From 160c8d88867dfe95ec75fb6133d1768c014226d7 Mon Sep 17 00:00:00 2001
From: Dmitry Kalinkin <dmitry.kalinkin@gmail.com>
Date: Tue, 10 Aug 2021 23:29:42 -0400
Subject: [PATCH 01/51] python3Packages.numpy: proper fix for Werror
 misdetection bug

---
 pkgs/development/python-modules/numpy/default.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index 9071cec1b03d..62a922d62a33 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchPypi
+, fetchpatch
 , python
 , buildPythonPackage
 , gfortran
@@ -50,7 +51,13 @@ in buildPythonPackage rec {
     sha256 = "1za22ggjxzm7drs2vd15s81ad9rlshk4p7pv7mxcbz4acdiszx6z";
   };
 
-  patches = lib.optionals python.hasDistutilsCxxPatch [
+  patches = [
+    # fix https://github.com/numpy/numpy/issues/19624
+    (fetchpatch {
+      url = "https://github.com/numpy/numpy/commit/ae279066d6bd253e8675428fac8946938b8d48d9.diff";
+      sha256 = "sha256-q8SoF/pMzLI4zYCx2YAZzR31cARlZXerNnBSevBO5pE=";
+    })
+  ] ++ lib.optionals python.hasDistutilsCxxPatch [
     # We patch cpython/distutils to fix https://bugs.python.org/issue1222585
     # Patching of numpy.distutils is needed to prevent it from undoing the
     # patch to distutils.
@@ -73,10 +80,6 @@ in buildPythonPackage rec {
     ln -s ${cfg} site.cfg
   '';
 
-  # Workaround flakey compiler feature detection
-  # https://github.com/numpy/numpy/issues/19624
-  hardeningDisable = [ "strictoverflow" ];
-
   enableParallelBuilding = true;
 
   checkInputs = [

From 3780c7c21127eed5753a7df6017d43eeb0b7aa9a Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 22 Oct 2021 21:39:13 +0100
Subject: [PATCH 02/51] gnome2.ORBit2: update homepage to
 https://developer-old.gnome.org/ORBit2/

Previous homepage returned 404.
---
 pkgs/desktops/gnome-2/platform/ORBit2/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/desktops/gnome-2/platform/ORBit2/default.nix b/pkgs/desktops/gnome-2/platform/ORBit2/default.nix
index ab76e0c64fd1..456a9ed24bb3 100644
--- a/pkgs/desktops/gnome-2/platform/ORBit2/default.nix
+++ b/pkgs/desktops/gnome-2/platform/ORBit2/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage    = "https://projects.gnome.org/ORBit2/";
+    homepage    = "https://developer-old.gnome.org/ORBit2/";
     description = "A CORBA 2.4-compliant Object Request Broker";
     platforms   = platforms.unix;
     maintainers = with maintainers; [ lovek323 ];

From 1d9e598b5fadab5b52236268dfcd21153ce3edf3 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 22 Oct 2021 22:35:09 +0100
Subject: [PATCH 03/51] gnome2.ORBit2: explicitly disable build parallelism due
 to missing depends

---
 pkgs/desktops/gnome-2/platform/ORBit2/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/desktops/gnome-2/platform/ORBit2/default.nix b/pkgs/desktops/gnome-2/platform/ORBit2/default.nix
index 456a9ed24bb3..bf5ae4ebbb1a 100644
--- a/pkgs/desktops/gnome-2/platform/ORBit2/default.nix
+++ b/pkgs/desktops/gnome-2/platform/ORBit2/default.nix
@@ -22,6 +22,14 @@ stdenv.mkDerivation rec {
     moveToOutput "bin/orbit2-config" "$dev"
   '';
 
+  # Parallel build fails due to missing internal library dependency:
+  #    libtool --tag=CC   --mode=link gcc ... -o orbit-name-server-2 ...
+  #    ld: cannot find libname-server-2.a: No such file or directory
+  # It happens because orbit-name-server-2 should have libname-server-2.a
+  # in _DEPENDENCIES but does not. Instead of fixing it and regenerating
+  # Makefile.in let's just disable parallel build.
+  enableParallelBuilding = false;
+
   meta = with lib; {
     homepage    = "https://developer-old.gnome.org/ORBit2/";
     description = "A CORBA 2.4-compliant Object Request Broker";

From 972d7e74f61e2ded43e8ff998c1b8678c14f8e49 Mon Sep 17 00:00:00 2001
From: Akshat Agarwal <humancalico@disroot.org>
Date: Tue, 2 Nov 2021 16:43:55 +0530
Subject: [PATCH 04/51] linux-kernel: enable BPF_LSM

Enables instrumentation of the security hooks with BPF programs for
implementing dynamic MAC and Audit Policies.

The BPF LSM was merged into the Linux kernel 5.7

This has already been enabled in Fedora (version 33 onwards), Ubuntu
(Hirsute Hippo), Flatcar Linux, Arch Linux.

Distros like Ubuntu don't enable bpf in CONFIG_LSM by default to avoid
any performance penalty so similar to that this commit enables
CONFIG_BPF_LSM but doesn't add bpf to the default list in CONFIG_LSM,
users willing to use this feature could boot with the lsm=...bpf
parameter on the kernel

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=641cd7b06c911c5935c34f24850ea18690649917
https://outflux.net/blog/archives/2020/09/21/security-things-in-linux-v5-7/
https://lwn.net/Articles/813057/
https://github.com/flatcar-linux/Flatcar/issues/343
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1905975
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=983329
---
 pkgs/os-specific/linux/kernel/common-config.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 207396b7d772..961d01b71fcc 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -41,6 +41,7 @@ let
         (whenAtLeast "5.2" yes)
       ];
       DEBUG_INFO_BTF            = whenAtLeast "5.2" (option yes);
+      BPF_LSM                   = whenAtLeast "5.7" (option yes);
       DEBUG_KERNEL              = yes;
       DEBUG_DEVRES              = no;
       DYNAMIC_DEBUG             = yes;

From 90dbec47b7c8eff5262fda73d97335fb29e079fa Mon Sep 17 00:00:00 2001
From: Victor Engmark <victor@engmark.name>
Date: Sun, 14 Nov 2021 15:53:26 +1300
Subject: [PATCH 05/51] vanity: Indent with spaces

Some literal tabs within strings should probably be spaces `\t`, but
I'm not familiar enough to make that call.
---
 maintainers/scripts/vanity.sh | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/maintainers/scripts/vanity.sh b/maintainers/scripts/vanity.sh
index aa7d4ec967da..a6e82e039422 100755
--- a/maintainers/scripts/vanity.sh
+++ b/maintainers/scripts/vanity.sh
@@ -30,7 +30,7 @@ fetchGithubName () {
         curl https://github.com/NixOS/nixpkgs/commit/"$commitid" 2>/dev/null |
         grep committed -B10 | grep 'href="/' |
         sed -re 's@.* href="/@@; s@".*@@' |
-	grep -v "/commit/"
+        grep -v "/commit/"
     )";
     echo "$userid"
 }
@@ -38,7 +38,7 @@ fetchGithubName () {
 [ -n "$NIXPKGS_GITHUB_NAME_CACHE" ] && {
     echo "$emails" | while read email; do
         line="$(grep "$email	" "$NIXPKGS_GITHUB_NAME_CACHE")"
-	[ -z "$line" ] && {
+        [ -z "$line" ] && {
             echo "$email	$(fetchGithubName "$email")" >> \
                 "$NIXPKGS_GITHUB_NAME_CACHE"
         }
@@ -47,11 +47,11 @@ fetchGithubName () {
 
 # For RDF
 normalize_name () {
-	sed -e 's/%/%25/g; s/ /%20/g; s/'\''/%27/g; s/"/%22/g; s/`/%60/g; s/\^/%5e/g; '
+    sed -e 's/%/%25/g; s/ /%20/g; s/'\''/%27/g; s/"/%22/g; s/`/%60/g; s/\^/%5e/g; '
 }
 
 denormalize_name () {
-	sed -e 's/%20/ /g; s/%27/'\''/g; s/%22/"/g; s/%60/`/g; s/%5e/^/g; s/%25/%/g;';
+    sed -e 's/%20/ /g; s/%27/'\''/g; s/%22/"/g; s/%60/`/g; s/%5e/^/g; s/%25/%/g;';
 }
 
 n3="$(mktemp --suffix .n3)"
@@ -75,22 +75,22 @@ echo "$maintainers" | cut -f 2 | sed -e 's@.*@<my://name/&>	<my://is-name>	<my:/
 # Get transitive closure
 sparql="$(nix-build '<nixpkgs>' -Q -A apache-jena --no-out-link)/bin/sparql"
 name_list="$(
-	"$sparql" --results=TSV --data="$n3" "
+    "$sparql" --results=TSV --data="$n3" "
 	select ?x ?y ?g where {
 	  ?x <my://can-be>+ ?y.
 	  ?x <my://is-name> ?g.
         }
 	" | tail -n +2 |
-	sed -re 's@<my://name/@@g; s@<my://@@g; s@>@@g;' |
-	sort -k 2,3 -t '	'
+    sed -re 's@<my://name/@@g; s@<my://@@g; s@>@@g;' |
+    sort -k 2,3 -t '	'
 )"
 github_name_list="$(
-	"$sparql" --results=TSV --data="$n3" "
+    "$sparql" --results=TSV --data="$n3" "
 	select ?x ?y where {
 	  ?x (<my://can-be>+ / <my://at-github>) ?y.
         }
 	" | tail -n +2 |
-	sed -re 's@<my://(name|github)/@@g; s@<my://@@g; s@>@@g;'
+    sed -re 's@<my://(name|github)/@@g; s@<my://@@g; s@>@@g;'
 )"
 
 # Take first spelling option for every person
@@ -104,10 +104,10 @@ if [ -n "$NIXPKGS_GITHUB_NAME_CACHE" ]; then
     github_adder_script="$(mktemp)"
     echo "$github_name_list" |
         grep -E "$(echo "$name_list_canonical" | cut -f 2 |
-	    tr '\n' '|' )" |
-	sort | uniq |
+        tr '\n' '|' )" |
+    sort | uniq |
         sed -re 's/(.*)\t(.*)/s| \1$| \1\t\2|g;/' |
-	denormalize_name > "$github_adder_script"
+    denormalize_name > "$github_adder_script"
 else
     github_adder_script='/dev/null'
 fi

From 57b496ea98bdbd633c48f16af1c69a196aaf963a Mon Sep 17 00:00:00 2001
From: Victor Engmark <victor@engmark.name>
Date: Sun, 14 Nov 2021 15:54:33 +1300
Subject: [PATCH 06/51] misc: Replace tab indentation with spaces

I've tried to be consistent, using four or eight spaces to line up
with existing code.
---
 pkgs/build-support/fetchmtn/builder.sh        | 48 ++++++------
 .../pkg-config-wrapper/pkg-config-wrapper.sh  |  6 +-
 .../setup-hooks/shorten-perl-shebang.sh       |  6 +-
 pkgs/data/fonts/iosevka/update-bin.sh         | 20 ++---
 pkgs/data/misc/geolite-legacy/builder.sh      | 12 +--
 pkgs/desktops/gnustep/make/builder.sh         | 60 +++++++-------
 pkgs/desktops/gnustep/make/setup-hook.sh      | 36 ++++-----
 .../ios-cross-compile/9.2_builder.sh          | 78 +++++++++----------
 .../libraries/gdk-pixbuf/setup-hook.sh        | 22 +++---
 .../libraries/physics/lhapdf/maintainer.sh    |  6 +-
 pkgs/development/libraries/slib/setup-hook.sh | 10 +--
 .../lisp-modules/clwrapper/cl-wrapper.sh      | 70 ++++++++---------
 .../from-quicklisp/asdf-description.sh        |  4 +-
 .../barebones-quicklisp-expression.sh         |  6 +-
 .../filtered-requirements.sh                  | 12 +--
 .../expression-generator/full-requirements.sh | 18 ++---
 .../expression-generator/grab-url.sh          | 13 ++--
 .../expression-generator/lib-cache.sh         | 21 +++--
 .../expression-generator/requirements.sh      | 12 +--
 .../retrieve-file-link.sh                     |  8 +-
 .../retrieve-meta-yaml.sh                     |  8 +-
 .../source-download-link.sh                   | 10 +--
 .../write-nix-expression.sh                   | 18 ++---
 .../tools/build-managers/tup/setup-hook.sh    | 44 +++++------
 pkgs/games/dwarf-fortress/update.sh           | 34 ++++----
 .../linux/service-wrapper/service-wrapper.sh  | 70 ++++++++---------
 pkgs/tools/graphics/zxing/zxing.sh            | 26 +++----
 pkgs/tools/misc/grub/grub1.patches.sh         | 68 ++++++++--------
 pkgs/tools/typesetting/lout/builder.sh        | 32 ++++----
 29 files changed, 388 insertions(+), 390 deletions(-)

diff --git a/pkgs/build-support/fetchmtn/builder.sh b/pkgs/build-support/fetchmtn/builder.sh
index c1b0db895bc1..73eff9c27252 100644
--- a/pkgs/build-support/fetchmtn/builder.sh
+++ b/pkgs/build-support/fetchmtn/builder.sh
@@ -2,33 +2,33 @@ source $stdenv/setup
 
 set -x
 
-if ! [ -f "$cacheDB" ]; then 
-	echo "Creating cache DB $cacheDB"
-	mtn --db "$cacheDB" db init
+if ! [ -f "$cacheDB" ]; then
+    echo "Creating cache DB $cacheDB"
+    mtn --db "$cacheDB" db init
 fi
 
 header "getting revision $selector";
 
 done=;
 for source in $dbs; do
-	if mtn pull --db "$cacheDB" "$source" "${branch}"; then
-		revision="$(mtn --db "$cacheDB" au toposort $(mtn --db "$cacheDB" au select "$selector") | tail -1)";
-		if [ -n "$revision" ]; then
-			if mtn --db "$cacheDB" au get_revision "$revision"; then
-				echo "found revision $revision"
-				done=1;
-			else
-				echo "revision $revision does not exist";
-			fi
-		else
-			echo "selector $selector does not match any revision";
-		fi
-	else
-		echo "pulling branch $branch wasn't successful";
-	fi;
-	if test -n "$done"; then
-		break;
-	fi;
+    if mtn pull --db "$cacheDB" "$source" "${branch}"; then
+        revision="$(mtn --db "$cacheDB" au toposort $(mtn --db "$cacheDB" au select "$selector") | tail -1)";
+        if [ -n "$revision" ]; then
+            if mtn --db "$cacheDB" au get_revision "$revision"; then
+                echo "found revision $revision"
+                done=1;
+            else
+                echo "revision $revision does not exist";
+            fi
+        else
+            echo "selector $selector does not match any revision";
+        fi
+    else
+        echo "pulling branch $branch wasn't successful";
+    fi;
+    if test -n "$done"; then
+        break;
+    fi;
 done;
 
 stopNest;
@@ -36,10 +36,10 @@ stopNest;
 header "checking out the revision $revision";
 
 if test -n "$done"; then
-	mtn checkout --db "$cacheDB" -r "$revision" "$out" -b "${branch}"
+    mtn checkout --db "$cacheDB" -r "$revision" "$out" -b "${branch}"
 else
-	echo "Needed revision still not found. Exiting";
-	exit 1;
+    echo "Needed revision still not found. Exiting";
+    exit 1;
 fi;
 
 stopNest
diff --git a/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh b/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
index f7c7429eb0b3..a5a442716688 100644
--- a/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
+++ b/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
@@ -13,9 +13,9 @@ if [ -z "${NIX_PKG_CONFIG_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
 fi
 
 if (( ${#role_suffixes[@]} > 0 )); then
-	# replace env var with nix-modified one
+    # replace env var with nix-modified one
     PKG_CONFIG_PATH=$PKG_CONFIG_PATH_@suffixSalt@ exec @prog@ "$@"
 else
-	# pkg-config isn't a bonafied dependency so ignore setup hook entirely
-	exec @prog@ "$@"
+    # pkg-config isn't a bonafied dependency so ignore setup hook entirely
+    exec @prog@ "$@"
 fi
diff --git a/pkgs/build-support/setup-hooks/shorten-perl-shebang.sh b/pkgs/build-support/setup-hooks/shorten-perl-shebang.sh
index 4bf7c0ff1af4..825da1bde962 100644
--- a/pkgs/build-support/setup-hooks/shorten-perl-shebang.sh
+++ b/pkgs/build-support/setup-hooks/shorten-perl-shebang.sh
@@ -71,9 +71,9 @@ _shortenPerlShebang() {
             print
         }
     ' "$program" > "$temp" || die
-	# Preserve the mode of the original file
-	cp --preserve=mode --attributes-only "$program" "$temp"
-	mv "$temp" "$program"
+    # Preserve the mode of the original file
+    cp --preserve=mode --attributes-only "$program" "$temp"
+    mv "$temp" "$program"
 
     # Measure the new shebang line length and make sure it's okay. We subtract
     # one to account for the trailing newline that "head" included in its
diff --git a/pkgs/data/fonts/iosevka/update-bin.sh b/pkgs/data/fonts/iosevka/update-bin.sh
index a402f152d8a1..68f93f1f26e6 100755
--- a/pkgs/data/fonts/iosevka/update-bin.sh
+++ b/pkgs/data/fonts/iosevka/update-bin.sh
@@ -10,19 +10,19 @@ oldVersion=$(nix-instantiate --eval -E 'with import ../../../.. {}; lib.getVersi
 version=$(echo "$release" | jq -r .tag_name | tr -d v)
 
 if test "$oldVersion" = "$version"; then
-	echo "New version same as old version, nothing to do." >&2
-	exit 0
+    echo "New version same as old version, nothing to do." >&2
+    exit 0
 fi
 
 sed -i "s/$oldVersion/$version/" bin.nix
 
 {
-	echo '# This file was autogenerated. DO NOT EDIT!'
-	echo '{'
-	for asset in $(echo "$release" | jq -r '.assets[].name | select(startswith("ttc"))'); do
-		printf '  %s = "%s";\n' \
-			$(echo "$asset" | sed -r "s/^ttc-(.*)-$version.zip$/\1/") \
-			$(nix-prefetch-url "https://github.com/be5invis/Iosevka/releases/download/v$version/$asset")
-	done
-	echo '}'
+    echo '# This file was autogenerated. DO NOT EDIT!'
+    echo '{'
+    for asset in $(echo "$release" | jq -r '.assets[].name | select(startswith("ttc"))'); do
+        printf '  %s = "%s";\n' \
+            $(echo "$asset" | sed -r "s/^ttc-(.*)-$version.zip$/\1/") \
+            $(nix-prefetch-url "https://github.com/be5invis/Iosevka/releases/download/v$version/$asset")
+    done
+    echo '}'
 } >variants.nix
diff --git a/pkgs/data/misc/geolite-legacy/builder.sh b/pkgs/data/misc/geolite-legacy/builder.sh
index 683b2e8606b8..0bb61d863ece 100644
--- a/pkgs/data/misc/geolite-legacy/builder.sh
+++ b/pkgs/data/misc/geolite-legacy/builder.sh
@@ -5,13 +5,13 @@ cd $out/share/GeoIP
 
