Recover the complicated situation after my bad merge

I made a mistake merge. Reverting it in c778945806 undid the state on master, but now I realize it crippled the git merge mechanism. As the merge contained a mix of commits from `master..staging-next` and other commits from `staging-next..staging`, it got the `staging-next` branch into a state that was difficult to recover. I reconstructed the "desired" state of staging-next tree by: - checking out the last commit of the problematic range: 4effe769e2 - `git rebase -i --preserve-merges a8a018ddc0` - dropping the mistaken merge commit and its revert from that range (while keeping reapplication from 4effe769e2) - merging the last unaffected staging-next commit (803ca85c20) - fortunately no other commits have been pushed to staging-next yet - applying a diff on staging-next to get it into that state
2020-10-25 22:17:24 +01:00 · 2020-10-25 22:17:24 +01:00 · 89023c38fc
commit 89023c38fc
parent 4bd836b381
52 changed files with 667 additions and 1750 deletions
--- a/doc/stdenv/stdenv.xml
+++ b/doc/stdenv/stdenv.xml
@ -2070,7 +2070,7 @@ nativeBuildInputs = [ breakpointHook ];
       The <literal>installManPage</literal> function takes one or more paths to manpages to install. The manpages must have a section suffix, and may optionally be compressed (with <literal>.gz</literal> suffix). This function will place them into the correct directory.
      </para>
      <para>
-       The <literal>installShellCompletion</literal> function takes one or more paths to shell completion files. By default it will autodetect the shell type from the completion file extension, but you may also specify it by passing one of <literal>--bash</literal>, <literal>--fish</literal>, or <literal>--zsh</literal>. These flags apply to all paths listed after them (up until another shell flag is given). Each path may also have a custom installation name provided by providing a flag <literal>--name NAME</literal> before the path. If this flag is not provided, zsh completions will be renamed automatically such that <literal>foobar.zsh</literal> becomes <literal>_foobar</literal>.
+       The <literal>installShellCompletion</literal> function takes one or more paths to shell completion files. By default it will autodetect the shell type from the completion file extension, but you may also specify it by passing one of <literal>--bash</literal>, <literal>--fish</literal>, or <literal>--zsh</literal>. These flags apply to all paths listed after them (up until another shell flag is given). Each path may also have a custom installation name provided by providing a flag <literal>--name NAME</literal> before the path. If this flag is not provided, zsh completions will be renamed automatically such that <literal>foobar.zsh</literal> becomes <literal>_foobar</literal>. A root name may be provided for all paths using the flag <literal>--cmd NAME</literal>; this synthesizes the appropriate name depending on the shell (e.g. <literal>--cmd foo</literal> will synthesize the name <literal>foo.bash</literal> for bash and <literal>_foo</literal> for zsh). The path may also be a fifo or named fd (such as produced by <literal>&lt;(cmd)</literal>), in which case the shell and name must be provided.
 <programlisting>
 nativeBuildInputs = [ installShellFiles ];
 postInstall = ''
@ -2081,6 +2081,11 @@ postInstall = ''
  installShellCompletion --zsh --name _foobar share/completions.zsh
  # implicit behavior
  installShellCompletion share/completions/foobar.{bash,fish,zsh}
+  # using named fd
+  installShellCompletion --cmd foobar \
+    --bash &lt;($out/bin/foobar --bash-completion) \
+    --fish &lt;($out/bin/foobar --fish-completion) \
+    --zsh &lt;($out/bin/foobar --zsh-completion)
 '';
 </programlisting>
      </para>
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@ -22,7 +22,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;

 let
-  version = "2.28.0";
+  version = "2.29.0";
  svn = subversionClient.override { perlBindings = perlSupport; };

  gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@ -34,7 +34,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "17a311vzimqn1glc9d7x82rhb1mb81m5rr4g8xji8idaafid39fz";
+    sha256 = "KEMtmVJXxGJv4PsgkfWI327tmOlXFBnnLIO8Izcua4k=";
  };

  outputs = [ "out" ] ++ stdenv.lib.optional withManual "doc";
--- a/pkgs/build-support/install-shell-files/default.nix
+++ b/pkgs/build-support/install-shell-files/default.nix
@ -1,4 +1,12 @@
-{ makeSetupHook }:
+{ makeSetupHook, tests }:

 # See the header comment in ../setup-hooks/install-shell-files.sh for example usage.
-makeSetupHook { name = "install-shell-files"; } ../setup-hooks/install-shell-files.sh
+let
+  setupHook = makeSetupHook { name = "install-shell-files"; } ../setup-hooks/install-shell-files.sh;
+in
+
+setupHook.overrideAttrs (oldAttrs: {
+  passthru = (oldAttrs.passthru or {}) // {
+    tests = tests.install-shell-files;
+  };
+})
--- a/pkgs/build-support/setup-hooks/install-shell-files.sh
+++ b/pkgs/build-support/setup-hooks/install-shell-files.sh
@ -1,4 +1,4 @@
-#!/bin/bash
+# shellcheck shell=bash
 # Setup hook for the `installShellFiles` package.
 #
 # Example usage in a derivation:
@ -19,8 +19,8 @@
 # installManPage <path> [...<path>]
 #
 # Each argument is checked for its man section suffix and installed into the appropriate
-# share/man<n>/ directory. The function returns an error if any paths don't have the man section
-# suffix (with optional .gz compression).
+# share/man/man<n>/ directory. The function returns an error if any paths don't have the man
+# section suffix (with optional .gz compression).
 installManPage() {
    local path
    for path in "$@"; do
@ -49,7 +49,7 @@ installManPage() {
    done
 }

-# installShellCompletion [--bash|--fish|--zsh] ([--name <name>] <path>)...
+# installShellCompletion [--cmd <name>] ([--bash|--fish|--zsh] [--name <name>] <path>)...
 #
 # Each path is installed into the appropriate directory for shell completions for the given shell.
 # If one of `--bash`, `--fish`, or `--zsh` is given the path is assumed to belong to that shell.
@ -61,9 +61,20 @@ installManPage() {
 # If the shell completion needs to be renamed before installing the optional `--name <name>` flag
 # may be given. Any name provided with this flag only applies to the next path.
 #
+# If all shell completions need to be renamed before installing the optional `--cmd <name>` flag
+# may be given. This will synthesize a name for each file, unless overridden with an explicit
+# `--name` flag. For example, `--cmd foobar` will synthesize the name `_foobar` for zsh and
+# `foobar.bash` for bash.
+#
 # For zsh completions, if the `--name` flag is not given, the path will be automatically renamed
 # such that `foobar.zsh` becomes `_foobar`.
 #
+# A path may be a named fd, such as produced by the bash construct `<(cmd)`. When using a named fd,
+# the shell type flag must be provided, and either the `--name` or `--cmd` flag must be provided.
+# This might look something like:
+#
+#   installShellCompletion --zsh --name _foobar <($out/bin/foobar --zsh-completion)
+#
 # This command accepts multiple shell flags in conjunction with multiple paths if you wish to
 # install them all in one command:
 #
@ -76,9 +87,16 @@ installManPage() {
 #   installShellCompletion --fish --name foobar.fish share/completions.fish
 #   installShellCompletion --zsh --name _foobar share/completions.zsh
 #
+# Or to use shell newline escaping to split a single invocation across multiple lines:
+#
+#   installShellCompletion --cmd foobar \
+#     --bash <($out/bin/foobar --bash-completion) \
+#     --fish <($out/bin/foobar --fish-completion) \
+#     --zsh <($out/bin/foobar --zsh-completion)
+#
 # If any argument is `--` the remaining arguments will be treated as paths.
 installShellCompletion() {
-    local shell='' name='' retval=0 parseArgs=1 arg
+    local shell='' name='' cmdname='' retval=0 parseArgs=1 arg
    while { arg=$1; shift; }; do
        # Parse arguments
        if (( parseArgs )); then
@ -97,6 +115,17 @@ installShellCompletion() {
                # treat `--name=foo` the same as `--name foo`
                name=${arg#--name=}
                continue;;
+            --cmd)
+                cmdname=$1
+                shift || {
+                    echo 'installShellCompletion: error: --cmd flag expected an argument' >&2
+                    return 1
+                }
+                continue;;
+            --cmd=*)
+                # treat `--cmd=foo` the same as `--cmd foo`
+                cmdname=${arg#--cmd=}
+                continue;;
            --?*)
                echo "installShellCompletion: warning: unknown flag ${arg%%=*}" >&2
                retval=2
@ -110,19 +139,34 @@ installShellCompletion() {
        if (( "${NIX_DEBUG:-0}" >= 1 )); then
            echo "installShellCompletion: installing $arg${name:+ as $name}"
        fi
-        # if we get here, this is a path
-        # Identify shell
-        local basename
-        basename=$(stripHash "$arg")
+        # if we get here, this is a path or named pipe
+        # Identify shell and output name
        local curShell=$shell
+        local outName=''
+        if [[ -z "$arg" ]]; then
+            echo "installShellCompletion: error: empty path is not allowed" >&2
+            return 1
+        elif [[ -p "$arg" ]]; then
+            # this is a named fd or fifo
+            if [[ -z "$curShell" ]]; then
+                echo "installShellCompletion: error: named pipe requires one of --bash, --fish, or --zsh" >&2
+                return 1
+            elif [[ -z "$name" && -z "$cmdname" ]]; then
+                echo "installShellCompletion: error: named pipe requires one of --cmd or --name" >&2
+                return 1
+            fi
+        else
+            # this is a path
+            local argbase
+            argbase=$(stripHash "$arg")
            if [[ -z "$curShell" ]]; then
                # auto-detect the shell
-            case "$basename" in
+                case "$argbase" in
                ?*.bash) curShell=bash;;
                ?*.fish) curShell=fish;;
                ?*.zsh) curShell=zsh;;
                *)
-                if [[ "$basename" = _* && "$basename" != *.* ]]; then
+                    if [[ "$argbase" = _* && "$argbase" != *.* ]]; then
                        # probably zsh
                        echo "installShellCompletion: warning: assuming path \`$arg' is zsh; please specify with --zsh" >&2
                        curShell=zsh
@ -133,16 +177,29 @@ installShellCompletion() {
                    fi;;
                esac
            fi
+            outName=$argbase
+        fi
        # Identify output path
-        local outName sharePath
-        outName=${name:-$basename}
+        if [[ -n "$name" ]]; then
+            outName=$name
+        elif [[ -n "$cmdname" ]]; then
+            case "$curShell" in
+            bash|fish) outName=$cmdname.$curShell;;
+            zsh) outName=_$cmdname;;
+            *)
+                # Our list of shells is out of sync with the flags we accept or extensions we detect.
+                echo 'installShellCompletion: internal error' >&2
+                return 1;;
+            esac
+        fi
+        local sharePath
        case "$curShell" in
        bash) sharePath=bash-completion/completions;;
        fish) sharePath=fish/vendor_completions.d;;
        zsh)
            sharePath=zsh/site-functions
            # only apply automatic renaming if we didn't have a manual rename
-            if test -z "$name"; then
+            if [[ -z "$name" && -z "$cmdname" ]]; then
                # convert a name like `foo.zsh` into `_foo`
                outName=${outName%.zsh}
                outName=_${outName#_}
@ -153,8 +210,16 @@ installShellCompletion() {
            return 1;;
        esac
        # Install file
-        install -Dm644 -T "$arg" "${!outputBin:?}/share/$sharePath/$outName" || return
-        # Clear the name, it only applies to one path
+        local outDir="${!outputBin:?}/share/$sharePath"
+        local outPath="$outDir/$outName"
+        if [[ -p "$arg" ]]; then
+            # install handles named pipes on NixOS but not on macOS
+            mkdir -p "$outDir" \
+            && cat "$arg" > "$outPath"
+        else
+            install -Dm644 -T "$arg" "$outPath"
+        fi || return
+        # Clear the per-path flags
        name=
    done
    if [[ -n "$name" ]]; then
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@ -2,16 +2,16 @@

 stdenv.mkDerivation rec {
  pname = "tzdata";
-  version = "2019c";
+  version = "2020c";

  srcs =
    [ (fetchurl {
        url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-        sha256 = "0z7w1yv37cfk8yhix2cillam091vgp1j4g8fv84261q9mdnq1ivr";
+        sha256 = "1nab36g5ibs88wg2mzpzygi1wh5gh2al1qjvbk8sb90sbw8ar43q";
      })
      (fetchurl {
        url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-        sha256 = "1m3y2rnf1nggxxhxplab5zdd5whvar3ijyrv7lifvm82irkd7szn";
+        sha256 = "1r5zrk1k3jhhilkhrx82fd19rvysji8jk05gq5v0rndmyx07zacs";
      })
    ];

