Merge staging-next into staging

24 files changed, 164 insertions, 156 deletions

diff --git a/pkgs/development/compilers/chicken/5/chicken.nix b/pkgs/development/compilers/chicken/5/chicken.nix
index b1fdde8d866..ed74dfd4823 100644
--- a/pkgs/development/compilers/chicken/5/chicken.nix
+++ b/pkgs/development/compilers/chicken/5/chicken.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, makeWrapper, darwin, bootstrap-chicken ? null }:
+{ lib, stdenv, fetchurl, makeWrapper, darwin, bootstrap-chicken ? null, testers }:
 
 let
   platform = with stdenv;
@@ -8,30 +8,41 @@ let
     else if isSunOS then "solaris"
     else "linux"; # Should be a sane default
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "chicken";
   version = "5.3.0";
 
   binaryVersion = 11;
 
   src = fetchurl {
-    url = "https://code.call-cc.org/releases/${version}/chicken-${version}.tar.gz";
+    url = "https://code.call-cc.org/releases/${finalAttrs.version}/chicken-${finalAttrs.version}.tar.gz";
     sha256 = "sha256-w62Z2PnhftgQkS75gaw7DC4vRvsOzAM7XDttyhvbDXY=";
   };
 
+  # Disable two broken tests: "static link" and "linking tests"
+  postPatch = ''
+    sed -i tests/runtests.sh -e "/static link/,+4 { s/^/# / }"
+    sed -i tests/runtests.sh -e "/linking tests/,+11 { s/^/# / }"
+  '';
+
   setupHook = lib.optional (bootstrap-chicken != null) ./setup-hook.sh;
 
-  # -fno-strict-overflow is not a supported argument in clang on darwin
-  hardeningDisable = lib.optionals stdenv.isDarwin ["strictoverflow"];
+  # -fno-strict-overflow is not a supported argument in clang
+  hardeningDisable = lib.optionals stdenv.cc.isClang [ "strictoverflow" ];
 
   makeFlags = [
-    "PLATFORM=${platform}" "PREFIX=$(out)"
-  ] ++ (lib.optionals stdenv.isDarwin [
-    "XCODE_TOOL_PATH=${darwin.binutils.bintools}/bin"
+    "PLATFORM=${platform}"
+    "PREFIX=$(out)"
     "C_COMPILER=$(CC)"
     "CXX_COMPILER=$(CXX)"
+    "TARGET_C_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
+    "TARGET_CXX_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++"
+  ] ++ (lib.optionals stdenv.isDarwin [
+    "XCODE_TOOL_PATH=${darwin.binutils.bintools}/bin"
     "LINKER_OPTIONS=-headerpad_max_install_names"
     "POSTINSTALL_PROGRAM=install_name_tool"
+  ]) ++ (lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "HOSTSYSTEM=${stdenv.hostPlatform.config}"
   ]);
 
   nativeBuildInputs = [
@@ -44,24 +55,16 @@ stdenv.mkDerivation rec {
     bootstrap-chicken
   ];
 
-  postInstall = ''
-    for f in $out/bin/*
-    do
-      wrapProgram $f \
-        --prefix PATH : ${lib.makeBinPath [ stdenv.cc ]}
-    done
-  '';
-
   doCheck = !stdenv.isDarwin;
   postCheck = ''
     ./csi -R chicken.pathname -R chicken.platform \
-       -p "(assert (equal? \"${toString binaryVersion}\" (pathname-file (car (repository-path)))))"
+       -p "(assert (equal? \"${toString finalAttrs.binaryVersion}\" (pathname-file (car (repository-path)))))"
   '';
 
-  doInstallCheck = true;
-  installCheckPhase = ''
-    $out/bin/chicken -version
-  '';
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+    command = "csi -version";
+  };
 
   meta = {
     homepage = "https://call-cc.org/";
@@ -77,4 +80,4 @@ stdenv.mkDerivation rec {
       Windows, and many Unix flavours.
     '';
   };
-}
+})
diff --git a/pkgs/development/compilers/chicken/5/eggDerivation.nix b/pkgs/development/compilers/chicken/5/eggDerivation.nix
index a85a98d46cb..2d246235592 100644
--- a/pkgs/development/compilers/chicken/5/eggDerivation.nix
+++ b/pkgs/development/compilers/chicken/5/eggDerivation.nix
@@ -17,14 +17,16 @@ in
 (stdenv.mkDerivation ({
   name = "chicken-${name}";
   propagatedBuildInputs = buildInputs;
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ chicken makeWrapper ];
   buildInputs = [ chicken ];
 
