Merge #253854: staging-next 2023-09-07

117 files changed, 1209 insertions, 1346 deletions

diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 79dbad30a0a..0afc6586511 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -47,102 +47,43 @@ let
   inherit (lib) optionals optional;
 in
 
-optionals (is49 || is6) [
-  ./9/fix-struct-redefinition-on-glibc-2.36.patch
-] ++ optionals (is49 || (is6 && !stdenv.targetPlatform.isRedox)) [
-  ./use-source-date-epoch.patch
-] ++ optionals (is6 && !stdenv.targetPlatform.isRedox) [
-  ./6/0001-Fix-build-for-glibc-2.31.patch
-] ++ optionals (!atLeast6) [
-  ./parallel-bconfig.patch
-] ++ optionals (is49) [
-  (./. + "/${lib.versions.major version}.${lib.versions.minor version}/parallel-strsignal.patch")
-  (./. + "/${lib.versions.major version}.${lib.versions.minor version}/libsanitizer.patch")
-  (fetchpatch {
-    name = "avoid-ustat-glibc-2.28.patch";
-    url = "https://gitweb.gentoo.org/proj/gcc-patches.git/plain/4.9.4/gentoo/100_all_avoid-ustat-glibc-2.28.patch?id=55fcb515620a8f7d3bb77eba938aa0fcf0d67c96";
-    sha256 = "0b32sb4psv5lq0ij9fwhi1b4pjbwdjnv24nqprsk14dsc6xmi1g0";
-  })
-] ++ optionals (is7) [
-  # https://gcc.gnu.org/ml/gcc-patches/2018-02/msg00633.html
-  (./. + "/${majorVersion}/riscv-pthread-reentrant.patch")
-  # https://gcc.gnu.org/ml/gcc-patches/2018-03/msg00297.html
-  (./. + "/${majorVersion}/riscv-no-relax.patch")
-  # Fix for asan w/glibc-2.34. Although there's no upstream backport to v7,
-  # the patch from gcc 8 seems to work perfectly fine.
-  (./. + "/${majorVersion}/gcc8-asan-glibc-2.34.patch")
-  (./. + "/${majorVersion}/0001-Fix-build-for-glibc-2.31.patch")
-] ++ optional (majorVersion == "9") ./9/fix-struct-redefinition-on-glibc-2.36.patch
+#
+#  Patches below are organized into three general categories:
+#  1. Patches relevant to gcc>=12 on every platform
+#  2. Patches relevant to gcc>=12 on specific platforms
+#  3. Patches relevant only to gcc<12
+#
+
+
+## 1. Patches relevant to gcc>=12 on every platform ####################################
+
+[]
 ++ optional (atLeast6 && !atLeast12) ./fix-bug-80431.patch
-++ optional (is7 || is8) ./9/fix-struct-redefinition-on-glibc-2.36.patch
 ++ optional (targetPlatform != hostPlatform) ./libstdc++-target.patch
-++ optional (atLeast7 && !atLeast10 && targetPlatform.isNetBSD) ./libstdc++-netbsd-ctypes.patch
-++ optional (noSysDirs) (if atLeast12 then ./gcc-12-no-sys-dirs.patch else ./no-sys-dirs.patch)
-++ optionals (is6 && langAda) [
-  ./gnat-cflags.patch
-  ./6/gnat-glibc234.patch
-] ++ optional (noSysDirs && atLeast10 && !atLeast13 && (is10 || (!atLeast12 -> hostPlatform.isRiscV))) ./no-sys-dirs-riscv.patch
-++ optional (noSysDirs && is13) ./13/no-sys-dirs-riscv.patch
-++ optional (noSysDirs && is9 && hostPlatform.isRiscV) ./no-sys-dirs-riscv-gcc9.patch
-++ optionals (langAda || atLeast12) [
-  ./gnat-cflags-11.patch
-] ++ optionals (langAda && (is9 || is10)) [
-  ./gnat-cflags.patch
-] ++ optionals atLeast12 [
-  ./gcc-12-gfortran-driving.patch
-  ./ppc-musl.patch
-] ++ optionals is12 [
-  # backport ICE fix on ccache code
-  ./12/lambda-ICE-PR109241.patch
-]
-# We only apply this patch when building a native toolchain for aarch64-darwin, as it breaks building
-# a foreign one: https://github.com/iains/gcc-12-branch/issues/18
-++ optionals (stdenv.isDarwin && stdenv.isAarch64 && buildPlatform == hostPlatform && hostPlatform == targetPlatform) ({
-  "13" = [ (fetchpatch {
-    name = "gcc-13-darwin-aarch64-support.patch";
-    url = "https://raw.githubusercontent.com/Homebrew/formula-patches/3c5cbc8e9cf444a1967786af48e430588e1eb481/gcc/gcc-13.2.0.diff";
-    sha256 = "sha256-Y5r3U3dwAFG6+b0TNCFd18PNxYu2+W/5zDbZ5cHvv+U=";
-  }) ];
-  "12" = [ (fetchurl {
-    name = "gcc-12-darwin-aarch64-support.patch";
-    url = "https://raw.githubusercontent.com/Homebrew/formula-patches/f1188b90d610e2ed170b22512ff7435ba5c891e2/gcc/gcc-12.3.0.diff";
-    sha256 = "sha256-naL5ZNiurqfDBiPSU8PTbTmLqj25B+vjjiqc4fAFgYs=";
-  }) ];
-}."${majorVersion}" or [])
+++ optionals (noSysDirs) (
+  [(if atLeast12 then ./gcc-12-no-sys-dirs.patch else ./no-sys-dirs.patch)] ++
+  ({
+    "13" = [ ./13/no-sys-dirs-riscv.patch ];
+    "12" = [ ./no-sys-dirs-riscv.patch ];
+    "11" = [ ./no-sys-dirs-riscv.patch ];
+    "10" = [ ./no-sys-dirs-riscv.patch ];
+    "9"  = [ ./no-sys-dirs-riscv-gcc9.patch ];
+  }."${majorVersion}" or [])
+)
+++ optional (atLeast12 && langAda) ./gnat-cflags-11.patch
+++ optional langFortran (if atLeast12 then ./gcc-12-gfortran-driving.patch else ./gfortran-driving.patch)
+++ optional atLeast7 ./ppc-musl.patch
+++ optional is12 ./12/lambda-ICE-PR109241.patch # backport ICE fix on ccache code
 ++ optional (atLeast9 && langD) ./libphobos.patch
-++ optional (is7 && hostPlatform != buildPlatform) (fetchpatch { # XXX: Refine when this should be applied
-  url = "https://git.busybox.net/buildroot/plain/package/gcc/7.1.0/0900-remove-selftests.patch?id=11271540bfe6adafbc133caf6b5b902a816f5f02";
-  sha256 = "0mrvxsdwip2p3l17dscpc1x8vhdsciqw1z5q9i6p5g9yg1cqnmgs";
-})
-++ optional (!atLeast12 && langFortran) ./gfortran-driving.patch
-++ optional (!atLeast49 && hostPlatform.isDarwin) ./gfortran-darwin-NXConstStr.patch
-++ optionals (is49) [
-  # glibc-2.26
-  ./struct-ucontext.patch
-  ./struct-sigaltstack-4.9.patch
-]
-# TODO: deduplicate this with copy above -- leaving duplicated for now in order to avoid changing eval results by reordering
-++ optional (atLeast7 && !atLeast12 && targetPlatform.libc == "musl" && targetPlatform.isPower) ./ppc-musl.patch
-++ optional ((is6 || is7) && targetPlatform.libc == "musl" && targetPlatform.isx86_32) (fetchpatch {
-  url = "https://git.alpinelinux.org/aports/plain/main/gcc/gcc-6.1-musl-libssp.patch?id=5e4b96e23871ee28ef593b439f8c07ca7c7eb5bb";
-  sha256 = "1jf1ciz4gr49lwyh8knfhw6l5gvfkwzjy90m7qiwkcbsf4a3fqn2";
-})
-++ optional ((is6 || is7 || is8) && !atLeast9 && targetPlatform.libc == "musl") ./libgomp-dont-force-initial-exec.patch
-++ optional (is6 && langGo) ./gogcc-workaround-glibc-2.36.patch
-# TODO: deduplicate this with copy above -- leaving duplicated for now in order to avoid changing eval results by reordering
-++ optionals (is11 && stdenv.isDarwin) [
-  (fetchpatch {
-    # There are no upstream release tags in https://github.com/iains/gcc-11-branch.
-    # ff4bf32 is the commit from https://github.com/gcc-mirror/gcc/releases/tag/releases%2Fgcc-11.4.0
-    url = "https://github.com/iains/gcc-11-branch/compare/ff4bf326d03e750a8d4905ea49425fe7d15a04b8..gcc-11.4-darwin-r0.diff";
-    hash = "sha256-6prPgR2eGVJs7vKd6iM1eZsEPCD1ShzLns2Z+29vlt4=";
-  })
-]
-# https://github.com/osx-cross/homebrew-avr/issues/280#issuecomment-1272381808
-++ optional (is11 && stdenv.isDarwin && targetPlatform.isAvr) ./avr-gcc-11.3-darwin.patch
+
+
+
+## 2. Patches relevant to gcc>=12 on specific platforms ####################################
+
+### Musl+Go+gcc12
 
 # backport fixes to build gccgo with musl libc
-++ optionals (atLeast12 && langGo && stdenv.hostPlatform.isMusl) [
+++ optionals (stdenv.hostPlatform.isMusl && langGo && atLeast12) [
   (fetchpatch {
     excludes = [ "gcc/go/gofrontend/MERGE" ];
     url = "https://github.com/gcc-mirror/gcc/commit/cf79b1117bd177d3d4c6ed24b6fa243c3628ac2d.diff";
@@ -179,16 +120,143 @@ optionals (is49 || is6) [
   })
 ]
 
+
+## Darwin
+
 # Fix detection of bootstrap compiler Ada support (cctools as) on Nix Darwin
 ++ optional (atLeast12 && stdenv.isDarwin && langAda) ./ada-cctools-as-detection-configure.patch
 
 # Use absolute path in GNAT dylib install names on Darwin
 ++ optional (atLeast12 && stdenv.isDarwin && langAda) ./gnat-darwin-dylib-install-name.patch
 
+# We only apply this patch when building a native toolchain for aarch64-darwin, as it breaks building
+# a foreign one: https://github.com/iains/gcc-12-branch/issues/18
+++ optionals (stdenv.isDarwin && stdenv.isAarch64 && buildPlatform == hostPlatform && hostPlatform == targetPlatform) ({
+  "13" = [ (fetchpatch {
+    name = "gcc-13-darwin-aarch64-support.patch";
+    url = "https://raw.githubusercontent.com/Homebrew/formula-patches/3c5cbc8e9cf444a1967786af48e430588e1eb481/gcc/gcc-13.2.0.diff";
+    sha256 = "sha256-Y5r3U3dwAFG6+b0TNCFd18PNxYu2+W/5zDbZ5cHvv+U=";
+  }) ];
+  "12" = [ (fetchurl {
+    name = "gcc-12-darwin-aarch64-support.patch";
+    url = "https://raw.githubusercontent.com/Homebrew/formula-patches/f1188b90d610e2ed170b22512ff7435ba5c891e2/gcc/gcc-12.3.0.diff";
+    sha256 = "sha256-naL5ZNiurqfDBiPSU8PTbTmLqj25B+vjjiqc4fAFgYs=";
+  }) ];
+  "11" = [ (fetchpatch {
+    # There are no upstream release tags in https://github.com/iains/gcc-11-branch.
+    # ff4bf32 is the commit from https://github.com/gcc-mirror/gcc/releases/tag/releases%2Fgcc-11.4.0
+    url = "https://github.com/iains/gcc-11-branch/compare/ff4bf326d03e750a8d4905ea49425fe7d15a04b8..gcc-11.4-darwin-r0.diff";
+    hash = "sha256-6prPgR2eGVJs7vKd6iM1eZsEPCD1ShzLns2Z+29vlt4=";
+  }) ];
+}.${majorVersion} or [])
+
+
+## Windows
+
 # Obtain latest patch with ../update-mcfgthread-patches.sh
 ++ optional (atLeast6 && !atLeast13 && !withoutTargetLibc && targetPlatform.isMinGW && threadsCross.model == "mcf")
   (./. + "/${majorVersion}/Added-mcf-thread-model-support-from-mcfgthread.patch")
 
+
+
+
+##############################################################################
+##
+##  3. Patches relevant only to gcc<12
+##
+##  Above this point are patches which might potentially be applied
+##  to gcc version 12 or newer.  Below this point are patches which
+##  will *only* be used for gcc versions older than gcc12.
+##
+##############################################################################
+
+
+
+
+## gcc 11.0 and older ##############################################################################
+
+# https://github.com/osx-cross/homebrew-avr/issues/280#issuecomment-1272381808
+++ optional (is11 && stdenv.isDarwin && targetPlatform.isAvr) ./avr-gcc-11.3-darwin.patch
+
+# openjdk build fails without this on -march=opteron; is upstream in gcc12
+++ optionals (is11) [ ./11/gcc-issue-103910.patch ]
+
+
+
+## gcc 10.0 and older ##############################################################################
+
+++ optional (langAda && (is9 || is10)) ./gnat-cflags.patch
+++ optional (is10 && buildPlatform.system == "aarch64-darwin" && targetPlatform != buildPlatform) (fetchpatch {
+  url = "https://raw.githubusercontent.com/richard-vd/musl-cross-make/5e9e87f06fc3220e102c29d3413fbbffa456fcd6/patches/gcc-${version}/0008-darwin-aarch64-self-host-driver.patch";
+  sha256 = "sha256-XtykrPd5h/tsnjY1wGjzSOJ+AyyNLsfnjuOZ5Ryq9vA=";
+})
+
+
+## gcc 9.0 and older ##############################################################################
+
+++ optional (majorVersion == "9") ./9/fix-struct-redefinition-on-glibc-2.36.patch
+++ optional (atLeast7 && !atLeast10 && targetPlatform.isNetBSD) ./libstdc++-netbsd-ctypes.patch
+
+
+## gcc 8.0 and older ##############################################################################
+
+# for 49 this is applied later
+++ optional (atLeast49 && !is49 && !atLeast9) ./libsanitizer-no-cyclades-9.patch
+++ optional (is7 || is8) ./9/fix-struct-redefinition-on-glibc-2.36.patch
+
+
+## gcc 7.0 and older ##############################################################################
+
+++ optional (is7 && hostPlatform != buildPlatform) (fetchpatch { # XXX: Refine when this should be applied
+  url = "https://git.busybox.net/buildroot/plain/package/gcc/7.1.0/0900-remove-selftests.patch?id=11271540bfe6adafbc133caf6b5b902a816f5f02";
+  sha256 = "0mrvxsdwip2p3l17dscpc1x8vhdsciqw1z5q9i6p5g9yg1cqnmgs";
+})
+++ optionals (is7) [
+  # https://gcc.gnu.org/ml/gcc-patches/2018-02/msg00633.html
+  (./. + "/${majorVersion}/riscv-pthread-reentrant.patch")
+  # https://gcc.gnu.org/ml/gcc-patches/2018-03/msg00297.html
+  (./. + "/${majorVersion}/riscv-no-relax.patch")
+  # Fix for asan w/glibc-2.34. Although there's no upstream backport to v7,
+  # the patch from gcc 8 seems to work perfectly fine.
+  (./. + "/${majorVersion}/gcc8-asan-glibc-2.34.patch")
+  (./. + "/${majorVersion}/0001-Fix-build-for-glibc-2.31.patch")
+]
+++ optional ((is6 || is7) && targetPlatform.libc == "musl" && targetPlatform.isx86_32) (fetchpatch {
+  url = "https://git.alpinelinux.org/aports/plain/main/gcc/gcc-6.1-musl-libssp.patch?id=5e4b96e23871ee28ef593b439f8c07ca7c7eb5bb";
+  sha256 = "1jf1ciz4gr49lwyh8knfhw6l5gvfkwzjy90m7qiwkcbsf4a3fqn2";
+})
+++ optional ((is6 || is7 || is8) && !atLeast9 && targetPlatform.libc == "musl") ./libgomp-dont-force-initial-exec.patch
+
+
+
+## gcc 6.0 and older ##############################################################################
+
+++ optional (is6 && langGo) ./gogcc-workaround-glibc-2.36.patch
+++ optional (is49 || is6) ./9/fix-struct-redefinition-on-glibc-2.36.patch
+++ optional (is49 || (is6 && !stdenv.targetPlatform.isRedox)) ./use-source-date-epoch.patch
+++ optional (is6 && !stdenv.targetPlatform.isRedox) ./6/0001-Fix-build-for-glibc-2.31.patch
+++ optionals (is6 && langAda) [
+  ./gnat-cflags.patch
+  ./6/gnat-glibc234.patch
+]
+
+## gcc 4.9 and older ##############################################################################
+
+++ optional (!atLeast6) ./parallel-bconfig.patch
+++ optionals (is49) [
+  (./. + "/${lib.versions.major version}.${lib.versions.minor version}/parallel-strsignal.patch")
+  (./. + "/${lib.versions.major version}.${lib.versions.minor version}/libsanitizer.patch")
+  (fetchpatch {
+    name = "avoid-ustat-glibc-2.28.patch";
+    url = "https://gitweb.gentoo.org/proj/gcc-patches.git/plain/4.9.4/gentoo/100_all_avoid-ustat-glibc-2.28.patch?id=55fcb515620a8f7d3bb77eba938aa0fcf0d67c96";
+    sha256 = "0b32sb4psv5lq0ij9fwhi1b4pjbwdjnv24nqprsk14dsc6xmi1g0";
+  })
+  # has to be applied after "avoid-ustat-glibc-2.28.patch"
+  ./libsanitizer-no-cyclades-9.patch
+  # glibc-2.26
+  ./struct-ucontext.patch
+  ./struct-sigaltstack-4.9.patch
+]
 # Retpoline patches pulled from the branch hjl/indirect/gcc-4_9-branch (by H.J. Lu, the author of GCC upstream retpoline commits)
 ++ optionals is49
   (builtins.map ({commit, sha256}: fetchpatch {url = "https://github.com/hjl-tools/gcc/commit/${commit}.patch"; inherit sha256;})
@@ -206,7 +274,6 @@ optionals (is49 || is6) [
    { commit = "1e961ed49b18e176c7457f53df2433421387c23b"; sha256 = "04dnqqs4qsvz4g8cq6db5id41kzys7hzhcaycwmc9rpqygs2ajwz"; }
    { commit = "e137c72d099f9b3b47f4cc718aa11eab14df1a9c"; sha256 = "1ms0dmz74yf6kwgjfs4d2fhj8y6mcp2n184r3jk44wx2xc24vgb2"; }])
 
-++ optional (atLeast49 && !atLeast9) ./libsanitizer-no-cyclades-9.patch
 ++ optional (is49 && !atLeast6) [
   # gcc-11 compatibility
   (fetchpatch {
@@ -217,14 +284,11 @@ optionals (is49 || is6) [
   })
 ]
 