--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@ -287,7 +287,12 @@ postInstall() {
    done

    # Two identical man pages are shipped (moving and compressing is done later)
-    ln -sf gcc.1 "$out"/share/man/man1/g++.1
+    for i in "$out"/share/man/man1/*g++.1; do
+        if test -e "$i"; then
+            man_prefix=`echo "$i" | sed "s,.*/\(.*\)g++.1,\1,"`
+            ln -sf "$man_prefix"gcc.1 "$i"
+        fi
+    done
 }

 genericBuild
--- a/pkgs/development/compilers/purescript/psc-package/default.nix
+++ b/pkgs/development/compilers/purescript/psc-package/default.nix
@ -44,12 +44,10 @@ stdenv.mkDerivation rec {
  '' + ''
    chmod u-w $PSC_PACKAGE

-    $PSC_PACKAGE --bash-completion-script $PSC_PACKAGE > psc-package.bash
-    $PSC_PACKAGE --fish-completion-script $PSC_PACKAGE > psc-package.fish
-    $PSC_PACKAGE --zsh-completion-script $PSC_PACKAGE > _psc-package
-    installShellCompletion \
-      psc-package.{bash,fish} \
-      --zsh _psc-package
+    installShellCompletion --cmd psc-package \
+      --bash <($PSC_PACKAGE --bash-completion-script $PSC_PACKAGE) \
+      --fish <($PSC_PACKAGE --fish-completion-script $PSC_PACKAGE) \
+      --zsh <($PSC_PACKAGE --zsh-completion-script $PSC_PACKAGE)
  '';

  meta = with lib; {
--- a/pkgs/development/compilers/rust/1_47.nix
+++ b/pkgs/development/compilers/rust/1_47.nix
@ -19,24 +19,24 @@
 } @ args:

 import ./default.nix {
-  rustcVersion = "1.46.0";
-  rustcSha256 = "0a17jby2pd050s24cy4dfc0gzvgcl585v3vvyfilniyvjrqknsid";
+  rustcVersion = "1.47.0";
+  rustcSha256 = "sha256-MYXfBkxHR/LIubuMRGjt1Y/0rW0HiAyHmsGxc7do2B0=";

  # Note: the version MUST be one version prior to the version we're
  # building
-  bootstrapVersion = "1.45.2";
+  bootstrapVersion = "1.46.0";

  # fetch hashes by running `print-hashes.sh 1.45.2`
  bootstrapHashes = {
-    i686-unknown-linux-gnu = "5b2050dde23152750de89f7e59acaab6bf088d0beb5854c69c9a545fd254b936";
-    x86_64-unknown-linux-gnu = "860feed955726a4d96ffe40758a110053326b9ae11c9e1ee059e9c6222f25643";
-    arm-unknown-linux-gnueabihf = "ddb5f59bbdef84e0b7c83049461e003ed031dd881a4622365c3d475102535c60";
-    armv7-unknown-linux-gnueabihf = "7a556581f87602705f9c89b04cce621cfbba9050b6fbe478166e91d164567531";
-    aarch64-unknown-linux-gnu = "151fad66442d28a4e4786753d1afb559c4a3d359081c64769273a31c2f0f4d30";
-    x86_64-apple-darwin = "6e8067624ede10aa23081d62e0086c6f42f7228cc0d00fb5ff24d4dac65249d6";
+    i686-unknown-linux-gnu = "6ebd7e04dc18a36d08b9731cdb42d5caf8460e1eb41b75f3a8596c39f5e71206";
+    x86_64-unknown-linux-gnu = "e3b98bc3440fe92817881933f9564389eccb396f5f431f33d48b979fa2fbdcf5";
+    arm-unknown-linux-gnueabihf = "bb8af68565321f54608e918597083eb016ed0f9f4f3cc23f7cc5f467b934ce7f";
+    armv7-unknown-linux-gnueabihf = "7c0640879d7f2c38db60352e3c0f09e3fc6fa3bac6ca8f22cbccb1eb5e950121";
+    aarch64-unknown-linux-gnu = "f0c6d630f3dedb3db69d69ed9f833aa6b472363096f5164f1068c7001ca42aeb";
+    x86_64-apple-darwin = "82d61582a3772932432a99789c3b3bd4abe6baca339e355048ca9efb9ea5b4db";
  };

-  selectRustPackage = pkgs: pkgs.rust_1_46;
+  selectRustPackage = pkgs: pkgs.rust_1_47;

  rustcPatches = [
  ];
--- a/pkgs/development/compilers/rust/binary.nix
+++ b/pkgs/development/compilers/rust/binary.nix
@ -1,4 +1,4 @@
-{ stdenv, makeWrapper, bash, curl, darwin
+{ stdenv, makeWrapper, bash, curl, darwin, zlib
 , version
 , src
 , platform
@ -42,17 +42,23 @@ rec {
      ./install.sh --prefix=$out \
        --components=${installComponents}

-      ${optionalString (stdenv.isLinux && bootstrapping) ''
+      ${optionalString (stdenv.isLinux && bootstrapping) (''
        patchelf \
          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
          "$out/bin/rustc"
+        '' + optionalString (stdenv.lib.versionAtLeast version "1.46")
+        # rustc bootstrap needs libz starting from 1.46
+        ''
+          ln -s ${zlib}/lib/libz.so.1 $out/lib/libz.so.1
+          ln -s ${zlib}/lib/libz.so $out/lib/libz.so
+        '' + ''
        patchelf \
          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
          "$out/bin/rustdoc"
        patchelf \
          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
          "$out/bin/cargo"
-      ''}
+      '')}

      # Do NOT, I repeat, DO NOT use `wrapProgram` on $out/bin/rustc
      # (or similar) here. It causes strange effects where rustc loads
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "rubygems";
-  version = "3.1.2";
+  version = "3.1.3";

  src = fetchurl {
    url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    sha256 = "0h7ij4jpj8rgnpkl63cwh2lnav73pw5wpfqra3va7077lsyadlgd";
+    sha256 = "181wjclxnq5lrwnr53famy9pg8911hi9w2v0vy7dqgjqnc4iy1hp";
  };

  patches = [
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "enchant";
-  version = "2.2.11";
+  version = "2.2.12";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "opxXd8TkX8rCWVwVxJ1tKqQ0+l58mT3/P582e2X+Ryo=";
+    sha256 = "0zi20s62gax9rkhwj318kqrxa62pmks6dsdd6m9pzvhlwy5cb6vb";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@ -1,16 +1,18 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, lib }:

 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.

-stdenv.mkDerivation rec {
-  name = "expat-2.2.8";
+let
+  version = "2.2.10";
+in stdenv.mkDerivation rec {
+  name = "expat-${version}";

  src = fetchurl {
-    url = "https://github.com/libexpat/libexpat/releases/download/R_2_2_8/${name}.tar.xz";
-    sha256 = "16vpj5mk3lps3x7fr8cs03rffx3ir4jilyqw0frayn6q94daijk1";
+    url = "https://github.com/libexpat/libexpat/releases/download/R_${lib.replaceStrings ["."] ["_"] version}/${name}.tar.xz";
+    sha256 = "sha256-Xf5Tj4tbY/A+mO2sUg19mmpNIuSC5cltTQb8xUhcJfI=";
  };

  outputs = [ "out" "dev" ]; # TODO: fix referrers
--- a/pkgs/development/libraries/freetype/default.nix
+++ b/pkgs/development/libraries/freetype/default.nix
@ -14,7 +14,7 @@ let

 in stdenv.mkDerivation rec {
  pname = "freetype";
-  version = "2.10.2";
+  version = "2.10.4";

  meta = with stdenv.lib; {
    description = "A font rendering engine";
@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://savannah/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "12rd181yzz6952cyjqaa4253f5szam93cmhw18p33rnj4l8dchqm";
+    sha256 = "112pyy215chg7f7fmp2l9374chhhpihbh8wgpj5nj6avj3c59a46";
  };

  propagatedBuildInputs = [ zlib bzip2 libpng ]; # needed when linking against freetype
--- a/pkgs/development/libraries/gamin/abstract-socket-namespace.patch
+++ b/pkgs/development/libraries/gamin/abstract-socket-namespace.patch
@ -0,0 +1,73 @@
+From 737452159d521aef2041a2767f3ebf9f68f4b6a9 Mon Sep 17 00:00:00 2001
+From: Christian Kampka <christian@kampka.net>
+Date: Tue, 1 Sep 2020 13:54:35 +0200
+Subject: [PATCH] Pin abstract namespace sockets to host_os
+
+Running programs with AC_RUN_IFELSE fails when cross-compiling.
+Since abstract namespace sockets are linux feature, we can easily
+assume it is available for linux and not for darwin.
+---
+ configure.in | 47 ++++++-----------------------------------------
+ 1 file changed, 6 insertions(+), 41 deletions(-)
+
+diff --git a/configure.in b/configure.in
+index eb129db..0ed82ba 100644
+--- a/configure.in
+++ b/configure.in
+@@ -387,47 +387,12 @@ fi
+ 
+ #### Abstract sockets
+ 
+-AC_MSG_CHECKING(abstract socket namespace)
+-AC_LANG_PUSH(C)
+-AC_RUN_IFELSE([AC_LANG_PROGRAM(
+-[[
+-#include <sys/types.h>
+-#include <stdlib.h>
+-#include <string.h>
+-#include <stdio.h>
+-#include <sys/socket.h>
+-#include <sys/un.h>
+-#include <errno.h>
+-]],
+-[[
+-  int listen_fd;
+-  struct sockaddr_un addr;
+-  
+-  listen_fd = socket (PF_UNIX, SOCK_STREAM, 0);
+-  
+-  if (listen_fd < 0)
+-    {
+-      fprintf (stderr, "socket() failed: %s\n", strerror (errno));
+-      exit (1);
+-    }
+-
+-  memset (&addr, '\0', sizeof (addr));
+-  addr.sun_family = AF_UNIX;
+-  strcpy (addr.sun_path, "X/tmp/dbus-fake-socket-path-used-in-configure-test");
+-  addr.sun_path[0] = '\0'; /* this is what makes it abstract */
+-  
+-  if (bind (listen_fd, (struct sockaddr*) &addr, SUN_LEN (&addr)) < 0)
+-    {
+-       fprintf (stderr, "Abstract socket namespace bind() failed: %s\n", 
+-                strerror (errno));
+-       exit (1);
+-    }
+-  else 
+-    exit (0);
+-]])],
+-              [have_abstract_sockets=yes],
+-              [have_abstract_sockets=no])
+-AC_LANG_POP(C)
+AC_MSG_CHECKING([whether target os has abstract socket namespace])
+if test x$target_os = xlinux-gnu ; then
+    have_abstract_sockets=yes
+else
+    have_abstract_sockets=no
+fi	
+ AC_MSG_RESULT($have_abstract_sockets)
+ 
+ if test x$enable_abstract_sockets = xyes; then
+-- 
+2.25.4
+
--- a/pkgs/development/libraries/gamin/default.nix
+++ b/pkgs/development/libraries/gamin/default.nix
@ -1,6 +1,8 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, glib }:
+{ stdenv, fetchurl, fetchpatch, pkgconfig, glib, autoreconfHook }:

-stdenv.mkDerivation (rec {
+let
+  cross = stdenv.hostPlatform != stdenv.buildPlatform;
+in stdenv.mkDerivation (rec {
  name = "gamin-0.1.10";

  src = fetchurl {
@ -8,7 +10,7 @@ stdenv.mkDerivation (rec {
    sha256 = "18cr51y5qacvs2fc2p1bqv32rs8bzgs6l67zhasyl45yx055y218";
  };

