Merge #171497: staging-next 2022-05-04

2022-05-09 07:19:20 +02:00 · 2022-05-09 07:19:20 +02:00 · 43c99bebda
commit 43c99bebda
parent 4fea68fd73 7fc4acfd29
68 changed files with 597 additions and 300 deletions
--- a/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json
+++ b/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json
@ -61,6 +61,9 @@
        {
          "application.process.binary": "teams"
        },
+        {
+          "application.process.binary": "teams-insiders"
+        },
        {
          "application.process.binary": "skypeforlinux"
        }
--- a/pkgs/applications/audio/cdparanoia/configure.patch
+++ b/pkgs/applications/audio/cdparanoia/configure.patch
@ -0,0 +1,22 @@
+diff --git a/configure.in b/configure.ac
+similarity index 90%
+rename from configure.in
+rename to configure.ac
+index 3ad98ca11da..8fad378faf4 100644
+--- a/configure.in
+++ b/configure.ac
+@@ -1,13 +1,8 @@
+ AC_INIT(interface/interface.c)
+ 
+-cp $srcdir/configure.guess $srcdir/config.guess
+-cp $srcdir/configure.sub $srcdir/config.sub
+-
+ AC_CANONICAL_HOST
+ 
+-if test -z "$CC"; then
+-	AC_PROG_CC	
+-fi
+AC_PROG_CC
+ AC_PROG_RANLIB
+ AC_CHECK_PROG(AR,ar,ar)
+ AC_CHECK_PROG(INSTALL,install,install)
--- a/pkgs/applications/audio/cdparanoia/default.nix
+++ b/pkgs/applications/audio/cdparanoia/default.nix
@ -1,4 +1,7 @@
-{ lib, stdenv, fetchurl, gnu-config, IOKit, Carbon }:
+{ lib, stdenv, fetchurl, fetchpatch
+, updateAutotoolsGnuConfigScriptsHook, autoreconfHook
+, IOKit, Carbon
+}:

 stdenv.mkDerivation rec {
  pname = "cdparanoia-III";
@ -10,16 +13,29 @@ stdenv.mkDerivation rec {
  };

  patches = lib.optionals stdenv.isDarwin [
-    (fetchurl {
+    (fetchpatch {
      url = "https://trac.macports.org/export/70964/trunk/dports/audio/cdparanoia/files/osx_interface.patch";
-      sha256 = "1n86kzm2ssl8fdf5wlhp6ncb2bf6b9xlb5vg0mhc85r69prqzjiy";
+      sha256 = "0hq3lvfr0h1m3p0r33jij0s1aspiqlpy533rwv19zrfllb39qvr8";
+      # Our configure patch will subsume it, but we want our configure
+      # patch to be used on all platforms so we cannot just start where
+      # this leaves off.
+      excludes = [ "configure.in" ];
    })
    (fetchurl {
      url = "https://trac.macports.org/export/70964/trunk/dports/audio/cdparanoia/files/patch-paranoia_paranoia.c.10.4.diff";
      sha256 = "17l2qhn8sh4jy6ryy5si6ll6dndcm0r537rlmk4a6a8vkn852vad";
    })
-    ] ++ lib.optional stdenv.hostPlatform.isMusl ./utils.patch
-    ++ [./fix_private_keyword.patch];
+  ] ++ [
+    # Has to come after darwin patches
+    ./fix_private_keyword.patch
+    # Order does not matter
+    ./configure.patch
+  ] ++ lib.optional stdenv.hostPlatform.isMusl ./utils.patch;
+
+  nativeBuildInputs = [
+    updateAutotoolsGnuConfigScriptsHook
+    autoreconfHook
+  ];

  propagatedBuildInputs = lib.optionals stdenv.isDarwin [
    Carbon
@ -28,13 +44,6 @@ stdenv.mkDerivation rec {

  hardeningDisable = [ "format" ];

-  preConfigure = ''
-    unset CC
-  '' + lib.optionalString (!stdenv.hostPlatform.isx86) ''
-    cp ${gnu-config}/config.sub configure.sub
-    cp ${gnu-config}/config.guess configure.guess
-  '';
-
  # Build system reuses the same object file names for shared and static
  # library. Occasionally fails in the middle:
  #    gcc -O2 -fsigned-char -g -O2 -c scan_devices.c
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@ -16,8 +16,8 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ buildPackages.stdenv.cc pkg-config cmake ];

-  buildInputs = [ glib libsndfile libpulseaudio libjack2 ]
-    ++ lib.optionals stdenv.isLinux [ alsa-lib ]
+  buildInputs = [ glib libsndfile libjack2 ]
+    ++ lib.optionals stdenv.isLinux [ alsa-lib libpulseaudio ]
    ++ lib.optionals stdenv.isDarwin [ AudioUnit CoreAudio CoreMIDI CoreServices ];

  cmakeFlags = [ "-Denable-framework=off" ];
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.4609";
+  version = "8.2.4816";

  src = fetchFromGitHub {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    sha256 = "sha256-IiWZJ4zT+VbcxwKChl847pS9jU9AlxZ/yQUIL8I2MhQ=";
+    sha256 = "1lgqr3ki50hwkz4vhdyaryirrs99qq4kgkhmpx7ygvn6aj2wapg5";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/editors/vim/configurable.nix
+++ b/pkgs/applications/editors/vim/configurable.nix
@ -3,7 +3,7 @@
 , libX11, libXext, libSM, libXpm, libXt, libXaw, libXau, libXmu
 , libICE
 , vimPlugins
-, makeWrapper, makeBinaryWrapper
+, makeWrapper
 , wrapGAppsHook
 , runtimeShell

@ -133,9 +133,7 @@ in stdenv.mkDerivation rec {
  ++ lib.optional wrapPythonDrv makeWrapper
  ++ lib.optional nlsSupport gettext
  ++ lib.optional perlSupport perl
-  # Make the inner wrapper binary to avoid double wrapping issues with wrapPythonDrv
-  # (https://github.com/NixOS/nixpkgs/pull/164163)
-  ++ lib.optional (guiSupport == "gtk3") (wrapGAppsHook.override { makeWrapper = makeBinaryWrapper; })
+  ++ lib.optional (guiSupport == "gtk3") wrapGAppsHook
  ;

  buildInputs = [
--- a/pkgs/applications/graphics/sane/backends/default.nix
+++ b/pkgs/applications/graphics/sane/backends/default.nix
@ -40,18 +40,19 @@ stdenv.mkDerivation {
  buildInputs = [
    avahi
    libgphoto2
-    libieee1284
    libjpeg
    libpng
    libtiff
    libusb1
-    libv4l
-    net-snmp
    curl
-    systemd
    libxml2
    poppler
    gawk
+  ] ++ lib.optionals stdenv.isLinux [
+    libieee1284
+    libv4l
+    net-snmp
+    systemd
  ];

  enableParallelBuilding = true;
@ -113,6 +114,6 @@ stdenv.mkDerivation {
    '';
    homepage = "http://www.sane-project.org/";
    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
  };
 }
--- a/pkgs/applications/misc/archivy/default.nix
+++ b/pkgs/applications/misc/archivy/default.nix
@ -49,21 +49,9 @@ buildPythonApplication rec {
    hash = "sha256-o5dVJDbdKgo6hMMU9mKzoouSgVWl7xSAp+Aq61VcfeU=";
  };

-  # Relax some dependencies
-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace 'WTForms ==' 'WTForms >=' \
-      --replace 'attrs == 20.2.0' 'attrs' \
-      --replace 'elasticsearch ==' 'elasticsearch >=' \
-      --replace 'python_dotenv ==' 'python_dotenv >=' \
-      --replace 'python_frontmatter == 0.5.0' 'python_frontmatter' \
-      --replace 'requests ==' 'requests >=' \
-      --replace 'validators ==' 'validators >=' \
-      --replace 'flask-login == ' 'flask-login >= ' \
-      --replace 'tinydb ==' 'tinydb >=' \
-      --replace 'Flask_WTF == 0.14.3' 'Flask_WTF' \
-      --replace 'Flask ==' 'Flask >='
-  '';
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+
+  pythonRelaxDeps = true;

  propagatedBuildInputs = [
    appdirs
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -1,5 +1,5 @@
 { stdenv, lib, makeDesktopItem, makeWrapper, lndir, config
-, replace, fetchurl, zip, unzip, jq, xdg-utils, writeText
+, fetchurl, zip, unzip, jq, xdg-utils, writeText

 ## various stuff that can be plugged in
 , ffmpeg, xorg, alsa-lib, libpulseaudio, libcanberra-gtk3, libglvnd, libnotify, opensc
@ -176,7 +176,7 @@ let
        startupWMClass = wmClass;
      };

-      nativeBuildInputs = [ makeWrapper lndir replace jq ];
+      nativeBuildInputs = [ makeWrapper lndir jq ];
      buildInputs = [ browser.gtk3 ];


@ -206,48 +206,50 @@ let
        done

        # fix links and absolute references
-        cd "${browser}"

        find . -type l -print0 | while read -d $'\0' l; do
-          target="$(readlink "$l" | replace-literal -es -- "${browser}" "$out")"
+          target="$(readlink "$l")"
+          target=''${target/#"${browser}"/"$out"}
          ln -sfT "$target" "$out/$l"
        done

