Merge remote-tracking branch 'origin/staging' into staging-next

Conflicts: nixos/tests/custom-ca.nix
3 years ago · 4b73049ccc
parent e46718d278 40d43349e6
commit 4b73049ccc
83 changed files with 770 additions and 576 deletions
--- a/maintainers/scripts/vanity.sh
+++ b/maintainers/scripts/vanity.sh
@ -30,7 +30,7 @@ fetchGithubName () {
        curl https://github.com/NixOS/nixpkgs/commit/"$commitid" 2>/dev/null |
        grep committed -B10 | grep 'href="/' |
        sed -re 's@.* href="/@@; s@".*@@' |
-	grep -v "/commit/"
+        grep -v "/commit/"
    )";
    echo "$userid"
 }
@ -38,7 +38,7 @@ fetchGithubName () {
 [ -n "$NIXPKGS_GITHUB_NAME_CACHE" ] && {
    echo "$emails" | while read email; do
        line="$(grep "$email	" "$NIXPKGS_GITHUB_NAME_CACHE")"
-	[ -z "$line" ] && {
+        [ -z "$line" ] && {
            echo "$email	$(fetchGithubName "$email")" >> \
                "$NIXPKGS_GITHUB_NAME_CACHE"
        }
@ -47,11 +47,11 @@ fetchGithubName () {

 # For RDF
 normalize_name () {
-	sed -e 's/%/%25/g; s/ /%20/g; s/'\''/%27/g; s/"/%22/g; s/`/%60/g; s/\^/%5e/g; '
+    sed -e 's/%/%25/g; s/ /%20/g; s/'\''/%27/g; s/"/%22/g; s/`/%60/g; s/\^/%5e/g; '
 }

 denormalize_name () {
-	sed -e 's/%20/ /g; s/%27/'\''/g; s/%22/"/g; s/%60/`/g; s/%5e/^/g; s/%25/%/g;';
+    sed -e 's/%20/ /g; s/%27/'\''/g; s/%22/"/g; s/%60/`/g; s/%5e/^/g; s/%25/%/g;';
 }

 n3="$(mktemp --suffix .n3)"
@ -75,22 +75,22 @@ echo "$maintainers" | cut -f 2 | sed -e 's@.*@<my://name/&>	<my://is-name>	<my:/
 # Get transitive closure
 sparql="$(nix-build '<nixpkgs>' -Q -A apache-jena --no-out-link)/bin/sparql"
 name_list="$(
-	"$sparql" --results=TSV --data="$n3" "
-	select ?x ?y ?g where {
-	  ?x <my://can-be>+ ?y.
-	  ?x <my://is-name> ?g.
+    "$sparql" --results=TSV --data="$n3" "
+    select ?x ?y ?g where {
+      ?x <my://can-be>+ ?y.
+      ?x <my://is-name> ?g.
        }
-	" | tail -n +2 |
-	sed -re 's@<my://name/@@g; s@<my://@@g; s@>@@g;' |
-	sort -k 2,3 -t '	'
+    " | tail -n +2 |
+    sed -re 's@<my://name/@@g; s@<my://@@g; s@>@@g;' |
+    sort -k 2,3 -t '	'
 )"
 github_name_list="$(
-	"$sparql" --results=TSV --data="$n3" "
-	select ?x ?y where {
-	  ?x (<my://can-be>+ / <my://at-github>) ?y.
+    "$sparql" --results=TSV --data="$n3" "
+    select ?x ?y where {
+      ?x (<my://can-be>+ / <my://at-github>) ?y.
        }
-	" | tail -n +2 |
-	sed -re 's@<my://(name|github)/@@g; s@<my://@@g; s@>@@g;'
+    " | tail -n +2 |
+    sed -re 's@<my://(name|github)/@@g; s@<my://@@g; s@>@@g;'
 )"

 # Take first spelling option for every person
@ -104,10 +104,10 @@ if [ -n "$NIXPKGS_GITHUB_NAME_CACHE" ]; then
    github_adder_script="$(mktemp)"
    echo "$github_name_list" |
        grep -E "$(echo "$name_list_canonical" | cut -f 2 |
-	    tr '\n' '|' )" |
-	sort | uniq |
+        tr '\n' '|' )" |
+    sort | uniq |
        sed -re 's/(.*)\t(.*)/s| \1$| \1\t\2|g;/' |
-	denormalize_name > "$github_adder_script"
+    denormalize_name > "$github_adder_script"
 else
    github_adder_script='/dev/null'
 fi
--- a/nixos/tests/custom-ca.nix
+++ b/nixos/tests/custom-ca.nix
@ -82,6 +82,9 @@ in
      # chromium-based browsers refuse to run as root
      test-support.displayManager.auto.user = "alice";

+      # browsers may hang with the default memory
+      virtualisation.memorySize = 600;
+
      networking.hosts."127.0.0.1" = [ "good.example.com" "bad.example.com" ];
      security.pki.certificateFiles = [ "${example-good-cert}/ca.crt" ];

@ -160,7 +163,7 @@ in
        browser = command.split()[0]
        with subtest("Good certificate is trusted in " + browser):
            execute_as(
-                "alice", f"env P11_KIT_DEBUG=trust {command} https://good.example.com & >&2"
+                "alice", f"{command} https://good.example.com >&2 &"
            )
            wait_for_window_as("alice", browser)
            machine.wait_for_text("It works!")
@ -168,9 +171,9 @@ in
            execute_as("alice", "xdotool key ctrl+w")  # close tab

        with subtest("Unknown CA is untrusted in " + browser):
-            execute_as("alice", f"{command} https://bad.example.com & >&2")
+            execute_as("alice", f"{command} https://bad.example.com >&2 &")
            machine.wait_for_text(error)
            machine.screenshot("bad" + browser)
-            machine.succeed("pkill " + browser)
+            machine.succeed("pkill -f " + browser)
  '';
 })
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@ -25,7 +25,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;

 let
-  version = "2.33.1";
+  version = "2.34.0";
  svn = subversionClient.override { perlBindings = perlSupport; };

  gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@ -37,7 +37,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "sha256-4FSm5sKwiL0b/19h7ZulqpHJo81QlTmktBxd3wIgHy8=";
+    sha256 = "07s1c9lzlm4kpbb5lmxy0869phg7037pv4faz5hlqyb5csrbjv7x";
  };

  outputs = [ "out" ] ++ lib.optional withManual "doc";
--- a/pkgs/build-support/fetchmtn/builder.sh
+++ b/pkgs/build-support/fetchmtn/builder.sh
@ -2,33 +2,33 @@ source $stdenv/setup

 set -x

-if ! [ -f "$cacheDB" ]; then 
-	echo "Creating cache DB $cacheDB"
-	mtn --db "$cacheDB" db init
+if ! [ -f "$cacheDB" ]; then
+    echo "Creating cache DB $cacheDB"
+    mtn --db "$cacheDB" db init
 fi

 header "getting revision $selector";

 done=;
 for source in $dbs; do
-	if mtn pull --db "$cacheDB" "$source" "${branch}"; then
-		revision="$(mtn --db "$cacheDB" au toposort $(mtn --db "$cacheDB" au select "$selector") | tail -1)";
-		if [ -n "$revision" ]; then
-			if mtn --db "$cacheDB" au get_revision "$revision"; then
-				echo "found revision $revision"
-				done=1;
-			else
-				echo "revision $revision does not exist";
-			fi
-		else
-			echo "selector $selector does not match any revision";
-		fi
-	else
-		echo "pulling branch $branch wasn't successful";
-	fi;
-	if test -n "$done"; then
-		break;
-	fi;
+    if mtn pull --db "$cacheDB" "$source" "${branch}"; then
+        revision="$(mtn --db "$cacheDB" au toposort $(mtn --db "$cacheDB" au select "$selector") | tail -1)";
+        if [ -n "$revision" ]; then
+            if mtn --db "$cacheDB" au get_revision "$revision"; then
+                echo "found revision $revision"
+                done=1;
+            else
+                echo "revision $revision does not exist";
+            fi
+        else
+            echo "selector $selector does not match any revision";
+        fi
+    else
+        echo "pulling branch $branch wasn't successful";
+    fi;
+    if test -n "$done"; then
+        break;
+    fi;
 done;

 stopNest;
@ -36,10 +36,10 @@ stopNest;
 header "checking out the revision $revision";

 if test -n "$done"; then
-	mtn checkout --db "$cacheDB" -r "$revision" "$out" -b "${branch}"
+    mtn checkout --db "$cacheDB" -r "$revision" "$out" -b "${branch}"
 else
-	echo "Needed revision still not found. Exiting";
-	exit 1;
+    echo "Needed revision still not found. Exiting";
+    exit 1;
 fi;

 stopNest
--- a/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
+++ b/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
@ -13,9 +13,9 @@ if [ -z "${NIX_PKG_CONFIG_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
 fi

 if (( ${#role_suffixes[@]} > 0 )); then
-	# replace env var with nix-modified one
+    # replace env var with nix-modified one
    PKG_CONFIG_PATH=$PKG_CONFIG_PATH_@suffixSalt@ exec @prog@ "$@"
 else
-	# pkg-config isn't a bonafied dependency so ignore setup hook entirely
-	exec @prog@ "$@"
+    # pkg-config isn't a bonafied dependency so ignore setup hook entirely
+    exec @prog@ "$@"
 fi
--- a/pkgs/build-support/setup-hooks/shorten-perl-shebang.sh
+++ b/pkgs/build-support/setup-hooks/shorten-perl-shebang.sh
@ -71,9 +71,9 @@ _shortenPerlShebang() {
            print
        }
    ' "$program" > "$temp" || die
-	# Preserve the mode of the original file
-	cp --preserve=mode --attributes-only "$program" "$temp"
-	mv "$temp" "$program"
+    # Preserve the mode of the original file
+    cp --preserve=mode --attributes-only "$program" "$temp"
+    mv "$temp" "$program"

    # Measure the new shebang line length and make sure it's okay. We subtract
    # one to account for the trailing newline that "head" included in its
--- a/pkgs/data/fonts/iosevka/update-bin.sh
+++ b/pkgs/data/fonts/iosevka/update-bin.sh
@ -10,19 +10,19 @@ oldVersion=$(nix-instantiate --eval -E 'with import ../../../.. {}; lib.getVersi
 version=$(echo "$release" | jq -r .tag_name | tr -d v)

 if test "$oldVersion" = "$version"; then
-	echo "New version same as old version, nothing to do." >&2
-	exit 0
+    echo "New version same as old version, nothing to do." >&2
+    exit 0
 fi

 sed -i "s/$oldVersion/$version/" bin.nix

 {
-	echo '# This file was autogenerated. DO NOT EDIT!'
-	echo '{'
-	for asset in $(echo "$release" | jq -r '.assets[].name | select(startswith("ttc"))'); do
-		printf '  %s = "%s";\n' \
-			$(echo "$asset" | sed -r "s/^ttc-(.*)-$version.zip$/\1/") \
-			$(nix-prefetch-url "https://github.com/be5invis/Iosevka/releases/download/v$version/$asset")
-	done
-	echo '}'
+    echo '# This file was autogenerated. DO NOT EDIT!'
+    echo '{'
+    for asset in $(echo "$release" | jq -r '.assets[].name | select(startswith("ttc"))'); do
+        printf '  %s = "%s";\n' \
+            $(echo "$asset" | sed -r "s/^ttc-(.*)-$version.zip$/\1/") \
+            $(nix-prefetch-url "https://github.com/be5invis/Iosevka/releases/download/v$version/$asset")
+    done
+    echo '}'
 } >variants.nix
--- a/pkgs/data/misc/geolite-legacy/builder.sh
+++ b/pkgs/data/misc/geolite-legacy/builder.sh
@ -5,13 +5,13 @@ cd $out/share/GeoIP

 # Iterate over all environment variable names beginning with "src":
 for var in "${!src@}"; do
-	# Store the value of the variable with name $var in $src:
-	eval src="\$$var"
+    # Store the value of the variable with name $var in $src:
+    eval src="\$$var"

-	# Copy $src to current directory, removing Nix hash from the filename:
-	dest="${src##*/}"
-	dest="${dest#*-}"
-	cp "$src" "$dest"
+    # Copy $src to current directory, removing Nix hash from the filename:
+    dest="${src##*/}"
+    dest="${dest#*-}"
+    cp "$src" "$dest"
 done

 gzip -dv *.gz
--- a/pkgs/desktops/gnome-2/platform/ORBit2/default.nix
+++ b/pkgs/desktops/gnome-2/platform/ORBit2/default.nix
@ -22,8 +22,16 @@ stdenv.mkDerivation rec {
    moveToOutput "bin/orbit2-config" "$dev"
  '';