-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];

  buildInputs = [ glib ];

@ -27,7 +29,7 @@ stdenv.mkDerivation (rec {
      name = "fix-pthread-mutex.patch";
      url = "https://git.alpinelinux.org/aports/plain/main/gamin/fix-pthread-mutex.patch?h=3.4-stable&id=a1a836b089573752c1b0da7d144c0948b04e8ea8";
      sha256 = "13igdbqsxb3sz0h417k6ifmq2n4siwqspj6slhc7fdl5wd1fxmdz";
-    });
+    }) ++ stdenv.lib.optional (cross) ./abstract-socket-namespace.patch ;


  meta = with stdenv.lib; {
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@ -11,7 +11,7 @@
 }:

 let
-  version = "2.7.1";
+  version = "2.7.2";
  inherit (stdenv.lib) optional optionals optionalString;
  mesonFeatureFlag = opt: b:
    "-D${opt}=${if b then "enabled" else "disabled"}";
@ -24,7 +24,7 @@ stdenv.mkDerivation {
    owner  = "harfbuzz";
    repo   = "harfbuzz";
    rev    = version;
-    sha256 = "172jmwp666xbs6yy1pc2495gnkz8xw11b8zkz3j19jxlvvp4mxcs";
+    sha256 = "0vfyxr3lvzp80j1347nrwpr1ndv265p15rj2q8rj31lb26nyz4dm";
  };

  postPatch = ''
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, meson, ninja
+{ stdenv, fetchFromGitLab, pkgconfig, meson, ninja
 , libevdev, mtdev, udev, libwacom
 , documentationSupport ? false, doxygen ? null, graphviz ? null # Documentation
 , eventGUISupport ? false, cairo ? null, glib ? null, gtk3 ? null # GUI event viewer support
@ -27,11 +27,14 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
  pname = "libinput";
-  version = "1.16.1";
+  version = "1.16.2";

-  src = fetchurl {
-    url = "https://www.freedesktop.org/software/libinput/${pname}-${version}.tar.xz";
-    sha256 = "e6fRru3RUWi7IdF+nmKKocJ5V5Y6Qjo/6jk4pQF1hTk=";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = pname;
+    repo = pname;
+    rev = version;
+    sha256 = "0qii6yh3dlhgv9z970cpzbz19ii8zjvq4k7pg75sy2gmia7smwd1";
  };

  outputs = [ "bin" "out" "dev" ];
@ -80,7 +83,7 @@ stdenv.mkDerivation rec {

  meta = {
    description = "Handles input devices in Wayland compositors and provides a generic X.Org input driver";
-    homepage    = "http://www.freedesktop.org/wiki/Software/libinput";
+    homepage    = "https://www.freedesktop.org/wiki/Software/libinput/";
    license     = licenses.mit;
    platforms   = platforms.unix;
    maintainers = with maintainers; [ codyopel ];
--- a/pkgs/development/libraries/libvpx/CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch
+++ b/pkgs/development/libraries/libvpx/CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch
@ -1,211 +0,0 @@
-Backports of
-
-From 46e17f0cb4a80b36755c84b8bf15731d3386c08f Mon Sep 17 00:00:00 2001
-From: kyslov <kyslov@google.com>
-Date: Fri, 4 Jan 2019 17:04:09 -0800
-Subject: [PATCH] Fix OOB memory access on fuzzed data
-
-From 0681cff1ad36b3ef8ec242f59b5a6c4234ccfb88 Mon Sep 17 00:00:00 2001
-From: James Zern <jzern@google.com>
-Date: Tue, 24 Jul 2018 21:36:50 -0700
-Subject: [PATCH] vp9: fix OOB read in decoder_peek_si_internal
-
-From f00890eecdf8365ea125ac16769a83aa6b68792d Mon Sep 17 00:00:00 2001
-From: James Zern <jzern@google.com>
-Date: Tue, 11 Dec 2018 18:06:20 -0800
-Subject: [PATCH] update libwebm to libwebm-1.0.0.27-352-g6ab9fcf
-
-From 34d54b04e98dd0bac32e9aab0fbda0bf501bc742 Mon Sep 17 00:00:00 2001
-From: James Zern <jzern@google.com>
-Date: Tue, 9 Apr 2019 18:37:44 -0700
-Subject: [PATCH] update libwebm to libwebm-1.0.0.27-358-gdbf1d10
-
-From 52add5896661d186dec284ed646a4b33b607d2c7 Mon Sep 17 00:00:00 2001
-From: Jerome Jiang <jianj@google.com>
-Date: Wed, 23 May 2018 15:43:00 -0700
-Subject: [PATCH] VP8: Fix use-after-free in postproc.
-
-to address CVE-2019-9232 CVE-2019-9325 CVE-2019-9371 CVE-2019-9433
-
--- libvpx-1.7.0.orig/test/decode_api_test.cc
-+++ libvpx-1.7.0/test/decode_api_test.cc
-@@ -138,8 +138,30 @@ TEST(DecodeAPI, Vp9InvalidDecode) {
-   EXPECT_EQ(VPX_CODEC_OK, vpx_codec_destroy(&dec));
- }
- 
-TEST(DecodeAPI, Vp9PeekSI) {
-+void TestPeekInfo(const uint8_t *const data, uint32_t data_sz,
-+                  uint32_t peek_size) {
-   const vpx_codec_iface_t *const codec = &vpx_codec_vp9_dx_algo;
-+  // Verify behavior of vpx_codec_decode. vpx_codec_decode doesn't even get
-+  // to decoder_peek_si_internal on frames of size < 8.
-+  if (data_sz >= 8) {
-+    vpx_codec_ctx_t dec;
-+    EXPECT_EQ(VPX_CODEC_OK, vpx_codec_dec_init(&dec, codec, NULL, 0));
-+    EXPECT_EQ((data_sz < peek_size) ? VPX_CODEC_UNSUP_BITSTREAM
-+                                    : VPX_CODEC_CORRUPT_FRAME,
-+              vpx_codec_decode(&dec, data, data_sz, NULL, 0));
-+    vpx_codec_iter_t iter = NULL;
-+    EXPECT_EQ(NULL, vpx_codec_get_frame(&dec, &iter));
-+    EXPECT_EQ(VPX_CODEC_OK, vpx_codec_destroy(&dec));
-+  }
-+
-+  // Verify behavior of vpx_codec_peek_stream_info.
-+  vpx_codec_stream_info_t si;
-+  si.sz = sizeof(si);
-+  EXPECT_EQ((data_sz < peek_size) ? VPX_CODEC_UNSUP_BITSTREAM : VPX_CODEC_OK,
-+            vpx_codec_peek_stream_info(codec, data, data_sz, &si));
-+}
-+
-+TEST(DecodeAPI, Vp9PeekStreamInfo) {
-   // The first 9 bytes are valid and the rest of the bytes are made up. Until
-   // size 10, this should return VPX_CODEC_UNSUP_BITSTREAM and after that it
-   // should return VPX_CODEC_CORRUPT_FRAME.
-@@ -150,24 +172,18 @@ TEST(DecodeAPI, Vp9PeekSI) {
-   };
- 
-   for (uint32_t data_sz = 1; data_sz <= 32; ++data_sz) {
-    // Verify behavior of vpx_codec_decode. vpx_codec_decode doesn't even get
-    // to decoder_peek_si_internal on frames of size < 8.
-    if (data_sz >= 8) {
-      vpx_codec_ctx_t dec;
-      EXPECT_EQ(VPX_CODEC_OK, vpx_codec_dec_init(&dec, codec, NULL, 0));
-      EXPECT_EQ(
-          (data_sz < 10) ? VPX_CODEC_UNSUP_BITSTREAM : VPX_CODEC_CORRUPT_FRAME,
-          vpx_codec_decode(&dec, data, data_sz, NULL, 0));
-      vpx_codec_iter_t iter = NULL;
-      EXPECT_EQ(NULL, vpx_codec_get_frame(&dec, &iter));
-      EXPECT_EQ(VPX_CODEC_OK, vpx_codec_destroy(&dec));
-    }
-
-    // Verify behavior of vpx_codec_peek_stream_info.
-    vpx_codec_stream_info_t si;
-    si.sz = sizeof(si);
-    EXPECT_EQ((data_sz < 10) ? VPX_CODEC_UNSUP_BITSTREAM : VPX_CODEC_OK,
-              vpx_codec_peek_stream_info(codec, data, data_sz, &si));
-+    TestPeekInfo(data, data_sz, 10);
-+  }
-+}
-+
-+TEST(DecodeAPI, Vp9PeekStreamInfoTruncated) {
-+  // This profile 1 header requires 10.25 bytes, ensure
-+  // vpx_codec_peek_stream_info doesn't over read.
-+  const uint8_t profile1_data[10] = { 0xa4, 0xe9, 0x30, 0x68, 0x53,
-+                                      0xe9, 0x30, 0x68, 0x53, 0x04 };
-+
-+  for (uint32_t data_sz = 1; data_sz <= 10; ++data_sz) {
-+    TestPeekInfo(profile1_data, data_sz, 11);
-   }
- }
- #endif  // CONFIG_VP9_DECODER
--- libvpx-1.7.0.orig/third_party/libwebm/mkvparser/mkvparser.cc
-+++ libvpx-1.7.0/third_party/libwebm/mkvparser/mkvparser.cc
-@@ -5307,8 +5307,8 @@ long VideoTrack::Parse(Segment* pSegment
- 
-   const long long stop = pos + s.size;
- 
-  Colour* colour = NULL;
-  Projection* projection = NULL;
-+  std::unique_ptr<Colour> colour_ptr;
-+  std::unique_ptr<Projection> projection_ptr;
- 
-   while (pos < stop) {
-     long long id, size;
-@@ -5357,11 +5357,19 @@ long VideoTrack::Parse(Segment* pSegment
-       if (rate <= 0)
-         return E_FILE_FORMAT_INVALID;
-     } else if (id == libwebm::kMkvColour) {
-      if (!Colour::Parse(pReader, pos, size, &colour))
-+      Colour* colour = NULL;
-+      if (!Colour::Parse(pReader, pos, size, &colour)) {
-         return E_FILE_FORMAT_INVALID;
-+      } else {
-+        colour_ptr.reset(colour);
-+      }
-     } else if (id == libwebm::kMkvProjection) {
-      if (!Projection::Parse(pReader, pos, size, &projection))
-+      Projection* projection = NULL;
-+      if (!Projection::Parse(pReader, pos, size, &projection)) {
-         return E_FILE_FORMAT_INVALID;
-+      } else {
-+        projection_ptr.reset(projection);
-+      }
-     }
- 
-     pos += size;  // consume payload
-@@ -5392,8 +5400,8 @@ long VideoTrack::Parse(Segment* pSegment
-   pTrack->m_display_unit = display_unit;
-   pTrack->m_stereo_mode = stereo_mode;
-   pTrack->m_rate = rate;
-  pTrack->m_colour = colour;
-  pTrack->m_projection = projection;
-+  pTrack->m_colour = colour_ptr.release();
-+  pTrack->m_projection = projection_ptr.release();
- 
-   pResult = pTrack;
-   return 0;  // success
--- libvpx-1.7.0.orig/vp8/common/postproc.c
-+++ libvpx-1.7.0/vp8/common/postproc.c
-@@ -65,7 +65,7 @@ void vp8_deblock(VP8_COMMON *cm, YV12_BU
-   double level = 6.0e-05 * q * q * q - .0067 * q * q + .306 * q + .0065;
-   int ppl = (int)(level + .5);
- 
-  const MODE_INFO *mode_info_context = cm->show_frame_mi;
-+  const MODE_INFO *mode_info_context = cm->mi;
-   int mbr, mbc;
- 
-   /* The pixel thresholds are adjusted according to if or not the macroblock
--- libvpx-1.7.0.orig/vp8/decoder/dboolhuff.h
-+++ libvpx-1.7.0/vp8/decoder/dboolhuff.h
-@@ -76,7 +76,7 @@ static int vp8dx_decode_bool(BOOL_DECODE
-   }
- 
-   {
-    register int shift = vp8_norm[range];
-+    const unsigned char shift = vp8_norm[(unsigned char)range];
-     range <<= shift;
-     value <<= shift;
-     count -= shift;
--- libvpx-1.7.0.orig/vp9/vp9_dx_iface.c
-+++ libvpx-1.7.0/vp9/vp9_dx_iface.c
-@@ -97,7 +97,7 @@ static vpx_codec_err_t decoder_peek_si_i
-     const uint8_t *data, unsigned int data_sz, vpx_codec_stream_info_t *si,
-     int *is_intra_only, vpx_decrypt_cb decrypt_cb, void *decrypt_state) {
-   int intra_only_flag = 0;
-  uint8_t clear_buffer[10];
-+  uint8_t clear_buffer[11];
- 
-   if (data + data_sz <= data) return VPX_CODEC_INVALID_PARAM;
- 
-@@ -158,6 +158,9 @@ static vpx_codec_err_t decoder_peek_si_i
-         if (profile > PROFILE_0) {
-           if (!parse_bitdepth_colorspace_sampling(profile, &rb))
-             return VPX_CODEC_UNSUP_BITSTREAM;
-+          // The colorspace info may cause vp9_read_frame_size() to need 11
-+          // bytes.
-+          if (data_sz < 11) return VPX_CODEC_UNSUP_BITSTREAM;
-         }
-         rb.bit_offset += REF_FRAMES;  // refresh_frame_flags
-         vp9_read_frame_size(&rb, (int *)&si->w, (int *)&si->h);
--- libvpx-1.7.0.orig/vpx_dsp/bitreader.h
-+++ libvpx-1.7.0/vpx_dsp/bitreader.h
-@@ -94,7 +94,7 @@ static INLINE int vpx_read(vpx_reader *r
-   }
- 
-   {
-    register int shift = vpx_norm[range];
-+    const unsigned char shift = vpx_norm[(unsigned char)range];
-     range <<= shift;
-     value <<= shift;
-     count -= shift;
--- libvpx-1.7.0.orig/vpx_dsp/bitreader_buffer.c
-+++ libvpx-1.7.0/vpx_dsp/bitreader_buffer.c
-@@ -23,7 +23,7 @@ int vpx_rb_read_bit(struct vpx_read_bit_
-     rb->bit_offset = off + 1;
-     return bit;
-   } else {
-    rb->error_handler(rb->error_handler_data);
-+    if (rb->error_handler != NULL) rb->error_handler(rb->error_handler_data);
-     return 0;
-   }
- }
--- a/pkgs/development/libraries/libvpx/default.nix
+++ b/pkgs/development/libraries/libvpx/default.nix
@ -56,20 +56,16 @@ assert isCygwin -> unitTestsSupport && webmIOSupport && libyuvSupport;