+  strictDeps = true;
+
   CSC_OPTIONS = lib.concatStringsSep " " cscOptions;
 
   buildPhase = ''
     runHook preBuild
-    chicken-install -cached -no-install ${lib.escapeShellArgs chickenInstallFlags}
+    chicken-install -cached -no-install -host ${lib.escapeShellArgs chickenInstallFlags}
     runHook postBuild
   '';
 
@@ -33,7 +35,7 @@ in
 
     export CHICKEN_INSTALL_PREFIX=$out
     export CHICKEN_INSTALL_REPOSITORY=$out/lib/chicken/${toString chicken.binaryVersion}
-    chicken-install -cached ${lib.escapeShellArgs chickenInstallFlags}
+    chicken-install -cached -host ${lib.escapeShellArgs chickenInstallFlags}
 
     for f in $out/bin/*
     do
diff --git a/pkgs/development/coq-modules/coq-ext-lib/default.nix b/pkgs/development/coq-modules/coq-ext-lib/default.nix
index 8991787873f..297beaf950e 100644
--- a/pkgs/development/coq-modules/coq-ext-lib/default.nix
+++ b/pkgs/development/coq-modules/coq-ext-lib/default.nix
@@ -5,7 +5,7 @@ mkCoqDerivation rec {
   owner = "coq-ext-lib";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.11" "8.17"; out = "0.11.7"; }
+    { case = range "8.11" "8.17"; out = "0.11.8"; }
     { case = range "8.8" "8.16"; out = "0.11.6"; }
     { case = range "8.8" "8.14"; out = "0.11.4"; }
     { case = range "8.8" "8.13"; out = "0.11.3"; }
@@ -13,6 +13,7 @@ mkCoqDerivation rec {
     { case = "8.6";              out = "0.9.5"; }
     { case = "8.5";              out = "0.9.4"; }
   ] null;
+  release."0.11.8".sha256 = "sha256-uUBKJb7XjRnyb7rCisZrDcaDdsp1Bv1lXDIU3Ce8e5k=";
   release."0.11.7".sha256 = "sha256-HkxUny0mxDDT4VouBBh8btwxGZgsb459kBufTLLnuEY=";
   release."0.11.6".sha256 = "0w6iyrdszz7zc8kaybhy3mwjain2d2f83q79xfd5di0hgdayh7q7";
   release."0.11.4".sha256 = "0yp8mhrhkc498nblvhq1x4j6i9aiidkjza4wzvrkp9p8rgx5g5y3";
diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index 338e15f0248..001e477b918 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -1,9 +1,9 @@
-self: dontUse: with self;
+self: super: with self;
 
