pkgs: Add _type = "pkgs"

(cherry picked from commit ad1e2500ef)
(cherry picked from commit aec730a0af)

pkgs/applications/editors/vim/default.nix

@@ -2,7 +2,7 @@
 # default vimrc
 , vimrc ? fetchurl {
     name = "default-vimrc";
-    url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/archlinux.vim?id=68f6d131750aa778807119e03eed70286a17b1cb";
+    url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/68f6d131750aa778807119e03eed70286a17b1cb/trunk/archlinux.vim";
     sha256 = "18ifhv5q9prd175q3vxbqf6qyvkk6bc7d2lhqdk0q78i68kv9y0c";
   }
 # apple frameworks

pkgs/applications/graphics/ImageMagick/7.0.nix

@@ -15,13 +15,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "imagemagick";
-  version = "7.1.0-0";
+  version = "7.1.0-2";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = version;
-    sha256 = "sha256-TmyJMzj5tHMrVm6xRguZmXIg7c6mHmqusMMdJAHNqNg=";
+    sha256 = "sha256-0nTz9UBspROrNj72amyZmFYK/y9Xg4+qNt4raZiK3AI=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
     homepage = "http://www.imagemagick.org/";
     description = "A software suite to create, edit, compose, or convert bitmap images";
     platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ erictapen ];
+    maintainers = with maintainers; [ erictapen dotlambda ];
     license = licenses.asl20;
   };
 }

pkgs/applications/graphics/hugin/default.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   patches = [
     # Fixes build with exiv2 0.27.1
     (fetchpatch {
-      url = "https://git.archlinux.org/svntogit/community.git/plain/trunk/hugin-exiv2-0.27.1.patch?h=packages/hugin";
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-community/0467d8ba362b9c196e4c1dc4be7de0c1b336335b/hugin/trunk/hugin-exiv2-0.27.1.patch";
       sha256 = "1yxvlpvrhyrfd2w6kwx1w3mncsvlzdhp0w7xchy8q6kc2kd5nf7r";
     })
   ];

pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -1,8 +1,8 @@
 {
   "stable": {
-    "version": "91.0.4472.101",
-    "sha256": "1d3y621iclkq6nvxrapk5aihv50x13hjha0c2gcp2xxfma96253q",
-    "sha256bin64": "12j5q5b9v0jpiznjnh89831w8lv399vd1z4ljhbsnsidbsygrbr1",
+    "version": "91.0.4472.114",
+    "sha256": "0wbyiwbdazgjjgj9vs56x26q3g9r80a57gfl0f2rfl1j7xwgxiy1",
+    "sha256bin64": "00ac1dyqxpxy1j11jvc5j35bgc629n2f2pll3912gzih4ir0vrys",
     "deps": {
       "gn": {
         "version": "2021-04-06",
@@ -12,9 +12,9 @@
       }
     },
     "chromedriver": {
-      "version": "91.0.4472.19",
-      "sha256_linux": "0pg9y55644i87qxa0983lvfizbmfiak9bg9249xhifl5kykghrb2",
-      "sha256_darwin": "07v5k07100vrzsbm6r59xg8j80ffzs3gnnf2kcfgqrzprx284gf2"
+      "version": "91.0.4472.101",
+      "sha256_linux": "0dzx565z2rd0y4i57rv5kd7dsm69sffza96y3c773hqaghm4y1ng",
+      "sha256_darwin": "0nff1jmmrn6a4clfvhyzrhfp8hx85z72563jwk28apflqmnm0k68"
     }
   },
   "beta": {
@@ -44,9 +44,9 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "91.0.4472.101",
-    "sha256": "1d3y621iclkq6nvxrapk5aihv50x13hjha0c2gcp2xxfma96253q",
-    "sha256bin64": "12j5q5b9v0jpiznjnh89831w8lv399vd1z4ljhbsnsidbsygrbr1",
+    "version": "91.0.4472.114",
+    "sha256": "0wbyiwbdazgjjgj9vs56x26q3g9r80a57gfl0f2rfl1j7xwgxiy1",
+    "sha256bin64": "00ac1dyqxpxy1j11jvc5j35bgc629n2f2pll3912gzih4ir0vrys",
     "deps": {
       "gn": {
         "version": "2021-04-06",
@@ -55,8 +55,8 @@
         "sha256": "199xkks67qrn0xa5fhp24waq2vk8qb78a96cb3kdd8v1hgacgb8x"
       },
       "ungoogled-patches": {
-        "rev": "91.0.4472.101-1",
-        "sha256": "1ca8gjxz3w730446qns253ibs9lx22iysxq5sphb3pw2w0069q8r"
+        "rev": "91.0.4472.114-1",
+        "sha256": "1xb5g3hybaiwn3y1zw1fxd3g0zwmvplrs06sdqnxzsr1qm8b874h"
       }
     }
   }

pkgs/applications/networking/browsers/firefox-bin/update.nix

@@ -24,7 +24,8 @@ in writeScript "update-${name}" ''
   pushd ${basePath}
 
   export GNUPGHOME=`mktemp -d`
-  gpg --keyserver hkps://gpg.mozilla.org --recv-keys 14F26682D0916CDD81E37B6D61B7B526D98F0353
+
+  gpg --receive-keys 14F26682D0916CDD81E37B6D61B7B526D98F0353
 
   tmpfile=`mktemp`
   url=${baseUrl}

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -7,10 +7,10 @@ in
 rec {
   firefox = commonCP rec {
     pname = "firefox";
-    ffversion = "89.0";
+    ffversion = "89.0.2";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "5089720feda15d054d0aa4c3bdeb84760314dadd6381d7360e688d8e396154868220c6315add650d8d2a42652cb8a9bfeb833885812ef0bd70a74ee58ad18aa3";
+      sha512 = "ffd98ab0887611c5b4aba68346c49a7a31a58150fd8bbae610a4d941c4cff0acef0daaebfbb577787a759b4c1ef3c1199f02681148612f4f5b709983e07e0ccb";
     };
 
     meta = {
@@ -51,6 +51,7 @@ rec {
     };
     updateScript = callPackage ./update.nix {
       attrPath = "firefox-esr-78-unwrapped";
+      versionSuffix = "esr";
       versionKey = "ffversion";
     };
   }

pkgs/applications/networking/browsers/firefox/update.nix

@@ -6,6 +6,7 @@
 , gnused
 , gnugrep
 , curl
+, gnupg
 , attrPath
 , runtimeShell
 , baseUrl ? "http://archive.mozilla.org/pub/firefox/releases/"
@@ -15,7 +16,12 @@
 
 writeScript "update-${attrPath}" ''
   #!${runtimeShell}
-  PATH=${lib.makeBinPath [ common-updater-scripts coreutils curl gnugrep gnused xidel ]}
+  PATH=${lib.makeBinPath [ common-updater-scripts coreutils curl gnugrep gnupg gnused xidel ]}
+
+  set -eux
+  HOME=`mktemp -d`
+  export GNUPGHOME=`mktemp -d`
+  gpg --receive-keys 14F26682D0916CDD81E37B6D61B7B526D98F0353
 
   url=${baseUrl}
 
@@ -31,5 +37,11 @@ writeScript "update-${attrPath}" ''
            sort --version-sort | \
            tail -n 1`
 
-  update-source-version ${attrPath} "$version" "" "" --version-key=${versionKey}
+  curl --silent --show-error -o "$HOME"/shasums "$url$version/SHA512SUMS"
+  curl --silent --show-error -o "$HOME"/shasums.asc "$url$version/SHA512SUMS.asc"
+  gpgv --keyring="$GNUPGHOME"/pubring.kbx "$HOME"/shasums.asc "$HOME"/shasums
+
+  hash=$(grep '\.source\.tar\.xz$' "$HOME"/shasums | grep '^[^ ]*' -o)
+
+  update-source-version ${attrPath} "$version" "$hash" "" --version-key=${versionKey}
 ''

pkgs/applications/networking/mailreaders/thunderbird/default.nix

@@ -331,7 +331,7 @@ stdenv.mkDerivation rec {
     attrPath = "thunderbird-78";
     baseUrl = "http://archive.mozilla.org/pub/thunderbird/releases/";
     inherit writeScript lib common-updater-scripts xidel coreutils gnused
-      gnugrep curl runtimeShell;
+      gnugrep gnupg curl runtimeShell;
   };
 
   requiredSystemFeatures = [ "big-parallel" ];

pkgs/applications/office/abiword/default.nix

@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     # default and this patch can be removed.
     # https://github.com/NixOS/nixpkgs/issues/38506
     (fetchurl {
-      url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/enchant-2.1.patch?h=packages/abiword";
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/d3ff951d3c7249927e7113b3de1653031db24596/abiword/trunk/enchant-2.1.patch";
       sha256 = "444dc2aadea3c80310a509b690097541573f6d2652c573d04da66a0f385fcfb2";
     })
   ];

pkgs/applications/science/astronomy/xplanet/default.nix

@@ -16,12 +16,12 @@ stdenv.mkDerivation rec {
   patches = [
     (fetchpatch {
       name = "giflib6.patch";
-      url = "https://git.archlinux.org/svntogit/community.git/plain/trunk/giflib6.patch?h=packages/xplanet&id=ce6f25eb369dc011161613894f01fd0a6ae85a09";
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-community/ce6f25eb369dc011161613894f01fd0a6ae85a09/trunk/giflib6.patch";
       sha256 = "173l0xkqq0v2bpaff7hhwc7y2aw5cclqw8988k1nalhyfbrjb8bl";
     })
     (fetchpatch {
       name = "xplanet-c++11.patch";
-      url = "https://git.archlinux.org/svntogit/community.git/plain/trunk/xplanet-c++11.patch?h=packages/xplanet&id=ce6f25eb369dc011161613894f01fd0a6ae85a09";
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-community/ce6f25eb369dc011161613894f01fd0a6ae85a09/trunk/xplanet-c++11.patch";
       sha256 = "0vldai78ixw49bxch774pps6pq4sp0p33qvkvxywcz7p8kzpg8q2";
     })
   ];

pkgs/applications/window-managers/openbox/default.nix

@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     # Use fetchurl to avoid "fetchpatch: ignores file renames" #32084
     # This patch adds python3 support
     (fetchurl {
-      url = "https://git.archlinux.org/svntogit/community.git/plain/openbox/trunk/py3.patch?id=90cb57ef53d952bb6ab4c33a184f815bbe1791c0";
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-community/90cb57ef53d952bb6ab4c33a184f815bbe1791c0/openbox/trunk/py3.patch";
       sha256 = "1ks99awlkhd5ph9kz94s1r6m1bfvh42g4rmxd14dyg5b421p1ljc";
     })
   ];

