From e935fa1951e1fef2798365276a056b7dcaa0b118 Mon Sep 17 00:00:00 2001
From: Antoine Viallon <antoine@lesviallon.fr>
Date: Wed, 5 Apr 2023 00:26:36 +0200
Subject: [PATCH 01/33] ffmpeg: add tensorflow dnn backend support

---
 pkgs/development/libraries/ffmpeg/generic.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 0ece46f32668..c69325db75d7 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -79,6 +79,7 @@
 , withSsh ? withHeadlessDeps # SFTP protocol
 , withSvg ? withFullDeps # SVG protocol
 , withSvtav1 ? withFullDeps && !stdenv.isAarch64 # AV1 encoder/decoder (focused on speed and correctness)
+, withTensorflow ? withFullDeps # Tensorflow dnn backend support
 , withTheora ? withHeadlessDeps # Theora encoder
 , withV4l2 ? withFullDeps && !stdenv.isDarwin # Video 4 Linux support
 , withV4l2M2m ? withV4l2
@@ -211,6 +212,7 @@
 , libopus
 , librsvg
 , libssh
+, libtensorflow
 , libtheora
 , libv4l
 , libva
@@ -472,6 +474,7 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withSvg "librsvg")
     (enableFeature withSrt "libsrt")
     (enableFeature withSsh "libssh")
+    (enableFeature withTensorflow "libtensorflow")
     (enableFeature withTheora "libtheora")
     (enableFeature withV4l2 "libv4l2")
     (enableFeature withV4l2M2m "v4l2-m2m")
@@ -596,6 +599,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withSsh [ libssh ]
   ++ optionals withSvg [ librsvg ]
   ++ optionals withSvtav1 [ svt-av1 ]
+  ++ optionals withTensorflow [ libtensorflow ]
   ++ optionals withTheora [ libtheora ]
   ++ optionals withVaapi [ (if withSmallDeps then libva else libva-minimal) ]
   ++ optionals withVdpau [ libvdpau ]

From bbd604ab1de6a2f4c400db38e8e992854e2700c3 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 23 Apr 2023 20:23:15 +0100
Subject: [PATCH 02/33] polyphone: drop redundant INCLUDEPATH to libjack2

`diffoscope` shows no difference before and after the change.
---
 pkgs/applications/audio/polyphone/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/applications/audio/polyphone/default.nix b/pkgs/applications/audio/polyphone/default.nix
index 568f3b6ba151..f7008bf66bba 100644
--- a/pkgs/applications/audio/polyphone/default.nix
+++ b/pkgs/applications/audio/polyphone/default.nix
@@ -36,7 +36,6 @@ mkDerivation rec {
   qmakeFlags = [
     "DEFINES+=USE_LOCAL_STK"
     "DEFINES+=USE_LOCAL_QCUSTOMPLOT"
-    "INCLUDEPATH+=${libjack2}/include/jack"
   ];
 
   meta = with lib; {

From efe64155a224ba9507c4760da72ae50a9b21d8d4 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 24 Apr 2023 22:14:30 +0100
Subject: [PATCH 03/33] numactl: move headers and mans to "dev" and "man"
 outputs

---
 pkgs/os-specific/linux/numactl/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/os-specific/linux/numactl/default.nix b/pkgs/os-specific/linux/numactl/default.nix
index 28157ffe1677..998b7d052b35 100644
--- a/pkgs/os-specific/linux/numactl/default.nix
+++ b/pkgs/os-specific/linux/numactl/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-aDKzkmvrPDzQl4n0KgeiU5LOLhQA0tmwzGiXvJDp7ZI=";
   };
 
+  outputs = [ "out" "dev" "man" ];
+
   nativeBuildInputs = [ autoreconfHook ];
 
   postPatch = ''

From 43797d4b969794d8d8a99650747903cd0f512a7b Mon Sep 17 00:00:00 2001
From: Antoine Viallon <antoine@lesviallon.fr>
Date: Tue, 25 Apr 2023 17:37:39 +0200
Subject: [PATCH 04/33] ffmpeg: don't enable tensorflow by default for full

Co-authored-by: Atemu <atemu.main@gmail.com>
---
 pkgs/development/libraries/ffmpeg/generic.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index c69325db75d7..73bf29ccffdd 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -79,7 +79,7 @@
 , withSsh ? withHeadlessDeps # SFTP protocol
 , withSvg ? withFullDeps # SVG protocol
 , withSvtav1 ? withFullDeps && !stdenv.isAarch64 # AV1 encoder/decoder (focused on speed and correctness)
-, withTensorflow ? withFullDeps # Tensorflow dnn backend support
+, withTensorflow ? false # Tensorflow dnn backend support
 , withTheora ? withHeadlessDeps # Theora encoder
 , withV4l2 ? withFullDeps && !stdenv.isDarwin # Video 4 Linux support
 , withV4l2M2m ? withV4l2

From ea547c89730a8dae586a8be89ca124e4dcd0a041 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 26 Apr 2023 19:02:49 -0700
Subject: [PATCH 05/33] python310Packages.cryptography: don't depend on
 pytest-benchmark

---
 .../python-modules/cryptography/default.nix          | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index 578d13acf43d..e7c07daa5878 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -13,7 +13,6 @@
 , cffi
 , pkg-config
 , pytestCheckHook
-, pytest-benchmark
 , pytest-subtests
 , pythonOlder
 , pretend
@@ -45,6 +44,11 @@ buildPythonPackage rec {
     hash = "sha256-gFfDTc2QWBWHBCycVH1dYlCsWQMVcRZfOBIau+njtDU=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "--benchmark-disable" ""
+  '';
+
   cargoRoot = "src/rust";
 
   nativeBuildInputs = lib.optionals (!isPyPy) [
@@ -70,7 +74,6 @@ buildPythonPackage rec {
     pretend
     py
     pytestCheckHook
-    pytest-benchmark
     pytest-subtests
     pytz
   ];
@@ -79,7 +82,10 @@ buildPythonPackage rec {
     "--disable-pytest-warnings"
   ];
 
-  disabledTestPaths = lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
+  disabledTestPaths = [
+    # save compute time by not running benchmarks
+    "tests/bench"
+  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
     # aarch64-darwin forbids W+X memory, but this tests depends on it:
     # * https://cffi.readthedocs.io/en/latest/using.html#callbacks
     "tests/hazmat/backends/test_openssl_memleak.py"

From c6355a709ca1a10144d53a0c6e4926e63c9a3223 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 26 Apr 2023 19:11:36 -0700
Subject: [PATCH 06/33] python310Packages.pytest-benchmark: run tests

---
 .../pytest-benchmark/default.nix              | 51 +++++++++++++++----
 1 file changed, 42 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-benchmark/default.nix b/pkgs/development/python-modules/pytest-benchmark/default.nix
index 6fd0cefb51c3..4117d2e658c5 100644
--- a/pkgs/development/python-modules/pytest-benchmark/default.nix
+++ b/pkgs/development/python-modules/pytest-benchmark/default.nix
@@ -1,16 +1,25 @@
 { lib
+, aspectlib
 , buildPythonPackage
+, elasticsearch
 , fetchFromGitHub
-, pathlib
+, fetchpatch
+, freezegun
+, git
+, mercurial
 , py-cpuinfo
+, pygal
 , pytest
+, pytestCheckHook
 , pythonOlder
-, statistics
 }:
 
 buildPythonPackage rec {
   pname = "pytest-benchmark";
   version = "4.0.0";
+
+  disabled = pythonOlder "3.7";
+
   format = "setuptools";
 
   src = fetchFromGitHub {
@@ -20,28 +29,52 @@ buildPythonPackage rec {
     hash = "sha256-f9Ty4+5PycraxoLUSa9JFusV5Cot6bBWKfOGHZIRR3o=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/ionelmc/pytest-benchmark/commit/728752d2976ef53fde7e40beb3e55f09cf4d4736.patch";
+      hash = "sha256-WIQADCLey5Y79UJUj9J5E02HQ0O86xBh/3IeGLpVrWI=";
+    })
+  ];
+
   buildInputs = [
     pytest
   ];
 
   propagatedBuildInputs = [
     py-cpuinfo
-  ] ++ lib.optionals (pythonOlder "3.4") [
-    pathlib
-    statistics
   ];
 
-  # Circular dependency
-  doCheck = false;
-
   pythonImportsCheck = [
     "pytest_benchmark"
   ];
 
