Merge pull request #147092 from NixOS/staging-next

staging-next: 2021-11-22
author: Jonathan Ringer <jonringer@users.noreply.github.com> 2021-12-02 16:04:32 -0800
committer: GitHub <noreply@github.com> 2021-12-02 16:04:32 -0800
commit: 571cbf3d1db477058303cef8754fb85a14e90eb7 (patch)
tree: 4e27750e24b51b0308574496b6f28200faaece1d
parent: 3bf91048f85654c6dec62bbbf4e79a85beda3bb0 (diff)
parent: 987163192b0991a76c413693f7040d01460cd5e4 (diff)
download: nixpkgs-571cbf3d1db477058303cef8754fb85a14e90eb7.tar
nixpkgs-571cbf3d1db477058303cef8754fb85a14e90eb7.tar.gz
nixpkgs-571cbf3d1db477058303cef8754fb85a14e90eb7.tar.bz2
nixpkgs-571cbf3d1db477058303cef8754fb85a14e90eb7.tar.lz
nixpkgs-571cbf3d1db477058303cef8754fb85a14e90eb7.tar.xz
nixpkgs-571cbf3d1db477058303cef8754fb85a14e90eb7.tar.zst
nixpkgs-571cbf3d1db477058303cef8754fb85a14e90eb7.zip
86 files changed, 772 insertions, 579 deletions
diff --git a/maintainers/scripts/vanity.sh b/maintainers/scripts/vanity.sh
index aa7d4ec967d..b879488165d 100755
--- a/maintainers/scripts/vanity.sh
+++ b/maintainers/scripts/vanity.sh
@@ -30,7 +30,7 @@ fetchGithubName () {
         curl https://github.com/NixOS/nixpkgs/commit/"$commitid" 2>/dev/null |
         grep committed -B10 | grep 'href="/' |
         sed -re 's@.* href="/@@; s@".*@@' |
-	grep -v "/commit/"
+        grep -v "/commit/"
     )";
     echo "$userid"
 }
@@ -38,7 +38,7 @@ fetchGithubName () {
 [ -n "$NIXPKGS_GITHUB_NAME_CACHE" ] && {
     echo "$emails" | while read email; do
         line="$(grep "$email	" "$NIXPKGS_GITHUB_NAME_CACHE")"
-	[ -z "$line" ] && {
+        [ -z "$line" ] && {
             echo "$email	$(fetchGithubName "$email")" >> \
                 "$NIXPKGS_GITHUB_NAME_CACHE"
         }
@@ -47,11 +47,11 @@ fetchGithubName () {
 
 # For RDF
 normalize_name () {
-	sed -e 's/%/%25/g; s/ /%20/g; s/'\''/%27/g; s/"/%22/g; s/`/%60/g; s/\^/%5e/g; '
+    sed -e 's/%/%25/g; s/ /%20/g; s/'\''/%27/g; s/"/%22/g; s/`/%60/g; s/\^/%5e/g; '
 }
 
 denormalize_name () {
-	sed -e 's/%20/ /g; s/%27/'\''/g; s/%22/"/g; s/%60/`/g; s/%5e/^/g; s/%25/%/g;';
+    sed -e 's/%20/ /g; s/%27/'\''/g; s/%22/"/g; s/%60/`/g; s/%5e/^/g; s/%25/%/g;';
 }
 
 n3="$(mktemp --suffix .n3)"
@@ -75,22 +75,22 @@ echo "$maintainers" | cut -f 2 | sed -e 's@.*@<my://name/&>	<my://is-name>	<my:/
 # Get transitive closure
 sparql="$(nix-build '<nixpkgs>' -Q -A apache-jena --no-out-link)/bin/sparql"
 name_list="$(
-	"$sparql" --results=TSV --data="$n3" "
-	select ?x ?y ?g where {
-	  ?x <my://can-be>+ ?y.
-	  ?x <my://is-name> ?g.
+    "$sparql" --results=TSV --data="$n3" "
+    select ?x ?y ?g where {
+      ?x <my://can-be>+ ?y.
+      ?x <my://is-name> ?g.
         }
-	" | tail -n +2 |
-	sed -re 's@<my://name/@@g; s@<my://@@g; s@>@@g;' |
-	sort -k 2,3 -t '	'
+    " | tail -n +2 |
+    sed -re 's@<my://name/@@g; s@<my://@@g; s@>@@g;' |
+    sort -k 2,3 -t '	'
 )"
 github_name_list="$(
-	"$sparql" --results=TSV --data="$n3" "
-	select ?x ?y where {
-	  ?x (<my://can-be>+ / <my://at-github>) ?y.
+    "$sparql" --results=TSV --data="$n3" "
+    select ?x ?y where {
+      ?x (<my://can-be>+ / <my://at-github>) ?y.
         }
-	" | tail -n +2 |
-	sed -re 's@<my://(name|github)/@@g; s@<my://@@g; s@>@@g;'
+    " | tail -n +2 |
+    sed -re 's@<my://(name|github)/@@g; s@<my://@@g; s@>@@g;'
 )"
 
 # Take first spelling option for every person
@@ -104,10 +104,10 @@ if [ -n "$NIXPKGS_GITHUB_NAME_CACHE" ]; then
     github_adder_script="$(mktemp)"
     echo "$github_name_list" |
         grep -E "$(echo "$name_list_canonical" | cut -f 2 |
-	    tr '\n' '|' )" |
-	sort | uniq |
+        tr '\n' '|' )" |
+    sort | uniq |
         sed -re 's/(.*)\t(.*)/s| \1$| \1\t\2|g;/' |
-	denormalize_name > "$github_adder_script"
+    denormalize_name > "$github_adder_script"
 else
     github_adder_script='/dev/null'
 fi
diff --git a/nixos/tests/custom-ca.nix b/nixos/tests/custom-ca.nix
index 0ab49f3b343..a55449a397a 100644
--- a/nixos/tests/custom-ca.nix
+++ b/nixos/tests/custom-ca.nix
@@ -82,6 +82,9 @@ in
       # chromium-based browsers refuse to run as root
       test-support.displayManager.auto.user = "alice";
 
+      # browsers may hang with the default memory
+      virtualisation.memorySize = 600;
+
       networking.hosts."127.0.0.1" = [ "good.example.com" "bad.example.com" ];
       security.pki.certificateFiles = [ "${example-good-cert}/ca.crt" ];
 
@@ -160,7 +163,7 @@ in
         browser = command.split()[0]
         with subtest("Good certificate is trusted in " + browser):
             execute_as(
-                "alice", f"env P11_KIT_DEBUG=trust {command} https://good.example.com & >&2"
+                "alice", f"{command} https://good.example.com >&2 &"
             )
             wait_for_window_as("alice", browser)
             machine.wait_for_text("It works!")
@@ -168,9 +171,9 @@ in
             execute_as("alice", "xdotool key ctrl+w")  # close tab
 
         with subtest("Unknown CA is untrusted in " + browser):
-            execute_as("alice", f"{command} https://bad.example.com & >&2")
+            execute_as("alice", f"{command} https://bad.example.com >&2 &")
             machine.wait_for_text(error)
             machine.screenshot("bad" + browser)
-            machine.succeed("pkill " + browser)
+            machine.succeed("pkill -f " + browser)
   '';
 })
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 61d5225621b..634d82a6045 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -25,7 +25,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.33.1";
+  version = "2.34.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "sha256-4FSm5sKwiL0b/19h7ZulqpHJo81QlTmktBxd3wIgHy8=";
+    sha256 = "07s1c9lzlm4kpbb5lmxy0869phg7037pv4faz5hlqyb5csrbjv7x";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
diff --git a/pkgs/build-support/fetchmtn/builder.sh b/pkgs/build-support/fetchmtn/builder.sh
index c1b0db895bc..73eff9c2725 100644
--- a/pkgs/build-support/fetchmtn/builder.sh
+++ b/pkgs/build-support/fetchmtn/builder.sh
@@ -2,33 +2,33 @@ source $stdenv/setup
 
 set -x
 
-if ! [ -f "$cacheDB" ]; then 
-	echo "Creating cache DB $cacheDB"
-	mtn --db "$cacheDB" db init
+if ! [ -f "$cacheDB" ]; then
+    echo "Creating cache DB $cacheDB"
+    mtn --db "$cacheDB" db init
 fi
 
 header "getting revision $selector";
 
 done=;
 for source in $dbs; do
-	if mtn pull --db "$cacheDB" "$source" "${branch}"; then
-		revision="$(mtn --db "$cacheDB" au toposort $(mtn --db "$cacheDB" au select "$selector") | tail -1)";
-		if [ -n "$revision" ]; then
-			if mtn --db "$cacheDB" au get_revision "$revision"; then
-				echo "found revision $revision"
-				done=1;
-			else
-				echo "revision $revision does not exist";
-			fi
-		else
-			echo "selector $selector does not match any revision";
-		fi
-	else
-		echo "pulling branch $branch wasn't successful";
-	fi;
-	if test -n "$done"; then
-		break;
-	fi;
+    if mtn pull --db "$cacheDB" "$source" "${branch}"; then
+        revision="$(mtn --db "$cacheDB" au toposort $(mtn --db "$cacheDB" au select "$selector") | tail -1)";
+        if [ -n "$revision" ]; then
+            if mtn --db "$cacheDB" au get_revision "$revision"; then
+                echo "found revision $revision"
+                done=1;
+            else
+                echo "revision $revision does not exist";
+            fi
+        else
+            echo "selector $selector does not match any revision";
+        fi
+    else
+        echo "pulling branch $branch wasn't successful";
+    fi;
+    if test -n "$done"; then
+        break;
+    fi;
 done;
 
 stopNest;
@@ -36,10 +36,10 @@ stopNest;
 header "checking out the revision $revision";
 
 if test -n "$done"; then
-	mtn checkout --db "$cacheDB" -r "$revision" "$out" -b "${branch}"
+    mtn checkout --db "$cacheDB" -r "$revision" "$out" -b "${branch}"
 else
-	echo "Needed revision still not found. Exiting";
-	exit 1;
+    echo "Needed revision still not found. Exiting";
+    exit 1;
 fi;
 
 stopNest
diff --git a/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh b/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
index f7c7429eb0b..a5a44271668 100644
--- a/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
+++ b/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
@@ -13,9 +13,9 @@ if [ -z "${NIX_PKG_CONFIG_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
 fi
 
 if (( ${#role_suffixes[@]} > 0 )); then
-	# replace env var with nix-modified one
+    # replace env var with nix-modified one
     PKG_CONFIG_PATH=$PKG_CONFIG_PATH_@suffixSalt@ exec @prog@ "$@"
 else
-	# pkg-config isn't a bonafied dependency so ignore setup hook entirely
-	exec @prog@ "$@"
+    # pkg-config isn't a bonafied dependency so ignore setup hook entirely
+    exec @prog@ "$@"
 fi
diff --git a/pkgs/build-support/setup-hooks/shorten-perl-shebang.sh b/pkgs/build-support/setup-hooks/shorten-perl-shebang.sh
index 4bf7c0ff1af..825da1bde96 100644
--- a/pkgs/build-support/setup-hooks/shorten-perl-shebang.sh
+++ b/pkgs/build-support/setup-hooks/shorten-perl-shebang.sh
@@ -71,9 +71,9 @@ _shortenPerlShebang() {
             print
         }
     ' "$program" > "$temp" || die
-	# Preserve the mode of the original file
-	cp --preserve=mode --attributes-only "$program" "$temp"
-	mv "$temp" "$program"
+    # Preserve the mode of the original file
+    cp --preserve=mode --attributes-only "$program" "$temp"
+    mv "$temp" "$program"
 
     # Measure the new shebang line length and make sure it's okay. We subtract
     # one to account for the trailing newline that "head" included in its
diff --git a/pkgs/data/fonts/iosevka/update-bin.sh b/pkgs/data/fonts/iosevka/update-bin.sh
index a402f152d8a..68f93f1f26e 100755
--- a/pkgs/data/fonts/iosevka/update-bin.sh
+++ b/pkgs/data/fonts/iosevka/update-bin.sh
@@ -10,19 +10,19 @@ oldVersion=$(nix-instantiate --eval -E 'with import ../../../.. {}; lib.getVersi
 version=$(echo "$release" | jq -r .tag_name | tr -d v)
 
 if test "$oldVersion" = "$version"; then
-	echo "New version same as old version, nothing to do." >&2
-	exit 0
+    echo "New version same as old version, nothing to do." >&2
+    exit 0
 fi
 
 sed -i "s/$oldVersion/$version/" bin.nix
 
 {
-	echo '# This file was autogenerated. DO NOT EDIT!'
-	echo '{'
-	for asset in $(echo "$release" | jq -r '.assets[].name | select(startswith("ttc"))'); do
-		printf '  %s = "%s";\n' \
-			$(echo "$asset" | sed -r "s/^ttc-(.*)-$version.zip$/\1/") \
-			$(nix-prefetch-url "https://github.com/be5invis/Iosevka/releases/download/v$version/$asset")
-	done
-	echo '}'
+    echo '# This file was autogenerated. DO NOT EDIT!'
+    echo '{'
+    for asset in $(echo "$release" | jq -r '.assets[].name | select(startswith("ttc"))'); do
+        printf '  %s = "%s";\n' \
+            $(echo "$asset" | sed -r "s/^ttc-(.*)-$version.zip$/\1/") \
+            $(nix-prefetch-url "https://github.com/be5invis/Iosevka/releases/download/v$version/$asset")
+    done
+    echo '}'
 } >variants.nix
diff --git a/pkgs/data/misc/geolite-legacy/builder.sh b/pkgs/data/misc/geolite-legacy/builder.sh
index 683b2e8606b..0bb61d863ec 100644
--- a/pkgs/data/misc/geolite-legacy/builder.sh
+++ b/pkgs/data/misc/geolite-legacy/builder.sh
@@ -5,13 +5,13 @@ cd $out/share/GeoIP
 
 # Iterate over all environment variable names beginning with "src":
 for var in "${!src@}"; do
-	# Store the value of the variable with name $var in $src:
-	eval src="\$$var"
+    # Store the value of the variable with name $var in $src:
+    eval src="\$$var"
 
-	# Copy $src to current directory, removing Nix hash from the filename:
-	dest="${src##*/}"
-	dest="${dest#*-}"
-	cp "$src" "$dest"
+    # Copy $src to current directory, removing Nix hash from the filename:
+    dest="${src##*/}"
+    dest="${dest#*-}"
+    cp "$src" "$dest"
 done
 
 gzip -dv *.gz
diff --git a/pkgs/desktops/gnome-2/platform/ORBit2/default.nix b/pkgs/desktops/gnome-2/platform/ORBit2/default.nix
index ab76e0c64fd..bf5ae4ebbb1 100644
--- a/pkgs/desktops/gnome-2/platform/ORBit2/default.nix
+++ b/pkgs/desktops/gnome-2/platform/ORBit2/default.nix
@@ -22,8 +22,16 @@ stdenv.mkDerivation rec {
     moveToOutput "bin/orbit2-config" "$dev"
   '';
 
