From 66d41e75e89aa7cf3484c97b5c006c36da5fc56f Mon Sep 17 00:00:00 2001
From: Audrey Dutcher <audrey@rhelmot.io>
Date: Sat, 20 Jul 2024 23:56:40 -0700
Subject: [PATCH 001/115] python{39,310,311,312,313}: Allow using cc to resolve
 dynamic libraries

This patch hasn't been complete since an alternate case was added to
cpython which allows using ld(1) to resolve libraries. In addition to
this, the stated reason for the patch, to improve startup times by
preventing cpython from invoking gcc to resolve libuuid, has not been an
issue since that logic was removed in cpython 3.9. Finally, this patch
creates a disparity between Linux and other operating systems (I am
working on FreeBSD right now) since the ld(1) case is system gated.

Since it no longer accomplishes its stated purpose, is no longer needed,
and creates platform disparities, we should remove it.

I've left the half of this patch which prevents /sbin/ldconfig from
being invoked, since no nix-compiled program should ever be invoking
absolute paths like this.
---
 .../python/cpython/3.10/no-ldconfig.patch     | 55 -------------------
 .../python/cpython/3.11/no-ldconfig.patch     | 55 -------------------
 .../python/cpython/3.12/no-ldconfig.patch     | 55 -------------------
 .../python/cpython/3.13/no-ldconfig.patch     | 55 -------------------
 .../python/cpython/3.9/no-ldconfig.patch      | 55 -------------------
 5 files changed, 275 deletions(-)

diff --git a/pkgs/development/interpreters/python/cpython/3.10/no-ldconfig.patch b/pkgs/development/interpreters/python/cpython/3.10/no-ldconfig.patch
index c259aed72b99..e65883ab895a 100644
--- a/pkgs/development/interpreters/python/cpython/3.10/no-ldconfig.patch
+++ b/pkgs/development/interpreters/python/cpython/3.10/no-ldconfig.patch
@@ -11,61 +11,6 @@ diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
 index 0c2510e..7fb98af 100644
 --- a/Lib/ctypes/util.py
 +++ b/Lib/ctypes/util.py
-@@ -100,53 +100,7 @@ elif os.name == "posix":
-             return thefile.read(4) == elf_header
- 
-     def _findLib_gcc(name):
--        # Run GCC's linker with the -t (aka --trace) option and examine the
--        # library name it prints out. The GCC command will fail because we
--        # haven't supplied a proper program with main(), but that does not
--        # matter.
--        expr = os.fsencode(r'[^\(\)\s]*lib%s\.[^\(\)\s]*' % re.escape(name))
--
--        c_compiler = shutil.which('gcc')
--        if not c_compiler:
--            c_compiler = shutil.which('cc')
--        if not c_compiler:
--            # No C compiler available, give up
--            return None
--
--        temp = tempfile.NamedTemporaryFile()
--        try:
--            args = [c_compiler, '-Wl,-t', '-o', temp.name, '-l' + name]
--
--            env = dict(os.environ)
--            env['LC_ALL'] = 'C'
--            env['LANG'] = 'C'
--            try:
--                proc = subprocess.Popen(args,
--                                        stdout=subprocess.PIPE,
--                                        stderr=subprocess.STDOUT,
--                                        env=env)
--            except OSError:  # E.g. bad executable
--                return None
--            with proc:
--                trace = proc.stdout.read()
--        finally:
--            try:
--                temp.close()
--            except FileNotFoundError:
--                # Raised if the file was already removed, which is the normal
--                # behaviour of GCC if linking fails
--                pass
--        res = re.findall(expr, trace)
--        if not res:
--            return None
--
--        for file in res:
--            # Check if the given file is an elf file: gcc can report
--            # some files that are linker scripts and not actual
--            # shared objects. See bpo-41976 for more details
--            if not _is_elf(file):
--                continue
--            return os.fsdecode(file)
-+        return None
- 
- 
-     if sys.platform == "sunos5":
 @@ -268,34 +222,7 @@ elif os.name == "posix":
      else:
  
diff --git a/pkgs/development/interpreters/python/cpython/3.11/no-ldconfig.patch b/pkgs/development/interpreters/python/cpython/3.11/no-ldconfig.patch
index ca6a76d0ffd9..bafcaee7c980 100644
--- a/pkgs/development/interpreters/python/cpython/3.11/no-ldconfig.patch
+++ b/pkgs/development/interpreters/python/cpython/3.11/no-ldconfig.patch
@@ -11,61 +11,6 @@ diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
 index 0c2510e161..7fb98af308 100644
 --- a/Lib/ctypes/util.py
 +++ b/Lib/ctypes/util.py
-@@ -100,53 +100,7 @@ def _is_elf(filename):
-             return thefile.read(4) == elf_header
- 
-     def _findLib_gcc(name):
--        # Run GCC's linker with the -t (aka --trace) option and examine the
--        # library name it prints out. The GCC command will fail because we
--        # haven't supplied a proper program with main(), but that does not
--        # matter.
--        expr = os.fsencode(r'[^\(\)\s]*lib%s\.[^\(\)\s]*' % re.escape(name))
--
--        c_compiler = shutil.which('gcc')
--        if not c_compiler:
--            c_compiler = shutil.which('cc')
--        if not c_compiler:
--            # No C compiler available, give up
--            return None
--
--        temp = tempfile.NamedTemporaryFile()
--        try:
--            args = [c_compiler, '-Wl,-t', '-o', temp.name, '-l' + name]
--
--            env = dict(os.environ)
--            env['LC_ALL'] = 'C'
--            env['LANG'] = 'C'
--            try:
--                proc = subprocess.Popen(args,
--                                        stdout=subprocess.PIPE,
--                                        stderr=subprocess.STDOUT,
--                                        env=env)
--            except OSError:  # E.g. bad executable
--                return None
--            with proc:
--                trace = proc.stdout.read()
--        finally:
--            try:
--                temp.close()
--            except FileNotFoundError:
--                # Raised if the file was already removed, which is the normal
--                # behaviour of GCC if linking fails
--                pass
--        res = re.findall(expr, trace)
--        if not res:
--            return None
--
--        for file in res:
--            # Check if the given file is an elf file: gcc can report
--            # some files that are linker scripts and not actual
--            # shared objects. See bpo-41976 for more details
--            if not _is_elf(file):
--                continue
--            return os.fsdecode(file)
-+        return None
- 
- 
-     if sys.platform == "sunos5":
 @@ -268,34 +222,7 @@ def find_library(name, is64 = False):
      else:
  
diff --git a/pkgs/development/interpreters/python/cpython/3.12/no-ldconfig.patch b/pkgs/development/interpreters/python/cpython/3.12/no-ldconfig.patch
index ca6a76d0ffd9..bafcaee7c980 100644
--- a/pkgs/development/interpreters/python/cpython/3.12/no-ldconfig.patch
+++ b/pkgs/development/interpreters/python/cpython/3.12/no-ldconfig.patch
@@ -11,61 +11,6 @@ diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
 index 0c2510e161..7fb98af308 100644
 --- a/Lib/ctypes/util.py
 +++ b/Lib/ctypes/util.py
-@@ -100,53 +100,7 @@ def _is_elf(filename):
-             return thefile.read(4) == elf_header
- 
-     def _findLib_gcc(name):
--        # Run GCC's linker with the -t (aka --trace) option and examine the
--        # library name it prints out. The GCC command will fail because we
--        # haven't supplied a proper program with main(), but that does not
--        # matter.
--        expr = os.fsencode(r'[^\(\)\s]*lib%s\.[^\(\)\s]*' % re.escape(name))
--
--        c_compiler = shutil.which('gcc')
--        if not c_compiler:
--            c_compiler = shutil.which('cc')
--        if not c_compiler:
--            # No C compiler available, give up
--            return None
--
--        temp = tempfile.NamedTemporaryFile()
--        try:
--            args = [c_compiler, '-Wl,-t', '-o', temp.name, '-l' + name]
--
--            env = dict(os.environ)
--            env['LC_ALL'] = 'C'
--            env['LANG'] = 'C'
--            try:
--                proc = subprocess.Popen(args,
--                                        stdout=subprocess.PIPE,
--                                        stderr=subprocess.STDOUT,
--                                        env=env)
--            except OSError:  # E.g. bad executable
--                return None
--            with proc:
--                trace = proc.stdout.read()
--        finally:
--            try:
--                temp.close()
--            except FileNotFoundError:
--                # Raised if the file was already removed, which is the normal
--                # behaviour of GCC if linking fails
--                pass
--        res = re.findall(expr, trace)
--        if not res:
--            return None
--
--        for file in res:
--            # Check if the given file is an elf file: gcc can report
--            # some files that are linker scripts and not actual
--            # shared objects. See bpo-41976 for more details
--            if not _is_elf(file):
--                continue
--            return os.fsdecode(file)
-+        return None
- 
- 
-     if sys.platform == "sunos5":
 @@ -268,34 +222,7 @@ def find_library(name, is64 = False):
      else:
  
diff --git a/pkgs/development/interpreters/python/cpython/3.13/no-ldconfig.patch b/pkgs/development/interpreters/python/cpython/3.13/no-ldconfig.patch
index ca6a76d0ffd9..bafcaee7c980 100644
--- a/pkgs/development/interpreters/python/cpython/3.13/no-ldconfig.patch
+++ b/pkgs/development/interpreters/python/cpython/3.13/no-ldconfig.patch
@@ -11,61 +11,6 @@ diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
 index 0c2510e161..7fb98af308 100644
 --- a/Lib/ctypes/util.py
 +++ b/Lib/ctypes/util.py
-@@ -100,53 +100,7 @@ def _is_elf(filename):
-             return thefile.read(4) == elf_header
- 
-     def _findLib_gcc(name):
--        # Run GCC's linker with the -t (aka --trace) option and examine the
--        # library name it prints out. The GCC command will fail because we
--        # haven't supplied a proper program with main(), but that does not
--        # matter.
--        expr = os.fsencode(r'[^\(\)\s]*lib%s\.[^\(\)\s]*' % re.escape(name))
--
--        c_compiler = shutil.which('gcc')
--        if not c_compiler:
--            c_compiler = shutil.which('cc')
--        if not c_compiler:
--            # No C compiler available, give up
--            return None
--
--        temp = tempfile.NamedTemporaryFile()
--        try:
--            args = [c_compiler, '-Wl,-t', '-o', temp.name, '-l' + name]
--
--            env = dict(os.environ)
--            env['LC_ALL'] = 'C'
--            env['LANG'] = 'C'
--            try:
--                proc = subprocess.Popen(args,
--                                        stdout=subprocess.PIPE,
--                                        stderr=subprocess.STDOUT,
--                                        env=env)
--            except OSError:  # E.g. bad executable
--                return None
--            with proc:
--                trace = proc.stdout.read()
--        finally:
--            try:
--                temp.close()
--            except FileNotFoundError:
--                # Raised if the file was already removed, which is the normal
--                # behaviour of GCC if linking fails
--                pass
--        res = re.findall(expr, trace)
--        if not res:
--            return None
--
--        for file in res:
--            # Check if the given file is an elf file: gcc can report
--            # some files that are linker scripts and not actual
--            # shared objects. See bpo-41976 for more details
--            if not _is_elf(file):
--                continue
--            return os.fsdecode(file)
-+        return None
- 
- 
-     if sys.platform == "sunos5":
 @@ -268,34 +222,7 @@ def find_library(name, is64 = False):
      else:
  
diff --git a/pkgs/development/interpreters/python/cpython/3.9/no-ldconfig.patch b/pkgs/development/interpreters/python/cpython/3.9/no-ldconfig.patch
index 41d3ab52345b..1a5eccb9eca8 100644
--- a/pkgs/development/interpreters/python/cpython/3.9/no-ldconfig.patch
+++ b/pkgs/development/interpreters/python/cpython/3.9/no-ldconfig.patch
@@ -11,61 +11,6 @@ diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
 index 0c2510e161..7fb98af308 100644
 --- a/Lib/ctypes/util.py
 +++ b/Lib/ctypes/util.py
-@@ -100,53 +100,7 @@ elif os.name == "posix":
-             return thefile.read(4) == elf_header
-
-     def _findLib_gcc(name):
--        # Run GCC's linker with the -t (aka --trace) option and examine the
--        # library name it prints out. The GCC command will fail because we
--        # haven't supplied a proper program with main(), but that does not
--        # matter.
--        expr = os.fsencode(r'[^\(\)\s]*lib%s\.[^\(\)\s]*' % re.escape(name))
--
--        c_compiler = shutil.which('gcc')
--        if not c_compiler:
--            c_compiler = shutil.which('cc')
--        if not c_compiler:
--            # No C compiler available, give up
--            return None
--
--        temp = tempfile.NamedTemporaryFile()
--        try:
--            args = [c_compiler, '-Wl,-t', '-o', temp.name, '-l' + name]
--
--            env = dict(os.environ)
--            env['LC_ALL'] = 'C'
--            env['LANG'] = 'C'
--            try:
--                proc = subprocess.Popen(args,
--                                        stdout=subprocess.PIPE,
--                                        stderr=subprocess.STDOUT,
--                                        env=env)
--            except OSError:  # E.g. bad executable
--                return None
--            with proc:
--                trace = proc.stdout.read()
--        finally:
--            try:
--                temp.close()
--            except FileNotFoundError:
--                # Raised if the file was already removed, which is the normal
--                # behaviour of GCC if linking fails
--                pass
--        res = re.findall(expr, trace)
--        if not res:
--            return None
--
--        for file in res:
--            # Check if the given file is an elf file: gcc can report
--            # some files that are linker scripts and not actual
--            # shared objects. See bpo-41976 for more details
--            if not _is_elf(file):
--                continue
--            return os.fsdecode(file)
-+        return None
-
-
-     if sys.platform == "sunos5":
 @@ -268,34 +222,7 @@ elif os.name == "posix":
      else:
 

From 64c6d5f183c59122c2ef53ccc81f24f9cc657163 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=A9clairevoyant?=
 <848000+eclairevoyant@users.noreply.github.com>
Date: Wed, 24 Jul 2024 09:20:05 -0400
Subject: [PATCH 002/115] usbutils: build and install usbreset

---
 pkgs/os-specific/linux/usbutils/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/os-specific/linux/usbutils/default.nix b/pkgs/os-specific/linux/usbutils/default.nix
index 4e64f394d82f..c0b713ca9047 100644
--- a/pkgs/os-specific/linux/usbutils/default.nix
+++ b/pkgs/os-specific/linux/usbutils/default.nix
@@ -20,8 +20,14 @@ stdenv.mkDerivation rec {
   buildInputs = [ libusb1 python3 ];
 
   outputs = [ "out" "man" "python" ];
+
+  postBuild = ''
+    $CC $NIX_CFLAGS -o usbreset usbreset.c
+  '';
+
   postInstall = ''
     moveToOutput "bin/lsusb.py" "$python"
+    install -Dm555 usbreset -t $out/bin
   '';
 
   meta = with lib; {

From 3150b3bd7551d8604cbff05bab981cf11f3c025b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=A9clairevoyant?=
 <848000+eclairevoyant@users.noreply.github.com>
Date: Wed, 24 Jul 2024 09:20:27 -0400
Subject: [PATCH 003/115] usbutils: fix meta

---
 pkgs/os-specific/linux/usbutils/default.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/usbutils/default.nix b/pkgs/os-specific/linux/usbutils/default.nix
index c0b713ca9047..f55c4e983367 100644
--- a/pkgs/os-specific/linux/usbutils/default.nix
+++ b/pkgs/os-specific/linux/usbutils/default.nix
@@ -30,12 +30,15 @@ stdenv.mkDerivation rec {
     install -Dm555 usbreset -t $out/bin
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "http://www.linux-usb.org/";
     description = "Tools for working with USB devices, such as lsusb";
-    maintainers = with maintainers; [ cafkafk ];
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
+    maintainers = with lib.maintainers; [ cafkafk ];
+    license = with lib.licenses; [
+      gpl2Only # manpages, usbreset
+      gpl2Plus # most of the code
+     ];
+    platforms = lib.platforms.linux;
     mainProgram = "lsusb";
   };
 }

From 0af83e770a3985067f105dc1294443e08fe0be53 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 28 Jul 2024 19:54:22 +0100
Subject: [PATCH 004/115] meson: 1.5.0 -> 1.5.1

---
 pkgs/by-name/me/meson/package.nix | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/me/meson/package.nix b/pkgs/by-name/me/meson/package.nix
index 79ffae36a98f..5e7f9368d66b 100644
--- a/pkgs/by-name/me/meson/package.nix
+++ b/pkgs/by-name/me/meson/package.nix
@@ -21,13 +21,13 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "mesonbuild";
     repo = "meson";
     rev = "refs/tags/${version}";
-    hash = "sha256-Y//8fXBNdx+ikpvg+S5Bk2rN3UVS5qo2bnbTSVBb8b8=";
+    hash = "sha256-BqsEO1a93a8d7/UH232buSPBt+WSNJbw1DGYA2nm9rs=";
   };
 
   patches = [
@@ -81,12 +81,6 @@ python3.pkgs.buildPythonApplication rec {
       hash = "sha256-XkwNQ5eg/fVekhsFg/V2/S2LbIVGz3H0wsSFlUT3ZZE=";
     })
 
-    (fetchpatch {
-      name = "cross.patch";
-      url = "https://github.com/mesonbuild/meson/pull/13411.patch";
-      hash = "sha256-IHSV0Dfse0lzDtxh/+APc/dzGr/BUbR/WIOqDsm7/8Y=";
-    })
-
     # Fix extraframework lookup on case-sensitive APFS.
     # https://github.com/mesonbuild/meson/pull/13038
     ./007-case-sensitive-fs.patch

From 24655f78040b420c6af6103c714f2c052a533592 Mon Sep 17 00:00:00 2001
From: Minijackson <minijackson@riseup.net>
Date: Fri, 26 Jul 2024 16:20:14 +0200
Subject: [PATCH 005/115] patch-shebangs: don't patch shebangs with bash
 builtins

'command -v builtin' returns 'builtin', which doesn't suit us since
we're looking for program in the given PATH. This could give us shebangs
like this:

    #!builtin

which is surprising.

Switch to 'type -P command' which always returns a path, even if command
is both a builtin and an executable (for example 'test'), or fail is
'command' is just a builtin.
---
 pkgs/build-support/setup-hooks/patch-shebangs.sh |  8 ++++----
 pkgs/test/stdenv/patch-shebangs.nix              | 14 ++++++++++++++
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/patch-shebangs.sh b/pkgs/build-support/setup-hooks/patch-shebangs.sh
index 80a29d727c85..0553eb04b111 100644
--- a/pkgs/build-support/setup-hooks/patch-shebangs.sh
+++ b/pkgs/build-support/setup-hooks/patch-shebangs.sh
@@ -90,8 +90,8 @@ patchShebangs() {
             if [[ $arg0 == "-S" ]]; then
                 arg0=${args%% *}
                 args=${args#* }
-                newPath="$(PATH="${!pathName}" command -v "env" || true)"
-                args="-S $(PATH="${!pathName}" command -v "$arg0" || true) $args"
+                newPath="$(PATH="${!pathName}" type -P "env" || true)"
+                args="-S $(PATH="${!pathName}" type -P "$arg0" || true) $args"
 
             # Check for unsupported 'env' functionality:
             # - options: something starting with a '-' besides '-S'
@@ -100,7 +100,7 @@ patchShebangs() {
                 echo "$f: unsupported interpreter directive \"$oldInterpreterLine\" (set dontPatchShebangs=1 and handle shebang patching yourself)" >&2
                 exit 1
             else
-                newPath="$(PATH="${!pathName}" command -v "$arg0" || true)"
+                newPath="$(PATH="${!pathName}" type -P "$arg0" || true)"
             fi
         else
             if [[ -z $oldPath ]]; then
@@ -109,7 +109,7 @@ patchShebangs() {
                 oldPath="/bin/sh"
             fi
 
-            newPath="$(PATH="${!pathName}" command -v "$(basename "$oldPath")" || true)"
+            newPath="$(PATH="${!pathName}" type -P "$(basename "$oldPath")" || true)"
 
             args="$arg0 $args"
         fi
diff --git a/pkgs/test/stdenv/patch-shebangs.nix b/pkgs/test/stdenv/patch-shebangs.nix
index db9ca2fcaafe..51edf128f7d5 100644
--- a/pkgs/test/stdenv/patch-shebangs.nix
+++ b/pkgs/test/stdenv/patch-shebangs.nix
@@ -87,6 +87,20 @@ let
       };
     };
 
+    dont-patch-builtins = stdenv.mkDerivation {
+      name = "dont-patch-builtins";
+      strictDeps = false;
+      dontUnpack = true;
+      installPhase = ''
+        mkdir -p $out/bin
+        echo "#!/usr/bin/builtin" > $out/bin/test
+        chmod +x $out/bin/test
+        dontPatchShebangs=
+      '';
+      passthru = {
+        assertion = "grep '^#!/usr/bin/builtin' $out/bin/test > /dev/null";
+      };
+    };
   };
 in
 stdenv.mkDerivation {

From 4c6e132c7ed1928d347e48dc1f2ea6013f48cd6d Mon Sep 17 00:00:00 2001
From: Ivan Trubach <mr.trubach@icloud.com>
Date: Sat, 4 May 2024 08:23:44 +0300
Subject: [PATCH 006/115] =?UTF-8?q?lib/systems:=20use=20execline=E2=80=99s?=
 =?UTF-8?q?=20exec=20instead=20of=20runtimeShell?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 lib/systems/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 0b8aeda208e3..6c5cdb853348 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -282,8 +282,11 @@ let
             };
             wine = (pkgs.winePackagesFor "wine${toString final.parsed.cpu.bits}").minimal;
           in
+          # Note: we guarantee that the return value is either `null` or a path
+          # to an emulator program. That is, if an emulator requires additional
+          # arguments, a wrapper should be used.
           if pkgs.stdenv.hostPlatform.canExecute final
-          then "${pkgs.runtimeShell} -c '\"$@\"' --"
+          then "${pkgs.execline}/bin/exec"
           else if final.isWindows
           then "${wine}/bin/wine${optionalString (final.parsed.cpu.bits == 64) "64"}"
           else if final.isLinux && pkgs.stdenv.hostPlatform.isLinux && final.qemuArch != null

From 93ff87e4ffa2178066dc11699b5d9f450ea0ec9b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <mail@dotlambda.de>
Date: Mon, 5 Aug 2024 01:48:05 -0700
Subject: [PATCH 007/115] python312Packages.flake8: 7.1.0 -> 7.1.1

Diff: https://github.com/PyCQA/flake8/compare/7.1.0...7.1.1

Changelog: https://github.com/PyCQA/flake8/blob/7.1.1/docs/source/release-notes/7.1.1.rst
---
 pkgs/development/python-modules/flake8/default.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/flake8/default.nix b/pkgs/development/python-modules/flake8/default.nix
index 8fa7a8fa99a9..624f36a7447a 100644
--- a/pkgs/development/python-modules/flake8/default.nix
+++ b/pkgs/development/python-modules/flake8/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "flake8";
-  version = "7.1.0";
+  version = "7.1.1";
 
   disabled = pythonOlder "3.8";
 
@@ -22,12 +22,12 @@ buildPythonPackage rec {
     owner = "PyCQA";
     repo = "flake8";
     rev = version;
-    hash = "sha256-jkRr/k/XjiKOkcd4jlOQTnnFun7/hMHdVUWBlS1QZ1E=";
+    hash = "sha256-6iCZEapftHqd9okJS1wMzIjjmWahrmmZtXd7SUMVcmE=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     mccabe
     pycodestyle
     pyflakes
@@ -36,6 +36,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [ pytestCheckHook ];
 
   meta = with lib; {
+    changelog = "https://github.com/PyCQA/flake8/blob/${src.rev}/docs/source/release-notes/${version}.rst";
     description = "Modular source code checker: pep8, pyflakes and co";
     homepage = "https://github.com/PyCQA/flake8";
     license = licenses.mit;

From 388bcf6e3e56c4a376dfeecdec482fae2809930e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <mail@dotlambda.de>
Date: Wed, 7 Aug 2024 13:05:06 -0700
Subject: [PATCH 008/115] python312Packages.pyyaml: 6.0.1 -> 6.0.2

Diff: https://github.com/yaml/pyyaml/compare/6.0.1...6.0.2

Changelog: https://github.com/yaml/pyyaml/blob/6.0.2/CHANGES
---
 .../python-modules/pyyaml/default.nix         | 28 ++++++++-----------
 1 file changed, 12 insertions(+), 16 deletions(-)

diff --git a/pkgs/development/python-modules/pyyaml/default.nix b/pkgs/development/python-modules/pyyaml/default.nix
index 7e81354ceae0..f9aafffd0905 100644
--- a/pkgs/development/python-modules/pyyaml/default.nix
+++ b/pkgs/development/python-modules/pyyaml/default.nix
@@ -3,43 +3,39 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
-  cython_0,
+  cython,
   setuptools,
   libyaml,
-  python,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "pyyaml";
-  version = "6.0.1";
+  version = "6.0.2";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
-
-  format = "pyproject";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "yaml";
     repo = "pyyaml";
-    rev = version;
-    hash = "sha256-YjWMyMVDByLsN5vEecaYjHpR1sbBey1L/khn4oH9SPA=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-IQoZd9Lp0ZHLAQN3PFwMsZVTsIVJyIaT9D6fpkzA8IA=";
   };
 
-  nativeBuildInputs = [
-    cython_0
+  build-system = [
+    cython
     setuptools
   ];
 
   buildInputs = [ libyaml ];
 
-  checkPhase = ''
-    runHook preCheck
-    PYTHONPATH="tests/lib:$PYTHONPATH" ${python.interpreter} -m test_all
-    runHook postCheck
-  '';
-
   pythonImportsCheck = [ "yaml" ];
 
+  nativeCheckInputs = [ pytestCheckHook ];
+
   meta = with lib; {
+    changelog = "https://github.com/yaml/pyyaml/blob/${src.rev}/CHANGES";
     description = "Next generation YAML parser and emitter for Python";
     homepage = "https://github.com/yaml/pyyaml";
     license = licenses.mit;

From 117e468da4642bf43cffe0336bb9f8a22921645b Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Thu, 15 Aug 2024 10:08:05 +0200
Subject: [PATCH 009/115] graphene: tighten withDocumentation default

The underlying reason documentation can't be built for pkgsStatic is
that gobject-introspection is unavailable, so branching based on that
fixes the same problem for all situations where that's true, not just
pkgsStatic.
---
 pkgs/development/libraries/graphene/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/graphene/default.nix b/pkgs/development/libraries/graphene/default.nix
index 7b64aa2bc586..11b0f43fec24 100644
--- a/pkgs/development/libraries/graphene/default.nix
+++ b/pkgs/development/libraries/graphene/default.nix
@@ -11,7 +11,7 @@
 , mutest
 , nixosTests
 , glib
-, withDocumentation ? !stdenv.hostPlatform.isStatic
+, withDocumentation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform || stdenv.hostPlatform.emulatorAvailable buildPackages
 , gtk-doc
 , docbook_xsl
 , docbook_xml_dtd_43
@@ -65,10 +65,10 @@ stdenv.mkDerivation (finalAttrs: {
     docbook_xml_dtd_43
     docbook_xsl
     gtk-doc
+  ] ++ lib.optionals (withDocumentation && !stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    mesonEmulatorHook
   ] ++ lib.optionals withIntrospection [
     gobject-introspection
-  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
-    mesonEmulatorHook
   ];
 
   buildInputs = [

From 4249fa33f622eaf9ffebc3d7a01cb74d6bbf6704 Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Tue, 2 Jan 2024 11:28:30 +0300
Subject: [PATCH 010/115] gnutls: enable ktls support

---
 pkgs/development/libraries/gnutls/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 33b35446d725..f1ecc1e9939f 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -92,6 +92,7 @@ stdenv.mkDerivation rec {
   #  - fastopen: no idea; it broke between 3.6.2 and 3.6.3 (3437fdde6 in particular)
   #  - trust-store: default trust store path (/etc/ssl/...) is missing in sandbox (3.5.11)
   #  - psk-file: no idea; it broke between 3.6.3 and 3.6.4
+  #  - ktls: requires tls module loaded into kernel
   # Change p11-kit test to use pkg-config to find p11-kit
   postPatch = ''
     sed '2iexit 77' -i tests/{pkgconfig,fastopen}.sh
@@ -99,6 +100,8 @@ stdenv.mkDerivation rec {
     sed 's:/usr/lib64/pkcs11/ /usr/lib/pkcs11/ /usr/lib/x86_64-linux-gnu/pkcs11/:`pkg-config --variable=p11_module_path p11-kit-1`:' -i tests/p11-kit-trust.sh
   '' + lib.optionalString stdenv.hostPlatform.isMusl '' # See https://gitlab.com/gnutls/gnutls/-/issues/945
     sed '2iecho "certtool tests skipped in musl build"\nexit 0' -i tests/cert-tests/certtool.sh
+  '' + lib.optionalString stdenv.isLinux ''
+    sed '2iexit 77' -i tests/{ktls,ktls_keyupdate}.sh
   '';
 
   preConfigure = "patchShebangs .";
@@ -112,6 +115,8 @@ stdenv.mkDerivation rec {
       "--with-unbound-root-key-file=${dns-root-data}/root.key"
       (lib.withFeature withP11-kit "p11-kit")
       (lib.enableFeature cxxBindings "cxx")
+    ] ++ lib.optionals stdenv.isLinux [
+      "--enable-ktls"
     ] ++ lib.optionals (stdenv.hostPlatform.isMinGW) [
       "--disable-doc"
     ];

From 5be4ecc1c44eb566cd6a2dd537325cd891e9d2a9 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Fri, 16 Aug 2024 04:39:35 +0800
Subject: [PATCH 011/115] emacs: make melpaBuild accept recipe content as a
 string

This is the first part of https://github.com/NixOS/nixpkgs/issues/334888.
---
 .../editors/emacs/build-support/melpa.nix     | 23 ++++++++++++++-----
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/editors/emacs/build-support/melpa.nix b/pkgs/applications/editors/emacs/build-support/melpa.nix
index aeaf1d3882ab..bda412a0957f 100644
--- a/pkgs/applications/editors/emacs/build-support/melpa.nix
+++ b/pkgs/applications/editors/emacs/build-support/melpa.nix
@@ -63,11 +63,10 @@ libBuildHelper.extendMkDerivation' genericBuild (finalAttrs:
   /*
     recipe: Optional MELPA recipe.
     Default: a minimally functional recipe
+    This can be a path of a recipe file, a string of the recipe content or an empty string.
+    The default value is used if it is an empty string.
   */
-, recipe ? (writeText "${finalAttrs.pname}-recipe" ''
-    (${finalAttrs.ename} :fetcher git :url ""
-              ${lib.optionalString (finalAttrs.files != null) ":files ${finalAttrs.files}"})
-  '')
+, recipe ? ""
 , preUnpack ? ""
 , postUnpack ? ""
 , meta ? {}
@@ -98,9 +97,21 @@ libBuildHelper.extendMkDerivation' genericBuild (finalAttrs:
 
   preUnpack = ''
     mkdir -p "$NIX_BUILD_TOP/recipes"
-    if [ -n "$recipe" ]; then
-      cp "$recipe" "$NIX_BUILD_TOP/recipes/$ename"
+    recipeFile="$NIX_BUILD_TOP/recipes/$ename"
+    if [ -r "$recipe" ]; then
+      ln -s "$recipe" "$recipeFile"
+      nixInfoLog "link recipe"
+    elif [ -n "$recipe" ]; then
+      printf "%s" "$recipe" > "$recipeFile"
+      nixInfoLog "write recipe"
+    else
+      cat > "$recipeFile" <<'EOF'
+(${finalAttrs.ename} :fetcher git :url "" ${lib.optionalString (finalAttrs.files != null) ":files ${finalAttrs.files}"})
+EOF
+      nixInfoLog "use default recipe"
     fi
+    nixInfoLog "recipe content:" "$(< $recipeFile)"
+    unset -v recipeFile
 
     ln -s "$packageBuild" "$NIX_BUILD_TOP/package-build"
 

From 023967169b3524a16a9e967b9dbe7880bd335570 Mon Sep 17 00:00:00 2001
From: Elliot Cameron <nixpkgs-commits@deshaw.com>
Date: Wed, 10 Jul 2024 16:58:09 -0400
Subject: [PATCH 012/115] python3Packages.k5test: fix krb5-config paths

---
 pkgs/development/python-modules/k5test/fix-paths.patch | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/k5test/fix-paths.patch b/pkgs/development/python-modules/k5test/fix-paths.patch
index 04103df36d53..feb24226dc2f 100644
--- a/pkgs/development/python-modules/k5test/fix-paths.patch
+++ b/pkgs/development/python-modules/k5test/fix-paths.patch
@@ -49,7 +49,7 @@
  
          if provider_cls == K5Realm:
 -            krb5_config = _discover_path("krb5-config", "/usr/bin/krb5-config", kwargs)
-+            krb5_config = _discover_path("krb5-config", "@krb5@/bin/krb5-config", kwargs)
++            krb5_config = _discover_path("krb5-config", "@krb5Dev@/bin/krb5-config", kwargs)
  
              try:
                  krb5_version = subprocess.check_output(
@@ -58,7 +58,7 @@
                  # macOS output doesn't contain Heimdal
                  if "heimdal" in krb5_version.lower() or (
 -                    sys.platform == "darwin" and krb5_config == "/usr/bin/krb5-config"
-+                    sys.platform == "darwin" and krb5_config == "@krb5@/bin/krb5-config"
++                    sys.platform == "darwin" and krb5_config == "@krb5Dev@/bin/krb5-config"
                  ):
                      provider_cls = HeimdalRealm
                  else:

From cf2eaa548152f7d5a0fffdc2aecec821c67a4a0b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <mail@dotlambda.de>
Date: Sun, 18 Aug 2024 14:28:57 -0700
Subject: [PATCH 013/115] python312Packages.pyjwt: 2.8.0 -> 2.9.0

Diff: https://github.com/jpadilla/pyjwt/compare/refs/tags/2.8.0...2.9.0

Changelog: https://github.com/jpadilla/pyjwt/blob/2.9.0/CHANGELOG.rst
---
 .../python-modules/pyjwt/default.nix          | 30 ++++++++-----------
 1 file changed, 13 insertions(+), 17 deletions(-)

diff --git a/pkgs/development/python-modules/pyjwt/default.nix b/pkgs/development/python-modules/pyjwt/default.nix
index 62c9c8c859db..2dee3c550a12 100644
--- a/pkgs/development/python-modules/pyjwt/default.nix
+++ b/pkgs/development/python-modules/pyjwt/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   setuptools,
   cryptography,
   pytestCheckHook,
@@ -13,38 +13,34 @@
 
 buildPythonPackage rec {
   pname = "pyjwt";
-  version = "2.8.0";
-  format = "pyproject";
+  version = "2.9.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    pname = "PyJWT";
-    inherit version;
-    hash = "sha256-V+KNFW49XBAIjgxoq7kL+sPfgrQKcb0NqiDGXM1cI94=";
+  src = fetchFromGitHub {
+    owner = "jpadilla";
+    repo = "pyjwt";
+    rev = "refs/tags/${version}";
+    hash = "sha256-z1sqaSeign0ZDFcg94cli0fIVBxcK14VUlgP+mSaxRA=";
   };
 
-  postPatch = ''
-    sed -i '/types-cryptography/d' setup.cfg
-  '';
-
   outputs = [
     "out"
     "doc"
   ];
 
+  build-system = [ setuptools ];
+
   nativeBuildInputs = [
-    setuptools
     sphinxHook
     sphinx-rtd-theme
     zope-interface
   ];
 
-  passthru.optional-dependencies.crypto = [ cryptography ];
+  optional-dependencies.crypto = [ cryptography ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ] ++ (lib.flatten (lib.attrValues passthru.optional-dependencies));
+  nativeCheckInputs = [ pytestCheckHook ] ++ (lib.flatten (lib.attrValues optional-dependencies));
 
   disabledTests = [
     # requires internet connection

From 84762ac4d0bd7a0da97aa8945020c39268d6155c Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 19 Aug 2024 21:40:33 +0100
Subject: [PATCH 014/115] libinput: 1.26.1 -> 1.26.2

Changes: https://lists.freedesktop.org/archives/wayland-devel/2024-August/043706.html
---
 pkgs/development/libraries/libinput/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 1628cb679d22..0021f08aa5e2 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -45,7 +45,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.26.1";
+  version = "1.26.2";
 
   outputs = [ "bin" "out" "dev" ];
 
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     owner = "libinput";
     repo = "libinput";
     rev = version;
-    hash = "sha256-3iWKqg9HSicocDAyp1Lk87nBbj+Slg1/e1VKEOIQkyQ=";
+    hash = "sha256-Ly832W2U38JuXiqvt6e7u3APynrmwi4Ns98bBdTBnP8=";
   };
 
   patches = [

From 4c2e720a58bc4c6903147a34d9fd9699276d5986 Mon Sep 17 00:00:00 2001
From: Ivan Trubach <mr.trubach@icloud.com>
Date: Tue, 30 Jul 2024 17:33:07 +0300
Subject: [PATCH 015/115] pbzx: fix build with musl libc

---
 pkgs/tools/compression/pbzx/default.nix |  1 +
 pkgs/tools/compression/pbzx/stdin.patch | 53 +++++++++++++++++++++++++
 2 files changed, 54 insertions(+)
 create mode 100644 pkgs/tools/compression/pbzx/stdin.patch

diff --git a/pkgs/tools/compression/pbzx/default.nix b/pkgs/tools/compression/pbzx/default.nix
index 44555cd6ddbc..aa5692d14c51 100644
--- a/pkgs/tools/compression/pbzx/default.nix
+++ b/pkgs/tools/compression/pbzx/default.nix
@@ -9,6 +9,7 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     sha256 = "0bwd7wmnhpz1n5p39mh6asfyccj4cm06hwigslcwbb3pdwmvxc90";
   };
+  patches = [ ./stdin.patch ];
   buildInputs = [ xz xar ];
   buildPhase = ''
     ${stdenv.cc.targetPrefix}cc pbzx.c -llzma -lxar -o pbzx
diff --git a/pkgs/tools/compression/pbzx/stdin.patch b/pkgs/tools/compression/pbzx/stdin.patch
new file mode 100644
index 000000000000..f4fa23474387
--- /dev/null
+++ b/pkgs/tools/compression/pbzx/stdin.patch
@@ -0,0 +1,53 @@
+C standard defines `stdin` as a macro so we can’t use it as an
+identifier. See also
+https://lists.llvm.org/pipermail/llvm-commits/Week-of-Mon-20130506/173524.html
+
+--- a/pbzx.c
++++ b/pbzx.c
+@@ -34,7 +34,7 @@
+ 
+ /* Structure to hold the command-line options. */
+ struct options {
+-    bool stdin;    /* True if data should be read from stdin. */
++    bool usestdin; /* True if data should be read from stdin. */
+     bool noxar;    /* The input data is not a XAR archive but the pbzx Payload. */
+     bool help;     /* Print usage with details and exit. */
+     bool version;  /* Print version and exit. */
+@@ -74,7 +74,7 @@
+         /* Skip arguments that are not flags. */
+         if (argv[i][0] != '-') continue;
+         /* Match available arguments. */
+-        if      (strcmp(argv[i], "-")  == 0) opts->stdin = true;
++        if      (strcmp(argv[i], "-")  == 0) opts->usestdin = true;
+         else if (strcmp(argv[i], "-n") == 0) opts->noxar = true;
+         else if (strcmp(argv[i], "-h") == 0) opts->help = true;
+         else if (strcmp(argv[i], "-v") == 0) opts->version = true;
+@@ -204,9 +204,9 @@
+     parse_args(&argc, argv, &opts);
+     if (opts.version) version();
+     if (opts.help) usage(NULL);
+-    if (!opts.stdin && argc < 2)
++    if (!opts.usestdin && argc < 2)
+         usage("missing filename argument");
+-    else if ((!opts.stdin && argc > 2) || (opts.stdin && argc > 1))
++    else if ((!opts.usestdin && argc > 2) || (opts.usestdin && argc > 1))
+         usage("unhandled positional argument(s)");
+ 
+     char const* filename = NULL;
+@@ -216,7 +216,7 @@
+     struct stream stream;
+     stream_init(&stream);
+     bool success = false;
+-    if (opts.stdin) {
++    if (opts.usestdin) {
+         stream.type = STREAM_FP;
+         stream.fp = stdin;
+         success = true;
+@@ -291,6 +291,6 @@
+     }
+     free(zbuf);
+     lzma_end(&zs);
+-    if (!opts.stdin) stream_close(&stream);
++    if (!opts.usestdin) stream_close(&stream);
+     return 0;
+ }

From 6c166ced421740ee6c108d546e350aa8899a623a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 22 Aug 2024 05:33:20 +0000
Subject: [PATCH 016/115] publicsuffix-list: 0-unstable-2024-06-19 ->
 0-unstable-2024-08-21

---
 pkgs/data/misc/publicsuffix-list/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/data/misc/publicsuffix-list/default.nix b/pkgs/data/misc/publicsuffix-list/default.nix
index 95cab65aa61b..3a46cc980bc3 100644
--- a/pkgs/data/misc/publicsuffix-list/default.nix
+++ b/pkgs/data/misc/publicsuffix-list/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "publicsuffix-list";
-  version = "0-unstable-2024-06-19";
+  version = "0-unstable-2024-08-21";
 
   src = fetchFromGitHub {
     owner = "publicsuffix";
     repo = "list";
-    rev = "92c74a6cde6092a5e80531c0662e1055abeb975e";
-    hash = "sha256-fkfjR2A2nf3/F16Pn0hCwXtAd26TbUVA5gIv+J4DOjc=";
+    rev = "30c3fc2db5ec0ecbc2efbb798b12459e9a22fffd";
+    hash = "sha256-RmSlBl6lHFFvEEG2rsnwMpF9X8tv0VhPwhnke4UxUmA=";
   };
 
   dontBuild = true;

From 6b2530d2416b7611a0200bc61ff7b499eb8369b9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 23 Aug 2024 03:39:26 +0200
Subject: [PATCH 017/115] python312Packages.aiohttp: 3.10.3 -> 3.10.5

https://github.com/aio-libs/aiohttp/blob/v3.10.5/CHANGES.rst
---
 .../python-modules/aiohttp/default.nix        | 25 +++++++++++--------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index c96f0b1384e7..75db6b645291 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -5,12 +5,16 @@
   pythonOlder,
   fetchFromGitHub,
   substituteAll,
-  llhttp,
   python,
-  # build_requires
+
+  # build-system
   cython,
   setuptools,
-  # install_requires
+
+  # native dependencies
+  llhttp,
+
+  # dependencies
   aiohappyeyeballs,
   attrs,
   multidict,
@@ -20,12 +24,14 @@
   aiosignal,
   aiodns,
   brotli,
-  # tests_require
+
+  # tests
   freezegun,
   gunicorn,
   proxy-py,
+  pytest-cov-stub,
   pytest-mock,
-  pytest7CheckHook,
+  pytestCheckHook,
   python-on-whales,
   re-assert,
   trustme,
@@ -33,7 +39,7 @@
 
 buildPythonPackage rec {
   pname = "aiohttp";
-  version = "3.10.3";
+  version = "3.10.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -42,7 +48,7 @@ buildPythonPackage rec {
     owner = "aio-libs";
     repo = "aiohttp";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3dWd/IcCiPI3Ral6ULEUzOEOLkcdWVreDn7EI6eEy2k=";
+    hash = "sha256-HN2TJ8hVbClakV3ldTOn3wbrhCuf2Qn9EjWCSlSyJpw=";
   };
 
   patches = [
@@ -54,8 +60,6 @@ buildPythonPackage rec {
   ];
 
   postPatch = ''
-    sed -i '/--cov/d' setup.cfg
-
     rm -r vendor
     patchShebangs tools
     touch .git  # tools/gen.py uses .git to find the project root
@@ -92,8 +96,9 @@ buildPythonPackage rec {
     freezegun
     gunicorn
     proxy-py
+    pytest-cov-stub
     pytest-mock
-    pytest7CheckHook
+    pytestCheckHook
     python-on-whales
     re-assert
     trustme

From caef6dd355ad6cc584a5e316c545808e7636b185 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 23 Aug 2024 09:04:05 +0200
Subject: [PATCH 018/115] curl: enable configure flag
 `--enable-versioned-symbols`

This flag enable versioned symbols in CURL shared library.
---
 pkgs/tools/networking/curl/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 1ac724a08bc3..cc850b0d7b0c 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -120,6 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   configureFlags = [
+      "--enable-versioned-symbols"
       # Build without manual
       "--disable-manual"
       (lib.enableFeature c-aresSupport "ares")

From 45db1ff7c1aa8219a83e3fd48034fdf58706fd00 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 23 Aug 2024 11:41:20 +0200
Subject: [PATCH 019/115] nodejs_20: 20.16.0 -> 20.17.0 (#336388)

---
 pkgs/development/web/nodejs/v20.nix | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/web/nodejs/v20.nix b/pkgs/development/web/nodejs/v20.nix
index 1aa0fbf72e8d..bb2a446d6eef 100644
--- a/pkgs/development/web/nodejs/v20.nix
+++ b/pkgs/development/web/nodejs/v20.nix
@@ -1,4 +1,4 @@
-{ callPackage, fetchpatch2, openssl, python3, enableNpm ? true }:
+{ callPackage, openssl, python3, enableNpm ? true }:
 
 let
   buildNodejs = callPackage ./nodejs.nix {
@@ -12,8 +12,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "20.16.0";
-  sha256 = "cd6c8fc3ff2606aadbc7155db6f7e77247d2d0065ac18e2f7f049095584b8b46";
+  version = "20.17.0";
+  sha256 = "9abf03ac23362c60387ebb633a516303637145cb3c177be3348b16880fd8b28c";
   patches = [
     ./configure-emulator.patch
     ./configure-armv6-vfpv2.patch
@@ -21,13 +21,5 @@ buildNodejs {
     ./bypass-darwin-xcrun-node16.patch
     ./node-npm-build-npm-package-logic.patch
     ./use-correct-env-in-tests.patch
-    (fetchpatch2 {
-      url = "https://github.com/nodejs/node/commit/87598d4b63ef2c827a2bebdfa0f1540c35718519.patch";
-      hash = "sha256-efRJ2nN9QXaT91SQTB+ESkHvXtBq30Cb9BEDEZU9M/8=";
-    })
-    (fetchpatch2 {
-      url = "https://github.com/nodejs/node/commit/d0a6b605fba6cd69a82e6f12ff0363eef8fe1ee9.patch";
-      hash = "sha256-TfYal/PikRZHL6zpAlC3SmkYXCe+/8Gs83dLX/X/P/k=";
-    })
   ] ++ gypPatches;
 }

From c455cc3170d68f05b4614c41883a7d417d1c16e0 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 23 Aug 2024 11:41:36 +0200
Subject: [PATCH 020/115] nodejs_22: 22.6.0 -> 22.7.0 (#336556)

---
 pkgs/development/web/nodejs/v22.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix
index 9724d70c2b51..3c6508fc5c5d 100644
--- a/pkgs/development/web/nodejs/v22.nix
+++ b/pkgs/development/web/nodejs/v22.nix
@@ -12,8 +12,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "22.6.0";
-  sha256 = "37259d618d5565ca55acc2585045c7e1c5b9965a3d4eb44c0a237fdae84b9d44";
+  version = "22.7.0";
+  sha256 = "1e0b6f2f2ca4fb0b4644a11363169daf4b7c42f00e5a53d2c65a9fdc463e7d88";
   patches = [
     ./configure-emulator.patch
     ./configure-armv6-vfpv2.patch

From 911aa1440f40405f13f9252e2eb8ffc12f269090 Mon Sep 17 00:00:00 2001
From: Tim Cuthbertson <tim@gfxmonk.net>
Date: Tue, 28 Nov 2023 22:15:40 +1100
Subject: [PATCH 021/115] treewide: support NIX_SSL_CERT_FILE as an
 impureEnvVar

This envvar is also added to lib.proxyImpureEnvVars since it's
typically required for https proxies.

This change also updates fetchgit and go module fetching to use this
envvar. NIX_GIT_SSL_CAINFO is still supported for backwards
compatibility in fetchgit.
---
 lib/fetchers.nix                             | 3 +++
 pkgs/build-support/fetchgit/default.nix      | 4 +---
 pkgs/build-support/fetchgit/nix-prefetch-git | 6 +++---
 pkgs/build-support/go/module.nix             | 1 +
 pkgs/data/misc/cacert/setup-hook.sh          | 6 +++---
 5 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/lib/fetchers.nix b/lib/fetchers.nix
index e94c611299be..b2fe7872a12b 100644
--- a/lib/fetchers.nix
+++ b/lib/fetchers.nix
@@ -9,6 +9,9 @@
     # by definition pure.
     "http_proxy" "https_proxy" "ftp_proxy" "all_proxy" "no_proxy"
     "HTTP_PROXY" "HTTPS_PROXY" "FTP_PROXY" "ALL_PROXY" "NO_PROXY"
+
+    # https proxies typically need to inject custom root CAs too
+    "NIX_SSL_CERT_FILE"
   ];
 
 }
diff --git a/pkgs/build-support/fetchgit/default.nix b/pkgs/build-support/fetchgit/default.nix
index 66bb3b7c09ff..92c7468753e8 100644
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@@ -67,7 +67,7 @@ stdenvNoCC.mkDerivation {
   builder = ./builder.sh;
   fetcher = ./nix-prefetch-git;
 
-  nativeBuildInputs = [ git ]
+  nativeBuildInputs = [ git cacert ]
     ++ lib.optionals fetchLFS [ git-lfs ];
 
   outputHashAlgo = if hash != "" then null else "sha256";
@@ -94,8 +94,6 @@ stdenvNoCC.mkDerivation {
     export HOME=$PWD
   '';
 
-  GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-
   impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ netrcImpureEnvVars ++ [
     "GIT_PROXY_COMMAND" "NIX_GIT_SSL_CAINFO" "SOCKS_SERVER"
   ];
diff --git a/pkgs/build-support/fetchgit/nix-prefetch-git b/pkgs/build-support/fetchgit/nix-prefetch-git
index 0f41cbd6a265..b921f161f012 100755
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@@ -17,9 +17,9 @@ branchName=$NIX_PREFETCH_GIT_BRANCH_NAME
 out=${out:-}
 http_proxy=${http_proxy:-}
 
-# allow overwriting cacert's ca-bundle.crt with a custom one
-# this can be done by setting NIX_GIT_SSL_CAINFO and NIX_SSL_CERT_FILE environment variables for the nix-daemon
-GIT_SSL_CAINFO=${NIX_GIT_SSL_CAINFO:-$GIT_SSL_CAINFO}
+# NOTE: use of NIX_GIT_SSL_CAINFO is for backwards compatibility; NIX_SSL_CERT_FILE is preferred
+# as of PR#303307
+GIT_SSL_CAINFO=${NIX_GIT_SSL_CAINFO:-$NIX_SSL_CERT_FILE}
 
 # populated by clone_user_rev()
 fullRev=
diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index 214b2603ff7f..bda01fc6f9b2 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -136,6 +136,7 @@ in
         exit 10
       fi
 
+      export GIT_SSL_CAINFO=$NIX_SSL_CERT_FILE
       ${if finalAttrs.proxyVendor then ''
         mkdir -p "''${GOPATH}/pkg/mod/cache/download"
         go mod download
diff --git a/pkgs/data/misc/cacert/setup-hook.sh b/pkgs/data/misc/cacert/setup-hook.sh
index 93b682fbbd12..62361102648d 100644
--- a/pkgs/data/misc/cacert/setup-hook.sh
+++ b/pkgs/data/misc/cacert/setup-hook.sh
@@ -1,7 +1,7 @@
-export NIX_SSL_CERT_FILE=@out@/etc/ssl/certs/ca-bundle.crt
+export NIX_SSL_CERT_FILE="${NIX_SSL_CERT_FILE:-@out@/etc/ssl/certs/ca-bundle.crt}"
 
 # compatibility
 #  - openssl
-export SSL_CERT_FILE=@out@/etc/ssl/certs/ca-bundle.crt
+export SSL_CERT_FILE=$NIX_SSL_CERT_FILE
 #  - Haskell x509-system
-export SYSTEM_CERTIFICATE_PATH=@out@/etc/ssl/certs/ca-bundle.crt
+export SYSTEM_CERTIFICATE_PATH=$NIX_SSL_CERT_FILE

From 7eb5c0991cc5e6ad7fcef92848157e83e23f5fe8 Mon Sep 17 00:00:00 2001
From: Tim Cuthbertson <tim@gfxmonk.net>
Date: Fri, 9 Feb 2024 14:20:32 +1100
Subject: [PATCH 022/115] doc: add proxy usage to fetchers chapter

---
 doc/build-helpers/fetchers.chapter.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/doc/build-helpers/fetchers.chapter.md b/doc/build-helpers/fetchers.chapter.md
index 2167df3f1748..21cadfaa21fa 100644
--- a/doc/build-helpers/fetchers.chapter.md
+++ b/doc/build-helpers/fetchers.chapter.md
@@ -157,6 +157,12 @@ Here are security considerations for this scenario:
 
   In more concrete terms, if you use any other hash, the [`--insecure` flag](https://curl.se/docs/manpage.html#-k) will be passed to the underlying call to `curl` when downloading content.
 
