From 4735c9a4c26c4ce13d6bfddcf1ee1ac8d0535fe3 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Sun, 4 Oct 2020 14:34:11 +0200
Subject: [PATCH 01/13] llvmPackages_11.clang-unwrapped: Inherit
 clang-tools-extra_src

So that it can be accessed via llvmPackages_11.clang-unwrapped.clang-tools-extra_src
(e.g. useful for nix-prefetch-url).

(cherry picked from commit 72cc4d2f0a80fdf183bb8a23f75de553a0b81b78)
---
 pkgs/development/compilers/llvm/11/clang/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/compilers/llvm/11/clang/default.nix b/pkgs/development/compilers/llvm/11/clang/default.nix
index 3aa3ba0ee46a..53292ef844b2 100644
--- a/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@@ -9,6 +9,7 @@ let
     inherit version;
 
     src = fetch "clang" "1p64l5a3x55118nyms1805qbk3r9w37nz1rb7xvbgc9fmyzaffay";
+    inherit clang-tools-extra_src;
 
     unpackPhase = ''
       unpackFile $src

From 49ebef384b702e44de46768a55d5c514ccfc1c2e Mon Sep 17 00:00:00 2001
From: TredwellGit <tredwell@tutanota.com>
Date: Sun, 11 Oct 2020 08:42:56 -0400
Subject: [PATCH 02/13] llvm_11: link to the llvm compiler-rt share directory
 from the wrapper (#100190)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A port of #85925 for LLVM 11 to enable CFI for Chromium.

This is required for features such as `-fsanitize=cfi` that (by default)
load the file `…/resource-root/share/cfi_blacklist.txt`.

(cherry picked from commit 03dd1b355b6c7379500becdf170850a5a1dfea5a)
---
 pkgs/development/compilers/llvm/11/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index dc75fe9f96e7..eb2349f0acd6 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -24,6 +24,7 @@ let
       mkdir "$rsrc"
       ln -s "${cc}/lib/clang/${release_version}/include" "$rsrc"
       ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
+      ln -s "${targetLlvmLibraries.compiler-rt.out}/share" "$rsrc/share"
       echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
     '' + stdenv.lib.optionalString (stdenv.targetPlatform.isLinux && tools.clang-unwrapped ? gcc && !(stdenv.targetPlatform.useLLVM or false)) ''
       echo "--gcc-toolchain=${tools.clang-unwrapped.gcc}" >> $out/nix-support/cc-cflags

From b348fcc0ed017201442dc7429313903fa36b8e2d Mon Sep 17 00:00:00 2001
From: Gabor Greif <ggreif@gmail.com>
Date: Wed, 7 Oct 2020 23:29:47 +0200
Subject: [PATCH 03/13] llvmPackages_11: 11.0.0rc5 -> 11.0.0

https://lists.llvm.org/pipermail/release-testers/2020-October/001377.html
https://lists.llvm.org/pipermail/llvm-announce/2020-October/000089.html

Fixes:
 - builds on Darwin
 - builds `libcxx` on Linux
(cherry picked from commit cffb7cfbf755e5166a3a41594978e838942ef17f)
---
 .../compilers/llvm/11/clang/default.nix       |  2 +-
 .../compilers/llvm/11/compiler-rt.nix         |  6 ++++-
 .../development/compilers/llvm/11/default.nix |  7 +++---
 .../compilers/llvm/11/libc++/default.nix      | 22 +++++++++----------
 .../compilers/llvm/11/libc++abi.nix           |  9 ++++----
 .../compilers/llvm/11/libunwind.nix           |  2 +-
 pkgs/development/compilers/llvm/11/lld.nix    |  2 +-
 pkgs/development/compilers/llvm/11/lldb.nix   |  2 +-
 pkgs/development/compilers/llvm/11/llvm.nix   |  6 ++---
 pkgs/development/compilers/llvm/11/openmp.nix |  2 +-
 10 files changed, 31 insertions(+), 29 deletions(-)

diff --git a/pkgs/development/compilers/llvm/11/clang/default.nix b/pkgs/development/compilers/llvm/11/clang/default.nix
index 53292ef844b2..2aefc884d48e 100644
--- a/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@@ -8,7 +8,7 @@ let
     pname = "clang";
     inherit version;
 
-    src = fetch "clang" "1p64l5a3x55118nyms1805qbk3r9w37nz1rb7xvbgc9fmyzaffay";
+    src = fetch "clang" "02ajkij85966vd150iy246mv16dsaph1kfi0y8wnncp8w6nar5hg";
     inherit clang-tools-extra_src;
 
     unpackPhase = ''
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt.nix b/pkgs/development/compilers/llvm/11/compiler-rt.nix
index e0cb712fe613..417c610586eb 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt.nix
@@ -11,7 +11,7 @@ in
 stdenv.mkDerivation rec {
   pname = "compiler-rt";
   inherit version;
-  src = fetch pname "0cpyi5g0wlwyb7gvy47k5rjiipnlhrr3ks4q4rlrlyax6w9dx98n";
+  src = fetch pname "0d5j5l8phwqjjscmk8rmqn0i2i0abl537gdbkagl8fjpzy1gyjip";
 
   nativeBuildInputs = [ cmake python3 llvm ];
   buildInputs = stdenv.lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
     "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
     "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
+  ] ++ stdenv.lib.optionals (stdenv.isDarwin) [
+    "-DDARWIN_macosx_OVERRIDE_SDK_VERSION=ON"
   ] ++ stdenv.lib.optionals (useLLVM || bareMetal || isMusl) [
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
@@ -60,6 +62,8 @@ stdenv.mkDerivation rec {
     substituteInPlace cmake/builtin-config-ix.cmake \
       --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
   '' + stdenv.lib.optionalString stdenv.isDarwin ''
+    substituteInPlace cmake/builtin-config-ix.cmake \
+      --replace 'set(ARM64 arm64 arm64e)' 'set(ARM64)'
     substituteInPlace cmake/config-ix.cmake \
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
   '' + stdenv.lib.optionalString (useLLVM) ''
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index eb2349f0acd6..0b091c60973a 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -6,16 +6,15 @@
 