-# openjdk build fails without this on -march=opteron; is upstream in gcc12
-++ optionals (is11) [ ./11/gcc-issue-103910.patch ]
 
-++ optional (is10 && buildPlatform.system == "aarch64-darwin" && targetPlatform != buildPlatform) (fetchpatch {
-  url = "https://raw.githubusercontent.com/richard-vd/musl-cross-make/5e9e87f06fc3220e102c29d3413fbbffa456fcd6/patches/gcc-${version}/0008-darwin-aarch64-self-host-driver.patch";
-  sha256 = "sha256-XtykrPd5h/tsnjY1wGjzSOJ+AyyNLsfnjuOZ5Ryq9vA=";
-})
-++ lib.optionals is48 [
+## gcc 4.8 only ##############################################################################
+
+++ optional (!atLeast49 && hostPlatform.isDarwin) ./gfortran-darwin-NXConstStr.patch
+++ optionals is48 [
   (fetchpatch {
     name = "libc_name_p.diff"; # needed to build with gcc6
     url = "https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff_plain;h=ec1cc0263f1";
diff --git a/pkgs/development/compilers/go/1.20.nix b/pkgs/development/compilers/go/1.20.nix
index 3364ea35401..26fbc9e7df2 100644
--- a/pkgs/development/compilers/go/1.20.nix
+++ b/pkgs/development/compilers/go/1.20.nix
@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.20.7";
+  version = "1.20.8";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    hash = "sha256-LF7pyeweczsNu8K9/tP2IwblHYFyvzj09OVCsnUg9Zc=";
+    hash = "sha256-ONcXFPpSeflyQEUZVtjkfjwbal3ny4QTeUnWK13TGC4=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/llvm/10/bintools/default.nix b/pkgs/development/compilers/llvm/10/bintools/default.nix
deleted file mode 100644
index 38002439c20..00000000000
--- a/pkgs/development/compilers/llvm/10/bintools/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
index 6aed5d219a5..3702509d775 100644
--- a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation {
   outputs = [ "out" "dev" ];
 
   patches = [
-    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    ../../common/compiler-rt/7-12-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./find-darwin-sdk-version.patch # don't test for macOS being >= 10.15
     ./gnu-install-dirs.patch
     ../../common/compiler-rt/libsanitizer-no-cyclades-11.patch
diff --git a/pkgs/development/compilers/llvm/10/default.nix b/pkgs/development/compilers/llvm/10/default.nix
index c1ea3a86342..37c32e425c6 100644
--- a/pkgs/development/compilers/llvm/10/default.nix
+++ b/pkgs/development/compilers/llvm/10/default.nix
@@ -137,7 +137,7 @@ let
         ./lldb/procfs.patch
         ./lldb/gnu-install-dirs.patch
       ];
-      inherit llvm_meta release_version;
+      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -147,7 +147,7 @@ let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/10/libcxxabi/default.nix b/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
index d59191dfd72..c4eba56a6b8 100644
--- a/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
@@ -19,11 +19,11 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -d $(ls -d libcxx-*) -i ${../../libcxx-0001-musl-hacks.patch}
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d $(ls -d llvm-*) -i ${./wasm.patch}
+    patch -p1 -d $(ls -d llvm-*) -i ${../../common/libcxxabi/wasm.patch}
   '';
 
   patches = [
-    ./no-threads.patch
+    ../../common/libcxxabi/no-threads.patch
     ./gnu-install-dirs.patch
   ];
 
diff --git a/pkgs/development/compilers/llvm/11/bintools/default.nix b/pkgs/development/compilers/llvm/11/bintools/default.nix
deleted file mode 100644
index 38002439c20..00000000000
--- a/pkgs/development/compilers/llvm/11/bintools/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt/codesign.patch b/pkgs/development/compilers/llvm/11/compiler-rt/codesign.patch
deleted file mode 100644
index 3cc12b94b20..00000000000
--- a/pkgs/development/compilers/llvm/11/compiler-rt/codesign.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 3dec5f3475a26aeb4678627795c4b67c6b7b4785 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Tue, 19 Sep 2017 13:13:06 -0500
-Subject: [PATCH] remove codesign use on Apple, disable ios sim testing that
- needs it
-
----
- cmake/Modules/AddCompilerRT.cmake |  8 ------
- test/asan/CMakeLists.txt          | 52 ---------------------------------------
- test/tsan/CMakeLists.txt          | 47 -----------------------------------
- 3 files changed, 107 deletions(-)
-
-diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
-index bc5fb9ff7..b64eb4246 100644
---- a/cmake/Modules/AddCompilerRT.cmake
-+++ b/cmake/Modules/AddCompilerRT.cmake
-@@ -210,14 +210,6 @@ function(add_compiler_rt_runtime name type)
-         set_target_properties(${libname} PROPERTIES IMPORT_PREFIX "")
-         set_target_properties(${libname} PROPERTIES IMPORT_SUFFIX ".lib")
-       endif()
--      if(APPLE)
--        # Ad-hoc sign the dylibs
--        add_custom_command(TARGET ${libname}
--          POST_BUILD  
--          COMMAND codesign --sign - $<TARGET_FILE:${libname}>
--          WORKING_DIRECTORY ${COMPILER_RT_LIBRARY_OUTPUT_DIR}
--        )
--      endif()
-     endif()
-     install(TARGETS ${libname}
-       ARCHIVE DESTINATION ${COMPILER_RT_LIBRARY_INSTALL_DIR}
-2.14.1
-
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
index aaea3bf9e0d..38dc7a0fbdc 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
   outputs = [ "out" "dev" ];
 
   patches = [
-    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    ../../common/compiler-rt/7-12-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
     ./gnu-install-dirs.patch
     # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index acb649cdab0..6ce7d86c835 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -152,7 +152,7 @@ let
         ./lldb/procfs.patch
         ./lldb/gnu-install-dirs.patch
       ];
-      inherit llvm_meta release_version;
+      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -162,7 +162,7 @@ let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/11/libcxxabi/default.nix b/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
index 77f7e141188..8a0a18f6782 100644
--- a/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
@@ -22,11 +22,11 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -d libcxx -i ${../../libcxx-0001-musl-hacks.patch}
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d llvm -i ${./wasm.patch}
+    patch -p1 -d llvm -i ${../../common/libcxxabi/wasm.patch}
   '';
 
   patches = [
-    ./no-threads.patch
+    ../../common/libcxxabi/no-threads.patch
     ./gnu-install-dirs.patch
   ];
 
diff --git a/pkgs/development/compilers/llvm/11/libcxxabi/no-threads.patch b/pkgs/development/compilers/llvm/11/libcxxabi/no-threads.patch
deleted file mode 100644
index 787f3e16500..00000000000
--- a/pkgs/development/compilers/llvm/11/libcxxabi/no-threads.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 4138acf..41b4763 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -362,6 +362,7 @@ if (NOT LIBCXXABI_ENABLE_THREADS)
-                         " is also set to ON.")
-   endif()
-   add_definitions(-D_LIBCXXABI_HAS_NO_THREADS)
-+  add_definitions(-D_LIBCPP_HAS_NO_THREADS)
- endif()
- 
- if (LIBCXXABI_HAS_EXTERNAL_THREAD_API)
diff --git a/pkgs/development/compilers/llvm/11/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/11/libcxxabi/wasm.patch
deleted file mode 100644
index 4ebfe46aa81..00000000000
--- a/pkgs/development/compilers/llvm/11/libcxxabi/wasm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
-index 15497d405e0..33f7f18193a 100644
---- a/cmake/modules/HandleLLVMOptions.cmake
-+++ b/cmake/modules/HandleLLVMOptions.cmake
-@@ -127,7 +127,10 @@ else(WIN32)
-       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
-     endif()
-   else(FUCHSIA OR UNIX)
--    MESSAGE(SEND_ERROR "Unable to determine platform")
-+    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
-+    else()
-+      MESSAGE(SEND_ERROR "Unable to determine platform")
-+    endif()
-   endif(FUCHSIA OR UNIX)
- endif(WIN32)
- 
diff --git a/pkgs/development/compilers/llvm/12/bintools/default.nix b/pkgs/development/compilers/llvm/12/bintools/default.nix
deleted file mode 100644
index 38002439c20..00000000000
--- a/pkgs/development/compilers/llvm/12/bintools/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/12/compiler-rt/codesign.patch b/pkgs/development/compilers/llvm/12/compiler-rt/codesign.patch
deleted file mode 100644
index 3cc12b94b20..00000000000
--- a/pkgs/development/compilers/llvm/12/compiler-rt/codesign.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 3dec5f3475a26aeb4678627795c4b67c6b7b4785 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Tue, 19 Sep 2017 13:13:06 -0500
-Subject: [PATCH] remove codesign use on Apple, disable ios sim testing that
- needs it
-
----
- cmake/Modules/AddCompilerRT.cmake |  8 ------
- test/asan/CMakeLists.txt          | 52 ---------------------------------------
- test/tsan/CMakeLists.txt          | 47 -----------------------------------
- 3 files changed, 107 deletions(-)
-
-diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
-index bc5fb9ff7..b64eb4246 100644
---- a/cmake/Modules/AddCompilerRT.cmake
-+++ b/cmake/Modules/AddCompilerRT.cmake
-@@ -210,14 +210,6 @@ function(add_compiler_rt_runtime name type)
-         set_target_properties(${libname} PROPERTIES IMPORT_PREFIX "")
-         set_target_properties(${libname} PROPERTIES IMPORT_SUFFIX ".lib")
-       endif()
--      if(APPLE)
--        # Ad-hoc sign the dylibs
--        add_custom_command(TARGET ${libname}
--          POST_BUILD  
--          COMMAND codesign --sign - $<TARGET_FILE:${libname}>
--          WORKING_DIRECTORY ${COMPILER_RT_LIBRARY_OUTPUT_DIR}
--        )
--      endif()
-     endif()
-     install(TARGETS ${libname}
-       ARCHIVE DESTINATION ${COMPILER_RT_LIBRARY_INSTALL_DIR}
-2.14.1
-
diff --git a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
index 82c190fa0d6..02c20016bad 100644
--- a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation {
   outputs = [ "out" "dev" ];
 
   patches = [
-    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    ../../common/compiler-rt/7-12-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
     ./gnu-install-dirs.patch
     # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
diff --git a/pkgs/development/compilers/llvm/12/default.nix b/pkgs/development/compilers/llvm/12/default.nix
index e390149f0da..b976dd2ee67 100644
--- a/pkgs/development/compilers/llvm/12/default.nix
+++ b/pkgs/development/compilers/llvm/12/default.nix
@@ -139,19 +139,20 @@ let
       src = fetch "lldb" "0g3pj1m3chafavpr35r9fynm85y2hdyla6klj0h28khxs2613i78";
       patches =
         let
-          resourceDirPatch = callPackage ({ runCommand, libclang }: (runCommand "resource-dir.patch"
-            {
-              clangLibDir = "${libclang.lib}/lib";
-            } ''
-            substitute '${./lldb/resource-dir.patch}' "$out" --subst-var clangLibDir
-          '')) { };
+          resourceDirPatch = callPackage
+            ({ substituteAll, libclang }: substituteAll
+              {
+                src = ./lldb/resource-dir.patch;
+                clangLibDir = "${libclang.lib}/lib";
+              })
+            { };
         in
         [
           ./lldb/procfs.patch
           resourceDirPatch
           ./lldb/gnu-install-dirs.patch
         ];
-      inherit llvm_meta release_version;
+      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -161,7 +162,7 @@ let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/12/libcxxabi/default.nix b/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
index bab39a5272c..78a4a68d6a1 100644
--- a/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -d libcxx -i ${../../libcxx-0001-musl-hacks.patch}
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d llvm -i ${./wasm.patch}
+    patch -p1 -d llvm -i ${../../common/libcxxabi/wasm.patch}
   '';
 
   patches = [
diff --git a/pkgs/development/compilers/llvm/12/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/12/libcxxabi/wasm.patch
deleted file mode 100644
index 4ebfe46aa81..00000000000
--- a/pkgs/development/compilers/llvm/12/libcxxabi/wasm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
-index 15497d405e0..33f7f18193a 100644
---- a/cmake/modules/HandleLLVMOptions.cmake
-+++ b/cmake/modules/HandleLLVMOptions.cmake
-@@ -127,7 +127,10 @@ else(WIN32)
-       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
-     endif()
-   else(FUCHSIA OR UNIX)
--    MESSAGE(SEND_ERROR "Unable to determine platform")
-+    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
-+    else()
-+      MESSAGE(SEND_ERROR "Unable to determine platform")
-+    endif()
-   endif(FUCHSIA OR UNIX)
- endif(WIN32)
- 
diff --git a/pkgs/development/compilers/llvm/13/bintools/default.nix b/pkgs/development/compilers/llvm/13/bintools/default.nix
deleted file mode 100644
index b69f4bd1291..00000000000
--- a/pkgs/development/compilers/llvm/13/bintools/default.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-rc $out/bin/${prefix}windres
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/13/default.nix b/pkgs/development/compilers/llvm/13/default.nix
index 0432dcd1431..3cf7cd711eb 100644
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@@ -138,12 +138,13 @@ let
     lldb = callPackage ../common/lldb.nix {
       patches =
         let
-          resourceDirPatch = callPackage ({ runCommand, libclang }: (runCommand "resource-dir.patch"
-            {
-              clangLibDir = "${libclang.lib}/lib";
-            } ''
-            substitute '${./lldb/resource-dir.patch}' "$out" --subst-var clangLibDir
-          '')) { };
+          resourceDirPatch = callPackage
+            ({ substituteAll, libclang }: substituteAll
+              {
+                src = ./lldb/resource-dir.patch;
+                clangLibDir = "${libclang.lib}/lib";
+              })
+            { };
         in
         [
           ./lldb/procfs.patch
@@ -164,7 +165,7 @@ let
             && !stdenv.targetPlatform.isAarch64
             && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
         ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-      inherit llvm_meta release_version;
+      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -174,7 +175,7 @@ let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/13/libcxxabi/default.nix b/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
index b1b57b3050a..50f09831e97 100644
--- a/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   postUnpack = lib.optionalString stdenv.isDarwin ''
     export TRIPLE=x86_64-apple-darwin
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d llvm -i ${./wasm.patch}
+    patch -p1 -d llvm -i ${../../common/libcxxabi/wasm.patch}
   '';
 
   patches = [
diff --git a/pkgs/development/compilers/llvm/13/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/13/libcxxabi/wasm.patch
deleted file mode 100644
index 4ebfe46aa81..00000000000
--- a/pkgs/development/compilers/llvm/13/libcxxabi/wasm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
-index 15497d405e0..33f7f18193a 100644
---- a/cmake/modules/HandleLLVMOptions.cmake
-+++ b/cmake/modules/HandleLLVMOptions.cmake
-@@ -127,7 +127,10 @@ else(WIN32)
-       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
-     endif()
-   else(FUCHSIA OR UNIX)
--    MESSAGE(SEND_ERROR "Unable to determine platform")
-+    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
-+    else()
-+      MESSAGE(SEND_ERROR "Unable to determine platform")
-+    endif()
-   endif(FUCHSIA OR UNIX)
- endif(WIN32)
- 
diff --git a/pkgs/development/compilers/llvm/14/bintools/default.nix b/pkgs/development/compilers/llvm/14/bintools/default.nix
deleted file mode 100644
index b69f4bd1291..00000000000
--- a/pkgs/development/compilers/llvm/14/bintools/default.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-rc $out/bin/${prefix}windres
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/14/default.nix b/pkgs/development/compilers/llvm/14/default.nix
index 75a52b60960..b9a74e0f070 100644
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ b/pkgs/development/compilers/llvm/14/default.nix
@@ -139,12 +139,13 @@ let
     lldb = callPackage ../common/lldb.nix {
       patches =
         let
-          resourceDirPatch = callPackage ({ runCommand, libclang }: (runCommand "resource-dir.patch"
-            {
-              clangLibDir = "${libclang.lib}/lib";
-            } ''
-            substitute '${./lldb/resource-dir.patch}' "$out" --subst-var clangLibDir
-          '')) { };
+          resourceDirPatch = callPackage
+            ({ substituteAll, libclang }: substituteAll
+              {
+                src = ./lldb/resource-dir.patch;
+                clangLibDir = "${libclang.lib}/lib";
+              })
+            { };
         in
         [
           ./lldb/procfs.patch
@@ -165,7 +166,7 @@ let
             && !stdenv.targetPlatform.isAarch64
             && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
         ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-      inherit llvm_meta release_version;
+      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -175,7 +176,7 @@ let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/14/libcxxabi/default.nix b/pkgs/development/compilers/llvm/14/libcxxabi/default.nix
index 30cc34a8c0e..0f7cec3695d 100644
--- a/pkgs/development/compilers/llvm/14/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/14/libcxxabi/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   postUnpack = lib.optionalString stdenv.isDarwin ''
     export TRIPLE=x86_64-apple-darwin
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d llvm -i ${./wasm.patch}
+    patch -p1 -d llvm -i ${../../common/libcxxabi/wasm.patch}
   '';
 
   patches = [
diff --git a/pkgs/development/compilers/llvm/14/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/14/libcxxabi/wasm.patch
deleted file mode 100644
index 4ebfe46aa81..00000000000
--- a/pkgs/development/compilers/llvm/14/libcxxabi/wasm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
-index 15497d405e0..33f7f18193a 100644
---- a/cmake/modules/HandleLLVMOptions.cmake
-+++ b/cmake/modules/HandleLLVMOptions.cmake
-@@ -127,7 +127,10 @@ else(WIN32)
-       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
-     endif()
-   else(FUCHSIA OR UNIX)
--    MESSAGE(SEND_ERROR "Unable to determine platform")
-+    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
-+    else()
-+      MESSAGE(SEND_ERROR "Unable to determine platform")
-+    endif()
-   endif(FUCHSIA OR UNIX)
- endif(WIN32)
- 
diff --git a/pkgs/development/compilers/llvm/15/bintools/default.nix b/pkgs/development/compilers/llvm/15/bintools/default.nix
deleted file mode 100644
index c7b20dd28e2..00000000000
--- a/pkgs/development/compilers/llvm/15/bintools/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-debuginfod $out/bin/${prefix}debuginfod
-   ln -s ${llvm}/bin/llvm-debuginfod-find $out/bin/${prefix}debuginfod-find
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-rc $out/bin/${prefix}windres
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/15/default.nix b/pkgs/development/compilers/llvm/15/default.nix
index f244987353b..863d31874ec 100644
--- a/pkgs/development/compilers/llvm/15/default.nix
+++ b/pkgs/development/compilers/llvm/15/default.nix
@@ -187,12 +187,13 @@ in let
     lldb = callPackage ../common/lldb.nix {
       patches =
         let
-          resourceDirPatch = callPackage ({ runCommand, libclang }: (runCommand "resource-dir.patch"
-            {
-              clangLibDir = "${libclang.lib}/lib";
-            } ''
-            substitute '${./lldb/resource-dir.patch}' "$out" --subst-var clangLibDir
-          '')) { };
+          resourceDirPatch = callPackage
+            ({ substituteAll, libclang }: substituteAll
+              {
+                src = ./lldb/resource-dir.patch;
+                clangLibDir = "${libclang.lib}/lib";
+              })
+            { };
         in
         [
           ./lldb/procfs.patch
@@ -213,7 +214,7 @@ in let
             && !stdenv.targetPlatform.isAarch64
             && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
         ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-      inherit llvm_meta release_version;
+      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -223,7 +224,7 @@ in let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/15/libcxxabi/default.nix b/pkgs/development/compilers/llvm/15/libcxxabi/default.nix
index 77ba2d2d008..04bfee14aa1 100644
--- a/pkgs/development/compilers/llvm/15/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/15/libcxxabi/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   postUnpack = lib.optionalString stdenv.isDarwin ''
     export TRIPLE=x86_64-apple-darwin
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d llvm -i ${./wasm.patch}
+    patch -p1 -d llvm -i ${../../common/libcxxabi/wasm.patch}
   '';
 