+## Proxy usage {#sec-pkgs-fetchers-proxy}
+
+Nixpkgs fetchers can make use of a http(s) proxy. Each fetcher will automatically inherit proxy-related environment variables (`http_proxy`, `https_proxy`, etc) via [impureEnvVars](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-impureEnvVars).
+
+The environment variable `NIX_SSL_CERT_FILE` is also inherited in fetchers, and can be used to provide a custom certificate bundle to fetchers. This is usually required for a https proxy to work without certificate validation errors.
+
 []{#fetchurl}
 ## `fetchurl` {#sec-pkgs-fetchers-fetchurl}
 

From 0a4fb986558dd24ffa46088bbb991dc8c3198f49 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 16 May 2024 23:24:04 +0200
Subject: [PATCH 023/115] lvm2: 2.03.23 -> 2.03.24

https://gitlab.com/lvmteam/lvm2/-/blob/v2_03_24/WHATS_NEW
---
 pkgs/os-specific/linux/lvm2/2_03.nix          |  4 +-
 pkgs/os-specific/linux/lvm2/common.nix        |  3 -
 pkgs/os-specific/linux/lvm2/fix-static.patch  | 28 ---------
 .../linux/lvm2/fix-stdio-usage.patch          | 58 ++++++++++---------
 4 files changed, 32 insertions(+), 61 deletions(-)
 delete mode 100644 pkgs/os-specific/linux/lvm2/fix-static.patch

diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
index fa0a2cc8a600..c4f27ef96ae8 100644
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.23";
-  hash = "sha256-dOeUqene4bz4ogZfZbkZbET98yHiLWO5jtfejJqhel0=";
+  version = "2.03.24";
+  hash = "sha256-WTxVA7oA+qscbgtKWXuWBex7WIGEXAS/QS6/nRu/oTw=";
 }
diff --git a/pkgs/os-specific/linux/lvm2/common.nix b/pkgs/os-specific/linux/lvm2/common.nix
index 9cba67ee2b39..6f7c3cb77f23 100644
--- a/pkgs/os-specific/linux/lvm2/common.nix
+++ b/pkgs/os-specific/linux/lvm2/common.nix
@@ -101,10 +101,7 @@ stdenv.mkDerivation rec {
       multipath_tools = optionalTool enableMultipath multipath-tools;
       vdo = optionalTool enableVDO vdo;
     }))
-    # Musl fix from Alpine
     ./fix-stdio-usage.patch
-    # https://gitlab.com/lvmteam/lvm2/-/merge_requests/8
-    ./fix-static.patch
   ];
 
   doCheck = false; # requires root
diff --git a/pkgs/os-specific/linux/lvm2/fix-static.patch b/pkgs/os-specific/linux/lvm2/fix-static.patch
deleted file mode 100644
index 89192744adec..000000000000
--- a/pkgs/os-specific/linux/lvm2/fix-static.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 0cbe7f0adc86c92c61156c417b27b063f156b31b Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Tue, 2 Jan 2024 18:15:20 +0100
-Subject: [PATCH] makefiles: fix disabling shared link
-
-LIB_SHARED still gets set when shared linking has been disabled, so
-the previous version of this check still attempted to build the
-shared library.
----
- libdm/make.tmpl.in | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libdm/make.tmpl.in b/libdm/make.tmpl.in
-index 2dd9625d4d..69ba2c35ab 100644
---- a/libdm/make.tmpl.in
-+++ b/libdm/make.tmpl.in
-@@ -436,7 +436,7 @@ DEFS+=-D_FILE_OFFSET_BITS=64
- 	@echo "    [CC] $(<F)"
- 	$(Q) $(CC) -c $(CFLAGS) $(CLDFLAGS) $< $(LIBS) -o $@
- 
--ifneq (,$(LIB_SHARED))
-+ifeq ("@SHARED_LINK@", "yes")
- 
- TARGETS += $(LIB_SHARED).$(LIB_VERSION)
- $(LIB_SHARED).$(LIB_VERSION): $(OBJECTS) $(LDDEPS)
--- 
-GitLab
-
diff --git a/pkgs/os-specific/linux/lvm2/fix-stdio-usage.patch b/pkgs/os-specific/linux/lvm2/fix-stdio-usage.patch
index 98cdc6eb3ec9..7b9989bc2590 100644
--- a/pkgs/os-specific/linux/lvm2/fix-stdio-usage.patch
+++ b/pkgs/os-specific/linux/lvm2/fix-stdio-usage.patch
@@ -1,40 +1,45 @@
-From 63b1c7332bee6080bffecf9ce9d75ff15d799166 Mon Sep 17 00:00:00 2001
-From: Natanael Copa <ncopa@alpinelinux.org>
-Date: Wed, 16 Nov 2022 10:42:39 +0100
-Subject: [PATCH] fix stdio usage
-
----
- lib/commands/toolcontext.c | 4 ++--
- tools/lvmcmdline.c         | 6 +++---
- 2 files changed, 5 insertions(+), 5 deletions(-)
-
 diff --git a/lib/commands/toolcontext.c b/lib/commands/toolcontext.c
-index b630554a9..f20080d18 100644
+index 56dc1f856..011ec2700 100644
 --- a/lib/commands/toolcontext.c
 +++ b/lib/commands/toolcontext.c
-@@ -1667,7 +1667,7 @@ struct cmd_context *create_toolcontext(unsigned is_clvmd,
+@@ -1660,6 +1660,7 @@ struct cmd_context *create_toolcontext(unsigned is_clvmd,
  	/* FIXME Make this configurable? */
  	reset_lvm_errno(1);
  
--#ifndef VALGRIND_POOL
-+#if !defined(VALGRIND_POOL) && defined(__GLIBC__)
++#ifdef __GLIBC__
  	/* Set in/out stream buffering before glibc */
  	if (set_buffering
- #ifdef SYS_gettid
-@@ -2045,7 +2045,7 @@ void destroy_toolcontext(struct cmd_context *cmd)
+ 	    && !cmd->running_on_valgrind /* Skipping within valgrind execution. */
+@@ -1704,7 +1705,7 @@ struct cmd_context *create_toolcontext(unsigned is_clvmd,
+ 	} else if (!set_buffering)
+ 		/* Without buffering, must not use stdin/stdout */
+ 		init_silent(1);
+-
++#endif
+ 	/*
+ 	 * Environment variable LVM_SYSTEM_DIR overrides this below.
+ 	 */
+@@ -2038,6 +2039,7 @@ void destroy_toolcontext(struct cmd_context *cmd)
+ 	if (cmd->cft_def_hash)
  		dm_hash_destroy(cmd->cft_def_hash);
  
- 	dm_device_list_destroy(&cmd->cache_dm_devs);
--#ifndef VALGRIND_POOL
-+#if !defined(VALGRIND_POOL) && defined(__GLIBC__)
- 	if (cmd->linebuffer) {
++#ifdef __GLIBC__
+ 	if (!cmd->running_on_valgrind && cmd->linebuffer) {
+ 		int flags;
  		/* Reset stream buffering to defaults */
- 		if (is_valid_fd(STDIN_FILENO) &&
+@@ -2061,6 +2063,7 @@ void destroy_toolcontext(struct cmd_context *cmd)
+ 
+ 		free(cmd->linebuffer);
+ 	}
++#endif
+ 
+ 	destroy_config_context(cmd);
+ 
 diff --git a/tools/lvmcmdline.c b/tools/lvmcmdline.c
-index a5bb6a5c5..0ebfa375c 100644
+index 1b2f7f47c..e0674d42d 100644
 --- a/tools/lvmcmdline.c
 +++ b/tools/lvmcmdline.c
-@@ -3422,7 +3422,7 @@ static int _check_standard_fds(void)
+@@ -3378,7 +3378,7 @@ static int _check_standard_fds(void)
  	int err = is_valid_fd(STDERR_FILENO);
  
  	if (!is_valid_fd(STDIN_FILENO) &&
@@ -43,7 +48,7 @@ index a5bb6a5c5..0ebfa375c 100644
  		if (err)
  			perror("stdin stream open");
  		else
-@@ -3432,7 +3432,7 @@ static int _check_standard_fds(void)
+@@ -3388,7 +3388,7 @@ static int _check_standard_fds(void)
  	}
  
  	if (!is_valid_fd(STDOUT_FILENO) &&
@@ -52,7 +57,7 @@ index a5bb6a5c5..0ebfa375c 100644
  		if (err)
  			perror("stdout stream open");
  		/* else no stdout */
-@@ -3440,7 +3440,7 @@ static int _check_standard_fds(void)
+@@ -3396,7 +3396,7 @@ static int _check_standard_fds(void)
  	}
  
  	if (!is_valid_fd(STDERR_FILENO) &&
@@ -61,6 +66,3 @@ index a5bb6a5c5..0ebfa375c 100644
  		printf("stderr stream open: %s\n",
  		       strerror(errno));
  		return 0;
--- 
-2.38.1
-

From ee6a0e376d4e6cb4d8c980eedff78cceeef18a1e Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Mon, 8 Jul 2024 18:55:38 +0200
Subject: [PATCH 024/115] kvdo: drop

---
 .../manual/release-notes/rl-2411.section.md   |  2 ++
 nixos/modules/tasks/lvm.nix                   |  3 +-
 pkgs/os-specific/linux/kvdo/default.nix       | 35 -------------------
 pkgs/os-specific/linux/vdo/default.nix        |  2 +-
 pkgs/top-level/linux-kernels.nix              |  3 +-
 5 files changed, 5 insertions(+), 40 deletions(-)
 delete mode 100644 pkgs/os-specific/linux/kvdo/default.nix

diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 6b380c5023d4..bff4f1eac74f 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -262,6 +262,8 @@
 
 - PPD files for Utax printers got renamed (spaces replaced by underscores) in newest `foomatic-db` package; users of Utax printers might need to adapt their `hardware.printers.ensurePrinters.*.model` value.
 
+- The `kvdo` kernel module package was removed, because it was upstreamed in kernel version 6.9, where it is called `dm-vdo`.
+
 - `libe57format` has been updated to `>= 3.0.0`, which contains some backward-incompatible API changes. See the [release note](https://github.com/asmaloney/libE57Format/releases/tag/v3.0.0) for more details.
 
 - `gitlab` deprecated support for *runner registration tokens* in GitLab 16.0, disabled their support in GitLab 17.0 and will
diff --git a/nixos/modules/tasks/lvm.nix b/nixos/modules/tasks/lvm.nix
index 9607218ec069..438b46f8f9b0 100644
--- a/nixos/modules/tasks/lvm.nix
+++ b/nixos/modules/tasks/lvm.nix
@@ -89,7 +89,7 @@ in {
     (mkIf cfg.boot.vdo.enable {
       boot = {
         initrd = {
-          kernelModules = [ "kvdo" ];
+          kernelModules = [ "dm-vdo" ];
 
           systemd.initrdBin = lib.mkIf config.boot.initrd.services.lvm.enable [ pkgs.vdo ];
 
@@ -107,7 +107,6 @@ in {
             done
           '';
         };
-        extraModulePackages = [ config.boot.kernelPackages.kvdo ];
       };
 
       services.lvm.package = mkOverride 999 pkgs.lvm2_vdo;  # this overrides mkDefault
diff --git a/pkgs/os-specific/linux/kvdo/default.nix b/pkgs/os-specific/linux/kvdo/default.nix
deleted file mode 100644
index cc5ace339b42..000000000000
--- a/pkgs/os-specific/linux/kvdo/default.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ stdenv, lib, fetchFromGitHub, vdo, kernel }:
-
-stdenv.mkDerivation rec {
-  inherit (vdo);
-  pname = "kvdo";
-  version = "8.2.3.3"; # bump this version with vdo
-
-  src = fetchFromGitHub {
-    owner = "dm-vdo";
-    repo = "kvdo";
-    rev = version;
-    hash = "sha256-y7uVgWFV6uWRoRqfiu0arG9731mgWijXjcp9KSaZ5X0=";
-  };
-
-  nativeBuildInputs = kernel.moduleBuildDependencies;
-
-  dontConfigure = true;
-  enableParallelBuilding = true;
-
-  KSRC = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
-  INSTALL_MOD_PATH = placeholder "out";
-
-  preBuild = ''
-    makeFlags="$makeFlags -C ${KSRC} M=$(pwd)"
-  '';
-  installTargets = [ "modules_install" ];
-
-  meta = with lib; {
-    inherit (vdo.meta) license maintainers;
-    homepage = "https://github.com/dm-vdo/kvdo";
-    description = "Pair of kernel modules which provide pools of deduplicated and/or compressed block storage";
-    platforms = platforms.linux;
-    broken = kernel.kernelOlder "5.17";
-  };
-}
diff --git a/pkgs/os-specific/linux/vdo/default.nix b/pkgs/os-specific/linux/vdo/default.nix
index e709b26ad93d..548caf7a5b6e 100644
--- a/pkgs/os-specific/linux/vdo/default.nix
+++ b/pkgs/os-specific/linux/vdo/default.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vdo";
-  version = "8.2.2.2";  # bump this version with kvdo
+  version = "8.2.2.2";
 
   src = fetchFromGitHub {
     owner = "dm-vdo";
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index d5bd0f19bac2..027374fd490e 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -389,8 +389,6 @@ in {
 
     ena = callPackage ../os-specific/linux/ena {};
 
-    kvdo = callPackage ../os-specific/linux/kvdo {};
-
     lenovo-legion-module = callPackage ../os-specific/linux/lenovo-legion { };
 
     linux-gpib = callPackage ../applications/science/electronics/linux-gpib/kernel.nix { };
@@ -613,6 +611,7 @@ in {
     vm-tools = self.mm-tools;
     xmm7360-pci = throw "Support for the XMM7360 WWAN card was added to the iosm kmod in mainline kernel version 5.18";
     amdgpu-pro = throw "amdgpu-pro was removed due to lack of maintenance"; # Added 2024-06-16
+    kvdo = throw "kvdo was removed, because it was added to mainline in kernel version 6.9"; # Added 2024-07-08
   });
 
   hardenedPackagesFor = kernel: overrides: packagesFor (hardenedKernelFor kernel overrides);

From f5fa4e0cc890b1a6ccf8cce32944a7e7a49cae85 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Mon, 8 Jul 2024 18:59:09 +0200
Subject: [PATCH 025/115] nixos/tests/lvm2/vdo: only build latest kernel

---
 nixos/tests/lvm2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/tests/lvm2/default.nix b/nixos/tests/lvm2/default.nix
index ba1bdb5de545..346ec6739501 100644
--- a/nixos/tests/lvm2/default.nix
+++ b/nixos/tests/lvm2/default.nix
@@ -10,7 +10,7 @@ let
   tests = let callTest = p: lib.flip (import p) { inherit system pkgs; }; in {
     thinpool = { test = callTest ./thinpool.nix; kernelFilter = lib.id; };
     # we would like to test all versions, but the kernel module currently does not compile against the other versions
-    vdo = { test = callTest ./vdo.nix; kernelFilter = lib.filter (v: v == "6.1"); };
+    vdo = { test = callTest ./vdo.nix; kernelFilter = lib.filter (v: v == "latest"); };
 
 
     # systemd in stage 1
@@ -26,7 +26,7 @@ let
     };
     vdo-sd-stage-1 = {
       test = callTest ./systemd-stage-1.nix;
-      kernelFilter = lib.filter (v: v == "6.1");
+      kernelFilter = lib.filter (v: v == "latest");
       flavour = "vdo";
     };
   };

From 9366ef0fbd3e5ddb495b2c38ab861d66f569fdd7 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Mon, 8 Jul 2024 19:03:43 +0200
Subject: [PATCH 026/115] vdo: 8.2.2.2 -> 8.3.0.71

---
 nixos/modules/tasks/lvm.nix            | 4 ++--
 pkgs/os-specific/linux/vdo/default.nix | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/nixos/modules/tasks/lvm.nix b/nixos/modules/tasks/lvm.nix
index 438b46f8f9b0..6748f023ec4c 100644
--- a/nixos/modules/tasks/lvm.nix
+++ b/nixos/modules/tasks/lvm.nix
@@ -98,11 +98,11 @@ in {
               copy_bin_and_libs ${pkgs.vdo}/bin/$BIN
             done
             substituteInPlace $out/bin/vdorecover --replace "${pkgs.bash}/bin/bash" "/bin/sh"
-            substituteInPlace $out/bin/adaptLVMVDO.sh --replace "${pkgs.bash}/bin/bash" "/bin/sh"
+            substituteInPlace $out/bin/adaptlvm --replace "${pkgs.bash}/bin/bash" "/bin/sh"
           '';
 
           extraUtilsCommandsTest = mkIf (!config.boot.initrd.systemd.enable)''
-            ls ${pkgs.vdo}/bin/ | grep -vE '(adaptLVMVDO|vdorecover)' | while read BIN; do
+            ls ${pkgs.vdo}/bin/ | grep -vE '(adaptlvm|vdorecover)' | while read BIN; do
               $out/bin/$(basename $BIN) --help > /dev/null
             done
           '';
diff --git a/pkgs/os-specific/linux/vdo/default.nix b/pkgs/os-specific/linux/vdo/default.nix
index 548caf7a5b6e..dc0a30732ed0 100644
--- a/pkgs/os-specific/linux/vdo/default.nix
+++ b/pkgs/os-specific/linux/vdo/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vdo";
-  version = "8.2.2.2";
+  version = "8.3.0.71";
 
   src = fetchFromGitHub {
     owner = "dm-vdo";
     repo = pname;
     rev = version;
-    hash = "sha256-+2w9jzJemI2xr+i/Jd5TIBZ/o8Zv+Ett0fbJbkOD7KI=";
+    hash = "sha256-FZerMUzth43p5jvKQalyYcW+mrl6SLjS8GrivY2qWkI=";
   };
 
   nativeBuildInputs = [
@@ -48,8 +48,8 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   postInstall = ''
-    installShellCompletion --bash $out/bash_completion.d/*
-    rm -r $out/bash_completion.d
+    installShellCompletion --bash $out/usr/share/bash-completion/completions/*
+    rm -rv $out/usr
 
     wrapPythonPrograms
   '';

From 31f61f5254bf27f5e2a73dc058757c40ecf8aeed Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Fri, 12 Jul 2024 18:52:28 +0200
Subject: [PATCH 027/115] lvm2: 2.03.24 -> 2.03.25

https://gitlab.com/lvmteam/lvm2/-/blob/v2_03_25/WHATS_NEW
---
 pkgs/os-specific/linux/lvm2/2_03.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
index c4f27ef96ae8..fcd141e3e5fa 100644
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.24";
-  hash = "sha256-WTxVA7oA+qscbgtKWXuWBex7WIGEXAS/QS6/nRu/oTw=";
+  version = "2.03.25";
+  hash = "sha256-S+pv0uWvnNs+J7SLTvqNiSENm/oT35AOCS5ARyClmx0=";
 }

From bd0539cb2086b948cb57cb2e9876efff3e47bfb8 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 18 Jul 2024 09:14:21 +0200
Subject: [PATCH 028/115] nixos/tasks/lvm: assert kernel version for vdo

---
 nixos/modules/tasks/lvm.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nixos/modules/tasks/lvm.nix b/nixos/modules/tasks/lvm.nix
index 6748f023ec4c..0b628725969a 100644
--- a/nixos/modules/tasks/lvm.nix
+++ b/nixos/modules/tasks/lvm.nix
@@ -87,6 +87,11 @@ in {
       environment.systemPackages = [ pkgs.thin-provisioning-tools ];
     })
     (mkIf cfg.boot.vdo.enable {
+      assertions = [{
+        assertion = lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.9";
+        message = "boot.vdo.enable requires at least kernel version 6.9";
+      }];
+
       boot = {
         initrd = {
           kernelModules = [ "dm-vdo" ];

From eec2ebe81aae6523512ad5d78bcafcf8c5f58da5 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Fri, 23 Aug 2024 20:01:58 +0200
Subject: [PATCH 029/115] lvm2: 2.03.25 -> 2.03.26

https://gitlab.com/lvmteam/lvm2/-/blob/v2_03_26/WHATS_NEW
---
 pkgs/os-specific/linux/lvm2/2_03.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
index fcd141e3e5fa..ad559a6c2bb6 100644
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.25";
-  hash = "sha256-S+pv0uWvnNs+J7SLTvqNiSENm/oT35AOCS5ARyClmx0=";
+  version = "2.03.26";
+  hash = "sha256-cuqLTw4WEN5dEZKWsV7yoiA0MQiVQdy+vGY2H2X7NfU=";
 }

From 5547322a0c01dd30a7e0111adc1f02bafbbd6ebc Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 3 Mar 2024 17:35:58 +0100
Subject: [PATCH 030/115] postgresql: move dynamic modules to default output

Dynamic modules are technically libraries, but are not used by other packages.
Instead they are loaded by PostgreSQL itself, e.g. as extensions. Those just
increased the size of the lib output without benefit.

This removes the NIX_PGLIBDIR hack introduced in #17838 and instead makes sure
that pg_config always returns the correct PGLIBDIR. The test for postgis
introduced in the same PR is still passing with the change.
---
 .../rust/cargo-pgrx/buildPgrxExtension.nix    |  1 -
 pkgs/servers/sql/postgresql/generic.nix       | 35 +++----------------
 .../patches/paths-for-split-outputs.patch     | 11 ++++++
 .../specify_pkglibdir_at_runtime.patch        | 28 ---------------
 4 files changed, 15 insertions(+), 60 deletions(-)
 delete mode 100644 pkgs/servers/sql/postgresql/patches/specify_pkglibdir_at_runtime.patch

diff --git a/pkgs/development/tools/rust/cargo-pgrx/buildPgrxExtension.nix b/pkgs/development/tools/rust/cargo-pgrx/buildPgrxExtension.nix
index 7138ae8ecfef..ab4343462f26 100644
--- a/pkgs/development/tools/rust/cargo-pgrx/buildPgrxExtension.nix
+++ b/pkgs/development/tools/rust/cargo-pgrx/buildPgrxExtension.nix
@@ -117,7 +117,6 @@ let
       ${preBuildAndTest}
       ${maybeEnterBuildAndTestSubdir}
 
-      NIX_PGLIBDIR="${postgresql}/lib" \
       PGRX_BUILD_FLAGS="--frozen -j $NIX_BUILD_CORES ${builtins.concatStringsSep " " cargoBuildFlags}" \
       ${lib.optionalString stdenv.isDarwin ''RUSTFLAGS="''${RUSTFLAGS:+''${RUSTFLAGS} }-Clink-args=-Wl,-undefined,dynamic_lookup"''} \
       cargo pgrx package \
diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index 08b32befb672..a8610c8e487b 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -112,7 +112,6 @@ let
       (if atLeast "16" then ./patches/relative-to-symlinks-16+.patch else ./patches/relative-to-symlinks.patch)
       ./patches/less-is-more.patch
       ./patches/paths-for-split-outputs.patch
-      ./patches/specify_pkglibdir_at_runtime.patch
       ./patches/paths-with-postgresql-suffix.patch
 
       (substituteAll {
@@ -129,18 +128,13 @@ let
     installTargets = [ "install-world" ];
 
     postPatch = ''
+      substituteInPlace "src/Makefile.global.in" --subst-var out
       # Hardcode the path to pgxs so pg_config returns the path in $out
       substituteInPlace "src/common/config_info.c" --subst-var out
-    '' + lib.optionalString jitSupport ''
-        # Force lookup of jit stuff in $out instead of $lib
-        substituteInPlace src/backend/jit/jit.c --replace pkglib_path \"$out/lib\"
-        substituteInPlace src/backend/jit/llvm/llvmjit.c --replace pkglib_path \"$out/lib\"
-        substituteInPlace src/backend/jit/llvm/llvmjit_inline.cpp --replace pkglib_path \"$out/lib\"
     '';
 
     postInstall =
       ''
-        moveToOutput "lib/pgxs" "$out" # looks strange, but not deleting it
         moveToOutput "lib/libpgcommon*.a" "$out"
         moveToOutput "lib/libpgport*.a" "$out"
         moveToOutput "lib/libecpg*" "$out"
@@ -159,11 +153,6 @@ let
           done
         fi
       '' + lib.optionalString jitSupport ''
-        # Move the bitcode and libllvmjit.so library out of $lib; otherwise, every client that
-        # depends on libpq.so will also have libLLVM.so in its closure too, bloating it
-        moveToOutput "lib/bitcode" "$out"
-        moveToOutput "lib/llvmjit*" "$out"
-
         # In the case of JIT support, prevent a retained dependency on clang-wrapper
         substituteInPlace "$out/lib/pgxs/src/Makefile.global" --replace ${stdenv'.cc}/bin/clang clang
         nuke-refs $out/lib/llvmjit_types.bc $(find $out/lib/bitcode -type f)
@@ -225,7 +214,7 @@ let
       in import ./ext newSelf newSuper;
 
       withPackages = postgresqlWithPackages {
-                       inherit makeWrapper buildEnv;
+                       inherit buildEnv;
                        postgresql = this;
                      }
                      this.pkgs;
@@ -271,30 +260,14 @@ let
     };
   });
 
-  postgresqlWithPackages = { postgresql, makeWrapper, buildEnv }: pkgs: f: buildEnv {
+  postgresqlWithPackages = { postgresql, buildEnv }: pkgs: f: buildEnv {
     name = "postgresql-and-plugins-${postgresql.version}";
     paths = f pkgs ++ [
         postgresql
-        postgresql.lib
         postgresql.man   # in case user installs this into environment
     ];
-    nativeBuildInputs = [ makeWrapper ];
 
-
-    # We include /bin to ensure the $out/bin directory is created, which is
-    # needed because we'll be removing the files from that directory in postBuild
-    # below. See #22653
-    pathsToLink = ["/" "/bin"];
-
-    # Note: the duplication of executables is about 4MB size.
-    # So a nicer solution was patching postgresql to allow setting the
-    # libdir explicitly.
-    postBuild = ''
-      mkdir -p $out/bin
-      rm $out/bin/{pg_config,postgres,pg_ctl}
-      cp --target-directory=$out/bin ${postgresql}/bin/{postgres,pg_config,pg_ctl}
-      wrapProgram $out/bin/postgres --set NIX_PGLIBDIR $out/lib
-    '';
+    pathsToLink = ["/"];
 
     passthru.version = postgresql.version;
     passthru.psqlSchema = postgresql.psqlSchema;
diff --git a/pkgs/servers/sql/postgresql/patches/paths-for-split-outputs.patch b/pkgs/servers/sql/postgresql/patches/paths-for-split-outputs.patch
index 2134f7e81a87..fca7aa10fc83 100644
--- a/pkgs/servers/sql/postgresql/patches/paths-for-split-outputs.patch
+++ b/pkgs/servers/sql/postgresql/patches/paths-for-split-outputs.patch
@@ -9,3 +9,14 @@
  	strlcat(path, "/pgxs/src/makefiles/pgxs.mk", sizeof(path));
  	cleanup_path(path);
  	configdata[i].setting = pstrdup(path);
+--- a/src/Makefile.global.in
++++ b/src/Makefile.global.in
+@@ -116,7 +116,7 @@ endif
+ 
+ libdir := @libdir@
+ 
+-pkglibdir = $(libdir)
++pkglibdir = @out@/lib
+ ifeq "$(findstring pgsql, $(pkglibdir))" ""
+ ifeq "$(findstring postgres, $(pkglibdir))" ""
+ override pkglibdir := $(pkglibdir)/postgresql
diff --git a/pkgs/servers/sql/postgresql/patches/specify_pkglibdir_at_runtime.patch b/pkgs/servers/sql/postgresql/patches/specify_pkglibdir_at_runtime.patch
deleted file mode 100644
index b94fc9efcbff..000000000000
--- a/pkgs/servers/sql/postgresql/patches/specify_pkglibdir_at_runtime.patch
+++ /dev/null
@@ -1,28 +0,0 @@
---- a/src/port/path.c
-+++ b/src/port/path.c
-@@ -714,7 +714,11 @@
- void
- get_lib_path(const char *my_exec_path, char *ret_path)
- {
--	make_relative_path(ret_path, LIBDIR, PGBINDIR, my_exec_path);
-+	char const * const nix_pglibdir = getenv("NIX_PGLIBDIR");
-+	if(nix_pglibdir == NULL)
-+		make_relative_path(ret_path, LIBDIR, PGBINDIR, my_exec_path);
-+	else
-+		make_relative_path(ret_path, nix_pglibdir, PGBINDIR, my_exec_path);
- }
- 
- /*
-@@ -723,7 +727,11 @@
- void
- get_pkglib_path(const char *my_exec_path, char *ret_path)
- {
--	make_relative_path(ret_path, PKGLIBDIR, PGBINDIR, my_exec_path);
-+	char const * const nix_pglibdir = getenv("NIX_PGLIBDIR");
-+	if(nix_pglibdir == NULL)
-+		make_relative_path(ret_path, PKGLIBDIR, PGBINDIR, my_exec_path);
-+	else
-+		make_relative_path(ret_path, nix_pglibdir, PGBINDIR, my_exec_path);
- }
- 
- /*

From 77977286d80c9bfb77cbf80989d41c59d66dccf8 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 3 Mar 2024 17:50:31 +0100
Subject: [PATCH 031/115] postgresql: move libecpq to lib output

This library is used by other packages, so should be in the lib output.

By removing unused sections, libecpg will not contain any references to other
outputs and thus does not increase the closure for the lib output anymore.
This will also help massively when splitting a dev output later.

As a side-effect, this also unbreaks pkgsMusl.postgresql_12_jit and
pkgsMusl.postgresql_13_jit. For, at least to me, unknown reasons, those build
fine now.
---
 pkgs/servers/sql/postgresql/generic.nix       | 42 ++++++++++++++-----
 .../patches/export-dynamic-darwin-15-.patch   | 13 ++++++
 2 files changed, 45 insertions(+), 10 deletions(-)
 create mode 100644 pkgs/servers/sql/postgresql/patches/export-dynamic-darwin-15-.patch

diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index a8610c8e487b..fc6087cde870 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -23,7 +23,7 @@ let
 
       # JIT
       , jitSupport
-      , nukeReferences, patchelf, llvmPackages
+      , nukeReferences, patchelf, llvmPackages, overrideCC
 
       # PL/Python
       , pythonSupport ? false
@@ -43,7 +43,14 @@ let
 
     pname = "postgresql";
 
-    stdenv' = if jitSupport then llvmPackages.stdenv else stdenv;
+    stdenv' =
+      if jitSupport then
+        overrideCC llvmPackages.stdenv (llvmPackages.stdenv.cc.override {
+          # LLVM bintools are not used by default, but are needed to make -flto work below.
+          bintools = llvmPackages.bintools;
+        })
+      else
+        stdenv;
   in stdenv'.mkDerivation (finalAttrs: {
     inherit version;
     pname = pname + lib.optionalString jitSupport "-jit";
@@ -53,10 +60,15 @@ let
       inherit hash;
     };
 
+    __structuredAttrs = true;
+
     hardeningEnable = lib.optionals (!stdenv'.cc.isClang) [ "pie" ];
 
     outputs = [ "out" "lib" "doc" "man" ];
     setOutputFlags = false; # $out retains configureFlags :-/
+    outputChecks.lib = {
+      disallowedReferences = [ "out" "doc" "man" ];
+    };
 
     buildInputs = [
       zlib
@@ -87,9 +99,17 @@ let
 
     buildFlags = [ "world" ];
 
-    # Makes cross-compiling work when xml2-config can't be executed on the host.
-    # Fixed upstream in https://github.com/postgres/postgres/commit/0bc8cebdb889368abdf224aeac8bc197fe4c9ae6
-    env.NIX_CFLAGS_COMPILE = lib.optionalString (olderThan "13") "-I${libxml2.dev}/include/libxml2";
+    # libpgcommon.a and libpgport.a contain all paths returned by pg_config and are linked
+    # into all binaries. However, almost no binaries actually use those paths. The following
+    # flags will remove unused sections from all shared libraries and binaries - including
+    # those paths. This avoids a lot of circular dependency problems with different outputs,
+    # and allows splitting them cleanly.
+    env.CFLAGS = "-fdata-sections -ffunction-sections"
+      + (if stdenv'.cc.isClang then " -flto" else " -fmerge-constants -Wl,--gc-sections")
+      + lib.optionalString (stdenv'.isDarwin && jitSupport) " -fuse-ld=lld"
+      # Makes cross-compiling work when xml2-config can't be executed on the host.
+      # Fixed upstream in https://github.com/postgres/postgres/commit/0bc8cebdb889368abdf224aeac8bc197fe4c9ae6
+      + lib.optionalString (olderThan "13") " -I${libxml2.dev}/include/libxml2";
 
     configureFlags = [
       "--with-openssl"
@@ -106,7 +126,10 @@ let
       ++ lib.optionals gssSupport [ "--with-gssapi" ]
       ++ lib.optionals pythonSupport [ "--with-python" ]
       ++ lib.optionals jitSupport [ "--with-llvm" ]
-      ++ lib.optionals stdenv'.isLinux [ "--with-pam" ];
+      ++ lib.optionals stdenv'.isLinux [ "--with-pam" ]
+      # This could be removed once the upstream issue is resolved:
+      # https://postgr.es/m/flat/427c7c25-e8e1-4fc5-a1fb-01ceff185e5b%40technowledgy.de
+      ++ lib.optionals (stdenv'.isDarwin && atLeast "16") [ "LDFLAGS_EX_BE=-Wl,-export_dynamic" ];
 
     patches = [
       (if atLeast "16" then ./patches/relative-to-symlinks-16+.patch else ./patches/relative-to-symlinks.patch)
@@ -123,6 +146,8 @@ let
       map fetchurl (lib.attrValues muslPatches)
     ) ++ lib.optionals stdenv'.isLinux  [
       (if atLeast "13" then ./patches/socketdir-in-run-13+.patch else ./patches/socketdir-in-run.patch)
+    ] ++ lib.optionals (stdenv'.isDarwin && olderThan "16") [
+      ./patches/export-dynamic-darwin-15-.patch
     ];
 
     installTargets = [ "install-world" ];
@@ -137,7 +162,6 @@ let
       ''
         moveToOutput "lib/libpgcommon*.a" "$out"
         moveToOutput "lib/libpgport*.a" "$out"
-        moveToOutput "lib/libecpg*" "$out"
 
         # Prevent a retained dependency on gcc-wrapper.
         substituteInPlace "$out/lib/pgxs/src/Makefile.global" --replace ${stdenv'.cc}/bin/ld ld
@@ -254,9 +278,7 @@ let
       # resulting LLVM IR isn't platform-independent this doesn't give you much.
       # In fact, I tried to test the result in a VM-test, but as soon as JIT was used to optimize
       # a query, postgres would coredump with `Illegal instruction`.
-      broken = (jitSupport && stdenv.hostPlatform != stdenv.buildPlatform)
-        # Allmost all tests fail FATAL errors for v12 and v13
-        || (jitSupport && stdenv.hostPlatform.isMusl && olderThan "14");
+      broken = jitSupport && !stdenv.hostPlatform.canExecute stdenv.buildPlatform;
     };
   });
 
diff --git a/pkgs/servers/sql/postgresql/patches/export-dynamic-darwin-15-.patch b/pkgs/servers/sql/postgresql/patches/export-dynamic-darwin-15-.patch
new file mode 100644
index 000000000000..fa0f4be4de7f
--- /dev/null
+++ b/pkgs/servers/sql/postgresql/patches/export-dynamic-darwin-15-.patch
@@ -0,0 +1,13 @@
+See https://postgr.es/m/eb249761-56e2-4e42-a2c5-b9ae18c1ca1f%40technowledgy.de
+---
+--- a/src/makefiles/Makefile.darwin
++++ b/src/makefiles/Makefile.darwin
+@@ -5,6 +5,8 @@ DLSUFFIX = .so
+ # env var name to use in place of LD_LIBRARY_PATH
+ ld_library_path_var = DYLD_LIBRARY_PATH
+ 
++export_dynamic = -Wl,-export_dynamic
++
+ ifdef PGXS
+   BE_DLLLIBS = -bundle_loader $(bindir)/postgres
+ else

From 435f51c37faf74375134dfbd7c5a4560da2a9ea7 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Mon, 4 Mar 2024 21:26:50 +0100
Subject: [PATCH 032/115] postgresql: split dev output

This splits a dev output to make the default output not depend on any
build dependencies anymore. This also avoids removing references from
pgxs' Makefile this way, which should, at least theoretically, be good
to build extensions via pgxs, making sure they use the same tooling.

ecpg is the "embedded SQL C preprocessor", which is certainly a dev
tool.

Most important, for closure size anyway, is to move pg_config to the dev
output, since it retains paths to all the other outputs.

The only thing with references to the dev output remaining is then the
postgres binary itself. It contains all the output paths, because it
shows those in the pg_config system view. There is no other way than
to nuke those references to avoid circular dependencies between outputs
- and blowing up closure size again.
---
 .../manual/release-notes/rl-2411.section.md   |  2 +
 .../modules/services/databases/postgresql.md  |  4 +
 pkgs/servers/sql/postgresql/generic.nix       | 73 +++++++++++++------
 .../patches/empty-pg-config-view-15+.patch    | 54 ++++++++++++++
 .../patches/empty-pg-config-view.patch        | 50 +++++++++++++
 .../patches/paths-for-split-outputs.patch     |  2 +-
 6 files changed, 160 insertions(+), 25 deletions(-)
 create mode 100644 pkgs/servers/sql/postgresql/patches/empty-pg-config-view-15+.patch
 create mode 100644 pkgs/servers/sql/postgresql/patches/empty-pg-config-view.patch

diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 98e5f961624f..9feef0c04fc5 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -298,6 +298,8 @@
 
 - Docker now defaults to 27.x, because version 24.x stopped receiving security updates and bug fixes after [February 1, 2024](https://github.com/moby/moby/pull/46772#discussion_r1686464084).
 
+- `postgresql` was split into default and -dev outputs. To make this work without circular dependencies, the output of the `pg_config` system view has been removed. The `pg_config` binary is provided in the -dev output and still works as expected.
+
 - `keycloak` was updated to version 25, which introduces new hostname related options.
   See [Upgrading Guide](https://www.keycloak.org/docs/25.0.1/upgrading/#migrating-to-25-0-0) for instructions.
 