 let
   release_version = "11.0.0";
-  candidate = "rc5";
-  version = "${release_version}${candidate}"; # differentiating these (variables) is important for RCs
+  version = "${release_version}"; # differentiating these (variables) is important for RCs
   targetConfig = stdenv.targetPlatform.config;
 
   fetch = name: sha256: fetchurl {
-    url = "https://github.com/llvm/llvm-project/releases/download/llvmorg-${release_version}-${candidate}/${name}-${version}.src.tar.xz";
+    url = "https://github.com/llvm/llvm-project/releases/download/llvmorg-${release_version}/${name}-${version}.src.tar.xz";
     inherit sha256;
   };
 
-  clang-tools-extra_src = fetch "clang-tools-extra" "0slqx5430pc699idabqnq34s9n0y2fq6q8z8hn5wakbi93dal71r";
+  clang-tools-extra_src = fetch "clang-tools-extra" "02bcwwn54661madhq4nxc069s7p7pj5gpqi8ww50w3anbpviilzy";
 
   tools = stdenv.lib.makeExtensible (tools: let
     callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
diff --git a/pkgs/development/compilers/llvm/11/libc++/default.nix b/pkgs/development/compilers/llvm/11/libc++/default.nix
index 7a7cf06600b6..1ce879cccb67 100644
--- a/pkgs/development/compilers/llvm/11/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/11/libc++/default.nix
@@ -1,33 +1,31 @@
-{ lib, stdenv, fetch, cmake, python3, libcxxabi, fixDarwinDylibNames, version
+{ lib, stdenv, fetch, cmake, python3, libcxxabi, llvm, fixDarwinDylibNames, version
 , enableShared ? true }:
 
 stdenv.mkDerivation {
   pname = "libc++";
   inherit version;
 
-  src = fetch "libcxx" "1rlp8hx0nmqpx0gxq8hh9kqbkkzfpadx9chm47c38d4lahdksr1v";
+  src = fetch "libcxx" "0ylbkcd38zrrz9xmkq9na3d9s8d96hc286dwfwd73wi205lyc7kc";
 
   postUnpack = ''
     unpackFile ${libcxxabi.src}
-    export LIBCXXABI_INCLUDE_DIR="$PWD/$(ls -d libcxxabi-${version}*)/include"
+    mv libcxxabi-* libcxxabi
+    unpackFile ${llvm.src}
+    mv llvm-* llvm
   '';
 
   patches = stdenv.lib.optional stdenv.hostPlatform.isMusl ../../libcxx-0001-musl-hacks.patch;
 
-  preConfigure = ''
-    # Get headers from the cxxabi source so we can see private headers not installed by the cxxabi package
-    cmakeFlagsArray=($cmakeFlagsArray -DLIBCXX_CXX_ABI_INCLUDE_PATHS="$LIBCXXABI_INCLUDE_DIR")
-  '' + lib.optionalString stdenv.hostPlatform.isMusl ''
+  preConfigure = lib.optionalString stdenv.hostPlatform.isMusl ''
     patchShebangs utils/cat_files.py
   '';
-  nativeBuildInputs = [ cmake ]
-    ++ stdenv.lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) python3;
 
-  buildInputs = [ libcxxabi ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+  nativeBuildInputs = [ cmake python3 ]
+    ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+
+  buildInputs = [ libcxxabi ];
 
   cmakeFlags = [
-    "-DLIBCXX_LIBCXXABI_LIB_PATH=${libcxxabi}/lib"
-    "-DLIBCXX_LIBCPPABI_VERSION=2"
     "-DLIBCXX_CXX_ABI=libcxxabi"
   ] ++ stdenv.lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
     ++ stdenv.lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
diff --git a/pkgs/development/compilers/llvm/11/libc++abi.nix b/pkgs/development/compilers/llvm/11/libc++abi.nix
index ba3b7fd9d92d..edf83197d2ca 100644
--- a/pkgs/development/compilers/llvm/11/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/11/libc++abi.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation {
   pname = "libc++abi";
   inherit version;
 
-  src = fetch "libcxxabi" "0214sl9m80hb8v0mdkrwl8l4ca3dvapis23mkld85bnxa8zq2c1q";
+  src = fetch "libcxxabi" "05ac7rkjbla03bc0lf92f901dfjgxdvp8cr9fpn59a5p4x27ssaq";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = stdenv.lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm) libunwind;
@@ -24,14 +24,15 @@ stdenv.mkDerivation {
 
   postUnpack = ''
     unpackFile ${libcxx.src}
+    mv libcxx-* libcxx
     unpackFile ${llvm.src}
-    cmakeFlags+=" -DLLVM_PATH=$PWD/$(ls -d llvm-*) -DLIBCXXABI_LIBCXX_PATH=$PWD/$(ls -d libcxx-*)"
+    mv llvm-* llvm
   '' + stdenv.lib.optionalString stdenv.isDarwin ''
     export TRIPLE=x86_64-apple-darwin
   '' + stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -d $(ls -d libcxx-*) -i ${../libcxx-0001-musl-hacks.patch}
+    patch -p1 -d libcxx -i ${../libcxx-0001-musl-hacks.patch}
   '' + stdenv.lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d $(ls -d llvm-*) -i ${./libcxxabi-wasm.patch}
+    patch -p1 -d llvm -i ${./libcxxabi-wasm.patch}
   '';
 
   installPhase = if stdenv.isDarwin
diff --git a/pkgs/development/compilers/llvm/11/libunwind.nix b/pkgs/development/compilers/llvm/11/libunwind.nix
index 0fc3fcabb33f..5a4492e803f6 100644
--- a/pkgs/development/compilers/llvm/11/libunwind.nix
+++ b/pkgs/development/compilers/llvm/11/libunwind.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   pname = "libunwind";
   inherit version;
 
