Merge remote-tracking branch 'origin/master' into haskell-updates

2021-05-16 21:39:44 +02:00 · 2021-05-16 21:39:44 +02:00 · 9e5896496c
parent cb6ec35052 74b74b0555
commit 9e5896496c
472 changed files with 14327 additions and 4607 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1394,12 +1394,6 @@
    githubId = 302429;
    name = "Marton Boros";
  };
-  branwright1 = {
-    email = "branwright@protonmail.com";
-    github = "branwright1";
-    githubId = 71175207;
-    name = "Brandon Wright";
-  };
  bramd = {
    email = "bram@bramd.nl";
    github = "bramd";
@ -4765,12 +4759,6 @@
    githubId = 1102396;
    name = "Jussi Maki";
  };
-  joaquinito2051 = {
-    email = "joaquinito2051@gmail.com";
-    github = "heroku-miraheze";
-    githubId = 61781343;
-    name = "Joaquín Rufo Gutierrez";
-  };
  jobojeha = {
    email = "jobojeha@jeppener.de";
    github = "jobojeha";
@ -5011,7 +4999,7 @@
    name = "Julien Dehos";
  };
  julm = {
-    email = "julm+nix@sourcephile.fr";
+    email = "julm+nixpkgs@sourcephile.fr";
    github = "ju1m";
    githubId = 21160136;
    name = "Julien Moutinho";
--- a/nixos/doc/manual/release-notes/rl-2105.xml
+++ b/nixos/doc/manual/release-notes/rl-2105.xml
@ -697,6 +697,17 @@ environment.systemPackages = [
     All CUDA toolkit versions prior to CUDA 10 have been removed.
    </para>
   </listitem>
+   <listitem>
+     <para>
+       The <package>kbdKeymaps</package> package was removed since dvp and neo
+       are now included in <package>kbd</package>.
+
+       If you want to use the Programmer Dvorak Keyboard Layout, you have to use
+       <literal>dvorak-programmer</literal> in <option>console.keyMap</option>
+       now instead of <literal>dvp</literal>.
+       In <option>services.xserver.xkbVariant</option> it's still <literal>dvp</literal>.
+    </para>
+   </listitem>
   <listitem>
     <para>
       The <package>babeld</package> service is now being run as an unprivileged user. To achieve that the module configures
@ -923,6 +934,23 @@ environment.systemPackages = [
      Note that users defined with an explicit UID below 500 are exempted from this check, as <xref linkend="opt-users.users._name_.isSystemUser" /> has no effect for those.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     The <literal>security.apparmor</literal> module,
+     for the <link xlink:href="https://gitlab.com/apparmor/apparmor/-/wikis/Documentation">AppArmor</link>
+     Mandatory Access Control system,
+     has been substantialy improved along with related tools,
+     so that module maintainers can now more easily write AppArmor profiles for NixOS.
+     The most notable change on the user-side is the new option <xref linkend="opt-security.apparmor.policies"/>,
+     replacing the previous <literal>profiles</literal> option
+     to provide a way to disable a profile
+     and to select whether to confine in enforce mode (default)
+     or in complain mode (see <literal>journalctl -b --grep apparmor</literal>).
+     Security-minded users may also want to enable <xref linkend="opt-security.apparmor.killUnconfinedConfinables"/>,
+     at the cost of having some of their processes killed
+     when updating to a NixOS version introducing new AppArmor profiles.
+    </para>
+   </listitem>
   <listitem>
     <para>
       The GNOME desktop manager once again installs <package>gnome.epiphany</package> by default.
--- a/nixos/modules/config/console.nix
+++ b/nixos/modules/config/console.nix
@ -82,8 +82,7 @@ in

    packages = mkOption {
      type = types.listOf types.package;
-      default = with pkgs.kbdKeymaps; [ dvp neo ];
-      defaultText = "with pkgs.kbdKeymaps; [ dvp neo ]";
+      default = [ ];
      description = ''
        List of additional packages that provide console fonts, keymaps and
        other resources for virtual consoles use.
--- a/nixos/modules/config/fonts/fontconfig.nix
+++ b/nixos/modules/config/fonts/fontconfig.nix
@ -448,6 +448,40 @@ in
    (mkIf cfg.enable {
      environment.systemPackages    = [ pkgs.fontconfig ];
      environment.etc.fonts.source  = "${fontconfigEtc}/etc/fonts/";
+      security.apparmor.includes."abstractions/fonts" = ''
+        # fonts.conf
+        r ${pkg.out}/etc/fonts/fonts.conf,
+
+        # fontconfig default config files
+        r ${pkg.out}/etc/fonts/conf.d/*.conf,
+
+        # 00-nixos-cache.conf
+        r ${cacheConf},
+
+        # 10-nixos-rendering.conf
+        r ${renderConf},
+
+        # 50-user.conf
+        ${optionalString cfg.includeUserConf ''
+        r ${pkg.out}/etc/fonts/conf.d.bak/50-user.conf,
+        ''}
+
+        # local.conf (indirect priority 51)
+        ${optionalString (cfg.localConf != "") ''
+        r ${localConf},
+        ''}
+
+        # 52-nixos-default-fonts.conf
+        r ${defaultFontsConf},
+
+        # 53-no-bitmaps.conf
+        r ${rejectBitmaps},
+
+        ${optionalString (!cfg.allowType1) ''
+        # 53-nixos-reject-type1.conf
+        r ${rejectType1},
+        ''}
+      '';
    })
    (mkIf cfg.enable {
      fonts.fontconfig.confPackages = [ confPkg ];
--- a/nixos/modules/config/malloc.nix
+++ b/nixos/modules/config/malloc.nix
@ -87,5 +87,12 @@ in
    environment.etc."ld-nix.so.preload".text = ''
      ${providerLibPath}
    '';
+    security.apparmor.includes = {
+      "abstractions/base" = ''
+        r /etc/ld-nix.so.preload,
+        r ${config.environment.etc."ld-nix.so.preload".source},
+        mr ${providerLibPath},
+      '';
+    };
  };
 }
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -211,7 +211,6 @@
  ./rename.nix
  ./security/acme.nix
  ./security/apparmor.nix
-  ./security/apparmor-suid.nix
  ./security/audit.nix
  ./security/auditd.nix
  ./security/ca.nix
--- a/nixos/modules/profiles/hardened.nix
+++ b/nixos/modules/profiles/hardened.nix
@ -36,6 +36,7 @@ with lib;
  security.virtualisation.flushL1DataCache = mkDefault "always";

  security.apparmor.enable = mkDefault true;
+  security.apparmor.killUnconfinedConfinables = mkDefault true;

  boot.kernelParams = [
    # Slab/slub sanity checks, redzoning, and poisoning
--- a/nixos/modules/security/apparmor-suid.nix
+++ b/nixos/modules/security/apparmor-suid.nix
@ -1,49 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.security.apparmor;
-in
-with lib;
-{
-  imports = [
-    (mkRenamedOptionModule [ "security" "virtualization" "flushL1DataCache" ] [ "security" "virtualisation" "flushL1DataCache" ])
-  ];
-
-  options.security.apparmor.confineSUIDApplications = mkOption {
-    type = types.bool;
-    default = true;
-    description = ''
-      Install AppArmor profiles for commonly-used SUID application
-      to mitigate potential privilege escalation attacks due to bugs
-      in such applications.
-
-      Currently available profiles: ping
-    '';
-  };
-
-  config = mkIf (cfg.confineSUIDApplications) {
-    security.apparmor.profiles = [ (pkgs.writeText "ping" ''
-      #include <tunables/global>
-      /run/wrappers/bin/ping {
-        #include <abstractions/base>
-        #include <abstractions/consoles>
-        #include <abstractions/nameservice>
-
-        capability net_raw,
-        capability setuid,
-        network inet raw,
-
-        ${pkgs.stdenv.cc.libc.out}/lib/*.so mr,
-        ${pkgs.libcap.lib}/lib/libcap.so* mr,
-        ${pkgs.attr.out}/lib/libattr.so* mr,
-
-        ${pkgs.iputils}/bin/ping mixr,
-
-        #/etc/modules.conf r,
-
-        ## Site-specific additions and overrides. See local/README for details.
-        ##include <local/bin.ping>
-      }
-    '') ];
-  };
-
-}
--- a/nixos/modules/security/apparmor.nix
+++ b/nixos/modules/security/apparmor.nix
@ -1,59 +1,216 @@
 { config, lib, pkgs, ... }:

+with lib;
+
 let
-  inherit (lib) mkIf mkOption types concatMapStrings;
+  inherit (builtins) attrNames head map match readFile;
+  inherit (lib) types;
+  inherit (config.environment) etc;
  cfg = config.security.apparmor;
+  mkDisableOption = name: mkEnableOption name // {
+    default = true;
+    example = false;
+  };
+  enabledPolicies = filterAttrs (n: p: p.enable) cfg.policies;
 in

 {
-   options = {
-     security.apparmor = {
-       enable = mkOption {
-         type = types.bool;
-         default = false;
-         description = "Enable the AppArmor Mandatory Access Control system.";
-       };
-       profiles = mkOption {
-         type = types.listOf types.path;
-         default = [];
-         description = "List of files containing AppArmor profiles.";
-       };
-       packages = mkOption {
-         type = types.listOf types.package;
-         default = [];
-         description = "List of packages to be added to apparmor's include path";
-       };
-     };
-   };
+  imports = [
+    (mkRemovedOptionModule [ "security" "apparmor" "confineSUIDApplications" ] "Please use the new options: `security.apparmor.policies.<policy>.enable'.")
+    (mkRemovedOptionModule [ "security" "apparmor" "profiles" ] "Please use the new option: `security.apparmor.policies'.")
+    apparmor/includes.nix
+    apparmor/profiles.nix
+  ];

-   config = mkIf cfg.enable {
-     environment.systemPackages = [ pkgs.apparmor-utils ];
+  options = {
+    security.apparmor = {
+      enable = mkEnableOption ''
+        the AppArmor Mandatory Access Control system.

-     boot.kernelParams = [ "apparmor=1" "security=apparmor" ];
+        If you're enabling this module on a running system,
+        note that a reboot will be required to activate AppArmor in the kernel.

-     systemd.services.apparmor = let
-       paths = concatMapStrings (s: " -I ${s}/etc/apparmor.d")
-         ([ pkgs.apparmor-profiles ] ++ cfg.packages);
-     in {
-       after = [ "local-fs.target" ];
-       before = [ "sysinit.target" ];
-       wantedBy = [ "multi-user.target" ];
-       unitConfig = {
-         DefaultDependencies = "no";
-       };
-       serviceConfig = {
-         Type = "oneshot";
-         RemainAfterExit = "yes";
-         ExecStart = map (p:
-           ''${pkgs.apparmor-parser}/bin/apparmor_parser -rKv ${paths} "${p}"''
-         ) cfg.profiles;
-         ExecStop = map (p:
-           ''${pkgs.apparmor-parser}/bin/apparmor_parser -Rv "${p}"''
-         ) cfg.profiles;
-         ExecReload = map (p:
-           ''${pkgs.apparmor-parser}/bin/apparmor_parser --reload ${paths} "${p}"''
-         ) cfg.profiles;
-       };
-     };
-   };
+        Also, beware that enabling this module privileges stability over security
+        by not trying to kill unconfined but newly confinable running processes by default,
+        though it would be needed because AppArmor can only confine new
+        or already confined processes of an executable.
+        This killing would for instance be necessary when upgrading to a NixOS revision
+        introducing for the first time an AppArmor profile for the executable
+        of a running process.
+
+        Enable <xref linkend="opt-security.apparmor.killUnconfinedConfinables"/>
+        if you want this service to do such killing
+        by sending a <literal>SIGTERM</literal> to those running processes'';
+      policies = mkOption {
+        description = ''
+          AppArmor policies.
+        '';
+        type = types.attrsOf (types.submodule ({ name, config, ... }: {
+          options = {
+            enable = mkDisableOption "loading of the profile into the kernel";
+            enforce = mkDisableOption "enforcing of the policy or only complain in the logs";
+            profile = mkOption {
+              description = "The policy of the profile.";
+              type = types.lines;
+              apply = pkgs.writeText name;
+            };
+          };
+        }));
+        default = {};
+      };
+      includes = mkOption {
+        type = types.attrsOf types.lines;
+        default = {};
+        description = ''
+          List of paths to be added to AppArmor's searched paths
+          when resolving <literal>include</literal> directives.
+        '';
+        apply = mapAttrs pkgs.writeText;
+      };
+      packages = mkOption {
+        type = types.listOf types.package;
+        default = [];
+        description = "List of packages to be added to AppArmor's include path";
+      };
+      enableCache = mkEnableOption ''
+        caching of AppArmor policies
+        in <literal>/var/cache/apparmor/</literal>.
+
+        Beware that AppArmor policies almost always contain Nix store paths,
+        and thus produce at each change of these paths
+        a new cached version accumulating in the cache'';
+      killUnconfinedConfinables = mkEnableOption ''
+        killing of processes which have an AppArmor profile enabled
+        (in <xref linkend="opt-security.apparmor.policies"/>)
+        but are not confined (because AppArmor can only confine new processes).
+
+        This is only sending a gracious <literal>SIGTERM</literal> signal to the processes,
+        not a <literal>SIGKILL</literal>.
+
+        Beware that due to a current limitation of AppArmor,
+        only profiles with exact paths (and no name) can enable such kills'';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = map (policy:
+      { assertion = match ".*/.*" policy == null;
+        message = "`security.apparmor.policies.\"${policy}\"' must not contain a slash.";
+        # Because, for instance, aa-remove-unknown uses profiles_names_list() in rc.apparmor.functions
+        # which does not recurse into sub-directories.
+      }
+    ) (attrNames cfg.policies);
+
+    environment.systemPackages = [
+      pkgs.apparmor-utils
+      pkgs.apparmor-bin-utils
+    ];
+    environment.etc."apparmor.d".source = pkgs.linkFarm "apparmor.d" (
+      # It's important to put only enabledPolicies here and not all cfg.policies
+      # because aa-remove-unknown reads profiles from all /etc/apparmor.d/*
+      mapAttrsToList (name: p: { inherit name; path = p.profile; }) enabledPolicies ++
+      mapAttrsToList (name: path: { inherit name path; }) cfg.includes
+    );
+    environment.etc."apparmor/parser.conf".text = ''
+        ${if cfg.enableCache then "write-cache" else "skip-cache"}
+        cache-loc /var/cache/apparmor
+        Include /etc/apparmor.d
+      '' +
+      concatMapStrings (p: "Include ${p}/etc/apparmor.d\n") cfg.packages;
+    # For aa-logprof
+    environment.etc."apparmor/apparmor.conf".text = ''
+    '';
+    # For aa-logprof
+    environment.etc."apparmor/severity.db".source = pkgs.apparmor-utils + "/etc/apparmor/severity.db";
+    environment.etc."apparmor/logprof.conf".source = pkgs.runCommand "logprof.conf" {
+      header = ''
+        [settings]
+          # /etc/apparmor.d/ is read-only on NixOS
+          profiledir = /var/cache/apparmor/logprof
+          inactive_profiledir = /etc/apparmor.d/disable
+          # Use: journalctl -b --since today --grep audit: | aa-logprof
+          logfiles = /dev/stdin
+
+          parser = ${pkgs.apparmor-parser}/bin/apparmor_parser
+          ldd = ${pkgs.glibc.bin}/bin/ldd
+          logger = ${pkgs.utillinux}/bin/logger
+
+          # customize how file ownership permissions are presented
+          # 0 - off
+          # 1 - default of what ever mode the log reported
+          # 2 - force the new permissions to be user
+          # 3 - force all perms on the rule to be user
+          default_owner_prompt = 1
+
+          custom_includes = /etc/apparmor.d ${concatMapStringsSep " " (p: "${p}/etc/apparmor.d") cfg.packages}
+
+        [qualifiers]
+          ${pkgs.runtimeShell} = icnu
+          ${pkgs.bashInteractive}/bin/sh = icnu
+          ${pkgs.bashInteractive}/bin/bash = icnu
+          ${config.users.defaultUserShell} = icnu
+      '';
+      footer = "${pkgs.apparmor-utils}/etc/apparmor/logprof.conf";
+      passAsFile = [ "header" ];
+    } ''
+      cp $headerPath $out
+      sed '1,/\[qualifiers\]/d' $footer >> $out
+    '';
+
+    boot.kernelParams = [ "apparmor=1" "security=apparmor" ];
+
+    systemd.services.apparmor = {
+      after = [
+        "local-fs.target"
+        "systemd-journald-audit.socket"
+      ];
+      before = [ "sysinit.target" ];
+      wantedBy = [ "multi-user.target" ];
+      unitConfig = {
+        Description="Load AppArmor policies";
+        DefaultDependencies = "no";
+        ConditionSecurity = "apparmor";
+      };
+      # Reloading instead of restarting enables to load new AppArmor profiles
+      # without necessarily restarting all services which have Requires=apparmor.service
+      reloadIfChanged = true;
+      restartTriggers = [
+        etc."apparmor/parser.conf".source
+        etc."apparmor.d".source
+      ];
+      serviceConfig = let
+        killUnconfinedConfinables = pkgs.writeShellScript "apparmor-kill" ''
+          set -eu
+          ${pkgs.apparmor-bin-utils}/bin/aa-status --json |
+          ${pkgs.jq}/bin/jq --raw-output '.processes | .[] | .[] | select (.status == "unconfined") | .pid' |
+          xargs --verbose --no-run-if-empty --delimiter='\n' \
+          kill
+        '';
+        commonOpts = p: "--verbose --show-cache ${optionalString (!p.enforce) "--complain "}${p.profile}";
+        in {
+        Type = "oneshot";
+        RemainAfterExit = "yes";
+        ExecStartPre = "${pkgs.apparmor-utils}/bin/aa-teardown";
+        ExecStart = mapAttrsToList (n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts p}") enabledPolicies;
+        ExecStartPost = optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
+        ExecReload =
+          # Add or replace into the kernel profiles in enabledPolicies
+          # (because AppArmor can do that without stopping the processes already confined).
+          mapAttrsToList (n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --replace ${commonOpts p}") enabledPolicies ++
+          # Remove from the kernel any profile whose name is not
+          # one of the names within the content of the profiles in enabledPolicies
+          # (indirectly read from /etc/apparmor.d/*, without recursing into sub-directory).
+          # Note that this does not remove profiles dynamically generated by libvirt.
+          [ "${pkgs.apparmor-utils}/bin/aa-remove-unknown" ] ++
+          # Optionaly kill the processes which are unconfined but now have a profile loaded
+          # (because AppArmor can only start to confine new processes).
+          optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
+        ExecStop = "${pkgs.apparmor-utils}/bin/aa-teardown";
+        CacheDirectory = [ "apparmor" "apparmor/logprof" ];
+        CacheDirectoryMode = "0700";
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ julm ];
 }
--- a/nixos/modules/security/apparmor/includes.nix
+++ b/nixos/modules/security/apparmor/includes.nix
@ -0,0 +1,317 @@
+{ config, lib, pkgs, ... }:
+let
+  inherit (builtins) attrNames hasAttr isAttrs;
+  inherit (lib) getLib;
+  inherit (config.environment) etc;
+  # Utility to generate an AppArmor rule
+  # only when the given path exists in config.environment.etc
+  etcRule = arg:
+    let go = { path ? null, mode ? "r", trail ? "" }:
+      lib.optionalString (hasAttr path etc)
+        "${mode} ${config.environment.etc.${path}.source}${trail},";
+    in if isAttrs arg
+    then go arg
+    else go { path = arg; };
+in
+{
+# FIXME: most of the etcRule calls below have been
+# written systematically by converting from apparmor-profiles's profiles
+# without testing nor deep understanding of their uses,
+# and thus may need more rules or can have less rules;
+# this remains to be determined case by case,
+# some may even be completely useless.
+config.security.apparmor.includes = {
+  # This one is included by <tunables/global>
+  # which is usualy included before any profile.
+  "abstractions/tunables/alias" = ''
+    alias /bin -> /run/current-system/sw/bin,
+    alias /lib/modules -> /run/current-system/kernel/lib/modules,
+    alias /sbin -> /run/current-system/sw/sbin,
+    alias /usr -> /run/current-system/sw,
+  '';
+  "abstractions/audio" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/audio"
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      "asound.conf"
+      "esound/esd.conf"
+      "libao.conf"
+      { path = "pulse";  trail = "/"; }
+      { path = "pulse";  trail = "/**"; }
+      { path = "sound";  trail = "/"; }
+      { path = "sound";  trail = "/**"; }
+      { path = "alsa/conf.d";  trail = "/"; }
+      { path = "alsa/conf.d";  trail = "/*"; }
+      "openal/alsoft.conf"
+      "wildmidi/wildmidi.conf"
+    ];
+  "abstractions/authentication" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/authentication"
+    # Defined in security.pam
+    include <abstractions/pam>
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      "nologin"
+      "securetty"
+      { path = "security";  trail = "/*"; }
+      "shadow"
+      "gshadow"
+      "pwdb.conf"
+      "default/passwd"
+      "login.defs"
+    ];
+  "abstractions/base" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/base"
+    r ${pkgs.stdenv.cc.libc}/share/locale/**,
+    r ${pkgs.stdenv.cc.libc}/share/locale.alias,
+    ${lib.optionalString (pkgs.glibcLocales != null) "r ${pkgs.glibcLocales}/lib/locale/locale-archive,"}
+    ${etcRule "localtime"}
+    r ${pkgs.tzdata}/share/zoneinfo/**,
+    r ${pkgs.stdenv.cc.libc}/share/i18n/**,
+  '';
+  "abstractions/bash" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/bash"
+
+    # bash inspects filesystems at startup
+    # and /etc/mtab is linked to /proc/mounts
+    @{PROC}/mounts
+
+    # system-wide bash configuration
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      "profile.dos"
+      "profile"
+      "profile.d"
+      { path = "profile.d";  trail = "/*"; }
+      "bashrc"
+      "bash.bashrc"
+      "bash.bashrc.local"
+      "bash_completion"
+      "bash_completion.d"
+      { path = "bash_completion.d";  trail = "/*"; }
+      # bash relies on system-wide readline configuration
+      "inputrc"
+      # run out of /etc/bash.bashrc
+      "DIR_COLORS"
+    ];
+  "abstractions/consoles" = ''
+     include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/consoles"
+  '';
+  "abstractions/cups-client" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/cpus-client"
+    ${etcRule "cups/cups-client.conf"}
+  '';
+  "abstractions/dbus-session-strict" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/dbus-session-strict"
+    ${etcRule "machine-id"}
+  '';
+  "abstractions/dconf" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/dconf"
+    ${etcRule { path = "dconf";  trail = "/**"; }}
+  '';
+  "abstractions/dri-common" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/dri-common"
+    ${etcRule "drirc"}
+  '';
+  # The config.fonts.fontconfig NixOS module adds many files to /etc/fonts/
+  # by symlinking them but without exporting them outside of its NixOS module,
+  # those are therefore added there to this "abstractions/fonts".
+  "abstractions/fonts" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/fonts"
+    ${etcRule { path = "fonts";  trail = "/**"; }}
+  '';
+  "abstractions/gnome" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/gnome"
+    include <abstractions/fonts>
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      { path = "gnome";  trail = "/gtkrc*"; }
+      { path = "gtk";  trail = "/*"; }
+      { path = "gtk-2.0";  trail = "/*"; }
+      { path = "gtk-3.0";  trail = "/*"; }
+      "orbitrc"
+      { path = "pango";  trail = "/*"; }
+      { path = "/etc/gnome-vfs-2.0";  trail = "/modules/"; }
+      { path = "/etc/gnome-vfs-2.0";  trail = "/modules/*"; }
+      "papersize"
+      { path = "cups";  trail = "/lpoptions"; }
+      { path = "gnome";  trail = "/defaults.list"; }
+      { path = "xdg";  trail = "/{,*-}mimeapps.list"; }
+      "xdg/mimeapps.list"
+    ];
+  "abstractions/kde" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/kde"
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      { path = "qt3";  trail = "/kstylerc"; }
+      { path = "qt3";  trail = "/qt_plugins_3.3rc"; }
+      { path = "qt3";  trail = "/qtrc"; }
+      "kderc"
+      { path = "kde3";  trail = "/*"; }
+      "kde4rc"
+      { path = "xdg";  trail = "/kdeglobals"; }
+      { path = "xdg";  trail = "/Trolltech.conf"; }
+    ];
+  "abstractions/kerberosclient" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/kerberosclient"
+    '' + lib.concatMapStringsSep "\n" etcRule [
+    { path = "krb5.keytab"; mode="rk"; }
+    "krb5.conf"
+    "krb5.conf.d"
+    { path = "krb5.conf.d";  trail = "/*"; }
+
+    # config files found via strings on libs
+    "krb.conf"
+    "krb.realms"
+    "srvtab"
+    ];
+  "abstractions/ldapclient" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/ldapclient"
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      "ldap.conf"
+      "ldap.secret"
+      { path = "openldap";  trail = "/*"; }
+      { path = "openldap";  trail = "/cacerts/*"; }
+      { path = "sasl2";  trail = "/*"; }
+    ];
+  "abstractions/likewise" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/likewise"
+  '';
+  "abstractions/mdns" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/mdns"
+    ${etcRule "nss_mdns.conf"}
+  '';
+  "abstractions/nameservice" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nameservice"
+
+    # Many programs wish to perform nameservice-like operations, such as
+    # looking up users by name or id, groups by name or id, hosts by name
+    # or IP, etc. These operations may be performed through files, dns,
+    # NIS, NIS+, LDAP, hesiod, wins, etc. Allow them all here.
+    mr ${getLib pkgs.nss}/lib/libnss_*.so*,
+    mr ${getLib pkgs.nss}/lib64/libnss_*.so*,
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      "group"
+      "host.conf"
+      "hosts"
+      "nsswitch.conf"
+      "gai.conf"
+      "passwd"
+      "protocols"
+
+      # libtirpc (used for NIS/YP login) needs this
+      "netconfig"
+
+      "resolv.conf"
+
+      { path = "samba";  trail = "/lmhosts"; }
+      "services"
+
+      "default/nss"
+
+      # libnl-3-200 via libnss-gw-name
+      { path = "libnl";  trail = "/classid"; }
+      { path = "libnl-3";  trail = "/classid"; }
+    ];
+  "abstractions/nis" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nis"
+  '';
+  "abstractions/nvidia" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nvidia"
+    ${etcRule "vdpau_wrapper.cfg"}
+  '';
+  "abstractions/opencl-common" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/opencl-common"
+    ${etcRule { path = "OpenCL";  trail = "/**"; }}
+  '';
+  "abstractions/opencl-mesa" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/opencl-mesa"
+    ${etcRule "default/drirc"}
+  '';
+  "abstractions/openssl" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/openssl"
+    ${etcRule { path = "ssl";  trail = "/openssl.cnf"; }}
+  '';
+  "abstractions/p11-kit" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/p11-kit"
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      { path = "pkcs11";  trail = "/"; }
+      { path = "pkcs11";  trail = "/pkcs11.conf"; }
+      { path = "pkcs11";  trail = "/modules/"; }
+      { path = "pkcs11";  trail = "/modules/*"; }
+    ];
+  "abstractions/perl" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/perl"
+    ${etcRule { path = "perl";  trail = "/**"; }}
+  '';
+  "abstractions/php" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/php"
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      { path = "php";  trail = "/**/"; }
+      { path = "php5";  trail = "/**/"; }
+      { path = "php7";  trail = "/**/"; }
+      { path = "php";  trail = "/**.ini"; }
+      { path = "php5";  trail = "/**.ini"; }
+      { path = "php7";  trail = "/**.ini"; }
+    ];
+  "abstractions/postfix-common" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/postfix-common"
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      "mailname"
+      { path = "postfix";  trail = "/*.cf"; }
+      "postfix/main.cf"
+      "postfix/master.cf"
+    ];
+  "abstractions/python" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/python"
+  '';
+  "abstractions/qt5" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/qt5"
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      { path = "xdg";  trail = "/QtProject/qtlogging.ini"; }
+      { path = "xdg/QtProject";  trail = "/qtlogging.ini"; }
+      "xdg/QtProject/qtlogging.ini"
+    ];
+  "abstractions/samba" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/samba"
+    ${etcRule { path = "samba";  trail = "/*"; }}
+  '';
+  "abstractions/ssl_certs" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/ssl_certs"
+
+    # For the NixOS module: security.acme
+    r /var/lib/acme/*/cert.pem,
+    r /var/lib/acme/*/chain.pem,
+    r /var/lib/acme/*/fullchain.pem,
+
+    '' + lib.concatMapStringsSep "\n" etcRule [
+      "ssl/certs/ca-certificates.crt"
+      "ssl/certs/ca-bundle.crt"
+      "pki/tls/certs/ca-bundle.crt"
+
+      { path = "ssl/trust";  trail = "/"; }
+      { path = "ssl/trust";  trail = "/*"; }
+      { path = "ssl/trust/anchors";  trail = "/"; }
+      { path = "ssl/trust/anchors";  trail = "/**"; }
+      { path = "pki/trust";  trail = "/"; }
+      { path = "pki/trust";  trail = "/*"; }
+      { path = "pki/trust/anchors";  trail = "/"; }
+      { path = "pki/trust/anchors";  trail = "/**"; }
+    ];
+  "abstractions/ssl_keys" = ''
+    # security.acme NixOS module
+    r /var/lib/acme/*/full.pem,
+    r /var/lib/acme/*/key.pem,
+  '';
+  "abstractions/vulkan" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/vulkan"
+    ${etcRule { path = "vulkan/icd.d";  trail = "/"; }}
+    ${etcRule { path = "vulkan/icd.d";  trail = "/*.json"; }}
+  '';
+  "abstractions/winbind" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/winbind"
+    ${etcRule { path = "samba";  trail = "/smb.conf"; }}
+    ${etcRule { path = "samba";  trail = "/dhcp.conf"; }}
+  '';
+  "abstractions/X" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/X"
+    ${etcRule { path = "X11/cursors";  trail = "/"; }}
+    ${etcRule { path = "X11/cursors";  trail = "/**"; }}
+  '';
+};
+}
--- a/nixos/modules/security/apparmor/profiles.nix
+++ b/nixos/modules/security/apparmor/profiles.nix
@ -0,0 +1,11 @@
+{ config, lib, pkgs, ... }:
+let apparmor = config.security.apparmor; in
+{
+config.security.apparmor.packages = [ pkgs.apparmor-profiles ];
+config.security.apparmor.policies."bin.ping".profile = lib.mkIf apparmor.policies."bin.ping".enable ''
+  include "${pkgs.iputils.apparmor}/bin.ping"
+  include "${pkgs.inetutils.apparmor}/bin.ping"
+  # Note that including those two profiles in the same profile
+  # would not work if the second one were to re-include <tunables/global>.
+'';
+}
--- a/nixos/modules/security/misc.nix
+++ b/nixos/modules/security/misc.nix
@ -7,6 +7,10 @@ with lib;
    maintainers = [ maintainers.joachifm ];
  };

