Merge pull request #85664 from NixOS/staging-next

Staging next

doc/stdenv/stdenv.xml

@@ -727,6 +727,16 @@ passthru.updateScript = [ ../../update.sh pname "--requested-release=unstable" ]
 
    <variablelist>
     <title>Variables controlling the patch phase</title>
+    <varlistentry>
+     <term>
+      <varname>dontPatch</varname>
+     </term>
+     <listitem>
+      <para>
+       Set to true to skip the patch phase.
+      </para>
+     </listitem>
+    </varlistentry>
     <varlistentry>
      <term>
       <varname>patches</varname>

nixos/modules/config/fonts/fontconfig.nix

@@ -45,6 +45,9 @@ let
 
   # generate the font cache setting file for a fontconfig version
   # use latest when no version is passed
+  # When cross-compiling, we can’t generate the cache, so we skip the
+  # <cachedir> part. fontconfig still works but is a little slower in
+  # looking things up.
   makeCacheConf = { version ? null }:
     let
       fcPackage = if version == null
@@ -60,11 +63,13 @@ let
       <fontconfig>
         <!-- Font directories -->
         ${concatStringsSep "\n" (map (font: "<dir>${font}</dir>") config.fonts.fonts)}
+        ${optionalString (pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform) ''
         <!-- Pre-generated font caches -->
         <cachedir>${cache}</cachedir>
         ${optionalString (pkgs.stdenv.isx86_64 && cfg.cache32Bit) ''
           <cachedir>${cache32}</cachedir>
         ''}
+        ''}
       </fontconfig>
     '';
 

nixos/modules/config/networking.nix

@@ -197,7 +197,7 @@ in
 
       } // optionalAttrs (pkgs.stdenv.hostPlatform.libc == "glibc") {
         # /etc/rpc: RPC program numbers.
-        rpc.source = pkgs.glibc.out + "/etc/rpc";
+        rpc.source = pkgs.stdenv.cc.libc.out + "/etc/rpc";
       };
 
       networking.proxy.envVars =

nixos/modules/services/system/nscd.nix

@@ -7,6 +7,10 @@ let
   nssModulesPath = config.system.nssModules.path;
   cfg = config.services.nscd;
 
+  nscd = if pkgs.stdenv.hostPlatform.libc == "glibc"
+         then pkgs.stdenv.cc.libc.bin
+         else pkgs.glibc.bin;
+
 in
 
 {
@@ -59,16 +63,16 @@ in
         # files. So prefix the ExecStart command with "!" to prevent systemd
         # from dropping privileges early. See ExecStart in systemd.service(5).
         serviceConfig =
-          { ExecStart = "!@${pkgs.glibc.bin}/sbin/nscd nscd";
+          { ExecStart = "!@${nscd}/sbin/nscd nscd";
             Type = "forking";
             DynamicUser = true;
             RuntimeDirectory = "nscd";
             PIDFile = "/run/nscd/nscd.pid";
             Restart = "always";
             ExecReload =
-              [ "${pkgs.glibc.bin}/sbin/nscd --invalidate passwd"
+              [ "${nscd}/sbin/nscd --invalidate passwd"
-                "${pkgs.glibc.bin}/sbin/nscd --invalidate group"
+                "${nscd}/sbin/nscd --invalidate group"
-                "${pkgs.glibc.bin}/sbin/nscd --invalidate hosts"
+                "${nscd}/sbin/nscd --invalidate hosts"
               ];
           };
       };

nixos/modules/services/x11/gdk-pixbuf.nix

@@ -19,7 +19,7 @@ let
           continue
         fi
         GDK_PIXBUF_MODULEDIR="$module_dir" \
-          ${pkgs.gdk-pixbuf.dev}/bin/gdk-pixbuf-query-loaders
+          ${pkgs.stdenv.hostPlatform.emulator pkgs.buildPackages} ${pkgs.gdk-pixbuf.dev}/bin/gdk-pixbuf-query-loaders
       done
     ) > "$out"
   '';
@@ -37,7 +37,7 @@ in
   # If there is any package configured in modulePackages, we generate the
   # loaders.cache based on that and set the environment variable
   # GDK_PIXBUF_MODULE_FILE to point to it.
-  config = mkIf (cfg.modulePackages != []) {
+  config = mkIf (cfg.modulePackages != [] || pkgs.stdenv.hostPlatform != pkgs.stdenv.buildPlatform) {
     environment.variables = {
       GDK_PIXBUF_MODULE_FILE = "${loadersCache}";
     };

pkgs/applications/editors/vim/common.nix

@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.0343";
+  version = "8.2.0510";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "063i52h8v7f87zamrw2ph057f0x2nzwf1s0izrm2psy41cyf4wa3";
+    sha256 = "16ggwf238pzzkn3ng6n09qz9cgdzha9vc0ghlcxhwilnjh12l7p9";
   };
 
   enableParallelBuilding = true;

pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -80,6 +80,8 @@ stdenv.mkDerivation {
   configureFlags = stdenv.lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "ac_cv_fread_reads_directories=yes"
     "ac_cv_snprintf_returns_bogus=no"
+    "ac_cv_iconv_omits_bom=no"
+    "ac_cv_prog_CURL_CONFIG=${curl.dev}/bin/curl-config"
   ];
 
   preBuild = ''

pkgs/applications/video/kodi/default.nix

@@ -4,22 +4,20 @@
 , boost, avahi, lame, autoreconfHook
 , gettext, pcre-cpp, yajl, fribidi, which
 , openssl, gperf, tinyxml2, taglib, libssh, swig, jre
-, libX11, xorgproto, libxml2
+, libxml2, systemd
-, libXt, libXmu, libXext
-, libXinerama, libXrandr
-, libXtst, libXfixes, systemd
 , alsaLib, libGLU, libGL, glew, fontconfig, freetype, ftgl
 , libjpeg, libpng, libtiff
 , libmpeg2, libsamplerate, libmad
 , libogg, libvorbis, flac, libxslt
 , lzo, libcdio, libmodplug, libass, libbluray
 , sqlite, libmysqlclient, nasm, gnutls, libva, libdrm
-, curl, bzip2, zip, unzip, glxinfo, xdpyinfo
+, curl, bzip2, zip, unzip, glxinfo
 , libcec, libcec_platform, dcadec, libuuid
 , libcrossguid, libmicrohttpd
-, bluez, doxygen, giflib, glib, harfbuzz, lcms2, libidn, libpthreadstubs, libtasn1, libXdmcp
+, bluez, doxygen, giflib, glib, harfbuzz, lcms2, libidn, libpthreadstubs, libtasn1
 , libplist, p11-kit, zlib, flatbuffers, fmt, fstrcmp, rapidjson
 , lirc
+, x11Support ? true, libX11, xorgproto, libXt, libXmu, libXext, libXinerama, libXrandr, libXtst, libXfixes, xdpyinfo, libXdmcp
 , dbusSupport ? true, dbus ? null
 , joystickSupport ? true, cwiid ? null
 , nfsSupport ? true, libnfs ? null
@@ -32,6 +30,7 @@
 , useWayland ? false, wayland ? null, wayland-protocols ? null
 , waylandpp ?  null, libxkbcommon ? null
 , useGbm ? false, mesa ? null, libinput ? null
+, buildPackages
 }:
 
 assert dbusSupport  -> dbus != null;
@@ -94,10 +93,18 @@ let
     sha256  = "1krsjlr949iy5l6ljxancza1yi6w1annxc5s6k283i9mb15qy8cy";
     preConfigure = ''
       cp ${kodi_src}/tools/depends/target/ffmpeg/{CMakeLists.txt,*.cmake} .
+      sed -i 's/ --cpu=''${CPU}//' CMakeLists.txt
+      sed -i 's/--strip=''${CMAKE_STRIP}/--strip=''${CMAKE_STRIP} --ranlib=''${CMAKE_RANLIB}/' CMakeLists.txt
     '';
-    buildInputs = [ gnutls libidn libtasn1 p11-kit zlib libva ]
+    cmakeFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+      "-DCROSSCOMPILING=ON"
+      "-DCPU=${stdenv.hostPlatform.parsed.cpu.name}"
+      "-DOS=${stdenv.hostPlatform.parsed.kernel.name}"
+      "-DPKG_CONFIG_EXECUTABLE=pkgconfig"
+    ];
+    buildInputs = [ libidn libtasn1 p11-kit zlib libva ]
       ++ lib.optional  vdpauSupport    libvdpau;
-    nativeBuildInputs = [ cmake nasm pkgconfig ];
+    nativeBuildInputs = [ cmake nasm pkgconfig gnutls ];
   };
 
   # We can build these externally but FindLibDvd.cmake forces us to build it
@@ -152,29 +159,31 @@ in stdenv.mkDerivation {
 
     buildInputs = [
       gnutls libidn libtasn1 nasm p11-kit
-      libxml2 yasm python2Packages.python
+      libxml2 python2Packages.python
       boost libmicrohttpd
       gettext pcre-cpp yajl fribidi libva libdrm
-      openssl gperf tinyxml2 taglib libssh swig jre
+      openssl gperf tinyxml2 taglib libssh
-      libX11 xorgproto libXt libXmu libXext
+      alsaLib libGL libGLU fontconfig freetype ftgl
-      libXinerama libXrandr libXtst libXfixes
-      alsaLib libGL libGLU glew fontconfig freetype ftgl
       libjpeg libpng libtiff
       libmpeg2 libsamplerate libmad
       libogg libvorbis flac libxslt systemd
       lzo libcdio libmodplug libass libbluray
       sqlite libmysqlclient avahi lame
-      curl bzip2 zip unzip glxinfo xdpyinfo
+      curl bzip2 zip unzip glxinfo
       libcec libcec_platform dcadec libuuid
       libgcrypt libgpgerror libunistring
-      libcrossguid cwiid libplist
+      libcrossguid libplist
-      bluez giflib glib harfbuzz lcms2 libpthreadstubs libXdmcp
+      bluez giflib glib harfbuzz lcms2 libpthreadstubs
       ffmpeg flatbuffers fmt fstrcmp rapidjson
       lirc
       # libdvdcss libdvdnav libdvdread
     ]
+    ++ lib.optional x11Support [
+      libX11 xorgproto libXt libXmu libXext libXdmcp
+      libXinerama libXrandr libXtst libXfixes
+    ]
     ++ lib.optional  dbusSupport     dbus
-    ++ lib.optionals joystickSupport [ cwiid ]
+    ++ lib.optional joystickSupport cwiid
     ++ lib.optional  nfsSupport      libnfs
     ++ lib.optional  pulseSupport    libpulseaudio
     ++ lib.optional  rtmpSupport     rtmpdump
@@ -183,7 +192,9 @@ in stdenv.mkDerivation {
     ++ lib.optional  usbSupport      libusb
     ++ lib.optional  vdpauSupport    libvdpau
     ++ lib.optionals useWayland [
-      wayland waylandpp.dev
+      wayland 
+      waylandpp.dev 
+      wayland-protocols
       # Not sure why ".dev" is needed here, but CMake doesn't find libxkbcommon otherwise
       libxkbcommon.dev
     ]
@@ -200,8 +211,16 @@ in stdenv.mkDerivation {
       which
       pkgconfig gnumake
       autoconf automake libtool # still needed for some components. Check if that is the case with 19.0
+      jre yasm gettext python2Packages.python flatbuffers
+
+      # for TexturePacker
+      giflib zlib libpng libjpeg lzo
     ] ++ lib.optionals useWayland [ wayland-protocols waylandpp.bin ];
 
+    depsBuildBuild = [
+      buildPackages.stdenv.cc
+    ];
+
     cmakeFlags = [
       "-Dlibdvdcss_URL=${libdvdcss.src}"
       "-Dlibdvdnav_URL=${libdvdnav.src}"
@@ -210,9 +229,14 @@ in stdenv.mkDerivation {
       "-DENABLE_EVENTCLIENTS=ON"
       "-DENABLE_INTERNAL_CROSSGUID=OFF"
       "-DENABLE_OPTICAL=ON"
+      "-DLIRC_DEVICE=/run/lirc/lircd"
+      "-DSWIG_EXECUTABLE=${buildPackages.swig}/bin/swig"
+      "-DFLATBUFFERS_FLATC_EXECUTABLE=${buildPackages.flatbuffers}/bin/flatc"
+      "-DPYTHON_EXECUTABLE=${buildPackages.python2Packages.python}/bin/python"
     ] ++ lib.optional useWayland [
       "-DCORE_PLATFORM_NAME=wayland"
       "-DWAYLAND_RENDER_SYSTEM=gl"
+      "-DWAYLANDPP_SCANNER=${buildPackages.waylandpp}/bin/wayland-scanner++"
     ] ++ lib.optional useGbm [
       "-DCORE_PLATFORM_NAME=gbm"
       "-DGBM_RENDER_SYSTEM=gles"
@@ -224,6 +248,16 @@ in stdenv.mkDerivation {
     # I'm guessing there is a thing waiting to time out
     doCheck = false;
 
+    # Need these tools on the build system when cross compiling,
+    # hacky, but have found no other way.
+    preConfigure = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+      CXX=c++ LD=ld make -C tools/depends/native/JsonSchemaBuilder
+      cmakeFlags+=" -DWITH_JSONSCHEMABUILDER=$PWD/tools/depends/native/JsonSchemaBuilder/bin"
+
+      CXX=c++ LD=ld make EXTRA_CONFIGURE= -C tools/depends/native/TexturePacker
+      cmakeFlags+=" -DWITH_TEXTUREPACKER=$PWD/tools/depends/native/TexturePacker/bin"
+    '';
+
     postPatch = ''
       substituteInPlace xbmc/platform/linux/LinuxTimezone.cpp \
         --replace 'usr/share/zoneinfo' 'etc/zoneinfo'
@@ -232,9 +266,11 @@ in stdenv.mkDerivation {
     postInstall = ''
       for p in $(ls $out/bin/) ; do
         wrapProgram $out/bin/$p \
-          --prefix PATH            ":" "${lib.makeBinPath [ python2Packages.python glxinfo xdpyinfo ]}" \
+          --prefix PATH            ":" "${lib.makeBinPath ([ python2Packages.python glxinfo ] ++ lib.optional x11Support xdpyinfo)}" \
           --prefix LD_LIBRARY_PATH ":" "${lib.makeLibraryPath
-              ([ curl systemd libmad libvdpau libcec libcec_platform rtmpdump libass ] ++ lib.optional nfsSupport libnfs)}"
+              ([ curl systemd libmad libvdpau libcec libcec_platform libass ]
+                 ++ lib.optional nfsSupport libnfs
+                 ++ lib.optional rtmpSupport rtmpdump)}"
       done
 
       substituteInPlace $out/share/xsessions/kodi.desktop \

pkgs/build-support/cc-wrapper/add-flags.sh

@@ -10,6 +10,7 @@ var_templates_list=(
     NIX+CFLAGS_LINK
     NIX+CXXSTDLIB_COMPILE
     NIX+CXXSTDLIB_LINK
+    NIX+GNATFLAGS_COMPILE
 )
 var_templates_bool=(
     NIX+ENFORCE_NO_NATIVE
@@ -40,6 +41,10 @@ if [ -e @out@/nix-support/cc-cflags ]; then
     NIX_@infixSalt@_CFLAGS_COMPILE="$(< @out@/nix-support/cc-cflags) $NIX_@infixSalt@_CFLAGS_COMPILE"
 fi
 
+if [ -e @out@/nix-support/gnat-cflags ]; then
+    NIX_@infixSalt@_GNATFLAGS_COMPILE="$(< @out@/nix-support/gnat-cflags) $NIX_@infixSalt@_GNATFLAGS_COMPILE"
+fi
+
 if [ -e @out@/nix-support/cc-ldflags ]; then
     NIX_@infixSalt@_LDFLAGS+=" $(< @out@/nix-support/cc-ldflags)"
 fi

pkgs/build-support/cc-wrapper/default.nix

@@ -199,6 +199,12 @@ stdenv.mkDerivation {
       fi
     ''
 
+    + optionalString cc.langAda or false ''
+      wrap ${targetPrefix}gnatmake ${./gnat-wrapper.sh} $ccPath/${targetPrefix}gnatmake
+      wrap ${targetPrefix}gnatbind ${./gnat-wrapper.sh} $ccPath/${targetPrefix}gnatbind
+      wrap ${targetPrefix}gnatlink ${./gnat-wrapper.sh} $ccPath/${targetPrefix}gnatlink
+    ''
+
     + optionalString cc.langFortran or false ''
       wrap ${targetPrefix}gfortran $wrapper $ccPath/${targetPrefix}gfortran
       ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}g77
@@ -283,6 +289,13 @@ stdenv.mkDerivation {
       ccLDFlags+=" -L${cc_solib}/lib"
       ccCFlags+=" -B${cc_solib}/lib"
 
+    '' + optionalString cc.langAda or false ''
+      basePath=$(echo $cc/lib/*/*/*)
+      ccCFlags+=" -B$basePath -I$basePath/adainclude"
+      gnatCFlags="-I$basePath/adainclude -I$basePath/adalib"
+
+      echo "$gnatCFlags" > $out/nix-support/gnat-cflags
+    '' + ''
       echo "$ccLDFlags" > $out/nix-support/cc-ldflags
       echo "$ccCFlags" > $out/nix-support/cc-cflags
     '' + optionalString (targetPlatform.isDarwin && (libcxx != null) && (cc.isClang or false)) ''
@@ -351,6 +364,8 @@ stdenv.mkDerivation {
       hardening_unsupported_flags+=" stackprotector fortify pie pic"
     '' + optionalString targetPlatform.isNetBSD ''
       hardening_unsupported_flags+=" stackprotector fortify"
+    '' + optionalString cc.langAda or false ''
+      hardening_unsupported_flags+=" stackprotector strictoverflow"
     ''
 