   prePatch = ''
diff --git a/pkgs/development/compilers/llvm/15/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/15/libcxxabi/wasm.patch
deleted file mode 100644
index 4ebfe46aa81..00000000000
--- a/pkgs/development/compilers/llvm/15/libcxxabi/wasm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
-index 15497d405e0..33f7f18193a 100644
---- a/cmake/modules/HandleLLVMOptions.cmake
-+++ b/cmake/modules/HandleLLVMOptions.cmake
-@@ -127,7 +127,10 @@ else(WIN32)
-       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
-     endif()
-   else(FUCHSIA OR UNIX)
--    MESSAGE(SEND_ERROR "Unable to determine platform")
-+    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
-+    else()
-+      MESSAGE(SEND_ERROR "Unable to determine platform")
-+    endif()
-   endif(FUCHSIA OR UNIX)
- endif(WIN32)
- 
diff --git a/pkgs/development/compilers/llvm/16/bintools/default.nix b/pkgs/development/compilers/llvm/16/bintools/default.nix
deleted file mode 100644
index c7b20dd28e2..00000000000
--- a/pkgs/development/compilers/llvm/16/bintools/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-debuginfod $out/bin/${prefix}debuginfod
-   ln -s ${llvm}/bin/llvm-debuginfod-find $out/bin/${prefix}debuginfod-find
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-rc $out/bin/${prefix}windres
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/16/default.nix b/pkgs/development/compilers/llvm/16/default.nix
index 94d0e7d30b5..9dbe65ed68d 100644
--- a/pkgs/development/compilers/llvm/16/default.nix
+++ b/pkgs/development/compilers/llvm/16/default.nix
@@ -192,12 +192,13 @@ in let
       '') { };
       patches =
         let
-          resourceDirPatch = callPackage ({ runCommand, libclang }: (runCommand "resource-dir.patch"
-            {
-              clangLibDir = "${libclang.lib}/lib";
-            } ''
-            substitute '${./lldb/resource-dir.patch}' "$out" --subst-var clangLibDir
-          '')) { };
+          resourceDirPatch = callPackage
+            ({ substituteAll, libclang }: substituteAll
+              {
+                src = ./lldb/resource-dir.patch;
+                clangLibDir = "${libclang.lib}/lib";
+              })
+            { };
         in
         [
           # FIXME: do we need this? ./procfs.patch
@@ -218,7 +219,7 @@ in let
             && !stdenv.targetPlatform.isAarch64
             && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
         ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-      inherit llvm_meta release_version;
+      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -228,7 +229,7 @@ in let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/16/libcxxabi/default.nix b/pkgs/development/compilers/llvm/16/libcxxabi/default.nix
index 77ba2d2d008..04bfee14aa1 100644
--- a/pkgs/development/compilers/llvm/16/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/16/libcxxabi/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   postUnpack = lib.optionalString stdenv.isDarwin ''
     export TRIPLE=x86_64-apple-darwin
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d llvm -i ${./wasm.patch}
+    patch -p1 -d llvm -i ${../../common/libcxxabi/wasm.patch}
   '';
 
   prePatch = ''
diff --git a/pkgs/development/compilers/llvm/16/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/16/libcxxabi/wasm.patch
deleted file mode 100644
index 4ebfe46aa81..00000000000
--- a/pkgs/development/compilers/llvm/16/libcxxabi/wasm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
-index 15497d405e0..33f7f18193a 100644
---- a/cmake/modules/HandleLLVMOptions.cmake
-+++ b/cmake/modules/HandleLLVMOptions.cmake
-@@ -127,7 +127,10 @@ else(WIN32)
-       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
-     endif()
-   else(FUCHSIA OR UNIX)
--    MESSAGE(SEND_ERROR "Unable to determine platform")
-+    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
-+    else()
-+      MESSAGE(SEND_ERROR "Unable to determine platform")
-+    endif()
-   endif(FUCHSIA OR UNIX)
- endif(WIN32)
- 
diff --git a/pkgs/development/compilers/llvm/5/clang/default.nix b/pkgs/development/compilers/llvm/5/clang/default.nix
index 6e968a6bd2a..70ffb3e0dd1 100644
--- a/pkgs/development/compilers/llvm/5/clang/default.nix
+++ b/pkgs/development/compilers/llvm/5/clang/default.nix
@@ -41,7 +41,7 @@ let
     ];
 
     patches = [
-      ./purity.patch
+      ../../common/clang/5-8-purity.patch
       ./gnu-install-dirs.patch
       (substituteAll {
         src = ./LLVMgold-path.patch;
diff --git a/pkgs/development/compilers/llvm/6/clang/default.nix b/pkgs/development/compilers/llvm/6/clang/default.nix
index baf601ffbfc..bc69f1c99cf 100644
--- a/pkgs/development/compilers/llvm/6/clang/default.nix
+++ b/pkgs/development/compilers/llvm/6/clang/default.nix
@@ -41,7 +41,7 @@ let
     ];
 
     patches = [
-      ./purity.patch
+      ../../common/clang/5-8-purity.patch
       ./gnu-install-dirs.patch
       (substituteAll {
         src = ../../clang-6-10-LLVMgold-path.patch;
diff --git a/pkgs/development/compilers/llvm/6/clang/purity.patch b/pkgs/development/compilers/llvm/6/clang/purity.patch
deleted file mode 100644
index b30d0d0b5d5..00000000000
--- a/pkgs/development/compilers/llvm/6/clang/purity.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 4add81bba40dcec62c4ea4481be8e35ac53e89d8 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Thu, 18 May 2017 11:56:12 -0500
-Subject: [PATCH] "purity" patch for 5.0
-
----
- lib/Driver/ToolChains/Gnu.cpp | 7 -------
- 1 file changed, 7 deletions(-)
-
-diff --git a/lib/Driver/ToolChains/Gnu.cpp b/lib/Driver/ToolChains/Gnu.cpp
-index fe3c0191bb..c6a482bece 100644
---- a/lib/Driver/ToolChains/Gnu.cpp
-+++ b/lib/Driver/ToolChains/Gnu.cpp
-@@ -494,13 +494,6 @@ void tools::gnutools::Linker::ConstructJob(Compilation &C, const JobAction &JA,
-   if (!Args.hasArg(options::OPT_static)) {
-     if (Args.hasArg(options::OPT_rdynamic))
-       CmdArgs.push_back("-export-dynamic");
--
--    if (!Args.hasArg(options::OPT_shared)) {
--      const std::string Loader =
--          D.DyldPrefix + ToolChain.getDynamicLinker(Args);
--      CmdArgs.push_back("-dynamic-linker");
--      CmdArgs.push_back(Args.MakeArgString(Loader));
--    }
-   }
- 
-   CmdArgs.push_back("-o");
--- 
-2.11.0
-
diff --git a/pkgs/development/compilers/llvm/7/bintools/default.nix b/pkgs/development/compilers/llvm/7/bintools/default.nix
deleted file mode 100644
index 38002439c20..00000000000
--- a/pkgs/development/compilers/llvm/7/bintools/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/7/clang/default.nix b/pkgs/development/compilers/llvm/7/clang/default.nix
index c3f2bcb73ff..136a69e7216 100644
--- a/pkgs/development/compilers/llvm/7/clang/default.nix
+++ b/pkgs/development/compilers/llvm/7/clang/default.nix
@@ -45,7 +45,7 @@ let
     ];
 
     patches = [
-      ./purity.patch
+      ../../common/clang/5-8-purity.patch
       # make clang -xhip use $PATH to find executables
       ./HIP-use-PATH-7.patch
       # Backport for the `--unwindlib=[libgcc|compiler-rt]` flag, which is
diff --git a/pkgs/development/compilers/llvm/7/clang/purity.patch b/pkgs/development/compilers/llvm/7/clang/purity.patch
deleted file mode 100644
index b30d0d0b5d5..00000000000
--- a/pkgs/development/compilers/llvm/7/clang/purity.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 4add81bba40dcec62c4ea4481be8e35ac53e89d8 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Thu, 18 May 2017 11:56:12 -0500
-Subject: [PATCH] "purity" patch for 5.0
-
----
- lib/Driver/ToolChains/Gnu.cpp | 7 -------
- 1 file changed, 7 deletions(-)
-
-diff --git a/lib/Driver/ToolChains/Gnu.cpp b/lib/Driver/ToolChains/Gnu.cpp
-index fe3c0191bb..c6a482bece 100644
---- a/lib/Driver/ToolChains/Gnu.cpp
-+++ b/lib/Driver/ToolChains/Gnu.cpp
-@@ -494,13 +494,6 @@ void tools::gnutools::Linker::ConstructJob(Compilation &C, const JobAction &JA,
-   if (!Args.hasArg(options::OPT_static)) {
-     if (Args.hasArg(options::OPT_rdynamic))
-       CmdArgs.push_back("-export-dynamic");
--
--    if (!Args.hasArg(options::OPT_shared)) {
--      const std::string Loader =
--          D.DyldPrefix + ToolChain.getDynamicLinker(Args);
--      CmdArgs.push_back("-dynamic-linker");
--      CmdArgs.push_back(Args.MakeArgString(Loader));
--    }
-   }
- 
-   CmdArgs.push_back("-o");
--- 
-2.11.0
-
diff --git a/pkgs/development/compilers/llvm/7/compiler-rt/codesign.patch b/pkgs/development/compilers/llvm/7/compiler-rt/codesign.patch
deleted file mode 100644
index 3cc12b94b20..00000000000
--- a/pkgs/development/compilers/llvm/7/compiler-rt/codesign.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 3dec5f3475a26aeb4678627795c4b67c6b7b4785 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Tue, 19 Sep 2017 13:13:06 -0500
-Subject: [PATCH] remove codesign use on Apple, disable ios sim testing that
- needs it
-
----
- cmake/Modules/AddCompilerRT.cmake |  8 ------
- test/asan/CMakeLists.txt          | 52 ---------------------------------------
- test/tsan/CMakeLists.txt          | 47 -----------------------------------
- 3 files changed, 107 deletions(-)
-
-diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
-index bc5fb9ff7..b64eb4246 100644
---- a/cmake/Modules/AddCompilerRT.cmake
-+++ b/cmake/Modules/AddCompilerRT.cmake
-@@ -210,14 +210,6 @@ function(add_compiler_rt_runtime name type)
-         set_target_properties(${libname} PROPERTIES IMPORT_PREFIX "")
-         set_target_properties(${libname} PROPERTIES IMPORT_SUFFIX ".lib")
-       endif()
--      if(APPLE)
--        # Ad-hoc sign the dylibs
--        add_custom_command(TARGET ${libname}
--          POST_BUILD  
--          COMMAND codesign --sign - $<TARGET_FILE:${libname}>
--          WORKING_DIRECTORY ${COMPILER_RT_LIBRARY_OUTPUT_DIR}
--        )
--      endif()
-     endif()
-     install(TARGETS ${libname}
-       ARCHIVE DESTINATION ${COMPILER_RT_LIBRARY_INSTALL_DIR}
-2.14.1
-
diff --git a/pkgs/development/compilers/llvm/7/compiler-rt/default.nix b/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
index a644229ff07..7354397d2bf 100644
--- a/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
   patches = [
     # https://github.com/llvm/llvm-project/commit/947f9692440836dcb8d88b74b69dd379d85974ce
     ../../common/compiler-rt/glibc.patch
-    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    ../../common/compiler-rt/7-12-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./gnu-install-dirs.patch
     ../../common/compiler-rt/libsanitizer-no-cyclades-9.patch
   ] ++ lib.optional (useLLVM) ./crtbegin-and-end.patch
diff --git a/pkgs/development/compilers/llvm/7/default.nix b/pkgs/development/compilers/llvm/7/default.nix
index 5c20086ce84..0607b5ebf42 100644
--- a/pkgs/development/compilers/llvm/7/default.nix
+++ b/pkgs/development/compilers/llvm/7/default.nix
@@ -149,7 +149,7 @@ let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/8/bintools/default.nix b/pkgs/development/compilers/llvm/8/bintools/default.nix
deleted file mode 100644
index 38002439c20..00000000000
--- a/pkgs/development/compilers/llvm/8/bintools/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/8/clang/default.nix b/pkgs/development/compilers/llvm/8/clang/default.nix
index 0d0af5ab6aa..994f9bd967c 100644
--- a/pkgs/development/compilers/llvm/8/clang/default.nix
+++ b/pkgs/development/compilers/llvm/8/clang/default.nix
@@ -45,7 +45,7 @@ let
     ];
 
     patches = [
-      ./purity.patch
+      ../../common/clang/5-8-purity.patch
       ./xpc.patch
       # Backport for -static-pie, which the latter touches, and which is nice in
       # its own right.
diff --git a/pkgs/development/compilers/llvm/8/clang/purity.patch b/pkgs/development/compilers/llvm/8/clang/purity.patch
deleted file mode 100644
index b30d0d0b5d5..00000000000
--- a/pkgs/development/compilers/llvm/8/clang/purity.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 4add81bba40dcec62c4ea4481be8e35ac53e89d8 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Thu, 18 May 2017 11:56:12 -0500
-Subject: [PATCH] "purity" patch for 5.0
-
----
- lib/Driver/ToolChains/Gnu.cpp | 7 -------
- 1 file changed, 7 deletions(-)
-
-diff --git a/lib/Driver/ToolChains/Gnu.cpp b/lib/Driver/ToolChains/Gnu.cpp
-index fe3c0191bb..c6a482bece 100644
---- a/lib/Driver/ToolChains/Gnu.cpp
-+++ b/lib/Driver/ToolChains/Gnu.cpp
-@@ -494,13 +494,6 @@ void tools::gnutools::Linker::ConstructJob(Compilation &C, const JobAction &JA,
-   if (!Args.hasArg(options::OPT_static)) {
-     if (Args.hasArg(options::OPT_rdynamic))
-       CmdArgs.push_back("-export-dynamic");
--
--    if (!Args.hasArg(options::OPT_shared)) {
--      const std::string Loader =
--          D.DyldPrefix + ToolChain.getDynamicLinker(Args);
--      CmdArgs.push_back("-dynamic-linker");
--      CmdArgs.push_back(Args.MakeArgString(Loader));
--    }
-   }
- 
-   CmdArgs.push_back("-o");
--- 
-2.11.0
-
diff --git a/pkgs/development/compilers/llvm/8/compiler-rt/codesign.patch b/pkgs/development/compilers/llvm/8/compiler-rt/codesign.patch
deleted file mode 100644
index 3cc12b94b20..00000000000
--- a/pkgs/development/compilers/llvm/8/compiler-rt/codesign.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 3dec5f3475a26aeb4678627795c4b67c6b7b4785 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Tue, 19 Sep 2017 13:13:06 -0500
-Subject: [PATCH] remove codesign use on Apple, disable ios sim testing that
- needs it
-
----
- cmake/Modules/AddCompilerRT.cmake |  8 ------
- test/asan/CMakeLists.txt          | 52 ---------------------------------------
- test/tsan/CMakeLists.txt          | 47 -----------------------------------
- 3 files changed, 107 deletions(-)
-
-diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
-index bc5fb9ff7..b64eb4246 100644
---- a/cmake/Modules/AddCompilerRT.cmake
-+++ b/cmake/Modules/AddCompilerRT.cmake
-@@ -210,14 +210,6 @@ function(add_compiler_rt_runtime name type)
-         set_target_properties(${libname} PROPERTIES IMPORT_PREFIX "")
-         set_target_properties(${libname} PROPERTIES IMPORT_SUFFIX ".lib")
-       endif()
--      if(APPLE)
--        # Ad-hoc sign the dylibs
--        add_custom_command(TARGET ${libname}
--          POST_BUILD  
--          COMMAND codesign --sign - $<TARGET_FILE:${libname}>
--          WORKING_DIRECTORY ${COMPILER_RT_LIBRARY_OUTPUT_DIR}
--        )
--      endif()
-     endif()
-     install(TARGETS ${libname}
-       ARCHIVE DESTINATION ${COMPILER_RT_LIBRARY_INSTALL_DIR}
-2.14.1
-
diff --git a/pkgs/development/compilers/llvm/8/compiler-rt/default.nix b/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
index 80f70ac64a0..26cb5aa3061 100644
--- a/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
   patches = [
     # https://github.com/llvm/llvm-project/commit/947f9692440836dcb8d88b74b69dd379d85974ce
     ../../common/compiler-rt/glibc.patch
-    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    ../../common/compiler-rt/7-12-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./gnu-install-dirs.patch
     ../../common/compiler-rt/libsanitizer-no-cyclades-9.patch
   ] ++ lib.optional (useLLVM) ./crtbegin-and-end.patch
diff --git a/pkgs/development/compilers/llvm/8/default.nix b/pkgs/development/compilers/llvm/8/default.nix
index c24c84754e3..5beb8afb2ee 100644
--- a/pkgs/development/compilers/llvm/8/default.nix
+++ b/pkgs/development/compilers/llvm/8/default.nix
@@ -150,7 +150,7 @@ let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/8/libcxxabi/default.nix b/pkgs/development/compilers/llvm/8/libcxxabi/default.nix
index ebf8a5c702e..885d85b8c3e 100644
--- a/pkgs/development/compilers/llvm/8/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/8/libcxxabi/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
   '';
 
   patches = [
-    ./no-threads.patch
+    ../../common/libcxxabi/no-threads.patch
     ./gnu-install-dirs.patch
   ];
 