+  # Parallel build fails due to missing internal library dependency:
+  #    libtool --tag=CC   --mode=link gcc ... -o orbit-name-server-2 ...
+  #    ld: cannot find libname-server-2.a: No such file or directory
+  # It happens because orbit-name-server-2 should have libname-server-2.a
+  # in _DEPENDENCIES but does not. Instead of fixing it and regenerating
+  # Makefile.in let's just disable parallel build.
+  enableParallelBuilding = false;
+
   meta = with lib; {
-    homepage    = "https://projects.gnome.org/ORBit2/";
+    homepage    = "https://developer-old.gnome.org/ORBit2/";
     description = "A CORBA 2.4-compliant Object Request Broker";
     platforms   = platforms.unix;
     maintainers = with maintainers; [ lovek323 ];
diff --git a/pkgs/desktops/gnustep/make/builder.sh b/pkgs/desktops/gnustep/make/builder.sh
index 66afe1271ca..39bd7703828 100644
--- a/pkgs/desktops/gnustep/make/builder.sh
+++ b/pkgs/desktops/gnustep/make/builder.sh
@@ -30,92 +30,92 @@ postInstall() {
     # add the current package to the paths
     local tmp="$out/lib/GNUstep/Applications"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_APPS" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_APPS "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_APPS "$tmp"
     fi
     tmp="$out/lib/GNUstep/Applications"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_ADMIN_APPS" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_APPS "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_APPS "$tmp"
     fi
     tmp="$out/lib/GNUstep/WebApplications"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_WEB_APPS" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_WEB_APPS "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_WEB_APPS "$tmp"
     fi
     tmp="$out/bin"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_TOOLS" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_TOOLS "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_TOOLS "$tmp"
     fi
     tmp="$out/sbin"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS "$tmp"
     fi
     tmp="$out/lib/GNUstep"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_LIBRARY" in *"${tmp}"*) false;; *) true;; esac; then
-    	addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARY "$tmp"
+            addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARY "$tmp"
     fi
     tmp="$out/include"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_HEADERS" in *"${tmp}"*) false;; *) true;; esac; then
-    	if [ -z "$NIX_GNUSTEP_SYSTEM_HEADERS" ]; then
-    	    export NIX_GNUSTEP_SYSTEM_HEADERS="$tmp"
-    	else
-    	    export NIX_GNUSTEP_SYSTEM_HEADERS+=" $tmp"
-    	fi
+            if [ -z "$NIX_GNUSTEP_SYSTEM_HEADERS" ]; then
+                export NIX_GNUSTEP_SYSTEM_HEADERS="$tmp"
+            else
+                export NIX_GNUSTEP_SYSTEM_HEADERS+=" $tmp"
+            fi
     fi
     tmp="$out/lib"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_LIBRARIES" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARIES "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARIES "$tmp"
     fi
     tmp="$out/share/GNUstep/Documentation"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_DOC" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_DOC "$tmp"
     fi
     tmp="$out/share/man"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_DOC_MAN" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_MAN "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_MAN "$tmp"
     fi
     tmp="$out/share/info"
     if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_DOC_INFO" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_INFO "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_INFO "$tmp"
     fi
-    
+
     # write the config file
     echo GNUSTEP_MAKEFILES=$GNUSTEP_MAKEFILES >> $conf
     if [ -n "$NIX_GNUSTEP_SYSTEM_APPS" ]; then
-	echo NIX_GNUSTEP_SYSTEM_APPS="$NIX_GNUSTEP_SYSTEM_APPS"
+        echo NIX_GNUSTEP_SYSTEM_APPS="$NIX_GNUSTEP_SYSTEM_APPS"
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_ADMIN_APPS" ]; then
-	echo NIX_GNUSTEP_SYSTEM_ADMIN_APPS="$NIX_GNUSTEP_SYSTEM_ADMIN_APPS" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_ADMIN_APPS="$NIX_GNUSTEP_SYSTEM_ADMIN_APPS" >> $conf
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_WEB_APPS" ]; then
-	echo NIX_GNUSTEP_SYSTEM_WEB_APPS="$NIX_GNUSTEP_SYSTEM_WEB_APPS" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_WEB_APPS="$NIX_GNUSTEP_SYSTEM_WEB_APPS" >> $conf
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_TOOLS" ]; then
-	echo NIX_GNUSTEP_SYSTEM_TOOLS="$NIX_GNUSTEP_SYSTEM_TOOLS" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_TOOLS="$NIX_GNUSTEP_SYSTEM_TOOLS" >> $conf
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS" ]; then
-	echo NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS="$NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS="$NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS" >> $conf
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_LIBRARY" ]; then
-	echo NIX_GNUSTEP_SYSTEM_LIBRARY="$NIX_GNUSTEP_SYSTEM_LIBRARY" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_LIBRARY="$NIX_GNUSTEP_SYSTEM_LIBRARY" >> $conf
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_HEADERS" ]; then
-	echo NIX_GNUSTEP_SYSTEM_HEADERS="$NIX_GNUSTEP_SYSTEM_HEADERS" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_HEADERS="$NIX_GNUSTEP_SYSTEM_HEADERS" >> $conf
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_LIBRARIES" ]; then
-	echo NIX_GNUSTEP_SYSTEM_LIBRARIES="$NIX_GNUSTEP_SYSTEM_LIBRARIES" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_LIBRARIES="$NIX_GNUSTEP_SYSTEM_LIBRARIES" >> $conf
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_DOC" ]; then
-	echo NIX_GNUSTEP_SYSTEM_DOC="$NIX_GNUSTEP_SYSTEM_DOC" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_DOC="$NIX_GNUSTEP_SYSTEM_DOC" >> $conf
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_DOC_MAN" ]; then
-	echo NIX_GNUSTEP_SYSTEM_DOC_MAN="$NIX_GNUSTEP_SYSTEM_DOC_MAN" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_DOC_MAN="$NIX_GNUSTEP_SYSTEM_DOC_MAN" >> $conf
     fi
     if [ -n "$NIX_GNUSTEP_SYSTEM_DOC_INFO" ]; then
-	echo NIX_GNUSTEP_SYSTEM_DOC_INFO="$NIX_GNUSTEP_SYSTEM_DOC_INFO" >> $conf
+        echo NIX_GNUSTEP_SYSTEM_DOC_INFO="$NIX_GNUSTEP_SYSTEM_DOC_INFO" >> $conf
     fi
-    
+
     for i in $out/bin/*; do
-	echo "wrapping $(basename $i)"
-	wrapGSMake "$i" "$out/share/.GNUstep.conf"
+        echo "wrapping $(basename $i)"
+        wrapGSMake "$i" "$out/share/.GNUstep.conf"
     done
 }
 
diff --git a/pkgs/desktops/gnustep/make/setup-hook.sh b/pkgs/desktops/gnustep/make/setup-hook.sh
index b2b90f1e522..177a381100a 100644
--- a/pkgs/desktops/gnustep/make/setup-hook.sh
+++ b/pkgs/desktops/gnustep/make/setup-hook.sh
@@ -20,58 +20,58 @@ addEnvVars() {
     local filename
 
     for filename in $1/share/GNUstep/Makefiles/Additional/*.make ; do
-	if case "${NIX_GNUSTEP_MAKEFILES_ADDITIONAL-}" in *"{$filename}"*) false;; *) true;; esac; then
-	    export NIX_GNUSTEP_MAKEFILES_ADDITIONAL+=" $filename"
-	fi
+    if case "${NIX_GNUSTEP_MAKEFILES_ADDITIONAL-}" in *"{$filename}"*) false;; *) true;; esac; then
+        export NIX_GNUSTEP_MAKEFILES_ADDITIONAL+=" $filename"
+    fi
     done
 
     local tmp="$1/lib/GNUstep/Applications"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_APPS-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_APPS "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_APPS "$tmp"
     fi
     tmp="$1/lib/GNUstep/Applications"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_ADMIN_APPS-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_APPS "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_APPS "$tmp"
     fi
     tmp="$1/lib/GNUstep/WebApplications"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_WEB_APPS-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_WEB_APPS "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_WEB_APPS "$tmp"
     fi
     tmp="$1/bin"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_TOOLS-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_TOOLS "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_TOOLS "$tmp"
     fi
     tmp="$1/sbin"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS "$tmp"
     fi
     tmp="$1/lib/GNUstep"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_LIBRARY-}" in *"${tmp}"*) false;; *) true;; esac; then
-    	addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARY "$tmp"
+        addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARY "$tmp"
     fi
     tmp="$1/include"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_HEADERS-}" in *"${tmp}"*) false;; *) true;; esac; then
-    	if [ -z "${NIX_GNUSTEP_SYSTEM_HEADERS-}" ]; then
-    	    export NIX_GNUSTEP_SYSTEM_HEADERS="$tmp"
-    	else
-    	    export NIX_GNUSTEP_SYSTEM_HEADERS+=" $tmp"
-    	fi
+        if [ -z "${NIX_GNUSTEP_SYSTEM_HEADERS-}" ]; then
+            export NIX_GNUSTEP_SYSTEM_HEADERS="$tmp"
+        else
+            export NIX_GNUSTEP_SYSTEM_HEADERS+=" $tmp"
+        fi
     fi
     tmp="$1/lib"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_LIBRARIES-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARIES "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARIES "$tmp"
     fi
     tmp="$1/share/GNUstep/Documentation"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_DOC-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_DOC "$tmp"
     fi
     tmp="$1/share/man"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_DOC_MAN-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_MAN "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_MAN "$tmp"
     fi
     tmp="$1/share/info"
     if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_DOC_INFO-}" in *"${tmp}"*) false;; *) true;; esac; then
-	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_INFO "$tmp"
+    addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_INFO "$tmp"
     fi
 }
 addEnvHooks "$targetOffset" addEnvVars
diff --git a/pkgs/development/compilers/go/1.16.nix b/pkgs/development/compilers/go/1.16.nix
index ed5ea00c4b9..dad133337e8 100644
--- a/pkgs/development/compilers/go/1.16.nix
+++ b/pkgs/development/compilers/go/1.16.nix
@@ -51,11 +51,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.16.9";
+  version = "1.16.10";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "sha256-ChzH/XvSBEj3Hr7WTYRhOIUNUJmxjPXMEKT8RRYNjD0=";
+    sha256 = "sha256-qQVHIBFYXkA9ANKkHefO0puIhDCdc0gqMH9on9DzILU=";
   };
 
   # perl is used for testing go vet
diff --git a/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh b/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh
index 4604b1fdea7..68ba3ed3a92 100644
--- a/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh
+++ b/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh
@@ -8,43 +8,43 @@ function extract
 
     case "$1" in
         *.tar.xz)
-	    xz -dc $1 | tar "$tarflags" - ;;
-	*)
-	    printf "Make sure you give a iPhoneOS9.2.sdk.tar.xz file \n" ;;
+        xz -dc $1 | tar "$tarflags" - ;;
+    *)
+        printf "Make sure you give a iPhoneOS9.2.sdk.tar.xz file \n" ;;
     esac
 }
 
 function verify_arch {
     case "$1" in
-	# Our good arches.
-	armv7|arm64) ;;
-	*)
-	    local
-	    acc="armv7 | arm64"
-	    error_message=$(
-		printf '%s is not an acceptable arch. Try one of %s' "$1" "$acc"
-			 )
-	    printf "$error_message\n"
-	    exit
+    # Our good arches.
+    armv7|arm64) ;;
+    *)
+        local
+        acc="armv7 | arm64"
+        error_message=$(
+        printf '%s is not an acceptable arch. Try one of %s' "$1" "$acc"
+             )
+        printf "$error_message\n"
+        exit
     esac
 }
 
 function verify_sdk_version {
     sdk_version=$(basename "$1" | grep -P -o "[0-9].[0-9]+")
     case "$sdk_version" in
-	# Make sure the SDK is correct.
-	[5-9].[0-9]) ;;
-	*)
-	    printf 'No iPhone SDK version in file name\n'
+    # Make sure the SDK is correct.
+    [5-9].[0-9]) ;;
+    *)
+        printf 'No iPhone SDK version in file name\n'
     esac
 }
 
 function do_build {
 
     if [ $# -lt 2 ]; then
-	printf "usage: $0 iPhoneOS.sdk.tar* <target cpu>\n" 1>&2
-	printf "i.e. $0 /path/to/iPhoneOS.sdk.tar.xz armv7\n" 1>&2
-	exit 1
+    printf "usage: $0 iPhoneOS.sdk.tar* <target cpu>\n" 1>&2
+    printf "i.e. $0 /path/to/iPhoneOS.sdk.tar.xz armv7\n" 1>&2
+    exit 1
     fi
 
     mkdir -p $out
@@ -54,7 +54,7 @@ function do_build {
     pushd "$cctools_port"/usage_examples/ios_toolchain &> /dev/null
 
     export LC_ALL=C
-    
+
     local
     triple='%s-apple-darwin11'
     target_dir="$PWD/target"
@@ -75,12 +75,12 @@ function do_build {
     extract "$1"
 
     local sys_lib=$(
-    	find $sdk_dir -name libSystem.dylib -o -name libSystem.tbd | head -n1
-    	  )
+        find $sdk_dir -name libSystem.dylib -o -name libSystem.tbd | head -n1
+          )
 
     if [ -z "$sys_lib" ]; then
-    	printf "SDK should contain libSystem{.dylib,.tbd}\n" 1>&2
-    	exit 1
+        printf "SDK should contain libSystem{.dylib,.tbd}\n" 1>&2
+        exit 1
     fi
 
     local sys_root=$(readlink -f "$(dirname $sys_lib)/../..")
@@ -96,18 +96,18 @@ function do_build {
     printf "int main(){return 0;}" | clang -xc -O2 -o "$target_dir"/bin/dsymutil -
 
     clang -O2 -std=c99 $alt_wrapper \
-    	  -DTARGET_CPU=$(printf '"%s"' "$2") \
-    	  -DNIX_APPLE_HDRS=$(
-    	printf '"%s"' "-I$out/$sdk/usr/include"
-    	  ) \
-    	  -DNIX_APPLE_FRAMEWORKS=$(
-    	printf '"%s"' "$out/$sdk/System/Library/Frameworks"
-    	  ) \
-    	  -DNIX_APPLE_PRIV_FRAMEWORKS=$(
-    	printf '"%s"' "$out/$sdk/System/Library/PrivateFrameworks"
-    	  ) \
-    	  -DOS_VER_MIN=$(printf '"%s"' "7.1") \
-    	  -o "$target_dir/bin/$triple-clang"
+          -DTARGET_CPU=$(printf '"%s"' "$2") \
+          -DNIX_APPLE_HDRS=$(
+        printf '"%s"' "-I$out/$sdk/usr/include"
+          ) \
+          -DNIX_APPLE_FRAMEWORKS=$(
+        printf '"%s"' "$out/$sdk/System/Library/Frameworks"
+          ) \
+          -DNIX_APPLE_PRIV_FRAMEWORKS=$(
+        printf '"%s"' "$out/$sdk/System/Library/PrivateFrameworks"
+          ) \
+          -DOS_VER_MIN=$(printf '"%s"' "7.1") \
+          -o "$target_dir/bin/$triple-clang"
 
     pushd "$target_dir"/bin &>/dev/null
 
@@ -141,8 +141,8 @@ function do_build {
     local me=`whoami`
 
     for d in bin libexec SDK; do
-    	chown -R $me:$me target/$d
-    	cp -R target/$d $out
+        chown -R $me:$me target/$d
+        cp -R target/$d $out
     done
 