+  # Parallel build fails due to missing internal library dependency:
+  #    libtool --tag=CC   --mode=link gcc ... -o orbit-name-server-2 ...
+  #    ld: cannot find libname-server-2.a: No such file or directory
+  # It happens because orbit-name-server-2 should have libname-server-2.a
+  # in _DEPENDENCIES but does not. Instead of fixing it and regenerating
+  # Makefile.in let's just disable parallel build.
+  enableParallelBuilding = false;
+
  meta = with lib; {
-    homepage    = "https://projects.gnome.org/ORBit2/";
+    homepage    = "https://developer-old.gnome.org/ORBit2/";
    description = "A CORBA 2.4-compliant Object Request Broker";
    platforms   = platforms.unix;
    maintainers = with maintainers; [ lovek323 ];
--- a/pkgs/desktops/gnustep/make/builder.sh
+++ b/pkgs/desktops/gnustep/make/builder.sh
@ -30,92 +30,92 @@ postInstall() {
    # add the current package to the paths
    local tmp="$out/lib/GNUstep/Applications"
    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_APPS" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_APPS "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_APPS "$tmp"
    fi
    tmp="$out/lib/GNUstep/Applications"
    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_ADMIN_APPS" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_APPS "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_APPS "$tmp"
    fi
    tmp="$out/lib/GNUstep/WebApplications"
    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_WEB_APPS" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_WEB_APPS "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_WEB_APPS "$tmp"
    fi
    tmp="$out/bin"
    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_TOOLS" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_TOOLS "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_TOOLS "$tmp"
    fi
    tmp="$out/sbin"
    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS "$tmp"
    fi
    tmp="$out/lib/GNUstep"
    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_LIBRARY" in *"${tmp}"*) false;; *) true;; esac; then
-    	addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARY "$tmp"
+            addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARY "$tmp"
    fi
    tmp="$out/include"
    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_HEADERS" in *"${tmp}"*) false;; *) true;; esac; then
-    	if [ -z "$NIX_GNUSTEP_SYSTEM_HEADERS" ]; then
-    	    export NIX_GNUSTEP_SYSTEM_HEADERS="$tmp"
-    	else
-    	    export NIX_GNUSTEP_SYSTEM_HEADERS+=" $tmp"
-    	fi
+            if [ -z "$NIX_GNUSTEP_SYSTEM_HEADERS" ]; then
+                export NIX_GNUSTEP_SYSTEM_HEADERS="$tmp"
+            else
+                export NIX_GNUSTEP_SYSTEM_HEADERS+=" $tmp"
+            fi
    fi
    tmp="$out/lib"
    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_LIBRARIES" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARIES "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARIES "$tmp"
    fi
    tmp="$out/share/GNUstep/Documentation"
    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_DOC" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_DOC "$tmp"
    fi
    tmp="$out/share/man"
    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_DOC_MAN" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_MAN "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_MAN "$tmp"
    fi
    tmp="$out/share/info"
    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_DOC_INFO" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_INFO "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_INFO "$tmp"
    fi
-    
+
    # write the config file
    echo GNUSTEP_MAKEFILES=$GNUSTEP_MAKEFILES >> $conf
    if [ -n "$NIX_GNUSTEP_SYSTEM_APPS" ]; then
-	echo NIX_GNUSTEP_SYSTEM_APPS="$NIX_GNUSTEP_SYSTEM_APPS"
+        echo NIX_GNUSTEP_SYSTEM_APPS="$NIX_GNUSTEP_SYSTEM_APPS"
    fi
    if [ -n "$NIX_GNUSTEP_SYSTEM_ADMIN_APPS" ]; then
-	echo NIX_GNUSTEP_SYSTEM_ADMIN_APPS="$NIX_GNUSTEP_SYSTEM_ADMIN_APPS" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_ADMIN_APPS="$NIX_GNUSTEP_SYSTEM_ADMIN_APPS" >> $conf
    fi
    if [ -n "$NIX_GNUSTEP_SYSTEM_WEB_APPS" ]; then
-	echo NIX_GNUSTEP_SYSTEM_WEB_APPS="$NIX_GNUSTEP_SYSTEM_WEB_APPS" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_WEB_APPS="$NIX_GNUSTEP_SYSTEM_WEB_APPS" >> $conf
    fi
    if [ -n "$NIX_GNUSTEP_SYSTEM_TOOLS" ]; then
-	echo NIX_GNUSTEP_SYSTEM_TOOLS="$NIX_GNUSTEP_SYSTEM_TOOLS" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_TOOLS="$NIX_GNUSTEP_SYSTEM_TOOLS" >> $conf
    fi
    if [ -n "$NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS" ]; then
-	echo NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS="$NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS="$NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS" >> $conf
    fi
    if [ -n "$NIX_GNUSTEP_SYSTEM_LIBRARY" ]; then
-	echo NIX_GNUSTEP_SYSTEM_LIBRARY="$NIX_GNUSTEP_SYSTEM_LIBRARY" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_LIBRARY="$NIX_GNUSTEP_SYSTEM_LIBRARY" >> $conf
    fi
    if [ -n "$NIX_GNUSTEP_SYSTEM_HEADERS" ]; then
-	echo NIX_GNUSTEP_SYSTEM_HEADERS="$NIX_GNUSTEP_SYSTEM_HEADERS" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_HEADERS="$NIX_GNUSTEP_SYSTEM_HEADERS" >> $conf
    fi
    if [ -n "$NIX_GNUSTEP_SYSTEM_LIBRARIES" ]; then
-	echo NIX_GNUSTEP_SYSTEM_LIBRARIES="$NIX_GNUSTEP_SYSTEM_LIBRARIES" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_LIBRARIES="$NIX_GNUSTEP_SYSTEM_LIBRARIES" >> $conf
    fi
    if [ -n "$NIX_GNUSTEP_SYSTEM_DOC" ]; then
-	echo NIX_GNUSTEP_SYSTEM_DOC="$NIX_GNUSTEP_SYSTEM_DOC" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_DOC="$NIX_GNUSTEP_SYSTEM_DOC" >> $conf
    fi
    if [ -n "$NIX_GNUSTEP_SYSTEM_DOC_MAN" ]; then
-	echo NIX_GNUSTEP_SYSTEM_DOC_MAN="$NIX_GNUSTEP_SYSTEM_DOC_MAN" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_DOC_MAN="$NIX_GNUSTEP_SYSTEM_DOC_MAN" >> $conf
    fi
    if [ -n "$NIX_GNUSTEP_SYSTEM_DOC_INFO" ]; then
-	echo NIX_GNUSTEP_SYSTEM_DOC_INFO="$NIX_GNUSTEP_SYSTEM_DOC_INFO" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_DOC_INFO="$NIX_GNUSTEP_SYSTEM_DOC_INFO" >> $conf
    fi
-    
+
    for i in $out/bin/*; do
-	echo "wrapping $(basename $i)"
-	wrapGSMake "$i" "$out/share/.GNUstep.conf"
+        echo "wrapping $(basename $i)"
+        wrapGSMake "$i" "$out/share/.GNUstep.conf"
    done
 }

--- a/pkgs/desktops/gnustep/make/setup-hook.sh
+++ b/pkgs/desktops/gnustep/make/setup-hook.sh
@ -20,58 +20,58 @@ addEnvVars() {
    local filename

    for filename in $1/share/GNUstep/Makefiles/Additional/*.make ; do
-	if case "${NIX_GNUSTEP_MAKEFILES_ADDITIONAL-}" in *"{$filename}"*) false;; *) true;; esac; then
-	    export NIX_GNUSTEP_MAKEFILES_ADDITIONAL+=" $filename"
-	fi
+    if case "${NIX_GNUSTEP_MAKEFILES_ADDITIONAL-}" in *"{$filename}"*) false;; *) true;; esac; then
+        export NIX_GNUSTEP_MAKEFILES_ADDITIONAL+=" $filename"
+    fi
    done

    local tmp="$1/lib/GNUstep/Applications"
    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_APPS-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_APPS "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_APPS "$tmp"
    fi
    tmp="$1/lib/GNUstep/Applications"
    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_ADMIN_APPS-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_APPS "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_APPS "$tmp"
    fi
    tmp="$1/lib/GNUstep/WebApplications"
    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_WEB_APPS-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_WEB_APPS "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_WEB_APPS "$tmp"
    fi
    tmp="$1/bin"
    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_TOOLS-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_TOOLS "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_TOOLS "$tmp"
    fi
    tmp="$1/sbin"
    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS "$tmp"
    fi
    tmp="$1/lib/GNUstep"
    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_LIBRARY-}" in *"${tmp}"*) false;; *) true;; esac; then
-    	addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARY "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARY "$tmp"
    fi
    tmp="$1/include"
    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_HEADERS-}" in *"${tmp}"*) false;; *) true;; esac; then
-    	if [ -z "${NIX_GNUSTEP_SYSTEM_HEADERS-}" ]; then
-    	    export NIX_GNUSTEP_SYSTEM_HEADERS="$tmp"
-    	else
-    	    export NIX_GNUSTEP_SYSTEM_HEADERS+=" $tmp"
-    	fi
+        if [ -z "${NIX_GNUSTEP_SYSTEM_HEADERS-}" ]; then
+            export NIX_GNUSTEP_SYSTEM_HEADERS="$tmp"
+        else
+            export NIX_GNUSTEP_SYSTEM_HEADERS+=" $tmp"
+        fi
    fi
    tmp="$1/lib"
    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_LIBRARIES-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARIES "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARIES "$tmp"
    fi
    tmp="$1/share/GNUstep/Documentation"
    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_DOC-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_DOC "$tmp"
    fi
    tmp="$1/share/man"
    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_DOC_MAN-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_MAN "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_MAN "$tmp"
    fi
    tmp="$1/share/info"
    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_DOC_INFO-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_INFO "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_INFO "$tmp"
    fi
 }
 addEnvHooks "$targetOffset" addEnvVars
--- a/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh
+++ b/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh
@ -8,43 +8,43 @@ function extract

    case "$1" in
        *.tar.xz)
-	    xz -dc $1 | tar "$tarflags" - ;;
-	*)
-	    printf "Make sure you give a iPhoneOS9.2.sdk.tar.xz file \n" ;;
+        xz -dc $1 | tar "$tarflags" - ;;
+    *)
+        printf "Make sure you give a iPhoneOS9.2.sdk.tar.xz file \n" ;;
    esac
 }

 function verify_arch {
    case "$1" in
-	# Our good arches.
-	armv7|arm64) ;;
-	*)
-	    local
-	    acc="armv7 | arm64"
-	    error_message=$(
-		printf '%s is not an acceptable arch. Try one of %s' "$1" "$acc"
-			 )
-	    printf "$error_message\n"
-	    exit
+    # Our good arches.
+    armv7|arm64) ;;
+    *)
+        local
+        acc="armv7 | arm64"
+        error_message=$(
+        printf '%s is not an acceptable arch. Try one of %s' "$1" "$acc"
+             )
+        printf "$error_message\n"
+        exit
    esac
 }

 function verify_sdk_version {
    sdk_version=$(basename "$1" | grep -P -o "[0-9].[0-9]+")
    case "$sdk_version" in
-	# Make sure the SDK is correct.
-	[5-9].[0-9]) ;;
-	*)
-	    printf 'No iPhone SDK version in file name\n'
+    # Make sure the SDK is correct.
+    [5-9].[0-9]) ;;
+    *)
+        printf 'No iPhone SDK version in file name\n'
    esac
 }

 function do_build {

    if [ $# -lt 2 ]; then
-	printf "usage: $0 iPhoneOS.sdk.tar* <target cpu>\n" 1>&2
-	printf "i.e. $0 /path/to/iPhoneOS.sdk.tar.xz armv7\n" 1>&2
-	exit 1
+    printf "usage: $0 iPhoneOS.sdk.tar* <target cpu>\n" 1>&2
+    printf "i.e. $0 /path/to/iPhoneOS.sdk.tar.xz armv7\n" 1>&2
+    exit 1
    fi

    mkdir -p $out
@ -54,7 +54,7 @@ function do_build {
    pushd "$cctools_port"/usage_examples/ios_toolchain &> /dev/null

    export LC_ALL=C
-    
+
    local
    triple='%s-apple-darwin11'
    target_dir="$PWD/target"
@ -75,12 +75,12 @@ function do_build {
    extract "$1"

    local sys_lib=$(
-    	find $sdk_dir -name libSystem.dylib -o -name libSystem.tbd | head -n1
-    	  )
+        find $sdk_dir -name libSystem.dylib -o -name libSystem.tbd | head -n1
+          )

    if [ -z "$sys_lib" ]; then
-    	printf "SDK should contain libSystem{.dylib,.tbd}\n" 1>&2
-    	exit 1
+        printf "SDK should contain libSystem{.dylib,.tbd}\n" 1>&2
+        exit 1
    fi

    local sys_root=$(readlink -f "$(dirname $sys_lib)/../..")
@ -96,18 +96,18 @@ function do_build {
    printf "int main(){return 0;}" | clang -xc -O2 -o "$target_dir"/bin/dsymutil -

    clang -O2 -std=c99 $alt_wrapper \
-    	  -DTARGET_CPU=$(printf '"%s"' "$2") \
-    	  -DNIX_APPLE_HDRS=$(
-    	printf '"%s"' "-I$out/$sdk/usr/include"
-    	  ) \
-    	  -DNIX_APPLE_FRAMEWORKS=$(
-    	printf '"%s"' "$out/$sdk/System/Library/Frameworks"
-    	  ) \
-    	  -DNIX_APPLE_PRIV_FRAMEWORKS=$(
-    	printf '"%s"' "$out/$sdk/System/Library/PrivateFrameworks"
-    	  ) \
-    	  -DOS_VER_MIN=$(printf '"%s"' "7.1") \
-    	  -o "$target_dir/bin/$triple-clang"
+          -DTARGET_CPU=$(printf '"%s"' "$2") \
+          -DNIX_APPLE_HDRS=$(
+        printf '"%s"' "-I$out/$sdk/usr/include"
+          ) \
+          -DNIX_APPLE_FRAMEWORKS=$(
+        printf '"%s"' "$out/$sdk/System/Library/Frameworks"
+          ) \
+          -DNIX_APPLE_PRIV_FRAMEWORKS=$(
+        printf '"%s"' "$out/$sdk/System/Library/PrivateFrameworks"
+          ) \
+          -DOS_VER_MIN=$(printf '"%s"' "7.1") \
+          -o "$target_dir/bin/$triple-clang"

    pushd "$target_dir"/bin &>/dev/null

@ -141,8 +141,8 @@ function do_build {
    local me=`whoami`

    for d in bin libexec SDK; do
-    	chown -R $me:$me target/$d
-    	cp -R target/$d $out
+        chown -R $me:$me target/$d
+        cp -R target/$d $out
    done

