From afe30350283655f2ab4dce016c93ee4fc11ce987 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Thu, 16 Dec 2021 00:06:21 +0000
Subject: [PATCH 01/23] python3Packages.lxml: 4.6.3 -> 4.6.5

---
 pkgs/development/python-modules/lxml/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index 984219b802b7..70d1b207bd92 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "lxml";
-  version = "4.6.3";
+  version = "4.6.5";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "1rhkv75qr4ij3653l97sy752gyp6f20sxfpiqp1vp08fpy47q8qn";
+    sha256 = "1j3fqz44jc7dga1yyrdfkpn569al72jcs6bbhb7swq12wc8jwbnm";
   };
 
   # setuptoolsBuildPhase needs dependencies to be passed through nativeBuildInputs

From 02fbc90fbbaf931d673409a7e5ed1bb9ccbd65fd Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 14 Dec 2021 18:10:59 +0100
Subject: [PATCH 02/23] openssl_1_1: 1.1.1l -> 1.1.1m

(cherry picked from commit 29f216c48a011569dd5282b8df1776ca86238ceb)
---
 pkgs/development/libraries/openssl/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index e9935317cdf0..14eebcea2201 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -192,15 +192,15 @@ in {
   };
 
   openssl_1_1 = common {
-    version = "1.1.1l";
-    sha256 = "sha256-C3o+XlnDSCf+DDp0t+yLrvMCuY+oAIjX+RU6oW+na9E=";
+    version = "1.1.1m";
+    sha256 = "sha256-+JGZvosjykX8fLnx2NPuZzEjGChq0DD1MWrKZGLbbJY=";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
       (if stdenv.hostPlatform.isDarwin
        then ./use-etc-ssl-certs-darwin.patch
        else ./use-etc-ssl-certs.patch)
-    ] ++ lib.optionals (stdenv.isDarwin) [
+    ] ++ lib.optionals (stdenv.isDarwin && (builtins.substring 5 5 version) < "m") [
       ./1.1/macos-yosemite-compat.patch
     ];
     withDocs = true;

From 0263955500269401774f35f9fefd98fb3cb2ee9e Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Wed, 1 Dec 2021 20:35:57 -0800
Subject: [PATCH 03/23] llvmPackages_*.llvm: fix llvm-config-native with static
 libs

Since both static and shared libs are installed to the same `lib`
output, we override the ActiveLibDir unconditionally.

Fixes `llvm-config-native --link-static --libs`

(cherry picked from commit 544707d6a4170ad747d42174654cc08baa53bc56)
---
 .../compilers/llvm/10/llvm/default.nix           |  2 +-
 .../compilers/llvm/10/llvm/outputs.patch         | 16 +++-------------
 .../compilers/llvm/11/llvm/default.nix           |  2 +-
 .../compilers/llvm/11/llvm/outputs.patch         | 16 +++-------------
 .../compilers/llvm/12/llvm/default.nix           |  2 +-
 .../compilers/llvm/12/llvm/outputs.patch         | 16 +++-------------
 .../compilers/llvm/13/llvm/default.nix           |  2 +-
 .../compilers/llvm/13/llvm/outputs.patch         | 16 +++-------------
 .../compilers/llvm/5/llvm/default.nix            |  2 +-
 .../compilers/llvm/5/llvm/outputs.patch          | 16 +++-------------
 .../compilers/llvm/6/llvm/default.nix            |  2 +-
 .../compilers/llvm/6/llvm/outputs.patch          | 16 +++-------------
 .../compilers/llvm/7/llvm/default.nix            |  2 +-
 .../compilers/llvm/7/llvm/outputs.patch          | 16 +++-------------
 .../compilers/llvm/8/llvm/default.nix            |  2 +-
 .../compilers/llvm/8/llvm/outputs.patch          | 16 +++-------------
 .../compilers/llvm/9/llvm/default.nix            |  2 +-
 .../compilers/llvm/9/llvm/outputs.patch          | 16 +++-------------
 .../compilers/llvm/git/llvm/default.nix          |  2 +-
 .../compilers/llvm/git/llvm/outputs.patch        | 16 +++-------------
 .../compilers/llvm/rocm/llvm/outputs.patch       | 16 +++-------------
 21 files changed, 43 insertions(+), 153 deletions(-)

diff --git a/pkgs/development/compilers/llvm/10/llvm/default.nix b/pkgs/development/compilers/llvm/10/llvm/default.nix
index 4e590dba4337..413de2f868a3 100644
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@@ -81,7 +81,7 @@ in stdenv.mkDerivation (rec {
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + optionalString (enableSharedLibraries) ''
+  + ''
     substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
     patch -p1 < ./outputs.patch
   '' + ''
diff --git a/pkgs/development/compilers/llvm/10/llvm/outputs.patch b/pkgs/development/compilers/llvm/10/llvm/outputs.patch
index 40096fa3497f..878460e05b8a 100644
--- a/pkgs/development/compilers/llvm/10/llvm/outputs.patch
+++ b/pkgs/development/compilers/llvm/10/llvm/outputs.patch
@@ -2,23 +2,13 @@ diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.c
 index 94d426b..37f7794 100644
 --- a/tools/llvm-config/llvm-config.cpp
 +++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,21 @@ int main(int argc, char **argv) {
+@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
      ActiveIncludeOption = "-I" + ActiveIncludeDir;
    }
  
-+  /// Nix-specific multiple-output handling: override ActiveLibDir if --link-shared
++  /// Nix-specific multiple-output handling: override ActiveLibDir
 +  if (!IsInDevelopmentTree) {
-+    bool WantShared = true;
-+    for (int i = 1; i < argc; ++i) {
-+      StringRef Arg = argv[i];
-+      if (Arg == "--link-shared")
-+        WantShared = true;
-+      else if (Arg == "--link-static")
-+        WantShared = false; // the last one wins
-+    }
-+
-+    if (WantShared)
-+      ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
++    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
 +  }
 +
    /// We only use `shared library` mode in cases where the static library form
diff --git a/pkgs/development/compilers/llvm/11/llvm/default.nix b/pkgs/development/compilers/llvm/11/llvm/default.nix
index f0148850dbe8..32981b9d4dde 100644
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@@ -73,7 +73,7 @@ in stdenv.mkDerivation (rec {
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + optionalString (enableSharedLibraries) ''
+  + ''
     substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
     patch -p1 < ./outputs.patch
   '' + ''
diff --git a/pkgs/development/compilers/llvm/11/llvm/outputs.patch b/pkgs/development/compilers/llvm/11/llvm/outputs.patch
index 40096fa3497f..878460e05b8a 100644
--- a/pkgs/development/compilers/llvm/11/llvm/outputs.patch
+++ b/pkgs/development/compilers/llvm/11/llvm/outputs.patch
@@ -2,23 +2,13 @@ diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.c
 index 94d426b..37f7794 100644
 --- a/tools/llvm-config/llvm-config.cpp
 +++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,21 @@ int main(int argc, char **argv) {
+@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
      ActiveIncludeOption = "-I" + ActiveIncludeDir;
    }
  
-+  /// Nix-specific multiple-output handling: override ActiveLibDir if --link-shared
++  /// Nix-specific multiple-output handling: override ActiveLibDir
 +  if (!IsInDevelopmentTree) {
-+    bool WantShared = true;
-+    for (int i = 1; i < argc; ++i) {
-+      StringRef Arg = argv[i];
-+      if (Arg == "--link-shared")
-+        WantShared = true;
-+      else if (Arg == "--link-static")
-+        WantShared = false; // the last one wins
-+    }
-+
-+    if (WantShared)
-+      ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
++    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
 +  }
 +
    /// We only use `shared library` mode in cases where the static library form
diff --git a/pkgs/development/compilers/llvm/12/llvm/default.nix b/pkgs/development/compilers/llvm/12/llvm/default.nix
index 30a1a7a16df8..bb5676b9d48e 100644
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/12/llvm/default.nix
@@ -74,7 +74,7 @@ in stdenv.mkDerivation (rec {
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + optionalString (enableSharedLibraries) ''
+  + ''
     substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
     patch -p1 < ./outputs.patch
   '' + ''
diff --git a/pkgs/development/compilers/llvm/12/llvm/outputs.patch b/pkgs/development/compilers/llvm/12/llvm/outputs.patch
index 40096fa3497f..878460e05b8a 100644
--- a/pkgs/development/compilers/llvm/12/llvm/outputs.patch
+++ b/pkgs/development/compilers/llvm/12/llvm/outputs.patch
@@ -2,23 +2,13 @@ diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.c
 index 94d426b..37f7794 100644
 --- a/tools/llvm-config/llvm-config.cpp
 +++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,21 @@ int main(int argc, char **argv) {
+@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
      ActiveIncludeOption = "-I" + ActiveIncludeDir;
    }
  
-+  /// Nix-specific multiple-output handling: override ActiveLibDir if --link-shared
++  /// Nix-specific multiple-output handling: override ActiveLibDir
 +  if (!IsInDevelopmentTree) {
-+    bool WantShared = true;
-+    for (int i = 1; i < argc; ++i) {
-+      StringRef Arg = argv[i];
-+      if (Arg == "--link-shared")
-+        WantShared = true;
-+      else if (Arg == "--link-static")
-+        WantShared = false; // the last one wins
-+    }
-+
-+    if (WantShared)
-+      ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
++    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
 +  }
 +
    /// We only use `shared library` mode in cases where the static library form
diff --git a/pkgs/development/compilers/llvm/13/llvm/default.nix b/pkgs/development/compilers/llvm/13/llvm/default.nix
index 957f29e44994..115b56396e8d 100644
--- a/pkgs/development/compilers/llvm/13/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/13/llvm/default.nix
@@ -68,7 +68,7 @@ in stdenv.mkDerivation (rec {
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + optionalString (enableSharedLibraries) ''
+  + ''
     substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
     patch -p1 < ./outputs.patch
   '' + ''
diff --git a/pkgs/development/compilers/llvm/13/llvm/outputs.patch b/pkgs/development/compilers/llvm/13/llvm/outputs.patch
index 40096fa3497f..878460e05b8a 100644
--- a/pkgs/development/compilers/llvm/13/llvm/outputs.patch
+++ b/pkgs/development/compilers/llvm/13/llvm/outputs.patch
@@ -2,23 +2,13 @@ diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.c
 index 94d426b..37f7794 100644
 --- a/tools/llvm-config/llvm-config.cpp
 +++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,21 @@ int main(int argc, char **argv) {
+@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
      ActiveIncludeOption = "-I" + ActiveIncludeDir;
    }
  
-+  /// Nix-specific multiple-output handling: override ActiveLibDir if --link-shared
++  /// Nix-specific multiple-output handling: override ActiveLibDir
 +  if (!IsInDevelopmentTree) {
-+    bool WantShared = true;
-+    for (int i = 1; i < argc; ++i) {
-+      StringRef Arg = argv[i];
-+      if (Arg == "--link-shared")
-+        WantShared = true;
-+      else if (Arg == "--link-static")
-+        WantShared = false; // the last one wins
-+    }
-+
-+    if (WantShared)
-+      ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
++    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
 +  }
 +
    /// We only use `shared library` mode in cases where the static library form
diff --git a/pkgs/development/compilers/llvm/5/llvm/default.nix b/pkgs/development/compilers/llvm/5/llvm/default.nix
index 6388cd65fbf4..a4d2fec36193 100644
--- a/pkgs/development/compilers/llvm/5/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/5/llvm/default.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation ({
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + optionalString (enableSharedLibraries) ''
+  + ''
     substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
     patch -p1 < ./outputs.patch
   '' + ''
diff --git a/pkgs/development/compilers/llvm/5/llvm/outputs.patch b/pkgs/development/compilers/llvm/5/llvm/outputs.patch
index 40096fa3497f..878460e05b8a 100644
--- a/pkgs/development/compilers/llvm/5/llvm/outputs.patch
+++ b/pkgs/development/compilers/llvm/5/llvm/outputs.patch
@@ -2,23 +2,13 @@ diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.c
 index 94d426b..37f7794 100644
 --- a/tools/llvm-config/llvm-config.cpp
 +++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,21 @@ int main(int argc, char **argv) {
+@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
      ActiveIncludeOption = "-I" + ActiveIncludeDir;
    }
  
-+  /// Nix-specific multiple-output handling: override ActiveLibDir if --link-shared
++  /// Nix-specific multiple-output handling: override ActiveLibDir
 +  if (!IsInDevelopmentTree) {
-+    bool WantShared = true;
-+    for (int i = 1; i < argc; ++i) {
-+      StringRef Arg = argv[i];
-+      if (Arg == "--link-shared")
-+        WantShared = true;
-+      else if (Arg == "--link-static")
-+        WantShared = false; // the last one wins
-+    }
-+
-+    if (WantShared)
-+      ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
++    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
 +  }
 +
    /// We only use `shared library` mode in cases where the static library form
diff --git a/pkgs/development/compilers/llvm/6/llvm/default.nix b/pkgs/development/compilers/llvm/6/llvm/default.nix
index 0907c8956171..1c010980048c 100644
--- a/pkgs/development/compilers/llvm/6/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/6/llvm/default.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation ({
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + optionalString (enableSharedLibraries) ''
+  + ''
     substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
     patch -p1 < ./outputs.patch
   '' + ''
diff --git a/pkgs/development/compilers/llvm/6/llvm/outputs.patch b/pkgs/development/compilers/llvm/6/llvm/outputs.patch
index 40096fa3497f..878460e05b8a 100644
--- a/pkgs/development/compilers/llvm/6/llvm/outputs.patch
+++ b/pkgs/development/compilers/llvm/6/llvm/outputs.patch
@@ -2,23 +2,13 @@ diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.c
 index 94d426b..37f7794 100644
 --- a/tools/llvm-config/llvm-config.cpp
 +++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,21 @@ int main(int argc, char **argv) {
+@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
      ActiveIncludeOption = "-I" + ActiveIncludeDir;
    }
  
-+  /// Nix-specific multiple-output handling: override ActiveLibDir if --link-shared
++  /// Nix-specific multiple-output handling: override ActiveLibDir
 +  if (!IsInDevelopmentTree) {
-+    bool WantShared = true;
-+    for (int i = 1; i < argc; ++i) {
-+      StringRef Arg = argv[i];
-+      if (Arg == "--link-shared")
-+        WantShared = true;
-+      else if (Arg == "--link-static")
-+        WantShared = false; // the last one wins
-+    }
-+
-+    if (WantShared)
-+      ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
++    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
 +  }
 +
    /// We only use `shared library` mode in cases where the static library form
diff --git a/pkgs/development/compilers/llvm/7/llvm/default.nix b/pkgs/development/compilers/llvm/7/llvm/default.nix
index 4a9b4f518205..ac6efaccb865 100644
--- a/pkgs/development/compilers/llvm/7/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/7/llvm/default.nix
@@ -76,7 +76,7 @@ in stdenv.mkDerivation ({
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + optionalString (enableSharedLibraries) ''
+  + ''
     substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
     patch -p1 < ./outputs.patch
   '' + ''
diff --git a/pkgs/development/compilers/llvm/7/llvm/outputs.patch b/pkgs/development/compilers/llvm/7/llvm/outputs.patch
index 40096fa3497f..878460e05b8a 100644
--- a/pkgs/development/compilers/llvm/7/llvm/outputs.patch
+++ b/pkgs/development/compilers/llvm/7/llvm/outputs.patch
@@ -2,23 +2,13 @@ diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.c
 index 94d426b..37f7794 100644
 --- a/tools/llvm-config/llvm-config.cpp
 +++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,21 @@ int main(int argc, char **argv) {
+@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
      ActiveIncludeOption = "-I" + ActiveIncludeDir;
    }
  