+  imports = [
+    (lib.mkRenamedOptionModule [ "security" "virtualization" "flushL1DataCache" ] [ "security" "virtualisation" "flushL1DataCache" ])
+  ];
+
  options = {
    security.allowUserNamespaces = mkOption {
      type = types.bool;
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@ -895,6 +895,81 @@ in
        runuser-l = { rootOK = true; unixAuth = false; };
      };

+    security.apparmor.includes."abstractions/pam" = let
+      isEnabled = test: fold or false (map test (attrValues config.security.pam.services));
+      in
+      lib.concatMapStringsSep "\n"
+        (name: "r ${config.environment.etc."pam.d/${name}".source},")
+        (attrNames config.security.pam.services) +
+      ''
+      mr ${getLib pkgs.pam}/lib/security/pam_filter/*,
+      mr ${getLib pkgs.pam}/lib/security/pam_*.so,
+      r ${getLib pkgs.pam}/lib/security/,
+      '' +
+      optionalString use_ldap ''
+         mr ${pam_ldap}/lib/security/pam_ldap.so,
+      '' +
+      optionalString config.services.sssd.enable ''
+        mr ${pkgs.sssd}/lib/security/pam_sss.so,
+      '' +
+      optionalString config.krb5.enable ''
+        mr ${pam_krb5}/lib/security/pam_krb5.so,
+        mr ${pam_ccreds}/lib/security/pam_ccreds.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.googleOsLoginAccountVerification)) ''
+        mr ${pkgs.google-compute-engine-oslogin}/lib/pam_oslogin_login.so,
+        mr ${pkgs.google-compute-engine-oslogin}/lib/pam_oslogin_admin.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.googleOsLoginAuthentication)) ''
+        mr ${pkgs.google-compute-engine-oslogin}/lib/pam_oslogin_login.so,
+      '' +
+      optionalString (config.security.pam.enableSSHAgentAuth
+                     && isEnabled (cfg: cfg.sshAgentAuth)) ''
+        mr ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.fprintAuth)) ''
+        mr ${pkgs.fprintd}/lib/security/pam_fprintd.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.u2fAuth)) ''
+        mr ${pkgs.pam_u2f}/lib/security/pam_u2f.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.usbAuth)) ''
+        mr ${pkgs.pam_usb}/lib/security/pam_usb.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.oathAuth)) ''
+        "mr ${pkgs.oathToolkit}/lib/security/pam_oath.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.yubicoAuth)) ''
+        mr ${pkgs.yubico-pam}/lib/security/pam_yubico.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.duoSecurity.enable)) ''
+        mr ${pkgs.duo-unix}/lib/security/pam_duo.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.otpwAuth)) ''
+        mr ${pkgs.otpw}/lib/security/pam_otpw.so,
+      '' +
+      optionalString config.security.pam.enableEcryptfs ''
+        mr ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.pamMount)) ''
+        mr ${pkgs.pam_mount}/lib/security/pam_mount.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.enableGnomeKeyring)) ''
+        mr ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.startSession)) ''
+        mr ${pkgs.systemd}/lib/security/pam_systemd.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.enableAppArmor)
+                     && config.security.apparmor.enable) ''
+        mr ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.enableKwallet)) ''
+        mr ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so,
+      '' +
+      optionalString config.virtualisation.lxc.lxcfs.enable ''
+        mr ${pkgs.lxc}/lib/security/pam_cgfs.so
+      '';
  };

 }
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@ -171,6 +171,14 @@ in
      export PATH="${wrapperDir}:$PATH"
    '';

+    security.apparmor.includes."nixos/security.wrappers" = ''
+      include "${pkgs.apparmorRulesFromClosure { name="security.wrappers"; } [
+        securityWrapper
+        pkgs.stdenv.cc.cc
+        pkgs.stdenv.cc.libc
+      ]}"
+    '';
+
    ###### setcap activation script
    system.activationScripts.wrappers =
      lib.stringAfter [ "specialfs" "users" ]
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@ -5,7 +5,7 @@ with lib;
 let
  cfg = config.services.transmission;
  inherit (config.environment) etc;
-  apparmor = config.security.apparmor.enable;
+  apparmor = config.security.apparmor;
  rootDir = "/run/transmission";
  homeDir = "/var/lib/transmission";
  settingsDir = ".config/transmission-daemon";
@ -184,8 +184,8 @@ in

    systemd.services.transmission = {
      description = "Transmission BitTorrent Service";
-      after = [ "network.target" ] ++ optional apparmor "apparmor.service";
-      requires = optional apparmor "apparmor.service";
+      after = [ "network.target" ] ++ optional apparmor.enable "apparmor.service";
+      requires = optional apparmor.enable "apparmor.service";
      wantedBy = [ "multi-user.target" ];
      environment.CURL_CA_BUNDLE = etc."ssl/certs/ca-certificates.crt".source;

@ -358,96 +358,39 @@ in
      })
    ];

-    security.apparmor.profiles = mkIf apparmor [
-      (pkgs.writeText "apparmor-transmission-daemon" ''
-        include <tunables/global>
+    security.apparmor.policies."bin.transmission-daemon".profile = ''
+      include "${pkgs.transmission.apparmor}/bin.transmission-daemon"
+    '';
+    security.apparmor.includes."local/bin.transmission-daemon" = ''
+      r ${config.systemd.services.transmission.environment.CURL_CA_BUNDLE},

-        ${pkgs.transmission}/bin/transmission-daemon {
-          include <abstractions/base>
-          include <abstractions/nameservice>
+      owner rw ${cfg.home}/${settingsDir}/**,
+      rw ${cfg.settings.download-dir}/**,
+      ${optionalString cfg.settings.incomplete-dir-enabled ''
+        rw ${cfg.settings.incomplete-dir}/**,
+      ''}
+      ${optionalString cfg.settings.watch-dir-enabled ''
+        rw ${cfg.settings.watch-dir}/**,
+      ''}
+      profile dirs {
+        rw ${cfg.settings.download-dir}/**,
+        ${optionalString cfg.settings.incomplete-dir-enabled ''
+          rw ${cfg.settings.incomplete-dir}/**,
+        ''}
+        ${optionalString cfg.settings.watch-dir-enabled ''
+          rw ${cfg.settings.watch-dir}/**,
+        ''}
+      }

-          # NOTE: https://github.com/NixOS/nixpkgs/pull/93457
-          # will remove the need for these by fixing <abstractions/base>
-          r ${etc."hosts".source},
-          r /etc/ld-nix.so.preload,
-          ${lib.optionalString (builtins.hasAttr "ld-nix.so.preload" etc) ''
-            r ${etc."ld-nix.so.preload".source},
-            ${concatMapStrings (p: optionalString (p != "") ("mr ${p},\n"))
-              (splitString "\n" config.environment.etc."ld-nix.so.preload".text)}
-          ''}
-          r ${etc."ssl/certs/ca-certificates.crt".source},
-          r ${pkgs.tzdata}/share/zoneinfo/**,
-          r ${pkgs.stdenv.cc.libc}/share/i18n/**,
-          r ${pkgs.stdenv.cc.libc}/share/locale/**,
-
-          mr ${getLib pkgs.stdenv.cc.cc}/lib/*.so*,
-          mr ${getLib pkgs.stdenv.cc.libc}/lib/*.so*,
-          mr ${getLib pkgs.attr}/lib/libattr*.so*,
-          mr ${getLib pkgs.c-ares}/lib/libcares*.so*,
-          mr ${getLib pkgs.curl}/lib/libcurl*.so*,
-          mr ${getLib pkgs.keyutils}/lib/libkeyutils*.so*,
-          mr ${getLib pkgs.libcap}/lib/libcap*.so*,
-          mr ${getLib pkgs.libevent}/lib/libevent*.so*,
-          mr ${getLib pkgs.libgcrypt}/lib/libgcrypt*.so*,
-          mr ${getLib pkgs.libgpgerror}/lib/libgpg-error*.so*,
-          mr ${getLib pkgs.libkrb5}/lib/lib*.so*,
-          mr ${getLib pkgs.libssh2}/lib/libssh2*.so*,
-          mr ${getLib pkgs.lz4}/lib/liblz4*.so*,
-          mr ${getLib pkgs.nghttp2}/lib/libnghttp2*.so*,
-          mr ${getLib pkgs.openssl}/lib/libcrypto*.so*,
-          mr ${getLib pkgs.openssl}/lib/libssl*.so*,
-          mr ${getLib pkgs.systemd}/lib/libsystemd*.so*,
-          mr ${getLib pkgs.util-linuxMinimal.out}/lib/libblkid.so*,
-          mr ${getLib pkgs.util-linuxMinimal.out}/lib/libmount.so*,
-          mr ${getLib pkgs.util-linuxMinimal.out}/lib/libuuid.so*,
-          mr ${getLib pkgs.xz}/lib/liblzma*.so*,
-          mr ${getLib pkgs.zlib}/lib/libz*.so*,
-          mr ${getLib pkgs.brotli}/lib/libbrotli*.so*,
-
-          r @{PROC}/sys/kernel/random/uuid,
-          r @{PROC}/sys/vm/overcommit_memory,
-          # @{pid} is not a kernel variable yet but a regexp
-          #r @{PROC}/@{pid}/environ,
-          r @{PROC}/@{pid}/mounts,
-          rwk /tmp/tr_session_id_*,
-          r /run/systemd/resolve/stub-resolv.conf,
-
-          r ${pkgs.openssl.out}/etc/**,
-          r ${config.systemd.services.transmission.environment.CURL_CA_BUNDLE},
-          r ${pkgs.transmission}/share/transmission/**,
-
-          owner rw ${cfg.home}/${settingsDir}/**,
-          rw ${cfg.settings.download-dir}/**,
-          ${optionalString cfg.settings.incomplete-dir-enabled ''
-            rw ${cfg.settings.incomplete-dir}/**,
-          ''}
-          ${optionalString cfg.settings.watch-dir-enabled ''
-            rw ${cfg.settings.watch-dir}/**,
-          ''}
-          profile dirs {
-            rw ${cfg.settings.download-dir}/**,
-            ${optionalString cfg.settings.incomplete-dir-enabled ''
-              rw ${cfg.settings.incomplete-dir}/**,
-            ''}
-            ${optionalString cfg.settings.watch-dir-enabled ''
-              rw ${cfg.settings.watch-dir}/**,
-            ''}
-          }
-
-          ${optionalString (cfg.settings.script-torrent-done-enabled &&
-                            cfg.settings.script-torrent-done-filename != "") ''
-            # Stack transmission_directories profile on top of
-            # any existing profile for script-torrent-done-filename
-            # FIXME: to be tested as I'm not sure it works well with NoNewPrivileges=
-            # https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorStacking#seccomp-and-no_new_privs
-            px ${cfg.settings.script-torrent-done-filename} -> &@{dirs},
-          ''}
-
-          # FIXME: enable customizing using https://github.com/NixOS/nixpkgs/pull/93457
-          # include <local/transmission-daemon>
-        }
-      '')
-    ];
+      ${optionalString (cfg.settings.script-torrent-done-enabled &&
+                        cfg.settings.script-torrent-done-filename != "") ''
+        # Stack transmission_directories profile on top of
+        # any existing profile for script-torrent-done-filename
+        # FIXME: to be tested as I'm not sure it works well with NoNewPrivileges=
+        # https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorStacking#seccomp-and-no_new_privs
+        px ${cfg.settings.script-torrent-done-filename} -> &@{dirs},
+      ''}
+    '';
  };

  meta.maintainers = with lib.maintainers; [ julm ];
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@ -1139,6 +1139,21 @@ in
    } else {
      ping.source = "${pkgs.iputils.out}/bin/ping";
    };
+    security.apparmor.policies."bin.ping".profile = lib.mkIf config.security.apparmor.policies."bin.ping".enable (lib.mkAfter ''
+      /run/wrappers/bin/ping {
+        include <abstractions/base>
+        include <nixos/security.wrappers>
+        rpx /run/wrappers/wrappers.*/ping,
+      }
+      /run/wrappers/wrappers.*/ping {
+        include <abstractions/base>
+        include <nixos/security.wrappers>
+        r /run/wrappers/wrappers.*/ping.real,
+        mrpx ${config.security.wrappers.ping.source},
+        capability net_raw,
+        capability setpcap,
+      }
+    '');

    # Set the host and domain names in the activation script.  Don't
    # clear it if it's not configured in the NixOS configuration,
--- a/nixos/modules/virtualisation/lxc.nix
+++ b/nixos/modules/virtualisation/lxc.nix
@ -74,9 +74,13 @@ in
    systemd.tmpfiles.rules = [ "d /var/lib/lxc/rootfs 0755 root root -" ];

    security.apparmor.packages = [ pkgs.lxc ];
-    security.apparmor.profiles = [
-      "${pkgs.lxc}/etc/apparmor.d/lxc-containers"
-      "${pkgs.lxc}/etc/apparmor.d/usr.bin.lxc-start"
-    ];
+    security.apparmor.policies = {
+      "bin.lxc-start".profile = ''
+        include ${pkgs.lxc}/etc/apparmor.d/usr.bin.lxc-start
+      '';
+      "lxc-containers".profile = ''
+        include ${pkgs.lxc}/etc/apparmor.d/lxc-containers
+      '';
+    };
  };
 }
--- a/nixos/modules/virtualisation/lxd.nix
+++ b/nixos/modules/virtualisation/lxd.nix
@ -97,11 +97,17 @@ in {
    # does a bunch of unrelated things.
    systemd.tmpfiles.rules = [ "d /var/lib/lxc/rootfs 0755 root root -" ];

-    security.apparmor.packages = [ cfg.lxcPackage ];
-    security.apparmor.profiles = [
-      "${cfg.lxcPackage}/etc/apparmor.d/lxc-containers"
-      "${cfg.lxcPackage}/etc/apparmor.d/usr.bin.lxc-start"
-    ];
+    security.apparmor = {
+      packages = [ cfg.lxcPackage ];
+      policies = {
+        "bin.lxc-start".profile = ''
+          include ${cfg.lxcPackage}/etc/apparmor.d/usr.bin.lxc-start
+        '';
+        "lxc-containers".profile = ''
+          include ${cfg.lxcPackage}/etc/apparmor.d/lxc-containers
+        '';
+      };
+    };

    # TODO: remove once LXD gets proper support for cgroupsv2
    # (currently most of the e.g. CPU accounting stuff doesn't work)
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -27,6 +27,7 @@ in
  airsonic = handleTest ./airsonic.nix {};
  amazon-init-shell = handleTest ./amazon-init-shell.nix {};
  ammonite = handleTest ./ammonite.nix {};
+  apparmor = handleTest ./apparmor.nix {};
  atd = handleTest ./atd.nix {};
  avahi = handleTest ./avahi.nix {};
  avahi-with-resolved = handleTest ./avahi.nix { networkd = true; };
--- a/nixos/tests/apparmor.nix
+++ b/nixos/tests/apparmor.nix
@ -0,0 +1,82 @@
+import ./make-test-python.nix ({ pkgs, ... } : {
+  name = "apparmor";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ julm ];
+  };
+
+  machine =
+    { lib, pkgs, config, ... }:
+    with lib;
+    {
+      security.apparmor.enable = mkDefault true;
+    };
+
+  testScript =
+    ''
+      machine.wait_for_unit("multi-user.target")
+
+      with subtest("AppArmor profiles are loaded"):
+          machine.succeed("systemctl status apparmor.service")
+
+      # AppArmor securityfs
+      with subtest("AppArmor securityfs is mounted"):
+          machine.succeed("mountpoint -q /sys/kernel/security")
+          machine.succeed("cat /sys/kernel/security/apparmor/profiles")
+
+      # Test apparmorRulesFromClosure by:
+      # 1. Prepending a string of the relevant packages' name and version on each line.
+      # 2. Sorting according to those strings.
+      # 3. Removing those prepended strings.
+      # 4. Using `diff` against the expected output.
+      with subtest("apparmorRulesFromClosure"):
+          machine.succeed(
+              "${pkgs.diffutils}/bin/diff ${pkgs.writeText "expected.rules" ''
+                  mr ${pkgs.bash}/lib/**.so*,
+                  r ${pkgs.bash},
+                  r ${pkgs.bash}/etc/**,
+                  r ${pkgs.bash}/lib/**,
+                  r ${pkgs.bash}/share/**,
+                  x ${pkgs.bash}/foo/**,
+                  mr ${pkgs.glibc}/lib/**.so*,
+                  r ${pkgs.glibc},
+                  r ${pkgs.glibc}/etc/**,
+                  r ${pkgs.glibc}/lib/**,
+                  r ${pkgs.glibc}/share/**,
+                  x ${pkgs.glibc}/foo/**,
+                  mr ${pkgs.libcap}/lib/**.so*,
+                  r ${pkgs.libcap},
+                  r ${pkgs.libcap}/etc/**,
+                  r ${pkgs.libcap}/lib/**,
+                  r ${pkgs.libcap}/share/**,
+                  x ${pkgs.libcap}/foo/**,
+                  mr ${pkgs.libcap.lib}/lib/**.so*,
+                  r ${pkgs.libcap.lib},
+                  r ${pkgs.libcap.lib}/etc/**,
+                  r ${pkgs.libcap.lib}/lib/**,
+                  r ${pkgs.libcap.lib}/share/**,
+                  x ${pkgs.libcap.lib}/foo/**,
+                  mr ${pkgs.libidn2.out}/lib/**.so*,
+                  r ${pkgs.libidn2.out},
+                  r ${pkgs.libidn2.out}/etc/**,
+                  r ${pkgs.libidn2.out}/lib/**,
+                  r ${pkgs.libidn2.out}/share/**,
+                  x ${pkgs.libidn2.out}/foo/**,
+                  mr ${pkgs.libunistring}/lib/**.so*,
+                  r ${pkgs.libunistring},
+                  r ${pkgs.libunistring}/etc/**,
+                  r ${pkgs.libunistring}/lib/**,
+                  r ${pkgs.libunistring}/share/**,
+                  x ${pkgs.libunistring}/foo/**,
+              ''} ${pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''
+                  ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ${builtins.storeDir}/[^,/-]*-\([^/,]*\):\1 \0:' ${
+                      pkgs.apparmorRulesFromClosure {
+                        name = "ping";
+                        additionalRules = ["x $path/foo/**"];
+                      } [ pkgs.libcap ]
+                  } |
+                  ${pkgs.coreutils}/bin/sort -n -k1 |
+                  ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ::' >$out
+              ''}"
+          )
+    '';
+})
--- a/nixos/tests/keymap.nix
+++ b/nixos/tests/keymap.nix
@ -107,17 +107,32 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
      altgr.expect = [ "~"       "#"       "{"       "["       "|"       ];
    };

-    extraConfig.console.keyMap = "azerty/fr";
+    extraConfig.console.keyMap = "fr";
    extraConfig.services.xserver.layout = "fr";
  };

+  bone = {
+    tests = {
+      layer1.qwerty = [ "f"           "j"                     ];
+      layer1.expect = [ "e"           "n"                     ];
+      layer2.qwerty = [ "shift-f"     "shift-j"     "shift-6" ];
+      layer2.expect = [ "E"           "N"           "$"       ];
+      layer3.qwerty = [ "caps_lock-d" "caps_lock-f"           ];
+      layer3.expect = [ "{"           "}"                     ];
+    };
+
+    extraConfig.console.keyMap = "bone";
+    extraConfig.services.xserver.layout = "de";
+    extraConfig.services.xserver.xkbVariant = "bone";
+  };
+
  colemak = {
    tests = {
      homerow.qwerty = [ "a" "s" "d" "f" "j" "k" "l" "semicolon" ];
      homerow.expect = [ "a" "r" "s" "t" "n" "e" "i" "o"         ];
    };

-    extraConfig.console.keyMap = "colemak/colemak";
+    extraConfig.console.keyMap = "colemak";
    extraConfig.services.xserver.layout = "us";
    extraConfig.services.xserver.xkbVariant = "colemak";
  };
@ -129,9 +144,13 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
      symbols.qwerty = [ "q" "w" "e" "minus" "equal" ];
      symbols.expect = [ "'" "," "." "["     "]"     ];
    };
+
+    extraConfig.console.keyMap = "dvorak";
+    extraConfig.services.xserver.layout = "us";
+    extraConfig.services.xserver.xkbVariant = "dvorak";
  };

-  dvp = {
+  dvorak-programmer = {
    tests = {
      homerow.qwerty = [ "a" "s" "d" "f" "j" "k" "l" "semicolon" ];
      homerow.expect = [ "a" "o" "e" "u" "h" "t" "n" "s"         ];
@ -142,6 +161,7 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
      symbols.expect = [ "&" "[" "{" "}" "(" "=" "*" ")" "+" "]" "!" ];
    };

+    extraConfig.console.keyMap = "dvorak-programmer";
    extraConfig.services.xserver.layout = "us";
    extraConfig.services.xserver.xkbVariant = "dvp";
  };
@ -156,6 +176,7 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
      layer3.expect = [ "{"           "}"                     ];
    };

+    extraConfig.console.keyMap = "neo";
    extraConfig.services.xserver.layout = "de";
    extraConfig.services.xserver.xkbVariant = "neo";
  };
--- a/nixos/tests/minecraft-server.nix
+++ b/nixos/tests/minecraft-server.nix
@ -24,7 +24,7 @@ in import ./make-test-python.nix ({ pkgs, ... }: {
      };
    };