    # Crucial piece
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@ -73,6 +73,20 @@ in stdenv.mkDerivation (rec {
      sha256 = "0nh123kld0dgz2h941lng331dkj3wbm5lfxm375k1f569gv83hlk";
      stripLen = 1;
    })
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
+    (fetchpatch {
+      name = "dfaemitter-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/0841916e87a39e3c223c986e8da31e4a9a1432e3.patch";
+      sha256 = "1kckghvsngs51mqm82asy0s9vr19h8aqbw43a0w44mccqw6bzrwf";
+      stripLen = 1;
+    })
  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;

  postPatch = optionalString stdenv.isDarwin ''
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@ -65,6 +65,26 @@ in stdenv.mkDerivation (rec {
      sha256 = "sha256:12s8vr6ibri8b48h2z38f3afhwam10arfiqfy4yg37bmc054p5hi";
      stripLen = 1;
    })
+    # gcc-11 compat upstream patch
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/b498303066a63a203d24f739b2d2e0e56dca70d1.patch";
+      sha256 = "sha256:0nh123kld0dgz2h941lng331dkj3wbm5lfxm375k1f569gv83hlk";
+      stripLen = 1;
+    })
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
+    (fetchpatch {
+      name = "dfaemitter-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/0841916e87a39e3c223c986e8da31e4a9a1432e3.patch";
+      sha256 = "1kckghvsngs51mqm82asy0s9vr19h8aqbw43a0w44mccqw6bzrwf";
+      stripLen = 1;
+    })
  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;

  postPatch = optionalString stdenv.isDarwin ''
--- a/pkgs/development/compilers/llvm/13/clang/default.nix
+++ b/pkgs/development/compilers/llvm/13/clang/default.nix
@ -44,6 +44,8 @@ let
    ];

    postPatch = ''
+      (cd tools && ln -s ../../clang-tools-extra extra)
+
      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
             -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
             lib/Driver/ToolChains/*.cpp
--- a/pkgs/development/compilers/llvm/5/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/5/llvm/default.nix
@ -66,6 +66,14 @@ stdenv.mkDerivation ({
    #  stripLen = 1;
    #})
    ./gnu-install-dirs.patch
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;

  postPatch = optionalString stdenv.isDarwin ''
--- a/pkgs/development/compilers/llvm/6/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/6/llvm/default.nix
@ -64,6 +64,14 @@ stdenv.mkDerivation ({
      sha256 = "0fxgrxmfnjx17w3lcq19rk68b2xksh1bynz3ina784kma7hp4wdb";
    })
    ./gnu-install-dirs.patch
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;

  postPatch = optionalString stdenv.isDarwin ''
--- a/pkgs/development/compilers/llvm/7/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/7/llvm/default.nix
@ -68,6 +68,14 @@ in stdenv.mkDerivation ({
      sha256 = "0k6k1p5yisgwx417a67s7sr9930rqh1n0zv5jvply8vjjy4b3kf8";
    })
    ./gnu-install-dirs.patch
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;

  postPatch = optionalString stdenv.isDarwin ''
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@ -71,6 +71,14 @@ in stdenv.mkDerivation ({
      sha256 = "0nh123kld0dgz2h941lng331dkj3wbm5lfxm375k1f569gv83hlk";
      stripLen = 1;
    })
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;

  postPatch = optionalString stdenv.isDarwin ''
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@ -69,6 +69,14 @@ in stdenv.mkDerivation (rec {
      sha256 = "0nh123kld0dgz2h941lng331dkj3wbm5lfxm375k1f569gv83hlk";
      stripLen = 1;
    })
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;

  postPatch = optionalString stdenv.isDarwin ''
--- a/pkgs/development/compilers/llvm/git/clang/default.nix
+++ b/pkgs/development/compilers/llvm/git/clang/default.nix
@ -44,6 +44,8 @@ let
    ];

    postPatch = ''
+      (cd tools && ln -s ../../clang-tools-extra extra)
+
      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
             -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
             lib/Driver/ToolChains/*.cpp
--- a/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
+++ b/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
@ -1,16 +1,16 @@
 findGdkPixbufLoaders() {

-	# choose the longest loaders.cache
-	local loadersCache="$1/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"
-	if [[ -f "$loadersCache" ]]; then
-		if [[ -f "${GDK_PIXBUF_MODULE_FILE-}" ]]; then
-			if (( "$(cat "$loadersCache" | wc -l)" > "$(cat "$GDK_PIXBUF_MODULE_FILE" | wc -l)" )); then
-				export GDK_PIXBUF_MODULE_FILE="$loadersCache"
-			fi
-		else
-			export GDK_PIXBUF_MODULE_FILE="$loadersCache"
-		fi
-	fi
+    # choose the longest loaders.cache
+    local loadersCache="$1/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"
+    if [[ -f "$loadersCache" ]]; then
+        if [[ -f "${GDK_PIXBUF_MODULE_FILE-}" ]]; then
+            if (( "$(cat "$loadersCache" | wc -l)" > "$(cat "$GDK_PIXBUF_MODULE_FILE" | wc -l)" )); then
+                export GDK_PIXBUF_MODULE_FILE="$loadersCache"
+            fi
+        else
+            export GDK_PIXBUF_MODULE_FILE="$loadersCache"
+        fi
+    fi

 }

--- a/pkgs/development/libraries/gmp/4.3.2.nix
+++ b/pkgs/development/libraries/gmp/4.3.2.nix
@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, m4, cxx ? true }:

 let self = stdenv.mkDerivation rec {
-  name = "gmp-4.3.2";
+  pname = "gmp";
+  version = "4.3.2";

  src = fetchurl {
-    url = "mirror://gnu/gmp/${name}.tar.bz2";
+    url = "mirror://gnu/gmp/gmp-${version}.tar.bz2";
    sha256 = "0x8prpqi9amfcmi7r4zrza609ai9529pjaq0h4aw51i867064qck";
  };

--- a/pkgs/development/libraries/gmp/5.1.x.nix
+++ b/pkgs/development/libraries/gmp/5.1.x.nix
@ -6,10 +6,11 @@
 let inherit (lib) optional; in

 let self = stdenv.mkDerivation rec {
-  name = "gmp-5.1.3";
+  pname = "gmp";
+  version = "5.1.3";

  src = fetchurl { # we need to use bz2, others aren't in bootstrapping stdenv
-    urls = [ "mirror://gnu/gmp/${name}.tar.bz2" "ftp://ftp.gmplib.org/pub/${name}/${name}.tar.bz2" ];
+    urls = [ "mirror://gnu/gmp/gmp-${version}.tar.bz2" "ftp://ftp.gmplib.org/pub/gmp-${version}/gmp-${version}.tar.bz2" ];
    sha256 = "0q5i39pxrasgn9qdxzpfbwhh11ph80p57x6hf48m74261d97j83m";
  };

--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@ -12,10 +12,11 @@
 let inherit (lib) optional; in

 let self = stdenv.mkDerivation rec {
-  name = "gmp-6.2.1";
+  pname = "gmp";
+  version = "6.2.1";

  src = fetchurl { # we need to use bz2, others aren't in bootstrapping stdenv
-    urls = [ "mirror://gnu/gmp/${name}.tar.bz2" "ftp://ftp.gmplib.org/pub/${name}/${name}.tar.bz2" ];
+    urls = [ "mirror://gnu/gmp/gmp-${version}.tar.bz2" "ftp://ftp.gmplib.org/pub/gmp-${version}/gmp-${version}.tar.bz2" ];
    sha256 = "0z2ddfiwgi0xbf65z4fg4hqqzlhv0cc6hdcswf3c6n21xdmk5sga";
  };

--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@ -51,8 +51,10 @@ stdenv.mkDerivation rec {

  preConfigure = "patchShebangs .";
  configureFlags =
-    lib.optional stdenv.isLinux "--with-default-trust-store-file=/etc/ssl/certs/ca-certificates.crt"
-  ++ [
+    lib.optionals stdenv.isLinux [
+    "--with-default-trust-store-file=/etc/ssl/certs/ca-certificates.crt"
+    "--with-default-trust-store-pkcs11=pkcs11:"
+  ] ++ [
    "--disable-dependency-tracking"
    "--enable-fast-install"
    "--with-unbound-root-key-file=${dns-root-data}/root.key"
--- a/pkgs/development/libraries/libnetfilter_log/default.nix
+++ b/pkgs/development/libraries/libnetfilter_log/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "libnetfilter_log";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchurl {
    url = "https://netfilter.org/projects/libnetfilter_log/files/${pname}-${version}.tar.bz2";
-    sha256 = "089vjcfxl5qjqpswrbgklf4wflh44irmw6sk2k0kmfixfmszxq3l";
+    sha256 = "1spy9xs41v76kid5ana8n126f3mvgq6fjibbfbj4kn0larbhix73";
  };

  buildInputs = [ libmnl ];
--- a/pkgs/development/libraries/libnftnl/default.nix
+++ b/pkgs/development/libraries/libnftnl/default.nix
@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, pkg-config, libmnl }:

 stdenv.mkDerivation rec {
-  version = "1.2.0";
+  version = "1.2.1";
  pname = "libnftnl";

  src = fetchurl {
    url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
-    sha256 = "1xblq1cbcxhr6qmjpy98i1qdza148idgz99vbhjc7s4vzvfizc4h";
+    sha256 = "0z4khm2mnys9mcl8ckwf19cw20jgrv8650nfncy3xcgs2k2aa23m";
  };

  nativeBuildInputs = [ pkg-config ];
@ -17,6 +17,6 @@ stdenv.mkDerivation rec {
    homepage = "http://netfilter.org/projects/libnftnl";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [ fpletz ajs124 ];
  };
 }
--- a/pkgs/development/libraries/libuninameslist/default.nix
+++ b/pkgs/development/libraries/libuninameslist/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "libuninameslist";
-  version = "20210917";
+  version = "20211114";

  src = fetchFromGitHub {
    owner = "fontforge";
    repo = pname;
    rev = version;
-    sha256 = "sha256-bwMgNK3DhhWjijush27265Q1UoZOw7T17fKsaR6IV14=";
+    sha256 = "sha256-izxG2mx+D83s78eL19ERUaLrw9FPjlJRcFZw3+xzLDQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@ -31,7 +31,11 @@ stdenv.mkDerivation rec {
  configureFlags = [
    "--sysconfdir=/etc"
    "--localstatedir=/var"
-    "--with-trust-paths=/etc/ssl/trust-source:/etc/ssl/certs/ca-certificates.crt"
+    "--with-trust-paths=${lib.concatStringsSep ":" [
+      "/etc/ssl/trust-source"               # p11-kit trust source
+      "/etc/ssl/certs/ca-certificates.crt"  # NixOS + Debian/Ubuntu/Arch/Gentoo...
+      "/etc/pki/tls/certs/ca-bundle.crt"    # Fedora/CentOS
+    ]}"
  ];

  enableParallelBuilding = true;
--- a/pkgs/development/libraries/physics/lhapdf/maintainer.sh
+++ b/pkgs/development/libraries/physics/lhapdf/maintainer.sh
@ -7,7 +7,7 @@ set -xe
 BASE_URL="https://lhapdfsets.web.cern.ch/lhapdfsets/current/"

 for pdf_set in `curl -L $BASE_URL 2>/dev/null | "$SED" -e "s/.*<a href=\"\([^\"/]*.tar.gz\)\".*/\1/;tx;d;:x" | sort -u`; do
-	echo -n "    \"${pdf_set%.tar.gz}\" = \""
-	nix-prefetch-url "${BASE_URL}${pdf_set}" 2>/dev/null | tr -d '\n'
-	echo "\";"
+    echo -n "    \"${pdf_set%.tar.gz}\" = \""
+    nix-prefetch-url "${BASE_URL}${pdf_set}" 2>/dev/null | tr -d '\n'
+    echo "\";"
 done
--- a/pkgs/development/libraries/slib/setup-hook.sh
+++ b/pkgs/development/libraries/slib/setup-hook.sh
@ -1,12 +1,12 @@
 addSlibPath () {
    if test -f "$1/lib/slib/slibcat"
    then
-	export SCHEME_LIBRARY_PATH="$1/lib/slib/"
-	echo "SLIB found in \`$1'; setting \$SCHEME_LIBRARY_PATH to \`$SCHEME_LIBRARY_PATH'"
+        export SCHEME_LIBRARY_PATH="$1/lib/slib/"
+        echo "SLIB found in \`$1'; setting \$SCHEME_LIBRARY_PATH to \`$SCHEME_LIBRARY_PATH'"

-	# This is needed so that `(load-from-path "slib/guile.init")' works.
-	export GUILE_LOAD_PATH="$1/lib:$GUILE_LOAD_PATH"
-	echo "SLIB: setting \$GUILE_LOAD_PATH to \`$GUILE_LOAD_PATH'"
+        # This is needed so that `(load-from-path "slib/guile.init")' works.
+        export GUILE_LOAD_PATH="$1/lib:$GUILE_LOAD_PATH"
+        echo "SLIB: setting \$GUILE_LOAD_PATH to \`$GUILE_LOAD_PATH'"
    fi
 }