pkgs/development/compilers/ghc/8.10.7.nix

@@ -0,0 +1,298 @@
+{ lib, stdenv, pkgsBuildTarget, targetPackages
+
+# build-tools
+, bootPkgs
+, autoconf, automake, coreutils, fetchpatch, fetchurl, perl, python3, m4, sphinx, xattr
+, bash
+
+, libiconv ? null, ncurses
+
+, # GHC can be built with system libffi or a bundled one.
+  libffi ? null
+
+, useLLVM ? !stdenv.targetPlatform.isx86
+, # LLVM is conceptually a run-time-only depedendency, but for
+  # non-x86, we need LLVM to bootstrap later stages, so it becomes a
+  # build-time dependency too.
+  buildLlvmPackages, llvmPackages
+
+, # If enabled, GHC will be built with the GPL-free but slower integer-simple
+  # library instead of the faster but GPLed integer-gmp library.
+  enableIntegerSimple ? !(lib.any (lib.meta.platformMatch stdenv.hostPlatform) gmp.meta.platforms), gmp
+
+, # If enabled, use -fPIC when compiling static libs.
+  enableRelocatedStaticLibs ? stdenv.targetPlatform != stdenv.hostPlatform
+
+  # aarch64 outputs otherwise exceed 2GB limit
+, enableProfiledLibs ? !stdenv.targetPlatform.isAarch64
+
+, # Whether to build dynamic libs for the standard library (on the target
+  # platform). Static libs are always built.
+  enableShared ? !stdenv.targetPlatform.isWindows && !stdenv.targetPlatform.useiOSPrebuilt
+
+, # Whether to build terminfo.
+  enableTerminfo ? !stdenv.targetPlatform.isWindows
+
+, # What flavour to build. An empty string indicates no
+  # specific flavour and falls back to ghc default values.
+  ghcFlavour ? lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
+    (if useLLVM then "perf-cross" else "perf-cross-ncg")
+
+, # Whether to disable the large address space allocator
+  # necessary fix for iOS: https://www.reddit.com/r/haskell/comments/4ttdz1/building_an_osxi386_to_iosarm64_cross_compiler/d5qvd67/
+  disableLargeAddressSpace ? stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64
+}:
+
+assert !enableIntegerSimple -> gmp != null;
+
+let
+  inherit (stdenv) buildPlatform hostPlatform targetPlatform;
+
+  inherit (bootPkgs) ghc;
+
+  # TODO(@Ericson2314) Make unconditional
+  targetPrefix = lib.optionalString
+    (targetPlatform != hostPlatform)
+    "${targetPlatform.config}-";
+
+  buildMK = ''
+    BuildFlavour = ${ghcFlavour}
+    ifneq \"\$(BuildFlavour)\" \"\"
+    include mk/flavours/\$(BuildFlavour).mk
+    endif
+    DYNAMIC_GHC_PROGRAMS = ${if enableShared then "YES" else "NO"}
+    INTEGER_LIBRARY = ${if enableIntegerSimple then "integer-simple" else "integer-gmp"}
+  '' + lib.optionalString (targetPlatform != hostPlatform) ''
+    Stage1Only = ${if targetPlatform.system == hostPlatform.system then "NO" else "YES"}
+    CrossCompilePrefix = ${targetPrefix}
+    HADDOCK_DOCS = NO
+    BUILD_SPHINX_HTML = NO
+    BUILD_SPHINX_PDF = NO
+  '' + lib.optionalString (!enableProfiledLibs) ''
+    GhcLibWays = "v dyn"
+  '' + lib.optionalString enableRelocatedStaticLibs ''
+    GhcLibHcOpts += -fPIC
+    GhcRtsHcOpts += -fPIC
+  '' + lib.optionalString targetPlatform.useAndroidPrebuilt ''
+    EXTRA_CC_OPTS += -std=gnu99
+  ''
+  # While split sections are now enabled by default in ghc 8.8 for windows,
+  # they seem to lead to `too many sections` errors when building base for
+  # profiling.
+  + lib.optionalString targetPlatform.isWindows ''
+    SplitSections = NO
+  '';
+
+  # Splicer will pull out correct variations
+  libDeps = platform: lib.optional enableTerminfo ncurses
+    ++ [libffi]
+    ++ lib.optional (!enableIntegerSimple) gmp
+    ++ lib.optional (platform.libc != "glibc" && !targetPlatform.isWindows) libiconv;
+
+  toolsForTarget = [
+    pkgsBuildTarget.targetPackages.stdenv.cc
+  ] ++ lib.optional useLLVM buildLlvmPackages.llvm;
+
+  targetCC = builtins.head toolsForTarget;
+
+  # ld.gold is disabled for musl libc due to https://sourceware.org/bugzilla/show_bug.cgi?id=23856
+  # see #84670 and #49071 for more background.
+  useLdGold = targetPlatform.isLinux && !(targetPlatform.useLLVM or false) && !targetPlatform.isMusl && !targetPlatform.isWindows;
+
+  runtimeDeps = [
+    targetPackages.stdenv.cc.bintools
+    coreutils
+  ]
+  # On darwin, we need unwrapped bintools as well (for otool)
+  ++ lib.optionals (stdenv.targetPlatform.isDarwin) [
+    targetPackages.stdenv.cc.bintools.bintools
+  ];
+
+in
+stdenv.mkDerivation (rec {
+  version = "8.10.7";
+  name = "${targetPrefix}ghc-${version}";
+
+  src = fetchurl {
+    url = "https://downloads.haskell.org/ghc/${version}/ghc-${version}-src.tar.xz";
+    sha256 = "e3eef6229ce9908dfe1ea41436befb0455fefb1932559e860ad4c606b0d03c9d";
+  };
+
+  enableParallelBuilding = true;
+
+  outputs = [ "out" "doc" ];
+
+  patches = [
+    # See upstream patch at
+    # https://gitlab.haskell.org/ghc/ghc/-/merge_requests/4885. Since we build
+    # from source distributions, the auto-generated configure script needs to be
+    # patched as well, therefore we use an in-tree patch instead of pulling the
+    # upstream patch. Don't forget to check backport status of the upstream patch
+    # when adding new GHC releases in nixpkgs.
+    ./respect-ar-path.patch
+
+    # cabal passes incorrect --host= when cross-compiling
+    # https://github.com/haskell/cabal/issues/5887
+    (fetchpatch {
+            url = "https://raw.githubusercontent.com/input-output-hk/haskell.nix/122bd81150386867da07fdc9ad5096db6719545a/overlays/patches/ghc/cabal-host.patch";
+      sha256 = "sha256:0yd0sajgi24sc1w5m55lkg2lp6kfkgpp3lgija2c8y3cmkwfpdc1";
+    })
+
+    # In order to build ghcjs packages, the Cabal of the ghc used for the ghcjs
+    # needs to be patched. Ref https://github.com/haskell/cabal/pull/7575
+    (fetchpatch {
+      url = "https://github.com/haskell/cabal/commit/369c4a0a54ad08a9e6b0d3bd303fedd7b5e5a336.patch";
+      sha256 = "120f11hwyaqa0pq9g5l1300crqij49jg0rh83hnp9sa49zfdwx1n";
+      stripLen = 3;
+      extraPrefix = "libraries/Cabal/Cabal/";
+    })
+  ] ++ lib.optionals stdenv.isDarwin [
+    # Make Block.h compile with c++ compilers. Remove with the next release
+    (fetchpatch {
+      url = "https://gitlab.haskell.org/ghc/ghc/-/commit/97d0b0a367e4c6a52a17c3299439ac7de129da24.patch";
+      sha256 = "0r4zjj0bv1x1m2dgxp3adsf2xkr94fjnyj1igsivd9ilbs5ja0b5";
+    })
+  ];
+
+  postPatch = "patchShebangs .";
+
+  # GHC is a bit confused on its cross terminology.
+  preConfigure = ''
+    for env in $(env | grep '^TARGET_' | sed -E 's|\+?=.*||'); do
+      export "''${env#TARGET_}=''${!env}"
+    done
+    # GHC is a bit confused on its cross terminology, as these would normally be
+    # the *host* tools.
+    export CC="${targetCC}/bin/${targetCC.targetPrefix}cc"
+    export CXX="${targetCC}/bin/${targetCC.targetPrefix}cxx"
+    # Use gold to work around https://sourceware.org/bugzilla/show_bug.cgi?id=16177
+    export LD="${targetCC.bintools}/bin/${targetCC.bintools.targetPrefix}ld${lib.optionalString useLdGold ".gold"}"
+    export AS="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}as"
+    export AR="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ar"
+    export NM="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}nm"
+    export RANLIB="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ranlib"
+    export READELF="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}readelf"
+    export STRIP="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}strip"
+
+    echo -n "${buildMK}" > mk/build.mk
+    sed -i -e 's|-isysroot /Developer/SDKs/MacOSX10.5.sdk||' configure
+  '' + lib.optionalString (!stdenv.isDarwin) ''
+    export NIX_LDFLAGS+=" -rpath $out/lib/ghc-${version}"
+  '' + lib.optionalString stdenv.isDarwin ''
+    export NIX_LDFLAGS+=" -no_dtrace_dof"
+
+    # GHC tries the host xattr /usr/bin/xattr by default which fails since it expects python to be 2.7
+    export XATTR=${lib.getBin xattr}/bin/xattr
+  '' + lib.optionalString targetPlatform.useAndroidPrebuilt ''
+    sed -i -e '5i ,("armv7a-unknown-linux-androideabi", ("e-m:e-p:32:32-i64:64-v128:64:128-a:0:32-n32-S64", "cortex-a8", ""))' llvm-targets
+  '' + lib.optionalString targetPlatform.isMusl ''
+      echo "patching llvm-targets for musl targets..."
+      echo "Cloning these existing '*-linux-gnu*' targets:"
+      grep linux-gnu llvm-targets | sed 's/^/  /'
+      echo "(go go gadget sed)"
+      sed -i 's,\(^.*linux-\)gnu\(.*\)$,\0\n\1musl\2,' llvm-targets
+      echo "llvm-targets now contains these '*-linux-musl*' targets:"
+      grep linux-musl llvm-targets | sed 's/^/  /'
+
+      echo "And now patching to preserve '-musleabi' as done with '-gnueabi'"
+      # (aclocal.m4 is actual source, but patch configure as well since we don't re-gen)
+      for x in configure aclocal.m4; do
+        substituteInPlace $x \
+          --replace '*-android*|*-gnueabi*)' \
+                    '*-android*|*-gnueabi*|*-musleabi*)'
+      done
+  '';
+
+  # TODO(@Ericson2314): Always pass "--target" and always prefix.
+  configurePlatforms = [ "build" "host" ]
+    ++ lib.optional (targetPlatform != hostPlatform) "target";
+
+  # `--with` flags for libraries needed for RTS linker
+  configureFlags = [
+    "--datadir=$doc/share/doc/ghc"
+    "--with-curses-includes=${ncurses.dev}/include" "--with-curses-libraries=${ncurses.out}/lib"
+  ] ++ lib.optionals (libffi != null) [
+    "--with-system-libffi"
+    "--with-ffi-includes=${targetPackages.libffi.dev}/include"
+    "--with-ffi-libraries=${targetPackages.libffi.out}/lib"
+  ] ++ lib.optionals (targetPlatform == hostPlatform && !enableIntegerSimple) [
+    "--with-gmp-includes=${targetPackages.gmp.dev}/include"
+    "--with-gmp-libraries=${targetPackages.gmp.out}/lib"
+  ] ++ lib.optionals (targetPlatform == hostPlatform && hostPlatform.libc != "glibc" && !targetPlatform.isWindows) [
+    "--with-iconv-includes=${libiconv}/include"
+    "--with-iconv-libraries=${libiconv}/lib"
+  ] ++ lib.optionals (targetPlatform != hostPlatform) [
+    "--enable-bootstrap-with-devel-snapshot"
+  ] ++ lib.optionals useLdGold [
+    "CFLAGS=-fuse-ld=gold"
+    "CONF_GCC_LINKER_OPTS_STAGE1=-fuse-ld=gold"
+    "CONF_GCC_LINKER_OPTS_STAGE2=-fuse-ld=gold"
+  ] ++ lib.optionals (disableLargeAddressSpace) [
+    "--disable-large-address-space"
+  ];
+
+  # Make sure we never relax`$PATH` and hooks support for compatibility.
+  strictDeps = true;
+
+  # Don’t add -liconv to LDFLAGS automatically so that GHC will add it itself.
+  dontAddExtraLibs = true;
+
+  nativeBuildInputs = [
+    perl autoconf automake m4 python3 sphinx
+    ghc bootPkgs.alex bootPkgs.happy bootPkgs.hscolour
+  ];
+
+  # For building runtime libs
+  depsBuildTarget = toolsForTarget;
+
+  buildInputs = [ perl bash ] ++ (libDeps hostPlatform);
+
+  propagatedBuildInputs = [ targetPackages.stdenv.cc ]
+    ++ lib.optional useLLVM llvmPackages.llvm;
+
+  depsTargetTarget = map lib.getDev (libDeps targetPlatform);
+  depsTargetTargetPropagated = map (lib.getOutput "out") (libDeps targetPlatform);
+
+  # required, because otherwise all symbols from HSffi.o are stripped, and
+  # that in turn causes GHCi to abort
+  stripDebugFlags = [ "-S" ] ++ lib.optional (!targetPlatform.isDarwin) "--keep-file-symbols";
+
+  checkTarget = "test";
+
+  hardeningDisable = [ "format" ] ++ lib.optional stdenv.targetPlatform.isMusl "pie";
+
+  postInstall = ''
+    # Install the bash completion file.
+    install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc
+
+    # Patch scripts to include "readelf" and "cat" in $PATH.
+    for i in "$out/bin/"*; do
+      test ! -h $i || continue
+      egrep --quiet '^#!' <(head -n 1 $i) || continue
+      sed -i -e '2i export PATH="$PATH:${lib.makeBinPath runtimeDeps}"' $i
+    done
+  '';
+
+  passthru = {
+    inherit bootPkgs targetPrefix;
+
+    inherit llvmPackages;
+    inherit enableShared;
+
+    # Our Cabal compiler name
+    haskellCompilerName = "ghc-${version}";
+  };
+
+  meta = {
+    homepage = "http://haskell.org/ghc";
+    description = "The Glasgow Haskell Compiler";
+    maintainers = with lib.maintainers; [ marcweber andres peti ];
+    timeout = 24 * 3600;
+    inherit (ghc.meta) license platforms;
+  };
+
+} // lib.optionalAttrs targetPlatform.useAndroidPrebuilt {
+  dontStrip = true;
+  dontPatchELF = true;
+  noAuditTmpdir = true;
+})