diff --git a/nixos/modules/services/databases/postgresql.md b/nixos/modules/services/databases/postgresql.md
index e76f127335c7..4de0ca9d2e90 100644
--- a/nixos/modules/services/databases/postgresql.md
+++ b/nixos/modules/services/databases/postgresql.md
@@ -362,3 +362,7 @@ postgresql.withJIT.pname
 ```
 
 evaluates to `"foobar"`.
+
+## Notable differences to upstream
+
+- To avoid circular dependencies between default and -dev outputs, the output of the `pg_config` system view has been removed.
diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index fc6087cde870..0ba6a7085ecb 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -6,6 +6,7 @@ let
       , glibc, zlib, readline, openssl, icu, lz4, zstd, systemd, libossp_uuid
       , pkg-config, libxml2, tzdata, libkrb5, substituteAll, darwin
       , linux-pam
+      , removeReferencesTo
 
       # This is important to obtain a version of `libpq` that does not depend on systemd.
       , systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd && !stdenv.hostPlatform.isStatic
@@ -64,10 +65,26 @@ let
 
     hardeningEnable = lib.optionals (!stdenv'.cc.isClang) [ "pie" ];
 
-    outputs = [ "out" "lib" "doc" "man" ];
-    setOutputFlags = false; # $out retains configureFlags :-/
+    outputs = [ "out" "dev" "doc" "lib" "man" ];
+    outputChecks.out = {
+      disallowedReferences = [ "dev" "doc" "man" ];
+      disallowedRequisites = [
+        stdenv'.cc
+      ] ++ (
+        map lib.getDev (builtins.filter (drv: drv ? "dev") finalAttrs.buildInputs)
+      ) ++ lib.optionals jitSupport [
+        llvmPackages.llvm.out
+      ];
+    };
     outputChecks.lib = {
-      disallowedReferences = [ "out" "doc" "man" ];
+      disallowedReferences = [ "out" "dev" "doc" "man" ];
+      disallowedRequisites = [
+        stdenv'.cc
+      ] ++ (
+        map lib.getDev (builtins.filter (drv: drv ? "dev") finalAttrs.buildInputs)
+      ) ++ lib.optionals jitSupport [
+        llvmPackages.llvm.out
+      ];
     };
 
     buildInputs = [
@@ -90,6 +107,7 @@ let
     nativeBuildInputs = [
       makeWrapper
       pkg-config
+      removeReferencesTo
     ]
       ++ lib.optionals jitSupport [ llvmPackages.llvm.dev nukeReferences patchelf ];
 
@@ -116,7 +134,6 @@ let
       "--with-libxml"
       "--with-icu"
       "--sysconfdir=/etc"
-      "--libdir=$(lib)/lib"
       "--with-system-tzdata=${tzdata}/share/zoneinfo"
       "--enable-debug"
       (lib.optionalString systemdSupport' "--with-systemd")
@@ -133,6 +150,7 @@ let
 
     patches = [
       (if atLeast "16" then ./patches/relative-to-symlinks-16+.patch else ./patches/relative-to-symlinks.patch)
+      (if atLeast "15" then ./patches/empty-pg-config-view-15+.patch else ./patches/empty-pg-config-view.patch)
       ./patches/less-is-more.patch
       ./patches/paths-for-split-outputs.patch
       ./patches/paths-with-postgresql-suffix.patch
@@ -154,21 +172,38 @@ let
 
     postPatch = ''
       substituteInPlace "src/Makefile.global.in" --subst-var out
-      # Hardcode the path to pgxs so pg_config returns the path in $out
-      substituteInPlace "src/common/config_info.c" --subst-var out
+      # Hardcode the path to pgxs so pg_config returns the path in $dev
+      substituteInPlace "src/common/config_info.c" --subst-var dev
     '';
 
     postInstall =
       ''
-        moveToOutput "lib/libpgcommon*.a" "$out"
-        moveToOutput "lib/libpgport*.a" "$out"
+        moveToOutput "bin/ecpg" "$dev"
+        moveToOutput "lib/pgxs" "$dev"
 
-        # Prevent a retained dependency on gcc-wrapper.
-        substituteInPlace "$out/lib/pgxs/src/Makefile.global" --replace ${stdenv'.cc}/bin/ld ld
+        # Pretend pg_config is located in $out/bin to return correct paths, but
+        # actually have it in -dev to avoid pulling in all other outputs.
+        moveToOutput "bin/pg_config" "$dev"
+        # To prevent a "pg_config: could not find own program executable" error, we fake
+        # pg_config in the default output.
+        cat << EOF > "$out/bin/pg_config" && chmod +x "$out/bin/pg_config"
+        #!${stdenv'.shell}
+        echo The real pg_config can be found in the -dev output.
+        exit 1
+        EOF
+        wrapProgram "$dev/bin/pg_config" --argv0 "$out/bin/pg_config"
+
+        # postgres exposes external symbols get_pkginclude_path and similar. Those
+        # can't be stripped away by --gc-sections/LTO, because they could theoretically
+        # be used by dynamically loaded modules / extensions. To avoid circular dependencies,
+        # references to -dev, -doc and -man are removed here. References to -lib must be kept,
+        # because there is a realistic use-case for extensions to locate the /lib directory to
+        # load other shared modules.
+        remove-references-to -t "$dev" -t "$doc" -t "$man" "$out/bin/postgres"
 
         if [ -z "''${dontDisableStatic:-}" ]; then
           # Remove static libraries in case dynamic are available.
-          for i in $out/lib/*.a $lib/lib/*.a; do
+          for i in $lib/lib/*.a; do
             name="$(basename "$i")"
             ext="${stdenv'.hostPlatform.extensions.sharedLibrary}"
             if [ -e "$lib/lib/''${name%.a}$ext" ] || [ -e "''${i%.a}$ext" ]; then
@@ -176,21 +211,13 @@ let
             fi
           done
         fi
+        # The remaining static libraries are libpgcommon.a, libpgport.a and related.
+        # Those are only used when building e.g. extensions, so go to $dev.
+        moveToOutput "lib/*.a" "$dev"
       '' + lib.optionalString jitSupport ''
         # In the case of JIT support, prevent a retained dependency on clang-wrapper
-        substituteInPlace "$out/lib/pgxs/src/Makefile.global" --replace ${stdenv'.cc}/bin/clang clang
         nuke-refs $out/lib/llvmjit_types.bc $(find $out/lib/bitcode -type f)
 
-        # Stop out depending on the default output of llvm
-        substituteInPlace $out/lib/pgxs/src/Makefile.global \
-          --replace ${llvmPackages.llvm.out}/bin "" \
-          --replace '$(LLVM_BINPATH)/' ""
-
-        # Stop out depending on the -dev output of llvm
-        substituteInPlace $out/lib/pgxs/src/Makefile.global \
-          --replace ${llvmPackages.llvm.dev}/bin/llvm-config llvm-config \
-          --replace -I${llvmPackages.llvm.dev}/include ""
-
         ${lib.optionalString (!stdenv'.isDarwin) ''
           # Stop lib depending on the -dev output of llvm
           rpath=$(patchelf --print-rpath $out/lib/llvmjit.so)
@@ -210,8 +237,6 @@ let
     # autodetection doesn't seem to able to find this, but it's there.
     checkTarget = "check";
 
-    disallowedReferences = [ stdenv'.cc ];
-
     passthru = let
       this = self.callPackage generic args;
       jitToggle = this.override {
diff --git a/pkgs/servers/sql/postgresql/patches/empty-pg-config-view-15+.patch b/pkgs/servers/sql/postgresql/patches/empty-pg-config-view-15+.patch
new file mode 100644
index 000000000000..c83e6964cf45
--- /dev/null
+++ b/pkgs/servers/sql/postgresql/patches/empty-pg-config-view-15+.patch
@@ -0,0 +1,54 @@
+Empty the pg_config system information view. This view keeps references to
+several -dev outputs, which we want to avoid to keep closure size down.
+
+The alternative to this patch would be to nuke references across the board,
+but this will also affect the output of the pg_config utility. By emptying
+the view only, we keep the pg_config binary intact. It resides in the -dev
+output, so it's fine to have all those references there.
+
+---
+--- a/src/backend/utils/misc/pg_config.c
++++ b/src/backend/utils/misc/pg_config.c
+@@ -32,20 +32,5 @@ pg_config(PG_FUNCTION_ARGS)
+ 	/* initialize our tuplestore */
+ 	InitMaterializedSRF(fcinfo, 0);
+ 
+-	configdata = get_configdata(my_exec_path, &configdata_len);
+-	for (i = 0; i < configdata_len; i++)
+-	{
+-		Datum		values[2];
+-		bool		nulls[2];
+-
+-		memset(values, 0, sizeof(values));
+-		memset(nulls, 0, sizeof(nulls));
+-
+-		values[0] = CStringGetTextDatum(configdata[i].name);
+-		values[1] = CStringGetTextDatum(configdata[i].setting);
+-
+-		tuplestore_putvalues(rsinfo->setResult, rsinfo->setDesc, values, nulls);
+-	}
+-
+ 	return (Datum) 0;
+ }
+--- a/src/test/regress/expected/sysviews.out
++++ b/src/test/regress/expected/sysviews.out
+@@ -29,7 +29,7 @@ select name, ident, parent, level, total_bytes >= free_bytes
+ (1 row)
+ 
+ -- At introduction, pg_config had 23 entries; it may grow
+-select count(*) > 20 as ok from pg_config;
++select count(*) = 0 as ok from pg_config;
+  ok 
+ ----
+  t
+--- a/src/test/regress/sql/sysviews.sql
++++ b/src/test/regress/sql/sysviews.sql
+@@ -18,7 +18,7 @@ select name, ident, parent, level, total_bytes >= free_bytes
+   from pg_backend_memory_contexts where level = 0;
+ 
+ -- At introduction, pg_config had 23 entries; it may grow
+-select count(*) > 20 as ok from pg_config;
++select count(*) = 0 as ok from pg_config;
+ 
+ -- We expect no cursors in this test; see also portals.sql
+ select count(*) = 0 as ok from pg_cursors;
diff --git a/pkgs/servers/sql/postgresql/patches/empty-pg-config-view.patch b/pkgs/servers/sql/postgresql/patches/empty-pg-config-view.patch
new file mode 100644
index 000000000000..98e4b8151431
--- /dev/null
+++ b/pkgs/servers/sql/postgresql/patches/empty-pg-config-view.patch
@@ -0,0 +1,50 @@
+Empty the pg_config system information view. This view keeps references to
+several -dev outputs, which we want to avoid to keep closure size down.
+
+The alternative to this patch would be to nuke references across the board,
+but this will also affect the output of the pg_config utility. By emptying
+the view only, we keep the pg_config binary intact. It resides in the -dev
+output, so it's fine to have all those references there.
+
+---
+--- a/src/backend/utils/misc/pg_config.c
++++ b/src/backend/utils/misc/pg_config.c
+@@ -69,16 +69,6 @@ pg_config(PG_FUNCTION_ARGS)
+ 	/* initialize our tuplestore */
+ 	tupstore = tuplestore_begin_heap(true, false, work_mem);
+ 
+-	configdata = get_configdata(my_exec_path, &configdata_len);
+-	for (i = 0; i < configdata_len; i++)
+-	{
+-		values[0] = configdata[i].name;
+-		values[1] = configdata[i].setting;
+-
+-		tuple = BuildTupleFromCStrings(attinmeta, values);
+-		tuplestore_puttuple(tupstore, tuple);
+-	}
+-
+ 	/*
+ 	 * no longer need the tuple descriptor reference created by
+ 	 * TupleDescGetAttInMetadata()
+--- a/src/test/regress/expected/sysviews.out
++++ b/src/test/regress/expected/sysviews.out
+@@ -20,7 +20,7 @@ select count(*) >= 0 as ok from pg_available_extensions;
+ (1 row)
+ 
+ -- At introduction, pg_config had 23 entries; it may grow
+-select count(*) > 20 as ok from pg_config;
++select count(*) = 0 as ok from pg_config;
+  ok 
+ ----
+  t
+--- a/src/test/regress/sql/sysviews.sql
++++ b/src/test/regress/sql/sysviews.sql
+@@ -13,7 +13,7 @@ select count(*) >= 0 as ok from pg_available_extension_versions;
+ select count(*) >= 0 as ok from pg_available_extensions;
+ 
+ -- At introduction, pg_config had 23 entries; it may grow
+-select count(*) > 20 as ok from pg_config;
++select count(*) = 0 as ok from pg_config;
+ 
+ -- We expect no cursors in this test; see also portals.sql
+ select count(*) = 0 as ok from pg_cursors;
diff --git a/pkgs/servers/sql/postgresql/patches/paths-for-split-outputs.patch b/pkgs/servers/sql/postgresql/patches/paths-for-split-outputs.patch
index fca7aa10fc83..46164bba2555 100644
--- a/pkgs/servers/sql/postgresql/patches/paths-for-split-outputs.patch
+++ b/pkgs/servers/sql/postgresql/patches/paths-for-split-outputs.patch
@@ -4,7 +4,7 @@
  	i++;
 
  	configdata[i].name = pstrdup("PGXS");
-+	strlcpy(path, "@out@/lib", sizeof(path));
++	strlcpy(path, "@dev@/lib", sizeof(path));
 -	get_pkglib_path(my_exec_path, path);
  	strlcat(path, "/pgxs/src/makefiles/pgxs.mk", sizeof(path));
  	cleanup_path(path);

From 94d432ce88b6dff272a17b4ed15dbefca14097fc Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Fri, 8 Mar 2024 09:52:58 +0100
Subject: [PATCH 033/115] postgresql: remove references to llvm-dev on darwin
 as well

The !isDarwin condition seems to have been put in place only because of the
use of patchelf, which in turn seemed to be necessary because of nuke-refs.

Replacing the big nuke with the more granular remove-references-to allows
enabling this for darwin, too.
---
 pkgs/servers/sql/postgresql/generic.nix | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index 0ba6a7085ecb..fcd8e335aac5 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -24,7 +24,7 @@ let
 
       # JIT
       , jitSupport
-      , nukeReferences, patchelf, llvmPackages, overrideCC
+      , nukeReferences, llvmPackages, overrideCC
 
       # PL/Python
       , pythonSupport ? false
@@ -40,6 +40,8 @@ let
     lz4Enabled = atLeast "14";
     zstdEnabled = atLeast "15";
 
+    dlSuffix = if olderThan "16" then ".so" else stdenv.hostPlatform.extensions.sharedLibrary;
+
     systemdSupport' = if enableSystemd == null then systemdSupport else (lib.warn "postgresql: argument enableSystemd is deprecated, please use systemdSupport instead." enableSystemd);
 
     pname = "postgresql";
@@ -109,7 +111,7 @@ let
       pkg-config
       removeReferencesTo
     ]
-      ++ lib.optionals jitSupport [ llvmPackages.llvm.dev nukeReferences patchelf ];
+      ++ lib.optionals jitSupport [ llvmPackages.llvm.dev nukeReferences ];
 
     enableParallelBuilding = true;
 
@@ -218,13 +220,8 @@ let
         # In the case of JIT support, prevent a retained dependency on clang-wrapper
         nuke-refs $out/lib/llvmjit_types.bc $(find $out/lib/bitcode -type f)
 
-        ${lib.optionalString (!stdenv'.isDarwin) ''
-          # Stop lib depending on the -dev output of llvm
-          rpath=$(patchelf --print-rpath $out/lib/llvmjit.so)
-          nuke-refs -e $out $out/lib/llvmjit.so
-          # Restore the correct rpath
-          patchelf $out/lib/llvmjit.so --set-rpath "$rpath"
-        ''}
+        # Stop lib depending on the -dev output of llvm
+        remove-references-to -t ${llvmPackages.llvm.dev} "$out/lib/llvmjit${dlSuffix}"
       '';
 
     postFixup = lib.optionalString (!stdenv'.isDarwin && stdenv'.hostPlatform.libc == "glibc")
@@ -244,13 +241,13 @@ let
       };
     in
     {
+      inherit dlSuffix;
+
       psqlSchema = lib.versions.major version;
 
       withJIT = if jitSupport then this else jitToggle;
       withoutJIT = if jitSupport then jitToggle else this;
 
-      dlSuffix = if olderThan "16" then ".so" else stdenv.hostPlatform.extensions.sharedLibrary;
-
       pkgs = let
         scope = {
           inherit jitSupport;

From dfde86f73857f575ae79785c1da9496599b38b2c Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Tue, 30 Jul 2024 20:36:59 +0200
Subject: [PATCH 034/115] postgresql: refactor removal of references in bitcode
 files

This prevents silently ignoring errors from "find".
---
 pkgs/servers/sql/postgresql/generic.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index fcd8e335aac5..4d9b1ac95ee1 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -217,8 +217,8 @@ let
         # Those are only used when building e.g. extensions, so go to $dev.
         moveToOutput "lib/*.a" "$dev"
       '' + lib.optionalString jitSupport ''
-        # In the case of JIT support, prevent a retained dependency on clang-wrapper
-        nuke-refs $out/lib/llvmjit_types.bc $(find $out/lib/bitcode -type f)
+        # In the case of JIT support, prevent useless dependencies on header files
+        find "$out/lib" -iname '*.bc' -type f -exec nuke-refs '{}' +
 
         # Stop lib depending on the -dev output of llvm
         remove-references-to -t ${llvmPackages.llvm.dev} "$out/lib/llvmjit${dlSuffix}"

From 73cb40366df17b3224970ae80e64527687bd5023 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sat, 1 Jun 2024 17:32:35 +0200
Subject: [PATCH 035/115] postgresql: refactor to simplify condition

glibc is not available on darwin anyway and isGnu is just shorter.
---
 pkgs/servers/sql/postgresql/generic.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index 4d9b1ac95ee1..bd9199c93026 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -224,7 +224,7 @@ let
         remove-references-to -t ${llvmPackages.llvm.dev} "$out/lib/llvmjit${dlSuffix}"
       '';
 
-    postFixup = lib.optionalString (!stdenv'.isDarwin && stdenv'.hostPlatform.libc == "glibc")
+    postFixup = lib.optionalString stdenv'.hostPlatform.isGnu
       ''
         # initdb needs access to "locale" command from glibc.
         wrapProgram $out/bin/initdb --prefix PATH ":" ${glibc.bin}/bin

From 19770f0097f4436c2b3147ad0f489ce08e84463a Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 23 Aug 2024 21:41:14 +0100
Subject: [PATCH 036/115] maturin: 1.7.0 -> 1.7.1

Changes: https://github.com/PyO3/maturin/releases/tag/v1.7.1
---
 pkgs/by-name/ma/maturin/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/maturin/package.nix b/pkgs/by-name/ma/maturin/package.nix
index d075c1882bb9..91ed83ea9715 100644
--- a/pkgs/by-name/ma/maturin/package.nix
+++ b/pkgs/by-name/ma/maturin/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-SjINeNtCbyMp3U+Op7ey+8lV7FYxLVpmO5g1a01ouBs=";
+    hash = "sha256-kFhY2ixZZrSA/YxLCQDLPjLqNWQI3zl5V1MLTPqQH60=";
   };
 
-  cargoHash = "sha256-xJafCgpCeihyORj3gIVUus74vu9h3N1xuyKvkxSqYK4=";
+  cargoHash = "sha256-ik6kFS66umiHf0M1fE+6++zpZF4gJrN9LQ2l+vi9SSY=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security

From ee075da75169ba8067d161dd31e180060fa82cb8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <mail@dotlambda.de>
Date: Wed, 14 Aug 2024 08:24:29 -0700
Subject: [PATCH 037/115] python312Packages.pybind11: 2.13.1 -> 2.13.5

Diff: https://github.com/pybind/pybind11/compare/v2.13.1...v2.13.5

Changelog: https://github.com/pybind/pybind11/blob/v2.13.5/docs/changelog.rst
---
 pkgs/development/python-modules/pybind11/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index 9ca1e3769566..6dab8d700d1e 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -50,14 +50,14 @@ let
 in
 buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.13.1";
+  version = "2.13.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = "pybind11";
     rev = "v${version}";
-    hash = "sha256-sQUq39CmgsDEMfluKMrrnC5fio//pgExcyqJAE00UjU=";
+    hash = "sha256-cpxhrTFihA+gWmX62a+EQF3lccUyvu+d1MU2IC/CN6Q=";
   };
 
   build-system = [

From 6e725d468c2bf2efcd732e2c1880bc32c4c3ee8c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sat, 24 Aug 2024 00:39:58 +0200
Subject: [PATCH 038/115] libpsl: don't make first output conditional if build
 statically

This can cause surprises if no output is chosen.
---
 pkgs/development/libraries/libpsl/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/libpsl/default.nix b/pkgs/development/libraries/libpsl/default.nix
index f1b2fbbab4fb..1659a55cb4ef 100644
--- a/pkgs/development/libraries/libpsl/default.nix
+++ b/pkgs/development/libraries/libpsl/default.nix
@@ -23,8 +23,9 @@ stdenv.mkDerivation rec {
     hash = "sha256-mp9qjG7bplDPnqVUdc0XLdKEhzFoBOnHMgLZdXLNOi0=";
   };
 
-  # bin/psl-make-dafsa brings a large runtime closure through python3
-  outputs = lib.optional (!stdenv.hostPlatform.isStatic) "bin" ++ [ "out" "dev" ];
+  outputs = [ "out" "dev" ]
+    # bin/psl-make-dafsa brings a large runtime closure through python3
+    ++ lib.optional (!stdenv.hostPlatform.isStatic) "bin";
 
   nativeBuildInputs = [
     autoreconfHook
@@ -77,7 +78,7 @@ stdenv.mkDerivation rec {
       the domain in a user interface or sorting domain lists by site.
     '';
     homepage = "https://rockdaboot.github.io/libpsl/";
-    changelog = "https://raw.githubusercontent.com/rockdaboot/${pname}/${pname}-${version}/NEWS";
+    changelog = "https://raw.githubusercontent.com/rockdaboot/libpsl/libpsl-${version}/NEWS";
     license = licenses.mit;
     maintainers = [ maintainers.c0bw3b ];
     mainProgram = "psl";

From 17c9dc89607b35948c2aa611ef5b638e543c6d5e Mon Sep 17 00:00:00 2001
From: hexacera <qyao@google.com>
Date: Thu, 22 Aug 2024 23:27:30 +0800
Subject: [PATCH 039/115] svt-av1: 2.1.2 -> 2.2.0

Release notes: https://gitlab.com/AOMediaCodec/SVT-AV1/-/tags/v2.2.0
---
 pkgs/tools/video/svt-av1/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/video/svt-av1/default.nix b/pkgs/tools/video/svt-av1/default.nix
index 4ffa2892195c..e9d2c4b571fe 100644
--- a/pkgs/tools/video/svt-av1/default.nix
+++ b/pkgs/tools/video/svt-av1/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "svt-av1";
-  version = "2.1.2";
+  version = "2.2.0";
 
   src = fetchFromGitLab {
     owner = "AOMediaCodec";
     repo = "SVT-AV1";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jrfnUcDTbrf3wWs0D57ueeLmndhpOQChM7gBB14MzcQ=";
+    hash = "sha256-LkTcy+CiuhlRnQsjNMA0hTVRVx7pbYs1ujMWjLrhvEU=";
   };
 
   nativeBuildInputs = [

From 1efcffa700a0650bfab2beb40b6e538d2bfb4bfc Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Fri, 23 Aug 2024 21:34:11 +0200
Subject: [PATCH 040/115] stdenv: support default values in concatTo

The previously used pattern was introduced in #318614, but technically
leaked the default flags into the global scope. While this would
probably not make much of a practical difference, making concatTo
support default values is a much cleaner approach.
---
 pkgs/build-support/setup-hooks/autoreconf.sh |  7 +++--
 pkgs/by-name/ni/ninja/setup-hook.sh          |  3 +--
 pkgs/stdenv/generic/setup.sh                 | 27 ++++++++++----------
 pkgs/test/stdenv/default.nix                 | 13 ++++++++--
 4 files changed, 30 insertions(+), 20 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/autoreconf.sh b/pkgs/build-support/setup-hooks/autoreconf.sh
index 763ea649c1c4..bb168aad4c51 100644
--- a/pkgs/build-support/setup-hooks/autoreconf.sh
+++ b/pkgs/build-support/setup-hooks/autoreconf.sh
@@ -4,8 +4,11 @@ autoreconfPhase() {
     runHook preAutoreconf
 
     local flagsArray=()
-    : "${autoreconfFlags:=--install --force --verbose}"
-    concatTo flagsArray autoreconfFlags
+    if [[ -v autoreconfFlags ]]; then
+        concatTo flagsArray autoreconfFlags
+    else
+        flagsArray+=(--install --force --verbose)
+    fi
 
     autoreconf "${flagsArray[@]}"
     runHook postAutoreconf
diff --git a/pkgs/by-name/ni/ninja/setup-hook.sh b/pkgs/by-name/ni/ninja/setup-hook.sh
index 4f3bc5b5acfa..4573aceea3c6 100644
--- a/pkgs/by-name/ni/ninja/setup-hook.sh
+++ b/pkgs/by-name/ni/ninja/setup-hook.sh
@@ -65,8 +65,7 @@ ninjaInstallPhase() {
     local flagsArray=(
         "-j$buildCores"
     )
-    : "${installTargets:=install}"
-    concatTo flagsArray ninjaFlags ninjaFlagsArray installTargets
+    concatTo flagsArray ninjaFlags ninjaFlagsArray installTargets=install
 
     echoCmd 'install flags' "${flagsArray[@]}"
     TERM=dumb ninja "${flagsArray[@]}"
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 1b4f7a89d358..3c197171e801 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -387,12 +387,16 @@ appendToVar() {
 # Accumulate flags from the named variables $2+ into the indexed array $1.
 #
 # Arrays are simply concatenated, strings are split on whitespace.
+# Default values can be passed via name=default.
 concatTo() {
     local -n targetref="$1"; shift
-    local name type
-    for name in "$@"; do
-        if type=$(declare -p "$name" 2> /dev/null); then
-            local -n nameref="$name"
+    local arg default name type
+    for arg in "$@"; do
+        IFS="=" read -r name default <<< "$arg"
+        local -n nameref="$name"
+        if [[ ! -n "${nameref[@]}" && -n "$default" ]]; then
+            targetref+=( "$default" )
+        elif type=$(declare -p "$name" 2> /dev/null); then
             case "${type#* }" in
                 -A*)
                     echo "concatTo(): ERROR: trying to use concatTo on an associative array." >&2
@@ -1340,8 +1344,7 @@ patchPhase() {
         esac
 
         local -a flagsArray
-        : "${patchFlags:=-p1}"
-        concatTo flagsArray patchFlags
+        concatTo flagsArray patchFlags=-p1
         # "2>&1" is a hack to make patch fail if the decompressor fails (nonexistent patch, etc.)
         # shellcheck disable=SC2086
         $uncompress < "$i" 2>&1 | patch "${flagsArray[@]}"
@@ -1493,8 +1496,7 @@ checkPhase() {
             SHELL="$SHELL"
         )
 
-        : "${checkFlags:=VERBOSE=y}"
-        concatTo flagsArray makeFlags makeFlagsArray checkFlags checkFlagsArray checkTarget
+        concatTo flagsArray makeFlags makeFlagsArray checkFlags=VERBOSE=y checkFlagsArray checkTarget
 
         echoCmd 'check flags' "${flagsArray[@]}"
         make ${makefile:+-f $makefile} "${flagsArray[@]}"
@@ -1528,8 +1530,7 @@ installPhase() {
         SHELL="$SHELL"
     )
 
-    : "${installTargets:=install}"
-    concatTo flagsArray makeFlags makeFlagsArray installFlags installFlagsArray installTargets
+    concatTo flagsArray makeFlags makeFlagsArray installFlags installFlagsArray installTargets=install
 
     echoCmd 'install flags' "${flagsArray[@]}"
     make ${makefile:+-f $makefile} "${flagsArray[@]}"
@@ -1612,9 +1613,8 @@ installCheckPhase() {
             SHELL="$SHELL"
         )
 
-        : "${installCheckTarget:=installcheck}"
         concatTo flagsArray makeFlags makeFlagsArray \
-          installCheckFlags installCheckFlagsArray installCheckTarget
+          installCheckFlags installCheckFlagsArray installCheckTarget=installcheck
 
         echoCmd 'installcheck flags' "${flagsArray[@]}"
         make ${makefile:+-f $makefile} "${flagsArray[@]}"
@@ -1629,8 +1629,7 @@ distPhase() {
     runHook preDist
 
     local flagsArray=()
-    : "${distTarget:=dist}"
-    concatTo flagsArray distFlags distFlagsArray distTarget
+    concatTo flagsArray distFlags distFlagsArray distTarget=dist
 
     echo 'dist flags: %q' "${flagsArray[@]}"
     make ${makefile:+-f $makefile} "${flagsArray[@]}"
diff --git a/pkgs/test/stdenv/default.nix b/pkgs/test/stdenv/default.nix
index a5b571b5a9f4..6ed430f5da3f 100644
--- a/pkgs/test/stdenv/default.nix
+++ b/pkgs/test/stdenv/default.nix
@@ -109,21 +109,30 @@ let
           declare -A associativeArray=(["X"]="Y")
           [[ $(concatTo nowhere associativeArray 2>&1) =~ "trying to use" ]] || (echo "concatTo did not throw concatenating associativeArray" && false)
 
+          empty_array=()
+          empty_string=""
+
           declare -a flagsArray
-          concatTo flagsArray string list
+          concatTo flagsArray string list notset=e=f empty_array=g empty_string=h
           declare -p flagsArray
           [[ "''${flagsArray[0]}" == "a" ]] || (echo "'\$flagsArray[0]' was not 'a'" && false)
           [[ "''${flagsArray[1]}" == "b" ]] || (echo "'\$flagsArray[1]' was not 'b'" && false)
           [[ "''${flagsArray[2]}" == "c" ]] || (echo "'\$flagsArray[2]' was not 'c'" && false)
           [[ "''${flagsArray[3]}" == "d" ]] || (echo "'\$flagsArray[3]' was not 'd'" && false)
+          [[ "''${flagsArray[4]}" == "e=f" ]] || (echo "'\$flagsArray[4]' was not 'e=f'" && false)
+          [[ "''${flagsArray[5]}" == "g" ]] || (echo "'\$flagsArray[5]' was not 'g'" && false)
+          [[ "''${flagsArray[6]}" == "h" ]] || (echo "'\$flagsArray[6]' was not 'h'" && false)
 
           # test concatenating to unset variable
-          concatTo nonExistant string list
+          concatTo nonExistant string list notset=e=f empty_array=g empty_string=h
           declare -p nonExistant
           [[ "''${nonExistant[0]}" == "a" ]] || (echo "'\$nonExistant[0]' was not 'a'" && false)
           [[ "''${nonExistant[1]}" == "b" ]] || (echo "'\$nonExistant[1]' was not 'b'" && false)
           [[ "''${nonExistant[2]}" == "c" ]] || (echo "'\$nonExistant[2]' was not 'c'" && false)
           [[ "''${nonExistant[3]}" == "d" ]] || (echo "'\$nonExistant[3]' was not 'd'" && false)
+          [[ "''${nonExistant[4]}" == "e=f" ]] || (echo "'\$nonExistant[4]' was not 'e=f'" && false)
+          [[ "''${nonExistant[5]}" == "g" ]] || (echo "'\$nonExistant[5]' was not 'g'" && false)
+          [[ "''${nonExistant[6]}" == "h" ]] || (echo "'\$nonExistant[6]' was not 'h'" && false)
 
           eval "$extraTest"
 

From f96e20895fbbde870aec134d04352b55f6344865 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 9 Jun 2024 16:22:35 +0200
Subject: [PATCH 041/115] bmake: support structuredAttrs in setup hook

Tested libfsm with and without __structuredAttrs.
---
 pkgs/by-name/bm/bmake/setup-hook.sh | 19 +++++--------------
 1 file changed, 5 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/bm/bmake/setup-hook.sh b/pkgs/by-name/bm/bmake/setup-hook.sh
index a36d024b111e..d6a7c4aafa0f 100644
--- a/pkgs/by-name/bm/bmake/setup-hook.sh
+++ b/pkgs/by-name/bm/bmake/setup-hook.sh
@@ -14,9 +14,8 @@ bmakeBuildPhase() {
     local flagsArray=(
         ${enableParallelBuilding:+-j${NIX_BUILD_CORES}}
         SHELL="$SHELL"
-        $makeFlags ${makeFlagsArray+"${makeFlagsArray[@]}"}
-        $buildFlags ${buildFlagsArray+"${buildFlagsArray[@]}"}
     )
+    concatTo flagsArray makeFlags makeFlagsArray buildFlags buildFlagsArray
 
     echoCmd 'build flags' "${flagsArray[@]}"
     bmake ${makefile:+-f $makefile} "${flagsArray[@]}"
@@ -42,11 +41,8 @@ bmakeCheckPhase() {
         local flagsArray=(
             ${enableParallelChecking:+-j${NIX_BUILD_CORES}}
             SHELL="$SHELL"
-            # Old bash empty array hack
-            $makeFlags ${makeFlagsArray+"${makeFlagsArray[@]}"}
-            ${checkFlags:-VERBOSE=y} ${checkFlagsArray+"${checkFlagsArray[@]}"}
-            ${checkTarget}
         )
+        concatTo flagsArray makeFlags makeFlagsArray checkFlags=VERBOSE=y checkFlagsArray checkTarget
 
         echoCmd 'check flags' "${flagsArray[@]}"
         bmake ${makefile:+-f $makefile} "${flagsArray[@]}"
@@ -65,11 +61,8 @@ bmakeInstallPhase() {
     local flagsArray=(
         ${enableParallelInstalling:+-j${NIX_BUILD_CORES}}
         SHELL="$SHELL"
-        # Old bash empty array hack
-        $makeFlags ${makeFlagsArray+"${makeFlagsArray[@]}"}
-        $installFlags ${installFlagsArray+"${installFlagsArray[@]}"}
-        ${installTargets:-install}
     )
+    concatTo flagsArray makeFlags makeFlagsArray installFlags installFlagsArray installTargets=install
 
     echoCmd 'install flags' "${flagsArray[@]}"
     bmake ${makefile:+-f $makefile} "${flagsArray[@]}"
@@ -84,10 +77,8 @@ bmakeDistPhase() {
         mkdir -p "$prefix"
     fi
 
-    # Old bash empty array hack
-    local flagsArray=(
-        $distFlags ${distFlagsArray+"${distFlagsArray[@]}"} ${distTarget:-dist}
-    )
+    local flagsArray=()
+    concatTo flagsArray distFlags distFlagsArray distTarget=dist
 
     echo 'dist flags: %q' "${flagsArray[@]}"
     bmake ${makefile:+-f $makefile} "${flagsArray[@]}"

From c3900d12c9805df2ad26b24c0475de4f951f25d2 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 9 Jun 2024 16:24:40 +0200
Subject: [PATCH 042/115] just: support structuredAttrs in setup hook

Tested cosmic-applibrary with and without __structuredAttrs.
---
 pkgs/by-name/ju/just/setup-hook.sh | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/ju/just/setup-hook.sh b/pkgs/by-name/ju/just/setup-hook.sh
index 0ffcfc187ebf..4f260714483f 100644
--- a/pkgs/by-name/ju/just/setup-hook.sh
+++ b/pkgs/by-name/ju/just/setup-hook.sh
@@ -1,7 +1,8 @@
 justBuildPhase() {
     runHook preBuild
 
-    local flagsArray=($justFlags "${justFlagsArray[@]}")
+    local flagsArray=()
+    concatTo flagsArray justFlags justFlagsArray
 
     echoCmd 'build flags' "${flagsArray[@]}"
     just "${flagsArray[@]}"
@@ -21,10 +22,8 @@ justCheckPhase() {
     if [ -z "${checkTarget:-}" ]; then
         echo "no test target found in just, doing nothing"
     else
-        local flagsArray=(
-            $justFlags "${justFlagsArray[@]}"
-            $checkTarget
-        )
+        local flagsArray=()
+        concatTo flagsArray justFlags justFlagsArray checkTarget
 
         echoCmd 'check flags' "${flagsArray[@]}"
         just "${flagsArray[@]}"
@@ -36,8 +35,8 @@ justCheckPhase() {
 justInstallPhase() {
     runHook preInstall
 
-    # shellcheck disable=SC2086
-    local flagsArray=($justFlags "${justFlagsArray[@]}" ${installTargets:-install})
+    local flagsArray=()
+    concatTo flagsArray justFlags justFlagsArray installTargets=install
 
     echoCmd 'install flags' "${flagsArray[@]}"
     just "${flagsArray[@]}"

From 8affc6a06fc1a21c8dd6007b24e35a1cdff23e56 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 9 Jun 2024 20:46:31 +0200
Subject: [PATCH 043/115] just: shellcheck setup hook

---
 pkgs/by-name/ju/just/setup-hook.sh | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ju/just/setup-hook.sh b/pkgs/by-name/ju/just/setup-hook.sh
index 4f260714483f..d171ac7610bb 100644
--- a/pkgs/by-name/ju/just/setup-hook.sh
+++ b/pkgs/by-name/ju/just/setup-hook.sh
@@ -1,3 +1,5 @@
+# shellcheck shell=bash
+
 justBuildPhase() {
     runHook preBuild
 
@@ -15,7 +17,7 @@ justCheckPhase() {
 
     if [ -z "${checkTarget:-}" ]; then
         if just -n test >/dev/null 2>&1; then
-            checkTarget=test
+            checkTarget="test"
         fi
     fi
 
@@ -44,14 +46,14 @@ justInstallPhase() {
     runHook postInstall
 }
 
-if [ -z "${dontUseJustBuild-}" -a -z "${buildPhase-}" ]; then
+if [ -z "${dontUseJustBuild-}" ] && [ -z "${buildPhase-}" ]; then
     buildPhase=justBuildPhase
 fi
 
-if [ -z "${dontUseJustCheck-}" -a -z "${checkPhase-}" ]; then
+if [ -z "${dontUseJustCheck-}" ] && [ -z "${checkPhase-}" ]; then
     checkPhase=justCheckPhase
 fi
 
-if [ -z "${dontUseJustInstall-}" -a -z "${installPhase-}" ]; then
+if [ -z "${dontUseJustInstall-}" ] && [ -z "${installPhase-}" ]; then
     installPhase=justInstallPhase
 fi

From add9bca495a7f0679156e8b8869f96b433778a28 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 9 Jun 2024 16:15:49 +0200
Subject: [PATCH 044/115] waf: support structuredAttrs in setup hook

Tested samba4 with and without __structuredAttrs.
---
 pkgs/by-name/wa/waf/setup-hook.sh | 26 ++++++--------------------
 1 file changed, 6 insertions(+), 20 deletions(-)

diff --git a/pkgs/by-name/wa/waf/setup-hook.sh b/pkgs/by-name/wa/waf/setup-hook.sh
index a154ae378a07..692341fb5a04 100644
--- a/pkgs/by-name/wa/waf/setup-hook.sh
+++ b/pkgs/by-name/wa/waf/setup-hook.sh
@@ -16,11 +16,8 @@ wafConfigurePhase() {
       export PKGCONFIG="${PKG_CONFIG}"
     fi
 
-    local flagsArray=(
-        $prefixFlag
-        $wafConfigureFlags "${wafConfigureFlagsArray[@]}"
-        ${wafConfigureTargets:-configure}
-    )
+    local flagsArray=( $prefixFlag )
+    concatTo flagsArray wafConfigureFlags wafConfigureFlagsArray wafConfigureTargets=configure
 
     echoCmd 'waf configure flags' "${flagsArray[@]}"
     python "$wafPath" "${flagsArray[@]}"
@@ -41,15 +38,8 @@ wafConfigurePhase() {
 wafBuildPhase () {
     runHook preBuild
 
-    # set to empty if unset
-    : "${wafFlags=}"
-
-    local flagsArray=(
-      ${enableParallelBuilding:+-j ${NIX_BUILD_CORES}}
-      $wafFlags ${wafFlagsArray[@]}
-      $wafBuildFlags ${wafBuildFlagsArray[@]}
-      ${wafBuildTargets:-build}
-    )
+    local flagsArray=( ${enableParallelBuilding:+-j ${NIX_BUILD_CORES}} )
+    concatTo flagsArray wafFlags wafFlagsArray wafBuildFlags wafBuildFlagsArray wafBuildTargets=build
 
     echoCmd 'waf build flags' "${flagsArray[@]}"
     python "$wafPath" "${flagsArray[@]}"
@@ -64,12 +54,8 @@ wafInstallPhase() {
         mkdir -p "$prefix"
     fi
 
-    local flagsArray=(
-        ${enableParallelInstalling:+-j ${NIX_BUILD_CORES}}
-        $wafFlags ${wafFlagsArray[@]}
-        $wafInstallFlags ${wafInstallFlagsArray[@]}
-        ${wafInstallTargets:-install}
-    )
+    local flagsArray=( ${enableParallelInstalling:+-j ${NIX_BUILD_CORES}} )
+    concatTo flagsArray wafFlags wafFlagsArray wafInstallFlags wafInstallFlagsArray wafInstallTargets=install
 
     echoCmd 'waf install flags' "${flagsArray[@]}"
     python "$wafPath" "${flagsArray[@]}"

From 55640420313c92c988c543ae3022009f9bfb20d7 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 9 Jun 2024 18:49:39 +0200
Subject: [PATCH 045/115] zig: support structuredAttrs in setup hook

Tested waylock with and without __structuredAttrs.
---
 .../compilers/zig/0.10/setup-hook.sh          | 24 +++++++++----------
 .../compilers/zig/0.11/setup-hook.sh          | 24 +++++++++----------
 .../compilers/zig/0.12/setup-hook.sh          | 24 +++++++++----------
 .../compilers/zig/0.13/setup-hook.sh          | 24 +++++++++----------
 .../compilers/zig/0.9/setup-hook.sh           | 24 +++++++++----------
 pkgs/development/compilers/zig/setup-hook.sh  | 24 +++++++++----------
 6 files changed, 66 insertions(+), 78 deletions(-)

diff --git a/pkgs/development/compilers/zig/0.10/setup-hook.sh b/pkgs/development/compilers/zig/0.10/setup-hook.sh
index 689ebec8a307..f9df7e6b558a 100644
--- a/pkgs/development/compilers/zig/0.10/setup-hook.sh
+++ b/pkgs/development/compilers/zig/0.10/setup-hook.sh
@@ -1,5 +1,6 @@
 # shellcheck shell=bash disable=SC2154,SC2086
 
+# shellcheck disable=SC2034
 readonly zigDefaultFlagsArray=(@zig_default_flags@)
 
 function zigSetGlobalCacheDir {
@@ -10,10 +11,9 @@ function zigSetGlobalCacheDir {
 function zigBuildPhase {
     runHook preBuild
 
-    local flagsArray=(
-        "${zigDefaultFlagsArray[@]}"
-        $zigBuildFlags "${zigBuildFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray zigDefaultFlagsArray \
+        zigBuildFlags zigBuildFlagsArray
 
     echoCmd 'zig build flags' "${flagsArray[@]}"
     zig build "${flagsArray[@]}"
@@ -24,10 +24,9 @@ function zigBuildPhase {
 function zigCheckPhase {
     runHook preCheck
 
-    local flagsArray=(
-        "${zigDefaultFlagsArray[@]}"
-        $zigCheckFlags "${zigCheckFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray zigDefaultFlagsArray \
+        zigCheckFlags zigCheckFlagsArray
 
     echoCmd 'zig check flags' "${flagsArray[@]}"
     zig build test "${flagsArray[@]}"
@@ -38,11 +37,10 @@ function zigCheckPhase {
 function zigInstallPhase {
     runHook preInstall
 
-    local flagsArray=(
-        "${zigDefaultFlagsArray[@]}"
-        $zigBuildFlags "${zigBuildFlagsArray[@]}"
-        $zigInstallFlags "${zigInstallFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray zigDefaultFlagsArray \
+        zigBuildFlags zigBuildFlagsArray \
+        zigInstallFlags zigInstallFlagsArray
 
     if [ -z "${dontAddPrefix-}" ]; then
         # Zig does not recognize `--prefix=/dir/`, only `--prefix /dir/`
diff --git a/pkgs/development/compilers/zig/0.11/setup-hook.sh b/pkgs/development/compilers/zig/0.11/setup-hook.sh
index 689ebec8a307..f9df7e6b558a 100644
--- a/pkgs/development/compilers/zig/0.11/setup-hook.sh
+++ b/pkgs/development/compilers/zig/0.11/setup-hook.sh
@@ -1,5 +1,6 @@
 # shellcheck shell=bash disable=SC2154,SC2086
 
+# shellcheck disable=SC2034
 readonly zigDefaultFlagsArray=(@zig_default_flags@)
 
 function zigSetGlobalCacheDir {
@@ -10,10 +11,9 @@ function zigSetGlobalCacheDir {
 function zigBuildPhase {
     runHook preBuild
 
-    local flagsArray=(
-        "${zigDefaultFlagsArray[@]}"
-        $zigBuildFlags "${zigBuildFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray zigDefaultFlagsArray \
+        zigBuildFlags zigBuildFlagsArray
 
     echoCmd 'zig build flags' "${flagsArray[@]}"
     zig build "${flagsArray[@]}"
@@ -24,10 +24,9 @@ function zigBuildPhase {
 function zigCheckPhase {
     runHook preCheck
 
-    local flagsArray=(
-        "${zigDefaultFlagsArray[@]}"
-        $zigCheckFlags "${zigCheckFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray zigDefaultFlagsArray \
+        zigCheckFlags zigCheckFlagsArray
 
     echoCmd 'zig check flags' "${flagsArray[@]}"
     zig build test "${flagsArray[@]}"
@@ -38,11 +37,10 @@ function zigCheckPhase {
 function zigInstallPhase {
     runHook preInstall
 
-    local flagsArray=(
-        "${zigDefaultFlagsArray[@]}"
-        $zigBuildFlags "${zigBuildFlagsArray[@]}"
-        $zigInstallFlags "${zigInstallFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray zigDefaultFlagsArray \
+        zigBuildFlags zigBuildFlagsArray \
+        zigInstallFlags zigInstallFlagsArray
 
     if [ -z "${dontAddPrefix-}" ]; then
         # Zig does not recognize `--prefix=/dir/`, only `--prefix /dir/`
diff --git a/pkgs/development/compilers/zig/0.12/setup-hook.sh b/pkgs/development/compilers/zig/0.12/setup-hook.sh
index 689ebec8a307..f9df7e6b558a 100644
--- a/pkgs/development/compilers/zig/0.12/setup-hook.sh
+++ b/pkgs/development/compilers/zig/0.12/setup-hook.sh
@@ -1,5 +1,6 @@
 # shellcheck shell=bash disable=SC2154,SC2086
 
+# shellcheck disable=SC2034
 readonly zigDefaultFlagsArray=(@zig_default_flags@)
 
 function zigSetGlobalCacheDir {
@@ -10,10 +11,9 @@ function zigSetGlobalCacheDir {
 function zigBuildPhase {
     runHook preBuild
 
-    local flagsArray=(
-        "${zigDefaultFlagsArray[@]}"
-        $zigBuildFlags "${zigBuildFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray zigDefaultFlagsArray \
+        zigBuildFlags zigBuildFlagsArray
 
     echoCmd 'zig build flags' "${flagsArray[@]}"
     zig build "${flagsArray[@]}"
@@ -24,10 +24,9 @@ function zigBuildPhase {
 function zigCheckPhase {
     runHook preCheck
 
-    local flagsArray=(
-        "${zigDefaultFlagsArray[@]}"
-        $zigCheckFlags "${zigCheckFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray zigDefaultFlagsArray \
+        zigCheckFlags zigCheckFlagsArray
 
     echoCmd 'zig check flags' "${flagsArray[@]}"
     zig build test "${flagsArray[@]}"
@@ -38,11 +37,10 @@ function zigCheckPhase {
 function zigInstallPhase {
     runHook preInstall
 
-    local flagsArray=(
-        "${zigDefaultFlagsArray[@]}"
-        $zigBuildFlags "${zigBuildFlagsArray[@]}"
-        $zigInstallFlags "${zigInstallFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray zigDefaultFlagsArray \
+        zigBuildFlags zigBuildFlagsArray \
+        zigInstallFlags zigInstallFlagsArray
 
     if [ -z "${dontAddPrefix-}" ]; then
         # Zig does not recognize `--prefix=/dir/`, only `--prefix /dir/`
diff --git a/pkgs/development/compilers/zig/0.13/setup-hook.sh b/pkgs/development/compilers/zig/0.13/setup-hook.sh
index 689ebec8a307..f9df7e6b558a 100644
--- a/pkgs/development/compilers/zig/0.13/setup-hook.sh
+++ b/pkgs/development/compilers/zig/0.13/setup-hook.sh
@@ -1,5 +1,6 @@
 # shellcheck shell=bash disable=SC2154,SC2086
 
+# shellcheck disable=SC2034
 readonly zigDefaultFlagsArray=(@zig_default_flags@)
 
 function zigSetGlobalCacheDir {
@@ -10,10 +11,9 @@ function zigSetGlobalCacheDir {
 function zigBuildPhase {
     runHook preBuild
 
-    local flagsArray=(
-        "${zigDefaultFlagsArray[@]}"
-        $zigBuildFlags "${zigBuildFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray zigDefaultFlagsArray \
+        zigBuildFlags zigBuildFlagsArray
 
     echoCmd 'zig build flags' "${flagsArray[@]}"
     zig build "${flagsArray[@]}"
@@ -24,10 +24,9 @@ function zigBuildPhase {
 function zigCheckPhase {
     runHook preCheck
 
-    local flagsArray=(
-        "${zigDefaultFlagsArray[@]}"
-        $zigCheckFlags "${zigCheckFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray zigDefaultFlagsArray \
+        zigCheckFlags zigCheckFlagsArray
 
     echoCmd 'zig check flags' "${flagsArray[@]}"
     zig build test "${flagsArray[@]}"
@@ -38,11 +37,10 @@ function zigCheckPhase {
 function zigInstallPhase {
     runHook preInstall
 
-    local flagsArray=(
-        "${zigDefaultFlagsArray[@]}"
-        $zigBuildFlags "${zigBuildFlagsArray[@]}"
-        $zigInstallFlags "${zigInstallFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray zigDefaultFlagsArray \
+        zigBuildFlags zigBuildFlagsArray \
+        zigInstallFlags zigInstallFlagsArray
 
     if [ -z "${dontAddPrefix-}" ]; then
         # Zig does not recognize `--prefix=/dir/`, only `--prefix /dir/`
diff --git a/pkgs/development/compilers/zig/0.9/setup-hook.sh b/pkgs/development/compilers/zig/0.9/setup-hook.sh
index 689ebec8a307..f9df7e6b558a 100644
--- a/pkgs/development/compilers/zig/0.9/setup-hook.sh
+++ b/pkgs/development/compilers/zig/0.9/setup-hook.sh
@@ -1,5 +1,6 @@
 # shellcheck shell=bash disable=SC2154,SC2086
 
+# shellcheck disable=SC2034
 readonly zigDefaultFlagsArray=(@zig_default_flags@)
 
 function zigSetGlobalCacheDir {
@@ -10,10 +11,9 @@ function zigSetGlobalCacheDir {
 function zigBuildPhase {
     runHook preBuild
 
-    local flagsArray=(
-        "${zigDefaultFlagsArray[@]}"
-        $zigBuildFlags "${zigBuildFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray zigDefaultFlagsArray \
+        zigBuildFlags zigBuildFlagsArray
 
     echoCmd 'zig build flags' "${flagsArray[@]}"
     zig build "${flagsArray[@]}"
@@ -24,10 +24,9 @@ function zigBuildPhase {
 function zigCheckPhase {
     runHook preCheck
 
-    local flagsArray=(
-        "${zigDefaultFlagsArray[@]}"
-        $zigCheckFlags "${zigCheckFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray zigDefaultFlagsArray \
+        zigCheckFlags zigCheckFlagsArray
 
     echoCmd 'zig check flags' "${flagsArray[@]}"
     zig build test "${flagsArray[@]}"
@@ -38,11 +37,10 @@ function zigCheckPhase {
 function zigInstallPhase {
     runHook preInstall
 
-    local flagsArray=(
-        "${zigDefaultFlagsArray[@]}"
-        $zigBuildFlags "${zigBuildFlagsArray[@]}"
-        $zigInstallFlags "${zigInstallFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray zigDefaultFlagsArray \
+        zigBuildFlags zigBuildFlagsArray \
+        zigInstallFlags zigInstallFlagsArray
 
     if [ -z "${dontAddPrefix-}" ]; then
         # Zig does not recognize `--prefix=/dir/`, only `--prefix /dir/`
diff --git a/pkgs/development/compilers/zig/setup-hook.sh b/pkgs/development/compilers/zig/setup-hook.sh
index 689ebec8a307..f9df7e6b558a 100644
--- a/pkgs/development/compilers/zig/setup-hook.sh
+++ b/pkgs/development/compilers/zig/setup-hook.sh
@@ -1,5 +1,6 @@
 # shellcheck shell=bash disable=SC2154,SC2086
 
+# shellcheck disable=SC2034
 readonly zigDefaultFlagsArray=(@zig_default_flags@)
 
 function zigSetGlobalCacheDir {
@@ -10,10 +11,9 @@ function zigSetGlobalCacheDir {
 function zigBuildPhase {
     runHook preBuild
 
-    local flagsArray=(
-        "${zigDefaultFlagsArray[@]}"
-        $zigBuildFlags "${zigBuildFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray zigDefaultFlagsArray \
+        zigBuildFlags zigBuildFlagsArray
 
     echoCmd 'zig build flags' "${flagsArray[@]}"
     zig build "${flagsArray[@]}"
@@ -24,10 +24,9 @@ function zigBuildPhase {
 function zigCheckPhase {
     runHook preCheck
 
-    local flagsArray=(
-        "${zigDefaultFlagsArray[@]}"
-        $zigCheckFlags "${zigCheckFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray zigDefaultFlagsArray \
+        zigCheckFlags zigCheckFlagsArray
 
     echoCmd 'zig check flags' "${flagsArray[@]}"
     zig build test "${flagsArray[@]}"
@@ -38,11 +37,10 @@ function zigCheckPhase {
 function zigInstallPhase {
     runHook preInstall
 
-    local flagsArray=(
-        "${zigDefaultFlagsArray[@]}"
-        $zigBuildFlags "${zigBuildFlagsArray[@]}"
-        $zigInstallFlags "${zigInstallFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray zigDefaultFlagsArray \
+        zigBuildFlags zigBuildFlagsArray \
+        zigInstallFlags zigInstallFlagsArray
 
     if [ -z "${dontAddPrefix-}" ]; then
         # Zig does not recognize `--prefix=/dir/`, only `--prefix /dir/`

From e3191276d9e36fbffafa2c969b36c1569245510c Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Mon, 19 Aug 2024 09:42:05 +0200
Subject: [PATCH 046/115] zig: improve shellcheck disable comments

---
 pkgs/development/compilers/zig/0.10/setup-hook.sh | 3 ++-
 pkgs/development/compilers/zig/0.11/setup-hook.sh | 3 ++-
 pkgs/development/compilers/zig/0.12/setup-hook.sh | 3 ++-
 pkgs/development/compilers/zig/0.13/setup-hook.sh | 3 ++-
 pkgs/development/compilers/zig/0.9/setup-hook.sh  | 3 ++-
 pkgs/development/compilers/zig/setup-hook.sh      | 3 ++-
 6 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/compilers/zig/0.10/setup-hook.sh b/pkgs/development/compilers/zig/0.10/setup-hook.sh
index f9df7e6b558a..0053c5997da6 100644
--- a/pkgs/development/compilers/zig/0.10/setup-hook.sh
+++ b/pkgs/development/compilers/zig/0.10/setup-hook.sh
@@ -1,4 +1,4 @@
-# shellcheck shell=bash disable=SC2154,SC2086
+# shellcheck shell=bash
 
 # shellcheck disable=SC2034
 readonly zigDefaultFlagsArray=(@zig_default_flags@)
@@ -53,6 +53,7 @@ function zigInstallPhase {
     runHook postInstall
 }
 
+# shellcheck disable=SC2154
 addEnvHooks "$targetOffset" zigSetGlobalCacheDir
 
 if [ -z "${dontUseZigBuild-}" ] && [ -z "${buildPhase-}" ]; then
diff --git a/pkgs/development/compilers/zig/0.11/setup-hook.sh b/pkgs/development/compilers/zig/0.11/setup-hook.sh
index f9df7e6b558a..0053c5997da6 100644
--- a/pkgs/development/compilers/zig/0.11/setup-hook.sh
+++ b/pkgs/development/compilers/zig/0.11/setup-hook.sh
@@ -1,4 +1,4 @@
-# shellcheck shell=bash disable=SC2154,SC2086
+# shellcheck shell=bash
 
 # shellcheck disable=SC2034
 readonly zigDefaultFlagsArray=(@zig_default_flags@)
@@ -53,6 +53,7 @@ function zigInstallPhase {
     runHook postInstall
 }
 
+# shellcheck disable=SC2154
 addEnvHooks "$targetOffset" zigSetGlobalCacheDir
 
 if [ -z "${dontUseZigBuild-}" ] && [ -z "${buildPhase-}" ]; then
diff --git a/pkgs/development/compilers/zig/0.12/setup-hook.sh b/pkgs/development/compilers/zig/0.12/setup-hook.sh
index f9df7e6b558a..0053c5997da6 100644
--- a/pkgs/development/compilers/zig/0.12/setup-hook.sh
+++ b/pkgs/development/compilers/zig/0.12/setup-hook.sh
@@ -1,4 +1,4 @@
-# shellcheck shell=bash disable=SC2154,SC2086
+# shellcheck shell=bash
 
 # shellcheck disable=SC2034
 readonly zigDefaultFlagsArray=(@zig_default_flags@)
@@ -53,6 +53,7 @@ function zigInstallPhase {
     runHook postInstall
 }
 
+# shellcheck disable=SC2154
 addEnvHooks "$targetOffset" zigSetGlobalCacheDir
 
 if [ -z "${dontUseZigBuild-}" ] && [ -z "${buildPhase-}" ]; then
diff --git a/pkgs/development/compilers/zig/0.13/setup-hook.sh b/pkgs/development/compilers/zig/0.13/setup-hook.sh
index f9df7e6b558a..0053c5997da6 100644
--- a/pkgs/development/compilers/zig/0.13/setup-hook.sh
+++ b/pkgs/development/compilers/zig/0.13/setup-hook.sh
@@ -1,4 +1,4 @@
-# shellcheck shell=bash disable=SC2154,SC2086
+# shellcheck shell=bash
 
 # shellcheck disable=SC2034
 readonly zigDefaultFlagsArray=(@zig_default_flags@)
@@ -53,6 +53,7 @@ function zigInstallPhase {
     runHook postInstall
 }
 
+# shellcheck disable=SC2154
 addEnvHooks "$targetOffset" zigSetGlobalCacheDir
 
 if [ -z "${dontUseZigBuild-}" ] && [ -z "${buildPhase-}" ]; then
diff --git a/pkgs/development/compilers/zig/0.9/setup-hook.sh b/pkgs/development/compilers/zig/0.9/setup-hook.sh
index f9df7e6b558a..0053c5997da6 100644
--- a/pkgs/development/compilers/zig/0.9/setup-hook.sh
+++ b/pkgs/development/compilers/zig/0.9/setup-hook.sh
@@ -1,4 +1,4 @@
-# shellcheck shell=bash disable=SC2154,SC2086
+# shellcheck shell=bash
 
 # shellcheck disable=SC2034
 readonly zigDefaultFlagsArray=(@zig_default_flags@)
@@ -53,6 +53,7 @@ function zigInstallPhase {
     runHook postInstall
 }
 
+# shellcheck disable=SC2154
 addEnvHooks "$targetOffset" zigSetGlobalCacheDir
 
 if [ -z "${dontUseZigBuild-}" ] && [ -z "${buildPhase-}" ]; then
diff --git a/pkgs/development/compilers/zig/setup-hook.sh b/pkgs/development/compilers/zig/setup-hook.sh
index f9df7e6b558a..0053c5997da6 100644
--- a/pkgs/development/compilers/zig/setup-hook.sh
+++ b/pkgs/development/compilers/zig/setup-hook.sh
@@ -1,4 +1,4 @@
-# shellcheck shell=bash disable=SC2154,SC2086
+# shellcheck shell=bash
 
 # shellcheck disable=SC2034
 readonly zigDefaultFlagsArray=(@zig_default_flags@)
@@ -53,6 +53,7 @@ function zigInstallPhase {
     runHook postInstall
 }
 
+# shellcheck disable=SC2154
 addEnvHooks "$targetOffset" zigSetGlobalCacheDir
 
 if [ -z "${dontUseZigBuild-}" ] && [ -z "${buildPhase-}" ]; then

From 5d3e7203cea89b8db01dc18e7b2447cc6c1f4c92 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 9 Jun 2024 18:58:17 +0200
Subject: [PATCH 047/115] build2: support structuredAttrs in setup hook

Tested build2 itself with and without __structuredAttrs.
---
 .../tools/build-managers/build2/setup-hook.sh  | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/tools/build-managers/build2/setup-hook.sh b/pkgs/development/tools/build-managers/build2/setup-hook.sh
index 1259fabc0548..d5dadfe73253 100644
--- a/pkgs/development/tools/build-managers/build2/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/build2/setup-hook.sh
@@ -16,8 +16,8 @@ build2ConfigurePhase() {
         "config.install.man=${!outputDoc}/share/man"
         "config.install.sbin=${!outputBin}/sbin"
         "config.install.bin.mode=755"
-        $build2ConfigureFlags "${build2ConfigureFlagsArray[@]}"
     )
+    concatTo flagsArray build2ConfigureFlags build2ConfigureFlagsArray
 
     if [ -n "@isTargetDarwin@" ]; then
         flagsArray+=("config.bin.ld=ld64-lld")
@@ -35,9 +35,8 @@ build2ConfigurePhase() {
 build2BuildPhase() {
     runHook preBuild
 
-    local flagsArray=(
-        $build2BuildFlags "${build2BuildFlagsArray[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray build2BuildFlags build2BuildFlagsArray
 
     echo 'build flags' "${flagsArray[@]}"
     b "${flagsArray[@]}"
@@ -48,9 +47,8 @@ build2BuildPhase() {
 build2CheckPhase() {
     runHook preCheck
 
-    local flagsArray=(
-        $build2CheckFlags "${build2CheckFlags[@]}"
-    )
+    local flagsArray=()
+    concatTo flagsArray build2CheckFlags build2CheckFlags
 
     echo 'check flags' "${flagsArray[@]}"
 
@@ -62,10 +60,8 @@ build2CheckPhase() {
 build2InstallPhase() {
     runHook preInstall
 
-    local flagsArray=(
-        $build2InstallFlags "${build2InstallFlagsArray[@]}"
-        ${installTargets:-}
-    )
+    local flagsArray=()
+    concatTo flagsArray build2InstallFlags build2InstallFlagsArray installTargets
 
     echo 'install flags' "${flagsArray[@]}"
     b install "${flagsArray[@]}"

From b42b649581b9f845173bc7c6727aa2536c30f350 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 9 Jun 2024 20:57:04 +0200
Subject: [PATCH 048/115] build2: shellcheck setup hook

---
 .../tools/build-managers/build2/setup-hook.sh      | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/tools/build-managers/build2/setup-hook.sh b/pkgs/development/tools/build-managers/build2/setup-hook.sh
index d5dadfe73253..ba6b616cf417 100644
--- a/pkgs/development/tools/build-managers/build2/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/build2/setup-hook.sh
@@ -1,3 +1,5 @@
+# shellcheck shell=bash
+
 build2ConfigurePhase() {
     runHook preConfigure
 
@@ -19,6 +21,7 @@ build2ConfigurePhase() {
     )
     concatTo flagsArray build2ConfigureFlags build2ConfigureFlagsArray
 
+    # shellcheck disable=SC2157
     if [ -n "@isTargetDarwin@" ]; then
         flagsArray+=("config.bin.ld=ld64-lld")
         flagsArray+=("config.cc.loptions+=-fuse-ld=lld")
@@ -52,7 +55,7 @@ build2CheckPhase() {
 
     echo 'check flags' "${flagsArray[@]}"
 
-    b test ${build2Dir:-.} "${flagsArray[@]}"
+    b test "${build2Dir:-.}" "${flagsArray[@]}"
 
     runHook postCheck
 }
@@ -69,19 +72,20 @@ build2InstallPhase() {
     runHook postInstall
 }
 
-if [ -z "${dontUseBuild2Configure-}" -a -z "${configurePhase-}" ]; then
+if [ -z "${dontUseBuild2Configure-}" ] && [ -z "${configurePhase-}" ]; then
+    # shellcheck disable=SC2034
     setOutputFlags=
     configurePhase=build2ConfigurePhase
 fi
 
-if [ -z "${dontUseBuild2Build-}" -a -z "${buildPhase-}" ]; then
+if [ -z "${dontUseBuild2Build-}" ] && [ -z "${buildPhase-}" ]; then
     buildPhase=build2BuildPhase
 fi
 
-if [ -z "${dontUseBuild2Check-}" -a -z "${checkPhase-}" ]; then
+if [ -z "${dontUseBuild2Check-}" ] && [ -z "${checkPhase-}" ]; then
     checkPhase=build2CheckPhase
 fi
 
-if [ -z "${dontUseBuild2Install-}" -a -z "${installPhase-}" ]; then
+if [ -z "${dontUseBuild2Install-}" ] && [ -z "${installPhase-}" ]; then
     installPhase=build2InstallPhase
 fi

From 4a48b9242cbe9bd8aaf3d630d78784c62ec461ce Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 9 Jun 2024 19:06:44 +0200
Subject: [PATCH 049/115] scons: support structuredAttrs in setup hook

Tested swiften with and without __structuredAttrs.
---
 pkgs/by-name/sc/scons/setup-hook.sh | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/sc/scons/setup-hook.sh b/pkgs/by-name/sc/scons/setup-hook.sh
index bfd8f3cc07b9..ea9b919fce21 100644
--- a/pkgs/by-name/sc/scons/setup-hook.sh
+++ b/pkgs/by-name/sc/scons/setup-hook.sh
@@ -8,14 +8,13 @@ sconsBuildPhase() {
     fi
 
     if [ -z "${dontAddPrefix:-}" ] && [ -n "$prefix" ]; then
-        buildFlags="${prefixKey:-prefix=}$prefix $buildFlags"
+        prependToVar buildFlags "${prefixKey:-prefix=}$prefix"
     fi
 
     local flagsArray=(
       ${enableParallelBuilding:+-j${NIX_BUILD_CORES}}
-      $sconsFlags ${sconsFlagsArray[@]}
-      $buildFlags ${buildFlagsArray[@]}
     )
+    concatTo flagsArray sconsFlags sconsFlagsArray buildFlags buildFlagsArray
 
     echoCmd 'scons build flags' "${flagsArray[@]}"
     scons "${flagsArray[@]}"
@@ -31,15 +30,13 @@ sconsInstallPhase() {
     fi
 
     if [ -z "${dontAddPrefix:-}" ] && [ -n "$prefix" ]; then
-        installFlags="${prefixKey:-prefix=}$prefix $installFlags"
+        prependToVar installFlags "${prefixKey:-prefix=}$prefix"
     fi
 
     local flagsArray=(
         ${enableParallelInstalling:+-j${NIX_BUILD_CORES}}
-        $sconsFlags ${sconsFlagsArray[@]}
-        $installFlags ${installFlagsArray[@]}
-        ${installTargets:-install}
     )
+    concatTo flagsArray sconsFlags sconsFlagsArray installFlags installFlagsArray installTargets=install
 
     echoCmd 'scons install flags' "${flagsArray[@]}"
     scons "${flagsArray[@]}"
@@ -63,9 +60,8 @@ sconsCheckPhase() {
     else
         local flagsArray=(
             ${enableParallelChecking:+-j${NIX_BUILD_CORES}}
-            $sconsFlags ${sconsFlagsArray[@]}
-            ${checkFlagsArray[@]}
         )
+        concatTo flagsArray sconsFlags sconsFlagsArray checkFlagsArray
 
         echoCmd 'scons check flags' "${flagsArray[@]}"
         scons "${flagsArray[@]}"

From 5c740315edaca42781cb0cf5a3b924d7cb61e965 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 9 Jun 2024 19:11:33 +0200
Subject: [PATCH 050/115] scons: add missing checkTarget in setup hook

The checkTarget variable is explicitly tested before, but not passed to
scons.

This was apparently missed in the initial commit for that setupHook in
#50293.
---
 pkgs/by-name/sc/scons/setup-hook.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/sc/scons/setup-hook.sh b/pkgs/by-name/sc/scons/setup-hook.sh
index ea9b919fce21..3cdb7da42453 100644
--- a/pkgs/by-name/sc/scons/setup-hook.sh
+++ b/pkgs/by-name/sc/scons/setup-hook.sh
@@ -61,7 +61,7 @@ sconsCheckPhase() {
         local flagsArray=(
             ${enableParallelChecking:+-j${NIX_BUILD_CORES}}
         )
-        concatTo flagsArray sconsFlags sconsFlagsArray checkFlagsArray
+        concatTo flagsArray sconsFlags sconsFlagsArray checkFlagsArray checkTarget
 
         echoCmd 'scons check flags' "${flagsArray[@]}"
         scons "${flagsArray[@]}"

From bc0468d6edfc769aefca04f0dd0ec953619ae2d9 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 9 Jun 2024 19:14:23 +0200
Subject: [PATCH 051/115] premake: support structuredAttrs in setup hook

Tested gmad with and without __structuredAttrs.

Building it succeeded on master with structuredAttrs, but the log output
showed that the configure flags were not passed correctly previously.
---
 pkgs/development/tools/misc/premake/setup-hook.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/development/tools/misc/premake/setup-hook.sh b/pkgs/development/tools/misc/premake/setup-hook.sh
index 6e65e9e8c73f..d89229f8a786 100644
--- a/pkgs/development/tools/misc/premake/setup-hook.sh
+++ b/pkgs/development/tools/misc/premake/setup-hook.sh
@@ -3,9 +3,8 @@ premakeConfigurePhase() {
 
     local flagsArray=(
         ${premakefile:+--file=$premakefile}
-        $premakeFlags ${premakeFlagsArray[@]}
-        ${premakeBackend:-gmake}
     )
+    concatTo flagsArray premakeFlags premakeFlagsArray premakeBackend=gmake
 
     echoCmd 'configure flags' "${flagsArray[@]}"
 

From b072c1f723747ab7d98f344430e293cd17872449 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 9 Jun 2024 21:01:20 +0200
Subject: [PATCH 052/115] premake: shellcheck setup hook

---
 pkgs/development/tools/misc/premake/setup-hook.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/tools/misc/premake/setup-hook.sh b/pkgs/development/tools/misc/premake/setup-hook.sh
index d89229f8a786..c99fae4d14f8 100644
--- a/pkgs/development/tools/misc/premake/setup-hook.sh
+++ b/pkgs/development/tools/misc/premake/setup-hook.sh
@@ -1,3 +1,5 @@
+# shellcheck shell=bash
+
 premakeConfigurePhase() {
     runHook preConfigure
 

From 544b981c3eb5f65ed8d56e98ee7d526a1322c4ae Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 9 Jun 2024 21:25:34 +0200
Subject: [PATCH 053/115] gn: support structuredAttrs in setup hook

Tested v8 with and without __structuredAttrs.
---
 pkgs/development/tools/build-managers/gn/setup-hook.sh | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/build-managers/gn/setup-hook.sh b/pkgs/development/tools/build-managers/gn/setup-hook.sh
index 850f18948cad..9f52f7778b9b 100644
--- a/pkgs/development/tools/build-managers/gn/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/gn/setup-hook.sh
@@ -1,9 +1,12 @@
 gnConfigurePhase() {
     runHook preConfigure
 
-    echo "gn flags: $gnFlags ${gnFlagsArray[@]}"
+    local flagsArray=()
+    concatTo flagsArray gnFlags gnFlagsArray
 
-    gn gen out/Release --args="$gnFlags ${gnFlagsArray[@]}"
+    echoCmd 'gn flags' "${flagsArray[@]}"
+
+    gn gen out/Release --args="${flagsArray[*]}"
     cd out/Release/
 
     runHook postConfigure

From 5b370227d11ee87fc308fb9165813acb5626f9f2 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 9 Jun 2024 21:28:37 +0200
Subject: [PATCH 054/115] gn: shellcheck setup hook

---
 pkgs/development/tools/build-managers/gn/setup-hook.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/tools/build-managers/gn/setup-hook.sh b/pkgs/development/tools/build-managers/gn/setup-hook.sh
index 9f52f7778b9b..f459e979aa0f 100644
--- a/pkgs/development/tools/build-managers/gn/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/gn/setup-hook.sh
@@ -1,3 +1,5 @@
+# shellcheck shell=bash
+
 gnConfigurePhase() {
     runHook preConfigure
 
@@ -7,11 +9,12 @@ gnConfigurePhase() {
     echoCmd 'gn flags' "${flagsArray[@]}"
 
     gn gen out/Release --args="${flagsArray[*]}"
+    # shellcheck disable=SC2164
     cd out/Release/
 
     runHook postConfigure
 }
 
-if [ -z "${dontUseGnConfigure-}" -a -z "${configurePhase-}" ]; then
+if [ -z "${dontUseGnConfigure-}" ] && [ -z "${configurePhase-}" ]; then
     configurePhase=gnConfigurePhase
 fi

From 1bcca7d66b0a052b703d029c4593434b84136455 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Wed, 12 Jun 2024 18:31:45 +0200
Subject: [PATCH 055/115] qt: support structuredAttrs in qmake hook

Tested qbs with and without __structuredAttrs.
---
 .../libraries/qt-5/hooks/qmake-hook.sh        | 36 +++++++++----------
 .../qt-5/hooks/qttools-setup-hook.sh          |  2 +-
 .../libraries/qt-6/hooks/qmake-hook.sh        | 28 +++++++--------
 3 files changed, 29 insertions(+), 37 deletions(-)

diff --git a/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh b/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
index 56607df6b4b9..f52de4e51df2 100644
--- a/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
@@ -1,40 +1,36 @@
 . @fix_qmake_libtool@
 
-qmakeFlags=( ${qmakeFlags-} )
-
 qmakePrePhase() {
-    qmakeFlags_orig=( "${qmakeFlags[@]}" )
-
     # These flags must be added _before_ the flags specified in the derivation.