-  src = fetch pname "1xw8y6agnix7qlwh676gm1kbkzh9c1nz7l3vhxjpazbk70biz9mq";
+  src = fetch pname "0bwjd2xf51r2apn8p0f9shb6nc8hnqzq1n9gggjvyjmi6cf02mc4";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/compilers/llvm/11/lld.nix b/pkgs/development/compilers/llvm/11/lld.nix
index 364fdb727d02..20eb87c548f6 100644
--- a/pkgs/development/compilers/llvm/11/lld.nix
+++ b/pkgs/development/compilers/llvm/11/lld.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   pname = "lld";
   inherit version;
 
-  src = fetch pname "1ibyahcxxckdfwh95f1dzxgcf1fsd0r9rpanm3dnn6nb99mn0is4";
+  src = fetch pname "077xyh7sij6mhp4dc4kdcmp9whrpz332fa12rwxnzp3wgd5bxrzg";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ llvm libxml2 ];
diff --git a/pkgs/development/compilers/llvm/11/lldb.nix b/pkgs/development/compilers/llvm/11/lldb.nix
index b79496921450..865232a6ac2b 100644
--- a/pkgs/development/compilers/llvm/11/lldb.nix
+++ b/pkgs/development/compilers/llvm/11/lldb.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation (rec {
   pname = "lldb";
   inherit version;
 
-  src = fetch pname "1v8nvw6rxmi7w3ayjcjan4plb5ryhizc41sras7fza2l7n3cz8iz";
+  src = fetch pname "0wic9lyb2la9bkzdc13szkm4f793w1mddp50xvh237iraygw0w45";
 
   patches = [ ./lldb-procfs.patch ];
 
diff --git a/pkgs/development/compilers/llvm/11/llvm.nix b/pkgs/development/compilers/llvm/11/llvm.nix
index b55ec1f0a102..3f37cac078f9 100644
--- a/pkgs/development/compilers/llvm/11/llvm.nix
+++ b/pkgs/development/compilers/llvm/11/llvm.nix
@@ -32,8 +32,8 @@ in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
-  src = fetch pname "1k7i2syqdm29l10di3ws64i02snh9jhd1s2jzgh8565b0vg25wlc";
-  polly_src = fetch "polly" "0l0n09f6sy30x825w85v8n7pvya0ciq89r0abv66n8ggwmrk3rnw";
+  src = fetch pname "0s94lwil98w7zb7cjrbnxli0z7gklb312pkw74xs1d6zk346hgwi";
+  polly_src = fetch "polly" "0h442ivcslr3dv3q3g1nw5avh77f8cxsp6zild1hgspj266xpynw";
 
   unpackPhase = ''
     unpackFile $src
@@ -96,7 +96,7 @@ in stdenv.mkDerivation (rec {
   '';
 
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
-  LDFLAGS = optionalString enableSharedLibraries "-Wl,--build-id=sha1";
+  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
   cmakeFlags = with stdenv; [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
diff --git a/pkgs/development/compilers/llvm/11/openmp.nix b/pkgs/development/compilers/llvm/11/openmp.nix
index 3cc19ad711d6..5fd6c62840db 100644
--- a/pkgs/development/compilers/llvm/11/openmp.nix
+++ b/pkgs/development/compilers/llvm/11/openmp.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   pname = "openmp";
   inherit version;
 
-  src = fetch pname "1yq7m0kwnlgq8ni719g9fny0x5wrvm8szp11b3q8zz39rqqyphsz";
+  src = fetch pname "0k389d0g9zlfyzh1kpb3i5jdawzpn0hrdxzbjinpvdv7rbw4sw1d";
 
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [ llvm ];

From b2b839a607ab3658ca60e79030ed0d68771fa471 Mon Sep 17 00:00:00 2001
From: Gabor Greif <ggreif@gmail.com>
Date: Thu, 15 Oct 2020 14:59:07 +0200
Subject: [PATCH 04/13] clang_11: forward-port #91293

(cherry picked from commit 7a30df9225e3c47080744535ccbb0a1202b36a3a)
---
 pkgs/development/compilers/llvm/11/clang/default.nix |  2 --
 pkgs/development/compilers/llvm/11/default.nix       | 10 ++++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/compilers/llvm/11/clang/default.nix b/pkgs/development/compilers/llvm/11/clang/default.nix
index 2aefc884d48e..4f5e20cfe770 100644
--- a/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@@ -86,8 +86,6 @@ let
     passthru = {
       isClang = true;
       inherit llvm;
-    } // stdenv.lib.optionalAttrs (stdenv.targetPlatform.isLinux || (stdenv.cc.isGNU && stdenv.cc.cc ? gcc)) {
-      gcc = if stdenv.cc.isGNU then stdenv.cc.cc else stdenv.cc.cc.gcc;
     };
 
     meta = {
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index 0b091c60973a..a404d1606957 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -1,5 +1,6 @@
-{ lowPrio, newScope, pkgs, stdenv, cmake
+{ lowPrio, newScope, pkgs, stdenv, cmake, gccForLibs
 , libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith, wrapBintoolsWith
+, buildPackages
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 }:
@@ -25,8 +26,8 @@ let
       ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
       ln -s "${targetLlvmLibraries.compiler-rt.out}/share" "$rsrc/share"
       echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
-    '' + stdenv.lib.optionalString (stdenv.targetPlatform.isLinux && tools.clang-unwrapped ? gcc && !(stdenv.targetPlatform.useLLVM or false)) ''
-      echo "--gcc-toolchain=${tools.clang-unwrapped.gcc}" >> $out/nix-support/cc-cflags
+    '' + stdenv.lib.optionalString (stdenv.targetPlatform.isLinux && !(stdenv.targetPlatform.useLLVM or false)) ''
+      echo "--gcc-toolchain=${gccForLibs}" >> $out/nix-support/cc-cflags
     '';
   in {
 