 stdenv.mkDerivation rec {
  pname = "libvpx";
-  version = "1.7.0";
+  version = "1.9.0";

  src = fetchFromGitHub {
    owner = "webmproject";
-    repo = "libvpx";
+    repo = pname;
    rev = "v${version}";
-    sha256 = "0vvh89hvp8qg9an9vcmwb7d9k3nixhxaz6zi65qdjnd0i56kkcz6";
+    sha256 = "16xv6ambc82g14h1y0q1vyy57wp6j9fbp0nk0wd5csnrw407rhry";
  };

-  patches = [
-    ./CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch
-  ];
-
-  postPatch = ''patchShebangs .'';
+  postPatch = "patchShebangs .";

  outputs = [ "bin" "dev" "out" ];
  setOutputFlags = false;
@ -135,6 +131,12 @@ stdenv.mkDerivation rec {
                    experimentalFpMbStatsSupport ||
                    experimentalEmulateHardwareSupport) "experimental")
  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    #"--extra-cflags="
+    #"--extra-cxxflags="
+    #"--prefix="
+    #"--libc="
+    #"--libdir="
+    "--enable-external-build"
    # libvpx darwin targets include darwin version (ie. ARCH-darwinXX-gcc, XX being the darwin version)
    # See all_platforms: https://github.com/webmproject/libvpx/blob/master/configure
    # Darwin versions: 10.4=8, 10.5=9, 10.6=10, 10.7=11, 10.8=12, 10.9=13, 10.10=14
@ -159,6 +161,10 @@ stdenv.mkDerivation rec {
  buildInputs = [ ]
    ++ optionals unitTestsSupport [ coreutils curl ];

+  NIX_LDFLAGS = [
+    "-lpthread" # fixes linker errors
+  ];
+
  enableParallelBuilding = true;

  postInstall = ''moveToOutput bin "$bin" '';
--- a/pkgs/development/libraries/libwebp/default.nix
+++ b/pkgs/development/libraries/libwebp/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl
+{ stdenv, fetchFromGitHub, autoreconfHook, libtool
 , threadingSupport ? true # multi-threading
 , openglSupport ? false, freeglut ? null, libGL ? null, libGLU ? null # OpenGL (required for vwebp)
 , pngSupport ? true, libpng ? null # PNG image format
@ -27,13 +27,17 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
  pname = "libwebp";
-  version = "1.0.3";
+  version = "1.1.0";

-  src = fetchurl {
-    url = "http://downloads.webmproject.org/releases/webp/${pname}-${version}.tar.gz";
-    sha256 = "0kxk4sic34bln3k09mml7crvrmhj97swdk7b1ahbp5w6bj30f2p2";
+  src = fetchFromGitHub {
+    owner  = "webmproject";
+    repo   = pname;
+    rev    = version;
+    sha256 = "1kl6qqa29ygqb2fpv140y59v539gdqx4vcf3mlaxhca2bks98qgm";
  };

+  prePatch = "patchShebangs .";
+
  configureFlags = [
    (mkFlag threadingSupport "threading")
    (mkFlag openglSupport "gl")
@ -50,6 +54,7 @@ stdenv.mkDerivation rec {
    (mkFlag libwebpdecoderSupport "libwebpdecoder")
  ];

+  nativeBuildInputs = [ autoreconfHook libtool ];
  buildInputs = [ ]
    ++ optionals openglSupport [ freeglut libGL libGLU ]
    ++ optional pngSupport libpng
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@ -8,7 +8,7 @@
 , galliumDrivers ? ["auto"]
 , driDrivers ? ["auto"]
 , vulkanDrivers ? ["auto"]
-, eglPlatforms ? [ "x11" "surfaceless" ] ++ lib.optionals stdenv.isLinux [ "wayland" "drm" ]
+, eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
 , OpenGL, Xplugin
 , withValgrind ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32, valgrind-light
 , enableGalliumNine ? stdenv.isLinux
@ -31,7 +31,7 @@ with stdenv.lib;
 let
  # Release calendar: https://www.mesa3d.org/release-calendar.html
  # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "20.1.9";
+  version = "20.2.1";
  branch  = versions.major version;
 in

@ -46,7 +46,7 @@ stdenv.mkDerivation {
      "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
      "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
    ];
-    sha256 = "10kk8a8k7f4ip8yaiqdyrx162nbw8pw4h3b4hs4ha8mpd43wlldj";
+    sha256 = "0ji4s1gwcvx3fbj9h0x5zbma6kw4b75vs0266zhc06r97yd6v96i";
  };

  prePatch = "patchShebangs .";
@ -58,7 +58,6 @@ stdenv.mkDerivation {
    ./missing-includes.patch # dev_t needs sys/stat.h, time_t needs time.h, etc.-- fixes build w/musl
    ./opencl-install-dir.patch
    ./disk_cache-include-dri-driver-path-in-cache-key.patch
-    ./link-radv-with-ld_args_build_id.patch
  ]
    ++ lib.optionals stdenv.hostPlatform.isMusl [
      # Fix `-Werror=int-conversion` pthread warnings on musl.
--- a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
+++ b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
@ -1,4 +1,4 @@
-From 46b10f2bc28fd79d561c8c49bbae3aee6a4cf0e6 Mon Sep 17 00:00:00 2001
+From 980164fd92f5c2302624cd046d30ff21e6e4ba8a Mon Sep 17 00:00:00 2001
 From: David McFarland <corngood@gmail.com>
 Date: Mon, 6 Aug 2018 15:52:11 -0300
 Subject: [PATCH] disk_cache: include dri driver path in cache key
@ -12,10 +12,10 @@ timestamps in /nix/store are zero.
 3 files changed, 15 insertions(+), 1 deletion(-)

 diff --git a/meson_options.txt b/meson_options.txt
-index 1a2dd8ebd12..2ac741af5a6 100644
+index 2d39d13b6ad..daf06480a60 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -348,6 +348,12 @@ option(
+@@ -368,6 +368,12 @@ option(
   value : true,
   description : 'Enable direct rendering in GLX and EGL for DRI',
 )
@ -26,13 +26,13 @@ index 1a2dd8ebd12..2ac741af5a6 100644
 +  description : 'Mesa cache key.'
 +)
 option(
-   'I-love-half-baked-turnips',
+   'prefer-iris',
   type : 'boolean',
 diff --git a/src/util/disk_cache.c b/src/util/disk_cache.c
-index d1f14736725..2ed328f292e 100644
+index a92d621927a..3bd65c6890c 100644
 --- a/src/util/disk_cache.c
 +++ b/src/util/disk_cache.c
-@@ -402,8 +402,10 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
+@@ -401,8 +401,10 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
 
    /* Create driver id keys */
    size_t id_size = strlen(driver_id) + 1;
@ -43,7 +43,7 @@ index d1f14736725..2ed328f292e 100644
    cache->driver_keys_blob_size += gpu_name_size;
 
    /* We sometimes store entire structs that contains a pointers in the cache,
-@@ -424,6 +426,7 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
+@@ -423,6 +425,7 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
    uint8_t *drv_key_blob = cache->driver_keys_blob;
    DRV_KEY_CPY(drv_key_blob, &cache_version, cv_size)
    DRV_KEY_CPY(drv_key_blob, driver_id, id_size)
@ -52,22 +52,23 @@ index d1f14736725..2ed328f292e 100644
    DRV_KEY_CPY(drv_key_blob, &ptr_size, ptr_size_size)
    DRV_KEY_CPY(drv_key_blob, &driver_flags, driver_flags_size)
 diff --git a/src/util/meson.build b/src/util/meson.build
-index 9da29cc7390..5f549bb1d99 100644
+index 0893f64793b..d46ce85a85f 100644
 --- a/src/util/meson.build
 +++ b/src/util/meson.build
-@@ -170,7 +170,12 @@ _libmesa_util = static_library(
-   include_directories : inc_common,
+@@ -179,7 +179,12 @@ _libmesa_util = static_library(
+   include_directories : [inc_include, inc_src, inc_mapi, inc_mesa, inc_gallium, inc_gallium_aux],
   dependencies : deps_for_libmesa_util,
   link_with: libmesa_format,
-  c_args : [c_msvc_compat_args, c_vis_args],
+-  c_args : [c_msvc_compat_args],
 +  c_args : [
-+    c_msvc_compat_args, c_vis_args,
+    c_msvc_compat_args,
 +    '-DDISK_CACHE_KEY="@0@"'.format(
 +      get_option('disk-cache-key')
 +    ),
 +  ],
+   gnu_symbol_visibility : 'hidden',
   build_by_default : false
 )
- 
 -- 
-2.25.1
+2.28.0
+
--- a/pkgs/development/libraries/mesa/link-radv-with-ld_args_build_id.patch
+++ b/pkgs/development/libraries/mesa/link-radv-with-ld_args_build_id.patch
@ -1,25 +0,0 @@
-From b49bcb6eece322b70fc2e8b0c8498f5a38ea7b82 Mon Sep 17 00:00:00 2001
-From: David McFarland <corngood@gmail.com>
-Date: Sun, 26 Jul 2020 17:29:49 -0300
-Subject: [PATCH] link radv with ld_args_build_id
-
-This is needed for radv_device_get_cache_uuid to work correctly.
---
- src/amd/vulkan/meson.build | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/amd/vulkan/meson.build b/src/amd/vulkan/meson.build
-index eec026e8f60..a07a0821938 100644
--- a/src/amd/vulkan/meson.build
-+++ b/src/amd/vulkan/meson.build
-@@ -183,7 +183,7 @@ libvulkan_radeon = shared_library(
-   ],
-   c_args : [c_vis_args, no_override_init_args, radv_flags],
-   cpp_args : [cpp_vis_args, radv_flags],
-  link_args : [ld_args_bsymbolic, ld_args_gc_sections, libvulkan_radeon_ld_args],
-+  link_args : [ld_args_build_id, ld_args_bsymbolic, ld_args_gc_sections, libvulkan_radeon_ld_args],
-   link_depends : [libvulkan_radeon_link_depends,],
-   install : true,
- )
--
-2.28.0
--- a/pkgs/development/libraries/mesa/missing-includes.patch
+++ b/pkgs/development/libraries/mesa/missing-includes.patch
@ -9,18 +9,6 @@
 #include "pipe/p_compiler.h"
 #include "pipe/p_state.h"
 