-        # This will not patch binaries, only "text" files.
-        # Its there for the wrapper mostly.
-        cd "$out"
-        replace-literal -esfR -- "${browser}" "$out"
-
        # create the wrapper

        executablePrefix="$out/bin"
        executablePath="$executablePrefix/${applicationName}"
+        oldWrapperArgs=()

-        if [ ! -x "$executablePath" ]
-        then
-            echo "cannot find executable file \`${browser}/bin/${applicationName}'"
-            exit 1
-        fi
-
-        if [ ! -L "$executablePath" ]
-        then
-          # Careful here, the file at executablePath may already be
-          # a wrapper. That is why we postfix it with -old instead
-          # of -wrapped.
-          oldExe="$executablePrefix"/".${applicationName}"-old
-          mv "$executablePath" "$oldExe"
-        else
+        if [[ -L $executablePath ]]; then
+          # Symbolic link: wrap the link's target.
          oldExe="$(readlink -v --canonicalize-existing "$executablePath")"
-        fi
-
-        if [ ! -x "${browser}/bin/${applicationName}" ]
-        then
-            echo "cannot find executable file \`${browser}/bin/${applicationName}'"
-            exit 1
+          rm "$executablePath"
+        elif wrapperCmd=$(strings -dw "$executablePath" | sed -n '/^makeCWrapper/,/^$/ p'); [[ $wrapperCmd ]]; then
+          # If the executable is a binary wrapper, we need to update its target to
+          # point to $out, but we can't just edit the binary in-place because of length
+          # issues. So we extract the command used to create the wrapper and add the
+          # arguments to our wrapper.
+          parseMakeCWrapperCall() {
+            shift # makeCWrapper
+            oldExe=$1; shift
+            for arg do case $arg in
+              --inherit-argv0) oldWrapperArgs+=(--argv0 '$0');; # makeWrapper doesn't understand --inherit-argv0
+              *) oldWrapperArgs+=("$arg");;
+            esac done
+          }
+          eval "parseMakeCWrapperCall ''${wrapperCmd//"${browser}"/"$out"}"
+          rm "$executablePath"
+        else
+          if read -rn2 shebang < "$executablePath" && [[ $shebang == '#!' ]]; then
+            # Shell wrapper: patch in place to point to $out.
+            sed -i "s@${browser}@$out@g" "$executablePath"
+          fi
+          # Suffix the executable with -old, because -wrapped might already be used by the old wrapper.
+          oldExe="$executablePrefix/.${applicationName}"-old
+          mv "$executablePath" "$oldExe"
        fi

        makeWrapper "$oldExe" \
-          "$out/bin/${applicationName}${nameSuffix}" \
+          "''${executablePath}${nameSuffix}" \
            --prefix LD_LIBRARY_PATH ':' "$libs" \
            --suffix-each GTK_PATH ':' "$gtk_modules" \
            --prefix PATH ':' "${xdg-utils}/bin" \
@ -258,9 +260,8 @@ let
            --set MOZ_ALLOW_DOWNGRADE 1 \
            --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
            --suffix XDG_DATA_DIRS : '${gnome.adwaita-icon-theme}/share' \
-            ${lib.optionalString forceWayland ''
-              --set MOZ_ENABLE_WAYLAND "1" \
-            ''}
+            ${lib.optionalString forceWayland "--set MOZ_ENABLE_WAYLAND 1"} \
+            "''${oldWrapperArgs[@]}"
        #############################
        #                           #
        #   END EXTRA PREF CHANGES  #
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@ -79,6 +79,11 @@ stdenv.mkDerivation rec {
  in ''
    mkdir -p test/test-databases
    ln -s ${test-database} test/test-databases/database-v1.tar.xz
+  ''
+  # TODO: restore after resolved upstream
+  # https://www.mail-archive.com/notmuch@notmuchmail.org/msg52808.html
+  + ''
+    rm test/T355-smime.sh
  '';

  doCheck = !stdenv.hostPlatform.isDarwin && (lib.versionAtLeast gmime.version "3.0.3");
--- a/pkgs/applications/version-management/gitless/default.nix
+++ b/pkgs/applications/version-management/gitless/default.nix
@ -15,16 +15,15 @@ python3.pkgs.buildPythonApplication rec {
    hash = "sha256-xo5EWtP2aN8YzP8ro3bnxZwUGUp0PHD0g8hk+Y+gExE=";
  };

+  nativeBuildInputs = [ python3.pkgs.pythonRelaxDepsHook ];
+
  propagatedBuildInputs = with python3.pkgs; [
    sh
    pygit2
    clint
  ];

-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "pygit2==0.28.2" "pygit2>=0.28.2"
-  '';
+  pythonRelaxDeps = [ "pygit2" ];

  doCheck = false;

--- a/pkgs/build-support/setup-hooks/make-binary-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper.sh
@ -33,6 +33,7 @@ assertExecutable() {
 # To troubleshoot a binary wrapper after you compiled it,
 # use the `strings` command or open the binary file in a text editor.
 makeWrapper() {
+    local NIX_CFLAGS_COMPILE= NIX_CFLAGS_LINK=
    local original="$1"
    local wrapper="$2"
    shift 2
@ -44,6 +45,7 @@ makeWrapper() {
    makeDocumentedCWrapper "$original" "$@" | \
      @CC@ \
        -Wall -Werror -Wpedantic \
+        -Wno-overlength-strings \
        -Os \
        -x c \
        -o "$wrapper" -
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
@ -1,7 +1,7 @@
 { stdenv
 , lib
 , makeSetupHook
-, makeWrapper
+, makeBinaryWrapper
 , gobject-introspection
 , isGraphical ? true
 , gtk3
@ -34,7 +34,7 @@ makeSetupHook {
  ] ++ [

    # We use the wrapProgram function.
-    makeWrapper
+    makeBinaryWrapper
  ];
  substitutions = {
    passthru.tests = let
@ -59,8 +59,8 @@ makeSetupHook {
        tested = basic;
      in testLib.runTest "basic-contains-dconf" (
        testLib.skip stdenv.isDarwin ''
-          ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GIO_EXTRA_MODULES=" "${dconf.lib}/lib/gio/modules"}
-          ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GIO_EXTRA_MODULES=" "${dconf.lib}/lib/gio/modules"}
+          ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GIO_EXTRA_MODULES" "${dconf.lib}/lib/gio/modules"}
+          ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GIO_EXTRA_MODULES" "${dconf.lib}/lib/gio/modules"}
        ''
      );

@ -98,8 +98,8 @@ makeSetupHook {
      typelib-user-has-gi-typelib-path = let
        tested = typelib-user;
      in testLib.runTest "typelib-user-has-gi-typelib-path" ''
-        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GI_TYPELIB_PATH=" "${typelib-Mahjong}/lib/girepository-1.0"}
-        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GI_TYPELIB_PATH=" "${typelib-Mahjong}/lib/girepository-1.0"}
+        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GI_TYPELIB_PATH" "${typelib-Mahjong}/lib/girepository-1.0"}
+        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GI_TYPELIB_PATH" "${typelib-Mahjong}/lib/girepository-1.0"}
      '';

      # Simple derivation containing a gobject-introspection typelib in lib output.
@ -143,8 +143,8 @@ makeSetupHook {
      typelib-multiout-user-has-gi-typelib-path = let
        tested = typelib-multiout-user;
      in testLib.runTest "typelib-multiout-user-has-gi-typelib-path" ''
-        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GI_TYPELIB_PATH=" "${typelib-Bechamel.lib}/lib/girepository-1.0"}
-        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GI_TYPELIB_PATH=" "${typelib-Bechamel.lib}/lib/girepository-1.0"}
+        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GI_TYPELIB_PATH" "${typelib-Bechamel.lib}/lib/girepository-1.0"}
+        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GI_TYPELIB_PATH" "${typelib-Bechamel.lib}/lib/girepository-1.0"}
      '';

      # Simple derivation that contains a typelib as well as a program using it.
@ -169,8 +169,8 @@ makeSetupHook {
      typelib-self-user-has-gi-typelib-path = let
        tested = typelib-self-user;
      in testLib.runTest "typelib-self-user-has-gi-typelib-path" ''
-        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GI_TYPELIB_PATH=" "${typelib-self-user}/lib/girepository-1.0"}
-        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GI_TYPELIB_PATH=" "${typelib-self-user}/lib/girepository-1.0"}
+        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GI_TYPELIB_PATH" "${typelib-self-user}/lib/girepository-1.0"}
+        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GI_TYPELIB_PATH" "${typelib-self-user}/lib/girepository-1.0"}
      '';
    };
  };
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/tests/lib.nix
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/tests/lib.nix
@ -1,5 +1,4 @@
-{ runCommand
-}:
+{ lib, runCommand }:

 rec {
  runTest = name: body: runCommand name { } ''
@ -19,12 +18,14 @@ rec {
  '';

  expectSomeLineContainingYInFileXToMentionZ = file: filter: expected: ''
-    if ! cat "${file}" | grep "${filter}"; then
-        ${fail "The file “${file}” should include a line containing “${filter}”."}
+    file=${lib.escapeShellArg file} filter=${lib.escapeShellArg filter} expected=${lib.escapeShellArg expected}
+
+    if ! grep --text --quiet "$filter" "$file"; then
+        ${fail "The file “$file” should include a line containing “$filter”."}
    fi