 # Iterate over all environment variable names beginning with "src":
 for var in "${!src@}"; do
-	# Store the value of the variable with name $var in $src:
-	eval src="\$$var"
+    # Store the value of the variable with name $var in $src:
+    eval src="\$$var"
 
-	# Copy $src to current directory, removing Nix hash from the filename:
-	dest="${src##*/}"
-	dest="${dest#*-}"
-	cp "$src" "$dest"
+    # Copy $src to current directory, removing Nix hash from the filename:
+    dest="${src##*/}"
+    dest="${dest#*-}"
+    cp "$src" "$dest"
 done
 
 gzip -dv *.gz
diff --git a/pkgs/desktops/gnustep/make/builder.sh b/pkgs/desktops/gnustep/make/builder.sh
index 66afe1271cae..39bd77038281 100644
--- a/pkgs/desktops/gnustep/make/builder.sh
+++ b/pkgs/desktops/gnustep/make/builder.sh
@@ -30,92 +30,92 @@ postInstall() {
     # add the current package to the paths
     local tmp="$out/lib/GNUstep/Applications"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_APPS" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_APPS "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_APPS "$tmp"
     fi
     tmp="$out/lib/GNUstep/Applications"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_ADMIN_APPS" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_APPS "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_APPS "$tmp"
     fi
     tmp="$out/lib/GNUstep/WebApplications"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_WEB_APPS" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_WEB_APPS "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_WEB_APPS "$tmp"
     fi
     tmp="$out/bin"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_TOOLS" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_TOOLS "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_TOOLS "$tmp"
     fi
     tmp="$out/sbin"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS "$tmp"
     fi
     tmp="$out/lib/GNUstep"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_LIBRARY" in *"${tmp}"*) false;; *) true;; esac; then
-    	addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARY "$tmp"
+            addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARY "$tmp"
     fi
     tmp="$out/include"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_HEADERS" in *"${tmp}"*) false;; *) true;; esac; then
-    	if [ -z "$NIX_GNUSTEP_SYSTEM_HEADERS" ]; then
-    	    export NIX_GNUSTEP_SYSTEM_HEADERS="$tmp"
-    	else
-    	    export NIX_GNUSTEP_SYSTEM_HEADERS+=" $tmp"
-    	fi
+            if [ -z "$NIX_GNUSTEP_SYSTEM_HEADERS" ]; then
+                export NIX_GNUSTEP_SYSTEM_HEADERS="$tmp"
+            else
+                export NIX_GNUSTEP_SYSTEM_HEADERS+=" $tmp"
+            fi
     fi
     tmp="$out/lib"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_LIBRARIES" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARIES "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARIES "$tmp"
     fi
     tmp="$out/share/GNUstep/Documentation"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_DOC" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_DOC "$tmp"
     fi
     tmp="$out/share/man"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_DOC_MAN" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_MAN "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_MAN "$tmp"
     fi
     tmp="$out/share/info"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_DOC_INFO" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_INFO "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_INFO "$tmp"
     fi
-    
+
     # write the config file
     echo GNUSTEP_MAKEFILES=$GNUSTEP_MAKEFILES >> $conf
     if [ -n "$NIX_GNUSTEP_SYSTEM_APPS" ]; then
-	echo NIX_GNUSTEP_SYSTEM_APPS="$NIX_GNUSTEP_SYSTEM_APPS"
+        echo NIX_GNUSTEP_SYSTEM_APPS="$NIX_GNUSTEP_SYSTEM_APPS"
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_ADMIN_APPS" ]; then
-	echo NIX_GNUSTEP_SYSTEM_ADMIN_APPS="$NIX_GNUSTEP_SYSTEM_ADMIN_APPS" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_ADMIN_APPS="$NIX_GNUSTEP_SYSTEM_ADMIN_APPS" >> $conf
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_WEB_APPS" ]; then
-	echo NIX_GNUSTEP_SYSTEM_WEB_APPS="$NIX_GNUSTEP_SYSTEM_WEB_APPS" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_WEB_APPS="$NIX_GNUSTEP_SYSTEM_WEB_APPS" >> $conf
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_TOOLS" ]; then
-	echo NIX_GNUSTEP_SYSTEM_TOOLS="$NIX_GNUSTEP_SYSTEM_TOOLS" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_TOOLS="$NIX_GNUSTEP_SYSTEM_TOOLS" >> $conf
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS" ]; then
-	echo NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS="$NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS="$NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS" >> $conf
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_LIBRARY" ]; then
-	echo NIX_GNUSTEP_SYSTEM_LIBRARY="$NIX_GNUSTEP_SYSTEM_LIBRARY" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_LIBRARY="$NIX_GNUSTEP_SYSTEM_LIBRARY" >> $conf
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_HEADERS" ]; then
-	echo NIX_GNUSTEP_SYSTEM_HEADERS="$NIX_GNUSTEP_SYSTEM_HEADERS" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_HEADERS="$NIX_GNUSTEP_SYSTEM_HEADERS" >> $conf
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_LIBRARIES" ]; then
-	echo NIX_GNUSTEP_SYSTEM_LIBRARIES="$NIX_GNUSTEP_SYSTEM_LIBRARIES" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_LIBRARIES="$NIX_GNUSTEP_SYSTEM_LIBRARIES" >> $conf
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_DOC" ]; then
-	echo NIX_GNUSTEP_SYSTEM_DOC="$NIX_GNUSTEP_SYSTEM_DOC" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_DOC="$NIX_GNUSTEP_SYSTEM_DOC" >> $conf
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_DOC_MAN" ]; then
-	echo NIX_GNUSTEP_SYSTEM_DOC_MAN="$NIX_GNUSTEP_SYSTEM_DOC_MAN" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_DOC_MAN="$NIX_GNUSTEP_SYSTEM_DOC_MAN" >> $conf
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_DOC_INFO" ]; then
-	echo NIX_GNUSTEP_SYSTEM_DOC_INFO="$NIX_GNUSTEP_SYSTEM_DOC_INFO" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_DOC_INFO="$NIX_GNUSTEP_SYSTEM_DOC_INFO" >> $conf
     fi
-    
+
     for i in $out/bin/*; do
-	echo "wrapping $(basename $i)"
-	wrapGSMake "$i" "$out/share/.GNUstep.conf"
+        echo "wrapping $(basename $i)"
+        wrapGSMake "$i" "$out/share/.GNUstep.conf"
     done
 }
 
diff --git a/pkgs/desktops/gnustep/make/setup-hook.sh b/pkgs/desktops/gnustep/make/setup-hook.sh
index b2b90f1e5222..177a381100a6 100644
--- a/pkgs/desktops/gnustep/make/setup-hook.sh
+++ b/pkgs/desktops/gnustep/make/setup-hook.sh
@@ -20,58 +20,58 @@ addEnvVars() {
     local filename
 
     for filename in $1/share/GNUstep/Makefiles/Additional/*.make ; do
-	if case "${NIX_GNUSTEP_MAKEFILES_ADDITIONAL-}" in *"{$filename}"*) false;; *) true;; esac; then
-	    export NIX_GNUSTEP_MAKEFILES_ADDITIONAL+=" $filename"
-	fi
+    if case "${NIX_GNUSTEP_MAKEFILES_ADDITIONAL-}" in *"{$filename}"*) false;; *) true;; esac; then
+        export NIX_GNUSTEP_MAKEFILES_ADDITIONAL+=" $filename"
+    fi
     done
 
     local tmp="$1/lib/GNUstep/Applications"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_APPS-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_APPS "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_APPS "$tmp"
     fi
     tmp="$1/lib/GNUstep/Applications"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_ADMIN_APPS-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_APPS "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_APPS "$tmp"
     fi
     tmp="$1/lib/GNUstep/WebApplications"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_WEB_APPS-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_WEB_APPS "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_WEB_APPS "$tmp"
     fi
     tmp="$1/bin"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_TOOLS-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_TOOLS "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_TOOLS "$tmp"
     fi
     tmp="$1/sbin"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS "$tmp"
     fi
     tmp="$1/lib/GNUstep"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_LIBRARY-}" in *"${tmp}"*) false;; *) true;; esac; then
-    	addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARY "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARY "$tmp"
     fi
     tmp="$1/include"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_HEADERS-}" in *"${tmp}"*) false;; *) true;; esac; then
-    	if [ -z "${NIX_GNUSTEP_SYSTEM_HEADERS-}" ]; then
-    	    export NIX_GNUSTEP_SYSTEM_HEADERS="$tmp"
-    	else
-    	    export NIX_GNUSTEP_SYSTEM_HEADERS+=" $tmp"
-    	fi
+        if [ -z "${NIX_GNUSTEP_SYSTEM_HEADERS-}" ]; then
+            export NIX_GNUSTEP_SYSTEM_HEADERS="$tmp"
+        else
+            export NIX_GNUSTEP_SYSTEM_HEADERS+=" $tmp"
+        fi
     fi
     tmp="$1/lib"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_LIBRARIES-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARIES "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARIES "$tmp"
     fi
     tmp="$1/share/GNUstep/Documentation"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_DOC-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_DOC "$tmp"
     fi
     tmp="$1/share/man"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_DOC_MAN-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_MAN "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_MAN "$tmp"
     fi
     tmp="$1/share/info"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_DOC_INFO-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_INFO "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_INFO "$tmp"
     fi
 }
 addEnvHooks "$targetOffset" addEnvVars
diff --git a/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh b/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh
index 4604b1fdea72..68ba3ed3a920 100644
--- a/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh
+++ b/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh
@@ -8,43 +8,43 @@ function extract
 
     case "$1" in
         *.tar.xz)
-	    xz -dc $1 | tar "$tarflags" - ;;
-	*)
-	    printf "Make sure you give a iPhoneOS9.2.sdk.tar.xz file \n" ;;
+        xz -dc $1 | tar "$tarflags" - ;;
+    *)
+        printf "Make sure you give a iPhoneOS9.2.sdk.tar.xz file \n" ;;
     esac
 }
 
 function verify_arch {
     case "$1" in
-	# Our good arches.
-	armv7|arm64) ;;
-	*)
-	    local
-	    acc="armv7 | arm64"
-	    error_message=$(
-		printf '%s is not an acceptable arch. Try one of %s' "$1" "$acc"
-			 )
-	    printf "$error_message\n"
-	    exit
+    # Our good arches.
+    armv7|arm64) ;;
+    *)
+        local
+        acc="armv7 | arm64"
+        error_message=$(
+        printf '%s is not an acceptable arch. Try one of %s' "$1" "$acc"
+             )
+        printf "$error_message\n"
+        exit
     esac
 }
 
 function verify_sdk_version {
     sdk_version=$(basename "$1" | grep -P -o "[0-9].[0-9]+")
     case "$sdk_version" in
-	# Make sure the SDK is correct.
-	[5-9].[0-9]) ;;
-	*)
-	    printf 'No iPhone SDK version in file name\n'
+    # Make sure the SDK is correct.
+    [5-9].[0-9]) ;;
+    *)
+        printf 'No iPhone SDK version in file name\n'
     esac
 }
 
 function do_build {
 
     if [ $# -lt 2 ]; then
-	printf "usage: $0 iPhoneOS.sdk.tar* <target cpu>\n" 1>&2
-	printf "i.e. $0 /path/to/iPhoneOS.sdk.tar.xz armv7\n" 1>&2
-	exit 1
+    printf "usage: $0 iPhoneOS.sdk.tar* <target cpu>\n" 1>&2
+    printf "i.e. $0 /path/to/iPhoneOS.sdk.tar.xz armv7\n" 1>&2
+    exit 1
     fi
 
     mkdir -p $out
@@ -54,7 +54,7 @@ function do_build {
     pushd "$cctools_port"/usage_examples/ios_toolchain &> /dev/null
 
     export LC_ALL=C
-    
+
     local
     triple='%s-apple-darwin11'
     target_dir="$PWD/target"
@@ -75,12 +75,12 @@ function do_build {
     extract "$1"
 
     local sys_lib=$(
-    	find $sdk_dir -name libSystem.dylib -o -name libSystem.tbd | head -n1
-    	  )
+        find $sdk_dir -name libSystem.dylib -o -name libSystem.tbd | head -n1
+          )
 
     if [ -z "$sys_lib" ]; then
-    	printf "SDK should contain libSystem{.dylib,.tbd}\n" 1>&2
-    	exit 1
+        printf "SDK should contain libSystem{.dylib,.tbd}\n" 1>&2
+        exit 1
     fi
 
     local sys_root=$(readlink -f "$(dirname $sys_lib)/../..")
@@ -96,18 +96,18 @@ function do_build {
     printf "int main(){return 0;}" | clang -xc -O2 -o "$target_dir"/bin/dsymutil -
 
     clang -O2 -std=c99 $alt_wrapper \
-    	  -DTARGET_CPU=$(printf '"%s"' "$2") \
-    	  -DNIX_APPLE_HDRS=$(
-    	printf '"%s"' "-I$out/$sdk/usr/include"
-    	  ) \
-    	  -DNIX_APPLE_FRAMEWORKS=$(
-    	printf '"%s"' "$out/$sdk/System/Library/Frameworks"
-    	  ) \
-    	  -DNIX_APPLE_PRIV_FRAMEWORKS=$(
-    	printf '"%s"' "$out/$sdk/System/Library/PrivateFrameworks"
-    	  ) \
-    	  -DOS_VER_MIN=$(printf '"%s"' "7.1") \
-    	  -o "$target_dir/bin/$triple-clang"
+          -DTARGET_CPU=$(printf '"%s"' "$2") \
+          -DNIX_APPLE_HDRS=$(
+        printf '"%s"' "-I$out/$sdk/usr/include"
+          ) \
+          -DNIX_APPLE_FRAMEWORKS=$(
+        printf '"%s"' "$out/$sdk/System/Library/Frameworks"
+          ) \
+          -DNIX_APPLE_PRIV_FRAMEWORKS=$(
+        printf '"%s"' "$out/$sdk/System/Library/PrivateFrameworks"
+          ) \
+          -DOS_VER_MIN=$(printf '"%s"' "7.1") \
+          -o "$target_dir/bin/$triple-clang"
 
     pushd "$target_dir"/bin &>/dev/null
 
@@ -141,8 +141,8 @@ function do_build {
     local me=`whoami`
 
     for d in bin libexec SDK; do
-    	chown -R $me:$me target/$d
-    	cp -R target/$d $out
+        chown -R $me:$me target/$d
+        cp -R target/$d $out
     done
 
     # Crucial piece
diff --git a/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh b/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
index bdfd00009dc5..ecf9793b91f6 100644
--- a/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
+++ b/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
@@ -1,16 +1,16 @@
 findGdkPixbufLoaders() {
 
-	# choose the longest loaders.cache
-	local loadersCache="$1/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"
-	if [[ -f "$loadersCache" ]]; then
-		if [[ -f "${GDK_PIXBUF_MODULE_FILE-}" ]]; then
-			if (( "$(cat "$loadersCache" | wc -l)" > "$(cat "$GDK_PIXBUF_MODULE_FILE" | wc -l)" )); then
-				export GDK_PIXBUF_MODULE_FILE="$loadersCache"
-			fi
-		else
-			export GDK_PIXBUF_MODULE_FILE="$loadersCache"
-		fi
-	fi
+    # choose the longest loaders.cache
+    local loadersCache="$1/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"
+    if [[ -f "$loadersCache" ]]; then
+        if [[ -f "${GDK_PIXBUF_MODULE_FILE-}" ]]; then
+            if (( "$(cat "$loadersCache" | wc -l)" > "$(cat "$GDK_PIXBUF_MODULE_FILE" | wc -l)" )); then
+                export GDK_PIXBUF_MODULE_FILE="$loadersCache"
+            fi
+        else
+            export GDK_PIXBUF_MODULE_FILE="$loadersCache"
+        fi
+    fi
 
 }
 
diff --git a/pkgs/development/libraries/physics/lhapdf/maintainer.sh b/pkgs/development/libraries/physics/lhapdf/maintainer.sh
index 92c225f90ccd..6e263dcebfde 100755
--- a/pkgs/development/libraries/physics/lhapdf/maintainer.sh
+++ b/pkgs/development/libraries/physics/lhapdf/maintainer.sh
@@ -7,7 +7,7 @@ set -xe
 BASE_URL="https://lhapdfsets.web.cern.ch/lhapdfsets/current/"
 
 for pdf_set in `curl -L $BASE_URL 2>/dev/null | "$SED" -e "s/.*<a href=\"\([^\"/]*.tar.gz\)\".*/\1/;tx;d;:x" | sort -u`; do
-	echo -n "    \"${pdf_set%.tar.gz}\" = \""
-	nix-prefetch-url "${BASE_URL}${pdf_set}" 2>/dev/null | tr -d '\n'
-	echo "\";"
+    echo -n "    \"${pdf_set%.tar.gz}\" = \""
+    nix-prefetch-url "${BASE_URL}${pdf_set}" 2>/dev/null | tr -d '\n'
+    echo "\";"
 done
diff --git a/pkgs/development/libraries/slib/setup-hook.sh b/pkgs/development/libraries/slib/setup-hook.sh
index 3c7e91e81886..e820d80e7a4e 100644
--- a/pkgs/development/libraries/slib/setup-hook.sh
+++ b/pkgs/development/libraries/slib/setup-hook.sh
@@ -1,12 +1,12 @@
 addSlibPath () {
     if test -f "$1/lib/slib/slibcat"
     then
-	export SCHEME_LIBRARY_PATH="$1/lib/slib/"
-	echo "SLIB found in \`$1'; setting \$SCHEME_LIBRARY_PATH to \`$SCHEME_LIBRARY_PATH'"
+        export SCHEME_LIBRARY_PATH="$1/lib/slib/"
+        echo "SLIB found in \`$1'; setting \$SCHEME_LIBRARY_PATH to \`$SCHEME_LIBRARY_PATH'"
 