     # Crucial piece
diff --git a/pkgs/development/compilers/llvm/10/llvm/default.nix b/pkgs/development/compilers/llvm/10/llvm/default.nix
index 4e590dba433..30a2d016d67 100644
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@@ -73,6 +73,20 @@ in stdenv.mkDerivation (rec {
       sha256 = "0nh123kld0dgz2h941lng331dkj3wbm5lfxm375k1f569gv83hlk";
       stripLen = 1;
     })
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
+    (fetchpatch {
+      name = "dfaemitter-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/0841916e87a39e3c223c986e8da31e4a9a1432e3.patch";
+      sha256 = "1kckghvsngs51mqm82asy0s9vr19h8aqbw43a0w44mccqw6bzrwf";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/11/llvm/default.nix b/pkgs/development/compilers/llvm/11/llvm/default.nix
index f0148850dbe..81ac4cb1ed0 100644
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@@ -65,6 +65,26 @@ in stdenv.mkDerivation (rec {
       sha256 = "sha256:12s8vr6ibri8b48h2z38f3afhwam10arfiqfy4yg37bmc054p5hi";
       stripLen = 1;
     })
+    # gcc-11 compat upstream patch
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/b498303066a63a203d24f739b2d2e0e56dca70d1.patch";
+      sha256 = "sha256:0nh123kld0dgz2h941lng331dkj3wbm5lfxm375k1f569gv83hlk";
+      stripLen = 1;
+    })
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
+    (fetchpatch {
+      name = "dfaemitter-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/0841916e87a39e3c223c986e8da31e4a9a1432e3.patch";
+      sha256 = "1kckghvsngs51mqm82asy0s9vr19h8aqbw43a0w44mccqw6bzrwf";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/13/clang/default.nix b/pkgs/development/compilers/llvm/13/clang/default.nix
index 78c2831a2f3..a775af3031b 100644
--- a/pkgs/development/compilers/llvm/13/clang/default.nix
+++ b/pkgs/development/compilers/llvm/13/clang/default.nix
@@ -44,6 +44,8 @@ let
     ];
 
     postPatch = ''
+      (cd tools && ln -s ../../clang-tools-extra extra)
+
       sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
              -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
              lib/Driver/ToolChains/*.cpp
diff --git a/pkgs/development/compilers/llvm/5/llvm/default.nix b/pkgs/development/compilers/llvm/5/llvm/default.nix
index 6388cd65fbf..fa99e275a62 100644
--- a/pkgs/development/compilers/llvm/5/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/5/llvm/default.nix
@@ -66,6 +66,14 @@ stdenv.mkDerivation ({
     #  stripLen = 1;
     #})
     ./gnu-install-dirs.patch
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/6/llvm/default.nix b/pkgs/development/compilers/llvm/6/llvm/default.nix
index 0907c895617..5925fab104f 100644
--- a/pkgs/development/compilers/llvm/6/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/6/llvm/default.nix
@@ -64,6 +64,14 @@ stdenv.mkDerivation ({
       sha256 = "0fxgrxmfnjx17w3lcq19rk68b2xksh1bynz3ina784kma7hp4wdb";
     })
     ./gnu-install-dirs.patch
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/7/llvm/default.nix b/pkgs/development/compilers/llvm/7/llvm/default.nix
index 4a9b4f51820..e4410bedf91 100644
--- a/pkgs/development/compilers/llvm/7/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/7/llvm/default.nix
@@ -68,6 +68,14 @@ in stdenv.mkDerivation ({
       sha256 = "0k6k1p5yisgwx417a67s7sr9930rqh1n0zv5jvply8vjjy4b3kf8";
     })
     ./gnu-install-dirs.patch
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/8/llvm/default.nix b/pkgs/development/compilers/llvm/8/llvm/default.nix
index 83b779b56d8..8bb2293f818 100644
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@@ -71,6 +71,14 @@ in stdenv.mkDerivation ({
       sha256 = "0nh123kld0dgz2h941lng331dkj3wbm5lfxm375k1f569gv83hlk";
       stripLen = 1;
     })
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/9/llvm/default.nix b/pkgs/development/compilers/llvm/9/llvm/default.nix
index 570795824ee..f8c474775e4 100644
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@@ -69,6 +69,14 @@ in stdenv.mkDerivation (rec {
       sha256 = "0nh123kld0dgz2h941lng331dkj3wbm5lfxm375k1f569gv83hlk";
       stripLen = 1;
     })
+
+    # Fix invalid std::string(nullptr) for GCC 12
+    (fetchpatch {
+      name = "nvptx-gcc-12.patch";
+      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
+      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/git/clang/default.nix b/pkgs/development/compilers/llvm/git/clang/default.nix
index 78c2831a2f3..a775af3031b 100644
--- a/pkgs/development/compilers/llvm/git/clang/default.nix
+++ b/pkgs/development/compilers/llvm/git/clang/default.nix
@@ -44,6 +44,8 @@ let
     ];
 
     postPatch = ''
+      (cd tools && ln -s ../../clang-tools-extra extra)
+
       sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
              -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
              lib/Driver/ToolChains/*.cpp
diff --git a/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh b/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
index bdfd00009dc..ecf9793b91f 100644
--- a/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
+++ b/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
@@ -1,16 +1,16 @@
 findGdkPixbufLoaders() {
 
-	# choose the longest loaders.cache
-	local loadersCache="$1/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"
-	if [[ -f "$loadersCache" ]]; then
-		if [[ -f "${GDK_PIXBUF_MODULE_FILE-}" ]]; then
-			if (( "$(cat "$loadersCache" | wc -l)" > "$(cat "$GDK_PIXBUF_MODULE_FILE" | wc -l)" )); then
-				export GDK_PIXBUF_MODULE_FILE="$loadersCache"
-			fi
-		else
-			export GDK_PIXBUF_MODULE_FILE="$loadersCache"
-		fi
-	fi
+    # choose the longest loaders.cache
+    local loadersCache="$1/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"
+    if [[ -f "$loadersCache" ]]; then
+        if [[ -f "${GDK_PIXBUF_MODULE_FILE-}" ]]; then
+            if (( "$(cat "$loadersCache" | wc -l)" > "$(cat "$GDK_PIXBUF_MODULE_FILE" | wc -l)" )); then
+                export GDK_PIXBUF_MODULE_FILE="$loadersCache"
+            fi
+        else
+            export GDK_PIXBUF_MODULE_FILE="$loadersCache"
+        fi
+    fi
 
 }
 
diff --git a/pkgs/development/libraries/gmp/4.3.2.nix b/pkgs/development/libraries/gmp/4.3.2.nix
index ce870581f5e..50e26b4c132 100644
--- a/pkgs/development/libraries/gmp/4.3.2.nix
+++ b/pkgs/development/libraries/gmp/4.3.2.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, m4, cxx ? true }:
 
 let self = stdenv.mkDerivation rec {
-  name = "gmp-4.3.2";
+  pname = "gmp";
+  version = "4.3.2";
 
   src = fetchurl {
-    url = "mirror://gnu/gmp/${name}.tar.bz2";
+    url = "mirror://gnu/gmp/gmp-${version}.tar.bz2";
     sha256 = "0x8prpqi9amfcmi7r4zrza609ai9529pjaq0h4aw51i867064qck";
   };
 
diff --git a/pkgs/development/libraries/gmp/5.1.x.nix b/pkgs/development/libraries/gmp/5.1.x.nix
index ea6a7ee4231..aa3704eb0b5 100644
--- a/pkgs/development/libraries/gmp/5.1.x.nix
+++ b/pkgs/development/libraries/gmp/5.1.x.nix
@@ -6,10 +6,11 @@
 let inherit (lib) optional; in
 
 let self = stdenv.mkDerivation rec {
-  name = "gmp-5.1.3";
+  pname = "gmp";
+  version = "5.1.3";
 
   src = fetchurl { # we need to use bz2, others aren't in bootstrapping stdenv
-    urls = [ "mirror://gnu/gmp/${name}.tar.bz2" "ftp://ftp.gmplib.org/pub/${name}/${name}.tar.bz2" ];
+    urls = [ "mirror://gnu/gmp/gmp-${version}.tar.bz2" "ftp://ftp.gmplib.org/pub/gmp-${version}/gmp-${version}.tar.bz2" ];
     sha256 = "0q5i39pxrasgn9qdxzpfbwhh11ph80p57x6hf48m74261d97j83m";
   };
 
diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index 6228b6aaab9..59bc98aa559 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -12,10 +12,11 @@
 let inherit (lib) optional; in
 
 let self = stdenv.mkDerivation rec {
-  name = "gmp-6.2.1";
+  pname = "gmp";
+  version = "6.2.1";
 
   src = fetchurl { # we need to use bz2, others aren't in bootstrapping stdenv
-    urls = [ "mirror://gnu/gmp/${name}.tar.bz2" "ftp://ftp.gmplib.org/pub/${name}/${name}.tar.bz2" ];
+    urls = [ "mirror://gnu/gmp/gmp-${version}.tar.bz2" "ftp://ftp.gmplib.org/pub/gmp-${version}/gmp-${version}.tar.bz2" ];
     sha256 = "0z2ddfiwgi0xbf65z4fg4hqqzlhv0cc6hdcswf3c6n21xdmk5sga";
   };
 
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index ace18afdeed..0d39abe1ac3 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -51,8 +51,10 @@ stdenv.mkDerivation rec {
 
   preConfigure = "patchShebangs .";
   configureFlags =
-    lib.optional stdenv.isLinux "--with-default-trust-store-file=/etc/ssl/certs/ca-certificates.crt"
-  ++ [
+    lib.optionals stdenv.isLinux [
+    "--with-default-trust-store-file=/etc/ssl/certs/ca-certificates.crt"
+    "--with-default-trust-store-pkcs11=pkcs11:"
+  ] ++ [
     "--disable-dependency-tracking"
     "--enable-fast-install"
     "--with-unbound-root-key-file=${dns-root-data}/root.key"
diff --git a/pkgs/development/libraries/libnetfilter_log/default.nix b/pkgs/development/libraries/libnetfilter_log/default.nix
index 4ac20cf29cb..aadc3d92b59 100644
--- a/pkgs/development/libraries/libnetfilter_log/default.nix
+++ b/pkgs/development/libraries/libnetfilter_log/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libnetfilter_log";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/libnetfilter_log/files/${pname}-${version}.tar.bz2";
-    sha256 = "089vjcfxl5qjqpswrbgklf4wflh44irmw6sk2k0kmfixfmszxq3l";
+    sha256 = "1spy9xs41v76kid5ana8n126f3mvgq6fjibbfbj4kn0larbhix73";
   };
 
   buildInputs = [ libmnl ];
diff --git a/pkgs/development/libraries/libnftnl/default.nix b/pkgs/development/libraries/libnftnl/default.nix
index 276ee52ed54..2c351181ee2 100644
--- a/pkgs/development/libraries/libnftnl/default.nix
+++ b/pkgs/development/libraries/libnftnl/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, pkg-config, libmnl }:
 
 stdenv.mkDerivation rec {
-  version = "1.2.0";
+  version = "1.2.1";
   pname = "libnftnl";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
-    sha256 = "1xblq1cbcxhr6qmjpy98i1qdza148idgz99vbhjc7s4vzvfizc4h";
+    sha256 = "0z4khm2mnys9mcl8ckwf19cw20jgrv8650nfncy3xcgs2k2aa23m";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -17,6 +17,6 @@ stdenv.mkDerivation rec {
     homepage = "http://netfilter.org/projects/libnftnl";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [ fpletz ajs124 ];
   };
 }
diff --git a/pkgs/development/libraries/libuninameslist/default.nix b/pkgs/development/libraries/libuninameslist/default.nix
index 90ea1947cb5..cd615ed81fe 100644
--- a/pkgs/development/libraries/libuninameslist/default.nix
+++ b/pkgs/development/libraries/libuninameslist/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libuninameslist";
-  version = "20210917";
+  version = "20211114";
 
   src = fetchFromGitHub {
     owner = "fontforge";
     repo = pname;
     rev = version;
-    sha256 = "sha256-bwMgNK3DhhWjijush27265Q1UoZOw7T17fKsaR6IV14=";
+    sha256 = "sha256-izxG2mx+D83s78eL19ERUaLrw9FPjlJRcFZw3+xzLDQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 05935e65ea0..a5d41d48629 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -33,7 +33,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "21.2.5";
+  version = "21.2.6";
   branch  = versions.major version;
 
 self = stdenv.mkDerivation {
@@ -47,7 +47,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "1fxcdf4qs4vmyjcns7jv62w4jy3gr383ar5b7mr77nb0nxgmhjcf";
+    sha256 = "0m69h3f9fr66h6xjxfc485zfdci6kl8j24ab0kx5k23f7kcj4zhy";
   };
 
   # TODO:
diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index 4ddc01ee6b2..34a3788d786 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -31,7 +31,11 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"
-    "--with-trust-paths=/etc/ssl/trust-source:/etc/ssl/certs/ca-certificates.crt"
+    "--with-trust-paths=${lib.concatStringsSep ":" [
+      "/etc/ssl/trust-source"               # p11-kit trust source
+      "/etc/ssl/certs/ca-certificates.crt"  # NixOS + Debian/Ubuntu/Arch/Gentoo...
+      "/etc/pki/tls/certs/ca-bundle.crt"    # Fedora/CentOS
+    ]}"
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/physics/lhapdf/maintainer.sh b/pkgs/development/libraries/physics/lhapdf/maintainer.sh
index 92c225f90cc..6e263dcebfd 100755
--- a/pkgs/development/libraries/physics/lhapdf/maintainer.sh
+++ b/pkgs/development/libraries/physics/lhapdf/maintainer.sh
@@ -7,7 +7,7 @@ set -xe
 BASE_URL="https://lhapdfsets.web.cern.ch/lhapdfsets/current/"
 
 for pdf_set in `curl -L $BASE_URL 2>/dev/null | "$SED" -e "s/.*<a href=\"\([^\"/]*.tar.gz\)\".*/\1/;tx;d;:x" | sort -u`; do
-	echo -n "    \"${pdf_set%.tar.gz}\" = \""
-	nix-prefetch-url "${BASE_URL}${pdf_set}" 2>/dev/null | tr -d '\n'
-	echo "\";"
+    echo -n "    \"${pdf_set%.tar.gz}\" = \""
+    nix-prefetch-url "${BASE_URL}${pdf_set}" 2>/dev/null | tr -d '\n'
+    echo "\";"
 done
diff --git a/pkgs/development/libraries/slib/setup-hook.sh b/pkgs/development/libraries/slib/setup-hook.sh
index 3c7e91e8188..e820d80e7a4 100644
--- a/pkgs/development/libraries/slib/setup-hook.sh
+++ b/pkgs/development/libraries/slib/setup-hook.sh
@@ -1,12 +1,12 @@
 addSlibPath () {
     if test -f "$1/lib/slib/slibcat"
     then
-	export SCHEME_LIBRARY_PATH="$1/lib/slib/"
-	echo "SLIB found in \`$1'; setting \$SCHEME_LIBRARY_PATH to \`$SCHEME_LIBRARY_PATH'"
+        export SCHEME_LIBRARY_PATH="$1/lib/slib/"
+        echo "SLIB found in \`$1'; setting \$SCHEME_LIBRARY_PATH to \`$SCHEME_LIBRARY_PATH'"
 
