Merge pull request #94296 from NixOS/staging-next

Staging next

pkgs/applications/audio/opusfile/default.nix

@@ -1,10 +1,10 @@
 { stdenv, fetchurl, pkgconfig, openssl, libogg, libopus }:
 
 stdenv.mkDerivation rec {
-  name = "opusfile-0.11";
+  name = "opusfile-0.12";
   src = fetchurl {
     url = "http://downloads.xiph.org/releases/opus/${name}.tar.gz";
-    sha256 = "1gq3aszzl5glgbajw5p1f5a1kdyf23w5vjdmwwrk246syin9pkkl";
+    sha256 = "02smwc5ah8nb3a67mnkjzqmrzk43j356hgj2a97s9midq40qd38i";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/applications/blockchains/monero/default.nix

@@ -2,7 +2,7 @@
 , cmake, pkgconfig
 , boost, miniupnpc, openssl, unbound
 , zeromq, pcsclite, readline, libsodium, hidapi
-, pythonProtobuf, randomx, rapidjson, libusb-compat-0_1
+, protobuf, randomx, rapidjson, libusb-compat-0_1
 , CoreData, IOKit, PCSC
 }:
 
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     boost miniupnpc openssl unbound
     zeromq pcsclite readline
     libsodium hidapi randomx rapidjson
-    pythonProtobuf libusb-compat-0_1
+    protobuf libusb-compat-0_1
   ] ++ stdenv.lib.optionals stdenv.isDarwin [ IOKit CoreData PCSC ];
 
   cmakeFlags = [

pkgs/applications/editors/ed/default.nix

@@ -1,6 +1,11 @@
 { stdenv, fetchurl, lzip
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation (rec {
   name = "ed-${version}";
   version = "1.16";

pkgs/applications/kde/messagelib.nix

@@ -5,7 +5,7 @@
   grantleetheme, karchive, kcodecs, kconfig, kconfigwidgets, kcontacts,
   kdepim-apps-libs, kiconthemes, kidentitymanagement, kio, kjobwidgets, kldap,
   kmailtransport, kmbox, kmime, kwindowsystem, libgravatar, libkdepim, libkleo,
-  pimcommon, qca-qt5, qtwebengine, qtwebkit, syntax-highlighting
+  pimcommon, qca-qt5, qtwebengine, syntax-highlighting
 }:
 
 mkDerivation {
@@ -18,7 +18,7 @@ mkDerivation {
   buildInputs = [
     akonadi-notes akonadi-search gpgme grantlee grantleetheme karchive kcodecs
     kconfig kconfigwidgets kdepim-apps-libs kiconthemes kio kjobwidgets kldap
-    kmailtransport kmbox kmime kwindowsystem libgravatar libkdepim qca-qt5 qtwebkit
+    kmailtransport kmbox kmime kwindowsystem libgravatar libkdepim qca-qt5
     syntax-highlighting
   ];
   propagatedBuildInputs = [

pkgs/applications/misc/ola/default.nix

@@ -1,31 +1,43 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, bison, flex, pkgconfig
-, libuuid, cppunit, protobuf3_1, zlib, avahi, libmicrohttpd
-, perl, python36 # Replace by python3 after the next update
+{ stdenv
+, fetchFromGitHub
+, autoreconfHook
+, bison
+, flex
+, pkgconfig
+, libuuid
+, cppunit
+, protobuf
+, zlib
+, avahi
+, libmicrohttpd
+, perl
+, python3
 }:
 
 stdenv.mkDerivation rec {
   pname = "ola";
-  version = "0.10.7";
+  version = "unstable-2020-07-17";
 
   src = fetchFromGitHub {
     owner = "OpenLightingProject";
     repo = "ola";
-    rev = version;
-    sha256 = "18krwrw7w1qzwih8gnmv7r4sah5ppvq7ax65r7l5yjxn3ihwp2kf";
+    rev = "e2cd699c7792570500578fd092fb6bfb3d511023"; # HEAD of "0.10" branch
+    sha256 = "17a3z3zhx00rjk58icd3zlqfw3753f3y8bwy2sza0frdim09lqr4";
   };
 
   nativeBuildInputs = [ autoreconfHook bison flex pkgconfig perl ];
-  buildInputs = [ libuuid cppunit protobuf3_1 zlib avahi libmicrohttpd python36 ];
+  buildInputs = [ libuuid cppunit protobuf zlib avahi libmicrohttpd python3 ];
   propagatedBuildInputs = [
-    (python36.pkgs.protobuf.override { protobuf = protobuf3_1; })
-    python36.pkgs.numpy
+    python3.pkgs.protobuf
+    python3.pkgs.numpy
   ];
 
   configureFlags = [ "--enable-python-libs" ];
 
   meta = with stdenv.lib; {
     description = "A framework for controlling entertainment lighting equipment.";
-    maintainers = [ maintainers.globin ];
+    homepage = "https://www.openlighting.org/ola/";
+    maintainers = with maintainers; [ globin ];
     license = with licenses; [ lgpl21 gpl2Plus ];
     platforms = platforms.all;
   };

pkgs/applications/networking/browsers/firefox/common.nix

@@ -177,7 +177,8 @@ stdenv.mkDerivation ({
     # included we need to look in a few places.
     # TODO: generalize this process for other use-cases.
 
-    BINDGEN_CFLAGS="$(< ${stdenv.cc}/nix-support/libc-cflags) \
+    BINDGEN_CFLAGS="$(< ${stdenv.cc}/nix-support/libc-crt1-cflags) \
+      $(< ${stdenv.cc}/nix-support/libc-cflags) \
       $(< ${stdenv.cc}/nix-support/cc-cflags) \
       $(< ${stdenv.cc}/nix-support/libcxx-cxxflags) \
       ${lib.optionalString stdenv.cc.isClang "-idirafter ${stdenv.cc.cc}/lib/clang/${lib.getVersion stdenv.cc.cc}/include"} \

pkgs/applications/networking/mailreaders/thunderbird/default.nix

@@ -175,7 +175,8 @@ stdenv.mkDerivation rec {
     # included we need to look in a few places.
     # TODO: generalize this process for other use-cases.
 
-    BINDGEN_CFLAGS="$(< ${stdenv.cc}/nix-support/libc-cflags) \
+    BINDGEN_CFLAGS="$(< ${stdenv.cc}/nix-support/libc-crt1-cflags) \
+      $(< ${stdenv.cc}/nix-support/libc-cflags) \
       $(< ${stdenv.cc}/nix-support/cc-cflags) \
       $(< ${stdenv.cc}/nix-support/libcxx-cxxflags) \
       ${

pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -21,7 +21,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.27.0";
+  version = "2.28.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "1ybk39ylvs32lywq7ra4l2kdr5izc80r9461hwfnw8pssxs9gjkk";
+    sha256 = "17a311vzimqn1glc9d7x82rhb1mb81m5rr4g8xji8idaafid39fz";
   };
 
   outputs = [ "out" ] ++ stdenv.lib.optional withManual "doc";

pkgs/build-support/alternatives/blas/default.nix

@@ -72,7 +72,7 @@ stdenv.mkDerivation {
 
   nm -an "$libblas" | cut -f3 -d' ' > symbols
   for symbol in ${toString blasFortranSymbols}; do
-    grep "^$symbol_$" symbols || { echo "$symbol" was not found in "$libblas"; exit 1; }
+    grep -q "^$symbol_$" symbols || { echo "$symbol" was not found in "$libblas"; exit 1; }
   done
 
   cp -L "$libblas" $out/lib/libblas${canonicalExtension}

pkgs/build-support/cc-wrapper/add-flags.sh

@@ -33,10 +33,14 @@ NIX_CFLAGS_COMPILE_@suffixSalt@="-B@out@/bin/ $NIX_CFLAGS_COMPILE_@suffixSalt@"
 # Export and assign separately in order that a failing $(..) will fail
 # the script.
 
-if [ -e @out@/nix-support/libc-cflags ]; then
+if [[ "$cInclude" = 1 ]] && [ -e @out@/nix-support/libc-cflags ]; then
     NIX_CFLAGS_COMPILE_@suffixSalt@="$(< @out@/nix-support/libc-cflags) $NIX_CFLAGS_COMPILE_@suffixSalt@"
 fi
 
+if [ -e @out@/nix-support/libc-crt1-cflags ]; then
+    NIX_CFLAGS_COMPILE_@suffixSalt@="$(< @out@/nix-support/libc-crt1-cflags) $NIX_CFLAGS_COMPILE_@suffixSalt@"
+fi
+
 if [ -e @out@/nix-support/libcxx-cxxflags ]; then
     NIX_CXXSTDLIB_COMPILE_@suffixSalt@+=" $(< @out@/nix-support/libcxx-cxxflags)"
 fi

pkgs/build-support/cc-wrapper/cc-wrapper.sh

@@ -17,16 +17,6 @@ fi
 
 source @out@/nix-support/utils.bash
 
-# Flirting with a layer violation here.
-if [ -z "${NIX_BINTOOLS_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
-    source @bintools@/nix-support/add-flags.sh
-fi
-
-# Put this one second so libc ldflags take priority.
-if [ -z "${NIX_CC_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
-    source @out@/nix-support/add-flags.sh
-fi
-
 
 # Parse command line options and set several variables.
 # For instance, figure out if linker flags should be passed.
@@ -37,6 +27,7 @@ cc1=0
 # shellcheck disable=SC2193
 [[ "@prog@" = *++ ]] && isCpp=1 || isCpp=0
 cppInclude=1
+cInclude=1
 
 expandResponseParams "$@"
 declare -i n=0
@@ -63,6 +54,7 @@ while (( "$n" < "$nParams" )); do
     elif [ "$p" = -nostdlib ]; then
         isCpp=-1
     elif [ "$p" = -nostdinc ]; then
+        cInclude=0
         cppInclude=0
     elif [ "$p" = -nostdinc++ ]; then
         cppInclude=0
@@ -111,6 +103,15 @@ if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "$NIX_STORE" ]]; then
     params=(${rest+"${rest[@]}"})
 fi
 
+# Flirting with a layer violation here.
+if [ -z "${NIX_BINTOOLS_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
+    source @bintools@/nix-support/add-flags.sh
+fi
+
+# Put this one second so libc ldflags take priority.
+if [ -z "${NIX_CC_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
+    source @out@/nix-support/add-flags.sh
+fi
 
