Merge pull request #168737 from NixOS/staging-next

doc/languages-frameworks/gnome.section.md

@@ -42,7 +42,21 @@ Unlike other libraries mentioned in this section, GdkPixbuf only supports a sing
 
 ### Icons {#ssec-gnome-icons}
 
-When an application uses icons, an icon theme should be available in `XDG_DATA_DIRS` during runtime. The package for the default, icon-less [hicolor-icon-theme](https://www.freedesktop.org/wiki/Software/icon-theme/) (should be propagated by every icon theme) contains [a setup hook](#ssec-gnome-hooks-hicolor-icon-theme) that will pick up icon themes from `buildInputs` and pass it to our wrapper. Unfortunately, relying on that would mean every user has to download the theme included in the package expression no matter their preference. For that reason, we leave the installation of icon theme on the user. If you use one of the desktop environments, you probably already have an icon theme installed.
+When an application uses icons, an icon theme should be available in `XDG_DATA_DIRS` during runtime. The package for the default, icon-less [hicolor-icon-theme](https://www.freedesktop.org/wiki/Software/icon-theme/) (should be propagated by every icon theme) contains [a setup hook](#ssec-gnome-hooks-hicolor-icon-theme) that will pick up icon themes from `buildInputs` and add their datadirs to `XDG_ICON_DIRS` environment variable (this is Nixpkgs specific, not actually a XDG standard variable). Unfortunately, relying on that would mean every user has to download the theme included in the package expression no matter their preference. For that reason, we leave the installation of icon theme on the user. If you use one of the desktop environments, you probably already have an icon theme installed.
+
+In the rare case you need to use icons from dependencies (e.g. when an app forces an icon theme), you can use the following to pick them up:
+
+```nix
+  buildInputs = [
+    pantheon.elementary-icon-theme
+  ];
+  preFixup = ''
+    gappsWrapperArgs+=(
+      # The icon theme is hardcoded.
+      --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS"
+    )
+  '';
+```
 
 To avoid costly file system access when locating icons, GTK, [as well as Qt](https://woboq.com/blog/qicon-reads-gtk-icon-cache-in-qt57.html), can rely on `icon-theme.cache` files from the themes' top-level directories. These files are generated using `gtk-update-icon-cache`, which is expected to be run whenever an icon is added or removed to an icon theme (typically an application icon into `hicolor` theme) and some programs do indeed run this after icon installation. However, since packages are installed into their own prefix by Nix, this would lead to conflicts. For that reason, `gtk3` provides a [setup hook](#ssec-gnome-hooks-gtk-drop-icon-theme-cache) that will clean the file from installation. Since most applications only ship their own icon that will be loaded on start-up, it should not affect them too much. On the other hand, icon themes are much larger and more widely used so we need to cache them. Because we recommend installing icon themes globally, we will generate the cache files from all packages in a profile using a NixOS module. You can enable the cache generation using `gtk.iconCache.enable` option if your desktop environment does not already do that.
 
@@ -98,7 +112,7 @@ For convenience, it also adds `dconf.lib` for a GIO module implementing a GSetti
 
 - []{#ssec-gnome-hooks-dconf} `dconf.lib` is a dependency of `wrapGAppsHook`, which then also adds it to the `GIO_EXTRA_MODULES` variable.
 
-- []{#ssec-gnome-hooks-hicolor-icon-theme} `hicolor-icon-theme`’s setup hook will add icon themes to `XDG_ICON_DIRS` which is prepended to `XDG_DATA_DIRS` by `wrapGAppsHook`.
+- []{#ssec-gnome-hooks-hicolor-icon-theme} `hicolor-icon-theme`’s setup hook will add icon themes to `XDG_ICON_DIRS`.
 
 - []{#ssec-gnome-hooks-gobject-introspection} `gobject-introspection` setup hook populates `GI_TYPELIB_PATH` variable with `lib/girepository-1.0` directories of dependencies, which is then added to wrapper by `wrapGAppsHook`. It also adds `share` directories of dependencies to `XDG_DATA_DIRS`, which is intended to promote GIR files but it also [pollutes the closures](https://github.com/NixOS/nixpkgs/issues/32790) of packages using `wrapGAppsHook`.
 

nixos/doc/manual/from_md/release-notes/rl-2205.section.xml

@@ -517,6 +517,15 @@
           the FIDO security key middleware interface.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>git</literal> no longer hardcodes the path to
+          openssh’ ssh binary to reduce the amount of rebuilds. If you
+          are using git with ssh remotes and do not have a ssh binary in
+          your enviroment consider adding <literal>openssh</literal> to
+          it or switching to <literal>gitFull</literal>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <literal>services.k3s.enable</literal> no longer implies
@@ -2130,6 +2139,16 @@
           (<link xlink:href="https://github.com/NixOS/nixpkgs/pull/158992">#158992</link>).
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>nss</literal> package was split into
+          <literal>nss_esr</literal> and <literal>nss_latest</literal>,
+          with <literal>nss</literal> being an alias for
+          <literal>nss_esr</literal>. This was done to ease maintenance
+          of <literal>nss</literal> and dependent high-profile packages
+          like <literal>firefox</literal>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The <literal>spark3</literal> package has been updated from

nixos/doc/manual/release-notes/rl-2205.section.md

@@ -164,6 +164,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `openssh` has been update to 8.9p1, changing the FIDO security key middleware interface.
 
+- `git` no longer hardcodes the path to openssh' ssh binary to reduce the amount of rebuilds. If you are using git with ssh remotes and do not have a ssh binary in your enviroment consider adding `openssh` to it or switching to `gitFull`.
+
 - `services.k3s.enable` no longer implies `systemd.enableUnifiedCgroupHierarchy = false`, and will default to the 'systemd' cgroup driver when using `services.k3s.docker = true`.
   This change may require a reboot to take effect, and k3s may not be able to run if the boot cgroup hierarchy does not match its configuration.
   The previous behavior may be retained by explicitly setting `systemd.enableUnifiedCgroupHierarchy = false` in your configuration.
@@ -748,6 +750,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The `R` package now builds again on `aarch64-darwin` ([#158992](https://github.com/NixOS/nixpkgs/pull/158992)).
 
+- The `nss` package was split into `nss_esr` and `nss_latest`, with `nss` being an alias for `nss_esr`. This was done to ease maintenance of `nss` and dependent high-profile packages like `firefox`.
+
 - The `spark3` package has been updated from 3.1.2 to 3.2.1 ([#160075](https://github.com/NixOS/nixpkgs/pull/160075)):
 
   - Testing has been enabled for `aarch64-linux` in addition to `x86_64-linux`.

nixos/modules/misc/locate.nix

@@ -27,7 +27,7 @@ in
 
     locate = mkOption {
       type = package;
-      default = pkgs.findutils;
+      default = pkgs.findutils.locate;
       defaultText = literalExpression "pkgs.findutils";
       example = literalExpression "pkgs.mlocate";
       description = ''

nixos/modules/services/misc/etebase-server.nix

@@ -166,7 +166,7 @@ in
       } ''
         makeWrapper ${pythonEnv}/bin/etebase-server \
           $out/bin/etebase-server \
-          --run "cd ${cfg.dataDir}" \
+          --chdir ${escapeShellArg cfg.dataDir} \
           --prefix ETEBASE_EASY_CONFIG_PATH : "${configIni}"
       '')
     ];

nixos/modules/services/misc/gitlab.nix

@@ -179,7 +179,7 @@ let
           ${concatStrings (mapAttrsToList (name: value: "--set ${name} '${value}' ") gitlabEnv)} \
           --set PATH '${lib.makeBinPath [ pkgs.nodejs pkgs.gzip pkgs.git pkgs.gnutar postgresqlPackage pkgs.coreutils pkgs.procps ]}:$PATH' \
           --set RAKEOPT '-f ${cfg.packages.gitlab}/share/gitlab/Rakefile' \
-          --run 'cd ${cfg.packages.gitlab}/share/gitlab'
+          --chdir '${cfg.packages.gitlab}/share/gitlab'
      '';
   };
 
@@ -193,7 +193,7 @@ let
       makeWrapper ${cfg.packages.gitlab.rubyEnv}/bin/rails $out/bin/gitlab-rails \
           ${concatStrings (mapAttrsToList (name: value: "--set ${name} '${value}' ") gitlabEnv)} \
           --set PATH '${lib.makeBinPath [ pkgs.nodejs pkgs.gzip pkgs.git pkgs.gnutar postgresqlPackage pkgs.coreutils pkgs.procps ]}:$PATH' \
-          --run 'cd ${cfg.packages.gitlab}/share/gitlab'
+          --chdir '${cfg.packages.gitlab}/share/gitlab'
      '';
   };
 

pkgs/applications/audio/hivelytracker/default.nix

@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
     # files passed as arguments anyway, so this works well enough until the
     # issue is fixed.
     wrapProgram $out/bin/hivelytracker \
-      --run "cd $out/share/hivelytracker"
+      --chdir "$out/share/hivelytracker"
 
     # Also install the hvl2wav tool
     install -Dm755 hvl2wav/hvl2wav $out/bin/hvl2wav

pkgs/applications/audio/hqplayer-desktop/default.nix

@@ -86,6 +86,7 @@ mkDerivation rec {
     homepage = "https://www.signalyst.com/custom.html";
     description = "High-end upsampling multichannel software HD-audio player";
     license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ lovesegfault ];
   };
 }

pkgs/applications/audio/libopenmpt/default.nix

@@ -1,42 +0,0 @@
-{ config, lib, stdenv, fetchurl, fetchpatch, zlib, pkg-config, mpg123, libogg, libvorbis, portaudio, libsndfile, flac
-, usePulseAudio ? config.pulseaudio or stdenv.isLinux, libpulseaudio }:
-
-stdenv.mkDerivation rec {
-  pname = "libopenmpt";
-  version = "0.5.11";
-
-  outputs = [ "out" "lib" "dev" ];
-
-  src = fetchurl {
-    url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "1c54lldr2imjzhlhq5lvwhj7d5794xm97cby9pznr5wdjjay0sa4";
-  };
-
-  patches = [
-    # Fix pending upstream inclusion for gcc-12 include headers:
-    #  https://github.com/OpenMPT/openmpt/pull/8
-    (fetchpatch {
-      name = "gcc-12.patch";
-      url = "https://github.com/OpenMPT/openmpt/commit/6e7a43190ef2f9ba0b3efc19b9527261b69ec8f7.patch";
-      sha256 = "081m1rf09bbrlg52aihaajmld5dcnwbp6y7zpyik92mm332r330h";
-    })
-  ];
-
-  enableParallelBuilding = true;
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ zlib mpg123 libogg libvorbis portaudio libsndfile flac ]
-  ++ lib.optional usePulseAudio libpulseaudio;
-
-  configureFlags = lib.optional (!usePulseAudio) "--without-pulseaudio";
-
-  doCheck = true;
-
-  meta = with lib; {
-    description = "A cross-platform command-line based module file player";
-    homepage = "https://lib.openmpt.org/libopenmpt/";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ OPNA2608 ];
-    platforms = platforms.unix;
-  };
-}