diff --git a/pkgs/development/compilers/llvm/8/libcxxabi/no-threads.patch b/pkgs/development/compilers/llvm/8/libcxxabi/no-threads.patch
deleted file mode 100644
index 787f3e16500..00000000000
--- a/pkgs/development/compilers/llvm/8/libcxxabi/no-threads.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 4138acf..41b4763 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -362,6 +362,7 @@ if (NOT LIBCXXABI_ENABLE_THREADS)
-                         " is also set to ON.")
-   endif()
-   add_definitions(-D_LIBCXXABI_HAS_NO_THREADS)
-+  add_definitions(-D_LIBCPP_HAS_NO_THREADS)
- endif()
- 
- if (LIBCXXABI_HAS_EXTERNAL_THREAD_API)
diff --git a/pkgs/development/compilers/llvm/8/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/8/libcxxabi/wasm.patch
deleted file mode 100644
index 4ebfe46aa81..00000000000
--- a/pkgs/development/compilers/llvm/8/libcxxabi/wasm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
-index 15497d405e0..33f7f18193a 100644
---- a/cmake/modules/HandleLLVMOptions.cmake
-+++ b/cmake/modules/HandleLLVMOptions.cmake
-@@ -127,7 +127,10 @@ else(WIN32)
-       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
-     endif()
-   else(FUCHSIA OR UNIX)
--    MESSAGE(SEND_ERROR "Unable to determine platform")
-+    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
-+    else()
-+      MESSAGE(SEND_ERROR "Unable to determine platform")
-+    endif()
-   endif(FUCHSIA OR UNIX)
- endif(WIN32)
- 
diff --git a/pkgs/development/compilers/llvm/9/bintools/default.nix b/pkgs/development/compilers/llvm/9/bintools/default.nix
deleted file mode 100644
index 38002439c20..00000000000
--- a/pkgs/development/compilers/llvm/9/bintools/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/9/compiler-rt/codesign.patch b/pkgs/development/compilers/llvm/9/compiler-rt/codesign.patch
deleted file mode 100644
index 3cc12b94b20..00000000000
--- a/pkgs/development/compilers/llvm/9/compiler-rt/codesign.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 3dec5f3475a26aeb4678627795c4b67c6b7b4785 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Tue, 19 Sep 2017 13:13:06 -0500
-Subject: [PATCH] remove codesign use on Apple, disable ios sim testing that
- needs it
-
----
- cmake/Modules/AddCompilerRT.cmake |  8 ------
- test/asan/CMakeLists.txt          | 52 ---------------------------------------
- test/tsan/CMakeLists.txt          | 47 -----------------------------------
- 3 files changed, 107 deletions(-)
-
-diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
-index bc5fb9ff7..b64eb4246 100644
---- a/cmake/Modules/AddCompilerRT.cmake
-+++ b/cmake/Modules/AddCompilerRT.cmake
-@@ -210,14 +210,6 @@ function(add_compiler_rt_runtime name type)
-         set_target_properties(${libname} PROPERTIES IMPORT_PREFIX "")
-         set_target_properties(${libname} PROPERTIES IMPORT_SUFFIX ".lib")
-       endif()
--      if(APPLE)
--        # Ad-hoc sign the dylibs
--        add_custom_command(TARGET ${libname}
--          POST_BUILD  
--          COMMAND codesign --sign - $<TARGET_FILE:${libname}>
--          WORKING_DIRECTORY ${COMPILER_RT_LIBRARY_OUTPUT_DIR}
--        )
--      endif()
-     endif()
-     install(TARGETS ${libname}
-       ARCHIVE DESTINATION ${COMPILER_RT_LIBRARY_INSTALL_DIR}
-2.14.1
-
diff --git a/pkgs/development/compilers/llvm/9/compiler-rt/default.nix b/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
index 0398b126ab5..d03fcbc7f70 100644
--- a/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
   patches = [
     # https://github.com/llvm/llvm-project/commit/947f9692440836dcb8d88b74b69dd379d85974ce
     ../../common/compiler-rt/glibc.patch
-    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    ../../common/compiler-rt/7-12-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./gnu-install-dirs.patch
     ../../common/compiler-rt/libsanitizer-no-cyclades-9.patch
     # Fix build on armv6l
diff --git a/pkgs/development/compilers/llvm/9/default.nix b/pkgs/development/compilers/llvm/9/default.nix
index 4ec802a4f28..9f79dc5cce7 100644
--- a/pkgs/development/compilers/llvm/9/default.nix
+++ b/pkgs/development/compilers/llvm/9/default.nix
@@ -150,7 +150,7 @@ let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/9/libcxxabi/default.nix b/pkgs/development/compilers/llvm/9/libcxxabi/default.nix
index f19bfb157ce..24d89b1a2da 100644
--- a/pkgs/development/compilers/llvm/9/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/9/libcxxabi/default.nix
@@ -19,11 +19,11 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -d $(ls -d libcxx-*) -i ${../../libcxx-0001-musl-hacks.patch}
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d $(ls -d llvm-*) -i ${./wasm.patch}
+    patch -p1 -d $(ls -d llvm-*) -i ${../../common/libcxxabi/wasm.patch}
   '';
 
   patches = [
-    ./no-threads.patch
+    ../../common/libcxxabi/no-threads.patch
     ./gnu-install-dirs.patch
   ];
 
diff --git a/pkgs/development/compilers/llvm/9/libcxxabi/no-threads.patch b/pkgs/development/compilers/llvm/9/libcxxabi/no-threads.patch
deleted file mode 100644
index 787f3e16500..00000000000
--- a/pkgs/development/compilers/llvm/9/libcxxabi/no-threads.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 4138acf..41b4763 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -362,6 +362,7 @@ if (NOT LIBCXXABI_ENABLE_THREADS)
-                         " is also set to ON.")
-   endif()
-   add_definitions(-D_LIBCXXABI_HAS_NO_THREADS)
-+  add_definitions(-D_LIBCPP_HAS_NO_THREADS)
- endif()
- 
- if (LIBCXXABI_HAS_EXTERNAL_THREAD_API)
diff --git a/pkgs/development/compilers/llvm/9/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/9/libcxxabi/wasm.patch
deleted file mode 100644
index 4ebfe46aa81..00000000000
--- a/pkgs/development/compilers/llvm/9/libcxxabi/wasm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
-index 15497d405e0..33f7f18193a 100644
---- a/cmake/modules/HandleLLVMOptions.cmake
-+++ b/cmake/modules/HandleLLVMOptions.cmake
-@@ -127,7 +127,10 @@ else(WIN32)
-       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
-     endif()
-   else(FUCHSIA OR UNIX)
--    MESSAGE(SEND_ERROR "Unable to determine platform")
-+    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
-+    else()
-+      MESSAGE(SEND_ERROR "Unable to determine platform")
-+    endif()
-   endif(FUCHSIA OR UNIX)
- endif(WIN32)
- 
diff --git a/pkgs/development/compilers/llvm/common/bintools.nix b/pkgs/development/compilers/llvm/common/bintools.nix
new file mode 100644
index 00000000000..a60060e8689
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common/bintools.nix
@@ -0,0 +1,48 @@
+{ lib, runCommand, stdenv, llvm, lld, version, release_version }:
+
+let
+  targetPrefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
+in
+runCommand "llvm-binutils-${version}"
+{
+  preferLocalBuild = true;
+  passthru = {
+    isLLVM = true;
+  };
+}
+  (''
+    mkdir -p $out/bin
+    for prog in ${lld}/bin/*; do
+      ln -s $prog $out/bin/${targetPrefix}$(basename $prog)
+    done
+    for prog in ${llvm}/bin/*; do
+      ln -sf $prog $out/bin/${targetPrefix}$(basename $prog)
+    done
+
+    llvmBin="${llvm}/bin"
+
+    ln -s $llvmBin/llvm-ar $out/bin/${targetPrefix}ar
+    ln -s $llvmBin/llvm-ar $out/bin/${targetPrefix}dlltool
+    ln -s $llvmBin/llvm-ar $out/bin/${targetPrefix}ranlib
+    ln -s $llvmBin/llvm-cxxfilt $out/bin/${targetPrefix}c++filt
+    ln -s $llvmBin/llvm-dwp $out/bin/${targetPrefix}dwp
+    ln -s $llvmBin/llvm-nm $out/bin/${targetPrefix}nm
+    ln -s $llvmBin/llvm-objcopy $out/bin/${targetPrefix}objcopy
+    ln -s $llvmBin/llvm-objcopy $out/bin/${targetPrefix}strip
+    ln -s $llvmBin/llvm-objdump $out/bin/${targetPrefix}objdump
+    ln -s $llvmBin/llvm-readobj $out/bin/${targetPrefix}readelf
+    ln -s $llvmBin/llvm-size $out/bin/${targetPrefix}size
+    ln -s $llvmBin/llvm-strings $out/bin/${targetPrefix}strings
+    ln -s $llvmBin/llvm-symbolizer $out/bin/${targetPrefix}addr2line
+
+    if [ -e "$llvmBin/llvm-debuginfod" ]; then
+      ln -s $llvmBin/llvm-debuginfod $out/bin/${targetPrefix}debuginfod
+      ln -s $llvmBin/llvm-debuginfod-find $out/bin/${targetPrefix}debuginfod-find
+    fi
+
+    ln -s ${lld}/bin/lld $out/bin/${targetPrefix}ld
+
+    # Only >=13 show GNU windres compatible in help
+  '' + lib.optionalString (lib.versionAtLeast release_version "13") ''
+    ln -s $llvmBin/llvm-rc $out/bin/${targetPrefix}windres
+  '')
diff --git a/pkgs/development/compilers/llvm/5/clang/purity.patch b/pkgs/development/compilers/llvm/common/clang/5-8-purity.patch
index b30d0d0b5d5..b30d0d0b5d5 100644
--- a/pkgs/development/compilers/llvm/5/clang/purity.patch
+++ b/pkgs/development/compilers/llvm/common/clang/5-8-purity.patch
diff --git a/pkgs/development/compilers/llvm/10/compiler-rt/codesign.patch b/pkgs/development/compilers/llvm/common/compiler-rt/7-12-codesign.patch
index 3cc12b94b20..3cc12b94b20 100644
--- a/pkgs/development/compilers/llvm/10/compiler-rt/codesign.patch
+++ b/pkgs/development/compilers/llvm/common/compiler-rt/7-12-codesign.patch
diff --git a/pkgs/development/compilers/llvm/10/libcxxabi/no-threads.patch b/pkgs/development/compilers/llvm/common/libcxxabi/no-threads.patch
index 787f3e16500..787f3e16500 100644
--- a/pkgs/development/compilers/llvm/10/libcxxabi/no-threads.patch
+++ b/pkgs/development/compilers/llvm/common/libcxxabi/no-threads.patch
diff --git a/pkgs/development/compilers/llvm/10/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/common/libcxxabi/wasm.patch
index 4ebfe46aa81..4ebfe46aa81 100644
--- a/pkgs/development/compilers/llvm/10/libcxxabi/wasm.patch
+++ b/pkgs/development/compilers/llvm/common/libcxxabi/wasm.patch
diff --git a/pkgs/development/compilers/llvm/common/lldb.nix b/pkgs/development/compilers/llvm/common/lldb.nix
index 82ad9c304ea..1f5d4a1e338 100644
--- a/pkgs/development/compilers/llvm/common/lldb.nix
+++ b/pkgs/development/compilers/llvm/common/lldb.nix
@@ -45,25 +45,21 @@ stdenv.mkDerivation (rec {
 
   outputs = [ "out" "lib" "dev" ];
 
-  sourceRoot =
-    if lib.versionOlder release_version "13" then null
-    else "${src.name}/${pname}";
+  sourceRoot = lib.optional (lib.versionAtLeast release_version "13") "${src.name}/${pname}";
 
   nativeBuildInputs = [
     cmake
-  ] ++ lib.optionals (lib.versionAtLeast release_version "15") [
-    ninja
-  ] ++ [
     python3
     which
     swig
     lit
     makeWrapper
-  ] ++ lib.optionals (lib.versionAtLeast release_version "14") [
     lua5_3
   ] ++ lib.optionals enableManpages [
     python3.pkgs.sphinx
     python3.pkgs.recommonmark
+  ] ++ lib.optionals (lib.versionAtLeast release_version "14") [
+    ninja
   ];
 
   buildInputs = [
@@ -87,11 +83,13 @@ stdenv.mkDerivation (rec {
   #
   # See here for context:
   # https://github.com/NixOS/nixpkgs/pull/194634#issuecomment-1272129132
-  ++ lib.optional (
+  ++ lib.optional
+    (
       stdenv.targetPlatform.isDarwin
-      && !stdenv.targetPlatform.isAarch64
-      && (lib.versionAtLeast release_version "15")
-    ) (
+        && !stdenv.targetPlatform.isAarch64
+        && (lib.versionAtLeast release_version "15")
+    )
+    (
       runCommand "bsm-audit-session-header" { } ''
         install -Dm444 \
           "${lib.getDev darwin.apple_sdk.sdk}/include/bsm/audit_session.h" \
@@ -104,7 +102,7 @@ stdenv.mkDerivation (rec {
   cmakeFlags = [
     "-DLLDB_INCLUDE_TESTS=${if doCheck then "YES" else "NO"}"
     "-DLLVM_ENABLE_RTTI=OFF"
-    "-DClang_DIR=${libclang.dev}/lib/cmake"
+    "-DClang_DIR=${lib.getDev libclang}/lib/cmake"
     "-DLLVM_EXTERNAL_LIT=${lit}/bin/lit"
   ] ++ lib.optionals stdenv.isDarwin [
     "-DLLDB_USE_SYSTEM_DEBUGSERVER=ON"
@@ -127,28 +125,21 @@ stdenv.mkDerivation (rec {
   ];
 
   doCheck = false;
+  doInstallCheck = lib.versionOlder release_version "15";
 
   # TODO: cleanup with mass-rebuild
-  installCheckPhase =
-    if ((lib.versions.major release_version) == "14") then ''
-      if [ ! -e $lib/${python3.sitePackages}/lldb/_lldb*.so ] ; then
-          echo "ERROR: python files not installed where expected!";
-          return 1;
-      fi
-      if [ ! -e "$lib/lib/lua/${lua5_3.luaversion}/lldb.so" ] ; then
-          echo "ERROR: lua files not installed where expected!";
-          return 1;
-      fi
-    '' else if (((lib.versions.major release_version) == "15") || (lib.versions.major release_version) == "16") then ''
-      if [ ! -e "$lib/${python3.sitePackages}/lldb/_lldb.so" ] ; then
-          return 1;
-      fi
-    '' else ''
-      if [ ! -e "$lib/${python3.sitePackages}/lldb/_lldb.so" ] ; then
-          echo "ERROR: python files not installed where expected!";
-          return 1;
-      fi
-    '';
+  installCheckPhase = ''
+    if [ ! -e $lib/${python3.sitePackages}/lldb/_lldb*.so ] ; then
+        echo "ERROR: python files not installed where expected!";
+        return 1;
+    fi
+  '' # Something lua is built on older versions but this file doesn't exist.
+  + lib.optionalString (lib.versionAtLeast release_version "14") ''
+    if [ ! -e "$lib/lib/lua/${lua5_3.luaversion}/lldb.so" ] ; then
+        echo "ERROR: lua files not installed where expected!";
+        return 1;
+    fi
+  '';
 
   postInstall = ''
     wrapProgram $out/bin/lldb --prefix PYTHONPATH : $lib/${python3.sitePackages}/
@@ -157,7 +148,7 @@ stdenv.mkDerivation (rec {
     # vscode:
     install -D ../tools/lldb-vscode/package.json $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/package.json
     mkdir -p $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
-    ln -s $out/bin/${if (lib.versionOlder release_version "12") then "llvm-vscode" else "lldb-vscode"} $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
+    ln -s $out/bin/*-vscode $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
   '';
 
   meta = llvm_meta // {
@@ -174,17 +165,15 @@ stdenv.mkDerivation (rec {
       (lib.versionOlder release_version "11" && stdenv.isDarwin && stdenv.isAarch64)
         || (((lib.versions.major release_version) == "13") && stdenv.isDarwin);
   };
-} // lib.optionalAttrs (lib.versionOlder release_version "15") {
-  doInstallCheck = true;
 } // lib.optionalAttrs enableManpages {
   pname = "lldb-manpages";
 
-  buildPhase =
-    if lib.versionOlder release_version "15" then ''
-      make ${if (lib.versionOlder release_version "12") then "docs-man" else "docs-lldb-man"}
-    '' else null;
+  buildPhase = lib.optionalString (lib.versionOlder release_version "15") ''
+    make ${if (lib.versionOlder release_version "12") then "docs-man" else "docs-lldb-man"}
+  '';
+
 
-  ninjaFlags = if lib.versionAtLeast release_version "15" then [ "docs-lldb-man" ] else null;
+  ninjaFlags = lib.optionals (lib.versionAtLeast release_version "15") [ "docs-lldb-man" ];
 
   propagatedBuildInputs = [ ];
 
diff --git a/pkgs/development/compilers/llvm/git/bintools/default.nix b/pkgs/development/compilers/llvm/git/bintools/default.nix
deleted file mode 100644
index c7b20dd28e2..00000000000
--- a/pkgs/development/compilers/llvm/git/bintools/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-debuginfod $out/bin/${prefix}debuginfod
-   ln -s ${llvm}/bin/llvm-debuginfod-find $out/bin/${prefix}debuginfod-find
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-rc $out/bin/${prefix}windres
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index 04f17d5edab..930b716881e 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -184,11 +184,28 @@ in let
       inherit llvm_meta;
     };
 