-	# This is needed so that `(load-from-path "slib/guile.init")' works.
-	export GUILE_LOAD_PATH="$1/lib:$GUILE_LOAD_PATH"
-	echo "SLIB: setting \$GUILE_LOAD_PATH to \`$GUILE_LOAD_PATH'"
+        # This is needed so that `(load-from-path "slib/guile.init")' works.
+        export GUILE_LOAD_PATH="$1/lib:$GUILE_LOAD_PATH"
+        echo "SLIB: setting \$GUILE_LOAD_PATH to \`$GUILE_LOAD_PATH'"
     fi
 }
 
diff --git a/pkgs/development/lisp-modules/clwrapper/cl-wrapper.sh b/pkgs/development/lisp-modules/clwrapper/cl-wrapper.sh
index 828920c5acc..d6fec46b449 100755
--- a/pkgs/development/lisp-modules/clwrapper/cl-wrapper.sh
+++ b/pkgs/development/lisp-modules/clwrapper/cl-wrapper.sh
@@ -18,59 +18,59 @@ fi
 export NIX_LISP NIX_LISP_LOAD_FILE NIX_LISP_EXEC_CODE NIX_LISP_COMMAND NIX_LISP_FINAL_PARAMETERS
 
 test -n "$NIX_LISP_LD_LIBRARY_PATH" &&
-	export LD_LIBRARY_PATH="$LD_LIBRARY_PATH${LD_LIBRARY_PATH:+:}$NIX_LISP_LD_LIBRARY_PATH"
+        export LD_LIBRARY_PATH="$LD_LIBRARY_PATH${LD_LIBRARY_PATH:+:}$NIX_LISP_LD_LIBRARY_PATH"
 
 declare -a NIX_LISP_FINAL_PARAMETERS;
 
 case "$NIX_LISP" in
-	sbcl)
-		NIX_LISP_LOAD_FILE="--load"
-		NIX_LISP_EXEC_CODE="--eval"
+        sbcl)
+                NIX_LISP_LOAD_FILE="--load"
+                NIX_LISP_EXEC_CODE="--eval"
                 NIX_LISP_QUIT="(quit)"
                 NIX_LISP_NODEBUG='--non-interactive'
-		NIX_LISP_FINAL_PARAMETERS=
+                NIX_LISP_FINAL_PARAMETERS=
                 NIX_LISP_FASL_TYPE="fasl"
-		;;
-	ecl)
-		NIX_LISP_LOAD_FILE="-load"
-		NIX_LISP_EXEC_CODE="-eval"
+                ;;
+        ecl)
+                NIX_LISP_LOAD_FILE="-load"
+                NIX_LISP_EXEC_CODE="-eval"
                 NIX_LISP_QUIT="(quit)"
                 NIX_LISP_NODEBUG='--nodebug'
-		NIX_LISP_FINAL_PARAMETERS=
+                NIX_LISP_FINAL_PARAMETERS=
                 NIX_LISP_FASL_TYPE="fas"
-		;;
-	clisp)
-		NIX_LISP_LOAD_FILE="-c -l"
-		NIX_LISP_EXEC_CODE="-x"
+                ;;
+        clisp)
+                NIX_LISP_LOAD_FILE="-c -l"
+                NIX_LISP_EXEC_CODE="-x"
                 NIX_LISP_QUIT="(quit)"
                 NIX_LISP_NODEBUG='-on-error exit'
-		NIX_LISP_FINAL_PARAMETERS="-repl"
+                NIX_LISP_FINAL_PARAMETERS="-repl"
                 NIX_LISP_FASL_TYPE="fas"
-		;;
-	lx86cl64)
-		NIX_LISP_LOAD_FILE="-l"
-		NIX_LISP_EXEC_CODE="-e"
+                ;;
+        lx86cl64)
+                NIX_LISP_LOAD_FILE="-l"
+                NIX_LISP_EXEC_CODE="-e"
                 NIX_LISP_QUIT="(quit)"
                 NIX_LISP_NODEBUG='-b'
-		NIX_LISP_FINAL_PARAMETERS=
+                NIX_LISP_FINAL_PARAMETERS=
                 NIX_LISP_FASL_TYPE="lx64fsl"
-		;;
-	lx86cl)
-		NIX_LISP_LOAD_FILE="-l"
-		NIX_LISP_EXEC_CODE="-e"
+                ;;
+        lx86cl)
+                NIX_LISP_LOAD_FILE="-l"
+                NIX_LISP_EXEC_CODE="-e"
                 NIX_LISP_QUIT="(quit)"
                 NIX_LISP_NODEBUG='-b'
-		NIX_LISP_FINAL_PARAMETERS=
+                NIX_LISP_FINAL_PARAMETERS=
                 NIX_LISP_FASL_TYPE="lx32fsl"
-		;;
-	abcl)
-		NIX_LISP_LOAD_FILE="--load"
-		NIX_LISP_EXEC_CODE="--eval"
+                ;;
+        abcl)
+                NIX_LISP_LOAD_FILE="--load"
+                NIX_LISP_EXEC_CODE="--eval"
                 NIX_LISP_QUIT="(quit)"
                 NIX_LISP_NODEBUG=''
-		NIX_LISP_FINAL_PARAMETERS=
+                NIX_LISP_FINAL_PARAMETERS=
                 NIX_LISP_FASL_TYPE="abcl"
-		;;
+                ;;
 esac
 
 NIX_LISP_ASDF_REGISTRY_CODE="
@@ -127,8 +127,8 @@ eval "$NIX_LISP_PRELAUNCH_HOOK"
 
 if [ -z "$NIX_LISP_SKIP_CODE" ]; then
     "$NIX_LISP_COMMAND" $NIX_LISP_EARLY_OPTIONS \
-	                $NIX_LISP_EXEC_CODE "${NIX_LISP_ASDF_LOAD:-"(load \"$NIX_LISP_ASDF/lib/common-lisp/asdf/build/asdf.$NIX_LISP_FASL_TYPE\")"}" \
-	                $NIX_LISP_EXEC_CODE "$NIX_LISP_ASDF_REGISTRY_CODE" \
-	                ${NIX_LISP_FINAL_PARAMETERS[*]:+"${NIX_LISP_FINAL_PARAMETERS[@]}"} \
-	                "$@"
+                        $NIX_LISP_EXEC_CODE "${NIX_LISP_ASDF_LOAD:-"(load \"$NIX_LISP_ASDF/lib/common-lisp/asdf/build/asdf.$NIX_LISP_FASL_TYPE\")"}" \
+                        $NIX_LISP_EXEC_CODE "$NIX_LISP_ASDF_REGISTRY_CODE" \
+                        ${NIX_LISP_FINAL_PARAMETERS[*]:+"${NIX_LISP_FINAL_PARAMETERS[@]}"} \
+                        "$@"
 fi
diff --git a/pkgs/development/lisp-modules/from-quicklisp/asdf-description.sh b/pkgs/development/lisp-modules/from-quicklisp/asdf-description.sh
index 6c240d15c76..bdb5981bf4f 100755
--- a/pkgs/development/lisp-modules/from-quicklisp/asdf-description.sh
+++ b/pkgs/development/lisp-modules/from-quicklisp/asdf-description.sh
@@ -11,6 +11,6 @@
 name="$1"
 
 sbcl --noinform --load "$NIX_QUICKLISP_DIR"/setup.lisp --eval "(ql:quickload :$name)" \
-	--eval "(format t \"~a~%\" (or (asdf::system-description (asdf::find-system \"$name\")) \"\"))" \
-	--eval '(quit)' --script |
+    --eval "(format t \"~a~%\" (or (asdf::system-description (asdf::find-system \"$name\")) \"\"))" \
+    --eval '(quit)' --script |
     tee /dev/stderr | tail -n 1
diff --git a/pkgs/development/lisp-modules/from-quicklisp/barebones-quicklisp-expression.sh b/pkgs/development/lisp-modules/from-quicklisp/barebones-quicklisp-expression.sh
index d2d846b78f2..f8bae899727 100755
--- a/pkgs/development/lisp-modules/from-quicklisp/barebones-quicklisp-expression.sh
+++ b/pkgs/development/lisp-modules/from-quicklisp/barebones-quicklisp-expression.sh
@@ -122,8 +122,8 @@ url="${ql_src##* }"
   with (import <nixpkgs> {});
       fetchdarcs {
         url=''$url'';
-	rev=''$version'';
-	sha256=''0000000000000000000000000000000000000000000000000000000000000000'';
+    rev=''$version'';
+    sha256=''0000000000000000000000000000000000000000000000000000000000000000'';
     }" | nix-instantiate - | tail -n 1 |
     xargs nix-store -r 2>&1 | tee /dev/stderr | grep 'instead has' | tail -n 1 |
     sed -e 's/.* instead has .//;s/[^0-9a-z].*//')
@@ -149,7 +149,7 @@ url="${ql_src##* }"
 }
 
 if [ "$ql_src" = '{"error":"Not Found"}' ]; then
-	echo "# $name: not found"
+    echo "# $name: not found"
 else
 cat << EOF | grep -Ev '^[ ]+$'
 
diff --git a/pkgs/development/perl-modules/expression-generator/filtered-requirements.sh b/pkgs/development/perl-modules/expression-generator/filtered-requirements.sh
index 98c01508fd5..2e3509d68c1 100755
--- a/pkgs/development/perl-modules/expression-generator/filtered-requirements.sh
+++ b/pkgs/development/perl-modules/expression-generator/filtered-requirements.sh
@@ -3,13 +3,13 @@
 source lib-cache.sh;
 
 print_reqs() {
-	module_name="$1";
+    module_name="$1";
 
-	./requirements.sh "$1"| while read; do
-		if let "$(./source-download-link.sh "${REPLY}" | wc -c)" && [ perl != "$REPLY" ]; then
-			echo "$REPLY";
-		fi;
-	done;
+    ./requirements.sh "$1"| while read; do
+        if let "$(./source-download-link.sh "${REPLY}" | wc -c)" && [ perl != "$REPLY" ]; then
+            echo "$REPLY";
+        fi;
+    done;
 }
 
 module_name="$1";
diff --git a/pkgs/development/perl-modules/expression-generator/full-requirements.sh b/pkgs/development/perl-modules/expression-generator/full-requirements.sh
index 29ed83668ed..91218f36f60 100755
--- a/pkgs/development/perl-modules/expression-generator/full-requirements.sh
+++ b/pkgs/development/perl-modules/expression-generator/full-requirements.sh
@@ -3,19 +3,19 @@
 source lib-cache.sh;
 
 print_requirements () {
-	module_name="$1";
+    module_name="$1";
 
-	./requirements.sh "$module_name" | while read; do
-		echo "$REPLY";
-		print_reqs_cache "$REPLY";
-	done | sort | uniq
+    ./requirements.sh "$module_name" | while read; do
+        echo "$REPLY";
+        print_reqs_cache "$REPLY";
+    done | sort | uniq
 };
 
 print_reqs_cache () {
-	module_name="$1";
-	module_basename="${module_name//::/-}";
-	
-	cached_output print_requirements "$module_basename" "$module_name" "full.deps";
+    module_name="$1";
+    module_basename="${module_name//::/-}";
+
+    cached_output print_requirements "$module_basename" "$module_name" "full.deps";
 };
 
 print_reqs_cache "$@";
diff --git a/pkgs/development/perl-modules/expression-generator/grab-url.sh b/pkgs/development/perl-modules/expression-generator/grab-url.sh
index 809cf87fceb..8935cad8cef 100755
--- a/pkgs/development/perl-modules/expression-generator/grab-url.sh
+++ b/pkgs/development/perl-modules/expression-generator/grab-url.sh
@@ -3,13 +3,13 @@
 source lib-cache.sh
 
 get_file() {
-	url="$1";
+    url="$1";
 
-	if [ -n "$url" ]; then 
-		curl "$1";
-	else
-		echo -n;
-	fi;
+    if [ -n "$url" ]; then
+        curl "$1";
+    else
+        echo -n;
+    fi;
 }
 
 url="$1";
@@ -17,4 +17,3 @@ name="$2";
 name=${name:-$(basename "$url")}
 
 cached_output get_file "${name%%.*}" "$url" "${name#*.}"
-
diff --git a/pkgs/development/perl-modules/expression-generator/lib-cache.sh b/pkgs/development/perl-modules/expression-generator/lib-cache.sh
index 7473e2d1c15..65095144bcd 100644
--- a/pkgs/development/perl-modules/expression-generator/lib-cache.sh
+++ b/pkgs/development/perl-modules/expression-generator/lib-cache.sh
@@ -4,16 +4,15 @@
 # Third argument: argument to command
 # Fourth argument: cache type
 cached_output () {
-	cmd="$1";
-	basename="$2";
-	arg="$3";
-	ext="$4";
-	
-	if ! [ -e "cache-${ext//./-}/${basename}.${ext}" ]; then
-		mkdir -p "cache-${ext//./-}";
-		$cmd $arg > "cache-${ext//./-}/${basename}.${ext}";
-	fi;
+    cmd="$1";
+    basename="$2";
+    arg="$3";
+    ext="$4";
 
-	cat "cache-${ext//./-}/${basename}.${ext}";
-}
+    if ! [ -e "cache-${ext//./-}/${basename}.${ext}" ]; then
+        mkdir -p "cache-${ext//./-}";
+        $cmd $arg > "cache-${ext//./-}/${basename}.${ext}";
+    fi;
 
+    cat "cache-${ext//./-}/${basename}.${ext}";
+}
diff --git a/pkgs/development/perl-modules/expression-generator/requirements.sh b/pkgs/development/perl-modules/expression-generator/requirements.sh
index 60ee68d99ad..19b24c55a8e 100755
--- a/pkgs/development/perl-modules/expression-generator/requirements.sh
+++ b/pkgs/development/perl-modules/expression-generator/requirements.sh
@@ -6,12 +6,12 @@ module_name="$1";
 module_basename="${1//::/-}";
 
 print_requirements () {
-	module_name="$1";
-	
-	./retrieve-meta-yaml.sh "$module_name" |
-		sed -re '1,/^requires:/d; /^[a-z]/,$d; s@^\s*@@; s@:\s.*@@';
-	./retrieve-meta-yaml.sh "$module_name" |
-		sed -re '1,/^build_requires:/d; /^[a-z]/,$d; s@^\s*@@; s@:\s.*@@';
+    module_name="$1";
+
+    ./retrieve-meta-yaml.sh "$module_name" |
+        sed -re '1,/^requires:/d; /^[a-z]/,$d; s@^\s*@@; s@:\s.*@@';
+    ./retrieve-meta-yaml.sh "$module_name" |
+        sed -re '1,/^build_requires:/d; /^[a-z]/,$d; s@^\s*@@; s@:\s.*@@';
 };
 
 cached_output print_requirements "$module_basename" "$module_name" "direct.deps";
diff --git a/pkgs/development/perl-modules/expression-generator/retrieve-file-link.sh b/pkgs/development/perl-modules/expression-generator/retrieve-file-link.sh
index a9cf0d94e0d..c8ec5df11b7 100755
--- a/pkgs/development/perl-modules/expression-generator/retrieve-file-link.sh
+++ b/pkgs/development/perl-modules/expression-generator/retrieve-file-link.sh
@@ -6,9 +6,9 @@ file_name="$2";
 version_regexp="${module_basename}(-[0-9.a-z]+){0,1}";
 author_regexp="[A-Z0-9]+";
 