-	# This is needed so that `(load-from-path "slib/guile.init")' works.
-	export GUILE_LOAD_PATH="$1/lib:$GUILE_LOAD_PATH"
-	echo "SLIB: setting \$GUILE_LOAD_PATH to \`$GUILE_LOAD_PATH'"
+        # This is needed so that `(load-from-path "slib/guile.init")' works.
+        export GUILE_LOAD_PATH="$1/lib:$GUILE_LOAD_PATH"
+        echo "SLIB: setting \$GUILE_LOAD_PATH to \`$GUILE_LOAD_PATH'"
     fi
 }
 
diff --git a/pkgs/development/lisp-modules/clwrapper/cl-wrapper.sh b/pkgs/development/lisp-modules/clwrapper/cl-wrapper.sh
index 828920c5accc..d6fec46b449e 100755
--- a/pkgs/development/lisp-modules/clwrapper/cl-wrapper.sh
+++ b/pkgs/development/lisp-modules/clwrapper/cl-wrapper.sh
@@ -18,59 +18,59 @@ fi
 export NIX_LISP NIX_LISP_LOAD_FILE NIX_LISP_EXEC_CODE NIX_LISP_COMMAND NIX_LISP_FINAL_PARAMETERS
 
 test -n "$NIX_LISP_LD_LIBRARY_PATH" &&
-	export LD_LIBRARY_PATH="$LD_LIBRARY_PATH${LD_LIBRARY_PATH:+:}$NIX_LISP_LD_LIBRARY_PATH"
+        export LD_LIBRARY_PATH="$LD_LIBRARY_PATH${LD_LIBRARY_PATH:+:}$NIX_LISP_LD_LIBRARY_PATH"
 
 declare -a NIX_LISP_FINAL_PARAMETERS;
 
 case "$NIX_LISP" in
-	sbcl)
-		NIX_LISP_LOAD_FILE="--load"
-		NIX_LISP_EXEC_CODE="--eval"
+        sbcl)
+                NIX_LISP_LOAD_FILE="--load"
+                NIX_LISP_EXEC_CODE="--eval"
                 NIX_LISP_QUIT="(quit)"
                 NIX_LISP_NODEBUG='--non-interactive'
-		NIX_LISP_FINAL_PARAMETERS=
+                NIX_LISP_FINAL_PARAMETERS=
                 NIX_LISP_FASL_TYPE="fasl"
-		;;
-	ecl)
-		NIX_LISP_LOAD_FILE="-load"
-		NIX_LISP_EXEC_CODE="-eval"
+                ;;
+        ecl)
+                NIX_LISP_LOAD_FILE="-load"
+                NIX_LISP_EXEC_CODE="-eval"
                 NIX_LISP_QUIT="(quit)"
                 NIX_LISP_NODEBUG='--nodebug'
-		NIX_LISP_FINAL_PARAMETERS=
+                NIX_LISP_FINAL_PARAMETERS=
                 NIX_LISP_FASL_TYPE="fas"
-		;;
-	clisp)
-		NIX_LISP_LOAD_FILE="-c -l"
-		NIX_LISP_EXEC_CODE="-x"
+                ;;
+        clisp)
+                NIX_LISP_LOAD_FILE="-c -l"
+                NIX_LISP_EXEC_CODE="-x"
                 NIX_LISP_QUIT="(quit)"
                 NIX_LISP_NODEBUG='-on-error exit'
-		NIX_LISP_FINAL_PARAMETERS="-repl"
+                NIX_LISP_FINAL_PARAMETERS="-repl"
                 NIX_LISP_FASL_TYPE="fas"
-		;;
-	lx86cl64)
-		NIX_LISP_LOAD_FILE="-l"
-		NIX_LISP_EXEC_CODE="-e"
+                ;;
+        lx86cl64)
+                NIX_LISP_LOAD_FILE="-l"
+                NIX_LISP_EXEC_CODE="-e"
                 NIX_LISP_QUIT="(quit)"
                 NIX_LISP_NODEBUG='-b'
-		NIX_LISP_FINAL_PARAMETERS=
+                NIX_LISP_FINAL_PARAMETERS=
                 NIX_LISP_FASL_TYPE="lx64fsl"
-		;;
-	lx86cl)
-		NIX_LISP_LOAD_FILE="-l"
-		NIX_LISP_EXEC_CODE="-e"
+                ;;
+        lx86cl)
+                NIX_LISP_LOAD_FILE="-l"
+                NIX_LISP_EXEC_CODE="-e"
                 NIX_LISP_QUIT="(quit)"
                 NIX_LISP_NODEBUG='-b'
-		NIX_LISP_FINAL_PARAMETERS=
+                NIX_LISP_FINAL_PARAMETERS=
                 NIX_LISP_FASL_TYPE="lx32fsl"
-		;;
-	abcl)
-		NIX_LISP_LOAD_FILE="--load"
-		NIX_LISP_EXEC_CODE="--eval"
+                ;;
+        abcl)
+                NIX_LISP_LOAD_FILE="--load"
+                NIX_LISP_EXEC_CODE="--eval"
                 NIX_LISP_QUIT="(quit)"
                 NIX_LISP_NODEBUG=''
-		NIX_LISP_FINAL_PARAMETERS=
+                NIX_LISP_FINAL_PARAMETERS=
                 NIX_LISP_FASL_TYPE="abcl"
-		;;
+                ;;
 esac
 
 NIX_LISP_ASDF_REGISTRY_CODE="
@@ -127,8 +127,8 @@ eval "$NIX_LISP_PRELAUNCH_HOOK"
 
 if [ -z "$NIX_LISP_SKIP_CODE" ]; then
     "$NIX_LISP_COMMAND" $NIX_LISP_EARLY_OPTIONS \
-	                $NIX_LISP_EXEC_CODE "${NIX_LISP_ASDF_LOAD:-"(load \"$NIX_LISP_ASDF/lib/common-lisp/asdf/build/asdf.$NIX_LISP_FASL_TYPE\")"}" \
-	                $NIX_LISP_EXEC_CODE "$NIX_LISP_ASDF_REGISTRY_CODE" \
-	                ${NIX_LISP_FINAL_PARAMETERS[*]:+"${NIX_LISP_FINAL_PARAMETERS[@]}"} \
-	                "$@"
+                        $NIX_LISP_EXEC_CODE "${NIX_LISP_ASDF_LOAD:-"(load \"$NIX_LISP_ASDF/lib/common-lisp/asdf/build/asdf.$NIX_LISP_FASL_TYPE\")"}" \
+                        $NIX_LISP_EXEC_CODE "$NIX_LISP_ASDF_REGISTRY_CODE" \
+                        ${NIX_LISP_FINAL_PARAMETERS[*]:+"${NIX_LISP_FINAL_PARAMETERS[@]}"} \
+                        "$@"
 fi
diff --git a/pkgs/development/lisp-modules/from-quicklisp/asdf-description.sh b/pkgs/development/lisp-modules/from-quicklisp/asdf-description.sh
index 6c240d15c76e..bdb5981bf4fb 100755
--- a/pkgs/development/lisp-modules/from-quicklisp/asdf-description.sh
+++ b/pkgs/development/lisp-modules/from-quicklisp/asdf-description.sh
@@ -11,6 +11,6 @@
 name="$1"
 
 sbcl --noinform --load "$NIX_QUICKLISP_DIR"/setup.lisp --eval "(ql:quickload :$name)" \
-	--eval "(format t \"~a~%\" (or (asdf::system-description (asdf::find-system \"$name\")) \"\"))" \
-	--eval '(quit)' --script |
+    --eval "(format t \"~a~%\" (or (asdf::system-description (asdf::find-system \"$name\")) \"\"))" \
+    --eval '(quit)' --script |
     tee /dev/stderr | tail -n 1
diff --git a/pkgs/development/lisp-modules/from-quicklisp/barebones-quicklisp-expression.sh b/pkgs/development/lisp-modules/from-quicklisp/barebones-quicklisp-expression.sh
index d2d846b78f2b..f8bae8997272 100755
--- a/pkgs/development/lisp-modules/from-quicklisp/barebones-quicklisp-expression.sh
+++ b/pkgs/development/lisp-modules/from-quicklisp/barebones-quicklisp-expression.sh
@@ -122,8 +122,8 @@ url="${ql_src##* }"
   with (import <nixpkgs> {});
       fetchdarcs {
         url=''$url'';
-	rev=''$version'';
-	sha256=''0000000000000000000000000000000000000000000000000000000000000000'';
+    rev=''$version'';
+    sha256=''0000000000000000000000000000000000000000000000000000000000000000'';
     }" | nix-instantiate - | tail -n 1 |
     xargs nix-store -r 2>&1 | tee /dev/stderr | grep 'instead has' | tail -n 1 |
     sed -e 's/.* instead has .//;s/[^0-9a-z].*//')
@@ -149,7 +149,7 @@ url="${ql_src##* }"
 }
 
 if [ "$ql_src" = '{"error":"Not Found"}' ]; then
-	echo "# $name: not found"
+    echo "# $name: not found"
 else
 cat << EOF | grep -Ev '^[ ]+$'
 
diff --git a/pkgs/development/perl-modules/expression-generator/filtered-requirements.sh b/pkgs/development/perl-modules/expression-generator/filtered-requirements.sh
index 98c01508fd5a..2e3509d68c12 100755
--- a/pkgs/development/perl-modules/expression-generator/filtered-requirements.sh
+++ b/pkgs/development/perl-modules/expression-generator/filtered-requirements.sh
@@ -3,13 +3,13 @@
 source lib-cache.sh;
 
 print_reqs() {
-	module_name="$1";
+    module_name="$1";
 
-	./requirements.sh "$1"| while read; do
-		if let "$(./source-download-link.sh "${REPLY}" | wc -c)" && [ perl != "$REPLY" ]; then
-			echo "$REPLY";
-		fi;
-	done;
+    ./requirements.sh "$1"| while read; do
+        if let "$(./source-download-link.sh "${REPLY}" | wc -c)" && [ perl != "$REPLY" ]; then
+            echo "$REPLY";
+        fi;
+    done;
 }
 
 module_name="$1";
diff --git a/pkgs/development/perl-modules/expression-generator/full-requirements.sh b/pkgs/development/perl-modules/expression-generator/full-requirements.sh
index 29ed83668ed5..91218f36f609 100755
--- a/pkgs/development/perl-modules/expression-generator/full-requirements.sh
+++ b/pkgs/development/perl-modules/expression-generator/full-requirements.sh
@@ -3,19 +3,19 @@
 source lib-cache.sh;
 
 print_requirements () {
-	module_name="$1";
+    module_name="$1";
 
-	./requirements.sh "$module_name" | while read; do
-		echo "$REPLY";
-		print_reqs_cache "$REPLY";
-	done | sort | uniq
+    ./requirements.sh "$module_name" | while read; do
+        echo "$REPLY";
+        print_reqs_cache "$REPLY";
+    done | sort | uniq
 };
 
 print_reqs_cache () {
-	module_name="$1";
-	module_basename="${module_name//::/-}";
-	
-	cached_output print_requirements "$module_basename" "$module_name" "full.deps";
+    module_name="$1";
+    module_basename="${module_name//::/-}";
+
+    cached_output print_requirements "$module_basename" "$module_name" "full.deps";
 };
 
 print_reqs_cache "$@";
diff --git a/pkgs/development/perl-modules/expression-generator/grab-url.sh b/pkgs/development/perl-modules/expression-generator/grab-url.sh
index 809cf87fcebf..8935cad8cefe 100755
--- a/pkgs/development/perl-modules/expression-generator/grab-url.sh
+++ b/pkgs/development/perl-modules/expression-generator/grab-url.sh
@@ -3,13 +3,13 @@
 source lib-cache.sh
 
 get_file() {
-	url="$1";
+    url="$1";
 
-	if [ -n "$url" ]; then 
-		curl "$1";
-	else
-		echo -n;
-	fi;
+    if [ -n "$url" ]; then
+        curl "$1";
+    else
+        echo -n;
+    fi;
 }
 
 url="$1";
@@ -17,4 +17,3 @@ name="$2";
 name=${name:-$(basename "$url")}
 
 cached_output get_file "${name%%.*}" "$url" "${name#*.}"
-
diff --git a/pkgs/development/perl-modules/expression-generator/lib-cache.sh b/pkgs/development/perl-modules/expression-generator/lib-cache.sh
index 7473e2d1c15e..65095144bcd6 100644
--- a/pkgs/development/perl-modules/expression-generator/lib-cache.sh
+++ b/pkgs/development/perl-modules/expression-generator/lib-cache.sh
@@ -4,16 +4,15 @@
 # Third argument: argument to command
 # Fourth argument: cache type
 cached_output () {
-	cmd="$1";
-	basename="$2";
-	arg="$3";
-	ext="$4";
-	
-	if ! [ -e "cache-${ext//./-}/${basename}.${ext}" ]; then
-		mkdir -p "cache-${ext//./-}";
-		$cmd $arg > "cache-${ext//./-}/${basename}.${ext}";
-	fi;
+    cmd="$1";
+    basename="$2";
+    arg="$3";
+    ext="$4";
 
-	cat "cache-${ext//./-}/${basename}.${ext}";
+    if ! [ -e "cache-${ext//./-}/${basename}.${ext}" ]; then
+        mkdir -p "cache-${ext//./-}";
+        $cmd $arg > "cache-${ext//./-}/${basename}.${ext}";
+    fi;
+
+    cat "cache-${ext//./-}/${basename}.${ext}";
 }
-
diff --git a/pkgs/development/perl-modules/expression-generator/requirements.sh b/pkgs/development/perl-modules/expression-generator/requirements.sh
index 60ee68d99ada..19b24c55a8ee 100755
--- a/pkgs/development/perl-modules/expression-generator/requirements.sh
+++ b/pkgs/development/perl-modules/expression-generator/requirements.sh
@@ -6,12 +6,12 @@ module_name="$1";
 module_basename="${1//::/-}";
 
 print_requirements () {
-	module_name="$1";
-	
-	./retrieve-meta-yaml.sh "$module_name" |
-		sed -re '1,/^requires:/d; /^[a-z]/,$d; s@^\s*@@; s@:\s.*@@';
-	./retrieve-meta-yaml.sh "$module_name" |
-		sed -re '1,/^build_requires:/d; /^[a-z]/,$d; s@^\s*@@; s@:\s.*@@';
+    module_name="$1";
+
+    ./retrieve-meta-yaml.sh "$module_name" |
+        sed -re '1,/^requires:/d; /^[a-z]/,$d; s@^\s*@@; s@:\s.*@@';
+    ./retrieve-meta-yaml.sh "$module_name" |
+        sed -re '1,/^build_requires:/d; /^[a-z]/,$d; s@^\s*@@; s@:\s.*@@';
 };
 
 cached_output print_requirements "$module_basename" "$module_name" "direct.deps";
diff --git a/pkgs/development/perl-modules/expression-generator/retrieve-file-link.sh b/pkgs/development/perl-modules/expression-generator/retrieve-file-link.sh
index a9cf0d94e0d3..c8ec5df11b7d 100755
--- a/pkgs/development/perl-modules/expression-generator/retrieve-file-link.sh
+++ b/pkgs/development/perl-modules/expression-generator/retrieve-file-link.sh
@@ -6,9 +6,9 @@ file_name="$2";
 version_regexp="${module_basename}(-[0-9.a-z]+){0,1}";
 author_regexp="[A-Z0-9]+";
 
-./retrieve-modulepage.sh "$module_basename" | 
-	egrep "[<]a href=\"[a-z0-9/]*/(${author_regexp}/){0,1}${version_regexp}/${file_name}" |
-	sed -re "s@.*href=\"@@; s@\".*@@" |
-	sed -re 's@^/@http://search.cpan.org/@';
+./retrieve-modulepage.sh "$module_basename" |
+    egrep "[<]a href=\"[a-z0-9/]*/(${author_regexp}/){0,1}${version_regexp}/${file_name}" |
+    sed -re "s@.*href=\"@@; s@\".*@@" |
+    sed -re 's@^/@http://search.cpan.org/@';
 
 echo "$link_line";
diff --git a/pkgs/development/perl-modules/expression-generator/retrieve-meta-yaml.sh b/pkgs/development/perl-modules/expression-generator/retrieve-meta-yaml.sh
index 2c85d45691f0..3b162ebe693f 100755
--- a/pkgs/development/perl-modules/expression-generator/retrieve-meta-yaml.sh
+++ b/pkgs/development/perl-modules/expression-generator/retrieve-meta-yaml.sh
@@ -3,11 +3,11 @@
 source lib-cache.sh;
 
 print_meta_yaml () {
-	module_name="$1";
-	module_basename="${module_name//::/-}";
+    module_name="$1";
+    module_basename="${module_name//::/-}";
 
-	./grab-url.sh "$(./retrieve-file-link.sh "$module_basename" "META.yml")" \
-		"${module_basename}.meta.yml";
+    ./grab-url.sh "$(./retrieve-file-link.sh "$module_basename" "META.yml")" \
+        "${module_basename}.meta.yml";
 };
 
 module_name="$1";
diff --git a/pkgs/development/perl-modules/expression-generator/source-download-link.sh b/pkgs/development/perl-modules/expression-generator/source-download-link.sh
index 575f47629c26..779d131961f0 100755
--- a/pkgs/development/perl-modules/expression-generator/source-download-link.sh
+++ b/pkgs/development/perl-modules/expression-generator/source-download-link.sh
@@ -6,12 +6,12 @@ module_name="$1";
 module_basename="${module_name//::/-}";
 
 write_link() {
-	module_basename="$1";
+    module_basename="$1";
 
-	./retrieve-modulepage.sh "$module_basename" | 
-		grep -A 2 "This Release" |
-		grep href |
-		sed -re 's/.*href="//; s/".*//; s@^/@http://search.cpan.org/@';
+    ./retrieve-modulepage.sh "$module_basename" |
+        grep -A 2 "This Release" |
+        grep href |
+        sed -re 's/.*href="//; s/".*//; s@^/@http://search.cpan.org/@';
 }
 
 cached_output write_link "$module_basename" "$module_basename" src.link;
diff --git a/pkgs/development/perl-modules/expression-generator/write-nix-expression.sh b/pkgs/development/perl-modules/expression-generator/write-nix-expression.sh
index cfe1506640b3..9f5cdb9142eb 100755
--- a/pkgs/development/perl-modules/expression-generator/write-nix-expression.sh
+++ b/pkgs/development/perl-modules/expression-generator/write-nix-expression.sh
@@ -5,16 +5,16 @@ cd $(dirname $0);
 source lib-cache.sh;
 
 print_expression () {
-	module_name="$1";
-	module_basename="${module_name//::/-}";
-	module_compressedname="perl${module_name//::/}";
-	sourcelink="$(./source-download-link.sh "${module_name}")";
-	version_name="${sourcelink%.tar.*}";
-	version_name="${version_name##*/}";
-	dependencies="$(./filtered-requirements.sh "$module_name" | sed -e 's/^/perl/; s/:://g' | xargs)";
-	source_hash=$(nix-prefetch-url "$sourcelink" 2>/dev/null);
+    module_name="$1";
+    module_basename="${module_name//::/-}";
+    module_compressedname="perl${module_name//::/}";
+    sourcelink="$(./source-download-link.sh "${module_name}")";
+    version_name="${sourcelink%.tar.*}";
+    version_name="${version_name##*/}";
+    dependencies="$(./filtered-requirements.sh "$module_name" | sed -e 's/^/perl/; s/:://g' | xargs)";
+    source_hash=$(nix-prefetch-url "$sourcelink" 2>/dev/null);
 