-    qmakeFlags=( \
-        "PREFIX=$out" \
-        "NIX_OUTPUT_OUT=$out" \
-        "NIX_OUTPUT_DEV=${!outputDev}" \
-        "NIX_OUTPUT_BIN=${!outputBin}" \
-        "NIX_OUTPUT_DOC=${!outputDev}/${qtDocPrefix:?}" \
-        "NIX_OUTPUT_QML=${!outputBin}/${qtQmlPrefix:?}" \
-        "NIX_OUTPUT_PLUGIN=${!outputBin}/${qtPluginPrefix:?}" \
-    )
+    prependToVar qmakeFlags \
+      "PREFIX=$out" \
+      "NIX_OUTPUT_OUT=$out" \
+      "NIX_OUTPUT_DEV=${!outputDev}" \
+      "NIX_OUTPUT_BIN=${!outputBin}" \
+      "NIX_OUTPUT_DOC=${!outputDev}/${qtDocPrefix:?}" \
+      "NIX_OUTPUT_QML=${!outputBin}/${qtQmlPrefix:?}" \
+      "NIX_OUTPUT_PLUGIN=${!outputBin}/${qtPluginPrefix:?}"
 
     if [ -n "@debug@" ]; then
-        qmakeFlags+=( "CONFIG+=debug" )
+        prependToVar qmakeFlags "CONFIG+=debug"
     else
-        qmakeFlags+=( "CONFIG+=release" )
+        prependToVar qmakeFlags "CONFIG+=release"
     fi
 
     # do the stripping ourselves (needed for separateDebugInfo)
-    qmakeFlags+=( "CONFIG+=nostrip" )
-
-    qmakeFlags+=( "${qmakeFlags_orig[@]}" )
+    prependToVar qmakeFlags "CONFIG+=nostrip"
 }
 prePhases+=" qmakePrePhase"
 
 qmakeConfigurePhase() {
     runHook preConfigure
 
+    local flagsArray=()
+    concatTo flagsArray qmakeFlags
+
     echo "QMAKEPATH=$QMAKEPATH"
-    echo qmake "${qmakeFlags[@]}"
-    qmake "${qmakeFlags[@]}"
+    echo qmake "${flagsArray[@]}"
+    qmake "${flagsArray[@]}"
 
     if ! [[ -v enableParallelBuilding ]]; then
         enableParallelBuilding=1
diff --git a/pkgs/development/libraries/qt-5/hooks/qttools-setup-hook.sh b/pkgs/development/libraries/qt-5/hooks/qttools-setup-hook.sh
index c320a7974471..099c0879ed39 100644
--- a/pkgs/development/libraries/qt-5/hooks/qttools-setup-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/qttools-setup-hook.sh
@@ -1 +1 @@
-qmakeFlags+=( "QMAKE_LRELEASE=@dev@/bin/lrelease" )
+appendToVar qmakeFlags "QMAKE_LRELEASE=@dev@/bin/lrelease"
diff --git a/pkgs/development/libraries/qt-6/hooks/qmake-hook.sh b/pkgs/development/libraries/qt-6/hooks/qmake-hook.sh
index 130e8290a3fe..84b2fb153d9f 100644
--- a/pkgs/development/libraries/qt-6/hooks/qmake-hook.sh
+++ b/pkgs/development/libraries/qt-6/hooks/qmake-hook.sh
@@ -1,33 +1,29 @@
 . @fix_qmake_libtool@
 
-qmakeFlags=(${qmakeFlags-})
-
 qmakePrePhase() {
-    qmakeFlags_orig=("${qmakeFlags[@]}")
-
     # These flags must be added _before_ the flags specified in the derivation.
     # TODO: these flags also need a patch which isn't applied
     # can we either remove these flags or update the qt5 patch?
     # "NIX_OUTPUT_DOC=${!outputDev}/${qtDocPrefix:?}" \
-    qmakeFlags=(
-        "PREFIX=$out"
-        "NIX_OUTPUT_OUT=$out"
-        "NIX_OUTPUT_DEV=${!outputDev}"
-        "NIX_OUTPUT_BIN=${!outputBin}"
-        "NIX_OUTPUT_QML=${!outputBin}/${qtQmlPrefix:?}"
-        "NIX_OUTPUT_PLUGIN=${!outputBin}/${qtPluginPrefix:?}"
-    )
-
-    qmakeFlags+=("${qmakeFlags_orig[@]}")
+    prependToVar qmakeFlags \
+      "PREFIX=$out" \
+      "NIX_OUTPUT_OUT=$out" \
+      "NIX_OUTPUT_DEV=${!outputDev}" \
+      "NIX_OUTPUT_BIN=${!outputBin}" \
+      "NIX_OUTPUT_QML=${!outputBin}/${qtQmlPrefix:?}" \
+      "NIX_OUTPUT_PLUGIN=${!outputBin}/${qtPluginPrefix:?}"
 }
 prePhases+=" qmakePrePhase"
 
 qmakeConfigurePhase() {
     runHook preConfigure
 
+    local flagsArray=()
+    concatTo flagsArray qmakeFlags
+
     echo "QMAKEPATH=$QMAKEPATH"
-    echo qmake "${qmakeFlags[@]}"
-    qmake "${qmakeFlags[@]}"
+    echo qmake "${flagsArray[@]}"
+    qmake "${flagsArray[@]}"
 
     if ! [[ -v enableParallelBuilding ]]; then
         enableParallelBuilding=1

From 581aebcdad092b228b02ac068bb28d6b2a22b909 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Wed, 12 Jun 2024 18:35:54 +0200
Subject: [PATCH 056/115] perl: support structuredAttrs in generic builder

Tested perlPackages.GSSAPI with and without __structuredAttrs.
---
 pkgs/development/perl-modules/generic/builder.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/perl-modules/generic/builder.sh b/pkgs/development/perl-modules/generic/builder.sh
index 4da9f7a98212..f87bb2b9e177 100644
--- a/pkgs/development/perl-modules/generic/builder.sh
+++ b/pkgs/development/perl-modules/generic/builder.sh
@@ -23,7 +23,10 @@ preConfigure() {
         fi
     done
 
-    perl Makefile.PL PREFIX=$out INSTALLDIRS=site $makeMakerFlags PERL=$(type -P perl) FULLPERL=\"$fullperl/bin/perl\"
+    local flagsArray=()
+    concatTo flagsArray makeMakerFlags
+
+    perl Makefile.PL PREFIX=$out INSTALLDIRS=site "${flagsArray[@]}" PERL=$(type -P perl) FULLPERL=\"$fullperl/bin/perl\"
 }
 
 if test -n "$perlPreHook"; then

From 050689db307b54c180afd5a4320f57db947e0a7d Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sat, 9 Dec 2023 20:00:23 +0100
Subject: [PATCH 057/115] treewide: fix pg_config / postgresql headers moved to
 dev output
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This was supposed to happen in #294504, but the commit was accidentally
left out when splitting off some libpq-related changes. Originated in
#179962, by Sandro.

Co-authored-by: Sandro Jäckel <sandro.jaeckel@gmail.com>
Co-authored-by: Wolfgang Walther <walther@technowledgy.de>
---
 doc/languages-frameworks/ruby.section.md                  | 8 +++-----
 pkgs/applications/misc/pgmodeler/default.nix              | 4 ++--
 pkgs/applications/networking/misc/zammad/default.nix      | 2 +-
 pkgs/development/compilers/urweb/default.nix              | 1 -
 pkgs/development/libraries/libdbi-drivers/default.nix     | 2 --
 pkgs/development/libraries/opendbx/default.nix            | 2 +-
 pkgs/development/python-modules/psycopg/default.nix       | 5 +++++
 pkgs/development/python-modules/psycopg2/default.nix      | 2 +-
 pkgs/development/ruby-modules/gem-config/default.nix      | 2 +-
 .../tools/rust/cargo-pgrx/buildPgrxExtension.nix          | 4 ++--
 pkgs/servers/mail/exim/default.nix                        | 1 -
 pkgs/servers/sql/postgresql/ext/age.nix                   | 2 +-
 pkgs/servers/sql/postgresql/ext/plv8/default.nix          | 2 +-
 pkgs/servers/sql/postgresql/ext/tsja.nix                  | 8 ++++----
 pkgs/tools/backup/bacula/default.nix                      | 2 +-
 pkgs/tools/networking/kea/default.nix                     | 2 +-
 pkgs/top-level/php-packages.nix                           | 4 ++--
 17 files changed, 26 insertions(+), 27 deletions(-)

diff --git a/doc/languages-frameworks/ruby.section.md b/doc/languages-frameworks/ruby.section.md
index c5cc122394f5..31f696bd6427 100644
--- a/doc/languages-frameworks/ruby.section.md
+++ b/doc/languages-frameworks/ruby.section.md
@@ -154,7 +154,7 @@ let
     defaultGemConfig = pkgs.defaultGemConfig // {
       pg = attrs: {
         buildFlags =
-        [ "--with-pg-config=${pkgs."postgresql_${pg_version}"}/bin/pg_config" ];
+        [ "--with-pg-config=${lib.getDev pkgs."postgresql_${pg_version}"}/bin/pg_config" ];
       };
     };
   };
@@ -172,7 +172,7 @@ let
     gemConfig = pkgs.defaultGemConfig // {
       pg = attrs: {
         buildFlags =
-        [ "--with-pg-config=${pkgs."postgresql_${pg_version}"}/bin/pg_config" ];
+        [ "--with-pg-config=${lib.getDev pkgs."postgresql_${pg_version}"}/bin/pg_config" ];
       };
     };
   };
@@ -190,9 +190,7 @@ let
         defaultGemConfig = super.defaultGemConfig // {
           pg = attrs: {
             buildFlags = [
-              "--with-pg-config=${
-                pkgs."postgresql_${pg_version}"
-              }/bin/pg_config"
+              "--with-pg-config=${lib.getDev pkgs."postgresql_${pg_version}"}/bin/pg_config"
             ];
           };
         };
diff --git a/pkgs/applications/misc/pgmodeler/default.nix b/pkgs/applications/misc/pgmodeler/default.nix
index c3b5491387cd..f97827eccafa 100644
--- a/pkgs/applications/misc/pgmodeler/default.nix
+++ b/pkgs/applications/misc/pgmodeler/default.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config qmake wrapQtAppsHook ];
   qmakeFlags = [ "pgmodeler.pro" "CONFIG+=release" ] ++ lib.optionals stdenv.isDarwin [
-    "PGSQL_INC=${postgresql}/include"
-    "PGSQL_LIB=${postgresql.lib}/lib/libpq.dylib"
+    "PGSQL_INC=${lib.getDev postgresql}/include"
+    "PGSQL_LIB=${lib.getLib postgresql}/lib/libpq.dylib"
     "XML_INC=${libxml2.dev}/include/libxml2"
     "XML_LIB=${libxml2.out}/lib/libxml2.dylib"
     "PREFIX=${placeholder "out"}/Applications/pgModeler.app/Contents"
diff --git a/pkgs/applications/networking/misc/zammad/default.nix b/pkgs/applications/networking/misc/zammad/default.nix
index 065749554ea1..4a37b4737c61 100644
--- a/pkgs/applications/networking/misc/zammad/default.nix
+++ b/pkgs/applications/networking/misc/zammad/default.nix
@@ -74,7 +74,7 @@ let
     ];
     gemConfig = defaultGemConfig // {
       pg = attrs: {
-        buildFlags = [ "--with-pg-config=${postgresql}/bin/pg_config" ];
+        buildFlags = [ "--with-pg-config=${lib.getDev postgresql}/bin/pg_config" ];
       };
       rszr = attrs: {
         buildInputs = [ imlib2 imlib2.dev ];
diff --git a/pkgs/development/compilers/urweb/default.nix b/pkgs/development/compilers/urweb/default.nix
index 2621f4bc8050..f96cce8c53f1 100644
--- a/pkgs/development/compilers/urweb/default.nix
+++ b/pkgs/development/compilers/urweb/default.nix
@@ -20,7 +20,6 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--with-openssl=${openssl.dev}" ];
 
   preConfigure = ''
-    export PGHEADER="${postgresql}/include/libpq-fe.h";
     export MSHEADER="${libmysqlclient}/include/mysql/mysql.h";
     export SQHEADER="${sqlite.dev}/include/sqlite3.h";
     export ICU_INCLUDES="-I${icu.dev}/include";
diff --git a/pkgs/development/libraries/libdbi-drivers/default.nix b/pkgs/development/libraries/libdbi-drivers/default.nix
index bbd9e3898d91..6537e3ae2a3e 100644
--- a/pkgs/development/libraries/libdbi-drivers/default.nix
+++ b/pkgs/development/libraries/libdbi-drivers/default.nix
@@ -42,8 +42,6 @@ stdenv.mkDerivation rec {
     "--with-sqlite3-libdir=${sqlite.out}/lib/sqlite"
   ] ++ lib.optionals (postgresql != null) [
     "--with-pgsql"
-    "--with-pgsql_incdir=${postgresql}/include"
-    "--with-pgsql_libdir=${postgresql.lib}/lib"
   ];
 
   env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isClang [
diff --git a/pkgs/development/libraries/opendbx/default.nix b/pkgs/development/libraries/opendbx/default.nix
index 04ffde29daa0..9fbb8356679c 100644
--- a/pkgs/development/libraries/opendbx/default.nix
+++ b/pkgs/development/libraries/opendbx/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   preConfigure = ''
     export CPPFLAGS="-I${getDev libmysqlclient}/include/mysql"
-    export LDFLAGS="-L${libmysqlclient}/lib/mysql -L${postgresql}/lib"
+    export LDFLAGS="-L${libmysqlclient}/lib/mysql"
     configureFlagsArray=(--with-backends="mysql pgsql sqlite3")
   '';
 
diff --git a/pkgs/development/python-modules/psycopg/default.nix b/pkgs/development/python-modules/psycopg/default.nix
index 7d1f8c54f3d0..b1b69bc3526a 100644
--- a/pkgs/development/python-modules/psycopg/default.nix
+++ b/pkgs/development/python-modules/psycopg/default.nix
@@ -74,11 +74,16 @@ let
 
     nativeBuildInputs = [
       cython
+      # needed to find pg_config with strictDeps
       postgresql
       setuptools
       tomli
     ];
 
+    buildInputs = [
+      postgresql
+    ];
+
     # tested in psycopg
     doCheck = false;
 
diff --git a/pkgs/development/python-modules/psycopg2/default.nix b/pkgs/development/python-modules/psycopg2/default.nix
index ec958d7525c9..c8959b948fd7 100644
--- a/pkgs/development/python-modules/psycopg2/default.nix
+++ b/pkgs/development/python-modules/psycopg2/default.nix
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     # some linker flags are added but the linker ignores them because they're incompatible
     # https://github.com/psycopg/psycopg2/blob/89005ac5b849c6428c05660b23c5a266c96e677d/setup.py
     substituteInPlace setup.py \
-      --replace "self.pg_config_exe = self.build_ext.pg_config" 'self.pg_config_exe = "${lib.getExe' buildPackages.postgresql "pg_config"}"'
+      --replace-fail "self.pg_config_exe = self.build_ext.pg_config" 'self.pg_config_exe = "${lib.getDev buildPackages.postgresql}/bin/pg_config"'
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index a541a8ee34bd..eb55255191cf 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -671,7 +671,7 @@ in
     # Force pkg-config lookup for libpq.
     # See https://github.com/ged/ruby-pg/blob/6629dec6656f7ca27619e4675b45225d9e422112/ext/extconf.rb#L34-L55
     #
-    # Note that setting --with-pg-config=${postgresql}/bin/pg_config would add
+    # Note that setting --with-pg-config=${lib.getDev postgresql}/bin/pg_config would add
     # an unnecessary reference to the entire postgresql package.
     buildFlags = [ "--with-pg-config=ignore" ];
     nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/tools/rust/cargo-pgrx/buildPgrxExtension.nix b/pkgs/development/tools/rust/cargo-pgrx/buildPgrxExtension.nix
index ab4343462f26..3d41c35ffd36 100644
--- a/pkgs/development/tools/rust/cargo-pgrx/buildPgrxExtension.nix
+++ b/pkgs/development/tools/rust/cargo-pgrx/buildPgrxExtension.nix
@@ -86,7 +86,7 @@ let
   preBuildAndTest = ''
     export PGRX_HOME=$(mktemp -d)
     export PGDATA="$PGRX_HOME/data-${pgrxPostgresMajor}/"
-    cargo-pgrx pgrx init "--pg${pgrxPostgresMajor}" ${postgresql}/bin/pg_config
+    cargo-pgrx pgrx init "--pg${pgrxPostgresMajor}" ${lib.getDev postgresql}/bin/pg_config
     echo "unix_socket_directories = '$(mktemp -d)'" > "$PGDATA/postgresql.conf"
 
     # This is primarily for Mac or other Nix systems that don't use the nixbld user.
@@ -120,7 +120,7 @@ let
       PGRX_BUILD_FLAGS="--frozen -j $NIX_BUILD_CORES ${builtins.concatStringsSep " " cargoBuildFlags}" \
       ${lib.optionalString stdenv.isDarwin ''RUSTFLAGS="''${RUSTFLAGS:+''${RUSTFLAGS} }-Clink-args=-Wl,-undefined,dynamic_lookup"''} \
       cargo pgrx package \
-        --pg-config ${postgresql}/bin/pg_config \
+        --pg-config ${lib.getDev postgresql}/bin/pg_config \
         ${maybeDebugFlag} \
         --features "${builtins.concatStringsSep " " buildFeatures}" \
         --out-dir "$out"
diff --git a/pkgs/servers/mail/exim/default.nix b/pkgs/servers/mail/exim/default.nix
index 26967b333eb9..bf593354da92 100644
--- a/pkgs/servers/mail/exim/default.nix
+++ b/pkgs/servers/mail/exim/default.nix
@@ -82,7 +82,6 @@ in stdenv.mkDerivation rec {
         s:^# \(LOOKUP_PGSQL=yes\)$:\1:
         s:^\(LOOKUP_LIBS\)=\(.*\):\1=\2 -lpq -L${postgresql.lib}/lib:
         s:^# \(LOOKUP_LIBS\)=.*:\1=-lpq -L${postgresql.lib}/lib:
-        s:^# \(LOOKUP_INCLUDE\)=.*:\1=-I${postgresql}/include:
       ''}
       ${lib.optionalString enableSqlite ''
         s:^# \(LOOKUP_SQLITE=yes\)$:\1:
diff --git a/pkgs/servers/sql/postgresql/ext/age.nix b/pkgs/servers/sql/postgresql/ext/age.nix
index 2c68d6dcbbad..b80d1c203b2c 100644
--- a/pkgs/servers/sql/postgresql/ext/age.nix
+++ b/pkgs/servers/sql/postgresql/ext/age.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
       echo -e "include Makefile\nfiles:\n\t@echo \$(REGRESS)" > Makefile.regress
       REGRESS_TESTS=$(make -f Makefile.regress files)
 
-      ${postgresql}/lib/pgxs/src/test/regress/pg_regress \
+      ${lib.getDev postgresql}/lib/pgxs/src/test/regress/pg_regress \
         --inputdir=./ \
         --bindir='${postgresqlAge}/bin' \
         --encoding=UTF-8 \
diff --git a/pkgs/servers/sql/postgresql/ext/plv8/default.nix b/pkgs/servers/sql/postgresql/ext/plv8/default.nix
index af1cee81fa78..e0dbc19e353f 100644
--- a/pkgs/servers/sql/postgresql/ext/plv8/default.nix
+++ b/pkgs/servers/sql/postgresql/ext/plv8/default.nix
@@ -112,7 +112,7 @@ in stdenv.mkDerivation (finalAttrs: {
             echo -e "include Makefile\nprint_regress_files:\n\t@echo \$(REGRESS)" > Makefile.regress
             REGRESS_TESTS=$(make -f Makefile.regress print_regress_files)
 
-            ${postgresql}/lib/pgxs/src/test/regress/pg_regress \
+            ${lib.getDev postgresql}/lib/pgxs/src/test/regress/pg_regress \
               --bindir='${postgresqlWithSelf}/bin' \
               --temp-instance=regress-instance \
               --dbname=contrib_regression \
diff --git a/pkgs/servers/sql/postgresql/ext/tsja.nix b/pkgs/servers/sql/postgresql/ext/tsja.nix
index f62eae5b6a3e..f0b9238f59ef 100644
--- a/pkgs/servers/sql/postgresql/ext/tsja.nix
+++ b/pkgs/servers/sql/postgresql/ext/tsja.nix
@@ -18,10 +18,10 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace Makefile \
-      --replace /usr/local/pgsql ${postgresql} \
-      --replace -L/usr/local/lib "" \
-      --replace -I/usr/local/include ""
-    substituteInPlace tsja.c --replace /usr/local/lib/mecab ${mecab}/lib/mecab
+      --replace-fail /usr/local/pgsql ${lib.getDev postgresql} \
+      --replace-fail -L/usr/local/lib "" \
+      --replace-fail -I/usr/local/include ""
+    substituteInPlace tsja.c --replace-fail /usr/local/lib/mecab ${mecab}/lib/mecab
   '';
 
   buildInputs = [ mecab postgresql ];
diff --git a/pkgs/tools/backup/bacula/default.nix b/pkgs/tools/backup/bacula/default.nix
index f8ec672710f5..386775960a73 100644
--- a/pkgs/tools/backup/bacula/default.nix
+++ b/pkgs/tools/backup/bacula/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--with-sqlite3=${sqlite.dev}"
-    "--with-postgresql=${postgresql}"
+    "--with-postgresql=${lib.getDev postgresql}"
     "--with-logdir=/var/log/bacula"
     "--with-working-dir=/var/lib/bacula"
     "--mandir=\${out}/share/man"
diff --git a/pkgs/tools/networking/kea/default.nix b/pkgs/tools/networking/kea/default.nix
index a4831b6ef0ef..ac068c39591b 100644
--- a/pkgs/tools/networking/kea/default.nix
+++ b/pkgs/tools/networking/kea/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     "--localstatedir=/var"
     "--with-openssl=${lib.getDev openssl}"
   ]
-  ++ lib.optional withPostgres "--with-pgsql=${postgresql}/bin/pg_config"
+  ++ lib.optional withPostgres "--with-pgsql=${lib.getDev postgresql}/bin/pg_config"
   ++ lib.optional withMysql "--with-mysql=${lib.getDev libmysqlclient}/bin/mysql_config";
 
   postConfigure = ''
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index e85ae6dea40a..f2398b0502c0 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -586,7 +586,7 @@ in {
         {
           name = "pdo_pgsql";
           internalDeps = [ php.extensions.pdo ];
-          configureFlags = [ "--with-pdo-pgsql=${postgresql}" ];
+          configureFlags = [ "--with-pdo-pgsql=${lib.getDev postgresql}" ];
           doCheck = false;
         }
         {
@@ -599,7 +599,7 @@ in {
         {
           name = "pgsql";
           buildInputs = [ pcre2 ];
-          configureFlags = [ "--with-pgsql=${postgresql}" ];
+          configureFlags = [ "--with-pgsql=${lib.getDev postgresql}" ];
           doCheck = false;
         }
         { name = "posix"; doCheck = false; }

From cd81adf5ae33007c3dd914831f98c8ff653c45a2 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Sat, 24 Aug 2024 11:54:40 -0400
Subject: [PATCH 058/115] openh264: add patch enabling riscv64 support

---
 pkgs/by-name/op/openh264/package.nix | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/op/openh264/package.nix b/pkgs/by-name/op/openh264/package.nix
index ebd93572e29e..12048b593dd0 100644
--- a/pkgs/by-name/op/openh264/package.nix
+++ b/pkgs/by-name/op/openh264/package.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch2
 , gtest
 , meson
 , nasm
@@ -20,6 +21,16 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-ai7lcGcQQqpsLGSwHkSs7YAoEfGCIbxdClO6JpGA+MI=";
   };
 
+  patches = [
+    # build: fix build with meson on riscv64
+    # https://github.com/cisco/openh264/pull/3773
+    (fetchpatch2 {
+      name = "openh264-riscv64.patch";
+      url = "https://github.com/cisco/openh264/commit/cea886eda8fae7ba42c4819e6388ce8fc633ebf6.patch";
+      hash = "sha256-ncXuGgogXA7JcCOjGk+kBprmOErFohrYjYzZYzAbbDQ=";
+    })
+  ];
+
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [
@@ -45,7 +56,8 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [ AndersonTorres ];
     # See meson.build
     platforms = lib.platforms.windows ++ lib.intersectLists
-      (lib.platforms.x86 ++ lib.platforms.arm ++ lib.platforms.aarch64 ++ lib.platforms.loongarch64)
+      (lib.platforms.x86 ++ lib.platforms.arm ++ lib.platforms.aarch64 ++
+       lib.platforms.loongarch64 ++ lib.platforms.riscv64)
       (lib.platforms.linux ++ lib.platforms.darwin);
   };
 })

From 287e0d3288a84c595d83c1bed662b29c50cd7317 Mon Sep 17 00:00:00 2001
From: Luflosi <luflosi@luflosi.de>
Date: Fri, 23 Aug 2024 10:57:26 +0200
Subject: [PATCH 059/115] python3Packages.pytest-order: 1.2.1 -> 1.3.0

https://github.com/pytest-dev/pytest-order/releases/tag/v1.3.0

Also fetch the source from GitHub since that is "closer to the source" and use `pyproject = true`.
---
 .../python-modules/pytest-order/default.nix    | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-order/default.nix b/pkgs/development/python-modules/pytest-order/default.nix
index 34ea35247416..86db6d272fe6 100644
--- a/pkgs/development/python-modules/pytest-order/default.nix
+++ b/pkgs/development/python-modules/pytest-order/default.nix
@@ -1,8 +1,8 @@
 {
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   lib,
-  pytest,
+  setuptools,
   pytest-xdist,
   pytest-dependency,
   pytest-mock,
@@ -11,15 +11,17 @@
 
 buildPythonPackage rec {
   pname = "pytest-order";
-  version = "1.2.1";
-  format = "setuptools";
+  version = "1.3.0";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-RFG9iCG6T6IQlFWi/MiCr2DvjlPgnSRNZ2dL4I9W6sM=";
+  src = fetchFromGitHub {
+    owner = "pytest-dev";
+    repo = "pytest-order";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-V1qJGkXn+HhuK5wiwkkJBEbfnv23R4x9Cv0J6ZTj5xE=";
   };
 
-  buildInputs = [ pytest ];
+  build-system = [ setuptools ];
 
   nativeCheckInputs = [
     pytestCheckHook

From 2d6ba540503a8aca4924bf5f8b3c66bab5d59458 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 24 Aug 2024 18:58:25 +0000
Subject: [PATCH 060/115] aws-c-auth: 0.7.25 -> 0.7.26

---
 pkgs/development/libraries/aws-c-auth/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/aws-c-auth/default.nix b/pkgs/development/libraries/aws-c-auth/default.nix
index 84724375fea2..70aa863a7ce2 100644
--- a/pkgs/development/libraries/aws-c-auth/default.nix
+++ b/pkgs/development/libraries/aws-c-auth/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-auth";
-  version = "0.7.25";
+  version = "0.7.26";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-auth";
     rev = "v${version}";
-    hash = "sha256-pj2LnvF1/h8AQNc810U7oYWKun13+qPBNCbGPj3wKlo=";
+    hash = "sha256-02dy2xgMGWkLf+HyBztbkCcazfZNAMwpJPU2gGBPokY=";
   };
 
   nativeBuildInputs = [

From 0835b9f6deb1aeb59e68446a8c94a92c1c4bbff8 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 25 Aug 2024 09:57:06 +0100
Subject: [PATCH 061/115] wayland: 1.23.0 -> 1.23.1

---
 pkgs/development/libraries/wayland/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/wayland/default.nix b/pkgs/development/libraries/wayland/default.nix
index 8398dce70790..3cd2ba5dbe68 100644
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wayland";
-  version = "1.23.0";
+  version = "1.23.1";
 
   src = fetchurl {
     url = with finalAttrs; "https://gitlab.freedesktop.org/wayland/wayland/-/releases/${version}/downloads/${pname}-${version}.tar.xz";
-    hash = "sha256-BbPhV00+Z2JrWXT4YvNrW0J8fO65Zcs2pObC00LkWrI=";
+    hash = "sha256-hk+yqDmeLQ7DnVbp2bdTwJN3W+rcYCLOgfRBkpqB5e0=";
   };
 
   patches = [

From 5eee6cf40ad44fd4f21b76f26f54ca34a7f5e69e Mon Sep 17 00:00:00 2001
From: Ivan Trubach <mr.trubach@icloud.com>
Date: Wed, 24 Jul 2024 21:34:38 +0300
Subject: [PATCH 062/115] xar: 1.6.1 -> 498

This change switches the xar package from unmaintained fork of the
original project to the Apple Open Source tarball. See also
https://repology.org/project/xar/versions

Since the package is essentially rewritten from scratch, we take an
opportunity and move it to pkgs/by-name/xa/xar (formatted with nixfmt).

We also remove Windows from the supported platforms because even before
this change pkgsCross.mingwW64.xar failed with
xar> configure: error: can not detect the size of your system's uid_t type
---
 pkgs/by-name/xa/xar/package.nix               | 178 ++++
 ...e-tests-for-Python-3-and-Nix-sandbox.patch | 961 ++++++++++++++++++
 ...-Update-for-modern-liblzma5-versions.patch | 153 +++
 ...defined-EXT2_ECOMPR_FL-for-e2fsprogs.patch |  39 +
 ...4-Fix-compatibility-with-openssl-1.0.patch |  60 ++
 ...5-Fix-configure.ac-for-Linux-headers.patch | 123 +++
 .../0006-Fix-more-non-Darwin-stuff.patch      |  38 +
 ...lized-constant-with-define-statement.patch |  33 +
 ...ac-not-finding-AR-with-target-prefix.patch |  37 +
 ...d-useless-descriptions-to-AC_DEFINE.patch} |  42 +-
 ...ac-for-openssl-libxml2-liblzma-and-.patch} |  98 +-
 ...udes-and-silence-string-format-warni.patch | 104 ++
 ...-char-signedness-for-ARM-and-PowerPC.patch |  46 +
 ...Enable-extended-attributes-for-btrfs.patch |  43 +
 ...-segfault-when-copying-xattr-buffers.patch | 123 +++
 ...x-segfault-in-xar_attrcopy_from_heap.patch |  59 ++
 ...16-Do-not-set-property-for-empty-ACL.patch |  90 ++
 .../0017-Fix-time-format-for-musl.patch       |  75 ++
 ...Replace-memcpy-with-memmove-for-musl.patch |  25 +
 ...enSSL-over-CommonCrypto-if-available.patch | 150 +++
 pkgs/stdenv/darwin/default.nix                |   2 +-
 pkgs/tools/compression/xar/default.nix        |  49 -
 pkgs/top-level/all-packages.nix               |   2 -
 23 files changed, 2436 insertions(+), 94 deletions(-)
 create mode 100644 pkgs/by-name/xa/xar/package.nix
 create mode 100644 pkgs/by-name/xa/xar/patches/0001-Update-tests-for-Python-3-and-Nix-sandbox.patch
 create mode 100644 pkgs/by-name/xa/xar/patches/0002-Update-for-modern-liblzma5-versions.patch
 create mode 100644 pkgs/by-name/xa/xar/patches/0003-Fix-undefined-EXT2_ECOMPR_FL-for-e2fsprogs.patch
 create mode 100644 pkgs/by-name/xa/xar/patches/0004-Fix-compatibility-with-openssl-1.0.patch
 create mode 100644 pkgs/by-name/xa/xar/patches/0005-Fix-configure.ac-for-Linux-headers.patch
 create mode 100644 pkgs/by-name/xa/xar/patches/0006-Fix-more-non-Darwin-stuff.patch
 create mode 100644 pkgs/by-name/xa/xar/patches/0007-replace-initialized-constant-with-define-statement.patch
 create mode 100644 pkgs/by-name/xa/xar/patches/0008-Fix-configure.ac-not-finding-AR-with-target-prefix.patch
 rename pkgs/{tools/compression/xar/0001-Add-useless-descriptions-to-AC_DEFINE.patch => by-name/xa/xar/patches/0009-Add-useless-descriptions-to-AC_DEFINE.patch} (70%)
 rename pkgs/{tools/compression/xar/0002-Use-pkg-config-for-libxml2.patch => by-name/xa/xar/patches/0010-Update-configure.ac-for-openssl-libxml2-liblzma-and-.patch} (51%)
 create mode 100644 pkgs/by-name/xa/xar/patches/0011-Fix-missing-includes-and-silence-string-format-warni.patch
 create mode 100644 pkgs/by-name/xa/xar/patches/0012-Fix-char-signedness-for-ARM-and-PowerPC.patch
 create mode 100644 pkgs/by-name/xa/xar/patches/0013-Enable-extended-attributes-for-btrfs.patch
 create mode 100644 pkgs/by-name/xa/xar/patches/0014-Fix-segfault-when-copying-xattr-buffers.patch
 create mode 100644 pkgs/by-name/xa/xar/patches/0015-Fix-segfault-in-xar_attrcopy_from_heap.patch
 create mode 100644 pkgs/by-name/xa/xar/patches/0016-Do-not-set-property-for-empty-ACL.patch
 create mode 100644 pkgs/by-name/xa/xar/patches/0017-Fix-time-format-for-musl.patch
 create mode 100644 pkgs/by-name/xa/xar/patches/0018-Replace-memcpy-with-memmove-for-musl.patch
 create mode 100644 pkgs/by-name/xa/xar/patches/0019-Prefer-OpenSSL-over-CommonCrypto-if-available.patch
 delete mode 100644 pkgs/tools/compression/xar/default.nix

diff --git a/pkgs/by-name/xa/xar/package.nix b/pkgs/by-name/xa/xar/package.nix
new file mode 100644
index 000000000000..4ad071f36a1f
--- /dev/null
+++ b/pkgs/by-name/xa/xar/package.nix
@@ -0,0 +1,178 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  applyPatches,
+  autoreconfHook,
+  nix-update-script,
+
+  # Required dependencies.
+  openssl,
+  zlib,
+  libxml2,
+
+  # Optional dependencies.
+  e2fsprogs,
+  bzip2,
+  xz, # lzma
+
+  # Platform-specific dependencies.
+  acl,
+  musl-fts,
+
+  # for tests
+  testers,
+  python3,
+  libxslt, # xsltproc
+  runCommand,
+  runCommandCC,
+  makeWrapper,
+  xar,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xar";
+  version = "498";
+
+  src = fetchFromGitHub {
+    owner = "apple-oss-distributions";
+    repo = "xar";
+    rev = "xar-${finalAttrs.version}";
+    hash = "sha256-RyWeR/ZnDBHIZhwzVxETdrTTPQA2VgsLZegRkxX1240=";
+  };
+
+  # Update patch set with
+  #   git clone https://github.com/apple-oss-distributions/xar
+  #   cd xar
+  #   git switch -c nixpkgs
+  #   git am ../pkgs/by-name/xa/xar/patches/*
+  #   # …
+  #   rm -r ../pkgs/by-name/xa/xar/patches
+  #   git format-patch --zero-commit --output-directory ../pkgs/by-name/xa/xar/patches main
+  patches = lib.filesystem.listFilesRecursive ./patches;
+
+  # We do not use or modify files outside of the xar subdirectory.
+  patchFlags = [ "-p2" ];
+  sourceRoot = "source/xar";
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  # For some reason libxml2 package headers are in subdirectory and thus aren’t
+  # picked up by stdenv’s C compiler wrapper (see ccWrapper_addCVars). This
+  # doesn’t really belong here and either should be part of libxml2 package or
+  # libxml2 in Nixpkgs can just fix their header paths.
+  env.NIX_CFLAGS_COMPILE = "-isystem ${libxml2.dev}/include/libxml2";
+
+  buildInputs =
+    [
+      # NB we use OpenSSL instead of CommonCrypto on Darwin.
+      openssl
+      zlib
+      libxml2
+      bzip2
+      xz
+      e2fsprogs
+    ]
+    ++ lib.optional stdenv.hostPlatform.isLinux acl ++ lib.optional stdenv.hostPlatform.isMusl musl-fts;
+
+  passthru =
+    let
+      patchedSource = applyPatches { inherit (finalAttrs) src patches; };
+      pythonForTests = python3.withPackages (p: [ p.xattr ]);
+    in
+    {
+      # Tests xar outside of the Nix sandbox (extended attributes are not supported
+      # in Nix sandbox, e.g. filtered with seccomp on Linux).
+      #
+      # Run with
+      # $ nix run --file . xar.impureTests.integrationTest
+      # Ensure that all tests are PASSED and none are FAILED or SKIPPED.
+      impureTests.integrationTest =
+        runCommand "xar-impure-tests-integration-test"
+          {
+            src = patchedSource;
+            xar = finalAttrs.finalPackage;
+            xsltproc = lib.getBin libxslt;
+            pythonInterpreter = pythonForTests.interpreter;
+            nativeBuildInputs = [ makeWrapper ];
+          }
+          ''
+            makeWrapper "$pythonInterpreter" "$out/bin/$name" \
+              --prefix PATH : "$xar/bin" \
+              --suffix PATH : "$xsltproc/bin" \
+              --add-flags -- \
+              --add-flags "$src/xar/test/run-all.py"
+          '';
+
+      tests = lib.optionalAttrs (stdenv.buildPlatform.canExecute stdenv.hostPlatform) {
+        version = testers.testVersion {
+          package = finalAttrs.finalPackage;
+          version = "1.8dev";
+        };
+
+        integrationTest =
+          runCommand "xar-tests-integration-test"
+            {
+              src = patchedSource;
+              strictDeps = true;
+              pythonExecutable = pythonForTests.executable;
+              nativeBuildInputs = [
+                finalAttrs.finalPackage
+                pythonForTests
+                libxslt
+              ];
+            }
+            ''
+              "$pythonExecutable" "$src"/xar/test/run-all.py
+              touch "$out"
+            '';
+
+        smokeTest =
+          runCommandCC "xar-tests-smoke-test"
+            {
+              src = patchedSource;
+              strictDeps = true;
+              nativeBuildInputs = [ finalAttrs.finalPackage ];
+              buildInputs = [
+                finalAttrs.finalPackage
+                openssl
+              ];
+            }
+            ''
+              cp "$src"/xar/test/{buffer.c,validate.c} .
+              "$CC" -lxar -o buffer buffer.c
+              "$CC" -lxar -lcrypto -o validate validate.c
+              ./buffer validate.c
+              xar -x -f test.xar
+              diff validate.c mydir/secondfile
+              ./validate test.xar
+              touch "$out"
+            '';
+      };
+
+      updateScript = nix-update-script {
+        extraArgs = [
+          "--version-regex"
+          "xar-(.*)"
+        ];
+      };
+    };
+
+  meta = {
+    homepage = "https://github.com/apple-oss-distributions/xar";
+    description = "An easily extensible archive format";
+    license = lib.licenses.bsd3;
+    maintainers =
+      lib.teams.darwin.members
+      ++ lib.attrValues { inherit (lib.maintainers) copumpkin tie; };
+    platforms = lib.platforms.unix;
+    mainProgram = "xar";
+  };
+})
diff --git a/pkgs/by-name/xa/xar/patches/0001-Update-tests-for-Python-3-and-Nix-sandbox.patch b/pkgs/by-name/xa/xar/patches/0001-Update-tests-for-Python-3-and-Nix-sandbox.patch
new file mode 100644
index 000000000000..2b26cc1429df
--- /dev/null
+++ b/pkgs/by-name/xa/xar/patches/0001-Update-tests-for-Python-3-and-Nix-sandbox.patch
@@ -0,0 +1,961 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ivan Trubach <mr.trubach@icloud.com>
+Date: Sat, 27 Jul 2024 12:53:54 +0300
+Subject: [PATCH 01/19] Update tests for Python 3 and Nix sandbox
+
+This change updates integration tests for Python 3 and fixes some
+assumptions to work under Nix sandbox (in particular, extended
+attributes are not allowed).
+
+Also updates xar/test/validate.c for modern OpenSSL versions.
+---
+ xar/test/attr.py        | 54 +++++++++++++++++++-------
+ xar/test/buffer.c       |  3 +-
+ xar/test/checksums.py   | 75 +++++++++++++++++++-----------------
+ xar/test/compression.py | 27 ++++++++-----
+ xar/test/data.py        | 19 +++++----
+ xar/test/hardlink.py    | 12 ++++--
+ xar/test/heap.py        | 27 +++++++------
+ xar/test/integrity.py   | 45 ++++++++++++----------
+ xar/test/run-all.py     | 25 ++++++++++++
+ xar/test/util.py        | 85 ++++++++++++++++++++++++++++++++++++-----
+ xar/test/validate.c     | 32 +++++++++-------
+ 11 files changed, 282 insertions(+), 122 deletions(-)
+ create mode 100755 xar/test/run-all.py
+
+diff --git a/xar/test/attr.py b/xar/test/attr.py
+index adc2c56..c28a4e6 100755
+--- a/xar/test/attr.py
++++ b/xar/test/attr.py
+@@ -6,6 +6,7 @@ import os
+ import os.path
+ import shutil
+ import subprocess
++import sys
+ import xattr
+ 
+ import util
+@@ -26,20 +27,27 @@ import util
+ class MissingExtendedAttributeError(AssertionError):
+ 	pass
+ 
+-def _random_big_data(bytes=65536, path="/dev/random"):
++def _random_big_data(bytes=65536):
+ 	"""
+ 	Returns a random string with the number of bytes requested. Due to xar
+ 	implementation details, this should be greater than 4096 (32768 for
+ 	compressed heap testing).
+ 	
+ 	"""
+-	with open(path, "r") as f:
+-		return f.read(bytes)
++	return os.urandom(bytes)
++
++def _to_bytes(s):
++	if isinstance(s, str):
++		return s.encode("utf-8")
++	return s
+ 
+ def _test_xattr_on_file_with_contents(filename, file_contents, xattrs=[], xar_create_flags=[], xar_extract_flags=[]):
++	file_contents = _to_bytes(file_contents)
++	xattr_prefix = "user." if sys.platform != "darwin" else ""
++	xattrs = [(xattr_prefix + k, _to_bytes(v)) for k, v in xattrs]
+ 	try:
+ 		# Write file out
+-		with open(filename, "w") as f:
++		with open(filename, "wb") as f:
+ 			f.write(file_contents)
+ 			for (key, value) in xattrs:
+ 				xattr.setxattr(f, key, value)
+@@ -51,14 +59,16 @@ def _test_xattr_on_file_with_contents(filename, file_contents, xattrs=[], xar_cr
+ 			with util.directory_created("extracted") as directory:
+ 				# Validate resulting xattrs
+ 				subprocess.check_call(["xar", "-x", "-C", directory, "-f", path] + xar_extract_flags)
++				extracted_filename = os.path.join(directory, filename)
++				expected_set = {key for key, _ in xattrs}
++				actual_set = set(xattr.listxattr(os.path.join(directory, filename)))
++				for key in expected_set - actual_set:
++					raise MissingExtendedAttributeError("extended attribute \"{n}\" missing after extraction".format(n=key))
+ 				for (key, value) in xattrs:
+-					try:
+-						assert xattr.getxattr(os.path.join(directory, filename), key) == value, "extended attribute \"{n}\" has incorrect contents after extraction".format(n=key)
+-					except KeyError:
+-						raise MissingExtendedAttributeError("extended attribute \"{n}\" missing after extraction".format(n=key))
++					assert xattr.getxattr(extracted_filename, key) == value, "extended attribute \"{n}\" has incorrect contents after extraction".format(n=key)
+ 				
+ 				# Validate file contents
+-				with open(os.path.join(directory, filename), "r") as f:
++				with open(os.path.join(directory, filename), "rb") as f:
+ 					if f.read() != file_contents:
+ 						raise MissingExtendedAttributeError("archived file \"{f}\" has has incorrect contents after extraction".format(f=filename))
+ 	finally:
+@@ -73,36 +83,47 @@ def _test_xattr_on_file_with_contents(filename, file_contents, xattrs=[], xar_cr
+ #       tests are commented out awaiting a day when this might be different.
+ 
+ # def empty_xattr_empty_file(filename):
++# 	util.skip_if_no_xattrs_support()
+ # 	_test_xattr_on_file_with_contents(filename, "", xattrs=[("foo", "")])
+ 
+ def small_xattr_empty_file(filename):
++	util.skip_if_no_xattrs_support()
+ 	_test_xattr_on_file_with_contents(filename, "", xattrs=[("foo", "1234")])
+ 
+ def large_xattr_empty_file(filename):
++	util.skip_if_no_xattrs_support()
+ 	_test_xattr_on_file_with_contents(filename, "", xattrs=[("foo", _random_big_data(5000))])
+ 
+ # def empty_xattr_small_file(filename):
++# 	util.skip_if_no_xattrs_support()
+ # 	_test_xattr_on_file_with_contents(filename, "small.file.contents", xattrs=[("foo", "")])
+ 
+ def small_xattr_small_file(filename):
++	util.skip_if_no_xattrs_support()
+ 	_test_xattr_on_file_with_contents(filename, "small.file.contents", xattrs=[("foo", "1234")])
+ 
+ def large_xattr_small_file(filename):
++	util.skip_if_no_xattrs_support()
+ 	_test_xattr_on_file_with_contents(filename, "small.file.contents", xattrs=[("foo", _random_big_data(4567))])
+ 
+ # def empty_xattr_large_file(filename):
++# 	util.skip_if_no_xattrs_support()
+ # 	_test_xattr_on_file_with_contents(filename, _random_big_data(10000000), xattrs=[("foo", "")])
+ 
+ def small_xattr_large_file(filename):
++	util.skip_if_no_xattrs_support()
+ 	_test_xattr_on_file_with_contents(filename, _random_big_data(5000000), xattrs=[("foo", "1234")])
+ 
+ def large_xattr_large_file(filename):
++	util.skip_if_no_xattrs_support()
+ 	_test_xattr_on_file_with_contents(filename, _random_big_data(9876543), xattrs=[("foo", _random_big_data(6543))])
+ 
+ def multiple_xattrs(filename):
++	util.skip_if_no_xattrs_support()
+ 	_test_xattr_on_file_with_contents(filename, "", xattrs=[("foo", "bar"), ("baz", "1234"), ("quux", "more")]) # ("empty", "")
+ 
+ def distribution_create(filename):
++	util.skip_if_no_xattrs_support()
+ 	try:
+ 		_test_xattr_on_file_with_contents(filename, "dummy", xattrs=[("foo", "bar")], xar_create_flags=["--distribution"])
+ 	except MissingExtendedAttributeError:
+@@ -114,6 +135,7 @@ def distribution_create(filename):
+ #       when it can.
+ 
+ # def distribution_extract(filename):
++# 	util.skip_if_no_xattrs_support()
+ # 	try:
+ # 		_test_xattr_on_file_with_contents(filename, "dummy", xattrs=[("foo", "bar")], xar_extract_flags=["--distribution"])
+ # 	except MissingExtendedAttributeError:
+@@ -128,12 +150,18 @@ TEST_CASES = (small_xattr_empty_file, large_xattr_empty_file,
+               multiple_xattrs, distribution_create)
+ 
+ if __name__ == "__main__":
++	failed = False
+ 	for case in TEST_CASES:
++		func_name = case.__name__
+ 		try:
+-			case(case.func_name)
+-			print("PASSED: {f}".format(f=case.func_name))
++			case(func_name)
++			print("PASSED: {f}".format(f=func_name))
+ 		except (AssertionError, IOError, subprocess.CalledProcessError):
+-			import sys, os
+-			print("FAILED: {f}".format(f=case.func_name))
++			failed = True
++			print("FAILED: {f}".format(f=func_name))
+ 			sys.excepthook(*sys.exc_info())
+ 			print("")
++		except util.TestCaseSkipError as e:
++			print("SKIPPED: {f}: {m}".format(f=func_name, m=e))
++	if failed:
++		sys.exit(1)
+diff --git a/xar/test/buffer.c b/xar/test/buffer.c
+index a353cef..e4c5639 100644
+--- a/xar/test/buffer.c
++++ b/xar/test/buffer.c
+@@ -1,5 +1,6 @@
+ #include <stdlib.h>
+ #include <stdio.h>
++#include <unistd.h>
+ #include <sys/stat.h>
+ #include <sys/fcntl.h>
+ #include <string.h>
+@@ -50,7 +51,7 @@ int main(int argc, char *argv[])
+ 	if( red < sb.st_size )
+ 		fprintf(stderr, "Incomplete read\n");
+ 
+-	x = xar_open("/tmp/test.xar", WRITE);
++	x = xar_open("test.xar", WRITE);
+  	if( x == NULL ) {
+ 		fprintf(stderr, "Error creating xarchive\n");
+ 		exit(6);
+diff --git a/xar/test/checksums.py b/xar/test/checksums.py
+index 7080d7c..0f39e63 100755
+--- a/xar/test/checksums.py
++++ b/xar/test/checksums.py
+@@ -2,6 +2,7 @@
+ 
+ from __future__ import print_function
+ 
++import contextlib
+ import hashlib
+ import os
+ import os.path
+@@ -9,6 +10,7 @@ import re
+ import shutil
+ import struct
+ import subprocess
++import sys
+ 
+ import util
+ 
+@@ -17,15 +19,21 @@ import util
+ # Utility Functions
+ # 
+ 
++@contextlib.contextmanager
++def _test_archive_created(filename, directory, *args, **kwargs):
++	with util.test_directory_created(directory) as test_directory:
++		with util.archive_created(filename, test_directory, *args, **kwargs) as path:
++			yield path
++
+ def _get_numeric_value_from_header(archive_name, key):
+ 	"""
+ 	Dumps the header of the specified xar archive and extracts the header
+ 	size from the output, in bytes.
+ 	
+ 	"""
+-	header = subprocess.check_output(["xar", "--dump-header", "-f", archive_name])
++	header = subprocess.check_output(["xar", "--dump-header", "-f", archive_name], text=True)
+ 	for line in header.splitlines():
+-		matchdata = re.match("^(.+):\s+(.+)$", line) # magic: 0x78617221 (OK)
++		matchdata = re.match(r"^(.+):\s+(.+)$", line) # magic: 0x78617221 (OK)
+ 		assert matchdata, "unexpected output from `xar --dump-header`:\n{h}".format(h=header)
+ 		if matchdata.groups()[0] == key:
+ 			return int(matchdata.groups()[1])
+@@ -38,17 +46,14 @@ def _get_toc_size(archive_name):
+ 	return _get_numeric_value_from_header(archive_name, "Compressed TOC length")
+ 
+ def _clobber_bytes_at(clobber_range, path):
+-	with open(path, "r+") as f:
++	with open(path, "rb+") as f:
+ 		f.seek(clobber_range[0])
+-		with open("/dev/random", "r") as r:
+-			random_bytes = r.read(len(clobber_range))
+-			f.write(random_bytes)
++		f.write(os.urandom(len(clobber_range)))
+ 
+ def _verify_extraction_failed(filename):
+ 	with util.directory_created("extracted") as directory:
+ 		try:
+-			with open("/dev/null", "w") as n:
+-				returncode = subprocess.call(["xar", "-x", "-C", directory, "-f", filename], stdout=n, stderr=n)
++			returncode = subprocess.call(["xar", "-x", "-C", directory, "-f", filename], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+ 			assert returncode != 0, "xar reported success extracting an archive with a broken TOC"
+ 		finally:
+ 			if os.path.exists(directory):
+@@ -63,7 +68,7 @@ def _verify_header_checksum(filename, algorithm):
+ 	header_size = _get_header_size(filename)
+ 	toc_length = _get_toc_size(filename)
+ 	
+-	with open(filename, "r") as f:
++	with open(filename, "rb") as f:
+ 		f.seek(header_size)
+ 		h = hashlib.new(algorithm, f.read(toc_length))
+ 		computed_digest = h.digest()
+@@ -76,23 +81,23 @@ def _verify_header_checksum(filename, algorithm):
+ # 
+ 
+ def default_toc_checksum_validity(filename):
+-	with util.archive_created(filename, "/bin") as path:
++	with _test_archive_created(filename, "testdir") as path:
+ 		_verify_header_checksum(path, "sha1")
+ 
+ def sha1_toc_checksum_validity(filename):
+-	with util.archive_created(filename, "/bin", "--toc-cksum", "sha1") as path:
++	with _test_archive_created(filename, "testdir", "--toc-cksum", "sha1") as path:
+ 		_verify_header_checksum(path, "sha1")
+ 
+ def sha256_toc_checksum_validity(filename):
+-	with util.archive_created(filename, "/bin", "--toc-cksum", "sha256") as path:
++	with _test_archive_created(filename, "testdir", "--toc-cksum", "sha256") as path:
+ 		_verify_header_checksum(path, "sha256")
+ 
+ def sha512_toc_checksum_validity(filename):
+-	with util.archive_created(filename, "/bin", "--toc-cksum", "sha512") as path:
++	with _test_archive_created(filename, "testdir", "--toc-cksum", "sha512") as path:
+ 		_verify_header_checksum(path, "sha512")
+ 
+ def broken_toc_default_checksum(filename):
+-	with util.archive_created(filename, "/bin") as path:
++	with _test_archive_created(filename, "testdir") as path:
+ 		# Mess up the archive
+ 		toc_start = _get_header_size(path)
+ 		_clobber_bytes_at(range(toc_start + 4, toc_start + 4 + 100), path) # Why did the original test specify 4? No idea.
+@@ -101,7 +106,7 @@ def broken_toc_default_checksum(filename):
+ 		_verify_extraction_failed(filename)
+ 		
+ def broken_toc_sha1_checksum(filename):
+-	with util.archive_created(filename, "/bin", "--toc-cksum", "sha1") as path:
++	with _test_archive_created(filename, "testdir", "--toc-cksum", "sha1") as path:
+ 		# Mess up the archive
+ 		toc_start = _get_header_size(path)
+ 		_clobber_bytes_at(range(toc_start + 4, toc_start + 4 + 100), path) # Why did the original test specify 4? No idea.
+@@ -110,7 +115,7 @@ def broken_toc_sha1_checksum(filename):
+ 		_verify_extraction_failed(filename)
+ 
+ def broken_toc_sha256_checksum(filename):
+-	with util.archive_created(filename, "/bin", "--toc-cksum", "sha256") as path:
++	with _test_archive_created(filename, "testdir", "--toc-cksum", "sha256") as path:
+ 		# Mess up the archive
+ 		toc_start = _get_header_size(path)
+ 		_clobber_bytes_at(range(toc_start + 4, toc_start + 4 + 100), path) # Why did the original test specify 4? No idea.
+@@ -119,7 +124,7 @@ def broken_toc_sha256_checksum(filename):
+ 		_verify_extraction_failed(filename)
+ 
+ def broken_toc_sha512_checksum(filename):
+-	with util.archive_created(filename, "/bin", "--toc-cksum", "sha512") as path:
++	with _test_archive_created(filename, "testdir", "--toc-cksum", "sha512") as path:
+ 		# Mess up the archive
+ 		toc_start = _get_header_size(path)
+ 		_clobber_bytes_at(range(toc_start + 4, toc_start + 4 + 100), path) # Why did the original test specify 4? No idea.
+@@ -128,7 +133,7 @@ def broken_toc_sha512_checksum(filename):
+ 		_verify_extraction_failed(filename)
+ 
+ def broken_heap_default_checksum(filename):
+-	with util.archive_created(filename, "/bin") as path:
++	with _test_archive_created(filename, "testdir") as path:
+ 		# Mess up the archive
+ 		toc_start = _get_header_size(path)
+ 		toc_size = _get_toc_size(path)
+@@ -139,11 +144,11 @@ def broken_heap_default_checksum(filename):
+ 		_verify_extraction_failed(filename)
+ 
+ def default_checksum_algorithm(filename):
+-	with util.archive_created(filename, "/bin") as path:
+-		header = subprocess.check_output(["xar", "--dump-header", "-f", path])
++	with _test_archive_created(filename, "testdir") as path:
++		header = subprocess.check_output(["xar", "--dump-header", "-f", path], text=True)
+ 		found = False
+ 		for line in header.splitlines():
+-			matchdata = re.match("^Checksum algorithm:\s+(\d+)\s+\\((\w+)\\)$", line)
++			matchdata = re.match(r"^Checksum algorithm:\s+(\d+)\s+\((\w+)\)$", line)
+ 			if not matchdata:
+ 				continue
+ 			found = True
+@@ -156,7 +161,7 @@ def default_checksum_algorithm(filename):
+ # 
+ # def invalid_checksum_algorithm(filename):
+ # 	try:
+-# 		with util.archive_created(filename, "/bin", "--toc-cksum", "invalid-algorithm") as path:
++# 		with _test_archive_created(filename, "testdir", "--toc-cksum", "invalid-algorithm") as path:
+ # 			raise AssertionError("xar succeeded when it should have failed")
+ # 	except subprocess.CalledProcessError:
+ # 		pass
+@@ -164,17 +169,15 @@ def default_checksum_algorithm(filename):
+ # It does fail for md5 explicitly, however
+ def md5_toc_checksum_failure(filename):
+ 	try:
+-		with open("/dev/null", "a") as devnull:
+-			with util.archive_created(filename, "/bin", "--toc-cksum", "md5", stderr=devnull) as path:
+-				raise AssertionError("xar succeeded when it should have failed")
++		with _test_archive_created(filename, "testdir", "--toc-cksum", "md5", stderr=subprocess.DEVNULL) as path:
++			raise AssertionError("xar succeeded when it should have failed")
+ 	except subprocess.CalledProcessError:
+ 		pass
+ 
+ def md5_file_checksum_failure(filename):
+ 	try:
+-		with open("/dev/null", "a") as devnull:
+-			with util.archive_created(filename, "/bin", "--file-cksum", "md5", stderr=devnull) as path:
+-				raise AssertionError("xar succeeded when it should have failed")
++		with _test_archive_created(filename, "testdir", "--file-cksum", "md5", stderr=subprocess.DEVNULL) as path:
++			raise AssertionError("xar succeeded when it should have failed")
+ 	except subprocess.CalledProcessError:
+ 		pass
+ 
+@@ -185,8 +188,8 @@ def _verify_checksum_algorithm(filename, algorithm):
+ 	else:
+ 		algorithm = "sha1"
+ 	
+-	with util.archive_created(filename, "/bin", *additional_args) as path:
+-		toc = subprocess.check_output(["xar", "--dump-toc=-", "-f", path])
++	with _test_archive_created(filename, "testdir", *additional_args) as path:
++		toc = subprocess.check_output(["xar", "--dump-toc=-", "-f", path], text=True)
+ 		found = False
+ 		for line in toc.splitlines():
+ 			if '<unarchived-checksum style="{a}">'.format(a=algorithm) in line or '<archived-checksum style="{a}">'.format(a=algorithm) in line:
+@@ -214,12 +217,16 @@ TEST_CASES = (default_toc_checksum_validity, sha1_toc_checksum_validity, sha256_
+               md5_toc_checksum_failure, md5_file_checksum_failure,)
+ 
+ if __name__ == "__main__":
++	failed = False
+ 	for case in TEST_CASES:
++		func_name = case.__name__
+ 		try:
+-			case("{f}.xar".format(f=case.func_name))
+-			print("PASSED: {f}".format(f=case.func_name))
++			case("{f}.xar".format(f=func_name))
++			print("PASSED: {f}".format(f=func_name))
+ 		except (AssertionError, IOError, subprocess.CalledProcessError):
+-			import sys, os
+-			print("FAILED: {f}".format(f=case.func_name))
++			failed = True
++			print("FAILED: {f}".format(f=func_name))
+ 			sys.excepthook(*sys.exc_info())
+ 			print("")
++	if failed:
++		sys.exit(1)
+diff --git a/xar/test/compression.py b/xar/test/compression.py
+index 2b3b2ec..7ed30ca 100755
+--- a/xar/test/compression.py
++++ b/xar/test/compression.py
+@@ -2,10 +2,10 @@
+ 
+ from __future__ import print_function
+ 
+-import cStringIO
+ import os
+ import os.path
+ import subprocess
++import sys
+ import tempfile
+ 
+ import util
+@@ -16,10 +16,15 @@ import util
+ # 
+ 
+ def _check_compression(filename, *args, **kwargs):
+-	with util.archive_created(filename, "/bin", *args, **kwargs) as path:
++	with (
++		util.directory_created("temp") as temp_directory,
++		util.chdir(temp_directory),
++		util.test_directory_created("testdir") as test_directory,
++		util.archive_created(filename, "testdir", *args, **kwargs) as path,
++	):
+ 		with util.directory_created("extracted") as directory:
+ 			subprocess.check_call(["xar", "-x", "-f", path, "-C", directory])
+-			util.assert_identical_directories("/bin", os.path.join(directory, "bin"))
++			util.assert_identical_directories(test_directory, os.path.join(directory, "testdir"))
+ 
+ 
+ # 
+@@ -61,14 +66,18 @@ TEST_CASES = (no_compression, default_compression,
+               gzip_compression_short, bzip2_compression_short, lzma_compression_short)
+ 
+ if __name__ == "__main__":
++	failed = False
+ 	for case in TEST_CASES:
++		func_name = case.__name__
+ 		try:
+-			case("{f}.xar".format(f=case.func_name))
+-			print("PASSED: {f}".format(f=case.func_name))
++			case("{f}.xar".format(f=func_name))
++			print("PASSED: {f}".format(f=func_name))
+ 		except (AssertionError, IOError, subprocess.CalledProcessError):
+-			import sys, os
+-			print("FAILED: {f}".format(f=case.func_name))
++			failed = True
++			print("FAILED: {f}".format(f=func_name))
+ 			sys.excepthook(*sys.exc_info())
+ 			print("")
+-		except util.TestCaseSkipError, e:
+-			print("SKIPPED: {f}: {m}".format(f=case.func_name, m=e.message))
++		except util.TestCaseSkipError as e:
++			print("SKIPPED: {f}: {m}".format(f=func_name, m=e))
++	if failed:
++		sys.exit(1)
+diff --git a/xar/test/data.py b/xar/test/data.py
+index a9793f0..f902b78 100755
+--- a/xar/test/data.py
++++ b/xar/test/data.py
+@@ -6,6 +6,7 @@ import contextlib
+ import os
+ import os.path
+ import subprocess
++import sys
+ import util
+ 
+ 
+@@ -28,7 +29,7 @@ def _process_toc(archive_path):
+ 	subprocess.check_call(["xar", "-f", archive_path, "--dump-toc=data_toc.xml"])
+ 	try:
+ 		result = subprocess.check_output(["xsltproc", "-o", "-", os.path.realpath(os.path.join(__file__, "..", "data.xsl")), "data_toc.xml"])
+-		assert result == "", "expected no data offset, but instead found:{o}".format(o=result)
++		assert result == b"", "expected no data offset, but instead found:{o}".format(o=result)
+ 	finally:
+ 		os.unlink("data_toc.xml")
+ 
+@@ -90,14 +91,18 @@ TEST_CASES = (zero_length_default_compression, zero_length_no_compression,
+               mixed_length_gzip_compression, mixed_length_bzip2_compression, mixed_length_lzma_compression)
+ 
+ if __name__ == "__main__":
++	failed = False
+ 	for case in TEST_CASES:
++		func_name = case.__name__
+ 		try:
+-			case("{f}.xar".format(f=case.func_name))
+-			print("PASSED: {f}".format(f=case.func_name))
++			case("{f}.xar".format(f=func_name))
++			print("PASSED: {f}".format(f=func_name))
+ 		except (AssertionError, IOError, subprocess.CalledProcessError):
+-			import sys, os
+-			print("FAILED: {f}".format(f=case.func_name))
++			failed = True
++			print("FAILED: {f}".format(f=func_name))
+ 			sys.excepthook(*sys.exc_info())
+ 			print("")
+-		except util.TestCaseSkipError, e:
+-			print("SKIPPED: {f}: {m}".format(f=case.func_name, m=e.message))
++		except util.TestCaseSkipError as e:
++			print("SKIPPED: {f}: {m}".format(f=func_name, m=e))
++	if failed:
++		sys.exit(1)
+diff --git a/xar/test/hardlink.py b/xar/test/hardlink.py
+index 5145216..da409d6 100755
+--- a/xar/test/hardlink.py
++++ b/xar/test/hardlink.py
+@@ -5,6 +5,7 @@ from __future__ import print_function
+ import os
+ import os.path
+ import subprocess
++import sys
+ 
+ import util
+ 
+@@ -58,12 +59,17 @@ def hard_link_identical_files(filename):
+ TEST_CASES = (hard_link_in_directory, hard_link_in_cwd, hard_link_identical_files)
+ 
+ if __name__ == "__main__":
++	failed = False
+ 	for case in TEST_CASES:
++		func_name = case.__name__
+ 		try:
+-			case("{f}.xar".format(f=case.func_name))
+-			print("PASSED: {f}".format(f=case.func_name))
++			case("{f}.xar".format(f=func_name))
++			print("PASSED: {f}".format(f=func_name))
+ 		except (AssertionError, IOError, subprocess.CalledProcessError):
++			failed = True
+ 			import sys, os
+-			print("FAILED: {f}".format(f=case.func_name))
++			print("FAILED: {f}".format(f=func_name))
+ 			sys.excepthook(*sys.exc_info())
+ 			print("")
++	if failed:
++		sys.exit(1)
+diff --git a/xar/test/heap.py b/xar/test/heap.py
+index f431c77..727412a 100755
+--- a/xar/test/heap.py
++++ b/xar/test/heap.py
+@@ -8,6 +8,7 @@ import os.path
+ import re
+ import shutil
+ import subprocess
++import sys
+ 
+ import util
+ 
+@@ -19,8 +20,8 @@ import util
+ def _file_offsets_for_archive(path, xsl_path):
+ 	subprocess.check_call(["xar", "--dump-toc=heap_toc.xml", "-f", path])
+ 	try:
+-		offsets = subprocess.check_output(["xsltproc", xsl_path, "heap_toc.xml"])
+-		matches = [re.match("^(.+)\s([^\s]+)$", offset) for offset in offsets.splitlines()]
++		offsets = subprocess.check_output(["xsltproc", xsl_path, "heap_toc.xml"], text=True)
++		matches = [re.match(r"^(.+)\s([^\s]+)$", offset) for offset in offsets.splitlines()]
+ 		offsets = [(match.groups()[0], int(match.groups()[1])) for match in matches]
+ 		return offsets
+ 	finally:
+@@ -33,9 +34,8 @@ def _file_offsets_for_archive(path, xsl_path):
+ XSL_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), "heap1.xsl")
+ 
+ def normal_heap(filename):
+-	with util.directory_created("scratch") as directory:
+-		shutil.copy("/bin/ls", os.path.join(directory, "ls"))
+-		shutil.copy(os.path.join(directory, "ls"), os.path.join(directory, "foo"))
++	with util.test_directory_created("scratch") as directory:
++		shutil.copy(os.path.join(directory, "script"), os.path.join(directory, "foo"))
+ 		with util.chdir(directory):
+ 			with util.archive_created(os.path.join("..", "heap.xar"), ".") as path:
+ 				# Verify file offsets are as we expect
+@@ -50,9 +50,8 @@ def normal_heap(filename):
+ 					subprocess.check_call(["xar", "-x", "-f", path, "-C", extracted])
+ 
+ def coalesce_heap(filename):
+-	with util.directory_created("scratch") as directory:
+-		shutil.copy("/bin/ls", os.path.join(directory, "ls"))
+-		shutil.copy(os.path.join(directory, "ls"), os.path.join(directory, "foo"))
++	with util.test_directory_created("scratch") as directory:
++		shutil.copy(os.path.join(directory, "script"), os.path.join(directory, "foo"))
+ 		with util.chdir(directory):
+ 			with util.archive_created(os.path.join("..", "heap.xar"), ".", "--coalesce-heap") as path:
+ 				# Verify file offsets are as we expect
+@@ -67,12 +66,16 @@ def coalesce_heap(filename):
+ TEST_CASES = (normal_heap, coalesce_heap)
+ 
+ if __name__ == "__main__":
++	failed = False
+ 	for case in TEST_CASES:
++		func_name = case.__name__
+ 		try:
+-			case("{f}.xar".format(f=case.func_name))
+-			print("PASSED: {f}".format(f=case.func_name))
++			case("{f}.xar".format(f=func_name))
++			print("PASSED: {f}".format(f=func_name))
+ 		except (AssertionError, IOError, subprocess.CalledProcessError):
+-			import sys, os
+-			print("FAILED: {f}".format(f=case.func_name))
++			failed = True
++			print("FAILED: {f}".format(f=func_name))
+ 			sys.excepthook(*sys.exc_info())
+ 			print("")
++	if failed:
++		sys.exit(1)
+diff --git a/xar/test/integrity.py b/xar/test/integrity.py
+index c47ac6a..f4d2af7 100755
+--- a/xar/test/integrity.py
++++ b/xar/test/integrity.py
+@@ -5,6 +5,7 @@ from __future__ import print_function
+ import os
+ import os.path
+ import subprocess
++import sys
+ 
+ import util
+ 
+@@ -12,9 +13,9 @@ import util
+ # Utility Functions
+ # 
+ 
+-def _test_truncation(filename, path_to_be_archived, bytes_to_chop, *args):
+-	with util.archive_created(filename, path_to_be_archived) as path:
+-		with open("/dev/null", "w") as bitbucket:
++def _test_truncation(filename, bytes_to_chop, *args):
++	with util.test_directory_created("testdir") as test_directory:
++		with util.archive_created(filename, test_directory) as path:
+ 			size = os.stat(path).st_size
+ 			while size > 0:
+ 				last_size = size
+@@ -23,7 +24,7 @@ def _test_truncation(filename, path_to_be_archived, bytes_to_chop, *args):
+ 					f.truncate(size)
+ 			
+ 				with util.directory_created("scratch") as directory:
+-					returncode = subprocess.call(["xar", "-x", "-f", path, "-C", directory], stderr=bitbucket)
++					returncode = subprocess.call(["xar", "-x", "-f", path, "-C", directory], stderr=subprocess.DEVNULL)
+ 					assert returncode != 0, "xar claimed to succeed when extracting a truncated archive"
+ 
+ # 
+@@ -31,42 +32,42 @@ def _test_truncation(filename, path_to_be_archived, bytes_to_chop, *args):
+ #
+ 
+ def large_uncompressed(filename):
+-	_test_truncation(filename, "/usr/share/man/man1", 1024 * 1024, "--compression=none")
++	_test_truncation(filename, 1024 * 1024, "--compression=none")
+ 	
+ def large_default_compression(filename):
+-	_test_truncation(filename, "/usr/share/man/man1", 1024 * 1024)
++	_test_truncation(filename, 1024 * 1024)
+ 
+ def large_gzip_compressed(filename):
+ 	util.skip_if_no_compression_support("gzip")
+-	_test_truncation(filename, "/usr/share/man/man1", 1024 * 1024, "--compression=gzip")
++	_test_truncation(filename, 1024 * 1024, "--compression=gzip")
+ 
+ def large_bzip2_compressed(filename):
+ 	util.skip_if_no_compression_support("bzip2")
+-	_test_truncation(filename, "/usr/share/man/man1", 1024 * 1024, "--compression=bzip2")
++	_test_truncation(filename, 1024 * 1024, "--compression=bzip2")
+ 
+ def large_lzma_compressed(filename):
+ 	util.skip_if_no_compression_support("lzma")
+-	_test_truncation(filename, "/usr/share/man/man1", 1024 * 1024, "--compression=lzma")
++	_test_truncation(filename, 1024 * 1024, "--compression=lzma")
+ 
+ # "small" variants use a non-base-2 size to try to catch issues that occur on uneven boundaries
+ 
+ def small_uncompressed(filename):
+-	_test_truncation(filename, "/bin", 43651, "--compression=none")
++	_test_truncation(filename, 43651, "--compression=none")
+ 
+ def small_default_compression(filename):
+-	_test_truncation(filename, "/bin", 43651)
++	_test_truncation(filename, 43651)
+ 
+ def small_gzip_compressed(filename):
+ 	util.skip_if_no_compression_support("gzip")
+-	_test_truncation(filename, "/bin", 43651, "--compression=gzip")
++	_test_truncation(filename, 43651, "--compression=gzip")
+ 
+ def small_bzip2_compressed(filename):
+ 	util.skip_if_no_compression_support("bzip2")
+-	_test_truncation(filename, "/bin", 43651, "--compression=bzip2")
++	_test_truncation(filename, 43651, "--compression=bzip2")
+ 
+ def small_lzma_compressed(filename):
+ 	util.skip_if_no_compression_support("lzma")
+-	_test_truncation(filename, "/bin", 43651, "--compression=lzma")
++	_test_truncation(filename, 43651, "--compression=lzma")
+ 
+ 
+ TEST_CASES = (large_uncompressed, large_default_compression,
+@@ -75,14 +76,18 @@ TEST_CASES = (large_uncompressed, large_default_compression,
+               small_gzip_compressed, small_bzip2_compressed, small_lzma_compressed)
+ 
+ if __name__ == "__main__":
++	failed = False
+ 	for case in TEST_CASES:
++		func_name = case.__name__
+ 		try:
+-			case("{f}.xar".format(f=case.func_name))
+-			print("PASSED: {f}".format(f=case.func_name))
++			case("{f}.xar".format(f=func_name))
++			print("PASSED: {f}".format(f=func_name))
+ 		except (AssertionError, IOError, subprocess.CalledProcessError):
+-			import sys, os
+-			print("FAILED: {f}".format(f=case.func_name))
++			failed = True
++			print("FAILED: {f}".format(f=func_name))
+ 			sys.excepthook(*sys.exc_info())
+ 			print("")
+-		except util.TestCaseSkipError, e:
+-			print("SKIPPED: {f}: {m}".format(f=case.func_name, m=e.message))
++		except util.TestCaseSkipError as e:
++			print("SKIPPED: {f}: {m}".format(f=func_name, m=e))
++	if failed:
++		sys.exit(1)
+diff --git a/xar/test/run-all.py b/xar/test/run-all.py
+new file mode 100755
+index 0000000..05e3054
+--- /dev/null
++++ b/xar/test/run-all.py
+@@ -0,0 +1,25 @@
++#!/usr/bin/env python3
++
++import os.path
++import subprocess
++import sys
++
++test_suites = [
++	"attr.py",
++	"checksums.py",
++	"compression.py",
++	"data.py",
++	"hardlink.py",
++	"heap.py",
++	"integrity.py",
++]
++
++test_path = os.path.dirname(__file__)
++
++failed = False
++for suite in test_suites:
++	p = subprocess.run([sys.executable, "--", os.path.join(test_path, suite)])
++	if p.returncode:
++		failed = True
++if failed:
++	sys.exit(1)
+diff --git a/xar/test/util.py b/xar/test/util.py
+index da79925..423dd3c 100644
+--- a/xar/test/util.py
++++ b/xar/test/util.py
+@@ -1,6 +1,8 @@
+ #!/usr/bin/env python
+ 
+ import contextlib
++import errno
++import functools
+ import hashlib
+ import os
+ import os.path
+@@ -13,16 +15,65 @@ import xattr
+ class TestCaseSkipError(Exception):
+ 	pass
+ 
++@functools.cache
