Merge remote-tracking branch 'origin/staging' into staging-next

doc/languages-frameworks/python.section.md

@@ -765,7 +765,7 @@ and in this case the `python38` interpreter is automatically used.
 ### Interpreters {#interpreters}
 
 Versions 2.7, 3.6, 3.7, 3.8 and 3.9 of the CPython interpreter are available as
-respectively `python27`, `python36`, `python37`, `python38` and `python39`. The
+respectively `python27`, `python37`, `python38` and `python39`. The
 aliases `python2` and `python3` correspond to respectively `python27` and
 `python39`. The attribute `python` maps to `python2`. The PyPy interpreters
 compatible with Python 2.7 and 3 are available as `pypy27` and `pypy3`, with
@@ -830,10 +830,10 @@ attribute set is created for each available Python interpreter. The available
 sets are
 
 * `pkgs.python27Packages`
-* `pkgs.python36Packages`
 * `pkgs.python37Packages`
 * `pkgs.python38Packages`
 * `pkgs.python39Packages`
+* `pkgs.python310Packages`
 * `pkgs.pypyPackages`
 
 and the aliases

nixos/doc/manual/from_md/release-notes/rl-2111.section.xml

@@ -15,6 +15,12 @@
   <section xml:id="sec-release-21.11-highlights">
     <title>Highlights</title>
     <itemizedlist>
+      <listitem>
+        <para>
+          <literal>iptables</literal> now uses
+          <literal>nf_tables</literal> backend.
+        </para>
+      </listitem>
       <listitem>
         <para>
           PHP now defaults to PHP 8.0, updated from 7.4.
@@ -373,6 +379,14 @@
           nobody/nogroup, which is unsafe.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          Since <literal>iptables</literal> now uses
+          <literal>nf_tables</literal> backend and
+          <literal>ipset</literal> doesn’t support it, some applications
+          (ferm, shorewall, firehol) may have limited functionality.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The <literal>paperless</literal> module and package have been

nixos/doc/manual/release-notes/rl-2111.section.md

@@ -6,6 +6,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 ## Highlights {#sec-release-21.11-highlights}
 
+- `iptables` now uses `nf_tables` backend.
+
 - PHP now defaults to PHP 8.0, updated from 7.4.
 
 - kOps now defaults to 1.21.1, which uses containerd as the default runtime.
@@ -114,6 +116,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 - The `security.wrappers` option now requires to always specify an owner, group and whether the setuid/setgid bit should be set.
   This is motivated by the fact that before NixOS 21.11, specifying either setuid or setgid but not owner/group resulted in wrappers owned by nobody/nogroup, which is unsafe.
 
+- Since `iptables` now uses `nf_tables` backend and `ipset` doesn't support it, some applications (ferm, shorewall, firehol) may have limited functionality.
+
 - The `paperless` module and package have been removed. All users should migrate to the
   successor `paperless-ng` instead. The Paperless project [has been
   archived](https://github.com/the-paperless-project/paperless/commit/9b0063c9731f7c5f65b1852cb8caff97f5e40ba4)

nixos/modules/hardware/printers.nix

@@ -116,19 +116,14 @@ in {
       description = "Ensure NixOS-configured CUPS printers";
       wantedBy = [ "multi-user.target" ];
       requires = [ cupsUnit ];
-      # in contrast to cups.socket, for cups.service, this is actually not enough,
-      # as the cups service reports its activation before clients can actually interact with it.
-      # Because of this, commands like `lpinfo -v` will report a bad file descriptor
-      # due to the missing UNIX socket without sufficient sleep time.
       after = [ cupsUnit ];
 
       serviceConfig = {
         Type = "oneshot";
+        RemainAfterExit = true;
       };
 
-       # sleep 10 is required to wait until cups.service is actually initialized and has created its UNIX socket file
-      script = (optionalString (!config.services.printing.startWhenNeeded) "sleep 10\n")
-        + (concatMapStringsSep "\n" ensurePrinter cfg.ensurePrinters)
+      script = concatMapStringsSep "\n" ensurePrinter cfg.ensurePrinters
         + optionalString (cfg.ensureDefaultPrinter != null) (ensureDefaultPrinter cfg.ensureDefaultPrinter);
     };
   };

nixos/modules/security/ca.nix

@@ -8,12 +8,10 @@ let
 
   cacertPackage = pkgs.cacert.override {
     blacklist = cfg.caCertificateBlacklist;
+    extraCertificateFiles = cfg.certificateFiles;
+    extraCertificateStrings = cfg.certificates;
   };
-
-  caCertificates = pkgs.runCommand "ca-certificates.crt" {
-    files = cfg.certificateFiles ++ [ (builtins.toFile "extra.crt" (concatStringsSep "\n" cfg.certificates)) ];
-    preferLocalBuild = true;
-  } "awk 1 $files > $out";  # awk ensures a newline between each pair of consecutive files
+  caBundle = "${cacertPackage}/etc/ssl/certs/ca-bundle.crt";
 
 in
 
@@ -74,16 +72,17 @@ in
 
   config = {
 
-    security.pki.certificateFiles = [ "${cacertPackage}/etc/ssl/certs/ca-bundle.crt" ];
-
     # NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility.
-    environment.etc."ssl/certs/ca-certificates.crt".source = caCertificates;
+    environment.etc."ssl/certs/ca-certificates.crt".source = caBundle;
 
     # Old NixOS compatibility.
-    environment.etc."ssl/certs/ca-bundle.crt".source = caCertificates;
+    environment.etc."ssl/certs/ca-bundle.crt".source = caBundle;
 
     # CentOS/Fedora compatibility.
-    environment.etc."pki/tls/certs/ca-bundle.crt".source = caCertificates;
+    environment.etc."pki/tls/certs/ca-bundle.crt".source = caBundle;
+
+    # P11-Kit trust source.
+    environment.etc."ssl/trust-source".source = "${cacertPackage.p11kit}/etc/ssl/trust-source";
 
   };
 

nixos/modules/services/networking/networkmanager.nix

@@ -502,13 +502,6 @@ in {
 
     systemd.services.ModemManager.aliases = [ "dbus-org.freedesktop.ModemManager1.service" ];
 
-    # override unit as recommended by upstream - see https://github.com/NixOS/nixpkgs/issues/88089
-    # TODO: keep an eye on modem-manager releases as this will eventually be added to the upstream unit
-    systemd.services.ModemManager.serviceConfig.ExecStart = [
-      ""
-      "${pkgs.modemmanager}/sbin/ModemManager --filter-policy=STRICT"
-    ];
-
     systemd.services.NetworkManager-dispatcher = {
       wantedBy = [ "network.target" ];
       restartTriggers = [ configFile overrideNameserversScript ];

nixos/modules/virtualisation/libvirtd.nix

@@ -168,7 +168,7 @@ in {
       etc."qemu/bridge.conf".text = lib.concatMapStringsSep "\n" (e:
         "allow ${e}") cfg.allowedBridges;
       systemPackages = with pkgs; [ libressl.nc iptables cfg.package cfg.qemuPackage ];
-      etc.ethertypes.source = "${pkgs.ebtables}/etc/ethertypes";
+      etc.ethertypes.source = "${pkgs.iptables}/etc/ethertypes";
     };
 
     boot.kernelModules = [ "tun" ];

nixos/tests/all-tests.nix

@@ -430,6 +430,7 @@ in
   systemd-binfmt = handleTestOn ["x86_64-linux"] ./systemd-binfmt.nix {};
   systemd-boot = handleTest ./systemd-boot.nix {};
   systemd-confinement = handleTest ./systemd-confinement.nix {};
+  systemd-cryptenroll = handleTest ./systemd-cryptenroll.nix {};
   systemd-journal = handleTest ./systemd-journal.nix {};
   systemd-networkd = handleTest ./systemd-networkd.nix {};
   systemd-networkd-dhcpserver = handleTest ./systemd-networkd-dhcpserver.nix {};

nixos/tests/custom-ca.nix

@@ -109,9 +109,7 @@ in
 
       environment.systemPackages = with pkgs; [
         xdotool
-        # Firefox was disabled here, because we needed to disable p11-kit support in nss,
-        # which is why it will not use the system certificate store for the time being.
-        # firefox
+        firefox
         chromium
         qutebrowser
         midori
@@ -153,9 +151,7 @@ in
         machine.fail("curl -fv https://bad.example.com")
 
     browsers = {
-      # Firefox was disabled here, because we needed to disable p11-kit support in nss,
-      # which is why it will not use the system certificate store for the time being.
-      #"firefox": "Security Risk",
+      "firefox": "Security Risk",
       "chromium": "not private",
       "qutebrowser -T": "Certificate error",
       "midori": "Security"

nixos/tests/printing.nix

@@ -53,18 +53,10 @@ in {
 
     start_all()
 
-    with subtest("Make sure that cups is up on both sides"):
+    with subtest("Make sure that cups is up on both sides and printers are set up"):
         serviceServer.wait_for_unit("cups.service")
         serviceClient.wait_for_unit("cups.service")
-
-    with subtest(
-        "Wait until cups is fully initialized and ensure-printers has "
-        "executed with 10s delay"
-    ):
-        serviceClient.sleep(20)
-        socketActivatedClient.wait_until_succeeds(
-            "systemctl show ensure-printers | grep -q -E 'code=exited ; status=0'"
-        )
+        socketActivatedClient.wait_for_unit("ensure-printers.service")
 
 
     def test_printing(client, server):

nixos/tests/systemd-cryptenroll.nix

@@ -0,0 +1,55 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "systemd-cryptenroll";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ymatsiuk ];
+  };
+
+  machine = { pkgs, lib, ... }: {
+    environment.systemPackages = [ pkgs.cryptsetup ];
+    virtualisation = {
+      emptyDiskImages = [ 512 ];
+      memorySize = 1024;
+      qemu.options = [
+        "-chardev socket,id=chrtpm,path=/tmp/swtpm-sock"
+        "-tpmdev emulator,id=tpm0,chardev=chrtpm"
+        "-device tpm-tis,tpmdev=tpm0"
+      ];
+    };
+  };
+
+  testScript = ''
+    import subprocess
+    import tempfile
+
+    def start_swtpm(tpmstate):
+        subprocess.Popen(["${pkgs.swtpm}/bin/swtpm", "socket", "--tpmstate", "dir="+tpmstate, "--ctrl", "type=unixio,path=/tmp/swtpm-sock", "--log", "level=0", "--tpm2"])
+
+    with tempfile.TemporaryDirectory() as tpmstate:
+        start_swtpm(tpmstate)
+        machine.start()
+
+        # Verify the TPM device is available and accessible by systemd-cryptenroll
+        machine.succeed("test -e /dev/tpm0")
+        machine.succeed("test -e /dev/tpmrm0")
+        machine.succeed("systemd-cryptenroll --tpm2-device=list")
+
+        # Create LUKS partition
+        machine.succeed("echo -n lukspass | cryptsetup luksFormat -q /dev/vdb -")
+        # Enroll new LUKS key and bind it to Secure Boot state
+        # For more details on PASSWORD variable, check the following issue:
+        # https://github.com/systemd/systemd/issues/20955
+        machine.succeed("PASSWORD=lukspass systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 /dev/vdb")
+        # Add LUKS partition to /etc/crypttab to test auto unlock
+        machine.succeed("echo 'luks /dev/vdb - tpm2-device=auto' >> /etc/crypttab")
+        machine.shutdown()
+
+        start_swtpm(tpmstate)
+        machine.start()
+
+        # Test LUKS partition automatic unlock on boot
+        machine.wait_for_unit("systemd-cryptsetup@luks.service")
+        # Wipe TPM2 slot
+        machine.succeed("systemd-cryptenroll --wipe-slot=tpm2 /dev/vdb")
+  '';
+})
+

pkgs/applications/audio/bambootracker/default.nix

@@ -30,13 +30,9 @@ mkDerivation rec {
 
   postConfigure = "make qmake_all";
 
-  # 1. installs app bundle on darwin, move to app bundle dir & link binary to bin
-  # 2. wrapQtAppsHook fails to wrap mach-o binaries automatically, manually call wrapper
-  #    (see https://github.com/NixOS/nixpkgs/issues/102044)
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir -p $out/Applications
     mv $out/{bin,Applications}/BambooTracker.app
-    wrapQtApp $out/Applications/BambooTracker.app/Contents/MacOS/BambooTracker
     ln -s $out/{Applications/BambooTracker.app/Contents/MacOS,bin}/BambooTracker
   '';
 

pkgs/applications/audio/fluidsynth/default.nix

@@ -11,8 +11,8 @@ let
       sha256 = "0n75jq3xgq46hfmjkaaxz3gic77shs4fzajq40c8gk043i84xbdh";
     };
     "2" = {
-      fluidsynthVersion = "2.0.6";
-      sha256 = "0nas9pp9r8rnziznxm65x2yzf1ryg98zr3946g0br3s38sjf8l3a";
+      fluidsynthVersion = "2.2.3";
+      sha256 = "0x5808d03ym23np17nl8gfbkx3c4y3d7jyyr2222wn2prswbb6x3";
     };
   };
 in

pkgs/applications/audio/munt/default.nix

@@ -36,7 +36,6 @@ mkDerivation rec {
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir $out/Applications
     mv $out/bin/${mainProgram}.app $out/Applications/
-    wrapQtApp $out/Applications/${mainProgram}.app/Contents/MacOS/${mainProgram}
     ln -s $out/{Applications/${mainProgram}.app/Contents/MacOS,bin}/${mainProgram}
   '';
 

pkgs/applications/editors/mindforger/default.nix

@@ -52,7 +52,6 @@ stdenv.mkDerivation rec {
   postInstall = lib.optionalString stdenv.isDarwin ''
     mkdir "$out"/Applications
     mv app/mindforger.app "$out"/Applications/
-    wrapQtApp "$out"/Applications/mindforger.app/Contents/MacOS/mindforger
   '';
 
   meta = with lib; {

pkgs/applications/gis/openorienteering-mapper/default.nix

@@ -76,9 +76,6 @@ mkDerivation rec {
   postInstall = with stdenv; lib.optionalString isDarwin ''
     mkdir -p $out/Applications
     mv $out/Mapper.app $out/Applications
-    # Fixes "This application failed to start because it could not find or load the Qt
-    # platform plugin "cocoa"."
-    wrapQtApp $out/Applications/Mapper.app/Contents/MacOS/Mapper
     mkdir -p $out/bin
     ln -s $out/Applications/Mapper.app/Contents/MacOS/Mapper $out/bin/mapper
   '';

pkgs/applications/graphics/fbida/default.nix

@@ -10,6 +10,15 @@ stdenv.mkDerivation rec {
     sha256 = "0f242mix20rgsqz1llibhsz4r2pbvx6k32rmky0zjvnbaqaw1dwm";
   };
 
+  patches = [
+    # Upstream patch to fix build on -fno-common toolchains.
+    (fetchurl {
+      name = "no-common.patch";
+      url = "https://git.kraxel.org/cgit/fbida/patch/?id=1bb8a8aa29845378903f3c690e17c0867c820da2";
+      sha256 = "0n5vqbp8wd87q60zfwdf22jirggzngypc02ha34gsj1rd6pvwahi";
+    })
+  ];
+
   nativeBuildInputs = [ pkg-config which ];
   buildInputs = [
     libexif libjpeg libpng giflib freetype fontconfig libtiff libwebp
@@ -19,7 +28,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "prefix=$(out)" "verbose=yes" "STRIP=" "JPEG_VER=62" ];
 
-  patchPhase = ''
+  postPatch = ''
     sed -e 's@ cpp\>@ gcc -E -@' -i GNUmakefile
     sed -e 's@$(HAVE_LINUX_FB_H)@yes@' -i GNUmakefile
   '';

pkgs/applications/graphics/openscad/default.nix

@@ -65,8 +65,6 @@ mkDerivation rec {
     mv $out/bin/*.app $out/Applications
     rmdir $out/bin || true
 
-    wrapQtApp "$out"/Applications/OpenSCAD.app/Contents/MacOS/OpenSCAD
-
     mv --target-directory=$out/Applications/OpenSCAD.app/Contents/Resources \
       $out/share/openscad/{examples,color-schemes,locale,libraries,fonts,templates}
 

pkgs/applications/kde/fetch.sh

@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/release-service/21.08.1/src -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/release-service/21.08.2/src -A '*.tar.xz' )

pkgs/applications/misc/goldendict/default.nix

@@ -56,7 +56,6 @@ mkDerivation rec {
   postInstall = lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/Applications
     mv GoldenDict.app $out/Applications
-    wrapQtApp $out/Applications/GoldenDict.app/Contents/MacOS/GoldenDict
   '';
 
   meta = with lib; {

pkgs/applications/misc/gpxlab/default.nix

@@ -28,7 +28,6 @@ mkDerivation rec {
   postInstall = lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/Applications
     mv GPXLab/GPXLab.app $out/Applications
-    wrapQtApp $out/Applications/GPXLab.app/Contents/MacOS/GPXLab
   '';
 
   meta = with lib; {

pkgs/applications/misc/gpxsee/default.nix

@@ -26,7 +26,6 @@ mkDerivation rec {
   postInstall = with stdenv; lib.optionalString isDarwin ''
     mkdir -p $out/Applications
     mv GPXSee.app $out/Applications
-    wrapQtApp $out/Applications/GPXSee.app/Contents/MacOS/GPXSee
   '';
 
   meta = with lib; {

pkgs/applications/misc/keepassx/community.nix

@@ -115,11 +115,6 @@ stdenv.mkDerivation rec {
   ++ optional (stdenv.isDarwin && withKeePassTouchID)
     darwin.apple_sdk.frameworks.LocalAuthentication;
 
-  preFixup = optionalString stdenv.isDarwin ''
-    # Make it work without Qt in PATH.
-    wrapQtApp $out/Applications/KeePassXC.app/Contents/MacOS/KeePassXC
-  '';
-
   passthru.tests = nixosTests.keepassxc;
 
   meta = {

pkgs/applications/misc/lsd2dsl/default.nix

@@ -30,9 +30,6 @@ mkDerivation rec {
 
   installPhase = ''
     install -Dm755 console/lsd2dsl gui/lsd2dsl-qtgui -t $out/bin
-  '' + lib.optionalString stdenv.isDarwin ''
-    wrapQtApp $out/bin/lsd2dsl
-    wrapQtApp $out/bin/lsd2dsl-qtgui
   '';
 
   meta = with lib; {

pkgs/applications/misc/merkaartor/default.nix

@@ -50,7 +50,6 @@ mkDerivation rec {
     mkdir -p $out/Applications
     mv binaries/bin/merkaartor.app $out/Applications
     mv binaries/bin/plugins $out/Applications/merkaartor.app/Contents
-    wrapQtApp $out/Applications/merkaartor.app/Contents/MacOS/merkaartor
   '';
 
   meta = with lib; {

pkgs/applications/misc/multibootusb/default.nix

@@ -1,6 +1,6 @@
 { fetchFromGitHub, libxcb, mtools, p7zip, parted, procps, qemu, unzip, zip,
   coreutils, gnugrep, which, gnused, e2fsprogs, autoPatchelfHook, gptfdisk,
-  python36Packages, qt5, runtimeShell, lib, util-linux, wrapQtAppsHook }:
+  python3Packages, qt5, runtimeShell, lib, util-linux, wrapQtAppsHook }:
 
 # Note: Multibootusb is tricky to maintain. It relies on the
 # $PYTHONPATH variable containing some of their code, so that
@@ -13,7 +13,7 @@
 #
 # https://github.com/mbusb/multibootusb/blob/0d34d70c3868f1d7695cfd141141b17c075de967/scripts/osdriver.py#L59
 
-python36Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "multibootusb";
   name = "${pname}-${version}";
   version = "9.2.0";
@@ -42,7 +42,7 @@ python36Packages.buildPythonApplication rec {
 
   buildInputs = [
     libxcb
-    python36Packages.python
+    python3Packages.python
     qt5.full
   ];
 
@@ -58,12 +58,12 @@ python36Packages.buildPythonApplication rec {
   # "Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory"
   doCheck = false;
 
-  pythonPath = [
-    python36Packages.dbus-python
-    python36Packages.pyqt5
-    python36Packages.pytest-shutil
-    python36Packages.pyudev
-    python36Packages.six
+  pythonPath = with python3Packages; [
+    dbus-python
+    pyqt5
+    pytest-shutil
+    pyudev
+    six
   ];
 
   # multibootusb ships zips with various versions of syslinux, we need to patchelf them
@@ -95,7 +95,7 @@ python36Packages.buildPythonApplication rec {
       "''${qtWrapperArgs[@]}"
 
