenv, appleDerivation, xcbuildHook }:
+{ stdenv, appleDerivation, xcbuildHook, llvmPackages }:
 
 appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
 
-  patchPhase = ''
+  patches = [
+    # The following copied from
+    # https://github.com/Homebrew/homebrew-core/commit/712ed3e948868e17f96b7e59972b5f45d4faf688
+    # is needed to build libvirt.
+    ./rpcgen-support-hyper-and-quad-types.patch
+  ];
+
+  postPatch = ''
     substituteInPlace rpcgen/rpc_main.c \
-      --replace "/usr/bin/cpp" "${stdenv.cc}/bin/cpp"
+      --replace "/usr/bin/cpp" "${llvmPackages.clang-unwrapped}/bin/clang-cpp"
   '';
 
   # temporary install phase until xcodebuild has "install" support

pkgs/os-specific/darwin/apple-source-releases/developer_cmds/rpcgen-support-hyper-and-quad-types.patch

@@ -0,0 +1,66 @@
+diff --git a/rpcgen/rpc_parse.c b/rpcgen/rpc_parse.c
+index 52edc9f..db0c1f1 100644
+--- a/rpcgen/rpc_parse.c
++++ b/rpcgen/rpc_parse.c
+@@ -580,6 +580,10 @@ get_type(prefixp, typep, dkind)
+		*typep = "long";
+		(void) peekscan(TOK_INT, &tok);
+		break;
++	case TOK_HYPER:
++		*typep = "int64_t";
++		(void) peekscan(TOK_INT, &tok);
++		break;
+	case TOK_VOID:
+		if (dkind != DEF_UNION && dkind != DEF_PROGRAM) {
+			error("voids allowed only inside union and program definitions with one argument");
+@@ -592,6 +596,7 @@ get_type(prefixp, typep, dkind)
+	case TOK_INT:
+	case TOK_FLOAT:
+	case TOK_DOUBLE:
++	case TOK_QUAD:
+	case TOK_BOOL:
+		*typep = tok.str;
+		break;
+@@ -622,6 +627,11 @@ unsigned_dec(typep)
+		*typep = "u_long";
+		(void) peekscan(TOK_INT, &tok);
+		break;
++	case TOK_HYPER:
++		get_token(&tok);
++		*typep = "u_int64_t";
++		(void) peekscan(TOK_INT, &tok);
++		break;
+	case TOK_INT:
+		get_token(&tok);
+		*typep = "u_int";
+diff --git a/rpcgen/rpc_scan.c b/rpcgen/rpc_scan.c
+index a8df441..4130107 100644
+--- a/rpcgen/rpc_scan.c
++++ b/rpcgen/rpc_scan.c
+@@ -419,8 +419,10 @@ static token symbols[] = {
+	{TOK_UNSIGNED, "unsigned"},
+	{TOK_SHORT, "short"},
+	{TOK_LONG, "long"},
++	{TOK_HYPER, "hyper"},
+	{TOK_FLOAT, "float"},
+	{TOK_DOUBLE, "double"},
++	{TOK_QUAD, "quadruple"},
+	{TOK_STRING, "string"},
+	{TOK_PROGRAM, "program"},
+	{TOK_VERSION, "version"},
+diff --git a/rpcgen/rpc_scan.h b/rpcgen/rpc_scan.h
+index bac2be4..e4c57c8 100644
+--- a/rpcgen/rpc_scan.h
++++ b/rpcgen/rpc_scan.h
+@@ -66,9 +66,11 @@ enum tok_kind {
+	TOK_INT,
+	TOK_SHORT,
+	TOK_LONG,
++	TOK_HYPER,
+	TOK_UNSIGNED,
+	TOK_FLOAT,
+	TOK_DOUBLE,
++	TOK_QUAD,
+	TOK_OPAQUE,
+	TOK_CHAR,
+	TOK_STRING,

pkgs/os-specific/darwin/cctools/port.nix

@@ -17,92 +17,90 @@ in
 # Non-Darwin alternatives
 assert (!stdenv.hostPlatform.isDarwin) -> maloader != null;
 