-./retrieve-modulepage.sh "$module_basename" | 
-	egrep "[<]a href=\"[a-z0-9/]*/(${author_regexp}/){0,1}${version_regexp}/${file_name}" |
-	sed -re "s@.*href=\"@@; s@\".*@@" |
-	sed -re 's@^/@http://search.cpan.org/@';
+./retrieve-modulepage.sh "$module_basename" |
+    egrep "[<]a href=\"[a-z0-9/]*/(${author_regexp}/){0,1}${version_regexp}/${file_name}" |
+    sed -re "s@.*href=\"@@; s@\".*@@" |
+    sed -re 's@^/@http://search.cpan.org/@';
 
 echo "$link_line";
diff --git a/pkgs/development/perl-modules/expression-generator/retrieve-meta-yaml.sh b/pkgs/development/perl-modules/expression-generator/retrieve-meta-yaml.sh
index 2c85d45691f..3b162ebe693 100755
--- a/pkgs/development/perl-modules/expression-generator/retrieve-meta-yaml.sh
+++ b/pkgs/development/perl-modules/expression-generator/retrieve-meta-yaml.sh
@@ -3,11 +3,11 @@
 source lib-cache.sh;
 
 print_meta_yaml () {
-	module_name="$1";
-	module_basename="${module_name//::/-}";
+    module_name="$1";
+    module_basename="${module_name//::/-}";
 
-	./grab-url.sh "$(./retrieve-file-link.sh "$module_basename" "META.yml")" \
-		"${module_basename}.meta.yml";
+    ./grab-url.sh "$(./retrieve-file-link.sh "$module_basename" "META.yml")" \
+        "${module_basename}.meta.yml";
 };
 
 module_name="$1";
diff --git a/pkgs/development/perl-modules/expression-generator/source-download-link.sh b/pkgs/development/perl-modules/expression-generator/source-download-link.sh
index 575f47629c2..779d131961f 100755
--- a/pkgs/development/perl-modules/expression-generator/source-download-link.sh
+++ b/pkgs/development/perl-modules/expression-generator/source-download-link.sh
@@ -6,12 +6,12 @@ module_name="$1";
 module_basename="${module_name//::/-}";
 
 write_link() {
-	module_basename="$1";
+    module_basename="$1";
 
-	./retrieve-modulepage.sh "$module_basename" | 
-		grep -A 2 "This Release" |
-		grep href |
-		sed -re 's/.*href="//; s/".*//; s@^/@http://search.cpan.org/@';
+    ./retrieve-modulepage.sh "$module_basename" |
+        grep -A 2 "This Release" |
+        grep href |
+        sed -re 's/.*href="//; s/".*//; s@^/@http://search.cpan.org/@';
 }
 
 cached_output write_link "$module_basename" "$module_basename" src.link;
diff --git a/pkgs/development/perl-modules/expression-generator/write-nix-expression.sh b/pkgs/development/perl-modules/expression-generator/write-nix-expression.sh
index cfe1506640b..9f5cdb9142e 100755
--- a/pkgs/development/perl-modules/expression-generator/write-nix-expression.sh
+++ b/pkgs/development/perl-modules/expression-generator/write-nix-expression.sh
@@ -5,16 +5,16 @@ cd $(dirname $0);
 source lib-cache.sh;
 
 print_expression () {
-	module_name="$1";
-	module_basename="${module_name//::/-}";
-	module_compressedname="perl${module_name//::/}";
-	sourcelink="$(./source-download-link.sh "${module_name}")";
-	version_name="${sourcelink%.tar.*}";
-	version_name="${version_name##*/}";
-	dependencies="$(./filtered-requirements.sh "$module_name" | sed -e 's/^/perl/; s/:://g' | xargs)";
-	source_hash=$(nix-prefetch-url "$sourcelink" 2>/dev/null);
-
-	cat <<EOF
+    module_name="$1";
+    module_basename="${module_name//::/-}";
+    module_compressedname="perl${module_name//::/}";
+    sourcelink="$(./source-download-link.sh "${module_name}")";
+    version_name="${sourcelink%.tar.*}";
+    version_name="${version_name##*/}";
+    dependencies="$(./filtered-requirements.sh "$module_name" | sed -e 's/^/perl/; s/:://g' | xargs)";
+    source_hash=$(nix-prefetch-url "$sourcelink" 2>/dev/null);
+
+    cat <<EOF
 
   ${module_compressedname} = import ../development/perl-modules/generic perl {
     name = "${version_name}";
diff --git a/pkgs/development/python-modules/aiohttp-wsgi/default.nix b/pkgs/development/python-modules/aiohttp-wsgi/default.nix
index 18364bdce69..ed270cddd98 100644
--- a/pkgs/development/python-modules/aiohttp-wsgi/default.nix
+++ b/pkgs/development/python-modules/aiohttp-wsgi/default.nix
@@ -26,6 +26,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # makes http request to another server
+    "testEnviron"
+  ];
+
   pythonImportsCheck = [ "aiohttp_wsgi" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/hydra-check/default.nix b/pkgs/development/python-modules/hydra-check/default.nix
index 458363713db..48833d77e8b 100644
--- a/pkgs/development/python-modules/hydra-check/default.nix
+++ b/pkgs/development/python-modules/hydra-check/default.nix
@@ -6,6 +6,7 @@
 , requests
 , beautifulsoup4
 , mypy
+, types-requests
 }:
 
 buildPythonPackage rec {
@@ -26,14 +27,17 @@ buildPythonPackage rec {
     beautifulsoup4
   ];
 
-  checkInputs = [ mypy ];
+  checkInputs = [
+    mypy
+    types-requests
+  ];
 
   checkPhase = ''
     echo -e "\x1b[32m## run mypy\x1b[0m"
     mypy hydracheck
   '';
 
-  meta = with lib;{
+  meta = with lib; {
     description = "check hydra for the build status of a package";
     homepage = "https://github.com/nix-community/hydra-check";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/importlib-metadata/default.nix b/pkgs/development/python-modules/importlib-metadata/default.nix
index 158f101167e..e13f7361677 100644
--- a/pkgs/development/python-modules/importlib-metadata/default.nix
+++ b/pkgs/development/python-modules/importlib-metadata/default.nix
@@ -10,16 +10,20 @@
 
 buildPythonPackage rec {
   pname = "importlib-metadata";
-  version = "4.8.1";
+  version = "4.8.2";
+  format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     pname = "importlib_metadata";
     inherit version;
-    sha256 = "sha256-8oSz4RJWrR5dA6uGuyzNb1M5aI/xek15eg/n3zJvI7E=";
+    sha256 = "sha256-db3sFMOX9ShyTBv9lwnWYLM6TS53OHozWPILhIu15fs=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
 
   propagatedBuildInputs = [
     toml
@@ -30,7 +34,10 @@ buildPythonPackage rec {
 
   # Cyclic dependencies due to pyflakefs
   doCheck = false;
-  pythonImportsCheck = [ "importlib_metadata" ];
+
+  pythonImportsCheck = [
+    "importlib_metadata"
+  ];
 
   meta = with lib; {
     description = "Read metadata from Python packages";
diff --git a/pkgs/development/python-modules/mypy/default.nix b/pkgs/development/python-modules/mypy/default.nix
index dbbcb30ffce..99580e2de37 100644
--- a/pkgs/development/python-modules/mypy/default.nix
+++ b/pkgs/development/python-modules/mypy/default.nix
@@ -1,28 +1,63 @@
-{ lib, stdenv, fetchPypi, buildPythonPackage, typed-ast, psutil, isPy3k
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, buildPythonPackage
 , mypy-extensions
+, python
+, pythonOlder
+, typed-ast
 , typing-extensions
+, tomli
+, types-typed-ast
 }:
+
 buildPythonPackage rec {
   pname = "mypy";
-  version = "0.812";
-  disabled = !isPy3k;
+  version = "unstable-2021-11-14";
+  disabled = pythonOlder "3.6";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "069i9qnfanp7dn8df1vspnqb0flvsszzn22v00vj08nzlnd061yd";
+  src = fetchFromGitHub {
+    owner = "python";
+    repo = "mypy";
+    rev = "053a1beb94ee4e5b3260725594315d1b6776e42f";
+    sha256 = "sha256-q2ntj3y3GgXrw4v+yMvcqWFv4y/6YwunIj3bNzU9CH0=";
   };
 
-  propagatedBuildInputs = [ typed-ast psutil mypy-extensions typing-extensions ];
+  patches = [
+    # FIXME: Remove patch after upstream has decided the proper solution.
+    #        https://github.com/python/mypy/pull/11143
+    (fetchpatch {
+      url = "https://github.com/python/mypy/commit/f1755259d54330cd087cae763cd5bbbff26e3e8a.patch";
+      sha256 = "sha256-5gPahX2X6+/qUaqDQIGJGvh9lQ2EDtks2cpQutgbOHk=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "tomli>=1.1.0,<1.2.0" "tomli"
+  '';
+
+  buildInputs = [
+    types-typed-ast
+  ];
+
+  propagatedBuildInputs = [
+    mypy-extensions
+    tomli
+    typed-ast
+    typing-extensions
+  ];
 
   # Tests not included in pip package.
   doCheck = false;
 
   pythonImportsCheck = [
     "mypy"
-    "mypy.types"
     "mypy.api"
     "mypy.fastparse"
     "mypy.report"
+    "mypy.types"
     "mypyc"
     "mypyc.analysis"
   ];
@@ -32,10 +67,13 @@ buildPythonPackage rec {
   # is64bit: unfortunately the build would exhaust all possible memory on i686-linux.
   MYPY_USE_MYPYC = stdenv.buildPlatform.is64bit;
 
+  # when testing reduce optimisation level to drastically reduce build time
+  MYPYC_OPT_LEVEL = 1;
+
   meta = with lib; {
     description = "Optional static typing for Python";
-    homepage    = "http://www.mypy-lang.org";
-    license     = licenses.mit;
-    maintainers = with maintainers; [ martingms lnl7 ];
+    homepage = "http://www.mypy-lang.org";
+    license = licenses.mit;
+    maintainers = with maintainers; [ martingms lnl7 SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/python-modules/mypy/extensions.nix b/pkgs/development/python-modules/mypy/extensions.nix
index 5992a6815d8..e62fa4230ff 100644
--- a/pkgs/development/python-modules/mypy/extensions.nix
+++ b/pkgs/development/python-modules/mypy/extensions.nix
@@ -13,12 +13,12 @@ buildPythonPackage rec {
     sha256 = "2d82818f5bb3e369420cb3c4060a7970edba416647068eb4c5343488a6c604a8";
   };
 
-  propagatedBuildInputs = if pythonOlder "3.5" then [ typing ] else [ ];
+  propagatedBuildInputs = lib.optional (pythonOlder "3.5") typing;
 
   meta = with lib; {
     description = "Experimental type system extensions for programs checked with the mypy typechecker";
-    homepage    = "http://www.mypy-lang.org";
-    license     = licenses.mit;
-    maintainers = with maintainers; [ martingms lnl7 ];
+    homepage = "http://www.mypy-lang.org";
+    license = licenses.mit;
+    maintainers = with maintainers; [ martingms lnl7 SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index 6119ee38422..fef5dfb163b 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchPypi
+, fetchpatch
 , python
 , buildPythonPackage
 , gfortran
@@ -72,10 +73,6 @@ in buildPythonPackage rec {
     ln -s ${cfg} site.cfg
   '';
 
-  # Workaround flakey compiler feature detection
-  # https://github.com/numpy/numpy/issues/19624
-  hardeningDisable = [ "strictoverflow" ];
-
   enableParallelBuilding = true;
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/pylsp-mypy/default.nix b/pkgs/development/python-modules/pylsp-mypy/default.nix
index a7d13bb32a2..e1d7ddff298 100644
--- a/pkgs/development/python-modules/pylsp-mypy/default.nix
+++ b/pkgs/development/python-modules/pylsp-mypy/default.nix
@@ -20,10 +20,16 @@ buildPythonPackage rec {
     sha256 = "1d119csj1k5m9j0f7wdvpvnd02h548css6ybxqah92nk2v0rjscr";
   };
 
+  disabledTests = [
+    "test_multiple_workspaces"
+  ];
+
   checkInputs = [ pytestCheckHook mock ];
 
   propagatedBuildInputs = [ mypy python-lsp-server ];
 
+  pythonImportsCheck = [ "pylsp_mypy" ];
+
   meta = with lib; {
     homepage = "https://github.com/Richardk2n/pylsp-mypy";
     description = "Mypy plugin for the Python LSP Server";
diff --git a/pkgs/development/python-modules/tomli/default.nix b/pkgs/development/python-modules/tomli/default.nix
index 19a0fe6135e..c593e1e4cb1 100644
--- a/pkgs/development/python-modules/tomli/default.nix
+++ b/pkgs/development/python-modules/tomli/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "tomli";
-  version = "1.2.1";
+  version = "1.2.2";
   format = "pyproject";
 
   outputs = [
@@ -19,9 +19,14 @@ buildPythonPackage rec {
     owner = "hukkin";
     repo = pname;
     rev = version;
-    sha256 = "sha256-30AQ9MQmclcjl1d83mIoxFXzaJn1OFKQlVxayqC5NxY=";
+    sha256 = "sha256-oDjpNzWxTaCC1+WyBKrkR6kp90ZomcZQfyW+xKddDoM=";
   };
 
+  patches = [
+    # required for mypy
+    ./fix-backwards-compatibility-load.patch
+  ];
+
   nativeBuildInputs = [ flit-core ];
 
   postInstall = ''
diff --git a/pkgs/development/python-modules/tomli/fix-backwards-compatibility-load.patch b/pkgs/development/python-modules/tomli/fix-backwards-compatibility-load.patch
new file mode 100644
index 00000000000..edfc2f38349
--- /dev/null
+++ b/pkgs/development/python-modules/tomli/fix-backwards-compatibility-load.patch
@@ -0,0 +1,21 @@
+diff --git a/tomli/_parser.py b/tomli/_parser.py
+index 89e81c3..6fb1bfd 100644
+--- a/tomli/_parser.py
++++ b/tomli/_parser.py
+@@ -1,6 +1,6 @@
+ import string
+ from types import MappingProxyType
+-from typing import Any, BinaryIO, Dict, FrozenSet, Iterable, NamedTuple, Optional, Tuple
++from typing import IO, Union, Any, BinaryIO, Dict, FrozenSet, Iterable, NamedTuple, Optional, Tuple
+ import warnings
+ 
+ from tomli._re import (
+@@ -48,7 +48,7 @@ class TOMLDecodeError(ValueError):
+     """An error raised if a document is not valid TOML."""
+ 
+ 
+-def load(fp: BinaryIO, *, parse_float: ParseFloat = float) -> Dict[str, Any]:
++def load(fp: Union[IO, BinaryIO], *, parse_float: ParseFloat = float) -> Dict[str, Any]:
+     """Parse TOML from a binary file object."""
+     s_bytes = fp.read()
+     try:
diff --git a/pkgs/development/python-modules/typed-ast/default.nix b/pkgs/development/python-modules/typed-ast/default.nix
index d5c190e1c41..05ef879b3e4 100644
--- a/pkgs/development/python-modules/typed-ast/default.nix
+++ b/pkgs/development/python-modules/typed-ast/default.nix
@@ -1,15 +1,16 @@
 { buildPythonPackage, fetchFromGitHub, lib, pythonOlder, pytest }:
+
 buildPythonPackage rec {
   pname = "typed-ast";
-  version = "1.4.3";
+  version = "1.5.0";
+  disabled = pythonOlder "3.3";
+
   src = fetchFromGitHub {
     owner = "python";
     repo = "typed_ast";
     rev = version;
-    sha256 = "16mn9snwik5n2ib65sw2xcaqdm02j8ps21zgjxf8kyy7qnx2mx4w";
+    sha256 = "sha256-z3l5gMG1Jp6EI7SnGn5ABVXVBi+bK///iJBqEWn4d+s=";
   };
-  # Only works with Python 3.3 and newer;
-  disabled = pythonOlder "3.3";
 
   pythonImportsCheck = [
     "typed_ast"
@@ -21,6 +22,7 @@ buildPythonPackage rec {
   checkInputs = [
     pytest
   ];
+
   checkPhase = ''
     runHook preCheck
 