       # Then, add the installed scripts/ directory to the python path
-      --prefix "PYTHONPATH" ":" "$out/lib/${python36Packages.python.libPrefix}/site-packages"
+      --prefix "PYTHONPATH" ":" "$out/lib/${python3Packages.python.libPrefix}/site-packages"
 
       # Add some runtime dependencies
       --prefix "PATH" ":" "${lib.makeBinPath runTimeDeps}"

pkgs/applications/misc/sleepyhead/default.nix

@@ -33,10 +33,6 @@ in mkDerivation {
     cp sleepyhead/SleepyHead $out/bin
   '';
 
-  postFixup = lib.optionalString stdenv.isDarwin ''
-    wrapQtApp "$out/Applications/SleepyHead.app/Contents/MacOS/SleepyHead"
-  '';
-
   meta = with lib; {
     homepage = "https://sleepyhead.jedimark.net/";
     description = "Review and explore data produced by CPAP and related machines";

pkgs/applications/misc/xpdf/default.nix

@@ -51,11 +51,6 @@ stdenv.mkDerivation rec {
     install -Dm644 $src/xpdf-qt/xpdf-icon.svg $out/share/pixmaps/xpdf.svg
   '';
 
-  # wrapQtAppsHook broken on macOS (https://github.com/NixOS/nixpkgs/issues/102044)
-  postFixup = lib.optionalString stdenv.isDarwin ''
-    wrapQtApp $out/bin/xpdf
-  '';
-
   meta = with lib; {
     homepage = "https://www.xpdfreader.com";
     description = "Viewer for Portable Document Format (PDF) files";

pkgs/applications/networking/browsers/firefox/common.nix

@@ -117,9 +117,7 @@ let
                 then overrideCC stdenv llvmPackages.clangUseLLVM
                 else stdenv;
 
-  # Disable p11-kit support in nss until our cacert packages has caught up exposing CKA_NSS_MOZILLA_CA_POLICY
-  # https://github.com/NixOS/nixpkgs/issues/126065
-  nss_pkg = if lib.versionOlder version "83" then nss_3_53 else nss.override { useP11kit = false; };
+  nss_pkg = if lib.versionOlder version "83" then nss_3_53 else nss;
 
   # --enable-release adds -ffunction-sections & LTO that require a big amount of
   # RAM and the 32-bit memory space cannot handle that linking

pkgs/applications/networking/cluster/k3s/default.nix

@@ -13,7 +13,6 @@
 , pkg-config
 , ethtool
 , util-linux
-, ipset
 , fetchFromGitHub
 , fetchurl
 , fetchzip
@@ -254,7 +253,6 @@ stdenv.mkDerivation rec {
     bridge-utils
     ethtool
     util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
-    ipset
     conntrack-tools
   ];
 

pkgs/applications/networking/firehol/default.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, pkgs
-, autoconf, automake, curl, iprange, iproute2, ipset, iptables, iputils
+, autoconf, automake, curl, iprange, iproute2, iptables, iputils
 , kmod, nettools, procps, tcpdump, traceroute, util-linux, whois
 
 # If true, just install FireQOS without FireHOL
@@ -35,13 +35,14 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoconf automake ];
   buildInputs = [
-    curl iprange iproute2 ipset iptables iputils kmod
+    curl iprange iproute2 iptables iputils kmod
     nettools procps tcpdump traceroute util-linux whois
   ];
 
   preConfigure = "./autogen.sh";
   configureFlags = [ "--localstatedir=/var"
-                     "--disable-doc" "--disable-man" ] ++
+                     "--disable-doc" "--disable-man"
+                     "--disable-update-ipsets" ] ++
                    lib.optional onlyQOS [ "--disable-firehol" ];
 
   meta = with lib; {

pkgs/applications/networking/instant-messengers/chatterino2/default.nix

@@ -16,9 +16,6 @@ mkDerivation rec {
     mkdir -p "$out/Applications"
     mv bin/chatterino.app "$out/Applications/"
   '';
-  postFixup = lib.optionalString stdenv.isDarwin ''
-    wrapQtApp "$out/Applications/chatterino.app/Contents/MacOS/chatterino"
-  '';
   meta = with lib; {
     description = "A chat client for Twitch chat";
     longDescription = ''

pkgs/applications/networking/instant-messengers/tensor/default.nix

@@ -34,7 +34,6 @@ mkDerivation rec {
 
     mkdir -p $out/Applications
     cp -r tensor.app $out/Applications/tensor.app
-    wrapQtApp $out/Applications/tensor.app/Contents/MacOS/tensor
 
     runHook postInstall
   '' else ''

pkgs/applications/networking/irc/communi/default.nix

@@ -38,8 +38,6 @@ stdenv.mkDerivation rec {
     install_name_tool \
       -add_rpath @executable_path/../Frameworks \
       $out/Applications/Communi.app/Contents/MacOS/Communi
-
-    wrapQtApp $out/Applications/Communi.app/Contents/MacOS/Communi
   '' else ''
     substituteInPlace "$out/share/applications/communi.desktop" \
       --replace "/usr/bin" "$out/bin"

pkgs/applications/networking/sniffers/wireshark/default.nix

@@ -66,8 +66,6 @@ in stdenv.mkDerivation {
             install_name_tool -change "$dylib" "$out/lib/$dylib" "$f"
         done
     done
-
-    wrapQtApp $out/Applications/Wireshark.app/Contents/MacOS/Wireshark
   '' else optionalString withQt ''
     install -Dm644 -t $out/share/applications ../wireshark.desktop
 

pkgs/applications/office/beamerpresenter/default.nix

@@ -37,10 +37,6 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  postInstall = lib.optionalString stdenv.isDarwin ''
-    wrapQtApp "$out"/bin/beamerpresenter.app/Contents/MacOS/beamerpresenter
-  '';
-
   meta = with lib; {
     description = "Modular multi screen pdf presentation software respecting your window manager";
     homepage = "https://github.com/stiglers-eponym/BeamerPresenter";

pkgs/applications/science/astronomy/stellarium/default.nix

@@ -28,10 +28,6 @@ mkDerivation rec {
                 'SET(CMAKE_INSTALL_PREFIX "${placeholder "out"}/Stellarium.app/Contents")'
   '';
 
-  postFixup = lib.optionalString stdenv.isDarwin ''
-    wrapQtApp "$out"/Stellarium.app/Contents/MacOS/stellarium
-  '';
-
   meta = with lib; {
     description = "Free open-source planetarium";
     homepage = "http://stellarium.org/";

pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -25,7 +25,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.33.0";
+  version = "2.33.1";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "0kqcs8nj5h7rh3q86pw5777awq7gn77lgxk88ynjl1rfz2snlg5z";
+    sha256 = "sha256-4FSm5sKwiL0b/19h7ZulqpHJo81QlTmktBxd3wIgHy8=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";

pkgs/applications/video/jellyfin-media-player/default.nix

@@ -94,9 +94,6 @@ mkDerivation rec {
     mv $out/Resources/* "$out/Applications/Jellyfin Media Player.app/Contents/Resources/"
     rmdir $out/Resources
 
-    # fix 'Could not find the Qt platform plugin "cocoa" in ""' error
-    wrapQtApp "$out/Applications/Jellyfin Media Player.app/Contents/MacOS/Jellyfin Media Player"
-
     ln -s "$out/Applications/Jellyfin Media Player.app/Contents/MacOS/Jellyfin Media Player" $out/bin/jellyfinmediaplayer
   '';
 

pkgs/build-support/bintools-wrapper/default.nix

@@ -324,6 +324,16 @@ stdenv.mkDerivation {
       echo "-arch ${targetPlatform.darwinArch}" >> $out/nix-support/libc-ldflags
     ''
 
+    ##
+    ## GNU specific extra strip flags
+    ##
+
+    # TODO(@sternenseemann): make a generic strip wrapper?
+    + optionalString (bintools.isGNU or false) ''
+      wrap ${targetPrefix}strip ${./gnu-binutils-strip-wrapper.sh} \
+        "${bintools_bin}/bin/${targetPrefix}strip"
+    ''
+
     ###
     ### Remove LC_UUID
     ###

pkgs/build-support/bintools-wrapper/gnu-binutils-strip-wrapper.sh

@@ -0,0 +1,4 @@
+#! @shell@
+# shellcheck shell=bash
+
+exec @prog@ --enable-deterministic-archives "$@"

pkgs/build-support/rust/hooks/cargo-check-hook.sh

@@ -16,11 +16,11 @@ cargoCheckHook() {
         threads=1
     fi
 
-    if [ "${cargoBuildType}" != "debug" ]; then
-        cargoBuildProfileFlag="--${cargoBuildType}"
+    if [ "${cargoCheckType}" != "debug" ]; then
+        cargoCheckProfileFlag="--${cargoCheckType}"
     fi
 
-    argstr="${cargoBuildProfileFlag} --target @rustTargetPlatformSpec@ --frozen ${cargoTestFlags}";
+    argstr="${cargoCheckProfileFlag} --target @rustTargetPlatformSpec@ --frozen ${cargoTestFlags}";
 
     (
         set -x

pkgs/build-support/setup-hooks/strip.sh

@@ -51,7 +51,7 @@ stripDirs() {
 
     if [ -n "${dirs}" ]; then
         header "stripping (with command $cmd and flags $stripFlags) in$dirs"
-        find $dirs -type f -exec $cmd $commonStripFlags $stripFlags '{}' \; 2>/dev/null
+        find $dirs -type f -exec $cmd $stripFlags '{}' \; 2>/dev/null
         stopNest
     fi
 }

pkgs/data/misc/cacert/default.nix

@@ -1,126 +1,27 @@
 { lib
 , stdenv
+, writeText
 , fetchurl
-, nss
-, python3
-, blacklist ? [ ]
+, buildcatrust
+, blacklist ? []
+, extraCertificateFiles ? []
+, extraCertificateStrings ? []
 
-  # Used for tests only
+# Used by update.sh
+, nssOverride ? null
+
+# Used for tests only
 , runCommand
 , cacert
 , openssl
 }:
 
 let
-  certdata2pem = fetchurl {
-    name = "certdata2pem.py";
-    urls = [
-      "https://salsa.debian.org/debian/ca-certificates/raw/debian/20170717/mozilla/certdata2pem.py"
-      "https://git.launchpad.net/ubuntu/+source/ca-certificates/plain/mozilla/certdata2pem.py?id=47e49e1e0a8a1ca74deda27f88fe181191562957"
-    ];
-    sha256 = "1d4q27j1gss0186a5m8bs5dk786w07ccyq0qi6xmd2zr1a8q16wy";
-  };
-in
-
-stdenv.mkDerivation rec {
-  pname = "nss-cacert";
-  version = "3.66";
-
-  src = fetchurl {
-    url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
-    sha256 = "1jfdnh5l4k57r2vb07s06hqi7m2qzk0d9x25lsdsrw3cflx9x9w9";
-  };
-
-  outputs = [ "out" "unbundled" ];
-
-  nativeBuildInputs = [ python3 ];
-
-  configurePhase = ''
-    ln -s nss/lib/ckfw/builtins/certdata.txt
-
-    cat << EOF > blacklist.txt
-    ${lib.concatStringsSep "\n" (map (c: ''"${c}"'') blacklist)}
-    EOF
-
-    # copy from the store, otherwise python will scan it for imports
-    cat "${certdata2pem}" > certdata2pem.py
-  '';
-
-  buildPhase = ''
-    python certdata2pem.py | grep -vE '^(!|UNTRUSTED)'
-
-    for cert in *.crt; do
-      echo $cert | cut -d. -f1 | sed -e 's,_, ,g' >> ca-bundle.crt
-      cat $cert >> ca-bundle.crt
-      echo >> ca-bundle.crt
-    done
-  '';
-
-  installPhase = ''
-    mkdir -pv $out/etc/ssl/certs
-    cp -v ca-bundle.crt $out/etc/ssl/certs
-    # install individual certs in unbundled output
-    mkdir -pv $unbundled/etc/ssl/certs
-    cp -v *.crt $unbundled/etc/ssl/certs
-    rm $unbundled/etc/ssl/certs/ca-bundle.crt  # not wanted in unbundled
-  '';
-
-  setupHook = ./setup-hook.sh;
-
-  passthru = {
-    updateScript = ./update.sh;
-    tests = {
-      # Test that building this derivation with a blacklist works, and that UTF-8 is supported.
-      blacklist-utf8 =
-        let
-          blacklistCAToFingerprint = {
-            # "blacklist" uses the CA name from the NSS bundle, but we check for presence using the SHA256 fingerprint.
-            "CFCA EV ROOT" = "5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD";
-            "NetLock Arany (Class Gold) Főtanúsítvány" = "6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98";
-          };
-          mapBlacklist = f: lib.concatStringsSep "\n" (lib.mapAttrsToList f blacklistCAToFingerprint);
-        in
-        runCommand "verify-the-cacert-filter-output"
-          {
-            cacert = cacert.unbundled;
-            cacertWithExcludes = (cacert.override {
-              blacklist = builtins.attrNames blacklistCAToFingerprint;
-            }).unbundled;
-
-            nativeBuildInputs = [ openssl ];
-          } ''
-          isPresent() {
-            # isPresent <unbundled-dir> <ca name> <ca sha256 fingerprint>
-            for f in $1/etc/ssl/certs/*.crt; do
-              fingerprint="$(openssl x509 -in "$f" -noout -fingerprint -sha256 | cut -f2 -d=)"
-              if [[ "x$fingerprint" == "x$3" ]]; then
-                return 0
-              fi
-            done
-            return 1
-          }
-
-          # Ensure that each certificate is in the main "cacert".
-          ${mapBlacklist (caName: caFingerprint: ''
-            isPresent "$cacert" "${caName}" "${caFingerprint}" || ({
-              echo "CA fingerprint ${caFingerprint} (${caName}) is missing from the CA bundle. Consider picking a different CA for the blacklist test." >&2
-              exit 1
-            })
-          '')}
-
-          # Ensure that each certificate is NOT in the "cacertWithExcludes".
-          ${mapBlacklist (caName: caFingerprint: ''
-            isPresent "$cacertWithExcludes" "${caName}" "${caFingerprint}" && ({
-              echo "CA fingerprint ${caFingerprint} (${caName}) is present in the cacertWithExcludes bundle." >&2
-              exit 1
-            })
-          '')}
-
-          touch $out
-        '';
-    };
-  };
+  blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" blacklist);
+  extraCertificatesBundle = writeText "cacert-extra-certificates-bundle.crt" (lib.concatStringsSep "\n\n" extraCertificateStrings);
 
+  srcVersion = "3.71";
+  version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = with lib; {
     homepage = "https://curl.haxx.se/docs/caextract.html";
     description = "A bundle of X.509 certificates of public Certificate Authorities (CA)";
@@ -128,4 +29,179 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ andir fpletz lukegb ];
     license = licenses.mpl20;
   };
+  certdata = stdenv.mkDerivation {
+    pname = "nss-cacert-certdata";
+    inherit version;
+
+    src = if nssOverride != null then nssOverride.src else fetchurl {
+      url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
+      sha256 = "0ly2l3dv6z5hlxs72h5x6796ni3x1bq60saavaf42ddgv4ax7b4r";
+    };
+
+    dontBuild = true;
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir $out
+      cp nss/lib/ckfw/builtins/certdata.txt $out
+
+      runHook postInstall
+    '';
+
+    inherit meta;
+  };
+in
+stdenv.mkDerivation rec {
+  pname = "nss-cacert";
+  inherit version;
+
+  src = certdata;
+
+  outputs = [ "out" "unbundled" "p11kit" ];
+
+  nativeBuildInputs = [ buildcatrust ];
+
+  buildPhase = ''
+    mkdir unbundled
+    buildcatrust \
+      --certdata_input certdata.txt \
+      --ca_bundle_input "${extraCertificatesBundle}" ${lib.escapeShellArgs (map (arg: "${arg}") extraCertificateFiles)} \
+      --blocklist "${blocklist}" \
+      --ca_bundle_output ca-bundle.crt \
+      --ca_unpacked_output unbundled \
+      --p11kit_output ca-bundle.trust.p11-kit
+  '';
+
+  installPhase = ''
+    install -D -t "$out/etc/ssl/certs" ca-bundle.crt
+
+    # install p11-kit specific output to p11kit output
+    install -D -t "$p11kit/etc/ssl/trust-source" ca-bundle.trust.p11-kit
+
+    # install individual certs in unbundled output
+    install -D -t "$unbundled/etc/ssl/certs" unbundled/*.crt
+  '';
+
+  setupHook = ./setup-hook.sh;
+
+  passthru = {
+    updateScript = ./update.sh;
+    tests = let
+      isTrusted = ''
+        isTrusted() {
+          # isTrusted <unbundled-dir> <ca name> <ca sha256 fingerprint>
+          for f in $1/etc/ssl/certs/*.crt; do
+            if ! [[ -s "$f" ]]; then continue; fi
+            fingerprint="$(openssl x509 -in "$f" -noout -fingerprint -sha256 | cut -f2 -d=)"
+            if [[ "x$fingerprint" == "x$3" ]]; then
+              # If the certificate is treated as rejected for TLS Web Server, then we consider it untrusted.
+              if openssl x509 -in "$f" -noout -text | grep -q '^Rejected Uses:'; then
+                if openssl x509 -in "$f" -noout -text | grep -A1 '^Rejected Uses:' | grep -q 'TLS Web Server'; then
+                  return 1
+                fi
+              fi
+              return 0
+            fi
+          done
+          return 1
+        }
+      '';
+    in {
+      # Test that building this derivation with a blacklist works, and that UTF-8 is supported.
+      blacklist-utf8 = let
+        blacklistCAToFingerprint = {
+          # "blacklist" uses the CA name from the NSS bundle, but we check for presence using the SHA256 fingerprint.
+          "CFCA EV ROOT" = "5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD";
+          "NetLock Arany (Class Gold) Főtanúsítvány" = "6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98";
+        };
+        mapBlacklist = f: lib.concatStringsSep "\n" (lib.mapAttrsToList f blacklistCAToFingerprint);
+      in runCommand "verify-the-cacert-filter-output" {
+        cacert = cacert.unbundled;
+        cacertWithExcludes = (cacert.override {
+          blacklist = builtins.attrNames blacklistCAToFingerprint;
+        }).unbundled;
+
+        nativeBuildInputs = [ openssl ];
+      } ''
+        ${isTrusted}
+
+        # Ensure that each certificate is in the main "cacert".
+        ${mapBlacklist (caName: caFingerprint: ''
+          isTrusted "$cacert" "${caName}" "${caFingerprint}" || ({
+            echo "CA fingerprint ${caFingerprint} (${caName}) is missing from the CA bundle. Consider picking a different CA for the blacklist test." >&2
+            exit 1
+          })
+        '')}
+
+        # Ensure that each certificate is NOT in the "cacertWithExcludes".
+        ${mapBlacklist (caName: caFingerprint: ''
+          isTrusted "$cacertWithExcludes" "${caName}" "${caFingerprint}" && ({
+            echo "CA fingerprint ${caFingerprint} (${caName}) is present in the cacertWithExcludes bundle." >&2
+            exit 1
+          })
+        '')}
+
+        touch "$out"
+      '';
+
+      # Test that we can add additional certificates to the store, and have them be trusted.
+      extra-certificates = let
+        extraCertificateStr = ''
+          -----BEGIN CERTIFICATE-----
+          MIIB5DCCAWqgAwIBAgIUItvsAYEIdYDkOIo5sdDYMcUaNuIwCgYIKoZIzj0EAwIw
+          KTEnMCUGA1UEAwweTml4T1MgY2FjZXJ0IGV4dHJhIGNlcnRpZmljYXRlMB4XDTIx
+          MDYxMjE5MDQzMFoXDTIyMDYxMjE5MDQzMFowKTEnMCUGA1UEAwweTml4T1MgY2Fj
+          ZXJ0IGV4dHJhIGNlcnRpZmljYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEuP8y
+          lAm6ZyQt9v/P6gTlV/a9R+D61WjucW04kaegOhg8csiluimYodiSv0Pbgymu+Zxm
+          A3Bz9QGmytaYTiJ16083rJkwwIhqoYl7kWsLzreSTaLz87KH+rdeol59+H0Oo1Mw
+          UTAdBgNVHQ4EFgQUCxuHfvqI4YVU5M+A0+aKvd1LrdswHwYDVR0jBBgwFoAUCxuH
+          fvqI4YVU5M+A0+aKvd1LrdswDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNo
+          ADBlAjEArgxgjdNmRlSEuai0dzlktmBEDZKy2Iiul+ttSoce9ohfEVYESwO602HW
+          keVvI56vAjBCro3dc3m2TuktiKO6lQV56PUEyxko4H/sR5pnHlduCGRDlFzQKXf/
+          pMMmtj7cVb8=
+          -----END CERTIFICATE-----
+        '';
+        extraCertificateFile = ./test-cert-file.crt;
+        extraCertificatesToFingerprint = {
+          # String above
+          "NixOS cacert extra certificate string" = "A3:20:D0:84:96:97:25:FF:98:B8:A9:6D:A3:7C:89:95:6E:7A:77:21:92:F3:33:E9:31:AF:5E:03:CE:A9:E5:EE";
+
+          # File
+          "NixOS cacert extra certificate file" = "88:B8:BE:A7:57:AC:F1:FE:D6:98:8B:50:E0:BD:0A:AE:88:C7:DF:70:26:E1:67:5E:F5:F6:91:27:FF:02:D4:A5";
+        };
+        mapExtra = f: lib.concatStringsSep "\n" (lib.mapAttrsToList f extraCertificatesToFingerprint);
+      in runCommand "verify-the-cacert-extra-output" {
+        cacert = cacert.unbundled;
+        cacertWithExtras = (cacert.override {
+          extraCertificateStrings = [ extraCertificateStr ];
+          extraCertificateFiles = [ extraCertificateFile ];
+        }).unbundled;
+
+        nativeBuildInputs = [ openssl ];
+      } ''
+        ${isTrusted}
+
+        # Ensure that the extra certificate is not in the main "cacert".
+        ${mapExtra (extraName: extraFingerprint: ''
+          isTrusted "$cacert" "${extraName}" "${extraFingerprint}" && ({
+            echo "'extra' CA fingerprint ${extraFingerprint} (${extraName}) is present in the main CA bundle." >&2
+            exit 1
+          })
+        '')}
+
+        # Ensure that the extra certificates ARE in the "cacertWithExtras".
+        ${mapExtra (extraName: extraFingerprint: ''
+          isTrusted "$cacertWithExtras" "${extraName}" "${extraFingerprint}" || ({
+            echo "CA fingerprint ${extraFingerprint} (${extraName}) is not present in the cacertWithExtras bundle." >&2
+            exit 1
+          })
+        '')}
+
+        touch "$out"
+      '';
+    };
+  };
+
+  inherit meta;
 }