--- ./src/util/rand_xor.c.orig	2017-06-20 00:38:57.199474067 +0200
-+++ ./src/util/rand_xor.c	2017-06-20 00:40:31.351279557 +0200
-@@ -23,7 +23,9 @@
-  */
- 
- #if defined(__linux__)
-+#include <sys/types.h>
- #include <sys/file.h>
-+#include <sys/stat.h>
- #include <unistd.h>
- #include <fcntl.h>
- #else
 --- ./src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
 +++ ./src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
@@ -28,6 +28,8 @@
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@ -160,8 +160,8 @@ in {
  };

  openssl_1_1 = common {
-    version = "1.1.1g";
-    sha256 = "0ikdcc038i7jk8h7asq5xcn8b1xc2rrbc88yfm4hqbz3y5s4gc6x";
+    version = "1.1.1h";
+    sha256 = "1ncmcnh5bmxkwrvm0m1q4kdcjjfpwvlyjspjhibkxc6p9dvsi72w";
    patches = [
      ./1.1/nix-ssl-cert-file.patch

--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@ -36,6 +36,13 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

+  # Tests run in fakeroot for non-root users
+  preCheck = ''
+    if [ "$(id -u)" != "0" ]; then
+      export FAKED_MODE=1
+    fi
+  '';
+
  doCheck = !stdenv.isDarwin;

  installFlags = [
--- a/pkgs/development/libraries/zeromq/4.x.nix
+++ b/pkgs/development/libraries/zeromq/4.x.nix
@ -1,17 +1,19 @@
-{ stdenv, fetchFromGitHub, cmake, asciidoc, enableDrafts ? false }:
+{ stdenv, fetchFromGitHub, cmake, asciidoc, pkg-config, libsodium
+, enableDrafts ? false }:

 stdenv.mkDerivation rec {
  pname = "zeromq";
-  version = "4.3.2";
+  version = "4.3.3";

  src = fetchFromGitHub {
    owner = "zeromq";
    repo = "libzmq";
    rev = "v${version}";
-    sha256 = "1q37z05i76ili31j6jlw8988iy6vxadlmd306f99phxfdpqa6bn9";
+    sha256 = "155kb0ih0xj4jvd39bq8d04bgvhy9143r3632ks1m04455z4qdzd";
  };

-  nativeBuildInputs = [ cmake asciidoc ];
+  nativeBuildInputs = [ cmake asciidoc pkg-config ];
+  buildInputs = [ libsodium ];

  enableParallelBuilding = true;

--- a/pkgs/development/python-modules/arrow/default.nix
+++ b/pkgs/development/python-modules/arrow/default.nix
@ -6,11 +6,11 @@

 buildPythonPackage rec {
  pname = "arrow";
-  version = "0.15.8";
+  version = "0.17.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "edc31dc051db12c95da9bac0271cd1027b8e36912daf6d4580af53b23e62721a";
+    sha256 = "ff08d10cda1d36c68657d6ad20d74fbea493d980f8b2d45344e00d6ed2bf6ed4";
  };

  propagatedBuildInputs = [ python-dateutil ]
--- a/pkgs/development/python-modules/pycairo/default.nix
+++ b/pkgs/development/python-modules/pycairo/default.nix
@ -1,4 +1,13 @@
-{ lib, fetchFromGitHub, meson, ninja, buildPythonPackage, pytest, pkgconfig, cairo, xlibsWrapper, isPy3k }:
+{ lib
+, fetchFromGitHub
+, meson
+, ninja
+, buildPythonPackage
+, pytestCheckHook
+, pkg-config
+, cairo
+, isPy3k
+}:

 buildPythonPackage rec {
  pname = "pycairo";
@ -16,22 +25,25 @@ buildPythonPackage rec {
  nativeBuildInputs = [
    meson
    ninja
-    pkgconfig
+    pkg-config
  ];

  buildInputs = [
    cairo
-    xlibsWrapper
  ];

-  checkInputs = [ pytest ];
+  checkInputs = [
+    pytestCheckHook
+  ];

-  mesonFlags = [ "-Dpython=${if isPy3k then "python3" else "python"}" ];
+  mesonFlags = [
+    "-Dpython=${if isPy3k then "python3" else "python"}"
+  ];

  meta = with lib; {
    description = "Python 2/3 bindings for cairo";
    homepage = "https://pycairo.readthedocs.io/";
-    license = with licenses; [ lgpl2 mpl11 ];
+    license = with licenses; [ lgpl21Only mpl11 ];
    platforms = lib.platforms.linux ++ lib.platforms.darwin;
  };
 }
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@ -5,6 +5,7 @@
 , ps
 , isBootstrap ? false
 , useSharedLibraries ? (!isBootstrap && !stdenv.isCygwin)
+, useOpenSSL ? !isBootstrap, openssl
 , useNcurses ? false, ncurses
 , useQt4 ? false, qt4
 , withQt5 ? false, qtbase
@ -44,15 +45,17 @@ stdenv.mkDerivation rec {

  setupHook = ./setup-hook.sh;

-  buildInputs =
-    [ setupHook pkgconfig ]
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  nativeBuildInputs = [ setupHook pkgconfig ];
+
+  buildInputs = []
    ++ lib.optionals useSharedLibraries [ bzip2 curl expat libarchive xz zlib libuv rhash ]
+    ++ lib.optional useOpenSSL openssl
    ++ lib.optional useNcurses ncurses
    ++ lib.optional useQt4 qt4
    ++ lib.optional withQt5 qtbase;

-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-
  propagatedBuildInputs = lib.optional stdenv.isDarwin ps;

  preConfigure = ''
@ -91,13 +94,15 @@ stdenv.mkDerivation rec {
    "-DCMAKE_AR=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ar"
    "-DCMAKE_RANLIB=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ranlib"
    "-DCMAKE_STRIP=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}strip"
-  ]
+
+    "-DCMAKE_USE_OPENSSL=${if useOpenSSL then "ON" else "OFF"}"
    # Avoid depending on frameworks.
-    ++ lib.optional (!useNcurses) "-DBUILD_CursesDialog=OFF";
+    "-DBUILD_CursesDialog=${if useNcurses then "ON" else "OFF"}"
+  ];

  # make install attempts to use the just-built cmake
  preInstall = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) ''
-    sed -i 's|bin/cmake|${buildPackages.cmake}/bin/cmake|g' Makefile
+    sed -i 's|bin/cmake|${buildPackages.cmakeMinimal}/bin/cmake|g' Makefile
  '';

  dontUseCmakeConfigure = true;
--- a/pkgs/development/tools/build-managers/meson/boost-Do-not-add-system-paths-on-nix.patch
+++ b/pkgs/development/tools/build-managers/meson/boost-Do-not-add-system-paths-on-nix.patch
@ -0,0 +1,40 @@
+From 536108b10271f2f42d41c7d9ddb4ce2ea1851f4f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
+Date: Sat, 17 Oct 2020 19:27:08 +0200
+Subject: [PATCH] boost: Do not add system paths on nix
+
+---
+ mesonbuild/dependencies/boost.py | 17 +----------------
+ 1 file changed, 1 insertion(+), 16 deletions(-)
+
+diff --git a/mesonbuild/dependencies/boost.py b/mesonbuild/dependencies/boost.py
+index 907c0c275..ecaf11b18 100644
+--- a/mesonbuild/dependencies/boost.py
+++ b/mesonbuild/dependencies/boost.py
+@@ -643,22 +643,7 @@ class BoostDependency(ExternalDependency):
+             roots += [x for x in candidates if x.name.lower().startswith('boost') and x.is_dir()]
+         else:
+             tmp = []  # type: T.List[Path]
+-
+-            # Homebrew
+-            brew_boost = Path('/usr/local/Cellar/boost')
+-            if brew_boost.is_dir():
+-                tmp += [x for x in brew_boost.iterdir()]
+-
+-            # Add some default system paths
+-            tmp += [Path('/opt/local')]
+-            tmp += [Path('/usr/local/opt/boost')]
+-            tmp += [Path('/usr/local')]
+-            tmp += [Path('/usr')]
+-
+-            # Cleanup paths
+-            tmp = [x for x in tmp if x.is_dir()]
+-            tmp = [x.resolve() for x in tmp]
+-            roots += tmp
+            # Do not add any non-explicit paths on nix
+ 
+         return roots
+ 
+-- 
+2.25.4
+
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@ -52,6 +52,11 @@ python3.pkgs.buildPythonApplication rec {
    # cut-in-half-by-\0 store path references.
    # Let’s just clear the whole rpath and hope for the best.
    ./clear-old-rpath.patch
+
+    # Patch out default boost search paths to avoid impure builds on
+    # unsandboxed non-NixOS builds, see:
+    # https://github.com/NixOS/nixpkgs/issues/86131#issuecomment-711051774
+    ./boost-Do-not-add-system-paths-on-nix.patch
  ];

  setupHook = ./setup-hook.sh;
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@ -14,7 +14,7 @@

 let
  apparmor-series = "2.13";
-  apparmor-patchver = "4";
+  apparmor-patchver = "5";
  apparmor-version = apparmor-series + "." + apparmor-patchver;

  apparmor-meta = component: with stdenv.lib; {
@ -27,19 +27,10 @@ let

  apparmor-sources = fetchurl {
    url = "https://launchpad.net/apparmor/${apparmor-series}/${apparmor-version}/+download/apparmor-${apparmor-version}.tar.gz";
-    sha256 = "03nislxccnbxld89giak2s8xa4mdbwscfxbdwhmw5qpvgz08dgwh";
-  };
-
-  # See <https://gitlab.com/apparmor/apparmor/-/issues/74> This and the
-  # accompanying application in prePatchCommon should be removed in 2.13.5
-  gnumake43Patch = fetchpatch {
-    url = "https://gitlab.com/apparmor/apparmor/-/merge_requests/465.patch";
-    name = "2-23-fix-build-with-make-4.3.patch";
-    sha256 = "0xw028iqp69j9mxv0kbwraplgkj5i5djdlgf0anpkc5cdbsf96r9";
+    sha256 = "05x7r99k00r97v1cq2f711lv6yqzhbl8zp1i1c7kxra4v0a2lzk3";
  };

  prePatchCommon = ''
-    patch -p1 < ${gnumake43Patch}
    chmod a+x ./common/list_capabilities.sh ./common/list_af_names.sh
    patchShebangs ./common/list_capabilities.sh ./common/list_af_names.sh
    substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${buildPackages.perl}/bin/pod2man"
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@ -5,19 +5,19 @@

 stdenv.mkDerivation rec {
  pname = "iproute2";
-  version = "5.8.0";
+  version = "5.9.0";

  src = fetchurl {
    url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0vk4vickrpahdhl3zazr2qn2bf99v5549ncirjpwiy4h0a4izkfg";
+    sha256 = "1kys6dmhrl43iaq95n5sh02p39d7bq8i5y672qrzgwnwpjaaqpd2";
  };

  preConfigure = ''
    # Don't try to create /var/lib/arpd:
    sed -e '/ARPDDIR/d' -i Makefile
-    # TODO: Drop temporary version fix for 5.8 (53159d81) once 5.9 is out:
+    # TODO: Drop temporary version fix for 5.9 once 5.10 is out:
    substituteInPlace include/version.h \
-      --replace "v5.7.0-77-gb687d1067169" "5.8.0"
+      --replace "5.8.0" "${version}"
  '';

  outputs = [ "out" "dev" ];
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "libcap";
-  version = "2.27";
+  version = "2.44";