--- a/pkgs/development/lisp-modules/clwrapper/cl-wrapper.sh
+++ b/pkgs/development/lisp-modules/clwrapper/cl-wrapper.sh
@ -18,59 +18,59 @@ fi
 export NIX_LISP NIX_LISP_LOAD_FILE NIX_LISP_EXEC_CODE NIX_LISP_COMMAND NIX_LISP_FINAL_PARAMETERS

 test -n "$NIX_LISP_LD_LIBRARY_PATH" &&
-	export LD_LIBRARY_PATH="$LD_LIBRARY_PATH${LD_LIBRARY_PATH:+:}$NIX_LISP_LD_LIBRARY_PATH"
+        export LD_LIBRARY_PATH="$LD_LIBRARY_PATH${LD_LIBRARY_PATH:+:}$NIX_LISP_LD_LIBRARY_PATH"

 declare -a NIX_LISP_FINAL_PARAMETERS;

 case "$NIX_LISP" in
-	sbcl)
-		NIX_LISP_LOAD_FILE="--load"
-		NIX_LISP_EXEC_CODE="--eval"
+        sbcl)
+                NIX_LISP_LOAD_FILE="--load"
+                NIX_LISP_EXEC_CODE="--eval"
                NIX_LISP_QUIT="(quit)"
                NIX_LISP_NODEBUG='--non-interactive'
-		NIX_LISP_FINAL_PARAMETERS=
+                NIX_LISP_FINAL_PARAMETERS=
                NIX_LISP_FASL_TYPE="fasl"
-		;;
-	ecl)
-		NIX_LISP_LOAD_FILE="-load"
-		NIX_LISP_EXEC_CODE="-eval"
+                ;;
+        ecl)
+                NIX_LISP_LOAD_FILE="-load"
+                NIX_LISP_EXEC_CODE="-eval"
                NIX_LISP_QUIT="(quit)"
                NIX_LISP_NODEBUG='--nodebug'
-		NIX_LISP_FINAL_PARAMETERS=
+                NIX_LISP_FINAL_PARAMETERS=
                NIX_LISP_FASL_TYPE="fas"
-		;;
-	clisp)
-		NIX_LISP_LOAD_FILE="-c -l"
-		NIX_LISP_EXEC_CODE="-x"
+                ;;
+        clisp)
+                NIX_LISP_LOAD_FILE="-c -l"
+                NIX_LISP_EXEC_CODE="-x"
                NIX_LISP_QUIT="(quit)"
                NIX_LISP_NODEBUG='-on-error exit'
-		NIX_LISP_FINAL_PARAMETERS="-repl"
+                NIX_LISP_FINAL_PARAMETERS="-repl"
                NIX_LISP_FASL_TYPE="fas"
-		;;
-	lx86cl64)
-		NIX_LISP_LOAD_FILE="-l"
-		NIX_LISP_EXEC_CODE="-e"
+                ;;
+        lx86cl64)
+                NIX_LISP_LOAD_FILE="-l"
+                NIX_LISP_EXEC_CODE="-e"
                NIX_LISP_QUIT="(quit)"
                NIX_LISP_NODEBUG='-b'
-		NIX_LISP_FINAL_PARAMETERS=
+                NIX_LISP_FINAL_PARAMETERS=
                NIX_LISP_FASL_TYPE="lx64fsl"
-		;;
-	lx86cl)
-		NIX_LISP_LOAD_FILE="-l"
-		NIX_LISP_EXEC_CODE="-e"
+                ;;
+        lx86cl)
+                NIX_LISP_LOAD_FILE="-l"
+                NIX_LISP_EXEC_CODE="-e"
                NIX_LISP_QUIT="(quit)"
                NIX_LISP_NODEBUG='-b'
-		NIX_LISP_FINAL_PARAMETERS=
+                NIX_LISP_FINAL_PARAMETERS=
                NIX_LISP_FASL_TYPE="lx32fsl"
-		;;
-	abcl)
-		NIX_LISP_LOAD_FILE="--load"
-		NIX_LISP_EXEC_CODE="--eval"
+                ;;
+        abcl)
+                NIX_LISP_LOAD_FILE="--load"
+                NIX_LISP_EXEC_CODE="--eval"
                NIX_LISP_QUIT="(quit)"
                NIX_LISP_NODEBUG=''
-		NIX_LISP_FINAL_PARAMETERS=
+                NIX_LISP_FINAL_PARAMETERS=
                NIX_LISP_FASL_TYPE="abcl"
-		;;
+                ;;
 esac

 NIX_LISP_ASDF_REGISTRY_CODE="
@ -127,8 +127,8 @@ eval "$NIX_LISP_PRELAUNCH_HOOK"

 if [ -z "$NIX_LISP_SKIP_CODE" ]; then
    "$NIX_LISP_COMMAND" $NIX_LISP_EARLY_OPTIONS \
-	                $NIX_LISP_EXEC_CODE "${NIX_LISP_ASDF_LOAD:-"(load \"$NIX_LISP_ASDF/lib/common-lisp/asdf/build/asdf.$NIX_LISP_FASL_TYPE\")"}" \
-	                $NIX_LISP_EXEC_CODE "$NIX_LISP_ASDF_REGISTRY_CODE" \
-	                ${NIX_LISP_FINAL_PARAMETERS[*]:+"${NIX_LISP_FINAL_PARAMETERS[@]}"} \
-	                "$@"
+                        $NIX_LISP_EXEC_CODE "${NIX_LISP_ASDF_LOAD:-"(load \"$NIX_LISP_ASDF/lib/common-lisp/asdf/build/asdf.$NIX_LISP_FASL_TYPE\")"}" \
+                        $NIX_LISP_EXEC_CODE "$NIX_LISP_ASDF_REGISTRY_CODE" \
+                        ${NIX_LISP_FINAL_PARAMETERS[*]:+"${NIX_LISP_FINAL_PARAMETERS[@]}"} \
+                        "$@"
 fi
--- a/pkgs/development/lisp-modules/from-quicklisp/asdf-description.sh
+++ b/pkgs/development/lisp-modules/from-quicklisp/asdf-description.sh
@ -11,6 +11,6 @@
 name="$1"

 sbcl --noinform --load "$NIX_QUICKLISP_DIR"/setup.lisp --eval "(ql:quickload :$name)" \
-	--eval "(format t \"~a~%\" (or (asdf::system-description (asdf::find-system \"$name\")) \"\"))" \
-	--eval '(quit)' --script |
+    --eval "(format t \"~a~%\" (or (asdf::system-description (asdf::find-system \"$name\")) \"\"))" \
+    --eval '(quit)' --script |
    tee /dev/stderr | tail -n 1
--- a/pkgs/development/lisp-modules/from-quicklisp/barebones-quicklisp-expression.sh
+++ b/pkgs/development/lisp-modules/from-quicklisp/barebones-quicklisp-expression.sh
@ -122,8 +122,8 @@ url="${ql_src##* }"
  with (import <nixpkgs> {});
      fetchdarcs {
        url=''$url'';
-	rev=''$version'';
-	sha256=''0000000000000000000000000000000000000000000000000000000000000000'';
+    rev=''$version'';
+    sha256=''0000000000000000000000000000000000000000000000000000000000000000'';
    }" | nix-instantiate - | tail -n 1 |
    xargs nix-store -r 2>&1 | tee /dev/stderr | grep 'instead has' | tail -n 1 |
    sed -e 's/.* instead has .//;s/[^0-9a-z].*//')
@ -149,7 +149,7 @@ url="${ql_src##* }"
 }

 if [ "$ql_src" = '{"error":"Not Found"}' ]; then
-	echo "# $name: not found"
+    echo "# $name: not found"
 else
 cat << EOF | grep -Ev '^[ ]+$'

--- a/pkgs/development/perl-modules/expression-generator/filtered-requirements.sh
+++ b/pkgs/development/perl-modules/expression-generator/filtered-requirements.sh
@ -3,13 +3,13 @@
 source lib-cache.sh;

 print_reqs() {
-	module_name="$1";
+    module_name="$1";

-	./requirements.sh "$1"| while read; do
-		if let "$(./source-download-link.sh "${REPLY}" | wc -c)" && [ perl != "$REPLY" ]; then
-			echo "$REPLY";
-		fi;
-	done;
+    ./requirements.sh "$1"| while read; do
+        if let "$(./source-download-link.sh "${REPLY}" | wc -c)" && [ perl != "$REPLY" ]; then
+            echo "$REPLY";
+        fi;
+    done;
 }

 module_name="$1";
--- a/pkgs/development/perl-modules/expression-generator/full-requirements.sh
+++ b/pkgs/development/perl-modules/expression-generator/full-requirements.sh
@ -3,19 +3,19 @@
 source lib-cache.sh;

 print_requirements () {
-	module_name="$1";
+    module_name="$1";

-	./requirements.sh "$module_name" | while read; do
-		echo "$REPLY";
-		print_reqs_cache "$REPLY";
-	done | sort | uniq
+    ./requirements.sh "$module_name" | while read; do
+        echo "$REPLY";
+        print_reqs_cache "$REPLY";
+    done | sort | uniq
 };

 print_reqs_cache () {
-	module_name="$1";
-	module_basename="${module_name//::/-}";
-	
-	cached_output print_requirements "$module_basename" "$module_name" "full.deps";
+    module_name="$1";
+    module_basename="${module_name//::/-}";
+
+    cached_output print_requirements "$module_basename" "$module_name" "full.deps";
 };

 print_reqs_cache "$@";
--- a/pkgs/development/perl-modules/expression-generator/grab-url.sh
+++ b/pkgs/development/perl-modules/expression-generator/grab-url.sh
@ -3,13 +3,13 @@
 source lib-cache.sh

 get_file() {
-	url="$1";
+    url="$1";

-	if [ -n "$url" ]; then 
-		curl "$1";
-	else
-		echo -n;
-	fi;
+    if [ -n "$url" ]; then
+        curl "$1";
+    else
+        echo -n;
+    fi;
 }

 url="$1";
@ -17,4 +17,3 @@ name="$2";
 name=${name:-$(basename "$url")}

 cached_output get_file "${name%%.*}" "$url" "${name#*.}"
-
--- a/pkgs/development/perl-modules/expression-generator/lib-cache.sh
+++ b/pkgs/development/perl-modules/expression-generator/lib-cache.sh
@ -4,16 +4,15 @@
 # Third argument: argument to command
 # Fourth argument: cache type
 cached_output () {
-	cmd="$1";
-	basename="$2";
-	arg="$3";
-	ext="$4";
-	
-	if ! [ -e "cache-${ext//./-}/${basename}.${ext}" ]; then
-		mkdir -p "cache-${ext//./-}";
-		$cmd $arg > "cache-${ext//./-}/${basename}.${ext}";
-	fi;
+    cmd="$1";
+    basename="$2";
+    arg="$3";
+    ext="$4";

-	cat "cache-${ext//./-}/${basename}.${ext}";
-}
+    if ! [ -e "cache-${ext//./-}/${basename}.${ext}" ]; then
+        mkdir -p "cache-${ext//./-}";
+        $cmd $arg > "cache-${ext//./-}/${basename}.${ext}";
+    fi;

+    cat "cache-${ext//./-}/${basename}.${ext}";
+}
--- a/pkgs/development/perl-modules/expression-generator/requirements.sh
+++ b/pkgs/development/perl-modules/expression-generator/requirements.sh
@ -6,12 +6,12 @@ module_name="$1";
 module_basename="${1//::/-}";

 print_requirements () {
-	module_name="$1";
-	
-	./retrieve-meta-yaml.sh "$module_name" |
-		sed -re '1,/^requires:/d; /^[a-z]/,$d; s@^\s*@@; s@:\s.*@@';
-	./retrieve-meta-yaml.sh "$module_name" |
-		sed -re '1,/^build_requires:/d; /^[a-z]/,$d; s@^\s*@@; s@:\s.*@@';
+    module_name="$1";
+
+    ./retrieve-meta-yaml.sh "$module_name" |
+        sed -re '1,/^requires:/d; /^[a-z]/,$d; s@^\s*@@; s@:\s.*@@';
+    ./retrieve-meta-yaml.sh "$module_name" |
+        sed -re '1,/^build_requires:/d; /^[a-z]/,$d; s@^\s*@@; s@:\s.*@@';
 };

 cached_output print_requirements "$module_basename" "$module_name" "direct.deps";
--- a/pkgs/development/perl-modules/expression-generator/retrieve-file-link.sh
+++ b/pkgs/development/perl-modules/expression-generator/retrieve-file-link.sh
@ -6,9 +6,9 @@ file_name="$2";
 version_regexp="${module_basename}(-[0-9.a-z]+){0,1}";
 author_regexp="[A-Z0-9]+";

-./retrieve-modulepage.sh "$module_basename" | 
-	egrep "[<]a href=\"[a-z0-9/]*/(${author_regexp}/){0,1}${version_regexp}/${file_name}" |
-	sed -re "s@.*href=\"@@; s@\".*@@" |
-	sed -re 's@^/@http://search.cpan.org/@';
+./retrieve-modulepage.sh "$module_basename" |
+    egrep "[<]a href=\"[a-z0-9/]*/(${author_regexp}/){0,1}${version_regexp}/${file_name}" |
+    sed -re "s@.*href=\"@@; s@\".*@@" |
+    sed -re 's@^/@http://search.cpan.org/@';

 echo "$link_line";
--- a/pkgs/development/perl-modules/expression-generator/retrieve-meta-yaml.sh
+++ b/pkgs/development/perl-modules/expression-generator/retrieve-meta-yaml.sh
@ -3,11 +3,11 @@
 source lib-cache.sh;

 print_meta_yaml () {
-	module_name="$1";
-	module_basename="${module_name//::/-}";
+    module_name="$1";
+    module_basename="${module_name//::/-}";

-	./grab-url.sh "$(./retrieve-file-link.sh "$module_basename" "META.yml")" \
-		"${module_basename}.meta.yml";
+    ./grab-url.sh "$(./retrieve-file-link.sh "$module_basename" "META.yml")" \
+        "${module_basename}.meta.yml";
 };

 module_name="$1";
--- a/pkgs/development/perl-modules/expression-generator/source-download-link.sh
+++ b/pkgs/development/perl-modules/expression-generator/source-download-link.sh
@ -6,12 +6,12 @@ module_name="$1";
 module_basename="${module_name//::/-}";

 write_link() {
-	module_basename="$1";
+    module_basename="$1";