@@ -32,9 +34,10 @@ buildPythonPackage rec {
     runHook postCheck
   '';
 
-  meta = {
+  meta = with lib; {
     homepage = "https://github.com/python/typed_ast";
     description = "Python 2 and 3 ast modules with type comment support";
-    license = lib.licenses.asl20;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/python-modules/types-typed-ast/default.nix b/pkgs/development/python-modules/types-typed-ast/default.nix
new file mode 100644
index 00000000000..7c2c7f66a24
--- /dev/null
+++ b/pkgs/development/python-modules/types-typed-ast/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "types-typed-ast";
+  version = "1.5.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-2Op5y/vFIL6Nm8jeSHL0SzQtvbwJFmfi8hsDu9eWkVA=";
+  };
+
+  # Module doesn't have tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "typed_ast-stubs" ];
+
+  meta = with lib; {
+    description = "Typing stubs for typed-ast";
+    homepage = "https://github.com/python/typeshed";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ SuperSandro2000 veehaitch ];
+  };
+}
diff --git a/pkgs/development/tools/analysis/valgrind/default.nix b/pkgs/development/tools/analysis/valgrind/default.nix
index 341aba8e00b..6e736df235f 100644
--- a/pkgs/development/tools/analysis/valgrind/default.nix
+++ b/pkgs/development/tools/analysis/valgrind/default.nix
@@ -1,4 +1,7 @@
-{ lib, stdenv, fetchurl, perl, gdb, cctools, xnu, bootstrap_cmds }:
+{ lib, stdenv, fetchurl, fetchpatch
+, autoreconfHook, perl
+, gdb, cctools, xnu, bootstrap_cmds
+}:
 
 stdenv.mkDerivation rec {
   pname = "valgrind";
@@ -9,16 +12,25 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-AIWaoTp3Lt33giIl9LRu4NOa++Bx0yd42k2ZmECB9/U=";
   };
 
+  patches = [
+    # Fix tests on Musl.
+    # https://bugs.kde.org/show_bug.cgi?id=445300
+    (fetchpatch {
+      url = "https://bugsfiles.kde.org/attachment.cgi?id=143535";
+      sha256 = "036zyk30rixjvpylw3c7n171n4gpn6zcp7h6ya2dz4h5r478l9i6";
+    })
+  ];
+
   outputs = [ "out" "dev" "man" "doc" ];
 
-  hardeningDisable = [ "stackprotector" ];
+  hardeningDisable = [ "pie" "stackprotector" ];
 
   # GDB is needed to provide a sane default for `--db-command'.
   # Perl is needed for `callgrind_{annotate,control}'.
   buildInputs = [ gdb perl ]  ++ lib.optionals (stdenv.isDarwin) [ bootstrap_cmds xnu ];
 
   # Perl is also a native build input.
-  nativeBuildInputs = [ perl ];
+  nativeBuildInputs = [ autoreconfHook perl ];
 
   enableParallelBuilding = true;
   separateDebugInfo = stdenv.isLinux;
diff --git a/pkgs/development/tools/build-managers/tup/setup-hook.sh b/pkgs/development/tools/build-managers/tup/setup-hook.sh
index 5bf64ae59d3..b7962c80d46 100644
--- a/pkgs/development/tools/build-managers/tup/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/tup/setup-hook.sh
@@ -1,27 +1,27 @@
 #!/bin/sh
 
 tupConfigurePhase() {
-	runHook preConfigure
-
-	echo -n CONFIG_TUP_ARCH= >> tup.config
-	case "$system" in
-	"i686-*")      echo i386 >> tup.config;;
-	"x86_64-*")    echo x86_64 >> tup.config;;
-	"powerpc-*")   echo powerpc >> tup.config;;
-	"powerpc64-*") echo powerpc64 >> tup.config;;
-	"ia64-*")      echo ia64 >> tup.config;;
-	"alpha-*")     echo alpha >> tup.config;;
-	"sparc-*")     echo sparc >> tup.config;;
-	"aarch64-*")   echo arm64 >> tup.config;;
-	"arm*")        echo arm >> tup.config;;
-	esac
-
-	echo "${tupConfig-}" >> tup.config
-
-	tup init
-	tup generate tupBuild.sh
-
-	runHook postConfigure
+    runHook preConfigure
+
+    echo -n CONFIG_TUP_ARCH= >> tup.config
+    case "$system" in
+    "i686-*")      echo i386 >> tup.config;;
+    "x86_64-*")    echo x86_64 >> tup.config;;
+    "powerpc-*")   echo powerpc >> tup.config;;
+    "powerpc64-*") echo powerpc64 >> tup.config;;
+    "ia64-*")      echo ia64 >> tup.config;;
+    "alpha-*")     echo alpha >> tup.config;;
+    "sparc-*")     echo sparc >> tup.config;;
+    "aarch64-*")   echo arm64 >> tup.config;;
+    "arm*")        echo arm >> tup.config;;
+    esac
+
+    echo "${tupConfig-}" >> tup.config
+
+    tup init
+    tup generate tupBuild.sh
+
+    runHook postConfigure
 }
 
 if [ -z "${dontUseTupConfigure-}" -a -z "${configurePhase-}" ]; then
@@ -30,13 +30,13 @@ fi
 
 
 tupBuildPhase() {
-	runHook preBuild
+    runHook preBuild
 
-	pushd .
-	. tupBuild.sh
-	popd
+    pushd .
+    . tupBuild.sh
+    popd
 
-	runHook postBuild
+    runHook postBuild
 }
 
 if [ -z "${dontUseTupBuild-}" -a -z "${buildPhase-}" ]; then
diff --git a/pkgs/development/tools/build-managers/wafHook/setup-hook.sh b/pkgs/development/tools/build-managers/wafHook/setup-hook.sh
index 439350c3abc..6cea8fcc2ea 100644
--- a/pkgs/development/tools/build-managers/wafHook/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/wafHook/setup-hook.sh
@@ -21,6 +21,11 @@ wafConfigurePhase() {
     echoCmd 'configure flags' "${flagsArray[@]}"
     python "$wafPath" "${flagsArray[@]}"
 
+    if ! [[ -v enableParallelBuilding ]]; then
+        enableParallelBuilding=1
+        echo "waf: enabled parallel building"
+    fi
+
     runHook postConfigure
 }
 
diff --git a/pkgs/development/tools/misc/gengetopt/default.nix b/pkgs/development/tools/misc/gengetopt/default.nix
index 2c09f925d3d..d24d4b66d66 100644
--- a/pkgs/development/tools/misc/gengetopt/default.nix
+++ b/pkgs/development/tools/misc/gengetopt/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
     rm tests/test_conf_parser_save.sh
   '';
 
-  enableParallelBuilding = true;
+  # test suite is not thread safe
+  enableParallelBuilding = false;
 
   nativeBuildInputs = [ texinfo help2man ];
 
diff --git a/pkgs/games/dwarf-fortress/update.sh b/pkgs/games/dwarf-fortress/update.sh
index e36badc4199..0ef9a40c7a5 100755
--- a/pkgs/games/dwarf-fortress/update.sh
+++ b/pkgs/games/dwarf-fortress/update.sh
@@ -3,13 +3,13 @@
 
 # systems to generate hashes for
 systems='linux linux32 osx osx32
-	 win win_s win32 win32_s
+     win win_s win32 win32_s
          legacy legacy_s legacy32 legacy32_s'
 
 if [ $# -eq 0 ]; then
     versions="$(curl http://www.bay12games.com/dwarves/ \
-		   | grep 'DWARF FORTRESS CLASSIC ' \
-		   | sed 's/.*DWARF FORTRESS CLASSIC \([0-9.]*\) .*/\1/')"
+           | grep 'DWARF FORTRESS CLASSIC ' \
+           | sed 's/.*DWARF FORTRESS CLASSIC \([0-9.]*\) .*/\1/')"
 else
     versions="$@"
 fi
@@ -18,23 +18,23 @@ tmp1="$(mktemp)"
 tmp2="$(mktemp)"
 for version in $versions; do
     for system in $systems; do
-	echo -n $version,$system,
-	ver=$(echo $version | sed -e s,^0\.,, | tr . _)
-	if [[ "$system" = *win* ]] || [[ "$system" = *legacy* ]]; then
-	    ext=zip
-	else
-	    ext=tar.bz2
-	fi
-	nix-prefetch-url \
-	    http://www.bay12games.com/dwarves/df_${ver}_${system}.${ext}
+    echo -n $version,$system,
+    ver=$(echo $version | sed -e s,^0\.,, | tr . _)
+    if [[ "$system" = *win* ]] || [[ "$system" = *legacy* ]]; then
+        ext=zip
+    else
+        ext=tar.bz2
+    fi
+    nix-prefetch-url \
+        http://www.bay12games.com/dwarves/df_${ver}_${system}.${ext}
     done
 done | jq --slurp --raw-input \
-	  'split("\n")  | .[:-1] | map(split(",")) |
+      'split("\n")  | .[:-1] | map(split(",")) |
            map({ "version": .[0], "platform": .[1], "sha256": .[2] }) |
-	   group_by(.version) |
-	   map(map({"version": .version, (.platform): .sha256}) | add |
-	       {(.version): .} | map_values(del(.version))) | add' \
-	  > "$tmp1"
+       group_by(.version) |
+       map(map({"version": .version, (.platform): .sha256}) | add |
+           {(.version): .} | map_values(del(.version))) | add' \
+      > "$tmp1"
 
 # Append $tmp1 to game.json. There should be a better way to handle
 # this but all other attempts failed for me.
diff --git a/pkgs/os-specific/linux/checkpolicy/default.nix b/pkgs/os-specific/linux/checkpolicy/default.nix
index c3d8928c7ba..52cf0a3ec03 100644
--- a/pkgs/os-specific/linux/checkpolicy/default.nix
+++ b/pkgs/os-specific/linux/checkpolicy/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "checkpolicy";
-  version = "2.9";
-  inherit (libsepol) se_release se_url;
+  version = "3.3";
+  inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/checkpolicy-${version}.tar.gz";
-    sha256 = "13jz6f8zdrijvn5w1j102b36fs41z0q8ii74axw48cj550mw6im9";
+    url = "${se_url}/${version}/checkpolicy-${version}.tar.gz";
+    sha256 = "118l8c2vvnnckbd269saslr7adv6rdavr5rv0z5vh2m1lgglxj15";
   };
 
   nativeBuildInputs = [ bison flex ];
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index e492bb1ba56..9ddb4ef3800 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -41,6 +41,7 @@ let
         (whenAtLeast "5.2" yes)
       ];
       DEBUG_INFO_BTF            = whenAtLeast "5.2" (option yes);
+      BPF_LSM                   = whenAtLeast "5.7" (option yes);
       DEBUG_KERNEL              = yes;
       DEBUG_DEVRES              = no;
       DYNAMIC_DEBUG             = yes;
diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index fcea787ed79..1e0a2945162 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -9,14 +9,14 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "libselinux";
-  version = "3.0";
-  inherit (libsepol) se_release se_url;
+  version = "3.3";
+  inherit (libsepol) se_url;
 
   outputs = [ "bin" "out" "dev" "man" ] ++ optional enablePython "py";
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/libselinux-${version}.tar.gz";
-    sha256 = "0cr4p0qkr4qd5z1x677vwhz6mlz55kxyijwi2dmrvbhxcw7v78if";
+    url = "${se_url}/${version}/libselinux-${version}.tar.gz";
+    sha256 = "0mvh793g7fg6wb6zqhkdyrv80x6k84ypqwi8ii89c91xcckyxzdc";
   };
 
   nativeBuildInputs = [ pkg-config ] ++ optionals enablePython [ swig python3 ];
diff --git a/pkgs/os-specific/linux/libsemanage/default.nix b/pkgs/os-specific/linux/libsemanage/default.nix
index 0f9f26c8c5b..d828c38be1d 100644
--- a/pkgs/os-specific/linux/libsemanage/default.nix
+++ b/pkgs/os-specific/linux/libsemanage/default.nix
@@ -6,12 +6,12 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "libsemanage";
-  version = "2.9";
-  inherit (libsepol) se_release se_url;
+  version = "3.3";
+  inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/libsemanage-${version}.tar.gz";
-    sha256 = "075w6y3l9hiy5hicgwrmijyxmhfyd1r7cnc08qxyg4j46jfk8xi5";
+    url = "${se_url}/${version}/libsemanage-${version}.tar.gz";
+    sha256 = "1s3wb66l47blc15s6lkqs11j9l8pycdqqbb03x3vpfrlz9dfrl44";
    };
 
   outputs = [ "out" "dev" "man" ] ++ optional enablePython "py";
diff --git a/pkgs/os-specific/linux/libsepol/default.nix b/pkgs/os-specific/linux/libsepol/default.nix
index e90c0894209..c1df217944c 100644
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@@ -2,31 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "libsepol";
-  version = "3.0";
-  se_release = "20191204";
+  version = "3.3";
   se_url = "https://github.com/SELinuxProject/selinux/releases/download";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/libsepol-${version}.tar.gz";
-    sha256 = "0ygb6dh5lng91xs6xiqf5v0nxa68qmjc787p0s5h9w89364f2yjv";
+    url = "${se_url}/${version}/libsepol-${version}.tar.gz";
+    sha256 = "12r39ygn7aa1kz52wibfr4520m0cp75hlrn3i6rnjqa6p0zdz5rd";
   };
 
-  patches = [
-    # upstream build fix against -fno-common compilers like >=gcc-10
-    (fetchpatch {
-      url = "https://github.com/SELinuxProject/selinux/commit/a96e8c59ecac84096d870b42701a504791a8cc8c.patch";
-      sha256 = "0aybv4kzbhx8xq6s82dsh4ib76k59qzh2bgxmk44iq5cjnqn5rd6";
-      stripLen = 1;
-    })
-    (fetchpatch {
-      url = "https://github.com/SELinuxProject/selinux/commit/3d32fc24d6aff360a538c63dad08ca5c957551b0.patch";
-      sha256 = "1mphwdlj4d6mwmsp5xkpf6ci4rxhgbi3fm79d08h4jbzxaf4wny4";
-      stripLen = 1;
-    })
-  ];
-
   postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
     substituteInPlace src/Makefile --replace 'all: $(LIBA) $(LIBSO)' 'all: $(LIBA)'
     sed -i $'/^\t.*LIBSO/d' src/Makefile
@@ -46,7 +31,7 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = "-Wno-error";
 