-    virtualisation.memorySize = 2048;
+    virtualisation.memorySize = 2047;
  };

  testScript = ''
--- a/pkgs/applications/accessibility/dasher/default.nix
+++ b/pkgs/applications/accessibility/dasher/default.nix
@ -1,22 +1,33 @@
-{ stdenv, lib, fetchFromGitHub
-, autoreconfHook, pkg-config, wrapGAppsHook
-, glib, gtk3, expat, gnome-doc-utils, which
-, at-spi2-core, dbus
-, libxslt, libxml2
-, speechSupport ? true, speechd ? null
+{ stdenv
+, lib
+, fetchFromGitLab
+, autoreconfHook
+, pkg-config
+, wrapGAppsHook
+, glib
+, gtk3
+, expat
+, itstool
+, gnome-doc-utils
+, which
+, at-spi2-core
+, dbus
+, libxslt
+, libxml2
+, speechSupport ? true
+, speechd
 }:

-assert speechSupport -> speechd != null;
-
 stdenv.mkDerivation {
  pname = "dasher";
-  version = "2018-04-03";
+  version = "unstable-2021-04-25";

-  src = fetchFromGitHub {
-    owner = "dasher-project";
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
    repo = "dasher";
-    rev = "9ab12462e51d17a38c0ddc7f7ffe1cb5fe83b627";
-    sha256 = "1r9xn966nx3pv2bidd6i3pxmprvlw6insnsb38zabmac609h9d9s";
+    rev = "90c753b87564fa3f42cb2d04e1eb6662dc8e0f8f";
+    sha256 = "sha256-aM05CV68pCRlhfIPyhuHWeRL+tDroB3fVsoX08OU8hY=";
  };

  prePatch = ''
@ -33,23 +44,27 @@ stdenv.mkDerivation {
    # doc generation
    gnome-doc-utils
    which
-    libxslt libxml2
+    libxslt
+    libxml2
  ];

  buildInputs = [
    glib
    gtk3
    expat
+    itstool
    # at-spi2 needs dbus to be recognized by pkg-config
-    at-spi2-core dbus
+    at-spi2-core
+    dbus
  ] ++ lib.optional speechSupport speechd;

+  enableParallelBuilding = true;
+
  meta = {
-    homepage = "http://www.inference.org.uk/dasher/";
+    homepage = "https://www.inference.org.uk/dasher/";
    description = "Information-efficient text-entry interface, driven by natural continuous pointing gestures";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
    maintainers = [ lib.maintainers.Profpatsch ];
    platforms = lib.platforms.all;
  };
-
 }
--- a/pkgs/applications/blockchains/electrs.nix
+++ b/pkgs/applications/blockchains/electrs.nix
@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {

  # needed for librocksdb-sys
  nativeBuildInputs = [ llvmPackages.clang ];
-  LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
+  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";

  cargoSha256 = "1rqpadlr9r4z2z825li6vi5a21hivc3bsn5ibxshrdrwiycyyxz8";

--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@ -20,7 +20,7 @@ rustPlatform.buildRustPackage rec {

  nativeBuildInputs = [ clang ];

-  LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
+  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
  PROTOC = "${protobuf}/bin/protoc";

  # NOTE: We don't build the WASM runtimes since this would require a more
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@ -7,7 +7,7 @@
  , patches ? [ ]
 }:
 { stdenv, lib, fetchurl, fetchpatch, ncurses, xlibsWrapper, libXaw, libXpm
-, Xaw3d, libXcursor,  pkg-config, gettext, libXft, dbus, libpng, libjpeg, libungif
+, Xaw3d, libXcursor,  pkg-config, gettext, libXft, dbus, libpng, libjpeg, giflib
 , libtiff, librsvg, gconf, libxml2, imagemagick, gnutls, libselinux
 , alsaLib, cairo, acl, gpm, AppKit, GSS, ImageIO, m17n_lib, libotf
 , jansson, harfbuzz
@ -108,7 +108,7 @@ let emacs = stdenv.mkDerivation (lib.optionalAttrs nativeComp {
    [ ncurses gconf libxml2 gnutls alsaLib acl gpm gettext jansson harfbuzz.dev ]
    ++ lib.optionals stdenv.isLinux [ dbus libselinux systemd ]
    ++ lib.optionals withX
-      [ xlibsWrapper libXaw Xaw3d libXpm libpng libjpeg libungif libtiff libXft
+      [ xlibsWrapper libXaw Xaw3d libXpm libpng libjpeg giflib libtiff libXft
        gconf cairo ]
    ++ lib.optionals (withX || withNS) [ librsvg ]
    ++ lib.optionals withImageMagick [ imagemagick ]
--- a/pkgs/applications/editors/jove/default.nix
+++ b/pkgs/applications/editors/jove/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "jove";
-  version = "4.17.3.6";
+  version = "4.17.3.7";

  src = fetchFromGitHub {
    owner = "jonmacs";
    repo = "jove";
    rev = version;
-    sha256 = "sha256-uQRNKV06ipOHrOsvsceqIFGGlRv5qOQy18q0tFkR6Kg=";
+    sha256 = "sha256-fD87FIWZlfJE2tVX+0QaiGGqu+tJFHheXe1guJR/Hxg=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/editors/jucipp/default.nix
+++ b/pkgs/applications/editors/jucipp/default.nix
@ -56,8 +56,8 @@ stdenv.mkDerivation rec {
    e = "\");";
    v = lib.getVersion llvmPackages.clang;
  in
-    p+llvmPackages.libcxx+"/include/c++/v1"+e
-    +p+llvmPackages.clang-unwrapped+"/lib/clang/"+v+"/include/"+e
+    p+llvmPackages.libcxx.dev+"/include/c++/v1"+e
+    +p+llvmPackages.clang-unwrapped.lib+"/lib/clang/"+v+"/include/"+e
    +p+glibc.dev+"/include"+e;

  preConfigure = ''
--- a/pkgs/applications/editors/kdevelop5/kdevelop.nix
+++ b/pkgs/applications/editors/kdevelop5/kdevelop.nix
@ -23,7 +23,7 @@ mkDerivation rec {

  buildInputs = [
    kdevelop-pg-qt
-    llvmPackages.llvm llvmPackages.clang-unwrapped
+    llvmPackages.llvm llvmPackages.libclang
  ];

  propagatedBuildInputs = [
@ -37,7 +37,7 @@ mkDerivation rec {
  # https://cgit.kde.org/kdevelop.git/commit/?id=716372ae2e8dff9c51e94d33443536786e4bd85b
  # required as nixos seems to be unable to find CLANG_BUILTIN_DIR
  cmakeFlags = [
-    "-DCLANG_BUILTIN_DIR=${llvmPackages.clang-unwrapped}/lib/clang/${lib.getVersion llvmPackages.clang}/include"
+    "-DCLANG_BUILTIN_DIR=${llvmPackages.libclang.lib}/lib/clang/${lib.getVersion llvmPackages.clang}/include"
  ];

  dontWrapQtApps = true;
--- a/pkgs/applications/editors/rstudio/clang-location.patch
+++ b/pkgs/applications/editors/rstudio/clang-location.patch
@ -7,7 +7,7 @@ index ec12a3a1ff..8c81b633ae 100644
    // we need to add in the associated libclang headers as
    // they are not discovered / used by default during compilation
 -   FilePath llvmPath = s_libraryPath.parent().parent();
-+   FilePath llvmPath("@clang@");
+   FilePath llvmPath("@libclang@");
    boost::format fmt("%1%/lib/clang/%2%/include");
    fmt % llvmPath.absolutePath() % version.asString();
    std::string includePath = fmt.str();
--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@ -42,8 +42,8 @@ mkDerivation rec {
  postPatch = ''
    substituteInPlace src/cpp/core/r_util/REnvironmentPosix.cpp --replace '@R@' ${R}
    substituteInPlace src/cpp/core/libclang/LibClang.cpp \
-      --replace '@clang@' ${llvmPackages.clang.cc} \
-      --replace '@libclang.so@' ${llvmPackages.clang.cc.lib}/lib/libclang.so
+      --replace '@libclang@' ${llvmPackages.libclang.lib} \
+      --replace '@libclang.so@' ${llvmPackages.libclang.lib}/lib/libclang.so
  '';

  ginSrc = fetchurl {
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@ -19,7 +19,7 @@ let
    urllib3
    pygments
    pyqt5
-    sip
+    sip_4
    owslib
    six
  ];
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@ -18,13 +18,13 @@ in

 stdenv.mkDerivation rec {
  pname = "imagemagick";
-  version = "7.0.11-8";
+  version = "7.0.11-9";

  src = fetchFromGitHub {
    owner = "ImageMagick";
    repo = "ImageMagick";
    rev = version;
-    sha256 = "sha256-h9hoFXnxuLVQRVtEh83P7efz2KFLLqOXKD6nVJEhqiM=";
+    sha256 = "sha256-eL9zFrgkLb3pS8/UlQB5+p50UG8j3Q7TNDwcO/3BuXo=";
  };

  outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
--- a/pkgs/applications/graphics/fbida/default.nix
+++ b/pkgs/applications/graphics/fbida/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, libjpeg, libexif, libungif, libtiff, libpng, libwebp, libdrm
+{ lib, stdenv, fetchurl, libjpeg, libexif, giflib, libtiff, libpng, libwebp, libdrm
 , pkg-config, freetype, fontconfig, which, imagemagick, curl, sane-backends, libXpm
 , epoxy, poppler, mesa, lirc }:

@ -12,7 +12,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkg-config which ];
  buildInputs = [
-    libexif libjpeg libpng libungif freetype fontconfig libtiff libwebp
+    libexif libjpeg libpng giflib freetype fontconfig libtiff libwebp
    imagemagick curl sane-backends libdrm libXpm epoxy poppler lirc
    mesa
  ];
--- a/pkgs/applications/graphics/jpeg-archive/default.nix
+++ b/pkgs/applications/graphics/jpeg-archive/default.nix
@ -22,9 +22,10 @@ stdenv.mkDerivation {
  '';

  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
    "PREFIX=$(out)"
    "MOZJPEG_PREFIX=${mozjpeg}"
-    "LIBJPEG=${mozjpeg}/lib/libjpeg.so"
+    "LIBJPEG=${mozjpeg}/lib/libjpeg${stdenv.hostPlatform.extensions.sharedLibrary}"
  ];

  postInstall = ''
--- a/pkgs/applications/graphics/krita/default.nix
+++ b/pkgs/applications/graphics/krita/default.nix
@ -17,7 +17,7 @@ mkDerivation rec {
    sha256 = "0rwghzci2wn2jmisvnzs23yxc2z3d4dcx2qbbhcvjyi3q8ij61nl";
  };

-  nativeBuildInputs = [ cmake extra-cmake-modules python3Packages.sip makeWrapper ];
+  nativeBuildInputs = [ cmake extra-cmake-modules python3Packages.sip_4 makeWrapper ];

  buildInputs = [
    karchive kconfig kwidgetsaddons kcompletion kcoreaddons kguiaddons
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -35,7 +35,7 @@ stdenv.mkDerivation rec {

  patches = lib.optional stdenv.isDarwin ./darwin.patch;

-  nativeBuildInputs = [ cmake makeWrapper python3Packages.wrapPython ]
+  nativeBuildInputs = [ cmake makeWrapper python3Packages.wrapPython llvmPackages.llvm.dev ]
    ++ optionals cudaSupport [ addOpenGLRunpath ];
  buildInputs =
    [ boost ffmpeg gettext glew ilmbase
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@ -45,7 +45,7 @@ mkDerivation rec {
  prePatch = ''
    sed -i "s/\[tool.sip.project\]/[tool.sip.project]\nsip-include-dirs = [\"${escaped_pyqt5_dir}\/share\/sip\/PyQt5\"]/g" \
      setup/build.py
-    sed -i "s/\[tool.sip.bindings.pictureflow\]/[tool.sip.bindings.pictureflow]\ntags = [\"${python3Packages.sip_5.platform_tag}\"]/g" \
+    sed -i "s/\[tool.sip.bindings.pictureflow\]/[tool.sip.bindings.pictureflow]\ntags = [\"${python3Packages.sip.platform_tag}\"]/g" \
      setup/build.py

    # Remove unneeded files and libs
@ -95,7 +95,7 @@ mkDerivation rec {
      pyqtwebengine
      python
      regex
-      sip_5
+      sip
      zeroconf
      # the following are distributed with calibre, but we use upstream instead
      odfpy
--- a/pkgs/applications/misc/clipcat/default.nix
+++ b/pkgs/applications/misc/clipcat/default.nix
@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {

  cargoSha256 = "1ffgvhkdj8wkhlgi0cj0njdm9ycxq2qda4b5qn8bmaygzr2zkwpd";

-  LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
+  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";

  # needed for internal protobuf c wrapper library
  PROTOC = "${protobuf}/bin/protoc";
--- a/pkgs/applications/misc/cointop/default.nix
+++ b/pkgs/applications/misc/cointop/default.nix
@ -2,13 +2,13 @@

 buildGoPackage rec {
  pname = "cointop";
-  version = "1.6.3";
+  version = "1.6.5";

  src = fetchFromGitHub {
    owner = "miguelmota";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-h4102oWYSuY4uq/Pyo9u25Pdsai7AK2W9yUmS/zdjrw=";
+    sha256 = "sha256-pnh4z7vk8xazdBPNbwR5BrKFbi8df8UTM2SOU+KDvsk=";
  };

  goPackagePath = "github.com/miguelmota/cointop";
--- a/pkgs/applications/misc/corectrl/default.nix
+++ b/pkgs/applications/misc/corectrl/default.nix
@ -5,6 +5,7 @@
 , karchive
 , kauth
 , libdrm
+, hwdata
 , mesa-demos
 , procps
 , util-linux
@ -20,13 +21,13 @@

 stdenv.mkDerivation rec{
  pname = "corectrl";
-  version = "1.1.2";
+  version = "1.1.3";

  src = fetchFromGitLab {
    owner = "corectrl";
    repo = "corectrl";
    rev = "v${version}";
-    sha256 = "sha256-hKYZkKQOvNu2qDSOq1cjoiLwwOvEqdJfqGG5p3Vhkhs=";
+    sha256 = "sha256-xRyc7FYzG8MnhQ8DjIUHYLeUZCZQdi4j1v1fG7F0+G8=";
  };

  nativeBuildInputs = [
@ -50,7 +51,9 @@ stdenv.mkDerivation rec{
    qtxmlpatterns
  ];

-  runtimeDeps = [ mesa-demos vulkan-tools ];
+  cmakeFlags = [ "-DWITH_PCI_IDS_PATH=${hwdata}/share/hwdata/pci.ids" ];
+
+  runtimeDeps = [ hwdata mesa-demos vulkan-tools ];
  binPath = lib.makeBinPath runtimeDeps;

  dontWrapQtApps = true;
--- a/pkgs/applications/misc/cura/lulzbot/default.nix
+++ b/pkgs/applications/misc/cura/lulzbot/default.nix
@ -10,10 +10,10 @@ let
  };

  libarcusLulzbot = callPackage ./libarcus.nix {
-    inherit (python3.pkgs) buildPythonPackage sip pythonOlder;
+    inherit (python3.pkgs) buildPythonPackage sip_4 pythonOlder;
  };
  libsavitarLulzbot = callPackage ./libsavitar.nix {
-    inherit (python3.pkgs) buildPythonPackage sip pythonOlder;
+    inherit (python3.pkgs) buildPythonPackage sip_4 pythonOlder;
  };

  inherit (python3.pkgs) buildPythonPackage pyqt5 numpy scipy shapely pythonOlder;
--- a/pkgs/applications/misc/cura/lulzbot/libarcus.nix
+++ b/pkgs/applications/misc/cura/lulzbot/libarcus.nix
@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchgit, fetchurl, cmake, sip, protobuf, pythonOlder }:
+{ lib, buildPythonPackage, fetchgit, fetchurl, cmake, sip_4, protobuf, pythonOlder }:

 buildPythonPackage {
  pname = "libarcus";
@ -13,7 +13,7 @@ buildPythonPackage {

  disabled = pythonOlder "3.4.0";

-  propagatedBuildInputs = [ sip ];
+  propagatedBuildInputs = [ sip_4 ];
  nativeBuildInputs = [ cmake ];
  buildInputs = [ protobuf ];

--- a/pkgs/applications/misc/cura/lulzbot/libsavitar.nix
+++ b/pkgs/applications/misc/cura/lulzbot/libsavitar.nix
@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, pythonOlder, fetchgit, cmake, sip }:
+{ lib, buildPythonPackage, pythonOlder, fetchgit, cmake, sip_4 }:

 buildPythonPackage {
  pname = "libsavitar-lulzbot";
@ -19,7 +19,7 @@ buildPythonPackage {

  nativeBuildInputs = [ cmake ];

-  propagatedBuildInputs = [ sip ];
+  propagatedBuildInputs = [ sip_4 ];

  disabled = pythonOlder "3.4.0";

--- a/pkgs/applications/misc/imag/default.nix
+++ b/pkgs/applications/misc/imag/default.nix
@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
    ++ lib.optional stdenv.isDarwin Security;
  checkInputs = [ gitMinimal util-linuxMinimal ];

-  LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
+  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";

  cargoSha256 = "0n8cw70qh8g4hfwfaxwwxbrrx5hm2z037z8kdhvdpqkxljl9189x";

--- a/pkgs/applications/misc/openlp/lib.nix
+++ b/pkgs/applications/misc/openlp/lib.nix
@ -5,7 +5,7 @@
 # python deps
 , python, buildPythonPackage
 , alembic, beautifulsoup4, chardet, lxml, Mako, pyenchant
-, pyqt5_with_qtwebkit, pyxdg, sip, sqlalchemy, sqlalchemy_migrate
+, pyqt5_with_qtwebkit, pyxdg, sip_4, sqlalchemy, sqlalchemy_migrate
 }:

 buildPythonPackage rec {
@ -41,7 +41,7 @@ buildPythonPackage rec {
    pyenchant
    pyqt5_with_qtwebkit
    pyxdg
-    sip
+    sip_4
    sqlalchemy
    sqlalchemy_migrate
  ];
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -248,8 +248,8 @@ buildStdenv.mkDerivation ({
      $(< ${buildStdenv.cc}/nix-support/libc-cflags) \
      $(< ${buildStdenv.cc}/nix-support/cc-cflags) \
      $(< ${buildStdenv.cc}/nix-support/libcxx-cxxflags) \
-      ${lib.optionalString buildStdenv.cc.isClang "-idirafter ${buildStdenv.cc.cc}/lib/clang/${lib.getVersion buildStdenv.cc.cc}/include"} \
-      ${lib.optionalString buildStdenv.cc.isGNU "-isystem ${buildStdenv.cc.cc}/include/c++/${lib.getVersion buildStdenv.cc.cc} -isystem ${buildStdenv.cc.cc}/include/c++/${lib.getVersion buildStdenv.cc.cc}/${buildStdenv.hostPlatform.config}"} \
+      ${lib.optionalString buildStdenv.cc.isClang "-idirafter ${buildStdenv.cc.cc.lib}/lib/clang/${lib.getVersion buildStdenv.cc.cc}/include"} \
+      ${lib.optionalString buildStdenv.cc.isGNU "-isystem ${lib.getDev buildStdenv.cc.cc}/include/c++/${lib.getVersion buildStdenv.cc.cc} -isystem ${buildStdenv.cc.cc}/include/c++/${lib.getVersion buildStdenv.cc.cc}/${buildStdenv.hostPlatform.config}"} \
      $NIX_CFLAGS_COMPILE"

    echo "ac_add_options BINDGEN_CFLAGS='$BINDGEN_CFLAGS'" >> $MOZCONFIG
@ -282,7 +282,7 @@ buildStdenv.mkDerivation ({
    "--disable-updater"
    "--enable-jemalloc"
    "--enable-default-toolkit=${default-toolkit}"
-    "--with-libclang-path=${llvmPackages.libclang}/lib"
+    "--with-libclang-path=${llvmPackages.libclang.lib}/lib"
    "--with-system-nspr"
    "--with-system-nss"
  ]
--- a/pkgs/applications/networking/cluster/k9s/default.nix
+++ b/pkgs/applications/networking/cluster/k9s/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "k9s";
-  version = "0.24.6";
+  version = "0.24.8";

  src = fetchFromGitHub {
    owner  = "derailed";
    repo   = "k9s";
    rev    = "v${version}";
-    sha256 = "sha256-uqtjAvtsF+4cz3M60Xj9sCNotaoPzaeeTKnXQUB4CIo=";
+    sha256 = "sha256-6RGm2uiYvsdpWdhNwDTw4z1O6uNErkWTuyOiwKIvXOY=";
  };

  buildFlagsArray = ''
@ -18,7 +18,7 @@ buildGoModule rec {
      -X github.com/derailed/k9s/cmd.commit=${src.rev}
  '';

-  vendorSha256 = "sha256-/4Aof09MYHPc4VJJV2EyB7T9zNFtYY4JeDGJi67FQic=";
+  vendorSha256 = "sha256-lzxGTubm+qQes5QKaamfmSkXs4qquHHjIhts8YmKlYI=";

  doCheck = false;

--- a/pkgs/applications/networking/cluster/kube3d/default.nix
+++ b/pkgs/applications/networking/cluster/kube3d/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kube3d";
-  version = "4.4.2";
+  version = "4.4.3";

  src = fetchFromGitHub {
    owner = "rancher";
    repo = "k3d";
    rev = "v${version}";
-    sha256 = "sha256-6BDetNPWyAVZOsnCWs90HljVpfUlAytFDPQ/SqPxwgg=";
+    sha256 = "sha256-G8oaJtfsbSi5WaJobxUpNu9DchHfzbkpPvq23GYM99s=";
  };

  vendorSha256 = null;
--- a/pkgs/applications/networking/gns3/gui.nix
+++ b/pkgs/applications/networking/gns3/gui.nix
@ -24,7 +24,7 @@ in python.pkgs.buildPythonPackage rec {
  propagatedBuildInputs = with python.pkgs; [
    sentry-sdk psutil jsonschema # tox for check
    # Runtime dependencies
-    sip (pyqt5.override { withWebSockets = true; }) distro setuptools
+    sip_4 (pyqt5.override { withWebSockets = true; }) distro setuptools
  ];