@@ -60,7 +61,8 @@ let
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
-      libcxx = null; # libstdcxx is smuggled in with clang.gcc
+      # libstdcxx is taken from gcc in an ad-hoc way in cc-wrapper.
+      libcxx = null;
       extraPackages = [
         targetLlvmLibraries.compiler-rt
       ];

From bd499391c3219d6c9f5aa55b15cf8a0a678029b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Holger=20W=C3=BCnsche?=
 <DieGoldeneEnte@users.noreply.github.com>
Date: Fri, 16 Oct 2020 14:35:22 +0200
Subject: [PATCH 05/13] llvmPackages_11.compiler-rt: enable support for i486
 i586 i686

compiler-rt (and as a result clang) can't be build for i686 (as noticed here: #99984).
The patch adds the required variables and should result in the same behavior as in the nixpkgs-llvm10. It essentially forces to use i386 buildins when using i486, i586 or i686, which are not supported.

Fixes #100392

(cherry picked from commit 6948875e73a855b8a0c665301576dcd9653b9e15)
---
 .../compiler-rt-X86-support-extension.patch   | 23 +++++++++++++++++++
 .../compilers/llvm/11/compiler-rt.nix         |  1 +
 2 files changed, 24 insertions(+)
 create mode 100644 pkgs/development/compilers/llvm/11/compiler-rt-X86-support-extension.patch

diff --git a/pkgs/development/compilers/llvm/11/compiler-rt-X86-support-extension.patch b/pkgs/development/compilers/llvm/11/compiler-rt-X86-support-extension.patch
new file mode 100644
index 000000000000..f6f9336ad5ad
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/compiler-rt-X86-support-extension.patch
@@ -0,0 +1,23 @@
+diff --git a/lib/builtins/CMakeLists.txt b/lib/builtins/CMakeLists.txt
+index 3a66dd9c3fb..7efc85d9f9f 100644
+--- a/lib/builtins/CMakeLists.txt
++++ b/lib/builtins/CMakeLists.txt
+@@ -301,6 +301,10 @@ if (NOT MSVC)
+     i386/umoddi3.S
+   )
+ 
++  set(i486_SOURCES ${i386_SOURCES})
++  set(i586_SOURCES ${i386_SOURCES})
++  set(i686_SOURCES ${i386_SOURCES})
++
+   if (WIN32)
+     set(i386_SOURCES
+       ${i386_SOURCES}
+@@ -608,6 +612,7 @@ else ()
+   endif()
+ 
+   foreach (arch ${BUILTIN_SUPPORTED_ARCH})
++      message("arch: ${arch}")
+     if (CAN_TARGET_${arch})
+       # For ARM archs, exclude any VFP builtins if VFP is not supported
+       if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7m|armv7em)$")
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt.nix b/pkgs/development/compilers/llvm/11/compiler-rt.nix
index 417c610586eb..b8a5fcd5661c 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt.nix
@@ -49,6 +49,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    ./compiler-rt-X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
   ]# ++ stdenv.lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
     ++ stdenv.lib.optional stdenv.hostPlatform.isAarch32 ./compiler-rt-armv7l.patch;
 

From 616c488ccff51a6f44e1bd7f871a346891304f99 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Wed, 14 Oct 2020 12:17:07 +0200
Subject: [PATCH 06/13] chromium: Drop the libwebp include patch

Chromium 86.0.4240.75 builds fine without this patch. And since
WEBP_MAX_DIMENSION is the same in the system libwebp this patch should
not be required anymore (it was introduced in 06ec2a9f196, apparently to
fix the build).

(cherry picked from commit 015c5a2be650acf9db46c3c25012e5023319625b)
---
 .../networking/browsers/chromium/common.nix           |  1 -
 .../chromium/patches/remove-webp-include-69.patch     | 11 -----------
 2 files changed, 12 deletions(-)
 delete mode 100644 pkgs/applications/networking/browsers/chromium/patches/remove-webp-include-69.patch

diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 871f3bfb8987..cc5343d8023e 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -149,7 +149,6 @@ let
       ++ optionals useOzone [ libdrm wayland mesa_drivers libxkbcommon ];
 
     patches = [
-      ./patches/remove-webp-include-69.patch
       ./patches/no-build-timestamps.patch
       ./patches/widevine-79.patch
       # Unfortunately, chromium regularly breaks on major updates and
diff --git a/pkgs/applications/networking/browsers/chromium/patches/remove-webp-include-69.patch b/pkgs/applications/networking/browsers/chromium/patches/remove-webp-include-69.patch
deleted file mode 100644
index 07572cf7ee94..000000000000
--- a/pkgs/applications/networking/browsers/chromium/patches/remove-webp-include-69.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/third_party/blink/renderer/platform/image-encoders/image_encoder.cc
-+++ b/third_party/blink/renderer/platform/image-encoders/image_encoder.cc
-@@ -13,7 +13,7 @@
-
- #include "jpeglib.h"  // for JPEG_MAX_DIMENSION
-
--#include "third_party/libwebp/src/webp/encode.h"  // for WEBP_MAX_DIMENSION
-+#define WEBP_MAX_DIMENSION 16383
-
- namespace blink {
-

