From 8d243e1ff570a4cbca9cfb05e724872a8b3df4a2 Mon Sep 17 00:00:00 2001
From: talyz <kim.lindberger@gmail.com>
Date: Wed, 11 Mar 2020 19:52:37 +0100
Subject: [PATCH 01/40] nixos/haproxy: Revive the haproxy user and group

Running haproxy with "DynamicUser = true" doesn't really work, since
it prohibits specifying a TLS certificate bundle with limited
permissions. This revives the haproxy user and group, but makes them
dynamically allocated by NixOS, rather than statically allocated. It
also adds options to specify which user and group haproxy runs as.

(cherry picked from commit bb7ad853fbcbd158ff32c12d2d93941343418715)
---
 nixos/modules/misc/ids.nix                    |  4 +--
 nixos/modules/services/networking/haproxy.nix | 26 ++++++++++++++++++-
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index 979cdc5d4ad4..85e5534e906f 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -133,7 +133,7 @@ in
       tcpcryptd = 93; # tcpcryptd uses a hard-coded uid. We patch it in Nixpkgs to match this choice.
       firebird = 95;
       #keys = 96; # unused
-      #haproxy = 97; # DynamicUser as of 2019-11-08
+      #haproxy = 97; # dynamically allocated as of 2020-03-11
       mongodb = 98;
       openldap = 99;
       #users = 100; # unused
@@ -448,7 +448,7 @@ in
       #tcpcryptd = 93; # unused
       firebird = 95;
       keys = 96;
-      #haproxy = 97; # DynamicUser as of 2019-11-08
+      #haproxy = 97; # dynamically allocated as of 2020-03-11
       #mongodb = 98; # unused
       openldap = 99;
       munin = 102;
diff --git a/nixos/modules/services/networking/haproxy.nix b/nixos/modules/services/networking/haproxy.nix
index aff71e5e97da..4678829986c6 100644
--- a/nixos/modules/services/networking/haproxy.nix
+++ b/nixos/modules/services/networking/haproxy.nix
@@ -26,6 +26,18 @@ with lib;
         '';
       };
 
+      user = mkOption {
+        type = types.str;
+        default = "haproxy";
+        description = "User account under which haproxy runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "haproxy";
+        description = "Group account under which haproxy runs.";
+      };
+
       config = mkOption {
         type = types.nullOr types.lines;
         default = null;
@@ -49,7 +61,8 @@ with lib;
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
-        DynamicUser = true;
+        User = cfg.user;
+        Group = cfg.group;
         Type = "notify";
         # when running the config test, don't be quiet so we can see what goes wrong
         ExecStartPre = "${pkgs.haproxy}/sbin/haproxy -c -f ${haproxyCfg}";
@@ -60,5 +73,16 @@ with lib;
         AmbientCapabilities = "CAP_NET_BIND_SERVICE";
       };
     };
+
+    users.users = optionalAttrs (cfg.user == "haproxy") {
+      haproxy = {
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = optionalAttrs (cfg.group == "haproxy") {
+      haproxy = {};
+    };
   };
 }

From ac23e5039cdc043ce9f098d5c7029ebe355607db Mon Sep 17 00:00:00 2001
From: Nathan Smyth <nathan.smyth@mongodb.com>
Date: Thu, 3 May 2018 17:42:24 +1000
Subject: [PATCH 02/40] mongodb: 3.4.10 -> 4.0.4

fix: Adding libtool to allow darwin compiles

Libtool seems to be required for mongodb to compile on darwin.

fix: Marking MongoDB as broken on aarch64

fix: Adding libtools to the pkg imports

Update mongodb to 4.0.4

(cherry picked from commit e9bec1adf6d4147d7b15d6b636ec5bf4294c457b)
---
 lib/licenses.nix                              |  7 +++++
 pkgs/servers/nosql/mongodb/default.nix        | 29 ++++++++++---------
 .../mongodb/forget-build-dependencies.patch   | 10 ++-----
 3 files changed, 26 insertions(+), 20 deletions(-)

diff --git a/lib/licenses.nix b/lib/licenses.nix
index e2f94e565ce2..e37eb57cff97 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -649,6 +649,13 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
     url = http://metadata.ftp-master.debian.org/changelogs/main/d/debianutils/debianutils_4.8.1_copyright;
   };
 
+  sspl = {
+    shortName = "SSPL";
+    fullName = "Server Side Public License";
+    url = https://www.mongodb.com/licensing/server-side-public-license;
+    free = false;
+  };
+
   tcltk = spdx {
     spdxId = "TCL";
     fullName = "TCL/TK License";
diff --git a/pkgs/servers/nosql/mongodb/default.nix b/pkgs/servers/nosql/mongodb/default.nix
index c2ae83f3e8af..966cebc799e4 100644
--- a/pkgs/servers/nosql/mongodb/default.nix
+++ b/pkgs/servers/nosql/mongodb/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchurl, fetchpatch, scons, boost, gperftools, pcre-cpp, snappy
-, zlib, libyamlcpp, sasl, openssl, libpcap, Security
+{ stdenv, fetchurl, fetchpatch, scons, boost, gperftools, pcre-cpp, snappy, zlib,
+  libyamlcpp, sasl, openssl, libpcap, wiredtiger, Security, python27, libtool, curl
 }:
 
 # Note:
@@ -7,7 +7,8 @@
 
 with stdenv.lib;
 
-let version = "3.4.10";
+let version = "4.0.4";
+    python = python27.withPackages (ps: with ps; [ pyyaml typing cheetah ]);
     system-libraries = [
       "pcre"
       #"asio" -- XXX use package?
@@ -19,6 +20,7 @@ let version = "3.4.10";
       #"stemmer"  -- not nice to package yet (no versioning, no makefile, no shared libs).
       "yaml"
     ] ++ optionals stdenv.isLinux [ "tcmalloc" ];
+    inherit (stdenv.lib) systems subtractLists;
 
 in stdenv.mkDerivation {
   pname = "mongodb";
@@ -26,14 +28,14 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://fastdl.mongodb.org/src/mongodb-src-r${version}.tar.gz";
-    sha256 = "1wz2mhl9z0b1bdkg6m8v8mvw9k60mdv5ybq554xn3yjj9z500f24";
+    sha256 = "1qycwr9f99b5cy4nf54yv2y724xis3lwd2h6iv2pfp36qnhsvfh2";
   };
 
   nativeBuildInputs = [ scons ];
   buildInputs = [
     sasl boost gperftools pcre-cpp snappy
-    zlib libyamlcpp sasl openssl.dev openssl.out libpcap
-  ] ++ stdenv.lib.optionals stdenv.isDarwin [ Security ];
+    zlib libyamlcpp sasl openssl.dev openssl.out libpcap python curl
+  ] ++ stdenv.lib.optionals stdenv.isDarwin [ Security libtool ];
 
   patches =
     [
@@ -41,11 +43,6 @@ in stdenv.mkDerivation {
       # keeping dependencies to build inputs in the final output.
       # We remove the build flags from buildInfo data.
       ./forget-build-dependencies.patch
-      (fetchpatch {
-        url = https://projects.archlinux.org/svntogit/community.git/plain/trunk/boost160.patch?h=packages/mongodb;
-        name = "boost160.patch";
-        sha256 = "0bvsf3499zj55pzamwjmsssr6x63w434944w76273fr5rxwzcmh8";
-      })
     ];
 
   postPatch = ''
@@ -89,6 +86,11 @@ in stdenv.mkDerivation {
   preInstall = ''
     mkdir -p $out/lib
   '';
+
+  postInstall = ''
+    rm $out/bin/install_compass
+  '';
+
   prefixKey = "--prefix=";
 
   enableParallelBuilding = true;
@@ -98,9 +100,10 @@ in stdenv.mkDerivation {
   meta = {
     description = "A scalable, high-performance, open source NoSQL database";
     homepage = http://www.mongodb.org;
-    license = licenses.agpl3;
+    license = licenses.sspl;
+    broken = stdenv.hostPlatform.isAarch64; #g++ has internal compiler errors
 
     maintainers = with maintainers; [ bluescreen303 offline cstrahan ];
-    platforms = platforms.unix;
+    platforms = subtractLists systems.doubles.i686 systems.doubles.unix;
   };
 }
diff --git a/pkgs/servers/nosql/mongodb/forget-build-dependencies.patch b/pkgs/servers/nosql/mongodb/forget-build-dependencies.patch
index ca2c043deb2d..897618cceb12 100644
--- a/pkgs/servers/nosql/mongodb/forget-build-dependencies.patch
+++ b/pkgs/servers/nosql/mongodb/forget-build-dependencies.patch
@@ -1,8 +1,6 @@
---- a/site_scons/mongo_scons_utils.py
-+++ b/site_scons/mongo_scons_utils.py
-@@ -84,14 +84,11 @@
- def default_buildinfo_environment_data():
-     return (
+--- a/site_scons/mongo/generators.py
++++ b/site_scons/mongo/generators.py
+@@ -18,10 +18,7 @@ def default_buildinfo_environment_data():
          ('distmod', '$MONGO_DISTMOD', True, True,),
          ('distarch', '$MONGO_DISTARCH', True, True,),
          ('cc', '$CC_VERSION', True, False,),
@@ -13,5 +11,3 @@
          ('target_arch', '$TARGET_ARCH', True, True,),
          ('target_os', '$TARGET_OS', True, False,),
      )
- 
- # If you want buildInfo and --version to be relatively empty, set

From 54d29441724b892d92beb60fd318340605a8fbdb Mon Sep 17 00:00:00 2001
From: Nathan Smyth <nathan.smyth@mongodb.com>
Date: Fri, 31 May 2019 22:14:14 +1000
Subject: [PATCH 03/40] mongodb: split packages to expose 3.4, 3.6 and 4.0

(cherry picked from commit 97c4dff1583b871605964c165056074f0a502d0b)
---
 .../forget-build-dependencies-3-4.patch       | 17 ++++
 .../mongodb/{default.nix => mongodb.nix}      | 79 +++++++++++--------
 pkgs/servers/nosql/mongodb/v3_4.nix           | 12 +++
 pkgs/servers/nosql/mongodb/v3_6.nix           | 12 +++
 pkgs/servers/nosql/mongodb/v4_0.nix           | 12 +++
 pkgs/top-level/all-packages.nix               | 16 +++-
 6 files changed, 113 insertions(+), 35 deletions(-)
 create mode 100644 pkgs/servers/nosql/mongodb/forget-build-dependencies-3-4.patch
 rename pkgs/servers/nosql/mongodb/{default.nix => mongodb.nix} (63%)
 create mode 100644 pkgs/servers/nosql/mongodb/v3_4.nix
 create mode 100644 pkgs/servers/nosql/mongodb/v3_6.nix
 create mode 100644 pkgs/servers/nosql/mongodb/v4_0.nix

diff --git a/pkgs/servers/nosql/mongodb/forget-build-dependencies-3-4.patch b/pkgs/servers/nosql/mongodb/forget-build-dependencies-3-4.patch
new file mode 100644
index 000000000000..ca2c043deb2d
--- /dev/null
+++ b/pkgs/servers/nosql/mongodb/forget-build-dependencies-3-4.patch
@@ -0,0 +1,17 @@
+--- a/site_scons/mongo_scons_utils.py
++++ b/site_scons/mongo_scons_utils.py
+@@ -84,14 +84,11 @@
+ def default_buildinfo_environment_data():
+     return (
+         ('distmod', '$MONGO_DISTMOD', True, True,),
+         ('distarch', '$MONGO_DISTARCH', True, True,),
+         ('cc', '$CC_VERSION', True, False,),
+-        ('ccflags', '$CCFLAGS', True, False,),
+         ('cxx', '$CXX_VERSION', True, False,),
+-        ('cxxflags', '$CXXFLAGS', True, False,),
+-        ('linkflags', '$LINKFLAGS', True, False,),
+         ('target_arch', '$TARGET_ARCH', True, True,),
+         ('target_os', '$TARGET_OS', True, False,),
+     )
+ 
+ # If you want buildInfo and --version to be relatively empty, set
diff --git a/pkgs/servers/nosql/mongodb/default.nix b/pkgs/servers/nosql/mongodb/mongodb.nix
similarity index 63%
rename from pkgs/servers/nosql/mongodb/default.nix
rename to pkgs/servers/nosql/mongodb/mongodb.nix
index 966cebc799e4..fd4869f92aa2 100644
--- a/pkgs/servers/nosql/mongodb/default.nix
+++ b/pkgs/servers/nosql/mongodb/mongodb.nix
@@ -1,49 +1,59 @@
-{ stdenv, fetchurl, fetchpatch, scons, boost, gperftools, pcre-cpp, snappy, zlib,
-  libyamlcpp, sasl, openssl, libpcap, wiredtiger, Security, python27, libtool, curl
-}:
+{ stdenv, fetchurl, fetchpatch, scons, boost, gperftools, pcre-cpp, snappy, zlib
+, libyamlcpp, sasl, openssl, libpcap, wiredtiger, Security, python27, libtool
+, curl }:
 
 # Note:
 # The command line tools are written in Go as part of a different package (mongodb-tools)
 
 with stdenv.lib;
 
-let version = "4.0.4";
-    python = python27.withPackages (ps: with ps; [ pyyaml typing cheetah ]);
-    system-libraries = [
-      "pcre"
-      #"asio" -- XXX use package?
-      #"wiredtiger"
-      "boost"
-      "snappy"
-      "zlib"
-      #"valgrind" -- mongodb only requires valgrind.h, which is vendored in the source.
-      #"stemmer"  -- not nice to package yet (no versioning, no makefile, no shared libs).
-      "yaml"
-    ] ++ optionals stdenv.isLinux [ "tcmalloc" ];
-    inherit (stdenv.lib) systems subtractLists;
+{ version, sha256, patches ? [ ] }@args:
 