 let
-  pythonInterpreter = python.pythonForBuild.interpreter;
-  pythonSitePackages = python.sitePackages;
-  pythonCheckInterpreter = python.interpreter;
+  pythonInterpreter = super.python.pythonForBuild.interpreter;
+  pythonSitePackages = super.python.sitePackages;
+  pythonCheckInterpreter = super.python.interpreter;
   setuppy = ../run_setup.py;
 in {
   makePythonHook = args: pkgs.makeSetupHook ({passthru.provides.setupHook = true; } // args);
diff --git a/pkgs/development/interpreters/python/passthrufun.nix b/pkgs/development/interpreters/python/passthrufun.nix
index b73885b5e29..aa63f354e08 100644
--- a/pkgs/development/interpreters/python/passthrufun.nix
+++ b/pkgs/development/interpreters/python/passthrufun.nix
@@ -47,13 +47,12 @@
         selfTargetTarget = pythonOnTargetForTarget.pkgs or {}; # There is no Python TargetTarget.
       };
       hooks = import ./hooks/default.nix;
-      keep = self: hooks self {};
+      keep = lib.extends hooks pythonPackagesFun;
       extra = _: {};
       optionalExtensions = cond: as: lib.optionals cond as;
       pythonExtension = import ../../../top-level/python-packages.nix;
       python2Extension = import ../../../top-level/python2-packages.nix;
       extensions = lib.composeManyExtensions ([
-        hooks
         pythonExtension
       ] ++ (optionalExtensions (!self.isPy3k) [
         python2Extension
@@ -65,7 +64,7 @@
       otherSplices
       keep
       extra
-      (lib.extends (lib.composeExtensions aliases extensions) pythonPackagesFun))
+      (lib.extends (lib.composeExtensions aliases extensions) keep))
     {
       overrides = packageOverrides;
       python = self;
diff --git a/pkgs/development/libraries/freetype/default.nix b/pkgs/development/libraries/freetype/default.nix
index 9c5e49e046e..fc2adb673ec 100644
--- a/pkgs/development/libraries/freetype/default.nix
+++ b/pkgs/development/libraries/freetype/default.nix
@@ -38,7 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
   propagatedBuildInputs = [ zlib bzip2 brotli libpng ]; # needed when linking against freetype
 
   # dependence on harfbuzz is looser than the reverse dependence
-  nativeBuildInputs = [ pkg-config which makeWrapper ]
+  nativeBuildInputs = [ pkg-config which ]
+    ++ lib.optional (!stdenv.hostPlatform.isWindows) makeWrapper
     # FreeType requires GNU Make, which is not part of stdenv on FreeBSD.
     ++ lib.optional (!stdenv.isLinux) gnumake;
 
@@ -63,6 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = glib.flattenInclude + ''
     substituteInPlace $dev/bin/freetype-config \
       --replace ${buildPackages.pkg-config} ${pkgsHostHost.pkg-config}
+  '' + lib.optionalString (!stdenv.hostPlatform.isWindows) ''
 
     wrapProgram "$dev/bin/freetype-config" \
       --set PKG_CONFIG_PATH "$PKG_CONFIG_PATH:$dev/lib/pkgconfig"
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index 6e0f136e0e1..21325a94422 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.60";
+  version = "9.2.61";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-gai+o8XVcOj/HidvlictpnbHLUcGrNR+BLkCuEK8b7c=";
+    hash = "sha256-QIYJ0Xp1MwCHN1LcpGXF+ZjzFV7dRP6faQy1nwBiMFM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index bfaecc90957..16e34408e85 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.60";
+  version = "9.2.61";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-+LeJDSYtAdWyYu2wDm+r7nr1H+CKGxQI9CnmY/8lc/w=";
+    hash = "sha256-8nGiGDohzxiFNyvMls9EeUxcV7iFIBS2YhaE6Hep0KU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index be715ade28f..504fb66a491 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.60";
+  version = "9.2.61";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-w2dauzM7niQSbgLgSMXN5X2aU1Xj+9G/8Mah4CDMWGw=";
+    hash = "sha256-ZTS+Z0PWcA/jhBx37SVZOZ+NjPyG2VaRYMmBg0BeCDI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix b/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix
index b72ffdd4ea5..25dfe383e35 100644
--- a/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-cognitiveservices";
-  version = "13.4.0";
+  version = "13.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    hash = "sha256-GQXDIWOiKGqZqrzpNfvDR8hTU4KnpjZQKrLivcD0tsA=";
+    hash = "sha256-RK8LGbH4J+nN6gnGBUweZgkqUcMrwe9aVtvZtAvFeBU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-kusto/default.nix b/pkgs/development/python-modules/azure-mgmt-kusto/default.nix
index b4321d50dba..5195c0102db 100644
--- a/pkgs/development/python-modules/azure-mgmt-kusto/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-kusto/default.nix
@@ -6,13 +6,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "3.1.0";
+  version = "3.2.0";
   pname = "azure-mgmt-kusto";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dkuVCFR+w3Yr764izDqxGfKtDvgRmAuziSPpkKDWcxc=";
+    hash = "sha256-zgkFMrufHoX3gq9QXo8SlJYZOfV5GlY3pVQXmIWyx7c=";
     extension = "zip";
   };
 