From aeba7458eb0dc4cd135baa1211be18593d232bf5 Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Fri, 16 Oct 2020 11:22:28 +0000
Subject: [PATCH 07/13] chromium: build on all cores

(cherry picked from commit 5742fcdfa9e6a22d9085c0a80975a83c00d5c997)
---
 .../applications/networking/browsers/chromium/common.nix | 9 +--------
 .../networking/browsers/ungoogled-chromium/common.nix    | 9 +--------
 2 files changed, 2 insertions(+), 16 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index cc5343d8023e..babb8aef2836 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -313,15 +313,8 @@ let
     NIX_CFLAGS_COMPILE = "-Wno-unknown-warning-option";
 
     buildPhase = let
-      # Build paralelism: on Hydra the build was frequently running into memory
-      # exhaustion, and even other users might be running into similar issues.
-      # -j is halved to avoid memory problems, and -l is slightly increased
-      # so that the build gets slight preference before others
-      # (it will often be on "critical path" and at risk of timing out)
       buildCommand = target: ''
-        ninja -C "${buildPath}"  \
-          -j$(( ($NIX_BUILD_CORES+1) / 2 )) -l$(( $NIX_BUILD_CORES+1 )) \
-          "${target}"
+        ninja -C "${buildPath}" "${target}"
         (
           source chrome/installer/linux/common/installer.include
           PACKAGE=$packageName
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
index 4d537f8dd4c8..c6bcd831d09f 100644
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
@@ -350,15 +350,8 @@ let
     NIX_CFLAGS_COMPILE = "-Wno-unknown-warning-option";
 
     buildPhase = let
-      # Build paralelism: on Hydra the build was frequently running into memory
-      # exhaustion, and even other users might be running into similar issues.
-      # -j is halved to avoid memory problems, and -l is slightly increased
-      # so that the build gets slight preference before others
-      # (it will often be on "critical path" and at risk of timing out)
       buildCommand = target: ''
-        ninja -C "${buildPath}"  \
-          -j$(( ($NIX_BUILD_CORES+1) / 2 )) -l$(( $NIX_BUILD_CORES+1 )) \
-          "${target}"
+        ninja -C "${buildPath}" "${target}"
         (
           source chrome/installer/linux/common/installer.include
           PACKAGE=$packageName

From a8287a01361ed1e7188a05194dd1bfd4b9ad67aa Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Fri, 16 Oct 2020 12:54:34 +0000
Subject: [PATCH 08/13] chromium: build on $NIX_BUILD_CORES

(cherry picked from commit 8e861c07ce4bbfb7814c477d0852ca9dd2f78d0c)
---
 pkgs/applications/networking/browsers/chromium/common.nix       | 2 +-
 .../networking/browsers/ungoogled-chromium/common.nix           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index babb8aef2836..5a861fec66fb 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -314,7 +314,7 @@ let
 
     buildPhase = let
       buildCommand = target: ''
-        ninja -C "${buildPath}" "${target}"
+        ninja -C "${buildPath}" -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES "${target}"
         (
           source chrome/installer/linux/common/installer.include
           PACKAGE=$packageName
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
index c6bcd831d09f..0ae8207277a6 100644
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
@@ -351,7 +351,7 @@ let
 
     buildPhase = let
       buildCommand = target: ''
-        ninja -C "${buildPath}" "${target}"
+        ninja -C "${buildPath}" -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES "${target}"
         (
           source chrome/installer/linux/common/installer.include
           PACKAGE=$packageName

From 9e47bd3de57be388d2d5a9aeedec028e1e55eebd Mon Sep 17 00:00:00 2001
From: conferno <conferno@camfex.cz>
Date: Fri, 16 Oct 2020 17:37:28 +0000
Subject: [PATCH 09/13] chromium: fix build on i686 (#100512)

ld.gold runs out of memory on i686.

(cherry picked from commit c557c27ac37f0e820eff82dc28b83cf9d366d869)
---
 pkgs/applications/networking/browsers/chromium/common.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 5a861fec66fb..94c28200eeec 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -238,7 +238,7 @@ let
 
     gnFlags = mkGnFlags ({
       use_lld = false;
-      use_gold = true;
+      use_gold = stdenv.buildPlatform.is64bit;  # ld.gold outs-of-memory on i686
       gold_path = "${stdenv.cc}/bin";
       is_debug = false;
 

From ae3bbb9b001c01a3e91a798cd0ee5028f3bb9ba3 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Tue, 20 Oct 2020 12:59:55 +0200
Subject: [PATCH 10/13] chromium: Add some brief documentation

Wanted to do this for a long time to collect important knowledge and
make it easier to pass maintainership.
Only time will tell if this'll be useful or become outdated instead.

(cherry picked from commit b36db49ae73db879fe00f73f2777077f33a68745)
---
 .../networking/browsers/chromium/README.md    | 56 +++++++++++++++++++
 .../networking/browsers/chromium/browser.nix  | 12 +---
 .../networking/browsers/chromium/common.nix   | 12 +---
 3 files changed, 60 insertions(+), 20 deletions(-)
 create mode 100644 pkgs/applications/networking/browsers/chromium/README.md