+  nativeCheckInputs = [
+    aspectlib
+    elasticsearch
+    freezegun
+    git
+    mercurial
+    pygal
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    export PATH="$out/bin:$PATH"
+  '';
+
+  disabledTests = [
+    # AttributeError: 'PluginImportFixer' object has no attribute 'find_spec'
+    "test_compare_1"
+    "test_compare_2"
+    "test_regression_checks"
+    "test_rendering"
+  ];
+
   meta = with lib; {
+    changelog = "https://github.com/ionelmc/pytest-benchmark/blob/${src.rev}/CHANGELOG.rst";
     description = "Pytest fixture for benchmarking code";
     homepage = "https://github.com/ionelmc/pytest-benchmark";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ costrouc ];
+    maintainers = with maintainers; [ dotlambda ];
   };
 }

From fc0e13b4317a4331c6d73622757c187fca8c7fb1 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Fri, 28 Apr 2023 10:31:43 +0200
Subject: [PATCH 07/33] python3Packages.sqlparse: 0.4.3 -> 0.4.4

Fixes CVE-2023-30608.

https://github.com/andialbrecht/sqlparse/blob/0.4.4/CHANGELOG
---
 pkgs/development/python-modules/sqlparse/default.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/sqlparse/default.nix b/pkgs/development/python-modules/sqlparse/default.nix
index 4e668bed7163..193fa3439b56 100644
--- a/pkgs/development/python-modules/sqlparse/default.nix
+++ b/pkgs/development/python-modules/sqlparse/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, flit-core
 , installShellFiles
 , pytestCheckHook
 , isPy3k
@@ -8,16 +9,18 @@
 
 buildPythonPackage rec {
   pname = "sqlparse";
-  version = "0.4.3";
+  version = "0.4.4";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-acqASEa7EU0uw4DkNgqKNA24PwzPOvzusUBN8Cj1cmg=";
+    hash = "sha256-1EYYPoS4NJ+jBh8P5/BsqUumW0JpRv/r5uPoKVMyQgw=";
   };
 
-  nativeBuildInputs = [ installShellFiles ];
+  format = "pyproject";
+
+  nativeBuildInputs = [ flit-core installShellFiles ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 

From 3e0cb1ab7d27ee531915948c751c612c850e77a5 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Wed, 26 Apr 2023 12:53:36 +0000
Subject: [PATCH 08/33] compiler-rt: use -ffreestanding when no libc

This fixes building for x86_64-windows with no libc (for UEFI).
Otherwise, it would try to include a malloc header.
---
 pkgs/development/compilers/llvm/10/compiler-rt/default.nix  | 6 ++++--
 pkgs/development/compilers/llvm/11/compiler-rt/default.nix  | 4 ++--
 pkgs/development/compilers/llvm/12/compiler-rt/default.nix  | 6 ++++--
 pkgs/development/compilers/llvm/13/compiler-rt/default.nix  | 6 ++++--
 pkgs/development/compilers/llvm/14/compiler-rt/default.nix  | 6 ++++--
 pkgs/development/compilers/llvm/15/compiler-rt/default.nix  | 6 ++++--
 pkgs/development/compilers/llvm/7/compiler-rt/default.nix   | 6 ++++--
 pkgs/development/compilers/llvm/8/compiler-rt/default.nix   | 6 ++++--
 pkgs/development/compilers/llvm/9/compiler-rt/default.nix   | 6 ++++--
 pkgs/development/compilers/llvm/git/compiler-rt/default.nix | 6 ++++--
 10 files changed, 38 insertions(+), 20 deletions(-)

diff --git a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
index bfff847b6b52..6aed5d219a57 100644
--- a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
@@ -40,8 +40,6 @@ stdenv.mkDerivation {
     "-DCMAKE_CXX_COMPILER_WORKS=ON"
     "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
     "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
-  ] ++ lib.optionals (useLLVM && !haveLibc) [
-    "-DCMAKE_C_FLAGS=-nodefaultlibs"
   ] ++ lib.optionals (useLLVM) [
     "-DCOMPILER_RT_BUILD_BUILTINS=ON"
     #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
@@ -90,6 +88,10 @@ stdenv.mkDerivation {
       --replace "#include <assert.h>" ""
   '';
 
+  preConfigure = lib.optionalString (useLLVM && !haveLibc) ''
+    cmakeFlagsArray+=(-DCMAKE_C_FLAGS="-nodefaultlibs -ffreestanding")
+  '';
+
   # Hack around weird upsream RPATH bug
   postInstall = lib.optionalString (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isWasm) ''
     ln -s "$out/lib"/*/* "$out/lib"
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
index f737d34bb84c..aaea3bf9e0d2 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
@@ -41,8 +41,6 @@ stdenv.mkDerivation {
     "-DCMAKE_CXX_COMPILER_WORKS=ON"
     "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
     "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
-  ] ++ lib.optionals (!haveLibc) [
-    "-DCMAKE_C_FLAGS=-nodefaultlibs"
   ] ++ lib.optionals (useLLVM || isNewDarwinBootstrap) [
     "-DCOMPILER_RT_BUILD_BUILTINS=ON"
     #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
@@ -75,6 +73,8 @@ stdenv.mkDerivation {
 
   preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
     cmakeFlagsArray+=("-DCMAKE_LIPO=$(command -v ${stdenv.cc.targetPrefix}lipo)")
+  '' + lib.optionalString (!haveLibc) ''
+    cmakeFlagsArray+=("-DCMAKE_C_FLAGS=-nodefaultlibs -ffreestanding")
   '';
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
diff --git a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
index 2202e2c23c7c..82c190fa0d64 100644
--- a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
@@ -42,8 +42,6 @@ stdenv.mkDerivation {
     "-DCMAKE_CXX_COMPILER_WORKS=ON"
     "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
     "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
-  ] ++ lib.optionals (useLLVM && !haveLibc) [
-    "-DCMAKE_C_FLAGS=-nodefaultlibs"
   ] ++ lib.optionals (useLLVM) [
     "-DCOMPILER_RT_BUILD_BUILTINS=ON"
     #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
@@ -93,6 +91,10 @@ stdenv.mkDerivation {
       --replace "#include <assert.h>" ""
   '';
 
+  preConfigure = lib.optionalString (useLLVM && !haveLibc) ''
+    cmakeFlagsArray+=(-DCMAKE_C_FLAGS="-nodefaultlibs -ffreestanding")
+  '';
+
   # Hack around weird upsream RPATH bug
   postInstall = lib.optionalString (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isWasm) ''
     ln -s "$out/lib"/*/* "$out/lib"
diff --git a/pkgs/development/compilers/llvm/13/compiler-rt/default.nix b/pkgs/development/compilers/llvm/13/compiler-rt/default.nix
index 8f7977002920..faa123312bd7 100644
--- a/pkgs/development/compilers/llvm/13/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/13/compiler-rt/default.nix
@@ -46,8 +46,6 @@ stdenv.mkDerivation {
     "-DCMAKE_CXX_COMPILER_WORKS=ON"
     "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
     "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
-  ] ++ lib.optionals (useLLVM && !haveLibc) [
-    "-DCMAKE_C_FLAGS=-nodefaultlibs"
   ] ++ lib.optionals (useLLVM) [
     "-DCOMPILER_RT_BUILD_BUILTINS=ON"
     #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
@@ -100,6 +98,10 @@ stdenv.mkDerivation {
       --replace "#include <assert.h>" ""
   '';
 
+  preConfigure = lib.optionalString (useLLVM && !haveLibc) ''
+    cmakeFlagsArray+=(-DCMAKE_C_FLAGS="-nodefaultlibs -ffreestanding")
+  '';
+
   # Hack around weird upsream RPATH bug
   postInstall = lib.optionalString (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isWasm) ''
     ln -s "$out/lib"/*/* "$out/lib"
diff --git a/pkgs/development/compilers/llvm/14/compiler-rt/default.nix b/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
index 021eba5a7b63..98ee8135b8fa 100644
--- a/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
@@ -54,8 +54,6 @@ stdenv.mkDerivation {
     "-DCMAKE_CXX_COMPILER_WORKS=ON"
     "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
     "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
-  ] ++ lib.optionals (useLLVM && !haveLibc) [
-    "-DCMAKE_C_FLAGS=-nodefaultlibs"
   ] ++ lib.optionals (useLLVM) [
     "-DCOMPILER_RT_BUILD_BUILTINS=ON"
     #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
@@ -109,6 +107,10 @@ stdenv.mkDerivation {
       --replace "#include <assert.h>" ""
   '';
 