pkgs/applications/audio/losslessaudiochecker/default.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation {
     description = "Utility to check whether audio is truly lossless or not";
     homepage = "https://losslessaudiochecker.com";
     license = lib.licenses.unfree;
-    platforms = lib.platforms.x86_64;
+    platforms = [ "x86_64-linux" ];
     maintainers = with lib.maintainers; [ p-h ];
   };
 }

pkgs/applications/audio/lyrebird/default.nix

@@ -42,7 +42,7 @@ python3Packages.buildPythonApplication rec {
   makeWrapperArgs = [
     "--prefix 'PATH' ':' '${lib.makeBinPath [ sox pulseaudio ]}'"
     "--prefix 'PYTHONPATH' ':' '${placeholder "out"}/share/lyrebird'"
-    "--run 'cd ${placeholder "out"}/share/lyrebird'"
+    "--chdir '${placeholder "out"}/share/lyrebird'"
     ''"''${gappsWrapperArgs[@]}"''
   ];
 

pkgs/applications/audio/puddletag/default.nix

@@ -17,6 +17,7 @@
 let
   # NOTE: check if we can drop any of these overrides when bumping the version
   overrideVersions = [
+    "lxml"
     "pyparsing"
     "pyqt5"
   ];

pkgs/applications/audio/pulseaudio-modules-bt/default.nix

@@ -1,91 +0,0 @@
-{ stdenv
-, runCommand
-, fetchFromGitHub
-, pulseaudio
-, pkg-config
-, ffmpeg
-, patchelf
-, fdk_aac
-, libtool
-, ldacbt
-, cmake
-, bluez
-, dbus
-, sbc
-, lib
-}:
-
-let
-  pulseSources = runCommand "pulseaudio-sources" {} ''
-    mkdir $out
-    if [ -d ${pulseaudio.src} ]; then
-      ln -s ${pulseaudio.src}/* $out/
-    else
-      tar -xf ${pulseaudio.src}
-      mv pulseaudio*/* $out/
-    fi
-  '';
-
-in stdenv.mkDerivation rec {
-  pname = "pulseaudio-modules-bt";
-  version = "1.4";
-
-  src = fetchFromGitHub {
-    owner = "EHfive";
-    repo = "pulseaudio-modules-bt";
-    rev = "v${version}";
-    sha256 = "0bzg6x405j39axnkvc6n6vkl1hv1frk94y1i9sl170081bk23asd";
-  };
-
-  patches = [
-    ./fix-install-path.patch
-  ];
-
-  nativeBuildInputs = [
-    pkg-config
-    patchelf
-    cmake
-  ];
-
-  buildInputs = [
-    pulseaudio
-    ffmpeg
-    fdk_aac
-    libtool
-    ldacbt
-    bluez
-    dbus
-    sbc
-  ];
-
-  postPatch = ''
-    # Upstream bundles pulseaudio as a submodule
-    rm -r pa
-    ln -s ${pulseSources} pa
-
-    # Pulseaudio version is detected with a -rebootstrapped suffix which build system assumptions
-    substituteInPlace config.h.in --replace PulseAudio_VERSION ${pulseaudio.version}
-    substituteInPlace CMakeLists.txt --replace '${"\${PULSE_DIR}"}' ${pulseaudio.pulseDir}
-
-    # Fraunhofer recommends to enable afterburner but upstream has it set to false by default
-    substituteInPlace src/modules/bluetooth/a2dp/a2dp_aac.c \
-      --replace "info->aac_afterburner = false;" "info->aac_afterburner = true;"
-  '';
-
-  postFixup = ''
-    for so in $out/lib/pulse-${pulseaudio.version}/modules/*.so; do
-      orig_rpath=$(patchelf --print-rpath "$so")
-      patchelf \
-        --set-rpath "${ldacbt}/lib:${lib.getLib ffmpeg}/lib:$out/${pulseaudio.pulseDir}/modules:$orig_rpath" \
-        "$so"
-    done
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/EHfive/pulseaudio-modules-bt";
-    description = "LDAC, aptX, aptX HD, AAC codecs (A2DP Audio) support for Linux PulseAudio";
-    platforms = platforms.linux;
-    license = licenses.mit;
-    maintainers = with maintainers; [ adisbladis ];
-  };
-}

pkgs/applications/audio/pulseaudio-modules-bt/fix-install-path.patch

@@ -1,11 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 8d20dbf..63fe7ba 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -213,5 +213,4 @@ INSTALL(TARGETS
-         module-bluez5-device
-         module-bluetooth-discover
-         module-bluetooth-policy
--        LIBRARY DESTINATION ${PulseAudio_modlibexecdir})
--
-+        LIBRARY DESTINATION ${CMAKE_INSTALL_PREFIX}/${PULSE_DIR}/modules/)

pkgs/applications/audio/soundwireserver/default.nix

@@ -34,6 +34,7 @@ qt5.mkDerivation {
     description = "Turn your Android device into wireless headphones / wireless speaker";
     homepage = "https://georgielabs.net/";
     maintainers = with maintainers; [ mkg20001 ];
+    platforms = [ "x86_64-linux" ];
     license = licenses.unfree;
   };
 }

pkgs/applications/blockchains/wasabibackend/default.nix

@@ -32,7 +32,7 @@ buildDotnetModule rec {
 
   preConfigure = ''
     makeWrapperArgs+=(
-      --run "cd $out/lib/${pname}"
+      --chdir "$out/lib/${pname}"
     )
   '';
 

pkgs/applications/editors/pinegrow/default.nix

@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://pinegrow.com";
     description = "UI Web Editor";
-    platforms = platforms.linux;
+    platforms = [ "x86_64-linux" ];
     license = with licenses; [ unfreeRedistributable ];
     maintainers = with maintainers; [ gador ];
   };

pkgs/applications/editors/vim/common.nix

@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.4350";
+  version = "8.2.4609";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "sha256-+fCyLZi9+9r7tYoRQsVESkcoHHtM7vrVuOGdJi/9iF0=";
+    sha256 = "sha256-IiWZJ4zT+VbcxwKChl847pS9jU9AlxZ/yQUIL8I2MhQ=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/graphics/awesomebump/default.nix

@@ -46,7 +46,7 @@ in mkDerivation {
 
     # AwesomeBump expects to find Core and Configs in its current directory.
     makeQtWrapper $d/AwesomeBump $out/bin/AwesomeBump \
-        --run "cd $d"
+        --chdir "$d"
   '';
 
   # $ cd Sources; qmake; make ../workdir/linux-g++-dgb-gl4/obj/glwidget.o

pkgs/applications/graphics/cq-editor/default.nix

@@ -27,7 +27,7 @@ mkDerivationWith python3Packages.buildPythonApplication rec {
     pyparsing
     pyqtgraph
     spyder
-    pathpy
+    path
     qtconsole
     requests
   ];

pkgs/applications/graphics/foxotron/default.nix

@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     cp -R ${lib.optionalString stdenv.hostPlatform.isDarwin "Foxotron.app/Contents/MacOS/"}Foxotron \
       ../{config.json,Shaders,Skyboxes} $out/lib/foxotron/
     wrapProgram $out/lib/foxotron/Foxotron \
-      --run "cd $out/lib/foxotron"
+      --chdir "$out/lib/foxotron"
     ln -s $out/{lib/foxotron,bin}/Foxotron
 
     runHook postInstall

pkgs/applications/graphics/pixeluvo/default.nix

@@ -50,6 +50,7 @@ stdenv.mkDerivation rec {
     description = "A Beautifully Designed Image and Photo Editor for Windows and Linux";
     homepage = "http://www.pixeluvo.com/";
     license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ wolfangaukang ];
   };
 }

pkgs/applications/graphics/unigine-valley/default.nix

@@ -97,7 +97,7 @@ in
       mkdir -p $out/bin
       install -m 0755 valley $out/bin/valley
       wrapProgram $out/bin/valley \
-        --run "cd $instdir" \
+        --chdir "$instdir" \
         --prefix LD_LIBRARY_PATH : /run/opengl-driver/lib:$instdir/bin:$libPath
 
       runHook postInstall

pkgs/applications/misc/buku/default.nix

@@ -7,8 +7,9 @@ let
         version = "1.3.24";
         src = oldAttrs.src.override {
           inherit version;
-          sha256 = "ebbb777cbf9312359b897bf81ba00dae0f5cb69fba2a18265dcc18a6f5ef7519";
+          hash = "sha256-67t3fL+TEjWbiXv4G6ANrg9ctp+6KhgmXcwYpvXvdRk=";
         };
+        doCheck = false;
       });
       sqlalchemy-utils = super.sqlalchemy-utils.overridePythonAttrs (oldAttrs: rec {
         version = "0.36.6";

pkgs/applications/misc/foxitreader/default.nix

@@ -74,6 +74,7 @@ mkDerivation rec {
     description = "A viewer for PDF documents";
     homepage = "https://www.foxitsoftware.com/";
     license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ p-h rhoriguchi ];
   };
 }

pkgs/applications/misc/multibootusb/default.nix

@@ -101,7 +101,7 @@ python3Packages.buildPythonApplication rec {
       --prefix "PATH" ":" "${lib.makeBinPath runTimeDeps}"
 