-in stdenv.mkDerivation {
-  pname = "mongodb";
+let
+  python = python27.withPackages (ps: with ps; [ pyyaml typing cheetah ]);
+  system-libraries = [
+    "pcre"
+    #"asio" -- XXX use package?
+    #"wiredtiger"
+    "boost"
+    "snappy"
+    "zlib"
+    #"valgrind" -- mongodb only requires valgrind.h, which is vendored in the source.
+    #"stemmer"  -- not nice to package yet (no versioning, no makefile, no shared libs).
+    "yaml"
+  ] ++ optionals stdenv.isLinux [ "tcmalloc" ];
+  inherit (stdenv.lib) systems subtractLists;
+
+in stdenv.mkDerivation rec {
   inherit version;
+  name = "mongodb-${version}";
 
   src = fetchurl {
     url = "https://fastdl.mongodb.org/src/mongodb-src-r${version}.tar.gz";
-    sha256 = "1qycwr9f99b5cy4nf54yv2y724xis3lwd2h6iv2pfp36qnhsvfh2";
+    inherit sha256;
   };
 
   nativeBuildInputs = [ scons ];
   buildInputs = [
-    sasl boost gperftools pcre-cpp snappy
-    zlib libyamlcpp sasl openssl.dev openssl.out libpcap python curl
+    sasl
+    boost
+    gperftools
+    pcre-cpp
+    snappy
+    zlib
+    libyamlcpp
+    sasl
+    openssl.dev
+    openssl.out
+    libpcap
+    python
+    curl
   ] ++ stdenv.lib.optionals stdenv.isDarwin [ Security libtool ];
 
-  patches =
-    [
-      # MongoDB keeps track of its build parameters, which tricks nix into
-      # keeping dependencies to build inputs in the final output.
-      # We remove the build flags from buildInfo data.
-      ./forget-build-dependencies.patch
-    ];
+  # MongoDB keeps track of its build parameters, which tricks nix into
+  # keeping dependencies to build inputs in the final output.
+  # We remove the build flags from buildInfo data.
+  inherit patches;
 
   postPatch = ''
     # fix environment variable reading
@@ -63,7 +73,8 @@ in stdenv.mkDerivation {
       --replace 'engine("wiredTiger")' 'engine("mmapv1")'
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang
+    "-Wno-unused-command-line-argument";
 
   sconsFlags = [
     "--release"
@@ -84,11 +95,11 @@ in stdenv.mkDerivation {
   '';
 
   preInstall = ''
-    mkdir -p $out/lib
+    mkdir -p "$out/lib"
   '';
 
   postInstall = ''
-    rm $out/bin/install_compass
+    rm -f "$out/bin/install_compass" || true
   '';
 
   prefixKey = "--prefix=";
@@ -99,9 +110,9 @@ in stdenv.mkDerivation {
 
   meta = {
     description = "A scalable, high-performance, open source NoSQL database";
-    homepage = http://www.mongodb.org;
+    homepage = "http://www.mongodb.org";
     license = licenses.sspl;
-    broken = stdenv.hostPlatform.isAarch64; #g++ has internal compiler errors
+    broken = stdenv.hostPlatform.isAarch64; # g++ has internal compiler errors
 
     maintainers = with maintainers; [ bluescreen303 offline cstrahan ];
     platforms = subtractLists systems.doubles.i686 systems.doubles.unix;
diff --git a/pkgs/servers/nosql/mongodb/v3_4.nix b/pkgs/servers/nosql/mongodb/v3_4.nix
new file mode 100644
index 000000000000..07d27545a583
--- /dev/null
+++ b/pkgs/servers/nosql/mongodb/v3_4.nix
@@ -0,0 +1,12 @@
+{ stdenv, callPackage, lib, sasl, boost, Security }:
+
+let
+  buildMongoDB = callPackage ./mongodb.nix { inherit sasl; inherit boost; inherit Security; };
+in
+  buildMongoDB {
+    version = "3.4.20";
+    sha256 = "15avrhakbspz0q1w5n7dqzjjfkxi7md64a9axl97gfxi4ln7mhz0";
+    patches = [
+      ./forget-build-dependencies-3-4.patch
+    ];
+  }
diff --git a/pkgs/servers/nosql/mongodb/v3_6.nix b/pkgs/servers/nosql/mongodb/v3_6.nix
new file mode 100644
index 000000000000..9000a2b5ed5f
--- /dev/null
+++ b/pkgs/servers/nosql/mongodb/v3_6.nix
@@ -0,0 +1,12 @@
+{ stdenv, callPackage, lib, sasl, boost, Security }:
+
+let
+  buildMongoDB = callPackage ./mongodb.nix { inherit sasl; inherit boost; inherit Security; };
+in
+  buildMongoDB {
+    version = "3.6.12";
+    sha256 = "1fi1ccid4rnfjg6yn3183qrhjqc8hz7jfgdpwp1dy6piw6z85n3l";
+    patches = [
+      ./forget-build-dependencies.patch
+    ];
+  }
diff --git a/pkgs/servers/nosql/mongodb/v4_0.nix b/pkgs/servers/nosql/mongodb/v4_0.nix
new file mode 100644
index 000000000000..75e0cecc573e
--- /dev/null
+++ b/pkgs/servers/nosql/mongodb/v4_0.nix
@@ -0,0 +1,12 @@
+{ stdenv, callPackage, lib, sasl, boost, Security }:
+
+let
+  buildMongoDB = callPackage ./mongodb.nix { inherit sasl; inherit boost; inherit Security; };
+in
+  buildMongoDB {
+    version = "4.0.9";
+    sha256 = "0klm6dl1pr9wq4ghm2jjn3wzs1zpj1aabqjqjfddanxq2an7scph";
+    patches = [
+      ./forget-build-dependencies.patch
+    ];
+  }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fe99b8bae836..5b59bd0325b4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15531,7 +15531,21 @@ in
   };
   mysql = mariadb; # TODO: move to aliases.nix
 
-  mongodb = callPackage ../servers/nosql/mongodb {
+  mongodb = hiPrio mongodb-3_4;
+  
+  mongodb-3_4 = callPackage ../servers/nosql/mongodb/v3_4.nix {
+    sasl = cyrus_sasl;
+    boost = boost160;
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
+  mongodb-3_6 = callPackage ../servers/nosql/mongodb/v3_6.nix {
+    sasl = cyrus_sasl;
+    boost = boost160;
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
+  mongodb-4_0 = callPackage ../servers/nosql/mongodb/v4_0.nix {
     sasl = cyrus_sasl;
     boost = boost160;
     openssl = openssl_1_0_2;

From 83d71242f350aba6d30724d8af8df1bc2989f5db Mon Sep 17 00:00:00 2001
From: Nathan Smyth <nathan.smyth@mongodb.com>
Date: Sun, 4 Aug 2019 13:09:49 +1000
Subject: [PATCH 04/40] mongodb: 3.4.20 -> 3.4.22, 3.6.12 -> 3.6.13, 4.0.9 ->
 4.0.11

(cherry picked from commit 165d8bda8265ca9c247d1ab5e1137117c3236e25)
---
 pkgs/servers/nosql/mongodb/mongodb.nix        | 32 ++++++++-----------
 .../mongodb/mozjs-45_fix-3-byte-opcode.patch  | 27 ++++++++++++++++
 pkgs/servers/nosql/mongodb/v3_4.nix           |  8 ++---
 pkgs/servers/nosql/mongodb/v3_6.nix           |  8 ++---
 pkgs/servers/nosql/mongodb/v4_0.nix           |  9 +++---
 pkgs/top-level/all-packages.nix               | 12 ++++---
 6 files changed, 61 insertions(+), 35 deletions(-)
 create mode 100644 pkgs/servers/nosql/mongodb/mozjs-45_fix-3-byte-opcode.patch

diff --git a/pkgs/servers/nosql/mongodb/mongodb.nix b/pkgs/servers/nosql/mongodb/mongodb.nix
index fd4869f92aa2..3824fc6d1a74 100644
--- a/pkgs/servers/nosql/mongodb/mongodb.nix
+++ b/pkgs/servers/nosql/mongodb/mongodb.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchurl, fetchpatch, scons, boost, gperftools, pcre-cpp, snappy, zlib
-, libyamlcpp, sasl, openssl, libpcap, wiredtiger, Security, python27, libtool
-, curl }:
+{ stdenv, fetchurl, fetchpatch, scons, boost, gperftools, pcre-cpp, snappy, zlib,
+  libyamlcpp, sasl, openssl, libpcap, wiredtiger, Security, python27, curl, CoreFoundation, cctools
+}:
 
 # Note:
 # The command line tools are written in Go as part of a different package (mongodb-tools)
@@ -35,20 +35,9 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ scons ];
   buildInputs = [
-    sasl
-    boost
-    gperftools
-    pcre-cpp
-    snappy
-    zlib
-    libyamlcpp
-    sasl
-    openssl.dev
-    openssl.out
-    libpcap
-    python
-    curl
-  ] ++ stdenv.lib.optionals stdenv.isDarwin [ Security libtool ];
+    sasl boost gperftools pcre-cpp snappy
+    zlib libyamlcpp sasl openssl.dev openssl.out libpcap python curl
+  ] ++ stdenv.lib.optionals stdenv.isDarwin [ Security CoreFoundation cctools ];
 
   # MongoDB keeps track of its build parameters, which tricks nix into
   # keeping dependencies to build inputs in the final output.
@@ -60,6 +49,9 @@ in stdenv.mkDerivation rec {
     substituteInPlace SConstruct \
         --replace "env = Environment(" "env = Environment(ENV = os.environ,"
   '' + stdenv.lib.optionalString stdenv.isDarwin ''
+    substituteInPlace src/third_party/asio-master/asio/include/asio/detail/config.hpp --replace ASIO_HAS_STD_EXPERIMENTAL_STRING_VIEW ASIO_HAS_STD_STRING_VIEW
+
+    substituteInPlace src/third_party/mozjs-45/extract/js/src/jsmath.cpp --replace 'defined(HAVE_SINCOS)' 0
 
     substituteInPlace src/third_party/s2/s1angle.cc --replace drem remainder
     substituteInPlace src/third_party/s2/s1interval.cc --replace drem remainder
@@ -80,7 +72,7 @@ in stdenv.mkDerivation rec {
     "--release"
     "--ssl"
     #"--rocksdb" # Don't have this packaged yet
-    "--wiredtiger=${if stdenv.is64bit then "on" else "off"}"
+    "--wiredtiger=on"
     "--js-engine=mozjs"
     "--use-sasl-client"
     "--disable-warnings-as-errors"
@@ -92,6 +84,10 @@ in stdenv.mkDerivation rec {
     sconsFlags+=" CXX=$CXX"
   '' + optionalString stdenv.isAarch64 ''
     sconsFlags+=" CCFLAGS='-march=armv8-a+crc'"
+  '' + optionalString stdenv.isDarwin ''
+    sconsFlags+=" CPPPATH=${openssl.dev}/include"
+  '' + optionalString stdenv.isDarwin ''
+    sconsFlags+=" LIBPATH=${openssl.out}/lib"
   '';
 
   preInstall = ''
diff --git a/pkgs/servers/nosql/mongodb/mozjs-45_fix-3-byte-opcode.patch b/pkgs/servers/nosql/mongodb/mozjs-45_fix-3-byte-opcode.patch
new file mode 100644
index 000000000000..8c60cdd1e688
--- /dev/null
+++ b/pkgs/servers/nosql/mongodb/mozjs-45_fix-3-byte-opcode.patch
@@ -0,0 +1,27 @@
+# HG changeset patch
+# User Dan Gohman <sunfish@mozilla.com>
+# Parent  d9b405d82cffb07343a5f2fd941e029298c7f6c4
+# Bug 1390214 - IonMonkey: Don't test for a 3-byte opcode in a 2-byte opcode predicate.
+# https://bug1390214.bmoattachments.org/attachment.cgi?id=8902972
+
+diff --git a/src/third_party/mozjs-45/extract/js/src/jit/x86-shared/Encoding-x86-shared.h b/src/third_party/mozjs-45/extract/js/src/jit/x86-shared/Encoding-x86-shared.h
+--- a/src/third_party/mozjs-45/extract/js/src/jit/x86-shared/Encoding-x86-shared.h
++++ b/src/third_party/mozjs-45/extract/js/src/jit/x86-shared/Encoding-x86-shared.h
+@@ -310,17 +310,16 @@ enum ThreeByteOpcodeID {
+ 
+ // Test whether the given opcode should be printed with its operands reversed.
+ inline bool IsXMMReversedOperands(TwoByteOpcodeID opcode)
+ {
+     switch (opcode) {
+       case OP2_MOVSD_WsdVsd: // also OP2_MOVPS_WpsVps
+       case OP2_MOVAPS_WsdVsd:
+       case OP2_MOVDQ_WdqVdq:
+-      case OP3_PEXTRD_EdVdqIb:
+         return true;
+       default:
+         break;
+     }
+     return false;
+ }
+ 
+ enum ThreeByteEscape {
diff --git a/pkgs/servers/nosql/mongodb/v3_4.nix b/pkgs/servers/nosql/mongodb/v3_4.nix
index 07d27545a583..fb124a6b2e5b 100644
--- a/pkgs/servers/nosql/mongodb/v3_4.nix
+++ b/pkgs/servers/nosql/mongodb/v3_4.nix
@@ -1,11 +1,11 @@
-{ stdenv, callPackage, lib, sasl, boost, Security }:
+{ stdenv, callPackage, lib, sasl, boost, Security, CoreFoundation, cctools }:
 
 let
-  buildMongoDB = callPackage ./mongodb.nix { inherit sasl; inherit boost; inherit Security; };
+  buildMongoDB = callPackage ./mongodb.nix { inherit sasl; inherit boost; inherit Security; inherit CoreFoundation; inherit cctools; };
 in
   buildMongoDB {
-    version = "3.4.20";
-    sha256 = "15avrhakbspz0q1w5n7dqzjjfkxi7md64a9axl97gfxi4ln7mhz0";
+    version = "3.4.22";
+    sha256 = "1rizrr69b26y7fb973n52hk387sf3mxzqg8wka4f3zdjdidfyiny";
     patches = [
       ./forget-build-dependencies-3-4.patch
     ];
diff --git a/pkgs/servers/nosql/mongodb/v3_6.nix b/pkgs/servers/nosql/mongodb/v3_6.nix
index 9000a2b5ed5f..412d72b4e668 100644
--- a/pkgs/servers/nosql/mongodb/v3_6.nix
+++ b/pkgs/servers/nosql/mongodb/v3_6.nix
@@ -1,11 +1,11 @@
-{ stdenv, callPackage, lib, sasl, boost, Security }:
+{ stdenv, callPackage, lib, sasl, boost, Security, CoreFoundation, cctools }:
 