-    lldb = callPackage ./lldb {
+    lldb = callPackage ../common/lldb.nix {
+      src = callPackage ({ runCommand }: runCommand "lldb-src-${version}" {} ''
+        mkdir -p "$out"
+        cp -r ${monorepoSrc}/cmake "$out"
+        cp -r ${monorepoSrc}/lldb "$out"
+      '') { };
+      patches =
+        let
+          resourceDirPatch = callPackage
+            ({ substituteAll, libclang }: substituteAll
+              {
+                src = ./lldb/resource-dir.patch;
+                clangLibDir = "${libclang.lib}/lib";
+              })
+            { };
+        in
+        [
+          ./lldb/procfs.patch # FIXME: do we need this?
+          resourceDirPatch
+          ./lldb/gnu-install-dirs.patch
+        ];
       inherit llvm_meta;
-      inherit (darwin) libobjc bootstrap_cmds;
-      inherit (darwin.apple_sdk.libs) xpc;
-      inherit (darwin.apple_sdk.frameworks) Foundation Carbon Cocoa;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -198,7 +215,7 @@ in let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/git/libcxxabi/default.nix b/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
index 362de957886..6987e6b0ca3 100644
--- a/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   postUnpack = lib.optionalString stdenv.isDarwin ''
     export TRIPLE=x86_64-apple-darwin
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d llvm -i ${./wasm.patch}
+    patch -p1 -d llvm -i ${../../common/libcxxabi/wasm.patch}
   '';
 
   prePatch = ''
diff --git a/pkgs/development/compilers/llvm/git/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/git/libcxxabi/wasm.patch
deleted file mode 100644
index 4ebfe46aa81..00000000000
--- a/pkgs/development/compilers/llvm/git/libcxxabi/wasm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
-index 15497d405e0..33f7f18193a 100644
---- a/cmake/modules/HandleLLVMOptions.cmake
-+++ b/cmake/modules/HandleLLVMOptions.cmake
-@@ -127,7 +127,10 @@ else(WIN32)
-       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
-     endif()
-   else(FUCHSIA OR UNIX)
--    MESSAGE(SEND_ERROR "Unable to determine platform")
-+    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
-+    else()
-+      MESSAGE(SEND_ERROR "Unable to determine platform")
-+    endif()
-   endif(FUCHSIA OR UNIX)
- endif(WIN32)
- 
diff --git a/pkgs/development/compilers/llvm/git/lldb/default.nix b/pkgs/development/compilers/llvm/git/lldb/default.nix
deleted file mode 100644
index a02c5ca4b13..00000000000
--- a/pkgs/development/compilers/llvm/git/lldb/default.nix
+++ /dev/null
@@ -1,144 +0,0 @@
-{ lib, stdenv, llvm_meta
-, runCommand
-, monorepoSrc
-, cmake
-, ninja
-, zlib
-, ncurses
-, swig
-, which
-, libedit
-, libxml2
-, libllvm
-, libclang
-, python3
-, version
-, libobjc
-, xpc
-, Foundation
-, bootstrap_cmds
-, Carbon
-, Cocoa
-, lit
-, makeWrapper
-, enableManpages ? false
-, lua5_3
-}:
-
-stdenv.mkDerivation (rec {
-  pname = "lldb";
-  inherit version;
-
-  src = runCommand "${pname}-src-${version}" {} ''
-    mkdir -p "$out"
-    cp -r ${monorepoSrc}/cmake "$out"
-    cp -r ${monorepoSrc}/${pname} "$out"
-  '';
-
-  sourceRoot = "${src.name}/${pname}";
-
-  patches = [
-    ./procfs.patch
-    (runCommand "resource-dir.patch" {
-      clangLibDir = "${libclang.lib}/lib";
-    } ''
-      substitute '${./resource-dir.patch}' "$out" --subst-var clangLibDir
-    '')
-    ./gnu-install-dirs.patch
-  ];
-
-  outputs = [ "out" "lib" "dev" ];
-
-  nativeBuildInputs = [
-    cmake ninja python3 which swig lit makeWrapper lua5_3
-  ] ++ lib.optionals enableManpages [
-    python3.pkgs.sphinx python3.pkgs.recommonmark
-  ];
-
-  buildInputs = [
-    ncurses
-    zlib
-    libedit
-    libxml2
-    libllvm
-  ] ++ lib.optionals stdenv.isDarwin [
-    libobjc
-    xpc
-    Foundation
-    bootstrap_cmds
-    Carbon
-    Cocoa
-  ];
-
-  hardeningDisable = [ "format" ];
-
-  cmakeFlags = [
-    "-DLLDB_INCLUDE_TESTS=${if doCheck then "YES" else "NO"}"
-    "-DLLVM_ENABLE_RTTI=OFF"
-    "-DClang_DIR=${libclang.dev}/lib/cmake"
-    "-DLLVM_EXTERNAL_LIT=${lit}/bin/lit"
-  ] ++ lib.optionals stdenv.isDarwin [
-    "-DLLDB_USE_SYSTEM_DEBUGSERVER=ON"
-  ] ++ lib.optionals (!stdenv.isDarwin) [
-    "-DLLDB_CODESIGN_IDENTITY=" # codesigning makes nondeterministic
-  ] ++ lib.optionals enableManpages [
-    "-DLLVM_ENABLE_SPHINX=ON"
-    "-DSPHINX_OUTPUT_MAN=ON"
-    "-DSPHINX_OUTPUT_HTML=OFF"
-  ] ++ lib.optionals doCheck [
-    "-DLLDB_TEST_C_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
-    "-DLLDB_TEST_CXX_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++"
-  ];
-
-  doCheck = false;
-
-  installCheckPhase = ''
-    if [ ! -e "$lib/${python3.sitePackages}/lldb/_lldb.so" ] ; then
-        return 1;
-    fi
-  '';
-
-  postInstall = ''
-    wrapProgram $out/bin/lldb --prefix PYTHONPATH : $lib/${python3.sitePackages}/
-
-    # Editor support
-    # vscode:
-    install -D ../tools/lldb-vscode/package.json $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/package.json
-    mkdir -p $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
-    ln -s $out/bin/lldb-vscode $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
-  '';
-
-  meta = llvm_meta // {
-    homepage = "https://lldb.llvm.org/";
-    description = "A next-generation high-performance debugger";
-    longDescription = ''
-      LLDB is a next generation, high-performance debugger. It is built as a set
-      of reusable components which highly leverage existing libraries in the
-      larger LLVM Project, such as the Clang expression parser and LLVM
-      disassembler.
-    '';
-  };
-} // lib.optionalAttrs enableManpages {
-  pname = "lldb-manpages";
-
-  ninjaFlags = [ "docs-lldb-man" ];
-
-  propagatedBuildInputs = [];
-
-  # manually install lldb man page
-  installPhase = ''
-    mkdir -p $out/share/man/man1
-    install docs/man/lldb.1 -t $out/share/man/man1/
-  '';
-
-  postPatch = null;
-  postInstall = null;
-
-  outputs = [ "out" ];
-
-  doCheck = false;
-
-  meta = llvm_meta // {
-    description = "man pages for LLDB ${version}";
-  };
-})
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index 68efeb6094b..eaccfcc6e81 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -101,8 +101,8 @@ in rec {
   };
 
   vala_0_56 = generic {
-    version = "0.56.9";
-    sha256 = "VVeMfE8Ges4CjlQYBq8kD4CEy2/wzFVMqorAjL+Lzi8=";
+    version = "0.56.13";
+    sha256 = "SYgiMDbH4eSHTEdtDei9nL5QDuJe8Zp25WDcC21Wrgc=";
   };
 
   vala = vala_0_56;
diff --git a/pkgs/development/interpreters/luajit/2.0.nix b/pkgs/development/interpreters/luajit/2.0.nix
index 78abb742c40..29ad88f0ec1 100644
--- a/pkgs/development/interpreters/luajit/2.0.nix
+++ b/pkgs/development/interpreters/luajit/2.0.nix
@@ -1,13 +1,15 @@
 { self, callPackage, fetchFromGitHub, lib, passthruFun }:
 
-callPackage ./default.nix {
-  version = "2.0.5-2022-09-13";
+callPackage ./default.nix rec {
+  # The patch version is the timestamp of the git commit,
+  # obtain via `cat $(nix-build -A luajit_2_0.src)/.relver`
+  version = "2.0.1693340858";
 
   src = fetchFromGitHub {
     owner = "LuaJIT";
     repo = "LuaJIT";
-    rev = "46e62cd963a426e83a60f691dcbbeb742c7b3ba2";
-    hash = "sha256-/XR9+6NjXs2TrUVKJNkH2h970BkDNFqMDJTWcy/bswU=";
+    rev = "c6ee7e19d107b4f9a140bb2ccf99162e26318c69";
+    hash = "sha256-3/7ASZRniytw5RkOy0F9arHkZevq6dxmya+Ba3A5IIA=";
   };
 
   extraMeta = { # this isn't precise but it at least stops the useless Hydra build
diff --git a/pkgs/development/interpreters/luajit/2.1.nix b/pkgs/development/interpreters/luajit/2.1.nix
index 8efb86ab017..cf8531b7352 100644
--- a/pkgs/development/interpreters/luajit/2.1.nix
+++ b/pkgs/development/interpreters/luajit/2.1.nix
@@ -1,13 +1,15 @@
 { self, callPackage, fetchFromGitHub, passthruFun }:
 
-callPackage ./default.nix {
-  version = "2.1.0-2022-10-04";
+callPackage ./default.nix rec {
+  # The patch version is the timestamp of the git commit,
+  # obtain via `cat $(nix-build -A luajit_2_1.src)/.relver`
+  version = "2.1.1693350652";
 
   src = fetchFromGitHub {
     owner = "LuaJIT";
     repo = "LuaJIT";
-    rev = "6c4826f12c4d33b8b978004bc681eb1eef2be977";
-    hash = "sha256-GMgoSVHrfIuLdk8mW9XgdemNFsAkkQR4wiGGjaAXAKg=";
+    rev = "41fb94defa8f830ce69a8122b03f6ac3216d392a";
+    hash = "sha256-iY80CA97RqJ9gF1Kl7ms/lC6m6KScjxWmljh5Gy7Brg=";
   };
 
   inherit self passthruFun;
diff --git a/pkgs/development/interpreters/luajit/default.nix b/pkgs/development/interpreters/luajit/default.nix
index 16c2876f9f2..28493cc48ae 100644
--- a/pkgs/development/interpreters/luajit/default.nix
+++ b/pkgs/development/interpreters/luajit/default.nix
@@ -24,6 +24,7 @@
 , enableGDBJITSupport ? false
 , enableAPICheck ? false
 , enableVMAssertions ? false
+, enableRegisterAllocationRandomization ? false
 , useSystemMalloc ? false
 # Upstream generates randomized string id's by default for security reasons
 # https://github.com/LuaJIT/LuaJIT/issues/626. Deterministic string id's should
@@ -50,6 +51,7 @@ let
     ++ optional enableGDBJITSupport "-DLUAJIT_USE_GDBJIT"
     ++ optional enableAPICheck "-DLUAJIT_USE_APICHECK"
     ++ optional enableVMAssertions "-DLUAJIT_USE_ASSERT"
+    ++ optional enableRegisterAllocationRandomization "-DLUAJIT_RANDOM_RA"
     ++ optional deterministicStringIds "-DLUAJIT_SECURITY_STRID=0"
   ;
 
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index a1de2a55d98..6778dc460e0 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -454,8 +454,6 @@ in with passthru; stdenv.mkDerivation {
     done
     touch $out/lib/${libPrefix}/test/__init__.py
 
-    ln -s "$out/include/${executable}m" "$out/include/${executable}"
-
     # Determinism: Windows installers were not deterministic.
     # We're also not interested in building Windows installers.
     find "$out" -name 'wininst*.exe' | xargs -r rm -f
@@ -483,6 +481,9 @@ in with passthru; stdenv.mkDerivation {
     # This allows build Python to import host Python's sysconfigdata
     mkdir -p "$out/${sitePackages}"
     ln -s "$out/lib/${libPrefix}/"_sysconfigdata*.py "$out/${sitePackages}/"
+    '' + lib.optionalString (pythonOlder "3.8") ''
+    # This is gone in Python >= 3.8
+    ln -s "$out/include/${executable}m" "$out/include/${executable}"
     '' + optionalString stripConfig ''
     rm -R $out/bin/python*-config $out/lib/python*/config-*
     '' + optionalString stripIdlelib ''
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 4c8c7ed8f43..7b741b803de 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -1,7 +1,8 @@
 { lib
 , stdenv
 , config
-, fetchurl
+, fetchFromGitHub
+, nix-update-script
 , pkg-config
 , libGLSupported ? lib.elem stdenv.hostPlatform.system lib.platforms.mesaPlatforms
 , openglSupport ? libGLSupported
@@ -55,11 +56,13 @@
 
 stdenv.mkDerivation rec {
   pname = "SDL2";
-  version = "2.28.2";
+  version = "2.28.3";
 
-  src = fetchurl {
-    url = "https://www.libsdl.org/release/${pname}-${version}.tar.gz";
-    hash = "sha256-ZLEQL6Igk1FbAu8z3Yc53uG6V+nbumoJKUK4u+0aHF4=";
+  src = fetchFromGitHub {
+    owner = "libsdl-org";
+    repo = "SDL";
+    rev = "release-${version}";
+    hash = "sha256-/kQ2IyvAfmZ+zIUt1WuEIeX0nYPGXDlAQk2qDsQnFFs=";
   };
   dontDisableStatic = if withStatic then 1 else 0;
   outputs = [ "out" "dev" ];
@@ -165,7 +168,10 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
-  passthru = { inherit openglSupport; };
+  passthru = {
+    inherit openglSupport;
+    updateScript = nix-update-script { extraArgs = ["--version-regex" "release-(.*)"]; };
+  };
 
   meta = with lib; {
     description = "A cross-platform multimedia library";
diff --git a/pkgs/development/libraries/aubio/default.nix b/pkgs/development/libraries/aubio/default.nix
index 673064db7a5..2e8bdc50ca6 100644
--- a/pkgs/development/libraries/aubio/default.nix
+++ b/pkgs/development/libraries/aubio/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, alsa-lib, fftw, libjack2, libsamplerate
-, libsndfile, pkg-config, python3, waf
+, libsndfile, pkg-config, python3, wafHook
 }:
 
 stdenv.mkDerivation rec {
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1npks71ljc48w6858l9bq30kaf5nph8z0v61jkfb70xb9np850nl";
   };
 
-  nativeBuildInputs = [ pkg-config python3 waf.hook ];
+  nativeBuildInputs = [ pkg-config python3 wafHook ];
   buildInputs = [ alsa-lib fftw libjack2 libsamplerate libsndfile ];
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/audio/lilv/default.nix b/pkgs/development/libraries/audio/lilv/default.nix
index b51a608c969..14b0d4c5e46 100644
--- a/pkgs/development/libraries/audio/lilv/default.nix
+++ b/pkgs/development/libraries/audio/lilv/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, lv2, pkg-config, python3, serd, sord, sratom, waf
+{ lib, stdenv, fetchurl, lv2, pkg-config, python3, serd, sord, sratom, wafHook
 
 # test derivations
 , pipewire
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./lilv-pkgconfig.patch ];
 
-  nativeBuildInputs = [ pkg-config python3 waf.hook ];
+  nativeBuildInputs = [ pkg-config python3 wafHook ];
   buildInputs = [ serd sord sratom ];
   propagatedBuildInputs = [ lv2 ];
   dontAddWafCrossFlags = true;
diff --git a/pkgs/development/libraries/audio/lvtk/default.nix b/pkgs/development/libraries/audio/lvtk/default.nix
index af784d80a3a..9822640f8d6 100644
--- a/pkgs/development/libraries/audio/lvtk/default.nix
+++ b/pkgs/development/libraries/audio/lvtk/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, boost, gtkmm2, lv2, pkg-config, python3, waf }:
+{ lib, stdenv, fetchFromGitHub, boost, gtkmm2, lv2, pkg-config, python3, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "lvtk";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-6IoyhBig3Nvc4Y8F0w8b1up6sn8O2RmoUVaBQ//+Aaw=";
   };
 
-  nativeBuildInputs = [ pkg-config python3 waf.hook ];
+  nativeBuildInputs = [ pkg-config python3 wafHook ];
   buildInputs = [ boost gtkmm2 lv2 ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/audio/ntk/default.nix b/pkgs/development/libraries/audio/ntk/default.nix
index 3b8ecb807aa..d101e2a960c 100644
--- a/pkgs/development/libraries/audio/ntk/default.nix
+++ b/pkgs/development/libraries/audio/ntk/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cairo, libjpeg, libXft, pkg-config, python3, waf }:
+{ lib, stdenv, fetchFromGitHub, cairo, libjpeg, libXft, pkg-config, python3, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "ntk";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-NyEdg6e+9CI9V+TIgdpPyH1ei+Vq8pUxD3wPzWY5fEU=";
   };
 
-  nativeBuildInputs = [ pkg-config waf.hook ];
+  nativeBuildInputs = [ pkg-config wafHook ];
   buildInputs = [
     cairo libjpeg libXft python3
   ];
diff --git a/pkgs/development/libraries/audio/raul/default.nix b/pkgs/development/libraries/audio/raul/default.nix
index b8e21e36bba..c200d4ab79c 100644
--- a/pkgs/development/libraries/audio/raul/default.nix
+++ b/pkgs/development/libraries/audio/raul/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, boost, gtk2, pkg-config, python3, waf }:
+{ lib, stdenv, fetchgit, boost, gtk2, pkg-config, python3, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "raul";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "1z37jb6ghc13b8nv8a8hcg669gl8vh4ni9djvfgga9vcz8rmcg8l";
   };
 
-  nativeBuildInputs = [ pkg-config waf.hook python3 ];
+  nativeBuildInputs = [ pkg-config wafHook python3 ];
   buildInputs = [ boost gtk2 ];
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/audio/suil/default.nix b/pkgs/development/libraries/audio/suil/default.nix
index f037b61e3bc..3dc3bb5dacd 100644
--- a/pkgs/development/libraries/audio/suil/default.nix
+++ b/pkgs/development/libraries/audio/suil/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, gtk2, lv2, pkg-config, python3, serd, sord, sratom
-, waf
+, wafHook
 , withQt5 ? true, qt5 ? null
 }:
 
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "0z4v01pjw4wh65x38w6icn28wdwxz13ayl8hvn4p1g9kmamp1z06";
   };
 
-  nativeBuildInputs = [ pkg-config waf.hook python3 ];
+  nativeBuildInputs = [ pkg-config wafHook python3 ];
   buildInputs = [ gtk2 lv2 serd sord sratom ]
     ++ lib.optionals withQt5 (with qt5; [ qtbase qttools ]);
 
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index 905e93de7a7..6bd9a8b8f1a 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -1,4 +1,4 @@
-import ./generic.nix rec {
+import ./generic.nix {
   version = "4.4.4";
   sha256 = "sha256-Q8bkuF/1uJfqttJJoObnnLX3BEduv+qxsvOrVhMvRjA=";
   extraPatches = [
diff --git a/pkgs/development/libraries/ffmpeg/5.nix b/pkgs/development/libraries/ffmpeg/5.nix
index dcfe033f040..a3ff054f1e6 100644
--- a/pkgs/development/libraries/ffmpeg/5.nix
+++ b/pkgs/development/libraries/ffmpeg/5.nix
@@ -1,4 +1,4 @@
-import ./generic.nix rec {
+import ./generic.nix {
   version = "5.1.3";
   sha256 = "sha256-twfJvANLQGO7TiyHPMPqApfHLFUlOGZTTIIGEnjyvuE=";
   extraPatches = [
diff --git a/pkgs/development/libraries/ffmpeg/6.nix b/pkgs/development/libraries/ffmpeg/6.nix
index cf29526fbcb..37bdf5b060f 100644
--- a/pkgs/development/libraries/ffmpeg/6.nix
+++ b/pkgs/development/libraries/ffmpeg/6.nix
@@ -1,4 +1,4 @@
-import ./generic.nix rec {
+import ./generic.nix {
   version = "6.0";
   sha256 = "sha256-RVbgsafIbeUUNXmUbDQ03ZN42oaUo0njqROo7KOQgv0=";
 }
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index a1ca20f9483..6bde5aa776b 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -1,4 +1,4 @@
-{ version, sha256, extraPatches ? [], knownVulnerabilities ? [] }:
+{ version, sha256, extraPatches ? [] }:
 
 { lib, stdenv, buildPackages, removeReferencesTo, addOpenGLRunpath, pkg-config, perl, texinfo, yasm
 