+  preConfigure = lib.optionalString (useLLVM && !haveLibc) ''
+    cmakeFlagsArray+=(-DCMAKE_C_FLAGS="-nodefaultlibs -ffreestanding")
+  '';
+
   # Hack around weird upsream RPATH bug
   postInstall = lib.optionalString (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isWasm) ''
     ln -s "$out/lib"/*/* "$out/lib"
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/default.nix b/pkgs/development/compilers/llvm/15/compiler-rt/default.nix
index a3f2355c6a0b..d35bc7133fed 100644
--- a/pkgs/development/compilers/llvm/15/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/15/compiler-rt/default.nix
@@ -54,8 +54,6 @@ stdenv.mkDerivation {
     "-DCMAKE_CXX_COMPILER_WORKS=ON"
     "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
     "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
-  ] ++ lib.optionals (useLLVM && !haveLibc) [
-    "-DCMAKE_C_FLAGS=-nodefaultlibs"
   ] ++ lib.optionals (useLLVM) [
     "-DCOMPILER_RT_BUILD_BUILTINS=ON"
     #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
@@ -110,6 +108,10 @@ stdenv.mkDerivation {
       --replace "#include <assert.h>" ""
   '';
 
+  preConfigure = lib.optionalString (useLLVM && !haveLibc) ''
+    cmakeFlagsArray+=(-DCMAKE_C_FLAGS="-nodefaultlibs -ffreestanding")
+  '';
+
   # Hack around weird upsream RPATH bug
   postInstall = lib.optionalString (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isWasm) ''
     ln -s "$out/lib"/*/* "$out/lib"
diff --git a/pkgs/development/compilers/llvm/7/compiler-rt/default.nix b/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
index 4b4c30a43235..a644229ff07c 100644
--- a/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
@@ -38,8 +38,6 @@ stdenv.mkDerivation {
     "-DCMAKE_CXX_COMPILER_WORKS=ON"
     "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
     "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
-  ] ++ lib.optionals (useLLVM && !haveLibc) [
-    "-DCMAKE_C_FLAGS=-nodefaultlibs"
   ] ++ lib.optionals (useLLVM) [
     "-DCOMPILER_RT_BUILD_BUILTINS=ON"
     #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
@@ -84,6 +82,10 @@ stdenv.mkDerivation {
       --replace "#include <assert.h>" ""
   '';
 
+  preConfigure = lib.optionalString (useLLVM && !haveLibc) ''
+    cmakeFlagsArray+=(-DCMAKE_C_FLAGS="-nodefaultlibs -ffreestanding")
+  '';
+
   # Hack around weird upsream RPATH bug
   postInstall = lib.optionalString (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isWasm) ''
     ln -s "$out/lib"/*/* "$out/lib"
diff --git a/pkgs/development/compilers/llvm/8/compiler-rt/default.nix b/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
index 2ac116f68988..80f70ac64a0f 100644
--- a/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
@@ -38,8 +38,6 @@ stdenv.mkDerivation {
     "-DCMAKE_CXX_COMPILER_WORKS=ON"
     "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
     "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
-  ] ++ lib.optionals (useLLVM && !haveLibc) [
-    "-DCMAKE_C_FLAGS=-nodefaultlibs"
   ] ++ lib.optionals (useLLVM) [
     "-DCOMPILER_RT_BUILD_BUILTINS=ON"
     #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
@@ -84,6 +82,10 @@ stdenv.mkDerivation {
       --replace "#include <assert.h>" ""
   '';
 
+  preConfigure = lib.optionalString (useLLVM && !haveLibc) ''
+    cmakeFlagsArray+=(-DCMAKE_C_FLAGS="-nodefaultlibs -ffreestanding")
+  '';
+
   # Hack around weird upsream RPATH bug
   postInstall = lib.optionalString (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isWasm) ''
     ln -s "$out/lib"/*/* "$out/lib"
diff --git a/pkgs/development/compilers/llvm/9/compiler-rt/default.nix b/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
index 083fe6231e13..0398b126ab58 100644
--- a/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
@@ -38,8 +38,6 @@ stdenv.mkDerivation {
     "-DCMAKE_CXX_COMPILER_WORKS=ON"
     "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
     "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
-  ] ++ lib.optionals (useLLVM && !haveLibc) [
-    "-DCMAKE_C_FLAGS=-nodefaultlibs"
   ] ++ lib.optionals (useLLVM) [
     "-DCOMPILER_RT_BUILD_BUILTINS=ON"
     #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
@@ -87,6 +85,10 @@ stdenv.mkDerivation {
       --replace "#include <assert.h>" ""
   '';
 
+  preConfigure = lib.optionalString (useLLVM && !haveLibc) ''
+    cmakeFlagsArray+=(-DCMAKE_C_FLAGS="-nodefaultlibs -ffreestanding")
+  '';
+
   # Hack around weird upsream RPATH bug
   postInstall = lib.optionalString (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isWasm) ''
     ln -s "$out/lib"/*/* "$out/lib"
diff --git a/pkgs/development/compilers/llvm/git/compiler-rt/default.nix b/pkgs/development/compilers/llvm/git/compiler-rt/default.nix
index 53c0924a07c5..b20796ab02ab 100644
--- a/pkgs/development/compilers/llvm/git/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/git/compiler-rt/default.nix
@@ -54,8 +54,6 @@ stdenv.mkDerivation {
     "-DCMAKE_CXX_COMPILER_WORKS=ON"
     "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
     "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
-  ] ++ lib.optionals (useLLVM && !haveLibc) [
-    "-DCMAKE_C_FLAGS=-nodefaultlibs"
   ] ++ lib.optionals (useLLVM) [
     "-DCOMPILER_RT_BUILD_BUILTINS=ON"
     #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
@@ -71,6 +69,10 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_ENABLE_IOS=OFF"
   ];
 
+  preConfigure = lib.optionalString (useLLVM && !haveLibc) ''
+    cmakeFlagsArray+=(-DCMAKE_C_FLAGS="-nodefaultlibs -ffreestanding")
+  '';
+
   outputs = [ "out" "dev" ];
 
   patches = [

From e5d1511d5b058786ea5ad87bdcca1275283850fa Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Wed, 26 Apr 2023 13:07:19 +0000
Subject: [PATCH 09/33] lib.systems: allow specifying libc = null

It makes sense to allow platform definitions to opt out of having libc
at all.  One use case would be targetting some obscure new Linux
target that doesn't have a libc implementation yet, and another is
UEFI, which is basically libc-less Windows.

Not having libc is not commonly specified in (GNU) triples (even
Linux's build system will just target either -gnu or -musl depending
on the platform), so instead, we use a separate attribute for it.
---
 lib/systems/default.nix         | 1 +
 pkgs/top-level/all-packages.nix | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index b2cb8848f08b..19ba594d535d 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -50,6 +50,7 @@ rec {
         else if final.isFreeBSD             then "fblibc"
         else if final.isNetBSD              then "nblibc"
         else if final.isAvr                 then "avrlibc"
+        else if final.isGhcjs               then null
         else if final.isNone                then "newlib"
         # TODO(@Ericson2314) think more about other operating systems
         else                                     "native/impure";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6015e93fe927..27c59ef2d06e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20400,7 +20400,8 @@ with pkgs;
   libcCrossChooser = name:
     # libc is hackily often used from the previous stage. This `or`
     # hack fixes the hack, *sigh*.
-    /**/ if name == "glibc" then targetPackages.glibcCross or glibcCross
+    /**/ if name == null then null
+    else if name == "glibc" then targetPackages.glibcCross or glibcCross
     else if name == "bionic" then targetPackages.bionic or bionic
     else if name == "uclibc" then targetPackages.uclibcCross or uclibcCross
     else if name == "avrlibc" then targetPackages.avrlibcCross or avrlibcCross
@@ -20419,7 +20420,6 @@ with pkgs;
     else if name == "nblibc" then targetPackages.netbsdCross.libc or netbsdCross.libc
     else if name == "wasilibc" then targetPackages.wasilibc or wasilibc
     else if name == "relibc" then targetPackages.relibc or relibc
-    else if stdenv.targetPlatform.isGhcjs then null
     else throw "Unknown libc ${name}";
 
   libcCross = assert stdenv.targetPlatform != stdenv.buildPlatform; libcCrossChooser stdenv.targetPlatform.libc;