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index 37e38c47ad5..e0b6126482c 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.60";
+  version = "9.2.61";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-UpNnvHlsZkDltIDJAl8m1wx79MByRpBjUneiTW0PZr8=";
+    hash = "sha256-ibxXVHVskDF0DcOWccNKQpWu2V50ZSLCoZHRo+XEZTM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index d02cf1d1e37..3435e20b65e 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -16,7 +16,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.60";
+  version = "9.2.61";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-CpJiRcaZGM7AOzO1HqCmzWJAFhS2fHmSOJsRLs3VPFc=";
+    hash = "sha256-iAKHNVAtUdm+ZTk5nXejI7WdEV9sTjLnfZ4B6Wxzk18=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jsonmerge/default.nix b/pkgs/development/python-modules/jsonmerge/default.nix
index 6dfa6914f42..6d2c8b10108 100644
--- a/pkgs/development/python-modules/jsonmerge/default.nix
+++ b/pkgs/development/python-modules/jsonmerge/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "jsonmerge";
-  version = "1.9.0";
+  version = "1.9.2";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-otH4ACHFwdcKSeMfhitfBo+dsGYIDYVh6AZU3nSjWE0=";
+    hash = "sha256-xDdX4BgLDhm3rkwTCtQqB8xYDDGRL2H0gj6Ory+jlKM=";
   };
 
   propagatedBuildInputs = [ jsonschema ];
diff --git a/pkgs/development/python-modules/kasa-crypt/default.nix b/pkgs/development/python-modules/kasa-crypt/default.nix
index a761c978593..a9b15b4390d 100644
--- a/pkgs/development/python-modules/kasa-crypt/default.nix
+++ b/pkgs/development/python-modules/kasa-crypt/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "kasa-crypt";
-  version = "0.2.1";
+  version = "0.3.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = "kasa-crypt";
     rev = "refs/tags/v${version}";
-    hash = "sha256-VAm/jHeG/LfLpouHc3mSX8Kr8u/keHY552dLzoGaPrQ=";
+    hash = "sha256-w0LdGPVsxTi7jlfS/HSBEZdjL9ZKclucnBVViwrVC6Y=";
   };
 
   postPatch = ''
@@ -44,7 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Fast kasa crypt";
     homepage = "https://github.com/bdraco/kasa-crypt";
-    changelog = "https://github.com/bdraco/kasa-crypt/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/bdraco/kasa-crypt/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index 9b1d8424faf..26af176ec47 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.60";
+  version = "9.2.61";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-gDkt+6fuQ3kHfjgy3VqYGZNM9mGyJdbkt6QzNpVHzYQ=";
+    hash = "sha256-UbaaudnwsIXs/IsiZyCamnWjLndwrn244ZdbvZa7P0I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tpm2-pytss/default.nix b/pkgs/development/python-modules/tpm2-pytss/default.nix
index fe7df9d9efc..3c18e7cbdc0 100644
--- a/pkgs/development/python-modules/tpm2-pytss/default.nix
+++ b/pkgs/development/python-modules/tpm2-pytss/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , pythonOlder
 , asn1crypto
 , cffi
@@ -28,6 +29,19 @@ buildPythonPackage rec {
     hash = "sha256-W1tLFFb9wa7vPSw5cL6qB4yPfyZIyXppvPYMWi+VyJc=";
   };
 