 # Clear march/mtune=native -- they bring impurity.
 if [ "$NIX_ENFORCE_NO_NATIVE_@suffixSalt@" = 1 ]; then

pkgs/build-support/cc-wrapper/default.nix

@@ -287,7 +287,7 @@ stdenv.mkDerivation {
     + optionalString (libc != null) (''
       touch "$out/nix-support/libc-cflags"
       touch "$out/nix-support/libc-ldflags"
-      echo "-B${libc_lib}${libc.libdir or "/lib/"}" >> $out/nix-support/libc-cflags
+      echo "-B${libc_lib}${libc.libdir or "/lib/"}" >> $out/nix-support/libc-crt1-cflags
     '' + optionalString (!(cc.langD or false)) ''
       echo "-idirafter ${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
     '' + optionalString (isGNU && (!(cc.langD or false))) ''
@@ -429,7 +429,7 @@ stdenv.mkDerivation {
 
     + optionalString (libc != null && targetPlatform.isAvr) ''
       for isa in avr5 avr3 avr4 avr6 avr25 avr31 avr35 avr51 avrxmega2 avrxmega4 avrxmega5 avrxmega6 avrxmega7 tiny-stack; do
-        echo "-B${getLib libc}/avr/lib/$isa" >> $out/nix-support/libc-cflags
+        echo "-B${getLib libc}/avr/lib/$isa" >> $out/nix-support/libc-crt1-cflags
       done
     ''
 

pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix

@@ -0,0 +1,175 @@
+{ stdenv
+, lib
+, makeSetupHook
+, makeWrapper
+, gobject-introspection
+, gtk3
+, librsvg
+, dconf
+, callPackage
+, wrapGAppsHook
+, writeTextFile
+}:
+
+makeSetupHook {
+  deps = lib.optionals (!stdenv.isDarwin) [
+    # It is highly probable that a program will use GSettings,
+    # at minimum through GTK file chooser dialogue.
+    # Let’s add a GIO module for “dconf” GSettings backend
+    # to avoid falling back to “memory” backend. This is
+    # required for GSettings-based settings to be persisted.
+    # Unfortunately, it also requires the user to have dconf
+    # D-Bus service enabled globally (e.g. through a NixOS module).
+    dconf.lib
+  ] ++ [
+    # TODO: remove this, packages should depend on GTK explicitly.
+    gtk3
+
+    # librsvg provides a module for gdk-pixbuf to allow rendering
+    # SVG icons. Most icon themes are SVG-based and so are some
+    # graphics in GTK (e.g. cross for closing window in window title bar)
+    # so it is pretty much required for applications using GTK.
+    librsvg
+
+    # We use the wrapProgram function.
+    makeWrapper
+  ];
+  substitutions = {
+    passthru.tests = let
+      sample-project = ./tests/sample-project;
+
+      testLib = callPackage ./tests/lib.nix { };
+      inherit (testLib) expectSomeLineContainingYInFileXToMentionZ;
+    in rec {
+      # Simple derivation containing a program and a daemon.
+      basic = stdenv.mkDerivation {
+        name = "basic";
+
+        src = sample-project;
+
+        nativeBuildInputs = [ wrapGAppsHook ];
+
+        installFlags = [ "bin-foo" "libexec-bar" ];
+      };
+
+      # The wrapper for executable files should add path to dconf GIO module.
+      basic-contains-dconf = let
+        tested = basic;
+      in testLib.runTest "basic-contains-dconf" (
+        testLib.skip stdenv.isDarwin ''
+          ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GIO_EXTRA_MODULES=" "${dconf.lib}/lib/gio/modules"}
+          ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GIO_EXTRA_MODULES=" "${dconf.lib}/lib/gio/modules"}
+        ''
+      );
+
+      # Simple derivation containing a gobject-introspection typelib.
+      typelib-Mahjong = stdenv.mkDerivation {
+        name = "typelib-Mahjong";
+
+        src = sample-project;
+
+        installFlags = [ "typelib-Mahjong" ];
+      };
+
+      # Simple derivation using a typelib.
+      typelib-user = stdenv.mkDerivation {
+        name = "typelib-user";
+
+        src = sample-project;
+
+        nativeBuildInputs = [
+          gobject-introspection
+          wrapGAppsHook
+        ];
+
+        buildInputs = [
+          typelib-Mahjong
+        ];
+
+        installFlags = [ "bin-foo" "libexec-bar" ];
+      };
+
+      # Testing cooperation with gobject-introspection setup hook,
+      # which should populate GI_TYPELIB_PATH variable with paths
+      # to typelibs among the derivation’s dependencies.
+      # The resulting GI_TYPELIB_PATH should be picked up by the wrapper.
+      typelib-user-has-gi-typelib-path = let
+        tested = typelib-user;
+      in testLib.runTest "typelib-user-has-gi-typelib-path" ''
+        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GI_TYPELIB_PATH=" "${typelib-Mahjong}/lib/girepository-1.0"}
+        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GI_TYPELIB_PATH=" "${typelib-Mahjong}/lib/girepository-1.0"}
+      '';
+
+      # Simple derivation containing a gobject-introspection typelib in lib output.
+      typelib-Bechamel = stdenv.mkDerivation {
+        name = "typelib-Bechamel";
+
+        outputs = [ "out" "lib" ];
+
+        src = sample-project;
+
+        makeFlags = [
+          "LIBDIR=${placeholder "lib"}/lib"
+        ];
+
+        installFlags = [ "typelib-Bechamel" ];
+      };
+
+      # Simple derivation using a typelib from non-default output.
+      typelib-multiout-user = stdenv.mkDerivation {
+        name = "typelib-multiout-user";
+
+        src = sample-project;
+
+        nativeBuildInputs = [
+          gobject-introspection
+          wrapGAppsHook
+        ];
+
+        buildInputs = [
+          typelib-Bechamel
+        ];
+
+        installFlags = [ "bin-foo" "libexec-bar" ];
+      };
+
+      # Testing cooperation with gobject-introspection setup hook,
+      # which should populate GI_TYPELIB_PATH variable with paths
+      # to typelibs among the derivation’s dependencies,
+      # even when they are not in default output.
+      # The resulting GI_TYPELIB_PATH should be picked up by the wrapper.
+      typelib-multiout-user-has-gi-typelib-path = let
+        tested = typelib-multiout-user;
+      in testLib.runTest "typelib-multiout-user-has-gi-typelib-path" ''
+        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GI_TYPELIB_PATH=" "${typelib-Bechamel.lib}/lib/girepository-1.0"}
+        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GI_TYPELIB_PATH=" "${typelib-Bechamel.lib}/lib/girepository-1.0"}
+      '';
+
+      # Simple derivation that contains a typelib as well as a program using it.
+      typelib-self-user = stdenv.mkDerivation {
+        name = "typelib-self-user";
+
+        src = sample-project;
+
+        nativeBuildInputs = [
+          gobject-introspection
+          wrapGAppsHook
+        ];
+
+        installFlags = [ "typelib-Cow" "bin-foo" "libexec-bar" ];
+      };
+
+      # Testing cooperation with gobject-introspection setup hook,
+      # which should add the path to derivation’s own typelibs
+      # to GI_TYPELIB_PATH variable.
+      # The resulting GI_TYPELIB_PATH should be picked up by the wrapper.
+      # https://github.com/NixOS/nixpkgs/issues/85515
+      typelib-self-user-has-gi-typelib-path = let
+        tested = typelib-self-user;
+      in testLib.runTest "typelib-self-user-has-gi-typelib-path" ''
+        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GI_TYPELIB_PATH=" "${typelib-self-user}/lib/girepository-1.0"}
+        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GI_TYPELIB_PATH=" "${typelib-self-user}/lib/girepository-1.0"}
+      '';
+    };
+  };
+} ./wrap-gapps-hook.sh

pkgs/build-support/setup-hooks/wrap-gapps-hook/tests/lib.nix

@@ -0,0 +1,30 @@
+{ runCommand
+}:
+
+rec {
+  runTest = name: body: runCommand name { } ''
+    set -o errexit
+    ${body}
+    touch $out
+  '';
+
+  skip = cond: text:
+    if cond then ''
+      echo "Skipping test $name" > /dev/stderr
+    '' else text;
+
+  fail = text: ''
+    echo "FAIL: $name: ${text}" > /dev/stderr
+    exit 1
+  '';
+
+  expectSomeLineContainingYInFileXToMentionZ = file: filter: expected: ''
+    if ! cat "${file}" | grep "${filter}"; then
+        ${fail "The file “${file}” should include a line containing “${filter}”."}
+    fi
+
+    if ! cat "${file}" | grep "${filter}" | grep ${expected}; then
+        ${fail "The file “${file}” should include a line containing “${filter}” that also contains “${expected}”."}
+    fi
+  '';
+}

pkgs/build-support/setup-hooks/wrap-gapps-hook/tests/sample-project/Makefile

@@ -0,0 +1,30 @@
+PREFIX = $(out)
+BINDIR = $(PREFIX)/bin
+LIBEXECDIR = $(PREFIX)/libexec
+LIBDIR = $(PREFIX)/lib
+TYPELIBDIR = $(LIBDIR)/girepository-1.0
+
+all:
+	echo "Compiling…"
+install:
+	echo "Installing…"
+
+bin:
+	mkdir -p $(BINDIR)
+# Adds `bin-${foo}` targets, that install `${foo}` executable to `$(BINDIR)`.
+bin-%: bin
+	touch $(BINDIR)/$(@:bin-%=%)
+	chmod +x $(BINDIR)/$(@:bin-%=%)
+
+libexec:
+	mkdir -p $(LIBEXECDIR)
+# Adds `libexec-${foo}` targets, that install `${foo}` executable to `$(LIBEXECDIR)`.
+libexec-%: libexec
+	touch $(LIBEXECDIR)/$(@:libexec-%=%)
+	chmod +x $(LIBEXECDIR)/$(@:libexec-%=%)
+
+typelib:
+	mkdir -p $(TYPELIBDIR)
+# Adds `typelib-${foo}` targets, that install `${foo}-1.0.typelib` file to `$(TYPELIBDIR)`.
+typelib-%: typelib
+	touch $(TYPELIBDIR)/$(@:typelib-%=%)-1.0.typelib

pkgs/development/compilers/gcc/9/default.nix

@@ -31,6 +31,11 @@
 , buildPackages
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 # LTO needs libelf and zlib.
 assert libelf != null -> zlib != null;
 

pkgs/development/compilers/gcc/builder.sh

@@ -61,7 +61,7 @@ if test "$noSysDirs" = "1"; then
         if [[ -e "${!curCC}/nix-support/orig-libc" ]]; then
             # Figure out what extra compiling flags to pass to the gcc compilers
             # being generated to make sure that they use our libc.
-            extraFlags=($(< "${!curCC}/nix-support/libc-cflags"))
+            extraFlags=($(< "${!curCC}/nix-support/libc-crt1-cflags") $(< "${!curCC}/nix-support/libc-cflags"))
 