  doCheck = false; # Failing
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/68.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/68.nix
@ -1,184 +0,0 @@
-# This pakcage is keeped until Thunderbird 78 supports OpenPGP.
-# https://www.thunderbird.net/en-US/thunderbird/78.0.1/releasenotes/
-{ lib, stdenv, fetchurl, config, makeWrapper
-, alsaLib
-, at-spi2-atk
-, atk
-, cairo
-, cups
-, curl
-, dbus-glib
-, dbus
-, fontconfig
-, freetype
-, gdk-pixbuf
-, glib
-, glibc
-, gtk2
-, gtk3
-, libkrb5
-, libX11
-, libXScrnSaver
-, libXcomposite
-, libXcursor
-, libXdamage
-, libXext
-, libXfixes
-, libXi
-, libXinerama
-, libXrender
-, libXt
-, libxcb
-, libcanberra
-, gnome
-, libGLU, libGL
-, nspr
-, nss
-, pango
-, writeScript
-, xidel
-, coreutils
-, gnused
-, gnugrep
-, gnupg
-, runtimeShell
-}:
-
-# imports `version` and `sources`
-with (import ./68_sources.nix);
-
-let
-  arch = if stdenv.hostPlatform.system == "i686-linux"
-    then "linux-i686"
-    else "linux-x86_64";
-
-  isPrefixOf = prefix: string:
-    builtins.substring 0 (builtins.stringLength prefix) string == prefix;
-
-  sourceMatches = locale: source:
-      (isPrefixOf source.locale locale) && source.arch == arch;
-
-  systemLocale = config.i18n.defaultLocale or "en-US";
-
-  defaultSource = lib.findFirst (sourceMatches "en-US") {} sources;
-
-  source = lib.findFirst (sourceMatches systemLocale) defaultSource sources;
-
-  name = "thunderbird-bin-${version}";
-in
-
-stdenv.mkDerivation {
-  inherit name;
-
-  src = fetchurl {
-    url = "https://download-installer.cdn.mozilla.net/pub/thunderbird/releases/${version}/${source.arch}/${source.locale}/thunderbird-${version}.tar.bz2";
-    inherit (source) sha256;
-  };
-
-  phases = "unpackPhase installPhase";
-
-  libPath = lib.makeLibraryPath
-    [ stdenv.cc.cc
-      alsaLib
-      at-spi2-atk
-      atk
-      cairo
-      cups
-      curl
-      dbus-glib
-      dbus
-      fontconfig
-      freetype
-      gdk-pixbuf
-      glib
-      glibc
-      gtk2
-      gtk3
-      libkrb5
-      libX11
-      libXScrnSaver
-      libXcomposite
-      libXcursor
-      libXdamage
-      libXext
-      libXfixes
-      libXi
-      libXinerama
-      libXrender
-      libXt
-      libxcb
-      libcanberra
-      libGLU libGL
-      nspr
-      nss
-      pango
-    ] + ":" + lib.makeSearchPathOutput "lib" "lib64" [
-      stdenv.cc.cc
-    ];
-
-  buildInputs = [ gtk3 gnome.adwaita-icon-theme ];
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase =
-    ''
-      mkdir -p "$prefix/usr/lib/thunderbird-bin-${version}"
-      cp -r * "$prefix/usr/lib/thunderbird-bin-${version}"
-
-      mkdir -p "$out/bin"
-      ln -s "$prefix/usr/lib/thunderbird-bin-${version}/thunderbird" "$out/bin/"
-
-      for executable in \
-        thunderbird crashreporter thunderbird-bin plugin-container updater
-      do
-        patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-          "$out/usr/lib/thunderbird-bin-${version}/$executable"
-      done
-
-      find . -executable -type f -exec \
-        patchelf --set-rpath "$libPath" \
-          "$out/usr/lib/thunderbird-bin-${version}/{}" \;
-
-      # Create a desktop item.
-      mkdir -p $out/share/applications
-      cat > $out/share/applications/thunderbird.desktop <<EOF
-      [Desktop Entry]
-      Type=Application
-      Exec=$out/bin/thunderbird
-      Icon=$out/usr/lib/thunderbird-bin-${version}/chrome/icons/default/default256.png
-      Name=Thunderbird
-      GenericName=Mail Reader
-      Categories=Application;Network;
-      EOF
-
-      # SNAP_NAME: https://github.com/NixOS/nixpkgs/pull/61980
-      # MOZ_LEGACY_PROFILES and MOZ_ALLOW_DOWNGRADE:
-      #   commit 87e261843c4236c541ee0113988286f77d2fa1ee
-      wrapProgram "$out/bin/thunderbird" \
-        --argv0 "$out/bin/.thunderbird-wrapped" \
-        --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH:" \
-        --suffix XDG_DATA_DIRS : "$XDG_ICON_DIRS" \
-        --set SNAP_NAME "thunderbird" \
-        --set MOZ_LEGACY_PROFILES 1 \
-        --set MOZ_ALLOW_DOWNGRADE 1
-    '';
-
-  passthru.updateScript = import ./../../browsers/firefox-bin/update.nix {
-    inherit name writeScript xidel coreutils gnused gnugrep curl gnupg runtimeShell;
-    baseName = "thunderbird";
-    channel = "release";
-    basePath = "pkgs/applications/networking/mailreaders/thunderbird-bin";
-    baseUrl = "http://archive.mozilla.org/pub/thunderbird/releases/";
-  };
-  meta = with lib; {
-    description = "Mozilla Thunderbird, a full-featured email client (binary package)";
-    homepage = "http://www.mozilla.org/thunderbird/";
-    license = {
-      free = false;
-      url = "http://www.mozilla.org/en-US/foundation/trademarks/policy/";
-    };
-    maintainers = with lib.maintainers; [ ];
-    platforms = platforms.linux;
-    knownVulnerabilities = [ "Support ended around Semptember 2020." ];
-  };
-}
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/68_sources.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/68_sources.nix
@ -1,615 +0,0 @@
-{
-  version = "68.12.0";
-  sources = [
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/ar/thunderbird-68.12.0.tar.bz2";
-      locale = "ar";
-      arch = "linux-x86_64";
-      sha256 = "70cfb9e6a7a1f285f37a8f13c9a010237e6aabf815b77a12f54ee0deedd36400";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/ast/thunderbird-68.12.0.tar.bz2";
-      locale = "ast";
-      arch = "linux-x86_64";
-      sha256 = "5645657f20d37ffdb11f383f164f03c66ed2024244849b09bfa60075d5d07490";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/be/thunderbird-68.12.0.tar.bz2";
-      locale = "be";
-      arch = "linux-x86_64";
-      sha256 = "d38cdcc2ba4534c23a1bb42b93f271623c497f48e1d255a23bf12a368ff339bd";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/bg/thunderbird-68.12.0.tar.bz2";
-      locale = "bg";
-      arch = "linux-x86_64";
-      sha256 = "c8883242683dec57f9db502d96d2036ec46753f474a33c0f1ae31f97f2c3113c";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/br/thunderbird-68.12.0.tar.bz2";
-      locale = "br";
-      arch = "linux-x86_64";
-      sha256 = "cfb669e2378f97689a14f23e2c55ef4987e2508695eb195be3af75ed1d648345";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/ca/thunderbird-68.12.0.tar.bz2";
-      locale = "ca";
-      arch = "linux-x86_64";
-      sha256 = "9ae4b43e0d5d9edd83291f0be7d53d07e5c84f1d0ad4348654136543b7b53a54";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/cak/thunderbird-68.12.0.tar.bz2";
-      locale = "cak";
-      arch = "linux-x86_64";
-      sha256 = "d6d635a15b913679ed943c3501dd03140d099ff36b48c8731a47eacda1b5232b";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/cs/thunderbird-68.12.0.tar.bz2";
-      locale = "cs";
-      arch = "linux-x86_64";
-      sha256 = "616fbf24e36d63ce3cbc957d69b8972d517524c613a22bedcf5b57534f9a9a41";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/cy/thunderbird-68.12.0.tar.bz2";
-      locale = "cy";
-      arch = "linux-x86_64";
-      sha256 = "548c51228d2f3003bb94e1bee91cea0d2edb95bd0f86ee4259c8daef90a2dca8";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/da/thunderbird-68.12.0.tar.bz2";
-      locale = "da";
-      arch = "linux-x86_64";
-      sha256 = "ad0e4b7a693d881b8875a5b8cc3e607a3883df759278129f0933522b9a6acd24";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/de/thunderbird-68.12.0.tar.bz2";
-      locale = "de";
-      arch = "linux-x86_64";
-      sha256 = "bf9b70b345ffe5df03365d819c5abc3339ed3af4d8a716cdfe7099134864a9b4";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/dsb/thunderbird-68.12.0.tar.bz2";
-      locale = "dsb";
-      arch = "linux-x86_64";
-      sha256 = "a2cd7ffb0e8b4c3d1715c18e636d0dcd5efa245200d6d0f14048fc4b399b8121";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/el/thunderbird-68.12.0.tar.bz2";
-      locale = "el";
-      arch = "linux-x86_64";
-      sha256 = "07836ce122936848e26cd5a1522967760bee67654582076c53e4ec183cc4c40e";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/en-GB/thunderbird-68.12.0.tar.bz2";
-      locale = "en-GB";
-      arch = "linux-x86_64";
-      sha256 = "c89fa35af79eca3cc26b492c602a3f8af0dbaf6ce4ee3af93d93f10daf4e9d6e";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/en-US/thunderbird-68.12.0.tar.bz2";
-      locale = "en-US";
-      arch = "linux-x86_64";
-      sha256 = "6eeea0de838909f91da7270e42ae1513d2b801f412fc758f2f8c682d260a7c24";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/es-AR/thunderbird-68.12.0.tar.bz2";
-      locale = "es-AR";
-      arch = "linux-x86_64";
-      sha256 = "e9d84032a91f7feb2db3d22a500c564f273c2b637f97aaab2edf3209b93dda1d";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/es-ES/thunderbird-68.12.0.tar.bz2";
-      locale = "es-ES";
-      arch = "linux-x86_64";
-      sha256 = "a986e8a48b59354421193f2dd01e3c291fb6c98031af43531e723dc217a43d4a";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/et/thunderbird-68.12.0.tar.bz2";
-      locale = "et";
-      arch = "linux-x86_64";
-      sha256 = "2f7508e83aba4fd64a817c7eb4b44d4ea9371956339a009ba541bf3a349693cf";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/eu/thunderbird-68.12.0.tar.bz2";
-      locale = "eu";
-      arch = "linux-x86_64";
-      sha256 = "edbc5ff4ba45106233cdbf5255405c4ee52ba7e6811736958323a616881b943f";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/fi/thunderbird-68.12.0.tar.bz2";
-      locale = "fi";
-      arch = "linux-x86_64";
-      sha256 = "f4ad740a724efdbfec54445304ca75e9a16e0881bc18789b8ea35632d8857d4b";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/fr/thunderbird-68.12.0.tar.bz2";
-      locale = "fr";
-      arch = "linux-x86_64";
-      sha256 = "ebf60a227c9fe5237eff22fb81f3c8bc02a593de823d6f0ad9b67f07af129dea";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/fy-NL/thunderbird-68.12.0.tar.bz2";
-      locale = "fy-NL";
-      arch = "linux-x86_64";
-      sha256 = "b12983077a62c5bf7353f50dd951348a457ce07f5beb2a579f199c4d77ed0906";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/ga-IE/thunderbird-68.12.0.tar.bz2";
-      locale = "ga-IE";
-      arch = "linux-x86_64";
-      sha256 = "aa7c3a4b54fd6fef0f120a6748c45a3f379268f31e087cb3df07d270bf060bad";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/gd/thunderbird-68.12.0.tar.bz2";
-      locale = "gd";
-      arch = "linux-x86_64";
-      sha256 = "39fadb2bd4c01da0eb188cb9f52ccd726ec9f7eb5ced44e2a30ee0cfac2527bf";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/gl/thunderbird-68.12.0.tar.bz2";
-      locale = "gl";
-      arch = "linux-x86_64";
-      sha256 = "b4ee1f89b0326b22fc7a5b980b857c2652d6881d096060a8bc083015b47762d8";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/he/thunderbird-68.12.0.tar.bz2";
-      locale = "he";
-      arch = "linux-x86_64";
-      sha256 = "cefbc742672942e310dc9f4dbcefc8b66cf01d58ac64448ac8c0dc33fdace5ae";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/hr/thunderbird-68.12.0.tar.bz2";
-      locale = "hr";
-      arch = "linux-x86_64";
-      sha256 = "9e132811cb6bd98faee86e298b78e845727bfded84c0cdab41608ed1565f1aee";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/hsb/thunderbird-68.12.0.tar.bz2";
-      locale = "hsb";
-      arch = "linux-x86_64";
-      sha256 = "2a41d1e188fd5fed93a37a1bedc67cb745367447504a76836f79928194730d3b";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/hu/thunderbird-68.12.0.tar.bz2";
-      locale = "hu";
-      arch = "linux-x86_64";
-      sha256 = "9196df7850b9cff69f52b5db69ec3b64cfa312bba5669380c137b95a8140cf39";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/hy-AM/thunderbird-68.12.0.tar.bz2";
-      locale = "hy-AM";
-      arch = "linux-x86_64";
-      sha256 = "4a08137a9a714677ecf86a24f165047b809e22eff50d196b92c153e59f943c30";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/id/thunderbird-68.12.0.tar.bz2";
-      locale = "id";
-      arch = "linux-x86_64";
-      sha256 = "39784aab0bc3253af47cdcd95824eccdecae4dac819bacf6a04daa7b5c86d6e3";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/is/thunderbird-68.12.0.tar.bz2";
-      locale = "is";
-      arch = "linux-x86_64";
-      sha256 = "a041d1af23e9c64967e4d014b6a84ddc80ad24e852146e448f6b380cdd672e67";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/it/thunderbird-68.12.0.tar.bz2";
-      locale = "it";
-      arch = "linux-x86_64";
-      sha256 = "b0e3161c801fbaee2f589b1bc61a4fba9968f5f363a62cf0f8af855d23e4782c";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/ja/thunderbird-68.12.0.tar.bz2";
-      locale = "ja";
-      arch = "linux-x86_64";
-      sha256 = "ad416d47930d81be9ac2f20b3699f4c74471c36e08b14f9d5c6ee1af97c7c9d4";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/ka/thunderbird-68.12.0.tar.bz2";
-      locale = "ka";
-      arch = "linux-x86_64";
-      sha256 = "3b30bc5f0971310d71e1909b4ed891481457ac8baf11c1e505c3400b2a7cfb63";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/kab/thunderbird-68.12.0.tar.bz2";
-      locale = "kab";
-      arch = "linux-x86_64";
-      sha256 = "abdc58d5d5ef251e63c0c40a48460f90e299a4420cbe4e290d519fbed4c335b8";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/kk/thunderbird-68.12.0.tar.bz2";
-      locale = "kk";
-      arch = "linux-x86_64";
-      sha256 = "08018b951de59b1a92717fc82bd98a0c324a019ee0ae14888f09c5351a586284";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/ko/thunderbird-68.12.0.tar.bz2";
-      locale = "ko";
-      arch = "linux-x86_64";
-      sha256 = "1178adc42b3a2ddac46dd50ad8436d1be50db409963e8fac3beb22a431f885fe";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/lt/thunderbird-68.12.0.tar.bz2";
-      locale = "lt";
-      arch = "linux-x86_64";
-      sha256 = "18d88a8cbb24d2a78af0de282187a743e707136fdb61912e5f64bf75730e3a76";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/ms/thunderbird-68.12.0.tar.bz2";
-      locale = "ms";
-      arch = "linux-x86_64";
-      sha256 = "e1754cfbf20e286fd6304b8d75337e3794893c5ebd9b242cf624090e6fc6e9ee";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/nb-NO/thunderbird-68.12.0.tar.bz2";
-      locale = "nb-NO";
-      arch = "linux-x86_64";
-      sha256 = "6379f6dca3d8bacb466044f0a7d11b32eb61166d3f14c37431f77843eb884c90";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/nl/thunderbird-68.12.0.tar.bz2";
-      locale = "nl";
-      arch = "linux-x86_64";
-      sha256 = "66a56e218365bb260980848427609d390674e2ba3c70b9adc4121f73c861d9b8";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/nn-NO/thunderbird-68.12.0.tar.bz2";
-      locale = "nn-NO";
-      arch = "linux-x86_64";
-      sha256 = "ccdb135d43f5542151fe2c99a8e13cebfbc032367abb0308213433b753dc8125";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/pl/thunderbird-68.12.0.tar.bz2";
-      locale = "pl";
-      arch = "linux-x86_64";
-      sha256 = "5dc2151d1bb956c4b6fbd1b6185d9328f7091e60fdcd51bad5a9ebaa8fcbb7d7";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/pt-BR/thunderbird-68.12.0.tar.bz2";
-      locale = "pt-BR";
-      arch = "linux-x86_64";
-      sha256 = "5ebf77d47bf45b058aaeca857060c908dbf7036bae2c2c5812ff145aed840203";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/pt-PT/thunderbird-68.12.0.tar.bz2";
-      locale = "pt-PT";
-      arch = "linux-x86_64";
-      sha256 = "73baa68f79b4a15795fc426dfc9a8d573a05e4ab8a663d122cfd802f93941825";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/rm/thunderbird-68.12.0.tar.bz2";
-      locale = "rm";
-      arch = "linux-x86_64";
-      sha256 = "29f8ba57d9000803bae795c2ff977347af9a1f0df123337eaab3bdcc20786734";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/ro/thunderbird-68.12.0.tar.bz2";
-      locale = "ro";
-      arch = "linux-x86_64";
-      sha256 = "b8233ad81c6620c26a02457b9235ce0be0c5d93b81f88d9ddc84bc12f869dbad";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/ru/thunderbird-68.12.0.tar.bz2";
-      locale = "ru";
-      arch = "linux-x86_64";
-      sha256 = "f959f786dbbb7d06cb33eca24efd9e2763c5ca73fc4ba47e9b933b6298d7f026";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/si/thunderbird-68.12.0.tar.bz2";
-      locale = "si";
-      arch = "linux-x86_64";
-      sha256 = "dcf59c0c1ea0acdcc894463b04c54339a72dcceb25fe5478608265eb3ead226a";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/sk/thunderbird-68.12.0.tar.bz2";
-      locale = "sk";
-      arch = "linux-x86_64";
-      sha256 = "2a06329fd4a9dd6333e2d73a44fca7eaf593032e8ace33736a03dbfffb2920a0";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/sl/thunderbird-68.12.0.tar.bz2";
-      locale = "sl";
-      arch = "linux-x86_64";
-      sha256 = "f7bd3e3a407dbab07836342ff29fc143fe3904e7f878ea719522ade3fc4f6b84";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/sq/thunderbird-68.12.0.tar.bz2";
-      locale = "sq";
-      arch = "linux-x86_64";
-      sha256 = "0edc58751a6794494efab8b0a2ce852374a747ccb73b38455475f0099ea0f238";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/sr/thunderbird-68.12.0.tar.bz2";
-      locale = "sr";
-      arch = "linux-x86_64";
-      sha256 = "91ac5cc0646c062b00b3b064af53ba03c7e034b75afa13dca7586eb80578d377";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/sv-SE/thunderbird-68.12.0.tar.bz2";
-      locale = "sv-SE";
-      arch = "linux-x86_64";
-      sha256 = "5aa21e4b78f4294835197f784a651f17453d83fce98e7140e49c6da117464fd9";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/tr/thunderbird-68.12.0.tar.bz2";
-      locale = "tr";
-      arch = "linux-x86_64";
-      sha256 = "3ab2639dd126e3ed9b031fc10f4396c7d98ffa7b7ffca6a9b3f2f47590e3b83c";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/uk/thunderbird-68.12.0.tar.bz2";
-      locale = "uk";
-      arch = "linux-x86_64";
-      sha256 = "59be2ddc7c65405e0b3854c2a551dab73df9736842ee362b2a20dc9088242a96";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/uz/thunderbird-68.12.0.tar.bz2";
-      locale = "uz";
-      arch = "linux-x86_64";
-      sha256 = "ae196683b283525511fbd2e3ad428339672f2f1339566a323e01f6f649d333c1";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/vi/thunderbird-68.12.0.tar.bz2";
-      locale = "vi";
-      arch = "linux-x86_64";
-      sha256 = "9d66b8e4eefbb6b8c0d9893b056fc684310ae583921d626cb676cd8a7b4b39de";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/zh-CN/thunderbird-68.12.0.tar.bz2";
-      locale = "zh-CN";
-      arch = "linux-x86_64";
-      sha256 = "2839f2f076a8a6e283a3ffdd6100986a11d19b9108fce074f8e7f127cb0f375e";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-x86_64/zh-TW/thunderbird-68.12.0.tar.bz2";
-      locale = "zh-TW";
-      arch = "linux-x86_64";
-      sha256 = "02ef645a7de8abc1c5dd92eb685d64570cf1db971cfe7e248111d6a17b3ddcd9";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/ar/thunderbird-68.12.0.tar.bz2";
-      locale = "ar";
-      arch = "linux-i686";
-      sha256 = "5c4d899245a38626fa18d849bcf01d50125dee60d715d76224ca0bb4623f73be";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/ast/thunderbird-68.12.0.tar.bz2";
-      locale = "ast";
-      arch = "linux-i686";
-      sha256 = "f657bdc5b43b75e43578251abccf5c7b9e6d0848fd55c6105060daba33c36721";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/be/thunderbird-68.12.0.tar.bz2";
-      locale = "be";
-      arch = "linux-i686";
-      sha256 = "669a2cbfe600727b9d9a8ed5046272a1f19b80b6af9a6a6977ce1b89f60fa36e";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/bg/thunderbird-68.12.0.tar.bz2";
-      locale = "bg";
-      arch = "linux-i686";
-      sha256 = "e1b33857544c10c0191316f6e3d16b34957196b35a922c884315714fe851389b";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/br/thunderbird-68.12.0.tar.bz2";
-      locale = "br";
-      arch = "linux-i686";
-      sha256 = "b9e4a530529449446fe5a302277878c4d2192ef7bb48206f8528024087f520ea";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/ca/thunderbird-68.12.0.tar.bz2";
-      locale = "ca";
-      arch = "linux-i686";
-      sha256 = "aa5e4ae20fa9e5dbb8c0ba275ba18d1ba94900094ba3186aac40ffb27396a96f";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/cak/thunderbird-68.12.0.tar.bz2";
-      locale = "cak";
-      arch = "linux-i686";
-      sha256 = "a812c9150feec48e2ebfb1786f5e30ade33203160fa4102382435641caeaf3b8";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/cs/thunderbird-68.12.0.tar.bz2";
-      locale = "cs";
-      arch = "linux-i686";
-      sha256 = "75813ad7dd0ae5c073964296dd687e5c1289178491adc98d40e853ed812bdca9";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/cy/thunderbird-68.12.0.tar.bz2";
-      locale = "cy";
-      arch = "linux-i686";
-      sha256 = "b3894f05cf905aa96612860dcef0bdb4bb9564901ef84172e11856a9fa9e0ca4";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/da/thunderbird-68.12.0.tar.bz2";
-      locale = "da";
-      arch = "linux-i686";
-      sha256 = "a4f21bd2017043872a962167f98db358b824ae1821fcf03e2df1bef7783e07c0";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/de/thunderbird-68.12.0.tar.bz2";
-      locale = "de";
-      arch = "linux-i686";
-      sha256 = "3a079685f75d2ec0320ec9e366b4e037954d67fa3f9e3bda055b8cd7de8fbdd0";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/dsb/thunderbird-68.12.0.tar.bz2";
-      locale = "dsb";
-      arch = "linux-i686";
-      sha256 = "295a0f56429b3638dd0dcbf8d97a6376636b67e22d493ce8dfaceeb579466d18";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/el/thunderbird-68.12.0.tar.bz2";
-      locale = "el";
-      arch = "linux-i686";
-      sha256 = "86e4b98ede80cc07cc1aec043af82068a73b7c76820f70df8314e3b91c108d18";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/en-GB/thunderbird-68.12.0.tar.bz2";
-      locale = "en-GB";
-      arch = "linux-i686";
-      sha256 = "2cb03a17f88e3826181911ec6a7455528d1e4c051b065252c964c6c0794175e4";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/en-US/thunderbird-68.12.0.tar.bz2";
-      locale = "en-US";
-      arch = "linux-i686";
-      sha256 = "11fe953ede0d99656534ac676f118e939024744c5301d378acbeac6792e668e5";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/es-AR/thunderbird-68.12.0.tar.bz2";
-      locale = "es-AR";
-      arch = "linux-i686";
-      sha256 = "596264396a25adb873320222697e7f1a58aaab484de9c0d2e85f99962b6d893d";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/es-ES/thunderbird-68.12.0.tar.bz2";
-      locale = "es-ES";
-      arch = "linux-i686";
-      sha256 = "a9512af30e2b1613a6bd1ae6f4ce785f676b2cf70b80a37d85a5e1566bb2b35f";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/et/thunderbird-68.12.0.tar.bz2";
-      locale = "et";
-      arch = "linux-i686";
-      sha256 = "b7dcb196881a23e979edb5ae247a7c07b1cf1250cb4c159ce523d1a26be188c2";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/eu/thunderbird-68.12.0.tar.bz2";
-      locale = "eu";
-      arch = "linux-i686";
-      sha256 = "4066164b4c9242a9885bc2de802c4f5b6b594c928db36ac72c94faabaad86679";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/fi/thunderbird-68.12.0.tar.bz2";
-      locale = "fi";
-      arch = "linux-i686";
-      sha256 = "a7c635cbbbc10725b28052ccc61603fb60b91e06bbf1f240561bdb8f941af55a";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/fr/thunderbird-68.12.0.tar.bz2";
-      locale = "fr";
-      arch = "linux-i686";
-      sha256 = "7dba28adb1287e1aa9ae85840fc3aca42aaedd4b2c2aa6cc68d5f793549d19b7";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/fy-NL/thunderbird-68.12.0.tar.bz2";
-      locale = "fy-NL";
-      arch = "linux-i686";
-      sha256 = "bd763e264eb684ec3b0b1f2c68ce295d1df86994d15f5c66c487e4742bfef86e";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/ga-IE/thunderbird-68.12.0.tar.bz2";
-      locale = "ga-IE";
-      arch = "linux-i686";
-      sha256 = "52f9b5694efbdd8ecc76aef58695423c6a4b547b5b0cfedca313386b7500685e";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/gd/thunderbird-68.12.0.tar.bz2";
-      locale = "gd";
-      arch = "linux-i686";
-      sha256 = "6c9c1b0f11ad13e0780371d54fedb52d2463713db3bc52adb72c8ea9ff80eb8f";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/gl/thunderbird-68.12.0.tar.bz2";
-      locale = "gl";
-      arch = "linux-i686";
-      sha256 = "608bf5c0d6148cc3014758829ba06135222b462242456ca0984e7dc12654c2cd";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/he/thunderbird-68.12.0.tar.bz2";
-      locale = "he";
-      arch = "linux-i686";
-      sha256 = "f92d569a53f34bfdda4dac185834e5692526f13f20853d1943f165af33b54a37";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/hr/thunderbird-68.12.0.tar.bz2";
-      locale = "hr";
-      arch = "linux-i686";
-      sha256 = "60d2f184219f8d17c2739ee3cc8463bed474142bd2caad74157b97db2306b27f";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/hsb/thunderbird-68.12.0.tar.bz2";
-      locale = "hsb";
-      arch = "linux-i686";
-      sha256 = "40ffece26101b2f6a7789511b026d99234bd34ec78e566e7e25065ae3201d693";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/hu/thunderbird-68.12.0.tar.bz2";
-      locale = "hu";
-      arch = "linux-i686";
-      sha256 = "e74da0bdb27fe3375dfbd1ab042892de3ded84f33a6f6d46e209fdcaa28183d0";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/hy-AM/thunderbird-68.12.0.tar.bz2";
-      locale = "hy-AM";
-      arch = "linux-i686";
-      sha256 = "fd93972c11842b56453449e72617deb3177d020c8f25cf4d5fb687f4a3ddb5c0";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/id/thunderbird-68.12.0.tar.bz2";
-      locale = "id";
-      arch = "linux-i686";
-      sha256 = "546825968ad86e4c5c6effefd0f924cc1d10489fff7968f17401e3f84c4d1ab0";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/is/thunderbird-68.12.0.tar.bz2";
-      locale = "is";
-      arch = "linux-i686";
-      sha256 = "1f2e2228c685be2d65d6e0b92eef8ff3e58d7b772f846d0707a9b02e6d0ad306";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/it/thunderbird-68.12.0.tar.bz2";
-      locale = "it";
-      arch = "linux-i686";
-      sha256 = "41b27c8195432e1412e3c4645b823b8dd1f673eabf07ddc72f3d792d3f7488da";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/ja/thunderbird-68.12.0.tar.bz2";
-      locale = "ja";
-      arch = "linux-i686";
-      sha256 = "68940d44d933bb7228d6f9a03406ca01903c54fdf57eb5a1e1033b12ef507df6";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/ka/thunderbird-68.12.0.tar.bz2";
-      locale = "ka";
-      arch = "linux-i686";
-      sha256 = "ce0aff0fd47b00803ea66278b3514dcf65ecb5547878f8081f7ec6c1f411ce10";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/kab/thunderbird-68.12.0.tar.bz2";
-      locale = "kab";
-      arch = "linux-i686";
-      sha256 = "3936b56eaa1e05a96626f7d10c8fcc3ba9014b1385b21243c049b133b923ddef";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/kk/thunderbird-68.12.0.tar.bz2";
-      locale = "kk";
-      arch = "linux-i686";
-      sha256 = "7fa0aa64d0f0dcc6f71d6a21647cc4fccef935b783deb5d19b88f5b96b4b4ec4";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/ko/thunderbird-68.12.0.tar.bz2";
-      locale = "ko";
-      arch = "linux-i686";
-      sha256 = "4bddd0ccb747bb12cdc6d88c2c9544354293000c586454bb5932f4d81afbf400";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/lt/thunderbird-68.12.0.tar.bz2";
-      locale = "lt";
-      arch = "linux-i686";
-      sha256 = "f1a3514188c1b887afd2c662a1b6abf6fe37b558864be0cc79e87ed147188461";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/ms/thunderbird-68.12.0.tar.bz2";
-      locale = "ms";
-      arch = "linux-i686";
-      sha256 = "7ea045d6db78ec7d6ebf164c8e3d28c2540a573238de518e934646573aec71dc";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/nb-NO/thunderbird-68.12.0.tar.bz2";
-      locale = "nb-NO";
-      arch = "linux-i686";
-      sha256 = "d2c0e2099ea60b9da95ebd9bd79a5d0a6a1ebc84b8b490511a68c81355f97761";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/nl/thunderbird-68.12.0.tar.bz2";
-      locale = "nl";
-      arch = "linux-i686";
-      sha256 = "48741be79422d80140ec862d004fa75a407f67490f67a3e440c01e0defe1f85f";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/nn-NO/thunderbird-68.12.0.tar.bz2";
-      locale = "nn-NO";
-      arch = "linux-i686";
-      sha256 = "b40f0d7112cadab322c8b71cacce5d6df87fb80f40cc55ca22c279016c3ea805";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/pl/thunderbird-68.12.0.tar.bz2";
-      locale = "pl";
-      arch = "linux-i686";
-      sha256 = "e64b10526cb460f437427cc4a7ea90959cc693a75fd6a61b43e9d3fd76ded618";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/pt-BR/thunderbird-68.12.0.tar.bz2";
-      locale = "pt-BR";
-      arch = "linux-i686";
-      sha256 = "bdb558f9430c06871954ec6c7d54267625184a0cba914a87ad199e8f32b03de2";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/pt-PT/thunderbird-68.12.0.tar.bz2";
-      locale = "pt-PT";
-      arch = "linux-i686";
-      sha256 = "4631e8247446653e91f239fdb5ad3c8531f3d007dbdc83818178a4cdc525edf4";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/rm/thunderbird-68.12.0.tar.bz2";
-      locale = "rm";
-      arch = "linux-i686";
-      sha256 = "13e6aca7139fd89e83e7ae9b71253731f0954b0a83cc3560ecc00500b9bc1df7";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/ro/thunderbird-68.12.0.tar.bz2";
-      locale = "ro";
-      arch = "linux-i686";
-      sha256 = "023a567c42dad9bdbd465c8b99f12cf5f667ef4691e16971e09496c4a7db0f12";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/ru/thunderbird-68.12.0.tar.bz2";
-      locale = "ru";
-      arch = "linux-i686";
-      sha256 = "9ec35bbce5f026a4262a5d708b53a767f47ac8e90314513d36a587d1a49dbb6b";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/si/thunderbird-68.12.0.tar.bz2";
-      locale = "si";
-      arch = "linux-i686";
-      sha256 = "c540b94a45deeddf1f7f5a8cca8de7e944ee8ad9f8595a308836c159901ec0b6";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/sk/thunderbird-68.12.0.tar.bz2";
-      locale = "sk";
-      arch = "linux-i686";
-      sha256 = "5296241664023773d2c0c4fa55e74eb6470482389c834d1934c252f79e79ebff";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/sl/thunderbird-68.12.0.tar.bz2";
-      locale = "sl";
-      arch = "linux-i686";
-      sha256 = "cd0376137d8018875873332fdfae3bc3c0d6b2a2b881dfa970d7d7999e8b312b";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/sq/thunderbird-68.12.0.tar.bz2";
-      locale = "sq";
-      arch = "linux-i686";
-      sha256 = "6fbf47759ca8c4d7cf30ca3af8a3fd35a01b7738422d29448cfd9eed81eba49b";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/sr/thunderbird-68.12.0.tar.bz2";
-      locale = "sr";
-      arch = "linux-i686";
-      sha256 = "636708320247c7c45622fd9179d5689da97472a9308f11810623129cf5a0e8d7";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/sv-SE/thunderbird-68.12.0.tar.bz2";
-      locale = "sv-SE";
-      arch = "linux-i686";
-      sha256 = "9550c173b047e3ff774f4c3faf2c1f125b3abc34e6feb5801c108fda94e54e4e";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/tr/thunderbird-68.12.0.tar.bz2";
-      locale = "tr";
-      arch = "linux-i686";
-      sha256 = "ffe82a300c7fa7a0e826d11613f5187c003b009efa29f4755f17af0f88d9e73b";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/uk/thunderbird-68.12.0.tar.bz2";
-      locale = "uk";
-      arch = "linux-i686";
-      sha256 = "b018769149c0a4ff323b90b5d51465733629e7c527b39381ba9696cb077ad767";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/uz/thunderbird-68.12.0.tar.bz2";
-      locale = "uz";
-      arch = "linux-i686";
-      sha256 = "b0b59ac4d08c9f385f4ed7980065ce99ef24874734390a83af6e8fbd18173d99";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/vi/thunderbird-68.12.0.tar.bz2";
-      locale = "vi";
-      arch = "linux-i686";
-      sha256 = "901b40a99d84e7c7360fd5be6a14aa04ef6cc04fe1275cac26824b310bbd26e0";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/zh-CN/thunderbird-68.12.0.tar.bz2";
-      locale = "zh-CN";
-      arch = "linux-i686";
-      sha256 = "509478710f7c4fb404eec9fed0b6d22f4c5d76fee09ed833dffcefdacc53d55c";
-    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.12.0/linux-i686/zh-TW/thunderbird-68.12.0.tar.bz2";
-      locale = "zh-TW";
-      arch = "linux-i686";
-      sha256 = "a12dd777cc3eaf629cc7a6f4b8d4744cf63c3e778e559d9b3ce332414e509515";
-    }
-    ];
-}
--- a/pkgs/applications/networking/mailreaders/thunderbird/68.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/68.nix
@ -1,343 +0,0 @@
-# This pakcage is keeped until Thunderbird 78 supports OpenPGP.
-# https://www.thunderbird.net/en-US/thunderbird/78.0.1/releasenotes/
-{ autoconf213
-, bzip2
-, cargo
-, common-updater-scripts
-, copyDesktopItems
-, coreutils
-, curl
-, dbus
-, dbus-glib
-, fetchurl
-, file
-, fontconfig
-, freetype
-, glib
-, gnugrep
-, gnused
-, icu
-, jemalloc
-, lib
-, libGL
-, libGLU
-, libevent
-, libjpeg
-, libnotify
-, libpng
-, libstartup_notification
-, libvpx
-, libwebp
-, llvmPackages
-, m4
-, makeDesktopItem
-, nasm
-, nodejs
-, nspr
-, nss
-, pango
-, perl
-, pkg-config
-, python2
-, python3
-, runtimeShell
-, rust-cbindgen
-, rustc
-, sqlite
-, stdenv
-, systemd
-, unzip
-, which
-, writeScript
-, xidel
-, xorg
-, yasm
-, zip
-, zlib
-
-, debugBuild ? false
-
-, alsaSupport ? stdenv.isLinux, alsaLib
-, pulseaudioSupport ? stdenv.isLinux, libpulseaudio
-, gtk3Support ? true, gtk2, gtk3, wrapGAppsHook
-, waylandSupport ? true
-, libxkbcommon, calendarSupport ? true
-
-# Use official trademarked branding.  Permission obtained at:
-# https://github.com/NixOS/nixpkgs/pull/94880#issuecomment-675907971
-, enableOfficialBranding ? true
-}:
-
-assert waylandSupport -> gtk3Support == true;
-
-stdenv.mkDerivation rec {
-  pname = "thunderbird";
-  version = "68.12.0";
-
-  src = fetchurl {
-    url =
-      "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-    sha512 =
-      "33350vjgzvsg6sdhdld92z75k1xcf1wmngdcvzsj4f3y3aal73pyw03mlvgg6y36bm0j8fhaxvgbbg5zm7hxhn779z78970m4v9amg7";
-  };
-
-  nativeBuildInputs = [
-    autoconf213
-    cargo
-    copyDesktopItems
-    gnused
-    llvmPackages.llvm
-    m4
-    nasm
-    nodejs
-    perl
-    pkg-config
-    python2
-    python3
-    rust-cbindgen
-    rustc
-    which
-    yasm
-    unzip
-  ] ++ lib.optional gtk3Support wrapGAppsHook;
-
-  buildInputs = [
-    bzip2
-    dbus
-    dbus-glib
-    file
-    fontconfig
-    freetype
-    glib
-    gtk2
-    icu
-    jemalloc
-    libGL
-    libGLU
-    libevent
-    libjpeg
-    libnotify
-    libpng
-    libstartup_notification
-    libvpx
-    libwebp
-    nspr
-    nss
-    pango
-    perl
-    sqlite
-    xorg.libX11
-    xorg.libXScrnSaver
-    xorg.libXcursor
-    xorg.libXext
-    xorg.libXft
-    xorg.libXi
-    xorg.libXrender
-    xorg.libXt
-    xorg.pixman
-    xorg.xorgproto
-    zip
-    zlib
-  ] ++ lib.optional alsaSupport alsaLib
-    ++ lib.optional gtk3Support gtk3
-    ++ lib.optional pulseaudioSupport libpulseaudio
-    ++ lib.optional waylandSupport libxkbcommon;
-
-  NIX_CFLAGS_COMPILE =[
-    "-I${glib.dev}/include/gio-unix-2.0"
-    "-I${nss.dev}/include/nss"
-  ];
-
-  patches = [
-    ./no-buildconfig-68.patch
-  ];
-
-  postPatch = ''
-    rm -rf obj-x86_64-pc-linux-gnu
-  '';
-
-  hardeningDisable = [ "format" ];
-
-  preConfigure = ''
-    # remove distributed configuration files
-    rm -f configure
-    rm -f js/src/configure
-    rm -f .mozconfig*
-
-    configureScript="$(realpath ./mach) configure"
-    # AS=as in the environment causes build failure https://bugzilla.mozilla.org/show_bug.cgi?id=1497286
-    unset AS
-
-    export MOZCONFIG=$(pwd)/mozconfig
-
-    # Set C flags for Rust's bindgen program. Unlike ordinary C
-    # compilation, bindgen does not invoke $CC directly. Instead it
-    # uses LLVM's libclang. To make sure all necessary flags are
-    # included we need to look in a few places.
-    # TODO: generalize this process for other use-cases.
-
-    BINDGEN_CFLAGS="$(< ${stdenv.cc}/nix-support/libc-cflags) \
-      $(< ${stdenv.cc}/nix-support/cc-cflags) \
-      $(< ${stdenv.cc}/nix-support/libcxx-cxxflags) \
-      ${
-        lib.optionalString stdenv.cc.isClang
-        "-idirafter ${stdenv.cc.cc}/lib/clang/${
-          lib.getVersion stdenv.cc.cc
-        }/include"
-      } \
-      ${
-        lib.optionalString stdenv.cc.isGNU
-        "-isystem ${stdenv.cc.cc}/include/c++/${
-          lib.getVersion stdenv.cc.cc
-        } -isystem ${stdenv.cc.cc}/include/c++/${
-          lib.getVersion stdenv.cc.cc
-        }/${stdenv.hostPlatform.config}"
-      } \
-      $NIX_CFLAGS_COMPILE"
-
-    echo "ac_add_options BINDGEN_CFLAGS='$BINDGEN_CFLAGS'" >> $MOZCONFIG
-  '';
-
-  configureFlags = let
-    toolkitSlug = if gtk3Support then
-      "3${lib.optionalString waylandSupport "-wayland"}"
-    else
-      "2";
-    toolkitValue = "cairo-gtk${toolkitSlug}";
-  in [
-    "--enable-application=comm/mail"
-
-    "--with-system-bz2"
-    "--with-system-icu"
-    "--with-system-jpeg"
-    "--with-system-libevent"
-    "--with-system-nspr"
-    "--with-system-nss"
-    "--with-system-png" # needs APNG support
-    "--with-system-icu"
-    "--with-system-zlib"
-    "--with-system-webp"
-    "--with-system-libvpx"
-
-    "--enable-rust-simd"
-    "--enable-crashreporter"
-    "--enable-default-toolkit=${toolkitValue}"
-    "--enable-js-shell"
-    "--enable-necko-wifi"
-    "--enable-startup-notification"
-    "--enable-system-ffi"
-    "--enable-system-pixman"
-    "--enable-system-sqlite"
-
-    "--disable-gconf"
-    "--disable-tests"
-    "--disable-updater"
-    "--enable-jemalloc"
-  ] ++ (if debugBuild then [
-    "--enable-debug"
-    "--enable-profiling"
-  ] else [
-    "--disable-debug"
-    "--enable-release"
-    "--disable-debug-symbols"
-    "--enable-optimize"
-    "--enable-strip"
-  ]) ++ lib.optionals (!stdenv.hostPlatform.isi686) [
-    # on i686-linux: --with-libclang-path is not available in this configuration
-    "--with-libclang-path=${llvmPackages.libclang}/lib"
-    "--with-clang-path=${llvmPackages.clang}/bin/clang"
-  ] ++ lib.optional alsaSupport "--enable-alsa"
-  ++ lib.optional calendarSupport "--enable-calendar"
-  ++ lib.optional enableOfficialBranding "--enable-official-branding"
-  ++ lib.optional pulseaudioSupport "--enable-pulseaudio";
-
-  enableParallelBuilding = true;
-
-  postConfigure = ''
-    cd obj-*
-  '';
-
-  makeFlags = lib.optionals enableOfficialBranding [
-    "MOZILLA_OFFICIAL=1"
-    "BUILD_OFFICIAL=1"
-  ];
-
-  doCheck = false;
-
-  desktopItems = [
-    (makeDesktopItem {
-      categories = lib.concatStringsSep ";" [ "Application" "Network" ];
-      desktopName = "Thunderbird";
-      genericName = "Mail Reader";
-      name = "thunderbird";
-      exec = "thunderbird %U";
-      icon = "$out/lib/thunderbird/chrome/icons/default/default256.png";
-      mimeType = lib.concatStringsSep ";" [
-        # Email
-        "x-scheme-handler/mailto"
-        "message/rfc822"
-        # Feeds
-        "x-scheme-handler/feed"
-        "application/rss+xml"
-        "application/x-extension-rss"
-        # Newsgroups
-        "x-scheme-handler/news"
-        "x-scheme-handler/snews"
-        "x-scheme-handler/nntp"
-      ];
-    })
-  ];
-  postInstall = ''
-    # TODO: Move to a dev output?
-    rm -rf $out/include $out/lib/thunderbird-devel-* $out/share/idl
-  '';
-
-  preFixup = ''
-    # Needed to find Mozilla runtime
-    gappsWrapperArgs+=(
-      --argv0 "$out/bin/thunderbird"
-      --set MOZ_APP_LAUNCHER thunderbird
-      # https://github.com/NixOS/nixpkgs/pull/61980
-      --set SNAP_NAME "thunderbird"
-      --set MOZ_LEGACY_PROFILES 1
-      --set MOZ_ALLOW_DOWNGRADE 1
-    )
-  '';
-
-  # FIXME: The XUL portion of this can probably be removed as soon as we
-  # package a Thunderbird >=71.0 since XUL shouldn't be anymore (in use)?
-  postFixup = ''
-    local xul="$out/lib/thunderbird/libxul.so"
-    patchelf --set-rpath "${libnotify}/lib:${lib.getLib systemd}/lib:$(patchelf --print-rpath $xul)" $xul
-  '';
-
-  doInstallCheck = true;
-  installCheckPhase = ''
-    "$out/bin/thunderbird" --version
-  '';
-
-  disallowedRequisites = [
-    stdenv.cc
-  ];
-
-  passthru.updateScript = import ./../../browsers/firefox/update.nix {
-    attrPath = "thunderbird";
-    baseUrl = "http://archive.mozilla.org/pub/thunderbird/releases/";
-    inherit writeScript lib common-updater-scripts xidel coreutils gnused
-      gnugrep curl runtimeShell;
-  };
-
-  meta = with lib; {
-    description = "A full-featured e-mail client";
-    homepage = "https://www.thunderbird.net";
-    maintainers = with maintainers; [
-      eelco
-      lovesegfault
-      pierron
-      vcunat
-    ];
-    platforms = platforms.linux;
-    license = licenses.mpl20;
-    knownVulnerabilities = [ "Support ended around Semptember 2020." ];
-  };
-}
--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@ -242,7 +242,7 @@ stdenv.mkDerivation rec {
    "--enable-strip"
  ]) ++ lib.optionals (!stdenv.hostPlatform.isi686) [
    # on i686-linux: --with-libclang-path is not available in this configuration
-    "--with-libclang-path=${llvmPackages.libclang}/lib"
+    "--with-libclang-path=${llvmPackages.libclang.lib}/lib"
    "--with-clang-path=${llvmPackages.clang}/bin/clang"
  ] ++ lib.optional alsaSupport "--enable-alsa"
  ++ lib.optional calendarSupport "--enable-calendar"
--- a/pkgs/applications/networking/mailreaders/thunderbird/no-buildconfig-68.patch
+++ b/pkgs/applications/networking/mailreaders/thunderbird/no-buildconfig-68.patch
@ -1,36 +0,0 @@
-Remove about:buildconfig.  If used as-is, it would add unnecessary runtime dependencies.
-diff -ru -x '*~' a/docshell/base/nsAboutRedirector.cpp b/docshell/base/nsAboutRedirector.cpp
--- a/docshell/base/nsAboutRedirector.cpp	2017-07-31 18:20:51.000000000 +0200
-+++ b/docshell/base/nsAboutRedirector.cpp	2017-09-26 22:02:00.814151731 +0200
-@@ -32,8 +32,6 @@
-     {"about", "chrome://global/content/aboutAbout.xhtml", 0},
-     {"addons", "chrome://mozapps/content/extensions/extensions.xul",
-      nsIAboutModule::ALLOW_SCRIPT},
-    {"buildconfig", "chrome://global/content/buildconfig.html",
-     nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT},
-     {"checkerboard", "chrome://global/content/aboutCheckerboard.xhtml",
-      nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
-          nsIAboutModule::ALLOW_SCRIPT},
-diff -ru -x '*~' a/toolkit/content/jar.mn b/toolkit/content/jar.mn
--- a/toolkit/content/jar.mn	2017-07-31 18:20:52.000000000 +0200
-+++ b/toolkit/content/jar.mn	2017-09-26 22:01:42.383350314 +0200
-@@ -39,7 +39,6 @@
-    content/global/plugins.css
-    content/global/browser-child.js
-    content/global/browser-content.js
-*   content/global/buildconfig.html
-    content/global/buildconfig.css
-    content/global/contentAreaUtils.js
-    content/global/datepicker.xhtml
--- a/comm/mail/base/jar.mn
-+++ b/comm/mail/base/jar.mn
-@@ -117,9 +117,7 @@
- % override chrome://mozapps/content/profile/profileDowngrade.js chrome://messenger/content/profileDowngrade.js
- % override chrome://mozapps/content/profile/profileDowngrade.xul chrome://messenger/content/profileDowngrade.xul
- 
-*   content/messenger/buildconfig.html              (content/buildconfig.html)
-     content/messenger/buildconfig.css               (content/buildconfig.css)
-% override chrome://global/content/buildconfig.html chrome://messenger/content/buildconfig.html
- % override chrome://global/content/buildconfig.css chrome://messenger/content/buildconfig.css
- 
- # L10n resources and overrides.
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@ -22,6 +22,7 @@
 , enableDaemon ? true
 , enableCli ? true
 , installLib ? false
+, apparmorRulesFromClosure
 }:

 let
@ -39,6 +40,8 @@ in stdenv.mkDerivation {
    fetchSubmodules = true;
  };

+  outputs = [ "out" "apparmor" ];
+
  cmakeFlags =
    let
      mkFlag = opt: if opt then "ON" else "OFF";
@ -75,6 +78,31 @@ in stdenv.mkDerivation {

  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework CoreFoundation";

+  postInstall = ''
+    mkdir $apparmor
+    cat >$apparmor/bin.transmission-daemon <<EOF
+    include <tunables/global>
+    $out/bin/transmission-daemon {
+      include <abstractions/base>
+      include <abstractions/nameservice>
+      include <abstractions/ssl_certs>
+      include "${apparmorRulesFromClosure { name = "transmission-daemon"; } ([
+        curl libevent openssl pcre zlib
+      ] ++ lib.optionals enableSystemd [ systemd ]
+        ++ lib.optionals stdenv.isLinux [ inotify-tools ]
+      )}"
+      r @{PROC}/sys/kernel/random/uuid,
+      r @{PROC}/sys/vm/overcommit_memory,
+      r @{PROC}/@{pid}/environ,
+      r @{PROC}/@{pid}/mounts,
+      rwk /tmp/tr_session_id_*,
+      r /run/systemd/resolve/stub-resolv.conf,
+
+      include <local/bin.transmission-daemon>
+    }
+    EOF
+  '';
+
  passthru.tests = {
    smoke-test = nixosTests.bittorrent;
  };
--- a/pkgs/applications/radio/rtl_433/default.nix
+++ b/pkgs/applications/radio/rtl_433/default.nix
@ -3,14 +3,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "20.11";
+  version = "21.05";
  pname = "rtl_433";

  src = fetchFromGitHub {
    owner = "merbanan";
    repo = "rtl_433";
    rev = version;
-    sha256 = "093bxjxkg7yf78wqj5gpijbfa2p05ny09qqsj84kzi1svnzsa369";
+    sha256 = "sha256-01mXOwLv16yTR65BboN+TFm2aE2EMfW1D5teDdW2wLg=";
  };

  nativeBuildInputs = [ pkg-config cmake ];
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Decode traffic from devices that broadcast on 433.9 MHz, 868 MHz, 315 MHz, 345 MHz and 915 MHz";
    homepage = "https://github.com/merbanan/rtl_433";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ earldouglas ];
    platforms = platforms.all;
  };
--- a/pkgs/applications/science/machine-learning/labelimg/default.nix
+++ b/pkgs/applications/science/machine-learning/labelimg/default.nix
@ -15,7 +15,7 @@
    propagatedBuildInputs = with python3Packages; [
      pyqt5
      lxml
-      sip
+      sip_4
    ];
    preBuild = ''
      make qt5py3
--- a/pkgs/applications/science/math/R/default.nix
+++ b/pkgs/applications/science/math/R/default.nix
@ -69,8 +69,8 @@ stdenv.mkDerivation rec {
      --disable-R-framework
      --without-x
      OBJC="clang"
-      CPPFLAGS="-isystem ${libcxx}/include/c++/v1"
-      LDFLAGS="-L${libcxx}/lib"
+      CPPFLAGS="-isystem ${lib.getDev libcxx}/include/c++/v1"
+      LDFLAGS="-L${lib.getLib libcxx}/lib"
  '' + ''
    )
    echo >>etc/Renviron.in "TCLLIBPATH=${tk}/lib"
--- a/pkgs/applications/science/math/eukleides/default.nix
+++ b/pkgs/applications/science/math/eukleides/default.nix
@ -1,26 +1,57 @@
-{ lib, stdenv, fetchurl, bison, flex, texinfo, readline, texLive }:
+{ lib, stdenv, fetchurl, bison, flex, makeWrapper, texinfo, readline, texLive }:

-let
-  name    = "eukleides";
+lib.fix (eukleides: stdenv.mkDerivation rec {
+  pname = "eukleides";
  version = "1.5.4";
-in
-stdenv.mkDerivation {
-  name = "${name}-${version}";

  src = fetchurl {
-    url = "http://www.eukleides.org/files/${name}-${version}.tar.bz2";
+    url = "http://www.eukleides.org/files/${pname}-${version}.tar.bz2";
    sha256 = "0s8cyh75hdj89v6kpm3z24i48yzpkr8qf0cwxbs9ijxj1i38ki0q";
  };

-  buildInputs = [bison flex texinfo readline texLive];
+  # use $CC instead of hardcoded gcc
+  patches = [ ./use-CC.patch ];

-  preConfigure = "sed -i 's/ginstall-info/install-info/g' doc/Makefile";
-  installPhase = "mkdir -p $out/bin ; make PREFIX=$out install";
+  nativeBuildInputs = [ bison flex texinfo makeWrapper ];
+
+  buildInputs = [ readline texLive ];
+
+  preConfigure = ''
+    substituteInPlace Makefile \
+      --replace mktexlsr true
+
+    substituteInPlace doc/Makefile \
+      --replace ginstall-info install-info
+
+    substituteInPlace Config \
+      --replace '/usr/local' "$out" \
+      --replace '$(SHARE_DIR)/texmf' "$tex"
+  '';
+
+  preInstall = ''
+    mkdir -p $out/bin
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/euktoeps \
+      --set-default TEXINPUTS : \
+      --prefix TEXINPUTS : "$tex/tex/latex/eukleides" \
+      --prefix PATH : "${texLive}/bin"
+    wrapProgram $out/bin/euktopdf \
+      --set-default TEXINPUTS : \
+      --prefix TEXINPUTS : "$tex/tex/latex/eukleides" \
+      --prefix PATH : "${texLive}/bin"
+  '';
+
+  outputs = [ "out" "doc" "tex" ];
+
+  passthru.tlType = "run";
+  passthru.pkgs = [ eukleides.tex ];

  meta = {
    description = "Geometry Drawing Language";
    homepage = "http://www.eukleides.org/";
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl3Plus;

    longDescription = ''
      Eukleides is a computer language devoted to elementary plane
@ -31,7 +62,7 @@ stdenv.mkDerivation {
      circles and conics.
    '';

-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
    maintainers = [ lib.maintainers.peti ];
  };
-}
+})
--- a/pkgs/applications/science/math/eukleides/use-CC.patch
+++ b/pkgs/applications/science/math/eukleides/use-CC.patch
@ -0,0 +1,11 @@
+--- a/build/Makefile
+++ b/build/Makefile
+@@ -11,7 +11,7 @@ LEX = flex
+ LFLAGS = -8
+ YACC = bison
+ YFLAGS = -d
+-CC = gcc
+CC ?= gcc
+ IFLAGS = -I$(COMMON_DIR) -I$(MAIN_DIR) -I$(BUILD_DIR) 
+ ifneq ($(strip $(LOCALES)),)
+ MOFLAGS = -DMO_DIR=\"$(MO_DIR)\" 
--- a/pkgs/applications/science/math/glsurf/default.nix
+++ b/pkgs/applications/science/math/glsurf/default.nix
@ -1,5 +1,5 @@
-{ lib, stdenv, fetchurl, ocamlPackages, libGLU, libGL, freeglut
-, libmysqlclient, mpfr, gmp, libtiff, libjpeg, libpng, giflib
+{ lib, stdenv, fetchurl, ocamlPackages, libGLU, libGL, freeglut, giflib
+, libmysqlclient, mpfr, gmp, libtiff, libjpeg, libpng
 }:

 stdenv.mkDerivation {
@ -10,10 +10,10 @@ stdenv.mkDerivation {
    sha256 = "0w8xxfnw2snflz8wdr2ca9f5g91w5vbyp1hwlx1v7vg83d4bwqs7";
  };