++def _check_xattrs_supported():
++	"""
++	Returns True if the filesystem supports extended attributes.
++	"""
++	with directory_created("empty") as directory:
++		try:
++			xattr.setxattr(directory, "user.xattrcheck", b"supported")
++			return True
++		except OSError as e:
++			if e.errno != errno.ENOTSUP:
++				raise
++	return False
++
++def skip_if_no_xattrs_support():
++	"""
++	Raises TestCaseSkipError if the the filesystem does not support extended
++	attributes.
++	"""
++	if not _check_xattrs_supported():
++		raise TestCaseSkipError("filesystem does not support extended attributes")
++
++@functools.cache
++def _check_compression_supported(type):
++	"""
++	Returns True if xar has support for the given compression type compiled
++	in. This function performs a runtime check that tries to compress data
++	with the given compression type and looks for a known error string. It
++	ignores all other errors.
++	"""
++	supported = True
++	with directory_created("empty") as directory:
++		archive_path = f"{type}_compression_check.xar"
++		try:
++			return f"{type} support not compiled in." not in subprocess.run(
++				[
++					"xar",
++					"-c",
++					"-f",
++					archive_path,
++					"--compression=" + type,
++					directory,
++				],
++				stdout=subprocess.PIPE,
++				text=True,
++			).stdout
++		except:
++			# Assume that this compression type is supported.
++			pass
++		finally:
++			if os.path.exists(archive_path):
++				os.unlink(archive_path)
++	return supported
++
+ def skip_if_no_compression_support(type):
+ 	"""
+-	Raises TestCaseSkipError if the type is "lzma" and the test is running on
+-	darwin (OS X). In the future, we should add a hidden debugging flag to xar
+-	to determine valid compression types. This will skip incorrectly if a
+-	custom xar is used on OS X, or if a custom xar on another platform is
+-	built without bzip2 or lzma.
+-	
++	Raises TestCaseSkipError if the compression type is not compiled in.
+ 	"""
+-	if sys.platform == "darwin" and type == "lzma":
++	if not _check_compression_supported(type):
+ 		raise TestCaseSkipError("{t} support not compiled in".format(t=type))
+ 
+ @contextlib.contextmanager
+@@ -43,6 +94,22 @@ def directory_created(directory_path):
+ 		if os.path.exists(directory_path):
+ 			shutil.rmtree(directory_path)
+ 
++@contextlib.contextmanager
++def test_directory_created(directory_path):
++	"""
++	Like directory_created, but populates the directory with test files.
++	"""
++	with directory_created(directory_path) as directory:
++		with open(os.path.join(directory, "script"), "w+", opener=lambda path, flags: os.open(path, flags, 0o750)) as f:
++			f.write("#!/bin/sh\necho hello world")
++		with open(os.path.join(directory, "random_1kb"), "wb+") as f:
++			f.write(os.urandom(1000))
++		with open(os.path.join(directory, "random_4kib"), "wb+") as f:
++			f.write(os.urandom(4096))
++		with open(os.path.join(directory, "random_1mb"), "wb+") as f:
++			f.write(os.urandom(9999999))
++		yield directory
++
+ @contextlib.contextmanager
+ def archive_created(archive_path, content_path, *extra_args, **extra_kwargs):
+ 	"""
+@@ -68,7 +135,7 @@ def archive_created(archive_path, content_path, *extra_args, **extra_kwargs):
+ HASH_CHUNK_SIZE = 32768
+ 
+ def _md5_path(path):
+-	with open(path, "r") as f:
++	with open(path, "rb") as f:
+ 		h = hashlib.md5()
+ 		while True:
+ 			last = f.read(HASH_CHUNK_SIZE)
+@@ -122,7 +189,7 @@ def assert_identical_directories(path1, path2):
+ 		
+ 		# Sizes and the like
+ 		assert stat1.st_size == stat2.st_size, "size mismatch for \"{e1}\" ({s1}) and \"{e2}\" ({s2})".format(e1=entry1, s1=stat1.st_size, e2=entry2, s2=stat2.st_size)
+-		assert stat1.st_mtime == stat2.st_mtime, "mtime mismatch for \"{e1}\" and \"{e2}\"".format(e1=entry1, e2=entry2)
++		assert int(stat1.st_mtime) == int(stat2.st_mtime), "mtime mismatch for \"{e1}\" and \"{e2}\"".format(e1=entry1, e2=entry2)
+ 		assert _md5_path(entry1) == _md5_path(entry2), "md5 hash mismatch for \"{e1}\" and \"{e2}\"".format(e1=entry1, e2=entry2)
+ 		if os.path.isdir(entry1):
+ 			assert_identical_directories(entry1, entry2)
+diff --git a/xar/test/validate.c b/xar/test/validate.c
+index dfe69eb..a5fbe37 100644
+--- a/xar/test/validate.c
++++ b/xar/test/validate.c
+@@ -16,37 +16,40 @@
+ 
+ off_t HeapOff = 0;
+ 
+-static char* xar_format_md5(const unsigned char* m) {
++static char* xar_format_sha1(const unsigned char* m) {
+         char* result = NULL;
+         asprintf(&result,
+                 "%02x%02x%02x%02x"
+                 "%02x%02x%02x%02x"
+                 "%02x%02x%02x%02x"
++                "%02x%02x%02x%02x"
+                 "%02x%02x%02x%02x",
+                 m[0], m[1], m[2], m[3],
+                 m[4], m[5], m[6], m[7],
+                 m[8], m[9], m[10], m[11],
+-                m[12], m[13], m[14], m[15]);
++                m[12], m[13], m[14], m[15],
++                m[16], m[17], m[18], m[19]);
+         return result;
+ }
+ 
+ void heap_check(int fd, const char *name, const char *prop, off_t offset, off_t length, const char *csum) {
+ 	char *buf;
+-	EVP_MD_CTX ctx;
++	EVP_MD_CTX *ctx;
+ 	const EVP_MD *md;
+-	unsigned char md5str[EVP_MAX_MD_SIZE];
++	unsigned char sha1str[EVP_MAX_MD_SIZE];
+ 	unsigned int len;
+ 	ssize_t r;
+-	char *formattedmd5;
++	char *formattedsha1;
+ 
+ 	fprintf(stderr, "Heap checking %s %s at offset: %" PRIu64 "\n", name, prop, HeapOff+offset);
+ 	OpenSSL_add_all_digests();
+-	md = EVP_get_digestbyname("md5");
++	md = EVP_get_digestbyname("sha1");
+ 	if( md == NULL ) {
+-		fprintf(stderr, "No md5 digest in openssl\n");
++		fprintf(stderr, "No sha1 digest in openssl\n");
+ 		exit(1);
+ 	}
+-	EVP_DigestInit(&ctx, md);
++	ctx = EVP_MD_CTX_create();
++	EVP_DigestInit(ctx, md);
+ 
+ 	buf = malloc(length);
+ 	if( !buf ) {
+@@ -65,14 +68,15 @@ void heap_check(int fd, const char *name, const char *prop, off_t offset, off_t
+ 		fprintf(stderr, "Error reading from the heap\n");
+ 		exit(1);
+ 	}
+-	EVP_DigestUpdate(&ctx, buf, length);
+-	EVP_DigestFinal(&ctx, md5str, &len);
++	EVP_DigestUpdate(ctx, buf, length);
++	EVP_DigestFinal(ctx, sha1str, &len);
++	EVP_MD_CTX_destroy(ctx);
+ 
+-	formattedmd5 = xar_format_md5(md5str);
+-	if( strcmp(formattedmd5, csum) != 0 ) {
+-		fprintf(stderr, "%s %s checksum does not match\n", name, prop);
++	formattedsha1 = xar_format_sha1(sha1str);
++	if( strcmp(formattedsha1, csum) != 0 ) {
++		fprintf(stderr, "%s %s checksum does not match (got %s but expected %s)\n", name, prop, formattedsha1, csum);
+ 	}
+-	free(formattedmd5);
++	free(formattedsha1);
+ 	free(buf);
+ }
+ 
+-- 
+2.44.1
+
diff --git a/pkgs/by-name/xa/xar/patches/0002-Update-for-modern-liblzma5-versions.patch b/pkgs/by-name/xa/xar/patches/0002-Update-for-modern-liblzma5-versions.patch
new file mode 100644
index 000000000000..ef9ad0039410
--- /dev/null
+++ b/pkgs/by-name/xa/xar/patches/0002-Update-for-modern-liblzma5-versions.patch
@@ -0,0 +1,153 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ivan Trubach <mr.trubach@icloud.com>
+Date: Sat, 27 Jul 2024 16:34:17 +0300
+Subject: [PATCH 02/19] Update for modern liblzma5 versions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This change updates liblzma usage for modern xz versions (≥ 5, that is,
+released less than a decade ago).
+
+It also fixes missing realloc buffer calls that were supposed to be
+there but were lost in xar-420 (and Apple does not ship xar with LZMA
+support so nobody noticed). See also the offending commit:
+https://github.com/apple-oss-distributions/xar/commit/2426082efec74e9ed545cc4f5812ad16322bdf2c
+---
+ xar/lib/lzmaxar.c | 65 ++++++++---------------------------------------
+ 1 file changed, 10 insertions(+), 55 deletions(-)
+
+diff --git a/xar/lib/lzmaxar.c b/xar/lib/lzmaxar.c
+index ba9c868..8dcb484 100644
+--- a/xar/lib/lzmaxar.c
++++ b/xar/lib/lzmaxar.c
+@@ -54,27 +54,12 @@
+ 
+ #ifdef HAVE_LIBLZMA
+ 
+-#ifndef UINT32_C
+-#define UINT32_C(v)  (v ## U) /* from <stdint.h> normally */
+-#endif
+-#ifndef LZMA_VERSION
+-#define LZMA_VERSION UINT32_C(40420000) /* = 4.42.0alpha6 */
+-#endif
+-
+ struct _lzma_context{
+ 	uint8_t		lzmacompressed;
+ 	lzma_stream	lzma;
+-	lzma_options_stream options;
+-	lzma_allocator allocator;
+-#if LZMA_VERSION < 40420010U
+-	lzma_memory_limitter *limit;
+-#else
+-	lzma_memlimit *limit;
+-#endif
+ };
+ 
+ #define preset_level 7
+-#define memory_limit 93*1024*1024 /* 1=1M, 5=24M, 6=39M, 7=93M, 8=185M, 9=369M */
+ 
+ #define LZMA_CONTEXT(x) ((struct _lzma_context *)(*x))
+ #endif
+@@ -116,9 +101,7 @@ int xar_lzma_fromheap_in(xar_t x, xar_file_t f, xar_prop_t p, void **in, size_t
+ 		if( !opt ) return 0;
+ 		if( strcmp(opt, "application/x-lzma") != 0 ) return 0;
+ 		
+-		lzma_init_decoder();
+-		LZMA_CONTEXT(context)->lzma = LZMA_STREAM_INIT_VAR;
+-		r = lzma_stream_decoder(&LZMA_CONTEXT(context)->lzma, NULL, NULL);
++		r = lzma_stream_decoder(&LZMA_CONTEXT(context)->lzma, UINT64_MAX, LZMA_CONCATENATED);
+ 		if( (r != LZMA_OK) ) {
+ 			xar_err_new(x);
+ 			xar_err_set_file(x, f);
+@@ -194,11 +177,6 @@ int xar_lzma_toheap_done(xar_t x, xar_file_t f, xar_prop_t p, void **context) {
+ 	
+ 	if( LZMA_CONTEXT(context)->lzmacompressed){
+ 		lzma_end(&LZMA_CONTEXT(context)->lzma);		
+-#if LZMA_VERSION < 40420010U
+-		lzma_memory_limitter_end(LZMA_CONTEXT(context)->limit, 1);
+-#else
+-		lzma_memlimit_end(LZMA_CONTEXT(context)->limit, 1);
+-#endif
+ 
+ 		tmpp = xar_prop_pset(f, p, "encoding", NULL);
+ 		if( tmpp )
+@@ -222,7 +200,7 @@ int32_t xar_lzma_toheap_in(xar_t x, xar_file_t f, xar_prop_t p, void **in, size_
+ 
+ 	/* on first run, we init the context and check the compression type */
+ 	if( !LZMA_CONTEXT(context) ) {
+-		int level = preset_level;
++		uint32_t level = preset_level;
+ 		*context = calloc(1,sizeof(struct _lzma_context));
+ 		
+ 		opt = xar_opt_get(x, XAR_OPT_COMPRESSION);
+@@ -243,35 +221,7 @@ int32_t xar_lzma_toheap_in(xar_t x, xar_file_t f, xar_prop_t p, void **in, size_
+ 			}
+ 		}
+ 		
+-		lzma_init_encoder();
+-		LZMA_CONTEXT(context)->options.check = LZMA_CHECK_CRC64;
+-		LZMA_CONTEXT(context)->options.has_crc32 = 1; /* true */
+-		LZMA_CONTEXT(context)->options.alignment = 0;
+-#if defined (__ppc__) || defined (powerpc) || defined (__ppc64__)
+-		LZMA_CONTEXT(context)->options.filters[0].id = LZMA_FILTER_POWERPC;
+-#elif defined (__i386__) || defined (__amd64__) || defined(__x86_64__)
+-		LZMA_CONTEXT(context)->options.filters[0].id = LZMA_FILTER_X86;
+-#else
+-		LZMA_CONTEXT(context)->options.filters[0].id = LZMA_FILTER_COPY;
+-#endif
+-		LZMA_CONTEXT(context)->options.filters[0].options = NULL;
+-		LZMA_CONTEXT(context)->options.filters[1].id = LZMA_FILTER_LZMA;
+-		LZMA_CONTEXT(context)->options.filters[1].options = (lzma_options_lzma *)(lzma_preset_lzma + level - 1);
+-		/* Terminate the filter options array. */
+-		LZMA_CONTEXT(context)->options.filters[2].id = UINT64_MAX;
+-		LZMA_CONTEXT(context)->lzma = LZMA_STREAM_INIT_VAR;
+-#if LZMA_VERSION < 40420010U
+-		LZMA_CONTEXT(context)->limit = lzma_memory_limitter_create(memory_limit);
+-		LZMA_CONTEXT(context)->allocator.alloc = (void*) lzma_memory_alloc;
+-		LZMA_CONTEXT(context)->allocator.free = (void*) lzma_memory_free;
+-#else
+-		LZMA_CONTEXT(context)->limit = lzma_memlimit_create(memory_limit);
+-		LZMA_CONTEXT(context)->allocator.alloc = (void*) lzma_memlimit_alloc;
+-		LZMA_CONTEXT(context)->allocator.free = (void*) lzma_memlimit_free;
+-#endif
+-		LZMA_CONTEXT(context)->allocator.opaque = LZMA_CONTEXT(context)->limit;
+-		LZMA_CONTEXT(context)->lzma.allocator = &LZMA_CONTEXT(context)->allocator;
+-		r = lzma_stream_encoder_single(&LZMA_CONTEXT(context)->lzma, &(LZMA_CONTEXT(context)->options));
++		r = lzma_easy_encoder(&LZMA_CONTEXT(context)->lzma, level, LZMA_CHECK_CRC64);
+ 		if( (r != LZMA_OK) ) {
+ 			xar_err_new(x);
+ 			xar_err_set_file(x, f);
+@@ -279,6 +229,7 @@ int32_t xar_lzma_toheap_in(xar_t x, xar_file_t f, xar_prop_t p, void **in, size_
+ 			xar_err_callback(x, XAR_SEVERITY_FATAL, XAR_ERR_ARCHIVE_CREATION);
+ 			return -1;
+ 		}
++
+ 		LZMA_CONTEXT(context)->lzmacompressed = 1;
+ 		if( *inlen == 0 )
+ 			return 0;
+@@ -303,7 +254,8 @@ int32_t xar_lzma_toheap_in(xar_t x, xar_file_t f, xar_prop_t p, void **in, size_
+ 				outlen = newlen;
+ 			else
+ 				abort();	/* Someone has somehow malloced over 2^64 bits of ram. */
+-			
++
++			out = realloc(out, outlen);
+ 			if( out == NULL ) abort();
+ 
+ 			LZMA_CONTEXT(context)->lzma.next_out = ((unsigned char *)out) + offset;
+@@ -318,7 +270,10 @@ int32_t xar_lzma_toheap_in(xar_t x, xar_file_t f, xar_prop_t p, void **in, size_
+ 			if (newlen > outlen)
+ 				outlen = newlen;
+ 			else
+-				abort();	/* Someone has somehow malloced over 2^64 bits of ram. */			if( out == NULL ) abort();
++				abort();	/* Someone has somehow malloced over 2^64 bits of ram. */
++
++			out = realloc(out, outlen);
++			if( out == NULL ) abort();
+ 
+ 			LZMA_CONTEXT(context)->lzma.next_out = ((unsigned char *)out) + offset;
+ 			LZMA_CONTEXT(context)->lzma.avail_out = outlen - offset;
+-- 
+2.44.1
+
diff --git a/pkgs/by-name/xa/xar/patches/0003-Fix-undefined-EXT2_ECOMPR_FL-for-e2fsprogs.patch b/pkgs/by-name/xa/xar/patches/0003-Fix-undefined-EXT2_ECOMPR_FL-for-e2fsprogs.patch
new file mode 100644
index 000000000000..795c42ad59c4
--- /dev/null
+++ b/pkgs/by-name/xa/xar/patches/0003-Fix-undefined-EXT2_ECOMPR_FL-for-e2fsprogs.patch
@@ -0,0 +1,39 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ivan Trubach <mr.trubach@icloud.com>
+Date: Sat, 27 Jul 2024 18:25:48 +0300
+Subject: [PATCH 03/19] Fix undefined EXT2_ECOMPR_FL for e2fsprogs
+
+See https://github.com/mackyle/xar/issues/10
+---
+ xar/lib/ext2.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/xar/lib/ext2.c b/xar/lib/ext2.c
+index 767891a..2380846 100644
+--- a/xar/lib/ext2.c
++++ b/xar/lib/ext2.c
+@@ -139,8 +139,10 @@ int xar_ext2attr_archive(xar_t x, xar_file_t f, const char* file, const char *bu
+ 	if(! (flags & ~EXT2_NOCOMPR_FL) )
+ 		x_addprop(f, "NoCompBlock");
+ #endif
++#ifdef EXT2_ECOMPR_FL
+ 	if(! (flags & ~EXT2_ECOMPR_FL) )
+ 		x_addprop(f, "CompError");
++#endif
+ 	if(! (flags & ~EXT2_BTREE_FL) )
+ 		x_addprop(f, "BTree");
+ 	if(! (flags & ~EXT2_INDEX_FL) )
+@@ -225,8 +227,10 @@ int xar_ext2attr_extract(xar_t x, xar_file_t f, const char* file, char *buffer,
+ 	if( e2prop_get(f, "NoCompBlock", (char **)&tmp) == 0 )
+ 		flags |= EXT2_NOCOMPR_FL ;
+ #endif
++#ifdef EXT2_ECOMPR_FL
+ 	if( e2prop_get(f, "CompError", (char **)&tmp) == 0 )
+ 		flags |= EXT2_ECOMPR_FL ;
++#endif
+ 	if( e2prop_get(f, "BTree", (char **)&tmp) == 0 )
+ 		flags |= EXT2_BTREE_FL ;
+ 	if( e2prop_get(f, "HashIndexed", (char **)&tmp) == 0 )
+-- 
+2.44.1
+
diff --git a/pkgs/by-name/xa/xar/patches/0004-Fix-compatibility-with-openssl-1.0.patch b/pkgs/by-name/xa/xar/patches/0004-Fix-compatibility-with-openssl-1.0.patch
new file mode 100644
index 000000000000..bd1fed261c78
--- /dev/null
+++ b/pkgs/by-name/xa/xar/patches/0004-Fix-compatibility-with-openssl-1.0.patch
@@ -0,0 +1,60 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fabian Groffen <grobian@gentoo.org>
+Date: Tue, 1 Jan 2019 18:00:08 +0100
+Subject: [PATCH 04/19] Fix compatibility with openssl-1.0
+
+Patch-Source: https://github.com/gentoo/gentoo/blob/dce914f2bbf52360f45c90d877857df3c4c2a353/app-arch/xar/files/xar-1.8-openssl-1.1.patch
+--
+lib/hash.c: fix compilation with OpenSSL-1.1+
+
+EVP_MD_CTX has become an anonymous struct now, so can't allocate size
+for it anymore.
+---
+ xar/lib/hash.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/xar/lib/hash.c b/xar/lib/hash.c
+index 66876ad..cb4f6cf 100644
+--- a/xar/lib/hash.c
++++ b/xar/lib/hash.c
+@@ -97,7 +97,7 @@ struct __xar_hash_t {
+ #ifdef __APPLE__
+ 	CCDigestRef digest;
+ #else
+-	EVP_MD_CTX digest;
++	EVP_MD_CTX *digest;
+ 	const EVP_MD *type;
+ #endif
+ 	unsigned int length;
+@@ -118,7 +118,8 @@ xar_hash_t xar_hash_new(const char *digest_name, void *context) {
+ #else
+ 	OpenSSL_add_all_digests();
+ 	HASH_CTX(hash)->type = EVP_get_digestbyname(digest_name);
+-	EVP_DigestInit(&HASH_CTX(hash)->digest, HASH_CTX(hash)->type);
++	HASH_CTX(hash)->digest = EVP_MD_CTX_create();
++	EVP_DigestInit(HASH_CTX(hash)->digest, HASH_CTX(hash)->type);
+ #endif
+ 	
+ 	HASH_CTX(hash)->digest_name = strdup(digest_name);
+@@ -138,7 +139,7 @@ void xar_hash_update(xar_hash_t hash, void *buffer, size_t nbyte) {
+ #ifdef __APPLE__
+ 	CCDigestUpdate(HASH_CTX(hash)->digest, buffer, nbyte);
+ #else
+-	EVP_DigestUpdate(&HASH_CTX(hash)->digest, buffer, nbyte);
++	EVP_DigestUpdate(HASH_CTX(hash)->digest, buffer, nbyte);
+ #endif
+ }
+ 
+@@ -155,7 +156,8 @@ void *xar_hash_finish(xar_hash_t hash, size_t *nbyte) {
+ 	CCDigestFinal(HASH_CTX(hash)->digest, buffer);
+ 	CCDigestDestroy(HASH_CTX(hash)->digest);
+ #else
+-	EVP_DigestFinal(&HASH_CTX(hash)->digest, buffer, &HASH_CTX(hash)->length);
++	EVP_DigestFinal(HASH_CTX(hash)->digest, buffer, &HASH_CTX(hash)->length);
++	EVP_MD_CTX_destroy(HASH_CTX(hash)->digest);
+ #endif
+ 	
+ 	*nbyte = HASH_CTX(hash)->length;
+-- 
+2.44.1
+
diff --git a/pkgs/by-name/xa/xar/patches/0005-Fix-configure.ac-for-Linux-headers.patch b/pkgs/by-name/xa/xar/patches/0005-Fix-configure.ac-for-Linux-headers.patch
new file mode 100644
index 000000000000..1b24fc6b2dfc
--- /dev/null
+++ b/pkgs/by-name/xa/xar/patches/0005-Fix-configure.ac-for-Linux-headers.patch
@@ -0,0 +1,123 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?S=C3=B6ren=20Tempel?= <soeren+git@soeren-tempel.net>
+Date: Sat, 2 Mar 2024 01:25:52 +0100
+Subject: [PATCH 05/19] Fix configure.ac for Linux headers
+
+Patch-Source: https://github.com/gentoo/gentoo/blob/dce914f2bbf52360f45c90d877857df3c4c2a353/app-arch/xar/files/xar-1.8.0.0.452-linux.patch
+---
+ xar/configure.ac        | 19 +++++++++++++++++--
+ xar/include/config.h.in |  3 +++
+ xar/lib/util.c          | 15 +++++++++++++++
+ 3 files changed, 35 insertions(+), 2 deletions(-)
+
+diff --git a/xar/configure.ac b/xar/configure.ac
+index 3a36f42..26d41a5 100644
+--- a/xar/configure.ac
++++ b/xar/configure.ac
+@@ -183,7 +183,7 @@ AC_SUBST([enable_autogen])
+ 
+ AC_TRY_COMPILE([#include <sys/types.h> 
+ #include <sys/acl.h>], [acl_t a], [AC_DEFINE([HAVE_SYS_ACL_H],[1], [define if you have sys/acl.h and it has a working acl_t type])])
+-AC_CHECK_HEADERS(ext2fs/ext2_fs.h sys/statfs.h sys/xattr.h sys/param.h sys/extattr.h libutil.h)
++AC_CHECK_HEADERS(ext2fs/ext2_fs.h sys/statfs.h sys/vfs.h sys/xattr.h sys/param.h sys/extattr.h libutil.h)
+ AC_CHECK_FUNCS(lgetxattr)
+ AC_CHECK_FUNCS(lsetxattr)
+ AC_CHECK_FUNCS(getxattr)
+@@ -199,7 +199,22 @@ AC_CHECK_FUNCS(strmode)
+ 
+ AC_CHECK_MEMBERS([struct statfs.f_fstypename],,,[#include <sys/types.h>
+ #include <sys/param.h>
+-#include <sys/mount.h>])
++#include <sys/mount.h>
++#ifdef HAVE_SYS_VFS_H
++#include <sys/vfs.h>
++#endif])
++AC_CHECK_MEMBERS([struct statfs.f_iosize],,,[#include <sys/types.h>
++#include <sys/param.h>
++#include <sys/mount.h>
++#ifdef HAVE_SYS_VFS_H
++#include <sys/vfs.h>
++#endif])
++AC_CHECK_MEMBERS([struct statfs.f_bsize],,,[#include <sys/types.h>
++#include <sys/param.h>
++#include <sys/mount.h>
++#ifdef HAVE_SYS_VFS_H
++#include <sys/vfs.h>
++#endif])
+ AC_CHECK_MEMBERS([struct statvfs.f_fstypename],,,[#include <sys/statvfs.h>])
+ AC_CHECK_MEMBERS([struct stat.st_flags])
+ 
+diff --git a/xar/include/config.h.in b/xar/include/config.h.in
+index 2bb997b..16c72d3 100644
+--- a/xar/include/config.h.in
++++ b/xar/include/config.h.in
+@@ -1,4 +1,5 @@
+ #undef HAVE_SYS_STATFS_H
++#undef HAVE_SYS_VFS_H
+ #undef HAVE_SYS_XATTR_H
+ #undef HAVE_SYS_EXTATTR_H
+ #undef HAVE_SYS_PARAM_H
+@@ -15,6 +16,8 @@
+ #undef HAVE_STRUCT_STAT_ST_FLAGS
+ #undef HAVE_STRUCT_STATVFS_F_FSTYPENAME
+ #undef HAVE_STRUCT_STATFS_F_FSTYPENAME
++#undef HAVE_STRUCT_STATFS_F_IOSIZE
++#undef HAVE_STRUCT_STATFS_F_BSIZE
+ #undef HAVE_SYS_ACL_H
+ #undef HAVE_LIBUTIL_H
+ #undef HAVE_LIBPTHREAD
+diff --git a/xar/lib/util.c b/xar/lib/util.c
+index 0ea661a..1db2daa 100644
+--- a/xar/lib/util.c
++++ b/xar/lib/util.c
+@@ -35,11 +35,16 @@
+  * Christopher Ryan <ryanc@apple.com>
+ */
+ 
++#include "config.h"
++
+ #include <stdio.h>
+ #include <stdint.h>
+ #include <sys/types.h>
+ #include <sys/mount.h>
+ #include <sys/param.h>
++#ifdef HAVE_SYS_VFS_H
++# include <sys/vfs.h>
++#endif
+ #include <arpa/inet.h>
+ #include <string.h>
+ #include <unistd.h>
+@@ -583,6 +588,14 @@ char *xar_get_mtime(xar_t x, xar_file_t f) {
+ 	return tmp;
+ }
+ 
++#ifndef HAVE_STRUCT_STATFS_F_IOSIZE
++# ifdef HAVE_STRUCT_STATFS_F_BSIZE
++#  define f_iosize f_bsize
++# else
++#  error need a field to get optimal transfer block size
++# endif
++#endif
++
+ size_t xar_optimal_io_size_at_path(const char *path)
+ {
+ 	// Start at 1MiB
+@@ -599,6 +612,7 @@ size_t xar_optimal_io_size_at_path(const char *path)
+ 			fs_iosize = optimal_rsize;
+ 		}
+ 		
++#ifdef MNT_LOCAL
+ 		// If we're a remote filesystem, never let us go below the optimal size above of 1MiB
+ 		// NFS is horrible and lies that the optimal size is 512 bytes.
+ 		// Whereas SMB in my testing returns 7MiBs (far more practicle)
+@@ -611,6 +625,7 @@ size_t xar_optimal_io_size_at_path(const char *path)
+ 			}
+ 		}
+ 		else
++#endif
+ 		{
+ 			optimal_rsize = fs_iosize;
+ 		}
+-- 
+2.44.1
+
diff --git a/pkgs/by-name/xa/xar/patches/0006-Fix-more-non-Darwin-stuff.patch b/pkgs/by-name/xa/xar/patches/0006-Fix-more-non-Darwin-stuff.patch
new file mode 100644
index 000000000000..bd052fba25ef
--- /dev/null
+++ b/pkgs/by-name/xa/xar/patches/0006-Fix-more-non-Darwin-stuff.patch
@@ -0,0 +1,38 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ivan Trubach <mr.trubach@icloud.com>
+Date: Sat, 27 Jul 2024 18:38:10 +0300
+Subject: [PATCH 06/19] Fix more non-Darwin stuff
+
+---
+ xar/include/xar.h.in | 1 +
+ xar/lib/linuxattr.c  | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/xar/include/xar.h.in b/xar/include/xar.h.in
+index 9c93798..3d24b4f 100644
+--- a/xar/include/xar.h.in
++++ b/xar/include/xar.h.in
+@@ -52,6 +52,7 @@ extern "C" {
+ #import <os/availability.h>
+ #else
+ #define API_DEPRECATED(...)
++#define API_AVAILABLE(...)
+ #endif
+ 
+ #pragma pack(4)
+diff --git a/xar/lib/linuxattr.c b/xar/lib/linuxattr.c
+index 0fec2bb..58ee6a8 100644
+--- a/xar/lib/linuxattr.c
++++ b/xar/lib/linuxattr.c
+@@ -226,7 +226,7 @@ int32_t xar_linuxattr_extract(xar_t x, xar_file_t f, const char* file, char *buf
+ 	if( statfs(file, &sfs) != 0 ) {
+ 		char *tmp, *bname;
+ 		tmp = strdup(file);
+-		bname = safe_dirname(tmp);
++		bname = xar_safe_dirname(tmp);
+ 		statfs(bname, &sfs);
+ 		free(tmp);
+ 		free(bname);
+-- 
+2.44.1
+
diff --git a/pkgs/by-name/xa/xar/patches/0007-replace-initialized-constant-with-define-statement.patch b/pkgs/by-name/xa/xar/patches/0007-replace-initialized-constant-with-define-statement.patch
new file mode 100644
index 000000000000..0a2bc9dd6cb2
--- /dev/null
+++ b/pkgs/by-name/xa/xar/patches/0007-replace-initialized-constant-with-define-statement.patch
@@ -0,0 +1,33 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fabian Groffen <grobian@gentoo.org>
+Date: Sat, 16 Jul 2022 21:34:13 +0200
+Subject: [PATCH 07/19] replace initialized constant with #define statement
+
+GCC doesn't like this:
+
+filetree.c:744:9: error: variable-sized object may not be initialized
+
+Since there's nothing changing at runtime at all, just make the compiler
+see it's always going to be 1.
+
+Patch-Source: https://github.com/gentoo/gentoo/blob/dce914f2bbf52360f45c90d877857df3c4c2a353/app-arch/xar/files/xar-1.8.0.0.487-variable-sized-object.patch
+---
+ xar/lib/filetree.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/xar/lib/filetree.c b/xar/lib/filetree.c
+index f31682a..9c30c03 100644
+--- a/xar/lib/filetree.c
++++ b/xar/lib/filetree.c
+@@ -752,7 +752,7 @@ int xar_file_equals_file(xar_file_t f1, xar_file_t f2)
+ 	size_t fspath1_size = 0, fspath2_size = 0;
+ 	size_t ns1_size = 0, ns2_size = 0;
+ 	const struct __xar_file_t * child1 = NULL, * child2 = NULL;
+-	const uint keys_to_ignore_count = 1;
++#define keys_to_ignore_count 1
+ 	char * keys_to_ignore[keys_to_ignore_count] = { "id" }; // ID is allowed ot mismatch
+ 	
+ 	// If the two pointers match, call it the same.
+-- 
+2.44.1
+
diff --git a/pkgs/by-name/xa/xar/patches/0008-Fix-configure.ac-not-finding-AR-with-target-prefix.patch b/pkgs/by-name/xa/xar/patches/0008-Fix-configure.ac-not-finding-AR-with-target-prefix.patch
new file mode 100644
index 000000000000..4345a5b271e7
--- /dev/null
+++ b/pkgs/by-name/xa/xar/patches/0008-Fix-configure.ac-not-finding-AR-with-target-prefix.patch
@@ -0,0 +1,37 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ivan Trubach <mr.trubach@icloud.com>
+Date: Sat, 27 Jul 2024 18:43:38 +0300
+Subject: [PATCH 08/19] Fix configure.ac not finding $AR with target prefix
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fixes AR and RANLIB with target prefix (if not set to absolute paths).
+Looks like AC_PATH_PROG doesn’t perform PATH lookups when user overrides
+the program via environment variable but sets the value to program name
+instead of absolute path.
+
+Note that LD seems to be unused so we remove it.
+---
+ xar/configure.ac | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/xar/configure.ac b/xar/configure.ac
+index 26d41a5..3d8e5de 100644
+--- a/xar/configure.ac
++++ b/xar/configure.ac
+@@ -86,9 +86,8 @@ fi
+ AC_PROG_CPP
+ 
+ AC_PROG_INSTALL
+-AC_PATH_PROG([LD], [ld], , [$PATH])
+-AC_PATH_PROG([AR], [ar], , [$PATH])
+-AC_PATH_PROG([RANLIB], [ranlib], , [$PATH])
++AC_PROG_AR
++AC_PROG_RANLIB
+ AC_PATH_PROG([AUTOCONF], [autoconf], , [$PATH])
+ 
+ dnl Some libtool envy
+-- 
+2.44.1
+
diff --git a/pkgs/tools/compression/xar/0001-Add-useless-descriptions-to-AC_DEFINE.patch b/pkgs/by-name/xa/xar/patches/0009-Add-useless-descriptions-to-AC_DEFINE.patch
similarity index 70%
rename from pkgs/tools/compression/xar/0001-Add-useless-descriptions-to-AC_DEFINE.patch
rename to pkgs/by-name/xa/xar/patches/0009-Add-useless-descriptions-to-AC_DEFINE.patch
index a605d2db1708..8dd0932d09b6 100644
--- a/pkgs/tools/compression/xar/0001-Add-useless-descriptions-to-AC_DEFINE.patch
+++ b/pkgs/by-name/xa/xar/patches/0009-Add-useless-descriptions-to-AC_DEFINE.patch
@@ -1,18 +1,18 @@
-From a14be07c0aae3bf6f732d1ca5f625ba375702121 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Andrew Childs <andrew.childs@bibo.com.ph>
 Date: Sun, 15 Nov 2020 19:12:33 +0900
-Subject: [PATCH 1/2] Add useless descriptions to AC_DEFINE
+Subject: [PATCH 09/19] Add useless descriptions to AC_DEFINE
 
-Removes autoheader warnings.
+Removes autoheader warnings from autoreconfHook.
 ---
- configure.ac | 42 +++++++++++++++++++++---------------------
- 1 file changed, 21 insertions(+), 21 deletions(-)
+ xar/configure.ac | 46 +++++++++++++++++++++++-----------------------
+ 1 file changed, 23 insertions(+), 23 deletions(-)
 
-diff --git a/configure.ac b/configure.ac
-index 812b5ff..358ab89 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -210,48 +210,48 @@ AC_CHECK_MEMBERS([struct stat.st_flags])
+diff --git a/xar/configure.ac b/xar/configure.ac
+index 3d8e5de..0cc04dd 100644
+--- a/xar/configure.ac
++++ b/xar/configure.ac
+@@ -219,48 +219,48 @@ AC_CHECK_MEMBERS([struct stat.st_flags])
  
  AC_CHECK_SIZEOF(uid_t)
  if test $ac_cv_sizeof_uid_t = "4"; then
@@ -81,7 +81,7 @@ index 812b5ff..358ab89 100644
  else
  AC_ERROR(can not detect the size of your system's dev_t type)
  fi
-@@ -261,7 +261,7 @@ AC_CHECK_LIB(acl, acl_get_file)
+@@ -270,7 +270,7 @@ AC_CHECK_LIB(acl, acl_get_file)
  dnl Check for paths
  AC_PREFIX_DEFAULT(/usr/local)
  
@@ -90,6 +90,24 @@ index 812b5ff..358ab89 100644
  
  dnl 
  dnl Configure libxml2.
+@@ -350,7 +350,7 @@ have_libbz2="1"
+ AC_CHECK_HEADERS([bzlib.h], , [have_libbz2="0"])
+ AC_CHECK_LIB([bz2], [BZ2_bzCompress], , [have_libbz2="0"])
+ if test "x${have_libbz2}" = "x1" ; then
+-  AC_DEFINE([HAVE_LIBBZ2])
++  AC_DEFINE([HAVE_LIBBZ2], [], [HAVE_LIBBZ2])
+ fi
+ 
+ dnl 
+@@ -360,7 +360,7 @@ have_libpthread="1"
+ AC_CHECK_HEADERS([pthread.h], , [have_pthread="0"])
+ AC_CHECK_LIB([pthread], [pthread_mutex_lock], , [have_pthread="0"])
+ if test "x${have_pthread}" = "x1" ; then
+-  AC_DEFINE([HAVE_PTHREAD])
++  AC_DEFINE([HAVE_PTHREAD], [], [HAVE_PTHREAD])
+ fi
+ 
+ dnl 
 -- 
-2.28.0
+2.44.1
 
diff --git a/pkgs/tools/compression/xar/0002-Use-pkg-config-for-libxml2.patch b/pkgs/by-name/xa/xar/patches/0010-Update-configure.ac-for-openssl-libxml2-liblzma-and-.patch
similarity index 51%
rename from pkgs/tools/compression/xar/0002-Use-pkg-config-for-libxml2.patch
rename to pkgs/by-name/xa/xar/patches/0010-Update-configure.ac-for-openssl-libxml2-liblzma-and-.patch
index d71ad4b753c1..a1b5aef3ca6c 100644
--- a/pkgs/tools/compression/xar/0002-Use-pkg-config-for-libxml2.patch
+++ b/pkgs/by-name/xa/xar/patches/0010-Update-configure.ac-for-openssl-libxml2-liblzma-and-.patch
@@ -1,21 +1,31 @@
-From 276833851657c85651c053ee16b8e1a8dc768a50 Mon Sep 17 00:00:00 2001
-From: Andrew Childs <andrew.childs@bibo.com.ph>
-Date: Sun, 15 Nov 2020 19:12:56 +0900
-Subject: [PATCH 2/2] Use pkg-config for libxml2
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ivan Trubach <mr.trubach@icloud.com>
+Date: Sat, 27 Jul 2024 18:58:14 +0300
+Subject: [PATCH 10/19] Update configure.ac for openssl, libxml2, liblzma and
+ musl-fts
 
+Simplifies libxml2 detection, adds detection for liblzma (from xz),
+openssl and fts (for musl libc).
 ---
- configure.ac | 66 +++++++++-------------------------------------------
- 1 file changed, 11 insertions(+), 55 deletions(-)
+ xar/configure.ac | 83 +++++++++++++++++-------------------------------
+ 1 file changed, 30 insertions(+), 53 deletions(-)
 
-diff --git a/configure.ac b/configure.ac
-index 358ab89..984a694 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -268,61 +268,17 @@ dnl Configure libxml2.
- dnl 
- LIBXML2_VERSION_MIN=2.6.11
+diff --git a/xar/configure.ac b/xar/configure.ac
+index 0cc04dd..e466ee0 100644
+--- a/xar/configure.ac
++++ b/xar/configure.ac
+@@ -272,63 +272,14 @@ AC_PREFIX_DEFAULT(/usr/local)
  
--have_libxml2="1"
+ AC_CHECK_FUNC([asprintf], AC_DEFINE([HAVE_ASPRINTF], [], [HAVE_ASPRINTF]))
+ 
++AC_SEARCH_LIBS([fts_close], [fts])
++
+ dnl 
+ dnl Configure libxml2.
+ dnl 
+-LIBXML2_VERSION_MIN=2.6.11
+-
+ have_libxml2="1"
 -
 -AC_ARG_WITH([xml2-config], [  --with-xml2-config      libxml2 config program],
 -if test "x${with_xml2_config}" = "xno" ; then
@@ -67,23 +77,51 @@ index 358ab89..984a694 100644
 -  dnl Final sanity check, to make sure that xmlwriter is present.
 -  AC_CHECK_HEADER([libxml/xmlwriter.h], , [have_libxml2="0"])
 -fi
--if test "x${have_libxml2}" = "x0" ; then
--  AC_MSG_ERROR([Cannot build without libxml2])
--fi
-+PKG_PROG_PKG_CONFIG
-+
-+PKG_CHECK_MODULES(LIBXML2_PKGCONFIG, [libxml-2.0 >= ${LIBXML2_VERSION_MIN}],
-+  [
-+    have_libxml2=1
-+    CPPFLAGS="${CPPFLAGS} ${LIBXML2_PKGCONFIG_CFLAGS}"
-+    LIBS="${LIBS} ${LIBXML2_PKGCONFIG_LIBS}"
-+  ],
-+  [
-+    have_libxml2=0
-+  ])
++AC_CHECK_HEADERS([libxml/xmlwriter.h], , [have_libxml2="0"])
++AC_CHECK_LIB([xml2], [xmlInitParser], , [have_libxml2="0"])
+ if test "x${have_libxml2}" = "x0" ; then
+   AC_MSG_ERROR([Cannot build without libxml2])
+ fi
+@@ -343,6 +294,22 @@ if test "x${have_libz}" = "x0" ; then
+   AC_MSG_ERROR([Cannot build without libz])
+ fi
  
++dnl 
++dnl Configure openssl.
++dnl 
++have_openssl="1"
++AC_CHECK_HEADERS([openssl/evp.h], , [have_openssl="0"])
++AC_CHECK_LIB([crypto], [OPENSSL_config], , [have_openssl="0"])
++if test "x${have_openssl}" = "x0" ; then
++  case "${host}" in
++    *-*-darwin*)
++      ;;
++    *)
++      AC_MSG_ERROR([Cannot build without OpenSSL for non-Darwin host])
++      ;;
++  esac
++fi
++
+ dnl 
+ dnl Configure libbz2.
+ dnl 
+@@ -353,6 +320,16 @@ if test "x${have_libbz2}" = "x1" ; then
+   AC_DEFINE([HAVE_LIBBZ2], [], [HAVE_LIBBZ2])
+ fi
+ 
++dnl 
++dnl Configure liblzma.
++dnl 
++have_liblzma="1"
++AC_CHECK_HEADERS([lzma.h], , [have_liblzma="0"])
++AC_CHECK_LIB([lzma], [lzma_stream_decoder], , [have_liblzma="0"])
++if test "x${have_liblzma}" = "x1" ; then
++  AC_DEFINE([HAVE_LIBLZMA], [], [HAVE_LIBLZMA])
++fi
++
+ dnl 
+ dnl Configure libpthread.
  dnl 
- dnl Configure libcrypto (part of OpenSSL).
 -- 
-2.28.0
+2.44.1
 
diff --git a/pkgs/by-name/xa/xar/patches/0011-Fix-missing-includes-and-silence-string-format-warni.patch b/pkgs/by-name/xa/xar/patches/0011-Fix-missing-includes-and-silence-string-format-warni.patch
new file mode 100644
index 000000000000..3eac163156e4
--- /dev/null
+++ b/pkgs/by-name/xa/xar/patches/0011-Fix-missing-includes-and-silence-string-format-warni.patch
@@ -0,0 +1,104 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ivan Trubach <mr.trubach@icloud.com>
+Date: Sat, 27 Jul 2024 19:10:46 +0300
+Subject: [PATCH 11/19] Fix missing includes and silence string format warnings
+
+Based on patch from Gentoo; see
+https://gitweb.gentoo.org/repo/gentoo.git/plain/app-arch/xar/files/xar-1.8.0.0.498-impl-decls.patch?id=cc91eb0f86043ae92c10cce55b326244bed3f061
+---
+ xar/lib/Makefile.inc.in | 1 +
+ xar/lib/darwinattr.c    | 1 +
+ xar/lib/ea.c            | 3 ++-
+ xar/lib/ext2.c          | 1 +
+ xar/lib/util.c          | 1 +
+ xar/src/xar_internal.h  | 4 ----
+ 6 files changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/xar/lib/Makefile.inc.in b/xar/lib/Makefile.inc.in
+index c046b25..d5e9003 100644
+--- a/xar/lib/Makefile.inc.in
++++ b/xar/lib/Makefile.inc.in
+@@ -127,6 +127,7 @@ lib_distclean :
+ 
+ CPPFLAGS := -I@objroot@include $(CPPFLAGS)
+ CPPFLAGS := -I@srcroot@include $(CPPFLAGS)
++CPPFLAGS := -I@srcroot@lib $(CPPFLAGS)
+ 
+ #
+ # Build rules.
+diff --git a/xar/lib/darwinattr.c b/xar/lib/darwinattr.c
+index 4938965..18302b0 100644
+--- a/xar/lib/darwinattr.c
++++ b/xar/lib/darwinattr.c
+@@ -37,6 +37,7 @@
+ 
+ #include "config.h"
+ #include <stdio.h>
++#include <stdlib.h>
+ #include <unistd.h>
+ #include <string.h>
+ #include <libgen.h>
+diff --git a/xar/lib/ea.c b/xar/lib/ea.c
+index 1bb8e27..fa1d06a 100644
+--- a/xar/lib/ea.c
++++ b/xar/lib/ea.c
+@@ -29,6 +29,7 @@
+ #include "config.h"
+ #include <stdlib.h>
+ #include <stdio.h>
++#include <inttypes.h>  /* for PRId64 */
+ #include <string.h>
+ #include <assert.h>
+ #include <libgen.h>
+@@ -67,7 +68,7 @@ xar_ea_t xar_ea_new(xar_file_t f, const char *name)
+ 	xar_prop_setvalue(XAR_EA(ret)->prop, NULL);
+ 	XAR_PROP(XAR_EA(ret)->prop)->attrs = xar_attr_new();
+ 	XAR_ATTR(XAR_PROP(XAR_EA(ret)->prop)->attrs)->key = strdup("id");
+-	asprintf((char **)&XAR_ATTR(XAR_PROP(XAR_EA(ret)->prop)->attrs)->value, "%lld", XAR_FILE(f)->nexteaid++);
++	asprintf((char **)&XAR_ATTR(XAR_PROP(XAR_EA(ret)->prop)->attrs)->value, "%"PRId64, XAR_FILE(f)->nexteaid++);
+ 
+ 	xar_prop_pset(f, XAR_EA(ret)->prop, "name", name);
+ 	
+diff --git a/xar/lib/ext2.c b/xar/lib/ext2.c
+index 2380846..b4ca1b0 100644
+--- a/xar/lib/ext2.c
++++ b/xar/lib/ext2.c
+@@ -41,6 +41,7 @@
+ #include "asprintf.h"
+ #endif
+ #include <stdio.h>
++#include <stdlib.h>
+ #include <unistd.h>
+ #include "xar.h"
+ #include "arcmod.h"
+diff --git a/xar/lib/util.c b/xar/lib/util.c
+index 1db2daa..ac0b822 100644
+--- a/xar/lib/util.c
++++ b/xar/lib/util.c
+@@ -38,6 +38,7 @@
+ #include "config.h"
+ 
+ #include <stdio.h>
++#include <stdlib.h>
+ #include <stdint.h>
+ #include <sys/types.h>
+ #include <sys/mount.h>
+diff --git a/xar/src/xar_internal.h b/xar/src/xar_internal.h
+index b78745c..2e6199e 100644
+--- a/xar/src/xar_internal.h
++++ b/xar/src/xar_internal.h
+@@ -8,11 +8,7 @@
+ #ifndef _XAR_INTERNAL_H_
+ #define _XAR_INTERNAL_H_
+ 
+-#ifdef XARSIG_BUILDING_WITH_XAR
+ #include "xar.h"
+-#else
+-#include <xar/xar.h>
+-#endif // XARSIG_BUILDING_WITH_XAR
+ 
+ // Undeprecate these for internal usage
+ xar_t xar_open(const char *file, int32_t flags) API_AVAILABLE(macos(10.4));
+-- 
+2.44.1
+
diff --git a/pkgs/by-name/xa/xar/patches/0012-Fix-char-signedness-for-ARM-and-PowerPC.patch b/pkgs/by-name/xa/xar/patches/0012-Fix-char-signedness-for-ARM-and-PowerPC.patch
new file mode 100644
index 000000000000..bc4fb7ff8504
--- /dev/null
+++ b/pkgs/by-name/xa/xar/patches/0012-Fix-char-signedness-for-ARM-and-PowerPC.patch
@@ -0,0 +1,46 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ivan Trubach <mr.trubach@icloud.com>
+Date: Sat, 27 Jul 2024 19:26:14 +0300
+Subject: [PATCH 12/19] Fix char signedness for ARM and PowerPC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Use signed char explicitly for ARM and PowerPC (defaults to unsigned).
+Otherwise -1 integer literal is helpfully converted to char 255…
+
+Derives from https://gitweb.gentoo.org/repo/gentoo.git/plain/app-arch/xar/files/xar-1.8-arm-ppc.patch?id=cc91eb0f86043ae92c10cce55b326244bed3f061
+---
+ xar/lib/b64.c | 2 +-
+ xar/src/xar.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/xar/lib/b64.c b/xar/lib/b64.c
+index 6361acd..4ffc34c 100644
+--- a/xar/lib/b64.c
++++ b/xar/lib/b64.c
+@@ -59,7 +59,7 @@ typedef enum _B64CommandCodes {
+ 	B64_IgnorableCharacter	= -1
+ } B64CommandCodes;
+ 
+-static char b64revtb[256] = {
++static signed char b64revtb[256] = {
+   -3, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*0-15*/
+   -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*16-31*/
+   -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63, /*32-47*/
+diff --git a/xar/src/xar.c b/xar/src/xar.c
+index 9977e8a..1bceb63 100644
+--- a/xar/src/xar.c
++++ b/xar/src/xar.c
+@@ -910,7 +910,7 @@ static void print_version() {
+ int main(int argc, char *argv[]) {
+ 	int ret;
+ 	char *filename = NULL;
+-	char command = 0, c;
++	signed char command = 0, c;
+ 	char **args;
+ 	const char *tocfile = NULL;
+ 	int arglen, i, err;
+-- 
+2.44.1
+
diff --git a/pkgs/by-name/xa/xar/patches/0013-Enable-extended-attributes-for-btrfs.patch b/pkgs/by-name/xa/xar/patches/0013-Enable-extended-attributes-for-btrfs.patch
new file mode 100644
index 000000000000..7722e5c748e5
--- /dev/null
+++ b/pkgs/by-name/xa/xar/patches/0013-Enable-extended-attributes-for-btrfs.patch
@@ -0,0 +1,43 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ivan Trubach <mr.trubach@icloud.com>
+Date: Sat, 27 Jul 2024 19:28:09 +0300
+Subject: [PATCH 13/19] Enable extended attributes for btrfs
+
+---
+ xar/lib/linuxattr.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/xar/lib/linuxattr.c b/xar/lib/linuxattr.c
+index 58ee6a8..496dd82 100644
+--- a/xar/lib/linuxattr.c
++++ b/xar/lib/linuxattr.c
+@@ -80,6 +80,10 @@
+ #define XFS_SUPER_MAGIC 0x58465342
+ #endif
+ 
++#ifndef BTRFS_SUPER_MAGIC
++#define BTRFS_SUPER_MAGIC 0x9123683E
++#endif
++
+ #if defined(HAVE_SYS_XATTR_H) && defined(HAVE_LGETXATTR) && !defined(__APPLE__)
+ 
+ struct _linuxattr_context{
+@@ -175,6 +179,7 @@ TRYAGAIN:
+ 	case JFS_SUPER_MAGIC:  fsname = "jfs" ; break;
+ 	case REISERFS_SUPER_MAGIC:fsname = "reiser" ; break;
+ 	case XFS_SUPER_MAGIC:  fsname = "xfs" ; break;
++	case BTRFS_SUPER_MAGIC:  fsname = "btrfs" ; break;
+ 	default: retval=0; goto BAIL;
+ 	};
+ 
+@@ -236,6 +241,7 @@ int32_t xar_linuxattr_extract(xar_t x, xar_file_t f, const char* file, char *buf
+ 	case JFS_SUPER_MAGIC:  fsname = "jfs" ; break;
+ 	case REISERFS_SUPER_MAGIC:fsname = "reiser" ; break;
+ 	case XFS_SUPER_MAGIC:  fsname = "xfs" ; break;
++	case BTRFS_SUPER_MAGIC:fsname = "btrfs" ; break;
+ 	};
+ 
+ 	for(p = xar_prop_pfirst(f); p; p = xar_prop_pnext(p)) {
+-- 
+2.44.1
+
diff --git a/pkgs/by-name/xa/xar/patches/0014-Fix-segfault-when-copying-xattr-buffers.patch b/pkgs/by-name/xa/xar/patches/0014-Fix-segfault-when-copying-xattr-buffers.patch
new file mode 100644
index 000000000000..6a9f3998e512
--- /dev/null
+++ b/pkgs/by-name/xa/xar/patches/0014-Fix-segfault-when-copying-xattr-buffers.patch
@@ -0,0 +1,123 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ivan Trubach <mr.trubach@icloud.com>
+Date: Sat, 27 Jul 2024 20:46:31 +0300
+Subject: [PATCH 14/19] Fix segfault when copying xattr buffers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+xar_linuxattr_read allocates an internal buffer and incrementally copies
+the data to xar_attrcopy_to_heap’s inbuf. This change fixes the offset
+handling by rewriting xar_linuxattr_read function from scratch (with an
+arguably cleaner implementation).
+---
+ xar/lib/linuxattr.c | 68 +++++++++++++++++++++++++++------------------
+ 1 file changed, 41 insertions(+), 27 deletions(-)
+
+diff --git a/xar/lib/linuxattr.c b/xar/lib/linuxattr.c
+index 496dd82..30c85c2 100644
+--- a/xar/lib/linuxattr.c
++++ b/xar/lib/linuxattr.c
+@@ -97,39 +97,50 @@ struct _linuxattr_context{
+ 
+ #define LINUXATTR_CONTEXT(x) ((struct _linuxattr_context *)(x))
+ 
+-int32_t xar_linuxattr_read(xar_t x, xar_file_t f, void * buf, size_t len, void *context) {
+-	
+-	if( !LINUXATTR_CONTEXT(context)->buf ) {
+-		int r;
+-		LINUXATTR_CONTEXT(context)->bufsz = 1024;
++int32_t xar_linuxattr_read(xar_t x, xar_file_t f, void *inbuf, size_t len, void *context) {
++	void *buf;
++	int bufsz, off, ret;
++	int r;
++
++	buf = LINUXATTR_CONTEXT(context)->buf;
++	bufsz = LINUXATTR_CONTEXT(context)->bufsz;
++	off = LINUXATTR_CONTEXT(context)->off;
++
++	if (buf == NULL) {
++		bufsz = 1024;
+ AGAIN2:
+-		LINUXATTR_CONTEXT(context)->buf = malloc(LINUXATTR_CONTEXT(context)->bufsz);
+-		if(!LINUXATTR_CONTEXT(context)->buf)
+-			goto AGAIN2;
+-		memset(LINUXATTR_CONTEXT(context)->buf, 0, LINUXATTR_CONTEXT(context)->bufsz);
+-		r = lgetxattr(LINUXATTR_CONTEXT(context)->file, LINUXATTR_CONTEXT(context)->attrname, LINUXATTR_CONTEXT(context)->buf, LINUXATTR_CONTEXT(context)->bufsz);
+-		if( r < 0 ) {
+-			switch(errno) {
+-			case ERANGE: LINUXATTR_CONTEXT(context)->bufsz *= 2; free(LINUXATTR_CONTEXT(context)->buf); goto AGAIN2;
+-			case ENOTSUP: free(LINUXATTR_CONTEXT(context)->buf); return 0;
+-			default: break;
++		buf = malloc(bufsz);
++		if (!buf) {
++			return -1;
++		}
++		memset(buf, 0, bufsz);
++		r = lgetxattr(LINUXATTR_CONTEXT(context)->file, LINUXATTR_CONTEXT(context)->attrname, buf, bufsz);
++		if (r < 0) {
++			free(buf);
++			switch (errno) {
++			case ERANGE:
++				bufsz *= 2;
++				goto AGAIN2;
++			case ENOTSUP:
++				return 0;
+ 			};
+ 			return -1;
+ 		}
++		LINUXATTR_CONTEXT(context)->buf = buf;
+ 		LINUXATTR_CONTEXT(context)->bufsz = r;
++		bufsz = r;
+ 	}
+ 
+-	if( (LINUXATTR_CONTEXT(context)->bufsz-LINUXATTR_CONTEXT(context)->off) <= len ) {
+-		int32_t ret;
+-		ret = LINUXATTR_CONTEXT(context)->bufsz - LINUXATTR_CONTEXT(context)->off;
+-		memcpy(buf, ((char *)LINUXATTR_CONTEXT(context)->buf)+LINUXATTR_CONTEXT(context)->off, ret);
+-		LINUXATTR_CONTEXT(context)->off += ret;
+-		return(ret);
+-	} else {
+-		memcpy(buf, ((char *)LINUXATTR_CONTEXT(context)->buf)+LINUXATTR_CONTEXT(context)->off, len);
+-		LINUXATTR_CONTEXT(context)->buf = ((char *)LINUXATTR_CONTEXT(context)->buf) + len;
+-		return len;
++	ret = bufsz - off;
++	if (ret <= len) {
++		memcpy(inbuf, ((char *)buf) + off, ret);
++		LINUXATTR_CONTEXT(context)->off = bufsz;
++		return ret;
+ 	}
++
++	memcpy(inbuf, ((char *)buf) + off, len);
++	LINUXATTR_CONTEXT(context)->off += len;
++	return len;
+ }
+ 
+ int32_t xar_linuxattr_write(xar_t x, xar_file_t f, void *buf, size_t len, void *context) {
+@@ -185,6 +196,7 @@ TRYAGAIN:
+ 
+ 	for( i=buf; (i-buf) < ret; i += strlen(i)+1 ) {
+ 		xar_ea_t e;
++		int rc;
+ 
+ 		context.bufsz = 0;
+ 		context.off = 0;
+@@ -194,11 +206,13 @@ TRYAGAIN:
+ 		xar_ea_pset(f, e, "fstype", fsname);
+ 		context.attrname = i;
+ 		context.ea = e;
+-		if (XAR(x)->attrcopy_to_heap(x, f, xar_ea_root(e), xar_linuxattr_read,&context) < 0) {
++		rc = XAR(x)->attrcopy_to_heap(x, f, xar_ea_root(e), xar_linuxattr_read, &context);
++		if (context.buf != NULL)
++			free(context.buf);
++		if (rc < 0) {
+ 			retval = -1;
+ 			goto BAIL;
+ 		}
+-		free(context.buf);
+ 		context.attrname = NULL;
+ 	}
+ 
+-- 
+2.44.1
+
diff --git a/pkgs/by-name/xa/xar/patches/0015-Fix-segfault-in-xar_attrcopy_from_heap.patch b/pkgs/by-name/xa/xar/patches/0015-Fix-segfault-in-xar_attrcopy_from_heap.patch
new file mode 100644
index 000000000000..bfec41f10a73
--- /dev/null
+++ b/pkgs/by-name/xa/xar/patches/0015-Fix-segfault-in-xar_attrcopy_from_heap.patch
@@ -0,0 +1,59 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ivan Trubach <mr.trubach@icloud.com>
+Date: Sat, 27 Jul 2024 21:04:20 +0300
+Subject: [PATCH 15/19] Fix segfault in xar_attrcopy_from_heap
+
+Fixes a nasty segfault crash when extracting files with extended
+attributes (and perhaps in other cases).
+
+xar_attrcopy_from_heap (in lib/io.c) must not assume that context is
+convertible to DATA_CONTEXT. Without this change, it calls the callback
+from the provided context as if it was DATA_CONTEXT, but the context can
+actually be other types, e.g. LINUXATTR_CONTEXT.
+---
+ xar/lib/data.c | 9 ++++++++-
+ xar/lib/io.c   | 3 ---
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/xar/lib/data.c b/xar/lib/data.c
+index dcb5783..cfb3d58 100644
+--- a/xar/lib/data.c
++++ b/xar/lib/data.c
+@@ -245,6 +245,13 @@ int32_t xar_data_extract(xar_t x, xar_file_t f, const char *file, char *buffer,
+ 	return retval;
+ }
+ 
++static int xar_data_verify_callback(xar_t x, xar_file_t f, void *inbuf, size_t bsize, void *context) {
++	DATA_CONTEXT(context)->total += bsize;
++	if (DATA_CONTEXT(context)->progress)
++		DATA_CONTEXT(context)->progress(x, f, DATA_CONTEXT(context)->total);
++	return 0;
++}
++
+ int32_t xar_data_verify(xar_t x, xar_file_t f, xar_progress_callback p)
+ {
+ 	const char *opt;
+@@ -269,5 +276,5 @@ int32_t xar_data_verify(xar_t x, xar_file_t f, xar_progress_callback p)
+ 	if (!tmpp)		// It appears that xar can have truely empty files, aka, no data. We should just fail to verify these files. 
+ 		return 0;	// After all, the checksum of blank is meaningless. So, failing to do so will cause a crash.
+ 	
+-	return XAR(x)->attrcopy_from_heap(x, f, tmpp, NULL , (void *)(&context));
++	return XAR(x)->attrcopy_from_heap(x, f, tmpp, xar_data_verify_callback, (void *)(&context));
+ }
+diff --git a/xar/lib/io.c b/xar/lib/io.c
+index fb9a72e..64c69af 100644
+--- a/xar/lib/io.c
++++ b/xar/lib/io.c
+@@ -529,9 +529,6 @@ int32_t xar_attrcopy_from_heap(xar_t x, xar_file_t f, xar_prop_t p, write_callba
+ 		
+ 		readsofar += bsize;
+ 		
+-		if (DATA_CONTEXT(context)->progress)
+-			DATA_CONTEXT(context)->progress(x, f, readsofar);
+-		
+ 		bsize = def_bsize;
+ 	}
+ 
+-- 
+2.44.1
+
diff --git a/pkgs/by-name/xa/xar/patches/0016-Do-not-set-property-for-empty-ACL.patch b/pkgs/by-name/xa/xar/patches/0016-Do-not-set-property-for-empty-ACL.patch
new file mode 100644
index 000000000000..d036d1e3eb82
--- /dev/null
+++ b/pkgs/by-name/xa/xar/patches/0016-Do-not-set-property-for-empty-ACL.patch
@@ -0,0 +1,90 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ivan Trubach <mr.trubach@icloud.com>
+Date: Sun, 28 Jul 2024 12:00:01 +0300
+Subject: [PATCH 16/19] Do not set property for empty ACL
+
+On Linux, acl_get_file helpfully converts file mode bits to ACL if no
+extended attribute is set. See
+https://git.savannah.nongnu.org/cgit/acl.git/tree/libacl/acl_get_file.c?id=d9bb1759d4dad2f28a6dcc8c1742ff75d16dd10d#n83
+
+At the same time, Nix sandbox does not filter getxattr syscalls to
+return ENOTSUP, but does filter setxattr. So we are in a intricate
+situation where acl library thinks that EAs/ACLs are supported and
+returns meaningful values for reads, so xar archives files with acl
+property, but extraction fails because of the syscall filter.
+
+As a workaround, we add acl_extended_file check that actually returns
+whether the file is associated with ACLs (internally represented as
+extended attributes).
+---
+ xar/configure.ac        | 5 ++---
+ xar/include/config.h.in | 2 ++
+ xar/lib/stat.c          | 9 +++++++++
+ 3 files changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/xar/configure.ac b/xar/configure.ac
+index e466ee0..c3d9ff7 100644
+--- a/xar/configure.ac
++++ b/xar/configure.ac
+@@ -180,9 +180,8 @@ fi
+ )
+ AC_SUBST([enable_autogen])
+ 
+-AC_TRY_COMPILE([#include <sys/types.h> 
+-#include <sys/acl.h>], [acl_t a], [AC_DEFINE([HAVE_SYS_ACL_H],[1], [define if you have sys/acl.h and it has a working acl_t type])])
+-AC_CHECK_HEADERS(ext2fs/ext2_fs.h sys/statfs.h sys/vfs.h sys/xattr.h sys/param.h sys/extattr.h libutil.h)
++AC_CHECK_HEADERS(sys/acl.h acl/libacl.h ext2fs/ext2_fs.h sys/statfs.h sys/vfs.h sys/xattr.h sys/param.h sys/extattr.h libutil.h)
++AC_CHECK_DECLS([acl_extended_file], [], [], [[#include <acl/libacl.h>]])
+ AC_CHECK_FUNCS(lgetxattr)
+ AC_CHECK_FUNCS(lsetxattr)
+ AC_CHECK_FUNCS(getxattr)
+diff --git a/xar/include/config.h.in b/xar/include/config.h.in
+index 16c72d3..779f5aa 100644
+--- a/xar/include/config.h.in
++++ b/xar/include/config.h.in
+@@ -3,6 +3,7 @@
+ #undef HAVE_SYS_XATTR_H
+ #undef HAVE_SYS_EXTATTR_H
+ #undef HAVE_SYS_PARAM_H
++#undef HAVE_DECL_ACL_EXTENDED_FILE
+ #undef HAVE_LGETXATTR
+ #undef HAVE_LSETXATTR
+ #undef HAVE_GETXATTR
+@@ -12,6 +13,7 @@
+ #undef HAVE_CHFLAGS
+ #undef HAVE_STATVFS
+ #undef HAVE_STATFS
++#undef HAVE_ACL_LIBACL_H
+ #undef HAVE_EXT2FS_EXT2_FS_H
+ #undef HAVE_STRUCT_STAT_ST_FLAGS
+ #undef HAVE_STRUCT_STATVFS_F_FSTYPENAME
+diff --git a/xar/lib/stat.c b/xar/lib/stat.c
+index b0cce7c..81771dc 100644
+--- a/xar/lib/stat.c
++++ b/xar/lib/stat.c
+@@ -66,6 +66,9 @@
+ #ifdef HAVE_SYS_ACL_H
+ #include <sys/acl.h>
+ #endif
++#ifdef HAVE_ACL_LIBACL_H
++#include <acl/libacl.h>
++#endif
+ #include "xar.h"
+ #include "arcmod.h"
+ #include "archive.h"
+@@ -131,6 +134,12 @@ static int32_t aacls(xar_t x, xar_file_t f, const char *file) {
+ 	if( !xar_check_prop(x, "acl") )
+ 		return 0;
+ 
++#ifdef HAVE_DECL_ACL_EXTENDED_FILE
++	/* Do nothing if the file is not associated with ACL. */
++	if( !acl_extended_file(file) )
++		return 0;
++#endif
++
+ 	a = acl_get_file(file, ACL_TYPE_DEFAULT);
+ 	if( a ) {
+ 		char *t;
+-- 
+2.44.1
+
diff --git a/pkgs/by-name/xa/xar/patches/0017-Fix-time-format-for-musl.patch b/pkgs/by-name/xa/xar/patches/0017-Fix-time-format-for-musl.patch
new file mode 100644
index 000000000000..6123eef845f8
--- /dev/null
+++ b/pkgs/by-name/xa/xar/patches/0017-Fix-time-format-for-musl.patch
@@ -0,0 +1,75 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ivan Trubach <mr.trubach@icloud.com>
+Date: Tue, 30 Jul 2024 16:06:57 +0300
+Subject: [PATCH 17/19] Fix time format for musl
+
+Directive %F is not supported in musl (until recent versions).
+https://git.musl-libc.org/cgit/musl/commit/src/time/strptime.c?id=fced99e93daeefb0192fd16304f978d4401d1d77
+
+Avoid using it for str[fp]time.
+---
+ xar/lib/stat.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/xar/lib/stat.c b/xar/lib/stat.c
+index 81771dc..d71a613 100644
+--- a/xar/lib/stat.c
++++ b/xar/lib/stat.c
+@@ -82,6 +82,8 @@
+ #define LLONG_MAX LONG_LONG_MAX
+ #endif
+ 
++static const char time_format[] = "%Y-%m-%dT%H:%M:%SZ";
++
+ static struct {
+ 	const char *name;
+ 	mode_t type;
+@@ -513,24 +515,21 @@ int32_t xar_stat_archive(xar_t x, xar_file_t f, const char *file, const char *bu
+ 	if( xar_check_prop(x, "atime") ) {
+ 		gmtime_r(&XAR(x)->sbcache.st_atime, &t);
+ 		memset(time, 0, sizeof(time));
+-		strftime(time, sizeof(time), "%FT%T", &t);
+-		strcat(time, "Z");
++		strftime(time, sizeof(time), time_format, &t);
+ 		xar_prop_set(f, "atime", time);
+ 	}
+ 
+ 	if( xar_check_prop(x, "mtime") ) {
+ 		gmtime_r(&XAR(x)->sbcache.st_mtime, &t);
+ 		memset(time, 0, sizeof(time));
+-		strftime(time, sizeof(time), "%FT%T", &t);
+-		strcat(time, "Z");
++		strftime(time, sizeof(time), time_format, &t);
+ 		xar_prop_set(f, "mtime", time);
+ 	}
+ 
+ 	if( xar_check_prop(x, "ctime") ) {
+ 		gmtime_r(&XAR(x)->sbcache.st_ctime, &t);
+ 		memset(time, 0, sizeof(time));
+-		strftime(time, sizeof(time), "%FT%T", &t);
+-		strcat(time, "Z");
++		strftime(time, sizeof(time), time_format, &t);
+ 		xar_prop_set(f, "ctime", time);
+ 	}
+ 
+@@ -680,7 +679,7 @@ int32_t xar_set_perm(xar_t x, xar_file_t f, const char *file, char *buffer, size
+ 	xar_prop_get(f, "atime", &timestr);
+ 	if( timestr ) {
+ 		memset(&t, 0, sizeof(t));
+-		strptime(timestr, "%FT%T", &t);
++		strptime(timestr, time_format, &t);
+ 		tv[ATIME].tv_sec = timegm(&t);
+ 	} else {
+ 		tv[ATIME].tv_sec = time(NULL);
+@@ -689,7 +688,7 @@ int32_t xar_set_perm(xar_t x, xar_file_t f, const char *file, char *buffer, size
+ 	xar_prop_get(f, "mtime", &timestr);
+ 	if( timestr ) {
+ 		memset(&t, 0, sizeof(t));
+-		strptime(timestr, "%FT%T", &t);
++		strptime(timestr, time_format, &t);
+ 		tv[MTIME].tv_sec = timegm(&t);
+ 	} else {
+ 		tv[MTIME].tv_sec = time(NULL);
+-- 
+2.44.1
+
diff --git a/pkgs/by-name/xa/xar/patches/0018-Replace-memcpy-with-memmove-for-musl.patch b/pkgs/by-name/xa/xar/patches/0018-Replace-memcpy-with-memmove-for-musl.patch
new file mode 100644
index 000000000000..2b8c17100951
--- /dev/null
+++ b/pkgs/by-name/xa/xar/patches/0018-Replace-memcpy-with-memmove-for-musl.patch
@@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ivan Trubach <mr.trubach@icloud.com>
+Date: Tue, 30 Jul 2024 17:29:06 +0300
+Subject: [PATCH 18/19] Replace memcpy with memmove for musl
+
+---
+ xar/lib/io.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/xar/lib/io.c b/xar/lib/io.c
+index 64c69af..c962c4b 100644
+--- a/xar/lib/io.c
++++ b/xar/lib/io.c
+@@ -650,7 +650,7 @@ static int32_t flush_stream(xar_stream *stream) {
+ 			state->pending_buf = NULL;
+ 		} else if( state->pending_buf_size > len ) {
+ 			state->pending_buf_size -= len;
+-			memcpy(state->pending_buf, state->pending_buf + len, state->pending_buf_size);
++			memmove(state->pending_buf, state->pending_buf + len, state->pending_buf_size);
+ 		}
+ 	}
+ 
+-- 
+2.44.1
+
diff --git a/pkgs/by-name/xa/xar/patches/0019-Prefer-OpenSSL-over-CommonCrypto-if-available.patch b/pkgs/by-name/xa/xar/patches/0019-Prefer-OpenSSL-over-CommonCrypto-if-available.patch
new file mode 100644
index 000000000000..622ae16dc5fe
--- /dev/null
+++ b/pkgs/by-name/xa/xar/patches/0019-Prefer-OpenSSL-over-CommonCrypto-if-available.patch
@@ -0,0 +1,150 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ivan Trubach <mr.trubach@icloud.com>
+Date: Sat, 24 Aug 2024 10:44:09 +0300
+Subject: [PATCH 19/19] Prefer OpenSSL over CommonCrypto if available
+
+In Nixpkgs, we always have OpenSSL input available, so it makes sense to
+prefer it over the CommonCrypto library.
+See https://github.com/NixOS/nixpkgs/pull/329721#discussion_r1713492113
+---
+ xar/configure.ac        |  5 ++++-
+ xar/include/config.h.in |  1 +
+ xar/lib/archive.h       |  6 ------
+ xar/lib/hash.c          | 20 +++++++++++---------
+ 4 files changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/xar/configure.ac b/xar/configure.ac
+index c3d9ff7..f7626bf 100644
+--- a/xar/configure.ac
++++ b/xar/configure.ac
+@@ -299,9 +299,12 @@ dnl
+ have_openssl="1"
+ AC_CHECK_HEADERS([openssl/evp.h], , [have_openssl="0"])
+ AC_CHECK_LIB([crypto], [OPENSSL_config], , [have_openssl="0"])
+-if test "x${have_openssl}" = "x0" ; then
++if test "x${have_openssl}" = "x1" ; then
++  AC_DEFINE([HAVE_OPENSSL], [], [HAVE_OPENSSL])
++else
+   case "${host}" in
+     *-*-darwin*)
++      # Darwin uses CommonCrypto if OpenSSL is not available.
+       ;;
+     *)
+       AC_MSG_ERROR([Cannot build without OpenSSL for non-Darwin host])
+diff --git a/xar/include/config.h.in b/xar/include/config.h.in
+index 779f5aa..dd44002 100644
+--- a/xar/include/config.h.in
++++ b/xar/include/config.h.in
+@@ -24,6 +24,7 @@
+ #undef HAVE_LIBUTIL_H
+ #undef HAVE_LIBPTHREAD
+ #undef HAVE_ASPRINTF
++#undef HAVE_OPENSSL
+ #undef HAVE_LIBBZ2
+ #undef HAVE_LIBLZMA
+ #undef HAVE_LCHOWN
+diff --git a/xar/lib/archive.h b/xar/lib/archive.h
+index f926245..8743120 100644
+--- a/xar/lib/archive.h
++++ b/xar/lib/archive.h
+@@ -40,12 +40,6 @@
+ #define _XAR_ARCHIVE_H_
+ #include <zlib.h>
+ #include <libxml/hash.h>
+-#ifdef __APPLE__
+-#include <CommonCrypto/CommonDigest.h>
+-#include <CommonCrypto/CommonDigestSPI.h>
+-#else
+-#include <openssl/evp.h>
+-#endif
+ #include <sys/types.h>
+ #include <sys/stat.h>
+ #include "xar.h"
+diff --git a/xar/lib/hash.c b/xar/lib/hash.c
+index cb4f6cf..b99eca9 100644
+--- a/xar/lib/hash.c
++++ b/xar/lib/hash.c
+@@ -41,7 +41,10 @@
+ #include <string.h>
+ #include <sys/types.h>
+ #include <zlib.h>
+-#ifdef __APPLE__
++
++#include "config.h"
++
++#if !defined(HAVE_OPENSSL)
+ #include <CommonCrypto/CommonDigest.h>
+ #include <CommonCrypto/CommonDigestSPI.h>
+ #else
+@@ -50,7 +53,6 @@
+ 
+ #include "xar.h"
+ #include "hash.h"
+-#include "config.h"
+ #ifndef HAVE_ASPRINTF
+ #include "asprintf.h"
+ #endif
+@@ -58,7 +60,7 @@
+ 
+ #pragma mark Hash Wrapper Object
+ 
+-#ifdef __APPLE__
++#if !defined(HAVE_OPENSSL)
+ 
+ CCDigestRef digestRef_from_name(const char* name, unsigned int *outHashSize) {
+     CCDigestRef result = NULL;
+@@ -88,13 +90,13 @@ CCDigestRef digestRef_from_name(const char* name, unsigned int *outHashSize) {
+ 	
+     return result;
+ }
+-#endif // __APPLE__
++#endif // !defined(HAVE_OPENSSL)
+ 
+ 
+ struct __xar_hash_t {
+ 	const char *digest_name;
+ 	void *context;
+-#ifdef __APPLE__
++#if !defined(HAVE_OPENSSL)
+ 	CCDigestRef digest;
+ #else
+ 	EVP_MD_CTX *digest;
+@@ -113,7 +115,7 @@ xar_hash_t xar_hash_new(const char *digest_name, void *context) {
+ 	if( context )
+ 		HASH_CTX(hash)->context = context;
+ 	
+-#ifdef __APPLE__
++#if !defined(HAVE_OPENSSL)
+ 	HASH_CTX(hash)->digest = digestRef_from_name(digest_name, &HASH_CTX(hash)->length);
+ #else
+ 	OpenSSL_add_all_digests();
+@@ -136,7 +138,7 @@ const char *xar_hash_get_digest_name(xar_hash_t hash) {
+ }
+ 
+ void xar_hash_update(xar_hash_t hash, void *buffer, size_t nbyte) {
+-#ifdef __APPLE__
++#if !defined(HAVE_OPENSSL)
+ 	CCDigestUpdate(HASH_CTX(hash)->digest, buffer, nbyte);
+ #else
+ 	EVP_DigestUpdate(HASH_CTX(hash)->digest, buffer, nbyte);
+@@ -144,7 +146,7 @@ void xar_hash_update(xar_hash_t hash, void *buffer, size_t nbyte) {
+ }
+ 
+ void *xar_hash_finish(xar_hash_t hash, size_t *nbyte) {
+-#ifdef __APPLE__
++#if !defined(HAVE_OPENSSL)
+ 	void *buffer = calloc(1, CC_SHA512_DIGEST_LENGTH); // current biggest digest size  This is what OpenSSL uses
+ #else
+ 	void *buffer = calloc(1, EVP_MAX_MD_SIZE);
+@@ -152,7 +154,7 @@ void *xar_hash_finish(xar_hash_t hash, size_t *nbyte) {
+ 	if( ! buffer )
+ 		return NULL;
+ 	
+-#ifdef __APPLE__
++#if !defined(HAVE_OPENSSL)
+ 	CCDigestFinal(HASH_CTX(hash)->digest, buffer);
+ 	CCDigestDestroy(HASH_CTX(hash)->digest);
+ #else
+-- 
+2.44.1
+
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 13d53ad6e678..b8c8f1219c9d 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -2331,7 +2331,7 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
             openpam
             openssl.out
             patch
-            xar
+            xar.lib
             xz.bin
             xz.out
             zlib.dev
diff --git a/pkgs/tools/compression/xar/default.nix b/pkgs/tools/compression/xar/default.nix
deleted file mode 100644
index 9c03c41054be..000000000000
--- a/pkgs/tools/compression/xar/default.nix
+++ /dev/null
@@ -1,49 +0,0 @@
-{ lib, stdenv, fetchurl, pkg-config, libxml2, xz, openssl, zlib, bzip2, fts, autoreconfHook }:
-
-stdenv.mkDerivation rec {
-  version = "1.6.1";
-  pname = "xar";
-
-  src = fetchurl {
-    url    = "https://github.com/downloads/mackyle/xar/${pname}-${version}.tar.gz";
-    sha256 = "0ghmsbs6xwg1092v7pjcibmk5wkyifwxw6ygp08gfz25d2chhipf";
-  };
-
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ libxml2 xz openssl zlib bzip2 fts ];
-
-  patches = [
-    ./0001-Add-useless-descriptions-to-AC_DEFINE.patch
-    ./0002-Use-pkg-config-for-libxml2.patch
-  ];
-
-  postPatch = ''
-    substituteInPlace configure.ac \
-      --replace 'OpenSSL_add_all_ciphers' 'OPENSSL_init_crypto' \
-      --replace 'openssl/evp.h' 'openssl/crypto.h'
-  '';
-
-  configureFlags = lib.optional (fts != null) "LDFLAGS=-lfts";
-
-  meta = {
-    homepage    = "https://mackyle.github.io/xar/";
-    description = "Extensible Archiver";
-
-    longDescription =
-      '' The XAR project aims to provide an easily extensible archive format.
-         Important design decisions include an easily extensible XML table of
-         contents for random access to archived files, storing the toc at the
-         beginning of the archive to allow for efficient handling of streamed
-         archives, the ability to handle files of arbitrarily large sizes, the
-         ability to choose independent encodings for individual files in the
-         archive, the ability to store checksums for individual files in both
-         compressed and uncompressed form, and the ability to query the table
-         of content's rich meta-data.
-      '';
-
-    license     = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ copumpkin ];
-    platforms   = lib.platforms.all;
-    mainProgram = "xar";
-  };
-}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a0d28150f966..fdaaf001d650 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -14082,8 +14082,6 @@ with pkgs;
 
   vul = callPackage ../applications/misc/vul { };
 
-  xar = callPackage ../tools/compression/xar { };
-
   xarchive = callPackage ../tools/archivers/xarchive { };
 
   xarchiver = callPackage ../tools/archivers/xarchiver { };

From f3ece34945e145358cd8c2604b37fb683393f510 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 25 Aug 2024 17:08:37 +0100
Subject: [PATCH 063/115] nixos/postgresql: fix documentation markdown

Without the change the doc build fails as:

    $ nix build -f nixos config.system.build.manual.manualHTML -L
    ...
    nixos-manual-html> RuntimeError: heading in line 366 does not have an id
---
 nixos/modules/services/databases/postgresql.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/databases/postgresql.md b/nixos/modules/services/databases/postgresql.md
index 4de0ca9d2e90..77c87e3f063b 100644
--- a/nixos/modules/services/databases/postgresql.md
+++ b/nixos/modules/services/databases/postgresql.md
@@ -363,6 +363,6 @@ postgresql.withJIT.pname
 
 evaluates to `"foobar"`.
 
-## Notable differences to upstream
+## Notable differences to upstream {#module-services-postgres-upstream-deviation}
 
 - To avoid circular dependencies between default and -dev outputs, the output of the `pg_config` system view has been removed.

From 2f9c580c6f48b8bdea941188b85389601c1ad867 Mon Sep 17 00:00:00 2001
From: Ivan Trubach <mr.trubach@icloud.com>
Date: Mon, 26 Aug 2024 01:48:48 +0300
Subject: [PATCH 064/115] postgresql: use systemdLibs

Reduces the set of dependencies required to build PostgreSQL.
---
 pkgs/servers/sql/postgresql/generic.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index 08b32befb672..ad2bd184a4e2 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -3,12 +3,12 @@ let
   generic =
       # dependencies
       { stdenv, lib, fetchurl, fetchpatch, makeWrapper
-      , glibc, zlib, readline, openssl, icu, lz4, zstd, systemd, libossp_uuid
+      , glibc, zlib, readline, openssl, icu, lz4, zstd, systemdLibs, libossp_uuid
       , pkg-config, libxml2, tzdata, libkrb5, substituteAll, darwin
       , linux-pam
 
       # This is important to obtain a version of `libpq` that does not depend on systemd.
-      , systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd && !stdenv.hostPlatform.isStatic
+      , systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs && !stdenv.hostPlatform.isStatic
       , enableSystemd ? null
       , gssSupport ? with stdenv.hostPlatform; !isWindows && !isStatic
 
@@ -69,7 +69,7 @@ let
       ++ lib.optionals jitSupport [ llvmPackages.llvm ]
       ++ lib.optionals lz4Enabled [ lz4 ]
       ++ lib.optionals zstdEnabled [ zstd ]
-      ++ lib.optionals systemdSupport' [ systemd ]
+      ++ lib.optionals systemdSupport' [ systemdLibs ]
       ++ lib.optionals pythonSupport [ python3 ]
       ++ lib.optionals gssSupport [ libkrb5 ]
       ++ lib.optionals stdenv'.isLinux [ linux-pam ]

From 23eacd40cf5907665262e0dbeb24dc4347c575d1 Mon Sep 17 00:00:00 2001
From: Ivan Trubach <mr.trubach@icloud.com>
Date: Mon, 19 Aug 2024 17:28:11 +0300
Subject: [PATCH 065/115] gnupatch: fix segfault on cleanup

See https://savannah.gnu.org/bugs/?57717

Reproducer:

```console
$ patch -p1 <<'EOF'
diff --git a/file2.txt b/file2.txt
index e69de29..d20e9cd 100644
--- a/file2.txt
+++ b/file2.txt
@@ -1 +1 @@
-old content
+new content
EOF
```

```
(repeated lines omitted)
patch: **** Can't create file file2.txt.orig : Too many open files
patch: **** Can't create file file2.txt.orig : Too many open files
patch: **** Can't create file file2.txt.origSegmentation fault (core dumped)
```
---
 .../Abort_when_cleaning_up_fails.patch        | 51 +++++++++++++++++++
 pkgs/tools/text/gnupatch/default.nix          |  3 ++
 2 files changed, 54 insertions(+)
 create mode 100644 pkgs/tools/text/gnupatch/Abort_when_cleaning_up_fails.patch

diff --git a/pkgs/tools/text/gnupatch/Abort_when_cleaning_up_fails.patch b/pkgs/tools/text/gnupatch/Abort_when_cleaning_up_fails.patch
new file mode 100644
index 000000000000..ab3baf80f8c1
--- /dev/null
+++ b/pkgs/tools/text/gnupatch/Abort_when_cleaning_up_fails.patch
@@ -0,0 +1,51 @@
+From b7b028a77bd855f6f56b17c8837fc1cca77b469d Mon Sep 17 00:00:00 2001
+From: Andreas Gruenbacher <agruen@gnu.org>
+Date: Fri, 28 Jun 2019 00:30:25 +0200
+Subject: Abort when cleaning up fails
+
+When a fatal error triggers during cleanup, another attempt will be made to
+clean up, which will likely lead to the same fatal error.  So instead, bail out
+when that happens.
+src/patch.c (cleanup): Bail out when called recursively.
+(main): There is no need to call output_files() before cleanup() as cleanup()
+already does that.
+---
+ src/patch.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/src/patch.c b/src/patch.c
+index 4616a48..02fd982 100644
+--- a/src/patch.c
++++ b/src/patch.c
+@@ -685,7 +685,6 @@ main (int argc, char **argv)
+     }
+     if (outstate.ofp && (ferror (outstate.ofp) || fclose (outstate.ofp) != 0))
+       write_fatal ();
+-    output_files (NULL);
+     cleanup ();
+     delete_files ();
+     if (somefailed)
+@@ -1991,7 +1990,6 @@ void
+ fatal_exit (int sig)
+ {
+   cleanup ();
+-
+   if (sig)
+     exit_with_signal (sig);
+ 
+@@ -2011,6 +2009,12 @@ remove_if_needed (char const *name, bool *needs_removal)
+ static void
+ cleanup (void)
+ {
++  static bool already_cleaning_up;
++
++  if (already_cleaning_up)
++    return;
++  already_cleaning_up = true;
++
+   remove_if_needed (TMPINNAME, &TMPINNAME_needs_removal);
+   remove_if_needed (TMPOUTNAME, &TMPOUTNAME_needs_removal);
+   remove_if_needed (TMPPATNAME, &TMPPATNAME_needs_removal);
+-- 
+cgit v1.1
+
diff --git a/pkgs/tools/text/gnupatch/default.nix b/pkgs/tools/text/gnupatch/default.nix
index c19e087ea547..19d8652396c9 100644
--- a/pkgs/tools/text/gnupatch/default.nix
+++ b/pkgs/tools/text/gnupatch/default.nix
@@ -18,6 +18,9 @@ stdenv.mkDerivation rec {
     # https://git.savannah.gnu.org/cgit/patch.git/patch/?id=b5a91a01e5d0897facdd0f49d64b76b0f02b43e1
     ./Allow_input_files_to_be_missing_for_ed-style_patches.patch
 
+    # https://git.savannah.gnu.org/cgit/patch.git/patch/?id=b7b028a77bd855f6f56b17c8837fc1cca77b469d
+    ./Abort_when_cleaning_up_fails.patch
+
     # https://git.savannah.gnu.org/cgit/patch.git/patch/?id=123eaff0d5d1aebe128295959435b9ca5909c26d
     ./CVE-2018-1000156.patch
 

From 005b0d6ef55ce26badb81883a7394893ae791e6c Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Mon, 26 Aug 2024 17:52:13 +0300
Subject: [PATCH 066/115] graphene: fix `tests.installedTests`

`glib`'s typelib was split from `gobject-introspection`.

`ImportError: Typelib file for namespace 'GObject', version '2.0' not found`
---
 pkgs/development/libraries/graphene/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/graphene/default.nix b/pkgs/development/libraries/graphene/default.nix
index 7b64aa2bc586..a1f3fee6656d 100644
--- a/pkgs/development/libraries/graphene/default.nix
+++ b/pkgs/development/libraries/graphene/default.nix
@@ -103,7 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
   in lib.optionalString withIntrospection ''
     if [ -x '${introspectionPy}' ] ; then
       wrapProgram '${introspectionPy}' \
-        --prefix GI_TYPELIB_PATH : "$out/lib/girepository-1.0"
+        --prefix GI_TYPELIB_PATH : "${lib.makeSearchPath "lib/girepository-1.0" [ glib.out (placeholder "out") ]}"
     fi
   '';
 

From 1feaea91067bd93947cba889f2479c1733908880 Mon Sep 17 00:00:00 2001
From: Ben Darwin <bcdarwin@gmail.com>
Date: Tue, 27 Aug 2024 00:13:11 -0400
Subject: [PATCH 067/115] swig: swig3 -> swig4

---
 pkgs/top-level/all-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index adf61ba3d026..46084dc70a2e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -19018,7 +19018,7 @@ with pkgs;
 
   swig3 = callPackage ../development/tools/misc/swig/3.x.nix { };
   swig4 = callPackage ../development/tools/misc/swig/4.nix { };
-  swig = swig3;
+  swig = swig4;
   swigWithJava = swig;
 
   c2ffi = callPackage ../development/tools/misc/c2ffi { };

From 4075c526ec619f32a946c2cb93f9e081cdc38014 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Tue, 27 Aug 2024 18:23:51 +0300
Subject: [PATCH 068/115] python312Packages.scipy: don't use with lib in meta

---
 pkgs/development/python-modules/scipy/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index c6daa99905d2..aad048e88f52 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -211,12 +211,12 @@ buildPythonPackage {
 
   SCIPY_USE_G77_ABI_WRAPPER = 1;
 
-  meta = with lib; {
+  meta = {
     changelog = "https://github.com/scipy/scipy/releases/tag/v${version}";
     description = "SciPy (pronounced 'Sigh Pie') is open-source software for mathematics, science, and engineering";
     downloadPage = "https://github.com/scipy/scipy";
     homepage = "https://www.scipy.org/";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ doronbehar ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ doronbehar ];
   };
 }

From 5d63abee89ac0afca31bf7e35be438194634ebc9 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Tue, 27 Aug 2024 18:26:03 +0300
Subject: [PATCH 069/115] python312Packages.scipy: use modern deps Python
 attributes

---
 pkgs/development/python-modules/scipy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index aad048e88f52..028771ca5dbf 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -95,7 +95,7 @@ buildPythonPackage {
       --replace-fail "pybind11>=2.12.0,<2.13.0" "pybind11>=2.12.0" \
   '';
 
-  nativeBuildInputs = [
+  build-system = [
     cython
     gfortran
     meson-python
@@ -120,7 +120,7 @@ buildPythonPackage {
     xsimd
   ];
 
-  propagatedBuildInputs = [ numpy ];
+  dependencies = [ numpy ];
 
   __darwinAllowLocalNetworking = true;
 

From 0c8ccd6b96b5c755f63a50822e5fd44f35b9ff4d Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Tue, 27 Aug 2024 20:43:16 +0300
Subject: [PATCH 070/115] luaPackages.luarocks_bootstrap: Fix build

I don't know what conditions are necessary to have the files in
`/etc/luarocks` populated so using `replace-quiet`.

At least on cross there is a file which contains configuration.
---
 pkgs/development/tools/misc/luarocks/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/misc/luarocks/default.nix b/pkgs/development/tools/misc/luarocks/default.nix
index 996bfeacb2d1..b15924b34f3c 100644
--- a/pkgs/development/tools/misc/luarocks/default.nix
+++ b/pkgs/development/tools/misc/luarocks/default.nix
@@ -66,7 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = ''
     sed -e "1s@.*@#! ${lua}/bin/lua$LUA_SUFFIX@" -i "$out"/bin/*
     substituteInPlace $out/etc/luarocks/* \
-     --replace-fail '${lua.luaOnBuild}' '${lua}'
+     --replace-quiet '${lua.luaOnBuild}' '${lua}'
    ''
     + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd luarocks \

From 34123fcafb67ccc676fe5520f2ff1f31c8278ab7 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Tue, 27 Aug 2024 18:30:09 +0300
Subject: [PATCH 071/115] python312Packages.scipy: cleaning + inputs sorting

---
 .../python-modules/scipy/default.nix          | 70 +++++++++++--------
 1 file changed, 39 insertions(+), 31 deletions(-)

diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 028771ca5dbf..5084f741c838 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -1,34 +1,41 @@
 {
   lib,
   stdenv,
-  fetchFromGitHub,
-  fetchpatch,
   fetchurl,
   writeText,
-  xcbuild,
   python,
   buildPythonPackage,
+  fetchFromGitHub,
+  fetchpatch,
+
+  # build-system
   cython,
   gfortran,
   meson-python,
   nukeReferences,
-  pkg-config,
   pythran,
-  wheel,
+  pkg-config,
   setuptools,
-  hypothesis,
-  pytest7CheckHook,
-  pytest-xdist,
-  numpy,
-  pybind11,
-  pooch,
-  xsimd,
+  xcbuild,
+
+  # buildInputs
   # Upstream has support for using Darwin's Accelerate package. However this
   # requires a Darwin user to work on a nice way to do that via an override.
   # See:
   # https://github.com/scipy/scipy/blob/v1.14.0/scipy/meson.build#L194-L211
   blas,
   lapack,
+  pybind11,
+  pooch,
+  xsimd,
+
+  # dependencies
+  numpy,
+
+  # tests
+  hypothesis,
+  pytest7CheckHook,
+  pytest-xdist,
 
   # Reverse dependency
   sage,
@@ -66,12 +73,12 @@ let
 in
 buildPythonPackage {
   inherit pname version;
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scipy";
-    repo = pname;
-    rev = "v${version}";
+    repo = "scipy";
+    rev = "refs/tags/v${version}";
     hash = srcHash;
     fetchSubmodules = true;
   };
@@ -95,22 +102,23 @@ buildPythonPackage {
       --replace-fail "pybind11>=2.12.0,<2.13.0" "pybind11>=2.12.0" \
   '';
 
-  build-system = [
-    cython
-    gfortran
-    meson-python
-    nukeReferences
-    pythran
-    pkg-config
-    wheel
-    setuptools
-  ] ++ lib.optionals stdenv.isDarwin [
-    # Minimal version required according to:
-    # https://github.com/scipy/scipy/blob/v1.14.0/scipy/meson.build#L185-L188
-    (xcbuild.override {
-      sdkVer = "13.3";
-    })
-  ];
+  build-system =
+    [
+      cython
+      gfortran
+      meson-python
+      nukeReferences
+      pythran
+      pkg-config
+      setuptools
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      # Minimal version required according to:
+      # https://github.com/scipy/scipy/blob/v1.14.0/scipy/meson.build#L185-L188
+      (xcbuild.override {
+        sdkVer = "13.3";
+      })
+    ];
 
   buildInputs = [
     blas

From 8f4200d165b73db63dc277e9984a480984415593 Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Wed, 14 Aug 2024 11:16:23 -0300
Subject: [PATCH 072/115] installShellFiles: move setup script to the same
 directory

So that it can be migrated to by-name later.
---
 pkgs/build-support/install-shell-files/default.nix            | 4 ++--
 .../setup-hook.sh}                                            | 0
 2 files changed, 2 insertions(+), 2 deletions(-)
 rename pkgs/build-support/{setup-hooks/install-shell-files.sh => install-shell-files/setup-hook.sh} (100%)

diff --git a/pkgs/build-support/install-shell-files/default.nix b/pkgs/build-support/install-shell-files/default.nix
index d50661ddc65d..00f3caa7f721 100644
--- a/pkgs/build-support/install-shell-files/default.nix
+++ b/pkgs/build-support/install-shell-files/default.nix
@@ -1,8 +1,8 @@
 { makeSetupHook, tests }:
 
-# See the header comment in ../setup-hooks/install-shell-files.sh for example usage.
+# See the header comment in ./setup-hook.sh for example usage.
 let
-  setupHook = makeSetupHook { name = "install-shell-files"; } ../setup-hooks/install-shell-files.sh;
+  setupHook = makeSetupHook { name = "install-shell-files"; } ./setup-hook.sh;
 in
 
 setupHook.overrideAttrs (oldAttrs: {
diff --git a/pkgs/build-support/setup-hooks/install-shell-files.sh b/pkgs/build-support/install-shell-files/setup-hook.sh
similarity index 100%
rename from pkgs/build-support/setup-hooks/install-shell-files.sh
rename to pkgs/build-support/install-shell-files/setup-hook.sh

From f72e74d7aef142ea16d0841fa4322fc1310bb913 Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Wed, 14 Aug 2024 11:34:43 -0300
Subject: [PATCH 073/115] installShellFiles: migrate tests to tests
 subdirectory

Rationale: Since RFCs 140 and 146, the old category-based hierarchy is
deprecated and obsolete, and a new approach took place: packages should be as
self-contained as possible.

This paradigm is reflected in many new strict checks that prohibit a package to
refer to files outside its directory tree.

Following this spirit, this commit essentially moves nixpkgs
pkgs/test/default.nix to ./tests/default.nix.

Further, to keep the top-level `tests` attribute, a green alias is kept in the
place of older file.
---
 .../install-shell-files/default.nix           |   4 +-
 .../install-shell-files/tests/default.nix     | 125 +++++++++++++++++
 pkgs/test/install-shell-files/default.nix     | 126 +-----------------
 3 files changed, 129 insertions(+), 126 deletions(-)
 create mode 100644 pkgs/build-support/install-shell-files/tests/default.nix

diff --git a/pkgs/build-support/install-shell-files/default.nix b/pkgs/build-support/install-shell-files/default.nix
index 00f3caa7f721..1b7351847258 100644
--- a/pkgs/build-support/install-shell-files/default.nix
+++ b/pkgs/build-support/install-shell-files/default.nix
@@ -1,4 +1,4 @@
-{ makeSetupHook, tests }:
+{ callPackage, makeSetupHook }:
 
 # See the header comment in ./setup-hook.sh for example usage.
 let
@@ -7,6 +7,6 @@ in
 
 setupHook.overrideAttrs (oldAttrs: {
   passthru = (oldAttrs.passthru or {}) // {
-    tests = tests.install-shell-files;
+    tests = callPackage ./tests { };
   };
 })
diff --git a/pkgs/build-support/install-shell-files/tests/default.nix b/pkgs/build-support/install-shell-files/tests/default.nix
new file mode 100644
index 000000000000..aef5acc1de6b
--- /dev/null
+++ b/pkgs/build-support/install-shell-files/tests/default.nix
@@ -0,0 +1,125 @@
+{ lib, runCommandLocal, recurseIntoAttrs, installShellFiles }:
+
+let
+  runTest = name: env: buildCommand:
+    runCommandLocal "install-shell-files--${name}" ({
+      nativeBuildInputs = [ installShellFiles ];
+      meta.platforms = lib.platforms.all;
+    } // env) buildCommand;
+in
+
+recurseIntoAttrs {
+  # installManPage
+
+  install-manpage = runTest "install-manpage" {} ''
+    mkdir -p doc
+    echo foo > doc/foo.1
+    echo bar > doc/bar.2.gz
+    echo baz > doc/baz.3
+
+    installManPage doc/*
+
+    cmp doc/foo.1 $out/share/man/man1/foo.1
+    cmp doc/bar.2.gz $out/share/man/man2/bar.2.gz
+    cmp doc/baz.3 $out/share/man/man3/baz.3
+  '';
+  install-manpage-outputs = runTest "install-manpage-outputs" {
+    outputs = [ "out" "man" "devman" ];
+  } ''
+    mkdir -p doc
+    echo foo > doc/foo.1
+    echo bar > doc/bar.3
+
+    installManPage doc/*
+
+    # assert they didn't go into $out
+    [[ ! -f $out/share/man/man1/foo.1 && ! -f $out/share/man/man3/bar.3 ]]
+
+    # foo.1 alone went into man
+    cmp doc/foo.1 ''${!outputMan:?}/share/man/man1/foo.1
+    [[ ! -f ''${!outputMan:?}/share/man/man3/bar.3 ]]
+
+    # bar.3 alone went into devman
+    cmp doc/bar.3 ''${!outputDevman:?}/share/man/man3/bar.3
+    [[ ! -f ''${!outputDevman:?}/share/man/man1/foo.1 ]]
+
+    touch $out
+  '';
+
+  # installShellCompletion
+
+  install-completion = runTest "install-completion" {} ''
+    echo foo > foo
+    echo bar > bar
+    echo baz > baz
+    echo qux > qux.zsh
+    echo quux > quux
+
+    installShellCompletion --bash foo bar --zsh baz qux.zsh --fish quux
+
+    cmp foo $out/share/bash-completion/completions/foo
+    cmp bar $out/share/bash-completion/completions/bar
+    cmp baz $out/share/zsh/site-functions/_baz
+    cmp qux.zsh $out/share/zsh/site-functions/_qux
+    cmp quux $out/share/fish/vendor_completions.d/quux
+  '';
+  install-completion-output = runTest "install-completion-output" {
+    outputs = [ "out" "bin" ];
+  } ''
+    echo foo > foo
+
+    installShellCompletion --bash foo
+
+    # assert it didn't go into $out
+    [[ ! -f $out/share/bash-completion/completions/foo ]]
+
+    cmp foo ''${!outputBin:?}/share/bash-completion/completions/foo
+
+    touch $out
+  '';
+  install-completion-name = runTest "install-completion-name" {} ''
+    echo foo > foo
+    echo bar > bar
+    echo baz > baz
+
+    installShellCompletion --bash --name foobar.bash foo --zsh --name _foobar bar --fish baz
+
+    cmp foo $out/share/bash-completion/completions/foobar.bash
+    cmp bar $out/share/zsh/site-functions/_foobar
+    cmp baz $out/share/fish/vendor_completions.d/baz
+  '';
+  install-completion-inference = runTest "install-completion-inference" {} ''
+    echo foo > foo.bash
+    echo bar > bar.zsh
+    echo baz > baz.fish
+
+    installShellCompletion foo.bash bar.zsh baz.fish
+
+    cmp foo.bash $out/share/bash-completion/completions/foo.bash
+    cmp bar.zsh $out/share/zsh/site-functions/_bar
+    cmp baz.fish $out/share/fish/vendor_completions.d/baz.fish
+  '';
+  install-completion-cmd = runTest "install-completion-cmd" {} ''
+    echo foo > foo.bash
+    echo bar > bar.zsh
+    echo baz > baz.fish
+    echo qux > qux.fish
+
+    installShellCompletion --cmd foobar --bash foo.bash --zsh bar.zsh --fish baz.fish --name qux qux.fish
+
+    cmp foo.bash $out/share/bash-completion/completions/foobar.bash
+    cmp bar.zsh $out/share/zsh/site-functions/_foobar
+    cmp baz.fish $out/share/fish/vendor_completions.d/foobar.fish
+    cmp qux.fish $out/share/fish/vendor_completions.d/qux
+  '';
+  install-completion-fifo = runTest "install-completion-fifo" {} ''
+    installShellCompletion \
+      --bash --name foo.bash <(echo foo) \
+      --zsh --name _foo <(echo bar) \
+      --fish --name foo.fish <(echo baz)
+
+    [[ $(<$out/share/bash-completion/completions/foo.bash) == foo ]] || { echo "foo.bash comparison failed"; exit 1; }
+    [[ $(<$out/share/zsh/site-functions/_foo) == bar ]] || { echo "_foo comparison failed"; exit 1; }
+    [[ $(<$out/share/fish/vendor_completions.d/foo.fish) == baz ]] || { echo "foo.fish comparison failed"; exit 1; }
+  '';
+}
diff --git a/pkgs/test/install-shell-files/default.nix b/pkgs/test/install-shell-files/default.nix
index aef5acc1de6b..21894698fe1b 100644
--- a/pkgs/test/install-shell-files/default.nix
+++ b/pkgs/test/install-shell-files/default.nix
@@ -1,125 +1,3 @@
-{ lib, runCommandLocal, recurseIntoAttrs, installShellFiles }:
+{ installShellFiles }:
 
-let
-  runTest = name: env: buildCommand:
-    runCommandLocal "install-shell-files--${name}" ({
-      nativeBuildInputs = [ installShellFiles ];
-      meta.platforms = lib.platforms.all;
-    } // env) buildCommand;
-in
-
-recurseIntoAttrs {
-  # installManPage
-
-  install-manpage = runTest "install-manpage" {} ''
-    mkdir -p doc
-    echo foo > doc/foo.1
-    echo bar > doc/bar.2.gz
-    echo baz > doc/baz.3
-
-    installManPage doc/*
-
-    cmp doc/foo.1 $out/share/man/man1/foo.1
-    cmp doc/bar.2.gz $out/share/man/man2/bar.2.gz
-    cmp doc/baz.3 $out/share/man/man3/baz.3
-  '';
-  install-manpage-outputs = runTest "install-manpage-outputs" {
-    outputs = [ "out" "man" "devman" ];
-  } ''
-    mkdir -p doc
-    echo foo > doc/foo.1
-    echo bar > doc/bar.3
-
-    installManPage doc/*
-
-    # assert they didn't go into $out
-    [[ ! -f $out/share/man/man1/foo.1 && ! -f $out/share/man/man3/bar.3 ]]
-
-    # foo.1 alone went into man
-    cmp doc/foo.1 ''${!outputMan:?}/share/man/man1/foo.1
-    [[ ! -f ''${!outputMan:?}/share/man/man3/bar.3 ]]
-
-    # bar.3 alone went into devman
-    cmp doc/bar.3 ''${!outputDevman:?}/share/man/man3/bar.3
-    [[ ! -f ''${!outputDevman:?}/share/man/man1/foo.1 ]]
-
-    touch $out
-  '';
-
-  # installShellCompletion
-
-  install-completion = runTest "install-completion" {} ''
-    echo foo > foo
-    echo bar > bar
-    echo baz > baz
-    echo qux > qux.zsh
-    echo quux > quux
-
-    installShellCompletion --bash foo bar --zsh baz qux.zsh --fish quux
-
-    cmp foo $out/share/bash-completion/completions/foo
-    cmp bar $out/share/bash-completion/completions/bar
-    cmp baz $out/share/zsh/site-functions/_baz
-    cmp qux.zsh $out/share/zsh/site-functions/_qux
-    cmp quux $out/share/fish/vendor_completions.d/quux
-  '';
-  install-completion-output = runTest "install-completion-output" {
-    outputs = [ "out" "bin" ];
-  } ''
-    echo foo > foo
-
-    installShellCompletion --bash foo
-
-    # assert it didn't go into $out
-    [[ ! -f $out/share/bash-completion/completions/foo ]]
-
-    cmp foo ''${!outputBin:?}/share/bash-completion/completions/foo
-
-    touch $out
-  '';
-  install-completion-name = runTest "install-completion-name" {} ''
-    echo foo > foo
-    echo bar > bar
-    echo baz > baz
-
-    installShellCompletion --bash --name foobar.bash foo --zsh --name _foobar bar --fish baz
-
-    cmp foo $out/share/bash-completion/completions/foobar.bash
-    cmp bar $out/share/zsh/site-functions/_foobar
-    cmp baz $out/share/fish/vendor_completions.d/baz
-  '';
-  install-completion-inference = runTest "install-completion-inference" {} ''
-    echo foo > foo.bash
-    echo bar > bar.zsh
-    echo baz > baz.fish
-
-    installShellCompletion foo.bash bar.zsh baz.fish
-
-    cmp foo.bash $out/share/bash-completion/completions/foo.bash
-    cmp bar.zsh $out/share/zsh/site-functions/_bar
-    cmp baz.fish $out/share/fish/vendor_completions.d/baz.fish
-  '';
-  install-completion-cmd = runTest "install-completion-cmd" {} ''
-    echo foo > foo.bash
-    echo bar > bar.zsh
-    echo baz > baz.fish
-    echo qux > qux.fish
-
-    installShellCompletion --cmd foobar --bash foo.bash --zsh bar.zsh --fish baz.fish --name qux qux.fish
-
-    cmp foo.bash $out/share/bash-completion/completions/foobar.bash
-    cmp bar.zsh $out/share/zsh/site-functions/_foobar
-    cmp baz.fish $out/share/fish/vendor_completions.d/foobar.fish
-    cmp qux.fish $out/share/fish/vendor_completions.d/qux
-  '';
-  install-completion-fifo = runTest "install-completion-fifo" {} ''
-    installShellCompletion \
-      --bash --name foo.bash <(echo foo) \
-      --zsh --name _foo <(echo bar) \
-      --fish --name foo.fish <(echo baz)
-
-    [[ $(<$out/share/bash-completion/completions/foo.bash) == foo ]] || { echo "foo.bash comparison failed"; exit 1; }
-    [[ $(<$out/share/zsh/site-functions/_foo) == bar ]] || { echo "_foo comparison failed"; exit 1; }
-    [[ $(<$out/share/fish/vendor_completions.d/foo.fish) == baz ]] || { echo "foo.fish comparison failed"; exit 1; }
-  '';
-}
+installShellFiles.tests

From 8b674370c42fd5312d53edd2002af0978ff3f2b9 Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Wed, 14 Aug 2024 11:59:49 -0300
Subject: [PATCH 074/115] installShellFiles: nixfmt-rfc-style

---
 .../install-shell-files/default.nix           |   3 +-
 .../install-shell-files/tests/default.nix     | 100 +++++++++++-------
 2 files changed, 62 insertions(+), 41 deletions(-)

diff --git a/pkgs/build-support/install-shell-files/default.nix b/pkgs/build-support/install-shell-files/default.nix
index 1b7351847258..12595850c393 100644
--- a/pkgs/build-support/install-shell-files/default.nix
+++ b/pkgs/build-support/install-shell-files/default.nix
@@ -4,9 +4,8 @@
 let
   setupHook = makeSetupHook { name = "install-shell-files"; } ./setup-hook.sh;
 in
-
 setupHook.overrideAttrs (oldAttrs: {
-  passthru = (oldAttrs.passthru or {}) // {
+  passthru = (oldAttrs.passthru or { }) // {
     tests = callPackage ./tests { };
   };
 })
diff --git a/pkgs/build-support/install-shell-files/tests/default.nix b/pkgs/build-support/install-shell-files/tests/default.nix
index aef5acc1de6b..456edc5c6330 100644
--- a/pkgs/build-support/install-shell-files/tests/default.nix
+++ b/pkgs/build-support/install-shell-files/tests/default.nix
@@ -1,17 +1,26 @@
-{ lib, runCommandLocal, recurseIntoAttrs, installShellFiles }:
+{
+  lib,
+  runCommandLocal,
+  recurseIntoAttrs,
+  installShellFiles,
+}:
 
 let
-  runTest = name: env: buildCommand:
-    runCommandLocal "install-shell-files--${name}" ({
-      nativeBuildInputs = [ installShellFiles ];
-      meta.platforms = lib.platforms.all;
-    } // env) buildCommand;
+  runTest =
+    name: env: buildCommand:
+    runCommandLocal "install-shell-files--${name}" (
+      {
+        nativeBuildInputs = [ installShellFiles ];
+        meta.platforms = lib.platforms.all;
+      }
+      // env
+    ) buildCommand;
 in
 
 recurseIntoAttrs {
   # installManPage
 
-  install-manpage = runTest "install-manpage" {} ''
+  install-manpage = runTest "install-manpage" { } ''
     mkdir -p doc
     echo foo > doc/foo.1
     echo bar > doc/bar.2.gz
@@ -23,32 +32,39 @@ recurseIntoAttrs {
     cmp doc/bar.2.gz $out/share/man/man2/bar.2.gz
     cmp doc/baz.3 $out/share/man/man3/baz.3
   '';
-  install-manpage-outputs = runTest "install-manpage-outputs" {
-    outputs = [ "out" "man" "devman" ];
-  } ''
-    mkdir -p doc
-    echo foo > doc/foo.1
-    echo bar > doc/bar.3
+  install-manpage-outputs =
+    runTest "install-manpage-outputs"
+      {
+        outputs = [
+          "out"
+          "man"
+          "devman"
+        ];
+      }
+      ''
+        mkdir -p doc
+        echo foo > doc/foo.1
+        echo bar > doc/bar.3
 
-    installManPage doc/*
+        installManPage doc/*
 
-    # assert they didn't go into $out
-    [[ ! -f $out/share/man/man1/foo.1 && ! -f $out/share/man/man3/bar.3 ]]
+        # assert they didn't go into $out
+        [[ ! -f $out/share/man/man1/foo.1 && ! -f $out/share/man/man3/bar.3 ]]
 
-    # foo.1 alone went into man
-    cmp doc/foo.1 ''${!outputMan:?}/share/man/man1/foo.1
-    [[ ! -f ''${!outputMan:?}/share/man/man3/bar.3 ]]
+        # foo.1 alone went into man
+        cmp doc/foo.1 ''${!outputMan:?}/share/man/man1/foo.1
+        [[ ! -f ''${!outputMan:?}/share/man/man3/bar.3 ]]
 
-    # bar.3 alone went into devman
-    cmp doc/bar.3 ''${!outputDevman:?}/share/man/man3/bar.3
-    [[ ! -f ''${!outputDevman:?}/share/man/man1/foo.1 ]]
+        # bar.3 alone went into devman
+        cmp doc/bar.3 ''${!outputDevman:?}/share/man/man3/bar.3
+        [[ ! -f ''${!outputDevman:?}/share/man/man1/foo.1 ]]
 
-    touch $out
-  '';
+        touch $out
+      '';
 
   # installShellCompletion
 
-  install-completion = runTest "install-completion" {} ''
+  install-completion = runTest "install-completion" { } ''
     echo foo > foo
     echo bar > bar
     echo baz > baz
@@ -63,21 +79,27 @@ recurseIntoAttrs {
     cmp qux.zsh $out/share/zsh/site-functions/_qux
     cmp quux $out/share/fish/vendor_completions.d/quux
   '';
-  install-completion-output = runTest "install-completion-output" {
-    outputs = [ "out" "bin" ];
-  } ''
-    echo foo > foo
+  install-completion-output =
+    runTest "install-completion-output"
+      {
+        outputs = [
+          "out"
+          "bin"
+        ];
+      }
+      ''
+        echo foo > foo
 
-    installShellCompletion --bash foo
+        installShellCompletion --bash foo
 
-    # assert it didn't go into $out
-    [[ ! -f $out/share/bash-completion/completions/foo ]]
+        # assert it didn't go into $out
+        [[ ! -f $out/share/bash-completion/completions/foo ]]
 
-    cmp foo ''${!outputBin:?}/share/bash-completion/completions/foo
+        cmp foo ''${!outputBin:?}/share/bash-completion/completions/foo
 
-    touch $out
-  '';
-  install-completion-name = runTest "install-completion-name" {} ''
+        touch $out
+      '';
+  install-completion-name = runTest "install-completion-name" { } ''
     echo foo > foo
     echo bar > bar
     echo baz > baz
@@ -88,7 +110,7 @@ recurseIntoAttrs {
     cmp bar $out/share/zsh/site-functions/_foobar
     cmp baz $out/share/fish/vendor_completions.d/baz
   '';
-  install-completion-inference = runTest "install-completion-inference" {} ''
+  install-completion-inference = runTest "install-completion-inference" { } ''
     echo foo > foo.bash
     echo bar > bar.zsh
     echo baz > baz.fish
@@ -99,7 +121,7 @@ recurseIntoAttrs {
     cmp bar.zsh $out/share/zsh/site-functions/_bar
     cmp baz.fish $out/share/fish/vendor_completions.d/baz.fish
   '';
-  install-completion-cmd = runTest "install-completion-cmd" {} ''
+  install-completion-cmd = runTest "install-completion-cmd" { } ''
     echo foo > foo.bash
     echo bar > bar.zsh
     echo baz > baz.fish
@@ -112,7 +134,7 @@ recurseIntoAttrs {
     cmp baz.fish $out/share/fish/vendor_completions.d/foobar.fish
     cmp qux.fish $out/share/fish/vendor_completions.d/qux
   '';
-  install-completion-fifo = runTest "install-completion-fifo" {} ''
+  install-completion-fifo = runTest "install-completion-fifo" { } ''
     installShellCompletion \
       --bash --name foo.bash <(echo foo) \
       --zsh --name _foo <(echo bar) \

From e548b3170836504cc2be8159c9aadccfbd63c469 Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Wed, 14 Aug 2024 12:12:18 -0300
Subject: [PATCH 075/115] installShellFiles: migrate to by-name

---
 .../default.nix => by-name/in/installShellFiles/package.nix}    | 0
 .../in/installShellFiles}/setup-hook.sh                         | 0
 .../in/installShellFiles}/tests/default.nix                     | 0
 pkgs/top-level/all-packages.nix                                 | 2 --
 4 files changed, 2 deletions(-)
 rename pkgs/{build-support/install-shell-files/default.nix => by-name/in/installShellFiles/package.nix} (100%)
 rename pkgs/{build-support/install-shell-files => by-name/in/installShellFiles}/setup-hook.sh (100%)
 rename pkgs/{build-support/install-shell-files => by-name/in/installShellFiles}/tests/default.nix (100%)

diff --git a/pkgs/build-support/install-shell-files/default.nix b/pkgs/by-name/in/installShellFiles/package.nix
similarity index 100%
rename from pkgs/build-support/install-shell-files/default.nix
rename to pkgs/by-name/in/installShellFiles/package.nix
diff --git a/pkgs/build-support/install-shell-files/setup-hook.sh b/pkgs/by-name/in/installShellFiles/setup-hook.sh
similarity index 100%
rename from pkgs/build-support/install-shell-files/setup-hook.sh
rename to pkgs/by-name/in/installShellFiles/setup-hook.sh
diff --git a/pkgs/build-support/install-shell-files/tests/default.nix b/pkgs/by-name/in/installShellFiles/tests/default.nix
similarity index 100%
rename from pkgs/build-support/install-shell-files/tests/default.nix
rename to pkgs/by-name/in/installShellFiles/tests/default.nix
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 95a3f8e10570..f6e2250c6bc5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1204,8 +1204,6 @@ with pkgs;
     inherit url;
   };
 
-  installShellFiles = callPackage ../build-support/install-shell-files { };
-
   lazydocker = callPackage ../tools/misc/lazydocker { };
 
   ld-is-cc-hook = makeSetupHook { name = "ld-is-cc-hook"; }

From 98e9fbb530d572f057d1b9ea787a5a67a1d3a24c Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Wed, 14 Aug 2024 13:06:30 -0300
Subject: [PATCH 076/115] installShellFiles: dismember tests into their own
 files

It makes the maintenance and creation of tests more intuitive: just throw a Nix
package under tests!
---
 pkgs/by-name/in/installShellFiles/package.nix |  11 +-
 .../in/installShellFiles/tests/default.nix    | 147 ------------------
 .../tests/install-completion-cmd.nix          |  24 +++
 .../tests/install-completion-fifo.nix         |  21 +++
 .../tests/install-completion-inference.nix    |  22 +++
 .../tests/install-completion-name.nix         |  22 +++
 .../tests/install-completion-output.nix       |  27 ++++
 .../tests/install-completion.nix              |  26 ++++
 .../tests/install-manpage-outputs.nix         |  36 +++++
 .../tests/install-manpage.nix                 |  23 +++
 10 files changed, 210 insertions(+), 149 deletions(-)
 delete mode 100644 pkgs/by-name/in/installShellFiles/tests/default.nix
 create mode 100644 pkgs/by-name/in/installShellFiles/tests/install-completion-cmd.nix
 create mode 100644 pkgs/by-name/in/installShellFiles/tests/install-completion-fifo.nix
 create mode 100644 pkgs/by-name/in/installShellFiles/tests/install-completion-inference.nix
 create mode 100644 pkgs/by-name/in/installShellFiles/tests/install-completion-name.nix
 create mode 100644 pkgs/by-name/in/installShellFiles/tests/install-completion-output.nix
 create mode 100644 pkgs/by-name/in/installShellFiles/tests/install-completion.nix
 create mode 100644 pkgs/by-name/in/installShellFiles/tests/install-manpage-outputs.nix
 create mode 100644 pkgs/by-name/in/installShellFiles/tests/install-manpage.nix

diff --git a/pkgs/by-name/in/installShellFiles/package.nix b/pkgs/by-name/in/installShellFiles/package.nix
index 12595850c393..87787ad872ee 100644
--- a/pkgs/by-name/in/installShellFiles/package.nix
+++ b/pkgs/by-name/in/installShellFiles/package.nix
@@ -1,4 +1,8 @@
-{ callPackage, makeSetupHook }:
+{
+  lib,
+  callPackage,
+  makeSetupHook,
+}:
 
 # See the header comment in ./setup-hook.sh for example usage.
 let
@@ -6,6 +10,9 @@ let
 in
 setupHook.overrideAttrs (oldAttrs: {
   passthru = (oldAttrs.passthru or { }) // {
-    tests = callPackage ./tests { };
+    tests = lib.packagesFromDirectoryRecursive {
+      inherit callPackage;
+      directory = ./tests;
+    };
   };
 })
diff --git a/pkgs/by-name/in/installShellFiles/tests/default.nix b/pkgs/by-name/in/installShellFiles/tests/default.nix
deleted file mode 100644
index 456edc5c6330..000000000000
--- a/pkgs/by-name/in/installShellFiles/tests/default.nix
+++ /dev/null
@@ -1,147 +0,0 @@
-{
-  lib,
-  runCommandLocal,
-  recurseIntoAttrs,
-  installShellFiles,
-}:
-
-let
-  runTest =
-    name: env: buildCommand:
-    runCommandLocal "install-shell-files--${name}" (
-      {
-        nativeBuildInputs = [ installShellFiles ];
-        meta.platforms = lib.platforms.all;
-      }
-      // env
-    ) buildCommand;
-in
-
-recurseIntoAttrs {
-  # installManPage
-
-  install-manpage = runTest "install-manpage" { } ''
-    mkdir -p doc
-    echo foo > doc/foo.1
-    echo bar > doc/bar.2.gz
-    echo baz > doc/baz.3
-
-    installManPage doc/*
-
-    cmp doc/foo.1 $out/share/man/man1/foo.1
-    cmp doc/bar.2.gz $out/share/man/man2/bar.2.gz
-    cmp doc/baz.3 $out/share/man/man3/baz.3
-  '';
-  install-manpage-outputs =
-    runTest "install-manpage-outputs"
-      {
-        outputs = [
-          "out"
-          "man"
-          "devman"
-        ];
-      }
-      ''
-        mkdir -p doc
-        echo foo > doc/foo.1
-        echo bar > doc/bar.3
-
-        installManPage doc/*
-
-        # assert they didn't go into $out
-        [[ ! -f $out/share/man/man1/foo.1 && ! -f $out/share/man/man3/bar.3 ]]
-
-        # foo.1 alone went into man
-        cmp doc/foo.1 ''${!outputMan:?}/share/man/man1/foo.1
-        [[ ! -f ''${!outputMan:?}/share/man/man3/bar.3 ]]
-
-        # bar.3 alone went into devman
-        cmp doc/bar.3 ''${!outputDevman:?}/share/man/man3/bar.3
-        [[ ! -f ''${!outputDevman:?}/share/man/man1/foo.1 ]]
-
-        touch $out
-      '';
-
-  # installShellCompletion
-
-  install-completion = runTest "install-completion" { } ''
-    echo foo > foo
-    echo bar > bar
-    echo baz > baz
-    echo qux > qux.zsh
-    echo quux > quux
-
-    installShellCompletion --bash foo bar --zsh baz qux.zsh --fish quux
-
-    cmp foo $out/share/bash-completion/completions/foo
-    cmp bar $out/share/bash-completion/completions/bar
-    cmp baz $out/share/zsh/site-functions/_baz
-    cmp qux.zsh $out/share/zsh/site-functions/_qux
-    cmp quux $out/share/fish/vendor_completions.d/quux
-  '';
-  install-completion-output =
-    runTest "install-completion-output"
-      {
-        outputs = [
-          "out"
-          "bin"
-        ];
-      }
-      ''
-        echo foo > foo
-
-        installShellCompletion --bash foo
-
-        # assert it didn't go into $out
-        [[ ! -f $out/share/bash-completion/completions/foo ]]
-
-        cmp foo ''${!outputBin:?}/share/bash-completion/completions/foo
-
-        touch $out
-      '';
-  install-completion-name = runTest "install-completion-name" { } ''
-    echo foo > foo
-    echo bar > bar
-    echo baz > baz
-
-    installShellCompletion --bash --name foobar.bash foo --zsh --name _foobar bar --fish baz
-
-    cmp foo $out/share/bash-completion/completions/foobar.bash
-    cmp bar $out/share/zsh/site-functions/_foobar
-    cmp baz $out/share/fish/vendor_completions.d/baz
-  '';
-  install-completion-inference = runTest "install-completion-inference" { } ''
-    echo foo > foo.bash
-    echo bar > bar.zsh
-    echo baz > baz.fish
-
-    installShellCompletion foo.bash bar.zsh baz.fish
-
-    cmp foo.bash $out/share/bash-completion/completions/foo.bash
-    cmp bar.zsh $out/share/zsh/site-functions/_bar
-    cmp baz.fish $out/share/fish/vendor_completions.d/baz.fish
-  '';
-  install-completion-cmd = runTest "install-completion-cmd" { } ''
-    echo foo > foo.bash
-    echo bar > bar.zsh
-    echo baz > baz.fish
-    echo qux > qux.fish
-
-    installShellCompletion --cmd foobar --bash foo.bash --zsh bar.zsh --fish baz.fish --name qux qux.fish
-
-    cmp foo.bash $out/share/bash-completion/completions/foobar.bash
-    cmp bar.zsh $out/share/zsh/site-functions/_foobar
-    cmp baz.fish $out/share/fish/vendor_completions.d/foobar.fish
-    cmp qux.fish $out/share/fish/vendor_completions.d/qux
-  '';
-  install-completion-fifo = runTest "install-completion-fifo" { } ''
-    installShellCompletion \
-      --bash --name foo.bash <(echo foo) \
-      --zsh --name _foo <(echo bar) \
-      --fish --name foo.fish <(echo baz)
-
-    [[ $(<$out/share/bash-completion/completions/foo.bash) == foo ]] || { echo "foo.bash comparison failed"; exit 1; }
-    [[ $(<$out/share/zsh/site-functions/_foo) == bar ]] || { echo "_foo comparison failed"; exit 1; }
-    [[ $(<$out/share/fish/vendor_completions.d/foo.fish) == baz ]] || { echo "foo.fish comparison failed"; exit 1; }
-  '';
-}
diff --git a/pkgs/by-name/in/installShellFiles/tests/install-completion-cmd.nix b/pkgs/by-name/in/installShellFiles/tests/install-completion-cmd.nix
new file mode 100644
index 000000000000..a8687ccc2c7d
--- /dev/null
+++ b/pkgs/by-name/in/installShellFiles/tests/install-completion-cmd.nix
@@ -0,0 +1,24 @@
+{
+  lib,
+  installShellFiles,
+  runCommandLocal,
+}:
+
+runCommandLocal "install-shell-files--install-completion-cmd"
+  {
+    nativeBuildInputs = [ installShellFiles ];
+    meta.platforms = lib.platforms.all;
+  }
+  ''
+    echo foo > foo.bash
+    echo bar > bar.zsh
+    echo baz > baz.fish
+    echo qux > qux.fish
+
+    installShellCompletion --cmd foobar --bash foo.bash --zsh bar.zsh --fish baz.fish --name qux qux.fish
+
+    cmp foo.bash $out/share/bash-completion/completions/foobar.bash
+    cmp bar.zsh $out/share/zsh/site-functions/_foobar
+    cmp baz.fish $out/share/fish/vendor_completions.d/foobar.fish
+    cmp qux.fish $out/share/fish/vendor_completions.d/qux
+  ''
diff --git a/pkgs/by-name/in/installShellFiles/tests/install-completion-fifo.nix b/pkgs/by-name/in/installShellFiles/tests/install-completion-fifo.nix
new file mode 100644
index 000000000000..2c777f0fb68a
--- /dev/null
+++ b/pkgs/by-name/in/installShellFiles/tests/install-completion-fifo.nix
@@ -0,0 +1,21 @@
+{
+  lib,
+  installShellFiles,
+  runCommandLocal,
+}:
+
+runCommandLocal "install-shell-files--install-completion-fifo"
+  {
+    nativeBuildInputs = [ installShellFiles ];
+    meta.platforms = lib.platforms.all;
+  }
+  ''
+    installShellCompletion \
+      --bash --name foo.bash <(echo foo) \
+      --zsh --name _foo <(echo bar) \
+      --fish --name foo.fish <(echo baz)
+
+    [[ $(<$out/share/bash-completion/completions/foo.bash) == foo ]] || { echo "foo.bash comparison failed"; exit 1; }
+    [[ $(<$out/share/zsh/site-functions/_foo) == bar ]] || { echo "_foo comparison failed"; exit 1; }
+    [[ $(<$out/share/fish/vendor_completions.d/foo.fish) == baz ]] || { echo "foo.fish comparison failed"; exit 1; }
+  ''
diff --git a/pkgs/by-name/in/installShellFiles/tests/install-completion-inference.nix b/pkgs/by-name/in/installShellFiles/tests/install-completion-inference.nix
new file mode 100644
index 000000000000..9a51965ccecb
--- /dev/null
+++ b/pkgs/by-name/in/installShellFiles/tests/install-completion-inference.nix
@@ -0,0 +1,22 @@
+{
+  lib,
+  installShellFiles,
+  runCommandLocal,
+}:
+
+runCommandLocal "install-shell-files--install-completion-inference"
+  {
+    nativeBuildInputs = [ installShellFiles ];
+    meta.platforms = lib.platforms.all;
+  }
+  ''
+    echo foo > foo.bash
+    echo bar > bar.zsh
+    echo baz > baz.fish
+
+    installShellCompletion foo.bash bar.zsh baz.fish
+
+    cmp foo.bash $out/share/bash-completion/completions/foo.bash
+    cmp bar.zsh $out/share/zsh/site-functions/_bar
+    cmp baz.fish $out/share/fish/vendor_completions.d/baz.fish
+  ''
diff --git a/pkgs/by-name/in/installShellFiles/tests/install-completion-name.nix b/pkgs/by-name/in/installShellFiles/tests/install-completion-name.nix
new file mode 100644
index 000000000000..2473318dee2c
--- /dev/null
+++ b/pkgs/by-name/in/installShellFiles/tests/install-completion-name.nix
@@ -0,0 +1,22 @@
+{
+  lib,
+  installShellFiles,
+  runCommandLocal,
+}:
+
+runCommandLocal "install-shell-files--install-completion-name"
+  {
+    nativeBuildInputs = [ installShellFiles ];
+    meta.platforms = lib.platforms.all;
+  }
+  ''
+    echo foo > foo
+    echo bar > bar
+    echo baz > baz
+
+    installShellCompletion --bash --name foobar.bash foo --zsh --name _foobar bar --fish baz
+
+    cmp foo $out/share/bash-completion/completions/foobar.bash
+    cmp bar $out/share/zsh/site-functions/_foobar
+    cmp baz $out/share/fish/vendor_completions.d/baz
+  ''
diff --git a/pkgs/by-name/in/installShellFiles/tests/install-completion-output.nix b/pkgs/by-name/in/installShellFiles/tests/install-completion-output.nix
new file mode 100644
index 000000000000..380b241e4f01
--- /dev/null
+++ b/pkgs/by-name/in/installShellFiles/tests/install-completion-output.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  installShellFiles,
+  runCommandLocal,
+}:
+
+runCommandLocal "install-shell-files--install-completion-output"
+  {
+    outputs = [
+      "out"
+      "bin"
+    ];
+    nativeBuildInputs = [ installShellFiles ];
+    meta.platforms = lib.platforms.all;
+  }
+  ''
+    echo foo > foo
+
+    installShellCompletion --bash foo
+
+    # assert it didn't go into $out
+    [[ ! -f $out/share/bash-completion/completions/foo ]]
+
+    cmp foo ''${!outputBin:?}/share/bash-completion/completions/foo
+
+    touch $out
+  ''
diff --git a/pkgs/by-name/in/installShellFiles/tests/install-completion.nix b/pkgs/by-name/in/installShellFiles/tests/install-completion.nix
new file mode 100644
index 000000000000..2738dd647f56
--- /dev/null
+++ b/pkgs/by-name/in/installShellFiles/tests/install-completion.nix
@@ -0,0 +1,26 @@
+{
+  lib,
+  installShellFiles,
+  runCommandLocal,
+}:
+
+runCommandLocal "install-shell-files--install-completion"
+  {
+    nativeBuildInputs = [ installShellFiles ];
+    meta.platforms = lib.platforms.all;
+  }
+  ''
+    echo foo > foo
+    echo bar > bar
+    echo baz > baz
+    echo qux > qux.zsh
+    echo quux > quux
+
+    installShellCompletion --bash foo bar --zsh baz qux.zsh --fish quux
+
+    cmp foo $out/share/bash-completion/completions/foo
+    cmp bar $out/share/bash-completion/completions/bar
+    cmp baz $out/share/zsh/site-functions/_baz
+    cmp qux.zsh $out/share/zsh/site-functions/_qux
+    cmp quux $out/share/fish/vendor_completions.d/quux
+  ''
diff --git a/pkgs/by-name/in/installShellFiles/tests/install-manpage-outputs.nix b/pkgs/by-name/in/installShellFiles/tests/install-manpage-outputs.nix
new file mode 100644
index 000000000000..4e249a9e5061
--- /dev/null
+++ b/pkgs/by-name/in/installShellFiles/tests/install-manpage-outputs.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  installShellFiles,
+  runCommandLocal,
+}:
+
+runCommandLocal "install-shell-files--install-manpage-outputs"
+  {
+    outputs = [
+      "out"
+      "man"
+      "devman"
+    ];
+    nativeBuildInputs = [ installShellFiles ];
+    meta.platforms = lib.platforms.all;
+  }
+  ''
+    mkdir -p doc
+    echo foo > doc/foo.1
+    echo bar > doc/bar.3
+
+    installManPage doc/*
+
+    # assert they didn't go into $out
+    [[ ! -f $out/share/man/man1/foo.1 && ! -f $out/share/man/man3/bar.3 ]]
+
+    # foo.1 alone went into man
+    cmp doc/foo.1 ''${!outputMan:?}/share/man/man1/foo.1
+    [[ ! -f ''${!outputMan:?}/share/man/man3/bar.3 ]]
+
+    # bar.3 alone went into devman
+    cmp doc/bar.3 ''${!outputDevman:?}/share/man/man3/bar.3
+    [[ ! -f ''${!outputDevman:?}/share/man/man1/foo.1 ]]
+
+    touch $out
+  ''
diff --git a/pkgs/by-name/in/installShellFiles/tests/install-manpage.nix b/pkgs/by-name/in/installShellFiles/tests/install-manpage.nix
new file mode 100644
index 000000000000..7b67d0aed94c
--- /dev/null
+++ b/pkgs/by-name/in/installShellFiles/tests/install-manpage.nix
@@ -0,0 +1,23 @@
+{
+  lib,
+  installShellFiles,
+  runCommandLocal,
+}:
+
+runCommandLocal "install-shell-files--install-manpage"
+  {
+    nativeBuildInputs = [ installShellFiles ];
+    meta.platforms = lib.platforms.all;
+  }
+  ''
+    mkdir -p doc
+    echo foo > doc/foo.1
+    echo bar > doc/bar.2.gz
+    echo baz > doc/baz.3
+
+    installManPage doc/*
+
+    cmp doc/foo.1 $out/share/man/man1/foo.1
+    cmp doc/bar.2.gz $out/share/man/man2/bar.2.gz
+    cmp doc/baz.3 $out/share/man/man3/baz.3
+  ''

From 1c9d4799c297aa0a2c8292d8d4b97992aa7bdd7d Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Wed, 14 Aug 2024 13:16:44 -0300
Subject: [PATCH 077/115] installShellFiles: add new function installBin

---
 .../in/installShellFiles/setup-hook.sh        | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/pkgs/by-name/in/installShellFiles/setup-hook.sh b/pkgs/by-name/in/installShellFiles/setup-hook.sh
index 4f4e215da4df..f51733e5f11f 100644
--- a/pkgs/by-name/in/installShellFiles/setup-hook.sh
+++ b/pkgs/by-name/in/installShellFiles/setup-hook.sh
@@ -233,3 +233,27 @@ installShellCompletion() {
     fi
     return $retval
 }
+
+# installBin <path> [...<path>]
+#
+# Install each argument to $outputBin
+installBin() {
+    local path
+    for path in "$@"; do
+        if (( "${NIX_DEBUG:-0}" >= 1 )); then
+            echo "installBin: installing $path"
+        fi
+        if test -z "$path"; then
+            echo "installBin: error: path cannot be empty" >&2
+            return 1
+        fi
+        local basename
+        # use stripHash in case it's a nix store path
+        basename=$(stripHash "$path")
+
+        local outRoot
+        outRoot=${!outputBin:?}
+
+        install -D --mode=755 --no-target-directory "$path" "${outRoot}/bin/$basename" || return
+    done
+}

From 507416c3115ee4b2c26b49ad4c1f2b2f014ef7ae Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Wed, 14 Aug 2024 13:20:51 -0300
Subject: [PATCH 078/115] installShellFiles: add new tests install-bin and
 install-bin-output

---
 .../tests/install-bin-output.nix              | 31 +++++++++++++++++++
 .../installShellFiles/tests/install-bin.nix   | 21 +++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 pkgs/by-name/in/installShellFiles/tests/install-bin-output.nix
 create mode 100644 pkgs/by-name/in/installShellFiles/tests/install-bin.nix

diff --git a/pkgs/by-name/in/installShellFiles/tests/install-bin-output.nix b/pkgs/by-name/in/installShellFiles/tests/install-bin-output.nix
new file mode 100644
index 000000000000..900f1eaa7e71
--- /dev/null
+++ b/pkgs/by-name/in/installShellFiles/tests/install-bin-output.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  installShellFiles,
+  runCommandLocal,
+}:
+
+runCommandLocal "install-shell-files--install-bin-output"
+  {
+    outputs = [
+      "out"
+      "bin"
+    ];
+    nativeBuildInputs = [ installShellFiles ];
+    meta.platforms = lib.platforms.all;
+  }
+  ''
+    mkdir -p bin
+    echo "echo hello za warudo" > bin/hello
+    echo "echo amigo me gusta mucho" > bin/amigo
+
+    installBin bin/*
+
+    # assert it didn't go into $out
+    [[ ! -f $out/bin/amigo ]]
+    [[ ! -f $out/bin/hello ]]
+
+    cmp bin/amigo ''${!outputBin}/bin/amigo
+    cmp bin/hello ''${!outputBin}/bin/hello
+
+    touch $out
+  ''
diff --git a/pkgs/by-name/in/installShellFiles/tests/install-bin.nix b/pkgs/by-name/in/installShellFiles/tests/install-bin.nix
new file mode 100644
index 000000000000..ba00c59b21be
--- /dev/null
+++ b/pkgs/by-name/in/installShellFiles/tests/install-bin.nix
@@ -0,0 +1,21 @@
+{
+  lib,
+  installShellFiles,
+  runCommandLocal,
+}:
+
+runCommandLocal "install-shell-files--install-bin"
+  {
+    nativeBuildInputs = [ installShellFiles ];
+    meta.platforms = lib.platforms.all;
+  }
+  ''
+    mkdir -p bin
+    echo "echo hello za warudo" > bin/hello
+    echo "echo amigo me gusta mucho" > bin/amigo
+
+    installBin bin/*
+
+    cmp bin/amigo $out/bin/amigo
+    cmp bin/hello $out/bin/hello
+  ''

From bb5aa086d69be1bfe5c3777210edb748d10e31d2 Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Fri, 23 Aug 2024 22:15:25 -0300
Subject: [PATCH 079/115] installShellFiles: rewrite functions

- Use FUNCNAME to track the name of function being called
- use long options for install commands
- use nix*Log functions for logging, instead of custom echoes
- remove silent error construction `|| return`
---
 .../in/installShellFiles/setup-hook.sh        | 53 +++++++++----------
 1 file changed, 25 insertions(+), 28 deletions(-)

diff --git a/pkgs/by-name/in/installShellFiles/setup-hook.sh b/pkgs/by-name/in/installShellFiles/setup-hook.sh
index f51733e5f11f..b34893916541 100644
--- a/pkgs/by-name/in/installShellFiles/setup-hook.sh
+++ b/pkgs/by-name/in/installShellFiles/setup-hook.sh
@@ -24,19 +24,17 @@
 installManPage() {
     local path
     for path in "$@"; do
-        if (( "${NIX_DEBUG:-0}" >= 1 )); then
-            echo "installManPage: installing $path"
-        fi
         if test -z "$path"; then
-            echo "installManPage: error: path cannot be empty" >&2
+            nixErrorLog "${FUNCNAME[0]}: path cannot be empty"
             return 1
         fi
+        nixInfoLog "${FUNCNAME[0]}: installing $path"
         local basename
         basename=$(stripHash "$path") # use stripHash in case it's a nix store path
         local trimmed=${basename%.gz} # don't get fooled by compressed manpages
         local suffix=${trimmed##*.}
         if test -z "$suffix" -o "$suffix" = "$trimmed"; then
-            echo "installManPage: error: path missing manpage section suffix: $path" >&2
+            nixErrorLog "${FUNCNAME[0]}: path missing manpage section suffix: $path"
             return 1
         fi
         local outRoot
@@ -45,7 +43,8 @@ installManPage() {
         else
             outRoot=${!outputMan:?}
         fi
-        install -Dm644 -T "$path" "${outRoot}/share/man/man$suffix/$basename" || return
+        local outPath="${outRoot}/share/man/man$suffix/$basename"
+        install -D --mode=644 --no-target-directory "$path" "$outPath"
     done
 }
 
@@ -107,7 +106,7 @@ installShellCompletion() {
             --name)
                 name=$1
                 shift || {
-                    echo 'installShellCompletion: error: --name flag expected an argument' >&2
+                    nixErrorLog "${FUNCNAME[0]}: --name flag expected an argument"
                     return 1
                 }
                 continue;;
@@ -118,7 +117,7 @@ installShellCompletion() {
             --cmd)
                 cmdname=$1
                 shift || {
-                    echo 'installShellCompletion: error: --cmd flag expected an argument' >&2
+                    nixErrorLog "${FUNCNAME[0]}: --cmd flag expected an argument"
                     return 1
                 }
                 continue;;
@@ -127,7 +126,7 @@ installShellCompletion() {
                 cmdname=${arg#--cmd=}
                 continue;;
             --?*)
-                echo "installShellCompletion: warning: unknown flag ${arg%%=*}" >&2
+                nixWarnLog "${FUNCNAME[0]}: unknown flag ${arg%%=*}"
                 retval=2
                 continue;;
             --)
@@ -136,23 +135,21 @@ installShellCompletion() {
                 continue;;
             esac
         fi
-        if (( "${NIX_DEBUG:-0}" >= 1 )); then
-            echo "installShellCompletion: installing $arg${name:+ as $name}"
-        fi
+        nixInfoLog "${FUNCNAME[0]}: installing $arg${name:+ as $name}"
         # if we get here, this is a path or named pipe
         # Identify shell and output name
         local curShell=$shell
         local outName=''
         if [[ -z "$arg" ]]; then
-            echo "installShellCompletion: error: empty path is not allowed" >&2
+            nixErrorLog "${FUNCNAME[0]}: empty path is not allowed"
             return 1
         elif [[ -p "$arg" ]]; then
             # this is a named fd or fifo
             if [[ -z "$curShell" ]]; then
-                echo "installShellCompletion: error: named pipe requires one of --bash, --fish, or --zsh" >&2
+                nixErrorLog "${FUNCNAME[0]}: named pipe requires one of --bash, --fish, or --zsh"
                 return 1
             elif [[ -z "$name" && -z "$cmdname" ]]; then
-                echo "installShellCompletion: error: named pipe requires one of --cmd or --name" >&2
+                nixErrorLog "${FUNCNAME[0]}: named pipe requires one of --cmd or --name"
                 return 1
             fi
         else
@@ -168,10 +165,10 @@ installShellCompletion() {
                 *)
                     if [[ "$argbase" = _* && "$argbase" != *.* ]]; then
                         # probably zsh
-                        echo "installShellCompletion: warning: assuming path \`$arg' is zsh; please specify with --zsh" >&2
+                        nixWarnLog "${FUNCNAME[0]}: assuming path \`$arg' is zsh; please specify with --zsh"
                         curShell=zsh
                     else
-                        echo "installShellCompletion: warning: unknown shell for path: $arg" >&2
+                        nixWarnLog "${FUNCNAME[0]}: unknown shell for path: $arg" >&2
                         retval=2
                         continue
                     fi;;
@@ -188,7 +185,7 @@ installShellCompletion() {
             zsh) outName=_$cmdname;;
             *)
                 # Our list of shells is out of sync with the flags we accept or extensions we detect.
-                echo 'installShellCompletion: internal error' >&2
+                nixErrorLog "${FUNCNAME[0]}: internal: shell $curShell not recognized"
                 return 1;;
             esac
         fi
@@ -206,7 +203,7 @@ installShellCompletion() {
             fi;;
         *)
             # Our list of shells is out of sync with the flags we accept or extensions we detect.
-            echo 'installShellCompletion: internal error' >&2
+            nixErrorLog "${FUNCNAME[0]}: internal: shell $curShell not recognized"
             return 1;;
         esac
         # Install file
@@ -217,18 +214,18 @@ installShellCompletion() {
             mkdir -p "$outDir" \
             && cat "$arg" > "$outPath"
         else
-            install -Dm644 -T "$arg" "$outPath"
-        fi || return
+            install -D --mode=644 --no-target-directory "$arg" "$outPath"
+        fi
 
         if [ ! -s "$outPath" ]; then
-            echo "installShellCompletion: error: installed shell completion file \`$outPath' does not exist or has zero size" >&2
+            nixErrorLog "${FUNCNAME[0]}: installed shell completion file \`$outPath' does not exist or has zero size"
             return 1
         fi
         # Clear the per-path flags
         name=
     done
     if [[ -n "$name" ]]; then
-        echo 'installShellCompletion: error: --name flag given with no path' >&2
+        nixErrorLog "${FUNCNAME[0]}: --name flag given with no path" >&2
         return 1
     fi
     return $retval
@@ -240,13 +237,12 @@ installShellCompletion() {
 installBin() {
     local path
     for path in "$@"; do
-        if (( "${NIX_DEBUG:-0}" >= 1 )); then
-            echo "installBin: installing $path"
-        fi
         if test -z "$path"; then
-            echo "installBin: error: path cannot be empty" >&2
+            nixErrorLog "${FUNCNAME[0]}: path cannot be empty"
             return 1
         fi
+        nixInfoLog "${FUNCNAME[0]}: installing $path"
+
         local basename
         # use stripHash in case it's a nix store path
         basename=$(stripHash "$path")
@@ -254,6 +250,7 @@ installBin() {
         local outRoot
         outRoot=${!outputBin:?}
 
-        install -D --mode=755 --no-target-directory "$path" "${outRoot}/bin/$basename" || return
+        local outPath="${outRoot}/bin/$basename"
+        install -D --mode=755 --no-target-directory "$path" "${outRoot}/bin/$basename"
     done
 }

From 56ff39832db97b06ab3abc658a4569a30c6449f6 Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Fri, 23 Aug 2024 23:11:50 -0300
Subject: [PATCH 080/115] installShellFiles: set passthru directly instead of
 overriding it

---
 pkgs/by-name/in/installShellFiles/package.nix | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/in/installShellFiles/package.nix b/pkgs/by-name/in/installShellFiles/package.nix
index 87787ad872ee..f1cf436a9b79 100644
--- a/pkgs/by-name/in/installShellFiles/package.nix
+++ b/pkgs/by-name/in/installShellFiles/package.nix
@@ -5,14 +5,12 @@
 }:
 
 # See the header comment in ./setup-hook.sh for example usage.
-let
-  setupHook = makeSetupHook { name = "install-shell-files"; } ./setup-hook.sh;
-in
-setupHook.overrideAttrs (oldAttrs: {
-  passthru = (oldAttrs.passthru or { }) // {
+makeSetupHook {
+  name = "install-shell-files";
+  passthru = {
     tests = lib.packagesFromDirectoryRecursive {
       inherit callPackage;
       directory = ./tests;
     };
   };
-})
+} ./setup-hook.sh

From 1fc77a5ce2a6884e8cc69fc59986a08648f4eb83 Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Tue, 6 Aug 2024 22:12:58 -0300
Subject: [PATCH 081/115] doc: rewrite installShellFiles

---
 doc/hooks/installShellFiles.section.md | 83 ++++++++++++++++++++++++--
 1 file changed, 77 insertions(+), 6 deletions(-)

diff --git a/doc/hooks/installShellFiles.section.md b/doc/hooks/installShellFiles.section.md
index 9be67d57bfc6..edaea5895a3b 100644
--- a/doc/hooks/installShellFiles.section.md
+++ b/doc/hooks/installShellFiles.section.md
@@ -1,16 +1,79 @@
 # `installShellFiles` {#installshellfiles}
 
-This hook helps with installing manpages and shell completion files. It exposes 2 shell functions `installManPage` and `installShellCompletion` that can be used from your `postInstall` hook.
+This hook adds helpers that install artifacts like executable files, manpages
+and shell completions.
 
-The `installManPage` function takes one or more paths to manpages to install. The manpages must have a section suffix, and may optionally be compressed (with `.gz` suffix). This function will place them into the correct `share/man/man<section>/` directory, in [`outputMan`](#outputman).
+It exposes the following functions that can be used from your `postInstall`
+hook:
 
-The `installShellCompletion` function takes one or more paths to shell completion files. By default it will autodetect the shell type from the completion file extension, but you may also specify it by passing one of `--bash`, `--fish`, or `--zsh`. These flags apply to all paths listed after them (up until another shell flag is given). Each path may also have a custom installation name provided by providing a flag `--name NAME` before the path. If this flag is not provided, zsh completions will be renamed automatically such that `foobar.zsh` becomes `_foobar`. A root name may be provided for all paths using the flag `--cmd NAME`; this synthesizes the appropriate name depending on the shell (e.g. `--cmd foo` will synthesize the name `foo.bash` for bash and `_foo` for zsh).
+## `installBin` {#installshellfiles-installbin}
+
+The `installBin` function takes one or more paths to files to install as
+executable files.
+
+This function will place them into [`outputBin`](#outputbin).
+
+### Example Usage {#installshellfiles-installbin-exampleusage}
+
+```nix
+{
+  nativeBuildInputs = [ installShellFiles ];
+
+  # Sometimes the file has an undersirable name. It should be renamed before
+  # being installed via installBin
+  postInstall = ''
+    mv a.out delmar
+    installBin foobar delmar
+  '';
+}
+```
+
+## `installManPage` {#installshellfiles-installmanpage}
+
+The `installManPage` function takes one or more paths to manpages to install.
+
+The manpages must have a section suffix, and may optionally be compressed (with
+`.gz` suffix). This function will place them into the correct
+`share/man/man<section>/` directory in [`outputMan`](#outputman).
+
+### Example Usage {#installshellfiles-installmanpage-exampleusage}
+
+```nix
+{
+  nativeBuildInputs = [ installShellFiles ];
+
+  # Sometimes the manpage file has an undersirable name; e.g. it conflicts with
+  # another software with an equal name. It should be renamed before being
+  # installed via installManPage
+  postInstall = ''
+    mv fromsea.3 delmar.3
+    installManPage foobar.1 delmar.3
+  '';
+}
+```
+
+## `installShellCompletion` {#installshellfiles-installshellcompletion}
+
+The `installShellCompletion` function takes one or more paths to shell
+completion files.
+
+By default it will autodetect the shell type from the completion file extension,
+but you may also specify it by passing one of `--bash`, `--fish`, or
+`--zsh`. These flags apply to all paths listed after them (up until another
+shell flag is given). Each path may also have a custom installation name
+provided by providing a flag `--name NAME` before the path. If this flag is not
+provided, zsh completions will be renamed automatically such that `foobar.zsh`
+becomes `_foobar`. A root name may be provided for all paths using the flag
+`--cmd NAME`; this synthesizes the appropriate name depending on the shell
+(e.g. `--cmd foo` will synthesize the name `foo.bash` for bash and `_foo` for
+zsh).
+
+### Example Usage {#installshellfiles-installshellcompletion-exampleusage}
 
