Project import generated by Copybara.

GitOrigin-RevId: ac169ec6371f0d835542db654a65e0f2feb07838

third_party/nixpkgs/doc/languages-frameworks/python.section.md

@@ -834,6 +834,7 @@ sets are
 * `pkgs.python38Packages`
 * `pkgs.python39Packages`
 * `pkgs.python310Packages`
+* `pkgs.python311Packages`
 * `pkgs.pypyPackages`
 
 and the aliases

third_party/nixpkgs/maintainers/maintainer-list.nix

@@ -119,6 +119,12 @@
     githubId = 241628;
     name = "Adam Russell";
   };
+  aadibajpai = {
+    email = "hello@aadibajpai.com";
+    github = "aadibajpai";
+    githubId = 27063113;
+    name = "Aadi Bajpai";
+  };
   aanderse = {
     email = "aaron@fosslib.net";
     matrix = "@aanderse:nixos.dev";

third_party/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml

@@ -190,6 +190,14 @@
           usage in non-X11 environments, e.g. Wayland.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>services.stubby</literal> module was converted to
+          a
+          <link xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md">settings-style</link>
+          configuration.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
 </section>

third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2205.section.md

@@ -78,3 +78,5 @@ In addition to numerous new and upgraded packages, this release has the followin
   added, decoupling the setting of `SSH_ASKPASS` from
   `services.xserver.enable`. This allows easy usage in non-X11 environments,
   e.g. Wayland.
+
+- The `services.stubby` module was converted to a [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration.

third_party/nixpkgs/nixos/modules/services/databases/mysql.nix

@@ -11,10 +11,8 @@ let
   mysqldOptions =
     "--user=${cfg.user} --datadir=${cfg.dataDir} --basedir=${cfg.package}";
 
-  settingsFile = pkgs.writeText "my.cnf" (
+  format = pkgs.formats.ini { listsAsDuplicateKeys = true; };
-    generators.toINI { listsAsDuplicateKeys = true; } cfg.settings +
+  configFile = format.generate "my.cnf" cfg.settings;
-    optionalString (cfg.extraOptions != null) "[mysqld]\n${cfg.extraOptions}"
-  );
 
 in
 
@@ -22,6 +20,9 @@ in
   imports = [
     (mkRemovedOptionModule [ "services" "mysql" "pidDir" ] "Don't wait for pidfiles, describe dependencies through systemd.")
     (mkRemovedOptionModule [ "services" "mysql" "rootPassword" ] "Use socket authentication or set the password outside of the nix store.")
+    (mkRemovedOptionModule [ "services" "mysql" "extraOptions" ] "Use services.mysql.settings.mysqld instead.")
+    (mkRemovedOptionModule [ "services" "mysql" "bind" ] "Use services.mysql.settings.mysqld.bind-address instead.")
+    (mkRemovedOptionModule [ "services" "mysql" "port" ] "Use services.mysql.settings.mysqld.port instead.")
   ];
 
   ###### interface
@@ -40,41 +41,53 @@ in
         ";
       };
 
-      bind = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "0.0.0.0";
-        description = "Address to bind to. The default is to bind to all addresses.";
-      };
-
-      port = mkOption {
-        type = types.port;
-        default = 3306;
-        description = "Port of MySQL.";
-      };
-
       user = mkOption {
         type = types.str;
         default = "mysql";
-        description = "User account under which MySQL runs.";
+        description = ''
+          User account under which MySQL runs.
+
+          <note><para>
+          If left as the default value this user will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the user exists before the MySQL service starts.
+          </para></note>
+        '';
       };
 
       group = mkOption {
         type = types.str;
         default = "mysql";
-        description = "Group under which MySQL runs.";
+        description = ''
+          Group account under which MySQL runs.
+
+          <note><para>
+          If left as the default value this group will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the user exists before the MySQL service starts.
+          </para></note>
+        '';
       };
 
       dataDir = mkOption {
         type = types.path;
         example = "/var/lib/mysql";
-        description = "Location where MySQL stores its table files.";
+        description = ''
+          The data directory for MySQL.
+
+          <note><para>
+          If left as the default value of <literal>/var/lib/mysql</literal> this directory will automatically be created before the MySQL
+          server starts, otherwise you are responsible for ensuring the directory exists with appropriate ownership and permissions.
+          </para></note>
+        '';
       };
 
       configFile = mkOption {
         type = types.path;
-        default = settingsFile;
+        default = configFile;
-        defaultText = literalExpression "settingsFile";
+        defaultText = ''
+          A configuration file automatically generated by NixOS.
+        '';
         description = ''
           Override the configuration file used by MySQL. By default,
           NixOS generates one automatically from <option>services.mysql.settings</option>.
@@ -92,7 +105,7 @@ in
       };
 
       settings = mkOption {
-        type = with types; attrsOf (attrsOf (oneOf [ bool int str (listOf str) ]));
+        type = format.type;
         default = {};
         description = ''
           MySQL configuration. Refer to
@@ -125,23 +138,6 @@ in
         '';
       };
 
-      extraOptions = mkOption {
-        type = with types; nullOr lines;
-        default = null;
-        example = ''
-          key_buffer_size = 6G
-          table_cache = 1600
-          log-error = /var/log/mysql_err.log
-        '';
-        description = ''
-          Provide extra options to the MySQL configuration file.
-
-          Please note, that these options are added to the
-          <literal>[mysqld]</literal> section so you don't need to explicitly
-          state it again.
-        '';
-      };
-
       initialDatabases = mkOption {
         type = types.listOf (types.submodule {
           options = {
@@ -287,7 +283,7 @@ in
         };
 
         masterPort = mkOption {
-          type = types.int;
+          type = types.port;
           default = 3306;
           description = "Port number on which the MySQL master server runs.";
         };
@@ -299,9 +295,7 @@ in
 
   ###### implementation
 
-  config = mkIf config.services.mysql.enable {
+  config = mkIf cfg.enable {
-
-    warnings = optional (cfg.extraOptions != null) "services.mysql.`extraOptions` is deprecated, please use services.mysql.`settings`.";
 
     services.mysql.dataDir =
       mkDefault (if versionAtLeast config.system.stateVersion "17.09" then "/var/lib/mysql"
@@ -310,8 +304,7 @@ in
     services.mysql.settings.mysqld = mkMerge [
       {
         datadir = cfg.dataDir;
-        bind-address = mkIf (cfg.bind != null) cfg.bind;
+        port = mkDefault 3306;
-        port = cfg.port;
       }
       (mkIf (cfg.replication.role == "master" || cfg.replication.role == "slave") {
         log-bin = "mysql-bin-${toString cfg.replication.serverId}";
@@ -341,21 +334,14 @@ in
 
     environment.etc."my.cnf".source = cfg.configFile;
 
-    systemd.tmpfiles.rules = [
+    systemd.services.mysql = {
-      "d '${cfg.dataDir}' 0700 '${cfg.user}' '${cfg.group}' - -"
-      "z '${cfg.dataDir}' 0700 '${cfg.user}' '${cfg.group}' - -"
-    ];
-
-    systemd.services.mysql = let
-      hasNotify = isMariaDB;
-    in {
       description = "MySQL Server";
 
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ cfg.configFile ];
 
-        unitConfig.RequiresMountsFor = "${cfg.dataDir}";
+      unitConfig.RequiresMountsFor = cfg.dataDir;
 
       path = [
         # Needed for the mysql_install_db command in the preStart script
@@ -391,7 +377,7 @@ in
         # The super user account to use on *first* run of MySQL server
         superUser = if isMariaDB then cfg.user else "root";
       in ''
-          ${optionalString (!hasNotify) ''
+        ${optionalString (!isMariaDB) ''
           # Wait until the MySQL server is available for use
           count=0
           while [ ! -e /run/mysqld/mysqld.sock ]
@@ -489,8 +475,9 @@ in
           '') cfg.ensureUsers}
       '';
 
-        serviceConfig = {
+      serviceConfig = mkMerge [
-          Type = if hasNotify then "notify" else "simple";
+        {
+          Type = if isMariaDB then "notify" else "simple";
           Restart = "on-abort";
           RestartSec = "5s";
 
@@ -523,9 +510,12 @@ in
           PrivateMounts = true;
           # System Call Filtering
           SystemCallArchitectures = "native";
-        };
+        }
-      };
+        (mkIf (cfg.dataDir == "/var/lib/mysql") {
-
+          StateDirectory = "mysql";
-  };
+          StateDirectoryMode = "0700";
-
+        })
+      ];
+    };
+  };
 }

third_party/nixpkgs/nixos/modules/services/networking/stubby.nix

@@ -4,177 +4,48 @@ with lib;
 
 let
   cfg = config.services.stubby;
+  settingsFormat = pkgs.formats.yaml { };
+  confFile = settingsFormat.generate "stubby.yml" cfg.settings;
+in {
+  imports = map (x:
+    (mkRemovedOptionModule [ "services" "stubby" x ]
+      "Stubby configuration moved to services.stubby.settings.")) [
+        "authenticationMode"
+        "fallbackProtocols"
+        "idleTimeout"
+        "listenAddresses"
+        "queryPaddingBlocksize"
+        "roundRobinUpstreams"
+        "subnetPrivate"
+        "upstreamServers"
+      ];
 
-  fallbacks = concatMapStringsSep "\n  " (x: "- ${x}") cfg.fallbackProtocols;
-  listeners = concatMapStringsSep "\n  " (x: "- ${x}") cfg.listenAddresses;
-
-  # By default, the recursive resolvers maintained by the getdns
-  # project itself are enabled. More information about both getdns's servers,
-  # as well as third party options for upstream resolvers, can be found here:
-  # https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers
-  #
-  # You can override these values by supplying a yaml-formatted array of your
-  # preferred upstream resolvers in the following format:
-  #
-  # 106 # - address_data: IPv4 or IPv6 address of the upstream
-  #   port: Port for UDP/TCP (default is 53)
-  #   tls_auth_name: Authentication domain name checked against the server
-  #                  certificate
-  #   tls_pubkey_pinset: An SPKI pinset verified against the keys in the server
-  #                      certificate
-  #     - digest: Only "sha256" is currently supported
-  #       value: Base64 encoded value of the sha256 fingerprint of the public
-  #              key
-  #   tls_port: Port for TLS (default is 853)
-
-  defaultUpstream = ''
-    - address_data: 145.100.185.15
-      tls_auth_name: "dnsovertls.sinodun.com"
-      tls_pubkey_pinset:
-        - digest: "sha256"
-          value: 62lKu9HsDVbyiPenApnc4sfmSYTHOVfFgL3pyB+cBL4=
-    - address_data: 145.100.185.16
-      tls_auth_name: "dnsovertls1.sinodun.com"
-      tls_pubkey_pinset:
-        - digest: "sha256"
-          value: cE2ecALeE5B+urJhDrJlVFmf38cJLAvqekONvjvpqUA=
-    - address_data: 185.49.141.37
-      tls_auth_name: "getdnsapi.net"
-      tls_pubkey_pinset:
-        - digest: "sha256"
-          value: foxZRnIh9gZpWnl+zEiKa0EJ2rdCGroMWm02gaxSc9Q=
-    - address_data: 2001:610:1:40ba:145:100:185:15
-      tls_auth_name: "dnsovertls.sinodun.com"
-      tls_pubkey_pinset:
-        - digest: "sha256"
-          value: 62lKu9HsDVbyiPenApnc4sfmSYTHOVfFgL3pyB+cBL4=
-    - address_data: 2001:610:1:40ba:145:100:185:16
-      tls_auth_name: "dnsovertls1.sinodun.com"
-      tls_pubkey_pinset:
-        - digest: "sha256"
-          value: cE2ecALeE5B+urJhDrJlVFmf38cJLAvqekONvjvpqUA=
-    - address_data: 2a04:b900:0:100::38
-      tls_auth_name: "getdnsapi.net"
-      tls_pubkey_pinset:
-        - digest: "sha256"
-          value: foxZRnIh9gZpWnl+zEiKa0EJ2rdCGroMWm02gaxSc9Q=
-  '';
-
-  # Resolution type is not changeable here because it is required per the
-  # stubby documentation:
-  #
-  # "resolution_type: Work in stub mode only (not recursive mode) - required for Stubby
-  # operation."
-  #
-  # https://dnsprivacy.org/wiki/display/DP/Configuring+Stubby
-
-  confFile = pkgs.writeText "stubby.yml" ''
-    resolution_type: GETDNS_RESOLUTION_STUB
-    dns_transport_list:
-      ${fallbacks}
-    appdata_dir: "/var/cache/stubby"
-    tls_authentication: ${cfg.authenticationMode}
-    tls_query_padding_blocksize: ${toString cfg.queryPaddingBlocksize}
-    edns_client_subnet_private: ${if cfg.subnetPrivate then "1" else "0"}
-    idle_timeout: ${toString cfg.idleTimeout}
-    listen_addresses:
-      ${listeners}
-    round_robin_upstreams: ${if cfg.roundRobinUpstreams then "1" else "0"}
-    ${cfg.extraConfig}
-    upstream_recursive_servers:
-    ${cfg.upstreamServers}
-  '';
-in
-
-{
   options = {
     services.stubby = {
 
       enable = mkEnableOption "Stubby DNS resolver";
 
-      fallbackProtocols = mkOption {
+      settings = mkOption {
-        default = [ "GETDNS_TRANSPORT_TLS" ];
+        type = types.attrsOf settingsFormat.type;
-        type = with types; listOf (enum [
+        example = lib.literalExpression ''
-          "GETDNS_TRANSPORT_TLS"
+          pkgs.stubby.passthru.settingsExample // {
-          "GETDNS_TRANSPORT_TCP"
+            upstream_recursive_servers = [{
-          "GETDNS_TRANSPORT_UDP"
+              address_data = "158.64.1.29";
-        ]);
+              tls_auth_name = "kaitain.restena.lu";
-        description = ''
+              tls_pubkey_pinset = [{
-          Ordered list composed of one or more transport protocols.
+                digest = "sha256";
-          Strict mode should only use <literal>GETDNS_TRANSPORT_TLS</literal>.
+                value = "7ftvIkA+UeN/ktVkovd/7rPZ6mbkhVI7/8HnFJIiLa4=";
-          Other options are <literal>GETDNS_TRANSPORT_UDP</literal> and
+              }];
-          <literal>GETDNS_TRANSPORT_TCP</literal>.
+            }];
+          };
         '';
-      };
-
-      authenticationMode = mkOption {
-        default = "GETDNS_AUTHENTICATION_REQUIRED";
-        type = types.enum [
-          "GETDNS_AUTHENTICATION_REQUIRED"
-          "GETDNS_AUTHENTICATION_NONE"
-        ];
         description = ''
-          Selects the Strict or Opportunistic usage profile.
+          Content of the Stubby configuration file. All Stubby settings may be set or queried
-          For strict, set to <literal>GETDNS_AUTHENTICATION_REQUIRED</literal>.
+          here. The default settings are available at
-          for opportunistic, use <literal>GETDNS_AUTHENTICATION_NONE</literal>.
+          <literal>pkgs.stubby.passthru.settingsExample</literal>. See
-        '';
+          <link xlink:href="https://dnsprivacy.org/wiki/display/DP/Configuring+Stubby"/>.
-      };
+          A list of the public recursive servers can be found here:
-
+          <link xlink:href="https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers"/>.
-      queryPaddingBlocksize = mkOption {
-        default = 128;
-        type = types.int;
-        description = ''
-          EDNS0 option to pad the size of the DNS query to the given blocksize.
-        '';
-      };
-
-      subnetPrivate = mkOption {
-        default = true;
-        type = types.bool;
-        description = ''
-          EDNS0 option for ECS client privacy. Default is
-          <literal>true</literal>. If set, this option prevents the client
-          subnet from being sent to authoritative nameservers.
-        '';
-      };
-
-      idleTimeout = mkOption {
-        default = 10000;
-        type = types.int;
-        description = "EDNS0 option for keepalive idle timeout expressed in
-        milliseconds.";
-      };
-
-      listenAddresses = mkOption {
-        default = [ "127.0.0.1" "0::1" ];
-        type = with types; listOf str;
-        description = ''
-          Sets the listen address for the stubby daemon.
-          Uses port 53 by default.
-          Ise IP@port to specify a different port.
-        '';
-      };
-
-      roundRobinUpstreams = mkOption {
-        default = true;
-        type = types.bool;
-        description = ''
-          Instructs stubby to distribute queries across all available name
-          servers. Default is <literal>true</literal>. Set to
-          <literal>false</literal> in order to use the first available.
-        '';
-      };
-
-      upstreamServers = mkOption {
-        default = defaultUpstream;
-        type = types.lines;
-        description = ''
-          Replace default upstreams. See <citerefentry><refentrytitle>stubby
-          </refentrytitle><manvolnum>1</manvolnum></citerefentry> for an
-          example of the entry formatting. In Strict mode, at least one of the
-          following settings must be supplied for each nameserver:
-          <literal>tls_auth_name</literal> or
-          <literal>tls_pubkey_pinset</literal>.
         '';
       };
 