 let
-  buildMongoDB = callPackage ./mongodb.nix { inherit sasl; inherit boost; inherit Security; };
+  buildMongoDB = callPackage ./mongodb.nix { inherit sasl; inherit boost; inherit Security; inherit CoreFoundation; inherit cctools; };
 in
   buildMongoDB {
-    version = "3.6.12";
-    sha256 = "1fi1ccid4rnfjg6yn3183qrhjqc8hz7jfgdpwp1dy6piw6z85n3l";
+    version = "3.6.13";
+    sha256 = "1mbvk4bmabrswjdm01jssxcygjpq5799zqyx901nsi12vlcymwg4";
     patches = [
       ./forget-build-dependencies.patch
     ];
diff --git a/pkgs/servers/nosql/mongodb/v4_0.nix b/pkgs/servers/nosql/mongodb/v4_0.nix
index 75e0cecc573e..819d41cd17ee 100644
--- a/pkgs/servers/nosql/mongodb/v4_0.nix
+++ b/pkgs/servers/nosql/mongodb/v4_0.nix
@@ -1,12 +1,13 @@
-{ stdenv, callPackage, lib, sasl, boost, Security }:
+{ stdenv, callPackage, lib, sasl, boost, Security, CoreFoundation, cctools }:
 
 let
-  buildMongoDB = callPackage ./mongodb.nix { inherit sasl; inherit boost; inherit Security; };
+  buildMongoDB = callPackage ./mongodb.nix { inherit sasl; inherit boost; inherit Security; inherit CoreFoundation; inherit cctools; };
 in
   buildMongoDB {
-    version = "4.0.9";
-    sha256 = "0klm6dl1pr9wq4ghm2jjn3wzs1zpj1aabqjqjfddanxq2an7scph";
+    version = "4.0.11";
+    sha256 = "0kry8kzzpah0l7j8xa333y1ixwvarc28ip3f6lx5590yy11j8ry2";
     patches = [
       ./forget-build-dependencies.patch
+      ./mozjs-45_fix-3-byte-opcode.patch
     ];
   }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5b59bd0325b4..67d7b8a896bc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15536,20 +15536,22 @@ in
   mongodb-3_4 = callPackage ../servers/nosql/mongodb/v3_4.nix {
     sasl = cyrus_sasl;
     boost = boost160;
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin) cctools;
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
   };
 
   mongodb-3_6 = callPackage ../servers/nosql/mongodb/v3_6.nix {
     sasl = cyrus_sasl;
     boost = boost160;
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin) cctools;
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
   };
 
   mongodb-4_0 = callPackage ../servers/nosql/mongodb/v4_0.nix {
     sasl = cyrus_sasl;
-    boost = boost160;
-    openssl = openssl_1_0_2;
-    inherit (darwin.apple_sdk.frameworks) Security;
+    boost = boost169;
+    inherit (darwin) cctools;
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
   };
 
   nginx-sso = callPackage ../servers/nginx-sso { };

From 2cba56ec37a4ad766bd35fa43b5b24645d1a88c5 Mon Sep 17 00:00:00 2001
From: Nathan Smyth <nathan.smyth@mongodb.com>
Date: Sun, 4 Aug 2019 16:25:56 +1000
Subject: [PATCH 05/40] nixos/tests/mongodb: test against mongodb versions 3.4,
 3.6, 4.0

Now has tests for 3.4, 3.6, 4.0. Has some duplication, but it appears to
work on my machine.

(cherry picked from commit 44641ed00bf3b1d5914a685137f16910f6454951)
---
 nixos/tests/mongodb.nix                | 74 +++++++++++++-------------
 pkgs/servers/nosql/mongodb/mongodb.nix | 37 +++++++------
 pkgs/servers/nosql/mongodb/v3_4.nix    | 21 ++++----
 pkgs/servers/nosql/mongodb/v3_6.nix    | 21 ++++----
 pkgs/servers/nosql/mongodb/v4_0.nix    | 23 ++++----
 5 files changed, 95 insertions(+), 81 deletions(-)

diff --git a/nixos/tests/mongodb.nix b/nixos/tests/mongodb.nix
index 9ebf84eed232..dfb23ce6c0db 100644
--- a/nixos/tests/mongodb.nix
+++ b/nixos/tests/mongodb.nix
@@ -1,42 +1,42 @@
 # This test start mongodb, runs a query using mongo shell
 
-import ./make-test-python.nix ({ pkgs, ...} : let
-  testQuery = pkgs.writeScript "nixtest.js" ''
-    db.greetings.insert({ "greeting": "hello" });
-    print(db.greetings.findOne().greeting);
-  '';
-in {
-  name = "mongodb";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ bluescreen303 offline cstrahan rvl phile314 ];
-  };
+import ./make-test.nix ({ pkgs, ... }:
+  let
+    testQuery = pkgs.writeScript "nixtest.js" ''
+      db.greetings.insert({ "greeting": "hello" });
+      print(db.greetings.findOne().greeting);
+    '';
 
-  nodes = {
-    one =
-      { ... }:
-        {
-          services = {
-           mongodb.enable = true;
-           mongodb.enableAuth = true;
-           mongodb.initialRootPassword = "root";
-           mongodb.initialScript = pkgs.writeText "mongodb_initial.js" ''
-             db = db.getSiblingDB("nixtest");
-             db.createUser({user:"nixtest",pwd:"nixtest",roles:[{role:"readWrite",db:"nixtest"}]});
-           '';
-           mongodb.extraConfig = ''
-             # Allow starting engine with only a small virtual disk
-             storage.journal.enabled: false
-             storage.mmapv1.smallFiles: true
-           '';
-          };
-        };
+    runMongoDBTest = pkg: ''
+      $node->execute("(rm -rf data || true) && mkdir data");
+      $node->execute("${pkg}/bin/mongod --fork --logpath logs --dbpath data");
+      $node->waitForOpenPort(27017);
+
+      $node->succeed("mongo ${testQuery}") =~ /hello/ or die;
+
+      $node->execute("${pkg}/bin/mongod --shutdown --dbpath data");
+      $node->waitForClosedPort(27017);
+    '';
+
+  in {
+    name = "mongodb";
+    meta = with pkgs.stdenv.lib.maintainers; {
+      maintainers = [ bluescreen303 offline cstrahan rvl phile314 ];
     };
 
-  testScript = ''
-    start_all()
-    one.wait_for_unit("mongodb.service")
-    one.succeed(
-        "mongo -u nixtest -p nixtest nixtest ${testQuery} | grep -q hello"
-    )
-  '';
-})
+    nodes = {
+      node = {...}: {
+        environment.systemPackages = with pkgs; [
+#          mongodb-3_4
+          mongodb-3_6
+          mongodb-4_0
+        ];
+      };
+    };
+
+    testScript = "$node->start;" 
+#      + runMongoDBTest pkgs.mongodb-3_4
+      + runMongoDBTest pkgs.mongodb-3_6 
+      + runMongoDBTest pkgs.mongodb-4_0
+      + "$node->shutdown;";
+  })
diff --git a/pkgs/servers/nosql/mongodb/mongodb.nix b/pkgs/servers/nosql/mongodb/mongodb.nix
index 3824fc6d1a74..da4b46a69da5 100644
--- a/pkgs/servers/nosql/mongodb/mongodb.nix
+++ b/pkgs/servers/nosql/mongodb/mongodb.nix
@@ -1,26 +1,25 @@
-{ stdenv, fetchurl, fetchpatch, scons, boost, gperftools, pcre-cpp, snappy, zlib,
-  libyamlcpp, sasl, openssl, libpcap, wiredtiger, Security, python27, curl, CoreFoundation, cctools
-}:
+{ stdenv, fetchurl, scons, boost, gperftools, pcre-cpp, snappy, zlib, libyamlcpp
+, sasl, openssl, libpcap, python27, curl, Security, CoreFoundation, cctools }:
 
 # Note:
 # The command line tools are written in Go as part of a different package (mongodb-tools)
 
 with stdenv.lib;
 
-{ version, sha256, patches ? [ ] }@args:
+{ version, sha256, patches ? [] }@args:
 
 let
   python = python27.withPackages (ps: with ps; [ pyyaml typing cheetah ]);
   system-libraries = [
-    "pcre"
-    #"asio" -- XXX use package?
-    #"wiredtiger"
     "boost"
+    "pcre"
     "snappy"
-    "zlib"
-    #"valgrind" -- mongodb only requires valgrind.h, which is vendored in the source.
-    #"stemmer"  -- not nice to package yet (no versioning, no makefile, no shared libs).
     "yaml"
+    "zlib"
+    #"asio" -- XXX use package?
+    #"stemmer"  -- not nice to package yet (no versioning, no makefile, no shared libs).
+    #"valgrind" -- mongodb only requires valgrind.h, which is vendored in the source.
+    #"wiredtiger"
   ] ++ optionals stdenv.isLinux [ "tcmalloc" ];
   inherit (stdenv.lib) systems subtractLists;
 
@@ -35,8 +34,18 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ scons ];
   buildInputs = [
-    sasl boost gperftools pcre-cpp snappy
-    zlib libyamlcpp sasl openssl.dev openssl.out libpcap python curl
+    boost
+    curl
+    gperftools
+    libpcap
+    libyamlcpp
+    openssl.dev
+    openssl.out
+    pcre-cpp
+    python
+    sasl
+    snappy
+    zlib
   ] ++ stdenv.lib.optionals stdenv.isDarwin [ Security CoreFoundation cctools ];
 
   # MongoDB keeps track of its build parameters, which tricks nix into
@@ -84,10 +93,6 @@ in stdenv.mkDerivation rec {
     sconsFlags+=" CXX=$CXX"
   '' + optionalString stdenv.isAarch64 ''
     sconsFlags+=" CCFLAGS='-march=armv8-a+crc'"
-  '' + optionalString stdenv.isDarwin ''
-    sconsFlags+=" CPPPATH=${openssl.dev}/include"
-  '' + optionalString stdenv.isDarwin ''
-    sconsFlags+=" LIBPATH=${openssl.out}/lib"
   '';
 
   preInstall = ''
diff --git a/pkgs/servers/nosql/mongodb/v3_4.nix b/pkgs/servers/nosql/mongodb/v3_4.nix
index fb124a6b2e5b..113fa0680c3b 100644
--- a/pkgs/servers/nosql/mongodb/v3_4.nix
+++ b/pkgs/servers/nosql/mongodb/v3_4.nix
@@ -1,12 +1,15 @@
 { stdenv, callPackage, lib, sasl, boost, Security, CoreFoundation, cctools }:
 
 let
-  buildMongoDB = callPackage ./mongodb.nix { inherit sasl; inherit boost; inherit Security; inherit CoreFoundation; inherit cctools; };
-in
-  buildMongoDB {
-    version = "3.4.22";
-    sha256 = "1rizrr69b26y7fb973n52hk387sf3mxzqg8wka4f3zdjdidfyiny";
-    patches = [
-      ./forget-build-dependencies-3-4.patch
-    ];
-  }
+  buildMongoDB = callPackage ./mongodb.nix {
+    inherit sasl;
+    inherit boost;
+    inherit Security;
+    inherit CoreFoundation;
+    inherit cctools;
+  };
+in buildMongoDB {
+  version = "3.4.22";
+  sha256 = "1rizrr69b26y7fb973n52hk387sf3mxzqg8wka4f3zdjdidfyiny";
+  patches = [ ./forget-build-dependencies-3-4.patch ];
+}
diff --git a/pkgs/servers/nosql/mongodb/v3_6.nix b/pkgs/servers/nosql/mongodb/v3_6.nix
index 412d72b4e668..8da901c00c53 100644
--- a/pkgs/servers/nosql/mongodb/v3_6.nix
+++ b/pkgs/servers/nosql/mongodb/v3_6.nix
@@ -1,12 +1,15 @@
 { stdenv, callPackage, lib, sasl, boost, Security, CoreFoundation, cctools }:
 
 let
-  buildMongoDB = callPackage ./mongodb.nix { inherit sasl; inherit boost; inherit Security; inherit CoreFoundation; inherit cctools; };
-in
-  buildMongoDB {
-    version = "3.6.13";
-    sha256 = "1mbvk4bmabrswjdm01jssxcygjpq5799zqyx901nsi12vlcymwg4";
-    patches = [
-      ./forget-build-dependencies.patch
-    ];
-  }
+  buildMongoDB = callPackage ./mongodb.nix {
+    inherit sasl;
+    inherit boost;
+    inherit Security;
+    inherit CoreFoundation;
+    inherit cctools;
+  };
+in buildMongoDB {
+  version = "3.6.13";
+  sha256 = "1mbvk4bmabrswjdm01jssxcygjpq5799zqyx901nsi12vlcymwg4";
+  patches = [ ./forget-build-dependencies.patch ];
+}
diff --git a/pkgs/servers/nosql/mongodb/v4_0.nix b/pkgs/servers/nosql/mongodb/v4_0.nix
index 819d41cd17ee..95606317f319 100644
--- a/pkgs/servers/nosql/mongodb/v4_0.nix
+++ b/pkgs/servers/nosql/mongodb/v4_0.nix
@@ -1,13 +1,16 @@
 { stdenv, callPackage, lib, sasl, boost, Security, CoreFoundation, cctools }:
 
 let
-  buildMongoDB = callPackage ./mongodb.nix { inherit sasl; inherit boost; inherit Security; inherit CoreFoundation; inherit cctools; };
-in
-  buildMongoDB {
-    version = "4.0.11";
-    sha256 = "0kry8kzzpah0l7j8xa333y1ixwvarc28ip3f6lx5590yy11j8ry2";
-    patches = [
-      ./forget-build-dependencies.patch
-      ./mozjs-45_fix-3-byte-opcode.patch
-    ];
-  }
+  buildMongoDB = callPackage ./mongodb.nix {
+    inherit sasl;
+    inherit boost;
+    inherit Security;
+    inherit CoreFoundation;
+    inherit cctools;
+  };
+in buildMongoDB {
+  version = "4.0.11";
+  sha256 = "0kry8kzzpah0l7j8xa333y1ixwvarc28ip3f6lx5590yy11j8ry2";
+  patches =
+    [ ./forget-build-dependencies.patch ./mozjs-45_fix-3-byte-opcode.patch ];
+}

From ef9bd8e2440a6ca4664135a0fd5f3ab404ed78f6 Mon Sep 17 00:00:00 2001
From: Nathan Smyth <nathan.smyth@mongodb.com>
Date: Wed, 21 Aug 2019 19:33:51 +1000
Subject: [PATCH 06/40] mongodb-4_0: 4.0.11 -> 4.0.12