pkgs/data/misc/cacert/test-cert-file.crt

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB7TCCAXSgAwIBAgIUFJB0STXn22fIEDjpncEt++IdFeMwCgYIKoZIzj0EAwIw
+LjEsMCoGA1UEAwwjTml4T1MgY2FjZXJ0IGV4dHJhIGNlcnRpZmljYXRlIGZpbGUw
+HhcNMjEwNjEyMTkxODA4WhcNMjIwNjEyMTkxODA4WjAuMSwwKgYDVQQDDCNOaXhP
+UyBjYWNlcnQgZXh0cmEgY2VydGlmaWNhdGUgZmlsZTB2MBAGByqGSM49AgEGBSuB
+BAAiA2IABMifTLM5K5xd+guGdKE1+NR7wnEJbxw5INzuMrkg/7jgEIQil4+L2YOF
+kU1gxcM80Ot8tQAG5OcSvX1DF6CxunpoCT+hnHqyfqoWFvl89i1BUKjyWCQ5WXEe
+nSkuJUmYC6NTMFEwHQYDVR0OBBYEFBE2kNis1ri4fweyNVRmvje83gFQMB8GA1Ud
+IwQYMBaAFBE2kNis1ri4fweyNVRmvje83gFQMA8GA1UdEwEB/wQFMAMBAf8wCgYI
+KoZIzj0EAwIDZwAwZAIwUZf1qaSb4cezulV+4B4FoJHY2B/nRVIi/rFD8634YEDT
+vcg6dmCi/AqLEzJn7uFMAjBVTu4EVC/mtQCGESFChMeb04fsuhXgttWSwWliVPEG
+jkG7u0UNNGaU8dvrjpqRRmA=
+-----END CERTIFICATE-----

pkgs/data/misc/cacert/update.sh

@@ -28,7 +28,7 @@ BASEDIR="$(dirname "$0")/../../../.."
 
 
 CURRENT_PATH=$(nix-build --no-out-link -A cacert.out)
-PATCHED_PATH=$(nix-build --no-out-link -E "with import $BASEDIR {}; let nss_pkg = pkgs.nss_latest or pkgs.nss; in (cacert.overrideAttrs (_: { inherit (nss_pkg) src version; })).out")
+PATCHED_PATH=$(nix-build --no-out-link -E "with import $BASEDIR {}; let nss_pkg = pkgs.nss_latest or pkgs.nss; in (cacert.override { nssOverride = nss_pkg; }).out")
 
 # Check the hash of the etc subfolder
 # We can't check the entire output as that contains the nix-support folder
@@ -38,5 +38,5 @@ PATCHED_HASH=$(nix-hash "$PATCHED_PATH/etc")
 
 if [[ "$CURRENT_HASH" !=  "$PATCHED_HASH" ]]; then
     NSS_VERSION=$(nix-instantiate --json --eval -E "with import $BASEDIR {}; nss.version" | jq -r .)
-    update-source-version cacert "$NSS_VERSION"
+    update-source-version --version-key=srcVersion cacert.src "$NSS_VERSION"
 fi

pkgs/data/misc/tzdata/default.nix

@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "tzdata";
-  version = "2021a";
+  version = "2021c";
 
   srcs =
     [ (fetchurl {
         url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-        sha256 = "022fn6gkmp7pamlgab04x0dm5hnyn2m2fcnyr3pvm36612xd5rrr";
+        sha256 = "0himprzx3ahxkmg4rvp8n5lqry76qzc65j6sfq151hqirg4d3wdl";
       })
       (fetchurl {
         url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-        sha256 = "1l02b0jiwp3fl0xd6227i69d26rmx3yrnq0ssq9vvdmm4jhvyipb";
+        sha256 = "01fsa661vzdij46z286pa8q07cppqz29sr2pf0qqldqpldbb6km3";
       })
     ];
 
@@ -73,6 +73,6 @@ stdenv.mkDerivation rec {
       publicDomain # tzdata
     ];
     platforms = platforms.all;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [ ajs124 fpletz ];
   };
 }

pkgs/development/compilers/llvm/10/llvm/default.nix

@@ -65,6 +65,14 @@ in stdenv.mkDerivation (rec {
       sha256 = "sha256:12s8vr6ibri8b48h2z38f3afhwam10arfiqfy4yg37bmc054p5hi";
       stripLen = 1;
     })
+
+    # Fix missing includes for GCC 11
+    (fetchpatch {
+      name = "headers-gcc-11.patch";
+      url = "https://github.com/llvm/llvm-project/commit/b498303066a63a203d24f739b2d2e0e56dca70d1.patch";
+      sha256 = "0nh123kld0dgz2h941lng331dkj3wbm5lfxm375k1f569gv83hlk";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''

pkgs/development/compilers/llvm/8/llvm/default.nix

@@ -63,6 +63,14 @@ in stdenv.mkDerivation ({
       sha256 = "0rwx6jpqq4xnf4mvfm8v2d4r34y1yi05am0mx5k2d5bha9j64lqg";
     })
     ./gnu-install-dirs.patch
+
+    # Fix missing includes for GCC 11
+    (fetchpatch {
+      name = "headers-gcc-11.patch";
+      url = "https://github.com/llvm/llvm-project/commit/b498303066a63a203d24f739b2d2e0e56dca70d1.patch";
+      sha256 = "0nh123kld0dgz2h941lng331dkj3wbm5lfxm375k1f569gv83hlk";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''

pkgs/development/compilers/llvm/9/llvm/default.nix

@@ -1,6 +1,7 @@
 { lib, stdenv, llvm_meta
 , pkgsBuildBuild
 , fetch
+, fetchpatch
 , cmake
 , python3
 , libffi
@@ -60,6 +61,14 @@ in stdenv.mkDerivation (rec {
     # Force a test to evaluate the saved benchmark for a CPU for which LLVM has
     # an execution model. See NixOS/nixpkgs#119673.
     ../../exegesis-force-bdver2.patch
+
+    # Fix missing includes for GCC 11
+    (fetchpatch {
+      name = "headers-gcc-11.patch";
+      url = "https://github.com/llvm/llvm-project/commit/b498303066a63a203d24f739b2d2e0e56dca70d1.patch";
+      sha256 = "0nh123kld0dgz2h941lng331dkj3wbm5lfxm375k1f569gv83hlk";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''

pkgs/development/interpreters/guile/1.8.nix

@@ -1,13 +1,22 @@
-{ lib, stdenv, pkgsBuildBuild, buildPackages
-, fetchurl, makeWrapper, gawk, pkg-config
-, libtool, readline, gmp
+{ lib
+, stdenv
+, fetchurl
+, buildPackages
+, gawk
+, gmp
+, libtool
+, makeWrapper
+, pkg-config
+, pkgsBuildBuild
+, readline
 }:
 
 stdenv.mkDerivation rec {
-  name = "guile-1.8.8";
+  pname = "guile";
+  version = "1.8.8";
 
   src = fetchurl {
-    url = "mirror://gnu/guile/${name}.tar.gz";
+    url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
     sha256 = "0l200a0v7h8bh0cwz6v7hc13ds39cgqsmfrks55b1rbj5vniyiy3";
   };
 
@@ -15,18 +24,28 @@ stdenv.mkDerivation rec {
   setOutputFlags = false; # $dev gets into the library otherwise
 
   # GCC 4.6 raises a number of set-but-unused warnings.
-  configureFlags = [ "--disable-error-on-warning" ]
-    # Guile needs patching to preset results for the configure tests about
-    # pthreads, which work only in native builds.
-    ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
-                          "--with-threads=no";
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ]
-    ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
-                           pkgsBuildBuild.guile_1_8;
-  nativeBuildInputs = [ makeWrapper gawk pkg-config ];
-  buildInputs = [ readline libtool ];
+  configureFlags = [
+    "--disable-error-on-warning"
+  ]
+  # Guile needs patching to preset results for the configure tests about
+  # pthreads, which work only in native builds.
+  ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    "--with-threads=no";
 
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ]
+  ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    pkgsBuildBuild.guile_1_8;
+  nativeBuildInputs = [
+    gawk
+    makeWrapper
+    pkg-config
+  ];
+  buildInputs = [
+    libtool
+    readline
+  ];
   propagatedBuildInputs = [
     gmp
 
@@ -38,7 +57,9 @@ stdenv.mkDerivation rec {
   ];
 
   patches = [
+    # Fix doc snarfing with GCC 4.5.
     ./cpp-4.5.patch
+    # Self explanatory
     ./CVE-2016-8605.patch
   ];
 
@@ -46,13 +67,12 @@ stdenv.mkDerivation rec {
     sed -e '/lt_dlinit/a  lt_dladdsearchdir("'$out/lib'");' -i libguile/dynl.c
   '';
 
-
   postInstall = ''
     wrapProgram $out/bin/guile-snarf --prefix PATH : "${gawk}/bin"
   ''
-    # XXX: See http://thread.gmane.org/gmane.comp.lib.gnulib.bugs/18903 for
-    # why `--with-libunistring-prefix' and similar options coming from
-    # `AC_LIB_LINKFLAGS_BODY' don't work on NixOS/x86_64.
+  # XXX: See http://thread.gmane.org/gmane.comp.lib.gnulib.bugs/18903 for
+  # why `--with-libunistring-prefix' and similar options coming from
+  # `AC_LIB_LINKFLAGS_BODY' don't work on NixOS/x86_64.
   + ''
     sed -i "$out/lib/pkgconfig/guile"-*.pc    \
         -e "s|-lltdl|-L${libtool.lib}/lib -lltdl|g"
@@ -65,19 +85,21 @@ stdenv.mkDerivation rec {
   doCheck = false;
   doInstallCheck = doCheck;
 
-  setupHook = ./setup-hook.sh;
+  setupHook = ./setup-hook-1.8.sh;
 
-  meta = {
+  meta = with lib; {
+    homepage = "https://www.gnu.org/software/guile/";
     description = "Embeddable Scheme implementation";
-    homepage    = "https://www.gnu.org/software/guile/";
-    license     = lib.licenses.lgpl2Plus;
-    maintainers = [ lib.maintainers.ludo ];
-    platforms   = lib.platforms.unix;
-
     longDescription = ''
-      GNU Guile is an interpreter for the Scheme programming language,
-      packaged as a library that can be embedded into programs to make
-      them extensible.  It supports many SRFIs.
+      GNU Guile is an implementation of the Scheme programming language, with
+      support for many SRFIs, packaged for use in a wide variety of
+      environments.  In addition to implementing the R5RS Scheme standard and a
+      large subset of R6RS, Guile includes a module system, full access to POSIX
+      system calls, networking support, multiple threads, dynamic linking, a
+      foreign function call interface, and powerful string processing.
     '';
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ ludo ];
+    platforms = platforms.all;
   };
 }

pkgs/development/interpreters/guile/2.0.nix

@@ -1,88 +1,123 @@
-{ lib, stdenv, pkgsBuildBuild, buildPackages
-, fetchpatch, fetchurl, makeWrapper, gawk, pkg-config
-, libffi, libtool, readline, gmp, boehmgc, libunistring
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, boehmgc
+, buildPackages
 , coverageAnalysis ? null
+, gawk
+, gmp
+, libffi
+, libtool
+, libunistring
+, makeWrapper
+, pkg-config
+, pkgsBuildBuild
+, readline
 }:
 
-# Do either a coverage analysis build or a standard build.
-(if coverageAnalysis != null
- then coverageAnalysis
- else stdenv.mkDerivation)
-
-(rec {
-  name = "guile-2.0.13";
+let
+  # Do either a coverage analysis build or a standard build.
+  builder = if coverageAnalysis != null
+            then coverageAnalysis
+            else stdenv.mkDerivation;
+in
+builder rec {
+  pname = "guile";
+  version = "2.0.13";
 
   src = fetchurl {
-    url = "mirror://gnu/guile/${name}.tar.xz";
+    url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
     sha256 = "12yqkr974y91ylgw6jnmci2v90i90s7h9vxa4zk0sai8vjnz4i1p";
   };
 
   outputs = [ "out" "dev" "info" ];
   setOutputFlags = false; # $dev gets into the library otherwise
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ]
-    ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
-                           pkgsBuildBuild.guile_2_0;
-  nativeBuildInputs = [ makeWrapper gawk pkg-config ];
-  buildInputs = [ readline libtool libunistring libffi ];
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ]
+  ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    pkgsBuildBuild.guile_2_0;
 
+  nativeBuildInputs = [
+    makeWrapper
+    gawk
+    pkg-config
+  ];
+  buildInputs = [
+    readline
+    libtool
+    libunistring
+    libffi
+  ];
   propagatedBuildInputs = [
-    gmp boehmgc
+    boehmgc
+    gmp
 
-    # XXX: These ones aren't normally needed here, but `libguile*.la' has '-l'
-    # flags for them without corresponding '-L' flags. Adding them here will add
-    # the needed `-L' flags.  As for why the `.la' file lacks the `-L' flags,
-    # see below.
-    libtool libunistring
+    # These ones aren't normally needed here, but `libguile*.la' has '-l'
+    # flags for them without corresponding '-L' flags. Adding them here will
+    # add the needed `-L' flags.  As for why the `.la' file lacks the `-L'
+    # flags, see below.
+    libtool
+    libunistring
   ];
 
   enableParallelBuilding = true;
 
-  patches = [ ./disable-gc-sensitive-tests.patch ./eai_system.patch ./clang.patch
+  patches = [
+    # Small fixes to Clang compiler
+    ./clang.patch
+    # Self-explanatory
+    ./disable-gc-sensitive-tests.patch
+    # Read the header of the patch to more info
+    ./eai_system.patch
+    # RISC-V endianness
+    ./riscv.patch
+    # Fixes stability issues with 00-repl-server.test
     (fetchpatch {
-      # Fixes stability issues with 00-repl-server.test
       url = "https://git.savannah.gnu.org/cgit/guile.git/patch/?id=2fbde7f02adb8c6585e9baf6e293ee49cd23d4c4";
       sha256 = "0p6c1lmw1iniq03z7x5m65kg3lq543kgvdb4nrxsaxjqf3zhl77v";
+    })] ++
+  (lib.optional (coverageAnalysis != null) ./gcov-file-name.patch)
+  ++ lib.optionals stdenv.isDarwin [
+    ./filter-mkostemp-darwin.patch
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gtk-osx/raw/52898977f165777ad9ef169f7d4818f2d4c9b731/patches/guile-clocktime.patch";
+      sha256 = "12wvwdna9j8795x59ldryv9d84c1j3qdk2iskw09306idfsis207";
     })
-    ./riscv.patch
-  ] ++
-    (lib.optional (coverageAnalysis != null) ./gcov-file-name.patch)
-    ++ lib.optionals stdenv.isDarwin [
-      (fetchpatch {
-        url = "https://gitlab.gnome.org/GNOME/gtk-osx/raw/52898977f165777ad9ef169f7d4818f2d4c9b731/patches/guile-clocktime.patch";
-        sha256 = "12wvwdna9j8795x59ldryv9d84c1j3qdk2iskw09306idfsis207";
-      })
-      ./filter-mkostemp-darwin.patch
-    ];
+  ];
 
   # Explicitly link against libgcc_s, to work around the infamous
   # "libgcc_s.so.1 must be installed for pthread_cancel to work".
 
   # don't have "libgcc_s.so.1" on darwin
-  LDFLAGS = lib.optionalString (!stdenv.isDarwin && !stdenv.hostPlatform.isMusl) "-lgcc_s";
+  LDFLAGS = lib.optionalString
+    (!stdenv.isDarwin && !stdenv.hostPlatform.isMusl) "-lgcc_s";
 
-  configureFlags = [ "--with-libreadline-prefix" ]
-    ++ lib.optionals stdenv.isSunOS [
-      # Make sure the right <gmp.h> is found, and not the incompatible
-      # /usr/include/mp.h from OpenSolaris.  See
-      # <https://lists.gnu.org/archive/html/hydra-users/2012-08/msg00000.html>
-      # for details.
-      "--with-libgmp-prefix=${gmp.dev}"
+  configureFlags = [
+    "--with-libreadline-prefix"
+  ] ++ lib.optionals stdenv.isSunOS [
+    # Make sure the right <gmp.h> is found, and not the incompatible
+    # /usr/include/mp.h from OpenSolaris. See
+    # <https://lists.gnu.org/archive/html/hydra-users/2012-08/msg00000.html>
+    # for details.
+    "--with-libgmp-prefix=${lib.getDev gmp}"
 
-      # Same for these (?).
-      "--with-libreadline-prefix=${readline.dev}"
-      "--with-libunistring-prefix=${libunistring}"
+    # Same for these (?).
+    "--with-libreadline-prefix=${lib.getDev readline}"
+    "--with-libunistring-prefix=${libunistring}"
 
-      # See below.
-      "--without-threads"
-    ];
+    # See below.
+    "--without-threads"
+  ];
 
   postInstall = ''
     wrapProgram $out/bin/guile-snarf --prefix PATH : "${gawk}/bin"
   ''
-    # XXX: See http://thread.gmane.org/gmane.comp.lib.gnulib.bugs/18903 for
-    # why `--with-libunistring-prefix' and similar options coming from
-    # `AC_LIB_LINKFLAGS_BODY' don't work on NixOS/x86_64.
+  # XXX: See http://thread.gmane.org/gmane.comp.lib.gnulib.bugs/18903 for
+  # why `--with-libunistring-prefix' and similar options coming from
+  # `AC_LIB_LINKFLAGS_BODY' don't work on NixOS/x86_64.
   + ''
     sed -i "$out/lib/pkgconfig/guile"-*.pc    \
         -e "s|-lunistring|-L${libunistring}/lib -lunistring|g ;
@@ -90,7 +125,7 @@
             s|-lltdl|-L${libtool.lib}/lib -lltdl|g ;
             s|includedir=$out|includedir=$dev|g
             "
-  '';
+    '';
 
   # make check doesn't work on darwin
   # On Linuxes+Hydra the tests are flaky; feel free to investigate deeper.
@@ -99,24 +134,23 @@
 
   setupHook = ./setup-hook-2.0.sh;
 