 ```nix
 {
   nativeBuildInputs = [ installShellFiles ];
   postInstall = ''
-    installManPage doc/foobar.1 doc/barfoo.3
     # explicit behavior
     installShellCompletion --bash --name foobar.bash share/completions.bash
     installShellCompletion --fish --name foobar.fish share/completions.fish
@@ -21,9 +84,17 @@ The `installShellCompletion` function takes one or more paths to shell completio
 }
 ```
 
-The path may also be a fifo or named fd (such as produced by `<(cmd)`), in which case the shell and name must be provided (see below).
+The path may also be a fifo or named fd (such as produced by `<(cmd)`), in which
+case the shell and name must be provided (see below).
 
-If the destination shell completion file is not actually present or consists of zero bytes after calling `installShellCompletion` this is treated as a build failure. In particular, if completion files are not vendored but are generated by running an executable, this is likely to fail in cross compilation scenarios. The result will be a zero byte completion file and hence a build failure. To prevent this, guard the completion commands against this, e.g.
+If the destination shell completion file is not actually present or consists of
+zero bytes after calling `installShellCompletion` this is treated as a build
+failure. In particular, if completion files are not vendored but are generated
+by running an executable, this is likely to fail in cross compilation
+scenarios. The result will be a zero byte completion file and hence a build
+failure. To prevent this, guard the completion generation commands.
+
+### Example Usage {#installshellfiles-installshellcompletion-exampleusage-guarded}
 