@@ -184,20 +55,21 @@ in
         description = "Enable or disable debug level logging.";
       };
 
-      extraConfig = mkOption {
-        default = "";
-        type = types.lines;
-        description = ''
-          Add additional configuration options. see <citerefentry>
-          <refentrytitle>stubby</refentrytitle><manvolnum>1</manvolnum>
-          </citerefentry>for more options.
-        '';
-      };
     };
   };
 
   config = mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.stubby ];
+    assertions = [{
+      assertion =
+        (cfg.settings.resolution_type or "") == "GETDNS_RESOLUTION_STUB";
+      message = ''
+        services.stubby.settings.resolution_type must be set to "GETDNS_RESOLUTION_STUB".
+        Is services.stubby.settings unset?
+      '';
+    }];
+
+    services.stubby.settings.appdata_dir = "/var/cache/stubby";
+
     systemd.services.stubby = {
       description = "Stubby local DNS resolver";
       after = [ "network.target" ];

third_party/nixpkgs/nixos/modules/services/web-servers/caddy/default.nix

@@ -4,159 +4,81 @@ with lib;
 
 let
   cfg = config.services.caddy;
-  vhostToConfig = vhostName: vhostAttrs: ''
-    ${vhostName} ${builtins.concatStringsSep " " vhostAttrs.serverAliases} {
-      ${vhostAttrs.extraConfig}
-    }
-  '';
-  configFile = pkgs.writeText "Caddyfile" (builtins.concatStringsSep "\n"
-    ([ cfg.config ] ++ (mapAttrsToList vhostToConfig cfg.virtualHosts)));
 
-  formattedConfig = pkgs.runCommand "formattedCaddyFile" { } ''
+  virtualHosts = attrValues cfg.virtualHosts;
-    ${cfg.package}/bin/caddy fmt ${configFile} > $out
+  acmeVHosts = filter (hostOpts: hostOpts.useACMEHost != null) virtualHosts;
-  '';
 
-  tlsConfig = {
+  mkVHostConf = hostOpts:
-    apps.tls.automation.policies = [{
+    let
-      issuers = [{
+      sslCertDir = config.security.acme.certs.${hostOpts.useACMEHost}.directory;
-        inherit (cfg) ca email;
-        module = "acme";
-      }];
-    }];
-  };
-
-  adaptedConfig = pkgs.runCommand "caddy-config-adapted.json" { } ''
-    ${cfg.package}/bin/caddy adapt \
-      --config ${formattedConfig} --adapter ${cfg.adapter} > $out
-  '';
-  tlsJSON = pkgs.writeText "tls.json" (builtins.toJSON tlsConfig);
-
-  # merge the TLS config options we expose with the ones originating in the Caddyfile
-  configJSON =
-    if cfg.ca != null then
-      let tlsConfigMerge = ''
-        {"apps":
-          {"tls":
-            {"automation":
-              {"policies":
-                (if .[0].apps.tls.automation.policies == .[1]?.apps.tls.automation.policies
-                 then .[0].apps.tls.automation.policies
-                 else (.[0].apps.tls.automation.policies + .[1]?.apps.tls.automation.policies)
-                 end)
-              }
-            }
-          }
-        }'';
     in
-      pkgs.runCommand "caddy-config.json" { } ''
-        ${pkgs.jq}/bin/jq -s '.[0] * ${tlsConfigMerge}' ${adaptedConfig} ${tlsJSON} > $out
       ''
-    else
+        ${hostOpts.hostName} ${concatStringsSep " " hostOpts.serverAliases} {
-      adaptedConfig;
+          bind ${concatStringsSep " " hostOpts.listenAddresses}
+          ${optionalString (hostOpts.useACMEHost != null) "tls ${sslCertDir}/cert.pem ${sslCertDir}/key.pem"}
+          log {
+            ${hostOpts.logFormat}
+          }
+
+          ${hostOpts.extraConfig}
+        }
+      '';
+
+  configFile =
+    let
+      Caddyfile = pkgs.writeText "Caddyfile" ''
+        {
+          ${optionalString (cfg.email != null) "email ${cfg.email}"}
+          ${optionalString (cfg.acmeCA != null) "acme_ca ${cfg.acmeCA}"}
+          log {
+            ${cfg.logFormat}
+          }
+        }
+        ${cfg.extraConfig}
+      '';
+
+      Caddyfile-formatted = pkgs.runCommand "Caddyfile-formatted" { nativeBuildInputs = [ cfg.package ]; } ''
+        ${cfg.package}/bin/caddy fmt ${Caddyfile} > $out
+      '';
+    in
+      if pkgs.stdenv.buildPlatform == pkgs.stdenv.hostPlatform then Caddyfile-formatted else Caddyfile;
 in
 {
   imports = [
     (mkRemovedOptionModule [ "services" "caddy" "agree" ] "this option is no longer necessary for Caddy 2")
+    (mkRenamedOptionModule [ "services" "caddy" "ca" ] [ "services" "caddy" "acmeCA" ])
+    (mkRenamedOptionModule [ "services" "caddy" "config" ] [ "services" "caddy" "extraConfig" ])
   ];
 
+  # interface
   options.services.caddy = {
     enable = mkEnableOption "Caddy web server";
 
-    config = mkOption {
-      default = "";
-      example = ''
-        example.com {
-          encode gzip
-          log
-          root /srv/http
-        }
-      '';
-      type = types.lines;
-      description = ''
-        Verbatim Caddyfile to use.
-        Caddy v2 supports multiple config formats via adapters (see <option>services.caddy.adapter</option>).
-      '';
-    };
-
-    virtualHosts = mkOption {
-      type = types.attrsOf (types.submodule (import ./vhost-options.nix {
-        inherit config lib;
-      }));
-      default = { };
-      example = literalExpression ''
-        {
-          "hydra.example.com" = {
-            serverAliases = [ "www.hydra.example.com" ];
-            extraConfig = ''''''
-              encode gzip
-              log
-              root /srv/http
-            '''''';
-          };
-        };
-      '';
-      description = "Declarative vhost config";
-    };
-
-
     user = mkOption {
       default = "caddy";
       type = types.str;
-      description = "User account under which caddy runs.";
+      description = ''
+        User account under which caddy runs.
+
+        <note><para>
+          If left as the default value this user will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the user exists before the Caddy service starts.
+        </para></note>
+      '';
     };
 
     group = mkOption {
       default = "caddy";
       type = types.str;
-      description = "Group account under which caddy runs.";
-    };
-
-    adapter = mkOption {
-      default = "caddyfile";
-      example = "nginx";
-      type = types.str;
       description = ''
-        Name of the config adapter to use.
+        Group account under which caddy runs.
-        See https://caddyserver.com/docs/config-adapters for the full list.
-      '';
-    };
 
-    resume = mkOption {
+        <note><para>
-      default = false;
+          If left as the default value this user will automatically be created
-      type = types.bool;
+          on system activation, otherwise you are responsible for
-      description = ''
+          ensuring the user exists before the Caddy service starts.
-        Use saved config, if any (and prefer over configuration passed with <option>services.caddy.config</option>).
+        </para></note>
-      '';
-    };
-
-    ca = mkOption {
-      default = "https://acme-v02.api.letsencrypt.org/directory";
-      example = "https://acme-staging-v02.api.letsencrypt.org/directory";
-      type = types.nullOr types.str;
-      description = ''
-        Certificate authority ACME server. The default (Let's Encrypt
-        production server) should be fine for most people. Set it to null if
-        you don't want to include any authority (or if you want to write a more
-        fine-graned configuration manually)
-      '';
-    };
-
-    email = mkOption {
-      default = "";
-      type = types.str;
-      description = "Email address (for Let's Encrypt certificate)";
-    };
-
-    dataDir = mkOption {
-      default = "/var/lib/caddy";
-      type = types.path;
-      description = ''
-        The data directory, for storing certificates. Before 17.09, this
-        would create a .caddy directory. With 17.09 the contents of the
-        .caddy directory are in the specified data directory instead.
-
-        Caddy v2 replaced CADDYPATH with XDG directories.
-        See https://caddyserver.com/docs/conventions#file-locations.
       '';
     };
 
@@ -168,11 +90,176 @@ in
         Caddy package to use.
       '';
     };
+
+    dataDir = mkOption {
+      type = types.path;
+      default = "/var/lib/caddy";
+      description = ''
+        The data directory for caddy.
+
+        <note>
+          <para>
+            If left as the default value this directory will automatically be created
+            before the Caddy server starts, otherwise you are responsible for ensuring
+            the directory exists with appropriate ownership and permissions.
+          </para>
+          <para>
+            Caddy v2 replaced <literal>CADDYPATH</literal> with XDG directories.
+            See <link xlink:href="https://caddyserver.com/docs/conventions#file-locations"/>.
+          </para>
+        </note>
+      '';
     };
 
+    logDir = mkOption {
+      type = types.path;
+      default = "/var/log/caddy";
+      description = ''
+        Directory for storing Caddy access logs.
+
+        <note><para>
+          If left as the default value this directory will automatically be created
+          before the Caddy server starts, otherwise the sysadmin is responsible for
+          ensuring the directory exists with appropriate ownership and permissions.
+        </para></note>
+      '';
+    };
+
+    logFormat = mkOption {
+      type = types.lines;
+      default = ''
+        level ERROR
+      '';
+      example = literalExpression ''
+        mkForce "level INFO";
+      '';
+      description = ''
+        Configuration for the default logger. See
+        <link xlink:href="https://caddyserver.com/docs/caddyfile/options#log"/>
+        for details.
+      '';
+    };
+
+    configFile = mkOption {
+      type = types.path;
+      default = configFile;
+      defaultText = "A Caddyfile automatically generated by values from services.caddy.*";
+      example = literalExpression ''
+        pkgs.writeText "Caddyfile" '''
+          example.com
+
+          root * /var/www/wordpress
+          php_fastcgi unix//run/php/php-version-fpm.sock
+          file_server
+        ''';
+      '';
+      description = ''
+        Override the configuration file used by Caddy. By default,
+        NixOS generates one automatically.
+      '';
+    };
+
+    adapter = mkOption {
+      default = "caddyfile";
+      example = "nginx";
+      type = types.str;
+      description = ''
+        Name of the config adapter to use.
+        See <link xlink:href="https://caddyserver.com/docs/config-adapters"/>
+        for the full list.
+
+        <note><para>
+          Any value other than <literal>caddyfile</literal> is only valid when
+          providing your own <option>configFile</option>.
+        </para></note>
+      '';
+    };
+
+    resume = mkOption {
+      default = false;
+      type = types.bool;
+      description = ''
+        Use saved config, if any (and prefer over any specified configuration passed with <literal>--config</literal>).
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      example = ''
+        example.com {
+          encode gzip
+          log
+          root /srv/http
+        }
+      '';
+      description = ''
+        Additional lines of configuration appended to the automatically
+        generated <literal>Caddyfile</literal>.
+      '';
+    };
+
+    virtualHosts = mkOption {
+      type = with types; attrsOf (submodule (import ./vhost-options.nix { inherit cfg; }));
+      default = {};
+      example = literalExpression ''
+        {
+          "hydra.example.com" = {
+            serverAliases = [ "www.hydra.example.com" ];
+            extraConfig = '''
+              encode gzip
+              root /srv/http
+            ''';
+          };
+        };
+      '';
+      description = ''
+        Declarative specification of virtual hosts served by Caddy.
+      '';
+    };
+
+    acmeCA = mkOption {
+      default = "https://acme-v02.api.letsencrypt.org/directory";
+      example = "https://acme-staging-v02.api.letsencrypt.org/directory";
+      type = with types; nullOr str;
+      description = ''
+        The URL to the ACME CA's directory. It is strongly recommended to set
+        this to Let's Encrypt's staging endpoint for testing or development.
+
+        Set it to <literal>null</literal> if you want to write a more
+        fine-grained configuration manually.
+      '';
+    };
+
+    email = mkOption {
+      default = null;
+      type = with types; nullOr str;
+      description = ''
+        Your email address. Mainly used when creating an ACME account with your
+        CA, and is highly recommended in case there are problems with your
+        certificates.
+      '';
+    };
+
+  };
+
+  # implementation
   config = mkIf cfg.enable {
+
+    assertions = [
+      { assertion = cfg.adapter != "caddyfile" -> cfg.configFile != configFile;
+        message = "Any value other than 'caddyfile' is only valid when providing your own `services.caddy.configFile`";
+      }
+    ];
+
+    services.caddy.extraConfig = concatMapStringsSep "\n" mkVHostConf virtualHosts;
+
     systemd.packages = [ cfg.package ];
     systemd.services.caddy = {
+      wants = map (hostOpts: "acme-finished-${hostOpts.useACMEHost}.target") acmeVHosts;
+      after = map (hostOpts: "acme-selfsigned-${hostOpts.useACMEHost}.service") acmeVHosts;
+      before = map (hostOpts: "acme-${hostOpts.useACMEHost}.service") acmeVHosts;
+
       wantedBy = [ "multi-user.target" ];
       startLimitIntervalSec = 14400;
       startLimitBurst = 10;
@@ -180,13 +267,17 @@ in
       serviceConfig = {
         # https://www.freedesktop.org/software/systemd/man/systemd.service.html#ExecStart=
         # If the empty string is assigned to this option, the list of commands to start is reset, prior assignments of this option will have no effect.
-        ExecStart = [ "" "${cfg.package}/bin/caddy run ${optionalString cfg.resume "--resume"} --config ${configJSON}" ];
+        ExecStart = [ "" "${cfg.package}/bin/caddy run --config ${cfg.configFile} --adapter ${cfg.adapter} ${optionalString cfg.resume "--resume"}" ];
-        ExecReload = [ "" "${cfg.package}/bin/caddy reload --config ${configJSON}" ];
+        ExecReload = [ "" "${cfg.package}/bin/caddy reload --config ${cfg.configFile} --adapter ${cfg.adapter}" ];
 
+        ExecStartPre = "${cfg.package}/bin/caddy validate --config ${cfg.configFile} --adapter ${cfg.adapter}";
         User = cfg.user;
         Group = cfg.group;
         ReadWriteDirectories = cfg.dataDir;
+        StateDirectory = mkIf (cfg.dataDir == "/var/lib/caddy") [ "caddy" ];
+        LogsDirectory = mkIf (cfg.logDir == "/var/log/caddy") [ "caddy" ];
         Restart = "on-abnormal";
+        SupplementaryGroups = mkIf (length acmeVHosts != 0) [ "acme" ];
 
         # TODO: attempt to upstream these options
         NoNewPrivileges = true;
@@ -200,7 +291,6 @@ in
         group = cfg.group;
         uid = config.ids.uids.caddy;
         home = cfg.dataDir;
-        createHome = true;
       };
     };
 
@@ -208,5 +298,12 @@ in
       caddy.gid = config.ids.gids.caddy;
     };
 
+    security.acme.certs =
+      let
+        eachACMEHost = unique (catAttrs "useACMEHost" acmeVHosts);
+        reloads = map (useACMEHost: nameValuePair useACMEHost { reloadServices = [ "caddy.service" ]; }) eachACMEHost;
+      in
+        listToAttrs reloads;
+
   };
 }

third_party/nixpkgs/nixos/modules/services/web-servers/caddy/vhost-options.nix

@@ -1,15 +1,19 @@
-# This file defines the options that can be used both for the Nginx
+{ cfg }:
-# main server configuration, and for the virtual hosts.  (The latter
+{ config, lib, name, ... }:
-# has additional options that affect the web server as a whole, like
+let
-# the user/group to run under.)
+  inherit (lib) literalExpression mkOption types;
-
+in
-{ lib, ... }:
-
-with lib;
 {
   options = {
+
+    hostName = mkOption {
+      type = types.str;
+      default = name;
+      description = "Canonical hostname for the server.";
+    };
+
     serverAliases = mkOption {
-      type = types.listOf types.str;
+      type = with types; listOf str;
       default = [ ];
       example = [ "www.example.org" "example.org" ];
       description = ''
@@ -17,12 +21,59 @@ with lib;
       '';
     };
 