     + optionalString targetPlatform.isWasm ''

pkgs/build-support/cc-wrapper/gnat-wrapper.sh

@@ -0,0 +1,165 @@
+#! @shell@
+set -eu -o pipefail +o posix
+shopt -s nullglob
+
+if (( "${NIX_DEBUG:-0}" >= 7 )); then
+    set -x
+fi
+
+path_backup="$PATH"
+
+# That @-vars are substituted separately from bash evaluation makes
+# shellcheck think this, and others like it, are useless conditionals.
+# shellcheck disable=SC2157
+if [[ -n "@coreutils_bin@" && -n "@gnugrep_bin@" ]]; then
+    PATH="@coreutils_bin@/bin:@gnugrep_bin@/bin"
+fi
+
+source @out@/nix-support/utils.bash
+
+# Flirting with a layer violation here.
+if [ -z "${NIX_BINTOOLS_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
+    source @bintools@/nix-support/add-flags.sh
+fi
+
+# Put this one second so libc ldflags take priority.
+if [ -z "${NIX_CC_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
+    source @out@/nix-support/add-flags.sh
+fi
+
+
+# Parse command line options and set several variables.
+# For instance, figure out if linker flags should be passed.
+# GCC prints annoying warnings when they are not needed.
+dontLink=0
+nonFlagArgs=0
+# shellcheck disable=SC2193
+
+expandResponseParams "$@"
+declare -i n=0
+nParams=${#params[@]}
+while (( "$n" < "$nParams" )); do
+    p=${params[n]}
+    p2=${params[n+1]:-} # handle `p` being last one
+    if [ "$p" = -c ]; then
+        dontLink=1
+    elif [ "$p" = -S ]; then
+        dontLink=1
+    elif [ "$p" = -E ]; then
+        dontLink=1
+    elif [ "$p" = -E ]; then
+        dontLink=1
+    elif [ "$p" = -M ]; then
+        dontLink=1
+    elif [ "$p" = -MM ]; then
+        dontLink=1
+    elif [[ "$p" = -x && "$p2" = *-header ]]; then
+        dontLink=1
+    elif [[ "$p" != -?* ]]; then
+        # A dash alone signifies standard input; it is not a flag
+        nonFlagArgs=1
+    fi
+    n+=1
+done
+
+# If we pass a flag like -Wl, then gcc will call the linker unless it
+# can figure out that it has to do something else (e.g., because of a
+# "-c" flag).  So if no non-flag arguments are given, don't pass any
+# linker flags.  This catches cases like "gcc" (should just print
+# "gcc: no input files") and "gcc -v" (should print the version).
+if [ "$nonFlagArgs" = 0 ]; then
+    dontLink=1
+fi
+
+# Optionally filter out paths not refering to the store.
+if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "$NIX_STORE" ]]; then
+    rest=()
+    nParams=${#params[@]}
+    declare -i n=0
+    while (( "$n" < "$nParams" )); do
+        p=${params[n]}
+        p2=${params[n+1]:-} # handle `p` being last one
+        if [ "${p:0:3}" = -L/ ] && badPath "${p:2}"; then
+            skip "${p:2}"
+        elif [ "$p" = -L ] && badPath "$p2"; then
+            n+=1; skip "$p2"
+        elif [ "${p:0:3}" = -I/ ] && badPath "${p:2}"; then
+            skip "${p:2}"
+        elif [ "$p" = -I ] && badPath "$p2"; then
+            n+=1; skip "$p2"
+        elif [ "${p:0:4}" = -aI/ ] && badPath "${p:3}"; then
+            skip "${p:3}"
+        elif [ "$p" = -aI ] && badPath "$p2"; then
+            n+=1; skip "$p2"
+        elif [ "${p:0:4}" = -aO/ ] && badPath "${p:3}"; then
+            skip "${p:3}"
+        elif [ "$p" = -aO ] && badPath "$p2"; then
+            n+=1; skip "$p2"
+        elif [ "$p" = -isystem ] && badPath "$p2"; then
+            n+=1; skip "$p2"
+        else
+            rest+=("$p")
+        fi
+        n+=1
+    done
+    # Old bash empty array hack
+    params=(${rest+"${rest[@]}"})
+fi
+
+
+# Clear march/mtune=native -- they bring impurity.
+if [ "$NIX_@infixSalt@_ENFORCE_NO_NATIVE" = 1 ]; then
+    rest=()
+    # Old bash empty array hack
+    for p in ${params+"${params[@]}"}; do
+        if [[ "$p" = -m*=native ]]; then
+            skip "$p"
+        else
+            rest+=("$p")
+        fi
+    done
+    # Old bash empty array hack
+    params=(${rest+"${rest[@]}"})
+fi
+
+if [ "$(basename $0)x" = "gnatmakex" ]; then
+    extraBefore=("--GNATBIND=@out@/bin/gnatbind" "--GNATLINK=@out@/bin/gnatlink")
+    extraAfter=($NIX_@infixSalt@_GNATFLAGS_COMPILE)
+fi
+
+if [ "$(basename $0)x" = "gnatbindx" ]; then
+    extraBefore=()
+    extraAfter=($NIX_@infixSalt@_GNATFLAGS_COMPILE)
+fi
+
+if [ "$(basename $0)x" = "gnatlinkx" ]; then
+    extraBefore=()
+    extraAfter=("--GCC=@out@/bin/gcc")
+fi
+
+# As a very special hack, if the arguments are just `-v', then don't
+# add anything.  This is to prevent `gcc -v' (which normally prints
+# out the version number and returns exit code 0) from printing out
+# `No input files specified' and returning exit code 1.
+if [ "$*" = -v ]; then
+    extraAfter=()
+    extraBefore=()
+fi
+
+# Optionally print debug info.
+if (( "${NIX_DEBUG:-0}" >= 1 )); then
+    # Old bash workaround, see ld-wrapper for explanation.
+    echo "extra flags before to @prog@:" >&2
+    printf "  %q\n" ${extraBefore+"${extraBefore[@]}"}  >&2
+    echo "original flags to @prog@:" >&2
+    printf "  %q\n" ${params+"${params[@]}"} >&2
+    echo "extra flags after to @prog@:" >&2
+    printf "  %q\n" ${extraAfter+"${extraAfter[@]}"} >&2
+fi
+
+PATH="$path_backup"
+# Old bash workaround, see above.
+exec @prog@ \
+    ${extraBefore+"${extraBefore[@]}"} \
+    ${params+"${params[@]}"} \
+    ${extraAfter+"${extraAfter[@]}"}

pkgs/build-support/setup-hooks/auto-patchelf.sh

@@ -15,7 +15,7 @@ isExecutable() {
     # *or* there is an INTERP section. This also catches position-independent
     # executables, as they typically have an INTERP section but their ELF type
     # is DYN.
-    isExeResult="$(LANG=C readelf -h -l "$1" 2> /dev/null \
+    isExeResult="$(LANG=C $READELF -h -l "$1" 2> /dev/null \
         | grep '^ *Type: *EXEC\>\|^ *INTERP\>')"
     # not using grep -q, because it can cause Broken pipe
     [ -n "$isExeResult" ]
@@ -207,7 +207,7 @@ autoPatchelf() {
     # outside of this function.
     while IFS= read -r -d $'\0' file; do
       isELF "$file" || continue
-      segmentHeaders="$(LANG=C readelf -l "$file")"
+      segmentHeaders="$(LANG=C $READELF -l "$file")"
       # Skip if the ELF file doesn't have segment headers (eg. object files).
       # not using grep -q, because it can cause Broken pipe
       [ -n "$(echo "$segmentHeaders" | grep '^Program Headers:')" ] || continue

pkgs/data/icons/hicolor-icon-theme/setup-hook.sh

@@ -10,4 +10,4 @@ hicolorIconThemeHook() {
 }
 
 # I think this is meant to be a runtime dep
-addEnvHooks "${hostOffset:?}" hicolorIconThemeHook
+addEnvHooks "${targetOffset:?}" hicolorIconThemeHook

pkgs/desktops/gnome-3/core/epiphany/default.nix

@@ -58,6 +58,7 @@ stdenv.mkDerivation rec {
     python3
     wrapGAppsHook
     buildPackages.glib
+    buildPackages.gtk3
   ];
 
   buildInputs = [

pkgs/desktops/gnome-3/core/gnome-shell/default.nix

@@ -65,7 +65,10 @@ in stdenv.mkDerivation rec {
 
     # Install bash-completions to correct prefix.
     # https://gitlab.gnome.org/GNOME/gnome-shell/merge_requests/1194
-    ./fix-bash-completion.patch
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gnome-shell/commit/9f1ad5d86ddbabaa840eb2860279d53f4e635453.patch";
+      sha256 = "f8MDFbfg9D7ORF84Ld9GIvf0xRCYuSszo3QLMji2VaE=";
+    })
 
     # Use absolute path for libshew installation to make our patched gobject-introspection
     # aware of the location to hardcode in the generated GIR file.

pkgs/desktops/gnome-3/core/gnome-shell/fix-bash-completion.patch

@@ -1,10 +0,0 @@
---- a/subprojects/extensions-tool/meson.build
-+++ a/subprojects/extensions-tool/meson.build
-@@ -39,6 +39,6 @@ subdir('src')
- 
- if bash_completion.found()
-   install_data('completion/bash/gnome-extensions',
--    install_dir: bash_completion.get_pkgconfig_variable('completionsdir')
-+    install_dir: bash_completion.get_pkgconfig_variable('completionsdir', define_variable: ['prefix', prefix])
-   )
- endif

pkgs/development/compilers/gcc/6/default.nix

@@ -1,5 +1,6 @@
 { stdenv, targetPackages, fetchurl, fetchpatch, fetchFromGitHub, noSysDirs
 , langC ? true, langCC ? true, langFortran ? false
+, langAda ? false
 , langObjC ? stdenv.targetPlatform.isDarwin
 , langObjCpp ? stdenv.targetPlatform.isDarwin
 , langJava ? false
@@ -15,6 +16,7 @@
 , libelf                      # optional, for link-time optimizations (LTO)
 , isl ? null # optional, for the Graphite optimization framework.
 , zlib ? null, boehmgc ? null
+, gnatboot ? null
 , zip ? null, unzip ? null, pkgconfig ? null
 , gtk2 ? null, libart_lgpl ? null
 , libX11 ? null, libXt ? null, libSM ? null, libICE ? null, libXtst ? null
@@ -48,6 +50,8 @@ assert stdenv.hostPlatform.isDarwin -> gnused != null;
 # The go frontend is written in c++
 assert langGo -> langCC;
 
+assert langAda -> gnatboot != null;
+
 # threadsCross is just for MinGW
 assert threadsCross != null -> stdenv.targetPlatform.isWindows;
 
@@ -63,6 +67,7 @@ let majorVersion = "6";
       [ ../use-source-date-epoch.patch ]
       ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
+      ++ optional langAda ../gnat-cflags.patch
       ++ optional langFortran ../gfortran-driving.patch
       ++ optional (targetPlatform.libc == "musl") ../libgomp-dont-force-initial-exec.patch
       ++ optional (!crossStageStatic && targetPlatform.isMinGW) (fetchpatch {
@@ -200,6 +205,7 @@ stdenv.mkDerivation ({
     # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
     # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
     ++ (optional hostPlatform.isDarwin gnused)
+    ++ (optional langAda gnatboot)
     ;
 
   depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
@@ -208,7 +214,7 @@ stdenv.mkDerivation ({
 
   preConfigure = import ../common/pre-configure.nix {
     inherit (stdenv) lib;
-    inherit version hostPlatform langJava langGo;
+    inherit version hostPlatform gnatboot langJava langAda langGo;
   };
 
   dontDisableStatic = true;
@@ -234,6 +240,7 @@ stdenv.mkDerivation ({
       langCC
       langFortran
       langJava javaAwtGtk javaAntlr javaEcj
+      langAda
       langGo
       langObjC
       langObjCpp
@@ -292,7 +299,7 @@ stdenv.mkDerivation ({
     ;
 
   passthru = {
-    inherit langC langCC langObjC langObjCpp langFortran langGo version;
+    inherit langC langCC langObjC langObjCpp langFortran langAda langGo version;
     isGNU = true;
   };
 

pkgs/development/compilers/gcc/9/default.nix

@@ -1,5 +1,6 @@
 { stdenv, targetPackages, fetchurl, fetchpatch, noSysDirs
 , langC ? true, langCC ? true, langFortran ? false
+, langAda ? false
 , langObjC ? stdenv.targetPlatform.isDarwin
 , langObjCpp ? stdenv.targetPlatform.isDarwin
 , langGo ? false
@@ -13,6 +14,7 @@
 , libelf                      # optional, for link-time optimizations (LTO)
 , isl ? null # optional, for the Graphite optimization framework.
 , zlib ? null
+, gnatboot ? null
 , enableMultilib ? false
 , enablePlugin ? stdenv.hostPlatform == stdenv.buildPlatform # Whether to support user-supplied plug-ins
 , name ? "gcc"
@@ -35,6 +37,7 @@ assert stdenv.hostPlatform.isDarwin -> gnused != null;
 
 # The go frontend is written in c++
 assert langGo -> langCC;
+assert langAda -> gnatboot != null;
 
 # threadsCross is just for MinGW
 assert threadsCross != null -> stdenv.targetPlatform.isWindows;
@@ -54,6 +57,7 @@ let majorVersion = "9";
         url = "https://git.busybox.net/buildroot/plain/package/gcc/${version}/0900-remove-selftests.patch?id=11271540bfe6adafbc133caf6b5b902a816f5f02";
         sha256 = ""; # TODO: uncomment and check hash when available.
       }) */
+      ++ optional langAda ../gnat-cflags.patch
       ++ optional langFortran ../gfortran-driving.patch
       ++ optional (targetPlatform.libc == "musl" && targetPlatform.isPower) ../ppc-musl.patch
       ++ optional (!crossStageStatic && targetPlatform.isMinGW) (fetchpatch {
@@ -160,6 +164,7 @@ stdenv.mkDerivation ({
     # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
     # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
     ++ (optional hostPlatform.isDarwin gnused)
+    ++ (optional langAda gnatboot)
     ;
 
   depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
@@ -168,7 +173,7 @@ stdenv.mkDerivation ({
 
   preConfigure = import ../common/pre-configure.nix {
     inherit (stdenv) lib;
-    inherit version hostPlatform langGo;
+    inherit version hostPlatform gnatboot langAda langGo;
   };
 
   dontDisableStatic = true;
@@ -193,6 +198,7 @@ stdenv.mkDerivation ({
       langC
       langCC
       langFortran
+      langAda
       langGo
       langObjC
       langObjCpp
@@ -236,7 +242,7 @@ stdenv.mkDerivation ({
     ;
 
   passthru = {
-    inherit langC langCC langObjC langObjCpp langFortran langGo version;
+    inherit langC langCC langObjC langObjCpp langAda langFortran langGo version;
     isGNU = true;
   };
 

pkgs/development/compilers/gcc/builder.sh

@@ -216,6 +216,7 @@ postInstall() {
     moveToOutput "${targetConfig+$targetConfig/}lib/lib*.so*" "$lib"
     moveToOutput "${targetConfig+$targetConfig/}lib/lib*.la"  "$lib"
     moveToOutput "${targetConfig+$targetConfig/}lib/lib*.dylib" "$lib"
+    moveToOutput "${targetConfig+$targetConfig/}lib/lib*.dll.a" "$lib"
     moveToOutput "share/gcc-*/python" "$lib"
 
     for i in "$lib/${targetConfig}"/lib/*.{la,py}; do

pkgs/development/compilers/gcc/common/configure-flags.nix

@@ -16,6 +16,7 @@
 , langCC
 , langFortran
 , langJava ? false, javaAwtGtk ? false, javaAntlr ? null, javaEcj ? null
+, langAda ? false
 , langGo
 , langObjC
 , langObjCpp
@@ -115,6 +116,7 @@ let
           ++ lib.optional langCC       "c++"
           ++ lib.optional langFortran  "fortran"
           ++ lib.optional langJava     "java"
+          ++ lib.optional langAda      "ada"
           ++ lib.optional langGo       "go"
           ++ lib.optional langObjC     "objc"
           ++ lib.optional langObjCpp   "obj-c++"
@@ -140,6 +142,9 @@ let
       "--enable-cloog-backend=isl"
     ]
 