From 2839c94f1e2be5fe510597453afc64ed4dc9950b Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Wed, 26 Apr 2023 13:27:20 +0000
Subject: [PATCH 10/33] pkgsLLVM.stdenv: use clangNoLibc when libc is null

clangNoLibc always uses LLVM bintools, so it still has the useLLVM
semantics.
---
 pkgs/development/compilers/llvm/10/default.nix  | 3 ++-
 pkgs/development/compilers/llvm/11/default.nix  | 3 ++-
 pkgs/development/compilers/llvm/12/default.nix  | 3 ++-
 pkgs/development/compilers/llvm/13/default.nix  | 3 ++-
 pkgs/development/compilers/llvm/14/default.nix  | 3 ++-
 pkgs/development/compilers/llvm/15/default.nix  | 3 ++-
 pkgs/development/compilers/llvm/5/default.nix   | 3 ++-
 pkgs/development/compilers/llvm/6/default.nix   | 3 ++-
 pkgs/development/compilers/llvm/7/default.nix   | 3 ++-
 pkgs/development/compilers/llvm/8/default.nix   | 3 ++-
 pkgs/development/compilers/llvm/9/default.nix   | 3 ++-
 pkgs/development/compilers/llvm/git/default.nix | 3 ++-
 pkgs/stdenv/cross/default.nix                   | 2 +-
 13 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/compilers/llvm/10/default.nix b/pkgs/development/compilers/llvm/10/default.nix
index 75985e962479..feae428456da 100644
--- a/pkgs/development/compilers/llvm/10/default.nix
+++ b/pkgs/development/compilers/llvm/10/default.nix
@@ -102,7 +102,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      /**/ if stdenv.targetPlatform.libc == null then tools.clangNoLibc
+      else if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
       else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index 6f73f50e3183..cdfc9eb02d00 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -117,7 +117,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      /**/ if stdenv.targetPlatform.libc == null then tools.clangNoLibc
+      else if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
       else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
diff --git a/pkgs/development/compilers/llvm/12/default.nix b/pkgs/development/compilers/llvm/12/default.nix
index b936b35b155a..81443ddbacab 100644
--- a/pkgs/development/compilers/llvm/12/default.nix
+++ b/pkgs/development/compilers/llvm/12/default.nix
@@ -105,7 +105,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      /**/ if stdenv.targetPlatform.libc == null then tools.clangNoLibc
+      else if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
       else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
diff --git a/pkgs/development/compilers/llvm/13/default.nix b/pkgs/development/compilers/llvm/13/default.nix
index 0bc17119125b..9c3861155a66 100644
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@@ -106,7 +106,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      /**/ if stdenv.targetPlatform.libc == null then tools.clangNoLibc
+      else if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
       else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
diff --git a/pkgs/development/compilers/llvm/14/default.nix b/pkgs/development/compilers/llvm/14/default.nix
index 21dc8088452c..baef21602de7 100644
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ b/pkgs/development/compilers/llvm/14/default.nix
@@ -107,7 +107,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      /**/ if stdenv.targetPlatform.libc == null then tools.clangNoLibc
+      else if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
       else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
diff --git a/pkgs/development/compilers/llvm/15/default.nix b/pkgs/development/compilers/llvm/15/default.nix
index d4fd2d9bec6d..01b710f26d22 100644
--- a/pkgs/development/compilers/llvm/15/default.nix
+++ b/pkgs/development/compilers/llvm/15/default.nix
@@ -155,7 +155,8 @@ in let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      /**/ if stdenv.targetPlatform.libc == null then tools.clangNoLibc
+      else if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
       else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
diff --git a/pkgs/development/compilers/llvm/5/default.nix b/pkgs/development/compilers/llvm/5/default.nix
index 4a8c27471acc..f81aecb0eebc 100644
--- a/pkgs/development/compilers/llvm/5/default.nix
+++ b/pkgs/development/compilers/llvm/5/default.nix
@@ -77,7 +77,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      /**/ if stdenv.targetPlatform.libc == null then tools.clangNoLibc
+      else if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
       else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
diff --git a/pkgs/development/compilers/llvm/6/default.nix b/pkgs/development/compilers/llvm/6/default.nix
index fef543e39d82..601242439606 100644
--- a/pkgs/development/compilers/llvm/6/default.nix
+++ b/pkgs/development/compilers/llvm/6/default.nix
@@ -78,7 +78,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      /**/ if stdenv.targetPlatform.libc == null then tools.clangNoLibc
+      else if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
       else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
diff --git a/pkgs/development/compilers/llvm/7/default.nix b/pkgs/development/compilers/llvm/7/default.nix
index 9ae8358587b9..dab90c19fbc2 100644
--- a/pkgs/development/compilers/llvm/7/default.nix
+++ b/pkgs/development/compilers/llvm/7/default.nix
@@ -109,7 +109,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      /**/ if stdenv.targetPlatform.libc == null then tools.clangNoLibc
+      else if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
       else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
diff --git a/pkgs/development/compilers/llvm/8/default.nix b/pkgs/development/compilers/llvm/8/default.nix
index 9401bb34650a..1290d4974251 100644
--- a/pkgs/development/compilers/llvm/8/default.nix
+++ b/pkgs/development/compilers/llvm/8/default.nix
@@ -110,7 +110,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      /**/ if stdenv.targetPlatform.libc == null then tools.clangNoLibc
+      else if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
       else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
diff --git a/pkgs/development/compilers/llvm/9/default.nix b/pkgs/development/compilers/llvm/9/default.nix
index 0a803e3c3dc1..92a91f058640 100644
--- a/pkgs/development/compilers/llvm/9/default.nix
+++ b/pkgs/development/compilers/llvm/9/default.nix
@@ -110,7 +110,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      /**/ if stdenv.targetPlatform.libc == null then tools.clangNoLibc
+      else if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
       else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index d6d8186aecbc..7eddea58ef1c 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -155,7 +155,8 @@ in let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      /**/ if stdenv.targetPlatform.libc == null then tools.clangNoLibc
+      else if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
       else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
diff --git a/pkgs/stdenv/cross/default.nix b/pkgs/stdenv/cross/default.nix
index bf410ec0a684..a2ebd5c35f9f 100644
--- a/pkgs/stdenv/cross/default.nix
+++ b/pkgs/stdenv/cross/default.nix
@@ -72,7 +72,7 @@ in lib.init bootStages ++ [
            else if crossSystem.isDarwin
              then buildPackages.llvmPackages.libcxxClang
            else if crossSystem.useLLVM or false
-             then buildPackages.llvmPackages.clangUseLLVM
+             then buildPackages.llvmPackages.clang
            else buildPackages.gcc;
 
       extraNativeBuildInputs = old.extraNativeBuildInputs

From bfc7aaa8af566318ad5b0ef35fc8652fecc2945e Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Wed, 26 Apr 2023 14:03:11 +0000
Subject: [PATCH 11/33] wrapCCWith: disable pic when building for Windows

According to <https://gcc.gnu.org/legacy-ml/gcc-patches/2015-08/msg00836.html>,
all code is position-independent on Windows.  Some compilers
apparently warn for -fPIC on Windows, and clang errors:

> clang-15: error: unsupported option '-fPIC' for target 'x86_64-pc-windows-msvc'

I'm guessing the check was hostPlatform instead of targetPlatform by mistake.
---
 pkgs/build-support/cc-wrapper/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index adab6f239a61..bc9c199f778d 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -518,7 +518,7 @@ stdenv.mkDerivation {
     ''
 
     # TODO: categorize these and figure out a better place for them
-    + optionalString hostPlatform.isCygwin ''
+    + optionalString targetPlatform.isWindows ''
       hardening_unsupported_flags+=" pic"
     '' + optionalString targetPlatform.isMinGW ''
       hardening_unsupported_flags+=" stackprotector fortify"

From 0949f3cd78a074a04a9778231b057a2536390697 Mon Sep 17 00:00:00 2001
From: Vincenzo Mantova <1962985+xworld21@users.noreply.github.com>
Date: Fri, 28 Apr 2023 20:24:38 +0100
Subject: [PATCH 12/33] makeFontsConf: add darwin system fonts (#228619)

---
 pkgs/development/libraries/fontconfig/make-fonts-conf.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/fontconfig/make-fonts-conf.nix b/pkgs/development/libraries/fontconfig/make-fonts-conf.nix
index 493f662d0ce3..aa84de4dcecd 100644
--- a/pkgs/development/libraries/fontconfig/make-fonts-conf.nix
+++ b/pkgs/development/libraries/fontconfig/make-fonts-conf.nix
@@ -1,11 +1,13 @@
-{ runCommand, libxslt, fontconfig, dejavu_fonts, fontDirectories }:
+{ runCommand, stdenv, lib, libxslt, fontconfig, dejavu_fonts, fontDirectories }:
 
 runCommand "fonts.conf"
   {
     nativeBuildInputs = [ libxslt ];
     buildInputs = [ fontconfig ];
     # Add a default font for non-nixos systems, <1MB and in nixos defaults.
-    fontDirectories = fontDirectories ++ [ dejavu_fonts.minimal ];
+    fontDirectories = fontDirectories ++ [ dejavu_fonts.minimal ]
+      # further non-nixos fonts on darwin
+      ++ lib.optionals stdenv.isDarwin [ "/System/Library/Fonts" "/Library/Fonts" "~/Library/Fonts" ];
   }
   ''
     xsltproc --stringparam fontDirectories "$fontDirectories" \