-  meta = {
+  meta = with lib; {
+    homepage = "https://www.gnu.org/software/guile/";
     description = "Embeddable Scheme implementation";
-    homepage    = "https://www.gnu.org/software/guile/";
-    license     = lib.licenses.lgpl3Plus;
-    maintainers = with lib.maintainers; [ ludo lovek323 ];
-    platforms   = lib.platforms.all;
-
     longDescription = ''
-      GNU Guile is an implementation of the Scheme programming language, with
-      support for many SRFIs, packaged for use in a wide variety of
-      environments.  In addition to implementing the R5RS Scheme standard
-      and a large subset of R6RS, Guile includes a module system, full access
-      to POSIX system calls, networking support, multiple threads, dynamic
-      linking, a foreign function call interface, and powerful string
-      processing.
-    '';
+        GNU Guile is an implementation of the Scheme programming language, with
+        support for many SRFIs, packaged for use in a wide variety of
+        environments.  In addition to implementing the R5RS Scheme standard and
+        a large subset of R6RS, Guile includes a module system, full access to
+        POSIX system calls, networking support, multiple threads, dynamic
+        linking, a foreign function call interface, and powerful string
+        processing.
+      '';
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ ludo lovek323 vrthra ];
+    platforms = platforms.all;
   };
-})
+}
 
 //
 

pkgs/development/interpreters/guile/2.2.nix

@@ -1,41 +1,65 @@
-{ lib, stdenv, pkgsBuildBuild, buildPackages
-, fetchurl, makeWrapper, gawk, pkg-config
-, libffi, libtool, readline, gmp, boehmgc, libunistring
-, coverageAnalysis ? null
+{ lib
+, stdenv
+, fetchurl
 , fetchpatch
+, boehmgc
+, buildPackages
+, coverageAnalysis ? null
+, gawk
+, gmp
+, libffi
+, libtool
+, libunistring
+, makeWrapper
+, pkg-config
+, pkgsBuildBuild
+, readline
 }:
 
-# Do either a coverage analysis build or a standard build.
-(if coverageAnalysis != null
- then coverageAnalysis
- else stdenv.mkDerivation)
-
-(rec {
-  name = "guile-${version}";
+let
+  # Do either a coverage analysis build or a standard build.
+  builder = if coverageAnalysis != null
+            then coverageAnalysis
+            else stdenv.mkDerivation;
+in
+builder rec {
+  pname = "guile";
   version = "2.2.7";
 
   src = fetchurl {
-    url = "mirror://gnu/guile/${name}.tar.xz";
+    url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
     sha256 = "013mydzhfswqci6xmyc1ajzd59pfbdak15i0b090nhr9bzm7dxyd";
   };
 
   outputs = [ "out" "dev" "info" ];
   setOutputFlags = false; # $dev gets into the library otherwise
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ]
-    ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
-                           pkgsBuildBuild.guile;
-  nativeBuildInputs = [ makeWrapper gawk pkg-config ];
-  buildInputs = [ readline libtool libunistring libffi ];
-
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ]
+  ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    pkgsBuildBuild.guile;
+  nativeBuildInputs = [
+    gawk
+    makeWrapper
+    pkg-config
+  ];
+  buildInputs = [
+    libffi
+    libtool
+    libunistring
+    readline
+  ];
   propagatedBuildInputs = [
-    gmp boehmgc
+    boehmgc
+    gmp
 
     # XXX: These ones aren't normally needed here, but `libguile*.la' has '-l'
     # flags for them without corresponding '-L' flags. Adding them here will add
     # the needed `-L' flags.  As for why the `.la' file lacks the `-L' flags,
     # see below.
-    libtool libunistring
+    libtool
+    libunistring
   ];
 
   # According to Bernhard M. Wiedemann <bwiedemann suse de> on
@@ -47,9 +71,11 @@
   enableParallelBuilding = false;
 
   patches = [
+    # Read the header of the patch to more info
     ./eai_system.patch
   ] ++ lib.optional (coverageAnalysis != null) ./gcov-file-name.patch
-    ++ lib.optional stdenv.isDarwin (fetchpatch {
+  ++ lib.optional stdenv.isDarwin
+    (fetchpatch {
       url = "https://gitlab.gnome.org/GNOME/gtk-osx/raw/52898977f165777ad9ef169f7d4818f2d4c9b731/patches/guile-clocktime.patch";
       sha256 = "12wvwdna9j8795x59ldryv9d84c1j3qdk2iskw09306idfsis207";
     });
@@ -61,27 +87,28 @@
   LDFLAGS = lib.optionalString
     (!stdenv.isDarwin && !stdenv.hostPlatform.isStatic) "-lgcc_s";
 
-  configureFlags = [ "--with-libreadline-prefix=${readline.dev}" ]
-    ++ lib.optionals stdenv.isSunOS [
-      # Make sure the right <gmp.h> is found, and not the incompatible
-      # /usr/include/mp.h from OpenSolaris.  See
-      # <https://lists.gnu.org/archive/html/hydra-users/2012-08/msg00000.html>
-      # for details.
-      "--with-libgmp-prefix=${gmp.dev}"
+  configureFlags = [
+    "--with-libreadline-prefix=${lib.getDev readline}"
+  ] ++ lib.optionals stdenv.isSunOS [
+    # Make sure the right <gmp.h> is found, and not the incompatible
+    # /usr/include/mp.h from OpenSolaris.  See
+    # <https://lists.gnu.org/archive/html/hydra-users/2012-08/msg00000.html>
+    # for details.
+    "--with-libgmp-prefix=${lib.getDev gmp}"
 
-      # Same for these (?).
-      "--with-libunistring-prefix=${libunistring}"
+    # Same for these (?).
+    "--with-libunistring-prefix=${libunistring}"
 
-      # See below.
-      "--without-threads"
-    ];
+    # See below.
+    "--without-threads"
+  ];
 
   postInstall = ''
     wrapProgram $out/bin/guile-snarf --prefix PATH : "${gawk}/bin"
   ''
-    # XXX: See http://thread.gmane.org/gmane.comp.lib.gnulib.bugs/18903 for
-    # why `--with-libunistring-prefix' and similar options coming from
-    # `AC_LIB_LINKFLAGS_BODY' don't work on NixOS/x86_64.
+  # XXX: See http://thread.gmane.org/gmane.comp.lib.gnulib.bugs/18903 for
+  # why `--with-libunistring-prefix' and similar options coming from
+  # `AC_LIB_LINKFLAGS_BODY' don't work on NixOS/x86_64.
   + ''
     sed -i "$out/lib/pkgconfig/guile"-*.pc    \
         -e "s|-lunistring|-L${libunistring}/lib -lunistring|g ;
@@ -89,7 +116,7 @@
             s|-lltdl|-L${libtool.lib}/lib -lltdl|g ;
             s|includedir=$out|includedir=$dev|g
             "
-  '';
+    '';
 
   # make check doesn't work on darwin
   # On Linuxes+Hydra the tests are flaky; feel free to investigate deeper.
@@ -98,21 +125,19 @@
 
   setupHook = ./setup-hook-2.2.sh;
 
-  meta = {
+  meta = with lib; {
+    homepage = "https://www.gnu.org/software/guile/";
     description = "Embeddable Scheme implementation";
-    homepage    = "https://www.gnu.org/software/guile/";
-    license     = lib.licenses.lgpl3Plus;
-    maintainers = with lib.maintainers; [ ludo lovek323 vrthra ];
-    platforms   = lib.platforms.all;
-
     longDescription = ''
       GNU Guile is an implementation of the Scheme programming language, with
       support for many SRFIs, packaged for use in a wide variety of
-      environments.  In addition to implementing the R5RS Scheme standard
-      and a large subset of R6RS, Guile includes a module system, full access
-      to POSIX system calls, networking support, multiple threads, dynamic
-      linking, a foreign function call interface, and powerful string
-      processing.
+      environments.  In addition to implementing the R5RS Scheme standard and a
+      large subset of R6RS, Guile includes a module system, full access to POSIX
+      system calls, networking support, multiple threads, dynamic linking, a
+      foreign function call interface, and powerful string processing.
     '';
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ ludo lovek323 vrthra ];
+    platforms = platforms.all;
   };
-})
+}

pkgs/development/interpreters/guile/3.0.nix

@@ -0,0 +1,141 @@
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, boehmgc
+, buildPackages
+, coverageAnalysis ? null
+, gawk
+, gmp
+, libffi
+, libtool
+, libunistring
+, makeWrapper
+, pkg-config
+, pkgsBuildBuild
+, readline
+}:
+
+let
+  # Do either a coverage analysis build or a standard build.
+  builder = if coverageAnalysis != null
+            then coverageAnalysis
+            else stdenv.mkDerivation;
+in
+builder rec {
+  pname = "guile";
+  version = "3.0.7";
+
+  src = fetchurl {
+    url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
+    sha256 = "sha256-9X2GxwYgJxv863qb4MgXRKAz8IrcfOuoMsmRerPmkbc=";
+  };
+
+  outputs = [ "out" "dev" "info" ];
+  setOutputFlags = false; # $dev gets into the library otherwise
+
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    pkgsBuildBuild.guile;
+  nativeBuildInputs = [
+    gawk
+    makeWrapper
+    pkg-config
+  ];
+  buildInputs = [
+    libffi
+    libtool
+    libunistring
+    readline
+  ];
+  propagatedBuildInputs = [
+    boehmgc
+    gmp
+
+    # These ones aren't normally needed here, but `libguile*.la' has '-l'
+    # flags for them without corresponding '-L' flags. Adding them here will
+    # add the needed `-L' flags.  As for why the `.la' file lacks the `-L'
+    # flags, see below.
+    libtool
+    libunistring
+  ];
+
+  # According to Bernhard M. Wiedemann <bwiedemann suse de> on
+  # #reproducible-builds on irc.oftc.net, (2020-01-29): they had to build
+  # Guile without parallel builds to make it reproducible.
+  #
+  # re: https://issues.guix.gnu.org/issue/20272
+  # re: https://build.opensuse.org/request/show/732638
+  enableParallelBuilding = false;
+
+  patches = [
+    ./eai_system.patch
+  ] ++ lib.optional (coverageAnalysis != null) ./gcov-file-name.patch
+  ++ lib.optional stdenv.isDarwin
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gtk-osx/raw/52898977f165777ad9ef169f7d4818f2d4c9b731/patches/guile-clocktime.patch";
+      sha256 = "12wvwdna9j8795x59ldryv9d84c1j3qdk2iskw09306idfsis207";
+    });
+
+  # Explicitly link against libgcc_s, to work around the infamous
+  # "libgcc_s.so.1 must be installed for pthread_cancel to work".
+
+  # don't have "libgcc_s.so.1" on darwin
+  LDFLAGS = lib.optionalString
+    (!stdenv.isDarwin && !stdenv.hostPlatform.isStatic) "-lgcc_s";
+
+  configureFlags = [
+    "--with-libreadline-prefix=${lib.getDev readline}"
+  ] ++ lib.optionals stdenv.isSunOS [
+    # Make sure the right <gmp.h> is found, and not the incompatible
+    # /usr/include/mp.h from OpenSolaris.  See
+    # <https://lists.gnu.org/archive/html/hydra-users/2012-08/msg00000.html>
+    # for details.
+    "--with-libgmp-prefix=${lib.getDev gmp}"
+
+    # Same for these (?).
+    "--with-libunistring-prefix=${libunistring}"
+
+    # See below.
+    "--without-threads"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/guile-snarf --prefix PATH : "${gawk}/bin"
+  ''
+  # XXX: See http://thread.gmane.org/gmane.comp.lib.gnulib.bugs/18903 for
+  # why `--with-libunistring-prefix' and similar options coming from
+  # `AC_LIB_LINKFLAGS_BODY' don't work on NixOS/x86_64.
+  + ''
+    sed -i "$out/lib/pkgconfig/guile"-*.pc    \
+        -e "s|-lunistring|-L${libunistring}/lib -lunistring|g ;
+            s|^Cflags:\(.*\)$|Cflags: -I${libunistring}/include \1|g ;
+            s|-lltdl|-L${libtool.lib}/lib -lltdl|g ;
+            s|includedir=$out|includedir=$dev|g
+            "
+    '';
+
+  # make check doesn't work on darwin
+  # On Linuxes+Hydra the tests are flaky; feel free to investigate deeper.
+  doCheck = false;
+  doInstallCheck = doCheck;
+
+  setupHook = ./setup-hook-3.0.sh;
+
+  meta = with lib; {
+    homepage = "https://www.gnu.org/software/guile/";
+    description = "Embeddable Scheme implementation";
+    longDescription = ''
+      GNU Guile is an implementation of the Scheme programming language, with
+      support for many SRFIs, packaged for use in a wide variety of
+      environments.  In addition to implementing the R5RS Scheme standard and a
+      large subset of R6RS, Guile includes a module system, full access to POSIX
+      system calls, networking support, multiple threads, dynamic linking, a
+      foreign function call interface, and powerful string processing.
+    '';
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ ludo lovek323 vrthra ];
+    platforms = platforms.all;
+  };
+}

pkgs/development/interpreters/guile/setup-hook-1.8.sh

@@ -1,6 +1,5 @@
 addGuileLibPath () {
-    if test -d "$1/share/guile/site"
-    then
+    if test -d "$1/share/guile/site"; then
         export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
     fi
 }

pkgs/development/interpreters/guile/setup-hook-2.0.sh

@@ -1,21 +1,17 @@
 addGuileLibPath () {
-    if test -d "$1/share/guile/site/2.0"
-    then
+    if test -d "$1/share/guile/site/2.0"; then
         export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/2.0"
         export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/2.0"
-    elif test -d "$1/share/guile/site"
-    then
+    elif test -d "$1/share/guile/site"; then
         export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
         export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
     fi
 
-    if test -d "$1/lib/guile/2.0/ccache"
-    then
+    if test -d "$1/lib/guile/2.0/ccache"; then
         export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.0/ccache"
     fi
 
-    if test -d "$1/lib/guile/2.0/site-ccache"
-    then
+    if test -d "$1/lib/guile/2.0/site-ccache"; then
         export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.0/site-ccache"
     fi
 }

pkgs/development/interpreters/guile/setup-hook-2.2.sh

@@ -1,21 +1,17 @@
 addGuileLibPath () {
-    if test -d "$1/share/guile/site/2.2"
-    then
+    if test -d "$1/share/guile/site/2.2"; then
         export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/2.2"
         export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/2.2"
-    elif test -d "$1/share/guile/site"
-    then
+    elif test -d "$1/share/guile/site"; then
         export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
         export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
     fi
 
-    if test -d "$1/lib/guile/2.2/ccache"
-    then
+    if test -d "$1/lib/guile/2.2/ccache"; then
         export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.2/ccache"
     fi
 
-    if test -d "$1/lib/guile/2.2/site-ccache"
-    then
+    if test -d "$1/lib/guile/2.2/site-ccache"; then
         export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.2/site-ccache"
     fi
 }

pkgs/development/interpreters/guile/setup-hook-3.0.sh

@@ -0,0 +1,19 @@
+addGuileLibPath () {
+    if test -d "$1/share/guile/site/3.0"; then
+        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/3.0"
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/3.0"
+    elif test -d "$1/share/guile/site"; then
+        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
+    fi
+
+    if test -d "$1/lib/guile/3.0/ccache"; then
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/3.0/ccache"
+    fi
+
+    if test -d "$1/lib/guile/3.0/site-ccache"; then
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/3.0/site-ccache"
+    fi
+}
+
+addEnvHooks "$hostOffset" addGuileLibPath

pkgs/development/interpreters/python/cpython/default.nix

@@ -284,7 +284,10 @@ in with passthru; stdenv.mkDerivation {
   CPPFLAGS = concatStringsSep " " (map (p: "-I${getDev p}/include") buildInputs);
   LDFLAGS = concatStringsSep " " (map (p: "-L${getLib p}/lib") buildInputs);
   LIBS = "${optionalString (!stdenv.isDarwin) "-lcrypt"} ${optionalString (ncurses != null) "-lncurses"}";
-  NIX_LDFLAGS = optionalString (stdenv.isLinux && !stdenv.hostPlatform.isMusl) "-lgcc_s" + optionalString stdenv.hostPlatform.isMusl "-lgcc_eh";
+  NIX_LDFLAGS = lib.optionalString stdenv.cc.isGNU ({
+    "glibc" = "-lgcc_s";
+    "musl" = "-lgcc_eh";
+  }."${stdenv.hostPlatform.libc}" or "");
   # Determinism: We fix the hashes of str, bytes and datetime objects.
   PYTHONHASHSEED=0;
 

pkgs/development/interpreters/python/default.nix

@@ -37,7 +37,7 @@ with pkgs;
           keep = self: {
             # TODO maybe only define these here so nothing is needed to be kept in sync.
             inherit (self)
-              isPy27 isPy35 isPy36 isPy37 isPy38 isPy39 isPy3k isPyPy pythonAtLeast pythonOlder
+              isPy27 isPy35 isPy36 isPy37 isPy38 isPy39 isPy310 isPy3k isPyPy pythonAtLeast pythonOlder
               python bootstrapped-pip buildPythonPackage buildPythonApplication
               fetchPypi
               hasPythonModule requiredPythonModules makePythonPath disabledIf
@@ -123,10 +123,10 @@ with pkgs;
       sourceVersion = {
         major = "3";
         minor = "8";
-        patch = "11";
+        patch = "12";
         suffix = "";
       };
-      sha256 = "1chg8b0m1yrz50lizid20zha0dmj40z0iih3jqcrg7pyxca126pv";
+      sha256 = "1si8hw2xpagh4iji89zdx69p3dv5mjqwwbx2x2sl6lrp41jaglxi";
     };
     python39 = {
       sourceVersion = {
@@ -154,28 +154,15 @@ in {
     inherit passthruFun;
   };
 
-  python36 = callPackage ./cpython {
-    self = python36;
-    sourceVersion = {
-      major = "3";
-      minor = "6";
-      patch = "14";
-      suffix = "";
-    };
-    sha256 = "1bnm0bx7xf1jpfm0bmzlq19vwm0bvcbl7klx4rvgq05xryhafqr6";
-    inherit (darwin) configd;
-    inherit passthruFun;
-  };
-
   python37 = callPackage ./cpython {
     self = python37;
     sourceVersion = {
       major = "3";
       minor = "7";
-      patch = "11";
+      patch = "12";
       suffix = "";
     };
-    sha256 = "0d57b5a47wapzpkkq5rbvvi4caylc35j5910b64rxxn4nmm1kd6x";
+    sha256 = "041jqjl5wf7gsw84zd3jgvg91skq20l2fy5zbhz237w38zxzfyzp";
     inherit (darwin) configd;
     inherit passthruFun;
   };
@@ -198,9 +185,9 @@ in {
       major = "3";
       minor = "10";
       patch = "0";
-      suffix = "rc1";
+      suffix = "";
     };
-    sha256 = "0f76q6rsvbvrzcnsp0k7sp555krrgvjpcd09l1rybl4249ln2w3r";
+    sha256 = "00mhn6kj4qkvkkv6hh2klnnjr0yk0c9hspp7njc7n6m1lvkzi6as";
     inherit (darwin) configd;
     inherit passthruFun;
   };

pkgs/development/interpreters/spidermonkey/78.nix

@@ -15,7 +15,7 @@
 , rustc
 , rust-cbindgen
 , yasm
-, llvmPackages_11
+, llvmPackages_12
 , nspr
 }:
 