+  patches = [
+    # This patches the call to the C preprocessor not to include types
+    # pycparser does not handle.
+    # `hardeningDisable = [ "fortify" ]` would have the same effect but
+    # would also disable hardening from generated FFI objects.
+    #
+    # backport of https://github.com/tpm2-software/tpm2-pytss/pull/523
+    (fetchpatch {
+      url = "https://github.com/baloo/tpm2-pytss/commit/099c069f28cfcd0a3019adebfeafa976f9395221.patch";
+      sha256 = "sha256-wU2WfLYFDmkhGzYornZ386tB3zb3GYfGOTc+/QOFb1o=";
+    })
+  ];
+
   nativeBuildInputs = [
     cffi
     pkgconfig # this is the Python module
diff --git a/pkgs/development/python-modules/weconnect-mqtt/default.nix b/pkgs/development/python-modules/weconnect-mqtt/default.nix
index 0bd4bec4d51..0111a43b06c 100644
--- a/pkgs/development/python-modules/weconnect-mqtt/default.nix
+++ b/pkgs/development/python-modules/weconnect-mqtt/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "weconnect-mqtt";
-  version = "0.42.3";
+  version = "0.45.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "tillsteinbach";
     repo = "WeConnect-mqtt";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TEB2UtXH73CCJhbuQjnABcG3XLHB6VybDwjhixnpt0w=";
+    hash = "sha256-lZa8HIGLSDd/avNuoYSUHJ0b3rSx8uHLuUz8lABQHO4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
index 82f67523389..c066a9c5553 100644
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "buf";
-  version = "1.24.0";
+  version = "1.25.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-DMZYjtIuN8b03UOAEtz32+Cj2MaE46v2k0IHT7YiZfk=";
+    hash = "sha256-koYRJCO9G8McoFNe2P61y+q7T4gZ1MBNAy9jFC63kds=";
   };
 
-  vendorHash = "sha256-uBM5r3cT0c4NUOfWaqkxRJ06p2GtOwvSOQfvP77ivTA=";
+  vendorHash = "sha256-2UA8rp2ZHTUnYialFXrIlH+RzfZHtdKn0dc+Dfps8ow=";
 
   patches = [
     # Skip a test that requires networking to be available to work.
diff --git a/pkgs/development/tools/build-managers/bmake/default.nix b/pkgs/development/tools/build-managers/bmake/default.nix
index 7b6e8a5123a..f1ceb79dcdf 100644
--- a/pkgs/development/tools/build-managers/bmake/default.nix
+++ b/pkgs/development/tools/build-managers/bmake/default.nix
@@ -10,13 +10,24 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bmake";
-  version = "20230414";
+  version = "20230711";
 
   src = fetchurl {
-    url = "http://www.crufty.net/ftp/pub/sjg/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
-    hash = "sha256-KcsdJqrn3p3vkr2us6rUUg6JlRzpey518LibrhuVOZ8=";
+    url = "http://www.crufty.net/ftp/pub/sjg/bmake-${finalAttrs.version}.tar.gz";
+    hash = "sha256-CoFULAPxoObCe/UBXY+7xSY04RkIOOx9p2RYR9kzL+8=";
   };
 
+  patches = [
+    # make bootstrap script aware of the prefix in /nix/store
+    ./bootstrap-fix.patch
+    # preserve PATH from build env in unit tests
+    ./fix-unexport-env-test.patch
+    # Always enable ksh test since it checks in a impure location /bin/ksh
+    ./unconditional-ksh-test.patch
+    # decouple tests from build phase
+    ./dont-test-while-installing.diff
+  ];
+
   # Make tests work with musl
   # * Disable deptgt-delete_on_error test (alpine does this too)
   # * Disable shell-ksh test (ksh doesn't compile with musl)
@@ -30,27 +41,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ getopt ];
 
-  patches = [
-    # make bootstrap script aware of the prefix in /nix/store
-    ./bootstrap-fix.patch
-    # preserve PATH from build env in unit tests
-    ./fix-unexport-env-test.patch
-    # Always enable ksh test since it checks in a impure location /bin/ksh
-    ./unconditional-ksh-test.patch
-    # decouple tests from build phase
-    (fetchpatch {
-      name = "separate-tests.patch";
-      url = "https://raw.githubusercontent.com/alpinelinux/aports/2a36f7b79df44136c4d2b8e9512f908af65adfee/community/bmake/separate-tests.patch";
-      hash = "sha256-KkmqASAl46/6Of7JLOQDFUqkOw3rGLxnNmyg7Lk0RwM=";
-    })
-    # add a shebang to bmake's install(1) replacement
-    (fetchpatch {
-      name = "install-sh.patch";
-      url = "https://raw.githubusercontent.com/alpinelinux/aports/34cd8c45397c63c041cf3cbe1ba5232fd9331196/community/bmake/install-sh.patch";
-      hash = "sha256-RvFq5nsmDxq54UTnXGlfO6Rip/XQYj0ZySatqUxjEX0=";
-    })
-  ];
-
   # The generated makefile is a small wrapper for calling ./boot-strap with a
   # given op. On a case-insensitive filesystem this generated makefile clobbers
   # a distinct, shipped, Makefile and causes infinite recursion during tests
@@ -59,17 +49,6 @@ stdenv.mkDerivation (finalAttrs: {
     "--without-makefile"
   ];
 