-	./retrieve-modulepage.sh "$module_basename" | 
-		grep -A 2 "This Release" |
-		grep href |
-		sed -re 's/.*href="//; s/".*//; s@^/@http://search.cpan.org/@';
+    ./retrieve-modulepage.sh "$module_basename" |
+        grep -A 2 "This Release" |
+        grep href |
+        sed -re 's/.*href="//; s/".*//; s@^/@http://search.cpan.org/@';
 }

 cached_output write_link "$module_basename" "$module_basename" src.link;
--- a/pkgs/development/perl-modules/expression-generator/write-nix-expression.sh
+++ b/pkgs/development/perl-modules/expression-generator/write-nix-expression.sh
@ -5,16 +5,16 @@ cd $(dirname $0);
 source lib-cache.sh;

 print_expression () {
-	module_name="$1";
-	module_basename="${module_name//::/-}";
-	module_compressedname="perl${module_name//::/}";
-	sourcelink="$(./source-download-link.sh "${module_name}")";
-	version_name="${sourcelink%.tar.*}";
-	version_name="${version_name##*/}";
-	dependencies="$(./filtered-requirements.sh "$module_name" | sed -e 's/^/perl/; s/:://g' | xargs)";
-	source_hash=$(nix-prefetch-url "$sourcelink" 2>/dev/null);
-
-	cat <<EOF
+    module_name="$1";
+    module_basename="${module_name//::/-}";
+    module_compressedname="perl${module_name//::/}";
+    sourcelink="$(./source-download-link.sh "${module_name}")";
+    version_name="${sourcelink%.tar.*}";
+    version_name="${version_name##*/}";
+    dependencies="$(./filtered-requirements.sh "$module_name" | sed -e 's/^/perl/; s/:://g' | xargs)";
+    source_hash=$(nix-prefetch-url "$sourcelink" 2>/dev/null);
+
+    cat <<EOF

  ${module_compressedname} = import ../development/perl-modules/generic perl {
    name = "${version_name}";
--- a/pkgs/development/python-modules/hydra-check/default.nix
+++ b/pkgs/development/python-modules/hydra-check/default.nix
@ -6,6 +6,7 @@
 , requests
 , beautifulsoup4
 , mypy
+, types-requests
 }:

 buildPythonPackage rec {
@ -26,14 +27,17 @@ buildPythonPackage rec {
    beautifulsoup4
  ];

-  checkInputs = [ mypy ];
+  checkInputs = [
+    mypy
+    types-requests
+  ];

  checkPhase = ''
    echo -e "\x1b[32m## run mypy\x1b[0m"
    mypy hydracheck
  '';

-  meta = with lib;{
+  meta = with lib; {
    description = "check hydra for the build status of a package";
    homepage = "https://github.com/nix-community/hydra-check";
    license = licenses.mit;
--- a/pkgs/development/python-modules/importlib-metadata/default.nix
+++ b/pkgs/development/python-modules/importlib-metadata/default.nix
@ -10,16 +10,20 @@

 buildPythonPackage rec {
  pname = "importlib-metadata";
-  version = "4.8.1";
+  version = "4.8.2";
+  format = "setuptools";
+
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    pname = "importlib_metadata";
    inherit version;
-    sha256 = "sha256-8oSz4RJWrR5dA6uGuyzNb1M5aI/xek15eg/n3zJvI7E=";
+    sha256 = "sha256-db3sFMOX9ShyTBv9lwnWYLM6TS53OHozWPILhIu15fs=";
  };

-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    setuptools-scm
+  ];

  propagatedBuildInputs = [
    toml
@ -30,7 +34,10 @@ buildPythonPackage rec {

  # Cyclic dependencies due to pyflakefs
  doCheck = false;
-  pythonImportsCheck = [ "importlib_metadata" ];
+
+  pythonImportsCheck = [
+    "importlib_metadata"
+  ];

  meta = with lib; {
    description = "Read metadata from Python packages";
--- a/pkgs/development/python-modules/mypy/default.nix
+++ b/pkgs/development/python-modules/mypy/default.nix
@ -1,28 +1,63 @@
-{ lib, stdenv, fetchPypi, buildPythonPackage, typed-ast, psutil, isPy3k
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, buildPythonPackage
 , mypy-extensions
+, python
+, pythonOlder
+, typed-ast
 , typing-extensions
+, tomli
+, types-typed-ast
 }:
+
 buildPythonPackage rec {
  pname = "mypy";
-  version = "0.812";
-  disabled = !isPy3k;
+  version = "unstable-2021-11-14";
+  disabled = pythonOlder "3.6";

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "069i9qnfanp7dn8df1vspnqb0flvsszzn22v00vj08nzlnd061yd";
+  src = fetchFromGitHub {
+    owner = "python";
+    repo = "mypy";
+    rev = "053a1beb94ee4e5b3260725594315d1b6776e42f";
+    sha256 = "sha256-q2ntj3y3GgXrw4v+yMvcqWFv4y/6YwunIj3bNzU9CH0=";
  };

-  propagatedBuildInputs = [ typed-ast psutil mypy-extensions typing-extensions ];
+  patches = [
+    # FIXME: Remove patch after upstream has decided the proper solution.
+    #        https://github.com/python/mypy/pull/11143
+    (fetchpatch {
+      url = "https://github.com/python/mypy/commit/f1755259d54330cd087cae763cd5bbbff26e3e8a.patch";
+      sha256 = "sha256-5gPahX2X6+/qUaqDQIGJGvh9lQ2EDtks2cpQutgbOHk=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "tomli>=1.1.0,<1.2.0" "tomli"
+  '';
+
+  buildInputs = [
+    types-typed-ast
+  ];
+
+  propagatedBuildInputs = [
+    mypy-extensions
+    tomli
+    typed-ast
+    typing-extensions
+  ];

  # Tests not included in pip package.
  doCheck = false;

  pythonImportsCheck = [
    "mypy"
-    "mypy.types"
    "mypy.api"
    "mypy.fastparse"
    "mypy.report"
+    "mypy.types"
    "mypyc"
    "mypyc.analysis"
  ];
@ -32,10 +67,13 @@ buildPythonPackage rec {
  # is64bit: unfortunately the build would exhaust all possible memory on i686-linux.
  MYPY_USE_MYPYC = stdenv.buildPlatform.is64bit;

+  # when testing reduce optimisation level to drastically reduce build time
+  MYPYC_OPT_LEVEL = 1;
+
  meta = with lib; {
    description = "Optional static typing for Python";
-    homepage    = "http://www.mypy-lang.org";
-    license     = licenses.mit;
-    maintainers = with maintainers; [ martingms lnl7 ];
+    homepage = "http://www.mypy-lang.org";
+    license = licenses.mit;
+    maintainers = with maintainers; [ martingms lnl7 SuperSandro2000 ];
  };
 }
--- a/pkgs/development/python-modules/mypy/extensions.nix
+++ b/pkgs/development/python-modules/mypy/extensions.nix
@ -13,12 +13,12 @@ buildPythonPackage rec {
    sha256 = "2d82818f5bb3e369420cb3c4060a7970edba416647068eb4c5343488a6c604a8";
  };

-  propagatedBuildInputs = if pythonOlder "3.5" then [ typing ] else [ ];
+  propagatedBuildInputs = lib.optional (pythonOlder "3.5") typing;

  meta = with lib; {
    description = "Experimental type system extensions for programs checked with the mypy typechecker";
-    homepage    = "http://www.mypy-lang.org";
-    license     = licenses.mit;
-    maintainers = with maintainers; [ martingms lnl7 ];
+    homepage = "http://www.mypy-lang.org";
+    license = licenses.mit;
+    maintainers = with maintainers; [ martingms lnl7 SuperSandro2000 ];
  };
 }
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@ -1,5 +1,6 @@
 { lib
 , fetchPypi
+, fetchpatch
 , python
 , buildPythonPackage
 , gfortran
@ -49,7 +50,13 @@ in buildPythonPackage rec {
    sha256 = "423216d8afc5923b15df86037c6053bf030d15cc9e3224206ef868c2d63dd6dc";
  };

-  patches = lib.optionals python.hasDistutilsCxxPatch [
+  patches = [
+    # fix https://github.com/numpy/numpy/issues/19624
+    (fetchpatch {
+      url = "https://github.com/numpy/numpy/commit/ae279066d6bd253e8675428fac8946938b8d48d9.diff";
+      sha256 = "sha256-q8SoF/pMzLI4zYCx2YAZzR31cARlZXerNnBSevBO5pE=";
+    })
+  ] ++ lib.optionals python.hasDistutilsCxxPatch [
    # We patch cpython/distutils to fix https://bugs.python.org/issue1222585
    # Patching of numpy.distutils is needed to prevent it from undoing the
    # patch to distutils.
@ -72,10 +79,6 @@ in buildPythonPackage rec {
    ln -s ${cfg} site.cfg
  '';

-  # Workaround flakey compiler feature detection
-  # https://github.com/numpy/numpy/issues/19624
-  hardeningDisable = [ "strictoverflow" ];
-
  enableParallelBuilding = true;

  checkInputs = [
--- a/pkgs/development/python-modules/pylsp-mypy/default.nix
+++ b/pkgs/development/python-modules/pylsp-mypy/default.nix
@ -20,10 +20,16 @@ buildPythonPackage rec {
    sha256 = "1d119csj1k5m9j0f7wdvpvnd02h548css6ybxqah92nk2v0rjscr";
  };

+  disabledTests = [
+    "test_multiple_workspaces"
+  ];
+
  checkInputs = [ pytestCheckHook mock ];

  propagatedBuildInputs = [ mypy python-lsp-server ];

+  pythonImportsCheck = [ "pylsp_mypy" ];
+
  meta = with lib; {
    homepage = "https://github.com/Richardk2n/pylsp-mypy";
    description = "Mypy plugin for the Python LSP Server";
--- a/pkgs/development/python-modules/tomli/default.nix
+++ b/pkgs/development/python-modules/tomli/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "tomli";
-  version = "1.2.1";
+  version = "1.2.2";
  format = "pyproject";

  outputs = [
@ -19,9 +19,14 @@ buildPythonPackage rec {
    owner = "hukkin";
    repo = pname;
    rev = version;
-    sha256 = "sha256-30AQ9MQmclcjl1d83mIoxFXzaJn1OFKQlVxayqC5NxY=";
+    sha256 = "sha256-oDjpNzWxTaCC1+WyBKrkR6kp90ZomcZQfyW+xKddDoM=";
  };

+  patches = [
+    # required for mypy
+    ./fix-backwards-compatibility-load.patch
+  ];
+
  nativeBuildInputs = [ flit-core ];

  postInstall = ''
--- a/pkgs/development/python-modules/tomli/fix-backwards-compatibility-load.patch
+++ b/pkgs/development/python-modules/tomli/fix-backwards-compatibility-load.patch
@ -0,0 +1,21 @@
+diff --git a/tomli/_parser.py b/tomli/_parser.py
+index 89e81c3..6fb1bfd 100644
+--- a/tomli/_parser.py
+++ b/tomli/_parser.py
+@@ -1,6 +1,6 @@
+ import string
+ from types import MappingProxyType
+-from typing import Any, BinaryIO, Dict, FrozenSet, Iterable, NamedTuple, Optional, Tuple
+from typing import IO, Union, Any, BinaryIO, Dict, FrozenSet, Iterable, NamedTuple, Optional, Tuple
+ import warnings
+ 
+ from tomli._re import (
+@@ -48,7 +48,7 @@ class TOMLDecodeError(ValueError):
+     """An error raised if a document is not valid TOML."""
+ 
+ 
+-def load(fp: BinaryIO, *, parse_float: ParseFloat = float) -> Dict[str, Any]:
+def load(fp: Union[IO, BinaryIO], *, parse_float: ParseFloat = float) -> Dict[str, Any]:
+     """Parse TOML from a binary file object."""
+     s_bytes = fp.read()
+     try:
--- a/pkgs/development/python-modules/typed-ast/default.nix
+++ b/pkgs/development/python-modules/typed-ast/default.nix
@ -1,15 +1,16 @@
 { buildPythonPackage, fetchFromGitHub, lib, pythonOlder, pytest }:
+
 buildPythonPackage rec {
  pname = "typed-ast";
-  version = "1.4.3";
+  version = "1.5.0";
+  disabled = pythonOlder "3.3";
+
  src = fetchFromGitHub {
    owner = "python";
    repo = "typed_ast";
    rev = version;
-    sha256 = "16mn9snwik5n2ib65sw2xcaqdm02j8ps21zgjxf8kyy7qnx2mx4w";
+    sha256 = "sha256-z3l5gMG1Jp6EI7SnGn5ABVXVBi+bK///iJBqEWn4d+s=";
  };
-  # Only works with Python 3.3 and newer;
-  disabled = pythonOlder "3.3";

  pythonImportsCheck = [
    "typed_ast"
@ -21,6 +22,7 @@ buildPythonPackage rec {
  checkInputs = [
    pytest
  ];
+
  checkPhase = ''
    runHook preCheck

@ -32,9 +34,10 @@ buildPythonPackage rec {
    runHook postCheck
  '';