             # The path to the Libc headers
             libc_devdir="$(< "${!curCC}/nix-support/orig-libc-dev")"

pkgs/development/compilers/gcc/common/pre-configure.nix

@@ -17,3 +17,35 @@ lib.optionalString (hostPlatform.isSunOS && hostPlatform.is64bit) ''
 '' + lib.optionalString langAda ''
   export PATH=${gnatboot}/bin:$PATH
 ''
+
+# NOTE 2020/3/18: This environment variable prevents configure scripts from
+# detecting the presence of aligned_alloc on Darwin.  There are many facts that
+# collectively make this fix necessary:
+#  - Nix uses a fixed set of standard library headers on all MacOS systems,
+#    regardless of their actual version.  (Nix uses version 10.12 headers.)
+#  - Nix uses the native standard library binaries for the build system.  That
+#    means the standard library binaries may not exactly match the standard
+#    library headers.
+#  - The aligned_alloc procedure is present in MacOS 10.15 (Catalina), but not
+#    in earlier versions.  Therefore on Catalina systems, aligned_alloc is
+#    linkable (i.e. present in the binary libraries) but not present in the
+#    headers.
+#  - Configure scripts detect a procedure's existence by checking whether it is
+#    linkable.  They do not check whether it is present in the headers.
+#  - GCC throws an error during compilation because aligned_alloc is not
+#    defined in the headers---even though the linker can see it.
+#
+# This fix would not be necessary if ANY of the above were false:
+#  - If Nix used native headers for each different MacOS version, aligned_alloc
+#    would be in the headers on Catalina.
+#  - If Nix used the same libary binaries for each MacOS version, aligned_alloc
+#    would not be in the library binaries.
+#  - If Catalina did not include aligned_alloc, this wouldn't be a problem.
+#  - If the configure scripts looked for header presence as well as
+#    linkability, they would see that aligned_alloc is missing.
+#  - If GCC allowed implicit declaration of symbols, it would not fail during
+#    compilation even if the configure scripts did not check header presence.
+#
++ lib.optionalString (hostPlatform.isDarwin) ''
+  export ac_cv_func_aligned_alloc=no
+''

pkgs/development/compilers/llvm/10/clang/default.nix

@@ -27,6 +27,7 @@ let
     cmakeFlags = [
       "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
+      "-DLLVM_ENABLE_RTTI=ON"
     ] ++ stdenv.lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"

pkgs/development/compilers/llvm/5/clang/default.nix

@@ -27,6 +27,7 @@ let
 
     cmakeFlags = [
       "-DCMAKE_CXX_FLAGS=-std=c++11"
+      "-DLLVM_ENABLE_RTTI=ON"
     ] ++ stdenv.lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"

pkgs/development/compilers/llvm/6/clang/default.nix

@@ -27,6 +27,7 @@ let
 
     cmakeFlags = [
       "-DCMAKE_CXX_FLAGS=-std=c++11"
+      "-DLLVM_ENABLE_RTTI=ON"
     ] ++ stdenv.lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"

pkgs/development/compilers/llvm/7/clang/default.nix

@@ -27,6 +27,7 @@ let
 
     cmakeFlags = [
       "-DCMAKE_CXX_FLAGS=-std=c++11"
+      "-DLLVM_ENABLE_RTTI=ON"
     ] ++ stdenv.lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"

pkgs/development/compilers/llvm/8/clang/default.nix

@@ -28,6 +28,7 @@ let
     cmakeFlags = [
       "-DCMAKE_CXX_FLAGS=-std=c++11"
       "-DCLANGD_BUILD_XPC=OFF"
+      "-DLLVM_ENABLE_RTTI=ON"
     ] ++ stdenv.lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"

pkgs/development/compilers/llvm/9/clang/default.nix

@@ -28,6 +28,7 @@ let
     cmakeFlags = [
       "-DCMAKE_CXX_FLAGS=-std=c++11"
       "-DCLANGD_BUILD_XPC=OFF"
+      "-DLLVM_ENABLE_RTTI=ON"
     ] ++ stdenv.lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"

pkgs/development/compilers/rust/rustc.nix

@@ -1,6 +1,6 @@
 { stdenv, removeReferencesTo, pkgsBuildBuild, pkgsBuildHost, pkgsBuildTarget
 , fetchurl, file, python3
-, llvm_9, darwin, cmake, rust, rustPlatform
+, llvm_10, darwin, cmake, rust, rustPlatform
 , pkgconfig, openssl
 , which, libffi
 , withBundledLLVM ? false
@@ -14,12 +14,12 @@ let
   inherit (stdenv.lib) optionals optional optionalString;
   inherit (darwin.apple_sdk.frameworks) Security;
 
-  llvmSharedForBuild = pkgsBuildBuild.llvm_9.override { enableSharedLibraries = true; };
-  llvmSharedForHost = pkgsBuildHost.llvm_9.override { enableSharedLibraries = true; };
-  llvmSharedForTarget = pkgsBuildTarget.llvm_9.override { enableSharedLibraries = true; };
+  llvmSharedForBuild = pkgsBuildBuild.llvm_10.override { enableSharedLibraries = true; };
+  llvmSharedForHost = pkgsBuildHost.llvm_10.override { enableSharedLibraries = true; };
+  llvmSharedForTarget = pkgsBuildTarget.llvm_10.override { enableSharedLibraries = true; };
 
   # For use at runtime
-  llvmShared = llvm_9.override { enableSharedLibraries = true; };
+  llvmShared = llvm_10.override { enableSharedLibraries = true; };
 in stdenv.mkDerivation rec {
   pname = "rustc";
   inherit version;

pkgs/development/interpreters/perl/default.nix

@@ -2,6 +2,11 @@
 , enableThreading ? true, coreutils, makeWrapper
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 with lib;
 
 let

pkgs/development/interpreters/python/cpython/default.nix

@@ -36,6 +36,11 @@
 , enableOptimizations ? (!stdenv.isDarwin)
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 assert x11Support -> tcl != null
                   && tk != null
                   && xorgproto != null

pkgs/development/interpreters/python/default.nix

@@ -107,10 +107,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "8";
-      patch = "3";
+      patch = "5";
       suffix = "";
     };
-    sha256 = "0r2qg4pdvv52ld5dd95fl6lzzsxxxhbsxmymwcphh6624g3mxayz";
+    sha256 = "1c43dbv9lvlp3ynqmgdi4rh8q94swanhqarqrdx62zmigpakw073";
     inherit (darwin) configd;
     inherit passthruFun;
   };
@@ -121,9 +121,9 @@ in {
       major = "3";
       minor = "9";
       patch = "0";
-      suffix = "a4";
+      suffix = "b5";
     };
-    sha256 = "0qzy0wlq0izxk8ii28gy70v138g6xnz9sgsxpyayls2j04l6b5vz";
+    sha256 = "0r0m82srq4z44dahczd1cv6wgmxcpqbn5dyd8czcpk2pp9ydgqbc";
     inherit (darwin) configd;
     inherit passthruFun;
   };

pkgs/development/libraries/acl/default.nix

@@ -1,5 +1,10 @@
 { stdenv, fetchurl, gettext, attr }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   name = "acl-2.2.53";
 

pkgs/development/libraries/attr/default.nix

@@ -1,5 +1,10 @@
 { stdenv, fetchurl, gettext }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   name = "attr-2.4.48";
 
@@ -14,10 +19,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     # fix fakechroot: https://github.com/dex4er/fakechroot/issues/57
-    (fetchurl {
-      url = "https://git.savannah.nongnu.org/cgit/attr.git/patch/?id=14adc898a36948267bfe5c63b399996879e94c98";
-      sha256 = "0gja54fz79a9ma6b4mprnjxq77l5yg2z9xknlwhmkcrfnam02qxp";
-    })
+    ./syscall.patch
   ];
 
   postPatch = ''

pkgs/development/libraries/attr/syscall.patch

@@ -0,0 +1,120 @@
+From 14adc898a36948267bfe5c63b399996879e94c98 Mon Sep 17 00:00:00 2001
+From: Andreas Gruenbacher <agruenba@redhat.com>
+Date: Fri, 17 Aug 2018 14:07:31 +0200
+Subject: Switch back to syscall()
+
+Switch back to syscall() for the *xattr system calls.  The current
+mechanism of forwarding those calls to glibc breaks libraries like
+libfakeroot (fakeroot) and libasan (the gcc address sanitizer; gcc
+-fsanitize=address).
+
+Those libraries provide wrappers for functions defined in other shared
+libraries, usually glibc, do their own processing, and forward calls to
+the original symbols looke dup via dlsym(RTLD_NEXT, "symbol_name").  In
+our case, dlsym returns the libattr_*xattr wrappers.  However, when our
+wrappers try calling glibc, they end up calling the libfakeroot /
+libasan wrappers instead because those override the original symbols =>
+recursion.
+
+The libattr_*xattr wrappers will only be used when symbols are looked up
+at runtime (dlopen / dlsym).  Programs linking against libattr will
+directly use the glibc provided symbols.  Therefore, the slightly worse
+performance of syscall() won't affect any of the "normal" users of
+libattr.
+---
+ libattr/syscalls.c | 26 ++++++++++++++------------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/libattr/syscalls.c b/libattr/syscalls.c
+index 3013aa0..721ad7f 100644
+--- a/libattr/syscalls.c
++++ b/libattr/syscalls.c
+@@ -22,6 +22,8 @@
+ 
+ #include "config.h"
+ 
++#include <unistd.h>
++#include <sys/syscall.h>
+ #include <sys/xattr.h>
+ 
+ #ifdef HAVE_VISIBILITY_ATTRIBUTE
+@@ -31,67 +33,67 @@
+ int libattr_setxattr(const char *path, const char *name,
+ 		     void *value, size_t size, int flags)
+ {
+-	return setxattr(path, name, value, size, flags);
++	return syscall(__NR_setxattr, path, name, value, size, flags);
+ }
+ 
+ int libattr_lsetxattr(const char *path, const char *name,
+ 		      void *value, size_t size, int flags)
+ {
+-	return lsetxattr(path, name, value, size, flags);
++	return syscall(__NR_lsetxattr, path, name, value, size, flags);
+ }
+ 
+ int libattr_fsetxattr(int filedes, const char *name,
+ 		      void *value, size_t size, int flags)
+ {
+-	return fsetxattr(filedes, name, value, size, flags);
++	return syscall(__NR_fsetxattr, filedes, name, value, size, flags);
+ }
+ 
+ ssize_t libattr_getxattr(const char *path, const char *name,
+ 			 void *value, size_t size)
+ {
+-	return getxattr(path, name, value, size);
++	return syscall(__NR_getxattr, path, name, value, size);
+ }
+ 
+ ssize_t libattr_lgetxattr(const char *path, const char *name,
+ 			  void *value, size_t size)
+ {
+-	return lgetxattr(path, name, value, size);
++	return syscall(__NR_lgetxattr, path, name, value, size);
+ }
+ 
+ ssize_t libattr_fgetxattr(int filedes, const char *name,
+ 			  void *value, size_t size)
+ {
+-	return fgetxattr(filedes, name, value, size);
++	return syscall(__NR_fgetxattr, filedes, name, value, size);
+ }
+ 
+ ssize_t libattr_listxattr(const char *path, char *list, size_t size)
+ {
+-	return listxattr(path, list, size);
++	return syscall(__NR_listxattr, path, list, size);
+ }
+ 
+ ssize_t libattr_llistxattr(const char *path, char *list, size_t size)
+ {
+-	return llistxattr(path, list, size);
++	return syscall(__NR_llistxattr, path, list, size);
+ }
+ 
+ ssize_t libattr_flistxattr(int filedes, char *list, size_t size)
+ {
+-	return flistxattr(filedes, list, size);
++	return syscall(__NR_flistxattr, filedes, list, size);
+ }
+ 
+ int libattr_removexattr(const char *path, const char *name)
+ {
+-	return removexattr(path, name);
++	return syscall(__NR_removexattr, path, name);
+ }
+ 
+ int libattr_lremovexattr(const char *path, const char *name)
+ {
+-	return lremovexattr(path, name);
++	return syscall(__NR_lremovexattr, path, name);
+ }
+ 
+ int libattr_fremovexattr(int filedes, const char *name)
+ {
+-	return fremovexattr(filedes, name);
++	return syscall(__NR_fremovexattr, filedes, name);
+ }
+ 
+ #ifdef HAVE_VISIBILITY_ATTRIBUTE