pkgs/development/compilers/ghc/respect-ar-path.patch

@@ -0,0 +1,25 @@
+diff -urd a/aclocal.m4 b/aclocal.m4
+--- a/aclocal.m4
++++ b/aclocal.m4
+@@ -1199,7 +1199,8 @@
+ # thinks that target == host so it never checks the unqualified
+ # tools for Windows. See #14274.
+ AC_DEFUN([FP_PROG_AR],
+-[if test -z "$fp_prog_ar"; then
++[AC_SUBST(fp_prog_ar,$AR)
++if test -z "$fp_prog_ar"; then
+   if test "$HostOS" = "mingw32"
+   then
+     AC_PATH_PROG([fp_prog_ar], [ar])
+diff -urd a/configure b/configure
+--- a/configure
++++ b/configure
+@@ -10744,6 +10744,8 @@
+ test -z "$INSTALL_DATA" && INSTALL_DATA='${INSTALL} -m 644'
+ 
+ 
++fp_prog_ar=$AR
++
+ if test -z "$fp_prog_ar"; then
+   if test "$HostOS" = "mingw32"
+   then

pkgs/development/compilers/ghcjs/8.10/common-overrides.nix

@@ -0,0 +1,6 @@
+{ haskellLib }:
+
+let inherit (haskellLib) addBuildTools appendConfigureFlag dontHaddock doJailbreak;
+in self: super: {
+  ghcjs = doJailbreak super.ghcjs;
+}

pkgs/development/compilers/ghcjs/8.10/configured-ghcjs-src.nix

@@ -0,0 +1,60 @@
+{ perl
+, autoconf
+, automake
+, python3
+, gcc
+, cabal-install
+, runCommand
+, lib
+, stdenv
+
+, ghc
+, happy
+, alex
+
+, ghcjsSrc
+, version
+}:
+
+runCommand "configured-ghcjs-src" {
+  nativeBuildInputs = [
+    perl
+    autoconf
+    automake
+    python3
+    ghc
+    happy
+    alex
+    cabal-install
+  ] ++ lib.optionals stdenv.isDarwin [
+    gcc # https://github.com/ghcjs/ghcjs/issues/663
+  ];
+  inherit ghcjsSrc;
+} ''
+  export HOME=$(pwd)
+  mkdir $HOME/.cabal
+  touch $HOME/.cabal/config
+  cp -r "$ghcjsSrc" "$out"
+  chmod -R +w "$out"
+  cd "$out"
+
+  # TODO: Find a better way to avoid impure version numbers
+  sed -i 's/RELEASE=NO/RELEASE=YES/' ghc/configure.ac
+
+  # These files are needed by ghc-boot package, and these are generated by the
+  # make/hadrian build system when compiling ghc. Since we dont have access to
+  # the generated code of the ghc while it got built, here is a little hack to
+  # generate these again.
+  runhaskell ${./generate_host_version.hs}
+  mkdir -p utils/pkg-cache/ghc/libraries/ghc-boot/dist-install/build/GHC/Platform
+  mv Host.hs utils/pkg-cache/ghc/libraries/ghc-boot/dist-install/build/GHC/Platform/Host.hs
+  mv Version.hs utils/pkg-cache/ghc/libraries/ghc-boot/dist-install/build/GHC/Version.hs
+
+  # The ghcjs has the following hardcoded paths of lib dir in its code. Patching
+  # these to match the path expected by the nixpkgs's generic-builder, etc.
+  sed -i 's/libSubDir = "lib"/libSubDir = "lib\/ghcjs-${version}"/' src-bin/Boot.hs
+  sed -i 's@let libDir = takeDirectory haddockPath </> ".." </> "lib"@let libDir = takeDirectory haddockPath </> ".." </> "lib/ghcjs-${version}"@' src-bin/HaddockDriver.hs
+
+  patchShebangs .
+  ./utils/makePackages.sh copy
+''

pkgs/development/compilers/ghcjs/8.10/default.nix

@@ -0,0 +1,121 @@
+{ stdenv
+, pkgsHostHost
+, callPackage
+, fetchgit
+, ghcjsSrcJson ? null
+, ghcjsSrc ? fetchgit (builtins.fromJSON (builtins.readFile ghcjsSrcJson))
+, bootPkgs
+, stage0
+, haskellLib
+, cabal-install
+, nodejs
+, makeWrapper
+, xorg
+, gmp
+, pkg-config
+, gcc
+, lib
+, ghcjsDepOverrides ? (_:_:{})
+, haskell
+, linkFarm
+, buildPackages
+}:
+
+let
+  passthru = {
+    configuredSrc = callPackage ./configured-ghcjs-src.nix {
+      inherit ghcjsSrc;
+      inherit (bootPkgs) ghc alex;
+      inherit (bootGhcjs) version;
+      happy = bootPkgs.happy_1_19_12;
+    };
+    bootPkgs = bootPkgs.extend (lib.foldr lib.composeExtensions (_:_:{}) [
+      (self: _: import stage0 {
+        inherit (passthru) configuredSrc;
+        inherit (self) callPackage;
+      })
+
+      (callPackage ./common-overrides.nix {
+        inherit haskellLib;
+      })
+      ghcjsDepOverrides
+    ]);
+
+    targetPrefix = "";
+    inherit bootGhcjs;
+    inherit (bootGhcjs) version;
+    isGhcjs = true;
+
+    enableShared = true;
+
+    socket-io = pkgsHostHost.nodePackages."socket.io";
+
+    haskellCompilerName = "ghcjs-${bootGhcjs.version}";
+  };
+
+  bootGhcjs = haskellLib.justStaticExecutables passthru.bootPkgs.ghcjs;
+
+  # This provides the stuff we need from the emsdk
+  emsdk = linkFarm "emsdk" [
+    { name = "upstream/bin"; path = buildPackages.clang + "/bin";}
+    { name = "upstream/emscripten"; path = buildPackages.emscripten + "/bin"; }
+  ];
+
+in stdenv.mkDerivation {
+    name = bootGhcjs.name;
+    src = passthru.configuredSrc;
+    nativeBuildInputs = [
+      bootGhcjs
+      passthru.bootPkgs.ghc
+      cabal-install
+      nodejs
+      makeWrapper
+      xorg.lndir
+      gmp
+      pkg-config
+    ] ++ lib.optionals stdenv.isDarwin [
+      gcc # https://github.com/ghcjs/ghcjs/issues/663
+    ];
+    dontConfigure = true;
+    dontInstall = true;
+    buildPhase = ''
+      export HOME=$TMP
+      mkdir $HOME/.cabal
+      touch $HOME/.cabal/config
+      cd lib/boot
+
+      mkdir -p $out/bin
+      mkdir -p $out/lib/${bootGhcjs.name}
+      lndir ${bootGhcjs}/bin $out/bin
+      chmod -R +w $out/bin
+      rm $out/bin/ghcjs-boot
+      cp ${bootGhcjs}/bin/ghcjs-boot $out/bin
+      rm $out/bin/haddock
+      cp ${bootGhcjs}/bin/haddock $out/bin
+      cp ${bootGhcjs}/bin/private-ghcjs-hsc2hs $out/bin/ghcjs-hsc2hs
+
+      wrapProgram $out/bin/ghcjs-boot --set ghcjs_libexecdir $out/bin
+
+      wrapProgram $out/bin/ghcjs --add-flags "-B$out/lib/${bootGhcjs.name}"
+      wrapProgram $out/bin/haddock --add-flags "-B$out/lib/${bootGhcjs.name}"
+      wrapProgram $out/bin/ghcjs-pkg --add-flags "--global-package-db=$out/lib/${bootGhcjs.name}/package.conf.d"
+      wrapProgram $out/bin/ghcjs-hsc2hs --add-flags "-I$out/lib/${bootGhcjs.name}/include --template=$out/lib/${bootGhcjs.name}/include/template-hsc.h"
+
+      env PATH=$out/bin:$PATH $out/bin/ghcjs-boot --with-emsdk=${emsdk} --no-haddock
+    '';
+
+    enableParallelBuilding = true;
+
+    inherit passthru;
+
+    meta = {
+      platforms = with lib.platforms; linux ++ darwin;
+
+      # Hydra limits jobs to only outputting 1 gigabyte worth of files.
+      # GHCJS outputs over 3 gigabytes.
+      # https://github.com/NixOS/nixpkgs/pull/137066#issuecomment-922335563
+      hydraPlatforms = lib.platforms.none;
+
+      maintainers = with lib.maintainers; [ obsidian-systems-maintenance ];
+    };
+  }

pkgs/development/compilers/ghcjs/8.10/generate_host_version.hs

@@ -0,0 +1,54 @@
+-- Generate the Host.hs and Version.hs as done by hadrian/src/Rules/Generate.hs
+
+import GHC.Platform.Host
+import GHC.Version
+
+main = do
+  writeFile "Version.hs" versionHs
+  writeFile "Host.hs" platformHostHs
+
+-- | Generate @Version.hs@ files.
+versionHs :: String
+versionHs = unlines
+        [ "module GHC.Version where"
+        , ""
+        , "import Prelude -- See Note [Why do we import Prelude here?]"
+        , ""
+        , "cProjectGitCommitId   :: String"
+        , "cProjectGitCommitId   = " ++ show cProjectGitCommitId
+        , ""
+        , "cProjectVersion       :: String"
+        , "cProjectVersion       = " ++ show cProjectVersion
+        , ""
+        , "cProjectVersionInt    :: String"
+        , "cProjectVersionInt    = " ++ show cProjectVersionInt
+        , ""
+        , "cProjectPatchLevel    :: String"
+        , "cProjectPatchLevel    = " ++ show cProjectPatchLevel
+        , ""
+        , "cProjectPatchLevel1   :: String"
+        , "cProjectPatchLevel1   = " ++ show cProjectPatchLevel1
+        , ""
+        , "cProjectPatchLevel2   :: String"
+        , "cProjectPatchLevel2   = " ++ show cProjectPatchLevel2
+        ]
+
+-- | Generate @Platform/Host.hs@ files.
+platformHostHs :: String
+platformHostHs = unlines
+        [ "module GHC.Platform.Host where"
+        , ""
+        , "import GHC.Platform"
+        , ""
+        , "cHostPlatformArch :: Arch"
+        , "cHostPlatformArch = " ++ show cHostPlatformArch
+        , ""
+        , "cHostPlatformOS   :: OS"
+        , "cHostPlatformOS   = " ++ show cHostPlatformOS
+        , ""
+        , "cHostPlatformMini :: PlatformMini"
+        , "cHostPlatformMini = PlatformMini"
+        , "  { platformMini_arch = cHostPlatformArch"
+        , "  , platformMini_os = cHostPlatformOS"
+        , "  }"
+        ]

pkgs/development/compilers/ghcjs/8.10/ghcjs-base.nix

@@ -0,0 +1,29 @@
+{ mkDerivation, aeson, array, attoparsec, base, binary, bytestring
+, containers, deepseq, directory, dlist, fetchgit, ghc-prim
+, ghcjs-prim, hashable, HUnit, integer-gmp, primitive, QuickCheck
+, quickcheck-unicode, random, scientific, stdenv, test-framework
+, test-framework-hunit, test-framework-quickcheck2, text, time
+, transformers, unordered-containers, vector
+}:
+mkDerivation {
+  pname = "ghcjs-base";
+  version = "0.2.0.3";
+  src = fetchgit {
+    url = "git://github.com/ghcjs/ghcjs-base";
+    sha256 = "15fdkjv0l7hpbbsn5238xxgzfdg61g666nzbv2sgxkwryn5rycv0";
+    rev = "85e31beab9beffc3ea91b954b61a5d04e708b8f2";
+  };
+  libraryHaskellDepends = [
+    aeson attoparsec base binary bytestring containers deepseq dlist
+    ghc-prim ghcjs-prim hashable integer-gmp primitive scientific text
+    time transformers unordered-containers vector
+  ];
+  testHaskellDepends = [
+    array base bytestring deepseq directory ghc-prim ghcjs-prim HUnit
+    primitive QuickCheck quickcheck-unicode random test-framework
+    test-framework-hunit test-framework-quickcheck2 text
+  ];
+  homepage = "https://github.com/ghcjs/ghcjs-base";
+  description = "base library for GHCJS";
+  license = stdenv.lib.licenses.mit;
+}

pkgs/development/compilers/ghcjs/8.10/git.json

@@ -0,0 +1,6 @@
+{
+  "url": "https://github.com/obsidiansystems/ghcjs",
+  "rev": "9fc935f2c3ba6c33ec62eb83afc9f52a893eb68c",
+  "sha256": "sha256:063dmir39c4i1z8ypnmq86g1x2vhqndmdpzc4hyzsy5jjqcbx6i3",
+  "fetchSubmodules": true
+}