-+  /// Nix-specific multiple-output handling: override ActiveLibDir if --link-shared
++  /// Nix-specific multiple-output handling: override ActiveLibDir
 +  if (!IsInDevelopmentTree) {
-+    bool WantShared = true;
-+    for (int i = 1; i < argc; ++i) {
-+      StringRef Arg = argv[i];
-+      if (Arg == "--link-shared")
-+        WantShared = true;
-+      else if (Arg == "--link-static")
-+        WantShared = false; // the last one wins
-+    }
-+
-+    if (WantShared)
-+      ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
++    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
 +  }
 +
    /// We only use `shared library` mode in cases where the static library form
diff --git a/pkgs/development/compilers/llvm/8/llvm/default.nix b/pkgs/development/compilers/llvm/8/llvm/default.nix
index 83b779b56d82..48a434b24c7c 100644
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@@ -79,7 +79,7 @@ in stdenv.mkDerivation ({
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + optionalString (enableSharedLibraries) ''
+  + ''
     substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
     patch -p1 < ./outputs.patch
   '' + ''
diff --git a/pkgs/development/compilers/llvm/8/llvm/outputs.patch b/pkgs/development/compilers/llvm/8/llvm/outputs.patch
index 40096fa3497f..878460e05b8a 100644
--- a/pkgs/development/compilers/llvm/8/llvm/outputs.patch
+++ b/pkgs/development/compilers/llvm/8/llvm/outputs.patch
@@ -2,23 +2,13 @@ diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.c
 index 94d426b..37f7794 100644
 --- a/tools/llvm-config/llvm-config.cpp
 +++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,21 @@ int main(int argc, char **argv) {
+@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
      ActiveIncludeOption = "-I" + ActiveIncludeDir;
    }
  
-+  /// Nix-specific multiple-output handling: override ActiveLibDir if --link-shared
++  /// Nix-specific multiple-output handling: override ActiveLibDir
 +  if (!IsInDevelopmentTree) {
-+    bool WantShared = true;
-+    for (int i = 1; i < argc; ++i) {
-+      StringRef Arg = argv[i];
-+      if (Arg == "--link-shared")
-+        WantShared = true;
-+      else if (Arg == "--link-static")
-+        WantShared = false; // the last one wins
-+    }
-+
-+    if (WantShared)
-+      ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
++    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
 +  }
 +
    /// We only use `shared library` mode in cases where the static library form
diff --git a/pkgs/development/compilers/llvm/9/llvm/default.nix b/pkgs/development/compilers/llvm/9/llvm/default.nix
index 570795824ee5..a569c00071de 100644
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@@ -77,7 +77,7 @@ in stdenv.mkDerivation (rec {
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + optionalString (enableSharedLibraries) ''
+  + ''
     substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
     patch -p1 < ./outputs.patch
   '' + ''
diff --git a/pkgs/development/compilers/llvm/9/llvm/outputs.patch b/pkgs/development/compilers/llvm/9/llvm/outputs.patch
index 40096fa3497f..878460e05b8a 100644
--- a/pkgs/development/compilers/llvm/9/llvm/outputs.patch
+++ b/pkgs/development/compilers/llvm/9/llvm/outputs.patch
@@ -2,23 +2,13 @@ diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.c
 index 94d426b..37f7794 100644
 --- a/tools/llvm-config/llvm-config.cpp
 +++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,21 @@ int main(int argc, char **argv) {
+@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
      ActiveIncludeOption = "-I" + ActiveIncludeDir;
    }
  
-+  /// Nix-specific multiple-output handling: override ActiveLibDir if --link-shared
++  /// Nix-specific multiple-output handling: override ActiveLibDir
 +  if (!IsInDevelopmentTree) {
-+    bool WantShared = true;
-+    for (int i = 1; i < argc; ++i) {
-+      StringRef Arg = argv[i];
-+      if (Arg == "--link-shared")
-+        WantShared = true;
-+      else if (Arg == "--link-static")
-+        WantShared = false; // the last one wins
-+    }
-+
-+    if (WantShared)
-+      ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
++    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
 +  }
 +
    /// We only use `shared library` mode in cases where the static library form
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index daf4cfe808b6..4c895f81dbba 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -60,7 +60,7 @@ in stdenv.mkDerivation (rec {
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + optionalString (enableSharedLibraries) ''
+  + ''
     substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
     patch -p1 < ./outputs.patch
   '' + ''
diff --git a/pkgs/development/compilers/llvm/git/llvm/outputs.patch b/pkgs/development/compilers/llvm/git/llvm/outputs.patch
index 40096fa3497f..878460e05b8a 100644
--- a/pkgs/development/compilers/llvm/git/llvm/outputs.patch
+++ b/pkgs/development/compilers/llvm/git/llvm/outputs.patch
@@ -2,23 +2,13 @@ diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.c
 index 94d426b..37f7794 100644
 --- a/tools/llvm-config/llvm-config.cpp
 +++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,21 @@ int main(int argc, char **argv) {
+@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
      ActiveIncludeOption = "-I" + ActiveIncludeDir;
    }
  
-+  /// Nix-specific multiple-output handling: override ActiveLibDir if --link-shared
++  /// Nix-specific multiple-output handling: override ActiveLibDir
 +  if (!IsInDevelopmentTree) {
-+    bool WantShared = true;
-+    for (int i = 1; i < argc; ++i) {
-+      StringRef Arg = argv[i];
-+      if (Arg == "--link-shared")
-+        WantShared = true;
-+      else if (Arg == "--link-static")
-+        WantShared = false; // the last one wins
-+    }
-+
-+    if (WantShared)
-+      ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
++    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
 +  }
 +
    /// We only use `shared library` mode in cases where the static library form
diff --git a/pkgs/development/compilers/llvm/rocm/llvm/outputs.patch b/pkgs/development/compilers/llvm/rocm/llvm/outputs.patch
index 40096fa3497f..878460e05b8a 100644
--- a/pkgs/development/compilers/llvm/rocm/llvm/outputs.patch
+++ b/pkgs/development/compilers/llvm/rocm/llvm/outputs.patch
@@ -2,23 +2,13 @@ diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.c
 index 94d426b..37f7794 100644
 --- a/tools/llvm-config/llvm-config.cpp
 +++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,21 @@ int main(int argc, char **argv) {
+@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
      ActiveIncludeOption = "-I" + ActiveIncludeDir;
    }
  
-+  /// Nix-specific multiple-output handling: override ActiveLibDir if --link-shared
++  /// Nix-specific multiple-output handling: override ActiveLibDir
 +  if (!IsInDevelopmentTree) {
-+    bool WantShared = true;
-+    for (int i = 1; i < argc; ++i) {
-+      StringRef Arg = argv[i];
-+      if (Arg == "--link-shared")
-+        WantShared = true;
-+      else if (Arg == "--link-static")
-+        WantShared = false; // the last one wins
-+    }
-+
-+    if (WantShared)
-+      ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
++    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
 +  }
 +
    /// We only use `shared library` mode in cases where the static library form

From b04e5f4d1b21fca14227d5edc2fa0bdf4a7907a2 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Tue, 21 Dec 2021 22:09:28 +0000
Subject: [PATCH 04/23] binutils: add patch for CVE-2021-45078

(cherry picked from commit bcf076104ac84a190fe11f6a1c3a66aa8e6ebede)
---
 .../tools/misc/binutils/CVE-2021-45078.patch  | 239 ++++++++++++++++++
 .../tools/misc/binutils/default.nix           |   1 +
 2 files changed, 240 insertions(+)
 create mode 100644 pkgs/development/tools/misc/binutils/CVE-2021-45078.patch

diff --git a/pkgs/development/tools/misc/binutils/CVE-2021-45078.patch b/pkgs/development/tools/misc/binutils/CVE-2021-45078.patch
new file mode 100644
index 000000000000..af1c95fac806
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/CVE-2021-45078.patch
@@ -0,0 +1,239 @@
+based on upstream https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=161e87d12167b1e36193385485c1f6ce92f74f02;hp=d5c94731766bf4f276146fd29c1df8eebc2aaf69
+
+adapted by ris to apply to 2.35.2 (simply capitalizing booleans)
+
+diff --git a/binutils/stabs.c b/binutils/stabs.c
+index 274bfb0e7fa..83ee3ea5fa4 100644
+--- a/binutils/stabs.c
++++ b/binutils/stabs.c
+@@ -202,7 +202,7 @@ static debug_type stab_find_type (void *, struct stab_handle *, const int *);
+ static bool stab_record_type
+   (void *, struct stab_handle *, const int *, debug_type);
+ static debug_type stab_xcoff_builtin_type
+-  (void *, struct stab_handle *, int);
++  (void *, struct stab_handle *, unsigned int);
+ static debug_type stab_find_tagged_type
+   (void *, struct stab_handle *, const char *, int, enum debug_type_kind);
+ static debug_type *stab_demangle_argtypes
+@@ -3496,166 +3496,167 @@ stab_record_type (void *dhandle ATTRIBUTE_UNUSED, struct stab_handle *info,
+ 
+ static debug_type
+ stab_xcoff_builtin_type (void *dhandle, struct stab_handle *info,
+-			 int typenum)
++			 unsigned int typenum)
+ {
+   debug_type rettype;
+   const char *name;
+ 
+-  if (typenum >= 0 || typenum < -XCOFF_TYPE_COUNT)
++  typenum = -typenum - 1;
++  if (typenum >= XCOFF_TYPE_COUNT)
+     {
+-      fprintf (stderr, _("Unrecognized XCOFF type %d\n"), typenum);
++      fprintf (stderr, _("Unrecognized XCOFF type %d\n"), -typenum - 1);
+       return DEBUG_TYPE_NULL;
+     }
+-  if (info->xcoff_types[-typenum] != NULL)
+-    return info->xcoff_types[-typenum];
++  if (info->xcoff_types[typenum] != NULL)
++    return info->xcoff_types[typenum];
+ 
+-  switch (-typenum)
++  switch (typenum)
+     {
+-    case 1:
++    case 0:
+       /* The size of this and all the other types are fixed, defined
+ 	 by the debugging format.  */
+       name = "int";
+       rettype = debug_make_int_type (dhandle, 4, FALSE);
+       break;
+-    case 2:
++    case 1:
+       name = "char";
+       rettype = debug_make_int_type (dhandle, 1, FALSE);
+       break;
+-    case 3:
++    case 2:
+       name = "short";
+       rettype = debug_make_int_type (dhandle, 2, FALSE);
+       break;
+-    case 4:
++    case 3:
+       name = "long";
+       rettype = debug_make_int_type (dhandle, 4, FALSE);
+       break;
+-    case 5:
++    case 4:
+       name = "unsigned char";
+       rettype = debug_make_int_type (dhandle, 1, TRUE);
+       break;
+-    case 6:
++    case 5:
+       name = "signed char";
+       rettype = debug_make_int_type (dhandle, 1, FALSE);
+       break;
+-    case 7:
++    case 6:
+       name = "unsigned short";
+       rettype = debug_make_int_type (dhandle, 2, TRUE);
+       break;
+-    case 8:
++    case 7:
+       name = "unsigned int";
+       rettype = debug_make_int_type (dhandle, 4, TRUE);
+       break;
+-    case 9:
++    case 8:
+       name = "unsigned";
+       rettype = debug_make_int_type (dhandle, 4, TRUE);
+       break;
+-    case 10:
++    case 9:
+       name = "unsigned long";
+       rettype = debug_make_int_type (dhandle, 4, TRUE);
+       break;
+-    case 11:
++    case 10:
+       name = "void";
+       rettype = debug_make_void_type (dhandle);
+       break;
+-    case 12:
++    case 11:
+       /* IEEE single precision (32 bit).  */
+       name = "float";
+       rettype = debug_make_float_type (dhandle, 4);
+       break;
+-    case 13:
++    case 12:
+       /* IEEE double precision (64 bit).  */
+       name = "double";
+       rettype = debug_make_float_type (dhandle, 8);
+       break;
+-    case 14:
++    case 13:
+       /* This is an IEEE double on the RS/6000, and different machines
+ 	 with different sizes for "long double" should use different
+ 	 negative type numbers.  See stabs.texinfo.  */
+       name = "long double";
+       rettype = debug_make_float_type (dhandle, 8);
+       break;
+-    case 15:
++    case 14:
+       name = "integer";
+       rettype = debug_make_int_type (dhandle, 4, FALSE);
+       break;
+-    case 16:
++    case 15:
+       name = "boolean";
+       rettype = debug_make_bool_type (dhandle, 4);
+       break;
+-    case 17:
++    case 16:
+       name = "short real";
+       rettype = debug_make_float_type (dhandle, 4);
+       break;
+-    case 18:
++    case 17:
+       name = "real";
+       rettype = debug_make_float_type (dhandle, 8);
+       break;
+-    case 19:
++    case 18:
+       /* FIXME */
+       name = "stringptr";
+       rettype = NULL;
+       break;
+-    case 20:
++    case 19:
+       /* FIXME */
+       name = "character";
+       rettype = debug_make_int_type (dhandle, 1, TRUE);
+       break;
+-    case 21:
++    case 20:
+       name = "logical*1";
+       rettype = debug_make_bool_type (dhandle, 1);
+       break;
+-    case 22:
++    case 21:
+       name = "logical*2";
+       rettype = debug_make_bool_type (dhandle, 2);
+       break;
+-    case 23:
++    case 22:
+       name = "logical*4";
+       rettype = debug_make_bool_type (dhandle, 4);
+       break;
+-    case 24:
++    case 23:
+       name = "logical";
+       rettype = debug_make_bool_type (dhandle, 4);
+       break;
+-    case 25:
++    case 24:
+       /* Complex type consisting of two IEEE single precision values.  */
+       name = "complex";
+       rettype = debug_make_complex_type (dhandle, 8);
+       break;
+-    case 26:
++    case 25:
+       /* Complex type consisting of two IEEE double precision values.  */
+       name = "double complex";
+       rettype = debug_make_complex_type (dhandle, 16);
+       break;
+-    case 27:
++    case 26:
+       name = "integer*1";
+       rettype = debug_make_int_type (dhandle, 1, FALSE);
+       break;
+-    case 28:
++    case 27:
+       name = "integer*2";
+       rettype = debug_make_int_type (dhandle, 2, FALSE);
+       break;
+-    case 29:
++    case 28:
+       name = "integer*4";
+       rettype = debug_make_int_type (dhandle, 4, FALSE);
+       break;
+-    case 30:
++    case 29:
+       /* FIXME */
+       name = "wchar";
+       rettype = debug_make_int_type (dhandle, 2, FALSE);
+       break;
+-    case 31:
++    case 30:
+       name = "long long";
+       rettype = debug_make_int_type (dhandle, 8, FALSE);
+       break;
+-    case 32:
++    case 31:
+       name = "unsigned long long";
+       rettype = debug_make_int_type (dhandle, 8, TRUE);
+       break;
+-    case 33:
++    case 32:
+       name = "logical*8";
+       rettype = debug_make_bool_type (dhandle, 8);
+       break;
+-    case 34:
++    case 33:
+       name = "integer*8";
+       rettype = debug_make_int_type (dhandle, 8, FALSE);
+       break;
+@@ -3664,9 +3665,7 @@ stab_xcoff_builtin_type (void *dhandle, struct stab_handle *info,
+     }
+ 
+   rettype = debug_name_type (dhandle, name, rettype);
+-
+-  info->xcoff_types[-typenum] = rettype;
+-
++  info->xcoff_types[typenum] = rettype;
+   return rettype;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index a8c20bbd128f..0d7ff5a54656 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -85,6 +85,7 @@ stdenv.mkDerivation {
 
     ./CVE-2020-35448.patch
     ./CVE-2021-3487.patch
+    ./CVE-2021-45078.patch
   ] ++ lib.optional stdenv.targetPlatform.isiOS ./support-ios.patch
     ++ # This patch was suggested by Nick Clifton to fix
        # https://sourceware.org/bugzilla/show_bug.cgi?id=16177