-    if ! cat "${file}" | grep "${filter}" | grep ${expected}; then
-        ${fail "The file “${file}” should include a line containing “${filter}” that also contains “${expected}”."}
+    if ! grep --text "$filter" "$file" | grep --text --quiet "$expected"; then
+        ${fail "The file “$file” should include a line containing “$filter” that also contains “$expected”."}
    fi
  '';
 }
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@ -52,7 +52,13 @@ with lib;
 with builtins;

 let majorVersion = "11";
-    version = "${majorVersion}.2.0";
+    # The patch below for aarch64-darwin does not apply to 11.3.0 and an
+    # updated version is not available. Keep aarch64-darwin on 11.2.0 so the
+    # large body of packages which depend on gfortran are still functional
+    # until GCC 12 is the default.
+    # On x86_64-darwin, building libgcc suffers from some different issues with 11.3.0.
+    version = if stdenv.isDarwin then
+      "${majorVersion}.2.0" else "${majorVersion}.3.0";

    inherit (stdenv) buildPlatform hostPlatform targetPlatform;

@ -91,7 +97,9 @@ stdenv.mkDerivation ({

  src = fetchurl {
    url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = "sha256-0I7cU2tUw3KhAQ/2YZ3SdMDxYDqkkhK6IPeqLNo2+os=";
+    sha256 = if stdenv.isDarwin
+      then "sha256-0I7cU2tUw3KhAQ/2YZ3SdMDxYDqkkhK6IPeqLNo2+os="
+      else "sha256-tHzygYaR9bHiHfK7OMeV+sLPvWQO3i0KXhyJ4zijrDk=";
  };

  inherit patches;
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@ -124,6 +124,15 @@ in rec {
      };
    } ./python-recompile-bytecode-hook.sh ) {};

+  pythonRelaxDepsHook = callPackage ({ wheel }:
+    makeSetupHook {
+      name = "python-relax-deps-hook";
+      deps = [ wheel ];
+      substitutions = {
+        inherit pythonInterpreter;
+      };
+    } ./python-relax-deps-hook.sh) {};
+
  pythonRemoveBinBytecodeHook = callPackage ({ }:
    makeSetupHook {
      name = "python-remove-bin-bytecode-hook";
@ -161,8 +170,8 @@ in rec {
      deps = [ ensureNewerSourcesForZipFilesHook ];
      substitutions = {
        inherit pythonInterpreter;
-    };
-  } ./venv-shell-hook.sh) {});
+      };
+    } ./venv-shell-hook.sh) {});

  wheelUnpackHook = callPackage ({ wheel }:
    makeSetupHook {
--- a/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
@ -0,0 +1,83 @@
+# shellcheck shell=bash
+
+# Setup hook that modifies Python dependencies versions.
+#
+# Example usage in a derivation:
+#
+#   { …, pythonPackages, … }:
+#
+#   pythonPackages.buildPythonPackage {
+#     …
+#     nativeBuildInputs = [ pythonPackages.pythonRelaxDepsHook ];
+#
+#     # This will relax the dependency restrictions
+#     # e.g.: abc>1,<=2 -> abc
+#     pythonRelaxDeps = [ "abc" ];
+#     # This will relax all dependencies restrictions instead
+#     # pythonRelaxDeps = true;
+#     # This will remove the dependency
+#     # e.g.: cde>1,<=2 -> <nothing>
+#     pythonRemoveDeps = [ "cde" ];
+#     # This will remove all dependencies from the project
+#     # pythonRemoveDeps = true;
+#     …
+#   }
+
+_pythonRelaxDeps() {
+    local -r metadata_file="$1"
+
+    if [[ -z "${pythonRelaxDeps:-}" ]] || [[ "$pythonRelaxDeps" == 0 ]]; then
+        return
+    elif [[ "$pythonRelaxDeps" == 1 ]]; then
+        sed -i "$metadata_file" -r \
+            -e 's/(Requires-Dist: \S*) \(.*\)/\1/'
+    else
+        for dep in $pythonRelaxDeps; do
+            sed -i "$metadata_file" -r \
+                -e "s/(Requires-Dist: $dep) \(.*\)/\1/"
+        done
+    fi
+}
+
+_pythonRemoveDeps() {
+    local -r metadata_file="$1"
+
+    if [[ -z "${pythonRemoveDeps:-}" ]] || [[ "$pythonRemoveDeps" == 0 ]]; then
+        return
+    elif [[ "$pythonRemoveDeps" == 1 ]]; then
+        sed -i "$metadata_file" \
+            -e '/Requires-Dist:.*/d'
+    else
+        for dep in $pythonRemoveDeps; do
+            sed -i "$metadata_file" \
+                -e "/Requires-Dist: $dep/d"
+        done
+    fi
+
+}
+
+pythonRelaxDepsHook() {
+    pushd dist
+
+    local -r package="$pname-$version"
+    local -r unpack_dir="unpacked"
+    local -r metadata_file="$unpack_dir/$package/$package.dist-info/METADATA"
+    local -r wheel=$(echo "$package"*".whl")
+
+    @pythonInterpreter@ -m wheel unpack --dest "$unpack_dir" "$wheel"
+    rm -rf "$wheel"
+
+    _pythonRelaxDeps "$metadata_file"
+    _pythonRemoveDeps "$metadata_file"
+
+    if (( "${NIX_DEBUG:-0}" >= 1 )); then
+        echo "pythonRelaxDepsHook: resulting METADATA:"
+        cat "$unpack_dir/$package/$package.dist-info/METADATA"
+    fi
+
+    @pythonInterpreter@ -m wheel pack "$unpack_dir/$package"
+
+    popd
+}
+
+postBuild+=" pythonRelaxDepsHook"
--- a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
@ -12,10 +12,10 @@ setuptoolsBuildPhase() {
        args+="$setupPyGlobalFlags"
    fi
    if [ -n "$enableParallelBuilding" ]; then
-        setupPyBuildFlags+="--parallel $NIX_BUILD_CORES"
+        setupPyBuildFlags+=" --parallel $NIX_BUILD_CORES"
    fi
    if [ -n "$setupPyBuildFlags" ]; then
-        args+="build_ext $setupPyBuildFlags"
+        args+=" build_ext $setupPyBuildFlags"
    fi
    eval "@pythonInterpreter@ nix_run_setup $args bdist_wheel"

--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "libopenmpt";
-  version = "0.6.2";
+  version = "0.6.3";

  outputs = [ "out" "dev" "bin" ];

  src = fetchurl {
    url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "1dp645gg6d3pzjh82srq1d7qvyxi5h22k7yfdjiyzbyry8pxdh2h";
+    sha256 = "pBCv63zVlwsWuabOfazPSVsaXpEhqdZELeDAKP1Uols=";
  };

  enableParallelBuilding = true;
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@ -16,11 +16,11 @@

 stdenv.mkDerivation rec {
  pname = "expat";
-  version = "2.4.7";
+  version = "2.4.8";

  src = fetchurl {
    url = "https://github.com/libexpat/libexpat/releases/download/R_${lib.replaceStrings ["."] ["_"] version}/${pname}-${version}.tar.xz";
-    sha256 = "0zbss0dssn17mjmvk17qfi5cmvm0lcyzs62cwvqr219hhl864xcq";
+    sha256 = "sha256-95uPkEt0nj4NIK/q3s+CScVbLjLU67CJrjeN9HncryU=";
  };

  outputs = [ "out" "dev" ]; # TODO: fix referrers
--- a/pkgs/development/libraries/gmime/3.nix
+++ b/pkgs/development/libraries/gmime/3.nix
@ -2,12 +2,12 @@
 , vala }:

 stdenv.mkDerivation rec {
-  version = "3.2.7";
+  version = "3.2.11";
  pname = "gmime";

-  src = fetchurl {
-    url = "mirror://gnome/sources/gmime/3.2/${pname}-${version}.tar.xz";
-    sha256 = "0i3xfc84qn1z99i70q68kbnp9rmgqrnprqb418ba52s6g9j9dsia";
+  src = fetchurl { # https://github.com/jstedfast/gmime/releases
+    url = "https://github.com/jstedfast/gmime/releases/download/${version}/gmime-${version}.tar.xz";
+    sha256 = "5e023855a215b427645b400f5e55cf19cfd229f971317007e03e7bae72569bf8";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@ -30,7 +30,7 @@
 , gnome
 , gsettings-desktop-schemas
 , sassc
-, trackerSupport ? stdenv.isLinux
+, trackerSupport ? stdenv.isLinux && (stdenv.buildPlatform == stdenv.hostPlatform)
 , tracker
 , x11Support ? stdenv.isLinux
 , waylandSupport ? stdenv.isLinux
@ -39,12 +39,13 @@
 , wayland-protocols
 , xineramaSupport ? stdenv.isLinux
 , cupsSupport ? stdenv.isLinux
-, withGtkDoc ? stdenv.isLinux
+, withGtkDoc ? stdenv.isLinux && (stdenv.buildPlatform == stdenv.hostPlatform)
 , cups
 , AppKit
 , Cocoa
 , QuartzCore
 , broadwaySupport ? true
+, wayland-scanner
 }:

 let
@ -85,6 +86,9 @@ stdenv.mkDerivation rec {
    ./patches/3.0-darwin-x11.patch
  ];