pkgs/development/compilers/ghcjs/8.10/patches/vector-ghcjs-storable-set.patch

@@ -0,0 +1,14 @@
+diff --git a/Data/Vector/Storable/Mutable.hs b/Data/Vector/Storable/Mutable.hs
+index 8b538bc..2b74fce 100644
+--- a/Data/Vector/Storable/Mutable.hs
++++ b/Data/Vector/Storable/Mutable.hs
+@@ -197,7 +197,9 @@ storableSet (MVector n fp) x
+                   1 -> storableSetAsPrim n fp x (undefined :: Word8)
+                   2 -> storableSetAsPrim n fp x (undefined :: Word16)
+                   4 -> storableSetAsPrim n fp x (undefined :: Word32)
++#if !defined(ghcjs_HOST_OS)
+                   8 -> storableSetAsPrim n fp x (undefined :: Word64)
++#endif
+                   _ -> withForeignPtr fp $ \p -> do
+                        poke p x
+ 

pkgs/development/compilers/ghcjs/8.10/stage0.nix

@@ -0,0 +1,77 @@
+{ callPackage, configuredSrc }:
+
+{
+
+  ghcjs = callPackage
+    ({ mkDerivation, aeson, alex, array, attoparsec, base, base16-bytestring
+     , base64-bytestring, binary, bytestring, Cabal, containers
+     , cryptohash, data-default, deepseq, directory, executable-path
+     , filepath, ghc-boot, ghc-boot-th, ghc-compact, ghc-heap, ghc-paths
+     , ghci, happy, hashable, hpc, http-types, HUnit, lens, lib
+     , lifted-base, mtl, network, optparse-applicative, parallel, parsec
+     , process, random, safe, shelly, split, stringsearch, syb, tar
+     , template-haskell, terminfo, test-framework, test-framework-hunit
+     , text, time, transformers, unix, unix-compat, unordered-containers
+     , vector, wai, wai-app-static, wai-extra, wai-websockets, warp
+     , webdriver, websockets, wl-pprint-text, xhtml, yaml
+     }:
+     mkDerivation {
+       pname = "ghcjs";
+       version = "8.10.7";
+       src = configuredSrc + /.;
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         aeson array attoparsec base base16-bytestring base64-bytestring
+         binary bytestring Cabal containers cryptohash data-default deepseq
+         directory filepath ghc-boot ghc-boot-th ghc-compact ghc-heap
+         ghc-paths ghci hashable hpc lens mtl optparse-applicative parallel
+         parsec process safe split stringsearch syb template-haskell
+         terminfo text time transformers unix unordered-containers vector
+         wl-pprint-text yaml
+       ];
+       libraryToolDepends = [ alex happy ];
+       executableHaskellDepends = [
+         aeson array base binary bytestring Cabal containers deepseq
+         directory executable-path filepath ghc-boot lens mtl
+         optparse-applicative parsec process tar terminfo text time
+         transformers unix unix-compat unordered-containers vector xhtml
+         yaml
+       ];
+       testHaskellDepends = [
+         aeson base bytestring data-default deepseq directory filepath
+         http-types HUnit lens lifted-base network optparse-applicative
+         process random shelly test-framework test-framework-hunit text time
+         transformers unordered-containers wai wai-app-static wai-extra
+         wai-websockets warp webdriver websockets yaml
+       ];
+       description = "Haskell to JavaScript compiler";
+       license = lib.licenses.mit;
+     }) {};
+
+  ghcjs-th = callPackage
+    ({ mkDerivation, base, binary, bytestring, containers, ghc-prim
+    , ghci, lib, template-haskell
+    }:
+    mkDerivation {
+      pname = "ghcjs-th";
+      version = "0.1.0.0";
+      src = configuredSrc + /lib/ghcjs-th;
+      libraryHaskellDepends = [
+        base binary bytestring containers ghc-prim ghci template-haskell
+      ];
+      homepage = "http://github.com/ghcjs";
+      license = lib.licenses.mit;
+    }) {};
+
+  ghcjs-prim = callPackage
+    ({ mkDerivation, base, ghc-prim, lib }:
+    mkDerivation {
+      pname = "ghcjs-prim";
+      version = "0.1.1.0";
+      src = ./.;
+      libraryHaskellDepends = [ base ghc-prim ];
+      homepage = "http://github.com/ghcjs";
+      license = lib.licenses.mit;
+    }) {};
+}

pkgs/development/compilers/go/1.15.nix

@@ -31,11 +31,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.15.10";
+  version = "1.15.13";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "0rfx20y13cflv68nn8jci1fx34vfdn7qgyavm5hivd0h15pcmny1";
+    sha256 = "sha256-mQaeciNHnM5FU/hPh0uTRfb0BF8nz1CJSJtUbaYZokQ=";
   };
 
   # perl is used for testing go vet

pkgs/development/compilers/go/1.16.nix

@@ -11,7 +11,7 @@ let
 
   inherit (lib) optionals optionalString;
 
-  version = "1.16.2";
+  version = "1.16.5";
 
   go_bootstrap = buildPackages.callPackage ./bootstrap.nix { };
 
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "1sl33wkhp6pi9f15f6khp5a7l7xwmpc3sp1zmji8pjr3g8l19jip";
+    sha256 = "sha256-e/p+WQjHzJ512l3fMGbXy88/2fpRlFhRMl7rwX9QuoA=";
   };
 
   # perl is used for testing go vet

pkgs/development/haskell-modules/configuration-ghcjs-8.10.nix

@@ -0,0 +1,113 @@
+# GHCJS package fixes
+#
+# Please insert new packages *alphabetically*
+# in the OTHER PACKAGES section.
+{ pkgs, haskellLib }:
+
+let
+  removeLibraryHaskellDepends = pnames: depends:
+    builtins.filter (e: !(builtins.elem (e.pname or "") pnames)) depends;
+in
+
+with haskellLib;
+
+self: super:
+
+## GENERAL SETUP BASE PACKAGES
+{
+  inherit (self.ghc.bootPkgs)
+    jailbreak-cabal alex happy gtk2hs-buildtools rehoo hoogle;
+
+  ghcjs-base = dontCheck (self.callPackage ../compilers/ghcjs/8.10/ghcjs-base.nix {
+    fetchgit = pkgs.buildPackages.fetchgit;
+  });
+
+  # GHCJS does not ship with the same core packages as GHC.
+  # https://github.com/ghcjs/ghcjs/issues/676
+  stm = doJailbreak self.stm_2_5_0_0;
+  exceptions = dontCheck self.exceptions_0_10_4;
+
+## OTHER PACKAGES
+
+  # Runtime exception in tests, missing C API h$realloc
+  base-compat-batteries = dontCheck super.base-compat-batteries;
+
+  # nodejs crashes during test
+  ChasingBottoms = dontCheck super.ChasingBottoms;
+
+  # need doctest
+  comonad = dontCheck super.comonad;
+  distributive = dontCheck super.distributive;
+
+  # doctest doesn't work on ghcjs, but sometimes dontCheck doesn't seem to get rid of the dependency
+  doctest = pkgs.lib.warn "ignoring dependency on doctest" null;
+
+  ghcjs-dom = overrideCabal super.ghcjs-dom (drv: {
+    libraryHaskellDepends = with self; [
+      ghcjs-base ghcjs-dom-jsffi text transformers
+    ];
+    configureFlags = [ "-fjsffi" "-f-webkit" ];
+  });
+
+  ghcjs-dom-jsffi = overrideCabal super.ghcjs-dom-jsffi (drv: {
+    libraryHaskellDepends = (drv.libraryHaskellDepends or []) ++ [ self.ghcjs-base self.text ];
+    broken = false;
+  });
+
+  # https://github.com/Deewiant/glob/issues/39
+  Glob = dontCheck super.Glob;
+
+  # Test fails to compile during the hsc2hs stage
+  hashable = dontCheck super.hashable;
+
+  # uses doctest
+  http-types = dontCheck super.http-types;
+
+  jsaddle = overrideCabal super.jsaddle (drv: {
+    libraryHaskellDepends = (drv.libraryHaskellDepends or []) ++ [ self.ghcjs-base ];
+  });
+
+  # Tests hang, possibly some issue with tasty and race(async) usage in the nonTerminating tests
+  logict = dontCheck super.logict;
+
+  patch = dontCheck super.patch;
+
+  # TODO: tests hang
+  pcre-light = dontCheck super.pcre-light;
+
+  # Terminal test not supported on ghcjs
+  QuickCheck = dontCheck super.QuickCheck;
+
+  reflex = overrideCabal super.reflex (drv: {
+    libraryHaskellDepends = (drv.libraryHaskellDepends or []) ++ [ self.ghcjs-base ];
+  });
+
+  reflex-dom = overrideCabal super.reflex-dom (drv: {
+    libraryHaskellDepends = removeLibraryHaskellDepends ["jsaddle-webkit2gtk"] (drv.libraryHaskellDepends or []);
+  });
+
+  # https://github.com/dreixel/syb/issues/21
+  syb = dontCheck super.syb;
+
+  # nodejs crashes during test
+  scientific = dontCheck super.scientific;
+
+  # Tests use TH which gives error
+  tasty-quickcheck = dontCheck super.tasty-quickcheck;
+
+  temporary = dontCheck super.temporary;
+
+  # 2 tests fail, related to time precision
+  time-compat = dontCheck super.time-compat;
+
+  # TODO: The tests have a TH error, which has been fixed in ghc
+  # https://gitlab.haskell.org/ghc/ghc/-/issues/15481 but somehow the issue is
+  # still present here https://github.com/glguy/th-abstraction/issues/53
+  th-abstraction = dontCheck super.th-abstraction;
+
+  # https://github.com/haskell/vector/issues/410
+  vector = appendPatch super.vector (../compilers/ghcjs/patches/vector-ghcjs-storable-set.patch) ;
+
+  # Need hedgehog for tests, which fails to compile due to dep on concurrent-output
+  zenc = dontCheck super.zenc;
+}

pkgs/development/haskell-modules/hackage-packages.nix

@@ -85104,6 +85104,22 @@ self: {
        license = stdenv.lib.licenses.bsd3;
      }) {};
 
+  "exceptions_0_10_4" = callPackage
+    ({ mkDerivation, base, fail, mtl, stm, template-haskell, transformers
+    , transformers-compat
+    }:
+     mkDerivation {
+       pname = "exceptions";
+       version = "0.10.4";
+       sha256 = "1kw4pmx7j7zwbdwm0dyn9rcs6kp4byfxy48861yxdz6gam1zn2sd";
+       libraryHaskellDepends = [
+         base fail mtl stm template-haskell transformers transformers-compat
+       ];
+       description = "Extensible optionally-pure exceptions";
+       license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {};
+
   "exceptional" = callPackage
     ({ mkDerivation, base, exceptions }:
      mkDerivation {
@@ -114432,6 +114448,24 @@ self: {
        hydraPlatforms = stdenv.lib.platforms.none;
      }) {};
 
