3p/nixpkgs: add patches to mercurial package

third_party/nixpkgs/patches/pr153718.patch

@@ -0,0 +1,37 @@
+From a8ef60565ac9dc3fe2c68dc6a7fb29765e8bc2cf Mon Sep 17 00:00:00 2001
+From: pacien <pacien.trangirard@pacien.net>
+Date: Thu, 6 Jan 2022 22:16:22 +0100
+Subject: [PATCH] mercurial: add CA cert to test env for libgit
+
+This seems to be required for the tests to pass on Hydra.
+
+Otherwise, the test suit fails with errors like:
+
+```
+feature pygit2 failed:  OpenSSL error: failed to load certificates:
+error:00000000:lib(0):func(0):reason(0)
+```
+---
+ pkgs/applications/version-management/mercurial/default.nix | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
+index a85844fff2163..c3c04da3a69a6 100644
+--- a/pkgs/applications/version-management/mercurial/default.nix
++++ b/pkgs/applications/version-management/mercurial/default.nix
+@@ -11,6 +11,7 @@
+ , which
+ , sqlite
+ , git
++, cacert
+ , gnupg
+ }:
+ 
+@@ -70,6 +71,7 @@ let
+       git
+       gnupg
+     ];
++    SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";  # needed for git
+     checkPhase = ''
+       cat << EOF > tests/blacklists/nix
+       # tests enforcing "/usr/bin/env" shebangs, which are patched for nix

third_party/nixpkgs/patches/pr153998.patch

@@ -0,0 +1,47 @@
+From a7f3bd4bf7ad413bb4fcfe9fdb1866cc9e1fb704 Mon Sep 17 00:00:00 2001
+From: pacien <pacien.trangirard@pacien.net>
+Date: Fri, 7 Jan 2022 16:42:56 +0100
+Subject: [PATCH 1/2] mercurial: add pacien as maintainer
+
+---
+ pkgs/applications/version-management/mercurial/default.nix | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
+index c3c04da3a69a6..b59bf1ff17e19 100644
+--- a/pkgs/applications/version-management/mercurial/default.nix
++++ b/pkgs/applications/version-management/mercurial/default.nix
+@@ -118,7 +118,7 @@ let
+       homepage = "https://www.mercurial-scm.org";
+       downloadPage = "https://www.mercurial-scm.org/release/";
+       license = licenses.gpl2Plus;
+-      maintainers = with maintainers; [ eelco lukegb ];
++      maintainers = with maintainers; [ eelco lukegb pacien ];
+       updateWalker = true;
+       platforms = platforms.unix;
+     };
+
+From 416883461db4d3b8d451155dd6b6886da876f16e Mon Sep 17 00:00:00 2001
+From: pacien <pacien.trangirard@pacien.net>
+Date: Sat, 8 Jan 2022 13:48:04 +0100
+Subject: [PATCH 2/2] mercurialFull: skip an unstable experimental test
+
+---
+ pkgs/applications/version-management/mercurial/default.nix | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
+index b59bf1ff17e19..cc00f68461be9 100644
+--- a/pkgs/applications/version-management/mercurial/default.nix
++++ b/pkgs/applications/version-management/mercurial/default.nix
+@@ -77,6 +77,10 @@ let
+       # tests enforcing "/usr/bin/env" shebangs, which are patched for nix
+       test-run-tests.t
+       test-check-shbang.t
++
++      # unstable experimental/unsupported features
++      # https://bz.mercurial-scm.org/show_bug.cgi?id=6633#c1
++      test-git-interop.t
+       EOF
+ 
+       # extended timeout necessary for tests to pass on the busy CI workers

third_party/nixpkgs/patches/pr154021.patch

@@ -0,0 +1,154 @@
+From d69abfe510c77fa4cd01346e155c8a6e0e6de920 Mon Sep 17 00:00:00 2001
+From: Luke Granger-Brown <git@lukegb.com>
+Date: Sat, 8 Jan 2022 15:59:29 +0000
+Subject: [PATCH] mercurial: move tests to passthru.tests
+
+They're very expensive to run, especially if you don't have that many
+cores, and can sometimes be a bit flaky (it looks like their CI doesn't
+run things under the same constraints as we tend to).
+
+Move them to a separate derivation, and make them test the actual
+installed output rather than the local copy.
+---
+ .../version-management/mercurial/default.nix  | 100 ++++++++++++------
+ 1 file changed, 65 insertions(+), 35 deletions(-)
+
+diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
+index cc00f68461be9..85993487fb37e 100644
+--- a/pkgs/applications/version-management/mercurial/default.nix
++++ b/pkgs/applications/version-management/mercurial/default.nix
+@@ -7,6 +7,7 @@
+ , highlightSupport ? fullBuild
+ , ApplicationServices
+ # test dependencies
++, runCommand
+ , unzip
+ , which
+ , sqlite
+@@ -39,15 +40,6 @@ let
+     } else null;
+     cargoRoot = if rustSupport then "rust" else null;
+ 
+-    postPatch = ''
+-      patchShebangs .
+-
+-      for f in **/*.{py,c,t}; do
+-        # not only used in shebangs
+-        substituteAllInPlace "$f" '/bin/sh' '${stdenv.shell}'
+-      done
+-    '';
+-
+     propagatedBuildInputs = lib.optional re2Support fb-re2
+       ++ lib.optional gitSupport pygit2
+       ++ lib.optional highlightSupport pygments;
+@@ -63,31 +55,6 @@ let
+     makeFlags = [ "PREFIX=$(out)" ]
+       ++ lib.optional rustSupport "PURE=--rust";
+ 
+-    doCheck = stdenv.isLinux;  # tests seem unstable on Darwin
+-    checkInputs = [
+-      unzip
+-      which
+-      sqlite
+-      git
+-      gnupg
+-    ];
+-    SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";  # needed for git
+-    checkPhase = ''
+-      cat << EOF > tests/blacklists/nix
+-      # tests enforcing "/usr/bin/env" shebangs, which are patched for nix
+-      test-run-tests.t
+-      test-check-shbang.t
+-
+-      # unstable experimental/unsupported features
+-      # https://bz.mercurial-scm.org/show_bug.cgi?id=6633#c1
+-      test-git-interop.t
+-      EOF
+-
+-      # extended timeout necessary for tests to pass on the busy CI workers
+-      export HGTESTFLAGS="--blacklist blacklists/nix --timeout 600"
+-      make check
+-    '';
+-
+     postInstall = (lib.optionalString guiSupport ''
+       mkdir -p $out/etc/mercurial
+       cp contrib/hgk $out/bin
+@@ -115,7 +82,9 @@ let
+         --zsh contrib/zsh_completion
+     '';
+ 
+-    passthru.tests = {};
++    passthru.tests = {
++      mercurial-tests = makeTests { flags = "--with-hg=$MERCURIAL_BASE/bin/hg"; };
++    };
+ 
+     meta = with lib; {
+       description = "A fast, lightweight SCM system for very large distributed projects";
+@@ -127,6 +96,67 @@ let
+       platforms = platforms.unix;
+     };
+   };
++
++  makeTests = { mercurial ? self, nameSuffix ? "", flags ? "" }: runCommand "${mercurial.pname}${nameSuffix}-tests" {
++    inherit (mercurial) src;
++
++    SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";  # needed for git
++    MERCURIAL_BASE = mercurial;
++    nativeBuildInputs = [
++      python
++      unzip
++      which
++      sqlite
++      git
++      gnupg
++    ];
++
++    postPatch = ''
++      patchShebangs .
++
++      for f in **/*.{py,c,t}; do
++        # not only used in shebangs
++        substituteAllInPlace "$f" '/bin/sh' '${stdenv.shell}'
++      done
++
++      for f in **/*.t; do
++        substituteInPlace 2>/dev/null "$f" \
++          --replace '*/hg:' '*/*hg*:' \${/* paths emitted by our wrapped hg look like ..hg-wrapped-wrapped */""}
++          --replace '"$PYTHON" "$BINDIR"/hg' '"$BINDIR"/hg' ${/* 'hg' is a wrapper; don't run using python directly */""}
++      done
++    '';
++
++    # This runs Mercurial _a lot_ of times.
++    requiredSystemFeatures = [ "big-parallel" ];
++
++    # Don't run tests if not-Linux or if cross-compiling.
++    meta.broken = !stdenv.hostPlatform.isLinux || stdenv.buildPlatform != stdenv.hostPlatform;
++  } ''
++    addToSearchPathWithCustomDelimiter : PYTHONPATH "${mercurial}/${python.sitePackages}"
++
++    unpackPhase
++    cd "$sourceRoot"
++    patchPhase
++
++    cat << EOF > tests/blacklists/nix
++    # tests enforcing "/usr/bin/env" shebangs, which are patched for nix
++    test-run-tests.t
++    test-check-shbang.t
++
++    # unstable experimental/unsupported features
++    # https://bz.mercurial-scm.org/show_bug.cgi?id=6633#c1
++    test-git-interop.t
++
++    # doesn't like the extra setlocale warnings emitted by our bash wrappers
++    test-locale.t
++    EOF
++
++    export HGTEST_REAL_HG="${mercurial}/bin/hg"
++    # extended timeout necessary for tests to pass on the busy CI workers
++    export HGTESTFLAGS="--blacklist blacklists/nix --timeout 1800 -j$NIX_BUILD_CORES ${flags}"
++    make check
++    touch $out
++  '';
+ in
+   self.overridePythonAttrs (origAttrs: {
+     passthru = origAttrs.passthru // rec {

third_party/nixpkgs/patches/series

@@ -1,3 +1,6 @@
 patch-cherrypy.patch
 pomerium-fix.patch
 pomerium-fix2.patch
+pr153718.patch
+pr153998.patch
+pr154021.patch