-  # Disabled tests:
-  # opt-chdir: ofborg complains about it somehow
-  # opt-keep-going-indirect: not yet known
-  # varmod-localtime: musl doesn't support TZDIR and this test relies on impure,
-  # implicit paths
-  BROKEN_TESTS = builtins.concatStringsSep " " [
-    "opt-chdir"
-    "opt-keep-going-indirect"
-    "varmod-localtime"
-  ];
-
   buildPhase = ''
     runHook preBuild
 
@@ -94,6 +73,17 @@ stdenv.mkDerivation (finalAttrs: {
     ksh
   ];
 
+  # Disabled tests:
+  # opt-chdir: ofborg complains about it somehow
+  # opt-keep-going-indirect: not yet known
+  # varmod-localtime: musl doesn't support TZDIR and this test relies on impure,
+  # implicit paths
+  env.BROKEN_TESTS = builtins.concatStringsSep " " [
+    "opt-chdir"
+    "opt-keep-going-indirect"
+    "varmod-localtime"
+  ];
+
   checkPhase = ''
     runHook preCheck
 
@@ -104,14 +94,15 @@ stdenv.mkDerivation (finalAttrs: {
 
   setupHook = ./setup-hook.sh;
 
-  meta = with lib; {
+  passthru.tests.bmakeMusl = pkgsMusl.bmake;
+
+  meta = {
     homepage = "http://www.crufty.net/help/sjg/bmake.html";
     description = "Portable version of NetBSD 'make'";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ thoughtpolice AndersonTorres ];
-    platforms = platforms.unix;
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ thoughtpolice AndersonTorres ];
+    platforms = lib.platforms.unix;
+    broken = stdenv.isAarch64; # failure on gnulib-tests
   };
-
-  passthru.tests.bmakeMusl = pkgsMusl.bmake;
 })
 # TODO: report the quirks and patches to bmake devteam (especially the Musl one)
diff --git a/pkgs/development/tools/build-managers/bmake/dont-test-while-installing.diff b/pkgs/development/tools/build-managers/bmake/dont-test-while-installing.diff
new file mode 100644
index 00000000000..ab9399920c2
--- /dev/null
+++ b/pkgs/development/tools/build-managers/bmake/dont-test-while-installing.diff
@@ -0,0 +1,21 @@
+diff -Naur bmake-old/boot-strap bmake-new/boot-strap
+--- bmake-old/boot-strap	2023-06-27 18:02:19.000000000 -0300
++++ bmake-new/boot-strap	2023-07-23 22:31:02.334720661 -0300
+@@ -413,9 +413,6 @@
+ 	[ -s make-bootstrap.sh ] || op_configure
+ 	chmod 755 make-bootstrap.sh || exit 1
+ 	./make-bootstrap.sh || exit 1
+-	case "$op" in
+-	build) op_test;;
+-	esac
+ }
+ 
+ op_test() {
+@@ -434,7 +431,6 @@
+ }
+ 
+ op_install() {
+-	op_test
+ 	case "$INSTALL_PREFIX,$INSTALL_BIN,$prefix" in
+ 	,$HOST_TARGET/bin,*/$HOST_TARGET)
+ 		INSTALL_PREFIX=`dirname $prefix`
diff --git a/pkgs/development/tools/build-managers/bmake/fix-localtime-test.patch b/pkgs/development/tools/build-managers/bmake/fix-localtime-test.patch
deleted file mode 100644
index b377292cce2..00000000000
--- a/pkgs/development/tools/build-managers/bmake/fix-localtime-test.patch
+++ /dev/null
@@ -1,23 +0,0 @@
---- bmake/unit-tests/Makefile.orig	2021-05-30 14:24:38.822484317 +0200
-+++ bmake/unit-tests/Makefile	2021-05-31 13:25:21.645751428 +0200
-@@ -455,7 +455,8 @@
- ENV.varmisc=		FROM_ENV=env
- ENV.varmisc+=		FROM_ENV_BEFORE=env
- ENV.varmisc+=		FROM_ENV_AFTER=env
--ENV.varmod-localtime+=	TZ=Europe/Berlin
-+# Set absolute path to tz file since musl doesn't support TZDIR
-+ENV.varmod-localtime+=	TZDIR=${TZDIR} TZ=:${TZDIR}/Europe/Berlin
- ENV.varname-vpath+=	VPATH=varname-vpath.dir:varname-vpath.dir2
- 
- # Override make flags for some of the tests; default is -k.
---- bmake/unit-tests/varmod-localtime.mk.orig	2021-05-30 14:30:34.397986246 +0200
-+++ bmake/unit-tests/varmod-localtime.mk	2021-05-31 13:24:41.430906606 +0200
-@@ -3,7 +3,7 @@
- # Tests for the :localtime variable modifier, which formats a timestamp
- # using strftime(3) in local time.
- 
--.if ${TZ} != "Europe/Berlin"	# see unit-tests/Makefile
-+.if ${TZ} != ":${TZDIR}/Europe/Berlin"	# see unit-tests/Makefile
- .  error
- .endif
- 
diff --git a/pkgs/development/tools/build-managers/bmake/setup-hook.sh b/pkgs/development/tools/build-managers/bmake/setup-hook.sh
index f477a96d57a..a36d024b111 100644
--- a/pkgs/development/tools/build-managers/bmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/bmake/setup-hook.sh
@@ -1,3 +1,5 @@
+# shellcheck shell=bash disable=SC2086,SC2154,SC2206
+
 addMakeFlags() {
     export prefix="$out"
     export MANDIR="${!outputMan}/share/man"
@@ -6,48 +8,40 @@ addMakeFlags() {
     export STRIP_FLAG=
 }
 