pkgs/development/libraries/c-ares/default.nix

@@ -1,5 +1,10 @@
 { stdenv, fetchurl, writeTextDir }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 let self =
 stdenv.mkDerivation rec {
   name = "c-ares-1.15.0";

pkgs/development/libraries/expat/default.nix

@@ -1,5 +1,10 @@
 { stdenv, fetchurl }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   name = "expat-2.2.8";
 

pkgs/development/libraries/gcc/libstdc++/5.nix

@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
 
     # Figure out what extra flags to pass to the gcc compilers
     # being generated to make sure that they use our glibc.
-    EXTRA_FLAGS="-I$NIX_FIXINC_DUMMY $(cat $NIX_CC/nix-support/libc-cflags) -O2"
+    EXTRA_FLAGS="-I$NIX_FIXINC_DUMMY $(cat $NIX_CC/nix-support/libc-crt1-cflags) $(cat $NIX_CC/nix-support/libc-cflags) -O2"
 
     extraLDFlags="-L$glibc_libdir -rpath $glibc_libdir $(cat $NIX_BINTOOLS/nix-support/libc-ldflags) $(cat $NIX_BINTOOLS/nix-support/libc-ldflags-before)"
     for i in $extraLDFlags; do

pkgs/development/libraries/gettext/default.nix

@@ -1,5 +1,10 @@
 { stdenv, lib, fetchurl, libiconv, xz, fetchpatch }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   pname = "gettext";
   version = "0.20.1";

pkgs/development/libraries/glibc/common.nix

@@ -17,6 +17,11 @@
   but the exact set depends on the library version and the configuration.
 */
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 { stdenv, lib
 , buildPackages
 , fetchurl

pkgs/development/libraries/gmp/6.x.nix

@@ -3,6 +3,11 @@
 , buildPackages
 , withStatic ? false }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 let inherit (stdenv.lib) optional; in
 
 let self = stdenv.mkDerivation rec {

pkgs/development/libraries/harfbuzz/default.nix

@@ -1,4 +1,5 @@
 { stdenv, fetchurl, pkgconfig, glib, freetype, cairo, libintl
+, gobject-introspection
 , icu, graphite2, harfbuzz # The icu variant uses and propagates the non-icu one.
 , ApplicationServices, CoreText
 , withCoreText ? false
@@ -36,10 +37,16 @@ stdenv.mkDerivation {
     # not auto-detected by default
     "--with-graphite2=${if withGraphite2 then "yes" else "no"}"
     "--with-icu=${if withIcu then "yes" else "no"}"
+    "--with-gobject=yes"
+    "--enable-introspection=yes"
   ]
     ++ stdenv.lib.optional withCoreText "--with-coretext=yes";
 
-  nativeBuildInputs = [ pkgconfig libintl ];
+  nativeBuildInputs = [
+    gobject-introspection
+    libintl
+    pkgconfig
+  ];
 
   buildInputs = [ glib freetype cairo ] # recommended by upstream
     ++ stdenv.lib.optionals withCoreText [ ApplicationServices CoreText ];

pkgs/development/libraries/kerberos/krb5.nix

@@ -8,6 +8,11 @@
 , staticOnly ? false
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 let
   libOnly = type == "lib";
 in

pkgs/development/libraries/libelf/default.nix

@@ -2,6 +2,11 @@
 , fetchurl, autoreconfHook, gettext
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   name = "libelf-0.8.13";
 

pkgs/development/libraries/libev/default.nix

@@ -1,5 +1,10 @@
 { stdenv, fetchurl, static ? false }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   pname = "libev";
   version="4.33";

pkgs/development/libraries/libffi/default.nix

@@ -3,6 +3,11 @@
 
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   name = "libffi-3.3";
 

pkgs/development/libraries/libglvnd/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libglvnd";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "libglvnd";
     rev = "v${version}";
-    sha256 = "0mkzdzdxjxjl794rblq4mq33wmb8ikqmfswbqdbr8gw2kw4wlhdl";
+    sha256 = "10x7fgb114r4gikdg6flszl3kwzcb9y5qa7sj9936mk0zxhjaylz";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig python3 addOpenGLRunpath ];

pkgs/development/libraries/libidn/default.nix

@@ -1,11 +1,11 @@
 { fetchurl, stdenv, libiconv }:
 
 stdenv.mkDerivation rec {
-  name = "libidn-1.35";
+  name = "libidn-1.36";
 
   src = fetchurl {
     url = "mirror://gnu/libidn/${name}.tar.gz";
-    sha256 = "07pyy0afqikfq51z5kbzbj9ldbd12mri0zvx0mfv3ds6bc0g26pi";
+    sha256 = "0f20n634whpmdwr81c2r0vxxjwchgkvhsr1i8s2bm0ad6h473dhl";
   };
 
   outputs = [ "bin" "dev" "out" "info" "devdoc" ];

pkgs/development/libraries/libidn2/default.nix

@@ -1,5 +1,10 @@
 { fetchurl, stdenv, libiconv, libunistring, help2man, buildPackages }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 with stdenv.lib;
 
 stdenv.mkDerivation rec {

pkgs/development/libraries/libjpeg-turbo/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, cmake, nasm, enableStatic ? false }:
+{ stdenv, fetchurl, fetchpatch, cmake, nasm, enableStatic ? false, enableShared ? true }:
 
 stdenv.mkDerivation rec {
 
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DENABLE_STATIC=${if enableStatic then "1" else "0"}"
+    "-DENABLE_SHARED=${if enableShared then "1" else "0"}"
   ];
 
   doInstallCheck = true;

pkgs/development/libraries/libmicrohttpd/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmicrohttpd";
-  version = "0.9.70";
+  version = "0.9.71";
 
   src = fetchurl {
     url = "mirror://gnu/libmicrohttpd/${pname}-${version}.tar.gz";
-    sha256 = "01vkjy89b1ylmh22dy5yza2r414nfwcfixxh3v29nvzrjv9s7l4h";
+    sha256 = "10mii4mifmfs3v7kgciqml7f0fj7ljp0sngrx64pnwmgbzl4bx78";
   };
 
   outputs = [ "out" "dev" "devdoc" "info" ];

pkgs/development/libraries/libmpc/default.nix

@@ -2,6 +2,11 @@
 , gmp, mpfr
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 let
   version = "1.1.0";
 in

pkgs/development/libraries/libunistring/default.nix

@@ -1,5 +1,10 @@
 { fetchurl, stdenv, libiconv }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   pname = "libunistring";
   version = "0.9.10";

pkgs/development/libraries/libuv/default.nix

@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
         "tcp_open" "tcp_write_queue_order" "tcp_try_write" "tcp_writealot"
         "multiple_listen" "delayed_accept"
         "shutdown_close_tcp" "shutdown_eof" "shutdown_twice" "callback_stack"
-        "tty_pty" "condvar_5" "hrtime"
+        "tty_pty" "condvar_5" "hrtime" "udp_multicast_join"
         # Tests that fail when sandboxing is enabled.
         "fs_event_close_in_callback" "fs_event_watch_dir" "fs_event_error_reporting"
         "fs_event_watch_dir_recursive" "fs_event_watch_file"

pkgs/development/libraries/mesa/default.nix

@@ -31,7 +31,7 @@ with stdenv.lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "20.1.3";
+  version = "20.1.4";
   branch  = versions.major version;
 in
 