diff --git a/pkgs/applications/networking/browsers/chromium/README.md b/pkgs/applications/networking/browsers/chromium/README.md
new file mode 100644
index 000000000000..e7b7df7cd087
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/README.md
@@ -0,0 +1,56 @@
+# Maintainers
+
+- TODO: We need more maintainers:
+  - https://github.com/NixOS/nixpkgs/issues/78450
+  - If you just want to help out without becoming a maintainer:
+    - Look for open Nixpkgs issues or PRs related to Chromium
+    - Make your own PRs (but please try to make reviews as easy as possible)
+- Primary maintainer (responsible for updating Chromium): @primeos
+- Testers (test all stable channel updates)
+  - `nixos-unstable`:
+    - `x86_64`: @danielfullmer
+    - `aarch64`: @thefloweringash
+  - Stable channel:
+    - `x86_64`: @Frostman
+- Other relevant packages:
+  - `chromiumBeta` and `chromiumDev`: For testing purposes (not build on Hydra)
+  - `google-chrome`, `google-chrome-beta`, `google-chrome-dev`: Updated via
+    Chromium's `upstream-info.json`
+  - `ungoogled-chromium`: Based on `chromium` (the expressions are regularly
+    copied over and patched accordingly)
+
+# Updating Chromium
+
+Simply run `./pkgs/applications/networking/browsers/chromium/update.py` to
+update `upstream-info.json`. After updates it is important to test at least
+`nixosTests.chromium` (or basic manual testing) and `google-chrome` (which
+reuses `upstream-info.json`).
+
+## Backports
+
+All updates are considered security critical and should be ported to the stable
+channel ASAP. When there is a new stable release the old one should receive
+security updates for roughly one month. After that it is important to mark
+Chromium as insecure (see 69e4ae56c4b for an example; it is important that the
+tested job still succeeds and that all browsers that use `upstream-info.json`
+are marked as insecure).
+
+## Major version updates
+
+Unfortunately, Chromium regularly breaks on major updates and might need
+various patches. Either due to issues with the Nix build sandbox (e.g. we cannot
+fetch dependencies via the network and do not use standard FHS paths) or due to
+missing upstream fixes that need to be backported.
+
+Good sources for such patches and other hints:
+- https://github.com/archlinux/svntogit-packages/tree/packages/chromium/trunk
+- https://gitweb.gentoo.org/repo/gentoo.git/tree/www-client/chromium
+- https://src.fedoraproject.org/rpms/chromium/tree/master
+
+If the build fails immediately due to unknown compiler flags this usually means
+that a new major release of LLVM is required.
+
+## Beta and Dev channels
+
+Those channels are only used to test and fix builds in advance. They may be
+broken at times and must not delay stable channel updates.
diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
index 3d87325984b4..d3953da71d28 100644
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -77,18 +77,10 @@ mkChromiumDerivation (base: rec {
       of source code for Google Chrome (which has some additional features).
     '';
     homepage = "https://www.chromium.org/";
-    maintainers = with maintainers; [ bendlas thefloweringash primeos ];
-    # Overview of the maintainer roles:
-    # nixos-unstable:
-    # - TODO: Need a new maintainer for x86_64 [0]
-    # - @thefloweringash: aarch64
-    # - @primeos: Provisional maintainer (x86_64)
-    # Stable channel:
-    # - TODO (need someone to test backports [0])
-    # [0]: https://github.com/NixOS/nixpkgs/issues/78450
+    maintainers = with maintainers; [ primeos thefloweringash bendlas ]; # See README.md
     license = if enableWideVine then licenses.unfree else licenses.bsd3;
     platforms = platforms.linux;
     hydraPlatforms = if channel == "stable" then ["aarch64-linux" "x86_64-linux"] else [];
-    timeout = 172800; # 48 hours
+    timeout = 172800; # 48 hours (increased from the Hydra default of 10h)
   };
 })
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 94c28200eeec..68df159cbac6 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -149,16 +149,8 @@ let
       ++ optionals useOzone [ libdrm wayland mesa_drivers libxkbcommon ];
 
     patches = [
-      ./patches/no-build-timestamps.patch
-      ./patches/widevine-79.patch
-      # Unfortunately, chromium regularly breaks on major updates and
-      # then needs various patches backported in order to be compiled with GCC.
-      # Good sources for such patches and other hints:
-      # - https://gitweb.gentoo.org/repo/gentoo.git/plain/www-client/chromium/
-      # - https://git.archlinux.org/svntogit/packages.git/tree/trunk?h=packages/chromium
-      # - https://github.com/chromium/chromium/search?q=GCC&s=committer-date&type=Commits
-      #
-      # ++ optionals (channel == "dev") [ ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" ) ]
+      ./patches/no-build-timestamps.patch # Optional patch to use SOURCE_DATE_EPOCH in compute_build_timestamp.py (should be upstreamed)
+      ./patches/widevine-79.patch # For bundling Widevine (DRM), might be replaceable via bundle_widevine_cdm=true in gnFlags
       # ++ optional (versionRange "68" "72") ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" )
     ] ++ optionals (useVaapi && versionRange "86" "87") [
       # Check for enable-accelerated-video-decode on Linux:

From 56374102a98abb66706af62093d3b6bf40a82b75 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Tue, 3 Nov 2020 13:08:09 +0100
Subject: [PATCH 11/13] chromium: Extend update.py to automatically update gn

The gn version depends on the channel and new gn versions aren't always
backward compatible. Therefore we should also include it in
upstream-info.json (I've scoped it under "deps" as we'll likely have to
add more like this in the future).

(cherry picked from commit d7f53864741aa0cb3a992e74ada3153a89a85f69)
---
 .../networking/browsers/chromium/common.nix   |  7 ++++-
 .../networking/browsers/chromium/default.nix  | 15 ++--------
 .../networking/browsers/chromium/update.py    | 30 ++++++++++++++++++-
 .../browsers/chromium/upstream-info.json      | 30 +++++++++++++++++--
 4 files changed, 64 insertions(+), 18 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 68df159cbac6..42661cc65b30 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -325,7 +325,12 @@ let
       patchelf --set-rpath "${libGL}/lib:$origRpath" "$chromiumBinary"
     '';
 
-    passthru.updateScript = ./update.py;
+    passthru = {
+      updateScript = ./update.py;
+      chromiumDeps = {
+        gn = gnChromium;
+      };
+    };
   };
 