-  passthru = { inherit se_release se_url; };
+  passthru = { inherit se_url; };
 
   meta = with lib; {
     description = "SELinux binary policy manipulation library";
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index ebca6b2623c..0b6291226bc 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -10,12 +10,12 @@
 with lib;
 
 stdenv.mkDerivation rec {
-  version = "1.0.0";
+  version = "1.0.1";
   pname = "nftables";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/nftables/files/${pname}-${version}.tar.bz2";
-    sha256 = "1x25zs2czmn14mmq1nqi4zibsvh04vqjbx5lxj42nylnmxym9gsq";
+    sha256 = "08x4xw0s5sap3q7jfr91v7mrkxrydi4dvsckw85ims0qb1ibmviw";
   };
 
   nativeBuildInputs = [
@@ -35,6 +35,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--with-json"
+    "--with-cli=readline"  # TODO: maybe switch to editline
   ] ++ optional (!withDebugSymbols) "--disable-debug"
     ++ optional (!withPython) "--disable-python"
     ++ optional withPython "--enable-python"
@@ -45,6 +46,6 @@ stdenv.mkDerivation rec {
     homepage = "https://netfilter.org/projects/nftables/";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ izorkin ];
+    maintainers = with maintainers; [ izorkin ajs124 ];
   };
 }
diff --git a/pkgs/os-specific/linux/policycoreutils/default.nix b/pkgs/os-specific/linux/policycoreutils/default.nix
index 7e2ff29325a..c066dd4c4c5 100644
--- a/pkgs/os-specific/linux/policycoreutils/default.nix
+++ b/pkgs/os-specific/linux/policycoreutils/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "policycoreutils";
-  version = "2.9";
-  inherit (libsepol) se_release se_url;
+  version = "3.3";
+  inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/policycoreutils-${version}.tar.gz";
-    sha256 = "0yqg5ws5gbl1cbn8msxdk1c3ilmmx58qg5dx883kqyq0517k8g65";
+    url = "${se_url}/${version}/policycoreutils-${version}.tar.gz";
+    sha256 = "0y0hl32b2ks7r0fhbx3k2j1gqqms5aplyasjs3fz50caxl6096a1";
   };
 
   postPatch = ''
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [
     "PREFIX=$(out)"
-    "SBINDIR=$(out)/sbin"
+    "SBINDIR=$(out)/bin"
     "ETCDIR=$(out)/etc"
     "BASHCOMPLETIONDIR=$out/share/bash-completion/completions"
     "LOCALEDIR=$(out)/share/locale"
diff --git a/pkgs/os-specific/linux/selinux-python/default.nix b/pkgs/os-specific/linux/selinux-python/default.nix
index b6394b3e1f6..c50f4ffccd0 100644
--- a/pkgs/os-specific/linux/selinux-python/default.nix
+++ b/pkgs/os-specific/linux/selinux-python/default.nix
@@ -7,13 +7,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "selinux-python";
-  version = "2.9";
+  version = "3.3";
 
-  inherit (libsepol) se_release se_url;
+  inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/selinux-python-${version}.tar.gz";
-    sha256 = "1pjzsyay5535cxcjag7y7k193ajry0s0xc3dqv5905qd7cwval1n";
+    url = "${se_url}/${version}/selinux-python-${version}.tar.gz";
+    sha256 = "1v244hpb45my303793xa4kcn7qnxjgxn4ja7rdn9k1q361hi1nca";
   };
 
   strictDeps = true;
@@ -49,4 +49,3 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
   };
 }
-
diff --git a/pkgs/os-specific/linux/selinux-sandbox/default.nix b/pkgs/os-specific/linux/selinux-sandbox/default.nix
index a10588bacf1..0d2843d216a 100644
--- a/pkgs/os-specific/linux/selinux-sandbox/default.nix
+++ b/pkgs/os-specific/linux/selinux-sandbox/default.nix
@@ -9,12 +9,12 @@ with python3.pkgs;
 
 stdenv.mkDerivation rec {
   pname = "selinux-sandbox";
-  version = "2.9";
-  inherit (policycoreutils) se_release se_url;
+  version = "3.3";
+  inherit (policycoreutils) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/selinux-sandbox-${version}.tar.gz";
-    sha256 = "0qj20jyi8v1653xdqj5yak3wwbvg5bw8f2jmx8fpahl6y1bmz481";
+    url = "${se_url}/${version}/selinux-sandbox-${version}.tar.gz";
+    sha256 = "0rw8pxfqhl6ww4w31fbf4hi3zilh1n3b1rfjm7ra76mm78wfyylj";
   };
 
   nativeBuildInputs = [ wrapPython ];
diff --git a/pkgs/os-specific/linux/semodule-utils/default.nix b/pkgs/os-specific/linux/semodule-utils/default.nix
index b76e715dbc2..5c8d83c3f82 100644
--- a/pkgs/os-specific/linux/semodule-utils/default.nix
+++ b/pkgs/os-specific/linux/semodule-utils/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "semodule-utils";
-  version = "2.9";
+  version = "3.3";
 
-  inherit (libsepol) se_release se_url;
+  inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/${pname}-${version}.tar.gz";
-    sha256 = "01yrwnd3calmw6r8kdh8ld7i7fb250n2yqqqk9p0ymrlwsg6g0w0";
+    url = "${se_url}/${version}/${pname}-${version}.tar.gz";
+    sha256 = "0qvhl40a6jlm8p719nnlw2ghlxbh8lxbcsd59azxp884bxgfr61h";
   };
 
   buildInputs = [ libsepol ];
diff --git a/pkgs/os-specific/linux/sepolgen/default.nix b/pkgs/os-specific/linux/sepolgen/default.nix
deleted file mode 100644
index f7ef1cb9c3a..00000000000
--- a/pkgs/os-specific/linux/sepolgen/default.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ lib, stdenv, fetchurl, libsepol, python }:
-
-stdenv.mkDerivation rec {
-  pname = "sepolgen";
-  version = "1.2.2";
-  inherit (libsepol) se_release se_url;
-
-  src = fetchurl {
-    url = "${se_url}/${se_release}/sepolgen-${version}.tar.gz";
-    sha256 = "09139kspr41zgksayi4dh982p8080lrfl96p4dld51nknbpaigdy";
-  };
-
-  preBuild = ''
-    makeFlagsArray+=("PREFIX=$out")
-    makeFlagsArray+=("DESTDIR=$out")
-    makeFlagsArray+=("PYTHONLIBDIR=lib/${python.libPrefix}/site-packages")
-  '';
-
-  meta = with lib; {
-    inherit (libsepol.meta) homepage platforms maintainers;
-    description = "SELinux policy generation library";
-    license = licenses.gpl2;
-  };
-}
diff --git a/pkgs/os-specific/linux/service-wrapper/service-wrapper.sh b/pkgs/os-specific/linux/service-wrapper/service-wrapper.sh
index a7c3bc9758b..2889adc1868 100755
--- a/pkgs/os-specific/linux/service-wrapper/service-wrapper.sh
+++ b/pkgs/os-specific/linux/service-wrapper/service-wrapper.sh
@@ -33,12 +33,12 @@
 
 
 is_ignored_file() {
-	case "$1" in
-		skeleton | README | *.dpkg-dist | *.dpkg-old | rc | rcS | single | reboot | bootclean.sh)
-			return 0
-		;;
-	esac
-	return 1
+    case "$1" in
+        skeleton | README | *.dpkg-dist | *.dpkg-old | rc | rcS | single | reboot | bootclean.sh)
+            return 0
+        ;;
+    esac
+    return 1
 }
 
 VERSION=$(@coreutils@/bin/basename $0)" ver. 19-04"
@@ -75,35 +75,35 @@ while [ $# -gt 0 ]; do
        if [ -z "${SERVICE}" -a $# -eq 1 -a "${1}" = "--status-all" ]; then
           if [ -d "${SERVICEDIR}" ]; then
              cd ${SERVICEDIR}
-	     for SERVICE in * ; do
-	       case "${SERVICE}" in
-	         functions | halt | killall | single| linuxconf| kudzu)
-	             ;;
-	         *)
-	           if ! is_ignored_file "${SERVICE}" \
-	   	    && [ -x "${SERVICEDIR}/${SERVICE}" ]; then
-	                   out=$(env -i LANG="$LANG" LANGUAGE="$LANGUAGE" LC_CTYPE="$LC_CTYPE" LC_NUMERIC="$LC_NUMERIC" LC_TIME="$LC_TIME" LC_COLLATE="$LC_COLLATE" LC_MONETARY="$LC_MONETARY" LC_MESSAGES="$LC_MESSAGES" LC_PAPER="$LC_PAPER" LC_NAME="$LC_NAME" LC_ADDRESS="$LC_ADDRESS" LC_TELEPHONE="$LC_TELEPHONE" LC_MEASUREMENT="$LC_MEASUREMENT" LC_IDENTIFICATION="$LC_IDENTIFICATION" LC_ALL="$LC_ALL" PATH="$PATH" TERM="$TERM" "$SERVICEDIR/$SERVICE" status 2>&1)
-	                   retval=$?
-	                   if echo "$out" | egrep -iq "usage:"; then
-	                     #printf " %s %-60s %s\n" "[?]" "$SERVICE:" "unknown" 1>&2
-	                     echo " [ ? ]  $SERVICE" 1>&2
-	                     continue
-	                   else
-	                     if [ "$retval" = "0" -a -n "$out" ]; then
-	                       #printf " %s %-60s %s\n" "[+]" "$SERVICE:" "running"
-	                       echo " [ + ]  $SERVICE"
-	                       continue
-	                     else
-	                       #printf " %s %-60s %s\n" "[-]" "$SERVICE:" "NOT running"
-	                       echo " [ - ]  $SERVICE"
-	                       continue
-	                     fi
-	                   fi
-	             #env -i LANG="$LANG" LANGUAGE="$LANGUAGE" LC_CTYPE="$LC_CTYPE" LC_NUMERIC="$LC_NUMERIC" LC_TIME="$LC_TIME" LC_COLLATE="$LC_COLLATE" LC_MONETARY="$LC_MONETARY" LC_MESSAGES="$LC_MESSAGES" LC_PAPER="$LC_PAPER" LC_NAME="$LC_NAME" LC_ADDRESS="$LC_ADDRESS" LC_TELEPHONE="$LC_TELEPHONE" LC_MEASUREMENT="$LC_MEASUREMENT" LC_IDENTIFICATION="$LC_IDENTIFICATION" LC_ALL="$LC_ALL" PATH="$PATH" TERM="$TERM" "$SERVICEDIR/$SERVICE" status
-	           fi
-	           ;;
-	       esac
-	     done
+         for SERVICE in * ; do
+           case "${SERVICE}" in
+             functions | halt | killall | single| linuxconf| kudzu)
+                 ;;
+             *)
+               if ! is_ignored_file "${SERVICE}" \
+               && [ -x "${SERVICEDIR}/${SERVICE}" ]; then
+                       out=$(env -i LANG="$LANG" LANGUAGE="$LANGUAGE" LC_CTYPE="$LC_CTYPE" LC_NUMERIC="$LC_NUMERIC" LC_TIME="$LC_TIME" LC_COLLATE="$LC_COLLATE" LC_MONETARY="$LC_MONETARY" LC_MESSAGES="$LC_MESSAGES" LC_PAPER="$LC_PAPER" LC_NAME="$LC_NAME" LC_ADDRESS="$LC_ADDRESS" LC_TELEPHONE="$LC_TELEPHONE" LC_MEASUREMENT="$LC_MEASUREMENT" LC_IDENTIFICATION="$LC_IDENTIFICATION" LC_ALL="$LC_ALL" PATH="$PATH" TERM="$TERM" "$SERVICEDIR/$SERVICE" status 2>&1)
+                       retval=$?
+                       if echo "$out" | egrep -iq "usage:"; then
+                         #printf " %s %-60s %s\n" "[?]" "$SERVICE:" "unknown" 1>&2
+                         echo " [ ? ]  $SERVICE" 1>&2
+                         continue
+                       else
+                         if [ "$retval" = "0" -a -n "$out" ]; then
+                           #printf " %s %-60s %s\n" "[+]" "$SERVICE:" "running"
+                           echo " [ + ]  $SERVICE"
+                           continue
+                         else
+                           #printf " %s %-60s %s\n" "[-]" "$SERVICE:" "NOT running"
+                           echo " [ - ]  $SERVICE"
+                           continue
+                         fi
+                       fi
+                 #env -i LANG="$LANG" LANGUAGE="$LANGUAGE" LC_CTYPE="$LC_CTYPE" LC_NUMERIC="$LC_NUMERIC" LC_TIME="$LC_TIME" LC_COLLATE="$LC_COLLATE" LC_MONETARY="$LC_MONETARY" LC_MESSAGES="$LC_MESSAGES" LC_PAPER="$LC_PAPER" LC_NAME="$LC_NAME" LC_ADDRESS="$LC_ADDRESS" LC_TELEPHONE="$LC_TELEPHONE" LC_MEASUREMENT="$LC_MEASUREMENT" LC_IDENTIFICATION="$LC_IDENTIFICATION" LC_ALL="$LC_ALL" PATH="$PATH" TERM="$TERM" "$SERVICEDIR/$SERVICE" status
+               fi
+               ;;
+           esac
+         done
           else
              systemctl $sctl_args list-units
           fi
diff --git a/pkgs/os-specific/linux/setools/default.nix b/pkgs/os-specific/linux/setools/default.nix
index 842a525353d..9d547d2007e 100644
--- a/pkgs/os-specific/linux/setools/default.nix
+++ b/pkgs/os-specific/linux/setools/default.nix
@@ -1,6 +1,5 @@
 { lib, fetchFromGitHub, python3
 , libsepol, libselinux, checkpolicy
-, fetchpatch
 , withGraphics ? false
 }:
 
@@ -9,22 +8,15 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "setools";
-  version = "4.3.0";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "SELinuxProject";
     repo = pname;
     rev = version;
-    sha256 = "0vr20bi8w147z5lclqz1l0j1b34137zg2r04pkafkgqqk7qbyjk6";
+    sha256 = "1qvd5j6zwq4fmlahg45swjplhif2z89x7s6pnp07gvcp2fbqdsh5";
   };
 