@@ -46,7 +46,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "1w9b6sl82a3birmpgzn1xx6biggpvynr4hmyzxvj30pfdgabhwlq";
+    sha256 = "1zlrczmmkcy42w332rfmlicihlnrxmkrnkpb21sl98725cf2f038";
   };
 
   prePatch = "patchShebangs .";
@@ -58,6 +58,7 @@ stdenv.mkDerivation {
     ./missing-includes.patch # dev_t needs sys/stat.h, time_t needs time.h, etc.-- fixes build w/musl
     ./opencl-install-dir.patch
     ./disk_cache-include-dri-driver-path-in-cache-key.patch
+    ./link-radv-with-ld_args_build_id.patch
   ] # do not prefix user provided dri-drivers-path
     ++ lib.optional (lib.versionOlder version "19.0.0") (fetchpatch {
       url = "https://gitlab.freedesktop.org/mesa/mesa/commit/f6556ec7d126b31da37c08d7cb657250505e01a0.patch";

pkgs/development/libraries/mesa/link-radv-with-ld_args_build_id.patch

@@ -0,0 +1,26 @@
+From 00f3c6d1b771c11ecc08c3d8bd793a51d6e64166 Mon Sep 17 00:00:00 2001
+From: David McFarland <corngood@gmail.com>
+Date: Sun, 26 Jul 2020 17:29:49 -0300
+Subject: [PATCH] link radv with ld_args_build_id
+
+This is needed for radv_device_get_cache_uuid to work correctly.
+---
+ src/amd/vulkan/meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/amd/vulkan/meson.build b/src/amd/vulkan/meson.build
+index efcf2dd6c89..590f286b8cb 100644
+--- a/src/amd/vulkan/meson.build
++++ b/src/amd/vulkan/meson.build
+@@ -173,7 +173,7 @@ libvulkan_radeon = shared_library(
+   ],
+   c_args : [c_vis_args, no_override_init_args, radv_flags],
+   cpp_args : [cpp_vis_args, radv_flags],
+-  link_args : [ld_args_bsymbolic, ld_args_gc_sections],
++  link_args : [ld_args_build_id, ld_args_bsymbolic, ld_args_gc_sections],
+   install : true,
+ )
+ 
+-- 
+2.27.0
+

pkgs/development/libraries/mpfr/default.nix

@@ -1,5 +1,10 @@
 { stdenv, fetchurl, gmp }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   version = "4.0.2";
   pname = "mpfr";

pkgs/development/libraries/nghttp2/default.nix

@@ -12,6 +12,11 @@
 , enablePython ? false, python ? null, cython ? null, ncurses ? null, setuptools ? null
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 assert enableHpack -> jansson != null;
 assert enableAsioLib -> boost != null;
 assert enableGetAssets -> libxml2 != null;

pkgs/development/libraries/nspr/default.nix

@@ -2,7 +2,7 @@
 , CoreServices ? null
 , buildPackages }:
 
-let version = "4.26"; in
+let version = "4.27"; in
 
 stdenv.mkDerivation {
   pname = "nspr";
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://mozilla/nspr/releases/v${version}/src/nspr-${version}.tar.gz";
-    sha256 = "0gbp3g9p4nhf0zrlvqi5883sqb9zdw0wk83lccpgskxphlni97gw";
+    sha256 = "16z82qc1l4cqn66p59ai0dy9ycllywn4jlxhip1a605bns952jbd";
   };
 
   patches = [

pkgs/development/libraries/nss/default.nix

@@ -5,7 +5,7 @@ let
     url = "http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz";
     sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
   };
-  version = "3.54";
+  version = "3.55";
   underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
 
 in stdenv.mkDerivation rec {
@@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "0hvfip056pl07h6w91i6fyji5nczrrsxyr56rls7jd2yryzqpcfs";
+    sha256 = "0100hm7n1xrp144xy665z46s0wf1jpkqkncc6bk2w22snhyjwsgw";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];

pkgs/development/libraries/openssl/default.nix

@@ -5,6 +5,11 @@
 , static ? false
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 with stdenv.lib;
 
 let

pkgs/development/libraries/pango/default.nix

@@ -9,15 +9,26 @@ with stdenv.lib;
 
 let
   pname = "pango";
-  version = "1.44.7";
+  version = "1.45.3";
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "07qvxa2sk90chp1l12han6vxvy098mc37sdqcznyywyv2g6bd9b6";
+    sha256 = "0zg6gvzk227q997jf1c9p7j5ra87nm008hlgq6q8na9xmgmw2x8z";
   };
 
+  patches = [
+    # Fix issue with Pango loading unsupported formats that
+    # breaks mixed x11/opentype font packages.
+    # See https://gitlab.gnome.org/GNOME/pango/issues/457
+    # Remove on next release.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/pango/commit/fe1ee773310bac83d8e5d3c062b13a51fb5fb4ad.patch";
+      sha256 = "1px66g31l2jx4baaqi4md59wlmvw0ywgspn6zr919fxl4h1kkh0h";
+    })
+  ];
+
   # FIXME: docs fail on darwin
   outputs = [ "bin" "dev" "out" ] ++ optional (!stdenv.isDarwin) "devdoc";
 

pkgs/development/libraries/science/math/or-tools/default.nix

@@ -1,20 +1,16 @@
 { stdenv, fetchFromGitHub, cmake, abseil-cpp, gflags, which
-, lsb-release, glog, protobuf3_11, cbc, zlib
+, lsb-release, glog, protobuf, cbc, zlib
 , ensureNewerSourcesForZipFilesHook, python, swig }:
 
-let
-  protobuf = protobuf3_11;
-  pythonProtobuf = python.pkgs.protobuf.override { inherit protobuf; };
-
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "or-tools";
-  version = "7.6";
+  version = "7.7";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "or-tools";
     rev = "v${version}";
-    sha256 = "0605q3y7vh7x7m9azrbkx44blq12zrab6v28b9wmpcn1lmykbw1b";
+    sha256 = "06ig9a1afmzgzcg817y0rdq49ahll0q9y7bhhg9d89x6zy959ypv";
   };
 
   # The original build system uses cmake which does things like pull
@@ -33,7 +29,7 @@ in stdenv.mkDerivation rec {
 
   makeFlags = [
     "prefix=${placeholder "out"}"
-    "PROTOBUF_PYTHON_DESC=${pythonProtobuf}/${python.sitePackages}/google/protobuf/descriptor_pb2.py"
+    "PROTOBUF_PYTHON_DESC=${python.pkgs.protobuf}/${python.sitePackages}/google/protobuf/descriptor_pb2.py"
   ];
   buildFlags = [ "cc" "pypi_archive" ];
 
@@ -54,7 +50,7 @@ in stdenv.mkDerivation rec {
   ];
   propagatedBuildInputs = [
     abseil-cpp gflags glog protobuf cbc
-    pythonProtobuf python.pkgs.six
+    python.pkgs.protobuf python.pkgs.six
   ];
 
   enableParallelBuilding = true;

pkgs/development/libraries/zlib/default.nix

@@ -12,6 +12,11 @@
 , splitStaticOutput ? static
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 assert splitStaticOutput -> static;
 
 stdenv.mkDerivation (rec {

pkgs/development/python-modules/Cython/default.nix

@@ -26,11 +26,11 @@ let
 
 in buildPythonPackage rec {
   pname = "Cython";
-  version = "0.29.19";
+  version = "0.29.21";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0n2j87nka8cs772qc60d0c7lrpvsw0y8p3qzvhrsi3nmq1yqmycp";
+    sha256 = "1bcwpra7c6k30yvic3sw2v3rq2dr40ypc4zqif6kr52mpn4wnyp5";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/cirq/default.nix

@@ -10,7 +10,7 @@
 , networkx
 , numpy
 , pandas
-, pythonProtobuf  # pythonPackages.protobuf
+, protobuf
 , requests
 , scipy
 , sortedcontainers
@@ -28,15 +28,15 @@
 
 buildPythonPackage rec {
   pname = "cirq";
-  version = "0.8.0";
+  version = "0.8.2";
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "quantumlib";
     repo = "cirq";
     rev = "v${version}";
-    sha256 = "01nnv7r595sp60wvp7750lfdjwdsi4q0r4lmaj6li09zsdw0r4b3";
+    sha256 = "0xs46s19idh8smf80zhgraxwh3lphcdbljdrhxwhi5xcc41dfsmf";
   };
 
   patches = [
@@ -48,14 +48,6 @@ buildPythonPackage rec {
     })
   ];
 
-  # Cirq locks protobuf==3.8.0, but tested working with default pythonPackages.protobuf (3.7). This avoids overrides/pythonPackages.protobuf conflicts
-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace "networkx~=2.4" "networkx" \
-      --replace "protobuf==3.8.0" "protobuf" \
-      --replace "freezegun~=0.3.15" "freezegun"
-  '';
-
   propagatedBuildInputs = [
     freezegun
     google_api_core
@@ -63,7 +55,7 @@ buildPythonPackage rec {
     matplotlib
     networkx
     pandas
-    pythonProtobuf
+    protobuf
     requests
     scipy
     sortedcontainers

pkgs/development/python-modules/cryptography/default.nix

@@ -22,11 +22,11 @@
 
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "2.9.2"; # Also update the hash in vectors.nix
+  version = "3.0"; # Also update the hash in vectors.nix
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a0c30272fb4ddda5f5ffc1089d7405b7a71b0b0f51993cb4e5dbb4590b2fc229";
+    sha256 = "0lr06a9317n2iwfqwz9mpalqm99acqwk1478arvyj1jj0ay4v4lf";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/python-modules/cryptography/vectors.nix

@@ -7,7 +7,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1d4iykcv7cn9j399hczlxm5pzxmqy6d80h3j16dkjwlmv3293b4r";
+    sha256 = "0fa26ggksyhknb43cja1g0jwp35qkdbavivdq6yynj1igd2z1vsj";
   };
 
   # No tests included

pkgs/development/python-modules/dbus/default.nix

@@ -3,14 +3,14 @@
 
 buildPythonPackage rec {
   pname = "dbus-python";
-  version = "1.2.12";
+  version = "1.2.16";
   format = "other";
 
   outputs = [ "out" "dev" ];
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0q7jmldv0bxxqnbj63cd7i81vs6y85xys4r0n63z4n2y9wndxm6d";
+    sha256 = "196m5rk3qzw5nkmgzjl7wmq0v7vpwfhh8bz2sapdi5f9hqfqy8qi";
   };
 
   patches = [

pkgs/development/python-modules/decorator/default.nix

@@ -1,25 +1,17 @@
 { lib
 , buildPythonPackage
-, fetchpatch
 , fetchPypi
 }:
 
 buildPythonPackage rec {
   pname = "decorator";
-  version = "4.4.1";
+  version = "4.4.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "54c38050039232e1db4ad7375cfce6748d7b41c29e95a081c8a6d2c30364a2ce";
+    sha256 = "1rxzhk5zwiggk45hl53zydvy70lk654kg0nc1p54090p402jz9p3";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/micheles/decorator/commit/3265f2755d16c0a3dfc9f1feee39722ddc11ee80.patch";
-      sha256 = "1q5nmff30vccqq5swf2ivm8cn7x3lhz8c9qpj0zddgs2y7fw8syz";
-    })
-  ];
-
   meta = with lib; {
     homepage = "https://pypi.python.org/pypi/decorator";
     description = "Better living through Python with decorators";

pkgs/development/python-modules/lxml/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchFromGitHub
+{ lib, buildPythonPackage, fetchFromGitHub
 , cython
 , libxml2
 , libxslt
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "lxml";
-  version = "4.5.0";
+  version = "4.5.2";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "1i3bhg8xb502afq4ar3kgvvi1hy83l4af2gznfwqvb5b221fr7ak";
+    sha256 = "1d0cpwdjxfzwjzmnz066ibzicyj2vhx15qxmm775l8hxqi65xps4";
   };
 
