Merge master into staging-next

doc/languages-frameworks/python.section.md

@@ -1633,3 +1633,25 @@ would be:
 ```ShellSession
 $ maintainers/scripts/update-python-libraries --target minor --commit --use-pkgs-prefix pkgs/development/python-modules/**/default.nix
 ```
+
+## CPython Update Schedule
+
+With [PEP 602](https://www.python.org/dev/peps/pep-0602/), CPython now
+follows a yearly release cadence. In nixpkgs, all supported interpreters
+are made available, but only the most recent two
+interpreters package sets are built; this is a compromise between being
+the latest interpreter, and what the majority of the Python packages support.
+
+New CPython interpreters are released in October. Generally, it takes some
+time for the majority of active Python projects to support the latest stable
+interpreter. To help ease the migration for Nixpkgs users
+between Python interpreters the schedule below will be used:
+
+| When | Event |
+| --- | --- |
+| After YY.11 Release | Bump CPython package set window. The latest and previous latest stable should now be built. |
+| After YY.05 Release | Bump default CPython interpreter to latest stable. |
+
+In practice, this means that the Python community will have had a stable interpreter
+for ~2 months before attempting to update the package set. And this will
+allow for ~7 months for Python applications to support the latest interpreter.

doc/stdenv/stdenv.chapter.md

@@ -796,7 +796,7 @@ The standard environment provides a number of useful functions.
 
 ### `makeWrapper` \<executable\> \<wrapperfile\> \<args\> {#fun-makeWrapper}
 
-Constructs a wrapper for a program with various possible arguments. For example:
+Constructs a wrapper for a program with various possible arguments. It is defined as part of 2 setup-hooks named `makeWrapper` and `makeBinaryWrapper` that implement the same bash functions. Hence, to use it you have to add `makeWrapper` to your `nativeBuildInputs`. Here's an example usage:
 
 ```bash
 # adds `FOOBAR=baz` to `$out/bin/foo`’s environment
@@ -808,9 +808,11 @@ makeWrapper $out/bin/foo $wrapperfile --set FOOBAR baz
 makeWrapper $out/bin/foo $wrapperfile --prefix PATH : ${lib.makeBinPath [ hello git ]}
 ```
 
-There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh`.
+There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh` for the `makeWrapper` implementation and in `nixpkgs/pkgs/build-support/setup-hooks/make-binary-wrapper.sh` for the `makeBinaryWrapper` implementation.
 
-`wrapProgram` is a convenience function you probably want to use most of the time.
+`wrapProgram` is a convenience function you probably want to use most of the time, implemented by both `makeWrapper` and `makeBinaryWrapper`.
+
+Using the `makeBinaryWrapper` implementation is usually preferred, as it creates a tiny _compiled_ wrapper executable, that can be used as a shebang interpreter. This is needed mostly on Darwin, where shebangs cannot point to scripts, [due to a limitation with the `execve`-syscall](https://stackoverflow.com/questions/67100831/macos-shebang-with-absolute-path-not-working). Compiled wrappers generated by `makeBinaryWrapper` can be inspected with `less <path-to-wrapper>` - by scrolling past the binary data you should be able to see the shell command that generated the executable and there see the environment variables that were injected into the wrapper.
 
 ### `substitute` \<infile\> \<outfile\> \<subs\> {#fun-substitute}
 
@@ -885,9 +887,9 @@ someVar=$(stripHash $name)
 
 ### `wrapProgram` \<executable\> \<makeWrapperArgs\> {#fun-wrapProgram}
 
-Convenience function for `makeWrapper` that automatically creates a sane wrapper file. It takes all the same arguments as `makeWrapper`, except for `--argv0`.
+Convenience function for `makeWrapper` that replaces `<\executable\>` with a wrapper that executes the original program. It takes all the same arguments as `makeWrapper`, except for `--inherit-argv0` (used by the `makeBinaryWrapper` implementation) and `--argv0` (used by both `makeWrapper` and `makeBinaryWrapper` wrapper implementations).
 
-It cannot be applied multiple times, since it will overwrite the wrapper file.
+If you will apply it multiple times, it will overwrite the wrapper file and you will end up with double wrapping, which should be avoided.
 
 ## Package setup hooks {#ssec-setup-hooks}
 

lib/systems/doubles.nix

@@ -39,8 +39,8 @@ let
     "riscv32-netbsd" "riscv64-netbsd" "x86_64-netbsd"
 
     # none
-    "aarch64-none" "arm-none" "armv6l-none" "avr-none" "i686-none"
-    "msp430-none" "or1k-none" "m68k-none" "powerpc-none"
+    "aarch64_be-none" "aarch64-none" "arm-none" "armv6l-none" "avr-none" "i686-none"
+    "msp430-none" "or1k-none" "m68k-none" "powerpc-none" "powerpcle-none"
     "riscv32-none" "riscv64-none" "s390-none" "s390x-none" "vc4-none"
     "x86_64-none"
 

lib/systems/examples.nix

@@ -290,6 +290,7 @@ rec {
     libc = "nblibc";
   };
 
+  # this is broken and never worked fully
   x86_64-netbsd-llvm = {
     config = "x86_64-unknown-netbsd";
     libc = "nblibc";

maintainers/maintainer-list.nix

@@ -1414,6 +1414,12 @@
     githubId = 251106;
     name = "Daniel Bergey";
   };
+  bergkvist = {
+    email = "tobias@bergkv.ist";
+    github = "bergkvist";
+    githubId = 410028;
+    name = "Tobias Bergkvist";
+  };
   betaboon = {
     email = "betaboon@0x80.ninja";
     github = "betaboon";

nixos/modules/hardware/keyboard/zsa.nix

@@ -5,7 +5,6 @@ let
   cfg = config.hardware.keyboard.zsa;
 in
 {
-  # TODO: make group configurable like in https://github.com/NixOS/nixpkgs/blob/0b2b4b8c4e729535a61db56468809c5c2d3d175c/pkgs/tools/security/nitrokey-app/udev-rules.nix ?
   options.hardware.keyboard.zsa = {
     enable = mkOption {
       type = types.bool;
@@ -14,7 +13,6 @@ in
         Enables udev rules for keyboards from ZSA like the ErgoDox EZ, Planck EZ and Moonlander Mark I.
         You need it when you want to flash a new configuration on the keyboard
         or use their live training in the browser.
-        Access to the keyboard is granted to users in the "plugdev" group.
         You may want to install the wally-cli package.
       '';
     };
@@ -22,6 +20,5 @@ in
 
   config = mkIf cfg.enable {
     services.udev.packages = [ pkgs.zsa-udev-rules ];
-    users.groups.plugdev = {};
   };
 }

pkgs/applications/science/math/polymake/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "polymake";
-  version = "4.4";
+  version = "4.5";
 
   src = fetchurl {
     # "The minimal version is a packager friendly version which omits
     # the bundled sources of cdd, lrs, libnormaliz, nauty and jReality."
     url = "https://polymake.org/lib/exe/fetch.php/download/polymake-${version}-minimal.tar.bz2";
-    sha256 = "sha256-2nF5F2xznI77pl2TslrxA8HLpw4fmzVnPOM8N3kOwJE=";
+    sha256 = "sha256-6UPUuzHBEvrYUjQONZW8WRwgcGkqFtUBg6OxBFZteZY=";
   };
 
   buildInputs = [

pkgs/applications/version-management/gitlab/gitaly/default.nix

@@ -72,7 +72,7 @@ buildGoModule {
   meta = with lib; {
     homepage = "https://gitlab.com/gitlab-org/gitaly";
     description = "A Git RPC service for handling all the git calls made by GitLab";
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ [ "x86_64-darwin" ];
     maintainers = with maintainers; [ roblabla globin fpletz talyz ];
     license = licenses.mit;
   };