+    # Ada options
+    ++ lib.optional langAda "--enable-libada"
+
     # Java options
     ++ lib.optionals langJava [
       "--with-ecj-jar=${javaEcj}"

pkgs/development/compilers/gcc/common/pre-configure.nix

@@ -1,6 +1,11 @@
-{ lib, version, hostPlatform, langJava ? false, langGo }:
+{ lib, version, hostPlatform
+, gnatboot ? null
+, langAda ? false
+, langJava ? false
+, langGo }:
 
 assert langJava -> lib.versionOlder version "7";
+assert langAda -> gnatboot != null;
 
 lib.optionalString (hostPlatform.isSunOS && hostPlatform.is64bit) ''
   export NIX_LDFLAGS=`echo $NIX_LDFLAGS | sed -e s~$prefix/lib~$prefix/lib/amd64~g`
@@ -9,4 +14,6 @@ lib.optionalString (hostPlatform.isSunOS && hostPlatform.is64bit) ''
   export CFLAGS_FOR_TARGET="-Wl,-rpath,$prefix/lib/amd64 $CFLAGS_FOR_TARGET"
 '' + lib.optionalString (lib.versionOlder version "7" && (langJava || langGo)) ''
   export lib=$out;
+'' + lib.optionalString langAda ''
+  export PATH=${gnatboot}/bin:$PATH
 ''

pkgs/development/compilers/gcc/gnat-cflags.patch

@@ -0,0 +1,35 @@
+diff --git a/gcc/ada/gcc-interface/Makefile.in b/gcc/ada/gcc-interface/Makefile.in
+index 4e74252bd74..0d848b5b4e3 100644
+--- a/gcc/ada/gcc-interface/Makefile.in
++++ b/gcc/ada/gcc-interface/Makefile.in
+@@ -111,7 +111,7 @@ NO_OMIT_ADAFLAGS = -fno-omit-frame-pointer
+ NO_SIBLING_ADAFLAGS = -fno-optimize-sibling-calls
+ NO_REORDER_ADAFLAGS = -fno-toplevel-reorder
+ GNATLIBFLAGS = -W -Wall -gnatpg -nostdinc
+-GNATLIBCFLAGS = -g -O2
++GNATLIBCFLAGS = -g -O2 $(CFLAGS_FOR_TARGET)
+ # Pretend that _Unwind_GetIPInfo is available for the target by default.  This
+ # should be autodetected during the configuration of libada and passed down to
+ # here, but we need something for --disable-libada and hope for the best.
+@@ -198,7 +198,7 @@ RTSDIR = rts$(subst /,_,$(MULTISUBDIR))
+ # Link flags used to build gnat tools.  By default we prefer to statically
+ # link with libgcc to avoid a dependency on shared libgcc (which is tricky
+ # to deal with as it may conflict with the libgcc provided by the system).
+-GCC_LINK_FLAGS=-static-libstdc++ -static-libgcc
++GCC_LINK_FLAGS=-static-libstdc++ -static-libgcc $(CFLAGS_FOR_TARGET)
+
+ # End of variables for you to override.
+
+diff --git a/libada/Makefile.in b/libada/Makefile.in
+index 522b9207326..ca866c74471 100644
+--- a/libada/Makefile.in
++++ b/libada/Makefile.in
+@@ -59,7 +59,7 @@ LDFLAGS=
+ CFLAGS=-g
+ PICFLAG = @PICFLAG@
+ GNATLIBFLAGS= -W -Wall -gnatpg -nostdinc
+-GNATLIBCFLAGS= -g -O2
++GNATLIBCFLAGS= -g -O2 $(CFLAGS)
+ GNATLIBCFLAGS_FOR_C = -W -Wall $(GNATLIBCFLAGS) $(CFLAGS_FOR_TARGET) \
+        -fexceptions -DIN_RTS @have_getipinfo@ @have_capability@
+

pkgs/development/compilers/ghdl/default.nix

@@ -0,0 +1,40 @@
+{ stdenv, fetchFromGitHub, gnat, zlib, llvm, lib
+, backend ? "mcode" }:
+
+assert backend == "mcode" || backend == "llvm";
+
+stdenv.mkDerivation rec {
+  pname = "ghdl-${backend}";
+  version = "0.37";
+
+  src = fetchFromGitHub {
+    owner = "ghdl";
+    repo = "ghdl";
+    rev = "v${version}";
+    sha256 = "0b53yl4im33c1cd4mdyc4ks9cmrpixym17gzchfmplrl22w3l17y";
+  };
+
+  LIBRARY_PATH = "${stdenv.cc.libc}/lib";
+
+  buildInputs = [ gnat zlib ];
+
+  preConfigure = ''
+    # If llvm 7.0 works, 7.x releases should work too.
+    sed -i 's/check_version 7.0/check_version 7/g' configure
+  '';
+
+  configureFlags = lib.optional (backend == "llvm")
+    "--with-llvm-config=${llvm}/bin/llvm-config";
+
+  hardeningDisable = [ "format" ];
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "https://github.com/ghdl/ghdl";
+    description = "VHDL 2008/93/87 simulator";
+    maintainers = with maintainers; [ lucus16 ];
+    platforms = platforms.linux;
+    license = licenses.gpl2;
+  };
+}

pkgs/development/compilers/gnatboot/default.nix

@@ -0,0 +1,51 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation {
+  pname = "gentoo-gnatboot";
+  version = "4.1";
+
+  src = if stdenv.system == "i686-linux" then
+    fetchurl {
+      url = mirror://gentoo/distfiles/gnatboot-4.1-i386.tar.bz2;
+      sha256 = "0665zk71598204bf521vw68i5y6ccqarq9fcxsqp7ccgycb4lysr";
+    }
+  else if stdenv.system == "x86_64-linux" then
+    fetchurl {
+      url = mirror://gentoo/distfiles/gnatboot-4.1-amd64.tar.bz2;
+      sha256 = "1li4d52lmbnfs6llcshlbqyik2q2q4bvpir0f7n38nagp0h6j0d4";
+    }
+  else
+    throw "Platform not supported";
+
+  dontStrip = 1;
+
+  installPhase = ''
+    mkdir -p $out
+    cp -R * $out
+
+    set +e
+    for a in $out/bin/* ; do
+      patchelf --interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+        --set-rpath $(cat $NIX_CC/nix-support/orig-libc)/lib:$(cat $NIX_CC/nix-support/orig-cc)/lib64:$(cat $NIX_CC/nix-support/orig-cc)/lib $a
+    done
+    set -e
+
+    mv $out/bin/gnatgcc_2wrap $out/bin/gnatgcc
+    ln -s $out/bin/gnatgcc $out/bin/gcc
+  '';
+
+  passthru = {
+    langC = true; # TRICK for gcc-wrapper to wrap it
+    langCC = false;
+    langFortran = false;
+    langAda = true;
+  };
+
+  meta = with stdenv.lib; {
+    homepage = "https://gentoo.org";
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.lucus16 ];
+
+    platforms = platforms.linux;
+  };
+}

pkgs/development/interpreters/python/default.nix

@@ -57,10 +57,10 @@ in {
     sourceVersion = {
       major = "2";
       minor = "7";
-      patch = "17";
+      patch = "18";
       suffix = "";
     };
-    sha256 = "0hds28cg226m8j8sr394nm9yc4gxhvlv109w0avsf2mxrlrz0hsd";
+    sha256 = "0hzgxl94hnflis0d6m4szjx0b52gah7wpmcg5g00q7am6xwhwb5n";
     inherit (darwin) configd;
     inherit passthruFun;
   };

pkgs/development/libraries/atk/default.nix

@@ -4,7 +4,7 @@
 
 let
   pname = "atk";
-  version = "2.35.1";
+  version = "2.36.0";
 in
 
 stdenv.mkDerivation rec {
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "111qajn7kxwmh40drc8i6jc3hnril2rp63n207q92pl47zx614xy";
+    sha256 = "1217cmmykjgkkim0zr1lv5j13733m4w5vipmy4ivw0ll6rz28xpv";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/cairo/default.nix

@@ -61,7 +61,7 @@ in stdenv.mkDerivation rec {
     ++ optional glSupport libGL
     ; # TODO: maybe liblzo but what would it be for here?
 
-  configureFlags = if stdenv.isDarwin then [
+  configureFlags = (if stdenv.isDarwin then [
     "--disable-dependency-tracking"
     "--enable-quartz"
     "--enable-quartz-font"
@@ -71,7 +71,7 @@ in stdenv.mkDerivation rec {
     ++ optional xcbSupport "--enable-xcb"
     ++ optional glSupport "--enable-gl"
     ++ optional pdfSupport "--enable-pdf"
-  );
+  )) ++ optional (!x11Support) "--disable-xlib";
 
   preConfigure =
   # On FreeBSD, `-ldl' doesn't exist.

pkgs/development/libraries/chromaprint/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "chromaprint";
-  version = "1.4.3";
+  version = "1.5.0";
 
   src = fetchurl {
     url = "https://github.com/acoustid/chromaprint/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "10kz8lncal4s2rp2rqpgc6xyjp0jzcrihgkx7chf127vfs5n067a";
+    sha256 = "0sknmyl5254rc55bvkhfwpl4dfvz45xglk1rq8zq5crmwq058fjp";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/cracklib/default.nix

@@ -18,10 +18,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) buildPackages.cracklib;
   buildInputs = [ zlib gettext ];
 
-  postPatch = ''
+  postPatch = stdenv.lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
     chmod +x util/cracklib-format
     patchShebangs util
 
+  '' + ''
     ln -vs ${toString wordlists} dicts/
   '';
 

pkgs/development/libraries/dconf/default.nix

@@ -1,28 +1,61 @@
-{ stdenv, fetchurl, meson, ninja, python3, vala, libxslt, pkgconfig, glib, bash-completion, dbus, gnome3
+{ stdenv
-, libxml2, gtk-doc, docbook_xsl, docbook_xml_dtd_42 }:
+, fetchurl
+, fetchpatch
+, meson
+, ninja
+, python3
+, vala
+, libxslt
+, pkg-config
+, glib
+, bash-completion
+, dbus
+, gnome3
+, libxml2
+, gtk-doc
+, docbook-xsl-nons
+, docbook_xml_dtd_42
+}:
 
-let
-  pname = "dconf";
-in
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+  pname = "dconf";
   version = "0.36.0";
 
-  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "0bfs069pjv6lhp7xrzmrhz3876ay2ryqxzc6mlva1hhz34ibprlz";
-  };
-
-  postPatch = ''
-    chmod +x meson_post_install.py tests/test-dconf.py
-    patchShebangs meson_post_install.py
-    patchShebangs tests/test-dconf.py
-  '';
-
   outputs = [ "out" "lib" "dev" "devdoc" ];
 
-  nativeBuildInputs = [ meson ninja vala pkgconfig python3 libxslt libxml2 glib gtk-doc docbook_xsl docbook_xml_dtd_42 ];
+  src = fetchurl {
-  buildInputs = [ glib bash-completion dbus ];
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "0bfs069pjv6lhp7xrzmrhz3876ay2ryqxzc6mlva1hhz34ibprlz";
+  };
+
+  patches = [
+    # Fix bash-completion installation
+    # https://gitlab.gnome.org/GNOME/dconf/merge_requests/58
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/dconf/commit/b3c9423c6151f3c28e526083ea2f04987a780fdf.patch";
+      sha256 = "zrIPKmgEpa1iIGUKv03+z+GNwJwgdf2hDATgP3i8qk0=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    vala
+    pkg-config
+    python3
+    libxslt
+    libxml2
+    glib
+    gtk-doc
+    docbook-xsl-nons
+    docbook_xml_dtd_42
+  ];
+
+  buildInputs = [
+    glib
+    bash-completion
+    dbus
+  ];
 
   mesonFlags = [
     "--sysconfdir=/etc"
@@ -31,6 +64,12 @@ stdenv.mkDerivation rec {
 
   doCheck = !stdenv.isAarch32 && !stdenv.isAarch64 && !stdenv.isDarwin;
 
+  postPatch = ''
+    chmod +x meson_post_install.py tests/test-dconf.py
+    patchShebangs meson_post_install.py
+    patchShebangs tests/test-dconf.py
+  '';
+
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
@@ -40,7 +79,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Projects/dconf";
     license = licenses.lgpl21Plus;
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = platforms.unix;
     maintainers = teams.gnome.members;
   };
 }

pkgs/development/libraries/flatbuffers/default.nix

@@ -18,7 +18,9 @@ stdenv.mkDerivation (rec {
   nativeBuildInputs = [ cmake ];
   enableParallelBuilding = true;
 
-  doCheck = true;
+  cmakeFlags = [ "-DFLATBUFFERS_BUILD_TESTS=${if doCheck then "ON" else "OFF"}" ];
+
+  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
   checkTarget = "test";
 
   meta = {

pkgs/development/libraries/fstrcmp/cross.patch

@@ -0,0 +1,24 @@
+diff '--color=auto' -ur fstrcmp-0.7-D001-old/configure.ac fstrcmp-0.7.D001/configure.ac
+--- fstrcmp-0.7-D001-old/configure.ac	2014-03-04 19:13:45.000000000 -0500
++++ fstrcmp-0.7.D001/configure.ac	2020-04-02 13:57:52.805154634 -0400
+@@ -32,6 +32,8 @@
+ AC_OBJEXT
+ AC_EXEEXT
+ 
++LT_INIT
++
+ dnl @synopsis AC_ADD_CFLAGS
+ dnl
+ dnl Add the given option to CFLAGS, if it doesn't break the compiler
+diff '--color=auto' -ur fstrcmp-0.7-D001-old/Makefile.in fstrcmp-0.7.D001/Makefile.in
+--- fstrcmp-0.7-D001-old/Makefile.in	2014-03-04 19:13:45.000000000 -0500
++++ fstrcmp-0.7.D001/Makefile.in	2020-04-02 13:57:12.355269595 -0400
+@@ -37,6 +37,8 @@
+ srcdir = @srcdir@
+ VPATH = @srcdir@
+ 
++top_builddir = $(srcdir)
++
+ #
+ # the name of the install program to use
+ #

pkgs/development/libraries/fstrcmp/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, libtool, ghostscript, groff }:
+{ stdenv, fetchzip, libtool, ghostscript, groff, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "fstrcmp";
@@ -9,9 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "0yg3y3k0wz50gmhgigfi2dx725w1gc8snb95ih7vpcnj6kabgz9a";
   };
 
+  patches = [ ./cross.patch ];
+
   outputs = [ "out" "dev" "doc" "man" "devman" ];
 
-  nativeBuildInputs = [ libtool ghostscript groff ];
+  nativeBuildInputs = [ libtool ghostscript groff autoreconfHook ];
 
   enableParallelBuilding = true;
 

pkgs/development/libraries/ftgl/default.nix

@@ -18,6 +18,8 @@ stdenv.mkDerivation {
       [ libGL libGLU ])
     ;
 
+  configureFlags = [ "--with-ft-prefix=${stdenv.lib.getDev freetype}" ];
+
   enableParallelBuilding = true;
 
   meta = {

pkgs/development/libraries/gdk-pixbuf/default.nix

@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     meson ninja pkgconfig gettext python3 libxml2 libxslt docbook_xsl docbook_xml_dtd_43
-    gtk-doc gobject-introspection makeWrapper
+    gtk-doc gobject-introspection makeWrapper glib
   ]
     ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
@@ -68,7 +68,7 @@ in stdenv.mkDerivation rec {
     + ''
       moveToOutput "bin" "$dev"
       moveToOutput "bin/gdk-pixbuf-thumbnailer" "$out"
-
+    '' + stdenv.lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
       # We need to install 'loaders.cache' in lib/gdk-pixbuf-2.0/2.10.0/
       $dev/bin/gdk-pixbuf-query-loaders --update-cache
     '';

pkgs/development/libraries/gdk-pixbuf/setup-hook.sh

@@ -14,4 +14,4 @@ findGdkPixbufLoaders() {
 
 }
 
-addEnvHooks "$hostOffset" findGdkPixbufLoaders
+addEnvHooks "$targetOffset" findGdkPixbufLoaders

pkgs/development/libraries/glib-networking/default.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "glib-networking";
-  version = "2.64.0";
+  version = "2.64.1";
 
   outputs = [ "out" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1fm1462v7z556qivlwflvc3qpz36jwpzqxxvsihh45j7aka2gnjw";
+    sha256 = "0wmg5n2h0r1rcdmp4w48akqlsbpjrjrj6p59g5ylc5yqyzg4dhx4";
   };
 
   patches = [

pkgs/development/libraries/glib/setup-hook.sh

@@ -1,4 +1,3 @@
-
 make_glib_find_gsettings_schemas() {
     # For packages that need gschemas of other packages (e.g. empathy)
     for maybe_dir in "$1"/share/gsettings-schemas/*; do
@@ -7,7 +6,7 @@ make_glib_find_gsettings_schemas() {
         fi
     done
 }
-addEnvHooks "$hostOffset" make_glib_find_gsettings_schemas
+addEnvHooks "$targetOffset" make_glib_find_gsettings_schemas
 
 # Install gschemas, if any, in a package-specific directory
 glibPreInstallPhase() {

pkgs/development/libraries/gobject-introspection/default.nix

@@ -10,11 +10,11 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "gobject-introspection";
-  version = "1.64.0";
+  version = "1.64.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "10pwykfnk7pw8k9k8iz3p72phxvyrh5q4d7gr3ysv08w15immh7a";
+    sha256 = "19vz7vp10h0zj3f491yk72dp89bix6rgkzxg4qcm4d6151ksxgl0";
   };
 
   outputs = [ "out" "dev" "man" ];

pkgs/development/libraries/gpgme/default.nix

@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, fetchpatch, libgpgerror, gnupg, pkgconfig, glib, pth, libassuan
+{ stdenv, fetchurl, fetchpatch
+, autoreconfHook, libgpgerror, gnupg, pkgconfig, glib, pth, libassuan
 , file, which, ncurses
 , texinfo
 , buildPackages
@@ -33,7 +34,14 @@ stdenv.mkDerivation rec {
       url = "http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;a=patch;h=c4cf527ea227edb468a84bf9b8ce996807bd6992";
       sha256 = "pKL1tvUw7PB2w4FHSt2up4SvpFiprBH6TLdgKxYFC3g=";
     })
-  ];
+    # https://lists.gnupg.org/pipermail/gnupg-devel/2020-April/034591.html
+    (fetchpatch {
+      name = "0001-Fix-python-tests-on-non-Linux.patch";
+      url = "https://lists.gnupg.org/pipermail/gnupg-devel/attachments/20200415/f7be62d1/attachment.obj";
+      sha256 = "00d4sxq63601lzdp2ha1i8fvybh7dzih4531jh8bx07fab3sw65g";
+    })
+    # Disable python tests on Darwin as they use gpg (see configureFlags below)
+  ] ++ lib.optional stdenv.isDarwin ./disable-python-tests.patch;
 
   outputs = [ "out" "dev" "info" ];
   outputBin = "dev"; # gpgme-config; not so sure about gpgme-tool
@@ -42,15 +50,11 @@ stdenv.mkDerivation rec {
     [ libgpgerror glib libassuan pth ]
     ++ lib.optional (qtbase != null) qtbase;
 