  src = fetchurl {
    url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${pname}-${version}.tar.xz";
-    sha256 = "0sj8kidl7qgf2qwxcbw1vadnlb30y4zvjzxswsmfdghq04npkhfs";
+    sha256 = "1qf80lifygbnxwvqjf8jz5j24n6fqqx4ixnkbf76xs2vrmcq664j";
  };

  outputs = [ "out" "dev" "lib" "man" "doc" "pam" ];
@ -54,6 +54,7 @@ stdenv.mkDerivation rec {

  meta = {
    description = "Library for working with POSIX capabilities";
+    homepage = "https://sites.google.com/site/fullycapable";
    platforms = stdenv.lib.platforms.linux;
    license = stdenv.lib.licenses.bsd3;
  };
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@ -1,27 +1,61 @@
-{ stdenv, lib, fetchFromGitHub, pkgconfig, intltool, gperf, libcap
-, curl, kmod, gnupg, gnutar, xz, pam, acl, libuuid, m4, e2fsprogs, utillinux, libffi
-, glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libidn2, libapparmor
-, audit, lz4, bzip2, pcre2
-, linuxHeaders ? stdenv.cc.libc.linuxHeaders
-, iptables, gnu-efi, bashInteractive
-, gettext, docbook_xsl, docbook_xml_dtd_42, docbook_xml_dtd_45
-, ninja, meson, python3Packages, glibcLocales
-, patchelf
-, substituteAll
-, getent
-, cryptsetup, lvm2
+{ stdenv, lib, fetchFromGitHub
 , buildPackages
-, perl
+, ninja, meson, m4, pkgconfig, coreutils, gperf, getent
+, patchelf, perl, glibcLocales, glib, substituteAll
+, gettext, python3Packages
+
+# Mandatory dependencies
+, libcap
+, utillinux
+, kbd
+, kmod
+
+# Optional dependencies
+, pam, cryptsetup, lvm2, audit, acl
+, lz4, libgcrypt, libgpgerror, libidn2
+, curl, gnutar, gnupg, zlib
+, xz, libuuid, libffi
+, libapparmor, intltool
+, bzip2, pcre2, e2fsprogs
+, linuxHeaders ? stdenv.cc.libc.linuxHeaders
+, gnu-efi
+, iptables
 , withSelinux ? false, libselinux
 , withLibseccomp ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) libseccomp.meta.platforms, libseccomp
 , withKexectools ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) kexectools.meta.platforms, kexectools
+, bashInteractive
+
+, withResolved ? true
+, withLogind ? true
+, withHostnamed ? true
+, withLocaled ? true
+, withNetworkd ? true
+, withTimedated ? true
+, withTimesyncd ? true
+, withHwdb ? true
+, withEfi ? stdenv.hostPlatform.isEfi
+, withImportd ? true
+, withCryptsetup ? true
+
+# name argument
+, pname ? "systemd"
+
+
+, libxslt, docbook_xsl, docbook_xml_dtd_42, docbook_xml_dtd_45
 }:

+assert withResolved -> (libgcrypt != null && libgpgerror != null);
+assert withImportd ->
+  ( curl.dev != null && zlib != null && xz != null && libgcrypt != null
+  && gnutar != null && gnupg != null);
+
+assert withCryptsetup ->
+  ( cryptsetup != null );
+
 let
  version = "246.6";
 in stdenv.mkDerivation {
-  inherit version;
-  pname = "systemd";
+  inherit version pname;

  # We use systemd/systemd-stable for src, and ship NixOS-specific patches inside nixpkgs directly
  # This has proven to be less error-prone than the previous systemd fork.
@ -71,13 +105,17 @@ in stdenv.mkDerivation {
  outputs = [ "out" "man" "dev" ];

  nativeBuildInputs =
-    [ pkgconfig intltool gperf libxslt gettext docbook_xsl docbook_xml_dtd_42 docbook_xml_dtd_45
+    [ pkgconfig gperf
      ninja meson
      coreutils # meson calls date, stat etc.
      glibcLocales
      patchelf getent m4
      perl # to patch the libsystemd.so and remove dependencies on aarch64

+      intltool
+      gettext
+
+      libxslt docbook_xsl docbook_xml_dtd_42 docbook_xml_dtd_45
      (buildPackages.python3Packages.python.withPackages ( ps: with ps; [ python3Packages.lxml ]))
    ];
  buildInputs =
@ -86,9 +124,10 @@ in stdenv.mkDerivation {
      pcre2 ] ++
      stdenv.lib.optional withKexectools kexectools ++
      stdenv.lib.optional withLibseccomp libseccomp ++
-    [ libffi audit lz4 bzip2 libapparmor
-      iptables gnu-efi
-    ] ++ stdenv.lib.optional withSelinux libselinux;
+      [ libffi audit lz4 bzip2 libapparmor iptables ] ++
+      stdenv.lib.optional withEfi gnu-efi ++
+      stdenv.lib.optional withSelinux libselinux ++
+      stdenv.lib.optional withCryptsetup cryptsetup.dev;

  #dontAddPrefix = true;

@ -106,19 +145,23 @@ in stdenv.mkDerivation {
    "-Ddebug-shell=${bashInteractive}/bin/bash"
    # while we do not run tests we should also not build them. Removes about 600 targets
    "-Dtests=false"
-    "-Dimportd=true"
+    "-Dimportd=${stdenv.lib.boolToString withImportd}"
    "-Dlz4=true"
    "-Dhomed=false"
-    "-Dhostnamed=true"
-    "-Dnetworkd=true"
+    "-Dlogind=${stdenv.lib.boolToString withLogind}"
+    "-Dlocaled=${stdenv.lib.boolToString withLocaled}"
+    "-Dhostnamed=${stdenv.lib.boolToString withHostnamed}"
+    "-Dnetworkd=${stdenv.lib.boolToString withNetworkd}"
+    "-Dcryptsetup=${stdenv.lib.boolToString withCryptsetup}"
    "-Dportabled=false"
+    "-Dhwdb=${stdenv.lib.boolToString withHwdb}"
    "-Dremote=false"
    "-Dsysusers=false"
-    "-Dtimedated=true"
-    "-Dtimesyncd=true"
+    "-Dtimedated=${stdenv.lib.boolToString withTimedated}"
+    "-Dtimesyncd=${stdenv.lib.boolToString withTimesyncd}"
    "-Dfirstboot=false"
    "-Dlocaled=true"
-    "-Dresolve=true"
+    "-Dresolve=${stdenv.lib.boolToString withResolved}"
    "-Dsplit-usr=false"
    "-Dlibcurl=true"
    "-Dlibidn=false"
@ -141,11 +184,6 @@ in stdenv.mkDerivation {
    "-Dsystem-gid-max=999"
    # "-Dtime-epoch=1"

-    (if !stdenv.hostPlatform.isEfi then "-Dgnu-efi=false" else "-Dgnu-efi=true")
-    "-Defi-libdir=${toString gnu-efi}/lib"
-    "-Defi-includedir=${toString gnu-efi}/include/efi"
-    "-Defi-ldsdir=${toString gnu-efi}/lib"
-
    "-Dsysvinit-path="
    "-Dsysvrcnd-path="

@ -161,6 +199,12 @@ in stdenv.mkDerivation {
    # Upstream defaulted to disable manpages since they optimize for the much
    # more frequent development builds
    "-Dman=true"
+
+    "-Dgnu-efi=${stdenv.lib.boolToString (withEfi && gnu-efi != null)}"
+  ] ++ stdenv.lib.optionals (withEfi && gnu-efi != null) [
+    "-Defi-libdir=${toString gnu-efi}/lib"
+    "-Defi-includedir=${toString gnu-efi}/include/efi"
+    "-Defi-ldsdir=${toString gnu-efi}/lib"
  ];

  preConfigure = ''
@ -284,6 +328,6 @@ in stdenv.mkDerivation {
    license = licenses.lgpl21Plus;
    platforms = platforms.linux;
    priority = 10;
-    maintainers = with maintainers; [ andir eelco flokli ];
+    maintainers = with maintainers; [ andir eelco flokli kloenk ];
  };
 }
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@ -703,11 +703,11 @@ lib.makeScope newScope (self: with self; {
  }) {};

  libX11 = callPackage ({ stdenv, pkgconfig, fetchurl, xorgproto, libxcb, xtrans }: stdenv.mkDerivation {
-    name = "libX11-1.6.8";
+    name = "libX11-1.6.12";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libX11-1.6.8.tar.bz2";
-      sha256 = "1mbkwhhprhf49s2iwx7kiliprsdvd690zk44x3h53ql9q52si2dj";
+      url = "mirror://xorg/individual/lib/libX11-1.6.12.tar.bz2";
+      sha256 = "1ivfzl1qwk8zh7gc0m5vb58gdxz11jwg7w3d356w16j1d5s2427i";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    nativeBuildInputs = [ pkgconfig ];
@ -1054,11 +1054,11 @@ lib.makeScope newScope (self: with self; {
  }) {};

  libXvMC = callPackage ({ stdenv, pkgconfig, fetchurl, xorgproto, libX11, libXext, libXv }: stdenv.mkDerivation {
-    name = "libXvMC-1.0.11";
+    name = "libXvMC-1.0.12";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXvMC-1.0.11.tar.bz2";
-      sha256 = "0bb2c996p0smp2lwckffcfh4701bzv7266xh230ag0x68ka38bja";
+      url = "mirror://xorg/individual/lib/libXvMC-1.0.12.tar.bz2";
+      sha256 = "1kbdjsvkm5l7axv7g477qj18sab2wnqhliy6197syzizgfbsfgbb";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    nativeBuildInputs = [ pkgconfig ];
@ -1158,11 +1158,11 @@ lib.makeScope newScope (self: with self; {
  }) {};

  libxcb = callPackage ({ stdenv, pkgconfig, fetchurl, libxslt, libpthreadstubs, libXau, xcbproto, libXdmcp, python }: stdenv.mkDerivation {
-    name = "libxcb-1.13.1";
+    name = "libxcb-1.14";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "https://xcb.freedesktop.org/dist/libxcb-1.13.1.tar.bz2";
-      sha256 = "1i27lvrcsygims1pddpl5c4qqs6z715lm12ax0n3vx0igapvg7x8";
+      url = "mirror://xorg/individual/lib/libxcb-1.14.tar.xz";
+      sha256 = "0d2chjgyn5lr9sfhacfvqgnj9l9faz11vn322a06jd6lk3dxcpm5";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    nativeBuildInputs = [ pkgconfig python ];
@ -1431,11 +1431,11 @@ lib.makeScope newScope (self: with self; {
  }) {};

  xcbproto = callPackage ({ stdenv, pkgconfig, fetchurl, python }: stdenv.mkDerivation {
-    name = "xcb-proto-1.13";
+    name = "xcb-proto-1.14.1";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "https://xcb.freedesktop.org/dist/xcb-proto-1.13.tar.bz2";
-      sha256 = "1qdxw9syhbvswiqj5dvj278lrmfhs81apzmvx6205s4vcqg7563v";
+      url = "mirror://xorg/individual/proto/xcb-proto-1.14.1.tar.xz";
+      sha256 = "1hzwazgyywd9mz4mjj1yv8ski27qqx7ypmyr27m39hrajyddsjph";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    nativeBuildInputs = [ pkgconfig python ];
@ -1717,11 +1717,11 @@ lib.makeScope newScope (self: with self; {
  }) {};

  xf86inputlibinput = callPackage ({ stdenv, pkgconfig, fetchurl, xorgproto, libinput, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-input-libinput-0.28.2";
+    name = "xf86-input-libinput-0.30.0";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/driver/xf86-input-libinput-0.28.2.tar.bz2";
-      sha256 = "0818vr0yhk9j1y1wcbxzcd458vrvp06rrhi8k43bhqkb5jb4dcxq";
+      url = "mirror://xorg/individual/driver/xf86-input-libinput-0.30.0.tar.bz2";
+      sha256 = "1h4np66p87jf0c85ig524w8f5rbhl5gx8fww1qg0c55f87yzkizr";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    nativeBuildInputs = [ pkgconfig ];
@ -2679,11 +2679,11 @@ lib.makeScope newScope (self: with self; {
  }) {};