(cherry picked from commit de69821b541a6143c7b5d31afe463ab3c2cf918b)
---
 .../asio-no-experimental-string-view.patch    | 20 +++++++++++++++++++
 pkgs/servers/nosql/mongodb/mongodb.nix        |  2 --
 pkgs/servers/nosql/mongodb/v3_6.nix           |  3 ++-
 pkgs/servers/nosql/mongodb/v4_0.nix           |  7 ++++---
 4 files changed, 26 insertions(+), 6 deletions(-)
 create mode 100644 pkgs/servers/nosql/mongodb/asio-no-experimental-string-view.patch

diff --git a/pkgs/servers/nosql/mongodb/asio-no-experimental-string-view.patch b/pkgs/servers/nosql/mongodb/asio-no-experimental-string-view.patch
new file mode 100644
index 000000000000..eb5db1818fe0
--- /dev/null
+++ b/pkgs/servers/nosql/mongodb/asio-no-experimental-string-view.patch
@@ -0,0 +1,20 @@
+diff --git a/src/third_party/asio-master/asio/include/asio/detail/config.hpp b/src/third_party/asio-master/asio/include/asio/detail/config.hpp
+index 7fe6a95a..ff4cc56b 100644
+--- a/src/third_party/asio-master/asio/include/asio/detail/config.hpp
++++ b/src/third_party/asio-master/asio/include/asio/detail/config.hpp
+@@ -786,7 +786,6 @@
+ #   if (__cplusplus >= 201402)
+ #    if __has_include(<experimental/string_view>)
+ #     define ASIO_HAS_STD_STRING_VIEW 1
+-#     define ASIO_HAS_STD_EXPERIMENTAL_STRING_VIEW 1
+ #    endif // __has_include(<experimental/string_view>)
+ #   endif // (__cplusplus >= 201402)
+ #  endif // defined(__clang__)
+@@ -794,7 +793,6 @@
+ #   if ((__GNUC__ == 4) && (__GNUC_MINOR__ >= 9)) || (__GNUC__ > 4)
+ #    if (__cplusplus >= 201402)
+ #     define ASIO_HAS_STD_STRING_VIEW 1
+-#     define ASIO_HAS_STD_EXPERIMENTAL_STRING_VIEW 1
+ #    endif // (__cplusplus >= 201402)
+ #   endif // ((__GNUC__ == 4) && (__GNUC_MINOR__ >= 7)) || (__GNUC__ > 4)
+ #  endif // defined(__GNUC__)
diff --git a/pkgs/servers/nosql/mongodb/mongodb.nix b/pkgs/servers/nosql/mongodb/mongodb.nix
index da4b46a69da5..3f5aeb4d7da8 100644
--- a/pkgs/servers/nosql/mongodb/mongodb.nix
+++ b/pkgs/servers/nosql/mongodb/mongodb.nix
@@ -58,8 +58,6 @@ in stdenv.mkDerivation rec {
     substituteInPlace SConstruct \
         --replace "env = Environment(" "env = Environment(ENV = os.environ,"
   '' + stdenv.lib.optionalString stdenv.isDarwin ''
-    substituteInPlace src/third_party/asio-master/asio/include/asio/detail/config.hpp --replace ASIO_HAS_STD_EXPERIMENTAL_STRING_VIEW ASIO_HAS_STD_STRING_VIEW
-
     substituteInPlace src/third_party/mozjs-45/extract/js/src/jsmath.cpp --replace 'defined(HAVE_SINCOS)' 0
 
     substituteInPlace src/third_party/s2/s1angle.cc --replace drem remainder
diff --git a/pkgs/servers/nosql/mongodb/v3_6.nix b/pkgs/servers/nosql/mongodb/v3_6.nix
index 8da901c00c53..68f83631c801 100644
--- a/pkgs/servers/nosql/mongodb/v3_6.nix
+++ b/pkgs/servers/nosql/mongodb/v3_6.nix
@@ -11,5 +11,6 @@ let
 in buildMongoDB {
   version = "3.6.13";
   sha256 = "1mbvk4bmabrswjdm01jssxcygjpq5799zqyx901nsi12vlcymwg4";
-  patches = [ ./forget-build-dependencies.patch ];
+  patches = [ ./forget-build-dependencies.patch ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ ./asio-no-experimental-string-view.patch ];
 }
diff --git a/pkgs/servers/nosql/mongodb/v4_0.nix b/pkgs/servers/nosql/mongodb/v4_0.nix
index 95606317f319..51ce1e25062d 100644
--- a/pkgs/servers/nosql/mongodb/v4_0.nix
+++ b/pkgs/servers/nosql/mongodb/v4_0.nix
@@ -9,8 +9,9 @@ let
     inherit cctools;
   };
 in buildMongoDB {
-  version = "4.0.11";
-  sha256 = "0kry8kzzpah0l7j8xa333y1ixwvarc28ip3f6lx5590yy11j8ry2";
+  version = "4.0.12";
+  sha256 = "1j8dqa4jr623y87jrdanyib9r7x18srrvdx952q4azcc8zrdwci1";
   patches =
-    [ ./forget-build-dependencies.patch ./mozjs-45_fix-3-byte-opcode.patch ];
+    [ ./forget-build-dependencies.patch ./mozjs-45_fix-3-byte-opcode.patch ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ ./asio-no-experimental-string-view.patch ];
 }

From 00d69b87a471cf240a511e5a5566ca475bbfe029 Mon Sep 17 00:00:00 2001
From: Thibault Gagnaux <thibault@gagnaux.ch>
Date: Tue, 25 Feb 2020 15:11:53 +0100
Subject: [PATCH 07/40] mongodb: 3.4.22 -> 3.4.24 & fix ssl

Reverts previous ssl fix commit and updates the mongodb version which fixes the ssl compile problem on darwin.

(cherry picked from commit c2eee6ecdbd7c09bd70cf69c136f695b83d93213)
---
 pkgs/servers/nosql/mongodb/mongodb.nix | 3 +--
 pkgs/servers/nosql/mongodb/v3_4.nix    | 4 ++--
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/nosql/mongodb/mongodb.nix b/pkgs/servers/nosql/mongodb/mongodb.nix
index 3f5aeb4d7da8..e83a79184a36 100644
--- a/pkgs/servers/nosql/mongodb/mongodb.nix
+++ b/pkgs/servers/nosql/mongodb/mongodb.nix
@@ -39,8 +39,7 @@ in stdenv.mkDerivation rec {
     gperftools
     libpcap
     libyamlcpp
-    openssl.dev
-    openssl.out
+    openssl
     pcre-cpp
     python
     sasl
diff --git a/pkgs/servers/nosql/mongodb/v3_4.nix b/pkgs/servers/nosql/mongodb/v3_4.nix
index 113fa0680c3b..2f02ae7f72ad 100644
--- a/pkgs/servers/nosql/mongodb/v3_4.nix
+++ b/pkgs/servers/nosql/mongodb/v3_4.nix
@@ -9,7 +9,7 @@ let
     inherit cctools;
   };
 in buildMongoDB {
-  version = "3.4.22";
-  sha256 = "1rizrr69b26y7fb973n52hk387sf3mxzqg8wka4f3zdjdidfyiny";
+  version = "3.4.24";
+  sha256 = "0j6mvgv0jnsnvgkl8505bl88kbxkba66qijlpi1la0dd5pd1imfr";
   patches = [ ./forget-build-dependencies-3-4.patch ];
 }

From 56bfb0d8ff7b983a0cf83e97d22bf5bdafdb8eca Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Mon, 23 Mar 2020 23:33:27 +0100
Subject: [PATCH 08/40] mongodb: builds on aarch64 as well

(cherry picked from commit 80e6da7bd399fe62b461c8e5f6a4756753af9707)
---
 pkgs/servers/nosql/mongodb/mongodb.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/servers/nosql/mongodb/mongodb.nix b/pkgs/servers/nosql/mongodb/mongodb.nix
index e83a79184a36..b4b6334c13f5 100644
--- a/pkgs/servers/nosql/mongodb/mongodb.nix
+++ b/pkgs/servers/nosql/mongodb/mongodb.nix
@@ -110,7 +110,6 @@ in stdenv.mkDerivation rec {
     description = "A scalable, high-performance, open source NoSQL database";
     homepage = "http://www.mongodb.org";
     license = licenses.sspl;
-    broken = stdenv.hostPlatform.isAarch64; # g++ has internal compiler errors
 
     maintainers = with maintainers; [ bluescreen303 offline cstrahan ];
     platforms = subtractLists systems.doubles.i686 systems.doubles.unix;

From 07fb01965ec3fe20c72f8e5305692d415f1ed1c5 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 26 Mar 2020 13:46:22 +0100
Subject: [PATCH 09/40] nixos/tests/mongodb: rewrite with python

perl-based VM tests are deprecated.

(cherry picked from commit 2934f0464161d01aebb347080d5ccb05bd03200d)
---
 nixos/tests/mongodb.nix | 28 +++++++++++++++++++---------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff --git a/nixos/tests/mongodb.nix b/nixos/tests/mongodb.nix
index dfb23ce6c0db..ee7fc50f7ecc 100644
--- a/nixos/tests/mongodb.nix
+++ b/nixos/tests/mongodb.nix
@@ -1,6 +1,6 @@
 # This test start mongodb, runs a query using mongo shell
 
-import ./make-test.nix ({ pkgs, ... }:
+import ./make-test-python.nix ({ pkgs, ... }:
   let
     testQuery = pkgs.writeScript "nixtest.js" ''
       db.greetings.insert({ "greeting": "hello" });
@@ -8,14 +8,20 @@ import ./make-test.nix ({ pkgs, ... }:
     '';
 
     runMongoDBTest = pkg: ''
-      $node->execute("(rm -rf data || true) && mkdir data");
-      $node->execute("${pkg}/bin/mongod --fork --logpath logs --dbpath data");
-      $node->waitForOpenPort(27017);
+      node.execute("(rm -rf data || true) && mkdir data")
+      node.execute(
+          "${pkg}/bin/mongod --fork --logpath logs --dbpath data"
+      )
+      node.wait_for_open_port(27017)
 
-      $node->succeed("mongo ${testQuery}") =~ /hello/ or die;
+      assert "hello" in node.succeed(
+          "mongo ${testQuery}"
+      )
 
-      $node->execute("${pkg}/bin/mongod --shutdown --dbpath data");
-      $node->waitForClosedPort(27017);
+      node.execute(
+          "${pkg}/bin/mongod --shutdown --dbpath data"
+      )
+      node.wait_for_closed_port(27017)
     '';
 
   in {
@@ -34,9 +40,13 @@ import ./make-test.nix ({ pkgs, ... }:
       };
     };
 
-    testScript = "$node->start;" 
+    testScript = ''
+      node.start()
+    ''
 #      + runMongoDBTest pkgs.mongodb-3_4
       + runMongoDBTest pkgs.mongodb-3_6 
       + runMongoDBTest pkgs.mongodb-4_0
-      + "$node->shutdown;";
+      + ''
+        node.shutdown()
+      '';
   })

From 7cf4906ab937222ed558b4a3e7fdc601a694bd12 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 26 Mar 2020 14:04:42 +0100
Subject: [PATCH 10/40] nixos/release-notes: mention mongodb update

(cherry picked from commit b65ff5d455724d58cf761c854e4c453aa60ff1d8)
---
 nixos/doc/manual/release-notes/rl-2003.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2003.xml b/nixos/doc/manual/release-notes/rl-2003.xml
index c0e3b6d650ef..152502d9a5c1 100644
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@@ -1075,6 +1075,11 @@ auth required pam_succeed_if.so uid >= 1000 quiet
     not <command>systemd-networkd</command>.
    </para>
   </listitem>
+  <listitem>
+   <para>
+    <package>mongodb</package> has been updated to version <literal>3.4.24</literal>.
+   </para>
+  </listitem>
   </itemizedlist>
  </section>
 </section>

From cd36c1d76e3ecff6d1341d3bb4dc6c2b69fc2acf Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sat, 28 Mar 2020 21:03:15 +0100
Subject: [PATCH 11/40] nixos/release-notes: mention that mongodb is unfree now

(cherry picked from commit 27121521b86edc5c653aea49415c4cf5042d7c56)
---
 nixos/doc/manual/release-notes/rl-2003.xml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2003.xml b/nixos/doc/manual/release-notes/rl-2003.xml
index 152502d9a5c1..75a8c67b471b 100644
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@@ -1078,6 +1078,15 @@ auth required pam_succeed_if.so uid >= 1000 quiet
   <listitem>
    <para>
     <package>mongodb</package> has been updated to version <literal>3.4.24</literal>.
+    <warning>
+     <para>
+      Please note that <package>mongodb</package> has been relicensed under their own
+      <link xlink:href="https://www.mongodb.com/licensing/server-side-public-license/faq"><literal>
+      sspl</literal></link>-license. Since it's not entirely free and not OSI-approved,
+      it's listed as non-free. This means that Hydra doesn't provide prebuilt
+      <package>mongodb</package>-packages and needs to be built locally.
+     </para>
+    </warning>
    </para>
   </listitem>
   </itemizedlist>

From 834fb02c9d1c78585aab323299f4fe8b442abcf2 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 29 Mar 2020 01:06:43 +0100
Subject: [PATCH 12/40] nixos/tests/mongodb: also test mongodb-3_4

(cherry picked from commit 2c133fbb4ba6106b20a845037ef4a3453bc3a779)
---
 nixos/tests/mongodb.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/tests/mongodb.nix b/nixos/tests/mongodb.nix
index ee7fc50f7ecc..a637ec4bfc00 100644
--- a/nixos/tests/mongodb.nix
+++ b/nixos/tests/mongodb.nix
@@ -33,7 +33,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
     nodes = {
       node = {...}: {
         environment.systemPackages = with pkgs; [
-#          mongodb-3_4
+          mongodb-3_4
           mongodb-3_6
           mongodb-4_0
         ];
@@ -43,7 +43,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
     testScript = ''
       node.start()
     ''
-#      + runMongoDBTest pkgs.mongodb-3_4
+      + runMongoDBTest pkgs.mongodb-3_4
       + runMongoDBTest pkgs.mongodb-3_6 
       + runMongoDBTest pkgs.mongodb-4_0
       + ''

From 1bdc619f4b41db05779f378ee7236ec1789f0386 Mon Sep 17 00:00:00 2001
From: Danylo Hlynskyi <abcz2.uprola@gmail.com>
Date: Sun, 16 Feb 2020 22:58:34 +0200
Subject: [PATCH 13/40] postgresql-wal-receiver: fix test for Pg12 (#80268)