-  meta = {
+  meta = with lib; {
    homepage = "https://github.com/python/typed_ast";
    description = "Python 2 and 3 ast modules with type comment support";
-    license = lib.licenses.asl20;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ SuperSandro2000 ];
  };
 }
--- a/pkgs/development/python-modules/types-typed-ast/default.nix
+++ b/pkgs/development/python-modules/types-typed-ast/default.nix
@ -0,0 +1,26 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "types-typed-ast";
+  version = "1.5.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-2Op5y/vFIL6Nm8jeSHL0SzQtvbwJFmfi8hsDu9eWkVA=";
+  };
+
+  # Module doesn't have tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "typed_ast-stubs" ];
+
+  meta = with lib; {
+    description = "Typing stubs for typed-ast";
+    homepage = "https://github.com/python/typeshed";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ SuperSandro2000 veehaitch ];
+  };
+}
--- a/pkgs/development/tools/analysis/valgrind/default.nix
+++ b/pkgs/development/tools/analysis/valgrind/default.nix
@ -1,4 +1,7 @@
-{ lib, stdenv, fetchurl, perl, gdb, cctools, xnu, bootstrap_cmds }:
+{ lib, stdenv, fetchurl, fetchpatch
+, autoreconfHook, perl
+, gdb, cctools, xnu, bootstrap_cmds
+}:

 stdenv.mkDerivation rec {
  pname = "valgrind";
@ -9,16 +12,25 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-AIWaoTp3Lt33giIl9LRu4NOa++Bx0yd42k2ZmECB9/U=";
  };

+  patches = [
+    # Fix tests on Musl.
+    # https://bugs.kde.org/show_bug.cgi?id=445300
+    (fetchpatch {
+      url = "https://bugsfiles.kde.org/attachment.cgi?id=143535";
+      sha256 = "036zyk30rixjvpylw3c7n171n4gpn6zcp7h6ya2dz4h5r478l9i6";
+    })
+  ];
+
  outputs = [ "out" "dev" "man" "doc" ];

-  hardeningDisable = [ "stackprotector" ];
+  hardeningDisable = [ "pie" "stackprotector" ];

  # GDB is needed to provide a sane default for `--db-command'.
  # Perl is needed for `callgrind_{annotate,control}'.
  buildInputs = [ gdb perl ]  ++ lib.optionals (stdenv.isDarwin) [ bootstrap_cmds xnu ];

  # Perl is also a native build input.
-  nativeBuildInputs = [ perl ];
+  nativeBuildInputs = [ autoreconfHook perl ];

  enableParallelBuilding = true;
  separateDebugInfo = stdenv.isLinux;
--- a/pkgs/development/tools/build-managers/tup/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/tup/setup-hook.sh
@ -1,27 +1,27 @@
 #!/bin/sh

 tupConfigurePhase() {
-	runHook preConfigure
-
-	echo -n CONFIG_TUP_ARCH= >> tup.config
-	case "$system" in
-	"i686-*")      echo i386 >> tup.config;;
-	"x86_64-*")    echo x86_64 >> tup.config;;
-	"powerpc-*")   echo powerpc >> tup.config;;
-	"powerpc64-*") echo powerpc64 >> tup.config;;
-	"ia64-*")      echo ia64 >> tup.config;;
-	"alpha-*")     echo alpha >> tup.config;;
-	"sparc-*")     echo sparc >> tup.config;;
-	"aarch64-*")   echo arm64 >> tup.config;;
-	"arm*")        echo arm >> tup.config;;
-	esac
-
-	echo "${tupConfig-}" >> tup.config
-
-	tup init
-	tup generate tupBuild.sh
-
-	runHook postConfigure
+    runHook preConfigure
+
+    echo -n CONFIG_TUP_ARCH= >> tup.config
+    case "$system" in
+    "i686-*")      echo i386 >> tup.config;;
+    "x86_64-*")    echo x86_64 >> tup.config;;
+    "powerpc-*")   echo powerpc >> tup.config;;
+    "powerpc64-*") echo powerpc64 >> tup.config;;
+    "ia64-*")      echo ia64 >> tup.config;;
+    "alpha-*")     echo alpha >> tup.config;;
+    "sparc-*")     echo sparc >> tup.config;;
+    "aarch64-*")   echo arm64 >> tup.config;;
+    "arm*")        echo arm >> tup.config;;
+    esac
+
+    echo "${tupConfig-}" >> tup.config
+
+    tup init
+    tup generate tupBuild.sh
+
+    runHook postConfigure
 }

 if [ -z "${dontUseTupConfigure-}" -a -z "${configurePhase-}" ]; then
@ -30,13 +30,13 @@ fi


 tupBuildPhase() {
-	runHook preBuild
+    runHook preBuild

-	pushd .
-	. tupBuild.sh
-	popd
+    pushd .
+    . tupBuild.sh
+    popd

-	runHook postBuild
+    runHook postBuild
 }

 if [ -z "${dontUseTupBuild-}" -a -z "${buildPhase-}" ]; then
--- a/pkgs/development/tools/build-managers/wafHook/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/wafHook/setup-hook.sh
@ -21,6 +21,11 @@ wafConfigurePhase() {
    echoCmd 'configure flags' "${flagsArray[@]}"
    python "$wafPath" "${flagsArray[@]}"

+    if ! [[ -v enableParallelBuilding ]]; then
+        enableParallelBuilding=1
+        echo "waf: enabled parallel building"
+    fi
+
    runHook postConfigure
 }

--- a/pkgs/development/tools/misc/gengetopt/default.nix
+++ b/pkgs/development/tools/misc/gengetopt/default.nix
@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
    rm tests/test_conf_parser_save.sh
  '';

-  enableParallelBuilding = true;
+  # test suite is not thread safe
+  enableParallelBuilding = false;

  nativeBuildInputs = [ texinfo help2man ];

--- a/pkgs/games/dwarf-fortress/update.sh
+++ b/pkgs/games/dwarf-fortress/update.sh
@ -3,13 +3,13 @@

 # systems to generate hashes for
 systems='linux linux32 osx osx32
-	 win win_s win32 win32_s
+     win win_s win32 win32_s
         legacy legacy_s legacy32 legacy32_s'

 if [ $# -eq 0 ]; then
    versions="$(curl http://www.bay12games.com/dwarves/ \
-		   | grep 'DWARF FORTRESS CLASSIC ' \
-		   | sed 's/.*DWARF FORTRESS CLASSIC \([0-9.]*\) .*/\1/')"
+           | grep 'DWARF FORTRESS CLASSIC ' \
+           | sed 's/.*DWARF FORTRESS CLASSIC \([0-9.]*\) .*/\1/')"
 else
    versions="$@"
 fi
@ -18,23 +18,23 @@ tmp1="$(mktemp)"
 tmp2="$(mktemp)"
 for version in $versions; do
    for system in $systems; do
-	echo -n $version,$system,
-	ver=$(echo $version | sed -e s,^0\.,, | tr . _)
-	if [[ "$system" = *win* ]] || [[ "$system" = *legacy* ]]; then
-	    ext=zip
-	else
-	    ext=tar.bz2
-	fi
-	nix-prefetch-url \
-	    http://www.bay12games.com/dwarves/df_${ver}_${system}.${ext}
+    echo -n $version,$system,
+    ver=$(echo $version | sed -e s,^0\.,, | tr . _)
+    if [[ "$system" = *win* ]] || [[ "$system" = *legacy* ]]; then
+        ext=zip
+    else
+        ext=tar.bz2
+    fi
+    nix-prefetch-url \
+        http://www.bay12games.com/dwarves/df_${ver}_${system}.${ext}
    done
 done | jq --slurp --raw-input \
-	  'split("\n")  | .[:-1] | map(split(",")) |
+      'split("\n")  | .[:-1] | map(split(",")) |
           map({ "version": .[0], "platform": .[1], "sha256": .[2] }) |
-	   group_by(.version) |
-	   map(map({"version": .version, (.platform): .sha256}) | add |
-	       {(.version): .} | map_values(del(.version))) | add' \
-	  > "$tmp1"
+       group_by(.version) |
+       map(map({"version": .version, (.platform): .sha256}) | add |
+           {(.version): .} | map_values(del(.version))) | add' \
+      > "$tmp1"

 # Append $tmp1 to game.json. There should be a better way to handle
 # this but all other attempts failed for me.
--- a/pkgs/os-specific/linux/checkpolicy/default.nix
+++ b/pkgs/os-specific/linux/checkpolicy/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "checkpolicy";
-  version = "2.9";
-  inherit (libsepol) se_release se_url;
+  version = "3.3";
+  inherit (libsepol) se_url;

  src = fetchurl {
-    url = "${se_url}/${se_release}/checkpolicy-${version}.tar.gz";
-    sha256 = "13jz6f8zdrijvn5w1j102b36fs41z0q8ii74axw48cj550mw6im9";
+    url = "${se_url}/${version}/checkpolicy-${version}.tar.gz";
+    sha256 = "118l8c2vvnnckbd269saslr7adv6rdavr5rv0z5vh2m1lgglxj15";
  };

  nativeBuildInputs = [ bison flex ];
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@ -41,6 +41,7 @@ let
        (whenAtLeast "5.2" yes)
      ];
      DEBUG_INFO_BTF            = whenAtLeast "5.2" (option yes);
+      BPF_LSM                   = whenAtLeast "5.7" (option yes);
      DEBUG_KERNEL              = yes;
      DEBUG_DEVRES              = no;
      DYNAMIC_DEBUG             = yes;
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@ -9,14 +9,14 @@ with lib;

 stdenv.mkDerivation rec {
  pname = "libselinux";
-  version = "3.0";
-  inherit (libsepol) se_release se_url;
+  version = "3.3";
+  inherit (libsepol) se_url;

  outputs = [ "bin" "out" "dev" "man" ] ++ optional enablePython "py";

  src = fetchurl {
-    url = "${se_url}/${se_release}/libselinux-${version}.tar.gz";
-    sha256 = "0cr4p0qkr4qd5z1x677vwhz6mlz55kxyijwi2dmrvbhxcw7v78if";
+    url = "${se_url}/${version}/libselinux-${version}.tar.gz";
+    sha256 = "0mvh793g7fg6wb6zqhkdyrv80x6k84ypqwi8ii89c91xcckyxzdc";
  };

  nativeBuildInputs = [ pkg-config ] ++ optionals enablePython [ swig python3 ];
--- a/pkgs/os-specific/linux/libsemanage/default.nix
+++ b/pkgs/os-specific/linux/libsemanage/default.nix
@ -6,12 +6,12 @@ with lib;

 stdenv.mkDerivation rec {
  pname = "libsemanage";
-  version = "2.9";
-  inherit (libsepol) se_release se_url;
+  version = "3.3";
+  inherit (libsepol) se_url;

  src = fetchurl {
-    url = "${se_url}/${se_release}/libsemanage-${version}.tar.gz";
-    sha256 = "075w6y3l9hiy5hicgwrmijyxmhfyd1r7cnc08qxyg4j46jfk8xi5";
+    url = "${se_url}/${version}/libsemanage-${version}.tar.gz";
+    sha256 = "1s3wb66l47blc15s6lkqs11j9l8pycdqqbb03x3vpfrlz9dfrl44";
   };

  outputs = [ "out" "dev" "man" ] ++ optional enablePython "py";
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@ -2,31 +2,16 @@

 stdenv.mkDerivation rec {
  pname = "libsepol";
-  version = "3.0";
-  se_release = "20191204";
+  version = "3.3";
  se_url = "https://github.com/SELinuxProject/selinux/releases/download";

  outputs = [ "bin" "out" "dev" "man" ];

  src = fetchurl {
-    url = "${se_url}/${se_release}/libsepol-${version}.tar.gz";
-    sha256 = "0ygb6dh5lng91xs6xiqf5v0nxa68qmjc787p0s5h9w89364f2yjv";
+    url = "${se_url}/${version}/libsepol-${version}.tar.gz";
+    sha256 = "12r39ygn7aa1kz52wibfr4520m0cp75hlrn3i6rnjqa6p0zdz5rd";
  };

-  patches = [
-    # upstream build fix against -fno-common compilers like >=gcc-10
-    (fetchpatch {
-      url = "https://github.com/SELinuxProject/selinux/commit/a96e8c59ecac84096d870b42701a504791a8cc8c.patch";
-      sha256 = "0aybv4kzbhx8xq6s82dsh4ib76k59qzh2bgxmk44iq5cjnqn5rd6";
-      stripLen = 1;
-    })
-    (fetchpatch {
-      url = "https://github.com/SELinuxProject/selinux/commit/3d32fc24d6aff360a538c63dad08ca5c957551b0.patch";
-      sha256 = "1mphwdlj4d6mwmsp5xkpf6ci4rxhgbi3fm79d08h4jbzxaf4wny4";
-      stripLen = 1;
-    })
-  ];
-
  postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
    substituteInPlace src/Makefile --replace 'all: $(LIBA) $(LIBSO)' 'all: $(LIBA)'
    sed -i $'/^\t.*LIBSO/d' src/Makefile
@ -46,7 +31,7 @@ stdenv.mkDerivation rec {

  NIX_CFLAGS_COMPILE = "-Wno-error";