-let
+stdenv.mkDerivation {
-  baseParams = rec {
+  pname = "${targetPrefix}cctools-port";
-    name = "${targetPrefix}cctools-port";
+  version = "949.0.1";
-    version = "927.0.2";
 
-    src = fetchFromGitHub {
+  src = fetchFromGitHub {
-      owner  = "tpoechtrager";
+    owner  = "tpoechtrager";
-      repo   = "cctools-port";
+    repo   = "cctools-port";
-      rev    = "8239a5211bcf07d6b9d359782e1a889ec1d7cce5";
+    rev    = "43f32a4c61b5ba7fde011e816136c550b1b3146f";
-      sha256 = "0h8b1my0wf1jyjq63wbiqkl2clgxsf87f6i4fjhqs431fzlq8sac";
+    sha256 = "10yc5smiczzm62q6ijqccc58bwmfhc897f3bwa5i9j98csqsjj0k";
-    };
+  };
 
-    outputs = [ "out" "dev" "man" ];
+  outputs = [ "out" "dev" "man" ];
 
-    nativeBuildInputs = [ autoconf automake libtool autoreconfHook installShellFiles ];
+  nativeBuildInputs = [ autoconf automake libtool autoreconfHook installShellFiles ];
-    buildInputs = [ libuuid ]
+  buildInputs = [ libuuid ]
-      ++ stdenv.lib.optionals stdenv.isDarwin [ libcxxabi libobjc ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ libcxxabi libobjc ]
-      ++ stdenv.lib.optional enableTapiSupport libtapi;
+    ++ stdenv.lib.optional enableTapiSupport libtapi;
 
-    patches = [ ./ld-ignore-rpath-link.patch ./ld-rpath-nonfinal.patch ];
+  patches = [ ./ld-ignore-rpath-link.patch ./ld-rpath-nonfinal.patch ];
 
-    __propagatedImpureHostDeps = [
+  __propagatedImpureHostDeps = [
-      # As far as I can tell, otool from cctools is the only thing that depends on these two, and we should fix them
+    # As far as I can tell, otool from cctools is the only thing that depends on these two, and we should fix them
-      "/usr/lib/libobjc.A.dylib"
+    "/usr/lib/libobjc.A.dylib"
-      "/usr/lib/libobjc.dylib"
+    "/usr/lib/libobjc.dylib"
+  ];
+
+  enableParallelBuilding = true;
+
+  # TODO(@Ericson2314): Always pass "--target" and always targetPrefix.
+  configurePlatforms = [ "build" "host" ]
+    ++ stdenv.lib.optional (stdenv.targetPlatform != stdenv.hostPlatform) "target";
+  configureFlags = [ "--disable-clang-as" ]
+    ++ stdenv.lib.optionals enableTapiSupport [
+      "--enable-tapi-support"
+      "--with-libtapi=${libtapi}"
     ];
 
-    enableParallelBuilding = true;
+  postPatch = stdenv.lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace cctools/Makefile.am --replace libobjc2 ""
+  '' + ''
+    sed -i -e 's/addStandardLibraryDirectories = true/addStandardLibraryDirectories = false/' cctools/ld64/src/ld/Options.cpp
 
-    # TODO(@Ericson2314): Always pass "--target" and always targetPrefix.
+    # FIXME: there are far more absolute path references that I don't want to fix right now
-    configurePlatforms = [ "build" "host" ]
+    substituteInPlace cctools/configure.ac \
-      ++ stdenv.lib.optional (stdenv.targetPlatform != stdenv.hostPlatform) "target";
+      --replace "-isystem /usr/local/include -isystem /usr/pkg/include" "" \
-    configureFlags = [ "--disable-clang-as" ]
+      --replace "-L/usr/local/lib" "" \
-      ++ stdenv.lib.optionals enableTapiSupport [
-        "--enable-tapi-support"
-        "--with-libtapi=${libtapi}"
-      ];
 