       # Finally, move to directory that contains data
-      --run "cd $out/share/${pname}"
+      --chdir "$out/share/${pname}"
     )
   '';
 

pkgs/applications/misc/octoprint/default.nix

@@ -233,7 +233,7 @@ let
           self: super: {
             falcon = super.falcon.overridePythonAttrs (oldAttrs: rec {
               #pytestFlagsArray = [ "-W ignore::DeprecationWarning" ];
-              disabledTestPaths = oldAttrs.disabledTestPaths ++ [
+              disabledTestPaths = oldAttrs.disabledTestPaths or [] ++ [
                 "tests/asgi/test_asgi_servers.py"
               ];
             });
@@ -244,7 +244,7 @@ let
         (
           self: super: {
             sanic = super.sanic.overridePythonAttrs (oldAttrs: rec {
-              disabledTestPaths = oldAttrs.disabledTestPaths ++ [
+              disabledTestPaths = oldAttrs.disabledTestPaths or [] ++ [
                 "test_cli.py"
                 "test_cookies.py"
                 # requires network

pkgs/applications/misc/tvbrowser/bin.nix

@@ -41,7 +41,7 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/bin
     makeWrapper ${jre}/bin/java $out/bin/${pname} \
       --add-flags "-jar $out/share/java/${pname}/${pname}.jar" \
-      --run "cd $out/share/java/${pname}"
+      --chdir "$out/share/java/${pname}"
   '';
 
   meta = with lib; {

pkgs/applications/misc/upwork/default.nix

@@ -62,6 +62,7 @@ stdenv.mkDerivation rec {
     description = "Online freelancing platform desktop application for time tracking";
     homepage = "https://www.upwork.com/ab/downloads/";
     license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ zakkor wolfangaukang ];
   };
 }

pkgs/applications/misc/xteddy/default.nix

@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   postFixup = ''
     # this is needed, because xteddy expects images to reside
     # in the current working directory
-    wrapProgram $out/bin/xteddy --run "cd $out/share/images/"
+    wrapProgram $out/bin/xteddy --chdir "$out/share/images/"
   '';
 
   meta = with lib; {

pkgs/applications/networking/browsers/firefox/common.nix

@@ -61,7 +61,8 @@
 , libwebp
 , nasm
 , nspr
-, nss
+, nss_esr
+, nss_latest
 , pango
 , xorg
 , zip
@@ -356,7 +357,6 @@ buildStdenv.mkDerivation ({
     libwebp
     nasm
     nspr
-    nss
     pango
     perl
     xorg.libX11
@@ -373,6 +373,7 @@ buildStdenv.mkDerivation ({
     zip
     zlib
   ]
+  ++ [ (if (lib.versionAtLeast version "92") then nss_latest else nss_esr) ]
   ++ lib.optional  alsaSupport alsa-lib
   ++ lib.optional  pulseaudioSupport libpulseaudio # only headers are needed
   ++ lib.optional  gssSupport libkrb5

pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix

@@ -17,7 +17,12 @@ stdenv.mkDerivation rec {
 
   src = fetchurl source;
 
-  nativeBuildInputs = [ autoPatchelfHook ] ++ (if stdenv.isDarwin then [ unzip ] else [ dpkg ]);
+  nativeBuildInputs = lib.optionals stdenv.isLinux [
+    autoPatchelfHook
+    dpkg
+  ] ++ lib.optionals stdenv.isDarwin [
+    unzip
+  ];
 
   unpackPhase = if stdenv.isDarwin then "unzip $src" else "dpkg-deb -x $src .";
 

pkgs/applications/networking/instant-messengers/ripcord/default.nix

@@ -48,7 +48,7 @@ mkDerivation rec {
     install -Dm755 ${src}/Ripcord $out/Ripcord
     patchelf --replace-needed libsodium.so.18 libsodium.so $out/Ripcord
     makeQtWrapper $out/Ripcord $out/bin/ripcord \
-      --run "cd $out" \
+      --chdir "$out" \
       --set FONTCONFIG_FILE "${fontsConf}" \
       --prefix LD_LIBRARY_PATH ":" "${xorg.libXcursor}/lib" \
       --prefix QT_XKB_CONFIG_ROOT ":" "${xorg.xkeyboardconfig}/share/X11/xkb" \

pkgs/applications/networking/instant-messengers/torchat/default.nix

@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     cp -rf * $out/lib/torchat
     makeWrapper ${python2}/bin/python $out/bin/torchat \
         --set PYTHONPATH $out/lib/torchat:$program_PYTHONPATH \
-        --run "cd $out/lib/torchat" \
+        --chdir "$out/lib/torchat" \
         --add-flags "-O $out/lib/torchat/torchat.py"
   '';
 

pkgs/applications/networking/instant-messengers/zoom-us/default.nix

@@ -104,7 +104,7 @@ stdenv.mkDerivation rec {
     # Clear Qt paths to prevent tripping over "foreign" Qt resources.
     # Clear Qt screen scaling settings to prevent over-scaling.
     makeWrapper $out/opt/zoom/ZoomLauncher $out/bin/zoom \
-      --run "cd $out/opt/zoom" \
+      --chdir "$out/opt/zoom" \
       --unset QML2_IMPORT_PATH \
       --unset QT_PLUGIN_PATH \
       --unset QT_SCREEN_SCALE_FACTORS \

pkgs/applications/networking/mailreaders/mailspring/default.nix

@@ -95,6 +95,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ toschmidt doronbehar ];
     homepage = "https://getmailspring.com";
     downloadPage = "https://github.com/Foundry376/Mailspring";
-    platforms = platforms.x86_64;
+    platforms = [ "x86_64-linux" ];
   };
 }

pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix

@@ -38,7 +38,7 @@
 , adwaita-icon-theme
 , libGLU, libGL
 , nspr
-, nss
+, nss_latest
 , pango
 , pipewire
 , pciutils
@@ -132,7 +132,7 @@ stdenv.mkDerivation {
       libnotify
       libGLU libGL
       nspr
-      nss
+      nss_latest
       pango
       pipewire
       pciutils

pkgs/applications/networking/p2p/tribler/default.nix

@@ -74,10 +74,10 @@ stdenv.mkDerivation rec {
     makeWrapper ${python3.pkgs.python}/bin/python $out/bin/tribler \
         --set QT_QPA_PLATFORM_PLUGIN_PATH ${qt5.qtbase.bin}/lib/qt-*/plugins/platforms \
         --set QT_PLUGIN_PATH "${qt5.qtsvg.bin}/${qt5.qtbase.qtPluginPrefix}" \
-        --set _TRIBLERPATH $out/src \
+        --set _TRIBLERPATH "$out/src" \
         --set PYTHONPATH $out/src/tribler-core:$out/src/tribler-common:$out/src/tribler-gui:$program_PYTHONPATH \
         --set NO_AT_BRIDGE 1 \
-        --run 'cd $_TRIBLERPATH' \
+        --chdir "$out/src" \
         --add-flags "-O $out/src/run_tribler.py"
 
     mkdir -p $out/share/applications $out/share/icons

pkgs/applications/networking/remote/rustdesk/default.nix

@@ -86,7 +86,7 @@ rustPlatform.buildRustPackage rec {
     ln -s ${libsciter}/lib/libsciter-gtk.so $out/lib/rustdesk
 
     makeWrapper $out/lib/rustdesk/rustdesk $out/bin/rustdesk \
-      --run "cd $out/share"
+      --chdir "$out/share"
 
     cp -a $src/src/ui $out/share/src
 

pkgs/applications/networking/seahub/default.nix

@@ -1,4 +1,8 @@
-{ lib, fetchFromGitHub, python3, makeWrapper }:
+{ lib
+, fetchFromGitHub
+, python3
+, makeWrapper
+}:
 let
   # Seahub 8.x.x does not support django-webpack-loader >=1.x.x
   python = python3.override {
@@ -25,9 +29,12 @@ python.pkgs.buildPythonApplication rec {
   };
 
   dontBuild = true;
+
   doCheck = false; # disabled because it requires a ccnet environment
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [
+    makeWrapper
+  ];
 
   propagatedBuildInputs = with python.pkgs; [
     django
@@ -44,7 +51,7 @@ python.pkgs.buildPythonApplication rec {
     djangorestframework
     openpyxl
     requests
-    requests_oauthlib
+    requests-oauthlib
     pyjwt
     pycryptodome
     qrcode
@@ -65,10 +72,10 @@ python.pkgs.buildPythonApplication rec {
   };
 
   meta = with lib; {
-    homepage = "https://github.com/haiwen/seahub";
     description = "The web end of seafile server";
+    homepage = "https://github.com/haiwen/seahub";
     license = licenses.asl20;
-    platforms = platforms.linux;
     maintainers = with maintainers; [ greizgh schmittlauch ];
+    platforms = platforms.linux;
   };
 }

pkgs/applications/networking/tetrd/default.nix

@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
     description = "Share your internet connection from your device to your PC and vice versa through a USB cable";
     homepage = "https://tetrd.app";
     license = licenses.unfree;
-    platforms = platforms.all;
+    platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ Madouura ];
   };
 }

pkgs/applications/office/fava/default.nix

@@ -1,14 +1,26 @@
-{ lib, python3 }:
+{ lib, python3, fetchpatch }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "fava";
-  version = "1.19";
+  version = "1.21";
+  format = "pyproject";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "def7c0210bf0ce8dfffdb46ce21b3efcf71eba5a4e903565258419e4c53c2d43";
+    sha256 = "sha256-0aFCKEjmXn6yddgNMi9t4rzqHcN7VBLoz3LEg9apmNY=";
   };
 
+  patches = [
+    (fetchpatch {
+      # Update werkzeug compatibility
+      url = "https://github.com/beancount/fava/commit/5a99417a42e1d739b1e57fae2d01ff1d146dcbc2.patch";
+      hash = "sha256-Y6IcxZAcFJEYgT8/xBIABdkP+pUdQX1EgSS5uNdSJUE=";
+      excludes = [
+        ".pre-commit-config.yaml"
+      ];
+    })
+  ];
+
   nativeBuildInputs = with python3.pkgs; [ setuptools-scm ];
 
   propagatedBuildInputs = with python3.pkgs; [

pkgs/applications/office/jameica/default.nix

@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
         lib.optionalString stdenv.isDarwin ''-Xdock:name="Jameica" -XstartOnFirstThread''
       } de.willuhn.jameica.Main" \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath buildInputs} \
-      --run "cd $out/share/java/"
+      --chdir "$out/share/java/"
   '';
 
   meta = with lib; {

pkgs/applications/science/biology/cmtk/default.nix

@@ -12,7 +12,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
+  NIX_CFLAGS_COMPILE = [
+    "-std=c++11"
+    (lib.optional stdenv.cc.isClang "-Wno-error=c++11-narrowing")
+  ];
 
   meta = with lib; {
     description = "Computational Morphometry Toolkit ";

pkgs/applications/science/logic/fast-downward/default.nix

@@ -1,20 +1,27 @@
-{ stdenv, lib, fetchhg, cmake, which, python3, osi, cplex }:
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, python3
+, osi
+, cplex
+}:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
-  version = "19.12";
   pname = "fast-downward";
+  version = "21.12.0";
 
-  src = fetchhg {
+  src = fetchFromGitHub {
-    url = "http://hg.fast-downward.org/";
+    owner = "aibasel";
-    rev = "41688a4f16b3";
+    repo = "downward";
-    sha256 = "08m4k1mkx4sz7c2ab7xh7ip6b67zxv7kl68xrvwa83xw1yigqkna";
+    rev = "release-${version}";
+    sha256 = "sha256-qc+SaUpIYm7bnOZlHH2mdvUaMBB+VRyOCQM/BOoOaPE=";
   };
 
-  nativeBuildInputs = [ cmake which ];
+  nativeBuildInputs = [ cmake python3.pkgs.wrapPython ];
-  buildInputs = [ python3 python3.pkgs.wrapPython osi ];
+  buildInputs = [ python3 osi ];
 