-  passthru = { inherit se_release se_url; };
+  passthru = { inherit se_url; };

  meta = with lib; {
    description = "SELinux binary policy manipulation library";
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@ -10,12 +10,12 @@
 with lib;

 stdenv.mkDerivation rec {
-  version = "1.0.0";
+  version = "1.0.1";
  pname = "nftables";

  src = fetchurl {
    url = "https://netfilter.org/projects/nftables/files/${pname}-${version}.tar.bz2";
-    sha256 = "1x25zs2czmn14mmq1nqi4zibsvh04vqjbx5lxj42nylnmxym9gsq";
+    sha256 = "08x4xw0s5sap3q7jfr91v7mrkxrydi4dvsckw85ims0qb1ibmviw";
  };

  nativeBuildInputs = [
@ -35,6 +35,7 @@ stdenv.mkDerivation rec {

  configureFlags = [
    "--with-json"
+    "--with-cli=readline"  # TODO: maybe switch to editline
  ] ++ optional (!withDebugSymbols) "--disable-debug"
    ++ optional (!withPython) "--disable-python"
    ++ optional withPython "--enable-python"
@ -45,6 +46,6 @@ stdenv.mkDerivation rec {
    homepage = "https://netfilter.org/projects/nftables/";
    license = licenses.gpl2Only;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ izorkin ];
+    maintainers = with maintainers; [ izorkin ajs124 ];
  };
 }
--- a/pkgs/os-specific/linux/policycoreutils/default.nix
+++ b/pkgs/os-specific/linux/policycoreutils/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "policycoreutils";
-  version = "2.9";
-  inherit (libsepol) se_release se_url;
+  version = "3.3";
+  inherit (libsepol) se_url;

  src = fetchurl {
-    url = "${se_url}/${se_release}/policycoreutils-${version}.tar.gz";
-    sha256 = "0yqg5ws5gbl1cbn8msxdk1c3ilmmx58qg5dx883kqyq0517k8g65";
+    url = "${se_url}/${version}/policycoreutils-${version}.tar.gz";
+    sha256 = "0y0hl32b2ks7r0fhbx3k2j1gqqms5aplyasjs3fz50caxl6096a1";
  };

  postPatch = ''
@ -24,7 +24,7 @@ stdenv.mkDerivation rec {

  makeFlags = [
    "PREFIX=$(out)"
-    "SBINDIR=$(out)/sbin"
+    "SBINDIR=$(out)/bin"
    "ETCDIR=$(out)/etc"
    "BASHCOMPLETIONDIR=$out/share/bash-completion/completions"
    "LOCALEDIR=$(out)/share/locale"
--- a/pkgs/os-specific/linux/selinux-python/default.nix
+++ b/pkgs/os-specific/linux/selinux-python/default.nix
@ -7,13 +7,13 @@ with lib;

 stdenv.mkDerivation rec {
  pname = "selinux-python";
-  version = "2.9";
+  version = "3.3";

-  inherit (libsepol) se_release se_url;
+  inherit (libsepol) se_url;

  src = fetchurl {
-    url = "${se_url}/${se_release}/selinux-python-${version}.tar.gz";
-    sha256 = "1pjzsyay5535cxcjag7y7k193ajry0s0xc3dqv5905qd7cwval1n";
+    url = "${se_url}/${version}/selinux-python-${version}.tar.gz";
+    sha256 = "1v244hpb45my303793xa4kcn7qnxjgxn4ja7rdn9k1q361hi1nca";
  };

  strictDeps = true;
@ -49,4 +49,3 @@ stdenv.mkDerivation rec {
    platforms = platforms.linux;
  };
 }
-
--- a/pkgs/os-specific/linux/selinux-sandbox/default.nix
+++ b/pkgs/os-specific/linux/selinux-sandbox/default.nix
@ -9,12 +9,12 @@ with python3.pkgs;

 stdenv.mkDerivation rec {
  pname = "selinux-sandbox";
-  version = "2.9";
-  inherit (policycoreutils) se_release se_url;
+  version = "3.3";
+  inherit (policycoreutils) se_url;

  src = fetchurl {
-    url = "${se_url}/${se_release}/selinux-sandbox-${version}.tar.gz";
-    sha256 = "0qj20jyi8v1653xdqj5yak3wwbvg5bw8f2jmx8fpahl6y1bmz481";
+    url = "${se_url}/${version}/selinux-sandbox-${version}.tar.gz";
+    sha256 = "0rw8pxfqhl6ww4w31fbf4hi3zilh1n3b1rfjm7ra76mm78wfyylj";
  };

  nativeBuildInputs = [ wrapPython ];
--- a/pkgs/os-specific/linux/semodule-utils/default.nix
+++ b/pkgs/os-specific/linux/semodule-utils/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "semodule-utils";
-  version = "2.9";
+  version = "3.3";

-  inherit (libsepol) se_release se_url;
+  inherit (libsepol) se_url;

  src = fetchurl {
-    url = "${se_url}/${se_release}/${pname}-${version}.tar.gz";
-    sha256 = "01yrwnd3calmw6r8kdh8ld7i7fb250n2yqqqk9p0ymrlwsg6g0w0";
+    url = "${se_url}/${version}/${pname}-${version}.tar.gz";
+    sha256 = "0qvhl40a6jlm8p719nnlw2ghlxbh8lxbcsd59azxp884bxgfr61h";
  };

  buildInputs = [ libsepol ];
--- a/pkgs/os-specific/linux/sepolgen/default.nix
+++ b/pkgs/os-specific/linux/sepolgen/default.nix
@ -1,24 +0,0 @@
-{ lib, stdenv, fetchurl, libsepol, python }:
-
-stdenv.mkDerivation rec {
-  pname = "sepolgen";
-  version = "1.2.2";
-  inherit (libsepol) se_release se_url;
-
-  src = fetchurl {
-    url = "${se_url}/${se_release}/sepolgen-${version}.tar.gz";
-    sha256 = "09139kspr41zgksayi4dh982p8080lrfl96p4dld51nknbpaigdy";
-  };
-
-  preBuild = ''
-    makeFlagsArray+=("PREFIX=$out")
-    makeFlagsArray+=("DESTDIR=$out")
-    makeFlagsArray+=("PYTHONLIBDIR=lib/${python.libPrefix}/site-packages")
-  '';
-
-  meta = with lib; {
-    inherit (libsepol.meta) homepage platforms maintainers;
-    description = "SELinux policy generation library";
-    license = licenses.gpl2;
-  };
-}
--- a/pkgs/os-specific/linux/service-wrapper/service-wrapper.sh
+++ b/pkgs/os-specific/linux/service-wrapper/service-wrapper.sh
@ -33,12 +33,12 @@


 is_ignored_file() {
-	case "$1" in
-		skeleton | README | *.dpkg-dist | *.dpkg-old | rc | rcS | single | reboot | bootclean.sh)
-			return 0
-		;;
-	esac
-	return 1
+    case "$1" in
+        skeleton | README | *.dpkg-dist | *.dpkg-old | rc | rcS | single | reboot | bootclean.sh)
+            return 0
+        ;;
+    esac
+    return 1
 }

 VERSION=$(@coreutils@/bin/basename $0)" ver. 19-04"
@ -75,35 +75,35 @@ while [ $# -gt 0 ]; do
       if [ -z "${SERVICE}" -a $# -eq 1 -a "${1}" = "--status-all" ]; then
          if [ -d "${SERVICEDIR}" ]; then
             cd ${SERVICEDIR}
-	     for SERVICE in * ; do
-	       case "${SERVICE}" in
-	         functions | halt | killall | single| linuxconf| kudzu)
-	             ;;
-	         *)
-	           if ! is_ignored_file "${SERVICE}" \
-	   	    && [ -x "${SERVICEDIR}/${SERVICE}" ]; then
-	                   out=$(env -i LANG="$LANG" LANGUAGE="$LANGUAGE" LC_CTYPE="$LC_CTYPE" LC_NUMERIC="$LC_NUMERIC" LC_TIME="$LC_TIME" LC_COLLATE="$LC_COLLATE" LC_MONETARY="$LC_MONETARY" LC_MESSAGES="$LC_MESSAGES" LC_PAPER="$LC_PAPER" LC_NAME="$LC_NAME" LC_ADDRESS="$LC_ADDRESS" LC_TELEPHONE="$LC_TELEPHONE" LC_MEASUREMENT="$LC_MEASUREMENT" LC_IDENTIFICATION="$LC_IDENTIFICATION" LC_ALL="$LC_ALL" PATH="$PATH" TERM="$TERM" "$SERVICEDIR/$SERVICE" status 2>&1)
-	                   retval=$?
-	                   if echo "$out" | egrep -iq "usage:"; then
-	                     #printf " %s %-60s %s\n" "[?]" "$SERVICE:" "unknown" 1>&2
-	                     echo " [ ? ]  $SERVICE" 1>&2
-	                     continue
-	                   else
-	                     if [ "$retval" = "0" -a -n "$out" ]; then
-	                       #printf " %s %-60s %s\n" "[+]" "$SERVICE:" "running"
-	                       echo " [ + ]  $SERVICE"
-	                       continue
-	                     else
-	                       #printf " %s %-60s %s\n" "[-]" "$SERVICE:" "NOT running"
-	                       echo " [ - ]  $SERVICE"
-	                       continue
-	                     fi
-	                   fi
-	             #env -i LANG="$LANG" LANGUAGE="$LANGUAGE" LC_CTYPE="$LC_CTYPE" LC_NUMERIC="$LC_NUMERIC" LC_TIME="$LC_TIME" LC_COLLATE="$LC_COLLATE" LC_MONETARY="$LC_MONETARY" LC_MESSAGES="$LC_MESSAGES" LC_PAPER="$LC_PAPER" LC_NAME="$LC_NAME" LC_ADDRESS="$LC_ADDRESS" LC_TELEPHONE="$LC_TELEPHONE" LC_MEASUREMENT="$LC_MEASUREMENT" LC_IDENTIFICATION="$LC_IDENTIFICATION" LC_ALL="$LC_ALL" PATH="$PATH" TERM="$TERM" "$SERVICEDIR/$SERVICE" status
-	           fi
-	           ;;
-	       esac
-	     done
+         for SERVICE in * ; do
+           case "${SERVICE}" in
+             functions | halt | killall | single| linuxconf| kudzu)
+                 ;;
+             *)
+               if ! is_ignored_file "${SERVICE}" \
+               && [ -x "${SERVICEDIR}/${SERVICE}" ]; then
+                       out=$(env -i LANG="$LANG" LANGUAGE="$LANGUAGE" LC_CTYPE="$LC_CTYPE" LC_NUMERIC="$LC_NUMERIC" LC_TIME="$LC_TIME" LC_COLLATE="$LC_COLLATE" LC_MONETARY="$LC_MONETARY" LC_MESSAGES="$LC_MESSAGES" LC_PAPER="$LC_PAPER" LC_NAME="$LC_NAME" LC_ADDRESS="$LC_ADDRESS" LC_TELEPHONE="$LC_TELEPHONE" LC_MEASUREMENT="$LC_MEASUREMENT" LC_IDENTIFICATION="$LC_IDENTIFICATION" LC_ALL="$LC_ALL" PATH="$PATH" TERM="$TERM" "$SERVICEDIR/$SERVICE" status 2>&1)
+                       retval=$?
+                       if echo "$out" | egrep -iq "usage:"; then
+                         #printf " %s %-60s %s\n" "[?]" "$SERVICE:" "unknown" 1>&2
+                         echo " [ ? ]  $SERVICE" 1>&2
+                         continue
+                       else
+                         if [ "$retval" = "0" -a -n "$out" ]; then
+                           #printf " %s %-60s %s\n" "[+]" "$SERVICE:" "running"
+                           echo " [ + ]  $SERVICE"
+                           continue
+                         else
+                           #printf " %s %-60s %s\n" "[-]" "$SERVICE:" "NOT running"
+                           echo " [ - ]  $SERVICE"
+                           continue
+                         fi
+                       fi
+                 #env -i LANG="$LANG" LANGUAGE="$LANGUAGE" LC_CTYPE="$LC_CTYPE" LC_NUMERIC="$LC_NUMERIC" LC_TIME="$LC_TIME" LC_COLLATE="$LC_COLLATE" LC_MONETARY="$LC_MONETARY" LC_MESSAGES="$LC_MESSAGES" LC_PAPER="$LC_PAPER" LC_NAME="$LC_NAME" LC_ADDRESS="$LC_ADDRESS" LC_TELEPHONE="$LC_TELEPHONE" LC_MEASUREMENT="$LC_MEASUREMENT" LC_IDENTIFICATION="$LC_IDENTIFICATION" LC_ALL="$LC_ALL" PATH="$PATH" TERM="$TERM" "$SERVICEDIR/$SERVICE" status
+               fi
+               ;;
+           esac
+         done
          else
             systemctl $sctl_args list-units
          fi
--- a/pkgs/os-specific/linux/setools/default.nix
+++ b/pkgs/os-specific/linux/setools/default.nix
@ -1,6 +1,5 @@
 { lib, fetchFromGitHub, python3
 , libsepol, libselinux, checkpolicy
-, fetchpatch
 , withGraphics ? false
 }:

@ -9,22 +8,15 @@ with python3.pkgs;

 buildPythonApplication rec {
  pname = "setools";
-  version = "4.3.0";
+  version = "4.4.0";

  src = fetchFromGitHub {
    owner = "SELinuxProject";
    repo = pname;
    rev = version;
-    sha256 = "0vr20bi8w147z5lclqz1l0j1b34137zg2r04pkafkgqqk7qbyjk6";
+    sha256 = "1qvd5j6zwq4fmlahg45swjplhif2z89x7s6pnp07gvcp2fbqdsh5";
  };