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoconf213
     cargo
-    llvmPackages_11.llvm # for llvm-objdump
+    llvmPackages_12.llvm # for llvm-objdump
     perl
     pkg-config
     python3

pkgs/development/interpreters/tcl/mk-tcl-derivation.nix

@@ -32,7 +32,7 @@ let
   defaultTclPkgConfigureFlags = [
     "--with-tcl=${tcl}/lib"
     "--with-tclinclude=${tcl}/include"
-    "--exec-prefix=\${out}"
+    "--exec-prefix=${placeholder "out"}"
   ];
 
   self = (stdenv.mkDerivation ((builtins.removeAttrs attrs [

pkgs/development/libraries/boehm-gc/7.6.6.nix

@@ -1,74 +0,0 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkg-config, libatomic_ops
-, enableLargeConfig ? false # doc: https://github.com/ivmai/bdwgc/blob/v7.6.6/doc/README.macros#L179
-}:
-
-stdenv.mkDerivation rec {
-  pname = "boehm-gc";
-  version = "7.6.6";
-
-  src = fetchurl {
-    urls = [
-      "https://www.hboehm.info/gc/gc_source/gc-${version}.tar.gz"
-      "https://github.com/ivmai/bdwgc/releases/download/v${version}/gc-${version}.tar.gz"
-    ];
-    sha256 = "1p1r015a7jbpvkkbgzv1y8nxrbbp6dg0mq3ksi6ji0qdz3wfss79";
-  };
-
-  buildInputs = [ libatomic_ops ];
-  nativeBuildInputs = [ pkg-config ];
-
-  outputs = [ "out" "dev" "doc" ];
-  separateDebugInfo = stdenv.isLinux;
-
-  preConfigure = lib.optionalString (stdenv.hostPlatform.libc == "musl") ''
-    export NIX_CFLAGS_COMPILE+=" -D_GNU_SOURCE -DUSE_MMAP -DHAVE_DL_ITERATE_PHDR"
-  '';
-
-  patches = [ (fetchpatch {
-    url = "https://gitweb.gentoo.org/proj/musl.git/plain/dev-libs/boehm-gc/files/boehm-gc-7.6.0-sys_select.patch";
-    sha256 = "1gydwlklvci30f5dpp5ccw2p2qpph5y41r55wx9idamjlq66fbb3";
-  }) ] ++
-    # https://github.com/ivmai/bdwgc/pull/208
-    lib.optional stdenv.hostPlatform.isRiscV ./riscv.patch;
-
-  configureFlags =
-    [ "--enable-cplusplus" ]
-    ++ lib.optional enableLargeConfig "--enable-large-config"
-    ++ lib.optional (stdenv.hostPlatform.libc == "musl") "--disable-static";
-
-  doCheck = true; # not cross;
-
-  # Don't run the native `strip' when cross-compiling.
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-
-  enableParallelBuilding = true;
-
-  meta = {
-    description = "The Boehm-Demers-Weiser conservative garbage collector for C and C++";
-
-    longDescription = ''
-      The Boehm-Demers-Weiser conservative garbage collector can be used as a
-      garbage collecting replacement for C malloc or C++ new.  It allows you
-      to allocate memory basically as you normally would, without explicitly
-      deallocating memory that is no longer useful.  The collector
-      automatically recycles memory when it determines that it can no longer
-      be otherwise accessed.
-
-      The collector is also used by a number of programming language
-      implementations that either use C as intermediate code, want to
-      facilitate easier interoperation with C libraries, or just prefer the
-      simple collector interface.
-
-      Alternatively, the garbage collector may be used as a leak detector for
-      C or C++ programs, though that is not its primary goal.
-    '';
-
-    homepage = "https://hboehm.info/gc/";
-
-    # non-copyleft, X11-style license
-    license = "https://hboehm.info/gc/license.txt";
-
-    maintainers = [ ];
-    platforms = lib.platforms.all;
-  };
-}

pkgs/development/libraries/boehm-gc/default.nix

@@ -1,18 +1,18 @@
 { lib, stdenv, fetchurl
 , autoreconfHook
-, enableLargeConfig ? false # doc: https://github.com/ivmai/bdwgc/blob/v7.6.6/doc/README.macros#L179
+, enableLargeConfig ? false # doc: https://github.com/ivmai/bdwgc/blob/v8.0.6/doc/README.macros#L195
 }:
 
 stdenv.mkDerivation rec {
   pname = "boehm-gc";
-  version = "8.0.4";
+  version = "8.0.6";
 
   src = fetchurl {
     urls = [
       "https://github.com/ivmai/bdwgc/releases/download/v${version}/gc-${version}.tar.gz"
       "https://www.hboehm.info/gc/gc_source/gc-${version}.tar.gz"
     ];
-    sha256 = "1798rp3mcfkgs38ynkbg2p47bq59pisrc6mn0l20pb5iczf0ssj3";
+    sha256 = "3b4914abc9fa76593596773e4da671d7ed4d5390e3d46fbf2e5f155e121bea11";
   };
 
   outputs = [ "out" "dev" "doc" ];
@@ -22,10 +22,8 @@ stdenv.mkDerivation rec {
     export NIX_CFLAGS_COMPILE+=" -D_GNU_SOURCE -DUSE_MMAP -DHAVE_DL_ITERATE_PHDR"
   '';
 
-  patches = # https://github.com/ivmai/bdwgc/pull/208
-    lib.optional stdenv.hostPlatform.isRiscV ./riscv.patch
-    # boehm-gc whitelists GCC threading models
-    ++ lib.optional stdenv.hostPlatform.isMinGW ./mcfgthread.patch;
+  # boehm-gc whitelists GCC threading models
+  patches = lib.optional stdenv.hostPlatform.isMinGW ./mcfgthread.patch;
 
   configureFlags =
     [ "--enable-cplusplus" "--with-libatomic-ops=none" ]

pkgs/development/libraries/boehm-gc/riscv.patch

@@ -1,53 +0,0 @@
-diff --git a/include/private/gcconfig.h b/include/private/gcconfig.h
-index a8e55dd2..439cc88d 100644
---- a/include/private/gcconfig.h
-+++ b/include/private/gcconfig.h
-@@ -650,6 +650,15 @@
- #   endif
- #   define mach_type_known
- # endif
-+# if defined(__riscv) && defined(LINUX)
-+#   if __riscv_xlen == 32
-+#     define RISCV32
-+#     define mach_type_known
-+#   elif __riscv_xlen == 64
-+#     define RISCV64
-+#     define mach_type_known
-+#   endif
-+# endif
- 
- # if defined(SN_TARGET_PSP2)
- #   define mach_type_known
-@@ -2970,6 +2979,32 @@
- #   endif
- # endif
- 
-+# ifdef RISCV32
-+#   define CPP_WORDSZ 32
-+#   define MACH_TYPE "RISC-V 32"
-+#   define ALIGNMENT 4
-+#   ifdef LINUX
-+#     define OS_TYPE "LINUX"
-+      extern int __data_start[];
-+#     define DATASTART ((ptr_t)__data_start)
-+#     define LINUX_STACKBOTTOM
-+#     define DYNAMIC_LOADING
-+#   endif
-+# endif
-+
-+# ifdef RISCV64
-+#   define CPP_WORDSZ 64
-+#   define MACH_TYPE "RISC-V 64"
-+#   define ALIGNMENT 8
-+#   ifdef LINUX
-+#     define OS_TYPE "LINUX"
-+      extern int __data_start[];
-+#     define DATASTART ((ptr_t)__data_start)
-+#     define LINUX_STACKBOTTOM
-+#     define DYNAMIC_LOADING
-+#   endif
-+# endif
-+
- #if defined(__GLIBC__) && !defined(DONT_USE_LIBC_PRIVATES)
-   /* Use glibc's stack-end marker. */
- # define USE_LIBC_PRIVATES

pkgs/development/libraries/git2/default.nix

@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libgit2";
-  version = "1.1.1";
+  version = "1.3.0";
   # keep the version in sync with python3.pkgs.pygit2 and libgit2-glib
 
   src = fetchFromGitHub {
     owner = "libgit2";
     repo = "libgit2";
     rev = "v${version}";
-    sha256 = "sha256-SxceIxT0aeiiiZCeSIe6EOa+MyVpQVaiv/ZZn6fkwIc=";
+    sha256 = "sha256-7atNkOBzX+nU1gtFQEaE+EF1L+eex+Ajhq2ocoJY920=";
   };
 
   cmakeFlags = [

pkgs/development/libraries/glibc/common.nix

@@ -42,7 +42,7 @@
 
 let
   version = "2.33";
-  patchSuffix = "-50";
+  patchSuffix = "-55";
   sha256 = "sha256-LiVWAA4QXb1X8Layoy/yzxc73k8Nhd/8z9i35RoGd/8=";
 in
 
@@ -61,7 +61,7 @@ stdenv.mkDerivation ({
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
           $ git fetch --all -p && git checkout origin/release/2.33/master && git describe
-          glibc-2.33-50-gc6cadbf83a
+          glibc-2.33-55-g4b95183785
           $ git show --minimal --reverse glibc-2.33.. | gzip -9n --rsyncable - > 2.33-master.patch.gz
 
          To compare the archive contents zdiff can be used.

pkgs/development/libraries/gtk/2.x.nix

@@ -21,11 +21,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gtk+";
-  version = "2.24.32";
+  version = "2.24.33";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/2.24/${pname}-${version}.tar.xz";
-    sha256 = "b6c8a93ddda5eabe3bfee1eb39636c9a03d2a56c7b62828b359bf197943c582e";
+    sha256 = "rCrHV/WULTGKMRpUsMgLXvKV8pnCpzxjL2v7H/Scxto=";
   };
 
   outputs = [ "out" "dev" "devdoc" ];

pkgs/development/libraries/kde-frameworks/fetch.sh

@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/frameworks/5.85/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/frameworks/5.87/ -A '*.tar.xz' )

pkgs/development/libraries/kde-frameworks/karchive.nix

@@ -1,13 +1,13 @@
 {
   mkDerivation,
   extra-cmake-modules,
-  bzip2, xz, qtbase, zlib,
+  bzip2, xz, qtbase, zlib, zstd
 }:
 
 mkDerivation {
   name = "karchive";
   nativeBuildInputs = [ extra-cmake-modules ];
-  buildInputs = [ bzip2 xz zlib ];
+  buildInputs = [ bzip2 xz zlib zstd ];
   propagatedBuildInputs = [ qtbase ];
   outputs = [ "out" "dev" ];
 }

pkgs/development/libraries/kde-frameworks/kcontacts.nix

@@ -1,6 +1,6 @@
 {
   mkDerivation, lib,
-  extra-cmake-modules,
+  extra-cmake-modules, isocodes,
   kcoreaddons, kconfig, kcodecs, ki18n, qtbase,
 }:
 
@@ -9,6 +9,9 @@ mkDerivation {
   meta = {
     license = [ lib.licenses.lgpl21 ];
   };
+  propagatedBuildInputs = [
+    isocodes
+  ];
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ kcoreaddons kconfig kcodecs ki18n qtbase ];
   outputs = [ "out" "dev" ];

pkgs/development/libraries/kde-frameworks/kded.nix

@@ -1,7 +1,7 @@
 {
   mkDerivation, propagate, wrapGAppsHook,
   extra-cmake-modules, kdoctools,
-  gsettings-desktop-schemas, kconfig, kcoreaddons, kcrash, kdbusaddons, kinit,
+  gsettings-desktop-schemas, kconfig, kcoreaddons, kcrash, kdbusaddons,
   kservice, qtbase,
 }:
 
@@ -9,7 +9,7 @@ mkDerivation {
   name = "kded";
   nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook ];
   buildInputs = [
-    gsettings-desktop-schemas kconfig kcoreaddons kcrash kdbusaddons kinit
+    gsettings-desktop-schemas kconfig kcoreaddons kcrash kdbusaddons
     kservice qtbase
   ];
   outputs = [ "out" "dev" ];

pkgs/development/libraries/kde-frameworks/kio/0002-Debug-module-loader.patch

@@ -11,15 +11,15 @@ diff --git a/src/kiod/kiod_main.cpp b/src/kiod/kiod_main.cpp
 index 1976ee1..eb402bf 100644
 --- a/src/kiod/kiod_main.cpp
 +++ b/src/kiod/kiod_main.cpp
-@@ -50,7 +50,7 @@ void KIOD::loadModule(const QString &name)
-         module = factory->create<KDEDModule>();
+@@ -49,7 +49,7 @@ void KIOD::loadModule(const QString &name)
+         module->setModuleName(name); // makes it register to DBus
+         m_modules.insert(name, module);
+     } else {
+-        qCWarning(KIOD_CATEGORY) << "Error loading plugin:" << result.errorText;
++        qCWarning(KIOD_CATEGORY) << "Error loading plugin:" << name << result.errorText;
      }
-     if (!module) {
--        qCWarning(KIOD_CATEGORY) << "Error loading plugin:" << loader.errorString();
-+        qCWarning(KIOD_CATEGORY) << "Error loading plugin" << name << loader.errorString();
-         return;
-     }
-     module->setModuleName(name); // makes it register to DBus
+ }
+ 
 -- 
 2.30.1
 

pkgs/development/libraries/kde-frameworks/kio/default.nix

@@ -1,23 +1,27 @@
 {
-  mkDerivation, fetchpatch,
-  util-linux, extra-cmake-modules, kdoctools, qttools,
+  stdenv, lib, mkDerivation, fetchpatch,
+  extra-cmake-modules, kdoctools, qttools,
+  acl, attr, libkrb5, util-linux,
   karchive, kbookmarks, kcompletion, kconfig, kconfigwidgets, kcoreaddons,
   kdbusaddons, ki18n, kiconthemes, kitemviews, kjobwidgets, knotifications,
   kservice, ktextwidgets, kwallet, kwidgetsaddons, kwindowsystem, kxmlgui,
-  qtbase, qtscript, qtx11extras, solid, kcrash
+  qtbase, qtscript, qtx11extras, solid, kcrash, kded
 }:
 
 mkDerivation {
   name = "kio";
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
-    util-linux karchive kconfigwidgets kdbusaddons ki18n kiconthemes knotifications
+    karchive kconfigwidgets kdbusaddons ki18n kiconthemes knotifications
     ktextwidgets kwallet kwidgetsaddons kwindowsystem qtscript qtx11extras
-    kcrash
+    kcrash libkrb5
+  ] ++ lib.lists.optionals stdenv.isLinux [
+    acl attr # both are needed for ACL support
+    util-linux # provides libmount
   ];
   propagatedBuildInputs = [
     kbookmarks kcompletion kconfig kcoreaddons kitemviews kjobwidgets kservice
-    kxmlgui qtbase qttools solid
+    kxmlgui qtbase qttools solid kded
   ];
   outputs = [ "out" "dev" ];
   patches = [

pkgs/development/libraries/kde-frameworks/knewstuff/default.nix

@@ -3,7 +3,7 @@
   extra-cmake-modules,
   attica, karchive, kcompletion, kconfig, kcoreaddons, ki18n, kiconthemes,
   kio, kitemviews, kpackage, kservice, ktextwidgets, kwidgetsaddons, kxmlgui, qtbase,
-  qtdeclarative, kirigami2,
+  qtdeclarative, kirigami2, syndication,
 }:
 
 mkDerivation {
@@ -12,7 +12,7 @@ mkDerivation {
   buildInputs = [
     karchive kcompletion kconfig kcoreaddons ki18n kiconthemes kio kitemviews
     kpackage
-    ktextwidgets kwidgetsaddons qtbase qtdeclarative kirigami2
+    ktextwidgets kwidgetsaddons qtbase qtdeclarative kirigami2 syndication
   ];
   propagatedBuildInputs = [ attica kservice kxmlgui ];
   patches = [

pkgs/development/libraries/kde-frameworks/kpackage/0002-QDirIterator-follow-symlinks.patch

@@ -12,10 +12,10 @@ diff --git a/src/kpackage/packageloader.cpp b/src/kpackage/packageloader.cpp
 index f03d882..d5aee56 100644
 --- a/src/kpackage/packageloader.cpp
 +++ b/src/kpackage/packageloader.cpp
-@@ -210,7 +210,7 @@ QList<KPluginMetaData> PackageLoader::listPackages(const QString &packageFormat,
+@@ -196,7 +196,7 @@ QList<KPluginMetaData> PackageLoader::listPackages(const QString &packageFormat,
      }
 
-     for (auto const &plugindir : qAsConst(paths)) {
+     for (auto const &plugindir : std::as_const(paths)) {
 -        const QDirIterator::IteratorFlags flags = QDirIterator::Subdirectories;
 +        const QDirIterator::IteratorFlags flags = QDirIterator::Subdirectories | QDirIterator::FollowSymlinks;
          const QStringList nameFilters = {QStringLiteral("metadata.json"), QStringLiteral("metadata.desktop")};

pkgs/development/libraries/kde-frameworks/purpose.nix

@@ -1,14 +1,14 @@
 {
-  mkDerivation, extra-cmake-modules, qtbase
-, qtdeclarative, kconfig, kcoreaddons, ki18n, kio, kirigami2
-, fetchpatch
+  mkDerivation, extra-cmake-modules, intltool, qtbase
+, accounts-qt, qtdeclarative, kaccounts-integration, kconfig, kcoreaddons, ki18n, kio, kirigami2
+, fetchpatch, signond
 }:
 
 mkDerivation {
   name = "purpose";
-  nativeBuildInputs = [ extra-cmake-modules ];
+  nativeBuildInputs = [ extra-cmake-modules intltool ];
   buildInputs = [
-    qtbase qtdeclarative kconfig kcoreaddons
-    ki18n kio kirigami2
+    qtbase accounts-qt qtdeclarative kaccounts-integration kconfig kcoreaddons
+    ki18n kio kirigami2 signond
   ];
 }