-	cat <<EOF
+    cat <<EOF
 
   ${module_compressedname} = import ../development/perl-modules/generic perl {
     name = "${version_name}";
diff --git a/pkgs/development/tools/build-managers/tup/setup-hook.sh b/pkgs/development/tools/build-managers/tup/setup-hook.sh
index 5bf64ae59d35..b7962c80d469 100644
--- a/pkgs/development/tools/build-managers/tup/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/tup/setup-hook.sh
@@ -1,27 +1,27 @@
 #!/bin/sh
 
 tupConfigurePhase() {
-	runHook preConfigure
+    runHook preConfigure
 
-	echo -n CONFIG_TUP_ARCH= >> tup.config
-	case "$system" in
-	"i686-*")      echo i386 >> tup.config;;
-	"x86_64-*")    echo x86_64 >> tup.config;;
-	"powerpc-*")   echo powerpc >> tup.config;;
-	"powerpc64-*") echo powerpc64 >> tup.config;;
-	"ia64-*")      echo ia64 >> tup.config;;
-	"alpha-*")     echo alpha >> tup.config;;
-	"sparc-*")     echo sparc >> tup.config;;
-	"aarch64-*")   echo arm64 >> tup.config;;
-	"arm*")        echo arm >> tup.config;;
-	esac
+    echo -n CONFIG_TUP_ARCH= >> tup.config
+    case "$system" in
+    "i686-*")      echo i386 >> tup.config;;
+    "x86_64-*")    echo x86_64 >> tup.config;;
+    "powerpc-*")   echo powerpc >> tup.config;;
+    "powerpc64-*") echo powerpc64 >> tup.config;;
+    "ia64-*")      echo ia64 >> tup.config;;
+    "alpha-*")     echo alpha >> tup.config;;
+    "sparc-*")     echo sparc >> tup.config;;
+    "aarch64-*")   echo arm64 >> tup.config;;
+    "arm*")        echo arm >> tup.config;;
+    esac
 
-	echo "${tupConfig-}" >> tup.config
+    echo "${tupConfig-}" >> tup.config
 
-	tup init
-	tup generate tupBuild.sh
+    tup init
+    tup generate tupBuild.sh
 
-	runHook postConfigure
+    runHook postConfigure
 }
 
 if [ -z "${dontUseTupConfigure-}" -a -z "${configurePhase-}" ]; then
@@ -30,13 +30,13 @@ fi
 
 
 tupBuildPhase() {
-	runHook preBuild
+    runHook preBuild
 
-	pushd .
-	. tupBuild.sh
-	popd
+    pushd .
+    . tupBuild.sh
+    popd
 
-	runHook postBuild
+    runHook postBuild
 }
 
 if [ -z "${dontUseTupBuild-}" -a -z "${buildPhase-}" ]; then
diff --git a/pkgs/games/dwarf-fortress/update.sh b/pkgs/games/dwarf-fortress/update.sh
index e36badc4199e..0ef9a40c7a5d 100755
--- a/pkgs/games/dwarf-fortress/update.sh
+++ b/pkgs/games/dwarf-fortress/update.sh
@@ -3,13 +3,13 @@
 
 # systems to generate hashes for
 systems='linux linux32 osx osx32
-	 win win_s win32 win32_s
+     win win_s win32 win32_s
          legacy legacy_s legacy32 legacy32_s'
 
 if [ $# -eq 0 ]; then
     versions="$(curl http://www.bay12games.com/dwarves/ \
-		   | grep 'DWARF FORTRESS CLASSIC ' \
-		   | sed 's/.*DWARF FORTRESS CLASSIC \([0-9.]*\) .*/\1/')"
+           | grep 'DWARF FORTRESS CLASSIC ' \
+           | sed 's/.*DWARF FORTRESS CLASSIC \([0-9.]*\) .*/\1/')"
 else
     versions="$@"
 fi
@@ -18,23 +18,23 @@ tmp1="$(mktemp)"
 tmp2="$(mktemp)"
 for version in $versions; do
     for system in $systems; do
-	echo -n $version,$system,
-	ver=$(echo $version | sed -e s,^0\.,, | tr . _)
-	if [[ "$system" = *win* ]] || [[ "$system" = *legacy* ]]; then
-	    ext=zip
-	else
-	    ext=tar.bz2
-	fi
-	nix-prefetch-url \
-	    http://www.bay12games.com/dwarves/df_${ver}_${system}.${ext}
+    echo -n $version,$system,
+    ver=$(echo $version | sed -e s,^0\.,, | tr . _)
+    if [[ "$system" = *win* ]] || [[ "$system" = *legacy* ]]; then
+        ext=zip
+    else
+        ext=tar.bz2
+    fi
+    nix-prefetch-url \
+        http://www.bay12games.com/dwarves/df_${ver}_${system}.${ext}
     done
 done | jq --slurp --raw-input \
-	  'split("\n")  | .[:-1] | map(split(",")) |
+      'split("\n")  | .[:-1] | map(split(",")) |
            map({ "version": .[0], "platform": .[1], "sha256": .[2] }) |
-	   group_by(.version) |
-	   map(map({"version": .version, (.platform): .sha256}) | add |
-	       {(.version): .} | map_values(del(.version))) | add' \
-	  > "$tmp1"
+       group_by(.version) |
+       map(map({"version": .version, (.platform): .sha256}) | add |
+           {(.version): .} | map_values(del(.version))) | add' \
+      > "$tmp1"
 
 # Append $tmp1 to game.json. There should be a better way to handle
 # this but all other attempts failed for me.
diff --git a/pkgs/os-specific/linux/service-wrapper/service-wrapper.sh b/pkgs/os-specific/linux/service-wrapper/service-wrapper.sh
index a7c3bc9758b1..2889adc18686 100755
--- a/pkgs/os-specific/linux/service-wrapper/service-wrapper.sh
+++ b/pkgs/os-specific/linux/service-wrapper/service-wrapper.sh
@@ -33,12 +33,12 @@
 
 
 is_ignored_file() {
-	case "$1" in
-		skeleton | README | *.dpkg-dist | *.dpkg-old | rc | rcS | single | reboot | bootclean.sh)
-			return 0
-		;;
-	esac
-	return 1
+    case "$1" in
+        skeleton | README | *.dpkg-dist | *.dpkg-old | rc | rcS | single | reboot | bootclean.sh)
+            return 0
+        ;;
+    esac
+    return 1
 }
 
 VERSION=$(@coreutils@/bin/basename $0)" ver. 19-04"
@@ -75,35 +75,35 @@ while [ $# -gt 0 ]; do
        if [ -z "${SERVICE}" -a $# -eq 1 -a "${1}" = "--status-all" ]; then
           if [ -d "${SERVICEDIR}" ]; then
              cd ${SERVICEDIR}
-	     for SERVICE in * ; do
-	       case "${SERVICE}" in
-	         functions | halt | killall | single| linuxconf| kudzu)
-	             ;;
-	         *)
-	           if ! is_ignored_file "${SERVICE}" \
-	   	    && [ -x "${SERVICEDIR}/${SERVICE}" ]; then
-	                   out=$(env -i LANG="$LANG" LANGUAGE="$LANGUAGE" LC_CTYPE="$LC_CTYPE" LC_NUMERIC="$LC_NUMERIC" LC_TIME="$LC_TIME" LC_COLLATE="$LC_COLLATE" LC_MONETARY="$LC_MONETARY" LC_MESSAGES="$LC_MESSAGES" LC_PAPER="$LC_PAPER" LC_NAME="$LC_NAME" LC_ADDRESS="$LC_ADDRESS" LC_TELEPHONE="$LC_TELEPHONE" LC_MEASUREMENT="$LC_MEASUREMENT" LC_IDENTIFICATION="$LC_IDENTIFICATION" LC_ALL="$LC_ALL" PATH="$PATH" TERM="$TERM" "$SERVICEDIR/$SERVICE" status 2>&1)
-	                   retval=$?
-	                   if echo "$out" | egrep -iq "usage:"; then
-	                     #printf " %s %-60s %s\n" "[?]" "$SERVICE:" "unknown" 1>&2
-	                     echo " [ ? ]  $SERVICE" 1>&2
-	                     continue
-	                   else
-	                     if [ "$retval" = "0" -a -n "$out" ]; then
-	                       #printf " %s %-60s %s\n" "[+]" "$SERVICE:" "running"
-	                       echo " [ + ]  $SERVICE"
-	                       continue
-	                     else
-	                       #printf " %s %-60s %s\n" "[-]" "$SERVICE:" "NOT running"
-	                       echo " [ - ]  $SERVICE"
-	                       continue
-	                     fi
-	                   fi
-	             #env -i LANG="$LANG" LANGUAGE="$LANGUAGE" LC_CTYPE="$LC_CTYPE" LC_NUMERIC="$LC_NUMERIC" LC_TIME="$LC_TIME" LC_COLLATE="$LC_COLLATE" LC_MONETARY="$LC_MONETARY" LC_MESSAGES="$LC_MESSAGES" LC_PAPER="$LC_PAPER" LC_NAME="$LC_NAME" LC_ADDRESS="$LC_ADDRESS" LC_TELEPHONE="$LC_TELEPHONE" LC_MEASUREMENT="$LC_MEASUREMENT" LC_IDENTIFICATION="$LC_IDENTIFICATION" LC_ALL="$LC_ALL" PATH="$PATH" TERM="$TERM" "$SERVICEDIR/$SERVICE" status
-	           fi
-	           ;;
-	       esac
-	     done
+         for SERVICE in * ; do
+           case "${SERVICE}" in
+             functions | halt | killall | single| linuxconf| kudzu)
+                 ;;
+             *)
+               if ! is_ignored_file "${SERVICE}" \
+               && [ -x "${SERVICEDIR}/${SERVICE}" ]; then
+                       out=$(env -i LANG="$LANG" LANGUAGE="$LANGUAGE" LC_CTYPE="$LC_CTYPE" LC_NUMERIC="$LC_NUMERIC" LC_TIME="$LC_TIME" LC_COLLATE="$LC_COLLATE" LC_MONETARY="$LC_MONETARY" LC_MESSAGES="$LC_MESSAGES" LC_PAPER="$LC_PAPER" LC_NAME="$LC_NAME" LC_ADDRESS="$LC_ADDRESS" LC_TELEPHONE="$LC_TELEPHONE" LC_MEASUREMENT="$LC_MEASUREMENT" LC_IDENTIFICATION="$LC_IDENTIFICATION" LC_ALL="$LC_ALL" PATH="$PATH" TERM="$TERM" "$SERVICEDIR/$SERVICE" status 2>&1)
+                       retval=$?
+                       if echo "$out" | egrep -iq "usage:"; then
+                         #printf " %s %-60s %s\n" "[?]" "$SERVICE:" "unknown" 1>&2
+                         echo " [ ? ]  $SERVICE" 1>&2
+                         continue
+                       else
+                         if [ "$retval" = "0" -a -n "$out" ]; then
+                           #printf " %s %-60s %s\n" "[+]" "$SERVICE:" "running"
+                           echo " [ + ]  $SERVICE"
+                           continue
+                         else
+                           #printf " %s %-60s %s\n" "[-]" "$SERVICE:" "NOT running"
+                           echo " [ - ]  $SERVICE"
+                           continue
+                         fi
+                       fi
+                 #env -i LANG="$LANG" LANGUAGE="$LANGUAGE" LC_CTYPE="$LC_CTYPE" LC_NUMERIC="$LC_NUMERIC" LC_TIME="$LC_TIME" LC_COLLATE="$LC_COLLATE" LC_MONETARY="$LC_MONETARY" LC_MESSAGES="$LC_MESSAGES" LC_PAPER="$LC_PAPER" LC_NAME="$LC_NAME" LC_ADDRESS="$LC_ADDRESS" LC_TELEPHONE="$LC_TELEPHONE" LC_MEASUREMENT="$LC_MEASUREMENT" LC_IDENTIFICATION="$LC_IDENTIFICATION" LC_ALL="$LC_ALL" PATH="$PATH" TERM="$TERM" "$SERVICEDIR/$SERVICE" status
+               fi
+               ;;
+           esac
+         done
           else
              systemctl $sctl_args list-units
           fi
diff --git a/pkgs/tools/graphics/zxing/zxing.sh b/pkgs/tools/graphics/zxing/zxing.sh
index ca6ac60bab69..a38558d87026 100644
--- a/pkgs/tools/graphics/zxing/zxing.sh
+++ b/pkgs/tools/graphics/zxing/zxing.sh
@@ -2,17 +2,17 @@
 choice="$1";
 shift
 case "$choice" in
-	encode | create | write | CommandLineEncoder)
-		zxing-cmdline-encoder "$@";
-		;;
-	decode | read | run | CommandLineRunner)
-		zxing-cmdline-runner "$@";
-		;;
-	help | usage | --help | --usage | -h)
-		zxing read;
-		zxing write;
-		;;
-	*)
-		zxing read "$choice" "$@"
-		;;
+    encode | create | write | CommandLineEncoder)
+        zxing-cmdline-encoder "$@";
+        ;;
+    decode | read | run | CommandLineRunner)
+        zxing-cmdline-runner "$@";
+        ;;
+    help | usage | --help | --usage | -h)
+        zxing read;
+        zxing write;
+        ;;
+    *)
+        zxing read "$choice" "$@"
+        ;;
 esac
diff --git a/pkgs/tools/misc/grub/grub1.patches.sh b/pkgs/tools/misc/grub/grub1.patches.sh
index d3b138ad3577..a7db25afb64f 100755
--- a/pkgs/tools/misc/grub/grub1.patches.sh
+++ b/pkgs/tools/misc/grub/grub1.patches.sh
@@ -13,39 +13,39 @@ set -u
 
 # https://salsa.debian.org/grub-team/grub-legacy/tree/master/debian/patches
 SERIES=(
-	snapshot.patch
-	menu.lst_gnu-hurd.patch
-	graphics.patch
-	raid.patch
-	raid_cciss.patch
-	xfs_freeze.patch
-	2gb_limit.patch
-	grub-special_device_names.patch
-	grub-xvd_drives.patch
-	initrd_max_address.patch
-	splashimage_help.patch
-	grub-install_addsyncs.patch
-	grub-install_regexp.patch
-	grub-install_aoe_support.patch
-	grub-install_xvd.patch
-	geometry-26kernel.patch
-	print_func.patch
-	mprotect.patch
-	savedefault.patch
-	find-grub-dir.patch
-	intelmac.patch
-	crossreference_manpages.patch
-	ext3_256byte_inode.patch
+    snapshot.patch
+    menu.lst_gnu-hurd.patch
+    graphics.patch
+    raid.patch
+    raid_cciss.patch
+    xfs_freeze.patch
+    2gb_limit.patch
+    grub-special_device_names.patch
+    grub-xvd_drives.patch
+    initrd_max_address.patch
+    splashimage_help.patch
+    grub-install_addsyncs.patch
+    grub-install_regexp.patch
+    grub-install_aoe_support.patch
+    grub-install_xvd.patch
+    geometry-26kernel.patch
+    print_func.patch
+    mprotect.patch
+    savedefault.patch
+    find-grub-dir.patch
+    intelmac.patch
+    crossreference_manpages.patch
+    ext3_256byte_inode.patch
     # Breaks on NixOS.
-	#use_grub-probe_in_grub-install.patch
-	objcopy-absolute.patch
-	no-reorder-functions.patch
+    #use_grub-probe_in_grub-install.patch
+    objcopy-absolute.patch
+    no-reorder-functions.patch
 
-	# We aren't building amd64 binaries, see #244498
-	#fix_amd64_compile.patch
-	modern-automake.patch
-	no-combine-stack-adjustments.patch
-	no-pie.patch
+    # We aren't building amd64 binaries, see #244498
+    #fix_amd64_compile.patch
+    modern-automake.patch
+    no-combine-stack-adjustments.patch
+    no-pie.patch
 )
 
 # Revision mapping to current tip of the 0.97-73 branch.
@@ -63,8 +63,8 @@ in
 EOF
 
 for PATCH in "${SERIES[@]}"; do
-	URL="$prefix/$PATCH"
-	HASH="$(nix-prefetch-url "$URL")"
-	echo "{ url = \"\${prefix}/$PATCH\"; sha256 = \"$HASH\"; }" >> "$FILE"
+    URL="$prefix/$PATCH"
+    HASH="$(nix-prefetch-url "$URL")"
+    echo "{ url = \"\${prefix}/$PATCH\"; sha256 = \"$HASH\"; }" >> "$FILE"
 done
 echo "]" >> "$FILE"
diff --git a/pkgs/tools/typesetting/lout/builder.sh b/pkgs/tools/typesetting/lout/builder.sh
index 61459e48b7f0..eab37c3c68fb 100755
--- a/pkgs/tools/typesetting/lout/builder.sh
+++ b/pkgs/tools/typesetting/lout/builder.sh
@@ -15,28 +15,28 @@ installDoc ()
     echo "building \`$doc' document..."
     if [ ! -f "doc/$doc/outfile.ps" ]
     then
-      ( PATH="$PWD:$PATH" ;				\
-        cd "doc/$doc" && lout -r4 -o outfile.ps all )	\
+      ( PATH="$PWD:$PATH" ; \
+        cd "doc/$doc" && lout -r4 -o outfile.ps all ) \
       || return 1
     fi
-    cp "doc/$doc/outfile.ps" "$out/doc/lout/$doc.ps" &&		\
-    ps2pdf -dPDFSETTINGS=/prepress -sPAPERSIZE=a4		\
+    cp "doc/$doc/outfile.ps" "$out/doc/lout/$doc.ps" && \
+    ps2pdf -dPDFSETTINGS=/prepress -sPAPERSIZE=a4 \
            "doc/$doc/outfile.ps" "$out/doc/lout/$doc.pdf"
   done
 
   return 0
 }
 
-unpackPhase &&									\
-cd lout-*.* &&									\
-cat makefile |									\
-  sed -e "s|^PREFIX[[:blank:]]*=.*\$|PREFIX = $out|g ;				\
-          s|^LOUTLIBDIR[[:blank:]]*=.*$|LOUTLIBDIR = \$(PREFIX)/lib/lout|g ;	\
-	  s|^LOUTDOCDIR[[:blank:]]*=.*$|LOUTDOCDIR = \$(PREFIX)/doc/lout|g ;	\
-	  s|^MANDIR[[:blank:]]*=.*$|MANDIR = \$(PREFIX)/man|g"			\
-  > "$nixMakefile" &&								\
-mkdir -p "$out/bin" && mkdir -p "$out/lib"					\
-mkdir -p "$out/man" && mkdir -p "$out/doc/lout" &&				\
-make -f "$nixMakefile" CC=cc install installman &&					\
-installDoc &&									\
+unpackPhase && \
+cd lout-*.* && \
+cat makefile | \
+  sed -e "s|^PREFIX[[:blank:]]*=.*\$|PREFIX = $out|g ; \
+    s|^LOUTLIBDIR[[:blank:]]*=.*$|LOUTLIBDIR = \$(PREFIX)/lib/lout|g ; \
+    s|^LOUTDOCDIR[[:blank:]]*=.*$|LOUTDOCDIR = \$(PREFIX)/doc/lout|g ; \
+    s|^MANDIR[[:blank:]]*=.*$|MANDIR = \$(PREFIX)/man|g" \
+  > "$nixMakefile" && \
+mkdir -p "$out/bin" && mkdir -p "$out/lib" \
+mkdir -p "$out/man" && mkdir -p "$out/doc/lout" && \
+make -f "$nixMakefile" CC=cc install installman && \
+installDoc && \
 fixupPhase