  xorgproto = callPackage ({ stdenv, pkgconfig, fetchurl, libXt }: stdenv.mkDerivation {
-    name = "xorgproto-2019.1";
+    name = "xorgproto-2020.1";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/proto/xorgproto-2019.1.tar.bz2";
-      sha256 = "16yll1kaffnslik5sizlw3qrigj1gpsgfgyq6903g3mwdixamnm6";
+      url = "mirror://xorg/individual/proto/xorgproto-2020.1.tar.bz2";
+      sha256 = "1llrnrkq6iprgiqakmwlv89745s9h02xsiaq0xn3fnh377qm78al";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@ -82,13 +82,6 @@ self: super:

  libX11 = super.libX11.overrideAttrs (attrs: {
    outputs = [ "out" "dev" "man" ];
-    patches = [
-      # Fixes an issue that happens when cross-compiling for us.
-      (fetchpatch {
-        url = "https://cgit.freedesktop.org/xorg/lib/libX11/patch/?id=0327c427d62f671eced067c6d9b69f4e216a8cac";
-        sha256 = "11k2mx56hjgw886zf1cdf2nhv7052d5rggimfshg6lq20i38vpza";
-      })
-    ];
    configureFlags = attrs.configureFlags or []
      ++ malloc0ReturnsNullCrossFlag;
    depsBuildBuild = [ buildPackages.stdenv.cc ];
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@ -1,7 +1,5 @@
 https://invisible-mirror.net/archives/luit/luit-20190106.tgz
 https://xcb.freedesktop.org/dist/libpthread-stubs-0.4.tar.bz2
-https://xcb.freedesktop.org/dist/libxcb-1.13.1.tar.bz2
-https://xcb.freedesktop.org/dist/xcb-proto-1.13.tar.bz2
 https://xcb.freedesktop.org/dist/xcb-util-0.4.0.tar.bz2
 https://xcb.freedesktop.org/dist/xcb-util-cursor-0.1.3.tar.bz2
 https://xcb.freedesktop.org/dist/xcb-util-errors-1.0.tar.bz2
@ -83,7 +81,7 @@ mirror://xorg/individual/doc/xorg-sgml-doctools-1.11.tar.bz2
 mirror://xorg/individual/driver/xf86-input-evdev-2.10.6.tar.bz2
 mirror://xorg/individual/driver/xf86-input-joystick-1.6.3.tar.bz2
 mirror://xorg/individual/driver/xf86-input-keyboard-1.9.0.tar.bz2
-mirror://xorg/individual/driver/xf86-input-libinput-0.28.2.tar.bz2
+mirror://xorg/individual/driver/xf86-input-libinput-0.30.0.tar.bz2
 mirror://xorg/individual/driver/xf86-input-mouse-1.9.3.tar.bz2
 mirror://xorg/individual/driver/xf86-input-synaptics-1.9.1.tar.bz2
 mirror://xorg/individual/driver/xf86-input-vmmouse-13.1.0.tar.bz2
@ -177,10 +175,11 @@ mirror://xorg/individual/lib/libICE-1.0.10.tar.bz2
 mirror://xorg/individual/lib/libpciaccess-0.16.tar.bz2
 mirror://xorg/individual/lib/libSM-1.2.3.tar.bz2
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libX11-1.6.8.tar.bz2
+mirror://xorg/individual/lib/libX11-1.6.12.tar.bz2
 mirror://xorg/individual/lib/libXau-1.0.9.tar.bz2
 mirror://xorg/individual/lib/libXaw-1.0.13.tar.bz2
 mirror://xorg/individual/lib/libXaw3d-1.6.3.tar.bz2
+mirror://xorg/individual/lib/libxcb-1.14.tar.xz
 mirror://xorg/individual/lib/libXcomposite-0.4.5.tar.bz2
 mirror://xorg/individual/lib/libXcursor-1.2.0.tar.bz2
 mirror://xorg/individual/lib/libXdamage-1.1.5.tar.bz2
@ -206,12 +205,13 @@ mirror://xorg/individual/lib/libXTrap-1.0.1.tar.bz2
 mirror://xorg/individual/lib/libXt-1.2.0.tar.bz2
 mirror://xorg/individual/lib/libXtst-1.2.3.tar.bz2
 mirror://xorg/individual/lib/libXv-1.0.11.tar.bz2
-mirror://xorg/individual/lib/libXvMC-1.0.11.tar.bz2
+mirror://xorg/individual/lib/libXvMC-1.0.12.tar.bz2
 mirror://xorg/individual/lib/libXxf86dga-1.1.5.tar.bz2
 mirror://xorg/individual/lib/libXxf86misc-1.0.4.tar.bz2
 mirror://xorg/individual/lib/libXxf86vm-1.1.4.tar.bz2
 mirror://xorg/individual/lib/xtrans-1.4.0.tar.bz2
-mirror://xorg/individual/proto/xorgproto-2019.1.tar.bz2
+mirror://xorg/individual/proto/xcb-proto-1.14.1.tar.xz
+mirror://xorg/individual/proto/xorgproto-2020.1.tar.bz2
 mirror://xorg/individual/util/gccmakedep-1.0.3.tar.bz2
 mirror://xorg/individual/util/imake-1.0.8.tar.bz2
 mirror://xorg/individual/util/lndir-1.0.3.tar.bz2
--- a/pkgs/shells/bash/bash-completion/default.nix
+++ b/pkgs/shells/bash/bash-completion/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "bash-completion";
-  version = "2.10";
+  version = "2.11";

  src = fetchFromGitHub {
    owner = "scop";
    repo = "bash-completion";
    rev = version;
-    sha256 = "047yjryy9d6hp18wkigbfrw9r0sm31inlsp8l28fhxg8ii032sgq";
+    sha256 = "0m3brd5jx7w07h8vxvvcmbyrlnadrx6hra3cvx6grzv6rin89liv";
  };

  nativeBuildInputs = [ autoreconfHook ];
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@ -190,10 +190,7 @@ in rec {

  stage1 = prevStage: let
    persistent = self: super: with prevStage; {
-      cmake = super.cmake.override {
-        isBootstrap = true;
-        useSharedLibraries = false;
-      };
+      cmake = super.cmakeMinimal;

      python3 = super.python3Minimal;

--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@ -27,6 +27,8 @@ with pkgs;
  cc-multilib-gcc = callPackage ./cc-wrapper/multilib.nix { stdenv = gccMultiStdenv; };
  cc-multilib-clang = callPackage ./cc-wrapper/multilib.nix { stdenv = clangMultiStdenv; };

+  install-shell-files = callPackage ./install-shell-files {};
+
  kernel-config = callPackage ./kernel.nix {};

  ld-library-path = callPackage ./ld-library-path {};
--- a/pkgs/test/install-shell-files/default.nix
+++ b/pkgs/test/install-shell-files/default.nix
@ -0,0 +1,125 @@
+{ stdenv, runCommandLocal, recurseIntoAttrs, installShellFiles }:
+
+let
+  runTest = name: env: buildCommand:
+    runCommandLocal "install-shell-files--${name}" ({
+      nativeBuildInputs = [ installShellFiles ];
+      meta.platforms = stdenv.lib.platforms.all;
+    } // env) buildCommand;
+in
+
+recurseIntoAttrs {
+  # installManPage
+
+  install-manpage = runTest "install-manpage" {} ''
+    mkdir -p doc
+    echo foo > doc/foo.1
+    echo bar > doc/bar.2.gz
+    echo baz > doc/baz.3
+
+    installManPage doc/*
+
+    cmp doc/foo.1 $out/share/man/man1/foo.1
+    cmp doc/bar.2.gz $out/share/man/man2/bar.2.gz
+    cmp doc/baz.3 $out/share/man/man3/baz.3
+  '';
+  install-manpage-outputs = runTest "install-manpage-outputs" {
+    outputs = [ "out" "man" "devman" ];
+  } ''
+    mkdir -p doc
+    echo foo > doc/foo.1
+    echo bar > doc/bar.3
+
+    installManPage doc/*
+
+    # assert they didn't go into $out
+    [[ ! -f $out/share/man/man1/foo.1 && ! -f $out/share/man/man3/bar.3 ]]
+
+    # foo.1 alone went into man
+    cmp doc/foo.1 ''${!outputMan:?}/share/man/man1/foo.1
+    [[ ! -f ''${!outputMan:?}/share/man/man3/bar.3 ]]
+
+    # bar.3 alone went into devman
+    cmp doc/bar.3 ''${!outputDevman:?}/share/man/man3/bar.3
+    [[ ! -f ''${!outputDevman:?}/share/man/man1/foo.1 ]]
+
+    touch $out
+  '';
+
+  # installShellCompletion
+
+  install-completion = runTest "install-completion" {} ''
+    echo foo > foo
+    echo bar > bar
+    echo baz > baz
+    echo qux > qux.zsh
+    echo quux > quux
+
+    installShellCompletion --bash foo bar --zsh baz qux.zsh --fish quux
+
+    cmp foo $out/share/bash-completion/completions/foo
+    cmp bar $out/share/bash-completion/completions/bar
+    cmp baz $out/share/zsh/site-functions/_baz
+    cmp qux.zsh $out/share/zsh/site-functions/_qux
+    cmp quux $out/share/fish/vendor_completions.d/quux
+  '';
+  install-completion-output = runTest "install-completion-output" {
+    outputs = [ "out" "bin" ];
+  } ''
+    echo foo > foo
+
+    installShellCompletion --bash foo
+
+    # assert it didn't go into $out
+    [[ ! -f $out/share/bash-completion/completions/foo ]]
+
+    cmp foo ''${!outputBin:?}/share/bash-completion/completions/foo
+
+    touch $out
+  '';
+  install-completion-name = runTest "install-completion-name" {} ''
+    echo foo > foo
+    echo bar > bar
+    echo baz > baz
+
+    installShellCompletion --bash --name foobar.bash foo --zsh --name _foobar bar --fish baz
+
+    cmp foo $out/share/bash-completion/completions/foobar.bash
+    cmp bar $out/share/zsh/site-functions/_foobar
+    cmp baz $out/share/fish/vendor_completions.d/baz
+  '';
+  install-completion-inference = runTest "install-completion-inference" {} ''
+    echo foo > foo.bash
+    echo bar > bar.zsh
+    echo baz > baz.fish
+
+    installShellCompletion foo.bash bar.zsh baz.fish
+
+    cmp foo.bash $out/share/bash-completion/completions/foo.bash
+    cmp bar.zsh $out/share/zsh/site-functions/_bar
+    cmp baz.fish $out/share/fish/vendor_completions.d/baz.fish
+  '';
+  install-completion-cmd = runTest "install-completion-cmd" {} ''
+    echo foo > foo.bash
+    echo bar > bar.zsh
+    echo baz > baz.fish
+    echo qux > qux.fish
+
+    installShellCompletion --cmd foobar --bash foo.bash --zsh bar.zsh --fish baz.fish --name qux qux.fish
+
+    cmp foo.bash $out/share/bash-completion/completions/foobar.bash
+    cmp bar.zsh $out/share/zsh/site-functions/_foobar
+    cmp baz.fish $out/share/fish/vendor_completions.d/foobar.fish
+    cmp qux.fish $out/share/fish/vendor_completions.d/qux
+  '';
+  install-completion-fifo = runTest "install-completion-fifo" {} ''
+    installShellCompletion \
+      --bash --name foo.bash <(echo foo) \
+      --zsh --name _foo <(echo bar) \
+      --fish --name foo.fish <(echo baz)
+
+    [[ $(<$out/share/bash-completion/completions/foo.bash) == foo ]] || { echo "foo.bash comparison failed"; exit 1; }
+    [[ $(<$out/share/zsh/site-functions/_foo) == bar ]] || { echo "_foo comparison failed"; exit 1; }
+    [[ $(<$out/share/fish/vendor_completions.d/foo.fish) == baz ]] || { echo "foo.fish comparison failed"; exit 1; }
+  '';
+}
--- a/pkgs/tools/compression/brotli/default.nix
+++ b/pkgs/tools/compression/brotli/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "brotli";
-  version = "1.0.7";
+  version = "1.0.9";

  src = fetchFromGitHub {
    owner = "google";
    repo = "brotli";
    rev = "v" + version;
-    sha256 = "1811b55wdfg4kbsjcgh1kc938g118jpvif97ilgrmbls25dfpvvw";
+    sha256 = "z6Dhrabav1MDQ4rAcXaDv0aN+qOoh9cvoXZqEWBB13c=";
  };

  nativeBuildInputs = [ cmake ];
@ -32,7 +32,14 @@ stdenv.mkDerivation rec {

  # This breaks on Darwin because our cmake hook tries to make a build folder
  # and the wonderful bazel BUILD file is already there (yay case-insensitivity?)
-  prePatch = "rm BUILD";
+  prePatch = ''
+      rm BUILD
+
+      # Upstream fixed this reference to runtime-path after the release
+      # and with this references g++ complains about invalid option -R
+      sed -i 's/ -R''${libdir}//' scripts/libbrotli*.pc.in
+      cat scripts/libbrotli*.pc.in
+    '';