-    postPatch = stdenv.lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace cctools/include/Makefile \
-      substituteInPlace cctools/Makefile.am --replace libobjc2 ""
+      --replace "/bin/" ""
-    '' + ''
-      sed -i -e 's/addStandardLibraryDirectories = true/addStandardLibraryDirectories = false/' cctools/ld64/src/ld/Options.cpp
 
-      # FIXME: there are far more absolute path references that I don't want to fix right now
+    patchShebangs tools
-      substituteInPlace cctools/configure.ac \
+    sed -i -e 's/which/type -P/' tools/*.sh
-        --replace "-isystem /usr/local/include -isystem /usr/pkg/include" "" \
-        --replace "-L/usr/local/lib" "" \
 
-      substituteInPlace cctools/include/Makefile \
+    # Workaround for https://www.sourceware.org/bugzilla/show_bug.cgi?id=11157
-        --replace "/bin/" ""
+    cat > cctools/include/unistd.h <<EOF
+    #ifdef __block
+    #  undef __block
+    #  include_next "unistd.h"
+    #  define __block __attribute__((__blocks__(byref)))
+    #else
+    #  include_next "unistd.h"
+    #endif
+    EOF
 
-      patchShebangs tools
+    cd cctools
-      sed -i -e 's/which/type -P/' tools/*.sh
+  '';
 
-      # Workaround for https://www.sourceware.org/bugzilla/show_bug.cgi?id=11157
+  preInstall = ''
-      cat > cctools/include/unistd.h <<EOF
+    pushd include
-      #ifdef __block
+    make DSTROOT=$out/include RC_OS=common install
-      #  undef __block
+    popd
-      #  include_next "unistd.h"
-      #  define __block __attribute__((__blocks__(byref)))
-      #else
-      #  include_next "unistd.h"
-      #endif
-      EOF
 
-      cd cctools
+    installManPage ar/ar.{1,5}
-    '';
+  '';
 
-    preInstall = ''
+  passthru = {
-      pushd include
+    inherit targetPrefix;
-      make DSTROOT=$out/include RC_OS=common install
-      popd
-
-      installManPage ar/ar.{1,5}
-    '';
-
-    passthru = {
-      inherit targetPrefix;
-    };
-
-    meta = {
-      broken = !stdenv.targetPlatform.isDarwin; # Only supports darwin targets
-      homepage = "http://www.opensource.apple.com/source/cctools/";
-      description = "MacOS Compiler Tools (cross-platform port)";
-      license = stdenv.lib.licenses.apsl20;
-      maintainers = with stdenv.lib.maintainers; [ matthewbauer ];
-    };
   };
-in stdenv.mkDerivation baseParams
+
+  meta = {
+    broken = !stdenv.targetPlatform.isDarwin; # Only supports darwin targets
+    homepage = "http://www.opensource.apple.com/source/cctools/";
+    description = "MacOS Compiler Tools (cross-platform port)";
+    license = stdenv.lib.licenses.apsl20;
+    maintainers = with stdenv.lib.maintainers; [ matthewbauer ];
+  };
+}

pkgs/os-specific/darwin/libtapi/default.nix

@@ -1,30 +1,44 @@
-{ lib, stdenv, fetchFromGitHub, cmake, python3, clang_6 }:
+{ lib, stdenv, fetchFromGitHub, cmake, python3, ncurses }:
 
 stdenv.mkDerivation {
   name = "libtapi-1000.10.8";
   src = fetchFromGitHub {
     owner = "tpoechtrager";
     repo = "apple-libtapi";
-    rev = "cd9885b97fdff92cc41e886bba4a404c42fdf71b";
+    rev = "3cb307764cc5f1856c8a23bbdf3eb49dfc6bea48";
-    sha256 = "1a19h39a48agvnmal99n9j1fjadiqwib7hfzmn342wmgh9z3vk0g";
+    sha256 = "1zb10p6xkls8x7wsdwgy9c0v16z97rfkgidii9ffq5rfczgvrhjh";
   };
 
-  nativeBuildInputs = [ cmake python3 ];
+  sourceRoot = "source/src/llvm";
-  buildInputs = [ clang_6.cc ];
 