-preConfigureHooks+=(addMakeFlags)
-
 bmakeBuildPhase() {
     runHook preBuild
 
     local flagsArray=(
         ${enableParallelBuilding:+-j${NIX_BUILD_CORES}}
-        SHELL=$SHELL
+        SHELL="$SHELL"
         $makeFlags ${makeFlagsArray+"${makeFlagsArray[@]}"}
         $buildFlags ${buildFlagsArray+"${buildFlagsArray[@]}"}
     )
 
     echoCmd 'build flags' "${flagsArray[@]}"
     bmake ${makefile:+-f $makefile} "${flagsArray[@]}"
-    unset flagsArray
 
     runHook postBuild
 }
 
-if [ -z "${dontUseBmakeBuild-}" -a -z "${buildPhase-}" ]; then
-    buildPhase=bmakeBuildPhase
-fi
-
 bmakeCheckPhase() {
     runHook preCheck
 
     if [ -z "${checkTarget:-}" ]; then
         #TODO(@oxij): should flagsArray influence make -n?
         if bmake -n ${makefile:+-f $makefile} check >/dev/null 2>&1; then
-            checkTarget=check
+            checkTarget="check"
         elif bmake -n ${makefile:+-f $makefile} test >/dev/null 2>&1; then
-            checkTarget=test
+            checkTarget="test"
         fi
     fi
 
     if [ -z "${checkTarget:-}" ]; then
         echo "no test target found in bmake, doing nothing"
     else
-        # shellcheck disable=SC2086
         local flagsArray=(
             ${enableParallelChecking:+-j${NIX_BUILD_CORES}}
-            SHELL=$SHELL
+            SHELL="$SHELL"
             # Old bash empty array hack
             $makeFlags ${makeFlagsArray+"${makeFlagsArray[@]}"}
             ${checkFlags:-VERBOSE=y} ${checkFlagsArray+"${checkFlagsArray[@]}"}
@@ -56,17 +50,11 @@ bmakeCheckPhase() {
 
         echoCmd 'check flags' "${flagsArray[@]}"
         bmake ${makefile:+-f $makefile} "${flagsArray[@]}"
-
-        unset flagsArray
     fi
 
     runHook postCheck
 }
 
-if [ -z "${dontUseBmakeCheck-}" -a -z "${checkPhase-}" ]; then
-    checkPhase=bmakeCheckPhase
-fi
-
 bmakeInstallPhase() {
     runHook preInstall
 