@@ -33,7 +33,6 @@
 , withBzlib ? withHeadlessDeps
 , withCaca ? withFullDeps # Textual display (ASCII art)
 , withCelt ? withFullDeps # CELT decoder
-, withCrystalhd ? withFullDeps
 , withCuda ? withFullDeps && (with stdenv; (!isDarwin && !hostPlatform.isAarch && !hostPlatform.isRiscV))
 , withCudaLLVM ? withFullDeps
 , withDav1d ? withHeadlessDeps # AV1 decoder (focused on speed and correctness)
@@ -49,7 +48,6 @@
 , withGnutls ? withHeadlessDeps
 , withGsm ? withFullDeps # GSM de/encoder
 , withIconv ? withHeadlessDeps
-, withIlbc ? withFullDeps
 , withJack ? withFullDeps && !stdenv.isDarwin # Jack audio
 , withLadspa ? withFullDeps # LADSPA audio filtering
 , withLibplacebo ? withFullDeps && !stdenv.isDarwin # libplacebo video processing library
@@ -79,7 +77,7 @@
 , withSrt ? withHeadlessDeps # Secure Reliable Transport (SRT) protocol
 , withSsh ? withHeadlessDeps # SFTP protocol
 , withSvg ? withFullDeps # SVG protocol
-, withSvtav1 ? withFullDeps && !stdenv.isAarch64 # AV1 encoder/decoder (focused on speed and correctness)
+, withSvtav1 ? withHeadlessDeps && !stdenv.isAarch64 # AV1 encoder/decoder (focused on speed and correctness)
 , withTensorflow ? false # Tensorflow dnn backend support
 , withTheora ? withHeadlessDeps # Theora encoder
 , withV4l2 ? withFullDeps && !stdenv.isDarwin # Video 4 Linux support
diff --git a/pkgs/development/libraries/fortify-headers/default.nix b/pkgs/development/libraries/fortify-headers/default.nix
index 2c24665456b..1f418af7ae9 100644
--- a/pkgs/development/libraries/fortify-headers/default.nix
+++ b/pkgs/development/libraries/fortify-headers/default.nix
@@ -15,6 +15,11 @@ stdenv.mkDerivation {
     hash = "sha256-8A8JcKHIBgXpUuIP4zs3Q1yBs5jCGd5F3H2E8UN/S2g=";
   };
 
+  patches = [
+    ./wchar-imports-skip.patch
+    ./restore-macros.patch
+  ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/development/libraries/fortify-headers/restore-macros.patch b/pkgs/development/libraries/fortify-headers/restore-macros.patch
new file mode 100644
index 00000000000..f7d31a329e3
--- /dev/null
+++ b/pkgs/development/libraries/fortify-headers/restore-macros.patch
@@ -0,0 +1,283 @@
+restore #undef'ed macro values after we're done
+
+some programs that define these miss them if removed
+
+push_macro and pop_macro pragmas allegedly well supported
+by gcc, clang and msvc
+
+--- a/include/fortify/poll.h
++++ b/include/fortify/poll.h
+@@ -29,6 +29,7 @@ __extension__
+ extern "C" {
+ #endif
+ 
++#pragma push_macro("poll")
+ #undef poll
+ 
+ _FORTIFY_FN(poll) int poll(struct pollfd * _FORTIFY_POS0 __f, nfds_t __n, int __s)
+@@ -40,6 +41,8 @@ _FORTIFY_FN(poll) int poll(struct pollfd * _FORTIFY_POS0 __f, nfds_t __n, int __
+ 	return __orig_poll(__f, __n, __s);
+ }
+ 
++#pragma pop_macro("poll")
++
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/include/fortify/stdio.h
++++ b/include/fortify/stdio.h
+@@ -29,12 +29,19 @@ __extension__
+ extern "C" {
+ #endif
+ 
++#pragma push_macro("fgets")
+ #undef fgets
++#pragma push_macro("fread")
+ #undef fread
++#pragma push_macro("fwrite")
+ #undef fwrite
++#pragma push_macro("vsprintf")
+ #undef vsprintf
++#pragma push_macro("vsnprintf")
+ #undef vsnprintf
++#pragma push_macro("snprintf")
+ #undef snprintf
++#pragma push_macro("sprintf")
+ #undef sprintf
+ 
+ _FORTIFY_FN(fgets) char *fgets(char * _FORTIFY_POS0 __s, int __n, FILE *__f)
+@@ -140,6 +147,14 @@ _FORTIFY_FN(sprintf) int sprintf(char *__s, const char *__f, ...)
+ #endif /* __has_builtin(__builtin_va_arg_pack) */
+ #endif /* defined(__has_builtin) */
+ 
++#pragma pop_macro("fgets")
++#pragma pop_macro("fread")
++#pragma pop_macro("fwrite")
++#pragma pop_macro("vsprintf")
++#pragma pop_macro("vsnprintf")
++#pragma pop_macro("snprintf")
++#pragma pop_macro("sprintf")
++
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/include/fortify/stdlib.h
++++ b/include/fortify/stdlib.h
+@@ -38,7 +38,10 @@ extern "C" {
+ 
+ /* FIXME clang */
+ #if (defined(_XOPEN_SOURCE) || defined(_GNU_SOURCE) || defined(_BSD_SOURCE)) && !defined(__clang__)
++
++#pragma push_macro("realpath")
+ #undef realpath
++
+ _FORTIFY_FN(realpath) char *realpath(const char *__p, char *__r)
+ {
+ #ifndef PATH_MAX
+@@ -60,6 +63,9 @@ _FORTIFY_FN(realpath) char *realpath(const char *__p, char *__r)
+ 	return __orig_realpath(__p, __r);
+ #endif
+ }
++
++#pragma pop_macro("realpath")
++
+ #endif
+ 
+ #ifdef __cplusplus
+--- a/include/fortify/string.h
++++ b/include/fortify/string.h
+@@ -29,12 +29,19 @@ __extension__
+ extern "C" {
+ #endif
+ 
++#pragma push_macro("memcpy")
+ #undef memcpy
++#pragma push_macro("memmove")
+ #undef memmove
++#pragma push_macro("memset")
+ #undef memset
++#pragma push_macro("strcat")
+ #undef strcat
++#pragma push_macro("strcpy")
+ #undef strcpy
++#pragma push_macro("strncat")
+ #undef strncat
++#pragma push_macro("strncpy")
+ #undef strncpy
+ 
+ _FORTIFY_FN(memcpy) void *memcpy(void * _FORTIFY_POS0 __od,
+@@ -183,6 +190,14 @@ _FORTIFY_FN(strlcpy) size_t strlcpy(char * _FORTIFY_POS0 __d,
+ }
+ #endif
+ 
++#pragma pop_macro("memcpy")
++#pragma pop_macro("memmove")
++#pragma pop_macro("memset")
++#pragma pop_macro("strcat")
++#pragma pop_macro("strcpy")
++#pragma pop_macro("strncat")
++#pragma pop_macro("strncpy")
++
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/include/fortify/strings.h
++++ b/include/fortify/strings.h
+@@ -29,8 +29,12 @@ extern "C" {
+ #if defined(_GNU_SOURCE) || defined(_BSD_SOURCE) || defined(_POSIX_SOURCE) \
+  || (defined(_POSIX_C_SOURCE) && _POSIX_C_SOURCE+0 < 200809L) \
+  || (defined(_XOPEN_SOURCE) && _XOPEN_SOURCE+0 < 700)
++
++#pragma push_macro("bcopy")
+ #undef bcopy
++#pragma push_macro("bzero")
+ #undef bzero
++
+ _FORTIFY_FN(bcopy) void bcopy(const void * _FORTIFY_POS0 __s,
+                               void * _FORTIFY_POS0 __d, size_t __n)
+ {
+@@ -52,6 +56,9 @@ _FORTIFY_FN(bzero) void bzero(void * _FORTIFY_POS0 __s, size_t __n)
+ }
+ #endif
+ 
++#pragma pop_macro("bcopy")
++#pragma pop_macro("bzero")
++
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/include/fortify/sys/socket.h
++++ b/include/fortify/sys/socket.h
+@@ -29,9 +29,13 @@ __extension__
+ extern "C" {
+ #endif
+ 
++#pragma push_macro("recv")
+ #undef recv
++#pragma push_macro("recvfrom")
+ #undef recvfrom
++#pragma push_macro("send")
+ #undef send
++#pragma push_macro("sendto")
+ #undef sendto
+ 
+ _FORTIFY_FN(recv) ssize_t recv(int __f, void * _FORTIFY_POS0 __s, size_t __n,
+@@ -76,6 +80,11 @@ _FORTIFY_FN(sendto) ssize_t sendto(int __f, const void * _FORTIFY_POS0 __s,
+ 	return __orig_sendto(__f, __s, __n, __fl, __a, __l);
+ }
+ 
++#pragma push_macro("recv")
++#pragma push_macro("recvfrom")
++#pragma push_macro("send")
++#pragma push_macro("sendto")
++
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/include/fortify/unistd.h
++++ b/include/fortify/unistd.h
+@@ -29,16 +29,27 @@ __extension__
+ extern "C" {
+ #endif
+ 
++#pragma push_macro("confstr")
+ #undef confstr
++#pragma push_macro("getcwd")
+ #undef getcwd
++#pragma push_macro("getgroups")
+ #undef getgroups
++#pragma push_macro("gethostname")
+ #undef gethostname
++#pragma push_macro("getlogin_r")
+ #undef getlogin_r
++#pragma push_macro("pread")
+ #undef pread
++#pragma push_macro("read")
+ #undef read
++#pragma push_macro("readlink")
+ #undef readlink
++#pragma push_macro("readlinkat")
+ #undef readlinkat
++#pragma push_macro("ttyname_r")
+ #undef ttyname_r
++#pragma push_macro("write")
+ #undef write
+ 
+ _FORTIFY_FN(confstr) size_t confstr(int __n, char * _FORTIFY_POS0 __s, size_t __l)
+@@ -158,6 +169,18 @@ _FORTIFY_FN(write) ssize_t write(int __f, const void * _FORTIFY_POS0 __s,
+ 	return __orig_write(__f, __s, __n);
+ }
+ 
++#pragma pop_macro("confstr")
++#pragma pop_macro("getcwd")
++#pragma pop_macro("getgroups")
++#pragma pop_macro("gethostname")
++#pragma pop_macro("getlogin_r")
++#pragma pop_macro("pread")
++#pragma pop_macro("read")
++#pragma pop_macro("readlink")
++#pragma pop_macro("readlinkat")
++#pragma pop_macro("ttyname_r")
++#pragma pop_macro("write")
++
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/include/fortify/wchar.h
++++ b/include/fortify/wchar.h
+@@ -43,19 +43,33 @@ __extension__
+ extern "C" {
+ #endif
+ 
++#pragma push_macro("fgetws")
+ #undef fgetws
++#pragma push_macro("mbsrtowcs")
+ #undef mbsrtowcs
++#pragma push_macro("mbstowcs")
+ #undef mbstowcs
++#pragma push_macro("wcrtomb")
+ #undef wcrtomb
++#pragma push_macro("wcscat")
+ #undef wcscat
++#pragma push_macro("wcscpy")
+ #undef wcscpy
++#pragma push_macro("wcsncat")
+ #undef wcsncat
++#pragma push_macro("wcsncpy")
+ #undef wcsncpy
++#pragma push_macro("wcsrtombs")
+ #undef wcsrtombs
++#pragma push_macro("wcstombs")
+ #undef wcstombs
++#pragma push_macro("wctomb")
+ #undef wctomb
++#pragma push_macro("wmemcpy")
+ #undef wmemcpy
++#pragma push_macro("wmemmove")
+ #undef wmemmove
++#pragma push_macro("wmemset")
+ #undef wmemset
+ 
+ _FORTIFY_FN(fgetws) wchar_t *fgetws(wchar_t * _FORTIFY_POS0 __s,
+@@ -269,6 +283,21 @@ _FORTIFY_FN(wmemset) wchar_t *wmemset(wchar_t * _FORTIFY_POS0 __s,
+ 	return __orig_wmemset(__s, __c, __n);
+ }
+ 
++#pragma pop_macro("fgetws")
++#pragma pop_macro("mbsrtowcs")
++#pragma pop_macro("mbstowcs")
++#pragma pop_macro("wcrtomb")
++#pragma pop_macro("wcscat")
++#pragma pop_macro("wcscpy")
++#pragma pop_macro("wcsncat")
++#pragma pop_macro("wcsncpy")
++#pragma pop_macro("wcsrtombs")
++#pragma pop_macro("wcstombs")
++#pragma pop_macro("wctomb")
++#pragma pop_macro("wmemcpy")
++#pragma pop_macro("wmemmove")
++#pragma pop_macro("wmemset")
++
+ #ifdef __cplusplus
+ }
+ #endif
diff --git a/pkgs/development/libraries/fortify-headers/wchar-imports-skip.patch b/pkgs/development/libraries/fortify-headers/wchar-imports-skip.patch
new file mode 100644
index 00000000000..255ceba9f09
--- /dev/null
+++ b/pkgs/development/libraries/fortify-headers/wchar-imports-skip.patch
@@ -0,0 +1,41 @@
+wchar.h: only include other headers if _FORTIFY_SOURCE is enabled
+
+unexpectedly including other headers can cause problems with
+sensitive/brittle code, particularly with alternative compilers
+(clang) which are already operating on the margins of what's
+supported/expected by some projects.
+
+having a way to almost entirely short-circuit these headers (by
+disabling _FORTIFY_SOURCE) is therefore important.
+
+--- a/include/fortify/wchar.h
++++ b/include/fortify/wchar.h
+@@ -20,21 +20,23 @@
+ #if !defined(__cplusplus) && !defined(__clang__)
+ __extension__
+ #endif
+-#include_next <limits.h>
++#include_next <wchar.h>
++
++#if defined(_FORTIFY_SOURCE) && _FORTIFY_SOURCE > 0 && defined(__OPTIMIZE__) && __OPTIMIZE__ > 0
++
+ #if !defined(__cplusplus) && !defined(__clang__)
+ __extension__
+ #endif
+-#include_next <stdlib.h>
++#include_next <limits.h>
+ #if !defined(__cplusplus) && !defined(__clang__)
+ __extension__
+ #endif
+-#include_next <string.h>
++#include_next <stdlib.h>
+ #if !defined(__cplusplus) && !defined(__clang__)
+ __extension__
+ #endif
+-#include_next <wchar.h>
++#include_next <string.h>
+ 
+-#if defined(_FORTIFY_SOURCE) && _FORTIFY_SOURCE > 0 && defined(__OPTIMIZE__) && __OPTIMIZE__ > 0
+ #include "fortify-headers.h"
+ 
+ #ifdef __cplusplus
diff --git a/pkgs/development/libraries/ganv/default.nix b/pkgs/development/libraries/ganv/default.nix
index 9818afa9412..d53206ca667 100644
--- a/pkgs/development/libraries/ganv/default.nix
+++ b/pkgs/development/libraries/ganv/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, graphviz, gtk2, gtkmm2, pkg-config, python3, waf }:
+{ lib, stdenv, fetchgit, graphviz, gtk2, gtkmm2, pkg-config, python3, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "ganv";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "01znnalirbqxpz62fbw2c14c8xn117jc92xv6dhb3hln92k9x37f";
   };
 
-  nativeBuildInputs = [ pkg-config waf.hook python3 gtk2 ];
+  nativeBuildInputs = [ pkg-config wafHook python3 gtk2 ];
   buildInputs = [ graphviz gtkmm2 ];
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index 6af608995c2..b223f249f83 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -26,11 +26,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gpgme";
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchurl {
     url = "mirror://gnupg/gpgme/${pname}-${version}.tar.bz2";
-    hash = "sha256-QW4XThZXNNhIBiU/jJa9opk/0H8ljDqtXwU6bv1GPog=";
+    hash = "sha256-lVHjcIGtO96BAYoNJPJFw/ggaZBUlZj7Mal6aDgKe3E=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/ldb/default.nix b/pkgs/development/libraries/ldb/default.nix
index 753dee9e3f0..95547fb6382 100644
--- a/pkgs/development/libraries/ldb/default.nix
+++ b/pkgs/development/libraries/ldb/default.nix
@@ -11,7 +11,7 @@
 , docbook-xsl-nons
 , docbook_xml_dtd_42
 , cmocka
-, waf
+, wafHook
 , libxcrypt
 }:
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     python3
-    waf.hook
+    wafHook
     libxslt
     docbook-xsl-nons
     docbook_xml_dtd_42
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index c8e9efdfa77..a159a1fb5f6 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -45,7 +45,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.23.0";
+  version = "1.24.0";
 
   outputs = [ "bin" "out" "dev" ];
 