From 472602ec4e8cd4bac5bd54dbd3f46f94e766fdf7 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Wed, 26 Apr 2023 22:21:53 +1000
Subject: [PATCH 13/33] python310Packages.mkdocs-material: 9.0.15 -> 9.1.8

Diff: https://github.com/squidfunk/mkdocs-material/compare/refs/tags/9.0.15...9.1.8
---
 pkgs/development/python-modules/mkdocs-material/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mkdocs-material/default.nix b/pkgs/development/python-modules/mkdocs-material/default.nix
index a17f10e863f6..1af375762dc7 100644
--- a/pkgs/development/python-modules/mkdocs-material/default.nix
+++ b/pkgs/development/python-modules/mkdocs-material/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-material";
-  version = "9.0.15";
+  version = "9.1.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "squidfunk";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-GIzHgCU4BzHuQMBleGn9DcJBm+pQ7/JP67e8eIcyhpc=";
+    hash = "sha256-a0AeRjS0fV4q3z6MPZBBv8Ffv61W3zHPrnPT4evBnaw=";
   };
 
   nativeBuildInputs = [

From 194ddeefd5339f2a570a878e4f2b15f9585da06f Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 28 Apr 2023 23:26:42 +0000
Subject: [PATCH 14/33] wrapBintoolsWith: support LINK.EXE-style args in purity
 checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

LLD supports Windows-style linker arguments, but these previously
triggered purity check false positives, because it saw that they
started with a '/' and assumed they were paths.

This tweaks the path detection to allow through certain values that
could be paths, but are much more likely to be LINK.EXE-style flags.
The risk of false negatives here is low — the only things we'd now
fail to catch would be attempts to link with libraries in the root
directory, which doesn't happen in practice.

We also teach the wrapper how to apply its purity checks to library
paths specified with the /LIBPATH: option.

Tested that paths we expect to be rejected (like /lib/libfoo.so) still
are.
---
 pkgs/build-support/bintools-wrapper/ld-wrapper.sh | 10 ++++++----
 pkgs/build-support/wrapper-common/utils.bash      |  7 ++++++-
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
index 0d832bc4a67a..dcbe8a4c2494 100644
--- a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
@@ -55,10 +55,12 @@ if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "${NIX_STORE:-}"
             # produces '-syslibroot //' linker flag. It's a no-op,
             # which does not introduce impurities.
             n+=1; skip "$p2"
-        elif [ "${p:0:1}" = / ] && badPath "$p"; then
-            # We cannot skip this; barf.
-            echo "impure path \`$p' used in link" >&2
-            exit 1
+        elif [ "${p:0:10}" = /LIBPATH:/ ] && badPath "${p:9}"; then
+            reject "${p:9}"
+        # We need to not match LINK.EXE-style flags like
+        # /NOLOGO or /LIBPATH:/nix/store/foo
+        elif [[ $p =~ ^/[^:]*/ ]] && badPath "$p"; then
+            reject "$p"
         elif [ "${p:0:9}" = --sysroot ]; then
             # Our ld is not built with sysroot support (Can we fix that?)
             :
diff --git a/pkgs/build-support/wrapper-common/utils.bash b/pkgs/build-support/wrapper-common/utils.bash
index 44b44818c8ed..2faf96df15b4 100644
--- a/pkgs/build-support/wrapper-common/utils.bash
+++ b/pkgs/build-support/wrapper-common/utils.bash
@@ -84,12 +84,17 @@ mangleVarSingle() {
     done
 }
 
-skip () {
+skip() {
     if (( "${NIX_DEBUG:-0}" >= 1 )); then
         echo "skipping impure path $1" >&2
     fi
 }
 
+reject() {
+    echo "impure path \`$1' used in link" >&2
+    exit 1
+}
+
 
 # Checks whether a path is impure.  E.g., `/lib/foo.so' is impure, but
 # `/nix/store/.../lib/foo.so' isn't.

From 83c29429163acb1f03b606688de2c4e1cac62aa7 Mon Sep 17 00:00:00 2001
From: Dmitry Bogatov <git#v1@kaction.cc>
Date: Thu, 12 May 2022 14:27:20 -0400
Subject: [PATCH 15/33] python3.pkgs.sphinxcontrib-log-cabinet: init at 1.0.1

---
 .../sphinxcontrib-log-cabinet/default.nix     | 27 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 29 insertions(+)
 create mode 100644 pkgs/development/python-modules/sphinxcontrib-log-cabinet/default.nix

diff --git a/pkgs/development/python-modules/sphinxcontrib-log-cabinet/default.nix b/pkgs/development/python-modules/sphinxcontrib-log-cabinet/default.nix
new file mode 100644
index 000000000000..867d5acc9bae
--- /dev/null
+++ b/pkgs/development/python-modules/sphinxcontrib-log-cabinet/default.nix
@@ -0,0 +1,27 @@
+{ lib, buildPythonPackage, fetchFromGitHub, sphinx }:
+
+buildPythonPackage rec {
+  pname = "sphinxcontrib-log-cabinet";
+  version = "1.0.1";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "davidism";
+    repo = "sphinxcontrib-log-cabinet";
+    rev = "refs/tags/${version}";
+    sha256 = "03cxspgqsap9q74sqkdx6r6b4gs4hq6dpvx4j58hm50yfhs06wn1";
+  };
+
+  propagatedBuildInputs = [ sphinx ];
+
+  pythonImportsCheck = [ "sphinxcontrib.log_cabinet" ];
+
+  doCheck = false; # no tests
+
+  meta = with lib; {
+    homepage = "https://github.com/davidism/sphinxcontrib-log-cabinet";
+    description = "Sphinx extension to organize changelogs";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kaction ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3080c6cd93ce..f8bf262fecb4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11227,6 +11227,8 @@ self: super: with self; {
     inherit (pkgs) mscgen;
   };
 
+  sphinxcontrib-log-cabinet = callPackage ../development/python-modules/sphinxcontrib-log-cabinet { };
+
   sphinxcontrib-nwdiag = callPackage ../development/python-modules/sphinxcontrib-nwdiag { };
 
   sphinxcontrib_newsfeed = callPackage ../development/python-modules/sphinxcontrib_newsfeed { };

From e7246768380a03512d7f4703d4588fb0dd5786d3 Mon Sep 17 00:00:00 2001
From: Dmitry Bogatov <git#v1@kaction.cc>
Date: Thu, 12 May 2022 13:51:34 -0400
Subject: [PATCH 16/33] python3.pkgs.sphinx-issues: init at 3.0.1

---
 .../python-modules/sphinx-issues/default.nix  | 36 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 38 insertions(+)
 create mode 100644 pkgs/development/python-modules/sphinx-issues/default.nix

diff --git a/pkgs/development/python-modules/sphinx-issues/default.nix b/pkgs/development/python-modules/sphinx-issues/default.nix
new file mode 100644
index 000000000000..4ea94b761890
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-issues/default.nix
@@ -0,0 +1,36 @@
+{ lib, buildPythonPackage, sphinx, fetchFromGitHub, pandoc }:
+
+buildPythonPackage rec {
+  pname = "sphinx-issues";
+  version = "3.0.1";
+  outputs = [ "out" "doc" ];
+
+  src = fetchFromGitHub {
+    owner = "sloria";
+    repo = "sphinx-issues";
+    rev = version;
+    sha256 = "1lns6isq9kwcw8z4jwgy927f7idx9srvri5adaa5zmypw5x47hha";
+  };
+
+  pythonImportsCheck = [ "sphinx_issues" ];
+
+  propagatedBuildInputs = [ sphinx ];
+
+  nativeBuildInputs = [ pandoc ];
+
+  postBuild = ''
+    pandoc -f rst -t html --standalone < README.rst > README.html
+  '';
+
+  postInstall = ''
+    mkdir -p $doc/share/doc/$name/html
+    cp README.html $doc/share/doc/$name/html
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/sloria/sphinx-issues";
+    description = "Sphinx extension for linking to your project's issue tracker.";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kaction ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f8bf262fecb4..2ebb6027c8b3 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11273,6 +11273,8 @@ self: super: with self; {
 
   sphinx-inline-tabs = callPackage ../development/python-modules/sphinx-inline-tabs { };
 