@@ -74,10 +62,9 @@ bmakeInstallPhase() {
         mkdir -p "$prefix"
     fi
 
-    # shellcheck disable=SC2086
     local flagsArray=(
         ${enableParallelInstalling:+-j${NIX_BUILD_CORES}}
-        SHELL=$SHELL
+        SHELL="$SHELL"
         # Old bash empty array hack
         $makeFlags ${makeFlagsArray+"${makeFlagsArray[@]}"}
         $installFlags ${installFlagsArray+"${installFlagsArray[@]}"}
@@ -86,15 +73,10 @@ bmakeInstallPhase() {
 
     echoCmd 'install flags' "${flagsArray[@]}"
     bmake ${makefile:+-f $makefile} "${flagsArray[@]}"
-    unset flagsArray
 
     runHook postInstall
 }
 
-if [ -z "${dontUseBmakeInstall-}" -a -z "${installPhase-}" ]; then
-    installPhase=bmakeInstallPhase
-fi
-
 bmakeDistPhase() {
     runHook preDist
 
@@ -103,7 +85,6 @@ bmakeDistPhase() {
     fi
 
     # Old bash empty array hack
-    # shellcheck disable=SC2086
     local flagsArray=(
         $distFlags ${distFlagsArray+"${distFlagsArray[@]}"} ${distTarget:-dist}
     )
@@ -116,13 +97,26 @@ bmakeDistPhase() {
 
         # Note: don't quote $tarballs, since we explicitly permit
         # wildcards in there.
-        # shellcheck disable=SC2086
         cp -pvd ${tarballs:-*.tar.gz} "$out/tarballs"
     fi
 
     runHook postDist
 }
 
-if [ -z "${dontUseBmakeDist-}" -a -z "${distPhase-}" ]; then
+preConfigureHooks+=(addMakeFlags)
+
+if [ -z "${dontUseBmakeBuild-}" ] && [ -z "${buildPhase-}" ]; then
+    buildPhase=bmakeBuildPhase
+fi
+
+if [ -z "${dontUseBmakeCheck-}" ] && [ -z "${checkPhase-}" ]; then
+    checkPhase=bmakeCheckPhase
+fi
+
+if [ -z "${dontUseBmakeInstall-}" ] && [ -z "${installPhase-}" ]; then
+    installPhase=bmakeInstallPhase
+fi
+
+if [ -z "${dontUseBmakeDist-}" ] && [ -z "${distPhase-}" ]; then
     distPhase=bmakeDistPhase
 fi
diff --git a/pkgs/development/tools/mold/default.nix b/pkgs/development/tools/mold/default.nix
index ac60a01a1ae..8a83d056646 100644
--- a/pkgs/development/tools/mold/default.nix
+++ b/pkgs/development/tools/mold/default.nix
@@ -8,17 +8,18 @@
 , zlib
 , testers
 , mold
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "mold";
-  version = "1.11.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "rui314";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-dfdrXp05eJALTQnx2F3GxRWKMA+Icj0mRPcb72z7qMw=";
+    hash = "sha256-dEmwVgo9XiU3WtObVL5VbFW7rEzdFfnRepcbyGxX1JM=";
   };
 
   nativeBuildInputs = [
@@ -49,7 +50,10 @@ stdenv.mkDerivation rec {
     "-faligned-allocation"
   ]);
 
-  passthru.tests.version = testers.testVersion { package = mold; };
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion { package = mold; };
+  };
 
   meta = with lib; {
     description = "A faster drop-in replacement for existing Unix linkers";
@@ -61,7 +65,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://github.com/rui314/mold";
     changelog = "https://github.com/rui314/mold/releases/tag/v${version}";
-    license = licenses.agpl3Plus;
+    license = licenses.mit;
     maintainers = with maintainers; [ azahi nitsky ];
     platforms = platforms.unix;
   };