pkgs/build-support/setup-hooks/make-binary-wrapper.sh

@@ -0,0 +1,384 @@
+
+set -euo pipefail
+
+# Assert that FILE exists and is executable
+#
+# assertExecutable FILE
+assertExecutable() {
+    local file="$1"
+    [[ -f "$file" && -x "$file" ]] || \
+        die "Cannot wrap '$file' because it is not an executable file"
+}
+
+# Generate a binary executable wrapper for wrapping an executable.
+# The binary is compiled from generated C-code using gcc.
+# makeWrapper EXECUTABLE OUT_PATH ARGS
+
+# ARGS:
+# --argv0       NAME    : set name of executed process to NAME
+#                         (otherwise it’s called …-wrapped)
+# --inherit-argv0       : the executable inherits argv0 from the wrapper.
+#                         (use instead of --argv0 '$0')
+# --set         VAR VAL : add VAR with value VAL to the executable’s
+#                         environment
+# --set-default VAR VAL : like --set, but only adds VAR if not already set in
+#                         the environment
+# --unset       VAR     : remove VAR from the environment
+# --chdir       DIR     : change working directory (use instead of --run "cd DIR")
+# --add-flags   FLAGS   : add FLAGS to invocation of executable
+
+# --prefix          ENV SEP VAL   : suffix/prefix ENV with VAL, separated by SEP
+# --suffix
+
+# To troubleshoot a binary wrapper after you compiled it,
+# use the `strings` command or open the binary file in a text editor.
+makeWrapper() {
+    assertExecutable "$1"
+    makeDocumentedCWrapper "$1" "${@:3}" | \
+      @CC@ \
+        -Wall -Werror -Wpedantic \
+        -Os \
+        -x c \
+        -o "$2" -
+}
+
+# Syntax: wrapProgram <PROGRAM> <MAKE-WRAPPER FLAGS...>
+wrapProgram() {
+    local prog="$1"
+    local hidden
+
+    assertExecutable "$prog"
+
+    hidden="$(dirname "$prog")/.$(basename "$prog")"-wrapped
+    while [ -e "$hidden" ]; do
+      hidden="${hidden}_"
+    done
+    mv "$prog" "$hidden"
+    # Silence warning about unexpanded $0:
+    # shellcheck disable=SC2016
+    makeWrapper "$hidden" "$prog" --inherit-argv0 "${@:2}"
+}
+
+# Generate source code for the wrapper in such a way that the wrapper inputs
+# will still be readable even after compilation
+# makeDocumentedCWrapper EXECUTABLE ARGS
+# ARGS: same as makeWrapper
+makeDocumentedCWrapper() {
+    local src docs
+    src=$(makeCWrapper "$@")
+    docs=$(docstring "$@")
+    printf '%s\n\n' "$src"
+    printf '%s\n' "$docs"
+}
+
+# makeCWrapper EXECUTABLE ARGS
+# ARGS: same as makeWrapper
+makeCWrapper() {
+    local argv0 inherit_argv0 n params cmd main flagsBefore flags executable length
+    local uses_prefix uses_suffix uses_assert uses_assert_success uses_stdio uses_asprintf
+    executable=$(escapeStringLiteral "$1")
+    params=("$@")
+    length=${#params[*]}
+    for ((n = 1; n < length; n += 1)); do
+        p="${params[n]}"
+        case $p in
+            --set)
+                cmd=$(setEnv "${params[n + 1]}" "${params[n + 2]}")
+                main="$main$cmd"$'\n'
+                n=$((n + 2))
+                [ $n -ge "$length" ] && main="$main#error makeCWrapper: $p takes 2 arguments"$'\n'
+            ;;
+            --set-default)
+                cmd=$(setDefaultEnv "${params[n + 1]}" "${params[n + 2]}")
+                main="$main$cmd"$'\n'
+                uses_stdio=1
+                uses_assert_success=1
+                n=$((n + 2))
+                [ $n -ge "$length" ] && main="$main#error makeCWrapper: $p takes 2 arguments"$'\n'
+            ;;
+            --unset)
+                cmd=$(unsetEnv "${params[n + 1]}")
+                main="$main$cmd"$'\n'
+                uses_stdio=1
+                uses_assert_success=1
+                n=$((n + 1))
+                [ $n -ge "$length" ] && main="$main#error makeCWrapper: $p takes 1 argument"$'\n'
+            ;;
+            --prefix)
+                cmd=$(setEnvPrefix "${params[n + 1]}" "${params[n + 2]}" "${params[n + 3]}")
+                main="$main$cmd"$'\n'
+                uses_prefix=1
+                uses_asprintf=1
+                uses_stdio=1
+                uses_assert_success=1
+                uses_assert=1
+                n=$((n + 3))
+                [ $n -ge "$length" ] && main="$main#error makeCWrapper: $p takes 3 arguments"$'\n'
+            ;;
+            --suffix)
+                cmd=$(setEnvSuffix "${params[n + 1]}" "${params[n + 2]}" "${params[n + 3]}")
+                main="$main$cmd"$'\n'
+                uses_suffix=1
+                uses_asprintf=1
+                uses_stdio=1
+                uses_assert_success=1
+                uses_assert=1
+                n=$((n + 3))
+                [ $n -ge "$length" ] && main="$main#error makeCWrapper: $p takes 3 arguments"$'\n'
+            ;;
+            --chdir)
+                cmd=$(changeDir "${params[n + 1]}")
+                main="$main$cmd"$'\n'
+                uses_stdio=1
+                uses_assert_success=1
+                n=$((n + 1))
+                [ $n -ge "$length" ] && main="$main#error makeCWrapper: $p takes 1 argument"$'\n'
+            ;;
+            --add-flags)
+                flags="${params[n + 1]}"
+                flagsBefore="$flagsBefore $flags"
+                uses_assert=1
+                n=$((n + 1))
+                [ $n -ge "$length" ] && main="$main#error makeCWrapper: $p takes 1 argument"$'\n'
+            ;;
+            --argv0)
+                argv0=$(escapeStringLiteral "${params[n + 1]}")
+                inherit_argv0=
+                n=$((n + 1))
+                [ $n -ge "$length" ] && main="$main#error makeCWrapper: $p takes 1 argument"$'\n'
+            ;;
+            --inherit-argv0)
+                # Whichever comes last of --argv0 and --inherit-argv0 wins
+                inherit_argv0=1
+            ;;
+            *) # Using an error macro, we will make sure the compiler gives an understandable error message
+                main="$main#error makeCWrapper: Unknown argument ${p}"$'\n'
+            ;;
+        esac
+    done
+    # shellcheck disable=SC2086
+    [ -z "$flagsBefore" ] || main="$main"${main:+$'\n'}$(addFlags $flagsBefore)$'\n'$'\n'
+    [ -z "$inherit_argv0" ] && main="${main}argv[0] = \"${argv0:-${executable}}\";"$'\n'
+    main="${main}return execv(\"${executable}\", argv);"$'\n'
