From 84245c843f30a7b535280e35f4d2d56e2a0ab789 Mon Sep 17 00:00:00 2001
From: alyaeanyx <alexandra.hollmeier@mailbox.org>
Date: Sun, 14 Nov 2021 17:06:21 +0100
Subject: [PATCH 01/31] bspatch: security and bug fixes

---
 pkgs/tools/compression/bsdiff/default.nix | 26 +++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/compression/bsdiff/default.nix b/pkgs/tools/compression/bsdiff/default.nix
index 8f8818781ab4..541609bf13b3 100644
--- a/pkgs/tools/compression/bsdiff/default.nix
+++ b/pkgs/tools/compression/bsdiff/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, bzip2 }:
+{ lib, stdenv, fetchurl, fetchpatch, bzip2 }:
 
 stdenv.mkDerivation rec {
   pname = "bsdiff";
@@ -10,7 +10,29 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ bzip2 ];
-  patches = [ ./include-systypes.patch ];
+  patches = [
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/b/bsdiff/4.3-22/debian/patches/20-CVE-2014-9862.patch";
+      sha256 = "sha256-3UuUfNvShQ8fLqxCKUTb/n4BmjL4+Nl7aEqCxYrrERQ=";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/b/bsdiff/4.3-22/debian/patches/30-bug-632585-mmap-src-file-instead-of-malloc-read-it.patch";
+      sha256 = "sha256-esbhz2/efUiuQDuF7LGfSeEn3/f1WbqCxQpTs2A0ulI=";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/b/bsdiff/4.3-22/debian/patches/31-bug-632585-mmap-dst-file-instead-of-malloc-read-it.patch";
+      sha256 = "sha256-Of4aOcI0rsgdRzPqyw2VRn2p9wQuo3hdlgDTBdXGzoc=";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/b/bsdiff/4.3-22/debian/patches/32-bug-632585-use-int32_t-instead-off_t-for-file-size.patch";
+      sha256 = "sha256-SooFnFK4uKNXvXQb/LEcH8GocnRtkryExI4b3BZTsAY=";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/b/bsdiff/4.3-22/debian/patches/33-CVE-2020-14315.patch";
+      sha256 = "sha256-eHu0ulZ4dneIju3GuffzvbpI0Hk2eDpovEUjmrHDk9U=";
+    })
+    ./include-systypes.patch
+  ];
 
   buildPhase = ''
     $CC -O3 -lbz2 bspatch.c -o bspatch

From 842a855325c8e050a874bc8249904b02405de74e Mon Sep 17 00:00:00 2001
From: alyaeanyx <alexandra.hollmeier@mailbox.org>
Date: Sun, 14 Nov 2021 18:04:54 +0100
Subject: [PATCH 02/31] bsdiff: fix patch file for aarch64-linux

---
 .../compression/bsdiff/CVE-2020-14315.patch   | 384 ++++++++++++++++++
 1 file changed, 384 insertions(+)
 create mode 100644 pkgs/tools/compression/bsdiff/CVE-2020-14315.patch

diff --git a/pkgs/tools/compression/bsdiff/CVE-2020-14315.patch b/pkgs/tools/compression/bsdiff/CVE-2020-14315.patch
new file mode 100644
index 000000000000..dabb8deee00a
--- /dev/null
+++ b/pkgs/tools/compression/bsdiff/CVE-2020-14315.patch
@@ -0,0 +1,384 @@
+Description: patch for CVE-2020-14315
+ A memory corruption vulnerability is present in bspatch as shipped in
+ Colin Percival’s bsdiff tools version 4.3. Insufficient checks when
+ handling external inputs allows an attacker to bypass the sanity checks
+ in place and write out of a dynamically allocated buffer boundaries.
+Source: https://svnweb.freebsd.org/base/head/usr.bin/bsdiff/bspatch/bspatch.c?revision=352742&view=co
+Author: tony mancill <tmancill@debian.org>
+Comment: The patch was created by comparing the Debian sources to the
+ "Confirmed Patched Version" [1] documented in the
+ X41 D-SEC GmbH Security Advisory: X41-2020-006 [2].
+ References to FreeBSD capsicum have been dropped.  Definitions for
+ TYPE_MINIMUM and TYPE_MAXIMUM have been borrowed from the Debian
+ coreutils package sources but originate in gnulib [3] and are used to
+ define OFF_MIN and OFF_MAX (limits of off_t). Whitespace changes from
+ the confirmed patched version are also included and keep the difference
+ between the Debian sources and the confirmed patched version minimal.
+ .
+ [1] https://svnweb.freebsd.org/base/head/usr.bin/bsdiff/bspatch/bspatch.c?revision=352742&view=co
+ [2] https://www.openwall.com/lists/oss-security/2020/07/09/2
+ [3] https://www.gnu.org/software/gnulib/
+Last-Update: 2021-04-03
+Forwarded: not-needed
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964796
+
+--- a/bspatch.c
++++ b/bspatch.c
+@@ -1,4 +1,6 @@
+ /*-
++ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
++ *
+  * Copyright 2003-2005 Colin Percival
+  * All rights reserved
+  *
+@@ -24,56 +26,149 @@
+  * POSSIBILITY OF SUCH DAMAGE.
+  */
+ 
++#include <sys/cdefs.h>
+ #if 0
+-__FBSDID("$FreeBSD: src/usr.bin/bsdiff/bspatch/bspatch.c,v 1.1 2005/08/06 01:59:06 cperciva Exp $");
++__FBSDID("$FreeBSD$");
+ #endif
+ 
+ #include <bzlib.h>
+-#include <stdlib.h>
++#include <err.h>
++#include <fcntl.h>
++#include <libgen.h>
++#include <limits.h>
++#include <stdint.h>
+ #include <stdio.h>
++#include <stdlib.h>
+ #include <string.h>
+-#include <err.h>
+ #include <unistd.h>
+-#include <fcntl.h>
++
++#ifndef O_BINARY
++#define O_BINARY 0
++#endif
++#define HEADER_SIZE 32
++
++/* TYPE_MINIMUM and TYPE_MAXIMUM taken from coreutils */
++#ifndef TYPE_MINIMUM
++#define TYPE_MINIMUM(t) \
++  ((t) ((t) 0 < (t) -1 ? (t) 0 : ~ TYPE_MAXIMUM (t)))
++#endif
++#ifndef TYPE_MAXIMUM
++#define TYPE_MAXIMUM(t) \
++  ((t) ((t) 0 < (t) -1 \
++        ? (t) -1 \
++        : ((((t) 1 << (sizeof (t) * CHAR_BIT - 2)) - 1) * 2 + 1)))
++#endif
++
++#ifndef OFF_MAX
++#define OFF_MAX TYPE_MAXIMUM(off_t)
++#endif
++
++#ifndef OFF_MIN
++#define OFF_MIN TYPE_MINIMUM(off_t)
++#endif
++
++static char *newfile;
++static int dirfd = -1;
++
++static void
++exit_cleanup(void)
++{
++
++	if (dirfd != -1 && newfile != NULL)
++		if (unlinkat(dirfd, newfile, 0))
++			warn("unlinkat");
++}
++
++static inline off_t
++add_off_t(off_t a, off_t b)
++{
++	off_t result;
++
++#if __GNUC__ >= 5 || \
++	if (__builtin_add_overflow(a, b, &result))
++		errx(1, "Corrupt patch");
++#else
++	if ((b > 0 && a > OFF_MAX - b) || (b < 0 && a < OFF_MIN - b))
++		errx(1, "Corrupt patch");
++	result = a + b;
++#endif
++	return result;
++}
+ 
+ static off_t offtin(u_char *buf)
+ {
+ 	off_t y;
+ 
+-	y=buf[7]&0x7F;
+-	y=y*256;y+=buf[6];
+-	y=y*256;y+=buf[5];
+-	y=y*256;y+=buf[4];
+-	y=y*256;y+=buf[3];
+-	y=y*256;y+=buf[2];
+-	y=y*256;y+=buf[1];
+-	y=y*256;y+=buf[0];
++	y = buf[7] & 0x7F;
++	y = y * 256; y += buf[6];
++	y = y * 256; y += buf[5];
++	y = y * 256; y += buf[4];
++	y = y * 256; y += buf[3];
++	y = y * 256; y += buf[2];
++	y = y * 256; y += buf[1];
++	y = y * 256; y += buf[0];
+ 
+-	if(buf[7]&0x80) y=-y;
++	if (buf[7] & 0x80)
++		y = -y;
+ 
+-	return y;
++	return (y);
+ }
+ 
+-int main(int argc,char * argv[])
++static void
++usage(void)
+ {
+-	FILE * f, * cpf, * dpf, * epf;
+-	BZFILE * cpfbz2, * dpfbz2, * epfbz2;
++
++	fprintf(stderr, "usage: bspatch oldfile newfile patchfile\n");
++	exit(1);
++}
++
++int main(int argc, char *argv[])
++{
++	FILE *f, *cpf, *dpf, *epf;
++	BZFILE *cpfbz2, *dpfbz2, *epfbz2;
++	char *directory, *namebuf;
+ 	int cbz2err, dbz2err, ebz2err;
+-	int fd;
+-	ssize_t oldsize,newsize;
+-	ssize_t bzctrllen,bzdatalen;
+-	u_char header[32],buf[8];
++	int newfd, oldfd;
++	off_t oldsize, newsize;
++	off_t bzctrllen, bzdatalen;
++	u_char header[HEADER_SIZE], buf[8];
+ 	u_char *old, *new;
+-	off_t oldpos,newpos;
++	off_t oldpos, newpos;
+ 	off_t ctrl[3];
+-	off_t lenread;
+-	off_t i;
++	off_t i, lenread, offset;
+ 
+-	if(argc!=4) errx(1,"usage: %s oldfile newfile patchfile\n",argv[0]);
++	if (argc != 4)
++		usage();
+ 
+ 	/* Open patch file */
+-	if ((f = fopen(argv[3], "r")) == NULL)
++	if ((f = fopen(argv[3], "rb")) == NULL)
++		err(1, "fopen(%s)", argv[3]);
++	/* Open patch file for control block */
++	if ((cpf = fopen(argv[3], "rb")) == NULL)
++		err(1, "fopen(%s)", argv[3]);
++	/* open patch file for diff block */
++	if ((dpf = fopen(argv[3], "rb")) == NULL)
+ 		err(1, "fopen(%s)", argv[3]);
++	/* open patch file for extra block */
++	if ((epf = fopen(argv[3], "rb")) == NULL)
++		err(1, "fopen(%s)", argv[3]);
++	/* open oldfile */
++	if ((oldfd = open(argv[1], O_RDONLY | O_BINARY, 0)) < 0)
++		err(1, "open(%s)", argv[1]);
++	/* open directory where we'll write newfile */
++	if ((namebuf = strdup(argv[2])) == NULL ||
++	    (directory = dirname(namebuf)) == NULL ||
++	    (dirfd = open(directory, O_DIRECTORY)) < 0)
++		err(1, "open %s", argv[2]);
++	free(namebuf);
++	if ((newfile = basename(argv[2])) == NULL)
++		err(1, "basename");
++	/* open newfile */
++	if ((newfd = openat(dirfd, newfile,
++	    O_CREAT | O_TRUNC | O_WRONLY | O_BINARY, 0666)) < 0)
++		err(1, "open(%s)", argv[2]);
++	atexit(exit_cleanup);
+ 
+ 	/*
+ 	File format:
+@@ -90,104 +185,104 @@
+ 	*/
+ 
+ 	/* Read header */
+-	if (fread(header, 1, 32, f) < 32) {
++	if (fread(header, 1, HEADER_SIZE, f) < HEADER_SIZE) {
+ 		if (feof(f))
+-			errx(1, "Corrupt patch\n");
++			errx(1, "Corrupt patch");
+ 		err(1, "fread(%s)", argv[3]);
+ 	}
+ 
+ 	/* Check for appropriate magic */
+ 	if (memcmp(header, "BSDIFF40", 8) != 0)
+-		errx(1, "Corrupt patch\n");
++		errx(1, "Corrupt patch");
+ 
+ 	/* Read lengths from header */
+-	bzctrllen=offtin(header+8);
+-	bzdatalen=offtin(header+16);
+-	newsize=offtin(header+24);
+-	if((bzctrllen<0) || (bzdatalen<0) || (newsize<0))
+-		errx(1,"Corrupt patch\n");
++	bzctrllen = offtin(header + 8);
++	bzdatalen = offtin(header + 16);
++	newsize = offtin(header + 24);
++	if (bzctrllen < 0 || bzctrllen > OFF_MAX - HEADER_SIZE ||
++	    bzdatalen < 0 || bzctrllen + HEADER_SIZE > OFF_MAX - bzdatalen ||
++	    newsize < 0 || newsize > SSIZE_MAX)
++		errx(1, "Corrupt patch");
+ 
+ 	/* Close patch file and re-open it via libbzip2 at the right places */
+ 	if (fclose(f))
+ 		err(1, "fclose(%s)", argv[3]);
+-	if ((cpf = fopen(argv[3], "r")) == NULL)
+-		err(1, "fopen(%s)", argv[3]);
+-	if (fseeko(cpf, 32, SEEK_SET))
+-		err(1, "fseeko(%s, %lld)", argv[3],
+-		    (long long)32);
++	offset = HEADER_SIZE;
++	if (fseeko(cpf, offset, SEEK_SET))
++		err(1, "fseeko(%s, %jd)", argv[3], (intmax_t)offset);
+ 	if ((cpfbz2 = BZ2_bzReadOpen(&cbz2err, cpf, 0, 0, NULL, 0)) == NULL)
+ 		errx(1, "BZ2_bzReadOpen, bz2err = %d", cbz2err);
+-	if ((dpf = fopen(argv[3], "r")) == NULL)
+-		err(1, "fopen(%s)", argv[3]);
+-	if (fseeko(dpf, 32 + bzctrllen, SEEK_SET))
+-		err(1, "fseeko(%s, %lld)", argv[3],
+-		    (long long)(32 + bzctrllen));
++	offset = add_off_t(offset, bzctrllen);
++	if (fseeko(dpf, offset, SEEK_SET))
++		err(1, "fseeko(%s, %jd)", argv[3], (intmax_t)offset);
+ 	if ((dpfbz2 = BZ2_bzReadOpen(&dbz2err, dpf, 0, 0, NULL, 0)) == NULL)
+ 		errx(1, "BZ2_bzReadOpen, bz2err = %d", dbz2err);
+-	if ((epf = fopen(argv[3], "r")) == NULL)
+-		err(1, "fopen(%s)", argv[3]);
+-	if (fseeko(epf, 32 + bzctrllen + bzdatalen, SEEK_SET))
+-		err(1, "fseeko(%s, %lld)", argv[3],
+-		    (long long)(32 + bzctrllen + bzdatalen));
++	offset = add_off_t(offset, bzdatalen);
++	if (fseeko(epf, offset, SEEK_SET))
++		err(1, "fseeko(%s, %jd)", argv[3], (intmax_t)offset);
+ 	if ((epfbz2 = BZ2_bzReadOpen(&ebz2err, epf, 0, 0, NULL, 0)) == NULL)
+ 		errx(1, "BZ2_bzReadOpen, bz2err = %d", ebz2err);
+ 
+-	if(((fd=open(argv[1],O_RDONLY,0))<0) ||
+-		((oldsize=lseek(fd,0,SEEK_END))==-1) ||
+-		((old=malloc(oldsize+1))==NULL) ||
+-		(lseek(fd,0,SEEK_SET)!=0) ||
+-		(read(fd,old,oldsize)!=oldsize) ||
+-		(close(fd)==-1)) err(1,"%s",argv[1]);
+-	if((new=malloc(newsize+1))==NULL) err(1,NULL);
+-
+-	oldpos=0;newpos=0;
+-	while(newpos<newsize) {
++	if ((oldsize = lseek(oldfd, 0, SEEK_END)) == -1 ||
++	    oldsize > SSIZE_MAX ||
++	    (old = malloc(oldsize)) == NULL ||
++	    lseek(oldfd, 0, SEEK_SET) != 0 ||
++	    read(oldfd, old, oldsize) != oldsize ||
++	    close(oldfd) == -1)
++		err(1, "%s", argv[1]);
++	if ((new = malloc(newsize)) == NULL)
++		err(1, NULL);
++
++	oldpos = 0;
++	newpos = 0;
++	while (newpos < newsize) {
+ 		/* Read control data */
+-		for(i=0;i<=2;i++) {
++		for (i = 0; i <= 2; i++) {
+ 			lenread = BZ2_bzRead(&cbz2err, cpfbz2, buf, 8);
+ 			if ((lenread < 8) || ((cbz2err != BZ_OK) &&
+ 			    (cbz2err != BZ_STREAM_END)))
+-				errx(1, "Corrupt patch\n");
+-			ctrl[i]=offtin(buf);
+-		};
++				errx(1, "Corrupt patch");
++			ctrl[i] = offtin(buf);
++		}
+ 
+ 		/* Sanity-check */
+-		if ((ctrl[0] < 0) || (ctrl[1] < 0))
+-			errx(1,"Corrupt patch\n");
++		if (ctrl[0] < 0 || ctrl[0] > INT_MAX ||
++		    ctrl[1] < 0 || ctrl[1] > INT_MAX)
++			errx(1, "Corrupt patch");
+ 
+ 		/* Sanity-check */
+-		if(newpos+ctrl[0]>newsize)
+-			errx(1,"Corrupt patch\n");
++		if (add_off_t(newpos, ctrl[0]) > newsize)
++			errx(1, "Corrupt patch");
+ 
+ 		/* Read diff string */
+ 		lenread = BZ2_bzRead(&dbz2err, dpfbz2, new + newpos, ctrl[0]);
+ 		if ((lenread < ctrl[0]) ||
+ 		    ((dbz2err != BZ_OK) && (dbz2err != BZ_STREAM_END)))
+-			errx(1, "Corrupt patch\n");
++			errx(1, "Corrupt patch");
+ 
+ 		/* Add old data to diff string */
+-		for(i=0;i<ctrl[0];i++)
+-			if((oldpos+i>=0) && (oldpos+i<oldsize))
+-				new[newpos+i]+=old[oldpos+i];
++		for (i = 0; i < ctrl[0]; i++)
++			if (add_off_t(oldpos, i) < oldsize)
++				new[newpos + i] += old[oldpos + i];
+ 
+ 		/* Adjust pointers */
+-		newpos+=ctrl[0];
+-		oldpos+=ctrl[0];
++		newpos = add_off_t(newpos, ctrl[0]);
++		oldpos = add_off_t(oldpos, ctrl[0]);
+ 
+ 		/* Sanity-check */
+-		if(newpos+ctrl[1]>newsize)
+-			errx(1,"Corrupt patch\n");
++		if (add_off_t(newpos, ctrl[1]) > newsize)
++			errx(1, "Corrupt patch");
+ 
+ 		/* Read extra string */
+ 		lenread = BZ2_bzRead(&ebz2err, epfbz2, new + newpos, ctrl[1]);
+ 		if ((lenread < ctrl[1]) ||
+ 		    ((ebz2err != BZ_OK) && (ebz2err != BZ_STREAM_END)))
+-			errx(1, "Corrupt patch\n");
++			errx(1, "Corrupt patch");
+ 
+ 		/* Adjust pointers */
+-		newpos+=ctrl[1];
+-		oldpos+=ctrl[2];
+-	};
++		newpos = add_off_t(newpos, ctrl[1]);
++		oldpos = add_off_t(oldpos, ctrl[2]);
++	}
+ 
+ 	/* Clean up the bzip2 reads */
+ 	BZ2_bzReadClose(&cbz2err, cpfbz2);
+@@ -197,12 +292,13 @@
+ 		err(1, "fclose(%s)", argv[3]);
+ 
+ 	/* Write the new file */
+-	if(((fd=open(argv[2],O_CREAT|O_TRUNC|O_WRONLY,0666))<0) ||
+-		(write(fd,new,newsize)!=newsize) || (close(fd)==-1))
+-		err(1,"%s",argv[2]);
++	if (write(newfd, new, newsize) != newsize || close(newfd) == -1)
++		err(1, "%s", argv[2]);
++	/* Disable atexit cleanup */
++	newfile = NULL;
+ 
+ 	free(new);
+ 	free(old);
+ 
+-	return 0;
++	return (0);
+ }

From 47a9d5e419a32c41b0e0e3d650acdf312372a7b3 Mon Sep 17 00:00:00 2001
From: alyaeanyx <alexandra.hollmeier@mailbox.org>
Date: Sun, 14 Nov 2021 19:58:41 +0100
Subject: [PATCH 03/31] bsdiff: add patch to default.nix

---
 pkgs/tools/compression/bsdiff/default.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/pkgs/tools/compression/bsdiff/default.nix b/pkgs/tools/compression/bsdiff/default.nix
index 541609bf13b3..8bce8a65a5f9 100644
--- a/pkgs/tools/compression/bsdiff/default.nix
+++ b/pkgs/tools/compression/bsdiff/default.nix
@@ -27,10 +27,7 @@ stdenv.mkDerivation rec {
       url = "https://sources.debian.org/data/main/b/bsdiff/4.3-22/debian/patches/32-bug-632585-use-int32_t-instead-off_t-for-file-size.patch";
       sha256 = "sha256-SooFnFK4uKNXvXQb/LEcH8GocnRtkryExI4b3BZTsAY=";
     })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/b/bsdiff/4.3-22/debian/patches/33-CVE-2020-14315.patch";
-      sha256 = "sha256-eHu0ulZ4dneIju3GuffzvbpI0Hk2eDpovEUjmrHDk9U=";
-    })
+    ./CVE-2020-14315.patch
     ./include-systypes.patch
   ];
 

From 200ffaa0727c1f5c09f2f76fdf1a607b6c83d0ec Mon Sep 17 00:00:00 2001
From: alyaeanyx <alexandra.hollmeier@mailbox.org>
Date: Sun, 14 Nov 2021 21:16:55 +0100
Subject: [PATCH 04/31] bsdiff: fix patch

---
 pkgs/tools/compression/bsdiff/CVE-2020-14315.patch | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/compression/bsdiff/CVE-2020-14315.patch b/pkgs/tools/compression/bsdiff/CVE-2020-14315.patch
index dabb8deee00a..bb7ff41284eb 100644
--- a/pkgs/tools/compression/bsdiff/CVE-2020-14315.patch
+++ b/pkgs/tools/compression/bsdiff/CVE-2020-14315.patch
@@ -31,7 +31,7 @@ Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964796
   * Copyright 2003-2005 Colin Percival
   * All rights reserved
   *
-@@ -24,56 +26,149 @@
+@@ -24,56 +26,148 @@
   * POSSIBILITY OF SUCH DAMAGE.
   */
  
@@ -97,7 +97,7 @@ Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964796
 +{
 +	off_t result;
 +
-+#if __GNUC__ >= 5 || \
++#if __GNUC__ >= 5
 +	if (__builtin_add_overflow(a, b, &result))
 +		errx(1, "Corrupt patch");
 +#else

From 4d57666646477d960610309b00e7883ca09133ba Mon Sep 17 00:00:00 2001
From: alyaeanyx <alexandra.hollmeier@mailbox.org>
Date: Mon, 15 Nov 2021 12:34:35 +0100
Subject: [PATCH 05/31] bsdiff: disable bugfix patches for darwin

---
 pkgs/tools/compression/bsdiff/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/compression/bsdiff/default.nix b/pkgs/tools/compression/bsdiff/default.nix
index 8bce8a65a5f9..b8a86eae89bd 100644
--- a/pkgs/tools/compression/bsdiff/default.nix
+++ b/pkgs/tools/compression/bsdiff/default.nix
@@ -15,6 +15,9 @@ stdenv.mkDerivation rec {
       url = "https://sources.debian.org/data/main/b/bsdiff/4.3-22/debian/patches/20-CVE-2014-9862.patch";
       sha256 = "sha256-3UuUfNvShQ8fLqxCKUTb/n4BmjL4+Nl7aEqCxYrrERQ=";
     })
+    ./CVE-2020-14315.patch
+    ./include-systypes.patch
+  ] ++ lib.optional stdenv.hostPlatform.isLinux [
     (fetchpatch {
       url = "https://sources.debian.org/data/main/b/bsdiff/4.3-22/debian/patches/30-bug-632585-mmap-src-file-instead-of-malloc-read-it.patch";
       sha256 = "sha256-esbhz2/efUiuQDuF7LGfSeEn3/f1WbqCxQpTs2A0ulI=";
@@ -27,8 +30,6 @@ stdenv.mkDerivation rec {
       url = "https://sources.debian.org/data/main/b/bsdiff/4.3-22/debian/patches/32-bug-632585-use-int32_t-instead-off_t-for-file-size.patch";
       sha256 = "sha256-SooFnFK4uKNXvXQb/LEcH8GocnRtkryExI4b3BZTsAY=";
     })
-    ./CVE-2020-14315.patch
-    ./include-systypes.patch
   ];
 
   buildPhase = ''

From fbd8c90829cb646fe63349efce2ec521b9b864b7 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 20 Nov 2021 11:55:17 +0100
Subject: [PATCH 06/31] python3Packages.flux-led: 0.24.24 -> 0.24.25

---
 pkgs/development/python-modules/flux-led/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/flux-led/default.nix b/pkgs/development/python-modules/flux-led/default.nix
index 58f23fba931c..be3dab8bdfd8 100644
--- a/pkgs/development/python-modules/flux-led/default.nix
+++ b/pkgs/development/python-modules/flux-led/default.nix
@@ -7,8 +7,9 @@
 }:
 
 buildPythonPackage rec {
-  pname = "flux_led";
-  version = "0.24.24";
+  pname = "flux-led";
+  version = "0.24.25";
+  format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
@@ -16,7 +17,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "flux_led";
     rev = version;
-    sha256 = "sha256-99EHmhyc6lAjYPHFvvqnd5r8HeEEJM6W3VK0/yLsz7I=";
+    sha256 = "sha256-HhoqsdaqNKdKH63glYEl5mRBFImu6Nxw5gwF7JAJABk=";
   };
 
   propagatedBuildInputs = [

From a05acfc2c073f129768a576bf3833357510410f3 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 20 Nov 2021 12:23:16 +0100
Subject: [PATCH 07/31] python3Packages.pyads: 3.3.8 -> 3.3.9

---
 pkgs/development/python-modules/pyads/default.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/pyads/default.nix b/pkgs/development/python-modules/pyads/default.nix
index 232221365fa4..a22e85154261 100644
--- a/pkgs/development/python-modules/pyads/default.nix
+++ b/pkgs/development/python-modules/pyads/default.nix
@@ -8,14 +8,16 @@
 
 buildPythonPackage rec {
   pname = "pyads";
-  version = "3.3.8";
-  disabled = pythonOlder "3.6";
+  version = "3.3.9";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "stlehmann";
     repo = pname;
     rev = version;
-    sha256 = "sha256-jhEVBndUOKM8rBX0LEqPTMLqbpizCiD7T+OCzbVgLM8=";
+    sha256 = "sha256-eNouFJQDgp56fgkA7wZKfosKWOKU6OvXRjFwjCMvZqI=";
   };
 
   buildInputs = [
@@ -31,7 +33,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "pyads" ];
+  pythonImportsCheck = [
+    "pyads"
+  ];
 
   meta = with lib; {
     description = "Python wrapper for TwinCAT ADS library";

From ec24bab90eac4c100aa5eeef77dec10dc391158b Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Sat, 20 Nov 2021 19:17:57 +0000
Subject: [PATCH 08/31] hmmer: restrict platforms to x86_64

technically big-endian powerpc with VMX is also supported, but
on x86, SSE is apparently *required* which means we can't build
a pure i686 version
---
 pkgs/applications/science/biology/hmmer/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/science/biology/hmmer/default.nix b/pkgs/applications/science/biology/hmmer/default.nix
index 0f83178626bf..2a4df9d21dba 100644
--- a/pkgs/applications/science/biology/hmmer/default.nix
+++ b/pkgs/applications/science/biology/hmmer/default.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
     homepage = "http://hmmer.org/";
     license = licenses.gpl3;
     maintainers = [ maintainers.iimog ];
-    platforms = platforms.unix;
+    # at least SSE is *required*
+    platforms = platforms.x86_64;
   };
 }

From 74cb07175b8788ad33dcc622aca8769828b925d1 Mon Sep 17 00:00:00 2001
From: Dmitry Kalinkin <dmitry.kalinkin@gmail.com>
Date: Sat, 20 Nov 2021 14:18:10 -0500
Subject: [PATCH 09/31] qvge: enable on darwin

---
 pkgs/applications/graphics/qvge/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/graphics/qvge/default.nix b/pkgs/applications/graphics/qvge/default.nix
index f50e87d1eddb..c5712c38095f 100644
--- a/pkgs/applications/graphics/qvge/default.nix
+++ b/pkgs/applications/graphics/qvge/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , substituteAll
 , qmake
+, qtsvg
 , qtx11extras
 , graphviz
 }:
@@ -27,13 +28,13 @@ mkDerivation rec {
 
   nativeBuildInputs = [ qmake ];
 
-  buildInputs = [ qtx11extras ];
+  buildInputs = if stdenv.isDarwin then [ qtsvg ] else [ qtx11extras ];
 
   meta = with lib; {
     description = "Qt Visual Graph Editor";
     homepage = "https://github.com/ArsMasiuk/qvge";
     license = licenses.mit;
     maintainers = with maintainers; [ sikmir ];
-    platforms = with platforms; linux;
+    platforms = platforms.unix;
   };
 }

From fedc3db7ba5a6f29f2518db4c01fcda87ef0c487 Mon Sep 17 00:00:00 2001
From: Dmitry Kalinkin <dmitry.kalinkin@gmail.com>
Date: Sat, 20 Nov 2021 14:18:32 -0500
Subject: [PATCH 10/31] qvge: don't use libsForQt5.mkDerivation

---
 pkgs/applications/graphics/qvge/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/graphics/qvge/default.nix b/pkgs/applications/graphics/qvge/default.nix
index c5712c38095f..442e3200e469 100644
--- a/pkgs/applications/graphics/qvge/default.nix
+++ b/pkgs/applications/graphics/qvge/default.nix
@@ -1,14 +1,15 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , substituteAll
+, wrapQtAppsHook
 , qmake
 , qtsvg
 , qtx11extras
 , graphviz
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "qvge";
   version = "0.6.3";
 
@@ -26,7 +27,7 @@ mkDerivation rec {
     inherit graphviz;
   });
 
-  nativeBuildInputs = [ qmake ];
+  nativeBuildInputs = [ wrapQtAppsHook qmake ];
 
   buildInputs = if stdenv.isDarwin then [ qtsvg ] else [ qtx11extras ];
 

From 0ca14515c6ed3c4f80afd80b315cf7bcf559200a Mon Sep 17 00:00:00 2001
From: 0x4A6F <0x4A6F@users.noreply.github.com>
Date: Sat, 20 Nov 2021 22:00:22 +0100
Subject: [PATCH 11/31] testVersion: name runCommand after package.name

---
 pkgs/build-support/trivial-builders.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index 2966675be7ca..3c9f3189d2cf 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -749,7 +749,7 @@ rec {
     { package,
       command ? "${package.meta.mainProgram or package.pname or package.name} --version",
       version ? package.version,
-    }: runCommand "test-version" { nativeBuildInputs = [ package ]; meta.timeout = 60; } ''
+    }: runCommand "${package.name}-test-version" { nativeBuildInputs = [ package ]; meta.timeout = 60; } ''
       ${command} |& grep -Fw ${version}
       touch $out
     '';

From 2175b157acf1fd338021bc162ec7c4d6d7f90306 Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Sat, 20 Nov 2021 17:50:41 -0800
Subject: [PATCH 12/31] treewide: refactor isi686 && isx86_64 -> isx86

---
 nixos/lib/make-zfs-image.nix                          | 2 +-
 nixos/lib/qemu-common.nix                             | 2 +-
 nixos/modules/hardware/all-firmware.nix               | 2 +-
 nixos/modules/installer/cd-dvd/iso-image.nix          | 2 +-
 nixos/modules/system/boot/kernel.nix                  | 2 +-
 nixos/modules/virtualisation/azure-agent.nix          | 2 +-
 nixos/modules/virtualisation/qemu-vm.nix              | 4 ++--
 nixos/modules/virtualisation/virtualbox-guest.nix     | 2 +-
 nixos/modules/virtualisation/vmware-guest.nix         | 2 +-
 nixos/tests/installer.nix                             | 2 +-
 pkgs/applications/graphics/krita/generic.nix          | 2 +-
 pkgs/applications/science/logic/monosat/default.nix   | 2 +-
 pkgs/applications/video/mplayer/default.nix           | 2 +-
 pkgs/build-support/vm/default.nix                     | 2 +-
 pkgs/desktops/gnome/core/gnome-software/default.nix   | 2 +-
 pkgs/development/compilers/ocaml/ber-metaocaml.nix    | 2 +-
 pkgs/development/compilers/sbcl/common.nix            | 4 ++--
 pkgs/development/interpreters/clisp/default.nix       | 4 ++--
 pkgs/development/interpreters/clisp/hg.nix            | 4 ++--
 pkgs/development/libraries/SDL2_gfx/default.nix       | 2 +-
 pkgs/development/libraries/glibc/common.nix           | 2 +-
 pkgs/development/libraries/libimagequant/default.nix  | 2 +-
 pkgs/development/libraries/opencolorio/1.x.nix        | 2 +-
 pkgs/development/libraries/pcl/default.nix            | 2 +-
 pkgs/development/libraries/x264/default.nix           | 2 +-
 pkgs/development/python-modules/pyqtgraph/default.nix | 2 +-
 pkgs/os-specific/linux/fbterm/default.nix             | 2 +-
 pkgs/os-specific/linux/firmware/fwupd/default.nix     | 2 +-
 pkgs/os-specific/linux/read-edid/default.nix          | 4 ++--
 pkgs/os-specific/linux/rtl8812au/default.nix          | 2 +-
 pkgs/tools/graphics/pngquant/default.nix              | 2 +-
 pkgs/tools/misc/ipxe/default.nix                      | 6 +++---
 pkgs/tools/networking/fastd/default.nix               | 2 +-
 pkgs/tools/security/mkp224o/default.nix               | 2 +-
 pkgs/top-level/all-packages.nix                       | 2 +-
 35 files changed, 42 insertions(+), 42 deletions(-)

diff --git a/nixos/lib/make-zfs-image.nix b/nixos/lib/make-zfs-image.nix
index 40648ca24d4d..a84732aa1171 100644
--- a/nixos/lib/make-zfs-image.nix
+++ b/nixos/lib/make-zfs-image.nix
@@ -241,7 +241,7 @@ let
     pkgs.vmTools.override {
       rootModules =
         [ "zfs" "9p" "9pnet_virtio" "virtio_pci" "virtio_blk" ] ++
-          (pkgs.lib.optional (pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64) "rtc_cmos");
+          (pkgs.lib.optional pkgs.stdenv.hostPlatform.isx86 "rtc_cmos");
       kernel = modulesTree;
     }
   ).runInLinuxVM (
diff --git a/nixos/lib/qemu-common.nix b/nixos/lib/qemu-common.nix
index 84f9060acd63..1a1f7531feb0 100644
--- a/nixos/lib/qemu-common.nix
+++ b/nixos/lib/qemu-common.nix
@@ -17,7 +17,7 @@ rec {
       ''-netdev vde,id=vlan${toString nic},sock="$QEMU_VDE_SOCKET_${toString net}"''
     ];
 
-  qemuSerialDevice = if pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64 then "ttyS0"
+  qemuSerialDevice = if pkgs.stdenv.hostPlatform.isx86 then "ttyS0"
         else if (with pkgs.stdenv.hostPlatform; isAarch32 || isAarch64 || isPower) then "ttyAMA0"
         else throw "Unknown QEMU serial device for system '${pkgs.stdenv.hostPlatform.system}'";
 
diff --git a/nixos/modules/hardware/all-firmware.nix b/nixos/modules/hardware/all-firmware.nix
index bdf90816740c..ce87f9e8be8a 100644
--- a/nixos/modules/hardware/all-firmware.nix
+++ b/nixos/modules/hardware/all-firmware.nix
@@ -83,7 +83,7 @@ in {
         b43Firmware_5_1_138
         b43Firmware_6_30_163_46
         b43FirmwareCutter
-      ] ++ optional (pkgs.stdenv.hostPlatform.isi686 || pkgs.stdenv.hostPlatform.isx86_64) facetimehd-firmware;
+      ] ++ optional pkgs.stdenv.hostPlatform.isx86 facetimehd-firmware;
     })
     (mkIf cfg.wirelessRegulatoryDatabase {
       hardware.firmware = [ pkgs.wireless-regdb ];
diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index 4812cacabaf3..30610b4f4260 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -467,7 +467,7 @@ let
       throw "Unsupported architecture";
 
   # Syslinux (and isolinux) only supports x86-based architectures.
-  canx86BiosBoot = pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64;
+  canx86BiosBoot = pkgs.stdenv.hostPlatform.isx86;
 
 in
 
diff --git a/nixos/modules/system/boot/kernel.nix b/nixos/modules/system/boot/kernel.nix
index 4a9da9394519..d147155d796c 100644
--- a/nixos/modules/system/boot/kernel.nix
+++ b/nixos/modules/system/boot/kernel.nix
@@ -243,7 +243,7 @@ in
             "hid_generic" "hid_lenovo" "hid_apple" "hid_roccat"
             "hid_logitech_hidpp" "hid_logitech_dj" "hid_microsoft"
 
-          ] ++ optionals (pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64) [
+          ] ++ optionals pkgs.stdenv.hostPlatform.isx86 [
             # Misc. x86 keyboard stuff.
             "pcips2" "atkbd" "i8042"
 
diff --git a/nixos/modules/virtualisation/azure-agent.nix b/nixos/modules/virtualisation/azure-agent.nix
index 41f3fa0e6642..bd8c7f8c1eea 100644
--- a/nixos/modules/virtualisation/azure-agent.nix
+++ b/nixos/modules/virtualisation/azure-agent.nix
@@ -76,7 +76,7 @@ in
 
   config = mkIf cfg.enable {
     assertions = [ {
-      assertion = pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64;
+      assertion = pkgs.stdenv.hostPlatform.isx86;
       message = "Azure not currently supported on ${pkgs.stdenv.hostPlatform.system}";
     } {
       assertion = config.networking.networkmanager.enable == false;
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 0c2782d3e027..e9802f2bd9cd 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -97,7 +97,7 @@ let
     imap1 (idx: drive: drive // { device = driveDeviceName idx; });
 
   efiPrefix =
-    if (pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64) then "${pkgs.OVMF.fd}/FV/OVMF"
+    if pkgs.stdenv.hostPlatform.isx86 then "${pkgs.OVMF.fd}/FV/OVMF"
     else if pkgs.stdenv.isAarch64 then "${pkgs.OVMF.fd}/FV/AAVMF"
     else throw "No EFI firmware available for platform";
   efiFirmware = "${efiPrefix}_CODE.fd";
@@ -833,7 +833,7 @@ in
 
     # FIXME: Consolidate this one day.
     virtualisation.qemu.options = mkMerge [
-      (mkIf (pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64) [
+      (mkIf pkgs.stdenv.hostPlatform.isx86 [
         "-usb" "-device usb-tablet,bus=usb-bus.0"
       ])
       (mkIf (pkgs.stdenv.isAarch32 || pkgs.stdenv.isAarch64) [
diff --git a/nixos/modules/virtualisation/virtualbox-guest.nix b/nixos/modules/virtualisation/virtualbox-guest.nix
index 486951983d30..f702fb4e525c 100644
--- a/nixos/modules/virtualisation/virtualbox-guest.nix
+++ b/nixos/modules/virtualisation/virtualbox-guest.nix
@@ -33,7 +33,7 @@ in
 
   config = mkIf cfg.enable (mkMerge [{
     assertions = [{
-      assertion = pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64;
+      assertion = pkgs.stdenv.hostPlatform.isx86;
       message = "Virtualbox not currently supported on ${pkgs.stdenv.hostPlatform.system}";
     }];
 
diff --git a/nixos/modules/virtualisation/vmware-guest.nix b/nixos/modules/virtualisation/vmware-guest.nix
index 480a9703cef3..09b26eeb33a9 100644
--- a/nixos/modules/virtualisation/vmware-guest.nix
+++ b/nixos/modules/virtualisation/vmware-guest.nix
@@ -23,7 +23,7 @@ in
 
   config = mkIf cfg.enable {
     assertions = [ {
-      assertion = pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64;
+      assertion = pkgs.stdenv.hostPlatform.isx86;
       message = "VMWare guest is not currently supported on ${pkgs.stdenv.hostPlatform.system}";
     } ];
 
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 73dc676ca32d..513d2506e941 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -70,7 +70,7 @@ let
     let iface = if grubVersion == 1 then "ide" else "virtio";
         isEfi = bootLoader == "systemd-boot" || (bootLoader == "grub" && grubUseEfi);
         bios  = if pkgs.stdenv.isAarch64 then "QEMU_EFI.fd" else "OVMF.fd";
-    in if !isEfi && !(pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64) then
+    in if !isEfi && !pkgs.stdenv.hostPlatform.isx86 then
       throw "Non-EFI boot methods are only supported on i686 / x86_64"
     else ''
       def assemble_qemu_flags():
diff --git a/pkgs/applications/graphics/krita/generic.nix b/pkgs/applications/graphics/krita/generic.nix
index efaf341b1f64..a0819a203e72 100644
--- a/pkgs/applications/graphics/krita/generic.nix
+++ b/pkgs/applications/graphics/krita/generic.nix
@@ -32,7 +32,7 @@ mkDerivation rec {
     openjpeg opencolorio_1 poppler curl ilmbase
     qtmultimedia qtx11extras quazip
     python3Packages.pyqt5
-  ] ++ lib.optional (stdenv.hostPlatform.isi686 || stdenv.hostPlatform.isx86_64) vc;
+  ] ++ lib.optional stdenv.hostPlatform.isx86 vc;
 
   NIX_CFLAGS_COMPILE = [ "-I${ilmbase.dev}/include/OpenEXR" ]
     ++ lib.optional stdenv.cc.isGNU "-Wno-deprecated-copy";
diff --git a/pkgs/applications/science/logic/monosat/default.nix b/pkgs/applications/science/logic/monosat/default.nix
index b26c122064a8..1356c88d478f 100644
--- a/pkgs/applications/science/logic/monosat/default.nix
+++ b/pkgs/applications/science/logic/monosat/default.nix
@@ -31,7 +31,7 @@ let
   # source behind __linux__ check assumes system is also x86 and
   # tries to disable x86/x87-specific extended precision mode
   # https://github.com/sambayless/monosat/issues/33
-  commonPostPatch = lib.optionalString (!(stdenv.isi686 || stdenv.isx86_64)) ''
+  commonPostPatch = lib.optionalString (!stdenv.hostPlatform.isx86) ''
     substituteInPlace src/monosat/Main.cc \
       --replace 'defined(__linux__)' '0'
   '';
diff --git a/pkgs/applications/video/mplayer/default.nix b/pkgs/applications/video/mplayer/default.nix
index 644e35468fb5..1715ce4a6a17 100644
--- a/pkgs/applications/video/mplayer/default.nix
+++ b/pkgs/applications/video/mplayer/default.nix
@@ -174,7 +174,7 @@ stdenv.mkDerivation rec {
          (useUnfreeCodecs && codecs != null && !crossBuild)
          "--codecsdir=${codecs}"
     ++ optional
-         ((stdenv.hostPlatform.isi686 || stdenv.hostPlatform.isx86_64) && !crossBuild)
+         (stdenv.hostPlatform.isx86 && !crossBuild)
          "--enable-runtime-cpudetection"
     ++ optional fribidiSupport "--enable-fribidi"
     ++ optional stdenv.isLinux "--enable-vidix"
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 09a56fda7b7f..3f176db36c2b 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -5,7 +5,7 @@
 , storeDir ? builtins.storeDir
 , rootModules ?
     [ "virtio_pci" "virtio_mmio" "virtio_blk" "virtio_balloon" "virtio_rng" "ext4" "unix" "9p" "9pnet_virtio" "crc32c_generic" ]
-      ++ pkgs.lib.optional (pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64) "rtc_cmos"
+      ++ pkgs.lib.optional pkgs.stdenv.hostPlatform.isx86 "rtc_cmos"
 }:
 
 let
diff --git a/pkgs/desktops/gnome/core/gnome-software/default.nix b/pkgs/desktops/gnome/core/gnome-software/default.nix
index 7ee3a51aba2e..61edbe9679d6 100644
--- a/pkgs/desktops/gnome/core/gnome-software/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-software/default.nix
@@ -37,7 +37,7 @@
 }:
 
 let
-  withFwupd = stdenv.isx86_64 || stdenv.isi686;
+  withFwupd = stdenv.hostPlatform.isx86;
 in
 
 stdenv.mkDerivation rec {
diff --git a/pkgs/development/compilers/ocaml/ber-metaocaml.nix b/pkgs/development/compilers/ocaml/ber-metaocaml.nix
index d3ab0d6e1c60..895706312c14 100644
--- a/pkgs/development/compilers/ocaml/ber-metaocaml.nix
+++ b/pkgs/development/compilers/ocaml/ber-metaocaml.nix
@@ -4,7 +4,7 @@
 }:
 
 let
-   useX11 = stdenv.isi686 || stdenv.isx86_64;
+   useX11 = stdenv.hostPlatform.isx86;
    x11deps = [ libX11 xorgproto ];
    inherit (lib) optionals;
 
diff --git a/pkgs/development/compilers/sbcl/common.nix b/pkgs/development/compilers/sbcl/common.nix
index d2450315eb59..9cfb38109f7b 100644
--- a/pkgs/development/compilers/sbcl/common.nix
+++ b/pkgs/development/compilers/sbcl/common.nix
@@ -2,8 +2,8 @@
 
 { lib, stdenv, fetchurl, fetchpatch, writeText, sbclBootstrap
 , sbclBootstrapHost ? "${sbclBootstrap}/bin/sbcl --disable-debugger --no-userinit --no-sysinit"
-, threadSupport ? (stdenv.isi686 || stdenv.isx86_64 || "aarch64-linux" == stdenv.hostPlatform.system || "aarch64-darwin" == stdenv.hostPlatform.system)
-, linkableRuntime ? (stdenv.isi686 || stdenv.isx86_64)
+, threadSupport ? (stdenv.hostPlatform.isx86 || "aarch64-linux" == stdenv.hostPlatform.system || "aarch64-darwin" == stdenv.hostPlatform.system)
+, linkableRuntime ? stdenv.hostPlatform.isx86
 , disableImmobileSpace ? false
   # Meant for sbcl used for creating binaries portable to non-NixOS via save-lisp-and-die.
   # Note that the created binaries still need `patchelf --set-interpreter ...`
diff --git a/pkgs/development/interpreters/clisp/default.nix b/pkgs/development/interpreters/clisp/default.nix
index 137ebbccbc71..2a387d34f470 100644
--- a/pkgs/development/interpreters/clisp/default.nix
+++ b/pkgs/development/interpreters/clisp/default.nix
@@ -9,8 +9,8 @@
 , libffcall
 , coreutils
 # build options
-, threadSupport ? (stdenv.isi686 || stdenv.isx86_64)
-, x11Support ? (stdenv.isi686 || stdenv.isx86_64)
+, threadSupport ? stdenv.hostPlatform.isx86
+, x11Support ? stdenv.hostPlatform.isx86
 , dllSupport ? true
 , withModules ? [
     "pcre"
diff --git a/pkgs/development/interpreters/clisp/hg.nix b/pkgs/development/interpreters/clisp/hg.nix
index 83a1870d182b..7ab4134facb9 100644
--- a/pkgs/development/interpreters/clisp/hg.nix
+++ b/pkgs/development/interpreters/clisp/hg.nix
@@ -8,8 +8,8 @@
 , libffi, libffcall, automake
 , coreutils
 # build options
-, threadSupport ? (stdenv.isi686 || stdenv.isx86_64)
-, x11Support ? (stdenv.isi686 || stdenv.isx86_64)
+, threadSupport ? stdenv.hostPlatform.isx86
+, x11Support ? stdenv.hostPlatform.isx86
 , dllSupport ? true
 , withModules ? [
     "pcre"
diff --git a/pkgs/development/libraries/SDL2_gfx/default.nix b/pkgs/development/libraries/SDL2_gfx/default.nix
index 783dedc5c78d..3d599c39c05b 100644
--- a/pkgs/development/libraries/SDL2_gfx/default.nix
+++ b/pkgs/development/libraries/SDL2_gfx/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ SDL2 ]
     ++ lib.optional stdenv.isDarwin darwin.libobjc;
 
-  configureFlags = [(if stdenv.isi686 || stdenv.isx86_64 then "--enable-mmx" else "--disable-mmx")]
+  configureFlags = [(if stdenv.hostPlatform.isx86 then "--enable-mmx" else "--disable-mmx")]
      ++ lib.optional stdenv.isDarwin "--disable-sdltest";
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 91281f9cd244..57c2e259e066 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -161,7 +161,7 @@ stdenv.mkDerivation ({
       "--enable-bind-now"
       (lib.withFeatureAs withLinuxHeaders "headers" "${linuxHeaders}/include")
       (lib.enableFeature profilingLibraries "profile")
-    ] ++ lib.optionals (stdenv.hostPlatform.isx86_64 || stdenv.hostPlatform.isi686 || stdenv.hostPlatform.isAarch64) [
+    ] ++ lib.optionals (stdenv.hostPlatform.isx86 || stdenv.hostPlatform.isAarch64) [
       # This feature is currently supported on
       # i386, x86_64 and x32 with binutils 2.29 or later,
       # and on aarch64 with binutils 2.30 or later.
diff --git a/pkgs/development/libraries/libimagequant/default.nix b/pkgs/development/libraries/libimagequant/default.nix
index 8a5751411486..348f610bf183 100644
--- a/pkgs/development/libraries/libimagequant/default.nix
+++ b/pkgs/development/libraries/libimagequant/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     patchShebangs ./configure
   '';
 
-  configureFlags = lib.optionals (!stdenv.isi686 && !stdenv.isx86_64) [ "--disable-sse" ];
+  configureFlags = lib.optionals (!stdenv.hostPlatform.isx86) [ "--disable-sse" ];
 
   meta = with lib; {
     homepage = "https://pngquant.org/lib/";
diff --git a/pkgs/development/libraries/opencolorio/1.x.nix b/pkgs/development/libraries/opencolorio/1.x.nix
index 041ddf8e8371..1b58faf54438 100644
--- a/pkgs/development/libraries/opencolorio/1.x.nix
+++ b/pkgs/development/libraries/opencolorio/1.x.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     # External libyamlcpp 0.6.* not compatible: https://github.com/imageworks/OpenColorIO/issues/517
     "-DUSE_EXTERNAL_YAML=OFF"
   ] ++ lib.optional stdenv.isDarwin "-DOCIO_USE_BOOST_PTR=ON"
-    ++ lib.optional (!stdenv.hostPlatform.isi686 && !stdenv.hostPlatform.isx86_64) "-DOCIO_USE_SSE=OFF";
+    ++ lib.optional (!stdenv.hostPlatform.isx86) "-DOCIO_USE_SSE=OFF";
 
   postInstall = ''
     mkdir -p $bin/bin; mv $out/bin $bin/
diff --git a/pkgs/development/libraries/pcl/default.nix b/pkgs/development/libraries/pcl/default.nix
index 8afcdbf33f23..bbc2bd8cc6f3 100644
--- a/pkgs/development/libraries/pcl/default.nix
+++ b/pkgs/development/libraries/pcl/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   # remove attempt to prevent (x86/x87-specific) extended precision use
   # when SSE not detected
-  postPatch = lib.optionalString (!(stdenv.isi686 || stdenv.isx86_64)) ''
+  postPatch = lib.optionalString (!stdenv.hostPlatform.isx86) ''
     sed -i '/-ffloat-store/d' cmake/pcl_find_sse.cmake
   '';
 
diff --git a/pkgs/development/libraries/x264/default.nix b/pkgs/development/libraries/x264/default.nix
index 57d0c0a4d632..2c9f476313ec 100644
--- a/pkgs/development/libraries/x264/default.nix
+++ b/pkgs/development/libraries/x264/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional (!stdenv.isi686) "--enable-pic"
     ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) "--cross-prefix=${stdenv.cc.targetPrefix}";
 
-  nativeBuildInputs = lib.optional (stdenv.hostPlatform.isx86_64 || stdenv.hostPlatform.isi686) nasm;
+  nativeBuildInputs = lib.optional stdenv.hostPlatform.isx86 nasm;
 
   meta = with lib; {
     description = "Library for encoding H264/AVC video streams";
diff --git a/pkgs/development/python-modules/pyqtgraph/default.nix b/pkgs/development/python-modules/pyqtgraph/default.nix
index 854af36e5bcd..af5567acc8d3 100644
--- a/pkgs/development/python-modules/pyqtgraph/default.nix
+++ b/pkgs/development/python-modules/pyqtgraph/default.nix
@@ -53,7 +53,7 @@ buildPythonPackage rec {
     export FONTCONFIG_FILE=${fontsConf}
   '';
 
-  disabledTests = lib.optionals (!(stdenv.isi686 || stdenv.isx86_64)) [
+  disabledTests = lib.optionals (!stdenv.hostPlatform.isx86) [
     # small precision-related differences on other architectures,
     # upstream doesn't consider it serious.
     # https://github.com/pyqtgraph/pyqtgraph/issues/2110
diff --git a/pkgs/os-specific/linux/fbterm/default.nix b/pkgs/os-specific/linux/fbterm/default.nix
index 4fdbb06c5217..ecf1b5e2b314 100644
--- a/pkgs/os-specific/linux/fbterm/default.nix
+++ b/pkgs/os-specific/linux/fbterm/default.nix
@@ -9,7 +9,7 @@ let
       sha256 = "0pciv5by989vzvjxsv1jsv4bdp4m8j0nfbl29jm5fwi12w4603vj";
     };
   buildInputs = [ gpm freetype fontconfig ncurses ]
-    ++ lib.optional (stdenv.isi686 || stdenv.isx86_64) libx86;
+    ++ lib.optional stdenv.hostPlatform.isx86 libx86;
 in
 stdenv.mkDerivation {
   inherit (s) pname version;
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 0333a9e43105..e6c43c0aa6e4 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -58,7 +58,7 @@ let
     setuptools
   ]);
 
-  isx86 = stdenv.isx86_64 || stdenv.isi686;
+  isx86 = stdenv.hostPlatform.isx86;
 
   # Dell isn't supported on Aarch64
   haveDell = isx86;
diff --git a/pkgs/os-specific/linux/read-edid/default.nix b/pkgs/os-specific/linux/read-edid/default.nix
index 24ad06749766..7f6d224ff4d5 100644
--- a/pkgs/os-specific/linux/read-edid/default.nix
+++ b/pkgs/os-specific/linux/read-edid/default.nix
@@ -10,9 +10,9 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = lib.optional (stdenv.isi686 || stdenv.isx86_64) libx86;
+  buildInputs = lib.optional stdenv.hostPlatform.isx86 libx86;
 
-  cmakeFlags = [ "-DCLASSICBUILD=${if stdenv.isi686 || stdenv.isx86_64 then "ON" else "OFF"}" ];
+  cmakeFlags = [ "-DCLASSICBUILD=${if stdenv.hostPlatform.isx86 then "ON" else "OFF"}" ];
 
   patchPhase = ''
     substituteInPlace CMakeLists.txt --replace 'COPYING' 'LICENSE'
diff --git a/pkgs/os-specific/linux/rtl8812au/default.nix b/pkgs/os-specific/linux/rtl8812au/default.nix
index 1aab3e03cd95..b385b9a27da0 100644
--- a/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/pkgs/os-specific/linux/rtl8812au/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   makeFlags = [
     "ARCH=${stdenv.hostPlatform.linuxArch}"
     "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-    ("CONFIG_PLATFORM_I386_PC=" + (if (stdenv.hostPlatform.isi686 || stdenv.hostPlatform.isx86_64) then "y" else "n"))
+    ("CONFIG_PLATFORM_I386_PC=" + (if stdenv.hostPlatform.isx86 then "y" else "n"))
     ("CONFIG_PLATFORM_ARM_RPI=" + (if (stdenv.hostPlatform.isAarch32 || stdenv.hostPlatform.isAarch64) then "y" else "n"))
   ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
diff --git a/pkgs/tools/graphics/pngquant/default.nix b/pkgs/tools/graphics/pngquant/default.nix
index bb0ef8581250..dd145d48fc1b 100644
--- a/pkgs/tools/graphics/pngquant/default.nix
+++ b/pkgs/tools/graphics/pngquant/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   preConfigure = "patchShebangs .";
 
-  configureFlags = lib.optionals (!stdenv.isi686 && !stdenv.isx86_64) [ "--disable-sse" ];
+  configureFlags = lib.optionals (!stdenv.hostPlatform.isx86) [ "--disable-sse" ];
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libpng zlib lcms2 ];
diff --git a/pkgs/tools/misc/ipxe/default.nix b/pkgs/tools/misc/ipxe/default.nix
index 70b1ae48ae9c..76ce66e56864 100644
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@@ -9,7 +9,7 @@ let
     "bin-x86_64-efi/ipxe.efi" = null;
     "bin-x86_64-efi/ipxe.efirom" = null;
     "bin-x86_64-efi/ipxe.usb" = "ipxe-efi.usb";
-  } // lib.optionalAttrs (stdenv.isi686 || stdenv.isx86_64) {
+  } // lib.optionalAttrs stdenv.hostPlatform.isx86 {
     "bin/ipxe.dsk" = null;
     "bin/ipxe.usb" = null;
     "bin/ipxe.iso" = null;
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   pname = "ipxe";
   version = "1.21.1";
 
-  nativeBuildInputs = [ perl cdrkit xz openssl gnu-efi mtools ] ++ lib.optional (stdenv.isi686 || stdenv.isx86_64) syslinux;
+  nativeBuildInputs = [ perl cdrkit xz openssl gnu-efi mtools ] ++ lib.optional stdenv.hostPlatform.isx86 syslinux;
 
   src = fetchFromGitHub {
     owner = "ipxe";
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
 
   makeFlags =
     [ "ECHO_E_BIN_ECHO=echo" "ECHO_E_BIN_ECHO_E=echo" # No /bin/echo here.
-    ] ++ lib.optionals (stdenv.isi686 || stdenv.isx86_64) [
+    ] ++ lib.optionals stdenv.hostPlatform.isx86 [
       "ISOLINUX_BIN_LIST=${syslinux}/share/syslinux/isolinux.bin"
       "LDLINUX_C32=${syslinux}/share/syslinux/ldlinux.c32"
     ] ++ lib.optional (embedScript != null) "EMBED=${embedScript}";
diff --git a/pkgs/tools/networking/fastd/default.nix b/pkgs/tools/networking/fastd/default.nix
index 8d1594b8187d..47007e1646ee 100644
--- a/pkgs/tools/networking/fastd/default.nix
+++ b/pkgs/tools/networking/fastd/default.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
   ];
 
   # some options are only available on x86
-  mesonFlags = lib.optionals (!stdenv.isx86_64 && !stdenv.isi686) [
+  mesonFlags = lib.optionals (!stdenv.hostPlatform.isx86) [
     "-Dcipher_salsa20_xmm=disabled"
     "-Dcipher_salsa2012_xmm=disabled"
     "-Dmac_ghash_pclmulqdq=disabled"
diff --git a/pkgs/tools/security/mkp224o/default.nix b/pkgs/tools/security/mkp224o/default.nix
index dc17cc602764..17d8e8ad4ffb 100644
--- a/pkgs/tools/security/mkp224o/default.nix
+++ b/pkgs/tools/security/mkp224o/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
       variants = [
         { suffix = "ref10";         configureFlags = ["--enable-ref10"]; }
         { suffix = "donna";         configureFlags = ["--enable-donna"]; }
-      ] ++ lib.optionals (stdenv.isi686 || stdenv.isx86_64) [
+      ] ++ lib.optionals stdenv.hostPlatform.isx86 [
         { suffix = "donna-sse2";    configureFlags = ["--enable-donna-sse2"]; }
       ] ++ lib.optionals stdenv.isx86_64 [
         { suffix = "amd64-51-30k";  configureFlags = ["--enable-amd64-51-30k"]; }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e1dc55d20c1f..78472c9abba8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11607,7 +11607,7 @@ with pkgs;
     if ccWrapper.isGNU then ccWrapper.overrideAttrs(old: {
       cc = old.cc.override {
         reproducibleBuild = false;
-        profiledCompiler = with stdenv; (!isDarwin && (isi686 || isx86_64));
+        profiledCompiler = with stdenv; (!isDarwin && hostPlatform.isx86);
       };
     }) else ccWrapper;
 

From c2409db926de4b7435e14e8366e8d08b0f69fd12 Mon Sep 17 00:00:00 2001
From: oxalica <oxalicc@pm.me>
Date: Tue, 16 Nov 2021 18:40:02 +0800
Subject: [PATCH 13/31] firefox: remove unnecessary make flags and LD_FLAGS

Since we are using LLVM stdenv when enabling LTO, there are no need to
manually specify them.
---
 .../networking/browsers/firefox/common.nix          | 13 +------------
 1 file changed, 1 insertion(+), 12 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 1c0832e32ca2..99a71ab86a88 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -174,10 +174,6 @@ buildStdenv.mkDerivation ({
                                           AVFoundation MediaToolbox CoreLocation
                                           Foundation libobjc AddressBook cups ];
 
-  NIX_LDFLAGS = lib.optionalString ltoSupport ''
-    -rpath ${llvmPackages.libunwind.out}/lib
-  '';
-
   MACH_USE_SYSTEM_PYTHON = "1";
 
   postPatch = ''
@@ -297,14 +293,7 @@ buildStdenv.mkDerivation ({
     cd obj-*
   '';
 
-  makeFlags = lib.optionals ltoSupport [
-    "AR=${buildStdenv.cc.bintools.bintools}/bin/llvm-ar"
-    "LLVM_OBJDUMP=${buildStdenv.cc.bintools.bintools}/bin/llvm-objdump"
-    "NM=${buildStdenv.cc.bintools.bintools}/bin/llvm-nm"
-    "RANLIB=${buildStdenv.cc.bintools.bintools}/bin/llvm-ranlib"
-    "STRIP=${buildStdenv.cc.bintools.bintools}/bin/llvm-strip"
-  ]
-  ++ extraMakeFlags;
+  makeFlags = extraMakeFlags;
 
   enableParallelBuilding = true;
   doCheck = false; # "--disable-tests" above

From 8d4bef7124cfab618d25113ef22d0852b0e33387 Mon Sep 17 00:00:00 2001
From: oxalica <oxalicc@pm.me>
Date: Tue, 16 Nov 2021 18:38:56 +0800
Subject: [PATCH 14/31] firefox: enable separated debug symbols

---
 .../networking/browsers/firefox/common.nix    | 64 ++++++++++++++++---
 1 file changed, 54 insertions(+), 10 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 99a71ab86a88..41ed625779d4 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -71,6 +71,9 @@
 # > the experience of Firefox users, you won't have any issues using the
 # > official branding.
 , enableOfficialBranding ? true
+
+# On 32bit platforms, we disable adding "-g" for easier linking.
+, enableDebugSymbols ? !stdenv.is32bit
 }:
 
 assert stdenv.cc.libc or null != null;
@@ -116,12 +119,6 @@ let
                 })
                 else stdenv;
 
-  # --enable-release adds -ffunction-sections & LTO that require a big amount of
-  # RAM and the 32-bit memory space cannot handle that linking
-  # We also disable adding "-g" for easier linking
-  releaseFlags = if stdenv.is32bit
-                 then [ "--disable-release" "--disable-debug-symbols" ]
-                 else [ "--enable-release" ];
 in
 
 buildStdenv.mkDerivation ({
@@ -202,6 +199,9 @@ buildStdenv.mkDerivation ({
     ++ lib.optionals buildStdenv.isDarwin [ xcbuild rsync ]
     ++ extraNativeBuildInputs;
 
+  separateDebugInfo = enableDebugSymbols;
+  setOutputFlags = false; # `./mach configure` doesn't understand `--*dir=` flags.
+
   preConfigure = ''
     # remove distributed configuration files
     rm -f configure
@@ -225,7 +225,11 @@ buildStdenv.mkDerivation ({
       ${lib.optionalString buildStdenv.cc.isClang "-idirafter ${buildStdenv.cc.cc.lib}/lib/clang/${lib.getVersion buildStdenv.cc.cc}/include"} \
       ${lib.optionalString buildStdenv.cc.isGNU "-isystem ${lib.getDev buildStdenv.cc.cc}/include/c++/${lib.getVersion buildStdenv.cc.cc} -isystem ${buildStdenv.cc.cc}/include/c++/${lib.getVersion buildStdenv.cc.cc}/${buildStdenv.hostPlatform.config}"} \
       $NIX_CFLAGS_COMPILE"
-
+    ${
+    # Bindgen doesn't like the flag added by `separateDebugInfo`.
+    lib.optionalString enableDebugSymbols ''
+      BINDGEN_CFLAGS="''${BINDGEN_CFLAGS/ -Wa,--compress-debug-sections/}"
+    ''}
     echo "ac_add_options BINDGEN_CFLAGS='$BINDGEN_CFLAGS'" >> $MOZCONFIG
   '' + (lib.optionalString googleAPISupport ''
     # Google API key used by Chromium and Firefox.
@@ -283,9 +287,13 @@ buildStdenv.mkDerivation ({
   ++ lib.optional drmSupport "--enable-eme=widevine"
 
   ++ (if debugBuild then [ "--enable-debug" "--enable-profiling" ]
-                    else ([ "--disable-debug"
-                           "--enable-optimize"
-                           "--enable-strip" ] ++ releaseFlags))
+                    else [ "--disable-debug" "--enable-optimize" ])
+  # --enable-release adds -ffunction-sections & LTO that require a big amount of
+  # RAM and the 32-bit memory space cannot handle that linking
+  ++ flag (!debugBuild && !stdenv.is32bit) "release"
+  ++ flag enableDebugSymbols "debug-symbols"
+  ++ lib.optionals enableDebugSymbols [ "--disable-strip" "--disable-install-strip" ]
+
   ++ lib.optional enableOfficialBranding "--enable-official-branding"
   ++ extraConfigureFlags;
 
@@ -311,6 +319,42 @@ buildStdenv.mkDerivation ({
     gappsWrapperArgs+=(--argv0 "$out/bin/.${binaryName}-wrapped")
   '';
 
+  # Workaround: The separateDebugInfo hook skips artifacts whose build ID's length is not 40.
+  # But we got 16-length build ID here. The function body is mainly copied from pkgs/build-support/setup-hooks/separate-debug-info.sh
+  # Remove it when PR #146275 is merged.
+  preFixup = lib.optionalString enableDebugSymbols ''
+    _separateDebugInfo() {
+        [ -e "$prefix" ] || return 0
+
+        local dst="''${debug:-$out}"
+        if [ "$prefix" = "$dst" ]; then return 0; fi
+
+        dst="$dst/lib/debug/.build-id"
+
+        # Find executables and dynamic libraries.
+        local i
+        while IFS= read -r -d $'\0' i; do
+            if ! isELF "$i"; then continue; fi
+
+            # Extract the Build ID. FIXME: there's probably a cleaner way.
+            local id="$($READELF -n "$i" | sed 's/.*Build ID: \([0-9a-f]*\).*/\1/; t; d')"
+            if [[ -z "$id" ]]; then
+                echo "could not find build ID of $i, skipping" >&2
+                continue
+            fi
+
+            # Extract the debug info.
+            header "separating debug info from $i (build ID $id)"
+            mkdir -p "$dst/''${id:0:2}"
+            $OBJCOPY --only-keep-debug "$i" "$dst/''${id:0:2}/''${id:2}.debug"
+            $STRIP --strip-debug "$i"
+
+            # Also a create a symlink <original-name>.debug.
+            ln -sfn ".build-id/''${id:0:2}/''${id:2}.debug" "$dst/../$(basename "$i")"
+        done < <(find "$prefix" -type f -print0)
+    }
+  '';
+
   doInstallCheck = true;
   installCheckPhase = ''
     # Some basic testing

From a343380d9dca9305951fe4eca8b58745b4bb3f97 Mon Sep 17 00:00:00 2001
From: oxalica <oxalicc@pm.me>
Date: Fri, 19 Nov 2021 23:44:10 +0800
Subject: [PATCH 15/31] firefox: enable cross-language LTO

---
 pkgs/applications/networking/browsers/firefox/common.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 41ed625779d4..0ac5977653ea 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -273,7 +273,7 @@ buildStdenv.mkDerivation ({
   #   https://bugzilla.mozilla.org/show_bug.cgi?id=1538724
   # elf-hack is broken when using clang+lld:
   #   https://bugzilla.mozilla.org/show_bug.cgi?id=1482204
-  ++ lib.optional ltoSupport "--enable-lto"
+  ++ lib.optional ltoSupport "--enable-lto=cross" # Cross-language LTO.
   ++ lib.optional (ltoSupport && (buildStdenv.isAarch32 || buildStdenv.isi686 || buildStdenv.isx86_64)) "--disable-elf-hack"
   ++ lib.optional (ltoSupport && !buildStdenv.isDarwin) "--enable-linker=lld"
 

From 8a2be27251d9a36c7cbdb684d97c07e481d2c5f4 Mon Sep 17 00:00:00 2001
From: oxalica <oxalicc@pm.me>
Date: Sun, 21 Nov 2021 02:29:37 +0800
Subject: [PATCH 16/31] firefox: disable jemalloc by default to fix crash

---
 pkgs/applications/networking/browsers/firefox/common.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 0ac5977653ea..b0d11bd835b6 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -27,7 +27,9 @@
 , ltoSupport ? (stdenv.isLinux && stdenv.is64bit), overrideCC, buildPackages
 , gssSupport ? true, libkrb5
 , pipewireSupport ? waylandSupport && webrtcSupport, pipewire
-, jemallocSupport ? true, jemalloc
+# Workaround: disabled since currently jemalloc causes crashes with LLVM 13.
+# https://bugzilla.mozilla.org/show_bug.cgi?id=1741454
+, jemallocSupport ? false, jemalloc
 
 ## privacy-related options
 

From 6ba916f5ad7c5634cf2692a996938c644ec72a85 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 21 Nov 2021 10:25:10 +0100
Subject: [PATCH 17/31] python3Packages.qcs-api-client: 0.19.0 -> 0.20.0

---
 pkgs/development/python-modules/qcs-api-client/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/qcs-api-client/default.nix b/pkgs/development/python-modules/qcs-api-client/default.nix
index 78fc11f150ea..dfb237fe2065 100644
--- a/pkgs/development/python-modules/qcs-api-client/default.nix
+++ b/pkgs/development/python-modules/qcs-api-client/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "qcs-api-client";
-  version = "0.19.0";
+  version = "0.20.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-OfhOYvGcBzbirsD05D206b+mAOVvDVAwBvDgCKfXxSw=";
+    sha256 = "sha256-l6n/DUEWIBmnPvt5+TAZ2RnFrYEUwh4nIZa6aQG2lJ0=";
   };
 
   propagatedBuildInputs = [

From 32478d226dc47c9984464f57c4c3062421789e14 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 21 Nov 2021 10:39:11 +0100
Subject: [PATCH 18/31] python3Packages.env-canada: 0.5.16 -> 0.5.17

---
 .../python-modules/env-canada/default.nix            | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/env-canada/default.nix b/pkgs/development/python-modules/env-canada/default.nix
index 23dbf63df691..587dcf149231 100644
--- a/pkgs/development/python-modules/env-canada/default.nix
+++ b/pkgs/development/python-modules/env-canada/default.nix
@@ -8,18 +8,22 @@
 , pillow
 , pytestCheckHook
 , python-dateutil
+, pythonOlder
 , voluptuous
 }:
 
 buildPythonPackage rec {
   pname = "env-canada";
-  version = "0.5.16";
+  version = "0.5.17";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "michaeldavie";
     repo = "env_canada";
     rev = "v${version}";
-    sha256 = "sha256-5Cxpl5iwbBtpwQ9//yhEZNCIzBZgTm/fqAo9PNNxoG4=";
+    sha256 = "sha256-viuBuyGzAUcfb4qSecZsDvoAU++FNhuwNJET/s0qyOI=";
   };
 
   propagatedBuildInputs = [
@@ -49,7 +53,9 @@ buildPythonPackage rec {
     "test_ecradar"
   ];
 
-  pythonImportsCheck = [ "env_canada" ];
+  pythonImportsCheck = [
+    "env_canada"
+  ];
 
   meta = with lib; {
     description = "Python library to get Environment Canada weather data";

From 28aae75929bb2a04a3e789052cb8128c91dfc6bf Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 21 Nov 2021 11:53:10 +0100
Subject: [PATCH 19/31] python3Packages.casbin: 1.9.7 -> 1.11.1

---
 pkgs/development/python-modules/casbin/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/casbin/default.nix b/pkgs/development/python-modules/casbin/default.nix
index 9150e1c5298b..64c69ddaa043 100644
--- a/pkgs/development/python-modules/casbin/default.nix
+++ b/pkgs/development/python-modules/casbin/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "casbin";
-  version = "1.9.7";
+  version = "1.11.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "pycasbin";
     rev = "v${version}";
-    sha256 = "sha256-wNygKs37PtMLij3f+pAh6PNLqQ45cvrpF43Aj+cO8p8=";
+    sha256 = "sha256-gFGYpHd1kp4JMtoe47VbJ0uDnuGQegggbjXaw6nEMR4=";
   };
 
   propagatedBuildInputs = [

From 82ccc7f17b5f70c36568918c386992fa4706faff Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Tue, 9 Nov 2021 21:07:02 +0000
Subject: [PATCH 20/31] libgphoto2: fix cross

Depends on libtool at runtime for libltdl.
---
 .../libraries/libgphoto2/default.nix          | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/libgphoto2/default.nix b/pkgs/development/libraries/libgphoto2/default.nix
index 3e3fa1a725bf..666135f91bb9 100644
--- a/pkgs/development/libraries/libgphoto2/default.nix
+++ b/pkgs/development/libraries/libgphoto2/default.nix
@@ -1,7 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, gettext
+{ lib, stdenv, fetchFromGitHub, buildPackages
+, autoreconfHook, pkg-config, gettext
 , libusb1
 , libtool
 , libexif
+, libgphoto2
 , libjpeg
 }:
 
@@ -16,17 +18,17 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-c7fBl6GBLAU+RL5WFC4PL+n/nEHZUfqIJ9qq1+qNNCg=";
   };
 
-  patches = [];
+  depsBuildBuild = [ pkg-config ];
 
   nativeBuildInputs = [
     autoreconfHook
-    pkg-config
     gettext
     libtool
   ];
 
   buildInputs = [
     libjpeg
+    libtool # for libltdl
     libusb1
   ];
 
@@ -35,9 +37,16 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  postInstall = ''
+  postInstall = let
+    executablePrefix = if stdenv.buildPlatform == stdenv.hostPlatform then
+      "$out"
+    else
+      buildPackages.libgphoto2;
+  in ''
     mkdir -p $out/lib/udev/rules.d
-    $out/lib/libgphoto2/print-camera-list udev-rules version 175 group camera >$out/lib/udev/rules.d/40-gphoto2.rules
+    ${executablePrefix}/lib/libgphoto2/print-camera-list \
+        udev-rules version 175 group camera \
+        >$out/lib/udev/rules.d/40-gphoto2.rules
   '';
 
   meta = {

From 858f0e8ed9ac9b00d03feccb5fb564bf6b75e27a Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 12 Nov 2021 12:23:04 +0000
Subject: [PATCH 21/31] python3.pkgs.keyutils: fix cross

When cross-compiling, tests aren't run, and check inputs aren't
available.  But pytest-runner was a setup requirement, so keyutils
would fail to build without it, even though we weren't running the
tests.  To fix that, drop the pytest-runner setup requirement.
---
 pkgs/development/python-modules/keyutils/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/keyutils/default.nix b/pkgs/development/python-modules/keyutils/default.nix
index 3d1575d8c37f..21eeb11d136c 100644
--- a/pkgs/development/python-modules/keyutils/default.nix
+++ b/pkgs/development/python-modules/keyutils/default.nix
@@ -12,6 +12,10 @@ buildPythonPackage rec {
     sha256 = "0pfqfr5xqgsqkxzrmj8xl2glyl4nbq0irs0k6ik7iy3gd3mxf5g1";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py --replace '"pytest-runner"' ""
+  '';
+
   buildInputs = [ keyutils ];
   checkInputs = [ pytest pytest-runner ];
 

From f508ae889415b51263ea1c20b6b4c0e0ecbfc0bd Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Sat, 13 Nov 2021 22:03:55 +0000
Subject: [PATCH 22/31] mirrors: add kernel.org mirrors where appropriate

---
 pkgs/build-support/fetchurl/mirrors.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index 3ab4be4d8be2..e4d6f02a94bd 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -151,6 +151,7 @@
   cpan = [
     "https://cpan.metacpan.org/"
     "https://cpan.perl.org/"
+    "https://mirrors.kernel.org/CPAN/"
     "https://backpan.perl.org/"  # for old releases
   ];
 
@@ -171,6 +172,7 @@
   debian = [
     "https://httpredir.debian.org/debian/"
     "https://ftp.debian.org/debian/"
+    "https://mirrors.edge.kernel.org/debian/"
     "ftp://ftp.de.debian.org/debian/"
     "ftp://ftp.fr.debian.org/debian/"
     "ftp://ftp.nl.debian.org/debian/"
@@ -183,6 +185,7 @@
   ubuntu = [
     "https://nl.archive.ubuntu.com/ubuntu/"
     "https://old-releases.ubuntu.com/ubuntu/"
+    "https://mirrors.edge.kernel.org/ubuntu/"
     "http://de.archive.ubuntu.com/ubuntu/"
     "http://archive.ubuntu.com/ubuntu/"
   ];
@@ -206,6 +209,7 @@
     "https://ftp.funet.fi/pub/linux/mirrors/opensuse/distribution/"
     "https://ftp.opensuse.org/pub/opensuse/distribution/"
     "https://ftp5.gwdg.de/pub/opensuse/discontinued/distribution/"
+    "https://mirrors.edge.kernel.org/opensuse/distribution/"
     "http://ftp.hosteurope.de/mirror/ftp.opensuse.org/discontinued/"
   ];
 

From 46c3452a16a030c20cf2f842ee3820cf6bebd0a3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Mancilla?= <smancill@smancill.dev>
Date: Sun, 21 Nov 2021 01:05:37 -0300
Subject: [PATCH 23/31] python3Packages.pyahocorasick: fix build on Hydra
 (x86_64-darwin)

Tests need write access to /tmp, which fails on Hydra (x86_64-darwin).
Use $TMPDIR instead.
---
 pkgs/development/python-modules/pyahocorasick/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/pyahocorasick/default.nix b/pkgs/development/python-modules/pyahocorasick/default.nix
index 87d1d0c9fc01..7bb2f7c988a9 100644
--- a/pkgs/development/python-modules/pyahocorasick/default.nix
+++ b/pkgs/development/python-modules/pyahocorasick/default.nix
@@ -15,6 +15,11 @@ buildPythonPackage rec {
     sha256 = "13x3718if28l50474xrz1b9709kvnvdg3nzm6y8bh7mc9a4zyss5";
   };
 
+  postPatch = ''
+    substituteInPlace unittests.py \
+        --replace '(tmp, "test.dat")' "(\"$TMPDIR\", \"test.dat\")"
+  '';
+
   checkInputs = [ pytestCheckHook ];
 
   pytestFlagsArray = [ "unittests.py" ];

From 09a54b14cd1abb87c7f9e5357cd0030f9d8aefda Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Mancilla?= <smancill@smancill.dev>
Date: Sat, 20 Nov 2021 23:13:12 -0300
Subject: [PATCH 24/31] fluent-bit: fix build on darwin

- Update fix-luajit-darwin.patch to apply to the current version.

- Add a patch to fix compilation of cmetrics on darwin.

- Use default stdenv instead of gccStdenv. The only requirement for GCC
  was the bundled luajit having 'DEFAULT_CC = gcc' hardcoded, but it has
  been fixed with the updated fix-luajit-darwin.patch by adding
  DEFAULT_CC=cc to the arguments.
---
 pkgs/tools/misc/fluent-bit/default.nix        |  7 +++--
 .../misc/fluent-bit/fix-cmetrics-darwin.patch | 23 ++++++++++++++
 .../misc/fluent-bit/fix-luajit-darwin.patch   | 31 ++++++++++++++-----
 pkgs/top-level/all-packages.nix               |  4 +--
 4 files changed, 52 insertions(+), 13 deletions(-)
 create mode 100644 pkgs/tools/misc/fluent-bit/fix-cmetrics-darwin.patch

diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index 795e2b39b7b2..713b1df0c4e9 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -11,14 +11,17 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-b+MZuZQB/sl0HcioU1KCxH3TNiXYSPBfC9dBKqCVeXk=";
   };
 
+  patches = lib.optionals stdenv.isDarwin [
+    ./fix-cmetrics-darwin.patch
+    ./fix-luajit-darwin.patch
+  ];
+
   nativeBuildInputs = [ cmake flex bison ];
 
   buildInputs = lib.optionals stdenv.isLinux [ systemd ];
 
   cmakeFlags = [ "-DFLB_METRICS=ON" "-DFLB_HTTP_SERVER=ON" ];
 
-  patches = lib.optionals stdenv.isDarwin [ ./fix-luajit-darwin.patch ];
-
   # _FORTIFY_SOURCE requires compiling with optimization (-O)
   NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-O";
 
diff --git a/pkgs/tools/misc/fluent-bit/fix-cmetrics-darwin.patch b/pkgs/tools/misc/fluent-bit/fix-cmetrics-darwin.patch
new file mode 100644
index 000000000000..8bd77605cbc0
--- /dev/null
+++ b/pkgs/tools/misc/fluent-bit/fix-cmetrics-darwin.patch
@@ -0,0 +1,23 @@
+diff --git i/lib/cmetrics/src/cmt_time.c w/lib/cmetrics/src/cmt_time.c
+--- i/lib/cmetrics/src/cmt_time.c
++++ w/lib/cmetrics/src/cmt_time.c
+@@ -20,7 +20,7 @@
+ #include <cmetrics/cmt_info.h>
+ 
+ /* MacOS */
+-#ifdef FLB_HAVE_CLOCK_GET_TIME
++#ifdef CMT_HAVE_CLOCK_GET_TIME
+ #include <mach/clock.h>
+ #include <mach/mach.h>
+ #endif
+@@ -41,8 +41,8 @@
+     mach_timespec_t mts;
+     host_get_clock_service(mach_host_self(), CALENDAR_CLOCK, &cclock);
+     clock_get_time(cclock, &mts);
+-    tm->tv_sec = mts.tv_sec;
+-    tm->tv_nsec = mts.tv_nsec;
++    tm.tv_sec = mts.tv_sec;
++    tm.tv_nsec = mts.tv_nsec;
+     mach_port_deallocate(mach_task_self(), cclock);
+ #else /* __STDC_VERSION__ */
+     clock_gettime(CLOCK_REALTIME, &tm);
diff --git a/pkgs/tools/misc/fluent-bit/fix-luajit-darwin.patch b/pkgs/tools/misc/fluent-bit/fix-luajit-darwin.patch
index 21d9c21f5b9b..ef6be0f5ad35 100644
--- a/pkgs/tools/misc/fluent-bit/fix-luajit-darwin.patch
+++ b/pkgs/tools/misc/fluent-bit/fix-luajit-darwin.patch
@@ -1,14 +1,29 @@
 diff -Naur fluent-bit.old/cmake/luajit.cmake fluent-bit.new/cmake/luajit.cmake
 --- fluent-bit.old/cmake/luajit.cmake
 +++ fluent-bit.new/cmake/luajit.cmake
-@@ -11,10 +11,6 @@
- set(LUAJIT_SRC ${CMAKE_CURRENT_SOURCE_DIR}/${FLB_PATH_LIB_LUAJIT})
+@@ -12,15 +12,7 @@
  set(LUAJIT_DEST ${CMAKE_CURRENT_BINARY_DIR})
  
--if (CMAKE_SYSTEM_NAME MATCHES "Darwin")
--  set(CFLAGS "${CFLAGS} -isysroot ${CMAKE_OSX_SYSROOT}")
--endif()
--
+ if (CMAKE_SYSTEM_NAME MATCHES "Darwin")
+-  set(CFLAGS "${CFLAGS} -isysroot ${CMAKE_OSX_SYSROOT} -fno-stack-check")
+-  if (CMAKE_HOST_SYSTEM_VERSION VERSION_GREATER_EQUAL 20
+-      AND CMAKE_HOST_SYSTEM_VERSION VERSION_LESS 21)
+-    set(DEPLOYMENT_TARGET "MACOSX_DEPLOYMENT_TARGET=11.0")
+-  else()
+-    set(DEPLOYMENT_TARGET "MACOSX_DEPLOYMENT_TARGET=10.15")
+-  endif()
+-else()
+-  set(DEPLOYMENT_TARGET "")
++  set(CFLAGS "${CFLAGS} -fno-stack-check")
+ endif()
+ 
  # luajit (UNIX)
- # =============
- ExternalProject_Add(luajit
+@@ -30,7 +22,7 @@
+   EXCLUDE_FROM_ALL TRUE
+   SOURCE_DIR ${LUAJIT_SRC}
+   CONFIGURE_COMMAND ./configure
+-  BUILD_COMMAND $(MAKE) CROSS=${CROSS_PREFIX} CFLAGS=${CFLAGS} BUILD_MODE=static "XCFLAGS=-fPIC" ${DEPLOYMENT_TARGET}
++  BUILD_COMMAND $(MAKE) DEFAULT_CC=cc CROSS=${CROSS_PREFIX} CFLAGS=${CFLAGS} BUILD_MODE=static "XCFLAGS=-fPIC"
+   INSTALL_COMMAND cp src/libluajit.a "${LUAJIT_DEST}/lib/libluajit.a")
+ 
+ # luajit (Windows)
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 07588cfcfbea..cd03a1c72068 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5159,9 +5159,7 @@ with pkgs;
     icu = icu63;
   };
 
-  fluent-bit = callPackage ../tools/misc/fluent-bit {
-    stdenv = gccStdenv;
-  };
+  fluent-bit = callPackage ../tools/misc/fluent-bit { };
 
   flux = callPackage ../development/compilers/flux { };
 

From 996f991b5deed60fc613e2d62b414c96335127d8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Janne=20He=C3=9F?= <janne@hess.ooo>
Date: Sun, 21 Nov 2021 15:42:35 +0100
Subject: [PATCH 25/31] icingaweb2-ipl: 0.6.1 -> 0.7.0

---
 pkgs/servers/icingaweb2/ipl.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/icingaweb2/ipl.nix b/pkgs/servers/icingaweb2/ipl.nix
index 20b29962b7c6..7e67e645be91 100644
--- a/pkgs/servers/icingaweb2/ipl.nix
+++ b/pkgs/servers/icingaweb2/ipl.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "icingaweb2-ipl";
-  version = "0.6.1";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "Icinga";
     repo = "icinga-php-library";
     rev = "v${version}";
-    sha256 = "sha256-5xlvwB1o6d3mWd0TSybQW9s88q6A7KrledY1L8xaxLU=";
+    sha256 = "sha256:118bg9mxjxajm2ydbycgqdmdx8przwxblsaxc373r0g1dp1lv0fz";
   };
 
   installPhase = ''

From 05bbe40f68313e08486151d014dc99e037924c56 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Janne=20He=C3=9F?= <janne@hess.ooo>
Date: Sun, 21 Nov 2021 15:42:48 +0100
Subject: [PATCH 26/31] cingaweb2: 2.9.3 -> 2.9.4

---
 pkgs/servers/icingaweb2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/icingaweb2/default.nix b/pkgs/servers/icingaweb2/default.nix
index cf900ffd7fda..3602f5b01047 100644
--- a/pkgs/servers/icingaweb2/default.nix
+++ b/pkgs/servers/icingaweb2/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "icingaweb2";
-  version = "2.9.3";
+  version = "2.9.4";
 
   src = fetchFromGitHub {
     owner = "Icinga";
     repo = "icingaweb2";
     rev = "v${version}";
-    sha256 = "sha256-nPzf/SGyjEXuy0Q/Lofe1rSbW+4E6LXKzyi4np3jvF4=";
+    sha256 = "sha256:1fd5d2vhiq3s7qr4hnvnh9vv4ns7dvqwq8s67av89hjf3sqgw13j";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 54ece050b8ff6ce12a665832b2c83bfd925ce8a3 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Sat, 20 Nov 2021 23:26:46 +0200
Subject: [PATCH 27/31] nixos/qemu-vm: default memorySize 384 -> 1024

the default hasn't been changed since 2009
this can improve our test performances

nixos/tests: remove explicit memorySize <1024

1024MiB is now the default
---
 nixos/modules/virtualisation/qemu-vm.nix       | 2 +-
 nixos/tests/airsonic.nix                       | 4 ----
 nixos/tests/cage.nix                           | 1 -
 nixos/tests/cagebreak.nix                      | 1 -
 nixos/tests/cassandra.nix                      | 1 -
 nixos/tests/ceph-multi-node.nix                | 1 -
 nixos/tests/ceph-single-node-bluestore.nix     | 1 -
 nixos/tests/ceph-single-node.nix               | 1 -
 nixos/tests/common/wayland-cage.nix            | 1 -
 nixos/tests/containers-bridge.nix              | 1 -
 nixos/tests/containers-ephemeral.nix           | 1 -
 nixos/tests/containers-extra_veth.nix          | 1 -
 nixos/tests/containers-hosts.nix               | 1 -
 nixos/tests/containers-imperative.nix          | 1 -
 nixos/tests/containers-ip.nix                  | 1 -
 nixos/tests/containers-macvlans.nix            | 2 --
 nixos/tests/containers-physical_interfaces.nix | 4 ----
 nixos/tests/containers-portforward.nix         | 1 -
 nixos/tests/containers-tmpfs.nix               | 1 -
 nixos/tests/custom-ca.nix                      | 2 --
 nixos/tests/enlightenment.nix                  | 1 -
 nixos/tests/fcitx/default.nix                  | 1 -
 nixos/tests/fenics.nix                         | 1 -
 nixos/tests/firefox.nix                        | 3 ---
 nixos/tests/gerrit.nix                         | 1 -
 nixos/tests/gnome-xorg.nix                     | 1 -
 nixos/tests/gnome.nix                          | 1 -
 nixos/tests/graphite.nix                       | 1 -
 nixos/tests/hadoop/hadoop.nix                  | 2 --
 nixos/tests/hadoop/hdfs.nix                    | 1 -
 nixos/tests/installed-tests/fwupd.nix          | 1 -
 nixos/tests/jitsi-meet.nix                     | 1 -
 nixos/tests/kafka.nix                          | 1 -
 nixos/tests/keycloak.nix                       | 1 -
 nixos/tests/lxd-image.nix                      | 2 --
 nixos/tests/metabase.nix                       | 1 -
 nixos/tests/mysql/mysql.nix                    | 4 ----
 nixos/tests/networking-proxy.nix               | 1 -
 nixos/tests/nginx-etag.nix                     | 1 -
 nixos/tests/nixops/default.nix                 | 1 -
 nixos/tests/opensmtpd-rspamd.nix               | 1 -
 nixos/tests/pantheon.nix                       | 1 -
 nixos/tests/paperless-ng.nix                   | 1 -
 nixos/tests/plasma5-systemd-start.nix          | 1 -
 nixos/tests/plasma5.nix                        | 1 -
 nixos/tests/pleroma.nix                        | 1 -
 nixos/tests/privacyidea.nix                    | 1 -
 nixos/tests/prometheus-exporters.nix           | 2 --
 nixos/tests/prometheus.nix                     | 1 -
 nixos/tests/rspamd.nix                         | 5 -----
 nixos/tests/seafile.nix                        | 2 --
 nixos/tests/signal-desktop.nix                 | 1 -
 nixos/tests/spark/default.nix                  | 1 -
 nixos/tests/sway.nix                           | 1 -
 nixos/tests/sympa.nix                          | 1 -
 nixos/tests/systemd-cryptenroll.nix            | 1 -
 nixos/tests/systemd.nix                        | 1 -
 nixos/tests/vault-postgresql.nix               | 1 -
 nixos/tests/vault.nix                          | 1 -
 nixos/tests/vaultwarden.nix                    | 1 -
 nixos/tests/xfce.nix                           | 1 -
 61 files changed, 1 insertion(+), 82 deletions(-)

diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 0c2782d3e027..e51473f877b0 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -296,7 +296,7 @@ in
     virtualisation.memorySize =
       mkOption {
         type = types.ints.positive;
-        default = 384;
+        default = 1024;
         description =
           ''
             The memory size in megabytes of the virtual machine.
diff --git a/nixos/tests/airsonic.nix b/nixos/tests/airsonic.nix
index 59bd84877c61..d8df092c2ecf 100644
--- a/nixos/tests/airsonic.nix
+++ b/nixos/tests/airsonic.nix
@@ -11,10 +11,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         enable = true;
         maxMemory = 800;
       };
-
-      # Airsonic is a Java application, and unfortunately requires a significant
-      # amount of memory.
-      virtualisation.memorySize = 1024;
     };
 
   testScript = ''
diff --git a/nixos/tests/cage.nix b/nixos/tests/cage.nix
index e6bef374d303..83bae3deeeab 100644
--- a/nixos/tests/cage.nix
+++ b/nixos/tests/cage.nix
@@ -17,7 +17,6 @@ import ./make-test-python.nix ({ pkgs, ...} :
       program = "${pkgs.xterm}/bin/xterm -cm -pc -fa Monospace -fs 24";
     };
 
-    virtualisation.memorySize = 1024;
     # Need to switch to a different GPU driver than the default one (-vga std) so that Cage can launch:
     virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
   };
diff --git a/nixos/tests/cagebreak.nix b/nixos/tests/cagebreak.nix
index 242e59f5d7ab..c6c2c632b61a 100644
--- a/nixos/tests/cagebreak.nix
+++ b/nixos/tests/cagebreak.nix
@@ -35,7 +35,6 @@ in
     programs.xwayland.enable = true;
     environment.systemPackages = [ pkgs.cagebreak pkgs.wayland-utils ];
 
-    virtualisation.memorySize = 1024;
     # Need to switch to a different GPU driver than the default one (-vga std) so that Cagebreak can launch:
     virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
   };
diff --git a/nixos/tests/cassandra.nix b/nixos/tests/cassandra.nix
index bef3105f0a9e..a19d525c3431 100644
--- a/nixos/tests/cassandra.nix
+++ b/nixos/tests/cassandra.nix
@@ -41,7 +41,6 @@ let
       ];
     };
     services.cassandra = cassandraCfg ipAddress // extra;
-    virtualisation.memorySize = 1024;
   };
 in
 {
diff --git a/nixos/tests/ceph-multi-node.nix b/nixos/tests/ceph-multi-node.nix
index 33736e27b984..29e7c279d69a 100644
--- a/nixos/tests/ceph-multi-node.nix
+++ b/nixos/tests/ceph-multi-node.nix
@@ -37,7 +37,6 @@ let
 
   generateHost = { pkgs, cephConfig, networkConfig, ... }: {
     virtualisation = {
-      memorySize = 1024;
       emptyDiskImages = [ 20480 ];
       vlans = [ 1 ];
     };
diff --git a/nixos/tests/ceph-single-node-bluestore.nix b/nixos/tests/ceph-single-node-bluestore.nix
index f706d4d56fcf..acaae4cf300e 100644
--- a/nixos/tests/ceph-single-node-bluestore.nix
+++ b/nixos/tests/ceph-single-node-bluestore.nix
@@ -34,7 +34,6 @@ let
 
   generateHost = { pkgs, cephConfig, networkConfig, ... }: {
     virtualisation = {
-      memorySize = 1024;
       emptyDiskImages = [ 20480 20480 20480 ];
       vlans = [ 1 ];
     };
diff --git a/nixos/tests/ceph-single-node.nix b/nixos/tests/ceph-single-node.nix
index d1d56ea6708c..4fe5dc59ff8f 100644
--- a/nixos/tests/ceph-single-node.nix
+++ b/nixos/tests/ceph-single-node.nix
@@ -34,7 +34,6 @@ let
 
   generateHost = { pkgs, cephConfig, networkConfig, ... }: {
     virtualisation = {
-      memorySize = 1024;
       emptyDiskImages = [ 20480 20480 20480 ];
       vlans = [ 1 ];
     };
diff --git a/nixos/tests/common/wayland-cage.nix b/nixos/tests/common/wayland-cage.nix
index 55aeb858d7a4..fd0700941392 100644
--- a/nixos/tests/common/wayland-cage.nix
+++ b/nixos/tests/common/wayland-cage.nix
@@ -8,7 +8,6 @@
   };
 
   virtualisation = {
-    memorySize = 1024;
     qemu.options = [ "-vga virtio" ];
   };
 }
diff --git a/nixos/tests/containers-bridge.nix b/nixos/tests/containers-bridge.nix
index a1b0c9469d83..b8661fd7997c 100644
--- a/nixos/tests/containers-bridge.nix
+++ b/nixos/tests/containers-bridge.nix
@@ -15,7 +15,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     { pkgs, ... }:
     { imports = [ ../modules/installer/cd-dvd/channel.nix ];
       virtualisation.writableStore = true;
-      virtualisation.memorySize = 768;
 
       networking.bridges = {
         br0 = {
diff --git a/nixos/tests/containers-ephemeral.nix b/nixos/tests/containers-ephemeral.nix
index fabf0593f23a..db1631cf5b5d 100644
--- a/nixos/tests/containers-ephemeral.nix
+++ b/nixos/tests/containers-ephemeral.nix
@@ -5,7 +5,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
   };
 
   machine = { pkgs, ... }: {
-    virtualisation.memorySize = 768;
     virtualisation.writableStore = true;
 
     containers.webserver = {
diff --git a/nixos/tests/containers-extra_veth.nix b/nixos/tests/containers-extra_veth.nix
index 172409f56e89..b8f3d9844064 100644
--- a/nixos/tests/containers-extra_veth.nix
+++ b/nixos/tests/containers-extra_veth.nix
@@ -8,7 +8,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     { pkgs, ... }:
     { imports = [ ../modules/installer/cd-dvd/channel.nix ];
       virtualisation.writableStore = true;
-      virtualisation.memorySize = 768;
       virtualisation.vlans = [];
 
       networking.useDHCP = false;
diff --git a/nixos/tests/containers-hosts.nix b/nixos/tests/containers-hosts.nix
index 1f24ed1f3c2c..3c6a15710027 100644
--- a/nixos/tests/containers-hosts.nix
+++ b/nixos/tests/containers-hosts.nix
@@ -7,7 +7,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
   machine =
     { lib, ... }:
     {
-      virtualisation.memorySize = 256;
       virtualisation.vlans = [];
 
       networking.bridges.br0.interfaces = [];
diff --git a/nixos/tests/containers-imperative.nix b/nixos/tests/containers-imperative.nix
index 34103ef7586b..a126a5480c03 100644
--- a/nixos/tests/containers-imperative.nix
+++ b/nixos/tests/containers-imperative.nix
@@ -14,7 +14,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
       nix.binaryCaches = []; # don't try to access cache.nixos.org
 
       virtualisation.writableStore = true;
-      virtualisation.memorySize = 1024;
       # Make sure we always have all the required dependencies for creating a
       # container available within the VM, because we don't have network access.
       virtualisation.additionalPaths = let
diff --git a/nixos/tests/containers-ip.nix b/nixos/tests/containers-ip.nix
index 8fc42dab6241..91fdda0392a9 100644
--- a/nixos/tests/containers-ip.nix
+++ b/nixos/tests/containers-ip.nix
@@ -22,7 +22,6 @@ in import ./make-test-python.nix ({ pkgs, lib, ... }: {
       imports = [ ../modules/installer/cd-dvd/channel.nix ];
       virtualisation = {
         writableStore = true;
-        memorySize = 768;
       };
 
       containers.webserver4 = webserverFor "10.231.136.1" "10.231.136.2";
diff --git a/nixos/tests/containers-macvlans.nix b/nixos/tests/containers-macvlans.nix
index d0f41be8c125..a0cea8db4a1a 100644
--- a/nixos/tests/containers-macvlans.nix
+++ b/nixos/tests/containers-macvlans.nix
@@ -15,7 +15,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     machine1 =
       { lib, ... }:
       {
-        virtualisation.memorySize = 256;
         virtualisation.vlans = [ 1 ];
 
         # To be able to ping containers from the host, it is necessary
@@ -55,7 +54,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     machine2 =
       { ... }:
       {
-        virtualisation.memorySize = 256;
         virtualisation.vlans = [ 1 ];
       };
 
diff --git a/nixos/tests/containers-physical_interfaces.nix b/nixos/tests/containers-physical_interfaces.nix
index 57bd0eedcc33..e203f88786a3 100644
--- a/nixos/tests/containers-physical_interfaces.nix
+++ b/nixos/tests/containers-physical_interfaces.nix
@@ -7,7 +7,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
   nodes = {
     server = { ... }:
       {
-        virtualisation.memorySize = 256;
         virtualisation.vlans = [ 1 ];
 
         containers.server = {
@@ -23,7 +22,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
         };
       };
     bridged = { ... }: {
-      virtualisation.memorySize = 128;
       virtualisation.vlans = [ 1 ];
 
       containers.bridged = {
@@ -41,7 +39,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     };
 
     bonded = { ... }: {
-      virtualisation.memorySize = 128;
       virtualisation.vlans = [ 1 ];
 
       containers.bonded = {
@@ -62,7 +59,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     };
 
     bridgedbond = { ... }: {
-      virtualisation.memorySize = 128;
       virtualisation.vlans = [ 1 ];
 
       containers.bridgedbond = {
diff --git a/nixos/tests/containers-portforward.nix b/nixos/tests/containers-portforward.nix
index e21f6cee76a9..6cecd72f1bda 100644
--- a/nixos/tests/containers-portforward.nix
+++ b/nixos/tests/containers-portforward.nix
@@ -15,7 +15,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     { pkgs, ... }:
     { imports = [ ../modules/installer/cd-dvd/channel.nix ];
       virtualisation.writableStore = true;
-      virtualisation.memorySize = 768;
 
       containers.webserver =
         { privateNetwork = true;
diff --git a/nixos/tests/containers-tmpfs.nix b/nixos/tests/containers-tmpfs.nix
index 0185c2d91f23..d95178d1ff58 100644
--- a/nixos/tests/containers-tmpfs.nix
+++ b/nixos/tests/containers-tmpfs.nix
@@ -8,7 +8,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     { pkgs, ... }:
     { imports = [ ../modules/installer/cd-dvd/channel.nix ];
       virtualisation.writableStore = true;
-      virtualisation.memorySize = 768;
 
       containers.tmpfs =
         {
diff --git a/nixos/tests/custom-ca.nix b/nixos/tests/custom-ca.nix
index 4480519c7edc..0ab49f3b3430 100644
--- a/nixos/tests/custom-ca.nix
+++ b/nixos/tests/custom-ca.nix
@@ -81,8 +81,6 @@ in
 
       # chromium-based browsers refuse to run as root
       test-support.displayManager.auto.user = "alice";
-      # browsers may hang with the default memory
-      virtualisation.memorySize = 500;
 
       networking.hosts."127.0.0.1" = [ "good.example.com" "bad.example.com" ];
       security.pki.certificateFiles = [ "${example-good-cert}/ca.crt" ];
diff --git a/nixos/tests/enlightenment.nix b/nixos/tests/enlightenment.nix
index c5f0e208906b..8506c348246d 100644
--- a/nixos/tests/enlightenment.nix
+++ b/nixos/tests/enlightenment.nix
@@ -19,7 +19,6 @@ import ./make-test-python.nix ({ pkgs, ...} :
       };
     };
     hardware.pulseaudio.enable = true; # needed for the factl test, /dev/snd/* exists without them but udev doesn't care then
-    virtualisation.memorySize = 1024;
     environment.systemPackages = [ pkgs.xdotool ];
     services.acpid.enable = true;
     services.connman.enable = true;
diff --git a/nixos/tests/fcitx/default.nix b/nixos/tests/fcitx/default.nix
index cbeb95d33b0c..a243be8dc19b 100644
--- a/nixos/tests/fcitx/default.nix
+++ b/nixos/tests/fcitx/default.nix
@@ -11,7 +11,6 @@ import ../make-test-python.nix (
           ...
         }:
           {
-            virtualisation.memorySize = 1024;
 
             imports = [
               ../common/user-account.nix
diff --git a/nixos/tests/fenics.nix b/nixos/tests/fenics.nix
index 56f09d6a27e4..f0a8c32c7cd8 100644
--- a/nixos/tests/fenics.nix
+++ b/nixos/tests/fenics.nix
@@ -38,7 +38,6 @@ in
         gcc
         (python3.withPackages (ps: with ps; [ fenics ]))
       ];
-      virtualisation.memorySize = 512;
     };
   };
   testScript =
diff --git a/nixos/tests/firefox.nix b/nixos/tests/firefox.nix
index 7216ad43b8e9..6101fc973564 100644
--- a/nixos/tests/firefox.nix
+++ b/nixos/tests/firefox.nix
@@ -13,9 +13,6 @@ import ./make-test-python.nix ({ pkgs, firefoxPackage, ... }: {
         pkgs.xdotool
       ];
 
-      # Need some more memory to record audio.
-      virtualisation.memorySize = 500;
-
       # Create a virtual sound device, with mixing
       # and all, for recording audio.
       boot.kernelModules = [ "snd-aloop" ];
diff --git a/nixos/tests/gerrit.nix b/nixos/tests/gerrit.nix
index b6b6486fae86..8ae9e89cf6b0 100644
--- a/nixos/tests/gerrit.nix
+++ b/nixos/tests/gerrit.nix
@@ -18,7 +18,6 @@ in {
       { config, pkgs, ... }: {
         networking.firewall.allowedTCPPorts = [ 80 2222 ];
 
-        virtualisation.memorySize = 1024;
 
         services.gerrit = {
           enable = true;
diff --git a/nixos/tests/gnome-xorg.nix b/nixos/tests/gnome-xorg.nix
index b9ff5e682875..6264b87af4ec 100644
--- a/nixos/tests/gnome-xorg.nix
+++ b/nixos/tests/gnome-xorg.nix
@@ -40,7 +40,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
         };
       };
 
-      virtualisation.memorySize = 1024;
     };
 
   testScript = { nodes, ... }: let
diff --git a/nixos/tests/gnome.nix b/nixos/tests/gnome.nix
index 1da97f733cfd..06f387ecad67 100644
--- a/nixos/tests/gnome.nix
+++ b/nixos/tests/gnome.nix
@@ -45,7 +45,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
         };
       };
 
-      virtualisation.memorySize = 1024;
     };
 
   testScript = { nodes, ... }: let
diff --git a/nixos/tests/graphite.nix b/nixos/tests/graphite.nix
index 137be2d89c8b..496f16846ea6 100644
--- a/nixos/tests/graphite.nix
+++ b/nixos/tests/graphite.nix
@@ -4,7 +4,6 @@ import ./make-test-python.nix ({ pkgs, ... } :
   nodes = {
     one =
       { ... }: {
-        virtualisation.memorySize = 1024;
         time.timeZone = "UTC";
         services.graphite = {
           web = {
diff --git a/nixos/tests/hadoop/hadoop.nix b/nixos/tests/hadoop/hadoop.nix
index b4ed0e17a852..48737debab54 100644
--- a/nixos/tests/hadoop/hadoop.nix
+++ b/nixos/tests/hadoop/hadoop.nix
@@ -95,7 +95,6 @@ import ../make-test-python.nix ({pkgs, ...}: {
 
     # YARN cluster
     rm1 = {pkgs, options, ...}: {
-      virtualisation.memorySize = 1024;
       services.hadoop = {
         inherit package coreSite hdfsSite;
         yarnSite = options.services.hadoop.yarnSite.default // yarnSiteHA;
@@ -103,7 +102,6 @@ import ../make-test-python.nix ({pkgs, ...}: {
       };
     };
     rm2 = {pkgs, options, ...}: {
-      virtualisation.memorySize = 1024;
       services.hadoop = {
         inherit package coreSite hdfsSite;
         yarnSite = options.services.hadoop.yarnSite.default // yarnSiteHA;
diff --git a/nixos/tests/hadoop/hdfs.nix b/nixos/tests/hadoop/hdfs.nix
index 360dbd60ed27..b63cbf480327 100644
--- a/nixos/tests/hadoop/hdfs.nix
+++ b/nixos/tests/hadoop/hdfs.nix
@@ -2,7 +2,6 @@
 import ../make-test-python.nix ({...}: {
   nodes = {
     namenode = {pkgs, ...}: {
-      virtualisation.memorySize = 1024;
       services.hadoop = {
         package = pkgs.hadoop;
         hdfs = {
diff --git a/nixos/tests/installed-tests/fwupd.nix b/nixos/tests/installed-tests/fwupd.nix
index a8a683a1af7b..65614e2689d8 100644
--- a/nixos/tests/installed-tests/fwupd.nix
+++ b/nixos/tests/installed-tests/fwupd.nix
@@ -7,6 +7,5 @@ makeInstalledTest {
     services.fwupd.enable = true;
     services.fwupd.disabledPlugins = lib.mkForce []; # don't disable test plugin
     services.fwupd.enableTestRemote = true;
-    virtualisation.memorySize = 768;
   };
 }
diff --git a/nixos/tests/jitsi-meet.nix b/nixos/tests/jitsi-meet.nix
index f9a0b121a2bf..d95f7c2ea9ea 100644
--- a/nixos/tests/jitsi-meet.nix
+++ b/nixos/tests/jitsi-meet.nix
@@ -8,7 +8,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     client = { nodes, pkgs, ... }: {
     };
     server = { config, pkgs, ... }: {
-      virtualisation.memorySize = 512;
       services.jitsi-meet = {
         enable = true;
         hostName = "server";
diff --git a/nixos/tests/kafka.nix b/nixos/tests/kafka.nix
index 95711808a2c3..5def759ca24d 100644
--- a/nixos/tests/kafka.nix
+++ b/nixos/tests/kafka.nix
@@ -19,7 +19,6 @@ let
         };
 
         networking.firewall.allowedTCPPorts = [ 2181 ];
-        virtualisation.memorySize = 1024;
       };
       kafka = { ... }: {
         services.apache-kafka = {
diff --git a/nixos/tests/keycloak.nix b/nixos/tests/keycloak.nix
index fc321b8902f1..1be3fed6acc9 100644
--- a/nixos/tests/keycloak.nix
+++ b/nixos/tests/keycloak.nix
@@ -17,7 +17,6 @@ let
 
       nodes = {
         keycloak = { ... }: {
-          virtualisation.memorySize = 1024;
 
           security.pki.certificateFiles = [
             certs.ca.cert
diff --git a/nixos/tests/lxd-image.nix b/nixos/tests/lxd-image.nix
index bc8274eebedd..096b9d9aba90 100644
--- a/nixos/tests/lxd-image.nix
+++ b/nixos/tests/lxd-image.nix
@@ -46,8 +46,6 @@ in {
 
   machine = { lib, ... }: {
     virtualisation = {
-      # OOMs otherwise
-      memorySize = 1024;
       # disk full otherwise
       diskSize = 2048;
 
diff --git a/nixos/tests/metabase.nix b/nixos/tests/metabase.nix
index 370114e92223..1b25071902e9 100644
--- a/nixos/tests/metabase.nix
+++ b/nixos/tests/metabase.nix
@@ -7,7 +7,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {
   nodes = {
     machine = { ... }: {
       services.metabase.enable = true;
-      virtualisation.memorySize = 1024;
     };
   };
 
diff --git a/nixos/tests/mysql/mysql.nix b/nixos/tests/mysql/mysql.nix
index dce5fa26acf7..2ac2b34a18e2 100644
--- a/nixos/tests/mysql/mysql.nix
+++ b/nixos/tests/mysql/mysql.nix
@@ -64,10 +64,6 @@ in
       {
         imports = [ users ];
 
-        # prevent oom:
-        # Kernel panic - not syncing: Out of memory: compulsory panic_on_oom is enabled
-        virtualisation.memorySize = 1024;
-
         services.mysql.enable = true;
         services.mysql.initialDatabases = [
           { name = "testdb3"; schema = ./testdb.sql; }
diff --git a/nixos/tests/networking-proxy.nix b/nixos/tests/networking-proxy.nix
index 62b5e690f6d1..fcb2558cf3b0 100644
--- a/nixos/tests/networking-proxy.nix
+++ b/nixos/tests/networking-proxy.nix
@@ -8,7 +8,6 @@ let default-config = {
 
         services.xserver.enable = false;
 
-        virtualisation.memorySize = 128;
       };
 in import ./make-test-python.nix ({ pkgs, ...} : {
   name = "networking-proxy";
diff --git a/nixos/tests/nginx-etag.nix b/nixos/tests/nginx-etag.nix
index a7bfc0d26958..b69511d081d4 100644
--- a/nixos/tests/nginx-etag.nix
+++ b/nixos/tests/nginx-etag.nix
@@ -37,7 +37,6 @@ import ./make-test-python.nix {
     };
 
     client = { pkgs, lib, ... }: {
-      virtualisation.memorySize = 512;
       environment.systemPackages = let
         testRunner = pkgs.writers.writePython3Bin "test-runner" {
           libraries = [ pkgs.python3Packages.selenium ];
diff --git a/nixos/tests/nixops/default.nix b/nixos/tests/nixops/default.nix
index 3fb81906a522..ec3d028aabae 100644
--- a/nixos/tests/nixops/default.nix
+++ b/nixos/tests/nixops/default.nix
@@ -26,7 +26,6 @@ let
         nix.binaryCaches = lib.mkForce [ ];
         users.users.person.isNormalUser = true;
         virtualisation.writableStore = true;
-        virtualisation.memorySize = 1024 /*MiB*/;
         virtualisation.additionalPaths = [
           pkgs.hello
           pkgs.figlet
diff --git a/nixos/tests/opensmtpd-rspamd.nix b/nixos/tests/opensmtpd-rspamd.nix
index 9cb2624e6c4e..19969a7b47dd 100644
--- a/nixos/tests/opensmtpd-rspamd.nix
+++ b/nixos/tests/opensmtpd-rspamd.nix
@@ -39,7 +39,6 @@ import ./make-test-python.nix {
 
     smtp2 = { pkgs, ... }: {
       imports = [ common/user-account.nix ];
-      virtualisation.memorySize = 512;
       networking = {
         firewall.allowedTCPPorts = [ 25 143 ];
         useDHCP = false;
diff --git a/nixos/tests/pantheon.nix b/nixos/tests/pantheon.nix
index aebf6b534476..989d29a966df 100644
--- a/nixos/tests/pantheon.nix
+++ b/nixos/tests/pantheon.nix
@@ -15,7 +15,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :
     services.xserver.enable = true;
     services.xserver.desktopManager.pantheon.enable = true;
 
-    virtualisation.memorySize = 1024;
   };
 
   enableOCR = true;
diff --git a/nixos/tests/paperless-ng.nix b/nixos/tests/paperless-ng.nix
index a4b2f348ec32..618eeec6b125 100644
--- a/nixos/tests/paperless-ng.nix
+++ b/nixos/tests/paperless-ng.nix
@@ -8,7 +8,6 @@ import ./make-test-python.nix ({ lib, ... }: {
       enable = true;
       passwordFile = builtins.toFile "password" "admin";
     };
-    virtualisation.memorySize = 1024;
   };
 
   testScript = ''
diff --git a/nixos/tests/plasma5-systemd-start.nix b/nixos/tests/plasma5-systemd-start.nix
index ac6fad7da6c6..72de19af70ce 100644
--- a/nixos/tests/plasma5-systemd-start.nix
+++ b/nixos/tests/plasma5-systemd-start.nix
@@ -21,7 +21,6 @@ import ./make-test-python.nix ({ pkgs, ...} :
         user = "alice";
       };
     };
-    virtualisation.memorySize = 1024;
   };
 
   testScript = { nodes, ... }: let
diff --git a/nixos/tests/plasma5.nix b/nixos/tests/plasma5.nix
index 281c9843e901..5c7ea602f79e 100644
--- a/nixos/tests/plasma5.nix
+++ b/nixos/tests/plasma5.nix
@@ -19,7 +19,6 @@ import ./make-test-python.nix ({ pkgs, ...} :
       user = "alice";
     };
     hardware.pulseaudio.enable = true; # needed for the factl test, /dev/snd/* exists without them but udev doesn't care then
-    virtualisation.memorySize = 1024;
   };
 
   testScript = { nodes, ... }: let
diff --git a/nixos/tests/pleroma.nix b/nixos/tests/pleroma.nix
index d0ae1488d134..bf3623fce38b 100644
--- a/nixos/tests/pleroma.nix
+++ b/nixos/tests/pleroma.nix
@@ -202,7 +202,6 @@ import ./make-test-python.nix ({ pkgs, ... }:
       security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
       networking.extraHosts = hosts nodes;
       networking.firewall.enable = false;
-      virtualisation.memorySize = 512;
       environment.systemPackages = with pkgs; [
         provision-db
         provision-secrets
diff --git a/nixos/tests/privacyidea.nix b/nixos/tests/privacyidea.nix
index 4a94f0727946..c1141465ec24 100644
--- a/nixos/tests/privacyidea.nix
+++ b/nixos/tests/privacyidea.nix
@@ -8,7 +8,6 @@ import ./make-test-python.nix ({ pkgs, ...} : rec {
 
   machine = { ... }: {
     virtualisation.cores = 2;
-    virtualisation.memorySize = 512;
 
     services.privacyidea = {
       enable = true;
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index 38b93c4087c0..d069854328a2 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -464,7 +464,6 @@ let
         extraFlags = [ "--lnd.network=regtest" ];
       };
       metricProvider = {
-        virtualisation.memorySize = 1024;
         systemd.services.prometheus-lnd-exporter.serviceConfig.RestartSec = 15;
         systemd.services.prometheus-lnd-exporter.after = [ "lnd.service" ];
         services.bitcoind.regtest = {
@@ -953,7 +952,6 @@ let
       };
       metricProvider = {
         services.rspamd.enable = true;
-        virtualisation.memorySize = 1024;
       };
       exporterTest = ''
         wait_for_unit("rspamd.service")
diff --git a/nixos/tests/prometheus.nix b/nixos/tests/prometheus.nix
index 20f8c4459e10..a075cfc1f1b7 100644
--- a/nixos/tests/prometheus.nix
+++ b/nixos/tests/prometheus.nix
@@ -188,7 +188,6 @@ in import ./make-test-python.nix {
       # Minio requires at least 1GiB of free disk space to run.
       virtualisation = {
         diskSize = 2 * 1024;
-        memorySize = 1024;
       };
       networking.firewall.allowedTCPPorts = [ minioPort ];
 
diff --git a/nixos/tests/rspamd.nix b/nixos/tests/rspamd.nix
index 3fd55444fd8a..f0ccfe7ea0e6 100644
--- a/nixos/tests/rspamd.nix
+++ b/nixos/tests/rspamd.nix
@@ -25,7 +25,6 @@ let
     machine = {
       services.rspamd.enable = true;
       networking.enableIPv6 = enableIPv6;
-      virtualisation.memorySize = 1024;
     };
     testScript = ''
       start_all()
@@ -69,7 +68,6 @@ in
           group = "rspamd";
         }];
       };
-      virtualisation.memorySize = 1024;
     };
 
     testScript = ''
@@ -118,7 +116,6 @@ in
           '';
         };
       };
-      virtualisation.memorySize = 1024;
     };
 
     testScript = ''
@@ -224,7 +221,6 @@ in
           rspamd_logger.infox(rspamd_config, 'Work dammit!!!')
         '';
       };
-      virtualisation.memorySize = 1024;
     };
     testScript = ''
       ${initMachine}
@@ -291,7 +287,6 @@ in
         postfix.enable = true;
         workers.rspamd_proxy.type = "rspamd_proxy";
       };
-      virtualisation.memorySize = 1024;
     };
     testScript = ''
       ${initMachine}
diff --git a/nixos/tests/seafile.nix b/nixos/tests/seafile.nix
index 70b9ba55457e..6eec8b1fbe55 100644
--- a/nixos/tests/seafile.nix
+++ b/nixos/tests/seafile.nix
@@ -1,7 +1,6 @@
 import ./make-test-python.nix ({ pkgs, ... }:
   let
     client = { config, pkgs, ... }: {
-      virtualisation.memorySize = 256;
       environment.systemPackages = [ pkgs.seafile-shared pkgs.curl ];
     };
   in {
@@ -12,7 +11,6 @@ import ./make-test-python.nix ({ pkgs, ... }:
 
     nodes = {
       server = { config, pkgs, ... }: {
-        virtualisation.memorySize = 512;
         services.seafile = {
           enable = true;
           ccnetSettings.General.SERVICE_URL = "http://server";
diff --git a/nixos/tests/signal-desktop.nix b/nixos/tests/signal-desktop.nix
index 7bc7cfe18cf8..8c7230629923 100644
--- a/nixos/tests/signal-desktop.nix
+++ b/nixos/tests/signal-desktop.nix
@@ -29,7 +29,6 @@ in {
     environment.systemPackages = with pkgs; [
       signal-desktop file sqlite sqlcipher-signal
     ];
-    virtualisation.memorySize = 1024;
   };
 
   enableOCR = true;
diff --git a/nixos/tests/spark/default.nix b/nixos/tests/spark/default.nix
index 254cdec6e6b0..025c5a5222e7 100644
--- a/nixos/tests/spark/default.nix
+++ b/nixos/tests/spark/default.nix
@@ -3,7 +3,6 @@ import ../make-test-python.nix ({...}: {
 
   nodes = {
     worker = { nodes, pkgs, ... }: {
-      virtualisation.memorySize = 1024;
       services.spark.worker = {
         enable = true;
         master = "master:7077";
diff --git a/nixos/tests/sway.nix b/nixos/tests/sway.nix
index 01240ef572a6..3476ebab3e26 100644
--- a/nixos/tests/sway.nix
+++ b/nixos/tests/sway.nix
@@ -44,7 +44,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :
     # To test pinentry via gpg-agent:
     programs.gnupg.agent.enable = true;
 
-    virtualisation.memorySize = 1024;
     # Need to switch to a different GPU driver than the default one (-vga std) so that Sway can launch:
     virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
   };
diff --git a/nixos/tests/sympa.nix b/nixos/tests/sympa.nix
index eb38df180a78..aad7c95b6c99 100644
--- a/nixos/tests/sympa.nix
+++ b/nixos/tests/sympa.nix
@@ -5,7 +5,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
   machine =
     { ... }:
     {
-      virtualisation.memorySize = 1024;
 
       services.sympa = {
         enable = true;
diff --git a/nixos/tests/systemd-cryptenroll.nix b/nixos/tests/systemd-cryptenroll.nix
index 2c436f2de890..49634ef65672 100644
--- a/nixos/tests/systemd-cryptenroll.nix
+++ b/nixos/tests/systemd-cryptenroll.nix
@@ -8,7 +8,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     environment.systemPackages = [ pkgs.cryptsetup ];
     virtualisation = {
       emptyDiskImages = [ 512 ];
-      memorySize = 1024;
       qemu.options = [
         "-chardev socket,id=chrtpm,path=/tmp/swtpm-sock"
         "-tpmdev emulator,id=tpm0,chardev=chrtpm"
diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix
index e0685f53a945..6561f7efe1a5 100644
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -5,7 +5,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     imports = [ common/user-account.nix common/x11.nix ];
 
     virtualisation.emptyDiskImages = [ 512 512 ];
-    virtualisation.memorySize = 1024;
 
     environment.systemPackages = [ pkgs.cryptsetup ];
 
diff --git a/nixos/tests/vault-postgresql.nix b/nixos/tests/vault-postgresql.nix
index a563aead22a3..071cfd106ffb 100644
--- a/nixos/tests/vault-postgresql.nix
+++ b/nixos/tests/vault-postgresql.nix
@@ -12,7 +12,6 @@ import ./make-test-python.nix ({ pkgs, ... }:
     maintainers = [ lnl7 roberth ];
   };
   machine = { lib, pkgs, ... }: {
-    virtualisation.memorySize = 512;
     environment.systemPackages = [ pkgs.vault ];
     environment.variables.VAULT_ADDR = "http://127.0.0.1:8200";
     services.vault.enable = true;
diff --git a/nixos/tests/vault.nix b/nixos/tests/vault.nix
index c3b28b62695a..e86acd5b593f 100644
--- a/nixos/tests/vault.nix
+++ b/nixos/tests/vault.nix
@@ -8,7 +8,6 @@ import ./make-test-python.nix ({ pkgs, ... }:
     environment.systemPackages = [ pkgs.vault ];
     environment.variables.VAULT_ADDR = "http://127.0.0.1:8200";
     services.vault.enable = true;
-    virtualisation.memorySize = 512;
   };
 
   testScript =
diff --git a/nixos/tests/vaultwarden.nix b/nixos/tests/vaultwarden.nix
index b5343f5cad2d..56f1d245d505 100644
--- a/nixos/tests/vaultwarden.nix
+++ b/nixos/tests/vaultwarden.nix
@@ -140,7 +140,6 @@ let
               in
               [ pkgs.firefox-unwrapped pkgs.geckodriver testRunner ];
 
-            virtualisation.memorySize = 768;
           }
         ];
 
diff --git a/nixos/tests/xfce.nix b/nixos/tests/xfce.nix
index 148eccdbe308..9051deebae76 100644
--- a/nixos/tests/xfce.nix
+++ b/nixos/tests/xfce.nix
@@ -23,7 +23,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
 
       hardware.pulseaudio.enable = true; # needed for the factl test, /dev/snd/* exists without them but udev doesn't care then
 
-      virtualisation.memorySize = 1024;
     };
 
   testScript = { nodes, ... }: let

From 339974e1a868527b88928de5784f1ee95f284853 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Mancilla?= <smancill@smancill.dev>
Date: Sun, 21 Nov 2021 13:24:28 -0300
Subject: [PATCH 28/31] libite: set platforms to linux + netbsd

From the README:

> This library was initially built for and developed on GNU/Linux
> systems as a light weight utility library, these days NetBSD should
> also work.
---
 pkgs/development/libraries/libite/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libite/default.nix b/pkgs/development/libraries/libite/default.nix
index 4ffb7a5f7fbc..3c1d1e890207 100644
--- a/pkgs/development/libraries/libite/default.nix
+++ b/pkgs/development/libraries/libite/default.nix
@@ -15,7 +15,6 @@ stdenv.mkDerivation rec {
   buildInputs = [ libconfuse ];
 
   meta = with lib; {
-    inherit (src.meta) homepage;
     description = "Lightweight library of frog DNA";
     longDescription = ''
       Libite is a lightweight library of frog DNA. It can be used to fill
@@ -29,7 +28,8 @@ stdenv.mkDerivation rec {
       _SAFE macros in the BSD sys/queue.h API — highly recommended when
       traversing lists to delete/free nodes.
     '';
-    platforms = platforms.unix;
+    homepage = "https://github.com/troglobit/libite";
+    platforms = with platforms; linux ++ netbsd;
     maintainers = with maintainers; [ fpletz ];
     license = with licenses; [ mit isc bsd2 bsd3 ];
   };

From 849e45fe7ae4d426deba3bfde6df7416b43f7fc5 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 21 Nov 2021 17:28:08 +0100
Subject: [PATCH 29/31] python3Packages.oath: 1.4.3 -> 1.4.4

---
 pkgs/development/python-modules/oath/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/oath/default.nix b/pkgs/development/python-modules/oath/default.nix
index fd12a830472b..6d22a0aec2a0 100644
--- a/pkgs/development/python-modules/oath/default.nix
+++ b/pkgs/development/python-modules/oath/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "oath";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1xqgcqgx6aa0j21hwsdb3aqpqhviwj756bcqjjjcm1h1aij11p6m";
+    sha256 = "sha256-vWsg0g8sTj9TUj7pACEdynWu7KcvT1qf2NyswXX+HAs=";
   };
 
   meta = with lib; {

From cde18dcb924b80cc2c01a27133f0fc035827a4ac Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 21 Nov 2021 17:30:50 +0100
Subject: [PATCH 30/31] python3Packages.oath: switch to pytestCheckHook

---
 pkgs/development/python-modules/oath/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/python-modules/oath/default.nix b/pkgs/development/python-modules/oath/default.nix
index 6d22a0aec2a0..a8740f685747 100644
--- a/pkgs/development/python-modules/oath/default.nix
+++ b/pkgs/development/python-modules/oath/default.nix
@@ -1,16 +1,25 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "oath";
   version = "1.4.4";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "sha256-vWsg0g8sTj9TUj7pACEdynWu7KcvT1qf2NyswXX+HAs=";
   };
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "oath"
+  ];
 
   meta = with lib; {
     description = "Python implementation of the three main OATH specifications: HOTP, TOTP and OCRA";

From 279ef8ed7eea250a1727c0c4a56f01aad786882c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Mancilla?= <smancill@smancill.dev>
Date: Sun, 21 Nov 2021 13:29:20 -0300
Subject: [PATCH 31/31] libtsm: set platforms to linux only

libtsm 4.x uses epoll now.
---
 pkgs/development/libraries/libtsm/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/libtsm/default.nix b/pkgs/development/libraries/libtsm/default.nix
index d959306c9718..9c8e418fba4f 100644
--- a/pkgs/development/libraries/libtsm/default.nix
+++ b/pkgs/development/libraries/libtsm/default.nix
@@ -20,6 +20,6 @@ stdenv.mkDerivation rec {
     homepage = "http://www.freedesktop.org/wiki/Software/kmscon/libtsm/";
     license = licenses.mit;
     maintainers = with maintainers; [ cstrahan ];
-    platforms = with platforms; unix;
+    platforms = platforms.linux;
   };
 }