+  depsBuildBuild = [
+    pkg-config
+  ];
  nativeBuildInputs = [
    gettext
    gobject-introspection
@ -94,12 +98,15 @@ stdenv.mkDerivation rec {
    pkg-config
    python3
    sassc
+    gdk-pixbuf
  ] ++ setupHooks ++ lib.optionals withGtkDoc [
    docbook_xml_dtd_43
    docbook-xsl-nons
    gtk-doc
    # For xmllint
    libxml2
+  ] ++ lib.optionals waylandSupport [
+    wayland-scanner
  ];

  buildInputs = [
@ -151,6 +158,7 @@ stdenv.mkDerivation rec {
    "-Dbroadway_backend=${lib.boolToString broadwaySupport}"
    "-Dx11_backend=${lib.boolToString x11Support}"
    "-Dquartz_backend=${lib.boolToString (stdenv.isDarwin && !x11Support)}"
+    "-Dintrospection=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}"
  ];

  doCheck = false; # needs X11
--- a/pkgs/development/libraries/icu/71.nix
+++ b/pkgs/development/libraries/icu/71.nix
@ -0,0 +1,4 @@
+import ./base.nix {
+  version = "71.1";
+  sha256 = "sha256-Z6fm5R9h+vEwa2k1Mz4TssSKvY2m0vRs5q3KJLHiHr8=";
+}
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@ -2,9 +2,13 @@
 # Image file formats
 , libjpeg, libtiff, giflib, libpng, libwebp
 # imlib2 can load images from ID3 tags.
-, libid3tag
+, libid3tag, librsvg, libheif
 , freetype , bzip2, pkg-config
 , x11Support ? true, xlibsWrapper ? null
+# Compilation error on Darwin with librsvg. For more information see:
+# https://github.com/NixOS/nixpkgs/pull/166452#issuecomment-1090725613
+, svgSupport ? !stdenv.isDarwin
+, heifSupport ? !stdenv.isDarwin
 }:

 let
@ -12,17 +16,19 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "imlib2";
-  version = "1.7.5";
+  version = "1.8.1";

  src = fetchurl {
    url = "mirror://sourceforge/enlightenment/${pname}-${version}.tar.xz";
-    hash = "sha256-RY2DAKp6bUzjU1GDi7pdn9+wiES9WxU8WTjs/kP/Ngo=";
+    hash = "sha256-Ui4ecOZbwO3f4gdhfRXJo5VmKnwJBmHaqiwpT7fZ/ao=";
  };

  buildInputs = [
    libjpeg libtiff giflib libpng libwebp
    bzip2 freetype libid3tag
-  ] ++ optional x11Support xlibsWrapper;
+  ] ++ optional x11Support xlibsWrapper
+    ++ optional heifSupport libheif
+    ++ optional svgSupport librsvg;

  nativeBuildInputs = [ pkg-config ];

@ -31,6 +37,8 @@ stdenv.mkDerivation rec {
  # Do not build amd64 assembly code on Darwin, because it fails to compile
  # with unknow directive errors
  configureFlags = optional stdenv.isDarwin "--enable-amd64=no"
+    ++ optional (!svgSupport) "--without-svg"
+    ++ optional (!heifSupport) "--without-heif"
    ++ optional (!x11Support) "--without-x";

  outputs = [ "bin" "out" "dev" ];
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@ -40,18 +40,21 @@ stdenv.mkDerivation rec {
  postPatch = ''
    substituteInPlace Makefile.am --replace '/bin/pwd' "$(type -P pwd)"

-    declare -a skip_tests=(
+    declare -a skip_test_paths=(
      # test won't work in nix sandbox
-      'test_write_disk_perms'
+      'libarchive/test/test_write_disk_perms.c'
      # can't be sure builder will have sparse-capable fs
-      'test_sparse_basic'
+      'libarchive/test/test_sparse_basic.c'
      # can't even be sure builder will have hardlink-capable fs
-      'test_write_disk_hardlink'
+      'libarchive/test/test_write_disk_hardlink.c'
+      # access-time-related tests flakey on some systems
+      'cpio/test/test_option_a.c'
+      'cpio/test/test_option_t.c'
    )

-    for test_name in "''${skip_tests[@]}" ; do
-      sed -i "/$test_name/d" Makefile.am
-      rm "libarchive/test/$test_name.c"
+    for test_path in "''${skip_test_paths[@]}" ; do
+      substituteInPlace Makefile.am --replace "$test_path" ""
+      rm "$test_path"
    done
  '';

--- a/pkgs/development/libraries/libnotify/default.nix
+++ b/pkgs/development/libraries/libnotify/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "libnotify";
-  version = "0.7.9";
+  version = "0.7.11";

  outputs = [ "out" "man" "dev" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0qa7cx6ra5hwqnxw95b9svgjg5q6ynm8y843iqjszxvds5z53h36";
+    sha256 = "3VaC7GgiAznhHFFZt+ASIEoxjdGzaDoJxILKQhqwc3U=";
  };

  mesonFlags = [
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@ -27,7 +27,7 @@

 stdenv.mkDerivation rec {
  pname = "librsvg";
-  version = "2.54.0";
+  version = "2.54.1";

  outputs = [ "out" "dev" "installedTests" ] ++ lib.optionals withIntrospection [
    "devdoc"
@ -35,7 +35,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "uvjrwUfxRrQmG7PQzQ+slEv427Sx8jR9IzQfl03MMIU=";
+    sha256 = "1VV++9zEFaQYDhEWt/c2y3EbJT0RDZX6huyDD3ACZiU=";
  };

  cargoVendorDir = "vendor";
--- a/pkgs/development/libraries/libseccomp/default.nix
+++ b/pkgs/development/libraries/libseccomp/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, getopt, util-linux, gperf, nix-update-script }:
+{ lib, stdenv, fetchurl, getopt, util-linuxMinimal, which, gperf, nix-update-script }:

 stdenv.mkDerivation rec {
  pname = "libseccomp";
@ -18,8 +18,8 @@ stdenv.mkDerivation rec {
    patchShebangs .
  '';

-  checkInputs = [ util-linux ];
-  doCheck = false; # dependency cycle
+  checkInputs = [ util-linuxMinimal which ];
+  doCheck = true;

  # Hack to ensure that patchelf --shrink-rpath get rids of a $TMPDIR reference.
  preFixup = "rm -rfv src";
--- a/pkgs/development/libraries/libsndfile/default.nix
+++ b/pkgs/development/libraries/libsndfile/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "libsndfile";
-  version = "1.0.31";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = version;
-    sha256 = "1alba3iv8i7i2jb5fd6q5s7j9bcj48sf28nfjd3qigz2n2is5jl2";
+    sha256 = "sha256-bhIXVSKuUnUzs5aaLDHt21RcnqekEpLU414sFtl2Lro=";
  };

  nativeBuildInputs = [ autoreconfHook autogen pkg-config python3 ];
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@ -21,7 +21,7 @@

 stdenv.mkDerivation rec {
  pname = "libxml2";
-  version = "2.9.13";
+  version = "2.9.14";

  outputs = [ "bin" "dev" "out" "man" "doc" ]
    ++ lib.optional pythonSupport "py"
@ -29,7 +29,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "J2EwYC0S/khOzANEfuXnWdBGVVj7yda9FE43RTBuvw4=";
+    sha256 = "1vnzk33wfms348lgz9pvkq9li7jm44pvm73lbr3w1khwgljlmmv0";
  };

  patches = [
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@ -178,8 +178,8 @@ in {


  openssl_1_1 = common rec {
-    version = "1.1.1n";
-    sha256 = "sha256-QNzrUaT2pSdb3g5r8g70uRv8Mu1XwFUuLo4VRjNysXo=";
+    version = "1.1.1o";
+    sha256 = "sha256-k4SisFcN2ANYhBRkZ3EV33he25QccSEfdQdtcv5rQ48=";
    patches = [
      ./1.1/nix-ssl-cert-file.patch