Fixes https://github.com/NixOS/nixpkgs/issues/80060

(cherry picked from commit 56c4800e7f9d57b102bb53326f24c10847cec8a1)
---
 nixos/tests/postgresql-wal-receiver.nix | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/nixos/tests/postgresql-wal-receiver.nix b/nixos/tests/postgresql-wal-receiver.nix
index 791b041ba95b..372dd9d8c1c1 100644
--- a/nixos/tests/postgresql-wal-receiver.nix
+++ b/nixos/tests/postgresql-wal-receiver.nix
@@ -6,17 +6,24 @@ with import ../lib/testing.nix { inherit system pkgs; };
 with pkgs.lib;
 
 let
+  makePostgresqlWalReceiverTest = subTestName: postgresqlPackage: let
+
   postgresqlDataDir = "/var/db/postgresql/test";
   replicationUser = "wal_receiver_user";
   replicationSlot = "wal_receiver_slot";
   replicationConn = "postgresql://${replicationUser}@localhost";
   baseBackupDir = "/tmp/pg_basebackup";
   walBackupDir = "/tmp/pg_wal";
-  recoveryConf = pkgs.writeText "recovery.conf" ''
+  atLeast12 = versionAtLeast postgresqlPackage.version "12.0";
+  restoreCommand = ''
     restore_command = 'cp ${walBackupDir}/%f %p'
   '';
 
-  makePostgresqlWalReceiverTest = subTestName: postgresqlPackage: makeTest {
+  recoveryFile = if atLeast12
+      then pkgs.writeTextDir "recovery.signal" ""
+      else pkgs.writeTextDir "recovery.conf" "${restoreCommand}";
+
+  in makeTest {
     name = "postgresql-wal-receiver-${subTestName}";
     meta.maintainers = with maintainers; [ pacien ];
 
@@ -29,6 +36,9 @@ let
           wal_level = archive # alias for replica on pg >= 9.6
           max_wal_senders = 10
           max_replication_slots = 10
+        '' + optionalString atLeast12 ''
+          ${restoreCommand}
+          recovery_end_command = 'touch recovery.done'
         '';
         authentication = ''
           host replication ${replicationUser} all trust
@@ -45,6 +55,9 @@ let
         slot = replicationSlot;
         directory = walBackupDir;
       };
+      # This is only to speedup test, it isn't time racing. Service is set to autorestart always,
+      # default 60sec is fine for real system, but is too much for a test
+      systemd.services.postgresql-wal-receiver-main.serviceConfig.RestartSec = mkForce 5;
     };
 
     testScript = ''
@@ -70,7 +83,7 @@ let
       # prepare WAL and recovery
       $machine->succeed('chmod a+rX -R ${walBackupDir}');
       $machine->execute('for part in ${walBackupDir}/*.partial; do mv $part ''${part%%.*}; done'); # make use of partial segments too
-      $machine->succeed('cp ${recoveryConf} ${postgresqlDataDir}/recovery.conf && chmod 666 ${postgresqlDataDir}/recovery.conf');
+      $machine->succeed('cp ${recoveryFile}/* ${postgresqlDataDir}/ && chmod 666 ${postgresqlDataDir}/recovery*');
 
       # replay WAL
       $machine->systemctl('start postgresql');

From 5c8fdaacaf616e686e106307f46df81dc1da4008 Mon Sep 17 00:00:00 2001
From: Peter Simons <simons@cryp.to>
Date: Mon, 23 Mar 2020 15:08:45 +0100
Subject: [PATCH 14/40] chromium: fix webrtc interaction with pulseaudio

The webrtc code suffered from a race condition when used
with Pulseaudio. This lead to audio input breaking every
couple of minutes during a webrtc session.

(cherry picked from commit 81b18c3711cd3ced9ad148ee6ba8c5f103709f12)
---
 .../networking/browsers/chromium/common.nix   |  2 +
 .../chromium/patches/webrtc-pulse.patch       | 61 +++++++++++++++++++
 2 files changed, 63 insertions(+)
 create mode 100644 pkgs/applications/networking/browsers/chromium/patches/webrtc-pulse.patch

diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 7b5c995e806d..4d022f5eb88f 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -149,6 +149,8 @@ let
     ] ++ optionals (useVaapi) [
       # source: https://aur.archlinux.org/cgit/aur.git/tree/vaapi-fix.patch?h=chromium-vaapi
       ./patches/vaapi-fix.patch
+      # fix race condition in the interaction with pulseaudio
+      ./patches/webrtc-pulse.patch
     ];
 
     postPatch = ''
diff --git a/pkgs/applications/networking/browsers/chromium/patches/webrtc-pulse.patch b/pkgs/applications/networking/browsers/chromium/patches/webrtc-pulse.patch
new file mode 100644
index 000000000000..cf24e2704191
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/patches/webrtc-pulse.patch
@@ -0,0 +1,61 @@
+From 704dc99bd05a94eb61202e6127df94ddfd571e85 Mon Sep 17 00:00:00 2001
+From: Dale Curtis <dalecurtis@chromium.org>
+Date: Mon, 02 Mar 2020 22:12:22 +0000
+Subject: [PATCH] Hold PulseAudio mainloop lock while querying input device info.
+
+a22cc23955cb3d58b7525c5103314226b3ce0137 moved this section out of
+UpdateNativeAudioHardwareInfo(), but forgot to bring the lock along.
+
+R=guidou
+
+Bug: 1043040
+Change-Id: I5b17a2cf0ad55d61c0811db1dae7045af4a91370
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2083814
+Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
+Commit-Queue: Guido Urdaneta <guidou@chromium.org>
+Reviewed-by: Guido Urdaneta <guidou@chromium.org>
+Auto-Submit: Dale Curtis <dalecurtis@chromium.org>
+Cr-Commit-Position: refs/heads/master@{#746115}
+---
+
+diff --git a/media/audio/pulse/audio_manager_pulse.cc b/media/audio/pulse/audio_manager_pulse.cc
+index 90e9317..829846f 100644
+--- a/media/audio/pulse/audio_manager_pulse.cc
++++ b/media/audio/pulse/audio_manager_pulse.cc
+@@ -104,22 +104,27 @@
+ 
+ AudioParameters AudioManagerPulse::GetInputStreamParameters(
+     const std::string& device_id) {
+-  int user_buffer_size = GetUserBufferSize();
+-  int buffer_size =
+-      user_buffer_size ? user_buffer_size : kDefaultInputBufferSize;
+-
+   UpdateNativeAudioHardwareInfo();
+-  auto* operation = pa_context_get_source_info_by_name(
+-      input_context_, default_source_name_.c_str(), DefaultSourceInfoCallback,
+-      this);
+-  WaitForOperationCompletion(input_mainloop_, operation, input_context_);
++
++  {
++    AutoPulseLock auto_lock(input_mainloop_);
++    auto* operation = pa_context_get_source_info_by_name(
++        input_context_, default_source_name_.c_str(), DefaultSourceInfoCallback,
++        this);
++    WaitForOperationCompletion(input_mainloop_, operation, input_context_);
++  }
+ 
+   // We don't want to accidentally open a monitor device, so return invalid
+-  // parameters for those.
++  // parameters for those. Note: The value of |default_source_is_monitor_|
++  // depends on the the call to pa_context_get_source_info_by_name() above.
+   if (device_id == AudioDeviceDescription::kDefaultDeviceId &&
+       default_source_is_monitor_) {
+     return AudioParameters();
+   }
++
++  const int user_buffer_size = GetUserBufferSize();
++  const int buffer_size =
++      user_buffer_size ? user_buffer_size : kDefaultInputBufferSize;
+   return AudioParameters(AudioParameters::AUDIO_PCM_LOW_LATENCY,
+                          CHANNEL_LAYOUT_STEREO,
+                          native_input_sample_rate_ ? native_input_sample_rate_

From e7c0dc6c8b38b615ed55b352ae9e170bd5de062b Mon Sep 17 00:00:00 2001
From: Peter Simons <simons@cryp.to>
Date: Tue, 24 Mar 2020 22:49:19 +0100
Subject: [PATCH 15/40] chromium: I accidentally added the webrtc patch into
 the wrong section

(cherry picked from commit b3c2908825233ffe5381f91d5f6733316c8ce1be)
---
 pkgs/applications/networking/browsers/chromium/common.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 4d022f5eb88f..83c492e1e651 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -137,6 +137,8 @@ let
       ./patches/no-build-timestamps.patch
       ./patches/widevine-79.patch
       ./patches/dont-use-ANGLE-by-default.patch
+      # fix race condition in the interaction with pulseaudio
+      ./patches/webrtc-pulse.patch
       # Unfortunately, chromium regularly breaks on major updates and
       # then needs various patches backported in order to be compiled with GCC.
       # Good sources for such patches and other hints:
@@ -149,8 +151,6 @@ let
     ] ++ optionals (useVaapi) [
       # source: https://aur.archlinux.org/cgit/aur.git/tree/vaapi-fix.patch?h=chromium-vaapi
       ./patches/vaapi-fix.patch
-      # fix race condition in the interaction with pulseaudio
-      ./patches/webrtc-pulse.patch
     ];
 
     postPatch = ''

From b36c9faf0f36b01f1d19c16aaacceec8ef595cf5 Mon Sep 17 00:00:00 2001
From: Artemis Tosini <me@artem.ist>
Date: Tue, 4 Feb 2020 21:08:31 +0000
Subject: [PATCH 16/40] chromium: Add option to enable ozone (for Wayland)

(cherry picked from commit b3e1a1bbbb5b96f40994944849e5e634d1d9034d)
---
 .../networking/browsers/chromium/common.nix       | 15 ++++++++++++++-
 .../networking/browsers/chromium/default.nix      |  3 ++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 83c492e1e651..53d6e145dbf8 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -21,9 +21,11 @@
 # optional dependencies
 , libgcrypt ? null # gnomeSupport || cupsSupport
 , libva ? null # useVaapi
+, libdrm ? null, wayland ? null, mesa_drivers ? null, libxkbcommon ? null # useOzone
 
 # package customization
 , useVaapi ? false
+, useOzone ? false
 , gnomeSupport ? false, gnome ? null
 , gnomeKeyringSupport ? false, libgnome-keyring3 ? null
 , proprietaryCodecs ? true
@@ -129,7 +131,8 @@ let
       ++ optionals gnomeSupport [ gnome.GConf libgcrypt ]
       ++ optionals cupsSupport [ libgcrypt cups ]
       ++ optional useVaapi libva
-      ++ optional pulseSupport libpulseaudio;
+      ++ optional pulseSupport libpulseaudio
+      ++ optionals useOzone [ libdrm wayland mesa_drivers libxkbcommon ];
 
     patches = [
       ./patches/nix_plugin_paths_68.patch
@@ -261,6 +264,16 @@ let
     } // optionalAttrs pulseSupport {
       use_pulseaudio = true;
       link_pulseaudio = true;
+    } // optionalAttrs useOzone {
+      use_ozone = true;
+      ozone_platform_gbm = false;
+      use_xkbcommon = true;
+      use_glib = true;
+      use_gtk = true;
+      use_system_libwayland = true;
+      use_system_minigbm = true;
+      use_system_libdrm = true;
+      system_wayland_scanner_path = "${wayland}/bin/wayland-scanner";
     } // (extraAttrs.gnFlags or {}));
 
     configurePhase = ''
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index c3522e17379b..677a7ed3558b 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -13,6 +13,7 @@
 , enablePepperFlash ? false
 , enableWideVine ? false
 , useVaapi ? false # test video on radeon, before enabling this
+, useOzone ? false
 , cupsSupport ? true
 , pulseSupport ? config.pulseaudio or stdenv.isLinux
 , commandLineArgs ? ""
@@ -30,7 +31,7 @@ let
     upstream-info = (callPackage ./update.nix {}).getChannel channel;
 
     mkChromiumDerivation = callPackage ./common.nix {
-      inherit gnome gnomeSupport gnomeKeyringSupport proprietaryCodecs cupsSupport pulseSupport useVaapi;
+      inherit gnome gnomeSupport gnomeKeyringSupport proprietaryCodecs cupsSupport pulseSupport useVaapi useOzone;
     };
 
     browser = callPackage ./browser.nix { inherit channel enableWideVine; };

From bb34ef369ef20d27c6472865ae40f62ea8c7a174 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Wed, 1 Apr 2020 12:33:52 +0200
Subject: [PATCH 17/40] chromium: 80.0.3987.149 -> 80.0.3987.162

https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_31.html

This update includes 8 security fixes.

CVEs:
CVE-2020-6450 CVE-2020-6451 CVE-2020-6452

(cherry picked from commit 6b7528c940b85c148265cd6c88980e6de74f5206)
---
 .../browsers/chromium/upstream-info.nix        | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index 0e939f2fd219..193acc162d97 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "177hv5jkgpcbi6khk7j883rf3rzzkjmi8cqqpzckaiw7pcwsvyvd";
-    sha256bin64 = "0sicz51d2l3gj70mfpyh5idwarjl19pba5lc6ahznxxqsrjfp80r";
-    version = "81.0.4044.69";
+    sha256 = "1h0hq05vbq2xrabrjcqqr8yrnxqs33zr4ylvyxng7sx54a39dwc6";
+    sha256bin64 = "1db66x9xljhaygdhpgp8aag983mif04d8bcixwiw9z813chki9wn";
+    version = "81.0.4044.83";
   };
   dev = {
-    sha256 = "0s0072rmg287iijh6wwm9i5a5fsh96qm6nhd13xwbxrvj6pldb7n";
-    sha256bin64 = "0l5ljjz0s5x9727syq4gs5xshl9vs8apvw6xw8il0xy5qax32g85";
-    version = "82.0.4083.0";
+    sha256 = "0660lcn8i80nzs8g4by0wswyyyckfv888bkybx85zkzwgcqhpcgc";
+    sha256bin64 = "0vbgxj4fi1dif2id1jwq9ay6h4627x480ycmbcp6ya2wszwf1piz";
+    version = "83.0.4093.3";
   };
   stable = {
-    sha256 = "07icl3hgg1wjkmz88lbpjf6ll4xyi64spki1nmsy6899jgkxvgjh";
-    sha256bin64 = "0qgp6hv4qj04v6pzfx9ggjvcl1vi6ljjc3cpi4hfr67p4jab40ji";
-    version = "80.0.3987.149";
+    sha256 = "080fqaxmprbni3lz4gsbys5vksribkqrfky4m79as2zi5hb7fmdc";
+    sha256bin64 = "1qyxr1dqpgk6f6b7w0yjyl5s4zxpxgxi660yqs7by3dk1kl5m1dh";
+    version = "80.0.3987.162";
   };
 }

From 69975012f6bb0d791b6d6687cab8e6ab4888d363 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Thu, 2 Apr 2020 12:48:43 +0200
Subject: [PATCH 18/40] chromiumDev: Remove a patch that is already applied

This fixes the patch phase.
I missed this problem in #83956.