-  cmakeFlags =
+  cmakeFlags = lib.optional osi.withCplex [ "-DDOWNWARD_CPLEX_ROOT=${cplex}/cplex" ];
-    lib.optional osi.withCplex [ "-DDOWNWARD_CPLEX_ROOT=${cplex}/cplex" ];
 
   configurePhase = ''
     python build.py release
@@ -54,7 +61,7 @@ stdenv.mkDerivation {
     description = "A domain-independent planning system";
     homepage = "https://www.fast-downward.org/";
     license = licenses.gpl3Plus;
-    platforms = with platforms; (linux ++ darwin);
+    platforms = platforms.unix;
     maintainers = with maintainers; [ abbradar ];
   };
 }

pkgs/applications/science/logic/tlaplus/toolbox.nix

@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
       "$(find "$out/toolbox" -name jspawnhelper)"
 
     makeWrapper $out/toolbox/toolbox $out/bin/tla-toolbox \
-      --run "set -x; cd $out/toolbox" \
+      --chdir "$out/toolbox" \
       --add-flags "-data ~/.tla-toolbox" \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ gtk3 libXtst glib zlib ]}"  \
       "''${gappsWrapperArgs[@]}"

pkgs/applications/science/misc/fityk/default.nix

@@ -16,6 +16,10 @@ stdenv.mkDerivation rec {
   buildInputs = [ wxGTK30 boost lua zlib bzip2 xylib readline
     gnuplot swig3 ];
 
+  NIX_CFLAGS_COMPILE = [
+    "-std=c++11"
+  ];
+
   meta = {
     description = "Curve fitting and peak fitting software";
     license = lib.licenses.gpl2;

pkgs/applications/science/misc/netlogo/default.nix

@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
 
     # launcher with `cd` is required b/c otherwise the model library isn't usable
     makeWrapper "${jre}/bin/java" "$out/bin/netlogo" \
-      --run "cd $out/share/netlogo/app" \
+      --chdir "$out/share/netlogo/app" \
       --add-flags "-jar netlogo-${version}.jar"
 
     cp $src1 $out/share/icons/hicolor/256x256/apps/netlogo.png

pkgs/applications/science/robotics/sumorobot-manager/default.nix

@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     mkdir $out/bin
     dos2unix $out/opt/sumorobot-manager/main.py
     makeQtWrapper $out/opt/sumorobot-manager/main.py $out/bin/sumorobot-manager \
-      --run "cd $out/opt/sumorobot-manager"
+      --chdir "$out/opt/sumorobot-manager"
   '';
 
   preFixup = ''

pkgs/applications/terminal-emulators/syncterm/default.nix

@@ -34,6 +34,8 @@ stdenv.mkDerivation rec {
     homepage = "https://syncterm.bbsdev.net/";
     description = "BBS terminal emulator";
     maintainers = with maintainers; [ embr ];
+    platforms = platforms.unix;
     license = licenses.gpl2Plus;
+    broken = stdenv.isDarwin; # error: unsupported option '-fsanitize=safe-stack' for target 'x86_64-apple-darwin'
   };
 }

pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -18,6 +18,7 @@
 , withLibsecret ? false
 , pkg-config, glib, libsecret
 , gzip # needed at runtime by gitweb.cgi
+, withSsh ? false
 }:
 
 assert osxkeychainSupport -> stdenv.isDarwin;
@@ -25,9 +26,8 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.35.1";
+  version = "2.35.3";
   svn = subversionClient.override { perlBindings = perlSupport; };
-
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
 
@@ -39,37 +39,37 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "100h37cpw49pmlpf6lcpm1xi578gllf6y9in60h5mxj3cj754s6p";
+    sha256 = "sha256-FenbT5vy7Z//MMtioAxcfAkBAV9asEjNtOiwTd7gD6I=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
+  separateDebugInfo = true;
 
   hardeningDisable = [ "format" ];
 
   enableParallelBuilding = true;
 
-  ## Patch
-
   patches = [
     ./docbook2texi.patch
     ./git-sh-i18n.patch
-    ./ssh-path.patch
     ./git-send-email-honor-PATH.patch
     ./installCheck-path.patch
+  ] ++ lib.optionals withSsh [
+    ./ssh-path.patch
   ];
 
   postPatch = ''
-    for x in connect.c git-gui/lib/remote_add.tcl ; do
-      substituteInPlace "$x" \
-        --subst-var-by ssh "${openssh}/bin/ssh"
-    done
-
     # Fix references to gettext introduced by ./git-sh-i18n.patch
     substituteInPlace git-sh-i18n.sh \
         --subst-var-by gettext ${gettext}
 
     # ensure we are using the correct shell when executing the test scripts
     patchShebangs t/*.sh
+  '' + lib.optionalString withSsh ''
+    for x in connect.c git-gui/lib/remote_add.tcl ; do
+      substituteInPlace "$x" \
+        --subst-var-by ssh "${openssh}/bin/ssh"
+    done
   '';
 
   nativeBuildInputs = [ gettext perlPackages.perl makeWrapper ]

pkgs/applications/video/epgstation/default.nix

@@ -115,7 +115,7 @@ let
       ln -sfT /var/lib/epgstation/thumbnail thumbnail
 
       makeWrapper ${nodejs}/bin/npm $out/bin/epgstation \
-       --run "cd $out/lib/node_modules/epgstation" \
+       --chdir "$out/lib/node_modules/epgstation" \
        --prefix PATH : ${lib.makeBinPath runtimeDeps} \
        --set APP_ROOT_PATH "$out/lib/node_modules/epgstation"
 

pkgs/applications/video/mirakurun/default.nix

@@ -61,7 +61,7 @@ stdenvNoCC.mkDerivation rec {
       mkdir -p $out/bin
 
       makeWrapper ${mirakurun}/bin/mirakurun-epgdump $out/bin/mirakurun-epgdump \
-        --run "cd ${mirakurun}/libexec/mirakurun/node_modules/mirakurun" \
+        --chdir "${mirakurun}/libexec/mirakurun/node_modules/mirakurun" \
         --prefix PATH : ${lib.makeBinPath runtimeDeps}
 
       # XXX: The original mirakurun command uses PM2 to manage the Mirakurun
@@ -70,7 +70,7 @@ stdenvNoCC.mkDerivation rec {
       # unique to PM2 is currently being used.
       makeWrapper ${yarn}/bin/yarn $out/bin/mirakurun-start \
         --add-flags "start" \
-        --run "cd ${mirakurun}/libexec/mirakurun/node_modules/mirakurun" \
+        --chdir "${mirakurun}/libexec/mirakurun/node_modules/mirakurun" \
         --prefix PATH : ${lib.makeBinPath runtimeDeps}
     '';
 

pkgs/applications/window-managers/afterstep/default.nix

@@ -45,7 +45,19 @@ stdenv.mkDerivation rec {
 
   # A strange type of bug: dbus is not immediately found by pkg-config
   preConfigure = ''
-     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE $(pkg-config dbus-1 --cflags)"
+    # binutils 2.37 fix
+    # https://github.com/afterstep/afterstep/issues/2
+    fixupList=(
+      "autoconf/Makefile.defines.in"
+      "libAfterImage/aftershow/Makefile.in"
+      "libAfterImage/apps/Makefile.in"
+      "libAfterBase/Makefile.in"
+      "libAfterImage/Makefile.in"
+    )
+    for toFix in "''${fixupList[@]}"; do
+      substituteInPlace "$toFix" --replace "clq" "cq"
+    done
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE $(pkg-config dbus-1 --cflags)"
   '';
 
   # Parallel build fails due to missing dependencies between private libaries:

pkgs/build-support/setup-hooks/make-wrapper.sh

@@ -18,6 +18,7 @@ assertExecutable() {
 # --set-default VAR VAL : like --set, but only adds VAR if not already set in
 #                         the environment
 # --unset       VAR     : remove VAR from the environment
+# --chdir       DIR     : change working directory (use instead of --run "cd DIR")
 # --run         COMMAND : run command before the executable
 # --add-flags   FLAGS   : add FLAGS to invocation of executable
 
@@ -126,6 +127,10 @@ makeWrapper() {
             varName="${params[$((n + 1))]}"
             n=$((n + 1))
             echo "unset $varName" >> "$wrapper"
+        elif [[ "$p" == "--chdir" ]]; then
+            dir="${params[$((n + 1))]}"
+            n=$((n + 1))
+            echo "cd ${dir@Q}" >> "$wrapper"
         elif [[ "$p" == "--run" ]]; then
             command="${params[$((n + 1))]}"
             n=$((n + 1))

pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh

@@ -14,10 +14,6 @@ gappsWrapperArgsHook() {
         gappsWrapperArgs+=(--set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE")
     fi
 
-    if [ -n "$XDG_ICON_DIRS" ]; then
-        gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS")
-    fi
-
     if [ -n "$GSETTINGS_SCHEMAS_PATH" ]; then
         gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH")
     fi

pkgs/build-support/trivial-builders.nix

@@ -515,15 +515,19 @@ rec {
    * # setup hook that depends on the hello package and runs ./myscript.sh
    * myhellohook = makeSetupHook { deps = [ hello ]; } ./myscript.sh;
    *
-   * # wrotes a setup hook where @bash@ myscript.sh is substituted for the
+   * # writes a Linux-exclusive setup hook where @bash@ myscript.sh is substituted for the
    * # bash interpreter.
    * myhellohookSub = makeSetupHook {
    *                 deps = [ hello ];
    *                 substitutions = { bash = "${pkgs.bash}/bin/bash"; };
+   *                 meta.platforms = lib.platforms.linux;
    *               } ./myscript.sh;
    */
-  makeSetupHook = { name ? "hook", deps ? [], substitutions ? {} }: script:
+  makeSetupHook = { name ? "hook", deps ? [], substitutions ? {}, meta ? {} }: script:
-    runCommand name substitutions
+    runCommand name
+      (substitutions // {
+        inherit meta;
+      })
       (''
         mkdir -p $out/nix-support
         cp ${script} $out/nix-support/setup-hook

pkgs/data/misc/cacert/default.nix

@@ -20,7 +20,7 @@ let
   blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" blacklist);
   extraCertificatesBundle = writeText "cacert-extra-certificates-bundle.crt" (lib.concatStringsSep "\n\n" extraCertificateStrings);
 
-  srcVersion = "3.74";
+  srcVersion = "3.77";
   version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = with lib; {
     homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -35,7 +35,7 @@ let
 
     src = if nssOverride != null then nssOverride.src else fetchurl {
       url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
-      sha256 = "0mnhdkm4galhpvfz4rv0918jwmjlwkvcvb1f5va8f3zlz48qi4l8";
+      sha256 = "1pfy33b51914sivqyaxdwfd930hzb77gm07z4f57hnyk5xddypl2";
     };
 
     dontBuild = true;

pkgs/data/misc/cacert/update.sh

@@ -13,14 +13,11 @@
 # As of this writing there are a few magnitudes more packages depending on
 # cacert than on nss.
 #
-# If the current nixpkgs revision contains the attribute `nss_latest` that will
+# We use `nss_latest` instead of `nss_esr`, because that is the newer version
-# be used instead of `nss`. This is done to help the stable branch maintenance
+# and we want up-to-date certificates.
-# where (usually) after branch-off during the first Firefox upgrade that
+# `nss_esr` is used for the ecosystem at large through the `nss` attribute,
-# requries a new NSS version that attribute is introduced.
+# because it is updated less frequently and maintained for longer, whereas `nss_latest`
-# By having this change in the unstable branch we can safely carry it from
+# is used for software that actually needs a new nss, e.g. Firefox.
-# release to release without requiring more backport churn on those doing the
-# stable maintenance.
-
 
 set -ex
 
@@ -28,7 +25,7 @@ BASEDIR="$(dirname "$0")/../../../.."
 