pkgs/development/libraries/kde-frameworks/srcs.nix

@@ -4,667 +4,667 @@
 
 {
   attica = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/attica-5.85.0.tar.xz";
-      sha256 = "1rwb2jz2chvxa7hdxn5ms1f93ykpk26kmnngwcixqr7gwlcv8prl";
-      name = "attica-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/attica-5.87.0.tar.xz";
+      sha256 = "0wjfrlmwg03js544xjlpznxxqv14cj40fpzbfnlj24kjgd1ai8dq";
+      name = "attica-5.87.0.tar.xz";
     };
   };
   baloo = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/baloo-5.85.0.tar.xz";
-      sha256 = "0kcilv41assarhp54i99scpg08m11fjznw4d1lx5rdy7fyd4bd41";
-      name = "baloo-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/baloo-5.87.0.tar.xz";
+      sha256 = "0h55hn6klsq19l44qzc95l1r7hx2zr9hr4ysxd8kvcxc02imaswb";
+      name = "baloo-5.87.0.tar.xz";
     };
   };
   bluez-qt = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/bluez-qt-5.85.0.tar.xz";
-      sha256 = "18h0swvmimfxr9ygg0fs9gg0bm4a016n55hkvqx6n3y505b2lnx8";
-      name = "bluez-qt-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/bluez-qt-5.87.0.tar.xz";
+      sha256 = "1shk3riddgdb0i6f0603hbhww13z1b566rdaplxsbgk8cyhl5acz";
+      name = "bluez-qt-5.87.0.tar.xz";
     };
   };
   breeze-icons = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/breeze-icons-5.85.0.tar.xz";
-      sha256 = "0g97md30f76x38skqf7xpxxrcpydx4z5adrknq0bcnpqg3baw1s4";
-      name = "breeze-icons-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/breeze-icons-5.87.0.tar.xz";
+      sha256 = "19f7n4r6b0b1l8hc79xbj8gc18xf488bk4i0wdbw22x9vwl4h58h";
+      name = "breeze-icons-5.87.0.tar.xz";
     };
   };
   extra-cmake-modules = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/extra-cmake-modules-5.85.0.tar.xz";
-      sha256 = "0d36dg727d0ilq0ag4mv3vhp065p60nnl61014jm1p0kn71hjhks";
-      name = "extra-cmake-modules-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/extra-cmake-modules-5.87.0.tar.xz";
+      sha256 = "1axwz0p3ggjpcxpqqlyng3fa2pxmjxgybncgkp8i81i7iq6sf72l";
+      name = "extra-cmake-modules-5.87.0.tar.xz";
     };
   };
   frameworkintegration = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/frameworkintegration-5.85.0.tar.xz";
-      sha256 = "1j3p1hy5fhy1b83mcy2n25a8rzwv8n79c2jwfxhyd2hw1yvrkmzr";
-      name = "frameworkintegration-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/frameworkintegration-5.87.0.tar.xz";
+      sha256 = "1bbgxqgy28abrk2cgzj7k2m18xmkl9kw58dal03pzlmh77br00lb";
+      name = "frameworkintegration-5.87.0.tar.xz";
     };
   };
   kactivities = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kactivities-5.85.0.tar.xz";
-      sha256 = "0c40ripx3k8rccaj699ill4kmdnh1vl9gsxvzvff0y312ya1v2gm";
-      name = "kactivities-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kactivities-5.87.0.tar.xz";
+      sha256 = "1ynngg9x70dwcnn4ncf7h63hj5p187d4mk1aqriax0iz21mfjmp9";
+      name = "kactivities-5.87.0.tar.xz";
     };
   };
   kactivities-stats = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kactivities-stats-5.85.0.tar.xz";
-      sha256 = "08y5wqalsd3xwczb87n2n5l0rky8lydhyb66xvh2dzl5fmw7k5z1";
-      name = "kactivities-stats-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kactivities-stats-5.87.0.tar.xz";
+      sha256 = "1n7jzbfwgwclnrnssxm180fis74qp3v9nximhc0l8fmb8ac1f106";
+      name = "kactivities-stats-5.87.0.tar.xz";
     };
   };
   kapidox = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kapidox-5.85.0.tar.xz";
-      sha256 = "1cmx16gy2s6j2vvs0nn62vczjf6pc8s7dvdz47lrnpmc7p8yzddm";
-      name = "kapidox-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kapidox-5.87.0.tar.xz";
+      sha256 = "0iyla9i4ln6w9wkm4dand53ir6gzsm4180diwi9p2q5mfrk0rvja";
+      name = "kapidox-5.87.0.tar.xz";
     };
   };
   karchive = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/karchive-5.85.0.tar.xz";
-      sha256 = "0bvbmd3phjyk11ylggmzl0kihmg7w623alplwp3j4mj8jn8nw6cc";
-      name = "karchive-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/karchive-5.87.0.tar.xz";
+      sha256 = "0d8wqrynwmqazlf5v7qas9akrvcwr4lrqg3dcbnq61mmc252wgqh";
+      name = "karchive-5.87.0.tar.xz";
     };
   };
   kauth = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kauth-5.85.0.tar.xz";
-      sha256 = "1ib1i4mpxdkddn0kd6prx0j8vc55ai6nlx71lakr2cdafp296fhs";
-      name = "kauth-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kauth-5.87.0.tar.xz";
+      sha256 = "1gbq487v2nn0zyis6xdvsn0mz7yy131vafq76jdi7b6nyh5c1lgi";
+      name = "kauth-5.87.0.tar.xz";
     };
   };
   kbookmarks = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kbookmarks-5.85.0.tar.xz";
-      sha256 = "0jraagmjch0pda15k9ywpidl474x4wq60zzffi2n3vmy8y9hs4rn";
-      name = "kbookmarks-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kbookmarks-5.87.0.tar.xz";
+      sha256 = "0klws0psdq9vx09p38ckki7aqbdkcns1smk8ckj79krpsjv8q9nx";
+      name = "kbookmarks-5.87.0.tar.xz";
     };
   };
   kcalendarcore = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kcalendarcore-5.85.0.tar.xz";
-      sha256 = "04nrfwd4g5v4lnmlcq0rdmx8xfn9wbzp92izsy7zwwxcmpwivysq";
-      name = "kcalendarcore-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kcalendarcore-5.87.0.tar.xz";
+      sha256 = "0ig2w0dxrf9ih9hqk5rvqqmyhg658m1hs4807zl66llplkr58q0n";
+      name = "kcalendarcore-5.87.0.tar.xz";
     };
   };
   kcmutils = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kcmutils-5.85.0.tar.xz";
-      sha256 = "14yfkrqv77r6hm390ib8g7gcjcw3dlnlqs9bd3y0mg123wps7s10";
-      name = "kcmutils-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kcmutils-5.87.0.tar.xz";
+      sha256 = "09pcif2gmkbhwqb8cxfs89nw81wdpdsd4a2n7xdm1xz6lpwwmk1h";
+      name = "kcmutils-5.87.0.tar.xz";
     };
   };
   kcodecs = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kcodecs-5.85.0.tar.xz";
-      sha256 = "1zgpi177j0j3jzi3n0kjyddy0d7b9vp7kxv6c2jsqx9ppps0l1k5";
-      name = "kcodecs-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kcodecs-5.87.0.tar.xz";
+      sha256 = "1fb8agbkwxnxb0hlzz0ya460z3ihn9qz2zvjdxvk21rjhmp1alh7";
+      name = "kcodecs-5.87.0.tar.xz";
     };
   };
   kcompletion = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kcompletion-5.85.0.tar.xz";
-      sha256 = "1vy41mavbm8avr9jfspys4mpzc4i5rkg5gpl9hcbjrkldb9ymfj1";
-      name = "kcompletion-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kcompletion-5.87.0.tar.xz";
+      sha256 = "15c9sgdgw6cf5y2jjgjlsxn0p0pxvrmhzcyq05d9fqhy185ng03p";
+      name = "kcompletion-5.87.0.tar.xz";
     };
   };
   kconfig = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kconfig-5.85.0.tar.xz";
-      sha256 = "0qmrv8ixlg7qrb7fyyvk7a0a7avvpflc05rj46zzip6kjhl4imds";
-      name = "kconfig-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kconfig-5.87.0.tar.xz";
+      sha256 = "1l8px5qpf5qfma24filim1swblgbdvnf25pc38qc6s79inkganrl";
+      name = "kconfig-5.87.0.tar.xz";
     };
   };
   kconfigwidgets = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kconfigwidgets-5.85.0.tar.xz";
-      sha256 = "0hx8f1dcd38wsrifh4j3a5m05xahdqrhsysasbdwxhr5s29d7vvr";
-      name = "kconfigwidgets-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kconfigwidgets-5.87.0.tar.xz";
+      sha256 = "18m3nqlp87am2w8my4y933ck9k3cs5q62nkhbp8ngaavw8cfbd84";
+      name = "kconfigwidgets-5.87.0.tar.xz";
     };
   };
   kcontacts = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kcontacts-5.85.0.tar.xz";
-      sha256 = "07j2h8fd62j7jbcm5fyv27vy120687k1cmp2rw06sf3xl480nk8k";
-      name = "kcontacts-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kcontacts-5.87.0.tar.xz";
+      sha256 = "02zyirvds572rxbdc47ncs71a66z5hql0vpj8lx1zpr0nnvpvlcv";
+      name = "kcontacts-5.87.0.tar.xz";
     };
   };
   kcoreaddons = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kcoreaddons-5.85.0.tar.xz";
-      sha256 = "052l8kvv7k3m43r6arckg4fls0y913gklc8jx09y56g1m51mgbwh";
-      name = "kcoreaddons-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kcoreaddons-5.87.0.tar.xz";
+      sha256 = "19pdpz7jjknccaqc2i6zfmclmrk60clzanvx72ryvh7yb0xyk7yj";
+      name = "kcoreaddons-5.87.0.tar.xz";
     };
   };
   kcrash = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kcrash-5.85.0.tar.xz";
-      sha256 = "14hknkl4md0qzh44f1zqraljzvlbwzc95mci713a9mhk9rb0957f";
-      name = "kcrash-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kcrash-5.87.0.tar.xz";
+      sha256 = "1l48dn5vqn4lns57v61p1a8r3pklx4xclsa3890pjf6iviqxf22r";
+      name = "kcrash-5.87.0.tar.xz";
     };
   };
   kdav = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kdav-5.85.0.tar.xz";
-      sha256 = "11wwdv19d0fy7b1bzgqaciv4hg99a8pi6g2ymjn3g0l3ps05a0sl";
-      name = "kdav-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kdav-5.87.0.tar.xz";
+      sha256 = "0sb1g0wdpql5gw52nxhzkk1wa9md2k25lwyf902g3pf7ahdgdk5z";
+      name = "kdav-5.87.0.tar.xz";
     };
   };
   kdbusaddons = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kdbusaddons-5.85.0.tar.xz";
-      sha256 = "0f8k2kynbspi86gcvpzn209m1bm6vc65flqlnh8prbkd3gg283d6";
-      name = "kdbusaddons-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kdbusaddons-5.87.0.tar.xz";
+      sha256 = "14xmrvak95aqc98a6k6ldg1w4g7syx2xng3vgvwj9wzpzr3shp6p";
+      name = "kdbusaddons-5.87.0.tar.xz";
     };
   };
   kdeclarative = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kdeclarative-5.85.0.tar.xz";
-      sha256 = "1qdbvfx0i09hn9236hnb73fzym529wjsgqmfwzhh5a6dnqdh1rjd";
-      name = "kdeclarative-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kdeclarative-5.87.0.tar.xz";
+      sha256 = "0zx4alsqk3vqfgyi6x7v2mcar92j3swmg0ms0b9mjl95bvpgi4k7";
+      name = "kdeclarative-5.87.0.tar.xz";
     };
   };
   kded = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kded-5.85.0.tar.xz";
-      sha256 = "1yar9zcrrs0c0hakg8sfisnp32284ljj1axhgmx8hkwfj591jdiw";
-      name = "kded-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kded-5.87.0.tar.xz";
+      sha256 = "18dw1dd2lmwsh04yan1q72c5lzcgzm9kig1rqag3rg81h7pclsr5";
+      name = "kded-5.87.0.tar.xz";
     };
   };
   kdelibs4support = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/portingAids/kdelibs4support-5.85.0.tar.xz";
-      sha256 = "1c4zd60s7l1qv719nl28j7gh3lpr1cwqq5vcibb9a6di04k27mm0";
-      name = "kdelibs4support-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/portingAids/kdelibs4support-5.87.0.tar.xz";
+      sha256 = "17kw76fd97rhdyna3dc7hsajvd8bv9l71qx0xaqn65pvzbndf2jf";
+      name = "kdelibs4support-5.87.0.tar.xz";
     };
   };
   kdesignerplugin = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/portingAids/kdesignerplugin-5.85.0.tar.xz";
-      sha256 = "0pchfvmy7r2mkd412nbzk2pkji2dx5lispwcnk759ffm4wlnxncf";
-      name = "kdesignerplugin-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/portingAids/kdesignerplugin-5.87.0.tar.xz";
+      sha256 = "12rckqvg6w5cycvmxbrkvxi7ysfk6bqk3yi1ik4ryqh4x5dz2am9";
+      name = "kdesignerplugin-5.87.0.tar.xz";
     };
   };
   kdesu = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kdesu-5.85.0.tar.xz";
-      sha256 = "1xqzkyd9flglr3aqabkh54yl7a5a429d24mpqphakc3djmdv5d08";
-      name = "kdesu-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kdesu-5.87.0.tar.xz";
+      sha256 = "05bb3hcb00j1f047q6ngbb8arrp4s03da880sky0slvvicm4ynkr";
+      name = "kdesu-5.87.0.tar.xz";
     };
   };
   kdewebkit = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/portingAids/kdewebkit-5.85.0.tar.xz";
-      sha256 = "14w254wfp35sldadff1y62yl6f1kshlfk4vlhlan626vyidypc43";
-      name = "kdewebkit-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/portingAids/kdewebkit-5.87.0.tar.xz";
+      sha256 = "1a578sa6nfp2vycrrhc37idwg47nrrfhv6dp8rfb2gj4vf67bzcv";
+      name = "kdewebkit-5.87.0.tar.xz";
     };
   };
   kdnssd = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kdnssd-5.85.0.tar.xz";
-      sha256 = "0i1qv6qjsdlb08mwiqs3s6v2hwfr77i65hgc0qj9pbhzvm5v6x8m";
-      name = "kdnssd-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kdnssd-5.87.0.tar.xz";
+      sha256 = "1rs8i75qm1vazy8cnvcv3sha6faf27bav491z8brcs8fiab96dnw";
+      name = "kdnssd-5.87.0.tar.xz";
     };
   };
   kdoctools = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kdoctools-5.85.0.tar.xz";
-      sha256 = "01bxzp65ffwr14yrrbw8p15lkwhisv15drwkgcwg48f289f51if1";
-      name = "kdoctools-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kdoctools-5.87.0.tar.xz";
+      sha256 = "0md5wiv5mv4q63g9ads8d0xg8qxlh91dqgyg66n8abcg56qq83ps";
+      name = "kdoctools-5.87.0.tar.xz";
     };
   };
   kemoticons = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kemoticons-5.85.0.tar.xz";
-      sha256 = "0zihi00fql8q4jp08n71agmjrpr5177yw24w0vf0lmjhgmxwkrsw";
-      name = "kemoticons-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kemoticons-5.87.0.tar.xz";
+      sha256 = "0iah6ws0x9xnm900rii2k82gf155cbwlnxbz2rxbybp1dmbjbz5y";
+      name = "kemoticons-5.87.0.tar.xz";
     };
   };
   kfilemetadata = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kfilemetadata-5.85.0.tar.xz";
-      sha256 = "07i52zi4jmqhm2sazw2jx7g7s3mp8c7kr32z3ikifsc5wfzy8kix";
-      name = "kfilemetadata-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kfilemetadata-5.87.0.tar.xz";
+      sha256 = "1nh4gzprc588q8zfz94j76x3vvf77cnsc30xrs07316726mksw2i";
+      name = "kfilemetadata-5.87.0.tar.xz";
     };
   };
   kglobalaccel = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kglobalaccel-5.85.0.tar.xz";
-      sha256 = "0f5ly344a06aaj3rcsa45xzg9xx0s2qsgk5r0h2kphkj8n2gpp70";
-      name = "kglobalaccel-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kglobalaccel-5.87.0.tar.xz";
+      sha256 = "1wk6mxq6ylkvalcwbrkmc0whvkbllkfwnsf4hxz86cnixqb7ybjh";
+      name = "kglobalaccel-5.87.0.tar.xz";
     };
   };
   kguiaddons = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kguiaddons-5.85.0.tar.xz";
-      sha256 = "1d1724k67chiv4sxbaifnwzwcss3kry3ms9frpxifi2nsn0x9nhc";
-      name = "kguiaddons-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kguiaddons-5.87.0.tar.xz";
+      sha256 = "1k88x22f8db90x28fryg6cp239sfs0zrjk18l72v09bg3zc7y1lh";
+      name = "kguiaddons-5.87.0.tar.xz";
     };
   };
   kholidays = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kholidays-5.85.0.tar.xz";
-      sha256 = "0nrxn8sjzp1lg3va7703d5hxmda33d0f91rgq2s99mxi77a82yi2";
-      name = "kholidays-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kholidays-5.87.0.tar.xz";
+      sha256 = "1ca51vkmwwrl1fvs2fw16nvpmag2licywwmwjiaapkk8hv6v1gzm";
+      name = "kholidays-5.87.0.tar.xz";
     };
   };
   khtml = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/portingAids/khtml-5.85.0.tar.xz";
-      sha256 = "0ma9sk51pszxqmvzlrfdsnh2f8fm09wd0kaywsrkvbh2q2f6kg8g";
-      name = "khtml-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/portingAids/khtml-5.87.0.tar.xz";
+      sha256 = "1jxpznzw4r8ikx0g5n1fg0qrkllph5cwih4lcvwjn6cqx2ypgn6f";
+      name = "khtml-5.87.0.tar.xz";
     };
   };
   ki18n = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/ki18n-5.85.0.tar.xz";
-      sha256 = "1h1jcdyc3cphkn56qfn5j6jbbb6wp5z0vp8kxzm1wd023sj83dqn";
-      name = "ki18n-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/ki18n-5.87.0.tar.xz";
+      sha256 = "0395khchbhp7x4fgb2fwxlpx0mhdvbkgd0v7kwgmm0n4bkn7jphi";
+      name = "ki18n-5.87.0.tar.xz";
     };
   };
   kiconthemes = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kiconthemes-5.85.0.tar.xz";
-      sha256 = "0k6ni351b051k8rfncpddf5zplqmg71wf9a5h8k6ix787h1r5dcp";
-      name = "kiconthemes-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kiconthemes-5.87.0.tar.xz";
+      sha256 = "04chb3y3d6hxwy9f1xdifvl2mbcd8xbh7fv6x5m5vnb1cviwc6j7";
+      name = "kiconthemes-5.87.0.tar.xz";
     };
   };
   kidletime = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kidletime-5.85.0.tar.xz";
-      sha256 = "1nclrxipjzasqi8g84lvpsr5rwfs9xfqgj377wfphm4qbml09x2z";
-      name = "kidletime-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kidletime-5.87.0.tar.xz";
+      sha256 = "1m0p602i9c4dmkll3g8flmzq23ywv20rxnvzc1c8bf5kqn6321qp";
+      name = "kidletime-5.87.0.tar.xz";
     };
   };
   kimageformats = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kimageformats-5.85.0.tar.xz";
-      sha256 = "1687sh19ph1v1bg4xrdrf0gs2nna0ds8gcqc8x7ydgdc2301m9jh";
-      name = "kimageformats-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kimageformats-5.87.0.tar.xz";
+      sha256 = "0c4qq5j6hzz90kh7mmirafglr9l5wck3r67ij436gpmq69ignvmg";
+      name = "kimageformats-5.87.0.tar.xz";
     };
   };
   kinit = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kinit-5.85.0.tar.xz";
-      sha256 = "03m6ik7l54q1w615111rqs0m7az7snh6x418s90xnzm81g0dzpwj";
-      name = "kinit-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kinit-5.87.0.tar.xz";
+      sha256 = "0435syvhisagbq82qcbims5adq88ivv793gvb3kx03hxhyyx81xs";
+      name = "kinit-5.87.0.tar.xz";
     };
   };
   kio = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kio-5.85.0.tar.xz";
-      sha256 = "1xhrmpz9xbwipxqvj7l6d1n471isb3jggrvgcx5hqlz659yqmmg4";
-      name = "kio-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kio-5.87.0.tar.xz";
+      sha256 = "0sxwrqvfkqm679v99lx50vd2p4bx10pdzrjhxg0njfwww2fxa7mr";
+      name = "kio-5.87.0.tar.xz";
     };
   };
   kirigami2 = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kirigami2-5.85.0.tar.xz";
-      sha256 = "0axdsxzmr735ci19srmgkgpm4x7h23vk37hhakfc6n30ry0j7lik";
-      name = "kirigami2-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kirigami2-5.87.0.tar.xz";
+      sha256 = "1wvj0nnb1dd1k12arlmlx99gjhk7v2jpw5sgyjka6kkps31nr1zi";
+      name = "kirigami2-5.87.0.tar.xz";
     };
   };
   kitemmodels = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kitemmodels-5.85.0.tar.xz";
-      sha256 = "0c55lw6r78x41v6fgycr68inviaxlxa6bj8zm8fdia631mhx273s";
-      name = "kitemmodels-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kitemmodels-5.87.0.tar.xz";
+      sha256 = "1qx78pfbnwsq8nn6fa8qjjc0zn4nwh4dqs0ifb9iaam33cl3kw92";
+      name = "kitemmodels-5.87.0.tar.xz";
     };
   };
   kitemviews = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kitemviews-5.85.0.tar.xz";
-      sha256 = "1fr8ivpvpaxykrgnjjsf8nhnhs60i4xhlkanvhrkkgjabxk0sbl0";
-      name = "kitemviews-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kitemviews-5.87.0.tar.xz";
+      sha256 = "1nrg92nyc39fl1n7k38pa4k8dahwl76wadv0v0ixyh1zx0x4clbg";
+      name = "kitemviews-5.87.0.tar.xz";
     };
   };
   kjobwidgets = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kjobwidgets-5.85.0.tar.xz";
-      sha256 = "05gpp2bvirbxs5yk0ysi5gh72axwv253yc2sqmzdsjylq4fjy8rl";
-      name = "kjobwidgets-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kjobwidgets-5.87.0.tar.xz";
+      sha256 = "0s0g4dygc6c9p5w7vdk7bninizsdhj5xan351x15b4k0ddgq8sz5";
+      name = "kjobwidgets-5.87.0.tar.xz";
     };
   };
   kjs = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/portingAids/kjs-5.85.0.tar.xz";
-      sha256 = "0inliv97x63174n3mn5jqyy8d440863g3m5pn69cq1i2mr5zyswb";
-      name = "kjs-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/portingAids/kjs-5.87.0.tar.xz";
+      sha256 = "1ihwhjgk3k2nmyfg2brdjriymm2qi5dgmh47phmb9b2gvzqx6yg8";
+      name = "kjs-5.87.0.tar.xz";
     };
   };
   kjsembed = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/portingAids/kjsembed-5.85.0.tar.xz";
-      sha256 = "1j8prfg7hpk0g7manilds27ivrcgxr3hidjzy0yzn13ckvv3ccj1";
-      name = "kjsembed-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/portingAids/kjsembed-5.87.0.tar.xz";
+      sha256 = "0j8b637k8vx2qhl3zf6744ywykv6hnfcs2xgsq0i8w5ji0a2jigv";
+      name = "kjsembed-5.87.0.tar.xz";
     };
   };
   kmediaplayer = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/portingAids/kmediaplayer-5.85.0.tar.xz";
-      sha256 = "1bmj24d3si937svh8zdi7xs0y4j1ibyj8z8q1y4k2vp8fa9fack6";
-      name = "kmediaplayer-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/portingAids/kmediaplayer-5.87.0.tar.xz";
+      sha256 = "0mrmb7q4wmj8v9ipb9vh4c8scl1mr0frz3yvpc96dyimvb87pp08";
+      name = "kmediaplayer-5.87.0.tar.xz";
     };
   };
   knewstuff = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/knewstuff-5.85.0.tar.xz";
-      sha256 = "1j90ysfw1qygaiigizbjik1k7zkl6wkin0r7r9q8r3dibvbqziph";
-      name = "knewstuff-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/knewstuff-5.87.0.tar.xz";
+      sha256 = "0xnilr3r3l36g3j7a2nf2kqmill22ibrr6qfniqcywmcqpnq7x4q";
+      name = "knewstuff-5.87.0.tar.xz";
     };
   };
   knotifications = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/knotifications-5.85.0.tar.xz";
-      sha256 = "0qr695sn2di24cal0x6yj4x1a8qk6jny68r4d4xdcy5i1i4yyni5";
-      name = "knotifications-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/knotifications-5.87.0.tar.xz";
+      sha256 = "03zraci1lnzz3d5i97i2m2h4z8xp4fmm28aizk3xipqkgy3q61c3";
+      name = "knotifications-5.87.0.tar.xz";
     };
   };
   knotifyconfig = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/knotifyconfig-5.85.0.tar.xz";
-      sha256 = "1aphmi7r4zmzrfk8635a66dnkd6zg2i17nrm0hfqhqhcfn217mfv";
-      name = "knotifyconfig-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/knotifyconfig-5.87.0.tar.xz";
+      sha256 = "0jd5yzjg625ixm3fbmpafvg6wc69cvppqr0z0y0wzkbzbd930ggh";
+      name = "knotifyconfig-5.87.0.tar.xz";
     };
   };
   kpackage = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kpackage-5.85.0.tar.xz";
-      sha256 = "14rwq5ckns06h0n8h4q2r7ilfr1myxcan1md1zz4cg4vb87ckimj";
-      name = "kpackage-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kpackage-5.87.0.tar.xz";
+      sha256 = "1dmhj1byxmk407mcz62ydrzzjab6c4da22blkm4f5das79blkdsy";
+      name = "kpackage-5.87.0.tar.xz";
     };
   };
   kparts = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kparts-5.85.0.tar.xz";
-      sha256 = "07px14xdh7p2kb9kvsma16xifsc65mhpm6xmnz15i5pdmrz1wxc1";
-      name = "kparts-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kparts-5.87.0.tar.xz";
+      sha256 = "0jmjyvrskhvnp0w1d9l9k5azwf1ppda97qp2801179x77bgdfbgi";
+      name = "kparts-5.87.0.tar.xz";
     };
   };
   kpeople = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kpeople-5.85.0.tar.xz";
-      sha256 = "03ynnbjj939b3cmczlz9piilkgh45fbyal71pab0qfpxr66m9fk5";
-      name = "kpeople-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kpeople-5.87.0.tar.xz";
+      sha256 = "002qnfxyrzv9jr1z86ih7v7bprbpfx311s646rbmjc6c9wqa5a1a";
+      name = "kpeople-5.87.0.tar.xz";
     };
   };
   kplotting = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kplotting-5.85.0.tar.xz";
-      sha256 = "0jhkc12fiz50iavz9msj6w29lhqrm6chl1521sx55km9cb3wmzda";
-      name = "kplotting-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kplotting-5.87.0.tar.xz";
+      sha256 = "1np6rqrxldnhz82ak291kr87zqccmp9a3v4gvxl0xsm2qnpzxlxz";
+      name = "kplotting-5.87.0.tar.xz";
     };
   };
   kpty = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kpty-5.85.0.tar.xz";
-      sha256 = "1zmzzlzv1pnx0d7w6v8yiccw1q2g94pfjzh4sm2k1fickgrfrir8";
-      name = "kpty-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kpty-5.87.0.tar.xz";
+      sha256 = "1qd2lj53m0gbpmfilwrcz5v2m735daqlxj2qv1j5m28b3bjwz2li";
+      name = "kpty-5.87.0.tar.xz";
     };
   };
   kquickcharts = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kquickcharts-5.85.0.tar.xz";
-      sha256 = "1hnbr3qkjy48pq8hkvl7lcfd8cywkkr77n8qf296rjmrv23jw4xf";
-      name = "kquickcharts-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kquickcharts-5.87.0.tar.xz";
+      sha256 = "1dx4ilwih9pfimfn5l3fgjf0z1k75p6sb7y03akgnl4i9w2aycv8";
+      name = "kquickcharts-5.87.0.tar.xz";
     };
   };
   kross = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/portingAids/kross-5.85.0.tar.xz";
-      sha256 = "07gnh98avv5zzybh4262jqkjy8kg0cplryv356kvsbarl4ksy4kr";
-      name = "kross-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/portingAids/kross-5.87.0.tar.xz";
+      sha256 = "1nnyl67b43064y5gvj7ccvzz5481vbaycjhxxzgf4iaj0qm2vpfh";
+      name = "kross-5.87.0.tar.xz";
     };
   };
   krunner = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/krunner-5.85.0.tar.xz";
-      sha256 = "1pz466pjrqd3dj2wdqsqxcpmim0ig8i7gvnw96mxlh262cv15h4d";
-      name = "krunner-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/krunner-5.87.0.tar.xz";
+      sha256 = "0ygqfaif9xp30ahrld85xzsgmfmy51560hl8ym8shggwar20kb1s";
+      name = "krunner-5.87.0.tar.xz";
     };
   };
   kservice = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kservice-5.85.0.tar.xz";
-      sha256 = "008b56jibgvpg6qqh7wqbg39fyca62w6nj7c9qxsgj1bd91vglg2";
-      name = "kservice-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kservice-5.87.0.tar.xz";
+      sha256 = "0a3fcqhwbzqwy9wy1787p8hr1s1jfmz3y1dk2spiifwk9l668mxn";
+      name = "kservice-5.87.0.tar.xz";
     };
   };
   ktexteditor = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/ktexteditor-5.85.0.tar.xz";
-      sha256 = "1j6xkz8w7mb47ypgcf00m7hl1ayli8r5a3l4fk5xzsz1k0g72l6m";
-      name = "ktexteditor-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/ktexteditor-5.87.0.tar.xz";
+      sha256 = "13dnwf2zvp3k6xb0ry5a11gaf2j7x2swhq8d689w4gf3awpma7rg";
+      name = "ktexteditor-5.87.0.tar.xz";
     };
   };
   ktextwidgets = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/ktextwidgets-5.85.0.tar.xz";
-      sha256 = "128jjcay0s2qi0zs32zxwlmh2xq4kzasc0zhy3l9gfv898yaq6zy";
-      name = "ktextwidgets-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/ktextwidgets-5.87.0.tar.xz";
+      sha256 = "04gmqw8wjf6r8lpsjcsg0925a6b6hnckzy5i9ykvian1kq2d79fr";
+      name = "ktextwidgets-5.87.0.tar.xz";
     };
   };
   kunitconversion = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kunitconversion-5.85.0.tar.xz";
-      sha256 = "0rcnmdqnm7h8ffxacza2v7y7zicly0yvz07g4857jxpk7h4z62hy";
-      name = "kunitconversion-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kunitconversion-5.87.0.tar.xz";
+      sha256 = "1b5yvs0inr0kj7i4j5yavlxz6n8h3d2wbgw39r2harzxd4xjzz4h";
+      name = "kunitconversion-5.87.0.tar.xz";
     };
   };
   kwallet = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kwallet-5.85.0.tar.xz";
-      sha256 = "053ddi83a5d1i61r8y6jimd5pafmilja25w5pl09g3fqkp3id677";
-      name = "kwallet-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kwallet-5.87.0.tar.xz";
+      sha256 = "1a2qiwhf6hwh6qs9x84hz1ryaaqqm8bpg9v29kjy6cq9krn3mwar";
+      name = "kwallet-5.87.0.tar.xz";
     };
   };
   kwayland = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kwayland-5.85.0.tar.xz";
-      sha256 = "0sfzpqb3v79jrhc49f4v3akc9wrv1976nb7xs9nd6ips237v86v2";
-      name = "kwayland-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kwayland-5.87.0.tar.xz";
+      sha256 = "03lrlprvc3bj43f0l0dirg93l7amzlcx4ajaqh9h54g030qanfmc";
+      name = "kwayland-5.87.0.tar.xz";
     };
   };
   kwidgetsaddons = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kwidgetsaddons-5.85.0.tar.xz";
-      sha256 = "14042vc9jl48fclsfmsincwqj2s6mfm3lbq4yg5vlj931kznyr31";
-      name = "kwidgetsaddons-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kwidgetsaddons-5.87.0.tar.xz";
+      sha256 = "00gv9lxiah6yg8lxjd0md0zyvhi7zc9s6fg14jfh0cb1i0zrn49b";
+      name = "kwidgetsaddons-5.87.0.tar.xz";
     };
   };
   kwindowsystem = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kwindowsystem-5.85.0.tar.xz";
-      sha256 = "07k6d6sgxlfwkjg0r9lgvlkd7j53b986qfv283c313ahy5c3gd3d";
-      name = "kwindowsystem-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kwindowsystem-5.87.0.tar.xz";
+      sha256 = "0rxmpawp5g46xp5irk1gcdq6n2y9r9vlx1dm5gpqhcfh7gr64ja2";
+      name = "kwindowsystem-5.87.0.tar.xz";
     };
   };
   kxmlgui = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kxmlgui-5.85.0.tar.xz";
-      sha256 = "1ciwrm16a5cgmkkm8cv72cyr45q418gsrxc3qrjq3iic9ycf6fi5";
-      name = "kxmlgui-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kxmlgui-5.87.0.tar.xz";
+      sha256 = "1wnss0rjspgih3m2a3faflamf7n681k8sf8pzrcsrvvrzq95n65i";
+      name = "kxmlgui-5.87.0.tar.xz";
     };
   };
   kxmlrpcclient = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/portingAids/kxmlrpcclient-5.85.0.tar.xz";
-      sha256 = "117cvdf7iy1139sx0vk906whmkm3ffw0wivqdjdcfwxsdxi6s6d1";
-      name = "kxmlrpcclient-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/portingAids/kxmlrpcclient-5.87.0.tar.xz";
+      sha256 = "03l5zs4l52f3w01hsk00r8hmnccyy3iw2vhiclvpp6dksmb8yad7";
+      name = "kxmlrpcclient-5.87.0.tar.xz";
     };
   };
   modemmanager-qt = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/modemmanager-qt-5.85.0.tar.xz";
-      sha256 = "1jb27266dc6ry2y3w9bf1sf20xxw2rkb6ac8z9p46r0myhj2zn2j";
-      name = "modemmanager-qt-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/modemmanager-qt-5.87.0.tar.xz";
+      sha256 = "1ag98r2hhd93gki3dvlz48sgqc2805b0p0w4m0az0czvxnclg0rk";
+      name = "modemmanager-qt-5.87.0.tar.xz";
     };
   };
   networkmanager-qt = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/networkmanager-qt-5.85.0.tar.xz";
-      sha256 = "1lg17ibk9mn4jsxh6dl0yzyhy26xifymvrf5saggl28vkkhvnh6r";
-      name = "networkmanager-qt-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/networkmanager-qt-5.87.0.tar.xz";
+      sha256 = "0a4sxcm88mfry1sjc4r0qx5aqmbb61ghmd912wqk19nx18qgkm5y";
+      name = "networkmanager-qt-5.87.0.tar.xz";
     };
   };
   oxygen-icons5 = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/oxygen-icons5-5.85.0.tar.xz";
-      sha256 = "0if136n5mkvxhiyvlmwmj3q9y1g1gr9qz4qqdcsn6wy9jippq46g";
-      name = "oxygen-icons5-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/oxygen-icons5-5.87.0.tar.xz";
+      sha256 = "0mpxv2m6nkl1cp3p0xgpm916k2ykvkyk0x0ka4azs8iyy0anc36m";
+      name = "oxygen-icons5-5.87.0.tar.xz";
     };
   };
   plasma-framework = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/plasma-framework-5.85.0.tar.xz";
-      sha256 = "1zzqmm7s39bcay3b4f6qzhd5pw3q6p9fas94i88afhqsxjbkm6w7";
-      name = "plasma-framework-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/plasma-framework-5.87.0.tar.xz";
+      sha256 = "1y7w4b7jb8rnkfan97yln5w9w68skrmif4wqqba4f9mj6y2dcajb";
+      name = "plasma-framework-5.87.0.tar.xz";
     };
   };
   prison = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/prison-5.85.0.tar.xz";
-      sha256 = "1c6dq4ql3n6s9xwvs6ix8n3fsv96aqdvd0qwc1n4sap9xlg3752n";
-      name = "prison-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/prison-5.87.0.tar.xz";
+      sha256 = "0vb8ny4za37v4nmcy9qw8zz5zcr46clci9lg22s84f26l4vlcs87";
+      name = "prison-5.87.0.tar.xz";
     };
   };
   purpose = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/purpose-5.85.0.tar.xz";
-      sha256 = "13r47g81qfqdvd0s70r9dwlcdg8c6m5xrnpvypjs6cd51907m0f5";
-      name = "purpose-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/purpose-5.87.0.tar.xz";
+      sha256 = "0ddpm2hm3x1p25hkjzff4vs906n5bkkk4j3myh0gvyqn8accdhsd";
+      name = "purpose-5.87.0.tar.xz";
     };
   };
   qqc2-desktop-style = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/qqc2-desktop-style-5.85.0.tar.xz";
-      sha256 = "1hkcy3dzaqfkxnmj9k278q0dijiwhjmzw98xxj9fh8mjygwkj1dp";
-      name = "qqc2-desktop-style-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/qqc2-desktop-style-5.87.0.tar.xz";
+      sha256 = "02i4rg5gf7i63lm4f0afm9n3lgzvklpbg43d0zcsdwzph386baq7";
+      name = "qqc2-desktop-style-5.87.0.tar.xz";
     };
   };
   solid = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/solid-5.85.0.tar.xz";
-      sha256 = "0gcddgrz07j9dgf4fg9hc810zr8f3az9b0qvxax9ys9x5kg1dr57";
-      name = "solid-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/solid-5.87.0.tar.xz";
+      sha256 = "0zmcc4ryp4j93999f0fgwvchs4gycbynsz0wghrhdqkfhsjvhqra";
+      name = "solid-5.87.0.tar.xz";
     };
   };
   sonnet = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/sonnet-5.85.0.tar.xz";
-      sha256 = "1cg2f09c0blk7ymlq7j3a1bci78kv1n0xq3ys4kxgf53khwhdqpw";
-      name = "sonnet-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/sonnet-5.87.0.tar.xz";
+      sha256 = "1cc9j9ks33s6amr01a7ywnqiqvm498vlmqqva40ddvkfq1azxmhs";
+      name = "sonnet-5.87.0.tar.xz";
     };
   };
   syndication = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/syndication-5.85.0.tar.xz";
-      sha256 = "05hvzxzlvdzc2sxapjvqhdycdvn6bnq0hs45c88pb13ncxxljdxh";
-      name = "syndication-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/syndication-5.87.0.tar.xz";
+      sha256 = "1xbs83smgqzk01r7nds6p74v9n1pa0zhlafbbxlj2m226p1zf8bs";
+      name = "syndication-5.87.0.tar.xz";
     };
   };
   syntax-highlighting = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/syntax-highlighting-5.85.0.tar.xz";
-      sha256 = "1qn9n2sv9n22j7bhq4n93i985v244kkg0vi5c33s9zppb4xgd34a";
-      name = "syntax-highlighting-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/syntax-highlighting-5.87.0.tar.xz";
+      sha256 = "148wm3qdjkwzvcm51x3cppsxl4rylbjyjp1pfh6545fhikm5nqi6";
+      name = "syntax-highlighting-5.87.0.tar.xz";
     };
   };
   threadweaver = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/threadweaver-5.85.0.tar.xz";
-      sha256 = "0md5bnkn5bh2jqzj7m444bmn5c7davyhwlffi0pg22r01m44l6s3";
-      name = "threadweaver-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/threadweaver-5.87.0.tar.xz";
+      sha256 = "1gqpzv2ijw66fpvaqv66xsglh19lv0k4j9i505xmmkzlyddbhkch";
+      name = "threadweaver-5.87.0.tar.xz";
     };
   };
 }