From 20caa76219ce345f334db86c1ba02a0d761a428d Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 8 Nov 2021 23:34:29 +0000
Subject: [PATCH 07/51] sourceHighlight: fix tests on clang and gcc-12

---
 pkgs/tools/text/source-highlight/default.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/tools/text/source-highlight/default.nix b/pkgs/tools/text/source-highlight/default.nix
index 4a7b588cd9d4..289740854f2e 100644
--- a/pkgs/tools/text/source-highlight/default.nix
+++ b/pkgs/tools/text/source-highlight/default.nix
@@ -18,6 +18,13 @@ stdenv.mkDerivation rec {
       sha256 = "1wnj0jmkmrwjww7qk9dvfxh8h06jdn7mi8v2fvwh95b6x87z5l47";
       excludes = [ "ChangeLog" ];
     })
+
+    # Upstream fix for clang-13 and gcc-12 test support
+    (fetchpatch {
+      name = "gcc-12.patch";
+      url = "http://git.savannah.gnu.org/cgit/src-highlite.git/patch/?id=ab9fe5cb9b85c5afab94f2a7f4b6d7d473c14ee9";
+      sha256 = "1v33zd2766k7cdgmajw2lffw9wd7v4f8z01f40z53f6bp608nr62";
+    })
   ];
 
   # source-highlight uses it's own binary to generate documentation.
@@ -35,7 +42,7 @@ stdenv.mkDerivation rec {
     "--with-bash-completion=${placeholder "out"}/share/bash_completion.d"
   ];
 
-  doCheck = !stdenv.cc.isClang;
+  doCheck = true;
 
   enableParallelBuilding = true;
   # Upstream uses the same intermediate files in multiple tests, running

From 806b33a0493a16c3b110936f505669a0f1eea05d Mon Sep 17 00:00:00 2001
From: Kerstin Humm <kerstin@erictapen.name>
Date: Sun, 14 Nov 2021 17:24:15 +0100
Subject: [PATCH 08/51] libuninameslist: 20210917 -> 20211114

---
 pkgs/development/libraries/libuninameslist/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libuninameslist/default.nix b/pkgs/development/libraries/libuninameslist/default.nix
index 90ea1947cb54..cd615ed81fe9 100644
--- a/pkgs/development/libraries/libuninameslist/default.nix
+++ b/pkgs/development/libraries/libuninameslist/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libuninameslist";
-  version = "20210917";
+  version = "20211114";
 
   src = fetchFromGitHub {
     owner = "fontforge";
     repo = pname;
     rev = version;
-    sha256 = "sha256-bwMgNK3DhhWjijush27265Q1UoZOw7T17fKsaR6IV14=";
+    sha256 = "sha256-izxG2mx+D83s78eL19ERUaLrw9FPjlJRcFZw3+xzLDQ=";
   };
 
   nativeBuildInputs = [

From 6e78c9331e4c04b3e884896e74946bebb964762f Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Mon, 15 Nov 2021 22:59:26 +0100
Subject: [PATCH 09/51] git: 2.33.1 -> 2.34.0

---
 .../version-management/git-and-tools/git/default.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 61d5225621b2..634d82a6045d 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -25,7 +25,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.33.1";
+  version = "2.34.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "sha256-4FSm5sKwiL0b/19h7ZulqpHJo81QlTmktBxd3wIgHy8=";
+    sha256 = "07s1c9lzlm4kpbb5lmxy0869phg7037pv4faz5hlqyb5csrbjv7x";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";

From 3961921973524fc4805141a6a5eb1d6e7157a79c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 16 Nov 2021 12:15:39 -0800
Subject: [PATCH 10/51] imagemagick: 7.1.0-13 -> 7.1.0-14

---
 pkgs/applications/graphics/ImageMagick/7.0.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/graphics/ImageMagick/7.0.nix b/pkgs/applications/graphics/ImageMagick/7.0.nix
index a07cf38c0eba..257206b4f27e 100644
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@@ -18,13 +18,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "imagemagick";
-  version = "7.1.0-13";
+  version = "7.1.0-14";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = version;
-    sha256 = "sha256-W/XqgYOlSailHQdNBYsvf2P9go9sblWayDLrQQlekro=";
+    sha256 = "sha256-w4h4KEfmDC/dDgtk7xgEnIYvSfPlKfsvdFhx43Tn9GA=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big

From afac2c3c6867e3f88531aab14387290b2f727a36 Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Tue, 16 Nov 2021 22:51:10 +0100
Subject: [PATCH 11/51] gmp: use pname and version

---
 pkgs/development/libraries/gmp/4.3.2.nix | 5 +++--
 pkgs/development/libraries/gmp/5.1.x.nix | 5 +++--
 pkgs/development/libraries/gmp/6.x.nix   | 5 +++--
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/libraries/gmp/4.3.2.nix b/pkgs/development/libraries/gmp/4.3.2.nix
index ce870581f5e9..50e26b4c1327 100644
--- a/pkgs/development/libraries/gmp/4.3.2.nix
+++ b/pkgs/development/libraries/gmp/4.3.2.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, m4, cxx ? true }:
 
 let self = stdenv.mkDerivation rec {
-  name = "gmp-4.3.2";
+  pname = "gmp";
+  version = "4.3.2";
 
   src = fetchurl {
-    url = "mirror://gnu/gmp/${name}.tar.bz2";
+    url = "mirror://gnu/gmp/gmp-${version}.tar.bz2";
     sha256 = "0x8prpqi9amfcmi7r4zrza609ai9529pjaq0h4aw51i867064qck";
   };
 
diff --git a/pkgs/development/libraries/gmp/5.1.x.nix b/pkgs/development/libraries/gmp/5.1.x.nix
index ea6a7ee42310..aa3704eb0b58 100644
--- a/pkgs/development/libraries/gmp/5.1.x.nix
+++ b/pkgs/development/libraries/gmp/5.1.x.nix
@@ -6,10 +6,11 @@
 let inherit (lib) optional; in
 
 let self = stdenv.mkDerivation rec {
-  name = "gmp-5.1.3";
+  pname = "gmp";
+  version = "5.1.3";
 
   src = fetchurl { # we need to use bz2, others aren't in bootstrapping stdenv
-    urls = [ "mirror://gnu/gmp/${name}.tar.bz2" "ftp://ftp.gmplib.org/pub/${name}/${name}.tar.bz2" ];
+    urls = [ "mirror://gnu/gmp/gmp-${version}.tar.bz2" "ftp://ftp.gmplib.org/pub/gmp-${version}/gmp-${version}.tar.bz2" ];
     sha256 = "0q5i39pxrasgn9qdxzpfbwhh11ph80p57x6hf48m74261d97j83m";
   };
 
diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index 6228b6aaab9e..59bc98aa559f 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -12,10 +12,11 @@
 let inherit (lib) optional; in
 
 let self = stdenv.mkDerivation rec {
-  name = "gmp-6.2.1";
+  pname = "gmp";
+  version = "6.2.1";
 
   src = fetchurl { # we need to use bz2, others aren't in bootstrapping stdenv
-    urls = [ "mirror://gnu/gmp/${name}.tar.bz2" "ftp://ftp.gmplib.org/pub/${name}/${name}.tar.bz2" ];
+    urls = [ "mirror://gnu/gmp/gmp-${version}.tar.bz2" "ftp://ftp.gmplib.org/pub/gmp-${version}/gmp-${version}.tar.bz2" ];
     sha256 = "0z2ddfiwgi0xbf65z4fg4hqqzlhv0cc6hdcswf3c6n21xdmk5sga";
   };
 

From cd838da194ca8aa795c732e330f7634d057da05b Mon Sep 17 00:00:00 2001
From: Victor Engmark <vengmark@linz.govt.nz>
Date: Thu, 18 Nov 2021 10:53:29 +1300
Subject: [PATCH 12/51] vanity: Indent with spaces part 2

More risky since it affects the inside of strings.
---
 maintainers/scripts/vanity.sh | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/maintainers/scripts/vanity.sh b/maintainers/scripts/vanity.sh
index a6e82e039422..b879488165df 100755
--- a/maintainers/scripts/vanity.sh
+++ b/maintainers/scripts/vanity.sh
@@ -76,20 +76,20 @@ echo "$maintainers" | cut -f 2 | sed -e 's@.*@<my://name/&>	<my://is-name>	<my:/
 sparql="$(nix-build '<nixpkgs>' -Q -A apache-jena --no-out-link)/bin/sparql"
 name_list="$(
     "$sparql" --results=TSV --data="$n3" "
-	select ?x ?y ?g where {
-	  ?x <my://can-be>+ ?y.
-	  ?x <my://is-name> ?g.
+    select ?x ?y ?g where {
+      ?x <my://can-be>+ ?y.
+      ?x <my://is-name> ?g.
         }
-	" | tail -n +2 |
+    " | tail -n +2 |
     sed -re 's@<my://name/@@g; s@<my://@@g; s@>@@g;' |
     sort -k 2,3 -t '	'
 )"
 github_name_list="$(
     "$sparql" --results=TSV --data="$n3" "
-	select ?x ?y where {
-	  ?x (<my://can-be>+ / <my://at-github>) ?y.
+    select ?x ?y where {
+      ?x (<my://can-be>+ / <my://at-github>) ?y.
         }
-	" | tail -n +2 |
+    " | tail -n +2 |
     sed -re 's@<my://(name|github)/@@g; s@<my://@@g; s@>@@g;'
 )"
 

From e148f5ff46ebd8e420896d9cac1d311311b8eed8 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 18 Nov 2021 01:22:22 +0200
Subject: [PATCH 13/51] mariadb-connector-c: install my_config.h

https://github.com/bmwiedemann/openSUSE/blob/master/packages/m/mariadb-connector-c/mariadb-connector-c.spec#L152
https://github.com/NixOS/nixpkgs/issues/146340

arch, however, packages it in their mariadb-libs package which provides
connector-c so a nixpkgs mariadb maintainer may want to look into that
https://archlinux.org/packages/extra/x86_64/mariadb-libs/files/
---
 pkgs/servers/sql/mariadb/connector-c/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/servers/sql/mariadb/connector-c/default.nix b/pkgs/servers/sql/mariadb/connector-c/default.nix
index 0767828461fe..1db496d8e8da 100644
--- a/pkgs/servers/sql/mariadb/connector-c/default.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/default.nix
@@ -52,6 +52,7 @@ stdenv.mkDerivation {
     ln -sv mariadb $dev/include/mysql
     ln -sv mariadb_version.h $dev/include/mariadb/mysql_version.h
     ln -sv libmariadb.pc $dev/lib/pkgconfig/mysqlclient.pc
+    install -Dm644 include/ma_config.h $dev/include/mariadb/my_config.h
   '';
 
   meta = {

From 7f523aa88a31fc3b34615b4075544ccedb995d5e Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Thu, 18 Nov 2021 04:20:00 +0000
Subject: [PATCH 14/51] postgresql_9_6: 9.6.23 -> 9.6.24

https://www.postgresql.org/docs/release/9.6.24/
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index fafd5581e5a2..eee73aad36e2 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -201,9 +201,9 @@ let
 in self: {
 
   postgresql_9_6 = self.callPackage generic {
-    version = "9.6.23";
+    version = "9.6.24";
     psqlSchema = "9.6";
-    sha256 = "1fa735lrmv2vrfiixg73nh024gxlagcbrssklvgwdf0s82cgfjd8";
+    sha256 = "sha256-rrehlr4+vtGnR271ZfOXIhh8EI3UfadIm+nE/K6YKs4=";
     this = self.postgresql_9_6;
     thisAttr = "postgresql_9_6";
     inherit self;

From 1d35ef9ee0951c0870484e7b8981b27a821e843b Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Thu, 18 Nov 2021 04:20:00 +0000
Subject: [PATCH 15/51] postgresql_10: 10.18 -> 10.19

https://www.postgresql.org/docs/release/10.19/
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index eee73aad36e2..42239d3ad9b8 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -210,9 +210,9 @@ in self: {
   };
 
   postgresql_10 = self.callPackage generic {
-    version = "10.18";
+    version = "10.19";
     psqlSchema = "10.0"; # should be 10, but changing it is invasive
-    sha256 = "009qpb02bq0rx0aaw5ck70gk07xwparhfxvlfimgihw2vhp7qisp";
+    sha256 = "sha256-brgwtCi2DoSuh+IENrzmecTZ0CAr567A5BsMZ9kTQjk=";
     this = self.postgresql_10;
     thisAttr = "postgresql_10";
     inherit self;

From b701405be7879df38f3aebbc150f6b925ab2e9a1 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Thu, 18 Nov 2021 04:20:00 +0000
Subject: [PATCH 16/51] postgresql_11: 11.13 -> 11.14

https://www.postgresql.org/docs/release/11.14/
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 42239d3ad9b8..62a90adcafaa 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -220,9 +220,9 @@ in self: {
   };
 
   postgresql_11 = self.callPackage generic {
-    version = "11.13";
+    version = "11.14";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    sha256 = "0j5wnscnxa3sx8d39s55654df8aikmvkihfb0a02hrgmyygnihx0";
+    sha256 = "sha256-llx/S+lvtk+VgYUsWMTwXDgS1K2CPA8+K9/nd8Fi+Zk=";
     this = self.postgresql_11;
     thisAttr = "postgresql_11";
     inherit self;

From c046c5d6ff02699d5dbe7fb5287c56abd83af15d Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Thu, 18 Nov 2021 04:20:00 +0000
Subject: [PATCH 17/51] postgresql_12: 12.8 -> 12.9

https://www.postgresql.org/docs/release/12.9/
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 62a90adcafaa..4428e069ae3f 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -229,9 +229,9 @@ in self: {
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.8";
+    version = "12.9";
     psqlSchema = "12";
-    sha256 = "0an6v5bsp26d276wbdx76lsq6cq86hgi2fmkzwawnk63j3h02r72";
+    sha256 = "sha256-if2i3jPtBKmFSOQ/PuXxW4gr4XUF1jH+DdGlQKK1bc4=";
     this = self.postgresql_12;
     thisAttr = "postgresql_12";
     inherit self;

From 67abda7877aaf6af6f04be25fdff424302486d2f Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Thu, 18 Nov 2021 04:20:00 +0000
Subject: [PATCH 18/51] postgresql_13: 13.4 -> 13.5

https://www.postgresql.org/docs/release/13.5/
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 4428e069ae3f..fb514765858d 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -238,9 +238,9 @@ in self: {
   };
 
   postgresql_13 = self.callPackage generic {
-    version = "13.4";
+    version = "13.5";
     psqlSchema = "13";
-    sha256 = "1kf0gcsrl5n25rjlvkh87aywmn28kbwvakm5c7j1qpr4j01y34za";
+    sha256 = "sha256-m4EGelXtuqvEGKrO9FfdhHdkKCdJlWCwBhWm6mwT9rM=";
     this = self.postgresql_13;
     thisAttr = "postgresql_13";
     inherit self;

From 85852b941d8e0888a98f1a21ac0a43875ccf7073 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Thu, 18 Nov 2021 04:20:00 +0000
Subject: [PATCH 19/51] postgresql_14: 14.0 -> 14.1

https://www.postgresql.org/docs/release/14.1/
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index fb514765858d..6e5f41d68828 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -247,9 +247,9 @@ in self: {
   };
 
   postgresql_14 = self.callPackage generic {
-    version = "14.0";
+    version = "14.1";
     psqlSchema = "14";
-    sha256 = "08m14zcrcvc2i0xl10p0wgzycsmfmk27gny40a8mwdx74s8xfapf";
+    sha256 = "sha256-TTwQHqeuOJgvBr3HN1i1Nyf7ZALs2TggBvpezHwspB8=";
     this = self.postgresql_14;
     thisAttr = "postgresql_14";
     inherit self;

From ce410eb2e2054261b66f27302540c4f196621bc8 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 13 Nov 2021 14:43:38 +0100
Subject: [PATCH 20/51] python3Packages.typed-ast: 1.4.3 -> 1.5.0

---
 pkgs/development/python-modules/typed-ast/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/typed-ast/default.nix b/pkgs/development/python-modules/typed-ast/default.nix
index d5c190e1c41f..9c7a3c355320 100644
--- a/pkgs/development/python-modules/typed-ast/default.nix
+++ b/pkgs/development/python-modules/typed-ast/default.nix
@@ -1,12 +1,12 @@
 { buildPythonPackage, fetchFromGitHub, lib, pythonOlder, pytest }:
 buildPythonPackage rec {
   pname = "typed-ast";
-  version = "1.4.3";
+  version = "1.5.0";
   src = fetchFromGitHub {
     owner = "python";
     repo = "typed_ast";
     rev = version;
-    sha256 = "16mn9snwik5n2ib65sw2xcaqdm02j8ps21zgjxf8kyy7qnx2mx4w";
+    sha256 = "sha256-z3l5gMG1Jp6EI7SnGn5ABVXVBi+bK///iJBqEWn4d+s=";
   };
   # Only works with Python 3.3 and newer;
   disabled = pythonOlder "3.3";

From 8088701061742cee560435419e3e996b5c7bf8ea Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 13 Nov 2021 18:11:24 +0100
Subject: [PATCH 21/51] python3Packages.mypy: relax typed_ast constraint

---
 pkgs/development/python-modules/mypy/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/mypy/default.nix b/pkgs/development/python-modules/mypy/default.nix
index dbbcb30ffcec..edc3e3bfdf62 100644
--- a/pkgs/development/python-modules/mypy/default.nix
+++ b/pkgs/development/python-modules/mypy/default.nix
@@ -12,6 +12,12 @@ buildPythonPackage rec {
     sha256 = "069i9qnfanp7dn8df1vspnqb0flvsszzn22v00vj08nzlnd061yd";
   };
 
+  # remove pin with mypy>=0.920
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "typed_ast >= 1.4.0, < 1.5.0" "typed_ast >= 1.4.0, < 2"
+  '';
+
   propagatedBuildInputs = [ typed-ast psutil mypy-extensions typing-extensions ];
 
   # Tests not included in pip package.

From 8a976728e35bf1e8933bc2a48c16adbbd0bdff38 Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Thu, 23 Sep 2021 23:02:15 -0300
Subject: [PATCH 22/51] python39Packages.mypy: 0.812 -> unstable-2021-11-14