   # setuptoolsBuildPhase needs dependencies to be passed through nativeBuildInputs
@@ -25,7 +25,7 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "lxml" "lxml.etree" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Pythonic binding for the libxml2 and libxslt libraries";
     homepage = "https://lxml.de";
     license = licenses.bsd3;

pkgs/development/python-modules/pybind11/0001-Find-include-directory.patch

@@ -1,53 +0,0 @@
-From a027e2590d5d2d384d23568a8d47b7095054b6b7 Mon Sep 17 00:00:00 2001
-From: Frederik Rietdijk <fridh@fridh.nl>
-Date: Thu, 19 Dec 2019 19:51:07 +0100
-Subject: [PATCH] Find include directory
-
----
- pybind11/__init__.py | 33 +--------------------------------
- 1 file changed, 1 insertion(+), 32 deletions(-)
-
-diff --git a/pybind11/__init__.py b/pybind11/__init__.py
-index c625e8c..c8a707b 100644
---- a/pybind11/__init__.py
-+++ b/pybind11/__init__.py
-@@ -2,35 +2,4 @@ from ._version import version_info, __version__  # noqa: F401 imported but unuse
- 
- 
- def get_include(user=False):
--    from distutils.dist import Distribution
--    import os
--    import sys
--
--    # Are we running in a virtual environment?
--    virtualenv = hasattr(sys, 'real_prefix') or \
--        sys.prefix != getattr(sys, "base_prefix", sys.prefix)
--
--    # Are we running in a conda environment?
--    conda = os.path.exists(os.path.join(sys.prefix, 'conda-meta'))
--
--    if virtualenv:
--        return os.path.join(sys.prefix, 'include', 'site',
--                            'python' + sys.version[:3])
--    elif conda:
--        if os.name == 'nt':
--            return os.path.join(sys.prefix, 'Library', 'include')
--        else:
--            return os.path.join(sys.prefix, 'include')
--    else:
--        dist = Distribution({'name': 'pybind11'})
--        dist.parse_config_files()
--
--        dist_cobj = dist.get_command_obj('install', create=True)
--
--        # Search for packages in user's home directory?
--        if user:
--            dist_cobj.user = user
--            dist_cobj.prefix = ""
--        dist_cobj.finalize_options()
--
--        return os.path.dirname(dist_cobj.install_headers)
-+    return "@include@"
--- 
-2.23.0
-

pkgs/development/python-modules/pybind11/default.nix

@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.4.3";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0k89w4bsfbpzw963ykg1cyszi3h3nk393qd31m6y46pcfxkqh4rd";
+    sha256 = "13hcj6g7k7yvj7nry2ar6f5mg58ln7frrvq1cg5f8mczxh1ch6zl";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -40,14 +40,6 @@ buildPythonPackage rec {
   dontUsePipInstall = true;
   dontUseSetuptoolsCheck = true;
 
-  patches = [
-    ./0001-Find-include-directory.patch
-  ];
-
-  postPatch = ''
-    substituteInPlace pybind11/__init__.py --subst-var-by include "$out/include"
-  '';
-
   preFixup = ''
     pushd ..
     export PYBIND11_USE_CMAKE=1
@@ -65,7 +57,7 @@ buildPythonPackage rec {
     scipy
   ];
 
-  meta = {
+  meta = with lib; {
     homepage = "https://github.com/pybind/pybind11";
     description = "Seamless operability between C++11 and Python";
     longDescription = ''
@@ -73,7 +65,7 @@ buildPythonPackage rec {
       C++ types in Python and vice versa, mainly to create Python
       bindings of existing C++ code.
     '';
-    license = lib.licenses.bsd3;
-    maintainers = [ lib.maintainers.yuriaisaka ];
+    license = licenses.bsd3;
+    maintainers = with maintainers;[ yuriaisaka ];
   };
 }

pkgs/development/python-modules/pygobject/3.nix

@@ -3,13 +3,13 @@ pycairo, cairo, which, ncurses, meson, ninja, isPy3k, gnome3 }:
 
 buildPythonPackage rec {
   pname = "pygobject";
-  version = "3.36.0";
+  version = "3.36.1";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1vysyr586mfjm7biraw1nynpw4f1qajynkm6m40ybadsnpgx50w6";
+    sha256 = "0b9CgC0c7BE7Wtqg579/N0W0RSHcIWNYjSdtXNYdcY8=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/python-modules/typed-ast/default.nix

@@ -1,12 +1,12 @@
 { buildPythonPackage, fetchFromGitHub, lib, pythonOlder }:
 buildPythonPackage rec {
   pname = "typed-ast";
-  version = "1.4.0";
+  version = "1.4.1";
   src = fetchFromGitHub{
     owner = "python";
     repo = "typed_ast";
     rev = version;
-    sha256 = "0l0hz809f7i356kmqkvfsaswiidb98j9hs9rrjnfawzqcbffzgyb";
+    sha256 = "086r9qhls6mz1w72a6d1ld3m4fbkxklf6mgwbs8wpw0zlxjm7y40";
   };
   # Only works with Python 3.3 and newer;
   disabled = pythonOlder "3.3";

pkgs/development/tools/analysis/valgrind/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, perl, gdb, cctools, xnu, bootstrap_cmds }:
 
 stdenv.mkDerivation rec {
-  name = "valgrind-3.15.0";
+  name = "valgrind-3.16.1";
 
   src = fetchurl {
     url = "https://sourceware.org/pub/valgrind/${name}.tar.bz2";
-    sha256 = "1ccawxrni8brcvwhygy12iprkvz409hbr9xkk1bd03gnm2fplz21";
+    sha256 = "1jik19rcd34ip8a5c9nv5wfj8k8maqb8cyclr4xhznq2gcpkl7y9";
   };
 
   outputs = [ "out" "dev" "man" "doc" ];

pkgs/development/tools/build-managers/cmake/application-services.patch

@@ -1,11 +1,8 @@
 diff --git a/Source/CMakeLists.txt b/Source/CMakeLists.txt
-index 8aff8f6..af1852d 100644
+index 1b6bb00d4c..487114daa8 100644
 --- a/Source/CMakeLists.txt
 +++ b/Source/CMakeLists.txt
-@@ -791,12 +791,11 @@ if(CMAKE_SYSTEM_NAME STREQUAL "Linux" AND CMAKE_SYSTEM_PROCESSOR MATCHES "sparc"
-   endif()
- endif()
- 
+@@ -893,7 +893,6 @@ endif()
  # On Apple we need CoreFoundation and CoreServices
  if(APPLE)
    target_link_libraries(CMakeLib "-framework CoreFoundation")
@@ -13,13 +10,11 @@ index 8aff8f6..af1852d 100644
  endif()
  
  if(WIN32 AND NOT UNIX)
-   # We need the rpcrt4 library on Windows.
-   # We need the crypt32 library on Windows for crypto/cert APIs.
 diff --git a/Source/cmGlobalXCodeGenerator.cxx b/Source/cmGlobalXCodeGenerator.cxx
-index e353a37..b06f842 100644
+index a5ce5d18f4..3d6838ce82 100644
 --- a/Source/cmGlobalXCodeGenerator.cxx
 +++ b/Source/cmGlobalXCodeGenerator.cxx
-@@ -35,11 +35,6 @@
+@@ -43,11 +43,6 @@
  
  struct cmLinkImplementation;
  
@@ -32,12 +27,12 @@ index e353a37..b06f842 100644
  #  include "cmXMLParser.h"
  
 diff --git a/Utilities/cmlibarchive/CMakeLists.txt b/Utilities/cmlibarchive/CMakeLists.txt
-index d7af6e2..d4808fc 100644
+index bfcaf30bb7..1da540aee5 100644
 --- a/Utilities/cmlibarchive/CMakeLists.txt
 +++ b/Utilities/cmlibarchive/CMakeLists.txt
-@@ -1662,11 +1662,6 @@ IF(MSVC)
-   ADD_DEFINITIONS(-D_CRT_SECURE_NO_DEPRECATE)
- ENDIF(MSVC)
+@@ -2007,11 +2007,6 @@ IF(ENABLE_TEST)
+ ENDIF(ENABLE_TEST)
+ ENDIF()
  
 -# We need CoreServices on Mac OS.
 -IF(APPLE)
@@ -45,16 +40,5 @@ index d7af6e2..d4808fc 100644
 -ENDIF(APPLE)
 -
  add_subdirectory(libarchive)
- 
- install(FILES COPYING DESTINATION ${CMAKE_DOC_DIR}/cmlibarchive)
-index e505bdd..f45557d 100644
---- a/Utilities/cmlibuv/src/unix/darwin-proctitle.c
-+++ b/Utilities/cmlibuv/src/unix/darwin-proctitle.c
-@@ -30,7 +30,6 @@
-
- #if !TARGET_OS_IPHONE
- # include <CoreFoundation/CoreFoundation.h>
--# include <ApplicationServices/ApplicationServices.h>
- #endif
-
- #define S(s) pCFStringCreateWithCString(NULL, (s), kCFStringEncodingUTF8)
+ IF(0) # CMake does not build libarchive's command-line tools.
+ add_subdirectory(cat)

pkgs/development/tools/build-managers/cmake/default.nix

@@ -19,12 +19,12 @@ stdenv.mkDerivation rec {
           + lib.optionalString useNcurses "-cursesUI"
           + lib.optionalString withQt5 "-qt5UI"
           + lib.optionalString useQt4 "-qt4UI";
-  version = "3.17.3";
+  version = "3.18.0";
 
   src = fetchurl {
     url = "${meta.homepage}files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
     # compare with https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}-SHA-256.txt
-    sha256 = "0h4c3nwk7wmzcmmlwyb16zmjqr44l4k591m2y9p9zp3m498hvmhb";
+    sha256 = "0aby67jn3i0rqhj6cvpm0f7idw3dl7jayaqxa9hkk9w2jk5zzd43";
   };
 
   patches = [

pkgs/development/tools/build-managers/cmake/libuv-application-services.patch

@@ -1,7 +1,8 @@
-diff -ur cmake-3.12.1/Utilities/cmlibuv/CMakeLists.txt cmake-3.12.1-patched/Utilities/cmlibuv/CMakeLists.txt
---- cmake-3.12.1/Utilities/cmlibuv/CMakeLists.txt	2018-08-09 21:14:08.000000000 +0900
-+++ cmake-3.12.1-patched/Utilities/cmlibuv/CMakeLists.txt	2018-08-13 10:14:53.000000000 +0900
-@@ -173,6 +173,22 @@
+diff --git a/Utilities/cmlibuv/CMakeLists.txt b/Utilities/cmlibuv/CMakeLists.txt
+index 7625cf65d9..167903e309 100644
+--- a/Utilities/cmlibuv/CMakeLists.txt
++++ b/Utilities/cmlibuv/CMakeLists.txt
+@@ -193,6 +193,22 @@ if(CMAKE_SYSTEM_NAME STREQUAL "Darwin")
      src/unix/kqueue.c
      src/unix/proctitle.c
      )
@@ -24,9 +25,10 @@ diff -ur cmake-3.12.1/Utilities/cmlibuv/CMakeLists.txt cmake-3.12.1-patched/Util
  endif()
  