-  patches = [
-    (fetchpatch { # included in 4.4.0
-      url = "https://github.com/SELinuxProject/setools/commit/f1b4a5d375be05fbccedb258c940d771bff8e524.diff";
-      sha256 = "1r38s6i4i6bdr2zdp5wcg1yifpf3pd018c73a511mgynyg7d11xy";
-    })
-  ];
-
   nativeBuildInputs = [ cython ];
   buildInputs = [ libsepol ];
   propagatedBuildInputs = [ enum34 libselinux networkx ]
diff --git a/pkgs/servers/sql/mariadb/connector-c/default.nix b/pkgs/servers/sql/mariadb/connector-c/default.nix
index 745031e8a4c..3f0697bd2cc 100644
--- a/pkgs/servers/sql/mariadb/connector-c/default.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/default.nix
@@ -59,6 +59,7 @@ stdenv.mkDerivation {
     ln -sv mariadb $dev/include/mysql
     ln -sv mariadb_version.h $dev/include/mariadb/mysql_version.h
     ln -sv libmariadb.pc $dev/lib/pkgconfig/mysqlclient.pc
+    install -Dm644 include/ma_config.h $dev/include/mariadb/my_config.h
   '';
 
   meta = {
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index fafd5581e5a..6e5f41d6882 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -201,18 +201,18 @@ let
 in self: {
 
   postgresql_9_6 = self.callPackage generic {
-    version = "9.6.23";
+    version = "9.6.24";
     psqlSchema = "9.6";
-    sha256 = "1fa735lrmv2vrfiixg73nh024gxlagcbrssklvgwdf0s82cgfjd8";
+    sha256 = "sha256-rrehlr4+vtGnR271ZfOXIhh8EI3UfadIm+nE/K6YKs4=";
     this = self.postgresql_9_6;
     thisAttr = "postgresql_9_6";
     inherit self;
   };
 
   postgresql_10 = self.callPackage generic {
-    version = "10.18";
+    version = "10.19";
     psqlSchema = "10.0"; # should be 10, but changing it is invasive
-    sha256 = "009qpb02bq0rx0aaw5ck70gk07xwparhfxvlfimgihw2vhp7qisp";
+    sha256 = "sha256-brgwtCi2DoSuh+IENrzmecTZ0CAr567A5BsMZ9kTQjk=";
     this = self.postgresql_10;
     thisAttr = "postgresql_10";
     inherit self;
@@ -220,36 +220,36 @@ in self: {
   };
 
   postgresql_11 = self.callPackage generic {
-    version = "11.13";
+    version = "11.14";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    sha256 = "0j5wnscnxa3sx8d39s55654df8aikmvkihfb0a02hrgmyygnihx0";
+    sha256 = "sha256-llx/S+lvtk+VgYUsWMTwXDgS1K2CPA8+K9/nd8Fi+Zk=";
     this = self.postgresql_11;
     thisAttr = "postgresql_11";
     inherit self;
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.8";
+    version = "12.9";
     psqlSchema = "12";
-    sha256 = "0an6v5bsp26d276wbdx76lsq6cq86hgi2fmkzwawnk63j3h02r72";
+    sha256 = "sha256-if2i3jPtBKmFSOQ/PuXxW4gr4XUF1jH+DdGlQKK1bc4=";
     this = self.postgresql_12;
     thisAttr = "postgresql_12";
     inherit self;
   };
 
   postgresql_13 = self.callPackage generic {
-    version = "13.4";
+    version = "13.5";
     psqlSchema = "13";
-    sha256 = "1kf0gcsrl5n25rjlvkh87aywmn28kbwvakm5c7j1qpr4j01y34za";
+    sha256 = "sha256-m4EGelXtuqvEGKrO9FfdhHdkKCdJlWCwBhWm6mwT9rM=";
     this = self.postgresql_13;
     thisAttr = "postgresql_13";
     inherit self;
   };
 
   postgresql_14 = self.callPackage generic {
-    version = "14.0";
+    version = "14.1";
     psqlSchema = "14";
-    sha256 = "08m14zcrcvc2i0xl10p0wgzycsmfmk27gny40a8mwdx74s8xfapf";
+    sha256 = "sha256-TTwQHqeuOJgvBr3HN1i1Nyf7ZALs2TggBvpezHwspB8=";
     this = self.postgresql_14;
     thisAttr = "postgresql_14";
     inherit self;
diff --git a/pkgs/shells/bash/bash-5.1-patches.nix b/pkgs/shells/bash/bash-5.1-patches.nix
index aa5ad75fbc7..e6e9461bcbe 100644
--- a/pkgs/shells/bash/bash-5.1-patches.nix
+++ b/pkgs/shells/bash/bash-5.1-patches.nix
@@ -9,4 +9,8 @@ patch: [
 (patch "006" "051x8wlwrqk0yr0zg378vh824iklfl5g9pkmcdf62qp8gn9pvqbm")
 (patch "007" "0fir80pp1gmlpadmqcgkrv4y119pc7xllchjzg05fd7px73viz5c")
 (patch "008" "1lfjgshk8i9vch92p5wgc9r90j3phw79aa7gbai89w183b2z6b7j")
+(patch "009" "1vn36dzd9g4y1h3jiss6418crla0rbcd0d6wwsyv9d5l7aaxlp74")
+(patch "010" "0amfmvbzsand7bdypylkjdpcp88fa3cplfshn7vyzv2ff2rdgj52")
+(patch "011" "0yq24abb4fzfxqnwl20b330sxl9lr9ds0nc4yi30f81l94b1y6aq")
+(patch "012" "165bff97ffih49vfs4mkr5w3z5gn1w6zfyrf773iajkw6v48kw8h")
 ]
diff --git a/pkgs/tools/graphics/zxing/zxing.sh b/pkgs/tools/graphics/zxing/zxing.sh
index ca6ac60bab6..a38558d8702 100644
--- a/pkgs/tools/graphics/zxing/zxing.sh
+++ b/pkgs/tools/graphics/zxing/zxing.sh
@@ -2,17 +2,17 @@
 choice="$1";
 shift
 case "$choice" in
-	encode | create | write | CommandLineEncoder)
-		zxing-cmdline-encoder "$@";
-		;;
-	decode | read | run | CommandLineRunner)
-		zxing-cmdline-runner "$@";
-		;;
-	help | usage | --help | --usage | -h)
-		zxing read;
-		zxing write;
-		;;
-	*)
-		zxing read "$choice" "$@"
-		;;
+    encode | create | write | CommandLineEncoder)
+        zxing-cmdline-encoder "$@";
+        ;;
+    decode | read | run | CommandLineRunner)
+        zxing-cmdline-runner "$@";
+        ;;
+    help | usage | --help | --usage | -h)
+        zxing read;
+        zxing write;
+        ;;
+    *)
+        zxing read "$choice" "$@"
+        ;;
 esac
diff --git a/pkgs/tools/misc/grub/grub1.patches.sh b/pkgs/tools/misc/grub/grub1.patches.sh
index d3b138ad357..a7db25afb64 100755
--- a/pkgs/tools/misc/grub/grub1.patches.sh
+++ b/pkgs/tools/misc/grub/grub1.patches.sh
@@ -13,39 +13,39 @@ set -u
 
 # https://salsa.debian.org/grub-team/grub-legacy/tree/master/debian/patches
 SERIES=(
-	snapshot.patch
-	menu.lst_gnu-hurd.patch
-	graphics.patch
-	raid.patch
-	raid_cciss.patch
-	xfs_freeze.patch
-	2gb_limit.patch
-	grub-special_device_names.patch
-	grub-xvd_drives.patch
-	initrd_max_address.patch
-	splashimage_help.patch
-	grub-install_addsyncs.patch
-	grub-install_regexp.patch
-	grub-install_aoe_support.patch
-	grub-install_xvd.patch
-	geometry-26kernel.patch
-	print_func.patch
-	mprotect.patch
-	savedefault.patch
-	find-grub-dir.patch
-	intelmac.patch
-	crossreference_manpages.patch
-	ext3_256byte_inode.patch
+    snapshot.patch
+    menu.lst_gnu-hurd.patch
+    graphics.patch
+    raid.patch
+    raid_cciss.patch
+    xfs_freeze.patch
+    2gb_limit.patch
+    grub-special_device_names.patch
+    grub-xvd_drives.patch
+    initrd_max_address.patch
+    splashimage_help.patch
+    grub-install_addsyncs.patch
+    grub-install_regexp.patch
+    grub-install_aoe_support.patch
+    grub-install_xvd.patch
+    geometry-26kernel.patch
+    print_func.patch
+    mprotect.patch
+    savedefault.patch
+    find-grub-dir.patch
+    intelmac.patch
+    crossreference_manpages.patch
+    ext3_256byte_inode.patch
     # Breaks on NixOS.
-	#use_grub-probe_in_grub-install.patch
-	objcopy-absolute.patch
-	no-reorder-functions.patch
+    #use_grub-probe_in_grub-install.patch
+    objcopy-absolute.patch
+    no-reorder-functions.patch
 
-	# We aren't building amd64 binaries, see #244498
-	#fix_amd64_compile.patch
-	modern-automake.patch
-	no-combine-stack-adjustments.patch
-	no-pie.patch
+    # We aren't building amd64 binaries, see #244498
+    #fix_amd64_compile.patch
+    modern-automake.patch
+    no-combine-stack-adjustments.patch
+    no-pie.patch
 )
 
 # Revision mapping to current tip of the 0.97-73 branch.
@@ -63,8 +63,8 @@ in
 EOF
 
 for PATCH in "${SERIES[@]}"; do
-	URL="$prefix/$PATCH"
-	HASH="$(nix-prefetch-url "$URL")"
-	echo "{ url = \"\${prefix}/$PATCH\"; sha256 = \"$HASH\"; }" >> "$FILE"
+    URL="$prefix/$PATCH"
+    HASH="$(nix-prefetch-url "$URL")"
+    echo "{ url = \"\${prefix}/$PATCH\"; sha256 = \"$HASH\"; }" >> "$FILE"
 done
 echo "]" >> "$FILE"
diff --git a/pkgs/tools/security/rhash/default.nix b/pkgs/tools/security/rhash/default.nix
index 7177b1891f2..e82052d961b 100644
--- a/pkgs/tools/security/rhash/default.nix
+++ b/pkgs/tools/security/rhash/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-HkDgWwHoRWCNtWyfP4sj3veEd+KT5J7yL4J4Z/hJcrE=";
   };
 
-  patches = lib.optionals stdenv.cc.isClang [
+  patches = [
     # Fix clang configuration; remove with next release
     (fetchpatch {
       url = "https://github.com/rhash/RHash/commit/4dc506066cf1727b021e6352535a8bb315c3f8dc.patch";
diff --git a/pkgs/tools/text/source-highlight/default.nix b/pkgs/tools/text/source-highlight/default.nix
index 4a7b588cd9d..289740854f2 100644
--- a/pkgs/tools/text/source-highlight/default.nix
+++ b/pkgs/tools/text/source-highlight/default.nix
@@ -18,6 +18,13 @@ stdenv.mkDerivation rec {
       sha256 = "1wnj0jmkmrwjww7qk9dvfxh8h06jdn7mi8v2fvwh95b6x87z5l47";
       excludes = [ "ChangeLog" ];
     })
+
+    # Upstream fix for clang-13 and gcc-12 test support
+    (fetchpatch {
+      name = "gcc-12.patch";
+      url = "http://git.savannah.gnu.org/cgit/src-highlite.git/patch/?id=ab9fe5cb9b85c5afab94f2a7f4b6d7d473c14ee9";
+      sha256 = "1v33zd2766k7cdgmajw2lffw9wd7v4f8z01f40z53f6bp608nr62";
+    })
   ];
 
   # source-highlight uses it's own binary to generate documentation.
@@ -35,7 +42,7 @@ stdenv.mkDerivation rec {
     "--with-bash-completion=${placeholder "out"}/share/bash_completion.d"
   ];
 
-  doCheck = !stdenv.cc.isClang;
+  doCheck = true;
 
   enableParallelBuilding = true;
   # Upstream uses the same intermediate files in multiple tests, running
diff --git a/pkgs/tools/typesetting/lout/builder.sh b/pkgs/tools/typesetting/lout/builder.sh
index 61459e48b7f..eab37c3c68f 100755
--- a/pkgs/tools/typesetting/lout/builder.sh
+++ b/pkgs/tools/typesetting/lout/builder.sh
@@ -15,28 +15,28 @@ installDoc ()
     echo "building \`$doc' document..."
     if [ ! -f "doc/$doc/outfile.ps" ]
     then
-      ( PATH="$PWD:$PATH" ;				\
-        cd "doc/$doc" && lout -r4 -o outfile.ps all )	\
+      ( PATH="$PWD:$PATH" ; \
+        cd "doc/$doc" && lout -r4 -o outfile.ps all ) \
       || return 1
     fi
-    cp "doc/$doc/outfile.ps" "$out/doc/lout/$doc.ps" &&		\
-    ps2pdf -dPDFSETTINGS=/prepress -sPAPERSIZE=a4		\
+    cp "doc/$doc/outfile.ps" "$out/doc/lout/$doc.ps" && \
+    ps2pdf -dPDFSETTINGS=/prepress -sPAPERSIZE=a4 \
            "doc/$doc/outfile.ps" "$out/doc/lout/$doc.pdf"
   done
 
   return 0
 }
 
-unpackPhase &&									\
-cd lout-*.* &&									\
-cat makefile |									\
-  sed -e "s|^PREFIX[[:blank:]]*=.*\$|PREFIX = $out|g ;				\
-          s|^LOUTLIBDIR[[:blank:]]*=.*$|LOUTLIBDIR = \$(PREFIX)/lib/lout|g ;	\
-	  s|^LOUTDOCDIR[[:blank:]]*=.*$|LOUTDOCDIR = \$(PREFIX)/doc/lout|g ;	\
-	  s|^MANDIR[[:blank:]]*=.*$|MANDIR = \$(PREFIX)/man|g"			\
-  > "$nixMakefile" &&								\
-mkdir -p "$out/bin" && mkdir -p "$out/lib"					\
-mkdir -p "$out/man" && mkdir -p "$out/doc/lout" &&				\
-make -f "$nixMakefile" CC=cc install installman &&					\
-installDoc &&									\
+unpackPhase && \
+cd lout-*.* && \
+cat makefile | \
+  sed -e "s|^PREFIX[[:blank:]]*=.*\$|PREFIX = $out|g ; \
+    s|^LOUTLIBDIR[[:blank:]]*=.*$|LOUTLIBDIR = \$(PREFIX)/lib/lout|g ; \
+    s|^LOUTDOCDIR[[:blank:]]*=.*$|LOUTDOCDIR = \$(PREFIX)/doc/lout|g ; \
+    s|^MANDIR[[:blank:]]*=.*$|MANDIR = \$(PREFIX)/man|g" \
+  > "$nixMakefile" && \
+mkdir -p "$out/bin" && mkdir -p "$out/lib" \
+mkdir -p "$out/man" && mkdir -p "$out/doc/lout" && \
+make -f "$nixMakefile" CC=cc install installman && \
+installDoc && \
 fixupPhase
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index a6518b062b8..c78e2119239 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -838,6 +838,7 @@ mapAliases ({
   sdlmame = mame; # added 2019-10-30
   seeks = throw "seeks has been removed from nixpkgs, as it was unmaintained"; # added 2020-06-21
   seg3d = throw "seg3d has been removed from nixpkgs (2019-11-10)";
+  sepolgen = throw "sepolgen was merged into selinux-python"; # added 2021-11-11
   shared_mime_info = shared-mime-info; # added 2018-02-25
   skrooge2 = skrooge; # added 2017-02-18
   sky = throw "sky has been removed from nixpkgs (2020-09-16)";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 03f95e34e61..f38e73201b9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -22700,8 +22700,6 @@ with pkgs;
 
   sdrangel = libsForQt5.callPackage ../applications/radio/sdrangel {  };
 
-  sepolgen = callPackage ../os-specific/linux/sepolgen { };
-
   setools = callPackage ../os-specific/linux/setools { };
 
   seturgent = callPackage ../os-specific/linux/seturgent { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6fa68229056..2f415e50f96 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9626,6 +9626,8 @@ in {
 
   types-toml = callPackage ../development/python-modules/types-toml { };
 
+  types-typed-ast = callPackage ../development/python-modules/types-typed-ast { };
+
   typesentry = callPackage ../development/python-modules/typesentry { };
 
   typesystem = callPackage ../development/python-modules/typesystem { };
author	Jonathan Ringer <jonringer@users.noreply.github.com>	2021-12-02 16:04:32 -0800
committer	GitHub <noreply@github.com>	2021-12-02 16:04:32 -0800
commit	571cbf3d1db477058303cef8754fb85a14e90eb7 (patch)
tree	4e27750e24b51b0308574496b6f28200faaece1d
parent	3bf91048f85654c6dec62bbbf4e79a85beda3bb0 (diff)
parent	987163192b0991a76c413693f7040d01460cd5e4 (diff)
download	nixpkgs-571cbf3d1db477058303cef8754fb85a14e90eb7.tar nixpkgs-571cbf3d1db477058303cef8754fb85a14e90eb7.tar.gz nixpkgs-571cbf3d1db477058303cef8754fb85a14e90eb7.tar.bz2 nixpkgs-571cbf3d1db477058303cef8754fb85a14e90eb7.tar.lz nixpkgs-571cbf3d1db477058303cef8754fb85a14e90eb7.tar.xz nixpkgs-571cbf3d1db477058303cef8754fb85a14e90eb7.tar.zst nixpkgs-571cbf3d1db477058303cef8754fb85a14e90eb7.zip