+
+    [ -z "$uses_asprintf" ] || printf '%s\n' "#define _GNU_SOURCE         /* See feature_test_macros(7) */"
+    printf '%s\n' "#include <unistd.h>"
+    printf '%s\n' "#include <stdlib.h>"
+    [ -z "$uses_assert" ]   || printf '%s\n' "#include <assert.h>"
+    [ -z "$uses_stdio" ]    || printf '%s\n' "#include <stdio.h>"
+    [ -z "$uses_assert_success" ] || printf '\n%s\n' "#define assert_success(e) do { if ((e) < 0) { perror(#e); abort(); } } while (0)"
+    [ -z "$uses_prefix" ] || printf '\n%s\n' "$(setEnvPrefixFn)"
+    [ -z "$uses_suffix" ] || printf '\n%s\n' "$(setEnvSuffixFn)"
+    printf '\n%s' "int main(int argc, char **argv) {"
+    printf '\n%s' "$(indent4 "$main")"
+    printf '\n%s\n' "}"
+}
+
+addFlags() {
+    local result n flag flags var
+    var="argv_tmp"
+    flags=("$@")
+    for ((n = 0; n < ${#flags[*]}; n += 1)); do
+        flag=$(escapeStringLiteral "${flags[$n]}")
+        result="$result${var}[$((n+1))] = \"$flag\";"$'\n'
+    done
+    printf '%s\n' "char **$var = calloc($((n+1)) + argc, sizeof(*$var));"
+    printf '%s\n' "assert($var != NULL);"
+    printf '%s\n' "${var}[0] = argv[0];"
+    printf '%s' "$result"
+    printf '%s\n' "for (int i = 1; i < argc; ++i) {"
+    printf '%s\n' "    ${var}[$n + i] = argv[i];"
+    printf '%s\n' "}"
+    printf '%s\n' "${var}[$n + argc] = NULL;"
+    printf '%s\n' "argv = $var;"
+}
+
+# chdir DIR
+changeDir() {
+    local dir
+    dir=$(escapeStringLiteral "$1")
+    printf '%s' "assert_success(chdir(\"$dir\"));"
+}
+
+# prefix ENV SEP VAL
+setEnvPrefix() {
+    local env sep val
+    env=$(escapeStringLiteral "$1")
+    sep=$(escapeStringLiteral "$2")
+    val=$(escapeStringLiteral "$3")
+    printf '%s' "set_env_prefix(\"$env\", \"$sep\", \"$val\");"
+    assertValidEnvName "$1"
+}
+
+# suffix ENV SEP VAL
+setEnvSuffix() {
+    local env sep val
+    env=$(escapeStringLiteral "$1")
+    sep=$(escapeStringLiteral "$2")
+    val=$(escapeStringLiteral "$3")
+    printf '%s' "set_env_suffix(\"$env\", \"$sep\", \"$val\");"
+    assertValidEnvName "$1"
+}
+
+# setEnv KEY VALUE
+setEnv() {
+    local key value
+    key=$(escapeStringLiteral "$1")
+    value=$(escapeStringLiteral "$2")
+    printf '%s' "putenv(\"$key=$value\");"
+    assertValidEnvName "$1"
+}
+
+# setDefaultEnv KEY VALUE
+setDefaultEnv() {
+    local key value
+    key=$(escapeStringLiteral "$1")
+    value=$(escapeStringLiteral "$2")
+    printf '%s' "assert_success(setenv(\"$key\", \"$value\", 0));"
+    assertValidEnvName "$1"
+}
+
+# unsetEnv KEY
+unsetEnv() {
+    local key
+    key=$(escapeStringLiteral "$1")
+    printf '%s' "assert_success(unsetenv(\"$key\"));"
+    assertValidEnvName "$1"
+}
+
+# Makes it safe to insert STRING within quotes in a C String Literal.
+# escapeStringLiteral STRING
+escapeStringLiteral() {
+    local result
+    result=${1//$'\\'/$'\\\\'}
+    result=${result//\"/'\"'}
+    result=${result//$'\n'/"\n"}
+    result=${result//$'\r'/"\r"}
+    printf '%s' "$result"
+}
+
+# Indents every non-empty line by 4 spaces. To avoid trailing whitespace, we don't indent empty lines
+# indent4 TEXT_BLOCK
+indent4() {
+    printf '%s' "$1" | awk '{ if ($0 != "") { print "    "$0 } else { print $0 }}'
+}
+
+assertValidEnvName() {
+    case "$1" in
+        *=*) printf '\n%s\n' "#error Illegal environment variable name \`$1\` (cannot contain \`=\`)";;
+        "")  printf '\n%s\n' "#error Environment variable name can't be empty.";;
+    esac
+}
+
+setEnvPrefixFn() {
+    printf '%s' "\
+void set_env_prefix(char *env, char *sep, char *prefix) {
+    char *existing = getenv(env);
+    if (existing) {
+        char *val;
+        assert_success(asprintf(&val, \"%s%s%s\", prefix, sep, existing));
+        assert_success(setenv(env, val, 1));
+        free(val);
+    } else {
+        assert_success(setenv(env, prefix, 1));
+    }
+}
+"
+}
+
+setEnvSuffixFn() {
+    printf '%s' "\
+void set_env_suffix(char *env, char *sep, char *suffix) {
+    char *existing = getenv(env);
+    if (existing) {
+        char *val;
+        assert_success(asprintf(&val, \"%s%s%s\", existing, sep, suffix));
+        assert_success(setenv(env, val, 1));
+        free(val);
+    } else {
+        assert_success(setenv(env, suffix, 1));
+    }
+}
+"
+}
+
+# Embed a C string which shows up as readable text in the compiled binary wrapper
+# documentationString ARGS
+docstring() {
+    printf '%s' "const char * DOCSTRING = \"$(escapeStringLiteral "
+
+
+# ------------------------------------------------------------------------------------
+# The C-code for this binary wrapper has been generated using the following command:
+
+
+makeCWrapper $(formatArgs "$@")
+
+
+# (Use \`nix-shell -p makeBinaryWrapper\` to get access to makeCWrapper in your shell)
+# ------------------------------------------------------------------------------------
+
+
+")\";"
+}
+
+# formatArgs EXECUTABLE ARGS
+formatArgs() {
+    printf '%s' "$1"
+    shift
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            --set)
+                formatArgsLine 2 "$@"
+                shift 2
+            ;;
+            --set-default)
+                formatArgsLine 2 "$@"
+                shift 2
+            ;;
+            --unset)
+                formatArgsLine 1 "$@"
+                shift 1
+            ;;
+            --prefix)
+                formatArgsLine 3 "$@"
+                shift 3
+            ;;
+            --suffix)
+                formatArgsLine 3 "$@"
+                shift 3
+            ;;
+            --chdir)
+                formatArgsLine 1 "$@"
+                shift 1
+            ;;
+            --add-flags)
+                formatArgsLine 1 "$@"
+                shift 1
+            ;;
+            --argv0)
+                formatArgsLine 1 "$@"
+                shift 1
+            ;;
+            --inherit-argv0)
+                formatArgsLine 0 "$@"
+            ;;
+        esac
+        shift
+    done
+    printf '%s\n' ""
+}
+
+# formatArgsLine ARG_COUNT ARGS
+formatArgsLine() {
+    local ARG_COUNT LENGTH
+    ARG_COUNT=$1
+    LENGTH=$#
+    shift
+    printf '%s' $' \\\n    '"$1"
+    shift
+    while [ "$ARG_COUNT" -gt $((LENGTH - $# - 2)) ]; do
+        printf ' %s' "${1@Q}"
+        shift
+    done
+}

pkgs/data/misc/hackage/pin.json

@@ -1,6 +1,6 @@
 {
-  "commit": "f68c8c181db05f72a6423ed12b503445944face7",
-  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/f68c8c181db05f72a6423ed12b503445944face7.tar.gz",
-  "sha256": "0rcmpkd9hliiq4cj2mjnn2bi9lc4yh2ha6xh1mwxh7qf2i0zgjx6",
-  "msg": "Update from Hackage at 2021-12-07T20:15:21Z"
+  "commit": "5b1efa929ec68b76f8e84df53bf48b6e4a392feb",
+  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/5b1efa929ec68b76f8e84df53bf48b6e4a392feb.tar.gz",
+  "sha256": "1azja4gm6yy8zs0fjfiscjamfn13w4wp9wwadqhzhv0dmisg9y8v",
+  "msg": "Update from Hackage at 2021-12-08T21:36:39Z"
 }

pkgs/development/haskell-modules/configuration-common.nix

@@ -2121,4 +2121,7 @@ EOT
   # https://github.com/ChrisPenner/jet/issues/1
   jet = doJailbreak super.jet;
 
+  # Use latest version until next Stackage LTS snapshot
+  Agda = doDistribute self.Agda_2_6_2_1;
+
 } // import ./configuration-tensorflow.nix {inherit pkgs haskellLib;} self super

pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml

@@ -88,6 +88,7 @@ broken-packages:
   - aeson-tiled
   - aeson-typescript
   - aeson-utils
+  - aeson-value-parser
   - affection
   - affine-invariant-ensemble-mcmc
   - Agata

pkgs/development/haskell-modules/hackage-packages.nix

@@ -832,6 +832,42 @@ self: {
        maintainers = with lib.maintainers; [ abbradar turion ];
      }) {inherit (pkgs) emacs;};
 
+  "Agda_2_6_2_1" = callPackage
+    ({ mkDerivation, aeson, alex, array, async, base, binary
+     , blaze-html, boxes, bytestring, Cabal, case-insensitive
+     , containers, data-hash, deepseq, directory, edit-distance, emacs
+     , equivalence, exceptions, filepath, ghc-compact, gitrev, happy
+     , hashable, hashtables, haskeline, monad-control, mtl, murmur-hash
+     , parallel, pretty, process, regex-tdfa, split, stm, strict
+     , template-haskell, text, time, transformers, unordered-containers
+     , uri-encode, zlib
+     }:
+     mkDerivation {
+       pname = "Agda";
+       version = "2.6.2.1";
+       sha256 = "03dw7jfqr3ffik6avigm525djqh2gn5c3qwnb2h6298zkr9lch9w";
+       isLibrary = true;
+       isExecutable = true;
+       enableSeparateDataOutput = true;
+       setupHaskellDepends = [ base Cabal directory filepath process ];
+       libraryHaskellDepends = [
+         aeson array async base binary blaze-html boxes bytestring
+         case-insensitive containers data-hash deepseq directory
+         edit-distance equivalence exceptions filepath ghc-compact gitrev
+         hashable hashtables haskeline monad-control mtl murmur-hash
+         parallel pretty process regex-tdfa split stm strict
+         template-haskell text time transformers unordered-containers
+         uri-encode zlib
+       ];
+       libraryToolDepends = [ alex happy ];
+       executableHaskellDepends = [ base directory filepath process ];
+       executableToolDepends = [ emacs ];
+       description = "A dependently typed functional programming language and proof assistant";
+       license = "unknown";
+       hydraPlatforms = lib.platforms.none;
+       maintainers = with lib.maintainers; [ abbradar turion ];
+     }) {inherit (pkgs) emacs;};
+
   "Agda-executable" = callPackage
     ({ mkDerivation, Agda, base }:
      mkDerivation {
@@ -25085,6 +25121,8 @@ self: {
        pname = "aeson-iproute";
        version = "0.2.1";
        sha256 = "1130mr5fqwi4d74xg6nkvpqycc0vvd6rsiahm1pdhbrx3wvra8p2";
+       revision = "1";
+       editedCabalFile = "1q9yr42mvvcqy20ww1xcsy2q6jji0mrqng2clq8yd5diyy7kqx1a";
        libraryHaskellDepends = [
          aeson base iproute text unordered-containers
        ];
@@ -25541,19 +25579,21 @@ self: {
 
   "aeson-value-parser" = callPackage
     ({ mkDerivation, aeson, attoparsec, base, bytestring, hashable
-     , megaparsec, mtl, scientific, text, text-builder, transformers
+     , megaparsec, mtl, scientific, text, transformers
      , unordered-containers, vector
      }:
      mkDerivation {
        pname = "aeson-value-parser";
-       version = "0.19.4";
-       sha256 = "1z4l7x29zxalmf8qqynyz87mgr0xbjzvffmxk76r0kal31yljq81";
+       version = "0.19.4.1";
+       sha256 = "0bg4jwb6d6gyvhfzvrlj7snaga077pmfxnanirzqiqjf14g6hcif";
        libraryHaskellDepends = [
          aeson attoparsec base bytestring hashable megaparsec mtl scientific
-         text text-builder transformers unordered-containers vector
+         text transformers unordered-containers vector
        ];
        description = "API for parsing \"aeson\" JSON tree into Haskell types";
        license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
      }) {};
 
   "aeson-via" = callPackage
@@ -48667,23 +48707,20 @@ self: {
        hydraPlatforms = lib.platforms.none;
      }) {};
 
-  "bytestring_0_11_1_0" = callPackage
-    ({ mkDerivation, base, deepseq, dlist, ghc-prim, integer-gmp
-     , random, tasty, tasty-bench, tasty-hunit, tasty-quickcheck
-     , transformers
+  "bytestring_0_11_2_0" = callPackage
+    ({ mkDerivation, base, deepseq, ghc-prim, QuickCheck, random, tasty
+     , tasty-bench, tasty-quickcheck, template-haskell, transformers
      }:
      mkDerivation {
        pname = "bytestring";
-       version = "0.11.1.0";
-       sha256 = "1a29kwczd1hcpir691x936i9c5ys9d7m1lyby48djs9w54ksy1jw";
-       libraryHaskellDepends = [ base deepseq ghc-prim integer-gmp ];
+       version = "0.11.2.0";
+       sha256 = "16w5j3vxyak3ycfc8w1zwmagznlavgrwiqa1m0fn7s38vzjb7yjf";
+       libraryHaskellDepends = [ base deepseq ghc-prim template-haskell ];
        testHaskellDepends = [
-         base deepseq dlist ghc-prim tasty tasty-hunit tasty-quickcheck
-         transformers
-       ];
-       benchmarkHaskellDepends = [
-         base deepseq dlist random tasty-bench
+         base deepseq ghc-prim QuickCheck tasty tasty-quickcheck
+         template-haskell transformers
        ];
+       benchmarkHaskellDepends = [ base deepseq random tasty-bench ];
        description = "Fast, compact, strict and lazy byte strings with a list interface";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
@@ -63714,10 +63751,8 @@ self: {
      }:
      mkDerivation {
        pname = "config-value";
-       version = "0.8.1";
-       sha256 = "086jv01a737547w6x9w1951vq0p7mx6vqw9ifw5kcs5nvhj5rx2q";
-       revision = "2";
-       editedCabalFile = "1qw39gzq97fy3axdfi0y1i9knly2gfzhm3dljby3x1cfwzrj351w";
+       version = "0.8.2";
+       sha256 = "1yfy453mykwav6b3i58bmpkyb8jxyh96b96lvx2iyd4dz1i75cdk";
        libraryHaskellDepends = [ array base containers pretty text ];
        libraryToolDepends = [ alex happy ];
        testHaskellDepends = [ base text ];
@@ -100758,7 +100793,7 @@ self: {
        license = lib.licenses.isc;
      }) {};
 
-  "futhark_0_20_7" = callPackage
+  "futhark_0_20_8" = callPackage
     ({ mkDerivation, aeson, alex, ansi-terminal, array, base
      , base16-bytestring, binary, blaze-html, bmp, bytestring
      , bytestring-to-vector, cmark-gfm, containers, cryptohash-md5
@@ -100773,8 +100808,8 @@ self: {
      }:
      mkDerivation {
        pname = "futhark";
-       version = "0.20.7";
-       sha256 = "1j91gilrjyi0hd7fsh1pq687y4vdmk9kv0lwrwhq74rcczyyyrvj";
+       version = "0.20.8";
+       sha256 = "1a8sr934yf27n7hfa06239qxcpmaj7xqc47y4hpl7wa86bpvld1g";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -154998,8 +155033,8 @@ self: {
        pname = "intcode";
        version = "0.3.0.0";
        sha256 = "0qcws15hn03wnsv1rg93sw9zhwsyvwpiafrmwnyv9v990qap1x8y";
-       revision = "2";
-       editedCabalFile = "1yd0i90i910ysc7xflpdnkp4bgp1k6cdcl8p3qwqi07vlngkscxw";
+       revision = "3";
+       editedCabalFile = "1afp0s2zgqnkfh7qszpqbm3slmj021pmin9id1pyns8k9al06v2y";
        libraryHaskellDepends = [ base containers primitive ];
        testHaskellDepends = [ base containers doctest primitive ];
        description = "Advent of Code 2019 intcode interpreter";
@@ -161526,6 +161561,26 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "kanji_3_5_0" = callPackage
+    ({ mkDerivation, aeson, base, containers, criterion, deepseq
+     , hashable, HUnit-approx, tasty, tasty-hunit, text
+     }:
+     mkDerivation {
+       pname = "kanji";
+       version = "3.5.0";
+       sha256 = "15s640fq65l3f93w2sr3kyjm5gvp78lflcvmrz4ldndnyrzcq2c2";
+       libraryHaskellDepends = [
+         aeson base containers deepseq hashable text
+       ];
+       testHaskellDepends = [
+         aeson base containers HUnit-approx tasty tasty-hunit text
+       ];
+       benchmarkHaskellDepends = [ aeson base containers criterion text ];
+       description = "Perform 漢字検定 (Japan Kanji Aptitude Test) level analysis on Japanese Kanji";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "kansas-comet" = callPackage
     ({ mkDerivation, aeson, base, containers, data-default-class
      , scotty, stm, text, time, transformers, unordered-containers
@@ -220720,8 +220775,8 @@ self: {
      }:
      mkDerivation {
        pname = "prometheus-proc";
-       version = "0.1.3.0";
-       sha256 = "0pljmmas8wsigwd3m2ddjzn9mbsgsh0hbf1kz7301w8g5hnjfx03";
+       version = "0.1.3.1";
+       sha256 = "1g4pfnyamcn3p2qgnviz1f1lq808jpbi2fkibrxk0xb60flism3l";
        libraryHaskellDepends = [
          base directory filepath prometheus-client regex-applicative text
          unix unix-memory
@@ -248061,8 +248116,8 @@ self: {
      }:
      mkDerivation {
        pname = "shortbytestring";
-       version = "0.2.0.0";
-       sha256 = "1mwr0nf0jd8j0yd2lzvlaav44g5kil7yh3yazvdqc35bf52chc6s";
+       version = "0.2.1.0";
+       sha256 = "1aisvy9a0lbql7p1lhlbkpa3gp57cahb9fblg9rps8wz613vy62w";
        libraryHaskellDepends = [
          base bytestring exceptions primitive template-haskell text word16
          word8
@@ -249885,30 +249940,32 @@ self: {
      , attoparsec, base, base64-bytestring, bytestring, composition
      , constraints, containers, cryptonite, cryptostore, direct-sqlite
      , directory, file-embed, filepath, generic-random, hspec
-     , hspec-core, HUnit, ini, iso8601-time, memory, mtl, network
-     , network-transport, optparse-applicative, QuickCheck, random
-     , simple-logger, sqlite-simple, stm, template-haskell, text, time
-     , timeit, transformers, unliftio, unliftio-core, websockets, x509
+     , hspec-core, http-types, HUnit, ini, iso8601-time, memory, mtl
+     , network, network-transport, optparse-applicative, QuickCheck
+     , random, simple-logger, sqlite-simple, stm, template-haskell, text
+     , time, timeit, transformers, unliftio, unliftio-core, websockets
+     , x509
      }:
      mkDerivation {
        pname = "simplexmq";
-       version = "0.4.1";
-       sha256 = "0bqpjvcxk8fij0bvdp8abpaca17hwkjrya5fhiwzjsrs48c5w0by";
+       version = "0.5.0";
+       sha256 = "0wmhqmrxzgb4zvxmcsv49lzmvgqrqljivzcjfp4s04j87968x79j";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
          ansi-terminal asn1-encoding asn1-types async attoparsec base
          base64-bytestring bytestring composition constraints containers
          cryptonite direct-sqlite directory file-embed filepath
-         generic-random iso8601-time memory mtl network network-transport
-         QuickCheck random simple-logger sqlite-simple stm template-haskell
-         text time transformers unliftio unliftio-core websockets x509
+         generic-random http-types iso8601-time memory mtl network
+         network-transport QuickCheck random simple-logger sqlite-simple stm
+         template-haskell text time transformers unliftio unliftio-core
+         websockets x509
        ];
        executableHaskellDepends = [
          ansi-terminal asn1-encoding asn1-types async attoparsec base
          base64-bytestring bytestring composition constraints containers
          cryptonite cryptostore direct-sqlite directory file-embed filepath
-         generic-random ini iso8601-time memory mtl network
+         generic-random http-types ini iso8601-time memory mtl network
          network-transport optparse-applicative QuickCheck random
          simple-logger sqlite-simple stm template-haskell text time
          transformers unliftio unliftio-core websockets x509
@@ -249917,10 +249974,10 @@ self: {
          ansi-terminal asn1-encoding asn1-types async attoparsec base
          base64-bytestring bytestring composition constraints containers
          cryptonite direct-sqlite directory file-embed filepath
-         generic-random hspec hspec-core HUnit iso8601-time memory mtl
-         network network-transport QuickCheck random simple-logger
-         sqlite-simple stm template-haskell text time timeit transformers
-         unliftio unliftio-core websockets x509
+         generic-random hspec hspec-core http-types HUnit iso8601-time
+         memory mtl network network-transport QuickCheck random
+         simple-logger sqlite-simple stm template-haskell text time timeit
+         transformers unliftio unliftio-core websockets x509
        ];
        description = "SimpleXMQ message broker";
        license = lib.licenses.agpl3Only;
@@ -288194,8 +288251,8 @@ self: {
      }:
      mkDerivation {
        pname = "vector-extras";
-       version = "0.2.2.2";
-       sha256 = "1xlwfdyqmf0z2g3fmisz4gfz1f7y8db5446vkbp5qwlq3r1m6acd";
+       version = "0.2.3";
+       sha256 = "13iiy6jdbp4fgdxhm7jhkr1hqilgmzwmfjyjna6a64vb20vr9xyr";
        libraryHaskellDepends = [
          base containers deferred-folds foldl hashable unordered-containers
          vector
@@ -290008,8 +290065,8 @@ self: {
      }:
      mkDerivation {
        pname = "vulkan";
-       version = "3.14.1";
-       sha256 = "1ai8iw41z43l4x3x7hpdb0c0fxl4c4mc86g0r00m617056756732";
+       version = "3.14.2";
+       sha256 = "0zd6zki6hx0bhqvy20yhvd3597nxaasl2665s7m64bi02qjgjwsj";
        libraryHaskellDepends = [ base bytestring transformers vector ];
        libraryPkgconfigDepends = [ vulkan ];
        testHaskellDepends = [
@@ -290815,6 +290872,24 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "wai-logger_2_3_7" = callPackage
+    ({ mkDerivation, base, byteorder, bytestring, Cabal, cabal-doctest
+     , doctest, fast-logger, http-types, network, wai
+     }:
+     mkDerivation {
+       pname = "wai-logger";
+       version = "2.3.7";
+       sha256 = "0kp2bg8s2vz9lxa7hmd7xv3jlsz1dmfsgkb405x9sz92x6jb521f";
+       setupHaskellDepends = [ base Cabal cabal-doctest ];
+       libraryHaskellDepends = [
+         base byteorder bytestring fast-logger http-types network wai
+       ];
+       testHaskellDepends = [ base doctest ];
+       description = "A logging system for WAI";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "wai-logger-buffered" = callPackage
     ({ mkDerivation, base, bytestring, containers, data-default
      , http-types, time, wai, warp
@@ -295164,6 +295239,8 @@ self: {
        pname = "wl-pprint-text";
        version = "1.2.0.1";
        sha256 = "030ckgzz14sv2c317g4j5g68hyq9xi40cmv0apwclw6sc6xgsvly";
+       revision = "1";
+       editedCabalFile = "0yy27q99hmkf8amy0gfrh2xgwa22nb294p2fvqawjbpwxa2x1qxb";
        libraryHaskellDepends = [ base base-compat text ];
        description = "A Wadler/Leijen Pretty Printer for Text values";
        license = lib.licenses.bsd3;
@@ -295385,6 +295462,8 @@ self: {
        pname = "word16";
        version = "0.1.0.0";
        sha256 = "0z2nabnh7b42bl7hqy2iw68a1gxay26pgsid7m4hs8s2d7cghndx";
+       revision = "1";
+       editedCabalFile = "0vnjz4rxg062r306ycjlrxk6s4823gwiv8dcq2yn66rxif79ax5a";
        libraryHaskellDepends = [ base bytestring template-haskell text ];
        testHaskellDepends = [ base hspec ];
        testToolDepends = [ hspec-discover ];

pkgs/development/libraries/ntl/default.nix

@@ -14,11 +14,11 @@ assert withGf2x -> gf2x != null;
 
 stdenv.mkDerivation rec {
   pname = "ntl";
-  version = "11.4.4";
+  version = "11.5.1";
 
   src = fetchurl {
     url = "http://www.shoup.net/ntl/ntl-${version}.tar.gz";
-    sha256 = "sha256-nX9uguEaQJ8VHA3i3rCMDXY7r5g0/d/UMr89IY+AIds=";
+    sha256 = "sha256-IQ0GwxMGy8bq9oFEU8Vsd22djo3zbXTrMG9qUj0caoo=";
   };
 
   buildInputs = [

pkgs/development/python-modules/freezegun/default.nix

@@ -1,6 +1,8 @@
 { lib
 , buildPythonPackage
 , pythonOlder
+, pythonAtLeast
+, fetchpatch
 , fetchPypi
 , python-dateutil
 , pytestCheckHook
@@ -16,6 +18,14 @@ buildPythonPackage rec {
     sha256 = "177f9dd59861d871e27a484c3332f35a6e3f5d14626f2bf91be37891f18927f3";
   };
 
+  patches = lib.optionals (pythonAtLeast "3.10") [
+    # Staticmethods in 3.10+ are now callable, prevent freezegun to attempt to decorate them
+    (fetchpatch {
+      url = "https://github.com/spulec/freezegun/pull/397/commits/e63874ce75a74a1159390914045fe8e7955b24c4.patch";
+      sha256 = "sha256-FNABqVN5DFqVUR88lYzwbfsZj3xcB9/MvQtm+I2VjnI=";
+    })
+  ];
+
   propagatedBuildInputs = [ python-dateutil ];
   checkInputs = [ pytestCheckHook ];
 

pkgs/development/python-modules/python-lsp-black/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "python-lsp-black";
-  version = "1.0.0";
+  version = "1.0.1";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "python-lsp";
     repo = "python-lsp-black";
     rev = "v${version}";
-    sha256 = "1blxhj70jxb9xfbd4dxqikd262n6dn9dw5qhyml5yvdwxbv0bybc";
+    sha256 = "03k32m4jfqfzrawj69yxhk9kwzsdcwginip77kxdbra2xwgqfc3w";
   };
 
   checkInputs = [ pytestCheckHook ];

pkgs/development/ruby-modules/gem-config/default.nix

@@ -26,7 +26,7 @@
 , file, libvirt, glib, vips, taglib, libopus, linux-pam, libidn, protobuf, fribidi, harfbuzz
 , bison, flex, pango, python3, patchelf, binutils, freetds, wrapGAppsHook, atk
 , bundler, libsass, libexif, libselinux, libsepol, shared-mime-info, libthai, libdatrie
-, CoreServices, DarwinTools, cctools
+, CoreServices, DarwinTools, cctools, libtool
 }@args:
 
 let
@@ -280,7 +280,7 @@ in
   };
 
   grpc = attrs: {
-    nativeBuildInputs = [ pkg-config ];
+    nativeBuildInputs = [ pkg-config ] ++ lib.optional stdenv.isDarwin libtool;
     buildInputs = [ openssl ];
     hardeningDisable = [ "format" ];
     NIX_CFLAGS_COMPILE = toString [
@@ -297,6 +297,9 @@ in
     postPatch = ''
       substituteInPlace Makefile \
         --replace '-Wno-invalid-source-encoding' ""
+    '' + lib.optionalString stdenv.isDarwin ''
+      substituteInPlace src/ruby/ext/grpc/extconf.rb \
+        --replace "ENV['AR'] = 'libtool -o' if RUBY_PLATFORM =~ /darwin/" ""
     '';
   };
 
@@ -570,7 +573,7 @@ in
   };
 
   rugged = attrs: {
-    nativeBuildInputs = [ cmake pkg-config which ];
+    nativeBuildInputs = [ cmake pkg-config which ] ++ lib.optional stdenv.isDarwin libiconv;
     buildInputs = [ openssl libssh2 zlib ];
     dontUseCmakeConfigure = true;
   };

pkgs/os-specific/linux/zsa-udev-rules/default.nix

@@ -1,18 +1,17 @@
 { lib, stdenv, fetchFromGitHub }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "zsa-udev-rules";
-  version = "unstable-2020-12-16";
+  version = "2.1.3";
 
-  # TODO: use version and source from nixpkgs/pkgs/development/tools/wally-cli/default.nix after next release
   src = fetchFromGitHub {
     owner = "zsa";
     repo = "wally";
-    rev = "e5dde3c700beab39fb941c6941e55535bf9b2af6";
-    sha256 = "0pkybi32r1hrmpa1mc8qlzhv7xy5n5rr5ah25lbr0cipp1bda417";
+    rev = "${version}-linux";
+    sha256 = "mZzXKFKlO/jAitnqzfvmIHp46A+R3xt2gOhVC3qN6gM=";
   };
 
-  # it only installs files
+  # Only copies udevs rules
   dontConfigure = true;
   dontBuild = true;
   dontFixup = true;

pkgs/servers/dns/knot-resolver/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl
+{ lib, stdenv, fetchurl, fetchpatch
 # native deps.
 , runCommand, pkg-config, meson, ninja, makeWrapper
 # build+runtime deps.
@@ -26,6 +26,14 @@ unwrapped = stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
+  patches = [
+    (fetchpatch { # https://gitlab.nic.cz/knot/knot-resolver/-/merge_requests/1237
+      name = "console.aws.amazon.com-fix.patch";
+      url = "https://gitlab.nic.cz/knot/knot-resolver/-/commit/f4dabfbec9273703.diff";
+      sha256 = "3J+FDwNQ6CqIGo9pSzhrQZlHX99vXFDpPOBpwpCnOxs=";
+    })
+  ];
+
   # Path fixups for the NixOS service.
   postPatch = ''
     patch meson.build <<EOF

pkgs/test/default.nix

@@ -35,6 +35,8 @@ with pkgs;
 
   macOSSierraShared = callPackage ./macos-sierra-shared {};
 