  if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
-diff -ur cmake-3.12.1/Utilities/cmlibuv/src/unix/fsevents.c cmake-3.12.1-patched/Utilities/cmlibuv/src/unix/fsevents.c
---- cmake-3.12.1/Utilities/cmlibuv/src/unix/fsevents.c	2018-08-09 21:14:08.000000000 +0900
-+++ cmake-3.12.1-patched/Utilities/cmlibuv/src/unix/fsevents.c	2018-08-13 10:01:29.000000000 +0900
+diff --git a/Utilities/cmlibuv/src/unix/fsevents.c b/Utilities/cmlibuv/src/unix/fsevents.c
+index a51f29b3f6..3f6bf01968 100644
+--- a/Utilities/cmlibuv/src/unix/fsevents.c
++++ b/Utilities/cmlibuv/src/unix/fsevents.c
 @@ -21,7 +21,7 @@
  #include "uv.h"
  #include "internal.h"
@@ -35,17 +37,17 @@ diff -ur cmake-3.12.1/Utilities/cmlibuv/src/unix/fsevents.c cmake-3.12.1-patched
 +#if !HAVE_CORESERVICES_CORESERVICES_H || MAC_OS_X_VERSION_MAX_ALLOWED < 1070
  
  /* iOS (currently) doesn't provide the FSEvents-API (nor CoreServices) */
- 
-@@ -38,7 +38,7 @@
+ /* macOS prior to 10.7 doesn't provide the full FSEvents API so use kqueue */
+@@ -39,7 +39,7 @@ int uv__fsevents_close(uv_fs_event_t* handle) {
  void uv__fsevents_loop_delete(uv_loop_t* loop) {
  }
  
 -#else /* TARGET_OS_IPHONE */
 +#else /* !HAVE_CORESERVICES_CORESERVICES_H */
  
- #include <dlfcn.h>
- #include <assert.h>
-@@ -916,4 +916,4 @@
+ #include "darwin-stub.h"
+ 
+@@ -920,4 +920,4 @@ int uv__fsevents_close(uv_fs_event_t* handle) {
    return 0;
  }
  

pkgs/development/tools/build-managers/cmake/search-path.patch

@@ -1,9 +1,10 @@
-diff -ur cmake-3.9.1/Modules/Platform/UnixPaths.cmake cmake-3.9.1-mod/Modules/Platform/UnixPaths.cmake
---- cmake-3.9.1/Modules/Platform/UnixPaths.cmake	2017-08-10 13:36:32.000000000 +0000
-+++ cmake-3.9.1-mod/Modules/Platform/UnixPaths.cmake	2017-09-03 01:24:31.901473539 +0000
-@@ -22,9 +22,6 @@
- # List common installation prefixes.  These will be used for all
- # search types.
+diff --git a/Modules/Platform/UnixPaths.cmake b/Modules/Platform/UnixPaths.cmake
+index b9381c3d7d..cecc40a89e 100644
+--- a/Modules/Platform/UnixPaths.cmake
++++ b/Modules/Platform/UnixPaths.cmake
+@@ -26,9 +26,6 @@ get_filename_component(_CMAKE_INSTALL_DIR "${_CMAKE_INSTALL_DIR}" PATH)
+ # please make sure to keep Help/variable/CMAKE_SYSTEM_PREFIX_PATH.rst
+ # synchronized
  list(APPEND CMAKE_SYSTEM_PREFIX_PATH
 -  # Standard
 -  /usr/local /usr /
@@ -11,7 +12,7 @@ diff -ur cmake-3.9.1/Modules/Platform/UnixPaths.cmake cmake-3.9.1-mod/Modules/Pl
    # CMake install location
    "${_CMAKE_INSTALL_DIR}"
    )
-@@ -43,31 +40,26 @@
+@@ -47,24 +44,19 @@ endif()
  
  # Non "standard" but common install prefixes
  list(APPEND CMAKE_SYSTEM_PREFIX_PATH
@@ -39,12 +40,7 @@ diff -ur cmake-3.9.1/Modules/Platform/UnixPaths.cmake cmake-3.9.1-mod/Modules/Pl
    )
  
  if(CMAKE_SYSROOT_COMPILE)
-   set(_cmake_sysroot_compile "${CMAKE_SYSROOT_COMPILE}")
- else()
-   set(_cmake_sysroot_compile "${CMAKE_SYSROOT}")
- endif()
- 
- # Default per-language values.  These may be later replaced after
+@@ -77,15 +69,15 @@ endif()
  # parsing the implicit directory information from compiler output.
  set(_CMAKE_C_IMPLICIT_INCLUDE_DIRECTORIES_INIT
    ${CMAKE_C_IMPLICIT_INCLUDE_DIRECTORIES}
@@ -62,11 +58,12 @@ diff -ur cmake-3.9.1/Modules/Platform/UnixPaths.cmake cmake-3.9.1-mod/Modules/Pl
 +  @libc_dev@/include
    )
  
- # Enable use of lib32 and lib64 search path variants by default.
-diff -ur cmake-3.9.1/Modules/Platform/WindowsPaths.cmake cmake-3.9.1-mod/Modules/Platform/WindowsPaths.cmake
---- cmake-3.9.1/Modules/Platform/WindowsPaths.cmake	2017-08-10 13:36:32.000000000 +0000
-+++ cmake-3.9.1-mod/Modules/Platform/WindowsPaths.cmake	2017-09-03 01:19:32.808355986 +0000
-@@ -66,7 +66,7 @@
+ unset(_cmake_sysroot_compile)
+diff --git a/Modules/Platform/WindowsPaths.cmake b/Modules/Platform/WindowsPaths.cmake
+index b9e2f17979..ab517cd4a7 100644
+--- a/Modules/Platform/WindowsPaths.cmake
++++ b/Modules/Platform/WindowsPaths.cmake
+@@ -70,7 +70,7 @@ endif()
  
  if(CMAKE_CROSSCOMPILING AND NOT CMAKE_HOST_SYSTEM_NAME MATCHES "Windows")
    # MinGW (useful when cross compiling from linux with CMAKE_FIND_ROOT_PATH set)

pkgs/development/tools/misc/autoconf/default.nix

@@ -1,5 +1,10 @@
 { stdenv, fetchurl, m4, perl }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   name = "autoconf-2.69";
 

pkgs/development/tools/misc/binutils/default.nix

@@ -10,6 +10,11 @@
 , texinfo
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 let
   reuseLibs = enableShared && withAllTargets;
 

pkgs/development/tools/misc/gnum4/default.nix

@@ -1,5 +1,10 @@
 { stdenv, fetchurl }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation {
   name = "gnum4-1.4.18";
 

pkgs/development/tools/misc/help2man/default.nix

@@ -1,5 +1,10 @@
 { stdenv, fetchurl, perlPackages, gettext }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   name = "help2man-1.47.16";
 

pkgs/development/tools/misc/libtool/default.nix

@@ -1,5 +1,10 @@
 {stdenv, fetchurl, m4, perl}:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   name = "libtool-1.5.26";
 

pkgs/development/tools/misc/patchelf/default.nix

@@ -1,5 +1,10 @@
 { stdenv, fetchurl }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   name = "patchelf-0.11";
 

pkgs/development/tools/misc/texinfo/common.nix

@@ -6,6 +6,11 @@
 , interactive ? false, ncurses, procps
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 let
   crossBuildTools = interactive && stdenv.hostPlatform != stdenv.buildPlatform;
 in

pkgs/development/tools/parsing/bison/default.nix

@@ -1,5 +1,10 @@
 { stdenv, fetchurl, m4, perl, help2man }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   pname = "bison";
   version = "3.6.4";

pkgs/development/web/nodejs/v14.nix

@@ -1,9 +1,8 @@
-{ callPackage, openssl, icu67, python3, enableNpm ? true }:
+{ callPackage, openssl, python3, enableNpm ? true }:
 
 let
   buildNodejs = callPackage ./nodejs.nix {
     inherit openssl;
-    icu = icu67;
     python = python3;
   };
 in

pkgs/os-specific/linux/kernel/generic.nix

@@ -53,6 +53,11 @@
 , ...
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 assert stdenv.isLinux;
 
 let

pkgs/os-specific/linux/keyutils/default.nix

@@ -1,5 +1,10 @@
 { stdenv, fetchurl }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   pname = "keyutils";
   version = "1.6.1";

pkgs/os-specific/linux/systemd/default.nix

@@ -1,7 +1,7 @@
 { stdenv, lib, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap
 , curl, kmod, gnupg, gnutar, xz, pam, acl, libuuid, m4, utillinux, libffi
 , glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libidn2, libapparmor
-, audit, lz4, bzip2, libmicrohttpd, pcre2
+, audit, lz4, bzip2, pcre2
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
 , iptables, gnu-efi, bashInteractive
 , gettext, docbook_xsl, docbook_xml_dtd_42, docbook_xml_dtd_45
@@ -90,7 +90,7 @@ in stdenv.mkDerivation {
   buildInputs =
     [ linuxHeaders libcap curl.dev kmod xz pam acl
       /* cryptsetup */ libuuid glib libgcrypt libgpgerror libidn2
-      libmicrohttpd pcre2 ] ++
+      pcre2 ] ++
       stdenv.lib.optional withKexectools kexectools ++
       stdenv.lib.optional withLibseccomp libseccomp ++
     [ libffi audit lz4 bzip2 libapparmor
@@ -120,6 +120,7 @@ in stdenv.mkDerivation {
     "-Dhostnamed=true"
     "-Dnetworkd=true"
     "-Dportabled=false"
+    "-Dremote=false"
     "-Dsysusers=false"
     "-Dtimedated=true"
     "-Dtimesyncd=true"

pkgs/os-specific/linux/v4l-utils/default.nix

@@ -12,11 +12,11 @@ let
 # we need to use stdenv.mkDerivation in order not to pollute the libv4l’s closure with Qt
 in stdenv.mkDerivation rec {
   pname = "v4l-utils";
-  version = "1.18.1";
+  version = "1.20.0";
 
   src = fetchurl {
     url = "https://linuxtv.org/downloads/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "0hpkqm2bpg1ma2shjzcf6xsrpyjd8h5cakgh8a3iyh126wjl5z15";
+    sha256 = "1xr66y6w422hil6s7n8d61a2vhwh4im8l267amf41jvw7xqihqcm";
   };
 