 
 CURRENT_PATH=$(nix-build --no-out-link -A cacert.out)
-PATCHED_PATH=$(nix-build --no-out-link -E "with import $BASEDIR {}; let nss_pkg = pkgs.nss_latest or pkgs.nss; in (cacert.override { nssOverride = nss_pkg; }).out")
+PATCHED_PATH=$(nix-build --no-out-link -E "with import $BASEDIR {}; (cacert.override { nssOverride = nss_latest; }).out")
 
 # Check the hash of the etc subfolder
 # We can't check the entire output as that contains the nix-support folder
@@ -37,6 +34,6 @@ CURRENT_HASH=$(nix-hash "$CURRENT_PATH/etc")
 PATCHED_HASH=$(nix-hash "$PATCHED_PATH/etc")
 
 if [[ "$CURRENT_HASH" !=  "$PATCHED_HASH" ]]; then
-    NSS_VERSION=$(nix-instantiate --json --eval -E "with import $BASEDIR {}; nss.version" | jq -r .)
+    NSS_VERSION=$(nix-instantiate --json --eval -E "with import $BASEDIR {}; nss_latest.version" | jq -r .)
     update-source-version --version-key=srcVersion cacert.src "$NSS_VERSION"
 fi

pkgs/data/misc/dns-root-data/default.nix

@@ -19,7 +19,8 @@ let
 in
 
 stdenv.mkDerivation {
-  name = "dns-root-data-2019-01-11";
+  pname = "dns-root-data";
+  version = "2019-01-11";
 
   buildCommand = ''
     mkdir $out

pkgs/data/misc/freepats/default.nix

@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "freepats-20060219";
+  pname = "freepats";
+  version = "20060219";
 
   src = fetchurl {
-    url = "https://freepats.zenvoid.org/${name}.tar.bz2";
+    url = "https://freepats.zenvoid.org/freepats-${version}.tar.bz2";
     sha256 = "12iw36rd94zirll96cd5k0va7p5hxmf2shvjlhzihcmjaw8flq82";
   };
 

pkgs/desktops/cdesktopenv/default.nix

@@ -56,6 +56,19 @@ in stdenv.mkDerivation rec {
     "LOCALE_ARCHIVE=${glibcLocales}/lib/locale/locale-archive"
   ];
 
+  preConfigure = ''
+    # binutils 2.37 fix
+    fixupList=(
+      "config/cf/Imake.tmpl"
+      "config/util/crayar.sh"
+      "config/util/crayar.sh"
+      "programs/dtwm/Makefile.tmpl"
+    )
+    for toFix in "''${fixupList[@]}"; do
+      substituteInPlace "$toFix" --replace "clq" "cq"
+    done
+  '';
+
   preBuild = ''
     while IFS= read -r -d ''$'\0' i; do
       substituteInPlace "$i" --replace /usr/dt $out/opt/dt

pkgs/desktops/gnome/core/mutter/3.38/default.nix

@@ -32,6 +32,7 @@
 , mesa
 , meson
 , gnome-settings-daemon
+, libxcvt
 , xorgserver
 , python3
 , wrapGAppsHook
@@ -99,7 +100,8 @@ let self = stdenv.mkDerivation rec {
     pkg-config
     python3
     wrapGAppsHook
-    xorgserver # for cvt command
+    libxcvt
+    xorgserver
   ];
 
   buildInputs = [

pkgs/desktops/gnome/core/mutter/default.nix

@@ -33,6 +33,7 @@
 , mesa
 , meson
 , gnome-settings-daemon
+, libxcvt
 , xorgserver
 , python3
 , wrapGAppsHook
@@ -95,7 +96,8 @@ let self = stdenv.mkDerivation rec {
     pkg-config
     python3
     wrapGAppsHook
-    xorgserver # for cvt command
+    libxcvt
+    xorgserver
   ];
 
   buildInputs = [

pkgs/development/compilers/dmd/binary.nix

@@ -18,8 +18,9 @@ in stdenv.mkDerivation {
   dontConfigure = true;
   dontBuild = true;
 
-  nativeBuildInputs = [ autoPatchelfHook ]
+  nativeBuildInputs = lib.optionals hostPlatform.isLinux [
-    ++ lib.optional hostPlatform.isDarwin fixDarwinDylibNames;
+    autoPatchelfHook
+  ] ++ lib.optional hostPlatform.isDarwin fixDarwinDylibNames;
   propagatedBuildInputs = [ curl tzdata ] ++ lib.optional hostPlatform.isLinux glibc;
 
   installPhase = ''

pkgs/development/compilers/go/1.16.nix

@@ -7,7 +7,6 @@
 , perl
 , which
 , pkg-config
-, patch
 , procps
 , pcre
 , cacert
@@ -63,7 +62,7 @@ stdenv.mkDerivation rec {
   };
 
   # perl is used for testing go vet
-  nativeBuildInputs = [ perl which pkg-config patch procps ];
+  nativeBuildInputs = [ perl which pkg-config procps ];
   buildInputs = [ cacert pcre ]
     ++ lib.optionals stdenv.isLinux [ stdenv.cc.libc.out ]
     ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];

pkgs/development/compilers/go/1.17.nix

@@ -7,7 +7,6 @@
 , perl
 , which
 , pkg-config
-, patch
 , procps
 , pcre
 , cacert
@@ -55,15 +54,15 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.17.8";
+  version = "1.17.9";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "sha256-Lv/NiYFA2nmgYfN4TKT42LE9gR+yq+na0kBEQtq733o=";
+    sha256 = "sha256-djrUuvuAqSBEWMX6K45zJ/qXGu5FQlLA42LBEjYVaBM=";
   };
 
   # perl is used for testing go vet
-  nativeBuildInputs = [ perl which pkg-config patch procps ];
+  nativeBuildInputs = [ perl which pkg-config procps ];
   buildInputs = [ cacert pcre ]
     ++ lib.optionals stdenv.isLinux [ stdenv.cc.libc.out ]
     ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];

pkgs/development/compilers/go/1.18.nix

@@ -7,7 +7,6 @@
 , perl
 , which
 , pkg-config
-, patch
 , procps
 , pcre
 , cacert
@@ -63,7 +62,7 @@ stdenv.mkDerivation rec {
   };
 
   # perl is used for testing go vet
-  nativeBuildInputs = [ perl which pkg-config patch procps ];
+  nativeBuildInputs = [ perl which pkg-config procps ];
   buildInputs = [ cacert pcre ]
     ++ lib.optionals stdenv.isLinux [ stdenv.cc.libc.out ]
     ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];

pkgs/development/compilers/inklecate/default.nix

@@ -17,7 +17,7 @@ buildDotnetModule rec {
     sha256 = "00lagmwsbxap5mgnw4gndpavmv3xsgincdaq1zvw7fkc3vn3pxqc";
   };
 
-  nativeBuildInputs = [ autoPatchelfHook ];
+  nativeBuildInputs = lib.optionals stdenv.isLinux [ autoPatchelfHook ];
   buildInputs = [ stdenv.cc.cc.lib ];
 
   projectFile = "inklecate/inklecate.csproj";

pkgs/development/compilers/ldc/binary.nix

@@ -18,8 +18,9 @@ in stdenv.mkDerivation {
   dontConfigure = true;
   dontBuild = true;
 
-  nativeBuildInputs = [ autoPatchelfHook ]
+  nativeBuildInputs = lib.optionals hostPlatform.isLinux [
-    ++ lib.optional hostPlatform.isDarwin fixDarwinDylibNames;
+    autoPatchelfHook
+  ] ++ lib.optional hostPlatform.isDarwin fixDarwinDylibNames;
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libxml2 stdenv.cc.cc ];
 

pkgs/development/compilers/llvm/10/llvm/default.nix

@@ -244,6 +244,12 @@ in stdenv.mkDerivation (rec {
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
   ''
+  + optionalString enableSharedLibraries ''
+    mkdir -p $dev/lib
+    mv $lib/lib/*.a $dev/lib
+    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
+      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
+  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';

pkgs/development/compilers/llvm/11/llvm/default.nix

@@ -255,6 +255,12 @@ in stdenv.mkDerivation (rec {
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
   ''
+  + optionalString enableSharedLibraries ''
+    mkdir -p $dev/lib
+    mv $lib/lib/*.a $dev/lib
+    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
+      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
+  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';

pkgs/development/compilers/llvm/12/llvm/default.nix

@@ -242,6 +242,12 @@ in stdenv.mkDerivation (rec {
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
   ''
+  + optionalString enableSharedLibraries ''
+    mkdir -p $dev/lib
+    mv $lib/lib/*.a $dev/lib
+    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
+      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
+  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';

pkgs/development/compilers/llvm/13/llvm/default.nix

@@ -205,6 +205,12 @@ in stdenv.mkDerivation (rec {
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
   ''
+  + optionalString enableSharedLibraries ''
+    mkdir -p $dev/lib
+    mv $lib/lib/*.a $dev/lib
+    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
+      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
+  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';

pkgs/development/compilers/llvm/14/llvm/default.nix

@@ -200,6 +200,12 @@ in stdenv.mkDerivation (rec {
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
   ''
+  + optionalString enableSharedLibraries ''
+    mkdir -p $dev/lib
+    mv $lib/lib/*.a $dev/lib
+    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
+      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
+  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';

pkgs/development/compilers/llvm/5/llvm/default.nix

@@ -222,6 +222,12 @@ stdenv.mkDerivation (rec {
       ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${v}.dylib
     '') versionSuffixes}
   ''
+  + optionalString enableSharedLibraries ''
+    mkdir -p $dev/lib
+    mv $lib/lib/*.a $dev/lib
+    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
+      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
+  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';

pkgs/development/compilers/llvm/6/llvm/default.nix

@@ -215,6 +215,12 @@ stdenv.mkDerivation (rec {
       ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${v}.dylib
     '') versionSuffixes}
   ''
+  + optionalString enableSharedLibraries ''
+    mkdir -p $dev/lib
+    mv $lib/lib/*.a $dev/lib
+    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
+      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
+  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';