 # Remove some extraAttrs we supplied to the base attributes already.
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index 43e4717f82f6..779066a229ad 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -36,26 +36,15 @@ let
     mkChromiumDerivation = callPackage ./common.nix ({
       inherit channel gnome gnomeSupport gnomeKeyringSupport proprietaryCodecs
               cupsSupport pulseSupport useOzone;
-      # TODO: Remove after we can update gn for the stable channel (backward incompatible changes):
       gnChromium = gn.overrideAttrs (oldAttrs: {
-        version = "2020-07-20";
+        inherit (upstream-info.deps.gn) version;
         src = fetchgit {
-          url = "https://gn.googlesource.com/gn";
-          rev = "3028c6a426a4aaf6da91c4ebafe716ae370225fe";
-          sha256 = "0h3wf4152zdvrbb0jbj49q6814lfl3rcy5mj8b2pl9s0ahvkbc6q";
+          inherit (upstream-info.deps.gn) url rev sha256;
         };
       });
     } // lib.optionalAttrs (lib.versionAtLeast upstream-info.version "87") {
       useOzone = true; # YAY: https://chromium-review.googlesource.com/c/chromium/src/+/2382834 \o/
       useVaapi = !stdenv.isAarch64; # TODO: Might be best to not set use_vaapi anymore (default is fine)
-      gnChromium = gn.overrideAttrs (oldAttrs: {
-        version = "2020-08-17";
-        src = fetchgit {
-          url = "https://gn.googlesource.com/gn";
-          rev = "6f13aaac55a977e1948910942675c69f2b4f7a94";
-          sha256 = "01hpma1sllpdx09mvr4d6073sg6zmk6iv44kd3r28khymcj4s251";
-        };
-      });
     });
 
     browser = callPackage ./browser.nix { inherit channel enableWideVine; };
diff --git a/pkgs/applications/networking/browsers/chromium/update.py b/pkgs/applications/networking/browsers/chromium/update.py
index bfc7f0d2478c..b404ca555bff 100755
--- a/pkgs/applications/networking/browsers/chromium/update.py
+++ b/pkgs/applications/networking/browsers/chromium/update.py
@@ -1,13 +1,15 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i python -p python3 nix
+#! nix-shell -i python -p python3 nix nix-prefetch-git
 
 import csv
 import json
+import re
 import subprocess
 import sys
 
 from codecs import iterdecode
 from collections import OrderedDict
+from datetime import datetime
 from os.path import abspath, dirname
 from urllib.request import urlopen
 
@@ -26,6 +28,30 @@ def nix_prefetch_url(url, algo='sha256'):
     out = subprocess.check_output(['nix-prefetch-url', '--type', algo, url])
     return out.decode('utf-8').rstrip()
 
+def nix_prefetch_git(url, rev):
+    print(f'nix-prefetch-git {url} {rev}')
+    out = subprocess.check_output(['nix-prefetch-git', '--quiet', '--url', url, '--rev', rev])
+    return json.loads(out)
+
+def get_file_revision(revision, file_path):
+    url = f'https://raw.githubusercontent.com/chromium/chromium/{revision}/{file_path}'
+    with urlopen(url) as http_response:
+        return http_response.read()
+
+def get_channel_dependencies(channel):
+    deps = get_file_revision(channel['version'], 'DEPS')
+    gn_pattern = b"'gn_version': 'git_revision:([0-9a-f]{40})'"
+    gn_commit = re.search(gn_pattern, deps).group(1).decode()
+    gn = nix_prefetch_git('https://gn.googlesource.com/gn', gn_commit)
+    return {
+        'gn': {
+            'version': datetime.fromisoformat(gn['date']).date().isoformat(),
+            'url': gn['url'],
+            'rev': gn['rev'],
+            'sha256': gn['sha256']
+        }
+    }
+
 channels = {}
 last_channels = load_json(JSON_PATH)
 
@@ -58,6 +84,8 @@ with urlopen(HISTORY_URL) as resp:
             # the next one.
             continue
 
+        channel['deps'] = get_channel_dependencies(channel)
+
         channels[channel_name] = channel
 
 with open(JSON_PATH, 'w') as out:
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index d6971da2c0f4..565f884c5102 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -2,16 +2,40 @@
   "stable": {
     "version": "86.0.4240.183",
     "sha256": "1g39i82js7fm4fqb8i66d6xs0kzqjxzi4vzvvwz5y9rkbikcc4ma",
-    "sha256bin64": "1r0dxqsx6j19hgwr3v2sdlb2vd7gb961c4wba4ymd8wy8j8pzly9"
+    "sha256bin64": "1r0dxqsx6j19hgwr3v2sdlb2vd7gb961c4wba4ymd8wy8j8pzly9",
+    "deps": {
+      "gn": {
+        "version": "2020-08-07",
+        "url": "https://gn.googlesource.com/gn",
+        "rev": "e327ffdc503815916db2543ec000226a8df45163",
+        "sha256": "0kvlfj3www84zp1vmxh76x8fdjm9hyk8lkh2vdsidafpmm75fphr"
+      }
+    }
   },
   "beta": {
     "version": "87.0.4280.40",
     "sha256": "07xh76fl257np68way6i5rf64qbvirkfddy7m5gvqb0fzcqd7dp3",
-    "sha256bin64": "1b2z0aqlh28pqrk6dmabxp1d4mvp9iyfmi4kqmns4cdpg0qgaf41"
+    "sha256bin64": "1b2z0aqlh28pqrk6dmabxp1d4mvp9iyfmi4kqmns4cdpg0qgaf41",
+    "deps": {
+      "gn": {
+        "version": "2020-09-09",
+        "url": "https://gn.googlesource.com/gn",
+        "rev": "e002e68a48d1c82648eadde2f6aafa20d08c36f2",
+        "sha256": "0x4c7amxwzxs39grqs3dnnz0531mpf1p75niq7zhinyfqm86i4dk"
+      }
+    }
   },
   "dev": {
     "version": "88.0.4300.0",
     "sha256": "00cfs2rp4h8ybn2snr1d8ygg635hx7q5gv2aqriy1j6f8a1pgh1b",
-    "sha256bin64": "110r1m14h91212nx6pfhn8wkics7wlwx1608l5cqsxxcpvpzl3pv"
+    "sha256bin64": "110r1m14h91212nx6pfhn8wkics7wlwx1608l5cqsxxcpvpzl3pv",
+    "deps": {
+      "gn": {
+        "version": "2020-09-09",
+        "url": "https://gn.googlesource.com/gn",
+        "rev": "e002e68a48d1c82648eadde2f6aafa20d08c36f2",
+        "sha256": "0x4c7amxwzxs39grqs3dnnz0531mpf1p75niq7zhinyfqm86i4dk"
+      }
+    }
   }
 }