(cherry picked from commit 36c712370912b808b52879a40dbb0d62e88cef23)
---
 .../networking/browsers/chromium/common.nix   |  5 +-
 .../chromium/patches/webrtc-pulse.patch       | 61 -------------------
 2 files changed, 3 insertions(+), 63 deletions(-)
 delete mode 100644 pkgs/applications/networking/browsers/chromium/patches/webrtc-pulse.patch

diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 53d6e145dbf8..420dc5811c7c 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -140,8 +140,6 @@ let
       ./patches/no-build-timestamps.patch
       ./patches/widevine-79.patch
       ./patches/dont-use-ANGLE-by-default.patch
-      # fix race condition in the interaction with pulseaudio
-      ./patches/webrtc-pulse.patch
       # Unfortunately, chromium regularly breaks on major updates and
       # then needs various patches backported in order to be compiled with GCC.
       # Good sources for such patches and other hints:
@@ -151,6 +149,9 @@ let
       #
       # ++ optionals (channel == "dev") [ ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" ) ]
       # ++ optional (versionRange "68" "72") ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" )
+    ] ++ optionals (versionRange "80" "82.0.4076.0") [
+      # fix race condition in the interaction with pulseaudio
+      (githubPatch "704dc99bd05a94eb61202e6127df94ddfd571e85" "0nzwzfwliwl0959j35l0gn94sbsnkghs3dh1b9ka278gi7q4648z")
     ] ++ optionals (useVaapi) [
       # source: https://aur.archlinux.org/cgit/aur.git/tree/vaapi-fix.patch?h=chromium-vaapi
       ./patches/vaapi-fix.patch
diff --git a/pkgs/applications/networking/browsers/chromium/patches/webrtc-pulse.patch b/pkgs/applications/networking/browsers/chromium/patches/webrtc-pulse.patch
deleted file mode 100644
index cf24e2704191..000000000000
--- a/pkgs/applications/networking/browsers/chromium/patches/webrtc-pulse.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 704dc99bd05a94eb61202e6127df94ddfd571e85 Mon Sep 17 00:00:00 2001
-From: Dale Curtis <dalecurtis@chromium.org>
-Date: Mon, 02 Mar 2020 22:12:22 +0000
-Subject: [PATCH] Hold PulseAudio mainloop lock while querying input device info.
-
-a22cc23955cb3d58b7525c5103314226b3ce0137 moved this section out of
-UpdateNativeAudioHardwareInfo(), but forgot to bring the lock along.
-
-R=guidou
-
-Bug: 1043040
-Change-Id: I5b17a2cf0ad55d61c0811db1dae7045af4a91370
-Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2083814
-Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
-Commit-Queue: Guido Urdaneta <guidou@chromium.org>
-Reviewed-by: Guido Urdaneta <guidou@chromium.org>
-Auto-Submit: Dale Curtis <dalecurtis@chromium.org>
-Cr-Commit-Position: refs/heads/master@{#746115}
----
-
-diff --git a/media/audio/pulse/audio_manager_pulse.cc b/media/audio/pulse/audio_manager_pulse.cc
-index 90e9317..829846f 100644
---- a/media/audio/pulse/audio_manager_pulse.cc
-+++ b/media/audio/pulse/audio_manager_pulse.cc
-@@ -104,22 +104,27 @@
- 
- AudioParameters AudioManagerPulse::GetInputStreamParameters(
-     const std::string& device_id) {
--  int user_buffer_size = GetUserBufferSize();
--  int buffer_size =
--      user_buffer_size ? user_buffer_size : kDefaultInputBufferSize;
--
-   UpdateNativeAudioHardwareInfo();
--  auto* operation = pa_context_get_source_info_by_name(
--      input_context_, default_source_name_.c_str(), DefaultSourceInfoCallback,
--      this);
--  WaitForOperationCompletion(input_mainloop_, operation, input_context_);
-+
-+  {
-+    AutoPulseLock auto_lock(input_mainloop_);
-+    auto* operation = pa_context_get_source_info_by_name(
-+        input_context_, default_source_name_.c_str(), DefaultSourceInfoCallback,
-+        this);
-+    WaitForOperationCompletion(input_mainloop_, operation, input_context_);
-+  }
- 
-   // We don't want to accidentally open a monitor device, so return invalid
--  // parameters for those.
-+  // parameters for those. Note: The value of |default_source_is_monitor_|
-+  // depends on the the call to pa_context_get_source_info_by_name() above.
-   if (device_id == AudioDeviceDescription::kDefaultDeviceId &&
-       default_source_is_monitor_) {
-     return AudioParameters();
-   }
-+
-+  const int user_buffer_size = GetUserBufferSize();
-+  const int buffer_size =
-+      user_buffer_size ? user_buffer_size : kDefaultInputBufferSize;
-   return AudioParameters(AudioParameters::AUDIO_PCM_LOW_LATENCY,
-                          CHANNEL_LAYOUT_STEREO,
-                          native_input_sample_rate_ ? native_input_sample_rate_

From fea9f4e0027b646b605e7ac174977e5a04252518 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Thu, 2 Apr 2020 10:02:40 -0400
Subject: [PATCH 19/40] linux: 4.19.113 -> 4.19.114

---
 pkgs/os-specific/linux/kernel/linux-4.19.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 65f93a0f9243..c7e55b1c9f8a 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.113";
+  version = "4.19.114";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1rf0jz7r1f4rb4k0g3glssfa1hm2ka6vlbwjlkmsx1bybxnmg85m";
+    sha256 = "03hz6vg5bg728ilbm4z997pf52cgxzsxb03vz5cs55gwdbfa0h0y";
   };
 } // (args.argsOverride or {}))

From d4cd5a8b45f0912fcb4044fa31ab9b36ddfdd0b7 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Thu, 2 Apr 2020 10:02:52 -0400
Subject: [PATCH 20/40] linux: 5.4.29 -> 5.4.30

---
 pkgs/os-specific/linux/kernel/linux-5.4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 90389a79a2e0..21f7bb888322 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.4.29";
+  version = "5.4.30";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1jssjnhwjh1my42vskm9h2b7rpc0ncvf2428y2aqm558ihia9ln7";
+    sha256 = "1vwx6j87pkfyq68chng1hy0c85hpc2byabiv1pcikrmw07vpip8i";
   };
 } // (args.argsOverride or {}))

From c9f15e246e4f7df93d8695c14498c2cabe6336b6 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Thu, 2 Apr 2020 10:03:07 -0400
Subject: [PATCH 21/40] linux: 5.5.14 -> 5.5.15

---
 pkgs/os-specific/linux/kernel/linux-5.5.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-5.5.nix b/pkgs/os-specific/linux/kernel/linux-5.5.nix
index 4069914af07b..410f8811a722 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.5.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.5.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.5.14";
+  version = "5.5.15";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0spgja8pk8m3fdhhnf50d0z0bzbzdpjd12d7w23iiw8d2179wljc";
+    sha256 = "0572gkkz3460x0z4494vy3as57ks5gwndmm0y1dxwlry5q2xh7y4";
   };
 } // (args.argsOverride or {}))

From 866017f7ebb4972f66f7492be9c221df2f7f3147 Mon Sep 17 00:00:00 2001
From: Martin Milata <martin@martinmilata.cz>
Date: Thu, 2 Apr 2020 13:49:28 +0200
Subject: [PATCH 22/40] nixos/moinmoin: fix maintainer reference

(cherry picked from commit f35d65850e42cae75253be4e092c71ff3e2fa99e)
---
 nixos/modules/services/web-apps/moinmoin.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/moinmoin.nix b/nixos/modules/services/web-apps/moinmoin.nix
index 0fee64be0bb2..dc7abce2a5cb 100644
--- a/nixos/modules/services/web-apps/moinmoin.nix
+++ b/nixos/modules/services/web-apps/moinmoin.nix
@@ -299,5 +299,5 @@ in
     ])));
   };
 
-  meta.maintainers = with lib.maintainers; [ b42 ];
+  meta.maintainers = with lib.maintainers; [ mmilata ];
 }

From c8d2553996fe920673d35e645f7d5e01ac8ac503 Mon Sep 17 00:00:00 2001
From: Dmitry Kalinkin <dmitry.kalinkin@gmail.com>
Date: Mon, 30 Mar 2020 21:07:08 -0400
Subject: [PATCH 23/40] texlive.combine: set TEXMFCNF in binary wrapper

This helps kpathsea to find texmf.cnf in some cases. For example,
dvipng was trying to look for it in
/nix/store/<hash>-texlive-dvipng.bin-2019/ instead of
/nix/store/<hash>-texlive-combined-full-2019/.

(cherry picked from commit 91c9f2ab5c931ad036f6a5d1872c22d203b751af)
cc #83816
---
 pkgs/tools/typesetting/tex/texlive/combine.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/tools/typesetting/tex/texlive/combine.nix b/pkgs/tools/typesetting/tex/texlive/combine.nix
index cb4bc14927de..ee4d0dfe588a 100644
--- a/pkgs/tools/typesetting/tex/texlive/combine.nix
+++ b/pkgs/tools/typesetting/tex/texlive/combine.nix
@@ -153,7 +153,8 @@ in buildEnv {
       rm "$link"
       makeWrapper "$target" "$link" \
         --prefix PATH : "$out/bin:${perl}/bin" \
-        --prefix PERL5LIB : "$PERL5LIB"
+        --prefix PERL5LIB : "$PERL5LIB" \
+        --set-default TEXMFCNF "$TEXMFCNF"
 
       # avoid using non-nix shebang in $target by calling interpreter
       if [[ "$(head -c 2 "$target")" = "#!" ]]; then

From c8baff29a4d52693c6dec89bf4a549c40c85e11e Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Thu, 2 Apr 2020 13:56:08 +0000
Subject: [PATCH 24/40] scallion: use openssl 1.0

it does not work with openssl 1.1 (upstream issue https://github.com/lachesis/scallion/issues/113)

(cherry picked from commit 8195e7eb937fc3c2f50535a3dea638457f795243)
---
 pkgs/tools/security/scallion/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/scallion/default.nix b/pkgs/tools/security/scallion/default.nix
index e419232641b6..1395b8e10617 100644
--- a/pkgs/tools/security/scallion/default.nix
+++ b/pkgs/tools/security/scallion/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, makeWrapper, mono, openssl, ocl-icd }:
+{ stdenv, fetchFromGitHub, makeWrapper, mono, openssl_1_0_2, ocl-icd }:
 
 stdenv.mkDerivation rec {
   version = "2.1";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/share
     cp scallion/bin/Debug/* $out/share/
     makeWrapper ${mono}/bin/mono $out/bin/scallion \
-      --prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath [ openssl ocl-icd ]} \
+      --prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath [ openssl_1_0_2 ocl-icd ]} \
       --add-flags $out/share/scallion.exe
   '';
 

From 1c38dc5df0566b103a92b44d618b76302239fb0c Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Thu, 2 Apr 2020 14:02:48 -0400
Subject: [PATCH 25/40] linux: 4.14.174 -> 4.14.175

---
 pkgs/os-specific/linux/kernel/linux-4.14.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index aa75c125da41..70083eb6cc4d 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.174";
+  version = "4.14.175";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "12ai2lc2ny38s93d0m5ngrv030vwv1h2hhzp0fs6fhjxasikq8jc";
+    sha256 = "0b12w0d21sk261jr4p1pm32v0r20a5c2j1p5hasdqw80sb2hli6b";
   };
 } // (args.argsOverride or {}))

From 306226b37897715b3e90dca3d83a618250cac86b Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Thu, 2 Apr 2020 14:03:02 -0400
Subject: [PATCH 26/40] linux: 4.4.217 -> 4.4.218

---
 pkgs/os-specific/linux/kernel/linux-4.4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 69156f577f62..6f0baf2a53b3 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.217";
+  version = "4.4.218";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0vsjchywznmjn01flgvm9vsja5zqni319rfwgy997afcbz0c9spx";
+    sha256 = "0qzhcy8i111jbpnkpzq7hqf9nkwq4s7smi820hfvnmd2ky7cns7a";
   };
 } // (args.argsOverride or {}))

From 8bbceb7c00b5f26d13576533e4df8cf3df8cdd9c Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Thu, 2 Apr 2020 14:03:09 -0400
Subject: [PATCH 27/40] linux: 4.9.217 -> 4.9.218

---
 pkgs/os-specific/linux/kernel/linux-4.9.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 98d203e481ff..3b6a68b7c039 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.217";
+  version = "4.9.218";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "06b8av9f9pk2yp95nzv4322k0d5wsg40sxd9kfim1xzb093abckg";
+    sha256 = "1ka98c8sbfipzll6ss9fcsn26lh4cy60372yfw27pif4brhnwfnz";
   };
 } // (args.argsOverride or {}))

From 50bfd35a05c9667ccdd94911250f4b98f721063d Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 2 Apr 2020 17:49:25 +0200
Subject: [PATCH 28/40] matrix-synapse: 1.12.0 -> 1.12.1

https://github.com/matrix-org/synapse/releases/tag/v1.12.1
(cherry picked from commit 83c59cb9b64be0043bc7367159f74c6d983df606)
---
 pkgs/servers/matrix-synapse/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index f0c8a0d4f819..6b06a493509a 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -23,11 +23,11 @@ let
 
 in buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.12.0";
+  version = "1.12.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "18wavnb47w4hfh8dc7g77bfhz03zh1xzl58mxlfi0000qsbkz680";
+    sha256 = "0l3a5dvnahrzwqh8p0cnfr019bxxgd769jk2wprfvfd65h7p0g1r";
   };
 
   patches = [

From 5bf91db519cb83b12738da1096b271180c900088 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 2 Apr 2020 19:31:33 +0200
Subject: [PATCH 29/40] packagekit: Don't depend on nix unless enableNixBackend
 = true

(cherry picked from commit 9737f249195db232178c3f7034e1c23220f4fcda)
---
 pkgs/tools/package-management/packagekit/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/package-management/packagekit/default.nix b/pkgs/tools/package-management/packagekit/default.nix
index dc69ae457dcd..bd80d4a93507 100644
--- a/pkgs/tools/package-management/packagekit/default.nix
+++ b/pkgs/tools/package-management/packagekit/default.nix
@@ -1,7 +1,6 @@
 { stdenv, fetchFromGitHub, lib
 , intltool, glib, pkgconfig, polkit, python3, sqlite
 , gobject-introspection, vala, gtk-doc, autoreconfHook, autoconf-archive
-# TODO: set enableNixBackend to true, as soon as it builds
 , nix, enableNixBackend ? false, boost
 , enableCommandNotFound ? false
 , enableBashCompletion ? false, bash-completion ? null
@@ -23,7 +22,9 @@ stdenv.mkDerivation rec {
   buildInputs = [ glib polkit python3 gobject-introspection ]
                   ++ lib.optional enableSystemd systemd
                   ++ lib.optional enableBashCompletion bash-completion;
-  propagatedBuildInputs = [ sqlite nix boost ];
+  propagatedBuildInputs =
+    [ sqlite boost ]
+    ++ lib.optional enableNixBackend nix;
   nativeBuildInputs = [ vala intltool pkgconfig autoreconfHook autoconf-archive gtk-doc ];
 
   preAutoreconf = ''

From 2e3190538b8127ca9489d08e25de007c5a6bcc7d Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Fri, 3 Apr 2020 00:45:43 +0200
Subject: [PATCH 30/40] chromium: 80.0.3987.162 -> 80.0.3987.163

https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop.html

Note: This update contains only two fixes [0]. The fix that reverts a
feature which caused a crash spike on 80.0.3987.162 [1] seems important
for us (though the commit doesn't provide any data on the crash spike).