+    listenAddresses = mkOption {
+      type = with types; listOf str;
+      description = ''
+        A list of host interfaces to bind to for this virtual host.
+      '';
+      default = [ ];
+      example = [ "127.0.0.1" "::1" ];
+    };
+
+    useACMEHost = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        A host of an existing Let's Encrypt certificate to use.
+        This is mostly useful if you use DNS challenges but Caddy does not
+        currently support your provider.
+
+        <emphasis>Note that this option does not create any certificates, nor
+        does it add subdomains to existing ones – you will need to create them
+        manually using <xref linkend="opt-security.acme.certs"/>. Additionally,
+        you should probably add the <literal>caddy</literal> user to the
+        <literal>acme</literal> group to grant access to the certificates.</emphasis>
+      '';
+    };
+
+    logFormat = mkOption {
+      type = types.lines;
+      default = ''
+        output file ${cfg.logDir}/access-${config.hostName}.log
+      '';
+      defaultText = ''
+        output file ''${config.services.caddy.logDir}/access-''${hostName}.log
+      '';
+      example = literalExpression ''
+        mkForce '''
+          output discard
+        ''';
+      '';
+      description = ''
+        Configuration for HTTP request logging (also known as access logs). See
+        <link xlink:href="https://caddyserver.com/docs/caddyfile/directives/log#log"/>
+        for details.
+      '';
+    };
+
     extraConfig = mkOption {
       type = types.lines;
       default = "";
       description = ''
-        These lines go into the vhost verbatim
+        Additional lines of configuration appended to this virtual host in the
+        automatically generated <literal>Caddyfile</literal>.
       '';
     };
+
   };
 }

third_party/nixpkgs/nixos/modules/virtualisation/kubevirt.nix

@@ -0,0 +1,30 @@
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    ../profiles/qemu-guest.nix
+  ];
+
+  config = {
+    fileSystems."/" = {
+      device = "/dev/disk/by-label/nixos";
+      fsType = "ext4";
+      autoResize = true;
+    };
+
+    boot.growPartition = true;
+    boot.kernelParams = [ "console=ttyS0" ];
+    boot.loader.grub.device = "/dev/vda";
+    boot.loader.timeout = 0;
+
+    services.qemuGuest.enable = true;
+    services.openssh.enable = true;
+    services.cloud-init.enable = true;
+    systemd.services."serial-getty@ttyS0".enable = true;
+
+    system.build.kubevirtImage = import ../../lib/make-disk-image.nix {
+      inherit lib config pkgs;
+      format = "qcow2";
+    };
+  };
+}

third_party/nixpkgs/pkgs/applications/audio/lsp-plugins/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lsp-plugins";
-  version = "1.1.30";
+  version = "1.1.31";
 
   src = fetchFromGitHub {
     owner = "sadko4u";
     repo = pname;
     rev = version;
-    sha256 = "0g0nx05dyjwz2149v3pj6sa9divr26jyqvg2kk1qk48s2n4najkz";
+    sha256 = "sha256-P1woSkenSlVUwWr3q0sNv8K2fVtTa6zWwKfSHQgg9Xw=";
   };
 
   nativeBuildInputs = [ pkg-config php makeWrapper ];

third_party/nixpkgs/pkgs/applications/audio/ocenaudio/default.nix

@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ocenaudio";
-  version = "3.11.1";
+  version = "3.11.2";
 
   src = fetchurl {
     url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian9_64.deb?version=${version}";
-    sha256 = "sha256-m8sKu2QuEyCWQ975vDfLVWKgU7ydEp5/vRYRO3z1yio=";
+    sha256 = "sha256-kvmBOw8fQZSC1jC8FRVq4v+i7mM6ol2IrDTqfJtuZYc=";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/blockchains/alfis/default.nix

@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "alfis";
-  version = "0.6.9";
+  version = "0.6.10";
 
   src = fetchFromGitHub {
     owner = "Revertron";
     repo = "Alfis";
     rev = "v${version}";
-    sha256 = "1nnzy46hp1q9kcxzjx24d60frjhn3x46nksbqvdfcfrfn5pqrabh";
+    sha256 = "sha256-JJTU3wZ3cG5TmgHYShWJaNAZBA4z3qZXPfb7WUX6/80=";
   };
 
-  cargoSha256 = "02liz8sqnqla77bqxfa8hj93qfj2x482q2bijz66rmazfig3b045";
+  cargoSha256 = "sha256-BsFe1Fp+Q5Gqa1w4xov0tVLDKV7S+6b5fKBl09ggLB0=";
 
   checkFlags = [
     # these want internet access, disable them

third_party/nixpkgs/pkgs/applications/editors/deadpixi-sam/default.nix

@@ -1,20 +1,20 @@
 { lib, stdenv, fetchFromGitHub, freetype, libX11, libXi, libXt, libXft }:
 
 stdenv.mkDerivation rec {
-  version = "2017-10-27";
   pname = "deadpixi-sam-unstable";
+  version = "2020-07-14";
 
   src = fetchFromGitHub {
     owner = "deadpixi";
     repo = "sam";
-    rev = "51693780fb1457913389db6634163998f9b775b8";
+    rev = "5d8acb35d78c327d76f00a54857cbd566ed9bc11";
-    sha256 = "0nfkj93j4bgli4ixbk041nwi14rabk04kqg8krq4mj0044m1qywr";
+    sha256 = "sha256-+vRh6nDPc3UnmEdqROHRel5Te0h5m4eiaERs492xciQ=";
   };
 
   postPatch = ''
     substituteInPlace config.mk.def \
       --replace "/usr/include/freetype2" "${freetype.dev}/include/freetype2" \
-      --replace "CC=gcc" ""
+      --replace "CC=gcc" "CC=${stdenv.cc.targetPrefix}cc"
   '';
 
   CFLAGS = "-D_DARWIN_C_SOURCE";
@@ -27,10 +27,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    inherit (src.meta) homepage;
+    homepage = "https://github.com/deadpixi/sam";
     description = "Updated version of the sam text editor";
-    license = with licenses; lpl-102;
+    license = licenses.lpl-102;
     maintainers = with maintainers; [ ramkromberg ];
-    platforms = with platforms; unix;
+    platforms = platforms.unix;
   };
 }

third_party/nixpkgs/pkgs/applications/editors/jetbrains/default.nix

@@ -247,12 +247,12 @@ in
 
   clion = buildClion rec {
     name = "clion-${version}";
-    version = "2021.3"; /* updated by script */
+    version = "2021.3.1"; /* updated by script */
     description  = "C/C++ IDE. New. Intelligent. Cross-platform";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "0rvq0k99c4kniw2k0a8m2hq27v9nvn7qg6yg9dwxlmadsrx6as29"; /* updated by script */
+      sha256 = "0nf1r02i51pplrazlyavc6xs6mi91spa92srfqpsgb78ar9vn027"; /* updated by script */
     };
     wmClass = "jetbrains-clion";
     update-channel = "CLion RELEASE"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
@@ -260,12 +260,12 @@ in
 
   datagrip = buildDataGrip rec {
     name = "datagrip-${version}";
-    version = "2021.3.1"; /* updated by script */
+    version = "2021.3.2"; /* updated by script */
     description = "Your Swiss Army Knife for Databases and SQL";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/datagrip/${name}.tar.gz";
-      sha256 = "18drbddcjbbv6q6j95wy7ila8d7imi0gh5nnf0lhj4gkkxhszmii"; /* updated by script */
+      sha256 = "0m0nc988w2a2p0l3a9cirnk2vbrsas4wb3fc4pwiml5bz5vwh255"; /* updated by script */
     };
     wmClass = "jetbrains-datagrip";
     update-channel = "DataGrip RELEASE";
@@ -273,12 +273,12 @@ in
 
   goland = buildGoland rec {
     name = "goland-${version}";
-    version = "2021.3"; /* updated by script */
+    version = "2021.3.1"; /* updated by script */
     description = "Up and Coming Go IDE";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "0bdsvfsx0vhmvlqvy9phw6yz98la8qw2avm4p0yl9j8y9zplbhl0"; /* updated by script */
+      sha256 = "1kl1sg2fjh8wpx47984vw6zrqf7nakbji606cl52brkxik7py0d3"; /* updated by script */
     };
     wmClass = "jetbrains-goland";
     update-channel = "GoLand RELEASE";
@@ -365,12 +365,12 @@ in
 
   rider = buildRider rec {
     name = "rider-${version}";
-    version = "2021.3.1"; /* updated by script */
+    version = "2021.3.2"; /* updated by script */
     description = "A cross-platform .NET IDE based on the IntelliJ platform and ReSharper";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/rider/JetBrains.Rider-${version}.tar.gz";
-      sha256 = "0c788xvcd5b9jafz2yyllj1pzgc9ry3pg82qi8glghvimjnk1cfd"; /* updated by script */
+      sha256 = "0arnh9wlw874jqlgad00q0nf1kjp7pvb4xixwrb6v1l9fbr9nsan"; /* updated by script */
     };
     wmClass = "jetbrains-rider";
     update-channel = "Rider RELEASE";

third_party/nixpkgs/pkgs/applications/finance/odoo/default.nix

@@ -56,6 +56,7 @@ buildPythonApplication rec {
     libsass
     lxml
     markupsafe
+    mock
     num2words
     ofxparse
     passlib
@@ -76,7 +77,7 @@ buildPythonApplication rec {
     reportlab
     requests
     vobject
-    werkzeug1
+    werkzeug
     xlrd
     XlsxWriter
     xlwt
@@ -92,6 +93,6 @@ buildPythonApplication rec {
     description = "Open Source ERP and CRM";
     homepage = "https://www.odoo.com/";
     license = licenses.lgpl3Only;
-    maintainers = [ maintainers.mkg20001 ];
+    maintainers = with maintainers; [ mkg20001 ];
   };
 }

third_party/nixpkgs/pkgs/applications/misc/binance/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "binance";
-  version = "1.28.0";
+  version = "1.29.0";
 
   src = fetchurl {
     url = "https://github.com/binance/desktop/releases/download/v${version}/${pname}-${version}-amd64-linux.deb";
-    sha256 = "sha256-qJuD+O4M9U8P6JhFUFc92yllX1vgZZvTlTd0bph3Vo4=";
+    sha256 = "sha256-LQX5RUTVm6lBdRzCFMBq1NLGGiLBVyykJ1LY9FqINnY=";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/misc/electrum/default.nix

@@ -2,6 +2,7 @@
 , stdenv
 , fetchurl
 , fetchFromGitHub
+, fetchpatch
 , wrapQtAppsHook
 , python3
 , zbar
@@ -78,6 +79,14 @@ python3.pkgs.buildPythonApplication {
       --replace "dnspython>=2.0,<2.1" "dnspython>=2.0"
   '';
 
+  patches = [
+    # trezorlib 0.13 compatibility
+    (fetchpatch {
+      url = "https://github.com/spesmilo/electrum/commit/97e61cfacdca374103e4184f0f9a07a0c5757afb.patch";
+      sha256 = "sha256-RGVBO9IskC+lQOHNGjrqH6EM/inNPJlcD9sSWedyT5E=";
+    })
+  ];
+
   nativeBuildInputs = lib.optionals enableQt [ wrapQtAppsHook ];
 
   propagatedBuildInputs = with py.pkgs; [

third_party/nixpkgs/pkgs/applications/misc/joplin-desktop/default.nix

@@ -2,7 +2,7 @@
 
 let
   pname = "joplin-desktop";
-  version = "2.5.12";
+  version = "2.6.10";
   name = "${pname}-${version}";
 
   inherit (stdenv.hostPlatform) system;
@@ -16,8 +16,8 @@ let
   src = fetchurl {
     url = "https://github.com/laurent22/joplin/releases/download/v${version}/Joplin-${version}.${suffix}";
     sha256 = {
-      x86_64-linux = "sha256-/S/paqMKVerSQFjA4wQ9fLV0WaqKm4CzQfy+0OdH7c8=";
+      x86_64-linux = "sha256-2/QYEzQjB9n/4k5I/fry3ol8Fpsb5+tc1ttVdf2ID+4=";
-      x86_64-darwin = "sha256-5eKTfZRpW7IYwFt8TeJiytrwEpiHBgN4k9kth+Lh0Bo=";
+      x86_64-darwin = "sha256-BwBpq78hYJVUItUgs9lonBTV4YWJ+qvML6VTj5M4BQ4=";
     }.${system} or throwSystem;
   };
 

third_party/nixpkgs/pkgs/applications/misc/obsidian/default.nix

@@ -31,11 +31,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "obsidian";
-  version = "0.12.19";
+  version = "0.13.14";
 
   src = fetchurl {
     url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/obsidian-${version}.tar.gz";
-    sha256 = "sha256-M9U67+mCL/CziTprCAhfrZTWl6i7HRfH24l/xqUqkIg=";
+    sha256 = "0d55lk643yqjz4s6j5lbrdkf9f7wmwlz9ahjx760rzqpzy5190nr";
   };
 
   nativeBuildInputs = [ makeWrapper graphicsmagick ];

third_party/nixpkgs/pkgs/applications/misc/prusa-slicer/super-slicer.nix

@@ -5,8 +5,8 @@ let
   description = "PrusaSlicer fork with more features and faster development cycle";
 
   versions = {
-    stable = { version = "2.3.57.7"; sha256 = "sha256-qYvHNGuA2YDatrY/K2g5PE2gD53VXNptCaa7TpWGV7g="; };
+    stable = { version = "2.3.57.8"; sha256 = "sha256-k1G9sFukYyCqVeJIbYgjJX9T8zqmFTmjmj9OXZ78+LY="; };
-    latest = { version = "2.3.57.7"; sha256 = "sha256-qYvHNGuA2YDatrY/K2g5PE2gD53VXNptCaa7TpWGV7g="; };
+    latest = { version = "2.3.57.8"; sha256 = "sha256-k1G9sFukYyCqVeJIbYgjJX9T8zqmFTmjmj9OXZ78+LY="; };
   };
 
   override = { version, sha256 }: super: {

third_party/nixpkgs/pkgs/applications/misc/pwsafe/default.nix

@@ -1,4 +1,5 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, zip, gettext, perl
+{ lib, stdenv, fetchFromGitHub
+, cmake, pkg-config, zip, gettext, perl
 , wxGTK30, libXext, libXi, libXt, libXtst, xercesc
 , qrencode, libuuid, libyubikey, yubikey-personalization
 , curl, openssl, file
@@ -6,13 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "pwsafe";
-  version = "3.56.0";
+  version = "1.14.0"; # do NOT update to 3.x Windows releases
+  # nixpkgs-update: no auto update
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-ZLX/3cs1cdia5+32QEwE6q3V0uFNkkmiIGboKW6Xej8=";
+    hash = "sha256-s3IXe4gTwUOzQslNfWrcN/srrG9Jv02zfkGgiZN3C1s=";
   };
 
   nativeBuildInputs = [
@@ -32,19 +34,19 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     # Fix perl scripts used during the build.
-    for f in `find . -type f -name '*.pl'`; do
+    for f in $(find . -type f -name '*.pl') ; do
       patchShebangs $f
     done
 
     # Fix hard coded paths.
-    for f in `grep -Rl /usr/share/ src`; do
+    for f in $(grep -Rl /usr/share/ src) ; do
       substituteInPlace $f --replace /usr/share/ $out/share/
     done
 