-  nativeBuildInputs = [ file pkgconfig gnupg texinfo ]
+  nativeBuildInputs = [ pkgconfig gnupg texinfo autoreconfHook ]
   ++ lib.optionals pythonSupport [ python swig2 which ncurses ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
-  postPatch =''
-    substituteInPlace ./configure --replace /usr/bin/file ${file}/bin/file
-  '';
-
   configureFlags = [
     "--enable-fixed-path=${gnupg}/bin"
     "--with-libgpg-error-prefix=${libgpgerror.dev}"

pkgs/development/libraries/gpgme/disable-python-tests.patch

@@ -0,0 +1,12 @@
+diff -Naur --strip-trailing-cr gpgme-1.13.1.org/lang/python/Makefile.am gpgme-1.13.1/lang/python/Makefile.am
+--- gpgme-1.13.1.org/lang/python/Makefile.am	2019-06-04 07:27:49.000000000 +0100
++++ gpgme-1.13.1/lang/python/Makefile.am	2020-04-15 14:27:34.810172944 +0100
+@@ -23,7 +23,7 @@
+ 	gpgme.i \
+ 	helpers.c helpers.h private.h
+ 
+-SUBDIRS = . tests examples doc src
++SUBDIRS = . examples doc src
+ 
+ .PHONY: prepare
+ prepare: copystamp

pkgs/development/libraries/gsm/default.nix

@@ -9,11 +9,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gsm";
-  version = "1.0.18";
+  version = "1.0.19";
 
   src = fetchurl {
     url = "http://www.quut.com/gsm/${pname}-${version}.tar.gz";
-    sha256 = "041amvpz8cvxykl3pwqldrzxligmmzcg8ncdnxbg32rlqf3q1xh4";
+    sha256 = "1xkha9ss5g5qnfaybi8il0mcvp8knwg9plgh8404vh58d0pna0s9";
   };
 
   patchPhase = ''

pkgs/development/libraries/gstreamer/bad/default.nix

@@ -10,7 +10,7 @@
 , gst-plugins-base
 , orc
 , gobject-introspection
-, enableZbar ? true
+, enableZbar ? false
 , faacSupport ? false
 , faac ? null
 , faad2

pkgs/development/libraries/gstreamer/core/default.nix

@@ -37,6 +37,13 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./fix_pkgconfig_includedir.patch
+
+    # Fix build with bash-completion 2.10
+    # https://gitlab.freedesktop.org/gstreamer/gstreamer/merge_requests/436
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/commit/dd2ec3681e2d38e13e01477efa36e851650690fb.patch";
+      sha256 = "CMYQF2MTsC5A0btMpLVLemkwsMtEbzhDXVE3u49xHB4=";
+    })
   ];
 
   nativeBuildInputs = [

pkgs/development/libraries/gtk/3.x.nix

@@ -73,6 +73,21 @@ stdenv.mkDerivation rec {
 
     # https://gitlab.gnome.org/GNOME/gtk/merge_requests/1002
     ./patches/01-build-Fix-path-handling-in-pkgconfig.patch
+
+    # https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/1634
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/79732da1ed8cb167440fb047c72cfc0d888a187b.patch";
+      sha256 = "1ynrx81dkwjfqhvg80q28qbb6jabg4x73fkbrnligzgkzimfjpx3";
+    })
+    # https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/1633
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/12fc9a45efcbb546eb7de13c5c4d3183f2f5a3b8.patch";
+      sha256 = "00zrm77qk39p1hgn207az82cgvqiyp6is7dk0ssjxkc34403r78v";
+    })
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/5a52af20cba76474e631b2a7548963bcad22d66d.patch";
+      sha256 = "0sbzzwa0si1w83m5abyf312f4w445wwlms53m5hb7kdgkjbhaa3f";
+    })
   ] ++ optionals stdenv.isDarwin [
     # X11 module requires <gio/gdesktopappinfo.h> which is not installed on Darwin
     # let’s drop that dependency in similar way to how other parts of the library do it

pkgs/development/libraries/libasyncns/default.nix

@@ -8,6 +8,11 @@ stdenv.mkDerivation rec {
     sha256 = "0x5b6lcic4cd7q0bx00x93kvpyzl7n2abbgvqbrlzrfb8vknc6jg";
   };
 
+  configureFlags = stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+  ];
+
   meta = with stdenv.lib; {
     homepage = "http://0pointer.de/lennart/projects/libasyncns/";
     description = "A C library for Linux/Unix for executing name service queries asynchronously";

pkgs/development/libraries/libcddb/default.nix

@@ -10,6 +10,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = stdenv.lib.optional stdenv.isDarwin libiconv;
 
+  configureFlags = stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+  ];
+
   doCheck = false; # fails 3 of 5 tests with locale errors
 
   meta = with stdenv.lib; {

pkgs/development/libraries/libcdio/default.nix

@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
     patchShebangs .
   '';
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig help2man ];
-  buildInputs = [ libcddb ncurses help2man ]
+  buildInputs = [ libcddb ncurses ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ libiconv Carbon IOKit ];
 
   doCheck = !stdenv.isDarwin;

pkgs/development/libraries/libcec/default.nix

@@ -11,8 +11,8 @@ stdenv.mkDerivation {
     sha256 = "02j09y06csaic4m0fyb4dr9l3hl15nxbbniwq0i1qlccpxjak0j3";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig cmake ];
-  buildInputs = [ cmake udev libcec_platform ] ++
+  buildInputs = [ udev libcec_platform ] ++
     stdenv.lib.optional (libraspberrypi != null) libraspberrypi;
 
   cmakeFlags = [ "-DBUILD_SHARED_LIBS=1" ];

pkgs/development/libraries/libcrossguid/default.nix

@@ -15,8 +15,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ libuuid ];
 
   buildPhase = ''
-    g++ -c guid.cpp -o guid.o $CXXFLAGS -std=c++11 -DGUID_LIBUUID
+    $CXX -c guid.cpp -o guid.o $CXXFLAGS -std=c++11 -DGUID_LIBUUID
-    ar rvs libcrossguid.a guid.o
+    $AR rvs libcrossguid.a guid.o
   '';
   installPhase = ''
     mkdir -p $out/{lib,include}

pkgs/development/libraries/libfido2/default.nix

@@ -3,45 +3,28 @@
 , fetchpatch
 , cmake
 , pkgconfig
+, hidapi
 , libcbor
 , openssl
 , udev
-, IOKit }:
+}:
 
 stdenv.mkDerivation rec {
   pname = "libfido2";
-  version = "1.3.1";
+  version = "1.4.0";
   src = fetchurl {
     url = "https://developers.yubico.com/${pname}/Releases/${pname}-${version}.tar.gz";
-    sha256 = "0hdgxbmjbnm9kjwc07nrl2zy87qclvb3rzvdwr5iw35n2qhf4dds";
+    sha256 = "0v1a3n0qljmrp8y9pmnmbsdsy79l3z84qmhyjx50xdsbgnz1z4md";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
 
-  buildInputs = [ libcbor openssl ]
+  buildInputs = [ hidapi libcbor openssl ]
-    ++ stdenv.lib.optionals stdenv.isLinux [ udev ]
+    ++ stdenv.lib.optionals stdenv.isLinux [ udev ];
-    ++ stdenv.lib.optionals stdenv.isDarwin [ IOKit ];
-
-  patches = [
-    # fix build on darwin
-    (fetchpatch {
-      url = "https://github.com/Yubico/libfido2/commit/916ebd18a89e4028de203d603726805339be7a5b.patch";
-      sha256 = "07f0xpxnq02cccmqcric87b6pms7k7ssvdw722zr970a6qs8p6i7";
-    })
-    # allow attestation using any supported algorithm
-    (fetchpatch {
-      url = "https://github.com/Yubico/libfido2/commit/f7a9471fa0588cb91cbefffb13c1e4d06c2179b7.patch";
-      sha256 = "02qbw9bqy3sixvwig6az7v3vimgznxnfikn9p1jczm3d7mn8asw2";
-    })
-    # fix EdDSA attestation signature verification bug
-    (fetchpatch {
-      url = "https://github.com/Yubico/libfido2/commit/95126eea52294419515e6540dfd7220f35664c48.patch";
-      sha256 = "076mwpl9xndjhy359jdv2drrwyq7wd3pampkn28mn1rlwxfgf0d0";
-    })
-  ];
 
   cmakeFlags = [
     "-DUDEV_RULES_DIR=${placeholder "out"}/etc/udev/rules.d"
+    "-DUSE_HIDAPI=1"
     "-DCMAKE_INSTALL_LIBDIR=lib"
   ];
 

pkgs/development/libraries/libfido2/detect_apple_ld.patch

@@ -1,11 +0,0 @@
---- a/CMakeLists.txt	2020-02-19 17:21:59.000000000 +0000
-+++ b/CMakeLists.txt	2020-02-23 15:57:34.241115306 +0000
-@@ -296,7 +296,7 @@
- endif()
- 
- # export list
--if(CMAKE_C_COMPILER_ID STREQUAL "AppleClang")
-+if(APPLE AND CMAKE_C_COMPILER_ID STREQUAL "Clang" OR CMAKE_C_COMPILER_ID STREQUAL "AppleClang")	
- 	# clang + lld
- 	string(CONCAT CMAKE_SHARED_LINKER_FLAGS ${CMAKE_SHARED_LINKER_FLAGS}
- 	    " -exported_symbols_list ${CMAKE_CURRENT_SOURCE_DIR}/src/export.llvm")

pkgs/development/libraries/libinput/default.nix

@@ -27,11 +27,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.15.3";
+  version = "1.15.4";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libinput/${pname}-${version}.tar.xz";
-    sha256 = "0kb9i1xav8hmrl6g0qdq7jii589i9sjjrbh43fsc5284smyl44jv";
+    sha256 = "1ha5qyak1ka5npy5i6hzqfpii8samkj389mkppj4wdsfv536i2ww";
   };
 
   outputs = [ "bin" "out" "dev" ];

pkgs/development/libraries/libjpeg-turbo/default.nix

@@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
 
   pname = "libjpeg-turbo";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1ds16bnj17v6hzd43w8pzijz3imd9am4hw75ir0fxm240m8dwij2";
+    sha256 = "01ill8bgjyk582wipx7sh7gj2nidylpbzvwhx0wkcm6mxx3qbp9k";
   };
 
   patches =
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     homepage = "http://libjpeg-turbo.virtualgl.org/";
     description = "A faster (using SIMD) libjpeg implementation";
     license = licenses.ijg; # and some parts under other BSD-style licenses
-    maintainers = [ maintainers.vcunat ];
+    maintainers = with maintainers; [ vcunat colemickens ];
     platforms = platforms.all;
   };
 }

pkgs/development/libraries/libnetfilter_conntrack/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libnetfilter_conntrack";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/libnetfilter_conntrack/files/${pname}-${version}.tar.bz2";
-    sha256 = "1dl9z50yny04xi5pymlykwmy6hcfc9p4nd7m47697zwxw98m6s1k";
+    sha256 = "1ky1mqgnplw2h9jf0kn0a69d94jkydhbiipng9l2hdcj13h3pl8c";
   };
 
   buildInputs = [ libmnl ];

pkgs/development/libraries/librsvg/default.nix

@@ -4,14 +4,14 @@
 
 let
   pname = "librsvg";
-  version = "2.48.0";
+  version = "2.48.2";
 in
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "19ndf9l99wcrmkwcrk20vd1ggrwgldksfz1kkj786ljcrxv8nd2a";
+    sha256 = "1jmxd03fs8vkwycxpmx69kdfmgq52g64bhv82gmj3kjgw2h5h9i7";
   };
 
   outputs = [ "out" "dev" "installedTests" ];

pkgs/development/libraries/libsecret/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libsecret";
-  version = "0.20.1";
+  version = "0.20.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0ir4ynpf8b64xss1azvsi5x6697lik7hkf3z0xxa2qv2xja3xxsp";
+    sha256 = "1hzz34gmsxxf1jm1b7qin390rkwbg8sx198xdkwxqp3q6cw19sc1";
   };
 
   postPatch = ''

pkgs/development/libraries/libunwind/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libunwind";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchurl {
     url = "mirror://savannah/libunwind/${pname}-${version}.tar.gz";
-    sha256 = "1y0l08k6ak1mqbfj6accf9s5686kljwgsl4vcqpxzk5n74wpm6a3";
+    sha256 = "0dc46flppifrv2z0mrdqi60165ghxm1wk0g47vcbyzjdplqwjnfz";
   };
 
   patches = [ ./backtrace-only-with-glibc.patch ];

pkgs/development/libraries/libva/default.nix

@@ -2,6 +2,7 @@
 , libXext, libdrm, libXfixes, wayland, libffi, libX11
 , libGL, mesa
 , minimal ? false, libva-minimal
+, buildPackages
 }:
 
 stdenv.mkDerivation rec {
@@ -18,7 +19,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "dev" "out" ];
 
-  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig wayland ];
 
   buildInputs = [ libdrm ]
     ++ lib.optionals (!minimal) [ libva-minimal libX11 libXext libXfixes wayland libffi libGL ];
@@ -29,6 +30,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     # Add FHS paths for non-NixOS applications.
     "--with-drivers-path=${mesa.drivers.driverLink}/lib/dri:/usr/lib/dri:/usr/lib32/dri"
+    "ac_cv_path_WAYLAND_SCANNER=${buildPackages.wayland}/bin/wayland-scanner"
   ] ++ lib.optionals (!minimal) [ "--enable-glx" ];
 
   installFlags = [

pkgs/development/libraries/libvdpau/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libvdpau";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/vdpau/libvdpau/-/archive/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "b5a52eeac9417edbc396f26c40591ba5df0cd18285f68d84614ef8f06196e50e";
+    sha256 = "0c1zsfr6ypzwv8g9z50kdahpb7pirarq4z8avqqyyma5b9684n22";
   };
   patches = [ ./installdir.patch ];
 

pkgs/development/libraries/libvisual/default.nix

@@ -13,6 +13,11 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
+  configureFlags = stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+  ];
+
   meta = {
     description = "An abstraction library for audio visualisations";
     homepage = "https://sourceforge.net/projects/libvisual/";

pkgs/development/libraries/libvpx/default.nix

@@ -135,16 +135,10 @@ stdenv.mkDerivation rec {
                     experimentalFpMbStatsSupport ||
                     experimentalEmulateHardwareSupport) "experimental")
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    #"--extra-cflags="
-    #"--extra-cxxflags="
-    #"--prefix="
-    #"--libc="
-    #"--libdir="
-    "--enable-external-build"
     # libvpx darwin targets include darwin version (ie. ARCH-darwinXX-gcc, XX being the darwin version)
     # See all_platforms: https://github.com/webmproject/libvpx/blob/master/configure
     # Darwin versions: 10.4=8, 10.5=9, 10.6=10, 10.7=11, 10.8=12, 10.9=13, 10.10=14
-    "--force-target=${stdenv.hostPlatform.config}${
+    "--force-target=${stdenv.hostPlatform.parsed.cpu.name}-${stdenv.hostPlatform.parsed.kernel.name}${
             if stdenv.hostPlatform.isDarwin then
               if      stdenv.hostPlatform.osxMinVersion == "10.10" then "14"
               else if stdenv.hostPlatform.osxMinVersion == "10.9"  then "13"

pkgs/development/libraries/libwacom/default.nix

@@ -1,8 +1,8 @@
-{ stdenv, fetchFromGitHub, meson, ninja, glib, pkgconfig, udev, libgudev }:
+{ stdenv, fetchFromGitHub, meson, ninja, glib, pkgconfig, udev, libgudev, doxygen }:
 
 stdenv.mkDerivation rec {
   pname = "libwacom";
-  version = "1.1";
+  version = "1.3";
 
   outputs = [ "out" "dev" ];
 
@@ -10,12 +10,12 @@ stdenv.mkDerivation rec {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    sha256 = "037vnyfg7nim6h3f4m04w6a9pr6hi04df14qpys580kf5xnf87nz";
+    sha256 = "12g8jb67wj6sgg9ar2w8kkw1m1431rn9nd0j64qkrd3vy9g4l0hk";
   };
 
-  nativeBuildInputs = [ pkgconfig meson ninja ];
+  nativeBuildInputs = [ pkgconfig meson ninja doxygen ];
 
-  mesonFlags = [ "-Dtests=false" ];
+  mesonFlags = [ "-Dtests=disabled" ];
 
   buildInputs = [ glib udev libgudev ];
 
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     homepage = "https://linuxwacom.github.io/";
     description = "Libraries, configuration, and diagnostic tools for Wacom tablets running under Linux";
+    maintainers = teams.freedesktop.members;
     license = licenses.mit;
   };
 }

pkgs/development/libraries/libyaml/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libyaml";
-  version = "0.2.2";
+  version = "0.2.4";
 
   src = fetchFromGitHub {
     owner = "yaml";
     repo = "libyaml";
     rev = version;
-    sha256 = "0839nqcmxjzfgjn39j7740pnlsgmvngpkamiw1lfy1qlcqyc3r4v";
+    sha256 = "04z25mvw86jhzyrj0h8mlgisvj9glc5ww9g0cymzjfsd7z33gnmy";
   };
 
   nativeBuildInputs = [ autoreconfHook ];

pkgs/development/libraries/tinyxml/2.6.2.nix

@@ -23,14 +23,14 @@ in stdenv.mkDerivation {
     ./2.6.2-cxx.patch
   ];
 
-  preConfigure = "export LD=${if stdenv.isDarwin then "clang++" else "g++"}";
+  preConfigure = "export LD=${stdenv.cc.targetPrefix}c++";
 
   hardeningDisable = [ "format" ];
 
   NIX_CFLAGS_COMPILE =
     stdenv.lib.optionalString stdenv.isDarwin "-mmacosx-version-min=10.9";
 
-  buildInputs = [ unzip ];
+  nativeBuildInputs = [ unzip ];
   buildPhase = ''
     # use STL (xbmc requires it)
     sed '1i#define TIXML_USE_STL 1' -i tinyxml.h

pkgs/development/libraries/vulkan-loader/default.nix

@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "12n4mxc6db89258k8i47ql1zna7k94lkwv7lpxg39nm8ypa1ywrv";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig cmake ];
-  buildInputs = [ cmake python3 xlibsWrapper libxcb libXrandr libXext wayland ];
+  buildInputs = [ python3 xlibsWrapper libxcb libXrandr libXext wayland ];
   enableParallelBuilding = true;
 
   preConfigure = ''

pkgs/development/libraries/waylandpp/default.nix

@@ -1,5 +1,15 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, pugixml, wayland, libGL
+{ stdenv
-, docSupport ? true, doxygen ? null }:
+, fetchFromGitHub
+, cmake
+, pkgconfig
+, pugixml
+, wayland
+, libGL
+, libffi
+, buildPackages
+, docSupport ? true
+, doxygen ? null
+}:
 
 assert docSupport -> doxygen != null;
 
@@ -15,13 +25,17 @@ stdenv.mkDerivation rec {
     sha256 = "1r4m0xhvwpcqxrqvp3hz1bzlkxqj2jiymd5r6hj8xjzz536hyprz";
   };
 
+  cmakeFlags = [ 
+    "-DCMAKE_INSTALL_DATADIR=${placeholder "dev"}" 
+  ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "-DWAYLAND_SCANNERPP=${buildPackages.waylandpp}/bin/wayland-scanner++"
+  ];
+
   nativeBuildInputs = [ cmake pkgconfig ] ++ optional docSupport doxygen;
-  buildInputs = [ pugixml wayland libGL ];
+  buildInputs = [ pugixml wayland libGL libffi ];
 
   outputs = [ "bin" "dev" "lib" "out" ] ++ optionals docSupport [ "doc" "devman" ];
 
-  cmakeFlags = [ "-DCMAKE_INSTALL_DATADIR=${placeholder "dev"}" ];
-
   meta = with stdenv.lib; {
     description = "Wayland C++ binding";
     homepage = "https://github.com/NilsBrause/waylandpp/";

pkgs/development/perl-modules/xml-parser-0001-HACK-Assumes-Expat-paths-are-good.patch

@@ -0,0 +1,45 @@
+From e996904128653c67b04ddbdb1e10cef158098957 Mon Sep 17 00:00:00 2001
+From: Samuel Dionne-Riel <samuel@dionne-riel.com>
+Date: Fri, 6 Dec 2019 23:00:51 -0500
+Subject: [PATCH] [HACK]: Assumes Expat paths are good.
+
+The `check_lib` check fails with the cross-compilation build platform's
+Perl, since apparently `mktemp` is missing...
+
+Even then, side-stepping the issue, it seems it is not actually enough
+to work, as the compilation fails.
+---
+ Makefile.PL | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/Makefile.PL b/Makefile.PL
+index 505d1df..fc38b76 100644
+--- a/Makefile.PL
++++ b/Makefile.PL
+@@ -29,12 +29,17 @@ foreach (@ARGV) {
+ @ARGV = @replacement_args;
+ 
+ unless (
+-    check_lib(    # fill in what you prompted the user for here
+-        lib     => [qw(expat)],
+-        header  => ['expat.h'],
+-        incpath => $expat_incpath,
+-        ( $expat_libpath ? ( libpath => $expat_libpath ) : () ),
+-    )
++    #check_lib(    # fill in what you prompted the user for here
++    #    lib     => [qw(expat)],
++    #    header  => ['expat.h'],
++    #    incpath => $expat_incpath,
++    #    ( $expat_libpath ? ( libpath => $expat_libpath ) : () ),
++    #)
++    # The check_lib implementation fails horribly with cross-compilation.
++    # We are giving known good paths to expat.
++    # And in all cases, the previous behaviour of not actually failing
++    # seemed to work just fine :/.
++    false
+ ) {
+     warn <<'Expat_Not_Installed;';
+ 
+-- 
+2.23.0
+

pkgs/development/python-modules/python-dbusmock/default.nix

@@ -44,12 +44,12 @@ buildPythonPackage rec {
 
   checkInputs = [
     nose dbus dbus-python which pycodestyle pyflakes
-    pygobject3 bluez bluez.test networkmanager
+    pygobject3 bluez (lib.getOutput "test" bluez) networkmanager
   ];
 
   checkPhase = ''
     runHook preCheck
-    export PATH="$PATH:${bluez.test}/test";
+    export PATH="$PATH:${lib.getOutput "test" bluez}/test";
     nosetests -v
     runHook postCheck
   '';

pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch

@@ -1,25 +1,19 @@
 --- a/mesonbuild/coredata.py
 +++ b/mesonbuild/coredata.py
-@@ -375,18 +375,13 @@
+@@ -483,7 +483,6 @@ class CoreData:
-         '''
+             return value
-         if option.endswith('dir') and os.path.isabs(value) and \
+         if option.endswith('dir') and value.is_absolute() and \
             option not in builtin_dir_noprefix_options:
 -            # Value must be a subdir of the prefix
              # commonpath will always return a path in the native format, so we
              # must use pathlib.PurePath to do the same conversion before
              # comparing.
--            if os.path.commonpath([value, prefix]) != str(PurePath(prefix)):
+@@ -495,7 +494,7 @@ class CoreData:
--                m = 'The value of the {!r} option is {!r} which must be a ' \
+             try:
--                    'subdir of the prefix {!r}.\nNote that if you pass a ' \
+                 value = value.relative_to(prefix)
--                    'relative path, it is assumed to be a subdir of prefix.'
+             except ValueError:
--                raise MesonException(m.format(option, value, prefix))
+-                raise MesonException(msg.format(option, value, prefix))
--            # Convert path to be relative to prefix
++                pass
--            skip = len(prefix) + 1
+             if '..' in str(value):
--            value = value[skip:]
+                 raise MesonException(msg.format(option, value, prefix))
-+            if os.path.commonpath([value, prefix]) == str(PurePath(prefix)):
+         return value.as_posix()
-+                # Convert path to be relative to prefix
-+                skip = len(prefix) + 1
-+                value = value[skip:]
-         return value
- 
-     def init_builtins(self):

pkgs/development/tools/build-managers/meson/default.nix

@@ -19,11 +19,11 @@ let
 in
 python3Packages.buildPythonApplication rec {
   pname = "meson";
-  version = "0.53.2";
+  version = "0.54.0";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "Po+DDzMYQ5fC6wtlHsUCrbY97LKJeL3ISzVY1xKEwh8=";
+    sha256 = "3eVybXeBEqy9Sme7NjOrLuddM9HoeaYoOntKRMM2PCc=";
   };
 
   postFixup = ''

pkgs/development/tools/build-managers/waf/default.nix

@@ -8,13 +8,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "waf";
-  version = "2.0.19";
+  version = "2.0.20";
 
   src = fetchFromGitLab {
     owner = "ita1024";
     repo = "waf";
     rev = "${pname}-${version}";
-    sha256 = "1ydmx20blr776qnmnqp0whyiy81a3glln49m9fva2cmampmandpb";
+    sha256 = "1xbd1lmchq9pdrplkr2db28xqafyw753qbhnrfn8pxdg3inxxqvq";
   };
 
   buildInputs = [ python ensureNewerSourcesForZipFilesHook ];

pkgs/development/tools/documentation/doxygen/default.nix

@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
 
-  name = "doxygen-1.8.17";
+  name = "doxygen-1.8.18";
 
   src = fetchurl {
     urls = [
       "mirror://sourceforge/doxygen/${name}.src.tar.gz" # faster, with https, etc.
       "http://doxygen.nl/files/${name}.src.tar.gz"
     ];
-    sha256 = "16dmv0gm1x8rvbm82fmjvi213q8fxqxinm75pcf595flya59ific";
+    sha256 = "0mh6s1ri1fs5yb27m0avnjsbcxpchgb9aaprq4bd3lj6vjg3s5qq";
   };
 
   nativeBuildInputs = [

pkgs/development/tools/parsing/bison/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bison";
-  version = "3.5.2";
+  version = "3.5.4";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1ylls1ba8y62q78vnzawy4ajpjkk5580crgi8krvfk8g13fvdnxl";
+    sha256 = "0a2cbrqh7mgx2dwf5qm10v68iakv1i0dqh9di4x5aqxsz96ibpf0";
   };
 
   nativeBuildInputs = [ m4 perl ] ++ stdenv.lib.optional stdenv.isSunOS help2man;

pkgs/development/tools/parsing/byacc/default.nix

@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "byacc";
-  version = "20191125";
+  version = "20200330";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/byacc/${pname}-${version}.tgz"
       "https://invisible-mirror.net/archives/byacc/${pname}-${version}.tgz"
     ];
-    sha256 = "1phw8410ly3msv03dmjfi8xkmrl1lrrk928fp1489amg6sz2w707";
+    sha256 = "1c0zyn6v286i09jlc8gx6jyaa5438qyy985rqsd76kb8ibfy56g0";
   };
 
   configureFlags = [

pkgs/misc/emulators/retroarch/default.nix

@@ -15,6 +15,8 @@
 , enableNvidiaCgToolkit ? false, nvidia_cg_toolkit ? null
 , withVulkan ? stdenv.isLinux, vulkan-loader ? null
 , fetchurl
+, wayland
+, libxkbcommon
 }:
 
 with stdenv.lib;
@@ -30,7 +32,7 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
   };
 
-  nativeBuildInputs = [ pkgconfig ]
+  nativeBuildInputs = [ pkgconfig wayland ]
                       ++ optional withVulkan makeWrapper;
 
   buildInputs = [ ffmpeg freetype libxml2 libGLU libGL python3 SDL2 which ]
@@ -38,7 +40,11 @@ stdenv.mkDerivation rec {
                 ++ optional withVulkan vulkan-loader
                 ++ optionals stdenv.isDarwin [ libobjc AppKit Foundation ]
                 ++ optionals stdenv.isLinux [ alsaLib libdrm libpulseaudio libv4l libX11
-                                              libXdmcp libXext libXxf86vm mesa udev ];
+                                              libXdmcp libXext libXxf86vm mesa udev
+                                              wayland libxkbcommon ];
+
+  # we use prefix-less pkg-config
+  PKG_CONF_PATH = "pkg-config";
 
   enableParallelBuilding = true;
 

pkgs/os-specific/linux/alsa-plugins/default.nix

@@ -9,9 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "0z9k3ssbfk2ky2w13avgyf202j1drsz9sv3834bp33cj1i2hc3qw";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
+
   # ToDo: a52, etc.?
   buildInputs =
-    [ pkgconfig alsaLib libogg ]
+    [ alsaLib libogg ]
     ++ lib.optional (libpulseaudio != null) libpulseaudio
     ++ lib.optional (libjack2 != null) libjack2;
 

pkgs/os-specific/linux/bluez/default.nix

@@ -11,9 +11,13 @@
 , readline
 , systemd
 , udev
-}:
+}: let
-
+  pythonPath = with python3.pkgs; [
-stdenv.mkDerivation rec {
+    dbus-python
+    pygobject3
+    recursivePthLoader
+  ];
+in stdenv.mkDerivation rec {
   pname = "bluez";
   version = "5.54";
 
@@ -22,12 +26,6 @@ stdenv.mkDerivation rec {
     sha256 = "1p2ncvjz6alr9n3l5wvq2arqgc7xjs6dqyar1l9jp0z8cfgapkb8";
   };
 
-  pythonPath = with python3.pkgs; [
-    dbus-python
-    pygobject3
-    recursivePthLoader
-  ];
-
   buildInputs = [
     alsaLib
     dbus
@@ -44,7 +42,7 @@ stdenv.mkDerivation rec {
     python3.pkgs.wrapPython
   ];
 
-  outputs = [ "out" "dev" "test" ];
+  outputs = [ "out" "dev" ] ++ lib.optional doCheck "test";
 
   postPatch = ''
     substituteInPlace tools/hid2hci.rules \
@@ -79,7 +77,7 @@ stdenv.mkDerivation rec {
 
   doCheck = stdenv.hostPlatform.isx86_64;
 
-  postInstall = ''
+  postInstall = lib.optionalString doCheck ''
     mkdir -p $test/{bin,test}
     cp -a test $test
     pushd $test/test
@@ -94,8 +92,8 @@ stdenv.mkDerivation rec {
       ln -s ../test/$a $test/bin/bluez-$a
     done
     popd
-    wrapPythonProgramsIn $test/test "$test/test $pythonPath"
+    wrapPythonProgramsIn $test/test "$test/test ${toString pythonPath}"
-
+  '' + ''
     # for bluez4 compatibility for NixOS
     mkdir $out/sbin
     ln -s ../libexec/bluetooth/bluetoothd $out/sbin/bluetoothd

pkgs/os-specific/linux/iproute/default.nix

@@ -1,29 +1,27 @@
-{ fetchurl, stdenv, flex, bash, bison, db, iptables, pkgconfig, libelf, libmnl }:
+{ stdenv, fetchurl
+, buildPackages, bison, flex, pkg-config
+, db, iptables, libelf, libmnl
+}:
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "5.5.0";
+  version = "5.6.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0ywg70f98wgfai35jl47xzpjp45a6n7crja4vc8ql85cbi1l7ids";
+    sha256 = "14j6n1bc09xhq8lxs40vfsx8bb8lx12a07ga4rsxl8vfrqjhwnqv";
   };
 
   preConfigure = ''
-    patchShebangs ./configure
+    # Don't try to create /var/lib/arpd:
     sed -e '/ARPDDIR/d' -i Makefile
-    # Don't build netem tools--they're not installed and require HOSTCC
-    substituteInPlace Makefile --replace " netem " " "
   '';
 
   outputs = [ "out" "dev" ];
 
   makeFlags = [
-    "DESTDIR="
+    "PREFIX=$(out)"
-    "LIBDIR=$(out)/lib"
     "SBINDIR=$(out)/sbin"
-    "MANDIR=$(out)/share/man"
-    "BASH_COMPDIR=$(out)/share/bash-completion/completions"
     "DOCDIR=$(TMPDIR)/share/doc/${pname}" # Don't install docs
     "HDRDIR=$(dev)/include/iproute2"
   ];
@@ -36,15 +34,12 @@ stdenv.mkDerivation rec {
     "CONFDIR=$(out)/etc/iproute2"
   ];
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ]; # netem requires $HOSTCC
+  nativeBuildInputs = [ bison flex pkg-config ];
   buildInputs = [ db iptables libelf libmnl ];
-  nativeBuildInputs = [ bison flex pkgconfig ];
 
   enableParallelBuilding = true;
 
-  postInstall = ''
-    PATH=${bash}/bin:$PATH patchShebangs $out/sbin
-  '';
-
   meta = with stdenv.lib; {
     homepage = "https://wiki.linuxfoundation.org/networking/iproute2";
     description = "A collection of utilities for controlling TCP/IP networking and traffic control in Linux";

pkgs/os-specific/linux/kernel/common-config.nix

@@ -122,6 +122,7 @@ let
       XDP_SOCKETS        = whenAtLeast "4.19" yes;
       XDP_SOCKETS_DIAG   = whenAtLeast "4.19" yes;
       WAN                = yes;
+      TCP_CONG_CUBIC     = yes; # This is the default congestion control algorithm since 2.6.19
       # Required by systemd per-cgroup firewalling
       CGROUP_BPF                  = option yes;
       CGROUP_NET_PRIO             = yes; # Required by systemd
@@ -177,6 +178,10 @@ let
       NF_TABLES_BRIDGE            = mkMerge [ (whenBetween "4.19" "5.3" yes)
                                               (whenAtLeast "5.3" module) ];
 
+      # needed for `dropwatch`
+      # Builtin-only since https://github.com/torvalds/linux/commit/f4b6bcc7002f0e3a3428bac33cf1945abff95450
+      NET_DROP_MONITOR = yes;
+
       # needed for ss
       INET_DIAG         = yes;
       INET_TCP_DIAG     = module;

pkgs/os-specific/linux/plymouth/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, autoreconfHook, pkgconfig, libxslt, docbook_xsl
-, gtk3, udev, systemd
+, gtk3, udev, systemd, lib
 }:
 
 stdenv.mkDerivation rec {
@@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
     "--enable-pango"
     "--enable-gdm-transition"
     "--enable-gtk"
+    "ac_cv_path_SYSTEMD_ASK_PASSWORD_AGENT=${lib.getBin systemd}/bin/systemd-tty-ask-password-agent"
   ];
 
   configurePlatforms = [ "host" ];

pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch

@@ -0,0 +1,32 @@
+From a6c9317a905ef478b8e0d3dad263990feb5d11cb Mon Sep 17 00:00:00 2001
+From: Eelco Dolstra <eelco.dolstra@logicblox.com>
+Date: Tue, 8 Jan 2013 15:46:30 +0100
+Subject: [PATCH 01/27] Start device units for uninitialised encrypted devices
+
+This is necessary because the NixOS service that initialises the
+filesystem depends on the appearance of the device unit.  Also, this
+makes more sense to me: the device is ready; it's the filesystem
+that's not, but taking care of that is the responsibility of the mount
+unit.  (However, this ignores the fsck unit, so it's not perfect...)
+---
+ rules.d/99-systemd.rules.in | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in
+index c34b606216..3ab8c1c3fe 100644
+--- a/rules.d/99-systemd.rules.in
++++ b/rules.d/99-systemd.rules.in
+@@ -17,10 +17,6 @@ SUBSYSTEM=="ubi", TAG+="systemd"
+ SUBSYSTEM=="block", TAG+="systemd"
+ SUBSYSTEM=="block", ACTION=="add", ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="1", ENV{SYSTEMD_READY}="0"
+ 
+-# Ignore encrypted devices with no identified superblock on it, since
+-# we are probably still calling mke2fs or mkswap on it.
+-SUBSYSTEM=="block", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="0"
+-
+ # add symlink to GPT root disk
+ SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}!="crypto_LUKS", SYMLINK+="gpt-auto-root"
+ SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}=="crypto_LUKS", SYMLINK+="gpt-auto-root-luks"
+-- 
+2.24.1
+

pkgs/os-specific/linux/systemd/0003-Don-t-try-to-unmount-nix-or-nix-store.patch

@@ -0,0 +1,42 @@
+From fd9c882581877eef8ba1b34a9502a1ff546b3833 Mon Sep 17 00:00:00 2001
+From: Eelco Dolstra <eelco.dolstra@logicblox.com>
+Date: Fri, 12 Apr 2013 13:16:57 +0200
+Subject: [PATCH 03/27] Don't try to unmount /nix or /nix/store
+
+They'll still be remounted read-only.
+
+https://github.com/NixOS/nixos/issues/126
+---
+ src/core/mount.c      | 4 +++-
+ src/shutdown/umount.c | 2 ++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/core/mount.c b/src/core/mount.c
+index a0dfa6a1a7..4ca6adcdc6 100644
+--- a/src/core/mount.c
++++ b/src/core/mount.c
+@@ -414,6 +414,8 @@ static bool mount_is_extrinsic(Mount *m) {
+ 
+         if (PATH_IN_SET(m->where,  /* Don't bother with the OS data itself */
+                         "/",       /* (strictly speaking redundant: should already be covered by the perpetual flag check above) */
++                        "/nix",
++                        "/nix/store",
+                         "/usr",
+                         "/etc"))
+                 return true;
+diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
+index 2d07d3d6c1..8b112f464e 100644
+--- a/src/shutdown/umount.c
++++ b/src/shutdown/umount.c
+@@ -373,6 +373,8 @@ static int delete_dm(dev_t devnum) {
+ 
+ static bool nonunmountable_path(const char *path) {
+         return path_equal(path, "/")
++                || path_equal(path, "/nix")
++                || path_equal(path, "/nix/store")
+ #if ! HAVE_SPLIT_USR
+                 || path_equal(path, "/usr")
+ #endif
+-- 
+2.25.1
+

pkgs/os-specific/linux/systemd/0004-Fix-NixOS-containers.patch

@@ -0,0 +1,34 @@
+From 58c4a7b4e9d9c34b92deded6aea814738821059d Mon Sep 17 00:00:00 2001
+From: Eelco Dolstra <eelco.dolstra@logicblox.com>
+Date: Wed, 16 Apr 2014 10:59:28 +0200
+Subject: [PATCH 04/27] Fix NixOS containers
+
+In NixOS containers, the init script is bind-mounted into the
+container, so checking early whether it exists will fail.
+---
+ src/nspawn/nspawn.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
+index 5d9290b1cf..26615901c3 100644
+--- a/src/nspawn/nspawn.c
++++ b/src/nspawn/nspawn.c
+@@ -4924,6 +4924,7 @@ static int run(int argc, char *argv[]) {
+                                 goto finish;
+                         }
+                 } else {
++#if 0
+                         const char *p, *q;
+ 
+                         if (arg_pivot_root_new)
+@@ -4938,6 +4939,7 @@ static int run(int argc, char *argv[]) {
+                                 r = -EINVAL;
+                                 goto finish;
+                         }
++#endif
+                 }
+ 
+         } else {
+-- 
+2.24.1
+

pkgs/os-specific/linux/systemd/0006-Look-for-fsck-in-the-right-place.patch

@@ -0,0 +1,25 @@
+From c841ffab8fb6174b51382b9d4334f78c74018730 Mon Sep 17 00:00:00 2001
+From: Eelco Dolstra <eelco.dolstra@logicblox.com>
+Date: Thu, 1 May 2014 14:10:10 +0200
+Subject: [PATCH 06/27] Look for fsck in the right place
+
+---
+ src/fsck/fsck.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/fsck/fsck.c b/src/fsck/fsck.c
+index 55e6544d31..3626aadda7 100644
+--- a/src/fsck/fsck.c
++++ b/src/fsck/fsck.c
+@@ -371,7 +371,7 @@ static int run(int argc, char *argv[]) {
+                 } else
+                         dash_c[0] = 0;
+ 
+-                cmdline[i++] = "/sbin/fsck";
++                cmdline[i++] = "/run/current-system/sw/bin/fsck";
+                 cmdline[i++] =  arg_repair;
+                 cmdline[i++] = "-T";
+ 
+-- 
+2.24.1
+

pkgs/os-specific/linux/systemd/0007-Add-some-NixOS-specific-unit-directories.patch

@@ -0,0 +1,107 @@
+From 8c0be07ccbad35d0c1106015057996aa55b9a1f9 Mon Sep 17 00:00:00 2001
+From: Eelco Dolstra <eelco.dolstra@logicblox.com>
+Date: Fri, 19 Dec 2014 14:46:17 +0100
+Subject: [PATCH 07/27] Add some NixOS-specific unit directories
+
+Look in /nix/var/nix/profiles/default/lib/systemd for units provided
+by packages in the default (system-wide) profile, and in
+/etc/systemd-mutable/system for persistent, mutable units (not
+recommended).
+
+Also, remove /usr and /lib as these don't exist on NixOS.
+---
+ src/core/systemd.pc.in   |  4 ++--
+ src/shared/path-lookup.c | 18 +++++-------------
+ 2 files changed, 7 insertions(+), 15 deletions(-)
+
+diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
+index 5d1ddd7620..21b977d6fc 100644
+--- a/src/core/systemd.pc.in
++++ b/src/core/systemd.pc.in
+@@ -17,8 +17,8 @@ systemduserunitdir=${prefix}/lib/systemd/user
+ systemduserpresetdir=${prefix}/lib/systemd/user-preset
+ systemdsystemconfdir=${sysconfdir}/systemd/system
+ systemduserconfdir=${sysconfdir}/systemd/user
+-systemdsystemunitpath=${systemdsystemconfdir}:/etc/systemd/system:/run/systemd/system:/usr/local/lib/systemd/system:${systemdsystemunitdir}:/usr/lib/systemd/system:/lib/systemd/system
+-systemduserunitpath=${systemduserconfdir}:/etc/systemd/user:/run/systemd/user:/usr/local/lib/systemd/user:/usr/local/share/systemd/user:${systemduserunitdir}:/usr/lib/systemd/user:/usr/share/systemd/user
++systemdsystemunitpath=${systemdsystemconfdir}:/etc/systemd/system:/etc/systemd-mutable/system:/nix/var/nix/profiles/default/lib/systemd/user:/run/systemd/system:${systemdsystemunitdir}
++systemduserunitpath=${systemduserconfdir}:/etc/systemd/user:/etc/systemd-mutable/user:/nix/var/nix/profiles/default/lib/systemd/system:/run/systemd/user:${systemduserunitdir}
+ systemdsystemgeneratordir=${rootprefix}/lib/systemd/system-generators
+ systemdusergeneratordir=${prefix}/lib/systemd/user-generators
+ systemdsleepdir=${rootprefix}/lib/systemd/system-sleep
+diff --git a/src/shared/path-lookup.c b/src/shared/path-lookup.c
+index 6bf0ff0316..2b6324ad8c 100644
+--- a/src/shared/path-lookup.c
++++ b/src/shared/path-lookup.c
+@@ -99,17 +99,14 @@ int xdg_user_data_dir(char **ret, const char *suffix) {
+ }
+ 
+ static const char* const user_data_unit_paths[] = {
+-        "/usr/local/lib/systemd/user",
+-        "/usr/local/share/systemd/user",
+         USER_DATA_UNIT_PATH,
+-        "/usr/lib/systemd/user",
+-        "/usr/share/systemd/user",
+         NULL
+ };
+ 
+ static const char* const user_config_unit_paths[] = {
+         USER_CONFIG_UNIT_PATH,
+         "/etc/systemd/user",
++        "/etc/systemd-mutable/user",
+         NULL
+ };
+ 
+@@ -604,15 +601,14 @@ int lookup_paths_init(
+                                         persistent_config,
+                                         SYSTEM_CONFIG_UNIT_PATH,
+                                         "/etc/systemd/system",
++                                        "/etc/systemd-mutable/system",
++                                        "/nix/var/nix/profiles/default/lib/systemd/system",
+                                         STRV_IFNOTNULL(persistent_attached),
+                                         runtime_config,
+                                         "/run/systemd/system",
+                                         STRV_IFNOTNULL(runtime_attached),
+                                         STRV_IFNOTNULL(generator),
+-                                        "/usr/local/lib/systemd/system",
+                                         SYSTEM_DATA_UNIT_PATH,
+-                                        "/usr/lib/systemd/system",
+-                                        STRV_IFNOTNULL(flags & LOOKUP_PATHS_SPLIT_USR ? "/lib/systemd/system" : NULL),
+                                         STRV_IFNOTNULL(generator_late));
+                         break;
+ 
+@@ -628,14 +624,12 @@ int lookup_paths_init(
+                                         persistent_config,
+                                         USER_CONFIG_UNIT_PATH,
+                                         "/etc/systemd/user",
++                                        "/etc/systemd-mutable/user",
++                                        "/nix/var/nix/profiles/default/lib/systemd/user",
+                                         runtime_config,
+                                         "/run/systemd/user",
+                                         STRV_IFNOTNULL(generator),
+-                                        "/usr/local/share/systemd/user",
+-                                        "/usr/share/systemd/user",
+-                                        "/usr/local/lib/systemd/user",
+                                         USER_DATA_UNIT_PATH,
+-                                        "/usr/lib/systemd/user",
+                                         STRV_IFNOTNULL(generator_late));
+                         break;
+ 
+@@ -824,14 +818,12 @@ char **generator_binary_paths(UnitFileScope scope) {
+         case UNIT_FILE_SYSTEM:
+                 return strv_new("/run/systemd/system-generators",
+                                 "/etc/systemd/system-generators",
+-                                "/usr/local/lib/systemd/system-generators",
+                                 SYSTEM_GENERATOR_PATH);
+ 
+         case UNIT_FILE_GLOBAL:
+         case UNIT_FILE_USER:
+                 return strv_new("/run/systemd/user-generators",
+                                 "/etc/systemd/user-generators",
+-                                "/usr/local/lib/systemd/user-generators",
+                                 USER_GENERATOR_PATH);
+ 
+         default:
+-- 
+2.24.1
+

pkgs/os-specific/linux/systemd/0009-Get-rid-of-a-useless-message-in-user-sessions.patch

@@ -0,0 +1,31 @@
+From 99c86daa5244d45a19f75f6ce92bd4255edef420 Mon Sep 17 00:00:00 2001
+From: Eelco Dolstra <eelco.dolstra@logicblox.com>
+Date: Mon, 11 May 2015 15:39:38 +0200
+Subject: [PATCH 09/27] Get rid of a useless message in user sessions
+
+Namely lots of variants of
+
+  Unit nix-var-nix-db.mount is bound to inactive unit dev-disk-by\x2dlabel-nixos.device. Stopping, too.
+
+in containers.
+---
+ src/core/unit.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/core/unit.c b/src/core/unit.c
+index a1dc76aa6a..07670af8e2 100644
+--- a/src/core/unit.c
++++ b/src/core/unit.c
+@@ -2045,7 +2045,8 @@ static void unit_check_binds_to(Unit *u) {
+         }
+ 
+         assert(other);
+-        log_unit_info(u, "Unit is bound to inactive unit %s. Stopping, too.", other->id);
++        if (u->type != UNIT_MOUNT || detect_container() <= 0)
++                log_unit_info(u, "Unit is bound to inactive unit %s. Stopping, too.", other->id);
+ 
+         /* A unit we need to run is gone. Sniff. Let's stop this. */
+         r = manager_add_job(u->manager, JOB_STOP, u, JOB_FAIL, NULL, &error, NULL);
+-- 
+2.24.1
+

pkgs/os-specific/linux/systemd/0010-hostnamed-localed-timedated-disable-methods-that-cha.patch

@@ -0,0 +1,118 @@
+From cec1430f72edfedb951fe34e87765ef422ea9843 Mon Sep 17 00:00:00 2001
+From: Gabriel Ebner <gebner@gebner.org>
+Date: Sun, 6 Dec 2015 14:26:36 +0100
+Subject: [PATCH 10/27] hostnamed, localed, timedated: disable methods that
+ change system settings.
+
+---
+ src/hostname/hostnamed.c |  9 +++++++++
+ src/locale/localed.c     |  9 +++++++++
+ src/timedate/timedated.c | 10 ++++++++++
+ 3 files changed, 28 insertions(+)
+
+diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
+index 9e4f4fb59e..141b8acc08 100644
+--- a/src/hostname/hostnamed.c
++++ b/src/hostname/hostnamed.c
+@@ -423,6 +423,9 @@ static int method_set_hostname(sd_bus_message *m, void *userdata, sd_bus_error *
+         if (r < 0)
+                 return r;
+ 
++        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++            "Changing system settings via systemd is not supported on NixOS.");
++
+         if (isempty(name))
+                 name = c->data[PROP_STATIC_HOSTNAME];
+ 
+@@ -479,6 +482,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
+         if (r < 0)
+                 return r;
+ 
++        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++            "Changing system settings via systemd is not supported on NixOS.");
++
+         name = empty_to_null(name);
+ 
+         if (streq_ptr(name, c->data[PROP_STATIC_HOSTNAME]))
+@@ -536,6 +542,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
+         if (r < 0)
+                 return r;
+ 
++        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++            "Changing system settings via systemd is not supported on NixOS.");
++
+         name = empty_to_null(name);
+ 
+         if (streq_ptr(name, c->data[prop]))
+diff --git a/src/locale/localed.c b/src/locale/localed.c
+index 8d0eec96a5..0b1c1d664e 100644
+--- a/src/locale/localed.c
++++ b/src/locale/localed.c
+@@ -276,6 +276,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
+         if (r < 0)
+                 return r;
+ 
++        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++            "Changing system settings via systemd is not supported on NixOS.");
++
+         /* If single locale without variable name is provided, then we assume it is LANG=. */
+         if (strv_length(l) == 1 && !strchr(*l, '=')) {
+                 if (!locale_is_valid(*l))
+@@ -411,6 +414,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
+         if (r < 0)
+                 return r;
+ 
++        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++            "Changing system settings via systemd is not supported on NixOS.");
++
+         keymap = empty_to_null(keymap);
+         keymap_toggle = empty_to_null(keymap_toggle);
+ 
+@@ -587,6 +593,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
+         if (r < 0)
+                 return r;
+ 
++        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++            "Changing system settings via systemd is not supported on NixOS.");
++
+         layout = empty_to_null(layout);
+         model = empty_to_null(model);
+         variant = empty_to_null(variant);
+diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
+index 6c94b23de4..fa20d22cde 100644
+--- a/src/timedate/timedated.c
++++ b/src/timedate/timedated.c
+@@ -653,6 +653,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
+         if (r < 0)
+                 return r;
+ 
++        if (getenv("NIXOS_STATIC_TIMEZONE"))
++                return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++                    "Changing timezone via systemd is not supported when it is set in NixOS configuration.");
++
+         if (!timezone_is_valid(z, LOG_DEBUG))
+                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z);
+ 
+@@ -732,6 +736,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
+         if (r < 0)
+                 return r;
+ 
++        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++            "Changing system settings via systemd is not supported on NixOS.");
++
+         if (lrtc == c->local_rtc)
+                 return sd_bus_reply_method_return(m, NULL);
+ 
+@@ -924,6 +931,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
+         if (r < 0)
+                 return r;
+ 
++        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++            "Changing system settings via systemd is not supported on NixOS.");
++
+         r = context_update_ntp_status(c, bus, m);
+         if (r < 0)
+                 return r;
+-- 
+2.24.1
+

pkgs/os-specific/linux/systemd/0011-Fix-hwdb-paths.patch

@@ -0,0 +1,32 @@
+From 0f434c6baee63eff913f36aee839df3718a75d4a Mon Sep 17 00:00:00 2001
+From: Nikolay Amiantov <ab@fmap.me>
+Date: Thu, 7 Jul 2016 02:47:13 +0300
+Subject: [PATCH 11/27] Fix hwdb paths
+
+Patch by vcunat.
+---
+ src/libsystemd/sd-hwdb/sd-hwdb.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/src/libsystemd/sd-hwdb/sd-hwdb.c b/src/libsystemd/sd-hwdb/sd-hwdb.c
+index 58124abd21..d80e408b8c 100644
+--- a/src/libsystemd/sd-hwdb/sd-hwdb.c
++++ b/src/libsystemd/sd-hwdb/sd-hwdb.c
+@@ -298,13 +298,8 @@ static int trie_search_f(sd_hwdb *hwdb, const char *search) {
+ }
+ 
+ static const char hwdb_bin_paths[] =
+-        "/etc/systemd/hwdb/hwdb.bin\0"
+         "/etc/udev/hwdb.bin\0"
+-        "/usr/lib/systemd/hwdb/hwdb.bin\0"
+-#if HAVE_SPLIT_USR
+-        "/lib/systemd/hwdb/hwdb.bin\0"
+-#endif
+-        UDEVLIBEXECDIR "/hwdb.bin\0";
++        ;
+ 
+ _public_ int sd_hwdb_new(sd_hwdb **ret) {
+         _cleanup_(sd_hwdb_unrefp) sd_hwdb *hwdb = NULL;
+-- 
+2.24.1
+

pkgs/os-specific/linux/systemd/0012-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch

@@ -0,0 +1,132 @@
+From 78479b75c9f9342646223b3db6b4b0744817dc24 Mon Sep 17 00:00:00 2001
+From: Nikolay Amiantov <ab@fmap.me>
+Date: Tue, 11 Oct 2016 13:12:08 +0300
+Subject: [PATCH] Change /usr/share/zoneinfo to /etc/zoneinfo
+
+NixOS uses this path.
+---
+ man/localtime.xml         | 4 ++--
+ src/basic/time-util.c     | 6 +++---
+ src/firstboot/firstboot.c | 2 +-
+ src/nspawn/nspawn.c       | 4 ++--
+ src/timedate/timedated.c  | 8 ++++----
+ 5 files changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/man/localtime.xml b/man/localtime.xml
+index 0f1652ee2e..71c4f95c2e 100644
+--- a/man/localtime.xml
++++ b/man/localtime.xml
+@@ -20,7 +20,7 @@
+   </refnamediv>
+ 
+   <refsynopsisdiv>
+-    <para><filename>/etc/localtime</filename> -&gt; <filename>../usr/share/zoneinfo/…</filename></para>
++    <para><filename>/etc/localtime</filename> -&gt; <filename>zoneinfo/…</filename></para>
+   </refsynopsisdiv>
+ 
+   <refsect1>
+@@ -30,7 +30,7 @@
+     system-wide timezone of the local system that is used by
+     applications for presentation to the user. It should be an
+     absolute or relative symbolic link pointing to
+-    <filename>/usr/share/zoneinfo/</filename>, followed by a timezone
++    <filename>/etc/zoneinfo/</filename>, followed by a timezone
+     identifier such as <literal>Europe/Berlin</literal> or
+     <literal>Etc/UTC</literal>. The resulting link should lead to the
+     corresponding binary
+diff --git a/src/basic/time-util.c b/src/basic/time-util.c
+index 105584e2e7..5238f69931 100644
+--- a/src/basic/time-util.c
++++ b/src/basic/time-util.c
+@@ -1217,7 +1217,7 @@ int get_timezones(char ***ret) {
+         n_allocated = 2;
+         n_zones = 1;
+ 
+-        f = fopen("/usr/share/zoneinfo/zone1970.tab", "re");
++        f = fopen("/etc/zoneinfo/zone1970.tab", "re");
+         if (f) {
+                 for (;;) {
+                         _cleanup_free_ char *line = NULL;
+@@ -1312,7 +1312,7 @@ bool timezone_is_valid(const char *name, int log_level) {
+         if (p - name >= PATH_MAX)
+                 return false;
+ 
+-        t = strjoina("/usr/share/zoneinfo/", name);
++        t = strjoina("/etc/zoneinfo/", name);
+ 
+         fd = open(t, O_RDONLY|O_CLOEXEC);
+         if (fd < 0) {
+@@ -1410,7 +1410,7 @@ int get_timezone(char **ret) {
+         if (r < 0)
+                 return r; /* returns EINVAL if not a symlink */
+ 
+-        e = PATH_STARTSWITH_SET(t, "/usr/share/zoneinfo/", "../usr/share/zoneinfo/");
++        e = PATH_STARTSWITH_SET(t, "/etc/zoneinfo/", "../etc/zoneinfo/");
+         if (!e)
+                 return -EINVAL;
+ 
+diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
+index 528e6452cf..c712ca9072 100644
+--- a/src/firstboot/firstboot.c
++++ b/src/firstboot/firstboot.c
+@@ -443,7 +443,7 @@ static int process_timezone(void) {
+         if (isempty(arg_timezone))
+                 return 0;
+ 
+-        e = strjoina("../usr/share/zoneinfo/", arg_timezone);
++        e = strjoina("zoneinfo/", arg_timezone);
+ 
+         (void) mkdir_parents(etc_localtime, 0755);
+         if (symlink(e, etc_localtime) < 0)
+diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
+index 873a76596f..a024b10f32 100644
+--- a/src/nspawn/nspawn.c
++++ b/src/nspawn/nspawn.c
+@@ -1642,8 +1642,8 @@ static int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t u
+ static const char *timezone_from_path(const char *path) {
+         return PATH_STARTSWITH_SET(
+                         path,
+-                        "../usr/share/zoneinfo/",
+-                        "/usr/share/zoneinfo/");
++                        "../etc/zoneinfo/",
++                        "/etc/zoneinfo/");
+ }
+ 
+ static bool etc_writable(void) {
+diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
+index 5e2fb50d83..02eb2ca11d 100644
+--- a/src/timedate/timedated.c
++++ b/src/timedate/timedated.c
+@@ -264,7 +264,7 @@ static int context_read_data(Context *c) {
+ 
+         r = get_timezone(&t);
+         if (r == -EINVAL)
+-                log_warning_errno(r, "/etc/localtime should be a symbolic link to a time zone data file in /usr/share/zoneinfo/.");
++                log_warning_errno(r, "/etc/localtime should be a symbolic link to a time zone data file in /etc/zoneinfo/.");
+         else if (r < 0)
+                 log_warning_errno(r, "Failed to get target of /etc/localtime: %m");
+ 
+@@ -288,7 +288,7 @@ static int context_write_data_timezone(Context *c) {
+ 
+         if (isempty(c->zone) || streq(c->zone, "UTC")) {
+ 
+-                if (access("/usr/share/zoneinfo/UTC", F_OK) < 0) {
++                if (access("/etc/zoneinfo/UTC", F_OK) < 0) {
+ 
+                         if (unlink("/etc/localtime") < 0 && errno != ENOENT)
+                                 return -errno;
+@@ -296,9 +296,9 @@ static int context_write_data_timezone(Context *c) {
+                         return 0;
+                 }
+ 
+-                source = "../usr/share/zoneinfo/UTC";
++                source = "../etc/zoneinfo/UTC";
+         } else {
+-                p = path_join("../usr/share/zoneinfo", c->zone);
++                p = path_join("../etc/zoneinfo", c->zone);
+                 if (!p)
+                         return -ENOMEM;
+ 
+-- 
+2.25.1
+

pkgs/os-specific/linux/systemd/0013-localectl-use-etc-X11-xkb-for-list-x11.patch

@@ -0,0 +1,27 @@
+From 5365ffbfba2de03628e8bbb6cc0bc022272436a1 Mon Sep 17 00:00:00 2001
+From: Imuli <i@imu.li>
+Date: Wed, 19 Oct 2016 08:46:47 -0400
+Subject: [PATCH 13/27] localectl: use /etc/X11/xkb for list-x11-*
+
+NixOS has an option to link the xkb data files to /etc/X11, but not to
+/usr/share/X11.
+---
+ src/locale/localectl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/locale/localectl.c b/src/locale/localectl.c
+index 9fb5152110..9554c2cf76 100644
+--- a/src/locale/localectl.c
++++ b/src/locale/localectl.c
+@@ -287,7 +287,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
+         } state = NONE, look_for;
+         int r;
+ 
+-        f = fopen("/usr/share/X11/xkb/rules/base.lst", "re");
++        f = fopen("/etc/X11/xkb/rules/base.lst", "re");
+         if (!f)
+                 return log_error_errno(errno, "Failed to open keyboard mapping list. %m");
+ 
+-- 
+2.24.1
+

pkgs/os-specific/linux/systemd/0016-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch

@@ -0,0 +1,26 @@
+From 1408762890aba25e58598d1e4dfa17ed2b75de26 Mon Sep 17 00:00:00 2001
+From: Franz Pletz <fpletz@fnordicwalking.de>
+Date: Sun, 11 Feb 2018 04:37:44 +0100
+Subject: [PATCH 16/27] build: don't create statedir and don't touch prefixdir
+
+---
+ meson.build | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 8ccc947e37..263cc7189a 100644
+--- a/meson.build
++++ b/meson.build
+@@ -2944,9 +2944,6 @@ install_data('LICENSE.GPL2',
+              'src/libsystemd/sd-bus/GVARIANT-SERIALIZATION',
+              install_dir : docdir)
+ 
+-meson.add_install_script('sh', '-c', mkdir_p.format(systemdstatedir))
+-meson.add_install_script('sh', '-c', 'touch $DESTDIR@0@'.format(prefixdir))
+-
+ ############################################################
+ 
+ meson_check_help = find_program('tools/meson-check-help.sh')
+-- 
+2.24.1
+

pkgs/os-specific/linux/systemd/0018-Install-default-configuration-into-out-share-factory.patch

@@ -0,0 +1,317 @@
+From a087cb535b2d3c7a5d989b5aabc0a257369e9f9d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Mon, 26 Feb 2018 14:25:57 +0000
+Subject: [PATCH 18/27] Install default configuration into $out/share/factory
+
+By default systemd should read all its configuration from /etc. Therefor
+we rely on -Dsysconfdir=/etc in meson as default value. Unfortunately
+this would also lead to installation of systemd's own configuration
+files to `/etc` whereas we are limited to /nix/store. To counter that
+this commit introduces two new configuration variables `factoryconfdir`
+and `factorypkgconfdir` to install systemd's own configuration into nix
+store again, while having executables looking up files in /etc.
+---
+ hwdb.d/meson.build               |  2 +-
+ meson.build                    | 11 +++++++----
+ network/meson.build            |  2 +-
+ src/core/meson.build           | 10 +++++-----
+ src/coredump/meson.build       |  2 +-
+ src/journal-remote/meson.build |  4 ++--
+ src/journal/meson.build        |  2 +-
+ src/kernel-install/meson.build |  2 +-
+ src/login/meson.build          |  2 +-
+ src/network/meson.build        |  2 +-
+ src/pstore/meson.build         |  2 +-
+ src/resolve/meson.build        |  2 +-
+ src/timesync/meson.build       |  2 +-
+ src/udev/meson.build           |  4 ++--
+ sysctl.d/meson.build           |  2 +-
+ tmpfiles.d/meson.build         |  2 +-
+ units/meson.build              |  3 ++-
+ 17 files changed, 30 insertions(+), 26 deletions(-)
+
+diff --git a/hwdb.d/meson.build b/hwdb.d/meson.build
+index badf39f555..8fd9c7639f 100644
+--- a/hwdb.d/meson.build
++++ b/hwdb.d/meson.build
+@@ -26,7 +26,7 @@ if conf.get('ENABLE_HWDB') == 1
+                      install_dir : udevhwdbdir)
+ 
+         meson.add_install_script('sh', '-c',
+-                                 mkdir_p.format(join_paths(sysconfdir, 'udev/hwdb.d')))
++                                 mkdir_p.format(join_paths(factoryconfdir, 'udev/hwdb.d')))
+ 
+         meson.add_install_script('sh', '-c',
+                                  'test -n "$DESTDIR" || @0@/systemd-hwdb update'
+                                  .format(rootbindir))
+ endif
+ 
+ ############################################################
+diff --git a/meson.build b/meson.build
+index 263cc7189a..7a67078208 100644
+--- a/meson.build
++++ b/meson.build
+@@ -151,6 +151,9 @@ udevhwdbdir = join_paths(udevlibexecdir, 'hwdb.d')
+ catalogdir = join_paths(prefixdir, 'lib/systemd/catalog')
+ kernelinstalldir = join_paths(prefixdir, 'lib/kernel/install.d')
+ factorydir = join_paths(datadir, 'factory')
++factoryconfdir = join_paths(datadir, 'factory/etc')
++factorypkgconfdir = join_paths(datadir, 'factory/etc/systemd')
++factoryxinitrcdir = join_paths(datadir, 'factory/etc/X11/xinit/xinitrc.d')
+ bootlibdir = join_paths(prefixdir, 'lib/systemd/boot/efi')
+ testsdir = join_paths(prefixdir, 'lib/systemd/tests')
+ systemdstatedir = join_paths(localstatedir, 'lib/systemd')
+@@ -2287,7 +2290,7 @@ if conf.get('ENABLE_BINFMT') == 1
+         meson.add_install_script('sh', '-c',
+                                  mkdir_p.format(binfmtdir))
+         meson.add_install_script('sh', '-c',
+-                                 mkdir_p.format(join_paths(sysconfdir, 'binfmt.d')))
++                                 mkdir_p.format(join_paths(factoryconfdir, 'binfmt.d')))
+ endif
+ 
+ if conf.get('ENABLE_VCONSOLE') == 1
+@@ -2373,7 +2376,7 @@ executable('systemd-sleep',
+            install_dir : rootlibexecdir)
+ 
+ install_data('src/sleep/sleep.conf',
+-             install_dir : pkgsysconfdir)
++             install_dir : factorypkgconfdir)
+ 
+ exe = executable('systemd-sysctl',
+                  'src/sysctl/sysctl.c',
+@@ -2685,7 +2688,7 @@ if conf.get('HAVE_KMOD') == 1
+         meson.add_install_script('sh', '-c',
+                                  mkdir_p.format(modulesloaddir))
+         meson.add_install_script('sh', '-c',
+-                                 mkdir_p.format(join_paths(sysconfdir, 'modules-load.d')))
++                                 mkdir_p.format(join_paths(factoryconfdir, 'modules-load.d')))
+ endif
+ 
+ exe = executable('systemd-nspawn',
+@@ -2927,7 +2930,7 @@ install_subdir('factory/etc',
+                install_dir : factorydir)
+ 
+ install_data('xorg/50-systemd-user.sh',
+-             install_dir : xinitrcdir)
++             install_dir : factoryxinitrcdir)
+ install_data('modprobe.d/systemd.conf',
+              install_dir : modprobedir)
+ install_data('LICENSE.GPL2',
+diff --git a/network/meson.build b/network/meson.build
+index 59d4be1a17..72da2c16a2 100644
+--- a/network/meson.build
++++ b/network/meson.build
+@@ -7,7 +7,7 @@ if conf.get('ENABLE_NETWORKD') == 1
+                      install_dir : networkdir)
+ 
+         meson.add_install_script('sh', '-c',
+-                                 mkdir_p.format(join_paths(sysconfdir, 'systemd/network')))
++                                 mkdir_p.format(join_paths(factoryconfdir, 'systemd/network')))
+ endif
+ 
+ install_data('99-default.link',
+diff --git a/src/core/meson.build b/src/core/meson.build
+index df3aa5c6c1..305f67a80a 100644
+--- a/src/core/meson.build
++++ b/src/core/meson.build
+@@ -179,8 +179,8 @@ libcore = static_library(
+ systemd_sources = files('main.c')
+ 
+ in_files = [['macros.systemd',   rpmmacrosdir],
+-            ['system.conf',      pkgsysconfdir],
+-            ['user.conf',        pkgsysconfdir],
++            ['system.conf',      factorypkgconfdir],
++            ['user.conf',        factorypkgconfdir],
+             ['systemd.pc',       pkgconfigdatadir],
+             ['triggers.systemd', '']]
+ 
+@@ -210,6 +210,6 @@ meson.add_install_script('sh', '-c', mkdir_p.format(systemsleepdir))
+ meson.add_install_script('sh', '-c', mkdir_p.format(systemgeneratordir))
+ meson.add_install_script('sh', '-c', mkdir_p.format(usergeneratordir))
+ 
+-meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(pkgsysconfdir, 'system')))
+-meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(pkgsysconfdir, 'user')))
+-meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(sysconfdir, 'xdg/systemd')))
++meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(factorypkgconfdir, 'system')))
++meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(factorypkgconfdir, 'user')))
++meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(factorypkgconfdir, 'xdg/systemd')))
+diff --git a/src/coredump/meson.build b/src/coredump/meson.build
+index 7fa5942697..34c865dfa0 100644
+--- a/src/coredump/meson.build
++++ b/src/coredump/meson.build
+@@ -15,7 +15,7 @@ coredumpctl_sources = files('coredumpctl.c')
+ 
+ if conf.get('ENABLE_COREDUMP') == 1
+         install_data('coredump.conf',
+-                     install_dir : pkgsysconfdir)
++                     install_dir : factorypkgconfdir)
+ endif
+ 
+ tests += [
+diff --git a/src/journal-remote/meson.build b/src/journal-remote/meson.build
+index 87b8ba6495..daff8ec967 100644
+--- a/src/journal-remote/meson.build
++++ b/src/journal-remote/meson.build
+@@ -49,7 +49,7 @@ if conf.get('ENABLE_REMOTE') ==1 and conf.get('HAVE_LIBCURL') == 1
+                 output : 'journal-upload.conf',
+                 configuration : substs)
+         install_data(journal_upload_conf,
+-                     install_dir : pkgsysconfdir)
++                     install_dir : factorypkgconfdir)
+ endif
+ 
+ if conf.get('ENABLE_REMOTE') == 1 and conf.get('HAVE_MICROHTTPD') == 1
+@@ -58,7 +58,7 @@ if conf.get('ENABLE_REMOTE') == 1 and conf.get('HAVE_MICROHTTPD') == 1
+                 output : 'journal-remote.conf',
+                 configuration : substs)
+         install_data(journal_remote_conf,
+-                     install_dir : pkgsysconfdir)
++                     install_dir : factorypkgconfdir)
+ 
+         install_data('browse.html',
+                      install_dir : join_paths(pkgdatadir, 'gatewayd'))
+diff --git a/src/journal/meson.build b/src/journal/meson.build
+index 5796f77cac..75d975c260 100644
+--- a/src/journal/meson.build
++++ b/src/journal/meson.build
+@@ -109,7 +109,7 @@ if conf.get('HAVE_QRENCODE') == 1
+ endif
+ 
+ install_data('journald.conf',
+-             install_dir : pkgsysconfdir)
++             install_dir : factorypkgconfdir)
+ 
+ if get_option('create-log-dirs')
+         meson.add_install_script(
+diff --git a/src/kernel-install/meson.build b/src/kernel-install/meson.build
+index 261c3aaae4..dbc5e23513 100644
+--- a/src/kernel-install/meson.build
++++ b/src/kernel-install/meson.build
+@@ -11,4 +11,4 @@ install_data('00-entry-directory.install',
+              install_dir : kernelinstalldir)
+ 
+ meson.add_install_script('sh', '-c',
+-                         mkdir_p.format(join_paths(sysconfdir, 'kernel/install.d')))
++                         mkdir_p.format(join_paths(factoryconfdir, 'kernel/install.d')))
+diff --git a/src/login/meson.build b/src/login/meson.build
+index 0a7d3d5440..ff90149c1c 100644
+--- a/src/login/meson.build
++++ b/src/login/meson.build
+@@ -75,7 +75,7 @@ if conf.get('ENABLE_LOGIND') == 1
+                 output : 'logind.conf',
+                 configuration : substs)
+         install_data(logind_conf,
+-                     install_dir : pkgsysconfdir)
++                     install_dir : factorypkgconfdir)
+ 
+         install_data('org.freedesktop.login1.conf',
+                      install_dir : dbuspolicydir)
+diff --git a/src/network/meson.build b/src/network/meson.build
+index 6bed37a170..35f15bcaf1 100644
+--- a/src/network/meson.build
++++ b/src/network/meson.build
+@@ -168,7 +168,7 @@ if conf.get('ENABLE_NETWORKD') == 1
+         endif
+ 
+         install_data('networkd.conf',
+-                     install_dir : pkgsysconfdir)
++                     install_dir : factorypkgconfdir)
+ 
+         fuzzers += [
+     [['src/network/fuzz-netdev-parser.c',
+diff --git a/src/pstore/meson.build b/src/pstore/meson.build
+index adbac24b54..e9dc88dfa2 100644
+--- a/src/pstore/meson.build
++++ b/src/pstore/meson.build
+@@ -6,5 +6,5 @@ systemd_pstore_sources = files('''
+ 
+ if conf.get('ENABLE_PSTORE') == 1
+         install_data('pstore.conf',
+-                     install_dir : pkgsysconfdir)
++                     install_dir : factorypkgconfdir)
+ endif
+diff --git a/src/resolve/meson.build b/src/resolve/meson.build
+index 92b67b6333..ac5b9a0b0a 100644
+--- a/src/resolve/meson.build
++++ b/src/resolve/meson.build
+@@ -168,7 +168,7 @@ if conf.get('ENABLE_RESOLVE') == 1
+                 output : 'resolved.conf',
+                 configuration : substs)
+         install_data(resolved_conf,
+-                     install_dir : pkgsysconfdir)
++                     install_dir : factorypkgconfdir)
+ 
+         install_data('resolv.conf',
+                      install_dir : rootlibexecdir)
+diff --git a/src/timesync/meson.build b/src/timesync/meson.build
+index e5c118c8db..19235df9ca 100644
+--- a/src/timesync/meson.build
++++ b/src/timesync/meson.build
+@@ -27,7 +27,7 @@ if conf.get('ENABLE_TIMESYNCD') == 1
+                 output : 'timesyncd.conf',
+                 configuration : substs)
+         install_data(timesyncd_conf,
+-                     install_dir : pkgsysconfdir)
++                     install_dir : factorypkgconfdir)
+         install_data('org.freedesktop.timesync1.conf',
+                      install_dir : dbuspolicydir)
+         install_data('org.freedesktop.timesync1.service',
+diff --git a/src/udev/meson.build b/src/udev/meson.build
+index 511fe428b9..32333efea6 100644
+--- a/src/udev/meson.build
++++ b/src/udev/meson.build
+@@ -186,7 +186,7 @@ foreach prog : [['ata_id/ata_id.c'],
+ endforeach
+ 
+ install_data('udev.conf',
+-             install_dir : join_paths(sysconfdir, 'udev'))
++             install_dir : join_paths(factoryconfdir, 'udev'))
+ 
+ configure_file(
+         input : 'udev.pc.in',
+@@ -195,7 +195,7 @@ configure_file(
+         install_dir : pkgconfigdatadir == 'no' ? '' : pkgconfigdatadir)
+ 
+ meson.add_install_script('sh', '-c',
+-                         mkdir_p.format(join_paths(sysconfdir, 'udev/rules.d')))
++                         mkdir_p.format(join_paths(factoryconfdir, 'udev/rules.d')))
+ 
+ fuzzers += [
+         [['src/udev/net/fuzz-link-parser.c',
+diff --git a/sysctl.d/meson.build b/sysctl.d/meson.build
+index 3f072e3db7..bd9f843eba 100644
+--- a/sysctl.d/meson.build
++++ b/sysctl.d/meson.build
+@@ -27,4 +27,4 @@ foreach file : in_files
+ endforeach
+ 
+ meson.add_install_script('sh', '-c',
+-                         mkdir_p.format(join_paths(sysconfdir, 'sysctl.d')))
++                         mkdir_p.format(join_paths(factoryconfdir, 'sysctl.d')))
+diff --git a/tmpfiles.d/meson.build b/tmpfiles.d/meson.build
+index e77f46d06b..04d2ef621d 100644
+--- a/tmpfiles.d/meson.build
++++ b/tmpfiles.d/meson.build
+@@ -57,5 +57,5 @@ endforeach
+ if enable_tmpfiles
+         meson.add_install_script(
+                 'sh', '-c',
+-                mkdir_p.format(join_paths(sysconfdir, 'tmpfiles.d')))
++                mkdir_p.format(join_paths(factoryconfdir, 'tmpfiles.d')))
+ endif
+diff --git a/units/meson.build b/units/meson.build
+index 476991edba..3d9dc6e1c8 100644
+--- a/units/meson.build
++++ b/units/meson.build
+@@ -308,7 +308,7 @@ install_data('user-.slice.d/10-defaults.conf',
+ 
+ meson.add_install_script(meson_make_symlink,
+                          join_paths(pkgsysconfdir, 'user'),
+-                         join_paths(sysconfdir, 'xdg/systemd/user'))
++                         join_paths(factorypkgconfdir, 'xdg/systemd/user'))
+ meson.add_install_script(meson_make_symlink,
+                          join_paths(dbussystemservicedir, 'org.freedesktop.systemd1.service'),
+                          join_paths(dbussessionservicedir, 'org.freedesktop.systemd1.service'))
+-- 
+2.24.1
+