+  sphinx-issues = callPackage ../development/python-modules/sphinx-issues { };
+
   sphinx-jinja = callPackage ../development/python-modules/sphinx-jinja { };
 
   sphinx-markdown-parser = callPackage ../development/python-modules/sphinx-markdown-parser { };

From 7e4594a5d2560d864e35dea705e6224631181e9e Mon Sep 17 00:00:00 2001
From: Dmitry Bogatov <serenity@kaction.cc>
Date: Sat, 1 Apr 2023 13:39:50 -0400
Subject: [PATCH 17/33] python3.pkgs.jinja2: build offline documentation

---
 .../applications/misc/privacyidea/default.nix |  2 +-
 .../python-modules/jinja2/default.nix         | 15 +++++++++++
 .../jinja2/patches/import-order.patch         | 27 +++++++++++++++++++
 .../python-modules/sphinx/default.nix         |  2 +-
 4 files changed, 44 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/development/python-modules/jinja2/patches/import-order.patch

diff --git a/pkgs/applications/misc/privacyidea/default.nix b/pkgs/applications/misc/privacyidea/default.nix
index f5e13987aff4..14c532e3e1f8 100644
--- a/pkgs/applications/misc/privacyidea/default.nix
+++ b/pkgs/applications/misc/privacyidea/default.nix
@@ -52,7 +52,7 @@ let
         doCheck = false;
       });
       # Required by flask-1.1
-      jinja2 = super.jinja2.overridePythonAttrs (old: rec {
+      jinja2 = (super.jinja2.override { enableDocumentation = false; }).overridePythonAttrs (old: rec {
         version = "2.11.3";
         src = old.src.override {
           inherit version;
diff --git a/pkgs/development/python-modules/jinja2/default.nix b/pkgs/development/python-modules/jinja2/default.nix
index cb30b871ca86..6802811f7b88 100644
--- a/pkgs/development/python-modules/jinja2/default.nix
+++ b/pkgs/development/python-modules/jinja2/default.nix
@@ -6,11 +6,17 @@
 , babel
 , markupsafe
 , pytestCheckHook
+, sphinxHook
+, pallets-sphinx-themes
+, sphinxcontrib-log-cabinet
+, sphinx-issues
+, enableDocumentation ? true
 }:
 
 buildPythonPackage rec {
   pname = "Jinja2";
   version = "3.1.2";
+  outputs = [ "out" ] ++ lib.optional enableDocumentation "doc";
 
   disabled = pythonOlder "3.7";
 
@@ -19,11 +25,20 @@ buildPythonPackage rec {
     hash = "sha256-MTUacCpAip51laj8YVD8P0O7a/fjGXcMvA2535Q36FI=";
   };
 
+  patches = lib.optionals enableDocumentation [ ./patches/import-order.patch ];
+
   propagatedBuildInputs = [
     babel
     markupsafe
   ];
 
+  nativeBuildInputs = lib.optionals enableDocumentation [
+    sphinxHook
+    sphinxcontrib-log-cabinet
+    pallets-sphinx-themes
+    sphinx-issues
+  ];
+
   # Multiple tests run out of stack space on 32bit systems with python2.
   # See https://github.com/pallets/jinja/issues/1158
   doCheck = !stdenv.is32bit;
diff --git a/pkgs/development/python-modules/jinja2/patches/import-order.patch b/pkgs/development/python-modules/jinja2/patches/import-order.patch
new file mode 100644
index 000000000000..38514dff24e3
--- /dev/null
+++ b/pkgs/development/python-modules/jinja2/patches/import-order.patch
@@ -0,0 +1,27 @@
+Sphinx changed something between sphinx=4.5.0 and sphinx=5.3 that broke
+"sphinxcontrib.log_cabinet" plugin.
+
+When Sphinx tries to importlib.import_module("sphinxcontrib.log_cabinet"), it
+has couple other sphinxcontrib.* libraries in sys.path, and they seem to cause
+conflict. So here I purge sys.path from sphixcontrib-related things, import
+log_cabinet and put everything back, so when Sphinx will do "import_module",
+"sphinxcontrib.log_cabinet" will be already imported and cached.
+
+All this is quite hacky, but we are talking about merely building documentation
+here. If resulting html looks good, what happened in Nix sandbox stays in Nix
+sandbox.
+
+--- a/docs/conf.py	1970-01-01 00:00:00.000000000 -0000
++++ b/docs/conf.py	1970-01-01 00:00:00.000000000 -0000
+@@ -1,5 +1,12 @@
+ from pallets_sphinx_themes import get_version
+ from pallets_sphinx_themes import ProjectLink
++import importlib
++import sys
++
++saved_path = sys.path
++sys.path = [x for x in sys.path if "sphinxcontrib" not in x or "cabinet" in x]
++import sphinxcontrib.log_cabinet
++sys.path = saved_path
+ 
+ # Project --------------------------------------------------------------
diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index 1e14bc7a6133..a69d328c7fda 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -64,7 +64,7 @@ buildPythonPackage rec {
     alabaster
     docutils
     imagesize
-    jinja2
+    (jinja2.override { enableDocumentation = false; })
     packaging
     pygments
     requests

From e7b3a70ae4219b06764ebf7cf72e7602f1828f01 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 30 Apr 2023 01:29:03 +0200
Subject: [PATCH 18/33] python310Packages.psutil: 5.9.4 -> 5.9.5

---
 pkgs/development/python-modules/psutil/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index c77c31faa960..164e4431748d 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "psutil";
-  version = "5.9.4";
+  version = "5.9.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-PX+XOetDXUsTOJRKviP0lYS95TlfJ0h9LuJa2ah3SmI=";
+    hash = "sha256-VBBjjk3znFTZV/xRzgMEis2ObWCrwPUQevUeX7Vm6zw=";
   };
 
   buildInputs =

From c187bb54b0e4b491ea2e5f371e46c6e0dc9cca94 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 30 Apr 2023 01:30:24 +0200
Subject: [PATCH 19/33] python310Packages.simplejson: 3.18.3 -> 3.19.1

Diff: https://github.com/simplejson/simplejson/compare/refs/tags/v3.18.3...v3.19.1

Changelog: https://github.com/simplejson/simplejson/blob/v3.19.1/CHANGES.txt
---
 pkgs/development/python-modules/simplejson/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/simplejson/default.nix b/pkgs/development/python-modules/simplejson/default.nix
index f23e988a9fa6..f495e463864d 100644
--- a/pkgs/development/python-modules/simplejson/default.nix
+++ b/pkgs/development/python-modules/simplejson/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "simplejson";
-  version = "3.18.3";
+  version = "3.19.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-NKDcY/HRAbroT6onHdLP6oolEzWoCC+Jlf+Ec5bFDDc=";
+    hash = "sha256-LUD0Eoj7fDGiR0yhIZOto6kn7Ud0TXyDTO1UTbRMJiQ=";
   };
 
   nativeCheckInputs = [

From 04045cfccd972949dae73fcb5a1bbda7f2d61f9c Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sun, 30 Apr 2023 04:20:00 +0200
Subject: [PATCH 20/33] python310Packages.psutil: add changelog to meta

---
 pkgs/development/python-modules/psutil/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index 164e4431748d..015e82de857e 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -66,6 +66,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Process and system utilization information interface";
     homepage = "https://github.com/giampaolo/psutil";
+    changelog = "https://github.com/giampaolo/psutil/blob/release-${version}/HISTORY.rst";
     license = licenses.bsd3;
     maintainers = with maintainers; [ jonringer ];
   };

From 361195305b6d3477ea324913cccc07d2170a358f Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Sun, 30 Apr 2023 14:12:06 +0800
Subject: [PATCH 21/33] python3Packages.aiohttp: add setuptools to
 nativeBuildInputs, fix cross compilation

---
 pkgs/development/python-modules/aiohttp/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index 91ab8c040fdb..114077681c91 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -4,6 +4,8 @@
 , fetchPypi
 , fetchpatch
 , pythonOlder
+# build_requires
+, setuptools
 # install_requires
 , attrs
 , charset-normalizer
@@ -56,6 +58,10 @@ buildPythonPackage rec {
       --replace "charset-normalizer >=2.0, < 3.0" "charset-normalizer >=2.0, < 4.0"
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     attrs
     charset-normalizer

From d5962b7e9754d979ca473162ebc4a36cbc99f2ed Mon Sep 17 00:00:00 2001
From: Lorenz Brun <lorenz@brun.one>
Date: Sun, 16 Apr 2023 18:43:38 +0200
Subject: [PATCH 22/33] gst_all_1.gst-plugins-bad: remove gstmicrodns

This plugin causes every application which uses GstDeviceMonitor to
emit an mDNS query for _rtsp._tcp.local every two seconds.
The application can filter devices to exclude any devices found, but
there does not seem to be a way for applications to opt out of sending
these messages. See [1] and [2].