+  "happy_1_19_12" = callPackage
+    ({ mkDerivation, array, base, Cabal, containers, directory
+     , filepath, mtl, process
+     }:
+     mkDerivation {
+       pname = "happy";
+       version = "1.19.12";
+       sha256 = "03xlmq6qmdx4zvzw8bp33kd9g7yvcq5cz4wg50xilw812kj276pv";
+       isLibrary = false;
+       isExecutable = true;
+       setupHaskellDepends = [ base Cabal directory filepath ];
+       executableHaskellDepends = [ array base containers mtl ];
+       testHaskellDepends = [ base process ];
+       description = "Happy is a parser generator for Haskell";
+       license = stdenv.lib.licenses.bsd2;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {};
+
   "happy" = callPackage
     ({ mkDerivation, array, base, containers, mtl, process }:
      mkDerivation {

pkgs/development/libraries/gcc/libstdc++/5.nix

@@ -19,13 +19,13 @@ stdenv.mkDerivation rec {
     ./no-sys-dirs.patch
     (fetchpatch {
       name = "siginfo.patch";
-      url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/siginfo.patch?h=packages/libstdc%2B%2B5&id=e36ee8ed9bb5942db14cf6249a2ead14974a2bfa";
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/e36ee8ed9bb5942db14cf6249a2ead14974a2bfa/trunk/siginfo.patch";
       sha256 = "15zldbm33yba293dgrgsbv3j332hkc3iqpyc8fa7zl42mh9qk22j";
       extraPrefix = "";
     })
     (fetchpatch {
       name = "gcc-3.4.3-no_multilib_amd64.patch";
-      url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/gcc-3.4.3-no_multilib_amd64.patch?h=packages/libstdc%2B%2B5&id=e36ee8ed9bb5942db14cf6249a2ead14974a2bfa";
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/e36ee8ed9bb5942db14cf6249a2ead14974a2bfa/trunk/gcc-3.4.3-no_multilib_amd64.patch";
       sha256 = "11m5lc51b0addhc4yq4rz0dwpv6k73rrj73wya3lqdk8rly6cjpm";
       extraPrefix = "";
     })

pkgs/development/libraries/isl/0.14.1.nix

@@ -4,7 +4,10 @@ stdenv.mkDerivation rec {
   name = "isl-0.14.1";
 
   src = fetchurl {
-    url = "http://isl.gforge.inria.fr/${name}.tar.xz";
+    urls = [
+      "mirror://sourceforge/libisl/${name}.tar.xz"
+      "https://libisl.sourceforge.io/${name}.tar.xz"
+    ];
     sha256 = "0xa6xagah5rywkywn19rzvbvhfvkmylhcxr6z9z7bz29cpiwk0l8";
   };
 

pkgs/development/libraries/isl/0.17.1.nix

@@ -4,7 +4,10 @@ stdenv.mkDerivation rec {
   name = "isl-0.17.1";
 
   src = fetchurl {
-    url = "http://isl.gforge.inria.fr/${name}.tar.xz";
+    urls = [
+      "mirror://sourceforge/libisl/${name}.tar.xz"
+      "https://libisl.sourceforge.io/${name}.tar.xz"
+    ];
     sha256 = "be152e5c816b477594f4c6194b5666d8129f3a27702756ae9ff60346a8731647";
   };
 

pkgs/development/libraries/isl/0.20.0.nix

@@ -4,7 +4,11 @@ stdenv.mkDerivation rec {
   name = "isl-0.20";
 
   src = fetchurl {
-    url = "http://isl.gforge.inria.fr/${name}.tar.xz";
+    urls = [
+      "mirror://sourceforge/libisl/${name}.tar.xz"
+      "https://libisl.sourceforge.io/${name}.tar.xz"
+    ];
+
     sha256 = "1akpgq0rbqbah5517blg2zlnfvjxfcl9cjrfc75nbcx5p2gnlnd5";
   };
 

pkgs/development/libraries/mp4v2/default.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     (fetchurl {
       # 2020-06-19: NOTE: # Fix build with C++11
       # Close when https://github.com/TechSmith/mp4v2/pull/36 merged/closed.
-      url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/libmp4v2-c++11.patch?id=203f5a72bc97ffe089b424c47b07dd9eaea35713";
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/203f5a72bc97ffe089b424c47b07dd9eaea35713/trunk/libmp4v2-c++11.patch";
       sha256 = "0sbn0il7lmk77yrjyb4f0a3z3h8gsmdkscvz5n9hmrrrhrwf672w";
     })
   ];

pkgs/development/libraries/qt-5/5.12/default.nix

@@ -81,7 +81,7 @@ let
       # https://bugreports.qt.io/browse/QTBUG-77037
       (fetchpatch {
         name = "fix-build-with-pulseaudio-13.0.patch";
-        url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/qtbug-77037-workaround.patch?h=packages/qt5-webengine&id=fc77d6b3d5ec74e421b58f199efceb2593cbf951";
+        url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/fc77d6b3d5ec74e421b58f199efceb2593cbf951/trunk/qtbug-77037-workaround.patch";
         sha256 = "1gv733qfdn9746nbqqxzyjx4ijjqkkb7zb71nxax49nna5bri3am";
       })
 

pkgs/development/libraries/science/math/lcalc/default.nix

@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
 
     (fetchpatch {
       name = "c++11.patch";
-      url = "https://git.archlinux.org/svntogit/community.git/plain/trunk/lcalc-c++11.patch?h=packages/lcalc&id=3607b97df5a8c231191115b0cb5c62426b339e71";
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-community/3607b97df5a8c231191115b0cb5c62426b339e71/trunk/lcalc-c++11.patch";
       sha256 = "1ccrl61lv2vvx8ggldq54m5d0n1iy6mym7qz0i8nj6yj0dshnpk3";
     })
   ] ++ stdenv.lib.optional stdenv.isDarwin

pkgs/development/python-modules/fastapi/0.55.1-CVE-2021-32677.patch

@@ -0,0 +1,151 @@
+Based on upstream https://github.com/tiangolo/fastapi/commit/fa7e3c996edf2d5482fff8f9d890ac2390dede4d.patch
+modified by ris to apply to 0.55.1
+diff --git a/fastapi/routing.py b/fastapi/routing.py
+index ac5e19d998..9b51f03cac 100644
+--- a/fastapi/routing.py
++++ b/fastapi/routing.py
+@@ -1,3 +1,4 @@
+ import asyncio
++import email.message
+ import inspect
+ import json
+@@ -36,6 +37,7 @@
+ )
+ from pydantic import BaseModel
+ from pydantic.error_wrappers import ErrorWrapper, ValidationError
++from pydantic.fields import Undefined
+ from starlette import routing
+ from starlette.concurrency import run_in_threadpool
+ from starlette.exceptions import HTTPException
+@@ -174,7 +175,7 @@ def get_request_handler(
+ 
+     async def app(request: Request) -> Response:
+         try:
+-            body = None
++            body: Any = None
+             if body_field:
+                 if is_body_form:
+                     body = await request.form()
+@@ -181,6 +183,18 @@ def get_request_handler(
+                 else:
+                     body_bytes = await request.body()
+                     if body_bytes:
+-                        body = await request.json()
++                        json_body: Any = Undefined
++                        content_type_value = request.headers.get("content-type")
++                        if content_type_value:
++                            message = email.message.Message()
++                            message["content-type"] = content_type_value
++                            if message.get_content_maintype() == "application":
++                                subtype = message.get_content_subtype()
++                                if subtype == "json" or subtype.endswith("+json"):
++                                    json_body = await request.json()
++                        if json_body != Undefined:
++                            body = json_body
++                        else:
++                            body = body_bytes
+         except Exception as e:
+             logger.error(f"Error getting request body: {e}")
+diff --git a/tests/test_tutorial/test_body/test_tutorial001.py b/tests/test_tutorial/test_body/test_tutorial001.py
+index 38c6dbe876..c90240ae4c 100644
+--- a/tests/test_tutorial/test_body/test_tutorial001.py
++++ b/tests/test_tutorial/test_body/test_tutorial001.py
+@@ -0,4 +0,6 @@
++from unittest.mock import patch
++
+ import pytest
+ from fastapi.testclient import TestClient
+ 
+ from body.tutorial001 import app
+@@ -173,6 +173,76 @@ def test_post_body(path, body, expected_status, expected_response):
+ 
+ 
+ def test_post_broken_body():
+-    response = client.post("/items/", data={"name": "Foo", "price": 50.5})
+-    assert response.status_code == 400, response.text
+-    assert response.json() == {"detail": "There was an error parsing the body"}
++    response = client.post(
++        "/items/",
++        headers={"content-type": "application/json"},
++        data="{some broken json}",
++    )
++    assert response.status_code == 400, response.text
++    assert response.json() == {"detail": "There was an error parsing the body"}
++
++
++def test_post_form_for_json():
++    response = client.post("/items/", data={"name": "Foo", "price": 50.5})
++    assert response.status_code == 422, response.text
++    assert response.json() == {
++        "detail": [
++            {
++                "loc": ["body", "item"],
++                "msg": "value is not a valid dict",
++                "type": "type_error.dict",
++            }
++        ]
++    }
++
++
++def test_explicit_content_type():
++    response = client.post(
++        "/items/",
++        data='{"name": "Foo", "price": 50.5}',
++        headers={"Content-Type": "application/json"},
++    )
++    assert response.status_code == 200, response.text
++
++
++def test_geo_json():
++    response = client.post(
++        "/items/",
++        data='{"name": "Foo", "price": 50.5}',
++        headers={"Content-Type": "application/geo+json"},
++    )
++    assert response.status_code == 200, response.text
++
++
++def test_wrong_headers():
++    data = '{"name": "Foo", "price": 50.5}'
++    invalid_dict = {
++        "detail": [
++            {
++                "loc": ["body", "item"],
++                "msg": "value is not a valid dict",
++                "type": "type_error.dict",
++            }
++        ]
++    }
++
++    response = client.post("/items/", data=data, headers={"Content-Type": "text/plain"})
++    assert response.status_code == 422, response.text
++    assert response.json() == invalid_dict
++
++    response = client.post(
++        "/items/", data=data, headers={"Content-Type": "application/geo+json-seq"}
++    )
++    assert response.status_code == 422, response.text
++    assert response.json() == invalid_dict
++    response = client.post(
++        "/items/", data=data, headers={"Content-Type": "application/not-really-json"}
++    )
++    assert response.status_code == 422, response.text
++    assert response.json() == invalid_dict
++
++
++def test_other_exceptions():
++    with patch("json.loads", side_effect=Exception):
++        response = client.post("/items/", json={"test": "test2"})
++        assert response.status_code == 400, response.text
+diff --git a/tests/test_tutorial/test_custom_request_and_route/test_tutorial001.py b/tests/test_tutorial/test_custom_request_and_route/test_tutorial001.py
+index cc85a8a82a..3eb5822e28 100644
+--- a/tests/test_tutorial/test_custom_request_and_route/test_tutorial001.py
++++ b/tests/test_tutorial/test_custom_request_and_route/test_tutorial001.py
+@@ -25,6 +25,7 @@ def test_gzip_request(compress):
+     if compress:
+         data = gzip.compress(data)
+         headers["Content-Encoding"] = "gzip"
++    headers["Content-Type"] = "application/json"
+     response = client.post("/sum", data=data, headers=headers)
+     assert response.json() == {"sum": n}
+ 

pkgs/development/python-modules/fastapi/default.nix

@@ -27,6 +27,10 @@ buildPythonPackage rec {
     sha256 = "1515nhwari48v0angyl5z3cfpvwn4al2nvqh0cjd9xgxzvm310s8";
   };
 
+  patches = [
+    ./0.55.1-CVE-2021-32677.patch
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace "starlette ==0.13.2" "starlette"