pkgs/development/compilers/llvm/7/llvm/default.nix

@@ -234,6 +234,12 @@ in stdenv.mkDerivation (rec {
       ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${v}.dylib
     '') versionSuffixes}
   ''
+  + optionalString enableSharedLibraries ''
+    mkdir -p $dev/lib
+    mv $lib/lib/*.a $dev/lib
+    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
+      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
+  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';

pkgs/development/compilers/llvm/8/llvm/default.nix

@@ -226,6 +226,12 @@ in stdenv.mkDerivation (rec {
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
   ''
+  + optionalString enableSharedLibraries ''
+    mkdir -p $dev/lib
+    mv $lib/lib/*.a $dev/lib
+    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
+      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
+  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';

pkgs/development/compilers/llvm/9/llvm/default.nix

@@ -241,6 +241,12 @@ in stdenv.mkDerivation (rec {
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
   ''
+  + optionalString enableSharedLibraries ''
+    mkdir -p $dev/lib
+    mv $lib/lib/*.a $dev/lib
+    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
+      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
+  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';

pkgs/development/compilers/llvm/git/llvm/default.nix

@@ -200,6 +200,12 @@ in stdenv.mkDerivation (rec {
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
   ''
+  + optionalString enableSharedLibraries ''
+    mkdir -p $dev/lib
+    mv $lib/lib/*.a $dev/lib
+    sed -i -E "s|$lib/lib/(.*)\.a|$dev/lib/\1\.a|" \
+      "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake"
+  ''
   + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';

pkgs/development/compilers/mrustc/default.nix

@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
     sed -i 's/\$(shell git show --pretty=%H -s)/${rev}/' Makefile
     sed -i 's/\$(shell git symbolic-ref -q --short HEAD || git describe --tags --exact-match)/${tag}/' Makefile
     sed -i 's/\$(shell git diff-index --quiet HEAD; echo $$?)/0/' Makefile
+    sed '1i#include <limits>' -i src/trans/codegen_c.cpp
   '';
 
   strictDeps = true;

pkgs/development/compilers/rust/1_59.nix

@@ -1,64 +0,0 @@
-# New rust versions should first go to staging.
-# Things to check after updating:
-# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
-#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
-#    This testing can be also done by other volunteers as part of the pull
-#    request review, in case platforms cannot be covered.
-# 2. The LLVM version used for building should match with rust upstream.
-#    Check the version number in the src/llvm-project git submodule in:
-#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
-# 3. Firefox and Thunderbird should still build on x86_64-linux.
-
-{ stdenv, lib
-, buildPackages
-, newScope, callPackage
-, CoreFoundation, Security, SystemConfiguration
-, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
-, makeRustPlatform
-, llvmPackages_11
-, llvmPackages_13, llvm_13
-} @ args:
-
-import ./default.nix {
-  rustcVersion = "1.59.0";
-  rustcSha256 = "sha256-p8juruhb/O+EyWsCsxcdHmVA0VF5/4Pd3Z6vuhhfhfk=";
-
-  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_13.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForHost = pkgsBuildHost.llvmPackages_13.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_13.libllvm.override { enableSharedLibraries = true; };
-
-  llvmBootstrapForDarwin = llvmPackages_11;
-
-  # For use at runtime
-  llvmShared = llvm_13.override { enableSharedLibraries = true; };
-
-  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
-  llvmPackagesForBuild = pkgsBuildBuild.llvmPackages_13;
-
-  # Note: the version MUST be one version prior to the version we're
-  # building
-  bootstrapVersion = "1.58.1";
-
-  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
-  bootstrapHashes = {
-    i686-unknown-linux-gnu = "c3d282cd96cc9e5292e62db1ebb9fa6d5b738f4684d5ece9883f7472e2f76ad4";
-    x86_64-unknown-linux-gnu = "4fac6df9ea49447682c333e57945bebf4f9f45ec7b08849e507a64b2ccd5f8fb";
-    x86_64-unknown-linux-musl = "7036e34eadc8ce22d16b0625919d9f2244ca49a5441d6599f4822116c181d272";
-    arm-unknown-linux-gnueabihf = "739389d46c5862b0e67d01dece99aa3db2229e055a3d7f7624679c55b6c33e06";
-    armv7-unknown-linux-gnueabihf = "6cede2c7795e8126b0f17b1032d52500e594bac64c7d190bdc0ac1c832ef30bd";
-    aarch64-unknown-linux-gnu = "ce557516593e4526709b0f33c2e1d7c932b3ddf76af94c2417d8d667921ce90c";
-    aarch64-unknown-linux-musl = "b1533fdeeda483a3633617fd18a79d8fad7821331614b8dc13efd8b22acc30f5";
-    x86_64-apple-darwin = "d0044680fc132a721481b130a0a4282a444867f423efdb890fe13e447966412f";
-    aarch64-apple-darwin = "00b44985bc87e53c53d92622fb10226f09e9f25c79db48a77c0a769a36f83b1e";
-    powerpc64le-unknown-linux-gnu = "b15baef702cbd6f0ea2bef7bf98ca7ce5644f2beb219028e8a12e7053da4c849";
-    riscv64gc-unknown-linux-gnu = "d8ea2b11a4b24d1169fa3190127488b951b8bdef28293a4129ddd46c0ba9469b";
-    mips64el-unknown-linux-gnuabi64 = "4f03bc972ae784d4f66cfa77215b369723531e67f647de9f49ce9fc21e5691af";
-  };
-
-  selectRustPackage = pkgs: pkgs.rust_1_59;
-
-  rustcPatches = [
-  ];
-}
-
-(builtins.removeAttrs args [ "fetchpatch" "pkgsBuildHost" "llvmPackages_11" "llvmPackages_13" "llvm_13"])

pkgs/development/compilers/rust/1_60.nix

@@ -0,0 +1,64 @@
+# New rust versions should first go to staging.
+# Things to check after updating:
+# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
+#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
+#    This testing can be also done by other volunteers as part of the pull
+#    request review, in case platforms cannot be covered.
+# 2. The LLVM version used for building should match with rust upstream.
+#    Check the version number in the src/llvm-project git submodule in:
+#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
+# 3. Firefox and Thunderbird should still build on x86_64-linux.
+
+{ stdenv, lib
+, buildPackages
+, newScope, callPackage
+, CoreFoundation, Security, SystemConfiguration
+, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
+, makeRustPlatform
+, llvmPackages_11
+, llvmPackages_14, llvm_14
+} @ args:
+
+import ./default.nix {
+  rustcVersion = "1.60.0";
+  rustcSha256 = "1drqr0a26x1rb2w3kj0i6abhgbs3jx5qqkrcwbwdlx7n3inq5ji0";
+
+  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForHost = pkgsBuildHost.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
+
+  llvmBootstrapForDarwin = llvmPackages_11;
+
+  # For use at runtime
+  llvmShared = llvm_14.override { enableSharedLibraries = true; };
+
+  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
+  llvmPackagesForBuild = pkgsBuildBuild.llvmPackages_14;
+
+  # Note: the version MUST be one version prior to the version we're
+  # building
+  bootstrapVersion = "1.59.0";
+
+  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
+  bootstrapHashes = {
+    i686-unknown-linux-gnu = "f57ebfafed1e857b2b1dc1a22cf1133766f68a0759dc2f717dec54a8d4385dec";
+    x86_64-unknown-linux-gnu = "0c1c2da3fa26372e5178123aa5bb0fdcd4933fbad9bfb268ffbd71807182ecae";
+    x86_64-unknown-linux-musl = "c0ae76fa4bb0f1c85b86b9f7637db0fddf5084ce4c8f86c4d4acc3c41813201f";
+    arm-unknown-linux-gnueabihf = "f934ddd8533d5df922e3397a5d30404930c5992c6c91c72d3e1475e2978e8793";
+    armv7-unknown-linux-gnueabihf = "acb0f793c517de927b17e1c85135f6d58ae7430a8bd094a92009bcf0d4bbb8eb";
+    aarch64-unknown-linux-gnu = "ab5da30a3de5433e26cbc74c56b9d97b569769fc2e456fc54378adc8baaee4f0";
+    aarch64-unknown-linux-musl = "a3f8afdf23c98e6d25bf3b4bfcf5e9a4712f4c425f3754500931232d946204a9";
+    x86_64-apple-darwin = "d82204f536af0c7bfd2ea2213dc46b99911860cfc5517f7321244412ae96f159";
+    aarch64-apple-darwin = "5449ae915982967bae97746ce8bea30844f9ab40b4ee4da392b9997e0e7b2926";
+    powerpc64le-unknown-linux-gnu = "6892a706ea8118344a4f4624b57a99460a784b5b30cccd9df430c33008d341f3";
+    riscv64gc-unknown-linux-gnu = "e0cb22c2383d73b3928c17a630ae8d37f6787ddcea7871c9b3e21fd4560226b2";
+    mips64el-unknown-linux-gnuabi64 = "2e2c404741b1dd02b5d73361f187568a91a8531997ade41bd855eca3972e2a5b";
+  };
+
+  selectRustPackage = pkgs: pkgs.rust_1_60;
+
+  rustcPatches = [
+  ];
+}
+
+(builtins.removeAttrs args [ "fetchpatch" "pkgsBuildHost" "llvmPackages_11" "llvmPackages_14" "llvm_14"])

pkgs/development/compilers/rust/rustfmt-fix-self-tests.patch

@@ -1,13 +0,0 @@
---- a/src/tools/rustfmt/src/ignore_path.rs
-+++ b/src/tools/rustfmt/src/ignore_path.rs
-@@ -37,9 +37,9 @@
-     #[nightly_only_test]
-     #[test]
-     fn test_ignore_path_set() {
--        use std::path::{Path, PathBuf};
-         use crate::config::{Config, FileName};
-         use crate::ignore_path::IgnorePathSet;
-+        use std::path::{Path, PathBuf};
- 
-         let config =
-             Config::from_toml(r#"ignore = ["foo.rs", "bar_dir/*"]"#, Path::new("")).unwrap();

pkgs/development/compilers/rust/rustfmt.nix

@@ -21,9 +21,6 @@ rustPlatform.buildRustPackage rec {
   CFG_RELEASE = rustPlatform.rust.rustc.version;
   CFG_RELEASE_CHANNEL = if asNightly then "nightly" else "stable";
 
-  # FIXME: seems fixed upstream, remove after the next update
-  patches = [ ./rustfmt-fix-self-tests.patch ];
-
   meta = with lib; {
     description = "A tool for formatting Rust code according to style guidelines";
     homepage = "https://github.com/rust-lang-nursery/rustfmt";

pkgs/development/compilers/zulu/8.nix

@@ -61,18 +61,22 @@ in stdenv.mkDerivation {
   ];
 
   nativeBuildInputs = [
-    autoPatchelfHook makeWrapper
+    makeWrapper
+  ] ++ lib.optionals stdenv.isLinux [
+    autoPatchelfHook
   ] ++ lib.optionals stdenv.isDarwin [
     unzip
   ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out
     cp -r ./* "$out/"
-
+  '' + lib.optionalString stdenv.isLinux ''
     # jni.h expects jni_md.h to be in the header search path.
     ln -s $out/include/linux/*_md.h $out/include/
-
+  '' + ''
     mkdir -p $out/nix-support
     printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
 