Co-authored-by: @jnetod @veehaitch @nbraud @SuperSandro2000
---
 .../python-modules/mypy/default.nix           | 58 ++++++++++++++-----
 1 file changed, 45 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/mypy/default.nix b/pkgs/development/python-modules/mypy/default.nix
index edc3e3bfdf62..99580e2de37d 100644
--- a/pkgs/development/python-modules/mypy/default.nix
+++ b/pkgs/development/python-modules/mypy/default.nix
@@ -1,34 +1,63 @@
-{ lib, stdenv, fetchPypi, buildPythonPackage, typed-ast, psutil, isPy3k
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, buildPythonPackage
 , mypy-extensions
+, python
+, pythonOlder
+, typed-ast
 , typing-extensions
+, tomli
+, types-typed-ast
 }:
+
 buildPythonPackage rec {
   pname = "mypy";
-  version = "0.812";
-  disabled = !isPy3k;
+  version = "unstable-2021-11-14";
+  disabled = pythonOlder "3.6";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "069i9qnfanp7dn8df1vspnqb0flvsszzn22v00vj08nzlnd061yd";
+  src = fetchFromGitHub {
+    owner = "python";
+    repo = "mypy";
+    rev = "053a1beb94ee4e5b3260725594315d1b6776e42f";
+    sha256 = "sha256-q2ntj3y3GgXrw4v+yMvcqWFv4y/6YwunIj3bNzU9CH0=";
   };
 
-  # remove pin with mypy>=0.920
+  patches = [
+    # FIXME: Remove patch after upstream has decided the proper solution.
+    #        https://github.com/python/mypy/pull/11143
+    (fetchpatch {
+      url = "https://github.com/python/mypy/commit/f1755259d54330cd087cae763cd5bbbff26e3e8a.patch";
+      sha256 = "sha256-5gPahX2X6+/qUaqDQIGJGvh9lQ2EDtks2cpQutgbOHk=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "typed_ast >= 1.4.0, < 1.5.0" "typed_ast >= 1.4.0, < 2"
+      --replace "tomli>=1.1.0,<1.2.0" "tomli"
   '';
 
-  propagatedBuildInputs = [ typed-ast psutil mypy-extensions typing-extensions ];
+  buildInputs = [
+    types-typed-ast
+  ];
+
+  propagatedBuildInputs = [
+    mypy-extensions
+    tomli
+    typed-ast
+    typing-extensions
+  ];
 
   # Tests not included in pip package.
   doCheck = false;
 
   pythonImportsCheck = [
     "mypy"
-    "mypy.types"
     "mypy.api"
     "mypy.fastparse"
     "mypy.report"
+    "mypy.types"
     "mypyc"
     "mypyc.analysis"
   ];
@@ -38,10 +67,13 @@ buildPythonPackage rec {
   # is64bit: unfortunately the build would exhaust all possible memory on i686-linux.
   MYPY_USE_MYPYC = stdenv.buildPlatform.is64bit;
 
+  # when testing reduce optimisation level to drastically reduce build time
+  MYPYC_OPT_LEVEL = 1;
+
   meta = with lib; {
     description = "Optional static typing for Python";
-    homepage    = "http://www.mypy-lang.org";
-    license     = licenses.mit;
-    maintainers = with maintainers; [ martingms lnl7 ];
+    homepage = "http://www.mypy-lang.org";
+    license = licenses.mit;
+    maintainers = with maintainers; [ martingms lnl7 SuperSandro2000 ];
   };
 }

From 5f2f409a2649da5b011ae8e490fe023657384bcb Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Tue, 5 Oct 2021 11:43:12 -0300
Subject: [PATCH 23/51] python39Packages.types-typed-ast: init 1.4.4

Co-authored-by: @jnetod @veehaitch @nbraud
---
 .../types-typed-ast/default.nix               | 26 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 28 insertions(+)
 create mode 100644 pkgs/development/python-modules/types-typed-ast/default.nix

diff --git a/pkgs/development/python-modules/types-typed-ast/default.nix b/pkgs/development/python-modules/types-typed-ast/default.nix
new file mode 100644
index 000000000000..2ba006b578c4
--- /dev/null
+++ b/pkgs/development/python-modules/types-typed-ast/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "types-typed-ast";
+  version = "1.4.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "ffa0471e0ba19c4ea0cba0436d660871b5f5215854ea9ead3cb5b60f525af75a";
+  };
+
+  # Module doesn't have tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "typed_ast-stubs" ];
+
+  meta = with lib; {
+    description = "Typing stubs for typed-ast";
+    homepage = "https://github.com/python/typeshed";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ superherointj veehaitch ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 10f51ae57722..791638675d27 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9534,6 +9534,8 @@ in {
 
   types-toml = callPackage ../development/python-modules/types-toml { };
 
+  types-typed-ast = callPackage ../development/python-modules/types-typed-ast { };
+
   typesentry = callPackage ../development/python-modules/typesentry { };
 
   typesystem = callPackage ../development/python-modules/typesystem { };

From a5691cfc9a577ebfa05b7b5c847db5f41de052c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 15 Nov 2021 00:35:59 +0100
Subject: [PATCH 24/51] python39Packages.mypy_extensions: little cleanup, add
 SuperSandro2000 as maintainer

---
 pkgs/development/python-modules/mypy/extensions.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/mypy/extensions.nix b/pkgs/development/python-modules/mypy/extensions.nix
index 5992a6815d8e..e62fa4230fff 100644
--- a/pkgs/development/python-modules/mypy/extensions.nix
+++ b/pkgs/development/python-modules/mypy/extensions.nix
@@ -13,12 +13,12 @@ buildPythonPackage rec {
     sha256 = "2d82818f5bb3e369420cb3c4060a7970edba416647068eb4c5343488a6c604a8";
   };
 
-  propagatedBuildInputs = if pythonOlder "3.5" then [ typing ] else [ ];
+  propagatedBuildInputs = lib.optional (pythonOlder "3.5") typing;
 
   meta = with lib; {
     description = "Experimental type system extensions for programs checked with the mypy typechecker";
-    homepage    = "http://www.mypy-lang.org";
-    license     = licenses.mit;
-    maintainers = with maintainers; [ martingms lnl7 ];
+    homepage = "http://www.mypy-lang.org";
+    license = licenses.mit;
+    maintainers = with maintainers; [ martingms lnl7 SuperSandro2000 ];
   };
 }

From ffb5403eb6a43989227feda2e3d9b713d2519da7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 15 Nov 2021 00:36:21 +0100
Subject: [PATCH 25/51] python39Packages.tomli: 1.2.1 -> 1.2.2, patch type
 error which occurs with mypy

---
 .../python-modules/tomli/default.nix          |  9 ++++++--
 .../fix-backwards-compatibility-load.patch    | 21 +++++++++++++++++++
 2 files changed, 28 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/development/python-modules/tomli/fix-backwards-compatibility-load.patch

diff --git a/pkgs/development/python-modules/tomli/default.nix b/pkgs/development/python-modules/tomli/default.nix
index 19a0fe6135e5..c593e1e4cb19 100644
--- a/pkgs/development/python-modules/tomli/default.nix
+++ b/pkgs/development/python-modules/tomli/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "tomli";
-  version = "1.2.1";
+  version = "1.2.2";
   format = "pyproject";
 
   outputs = [
@@ -19,9 +19,14 @@ buildPythonPackage rec {
     owner = "hukkin";
     repo = pname;
     rev = version;
-    sha256 = "sha256-30AQ9MQmclcjl1d83mIoxFXzaJn1OFKQlVxayqC5NxY=";
+    sha256 = "sha256-oDjpNzWxTaCC1+WyBKrkR6kp90ZomcZQfyW+xKddDoM=";
   };
 
+  patches = [
+    # required for mypy
+    ./fix-backwards-compatibility-load.patch
+  ];
+
   nativeBuildInputs = [ flit-core ];
 
   postInstall = ''
diff --git a/pkgs/development/python-modules/tomli/fix-backwards-compatibility-load.patch b/pkgs/development/python-modules/tomli/fix-backwards-compatibility-load.patch
new file mode 100644
index 000000000000..edfc2f383495
--- /dev/null
+++ b/pkgs/development/python-modules/tomli/fix-backwards-compatibility-load.patch
@@ -0,0 +1,21 @@
+diff --git a/tomli/_parser.py b/tomli/_parser.py
+index 89e81c3..6fb1bfd 100644
+--- a/tomli/_parser.py
++++ b/tomli/_parser.py
+@@ -1,6 +1,6 @@
+ import string
+ from types import MappingProxyType
+-from typing import Any, BinaryIO, Dict, FrozenSet, Iterable, NamedTuple, Optional, Tuple
++from typing import IO, Union, Any, BinaryIO, Dict, FrozenSet, Iterable, NamedTuple, Optional, Tuple
+ import warnings
+ 
+ from tomli._re import (
+@@ -48,7 +48,7 @@ class TOMLDecodeError(ValueError):
+     """An error raised if a document is not valid TOML."""
+ 
+ 
+-def load(fp: BinaryIO, *, parse_float: ParseFloat = float) -> Dict[str, Any]:
++def load(fp: Union[IO, BinaryIO], *, parse_float: ParseFloat = float) -> Dict[str, Any]:
+     """Parse TOML from a binary file object."""
+     s_bytes = fp.read()
+     try:

From 8bd7e5c1624ef006786aa763892778c027d25266 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 15 Nov 2021 00:37:50 +0100
Subject: [PATCH 26/51] python39Packages.types-typed-ast: 1.4.4 -> 1.5.0

---
 pkgs/development/python-modules/types-typed-ast/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/types-typed-ast/default.nix b/pkgs/development/python-modules/types-typed-ast/default.nix
index 2ba006b578c4..7c2c7f66a246 100644
--- a/pkgs/development/python-modules/types-typed-ast/default.nix
+++ b/pkgs/development/python-modules/types-typed-ast/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "types-typed-ast";
-  version = "1.4.4";
+  version = "1.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ffa0471e0ba19c4ea0cba0436d660871b5f5215854ea9ead3cb5b60f525af75a";
+    sha256 = "sha256-2Op5y/vFIL6Nm8jeSHL0SzQtvbwJFmfi8hsDu9eWkVA=";
   };
 
   # Module doesn't have tests
@@ -21,6 +21,6 @@ buildPythonPackage rec {
     description = "Typing stubs for typed-ast";
     homepage = "https://github.com/python/typeshed";
     license = licenses.asl20;
-    maintainers = with maintainers; [ superherointj veehaitch ];
+    maintainers = with maintainers; [ SuperSandro2000 veehaitch ];
   };
 }

From 08e86542c4a9e748889e7fe61b2053e9ef34522f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 15 Nov 2021 01:47:15 +0100
Subject: [PATCH 27/51] python39Packages.typed-ast: add SuperSandro2000 as
 maintainer, minor cleanup

---
 pkgs/development/python-modules/typed-ast/default.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/typed-ast/default.nix b/pkgs/development/python-modules/typed-ast/default.nix
index 9c7a3c355320..05ef879b3e41 100644
--- a/pkgs/development/python-modules/typed-ast/default.nix
+++ b/pkgs/development/python-modules/typed-ast/default.nix
@@ -1,15 +1,16 @@
 { buildPythonPackage, fetchFromGitHub, lib, pythonOlder, pytest }:
+
 buildPythonPackage rec {
   pname = "typed-ast";
   version = "1.5.0";
+  disabled = pythonOlder "3.3";
+
   src = fetchFromGitHub {
     owner = "python";
     repo = "typed_ast";
     rev = version;
     sha256 = "sha256-z3l5gMG1Jp6EI7SnGn5ABVXVBi+bK///iJBqEWn4d+s=";
   };
-  # Only works with Python 3.3 and newer;
-  disabled = pythonOlder "3.3";
 
   pythonImportsCheck = [
     "typed_ast"
@@ -21,6 +22,7 @@ buildPythonPackage rec {
   checkInputs = [
     pytest
   ];
+
   checkPhase = ''
     runHook preCheck
 
@@ -32,9 +34,10 @@ buildPythonPackage rec {
     runHook postCheck
   '';
 
-  meta = {
+  meta = with lib; {
     homepage = "https://github.com/python/typed_ast";
     description = "Python 2 and 3 ast modules with type comment support";
-    license = lib.licenses.asl20;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
 }

From 8401031f6b536da462c0645fc10ed84ef451be26 Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Thu, 7 Oct 2021 00:45:02 -0300
Subject: [PATCH 28/51] hydra-check: include types for mypy

---
 pkgs/development/python-modules/hydra-check/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/hydra-check/default.nix b/pkgs/development/python-modules/hydra-check/default.nix
index 458363713db2..48833d77e8bf 100644
--- a/pkgs/development/python-modules/hydra-check/default.nix
+++ b/pkgs/development/python-modules/hydra-check/default.nix
@@ -6,6 +6,7 @@
 , requests
 , beautifulsoup4
 , mypy
+, types-requests
 }:
 
 buildPythonPackage rec {
@@ -26,14 +27,17 @@ buildPythonPackage rec {
     beautifulsoup4
   ];
 
-  checkInputs = [ mypy ];
+  checkInputs = [
+    mypy
+    types-requests
+  ];
 
   checkPhase = ''
     echo -e "\x1b[32m## run mypy\x1b[0m"
     mypy hydracheck
   '';
 
-  meta = with lib;{
+  meta = with lib; {
     description = "check hydra for the build status of a package";
     homepage = "https://github.com/nix-community/hydra-check";
     license = licenses.mit;

From b6e1eeb9e4cdf71d89439215bf0a61c7a37ba33a Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Thu, 7 Oct 2021 21:03:52 -0300
Subject: [PATCH 29/51] python3Packages.pylsp_mypy: disable test
 test_multiple_workspaces

---
 pkgs/development/python-modules/pylsp-mypy/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/pylsp-mypy/default.nix b/pkgs/development/python-modules/pylsp-mypy/default.nix
index a7d13bb32a2f..e1d7ddff298d 100644
--- a/pkgs/development/python-modules/pylsp-mypy/default.nix
+++ b/pkgs/development/python-modules/pylsp-mypy/default.nix
@@ -20,10 +20,16 @@ buildPythonPackage rec {
     sha256 = "1d119csj1k5m9j0f7wdvpvnd02h548css6ybxqah92nk2v0rjscr";
   };
 
+  disabledTests = [
+    "test_multiple_workspaces"
+  ];
+
   checkInputs = [ pytestCheckHook mock ];
 
   propagatedBuildInputs = [ mypy python-lsp-server ];
 
+  pythonImportsCheck = [ "pylsp_mypy" ];
+
   meta = with lib; {
     homepage = "https://github.com/Richardk2n/pylsp-mypy";
     description = "Mypy plugin for the Python LSP Server";

From 8af91e5588a9ecbe9e39d4a1d6c50ee9d1847d6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 18 Nov 2021 14:14:10 +0100
Subject: [PATCH 30/51] python39Packages.python-language-server: mark broken

---
 .../python-modules/python-language-server/default.nix           | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/python-language-server/default.nix b/pkgs/development/python-modules/python-language-server/default.nix
index f022eba58571..a201633e0633 100644
--- a/pkgs/development/python-modules/python-language-server/default.nix
+++ b/pkgs/development/python-modules/python-language-server/default.nix
@@ -84,6 +84,8 @@ buildPythonPackage rec {
     homepage = "https://github.com/palantir/python-language-server";
     description = "An implementation of the Language Server Protocol for Python";
     license = licenses.mit;
+    # not compatible with jedi 0.18.0
+    broken = true;
     maintainers = [ ];
   };
 }

From fc598f2681440e4bd8a42efe7570f5c7cf2bfdeb Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 18 Nov 2021 14:57:57 +0100
Subject: [PATCH 31/51] libnftnl: 1.2.0 -> 1.2.1

---
 pkgs/development/libraries/libnftnl/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/libnftnl/default.nix b/pkgs/development/libraries/libnftnl/default.nix
index 276ee52ed54d..2c351181ee22 100644
--- a/pkgs/development/libraries/libnftnl/default.nix
+++ b/pkgs/development/libraries/libnftnl/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, pkg-config, libmnl }:
 
 stdenv.mkDerivation rec {
-  version = "1.2.0";
+  version = "1.2.1";
   pname = "libnftnl";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
-    sha256 = "1xblq1cbcxhr6qmjpy98i1qdza148idgz99vbhjc7s4vzvfizc4h";
+    sha256 = "0z4khm2mnys9mcl8ckwf19cw20jgrv8650nfncy3xcgs2k2aa23m";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -17,6 +17,6 @@ stdenv.mkDerivation rec {
     homepage = "http://netfilter.org/projects/libnftnl";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [ fpletz ajs124 ];
   };
 }

From 9ee913d6c24cc53215ed34fb3d1a5dcf956704f8 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 18 Nov 2021 14:59:11 +0100
Subject: [PATCH 32/51] libnetfilter_log: 1.0.1 -> 1.0.2

---
 pkgs/development/libraries/libnetfilter_log/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libnetfilter_log/default.nix b/pkgs/development/libraries/libnetfilter_log/default.nix
index 4ac20cf29cb4..aadc3d92b597 100644
--- a/pkgs/development/libraries/libnetfilter_log/default.nix
+++ b/pkgs/development/libraries/libnetfilter_log/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libnetfilter_log";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/libnetfilter_log/files/${pname}-${version}.tar.bz2";
-    sha256 = "089vjcfxl5qjqpswrbgklf4wflh44irmw6sk2k0kmfixfmszxq3l";
+    sha256 = "1spy9xs41v76kid5ana8n126f3mvgq6fjibbfbj4kn0larbhix73";
   };
 
   buildInputs = [ libmnl ];

From 740155f9e4989bb2ce52012d7cb32c5d4250cdce Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 18 Nov 2021 14:58:15 +0100
Subject: [PATCH 33/51] nftables: 1.0.0 -> 1.0.1

---
 pkgs/os-specific/linux/nftables/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index ebca6b2623c6..0b6291226bc8 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -10,12 +10,12 @@
 with lib;
 
 stdenv.mkDerivation rec {
-  version = "1.0.0";
+  version = "1.0.1";
   pname = "nftables";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/nftables/files/${pname}-${version}.tar.bz2";
-    sha256 = "1x25zs2czmn14mmq1nqi4zibsvh04vqjbx5lxj42nylnmxym9gsq";
+    sha256 = "08x4xw0s5sap3q7jfr91v7mrkxrydi4dvsckw85ims0qb1ibmviw";
   };
 
   nativeBuildInputs = [
@@ -35,6 +35,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--with-json"
+    "--with-cli=readline"  # TODO: maybe switch to editline
   ] ++ optional (!withDebugSymbols) "--disable-debug"
     ++ optional (!withPython) "--disable-python"
     ++ optional withPython "--enable-python"
@@ -45,6 +46,6 @@ stdenv.mkDerivation rec {
     homepage = "https://netfilter.org/projects/nftables/";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ izorkin ];
+    maintainers = with maintainers; [ izorkin ajs124 ];
   };
 }

From cf3013b4c0df4e01ea761d2fa2c6b69a38f9a5a4 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Wed, 17 Nov 2021 00:56:36 +0100
Subject: [PATCH 34/51] p11-kit: add Fedora/RHEL trust store path

Fedora and RHEL use a different location for the trust store, compared
to other distros. Without this, validation of the CA root certificates
fails in all nss applications.
---
 pkgs/development/libraries/p11-kit/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index 4ddc01ee6b2b..34a3788d7860 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -31,7 +31,11 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"
-    "--with-trust-paths=/etc/ssl/trust-source:/etc/ssl/certs/ca-certificates.crt"
+    "--with-trust-paths=${lib.concatStringsSep ":" [
+      "/etc/ssl/trust-source"               # p11-kit trust source
+      "/etc/ssl/certs/ca-certificates.crt"  # NixOS + Debian/Ubuntu/Arch/Gentoo...
+      "/etc/pki/tls/certs/ca-bundle.crt"    # Fedora/CentOS
+    ]}"
   ];
 
   enableParallelBuilding = true;

From 6f3b6a2fea3278a91c120e67802b54a5823912d0 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Wed, 17 Nov 2021 23:50:53 +0100
Subject: [PATCH 35/51] gnutls: enable p11-kit by default

GnuTLS has a single hard-coded location for the system trust store,
currently set to the path used by NixOS, Debian, Arch, Gentoo, etc.
Since not all distributions use the same path, notably Fedora and RHEL,
the certificate validation will break on some non-NixOS system.