From 44856a6551de310ab5fc729405a132caa1f94514 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Wed, 8 Dec 2021 00:12:46 +0000
Subject: [PATCH 05/23] gmp: add patch for CVE-2021-43618

(cherry picked from commit d35c79a419f49277fd4b7e55e69c16607b7a8a65)
---
 .../libraries/gmp/6.2.1-CVE-2021-43618.patch  | 19 +++++++++++++++++++
 pkgs/development/libraries/gmp/6.x.nix        |  2 ++
 2 files changed, 21 insertions(+)
 create mode 100644 pkgs/development/libraries/gmp/6.2.1-CVE-2021-43618.patch

diff --git a/pkgs/development/libraries/gmp/6.2.1-CVE-2021-43618.patch b/pkgs/development/libraries/gmp/6.2.1-CVE-2021-43618.patch
new file mode 100644
index 000000000000..eec8206dba05
--- /dev/null
+++ b/pkgs/development/libraries/gmp/6.2.1-CVE-2021-43618.patch
@@ -0,0 +1,19 @@
+https://gmplib.org/repo/gmp-6.2/raw-rev/561a9c25298e
+
+diff -r e1fd9db13b47 -r 561a9c25298e mpz/inp_raw.c
+--- a/mpz/inp_raw.c	Tue Dec 22 23:49:51 2020 +0100
++++ b/mpz/inp_raw.c	Thu Oct 21 19:06:49 2021 +0200
+@@ -88,8 +88,11 @@
+ 
+   abs_csize = ABS (csize);
+ 
++  if (UNLIKELY (abs_csize > ~(mp_bitcnt_t) 0 / 8))
++    return 0; /* Bit size overflows */
++
+   /* round up to a multiple of limbs */
+-  abs_xsize = BITS_TO_LIMBS (abs_csize*8);
++  abs_xsize = BITS_TO_LIMBS ((mp_bitcnt_t) abs_csize * 8);
+ 
+   if (abs_xsize != 0)
+     {
+
diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index 6228b6aaab9e..f8f3e4f54086 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -19,6 +19,8 @@ let self = stdenv.mkDerivation rec {
     sha256 = "0z2ddfiwgi0xbf65z4fg4hqqzlhv0cc6hdcswf3c6n21xdmk5sga";
   };
 
+  patches = [ ./6.2.1-CVE-2021-43618.patch ];
+
   #outputs TODO: split $cxx due to libstdc++ dependency
   # maybe let ghc use a version with *.so shared with rest of nixpkgs and *.a added
   # - see #5855 for related discussion

From 28d56560d3f615190105b28d7c24f7e5da7ec423 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Thu, 9 Dec 2021 00:43:15 +0000
Subject: [PATCH 06/23] gmp5: add patch for CVE-2021-43618

(cherry picked from commit 7ba37884e2c504686d465de5cbd500d23072f971)
---
 .../libraries/gmp/5.1.3-CVE-2021-43618.patch  | 20 +++++++++++++++++++
 pkgs/development/libraries/gmp/5.1.x.nix      |  6 +++++-
 2 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/libraries/gmp/5.1.3-CVE-2021-43618.patch

diff --git a/pkgs/development/libraries/gmp/5.1.3-CVE-2021-43618.patch b/pkgs/development/libraries/gmp/5.1.3-CVE-2021-43618.patch
new file mode 100644
index 000000000000..13b9bc5f58cd
--- /dev/null
+++ b/pkgs/development/libraries/gmp/5.1.3-CVE-2021-43618.patch
@@ -0,0 +1,20 @@
+Based on https://gmplib.org/repo/gmp-6.2/raw-rev/561a9c25298e,
+adapted for 5.x by ris
+
+diff -r e1fd9db13b47 -r 561a9c25298e mpz/inp_raw.c
+--- a/mpz/inp_raw.c	Tue Dec 22 23:49:51 2020 +0100
++++ b/mpz/inp_raw.c	Thu Oct 21 19:06:49 2021 +0200
+@@ -81,8 +81,11 @@
+ 
+   abs_csize = ABS (csize);
+ 
++  if (UNLIKELY (abs_csize > ~(mp_bitcnt_t) 0 / 8))
++    return 0; /* Bit size overflows */
++
+   /* round up to a multiple of limbs */
+-  abs_xsize = (abs_csize*8 + GMP_NUMB_BITS-1) / GMP_NUMB_BITS;
++  abs_xsize = ((mp_bitcnt_t)abs_csize*8 + GMP_NUMB_BITS-1) / GMP_NUMB_BITS;
+ 
+   if (abs_xsize != 0)
+     {
+
diff --git a/pkgs/development/libraries/gmp/5.1.x.nix b/pkgs/development/libraries/gmp/5.1.x.nix
index ea6a7ee42310..048d36186eb0 100644
--- a/pkgs/development/libraries/gmp/5.1.x.nix
+++ b/pkgs/development/libraries/gmp/5.1.x.nix
@@ -21,7 +21,11 @@ let self = stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ m4 ];
 
-  patches = if stdenv.isDarwin then [ ./need-size-t.patch ] else null;
+  patches = [
+    ./5.1.3-CVE-2021-43618.patch
+  ] ++ lib.optionals stdenv.isDarwin [
+    ./need-size-t.patch
+  ];
 
   configureFlags = [
     "--with-pic"

From c7900c5e78bdd272afdb2ceef2828fd353f67d77 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Tue, 14 Dec 2021 22:55:49 +0000
Subject: [PATCH 07/23] lapack: add patch for CVE-2021-4048

(cherry picked from commit 6d952e40483a6951d585b79070872e81909409a9)
---
 .../libraries/science/math/liblapack/default.nix         | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/libraries/science/math/liblapack/default.nix b/pkgs/development/libraries/science/math/liblapack/default.nix
index f81a02303a60..f2a50cb2d3d4 100644
--- a/pkgs/development/libraries/science/math/liblapack/default.nix
+++ b/pkgs/development/libraries/science/math/liblapack/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , gfortran
 , cmake
 , shared ? true
@@ -17,6 +18,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ewYUM+M7jDO5LLnB4joiKkqgXjEDmWbFZbgad8x98gc=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2021-4048.patch";
+      url = "https://github.com/Reference-LAPACK/lapack/commit/0631b6beaed60ba118b0b027c0f8d35397bf5df0.patch";
+      sha256 = "1bqjw3f6ak9iz97y7ckn0rrfcgrzbn9prgfasl489qpxgzp2kjh8";
+    })
+  ];
+
   nativeBuildInputs = [ gfortran cmake ];
 
   # Configure stage fails on aarch64-darwin otherwise, due to either clang 11 or gfortran 10.

From f6054e21a6825c6b7ae33eff4106f82b42bae187 Mon Sep 17 00:00:00 2001
From: Moritz Angermann <moritz.angermann@gmail.com>
Date: Tue, 28 Dec 2021 11:04:36 +0800
Subject: [PATCH 08/23] Check link type based on expanded parameters

So far we've ignored response files in arguments, and did not
check linkType against expanded parameters.  This means if
we have `-static` in a @reponse-file, linkType will not be
set to `-static` as we never check against the expanded arguments
from response files.

(cherry picked from commit 14996789a1803ebef231f5d7ce6193a76ac0f9b1)
---
 pkgs/build-support/bintools-wrapper/ld-wrapper.sh | 2 +-
 pkgs/build-support/cc-wrapper/cc-wrapper.sh       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
index 2f96480f80c1..fb01c5096d5b 100644
--- a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
@@ -30,7 +30,7 @@ expandResponseParams "$@"
 if [[ -n "${NIX_LINK_TYPE_@suffixSalt@:-}" ]]; then
     linkType=$NIX_LINK_TYPE_@suffixSalt@
 else
-    linkType=$(checkLinkType "$@")
+    linkType=$(checkLinkType "${params[@]}")
 fi
 
 if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "${NIX_STORE:-}"
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index aa25de336418..1220841162c3 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -31,7 +31,7 @@ cxxLibrary=1
 cInclude=1
 
 expandResponseParams "$@"
-linkType=$(checkLinkType "$@")
+linkType=$(checkLinkType "${params[@]}")
 
 declare -i n=0
 nParams=${#params[@]}

From 291a3b29181791825a5b9b1adf78e063e24e2dfa Mon Sep 17 00:00:00 2001
From: TredwellGit <tredwell@tutanota.com>
Date: Sun, 26 Dec 2021 14:03:10 +0000
Subject: [PATCH 09/23] glibc: 2.33-59 -> 2.33-62