-  patches = [
-    (fetchpatch { # included in 4.4.0
-      url = "https://github.com/SELinuxProject/setools/commit/f1b4a5d375be05fbccedb258c940d771bff8e524.diff";
-      sha256 = "1r38s6i4i6bdr2zdp5wcg1yifpf3pd018c73a511mgynyg7d11xy";
-    })
-  ];
-
  nativeBuildInputs = [ cython ];
  buildInputs = [ libsepol ];
  propagatedBuildInputs = [ enum34 libselinux networkx ]
--- a/pkgs/servers/sql/mariadb/connector-c/default.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/default.nix
@ -52,6 +52,7 @@ stdenv.mkDerivation {
    ln -sv mariadb $dev/include/mysql
    ln -sv mariadb_version.h $dev/include/mariadb/mysql_version.h
    ln -sv libmariadb.pc $dev/lib/pkgconfig/mysqlclient.pc
+    install -Dm644 include/ma_config.h $dev/include/mariadb/my_config.h
  '';

  meta = {
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@ -201,18 +201,18 @@ let
 in self: {

  postgresql_9_6 = self.callPackage generic {
-    version = "9.6.23";
+    version = "9.6.24";
    psqlSchema = "9.6";
-    sha256 = "1fa735lrmv2vrfiixg73nh024gxlagcbrssklvgwdf0s82cgfjd8";
+    sha256 = "sha256-rrehlr4+vtGnR271ZfOXIhh8EI3UfadIm+nE/K6YKs4=";
    this = self.postgresql_9_6;
    thisAttr = "postgresql_9_6";
    inherit self;
  };

  postgresql_10 = self.callPackage generic {
-    version = "10.18";
+    version = "10.19";
    psqlSchema = "10.0"; # should be 10, but changing it is invasive
-    sha256 = "009qpb02bq0rx0aaw5ck70gk07xwparhfxvlfimgihw2vhp7qisp";
+    sha256 = "sha256-brgwtCi2DoSuh+IENrzmecTZ0CAr567A5BsMZ9kTQjk=";
    this = self.postgresql_10;
    thisAttr = "postgresql_10";
    inherit self;
@ -220,36 +220,36 @@ in self: {
  };

  postgresql_11 = self.callPackage generic {
-    version = "11.13";
+    version = "11.14";
    psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    sha256 = "0j5wnscnxa3sx8d39s55654df8aikmvkihfb0a02hrgmyygnihx0";
+    sha256 = "sha256-llx/S+lvtk+VgYUsWMTwXDgS1K2CPA8+K9/nd8Fi+Zk=";
    this = self.postgresql_11;
    thisAttr = "postgresql_11";
    inherit self;
  };

  postgresql_12 = self.callPackage generic {
-    version = "12.8";
+    version = "12.9";
    psqlSchema = "12";
-    sha256 = "0an6v5bsp26d276wbdx76lsq6cq86hgi2fmkzwawnk63j3h02r72";
+    sha256 = "sha256-if2i3jPtBKmFSOQ/PuXxW4gr4XUF1jH+DdGlQKK1bc4=";
    this = self.postgresql_12;
    thisAttr = "postgresql_12";
    inherit self;
  };

  postgresql_13 = self.callPackage generic {
-    version = "13.4";
+    version = "13.5";
    psqlSchema = "13";
-    sha256 = "1kf0gcsrl5n25rjlvkh87aywmn28kbwvakm5c7j1qpr4j01y34za";
+    sha256 = "sha256-m4EGelXtuqvEGKrO9FfdhHdkKCdJlWCwBhWm6mwT9rM=";
    this = self.postgresql_13;
    thisAttr = "postgresql_13";
    inherit self;
  };

  postgresql_14 = self.callPackage generic {
-    version = "14.0";
+    version = "14.1";
    psqlSchema = "14";
-    sha256 = "08m14zcrcvc2i0xl10p0wgzycsmfmk27gny40a8mwdx74s8xfapf";
+    sha256 = "sha256-TTwQHqeuOJgvBr3HN1i1Nyf7ZALs2TggBvpezHwspB8=";
    this = self.postgresql_14;
    thisAttr = "postgresql_14";
    inherit self;
--- a/pkgs/shells/bash/bash-5.1-patches.nix
+++ b/pkgs/shells/bash/bash-5.1-patches.nix
@ -9,4 +9,8 @@ patch: [
 (patch "006" "051x8wlwrqk0yr0zg378vh824iklfl5g9pkmcdf62qp8gn9pvqbm")
 (patch "007" "0fir80pp1gmlpadmqcgkrv4y119pc7xllchjzg05fd7px73viz5c")
 (patch "008" "1lfjgshk8i9vch92p5wgc9r90j3phw79aa7gbai89w183b2z6b7j")
+(patch "009" "1vn36dzd9g4y1h3jiss6418crla0rbcd0d6wwsyv9d5l7aaxlp74")
+(patch "010" "0amfmvbzsand7bdypylkjdpcp88fa3cplfshn7vyzv2ff2rdgj52")
+(patch "011" "0yq24abb4fzfxqnwl20b330sxl9lr9ds0nc4yi30f81l94b1y6aq")
+(patch "012" "165bff97ffih49vfs4mkr5w3z5gn1w6zfyrf773iajkw6v48kw8h")
 ]
--- a/pkgs/tools/graphics/zxing/zxing.sh
+++ b/pkgs/tools/graphics/zxing/zxing.sh
@ -2,17 +2,17 @@
 choice="$1";
 shift
 case "$choice" in
-	encode | create | write | CommandLineEncoder)
-		zxing-cmdline-encoder "$@";
-		;;
-	decode | read | run | CommandLineRunner)
-		zxing-cmdline-runner "$@";
-		;;
-	help | usage | --help | --usage | -h)
-		zxing read;
-		zxing write;
-		;;
-	*)
-		zxing read "$choice" "$@"
-		;;
+    encode | create | write | CommandLineEncoder)
+        zxing-cmdline-encoder "$@";
+        ;;
+    decode | read | run | CommandLineRunner)
+        zxing-cmdline-runner "$@";
+        ;;
+    help | usage | --help | --usage | -h)
+        zxing read;
+        zxing write;
+        ;;
+    *)
+        zxing read "$choice" "$@"
+        ;;
 esac
--- a/pkgs/tools/misc/grub/grub1.patches.sh
+++ b/pkgs/tools/misc/grub/grub1.patches.sh
@ -13,39 +13,39 @@ set -u

 # https://salsa.debian.org/grub-team/grub-legacy/tree/master/debian/patches
 SERIES=(
-	snapshot.patch
-	menu.lst_gnu-hurd.patch
-	graphics.patch
-	raid.patch
-	raid_cciss.patch
-	xfs_freeze.patch
-	2gb_limit.patch
-	grub-special_device_names.patch
-	grub-xvd_drives.patch
-	initrd_max_address.patch
-	splashimage_help.patch
-	grub-install_addsyncs.patch
-	grub-install_regexp.patch
-	grub-install_aoe_support.patch
-	grub-install_xvd.patch
-	geometry-26kernel.patch
-	print_func.patch
-	mprotect.patch
-	savedefault.patch
-	find-grub-dir.patch
-	intelmac.patch
-	crossreference_manpages.patch
-	ext3_256byte_inode.patch
+    snapshot.patch
+    menu.lst_gnu-hurd.patch
+    graphics.patch
+    raid.patch
+    raid_cciss.patch
+    xfs_freeze.patch
+    2gb_limit.patch
+    grub-special_device_names.patch
+    grub-xvd_drives.patch
+    initrd_max_address.patch
+    splashimage_help.patch
+    grub-install_addsyncs.patch
+    grub-install_regexp.patch
+    grub-install_aoe_support.patch
+    grub-install_xvd.patch
+    geometry-26kernel.patch
+    print_func.patch
+    mprotect.patch
+    savedefault.patch
+    find-grub-dir.patch
+    intelmac.patch
+    crossreference_manpages.patch
+    ext3_256byte_inode.patch
    # Breaks on NixOS.
-	#use_grub-probe_in_grub-install.patch
-	objcopy-absolute.patch
-	no-reorder-functions.patch
+    #use_grub-probe_in_grub-install.patch
+    objcopy-absolute.patch
+    no-reorder-functions.patch

-	# We aren't building amd64 binaries, see #244498
-	#fix_amd64_compile.patch
-	modern-automake.patch
-	no-combine-stack-adjustments.patch
-	no-pie.patch
+    # We aren't building amd64 binaries, see #244498
+    #fix_amd64_compile.patch
+    modern-automake.patch
+    no-combine-stack-adjustments.patch
+    no-pie.patch
 )

 # Revision mapping to current tip of the 0.97-73 branch.
@ -63,8 +63,8 @@ in
 EOF

 for PATCH in "${SERIES[@]}"; do
-	URL="$prefix/$PATCH"
-	HASH="$(nix-prefetch-url "$URL")"
-	echo "{ url = \"\${prefix}/$PATCH\"; sha256 = \"$HASH\"; }" >> "$FILE"
+    URL="$prefix/$PATCH"
+    HASH="$(nix-prefetch-url "$URL")"
+    echo "{ url = \"\${prefix}/$PATCH\"; sha256 = \"$HASH\"; }" >> "$FILE"
 done
 echo "]" >> "$FILE"
--- a/pkgs/tools/security/rhash/default.nix
+++ b/pkgs/tools/security/rhash/default.nix
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-HkDgWwHoRWCNtWyfP4sj3veEd+KT5J7yL4J4Z/hJcrE=";
  };

-  patches = lib.optionals stdenv.cc.isClang [
+  patches = [
    # Fix clang configuration; remove with next release
    (fetchpatch {
      url = "https://github.com/rhash/RHash/commit/4dc506066cf1727b021e6352535a8bb315c3f8dc.patch";
--- a/pkgs/tools/text/source-highlight/default.nix
+++ b/pkgs/tools/text/source-highlight/default.nix
@ -18,6 +18,13 @@ stdenv.mkDerivation rec {
      sha256 = "1wnj0jmkmrwjww7qk9dvfxh8h06jdn7mi8v2fvwh95b6x87z5l47";
      excludes = [ "ChangeLog" ];
    })
+
+    # Upstream fix for clang-13 and gcc-12 test support
+    (fetchpatch {
+      name = "gcc-12.patch";
+      url = "http://git.savannah.gnu.org/cgit/src-highlite.git/patch/?id=ab9fe5cb9b85c5afab94f2a7f4b6d7d473c14ee9";
+      sha256 = "1v33zd2766k7cdgmajw2lffw9wd7v4f8z01f40z53f6bp608nr62";
+    })
  ];

  # source-highlight uses it's own binary to generate documentation.
@ -35,7 +42,7 @@ stdenv.mkDerivation rec {
    "--with-bash-completion=${placeholder "out"}/share/bash_completion.d"
  ];

-  doCheck = !stdenv.cc.isClang;
+  doCheck = true;

  enableParallelBuilding = true;
  # Upstream uses the same intermediate files in multiple tests, running
--- a/pkgs/tools/typesetting/lout/builder.sh
+++ b/pkgs/tools/typesetting/lout/builder.sh
@ -15,28 +15,28 @@ installDoc ()
    echo "building \`$doc' document..."
    if [ ! -f "doc/$doc/outfile.ps" ]
    then
-      ( PATH="$PWD:$PATH" ;				\
-        cd "doc/$doc" && lout -r4 -o outfile.ps all )	\
+      ( PATH="$PWD:$PATH" ; \
+        cd "doc/$doc" && lout -r4 -o outfile.ps all ) \
      || return 1
    fi
-    cp "doc/$doc/outfile.ps" "$out/doc/lout/$doc.ps" &&		\
-    ps2pdf -dPDFSETTINGS=/prepress -sPAPERSIZE=a4		\
+    cp "doc/$doc/outfile.ps" "$out/doc/lout/$doc.ps" && \
+    ps2pdf -dPDFSETTINGS=/prepress -sPAPERSIZE=a4 \
           "doc/$doc/outfile.ps" "$out/doc/lout/$doc.pdf"
  done

  return 0
 }

-unpackPhase &&									\
-cd lout-*.* &&									\
-cat makefile |									\
-  sed -e "s|^PREFIX[[:blank:]]*=.*\$|PREFIX = $out|g ;				\
-          s|^LOUTLIBDIR[[:blank:]]*=.*$|LOUTLIBDIR = \$(PREFIX)/lib/lout|g ;	\
-	  s|^LOUTDOCDIR[[:blank:]]*=.*$|LOUTDOCDIR = \$(PREFIX)/doc/lout|g ;	\
-	  s|^MANDIR[[:blank:]]*=.*$|MANDIR = \$(PREFIX)/man|g"			\
-  > "$nixMakefile" &&								\
-mkdir -p "$out/bin" && mkdir -p "$out/lib"					\
-mkdir -p "$out/man" && mkdir -p "$out/doc/lout" &&				\
-make -f "$nixMakefile" CC=cc install installman &&					\
-installDoc &&									\
+unpackPhase && \
+cd lout-*.* && \
+cat makefile | \
+  sed -e "s|^PREFIX[[:blank:]]*=.*\$|PREFIX = $out|g ; \
+    s|^LOUTLIBDIR[[:blank:]]*=.*$|LOUTLIBDIR = \$(PREFIX)/lib/lout|g ; \
+    s|^LOUTDOCDIR[[:blank:]]*=.*$|LOUTDOCDIR = \$(PREFIX)/doc/lout|g ; \
+    s|^MANDIR[[:blank:]]*=.*$|MANDIR = \$(PREFIX)/man|g" \
+  > "$nixMakefile" && \
+mkdir -p "$out/bin" && mkdir -p "$out/lib" \
+mkdir -p "$out/man" && mkdir -p "$out/doc/lout" && \
+make -f "$nixMakefile" CC=cc install installman && \
+installDoc && \
 fixupPhase
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -834,6 +834,7 @@ mapAliases ({
  sdlmame = mame; # added 2019-10-30
  seeks = throw "seeks has been removed from nixpkgs, as it was unmaintained"; # added 2020-06-21
  seg3d = throw "seg3d has been removed from nixpkgs (2019-11-10)";
+  sepolgen = throw "sepolgen was merged into selinux-python"; # added 2021-11-11
  shared_mime_info = shared-mime-info; # added 2018-02-25
  skrooge2 = skrooge; # added 2017-02-18
  sky = throw "sky has been removed from nixpkgs (2020-09-16)";
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -22621,8 +22621,6 @@ with pkgs;

  sdrangel = libsForQt5.callPackage ../applications/radio/sdrangel {  };

-  sepolgen = callPackage ../os-specific/linux/sepolgen { };
-
  setools = callPackage ../os-specific/linux/setools { };

  seturgent = callPackage ../os-specific/linux/seturgent { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -9592,6 +9592,8 @@ in {

  types-toml = callPackage ../development/python-modules/types-toml { };

+  types-typed-ast = callPackage ../development/python-modules/types-typed-ast { };
+
  typesentry = callPackage ../development/python-modules/typesentry { };

  typesystem = callPackage ../development/python-modules/typesystem { };