-  preConfigure = ''
+  nativeBuildInputs = [ cmake python3 ];
-    cd src/llvm
+
-  '';
+  # ncurses is required here to avoid a reference to bootstrap-tools, which is
+  # not allowed for the stdenv.
+  buildInputs = [ ncurses ];
 
   cmakeFlags = [ "-DLLVM_INCLUDE_TESTS=OFF" ];
 
-  buildFlags = [ "libtapi" ];
+  # fixes: fatal error: 'clang/Basic/Diagnostic.h' file not found
+  # adapted from upstream
+  # https://github.com/tpoechtrager/apple-libtapi/blob/3cb307764cc5f1856c8a23bbdf3eb49dfc6bea48/build.sh#L58-L60
+  preConfigure = ''
+    INCLUDE_FIX="-I $PWD/projects/clang/include"
+    INCLUDE_FIX+=" -I $PWD/build/projects/clang/include"
 
-  installTarget = "install-libtapi";
+    cmakeFlagsArray+=(-DCMAKE_CXX_FLAGS="$INCLUDE_FIX")
+  '';
+
+  buildFlags = [ "clangBasic" "libtapi" ];
+
+  installTargets = [ "install-libtapi" "install-tapi-headers" ];
+
+  postInstall = ''
+    install_name_tool -id $out/lib/libtapi.dylib $out/lib/libtapi.dylib
+  '';
 
   meta = with lib; {
     license = licenses.apsl20;
     maintainers = with maintainers; [ matthewbauer ];
   };
-
 }

pkgs/os-specific/darwin/xcode/default.nix

@@ -53,5 +53,6 @@ in lib.makeExtensible (self: {
   xcode_10_2_1 = requireXcode "10.2.1" "11sdb54nr0x7kp987qq839x6k5gdx7vqdxjiy5xm5279n1n47bmg";
   xcode_10_3 = requireXcode "10.3" "1i628vfn6zad81fsz3zpc6z15chhskvyp8qnajp2wnpzvrwl6ngb";
   xcode_11 = requireXcode "11" "1r03j3kkp4blfp2kqpn538w3dx57ms930fj8apjkq6dk7fv3jcqh";
-  xcode = self."xcode_${lib.replaceStrings ["."] ["_"] (if stdenv.targetPlatform.useiOSPrebuilt then stdenv.targetPlatform.xcodeVer else "10.3")}";
+  xcode_11_3_1 = requireXcode "11.3.1" "1p6nicj91kr6ad3rmycahd1i7z4hj7ccjs93ixsiximjzaahx3q4";
+  xcode = self."xcode_${lib.replaceStrings ["."] ["_"] (if (stdenv.targetPlatform ? xcodeVer) then stdenv.targetPlatform.xcodeVer else "11.3.1")}";
 })

pkgs/os-specific/darwin/xcode/sdk-pkgs.nix

@@ -12,7 +12,7 @@
 
 let
 
-minSdkVersion = "9.0";
+minSdkVersion = targetPlatform.minSdkVersion or "9.0";
 
 iosPlatformArch = { parsed, ... }: {
   armv7a  = "armv7";
@@ -37,6 +37,10 @@ rec {
     bintools = binutils-unwrapped;
     extraBuildCommands = ''
       echo "-arch ${iosPlatformArch targetPlatform}" >> $out/nix-support/libc-ldflags
+    '' + stdenv.lib.optionalString (sdk.platform == "iPhoneSimulator") ''
+      echo "-platform_version ios-sim ${minSdkVersion} ${sdk.version}" >> $out/nix-support/libc-ldflags
+    '' + stdenv.lib.optionalString (sdk.platform == "iPhoneOS") ''
+      echo "-platform_version ios ${minSdkVersion} ${sdk.version}" >> $out/nix-support/libc-ldflags
     '';
   };
 

pkgs/os-specific/linux/conntrack-tools/default.nix

@@ -1,6 +1,8 @@
 { fetchurl, stdenv, flex, bison, pkgconfig, libmnl, libnfnetlink
 , libnetfilter_conntrack, libnetfilter_queue, libnetfilter_cttimeout
-, libnetfilter_cthelper, systemd }:
+, libnetfilter_cthelper, systemd
+, libtirpc
+}:
 