  # Don't bother with "man" output for now,
  # it currently only makes the manpages hard to use.
--- a/pkgs/tools/misc/coreutils/avoid-false-positive-in-date-debug-test.patch
+++ b/pkgs/tools/misc/coreutils/avoid-false-positive-in-date-debug-test.patch
@ -1,52 +0,0 @@
-From 0251229bfd9617e8a35cf9dd7d338d63fff74a0c Mon Sep 17 00:00:00 2001
-From: Assaf Gordon <assafgordon@gmail.com>
-Date: Mon, 13 May 2019 16:37:40 -0600
-Subject: [PATCH] tests: avoid false-positive in date-debug test
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When debugging an invalid date due to DST switching, the intermediate
-'normalized time' should not be checked - its value can differ between
-systems (e.g. glibc vs musl).
-
-Reported by Niklas Hambüchen in
-https://lists.gnu.org/r/coreutils/2019-05/msg00031.html
-Analyzed by Rich Felker in
-https://lists.gnu.org/r/coreutils/2019-05/msg00039.html
-
-* tests/misc/date-debug.sh: Replace the exact normalized time
-with 'XX:XX:XX' so different values would not trigger test failure.
---
- tests/misc/date-debug.sh | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/tests/misc/date-debug.sh b/tests/misc/date-debug.sh
-index aa47f1abb..2ce6f4ce8 100755
--- a/tests/misc/date-debug.sh
-+++ b/tests/misc/date-debug.sh
-@@ -71,7 +71,7 @@ date: input timezone: TZ="America/Edmonton" in date string
- date: using specified time as starting value: '02:30:00'
- date: error: invalid date/time value:
- date:     user provided time: '(Y-M-D) 2006-04-02 02:30:00'
-date:        normalized time: '(Y-M-D) 2006-04-02 03:30:00'
-+date:        normalized time: '(Y-M-D) 2006-04-02 XX:XX:XX'
- date:                                             --
- date:      possible reasons:
- date:        non-existing due to daylight-saving time;
-@@ -81,7 +81,14 @@ date: invalid date 'TZ="America/Edmonton" 2006-04-02 02:30:00'
- EOF
- 
- # date should return 1 (error) for invalid date
-returns_ 1 date --debug -d "$in2" >out2 2>&1 || fail=1
-+returns_ 1 date --debug -d "$in2" >out2-t 2>&1 || fail=1
-+
-+# The output line of "normalized time" can differ between systems
-+# (e.g. glibc vs musl) and should not be checked.
-+# See: https://lists.gnu.org/archive/html/coreutils/2019-05/msg00039.html
-+sed '/normalized time:/s/ [0-9][0-9]:[0-9][0-9]:[0-9][0-9]/ XX:XX:XX/' \
-+    out2-t > out2 || framework_failure_
-+
- compare exp2 out2 || fail=1
- 
- ##
--- a/pkgs/tools/misc/coreutils/coreutils-8.31-android-cross.patch
+++ b/pkgs/tools/misc/coreutils/coreutils-8.31-android-cross.patch
@ -1,51 +0,0 @@
-From 3bd82a82cf4ba693d2c31c7b95aaec4e56dc92a4 Mon Sep 17 00:00:00 2001
-From: Paul Eggert <eggert@cs.ucla.edu>
-Date: Mon, 11 Mar 2019 16:40:29 -0700
-Subject: [PATCH 1/1] strtod: fix clash with strtold
-
-Problem reported for RHEL 5 by Jesse Caldwell (Bug#34817).
-* lib/strtod.c (compute_minus_zero, minus_zero):
-Simplify by remving the macro / external variable,
-and having just a function.  User changed.  This avoids
-the need for an external variable that might clash.
---
- ChangeLog    |  9 +++++++++
- lib/strtod.c | 11 +++++------
- 2 files changed, 14 insertions(+), 6 deletions(-)
-
-diff --git a/lib/strtod.c b/lib/strtod.c
-index b9eaa51..69b1564 100644
--- a/lib/strtod.c
-+++ b/lib/strtod.c
-@@ -294,16 +294,15 @@ parse_number (const char *nptr,
-    ICC 10.0 has a bug when optimizing the expression -zero.
-    The expression -MIN * MIN does not work when cross-compiling
-    to PowerPC on Mac OS X 10.5.  */
-#if defined __hpux || defined __sgi || defined __ICC
- static DOUBLE
-compute_minus_zero (void)
-+minus_zero (void)
- {
-+#if defined __hpux || defined __sgi || defined __ICC
-   return -MIN * MIN;
-}
-# define minus_zero compute_minus_zero ()
- #else
-DOUBLE minus_zero = -0.0;
-+  return -0.0;
- #endif
-+}
- 
- /* Convert NPTR to a DOUBLE.  If ENDPTR is not NULL, a pointer to the
-    character after the last one used in the number is put in *ENDPTR.  */
-@@ -479,6 +478,6 @@ STRTOD (const char *nptr, char **endptr)
-   /* Special case -0.0, since at least ICC miscompiles negation.  We
-      can't use copysign(), as that drags in -lm on some platforms.  */
-   if (!num && negative)
-    return minus_zero;
-+    return minus_zero ();
-   return negative ? -num : num;
- }
-- 
-1.9.1
-
--- a/pkgs/tools/misc/coreutils/coreutils-8.31-musl-cross.patch
+++ b/pkgs/tools/misc/coreutils/coreutils-8.31-musl-cross.patch
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@ -22,21 +22,16 @@ with lib;

 stdenv.mkDerivation (rec {
  pname = "coreutils";
-  version = "8.31";
+  version = "8.32";

  src = fetchurl {
    url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1zg9m79x1i2nifj4kb0waf9x3i5h6ydkypkjnbsb9rnwis8rqypz";
+    sha256 = "sha256-RFjY3nhJ30TMqxXhaxVIsoUiTbul8I+sBwwcDgvMTPo=";
  };

  patches = optional stdenv.hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch
    # included on coreutils master; TODO: apply unconditionally, I guess
-         ++ optional stdenv.hostPlatform.isAarch64 ./sys-getdents-undeclared.patch
-         ++ optional stdenv.hostPlatform.isMusl ./avoid-false-positive-in-date-debug-test.patch
-         # Fix compilation in musl-cross environments. To be removed in coreutils-8.32.
-         ++ optional stdenv.hostPlatform.isMusl ./coreutils-8.31-musl-cross.patch
-         # Fix compilation in android-cross environments. To be removed in coreutils-8.32.
-         ++ [ ./coreutils-8.31-android-cross.patch ];
+    ++ optional stdenv.hostPlatform.isAarch64 ./sys-getdents-undeclared.patch;

  postPatch = ''
    # The test tends to fail on btrfs,f2fs and maybe other unusual filesystems.
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@ -34,14 +34,14 @@ assert gssSupport -> libkrb5 != null;

 stdenv.mkDerivation rec {
  pname = "curl";
-  version = "7.72.0";
+  version = "7.73.0";

  src = fetchurl {
    urls = [
      "https://curl.haxx.se/download/${pname}-${version}.tar.bz2"
      "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] pname}-${version}/${pname}-${version}.tar.bz2"
    ];
-    sha256 = "1vq3ay87vayfrv67l7s7h79nm7gwdqhidki0brv5jahhch49g4dd";
+    sha256 = "sha256-zzT+Cwe4APHAGkmabosq9Uj20OBE3KSinYikvuFG0TE=";
  };

  outputs = [ "bin" "dev" "out" "man" "devdoc" ];
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "unbound";
-  version = "1.11.0";
+  version = "1.12.0";

  src = fetchurl {
    url = "https://unbound.net/downloads/${pname}-${version}.tar.gz";
-    sha256 = "1xqywn2qdmjjq0csrqxh9p2rnizdrr1f99zdx87z7f3fyyc0fbwz";
+    sha256 = "0daqxzvknvcz7sgag3wcrxhp4a39ik93lsrfpwcl9whjg2lm74jv";
  };

  outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -8346,9 +8346,7 @@ in
  zssh = callPackage ../tools/networking/zssh { };

  zstd = callPackage ../tools/compression/zstd {
-    cmake = buildPackages.cmake.override {
-      libarchive = buildPackages.libarchive.override { zstd = null; };
-    };
+    cmake = buildPackages.cmakeMinimal;
  };

  zsync = callPackage ../tools/compression/zsync { };
@ -9676,15 +9674,15 @@ in
    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
    llvmPackages = if stdenv.cc.isClang then llvmPackages_5 else llvmPackages_10;
  };
-  rust_1_46 = callPackage ../development/compilers/rust/1_46.nix {
+  rust_1_47 = callPackage ../development/compilers/rust/1_47.nix {
    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
-    llvmPackages = if stdenv.cc.isClang then llvmPackages_5 else llvmPackages_10;
+    llvmPackages = if stdenv.cc.isClang then llvmPackages_5 else llvmPackages_11;
  };
-  rust = rust_1_46;
+  rust = rust_1_47;

  rustPackages_1_45 = rust_1_45.packages.stable;
-  rustPackages_1_46 = rust_1_46.packages.stable;
-  rustPackages = rustPackages_1_46;
+  rustPackages_1_47 = rust_1_47.packages.stable;
+  rustPackages = rustPackages_1_47;

  inherit (rustPackages) cargo clippy rustc rustPlatform;

@ -10860,6 +10858,10 @@ in

  cmake = libsForQt5.callPackage ../development/tools/build-managers/cmake { };

+  cmakeMinimal = libsForQt5.callPackage ../development/tools/build-managers/cmake {
+    isBootstrap = true;
+  };
+
  cmakeCurses = cmake.override { useNcurses = true; };

  cmakeWithGui = cmakeCurses.override { withQt5 = true; };
@ -18290,7 +18292,7 @@ in
    # udev is the same package as systemd which depends on cryptsetup
    # which depends on lvm2 again.  But we only need the libudev part
    # which does not depend on cryptsetup.
-    udev = udev.override { cryptsetup = null; };
+    udev = systemdMinimal;
  };
  lvm2_dmeventd = callPackage ../os-specific/linux/lvm2 {
    enableDmeventd = true;
@ -18641,8 +18643,23 @@ in
      bzip2 = null;
    };
  };
+  systemdMinimal = systemd.override {
+    pname = "systemd-minimal";
+    withResolved = false;
+    withLogind = false;
+    withHostnamed = false;
+    withLocaled = false;
+    withTimedated = false;
+    withHwdb = false;
+    withEfi = false;
+    withImportd = false;
+    withCryptsetup = false;
+    cryptsetup = null;
+    lvm2 = null;
+  };

-  udev = systemd; # TODO: move to aliases.nix
+
+  udev = systemd; # TODO: change to systemdMinimal

  systemd-wait = callPackage ../os-specific/linux/systemd-wait { };

--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -4828,7 +4828,7 @@ in {

  pybullet = callPackage ../development/python-modules/pybullet { };

-  pycairo = callPackage ../development/python-modules/pycairo { inherit (pkgs) meson pkgconfig; };
+  pycairo = callPackage ../development/python-modules/pycairo { inherit (pkgs) meson pkg-config; };

  pycallgraph = callPackage ../development/python-modules/pycallgraph { };