From 3af6255b10f94901c7024341a501c6e59f0bf681 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Tue, 10 Nov 2020 12:06:30 +0100
Subject: [PATCH 12/13] chromium: 86.0.4240.183 -> 86.0.4240.193

https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_9.html

This update includes 1 security fix (no CVE).

(cherry picked from commit 841664a172b31f4d07ab962fc1015c11523d88cd)
Backport of #103294.
---
 .../browsers/chromium/upstream-info.json      | 24 +++++++++----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 565f884c5102..8a6ed0453a1a 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -1,8 +1,8 @@
 {
   "stable": {
-    "version": "86.0.4240.183",
-    "sha256": "1g39i82js7fm4fqb8i66d6xs0kzqjxzi4vzvvwz5y9rkbikcc4ma",
-    "sha256bin64": "1r0dxqsx6j19hgwr3v2sdlb2vd7gb961c4wba4ymd8wy8j8pzly9",
+    "version": "86.0.4240.193",
+    "sha256": "0d55xkw3fygqpa3a5bvz7vqmzb0d9w1kis72h54cnwsqgw4xag90",
+    "sha256bin64": "1x1f8fv0fi965apk2a5v6jmhz8j5m3rz0k5x5vmkwqprvlblfjpw",
     "deps": {
       "gn": {
         "version": "2020-08-07",
@@ -13,9 +13,9 @@
     }
   },
   "beta": {
-    "version": "87.0.4280.40",
-    "sha256": "07xh76fl257np68way6i5rf64qbvirkfddy7m5gvqb0fzcqd7dp3",
-    "sha256bin64": "1b2z0aqlh28pqrk6dmabxp1d4mvp9iyfmi4kqmns4cdpg0qgaf41",
+    "version": "87.0.4280.47",
+    "sha256": "0a3c4kz85857wrbcxqknbqmai250d36nq332l66a83r8sidhbxfq",
+    "sha256bin64": "0bjls2airr4p448rx7im1a7gff68yfnfb5vymr4bin4kz0s38mpw",
     "deps": {
       "gn": {
         "version": "2020-09-09",
@@ -26,15 +26,15 @@
     }
   },
   "dev": {
-    "version": "88.0.4300.0",
-    "sha256": "00cfs2rp4h8ybn2snr1d8ygg635hx7q5gv2aqriy1j6f8a1pgh1b",
-    "sha256bin64": "110r1m14h91212nx6pfhn8wkics7wlwx1608l5cqsxxcpvpzl3pv",
+    "version": "88.0.4315.5",
+    "sha256": "0k6man2xq8vmnk73dqv3fcc9929agqq8j6s6nvc9z653q4jdphkw",
+    "sha256bin64": "0m139w8lwaawridk8in24ss1g1i6ah5298xky226k3vhk5i4mn3j",
     "deps": {
       "gn": {
-        "version": "2020-09-09",
+        "version": "2020-10-21",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "e002e68a48d1c82648eadde2f6aafa20d08c36f2",
-        "sha256": "0x4c7amxwzxs39grqs3dnnz0531mpf1p75niq7zhinyfqm86i4dk"
+        "rev": "f5f465b52e5df6d4de9fbe67cc79f1914ba4dbfc",
+        "sha256": "1xb31vsvg27ivvcdyiq93h8wj4d90qdrpagfh1dvm6xszkajsca1"
       }
     }
   }

From ded16fc1b4c673da8265fdc90d4a325aeffc7a41 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Thu, 12 Nov 2020 12:36:38 +0100
Subject: [PATCH 13/13] chromium: 86.0.4240.193 -> 86.0.4240.198

https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html

This update includes 2 security fixes. Google is aware of reports that
exploits for CVE-2020-16013 and CVE-2020-16017 exist in the wild.

CVEs: CVE-2020-16013 CVE-2020-16017
(cherry picked from commit b91153fd7ad32bfe5363844857e7a15f89c0a693)
Backport of #103595.
---
 .../networking/browsers/chromium/upstream-info.json         | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 8a6ed0453a1a..b88a63f27a4e 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -1,8 +1,8 @@
 {
   "stable": {
-    "version": "86.0.4240.193",
-    "sha256": "0d55xkw3fygqpa3a5bvz7vqmzb0d9w1kis72h54cnwsqgw4xag90",
-    "sha256bin64": "1x1f8fv0fi965apk2a5v6jmhz8j5m3rz0k5x5vmkwqprvlblfjpw",
+    "version": "86.0.4240.198",
+    "sha256": "0i3s1il0x5yi3528gdsg3bhnyhs2x24zh7p1nd5apv3va9g85ax0",
+    "sha256bin64": "0qfhs73r6j0r3nyqbnscnf7h1rs1s68lfl5ndsyd32dmip7ma01x",
     "deps": {
       "gn": {
         "version": "2020-08-07",