   outputs = [ "out" ] ++ lib.optional withUtils "lib" ++ [ "dev" ];

pkgs/servers/samba/4.x.nix

@@ -42,11 +42,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "samba";
-  version = "4.12.3";
+  version = "4.12.5";
 
   src = fetchurl {
     url = "mirror://samba/pub/samba/stable/${pname}-${version}.tar.gz";
-    sha256 = "09w7aap1cjc41ayhaksm1igc7p7gl40fad4a1l6q4ds9a2jbrb9z";
+    sha256 = "05dqj5l3spa8ggw0agxa5rf8fwgiizbmbfjms46y5jla6z31rd2l";
   };
 
   outputs = [ "out" "dev" "man" ];

pkgs/servers/x11/xorg/overrides.nix

@@ -105,7 +105,7 @@ self: super:
         rm -rf $out/share/doc
       '';
     CPP = stdenv.lib.optionalString stdenv.isDarwin "clang -E -";
-    propagatedBuildInputs = [ self.xorgproto ];
+    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ self.xorgproto ];
   });
 
   libAppleWM = super.libAppleWM.overrideAttrs (attrs: {
@@ -117,7 +117,7 @@ self: super:
 
   libXau = super.libXau.overrideAttrs (attrs: {
     outputs = [ "out" "dev" ];
-    propagatedBuildInputs = [ self.xorgproto ];
+    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ self.xorgproto ];
   });
 
   libXdmcp = super.libXdmcp.overrideAttrs (attrs: {
@@ -126,7 +126,7 @@ self: super:
 
   libXfont = super.libXfont.overrideAttrs (attrs: {
     outputs = [ "out" "dev" ];
-    propagatedBuildInputs = [ freetype ]; # propagate link reqs. like bzip2
+    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ freetype ]; # propagate link reqs. like bzip2
     # prevents "misaligned_stack_error_entering_dyld_stub_binder"
     configureFlags = lib.optional isDarwin "CFLAGS=-O0";
   });
@@ -136,6 +136,22 @@ self: super:
     configureFlags = attrs.configureFlags or []
       ++ malloc0ReturnsNullCrossFlag;
   });
+  libXxf86dga = super.libXxf86dga.overrideAttrs (attrs: {
+    configureFlags = attrs.configureFlags or []
+      ++ malloc0ReturnsNullCrossFlag;
+  });
+  libXxf86misc = super.libXxf86misc.overrideAttrs (attrs: {
+    configureFlags = attrs.configureFlags or []
+      ++ malloc0ReturnsNullCrossFlag;
+  });
+  libdmx = super.libdmx.overrideAttrs (attrs: {
+    configureFlags = attrs.configureFlags or []
+      ++ malloc0ReturnsNullCrossFlag;
+  });
+  xdpyinfo = super.xdpyinfo.overrideAttrs (attrs: {
+    configureFlags = attrs.configureFlags or []
+      ++ malloc0ReturnsNullCrossFlag;
+  });
 
   # Propagate some build inputs because of header file dependencies.
   # Note: most of these are in Requires.private, so maybe builder.sh
@@ -146,7 +162,7 @@ self: super:
     '';
     configureFlags = attrs.configureFlags or []
       ++ malloc0ReturnsNullCrossFlag;
-    propagatedBuildInputs = [ self.libSM ];
+    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ self.libSM ];
     depsBuildBuild = [ buildPackages.stdenv.cc ];
     CPP = if stdenv.isDarwin then "clang -E -" else "${stdenv.cc.targetPrefix}cc -E -";
     outputs = [ "out" "dev" "devdoc" ];
@@ -166,12 +182,12 @@ self: super:
 
   libXcomposite = super.libXcomposite.overrideAttrs (attrs: {
     outputs = [ "out" "dev" ];
-    propagatedBuildInputs = [ self.libXfixes ];
+    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ self.libXfixes ];
   });
 
   libXaw = super.libXaw.overrideAttrs (attrs: {
     outputs = [ "out" "dev" "devdoc" ];
-    propagatedBuildInputs = [ self.libXmu ];
+    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ self.libXmu ];
   });
 
   libXcursor = super.libXcursor.overrideAttrs (attrs: {
@@ -184,7 +200,7 @@ self: super:
 
   libXft = super.libXft.overrideAttrs (attrs: {
     outputs = [ "out" "dev" ];
-    propagatedBuildInputs = [ self.libXrender freetype fontconfig ];
+    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ self.libXrender freetype fontconfig ];
     configureFlags = attrs.configureFlags or []
       ++ malloc0ReturnsNullCrossFlag;
 
@@ -208,7 +224,7 @@ self: super:
 
   libXext = super.libXext.overrideAttrs (attrs: {
     outputs = [ "out" "dev" "man" "doc" ];
-    propagatedBuildInputs = [ self.xorgproto self.libXau ];
+    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ self.xorgproto self.libXau ];
     configureFlags = attrs.configureFlags or []
       ++ malloc0ReturnsNullCrossFlag;
   });
@@ -219,7 +235,7 @@ self: super:
 
   libXi = super.libXi.overrideAttrs (attrs: {
     outputs = [ "out" "dev" "man" "doc" ];
-    propagatedBuildInputs = [ self.libXfixes ];
+    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ self.libXfixes ];
     configureFlags = stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
       "xorg_cv_malloc0_returns_null=no";
   });
@@ -239,19 +255,19 @@ self: super:
     outputs = [ "out" "dev" ];
     configureFlags = attrs.configureFlags or []
       ++ malloc0ReturnsNullCrossFlag;
-    propagatedBuildInputs = [self.libXrender];
+    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ self.libXrender ];
   });
 
   libSM = super.libSM.overrideAttrs (attrs: {
     outputs = [ "out" "dev" "doc" ];
-    propagatedBuildInputs = [ self.libICE ];
+    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ self.libICE ];
   });
 
   libXrender = super.libXrender.overrideAttrs (attrs: {
     outputs = [ "out" "dev" "doc" ];
     configureFlags = attrs.configureFlags or []
       ++ malloc0ReturnsNullCrossFlag;
-    propagatedBuildInputs = [ self.xorgproto ];
+    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ self.xorgproto ];
   });
 
   libXres = super.libXres.overrideAttrs (attrs: {
@@ -319,7 +335,7 @@ self: super:
   });
 
   utilmacros = super.utilmacros.overrideAttrs (attrs: { # not needed for releases, we propagate the needed tools
-    propagatedBuildInputs = [ automake autoconf libtool ];
+    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ automake autoconf libtool ];
   });
 
   x11perf = super.x11perf.overrideAttrs (attrs: {
@@ -558,6 +574,7 @@ self: super:
 
   xorgproto = super.xorgproto.overrideAttrs (attrs: {
     buildInputs = [];
+    propagatedBuildInputs = [];
     nativeBuildInputs = attrs.nativeBuildInputs ++ [ meson ninja ];
     # adds support for printproto needed for libXp
     mesonFlags = [ "-Dlegacy=true" ];
@@ -626,7 +643,7 @@ self: super:
       then {
         outputs = [ "out" "dev" ];
         buildInputs = commonBuildInputs ++ [ libdrm mesa ];
-        propagatedBuildInputs = [ libpciaccess epoxy ] ++ commonPropagatedBuildInputs ++ lib.optionals stdenv.isLinux [
+        propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ libpciaccess epoxy ] ++ commonPropagatedBuildInputs ++ lib.optionals stdenv.isLinux [
           udev
         ];
         prePatch = stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
@@ -755,7 +772,7 @@ self: super:
       "--with-launchdaemons-dir=\${out}/LaunchDaemons"
       "--with-launchagents-dir=\${out}/LaunchAgents"
     ];
-    propagatedBuildInputs = [ self.xauth ]
+    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ self.xauth ]
                          ++ lib.optionals isDarwin [ self.libX11 self.xorgproto ];
     prePatch = ''
       sed -i 's|^defaultserverargs="|&-logfile \"$HOME/.xorg.log\"|p' startx.cpp

pkgs/shells/bash/4.4.nix

@@ -12,6 +12,11 @@ assert interactive -> readline70 != null;
 assert withDocs -> texinfo != null;
 assert stdenv.hostPlatform.isDarwin -> binutils != null;
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 let
   upstreamPatches = import ./bash-4.4-patches.nix (nr: sha256: fetchurl {
     url = "mirror://gnu/bash/bash-4.4-patches/bash44-${nr}";

pkgs/test/cc-wrapper/default.nix

@@ -45,6 +45,14 @@ in stdenv.mkDerivation {
     NIX_LDFLAGS="-L$NIX_BUILD_TOP/foo/lib -rpath $NIX_BUILD_TOP/foo/lib" $CC -lfoo -o ldflags-check ${./ldflags-main.c}
     ./ldflags-check
 
+    printf "Check whether -nostdinc and -nostdinc++ is handled correctly" >&2
+    mkdir -p std-include
+    cp ${./stdio.h} std-include/stdio.h
+    NIX_DEBUG=1 $CC -I std-include -nostdinc -o nostdinc-main ${./nostdinc-main.c}
+    ./nostdinc-main
+    $CXX -I std-include -nostdinc++ -o nostdinc-main++ ${./nostdinc-main.c}
+    ./nostdinc-main++
+
     ${optionalString sanitizersWorking ''
       printf "checking whether sanitizers are fully functional... ">&2
       $CC -o sanitizers -fsanitize=address,undefined ${./sanitizers.c}

pkgs/test/cc-wrapper/nostdinc-main.c

@@ -0,0 +1,8 @@
+// This one should not come from libc because of -nostdinc
+#include <stdio.h>
+
+int main(int argc, char *argv[]) {
+  // provided by our own stdio.h
+  foo();
+  return 0;
+}

pkgs/test/cc-wrapper/stdio.h

@@ -0,0 +1 @@
+static void foo(void) {}

pkgs/tools/archivers/gnutar/default.nix

@@ -1,5 +1,10 @@
 { stdenv, fetchurl, autoreconfHook, acl }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   pname = "gnutar";
   version = "1.32";

pkgs/tools/compression/bzip2/default.nix

@@ -3,6 +3,11 @@
 , autoreconfHook
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   pname = "bzip2";
   version = "1.0.6.0.1";

pkgs/tools/compression/gzip/default.nix

@@ -4,6 +4,11 @@
 , writeText
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   pname = "gzip";
   version = "1.10";

pkgs/tools/compression/lzip/default.nix

@@ -1,5 +1,10 @@
 { stdenv, fetchurl, texinfo }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   pname = "lzip";
   version = "1.21";