(cherry picked from commit afcb6d3e10a11914d6f7a7ab155c6c8a27c74e8a)
---
 .../libraries/glibc/2.33-master.patch.gz      | Bin 65714 -> 69704 bytes
 pkgs/development/libraries/glibc/common.nix   |   4 ++--
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/glibc/2.33-master.patch.gz b/pkgs/development/libraries/glibc/2.33-master.patch.gz
index 50f74b15822e9b9fa94b55c722e059a5d650f168..aecf1550feffdb6cce55dad4088b4f6f0fe6dbae 100644
GIT binary patch
delta 8309
zcmV-*Ad26zfdt5)1h5_Of9zdbcN;g7ewNPuh>m7wELkMe0QxH1IY*<*M7y%=BPvcd
zjt{3VXo)r{YDmhK=Vbr;)&=NBlPy`fJnVxNMKrr{M**lRRDI>-bIaW6qT@9ZUZGxC
z88U`rCB_J)z;p&_A*!m2dOHcXMYExZF{B`VtcG^3iYwS#8j{^vf17^f0x|HxJp0T}
z-ZtJ3F(UtDVC*N)cssGFh9^HCF@Vu$^g_imqlZBUaB}e-G5V<EFzf^|F6_ma@z$7+
zFVQC8S|dSZbzGs=M4CPNAyQ~}hgZj=Y3+|yMt7Kuy}mIT{V+Tlp_M;gVxP0Xk{ML-
zCkWz2P~;{=iN(9Je|Pvz_*X)gbwUcKp-5Dmgi#cgssNgavII3+Wrm@I^C&LkOc(W0
zI$Q#yjFuHTpI{K9#d0!cEXKh&pRVg(U%_4#qC=tx_JqH7jt*7oqn@zzULTx{UY@)n
z9(Q<h<bD6+!M=O*_;<W)M81Syc%SG1y<Re!mOcI)`xWZof5Hk2u}%VCVLYZJ2`c5s
zc_iZsIvk524pX7ZQl{{q;pev&)G&0Er20nK(2;E;9Lz_j#~#Pw*lKE!A@Fh_>?xfl
zLTR*Tg!3p0;na%-NP&TnY3$bUEf=u|(+GmqVvJ_SH(3tC8%5;3yoKYJtJ!kQ)9^UQ
z&_fNg+Um0xe+rS6p%NKtM^hgv1_BDo6a*Skg|I2)Wf0^EbLH)JEUqvt(=~V6M2J{y
zF(@IwA|4r`n>AXB8NZNehF8E%0H`fz(6(^6%!4ghgU7&rvsJ~o?r64vQ?7^3w+v;*
zFapGUyR{)aC;PLo;+)wQ;tn6jI8;*m5zI&F2U%Jbf4Lv|D)D6&R7s)ZECWum^21Qy
zr#YsvDkpt3XrQ}%SJSip(uV96aiC$;RX7-kFs%H%OjF&h-{~l%t<~vBK$pBxPbhDf
zKY(+_ZNvM<nnt}oe|3Ns5~IVTgH!T}HZM#>2N<;hMoz%OM?eW942rZs=7Qiv>g)%n
z`xuF+e_=`1Grg7K-P`ot=I(FHq$pF(%|PoB=&#-IP47h=!EH+~vTKFFmjBM?#TEWz
zv4kTO|1n);_%SKRiyQoh9#5zESyucNWPAEt0<Q=;ZHZUo%d5+qIl-7Osi2Q{{I}!}
zdUm-mUnGB0kqbmHqZ%ggX*ei+Nr|qnZ?Y}Je;TzP!sksfo{nc!2qMt1KFJw|W)gX>
zykCFyI;ZuK6npg$Em_t<mT95<F!7VYKnGfB1yX7FNQ%As62&r0AvrjqAcg|EYEYs^
zho_^uU*B&C90Y4zJ}DP7#)<k4@sZptyuTd0`r+)tlVWrC-gk6G+p6qz|Kj-7`O6`v
zf7lSdwPhg8+6V(*6Ex}V6lcfT*$$6SFVK0xd;Z)LNpI!to1e~yqt}N=vQCn&COJEM
zy>H)2_Ce@4ZEOOungEYU`%*&L|NG4C8z($@iH-;R(DQ94=g<4+2j6?Yx`mw{o(x}m
zzdTOYO;bve4ILaUqWWT53(S?~rHYcEf6NC1AH+440h#5G(|WI$`LODHJw3+_qkwag
zLz?5*eftz<=;=!AxhV?8Q;aF&oVCbhP7%X@aE11uPrb7lGCdc+|1icv{>;M|%lmT<
zV=U=69>$P`M)J&MQ_wXOm^KV7`n176$XE|Jym)nf<Q?xHu=DHb$?(F%8N-7ee^EBt
zWKEqp8t$JdYZfW^7)&r6Rj7JlYg1WWwDw0vQUI}arE8Wi{Dd-)Nz$2))^ObjKS;tj
zYPO$_<;)fPX)Hq7nGlzC{S$~ZP<~J|>=DpVQ3<8|DyuNSgoq_n877sIagj@vC#lXW
zQ8VlhW2w5}A#|^Rx08D^-4pQ|e|#{-8$IWcmL9swvHXT{kp}eDh86WwN7H3t--}cM
z<!2y|N@%96QViHx3Sf)#tQ27+VpRpX&m8V=h?t7$UCrJ8&D@g#Y=~&>AxLxQ8;Qel
zb}_v<vF=tD#~CrFK94Ytw*zyWIbsMB83;?baU^lXI|r)9$*H;ycM7}1e@7T&@}@*}
zvw`>D-r3q|u8+`_Q4_9BW&$XBvw{S+(kpN0jJ1-XzPpb4?%f;tUEdX&oZScOVX1Z+
z&lhH&cIyW06EcuRNY3VTv6FcvEOxp;YCJvpdVx^oFoY#4s_L?)*$wIXj0lb!RIW8X
zAfpv{MXiNoO-~&6xo?Pse;7xbEy+jNaT_WNQvTx<!>e8|cHSbPy&Kr#+^A*Vt`p04
z20SJ?2vQ(V;yCFmQ7jSb3&if`Kn!@<cXaM;_vKEn)+U(vpPtD%B4D!lD#^c~!Uk)}
zI6~&4Nx5k{%NmMy%?MU)BDS;&G4?q<lj+l(?#B2&13ee0Y8OKJfBvPJJy8Cj29dZk
zR!8+Zew<V#w9o}CZK;zq&5Ars3RQvNn=9#Oexg9OF8#8qR;4Nvv<92x2GHa0hD*qD
z5X&+Zgc@Y0JdMI2jEkT%fS$?M3ZQ46(W*^|;pC4$vS|O{n%VeW%jL^UrN8mTRkG_O
zscEBYH95UCzL9h#f0n<eFt9lFHEtfdz+|8C7LtG%;V=17<Gt__JIk<I<H`jDuS0;t
zDC@fnH(~B+Z4{`>N~TpAOE?>3F7r4jk}^?=lrj=gsl!}HWs&@@*xG0ae>VF__dDU9
z6nm<+gctU#WAzV)_Mi*te4bqw6nqz1tA!m2x(8<mknQ)Ee^+k!kM~y&qShgSQ99S;
z9M&0_s@VeO-5{SZbS7Vqi-?>^P=duZJ*C0KAc@T4z2~~n+=6bU5e0K`TUFy?Y_5WV
zHVnVIgqhY$s4~}+mXl*P`3&=9i!{KU#=+0~l;L$W!nqMRJ+|=-R=#&I8CT2Jbx_OV
z?*Puv*}{AEf8=n6wte37f*!1$*lkFtN9Yv4<X4!aQ4|L$hC&fZBEzbZIt$V$^EK>B
zm5x*?iz0bYu>&*>zkSpv2sIe4im)rMt#T(s$}Cb0nGz;tl@w(zf(Jz9)nYn?<<%r?
z#m`3kym=j+U7Y{V_RFJ}@H;|bju71b;u${Tf;8!vf7|<*;ldzPATHL1a)%`U?t1?X
zmSgk}8^z?Z8gKk{9`;h$VBTMCm@0o33U(8qdG`U(!$x*_HU0n@{2pfNiwz8k@e#e<
zs8-am5ZnTeoyE_~i;bY?Z~t{Jf*nd<6fa(gJ!`;&fH9DHqWcqAEU5P9jQ39@tPJ?Q
zcOq9_f7^+SMWS>BT=ZZ7+e`+#Oe(SmCUUiyj)`1NLK8_bPi&xLp2*?FIs86)BDvW6
zCz9WHPGn#w(p1?@r1QYzNG2!djKXL}1TBRzX-E*}P3j}o)7prvMKQq~;ixixq}gIx
zMHuuwx|Qf#_>O^r`2*RLjWTA<kq{KAD6~|<e~)w_Me2uI6h6q+xh{MqRhAV+prbzn
zIRH<H|AHL}BnJ`fDY+-r8gzj14du&=I|~5$VLX{U$_@K*oRu#VKL<jp@-isGFpK>p
zO~OQ`Wte~{h2hh4G@4)A)(i@RgL1d}$X;<5VVOeVcuA-VU*{kw6|45kt62@DuRf;B
ze{I;I&>6&TRKQ!9bbVlymZ-r1HscrUcs*$EXFv<>M<4X(kpZ_@e^Kg*rWd<jd*oNr
zPH&g`Zq%?Nov$rgXV*KF1J_hyHWZv&G2a7pzj<`HNFlN~ER#@o8q?fYx*KLUvH*0g
zK_O9qw-f6F{5AaJSHQWifOC%z|JaH5e`XgXueDYj-S)1uZNH%wbk2SmSmexNG1bW#
zZpZLF+golaTfO$G-ln3sn2sp7Yprv)5c|w>KGIL3GFL&2GIpj=y$DiF=NZuCUD=lE
z=eQxo=*Ybbf9dLk<mI~-M)E>0K`<;n5X#eb>($bGN)S?;_vE|0&F1BU`6zC?f3d5m
zQ!@lcyT~uh4uTyy#ulWp#zs@w46%T~dOQNyw9x|1F%0VVh|-c-hhcP0lj;oJiH+C$
zvrSeIE?4VC0MLtza}JnHWiW67+xjh**ry4~d<KP~=Af!HOl28`AQ|PcN<>xpRh8sv
zp315!0-?i5R=J=3A)#6Zo}cW6f9YNrtO?cEH_OSMcQ`Z17d*_w4=z5?NNPB%OMLTw
zdSkhNRw^fvA3I8AqpjuqWE2Nm49)<_t!4{leHqEmd#I)$Gst<yHoWWz=hkHIQcNQ#
zZre7i%`AZs=$i?MR<BsXqpiaipgf%~ki$eR675Ji;@x7T0#*Sq^GFR}e^@oILGHuy
z+osPH#)0AORgr0xmPKA=GEg#C6>z*VNy4B^vLcKtztkd6n4{d{p+-mhB^k|d4aW2v
zNyfIowvLB6^wZ?s*3Ny>eFsbZD2KiWI9x4~2zby;2^~b0gzkkpLq<qSl?P}r<HwaM
z*97;oqaRVO!w>646Q`Lke`J|wgFzN&QiVEC()KP!$$8_Vf07pr!89ua)7-xL%Wp3k
zo6XqLm-di>c{cGR$iV2WjAK7~2gEZW4VjIN!D?V4COna6M$d1v1i?FRXfS55cbaUq
zfV2&DeLE>hZ#YAp(j536HeSChbFY763Q1D=&byg?(({{Q&s!89e-W?6uzOAX&~~tn
zlOg)HuuBV`KW}+`c`sohBKo1Bjf{@%$(TcwlIp6a(@pO`HoZ4BSESTx+$N;JZ|hY;
ztUPhaozJZ>B4DO<5M%)eBPz~fAonb4Phod{V{qR2j)ZQQ-vp#?nrwJ5ya3k5;B;bO
zn6pg^1PYU0qFLVHe`Y@ZI3WD~o4NkzUNdwiDu5KOZ(Rjy|DjE4`)@ZT#puAD4_%#1
zxYK>4JKUA-#%7gV!}l3EelKcWaQ6jJwwz7J1?*9LQ#;Cvf7yDdyitWBP0#ZQXr?di
ztq?sPeM0-QuH>TU9sh7~^wa3|`N^C8iz8?)W1EKzZf>k2e>%t0UUDt1tvK#PcBnY?
zGCJ&3vzD6M6f!)zczN^^PG_`%<~$?Vtl4PtZ_O-NXsd^hh1C(?b=vnMUrRH$kB7&0
zwnI#PzSCp0v}^m4)FGehw6jmw&DEOs`mhE<+LlxT7MtZ1!E=U*G0C<tr7qBCdrp2P
zs3ozM-4wmRe@0v(0pJr_1ztZ{ve*PgaKsLbRDtC2Nq1|)>>lFk0PcBZ(NI(#g}PEf
zIvB{ZN`tt_{jysFwpK)2`?dC(fh!0Y13w%{{9T5`FRtN?$rd0w5Z?UquD_gr#>1(3
zJBNJ`W?<PM!UOr^-spTsvgn(As(yU4?0<xf^Mh!8e`B0^esS0QTi!J&_of?t-0}K`
zTls}z)Omk_^BH4(nLs*dBZ6#AZZzrUq-gf?!Naq3Pi-v&!!M?Ntg0aoLK#&$id46%
z;nDRu%7-Ad$_K*JCCat89`1p{foi)C6&sHP4x^o~DvGZvimxh)FQ_PBwH-1xW4&-z
z)daKof2yqFnS+t!9jeZi!;DC>E}8TY)%NmI&+Ay)yozZcGM@0ZsAJ3B9-jQ;hvB(k
z!ZE>xcDnQ|9V(TMw~jid1@`Ve-Q4Az2(oUYUKNws;&!fU-0SfrO6nwhVuzoZhp=5t
z4CZ^oB{-@X^OQP6%*p=nzY*7)9~-FhXX`5Ie_Fi&vH>t|aQK_i;KVK2a=R(SNWbRZ
z{&A4rEky=K8f~+}p79`ThN!dEq>V@IQmY}q9qL&WMUeV<VuwnFK?+q?MU>>JN~*B*
z5$6ZwHPzhVzs!KDZWrDG9P!!p)y#W7T@+vPEs-c5>;=JIn66#X7^x@<-cIy8cGf&N
ze?B4R>-5}P;F`AH>9_}Ei>ZaiSy;70sHCHI7}~e!8D0lk$3TQr3^b3?1}Dbs2aez|
z2Li+@vG}<X*1G6YFWJxrXfx00AY^?6NN)zb({i2_qY*)S>5@M~12L$g$9j#jrR$&~
zPhTBSRy=1Jk%(<J5da8QY6Ubtz~WF*e?l4&c2>vHD6PQ?c2esn)}e!78KC78-c?b)
zoMzW-;51&chj&K-^Ct_=j86Q<_>)T<-`TTmY!w`?Wr7K$h3`m~ageb8lh7q`CG|fY
zTf>?`<o)Vh&h-s4IYFM5AU=BieJ@5&hgtr<yq(?v;{`{UnJWE)mS&xuibmE5e<aVu
z;gs-4`u0uX9UmTf#aO?v@4TDhg_G1&-FlL#I*b_3O!ISaY|KW1F7R(wH^ME=n~Pna
zlHKy(j#QdbLBk(Tl{Be}zKFV0RmEzmVpl}#2{V7CxQ-;kNpjouzHoZiOmRIcdn}(C
zpZ+QE88Gir&^OC^q8$U9dTQx3e_CjkqbP2$Lp^Jw`yA=uyFEKY^l;DG@>Y=EgIQOF
zXMik#B4MUvZ!Tm{2{%__bIHOhlov=(C3P;(<dVI<2*X&q8H+k&h}FTb$v7Ds^6+~q
zc5-On<|u^+0tIY&73WwiOPc<<==FnSdoFg|Y<0hgpgj%Qa+}T4VNc1`e{6Nf(!@(D
z53zkY+oY_?x7U|R97m8<wer?|6I3NMHja5vfIUEc2Ij^84f$}ks_q~V2xLp77YIh%
z)&DYyGQZ%t+x72M@|~Nz?q?Qxz674gi@BxKYBHw=r*87Pe*v`-M>A~?OWKQql~Jkc
zp83MeS`ct9*um*}lRESLf3-Sv+8)F8Ix@f25#@Gdx!w_2k9Ct0+axB7yh#M}P>)*i
zotwMqkX-H1rklS`Mrm>&KTY3@=?&3&F%M}*-TsSp((9n1Rnmj)!)8-<*jCpRP!9;6
ziJPgRIU0sES|uKAA#Te-Jrt4e4u$lcxvkJ+)l+GEMW(R6{4{hke+AAI!?;W3#f2Rh
z>g8PZTJt57l|g}gJR11~=6BakTKB1>q)}b?wZ1gt2ZQe9Q2rx`0S2=kfxsOBwK`u4
zcR|X1y=XU0)x9VZPf4%R@U&Ht)Fl-0yn(wW&GdJhZm5;PVBnM)xMPVepk08{kqqVE
z719q}0t@O^M7Fyte>ozTMuLXeBTN`p_)FtB`E)%s^f;GM5B6TzeVwdfJ+M*kMX47R
z_=`VxvpJs*a5TVl$S6(XN16DPLi$ynrh&+{sB)32pz`w&fmO;V!1%B_@Pl;|pY;on
z=F(#@2x6IuxQbHshzk%><q{a!AG!efe{q}P{l41_z63#Te}7eKu<ZL9mtQu*0<q=>
z%H)d|Beiyo>-n~>&%9|l)7_uQ;!kRzXO*WS9t;vyl|`Zxb&qfH1BI<9{_ammesgiy
z6VltI&j5+$^kQ_n|M#QQ;Sa~hCqHcykQ+r48tLnDXU}_vT2phufzS^u7qA+fRVyZZ
zm+R?u_U6^;fB6vz+xu^h*gVVdILP1(58jN9&-Y&*jSvh1kB(<-5C&UOH6CRpLfMRp
zDjTuPv)#@>sq1qd*L(Bct=AUZe|*7BBVd8pMEBRgK=ov0Kw6n*EO2zJbsCRX*XW!d
zk>}io>CWUay>VJdbz<|H5uxLi&(?O|>J;4r(O(-0fA*tQ$l?7T00030|Lk2`Z__Xo
ze&<(|F|n2|RqEUtB#^j03?YGFk4Te~xLcrYN}WjX!f)qXoZ88<t=!)B=GKmV&hg#;
z&gTF|m>^*1^uwBqRrU3Ia+JA%{96fVF}F+iRYSFyo^t8$J`UHNk#n`{rn4q7xpeiI
z4rDs&e;RS+WPRJm*2c57%&$<lqiv(Fj)wlnzL(k<91H!yblao7maChsFtzcA=tnBr
z<tCeY)NeN{VnejAdnK{-Gr33>xy(})sD;X-P-dAd(jpTJm_KC@r}7UTH*XZfOOVD{
zxHQgDd)jk}{EmBgi9&hww%L_cqw$!Fs0U<TfAbaJ*{Am&WFWk^AH1Nwc8EmiIBmRa
zF44_ZBqEB*N5>%>kx&F(7HZv?;|T;yg8*jWry0Imh=LgcPeogIu5G1tnVDT|O~*X=
z8Zfa`!cS5Fwy!(clb%=zkyQp?^CagQs10QfP|k^H8mH&Bn66vMQsJ2qmBFx3n8CIP
ze|q`WpvRJd#^4zhld_S^OO5YHS^;cf2$!Lg`z4;;^K5*A7vkRY3*!G&TMXq@1EoKF
zHhS^t)!7-|$1?GuV^DL^A(2)Lon63&_%Bxhu9|eqHmKG9nXydaxjcGe;{iIpIOs^Z
z_o|}j@C<7<8kJw0a1WfoXs|9=mm9)re=v+kBcRH8%$=4Gwfw3!T-|oOhK1i{iIsu4
zp%Nvh1SjL04DopMGnsVF!NL%$o8>D4+oBU0Izf+oPmr6Hq4!}pRkP0MOb=;Hm$a%W
zH`}JRMlg?ZJz*d^ThN%p=?%=p290cHsK3`G($1jTL~e*m^CgKaJB=K9K4)%+f5995
zg4sK%qRi`{&U$iHU6y%kLGvyr=UDf<%RtNIHp%3U*Bhm+7ghJWNQXU=UNfZ*jn-o0
znUCLW@UDO@g?${8TmL*3wDVS6k0|}l0qrh=nx#J%i^R`F?h6@<C|%@!SV%cnQ5Xk8
z`LJ6klH%^&fZYMiX0e~nizq7=f8u^O@Ef}U0V=$@bxbGqc{s)1d2Q0sMuPvdvFNk_
zk^+Yu7w~cY&lc(t<&j8aw1jPgi07gZQIzz+aswZ8TN#KTc*kjoKmfzM(7U>yr)lCH
zbbsIfvb~Nzuc{UFcZ9#v>H!D0M+aZ^k2vvP-}Do@ncg5tOcyDa>f31ie?#fhV^~L&
ztHRSTDyaeiR*Z0Yh8@QvtIchY;U~t!pTbHYWgUhnL1@#4gk{;s#5N|f!PtJ9*nbx`
zm{KlQ7T=M}5o|7OMjl8Mc~@U`uD!bQM3ZZj#dC5AoG-%%)0<+PaP+_!?Rbn6xPj|<
zE3T8tDcEvvyQyP5*h;fIe;bWcf^nO|fXt7_RrY1O{62B?m{m>v)W*;X(Obik1A#lA
z4b|fD7&bhH(`26%>e8fxK?-YfAp7v&Wj`IrK5DZc`W}Lv;wBRUEgi0pqY+m$(HB#R
zyJq7#|LLncR6L}>z894pLR^LO&fwCCITYHI!*rPyelQ<~Hr<rFe*<KS{T9gdvfULt
zJ$M>mB+$@Q&|SfI7Vg)9PPdGC_xPrJeA6!g00960<Q;2o+A#2Q{)N{M8z}+tY72r@
z)gG*DDog{WNnI5|LexwsK|Hig9shmzaKLtw0h;z{{Xj!vALsMgzPsGxe+<D|`~EC2
zJc4M+<#-8^G^qOsf8~45P+Gz;x_^MP`t0kE>a@_~n)jTlHH<(>fJb2@y@e=_CyeH^
zV6D`s4}t4SvX(t{1QxijJ}7|T219}i6%>3mV8I<WCDIt7iRULJ*)i)3-=&l`g|qRf
z+r$Kd+NLB+zo#p{Lx0dc3lgr4HH0N(*z&qmQh>6KgG9}ef34(^$((H`s$P|p!tKZ3
z9r3<5`~vDp)%`GuCggRE<_C(1;L269G4Fj`Y*p2Q<*aKsOFR*4M?9x_p#MlMxL|tn
z1>PdHy1+y=M%IsICSjH3Nv-2t<?C1}jLXHeq-rQAdl^}5VD#BoCKF3Do1#2D=Lyzl
zSix_|aYsaYe-I$y^MDC!6D=@~9#E%HfP>Uy=P&*|k#Kv10(;6Q_3qj8XCaL^|AaDW
z{$<8Ruf7=$j4<CLe6qV*j#v_|VqQz%7Nxo&m>AEJD9Yw^(rkLZ*D9AU0<Yp#f~$J2
zN@c<@#S`;6D_9pKppb$EGouJ4ENjtLuk8YCsYt0}f6daduGGitVkgKYj8n8ba6t?h
z&zER*e6yS_&{3`9^Tmz#6OM-!*-jk7+>!ajeente)mYq4(1<EJQ~Y-0fnc$qz%xhG
zDwSH9Q$JN5Oaj+LuN^g)r@Gd8SCal~82BIVHaR&kv;#56`*Aeed&o+sw)tlDxX;y=
zyt{aNf7cti!`ohW<c<bzuMZqdwt5WWImS|IC+XnXgpb`$Ff6LQIscoL{AsrtaQD;T
z&gHcBy+PkL+F4I#*OH|NBPF3oa>*A(Lv(1_<69kVAQl(+uGjEjdxY~WZ%EhI;<Byv
zG?6G;c@a?n_!$<1vh`tTWKf5agactFcglIhf0>$Aib0hoH>2Bmp|Bgzxh<Fg_Q7$P
zU=qS9g}^0LyPbt?9(08Rupbl2%pG`WwiJ>-rD$%QOe*RF3$0$;B){oEYaW>1YEOnn
zJL89Q+5e@uY9HPDmq8?@(>8;}IA!E&mZk(pkinMlV$DJYhh2+h40@teB{X@0DWgC@
zf7CW;CUV_(uLu3lZWj(|7qp6x<54@!yxY_gwlv%fHu+2Z7|78m7PHq^@c_qW%-x?m
z<WFA?iMBZ#Ul!pq_PX6G&PJ;qU{<k)@A;QO5Y%e^q~ZsyVEP*X0RR6oN;Ne~O-?fb
z3L>4qO46!!00000|No6$U2B6d6n*Z$f5=m5p%c>ut*|#&*w_X|yO+I`Sj|@Gx}qzC
z{rcUH7%k4$x7x(3`M}(pdvXq*qQ5V;LJBESF+us)K<y4u!Kp&#31GCqms5K6(lhm*
zMuOIg`NHfdI15y3bI`2lnneEsx8X?#j#8k!8rNIcZsVGf=dHxO2Y!ZSq3i&kf1J!#
zy_Rw|-NxRGhsTwdpd!!7%)LK+si5R^w2ve9L5M4MxwXK)0xFa-FXKC6{h_@T_KoXE
zdNmecIF)@Zw{lC3cFC^QySS<GQ*g{ghH#=Zv_ljXbHbRk(yVG+8`gmSjHdG{l}*1<
z3es^Im=n0QZIOdD%at|lm^BUJf3pMb61<}cpZh=LZf62UaoTgrKhehzUF^k+c-tK+
z7}dM-mwx=m$#*TGrHcr~M9f@irDZ0~JW#pxr4FT@M~lpuTj}Rg4b|$cp-D~OXT$4S
zPd!KR;Lw0$?s>T%6k!-_wHn4e-nDs|dAwVn5mdx|A6oukB7uYOi|fF+Ym7b-;ae^U
zGfE-=k105hlk$5H0nd00z9UNjz-qo)#ev#vrY&Ir_}7g-l%T=*VHrQ+RNJJlE2M-M
zWh8t9-^&Y-DkvR<c>?>b$qaY(LWp`T-gHeS%Qcx3qfAKSL=pY~QGF6?2-pJvo)t<x