@@ -87,6 +91,8 @@ in stdenv.mkDerivation {
         wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
       fi
     done
+  '' + ''
+    runHook postInstall
   '';
 
   preFixup = ''

pkgs/development/compilers/zulu/default.nix

@@ -63,12 +63,16 @@ in stdenv.mkDerivation {
   ];
 
   nativeBuildInputs = [
-    autoPatchelfHook makeWrapper
+    makeWrapper
+  ] ++ lib.optionals stdenv.isLinux [
+    autoPatchelfHook
   ] ++ lib.optionals stdenv.isDarwin [
     unzip
   ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out
     cp -r ./* "$out/"
   '' + lib.optionalString stdenv.isLinux ''
@@ -90,6 +94,8 @@ in stdenv.mkDerivation {
     for bin in $( find "$out" -executable -type f -not -name jspawnhelper ); do
       wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
     done
+  '' + ''
+    runHook postInstall
   '';
 
   preFixup = ''

pkgs/development/go-modules/generic/default.nix

@@ -204,7 +204,7 @@ let
         if [ -n "$subPackages" ]; then
           echo "$subPackages" | sed "s,\(^\| \),\1./,g"
         else
-          find . -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort --unique
+          find . -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort --unique | grep -v "$exclude"
         fi
       }
 
@@ -221,7 +221,6 @@ let
           export NIX_BUILD_CORES=1
       fi
       for pkg in $(getGoDirs ""); do
-        grep -q "$exclude" <<<$pkg && continue
         echo "Building subPackage $pkg"
         buildGoDir install "$pkg"
       done

pkgs/development/go-packages/generic/default.nix

@@ -184,7 +184,7 @@ let
           echo "$subPackages" | sed "s,\(^\| \),\1$goPackagePath/,g"
         else
           pushd "$NIX_BUILD_TOP/go/src" >/dev/null
-          find "$goPackagePath" -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort | uniq
+          find "$goPackagePath" -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort | uniq | grep -v "$exclude"
           popd >/dev/null
         fi
       }
@@ -202,7 +202,6 @@ let
           export NIX_BUILD_CORES=1
       fi
       for pkg in $(getGoDirs ""); do
-        grep -q "$exclude" <<<$pkg && continue
         echo "Building subPackage $pkg"
         buildGoDir install "$pkg"
       done

pkgs/development/interpreters/gnu-apl/default.nix

@@ -11,14 +11,16 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ readline gettext ncurses ];
 
-  # Needed with GCC 8
   NIX_CFLAGS_COMPILE = with lib; toString ((optionals stdenv.cc.isGNU [
+    # Needed with GCC 8
     "-Wno-error=int-in-bool-context"
     "-Wno-error=class-memaccess"
     "-Wno-error=restrict"
     "-Wno-error=format-truncation"
     # Needed with GCC 10
     "-Wno-error=maybe-uninitialized"
+    # Needed with GCC 11
+    "-Wno-error=misleading-indentation"
    ]) ++ optional stdenv.cc.isClang "-Wno-error=null-dereference");
 
   patchPhase = lib.optionalString stdenv.isDarwin ''

pkgs/development/interpreters/perl/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, stdenv, fetchurl, fetchpatch, fetchFromGitHub, pkgs, buildPackages
+{ config, lib, stdenv, fetchurl, fetchFromGitHub, pkgs, buildPackages
 , callPackage
 , enableThreading ? true, coreutils, makeWrapper
 , zlib
@@ -41,14 +41,7 @@ let
       ]
       ++ optional stdenv.isSunOS ./ld-shared.patch
       ++ optionals stdenv.isDarwin [ ./cpp-precomp.patch ./sw_vers.patch ]
-      ++ optionals crossCompiling [
+      ++ optional crossCompiling ./MakeMaker-cross.patch;
-        ./MakeMaker-cross.patch
-        # https://github.com/arsv/perl-cross/pull/120
-        (fetchpatch {
-          url = "https://github.com/arsv/perl-cross/commit/3c318ae6572f8b36cb077c8b49c851e2f5fe181e.patch";
-          sha256 = "0cmcy8bams3c68f6xadl52z2w378wcpdjzi3qi4pcyvcfs011l6g";
-        })
-      ];
 
     # This is not done for native builds because pwd may need to come from
     # bootstrap tools when building bootstrap perl.
@@ -204,14 +197,14 @@ let
       priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
     };
   } // optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "393821c7cf53774233aaf130ff2c8ccec701b0a9"; # Sep 22, 2021
+    crossVersion = "1.3.7"; # Mar 15, 2022
 
     perl-cross-src = fetchFromGitHub {
       name = "perl-cross-${crossVersion}";
       owner = "arsv";
       repo = "perl-cross";
       rev = crossVersion;
-      sha256 = "1fn35b1773aibi2z54m0mar7114737mvfyp81wkdwhakrmzr5nv1";
+      sha256 = "sha256-F7Vi3RAgIE/3NPlbD5zQ3Q8Ex9ddXTC4zoCRaOxXK0A=";
     };
 
     depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
@@ -240,15 +233,15 @@ in {
   perl534 = common {
     perl = pkgs.perl534;
     buildPerl = buildPackages.perl534;
-    version = "5.34.0";
+    version = "5.34.1";
-    sha256 = "16mywn5afpv1mczv9dlc1w84rbgjgrr0pyr4c0hhb2wnif0zq7jm";
+    sha256 = "sha256-NXlRpJGwuhzjYRJjki/ux4zNWB3dwkpEawM+JazyQqE=";
   };
 
   # the latest Devel version
   perldevel = common {
     perl = pkgs.perldevel;
     buildPerl = buildPackages.perldevel;
-    version = "5.35.4";
+    version = "5.35.9";
-    sha256 = "1ss2r0qq5li6d2qghfv1iah5nl6nraymd7b7ib1iy1395rwyhl4q";
+    sha256 = "sha256-/nmSCIIXHXoC68DxFM9b5GM2AKU4WlLbfWLgduanL7U=";
   };
 }

pkgs/development/interpreters/python/cpython/default.nix

@@ -284,7 +284,7 @@ in with passthru; stdenv.mkDerivation {
 
   CPPFLAGS = concatStringsSep " " (map (p: "-I${getDev p}/include") buildInputs);
   LDFLAGS = concatStringsSep " " (map (p: "-L${getLib p}/lib") buildInputs);
-  LIBS = "${optionalString (!stdenv.isDarwin) "-lcrypt"} ${optionalString (ncurses != null) "-lncurses"}";
+  LIBS = "${optionalString (!stdenv.isDarwin) "-lcrypt"}";
   NIX_LDFLAGS = lib.optionalString stdenv.cc.isGNU ({
     "glibc" = "-lgcc_s";
     "musl" = "-lgcc_eh";

pkgs/development/interpreters/python/default.nix

@@ -124,19 +124,19 @@ with pkgs;
       sourceVersion = {
         major = "3";
         minor = "9";
-        patch = "11";
+        patch = "12";
         suffix = "";
       };
-      sha256 = "sha256-ZnZ6NTCdck83DfnlA8FytO5ET0nWK5i8TspyUSPibEk=";
+      sha256 = "sha256-LNlLIGcOQVnG2atX+R2/JVuX2MGhRR0cNfTsGWit+XE=";
     };
     python310 = {
       sourceVersion = {
         major = "3";
         minor = "10";
-        patch = "3";
+        patch = "4";
         suffix = "";
       };
-      sha256 = "sha256-WWxy3pmNw5IFvE9w7w2/ft7HQKMG0JtJqb0Kd4BnMNw=";
+      sha256 = "sha256-gL+SX1cdpDazUhCIbPefbrX6XWxXExa3NWg0NFH3ehk=";
     };
   };
 

pkgs/development/interpreters/ruby/default.nix

@@ -59,14 +59,9 @@ let
         pname = "ruby";
         inherit version;
 
-        src = if useRailsExpress then fetchFromGitHub {
+        src = fetchurl {
-          owner  = "ruby";
-          repo   = "ruby";
-          rev    = tag;
-          sha256 = sha256.git;
-        } else fetchurl {
           url = "https://cache.ruby-lang.org/pub/ruby/${ver.majMin}/ruby-${ver}.tar.gz";
-          sha256 = sha256.src;
+          inherit sha256;
         };
 
         # Have `configure' avoid `/usr/bin/nroff' in non-chroot builds.
@@ -100,17 +95,22 @@ let
             patchLevel = ver.patchLevel;
           }).${ver.majMinTiny}
           ++ op (lib.versionOlder ver.majMin "3.1") ./do-not-regenerate-revision.h.patch
-          ++ op (atLeast30 && useRailsExpress) ./do-not-update-gems-baseruby.patch
+          ++ op (atLeast30 && useBaseRuby) ./do-not-update-gems-baseruby.patch
-          # Ruby prior to 3.0 has a bug the installer (tools/rbinstall.rb) but
+          ++ ops (!atLeast30 && rubygemsSupport) [
-          # the resulting error was swallowed. Newer rubygems no longer swallows
+            # We upgrade rubygems to a version that isn't compatible with the
-          # this error. We upgrade rubygems when rubygemsSupport is enabled, so
+            # ruby 2.7 installer. Backport the upstream fix.
-          # we have to fix this bug to prevent the install step from failing.
+            ./rbinstall-new-rubygems-compat.patch
-          # See https://github.com/ruby/ruby/pull/2930
+
-          ++ op (!atLeast30 && rubygemsSupport)
+            # Ruby prior to 3.0 has a bug the installer (tools/rbinstall.rb) but
+            # the resulting error was swallowed. Newer rubygems no longer swallows
+            # this error. We upgrade rubygems when rubygemsSupport is enabled, so
+            # we have to fix this bug to prevent the install step from failing.
+            # See https://github.com/ruby/ruby/pull/2930
             (fetchpatch {
               url = "https://github.com/ruby/ruby/commit/261d8dd20afd26feb05f00a560abd99227269c1c.patch";
               sha256 = "0wrii25cxcz2v8bgkrf7ibcanjlxwclzhayin578bf0qydxdm9qy";
-            });
+            })
+          ];
 
         postUnpack = opString rubygemsSupport ''
           rm -rf $sourceRoot/{lib,test}/rubygems*
@@ -182,6 +182,11 @@ let
               sed -i '/CC_VERSION_MESSAGE/d' $rbConfig
             ''
           }
+          # Remove unnecessary external intermediate files created by gems
+          extMakefiles=$(find $out/lib/ruby/gems -name Makefile)
+          for makefile in $extMakefiles; do
+            make -C "$(dirname "$makefile")" distclean
+          done
           # Bundler tries to create this directory
           mkdir -p $out/nix-support
           cat > $out/nix-support/setup-hook <<EOF
@@ -252,26 +257,17 @@ let
 