-  buildInputs = [ freeglut libGLU libGL libmysqlclient mpfr gmp
-    libtiff libjpeg libpng giflib ]
+  buildInputs = [ freeglut libGLU libGL libmysqlclient mpfr giflib gmp
+    libtiff libjpeg libpng ]
  ++ (with ocamlPackages; [
-    ocaml findlib ocaml_mysql lablgl camlimages_4_0 mlgmpidl
+    ocaml findlib ocaml_mysql lablgl camlimages_4_1_2 mlgmpidl
  ]);

  installPhase = ''
@ -26,6 +26,6 @@ stdenv.mkDerivation {
  meta = {
    homepage = "https://raffalli.eu/~christophe/glsurf/";
    description = "A program to draw implicit surfaces and curves";
-    license = lib.licenses.lgpl21;
+    license = lib.licenses.gpl2Plus;
  };
 }
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
    sha256 = "0vrgi83hrw4n9zgx873fn4ba3vk54slrwk1cl4cc4plgxzv1y1kg";
  };

-  nativeBuildInputs = [ makeWrapper cmake pkg-config ];
+  nativeBuildInputs = [ makeWrapper cmake pkg-config llvm_5.dev ];
  buildInputs = [ ftgl gl2ps glew pcre zlib zstd llvm_5 libxml2 lz4 xz gsl xxHash libAfterImage giflib libjpeg libtiff libpng python.pkgs.numpy ]
    ++ lib.optionals (!stdenv.isDarwin) [ libX11 libXpm libXft libXext libGLU libGL ]
    ++ lib.optionals (stdenv.isDarwin) [ Cocoa OpenGL ]
--- a/pkgs/applications/version-management/git-and-tools/git-cola/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-cola/default.nix
@ -1,7 +1,7 @@
 { lib, fetchFromGitHub, python3Packages, gettext, git, qt5 }:

 let
-  inherit (python3Packages) buildPythonApplication pyqt5 sip pyinotify;
+  inherit (python3Packages) buildPythonApplication pyqt5 sip_4 pyinotify;

 in buildPythonApplication rec {
  pname = "git-cola";
@ -15,7 +15,7 @@ in buildPythonApplication rec {
  };

  buildInputs = [ git gettext ];
-  propagatedBuildInputs = [ pyqt5 sip pyinotify ];
+  propagatedBuildInputs = [ pyqt5 sip_4 pyinotify ];
  nativeBuildInputs = [ qt5.wrapQtAppsHook ];

  doCheck = false;
--- a/pkgs/applications/video/hdhomerun-config-gui/default.nix
+++ b/pkgs/applications/video/hdhomerun-config-gui/default.nix
@ -1,12 +1,12 @@
-{ lib, stdenv, fetchurl, libhdhomerun, gcc, gnumake, pkg-config, gtk2 }:
+{ lib, stdenv, fetchurl, libhdhomerun, pkg-config, gtk2 }:

 stdenv.mkDerivation rec {
  pname = "hdhomerun-config-gui";
-  version = "20200907";
+  version = "20210224";

  src = fetchurl {
    url = "https://download.silicondust.com/hdhomerun/hdhomerun_config_gui_${version}.tgz";
-    sha256 = "17zf0hzw68b0xdkh1maqhl96jb7171mbhd29y64as29nps9x4fmz";
+    sha256 = "sha256-vzrSk742Ca2I8Uk0uGo44SxpEoVY1QBn62Ahwz8E7p8=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/video/mplayer/default.nix
+++ b/pkgs/applications/video/mplayer/default.nix
@ -106,6 +106,8 @@ stdenv.mkDerivation rec {
    rm -rf ffmpeg
  '';

+  patches = [ ./svn-r38199-ffmpeg44fix.patch ];
+
  depsBuildBuild = [ buildPackages.stdenv.cc ];
  nativeBuildInputs = [ pkg-config yasm ];
  buildInputs = with lib;
--- a/pkgs/applications/video/mplayer/svn-r38199-ffmpeg44fix.patch
+++ b/pkgs/applications/video/mplayer/svn-r38199-ffmpeg44fix.patch
@ -0,0 +1,22 @@
+Index: libmpcodecs/ad_spdif.c
+===================================================================
+diff --git a/libmpcodecs/ad_spdif.c b/libmpcodecs/ad_spdif.c
+--- a/libmpcodecs/ad_spdif.c	(revision 38198)
+++ b/libmpcodecs/ad_spdif.c	(revision 38199)
+@@ -298,14 +298,8 @@
+         if (spdif_ctx->header_written)
+             av_write_trailer(lavf_ctx);
+         av_freep(&lavf_ctx->pb);
+-        if (lavf_ctx->streams) {
+-            av_freep(&lavf_ctx->streams[0]->codec);
+-            av_freep(&lavf_ctx->streams[0]->info);
+-            av_freep(&lavf_ctx->streams[0]);
+-        }
+-        av_freep(&lavf_ctx->streams);
+-        av_freep(&lavf_ctx->priv_data);
+        avformat_free_context(lavf_ctx);
+        lavf_ctx = NULL;
+     }
+-    av_freep(&lavf_ctx);
+     av_freep(&spdif_ctx);
+ }
--- a/pkgs/applications/video/openshot-qt/default.nix
+++ b/pkgs/applications/video/openshot-qt/default.nix
@ -18,7 +18,7 @@ mkDerivationWith python3Packages.buildPythonApplication rec {

  buildInputs = [ gtk3 ];

-  propagatedBuildInputs = with python3Packages; [ libopenshot pyqt5_with_qtwebkit requests sip httplib2 pyzmq ];
+  propagatedBuildInputs = with python3Packages; [ libopenshot pyqt5_with_qtwebkit requests sip_4 httplib2 pyzmq ];

  dontWrapGApps = true;
  dontWrapQtApps = true;
--- a/pkgs/applications/video/vdr/default.nix
+++ b/pkgs/applications/video/vdr/default.nix
@ -5,12 +5,12 @@
 }: stdenv.mkDerivation rec {

  pname = "vdr";
-  version = "2.4.6";
+  version = "2.4.7";

  src = fetchgit {
    url = "git://git.tvdr.de/vdr.git";
-    rev = "V20406";
-    sha256 = "sha256-te9lMmnWpesv+np2gJUDL17pI0WyVxhUnoBsFSRtOco=";
+    rev = version;
+    sha256 = "sha256-hDJ/DemWuLddDvXGqxkSTIqATlWUjolcP7ojjhK2CDk=";
  };

  enableParallelBuilding = true;
@ -51,6 +51,6 @@
    description = "Video Disc Recorder";
    maintainers = [ maintainers.ck3d ];
    platforms = [ "i686-linux" "x86_64-linux" ];
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
  };
 }
--- a/pkgs/applications/window-managers/icewm/default.nix
+++ b/pkgs/applications/window-managers/icewm/default.nix
@ -30,7 +30,7 @@
 , libpthreadstubs
 , libsndfile
 , libtiff
-, libungif
+, giflib
 , libxcb
 , mkfontdir
 , pcre
@ -81,7 +81,7 @@ stdenv.mkDerivation rec {
    libpthreadstubs
    libsndfile
    libtiff
-    libungif
+    giflib
    libxcb
    mkfontdir
    pcre
--- a/pkgs/applications/window-managers/river/default.nix
+++ b/pkgs/applications/window-managers/river/default.nix
@ -43,6 +43,6 @@ stdenv.mkDerivation rec {
    description = "A dynamic tiling wayland compositor";
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ branwright1 ];
+    maintainers = with maintainers; [ fortuneteller2k ];
  };
 }
--- a/pkgs/applications/window-managers/windowmaker/default.nix
+++ b/pkgs/applications/window-managers/windowmaker/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, pkg-config
 , libX11, libXext, libXft, libXmu, libXinerama, libXrandr, libXpm
-, imagemagick, libpng, libjpeg, libexif, libtiff, libungif, libwebp }:
+, imagemagick, libpng, libjpeg, libexif, libtiff, giflib, libwebp }:

 stdenv.mkDerivation rec {
  pname = "windowmaker";
@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ pkg-config ];

  buildInputs = [ libX11 libXext libXft libXmu libXinerama libXrandr libXpm
-                  imagemagick libpng libjpeg libexif libtiff libungif libwebp ];
+                  imagemagick libpng libjpeg libexif libtiff giflib libwebp ];

  configureFlags = [
    "--with-x"
--- a/pkgs/applications/window-managers/wio/default.nix
+++ b/pkgs/applications/window-managers/wio/default.nix
@ -25,6 +25,11 @@ stdenv.mkDerivation rec {
    sha256 = "1vpvlahv6dmr7vfb11p5cc5ds2y2vfvcb877nkqx18yin6pg357l";
  };

+  patches = [
+    # To fix the build with wlroots 0.13:
+    ./wlroots-0.13.patch
+  ];
+
  nativeBuildInputs = [ meson ninja pkg-config makeWrapper ];
  buildInputs = [
    cairo
--- a/pkgs/applications/window-managers/wio/wlroots-0.13.patch
+++ b/pkgs/applications/window-managers/wio/wlroots-0.13.patch
@ -0,0 +1,254 @@
+commit 8a3f903b20d646ebb2472c4f094ca1bf225a96c7
+Author: Michael Weiss <dev.primeos@gmail.com>
+Date:   Fri May 14 19:19:05 2021 +0200
+
+    Fix the build with wlroots 0.13
+
+diff --git a/main.c b/main.c
+index 5d7dcda..870fdb0 100644
+--- a/main.c
+++ b/main.c
+@@ -1,6 +1,7 @@
+ #define _POSIX_C_SOURCE 200809L
+ #include <assert.h>
+ #include <cairo/cairo.h>
+#include <libdrm/drm_fourcc.h>
+ #include <getopt.h>
+ #include <stdlib.h>
+ #include <string.h>
+@@ -49,7 +50,7 @@ static void gen_menu_textures(struct wio_server *server) {
+ 		cairo_surface_flush(surf);
+ 		unsigned char *data = cairo_image_surface_get_data(surf);
+ 		server->menu.inactive_textures[i] = wlr_texture_from_pixels(renderer,
+-				WL_SHM_FORMAT_ARGB8888,
+				DRM_FORMAT_ARGB8888,
+ 				cairo_image_surface_get_stride(surf),
+ 				extents.width + 2, extents.height + 2, data);
+ 	}
+@@ -66,7 +67,7 @@ static void gen_menu_textures(struct wio_server *server) {
+ 		cairo_surface_flush(surf);
+ 		unsigned char *data = cairo_image_surface_get_data(surf);
+ 		server->menu.active_textures[i] = wlr_texture_from_pixels(renderer,
+-				WL_SHM_FORMAT_ARGB8888,
+				DRM_FORMAT_ARGB8888,
+ 				cairo_image_surface_get_stride(surf),
+ 				extents.width + 2, extents.height + 2, data);
+ 	}
+@@ -152,7 +153,7 @@ int main(int argc, char **argv) {
+ 	}
+ 
+ 	server.wl_display = wl_display_create();
+-	server.backend = wlr_backend_autocreate(server.wl_display, NULL);
+	server.backend = wlr_backend_autocreate(server.wl_display);
+ 	server.renderer = wlr_backend_get_renderer(server.backend);
+ 	wlr_renderer_init_wl_display(server.renderer, server.wl_display);
+ 
+diff --git a/protocols/wlr-layer-shell-unstable-v1.xml b/protocols/wlr-layer-shell-unstable-v1.xml
+index 90b8bc8..d62fd51 100644
+--- a/protocols/wlr-layer-shell-unstable-v1.xml
+++ b/protocols/wlr-layer-shell-unstable-v1.xml
+@@ -25,7 +25,7 @@
+     THIS SOFTWARE.
+   </copyright>
+ 
+-  <interface name="zwlr_layer_shell_v1" version="1">
+  <interface name="zwlr_layer_shell_v1" version="4">
+     <description summary="create surfaces that are layers of the desktop">
+       Clients can use this interface to assign the surface_layer role to
+       wl_surfaces. Such surfaces are assigned to a "layer" of the output and
+@@ -47,6 +47,12 @@
+         or manipulate a buffer prior to the first layer_surface.configure call
+         must also be treated as errors.
+ 
+        After creating a layer_surface object and setting it up, the client
+        must perform an initial commit without any buffer attached.
+        The compositor will reply with a layer_surface.configure event.
+        The client must acknowledge it and is then allowed to attach a buffer
+        to map the surface.
+
+         You may pass NULL for output to allow the compositor to decide which
+         output to use. Generally this will be the one that the user most
+         recently interacted with.
+@@ -82,17 +88,35 @@
+       <entry name="top" value="2"/>
+       <entry name="overlay" value="3"/>
+     </enum>
+
+    <!-- Version 3 additions -->
+
+    <request name="destroy" type="destructor" since="3">
+      <description summary="destroy the layer_shell object">
+        This request indicates that the client will not use the layer_shell
+        object any more. Objects that have been created through this instance
+        are not affected.
+      </description>
+    </request>
+   </interface>
+ 
+-  <interface name="zwlr_layer_surface_v1" version="1">
+  <interface name="zwlr_layer_surface_v1" version="4">
+     <description summary="layer metadata interface">
+       An interface that may be implemented by a wl_surface, for surfaces that
+       are designed to be rendered as a layer of a stacked desktop-like
+       environment.
+ 
+-      Layer surface state (size, anchor, exclusive zone, margin, interactivity)
+-      is double-buffered, and will be applied at the time wl_surface.commit of
+-      the corresponding wl_surface is called.
+      Layer surface state (layer, size, anchor, exclusive zone,
+      margin, interactivity) is double-buffered, and will be applied at the
+      time wl_surface.commit of the corresponding wl_surface is called.
+
+      Attaching a null buffer to a layer surface unmaps it.
+
+      Unmapping a layer_surface means that the surface cannot be shown by the
+      compositor until it is explicitly mapped again. The layer_surface
+      returns to the state it had right after layer_shell.get_layer_surface.
+      The client can re-map the surface by performing a commit without any
+      buffer attached, waiting for a configure event and handling it as usual.
+     </description>
+ 
+     <request name="set_size">
+@@ -127,14 +151,19 @@
+ 
+     <request name="set_exclusive_zone">
+       <description summary="configures the exclusive geometry of this surface">
+-        Requests that the compositor avoids occluding an area of the surface
+-        with other surfaces. The compositor's use of this information is
+        Requests that the compositor avoids occluding an area with other
+        surfaces. The compositor's use of this information is
+         implementation-dependent - do not assume that this region will not
+         actually be occluded.
+ 
+-        A positive value is only meaningful if the surface is anchored to an
+-        edge, rather than a corner. The zone is the number of surface-local
+-        coordinates from the edge that is considered exclusive.
+        A positive value is only meaningful if the surface is anchored to one
+        edge or an edge and both perpendicular edges. If the surface is not
+        anchored, anchored to only two perpendicular edges (a corner), anchored
+        to only two parallel edges or anchored to all edges, a positive value
+        will be treated the same as zero.
+
+        A positive zone is the distance from the edge in surface-local
+        coordinates to consider exclusive.
+ 
+         Surfaces that do not wish to have an exclusive zone may instead specify
+         how they should interact with surfaces that do. If set to zero, the
+@@ -174,21 +203,85 @@
+       <arg name="left" type="int"/>
+     </request>
+ 
+    <enum name="keyboard_interactivity">
+      <description summary="types of keyboard interaction possible for a layer shell surface">
+        Types of keyboard interaction possible for layer shell surfaces. The
+        rationale for this is twofold: (1) some applications are not interested
+        in keyboard events and not allowing them to be focused can improve the
+        desktop experience; (2) some applications will want to take exclusive
+        keyboard focus.
+      </description>
+
+      <entry name="none" value="0">
+        <description summary="no keyboard focus is possible">
+          This value indicates that this surface is not interested in keyboard
+          events and the compositor should never assign it the keyboard focus.
+
+          This is the default value, set for newly created layer shell surfaces.
+
+          This is useful for e.g. desktop widgets that display information or
+          only have interaction with non-keyboard input devices.
+        </description>
+      </entry>
+      <entry name="exclusive" value="1">
+        <description summary="request exclusive keyboard focus">
+          Request exclusive keyboard focus if this surface is above the shell surface layer.
+
+          For the top and overlay layers, the seat will always give
+          exclusive keyboard focus to the top-most layer which has keyboard
+          interactivity set to exclusive. If this layer contains multiple
+          surfaces with keyboard interactivity set to exclusive, the compositor
+          determines the one receiving keyboard events in an implementation-
+          defined manner. In this case, no guarantee is made when this surface
+          will receive keyboard focus (if ever).
+
+          For the bottom and background layers, the compositor is allowed to use
+          normal focus semantics.
+
+          This setting is mainly intended for applications that need to ensure
+          they receive all keyboard events, such as a lock screen or a password
+          prompt.
+        </description>
+      </entry>
+      <entry name="on_demand" value="2" since="4">
+        <description summary="request regular keyboard focus semantics">
+          This requests the compositor to allow this surface to be focused and
+          unfocused by the user in an implementation-defined manner. The user
+          should be able to unfocus this surface even regardless of the layer
+          it is on.
+
+          Typically, the compositor will want to use its normal mechanism to
+          manage keyboard focus between layer shell surfaces with this setting
+          and regular toplevels on the desktop layer (e.g. click to focus).
+          Nevertheless, it is possible for a compositor to require a special
+          interaction to focus or unfocus layer shell surfaces (e.g. requiring
+          a click even if focus follows the mouse normally, or providing a
+          keybinding to switch focus between layers).
+
+          This setting is mainly intended for desktop shell components (e.g.
+          panels) that allow keyboard interaction. Using this option can allow
+          implementing a desktop shell that can be fully usable without the
+          mouse.
+        </description>
+      </entry>
+    </enum>
+
+     <request name="set_keyboard_interactivity">
+       <description summary="requests keyboard events">
+-        Set to 1 to request that the seat send keyboard events to this layer
+-        surface. For layers below the shell surface layer, the seat will use
+-        normal focus semantics. For layers above the shell surface layers, the
+-        seat will always give exclusive keyboard focus to the top-most layer
+-        which has keyboard interactivity set to true.
+        Set how keyboard events are delivered to this surface. By default,
+        layer shell surfaces do not receive keyboard events; this request can
+        be used to change this.
+
+        This setting is inherited by child surfaces set by the get_popup
+        request.
+ 
+         Layer surfaces receive pointer, touch, and tablet events normally. If
+         you do not want to receive them, set the input region on your surface
+         to an empty region.
+ 
+-        Events is double-buffered, see wl_surface.commit.
+        Keyboard interactivity is double-buffered, see wl_surface.commit.
+       </description>
+-      <arg name="keyboard_interactivity" type="uint"/>
+      <arg name="keyboard_interactivity" type="uint" enum="keyboard_interactivity"/>
+     </request>
+ 
+     <request name="get_popup">
+@@ -273,6 +366,7 @@
+       <entry name="invalid_surface_state" value="0" summary="provided surface state is invalid"/>
+       <entry name="invalid_size" value="1" summary="size is invalid"/>
+       <entry name="invalid_anchor" value="2" summary="anchor bitfield is invalid"/>
+      <entry name="invalid_keyboard_interactivity" value="3" summary="keyboard interactivity is invalid"/>
+     </enum>
+ 
+     <enum name="anchor" bitfield="true">
+@@ -281,5 +375,16 @@
+       <entry name="left" value="4" summary="the left edge of the anchor rectangle"/>
+       <entry name="right" value="8" summary="the right edge of the anchor rectangle"/>
+     </enum>
+
+    <!-- Version 2 additions -->
+
+    <request name="set_layer" since="2">
+      <description summary="change the layer of the surface">
+        Change the layer that the surface is rendered on.
+
+        Layer is double-buffered, see wl_surface.commit.
+      </description>
+      <arg name="layer" type="uint" enum="zwlr_layer_shell_v1.layer" summary="layer to move this surface to"/>
+    </request>
+   </interface>
+ </protocol>
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@ -25,8 +25,9 @@ dontLink=0
 nonFlagArgs=0
 cc1=0
 # shellcheck disable=SC2193
-[[ "@prog@" = *++ ]] && isCpp=1 || isCpp=0
-cppInclude=1
+[[ "@prog@" = *++ ]] && isCxx=1 || isCxx=0
+cxxInclude=1
+cxxLibrary=1
 cInclude=1
 setDynamicLinker=1

@ -50,15 +51,15 @@ while (( "$n" < "$nParams" )); do
        dontLink=1
    elif [[ "$p" = -x && "$p2" = *-header ]]; then
        dontLink=1
-    elif [[ "$p" = -x && "$p2" = c++* && "$isCpp" = 0 ]]; then
-        isCpp=1
+    elif [[ "$p" = -x && "$p2" = c++* && "$isCxx" = 0 ]]; then
+        isCxx=1
    elif [ "$p" = -nostdlib ]; then
-        isCpp=-1
+        cxxLibrary=0
    elif [ "$p" = -nostdinc ]; then
        cInclude=0
-        cppInclude=0
+        cxxInclude=0
    elif [ "$p" = -nostdinc++ ]; then
-        cppInclude=0
+        cxxInclude=0
    elif [[ "$p" = -static || "$p" = -static-pie ]]; then
        setDynamicLinker=0
    elif [[ "$p" != -?* ]]; then
@ -131,12 +132,13 @@ if [ "$NIX_ENFORCE_NO_NATIVE_@suffixSalt@" = 1 ]; then
    params=(${rest+"${rest[@]}"})
 fi

-if [[ "$isCpp" = 1 ]]; then
-    NIX_CFLAGS_LINK_@suffixSalt@+=" $NIX_CXXSTDLIB_LINK_@suffixSalt@"
-fi
-
-if [[ "$cppInclude" = 1 ]]; then
-    NIX_CFLAGS_COMPILE_@suffixSalt@+=" $NIX_CXXSTDLIB_COMPILE_@suffixSalt@"
+if [[ "$isCxx" = 1 ]]; then
+    if [[ "$cxxInclude" = 1 ]]; then
+        NIX_CFLAGS_COMPILE_@suffixSalt@+=" $NIX_CXXSTDLIB_COMPILE_@suffixSalt@"
+    fi
+    if [[ "$cxxLibrary" = 1 ]]; then
+        NIX_CFLAGS_LINK_@suffixSalt@+=" $NIX_CXXSTDLIB_LINK_@suffixSalt@"
+    fi
 fi

 source @out@/nix-support/add-hardening.sh
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@ -370,7 +370,7 @@ stdenv.mkDerivation {
      done
    ''
    + optionalString (libcxx.isLLVM or false) (''
-      echo "-isystem ${libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
+      echo "-isystem ${lib.getDev libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
      echo "-stdlib=libc++" >> $out/nix-support/libcxx-ldflags
    '' + lib.optionalString stdenv.targetPlatform.isLinux ''
      echo "-lc++abi" >> $out/nix-support/libcxx-ldflags
@ -404,7 +404,7 @@ stdenv.mkDerivation {
      echo "$ccLDFlags" >> $out/nix-support/cc-ldflags
      echo "$ccCFlags" >> $out/nix-support/cc-cflags
    '' + optionalString (targetPlatform.isDarwin && (libcxx != null) && (cc.isClang or false)) ''
-      echo " -L${libcxx}/lib" >> $out/nix-support/cc-ldflags
+      echo " -L${lib.getLib libcxx}/lib" >> $out/nix-support/cc-ldflags
    ''

    ##
--- a/pkgs/build-support/rust/default-crate-overrides.nix
+++ b/pkgs/build-support/rust/default-crate-overrides.nix
@ -92,7 +92,7 @@ in
  nettle-sys = attrs: {
    nativeBuildInputs = [ pkg-config ];
    buildInputs = [ nettle clang ];
-    LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
+    LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
  };

  openssl = attrs: {
--- a/pkgs/data/themes/marwaita/default.nix
+++ b/pkgs/data/themes/marwaita/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , gdk-pixbuf
 , gtk-engine-murrine
@ -8,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "marwaita";
-  version = "9.1";
+  version = "9.2.1";

  src = fetchFromGitHub {
    owner = "darkomarko42";
    repo = pname;
    rev = version;
-    sha256 = "0974pfcdbhajxvd6fnp2kix963s28n2il9w879h5zm1f6ayglsfz";
+    sha256 = "08392ybpxnbq3wswa7bvz8nnxryjg9aczvw3arnhfvmbigwq5q0s";
  };

  buildInputs = [
--- a/pkgs/desktops/gnustep/base/default.nix
+++ b/pkgs/desktops/gnustep/base/default.nix
@ -4,7 +4,7 @@
 , fetchurl, fetchpatch
 , gmp, gnutls
 , libffi, binutils-unwrapped
-, libjpeg, libtiff, libpng, giflib, libungif
+, libjpeg, libtiff, libpng, giflib
 , libxml2, libxslt, libiconv
 , libobjc, libgcrypt
 , icu
@ -26,7 +26,7 @@ gsmakeDerivation {
    cups
    gmp gnutls
    libffi binutils-unwrapped
-    libjpeg libtiff libpng giflib libungif
+    libjpeg libtiff libpng giflib giflib
    libxml2 libxslt libiconv
    libobjc libgcrypt
    icu
--- a/pkgs/desktops/gnustep/default.nix
+++ b/pkgs/desktops/gnustep/default.nix
@ -1,6 +1,5 @@
 { newScope
 , llvmPackages
-, giflib_4_1
 }:

 let
@ -16,7 +15,7 @@ let
    libobjc = callPackage ./libobjc2 {};
    make = callPackage ./make {};
    back = callPackage ./back {};
-    base = callPackage ./base { giflib = giflib_4_1; };
+    base = callPackage ./base { };
    gui = callPackage ./gui {};
    gworkspace = callPackage ./gworkspace {};
  };
--- a/pkgs/desktops/plasma-5/fetch.sh
+++ b/pkgs/desktops/plasma-5/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/plasma/5.21.3/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/plasma/5.21.4/ -A '*.tar.xz' )
--- a/pkgs/desktops/plasma-5/srcs.nix
+++ b/pkgs/desktops/plasma-5/srcs.nix
@ -4,419 +4,419 @@