delta 4288
zcmV;x5I^t8paimk1h5_Of9+jsbK5o+{cO+v2-cl8a%?FC_;#9|@!Cr3UB}5-PTOso
z(SjssE0Ha&C_mEa{`b8PfFdQ@R-1lI;;}5^K@zwC?!CA;r&g|B=XRSMuZZxH^uoxH
z5iBbaGL(YS=_i>eiZ<zO72Jl*1|mXALHt;zb}q6Dm|GSiyS>u=f2ai_@xe@e;zQn+
z?}rqT|1dE2ljl60*j$67U-}GS^a)R);+nCGqyyNwm_~{|`Z$a_L5d5XVpKderlWI=
z3AoZI5US!8YILNTqaPB5=Iik2SX<UU?`E`z$=K@~!{OUOe~3~3xQTtr28%MN;!hC7
zi=fC2MTy0`vU~UofBIKKm#t9>CxM8)C=S9f%)Ja`CR8zcv~q=1!f6=gk<wYUln&;g
zC}U)WPRB@MRL;jE#$xP^(#uuf>uZ>+0z8l?{5|2WtfK=janVnhJ8uq-hOdrZla4z$
z>N`LDbg*CFdHe@%Hlkj_3C=AopjUH7)3VE7Eq;Ywu(ZZPf23pI^^lJ#j{U-OqcoIJ
z0WTa0KME4z<+)7YztQKnN_sFnC`tDl;)4$DGs42$KYr;j569Nx4l)2;4valdC$aD}
z#xuft6b7*BMFOlqU&th?-{Bcou?O7<hE+MjFypC8!FVG^-t%i%e)%?AweU1t&XIa(
zp{zFE*$ISDe|g{uh2GJ`g&Tta`FR2cjVJ<`6w=)H)0nmL=5v%6NXvA^FKrki$}I*Z
z<RsFO5xQApq?kDua;b0&ctHTQRco{@Y%X(Q3&!9}P`^2<VpP4TDq)q|#lyD@WyUZ9
zq<q)!hVYzxo`oIfthSJLxSrxrNbQEuAGzzRq{vb?e{{XrmC7&TOh-zACRw;apzre>
zQ(NWZE(SEvUVh!vvzllrdqw1HXmu~>^+XU9Zki{FZujrBRMPb7v}B-7-f&lV&JKTo
z=8V&Z^OX&adUN{v03#%Zhy8<NIumUY45I_IS`V2Mu<{{D!VpQ3N>nZgPNXV+aJ-L9
zL<^N<f3?s%Dc-+J-f!;wu|ggds<at+dIb7wKKQ2dqGE8{(xtlc5ZLlJHOnsWk8%!6
zDE@I-D*PDdqjHLW=+WgRe&z*#1>2rJ=b$S>Nn7K^==|b*IwKhKIaPFX$G>y_plj!)
z`6Bs~sw@$~jP5XoPoqI$B4xU|nyM|M8Z|G%f9EtCU5+MH2_n$2KdIIXi%#Uea(@5a
zY3<fECHCSWS+c5w%#+M>gV>FGJ?(2xdtj9YYf9|JV-m|Mg=BI<K?()DszHew9v%;?
z_xfQ&U?bSz@^M~H7$@rQh>uh+!t=|)>$fLojue|a_omSnZR2Lg`)4m-pS~J!jt$}3
ze^>^>tPPR)nxILqFR^!OGuz?I<1;+G;C%O;BjVkq)E|F79Sq+b_GOhNS<Z5D@@C(r
zN<M?ovf9`TVmSjYlQvO8-T!-De>cu}^a>9i?8BRPY9)W!KRx)t`MqA*@!`?njq~ez
zzHaJLvTSJKXb9D#c`YzklIC6*`+3^yf4N|;c?!fVUC-;iTIa*A@74Uw8%Bh4k}1ux
z?Vde_9(uaOJ$H#l@g;J~)Ye+mGA|LszjuN0piiBX2`W8je||B>O8&~l80-6M7GtdG
z4=%<~gj({XuBPD8P*B>CSoG-v|3I-HaB%kewC}v!Kj6c!$47%R2YU<`c0}1|e~LA|
zOn<O{;@PlB!OLKbbX0-28#E@B<w0xz$xsRqwzhnW;S2u)>B~57%|~OndI;B#gD6}~
zKP|(VZ|o+K2xMzU9M;u8UnIWg`jx^Sf(&Ja@I1Fr1rkh%NWv|HxbS3@rP52|M5l$Q
z6!wR)RO{d&w6B1>lY27R6VVEMe=zZlo-(DSgGc4qenVcQ9(}d6qHa?2bXnN<Eb&0{
z71*N^9#a+x5_aYS)Z$d-A_zs~6@KcnhWiH?Q!#(tbGJX8Insv-5u-f>dG1_eanugG
zn728y$E_@mGh$AC8X}K(4dz(Y%n%eZFqUxQh@+5a4s?yvq3Vk66lRATe`sSmO^NPi
z1MlD2-r8PlAK_6(O}IA75GXp6j10Ei$**UOwW849U9rA9_cFihyG+wz_ueWk)%N1#
z3#(5%)dTDkGLS_`Rx{ezQBDqnoi>mbCp~$4fl%d;!V(=-Rb7{AO1?g0g5w00YK<2t
zXa$n!X(8L<O=`#Iz9JD~e;jR&Bp>37TdFL``Ta4{t6r7c?@-X*_iS}_)-q?O#$`JJ
z9g_|S5|Jlqob;6>mW1^MVs|qU18(;9Pn}LzZtqs!1jGO7n36*RCYvpb{0pkAw~~z+
zGRsBIP4lwsp=jP2!Kw{oOQRAKpR;QU-OgxljQ2C}<O1Eg4xxPif6!D9)ZeQ>B<@Vq
zQ8kX&v#Nv^I)kAtb(|zBOM^J`3NU<APrAyDJ+Q5FH!q51tICkp;3L%u^!U5c5>yIi
znezNVgYA?iVc-W*=C=~)nQ{#RJ#&plZA=O$e|*lM{me15@u!B%<3pvp@#rYosb#5T
zqir<R-qxIrq%E=Ze*@9LV%Jx=d3XdyeZpNx0%C;UbdDPLh3ELP468LN>VV)C1vs>_
zzEd~}^P5&dfjTc_Qsj|@wLzvbjr=UmV=tCch9b;$km@kc;y=Z$je+ndlN;LK3HGGe
z^QuUAVb?l#{~)yoZAhmxb(InME~-|gZ3)^3=K~;}59b$kfBKIP7d1q!Ljt3$ZId&t
zGbmM)68haBpD=VLZ;y+R4w0Y*i(~qd8WTwpS;hOn_rh=s+LcBW%<{S@M%l=01%qrD
zeRU2!t><vdRF4~n9M$*}^pma90C$=Le$K7J?P!E^BXD|r#uFI%&cS$8%p2Q5jflSk
zSU)GF^ZLo*e*|OuobNKau(Dz|A)(grDL!_tFiyfS@)M*&5pgVoqL5noNvK>6vr?f$
zFPB*sKj_#2nTDS(`V)lL8!Vf!OUc%`6QE>f2~ws6abCn(o(lf~Q+c_X7Grri3rF#D
z5I;{|{gboPe|KK>U%}51jX6Sa``R&j#2I<gv9xoee{f(BDiBv|soWvUZ*A#cVLitG
zu#t_=i_yk6vtT!Y3FgDahPmZ0!h_iaWWIg@<Y7adUyMFN0e2S*b;Sl!V%*?qH@YkO
zSO{(b+s@+WrP+qR>vq1G34fdNXW5GvV$TNfAYcp>9_#KH1`E3Vx#0aB2_pl3?(N8>
zWZRLEe~3LDf)?HD!8D^_mPv$qpd**7Y3a!2EYy+2d18r<xg!T>r|`3OM{>3IcO<8`
zcBF4R(%f><k+lmBGnpKjH452`2wDm`X~+=fN$Ljg)0l{CL@~h}VXHEJq?uwGRT%U=
z+Lh>9_>P`|`2*XNgEA(ICBe@Uk!k4(H`JLFe~BAtk-1=3r#f>z=_!?Ez7GEi<N#bD
z{s}V@SPsJ9^W>iNR-gmS*-+lRxU&F|A4lWyTF0>0)2v(>yD11#k>-9D1S)dlBo1Pk
z<UtIk6w;@s7&N~!tr--C8p_@BCA-C)1$hFM<0he(xjF?yDO-+TUM^}RefctNZo>?P
ze}_TrL<PEq$=3x%X^tKYP&0nT7q1%a!vtiZdFiA6G&JBAs|mRtYf9L0nk~PS_wstK
z?}iI?q&3;1b+)CU9k}8Wvs7^P8}mLud&=5$kwT~_$m2k_2GiVEd!1%Cv;cICMj=yx
zrxSYy_zV5x7r?nMfOG59Kepn%*#XI8f33lz+nkj;_8WRZXM8RLtDIOYrYbwb?HIkM
zvsJHUYqvS7J5&`{)53DQ@^tkn#9p(Sk96ZOPdz_E8(VqkUIZ(qbq!dQU7D7v>o_4r
zc#wMse$&<o*~@ngjO0?!!7$7|63SDjku-On5`@&|J>|}?)hvIo9PzfBxQZ$_e?wq2
zt9+z)5bUTHY(XAtd}ykhAr=r=k6QpAZCGMBhC$sPQeFz{Fp92uq^dxBW^?NO`6fFE
z=gap+0MN6uQzlHNIvBWsWBtlGzS9_OK7+zgX;4KHBr*>Ju#D2ki$zhmMG>b-n#iKa
ze4&F-7OAT~%cz#V<HmbIvKRO(e@6AybUxm54krfrf}5H2!SW-uq=vOR$CMA3Q>*>6
zQ#lUZsOD5Q-dZkCL2)p}U=NVpYNk;3my!Lvhi(cAgPbXj;pKyH^*fop6!Q?o+ty*X
znH3NMeKUk;)rciL+KRpa?dh~c4HLacG$W;mcZ*B~>;horksiFXZeD}je~0xqL!XJp
zf#L1FOldF4v$Rms_hjl7pz+E$4*Wb;Sr8R&u0<NNM!CgJjR)=L6g0zkFrnWlGWH4V
z({VEgZW6!W+P=@aZ&9h&I?(rkhO0#!f)1)Yq5ZIs@Opt(s0c~vr9KACxKZKdD~9_?
z|0lHT@WY;>i4x@snWw7Pe^Zf?UZB%BY0hGlohL5(lTN`9OtWWTnwwjH>Ge5dvzb`>
z+%7WE&xTKe0*v0tD00L1AUtF8kXddFb_0_z;fg#letuiT_uo4MgE50|rzutoMB7N$
zvvE#-!wLG7W}x?Q@cMb4I^C(MBu?aeXF9pnvuU>Hl-Uj9wHS48f59KxB<naD;Mo>F
z(t_*HJ04%oD;S7~erRMv(Xu@rF-0l4t|~d*bpE#K{8(v4p0~`~gcA6y8YQI4la}0i
z-5MhTdRqIw^1&GKA{BwStFYOH?d46td21RO-O#@=Sl!gwaA9x;s*S<vL}HkeO(Ft?
zPR}tcuQ#2IZhC~@e?Oh+oBB3GYo-iD;p)2XK<z#>Np-%R=ETu~GanvxGIXc=D0et3
z-HpsBxq|N#I`~~yzTox^AT^&{jxv~|c&B!#vj5uqP<_J!O`2WDC7_wEw7Wudd3cNQ
zXKmTVuJiKkS^wwZo71Bo_s{z9w2W;YFu1vij%aO9yU8`Tf3e~?6WOL>>Sa8zQ%o9e
zZd1vifA*^X3RY)~f#xzpn5;Qy^4mo(SZJ$<mxbjP->E&{PrNP7+CDBG9koqLeY(BN
zXlYkAk=!A-Ro=<%)naSSd2?6+A$26xfYqv$7(6GK8MAbRskOv2+cP?6f?g6E*-h*P
zmT`p)fLn|Tf4q7!XR`^aV8#w)szC9$)$N`zJBQSL0QV$WG!!ol16_E2((B2*Nc<>E
z-Mrlcwo*mY`?ZqHz!e0Hfgd$U{2hkG&#qvNQ6-oTgf~CG>&|DNaB*6s&R`yd9+)o>
z;X(XyZmfMrvFMt4s=7R#cW+?g{3sgV7-yan?iPQ`f4c?By?Ko;&Ujs;t^7(Hb<WqY
zJ|owcA=1GZ5makZ<4HFw#bPe+J={z8+^rE{_-NjBT@9%p$gt31=(W2V*1liO`QQiE
z`9OHOB)N9iqrRXpQEmI8V);m5G1~s(qWI#X_~N2?#6<z4?U1n<tAVrZCYa2YZ578X
zjAZZ7f9>jam@!FKEt6eDwLL%Avx-ZbM=>>o;tp?`I=0@<;OP6egHyqRW5|WJ+x#po
zE|r$lnmeWe_U=60+~JZ4vTj+gvhk$6p6LqrdUTGKIvJn%!q3e`m@dW!^L?Qu)Lb*>
zD!mLTC;NkcA+9%HHc;iyS6$MTdjV_%P~2egHaD%onH#ocXHki<e$Br9dXU}?M+P#D
iHdSHAoFH5@QR`EaHy*u9jR#pD>iPd+(PJK{qXPiRKW{bw

diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 6fa46d6d6c10..1bc5bf08ee46 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -44,7 +44,7 @@
 
 let
   version = "2.33";
-  patchSuffix = "-59";
+  patchSuffix = "-62";
   sha256 = "sha256-LiVWAA4QXb1X8Layoy/yzxc73k8Nhd/8z9i35RoGd/8=";
 in
 
@@ -63,7 +63,7 @@ stdenv.mkDerivation ({
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
           $ git fetch --all -p && git checkout origin/release/2.33/master && git describe
-          glibc-2.33-59-gf9592d65f2
+          glibc-2.33-62-gc493f6a0e4
           $ git show --minimal --reverse glibc-2.33.. | gzip -9n --rsyncable - > 2.33-master.patch.gz
 
          To compare the archive contents zdiff can be used.