--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@ -2,7 +2,6 @@
 , lib
 , buildPackages
 , fetchFromGitLab
-, fetchpatch
 , removeReferencesTo
 , python3
 , meson
@ -68,7 +67,7 @@ let

  self = stdenv.mkDerivation rec {
    pname = "pipewire";
-    version = "0.3.49";
+    version = "0.3.51";

    outputs = [
      "out"
@ -86,7 +85,7 @@ let
      owner = "pipewire";
      repo = "pipewire";
      rev = version;
-      sha256 = "sha256-8heX/9BsPguIOzHOuqEQdt6MS3eS4HxR4A+FUZKNpdo=";
+      sha256 = "sha256-k5OdKgkQUaelvrGS4KtO0MtSJg6cF2Nf8RrsR8Kf+C8=";
    };

    patches = [
@ -102,12 +101,6 @@ let
      ./0090-pipewire-config-template-paths.patch
      # Place SPA data files in lib output to avoid dependency cycles
      ./0095-spa-data-dir.patch
-      # Fixes missing function declarations in pipewire headers
-      # Should be removed after the next release
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/a2e98e28c1e6fb58b273ef582398d8bee4d2b769.patch";
-        sha256 = "sha256-tqiiAW2fTEp23HT59XR2D/G08pVENJtpxUI7UVufj/A=";
-      })
    ];

    nativeBuildInputs = [
--- a/pkgs/development/libraries/protobuf/3.19.nix
+++ b/pkgs/development/libraries/protobuf/3.19.nix
@ -1,6 +1,6 @@
 { callPackage, ... }:

 callPackage ./generic-v3.nix {
-  version = "3.19.3";
-  sha256 = "sha256-nA6L064MuyP5Si4MCLk2yg8PDM7RWggFEGQyibputYQ=";
+  version = "3.19.4";
+  sha256 = "sha256-mxQ8XonVgctfaNAyd3vqQHMLHVnkjBa9EObk47vxH24=";
 }
--- a/pkgs/development/libraries/signond/default.nix
+++ b/pkgs/development/libraries/signond/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "signond";
-  version = "8.60";
+  version = "8.61";

  src = fetchFromGitLab {
    owner = "accounts-sso";
    repo = pname;
    rev = "VERSION_${version}";
-    sha256 = "pFpeJ13ut5EoP37W33WrYL2LzkX/k7ZKJcRpPO5l8i4=";
+    sha256 = "sha256-d7JZmGpjIvSN9l1nvKbBZjF0OR5L5frPTGHF/pNEqHE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@ -12,13 +12,13 @@ in

 stdenv.mkDerivation rec {
  pname = "sqlite${optionalString interactive "-interactive"}";
-  version = "3.38.2";
+  version = "3.38.3";

  # nixpkgs-update: no auto update
  # NB! Make sure to update ./tools.nix src (in the same directory).
  src = fetchurl {
    url = "https://sqlite.org/2022/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "sha256-55dKoUMLrWkKXp95pu5chJKtqCadxnWHWtD7dH18raQ=";
+    sha256 = "sha256-YfLdk6LjjDNGi3EllnwyGL+fTdg2Xe9gJeMU+QXclC4=";
  };

  outputs = [ "bin" "dev" "out" ];
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@ -4,12 +4,12 @@ let
  archiveVersion = import ./archive-version.nix lib;
  mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
    inherit pname;
-    version = "3.38.2";
+    version = "3.38.3";

    # nixpkgs-update: no auto update
    src = assert version == sqlite.version; fetchurl {
      url = "https://sqlite.org/2022/sqlite-src-${archiveVersion version}.zip";
-      sha256 = "sha256-x8DwcKM4yS6wiAWQXAXyVPpG0cTdo1SKAkdPb7VnMpo=";
+      sha256 = "sha256-oQTUk+CEAGvXT/H/esLrKzh8fAo7Y7pv6i+vtBGDE68=";
    };

    nativeBuildInputs = [ unzip ];
--- a/pkgs/development/libraries/webrtc-audio-processing/0.3.nix
+++ b/pkgs/development/libraries/webrtc-audio-processing/0.3.nix
@ -9,7 +9,10 @@ stdenv.mkDerivation rec {
    sha256 = "1gsx7k77blfy171b6g3m0k0s0072v6jcawhmx1kjs9w5zlwdkzd0";
  };

-  patches = [ ./enable-riscv.patch ];
+  patches = [
+    ./enable-riscv.patch
+    ./enable-powerpc.patch
+  ];

  buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ ApplicationServices ]);

--- a/pkgs/development/libraries/webrtc-audio-processing/enable-powerpc.patch
+++ b/pkgs/development/libraries/webrtc-audio-processing/enable-powerpc.patch
@ -0,0 +1,37 @@
+This patch was extracted from the Gentoo powerpc64le-qtwebengine
+patchset, referenced here:
+
+  https://gitweb.gentoo.org/repo/gentoo.git/tree/dev-qt/qtwebengine/qtwebengine-5.15.3_p20220406.ebuild
+
+and downloaded from here:
+
+  https://dev.gentoo.org/~asturm/distfiles/${PN}-5.15.3_p20220406-patchset.tar.xz
+
+From 4bbb4482e14ad27cf0bd5032b1b5d4abba29dc99 Mon Sep 17 00:00:00 2001
+From: Georgy Yakovlev <gyakovlev@gentoo.org>
+Date: Fri, 27 Nov 2020 13:05:45 -0800
+Subject: [PATCH] 5.15.2 ppc64le patchet
+
+diff --git a/webrtc/typedefs.h b/webrtc/typedefs.h
+index ce1f3e8..fd39a16 100644
+--- a/webrtc/typedefs.h
+++ b/webrtc/typedefs.h
+@@ -38,6 +38,18 @@
+ #define WEBRTC_ARCH_X86
+ #define WEBRTC_ARCH_32_BITS
+ #define WEBRTC_ARCH_LITTLE_ENDIAN
+#elif defined(__PPC__)
+#define WEBRTC_ARCH_PPC_FAMILY
+#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+#define WEBRTC_ARCH_LITTLE_ENDIAN
+#else
+#define WEBRTC_ARCH_BIG_ENDIAN
+#endif
+#if defined(__LP64__)
+#define WEBRTC_ARCH_64_BITS
+#else
+#define WEBRTC_ARCH_32_BITS
+#endif
+ #elif defined(__ARMEL__)
+ // TODO(ajm): We'd prefer to control platform defines here, but this is
+ // currently provided by the Android makefiles. Commented to avoid duplicate
--- a/pkgs/development/libraries/zimg/default.nix
+++ b/pkgs/development/libraries/zimg/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "zimg";
-  version = "3.0.3";
+  version = "3.0.4";

  src = fetchFromGitHub {
    owner  = "sekrit-twc";
    repo   = "zimg";
    rev    = "release-${version}";
-    sha256 = "0pwgf1mybpa3fs13p6jryzm32vfldyql9biwaypqdcimlnlmyk20";
+    sha256 = "1069x49l7kh1mqcq1h3f0m5j0h832jp5x230bh4c613ymgg5kn00";
  };

  nativeBuildInputs = [ autoreconfHook ];
--- a/pkgs/development/python-modules/curio/default.nix
+++ b/pkgs/development/python-modules/curio/default.nix
@ -26,9 +26,10 @@ buildPythonPackage rec {

  disabledTests = [
     "test_aside_basic" # times out
+     "test_write_timeout" # flaky, does not always time out
     "test_aside_cancel" # fails because modifies PYTHONPATH and cant find pytest
     "test_ssl_outgoing" # touches network
-   ] ++ lib.optionals (stdenv.isDarwin) [
+   ] ++ lib.optionals stdenv.isDarwin [
     "test_unix_echo" # socket bind error on hydra when built with other packages
     "test_unix_ssl_server" # socket bind error on hydra when built with other packages
   ];
--- a/pkgs/development/python-modules/flask-restful/default.nix
+++ b/pkgs/development/python-modules/flask-restful/default.nix
@ -1,23 +1,28 @@
 { lib
+, aniso8601
+, blinker
 , buildPythonPackage
 , fetchPypi
-, aniso8601
 , flask
-, pytz
-, six
-, blinker
 , mock
 , nose
 , pytestCheckHook
+, pythonOlder
+, pytz
+, six
 }:

 buildPythonPackage rec {
-  pname = "Flask-RESTful";
+  pname = "flask-restful";
  version = "0.3.9";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0gm5dz088v3d2k1dkcp9b3nnqpkk0fp2jly870hijj2xhc5nbv6c";
+    pname = "Flask-RESTful";
+    inherit version;
+    hash = "sha256-zOxlC4NdSBkhOMhTKa4Dc15s7VjpstnCFG1shMBvpT4=";
  };

  patches = [
@ -32,19 +37,24 @@ buildPythonPackage rec {
  ];

  checkInputs = [
-    pytestCheckHook
+    blinker
    mock
    nose
-    blinker
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "flask_restful"
  ];

  meta = with lib; {
+    description = "Framework for creating REST APIs";
    homepage = "https://flask-restful.readthedocs.io";
-    description = "Simple framework for creating REST APIs";
    longDescription = ''
      Flask-RESTful provides the building blocks for creating a great
      REST API.
    '';
    license = licenses.bsd3;
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/python-modules/limits/default.nix
+++ b/pkgs/development/python-modules/limits/default.nix
@ -1,21 +1,84 @@
-{ lib, fetchPypi, buildPythonPackage, six }:
+{ lib
+, buildPythonPackage
+, deprecated
+, fetchFromGitHub
+, hiro
+, packaging
+, pymemcache
+, pymongo
+, pytest-asyncio
+, pytest-lazy-fixture
+, pytestCheckHook
+, pythonOlder
+, redis
+, setuptools
+, typing-extensions
+}:

 buildPythonPackage rec {
  pname = "limits";
-  version = "2.4.0";
+  version = "2.6.1";
+  format = "setuptools";