 in {
   ruby_2_7 = generic {
-    version = rubyVersion "2" "7" "5" "";
+    version = rubyVersion "2" "7" "6" "";
-    sha256 = {
+    sha256 = "042xrdk7hsv4072bayz3f8ffqh61i8zlhvck10nfshllq063n877";
-      src = "1wc1hwmz4m6iqlmqag8liyld917p6a8dvnhnpd1v8d8jl80bjm97";
-      git = "16565fyl7141hr6q6d74myhsz46lvgam8ifnacshi68vzibwjbbh";
-    };
   };
 
   ruby_3_0 = generic {
-    version = rubyVersion "3" "0" "3" "";
+    version = rubyVersion "3" "0" "4" "";
-    sha256 = {
+    sha256 = "0avj4g3s2839b2y4m6pk8kid74r8nj7k0qm2rsdcwjzhg8h7rd3h";
-      src = "1b4j39zyyvdkf1ax2c6qfa40b4mxfkr87zghhw19fmnzn8f8d1im";
-      git = "1q19w5i1jkfxn7qq6f9v9ngax9h52gxwijk7hp312dx6amwrkaim";
-    };
   };
 
   ruby_3_1 = generic {
-    version = rubyVersion "3" "1" "1" "";
+    version = rubyVersion "3" "1" "2" "";
-    sha256 = {
+    sha256 = "0gm84ipk6mrfw94852w5h7xxk2lqrxjbnlwb88svf0lz70933131";
-      src = "sha256-/m5Hgt6XRDl43bqLpL440iKqJNw+PwKmqOdwHA7rYZ0=";
-      git = "sha256-76t/tGyK5nz7nvcRdHJTjjckU+Kv+/kbTMiNWJ93jU8=";
-    };
   };
 }

pkgs/development/interpreters/ruby/patchsets.nix

@@ -1,15 +1,15 @@
 { patchSet, useRailsExpress, ops, patchLevel, fetchpatch }:
 
 {
-  "2.7.5" = ops useRailsExpress [
+  "2.7.6" = ops useRailsExpress [
     "${patchSet}/patches/ruby/2.7/head/railsexpress/01-fix-broken-tests-caused-by-ad.patch"
     "${patchSet}/patches/ruby/2.7/head/railsexpress/02-improve-gc-stats.patch"
     "${patchSet}/patches/ruby/2.7/head/railsexpress/03-more-detailed-stacktrace.patch"
   ];
-  "3.0.3" = ops useRailsExpress [
+  "3.0.4" = ops useRailsExpress [
     "${patchSet}/patches/ruby/3.0/head/railsexpress/01-improve-gc-stats.patch"
     "${patchSet}/patches/ruby/3.0/head/railsexpress/02-malloc-trim.patch"
   ];
-  "3.1.1" = ops useRailsExpress [ # no patches yet (2021-12-25)
+  "3.1.2" = ops useRailsExpress [ # no patches yet (2021-12-25)
   ];
 }

pkgs/development/interpreters/ruby/rbinstall-new-rubygems-compat.patch

@@ -0,0 +1,87 @@
+From 8e85d27f9ccfe152fc1b891c19f125915a907493 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?V=C3=ADt=20Ondruch?= <vondruch@redhat.com>
+Date: Tue, 1 Oct 2019 12:03:33 +0200
+Subject: [PATCH] Use `Gem::Package` like object instead of monkey patching.
+
+1. This is similar to what RubyGems does and it is less magic [[1]].
+2. It avoids deprecated code paths in RubyGems [[2]].
+
+[1]: https://github.com/rubygems/rubygems/blob/92892bbc3adba86a90756c385433835f6761b8da/lib/rubygems/installer.rb#L151
+[2]: https://github.com/rubygems/rubygems/blob/92892bbc3adba86a90756c385433835f6761b8da/lib/rubygems/installer.rb#L187
+
+(cherry picked from commit e960ef6f18a25c637c54f00c75bb6c24f8ab55d0)
+---
+ tool/rbinstall.rb | 47 +++++++++++++++++++++++++++--------------------
+ 1 file changed, 27 insertions(+), 20 deletions(-)
+
+diff --git a/tool/rbinstall.rb b/tool/rbinstall.rb
+index 060390626f..28ae8c409a 100755
+--- a/tool/rbinstall.rb
++++ b/tool/rbinstall.rb
+@@ -710,28 +710,34 @@ def remove_prefix(prefix, string)
+     end
+   end
+ 
+-  class UnpackedInstaller < Gem::Installer
+-    module DirPackage
+-      def extract_files(destination_dir, pattern = "*")
+-        path = File.dirname(@gem.path)
+-        return if path == destination_dir
+-        File.chmod(0700, destination_dir)
+-        mode = pattern == "bin/*" ? $script_mode : $data_mode
+-        spec.files.each do |f|
+-          src = File.join(path, f)
+-          dest = File.join(without_destdir(destination_dir), f)
+-          makedirs(dest[/.*(?=\/)/m])
+-          install src, dest, :mode => mode
+-        end
+-        File.chmod($dir_mode, destination_dir)
++  class DirPackage
++    attr_reader :spec
++
++    attr_accessor :dir_mode
++    attr_accessor :prog_mode
++    attr_accessor :data_mode
++
++    def initialize(spec)
++      @spec = spec
++      @src_dir = File.dirname(@spec.loaded_from)
++    end
++
++    def extract_files(destination_dir, pattern = "*")
++      path = @src_dir
++      return if path == destination_dir
++      File.chmod(0700, destination_dir)
++      mode = pattern == "bin/*" ? $script_mode : $data_mode
++      spec.files.each do |f|
++        src = File.join(path, f)
++        dest = File.join(without_destdir(destination_dir), f)
++        makedirs(dest[/.*(?=\/)/m])
++        install src, dest, :mode => mode
+       end
++      File.chmod($dir_mode, destination_dir)
+     end
++  end
+ 
+-    def initialize(spec, *options)
+-      super(spec.loaded_from, *options)
+-      @package.extend(DirPackage).spec = spec
+-    end
+-
++  class UnpackedInstaller < Gem::Installer
+     def write_cache_file
+     end
+ 
+@@ -890,7 +896,8 @@ def install_default_gem(dir, srcdir)
+     if File.directory?(ext = "#{gem_ext_dir}/#{spec.full_name}")
+       spec.extensions[0] ||= "-"
+     end
+-    ins = RbInstall::UnpackedInstaller.new(spec, options)
++    package = RbInstall::DirPackage.new spec
++    ins = RbInstall::UnpackedInstaller.new(package, options)
+     puts "#{INDENT}#{spec.name} #{spec.version}"
+     ins.install
+     File.chmod($data_mode, File.join(install_dir, "specifications", "#{spec.full_name}.gemspec"))
+-- 
+2.35.1
+

pkgs/development/libraries/SDL2/default.nix

@@ -22,6 +22,9 @@
 , waylandSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
 , wayland
 , wayland-protocols
+, drmSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
+, libdrm
+, mesa
 , libxkbcommon
 , dbusSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
 , dbus
@@ -92,7 +95,8 @@ stdenv.mkDerivation rec {
     ++ optional pulseaudioSupport libpulseaudio
     ++ optional udevSupport udev
     ++ optionals waylandSupport [ wayland wayland-protocols libxkbcommon ]
-    ++ optionals x11Support [ libICE libXi libXScrnSaver libXcursor libXinerama libXext libXrandr libXxf86vm ];
+    ++ optionals x11Support [ libICE libXi libXScrnSaver libXcursor libXinerama libXext libXrandr libXxf86vm ]
+    ++ optionals drmSupport [ libdrm mesa ];
 
   buildInputs = [ libiconv ]
     ++ dlopenBuildInputs

pkgs/development/libraries/audio/libopenmpt/default.nix

@@ -0,0 +1,66 @@
+{ config
+, lib
+, stdenv
+, fetchurl
+, zlib
+, pkg-config
+, mpg123
+, libogg
+, libvorbis
+, portaudio
+, libsndfile
+, flac
+, usePulseAudio ? config.pulseaudio or stdenv.isLinux
+, libpulseaudio
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libopenmpt";
+  version = "0.6.2";
+
+  outputs = [ "out" "dev" "bin" ];
+
+  src = fetchurl {
+    url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
+    sha256 = "1dp645gg6d3pzjh82srq1d7qvyxi5h22k7yfdjiyzbyry8pxdh2h";
+  };
+
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    zlib
+    mpg123
+    libogg
+    libvorbis
+    portaudio
+    libsndfile
+    flac
+  ] ++ lib.optional usePulseAudio libpulseaudio;
+
+  configureFlags = lib.optional (!usePulseAudio) "--without-pulseaudio";
+
+  doCheck = true;
+
+  postFixup = ''
+    moveToOutput share/doc $dev
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = with lib; {
+    description = "Cross-platform C++ and C library to decode tracked music files into a raw PCM audio stream";
+    longDescription = ''
+      libopenmpt is a cross-platform C++ and C library to decode tracked music files (modules) into a raw PCM audio stream.
+      openmpt123 is a cross-platform command-line or terminal based module file player.
+      libopenmpt is based on the player code of the OpenMPT project.
+    '';
+    homepage = "https://lib.openmpt.org/libopenmpt/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ OPNA2608 ];
+    platforms = platforms.unix;
+  };
+}

pkgs/development/libraries/audio/libopenmpt/update.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p common-updater-scripts curl xmlstarlet
+
+attr=libopenmpt
+
+set -eu -o pipefail
+
+# Get update notifications, remove updates for libopenmpt-modplug, find latest eligible & extract versions
+versions="$(
+  curl -s 'https://lib.openmpt.org/libopenmpt/feed.xml' |
+  xmlstarlet sel -N atom="http://www.w3.org/2005/Atom" -t -m /atom:feed/atom:entry -v atom:title -n |
+  grep -v 'libopenmpt-modplug' | head -n1 |
+  grep -Eo '([0-9][^,\s]+)' | tr '\n' ' '
+)"
+echo "Latest $attr versions: $versions"
+
+# Find a version that is > current version and not a rc
+# rc's have different download path and a full release will usually follow shortly
+currentVersion="$(nix-instantiate --eval -E "with import ./. {}; $attr.version" | tr -d '"')"
+echo "Current $attr version: $currentVersion"
+for version in $versions; do
+  (echo "$version" | grep -q 'rc') && continue
+  [ "$version" = "$(printf '%s\n%s' "$version" "$currentVersion" | sort -V | head -n1)" ] && continue
+
+  echo "Updating to $version. Please check if other versions qualify for backport to stable!"
+  update-source-version "$attr" "$version"
+  exit 0
+done
+
+echo "No version eligible for bump."
+exit 0