This plugin was apparently introduced by its author to be able to access
local and networked cameras through a single API [3], I'm pretty sure
that nixpkgs has no applications making use of it.

Remove it at least until it does not emit mDNS requests by default
anymore.

[1] https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/merge_requests/721#note_253085
[2] https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/issues/1090
[3] https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/merge_requests/721#note_253104
---
 pkgs/development/libraries/gstreamer/bad/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 717a61d82310..bb1acbe6fdb3 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -100,6 +100,8 @@
 , MediaToolbox
 , enableGplPlugins ? true
 , bluezSupport ? stdenv.isLinux
+# Causes every application using GstDeviceMonitor to send mDNS queries every 2 seconds
+, microdnsSupport ? false
 # Checks meson.is_cross_build(), so even canExecute isn't enough.
 , enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform, hotdoc
 }:
@@ -151,7 +153,6 @@ stdenv.mkDerivation rec {
     #webrtc-audio-processing_1 # required by isac
     libbs2b
     libmodplug
-    libmicrodns
     openjpeg
     libopenmpt
     libopus
@@ -203,6 +204,8 @@ stdenv.mkDerivation rec {
     x265
   ] ++ lib.optionals bluezSupport [
     bluez
+  ] ++ lib.optionals microdnsSupport [
+    libmicrodns
   ] ++ lib.optionals stdenv.isLinux [
     libva # vaapi requires libva -> libdrm -> libpciaccess, which is Linux-only in nixpkgs
     wayland
@@ -286,6 +289,7 @@ stdenv.mkDerivation rec {
     "-Dgs=disabled" # depends on `google-cloud-cpp`
     "-Donnx=disabled" # depends on `libonnxruntime` not packaged in nixpkgs as of writing
     "-Dopenaptx=enabled" # since gstreamer-1.20.1 `libfreeaptx` is supported for circumventing the dubious license conflict with `libopenaptx`
+    "-Dmicrodns=${if microdnsSupport then "enabled" else "disabled"}"
     "-Dbluez=${if bluezSupport then "enabled" else "disabled"}"
     (lib.mesonEnable "doc" enableDocumentation)
   ]

From cd72014a8778cbc1007f66acb2b79ec1fac8e8cc Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 30 Apr 2023 12:31:38 +0200
Subject: [PATCH 23/33] python3.pkgs.jinja2: don't build offline documentation
 by default

E.g. `systemd` fails like this:

    last 25 log lines:
    > Checking for function "blkid_probe_set_hint" with dependency blkid: YES
    > Run-time dependency libkmod found: YES 30
    > Run-time dependency xencontrol found: NO (tried pkgconfig and cmake)
    > Run-time dependency libmicrohttpd found: NO (tried pkgconfig and cmake)
    > Checking for function "crypt_activate_by_token_pin" : NO
    > Run-time dependency libiptc found: NO (tried pkgconfig and cmake)
    > Run-time dependency libqrencode found: NO (tried pkgconfig and cmake)
    > Run-time dependency gnutls found: NO (tried pkgconfig and cmake)
    > Run-time dependency openssl found: NO (tried pkgconfig, system and cmake)
    > Run-time dependency p11-kit-1 found: NO (tried pkgconfig and cmake)
    > Run-time dependency tss2-esys tss2-rc tss2-mu found: NO (tried pkgconfig and cmake)
    > Run-time dependency libdw found: NO (tried pkgconfig and cmake)
    > Run-time dependency zlib found: NO (tried pkgconfig, cmake and system)
    > Library bz2 found: NO
    > Run-time dependency liblzma found: NO (tried pkgconfig and cmake)
    > Run-time dependency libzstd found: NO (tried pkgconfig and cmake)
    > Run-time dependency xkbcommon found: NO (tried pkgconfig and cmake)
    > Run-time dependency libpcre2-8 found: NO (tried pkgconfig and cmake)
    > Run-time dependency dbus-1 found: NO (tried pkgconfig and cmake)
    > Message: default-dnssec cannot be set to yes or allow-downgrade openssl and gcrypt are disabled. Setting default-dnssec to no.
    > Program python3 (jinja2) found: NO
    >
    > meson.build:1949:15: ERROR: python3 is missing modules: jinja2

Upon trying more packages I realized that this is not the only one (it
appears to be related to `python3.withPackages` in some cases).

For now, flip the default to unbreak a lot of stuff and remove the
`enableDocumentation = false;` hacks from a bunch of other packages.
---
 pkgs/applications/misc/privacyidea/default.nix     | 2 +-
 pkgs/development/python-modules/jinja2/default.nix | 2 +-
 pkgs/development/python-modules/sphinx/default.nix | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/misc/privacyidea/default.nix b/pkgs/applications/misc/privacyidea/default.nix
index 14c532e3e1f8..f5e13987aff4 100644
--- a/pkgs/applications/misc/privacyidea/default.nix
+++ b/pkgs/applications/misc/privacyidea/default.nix
@@ -52,7 +52,7 @@ let
         doCheck = false;
       });
       # Required by flask-1.1
-      jinja2 = (super.jinja2.override { enableDocumentation = false; }).overridePythonAttrs (old: rec {
+      jinja2 = super.jinja2.overridePythonAttrs (old: rec {
         version = "2.11.3";
         src = old.src.override {
           inherit version;
diff --git a/pkgs/development/python-modules/jinja2/default.nix b/pkgs/development/python-modules/jinja2/default.nix
index 6802811f7b88..1fb7b26db5b3 100644
--- a/pkgs/development/python-modules/jinja2/default.nix
+++ b/pkgs/development/python-modules/jinja2/default.nix
@@ -10,7 +10,7 @@
 , pallets-sphinx-themes
 , sphinxcontrib-log-cabinet
 , sphinx-issues
-, enableDocumentation ? true
+, enableDocumentation ? false
 }:
 
 buildPythonPackage rec {
diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index a69d328c7fda..1e14bc7a6133 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -64,7 +64,7 @@ buildPythonPackage rec {
     alabaster
     docutils
     imagesize
-    (jinja2.override { enableDocumentation = false; })
+    jinja2
     packaging
     pygments
     requests

From ad454c1708cc2bb2ac82fbeb6af5210c8411d3c2 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Sun, 30 Apr 2023 12:25:03 -0400
Subject: [PATCH 24/33] or-tools: remove dev output

or-tools has buggy CMake scripts that don't pick up on the proper install
locations. This needs to fixed upstream, but I don't have time to do this right
now. Removing the dev output will cause cross-compiled builds to have build
platform contamination due to propagated native protobuf.
---
 pkgs/development/libraries/science/math/or-tools/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/science/math/or-tools/default.nix b/pkgs/development/libraries/science/math/or-tools/default.nix
index 6d23008b6922..92588307ca57 100644
--- a/pkgs/development/libraries/science/math/or-tools/default.nix
+++ b/pkgs/development/libraries/science/math/or-tools/default.nix
@@ -109,7 +109,7 @@ stdenv.mkDerivation rec {
     pip install --prefix="$python" python/
   '';
 
-  outputs = [ "out" "dev" "python" ];
+  outputs = [ "out" "python" ];
 
   meta = with lib; {
     homepage = "https://github.com/google/or-tools";

From bf02d717b59667cb7abc9c4a1c279ccdcd33c99a Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Sun, 30 Apr 2023 12:29:02 -0400
Subject: [PATCH 25/33] python3Packages.protobuf: remove dev output

Apparently some things don't handle Python packages with dev outputs correctly.
This will fix those packages but will cause build-platform contamination for
cross-compiled packages that use protobuf (due to propagatedNativeBuildInputs).
---
 pkgs/development/python-modules/protobuf/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/protobuf/default.nix b/pkgs/development/python-modules/protobuf/default.nix
index 68177357ca6d..8df8bb7c4a7d 100644
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@@ -41,8 +41,6 @@ buildPythonPackage {
     fi
   '';
 
-  outputs = [ "out" "dev" ];
-
   buildInputs = [ protobuf ];
 
   propagatedNativeBuildInputs = [

From a3cad4378eea8b3dfa7c27180acecc92c51f02d9 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 30 Apr 2023 20:35:27 +0300
Subject: [PATCH 26/33] pkgs/build-support: call the right makeWrapper function
 from wrapProgram<Type>