From bb6c3730783315069da2a777c06d3855c3606320 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 31 Dec 2021 16:55:05 +0000
Subject: [PATCH 10/23] apacheHttpd: 2.4.51 -> 2.4.52

(cherry picked from commit 78700df9422e34cb8b6d9b4e12a52fa8f12848e8)
---
 pkgs/servers/http/apache-httpd/2.4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index 9538ea9f450f..56d66a2e99cf 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-httpd";
-  version = "2.4.51";
+  version = "2.4.52";
 
   src = fetchurl {
     url = "mirror://apache/httpd/httpd-${version}.tar.bz2";
-    sha256 = "20e01d81fecf077690a4439e3969a9b22a09a8d43c525356e863407741b838f4";
+    sha256 = "sha256-ASf33El+mYPpxRR0vtdeRWB/L4cKdnWobckK9tVy9ck=";
   };
 
   # FIXME: -dev depends on -doc

From ae7297cb3f78e74e262540f70bb2296ddf5e2cab Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 4 Jan 2022 14:55:00 +0100
Subject: [PATCH 11/23] python3Packages.django_2: 2.2.24 -> 2.2.26

(cherry picked from commit ffcf2ec83359d4f222857849d12948b3bf73185b)
---
 pkgs/development/python-modules/django/2.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django/2.nix b/pkgs/development/python-modules/django/2.nix
index 9a0d98034c66..f20eb49c0233 100644
--- a/pkgs/development/python-modules/django/2.nix
+++ b/pkgs/development/python-modules/django/2.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "2.2.25";
+  version = "2.2.26";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-seZerzcTR9SxPrfgYbCXhslzBh3pU5DDJ8hcHiqiNJw=";
+    sha256 = "sha256-36U3Jn1SxiQ6YrMoVadEyoPDfHBgCqz/v9mLxdbYUY8=";
   };
 
   patches = lib.optional withGdal

From cf4dc97831e93900a3611b2a8c533b1889a062e1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 4 Jan 2022 14:56:16 +0100
Subject: [PATCH 12/23] python3Packages.django_3: 3.2.9 -> 3.2.11

(cherry picked from commit ade38fcf21c702a2bbaade528201ace363dc2cbb)
---
 pkgs/development/python-modules/django/3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django/3.nix b/pkgs/development/python-modules/django/3.nix
index fdcb8129f27d..a7bafcfb2707 100644
--- a/pkgs/development/python-modules/django/3.nix
+++ b/pkgs/development/python-modules/django/3.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "3.2.10";
+  version = "3.2.11";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-B06IGLS0Cs3CNp5n3NZVXVWDKXhUCNzSU0DumPHx1cQ=";
+    sha256 = "sha256-aclKvl1rGwiL9HXgm3t0QD+UPjTaEH55hGXSBF2ifnU=";
   };
 
   patches = lib.optional withGdal

From 01c1cb6da5511e6c06bb98fcf3f8af0d1d1f80ad Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Mon, 3 Jan 2022 22:44:21 +0000
Subject: [PATCH 13/23] openexr: add patch for CVE-2021-45942

the CVE description is currently suggesting
https://github.com/AcademySoftwareFoundation/openexr/commit/db217f29dfb24f6b4b5100c24ac5e7490e1c57d0
as the fix, but it is wrong

checked this patch does silence valgrind's complaints with
reproducer file https://oss-fuzz.com/download?testcase_id=5275682339422208

(cherry picked from commit a238071df44df8bebfa4f08fe81661b86f8d4f95)
---
 pkgs/development/libraries/openexr/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/libraries/openexr/default.nix b/pkgs/development/libraries/openexr/default.nix
index d60b7b7fc436..31ca48552755 100644
--- a/pkgs/development/libraries/openexr/default.nix
+++ b/pkgs/development/libraries/openexr/default.nix
@@ -26,6 +26,13 @@ stdenv.mkDerivation rec {
       url = "https://github.com/AcademySoftwareFoundation/openexr/commit/2f19a01923885fda75ec9d19332de080ec7102bd.patch";
       sha256 = "1yxmrdzq1x1911wdzwnzr29jmg2r4wd4yx3vhjn0y5dpny0ri5y5";
     })
+    (fetchpatch {
+      name = "CVE-2021-45942.patch";
+      url = "https://github.com/AcademySoftwareFoundation/openexr/commit/11cad77da87c4fa2aab7d58dd5339e254db7937e.patch";
+      stripLen = 4;
+      extraPrefix = "OpenEXR/IlmImf/";
+      sha256 = "1wa2jn6sa0n3phaqvklnlbgk1bz60y756ad4jk4d757pzpnannsy";
+    })
   ];
 
   nativeBuildInputs = [ cmake ];

From 5793edfe904d495a1ea73ab19eec0b3aa1788cd6 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Mon, 3 Jan 2022 17:49:44 +0000
Subject: [PATCH 14/23] openexr_3: add patch for CVE-2021-45942

the CVE description is currently suggesting
https://github.com/AcademySoftwareFoundation/openexr/commit/db217f29dfb24f6b4b5100c24ac5e7490e1c57d0
as the fix, but it is wrong

checked this patch does silence valgrind's complaints with
reproducer file https://oss-fuzz.com/download?testcase_id=5275682339422208

(cherry picked from commit 04c0fa2d3a524a74091b51b0d180eec138362272)
---
 pkgs/development/libraries/openexr/3.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/libraries/openexr/3.nix b/pkgs/development/libraries/openexr/3.nix
index 1fae66829065..dab6b2540896 100644
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , zlib
 , cmake
 , imath
@@ -19,6 +20,14 @@ stdenv.mkDerivation rec {
     sha256 = "0vyclrrikphwkkpyjg8kzh3qzflzk3d6xsidgqllgfdgllr9wmgv";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2021-45942.patch";
+      url = "https://github.com/AcademySoftwareFoundation/openexr/commit/11cad77da87c4fa2aab7d58dd5339e254db7937e.patch";
+      sha256 = "1qa8662ga5i0lyfi9mkj9s9bygdg7h1i6ahki28c664kxrlsakch";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
   propagatedBuildInputs = [ imath zlib ];
 

From 260faba296a0829f0d9e86dd2ec279861adf5fb4 Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Mon, 3 Jan 2022 15:40:39 +0100
Subject: [PATCH 15/23] llvmPackages_*.clang: stop passing LLVM_CONFIG_PATH
 unnecessarily

Starting with LLVM 8, clang does no longer use llvm-config to detect the
LLVM installation: https://github.com/llvm/llvm-project/commit/e4faa5c7986b7
Consequently, there is no point passing LLVM_CONFIG_PATH (in fact the
variable is unused currently).

(cherry picked from commit c58517aeed3ee840a0d92455e4f4231f2396d73f)
---
 pkgs/development/compilers/llvm/10/clang/default.nix  | 1 -
 pkgs/development/compilers/llvm/11/clang/default.nix  | 1 -
 pkgs/development/compilers/llvm/12/clang/default.nix  | 1 -
 pkgs/development/compilers/llvm/13/clang/default.nix  | 1 -
 pkgs/development/compilers/llvm/8/clang/default.nix   | 1 -
 pkgs/development/compilers/llvm/9/clang/default.nix   | 1 -
 pkgs/development/compilers/llvm/git/clang/default.nix | 1 -
 7 files changed, 7 deletions(-)

diff --git a/pkgs/development/compilers/llvm/10/clang/default.nix b/pkgs/development/compilers/llvm/10/clang/default.nix
index b42f40b96943..5336e4ea35a3 100644
--- a/pkgs/development/compilers/llvm/10/clang/default.nix
+++ b/pkgs/development/compilers/llvm/10/clang/default.nix
@@ -29,7 +29,6 @@ let
       "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/pkgs/development/compilers/llvm/11/clang/default.nix b/pkgs/development/compilers/llvm/11/clang/default.nix
index 9eed5269da6b..630a4b194248 100644
--- a/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@@ -30,7 +30,6 @@ let
     cmakeFlags = [
       "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/pkgs/development/compilers/llvm/12/clang/default.nix b/pkgs/development/compilers/llvm/12/clang/default.nix
index d6ee37524415..2938bd67a8a8 100644
--- a/pkgs/development/compilers/llvm/12/clang/default.nix
+++ b/pkgs/development/compilers/llvm/12/clang/default.nix
@@ -31,7 +31,6 @@ let
     cmakeFlags = [
       "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/pkgs/development/compilers/llvm/13/clang/default.nix b/pkgs/development/compilers/llvm/13/clang/default.nix
index ab826fa31526..a54cf446743c 100644
--- a/pkgs/development/compilers/llvm/13/clang/default.nix
+++ b/pkgs/development/compilers/llvm/13/clang/default.nix
@@ -21,7 +21,6 @@ let
     cmakeFlags = [
       "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/pkgs/development/compilers/llvm/8/clang/default.nix b/pkgs/development/compilers/llvm/8/clang/default.nix
index 5cb7720d026f..1d6a5b7d74df 100644
--- a/pkgs/development/compilers/llvm/8/clang/default.nix
+++ b/pkgs/development/compilers/llvm/8/clang/default.nix
@@ -30,7 +30,6 @@ let
       "-DCMAKE_CXX_FLAGS=-std=c++11"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/pkgs/development/compilers/llvm/9/clang/default.nix b/pkgs/development/compilers/llvm/9/clang/default.nix
index c98b4a830c42..ee124b43bfce 100644
--- a/pkgs/development/compilers/llvm/9/clang/default.nix
+++ b/pkgs/development/compilers/llvm/9/clang/default.nix
@@ -30,7 +30,6 @@ let
       "-DCMAKE_CXX_FLAGS=-std=c++11"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/pkgs/development/compilers/llvm/git/clang/default.nix b/pkgs/development/compilers/llvm/git/clang/default.nix
index a775af3031b7..097b80656ff4 100644
--- a/pkgs/development/compilers/llvm/git/clang/default.nix
+++ b/pkgs/development/compilers/llvm/git/clang/default.nix
@@ -21,7 +21,6 @@ let
     cmakeFlags = [
       "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"

From c162a080830611908f524be8588a947f1a117186 Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Fri, 31 Dec 2021 15:12:35 +0100
Subject: [PATCH 16/23] llvmPackages*.libllvm: drop outputs.patch for
 llvm-config.patch

Due to gnu-install-dirs.patch llvm-config will return correct results
for --link-shared as well as --link-static even without this patch.

(cherry picked from commit 677a94fd9e145fb1d473528cf000d8ea7ca1ae69)
---
 .../compilers/llvm/10/llvm/default.nix           |  5 -----
 .../compilers/llvm/10/llvm/outputs.patch         | 16 ----------------
 .../compilers/llvm/11/llvm/default.nix           |  5 -----
 .../compilers/llvm/11/llvm/outputs.patch         | 16 ----------------
 .../compilers/llvm/12/llvm/default.nix           |  5 -----
 .../compilers/llvm/12/llvm/outputs.patch         | 16 ----------------
 .../compilers/llvm/13/llvm/default.nix           |  5 -----
 .../compilers/llvm/13/llvm/outputs.patch         | 16 ----------------
 .../compilers/llvm/5/llvm/default.nix            |  5 -----
 .../compilers/llvm/5/llvm/outputs.patch          | 16 ----------------
 .../compilers/llvm/6/llvm/default.nix            |  5 -----
 .../compilers/llvm/6/llvm/outputs.patch          | 16 ----------------
 .../compilers/llvm/7/llvm/default.nix            |  5 -----
 .../compilers/llvm/7/llvm/outputs.patch          | 16 ----------------
 .../compilers/llvm/8/llvm/default.nix            |  5 -----
 .../compilers/llvm/8/llvm/outputs.patch          | 16 ----------------
 .../compilers/llvm/9/llvm/default.nix            |  5 -----
 .../compilers/llvm/9/llvm/outputs.patch          | 16 ----------------
 .../compilers/llvm/git/llvm/default.nix          |  5 -----
 .../compilers/llvm/git/llvm/outputs.patch        | 16 ----------------
 20 files changed, 210 deletions(-)
 delete mode 100644 pkgs/development/compilers/llvm/10/llvm/outputs.patch
 delete mode 100644 pkgs/development/compilers/llvm/11/llvm/outputs.patch
 delete mode 100644 pkgs/development/compilers/llvm/12/llvm/outputs.patch
 delete mode 100644 pkgs/development/compilers/llvm/13/llvm/outputs.patch
 delete mode 100644 pkgs/development/compilers/llvm/5/llvm/outputs.patch
 delete mode 100644 pkgs/development/compilers/llvm/6/llvm/outputs.patch
 delete mode 100644 pkgs/development/compilers/llvm/7/llvm/outputs.patch
 delete mode 100644 pkgs/development/compilers/llvm/8/llvm/outputs.patch
 delete mode 100644 pkgs/development/compilers/llvm/9/llvm/outputs.patch
 delete mode 100644 pkgs/development/compilers/llvm/git/llvm/outputs.patch

