summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/functions/library/attrsets.xml2
-rw-r--r--doc/languages-frameworks/ocaml.section.md4
-rw-r--r--nixos/doc/manual/development/writing-modules.chapter.md42
-rw-r--r--nixos/doc/manual/from_md/development/writing-modules.chapter.xml49
-rw-r--r--nixos/lib/utils.nix20
-rw-r--r--nixos/modules/services/web-servers/tomcat.nix7
-rw-r--r--nixos/tests/all-tests.nix2
-rw-r--r--nixos/tests/empty-file0
-rw-r--r--nixos/tests/systemd-escaping.nix45
-rw-r--r--nixos/tests/tomcat.nix21
-rw-r--r--pkgs/applications/emulators/cdemu/vhba.nix2
-rw-r--r--pkgs/applications/misc/mediaelch/default.nix4
-rwxr-xr-xpkgs/applications/networking/cluster/terraform-providers/update-all-providers13
-rwxr-xr-xpkgs/applications/networking/cluster/terraform-providers/update-provider70
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/default.nix4
-rw-r--r--pkgs/build-support/fetchurl/mirrors.nix493
-rw-r--r--pkgs/build-support/ocaml/dune.nix2
-rw-r--r--pkgs/development/compilers/llvm/14/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/14/llvm/default.nix3
-rwxr-xr-xpkgs/development/compilers/llvm/update.sh8
-rw-r--r--pkgs/development/compilers/ocaml/4.14.nix9
-rw-r--r--pkgs/development/libraries/vte/default.nix6
-rw-r--r--pkgs/development/ocaml-modules/facile/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/genspio/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/janestreet/janePackage.nix4
-rw-r--r--pkgs/development/ocaml-modules/janestreet/janePackage_0_12.nix2
-rw-r--r--pkgs/development/ocaml-modules/lwt/camlp4.nix4
-rw-r--r--pkgs/development/ocaml-modules/nonstd/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/ocamlfuse/default.nix8
-rw-r--r--pkgs/development/ocaml-modules/owee/default.nix17
-rw-r--r--pkgs/development/ocaml-modules/spacetime_lib/default.nix5
-rw-r--r--pkgs/development/php-packages/box/default.nix2
-rw-r--r--pkgs/development/php-packages/deployer/default.nix2
-rw-r--r--pkgs/development/php-packages/phing/default.nix2
-rw-r--r--pkgs/development/php-packages/phive/default.nix31
-rw-r--r--pkgs/development/php-packages/php-cs-fixer/default.nix2
-rw-r--r--pkgs/development/php-packages/php-parallel-lint/default.nix4
-rw-r--r--pkgs/development/php-packages/phpcbf/default.nix2
-rw-r--r--pkgs/development/php-packages/phpcs/default.nix2
-rw-r--r--pkgs/development/php-packages/phpmd/default.nix2
-rw-r--r--pkgs/development/php-packages/phpstan/default.nix2
-rw-r--r--pkgs/development/php-packages/psalm/default.nix2
-rw-r--r--pkgs/development/php-packages/psysh/default.nix2
-rw-r--r--pkgs/development/python-modules/aio-geojson-client/default.nix4
-rw-r--r--pkgs/development/python-modules/pudb/default.nix7
-rw-r--r--pkgs/development/python-modules/types-requests/default.nix4
-rw-r--r--pkgs/development/python-modules/types-urllib3/default.nix4
-rw-r--r--pkgs/development/python-modules/unidiff/default.nix4
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/camlp4.nix2
-rw-r--r--pkgs/development/tools/profiling/systemtap/default.nix4
-rw-r--r--pkgs/games/freedroidrpg/default.nix11
-rw-r--r--pkgs/os-specific/linux/akvcam/default.nix3
-rw-r--r--pkgs/os-specific/linux/apfs/default.nix2
-rw-r--r--pkgs/os-specific/linux/batman-adv/default.nix4
-rw-r--r--pkgs/os-specific/linux/can-isotp/default.nix15
-rw-r--r--pkgs/os-specific/linux/cryptodev/default.nix1
-rw-r--r--pkgs/os-specific/linux/digimend/default.nix5
-rw-r--r--pkgs/os-specific/linux/dpdk-kmods/default.nix6
-rw-r--r--pkgs/os-specific/linux/ena/default.nix3
-rw-r--r--pkgs/os-specific/linux/evdi/default.nix2
-rw-r--r--pkgs/os-specific/linux/fwts/module.nix2
-rw-r--r--pkgs/os-specific/linux/gcadapter-oc-kmod/default.nix2
-rw-r--r--pkgs/os-specific/linux/hid-nintendo/default.nix2
-rw-r--r--pkgs/os-specific/linux/jool/default.nix11
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix2
-rw-r--r--pkgs/os-specific/linux/lttng-modules/default.nix10
-rw-r--r--pkgs/os-specific/linux/mba6x_bl/default.nix2
-rw-r--r--pkgs/os-specific/linux/mbp-modules/mbp2018-bridge-drv/default.nix7
-rw-r--r--pkgs/os-specific/linux/netatop/default.nix3
-rw-r--r--pkgs/os-specific/linux/openrazer/driver.nix2
-rw-r--r--pkgs/os-specific/linux/r8168/default.nix8
-rw-r--r--pkgs/os-specific/linux/rtl8189es/default.nix14
-rw-r--r--pkgs/os-specific/linux/rtl8192eu/default.nix2
-rw-r--r--pkgs/os-specific/linux/rtl8814au/default.nix3
-rw-r--r--pkgs/os-specific/linux/rtl8821ce/default.nix4
-rw-r--r--pkgs/os-specific/linux/rtl8821cu/default.nix4
-rw-r--r--pkgs/os-specific/linux/rtl88x2bu/default.nix6
-rw-r--r--pkgs/os-specific/linux/rtw88/default.nix3
-rw-r--r--pkgs/os-specific/linux/rtw89/default.nix3
-rw-r--r--pkgs/os-specific/linux/v4l2loopback/default.nix7
-rw-r--r--pkgs/os-specific/linux/veikk-linux-driver/default.nix6
-rw-r--r--pkgs/os-specific/linux/xmm7360-pci/default.nix6
-rw-r--r--pkgs/os-specific/linux/xpadneo/default.nix2
-rw-r--r--pkgs/shells/tcsh/default.nix13
-rw-r--r--pkgs/tools/nix/nix-output-monitor/default.nix24
-rw-r--r--pkgs/tools/package-management/nix-eval-jobs/default.nix4
-rw-r--r--pkgs/tools/package-management/nix/default.nix8
-rw-r--r--pkgs/tools/security/gitleaks/default.nix6
-rw-r--r--pkgs/top-level/ocaml-packages.nix2
-rw-r--r--pkgs/top-level/php-packages.nix2
90 files changed, 742 insertions, 424 deletions
diff --git a/doc/functions/library/attrsets.xml b/doc/functions/library/attrsets.xml
index a30f4edf4c1..052bfa1f6ae 100644
--- a/doc/functions/library/attrsets.xml
+++ b/doc/functions/library/attrsets.xml
@@ -1474,7 +1474,7 @@ lib.attrsets.zipAttrsWith
  <section xml:id="function-library-lib.attrsets.zipAttrs">
   <title><function>lib.attrsets.zipAttrs</function></title>
 
-  <subtitle><literal>zipAttrsWith :: [ AttrSet ] -> AttrSet</literal>
+  <subtitle><literal>zipAttrs :: [ AttrSet ] -> AttrSet</literal>
   </subtitle>
 
   <xi:include href="./locations.xml" xpointer="lib.attrsets.zipAttrs" />
diff --git a/doc/languages-frameworks/ocaml.section.md b/doc/languages-frameworks/ocaml.section.md
index 47035551d41..e4813d7dd2d 100644
--- a/doc/languages-frameworks/ocaml.section.md
+++ b/doc/languages-frameworks/ocaml.section.md
@@ -38,8 +38,8 @@ Here is a simple package example.
 
 - It uses the `fetchFromGitHub` fetcher to get its source.
 
-- `useDune2 = true` ensures that the latest version of Dune is used for the
-  build (this may become the default value in a future release).
+- `useDune2 = true` ensures that Dune version 2 is used for the
+  build (this is the default; set to `false` to use Dune version 1).
 
 - It sets the optional `doCheck` attribute such that tests will be run with
   `dune runtest -p angstrom` after the build (`dune build -p angstrom`) is
diff --git a/nixos/doc/manual/development/writing-modules.chapter.md b/nixos/doc/manual/development/writing-modules.chapter.md
index 2e3c6b34f1f..0c41cbd3cb7 100644
--- a/nixos/doc/manual/development/writing-modules.chapter.md
+++ b/nixos/doc/manual/development/writing-modules.chapter.md
@@ -90,6 +90,17 @@ modules: `systemd.services` (the set of all systemd services) and
 `systemd.timers` (the list of commands to be executed periodically by
 `systemd`).
 
+Care must be taken when writing systemd services using `Exec*` directives. By
+default systemd performs substitution on `%<char>` specifiers in these
+directives, expands environment variables from `$FOO` and `${FOO}`, splits
+arguments on whitespace, and splits commands on `;`. All of these must be escaped
+to avoid unexpected substitution or splitting when interpolating into an `Exec*`
+directive, e.g. when using an `extraArgs` option to pass additional arguments to
+the service. The functions `utils.escapeSystemdExecArg` and
+`utils.escapeSystemdExecArgs` are provided for this, see [Example: Escaping in
+Exec directives](#exec-escaping-example) for an example. When using these
+functions system environment substitution should *not* be disabled explicitly.
+
 ::: {#locate-example .example}
 ::: {.title}
 **Example: NixOS Module for the "locate" Service**
@@ -153,6 +164,37 @@ in {
 ```
 :::
 
+::: {#exec-escaping-example .example}
+::: {.title}
+**Example: Escaping in Exec directives**
+:::
+```nix
+{ config, lib, pkgs, utils, ... }:
+
+with lib;
+
+let
+  cfg = config.services.echo;
+  echoAll = pkgs.writeScript "echo-all" ''
+    #! ${pkgs.runtimeShell}
+    for s in "$@"; do
+      printf '%s\n' "$s"
+    done
+  '';
+  args = [ "a%Nything" "lang=\${LANG}" ";" "/bin/sh -c date" ];
+in {
+  systemd.services.echo =
+    { description = "Echo to the journal";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig.Type = "oneshot";
+      serviceConfig.ExecStart = ''
+        ${echoAll} ${utils.escapeSystemdExecArgs args}
+      '';
+    };
+}
+```
+:::
+
 ```{=docbook}
 <xi:include href="option-declarations.section.xml" />
 <xi:include href="option-types.section.xml" />
diff --git a/nixos/doc/manual/from_md/development/writing-modules.chapter.xml b/nixos/doc/manual/from_md/development/writing-modules.chapter.xml
index e33c24f4f12..367731eda09 100644
--- a/nixos/doc/manual/from_md/development/writing-modules.chapter.xml
+++ b/nixos/doc/manual/from_md/development/writing-modules.chapter.xml
@@ -122,6 +122,25 @@
     services) and <literal>systemd.timers</literal> (the list of
     commands to be executed periodically by <literal>systemd</literal>).
   </para>
+  <para>
+    Care must be taken when writing systemd services using
+    <literal>Exec*</literal> directives. By default systemd performs
+    substitution on <literal>%&lt;char&gt;</literal> specifiers in these
+    directives, expands environment variables from
+    <literal>$FOO</literal> and <literal>${FOO}</literal>, splits
+    arguments on whitespace, and splits commands on
+    <literal>;</literal>. All of these must be escaped to avoid
+    unexpected substitution or splitting when interpolating into an
+    <literal>Exec*</literal> directive, e.g. when using an
+    <literal>extraArgs</literal> option to pass additional arguments to
+    the service. The functions
+    <literal>utils.escapeSystemdExecArg</literal> and
+    <literal>utils.escapeSystemdExecArgs</literal> are provided for
+    this, see <link linkend="exec-escaping-example">Example: Escaping in
+    Exec directives</link> for an example. When using these functions
+    system environment substitution should <emphasis>not</emphasis> be
+    disabled explicitly.
+  </para>
   <anchor xml:id="locate-example" />
   <para>
     <emphasis role="strong">Example: NixOS Module for the
@@ -184,6 +203,36 @@ in {
   };
 }
 </programlisting>
+  <anchor xml:id="exec-escaping-example" />
+  <para>
+    <emphasis role="strong">Example: Escaping in Exec
+    directives</emphasis>
+  </para>
+  <programlisting language="bash">
+{ config, lib, pkgs, utils, ... }:
+
+with lib;
+
+let
+  cfg = config.services.echo;
+  echoAll = pkgs.writeScript &quot;echo-all&quot; ''
+    #! ${pkgs.runtimeShell}
+    for s in &quot;$@&quot;; do
+      printf '%s\n' &quot;$s&quot;
+    done
+  '';
+  args = [ &quot;a%Nything&quot; &quot;lang=\${LANG}&quot; &quot;;&quot; &quot;/bin/sh -c date&quot; ];
+in {
+  systemd.services.echo =
+    { description = &quot;Echo to the journal&quot;;
+      wantedBy = [ &quot;multi-user.target&quot; ];
+      serviceConfig.Type = &quot;oneshot&quot;;
+      serviceConfig.ExecStart = ''
+        ${echoAll} ${utils.escapeSystemdExecArgs args}
+      '';
+    };
+}
+</programlisting>
   <xi:include href="option-declarations.section.xml" />
   <xi:include href="option-types.section.xml" />
   <xi:include href="option-def.section.xml" />
diff --git a/nixos/lib/utils.nix b/nixos/lib/utils.nix
index 733f9ca522b..ae68c3920c5 100644
--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@@ -45,6 +45,26 @@ rec {
    replaceChars ["/" "-" " "] ["-" "\\x2d" "\\x20"]
    (removePrefix "/" s);
 
+  # Quotes an argument for use in Exec* service lines.
+  # systemd accepts "-quoted strings with escape sequences, toJSON produces
+  # a subset of these.
+  # Additionally we escape % to disallow expansion of % specifiers. Any lone ;
+  # in the input will be turned it ";" and thus lose its special meaning.
+  # Every $ is escaped to $$, this makes it unnecessary to disable environment
+  # substitution for the directive.
+  escapeSystemdExecArg = arg:
+    let
+      s = if builtins.isPath arg then "${arg}"
+        else if builtins.isString arg then arg
+        else if builtins.isInt arg || builtins.isFloat arg then toString arg
+        else throw "escapeSystemdExecArg only allows strings, paths and numbers";
+    in
+      replaceChars [ "%" "$" ] [ "%%" "$$" ] (builtins.toJSON s);
+
+  # Quotes a list of arguments into a single string for use in a Exec*
+  # line.
+  escapeSystemdExecArgs = concatMapStringsSep " " escapeSystemdExecArg;
+
   # Returns a system path for a given shell package
   toShellPath = shell:
     if types.shellPackage.check shell then
diff --git a/nixos/modules/services/web-servers/tomcat.nix b/nixos/modules/services/web-servers/tomcat.nix
index f9446fe125a..877097cf378 100644
--- a/nixos/modules/services/web-servers/tomcat.nix
+++ b/nixos/modules/services/web-servers/tomcat.nix
@@ -23,8 +23,8 @@ in
 
       package = mkOption {
         type = types.package;
-        default = pkgs.tomcat85;
-        defaultText = literalExpression "pkgs.tomcat85";
+        default = pkgs.tomcat9;
+        defaultText = literalExpression "pkgs.tomcat9";
         example = lib.literalExpression "pkgs.tomcat9";
         description = ''
           Which tomcat package to use.
@@ -127,7 +127,7 @@ in
       webapps = mkOption {
         type = types.listOf types.path;
         default = [ tomcat.webapps ];
-        defaultText = literalExpression "[ pkgs.tomcat85.webapps ]";
+        defaultText = literalExpression "[ config.services.tomcat.package.webapps ]";
         description = "List containing WAR files or directories with WAR files which are web applications to be deployed on Tomcat";
       };
 
@@ -201,6 +201,7 @@ in
       { uid = config.ids.uids.tomcat;
         description = "Tomcat user";
         home = "/homeless-shelter";
+        group = "tomcat";
         extraGroups = cfg.extraGroups;
       };
 
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 043d8a56d0c..001518d02cb 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -503,6 +503,7 @@ in
   systemd-boot = handleTest ./systemd-boot.nix {};
   systemd-confinement = handleTest ./systemd-confinement.nix {};
   systemd-cryptenroll = handleTest ./systemd-cryptenroll.nix {};
+  systemd-escaping = handleTest ./systemd-escaping.nix {};
   systemd-journal = handleTest ./systemd-journal.nix {};
   systemd-machinectl = handleTest ./systemd-machinectl.nix {};
   systemd-networkd = handleTest ./systemd-networkd.nix {};
@@ -524,6 +525,7 @@ in
   tinc = handleTest ./tinc {};
   tinydns = handleTest ./tinydns.nix {};
   tinywl = handleTest ./tinywl.nix {};
+  tomcat = handleTest ./tomcat.nix {};
   tor = handleTest ./tor.nix {};
   # traefik test relies on docker-containers
   traefik = handleTestOn ["x86_64-linux"] ./traefik.nix {};
diff --git a/nixos/tests/empty-file b/nixos/tests/empty-file
new file mode 100644
index 00000000000..e69de29bb2d
--- /dev/null
+++ b/nixos/tests/empty-file
diff --git a/nixos/tests/systemd-escaping.nix b/nixos/tests/systemd-escaping.nix
new file mode 100644
index 00000000000..7f93eb5e4f7
--- /dev/null
+++ b/nixos/tests/systemd-escaping.nix
@@ -0,0 +1,45 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+let
+  echoAll = pkgs.writeScript "echo-all" ''
+    #! ${pkgs.runtimeShell}
+    for s in "$@"; do
+      printf '%s\n' "$s"
+    done
+  '';
+  # deliberately using a local empty file instead of pkgs.emptyFile to have
+  # a non-store path in the test
+  args = [ "a%Nything" "lang=\${LANG}" ";" "/bin/sh -c date" ./empty-file 4.2 23 ];
+in
+{
+  name = "systemd-escaping";
+
+  machine = { pkgs, lib, utils, ... }: {
+    systemd.services.echo =
+      assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ [] ])).success;
+      assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ {} ])).success;
+      assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ null ])).success;
+      assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ false ])).success;
+      assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ (_:_) ])).success;
+      { description = "Echo to the journal";
+        serviceConfig.Type = "oneshot";
+        serviceConfig.ExecStart = ''
+          ${echoAll} ${utils.escapeSystemdExecArgs args}
+        '';
+      };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("systemctl start echo.service")
+    # skip the first 'Starting <service> ...' line
+    logs = machine.succeed("journalctl -u echo.service -o cat").splitlines()[1:]
+    assert "a%Nything" == logs[0]
+    assert "lang=''${LANG}" == logs[1]
+    assert ";" == logs[2]
+    assert "/bin/sh -c date" == logs[3]
+    assert "/nix/store/ij3gw72f4n5z4dz6nnzl1731p9kmjbwr-empty-file" == logs[4]
+    assert "4.2" in logs[5] # toString produces extra fractional digits!
+    assert "23" == logs[6]
+  '';
+})
diff --git a/nixos/tests/tomcat.nix b/nixos/tests/tomcat.nix
new file mode 100644
index 00000000000..e383f224e3d
--- /dev/null
+++ b/nixos/tests/tomcat.nix
@@ -0,0 +1,21 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+{
+  name = "tomcat";
+
+  machine = { pkgs, ... }: {
+    services.tomcat.enable = true;
+  };
+
+  testScript = ''
+    machine.wait_for_unit("tomcat.service")
+    machine.wait_for_open_port(8080)
+    machine.wait_for_file("/var/tomcat/webapps/examples");
+    machine.succeed(
+        "curl --fail http://localhost:8080/examples/servlets/servlet/HelloWorldExample | grep 'Hello World!'"
+    )
+    machine.succeed(
+        "curl --fail http://localhost:8080/examples/jsp/jsp2/simpletag/hello.jsp | grep 'Hello, world!'"
+    )
+  '';
+})
diff --git a/pkgs/applications/emulators/cdemu/vhba.nix b/pkgs/applications/emulators/cdemu/vhba.nix
index aeadcf5c1c1..40792c81ac1 100644
--- a/pkgs/applications/emulators/cdemu/vhba.nix
+++ b/pkgs/applications/emulators/cdemu/vhba.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-csWowcRSgF5M74yv787MLSXOGXrkxnODCCgC5a3Nd7Y=";
   };
 
-  makeFlags = [ "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" "INSTALL_MOD_PATH=$(out)" ];
+  makeFlags = kernel.makeFlags ++ [ "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" "INSTALL_MOD_PATH=$(out)" ];
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/mediaelch/default.nix b/pkgs/applications/misc/mediaelch/default.nix
index 7cfe873a44e..2381e89640a 100644
--- a/pkgs/applications/misc/mediaelch/default.nix
+++ b/pkgs/applications/misc/mediaelch/default.nix
@@ -18,13 +18,13 @@
 
 mkDerivation rec {
   pname = "mediaelch";
-  version = "2.8.14";
+  version = "2.8.16";
 
   src = fetchFromGitHub {
     owner = "Komet";
     repo = "MediaElch";
     rev = "v${version}";
-    sha256 = "sha256-yHThX5Xs+8SijNKgmg+4Mawbwi3zHA/DJQoIBy0Wchs=";
+    sha256 = "sha256-83bHfIRVAC+3RkCYmV+TBjjQxaFMHfVyxt5Jq44dzeI=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/update-all-providers b/pkgs/applications/networking/cluster/terraform-providers/update-all-providers
index 57e1ab32f08..d7a05cf24a6 100755
--- a/pkgs/applications/networking/cluster/terraform-providers/update-all-providers
+++ b/pkgs/applications/networking/cluster/terraform-providers/update-all-providers
@@ -5,7 +5,7 @@
 # Update all providers which have specified provider source address
 set -euo pipefail
 
-providers=$(
+readarray -t providers < <(
   jq -r 'to_entries
   | map_values(.value + { alias: .key })
   | .[]
@@ -13,10 +13,13 @@ providers=$(
   | .alias' providers.json
 )
 
-echo "Will update providers:"
-echo "${providers}"
+cat <<EOF
+Will update ${#providers[@]} providers:
 
-for provider in ${providers}; do
-  echo "Updating ${provider}"
+${providers[*]}
+
+EOF
+
+for provider in "${providers[@]}"; do
   ./update-provider "$@" "${provider}"
 done
diff --git a/pkgs/applications/networking/cluster/terraform-providers/update-provider b/pkgs/applications/networking/cluster/terraform-providers/update-provider
index 255e82aee1d..4310fcdcc27 100755
--- a/pkgs/applications/networking/cluster/terraform-providers/update-provider
+++ b/pkgs/applications/networking/cluster/terraform-providers/update-provider
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -I nixpkgs=../../../../.. -i bash -p coreutils curl jq moreutils nix nix-prefetch
+#! nix-shell -I nixpkgs=../../../../.. -i bash -p coreutils curl git jq moreutils nix nix-prefetch
 # shellcheck shell=bash
 # vim: ft=sh
 #
@@ -75,45 +75,46 @@ if [[ -z ${provider} ]]; then
   exit 1
 fi
 
-provider_name=$(basename "${provider}")
-
 # Usage: read_attr <key>
 read_attr() {
-  jq -r ".\"${provider_name}\".\"$1\"" providers.json
+  jq -r ".\"${provider}\".\"$1\"" providers.json
 }
 
 # Usage: update_attr <key> <value>
 update_attr() {
   if [[ $2 == "null" ]]; then
-    jq -S ".\"${provider_name}\".\"$1\" = null" providers.json | sponge providers.json
+    jq -S ".\"${provider}\".\"$1\" = null" providers.json | sponge providers.json
   else
-    jq -S ".\"${provider_name}\".\"$1\" = \"$2\"" providers.json | sponge providers.json
+    jq -S ".\"${provider}\".\"$1\" = \"$2\"" providers.json | sponge providers.json
   fi
 }
 
-prefetch_github() {
-  # of a given owner, repo and rev, fetch the tarball and return the output of
-  # `nix-prefetch-url`
-  local owner=$1
-  local repo=$2
-  local rev=$3
-  nix-prefetch-url --unpack "https://github.com/${owner}/${repo}/archive/${rev}.tar.gz"
+repo_root=$(git rev-parse --show-toplevel)
+
+generate_hash() {
+  nix-prefetch -I nixpkgs="${repo_root}" \
+    "{ sha256 }: (import ${repo_root} {}).terraform-providers.${provider}.$1.overrideAttrs (_: { $2 = sha256; })"
 }
 
-old_source_address="$(read_attr provider-source-address)"
-old_vendor_sha256=$(read_attr vendorSha256)
-old_version=$(read_attr version)
+echo_provider() {
+  echo "== terraform-providers.${provider}: $* =="
+}
 
 if [[ ${provider} =~ ^[^/]+/[^/]+$ ]]; then
+  echo_provider "init"
   source_address=registry.terraform.io/${provider}
+  provider=$(basename "${provider}")
+  update_attr "provider-source-address" "${source_address}"
+  update_attr version "0"
+  # create empty stings so nix-prefetch works
+  update_attr sha256 ""
+  update_attr vendorSha256 ""
 else
-  source_address=${old_source_address}
-fi
-if [[ ${source_address} == "null" ]]; then
-  echo "Could not find the source address for provider: ${provider}"
-  exit 1
+  source_address="$(read_attr provider-source-address)"
 fi
-update_attr "provider-source-address" "${source_address}"
+
+old_vendor_sha256=$(read_attr vendorSha256)
+old_version=$(read_attr version)
 
 # The provider source address (used inside Terraform `required_providers` block) is
 # used to compute the registry API endpoint
@@ -125,8 +126,10 @@ registry_response=$(curl -s https://"${source_address/\///v1/providers/}")
 
 version="$(jq -r '.version' <<<"${registry_response}")"
 if [[ ${old_version} == "${version}" && ${force} != 1 && -z ${vendorSha256} && ${old_vendor_sha256} != "${vendorSha256}" ]]; then
-  echo "${provider_name} is already at version ${version}"
+  echo_provider "already at version ${version}"
   exit
+else
+  echo_provider "updating from ${old_version} to ${version}"
 fi
 update_attr version "${version}"
 
@@ -138,28 +141,23 @@ repo="$(echo "${provider_source_url}" | cut -d '/' -f 5)"
 update_attr repo "${repo}"
 rev="$(jq -r '.tag' <<<"${registry_response}")"
 update_attr rev "${rev}"
-sha256=$(prefetch_github "${org}" "${repo}" "${rev}")
+echo_provider "calculating sha256"
+sha256=$(generate_hash src outputHash)
 update_attr sha256 "${sha256}"
 
 if [[ -z ${vendorSha256} ]]; then
   if [[ ${old_vendor_sha256} == null ]]; then
     vendorSha256=null
-  elif [[ -n ${old_vendor_sha256} ]]; then
-    echo "=== Calculating vendorSha256 ==="
-    vendorSha256=$(nix-prefetch -I nixpkgs=../../../../.. "{ sha256 }: (import ../../../../.. {}).terraform-providers.${provider_name}.go-modules.overrideAttrs (_: { vendorSha256 = sha256; })")
-    # Deal with nix unstable
-    if [[ ${vendorSha256} == sha256-* ]]; then
-      vendorSha256=$(nix --extra-experimental-features nix-command hash to-base32 "${vendorSha256}")
-    fi
+  else
+    echo_provider "calculating vendorSha256"
+    vendorSha256=$(generate_hash go-modules vendorSha256)
   fi
 fi
 
-if [[ -n ${vendorSha256} ]]; then
-  update_attr vendorSha256 "${vendorSha256}"
-fi
+update_attr vendorSha256 "${vendorSha256}"
 
 # Check that the provider builds
 if [[ ${build} == 1 ]]; then
-  echo "=== Building terraform-providers.${provider_name} ==="
-  nix-build --no-out-link ../../../../.. -A "terraform-providers.${provider_name}"
+  echo_provider "building"
+  nix-build --no-out-link "${repo_root}" -A "terraform-providers.${provider}"
 fi
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index f1a2a752fd2..99ee871c917 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -24,7 +24,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "5.34.0"; # Please backport all updates to the stable channel.
+  version = "5.35.0"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "sha256-uU4WJtd9qwrjHgsK0oDg/pCf/5lfNhoMDEd/lHUnLwk=";
+    sha256 = "sha256-2KF2OLq6/vHElgloxn+kgQisJC+HAkpOBfsKfEPW35c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index e4d6f02a94b..82f768daa5f 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -1,6 +1,6 @@
 {
 
-  # Content-addressable Nix mirrors.
+  # Content-addressable Nix mirrors
   hashedMirrors = [
     "https://tarballs.nixos.org"
   ];
@@ -8,37 +8,73 @@
   # Mirrors for mirror://site/filename URIs, where "site" is
   # "sourceforge", "gnu", etc.
 
-  luarocks = [
-    "https://luarocks.org/"
-    "https://raw.githubusercontent.com/rocks-moonscript-org/moonrocks-mirror/master/"
-    "https://luafr.org/moonrocks/"
-    "http://luarocks.logiceditor.com/rocks/"
+  # Alsa Project
+  alsa = [
+    "https://www.alsa-project.org/files/pub/"
+    "ftp://ftp.alsa-project.org/pub/"
+    "http://alsa.cybermirror.org/"
+    "http://www.mirrorservice.org/sites/ftp.alsa-project.org/pub/"
   ];
 
-  # SourceForge.
-  sourceforge = [
-    "https://downloads.sourceforge.net/"
-    "https://prdownloads.sourceforge.net/"
-    "https://netcologne.dl.sourceforge.net/sourceforge/"
-    "https://versaweb.dl.sourceforge.net/sourceforge/"
-    "https://freefr.dl.sourceforge.net/sourceforge/"
-    "https://osdn.dl.sourceforge.net/sourceforge/"
-    "https://kent.dl.sourceforge.net/sourceforge/"
+  # Apache
+  apache = [
+    "https://www-eu.apache.org/dist/"
+    "https://ftp.wayne.edu/apache/"
+    "https://www.apache.org/dist/"
+    "https://archive.apache.org/dist/" # fallback for old releases
+    "https://apache.cs.uu.nl/"
+    "https://apache.cs.utah.edu/"
+    "http://ftp.tudelft.nl/apache/"
+    "ftp://ftp.funet.fi/pub/mirrors/apache.org/"
   ];
 
-  # OSDN (formerly SourceForge.jp).
-  osdn = [
-    "https://osdn.dl.osdn.jp/"
-    "https://osdn.mirror.constant.com/"
-    "https://mirrors.gigenet.com/OSDN/"
-    "https://osdn.dl.sourceforge.jp/"
-    "https://jaist.dl.sourceforge.jp/"
+  # Bioconductor mirrors (from https://bioconductor.org/about/mirrors/)
+  # The commented-out ones don't seem to allow direct package downloads;
+  # they serve error messages that result in hash mismatches instead
+  bioc = [
+    # http://bioc.ism.ac.jp/
+    # http://bioc.openanalytics.eu/
+    # http://bioconductor.fmrp.usp.br/
+    # http://mirror.aarnet.edu.au/pub/bioconductor/
+    # http://watson.nci.nih.gov/bioc_mirror/
+    "https://bioconductor.statistik.tu-dortmund.de/packages/"
+    "https://mirrors.ustc.edu.cn/bioc/"
+    "http://bioconductor.jp/packages/"
+  ];
+
+  # BitlBee mirrors, see https://www.bitlbee.org/main.php/mirrors.html
+  bitlbee = [
+    "https://get.bitlbee.org/"
+    "https://ftp.snt.utwente.nl/pub/software/bitlbee/"
+    "http://bitlbee.intergenia.de/"
+  ];
+
+  # GCC
+  gcc = [
+    "https://bigsearcher.com/mirrors/gcc/"
+    "https://mirror.koddos.net/gcc/"
+    "ftp://ftp.nluug.nl/mirror/languages/gcc/"
+    "ftp://ftp.fu-berlin.de/unix/languages/gcc/"
+    "ftp://ftp.irisa.fr/pub/mirrors/gcc.gnu.org/gcc/"
+    "ftp://gcc.gnu.org/pub/gcc/"
+  ];
+
+  # GNOME
+  gnome = [
+    # This one redirects to some mirror closeby, so it should be all you need
+    "https://download.gnome.org/"
+
+    "https://fr2.rpmfind.net/linux/gnome.org/"
+    "https://ftp.acc.umu.se/pub/GNOME/"
+    "https://ftp.belnet.be/mirror/ftp.gnome.org/"
+    "ftp://ftp.cse.buffalo.edu/pub/Gnome/"
+    "ftp://ftp.nara.wide.ad.jp/pub/X11/GNOME/"
   ];
 
-  # GNU (https://www.gnu.org/prep/ftp.html).
+  # GNU (https://www.gnu.org/prep/ftp.html)
   gnu = [
     # This one redirects to a (supposedly) nearby and (supposedly) up-to-date
-    # mirror.
+    # mirror
     "https://ftpmirror.gnu.org/"
 
     "https://ftp.nluug.nl/pub/gnu/"
@@ -47,23 +83,13 @@
     "https://mirror.dogado.de/gnu/"
     "https://mirror.tochlab.net/pub/gnu/"
 
-    # This one is the master repository, and thus it's always up-to-date.
+    # This one is the master repository, and thus it's always up-to-date
     "https://ftp.gnu.org/pub/gnu/"
 
     "ftp://ftp.funet.fi/pub/mirrors/ftp.gnu.org/gnu/"
   ];
 
-  # GCC.
-  gcc = [
-    "https://bigsearcher.com/mirrors/gcc/"
-    "https://mirror.koddos.net/gcc/"
-    "ftp://ftp.nluug.nl/mirror/languages/gcc/"
-    "ftp://ftp.fu-berlin.de/unix/languages/gcc/"
-    "ftp://ftp.irisa.fr/pub/mirrors/gcc.gnu.org/gcc/"
-    "ftp://gcc.gnu.org/pub/gcc/"
-  ];
-
-  # GnuPG.
+  # GnuPG
   gnupg = [
     "https://gnupg.org/ftp/gcrypt/"
     "https://mirrors.dotsrc.org/gcrypt/"
@@ -72,11 +98,13 @@
     "http://www.ring.gr.jp/pub/net/"
   ];
 
-  # kernel.org's /pub (/pub/{linux,software}) tree.
-  kernel = [
-    "https://cdn.kernel.org/pub/"
-    "http://linux-kernel.uio.no/pub/"
-    "ftp://ftp.funet.fi/pub/mirrors/ftp.kernel.org/pub/"
+  # ImageMagick mirrors, see https://www.imagemagick.org/script/mirror.php
+  imagemagick = [
+    "https://www.imagemagick.org/download/"
+    "https://mirror.checkdomain.de/imagemagick/"
+    "https://ftp.nluug.nl/ImageMagick/"
+    "https://ftp.sunet.se/mirror/imagemagick.org/ftp/"
+    "ftp://ftp.sunet.se/mirror/imagemagick.org/ftp/" # also contains older versions removed from most mirrors
   ];
 
   # Mirrors from https://download.kde.org/ls-lR.mirrorlist
@@ -89,13 +117,105 @@
     "https://ftp.funet.fi/pub/mirrors/ftp.kde.org/pub/kde/"
   ];
 
-  # Gentoo files.
-  gentoo = [
-    "https://ftp.snt.utwente.nl/pub/os/linux/gentoo/"
-    "https://distfiles.gentoo.org/"
-    "https://mirrors.kernel.org/gentoo/"
+  # kernel.org's /pub (/pub/{linux,software}) tree
+  kernel = [
+    "https://cdn.kernel.org/pub/"
+    "http://linux-kernel.uio.no/pub/"
+    "ftp://ftp.funet.fi/pub/mirrors/ftp.kernel.org/pub/"
+  ];
+
+  # Metalab, now IBiblio
+  metalab = [
+    "ftp://ftp.gwdg.de/pub/linux/metalab/"
+    "ftp://ftp.metalab.unc.edu/pub/linux/"
+  ];
+
+  # MySQL
+  mysql = [
+    "https://cdn.mysql.com/Downloads/"
+  ];
+
+  # Maven Central
+  maven = [
+    "https://repo1.maven.org/maven2/"
+  ];
+
+  # Mozilla projects
+  mozilla = [
+    "https://download.cdn.mozilla.net/pub/mozilla.org/"
+    "https://archive.mozilla.org/pub/"
+  ];
+
+  # OSDN (formerly SourceForge.jp)
+  osdn = [
+    "https://osdn.dl.osdn.jp/"
+    "https://osdn.mirror.constant.com/"
+    "https://mirrors.gigenet.com/OSDN/"
+    "https://osdn.dl.sourceforge.jp/"
+    "https://jaist.dl.sourceforge.jp/"
+  ];
+
+  # PostgreSQL
+  postgresql = [
+    "https://ftp.postgresql.org/pub/"
+  ];
+
+  # Roy marples mirrors
+  roy = [
+    "https://roy.marples.name/downloads/"
+    "https://cflags.cc/roy/"
+  ];
+
+  # Sage mirrors (https://www.sagemath.org/mirrors.html)
+  sageupstream = [
+    # Africa (HTTPS)
+    "https://sagemath.mirror.ac.za/spkg/upstream/"
+    "https://mirror.ufs.ac.za/sagemath/spkg/upstream/"
+
+    # America, North (HTTPS)
+    "https://mirrors.mit.edu/sage/spkg/upstream/"
+    "https://mirrors.xmission.com/sage/spkg/upstream/"
+
+    # Asia (HTTPS)
+    "https://mirrors.tuna.tsinghua.edu.cn/sagemath/spkg/upstream/"
+    "https://mirrors.ustc.edu.cn/sagemath/spkg/upstream/"
+    "http://ftp.tsukuba.wide.ad.jp/software/sage/spkg/upstream/"
+    "https://ftp.yz.yamagata-u.ac.jp/pub/math/sage/spkg/upstream/"
+    "https://mirror.yandex.ru/mirrors/sage.math.washington.edu/spkg/upstream/"
+
+    # Australia (HTTPS)
+    "https://mirror.aarnet.edu.au/pub/sage/spkg/upstream/"
+
+    # Europe (HTTPS)
+    "https://sage.mirror.garr.it/mirrors/sage/spkg/upstream/"
+    "https://www-ftp.lip6.fr/pub/math/sagemath/spkg/upstream/"
+
+    # Africa (non-HTTPS)
+    "ftp://ftp.sun.ac.za/pub/mirrors/www.sagemath.org/spkg/upstream/"
+
+    # America, North (non-HTTPS)
+    "http://www.cecm.sfu.ca/sage/spkg/upstream/"
+
+    # America, South (non-HTTPS)
+    "http://sagemath.c3sl.ufpr.br/spkg/upstream/"
+    "http://linorg.usp.br/sage/spkg/upstream"
+
+    # Asia (non-HTTPS)
+    "http://ftp.kaist.ac.kr/sage/spkg/upstream/"
+    "http://ftp.riken.jp/sagemath/spkg/upstream/"
+
+    # Europe (non-HTTPS)
+    "http://mirrors.fe.up.pt/pub/sage/spkg/upstream/"
+    "http://ftp.ntua.gr/pub/sagemath/spkg/upstream/"
+  ];
+
+  # SAMBA
+  samba = [
+    "https://www.samba.org/ftp/"
+    "http://www.samba.org/ftp/"
   ];
 
+  # GNU Savannah
   savannah = [
     # Mirrors from https://download-mirror.savannah.gnu.org/releases/00_MIRRORS.html
     "https://mirror.easyname.at/nongnu/"
@@ -126,28 +246,56 @@
     "ftp://ftp.mirrorservice.org/sites/download.savannah.gnu.org/releases/"
   ];
 
-  samba = [
-    "https://www.samba.org/ftp/"
-    "http://www.samba.org/ftp/"
+  # SourceForge
+  sourceforge = [
+    "https://downloads.sourceforge.net/"
+    "https://prdownloads.sourceforge.net/"
+    "https://netcologne.dl.sourceforge.net/sourceforge/"
+    "https://versaweb.dl.sourceforge.net/sourceforge/"
+    "https://freefr.dl.sourceforge.net/sourceforge/"
+    "https://osdn.dl.sourceforge.net/sourceforge/"
+    "https://kent.dl.sourceforge.net/sourceforge/"
   ];
 
-  # BitlBee mirrors, see https://www.bitlbee.org/main.php/mirrors.html .
-  bitlbee = [
-    "https://get.bitlbee.org/"
-    "https://ftp.snt.utwente.nl/pub/software/bitlbee/"
-    "http://bitlbee.intergenia.de/"
+  # Steam Runtime
+  steamrt = [
+    "https://repo.steampowered.com/steamrt/"
+    "https://public.abbradar.moe/steamrt/"
   ];
 
-  # ImageMagick mirrors, see https://www.imagemagick.org/script/mirror.php
-  imagemagick = [
-    "https://www.imagemagick.org/download/"
-    "https://mirror.checkdomain.de/imagemagick/"
-    "https://ftp.nluug.nl/ImageMagick/"
-    "https://ftp.sunet.se/mirror/imagemagick.org/ftp/"
-    "ftp://ftp.sunet.se/mirror/imagemagick.org/ftp/" # also contains older versions removed from most mirrors
+  # TCSH shell
+  tcsh = [
+    "https://astron.com/pub/tcsh/"
+    "https://astron.com/pub/tcsh/old/"
+    "http://ftp.funet.fi/pub/mirrors/ftp.astron.com/pub/tcsh/"
+    "http://ftp.funet.fi/pub/mirrors/ftp.astron.com/pub/tcsh/old/"
+    "ftp://ftp.astron.com/pub/tcsh/"
+    "ftp://ftp.astron.com/pub/tcsh/old/"
+    "ftp://ftp.funet.fi/pub/unix/shells/tcsh/"
+    "ftp://ftp.funet.fi/pub/unix/shells/tcsh/old/"
   ];
 
-  # CPAN mirrors.
+  # XFCE
+  xfce = [
+    "https://archive.xfce.org/"
+    "https://mirror.netcologne.de/xfce/"
+    "https://archive.be.xfce.org/xfce/"
+    "https://archive.al-us.xfce.org/"
+    "http://archive.se.xfce.org/xfce/"
+    "http://mirror.perldude.de/archive.xfce.org/"
+    "http://archive.be2.xfce.org/"
+    "http://ftp.udc.es/xfce/"
+  ];
+
+  # X.org
+  xorg = [
+    "https://xorg.freedesktop.org/releases/"
+    "https://ftp.x.org/archive/"
+  ];
+
+  ### Programming languages' package repos
+
+  # Perl CPAN
   cpan = [
     "https://cpan.metacpan.org/"
     "https://cpan.perl.org/"
@@ -155,7 +303,35 @@
     "https://backpan.perl.org/"  # for old releases
   ];
 
-  # CentOS.
+  # Haskell Hackage
+  hackage = [
+    "https://hackage.haskell.org/package/"
+  ];
+
+  # Lua Rocks
+  luarocks = [
+    "https://luarocks.org/"
+    "https://raw.githubusercontent.com/rocks-moonscript-org/moonrocks-mirror/master/"
+    "https://luafr.org/moonrocks/"
+    "http://luarocks.logiceditor.com/rocks/"
+  ];
+
+  # Python PyPI
+  pypi = [
+    "https://files.pythonhosted.org/packages/source/"
+    # pypi.io is a more semantic link, but atm it’s referencing
+    # files.pythonhosted.org over two redirects
+    "https://pypi.io/packages/source/"
+  ];
+
+  # Python Test-PyPI
+  testpypi = [
+    "https://test.pypi.io/packages/source/"
+  ];
+
+  ### Linux distros
+
+  # CentOS
   centos = [
     # For old releases
     "https://vault.centos.org/"
@@ -168,7 +344,7 @@
     "http://mirror.centos.org/centos/"
   ];
 
-  # Debian.
+  # Debian
   debian = [
     "https://httpredir.debian.org/debian/"
     "https://ftp.debian.org/debian/"
@@ -181,17 +357,9 @@
     "ftp://ftp.funet.fi/pub/mirrors/ftp.debian.org/debian/"
   ];
 
-  # Ubuntu.
-  ubuntu = [
-    "https://nl.archive.ubuntu.com/ubuntu/"
-    "https://old-releases.ubuntu.com/ubuntu/"
-    "https://mirrors.edge.kernel.org/ubuntu/"
-    "http://de.archive.ubuntu.com/ubuntu/"
-    "http://archive.ubuntu.com/ubuntu/"
-  ];
-
-  # Fedora (please only add full mirrors that carry old Fedora distributions as well).
-  # See: https://mirrors.fedoraproject.org/publiclist (but not all carry old content).
+  # Fedora
+  # Please add only full mirrors that carry old Fedora distributions as well
+  # See: https://mirrors.fedoraproject.org/publiclist (but not all carry old content)
   fedora = [
     "https://archives.fedoraproject.org/pub/fedora/"
     "https://fedora.osuosl.org/"
@@ -203,7 +371,14 @@
     "http://mirror.1000mbps.com/fedora/"
   ];
 
-  # openSUSE.
+  # Gentoo
+  gentoo = [
+    "https://ftp.snt.utwente.nl/pub/os/linux/gentoo/"
+    "https://distfiles.gentoo.org/"
+    "https://mirrors.kernel.org/gentoo/"
+  ];
+
+  # openSUSE
   opensuse = [
     "https://opensuse.hro.nl/opensuse/distribution/"
     "https://ftp.funet.fi/pub/linux/mirrors/opensuse/distribution/"
@@ -213,169 +388,21 @@
     "http://ftp.hosteurope.de/mirror/ftp.opensuse.org/discontinued/"
   ];
 
-  gnome = [
-    # This one redirects to some mirror closeby, so it should be all you need.
-    "https://download.gnome.org/"
-
-    "https://fr2.rpmfind.net/linux/gnome.org/"
-    "https://ftp.acc.umu.se/pub/GNOME/"
-    "https://ftp.belnet.be/mirror/ftp.gnome.org/"
-    "ftp://ftp.cse.buffalo.edu/pub/Gnome/"
-    "ftp://ftp.nara.wide.ad.jp/pub/X11/GNOME/"
-  ];
-
-  xfce = [
-    "https://archive.xfce.org/"
-    "https://mirror.netcologne.de/xfce/"
-    "https://archive.be.xfce.org/xfce/"
-    "https://archive.al-us.xfce.org/"
-    "http://archive.se.xfce.org/xfce/"
-    "http://mirror.perldude.de/archive.xfce.org/"
-    "http://archive.be2.xfce.org/"
-    "http://ftp.udc.es/xfce/"
-  ];
-
-  # X.org.
-  xorg = [
-    "https://xorg.freedesktop.org/releases/"
-    "https://ftp.x.org/archive/"
-  ];
-
-  apache = [
-    "https://www-eu.apache.org/dist/"
-    "https://ftp.wayne.edu/apache/"
-    "https://www.apache.org/dist/"
-    "https://archive.apache.org/dist/" # fallback for old releases
-    "https://apache.cs.uu.nl/"
-    "https://apache.cs.utah.edu/"
-    "http://ftp.tudelft.nl/apache/"
-    "ftp://ftp.funet.fi/pub/mirrors/apache.org/"
-  ];
-
-  postgresql = [
-    "https://ftp.postgresql.org/pub/"
-  ];
-
-  metalab = [
-    "ftp://ftp.gwdg.de/pub/linux/metalab/"
-    "ftp://ftp.metalab.unc.edu/pub/linux/"
-  ];
-
-  # Bioconductor mirrors (from https://bioconductor.org/about/mirrors/)
-  # The commented-out ones don't seem to allow direct package downloads;
-  # they serve error messages that result in hash mismatches instead.
-  bioc = [
-    # http://bioc.ism.ac.jp/
-    # http://bioc.openanalytics.eu/
-    # http://bioconductor.fmrp.usp.br/
-    # http://mirror.aarnet.edu.au/pub/bioconductor/
-    # http://watson.nci.nih.gov/bioc_mirror/
-    "https://bioconductor.statistik.tu-dortmund.de/packages/"
-    "https://mirrors.ustc.edu.cn/bioc/"
-    "http://bioconductor.jp/packages/"
-  ];
-
-  # Hackage mirrors
-  hackage = [
-    "https://hackage.haskell.org/package/"
-  ];
-
-  # Roy marples mirrors
-  roy = [
-    "https://roy.marples.name/downloads/"
-    "https://cflags.cc/roy/"
-  ];
-
-  # Sage mirrors (https://www.sagemath.org/mirrors.html)
-  sageupstream = [
-    # Africa (HTTPS)
-    "https://sagemath.mirror.ac.za/spkg/upstream/"
-    "https://mirror.ufs.ac.za/sagemath/spkg/upstream/"
-
-    # America, North (HTTPS)
-    "https://mirrors.mit.edu/sage/spkg/upstream/"
-    "https://mirrors.xmission.com/sage/spkg/upstream/"
-
-    # Asia (HTTPS)
-    "https://mirrors.tuna.tsinghua.edu.cn/sagemath/spkg/upstream/"
-    "https://mirrors.ustc.edu.cn/sagemath/spkg/upstream/"
-    "http://ftp.tsukuba.wide.ad.jp/software/sage/spkg/upstream/"
-    "https://ftp.yz.yamagata-u.ac.jp/pub/math/sage/spkg/upstream/"
-    "https://mirror.yandex.ru/mirrors/sage.math.washington.edu/spkg/upstream/"
-
-    # Australia (HTTPS)
-    "https://mirror.aarnet.edu.au/pub/sage/spkg/upstream/"
-
-    # Europe (HTTPS)
-    "https://sage.mirror.garr.it/mirrors/sage/spkg/upstream/"
-    "https://www-ftp.lip6.fr/pub/math/sagemath/spkg/upstream/"
-
-    # Africa (non-HTTPS)
-    "ftp://ftp.sun.ac.za/pub/mirrors/www.sagemath.org/spkg/upstream/"
-
-    # America, North (non-HTTPS)
-    "http://www.cecm.sfu.ca/sage/spkg/upstream/"
-
-    # America, South (non-HTTPS)
-    "http://sagemath.c3sl.ufpr.br/spkg/upstream/"
-    "http://linorg.usp.br/sage/spkg/upstream"
-
-    # Asia (non-HTTPS)
-    "http://ftp.kaist.ac.kr/sage/spkg/upstream/"
-    "http://ftp.riken.jp/sagemath/spkg/upstream/"
-
-    # Europe (non-HTTPS)
-    "http://mirrors.fe.up.pt/pub/sage/spkg/upstream/"
-    "http://ftp.ntua.gr/pub/sagemath/spkg/upstream/"
+  # Ubuntu
+  ubuntu = [
+    "https://nl.archive.ubuntu.com/ubuntu/"
+    "https://old-releases.ubuntu.com/ubuntu/"
+    "https://mirrors.edge.kernel.org/ubuntu/"
+    "http://de.archive.ubuntu.com/ubuntu/"
+    "http://archive.ubuntu.com/ubuntu/"
   ];
 
-  # MySQL mirrors
-  mysql = [
-    "https://cdn.mysql.com/Downloads/"
-  ];
+  # ... and other OSes in general
 
-  # OpenBSD mirrors
+  # OpenBSD
   openbsd = [
     "https://ftp.openbsd.org/pub/OpenBSD/"
     "ftp://ftp.nluug.nl/pub/OpenBSD/"
     "ftp://ftp-stud.fht-esslingen.de/pub/OpenBSD/"
   ];
-
-  # Steam Runtime mirrors
-  steamrt = [
-    "https://repo.steampowered.com/steamrt/"
-    "https://public.abbradar.moe/steamrt/"
-  ];
-
-  # Python PyPI mirrors
-  pypi = [
-    "https://files.pythonhosted.org/packages/source/"
-    # pypi.io is a more semantic link, but atm it’s referencing
-    # files.pythonhosted.org over two redirects
-    "https://pypi.io/packages/source/"
-  ];
-
-  # Python Test-PyPI mirror
-  testpypi = [
-    "https://test.pypi.io/packages/source/"
-  ];
-
-  # Mozilla projects.
-  mozilla = [
-    "https://download.cdn.mozilla.net/pub/mozilla.org/"
-    "https://archive.mozilla.org/pub/"
-  ];
-
-  # Maven Central
-  maven = [
-    "https://repo1.maven.org/maven2/"
-  ];
-
-  # Alsa Project
-  alsa = [
-    "https://www.alsa-project.org/files/pub/"
-    "ftp://ftp.alsa-project.org/pub/"
-    "http://alsa.cybermirror.org/"
-    "http://www.mirrorservice.org/sites/ftp.alsa-project.org/pub/"
-  ];
 }
diff --git a/pkgs/build-support/ocaml/dune.nix b/pkgs/build-support/ocaml/dune.nix
index 6bdec501630..18e8784cfab 100644
--- a/pkgs/build-support/ocaml/dune.nix
+++ b/pkgs/build-support/ocaml/dune.nix
@@ -2,7 +2,7 @@
 
 { pname, version, nativeBuildInputs ? [], enableParallelBuilding ? true, ... }@args:
 
-let Dune = if args.useDune2 or false then dune_2 else dune_1; in
+let Dune = if args.useDune2 or true then dune_2 else dune_1; in
 
 if (args ? minimumOCamlVersion && ! lib.versionAtLeast ocaml.version args.minimumOCamlVersion) ||
    (args ? minimalOCamlVersion && ! lib.versionAtLeast ocaml.version args.minimalOCamlVersion)
diff --git a/pkgs/development/compilers/llvm/14/default.nix b/pkgs/development/compilers/llvm/14/default.nix
index 5a91fb17fe6..ce126f7b502 100644
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ b/pkgs/development/compilers/llvm/14/default.nix
@@ -19,7 +19,7 @@
 
 let
   release_version = "14.0.0";
-  candidate = "rc2"; # empty or "rcN"
+  candidate = "rc4"; # empty or "rcN"
   dash-candidate = lib.optionalString (candidate != "") "-${candidate}";
   rev = ""; # When using a Git commit
   rev-version = ""; # When using a Git commit
@@ -30,7 +30,7 @@ let
     owner = "llvm";
     repo = "llvm-project";
     rev = if rev != "" then rev else "llvmorg-${version}";
-    sha256 = "sha256-5wJEaWvwJohtjqlIsBkqQ5rE6rcWw07MaQnN1RxPb5w=";
+    sha256 = "0xm3hscg6xv48rjdi7sg9ky960af1qyg5k3jyavnaqimlaj9wxgp";
   };
 
   llvm_meta = {
diff --git a/pkgs/development/compilers/llvm/14/llvm/default.nix b/pkgs/development/compilers/llvm/14/llvm/default.nix
index d2059cc66ba..05aac728b45 100644
--- a/pkgs/development/compilers/llvm/14/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/14/llvm/default.nix
@@ -209,6 +209,9 @@ in stdenv.mkDerivation (rec {
 
   checkTarget = "check-all";
 
+  # For the update script:
+  passthru.monorepoSrc = monorepoSrc;
+
   requiredSystemFeatures = [ "big-parallel" ];
   meta = llvm_meta // {
     homepage = "https://llvm.org/";
diff --git a/pkgs/development/compilers/llvm/update.sh b/pkgs/development/compilers/llvm/update.sh
index 603c603f275..95ad356dbd9 100755
--- a/pkgs/development/compilers/llvm/update.sh
+++ b/pkgs/development/compilers/llvm/update.sh
@@ -20,7 +20,11 @@ sed -Ei \
 
 readonly ATTRSET="llvmPackages_$VERSION_MAJOR"
 
-if [ "$VERSION_MAJOR" -ge "13" ]; then
+if [ "$VERSION_MAJOR" -ge "14" ]; then
+  readonly SOURCES=(
+    "llvm.monorepoSrc"
+  )
+elif [ "$VERSION_MAJOR" -eq "13" ]; then
   readonly SOURCES=(
     "llvm.src"
   )
@@ -43,7 +47,7 @@ fi
 for SOURCE in "${SOURCES[@]}"; do
   echo "Updating the hash of $SOURCE:"
   declare ATTR="$ATTRSET.$SOURCE"
-  declare OLD_HASH="$(nix eval -f . $ATTR.outputHash)"
+  declare OLD_HASH="$(nix --extra-experimental-features nix-command eval -f . $ATTR.outputHash)"
   declare NEW_HASH="\"$(nix-prefetch-url -A $ATTR)\""
   find "$DIR" -type f -exec sed -i "s/$OLD_HASH/$NEW_HASH/" {} +
 done
diff --git a/pkgs/development/compilers/ocaml/4.14.nix b/pkgs/development/compilers/ocaml/4.14.nix
new file mode 100644
index 00000000000..96e1c13d285
--- /dev/null
+++ b/pkgs/development/compilers/ocaml/4.14.nix
@@ -0,0 +1,9 @@
+import ./generic.nix {
+  major_version = "4";
+  minor_version = "14";
+  patch_version = "0-beta1";
+  src = fetchTarball {
+    url = "https://caml.inria.fr/pub/distrib/ocaml-4.14/ocaml-4.14.0~beta1.tar.xz";
+    sha256 = "0jiz20hb58jbbk8j38agx11ra4hg0v3prmzc5a9j70lm09mnzfcd";
+  };
+}
diff --git a/pkgs/development/libraries/vte/default.nix b/pkgs/development/libraries/vte/default.nix
index 0411086c78c..eae934a4ebb 100644
--- a/pkgs/development/libraries/vte/default.nix
+++ b/pkgs/development/libraries/vte/default.nix
@@ -21,6 +21,7 @@
 , zlib
 , icu
 , systemd
+, systemdSupport ? stdenv.hostPlatform.isLinux
 }:
 
 stdenv.mkDerivation rec {
@@ -63,6 +64,7 @@ stdenv.mkDerivation rec {
     pcre2
     zlib
     icu
+  ] ++ lib.optionals systemdSupport [
     systemd
   ];
 
@@ -73,6 +75,10 @@ stdenv.mkDerivation rec {
     pango
   ];
 
+  mesonFlags = lib.optionals (!systemdSupport) [
+    "-D_systemd=false"
+  ];
+
   postPatch = ''
     patchShebangs perf/*
     patchShebangs src/box_drawing_generate.sh
diff --git a/pkgs/development/ocaml-modules/facile/default.nix b/pkgs/development/ocaml-modules/facile/default.nix
index 8834de53a8f..df228603e9f 100644
--- a/pkgs/development/ocaml-modules/facile/default.nix
+++ b/pkgs/development/ocaml-modules/facile/default.nix
@@ -4,6 +4,8 @@ buildDunePackage rec {
   pname = "facile";
   version = "1.1.4";
 
+  useDune2 = false;
+
   src = fetchurl {
     url = "https://github.com/Emmanuel-PLF/facile/releases/download/${version}/facile-${version}.tbz";
     sha256 = "0jqrwmn6fr2vj2rrbllwxq4cmxykv7zh0y4vnngx29f5084a04jp";
diff --git a/pkgs/development/ocaml-modules/genspio/default.nix b/pkgs/development/ocaml-modules/genspio/default.nix
index db3c42bca36..963cd1dab13 100644
--- a/pkgs/development/ocaml-modules/genspio/default.nix
+++ b/pkgs/development/ocaml-modules/genspio/default.nix
@@ -6,6 +6,8 @@ buildDunePackage rec {
   pname = "genspio";
   version = "0.0.2";
 
+  useDune2 = false;
+
   src = fetchFromGitHub {
     owner = "hammerlab";
     repo = pname;
@@ -13,7 +15,7 @@ buildDunePackage rec {
     sha256 = "0cp6p1f713sfv4p2r03bzvjvakzn4ili7hf3a952b3w1k39hv37x";
   };
 
-  minimumOCamlVersion = "4.03";
+  minimalOCamlVersion = "4.03";
 
   propagatedBuildInputs = [ nonstd sosa ];
 
diff --git a/pkgs/development/ocaml-modules/janestreet/janePackage.nix b/pkgs/development/ocaml-modules/janestreet/janePackage.nix
index 63c4a900fce..da268757601 100644
--- a/pkgs/development/ocaml-modules/janestreet/janePackage.nix
+++ b/pkgs/development/ocaml-modules/janestreet/janePackage.nix
@@ -5,7 +5,9 @@
 buildDunePackage (args // {
   inherit version buildInputs;
 
-  minimumOCamlVersion = "4.04";
+  useDune2 = false;
+
+  minimalOCamlVersion = "4.04";
 
   src = fetchFromGitHub {
     owner = "janestreet";
diff --git a/pkgs/development/ocaml-modules/janestreet/janePackage_0_12.nix b/pkgs/development/ocaml-modules/janestreet/janePackage_0_12.nix
index 3d280a509ac..5b918683570 100644
--- a/pkgs/development/ocaml-modules/janestreet/janePackage_0_12.nix
+++ b/pkgs/development/ocaml-modules/janestreet/janePackage_0_12.nix
@@ -5,6 +5,8 @@
 buildDunePackage (args // {
   inherit version;
 
+  useDune2 = false;
+
   minimalOCamlVersion = "4.07";
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/ocaml-modules/lwt/camlp4.nix b/pkgs/development/ocaml-modules/lwt/camlp4.nix
index 88bb3d6759a..e48d7cfa185 100644
--- a/pkgs/development/ocaml-modules/lwt/camlp4.nix
+++ b/pkgs/development/ocaml-modules/lwt/camlp4.nix
@@ -11,7 +11,9 @@ buildDunePackage rec {
     sha256 = "1lv8z6ljfy47yvxmwf5jrvc5d3dc90r1n291x53j161sf22ddrk9";
   };
 
-  minimumOCamlVersion = "4.02";
+  useDune2 = false;
+
+  minimalOCamlVersion = "4.02";
 
   propagatedBuildInputs = [ camlp4 ];
 
diff --git a/pkgs/development/ocaml-modules/nonstd/default.nix b/pkgs/development/ocaml-modules/nonstd/default.nix
index 9de535154ee..82b1feed540 100644
--- a/pkgs/development/ocaml-modules/nonstd/default.nix
+++ b/pkgs/development/ocaml-modules/nonstd/default.nix
@@ -4,7 +4,9 @@ buildDunePackage rec {
   pname = "nonstd";
   version = "0.0.3";
 
-  minimumOCamlVersion = "4.02";
+  useDune2 = false;
+
+  minimalOCamlVersion = "4.02";
 
   src = fetchzip {
     url = "https://bitbucket.org/smondet/${pname}/get/${pname}.${version}.tar.gz";
diff --git a/pkgs/development/ocaml-modules/ocamlfuse/default.nix b/pkgs/development/ocaml-modules/ocamlfuse/default.nix
index 4dcaca42788..13ac62f6451 100644
--- a/pkgs/development/ocaml-modules/ocamlfuse/default.nix
+++ b/pkgs/development/ocaml-modules/ocamlfuse/default.nix
@@ -1,14 +1,14 @@
 { lib, buildDunePackage, fetchFromGitHub, camlidl, fuse, dune-configurator }:
 
-buildDunePackage {
+buildDunePackage rec {
   pname = "ocamlfuse";
-  version = "2.7.1_cvs6_e35e76b";
+  version = "2.7.1_cvs7";
 
   src = fetchFromGitHub {
     owner = "astrada";
     repo = "ocamlfuse";
-    rev = "e35e76bee3b06806256b5bfca108b7697267cd5c";
-    sha256 = "1v9g0wh7rnjkrjrnw50145g6ry38plyjs8fq8w0nlzwizhf3qhff";
+    rev = "v${version}";
+    sha256 = "6nmPXZx38hBGlg+gV9nnlRpPfeSAqDj4zBPcjUNvTRo=";
   };
 
   # This currently fails with dune
diff --git a/pkgs/development/ocaml-modules/owee/default.nix b/pkgs/development/ocaml-modules/owee/default.nix
index 9eb81003d47..7b15437a7ed 100644
--- a/pkgs/development/ocaml-modules/owee/default.nix
+++ b/pkgs/development/ocaml-modules/owee/default.nix
@@ -1,20 +1,19 @@
-{ lib, buildDunePackage, fetchFromGitHub }:
+{ lib, buildDunePackage, fetchurl }:
 
 buildDunePackage rec {
-  minimumOCamlVersion = "4.06";
+  minimalOCamlVersion = "4.06";
+  useDune2 = true;
   pname = "owee";
-  version = "0.3";
+  version = "0.4";
 
-  src = fetchFromGitHub {
-    owner = "let-def";
-    repo = "owee";
-    rev = "v${version}";
-    sha256 = "0jp8ca57488d7sj2nqy4yxcdpda6sxx51yyi8k6888hbinhyqp0j";
+  src = fetchurl {
+    url = "https://github.com/let-def/owee/releases/download/v${version}/owee-${version}.tbz";
+    sha256 = "sha256:055bi0yfdki1pqagbhrwmfvigyawjgsmqw04zhpp6hds8513qzvb";
   };
 
   meta = {
     description = "An experimental OCaml library to work with DWARF format";
-    inherit (src.meta) homepage;
+    homepage = "https://github.com/let-def/owee/";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.vbgl ];
   };
diff --git a/pkgs/development/ocaml-modules/spacetime_lib/default.nix b/pkgs/development/ocaml-modules/spacetime_lib/default.nix
index 009b2ce3261..442d06e4f69 100644
--- a/pkgs/development/ocaml-modules/spacetime_lib/default.nix
+++ b/pkgs/development/ocaml-modules/spacetime_lib/default.nix
@@ -1,4 +1,7 @@
-{ lib, fetchFromGitHub, buildDunePackage, owee }:
+{ lib, fetchFromGitHub, buildDunePackage, ocaml, owee }:
+
+lib.throwIfNot (lib.versionAtLeast "4.12" ocaml.version)
+  "spacetime_lib is not available for OCaml ${ocaml.version}"
 
 buildDunePackage rec {
   pname = "spacetime_lib";
diff --git a/pkgs/development/php-packages/box/default.nix b/pkgs/development/php-packages/box/default.nix
index b19b275019d..bc0f4ac636c 100644
--- a/pkgs/development/php-packages/box/default.nix
+++ b/pkgs/development/php-packages/box/default.nix
@@ -16,10 +16,12 @@ mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D $src $out/libexec/box/box.phar
     makeWrapper ${php}/bin/php $out/bin/box \
       --add-flags "-d phar.readonly=0 $out/libexec/box/box.phar"
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/php-packages/deployer/default.nix b/pkgs/development/php-packages/deployer/default.nix
index 7679fb5ea51..661a6310958 100644
--- a/pkgs/development/php-packages/deployer/default.nix
+++ b/pkgs/development/php-packages/deployer/default.nix
@@ -14,6 +14,7 @@ mkDerivation rec {
   nativeBuildInputs = [ makeWrapper installShellFiles ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D $src $out/libexec/deployer/deployer.phar
     makeWrapper ${php}/bin/php $out/bin/dep --add-flags "$out/libexec/deployer/deployer.phar"
@@ -22,6 +23,7 @@ mkDerivation rec {
     installShellCompletion --cmd dep \
       --bash <($out/bin/dep autocomplete --install) \
       --zsh <($out/bin/dep autocomplete --install)
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/php-packages/phing/default.nix b/pkgs/development/php-packages/phing/default.nix
index a8835241d09..6c5af7d5d27 100644
--- a/pkgs/development/php-packages/phing/default.nix
+++ b/pkgs/development/php-packages/phing/default.nix
@@ -16,10 +16,12 @@ mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D $src $out/libexec/phing/phing.phar
     makeWrapper ${php}/bin/php $out/bin/phing \
       --add-flags "$out/libexec/phing/phing.phar"
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/php-packages/phive/default.nix b/pkgs/development/php-packages/phive/default.nix
new file mode 100644
index 00000000000..f564cb53692
--- /dev/null
+++ b/pkgs/development/php-packages/phive/default.nix
@@ -0,0 +1,31 @@
+{ mkDerivation, fetchurl, makeWrapper, lib, php }:
+
+mkDerivation rec {
+  pname = "phive";
+  version = "0.15.0";
+
+  src = fetchurl {
+    url = "https://github.com/phar-io/phive/releases/download/${version}/phive-${version}.phar";
+    sha256 = "sha256-crMr8d5nsVt7+zQ5xPeph/JXmTEn6jJFVtp3mOgylB4=";
+  };
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    install -D $src $out/libexec/phive/phive.phar
+    makeWrapper ${php}/bin/php $out/bin/phive \
+      --add-flags "$out/libexec/phive/phive.phar"
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "The Phar Installation and Verification Environment (PHIVE)";
+    homepage = "https://github.com/phar-io/phive";
+    license = licenses.bsd3;
+    maintainers = with maintainers; teams.php.members;
+  };
+}
diff --git a/pkgs/development/php-packages/php-cs-fixer/default.nix b/pkgs/development/php-packages/php-cs-fixer/default.nix
index 292d0b2ca08..90bd1af0078 100644
--- a/pkgs/development/php-packages/php-cs-fixer/default.nix
+++ b/pkgs/development/php-packages/php-cs-fixer/default.nix
@@ -16,10 +16,12 @@ mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D $src $out/libexec/php-cs-fixer/php-cs-fixer.phar
     makeWrapper ${php}/bin/php $out/bin/php-cs-fixer \
       --add-flags "$out/libexec/php-cs-fixer/php-cs-fixer.phar"
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/php-packages/php-parallel-lint/default.nix b/pkgs/development/php-packages/php-parallel-lint/default.nix
index 50fd23540ee..d0335142490 100644
--- a/pkgs/development/php-packages/php-parallel-lint/default.nix
+++ b/pkgs/development/php-packages/php-parallel-lint/default.nix
@@ -20,15 +20,19 @@ mkDerivation {
   ];
 
   buildPhase = ''
+    runHook preBuild
     composer dump-autoload
     box build
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D parallel-lint.phar $out/libexec/php-parallel-lint/php-parallel-lint.phar
     makeWrapper ${php}/bin/php $out/bin/php-parallel-lint \
       --add-flags "$out/libexec/php-parallel-lint/php-parallel-lint.phar"
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/php-packages/phpcbf/default.nix b/pkgs/development/php-packages/phpcbf/default.nix
index cef7c2986e8..1cc6f46bd09 100644
--- a/pkgs/development/php-packages/phpcbf/default.nix
+++ b/pkgs/development/php-packages/phpcbf/default.nix
@@ -16,10 +16,12 @@ mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D $src $out/libexec/phpcbf/phpcbf.phar
     makeWrapper ${php}/bin/php $out/bin/phpcbf \
       --add-flags "$out/libexec/phpcbf/phpcbf.phar"
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/php-packages/phpcs/default.nix b/pkgs/development/php-packages/phpcs/default.nix
index baad111cec5..877f587717d 100644
--- a/pkgs/development/php-packages/phpcs/default.nix
+++ b/pkgs/development/php-packages/phpcs/default.nix
@@ -16,10 +16,12 @@ mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D $src $out/libexec/phpcs/phpcs.phar
     makeWrapper ${php}/bin/php $out/bin/phpcs \
       --add-flags "$out/libexec/phpcs/phpcs.phar"
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/php-packages/phpmd/default.nix b/pkgs/development/php-packages/phpmd/default.nix
index 763fd857c35..228fd25ea55 100644
--- a/pkgs/development/php-packages/phpmd/default.nix
+++ b/pkgs/development/php-packages/phpmd/default.nix
@@ -16,10 +16,12 @@ mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D $src $out/libexec/phpmd/phpmd.phar
     makeWrapper ${php}/bin/php $out/bin/phpmd \
       --add-flags "$out/libexec/phpmd/phpmd.phar"
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/php-packages/phpstan/default.nix b/pkgs/development/php-packages/phpstan/default.nix
index 41840f5ba9e..bced843d955 100644
--- a/pkgs/development/php-packages/phpstan/default.nix
+++ b/pkgs/development/php-packages/phpstan/default.nix
@@ -16,10 +16,12 @@ mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D $src $out/libexec/phpstan/phpstan.phar
     makeWrapper ${php}/bin/php $out/bin/phpstan \
       --add-flags "$out/libexec/phpstan/phpstan.phar"
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/php-packages/psalm/default.nix b/pkgs/development/php-packages/psalm/default.nix
index a772ae441a5..01f79c36397 100644
--- a/pkgs/development/php-packages/psalm/default.nix
+++ b/pkgs/development/php-packages/psalm/default.nix
@@ -16,10 +16,12 @@ mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D $src $out/libexec/psalm/psalm.phar
     makeWrapper ${php}/bin/php $out/bin/psalm \
       --add-flags "$out/libexec/psalm/psalm.phar"
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/php-packages/psysh/default.nix b/pkgs/development/php-packages/psysh/default.nix
index 5b7c02eefd8..f1105dea911 100644
--- a/pkgs/development/php-packages/psysh/default.nix
+++ b/pkgs/development/php-packages/psysh/default.nix
@@ -16,10 +16,12 @@ mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     tar -xzf $src -C $out/bin
     chmod +x $out/bin/psysh
     wrapProgram $out/bin/psysh --prefix PATH : "${lib.makeBinPath [ php ]}"
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/aio-geojson-client/default.nix b/pkgs/development/python-modules/aio-geojson-client/default.nix
index f00a75961b9..b0629483d01 100644
--- a/pkgs/development/python-modules/aio-geojson-client/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-client/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aio-geojson-client";
-  version = "0.16";
+  version = "0.17";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "exxamalte";
     repo = "python-aio-geojson-client";
     rev = "v${version}";
-    hash = "sha256-u3SwrSxeBJrBTHfqKY/mAb2p1jqW2AvRsHomKsI81gM=";
+    hash = "sha256-5GiQgtbvYeleovFbXO2vlr2XPsDIWZiElM64O+urMcY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pudb/default.nix b/pkgs/development/python-modules/pudb/default.nix
index 0ae60b381c6..406d81e15bb 100644
--- a/pkgs/development/python-modules/pudb/default.nix
+++ b/pkgs/development/python-modules/pudb/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , dataclasses
-, isPy3k
 , fetchPypi
 , jedi
 , pygments
@@ -14,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pudb";
-  version = "2022.1";
+  version = "2022.1.1";
   format = "setuptools";
 
-  disabled = !isPy3k;
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e827a4b489dcad561189535db6677becbf32164b2b44df00786eb2d5e00c587e";
+    hash = "sha256-2zvdZkI8nSkHTBwsSfyyJL0Nbwgxn+0bTn6taDkUCD8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/types-requests/default.nix b/pkgs/development/python-modules/types-requests/default.nix
index 165c65f3a9e..c62190ff5da 100644
--- a/pkgs/development/python-modules/types-requests/default.nix
+++ b/pkgs/development/python-modules/types-requests/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-requests";
-  version = "2.27.11";
+  version = "2.27.12";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-an7SSyF4CvSlteJMMQss2IX7YS31/ZVYTQPYfl8qGVo=";
+    sha256 = "sha256-/ROC+i4o6shI+u2wMyhAIE8G8MtRcAjjx7goLKU+VtI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/types-urllib3/default.nix b/pkgs/development/python-modules/types-urllib3/default.nix
index 7bffc7826a3..235535ce971 100644
--- a/pkgs/development/python-modules/types-urllib3/default.nix
+++ b/pkgs/development/python-modules/types-urllib3/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-urllib3";
-  version = "1.26.10";
+  version = "1.26.11";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-omiY9TDmw/Q/JbkH8riESGho/9Vqn6qUy/mz624WXWo=";
+    hash = "sha256-JNZORBFohR6wXx0CLeGK4xVY9WScjxEX44TC6F4xMVs=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/python-modules/unidiff/default.nix b/pkgs/development/python-modules/unidiff/default.nix
index 7dfd5c9d276..4c776070ae6 100644
--- a/pkgs/development/python-modules/unidiff/default.nix
+++ b/pkgs/development/python-modules/unidiff/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "unidiff";
-  version = "0.7.0";
+  version = "0.7.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "91bb13b4969514a400679d9ae5e29a6ffad85346087677f8b5e2e036af817447";
+    sha256 = "sha256-1fLlOpoA2zIkqMNjSbU4Dg4i0a7GxpSxT7lIPuk8YgU=";
   };
 
   pythonImportsCheck = [ "unidiff" ];
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/camlp4.nix b/pkgs/development/tools/ocaml/js_of_ocaml/camlp4.nix
index a08aaac832e..39f6d5f7aa2 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/camlp4.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/camlp4.nix
@@ -6,6 +6,8 @@ buildDunePackage rec {
   version = "3.2.1";
   pname = "js_of_ocaml-camlp4";
 
+  useDune2 = false;
+
   src = fetchFromGitHub {
     owner = "ocsigen";
     repo = "js_of_ocaml";
diff --git a/pkgs/development/tools/profiling/systemtap/default.nix b/pkgs/development/tools/profiling/systemtap/default.nix
index 31eafb1086b..ac00e341878 100644
--- a/pkgs/development/tools/profiling/systemtap/default.nix
+++ b/pkgs/development/tools/profiling/systemtap/default.nix
@@ -16,8 +16,8 @@ let
     pname = "systemtap";
     inherit version;
     src = fetchgit { inherit url rev sha256; };
-    nativeBuildInputs = [ pkg-config cpio ];
-    buildInputs = [ elfutils gettext python3 python3.pkgs.setuptools ];
+    nativeBuildInputs = [ pkg-config cpio python3 python3.pkgs.setuptools ];
+    buildInputs = [ elfutils gettext ];
     enableParallelBuilding = true;
   };
 
diff --git a/pkgs/games/freedroidrpg/default.nix b/pkgs/games/freedroidrpg/default.nix
index e0582c524ec..84fd9c154a2 100644
--- a/pkgs/games/freedroidrpg/default.nix
+++ b/pkgs/games/freedroidrpg/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, pkg-config, gettext, python3, SDL, SDL_image, SDL_gfx, SDL_mixer, libogg, libvorbis, lua5_3, libjpeg, libpng, zlib, libiconv }:
+{ fetchurl, fetchpatch, lib, stdenv, pkg-config, gettext, python3, SDL, SDL_image, SDL_gfx, SDL_mixer, libogg, libvorbis, lua5_3, libjpeg, libpng, zlib, libiconv }:
 
 let
   version = "0.16.1";
@@ -11,6 +11,15 @@ in stdenv.mkDerivation {
     sha256 = "0n4kn38ncmcy3lrxmq8fjry6c1z50z4q1zcqfig0j4jb0dsz2va2";
   };
 
+  patches = [
+    # Pull upstream fix for -fno-common tolchains.
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://gitlab.com/freedroid/freedroid-src/-/commit/e610d427374226b79da5258d979936459f30c761.patch";
+      sha256 = "1s7sw4dkc7b6i72j6x47driq6v0k3wss48l9ivd4fw40n3iaxjb1";
+    })
+  ];
+
   nativeBuildInputs = [ pkg-config gettext python3 ];
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/akvcam/default.nix b/pkgs/os-specific/linux/akvcam/default.nix
index 700389a4a18..0724118431c 100644
--- a/pkgs/os-specific/linux/akvcam/default.nix
+++ b/pkgs/os-specific/linux/akvcam/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
   };
   sourceRoot = "source/src";
 
-  makeFlags = [
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags ++ [
     "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
 
diff --git a/pkgs/os-specific/linux/apfs/default.nix b/pkgs/os-specific/linux/apfs/default.nix
index 62437d662b9..98fd83ed5d5 100644
--- a/pkgs/os-specific/linux/apfs/default.nix
+++ b/pkgs/os-specific/linux/apfs/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
   hardeningDisable = [ "pic" ];
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KERNELRELEASE=${kernel.modDirVersion}"
     "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "INSTALL_MOD_PATH=$(out)"
diff --git a/pkgs/os-specific/linux/batman-adv/default.nix b/pkgs/os-specific/linux/batman-adv/default.nix
index 354f4b1bff2..123c42e8397 100644
--- a/pkgs/os-specific/linux/batman-adv/default.nix
+++ b/pkgs/os-specific/linux/batman-adv/default.nix
@@ -12,11 +12,13 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags ++ [
+    "KERNELPATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
 
   hardeningDisable = [ "pic" ];
 
   preBuild = ''
-    makeFlags="KERNELPATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     sed -i -e "s,INSTALL_MOD_DIR=,INSTALL_MOD_PATH=$out INSTALL_MOD_DIR=," \
       -e /depmod/d Makefile
   '';
diff --git a/pkgs/os-specific/linux/can-isotp/default.nix b/pkgs/os-specific/linux/can-isotp/default.nix
index 9c30aae86fe..73edb3be9ec 100644
--- a/pkgs/os-specific/linux/can-isotp/default.nix
+++ b/pkgs/os-specific/linux/can-isotp/default.nix
@@ -13,16 +13,13 @@ stdenv.mkDerivation {
     sha256 = "1laax93czalclg7cy9iq1r7hfh9jigh7igj06y9lski75ap2vhfq";
   };
 
-  KERNELDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
-  INSTALL_MOD_PATH = "\${out}";
+  makeFlags = kernel.makeFlags ++ [
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
 
-  buildPhase = ''
-    make modules
-  '';
-
-  installPhase = ''
-    make modules_install
-  '';
+  buildFlags = [ "modules" ];
+  installTargets = [ "modules_install" ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
diff --git a/pkgs/os-specific/linux/cryptodev/default.nix b/pkgs/os-specific/linux/cryptodev/default.nix
index f09679ba212..cc3a1d81109 100644
--- a/pkgs/os-specific/linux/cryptodev/default.nix
+++ b/pkgs/os-specific/linux/cryptodev/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-vJQ10rG5FGbeEOqCUmH/pZ0P77kAW/MtUarywbtIyHw=";
   };
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
   hardeningDisable = [ "pic" ];
 
   KERNEL_DIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
diff --git a/pkgs/os-specific/linux/digimend/default.nix b/pkgs/os-specific/linux/digimend/default.nix
index 6b5f66f825b..e26509d3a7c 100644
--- a/pkgs/os-specific/linux/digimend/default.nix
+++ b/pkgs/os-specific/linux/digimend/default.nix
@@ -13,8 +13,6 @@ stdenv.mkDerivation rec {
     sha256 = "1l54j85540386a8aypqka7p5hy1b63cwmpsscv9rmmf10f78v8mm";
   };
 
-  INSTALL_MOD_PATH = "\${out}";
-
   postPatch = ''
     sed 's/udevadm /true /' -i Makefile
     sed 's/depmod /true /' -i Makefile
@@ -38,10 +36,11 @@ stdenv.mkDerivation rec {
     rm -r $out/lib/udev
   '';
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KVERSION=${kernel.modDirVersion}"
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "DESTDIR=${placeholder "out"}"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
   ];
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/dpdk-kmods/default.nix b/pkgs/os-specific/linux/dpdk-kmods/default.nix
index a188336cbe5..694e508dcd0 100644
--- a/pkgs/os-specific/linux/dpdk-kmods/default.nix
+++ b/pkgs/os-specific/linux/dpdk-kmods/default.nix
@@ -11,6 +11,9 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
+  makeFlags = kernel.makeFlags ++ [
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
   KSRC = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -18,10 +21,9 @@ stdenv.mkDerivation rec {
   preBuild = "cd linux/igb_uio";
 
   installPhase = ''
-    make -C ${KSRC} M=$(pwd) modules_install
+    make -C ${KSRC} M=$(pwd) modules_install $makeFlags
   '';
 
-  INSTALL_MOD_PATH = placeholder "out";
   enableParallelBuilding = true;
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/ena/default.nix b/pkgs/os-specific/linux/ena/default.nix
index 1257217a520..5873a2fe2c1 100644
--- a/pkgs/os-specific/linux/ena/default.nix
+++ b/pkgs/os-specific/linux/ena/default.nix
@@ -14,6 +14,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "pic" ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags;
 
   # linux 3.12
   NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
@@ -27,7 +28,7 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     runHook preInstall
-    strip -S ena.ko
+    $STRIP -S ena.ko
     dest=$out/lib/modules/${kernel.modDirVersion}/misc
     mkdir -p $dest
     cp ena.ko $dest/
diff --git a/pkgs/os-specific/linux/evdi/default.nix b/pkgs/os-specific/linux/evdi/default.nix
index e40448be435..721a49ed4a5 100644
--- a/pkgs/os-specific/linux/evdi/default.nix
+++ b/pkgs/os-specific/linux/evdi/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ kernel libdrm ];
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KVER=${kernel.modDirVersion}"
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
diff --git a/pkgs/os-specific/linux/fwts/module.nix b/pkgs/os-specific/linux/fwts/module.nix
index 737d3316e21..72f25aa800e 100644
--- a/pkgs/os-specific/linux/fwts/module.nix
+++ b/pkgs/os-specific/linux/fwts/module.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "INSTALL_MOD_PATH=${placeholder "out"}"
   ];
 
diff --git a/pkgs/os-specific/linux/gcadapter-oc-kmod/default.nix b/pkgs/os-specific/linux/gcadapter-oc-kmod/default.nix
index ab2e099d970..bcea220cc96 100644
--- a/pkgs/os-specific/linux/gcadapter-oc-kmod/default.nix
+++ b/pkgs/os-specific/linux/gcadapter-oc-kmod/default.nix
@@ -19,7 +19,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KERNEL_SOURCE_DIR=${kernel.dev}/${kerneldir}/build"
     "INSTALL_MOD_PATH=$(out)"
   ];
diff --git a/pkgs/os-specific/linux/hid-nintendo/default.nix b/pkgs/os-specific/linux/hid-nintendo/default.nix
index e9ee88252ea..7d01120b2f3 100644
--- a/pkgs/os-specific/linux/hid-nintendo/default.nix
+++ b/pkgs/os-specific/linux/hid-nintendo/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "-C"
     "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "M=$(sourceRoot)"
diff --git a/pkgs/os-specific/linux/jool/default.nix b/pkgs/os-specific/linux/jool/default.nix
index 2fd10778e2c..9246ca679a6 100644
--- a/pkgs/os-specific/linux/jool/default.nix
+++ b/pkgs/os-specific/linux/jool/default.nix
@@ -16,13 +16,12 @@ stdenv.mkDerivation {
     sed -e 's@/lib/modules/\$(.*)@${kernel.dev}/lib/modules/${kernel.modDirVersion}@' -i src/mod/*/Makefile
   '';
 
-  buildPhase = ''
-    make -C src/mod
-  '';
+  makeFlags = kernel.makeFlags ++ [
+    "-C src/mod"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
 
-  installPhase = ''
-    make -C src/mod modules_install INSTALL_MOD_PATH=$out
-  '';
+  installTargets = "modules_install";
 
   meta = with lib; {
     homepage = "https://www.jool.mx/";
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 4f12337c893..1ac9cbe00ea 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -56,7 +56,7 @@ let
     hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
 
   # Dependencies that are required to build kernel modules
-  moduleBuildDependencies = optional (lib.versionAtLeast version "4.14") libelf;
+  moduleBuildDependencies = [ perl ] ++ optional (lib.versionAtLeast version "4.14") libelf;
 
 
   installkernel = writeTextFile { name = "installkernel"; executable=true; text = ''
diff --git a/pkgs/os-specific/linux/lttng-modules/default.nix b/pkgs/os-specific/linux/lttng-modules/default.nix
index 8753f34087c..99ffb7756da 100644
--- a/pkgs/os-specific/linux/lttng-modules/default.nix
+++ b/pkgs/os-specific/linux/lttng-modules/default.nix
@@ -9,16 +9,16 @@ stdenv.mkDerivation rec {
     sha256 = "0hzksx2fw008jdsgfzpws9g7imy6ryw09ai5y0knvrmvr68nvj57";
   };
 
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
 
   NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
 
-  preConfigure = ''
-    export KERNELDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-    export INSTALL_MOD_PATH="$out"
-  '';
+  makeFlags = kernel.makeFlags ++ [
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
 
   installTargets = [ "modules_install" ];
 
diff --git a/pkgs/os-specific/linux/mba6x_bl/default.nix b/pkgs/os-specific/linux/mba6x_bl/default.nix
index fe9c11ace1f..04a89ad038d 100644
--- a/pkgs/os-specific/linux/mba6x_bl/default.nix
+++ b/pkgs/os-specific/linux/mba6x_bl/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "INSTALL_MOD_PATH=$(out)"
   ];
diff --git a/pkgs/os-specific/linux/mbp-modules/mbp2018-bridge-drv/default.nix b/pkgs/os-specific/linux/mbp-modules/mbp2018-bridge-drv/default.nix
index 070b4a6207e..0b4fec4dfb4 100644
--- a/pkgs/os-specific/linux/mbp-modules/mbp2018-bridge-drv/default.nix
+++ b/pkgs/os-specific/linux/mbp-modules/mbp2018-bridge-drv/default.nix
@@ -11,14 +11,17 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-o6yGiR+Y5SnX1johdi7fQWP5ts7HdDMqeju75UOhgik=";
   };
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags;
+
   buildPhase = ''
     make -C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build \
-      -j$NIX_BUILD_CORES M=$(pwd) modules
+      -j$NIX_BUILD_CORES M=$(pwd) modules $makeFlags
   '';
 
   installPhase = ''
     make -C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build  \
-      INSTALL_MOD_PATH=$out M=$(pwd) modules_install
+      INSTALL_MOD_PATH=$out M=$(pwd) modules_install $makeFlags
   '';
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/netatop/default.nix b/pkgs/os-specific/linux/netatop/default.nix
index 28f989929a4..dec1399d169 100644
--- a/pkgs/os-specific/linux/netatop/default.nix
+++ b/pkgs/os-specific/linux/netatop/default.nix
@@ -12,6 +12,7 @@ stdenv.mkDerivation {
     sha256 = "0qjw8glfdmngfvbn1w63q128vxdz2jlabw13y140ga9i5ibl6vvk";
   };
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
   buildInputs = [ kmod zlib ];
 
   hardeningDisable = [ "pic" ];
@@ -36,6 +37,8 @@ stdenv.mkDerivation {
     kmod=${kmod} substituteAllInPlace netatop.service
   '';
 
+  makeFlags = kernel.makeFlags;
+
   preInstall = ''
     mkdir -p $out/lib/systemd/system $out/bin $out/sbin $out/share/man/man{4,8}
     mkdir -p $out/lib/modules/${kernel.modDirVersion}/extra
diff --git a/pkgs/os-specific/linux/openrazer/driver.nix b/pkgs/os-specific/linux/openrazer/driver.nix
index 6e387de0719..2de63580ac3 100644
--- a/pkgs/os-specific/linux/openrazer/driver.nix
+++ b/pkgs/os-specific/linux/openrazer/driver.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation (common // {
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  buildFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
 
diff --git a/pkgs/os-specific/linux/r8168/default.nix b/pkgs/os-specific/linux/r8168/default.nix
index 91e15db2eeb..680cc531af4 100644
--- a/pkgs/os-specific/linux/r8168/default.nix
+++ b/pkgs/os-specific/linux/r8168/default.nix
@@ -27,11 +27,13 @@ in stdenv.mkDerivation rec {
   # avoid using the Makefile directly -- it doesn't understand
   # any kernel but the current.
   # based on the ArchLinux pkgbuild: https://git.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h=packages/r8168
+  makeFlags = kernel.makeFlags ++ [
+    "-C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "M=$(PWD)/src"
+    "modules"
+  ];
   preBuild = ''
-    makeFlagsArray+=("-C${kernel.dev}/lib/modules/${kernel.modDirVersion}/build")
-    makeFlagsArray+=("M=$PWD/src")
     makeFlagsArray+=("EXTRA_CFLAGS=-DCONFIG_R8168_NAPI -DCONFIG_R8168_VLAN -DCONFIG_ASPM -DENABLE_S5WOL -DENABLE_EEE")
-    makeFlagsArray+=("modules")
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/rtl8189es/default.nix b/pkgs/os-specific/linux/rtl8189es/default.nix
index 500359f7e4f..d6b5785210b 100644
--- a/pkgs/os-specific/linux/rtl8189es/default.nix
+++ b/pkgs/os-specific/linux/rtl8189es/default.nix
@@ -2,17 +2,16 @@
 
 stdenv.mkDerivation rec {
   name = "rtl8189es-${kernel.version}-${version}";
-  version = "2020-10-03";
+  version = "2021-10-01";
 
   src = fetchFromGitHub {
     owner = "jwrdegoede";
     repo = "rtl8189ES_linux";
-    rev = "03ac413135a355b55b693154c44b70f86a39732e";
-    sha256 = "0wiikviwyvy6h55rgdvy7csi1zqniqg26p8x44rd6mhbw0g00h56";
+    rev = "be378f47055da1bae42ff6ec1d62f1a5052ef097";
+    sha256 = "sha256-+19q1Xux2BjquavY+s0UDzTubEt6BEUZ9XVDVmj36us=";
   };
 
-  nativeBuildInputs = [ bc nukeReferences ];
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" "format" ];
 
@@ -23,13 +22,10 @@ stdenv.mkDerivation rec {
     substituteInPlace ./Makefile --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
 
-  makeFlags = [
-    "ARCH=${stdenv.hostPlatform.linuxArch}"
+  makeFlags = kernel.makeFlags ++ [
     "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     ("CONFIG_PLATFORM_I386_PC=" + (if (stdenv.hostPlatform.isi686 || stdenv.hostPlatform.isx86_64) then "y" else "n"))
     ("CONFIG_PLATFORM_ARM_RPI=" + (if (stdenv.hostPlatform.isAarch32 || stdenv.hostPlatform.isAarch64) then "y" else "n"))
-  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
   ];
 
   preInstall = ''
diff --git a/pkgs/os-specific/linux/rtl8192eu/default.nix b/pkgs/os-specific/linux/rtl8192eu/default.nix
index b33330611b8..6fa15358582 100644
--- a/pkgs/os-specific/linux/rtl8192eu/default.nix
+++ b/pkgs/os-specific/linux/rtl8192eu/default.nix
@@ -19,7 +19,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = kernel.moduleBuildDependencies ++ [ bc ];
 
-  makeFlags = [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
+  makeFlags = kernel.makeFlags ++ [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/rtl8814au/default.nix b/pkgs/os-specific/linux/rtl8814au/default.nix
index f9ca60b1112..f12adf73d5f 100644
--- a/pkgs/os-specific/linux/rtl8814au/default.nix
+++ b/pkgs/os-specific/linux/rtl8814au/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     sha256 = "0lk3ldff489ggbqmlfi4zvnp1cvxj1b06m0fhpzai82070klzzmj";
   };
 
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags;
 
   hardeningDisable = [ "pic" ];
 
diff --git a/pkgs/os-specific/linux/rtl8821ce/default.nix b/pkgs/os-specific/linux/rtl8821ce/default.nix
index 75e12a1b7a4..27303c02980 100644
--- a/pkgs/os-specific/linux/rtl8821ce/default.nix
+++ b/pkgs/os-specific/linux/rtl8821ce/default.nix
@@ -13,8 +13,8 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  nativeBuildInputs = [ bc ];
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags;
 
   prePatch = ''
     substituteInPlace ./Makefile \
diff --git a/pkgs/os-specific/linux/rtl8821cu/default.nix b/pkgs/os-specific/linux/rtl8821cu/default.nix
index 9229a3c1306..0ea0682214b 100644
--- a/pkgs/os-specific/linux/rtl8821cu/default.nix
+++ b/pkgs/os-specific/linux/rtl8821cu/default.nix
@@ -13,8 +13,8 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  nativeBuildInputs = [ bc ];
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags;
 
   prePatch = ''
     substituteInPlace ./Makefile \
diff --git a/pkgs/os-specific/linux/rtl88x2bu/default.nix b/pkgs/os-specific/linux/rtl88x2bu/default.nix
index 31d8f50a528..e092d145abd 100644
--- a/pkgs/os-specific/linux/rtl88x2bu/default.nix
+++ b/pkgs/os-specific/linux/rtl88x2bu/default.nix
@@ -13,10 +13,10 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  nativeBuildInputs = [ bc ];
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags;
 
- prePatch = ''
+  prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
       --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
diff --git a/pkgs/os-specific/linux/rtw88/default.nix b/pkgs/os-specific/linux/rtw88/default.nix
index c3f849df118..529ee621892 100644
--- a/pkgs/os-specific/linux/rtw88/default.nix
+++ b/pkgs/os-specific/linux/rtw88/default.nix
@@ -14,7 +14,8 @@ stdenv.mkDerivation {
     hash = "sha256-PRzWXC1lre8gt1GfVdnaG836f5YK57P9a8tG20yef0w=";
   };
 
-  makeFlags = [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags ++ [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/rtw89/default.nix b/pkgs/os-specific/linux/rtw89/default.nix
index 6b0f06c5bdc..6ff208fa6dd 100644
--- a/pkgs/os-specific/linux/rtw89/default.nix
+++ b/pkgs/os-specific/linux/rtw89/default.nix
@@ -14,7 +14,8 @@ stdenv.mkDerivation {
     sha256 = "0cvawyi1ksw9xkr8pzwipsl7b8hnmrb17w5cblyicwih8fqaw632";
   };
 
-  makeFlags = [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags ++ [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/v4l2loopback/default.nix b/pkgs/os-specific/linux/v4l2loopback/default.nix
index c1aa7be2af6..095d873e66c 100644
--- a/pkgs/os-specific/linux/v4l2loopback/default.nix
+++ b/pkgs/os-specific/linux/v4l2loopback/default.nix
@@ -16,12 +16,9 @@ stdenv.mkDerivation rec {
   preBuild = ''
     substituteInPlace Makefile --replace "modules_install" "INSTALL_MOD_PATH=$out modules_install"
     sed -i '/depmod/d' Makefile
-    export PATH=${kmod}/sbin:$PATH
   '';
 
-  nativeBuildInputs = kernel.moduleBuildDependencies;
-
-  buildInputs = [ kmod ];
+  nativeBuildInputs = [ kmod ] ++ kernel.moduleBuildDependencies;
 
   postInstall = ''
     make install-utils PREFIX=$bin
@@ -29,7 +26,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "bin" ];
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KERNELRELEASE=${kernel.modDirVersion}"
     "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
diff --git a/pkgs/os-specific/linux/veikk-linux-driver/default.nix b/pkgs/os-specific/linux/veikk-linux-driver/default.nix
index a1019d7b7fd..8cf4896ae02 100644
--- a/pkgs/os-specific/linux/veikk-linux-driver/default.nix
+++ b/pkgs/os-specific/linux/veikk-linux-driver/default.nix
@@ -15,9 +15,9 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ kernel ];
 
-  buildPhase = ''
-    make BUILD_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build
-  '';
+  makeFlags = kernel.makeFlags ++ [
+    "BUILD_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
 
   installPhase = ''
     mkdir -p $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/veikk
diff --git a/pkgs/os-specific/linux/xmm7360-pci/default.nix b/pkgs/os-specific/linux/xmm7360-pci/default.nix
index 6a589ff889c..435ff94afb7 100644
--- a/pkgs/os-specific/linux/xmm7360-pci/default.nix
+++ b/pkgs/os-specific/linux/xmm7360-pci/default.nix
@@ -11,10 +11,12 @@ stdenv.mkDerivation rec {
     sha256 = "1wdb0phqg9rj9g9ycqdya0m7lx24kzjlh25yw0ifp898ddxrrr0c";
   };
 
-  makeFlags = [ "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
+  makeFlags = kernel.makeFlags ++ [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
-  INSTALL_MOD_PATH = placeholder "out";
   installFlags = [ "DEPMOD=true" ];
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/xpadneo/default.nix b/pkgs/os-specific/linux/xpadneo/default.nix
index c1874877620..c5aa09a8860 100644
--- a/pkgs/os-specific/linux/xpadneo/default.nix
+++ b/pkgs/os-specific/linux/xpadneo/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = kernel.moduleBuildDependencies;
   buildInputs = [ bluez ];
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "-C"
     "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "M=$(sourceRoot)"
diff --git a/pkgs/shells/tcsh/default.nix b/pkgs/shells/tcsh/default.nix
index 2c8548fb1fd..4357ca605b1 100644
--- a/pkgs/shells/tcsh/default.nix
+++ b/pkgs/shells/tcsh/default.nix
@@ -10,17 +10,7 @@ stdenv.mkDerivation rec {
   version = "6.24.00";
 
   src = fetchurl {
-    urls = [
-      "https://astron.com/pub/tcsh/${pname}-${version}.tar.gz"
-      "https://astron.com/pub/tcsh/old/${pname}-${version}.tar.gz"
-      "http://ftp.funet.fi/pub/mirrors/ftp.astron.com/pub/tcsh/${pname}-${version}.tar.gz"
-      "http://ftp.funet.fi/pub/mirrors/ftp.astron.com/pub/tcsh/old/${pname}-${version}.tar.gz"
-
-      "ftp://ftp.astron.com/pub/tcsh/${pname}-${version}.tar.gz"
-      "ftp://ftp.astron.com/pub/tcsh/old/${pname}-${version}.tar.gz"
-      "ftp://ftp.funet.fi/pub/unix/shells/tcsh/${pname}-${version}.tar.gz"
-      "ftp://ftp.funet.fi/pub/unix/shells/tcsh/old/${pname}-${version}.tar.gz"
-    ];
+    url = "mirror://tcsh/${pname}-${version}.tar.gz";
     hash = "sha256-YL4sUEvY8fpuQksZVkldfnztUqKslNtf0n9La/yPdPA=";
   };
 
@@ -29,6 +19,7 @@ stdenv.mkDerivation rec {
   ];
 
   patches = lib.optional stdenv.hostPlatform.isMusl
+    # Use system malloc
     (fetchpatch {
       name = "sysmalloc.patch";
       url = "https://git.alpinelinux.org/aports/plain/community/tcsh/001-sysmalloc.patch?id=184585c046cdd56512f1a76e426dd799b368f8cf";
diff --git a/pkgs/tools/nix/nix-output-monitor/default.nix b/pkgs/tools/nix/nix-output-monitor/default.nix
index caa9abb9a1d..0f78600a050 100644
--- a/pkgs/tools/nix/nix-output-monitor/default.nix
+++ b/pkgs/tools/nix/nix-output-monitor/default.nix
@@ -6,6 +6,7 @@
   async,
   attoparsec,
   base,
+  bytestring,
   cassava,
   containers,
   data-default,
@@ -36,13 +37,14 @@
   unix,
   vector,
   wcwidth,
+  word8,
 }:
 mkDerivation {
   pname = "nix-output-monitor";
-  version = "1.1.1.0";
+  version = "1.1.2.0";
   src = fetchzip {
-    url = "https://github.com/maralorn/nix-output-monitor/archive/refs/tags/v1.1.1.0.tar.gz";
-    sha256 = "1zw7x1snyycl1bp5w7jh8wwnynqvw3g4glr293bnzi5jyirj5wlg";
+    url = "https://github.com/maralorn/nix-output-monitor/archive/refs/tags/v1.1.2.0.tar.gz";
+    sha256 = "03qhy4xzika41pxlmvpz3psgy54va72ipn9v1lv33l6369ikrhl1";
   };
   isLibrary = true;
   isExecutable = true;
@@ -51,6 +53,7 @@ mkDerivation {
     async
     attoparsec
     base
+    bytestring
     cassava
     containers
     data-default
@@ -74,12 +77,14 @@ mkDerivation {
     unix
     vector
     wcwidth
+    word8
   ];
   executableHaskellDepends = [
     ansi-terminal
     async
     attoparsec
     base
+    bytestring
     cassava
     containers
     data-default
@@ -103,12 +108,14 @@ mkDerivation {
     unix
     vector
     wcwidth
+    word8
   ];
   testHaskellDepends = [
     ansi-terminal
     async
     attoparsec
     base
+    bytestring
     cassava
     containers
     data-default
@@ -134,6 +141,7 @@ mkDerivation {
     unix
     vector
     wcwidth
+    word8
   ];
   homepage = "https://github.com/maralorn/nix-output-monitor";
   description = "Parses output of nix-build to show additional information";
@@ -148,11 +156,9 @@ mkDerivation {
     ${expect}/bin/unbuffer nix-build "\$@" 2>&1 | exec $out/bin/nom
     EOF
     chmod a+x $out/bin/nom-build
-    installShellCompletion --zsh --name _nom-build ${
-      builtins.toFile "completion.zsh" ''
-        #compdef nom-build
-        compdef nom-build=nix-build
-      ''
-    }
+    installShellCompletion --zsh --name _nom-build ${builtins.toFile "completion.zsh" ''
+      #compdef nom-build
+      compdef nom-build=nix-build
+    ''}
   '';
 }
diff --git a/pkgs/tools/package-management/nix-eval-jobs/default.nix b/pkgs/tools/package-management/nix-eval-jobs/default.nix
index dfcf11045cb..1023d23432c 100644
--- a/pkgs/tools/package-management/nix-eval-jobs/default.nix
+++ b/pkgs/tools/package-management/nix-eval-jobs/default.nix
@@ -11,12 +11,12 @@
 }:
 stdenv.mkDerivation rec {
   pname = "nix-eval-jobs";
-  version = "0.0.3";
+  version = "0.0.4";
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256:0flnqn1vkr55sipii82vwjfkhv4p835d01f6yhlpbalxwy2kr14r";
+    hash = "sha256-SCwvFlBYUlxCucjMO4GHhEQWZFZt0lRKJncm6hvDx9I=";
   };
   buildInputs = [
     boost
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index a6b7fa3a900..8eb8fef8298 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -73,13 +73,13 @@ in lib.makeExtensible (self: {
   stable = self.nix_2_7;
 
   unstable = lib.lowPrio (common rec {
-    version = "2.7";
-    suffix = "pre20220221_${lib.substring 0 7 src.rev}";
+    version = "2.8";
+    suffix = "pre20220311_${lib.substring 0 7 src.rev}";
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "nix";
-      rev = "caf51729450d4c57d48ddbef8e855e9bf65f8792";
-      sha256 = "sha256-2fbza6fWPjyTyVEqWIp0jk/Z4epjSDe1u4lbEu+v7Iw=";
+      rev = "d5322698a2abbc6d141e1d244e17b0d226a2f18b";
+      sha256 = "sha256-7rQSktGC8+DmeyGOnzFMy1QwAYnw4JJphv+lEwFCwfU=";
     };
   });
 })
diff --git a/pkgs/tools/security/gitleaks/default.nix b/pkgs/tools/security/gitleaks/default.nix
index ff70782dabe..a574c347629 100644
--- a/pkgs/tools/security/gitleaks/default.nix
+++ b/pkgs/tools/security/gitleaks/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "gitleaks";
-  version = "8.3.0";
+  version = "8.4.0";
 
   src = fetchFromGitHub {
     owner = "zricethezav";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-D6leHpGZNQ9Xt4PSU0Dwte6N3bMge7itkZtcUl0mIrQ=";
+    sha256 = "sha256-z3YGRDgBGpr2hixIayih4wxGWPtYL0EPAuTYVPByzQc=";
   };
 
-  vendorSha256 = "sha256-JZOalUOIeV51Nttm6xeBos+/8fleSBpUiXa8ekVuYJA=";
+  vendorSha256 = "sha256-J1xX+r+Mph1QkqjK87tqGDkYvPZp0lHgdRhd88WZi1c=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index c883066ced5..cc126dc320d 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1580,6 +1580,8 @@ in let inherit (pkgs) callPackage; in rec
 
   ocamlPackages_4_13 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.13.nix { });
 
+  ocamlPackages_4_14 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.14.nix { });
+
   ocamlPackages_latest = ocamlPackages_4_13;
 
   ocamlPackages = ocamlPackages_4_13;
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 81628686a31..1da6e934c24 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -144,6 +144,8 @@ lib.makeScope pkgs.newScope (self: with self; {
 
     phing = callPackage ../development/php-packages/phing { };
 
+    phive = callPackage ../development/php-packages/phive { };
+
     php-cs-fixer = callPackage ../development/php-packages/php-cs-fixer { };
 
     php-parallel-lint = callPackage ../development/php-packages/php-parallel-lint { };