This can be solved by enabling the p11-kit integration, so that by
default p11-kit (properly configured for all major distos) will provide
GnuTLS with the CA roots though the PKCS #11 API.
---
 pkgs/development/libraries/gnutls/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index ace18afdeed8..0d39abe1ac3c 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -51,8 +51,10 @@ stdenv.mkDerivation rec {
 
   preConfigure = "patchShebangs .";
   configureFlags =
-    lib.optional stdenv.isLinux "--with-default-trust-store-file=/etc/ssl/certs/ca-certificates.crt"
-  ++ [
+    lib.optionals stdenv.isLinux [
+    "--with-default-trust-store-file=/etc/ssl/certs/ca-certificates.crt"
+    "--with-default-trust-store-pkcs11=pkcs11:"
+  ] ++ [
     "--disable-dependency-tracking"
     "--enable-fast-install"
     "--with-unbound-root-key-file=${dns-root-data}/root.key"

From a19b4efc77b76d5c66edb31e2ae285f5c1c3ca17 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Thu, 18 Nov 2021 22:19:46 +0100
Subject: [PATCH 36/51] nixos/tests/custom-ca: fix firefox test

- allocate more memory (yay!)
- fix processes not being really killed
- fix firefox process hanging
- remove the p11-kit log: it's not really useful
---
 nixos/tests/custom-ca.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/nixos/tests/custom-ca.nix b/nixos/tests/custom-ca.nix
index 4480519c7edc..6ed3510dd2cc 100644
--- a/nixos/tests/custom-ca.nix
+++ b/nixos/tests/custom-ca.nix
@@ -82,7 +82,7 @@ in
       # chromium-based browsers refuse to run as root
       test-support.displayManager.auto.user = "alice";
       # browsers may hang with the default memory
-      virtualisation.memorySize = 500;
+      virtualisation.memorySize = 600;
 
       networking.hosts."127.0.0.1" = [ "good.example.com" "bad.example.com" ];
       security.pki.certificateFiles = [ "${example-good-cert}/ca.crt" ];
@@ -162,7 +162,7 @@ in
         browser = command.split()[0]
         with subtest("Good certificate is trusted in " + browser):
             execute_as(
-                "alice", f"env P11_KIT_DEBUG=trust {command} https://good.example.com & >&2"
+                "alice", f"{command} https://good.example.com >&2 &"
             )
             wait_for_window_as("alice", browser)
             machine.wait_for_text("It works!")
@@ -170,9 +170,9 @@ in
             execute_as("alice", "xdotool key ctrl+w")  # close tab
 
         with subtest("Unknown CA is untrusted in " + browser):
-            execute_as("alice", f"{command} https://bad.example.com & >&2")
+            execute_as("alice", f"{command} https://bad.example.com >&2 &")
             machine.wait_for_text(error)
             machine.screenshot("bad" + browser)
-            machine.succeed("pkill " + browser)
+            machine.succeed("pkill -f " + browser)
   '';
 })

From 49a2392306e6e4f4f13dd6f8887e20c252e82df9 Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Fri, 19 Nov 2021 01:03:22 -0800
Subject: [PATCH 37/51] gengetopt: disable parallelism

Test suite is not thread safe.
---
 pkgs/development/tools/misc/gengetopt/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/tools/misc/gengetopt/default.nix b/pkgs/development/tools/misc/gengetopt/default.nix
index 2c09f925d3d8..d24d4b66d66c 100644
--- a/pkgs/development/tools/misc/gengetopt/default.nix
+++ b/pkgs/development/tools/misc/gengetopt/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
     rm tests/test_conf_parser_save.sh
   '';
 
-  enableParallelBuilding = true;
+  # test suite is not thread safe
+  enableParallelBuilding = false;
 
   nativeBuildInputs = [ texinfo help2man ];
 

From fad0d94ce86ad01d96f2c5768d18ab8bf3013a75 Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Fri, 19 Nov 2021 09:07:53 -0800
Subject: [PATCH 38/51] Revert "python39Packages.python-language-server: mark
 broken"

This reverts commit 8af91e5588a9ecbe9e39d4a1d6c50ee9d1847d6a.
---
 .../python-modules/python-language-server/default.nix           | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-language-server/default.nix b/pkgs/development/python-modules/python-language-server/default.nix
index d85a2b7136ce..e0de396b7c76 100644
--- a/pkgs/development/python-modules/python-language-server/default.nix
+++ b/pkgs/development/python-modules/python-language-server/default.nix
@@ -85,8 +85,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/palantir/python-language-server";
     description = "An implementation of the Language Server Protocol for Python";
     license = licenses.mit;
-    # not compatible with jedi 0.18.0
-    broken = true;
     maintainers = [ ];
     # no longer maintained
     # see https://github.com/palantir/python-language-server/pull/918#issuecomment-817361554

From f91691f6a88b73866cad1dc70948dc4c8de8833b Mon Sep 17 00:00:00 2001
From: Julien Moutinho <ju1m@users.noreply.github.com>
Date: Fri, 19 Nov 2021 19:46:17 +0100
Subject: [PATCH 39/51] bash: update patches (#146463)

---
 pkgs/shells/bash/bash-5.1-patches.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/shells/bash/bash-5.1-patches.nix b/pkgs/shells/bash/bash-5.1-patches.nix
index aa5ad75fbc70..e6e9461bcbef 100644
--- a/pkgs/shells/bash/bash-5.1-patches.nix
+++ b/pkgs/shells/bash/bash-5.1-patches.nix
@@ -9,4 +9,8 @@ patch: [
 (patch "006" "051x8wlwrqk0yr0zg378vh824iklfl5g9pkmcdf62qp8gn9pvqbm")
 (patch "007" "0fir80pp1gmlpadmqcgkrv4y119pc7xllchjzg05fd7px73viz5c")
 (patch "008" "1lfjgshk8i9vch92p5wgc9r90j3phw79aa7gbai89w183b2z6b7j")
+(patch "009" "1vn36dzd9g4y1h3jiss6418crla0rbcd0d6wwsyv9d5l7aaxlp74")
+(patch "010" "0amfmvbzsand7bdypylkjdpcp88fa3cplfshn7vyzv2ff2rdgj52")
+(patch "011" "0yq24abb4fzfxqnwl20b330sxl9lr9ds0nc4yi30f81l94b1y6aq")
+(patch "012" "165bff97ffih49vfs4mkr5w3z5gn1w6zfyrf773iajkw6v48kw8h")
 ]

From 65855071f2bb87a6249dc317b983c399cfbfd38f Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Fri, 19 Nov 2021 18:45:11 -0800
Subject: [PATCH 40/51] rhash: apply clang patch unconditionally

The patch will be included in the next release and is safe to apply
unconditionally.
Cleanup after 2d2d4722739
---
 pkgs/tools/security/rhash/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/tools/security/rhash/default.nix b/pkgs/tools/security/rhash/default.nix
index 7177b1891f2d..e82052d961b8 100644
--- a/pkgs/tools/security/rhash/default.nix
+++ b/pkgs/tools/security/rhash/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-HkDgWwHoRWCNtWyfP4sj3veEd+KT5J7yL4J4Z/hJcrE=";
   };
 
-  patches = lib.optionals stdenv.cc.isClang [
+  patches = [
     # Fix clang configuration; remove with next release
     (fetchpatch {
       url = "https://github.com/rhash/RHash/commit/4dc506066cf1727b021e6352535a8bb315c3f8dc.patch";

From dd8ad828de283d4bb71fe67689581989549f8421 Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Sat, 20 Nov 2021 14:28:46 -0800
Subject: [PATCH 41/51] llvmPackages_{13,git}.clang: build clang-tools-extra

This is already done for previous versions of clang which use
a release tarball, but must be done differently for the more
recent versions which use fetchFromGitHub.

Fixes clang-tools clangd wrapper
---
 pkgs/development/compilers/llvm/13/clang/default.nix  | 2 ++
 pkgs/development/compilers/llvm/git/clang/default.nix | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/pkgs/development/compilers/llvm/13/clang/default.nix b/pkgs/development/compilers/llvm/13/clang/default.nix
index 78c2831a2f35..a775af3031b7 100644
--- a/pkgs/development/compilers/llvm/13/clang/default.nix
+++ b/pkgs/development/compilers/llvm/13/clang/default.nix
@@ -44,6 +44,8 @@ let
     ];
 
     postPatch = ''
+      (cd tools && ln -s ../../clang-tools-extra extra)
+
       sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
              -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
              lib/Driver/ToolChains/*.cpp
diff --git a/pkgs/development/compilers/llvm/git/clang/default.nix b/pkgs/development/compilers/llvm/git/clang/default.nix
index 78c2831a2f35..a775af3031b7 100644
--- a/pkgs/development/compilers/llvm/git/clang/default.nix
+++ b/pkgs/development/compilers/llvm/git/clang/default.nix
@@ -44,6 +44,8 @@ let
     ];
 
     postPatch = ''
+      (cd tools && ln -s ../../clang-tools-extra extra)
+
       sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
              -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
              lib/Driver/ToolChains/*.cpp

From e9dfe892ef40e6b6f34effb8c93aff7eaf80e14a Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 10 Sep 2021 13:57:11 +0100
Subject: [PATCH 42/51] llvm_{5..11}: pull upstream build fix for for gcc-12

Without the fix build fails on gcc-12 as:

    /build/llvm/lib/Target/NVPTX/NVPTXAsmPrinter.cpp:
      In member function 'std::string llvm::NVPTXAsmPrinter::getPTXFundamentalTypeStr(...':
    /build/llvm/lib/Target/NVPTX/NVPTXAsmPrinter.cpp:1319:10:
      error: use of deleted function 'std::__cxx11::basic_string<...>; std::nullptr_t = std::nullptr_t]'
     1319 |   return nullptr;
          |          ^~~~~~~

The patch is present in upstream releases since llvm-12.
---
 .../compilers/llvm/10/llvm/default.nix        | 14 +++++++++++++
 .../compilers/llvm/11/llvm/default.nix        | 20 +++++++++++++++++++
 .../compilers/llvm/5/llvm/default.nix         |  8 ++++++++
 .../compilers/llvm/6/llvm/default.nix         |  8 ++++++++
 .../compilers/llvm/7/llvm/default.nix         |  8 ++++++++
 .../compilers/llvm/8/llvm/default.nix         |  8 ++++++++
 .../compilers/llvm/9/llvm/default.nix         |  8 ++++++++
 7 files changed, 74 insertions(+)

diff --git a/pkgs/development/compilers/llvm/10/llvm/default.nix b/pkgs/development/compilers/llvm/10/llvm/default.nix
index 4e590dba4337..30a2d016d67c 100644
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@@ -73,6 +73,20 @@ in stdenv.mkDerivation (rec {
       sha256 = "0nh123kld0dgz2h941lng331dkj3wbm5lfxm375k1f569gv83hlk";
       stripLen = 1;
     })
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
+    (fetchpatch {
+      name = "dfaemitter-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/0841916e87a39e3c223c986e8da31e4a9a1432e3.patch";
+      sha256 = "1kckghvsngs51mqm82asy0s9vr19h8aqbw43a0w44mccqw6bzrwf";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/11/llvm/default.nix b/pkgs/development/compilers/llvm/11/llvm/default.nix
index f0148850dbe8..81ac4cb1ed08 100644
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@@ -65,6 +65,26 @@ in stdenv.mkDerivation (rec {
       sha256 = "sha256:12s8vr6ibri8b48h2z38f3afhwam10arfiqfy4yg37bmc054p5hi";
       stripLen = 1;
     })
+    # gcc-11 compat upstream patch
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/b498303066a63a203d24f739b2d2e0e56dca70d1.patch";
+      sha256 = "sha256:0nh123kld0dgz2h941lng331dkj3wbm5lfxm375k1f569gv83hlk";
+      stripLen = 1;
+    })
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
+    (fetchpatch {
+      name = "dfaemitter-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/0841916e87a39e3c223c986e8da31e4a9a1432e3.patch";
+      sha256 = "1kckghvsngs51mqm82asy0s9vr19h8aqbw43a0w44mccqw6bzrwf";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/5/llvm/default.nix b/pkgs/development/compilers/llvm/5/llvm/default.nix
index 6388cd65fbf4..fa99e275a623 100644
--- a/pkgs/development/compilers/llvm/5/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/5/llvm/default.nix
@@ -66,6 +66,14 @@ stdenv.mkDerivation ({
     #  stripLen = 1;
     #})
     ./gnu-install-dirs.patch
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/6/llvm/default.nix b/pkgs/development/compilers/llvm/6/llvm/default.nix
index 0907c8956171..5925fab104fa 100644
--- a/pkgs/development/compilers/llvm/6/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/6/llvm/default.nix
@@ -64,6 +64,14 @@ stdenv.mkDerivation ({
       sha256 = "0fxgrxmfnjx17w3lcq19rk68b2xksh1bynz3ina784kma7hp4wdb";
     })
     ./gnu-install-dirs.patch
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/7/llvm/default.nix b/pkgs/development/compilers/llvm/7/llvm/default.nix
index 4a9b4f518205..e4410bedf917 100644
--- a/pkgs/development/compilers/llvm/7/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/7/llvm/default.nix
@@ -68,6 +68,14 @@ in stdenv.mkDerivation ({
       sha256 = "0k6k1p5yisgwx417a67s7sr9930rqh1n0zv5jvply8vjjy4b3kf8";
     })
     ./gnu-install-dirs.patch
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/8/llvm/default.nix b/pkgs/development/compilers/llvm/8/llvm/default.nix
index 83b779b56d82..8bb2293f8189 100644
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@@ -71,6 +71,14 @@ in stdenv.mkDerivation ({
       sha256 = "0nh123kld0dgz2h941lng331dkj3wbm5lfxm375k1f569gv83hlk";
       stripLen = 1;
     })
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/9/llvm/default.nix b/pkgs/development/compilers/llvm/9/llvm/default.nix
index 570795824ee5..f8c474775e48 100644
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@@ -69,6 +69,14 @@ in stdenv.mkDerivation (rec {
       sha256 = "0nh123kld0dgz2h941lng331dkj3wbm5lfxm375k1f569gv83hlk";
       stripLen = 1;
     })
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''

From ae3ffded45243a77e0580845f293d17bd65e41d1 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Wed, 10 Nov 2021 22:23:52 +0000
Subject: [PATCH 43/51] pkgsMusl.valgrind-light: fix build

We need to add autoreconfHook because the patch modifies configure.ac.
---
 .../tools/analysis/valgrind/default.nix        | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/analysis/valgrind/default.nix b/pkgs/development/tools/analysis/valgrind/default.nix
index 341aba8e00b5..6e736df235f0 100644
--- a/pkgs/development/tools/analysis/valgrind/default.nix
+++ b/pkgs/development/tools/analysis/valgrind/default.nix
@@ -1,4 +1,7 @@
-{ lib, stdenv, fetchurl, perl, gdb, cctools, xnu, bootstrap_cmds }:
+{ lib, stdenv, fetchurl, fetchpatch
+, autoreconfHook, perl
+, gdb, cctools, xnu, bootstrap_cmds
+}:
 
 stdenv.mkDerivation rec {
   pname = "valgrind";
@@ -9,16 +12,25 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-AIWaoTp3Lt33giIl9LRu4NOa++Bx0yd42k2ZmECB9/U=";
   };
 
+  patches = [
+    # Fix tests on Musl.
+    # https://bugs.kde.org/show_bug.cgi?id=445300
+    (fetchpatch {
+      url = "https://bugsfiles.kde.org/attachment.cgi?id=143535";
+      sha256 = "036zyk30rixjvpylw3c7n171n4gpn6zcp7h6ya2dz4h5r478l9i6";
+    })
+  ];
+
   outputs = [ "out" "dev" "man" "doc" ];
 
-  hardeningDisable = [ "stackprotector" ];
+  hardeningDisable = [ "pie" "stackprotector" ];
 
   # GDB is needed to provide a sane default for `--db-command'.
   # Perl is needed for `callgrind_{annotate,control}'.
   buildInputs = [ gdb perl ]  ++ lib.optionals (stdenv.isDarwin) [ bootstrap_cmds xnu ];
 
   # Perl is also a native build input.
-  nativeBuildInputs = [ perl ];
+  nativeBuildInputs = [ autoreconfHook perl ];
 
   enableParallelBuilding = true;
   separateDebugInfo = stdenv.isLinux;

From 20fd3b100215364e6d88cf5a6becc91827ad0a73 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 12 Nov 2021 09:21:33 +0000
Subject: [PATCH 44/51] setools: 4.3.0 -> 4.4.0

---
 pkgs/os-specific/linux/setools/default.nix | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/pkgs/os-specific/linux/setools/default.nix b/pkgs/os-specific/linux/setools/default.nix
index 842a525353d4..9d547d2007ec 100644
--- a/pkgs/os-specific/linux/setools/default.nix
+++ b/pkgs/os-specific/linux/setools/default.nix
@@ -1,6 +1,5 @@
 { lib, fetchFromGitHub, python3
 , libsepol, libselinux, checkpolicy
-, fetchpatch
 , withGraphics ? false
 }:
 
@@ -9,22 +8,15 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "setools";
-  version = "4.3.0";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "SELinuxProject";
     repo = pname;
     rev = version;
-    sha256 = "0vr20bi8w147z5lclqz1l0j1b34137zg2r04pkafkgqqk7qbyjk6";
+    sha256 = "1qvd5j6zwq4fmlahg45swjplhif2z89x7s6pnp07gvcp2fbqdsh5";
   };
 