[0]: https://chromium.googlesource.com/chromium/src/+log/80.0.3987.162..80.0.3987.163?pretty=fuller
[1]: https://chromium.googlesource.com/chromium/src/+/fc11c43603c05a9ef77430a6b4081a01969d2bf4

(cherry picked from commit cbd13f3c55df7ae29ef7d782af06ac5553258eb3)
Backport of #84174.
---
 .../browsers/chromium/upstream-info.nix        | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index 193acc162d97..7b44919043a8 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "1h0hq05vbq2xrabrjcqqr8yrnxqs33zr4ylvyxng7sx54a39dwc6";
-    sha256bin64 = "1db66x9xljhaygdhpgp8aag983mif04d8bcixwiw9z813chki9wn";
-    version = "81.0.4044.83";
+    sha256 = "0i0szd749ihb08rxnsmsbxq75b6x952wpk94jwc0ncv6gb83zkx2";
+    sha256bin64 = "1y70kmfz9nv507b0zdda7zfk2ac9qh9m2gq00aphdmzd0al7skj8";
+    version = "81.0.4044.92";
   };
   dev = {
-    sha256 = "0660lcn8i80nzs8g4by0wswyyyckfv888bkybx85zkzwgcqhpcgc";
-    sha256bin64 = "0vbgxj4fi1dif2id1jwq9ay6h4627x480ycmbcp6ya2wszwf1piz";
-    version = "83.0.4093.3";
+    sha256 = "1rydvjmv62zj95sf0fgsyipqz2hphbxm60y8q0813wq9ym35d4yy";
+    sha256bin64 = "1m6740lw7xjjp1lplwp9ii4d3l7dfa9jrv5bysm4ar5pb9kywrai";
+    version = "83.0.4100.3";
   };
   stable = {
-    sha256 = "080fqaxmprbni3lz4gsbys5vksribkqrfky4m79as2zi5hb7fmdc";
-    sha256bin64 = "1qyxr1dqpgk6f6b7w0yjyl5s4zxpxgxi660yqs7by3dk1kl5m1dh";
-    version = "80.0.3987.162";
+    sha256 = "0ikk4cgz3jgjhyncsvlqvlc03y7jywjpa6v34fwsjxs88flyzpdn";
+    sha256bin64 = "1ks0i6vdxbmixnfz2b128yf9hsk5pm9x2j17nm3xg3245k0z22xr";
+    version = "80.0.3987.163";
   };
 }

From c565d7cc16f5409304b5f3815115d373e3632811 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Sat, 22 Feb 2020 13:10:30 -0500
Subject: [PATCH 31/40] haskell shellFor: Fix hoogle

(cherry picked from commit 1c07ee79255bb3fe8a7eb382cd5a8348e0b85893)
---
 pkgs/development/haskell-modules/make-package-set.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/haskell-modules/make-package-set.nix b/pkgs/development/haskell-modules/make-package-set.nix
index 9ba25e09db93..17fb1ab8ae85 100644
--- a/pkgs/development/haskell-modules/make-package-set.nix
+++ b/pkgs/development/haskell-modules/make-package-set.nix
@@ -315,10 +315,10 @@ in package-set { inherit pkgs stdenv callPackage; } self // {
 
           in self.mkDerivation genericBuilderArgs;
 
-        envFuncArgs = builtins.removeAttrs args [ "packages" ];
-      in (combinedPackageFor packages).env.overrideAttrs (old: envFuncArgs // {
-        nativeBuildInputs = old.nativeBuildInputs ++ envFuncArgs.nativeBuildInputs or [];
-        buildInputs = old.buildInputs ++ envFuncArgs.buildInputs or [];
+        mkDerivationArgs = builtins.removeAttrs args [ "packages" "withHoogle" ];
+      in ((combinedPackageFor packages).envFunc { inherit withHoogle; }).overrideAttrs (old: mkDerivationArgs // {
+        nativeBuildInputs = old.nativeBuildInputs ++ mkDerivationArgs.nativeBuildInputs or [];
+        buildInputs = old.buildInputs ++ mkDerivationArgs.buildInputs or [];
       });
 
     ghc = ghc // {

From cf0855c899c9ceb2413a7d5553e76695b398aac0 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 2 Apr 2020 18:01:45 +0200
Subject: [PATCH 32/40] nix-daemon.nix: Add option nix.registry

This allows you to specify the system-wide flake registry. One use is
to pin 'nixpkgs' to the Nixpkgs version used to build the system:

  nix.registry.nixpkgs.flake = nixpkgs;

where 'nixpkgs' is a flake input. This ensures that commands like

  $ nix run nixpkgs#hello

pull in a minimum of additional store paths.

You can also use this to redirect flakes, e.g.

  nix.registry.nixpkgs.to = {
    type = "github";
    owner = "my-org";
    repo = "my-nixpkgs";
  };

(cherry picked from commit 74e7ef35fee77139be31a3891033ff61496635f8)
---
 flake.nix                                  |  3 +-
 nixos/modules/services/misc/nix-daemon.nix | 58 ++++++++++++++++++++++
 pkgs/top-level/make-tarball.nix            |  2 +-
 3 files changed, 61 insertions(+), 2 deletions(-)

diff --git a/flake.nix b/flake.nix
index a6828c98fb51..f16c5ea697ac 100644
--- a/flake.nix
+++ b/flake.nix
@@ -25,8 +25,9 @@
           import ./nixos/lib/eval-config.nix (args // {
             modules = modules ++
               [ { system.nixos.versionSuffix =
-                    ".${lib.substring 0 8 self.lastModified}.${self.shortRev or "dirty"}";
+                    ".${lib.substring 0 8 (self.lastModifiedDate or self.lastModified)}.${self.shortRev or "dirty"}";
                   system.nixos.revision = lib.mkIf (self ? rev) self.rev;
+                  nix.registry.nixpkgs.flake = lib.mkDefault self;
                 }
               ];
           });
diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix
index 17c3582db0f6..8203cb13e506 100644
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@@ -376,6 +376,59 @@ in
           If enabled (the default), checks that Nix can parse the generated nix.conf.
         '';
       };
+
+      registry = mkOption {
+        type = types.attrsOf (types.submodule (
+          let
+            inputAttrs = types.attrsOf (types.oneOf [types.str types.int types.bool types.package]);
+          in
+          { config, name, ... }:
+          { options = {
+              from = mkOption {
+                type = inputAttrs;
+                example = { type = "indirect"; id = "nixpkgs"; };
+                description = "The flake reference to be rewritten.";
+              };
+              to = mkOption {
+                type = inputAttrs;
+                example = { type = "github"; owner = "my-org"; repo = "my-nixpkgs"; };
+                description = "The flake reference to which <option>from></option> is to be rewritten.";
+              };
+              flake = mkOption {
+                type = types.unspecified;
+                default = null;
+                example = literalExample "nixpkgs";
+                description = ''
+                  The flake input to which <option>from></option> is to be rewritten.
+                '';
+              };
+              exact = mkOption {
+                type = types.bool;
+                default = true;
+                description = ''
+                  Whether the <option>from</option> reference needs to match exactly. If set,
+                  a <option>from</option> reference like <literal>nixpkgs</literal> does not
+                  match with a reference like <literal>nixpkgs/nixos-20.03</literal>.
+                '';
+              };
+            };
+            config = {
+              from = mkDefault { type = "indirect"; id = name; };
+              to = mkIf (config.flake != null)
+                ({ type = "path";
+                   path = config.flake.outPath;
+                 } // lib.filterAttrs
+                   (n: v: n == "lastModified" || n == "rev" || n == "revCount" || n == "narHash")
+                   config.flake);
+            };
+          }
+        ));
+        default = {};
+        description = ''
+          A system-wide flake registry.
+        '';
+      };
+
     };
 
   };
@@ -390,6 +443,11 @@ in
 
     environment.etc."nix/nix.conf".source = nixConf;
 
+    environment.etc."nix/registry.json".text = builtins.toJSON {
+      version = 2;
+      flakes = mapAttrsToList (n: v: { inherit (v) from to exact; }) cfg.registry;
+    };
+
     # List of machines for distributed Nix builds in the format
     # expected by build-remote.pl.
     environment.etc."nix/machines" =
diff --git a/pkgs/top-level/make-tarball.nix b/pkgs/top-level/make-tarball.nix
index bb0d7bc54e78..6bb243879e9a 100644
--- a/pkgs/top-level/make-tarball.nix
+++ b/pkgs/top-level/make-tarball.nix
@@ -19,7 +19,7 @@ releaseTools.sourceTarball {
   version = pkgs.lib.fileContents ../../.version;
   versionSuffix = "pre${
     if nixpkgs ? lastModified
-    then builtins.substring 0 8 nixpkgs.lastModified
+    then builtins.substring 0 8 (nixpkgs.lastModifiedDate or nixpkgs.lastModified)
     else toString nixpkgs.revCount}.${nixpkgs.shortRev or "dirty"}";
 
   buildInputs = [ nix.out jq lib-tests pkgs.brotli ];

From b255cd7f7f982993fdad8856f16384c91c4cf999 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 3 Apr 2020 14:39:55 +0200
Subject: [PATCH 33/40] Don't pin 'nixpkgs' in the system registry by default

Nixpkgs takes up a lot of disk space so we shouldn't do this by
default.

(cherry picked from commit 469f14ef0fade3ae4c07e4977638fdf3afc29e08)
---
 flake.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index f16c5ea697ac..52fd2f82a37e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -27,7 +27,6 @@
               [ { system.nixos.versionSuffix =
                     ".${lib.substring 0 8 (self.lastModifiedDate or self.lastModified)}.${self.shortRev or "dirty"}";
                   system.nixos.revision = lib.mkIf (self ? rev) self.rev;
-                  nix.registry.nixpkgs.flake = lib.mkDefault self;
                 }
               ];
           });

From 988bb1f3653877f143fbb511c5d82c5a07f5ec8b Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Thu, 6 Feb 2020 14:25:28 +0300
Subject: [PATCH 34/40] mariadb: build server with NUMA

(cherry picked from commit c6d159d6964b5a4b9a4828082ceefd8e368e70fa)
---
 pkgs/servers/sql/mariadb/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 30df5d21afca..263c4556cdf8 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -1,7 +1,8 @@
 { stdenv, fetchurl, fetchFromGitHub, cmake, pkgconfig, makeWrapper, ncurses, zlib, xz, lzo, lz4, bzip2, snappy
 , libiconv, openssl, pcre, boost, judy, bison, libxml2, libkrb5, linux-pam, curl
-, libaio, libevent, jemalloc, cracklib, systemd, numactl, perl
+, libaio, libevent, jemalloc, cracklib, systemd, perl
 , fixDarwinDylibNames, cctools, CoreServices, less
+, numactl # NUMA Support
 , withoutClient ? false
 }:
 
@@ -163,6 +164,8 @@ server = stdenv.mkDerivation (common // {
     "-DWITH_INNODB_DISALLOW_WRITES=ON"
     "-DWITHOUT_EXAMPLE=1"
     "-DWITHOUT_FEDERATED=1"
+  ] ++ optional (stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32) [
+    "-DWITH_NUMA=ON"
   ] ++ optionals withoutClient [
     "-DWITHOUT_CLIENT=ON"
   ] ++ optionals stdenv.hostPlatform.isDarwin [

From 95c2e022cfa159f8abb5fe0a8b451b894072a4f8 Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Thu, 6 Feb 2020 16:33:59 +0300
Subject: [PATCH 35/40] mariadb: add needed packages

(cherry picked from commit 982a23de945a9b89c6f69213a39faf0c676f00b1)
---
 pkgs/servers/sql/mariadb/default.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 263c4556cdf8..51181c4d2ae5 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -3,6 +3,7 @@
 , libaio, libevent, jemalloc, cracklib, systemd, perl
 , fixDarwinDylibNames, cctools, CoreServices, less
 , numactl # NUMA Support
+, withStorageMroonga ? true, kytea, msgpack, zeromq
 , withoutClient ? false
 }:
 
@@ -144,6 +145,7 @@ server = stdenv.mkDerivation (common // {
     xz lzo lz4 bzip2 snappy
     libxml2 boost judy libevent cracklib
   ] ++ optional (stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32) numactl
+    ++ optionals withStorageMroonga [ kytea msgpack zeromq ]
     ++ optional stdenv.hostPlatform.isLinux linux-pam
     ++ optional (!stdenv.hostPlatform.isDarwin) mytopEnv;
 
@@ -166,6 +168,8 @@ server = stdenv.mkDerivation (common // {
     "-DWITHOUT_FEDERATED=1"
   ] ++ optional (stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32) [
     "-DWITH_NUMA=ON"
+  ] ++ optional (!withStorageMroonga) [
+    "-DWITHOUT_MROONGA=ON"
   ] ++ optionals withoutClient [
     "-DWITHOUT_CLIENT=ON"
   ] ++ optionals stdenv.hostPlatform.isDarwin [
@@ -181,7 +185,6 @@ server = stdenv.mkDerivation (common // {
     chmod +x "$out"/bin/wsrep_sst_common
     rm "$out"/bin/{mysql_client_test,mysqltest}
     rm -r "$out"/data # Don't need testing data
-    mv "$out"/share/{groonga,groonga-normalizer-mysql} "$out"/share/doc/mysql
   '' + optionalString withoutClient ''
     ${ # We don't build with GSSAPI on Darwin
       optionalString (!stdenv.hostPlatform.isDarwin) ''
@@ -190,6 +193,8 @@ server = stdenv.mkDerivation (common // {
     }
     rm "$out"/lib/mysql/plugin/client_ed25519.so
     rm "$out"/lib/{libmysqlclient${libExt},libmysqlclient_r${libExt}}
+  '' + optionalString withStorageMroonga ''
+    mv "$out"/share/{groonga,groonga-normalizer-mysql} "$out"/share/doc/mysql
   '' + optionalString (!stdenv.hostPlatform.isDarwin) ''
     sed -i 's/-mariadb/-mysql/' "$out"/bin/galera_new_cluster
   '';

From a9d0d059a046590cc3edde989f28f23325b41ada Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Sun, 15 Mar 2020 13:35:37 +0100
Subject: [PATCH 36/40] mariadb: remove withoutClient

When used as a global override, it breaks most of the options in the
mysql module, such as ensureDatabases, ensureUsers, initialDatabases,
initialScript.