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-jiK2PfJjECB6d7db1HRZnwpGE6fZFjZQ7TpCjpzHrjU=";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "alisaifee";
+    repo = pname;
+    rev = version;
+    # Upstream uses versioneer, which relies on git attributes substitution.
+    # This leads to non-reproducible archives on github. Remove the substituted
+    # file here, and recreate it later based on our version info.
+    extraPostFetch = ''
+      rm "$out/limits/_version.py"
+    '';
+    hash = "sha256-ja+YbRHCcZ5tFnoofdR44jbkkdDroVUdKeDOt6yE0LI=";
  };

-  propagatedBuildInputs = [ six ];
+  propagatedBuildInputs = [
+    deprecated
+    packaging
+    setuptools
+    typing-extensions
+  ];

-  doCheck = false; # ifilter
+  checkInputs = [
+    hiro
+    pymemcache
+    pymongo
+    pytest-asyncio
+    pytest-lazy-fixture
+    pytestCheckHook
+    redis
+  ];
+
+  postPatch = ''
+    substituteInPlace pytest.ini \
+      --replace "--cov=limits" "" \
+      --replace "-K" ""
+    # redis-py-cluster doesn't support redis > 4
+    substituteInPlace tests/conftest.py \
+      --replace "import rediscluster" ""
+
+    # Recreate _version.py, deleted at fetch time due to non-reproducibility.
+    echo 'def get_versions(): return {"version": "${version}"}' > limits/_version.py
+  '';
+
+  pythonImportsCheck = [
+    "limits"
+  ];
+
+  pytestFlagsArray = [
+    # All other tests require a running Docker instance
+    "tests/test_limits.py"
+    "tests/test_ratelimit_parser.py"
+    "tests/test_limit_granularities.py"
+  ];

  meta = with lib; {
    description = "Rate limiting utilities";
-    license = licenses.mit;
    homepage = "https://limits.readthedocs.org/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@ -17,7 +17,7 @@ let
 in

 buildPythonPackage rec {
-  version = "3.5.1";
+  version = "3.5.2";
  pname = "matplotlib";
  format = "setuptools";

@ -25,7 +25,7 @@ buildPythonPackage rec {

  src = fetchPypi {
    inherit pname version;
-    sha256 = "b2e9810e09c3a47b73ce9cab5a72243a1258f61e7900969097a817232246ce1c";
+    sha256 = "18h78s5ld1i6mz00w258hy29909nfr3ddq6ry9kq18agw468bks8";
  };

  XDG_RUNTIME_DIR = "/tmp";
--- a/pkgs/development/python-modules/pkgconfig/default.nix
+++ b/pkgs/development/python-modules/pkgconfig/default.nix
@ -1,8 +1,15 @@
-{ lib, buildPythonPackage, fetchPypi, pkg-config }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pkg-config
+, pytestCheckHook
+}:

 buildPythonPackage rec {
  pname = "pkgconfig";
  version = "1.5.5";
+  format = "pyproject";

  inherit (pkg-config)
    setupHooks
@ -10,22 +17,32 @@ buildPythonPackage rec {
    suffixSalt
    targetPrefix
    baseBinName
-  ;
+    ;

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "deb4163ef11f75b520d822d9505c1f462761b4309b1bb713d08689759ea8b899";
+  src = fetchFromGitHub {
+    owner = "matze";
+    repo = "pkgconfig";
+    rev = "v${version}";
+    sha256 = "sha256-uuLUGRNLCR3NS9g6OPCI+qG7tPWsLhI3OE5WmSI3vm8=";
  };

+  patches = [ ./executable.patch ];
+
+  postPatch = ''
+    rm pkgconfig/pkgconfig.py.orig
+    substituteInPlace pkgconfig/pkgconfig.py \
+      --replace 'PKG_CONFIG_EXE = "pkg-config"' 'PKG_CONFIG_EXE = "${pkg-config}/bin/${pkg-config.targetPrefix}pkg-config"'
+
+    # those pc files are missing and pkg-config validates that they exist
+    substituteInPlace data/fake-openssl.pc \
+      --replace "Requires: libssl libcrypto" ""
+  '';
+
+  nativeBuildInputs = [ poetry-core ];

  propagatedNativeBuildInputs = [ pkg-config ];

-  doCheck = false;
-
-  patches = [ ./executable.patch ];
-  postPatch = ''
-    substituteInPlace pkgconfig/pkgconfig.py --replace 'PKG_CONFIG_EXE = "pkg-config"' 'PKG_CONFIG_EXE = "${pkg-config}/bin/${pkg-config.targetPrefix}pkg-config"'
-  '';
+  checkInputs = [ pytestCheckHook ];

  pythonImportsCheck = [ "pkgconfig" ];

@ -33,5 +50,6 @@ buildPythonPackage rec {
    description = "Interface Python with pkg-config";
    homepage = "https://github.com/matze/pkgconfig";
    license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
  };
 }
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@ -2,6 +2,7 @@
 , buildPythonPackage
 , isPyPy
 , fetchPypi
+, fetchpatch
 , pythonOlder
 , curl
 , openssl
@ -20,6 +21,16 @@ buildPythonPackage rec {
    sha256 = "sha256-qGOtGP9Hj1VFkkBXiHza5CLhsnRuQWdGFfaHSY6luIo=";
  };

+  patches = [
+    # Pull upstream patch for curl-3.83:
+    #  https://github.com/pycurl/pycurl/pull/753
+    (fetchpatch {
+      name = "curl-3.83.patch";
+      url = "https://github.com/pycurl/pycurl/commit/d47c68b1364f8a1a45ab8c584c291d44b762f7b1.patch";
+      sha256 = "sha256-/lGq7O7ZyytzBAxWJPigcWdvypM7OHLBcp9ItmX7z1g=";
+    })
+  ];
+
  preConfigure = ''
    substituteInPlace setup.py --replace '--static-libs' '--libs'
    export PYCURL_SSL_LIBRARY=openssl
--- a/pkgs/development/python-modules/pyicu/default.nix
+++ b/pkgs/development/python-modules/pyicu/default.nix
@ -8,11 +8,11 @@

 buildPythonPackage rec {
  pname = "PyICU";
-  version = "2.8.1";
+  version = "2.9";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-8LlUmof4e6fEE/E2edE3Jx4LN/HzmwEJrOOCV9TRSNY=";
+    sha256 = "sha256-PCnWzmVUYVcReho0ejA+zfzxp1ke1nn8iM3vQQiEWHg=";
  };

  nativeBuildInputs = [ icu ]; # for icu-config, but should be replaced with pkg-config
--- a/pkgs/development/python-modules/rich/default.nix
+++ b/pkgs/development/python-modules/rich/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "rich";
-  version = "12.2.0";
+  version = "12.3.0";
  format = "pyproject";
  disabled = pythonOlder "3.6";

@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "Textualize";
    repo = pname;
    rev = "v${version}";
-    sha256 = "02zypmnc9sijlipki0riywh82piamd3hlrl5xbg2bxlldnlnwx1d";
+    sha256 = "sha256-/BPJcFjUldbTa/M3i9jGGU7apbrTcWbF+yrrFuLXcHY=";
  };

  nativeBuildInputs = [ poetry-core ];
--- a/pkgs/development/python-modules/setuptools-rust/default.nix
+++ b/pkgs/development/python-modules/setuptools-rust/default.nix
@ -12,12 +12,12 @@

 buildPythonPackage rec {
  pname = "setuptools-rust";
-  version = "1.2.0";
+  version = "1.3.0";
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-CkraR56Mfj2L18tW4aKazCsruYwjJQUbDNy1fX8Fbeg=";
+    sha256 = "sha256-lYxb9Ktkg9Wdq4iFOBIYccxQBjVKQvsPvVCs8Dyq0d4=";
  };

  nativeBuildInputs = [ setuptools-scm ];
--- a/pkgs/development/python-modules/testtools/default.nix
+++ b/pkgs/development/python-modules/testtools/default.nix
@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonRelaxDepsHook
 , pbr
 , python-mimeparse
 , extras
@ -20,15 +21,13 @@ buildPythonPackage rec {

  propagatedBuildInputs = [ pbr python-mimeparse extras ];
  buildInputs = [ traceback2 ];
+  nativeBuildInputs = [ pythonRelaxDepsHook ];

  # testscenarios has a circular dependency on testtools
  doCheck = false;
  checkInputs = [ testscenarios ];

-  # testtools 2.0.0 and up has a circular run-time dependency on futures
-  postPatch = ''
-    substituteInPlace requirements.txt --replace "fixtures>=1.3.0" ""
-  '';
+  pythonRemoveDeps = [ "fixtures" ];

  meta = {
    description = "A set of extensions to the Python standard library's unit testing framework";
--- a/pkgs/development/tools/misc/elfutils/default.nix
+++ b/pkgs/development/tools/misc/elfutils/default.nix
@ -85,6 +85,8 @@ stdenv.mkDerivation rec {
    homepage = "https://sourceware.org/elfutils/";
    description = "A set of utilities to handle ELF objects";
    platforms = platforms.linux;
+    # https://lists.fedorahosted.org/pipermail/elfutils-devel/2014-November/004223.html
+    broken = stdenv.hostPlatform.isStatic;
    # licenses are GPL2 or LGPL3+ for libraries, GPL3+ for bins,
    # but since this package isn't split that way, all three are listed.
    license = with licenses; [ gpl2Only lgpl3Plus gpl3Plus ];
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, perlPackages, gettext }:
+{ lib, stdenv, fetchurl, perlPackages, gettext, libintl }:

 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
@ -17,7 +17,11 @@ stdenv.mkDerivation rec {
  strictDeps = true;

  nativeBuildInputs = [ gettext perlPackages.perl perlPackages.LocaleGettext ];
-  buildInputs = [ perlPackages.LocaleGettext ];
+  buildInputs = [ perlPackages.LocaleGettext libintl ];
+
+  configureFlags = [
+    "--enable-nls"
+  ];

  doCheck = false;                                # target `check' is missing

--- a/pkgs/development/tools/pandoc/default.nix
+++ b/pkgs/development/tools/pandoc/default.nix
@ -13,9 +13,6 @@ in
      remove-references-to \
        -t ${haskellPackages.pandoc-types} \
        $out/bin/pandoc
-      remove-references-to \
-        -t ${haskellPackages.HTTP} \
-        $out/bin/pandoc
    '';
  }) static).overrideAttrs (drv: {
    # These libraries are still referenced, because they generate
@ -25,5 +22,5 @@ in
    # lead to a transitive runtime dependency on the whole GHC distribution.
    # This should ideally be fixed in haskellPackages (or even Cabal),
    # but a minimal pandoc is important enough to patch it manually.
-    disallowedReferences = [ haskellPackages.pandoc-types haskellPackages.HTTP ];
+    disallowedReferences = [ haskellPackages.pandoc-types ];
  })
--- a/pkgs/misc/ghostscript/default.nix
+++ b/pkgs/misc/ghostscript/default.nix
@ -1,6 +1,6 @@
 { config, stdenv, lib, fetchurl, pkg-config, zlib, expat, openssl, autoconf
 , libjpeg, libpng, libtiff, freetype, fontconfig, libpaper, jbig2dec
-, libiconv, ijs, lcms2, fetchpatch, callPackage, bash, buildPackages
+, libiconv, ijs, lcms2, callPackage, bash, buildPackages, openjpeg
 , cupsSupport ? config.ghostscript.cups or (!stdenv.isDarwin), cups
 , x11Support ? cupsSupport, xlibsWrapper # with CUPS, X11 only adds very little
 }:
@ -30,19 +30,14 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "ghostscript${lib.optionalString (x11Support) "-with-X"}";
-  version = "9.55.0";
+  version = "9.56.1";

  src = fetchurl {
    url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs9${lib.versions.minor version}${lib.versions.patch version}/ghostscript-${version}.tar.xz";
-    sha512 = "27g72152mlwlalg232jxdhaf3ykgmqwi2pccbkwfygql1h9iz40plfbwbs1n0fkvm4zwzg5r9cr8g7w2dxih4jldiidv7rflxdy1is2";
+    sha512 = "22ysgdprh960rxmxyk2fy2my47cdrhfhbrwar1955hvad54iw79l916drp92wh3qzbxw6z40i70wk00vz8bn2ryig7qgpc1q01m2npy";
  };

  patches = [
-    (fetchpatch {
-      name = "fix-non-vendored-lcms2-typo.patch";
-      url = "https://github.com/ArtifexSoftware/ghostpdl/commit/830afae5454dea3bff903869d82022306890a96c.patch";
-      sha256 = "1w9yspsgxyabvrw9ld6pv6pb7708c44ihjqvag7qqh9v1lhm48j0";
-    })
    ./urw-font-files.patch
    ./doc-no-ref.diff
  ];
@ -61,7 +56,7 @@ stdenv.mkDerivation rec {
  buildInputs = [
    zlib expat openssl
    libjpeg libpng libtiff freetype fontconfig libpaper jbig2dec
-    libiconv ijs lcms2 bash
+    libiconv ijs lcms2 bash openjpeg
  ]
  ++ lib.optional x11Support xlibsWrapper
  ++ lib.optional cupsSupport cups
@ -72,8 +67,7 @@ stdenv.mkDerivation rec {
    export CCAUX=$CC_FOR_BUILD
    ${lib.optionalString cupsSupport ''export CUPSCONFIG="${cups.dev}/bin/cups-config"''}

-    # requires in-tree (heavily patched) openjpeg
-    rm -rf jpeg libpng zlib jasper expat tiff lcms2mt jbig2dec freetype cups/libs ijs
+    rm -rf jpeg libpng zlib jasper expat tiff lcms2mt jbig2dec freetype cups/libs ijs openjpeg

    sed "s@if ( test -f \$(INCLUDE)[^ ]* )@if ( true )@; s@INCLUDE=/usr/include@INCLUDE=/no-such-path@" -i base/unix-aux.mak
    sed "s@^ZLIBDIR=.*@ZLIBDIR=${zlib.dev}/include@" -i configure.ac
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch
 , alsa-lib
 , dbus
 , ell
@ -49,6 +50,17 @@ in stdenv.mkDerivation rec {

  outputs = [ "out" "dev" ] ++ lib.optional doCheck "test";

+  patches = [
+    # https://github.com/bluez/bluez/commit/0905a06410d4a5189f0be81e25eb3c3e8a2199c5
+    # which fixes https://github.com/bluez/bluez/issues/329
+    # and is already merged upstream and not yet in a release.
+    (fetchpatch {
+      name = "StateDirectory_and_ConfigurationDirectory.patch";
+      url = "https://github.com/bluez/bluez/commit/0905a06410d4a5189f0be81e25eb3c3e8a2199c5.patch";
+      sha256 = "sha256-MI6yPTiDLHsSTjLvNqtWnuy2xUMYpSat1WhMbeoedSM=";
+    })
+  ];
+
  postPatch = ''
    substituteInPlace tools/hid2hci.rules \
      --replace /sbin/udevadm ${systemd}/bin/udevadm \
--- a/pkgs/os-specific/linux/kbd/default.nix
+++ b/pkgs/os-specific/linux/kbd/default.nix
@ -63,6 +63,7 @@ stdenv.mkDerivation rec {
  '';

  buildInputs = [ check pam ];
+  NIX_LDFLAGS = lib.optional stdenv.hostPlatform.isStatic "-laudit";
  nativeBuildInputs = [ autoreconfHook pkg-config flex ];

  passthru.tests = {
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@ -666,6 +666,18 @@ stdenv.mkDerivation {
    rm -rf $out/share/doc
  '';

+  # Avoid *.EFI binary stripping. At least on aarch64-linux strip
+  # removes too much from PE32+ files:
+  #   https://github.com/NixOS/nixpkgs/issues/169693
+  # The hack is to move EFI file out of lib/ before doStrip
+  # run and return it after doStrip run.
+  preFixup = lib.optionalString withEfi ''
+    mv $out/lib/systemd/boot/efi $out/dont-strip-me
+  '';
+  postFixup = lib.optionalString withEfi ''
+    mv $out/dont-strip-me $out/lib/systemd/boot/efi
+  '';
+
  passthru = {
    # The interface version prevents NixOS from switching to an
    # incompatible systemd at runtime.  (Switching across reboots is
@ -687,6 +699,8 @@ stdenv.mkDerivation {
    description = "A system and service manager for Linux";
    license = licenses.lgpl21Plus;
    platforms = platforms.linux;
+    # https://github.com/systemd/systemd/issues/20600#issuecomment-912338965
+    broken = stdenv.hostPlatform.isStatic;
    priority = 10;
    maintainers = with maintainers; [ flokli kloenk mic92 ];
  };
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, pkg-config, zlib, shadow, libcap_ng
 , ncursesSupport ? true
 , ncurses, pam
-, systemdSupport ? stdenv.isLinux
+, systemdSupport ? stdenv.isLinux && !stdenv.hostPlatform.isStatic
 , systemd
 , nlsSupport ? true
 }:
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@ -114,7 +114,9 @@ stdenv.mkDerivation rec {
  '';

  postInstall = lib.optionalString libOnly ''
-    rm -rf $out/{bin,share,etc,lib/{pulse-*,systemd}}
+    find $out/share -maxdepth 1 -mindepth 1 ! -name "vala" -prune -exec rm -r {} \;
+    find $out/share/vala -maxdepth 1 -mindepth 1 ! -name "vapi" -prune -exec rm -r {} \;
+    rm -r $out/{bin,etc,lib/pulse-*}
  ''
    + ''
    moveToOutput lib/cmake "$dev"
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@ -98,6 +98,7 @@ rec {

      doSign = localSystem.isAarch64 && last != null;
      doUpdateAutoTools = localSystem.isAarch64 && last != null;
+      inherit (last.pkgs) runCommandLocal;

      mkExtraBuildCommands = cc: ''
        rsrc="$out/resource-root"
@ -223,23 +224,15 @@ rec {
        '';
      };

-      pbzx = stdenv.mkDerivation {
-        name = "bootstrap-stage0-pbzx";
-        phases = [ "installPhase" ];
-        installPhase = ''
-          mkdir -p $out/bin
-          ln -s ${bootstrapTools}/bin/pbzx $out/bin
-        '';
-      };
+      pbzx = self.runCommandLocal "bootstrap-stage0-pbzx" { } ''
+        mkdir -p $out/bin
+        ln -s ${bootstrapTools}/bin/pbzx $out/bin
+      '';

-      cpio = stdenv.mkDerivation {
-        name = "bootstrap-stage0-cpio";
-        phases = [ "installPhase" ];
-        installPhase = ''
-          mkdir -p $out/bin
-          ln -s ${bootstrapFiles.cpio} $out/bin/cpio
-        '';
-      };
+      cpio = self.runCommandLocal "bootstrap-stage0-cpio" { } ''
+        mkdir -p $out/bin
+        ln -s ${bootstrapFiles.cpio} $out/bin/cpio
+      '';

      darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
        darwin-stubs = superDarwin.darwin-stubs.override { inherit (self) stdenvNoCC fetchurl; };
@ -253,43 +246,21 @@ rec {
          '';
        };

-        sigtool = stdenv.mkDerivation {
-          name = "bootstrap-stage0-sigtool";
-          phases = [ "installPhase" ];
-          installPhase = ''
-            mkdir -p $out/bin
-            ln -s ${bootstrapTools}/bin/sigtool $out/bin
+        sigtool = self.runCommandLocal "bootstrap-stage0-sigtool" { } ''
+           mkdir -p $out/bin
+           ln -s ${bootstrapTools}/bin/sigtool  $out/bin
+           ln -s ${bootstrapTools}/bin/codesign $out/bin
+        '';

-            # Rewrite nuked references
-            sed -e "s|[^( ]*\bsigtool\b|$out/bin/sigtool|g" \
-              ${bootstrapTools}/bin/codesign > $out/bin/codesign
-            chmod a+x $out/bin/codesign
-          '';
-          # on next bootstrap tools update, use the following:
-          # installPhase = ''
-          #   mkdir -p $out/bin
-          #   ln -s ${bootstrapTools}/bin/sigtool  $out/bin
-          #   ln -s ${bootstrapTools}/bin/codesign $out/bin
-          # '';
-        };
+        print-reexports = self.runCommandLocal "bootstrap-stage0-print-reexports" { } ''
+          mkdir -p $out/bin
+          ln -s ${bootstrapTools}/bin/print-reexports $out/bin
+        '';

-        print-reexports = stdenv.mkDerivation {
-          name = "bootstrap-stage0-print-reexports";
-          phases = [ "installPhase" ];
-          installPhase = ''
-            mkdir -p $out/bin
-            ln -s ${bootstrapTools}/bin/print-reexports $out/bin
-          '';
-        };
-
-        rewrite-tbd = stdenv.mkDerivation {
-          name = "bootstrap-stage0-rewrite-tbd";
-          phases = [ "installPhase" ];
-          installPhase = ''
-            mkdir -p $out/bin
-            ln -s ${bootstrapTools}/bin/rewrite-tbd $out/bin
-          '';
-        };
+        rewrite-tbd = self.runCommandLocal "bootstrap-stage0-rewrite-tbd" { } ''
+          mkdir -p $out/bin
+          ln -s ${bootstrapTools}/bin/rewrite-tbd $out/bin
+        '';

        binutils-unwrapped = { name = "bootstrap-stage0-binutils"; outPath = bootstrapTools; };

@ -359,7 +330,7 @@ rec {

        libcxx = stdenv.mkDerivation {
          name = "bootstrap-stage0-libcxx";
-          phases = [ "installPhase" "fixupPhase" ];
+          dontUnpack = true;
          installPhase = ''
            mkdir -p $out/lib $out/include
            ln -s ${bootstrapTools}/lib/libc++.dylib $out/lib/libc++.dylib
--- a/pkgs/test/make-binary-wrapper/default.nix
+++ b/pkgs/test/make-binary-wrapper/default.nix
@ -44,6 +44,7 @@ let
      "invalid-env"
      "prefix"
      "suffix"
+      "overlength-strings"
    ];
    f = name: lib.nameValuePair name (makeGoldenTest name);
  in builtins.listToAttrs (builtins.map f names);
--- a/pkgs/test/make-binary-wrapper/overlength-strings.c
+++ b/pkgs/test/make-binary-wrapper/overlength-strings.c
--- a/pkgs/test/make-binary-wrapper/overlength-strings.cmdline
+++ b/pkgs/test/make-binary-wrapper/overlength-strings.cmdline
--- a/pkgs/test/make-binary-wrapper/overlength-strings.env
+++ b/pkgs/test/make-binary-wrapper/overlength-strings.env
--- a/pkgs/tools/networking/curl/7.82.0-openssl-fix-CN-check.patch
+++ b/pkgs/tools/networking/curl/7.82.0-openssl-fix-CN-check.patch
@ -1,30 +0,0 @@
-From 911714d617c106ed5d553bf003e34ec94ab6a136 Mon Sep 17 00:00:00 2001
-From: Daniel Stenberg <daniel@haxx.se>
-Date: Tue, 8 Mar 2022 13:38:13 +0100
-Subject: [PATCH] openssl: fix CN check error code
-
-Due to a missing 'else' this returns error too easily.
-
-Regressed in: d15692ebb
-
-Reported-by: Kristoffer Gleditsch
-Fixes #8559
-Closes #8560
---
- lib/vtls/openssl.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
-index 0b79fc50a9c5..4618beeb3867 100644
--- a/lib/vtls/openssl.c
-+++ b/lib/vtls/openssl.c
-@@ -1817,7 +1817,8 @@ CURLcode Curl_ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
-               memcpy(peer_CN, ASN1_STRING_get0_data(tmp), peerlen);
-               peer_CN[peerlen] = '\0';
-             }
-            result = CURLE_OUT_OF_MEMORY;
-+            else
-+              result = CURLE_OUT_OF_MEMORY;
-           }
-         }
-         else /* not a UTF8 name */
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@ -54,19 +54,18 @@ assert zstdSupport -> zstd != null;

 stdenv.mkDerivation rec {
  pname = "curl";
-  version = "7.82.0";
+  version = "7.83.0";

  src = fetchurl {
    urls = [
      "https://curl.haxx.se/download/${pname}-${version}.tar.bz2"
      "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] pname}-${version}/${pname}-${version}.tar.bz2"
    ];
-    sha256 = "sha256-RtmgQAozQI/ZkncLBKRKdDSzA28ugImsKLV1c9WdNx8=";
+    sha256 = "sha256-JHx+x1IcQljmVjTlKScNIU/jKWmXHMy3KEXnqkaDH5Y=";
  };

  patches = [
    ./7.79.1-darwin-no-systemconfiguration.patch
-    ./7.82.0-openssl-fix-CN-check.patch
  ];

  outputs = [ "bin" "dev" "out" "man" "devdoc" ];
--- a/pkgs/tools/wayland/wlogout/default.nix
+++ b/pkgs/tools/wayland/wlogout/default.nix
@ -10,6 +10,11 @@
 , wayland
 , wayland-protocols
 , gtk-layer-shell
+# gtk-layer-shell fails to cross-compile due to a hard dependency
+# on gobject-introspection.
+# Disable it when cross-compiling since it's an optional dependency.
+# This disables transparency support.
+, withGtkLayerShell ? (stdenv.buildPlatform == stdenv.hostPlatform)
 }:

 stdenv.mkDerivation rec {
@ -23,12 +28,15 @@ stdenv.mkDerivation rec {
    sha256 = "cTscfx+erHVFHwwYpN7pADQWt5sq75sQSyXSP/H8kOs=";
  };

+  strictDeps = true;
+  depsBuildBuild = [ pkg-config ];
  nativeBuildInputs = [ pkg-config meson ninja scdoc ];
  buildInputs = [
    gtk3
    libxkbcommon
    wayland
    wayland-protocols
+  ] ++ lib.optionals withGtkLayerShell [
    gtk-layer-shell
  ];

--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -17911,8 +17911,13 @@ with pkgs;
  } // (lib.optionalAttrs (stdenv.hostPlatform.isi686 && stdenv.cc.isGNU) {
      stdenv = gcc6Stdenv; # with gcc-7: undefined reference to `__divmoddi4'
    }));
+  icu71 = callPackage ../development/libraries/icu/71.nix ({
+    nativeBuildRoot = buildPackages.icu71.override { buildRootOnly = true; };
+  } // (lib.optionalAttrs (stdenv.hostPlatform.isi686 && stdenv.cc.isGNU) {
+      stdenv = gcc6Stdenv; # with gcc-7: undefined reference to `__divmoddi4'
+    }));

-  icu = icu70;
+  icu = icu71;

  id3lib = callPackage ../development/libraries/id3lib { };

--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -120,6 +120,7 @@ in {
    pythonImportsCheckHook
    pythonNamespacesHook
    pythonRecompileBytecodeHook
+    pythonRelaxDepsHook
    pythonRemoveBinBytecodeHook
    pythonRemoveTestsDirHook
    setuptoolsBuildHook