+  make-binary-wrapper = callPackage ./make-binary-wrapper { inherit makeBinaryWrapper; };
+
   cross = callPackage ./cross {};
 
   php = recurseIntoAttrs (callPackages ./php {});

pkgs/test/make-binary-wrapper/add-flags.c

@@ -0,0 +1,21 @@
+#include <unistd.h>
+#include <stdlib.h>
+#include <assert.h>
+
+int main(int argc, char **argv) {
+    char **argv_tmp = calloc(5 + argc, sizeof(*argv_tmp));
+    assert(argv_tmp != NULL);
+    argv_tmp[0] = argv[0];
+    argv_tmp[1] = "-x";
+    argv_tmp[2] = "-y";
+    argv_tmp[3] = "-z";
+    argv_tmp[4] = "-abc";
+    for (int i = 1; i < argc; ++i) {
+        argv_tmp[4 + i] = argv[i];
+    }
+    argv_tmp[4 + argc] = NULL;
+    argv = argv_tmp;
+
+    argv[0] = "/send/me/flags";
+    return execv("/send/me/flags", argv);
+}

pkgs/test/make-binary-wrapper/add-flags.cmdline

@@ -0,0 +1,2 @@
+    --add-flags "-x -y -z" \
+    --add-flags -abc

pkgs/test/make-binary-wrapper/add-flags.env

@@ -0,0 +1,6 @@
+CWD=SUBST_CWD
+SUBST_ARGV0
+-x
+-y
+-z
+-abc

pkgs/test/make-binary-wrapper/argv0.c

@@ -0,0 +1,7 @@
+#include <unistd.h>
+#include <stdlib.h>
+
+int main(int argc, char **argv) {
+    argv[0] = "alternative-name";
+    return execv("/send/me/flags", argv);
+}

pkgs/test/make-binary-wrapper/argv0.cmdline

@@ -0,0 +1 @@
+    --argv0 alternative-name

pkgs/test/make-binary-wrapper/argv0.env

@@ -0,0 +1,2 @@
+CWD=SUBST_CWD
+alternative-name

pkgs/test/make-binary-wrapper/basic.c

@@ -0,0 +1,7 @@
+#include <unistd.h>
+#include <stdlib.h>
+
+int main(int argc, char **argv) {
+    argv[0] = "/send/me/flags";
+    return execv("/send/me/flags", argv);
+}

pkgs/test/make-binary-wrapper/basic.env

@@ -0,0 +1,2 @@
+CWD=SUBST_CWD
+SUBST_ARGV0

pkgs/test/make-binary-wrapper/chdir.c

@@ -0,0 +1,11 @@
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#define assert_success(e) do { if ((e) < 0) { perror(#e); abort(); } } while (0)
+
+int main(int argc, char **argv) {
+    assert_success(chdir("/tmp/foo"));
+    argv[0] = "/send/me/flags";
+    return execv("/send/me/flags", argv);
+}

pkgs/test/make-binary-wrapper/chdir.cmdline

@@ -0,0 +1 @@
+    --chdir /tmp/foo

pkgs/test/make-binary-wrapper/chdir.env

@@ -0,0 +1,2 @@
+CWD=/tmp/foo
+SUBST_ARGV0

pkgs/test/make-binary-wrapper/combination.c

@@ -0,0 +1,53 @@
+#define _GNU_SOURCE         /* See feature_test_macros(7) */
+#include <unistd.h>
+#include <stdlib.h>
+#include <assert.h>
+#include <stdio.h>
+
+#define assert_success(e) do { if ((e) < 0) { perror(#e); abort(); } } while (0)
+
+void set_env_prefix(char *env, char *sep, char *prefix) {
+    char *existing = getenv(env);
+    if (existing) {
+        char *val;
+        assert_success(asprintf(&val, "%s%s%s", prefix, sep, existing));
+        assert_success(setenv(env, val, 1));
+        free(val);
+    } else {
+        assert_success(setenv(env, prefix, 1));
+    }
+}
+
+void set_env_suffix(char *env, char *sep, char *suffix) {
+    char *existing = getenv(env);
+    if (existing) {
+        char *val;
+        assert_success(asprintf(&val, "%s%s%s", existing, sep, suffix));
+        assert_success(setenv(env, val, 1));
+        free(val);
+    } else {
+        assert_success(setenv(env, suffix, 1));
+    }
+}
+
+int main(int argc, char **argv) {
+    assert_success(setenv("MESSAGE", "HELLO", 0));
+    set_env_prefix("PATH", ":", "/usr/bin/");
+    set_env_suffix("PATH", ":", "/usr/local/bin/");
+    putenv("MESSAGE2=WORLD");
+
+    char **argv_tmp = calloc(4 + argc, sizeof(*argv_tmp));
+    assert(argv_tmp != NULL);
+    argv_tmp[0] = argv[0];
+    argv_tmp[1] = "-x";
+    argv_tmp[2] = "-y";
+    argv_tmp[3] = "-z";
+    for (int i = 1; i < argc; ++i) {
+        argv_tmp[3 + i] = argv[i];
+    }
+    argv_tmp[3 + argc] = NULL;
+    argv = argv_tmp;
+
+    argv[0] = "my-wrapper";
+    return execv("/send/me/flags", argv);
+}

pkgs/test/make-binary-wrapper/combination.cmdline

@@ -0,0 +1,6 @@
+    --argv0 my-wrapper \
+    --set-default MESSAGE HELLO \
+    --prefix PATH : /usr/bin/ \
+    --suffix PATH : /usr/local/bin/ \
+    --add-flags "-x -y -z" \
+    --set MESSAGE2 WORLD

pkgs/test/make-binary-wrapper/combination.env

@@ -0,0 +1,8 @@
+MESSAGE=HELLO
+PATH=/usr/bin/:/usr/local/bin/
+MESSAGE2=WORLD
+CWD=SUBST_CWD
+my-wrapper
+-x
+-y
+-z

pkgs/test/make-binary-wrapper/default.nix

@@ -0,0 +1,54 @@
+{ lib, coreutils, python3, gcc, writeText, writeScript, runCommand, makeBinaryWrapper }:
+
+let
+  env = { nativeBuildInputs = [ makeBinaryWrapper ]; };
+  envCheck = runCommand "envcheck" env ''
+    ${gcc}/bin/cc -Wall -Werror -Wpedantic -o $out ${./envcheck.c}
+  '';
+  makeGoldenTest = testname: runCommand "test-wrapper_${testname}" env ''
+    mkdir -p /tmp/foo
+
+    params=$(<"${./.}/${testname}.cmdline")
+    eval "makeCWrapper /send/me/flags $params" > wrapper.c
+
+    diff wrapper.c "${./.}/${testname}.c"
+
+    if [ -f "${./.}/${testname}.env" ]; then
+      eval "makeWrapper ${envCheck} wrapped $params"
+      env -i ./wrapped > env.txt
+      sed "s#SUBST_ARGV0#${envCheck}#;s#SUBST_CWD#$PWD#" \
+        "${./.}/${testname}.env" > golden-env.txt
+      if ! diff env.txt golden-env.txt; then
+        echo "env/argv should be:"
+        cat golden-env.txt
+        echo "env/argv output is:"
+        cat env.txt
+        exit 1
+      fi
+    else
+      # without a golden env, we expect the wrapper compilation to fail
+      ! eval "makeWrapper ${envCheck} wrapped $params" &> error.txt
+    fi
+
+    cp wrapper.c $out
+  '';
+  tests = let
+    names = [
+      "add-flags"
+      "argv0"
+      "basic"
+      "chdir"
+      "combination"
+      "env"
+      "inherit-argv0"
+      "invalid-env"
+      "prefix"
+      "suffix"
+    ];
+    f = name: lib.nameValuePair name (makeGoldenTest name);
+  in builtins.listToAttrs (builtins.map f names);
+in writeText "make-binary-wrapper-test" ''
+  ${lib.concatStringsSep "\n" (lib.mapAttrsToList (_: test: ''
+    "${test.name}" "${test}"
+  '') tests)}
+'' // tests