We could use `.client` there, but if the reasoning behind this was
closure size reduction, we now end up with the same (or a bigger)
runtime closure and more complexity.

Apart from the options exposed by the mysql module, the client is also
likely to be required for local backups or DBA tasks anyways.

Instead of dealing with all the increased complexity of this for no
arguable benefit, let's just remove the `withoutClient` argument.
Storage space on mysql servers shouldn't be that much of an issue.

Closes #82428.

(cherry picked from commit 4b8d66aa7266ab55f08d53271df36832d9c055d2)
---
 .../sql/mariadb/cmake-without-client.patch        | 15 ---------------
 pkgs/servers/sql/mariadb/default.nix              | 15 +--------------
 2 files changed, 1 insertion(+), 29 deletions(-)
 delete mode 100644 pkgs/servers/sql/mariadb/cmake-without-client.patch

diff --git a/pkgs/servers/sql/mariadb/cmake-without-client.patch b/pkgs/servers/sql/mariadb/cmake-without-client.patch
deleted file mode 100644
index ce36d036b6d0..000000000000
--- a/pkgs/servers/sql/mariadb/cmake-without-client.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 1ea7c1df..b0face0d 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -176,6 +176,10 @@ ELSE()
-   SET (SKIP_COMPONENTS "N-O-N-E")
- ENDIF()
- 
-+IF (WITHOUT_CLIENT)
-+  SET (SKIP_COMPONENTS "Client|ClientPlugins|ManPagesClient")
-+ENDIF()
-+
- OPTION(NOT_FOR_DISTRIBUTION "Allow linking with GPLv2-incompatible system libraries. Only set it you never plan to distribute the resulting binaries" OFF)
- 
- INCLUDE(check_compiler_flag)
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 51181c4d2ae5..2b287c8f6ffd 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -4,7 +4,6 @@
 , fixDarwinDylibNames, cctools, CoreServices, less
 , numactl # NUMA Support
 , withStorageMroonga ? true, kytea, msgpack, zeromq
-, withoutClient ? false
 }:
 
 with stdenv.lib;
@@ -149,9 +148,7 @@ server = stdenv.mkDerivation (common // {
     ++ optional stdenv.hostPlatform.isLinux linux-pam
     ++ optional (!stdenv.hostPlatform.isDarwin) mytopEnv;
 
-  patches = common.patches ++ [
-    ./cmake-without-client.patch
-  ] ++ optionals stdenv.hostPlatform.isDarwin [
+  patches = common.patches ++ optionals stdenv.hostPlatform.isDarwin [
     ./cmake-without-plugin-auth-pam.patch
   ];
 
@@ -170,8 +167,6 @@ server = stdenv.mkDerivation (common // {
     "-DWITH_NUMA=ON"
   ] ++ optional (!withStorageMroonga) [
     "-DWITHOUT_MROONGA=ON"
-  ] ++ optionals withoutClient [
-    "-DWITHOUT_CLIENT=ON"
   ] ++ optionals stdenv.hostPlatform.isDarwin [
     "-DWITHOUT_OQGRAPH=1"
     "-DWITHOUT_TOKUDB=1"
@@ -185,14 +180,6 @@ server = stdenv.mkDerivation (common // {
     chmod +x "$out"/bin/wsrep_sst_common
     rm "$out"/bin/{mysql_client_test,mysqltest}
     rm -r "$out"/data # Don't need testing data
-  '' + optionalString withoutClient ''
-    ${ # We don't build with GSSAPI on Darwin
-      optionalString (!stdenv.hostPlatform.isDarwin) ''
-        rm "$out"/lib/mysql/plugin/auth_gssapi_client.so
-      ''
-    }
-    rm "$out"/lib/mysql/plugin/client_ed25519.so
-    rm "$out"/lib/{libmysqlclient${libExt},libmysqlclient_r${libExt}}
   '' + optionalString withStorageMroonga ''
     mv "$out"/share/{groonga,groonga-normalizer-mysql} "$out"/share/doc/mysql
   '' + optionalString (!stdenv.hostPlatform.isDarwin) ''

From a05099d27731aee6420b33db176561dd1672341d Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Wed, 1 Apr 2020 16:51:30 +0300
Subject: [PATCH 37/40] mariadb: add option to build server without tokudb
 storage

(cherry picked from commit 0296e678cf58e944b1ba7c0a13ad7b89b0a190b4)
---
 nixos/doc/manual/release-notes/rl-2003.xml |  6 ++++++
 pkgs/servers/sql/mariadb/default.nix       | 21 +++++++++++++--------
 pkgs/top-level/all-packages.nix            |  2 +-
 3 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2003.xml b/nixos/doc/manual/release-notes/rl-2003.xml
index d9932fbfc904..3aa06c3bb2bd 100644
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@@ -1007,6 +1007,12 @@ auth required pam_succeed_if.so uid >= 1000 quiet
      </warning>
     </para>
    </listitem>
+   <listitem>
+     <para>
+       The TokuDB storage engine will be disabled in <package>mariadb</package> 10.5. It is recommended to switch
+       to RocksDB. See also <link xlink:href="https://mariadb.com/kb/en/tokudb/">TokuDB</link>.
+     </para>
+   </listitem>
   </itemizedlist>
  </section>
 
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 2b287c8f6ffd..1e9c087bb6e7 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -1,9 +1,10 @@
 { stdenv, fetchurl, fetchFromGitHub, cmake, pkgconfig, makeWrapper, ncurses, zlib, xz, lzo, lz4, bzip2, snappy
 , libiconv, openssl, pcre, boost, judy, bison, libxml2, libkrb5, linux-pam, curl
-, libaio, libevent, jemalloc, cracklib, systemd, perl
+, libaio, libevent, jemalloc450, jemalloc, cracklib, systemd, perl
 , fixDarwinDylibNames, cctools, CoreServices, less
 , numactl # NUMA Support
 , withStorageMroonga ? true, kytea, msgpack, zeromq
+, withStorageToku ? true
 }:
 
 with stdenv.lib;
@@ -34,9 +35,11 @@ common = rec { # attributes common to both builds
   nativeBuildInputs = [ cmake pkgconfig ];
 
   buildInputs = [
-    ncurses openssl zlib pcre jemalloc libiconv curl
+    ncurses openssl zlib pcre libiconv curl
   ] ++ optionals stdenv.hostPlatform.isLinux [ libaio systemd libkrb5 ]
-    ++ optionals stdenv.hostPlatform.isDarwin [ perl fixDarwinDylibNames cctools CoreServices ];
+    ++ optionals stdenv.hostPlatform.isDarwin [ perl fixDarwinDylibNames cctools CoreServices ]
+    ++ optional (!stdenv.hostPlatform.isDarwin && withStorageToku) [ jemalloc450 ]
+    ++ optional (!stdenv.hostPlatform.isDarwin && !withStorageToku) [ jemalloc ];
 
   prePatch = ''
     sed -i 's,[^"]*/var/log,/var/log,g' storage/mroonga/vendor/groonga/CMakeLists.txt
@@ -80,8 +83,6 @@ common = rec { # attributes common to both builds
     # to pass in java explicitly.
     "-DCONNECT_WITH_JDBC=OFF"
     "-DCURSES_LIBRARY=${ncurses.out}/lib/libncurses.dylib"
-  ] ++ optionals stdenv.hostPlatform.isMusl [
-    "-DWITHOUT_TOKUDB=1" # mariadb docs say disable this for musl
   ];
 
   postInstall = ''
@@ -99,6 +100,7 @@ common = rec { # attributes common to both builds
   passthru.mysqlVersion = "5.7";
 
   meta = {
+
     description = "An enhanced, drop-in replacement for MySQL";
     homepage    = https://mariadb.org/;
     license     = licenses.gpl2;
@@ -166,10 +168,13 @@ server = stdenv.mkDerivation (common // {
   ] ++ optional (stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32) [
     "-DWITH_NUMA=ON"
   ] ++ optional (!withStorageMroonga) [
-    "-DWITHOUT_MROONGA=ON"
-  ] ++ optionals stdenv.hostPlatform.isDarwin [
-    "-DWITHOUT_OQGRAPH=1"
+    "-DWITHOUT_MROONGA=1"
+  ] ++ optional (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isMusl || !withStorageToku) [
     "-DWITHOUT_TOKUDB=1"
+  ] ++ optional (!stdenv.hostPlatform.isDarwin && withStorageToku) [
+    "-DWITH_JEMALLOC=static"
+  ] ++ optional stdenv.hostPlatform.isDarwin [
+    "-DWITHOUT_OQGRAPH=1"
   ];
 
   preConfigure = optionalString (!stdenv.hostPlatform.isDarwin) ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 168a306f51ec..42894dc976c3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15547,7 +15547,7 @@ in
   mariadb = callPackage ../servers/sql/mariadb {
     # As per mariadb's cmake, "static jemalloc_pic.a can only be used up to jemalloc 4".
     # https://jira.mariadb.org/browse/MDEV-15034
-    jemalloc = jemalloc450.override ({ disableInitExecTls = true; });
+    jemalloc450 = jemalloc450.override ({ disableInitExecTls = true; });
     inherit (darwin) cctools;
     inherit (pkgs.darwin.apple_sdk.frameworks) CoreServices;
   };

From bf942675cb8d0028e52227518a7d705df96a61b8 Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Thu, 2 Apr 2020 10:12:22 +0300
Subject: [PATCH 38/40] mariadb: add option to build server without rocksdb
 storage

(cherry picked from commit eafdfc8f51b10b629ace0f8e5dba784b83fcc7ea)
---
 pkgs/servers/sql/mariadb/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 1e9c087bb6e7..c0d4cc101972 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -4,6 +4,7 @@
 , fixDarwinDylibNames, cctools, CoreServices, less
 , numactl # NUMA Support
 , withStorageMroonga ? true, kytea, msgpack, zeromq
+, withStorageRocks ? true
 , withStorageToku ? true
 }:
 
@@ -169,6 +170,10 @@ server = stdenv.mkDerivation (common // {
     "-DWITH_NUMA=ON"
   ] ++ optional (!withStorageMroonga) [
     "-DWITHOUT_MROONGA=1"
+  ] ++ optional (!withStorageRocks) [
+    "-DWITHOUT_ROCKSDB=1"
+  ] ++ optional (!stdenv.hostPlatform.isDarwin && withStorageRocks) [
+    "-DWITH_ROCKSDB_JEMALLOC=ON"
   ] ++ optional (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isMusl || !withStorageToku) [
     "-DWITHOUT_TOKUDB=1"
   ] ++ optional (!stdenv.hostPlatform.isDarwin && withStorageToku) [

From 6254058ddc3ce7e733496e073bf69403d45cb702 Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Thu, 2 Apr 2020 10:22:10 +0300
Subject: [PATCH 39/40] mariadb: add zstd compression

(cherry picked from commit 24357432cdac1ab22f3d5e1f6021c50bcba3ac6a)
---
 pkgs/servers/sql/mariadb/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index c0d4cc101972..b2274a457aee 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -1,6 +1,7 @@
-{ stdenv, fetchurl, fetchFromGitHub, cmake, pkgconfig, makeWrapper, ncurses, zlib, xz, lzo, lz4, bzip2, snappy
+{ stdenv, fetchurl, fetchFromGitHub, cmake, pkgconfig, makeWrapper, ncurses
 , libiconv, openssl, pcre, boost, judy, bison, libxml2, libkrb5, linux-pam, curl
 , libaio, libevent, jemalloc450, jemalloc, cracklib, systemd, perl
+, bzip2, lz4, lzo, snappy, xz, zlib, zstd
 , fixDarwinDylibNames, cctools, CoreServices, less
 , numactl # NUMA Support
 , withStorageMroonga ? true, kytea, msgpack, zeromq
@@ -144,7 +145,7 @@ server = stdenv.mkDerivation (common // {
   nativeBuildInputs = common.nativeBuildInputs ++ [ bison ] ++ optional (!stdenv.hostPlatform.isDarwin) makeWrapper;
 
   buildInputs = common.buildInputs ++ [
-    xz lzo lz4 bzip2 snappy
+    bzip2 lz4 lzo snappy xz zstd
     libxml2 boost judy libevent cracklib
   ] ++ optional (stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32) numactl
     ++ optionals withStorageMroonga [ kytea msgpack zeromq ]

From c0c04ea70dc85c391396f9f3f6cf61b870d8d181 Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Thu, 2 Apr 2020 10:31:58 +0300
Subject: [PATCH 40/40] mariadb: fix deps build

(cherry picked from commit 5abc729dd6f70f71efc499541dbb8b9c334ef722)
---
 pkgs/servers/sql/mariadb/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index b2274a457aee..9c23da852f5b 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -142,11 +142,11 @@ server = stdenv.mkDerivation (common // {
 
   outputs = [ "out" "man" ];
 
-  nativeBuildInputs = common.nativeBuildInputs ++ [ bison ] ++ optional (!stdenv.hostPlatform.isDarwin) makeWrapper;
+  nativeBuildInputs = common.nativeBuildInputs ++ [ bison boost.dev ] ++ optional (!stdenv.hostPlatform.isDarwin) makeWrapper;
 
   buildInputs = common.buildInputs ++ [
     bzip2 lz4 lzo snappy xz zstd
-    libxml2 boost judy libevent cracklib
+    libxml2 judy libevent cracklib
   ] ++ optional (stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32) numactl
     ++ optionals withStorageMroonga [ kytea msgpack zeromq ]
     ++ optional stdenv.hostPlatform.isLinux linux-pam