     # Fix hard coded zip path.
     substituteInPlace help/Makefile.linux --replace /usr/bin/zip ${zip}/bin/zip
 
-    for f in `grep -Rl /usr/bin/ .`; do
+    for f in $(grep -Rl /usr/bin/ .) ; do
       substituteInPlace $f --replace /usr/bin/ ""
     done
   '';

third_party/nixpkgs/pkgs/applications/misc/tiramisu/default.nix

@@ -1,19 +1,19 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, glib }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, glib, vala }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "tiramisu";
-  version = "unstable-2021-05-20";
+  version = "2.0.20211107";
 
   src = fetchFromGitHub {
     owner = "Sweets";
-    repo = "tiramisu";
+    repo = pname;
-    rev = "e53833d0b5b0ae41ceb7dc434d8e25818fe62291";
+    rev = version;
-    sha256 = "sha256-F4oaTOAQQfOkEXeBVbGH+0CHc9v9Ac08GyzHliOdAfc=";
+    sha256 = "1n1x1ybbwbanibw7b90k7v4cadagl41li17hz2l8s2sapacvq3mw";
   };
 
   buildInputs = [ glib ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config vala ];
 
   makeFlags = [ "PREFIX=$(out)" ];
 

third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/common.nix

@@ -27,9 +27,8 @@
 , ltoSupport ? (stdenv.isLinux && stdenv.is64bit), overrideCC, buildPackages
 , gssSupport ? true, libkrb5
 , pipewireSupport ? waylandSupport && webrtcSupport, pipewire
-# Workaround: disabled since currently jemalloc causes crashes with LLVM 13.
+# Jemalloc could reduce memory consumption.
-# https://bugzilla.mozilla.org/show_bug.cgi?id=1741454
+, jemallocSupport ? true, jemalloc
-, jemallocSupport ? false, jemalloc
 
 ## privacy-related options
 

third_party/nixpkgs/pkgs/applications/networking/cluster/helmfile/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "helmfile";
-  version = "0.141.0";
+  version = "0.142.0";
 
   src = fetchFromGitHub {
     owner = "roboll";
     repo = "helmfile";
     rev = "v${version}";
-    sha256 = "sha256-UwjV3xgnZa0Emzw4FP/+gHh1ES6MTihrrlGKUBH6O9Q=";
+    sha256 = "sha256-kz5U9MPpN+14Eb1D1hjwDfvTOygzg0unyIgrFTFhE0Q=";
   };
 
   vendorSha256 = "sha256-HKHMeDnIDmQ7AjuS2lYCMphTHGD1JgQuBYDJe2+PEk4=";

third_party/nixpkgs/pkgs/applications/networking/jmeter/default.nix

@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "jmeter";
-  version = "5.4.2";
+  version = "5.4.3";
   src = fetchurl {
     url = "https://archive.apache.org/dist/jmeter/binaries/apache-${pname}-${version}.tgz";
-    sha256 = "sha256-rtv68ACqLRnjU0zEBirLn5cwhxGy03upZWQyIqeECxA=";
+    sha256 = "sha256-clISFMDLh9rFuXTBxug6F6AJx/03e1W/I1JcckA7He4=";
   };
 
   nativeBuildInputs = [ makeWrapper jre ];

third_party/nixpkgs/pkgs/applications/networking/protonmail-bridge/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "protonmail-bridge";
-  version = "1.8.10";
+  version = "1.8.12";
 
   src = fetchFromGitHub {
     owner = "ProtonMail";
     repo = "proton-bridge";
     rev = "br-${version}";
-    sha256 = "sha256-T6pFfGKG4VNcZ6EYEU5A5V91PlZZDylTNSNbah/pwS4=";
+    sha256 = "sha256-CkvD7PKx2Gm2KgsIIqQ9l1Z3tWlhqIbW0sxCV2UBYTE=";
   };
 
-  vendorSha256 = "sha256-hRGedgdQlky9UBqsVTSbgAgii1skF/MA21ZQ0+goaM4=";
+  vendorSha256 = "sha256-Pz3xRTwlnJGh1XvxIbyjvYcMywk/wdp4hYovPLBD494=";
 
   nativeBuildInputs = [ pkg-config ];
 

third_party/nixpkgs/pkgs/applications/networking/remote/citrix-workspace/generic.nix

@@ -70,6 +70,7 @@ stdenv.mkDerivation rec {
     freetype
     gdk-pixbuf
     gnome2.gtkglext
+    glib-networking
     webkitgtk
     gtk2
     gtk2-x11

third_party/nixpkgs/pkgs/applications/networking/soulseek/nicotine-plus/default.nix

@@ -5,13 +5,13 @@ with lib;
 
 python3Packages.buildPythonApplication rec {
   pname = "nicotine-plus";
-  version = "3.1.1";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "Nicotine-Plus";
     repo = "nicotine-plus";
     rev = version;
-    hash = "sha256-NfI2RfxAYhA1qefml1ayfYWjbkrzUL4l9p2Rm/ROnzQ=";
+    hash = "sha256-E8b2VRlnMWmBHu919QDPBYuMbrjov9t//bHi1Y/F0Ak=";
   };
 
   nativeBuildInputs = [ gettext wrapGAppsHook ];
@@ -23,6 +23,12 @@ python3Packages.buildPythonApplication rec {
     mv $out/bin/nicotine $out/bin/nicotine-plus
   '';
 
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}"
+    )
+  '';
+
   doCheck = false;
 
   meta = {

third_party/nixpkgs/pkgs/applications/networking/tmpmail/default.nix

@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "tmpmail";
-  version = "1.1.4";
+  version = "1.1.9";
 
    src = fetchFromGitHub {
     owner = "sdushantha";
     repo = "tmpmail";
     rev = "v${version}";
-    sha256 = "sha256-Rcu1qNmUZhMRvPiaWrDlzLtGksv09XBiF2GJUxXKs1Y=";
+    sha256 = "sha256-sWcsmBUHSfo7sICXyhNhbfRFSHumObnWc7stWxcwVTg=";
   };
 
   dontConfigure = true;

third_party/nixpkgs/pkgs/applications/printing/pappl/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pappl";
-  version = "1.0.3";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "michaelrsweet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-B3g6R0/li+5D4odFG21qj+SR3K4PFnzzxIGCwbk1buo=";
+    sha256 = "sha256-FsmR0fFb9bU9G3oUyJU1eDLcoZ6OQ2//TINlPrW6lU0=";
   };
 
   outputs = [ "out" "dev" ];

third_party/nixpkgs/pkgs/applications/radio/gnuradio/3.8.nix

@@ -248,6 +248,11 @@ stdenv.mkDerivation rec {
       url = "https://github.com/gnuradio/gnuradio/commit/9d7343526dd793120b6425cd9a6969416ed32503.patch";
       sha256 = "sha256-usSoRDDuClUfdX4yFbQNu8wDzve6UEhZYTFj1oZbFic=";
     })
+    # Fix compilation with boost 177
+    (fetchpatch {
+      url = "https://github.com/gnuradio/gnuradio/commit/2c767bb260a25b415e8c9c4b3ea37280b2127cec.patch";
+      sha256 = "sha256-l4dSzkXb5s3vcCeuKMMwiKfv83hFI9Yg+EMEX+sl+Uo=";
+    })
   ];
   passthru = shared.passthru // {
     # Deps that are potentially overriden and are used inside GR plugins - the same version must

third_party/nixpkgs/pkgs/applications/radio/uhd/default.nix

@@ -6,14 +6,13 @@
 , pkg-config
 # See https://files.ettus.com/manual_archive/v3.15.0.0/html/page_build_guide.html for dependencies explanations
 , boost
-, enableLibuhd_C_api ? true
+, enableCApi ? true
 # requires numpy
-, enableLibuhd_Python_api ? false
+, enablePythonApi ? false
 , python3
 , enableExamples ? false
 , enableUtils ? false
-, enableLiberio ? false
+, enableSim ? false
-, liberio
 , libusb1
 , enableDpdk ? false
 , dpdk
@@ -25,7 +24,6 @@
 , enableUsrp1 ? true
 , enableUsrp2 ? true
 , enableX300 ? true
-, enableN230 ? true
 , enableN300 ? true
 , enableN320 ? true
 , enableE300 ? true
@@ -41,18 +39,18 @@ stdenv.mkDerivation rec {
   pname = "uhd";
   # UHD seems to use three different version number styles: x.y.z, xxx_yyy_zzz
   # and xxx.yyy.zzz. Hrmpf... style keeps changing
-  version = "4.0.0.0";
+  version = "4.1.0.5";
 
   src = fetchFromGitHub {
     owner = "EttusResearch";
     repo = "uhd";
     rev = "v${version}";
-    sha256 = "NCyiI4pIPw0nBRFdUGpgZ/x2mWz+Qm78ZGACUnSbGSs=";
+    sha256 = "sha256-XBq4GkLRR2SFunFRvpPOMiIbTuUkMYf8tPAoHCoveRA=";
   };
   # Firmware images are downloaded (pre-built) from the respective release on Github
   uhdImagesSrc = fetchurl {
     url = "https://github.com/EttusResearch/uhd/releases/download/v${version}/uhd-images_${version}.tar.xz";
-    sha256 = "Xfx0bsHUQ5+Dp+xk0sVWWP83oyXQcUH5AX4PNEE7fY4=";
+    sha256 = "HctHB90ikOMkrYNyWmjGE/2HvA7xXKCUezdtiqzN+1A=";
   };
 
   cmakeFlags = [
@@ -61,9 +59,8 @@ stdenv.mkDerivation rec {
     "-DENABLE_TESTS=ON" # This installs tests as well so we delete them via postPhases
     "-DENABLE_EXAMPLES=${onOffBool enableExamples}"
     "-DENABLE_UTILS=${onOffBool enableUtils}"
-    "-DENABLE_LIBUHD_C_API=${onOffBool enableLibuhd_C_api}"
+    "-DENABLE_C_API=${onOffBool enableCApi}"
-    "-DENABLE_LIBUHD_PYTHON_API=${onOffBool enableLibuhd_Python_api}"
+    "-DENABLE_PYTHON_API=${onOffBool enablePythonApi}"
-    "-DENABLE_LIBERIO=${onOffBool enableLiberio}"
     "-DENABLE_DPDK=${onOffBool enableDpdk}"
     # Devices
     "-DENABLE_OCTOCLOCK=${onOffBool enableOctoClock}"
@@ -73,7 +70,6 @@ stdenv.mkDerivation rec {
     "-DENABLE_USRP1=${onOffBool enableUsrp1}"
     "-DENABLE_USRP2=${onOffBool enableUsrp2}"
     "-DENABLE_X300=${onOffBool enableX300}"
-    "-DENABLE_N230=${onOffBool enableN230}"
     "-DENABLE_N300=${onOffBool enableN300}"
     "-DENABLE_N320=${onOffBool enableN320}"
     "-DENABLE_E300=${onOffBool enableE300}"
@@ -87,7 +83,7 @@ stdenv.mkDerivation rec {
 
   # Python + Mako are always required for the build itself but not necessary for runtime.
   pythonEnv = python3.withPackages (ps: with ps; [ Mako ]
-    ++ optionals (enableLibuhd_Python_api) [ numpy setuptools ]
+    ++ optionals (enablePythonApi) [ numpy setuptools ]
     ++ optionals (enableUtils) [ requests six ]
   );
 
@@ -98,7 +94,7 @@ stdenv.mkDerivation rec {
     # If both enableLibuhd_Python_api and enableUtils are off, we don't need
     # pythonEnv in buildInputs as it's a 'build' dependency and not a runtime
     # dependency
-    ++ optionals (!enableLibuhd_Python_api && !enableUtils) [ pythonEnv ]
+    ++ optionals (!enablePythonApi && !enableUtils) [ pythonEnv ]
   ;
   buildInputs = [
     boost
@@ -107,12 +103,12 @@ stdenv.mkDerivation rec {
     # However, if enableLibuhd_Python_api *or* enableUtils is on, we need
     # pythonEnv for runtime as well. The utilities' runtime dependencies are
     # handled at the environment
-    ++ optionals (enableLibuhd_Python_api || enableUtils) [ pythonEnv ]
+    ++ optionals (enablePythonApi || enableUtils) [ pythonEnv ]
-    ++ optionals (enableLiberio) [ liberio ]
     ++ optionals (enableDpdk) [ dpdk ]
   ;
 
-  doCheck = true;
+  # many tests fails on darwin, according to ofborg
+  doCheck = !stdenv.isDarwin;
 
   # Build only the host software
   preConfigure = "cd host";
@@ -154,6 +150,6 @@ stdenv.mkDerivation rec {
     homepage = "https://uhd.ettus.com/";
     license = licenses.gpl3Plus;
     platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ bjornfor fpletz tomberek ];
+    maintainers = with maintainers; [ bjornfor fpletz tomberek doronbehar ];
   };
 }

third_party/nixpkgs/pkgs/applications/science/chemistry/marvin/default.nix

@@ -4,12 +4,12 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "marvin";
-  version = "21.18.0";
+  version = "21.20.0";
 
   src = fetchurl {
     name = "marvin-${version}.deb";
     url = "http://dl.chemaxon.com/marvin/${version}/marvin_linux_${versions.majorMinor version}.deb";
-    sha256 = "sha256-h/fwP4HyelE1jZ8GrW1nKuDNuFAchms3cKSCGiRe7gU=";
+    sha256 = "sha256-xOtlJSUY7QLyggFXW0Ay3+6KNHIqljyDpyk0CP8jxWs=";
   };
 
   nativeBuildInputs = [ dpkg makeWrapper ];

third_party/nixpkgs/pkgs/applications/science/electronics/flatcam/default.nix

@@ -18,6 +18,7 @@ python3Packages.buildPythonApplication rec {
   propagatedBuildInputs = with python3Packages; [
     matplotlib
     numpy
+    packaging
     pyqt4
     Rtree
     scipy

third_party/nixpkgs/pkgs/applications/science/math/sage/patches/fonttools-deprecation-warnings.patch

@@ -0,0 +1,39 @@
+diff --git a/src/doc/en/prep/Advanced-2DPlotting.rst b/src/doc/en/prep/Advanced-2DPlotting.rst
+index 337457afef..f7c76f4b56 100644
+--- a/src/doc/en/prep/Advanced-2DPlotting.rst
++++ b/src/doc/en/prep/Advanced-2DPlotting.rst
+@@ -695,6 +695,8 @@ by the cells.
+ 
+     sage: pdf_savename = name+'.pdf'
+     sage: p.save(pdf_savename)
++    ...
++    DeprecationWarning: The py23 module has been deprecated and will be removed in a future release. Please update your code.
+ 
+ Notably, we can export in formats ready for inclusion in web pages.
+ 
+diff --git a/src/sage/plot/disk.py b/src/sage/plot/disk.py
+index 8680a1c9b1..e83763b678 100644
+--- a/src/sage/plot/disk.py
++++ b/src/sage/plot/disk.py
+@@ -156,6 +156,8 @@ class Disk(GraphicPrimitive):
+             sage: f = tmp_filename(ext='.pdf')
+             sage: p = disk((0,0), 5, (0, pi/4), alpha=0.5)
+             sage: p.save(f)
++            ...
++            DeprecationWarning: The py23 module has been deprecated and will be removed in a future release. Please update your code.
+ 
+         """
+         import matplotlib.patches as patches
+diff --git a/src/sage/plot/text.py b/src/sage/plot/text.py
+index 04cbdedf76..a970f97b79 100644
+--- a/src/sage/plot/text.py
++++ b/src/sage/plot/text.py
+@@ -325,6 +325,8 @@ def text(string, xy, **options):
+     You can save text as part of PDF output::
+ 
+         sage: text("sage", (0,0), rgbcolor=(0,0,0)).save(os.path.join(SAGE_TMP, 'a.pdf'))
++        ...
++        DeprecationWarning: The py23 module has been deprecated and will be removed in a future release. Please update your code.
+ 
+     Some examples of bounding box::
+ 

third_party/nixpkgs/pkgs/applications/science/math/sage/sage-src.nix

@@ -109,6 +109,14 @@ stdenv.mkDerivation rec {
     # strictly necessary, but keeps us from littering in the user's HOME.
     ./patches/sympow-cache.patch
 