pkgs/development/libraries/libaom/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "3.1.2";
+  version = "3.1.3";
 
   src = fetchzip {
     url = "https://aomedia.googlesource.com/aom/+archive/v${version}.tar.gz";
-    sha256 = "1c7yrhb56qj5c3lz54n1f9cbrvdr32g2yrrdiiy72sib8ycq9hz2";
+    sha256 = "08rk31d2cp9k9nj37s6a4n7klpfqfbj62anwyiggzsz7b68psjq3";
     stripRoot = false;
   };
 

pkgs/development/libraries/libaom/outputs.patch

@@ -1,37 +1,55 @@
+diff --git a/build/cmake/aom_install.cmake b/build/cmake/aom_install.cmake
+index 0bd2bf035..5cf5acea8 100644
 --- a/build/cmake/aom_install.cmake
 +++ b/build/cmake/aom_install.cmake
-@@ -45,2 +45,2 @@ macro(setup_aom_install_targets)
+@@ -42,8 +42,8 @@ macro(setup_aom_install_targets)
+               -DAOM_ROOT=${AOM_ROOT}
+               -DCMAKE_INSTALL_PREFIX=${CMAKE_INSTALL_PREFIX}
+               -DCMAKE_INSTALL_BINDIR=${CMAKE_INSTALL_BINDIR}
 -              -DCMAKE_INSTALL_INCLUDEDIR=${CMAKE_INSTALL_INCLUDEDIR}
 -              -DCMAKE_INSTALL_LIBDIR=${CMAKE_INSTALL_LIBDIR}
 +              -DCMAKE_INSTALL_FULL_INCLUDEDIR=${CMAKE_INSTALL_FULL_INCLUDEDIR}
 +              -DCMAKE_INSTALL_FULL_LIBDIR=${CMAKE_INSTALL_FULL_LIBDIR}
-@@ -82,14 +82,14 @@ macro(setup_aom_install_targets)
-     install(
-       FILES ${AOM_INSTALL_INCS}
--      DESTINATION "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_INCLUDEDIR}/aom")
-+      DESTINATION "${CMAKE_INSTALL_FULL_INCLUDEDIR}/aom")
-     install(
-       FILES "${AOM_PKG_CONFIG_FILE}"
--      DESTINATION "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}/pkgconfig")
-+      DESTINATION "${CMAKE_INSTALL_FULL_LIBDIR}/pkgconfig")
-     install(TARGETS ${AOM_INSTALL_LIBS} DESTINATION
--                    "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}")
-+                    "${CMAKE_INSTALL_FULL_LIBDIR}")
- 
-     if(ENABLE_EXAMPLES)
-       install(TARGETS ${AOM_INSTALL_BINS} DESTINATION
--                      "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_BINDIR}")
-+                      "${CMAKE_INSTALL_FULL_BINDIR}")
-     endif()
+               -DCMAKE_PROJECT_NAME=${CMAKE_PROJECT_NAME}
+               -DCONFIG_MULTITHREAD=${CONFIG_MULTITHREAD}
+               -DCONFIG_TUNE_VMAF=${CONFIG_TUNE_VMAF}
+@@ -84,12 +84,12 @@ macro(setup_aom_install_targets)
+     # Setup the install rules. install() will automatically prepend
+     # CMAKE_INSTALL_PREFIX to relative paths
+     install(FILES ${AOM_INSTALL_INCS}
+-            DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aom")
++            DESTINATION "${CMAKE_INSTALL_FULL_INCLUDEDIR}/aom")
+     install(FILES "${AOM_PKG_CONFIG_FILE}"
+-            DESTINATION "${CMAKE_INSTALL_LIBDIR}/pkgconfig")
++            DESTINATION "${CMAKE_INSTALL_FULL_LIBDIR}/pkgconfig")
+     install(TARGETS ${AOM_INSTALL_LIBS};${AOM_INSTALL_BINS}
+-            RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}"
+-            LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}"
+-            ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}")
++            RUNTIME DESTINATION "${CMAKE_INSTALL_FULL_BINDIR}"
++            LIBRARY DESTINATION "${CMAKE_INSTALL_FULL_LIBDIR}"
++            ARCHIVE DESTINATION "${CMAKE_INSTALL_FULL_LIBDIR}")
    endif()
+ endmacro()
+diff --git a/build/cmake/pkg_config.cmake b/build/cmake/pkg_config.cmake
+index e8fff2e77..b8a73aad4 100644
 --- a/build/cmake/pkg_config.cmake
 +++ b/build/cmake/pkg_config.cmake
-@@ -14,2 +14,2 @@
+@@ -11,8 +11,8 @@
+ cmake_minimum_required(VERSION 3.5)
+ 
+ set(REQUIRED_ARGS "AOM_ROOT" "AOM_CONFIG_DIR" "CMAKE_INSTALL_PREFIX"
 -                  "CMAKE_INSTALL_BINDIR" "CMAKE_INSTALL_INCLUDEDIR"
 -                  "CMAKE_INSTALL_LIBDIR" "CMAKE_PROJECT_NAME"
 +                  "CMAKE_INSTALL_BINDIR" "CMAKE_INSTALL_FULL_INCLUDEDIR"
 +                  "CMAKE_INSTALL_FULL_LIBDIR" "CMAKE_PROJECT_NAME"
-@@ -38,4 +38,4 @@ endif()
+                   "CONFIG_MULTITHREAD" "HAVE_PTHREAD_H")
+ 
+ foreach(arg ${REQUIRED_ARGS})
+@@ -35,15 +35,15 @@ else()
+ endif()
+ 
+ # Write pkg-config info.
 -set(prefix "${CMAKE_INSTALL_PREFIX}")
 -set(bindir "${CMAKE_INSTALL_BINDIR}")
 -set(includedir "${CMAKE_INSTALL_INCLUDEDIR}")
@@ -40,6 +58,12 @@
 +get_filename_component(exec_prefix "${CMAKE_INSTALL_FULL_LIBDIR}" DIRECTORY)
 +get_filename_component(includedir "${CMAKE_INSTALL_FULL_INCLUDEDIR}" NAME)
 +get_filename_component(libdir "${CMAKE_INSTALL_FULL_LIBDIR}" NAME)
-@@ -46 +46 @@ file(APPEND "${pkgconfig_file}" "prefix=${prefix}\n")
+ set(pkgconfig_file "${AOM_CONFIG_DIR}/aom.pc")
+ string(TOLOWER ${CMAKE_PROJECT_NAME} pkg_name)
+ file(WRITE "${pkgconfig_file}" "# libaom pkg-config.\n")
+ file(APPEND "${pkgconfig_file}" "prefix=${prefix}\n")
 -file(APPEND "${pkgconfig_file}" "exec_prefix=\${prefix}\n")
 +file(APPEND "${pkgconfig_file}" "exec_prefix=${exec_prefix}\n")
+ file(APPEND "${pkgconfig_file}" "includedir=\${prefix}/${includedir}\n")
+ file(APPEND "${pkgconfig_file}" "libdir=\${exec_prefix}/${libdir}\n\n")
+ file(APPEND "${pkgconfig_file}" "Name: ${pkg_name}\n")

pkgs/development/libraries/libass/default.nix

@@ -15,11 +15,11 @@ in
 with lib;
 stdenv.mkDerivation rec {
   pname = "libass";
-  version = "0.15.1";
+  version = "0.15.2";
 
   src = fetchurl {
     url = "https://github.com/libass/libass/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-HN05ydAHsG5zfnc4AE1/OM+bHpKEPzcweyTn/2OrjlM=";
+    sha256 = "sha256-G+LfnESFpX14uxjAqO0Ve8h6Wo3UjGYZYcYlyxEoMv0=";
   };
 
   configureFlags = [

pkgs/development/libraries/libdeflate/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdeflate";
-  version = "1.7";
+  version = "1.8";
 
   src = fetchFromGitHub {
     owner = "ebiggers";
     repo = "libdeflate";
     rev = "v${version}";
-    sha256 = "1hnn1yd9s5h92xs72y73izak47kdz070kxkw3kyz2d3az6brfdgh";
+    sha256 = "sha256-P7YbuhP2/zJCpE9dxZev1yy5oda8WKAHY84ZLTL8gVs=";
   };
 
   postPatch = ''

pkgs/development/libraries/libfido2/default.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , cmake
 , pkg-config
 , hidapi
@@ -13,24 +12,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libfido2";
-  version = "1.7.0";
+  version = "1.8.0";
 