 ```nix
 {

From 32897dce904cb05328940293f289d82d9b413bcb Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Mon, 5 Aug 2024 22:20:38 -0300
Subject: [PATCH 082/115] CODEOWNERS: update ownership for installShellFiles

Since Ericson2314 is the original codeowner of the files.
---
 .github/CODEOWNERS | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index e138cd66152a..22728d6a0b1a 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -389,3 +389,8 @@ pkgs/by-name/lx/lxc*                    @adamcstephens
 /pkgs/os-specific/linux/checkpolicy @RossComputerGuy
 /pkgs/os-specific/linux/libselinux  @RossComputerGuy
 /pkgs/os-specific/linux/libsepol    @RossComputerGuy
+
+# installShellFiles
+/pkgs/by-name/in/installShellFiles/*     @Ericson2314
+/pkgs/test/install-shell-files/*         @Ericson2314
+/doc/hooks/installShellFiles.section.md  @Ericson2314

From 618cffa8e16a5c3182602841d848e7fcbc3c14ca Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Fri, 23 Aug 2024 23:05:28 -0300
Subject: [PATCH 083/115] nawk: uses installBin to install the binary

---
 pkgs/by-name/na/nawk/package.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/na/nawk/package.nix b/pkgs/by-name/na/nawk/package.nix
index cb8766c8c6b0..d2132c25f277 100644
--- a/pkgs/by-name/na/nawk/package.nix
+++ b/pkgs/by-name/na/nawk/package.nix
@@ -34,7 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   installPhase = ''
     runHook preInstall
-    install -Dm755 a.out "$out/bin/nawk"
+    mv a.out nawk
+    installBin nawk
     mv awk.1 nawk.1
     installManPage nawk.1
     runHook postInstall

From 73c1748c1e0827c996ae7c71034d3eb105a122a3 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 29 Aug 2024 13:57:41 +0200
Subject: [PATCH 084/115] python312Packages.oauthlib: disable failing test with
 pyjwt 2.9.0

---
 pkgs/development/python-modules/oauthlib/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/oauthlib/default.nix b/pkgs/development/python-modules/oauthlib/default.nix
index e8211953bb44..84fc4a2627b8 100644
--- a/pkgs/development/python-modules/oauthlib/default.nix
+++ b/pkgs/development/python-modules/oauthlib/default.nix
@@ -47,6 +47,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
+  disabledTests = [
+    # https://github.com/oauthlib/oauthlib/issues/877
+    "test_rsa_bad_keys"
+  ];
+
   pythonImportsCheck = [ "oauthlib" ];
 
   passthru.tests = {

From 92134fa6c7417a28b326c4feb8d49988dc3929d9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 29 Aug 2024 16:49:01 +0200
Subject: [PATCH 085/115] python312Packages.pyjwt: test oauthlib in passthru

---
 pkgs/development/python-modules/pyjwt/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/pyjwt/default.nix b/pkgs/development/python-modules/pyjwt/default.nix
index 2dee3c550a12..daffbcb6d70c 100644
--- a/pkgs/development/python-modules/pyjwt/default.nix
+++ b/pkgs/development/python-modules/pyjwt/default.nix
@@ -9,6 +9,7 @@
   sphinxHook,
   sphinx-rtd-theme,
   zope-interface,
+  oauthlib,
 }:
 
 buildPythonPackage rec {
@@ -49,6 +50,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "jwt" ];
 
+  passthru.tests = {
+    inherit oauthlib;
+  };
+
   meta = with lib; {
     changelog = "https://github.com/jpadilla/pyjwt/blob/${version}/CHANGELOG.rst";
     description = "JSON Web Token implementation in Python";

From 9729387a99fcff79e06dfd631f74a2923a84d585 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 30 Aug 2024 08:56:00 +0300
Subject: [PATCH 086/115] fontconfig: fix properly, remove NixOS module hack

This reverts 49d33d4a6b15330b492a194edc4b67fb20a15fa1.
---
 nixos/modules/config/fonts/fontconfig.nix         | 8 +-------
 pkgs/development/libraries/fontconfig/default.nix | 1 +
 2 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/nixos/modules/config/fonts/fontconfig.nix b/nixos/modules/config/fonts/fontconfig.nix
index a44b1fecd29a..9a9ac08eefeb 100644
--- a/nixos/modules/config/fonts/fontconfig.nix
+++ b/nixos/modules/config/fonts/fontconfig.nix
@@ -180,14 +180,8 @@ let
     mkdir -p $dst
 
     # fonts.conf
-    cp ${pkg.out}/etc/fonts/fonts.conf \
+    ln -s ${pkg.out}/etc/fonts/fonts.conf \
           $dst/../fonts.conf
-
-    # horrible sed hack to add the line that was accidentally removed
-    # from the default config in #324516
-    # FIXME: fix that, revert this
-    sed "5i <include ignore_missing="yes">/etc/fonts/conf.d</include>" -i $dst/../fonts.conf
-
     # TODO: remove this legacy symlink once people stop using packages built before #95358 was merged
     mkdir -p $out/etc/fonts/2.11
     ln -s /etc/fonts/fonts.conf \
diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index 569c2716f0e5..83c5e3afc271 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -69,6 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = ''
     cd "$out/etc/fonts"
     xsltproc --stringparam fontDirectories "${dejavu_fonts.minimal}" \
+      --stringparam includes /etc/fonts/conf.d \
       --path $out/share/xml/fontconfig \
       ${./make-fonts-conf.xsl} $out/etc/fonts/fonts.conf \
       > fonts.conf.tmp

From 9994e4df96fdedd44fba7f11d37ad8600467d494 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Fri, 16 Aug 2024 17:01:15 -0700
Subject: [PATCH 087/115] tinyxxd: init at 1.3.5

---
 pkgs/by-name/ti/tinyxxd/package.nix | 50 +++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 pkgs/by-name/ti/tinyxxd/package.nix

diff --git a/pkgs/by-name/ti/tinyxxd/package.nix b/pkgs/by-name/ti/tinyxxd/package.nix
new file mode 100644
index 000000000000..a19f9d7ef3f3
--- /dev/null
+++ b/pkgs/by-name/ti/tinyxxd/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  installShellFiles,
+  vim,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tinyxxd";
+  version = "1.3.5";
+
+  src = fetchFromGitHub {
+    repo = "tinyxxd";
+    owner = "xyproto";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-W7BrQga98ACrhTHF3UlGQMRmcdJaxgorDP6FpD5mr2A=";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  postInstall = ''
+    installManPage tinyxxd.1
+
+    # Allow using `tinyxxd` as `xxd`. This is similar to the Arch packaging.
+    # https://gitlab.archlinux.org/archlinux/packaging/packages/tinyxxd/-/blob/main/PKGBUILD
+    ln -s $out/bin/{tiny,}xxd
+    ln -s $out/share/man/man1/{tiny,}xxd.1.gz
+  '';
+
+  meta = {
+    homepage = "https://github.com/xyproto/tinyxxd";
+    description = "Drop-in replacement and standalone version of the hex dump utility that comes with ViM";
+    license = [
+      lib.licenses.mit # or
+      lib.licenses.gpl2Only
+    ];
+    mainProgram = "tinyxxd";
+    maintainers = with lib.maintainers; [
+      emily
+      philiptaron
+    ];
+    platforms = lib.platforms.unix;
+
+    # If the two `xxd` providers are present, choose this one.
+    priority = (vim.xxd.meta.priority or lib.meta.defaultPriority) - 1;
+  };
+})

From 7118909e8222d9d7dd4dbf8c153c8a0cae9a87a1 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Fri, 16 Aug 2024 17:23:49 -0700
Subject: [PATCH 088/115] unixtools: use tinyxxd to serve up xxd

---
 pkgs/top-level/unixtools.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/unixtools.nix b/pkgs/top-level/unixtools.nix
index 959d87d5864d..93bb34bba20d 100644
--- a/pkgs/top-level/unixtools.nix
+++ b/pkgs/top-level/unixtools.nix
@@ -224,9 +224,9 @@ let
       darwin = pkgs.darwin.basic_cmds;
     };
     xxd = {
-      linux = pkgs.vim.xxd;
-      darwin = pkgs.vim.xxd;
-      freebsd = pkgs.vim.xxd;
+      linux = pkgs.tinyxxd;
+      darwin = pkgs.tinyxxd;
+      freebsd = pkgs.tinyxxd;
     };
   };
 

From 04cf7c0cd4faa09e36f264bfb326c21e7d63a349 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Fri, 16 Aug 2024 17:17:44 -0700
Subject: [PATCH 089/115] doc: add release note about `xxd` now being provided
 by `tinyxxd` instead of `vim.xxd`

---
 nixos/doc/manual/release-notes/rl-2411.section.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index dd8d377e14eb..f9672d9bfe57 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -417,6 +417,8 @@
 
 - The `shadowstack` hardening flag has been added, though disabled by default.
 
+- `xxd` is now provided by the `tinyxxd` package, rather than `vim.xxd`, to reduce closure size and vulnerability impact. Since it has the same options and semantics as Vim's `xxd` utility, there is no user impact. Vim's `xxd` remains available as the `vim.xxd` package.
+
 - `restic` module now has an option for inhibiting system sleep while backups are running, defaulting to off (not inhibiting sleep), available as [`services.restic.backups.<name>.inhibitsSleep`](#opt-services.restic.backups._name_.inhibitsSleep).
 
 - Support for *runner registration tokens* has been [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/380872)

From af10a338feb5c039ef2ae4a606697b7b5e769c1e Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Thu, 15 Aug 2024 10:11:35 +0200
Subject: [PATCH 090/115] gst_all_1.gstreamer: disable libunwind if unavailable

---
 .../libraries/gstreamer/core/default.nix            | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index 40d40d742463..2cf0569b3e9e 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -10,7 +10,6 @@
 , glib
 , makeWrapper
 , libcap
-, libunwind
 , elfutils # for libdw
 , bash-completion
 , lib
@@ -19,6 +18,9 @@
 , gobject-introspection
 , rustc
 , testers
+, libunwind
+# darwin.libunwind doesn't have pkg-config definitions so meson doesn't detect it.
+, withLibunwind ? !stdenv.isDarwin && lib.meta.availableOn stdenv.hostPlatform libunwind
 # Checks meson.is_cross_build(), so even canExecute isn't enough.
 , enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform, hotdoc
 }:
@@ -70,9 +72,10 @@ stdenv.mkDerivation (finalAttrs: {
     bash-completion
   ] ++ lib.optionals stdenv.isLinux [
     libcap
-    libunwind
   ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [
     elfutils
+  ] ++ lib.optionals withLibunwind [
+    libunwind
   ] ++ lib.optionals stdenv.isDarwin [
     Cocoa
     CoreServices
@@ -86,10 +89,8 @@ stdenv.mkDerivation (finalAttrs: {
     "-Ddbghelp=disabled" # not needed as we already provide libunwind and libdw, and dbghelp is a fallback to those
     "-Dexamples=disabled" # requires many dependencies and probably not useful for our users
     (lib.mesonEnable "doc" enableDocumentation)
-  ] ++ lib.optionals stdenv.isDarwin [
-    # darwin.libunwind doesn't have pkg-config definitions so meson doesn't detect it.
-    "-Dlibunwind=disabled"
-    "-Dlibdw=disabled"
+    (lib.mesonEnable "libunwind" withLibunwind)
+    (lib.mesonEnable "libdw" withLibunwind)
   ];
 
   postPatch = ''

From b5c88efba7d7ce6ae830930613b40bd3b0a4aba9 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Thu, 15 Aug 2024 10:12:42 +0200
Subject: [PATCH 091/115] gst_all_1.gstreamer: disable introspection if
 unavailable

---
 pkgs/development/libraries/gstreamer/core/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index 2cf0569b3e9e..e8f873555d70 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -15,9 +15,11 @@
 , lib
 , Cocoa
 , CoreServices
-, gobject-introspection
 , rustc
 , testers
+, gobject-introspection
+, buildPackages
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , libunwind
 # darwin.libunwind doesn't have pkg-config definitions so meson doesn't detect it.
 , withLibunwind ? !stdenv.isDarwin && lib.meta.availableOn stdenv.hostPlatform libunwind
@@ -60,10 +62,11 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper
     glib
     bash-completion
-    gobject-introspection
     rustc
   ] ++ lib.optionals stdenv.isLinux [
     libcap # for setcap binary
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
   ] ++ lib.optionals enableDocumentation [
     hotdoc
   ];
@@ -88,6 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
   mesonFlags = [
     "-Ddbghelp=disabled" # not needed as we already provide libunwind and libdw, and dbghelp is a fallback to those
     "-Dexamples=disabled" # requires many dependencies and probably not useful for our users
+    (lib.mesonEnable "introspection" withIntrospection)
     (lib.mesonEnable "doc" enableDocumentation)
     (lib.mesonEnable "libunwind" withLibunwind)
     (lib.mesonEnable "libdw" withLibunwind)

From 22786dadf499ddcfaada6c66eeef055752e62672 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 31 Aug 2024 13:45:46 +0300
Subject: [PATCH 092/115] vulkan-headers: 1.3.283.0 -> 1.3.290.0

Diff: https://github.com/KhronosGroup/Vulkan-Headers/compare/vulkan-sdk-1.3.283.0...vulkan-sdk-1.3.290.0
---
 pkgs/development/libraries/vulkan-headers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/vulkan-headers/default.nix b/pkgs/development/libraries/vulkan-headers/default.nix
index cd9dbec03208..c9126e954140 100644
--- a/pkgs/development/libraries/vulkan-headers/default.nix
+++ b/pkgs/development/libraries/vulkan-headers/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "vulkan-headers";
-  version = "1.3.283.0";
+  version = "1.3.290.0";
 
   nativeBuildInputs = [ cmake ];
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-DpbTYlEJPtyf/m9QEI8fdAm1Hw8MpFd+iCd7WB2gp/M=";
+    hash = "sha256-goxA3Wg3u5hNCz54tWMJnFaS0JGVjphy14Ng/sAK/EM=";
   };
 
   passthru.updateScript = ./update.sh;

From 44e1b2986d70210d4339c6d3f8207ab40db56b93 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 31 Aug 2024 13:45:48 +0300
Subject: [PATCH 093/115] vulkan-loader: 1.3.283.0 -> 1.3.290.0

Diff: https://github.com/KhronosGroup/Vulkan-Loader/compare/vulkan-sdk-1.3.283.0...vulkan-sdk-1.3.290.0
---
 pkgs/development/libraries/vulkan-loader/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/vulkan-loader/default.nix b/pkgs/development/libraries/vulkan-loader/default.nix
index 97e513107825..352060ef8dcb 100644
--- a/pkgs/development/libraries/vulkan-loader/default.nix
+++ b/pkgs/development/libraries/vulkan-loader/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-loader";
-  version = "1.3.283.0";
+  version = "1.3.290.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Loader";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-pe4WYbfB20yRI5Pg+RxgmQcmdXsSoRxbBkQ3DdAL8r4=";
+    hash = "sha256-z26xvp7bKaOQAXF+/Sk24Syuw3N9QXc6sk2vlQwceJ8=";
   };
 
   patches = [ ./fix-pkgconfig.patch ];

From 83ee093947ea50e0f9ed688c865b485d1738747f Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 31 Aug 2024 13:45:52 +0300
Subject: [PATCH 094/115] vulkan-validation-layers: 1.3.283.0 -> 1.3.290.0

Diff: https://github.com/KhronosGroup/Vulkan-ValidationLayers/compare/vulkan-sdk-1.3.283.0...vulkan-sdk-1.3.290.0
---
 pkgs/development/tools/vulkan-validation-layers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/vulkan-validation-layers/default.nix b/pkgs/development/tools/vulkan-validation-layers/default.nix
index fdcf2994c189..d5de37245c21 100644
--- a/pkgs/development/tools/vulkan-validation-layers/default.nix
+++ b/pkgs/development/tools/vulkan-validation-layers/default.nix
@@ -24,13 +24,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "vulkan-validation-layers";
-  version = "1.3.283.0";
+  version = "1.3.290.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ValidationLayers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-OT9VfGg3+NBVV6SCGZ+Hu9FAxGJXXT45yvt2sHDIFTA=";
+    hash = "sha256-FMzQpc7mwZGib544w0Dx6LeGi64cercm5oUW45raasc=";
   };
 
   nativeBuildInputs = [

From 9a94f57d73d101fe3bfdb7f93b3ba2f12c3da141 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 31 Aug 2024 13:45:54 +0300
Subject: [PATCH 095/115] vulkan-tools: 1.3.283.0 -> 1.3.290.0

Diff: https://github.com/KhronosGroup/Vulkan-Tools/compare/vulkan-sdk-1.3.283.0...vulkan-sdk-1.3.290.0
---
 pkgs/tools/graphics/vulkan-tools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/graphics/vulkan-tools/default.nix b/pkgs/tools/graphics/vulkan-tools/default.nix
index 19d1597b72d0..759841d02e66 100644
--- a/pkgs/tools/graphics/vulkan-tools/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools/default.nix
@@ -25,13 +25,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.3.283.0";
+  version = "1.3.290.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Tools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-IAlqFCenv5e70XyLSYh2fE84JZQFJwg+YKTGaK7ShKA=";
+    hash = "sha256-8xuE4OTwtH8ckCKDU7oo0WI7/R4Ox53+j+F+ZuKysKI=";
   };
 
   nativeBuildInputs = [

From 2cf5c8b852e31930a3866346f56841e67f4be17f Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 31 Aug 2024 13:45:57 +0300
Subject: [PATCH 096/115] vulkan-tools-lunarg: 1.3.283.0 -> 1.3.290.0

Diff: https://github.com/LunarG/VulkanTools/compare/vulkan-sdk-1.3.283.0...vulkan-sdk-1.3.290.0
---
 pkgs/tools/graphics/vulkan-tools-lunarg/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
index afe23265572d..bef94286ac80 100644
--- a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools-lunarg";
-  version = "1.3.283.0";
+  version = "1.3.290.0";
 
   src = fetchFromGitHub {
    owner = "LunarG";
    repo = "VulkanTools";
    rev = "vulkan-sdk-${version}";
-   hash = "sha256-kRioHGrk6zsBIsnvusq6usAQqxQmCMmGk+O3ckkGEG4=";
+   hash = "sha256-APJRiO5xNHml3k9goFQKwmxb3BXDN7tmvcs/oNCVU58=";
  };
 
   nativeBuildInputs = [ cmake python3 jq which pkg-config libsForQt5.qt5.wrapQtAppsHook ];

From 7b2ce5236d94c79fbeea87ae815a3c8efd723aa6 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 31 Aug 2024 13:46:02 +0300
Subject: [PATCH 097/115] vulkan-extension-layer: 1.3.283.0 -> 1.3.290.0

Diff: https://github.com/KhronosGroup/Vulkan-ExtensionLayer/compare/vulkan-sdk-1.3.283.0...vulkan-sdk-1.3.290.0
---
 pkgs/tools/graphics/vulkan-extension-layer/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/graphics/vulkan-extension-layer/default.nix b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
index 6f5961de851d..b428672fe9fe 100644
--- a/pkgs/tools/graphics/vulkan-extension-layer/default.nix
+++ b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-extension-layer";
-  version = "1.3.283.0";
+  version = "1.3.290.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ExtensionLayer";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-ClmCYJD9GRtM0XgbZqbW1OY1ukP8+FifneaXUjvNGQ4=";
+    hash = "sha256-Cz4C8HoyP768H9ZI7Ys9oX3/qEEhz6vfkdKXoVfodT0=";
   };
 
   nativeBuildInputs = [ cmake pkg-config jq ];

From 0d6ff0ddccbfb6285bb6811873c832172b1002d6 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 31 Aug 2024 13:46:04 +0300
Subject: [PATCH 098/115] vulkan-utility-libraries: 1.3.283.0 -> 1.3.290.0

Diff: https://github.com/KhronosGroup/Vulkan-Utility-Libraries/compare/vulkan-sdk-1.3.283.0...vulkan-sdk-1.3.290.0
---
 .../libraries/vulkan-utility-libraries/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/vulkan-utility-libraries/default.nix b/pkgs/development/libraries/vulkan-utility-libraries/default.nix
index 769cdb95908d..060f609c8566 100644
--- a/pkgs/development/libraries/vulkan-utility-libraries/default.nix
+++ b/pkgs/development/libraries/vulkan-utility-libraries/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-utility-libraries";
-  version = "1.3.283.0";
+  version = "1.3.290.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Utility-Libraries";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-oQC//4RHJjSncQtHPVsYnpLYtXfxSSJdbUBf8clevDI=";
+    hash = "sha256-dzX2xePUkjL4G+IMwPCUgFs1iKsqwZScQQBDt5toUzc=";
   };
 
   nativeBuildInputs = [ cmake python3 ];

From 2314a5687b0a165dad261e465f20d36a3f30786a Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 31 Aug 2024 13:46:07 +0300
Subject: [PATCH 099/115] vulkan-volk: 1.3.283.0 -> 1.3.290.0

Diff: https://github.com/zeux/volk/compare/vulkan-sdk-1.3.283.0...vulkan-sdk-1.3.290.0
---
 pkgs/by-name/vu/vulkan-volk/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-volk/package.nix b/pkgs/by-name/vu/vulkan-volk/package.nix
index d65002027a17..378e32cd01a2 100644
--- a/pkgs/by-name/vu/vulkan-volk/package.nix
+++ b/pkgs/by-name/vu/vulkan-volk/package.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "volk";
-  version = "1.3.283.0";
+  version = "1.3.290.0";
 
   src = fetchFromGitHub {
     owner = "zeux";
     repo = "volk";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-AoUStYeSTu6YmdyKgx0n3O+p3asb39GU6HSHgOhhFhQ=";
+    hash = "sha256-SbTBwS4mJETrXRT7QMJX9F8ukcZmzz8+1atVbB/fid4=";
   };
 
   nativeBuildInputs = [ cmake ];

From a919d00a29344642c0c0145c39008ff747a08f84 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 31 Aug 2024 13:46:10 +0300
Subject: [PATCH 100/115] spirv-headers: 1.3.283.0 -> 1.3.290.0

Diff: https://github.com/KhronosGroup/SPIRV-Headers/compare/vulkan-sdk-1.3.283.0...vulkan-sdk-1.3.290.0
---
 pkgs/development/libraries/spirv-headers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/spirv-headers/default.nix b/pkgs/development/libraries/spirv-headers/default.nix
index 31efd76209a3..8326a71041da 100644
--- a/pkgs/development/libraries/spirv-headers/default.nix
+++ b/pkgs/development/libraries/spirv-headers/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-headers";
-  version = "1.3.283.0";
+  version = "1.3.290.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-CAmDDqeMVKNdV/91VQYAKyCc+e+H99PRYZzt5WjswBI=";
+    hash = "sha256-c9ruBCnf9PNJz030bfRhHwyqju6T8YCRx+efKCEYgSo=";
   };
 
   nativeBuildInputs = [ cmake ];

From d4bd2a8446c36c4e06f55628a71a7e200e35f4bd Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 31 Aug 2024 13:46:14 +0300
Subject: [PATCH 101/115] spirv-cross: 1.3.283.0 -> 1.3.290.0

Diff: https://github.com/KhronosGroup/SPIRV-Cross/compare/vulkan-sdk-1.3.283.0...vulkan-sdk-1.3.290.0

Changelog: https://github.com/KhronosGroup/SPIRV-Cross/releases/tag/1.3.290.0
---
 pkgs/tools/graphics/spirv-cross/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/graphics/spirv-cross/default.nix b/pkgs/tools/graphics/spirv-cross/default.nix
index aec81ac9c406..ee211e6c0318 100644
--- a/pkgs/tools/graphics/spirv-cross/default.nix
+++ b/pkgs/tools/graphics/spirv-cross/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-cross";
-  version = "1.3.283.0";
+  version = "1.3.290.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Cross";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-UEXKzx1NXCInOnI96Z1hfrpyoWdb3BOGEKstX1gVzIo=";
+    hash = "sha256-h5My9PbPq1l03xpXQQFolNy7G1RhExtTH6qPg7vVF/8=";
   };
 
   nativeBuildInputs = [ cmake python3 ];

From 4441399c6475e24c34fed6e979d86b00f12c326d Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 31 Aug 2024 13:46:18 +0300
Subject: [PATCH 102/115] spirv-tools: 1.3.283.0 -> 1.3.290.0

Diff: https://github.com/KhronosGroup/SPIRV-Tools/compare/vulkan-sdk-1.3.283.0...vulkan-sdk-1.3.290.0
---
 pkgs/development/tools/spirv-tools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/spirv-tools/default.nix b/pkgs/development/tools/spirv-tools/default.nix
index 50d04ba050c3..40764df42280 100644
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-tools";
-  version = "1.3.283.0";
+  version = "1.3.290.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-at3krE0torhjg7G+NkX0/ewc26Sg/1t2xW7wghAAuZo=";
+    hash = "sha256-5swjNHeJpsCDkUVBL1uFqAzOPFzCESsYtDfRkno2bN4=";
   };
 
   # The cmake options are sufficient for turning on static building, but not

From 90534869fb973c7d8d49f343ff1c999d19f06e55 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sat, 31 Aug 2024 21:26:58 +0200
Subject: [PATCH 103/115] vim: 9.1.0689 -> 9.1.0707

Fixes 2 heap-buffer-overflows (GHSA-4ghr-c62x-cqfh / CVE-2024-43802, GHSA-wxf9-c5gx-qrwr).

https://www.openwall.com/lists/oss-security/2024/08/31/1
https://www.openwall.com/lists/oss-security/2024/08/25/1
---
 pkgs/applications/editors/vim/common.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 4113157d4f24..5b9cfec4cb32 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.0689";
+  version = "9.1.0707";
 
   outputs = [ "out" "xxd" ];
 
@@ -8,7 +8,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-87y/STnGB2Yf64TMwCd6VCFF2kvy+DmNyaXVKPIc86E=";
+    hash = "sha256-iHOLABPk5B7Sh7EBYnM7wdxnK2Wv7q4WS3FEp780SV4=";
   };
 
   enableParallelBuilding = true;

From ad0aa8e34d25f8f9263527a76ae26f3c28b00881 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Sat, 31 Aug 2024 19:28:04 +0800
Subject: [PATCH 104/115] emacs: set foundMakefile in buildPhase of elisp
 builders

foundMakefile is used[1] in stdenv checkPhase.

[1]: https://github.com/NixOS/nixpkgs/blob/12228ff1752d7b7624a54e9c1af4b222b3c1073b/pkgs/stdenv/generic/setup.sh#L1471-L1475
---
 pkgs/applications/editors/emacs/build-support/melpa.nix   | 5 +++++
 pkgs/applications/editors/emacs/build-support/trivial.nix | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/pkgs/applications/editors/emacs/build-support/melpa.nix b/pkgs/applications/editors/emacs/build-support/melpa.nix
index bda412a0957f..e129e3ebdeb0 100644
--- a/pkgs/applications/editors/emacs/build-support/melpa.nix
+++ b/pkgs/applications/editors/emacs/build-support/melpa.nix
@@ -126,6 +126,11 @@ EOF
   buildPhase = args.buildPhase or ''
     runHook preBuild
 
+    # This is modified from stdenv buildPhase. foundMakefile is used in stdenv checkPhase.
+    if [[ ! ( -z "''${makeFlags-}" && -z "''${makefile:-}" && ! ( -e Makefile || -e makefile || -e GNUmakefile ) ) ]]; then
+      foundMakefile=1
+    fi
+
     pushd "$NIX_BUILD_TOP"
 
     emacs --batch -Q \
diff --git a/pkgs/applications/editors/emacs/build-support/trivial.nix b/pkgs/applications/editors/emacs/build-support/trivial.nix
index 2c20b0567c68..8c515363f427 100644
--- a/pkgs/applications/editors/emacs/build-support/trivial.nix
+++ b/pkgs/applications/editors/emacs/build-support/trivial.nix
@@ -14,6 +14,11 @@ args:
   buildPhase = args.buildPhase or ''
     runHook preBuild
 
+    # This is modified from stdenv buildPhase. foundMakefile is used in stdenv checkPhase.
+    if [[ ! ( -z "''${makeFlags-}" && -z "''${makefile:-}" && ! ( -e Makefile || -e makefile || -e GNUmakefile ) ) ]]; then
+      foundMakefile=1
+    fi
+
     emacs -L . --batch -f batch-byte-compile *.el
 
     runHook postBuild

From f87b978abed6a81c3c003174aed1b8f093190a8c Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Thu, 15 Aug 2024 10:15:02 +0200
Subject: [PATCH 105/115] roc-toolkit: disable libunwind if unavailable

---
 pkgs/development/libraries/audio/roc-toolkit/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/audio/roc-toolkit/default.nix b/pkgs/development/libraries/audio/roc-toolkit/default.nix
index 4654e29a835f..a062afcfa1d0 100644
--- a/pkgs/development/libraries/audio/roc-toolkit/default.nix
+++ b/pkgs/development/libraries/audio/roc-toolkit/default.nix
@@ -9,7 +9,7 @@
   openfecSupport ? true,
   openfec,
   speexdsp,
-  libunwindSupport ? true,
+  libunwindSupport ? lib.meta.availableOn stdenv.hostPlatform libunwind,
   libunwind,
   pulseaudioSupport ? true,
   libpulseaudio,

From f0a86e6d119877f47452a790157def800aef5a61 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 2 Sep 2024 15:31:13 +0200
Subject: [PATCH 106/115] libunwind.meta.pkgConfigModules: init

This will allow packages like gstreamer that need to find libunwind
via pkg-config to check whether the libunwind they've been given has
the modules they expect.
---
 .../development/libraries/libunwind/default.nix | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/libunwind/default.nix b/pkgs/development/libraries/libunwind/default.nix
index 1f7074866d58..6f491a5c527f 100644
--- a/pkgs/development/libraries/libunwind/default.nix
+++ b/pkgs/development/libraries/libunwind/default.nix
@@ -1,13 +1,16 @@
-{ stdenv, lib, fetchpatch, fetchFromGitHub, autoreconfHook, xz, buildPackages }:
+{ stdenv, lib, fetchpatch, fetchFromGitHub, autoreconfHook, buildPackages
+, xz
+, testers
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libunwind";
   version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "libunwind";
     repo = "libunwind";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-rCFBHs6rCSnp5FEwbUR5veNNTqSQpFblAv8ebSPX0qE=";
   };
 
@@ -50,12 +53,18 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # fails
 
+  passthru.tests.pkg-config = testers.hasPkgConfigModules {
+    package = finalAttrs.finalPackage;
+    versionCheck = true;
+  };
+
   meta = with lib; {
     homepage = "https://www.nongnu.org/libunwind";
     description = "Portable and efficient API to determine the call-chain of a program";
     maintainers = with maintainers; [ orivej ];
+    pkgConfigModules = [ "libunwind" "libunwind-coredump" "libunwind-generic" "libunwind-ptrace" "libunwind-setjmp" ];
     # https://github.com/libunwind/libunwind#libunwind
     platforms = [ "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux" "armv7l-linux" "i686-freebsd" "i686-linux" "loongarch64-linux" "mips64el-linux" "mipsel-linux" "powerpc64-linux" "powerpc64le-linux" "riscv64-linux" "s390x-linux" "x86_64-freebsd" "x86_64-linux" "x86_64-solaris" ];
     license = licenses.mit;
   };
-}
+})

From 52b0b4ef3d2b1b6a76f97d0c8c50def5640ab7c1 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 2 Sep 2024 15:33:23 +0200
Subject: [PATCH 107/115] gst_all_1.gstreamer: use a better libunwind check

Checking for Darwin didn't take into account that we also use a
libunwind implementation without pkg-config on riscv32-linux.  Fix by
checking for the presence of the pkg-config file required directly,
rather than by using platform as a proxy.
---
 pkgs/development/libraries/gstreamer/core/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index e8f873555d70..d1094cfc8794 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -21,8 +21,9 @@
 , buildPackages
 , withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , libunwind
-# darwin.libunwind doesn't have pkg-config definitions so meson doesn't detect it.
-, withLibunwind ? !stdenv.isDarwin && lib.meta.availableOn stdenv.hostPlatform libunwind
+, withLibunwind ?
+  lib.meta.availableOn stdenv.hostPlatform libunwind &&
+    lib.elem "libunwind" libunwind.meta.pkgConfigModules or []
 # Checks meson.is_cross_build(), so even canExecute isn't enough.
 , enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform, hotdoc
 }:

From 235ae9c70fbb260384cb6497f45c443002c5fed0 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Tue, 3 Sep 2024 16:01:37 +0200
Subject: [PATCH 108/115] nodejs_22: 22.7.0 -> 22.8.0

---
 pkgs/development/web/nodejs/v22.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix
index 3c6508fc5c5d..90174977ffa9 100644
--- a/pkgs/development/web/nodejs/v22.nix
+++ b/pkgs/development/web/nodejs/v22.nix
@@ -12,8 +12,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "22.7.0";
-  sha256 = "1e0b6f2f2ca4fb0b4644a11363169daf4b7c42f00e5a53d2c65a9fdc463e7d88";
+  version = "22.8.0";
+  sha256 = "f130e82176d1ee0702d99afc1995d0061bf8ed357c38834a32a08c9ef74f1ac7";
   patches = [
     ./configure-emulator.patch
     ./configure-armv6-vfpv2.patch

From dfefafb8f66a9269882f60f72a3d27b695820c36 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 4 Sep 2024 02:41:21 +0200
Subject: [PATCH 109/115] python312Packages.django_4: 4.2.15 -> 4.2.16

https://docs.djangoproject.com/en/4.2/releases/4.2.16/
https://www.djangoproject.com/weblog/2024/sep/03/security-releases/

Fixes: CVE-2024-45230, CVE-2024-45231
---
 pkgs/development/python-modules/django/4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index 398e0516b7d4..99d71f2b38b1 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -44,7 +44,7 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "4.2.15";
+  version = "4.2.16";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -53,7 +53,7 @@ buildPythonPackage rec {
     owner = "django";
     repo = "django";
     rev = "refs/tags/${version}";
-    hash = "sha256-SWENMUsTgP3X3EvFiTgpKCZO0/KaZ1x1stSyp2kM/P4=";
+    hash = "sha256-VW/qfqOadivtU8Xg70FLqENtOV7GqJM4bR2Ik6Yag+o=";
   };
 
   patches =

From 8f61973d92aee06e2e0854f13433940c5e169a35 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 4 Sep 2024 05:06:42 +0100
Subject: [PATCH 110/115] Revert "e2fsprogs: build fuse2fs on darwin"

This change, while fine in isolation, breaks evaluation in combination
with <https://github.com/NixOS/nixpkgs/pull/329721>, as `xar` depends
on `e2fsprogs` which now depends on `macfuse-stubs` which depends on
`xar`. This broke `staging-next`.

A couple possible solutions are to disable the `e2fsprogs` dependency
in the version of `xar` used for the bootstrap, or to build
`macfuse-stubs` from source to avoid the `xar` dependency.

This reverts commit 0dfc820f4a915a979ccb4ba420a8fcad48345170.
---
 pkgs/tools/filesystems/e2fsprogs/default.nix  |  8 ++++----
 .../tools/filesystems/e2fsprogs/macfuse.patch | 20 -------------------
 2 files changed, 4 insertions(+), 24 deletions(-)
 delete mode 100644 pkgs/tools/filesystems/e2fsprogs/macfuse.patch

diff --git a/pkgs/tools/filesystems/e2fsprogs/default.nix b/pkgs/tools/filesystems/e2fsprogs/default.nix
index 1c453fb95893..b8443e8ac880 100644
--- a/pkgs/tools/filesystems/e2fsprogs/default.nix
+++ b/pkgs/tools/filesystems/e2fsprogs/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, buildPackages, fetchurl, fetchpatch, pkg-config, libuuid, gettext, texinfo
-, withFuse ? stdenv.isLinux || stdenv.isDarwin, fuse3, macfuse-stubs
+, withFuse ? stdenv.isLinux, fuse3
 , shared ? !stdenv.hostPlatform.isStatic
 , e2fsprogs, runCommand
 }:
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ pkg-config texinfo ];
   buildInputs = [ libuuid gettext ]
-    ++ lib.optional withFuse (if stdenv.isDarwin then macfuse-stubs else fuse3);
+    ++ lib.optionals withFuse [ fuse3 ];
 
   patches = [
     # Avoid trouble with older systems like NixOS 23.05.
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
       url = "https://lore.kernel.org/linux-ext4/20240527091542.4121237-2-hi@alyssa.is/raw";
       hash = "sha256-pMoqm2eo5zYaTdU+Ppa4+posCVFb2A9S4uo5oApaaqc=";
     })
-  ] ++ lib.optional stdenv.isDarwin ./macfuse.patch;
+  ];
 
   configureFlags =
     if stdenv.isLinux then [
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
       "--disable-uuidd"
     ] else [
       "--enable-libuuid --disable-e2initrd-helper"
-    ] ++ lib.optional stdenv.isDarwin "CFLAGS=-D_FILE_OFFSET_BITS=64";
+    ];
 
   nativeCheckInputs = [ buildPackages.perl ];
   doCheck = true;
diff --git a/pkgs/tools/filesystems/e2fsprogs/macfuse.patch b/pkgs/tools/filesystems/e2fsprogs/macfuse.patch
deleted file mode 100644
index 2445958edd79..000000000000
--- a/pkgs/tools/filesystems/e2fsprogs/macfuse.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- a/misc/fuse2fs.c
-+++ b/misc/fuse2fs.c
-@@ -2441,7 +2441,7 @@
- #undef XATTR_TRANSLATOR
-
- static int op_getxattr(const char *path, const char *key, char *value,
--		       size_t len)
-+		       size_t len, uint32_t position EXT2FS_ATTR((unused)))
- {
- 	struct fuse_context *ctxt = fuse_get_context();
- 	struct fuse2fs *ff = (struct fuse2fs *)ctxt->private_data;
-@@ -2623,7 +2623,7 @@
-
- static int op_setxattr(const char *path EXT2FS_ATTR((unused)),
- 		       const char *key, const char *value,
--		       size_t len, int flags EXT2FS_ATTR((unused)))
-+		       size_t len, int flags EXT2FS_ATTR((unused)), uint32_t position EXT2FS_ATTR((unused)))
- {
- 	struct fuse_context *ctxt = fuse_get_context();
- 	struct fuse2fs *ff = (struct fuse2fs *)ctxt->private_data;

From 5ffe217cd9b3834cdd916720723d2a28be6cae50 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Wed, 4 Sep 2024 17:22:03 +0200
Subject: [PATCH 111/115] mongodb-ce: remove custom `curl` override

(cherry picked from commit 3a41bcd617109a6161d702f7458d4a508a499a5a)
---
 pkgs/by-name/mo/mongodb-ce/package.nix | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/pkgs/by-name/mo/mongodb-ce/package.nix b/pkgs/by-name/mo/mongodb-ce/package.nix
index ba527df39564..d3dc490bdcfe 100644
--- a/pkgs/by-name/mo/mongodb-ce/package.nix
+++ b/pkgs/by-name/mo/mongodb-ce/package.nix
@@ -49,11 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
   dontStrip = true;
 
   buildInputs = [
-    # Remove this after https://github.com/NixOS/nixpkgs/pull/336712
-    # has landed in `nixpkgs-unstable`
-    (curl.overrideAttrs (old: {
-      configureFlags = old.configureFlags ++ [ "--enable-versioned-symbols" ];
-    })).dev
+    curl.dev
     openssl.dev
     stdenv.cc.cc.lib
   ];

From 02a4d9a728489f78a8265d84c6fd6c1057f449d1 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 5 Sep 2024 11:41:01 +0300
Subject: [PATCH 112/115] mesa: cherry-pick fixes for software rendering
 fallback

---
 pkgs/development/libraries/mesa/default.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index dc722d44243f..3593faa13edb 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -6,6 +6,7 @@
 , expat
 , fetchCrate
 , fetchFromGitLab
+, fetchpatch
 , file
 , flex
 , glslang
@@ -139,6 +140,18 @@ in stdenv.mkDerivation {
 
   patches = [
     ./opencl.patch
+
+    # dril/swrast fixes
+    # FIXME: remove when backported upstream
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/mesa/mesa/-/commit/06d417af80bc1f171cadc338e63a7aa75c877754.diff";
+      hash = "sha256-JbrygyjtgNcQlggv1X+3HWf4WRWdtyeEvg3jwthEspM=";
+    })
+
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/mesa/mesa/-/commit/56ac37845487b62f495428b0f20d145489f621e2.diff";
+      hash = "sha256-J6P7k6SuOqRzmeqiiAc+QgBDp5nIBY+sPwvnQ+hlCW8=";
+    })
   ];
 
   postPatch = ''

From 4333fa1caa944786110a0342b4cd1057eec74e14 Mon Sep 17 00:00:00 2001
From: techknowlogick <techknowlogick@gitea.com>
Date: Thu, 5 Sep 2024 21:12:46 -0400
Subject: [PATCH 113/115] go_1_22: 1.22.6 -> 1.22.7

Changelog: https://go.dev/doc/devel/release#go1.22
---
 pkgs/development/compilers/go/1.22.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.22.nix b/pkgs/development/compilers/go/1.22.nix
index 5cc070d34e0d..4060a6cf6975 100644
--- a/pkgs/development/compilers/go/1.22.nix
+++ b/pkgs/development/compilers/go/1.22.nix
@@ -47,11 +47,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.22.6";
+  version = "1.22.7";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-nkjZnVGYgleZF9gYnBfpjDc84lq667mHcuKScIiZKlE=";
+    hash = "sha256-ZkMth9heDPrD7f/mN9WTD8Td9XkzE/4R5KDzMwI8h58=";
   };
 
   strictDeps = true;

From 6efb622aca97c5bdf051f9bf554b2fc9a958d07e Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 6 Sep 2024 08:24:55 +0300
Subject: [PATCH 114/115] mesa: 24.2.1 -> 24.2.2

---
 pkgs/development/libraries/mesa/common.nix  |  4 ++--
 pkgs/development/libraries/mesa/default.nix | 12 ------------
 2 files changed, 2 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/libraries/mesa/common.nix b/pkgs/development/libraries/mesa/common.nix
index 37ae8905891f..1390ba84397e 100644
--- a/pkgs/development/libraries/mesa/common.nix
+++ b/pkgs/development/libraries/mesa/common.nix
@@ -5,14 +5,14 @@
 # nix build .#legacyPackages.x86_64-darwin.mesa .#legacyPackages.aarch64-darwin.mesa
 rec {
   pname = "mesa";
-  version = "24.2.1";
+  version = "24.2.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "mesa";
     rev = "mesa-${version}";
-    hash = "sha256-1aOK5M4Xe1FnmouOIoyafrvnxyoGpNK8wLVDC8yO4p0=";
+    hash = "sha256-1aRnG5BnFDuBOnGIb7X3yDk4PkhpBbMpp+IjfpmgtkM=";
   };
 
   meta = {
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 3593faa13edb..94a72143a71f 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -140,18 +140,6 @@ in stdenv.mkDerivation {
 
   patches = [
     ./opencl.patch
-
-    # dril/swrast fixes
-    # FIXME: remove when backported upstream
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/mesa/mesa/-/commit/06d417af80bc1f171cadc338e63a7aa75c877754.diff";
-      hash = "sha256-JbrygyjtgNcQlggv1X+3HWf4WRWdtyeEvg3jwthEspM=";
-    })
-
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/mesa/mesa/-/commit/56ac37845487b62f495428b0f20d145489f621e2.diff";
-      hash = "sha256-J6P7k6SuOqRzmeqiiAc+QgBDp5nIBY+sPwvnQ+hlCW8=";
-    })
   ];
 
   postPatch = ''

From 1e31bdf2b806ff39ded6419001e5a2b51397a510 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sun, 8 Sep 2024 07:26:22 +0200
Subject: [PATCH 115/115] vulkan-headers: fixup build on darwin

Broken after update by PR #338599
---
 pkgs/development/libraries/vulkan-headers/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/libraries/vulkan-headers/default.nix b/pkgs/development/libraries/vulkan-headers/default.nix
index c9126e954140..9b5916810ab0 100644
--- a/pkgs/development/libraries/vulkan-headers/default.nix
+++ b/pkgs/development/libraries/vulkan-headers/default.nix
@@ -5,6 +5,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
+  # TODO: investigate why <algorithm> isn't found
+  cmakeFlags = lib.optionals stdenv.isDarwin [ "-DVULKAN_HEADERS_ENABLE_MODULE=OFF" ];
+
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";