-  patches = [
-    (fetchpatch { # included in 4.4.0
-      url = "https://github.com/SELinuxProject/setools/commit/f1b4a5d375be05fbccedb258c940d771bff8e524.diff";
-      sha256 = "1r38s6i4i6bdr2zdp5wcg1yifpf3pd018c73a511mgynyg7d11xy";
-    })
-  ];
-
   nativeBuildInputs = [ cython ];
   buildInputs = [ libsepol ];
   propagatedBuildInputs = [ enum34 libselinux networkx ]

From 28625f78619e77e48dde0c453f9ed5944f30b3d7 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 12 Nov 2021 09:20:45 +0000
Subject: [PATCH 45/51] selinux: 2.9, 3.0 -> 3.3

These are all released together, so I'm updating them all in a single
commit.
---
 .../os-specific/linux/checkpolicy/default.nix |  8 +++----
 pkgs/os-specific/linux/libselinux/default.nix |  8 +++----
 .../os-specific/linux/libsemanage/default.nix |  8 +++----
 pkgs/os-specific/linux/libsepol/default.nix   | 23 ++++--------------
 .../linux/policycoreutils/default.nix         | 10 ++++----
 .../linux/selinux-python/default.nix          |  9 ++++---
 .../linux/selinux-sandbox/default.nix         |  8 +++----
 .../linux/semodule-utils/default.nix          |  8 +++----
 pkgs/os-specific/linux/sepolgen/default.nix   | 24 -------------------
 pkgs/top-level/aliases.nix                    |  1 +
 pkgs/top-level/all-packages.nix               |  2 --
 11 files changed, 34 insertions(+), 75 deletions(-)
 delete mode 100644 pkgs/os-specific/linux/sepolgen/default.nix

diff --git a/pkgs/os-specific/linux/checkpolicy/default.nix b/pkgs/os-specific/linux/checkpolicy/default.nix
index c3d8928c7ba4..52cf0a3ec037 100644
--- a/pkgs/os-specific/linux/checkpolicy/default.nix
+++ b/pkgs/os-specific/linux/checkpolicy/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "checkpolicy";
-  version = "2.9";
-  inherit (libsepol) se_release se_url;
+  version = "3.3";
+  inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/checkpolicy-${version}.tar.gz";
-    sha256 = "13jz6f8zdrijvn5w1j102b36fs41z0q8ii74axw48cj550mw6im9";
+    url = "${se_url}/${version}/checkpolicy-${version}.tar.gz";
+    sha256 = "118l8c2vvnnckbd269saslr7adv6rdavr5rv0z5vh2m1lgglxj15";
   };
 
   nativeBuildInputs = [ bison flex ];
diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index fcea787ed79c..1e0a29451629 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -9,14 +9,14 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "libselinux";
-  version = "3.0";
-  inherit (libsepol) se_release se_url;
+  version = "3.3";
+  inherit (libsepol) se_url;
 
   outputs = [ "bin" "out" "dev" "man" ] ++ optional enablePython "py";
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/libselinux-${version}.tar.gz";
-    sha256 = "0cr4p0qkr4qd5z1x677vwhz6mlz55kxyijwi2dmrvbhxcw7v78if";
+    url = "${se_url}/${version}/libselinux-${version}.tar.gz";
+    sha256 = "0mvh793g7fg6wb6zqhkdyrv80x6k84ypqwi8ii89c91xcckyxzdc";
   };
 
   nativeBuildInputs = [ pkg-config ] ++ optionals enablePython [ swig python3 ];
diff --git a/pkgs/os-specific/linux/libsemanage/default.nix b/pkgs/os-specific/linux/libsemanage/default.nix
index 0f9f26c8c5b0..d828c38be1d9 100644
--- a/pkgs/os-specific/linux/libsemanage/default.nix
+++ b/pkgs/os-specific/linux/libsemanage/default.nix
@@ -6,12 +6,12 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "libsemanage";
-  version = "2.9";
-  inherit (libsepol) se_release se_url;
+  version = "3.3";
+  inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/libsemanage-${version}.tar.gz";
-    sha256 = "075w6y3l9hiy5hicgwrmijyxmhfyd1r7cnc08qxyg4j46jfk8xi5";
+    url = "${se_url}/${version}/libsemanage-${version}.tar.gz";
+    sha256 = "1s3wb66l47blc15s6lkqs11j9l8pycdqqbb03x3vpfrlz9dfrl44";
    };
 
   outputs = [ "out" "dev" "man" ] ++ optional enablePython "py";
diff --git a/pkgs/os-specific/linux/libsepol/default.nix b/pkgs/os-specific/linux/libsepol/default.nix
index e90c08942096..c1df217944c7 100644
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@@ -2,31 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "libsepol";
-  version = "3.0";
-  se_release = "20191204";
+  version = "3.3";
   se_url = "https://github.com/SELinuxProject/selinux/releases/download";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/libsepol-${version}.tar.gz";
-    sha256 = "0ygb6dh5lng91xs6xiqf5v0nxa68qmjc787p0s5h9w89364f2yjv";
+    url = "${se_url}/${version}/libsepol-${version}.tar.gz";
+    sha256 = "12r39ygn7aa1kz52wibfr4520m0cp75hlrn3i6rnjqa6p0zdz5rd";
   };
 
-  patches = [
-    # upstream build fix against -fno-common compilers like >=gcc-10
-    (fetchpatch {
-      url = "https://github.com/SELinuxProject/selinux/commit/a96e8c59ecac84096d870b42701a504791a8cc8c.patch";
-      sha256 = "0aybv4kzbhx8xq6s82dsh4ib76k59qzh2bgxmk44iq5cjnqn5rd6";
-      stripLen = 1;
-    })
-    (fetchpatch {
-      url = "https://github.com/SELinuxProject/selinux/commit/3d32fc24d6aff360a538c63dad08ca5c957551b0.patch";
-      sha256 = "1mphwdlj4d6mwmsp5xkpf6ci4rxhgbi3fm79d08h4jbzxaf4wny4";
-      stripLen = 1;
-    })
-  ];
-
   postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
     substituteInPlace src/Makefile --replace 'all: $(LIBA) $(LIBSO)' 'all: $(LIBA)'
     sed -i $'/^\t.*LIBSO/d' src/Makefile
@@ -46,7 +31,7 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = "-Wno-error";
 
-  passthru = { inherit se_release se_url; };
+  passthru = { inherit se_url; };
 
   meta = with lib; {
     description = "SELinux binary policy manipulation library";
diff --git a/pkgs/os-specific/linux/policycoreutils/default.nix b/pkgs/os-specific/linux/policycoreutils/default.nix
index 7e2ff29325a8..c066dd4c4c5c 100644
--- a/pkgs/os-specific/linux/policycoreutils/default.nix
+++ b/pkgs/os-specific/linux/policycoreutils/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "policycoreutils";
-  version = "2.9";
-  inherit (libsepol) se_release se_url;
+  version = "3.3";
+  inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/policycoreutils-${version}.tar.gz";
-    sha256 = "0yqg5ws5gbl1cbn8msxdk1c3ilmmx58qg5dx883kqyq0517k8g65";
+    url = "${se_url}/${version}/policycoreutils-${version}.tar.gz";
+    sha256 = "0y0hl32b2ks7r0fhbx3k2j1gqqms5aplyasjs3fz50caxl6096a1";
   };
 
   postPatch = ''
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [
     "PREFIX=$(out)"
-    "SBINDIR=$(out)/sbin"
+    "SBINDIR=$(out)/bin"
     "ETCDIR=$(out)/etc"
     "BASHCOMPLETIONDIR=$out/share/bash-completion/completions"
     "LOCALEDIR=$(out)/share/locale"
diff --git a/pkgs/os-specific/linux/selinux-python/default.nix b/pkgs/os-specific/linux/selinux-python/default.nix
index b6394b3e1f6c..c50f4ffccd0b 100644
--- a/pkgs/os-specific/linux/selinux-python/default.nix
+++ b/pkgs/os-specific/linux/selinux-python/default.nix
@@ -7,13 +7,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "selinux-python";
-  version = "2.9";
+  version = "3.3";
 
-  inherit (libsepol) se_release se_url;
+  inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/selinux-python-${version}.tar.gz";
-    sha256 = "1pjzsyay5535cxcjag7y7k193ajry0s0xc3dqv5905qd7cwval1n";
+    url = "${se_url}/${version}/selinux-python-${version}.tar.gz";
+    sha256 = "1v244hpb45my303793xa4kcn7qnxjgxn4ja7rdn9k1q361hi1nca";
   };
 
   strictDeps = true;
@@ -49,4 +49,3 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
   };
 }
-
diff --git a/pkgs/os-specific/linux/selinux-sandbox/default.nix b/pkgs/os-specific/linux/selinux-sandbox/default.nix
index a10588bacf11..0d2843d216a4 100644
--- a/pkgs/os-specific/linux/selinux-sandbox/default.nix
+++ b/pkgs/os-specific/linux/selinux-sandbox/default.nix
@@ -9,12 +9,12 @@ with python3.pkgs;
 
 stdenv.mkDerivation rec {
   pname = "selinux-sandbox";
-  version = "2.9";
-  inherit (policycoreutils) se_release se_url;
+  version = "3.3";
+  inherit (policycoreutils) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/selinux-sandbox-${version}.tar.gz";
-    sha256 = "0qj20jyi8v1653xdqj5yak3wwbvg5bw8f2jmx8fpahl6y1bmz481";
+    url = "${se_url}/${version}/selinux-sandbox-${version}.tar.gz";
+    sha256 = "0rw8pxfqhl6ww4w31fbf4hi3zilh1n3b1rfjm7ra76mm78wfyylj";
   };
 
   nativeBuildInputs = [ wrapPython ];
diff --git a/pkgs/os-specific/linux/semodule-utils/default.nix b/pkgs/os-specific/linux/semodule-utils/default.nix
index b76e715dbc26..5c8d83c3f82a 100644
--- a/pkgs/os-specific/linux/semodule-utils/default.nix
+++ b/pkgs/os-specific/linux/semodule-utils/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "semodule-utils";
-  version = "2.9";
+  version = "3.3";
 
-  inherit (libsepol) se_release se_url;
+  inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/${pname}-${version}.tar.gz";
-    sha256 = "01yrwnd3calmw6r8kdh8ld7i7fb250n2yqqqk9p0ymrlwsg6g0w0";
+    url = "${se_url}/${version}/${pname}-${version}.tar.gz";
+    sha256 = "0qvhl40a6jlm8p719nnlw2ghlxbh8lxbcsd59azxp884bxgfr61h";
   };
 
   buildInputs = [ libsepol ];
diff --git a/pkgs/os-specific/linux/sepolgen/default.nix b/pkgs/os-specific/linux/sepolgen/default.nix
deleted file mode 100644
index f7ef1cb9c3a7..000000000000
--- a/pkgs/os-specific/linux/sepolgen/default.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ lib, stdenv, fetchurl, libsepol, python }:
-
-stdenv.mkDerivation rec {
-  pname = "sepolgen";
-  version = "1.2.2";
-  inherit (libsepol) se_release se_url;
-
-  src = fetchurl {
-    url = "${se_url}/${se_release}/sepolgen-${version}.tar.gz";
-    sha256 = "09139kspr41zgksayi4dh982p8080lrfl96p4dld51nknbpaigdy";
-  };
-
-  preBuild = ''
-    makeFlagsArray+=("PREFIX=$out")
-    makeFlagsArray+=("DESTDIR=$out")
-    makeFlagsArray+=("PYTHONLIBDIR=lib/${python.libPrefix}/site-packages")
-  '';
-
-  meta = with lib; {
-    inherit (libsepol.meta) homepage platforms maintainers;
-    description = "SELinux policy generation library";
-    license = licenses.gpl2;
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index e0939aafba8c..68f1e3a31254 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -833,6 +833,7 @@ mapAliases ({
   sdlmame = mame; # added 2019-10-30
   seeks = throw "seeks has been removed from nixpkgs, as it was unmaintained"; # added 2020-06-21
   seg3d = throw "seg3d has been removed from nixpkgs (2019-11-10)";
+  sepolgen = throw "sepolgen was merged into selinux-python"; # added 2021-11-11
   shared_mime_info = shared-mime-info; # added 2018-02-25
   skrooge2 = skrooge; # added 2017-02-18
   sky = throw "sky has been removed from nixpkgs (2020-09-16)";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 52d01737783a..cba557e3d968 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -22606,8 +22606,6 @@ with pkgs;
 
   sdrangel = libsForQt5.callPackage ../applications/radio/sdrangel {  };
 
-  sepolgen = callPackage ../os-specific/linux/sepolgen { };
-
   setools = callPackage ../os-specific/linux/setools { };
 
   seturgent = callPackage ../os-specific/linux/seturgent { };

From 27f9348ee7648f87db0c37fdccf087a676d3264f Mon Sep 17 00:00:00 2001
From: panicgh <79252025+panicgh@users.noreply.github.com>
Date: Sun, 21 Nov 2021 21:40:48 +0000
Subject: [PATCH 46/51] wafHook: always enable parallel building (#136641)

Follow the same pattern as used in the cmake setup hook to assume
`enableParallelBuilding=1` when unset by the user. This makes wafHook
honor `NIX_BUILD_CORES`. See #136368 and #136641.
---
 pkgs/development/tools/build-managers/wafHook/setup-hook.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/tools/build-managers/wafHook/setup-hook.sh b/pkgs/development/tools/build-managers/wafHook/setup-hook.sh
index 439350c3abc2..6cea8fcc2ea8 100644
--- a/pkgs/development/tools/build-managers/wafHook/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/wafHook/setup-hook.sh
@@ -21,6 +21,11 @@ wafConfigurePhase() {
     echoCmd 'configure flags' "${flagsArray[@]}"
     python "$wafPath" "${flagsArray[@]}"
 
+    if ! [[ -v enableParallelBuilding ]]; then
+        enableParallelBuilding=1
+        echo "waf: enabled parallel building"
+    fi
+
     runHook postConfigure
 }
 

From 45d6eedec39da64e4e456721ed150374fc1a37d2 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 18 Nov 2021 14:34:17 +0100
Subject: [PATCH 47/51] python3Packages.importlib-metadata: 4.8.1 -> 4.8.2

---
 .../python-modules/importlib-metadata/default.nix | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/importlib-metadata/default.nix b/pkgs/development/python-modules/importlib-metadata/default.nix
index 158f101167e2..e13f73616775 100644
--- a/pkgs/development/python-modules/importlib-metadata/default.nix
+++ b/pkgs/development/python-modules/importlib-metadata/default.nix
@@ -10,16 +10,20 @@
 
 buildPythonPackage rec {
   pname = "importlib-metadata";
-  version = "4.8.1";
+  version = "4.8.2";
+  format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     pname = "importlib_metadata";
     inherit version;
-    sha256 = "sha256-8oSz4RJWrR5dA6uGuyzNb1M5aI/xek15eg/n3zJvI7E=";
+    sha256 = "sha256-db3sFMOX9ShyTBv9lwnWYLM6TS53OHozWPILhIu15fs=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
 
   propagatedBuildInputs = [
     toml
@@ -30,7 +34,10 @@ buildPythonPackage rec {
 
   # Cyclic dependencies due to pyflakefs
   doCheck = false;
-  pythonImportsCheck = [ "importlib_metadata" ];
+
+  pythonImportsCheck = [
+    "importlib_metadata"
+  ];
 
   meta = with lib; {
     description = "Read metadata from Python packages";

From 88e9beea985a8a0c661a213ad1f3558da32b78af Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Mon, 22 Nov 2021 21:51:41 -0800
Subject: [PATCH 48/51] python3Packages.aiohttp-wsgi: disable network test

---
 pkgs/development/python-modules/aiohttp-wsgi/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/aiohttp-wsgi/default.nix b/pkgs/development/python-modules/aiohttp-wsgi/default.nix
index 18364bdce691..ed270cddd981 100644
--- a/pkgs/development/python-modules/aiohttp-wsgi/default.nix
+++ b/pkgs/development/python-modules/aiohttp-wsgi/default.nix
@@ -26,6 +26,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # makes http request to another server
+    "testEnviron"
+  ];
+
   pythonImportsCheck = [ "aiohttp_wsgi" ];
 
   meta = with lib; {

From dfcd49afe25d931432844f057cdc541c0ebe1018 Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Mon, 22 Nov 2021 22:00:05 -0800
Subject: [PATCH 49/51] python3Packages.numpy: remove unneeded patch

Patch was already merged upstream, no longer relevant
---
 pkgs/development/python-modules/numpy/default.nix | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index ce75f42c20ca..fef5dfb163bd 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -50,13 +50,7 @@ in buildPythonPackage rec {
     sha256 = "423216d8afc5923b15df86037c6053bf030d15cc9e3224206ef868c2d63dd6dc";
   };
 
-  patches = [
-    # fix https://github.com/numpy/numpy/issues/19624
-    (fetchpatch {
-      url = "https://github.com/numpy/numpy/commit/ae279066d6bd253e8675428fac8946938b8d48d9.diff";
-      sha256 = "sha256-q8SoF/pMzLI4zYCx2YAZzR31cARlZXerNnBSevBO5pE=";
-    })
-  ] ++ lib.optionals python.hasDistutilsCxxPatch [
+  patches = lib.optionals python.hasDistutilsCxxPatch [
     # We patch cpython/distutils to fix https://bugs.python.org/issue1222585
     # Patching of numpy.distutils is needed to prevent it from undoing the
     # patch to distutils.

From 63a370df6fed838d8850d6d874342c69a91ccf10 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Thu, 25 Nov 2021 23:25:06 +0100
Subject: [PATCH 50/51] mesa: 21.2.5 -> 21.2.6

---
 pkgs/development/libraries/mesa/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 05935e65ea04..a5d41d48629f 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -33,7 +33,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "21.2.5";
+  version = "21.2.6";
   branch  = versions.major version;
 
 self = stdenv.mkDerivation {
@@ -47,7 +47,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "1fxcdf4qs4vmyjcns7jv62w4jy3gr383ar5b7mr77nb0nxgmhjcf";
+    sha256 = "0m69h3f9fr66h6xjxfc485zfdci6kl8j24ab0kx5k23f7kcj4zhy";
   };
 
   # TODO:

From cc8cade9bab34326e9c191782718ae4bf9b3867d Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sun, 14 Nov 2021 09:27:51 +1000
Subject: [PATCH 51/51] go_1_16: 1.16.9 -> 1.16.10

---
 pkgs/development/compilers/go/1.16.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.16.nix b/pkgs/development/compilers/go/1.16.nix
index 433d3f9af7a3..a3368e386123 100644
--- a/pkgs/development/compilers/go/1.16.nix
+++ b/pkgs/development/compilers/go/1.16.nix
@@ -51,11 +51,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.16.9";
+  version = "1.16.10";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "sha256-ChzH/XvSBEj3Hr7WTYRhOIUNUJmxjPXMEKT8RRYNjD0=";
+    sha256 = "sha256-qQVHIBFYXkA9ANKkHefO0puIhDCdc0gqMH9on9DzILU=";
   };
 
   # perl is used for testing go vet