+    # fonttools 4.26.2, used by matplotlib, uses deprecated methods internally.
+    # This is fixed in fonttools 4.27.0, but since fonttools is a dependency of
+    # 2000+ packages and DeprecationWarnings are hidden almost everywhere by
+    # default (not on Sage's doctest harness, though), it doesn't make sense to
+    # backport the fix (see https://github.com/NixOS/nixpkgs/pull/151415).
+    # Let's just assume warnings are expected until we update to 4.27.0.
+    ./patches/fonttools-deprecation-warnings.patch
+
     # https://trac.sagemath.org/ticket/32305
     (fetchSageDiff {
       base = "9.4";
@@ -140,6 +148,22 @@ stdenv.mkDerivation rec {
       rev = "f5f7a86908daf60b25e66e6a189c51ada7e0a732";
       sha256 = "sha256-H/caGx3q4KcdsyGe+ojV9bUTQ5y0siqM+QHgDbeEnbw=";
     })
+
+    # https://trac.sagemath.org/ticket/32909
+    (fetchSageDiff {
+      base = "9.5.beta7";
+      name = "matplotlib-3.5-deprecation-warnings.patch";
+      rev = "a5127dc56fdf5c2e82f6bc781cfe78dbd04e97b7";
+      sha256 = "sha256-p23qUu9mgEUbdbX6cy7ArxZAtpcFjCKbgyxN4jWvj1o=";
+    })
+
+    # https://trac.sagemath.org/ticket/32968
+    (fetchSageDiff {
+      base = "9.5.beta8";
+      name = "sphinx-4.3-update.patch";
+      rev = "fc84f82f52b6f05f512cb359ec7c100f93cf8841";
+      sha256 = "sha256-bBbfdcnw/9LUOlY8rHJRbFJEdMXK4shosqTNaobTS1Q=";
+    })
   ];
 
   patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;

third_party/nixpkgs/pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -25,7 +25,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.34.0";
+  version = "2.34.1";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "07s1c9lzlm4kpbb5lmxy0869phg7037pv4faz5hlqyb5csrbjv7x";
+    sha256 = "0b40vf315s1kz65x1wq47g8srl4wqac39pwnvlj1mdzs3kfma1rs";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";

third_party/nixpkgs/pkgs/applications/video/bombono/default.nix

@@ -3,7 +3,7 @@
 , pkg-config
 , fetchpatch
 , scons
-, boost
+, boost172
 , dvdauthor
 , dvdplusrwtools
 , enca
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ wrapGAppsHook scons pkg-config gettext ];
 
   buildInputs = [
-    boost
+    boost172
     dvdauthor
     dvdplusrwtools
     enca

third_party/nixpkgs/pkgs/applications/video/clapper/default.nix

@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clapper";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner  = "Rafostar";
     repo   = pname;
     rev    = version;
-    sha256 = "1gf4z9lib5rxi1xilkxxyywakm9zlq5915w2wib09jyh0if82ahr";
+    sha256 = "sha256-ccvg8yxPCN7OYmJvq0SPY6iyiuFuWJyiu+mRoykEzqI=";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/video/corrscope/default.nix

@@ -11,6 +11,7 @@
 mkDerivationWith python3Packages.buildPythonApplication rec {
   pname = "corrscope";
   version = "0.7.1";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "corrscope";
@@ -19,8 +20,6 @@ mkDerivationWith python3Packages.buildPythonApplication rec {
     sha256 = "0c9kmrw6pcda68li04b5j2kmsgdw1q463qlc32wn96zn9hl82v6m";
   };
 
-  format = "pyproject";
-
   patches = [
     # Remove when bumping past 0.7.1
     (fetchpatch {
@@ -30,11 +29,28 @@ mkDerivationWith python3Packages.buildPythonApplication rec {
     })
   ];
 
-  nativeBuildInputs = [ wrapQtAppsHook ] ++ (with python3Packages; [ poetry-core ]);
+  nativeBuildInputs = [
+    wrapQtAppsHook
+  ] ++ (with python3Packages; [
+    poetry-core
+  ]);
 
-  buildInputs = [ ffmpeg qtbase ];
+  buildInputs = [
+    ffmpeg
+    qtbase
+  ];
 
-  propagatedBuildInputs = with python3Packages; [ appdirs atomicwrites attrs click matplotlib numpy pyqt5 ruamel-yaml ];
+  propagatedBuildInputs = with python3Packages; [
+    appdirs
+    atomicwrites
+    attrs
+    click
+    matplotlib
+    numpy
+    packaging
+    pyqt5
+    ruamel-yaml
+  ];
 
   dontWrapQtApps = true;
 

third_party/nixpkgs/pkgs/applications/virtualization/qemu/default.nix

@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, fetchpatch, python, zlib, pkg-config, glib
 , perl, pixman, vde2, alsa-lib, texinfo, flex
 , bison, lzo, snappy, libaio, libtasn1, gnutls, nettle, curl, ninja, meson, sigtool
-, makeWrapper, autoPatchelfHook, runtimeShell
+, makeWrapper, runtimeShell
 , attr, libcap, libcap_ng
 , CoreServices, Cocoa, Hypervisor, rez, setfile
 , numaSupport ? stdenv.isLinux && !stdenv.isAarch32, numactl
@@ -53,7 +53,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper python python.pkgs.sphinx python.pkgs.sphinx_rtd_theme pkg-config flex bison meson ninja ]
     ++ lib.optionals gtkSupport [ wrapGAppsHook ]
-    ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ]
     ++ lib.optionals stdenv.isDarwin [ sigtool ];
 
   buildInputs = [ zlib glib perl pixman
@@ -85,6 +84,8 @@ stdenv.mkDerivation rec {
   dontUseMesonConfigure = true; # meson's configurePhase isn't compatible with qemu build
 
   outputs = [ "out" "ga" ];
+  # On aarch64-linux we would shoot over the Hydra's 2G output limit.
+  separateDebugInfo = !(stdenv.isAarch64 && stdenv.isLinux);
 
   patches = [
     ./fix-qemu-ga.patch
@@ -180,6 +181,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--audio-drv-list=${audio}"
+    "--disable-strip" # We'll strip ourselves after separating debug info.
     "--enable-docs"
     "--enable-tools"
     "--enable-guest-agent"

third_party/nixpkgs/pkgs/applications/window-managers/i3/status.nix

@@ -1,24 +1,17 @@
-{ fetchurl, lib, stdenv, libconfuse, yajl, alsa-lib, libpulseaudio, libnl, pkg-config, asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl }:
+{ fetchurl, lib, stdenv, libconfuse, yajl, alsa-lib, libpulseaudio, libnl, meson, ninja, perl, pkg-config, asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl }:
 
 stdenv.mkDerivation rec {
   pname = "i3status";
-  version = "2.13";
+  version = "2.14";
 
   src = fetchurl {
-    url = "https://i3wm.org/i3status/i3status-${version}.tar.bz2";
+    url = "https://i3wm.org/i3status/i3status-${version}.tar.xz";
-    sha256 = "0rhlzb96mw64z2jnhwz9nibc7pxg549626lz5642xxk5hpzwk2ff";
+    sha256 = "0929chhvyq9hg4scpcz8r9zn3s9jvbg6a86k3wqa77qg85rh4kaw";
   };
 
-  nativeBuildInputs = [ pkg-config asciidoc xmlto docbook_xml_dtd_45 docbook_xsl ];
+  nativeBuildInputs = [ meson ninja perl pkg-config asciidoc xmlto docbook_xml_dtd_45 docbook_xsl ];
   buildInputs = [ libconfuse yajl alsa-lib libpulseaudio libnl ];
 
-  makeFlags = [ "all" "PREFIX=$(out)" ];
-
-  # This hack is needed because for unknown reasons configure generates a broken makefile on the 2.13 release under nixos
-  preBuild = ''
-    sed -i -e 's/\$(TEST_LOGS) \$(TEST_LOGS/\$(TEST_LOGS)/g' Makefile
-  '';
-
   meta = {
     description = "Generates a status line for i3bar, dzen2, xmobar or lemonbar";
     homepage = "https://i3wm.org";

third_party/nixpkgs/pkgs/build-support/pkg-config-wrapper/default.nix

@@ -47,6 +47,9 @@ stdenv.mkDerivation {
   dontBuild = true;
   dontConfigure = true;
 
+  # Additional flags passed to pkg-config.
+  addFlags = lib.optional stdenv.targetPlatform.isStatic "--static";
+
   unpackPhase = ''
     src=$PWD
   '';

third_party/nixpkgs/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh

@@ -12,10 +12,12 @@ if [ -z "${NIX_PKG_CONFIG_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
+set -- "$@" @addFlags@
+
 if (( ${#role_suffixes[@]} > 0 )); then
     # replace env var with nix-modified one
     PKG_CONFIG_PATH=$PKG_CONFIG_PATH_@suffixSalt@ exec @prog@ "$@"
 else
-    # pkg-config isn't a bonafied dependency so ignore setup hook entirely
+    # pkg-config isn't a real dependency so ignore setup hook entirely
     exec @prog@ "$@"
 fi

third_party/nixpkgs/pkgs/build-support/setup-hooks/separate-debug-info.sh

@@ -28,10 +28,16 @@ _separateDebugInfo() {
         # Extract the debug info.
         header "separating debug info from $i (build ID $id)"
         mkdir -p "$dst/${id:0:2}"
+
+        # This may fail, e.g. if the binary is for a different
+        # architecture than we're building for.  (This happens with
+        # firmware blobs in QEMU.)
+        (
             $OBJCOPY --only-keep-debug "$i" "$dst/${id:0:2}/${id:2}.debug"
             $STRIP --strip-debug "$i"
 
             # Also a create a symlink <original-name>.debug.
             ln -sfn ".build-id/${id:0:2}/${id:2}.debug" "$dst/../$(basename "$i")"
+        ) || rmdir -p "$dst/${id:0:2}"
     done < <(find "$prefix" -type f -print0)
 }

third_party/nixpkgs/pkgs/data/documentation/stdman/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "stdman";
-  version = "2020.11.17";
+  version = "2021.12.21";
 
   src = fetchFromGitHub {
     owner = "jeaye";
     repo = "stdman";
     rev = version;
-    sha256 = "sha256-pzAVuXSuUfwI7gQpFqmH/+klSUH3KipZup2TgZs8XsY=";
+    sha256 = "sha256-wOMQzC5w8aDmxNxQ5HK8jMgoow1wXBfHGUwFBw2WiPA=";
   };
 
   outputDevdoc = "out";

third_party/nixpkgs/pkgs/data/fonts/last-resort/default.nix

@@ -1,7 +1,7 @@
 { lib, fetchurl }:
 
 let
-  version = "13.001";
+  version = "14.000";
 in fetchurl {
   name = "last-resort-${version}";
 
@@ -13,7 +13,7 @@ in fetchurl {
   '';
 
   recursiveHash = true;
-  sha256 = "08mi65j46fv6a3y3pqnglqdjxjnbzg25v25f7c1zyk3c285m14hq";
+  sha256 = "sha256-rb69V4oExSFx4GpedpyVvGuS6o+MxmxTCSZhoe9kUhI=";
 
   meta = with lib; {
     description = "Fallback font of last resort";

third_party/nixpkgs/pkgs/data/fonts/noto-fonts/default.nix

@@ -124,11 +124,6 @@ in
       sha256 = "1d6zzk0ii43iqfnjbldwp8sasyx99lbjp1nfgqjla7ixld6yp98l";
     };
 
-    makeFlags = [
-      # TODO(@sternenseemann): remove if afdko is new enough to know about Unicode 14.0
-      "BYPASS_SEQUENCE_CHECK=True"
-    ];
-
     nativeBuildInputs = [
       cairo
       imagemagick

third_party/nixpkgs/pkgs/data/fonts/scheherazade/default.nix

@@ -1,10 +1,10 @@
-{ lib, fetchzip, version ? "3.200" }:
+{ lib, fetchzip, version ? "3.300" }:
 
 let
   new = lib.versionAtLeast version "3.000";
   sha256 = {
     "2.100" = "1g5f5f9gzamkq3kqyf7vbzvl4rdj3wmjf6chdrbxksrm3rnb926z";
-    "3.200" = "0qvmpsn6ja3g2hlvq0vb9pjsyk6ibna7s3w3n6q7lnhk0rhjg8bv";
+    "3.300" = "1bja1ma1mnna0qlk3dis31cvq5z1kgcqj7wjp8ml03zc5mpa2wb2";
   }."${version}";
 
 in fetchzip rec {
@@ -16,8 +16,9 @@ in fetchzip rec {
     mkdir -p $out/share/{doc,fonts}
     unzip -l $downloadedFile
     unzip -j $downloadedFile \*.ttf                        -d $out/share/fonts/truetype
+    unzip    $downloadedFile \*/documentation/\*           -d $out/share/doc/
+    mv $out/share/doc/* $out/share/doc/${name}
     unzip -j $downloadedFile \*/FONTLOG.txt  \*/README.txt -d $out/share/doc/${name}
-    unzip -j $downloadedFile \*/documentation/\*           -d $out/share/doc/${name}/documentation
   '';
 
   inherit sha256;
@@ -30,7 +31,7 @@ in fetchzip rec {
       Scheherazade${lib.optionalString new " New"}, named after the heroine of
       the classic Arabian Nights tale, is designed in a similar style to
       traditional typefaces such as Monotype Naskh, extended to cover the
-      Unicode Arabic repertoire through Unicode ${if new then "13.0" else "8.0"}.
+      Unicode Arabic repertoire through Unicode ${if new then "14.0" else "8.0"}.
 
       Scheherazade provides a “simplified” rendering of Arabic script, using
       basic connecting glyphs but not including a wide variety of additional

third_party/nixpkgs/pkgs/data/icons/numix-icon-theme-circle/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "numix-icon-theme-circle";
-  version = "21.11.29";
+  version = "21.12.05";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-0hGxgmNNYvNT1QQpA7SdOdN1VM8Iix+kZZFcO2R1V/Y=";
+    sha256 = "sha256-tmrysmg4jVPurNJy3AqzAIjd1QCXoH2nGuJhRinvqVQ=";
   };
 
   nativeBuildInputs = [ gtk3 ];

third_party/nixpkgs/pkgs/data/icons/numix-icon-theme-square/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "numix-icon-theme-square";
-  version = "21.11.29";
+  version = "21.12.05";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-3zZ/LpjYhYOHPpgRysGYXFLvYux5GgurItuYm7zAZ2M=";
+    sha256 = "sha256-SVWIY7RGwk2AKruDkAYoZ5nDSAU8LPb9dtqxDFumZ5o=";
   };
 
   nativeBuildInputs = [ gtk3 ];

third_party/nixpkgs/pkgs/data/icons/tela-icon-theme/default.nix

@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "tela-icon-theme";
-  version = "2021-11-05";
+  version = "2021-12-25";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "sha256-mvkgHBdZm6vF+/DS3CRLl1m14U0Lj4Xtz4J/vpJUTQM=";
+    sha256 = "sha256-qlt9jv3lCPVFBeN4aQd4r9NE0YAxWQavMoo13cvhv6E=";
   };
 
   nativeBuildInputs = [ gtk3 jdupes ];

third_party/nixpkgs/pkgs/data/misc/iana-etc/default.nix

@@ -1,12 +1,12 @@
 { lib, fetchzip, stdenvNoCC, writeText }:
 
 let
-  version = "20210225";
+  version = "20211124";
 in stdenvNoCC.mkDerivation {
   name = "iana-etc-${version}";
   src = fetchzip {
     url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "sha256:1bbbnj2ya0apyyhnw37521yl1hrz3zy3l8dw6sacmir0y6pmx9gi";
+    sha256 = "sha256-4mM/ZeGd91e1AklGHFK5UB4llg9IgCo9DKcM0iXcBls=";
   };
 
   installPhase = ''

third_party/nixpkgs/pkgs/development/compilers/flutter/patches/move-cache.patch

@@ -20,7 +20,7 @@ index ed42baea29..fee2fb1d62 100644
          final Uri entryUri = _fileSystem.path.toUri(asset);
          result.add(_Asset(
 -          baseDir: _fileSystem.path.join(Cache.flutterRoot!, 'bin', 'cache', 'artifacts', 'material_fonts'),
-+          baseDir: _fileSystem.path.join(globals.fsUtils.homeDirPath!, 'bin', 'cache', 'artifacts', 'material_fonts'),
++          baseDir: _fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter', 'artifacts', 'material_fonts'),
            relativeUri: Uri(path: entryUri.pathSegments.last),
            entryUri: entryUri,
            package: null,

third_party/nixpkgs/pkgs/development/compilers/gcc/9/default.nix

@@ -63,6 +63,11 @@ with lib;
 with builtins;
 
 let majorVersion = "9";
+    /*
+      If you update, please build on aarch64-linux
+      and check braces adjacent to `cplusplus` lines in file
+      ./result/lib/gcc/aarch64-unknown-linux-gnu/9.*.0/include/arm_acle.h
+    */
     version = "${majorVersion}.3.0";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;

third_party/nixpkgs/pkgs/development/compilers/ghc/head.nix

@@ -12,9 +12,10 @@
   libffi ? null
 
   # Libdw.c only supports x86_64, i686 and s390x
-, enableDwarf ? stdenv.targetPlatform.isx86 &&
+, enableDwarf ? (stdenv.targetPlatform.isx86 ||
-                !stdenv.targetPlatform.isDarwin &&
+                 (stdenv.targetPlatform.isS390 && stdenv.targetPlatform.is64bit)) &&
-                !stdenv.targetPlatform.isWindows
+                lib.meta.availableOn stdenv.hostPlatform elfutils &&
+                lib.meta.availableOn stdenv.targetPlatform elfutils
 , elfutils # for DWARF support
 
 , useLLVM ? !(stdenv.targetPlatform.isx86

third_party/nixpkgs/pkgs/development/compilers/go/1.16.nix

@@ -54,11 +54,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.16.10";
+  version = "1.16.12";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "sha256-qQVHIBFYXkA9ANKkHefO0puIhDCdc0gqMH9on9DzILU=";
+    sha256 = "sha256-Kv2Dnct20rsILFAsAaClzb/An9YwdXg1NjxP3o4vv+g=";
   };
 
   # perl is used for testing go vet

third_party/nixpkgs/pkgs/development/compilers/gwt/2.4.0.nix

@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, unzip }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
-  name = "gwt-java-2.4.0";
+  pname = "gwt-java";
+  version = "2.4.0";
 
   src = fetchurl {
-    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/google-web-toolkit/gwt-2.4.0.zip";
+    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/google-web-toolkit/gwt-${version}.zip";
     sha256 = "1gvyg00vx7fdqgfl2w7nhql78clg3abs6fxxy7m03pprdm5qmm17";
   };
 

third_party/nixpkgs/pkgs/development/compilers/koka/default.nix

@@ -4,12 +4,12 @@
 , parsec, process, regex-compat, text, time }:
 
 let
-  version = "2.3.2";
+  version = "2.3.6";
   src = fetchFromGitHub {
     owner = "koka-lang";
     repo = "koka";
     rev = "v${version}";
-    sha256 = "sha256-+w99Jvsd1tccUUYaP2TRgCNyGnMINWamuNRumHGzFWA=";
+    sha256 = "sha256-AibS/HudJKFQZlTxGD5LfwjBawIy1xwO2Hm8qzAUP2M=";
     fetchSubmodules = true;
   };
   kklib = stdenv.mkDerivation {

third_party/nixpkgs/pkgs/development/compilers/llvm/10/libcxx/default.nix

@@ -21,6 +21,12 @@ stdenv.mkDerivation {
     ../../libcxx-0001-musl-hacks.patch
   ];
 
+  # Prevent errors like "error: 'foo' is unavailable: introduced in macOS yy.zz"
+  postPatch = ''
+    substituteInPlace include/__config \
+      --replace "#    define _LIBCPP_USE_AVAILABILITY_APPLE" ""
+  '';
+
   preConfigure = ''
     # Get headers from the cxxabi source so we can see private headers not installed by the cxxabi package
     cmakeFlagsArray=($cmakeFlagsArray -DLIBCXX_CXX_ABI_INCLUDE_PATHS="$LIBCXXABI_INCLUDE_DIR")

third_party/nixpkgs/pkgs/development/compilers/llvm/11/libcxx/default.nix

@@ -29,6 +29,12 @@ stdenv.mkDerivation {
     ../../libcxx-0001-musl-hacks.patch
   ];
 
+  # Prevent errors like "error: 'foo' is unavailable: introduced in macOS yy.zz"
+  postPatch = ''
+    substituteInPlace include/__config \
+      --replace "#    define _LIBCPP_USE_AVAILABILITY_APPLE" ""
+  '';
+
   preConfigure = lib.optionalString stdenv.hostPlatform.isMusl ''
     patchShebangs utils/cat_files.py
   '';

third_party/nixpkgs/pkgs/development/compilers/llvm/11/libcxxabi/default.nix

@@ -1,5 +1,7 @@
 { lib, stdenv, llvm_meta, cmake, fetch, libcxx, libunwind, llvm, version
 , enableShared ? !stdenv.hostPlatform.isStatic
+, standalone ? stdenv.hostPlatform.useLLVM or false
+, withLibunwind ? !stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm
 }:
 
 stdenv.mkDerivation {
@@ -29,10 +31,11 @@ stdenv.mkDerivation {
   ];
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm) libunwind;
+  buildInputs = lib.optional withLibunwind libunwind;
 
-  cmakeFlags = lib.optionals (stdenv.hostPlatform.useLLVM or false) [
+  cmakeFlags = lib.optionals standalone [
     "-DLLVM_ENABLE_LIBCXX=ON"
+  ] ++ lib.optionals (standalone && withLibunwind) [
     "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
   ] ++ lib.optionals stdenv.hostPlatform.isWasm [
     "-DLIBCXXABI_ENABLE_THREADS=OFF"

third_party/nixpkgs/pkgs/development/compilers/llvm/12/libcxx/default.nix

@@ -23,6 +23,12 @@ stdenv.mkDerivation {
     ../../libcxx-0001-musl-hacks.patch
   ];
 
+  # Prevent errors like "error: 'foo' is unavailable: introduced in macOS yy.zz"
+  postPatch = ''
+    substituteInPlace include/__config \
+      --replace "#    define _LIBCPP_USE_AVAILABILITY_APPLE" ""
+  '';
+
   preConfigure = lib.optionalString stdenv.hostPlatform.isMusl ''
     patchShebangs utils/cat_files.py
   '';

third_party/nixpkgs/pkgs/development/compilers/llvm/12/libcxxabi/default.nix

@@ -1,5 +1,7 @@
 { lib, stdenv, llvm_meta, cmake, python3, fetch, libcxx, libunwind, llvm, version
 , enableShared ? !stdenv.hostPlatform.isStatic
+, standalone ? stdenv.hostPlatform.useLLVM or false
+, withLibunwind ? !stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm
 }:
 
 stdenv.mkDerivation {
@@ -28,9 +30,9 @@ stdenv.mkDerivation {
   ];
 
   nativeBuildInputs = [ cmake python3 ];
-  buildInputs = lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm) libunwind;
+  buildInputs = lib.optional withLibunwind libunwind;
 
-  cmakeFlags = lib.optionals (stdenv.hostPlatform.useLLVM or false) [
+  cmakeFlags = lib.optionals standalone [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
   ] ++ lib.optionals stdenv.hostPlatform.isWasm [
@@ -47,7 +49,7 @@ stdenv.mkDerivation {
         # the magic combination of necessary CMake variables
         # if you fancy a try, take a look at
         # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-        install_name_tool -id $out/$file $file
+        ${stdenv.cc.targetPrefix}install_name_tool -id $out/$file $file
       done
       make install
       install -d 755 $out/include

third_party/nixpkgs/pkgs/development/compilers/llvm/13/clang/default.nix

@@ -37,6 +37,11 @@ let
       ./purity.patch
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
+      # Revert of https://reviews.llvm.org/D100879
+      # The malloc alignment assumption is incorrect for jemalloc and causes
+      # mis-compilation in firefox.
+      # See: https://bugzilla.mozilla.org/show_bug.cgi?id=1741454
+      ./revert-malloc-alignment-assumption.patch
       (substituteAll {
         src = ../../clang-11-12-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";

third_party/nixpkgs/pkgs/development/compilers/llvm/13/clang/revert-malloc-alignment-assumption.patch

@@ -0,0 +1,78 @@
+--- b/include/clang/Basic/TargetInfo.h
++++ a/include/clang/Basic/TargetInfo.h
+@@ -612,8 +612,8 @@
+   }
+ 
+   /// Return the largest alignment for which a suitably-sized allocation with
++  /// '::operator new(size_t)' is guaranteed to produce a correctly-aligned
++  /// pointer.
+-  /// '::operator new(size_t)' or 'malloc' is guaranteed to produce a
+-  /// correctly-aligned pointer.
+   unsigned getNewAlign() const {
+     return NewAlign ? NewAlign : std::max(LongDoubleAlign, LongLongAlign);
+   }
+--- b/lib/CodeGen/CGCall.cpp
++++ a/lib/CodeGen/CGCall.cpp
+@@ -2048,24 +2048,6 @@
+       // allows it to work on indirect virtual function calls.
+       if (AttrOnCallSite && TargetDecl->hasAttr<NoMergeAttr>())
+         FuncAttrs.addAttribute(llvm::Attribute::NoMerge);
+-
+-      // Add known guaranteed alignment for allocation functions.
+-      if (unsigned BuiltinID = Fn->getBuiltinID()) {
+-        switch (BuiltinID) {
+-        case Builtin::BIaligned_alloc:
+-        case Builtin::BIcalloc:
+-        case Builtin::BImalloc:
+-        case Builtin::BImemalign:
+-        case Builtin::BIrealloc:
+-        case Builtin::BIstrdup:
+-        case Builtin::BIstrndup:
+-          RetAttrs.addAlignmentAttr(Context.getTargetInfo().getNewAlign() /
+-                                    Context.getTargetInfo().getCharWidth());
+-          break;
+-        default:
+-          break;
+-        }
+-      }
+     }
+ 
+     // 'const', 'pure' and 'noalias' attributed functions are also nounwind.
+--- b/test/CodeGen/alloc-fns-alignment.c
++++ /dev/null
+@@ -1,35 +0,0 @@
+-// RUN: %clang_cc1 -triple x86_64-unknown-linux-gnu -emit-llvm < %s | FileCheck %s --check-prefix=ALIGN16
+-// RUN: %clang_cc1 -triple x86_64-windows-msvc      -emit-llvm < %s | FileCheck %s --check-prefix=ALIGN16
+-// RUN: %clang_cc1 -triple i386-apple-darwin        -emit-llvm < %s | FileCheck %s --check-prefix=ALIGN16
+-// RUN: %clang_cc1 -triple i386-unknown-linux-gnu   -emit-llvm < %s | FileCheck %s --check-prefix=ALIGN8
+-// RUN: %clang_cc1 -triple x86_64-unknown-linux-gnu -fno-builtin-malloc  -emit-llvm < %s  | FileCheck %s --check-prefix=NOBUILTIN-MALLOC
+-// RUN: %clang_cc1 -triple x86_64-unknown-linux-gnu -fno-builtin-calloc  -emit-llvm < %s  | FileCheck %s --check-prefix=NOBUILTIN-CALLOC
+-// RUN: %clang_cc1 -triple x86_64-unknown-linux-gnu -fno-builtin-realloc -emit-llvm < %s  | FileCheck %s --check-prefix=NOBUILTIN-REALLOC
+-
+-typedef __SIZE_TYPE__ size_t;
+-
+-void *malloc(size_t);
+-void *calloc(size_t, size_t);
+-void *realloc(void *, size_t);
+-
+-void *malloc_test(size_t n) {
+-  return malloc(n);
+-}
+-
+-void *calloc_test(size_t n) {
+-  return calloc(1, n);
+-}
+-
+-void *raalloc_test(void *p, size_t n) {
+-  return realloc(p, n);
+-}
+-
+-// ALIGN16: align 16 i8* @malloc
+-// ALIGN16: align 16 i8* @calloc
+-// ALIGN16: align 16 i8* @realloc
+-// ALIGN8: align 8 i8* @malloc
+-// ALIGN8: align 8 i8* @calloc
+-// ALIGN8: align 8 i8* @realloc
+-// NOBUILTIN-MALLOC: declare i8* @malloc
+-// NOBUILTIN-CALLOC: declare i8* @calloc
+-// NOBUILTIN-REALLOC: declare i8* @realloc

third_party/nixpkgs/pkgs/development/compilers/llvm/13/default.nix

@@ -252,11 +252,18 @@ let
                );
     };
 
-    libcxxabi = callPackage ./libcxxabi {
+    libcxxabi = let
-      inherit llvm_meta;
+      stdenv_ = if stdenv.hostPlatform.useLLVM or false
-      stdenv = if stdenv.hostPlatform.useLLVM or false
                then overrideCC stdenv buildLlvmTools.clangNoLibcxx
                else stdenv;
+      cxx-headers = callPackage ./libcxx {
+        inherit llvm_meta;
+        stdenv = stdenv_;
+        headersOnly = true;
+      };
+    in callPackage ./libcxxabi {
+      stdenv = stdenv_;
+      inherit llvm_meta cxx-headers;
     };
 
     libunwind = callPackage ./libunwind {

third_party/nixpkgs/pkgs/development/compilers/llvm/13/libcxx/default.nix

@@ -1,15 +1,23 @@
 { lib, stdenv, llvm_meta, src, cmake, python3, fixDarwinDylibNames, version
+, libcxxabi
 , enableShared ? !stdenv.hostPlatform.isStatic
+
+# If headersOnly is true, the resulting package would only include the headers.
+# Use this to break the circular dependency between libcxx and libcxxabi.
+#
+# Some context:
+# https://reviews.llvm.org/rG1687f2bbe2e2aaa092f942d4a97d41fad43eedfb
+, headersOnly ? false
 }:
 
 stdenv.mkDerivation rec {
-  pname = "libcxx";
+  pname = if headersOnly then "cxx-headers" else "libcxx";
   inherit version;
 
   inherit src;
-  sourceRoot = "source/${pname}";
+  sourceRoot = "source/libcxx";
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" ] ++ lib.optional (!headersOnly) "dev";
 
   patches = [
     ./gnu-install-dirs.patch
@@ -17,6 +25,12 @@ stdenv.mkDerivation rec {
     ../../libcxx-0001-musl-hacks.patch
   ];
 
+  # Prevent errors like "error: 'foo' is unavailable: introduced in macOS yy.zz"
+  postPatch = ''
+    substituteInPlace include/__config \
+      --replace "#    define _LIBCPP_USE_AVAILABILITY_APPLE" ""
+  '';
+
   preConfigure = lib.optionalString stdenv.hostPlatform.isMusl ''
     patchShebangs utils/cat_files.py
   '';
@@ -24,15 +38,29 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake python3 ]
     ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
-  cmakeFlags = [
+  buildInputs = lib.optionals (!headersOnly) [ libcxxabi ];
-  ] ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
+
+  cmakeFlags = [ "-DLIBCXX_CXX_ABI=libcxxabi" ]
+    ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
-    ++ lib.optional stdenv.hostPlatform.isWasm [
+    ++ lib.optionals stdenv.hostPlatform.isWasm [
       "-DLIBCXX_ENABLE_THREADS=OFF"
       "-DLIBCXX_ENABLE_FILESYSTEM=OFF"
       "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
     ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF";
 
+  buildFlags = lib.optional headersOnly "generate-cxx-headers";
+  installTargets = lib.optional headersOnly "install-cxx-headers";
+
+  # At this point, cxxabi headers would be installed in the dev output, which
+  # prevents moveToOutput from doing its job later in the build process.
+  postInstall = lib.optionalString (!headersOnly) ''
+    mv "$dev/include/c++/v1/"* "$out/include/c++/v1/"
+    pushd "$dev"
+    rmdir -p include/c++/v1
+    popd
+  '';
+
   passthru = {
     isLLVM = true;
   };
@@ -45,9 +73,6 @@ stdenv.mkDerivation rec {
       C++14 and above.
     '';
 
-    # https://github.com/NixOS/nixpkgs/pull/133217#issuecomment-895742807
-    broken = stdenv.isDarwin;
-
     # "All of the code in libc++ is dual licensed under the MIT license and the
     # UIUC License (a BSD-like license)":
     license = with lib.licenses; [ mit ncsa ];

third_party/nixpkgs/pkgs/development/compilers/llvm/13/libcxxabi/default.nix

@@ -1,6 +1,7 @@
-{ lib, stdenv, llvm_meta, cmake, python3, src, libunwind, version
+{ lib, stdenv, llvm_meta, cmake, python3, src, cxx-headers, libunwind, version
 , enableShared ? !stdenv.hostPlatform.isStatic
-, libcxx
+, standalone ? stdenv.hostPlatform.useLLVM or false
+, withLibunwind ? !stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm
 }:
 
 stdenv.mkDerivation rec {
@@ -23,12 +24,13 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ cmake python3 ];
-  buildInputs = lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm) libunwind;
+  buildInputs = lib.optional withLibunwind libunwind;
 
   cmakeFlags = [
-    "-DLIBCXXABI_LIBCXX_INCLUDES=${libcxx.dev}/include/c++/v1"
+    "-DLIBCXXABI_LIBCXX_INCLUDES=${cxx-headers}/include/c++/v1"
-  ] ++ lib.optionals (stdenv.hostPlatform.useLLVM or false) [
+  ] ++ lib.optionals standalone [
     "-DLLVM_ENABLE_LIBCXX=ON"
+  ] ++ lib.optionals (standalone && withLibunwind) [
     "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
   ] ++ lib.optionals stdenv.hostPlatform.isWasm [
     "-DLIBCXXABI_ENABLE_THREADS=OFF"

third_party/nixpkgs/pkgs/development/compilers/llvm/6/libcxx/default.nix

@@ -19,6 +19,12 @@ stdenv.mkDerivation {
     ../../libcxx-0001-musl-hacks.patch
   ];
 
+  # Prevent errors like "error: 'foo' is unavailable: introduced in macOS yy.zz"
+  postPatch = ''
+    substituteInPlace include/__config \
+      --replace "#define _LIBCPP_USE_AVAILABILITY_APPLE" ""
+  '';
+
   prePatch = ''
     substituteInPlace lib/CMakeLists.txt --replace "/usr/lib/libc++" "\''${LIBCXX_LIBCXXABI_LIB_PATH}/libc++"
   '';

third_party/nixpkgs/pkgs/development/compilers/llvm/7/libcxx/default.nix

@@ -21,6 +21,12 @@ stdenv.mkDerivation {
     ../../libcxx-0001-musl-hacks.patch
   ];
 
+  # Prevent errors like "error: 'foo' is unavailable: introduced in macOS yy.zz"
+  postPatch = ''
+    substituteInPlace include/__config \
+      --replace "#    define _LIBCPP_USE_AVAILABILITY_APPLE" ""
+  '';
+
   prePatch = ''
     substituteInPlace lib/CMakeLists.txt --replace "/usr/lib/libc++" "\''${LIBCXX_LIBCXXABI_LIB_PATH}/libc++"
   '';

third_party/nixpkgs/pkgs/development/compilers/llvm/8/libcxx/default.nix

@@ -21,6 +21,12 @@ stdenv.mkDerivation {
     ../../libcxx-0001-musl-hacks.patch
   ];
 
+  # Prevent errors like "error: 'foo' is unavailable: introduced in macOS yy.zz"
+  postPatch = ''
+    substituteInPlace include/__config \
+      --replace "#    define _LIBCPP_USE_AVAILABILITY_APPLE" ""
+  '';
+
   prePatch = ''
     substituteInPlace lib/CMakeLists.txt --replace "/usr/lib/libc++" "\''${LIBCXX_LIBCXXABI_LIB_PATH}/libc++"
   '';

third_party/nixpkgs/pkgs/development/compilers/llvm/9/libcxx/default.nix

@@ -21,6 +21,12 @@ stdenv.mkDerivation {
     ../../libcxx-0001-musl-hacks.patch
   ];
 
+  # Prevent errors like "error: 'foo' is unavailable: introduced in macOS yy.zz"
+  postPatch = ''
+    substituteInPlace include/__config \
+      --replace "#    define _LIBCPP_USE_AVAILABILITY_APPLE" ""
+  '';
+
   preConfigure = ''
     # Get headers from the cxxabi source so we can see private headers not installed by the cxxabi package
     cmakeFlagsArray=($cmakeFlagsArray -DLIBCXX_CXX_ABI_INCLUDE_PATHS="$LIBCXXABI_INCLUDE_DIR")

third_party/nixpkgs/pkgs/development/compilers/llvm/git/default.nix

@@ -247,11 +247,18 @@ let
                else stdenv;
     };
 
-    libcxxabi = callPackage ./libcxxabi {
+    libcxxabi = let
-      inherit llvm_meta;
+      stdenv_ = if stdenv.hostPlatform.useLLVM or false
-      stdenv = if stdenv.hostPlatform.useLLVM or false
                then overrideCC stdenv buildLlvmTools.clangNoLibcxx
                else stdenv;
+      cxx-headers = callPackage ./libcxx {
+        inherit llvm_meta;
+        stdenv = stdenv_;
+        headersOnly = true;
+      };
+    in callPackage ./libcxxabi {
+      stdenv = stdenv_;
+      inherit llvm_meta cxx-headers;
     };
 
     libunwind = callPackage ./libunwind {

third_party/nixpkgs/pkgs/development/compilers/llvm/git/libcxx/default.nix

@@ -1,15 +1,23 @@
 { lib, stdenv, llvm_meta, src, cmake, python3, fixDarwinDylibNames, version
+, libcxxabi
 , enableShared ? !stdenv.hostPlatform.isStatic
+
+# If headersOnly is true, the resulting package would only include the headers.
+# Use this to break the circular dependency between libcxx and libcxxabi.
+#
+# Some context:
+# https://reviews.llvm.org/rG1687f2bbe2e2aaa092f942d4a97d41fad43eedfb
+, headersOnly ? false
 }:
 
 stdenv.mkDerivation rec {
-  pname = "libcxx";
+  pname = if headersOnly then "cxx-headers" else "libcxx";
   inherit version;
 
   inherit src;
-  sourceRoot = "source/${pname}";
+  sourceRoot = "source/libcxx";
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" ] ++ lib.optional (!headersOnly) "dev";
 
   patches = [
     ./gnu-install-dirs.patch
@@ -17,6 +25,12 @@ stdenv.mkDerivation rec {
     ../../libcxx-0001-musl-hacks.patch
   ];
 
+  # Prevent errors like "error: 'foo' is unavailable: introduced in macOS yy.zz"
+  postPatch = ''
+    substituteInPlace include/__config \
+      --replace "#    define _LIBCPP_USE_AVAILABILITY_APPLE" ""
+  '';
+
   preConfigure = lib.optionalString stdenv.hostPlatform.isMusl ''
     patchShebangs utils/cat_files.py
   '';
@@ -24,15 +38,29 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake python3 ]
     ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
-  cmakeFlags = [
+  buildInputs = lib.optionals (!headersOnly) [ libcxxabi ];
-  ] ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
+
+  cmakeFlags = [ "-DLIBCXX_CXX_ABI=libcxxabi" ]
+    ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
-    ++ lib.optional stdenv.hostPlatform.isWasm [
+    ++ lib.optionals stdenv.hostPlatform.isWasm [
       "-DLIBCXX_ENABLE_THREADS=OFF"
       "-DLIBCXX_ENABLE_FILESYSTEM=OFF"
       "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
     ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF";
 
+  buildFlags = lib.optional headersOnly "generate-cxx-headers";
+  installTargets = lib.optional headersOnly "install-cxx-headers";
+
+  # At this point, cxxabi headers would be installed in the dev output, which
+  # prevents moveToOutput from doing its job later in the build process.
+  postInstall = lib.optionalString (!headersOnly) ''
+    mv "$dev/include/c++/v1/"* "$out/include/c++/v1/"
+    pushd "$dev"
+    rmdir -p include/c++/v1
+    popd
+  '';
+
   passthru = {
     isLLVM = true;
   };

third_party/nixpkgs/pkgs/development/compilers/llvm/git/libcxxabi/default.nix

@@ -1,6 +1,5 @@
-{ lib, stdenv, llvm_meta, cmake, python3, src, libunwind, version
+{ lib, stdenv, llvm_meta, cmake, python3, src, cxx-headers, libunwind, version
 , enableShared ? !stdenv.hostPlatform.isStatic
-, libcxx
 }:
 
 stdenv.mkDerivation rec {
@@ -26,7 +25,7 @@ stdenv.mkDerivation rec {
   buildInputs = lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm) libunwind;
 
   cmakeFlags = [
-    "-DLIBCXXABI_LIBCXX_INCLUDES=${libcxx.dev}/include/c++/v1"
+    "-DLIBCXXABI_LIBCXX_INCLUDES=${cxx-headers}/include/c++/v1"
   ] ++ lib.optionals (stdenv.hostPlatform.useLLVM or false) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"

third_party/nixpkgs/pkgs/development/compilers/mozart/default.nix

@@ -4,7 +4,8 @@
 , cmake
 , unzip
 , makeWrapper
-, boost
+, boost169
+, pinnedBoost ? boost169
 , llvmPackages
 , llvmPackages_5
 , gmp
@@ -67,7 +68,7 @@ in stdenv.mkDerivation rec {
   '';
 
   buildInputs = [
-    boost
+    pinnedBoost
     llvmPackages_5.llvm
     llvmPackages_5.clang
     llvmPackages_5.clang-unwrapped

third_party/nixpkgs/pkgs/development/compilers/opendylan/bin.nix

@@ -2,15 +2,16 @@
 # The binaries can also be used as is.
 {lib, stdenv, fetchurl, patchelf, boehmgc, gnused, gcc, makeWrapper}:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
-  name = "opendylan-2013.2";
+  pname = "opendylan";
+  version = "2013.2";
 
   src = if stdenv.hostPlatform.system == "x86_64-linux" then fetchurl {
-      url = "https://opendylan.org/downloads/opendylan/2013.2/opendylan-2013.2-x86_64-linux.tar.bz2";
+      url = "https://opendylan.org/downloads/opendylan/${version}/opendylan-${version}-x86_64-linux.tar.bz2";
       sha256 = "035brbw3hm7zrs593q4zc42yglj1gmmkw3b1r7zzlw3ks4i2lg7h";
     }
     else if stdenv.hostPlatform.system == "i686-linux" then fetchurl {
-      url = "https://opendylan.org/downloads/opendylan/2013.2/opendylan-2013.2-x86-linux.tar.bz2";
+      url = "https://opendylan.org/downloads/opendylan/${version}/opendylan-${version}-x86-linux.tar.bz2";
       sha256 = "0c61ihvblcsjrw6ncr8x8ylhskcrqs8pajs4mg5di36cvqw12nq5";
     }
     else throw "platform ${stdenv.hostPlatform.system} not supported.";

third_party/nixpkgs/pkgs/development/compilers/rust/1_57.nix

@@ -20,8 +20,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.56.1";
+  rustcVersion = "1.57.0";
-  rustcSha256 = "04cmqx7nn63hzz7z27b2b0dj2qx18rck9ifvip43s6dampx8v2f3";
+  rustcSha256 = "06jw8ka2p3kls8p0gd4p0chhhb1ia1mlvj96zn78n7qvp71zjiim";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_13.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_13.libllvm.override { enableSharedLibraries = true; };
@@ -37,24 +37,24 @@ import ./default.nix {
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.55.0";
+  bootstrapVersion = "1.56.1";
 
   # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "6e42b6c44d2eb4170f4144423fa3c33338d8d5c3ea00b03bbac200c877bc9e98";
+    i686-unknown-linux-gnu = "84db34603ce22d93312ff8bccd5580fe112e932bbeb0361e7cc37668a9803a27";
-    x86_64-unknown-linux-gnu = "2080253a2ec36ac8ed6e060d30802d888533124b8d16545cfd4af898b365eaac";
+    x86_64-unknown-linux-gnu = "a6be5d045183a0b12dddf0d81633e2a64e63e4c2dfa44eb7593970c1ef93a98f";
-    x86_64-unknown-linux-musl = "f24f68587253c4bfbe59d3d10fe4897068d9130538de6b2d02097a25718030c2";
+    x86_64-unknown-linux-musl = "3c09058d104d9a88943fb343af1fb70422f9c4a987e6703666ee8a8051211190";
-    arm-unknown-linux-gnueabihf = "483444153d35cda51c6aec2c24bc4c97fa4fd30b28df4b60bf9763bd6e06da3a";
+    arm-unknown-linux-gnueabihf = "c445706d109bb74de4c889687ae08a48af5808676fda15b84b7ef5970a82a5f6";
-    armv7-unknown-linux-gnueabihf = "8c72f0eb75b10db970fb546c3b41f5e97df294d5dbbf0b8fa96e17f2b281ee9c";
+    armv7-unknown-linux-gnueabihf = "29ec65af502370c0c1a49faecd7131f1243fe3005b419ead4b40b267af2b2db0";
-    aarch64-unknown-linux-gnu = "eebdb2e659ed14884a49f0457d44e5e8c9f89fca3414533752c6dbb96232c156";
+    aarch64-unknown-linux-gnu = "69792887357c8dd78c5424f0b4a624578296796d99edf6c30ebe2acc2b939aa3";
-    aarch64-unknown-linux-musl = "2ce36a7d34f1f2aa43b4cbc0b437d96eefb45743828bf9ae699ff581ae257f28";
+    aarch64-unknown-linux-musl = "971d13d41657e50e3ac54f17f52b4198c3d8bc25ec489a6a9e6d12c18226dda5";
-    x86_64-apple-darwin = "2e345ac7724c192c9487a2c6bd4f6c52c884d791981510288830d27d9a0bf2f3";
+    x86_64-apple-darwin = "8d65ef02a123c23be00101fb204d28b60498b9145dd2ee8edabf0afde6e01e55";
-    aarch64-apple-darwin = "70c71d30d0de76912fcd88d503a6cb4323cfe6250c1a255be7e0d4e644b3d40a";
+    aarch64-apple-darwin = "e71c14c1368048a22e4d1851f301872ac2e6f4c574f04d2a7ae4d64b0e7c7235";
-    powerpc64le-unknown-linux-gnu = "12bf6447d338cbe2b55539b84e6369b17e7eefe938d1ba7e3dd69781c9cc9812";
+    powerpc64le-unknown-linux-gnu = "fa78b28fe1ef3cd4add9ec151e5eab756dfc83c8bc3e5a576a6eddd350c4de7a";
-    riscv64gc-unknown-linux-gnu = "effceb45346fef3b0b54b357336e6f374f788b803bb1bee4084f25eace8907f3";
+    riscv64gc-unknown-linux-gnu = "5ec327d1bd3ba8d00afbe9be4a1f0fb8ab845063fcf9be479be9493c52a4dbb6";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_56;
+  selectRustPackage = pkgs: pkgs.rust_1_57;
 
   rustcPatches = [
   ];

third_party/nixpkgs/pkgs/development/compilers/vala/default.nix

@@ -114,8 +114,8 @@ in rec {
   };
 
   vala_0_54 = generic {
-    version = "0.54.2";
+    version = "0.54.3";
-    sha256 = "iE3nRTF9TVbk6M7emT3I8E1Qz8o2z2DS8vJ4wwwrExE=";
+    sha256 = "7R1f5MvAzShF0N5PH/77Fa+waJLSMMfMppV4FnLo+2A=";
   };
 
   vala = vala_0_54;

third_party/nixpkgs/pkgs/development/haskell-modules/lib/compose.nix

@@ -288,7 +288,11 @@ rec {
     enableLibraryProfiling = false;
     isLibrary = false;
     doHaddock = false;
-    postFixup = "rm -rf $out/lib $out/nix-support $out/share/doc";
+    postFixup = drv.postFixup or "" + ''
+
+      # Remove every directory which could have links to other store paths.
+      rm -rf $out/lib $out/nix-support $out/share/doc
+    '';
   });
 
   /* Build a source distribution tarball instead of using the source files

third_party/nixpkgs/pkgs/development/interpreters/dzaima-apl/default.nix

@@ -64,6 +64,7 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = with maintainers; [ AndersonTorres ];
     inherit (jdk.meta) platforms;
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/staging-next/dapl-native.x86_64-darwin
   };
 }
 # TODO: Processing app

third_party/nixpkgs/pkgs/development/interpreters/love/0.7.nix

@@ -6,9 +6,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "love-0.7.2";
+  pname = "love";
+  version = "0.7.2";
+
   src = fetchurl {
-    url = "https://bitbucket.org/rude/love/downloads/${name}-linux-src.tar.gz";
+    url = "https://bitbucket.org/rude/love/downloads/love-${version}-linux-src.tar.gz";
     sha256 = "0s7jywkvydlshlgy11ilzngrnybmq5xlgzp2v2dhlffwrfqdqym5";
   };
 

third_party/nixpkgs/pkgs/development/interpreters/love/0.9.nix

@@ -5,9 +5,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "love-0.9.1";
+  pname = "love";
+  version = "0.9.1";
+
   src = fetchurl {
-    url = "https://bitbucket.org/rude/love/downloads/${name}-linux-src.tar.gz";
+    url = "https://bitbucket.org/rude/love/downloads/love-${version}-linux-src.tar.gz";
     sha256 = "1pikd0bzb44r4bf0jbgn78whz1yswpq1n5jc8nf87v42pm30kp84";
   };
 

third_party/nixpkgs/pkgs/development/interpreters/python/cpython/3.11/no-ldconfig.patch