pkgs/development/python-modules/pydantic/1.5.1-CVE-2021-29510.patch

@@ -0,0 +1,107 @@
+Based on upstream https://github.com/samuelcolvin/pydantic/commit/7e83fdd2563ffac081db7ecdf1affa65ef38c468.patch
+adapted by ris to apply to 1.5.1.
+
+Has side effect of adding negative timestamp support from
+https://github.com/samuelcolvin/pydantic/commit/113921c6c5d34c12de16d1ef0f83b6bc39097521
+as failing to do so would likely leave a hole in the fix.
+
+diff --git a/pydantic/datetime_parse.py b/pydantic/datetime_parse.py
+index d567c5c51..59466c15f 100644
+--- a/pydantic/datetime_parse.py
++++ b/pydantic/datetime_parse.py
+@@ -58,6 +58,8 @@
+ # if greater than this, the number is in ms, if less than or equal it's in seconds
+ # (in seconds this is 11th October 2603, in ms it's 20th August 1970)
+ MS_WATERSHED = int(2e10)
++# slightly more than datetime.max in ns - (datetime.max - EPOCH).total_seconds() * 1e9
++MAX_NUMBER = int(3e20)
+ StrBytesIntFloat = Union[str, bytes, int, float]
+ 
+ 
+@@ -73,6 +75,11 @@ def get_numeric(value: StrBytesIntFloat, native_expected_type: str) -> Union[Non
+ 
+ 
+ def from_unix_seconds(seconds: Union[int, float]) -> datetime:
+-    while seconds > MS_WATERSHED:
++    if seconds > MAX_NUMBER:
++        return datetime.max
++    elif seconds < -MAX_NUMBER:
++        return datetime.min
++
++    while abs(seconds) > MS_WATERSHED:
+         seconds /= 1000
+     dt = EPOCH + timedelta(seconds=seconds)
+diff --git a/tests/test_datetime_parse.py b/tests/test_datetime_parse.py
+index d629d9fb8..f714d6667 100644
+--- a/tests/test_datetime_parse.py
++++ b/tests/test_datetime_parse.py
+@@ -42,11 +42,20 @@ def create_tz(minutes):
+         (1_549_316_052_104, date(2019, 2, 4)),  # nowish in ms
+         (1_549_316_052_104_324, date(2019, 2, 4)),  # nowish in μs
+         (1_549_316_052_104_324_096, date(2019, 2, 4)),  # nowish in ns
++        ('infinity', date(9999, 12, 31)),
++        ('inf', date(9999, 12, 31)),
++        (float('inf'), date(9999, 12, 31)),
++        ('infinity ', date(9999, 12, 31)),
++        (int('1' + '0' * 100), date(9999, 12, 31)),
++        (1e1000, date(9999, 12, 31)),
++        ('-infinity', date(1, 1, 1)),
++        ('-inf', date(1, 1, 1)),
++        ('nan', ValueError),
+     ],
+ )
+ def test_date_parsing(value, result):
+-    if result == errors.DateError:
+-        with pytest.raises(errors.DateError):
++    if type(result) == type and issubclass(result, Exception):
++        with pytest.raises(result):
+             parse_date(value)
+     else:
+         assert parse_date(value) == result
+@@ -123,11 +132,19 @@ def test_time_parsing(value, result):
+         (1_549_316_052_104, datetime(2019, 2, 4, 21, 34, 12, 104_000, tzinfo=timezone.utc)),  # nowish in ms
+         (1_549_316_052_104_324, datetime(2019, 2, 4, 21, 34, 12, 104_324, tzinfo=timezone.utc)),  # nowish in μs
+         (1_549_316_052_104_324_096, datetime(2019, 2, 4, 21, 34, 12, 104_324, tzinfo=timezone.utc)),  # nowish in ns
++        ('infinity', datetime(9999, 12, 31, 23, 59, 59, 999999)),
++        ('inf', datetime(9999, 12, 31, 23, 59, 59, 999999)),
++        ('inf ', datetime(9999, 12, 31, 23, 59, 59, 999999)),
++        (1e50, datetime(9999, 12, 31, 23, 59, 59, 999999)),
++        (float('inf'), datetime(9999, 12, 31, 23, 59, 59, 999999)),
++        ('-infinity', datetime(1, 1, 1, 0, 0)),
++        ('-inf', datetime(1, 1, 1, 0, 0)),
++        ('nan', ValueError),
+     ],
+ )
+ def test_datetime_parsing(value, result):
+-    if result == errors.DateTimeError:
+-        with pytest.raises(errors.DateTimeError):
++    if type(result) == type and issubclass(result, Exception):
++        with pytest.raises(result):
+             parse_datetime(value)
+     else:
+         assert parse_datetime(value) == result
+@@ -251,3 +268,24 @@ class Model(BaseModel):
+         'type': 'value_error.unicodedecode',
+         'msg': "'utf-8' codec can't decode byte 0x81 in position 0: invalid start byte",
+     }
++
++
++def test_nan():
++    class Model(BaseModel):
++        dt: datetime
++        d: date
++
++    with pytest.raises(ValidationError) as exc_info:
++        Model(dt='nan', d='nan')
++    assert exc_info.value.errors() == [
++        {
++            'loc': ('dt',),
++            'msg': 'cannot convert float NaN to integer',
++            'type': 'value_error',
++        },
++        {
++            'loc': ('d',),
++            'msg': 'cannot convert float NaN to integer',
++            'type': 'value_error',
++        },
++    ]

pkgs/development/python-modules/pydantic/default.nix

@@ -29,6 +29,7 @@ buildPythonPackage rec {
       url = "https://github.com/samuelcolvin/pydantic/commit/a5b0e741e585040a0ab8b0be94dd9dc2dd3afcc7.patch";
       sha256 = "0v91ac3dw23rm73370s2ns84vi0xqbfzpvj84zb7xdiicx8fhmf1";
     })
+    ./1.5.1-CVE-2021-29510.patch
   ];
 
   propagatedBuildInputs = [

pkgs/development/python-modules/starlette/default.nix

@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , aiofiles
 , graphene
 , itsdangerous
@@ -31,6 +32,16 @@ buildPythonPackage rec {
     sha256 = "11i0yd8cqwscixajl734g11vf8pghki11c81chzfh8ifmj6mf9jk";
   };
 
+  patches = [
+    # a fix for https://github.com/encode/starlette/issues/1131 exposed
+    # by newer python 3.8+ versions
+    (fetchpatch {
+      name = "dont-use-undocumented-tracebackexception-attr.patch";
+      url = "https://github.com/encode/starlette/pull/1132/commits/aa97f30c73e1c830e0952f7a97d08bc5fad03dea.patch";
+      sha256 = "0clf8l4606y1g585dg4gvx250s2djskji8jaim4s90l9xzjag8sb";
+    })
+  ];
+
   propagatedBuildInputs = [
     aiofiles
     graphene

pkgs/os-specific/darwin/xattr/default.nix

@@ -0,0 +1,73 @@
+{ lib
+, stdenv
+, fetchzip
+, buildPythonPackage
+, python
+, ed
+, unifdef
+}:
+
+buildPythonPackage rec {
+  pname = "xattr";
+  version = "61.60.1";
+
+  src = fetchzip rec {
+    url = "https://opensource.apple.com/tarballs/python_modules/python_modules-${version}.tar.gz";
+    sha256 = "19kydl7w4vpdi7zmfd5z9vjkq24jfk2cv4j0pppw69j06czhdwwi";
+  };
+
+  sourceRoot = "${src.name}/Modules/xattr-0.6.4";
+  format = "other";
+
+  nativeBuildInputs = [
+    ed
+    unifdef
+  ];
+
+  makeFlags = [
+    "OBJROOT=$(PWD)"
+    "DSTROOT=${placeholder "out"}"
+    "OSL=${placeholder "doc"}/share/xattr/OpenSourceLicenses"
+    "OSV=${placeholder "doc"}/share/xattr/OpenSourceVersions"
+  ];
+
+  # need to use `out` instead of `bin` since buildPythonPackage ignores the latter
+  outputs = [ "out" "doc" "python" ];
+
+  # We need to patch a reference to gnutar in an included Makefile
+  postUnpack = ''
+    chmod u+w $sourceRoot/..
+  '';
+
+  postPatch = ''
+    substituteInPlace ../Makefile.inc --replace gnutar tar
+    substituteInPlace Makefile --replace "/usr" ""
+  '';
+
+  preInstall = ''
+    # prevent setup.py from trying to download setuptools
+    sed -i xattr-*/setup.py -e '/ez_setup/d'
+
+    # create our custom target dirs we patch in
+    mkdir -p "$doc/share/xattr/"OpenSource{Licenses,Versions}
+    mkdir -p "$python/lib/${python.libPrefix}"
+  '';
+
+  # move python package to its own output to reduce clutter
+  postInstall = ''
+    mv "$out/lib/python" "$python/${python.sitePackages}"
+    rmdir "$out/lib"
+  '';
+
+  makeWrapperArgs = [
+    "--prefix" "PYTHONPATH" ":" "${placeholder "python"}/${python.sitePackages}"
+  ];
+
+  meta = with lib; {
+    description = "Display and manipulate extended attributes";
+    license = [ licenses.psfl licenses.mit ]; # see $doc/share/xattr/OpenSourceLicenses
+    maintainers = [ maintainers.sternenseemann ];
+    homepage = "https://opensource.apple.com/source/python_modules/";
+    platforms = lib.platforms.darwin;
+  };
+}

pkgs/os-specific/linux/g15daemon/default.nix

@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
 
   patches = let
     patch = fname: sha256: fetchurl rec {
-      url = "https://git.archlinux.org/svntogit/community.git/plain/trunk/${pname}-${version}-${fname}.patch?h=packages/${pname}";
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-community/c0b0b6d4d6d7b79eca68123b20e0c9fb82e1c6e1/g15daemon/trunk/${pname}-${version}-${fname}.patch";
       name = "${fname}.patch";
       inherit sha256;
     };

pkgs/os-specific/linux/microcode/intel.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "microcode-intel";
-  version = "20210216";
+  version = "20210608";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     rev = "microcode-${version}";
-    sha256 = "17wrfp7h7xbvncgm1fp103zkyz9n1f820jy6yca1aq208264hjkv";
+    sha256 = "08nk353z2lcqsjbm2qdsfapfgrvlfw0rj7r9scr9pllzkjj5n9x3";
   };
 
   nativeBuildInputs = [ iucode-tool libarchive ];

pkgs/os-specific/linux/syslinux/default.nix

@@ -23,12 +23,12 @@ stdenv.mkDerivation {
       sha256 = "06ifgzbpjj4picpj17zgprsfi501zf4pp85qjjgn29i5rs291zni";
     })
     (fetchurl {
-      url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/0005-gnu-efi-version-compatibility.patch?id=821c3da473d1399d930d5b4a086e46a4179eaa45";
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/821c3da473d1399d930d5b4a086e46a4179eaa45/trunk/0005-gnu-efi-version-compatibility.patch";
       name = "0005-gnu-efi-version-compatibility.patch";
       sha256 = "1mz2idg8cwn0mvd3jixxynhkn7rhmi5fp8cc8zznh5f0ysfra446";
     })
     (fetchurl {
-      url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/0025-reproducible-build.patch?id=821c3da473d1399d930d5b4a086e46a4179eaa45";
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/821c3da473d1399d930d5b4a086e46a4179eaa45/trunk/0025-reproducible-build.patch";
       name = "0025-reproducible-build.patch";
       sha256 = "0qk6wc6z3648828y3961pn4pi7xhd20a6fqn6z1mnj22bbvzcxls";
     })

pkgs/servers/http/apache-httpd/2.4.nix

@@ -16,12 +16,12 @@ assert ldapSupport -> aprutil.ldapSupport && openldap != null;
 assert http2Support -> nghttp2 != null;
 
 stdenv.mkDerivation rec {
-  version = "2.4.46";
+  version = "2.4.48";
   pname = "apache-httpd";
 
   src = fetchurl {
     url = "mirror://apache/httpd/httpd-${version}.tar.bz2";
-    sha256 = "1sj1rwgbcjgkzac3ybjy7j68c9b3dv3ap71m48mrjhf6w7vds3kl";
+    sha256 = "0v4npxnvih5mlxx6dywwhhfs8xvgcckc0hxzwk3hi0g8nbkjdj0v";
   };
 