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     owner = "libinput";
     repo = "libinput";
     rev = version;
-    sha256 = "7Wxriy1fVsfAhcfhOhuvLehhmQYrQ2IgZTK53bt12HI=";
+    sha256 = "sha256-gTcgEZ7cs4jq8w5Genxtio9nVFy7y3n0nNXJ6SVtYHY=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/libwebp/CVE-2023-4863.patch b/pkgs/development/libraries/libwebp/CVE-2023-4863.patch
new file mode 100644
index 00000000000..c01b8a48667
--- /dev/null
+++ b/pkgs/development/libraries/libwebp/CVE-2023-4863.patch
@@ -0,0 +1,361 @@
+From 4de93ac70c3292fc944e4587101a52a29f8b0c9c Mon Sep 17 00:00:00 2001
+From: Vincent Rabaud <vrabaud@google.com>
+Date: Thu, 7 Sep 2023 21:16:03 +0200
+Subject: [PATCH] Fix OOB write in BuildHuffmanTable.
+
+First, BuildHuffmanTable is called to check if the data is valid.
+If it is and the table is not big enough, more memory is allocated.
+
+This will make sure that valid (but unoptimized because of unbalanced
+codes) streams are still decodable.
+
+Bug: chromium:1479274
+Change-Id: I31c36dbf3aa78d35ecf38706b50464fd3d375741
+(cherry picked from commit 902bc9190331343b2017211debcec8d2ab87e17a)
+---
+ src/dec/vp8l_dec.c        | 46 ++++++++++---------
+ src/dec/vp8li_dec.h       |  2 +-
+ src/utils/huffman_utils.c | 97 +++++++++++++++++++++++++++++++--------
+ src/utils/huffman_utils.h | 27 +++++++++--
+ 4 files changed, 129 insertions(+), 43 deletions(-)
+
+diff --git a/src/dec/vp8l_dec.c b/src/dec/vp8l_dec.c
+index c0ea0181..7995313f 100644
+--- a/src/dec/vp8l_dec.c
++++ b/src/dec/vp8l_dec.c
+@@ -253,11 +253,11 @@ static int ReadHuffmanCodeLengths(
+   int symbol;
+   int max_symbol;
+   int prev_code_len = DEFAULT_CODE_LENGTH;
+-  HuffmanCode table[1 << LENGTHS_TABLE_BITS];
++  HuffmanTables tables;
+ 
+-  if (!VP8LBuildHuffmanTable(table, LENGTHS_TABLE_BITS,
+-                             code_length_code_lengths,
+-                             NUM_CODE_LENGTH_CODES)) {
++  if (!VP8LHuffmanTablesAllocate(1 << LENGTHS_TABLE_BITS, &tables) ||
++      !VP8LBuildHuffmanTable(&tables, LENGTHS_TABLE_BITS,
++                             code_length_code_lengths, NUM_CODE_LENGTH_CODES)) {
+     goto End;
+   }
+ 
+@@ -277,7 +277,7 @@ static int ReadHuffmanCodeLengths(
+     int code_len;
+     if (max_symbol-- == 0) break;
+     VP8LFillBitWindow(br);
+-    p = &table[VP8LPrefetchBits(br) & LENGTHS_TABLE_MASK];
++    p = &tables.curr_segment->start[VP8LPrefetchBits(br) & LENGTHS_TABLE_MASK];
+     VP8LSetBitPos(br, br->bit_pos_ + p->bits);
+     code_len = p->value;
+     if (code_len < kCodeLengthLiterals) {
+@@ -300,6 +300,7 @@ static int ReadHuffmanCodeLengths(
+   ok = 1;
+ 
+  End:
++  VP8LHuffmanTablesDeallocate(&tables);
+   if (!ok) dec->status_ = VP8_STATUS_BITSTREAM_ERROR;
+   return ok;
+ }
+@@ -307,7 +308,8 @@ static int ReadHuffmanCodeLengths(
+ // 'code_lengths' is pre-allocated temporary buffer, used for creating Huffman
+ // tree.
+ static int ReadHuffmanCode(int alphabet_size, VP8LDecoder* const dec,
+-                           int* const code_lengths, HuffmanCode* const table) {
++                           int* const code_lengths,
++                           HuffmanTables* const table) {
+   int ok = 0;
+   int size = 0;
+   VP8LBitReader* const br = &dec->br_;
+@@ -362,8 +364,7 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
+   VP8LMetadata* const hdr = &dec->hdr_;
+   uint32_t* huffman_image = NULL;
+   HTreeGroup* htree_groups = NULL;
+-  HuffmanCode* huffman_tables = NULL;
+-  HuffmanCode* huffman_table = NULL;
++  HuffmanTables* huffman_tables = &hdr->huffman_tables_;
+   int num_htree_groups = 1;
+   int num_htree_groups_max = 1;
+   int max_alphabet_size = 0;
+@@ -372,6 +373,10 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
+   int* mapping = NULL;
+   int ok = 0;
+ 
++  // Check the table has been 0 initialized (through InitMetadata).
++  assert(huffman_tables->root.start == NULL);
++  assert(huffman_tables->curr_segment == NULL);
++
+   if (allow_recursion && VP8LReadBits(br, 1)) {
+     // use meta Huffman codes.
+     const int huffman_precision = VP8LReadBits(br, 3) + 2;
+@@ -434,16 +439,15 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
+ 
+   code_lengths = (int*)WebPSafeCalloc((uint64_t)max_alphabet_size,
+                                       sizeof(*code_lengths));
+-  huffman_tables = (HuffmanCode*)WebPSafeMalloc(num_htree_groups * table_size,
+-                                                sizeof(*huffman_tables));
+   htree_groups = VP8LHtreeGroupsNew(num_htree_groups);
+ 
+-  if (htree_groups == NULL || code_lengths == NULL || huffman_tables == NULL) {
++  if (htree_groups == NULL || code_lengths == NULL ||
++      !VP8LHuffmanTablesAllocate(num_htree_groups * table_size,
++                                 huffman_tables)) {
+     dec->status_ = VP8_STATUS_OUT_OF_MEMORY;
+     goto Error;
+   }
+ 
+-  huffman_table = huffman_tables;
+   for (i = 0; i < num_htree_groups_max; ++i) {
+     // If the index "i" is unused in the Huffman image, just make sure the
+     // coefficients are valid but do not store them.
+@@ -468,19 +472,20 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
+       int max_bits = 0;
+       for (j = 0; j < HUFFMAN_CODES_PER_META_CODE; ++j) {
+         int alphabet_size = kAlphabetSize[j];
+-        htrees[j] = huffman_table;
+         if (j == 0 && color_cache_bits > 0) {
+           alphabet_size += (1 << color_cache_bits);
+         }
+-        size = ReadHuffmanCode(alphabet_size, dec, code_lengths, huffman_table);
++        size =
++            ReadHuffmanCode(alphabet_size, dec, code_lengths, huffman_tables);
++        htrees[j] = huffman_tables->curr_segment->curr_table;
+         if (size == 0) {
+           goto Error;
+         }
+         if (is_trivial_literal && kLiteralMap[j] == 1) {
+-          is_trivial_literal = (huffman_table->bits == 0);
++          is_trivial_literal = (htrees[j]->bits == 0);
+         }
+-        total_size += huffman_table->bits;
+-        huffman_table += size;
++        total_size += htrees[j]->bits;
++        huffman_tables->curr_segment->curr_table += size;
+         if (j <= ALPHA) {
+           int local_max_bits = code_lengths[0];
+           int k;
+@@ -515,14 +520,13 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
+   hdr->huffman_image_ = huffman_image;
+   hdr->num_htree_groups_ = num_htree_groups;
+   hdr->htree_groups_ = htree_groups;
+-  hdr->huffman_tables_ = huffman_tables;
+ 
+  Error:
+   WebPSafeFree(code_lengths);
+   WebPSafeFree(mapping);
+   if (!ok) {
+     WebPSafeFree(huffman_image);
+-    WebPSafeFree(huffman_tables);
++    VP8LHuffmanTablesDeallocate(huffman_tables);
+     VP8LHtreeGroupsFree(htree_groups);
+   }
+   return ok;
+@@ -1358,7 +1362,7 @@ static void ClearMetadata(VP8LMetadata* const hdr) {
+   assert(hdr != NULL);
+ 
+   WebPSafeFree(hdr->huffman_image_);
+-  WebPSafeFree(hdr->huffman_tables_);
++  VP8LHuffmanTablesDeallocate(&hdr->huffman_tables_);
+   VP8LHtreeGroupsFree(hdr->htree_groups_);
+   VP8LColorCacheClear(&hdr->color_cache_);
+   VP8LColorCacheClear(&hdr->saved_color_cache_);
+@@ -1673,7 +1677,7 @@ int VP8LDecodeImage(VP8LDecoder* const dec) {
+ 
+   if (dec == NULL) return 0;
+ 
+-  assert(dec->hdr_.huffman_tables_ != NULL);
++  assert(dec->hdr_.huffman_tables_.root.start != NULL);
+   assert(dec->hdr_.htree_groups_ != NULL);
+   assert(dec->hdr_.num_htree_groups_ > 0);
+ 
+diff --git a/src/dec/vp8li_dec.h b/src/dec/vp8li_dec.h
+index 72b2e861..32540a4b 100644
+--- a/src/dec/vp8li_dec.h
++++ b/src/dec/vp8li_dec.h
+@@ -51,7 +51,7 @@ typedef struct {
+   uint32_t*       huffman_image_;
+   int             num_htree_groups_;
+   HTreeGroup*     htree_groups_;
+-  HuffmanCode*    huffman_tables_;
++  HuffmanTables   huffman_tables_;
+ } VP8LMetadata;
+ 
+ typedef struct VP8LDecoder VP8LDecoder;
+diff --git a/src/utils/huffman_utils.c b/src/utils/huffman_utils.c
+index 90c2fbf7..cf73abd4 100644
+--- a/src/utils/huffman_utils.c
++++ b/src/utils/huffman_utils.c
+@@ -177,21 +177,24 @@ static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
+       if (num_open < 0) {
+         return 0;
+       }
+-      if (root_table == NULL) continue;
+       for (; count[len] > 0; --count[len]) {
+         HuffmanCode code;
+         if ((key & mask) != low) {
+-          table += table_size;
++          if (root_table != NULL) table += table_size;
+           table_bits = NextTableBitSize(count, len, root_bits);
+           table_size = 1 << table_bits;
+           total_size += table_size;
+           low = key & mask;
+-          root_table[low].bits = (uint8_t)(table_bits + root_bits);
+-          root_table[low].value = (uint16_t)((table - root_table) - low);
++          if (root_table != NULL) {
++            root_table[low].bits = (uint8_t)(table_bits + root_bits);
++            root_table[low].value = (uint16_t)((table - root_table) - low);
++          }
++        }
++        if (root_table != NULL) {
++          code.bits = (uint8_t)(len - root_bits);
++          code.value = (uint16_t)sorted[symbol++];
++          ReplicateValue(&table[key >> root_bits], step, table_size, code);
+         }
+-        code.bits = (uint8_t)(len - root_bits);
+-        code.value = (uint16_t)sorted[symbol++];
+-        ReplicateValue(&table[key >> root_bits], step, table_size, code);
+         key = GetNextKey(key, len);
+       }
+     }
+@@ -211,25 +214,83 @@ static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
+   ((1 << MAX_CACHE_BITS) + NUM_LITERAL_CODES + NUM_LENGTH_CODES)
+ // Cut-off value for switching between heap and stack allocation.
+ #define SORTED_SIZE_CUTOFF 512
+-int VP8LBuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
++int VP8LBuildHuffmanTable(HuffmanTables* const root_table, int root_bits,
+                           const int code_lengths[], int code_lengths_size) {
+-  int total_size;
++  const int total_size =
++      BuildHuffmanTable(NULL, root_bits, code_lengths, code_lengths_size, NULL);
+   assert(code_lengths_size <= MAX_CODE_LENGTHS_SIZE);
+-  if (root_table == NULL) {
+-    total_size = BuildHuffmanTable(NULL, root_bits,
+-                                   code_lengths, code_lengths_size, NULL);
+-  } else if (code_lengths_size <= SORTED_SIZE_CUTOFF) {
++  if (total_size == 0 || root_table == NULL) return total_size;
++
++  if (root_table->curr_segment->curr_table + total_size >=
++      root_table->curr_segment->start + root_table->curr_segment->size) {
++    // If 'root_table' does not have enough memory, allocate a new segment.
++    // The available part of root_table->curr_segment is left unused because we
++    // need a contiguous buffer.
++    const int segment_size = root_table->curr_segment->size;
++    struct HuffmanTablesSegment* next =
++        (HuffmanTablesSegment*)WebPSafeMalloc(1, sizeof(*next));
++    if (next == NULL) return 0;
++    // Fill the new segment.
++    // We need at least 'total_size' but if that value is small, it is better to
++    // allocate a big chunk to prevent more allocations later. 'segment_size' is
++    // therefore chosen (any other arbitrary value could be chosen).
++    next->size = total_size > segment_size ? total_size : segment_size;
++    next->start =
++        (HuffmanCode*)WebPSafeMalloc(next->size, sizeof(*next->start));
++    if (next->start == NULL) {
++      WebPSafeFree(next);
++      return 0;
++    }
++    next->curr_table = next->start;
++    next->next = NULL;
++    // Point to the new segment.
++    root_table->curr_segment->next = next;
++    root_table->curr_segment = next;
++  }
++  if (code_lengths_size <= SORTED_SIZE_CUTOFF) {
+     // use local stack-allocated array.
+     uint16_t sorted[SORTED_SIZE_CUTOFF];
+-    total_size = BuildHuffmanTable(root_table, root_bits,
+-                                   code_lengths, code_lengths_size, sorted);
+-  } else {   // rare case. Use heap allocation.
++    BuildHuffmanTable(root_table->curr_segment->curr_table, root_bits,
++                      code_lengths, code_lengths_size, sorted);
++  } else {  // rare case. Use heap allocation.
+     uint16_t* const sorted =
+         (uint16_t*)WebPSafeMalloc(code_lengths_size, sizeof(*sorted));
+     if (sorted == NULL) return 0;
+-    total_size = BuildHuffmanTable(root_table, root_bits,
+-                                   code_lengths, code_lengths_size, sorted);
++    BuildHuffmanTable(root_table->curr_segment->curr_table, root_bits,
++                      code_lengths, code_lengths_size, sorted);
+     WebPSafeFree(sorted);
+   }
+   return total_size;
+ }
++
++int VP8LHuffmanTablesAllocate(int size, HuffmanTables* huffman_tables) {
++  // Have 'segment' point to the first segment for now, 'root'.
++  HuffmanTablesSegment* const root = &huffman_tables->root;
++  huffman_tables->curr_segment = root;
++  // Allocate root.
++  root->start = (HuffmanCode*)WebPSafeMalloc(size, sizeof(*root->start));
++  if (root->start == NULL) return 0;
++  root->curr_table = root->start;
++  root->next = NULL;
++  root->size = size;
++  return 1;
++}
++
++void VP8LHuffmanTablesDeallocate(HuffmanTables* const huffman_tables) {
++  HuffmanTablesSegment *current, *next;
++  if (huffman_tables == NULL) return;
++  // Free the root node.
++  current = &huffman_tables->root;
++  next = current->next;
++  WebPSafeFree(current->start);
++  current->start = NULL;
++  current->next = NULL;
++  current = next;
++  // Free the following nodes.
++  while (current != NULL) {
++    next = current->next;
++    WebPSafeFree(current->start);
++    WebPSafeFree(current);
++    current = next;
++  }
++}
+diff --git a/src/utils/huffman_utils.h b/src/utils/huffman_utils.h
+index 13b7ad1a..98415c53 100644
+--- a/src/utils/huffman_utils.h
++++ b/src/utils/huffman_utils.h
+@@ -43,6 +43,29 @@ typedef struct {
+                     // or non-literal symbol otherwise
+ } HuffmanCode32;
+ 
++// Contiguous memory segment of HuffmanCodes.
++typedef struct HuffmanTablesSegment {
++  HuffmanCode* start;
++  // Pointer to where we are writing into the segment. Starts at 'start' and
++  // cannot go beyond 'start' + 'size'.
++  HuffmanCode* curr_table;
++  // Pointer to the next segment in the chain.
++  struct HuffmanTablesSegment* next;
++  int size;
++} HuffmanTablesSegment;
++
++// Chained memory segments of HuffmanCodes.
++typedef struct HuffmanTables {
++  HuffmanTablesSegment root;
++  // Currently processed segment. At first, this is 'root'.
++  HuffmanTablesSegment* curr_segment;
++} HuffmanTables;
++
++// Allocates a HuffmanTables with 'size' contiguous HuffmanCodes. Returns 0 on
++// memory allocation error, 1 otherwise.
++int VP8LHuffmanTablesAllocate(int size, HuffmanTables* huffman_tables);
++void VP8LHuffmanTablesDeallocate(HuffmanTables* const huffman_tables);
++
+ #define HUFFMAN_PACKED_BITS 6
+ #define HUFFMAN_PACKED_TABLE_SIZE (1u << HUFFMAN_PACKED_BITS)
+ 
+@@ -78,9 +101,7 @@ void VP8LHtreeGroupsFree(HTreeGroup* const htree_groups);
+ // the huffman table.
+ // Returns built table size or 0 in case of error (invalid tree or
+ // memory error).
+-// If root_table is NULL, it returns 0 if a lookup cannot be built, something
+-// > 0 otherwise (but not the table size).
+-int VP8LBuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
++int VP8LBuildHuffmanTable(HuffmanTables* const root_table, int root_bits,
+                           const int code_lengths[], int code_lengths_size);
+ 
+ #ifdef __cplusplus
+-- 
+2.41.0
+
diff --git a/pkgs/development/libraries/libwebp/default.nix b/pkgs/development/libraries/libwebp/default.nix
index 39a7ab3ba45..287c0b6b18b 100644
--- a/pkgs/development/libraries/libwebp/default.nix
+++ b/pkgs/development/libraries/libwebp/default.nix
@@ -36,6 +36,14 @@ stdenv.mkDerivation rec {
     hash   = "sha256-Q94avvKjPdwdGt5ADo30cf2V4T7MCTubDHJxTtbG4xQ=";
   };
 
+  patches = [
+    # Commit 902bc919 from upstream, mangled slightly to apply onto 1.3.1.
+    # There is currently (2023-09-12) no confirmation that this is the fix for
+    # CVE-2023-4863, but it is linked to the right crbug, and matches the
+    # description of that (critical sev, exploited in the wild) CVE.
+    ./CVE-2023-4863.patch
+  ];
+
   configureFlags = [
     (lib.enableFeature threadingSupport "threading")
     (lib.enableFeature openglSupport "gl")
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 3f2f81183ca..bc9e2c8c2c1 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -34,7 +34,7 @@ in
 let
 libxml = stdenv.mkDerivation rec {
   pname = "libxml2";
-  version = "2.11.4";
+  version = "2.11.5";
 
   outputs = [ "bin" "dev" "out" "doc" ]
     ++ lib.optional pythonSupport "py"
@@ -43,7 +43,7 @@ libxml = stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
-    sha256 = "c34df4qz8TlynKE6JJT9F78w3bS3pCfPM2JSyrV/V/c=";
+    sha256 = "NyeweMNg7Gn6hp3hS9b3XX7o02mHsHHmko1HIKKN86Y=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/libyuv/default.nix b/pkgs/development/libraries/libyuv/default.nix
index f4415b51f81..cc9f78ccae6 100644
--- a/pkgs/development/libraries/libyuv/default.nix
+++ b/pkgs/development/libraries/libyuv/default.nix
@@ -28,6 +28,15 @@ stdenv.mkDerivation rec {
     ./link-library-against-libjpeg.patch
   ];
 
+  postPatch = ''
+    mkdir -p $out/lib/pkgconfig
+    cp ${./yuv.pc} $out/lib/pkgconfig/libyuv.pc
+
+    substituteInPlace $out/lib/pkgconfig/libyuv.pc \
+      --replace "@PREFIX@" "$out" \
+      --replace "@VERSION@" "$version"
+  '';
+
   meta = with lib; {
     homepage = "https://chromium.googlesource.com/libyuv/libyuv";
     description = "Open source project that includes YUV scaling and conversion functionality";
diff --git a/pkgs/development/libraries/libyuv/yuv.pc b/pkgs/development/libraries/libyuv/yuv.pc
new file mode 100644
index 00000000000..ecce62ed0ef
--- /dev/null
+++ b/pkgs/development/libraries/libyuv/yuv.pc
@@ -0,0 +1,13 @@
+prefix=@PREFIX@
+exec_prefix=${prefix}
+libdir=${prefix}/lib
+includedir=${prefix}/include
+
+Name: yuv
+Description: WebM Project Yuv codec implementation
+Version: @VERSION@
+Requires:
+Conflicts:
+Libs: -L${libdir} -lyuv -lm
+Libs.private: -lm -lpthread
+Cflags: -I${includedir}
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 550cb7f673f..b7bec7e8930 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -86,8 +86,8 @@
 */
 
 let
-  version = "23.1.5";
-  hash = "sha256-PPiFdv3r8k/EBHBnk2ExyQy2VBwnNlmWt5tmHewfsVM=";
+  version = "23.1.7";
+  hash = "sha256-QJZB6t8O0cd5R5em9aCwGVtVgLKCFm5exWKca82mrNM=";
 
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
diff --git a/pkgs/development/libraries/mpfr/default.nix b/pkgs/development/libraries/mpfr/default.nix
index cf5035948cb..dec33a63d15 100644
--- a/pkgs/development/libraries/mpfr/default.nix
+++ b/pkgs/development/libraries/mpfr/default.nix
@@ -11,7 +11,7 @@
 # files.
 
 stdenv.mkDerivation rec {
-  version = "4.2.0";
+  version = "4.2.1";
   pname = "mpfr";
 
   src = fetchurl {
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
       "https://www.mpfr.org/${pname}-${version}/${pname}-${version}.tar.xz"
       "mirror://gnu/mpfr/${pname}-${version}.tar.xz"
     ];
-    hash = "sha256-BqN43xNQEkjBsttaqXeiyBJq6Emp2be+JUb7Spwm2ZM=";
+    hash = "sha256-J3gHNTpnJpeJlpRa8T5Sgp46vXqaW3+yeTiU4Y8fy7I=";
   };
 
   outputs = [ "out" "dev" "doc" "info" ];
diff --git a/pkgs/development/libraries/ndn-cxx/default.nix b/pkgs/development/libraries/ndn-cxx/default.nix
index 7ab607b01f4..d7b31426c4f 100644
--- a/pkgs/development/libraries/ndn-cxx/default.nix
+++ b/pkgs/development/libraries/ndn-cxx/default.nix
@@ -5,7 +5,7 @@
 , pkg-config
 , python3
 , python3Packages
-, waf
+, wafHook
 , boost179
 , openssl
 , sqlite
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-nnnxlkYVTSRB6ZcuIUDFol999+amGtqegHXK+06ITK8=";
   };
 
-  nativeBuildInputs = [ doxygen pkg-config python3 python3Packages.sphinx waf.hook ];
+  nativeBuildInputs = [ doxygen pkg-config python3 python3Packages.sphinx wafHook ];
 
   buildInputs = [ boost179 openssl sqlite ];
 
diff --git a/pkgs/development/libraries/talloc/default.nix b/pkgs/development/libraries/talloc/default.nix
index 5fad3c1c512..bfe38fd4719 100644
--- a/pkgs/development/libraries/talloc/default.nix
+++ b/pkgs/development/libraries/talloc/default.nix
@@ -8,7 +8,7 @@
 , docbook-xsl-nons
 , docbook_xml_dtd_42
 , fixDarwinDylibNames
-, waf
+, wafHook
 }:
 
 stdenv.mkDerivation rec {
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     python3
-    waf.hook
+    wafHook
     docbook-xsl-nons
     docbook_xml_dtd_42
   ] ++ lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/tdb/default.nix b/pkgs/development/libraries/tdb/default.nix
index 562a422f91d..13f55a2dc52 100644
--- a/pkgs/development/libraries/tdb/default.nix
+++ b/pkgs/development/libraries/tdb/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv
 , fetchurl
 , pkg-config
-, waf
+, wafHook
 , python3
 , readline
 , libxslt
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     python3
     pkg-config
-    waf.hook
+    wafHook
     libxslt
     docbook-xsl-nons
     docbook_xml_dtd_45
diff --git a/pkgs/development/libraries/tevent/default.nix b/pkgs/development/libraries/tevent/default.nix
index 7d0d40439e4..c5d8d0fd3c4 100644
--- a/pkgs/development/libraries/tevent/default.nix
+++ b/pkgs/development/libraries/tevent/default.nix
@@ -9,7 +9,7 @@
 , docbook-xsl-nons
 , docbook_xml_dtd_42
 , which
-, waf
+, wafHook
 , libxcrypt
 }:
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     libxslt
     docbook-xsl-nons
     docbook_xml_dtd_42
-    waf.hook
+    wafHook
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index baef243cbdc..9fccef25da1 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -24,7 +24,7 @@ assert splitStaticOutput -> static;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zlib";
-  version = "1.2.13";
+  version = "1.3";
 
   src = let
     inherit (finalAttrs) version;
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
       # Stable archive path, but captcha can be encountered, causing hash mismatch.
       "https://www.zlib.net/fossils/zlib-${version}.tar.gz"
     ];
-    hash = "sha256-s6JN6XqP28g1uYMxaVAQMLiXcDG8tUs7OsE3QPhGqzA=";
+    hash = "sha256-/wukwpIBPbwnUws6geH5qBPNOd4Byl4Pi/NVcC76WT4=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/development/libraries/zxing-cpp/default.nix b/pkgs/development/libraries/zxing-cpp/default.nix
index bcddfa96552..9cd78b7b56a 100644
--- a/pkgs/development/libraries/zxing-cpp/default.nix
+++ b/pkgs/development/libraries/zxing-cpp/default.nix
@@ -1,20 +1,21 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, pkg-config
 , cmake
+, pkg-config
 , python3
+, gitUpdater
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "zxing-cpp";
-  version = "1.4.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
-    owner = "nu-book";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-MTu8tvJXpo6+Z0aSIZ27nmerNtNBOwnL/jDkGedIiM8=";
+    owner = "zxing-cpp";
+    repo = "zxing-cpp";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-B/jGsHImRfj0iEio2b6R6laWBI1LL3OI407O7sren8s=";
   };
 
   nativeBuildInputs = [
@@ -27,23 +28,17 @@ stdenv.mkDerivation rec {
     "-DBUILD_BLACKBOX_TESTS=OFF"
   ];
 
-  # https://github.com/nu-book/zxing-cpp/issues/335
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace 'configure_file(zxing.pc.in' \
-                'include(GNUInstallDirs)
-                 configure_file(zxing.pc.in'
-    substituteInPlace zxing.pc.in \
-      --replace '$'{exec_prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@ \
-      --replace '$'{prefix}/@CMAKE_INSTALL_INCLUDEDIR@ @CMAKE_INSTALL_FULL_INCLUDEDIR@
-  '';
-
-  passthru.tests = {
-    inherit (python3.pkgs) zxing_cpp;
+  passthru = {
+    tests = {
+      inherit (python3.pkgs) zxing_cpp;
+    };
+    updateScript = gitUpdater {
+      rev-prefix = "v";
+    };
   };
 
-  meta = with lib; {
-    homepage = "https://github.com/nu-book/zxing-cpp";
+  meta = {
+    homepage = "https://github.com/zxing-cpp/zxing-cpp";
     description = "C++ port of zxing (a Java barcode image processing library)";
     longDescription = ''
       ZXing-C++ ("zebra crossing") is an open-source, multi-format 1D/2D barcode
@@ -54,8 +49,8 @@ stdenv.mkDerivation rec {
       and performance. It can both read and write barcodes in a number of
       formats.
     '';
-    license = licenses.asl20;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = with platforms; unix;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ AndersonTorres lukegb ];
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/python-modules/invoke/default.nix b/pkgs/development/python-modules/invoke/default.nix
index e388cccf593..bf23cfbbcdd 100644
--- a/pkgs/development/python-modules/invoke/default.nix
+++ b/pkgs/development/python-modules/invoke/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "invoke";
-  version = "2.0.0";
+  version = "2.2.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-erXdnNdreH1WCnixqYENJSNnq1lZhcUGEnAr4h1nHdc=";
+    hash = "sha256-7my7EBrxqFnH/oTyomTAWQILDLf+NTX5QkMAq1aPa9U=";
   };
 
   postPatch = ''
@@ -34,6 +34,7 @@ buildPythonPackage rec {
   '';
 
   meta = with lib; {
+    changelog = "https://www.pyinvoke.org/changelog.html";
     description = "Pythonic task execution";
     homepage = "https://www.pyinvoke.org/";
     license = licenses.bsd2;
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index 7ba24e4bd52..fe29cde9e52 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -93,6 +93,8 @@ in buildPythonPackage rec {
     "test_cross_module_exception_translator"
   ];
 
+  hardeningDisable = lib.optional stdenv.hostPlatform.isMusl "fortify";
+
   meta = with lib; {
     homepage = "https://github.com/pybind/pybind11";
     changelog = "https://github.com/pybind/pybind11/blob/${src.rev}/docs/changelog.rst";
diff --git a/pkgs/development/python-modules/rapidfuzz/default.nix b/pkgs/development/python-modules/rapidfuzz/default.nix
index 422f90d71f7..07f2bdfb469 100644
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "rapidfuzz";
-  version = "3.2.0";
+  version = "3.3.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "maxbachmann";
     repo = "RapidFuzz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Lt5m1SdZBzId6nvXXrEDQR3ZdA3yjoj15o3/nPeXPPs=";
+    hash = "sha256-5JlEd7X0I/OmL260v2OMVI3h99TIpglv6Nt3EciEBEM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/trustme/default.nix b/pkgs/development/python-modules/trustme/default.nix
index 4deb72308fd..4648dd75a26 100644
--- a/pkgs/development/python-modules/trustme/default.nix
+++ b/pkgs/development/python-modules/trustme/default.nix
@@ -1,45 +1,48 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, isPy3k
 , cryptography
-, futures ? null
+, fetchPypi
+, idna
 , pyopenssl
-, service-identity
 , pytestCheckHook
-, idna
+, pythonOlder
+, service-identity
 }:
 
 buildPythonPackage rec {
   pname = "trustme";
-  version = "0.9.0";
+  version = "1.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XgeyPXDO7WTzuzauS5q8UjVMFsmNRasDe+4rX7/+WGw=";
+    hash = "sha256-U3Wtf7QnB0vslWWS4NTuKkz02miTThukvPQhcSa8ReY=";
   };
 
+  propagatedBuildInputs = [
+    cryptography
+    idna
+  ];
+
   nativeCheckInputs = [
     pyopenssl
     pytestCheckHook
     service-identity
   ];
 
-  propagatedBuildInputs = [
-    cryptography
-    idna
-  ] ++ lib.optionals (!isPy3k) [
-    futures
-  ];
-
   # Some of the tests use localhost networking.
   __darwinAllowLocalNetworking = true;
 
-  pythonImportsCheck = [ "trustme" ];
+  pythonImportsCheck = [
+    "trustme"
+  ];
 
   meta = with lib; {
     description = "High quality TLS certs while you wait, for the discerning tester";
     homepage = "https://github.com/python-trio/trustme";
+    changelog = "https://trustme.readthedocs.io/en/latest/#change-history";
     license = with licenses; [ mit asl20 ];
     maintainers = with maintainers; [ catern ];
   };
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index 582a9e0f563..7fe0bbdb833 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -140,14 +140,9 @@ buildPythonPackage rec {
     # twisted.python.runtime.platform.supportsINotify() == False
     substituteInPlace src/twisted/python/_inotify.py --replace \
       "ctypes.util.find_library(\"c\")" "'${stdenv.cc.libc}/lib/libc.so.6'"
-  '' + lib.optionalString (stdenv.isAarch64 && stdenv.isDarwin) ''
-    echo 'AbortConnectionTests_AsyncioSelectorReactorTests.test_fullWriteBufferAfterByteExchange.skip = "Timeout after 120 seconds"' >> src/twisted/internet/test/test_tcp.py
-    echo 'AbortConnectionTests_AsyncioSelectorReactorTests.test_resumeProducingAbort.skip = "Timeout after 120 seconds"' >> src/twisted/internet/test/test_tcp.py
-
-    echo 'PosixReactorBaseTests.test_removeAllSkipsInternalReaders.skip = "Fails due to unclosed event loop"' >> src/twisted/internet/test/test_posixbase.py
-    echo 'PosixReactorBaseTests.test_wakerIsInternalReader.skip = "Fails due to unclosed event loop"' >> src/twisted/internet/test/test_posixbase.py
-
-    echo 'TCPPortTests.test_connectionLostFailed.skip = "Fails due to unclosed event loop"' >> src/twisted/internet/test/test_posixbase.py
+  '' + lib.optionalString stdenv.isDarwin ''
+    echo 'ProcessTestsBuilder_AsyncioSelectorReactorTests.test_openFileDescriptors.skip = "invalid syntax"'>> src/twisted/internet/test/test_process.py
+    echo 'ProcessTestsBuilder_SelectReactorTests.test_openFileDescriptors.skip = "invalid syntax"'>> src/twisted/internet/test/test_process.py
   '';
 
   # Generate Twisted's plug-in cache. Twisted users must do it as well. See
@@ -171,7 +166,7 @@ buildPythonPackage rec {
     export SOURCE_DATE_EPOCH=315532800
     export PATH=$out/bin:$PATH
     # race conditions when running in paralell
-    ${python.interpreter} -m twisted.trial twisted
+    ${python.interpreter} -m twisted.trial -j1 twisted
   '';
 
   passthru = {
diff --git a/pkgs/development/python-modules/zxing_cpp/default.nix b/pkgs/development/python-modules/zxing_cpp/default.nix
index 2427e125699..b876ab05af3 100644
--- a/pkgs/development/python-modules/zxing_cpp/default.nix
+++ b/pkgs/development/python-modules/zxing_cpp/default.nix
@@ -1,20 +1,18 @@
-{ buildPythonPackage
-, lib
+{ lib
+, buildPythonPackage
 , cmake
-, pybind11
-, zxing-cpp
 , numpy
 , pillow
+, pybind11
+, zxing-cpp
 }:
 
 buildPythonPackage rec {
   pname = "zxing_cpp";
-  inherit (zxing-cpp) src version;
+  inherit (zxing-cpp) src version meta;
 
   sourceRoot = "${src.name}/wrappers/python";
-  patches = [
-    ./use-nixpkgs-pybind11.patch
-  ];
+
   dontUseCmakeConfigure = true;
 
   propagatedBuildInputs = [
@@ -29,21 +27,4 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pillow
   ];
-
-  meta = with lib; {
-    homepage = "https://github.com/zxing-cpp/zxing-cpp";
-    description = "Python bindings for C++ port of zxing (a Java barcode image processing library)";
-    longDescription = ''
-      ZXing-C++ ("zebra crossing") is an open-source, multi-format 1D/2D barcode
-      image processing library implemented in C++.
-
-      It was originally ported from the Java ZXing Library but has been
-      developed further and now includes many improvements in terms of quality
-      and performance. It can both read and write barcodes in a number of
-      formats.
-    '';
-    license = licenses.asl20;
-    maintainers = with maintainers; [ lukegb ];
-    platforms = with platforms; unix;
-  };
 }
diff --git a/pkgs/development/python-modules/zxing_cpp/use-nixpkgs-pybind11.patch b/pkgs/development/python-modules/zxing_cpp/use-nixpkgs-pybind11.patch
deleted file mode 100644
index 4a4960f13d6..00000000000
--- a/pkgs/development/python-modules/zxing_cpp/use-nixpkgs-pybind11.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index eadfc045..b6f273a6 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -20,8 +20,7 @@ if (NOT hasParent)
-         # In development mode, when the whole zxing-cpp directory is checked out, build against head code.
-         add_subdirectory(${CMAKE_CURRENT_SOURCE_DIR}/../../core ZXing EXCLUDE_FROM_ALL)
- 
--        include(${CMAKE_CURRENT_SOURCE_DIR}/../../zxing.cmake)
--        zxing_add_package(pybind11 pybind11 ${pybind11_git_repo} ${pybind11_git_rev})
-+        find_package(pybind11 CONFIG)
-     else()
-         # we don't have access to the top-level cmake helpers -> simply fetch it unconditional
-         include(FetchContent)
diff --git a/pkgs/development/tools/build-managers/waf/hook.nix b/pkgs/development/tools/build-managers/waf/hook.nix
index 7282ed9ebf9..ac497d22783 100644
--- a/pkgs/development/tools/build-managers/waf/hook.nix
+++ b/pkgs/development/tools/build-managers/waf/hook.nix
@@ -13,7 +13,7 @@ makeSetupHook {
     # waf is not inserted into propagatedBuildInputs, rather it is inserted
     # directly
     inherit waf;
-    crossFlags = lib.optionalString (stdenv.hostPlatform.system != stdenv.targetPlatform.system)
+    wafCrossFlags = lib.optionalString (stdenv.hostPlatform.system != stdenv.targetPlatform.system)
       ''--cross-compile "--cross-execute=${stdenv.targetPlatform.emulator pkgs}"'';
   };
 
diff --git a/pkgs/development/tools/build-managers/waf/setup-hook.sh b/pkgs/development/tools/build-managers/waf/setup-hook.sh
index 2593b0a9d80..d3e2bf97e68 100644
--- a/pkgs/development/tools/build-managers/waf/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/waf/setup-hook.sh
@@ -19,14 +19,14 @@ wafConfigurePhase() {
     local flagsArray=(
         $prefixFlag
         $wafConfigureFlags "${wafConfigureFlagsArray[@]}"
-        ${configureTargets:-configure}
+        ${wafConfigureTargets:-configure}
     )
 
     if [ -z "${dontAddWafCrossFlags:-}" ]; then
-        flagsArray+=(@crossFlags@)
+        flagsArray+=(@wafCrossFlags@)
     fi
 
-    echoCmd 'configure flags' "${flagsArray[@]}"
+    echoCmd 'waf configure flags' "${flagsArray[@]}"
     python "$wafPath" "${flagsArray[@]}"
 
     if ! [[ -v enableParallelBuilding ]]; then
@@ -51,11 +51,11 @@ wafBuildPhase () {
     local flagsArray=(
       ${enableParallelBuilding:+-j ${NIX_BUILD_CORES}}
       $wafFlags ${wafFlagsArray[@]}
-      $buildFlags ${buildFlagsArray[@]}
-      ${buildTargets:-build}
+      $wafBuildFlags ${wafBuildFlagsArray[@]}
+      ${wafBuildTargets:-build}
     )
 
-    echoCmd 'build flags' "${flagsArray[@]}"
+    echoCmd 'waf build flags' "${flagsArray[@]}"
     python "$wafPath" "${flagsArray[@]}"
 
     runHook postBuild
@@ -71,11 +71,11 @@ wafInstallPhase() {
     local flagsArray=(
         ${enableParallelInstalling:+-j ${NIX_BUILD_CORES}}
         $wafFlags ${wafFlagsArray[@]}
-        $installFlags ${installFlagsArray[@]}
-        ${installTargets:-install}
+        $wafInstallFlags ${wafInstallFlagsArray[@]}
+        ${wafInstallTargets:-install}
     )
 
-    echoCmd 'install flags' "${flagsArray[@]}"
+    echoCmd 'waf install flags' "${flagsArray[@]}"
     python "$wafPath" "${flagsArray[@]}"
 
     runHook postInstall
diff --git a/pkgs/development/tools/hotdoc/default.nix b/pkgs/development/tools/hotdoc/default.nix
index 50e2e43a67b..b649310214f 100644
--- a/pkgs/development/tools/hotdoc/default.nix
+++ b/pkgs/development/tools/hotdoc/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , buildPythonApplication
+, fetchpatch
 , fetchPypi
 , pytestCheckHook
 , pkg-config
@@ -27,13 +28,22 @@
 
 buildPythonApplication rec {
   pname = "hotdoc";
-  version = "0.13.7";
+  version = "0.15";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ESOmWeLJSXLDKBPsMBGR0zPbJHEqg/fj0G3VjUfPAJg=";
+    hash = "sha256-sfQ/iBd1Z+YqnaOg8j32rC2iucdiiK3Tff9NfYFnQyc=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-test-hotdoc.patch";
+      url = "https://github.com/hotdoc/hotdoc/commit/d2415a520e960a7b540742a0695b699be9189540.patch";
+      hash = "sha256-9ORZ91c+/oRqEp2EKXjKkz7u8mLnWCq3uPsc3G4NB9E=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     cmake