pkgs/test/make-binary-wrapper/env.c

@@ -0,0 +1,14 @@
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#define assert_success(e) do { if ((e) < 0) { perror(#e); abort(); } } while (0)
+
+int main(int argc, char **argv) {
+    putenv("PART1=HELLO");
+    assert_success(setenv("PART2", "WORLD", 0));
+    assert_success(unsetenv("SOME_OTHER_VARIABLE"));
+    putenv("PART3=\"!!\n\"");
+    argv[0] = "/send/me/flags";
+    return execv("/send/me/flags", argv);
+}

pkgs/test/make-binary-wrapper/env.cmdline

@@ -0,0 +1,4 @@
+    --set PART1 HELLO \
+    --set-default PART2 WORLD \
+    --unset SOME_OTHER_VARIABLE \
+    --set PART3 $'"!!\n"'

pkgs/test/make-binary-wrapper/env.env

@@ -0,0 +1,6 @@
+PART1=HELLO
+PART2=WORLD
+PART3="!!
+"
+CWD=SUBST_CWD
+SUBST_ARGV0

pkgs/test/make-binary-wrapper/envcheck.c

@@ -0,0 +1,22 @@
+#include <limits.h>
+#include <stdio.h>
+#include <unistd.h>
+
+int main(int argc, char **argv, char **envp) {
+  for (char **env = envp; *env != 0; ++env) {
+    puts(*env);
+  }
+
+   char cwd[PATH_MAX];
+   if (getcwd(cwd, sizeof(cwd))) {
+     printf("CWD=%s\n", cwd);
+   } else {
+     perror("getcwd() error");
+     return 1;
+   }
+
+  for (int i=0; i < argc; ++i) {
+    puts(argv[i]);
+  }
+  return 0;
+}

pkgs/test/make-binary-wrapper/inherit-argv0.c

@@ -0,0 +1,6 @@
+#include <unistd.h>
+#include <stdlib.h>
+
+int main(int argc, char **argv) {
+    return execv("/send/me/flags", argv);
+}

pkgs/test/make-binary-wrapper/inherit-argv0.cmdline

@@ -0,0 +1 @@
+    --inherit-argv0

pkgs/test/make-binary-wrapper/inherit-argv0.env

@@ -0,0 +1,2 @@
+CWD=SUBST_CWD
+./wrapped

pkgs/test/make-binary-wrapper/invalid-env.c

@@ -0,0 +1,14 @@
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#define assert_success(e) do { if ((e) < 0) { perror(#e); abort(); } } while (0)
+
+int main(int argc, char **argv) {
+    putenv("==TEST1");
+    #error Illegal environment variable name `=` (cannot contain `=`)
+    assert_success(setenv("", "TEST2", 0));
+    #error Environment variable name can't be empty.
+    argv[0] = "/send/me/flags";
+    return execv("/send/me/flags", argv);
+}

pkgs/test/make-binary-wrapper/invalid-env.cmdline

@@ -0,0 +1,2 @@
+    --set "=" "TEST1" \
+    --set-default "" "TEST2"

pkgs/test/make-binary-wrapper/prefix.c

@@ -0,0 +1,26 @@
+#define _GNU_SOURCE         /* See feature_test_macros(7) */
+#include <unistd.h>
+#include <stdlib.h>
+#include <assert.h>
+#include <stdio.h>
+
+#define assert_success(e) do { if ((e) < 0) { perror(#e); abort(); } } while (0)
+
+void set_env_prefix(char *env, char *sep, char *prefix) {
+    char *existing = getenv(env);
+    if (existing) {
+        char *val;
+        assert_success(asprintf(&val, "%s%s%s", prefix, sep, existing));
+        assert_success(setenv(env, val, 1));
+        free(val);
+    } else {
+        assert_success(setenv(env, prefix, 1));
+    }
+}
+
+int main(int argc, char **argv) {
+    set_env_prefix("PATH", ":", "/usr/bin/");
+    set_env_prefix("PATH", ":", "/usr/local/bin/");
+    argv[0] = "/send/me/flags";
+    return execv("/send/me/flags", argv);
+}

pkgs/test/make-binary-wrapper/prefix.cmdline

@@ -0,0 +1,2 @@
+    --prefix PATH : /usr/bin/ \
+    --prefix PATH : /usr/local/bin/

pkgs/test/make-binary-wrapper/prefix.env

@@ -0,0 +1,3 @@
+PATH=/usr/local/bin/:/usr/bin/
+CWD=SUBST_CWD
+SUBST_ARGV0

pkgs/test/make-binary-wrapper/suffix.c

@@ -0,0 +1,26 @@
+#define _GNU_SOURCE         /* See feature_test_macros(7) */
+#include <unistd.h>
+#include <stdlib.h>
+#include <assert.h>
+#include <stdio.h>
+
+#define assert_success(e) do { if ((e) < 0) { perror(#e); abort(); } } while (0)
+
+void set_env_suffix(char *env, char *sep, char *suffix) {
+    char *existing = getenv(env);
+    if (existing) {
+        char *val;
+        assert_success(asprintf(&val, "%s%s%s", existing, sep, suffix));
+        assert_success(setenv(env, val, 1));
+        free(val);
+    } else {
+        assert_success(setenv(env, suffix, 1));
+    }
+}
+
+int main(int argc, char **argv) {
+    set_env_suffix("PATH", ":", "/usr/bin/");
+    set_env_suffix("PATH", ":", "/usr/local/bin/");
+    argv[0] = "/send/me/flags";
+    return execv("/send/me/flags", argv);
+}

pkgs/test/make-binary-wrapper/suffix.cmdline

@@ -0,0 +1,2 @@
+    --suffix PATH : /usr/bin/ \
+    --suffix PATH : /usr/local/bin/

pkgs/test/make-binary-wrapper/suffix.env

@@ -0,0 +1,3 @@
+PATH=/usr/bin/:/usr/local/bin/
+CWD=SUBST_CWD
+SUBST_ARGV0

pkgs/tools/graphics/blockhash/default.nix

@@ -1,17 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, python2, pkg-config, imagemagick, wafHook }:
+{ lib, stdenv, fetchFromGitHub, python3, pkg-config, imagemagick, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "blockhash";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "commonsmachinery";
     repo = "blockhash";
     rev = "v${version}";
-    sha256 = "0m7ikppl42iicgmwsb7baajmag7v0p1ab06xckifvrr0zm21bq9p";
+    sha256 = "0x3lvhnkb4c3pyq6p81qnnqimz35wpippiac506dgjx3b1848v35";
   };
 
-  nativeBuildInputs = [ python2 pkg-config wafHook ];
+  nativeBuildInputs = [ python3 pkg-config wafHook ];
   buildInputs = [ imagemagick ];
 
   strictDeps = true;

pkgs/top-level/all-packages.nix

@@ -688,6 +688,21 @@ with pkgs;
   makeWrapper = makeSetupHook { deps = [ dieHook ]; substitutions = { shell = targetPackages.runtimeShell; }; }
                               ../build-support/setup-hooks/make-wrapper.sh;
 
+  makeBinaryWrapper = let
+    f = { cc, sanitizers }: let
+      san = lib.concatMapStringsSep " " (s: "-fsanitize=${s}") sanitizers;
+      script = runCommand "make-binary-wrapper.sh" {} ''
+        substitute ${../build-support/setup-hooks/make-binary-wrapper.sh} $out \
+          --replace " @CC@ " " ${cc}/bin/cc ${san} "
+      '';
+    in
+      makeSetupHook { deps = [ dieHook ]; } script;
+  in
+    lib.makeOverridable f {
+      cc = stdenv.cc.cc;
+      sanitizers = [ "undefined" "address" ];
+    };
+
   makeModulesClosure = { kernel, firmware, rootModules, allowMissing ? false }:
     callPackage ../build-support/kernel/modules-closure.nix {
       inherit kernel firmware rootModules allowMissing;