diff --git a/pkgs/development/compilers/llvm/10/llvm/default.nix b/pkgs/development/compilers/llvm/10/llvm/default.nix
index 413de2f868a3..c8c9a936e408 100644
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@@ -79,11 +79,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
diff --git a/pkgs/development/compilers/llvm/10/llvm/outputs.patch b/pkgs/development/compilers/llvm/10/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8a..000000000000
--- a/pkgs/development/compilers/llvm/10/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/11/llvm/default.nix b/pkgs/development/compilers/llvm/11/llvm/default.nix
index 32981b9d4dde..7f51714b8948 100644
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@@ -71,11 +71,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
diff --git a/pkgs/development/compilers/llvm/11/llvm/outputs.patch b/pkgs/development/compilers/llvm/11/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8a..000000000000
--- a/pkgs/development/compilers/llvm/11/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/12/llvm/default.nix b/pkgs/development/compilers/llvm/12/llvm/default.nix
index bb5676b9d48e..d2d7b83de345 100644
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/12/llvm/default.nix
@@ -72,11 +72,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
diff --git a/pkgs/development/compilers/llvm/12/llvm/outputs.patch b/pkgs/development/compilers/llvm/12/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8a..000000000000
--- a/pkgs/development/compilers/llvm/12/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/13/llvm/default.nix b/pkgs/development/compilers/llvm/13/llvm/default.nix
index 115b56396e8d..0b17ae326557 100644
--- a/pkgs/development/compilers/llvm/13/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/13/llvm/default.nix
@@ -66,11 +66,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
diff --git a/pkgs/development/compilers/llvm/13/llvm/outputs.patch b/pkgs/development/compilers/llvm/13/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8a..000000000000
--- a/pkgs/development/compilers/llvm/13/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/5/llvm/default.nix b/pkgs/development/compilers/llvm/5/llvm/default.nix
index a4d2fec36193..9ad5e80e433b 100644
--- a/pkgs/development/compilers/llvm/5/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/5/llvm/default.nix
@@ -72,11 +72,6 @@ stdenv.mkDerivation ({
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
diff --git a/pkgs/development/compilers/llvm/5/llvm/outputs.patch b/pkgs/development/compilers/llvm/5/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8a..000000000000
--- a/pkgs/development/compilers/llvm/5/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/6/llvm/default.nix b/pkgs/development/compilers/llvm/6/llvm/default.nix
index 1c010980048c..9722f6dcd172 100644
--- a/pkgs/development/compilers/llvm/6/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/6/llvm/default.nix
@@ -70,11 +70,6 @@ stdenv.mkDerivation ({
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
diff --git a/pkgs/development/compilers/llvm/6/llvm/outputs.patch b/pkgs/development/compilers/llvm/6/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8a..000000000000
--- a/pkgs/development/compilers/llvm/6/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/7/llvm/default.nix b/pkgs/development/compilers/llvm/7/llvm/default.nix
index ac6efaccb865..a9c463e447e6 100644
--- a/pkgs/development/compilers/llvm/7/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/7/llvm/default.nix
@@ -74,11 +74,6 @@ in stdenv.mkDerivation ({
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
diff --git a/pkgs/development/compilers/llvm/7/llvm/outputs.patch b/pkgs/development/compilers/llvm/7/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8a..000000000000
--- a/pkgs/development/compilers/llvm/7/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/8/llvm/default.nix b/pkgs/development/compilers/llvm/8/llvm/default.nix
index 48a434b24c7c..5c5854de5902 100644
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@@ -77,11 +77,6 @@ in stdenv.mkDerivation ({
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
diff --git a/pkgs/development/compilers/llvm/8/llvm/outputs.patch b/pkgs/development/compilers/llvm/8/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8a..000000000000
--- a/pkgs/development/compilers/llvm/8/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/9/llvm/default.nix b/pkgs/development/compilers/llvm/9/llvm/default.nix
index a569c00071de..1dfa5ede895d 100644
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@@ -75,11 +75,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
diff --git a/pkgs/development/compilers/llvm/9/llvm/outputs.patch b/pkgs/development/compilers/llvm/9/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8a..000000000000
--- a/pkgs/development/compilers/llvm/9/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 4c895f81dbba..6dd263d65e6a 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -58,11 +58,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
diff --git a/pkgs/development/compilers/llvm/git/llvm/outputs.patch b/pkgs/development/compilers/llvm/git/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8a..000000000000
--- a/pkgs/development/compilers/llvm/git/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,

From 4d0de000535a36a04ad541234feaad0cfc781168 Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Fri, 31 Dec 2021 13:46:48 +0100
Subject: [PATCH 17/23] llvmPackages_*.libllvm: make llvm-config and
 llvm-config equivalent

LLVM's build system creates NATIVE/bin/llvm-config by reexecuting cmake
with entirely new flags. Problematically, the `CMAKE_INSTALL_*` flags
are not inherited, causing llvm-config-native to return wrong
installation paths, e. g. CMAKE_INSTALL_LIBDIR would default to `lib64`
on x86_64-linux. Previously this was masked by outputs.patch which
replaced ActiveLibDir with a string passed in from Nix, however
`--cmakedir` for example would turn out to be wrong always, breaking
cross-compilation of e. g. lld.

Additionally LLVM_ENABLE_RTTI needs to be repassed, as it is used to
determine if RTTI is available. Passing LLVM_LINK_LLVM_DYLIB is crucial
if we are building LLVM non-statically: It influences the --shared-mode
flag (which should indicate that -lLLVM is enough to link all
components) and makes --link-shared work in the first place,
i. e. llvm-config-native believes the built shared libs don't exist
unless we repass this flag.

Passing LLVM_LINK_LLVM_DYLIB=ON, however, makes the native build produce
a full libLLVM.so which is something we don't want, so we introduce a
patch which forces llvm-config to link statically against the LLVM
components it needs.

(cherry picked from commit e10edcc27810bdbf3dc15c47860bf2a34cfddc24)
---
 .../compilers/llvm/10/llvm/default.nix        | 42 +++++++++++++++---
 .../compilers/llvm/11/llvm/default.nix        | 42 +++++++++++++++---
 .../compilers/llvm/12/llvm/default.nix        | 42 +++++++++++++++---
 .../compilers/llvm/13/llvm/default.nix        | 42 +++++++++++++++---
 .../compilers/llvm/5/llvm/default.nix         | 43 ++++++++++++++++---
 .../compilers/llvm/6/llvm/default.nix         | 43 ++++++++++++++++---
 .../compilers/llvm/7/llvm/default.nix         | 43 ++++++++++++++++---
 .../compilers/llvm/8/llvm/default.nix         | 42 +++++++++++++++---
 .../compilers/llvm/9/llvm/default.nix         | 42 +++++++++++++++---
 .../compilers/llvm/git/llvm/default.nix       | 42 +++++++++++++++---
 .../llvm/llvm-config-link-static.patch        | 12 ++++++
 11 files changed, 375 insertions(+), 60 deletions(-)
 create mode 100644 pkgs/development/compilers/llvm/llvm-config-link-static.patch

diff --git a/pkgs/development/compilers/llvm/10/llvm/default.nix b/pkgs/development/compilers/llvm/10/llvm/default.nix
index c8c9a936e408..c08d9a2cd853 100644
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@@ -57,6 +57,12 @@ in stdenv.mkDerivation (rec {
   propagatedBuildInputs = [ ncurses zlib ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
     # On older CPUs (e.g. Hydra/wendy) we'd be getting an error in this test.
     (fetchpatch {
@@ -111,18 +117,28 @@ in stdenv.mkDerivation (rec {
     ln -sv $PWD/lib $out
   '';
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=ON"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -148,7 +164,21 @@ in stdenv.mkDerivation (rec {
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
diff --git a/pkgs/development/compilers/llvm/11/llvm/default.nix b/pkgs/development/compilers/llvm/11/llvm/default.nix
index 7f51714b8948..aba2051e8e29 100644
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@@ -57,6 +57,12 @@ in stdenv.mkDerivation (rec {
   propagatedBuildInputs = [ ncurses zlib ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
     # On older CPUs (e.g. Hydra/wendy) we'd be getting an error in this test.
     (fetchpatch {
@@ -106,18 +112,28 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=ON"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -143,7 +159,21 @@ in stdenv.mkDerivation (rec {
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
diff --git a/pkgs/development/compilers/llvm/12/llvm/default.nix b/pkgs/development/compilers/llvm/12/llvm/default.nix
index d2d7b83de345..c1307816d253 100644
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/12/llvm/default.nix
@@ -58,6 +58,12 @@ in stdenv.mkDerivation (rec {
     ++ [ zlib ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
     # On older CPUs (e.g. Hydra/wendy) we'd be getting an error in this test.
     (fetchpatch {
@@ -111,18 +117,28 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=ON"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -148,7 +164,21 @@ in stdenv.mkDerivation (rec {
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
diff --git a/pkgs/development/compilers/llvm/13/llvm/default.nix b/pkgs/development/compilers/llvm/13/llvm/default.nix
index 0b17ae326557..e5b05004901e 100644
--- a/pkgs/development/compilers/llvm/13/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/13/llvm/default.nix
@@ -52,6 +52,12 @@ in stdenv.mkDerivation (rec {
   checkInputs = [ which ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
 
     # Fix random compiler crashes: https://bugs.llvm.org/show_bug.cgi?id=50611
@@ -104,18 +110,28 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=ON"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -141,7 +157,21 @@ in stdenv.mkDerivation (rec {
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
diff --git a/pkgs/development/compilers/llvm/5/llvm/default.nix b/pkgs/development/compilers/llvm/5/llvm/default.nix
index 9ad5e80e433b..09024bd9ff48 100644
--- a/pkgs/development/compilers/llvm/5/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/5/llvm/default.nix
@@ -65,6 +65,13 @@ stdenv.mkDerivation ({
     #  sha256 = "0injj1hqgrbcbihhwp2nbal88jfykad30r54f2cdcx7gws2fcy8i";
     #  stripLen = 1;
     #})
+
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
@@ -95,20 +102,30 @@ stdenv.mkDerivation ({
     ln -sv $PWD/lib $out
   '';
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=ON"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
 
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DTARGET_TRIPLE=${stdenv.hostPlatform.config}"
   ]
-  ++ lib.optional enableSharedLibraries
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ++ lib.optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -135,7 +152,21 @@ stdenv.mkDerivation ({
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
diff --git a/pkgs/development/compilers/llvm/6/llvm/default.nix b/pkgs/development/compilers/llvm/6/llvm/default.nix
index 9722f6dcd172..9af04fbcce94 100644
--- a/pkgs/development/compilers/llvm/6/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/6/llvm/default.nix
@@ -63,6 +63,13 @@ stdenv.mkDerivation ({
       includes = [ "test/tools/gold/X86/common.ll" ];
       sha256 = "0fxgrxmfnjx17w3lcq19rk68b2xksh1bynz3ina784kma7hp4wdb";
     })
+
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
@@ -88,19 +95,29 @@ stdenv.mkDerivation ({
     ln -sv $PWD/lib $out
   '';
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=ON"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -126,7 +143,21 @@ stdenv.mkDerivation ({
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
diff --git a/pkgs/development/compilers/llvm/7/llvm/default.nix b/pkgs/development/compilers/llvm/7/llvm/default.nix
index a9c463e447e6..9e1dc0ca35c8 100644
--- a/pkgs/development/compilers/llvm/7/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/7/llvm/default.nix
@@ -67,6 +67,13 @@ in stdenv.mkDerivation ({
       url = "https://github.com/llvm-mirror/llvm/commit/cc1f2a595ead516812a6c50398f0f3480ebe031f.patch";
       sha256 = "0k6k1p5yisgwx417a67s7sr9930rqh1n0zv5jvply8vjjy4b3kf8";
     })
+
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
@@ -105,19 +112,29 @@ in stdenv.mkDerivation ({
     ln -sv $PWD/lib $out
   '';
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=ON"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -143,7 +160,21 @@ in stdenv.mkDerivation ({
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
diff --git a/pkgs/development/compilers/llvm/8/llvm/default.nix b/pkgs/development/compilers/llvm/8/llvm/default.nix
index 5c5854de5902..eea6564f068b 100644
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@@ -57,6 +57,12 @@ in stdenv.mkDerivation ({
   propagatedBuildInputs = [ ncurses zlib ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     # Fix missing includes for GCC 10
     (fetchpatch {
       url = "https://bugs.gentoo.org/attachment.cgi?id=612792";
@@ -99,18 +105,28 @@ in stdenv.mkDerivation ({
     ln -sv $PWD/lib $out
   '';
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=ON"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -136,7 +152,21 @@ in stdenv.mkDerivation ({
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
diff --git a/pkgs/development/compilers/llvm/9/llvm/default.nix b/pkgs/development/compilers/llvm/9/llvm/default.nix
index 1dfa5ede895d..dccb3f847d56 100644
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@@ -57,6 +57,12 @@ in stdenv.mkDerivation (rec {
   propagatedBuildInputs = [ ncurses zlib ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
     # Force a test to evaluate the saved benchmark for a CPU for which LLVM has
     # an execution model. See NixOS/nixpkgs#119673.
@@ -114,18 +120,28 @@ in stdenv.mkDerivation (rec {
     ln -sv $PWD/lib $out
   '';
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=ON"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -151,7 +167,21 @@ in stdenv.mkDerivation (rec {
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 6dd263d65e6a..60be62980e91 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -51,6 +51,12 @@ in stdenv.mkDerivation (rec {
   checkInputs = [ which ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
@@ -96,18 +102,28 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=ON"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -133,7 +149,21 @@ in stdenv.mkDerivation (rec {
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
diff --git a/pkgs/development/compilers/llvm/llvm-config-link-static.patch b/pkgs/development/compilers/llvm/llvm-config-link-static.patch
new file mode 100644
index 000000000000..3881cc5206e2
--- /dev/null
+++ b/pkgs/development/compilers/llvm/llvm-config-link-static.patch
@@ -0,0 +1,12 @@
+diff --git llvm/tools/llvm-config/CMakeLists.txt llvm/tools/llvm-config/CMakeLists.txt
+index 16ba54c0cf2f..20b017195e84 100644
+--- llvm/tools/llvm-config/CMakeLists.txt
++++ llvm/tools/llvm-config/CMakeLists.txt
+@@ -6,6 +6,7 @@ set(BUILDVARIABLES_OBJPATH ${CMAKE_CURRENT_BINARY_DIR}/BuildVariables.inc)
+ # Add the llvm-config tool.
+ add_llvm_tool(llvm-config
+   llvm-config.cpp
++  DISABLE_LLVM_LINK_LLVM_DYLIB
+   )
+ 
+ # Compute the substitution values for various items.

From 2cab1bd5019f916684a42a1e69c419443bc8db6a Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Sun, 12 Dec 2021 16:16:08 +0000
Subject: [PATCH 18/23] libjxl: fix/enable for aarch64

(cherry picked from commit f24cab5396085e138ff82d53888af8a9a7d83055)
---
 pkgs/development/libraries/libjxl/default.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/libjxl/default.nix b/pkgs/development/libraries/libjxl/default.nix
index 5838561ff0ab..b4f6a05640a5 100644
--- a/pkgs/development/libraries/libjxl/default.nix
+++ b/pkgs/development/libraries/libjxl/default.nix
@@ -43,9 +43,14 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  # hydra's darwin machines run into https://github.com/libjxl/libjxl/issues/408
-  # unless we disable highway's tests
-  postPatch = lib.optional stdenv.isDarwin ''
+  postPatch = ''
+    # "robust statistics" have been removed in upstream mainline as they are
+    # conidered to cause "interoperability problems". sure enough the tests
+    # fail with precision issues on aarch64.
+    sed -i '/robust_statistics_test.cc/d' lib/{jxl_tests.cmake,lib.gni}
+  '' + lib.optionalString stdenv.isDarwin ''
+    # hydra's darwin machines run into https://github.com/libjxl/libjxl/issues/408
+    # unless we disable highway's tests
     substituteInPlace third_party/highway/CMakeLists.txt \
       --replace 'if(BUILD_TESTING)' 'if(false)'
   '';
@@ -122,6 +127,5 @@ stdenv.mkDerivation rec {
     license = licenses.bsd3;
     maintainers = with maintainers; [ nh2 ];
     platforms = platforms.all;
-    broken = stdenv.hostPlatform.isAarch64; # `internal compiler error`, see https://github.com/NixOS/nixpkgs/pull/103160#issuecomment-866388610
   };
 }

From 0c6ffefff95ad49507d3bdf2c5457acc3a388891 Mon Sep 17 00:00:00 2001
From: Moritz Angermann <moritz.angermann@gmail.com>
Date: Wed, 22 Dec 2021 17:54:49 +0800
Subject: [PATCH 19/23] llvmPackages_12.llvm: create fix-llvm-issue-49955.patch