   # releases on https://developers.yubico.com/libfido2/Releases/ are signed
   src = fetchurl {
     url = "https://developers.yubico.com/${pname}/Releases/${pname}-${version}.tar.gz";
-    sha256 = "13khkp2q8g447797l09p83qxy0z8vgmzr54l8dcnapy9lsr4jrqi";
+    sha256 = "07gxyy5yzgfh5hg7q9fr77z5mkj0xjvd5ya7p5f5kar4iwc92hjm";
   };
 
-  patches = [
-    # fix log truncation
-    # https://github.com/Yubico/libfido2/issues/318
-    # https://github.com/Yubico/libfido2/pull/319
-    (fetchpatch {
-      url = "https://github.com/Yubico/libfido2/commit/8edb9a204b2f4aeb487e282908c3187f1d02d606.patch";
-      sha256 = "1i360bghwbdccgkzjfzvhilscnwsj9lhfiviy000n928698l4wan";
-    })
-  ];
-
   nativeBuildInputs = [ cmake pkg-config ];
 
   buildInputs = [ libcbor openssl zlib ]

pkgs/development/libraries/libfive/default.nix

@@ -36,8 +36,6 @@ mkDerivation {
       -change libfive.dylib $out/lib/libfive.dylib \
       -change libfive-guile.dylib $out/lib/libfive-guile.dylib \
       $out/Applications/Studio.app/Contents/MacOS/Studio
-
-    wrapQtApp $out/Applications/Studio.app/Contents/MacOS/Studio
   '' else ''
     # Link "Studio" binary to "libfive-studio" to be more obvious:
     ln -s "$out/bin/Studio" "$out/bin/libfive-studio"

pkgs/development/libraries/libinput/default.nix

@@ -22,11 +22,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.18.1";
+  version = "1.19.1";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libinput/libinput-${version}.tar.xz";
-    sha256 = "1jx7y48ym89grjz67jmn80h5j8c36qgwb0h5c703nln2zchl18cw";
+    sha256 = "sha256-C9z1sXg7c3hUt68coi32e8Nqb+fJz6cfAekUn5IgRG0=";
   };
 
   outputs = [ "bin" "out" "dev" ];

pkgs/development/libraries/libksba/default.nix

@@ -1,10 +1,11 @@
 { buildPackages, lib, stdenv, fetchurl, gettext, libgpg-error }:
 
 stdenv.mkDerivation rec {
-  name = "libksba-1.5.1";
+  pname = "libksba";
+  version = "1.5.1";
 
   src = fetchurl {
-    url = "mirror://gnupg/libksba/${name}.tar.bz2";
+    url = "mirror://gnupg/libksba/libksba-${version}.tar.bz2";
     sha256 = "sha256-sPTGXk5EfZojSfa4wOd6KL6VMeRUi6AsVF0fRtx7+SE=";
   };
 
@@ -26,6 +27,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.gnupg.org";
     description = "CMS and X.509 access library";
     platforms = platforms.all;
+    maintainers = with maintainers; [ ];
     license = licenses.lgpl3;
   };
 }

pkgs/development/libraries/libqmi/default.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.28.8";
+  version = "1.30.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libqmi/${pname}-${version}.tar.xz";
-    sha256 = "sha256-bju70gC8G2SyP2JU/vkhLyaZ7HfPsyB10rpQecc6n3g=";
+    sha256 = "sha256-vgHs4OosIZTL6ldEv1qvBsBLpft+x4h6ExFsdtEU/t0=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/librsvg/default.nix

@@ -12,10 +12,12 @@
 , ApplicationServices
 , Foundation
 , libobjc
+, rustPlatform
 , rustc
 , cargo
 , gnome
 , vala
+, withIntrospection ? stdenv.hostPlatform == stdenv.buildPlatform
 , gobject-introspection
 , nixosTests
 }:
@@ -31,11 +33,20 @@ stdenv.mkDerivation rec {
     sha256 = "14zkdd7a9mymnfs3laqj0gr69c16nwixvbc5a4gvd534w6riz0mx";
   };
 
+  cargoVendorDir = "vendor";
+
+  strictDeps = true;
+
+  depsBuildBuild = [ pkg-config ];
+
   nativeBuildInputs = [
+    gdk-pixbuf
     pkg-config
     rustc
     cargo
     vala
+    rustPlatform.cargoSetupHook
+  ] ++ lib.optionals withIntrospection [
     gobject-introspection
   ] ++ lib.optionals stdenv.isDarwin [
     ApplicationServices
@@ -47,6 +58,8 @@ stdenv.mkDerivation rec {
     bzip2
     pango
     libintl
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
   ] ++ lib.optionals stdenv.isDarwin [
     libobjc
   ];
@@ -58,12 +71,12 @@ stdenv.mkDerivation rec {
   ];
 
   configureFlags = [
-    "--enable-introspection"
-  ] ++ lib.optionals (!stdenv.isDarwin) [
+    (lib.enableFeature withIntrospection "introspection")
+
     # Vapi does not build on MacOS.
     # https://github.com/NixOS/nixpkgs/pull/117081#issuecomment-827782004
-    "--enable-vala"
-  ] ++ [
+    (lib.enableFeature (withIntrospection && !stdenv.isDarwin) "vala")
+
     "--enable-installed-tests"
     "--enable-always-build-tests"
   ] ++ lib.optional stdenv.isDarwin "--disable-Bsymbolic";
@@ -95,11 +108,11 @@ stdenv.mkDerivation rec {
         -i gdk-pixbuf-loader/librsvg.thumbnailer.in
   '';
 
-  # Merge gdkpixbuf and librsvg loaders
-  postInstall = ''
-    mv $GDK_PIXBUF/loaders.cache $GDK_PIXBUF/loaders.cache.tmp
-    cat ${gdk-pixbuf.out}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache $GDK_PIXBUF/loaders.cache.tmp > $GDK_PIXBUF/loaders.cache
-    rm $GDK_PIXBUF/loaders.cache.tmp
+  # Not generated when cross compiling.
+  postInstall = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
+    # Merge gdkpixbuf and librsvg loaders
+    cat ${lib.getLib gdk-pixbuf}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache $GDK_PIXBUF/loaders.cache > $GDK_PIXBUF/loaders.cache.tmp
+    mv $GDK_PIXBUF/loaders.cache.tmp $GDK_PIXBUF/loaders.cache
   '';
 
   passthru = {

pkgs/development/libraries/libvirt/5.9.0.nix

@@ -2,7 +2,7 @@
 , pkg-config, makeWrapper, libtool, autoconf, automake, fetchpatch
 , coreutils, libxml2, gnutls, perl, python2, attr
 , iproute2, iptables, readline, lvm2, util-linux, systemd, libpciaccess, gettext
-, libtasn1, ebtables, libgcrypt, yajl, pmutils, libcap_ng, libapparmor
+, libtasn1, libgcrypt, yajl, pmutils, libcap_ng, libapparmor
 , dnsmasq, libnl, libpcap, libxslt, xhtml1, numad, numactl, perlPackages
 , curl, libiconv, gmp, zfs, parted, bridge-utils, dmidecode, glib, rpcsvc-proto, libtirpc
 , enableXen ? false, xen ? null
@@ -54,7 +54,7 @@ in stdenv.mkDerivation rec {
 
   preConfigure = ''
     ${ optionalString (!buildFromTarball) "./bootstrap --no-git --gnulib-srcdir=$(pwd)/.gnulib" }
-    PATH=${lib.makeBinPath ([ dnsmasq ] ++ optionals stdenv.isLinux [ iproute2 iptables ebtables lvm2 systemd numad ] ++ optionals enableIscsi [ openiscsi ])}:$PATH
+    PATH=${lib.makeBinPath ([ dnsmasq ] ++ optionals stdenv.isLinux [ iproute2 iptables lvm2 systemd numad ] ++ optionals enableIscsi [ openiscsi ])}:$PATH
     # the path to qemu-kvm will be stored in VM's .xml and .save files
     # do not use "''${qemu_kvm}/bin/qemu-kvm" to avoid bound VMs to particular qemu derivations
     substituteInPlace src/lxc/lxc_conf.c \
@@ -75,7 +75,6 @@ in stdenv.mkDerivation rec {
   ] ++ optionals stdenv.isLinux [
     "QEMU_BRIDGE_HELPER=/run/wrappers/bin/qemu-bridge-helper"
     "QEMU_PR_HELPER=/run/libvirt/nix-helpers/qemu-pr-helper"
-    "EBTABLES_PATH=${ebtables}/bin/ebtables-legacy"
     "CFLAGS=-I${libtirpc.dev}/include/tirpc"
     "--with-attr"
     "--with-apparmor"
@@ -101,7 +100,7 @@ in stdenv.mkDerivation rec {
 
 
   postInstall = let
-    binPath = [ iptables iproute2 pmutils numad numactl bridge-utils dmidecode dnsmasq ebtables ] ++ optionals enableIscsi [ openiscsi ];
+    binPath = [ iptables iproute2 pmutils numad numactl bridge-utils dmidecode dnsmasq ] ++ optionals enableIscsi [ openiscsi ];
   in ''
     substituteInPlace $out/libexec/libvirt-guests.sh \
       --replace 'ON_BOOT=start'       'ON_BOOT=''${ON_BOOT:-start}' \

pkgs/development/libraries/libvirt/default.nix

@@ -22,7 +22,6 @@
 , gettext
 , libtasn1
 , iptables
-, ebtables
 , libgcrypt
 , yajl
 , pmutils
@@ -68,19 +67,6 @@ with lib;
 # if you update, also bump <nixpkgs/pkgs/development/python-modules/libvirt/default.nix> and SysVirt in <nixpkgs/pkgs/top-level/perl-packages.nix>
 let
   buildFromTarball = stdenv.isDarwin;
-  # libvirt hardcodes the binary name 'ebtables', but in nixpkgs the ebtables
-  # binary we want to use is named 'ebtables-legacy'.
-  # Create a derivation to alias the binary name so that libvirt can find the right one, and use that below.
-  ebtables-compat = stdenv.mkDerivation {
-    pname = "ebtables-compat";
-    version = ebtables.version;
-    src = null;
-    buildInputs = [ ebtables ];
-    buildCommand = ''
-      mkdir -p $out/bin
-      ln -sf ${ebtables}/bin/ebtables-legacy $out/bin/ebtables
-    '';
-  };
 in
 stdenv.mkDerivation rec {
   pname = "libvirt";
@@ -178,7 +164,7 @@ stdenv.mkDerivation rec {
       '';
     in
     ''
-      PATH=${lib.makeBinPath ([ dnsmasq ] ++ optionals stdenv.isLinux [ iproute2 iptables ebtables-compat lvm2 systemd numad ] ++ optionals enableIscsi [ openiscsi ])}:$PATH
+      PATH=${lib.makeBinPath ([ dnsmasq ] ++ optionals stdenv.isLinux [ iproute2 iptables lvm2 systemd numad ] ++ optionals enableIscsi [ openiscsi ])}:$PATH
       # the path to qemu-kvm will be stored in VM's .xml and .save files
       # do not use "''${qemu_kvm}/bin/qemu-kvm" to avoid bound VMs to particular qemu derivations
       substituteInPlace src/lxc/lxc_conf.c \
@@ -226,8 +212,7 @@ stdenv.mkDerivation rec {
 
   postInstall =
     let
-      # Keep the legacy iptables binary for now for backwards compatibility (comment on #109332)
-      binPath = [ iptables ebtables-compat iproute2 pmutils numad numactl bridge-utils dmidecode dnsmasq ] ++ optionals enableIscsi [ openiscsi ];
+      binPath = [ iptables iproute2 pmutils numad numactl bridge-utils dmidecode dnsmasq ] ++ optionals enableIscsi [ openiscsi ];
     in
     ''
         substituteInPlace $out/libexec/libvirt-guests.sh \

pkgs/development/libraries/libxml2/default.nix

@@ -1,5 +1,6 @@
 { stdenv, lib, fetchurl, fetchpatch
 , zlib, xz, libintl, python, gettext, ncurses, findXMLCatalogs
+, libiconv
 , pythonSupport ? enableShared && stdenv.buildPlatform == stdenv.hostPlatform
 , icuSupport ? false, icu ? null
 , enableShared ? stdenv.hostPlatform.libc != "msvcrt" && !stdenv.hostPlatform.isStatic
@@ -52,7 +53,9 @@ stdenv.mkDerivation rec {
     # RUNPATH for that, leading to undefined references for its users.
     ++ lib.optional stdenv.isFreeBSD xz;
 
-  propagatedBuildInputs = [ zlib findXMLCatalogs ] ++ lib.optional icuSupport icu;
+  propagatedBuildInputs = [ zlib findXMLCatalogs ]
+    ++ lib.optional stdenv.isDarwin libiconv
+    ++ lib.optional icuSupport icu;
 
   configureFlags = [
     "--exec_prefix=$dev"

pkgs/development/libraries/mesa/default.nix

@@ -93,6 +93,10 @@ self = stdenv.mkDerivation {
     ++ lib.optional stdenv.isLinux "driversdev"
     ++ lib.optional enableOpenCL "opencl";
 
+  preConfigure = ''
+    PATH=${llvmPackages.libllvm.dev}/bin:$PATH
+  '';
+
   # TODO: Figure out how to enable opencl without having a runtime dependency on clang
   mesonFlags = [
     "--sysconfdir=/etc"

pkgs/development/libraries/nss/default.nix

@@ -27,7 +27,7 @@ let
   #       It will rebuild itself using the version of this package (NSS) and if
   #       an update is required do the required changes to the expression.
   #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
-  version = "3.70";
+  version = "3.71";
 
 in
 stdenv.mkDerivation rec {
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings [ "." ] [ "_" ] version}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "sha256-K4mruGAe5AW+isW1cD1x8fs4pRw6ZKPYNDh/eLMlURs=";
+    sha256 = "0ly2l3dv6z5hlxs72h5x6796ni3x1bq60saavaf42ddgv4ax7b4r";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];

pkgs/development/libraries/p11-kit/default.nix

@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"
-    "--with-trust-paths=/etc/ssl/certs/ca-certificates.crt"
+    "--with-trust-paths=/etc/ssl/trust-source:/etc/ssl/certs/ca-certificates.crt"
   ];
 
   enableParallelBuilding = true;

pkgs/development/libraries/plasma-wayland-protocols/default.nix

@@ -5,11 +5,11 @@
 
 mkDerivation rec {
   pname = "plasma-wayland-protocols";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-DaojYvLg0V954OAG6NfxkI6I43tcUgi0DJyw1NbcqbU=";
+    sha256 = "sha256-OLBDHZMagzk3cKu4KUIGk2tjuJzu4/DGPw8Ibz0rG6k=";
   };
 
   nativeBuildInputs = [ extra-cmake-modules ];

pkgs/development/libraries/qt-5/5.15/default.nix

@@ -112,6 +112,11 @@ let
         url = "https://codereview.qt-project.org/gitweb?p=qt/qtbase.git;a=patch;h=049e14870c13235cd066758f29c42dc96c1ccdf8";
         sha256 = "1cb2hwi859hds0fa2cbap014qaa7mah9p0rcxcm2cvj2ybl33qfc";
       })
+      (fetchpatch { # This can be removed when https://codereview.qt-project.org/c/qt/qtbase/+/363880/3 is included in an release.
+        name = "qtbase-mysql-version-vs-functionality-check.patch";
+        url = "https://codereview.qt-project.org/gitweb?p=qt/qtbase.git;a=patch;h=211369133cf40b2f522caaff259c19069ed23ca4";
+        sha256 = "19kq9h10qm344fpdqa9basrbzh1y5kr48c6jzz3nvk61pk4ja1k4";
+      })
     ];
     qtdeclarative = [ ./qtdeclarative.patch ];
     qtscript = [ ./qtscript.patch ];

pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh

@@ -76,7 +76,7 @@ wrapQtAppsHook() {
     [ -z "$wrapQtAppsHookHasRun" ] || return 0
     wrapQtAppsHookHasRun=1
 
-    local targetDirs=( "$prefix/bin" "$prefix/sbin" "$prefix/libexec"  )
+    local targetDirs=( "$prefix/bin" "$prefix/sbin" "$prefix/libexec" "$prefix/Applications" "$prefix/"*.app )
     echo "wrapping Qt applications in ${targetDirs[@]}"
 
     for targetDir in "${targetDirs[@]}"
@@ -85,7 +85,7 @@ wrapQtAppsHook() {
 
         find "$targetDir" ! -type d -executable -print0 | while IFS= read -r -d '' file
         do
-            patchelf --print-interpreter "$file" >/dev/null 2>&1 || continue
+            isELF "$file" || isMachO "$file" || continue
 
             if [ -f "$file" ]
             then

pkgs/development/libraries/science/math/suitesparse/default.nix

@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "suitesparse";
-  version = "5.9.0";
+  version = "5.10.1";
 
   outputs = [ "out" "dev" "doc" ];
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     owner = "DrTimothyAldenDavis";
     repo = "SuiteSparse";
     rev = "v${version}";
-    sha256 = "sha256-tvwpSVgZrfYZHXHN8OQF0Y/aJM03JHGPFok7hUqPE/4=";
+    sha256 = "sha256-ifuoXgVQp2vHR/reC/Hjbt3vqaKpql3Nfxdb/Cgv/aU=";
   };
 
   nativeBuildInputs = [
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     "CUBLAS_LIB=${cudatoolkit}/lib/libcublas.so"
   ] ++ lib.optionals stdenv.isDarwin [
     # Unless these are set, the build will attempt to use `Accelerate` on darwin, see:
-    # https://github.com/DrTimothyAldenDavis/SuiteSparse/blob/v5.9.0/SuiteSparse_config/SuiteSparse_config.mk#L368
+    # https://github.com/DrTimothyAldenDavis/SuiteSparse/blob/v5.10.1/SuiteSparse_config/SuiteSparse_config.mk#L368
     "BLAS=-lblas"
     "LAPACK=-llapack"
   ]