 stdenv.mkDerivation rec {
   pname = "conntrack-tools";
@@ -13,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libmnl libnfnetlink libnetfilter_conntrack libnetfilter_queue
-    libnetfilter_cttimeout libnetfilter_cthelper systemd
+    libnetfilter_cttimeout libnetfilter_cthelper systemd libtirpc
   ];
   nativeBuildInputs = [ flex bison pkgconfig ];
 

pkgs/os-specific/linux/cryptsetup/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cryptsetup";
-  version = "2.3.3";
+  version = "2.3.4";
 
   outputs = [ "out" "dev" "man" ];
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/cryptsetup/v2.3/${pname}-${version}.tar.xz";
-    sha256 = "1pw2bq4nv2z3xyycckxkbp7dp9kkp2n6bspna3plryg277z4zjiv";
+    sha256 = "0wrpz2fzbsszmsgxxbssxjgylpyiindh24z8g13m2fxmjsxyw5lx";
   };
 
   # Disable 4 test cases that fail in a sandbox

pkgs/os-specific/linux/keyutils/default.nix

@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "keyutils";
-  version = "1.6.1";
+  version = "1.6.3";
 
   src = fetchurl {
     url = "https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/keyutils.git/snapshot/${pname}-${version}.tar.gz";
-    sha256 = "0mzmw8c7gqmqaxm3sa0xki8ycjla47xxhqg0yh17pl00d7ydqw9w";
+    sha256 = "sha256-ph1XBhNq5MBb1I+GGGvP29iN2L1RB+Phlckkz8Gzm7Q=";
   };
 
   patches = [
@@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
   BUILDDATE = "1970-01-01";
   outputs = [ "out" "lib" "dev" ];
 
+  enableParallelBuilding = true;
+
   installFlags = [
     "ETCDIR=$(out)/etc"
     "BINDIR=$(out)/bin"

pkgs/os-specific/linux/nfs-utils/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, fetchpatch, lib, pkgconfig, utillinux, libcap, libtirpc, libevent
 , sqlite, kerberos, kmod, libuuid, keyutils, lvm2, systemd, coreutils, tcp_wrappers
-, python3, buildPackages, nixosTests
+, python3, buildPackages, nixosTests, rpcsvc-proto
 , enablePython ? true
 }:
 
@@ -10,18 +10,18 @@ in
 
 stdenv.mkDerivation rec {
   pname = "nfs-utils";
-  version = "2.4.1";
+  version = "2.5.1";
 
   src = fetchurl {
     url = "https://kernel.org/pub/linux/utils/nfs-utils/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0dkp11a7i01c378ri68bf6k56z27kz8zzvpqm7mip6s7jkd4l9w5";
+    sha256 = "1i1h3n2m35q9ixs1i2qf1rpjp10cipa3c25zdf1xj1vaw5q8270g";
   };
 
   # libnfsidmap is built together with nfs-utils from the same source,
   # put it in the "lib" output, and the headers in "dev"
   outputs = [ "out" "dev" "lib" "man" ];
 
-  nativeBuildInputs = [ pkgconfig buildPackages.stdenv.cc ];
+  nativeBuildInputs = [ pkgconfig buildPackages.stdenv.cc rpcsvc-proto ];
 
   buildInputs = [
     libtirpc libcap libevent sqlite lvm2
@@ -45,8 +45,8 @@ stdenv.mkDerivation rec {
       "--with-systemd=${placeholder "out"}/etc/systemd/system"
       "--enable-libmount-mount"
       "--with-pluginpath=${placeholder "lib"}/lib/libnfsidmap" # this installs libnfsidmap
-    ]
+      "--with-rpcgen=${rpcsvc-proto}/bin/rpcgen"
-    ++ lib.optional (stdenv ? glibc) "--with-rpcgen=${stdenv.glibc.bin}/bin/rpcgen";
+    ];
 
   patches = lib.optionals stdenv.hostPlatform.isMusl [
     (fetchpatch {