This patch addresses llvm/llvm-project#49955

(cherry picked from commit afca44c064196df9f0271e680bd5fb0373a0becb)
---
 pkgs/development/compilers/llvm/12/llvm/default.nix |  3 +++
 .../llvm/12/llvm/fix-llvm-issue-49955.patch         | 13 +++++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 pkgs/development/compilers/llvm/12/llvm/fix-llvm-issue-49955.patch

diff --git a/pkgs/development/compilers/llvm/12/llvm/default.nix b/pkgs/development/compilers/llvm/12/llvm/default.nix
index c1307816d253..7c90bf444335 100644
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/12/llvm/default.nix
@@ -63,6 +63,9 @@ in stdenv.mkDerivation (rec {
     # a native libLLVM.so (which would fail) we force llvm-config to be linked
     # statically against the necessary LLVM components always.
     ../../llvm-config-link-static.patch
+    # Fix llvm being miscompiled by some gccs. See llvm/llvm-project#49955
+    # Fix llvm being miscompiled by some gccs. See https://github.com/llvm/llvm-project/issues/49955
+    ./fix-llvm-issue-49955.patch
 
     ./gnu-install-dirs.patch
     # On older CPUs (e.g. Hydra/wendy) we'd be getting an error in this test.
diff --git a/pkgs/development/compilers/llvm/12/llvm/fix-llvm-issue-49955.patch b/pkgs/development/compilers/llvm/12/llvm/fix-llvm-issue-49955.patch
new file mode 100644
index 000000000000..b515583a0c42
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/llvm/fix-llvm-issue-49955.patch
@@ -0,0 +1,13 @@
+diff --git a/lib/CodeGen/AsmPrinter/CMakeLists.txt b/lib/CodeGen/AsmPrinter/CMakeLists.txt
+index eb924282..c77c140b 100644
+--- a/lib/CodeGen/AsmPrinter/CMakeLists.txt
++++ b/lib/CodeGen/AsmPrinter/CMakeLists.txt
+@@ -44,3 +44,8 @@ add_llvm_component_library(LLVMAsmPrinter
+   Support
+   Target
+   )
++
++if (CMAKE_COMPILER_IS_GNUCXX)
++  set_source_files_properties(DwarfCompileUnit.cpp PROPERTIES
++                              COMPILE_FLAGS -fno-strict-aliasing)
++endif()

From 9d554bb2f0c76966adcde97f9b209fbc83d0eeb6 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 6 Jan 2022 22:46:17 +0100
Subject: [PATCH 20/23] cacert: 3.71 -> 3.74

(cherry picked from commit eb9b64fc3290e4e8e, PR #153769)
---
 pkgs/data/misc/cacert/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index 49645ee80083..4e9925147a35 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -20,7 +20,7 @@ let
   blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" blacklist);
   extraCertificatesBundle = writeText "cacert-extra-certificates-bundle.crt" (lib.concatStringsSep "\n\n" extraCertificateStrings);
 
-  srcVersion = "3.71";
+  srcVersion = "3.74";
   version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = with lib; {
     homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -35,7 +35,7 @@ let
 
     src = if nssOverride != null then nssOverride.src else fetchurl {
       url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
-      sha256 = "0ly2l3dv6z5hlxs72h5x6796ni3x1bq60saavaf42ddgv4ax7b4r";
+      sha256 = "0mnhdkm4galhpvfz4rv0918jwmjlwkvcvb1f5va8f3zlz48qi4l8";
     };
 
     dontBuild = true;

From af91000a7ca004c36ed5ca98782112baed4be45d Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Fri, 7 Jan 2022 02:25:17 +0100
Subject: [PATCH 21/23] wrapCCWith: rely on the new bintools attribute for
 default value

wrapCCWith shipped its own, but imperfect duplication of the logic we
use to choose the bintools for the *next* stage by inspecting
targetPlatform.

This change should ensure that C compilers relying on the default
behavior of wrapCCWith should end up with the same bintools als
theirStage.bintools. In particular, this makes
pkgsLLVM.llvmPackages.stdenv correctly use the LLVM bintools instead of
GNU binutils.

(cherry picked from commit 17c5a15c89f2523b2543f946daa4d018e04d731a)
---
 pkgs/top-level/all-packages.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d9da6ec69ebe..6fa924cab199 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13135,7 +13135,11 @@ with pkgs;
       # Others should instead delegate to the next stage's choice with
       # `targetPackages.stdenv.cc.bintools`. This one is different just to
       # provide the default choice, avoiding infinite recursion.
-      bintools ? if stdenv.targetPlatform.isDarwin then darwin.binutils else binutils
+      # See the bintools attribute for the logic and reasoning. We need to provide
+      # a default here, since eval will hit this function when bootstrapping
+      # stdenv where the bintools attribute doesn't exist, but will never actually
+      # be evaluated -- callPackage ends up being too eager.
+      bintools ? pkgs.bintools
     , libc ? bintools.libc
     , # libc++ from the default LLVM version is bound at the top level, but we
       # want the C++ library to be explicitly chosen by the caller, and null by

From 806e5ab309c8679f393d37655518b0e4acd45d70 Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Fri, 7 Jan 2022 02:30:01 +0100
Subject: [PATCH 22/23] llvmPackages_*: respect cc for target when choosing C++
 flavour
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

llvmPackages_*.clang should check the default compiler for the package
set it is targeting (targetPackages.stdenv.cc) instead of the compiler
that has been used to build it (stdenv.cc) in order to get some sense of
whether to use libc++ or libstdc++.

Since we are now inspecting targetPackages in the llvmPackages.clang
attribute, we need to avoid using it in the cross stdenv — which just
forces us to explicitly request libcxxClang for darwin instead of
relying on the clang attribute to pick it for us.

We also need to do something similar for targetPackages.stdenv.cc: Here
the llvmPackages.clang logic would work as we want (inspect
targetPackages.stdenv.cc and if it doesn't exist, make the choice based
on stdenv.cc), but it gets locked in a cycle with the previous package.
We can easily break this, however: We know that the previous set had
clang and the next one doesn't exist, so we'd choose libcxxClang any day
of the week.

(cherry picked from commit 766f5ffb761bc916ea0f270f472d04ab30664d52)
---
 pkgs/development/compilers/llvm/10/default.nix  | 6 +++++-
 pkgs/development/compilers/llvm/11/default.nix  | 6 +++++-
 pkgs/development/compilers/llvm/12/default.nix  | 6 +++++-
 pkgs/development/compilers/llvm/13/default.nix  | 6 +++++-
 pkgs/development/compilers/llvm/5/default.nix   | 6 +++++-
 pkgs/development/compilers/llvm/6/default.nix   | 6 +++++-
 pkgs/development/compilers/llvm/7/default.nix   | 6 +++++-
 pkgs/development/compilers/llvm/8/default.nix   | 6 +++++-
 pkgs/development/compilers/llvm/9/default.nix   | 6 +++++-
 pkgs/development/compilers/llvm/git/default.nix | 6 +++++-
 pkgs/stdenv/booter.nix                          | 8 +++++++-
 pkgs/stdenv/cross/default.nix                   | 2 +-
 12 files changed, 58 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/compilers/llvm/10/default.nix b/pkgs/development/compilers/llvm/10/default.nix
index 8bd7e937e7d7..83840b4fd27e 100644
--- a/pkgs/development/compilers/llvm/10/default.nix
+++ b/pkgs/development/compilers/llvm/10/default.nix
@@ -89,7 +89,11 @@ let
     #   python3 = pkgs.python3;  # don't use python-boot
     # });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
+      then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index ebd0dc672aa3..b5c070915242 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -104,7 +104,11 @@ let
     #   python3 = pkgs.python3;  # don't use python-boot
     # });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
+      then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/12/default.nix b/pkgs/development/compilers/llvm/12/default.nix
index e68522faea06..8de6bb420d41 100644
--- a/pkgs/development/compilers/llvm/12/default.nix
+++ b/pkgs/development/compilers/llvm/12/default.nix
@@ -92,7 +92,11 @@ let
     #   python3 = pkgs.python3;  # don't use python-boot
     # });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
+      then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/13/default.nix b/pkgs/development/compilers/llvm/13/default.nix
index a89c6dabe391..bdc07a68742d 100644
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@@ -93,7 +93,11 @@ let
     #   python3 = pkgs.python3;  # don't use python-boot
     # });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
+      then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/5/default.nix b/pkgs/development/compilers/llvm/5/default.nix
index 4593580b72fd..4a6d55d55727 100644
--- a/pkgs/development/compilers/llvm/5/default.nix
+++ b/pkgs/development/compilers/llvm/5/default.nix
@@ -65,7 +65,11 @@ let
       python3 = pkgs.python3;  # don't use python-boot
     });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
+      then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/6/default.nix b/pkgs/development/compilers/llvm/6/default.nix
index 9b1caf410bc2..1b9a793e8858 100644
--- a/pkgs/development/compilers/llvm/6/default.nix
+++ b/pkgs/development/compilers/llvm/6/default.nix
@@ -66,7 +66,11 @@ let
       python3 = pkgs.python3;  # don't use python-boot
     });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
+      then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/7/default.nix b/pkgs/development/compilers/llvm/7/default.nix
index d014c043a80d..841fc120d744 100644
--- a/pkgs/development/compilers/llvm/7/default.nix
+++ b/pkgs/development/compilers/llvm/7/default.nix
@@ -96,7 +96,11 @@ let
       python3 = pkgs.python3;  # don't use python-boot
     });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
+      then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/8/default.nix b/pkgs/development/compilers/llvm/8/default.nix
index 7252b75a3397..234473c1adae 100644
--- a/pkgs/development/compilers/llvm/8/default.nix
+++ b/pkgs/development/compilers/llvm/8/default.nix
@@ -97,7 +97,11 @@ let
       python3 = pkgs.python3;  # don't use python-boot
     });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
+      then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/9/default.nix b/pkgs/development/compilers/llvm/9/default.nix
index 9126a614b106..a10bac13824e 100644
--- a/pkgs/development/compilers/llvm/9/default.nix
+++ b/pkgs/development/compilers/llvm/9/default.nix
@@ -97,7 +97,11 @@ let
       python3 = pkgs.python3;  # don't use python-boot
     });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
+      then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index 666e9be3cd89..56904addb52b 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -93,7 +93,11 @@ let
     #   python3 = pkgs.python3;  # don't use python-boot
     # });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
+      then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/stdenv/booter.nix b/pkgs/stdenv/booter.nix
index 51d617354e86..f1d07e6461a9 100644
--- a/pkgs/stdenv/booter.nix
+++ b/pkgs/stdenv/booter.nix
@@ -124,7 +124,13 @@ stageFuns: let
       if buildPackages.stdenv.hasCC
       then
         if buildPackages.stdenv.cc.isClang or false
-        then buildPackages.clang
+        # buildPackages.clang checks targetPackages.stdenv.cc (i. e. this
+        # attribute) to get a sense of the its set's default compiler and
+        # chooses between libc++ and libstdc++ based on that. If we hit this
+        # code here, we'll cause an infinite recursion. Since a set with
+        # clang as its default compiler always means libc++, we can infer this
+        # decision statically.
+        then buildPackages.llvmPackages.libcxxClang
         else buildPackages.gcc
       else
         # This will blow up if anything uses it, but that's OK. The `if
diff --git a/pkgs/stdenv/cross/default.nix b/pkgs/stdenv/cross/default.nix
index 613b8d5304c0..e01ac74599ae 100644
--- a/pkgs/stdenv/cross/default.nix
+++ b/pkgs/stdenv/cross/default.nix
@@ -70,7 +70,7 @@ in lib.init bootStages ++ [
              # when there is a C compiler and everything should be fine.
              then throw "no C compiler provided for this platform"
            else if crossSystem.isDarwin
-             then buildPackages.llvmPackages.clang
+             then buildPackages.llvmPackages.libcxxClang
            else if crossSystem.useLLVM or false
              then buildPackages.llvmPackages.clangUseLLVM
            else buildPackages.gcc;

From 56238790ce9048b03463383828708dbb6d1a638e Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Fri, 7 Jan 2022 12:58:21 +0100
Subject: [PATCH 23/23] llvmPackages_*.clang: pick clangUseLLVM if
 targetPlatform.useLLVM

libcxxClang still depends on cc wrapper's gccForLibs for libgcc which is
not available when useLLVM is set. In such cases we need to switch to
clangUseLLVM and (try) to use compiler-rt instead.

Resolves #153759: pkgsLLVM.llvmPackages.stdenv now correctly
clangUseLLVM as cc, allowing compilation to work as expected.

(cherry picked from commit e238f456b8d643d5afe5370e942e82204907d0ef)
---
 pkgs/development/compilers/llvm/10/default.nix  | 4 ++--
 pkgs/development/compilers/llvm/11/default.nix  | 4 ++--
 pkgs/development/compilers/llvm/12/default.nix  | 4 ++--
 pkgs/development/compilers/llvm/13/default.nix  | 4 ++--
 pkgs/development/compilers/llvm/5/default.nix   | 4 ++--
 pkgs/development/compilers/llvm/6/default.nix   | 4 ++--
 pkgs/development/compilers/llvm/7/default.nix   | 4 ++--
 pkgs/development/compilers/llvm/8/default.nix   | 4 ++--
 pkgs/development/compilers/llvm/9/default.nix   | 4 ++--
 pkgs/development/compilers/llvm/git/default.nix | 4 ++--
 10 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/pkgs/development/compilers/llvm/10/default.nix b/pkgs/development/compilers/llvm/10/default.nix
index 83840b4fd27e..5cb6c278659d 100644
--- a/pkgs/development/compilers/llvm/10/default.nix
+++ b/pkgs/development/compilers/llvm/10/default.nix
@@ -91,8 +91,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
-      then tools.libstdcxxClang
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index b5c070915242..82a78af85cac 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -106,8 +106,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
-      then tools.libstdcxxClang
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/12/default.nix b/pkgs/development/compilers/llvm/12/default.nix
index 8de6bb420d41..4a2a7ee87894 100644
--- a/pkgs/development/compilers/llvm/12/default.nix
+++ b/pkgs/development/compilers/llvm/12/default.nix
@@ -94,8 +94,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
-      then tools.libstdcxxClang
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/13/default.nix b/pkgs/development/compilers/llvm/13/default.nix
index bdc07a68742d..be5e9404cdd4 100644
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@@ -95,8 +95,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
-      then tools.libstdcxxClang
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/5/default.nix b/pkgs/development/compilers/llvm/5/default.nix
index 4a6d55d55727..ef9886fb5ea7 100644
--- a/pkgs/development/compilers/llvm/5/default.nix
+++ b/pkgs/development/compilers/llvm/5/default.nix
@@ -67,8 +67,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
-      then tools.libstdcxxClang
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/6/default.nix b/pkgs/development/compilers/llvm/6/default.nix
index 1b9a793e8858..4acfe6cd85d7 100644
--- a/pkgs/development/compilers/llvm/6/default.nix
+++ b/pkgs/development/compilers/llvm/6/default.nix
@@ -68,8 +68,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
-      then tools.libstdcxxClang
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/7/default.nix b/pkgs/development/compilers/llvm/7/default.nix
index 841fc120d744..f0908f30775d 100644
--- a/pkgs/development/compilers/llvm/7/default.nix
+++ b/pkgs/development/compilers/llvm/7/default.nix
@@ -98,8 +98,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
-      then tools.libstdcxxClang
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/8/default.nix b/pkgs/development/compilers/llvm/8/default.nix
index 234473c1adae..43050a72b922 100644
--- a/pkgs/development/compilers/llvm/8/default.nix
+++ b/pkgs/development/compilers/llvm/8/default.nix
@@ -99,8 +99,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
-      then tools.libstdcxxClang
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/9/default.nix b/pkgs/development/compilers/llvm/9/default.nix
index a10bac13824e..7efe8486a387 100644
--- a/pkgs/development/compilers/llvm/9/default.nix
+++ b/pkgs/development/compilers/llvm/9/default.nix
@@ -99,8 +99,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
-      then tools.libstdcxxClang
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index 56904addb52b..890270c851db 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -95,8 +95,8 @@ let
 
     # pick clang appropriate for package set we are targeting
     clang =
-      if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU
-      then tools.libstdcxxClang
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
       else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {