Merge branch staging into staging-next

The staging version is a bit older already, used in pre-test:
https://hydra.nixos.org/eval/1685435

22 files changed, 84 insertions, 64 deletions

diff --git a/pkgs/data/fonts/charis-sil/default.nix b/pkgs/data/fonts/charis-sil/default.nix
index 6639cb57d8b..75f1d89be77 100644
--- a/pkgs/data/fonts/charis-sil/default.nix
+++ b/pkgs/data/fonts/charis-sil/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchzip }:
 
 let
-  version = "6.000";
+  version = "6.001";
 in
   fetchzip rec {
     name = "charis-sil-${version}";
@@ -14,7 +14,7 @@ in
       unzip -j $downloadedFile \*OFL.txt \*OFL-FAQ.txt \*README.txt \*FONTLOG.txt -d "$out/share/doc/${name}"
     '';
 
-    sha256 = "sha256-eMmC893rI42qzZVCI17i9XSAbQzXCK2fHVe5Pf1/VnM=";
+    sha256 = "sha256-eKSOvYuTMpAnTk4sRiWFUDJrTsF+K5716ALCepaUU08=";
 
     meta = with lib; {
       homepage = "https://software.sil.org/charis";
diff --git a/pkgs/data/misc/cacert/setup-hook.sh b/pkgs/data/misc/cacert/setup-hook.sh
index 77b68a5c251..93b682fbbd1 100644
--- a/pkgs/data/misc/cacert/setup-hook.sh
+++ b/pkgs/data/misc/cacert/setup-hook.sh
@@ -1,3 +1,7 @@
 export NIX_SSL_CERT_FILE=@out@/etc/ssl/certs/ca-bundle.crt
-# left for compatibility
+
+# compatibility
+#  - openssl
 export SSL_CERT_FILE=@out@/etc/ssl/certs/ca-bundle.crt
+#  - Haskell x509-system
+export SYSTEM_CERTIFICATE_PATH=@out@/etc/ssl/certs/ca-bundle.crt
diff --git a/pkgs/development/compilers/llvm/12/clang/default.nix b/pkgs/development/compilers/llvm/12/clang/default.nix
index 87cdca834ea..d6ee3752441 100644
--- a/pkgs/development/compilers/llvm/12/clang/default.nix
+++ b/pkgs/development/compilers/llvm/12/clang/default.nix
@@ -9,7 +9,7 @@ let
     pname = "clang";
     inherit version;
 
-    src = fetch "clang" "1vd9rhhrd8ghdg111lac7w8by71y9l14yh5zxfijsm6lj4p4avp2";
+    src = fetch "clang" "0px4gl27az6cdz6adds89qzdwb1cqpjsfvrldbz9qvpmphrj34bf";
     inherit clang-tools-extra_src;
 
     unpackPhase = ''
diff --git a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
index cde1317ca35..fdc134bdf4b 100644
--- a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
@@ -12,7 +12,7 @@ in
 stdenv.mkDerivation {
   pname = "compiler-rt" + lib.optionalString (haveLibc) "-libc";
   inherit version;
-  src = fetch "compiler-rt" "0d444qihq9jhqnfv003cr704v363va72zl6qaw2algj1c85cva45";
+  src = fetch "compiler-rt" "1950rg294izdwkaasi7yjrmadc9mzdd5paf0q63jjcq2m3rdbj5l";
 
   nativeBuildInputs = [ cmake python3 llvm.dev ];
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
diff --git a/pkgs/development/compilers/llvm/12/default.nix b/pkgs/development/compilers/llvm/12/default.nix
index 35228eac43b..212c6e52876 100644
--- a/pkgs/development/compilers/llvm/12/default.nix
+++ b/pkgs/development/compilers/llvm/12/default.nix
@@ -18,7 +18,7 @@
 }:
 
 let
-  release_version = "12.0.0";
+  release_version = "12.0.1";
   candidate = ""; # empty or "rcN"
   dash-candidate = lib.optionalString (candidate != "") "-${candidate}";
   version = "${release_version}${dash-candidate}"; # differentiating these (variables) is important for RCs
@@ -29,7 +29,7 @@ let
     inherit sha256;
   };
 
-  clang-tools-extra_src = fetch "clang-tools-extra" "0p3dzr0qa7mar83y66xa5m5apynf6ia0lsdsq6axwnm64ysy0hdd";
+  clang-tools-extra_src = fetch "clang-tools-extra" "1r9a4fdz9ci58b5z2inwvm4z4cdp6scrivnaw05dggkxz7yrwrb5";
 
   llvm_meta = {
     license     = lib.licenses.ncsa;
diff --git a/pkgs/development/compilers/llvm/12/libcxx/default.nix b/pkgs/development/compilers/llvm/12/libcxx/default.nix
index 1c9a7dd3c53..3ddcb799750 100644
--- a/pkgs/development/compilers/llvm/12/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/12/libcxx/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
   pname = "libcxx";
   inherit version;
 
-  src = fetch "libcxx" "1wf3ww29xkx7prs7pdwicy5qqfapib26110jgmkjrbka9z57bjvx";
+  src = fetch "libcxx" "05cx39ldlxchck454lgfly1xj0c7x65iyx4hqhiihrlg6p6qj854";
 
   postUnpack = ''
     unpackFile ${libcxxabi.src}
diff --git a/pkgs/development/compilers/llvm/12/libcxxabi/default.nix b/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
index e360cf8d0b2..16eaed20d78 100644
--- a/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
   pname = "libcxxabi";
   inherit version;
 
-  src = fetch "libcxxabi" "1cbmzspwjlr8f6sp73pw6ivf4dpg6rpc61by0q1m2zca2k6yif3a";
+  src = fetch "libcxxabi" "1l4idd8npbkm168d26kqn529yv3npsd8f2dm8a7iwyknj7iyivw8";
 
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/development/compilers/llvm/12/libunwind/default.nix b/pkgs/development/compilers/llvm/12/libunwind/default.nix
index abfe950614a..8ed24687695 100644
--- a/pkgs/development/compilers/llvm/12/libunwind/default.nix
+++ b/pkgs/development/compilers/llvm/12/libunwind/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
   pname = "libunwind";
   inherit version;
 
-  src = fetch pname "1x8wpmsrsgnwj2v5ih52ylni7r6n8gzkcj6hx65zbxski2rablly";
+  src = fetch pname "192ww6n81lj2mb9pj4043z79jp3cf58a9c2qrxjwm5c3a64n1shb";
 
   postUnpack = ''
     unpackFile ${libcxx.src}
diff --git a/pkgs/development/compilers/llvm/12/lld/default.nix b/pkgs/development/compilers/llvm/12/lld/default.nix
index e2c7470d2fc..f9b0effbff3 100644
--- a/pkgs/development/compilers/llvm/12/lld/default.nix
+++ b/pkgs/development/compilers/llvm/12/lld/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   pname = "lld";
   inherit version;
 
-  src = fetch pname "1zakyxk5bwnh7jarckcd4rbmzi58jgn2dbah5j5cwcyfyfbx9drc";
+  src = fetch pname "0qg3fgc7wj34hdkqn21y03zcmsdd01szhhm1hfki63iifrm3y2v9";
 
   patches = [
     ./gnu-install-dirs.patch
diff --git a/pkgs/development/compilers/llvm/12/lldb/default.nix b/pkgs/development/compilers/llvm/12/lldb/default.nix
index 0712396cccf..b6659034e81 100644
--- a/pkgs/development/compilers/llvm/12/lldb/default.nix
+++ b/pkgs/development/compilers/llvm/12/lldb/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation (rec {
   pname = "lldb";
   inherit version;
 
-  src = fetch pname "1v85qyq3snk81vjmwq5q7xikyyqsfpqy2c4qmr81mps4avsw1g0l";
+  src = fetch pname "0g3pj1m3chafavpr35r9fynm85y2hdyla6klj0h28khxs2613i78";
 
   patches = [
     ./procfs.patch
diff --git a/pkgs/development/compilers/llvm/12/llvm/default.nix b/pkgs/development/compilers/llvm/12/llvm/default.nix
index 8413f0f5745..361c6798385 100644
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/12/llvm/default.nix
@@ -34,8 +34,8 @@ in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
-  src = fetch pname "0l4b79gwfvxild974aigcq1yigypjsk2j5p59syhl6ksd744gp29";
-  polly_src = fetch "polly" "1ixl9yj526n8iqh9ckyiah2vzravs9d1akybqq7rvy32n9vgr6hd";
+  src = fetch pname "1pzx9zrmd7r3481sbhwvkms68fwhffpp4mmz45dgrkjpyl2q96kx";
+  polly_src = fetch "polly" "1yfm9ixda4a2sx7ak5vswijx4ydk5lv1c1xh39xmd2kh299y4m12";
 
   unpackPhase = ''
     unpackFile $src
@@ -84,6 +84,8 @@ in stdenv.mkDerivation (rec {
     substituteInPlace unittests/IR/CMakeLists.txt \
       --replace "PassBuilderCallbacksTest.cpp" ""
     rm unittests/IR/PassBuilderCallbacksTest.cpp
+    # TODO: Fix failing tests:
+    rm test/DebugInfo/X86/vla-multi.ll
   '' + optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -i ${../../TLI-musl.patch}
     substituteInPlace unittests/Support/CMakeLists.txt \
diff --git a/pkgs/development/compilers/llvm/12/openmp/default.nix b/pkgs/development/compilers/llvm/12/openmp/default.nix
index c107258dd18..8ed1bf71f00 100644
--- a/pkgs/development/compilers/llvm/12/openmp/default.nix
+++ b/pkgs/development/compilers/llvm/12/openmp/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   pname = "openmp";
   inherit version;
 
-  src = fetch pname "0z8n1wanby6aq3i7d91mgk72hb33zfl5blayk0a22cs7l8i706zb";
+  src = fetch pname "14dh0r6h2xh747ffgnsl4z08h0ri04azi9vf79cbz7ma1r27kzk0";
 
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [ llvm ];
diff --git a/pkgs/development/libraries/atk/default.nix b/pkgs/development/libraries/atk/default.nix
index 38c55731698..08e6e5b0e41 100644
--- a/pkgs/development/libraries/atk/default.nix
+++ b/pkgs/development/libraries/atk/default.nix
@@ -1,6 +1,5 @@
 { lib, stdenv, fetchurl, meson, ninja, gettext, pkg-config, glib
 , fixDarwinDylibNames, gobject-introspection, gnome
-, withIntrospection ? stdenv.buildPlatform == stdenv.hostPlatform
 }:
 
 let
@@ -18,9 +17,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ meson ninja pkg-config gettext glib ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames
-    ++ lib.optional withIntrospection gobject-introspection;
+  nativeBuildInputs = [ meson ninja pkg-config gettext gobject-introspection glib ]
+    ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
   propagatedBuildInputs = [
     # Required by atk.pc
@@ -34,7 +32,7 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Dintrospection=${lib.boolToString withIntrospection}"
+    "-Dintrospection=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}"
   ];
 
   doCheck = true;
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index df3d0732393..d557c87ebdf 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -2,6 +2,7 @@
 # Darwin frameworks
 , Cocoa, CoreMedia, VideoToolbox
 , stdenv, lib
+, fetchpatch
 , ...
 }@args:
 
@@ -11,7 +12,18 @@ callPackage ./generic.nix (rec {
   sha256 = "03kxc29y8190k4y8s8qdpsghlbpmchv1m8iqygq2qn0vfm4ka2a2";
   darwinFrameworks = [ Cocoa CoreMedia VideoToolbox ];
 
-  /* Work around https://trac.ffmpeg.org/ticket/9242 */
-  patches = lib.optional stdenv.isDarwin
-    ./v2-0001-avcodec-videotoolboxenc-define-TARGET_CPU_ARM64-t.patch;
+  patches = [
+    # Fix incorrect segment length in HLS child playlist with fmp4 segment format
+    # FIXME remove in version 4.5
+    # https://trac.ffmpeg.org/ticket/9193
+    # https://trac.ffmpeg.org/ticket/9205
+    (fetchpatch {
+      name = "ffmpeg_fix_incorrect_segment_length_in_hls.patch";
+      url = "https://git.videolan.org/?p=ffmpeg.git;a=commitdiff_plain;h=59032494e81a1a65c0b960aaae7ec4c2cc9db35a";
+      sha256 = "03zz1lw51kkc3g3vh47xa5hfiz3g3g1rbrll3kcnslvwylmrqmy3";
+    })
+  ] ++ lib.optionals stdenv.isDarwin [
+    # Work around https://trac.ffmpeg.org/ticket/9242
+    ./v2-0001-avcodec-videotoolboxenc-define-TARGET_CPU_ARM64-t.patch
+  ];
 } // args)
diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index 075c810131c..22875e51842 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -1,5 +1,4 @@
 { lib, stdenv
-, fetchpatch
 , substituteAll
 , fetchurl
 , pkg-config
@@ -15,21 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fontconfig";
-  version = "2.13.93";
+  version = "2.13.94";
 
   src = fetchurl {
-    url = "http://fontconfig.org/release/${pname}-${version}.tar.xz";
-    sha256 = "1850q4k80yxma5g3yxkvyv8i5a3xqzswwml8gjy3jmywx8qqd5pa";
+    url = "https://www.freedesktop.org/software/fontconfig/release/${pname}-${version}.tar.xz";
+    sha256 = "0g004r0bkkqz00mpm3svnnxn7d83158q0yb9ggxryizxfg5m5w55";
   };
 
-  patches = [
-    # Fix build with no docbook2html.
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/fontconfig/fontconfig/-/commit/60ce9b695ee9d1ac514a61f562e210d3278ba605.patch";
-      sha256 = "0hfd2jdvsgackdp29dyzf5b1277pnbacihxqh9vdn63rr932ipra";
-    })
-  ];
-
   outputs = [ "bin" "dev" "lib" "out" ]; # $out contains all the config
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index 46c13bbe4a9..035b0ab55ad 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -1,8 +1,8 @@
 { lib, stdenv
 , fetchurl
 
+, autoreconfHook
 , pkg-config
-, cmake
 
 , libdeflate
 , libjpeg
@@ -12,17 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libtiff";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchurl {
     url = "https://download.osgeo.org/libtiff/tiff-${version}.tar.gz";
-    sha256 = "1jrkjv0xya9radddn8idxvs2gqzp3l2b1s8knlizmn7ad3jq817b";
+    sha256 = "1j3snghqjbhwmnm5vz3dr1zm68dj15mgbx1wqld7vkl7n2nfaihf";
   };
 
-  cmakeFlags = if stdenv.isDarwin then [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
-  ] else null;
-
   # FreeImage needs this patch
   patches = [ ./headers.patch ];
 
@@ -34,7 +30,9 @@ stdenv.mkDerivation rec {
     moveToOutput include/tiffiop.h $dev_private
   '';
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  # If you want to change to a different build system, please make
+  # sure cross-compilation works first!
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   propagatedBuildInputs = [ libjpeg xz zlib ]; #TODO: opengl support (bogus configure detection)
 
@@ -42,12 +40,13 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  doInstallCheck = true;
-  installCheckTarget = "test";
+  doCheck = true;
 
   meta = with lib; {
     description = "Library and utilities for working with the TIFF image file format";
-    homepage = "http://download.osgeo.org/libtiff";
+    homepage = "https://libtiff.gitlab.io/libtiff";
+    changelog = "https://libtiff.gitlab.io/libtiff/v${version}.html";
+    maintainers = with maintainers; [ qyliss ];
     license = licenses.libtiff;
     platforms = platforms.unix;
   };
diff --git a/pkgs/development/libraries/libtiff/headers.patch b/pkgs/development/libraries/libtiff/headers.patch
index 5a00502ef28..e1c681502b3 100644
--- a/pkgs/development/libraries/libtiff/headers.patch
+++ b/pkgs/development/libraries/libtiff/headers.patch
@@ -1,13 +1,16 @@
-diff -ruN a/libtiff/CMakeLists.txt b/libtiff/CMakeLists.txt
---- a/libtiff/CMakeLists.txt	2019-05-31 13:05:22.849705817 +0000
-+++ b/libtiff/CMakeLists.txt	2020-11-27 21:50:03.527831837 +0000
-@@ -42,6 +42,9 @@
-   libtiffxx.map)
+diff --git i/libtiff/Makefile.am w/libtiff/Makefile.am
+index 44522b62..d66e5948 100644
+--- i/libtiff/Makefile.am
++++ w/libtiff/Makefile.am
+@@ -36,8 +36,11 @@ EXTRA_DIST = \
+ 	tiffconf.h.cmake.in
  
- set(tiff_HEADERS
-+  tiffiop.h
-+  ${CMAKE_CURRENT_BINARY_DIR}/tif_config.h
-+  tif_dir.h
-   tiff.h
-   tiffio.h
-   tiffvers.h)
+ libtiffinclude_HEADERS = \
++	tif_config.h \
++	tif_dir.h \
+ 	tiff.h \
+ 	tiffio.h \
++	tiffiop.h \
+ 	tiffvers.h
+ 
+ if HAVE_CXX
diff --git a/pkgs/development/python-modules/Cython/default.nix b/pkgs/development/python-modules/Cython/default.nix
index c09f1586fd6..dcede9506e3 100644
--- a/pkgs/development/python-modules/Cython/default.nix
+++ b/pkgs/development/python-modules/Cython/default.nix
@@ -37,9 +37,9 @@ in buildPythonPackage rec {
     pkg-config
   ];
   checkInputs = [
-    numpy ncurses
+    gdb numpy ncurses
   ];
-  buildInputs = [ glibcLocales gdb ];
+  buildInputs = [ glibcLocales ];
   LC_ALL = "en_US.UTF-8";
 
   patches = [
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index 0f747a8d73e..af6c3d80dea 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -1,17 +1,17 @@
 { lib, stdenv, buildPythonPackage, fetchPypi, isPyPy, isPy3k
-, olefile, freetype, libjpeg, zlib, libtiff, libwebp, tcl, lcms2, tk, libX11
+, defusedxml, olefile, freetype, libjpeg, zlib, libtiff, libwebp, tcl, lcms2, tk, libX11
 , libxcb, openjpeg, libimagequant, pyroma, numpy, pytestCheckHook
 }@args:
 
 import ./generic.nix (rec {
   pname = "Pillow";
-  version = "8.2.0";
+  version = "8.3.1";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1qf3bz1sfz58ff6hclg8phgqyy210x3aqdk5yzjr8m5vsw8ap1x7";
+    sha256 = "2cac53839bfc5cece8fdbe7f084d5e3ee61e1303cccc86511d351adcb9e2c792";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pillow/generic.nix b/pkgs/development/python-modules/pillow/generic.nix
index 64ae9189559..3e33f1a8aa0 100644
--- a/pkgs/development/python-modules/pillow/generic.nix
+++ b/pkgs/development/python-modules/pillow/generic.nix
@@ -31,7 +31,8 @@ buildPythonPackage rec {
     "test_custom_metadata"
   ];
 
-  propagatedBuildInputs = [ olefile ];
+  propagatedBuildInputs = [ olefile ]
+    ++ lib.optionals (lib.versionAtLeast version "8.2.0") [ defusedxml ];
 
   checkInputs = [ pytestCheckHook pyroma numpy ];
 
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index 6d0d49b9d39..040b8fc8478 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -52,6 +52,11 @@ in stdenv.mkDerivation rec {
     substituteInPlace tools/hid2hci.rules \
       --replace /sbin/udevadm ${systemd}/bin/udevadm \
       --replace "hid2hci " "$out/lib/udev/hid2hci "
+    # Disable some tests:
+    # - test-mesh-crypto depends on the following kernel settings:
+    #   CONFIG_CRYPTO_[USER|USER_API|USER_API_AEAD|USER_API_HASH|AES|CCM|AEAD|CMAC]
+    if [[ ! -f unit/test-mesh-crypto.c ]]; then echo "unit/test-mesh-crypto.c no longer exists"; false; fi
+    echo 'int main() { return 77; }' > unit/test-mesh-crypto.c
   '';
 
   configureFlags = [
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index a89453b55f4..5253d7faa40 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
     (name: value: "-DZSTD_${name}:BOOL=${if value then "ON" else "OFF"}") {
       BUILD_SHARED = !static;
       BUILD_STATIC = static;
+      BUILD_CONTRIB = true;
       PROGRAMS_LINK_SHARED = !static;
       LEGACY_SUPPORT = legacySupport;
       BUILD_TESTS = doCheck;
@@ -62,12 +63,16 @@ stdenv.mkDerivation rec {
   '';
 
   preInstall = ''
+    mkdir -p $bin/bin
+    cp contrib/pzstd/pzstd $bin/bin/pzstd
     substituteInPlace ../programs/zstdgrep \
       --replace ":-grep" ":-${gnugrep}/bin/grep" \
       --replace ":-zstdcat" ":-$bin/bin/zstdcat"
 
     substituteInPlace ../programs/zstdless \
       --replace "zstdcat" "$bin/bin/zstdcat"
+  '' + lib.optionalString stdenv.isDarwin ''
+    install_name_tool -change @rpath/libzstd.1.dylib $out/lib/libzstd.1.dylib $bin/bin/pzstd
   '';
 
   outputs = [ "bin" "dev" ]