@@ -0,0 +1,107 @@
+From 5330b6af9f832af59aa5c61d9ef6971053a8e709 Mon Sep 17 00:00:00 2001
+From: Jonathan Ringer <jonringer117@gmail.com>
+Date: Mon, 9 Nov 2020 10:24:35 -0800
+Subject: [PATCH] CPython: Don't use ldconfig
+
+---
+ Lib/ctypes/util.py | 77 ++--------------------------------------------
+ 1 file changed, 2 insertions(+), 75 deletions(-)
+
+diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
+index 0c2510e161..7fb98af308 100644
+--- a/Lib/ctypes/util.py
++++ b/Lib/ctypes/util.py
+@@ -100,53 +100,7 @@ def _is_elf(filename):
+             return thefile.read(4) == elf_header
+ 
+     def _findLib_gcc(name):
+-        # Run GCC's linker with the -t (aka --trace) option and examine the
+-        # library name it prints out. The GCC command will fail because we
+-        # haven't supplied a proper program with main(), but that does not
+-        # matter.
+-        expr = os.fsencode(r'[^\(\)\s]*lib%s\.[^\(\)\s]*' % re.escape(name))
+-
+-        c_compiler = shutil.which('gcc')
+-        if not c_compiler:
+-            c_compiler = shutil.which('cc')
+-        if not c_compiler:
+-            # No C compiler available, give up
+-            return None
+-
+-        temp = tempfile.NamedTemporaryFile()
+-        try:
+-            args = [c_compiler, '-Wl,-t', '-o', temp.name, '-l' + name]
+-
+-            env = dict(os.environ)
+-            env['LC_ALL'] = 'C'
+-            env['LANG'] = 'C'
+-            try:
+-                proc = subprocess.Popen(args,
+-                                        stdout=subprocess.PIPE,
+-                                        stderr=subprocess.STDOUT,
+-                                        env=env)
+-            except OSError:  # E.g. bad executable
+-                return None
+-            with proc:
+-                trace = proc.stdout.read()
+-        finally:
+-            try:
+-                temp.close()
+-            except FileNotFoundError:
+-                # Raised if the file was already removed, which is the normal
+-                # behaviour of GCC if linking fails
+-                pass
+-        res = re.findall(expr, trace)
+-        if not res:
+-            return None
+-
+-        for file in res:
+-            # Check if the given file is an elf file: gcc can report
+-            # some files that are linker scripts and not actual
+-            # shared objects. See bpo-41976 for more details
+-            if not _is_elf(file):
+-                continue
+-            return os.fsdecode(file)
++        return None
+ 
+ 
+     if sys.platform == "sunos5":
+@@ -268,34 +222,7 @@ def find_library(name, is64 = False):
+     else:
+ 
+         def _findSoname_ldconfig(name):
+-            import struct
+-            if struct.calcsize('l') == 4:
+-                machine = os.uname().machine + '-32'
+-            else:
+-                machine = os.uname().machine + '-64'
+-            mach_map = {
+-                'x86_64-64': 'libc6,x86-64',
+-                'ppc64-64': 'libc6,64bit',
+-                'sparc64-64': 'libc6,64bit',
+-                's390x-64': 'libc6,64bit',
+-                'ia64-64': 'libc6,IA-64',
+-                }
+-            abi_type = mach_map.get(machine, 'libc6')
+-
+-            # XXX assuming GLIBC's ldconfig (with option -p)
+-            regex = r'\s+(lib%s\.[^\s]+)\s+\(%s'
+-            regex = os.fsencode(regex % (re.escape(name), abi_type))
+-            try:
+-                with subprocess.Popen(['/sbin/ldconfig', '-p'],
+-                                      stdin=subprocess.DEVNULL,
+-                                      stderr=subprocess.DEVNULL,
+-                                      stdout=subprocess.PIPE,
+-                                      env={'LC_ALL': 'C', 'LANG': 'C'}) as p:
+-                    res = re.search(regex, p.stdout.read())
+-                    if res:
+-                        return os.fsdecode(res.group(1))
+-            except OSError:
+-                pass
++            return None
+ 
+         def _findLib_ld(name):
+             # See issue #9998 for why this is needed
+-- 
+2.33.1
+

third_party/nixpkgs/pkgs/development/interpreters/python/cpython/docs/2.7-html.nix

@@ -2,10 +2,12 @@
 
 { stdenv, fetchurl, lib }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
-  name = "python27-docs-html-2.7.16";
+  pname = "python27-docs-html";
+  version = "2.7.16";
+
   src = fetchurl {
-    url = "http://docs.python.org/ftp/python/doc/2.7.16/python-2.7.16-docs-html.tar.bz2";
+    url = "http://docs.python.org/ftp/python/doc/${version}/python-${version}-docs-html.tar.bz2";
     sha256 = "1razs1grzhai65ihaiyph8kz6ncjkgp1gsn3c8v7kanf13lqim02";
   };
   installPhase = ''

third_party/nixpkgs/pkgs/development/interpreters/python/cpython/docs/2.7-pdf-a4.nix

@@ -2,10 +2,12 @@
 
 { stdenv, fetchurl, lib }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
-  name = "python27-docs-pdf-a4-2.7.16";
+  pname = "python27-docs-pdf-a4";
+  version = "2.7.16";
+
   src = fetchurl {
-    url = "http://docs.python.org/ftp/python/doc/2.7.16/python-2.7.16-docs-pdf-a4.tar.bz2";
+    url = "http://docs.python.org/ftp/python/doc/${version}/python-${version}-docs-pdf-a4.tar.bz2";
     sha256 = "14ml1ynrlbhg43737bdsb8k5y39wsffqj4iwhylhb8n8l5dplfdq";
   };
   installPhase = ''

third_party/nixpkgs/pkgs/development/interpreters/python/cpython/docs/2.7-pdf-letter.nix

@@ -2,10 +2,12 @@
 
 { stdenv, fetchurl, lib }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
-  name = "python27-docs-pdf-letter-2.7.16";
+  pname = "python27-docs-pdf-letter";
+  version = "2.7.16";
+
   src = fetchurl {
-    url = "http://docs.python.org/ftp/python/doc/2.7.16/python-2.7.16-docs-pdf-letter.tar.bz2";
+    url = "http://docs.python.org/ftp/python/doc/${version}/python-${version}-docs-pdf-letter.tar.bz2";
     sha256 = "019i8n48m71mn31v8d85kkwyqfgcgqnqh506y4a7fcgf656bajs0";
   };
   installPhase = ''

third_party/nixpkgs/pkgs/development/interpreters/python/cpython/docs/2.7-text.nix

@@ -2,10 +2,12 @@
 
 { stdenv, fetchurl, lib }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
-  name = "python27-docs-text-2.7.16";
+  pname = "python27-docs-text";
+  version = "2.7.16";
+
   src = fetchurl {
-    url = "http://docs.python.org/ftp/python/doc/2.7.16/python-2.7.16-docs-text.tar.bz2";
+    url = "http://docs.python.org/ftp/python/doc/${version}/python-${version}-docs-text.tar.bz2";
     sha256 = "1da7swlykvc013684nywycinfz3v8dqkcmv0zj8p7l5lyi5mq03r";
   };
   installPhase = ''

third_party/nixpkgs/pkgs/development/interpreters/python/cpython/docs/3.7-html.nix

@@ -2,10 +2,12 @@
 
 { stdenv, fetchurl, lib }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
-  name = "python37-docs-html-3.7.2";
+  pname = "python37-docs-html";
+  version = "3.7.2";
+
   src = fetchurl {
-    url = "http://docs.python.org/ftp/python/doc/3.7.2/python-3.7.2-docs-html.tar.bz2";
+    url = "http://docs.python.org/ftp/python/doc/${version}/python-${version}-docs-html.tar.bz2";
     sha256 = "19wbrawpdam09fmyipfy92sxwn1rl93v8jkfqsfx028qhvzf0422";
   };
   installPhase = ''

third_party/nixpkgs/pkgs/development/interpreters/python/cpython/docs/3.7-pdf-a4.nix

@@ -2,10 +2,12 @@
 
 { stdenv, fetchurl, lib }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
-  name = "python37-docs-pdf-a4-3.7.2";
+  pname = "python37-docs-pdf-a4";
+  version = "3.7.2";
+
   src = fetchurl {
-    url = "http://docs.python.org/ftp/python/doc/3.7.2/python-3.7.2-docs-pdf-a4.tar.bz2";
+    url = "http://docs.python.org/ftp/python/doc/${version}/python-${version}-docs-pdf-a4.tar.bz2";
     sha256 = "0vdx762m30hjaabn6w88awcj2qpbz0b6z59zn9wmamd35k59lfba";
   };
   installPhase = ''

third_party/nixpkgs/pkgs/development/interpreters/python/cpython/docs/3.7-pdf-letter.nix

@@ -2,10 +2,12 @@
 
 { stdenv, fetchurl, lib }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
-  name = "python37-docs-pdf-letter-3.7.2";
+  pname = "python37-docs-pdf-letter";
+  version = "3.7.2";
+
   src = fetchurl {
-    url = "http://docs.python.org/ftp/python/doc/3.7.2/python-3.7.2-docs-pdf-letter.tar.bz2";
+    url = "http://docs.python.org/ftp/python/doc/${version}/python-${version}-docs-pdf-letter.tar.bz2";
     sha256 = "17g57vlyvqx0k916q84q2pcx7y8myw0fda9fvg9kh0ph930c837x";
   };
   installPhase = ''

third_party/nixpkgs/pkgs/development/interpreters/python/cpython/docs/3.7-text.nix

@@ -2,10 +2,12 @@
 
 { stdenv, fetchurl, lib }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
-  name = "python37-docs-text-3.7.2";
+  pname = "python37-docs-text";
+  version = "3.7.2";
+
   src = fetchurl {
-    url = "http://docs.python.org/ftp/python/doc/3.7.2/python-3.7.2-docs-text.tar.bz2";
+    url = "http://docs.python.org/ftp/python/doc/${version}/python-${version}-docs-text.tar.bz2";
     sha256 = "0h50rlr8jclwfxa106b42q2vn2ynp219c4zsy5qz65n5m3b7y1g2";
   };
   installPhase = ''

third_party/nixpkgs/pkgs/development/interpreters/python/default.nix

@@ -95,6 +95,7 @@ with pkgs;
         isPy38 = pythonVersion == "3.8";
         isPy39 = pythonVersion == "3.9";
         isPy310 = pythonVersion == "3.10";
+        isPy311 = pythonVersion == "3.11";
         isPy2 = lib.strings.substring 0 1 pythonVersion == "2";
         isPy3 = lib.strings.substring 0 1 pythonVersion == "3";
         isPy3k = isPy3;
@@ -132,10 +133,10 @@ with pkgs;
       sourceVersion = {
         major = "3";
         minor = "9";
-        patch = "6";
+        patch = "9";
         suffix = "";
       };
-      sha256 = "12hhw2685i68pwfx5hdkqngzhbji4ccyjmqb5rzvkigg6fpj0y9r";
+      sha256 = "sha256-BoKMBKVzwHOk5RxCkqJ8G+SuJmIcPtx8+TGEGM47bSc=";
     };
   };
 
@@ -192,6 +193,19 @@ in {
     inherit passthruFun;
   };
 
+  python311 = callPackage ./cpython {
+    self = python311;
+    sourceVersion = {
+      major = "3";
+      minor = "11";
+      patch = "0";
+      suffix = "a2";
+    };
+    sha256 = "sha256-aKjE1s4lSKe2F9aZ+9s0iTe9rODPltsaoIOEnfXa0T8=";
+    inherit (darwin) configd;
+    inherit passthruFun;
+  };
+
   # Minimal versions of Python (built without optional dependencies)
   python3Minimal = (callPackage ./cpython ({
     self = python3Minimal;

third_party/nixpkgs/pkgs/development/interpreters/python/hooks/python-namespaces-hook.sh

@@ -24,6 +24,17 @@ pythonNamespacesHook() {
                 rm -v "$pathToRemove"
             fi
 
+            # remove ${pname}-${version}-${python-interpeter}-nspkg.pth
+            #
+            # Still need to check that parent directory exists in the
+            # event of a "meta-package" package, which will just install
+            # other packages, but not produce anything in site-packages
+            # besides meta information
+            if [ -d "${constructedPath}/../" -a -z ${dontRemovePth-} ]; then
+                # .pth files are located in the parent directory of a module
+                @findutils@/bin/find ${constructedPath}/../ -name '*-nspkg.pth' -exec rm -v "{}" +
+            fi
+
             # remove __pycache__/ entry, can be interpreter specific. E.g. __init__.cpython-38.pyc
             # use null characters to perserve potential whitespace in filepath
             if [ -d "$pycachePath" ]; then

third_party/nixpkgs/pkgs/development/libraries/aalib/default.nix

@@ -1,10 +1,11 @@
 {lib, stdenv, fetchurl, ncurses, automake}:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
-  name = "aalib-1.4rc5";
+  pname = "aalib";
+  version = "1.4rc5";
 
   src = fetchurl {
-    url = "mirror://sourceforge/aa-project/aalib-1.4rc5.tar.gz";
+    url = "mirror://sourceforge/aa-project/aalib-${version}.tar.gz";
     sha256 = "1vkh19gb76agvh4h87ysbrgy82hrw88lnsvhynjf4vng629dmpgv";
   };
 

third_party/nixpkgs/pkgs/development/libraries/acl/default.nix

@@ -6,10 +6,11 @@
 # files.
 
 stdenv.mkDerivation rec {
-  name = "acl-2.3.1";
+  pname = "acl";
+  version = "2.3.1";
 
   src = fetchurl {
-    url = "mirror://savannah/acl/${name}.tar.gz";
+    url = "mirror://savannah/acl/acl-${version}.tar.gz";
     sha256 = "sha256-dgxhxokBs3/dXu/ur0wMeia9/disdHoe3/HODiQ8Ea8=";
   };
 

third_party/nixpkgs/pkgs/development/libraries/aubio/default.nix

@@ -3,10 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "aubio-0.4.9";
+  pname = "aubio";
+  version = "0.4.9";
 
   src = fetchurl {
-    url = "https://aubio.org/pub/${name}.tar.bz2";
+    url = "https://aubio.org/pub/aubio-${version}.tar.bz2";
     sha256 = "1npks71ljc48w6858l9bq30kaf5nph8z0v61jkfb70xb9np850nl";
   };
 

third_party/nixpkgs/pkgs/development/libraries/audio/rtmidi/default.nix

@@ -42,6 +42,9 @@ stdenv.mkDerivation rec {
       url = "https://github.com/thestk/rtmidi/pull/230/commits/892fe5492f0e787484fa4a37027b08c265ce001f.patch";
       sha256 = "0ca9m42xa3gmycimzvzvl67wa266xq9pfp1b4v555rh2fp52kbcj";
     })
+
+    # https://github.com/thestk/rtmidi/pull/277
+    ./macos_include_targetconditionals.patch
   ];
 
   postPatch = ''

third_party/nixpkgs/pkgs/development/libraries/audio/rtmidi/macos_include_targetconditionals.patch

@@ -0,0 +1,13 @@
+diff -ru a/RtMidi.cpp b/RtMidi.cpp
+--- a/RtMidi.cpp	2021-12-23 16:46:33.000000000 -0500
++++ b/RtMidi.cpp	2021-12-23 16:48:19.000000000 -0500
+@@ -39,6 +39,9 @@
+ 
+ #include "RtMidi.h"
+ #include <sstream>
++#if defined(__APPLE__)
++#include <TargetConditionals.h>
++#endif
+ 
+ #if defined(__MACOSX_CORE__)
+   #if TARGET_OS_IPHONE