---
 .../setup-hooks/make-binary-wrapper/make-binary-wrapper.sh      | 2 +-
 pkgs/build-support/setup-hooks/make-wrapper.sh                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/make-binary-wrapper/make-binary-wrapper.sh b/pkgs/build-support/setup-hooks/make-binary-wrapper/make-binary-wrapper.sh
index 5f759d323cf6..88a50befd732 100644
--- a/pkgs/build-support/setup-hooks/make-binary-wrapper/make-binary-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper/make-binary-wrapper.sh
@@ -67,7 +67,7 @@ wrapProgramBinary() {
       hidden="${hidden}_"
     done
     mv "$prog" "$hidden"
-    makeWrapper "$hidden" "$prog" --inherit-argv0 "${@:2}"
+    makeBinaryWrapper "$hidden" "$prog" --inherit-argv0 "${@:2}"
 }
 
 # Generate source code for the wrapper in such a way that the wrapper inputs
diff --git a/pkgs/build-support/setup-hooks/make-wrapper.sh b/pkgs/build-support/setup-hooks/make-wrapper.sh
index 84e5ecee2909..4932e934ec16 100644
--- a/pkgs/build-support/setup-hooks/make-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-wrapper.sh
@@ -217,5 +217,5 @@ wrapProgramShell() {
       hidden="${hidden}_"
     done
     mv "$prog" "$hidden"
-    makeWrapper "$hidden" "$prog" --inherit-argv0 "${@:2}"
+    makeShellWrapper "$hidden" "$prog" --inherit-argv0 "${@:2}"
 }

From a2332386df7415d048f8291c75d25e65868efa91 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 30 Apr 2023 20:28:44 +0300
Subject: [PATCH 27/33] gnuplot-qt: fix wrapper

---
 pkgs/tools/graphics/gnuplot/default.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/tools/graphics/gnuplot/default.nix b/pkgs/tools/graphics/gnuplot/default.nix
index 5f96eb9f8d22..c95ec79534eb 100644
--- a/pkgs/tools/graphics/gnuplot/default.nix
+++ b/pkgs/tools/graphics/gnuplot/default.nix
@@ -53,11 +53,18 @@ in
 
   CXXFLAGS = lib.optionalString (stdenv.isDarwin && withQt) "-std=c++11";
 
+  # we'll wrap things ourselves
+  dontWrapGApps = true;
+  dontWrapQtApps = true;
+
+  # binary wrappers don't support --run
   postInstall = lib.optionalString withX ''
-    wrapProgram $out/bin/gnuplot \
+    wrapProgramShell $out/bin/gnuplot \
        --prefix PATH : '${gnused}/bin' \
        --prefix PATH : '${coreutils}/bin' \
        --prefix PATH : '${fontconfig.bin}/bin' \
+       "''${gappsWrapperArgs[@]}" \
+       "''${qtWrapperArgs[@]}" \
        --run '. ${./set-gdfontpath-from-fontconfig.sh}'
   '';
 

From 122e7746ee795984b5f0f144567a1b86baaefc7b Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Sun, 30 Apr 2023 21:30:17 +0200
Subject: [PATCH 28/33] gnupg: 2.4.0 -> 2.4.1

---
 pkgs/tools/security/gnupg/24.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/gnupg/24.nix b/pkgs/tools/security/gnupg/24.nix
index ee4e5d277b73..f92a61f3ac4e 100644
--- a/pkgs/tools/security/gnupg/24.nix
+++ b/pkgs/tools/security/gnupg/24.nix
@@ -12,11 +12,11 @@ assert guiSupport -> enableMinimal == false;
 
 stdenv.mkDerivation rec {
   pname = "gnupg";
-  version = "2.4.0";
+  version = "2.4.1";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    hash = "sha256-HXkVjdAdmSQx3S4/rLif2slxJ/iXhOosthDGAPsMFIM=";
+    hash = "sha256-drceWutEO/2RDOnLyCgbYXyDQWh6+2e65FWHeXK1neg=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];

From 313089a9ff64198a5f6fda16910dbadb5447d6e2 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Mon, 1 May 2023 15:18:57 +0800
Subject: [PATCH 29/33] =?UTF-8?q?libsoup=5F3:=203.4.1=20=E2=86=92=203.4.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/GNOME/libsoup/-/compare/3.4.1...3.4.2
---
 pkgs/development/libraries/libsoup/3.x.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libsoup/3.x.nix b/pkgs/development/libraries/libsoup/3.x.nix
index 5219f59e929d..13c7ccc30285 100644
--- a/pkgs/development/libraries/libsoup/3.x.nix
+++ b/pkgs/development/libraries/libsoup/3.x.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsoup";
-  version = "3.4.1";
+  version = "3.4.2";
 
   outputs = [ "out" "dev" ] ++ lib.optional withIntrospection "devdoc";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-UwuGexsWbLm8onUPHRXlGHMYtdlI77gdWJmvPXVhRQQ=";
+    sha256 = "sha256-eMj6N8sVLUDsjEoUjWFV4vaUfz8WAqfNo6Ma1A9e4vM=";
   };
 
   depsBuildBuild = [

From b02988a87c25347c863b5d6f7cc3eb1e2fbc8031 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 1 May 2023 10:09:47 +0200
Subject: [PATCH 30/33] Revert "python310Packages.aioesphomeapi: Propagate
 protobuf dev output"

This reverts commit d5edd07a01397450e9faebf6a68adb01330364fa.
The .dev output was removed in the parent commit.
---
 pkgs/development/python-modules/aioesphomeapi/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index d9f02f883e34..bee7cc393321 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -28,8 +28,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     async-timeout
     noiseprotocol
-    protobuf.out
-    protobuf.dev
+    protobuf
     zeroconf
   ];
 

From 955c459af5251f32d2ea91fb1411c644669bb486 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 1 May 2023 14:48:04 +0300
Subject: [PATCH 31/33] glslang: 1.3.243.0 -> 12.1.0

---
 pkgs/development/compilers/glslang/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/glslang/default.nix b/pkgs/development/compilers/glslang/default.nix
index 8eb10fe84397..c3ed81a839af 100644
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@@ -10,12 +10,12 @@
 }:
 stdenv.mkDerivation rec {
   pname = "glslang";
-  version = "1.3.243.0";
+  version = "12.1.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
-    rev = "sdk-${version}";
+    rev = version;
     hash = "sha256-U45/7G02o82EP4zh7i2Go0VCnsO1B7vxDwIokjyo5Rk=";
   };
 

From 2c8f7f3911ed36fa565b343ab54ade8a2a23825d Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 1 May 2023 14:38:33 +0300
Subject: [PATCH 32/33] spirv-tools: 1.3.243.0 -> 2023.2, remove spirv-headers
 version check

Upstream versioning isn't consistent in the first place.
---
 pkgs/development/tools/spirv-tools/default.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/spirv-tools/default.nix b/pkgs/development/tools/spirv-tools/default.nix
index 5ffda91a460e..c9061da1c180 100644
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-tools";
-  version = "1.3.243.0";
+  version = "2023.2";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
-    rev = "sdk-${version}";
+    rev = "v${version}";
     hash = "sha256-l44Ru0WjROQEDNU/2YQJGti1uDZP9osRdfsXus5EGX0=";
   };
 
@@ -41,6 +41,5 @@ stdenv.mkDerivation rec {
     license = licenses.asl20;
     platforms = platforms.unix;
     maintainers = [ maintainers.ralith ];
-    broken = (version != spirv-headers.version);
   };
 }

From 4732abcb38d65f9a0265dadfd54cfe51b21dda73 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Mon, 1 May 2023 07:23:53 +0000
Subject: [PATCH 33/33] =?UTF-8?q?tracker:=203.5.0=20=E2=86=92=203.5.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/GNOME/tracker/-/compare/3.5.0...3.5.1
---
 pkgs/development/libraries/tracker/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/tracker/default.nix b/pkgs/development/libraries/tracker/default.nix
index 2da4a3a3ca78..4ba70506b718 100644
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tracker";
-  version = "3.5.0";
+  version = "3.5.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "EylCddu7rZY0s6g5DAjm8Svr/oT2zK+3Kyewwjuo2i8=";
+    sha256 = "+XLVCse6/czxE7HrmdyuNUBGhameVb/vFvOsg7Tel00=";
   };
 
   strictDeps = true;
@@ -102,8 +102,8 @@ stdenv.mkDerivation rec {
   ];
 
   doCheck =
-    # https://gitlab.gnome.org/GNOME/tracker/-/issues/397
-    !stdenv.isAarch64
+    # https://gitlab.gnome.org/GNOME/tracker/-/issues/402
+    !stdenv.isDarwin
     # https://gitlab.gnome.org/GNOME/tracker/-/issues/398
     && !stdenv.is32bit;