   # FIXME: -dev depends on -doc

pkgs/servers/mail/dovecot/2.3.13-CVE-2021-29157.patch

@@ -0,0 +1,332 @@
+Based on upstream commits:
+
+https://github.com/dovecot/core/commit/7f06f6274437ea97142df1f64f322b3ced44d0b3.patch
+https://github.com/dovecot/core/commit/7a77e070ddb6a67fe7a40118ba3e3f9b6062a7d1.patch
+https://github.com/dovecot/core/commit/bae4e44596d6548322665d242b055f44fe1dc58d.patch
+https://github.com/dovecot/core/commit/1c61ba32660d47211dfc97c8a8a9b12f026f152d.patch
+
+with a touch of:
+https://github.com/dovecot/core/commit/d61b5dc49fa5da9d2966c2e39fa036e29665d5a1.patch
+
+adapted by ris to apply to 2.3.13
+
+diff --git a/src/lib-oauth2/oauth2-jwt.c b/src/lib-oauth2/oauth2-jwt.c
+index 83b241c558..94810766f1 100644
+--- a/src/lib-oauth2/oauth2-jwt.c
++++ b/src/lib-oauth2/oauth2-jwt.c
+@@ -45,6 +45,38 @@ get_time_field(const struct json_tree *tree, const char *key, long *value_r)
+ 	return 1;
+ }
+ 
++/* Escapes '.', '/' and '%' in identifier to %hex */
++static const char *escape_identifier(const char *identifier)
++{
++	size_t pos = strcspn(identifier, "./%");
++	if (pos < strlen(identifier)) {
++		/* sanitize identifier, cannot allow dots or / in it, so we
++		  encode them */
++		string_t *new_id = t_str_new(strlen(identifier));
++		/* put initial data */
++		str_append_data(new_id, identifier, pos);
++
++		for (const char *c = identifier+pos; *c != '\0'; c++) {
++			switch (*c) {
++			case '.':
++				str_append(new_id, "%2e");
++				break;
++			case '/':
++				str_append(new_id, "%2f");
++				break;
++			case '%':
++				str_append(new_id, "%25");
++				break;
++			default:
++				str_append_c(new_id, *c);
++				break;
++			}
++		}
++		return str_c(new_id);
++	}
++	return identifier;
++}
++
+ static int
+ oauth2_lookup_hmac_key(const struct oauth2_settings *set, const char *azp,
+ 		       const char *alg, const char *key_id,
+@@ -429,31 +461,8 @@ int oauth2_try_parse_jwt(const struct oauth2_settings *set,
+ 	else if (*kid == '\0') {
+ 		*error_r = "'kid' field is empty";
+ 		return -1;
+-	}
+-
+-	size_t pos = strcspn(kid, "./%");
+-	if (pos < strlen(kid)) {
+-		/* sanitize kid, cannot allow dots or / in it, so we encode them */
+-		string_t *new_kid = t_str_new(strlen(kid));
+-		/* put initial data */
+-		str_append_data(new_kid, kid, pos);
+-		for (const char *c = kid+pos; *c != '\0'; c++) {
+-			switch (*c) {
+-			case '.':
+-				str_append(new_kid, "%2e");
+-				break;
+-			case '/':
+-				str_append(new_kid, "%2f");
+-				break;
+-			case '%':
+-				str_append(new_kid, "%25");
+-				break;
+-			default:
+-				str_append_c(new_kid, *c);
+-				break;
+-			}
+-		}
+-		kid = str_c(new_kid);
++	} else {
++		kid = escape_identifier(kid);
+ 	}
+ 
+ 	/* parse body */
+--- a/src/lib-oauth2/oauth2-jwt.c
++++ b/src/lib-oauth2/oauth2-jwt.c
+@@ -49,32 +49,31 @@ get_time_field(const struct json_tree *tree, const char *key, long *value_r)
+ static const char *escape_identifier(const char *identifier)
+ {
+ 	size_t pos = strcspn(identifier, "./%");
+-	if (pos < strlen(identifier)) {
+-		/* sanitize identifier, cannot allow dots or / in it, so we
+-		  encode them */
+-		string_t *new_id = t_str_new(strlen(identifier));
+-		/* put initial data */
+-		str_append_data(new_id, identifier, pos);
+-
+-		for (const char *c = identifier+pos; *c != '\0'; c++) {
+-			switch (*c) {
+-			case '.':
+-				str_append(new_id, "%2e");
+-				break;
+-			case '/':
+-				str_append(new_id, "%2f");
+-				break;
+-			case '%':
+-				str_append(new_id, "%25");
+-				break;
+-			default:
+-				str_append_c(new_id, *c);
+-				break;
+-			}
+-		}
+-		return str_c(new_id);
++	/* nothing to escape */
++	if (identifier[pos] == '\0')
++		return identifier;
++
++	size_t len = strlen(identifier);
++	string_t *new_id = t_str_new(len);
++	str_append_data(new_id, identifier, pos);
++
++	for (size_t i = pos; i < len; i++) {
++	        switch (identifier[i]) {
++	        case '.':
++	                str_append(new_id, "%2e");
++	                break;
++	        case '/':
++	                str_append(new_id, "%2f");
++	                break;
++	        case '%':
++	                str_append(new_id, "%25");
++	                break;
++	        default:
++	                str_append_c(new_id, identifier[i]);
++	                break;
++	        }
+ 	}
+-	return identifier;
++	return str_c(new_id);
+ }
+ 
+ static int
+ 
+--- a/src/lib-oauth2/test-oauth2-jwt.c
++++ b/src/lib-oauth2/test-oauth2-jwt.c
+@@ -181,12 +181,23 @@ append_key_value(string_t *dest, const char *key, const char *value, bool str)
+ 
+ }
+ 
++#define create_jwt_token_fields(algo, exp, iat, nbf, fields) \
++	create_jwt_token_fields_kid(algo, "default", exp, iat, nbf, fields)
+-static buffer_t *create_jwt_token_fields(const char *algo, time_t exp, time_t iat,
+-					 time_t nbf, ARRAY_TYPE(oauth2_field) *fields)
++static buffer_t *
++create_jwt_token_fields_kid(const char *algo, const char *kid, time_t exp, time_t iat,
++			    time_t nbf, ARRAY_TYPE(oauth2_field) *fields)
+ {
+ 	const struct oauth2_field *field;
+ 	buffer_t *tokenbuf = t_buffer_create(64);
+-	base64url_encode_str(t_strdup_printf(
+-				"{\"alg\":\"%s\",\"typ\":\"JWT\"}", algo), tokenbuf);
++	string_t *hdr = t_str_new(32);
++	str_printfa(hdr, "{\"alg\":\"%s\",\"typ\":\"JWT\"", algo);
++	if (kid != NULL && *kid != '\0') {
++		str_append(hdr, ",\"kid\":\"");
++		json_append_escaped(hdr, kid);
++		str_append_c(hdr, '"');
++	}
++	str_append(hdr, "}");
++	base64url_encode_str(str_c(hdr), tokenbuf);
+ 	buffer_append(tokenbuf, ".", 1);
++
+ 	string_t *bodybuf = t_str_new(64);
+@@ -210,8 +223,12 @@ static buffer_t *create_jwt_token_fields(const char *algo, time_t exp, time_t ia
+ static void save_key_to(const char *algo, const char *name, const char *keydata)
+ {
+ 	const char *error;
+-	struct dict_transaction_context *ctx = dict_transaction_begin(keys_dict);
+-	dict_set(ctx, t_strconcat(DICT_PATH_SHARED, "default/", algo, "/", name, NULL), keydata);
++	struct dict_transaction_context *ctx =
++		dict_transaction_begin(keys_dict);
++	algo = t_str_ucase(algo);
++	dict_set(ctx, t_strconcat(DICT_PATH_SHARED, "default/", algo, "/",
++				  name, NULL),
++		 keydata);
+ 	if (dict_transaction_commit(&ctx, &error) < 0)
+ 		i_error("dict_set(%s) failed: %s", name, error);
+ }
+@@ -298,6 +305,50 @@ static void test_jwt_hs_token(void)
+ 	test_end();
+ }
+ 
++static void test_jwt_token_escape(void)
++{
++	struct test_case {
++		const char *alg;
++		const char *kid;
++		const char *esc_kid;
++	} test_cases[] = {
++		{ "hs256", "", "default" },
++		{ "hs256", "test", "test" },
++		{
++			"hs256",
++			"http://test.unit/local%key",
++			"http:%2f%2ftest%2eunit%2flocal%25key",
++		},
++		{ "hs256", "../", "%2e%2e%2f" },
++	};
++	buffer_t *b64_key =
++		t_base64_encode(0, SIZE_MAX, hs_sign_key->data, hs_sign_key->used);
++	ARRAY_TYPE(oauth2_field) fields;
++	t_array_init(&fields, 8);
++
++	for (size_t i = 0; i < N_ELEMENTS(test_cases); i++) {
++		const struct test_case *test_case = &test_cases[i];
++		array_clear(&fields);
++		struct oauth2_field *field = array_append_space(&fields);
++		field->name = "sub";
++		field->value = "testuser";
++		if (*test_case->kid != '\0') {
++			field = array_append_space(&fields);
++			field->name = "kid";
++			field->value = test_case->kid;
++		}
++		save_key_to(test_case->alg, test_case->esc_kid,
++			    str_c(b64_key));
++		buffer_t *token = create_jwt_token_fields_kid(test_case->alg,
++							      test_case->kid,
++							      time(NULL)+500,
++							      time(NULL)-500,
++							      0, &fields);
++		sign_jwt_token_hs256(token, hs_sign_key);
++		test_jwt_token(str_c(token));
++	}
++}
++
+ static void test_jwt_broken_token(void)
+ {
+ 	struct test_cases {
+@@ -754,6 +805,7 @@ int main(void)
+ 	static void (*test_functions[])(void) = {
+ 		test_do_init,
+ 		test_jwt_hs_token,
++		test_jwt_token_escape,
+ 		test_jwt_bad_valid_token,
+ 		test_jwt_broken_token,
+ 		test_jwt_dates,
+--- a/src/lib-oauth2/oauth2-jwt.c
++++ b/src/lib-oauth2/oauth2-jwt.c
+@@ -408,6 +408,8 @@ oauth2_jwt_body_process(const struct oauth2_settings *set, const char *alg,
+ 	const char *azp = get_field(tree, "azp");
+ 	if (azp == NULL)
+ 		azp = "default";
++	else
++		azp = escape_identifier(azp);
+ 
+ 	if (oauth2_validate_signature(set, azp, alg, kid, blobs, error_r) < 0)
+ 		return -1;
+--- a/src/lib-oauth2/test-oauth2-jwt.c
++++ b/src/lib-oauth2/test-oauth2-jwt.c
+@@ -227,13 +227,15 @@ create_jwt_token_fields_kid(const char *algo, const char *kid, time_t exp, time_
+ }
+ 
+ #define save_key(algo, key) save_key_to(algo, "default", (key))
+-static void save_key_to(const char *algo, const char *name, const char *keydata)
++#define save_key_to(algo, name, key) save_key_azp_to(algo, "default", name, (key))
++static void save_key_azp_to(const char *algo, const char *azp,
++			    const char *name, const char *keydata)
+ {
+ 	const char *error;
+ 	struct dict_transaction_context *ctx =
+ 		dict_transaction_begin(keys_dict);
+ 	algo = t_str_ucase(algo);
+-	dict_set(ctx, t_strconcat(DICT_PATH_SHARED, "default/", algo, "/",
++	dict_set(ctx, t_strconcat(DICT_PATH_SHARED, azp, "/", algo, "/",
+ 				  name, NULL),
+ 		 keydata);
+ 	if (dict_transaction_commit(&ctx, &error) < 0)
+@@ -308,18 +310,23 @@ static void test_jwt_hs_token(void)
+ static void test_jwt_token_escape(void)
+ {
+ 	struct test_case {
++		const char *azp;
+ 		const char *alg;
+ 		const char *kid;
++		const char *esc_azp;
+ 		const char *esc_kid;
+ 	} test_cases[] = {
+-		{ "hs256", "", "default" },
+-		{ "hs256", "test", "test" },
++		{ "", "hs256", "", "default", "default" },
++		{ "", "hs256", "test", "default", "test" },
++		{ "test", "hs256", "test", "test", "test" },
+ 		{
++			"http://test.unit/local%key",
+ 			"hs256",
+ 			"http://test.unit/local%key",
+ 			"http:%2f%2ftest%2eunit%2flocal%25key",
++			"http:%2f%2ftest%2eunit%2flocal%25key"
+ 		},
+-		{ "hs256", "../", "%2e%2e%2f" },
++		{ "../", "hs256", "../", "%2e%2e%2f", "%2e%2e%2f" },
+ 	};
+ 	buffer_t *b64_key =
+ 		t_base64_encode(0, SIZE_MAX, hs_sign_key->data, hs_sign_key->used);
+@@ -332,13 +339,18 @@ static void test_jwt_token_escape(void)
+ 		struct oauth2_field *field = array_append_space(&fields);
+ 		field->name = "sub";
+ 		field->value = "testuser";
++		if (*test_case->azp != '\0') {
++			field = array_append_space(&fields);
++			field->name = "azp";
++			field->value = test_case->azp;
++		}
+ 		if (*test_case->kid != '\0') {
+ 			field = array_append_space(&fields);
+ 			field->name = "kid";
+ 			field->value = test_case->kid;
+ 		}
+-		save_key_to(test_case->alg, test_case->esc_kid,
+-			    str_c(b64_key));
++		save_key_azp_to(test_case->alg, test_case->esc_azp, test_case->esc_kid,
++				str_c(b64_key));
+ 		buffer_t *token = create_jwt_token_fields_kid(test_case->alg,
+ 							      test_case->kid,
+ 							      time(NULL)+500,

pkgs/servers/mail/dovecot/default.nix

@@ -1,5 +1,5 @@
-{ stdenv, lib, fetchurl, perl, pkgconfig, systemd, openssl
-, bzip2, zlib, lz4, inotify-tools, pam, libcap
+{ stdenv, lib, fetchurl, fetchpatch, perl, pkgconfig, systemd, openssl
+, bzip2, zlib, lz4, inotify-tools, pam, libcap, coreutils
 , clucene_core_2, icu, openldap, libsodium, libstemmer, cyrus_sasl
 , nixosTests
 # Auth modules
@@ -25,6 +25,20 @@ stdenv.mkDerivation rec {
     sha256 = "1i7ijss79a23v7b6lycfzaa8r5rh01k0h0b9h0j4a6n11sw7by53";
   };
 
+  postPatch = ''
+    substituteInPlace src/lib-program-client/test-program-client-local.c \
+      --replace '"/bin/sh"' '"${stdenv.shell}"' \
+      --replace '"/bin/' '"${coreutils}/bin/' \
+      --replace 'head ' '${coreutils}/bin/head ' \
+      --replace 'sleep ' '${coreutils}/bin/sleep ' \
+      --replace ' cat' ' ${coreutils}/bin/cat'
+    patchShebangs src/lib-smtp/test-bin/*.sh
+    substituteInPlace src/lib-smtp/test-bin/sendmail-exit-1.sh \
+      --replace 'cat' ' ${coreutils}/bin/cat'
+    substituteInPlace src/lib-smtp/test-bin/sendmail-success.sh \
+      --replace 'cat' ' ${coreutils}/bin/cat'
+  '';
+
   enableParallelBuilding = true;
 
   preConfigure = ''
@@ -44,6 +58,12 @@ stdenv.mkDerivation rec {
     # so we can symlink plugins from several packages there.
     # The symlinking needs to be done in NixOS.
     ./2.3.x-module_dir.patch
+    ./2.3.13-CVE-2021-29157.patch
+    (fetchpatch {
+      name = "CVE-2021-33515.patch";
+      url = "https://github.com/dovecot/core/commit/65bd1a27a361545c9ccf405b955c72a9c4d29b38.patch";
+      sha256 = "0f1lz6qkwb9cbqc4p40fasr6gcyxxxgx1sxcsbqdypkz099m4psc";
+    })
   ];
 
   configureFlags = [
@@ -81,6 +101,9 @@ stdenv.mkDerivation rec {
     ++ lib.optional withPgSQL "--with-pgsql"
     ++ lib.optional withSQLite "--with-sqlite";
 