 {
  bluedevil = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/bluedevil-5.21.3.tar.xz";
-      sha256 = "1xqm4bn97asilc4yw5rvmmhk7c7wvmbalalr6gz8gw4gv0pg67qv";
-      name = "bluedevil-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/bluedevil-5.21.4.tar.xz";
+      sha256 = "0ls6ijk10pgi75ycwcnq3z4j5hn657cnr4s7fky53qkc3y2x25g1";
+      name = "bluedevil-5.21.4.tar.xz";
    };
  };
  breeze = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/breeze-5.21.3.tar.xz";
-      sha256 = "0frm3f8q1n0pdzjk7zwmvlrl19fb9265ihnnfhak6ckaq50x72l3";
-      name = "breeze-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/breeze-5.21.4.tar.xz";
+      sha256 = "1n6hwppcbnn3hw5r3f9jssvslnming9qvs4s2czyl0kky1nv8bfm";
+      name = "breeze-5.21.4.tar.xz";
    };
  };
  breeze-grub = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/breeze-grub-5.21.3.tar.xz";
-      sha256 = "1j0pk4pv5pxwhwah1gd5znnsw3j15x2sc74pp6zinz9a1ywjklnz";
-      name = "breeze-grub-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/breeze-grub-5.21.4.tar.xz";
+      sha256 = "1jd8fy9b5cmv1da27xqbl6x3197pq6m4wwxzylxgnmciivhmnzm2";
+      name = "breeze-grub-5.21.4.tar.xz";
    };
  };
  breeze-gtk = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/breeze-gtk-5.21.3.tar.xz";
-      sha256 = "1x5by915lfhbkhgrhy3lkwg64skwdlqaxzbq92x0m9v9a9agwidc";
-      name = "breeze-gtk-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/breeze-gtk-5.21.4.tar.xz";
+      sha256 = "03aj8rxh46j663m26jsb9hrg0x5j0hvzjqwc8l1ayfcwkdgl4b4i";
+      name = "breeze-gtk-5.21.4.tar.xz";
    };
  };
  breeze-plymouth = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/breeze-plymouth-5.21.3.tar.xz";
-      sha256 = "01ida3pfj6g1igndjfjpv16199zysgxlxlnc7vsx7kr8aval8pmx";
-      name = "breeze-plymouth-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/breeze-plymouth-5.21.4.tar.xz";
+      sha256 = "0ibwl2aikh547k851pb78216v8ld5la9xg3f9945dcbf7ly88nd7";
+      name = "breeze-plymouth-5.21.4.tar.xz";
    };
  };
  discover = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/discover-5.21.3.tar.xz";
-      sha256 = "170kxhrwj4mvj5qg7cyz3sxdfyp7rr4pgsi3v7kahs19a9w3isnx";
-      name = "discover-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/discover-5.21.4.tar.xz";
+      sha256 = "1f3hvafyf2kga1ywn5aia37xxgagx6p2b43h7ap7mjkmw7ywyr30";
+      name = "discover-5.21.4.tar.xz";
    };
  };
  drkonqi = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/drkonqi-5.21.3.tar.xz";
-      sha256 = "1hq37vi0vndhy66labspm75blicx1g4q594wxfxzl076mav5jds4";
-      name = "drkonqi-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/drkonqi-5.21.4.tar.xz";
+      sha256 = "123l0hyyzskjivasp1q8w9y2f2mbjrwjap3yfi23h98zbzcblcaq";
+      name = "drkonqi-5.21.4.tar.xz";
    };
  };
  kactivitymanagerd = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kactivitymanagerd-5.21.3.tar.xz";
-      sha256 = "1x5p6rbjf9kz07r5mrkiglvbigvk5bfx8qpb8l2vagsbvlg298c3";
-      name = "kactivitymanagerd-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kactivitymanagerd-5.21.4.tar.xz";
+      sha256 = "0waawpy5pqllj8iacrxpwsnz4m1yy7z8jih63s7psgr22cbvd116";
+      name = "kactivitymanagerd-5.21.4.tar.xz";
    };
  };
  kde-cli-tools = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kde-cli-tools-5.21.3.tar.xz";
-      sha256 = "0hkmr3zxg4np1ppsgj77ijgkwgvl7d0zxwl46xjc2px877lx8bpp";
-      name = "kde-cli-tools-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kde-cli-tools-5.21.4.tar.xz";
+      sha256 = "1hvfb0qg6hxbyih665xwki8gbxjljgbw6x2blh2cikp7df66nhh1";
+      name = "kde-cli-tools-5.21.4.tar.xz";
    };
  };
  kdecoration = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kdecoration-5.21.3.tar.xz";
-      sha256 = "06a3gsf1lyjxccjzn0ad254wsf7x2bln2i6kyk5j4gwqss6lplf5";
-      name = "kdecoration-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kdecoration-5.21.4.tar.xz";
+      sha256 = "003yp803gnsszlnbw1lbh043h8xlrrzg92v7vls8k5cb04ib0p8a";
+      name = "kdecoration-5.21.4.tar.xz";
    };
  };
  kde-gtk-config = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kde-gtk-config-5.21.3.tar.xz";
-      sha256 = "17fyan2jah059kj1i0sy7h901a4d2k7cc87sd84mskyys7g8vs1h";
-      name = "kde-gtk-config-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kde-gtk-config-5.21.4.tar.xz";
+      sha256 = "0g7h1l5q9hdi2iq1kh5aclxjw1ffpq1l020p37k7f251m49440y8";
+      name = "kde-gtk-config-5.21.4.tar.xz";
    };
  };
  kdeplasma-addons = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kdeplasma-addons-5.21.3.tar.xz";
-      sha256 = "1181ax96csn4170p5blvhr679d7l865nby5a66swscyl3a5ys8b1";
-      name = "kdeplasma-addons-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kdeplasma-addons-5.21.4.tar.xz";
+      sha256 = "18jny36w6zf4nfqffaqgmdgp4vcaa2civnd2lrrls8jhlz81grid";
+      name = "kdeplasma-addons-5.21.4.tar.xz";
    };
  };
  kgamma5 = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kgamma5-5.21.3.tar.xz";
-      sha256 = "0h8rwwd6lyfzmxsr5sfvllh1j8gk1pbq1w2fva8q534qrkqhqb49";
-      name = "kgamma5-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kgamma5-5.21.4.tar.xz";
+      sha256 = "1rzn3d7i2i4bba9nfydbsvjqc7wzfz9lgd7qg74k19hzmfiqfhsl";
+      name = "kgamma5-5.21.4.tar.xz";
    };
  };
  khotkeys = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/khotkeys-5.21.3.tar.xz";
-      sha256 = "1n3ahrb5mzrxap572ydal1sy5q71af97iy4i2fwbljdb6zb1l1bl";
-      name = "khotkeys-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/khotkeys-5.21.4.tar.xz";
+      sha256 = "05k6b8zilll97s14s50x27dk8p4lzmld95gzgrsv4i81jdvjgx53";
+      name = "khotkeys-5.21.4.tar.xz";
    };
  };
  kinfocenter = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kinfocenter-5.21.3.tar.xz";
-      sha256 = "1hj4mnx2mxb1ya7la05frx5c39cp3q7c5f78lnp6p8bkv3ylik72";
-      name = "kinfocenter-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kinfocenter-5.21.4.tar.xz";
+      sha256 = "150kfx4cb10zjsaqkyidh1qis5644849xfqfnd5ldwsn07nkyp1y";
+      name = "kinfocenter-5.21.4.tar.xz";
    };
  };
  kmenuedit = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kmenuedit-5.21.3.tar.xz";
-      sha256 = "0fc3sal11amaj5ydws86hdmc45zhrxkv6lc5sfy200wvff3ynjjj";
-      name = "kmenuedit-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kmenuedit-5.21.4.tar.xz";
+      sha256 = "1hmqji2ahkw3knv7pcj5m86zlmxmbsz98xv2igdx2gv6hrjbn8nh";
+      name = "kmenuedit-5.21.4.tar.xz";
    };
  };
  kscreen = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kscreen-5.21.3.tar.xz";
-      sha256 = "1f9gxdlj883ddmc1xgd1nmm8n6m5yd269kfx3m9bbp61cw4hrqlm";
-      name = "kscreen-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kscreen-5.21.4.tar.xz";
+      sha256 = "1n9ymmysdfipwwi3f6ixg1kh3pkbp5wvi2y8fli0cpjdbrfj5lfr";
+      name = "kscreen-5.21.4.tar.xz";
    };
  };
  kscreenlocker = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kscreenlocker-5.21.3.tar.xz";
-      sha256 = "1hjlpwwca9nrdwgsiy5ss5ainr1fy1wfvi4g599cvijb77qc84h0";
-      name = "kscreenlocker-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kscreenlocker-5.21.4.tar.xz";
+      sha256 = "1z94p93khl2b8zz965d6wdd4vi1q60f0s2a7ca9ph06gp8d574k4";
+      name = "kscreenlocker-5.21.4.tar.xz";
    };
  };
  ksshaskpass = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/ksshaskpass-5.21.3.tar.xz";
-      sha256 = "16c2kzdmw3viphaygdff29cvi06r53ag4a6hkxw15yrscw31n3ns";
-      name = "ksshaskpass-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/ksshaskpass-5.21.4.tar.xz";
+      sha256 = "0zj4160xs940b9rin43b0a3j6czm3n04drg484y1h2mfqjflgc61";
+      name = "ksshaskpass-5.21.4.tar.xz";
    };
  };
  ksysguard = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/ksysguard-5.21.3.tar.xz";
-      sha256 = "0ys1idjqb9n67czdhlds6mhhiizxq8qq4rmds9nq8cm961g5kqsf";
-      name = "ksysguard-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/ksysguard-5.21.4.tar.xz";
+      sha256 = "10p5bb80rcawd0qdm4f17whmqrfhzhv6hd20d57f1i9m7ijq456d";
+      name = "ksysguard-5.21.4.tar.xz";
    };
  };
  kwallet-pam = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kwallet-pam-5.21.3.tar.xz";
-      sha256 = "1dnni2k4ry11mfjnfc0i44zww3glhsbr70qnpkl9dsf5rj4dcwj3";
-      name = "kwallet-pam-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kwallet-pam-5.21.4.tar.xz";
+      sha256 = "0s3wy9qikciblr6g98kn6s4ii5pnqwcngzng0czr3r4p90w33kkg";
+      name = "kwallet-pam-5.21.4.tar.xz";
    };
  };
  kwayland-integration = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kwayland-integration-5.21.3.tar.xz";
-      sha256 = "0kqw5dbsxmdm5fi34yq718ngkx5j23211jh4l9vl029qgbi42xhc";
-      name = "kwayland-integration-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kwayland-integration-5.21.4.tar.xz";
+      sha256 = "1r3fmmzmdyfdam4hsjvjv3wss5zvyi674xsyn6csclmq3jwfz70k";
+      name = "kwayland-integration-5.21.4.tar.xz";
    };
  };
  kwayland-server = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kwayland-server-5.21.3.tar.xz";
-      sha256 = "0d3asblzz9c7cbjfdk33z26hn5n14rdrc3s9jm9awvcc1sd122a4";
-      name = "kwayland-server-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kwayland-server-5.21.4.tar.xz";
+      sha256 = "1mkivw3siyxhgyhrm6fkqmp2wiswckrb433q87dh1j9gp7kg8cpz";
+      name = "kwayland-server-5.21.4.tar.xz";
    };
  };
  kwin = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kwin-5.21.3.tar.xz";
-      sha256 = "0ni0ipfm0hp90sq03m1a5lm6shxb2cf9j1a4kiqpaf7n62ch8f3w";
-      name = "kwin-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kwin-5.21.4.tar.xz";
+      sha256 = "0br3hxnbqm2vyxcxind01784zd88bkhpz6ira03g3gjq7hlwzjx9";
+      name = "kwin-5.21.4.tar.xz";
    };
  };
  kwrited = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kwrited-5.21.3.tar.xz";
-      sha256 = "01nn94qmi8q38rdv694d9qs7zahsziclmkw49zy0wlffq4ivpk6x";
-      name = "kwrited-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kwrited-5.21.4.tar.xz";
+      sha256 = "1hrsy1r7b7sgnj0l8zn1yxlrfhrrbk8rq2frbfi329fk3psca247";
+      name = "kwrited-5.21.4.tar.xz";
    };
  };
  libkscreen = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/libkscreen-5.21.3.tar.xz";
-      sha256 = "1j2d1xpn48ks0wk9vvnvj9r03bc0ggrqvblyhs30p31svfihjs3a";
-      name = "libkscreen-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/libkscreen-5.21.4.tar.xz";
+      sha256 = "0b0mlc1lzfbkpzxs8rd7s7q5xmqla6p1q1jdnjxly3wj60pas2dc";
+      name = "libkscreen-5.21.4.tar.xz";
    };
  };
  libksysguard = {
-    version = "5.21.3.1";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/libksysguard-5.21.3.1.tar.xz";
-      sha256 = "0nayjihapn71wrnzfb4wv9laafysl0x6sn98sbwhclapbdvxnw73";
-      name = "libksysguard-5.21.3.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/libksysguard-5.21.4.tar.xz";
+      sha256 = "0sziqldjwcwpblkn7mn4w9xg34lv9pzdlc87andka4g1lxcln2gc";
+      name = "libksysguard-5.21.4.tar.xz";
    };
  };
  milou = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/milou-5.21.3.tar.xz";
-      sha256 = "0qbk0y783n7f7pl0akx252vyblrrgmsg5yr7ncaijq4x4l90f1yf";
-      name = "milou-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/milou-5.21.4.tar.xz";
+      sha256 = "0y6mvzc5prgg1n7z2gzv1b7ngh0fygggrhdbk5wvpy6zp8yanwka";
+      name = "milou-5.21.4.tar.xz";
    };
  };
  oxygen = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/oxygen-5.21.3.tar.xz";
-      sha256 = "16yj1qx4mbi62brkn8wkcr6sz5dkbl2pf49zc1hadnxfm9wd3z0a";
-      name = "oxygen-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/oxygen-5.21.4.tar.xz";
+      sha256 = "1d7cdpy3k7zyg3k6n6jz2473cqhbi7npgnpka4kc2lfjrkb9s0zj";
+      name = "oxygen-5.21.4.tar.xz";
    };
  };
  plasma-browser-integration = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-browser-integration-5.21.3.tar.xz";
-      sha256 = "1hz996lv3vvp1zldzpkb9dmvnn94v69j2vq9sfs446c25ggf9d6y";
-      name = "plasma-browser-integration-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-browser-integration-5.21.4.tar.xz";
+      sha256 = "14yna45ykfa88a17iy4c5qkd673ay818693qqn13s4zwkxriby3n";
+      name = "plasma-browser-integration-5.21.4.tar.xz";
    };
  };
  plasma-desktop = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-desktop-5.21.3.tar.xz";
-      sha256 = "0bryk523qfzb5max1h460d67ir6xbrsws9bq72bdfbv1wkv64kyy";
-      name = "plasma-desktop-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-desktop-5.21.4.tar.xz";
+      sha256 = "1drv50601030xvskkw1pa5hi5ngrx2i8lkj7m8i9pym8zy15qqy9";
+      name = "plasma-desktop-5.21.4.tar.xz";
    };
  };
  plasma-disks = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-disks-5.21.3.tar.xz";
-      sha256 = "18a7dppfhb2wpb7sfhnayq96bxjlzygdz7sppcjikxil8klhv1aq";
-      name = "plasma-disks-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-disks-5.21.4.tar.xz";
+      sha256 = "1hjihh088v1w03lpz5pcz6pycbpd8b8kh54a44pq7zkhh6l6n65g";
+      name = "plasma-disks-5.21.4.tar.xz";
    };
  };
  plasma-firewall = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-firewall-5.21.3.tar.xz";
-      sha256 = "0bzmcakzwiimc90bbpih1z5isrcfhdfwlslp4q3v3npppnivv9bw";
-      name = "plasma-firewall-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-firewall-5.21.4.tar.xz";
+      sha256 = "1in9maphksc7ajj6jhy0qxgw5f7fy4m23dpik6wvxc5r3v5b76z7";
+      name = "plasma-firewall-5.21.4.tar.xz";
    };
  };
  plasma-integration = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-integration-5.21.3.tar.xz";
-      sha256 = "09dlbfildd8wl0nbss84yibljyl6cadx95q8q4n0c5wymyc4zqy1";
-      name = "plasma-integration-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-integration-5.21.4.tar.xz";
+      sha256 = "0bj2k5c4170apy7ascfdqc052jm35pi2w5zb3m39qb5b7ylq1hhw";
+      name = "plasma-integration-5.21.4.tar.xz";
    };
  };
  plasma-nano = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-nano-5.21.3.tar.xz";
-      sha256 = "1yqn29769nnfhiyqbpv15c0zxvkfzq4yvk9x9qlchbcwjc1gr23j";
-      name = "plasma-nano-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-nano-5.21.4.tar.xz";
+      sha256 = "0v5vr5di9bk57g2xi442qj8yv9219mdpc0l0n2bsvbb8x4f0d5qk";
+      name = "plasma-nano-5.21.4.tar.xz";
    };
  };
  plasma-nm = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-nm-5.21.3.tar.xz";
-      sha256 = "0d7v757kzd0pcvlz201m0njcz9y8j0bqkwbzdz3gik9s7x6rl73p";
-      name = "plasma-nm-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-nm-5.21.4.tar.xz";
+      sha256 = "1gy1drykjyipmrpqbb7yk2232g5hzy316gkmr45invgfg3fizl73";
+      name = "plasma-nm-5.21.4.tar.xz";
    };
  };
  plasma-pa = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-pa-5.21.3.tar.xz";
-      sha256 = "16z9xzn5swrzz86yd8lykjphs92ghdsahfxjv0v9nj3ca24kfibp";
-      name = "plasma-pa-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-pa-5.21.4.tar.xz";
+      sha256 = "1rcghgqvasldmpianxhn980kc3nw1knmdlmxz52kngnpnimmqmz9";
+      name = "plasma-pa-5.21.4.tar.xz";
    };
  };
  plasma-phone-components = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-phone-components-5.21.3.tar.xz";
-      sha256 = "1dhv0gdyk47dl8il6zwjdz84jmz2d4ppfyifzc2rzf0ys934scn0";
-      name = "plasma-phone-components-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-phone-components-5.21.4.tar.xz";
+      sha256 = "08dpch4c6q59c9ys4n4w1hky09886hi1wqxgwwr4lyp02g3xmwbd";
+      name = "plasma-phone-components-5.21.4.tar.xz";
    };
  };
  plasma-sdk = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-sdk-5.21.3.tar.xz";
-      sha256 = "0asbb7j5b8c4kixw1yf7mdfyd8gjrf57gdb2wfs1npasak0dw84w";
-      name = "plasma-sdk-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-sdk-5.21.4.tar.xz";
+      sha256 = "1cn0lq3d5ipmlwkjzarm7s5ipx6ybjv9cz93pnpxkfxlbi47q0s0";
+      name = "plasma-sdk-5.21.4.tar.xz";
    };
  };
  plasma-systemmonitor = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-systemmonitor-5.21.3.tar.xz";
-      sha256 = "1w1xzqmpzk016f8rkyx6cvm6lng3h177c441hird13n6v147l7ll";
-      name = "plasma-systemmonitor-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-systemmonitor-5.21.4.tar.xz";
+      sha256 = "16mrq66qripffnj4gskzb6l52hqw9siqr8cwxq618cwk5g7hg544";
+      name = "plasma-systemmonitor-5.21.4.tar.xz";
    };
  };
  plasma-tests = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-tests-5.21.3.tar.xz";
-      sha256 = "000iwijpxxicixy5zbbgfs96h988x1d4wvjw90vagjw4hj361dk8";
-      name = "plasma-tests-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-tests-5.21.4.tar.xz";
+      sha256 = "0mxl3laym3wlhqnq7pmjm1g9mm0r306dnsr3yjl5mmhdx3dwb165";
+      name = "plasma-tests-5.21.4.tar.xz";
    };
  };
  plasma-thunderbolt = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-thunderbolt-5.21.3.tar.xz";
-      sha256 = "1j0nb9p5wbgksxy19bxsz9ni9ys40r4arvs8rl8pvvv9hndqhndm";
-      name = "plasma-thunderbolt-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-thunderbolt-5.21.4.tar.xz";
+      sha256 = "10r90hjm1ykigy587kdna6cydbbh9y4h7rbifx2r5rjzkhp9mihd";
+      name = "plasma-thunderbolt-5.21.4.tar.xz";
    };
  };
  plasma-vault = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-vault-5.21.3.tar.xz";
-      sha256 = "1q59q6y8gx4qbp1a5nbsg8zmrdljacfqd3i5n214nlj6al13sg9j";
-      name = "plasma-vault-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-vault-5.21.4.tar.xz";
+      sha256 = "13d4z2g34skhw11wykhwyigdzxpa12pgq01i30km5cyp0idi6xy5";
+      name = "plasma-vault-5.21.4.tar.xz";
    };
  };
  plasma-workspace = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-workspace-5.21.3.tar.xz";
-      sha256 = "1djanxc7mslw9hnbzlngf6pflc6byjzqb14ibilg3fxsir2jwq40";
-      name = "plasma-workspace-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-workspace-5.21.4.tar.xz";
+      sha256 = "1m98ssdq4vzhlqazd87qmgryi3fhmp68y47qw95yhaxnf12ih2xs";
+      name = "plasma-workspace-5.21.4.tar.xz";
    };
  };
  plasma-workspace-wallpapers = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-workspace-wallpapers-5.21.3.tar.xz";
-      sha256 = "1qjkk3qfzz1id898kmx7xx6rr6p77y0jfwkjyf26abk51bdfk9lm";
-      name = "plasma-workspace-wallpapers-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-workspace-wallpapers-5.21.4.tar.xz";
+      sha256 = "1myqz90b1fcmzgq08a15mlikn83iv6hflmdw7985419w7cly81n7";
+      name = "plasma-workspace-wallpapers-5.21.4.tar.xz";
    };
  };
  plymouth-kcm = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plymouth-kcm-5.21.3.tar.xz";
-      sha256 = "0wmpvb06z0js50c9jpv61jlxbx9sf1f5lidzs5v4xs31shxc9sbg";
-      name = "plymouth-kcm-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plymouth-kcm-5.21.4.tar.xz";
+      sha256 = "1d0na5831azka04n3j78582i3hy5ns1hpdw24y558rly16w80z60";
+      name = "plymouth-kcm-5.21.4.tar.xz";
    };
  };
  polkit-kde-agent = {
-    version = "1-5.21.3";
+    version = "1-5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/polkit-kde-agent-1-5.21.3.tar.xz";
-      sha256 = "06qpkf01665mjr49wyc3f336g6g7l93k8l35q0yyih58i3v04s0v";
-      name = "polkit-kde-agent-1-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/polkit-kde-agent-1-5.21.4.tar.xz";
+      sha256 = "0lg2ls4fb135p64y3kmkxczrqmqzlzdq4ywsrf58ayi42drghdmj";
+      name = "polkit-kde-agent-1-5.21.4.tar.xz";
    };
  };
  powerdevil = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/powerdevil-5.21.3.tar.xz";
-      sha256 = "0lk6bvc0mym3x3sd85bsvsxvm82vr40lcx355xjycxskf75c5jzz";
-      name = "powerdevil-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/powerdevil-5.21.4.tar.xz";
+      sha256 = "0i84k7dv8nvww0pfly2d7mplydjgzdkh14sd17113rlwzyfp5wf6";
+      name = "powerdevil-5.21.4.tar.xz";
    };
  };
  qqc2-breeze-style = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/qqc2-breeze-style-5.21.3.tar.xz";
-      sha256 = "1ydvirjrkjbwfc2faz74dd9zlmfz18fa3cig143gna9rfr5api54";
-      name = "qqc2-breeze-style-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/qqc2-breeze-style-5.21.4.tar.xz";
+      sha256 = "0ny9i75zm0j4m103kazs6lnny8lcmisgl6kmyvjwsnxfl0wfrdww";
+      name = "qqc2-breeze-style-5.21.4.tar.xz";
    };
  };
  sddm-kcm = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/sddm-kcm-5.21.3.tar.xz";
-      sha256 = "1flqgfpiz66s7dsw1k95zdrbj7ka09r0i2pcdygnrwlls5yvqljz";
-      name = "sddm-kcm-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/sddm-kcm-5.21.4.tar.xz";
+      sha256 = "00940pi4x7is88w6b25f5chqhi97xqvnmn92jzy629p1g8zg75ik";
+      name = "sddm-kcm-5.21.4.tar.xz";
    };
  };
  systemsettings = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/systemsettings-5.21.3.tar.xz";
-      sha256 = "08ynlg282x1klgpd43mh3ng4m579iq9hjlln96fqaw19g7x1i58x";
-      name = "systemsettings-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/systemsettings-5.21.4.tar.xz";
+      sha256 = "017d42fdb8dn1srni4lvdyvraaflybbcwkdgdl98vwyv9hw0qjq3";
+      name = "systemsettings-5.21.4.tar.xz";
    };
  };
  xdg-desktop-portal-kde = {
-    version = "5.21.3";
+    version = "5.21.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/xdg-desktop-portal-kde-5.21.3.tar.xz";
-      sha256 = "05r1kbw39jmj2gfn42052y779l0k89kxh7xynw07igr7c5mxy4ih";
-      name = "xdg-desktop-portal-kde-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/xdg-desktop-portal-kde-5.21.4.tar.xz";
+      sha256 = "01klvbvivw2zd478vj7bq0dn7l5mwsrqhnkj8hd5vc9xcaq6kgzg";
+      name = "xdg-desktop-portal-kde-5.21.4.tar.xz";
    };
  };
 }
--- a/pkgs/development/compilers/adoptopenjdk-bin/jdk-darwin-base.nix
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk-darwin-base.nix
@ -3,6 +3,7 @@
 { swingSupport ? true # not used for now
 , lib, stdenv
 , fetchurl
+, setJavaClassPath
 }:

 let cpuName = stdenv.hostPlatform.parsed.cpu.name;
@ -30,7 +31,11 @@ let cpuName = stdenv.hostPlatform.parsed.cpu.name;

    ln -s $out/Contents/Home/* $out/

+    # Propagate the setJavaClassPath setup hook from the JDK so that
+    # any package that depends on the JDK has $CLASSPATH set up
+    # properly.
    mkdir -p $out/nix-support
+    printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs

    # Set JAVA_HOME automatically.
    cat <<EOF >> $out/nix-support/setup-hook
--- a/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
@ -5,6 +5,7 @@
 , fetchurl
 , autoPatchelfHook
 , makeWrapper
+, setJavaClassPath
 # minimum dependencies
 , alsaLib
 , fontconfig
@ -74,7 +75,11 @@ let result = stdenv.mkDerivation rec {
    # https://github.com/NixOS/nixpkgs/issues/57733
    find "$out" -name 'libfreetype.so*' -delete

+    # Propagate the setJavaClassPath setup hook from the JDK so that
+    # any package that depends on the JDK has $CLASSPATH set up
+    # properly.
    mkdir -p $out/nix-support
+    printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs

    # Set JAVA_HOME automatically.
    cat <<EOF >> "$out/nix-support/setup-hook"
--- a/pkgs/development/compilers/crystal/default.nix
+++ b/pkgs/development/compilers/crystal/default.nix
@ -146,7 +146,7 @@ let
        "CRYSTAL_CONFIG_VERSION=${version}"
      ];

-      LLVM_CONFIG = "${llvmPackages.llvm}/bin/llvm-config";
+      LLVM_CONFIG = "${llvmPackages.llvm.dev}/bin/llvm-config";

      FLAGS = [
        "--release"
--- a/pkgs/development/compilers/dale/default.nix
+++ b/pkgs/development/compilers/dale/default.nix
@ -19,7 +19,7 @@ stdenv.mkDerivation {
    sha256 = "0v4ajrzrqvf279kd7wsd9flrpsav57lzxlwwimk9vnfwh7xpzf9v";
  };

-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [ cmake pkg-config llvm_6.dev ];
  buildInputs = [ libffi llvm_6 ];

  inherit doCheck;
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@ -4,6 +4,7 @@
 , langObjC ? stdenv.targetPlatform.isDarwin
 , langObjCpp ? stdenv.targetPlatform.isDarwin
 , langGo ? false
+, reproducibleBuild ? true
 , profiledCompiler ? false
 , langJit ? false
 , staticCompiler ? false
@ -48,11 +49,15 @@ assert langAda -> gnatboot != null;
 # threadsCross is just for MinGW
 assert threadsCross != null -> stdenv.targetPlatform.isWindows;

+# profiledCompiler builds inject non-determinism in one of the compilation stages.
+# If turned on, we can't provide reproducible builds anymore
+assert reproducibleBuild -> profiledCompiler == false;
+
 with lib;
 with builtins;

 let majorVersion = "10";
-    version = "${majorVersion}.2.0";
+    version = "${majorVersion}.3.0";

    inherit (stdenv) buildPlatform hostPlatform targetPlatform;

@ -85,7 +90,7 @@ stdenv.mkDerivation ({

  src = fetchurl {
    url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = "130xdkhmz1bc2kzx061s3sfwk36xah1fw5w332c0nzwwpdl47pdq";
+    sha256 = "0i6378ig6h397zkhd7m4ccwjx5alvzrf2hm27p1pzwjhlv0h9x34";
  };

  inherit patches;
@ -186,8 +191,7 @@ stdenv.mkDerivation ({

  dontDisableStatic = true;

-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];

  configureFlags = import ../common/configure-flags.nix {
    inherit
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@ -4,6 +4,7 @@
 , langObjCpp ? stdenv.targetPlatform.isDarwin
 , langJava ? false
 , langGo ? false
+, reproducibleBuild ? true
 , profiledCompiler ? false
 , langJit ? false
 , staticCompiler ? false
@ -58,6 +59,10 @@ assert langGo -> langCC;
 # threadsCross is just for MinGW
 assert threadsCross != null -> stdenv.targetPlatform.isWindows;

+# profiledCompiler builds inject non-determinism in one of the compilation stages.
+# If turned on, we can't provide reproducible builds anymore
+assert reproducibleBuild -> profiledCompiler == false;
+
 with lib;
 with builtins;

@ -196,8 +201,7 @@ stdenv.mkDerivation ({

  dontDisableStatic = true;

-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];

  configureFlags = import ../common/configure-flags.nix {
    inherit
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@ -4,6 +4,7 @@
 , langObjCpp ? stdenv.targetPlatform.isDarwin
 , langJava ? false
 , langGo ? false
+, reproducibleBuild ? true
 , profiledCompiler ? false
 , langJit ? false
 , staticCompiler ? false
@ -58,6 +59,10 @@ assert langGo -> langCC;
 # threadsCross is just for MinGW
 assert threadsCross != null -> stdenv.targetPlatform.isWindows;

+# profiledCompiler builds inject non-determinism in one of the compilation stages.
+# If turned on, we can't provide reproducible builds anymore
+assert reproducibleBuild -> profiledCompiler == false;
+
 with lib;
 with builtins;

@ -209,8 +214,7 @@ stdenv.mkDerivation ({

  dontDisableStatic = true;

-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];

  configureFlags = import ../common/configure-flags.nix {
    inherit
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@ -5,6 +5,7 @@
 , langObjCpp ? stdenv.targetPlatform.isDarwin
 , langJava ? false
 , langGo ? false
+, reproducibleBuild ? true
 , profiledCompiler ? false
 , langJit ? false
 , staticCompiler ? false
@ -61,6 +62,10 @@ assert langAda -> gnatboot != null;
 # threadsCross is just for MinGW
 assert threadsCross != null -> stdenv.targetPlatform.isWindows;

+# profiledCompiler builds inject non-determinism in one of the compilation stages.
+# If turned on, we can't provide reproducible builds anymore
+assert reproducibleBuild -> profiledCompiler == false;
+
 with lib;
 with builtins;

@ -232,8 +237,7 @@ stdenv.mkDerivation ({

  dontDisableStatic = true;

-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];

  configureFlags = import ../common/configure-flags.nix {
    inherit
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@ -3,6 +3,7 @@
 , langObjC ? stdenv.targetPlatform.isDarwin
 , langObjCpp ? stdenv.targetPlatform.isDarwin
 , langGo ? false
+, reproducibleBuild ? true
 , profiledCompiler ? false
 , langJit ? false
 , staticCompiler ? false
@ -45,6 +46,10 @@ assert langGo -> langCC;
 # threadsCross is just for MinGW
 assert threadsCross != null -> stdenv.targetPlatform.isWindows;

+# profiledCompiler builds inject non-determinism in one of the compilation stages.
+# If turned on, we can't provide reproducible builds anymore
+assert reproducibleBuild -> profiledCompiler == false;
+
 with lib;
 with builtins;

@ -197,8 +202,7 @@ stdenv.mkDerivation ({

  dontDisableStatic = true;

-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];

  configureFlags = import ../common/configure-flags.nix {
    inherit
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@ -3,6 +3,7 @@
 , langObjC ? stdenv.targetPlatform.isDarwin
 , langObjCpp ? stdenv.targetPlatform.isDarwin
 , langGo ? false
+, reproducibleBuild ? true
 , profiledCompiler ? false
 , langJit ? false
 , staticCompiler ? false
@ -45,6 +46,10 @@ assert langGo -> langCC;
 # threadsCross is just for MinGW
 assert threadsCross != null -> stdenv.targetPlatform.isWindows;

+# profiledCompiler builds inject non-determinism in one of the compilation stages.
+# If turned on, we can't provide reproducible builds anymore
+assert reproducibleBuild -> profiledCompiler == false;
+
 with lib;
 with builtins;

@ -183,8 +188,7 @@ stdenv.mkDerivation ({

  dontDisableStatic = true;

-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];

  configureFlags = import ../common/configure-flags.nix {
    inherit
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@ -5,6 +5,7 @@
 , langObjCpp ? stdenv.targetPlatform.isDarwin
 , langD ? false
 , langGo ? false
+, reproducibleBuild ? true
 , profiledCompiler ? false
 , langJit ? false
 , staticCompiler ? false
@ -54,6 +55,10 @@ assert langAda -> gnatboot != null;
 # threadsCross is just for MinGW
 assert threadsCross != null -> stdenv.targetPlatform.isWindows;

+# profiledCompiler builds inject non-determinism in one of the compilation stages.
+# If turned on, we can't provide reproducible builds anymore
+assert reproducibleBuild -> profiledCompiler == false;
+
 with lib;
 with builtins;

@ -200,8 +205,7 @@ stdenv.mkDerivation ({

  dontDisableStatic = true;

-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];

  configureFlags = import ../common/configure-flags.nix {
    inherit
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@ -44,6 +44,9 @@ let
  crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
  crossDarwin = targetPlatform != hostPlatform && targetPlatform.libc == "libSystem";

+  targetPrefix = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
+                  "${stdenv.targetPlatform.config}-";
+
  crossConfigureFlags =
    # Ensure that -print-prog-name is able to find the correct programs.
    [
@ -112,6 +115,18 @@ let

    # Basic configuration
    ++ [
+      # Force target prefix. The behavior if `--target` and `--host`
+      # are specified is inconsistent: Sometimes specifying `--target`
+      # always causes a prefix to be generated, sometimes it's only
+      # added if the `--host` and `--target` differ. This means that
+      # sometimes there may be a prefix even though nixpkgs doesn't
+      # expect one and sometimes there may be none even though nixpkgs
+      # expects one (since not all information is serialized into the
+      # config attribute). The easiest way out of these problems is to
+      # always set the program prefix, so gcc will conform to our
+      # expectations.
+      "--program-prefix=${targetPrefix}"
+
      (lib.enableFeature enableLTO "lto")
      "--disable-libstdcxx-pch"
      "--without-included-gettext"
--- a/pkgs/development/compilers/ghdl/default.nix
+++ b/pkgs/development/compilers/ghdl/default.nix
@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
  '';

  configureFlags = [ "--enable-synth" ] ++ lib.optional (backend == "llvm")
-    "--with-llvm-config=${llvm}/bin/llvm-config";
+    "--with-llvm-config=${llvm.dev}/bin/llvm-config";

  hardeningDisable = [ "format" ];

--- a/pkgs/development/compilers/intel-graphics-compiler/default.nix
+++ b/pkgs/development/compilers/intel-graphics-compiler/default.nix
@ -18,7 +18,7 @@ let
    inherit spirv-llvm-translator;
  };
  inherit (llvmPkgs) llvm;
-  inherit (if buildWithPatches then opencl-clang else llvmPkgs) clang clang-unwrapped spirv-llvm-translator;
+  inherit (if buildWithPatches then opencl-clang else llvmPkgs) clang libclang spirv-llvm-translator;
  inherit (lib) getVersion optional optionals versionOlder versions;
 in

@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
      ln -s ${clang}/bin/clang $out/
      ln -s clang $out/clang-${versions.major (getVersion clang)}
      ln -s ${opencl-clang}/lib/* $out/
-      ln -s ${clang-unwrapped}/lib/clang/${getVersion clang}/include/opencl-c.h $out/
+      ln -s ${lib.getLib libclang}/lib/clang/${getVersion clang}/include/opencl-c.h $out/
    '';
  };

--- a/pkgs/development/compilers/ispc/default.nix
+++ b/pkgs/development/compilers/ispc/default.nix
@ -28,10 +28,9 @@ stdenv.mkDerivation rec {
    })
  ];

-  nativeBuildInputs = [ cmake which m4 bison flex python3 ];
+  nativeBuildInputs = [ cmake which m4 bison flex python3 llvmPackages.llvm.dev ];
  buildInputs = with llvmPackages; [
-    # we need to link against libclang, so we need the unwrapped
-    llvm llvmPackages.clang-unwrapped
+    llvm llvmPackages.libclang
  ];

  postPatch = ''
@ -66,6 +65,7 @@ stdenv.mkDerivation rec {
  '';

  cmakeFlags = [
+    "-DLLVM_CONFIG_EXECUTABLE=${llvmPackages.llvm.dev}/bin/llvm-config"
    "-DCLANG_EXECUTABLE=${llvmPackages.clang}/bin/clang"
    "-DCLANGPP_EXECUTABLE=${llvmPackages.clang}/bin/clang++"
    "-DISPC_INCLUDE_EXAMPLES=OFF"
--- a/pkgs/development/compilers/ldc/generic.nix
+++ b/pkgs/development/compilers/ldc/generic.nix
@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
  '';

  nativeBuildInputs = [
-    cmake ldcBootstrap lit lit.python llvm_11 makeWrapper ninja unzip
+    cmake ldcBootstrap lit lit.python llvm_11.dev makeWrapper ninja unzip
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    darwin.apple_sdk.frameworks.Foundation
--- a/pkgs/development/compilers/llvm/10/clang/default.nix
+++ b/pkgs/development/compilers/llvm/10/clang/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3, lld
+{ lib, stdenv, fetch, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
+, buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
 }:
@ -18,28 +19,33 @@ let
      mv clang-tools-extra-* $sourceRoot/tools/extra
    '';

-    nativeBuildInputs = [ cmake python3 lld ]
+    nativeBuildInputs = [ cmake python3 ]
      ++ lib.optional enableManpages python3.pkgs.sphinx
      ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;

-    buildInputs = [ libxml2 llvm ];
+    buildInputs = [ libxml2 libllvm ];

    cmakeFlags = [
      "-DCMAKE_CXX_FLAGS=-std=c++14"
      "-DCLANGD_BUILD_XPC=OFF"
      "-DLLVM_ENABLE_RTTI=ON"
+      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
    ] ++ lib.optionals enableManpages [
      "-DCLANG_INCLUDE_DOCS=ON"
      "-DLLVM_ENABLE_SPHINX=ON"
      "-DSPHINX_OUTPUT_MAN=ON"
      "-DSPHINX_OUTPUT_HTML=OFF"
      "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+    ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+      "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
+      "-DCLANG_TABLEGEN=${buildLlvmTools.libclang.dev}/bin/clang-tblgen"
    ];

    patches = [
      ./purity.patch
      # https://reviews.llvm.org/D51899
      ./compiler-rt-baremetal.patch
+      ./gnu-install-dirs.patch
    ];

    postPatch = ''
@ -56,12 +62,12 @@ let
        --replace "NOT HAVE_CXX_ATOMICS64_WITHOUT_LIB" FALSE
    '';

-    outputs = [ "out" "lib" "python" ];
+    outputs = [ "out" "lib" "dev" "python" ];

    # Clang expects to find LLVMgold in its own prefix
    postInstall = ''
-      if [ -e ${llvm}/lib/LLVMgold.so ]; then
-        ln -sv ${llvm}/lib/LLVMgold.so $out/lib
+      if [ -e ${libllvm.lib}/lib/LLVMgold.so ]; then
+        ln -sv ${libllvm.lib}/lib/LLVMgold.so $lib/lib
      fi

      ln -sv $out/bin/clang $out/bin/cpp
@ -80,11 +86,14 @@ let
      fi
      mv $out/share/clang/*.py $python/share/clang
      rm $out/bin/c-index-test
+
+      mkdir -p $dev/bin
+      cp bin/clang-tblgen $dev/bin
    '';

    passthru = {
      isClang = true;
-      inherit llvm;
+      inherit libllvm;
    };

    meta = {
--- a/pkgs/development/compilers/llvm/10/clang/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/10/clang/gnu-install-dirs.patch
@ -0,0 +1,248 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index dc1413f4b597..c173531e624f 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -9,6 +9,8 @@ endif()
+ if( CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR )
+   project(Clang)
+ 
+  include(GNUInstallDirs)
+
+   # Rely on llvm-config.
+   set(CONFIG_OUTPUT)
+   if(LLVM_CONFIG)
+@@ -417,7 +419,7 @@ include_directories(BEFORE
+ 
+ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+   install(DIRECTORY include/clang include/clang-c
+-    DESTINATION include
+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
+     COMPONENT clang-headers
+     FILES_MATCHING
+     PATTERN "*.def"
+@@ -427,7 +429,7 @@ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+     )
+ 
+   install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/include/clang
+-    DESTINATION include
+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
+     COMPONENT clang-headers
+     FILES_MATCHING
+     PATTERN "CMakeFiles" EXCLUDE
+@@ -447,7 +449,7 @@ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+ 
+   add_custom_target(bash-autocomplete DEPENDS utils/bash-autocomplete.sh)
+   install(PROGRAMS utils/bash-autocomplete.sh
+-          DESTINATION share/clang
+          DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+           COMPONENT bash-autocomplete)
+   if(NOT LLVM_ENABLE_IDE)
+     add_llvm_install_targets(install-bash-autocomplete
+diff --git a/cmake/modules/AddClang.cmake b/cmake/modules/AddClang.cmake
+index 577cc11ab015..a4f4481d8442 100644
+--- a/cmake/modules/AddClang.cmake
+++ b/cmake/modules/AddClang.cmake
+@@ -114,9 +114,9 @@ macro(add_clang_library name)
+       install(TARGETS ${name}
+         COMPONENT ${name}
+         ${export_to_clangtargets}
+-        LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-        ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-        RUNTIME DESTINATION bin)
+        LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
+        ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
+        RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
+ 
+       if (NOT LLVM_ENABLE_IDE)
+         add_llvm_install_targets(install-${name}
+@@ -160,7 +160,7 @@ macro(add_clang_tool name)
+ 
+     install(TARGETS ${name}
+       ${export_to_clangtargets}
+-      RUNTIME DESTINATION bin
+      RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
+       COMPONENT ${name})
+ 
+     if(NOT LLVM_ENABLE_IDE)
+@@ -175,7 +175,7 @@ endmacro()
+ macro(add_clang_symlink name dest)
+   add_llvm_tool_symlink(${name} ${dest} ALWAYS_GENERATE)
+   # Always generate install targets
+-  llvm_install_symlink(${name} ${dest} ALWAYS_GENERATE)
+  llvm_install_symlink(${name} ${dest} ${CMAKE_INSTALL_FULL_BINDIR} ALWAYS_GENERATE)
+ endmacro()
+ 
+ function(clang_target_link_libraries target type)
+diff --git a/lib/Headers/CMakeLists.txt b/lib/Headers/CMakeLists.txt
+index 85c3124234ad..64c48235d914 100644
+--- a/lib/Headers/CMakeLists.txt
+++ b/lib/Headers/CMakeLists.txt
+@@ -191,7 +191,7 @@ set_target_properties(clang-resource-headers PROPERTIES
+   FOLDER "Misc"
+   RUNTIME_OUTPUT_DIRECTORY "${output_dir}")
+ 
+-set(header_install_dir lib${LLVM_LIBDIR_SUFFIX}/clang/${CLANG_VERSION}/include)
+set(header_install_dir ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/clang/${CLANG_VERSION}/include)
+ 
+ install(
+   FILES ${files} ${generated_files}
+diff --git a/tools/c-index-test/CMakeLists.txt b/tools/c-index-test/CMakeLists.txt
+index ceef4b08637c..8efad5520ca4 100644
+--- a/tools/c-index-test/CMakeLists.txt
+++ b/tools/c-index-test/CMakeLists.txt
+@@ -54,7 +54,7 @@ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+     set_property(TARGET c-index-test APPEND PROPERTY INSTALL_RPATH
+        "@executable_path/../../lib")
+   else()
+-    set(INSTALL_DESTINATION bin)
+    set(INSTALL_DESTINATION ${CMAKE_INSTALL_BINDIR})
+   endif()
+ 
+   install(TARGETS c-index-test
+diff --git a/tools/clang-format/CMakeLists.txt b/tools/clang-format/CMakeLists.txt
+index 35ecdb11253c..d77d75de0094 100644
+--- a/tools/clang-format/CMakeLists.txt
+++ b/tools/clang-format/CMakeLists.txt
+@@ -21,20 +21,20 @@ if( LLVM_LIB_FUZZING_ENGINE OR LLVM_USE_SANITIZE_COVERAGE )
+ endif()
+ 
+ install(PROGRAMS clang-format-bbedit.applescript
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-format)
+ install(PROGRAMS clang-format-diff.py
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-format)
+ install(PROGRAMS clang-format-sublime.py
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-format)
+ install(PROGRAMS clang-format.el
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-format)
+ install(PROGRAMS clang-format.py
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-format)
+ install(PROGRAMS git-clang-format
+-  DESTINATION bin
+  DESTINATION ${CMAKE_INSTALL_BINDIR}
+   COMPONENT clang-format)
+diff --git a/tools/clang-rename/CMakeLists.txt b/tools/clang-rename/CMakeLists.txt
+index cda8e29ec5b1..0134d8ccd70b 100644
+--- a/tools/clang-rename/CMakeLists.txt
+++ b/tools/clang-rename/CMakeLists.txt
+@@ -19,8 +19,8 @@ clang_target_link_libraries(clang-rename
+   )
+ 
+ install(PROGRAMS clang-rename.py
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-rename)
+ install(PROGRAMS clang-rename.el
+-  DESTINATION share/clang
+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
+   COMPONENT clang-rename)
+diff --git a/tools/diagtool/CMakeLists.txt b/tools/diagtool/CMakeLists.txt
+index a95444be40ee..136d96d9bf5b 100644
+--- a/tools/diagtool/CMakeLists.txt
+++ b/tools/diagtool/CMakeLists.txt
+@@ -21,7 +21,7 @@ clang_target_link_libraries(diagtool
+ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
+   install(TARGETS diagtool
+     COMPONENT diagtool
+-    RUNTIME DESTINATION bin)
+    RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
+ 
+   if (NOT LLVM_ENABLE_IDE)
+     add_llvm_install_targets(install-diagtool
+diff --git a/tools/libclang/CMakeLists.txt b/tools/libclang/CMakeLists.txt
+index 973655361f71..0181002e4e3b 100644
+--- a/tools/libclang/CMakeLists.txt
+++ b/tools/libclang/CMakeLists.txt
+@@ -141,7 +141,7 @@ endif()
+ if(INTERNAL_INSTALL_PREFIX)
+   set(LIBCLANG_HEADERS_INSTALL_DESTINATION "${INTERNAL_INSTALL_PREFIX}/include")
+ else()
+-  set(LIBCLANG_HEADERS_INSTALL_DESTINATION include)
+  set(LIBCLANG_HEADERS_INSTALL_DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
+ endif()
+ 
+ install(DIRECTORY ../../include/clang-c
+@@ -172,7 +172,7 @@ foreach(PythonVersion ${CLANG_PYTHON_BINDINGS_VERSIONS})
+           COMPONENT
+             libclang-python-bindings
+           DESTINATION
+-            "lib${LLVM_LIBDIR_SUFFIX}/python${PythonVersion}/site-packages")
+            "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/python${PythonVersion}/site-packages")
+ endforeach()
+ if(NOT LLVM_ENABLE_IDE)
+   add_custom_target(libclang-python-bindings)
+diff --git a/tools/scan-build/CMakeLists.txt b/tools/scan-build/CMakeLists.txt
+index 28241245fcb7..d6b59f02fc2a 100644
+--- a/tools/scan-build/CMakeLists.txt
+++ b/tools/scan-build/CMakeLists.txt
+@@ -42,7 +42,7 @@ if(CLANG_INSTALL_SCANBUILD)
+                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/bin/${BinFile})
+     list(APPEND Depends ${CMAKE_BINARY_DIR}/bin/${BinFile})
+     install(PROGRAMS bin/${BinFile}
+-            DESTINATION bin
+            DESTINATION ${CMAKE_INSTALL_BINDIR}
+             COMPONENT scan-build)
+   endforeach()
+ 
+@@ -56,7 +56,7 @@ if(CLANG_INSTALL_SCANBUILD)
+                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/libexec/${LibexecFile})
+     list(APPEND Depends ${CMAKE_BINARY_DIR}/libexec/${LibexecFile})
+     install(PROGRAMS libexec/${LibexecFile}
+-            DESTINATION libexec
+            DESTINATION ${CMAKE_INSTALL_LIBEXECDIR}
+             COMPONENT scan-build)
+   endforeach()
+ 
+@@ -84,7 +84,7 @@ if(CLANG_INSTALL_SCANBUILD)
+                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/share/scan-build/${ShareFile})
+     list(APPEND Depends ${CMAKE_BINARY_DIR}/share/scan-build/${ShareFile})
+     install(FILES share/scan-build/${ShareFile}
+-            DESTINATION share/scan-build
+            DESTINATION ${CMAKE_INSTALL_DATADIR}/scan-build
+             COMPONENT scan-build)
+   endforeach()
+ 
+diff --git a/tools/scan-view/CMakeLists.txt b/tools/scan-view/CMakeLists.txt
+index 22edb974bac7..9f140a9a4538 100644
+--- a/tools/scan-view/CMakeLists.txt
+++ b/tools/scan-view/CMakeLists.txt
+@@ -22,7 +22,7 @@ if(CLANG_INSTALL_SCANVIEW)
+                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/bin/${BinFile})
+     list(APPEND Depends ${CMAKE_BINARY_DIR}/bin/${BinFile})
+     install(PROGRAMS bin/${BinFile}
+-            DESTINATION bin
+            DESTINATION ${CMAKE_INSTALL_BINDIR}
+             COMPONENT scan-view)
+   endforeach()
+ 
+@@ -36,7 +36,7 @@ if(CLANG_INSTALL_SCANVIEW)
+                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/share/${ShareFile})
+     list(APPEND Depends ${CMAKE_BINARY_DIR}/share/scan-view/${ShareFile})
+     install(FILES share/${ShareFile}
+-            DESTINATION share/scan-view
+            DESTINATION ${CMAKE_INSTALL_DATADIR}/scan-view
+             COMPONENT scan-view)
+   endforeach()
+ 
+diff --git a/utils/hmaptool/CMakeLists.txt b/utils/hmaptool/CMakeLists.txt
+index 62f2de0cb15c..6aa66825b6ec 100644
+--- a/utils/hmaptool/CMakeLists.txt
+++ b/utils/hmaptool/CMakeLists.txt
+@@ -10,7 +10,7 @@ add_custom_command(OUTPUT ${CMAKE_BINARY_DIR}/${CMAKE_CFG_INTDIR}/bin/${CLANG_HM
+ 
+ list(APPEND Depends ${CMAKE_BINARY_DIR}/${CMAKE_CFG_INTDIR}/bin/${CLANG_HMAPTOOL})
+ install(PROGRAMS ${CLANG_HMAPTOOL}
+-        DESTINATION bin
+        DESTINATION ${CMAKE_INSTALL_BINDIR}
+         COMPONENT hmaptool)
+ 
+ add_custom_target(hmaptool ALL DEPENDS ${Depends})
--- a/Show more
+++ b/Show more