clickhouse: 23.3.3.52 -> 23.3.5.9

pkgs/servers/clickhouse/default.nix

@@ -1,6 +1,7 @@
 { lib
 , llvmPackages
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , ninja
 , python3
@@ -27,7 +28,7 @@ let
     else llvmPackages.stdenv).mkDerivation;
 in mkDerivation rec {
   pname = "clickhouse";
-  version = "23.3.3.52";
+  version = "23.3.5.9";
 
   src = fetchFromGitHub rec {
     owner = "ClickHouse";
@@ -35,9 +36,7 @@ in mkDerivation rec {
     rev = "v${version}-lts";
     fetchSubmodules = true;
     name = "clickhouse-${rev}.tar.gz";
-    hash = if stdenv.isDarwin
-           then "sha256-VaUGbUyDilYPK4iBv/nICOsfeolNQeBSEtC71gBTkpE="
-           else "sha256-NH+OW6zr8XBmJr68fX1WIy8Wt7cLWFMskIv7Be0TLEU=";
+    hash = "sha256-soF0L69oi95r0zgzPL0DfDhhXfRKekN5u/4+/mt8QwM=";
     postFetch = ''
       # delete files that make the source too big
       rm -rf $out/contrib/llvm-project/llvm/test
@@ -53,7 +52,7 @@ in mkDerivation rec {
       tar -I 'gzip -n' \
         --sort=name \
         --mtime=1970-01-01 \
-        --owner=root --group=root \
+        --owner=0 --group=0 \
         --numeric-owner --mode=go=rX,u+rw,a-s \
         --transform='s@^@source/@S' \
         -cf temp  -C "$out" .
@@ -157,9 +156,11 @@ in mkDerivation rec {
     "-DENABLE_TESTS=OFF"
     "-DCOMPILER_CACHE=disabled"
     "-DENABLE_EMBEDDED_COMPILER=ON"
-    "-DWERROR=OFF"
   ];
 
+  # https://github.com/ClickHouse/ClickHouse/issues/49988
+  hardeningDisable = [ "fortify" ];
+
   postInstall = ''
     rm -rf $out/share/clickhouse-test