+  doCheck = !stdenv.isDarwin;
+  checkInputs = [ coreutils ];
+
   meta = {
     homepage = "https://dovecot.org/";
     description = "Open source IMAP and POP3 email server written with security primarily in mind";

pkgs/tools/graphics/cuneiform/default.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation {
 
   patches = [
   (fetchurl {
-    url = "https://git.archlinux.org/svntogit/community.git/plain/cuneiform/trunk/build-fix.patch?id=a2ec92f05de006b56d16ac6a6c370d54a554861a";
+    url = "https://raw.githubusercontent.com/archlinux/svntogit-community/a2ec92f05de006b56d16ac6a6c370d54a554861a/cuneiform/trunk/build-fix.patch";
     sha256 = "19cmrlx4khn30qqrpyayn7bicg8yi0wpz1x1bvqqrbvr3kwldxyj";
   })
   ];

pkgs/tools/misc/xvfb-run/default.nix

@@ -3,8 +3,7 @@
 let
   xvfb_run = fetchurl {
     name = "xvfb-run";
-    # https://git.archlinux.org/svntogit/packages.git/?h=packages/xorg-server
-    url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/xvfb-run?h=packages/xorg-server&id=9cb733cefa92af3fca608fb051d5251160c9bbff";
+    url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/9cb733cefa92af3fca608fb051d5251160c9bbff/trunk/xvfb-run";
     sha256 = "1307mz4nr8ga3qz73i8hbcdphky75rq8lrvfk2zm4kmv6pkbk611";
   };
 in

pkgs/tools/networking/connman/connman.nix

@@ -55,10 +55,10 @@ let inherit (stdenv.lib) optionals; in
 
 stdenv.mkDerivation rec {
   pname = "connman";
-  version = "1.39";
+  version = "1.40";
   src = fetchurl {
     url = "mirror://kernel/linux/network/connman/${pname}-${version}.tar.xz";
-    sha256 = "sha256-n2KnFpt0kcZwof8uM1sNlmMI+y9i4oXHgRBeuQ8YGvM=";
+    sha256 = "sha256-GleufOI0qjoXRKrDvlwhIdmNzpmUQO+KucxO39XtyxI=";
   };
 
   buildInputs = [
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
     libmnl
     gnutls
     readline
-  ];
+  ] ++ optionals (enableOpenconnect) [ openconnect ];
 
   nativeBuildInputs = [
     pkgconfig

pkgs/tools/networking/ip2unix/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ip2unix";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "nixcloud";
     repo = "ip2unix";
     rev = "v${version}";
-    sha256 = "19c449h60b2m1d8kawnhpi4y9y4ddm24jmlh8kilqmx8m5l2khr6";
+    sha256 = "1pl8ayadxb0zzh5s26yschkjhr1xffbzzv347m88f9y0jv34d24r";
   };
 
   nativeBuildInputs = [

pkgs/tools/networking/lldpd/default.nix

@@ -1,5 +1,6 @@
 { stdenv, lib, fetchurl, pkgconfig, removeReferencesTo
 , libevent, readline, net-snmp, openssl
+, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
@@ -11,6 +12,20 @@ stdenv.mkDerivation rec {
     sha256 = "16fbqrs3l976gdslx647nds8x7sz4h5h3h4l4yxzrayvyh9b5lrd";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2020-27827-1.patch";
+      url = "https://github.com/lldpd/lldpd/commit/a8d3c90feca548fc0656d95b5d278713db86ff61.patch";
+      sha256 = "135hnq3wzga3zpmpy65jyyqyn67id9di1y3kv2qczp5jdgxfx9cy";
+    })
+    (fetchpatch {
+      name = "CVE-2020-27827-2.patch";
+      url = "https://github.com/lldpd/lldpd/commit/7d60bf30effc4c88f17f3d58ecaa72479f16d4be.patch";
+      sha256 = "0b2j8sn2z7p9250iki7rx88f9cdrxv5by7cbmmmwa0h4c5cb6b61";
+      excludes = [ "NEWS" ];
+    })
+  ];
+
   configureFlags = [
     "--localstatedir=/var"
     "--enable-pie"

pkgs/tools/networking/privoxy/default.nix

@@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
 
   pname = "privoxy";
-  version = "3.0.28";
+  version = "3.0.32";
 
   src = fetchurl {
     url = "mirror://sourceforge/ijbswa/Sources/${version}%20%28stable%29/${pname}-${version}-stable-src.tar.gz";
-    sha256 = "0jl2yav1qzqnaqnnx8i6i53ayckkimcrs3l6ryvv7bda6v08rmxm";
+    sha256 = "sha256-xh3kAIxiRF7Bjx8nBAfL8jcuq6k76szcnjI4uy3v7tc=";
   };
 
   hardeningEnable = [ "pie" ];

pkgs/tools/networking/vde2/default.nix

@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     # Fix build with openssl 1.1.0
     (fetchpatch {
       name = "vde_cryptcab-compile-against-openssl-1.1.0.patch";
-      url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/vde_cryptcab-compile-against-openssl-1.1.0.patch?h=packages/vde2&id=15b11be49997fa94b603e366064690b7cc6bce61";
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/15b11be49997fa94b603e366064690b7cc6bce61/trunk/vde_cryptcab-compile-against-openssl-1.1.0.patch";
       sha256 = "07z1yabwigq35mkwzqa934n7vjnjlqz5xfzq8cfj87lgyjjp00qi";
     })
   ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl [

pkgs/tools/networking/zssh/default.nix

@@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
     # Cargo-culted from Arch, returns “out of pty's” without it
     (fetchurl {
       name = "fix_use_ptmx_on_arch.patch";
-      url = "https://git.archlinux.org/svntogit/community.git/plain/trunk/fix_use_ptmx_on_arch.patch?h=packages/zssh&id=0a7c92543f9309856d02e31196f06d7c3eaa8b67";
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-community/0a7c92543f9309856d02e31196f06d7c3eaa8b67/trunk/fix_use_ptmx_on_arch.patch";
       sha256 = "12daw9wpy58ql882zww945wk9cg2adwp8qsr5rvazx0xq0qawgbr";
     })
   ];

pkgs/top-level/all-packages.nix

@@ -24,6 +24,21 @@ let
 
 in
 {
+  # A module system style type tag
+  #
+  # Allows the nixpkgs fixpoint, usually known as `pkgs`
+  # to be distinguished nominally.
+  #
+  #     pkgs._type == "pkgs"
+  #     pkgs.pkgsStatic._type == "pkgs"
+  #
+  # Design note:
+  # While earlier stages of nixpkgs fixpoint construction
+  # are supertypes of this stage, they're generally not
+  # usable in places where a `pkgs` is expected.
+  # (earlier stages being the various `super` variables
+  #  that precede all-packages.nix)
+  _type = "pkgs";
 
   # A stdenv capable of building 32-bit binaries.  On x86_64-linux,
   # it uses GCC compiled with multilib support; on i686-linux, it's

pkgs/top-level/darwin-packages.nix

@@ -68,6 +68,8 @@ in
 
   usr-include = callPackage ../os-specific/darwin/usr-include { };
 
+  xattr = pkgs.python3Packages.callPackage ../os-specific/darwin/xattr { };
+
   inherit (callPackages ../os-specific/darwin/xcode { })
     xcode_8_1 xcode_8_2
     xcode_9_1 xcode_9_2 xcode_9_4 xcode_9_4_1

pkgs/top-level/haskell-packages.nix

@@ -9,6 +9,7 @@ let
     "ghc8102BinaryMinimal"
     "ghcjs"
     "ghcjs86"
+    "ghcjs810"
     "integer-simple"
     "native-bignum"
     "ghcHEAD"
@@ -124,6 +125,20 @@ in {
       buildLlvmPackages = buildPackages.llvmPackages_9;
       llvmPackages = pkgs.llvmPackages_9;
     };
+    ghc8107 = callPackage ../development/compilers/ghc/8.10.7.nix {
+      # aarch64 ghc865Binary gets SEGVs due to haskell#15449 or similar
+      bootPkgs = if stdenv.isAarch64 || stdenv.isAarch32 then
+          packages.ghc8102BinaryMinimal
+        else
+          packages.ghc865Binary;
+      inherit (buildPackages.python3Packages) sphinx;
+      # Need to use apple's patched xattr until
+      # https://github.com/xattr/xattr/issues/44 and
+      # https://github.com/xattr/xattr/issues/55 are solved.
+      inherit (buildPackages.darwin) xattr;
+      buildLlvmPackages = buildPackages.llvmPackages_9;
+      llvmPackages = pkgs.llvmPackages_9;
+    };
     ghcHEAD = callPackage ../development/compilers/ghc/head.nix {
       bootPkgs = packages.ghc883; # no binary yet
       inherit (buildPackages.python3Packages) sphinx;
@@ -131,12 +146,18 @@ in {
       llvmPackages = pkgs.llvmPackages_10;
       libffi = pkgs.libffi;
     };
+
     ghcjs = compiler.ghcjs86;
-    ghcjs86 = callPackage ../development/compilers/ghcjs-ng {
+    ghcjs86 = callPackage ../development/compilers/ghcjs/8.6 {
       bootPkgs = packages.ghc865;
-      ghcjsSrcJson = ../development/compilers/ghcjs-ng/8.6/git.json;
-      stage0 = ../development/compilers/ghcjs-ng/8.6/stage0.nix;
-      ghcjsDepOverrides = callPackage ../development/compilers/ghcjs-ng/8.6/dep-overrides.nix {};
+      ghcjsSrcJson = ../development/compilers/ghcjs/8.6/git.json;
+      stage0 = ../development/compilers/ghcjs/8.6/stage0.nix;
+      ghcjsDepOverrides = callPackage ../development/compilers/ghcjs/8.6/dep-overrides.nix {};
+    };
+    ghcjs810 = callPackage ../development/compilers/ghcjs/8.10 {
+      bootPkgs = packages.ghc8107;
+      ghcjsSrcJson = ../development/compilers/ghcjs/8.10/git.json;
+      stage0 = ../development/compilers/ghcjs/8.10/stage0.nix;
     };
 
     # The integer-simple attribute set contains all the GHC compilers
@@ -230,17 +251,29 @@ in {
       ghc = bh.compiler.ghc8104;
       compilerConfig = callPackage ../development/haskell-modules/configuration-ghc-8.10.x.nix { };
     };
+    ghc8107 = callPackage ../development/haskell-modules {
+      buildHaskellPackages = bh.packages.ghc8107;
+      ghc = bh.compiler.ghc8107;
+      compilerConfig = callPackage ../development/haskell-modules/configuration-ghc-8.10.x.nix { };
+    };
     ghcHEAD = callPackage ../development/haskell-modules {
       buildHaskellPackages = bh.packages.ghcHEAD;
       ghc = bh.compiler.ghcHEAD;
       compilerConfig = callPackage ../development/haskell-modules/configuration-ghc-head.nix { };
     };
+
     ghcjs = packages.ghcjs86;
     ghcjs86 = callPackage ../development/haskell-modules rec {
       buildHaskellPackages = ghc.bootPkgs;
       ghc = bh.compiler.ghcjs86;
       compilerConfig = callPackage ../development/haskell-modules/configuration-ghc-8.6.x.nix { };
-      packageSetConfig = callPackage ../development/haskell-modules/configuration-ghcjs.nix { };
+      packageSetConfig = callPackage ../development/haskell-modules/configuration-ghcjs-8.6.nix { };
+    };
+    ghcjs810 = callPackage ../development/haskell-modules rec {
+      buildHaskellPackages = ghc.bootPkgs;
+      ghc = bh.compiler.ghcjs810;
+      compilerConfig = callPackage ../development/haskell-modules/configuration-ghc-8.10.x.nix { };
+      packageSetConfig = callPackage ../development/haskell-modules/configuration-ghcjs-8.10.nix { };
     };
 
     # The integer-simple attribute set contains package sets for all the GHC compilers