pkgs/os-specific/linux/systemd/0019-inherit-systemd-environment-when-calling-generators.patch

@@ -0,0 +1,42 @@
+From 3eb1716dd80c245a2883da04156af79fb9097519 Mon Sep 17 00:00:00 2001
+From: Andreas Rammhold <andreas@rammhold.de>
+Date: Fri, 2 Nov 2018 21:15:42 +0100
+Subject: [PATCH 19/27] inherit systemd environment when calling generators.
+
+Systemd generators need access to the environment configured in
+stage-2-init.sh since it schedules fsck and mkfs executions based on
+being able to find an appropriate binary for the target filesystem.
+
+With this commit I am altering the systemd behaviour since upstream
+tries to gather environments with that they call
+"environment-generators" and then seems to pass that on to all the other
+executables that are being called from managers.
+---
+ src/core/manager.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/src/core/manager.c b/src/core/manager.c
+index d9114bb0c5..22c3b6ff76 100644
+--- a/src/core/manager.c
++++ b/src/core/manager.c
+@@ -3868,9 +3868,14 @@ static int manager_run_generators(Manager *m) {
+         argv[4] = NULL;
+ 
+         RUN_WITH_UMASK(0022)
+-                (void) execute_directories((const char* const*) paths, DEFAULT_TIMEOUT_USEC, NULL, NULL,
+-                                           (char**) argv, m->transient_environment, EXEC_DIR_PARALLEL | EXEC_DIR_IGNORE_ERRORS);
+-
++                (void) execute_directories((const char* const*) paths, DEFAULT_TIMEOUT_USEC,
++                                    // On NixOS we must propagate PATH to generators so they are
++                                    // able to find binaries such as `fsck.${fstype}` and
++                                    // `mkfs.${fstype}`. That is why the last argument of the
++                                    // function (envp) is set to NULL. This propagates systemd's
++                                    // environment (e.g. PATH) that was setup
++                                    // before calling systemd from stage-2-init.sh.
++                                    NULL, NULL, (char**) argv, /* NixOS: use inherited env */ NULL, EXEC_DIR_PARALLEL | EXEC_DIR_IGNORE_ERRORS);
+         r = 0;
+ 
+ finish:
+-- 
+2.24.1
+

pkgs/os-specific/linux/systemd/0021-add-rootprefix-to-lookup-dir-paths.patch

@@ -0,0 +1,38 @@
+From 8d1618a97ad08078815f409f03b45aff3ae6bd0a Mon Sep 17 00:00:00 2001
+From: Andreas Rammhold <andreas@rammhold.de>
+Date: Thu, 9 May 2019 11:15:22 +0200
+Subject: [PATCH 21/27] add rootprefix to lookup dir paths
+
+systemd does not longer use the UDEVLIBEXEC directory as root for
+discovery default udev rules. By adding `$out/lib` to the lookup paths
+we should again be able to discover the udev rules amongst other default
+files that I might have missed.
+---
+ src/basic/def.h | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/basic/def.h b/src/basic/def.h
+index 2af0b763f0..17959b07e8 100644
+--- a/src/basic/def.h
++++ b/src/basic/def.h
+@@ -39,13 +39,15 @@
+         "/run/" n "\0"                          \
+         "/usr/local/lib/" n "\0"                \
+         "/usr/lib/" n "\0"                      \
+-        _CONF_PATHS_SPLIT_USR_NULSTR(n)
++        _CONF_PATHS_SPLIT_USR_NULSTR(n)         \
++        ROOTPREFIX "/lib/" n "\0"
+ 
+ #define CONF_PATHS_USR(n)                       \
+         "/etc/" n,                              \
+         "/run/" n,                              \
+         "/usr/local/lib/" n,                    \
+-        "/usr/lib/" n
++        "/usr/lib/" n,                          \
++        ROOTPREFIX "/lib/" n
+ 
+ #define CONF_PATHS(n)                           \
+         CONF_PATHS_USR(n)                       \
+-- 
+2.24.1
+

pkgs/os-specific/linux/systemd/0022-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch

@@ -0,0 +1,27 @@
+From 859c16c52cdd61ec99d256bf5b35637d59e5dac9 Mon Sep 17 00:00:00 2001
+From: Nikolay Amiantov <ab@fmap.me>
+Date: Thu, 25 Jul 2019 20:45:55 +0300
+Subject: [PATCH 22/27] systemd-shutdown: execute scripts in
+ /etc/systemd/system-shutdown
+
+This is needed for NixOS to use such scripts as systemd directory is immutable.
+---
+ src/shutdown/shutdown.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
+index 0eb17989d0..93e619c58a 100644
+--- a/src/shutdown/shutdown.c
++++ b/src/shutdown/shutdown.c
+@@ -299,7 +299,7 @@ int main(int argc, char *argv[]) {
+         _cleanup_free_ char *cgroup = NULL;
+         char *arguments[3], *watchdog_device;
+         int cmd, r, umount_log_level = LOG_INFO;
+-        static const char* const dirs[] = {SYSTEM_SHUTDOWN_PATH, NULL};
++        static const char* const dirs[] = {SYSTEM_SHUTDOWN_PATH, "/etc/systemd/system-shutdown", NULL};
+ 
+         /* The log target defaults to console, but the original systemd process will pass its log target in through a
+          * command line argument, which will override this default. Also, ensure we'll never log to the journal or
+-- 
+2.24.1
+

pkgs/os-specific/linux/systemd/0023-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch

@@ -0,0 +1,26 @@
+From 9be689d5243d0c78bec7b285774c58749da08c9c Mon Sep 17 00:00:00 2001
+From: Nikolay Amiantov <ab@fmap.me>
+Date: Thu, 25 Jul 2019 20:46:58 +0300
+Subject: [PATCH 23/27] systemd-sleep: execute scripts in
+ /etc/systemd/system-sleep
+
+This is needed for NixOS to use such scripts as systemd directory is immutable.
+---
+ src/sleep/sleep.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
+index b9fe96635d..f1c3ca06a3 100644
+--- a/src/sleep/sleep.c
++++ b/src/sleep/sleep.c
+@@ -191,6 +191,7 @@ static int execute(char **modes, char **states) {
+         };
+         static const char* const dirs[] = {
+                 SYSTEM_SLEEP_PATH,
++                "/etc/systemd/system-sleep",
+                 NULL
+         };
+ 
+-- 
+2.24.1
+

pkgs/os-specific/linux/systemd/0024-kmod-static-nodes.service-Update-ConditionFileNotEmpty.patch

@@ -0,0 +1,27 @@
+From 7db89c2236158461c99fe5c5da7ddb7feab825cf Mon Sep 17 00:00:00 2001
+From: Florian Klink <flokli@flokli.de>
+Date: Sat, 7 Mar 2020 22:40:27 +0100
+Subject: [PATCH] kmod-static-nodes.service: Update ConditionFileNotEmpty
+
+On NixOS, kernel modules of the currently booted systems are located at
+/run/booted-system/kernel-modules/lib/modules/%v/, not /lib/modules/%v/.
+---
+ units/kmod-static-nodes.service.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/units/kmod-static-nodes.service.in b/units/kmod-static-nodes.service.in
+index 0971edf9ec..87105a87b9 100644
+--- a/units/kmod-static-nodes.service.in
++++ b/units/kmod-static-nodes.service.in
+@@ -12,7 +12,7 @@ Description=Create list of static device nodes for the current kernel
+ DefaultDependencies=no
+ Before=sysinit.target systemd-tmpfiles-setup-dev.service
+ ConditionCapability=CAP_SYS_MODULE
+-ConditionFileNotEmpty=/lib/modules/%v/modules.devname
++ConditionFileNotEmpty=/run/booted-system/kernel-modules/lib/modules/%v/modules.devname
+ 
+ [Service]
+ Type=oneshot
+-- 
+2.25.1
+

pkgs/os-specific/linux/systemd/0025-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch

@@ -0,0 +1,33 @@
+From 0939ac4be7ced099670979f26adf8a579173ce4b Mon Sep 17 00:00:00 2001
+From: Florian Klink <flokli@flokli.de>
+Date: Sun, 8 Mar 2020 01:05:54 +0100
+Subject: [PATCH] path-util.h: add placeholder for DEFAULT_PATH_NORMAL
+
+This will be the $PATH used to lookup ExecStart= etc. options, which
+systemd itself uses extensively.
+---
+ src/basic/path-util.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/basic/path-util.h b/src/basic/path-util.h
+index 111d85d445..cfd92aeb73 100644
+--- a/src/basic/path-util.h
++++ b/src/basic/path-util.h
+@@ -24,11 +24,11 @@
+ #  define PATH_SBIN_BIN_NULSTR(x) PATH_NORMAL_SBIN_BIN_NULSTR(x)
+ #endif
+ 
+-#define DEFAULT_PATH_NORMAL PATH_SBIN_BIN("/usr/local/") ":" PATH_SBIN_BIN("/usr/")
+-#define DEFAULT_PATH_NORMAL_NULSTR PATH_SBIN_BIN_NULSTR("/usr/local/") PATH_SBIN_BIN_NULSTR("/usr/")
++#define DEFAULT_PATH_NORMAL "@defaultPathNormal@"
++#define DEFAULT_PATH_NORMAL_NULSTR "@defaultPathNormal@\0"
+ #define DEFAULT_PATH_SPLIT_USR DEFAULT_PATH_NORMAL ":" PATH_SBIN_BIN("/")
+ #define DEFAULT_PATH_SPLIT_USR_NULSTR DEFAULT_PATH_NORMAL_NULSTR PATH_SBIN_BIN_NULSTR("/")
+-#define DEFAULT_PATH_COMPAT PATH_SPLIT_SBIN_BIN("/usr/local/") ":" PATH_SPLIT_SBIN_BIN("/usr/") ":" PATH_SPLIT_SBIN_BIN("/")
++#define DEFAULT_PATH_COMPAT DEFAULT_PATH_NORMAL
+ 
+ #if HAVE_SPLIT_USR
+ #  define DEFAULT_PATH DEFAULT_PATH_SPLIT_USR
+-- 
+2.25.1
+

pkgs/os-specific/linux/systemd/default.nix

@@ -7,6 +7,7 @@
 , gettext, docbook_xsl, docbook_xml_dtd_42, docbook_xml_dtd_45
 , ninja, meson, python3Packages, glibcLocales
 , patchelf
+, substituteAll
 , getent
 , buildPackages
 , perl
@@ -23,25 +24,50 @@ let gnupg-minimal = gnupg.override {
   pinentry = null;
   adns = null;
   gnutls = null;
-  libusb = null;
+  libusb1 = null;
   openldap = null;
   readline = null;
   zlib = null;
   bzip2 = null;
 };
 in stdenv.mkDerivation {
-  version = "243.7";
+  version = "245.3";
   pname = "systemd";
 
   # When updating, use https://github.com/systemd/systemd-stable tree, not the development one!
   # Also fresh patches should be cherry-picked from that tree to our current one.
   src = fetchFromGitHub {
-    owner = "nixos";
+    owner = "systemd";
-    repo = "systemd";
+    repo = "systemd-stable";
-    rev = "e7d881488292fc8bdf96acd12767eca1bd65adae";
+    rev = "0f5047b7d393cfba37f91e25cae559a0bc910582";
-    sha256 = "0haj3iff3y13pm4w5dbqj1drp5wryqfad58jbbmnb6zdgis56h8f";
+    sha256 = "0wyh14gbvvpgdmk1mjgpxr9i4pv1i9n7pnwpa0gvjh6hq948fyn2";
   };
 
+  patches = [
+    ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch
+    ./0003-Don-t-try-to-unmount-nix-or-nix-store.patch
+    ./0004-Fix-NixOS-containers.patch
+    ./0006-Look-for-fsck-in-the-right-place.patch
+    ./0007-Add-some-NixOS-specific-unit-directories.patch
+    ./0009-Get-rid-of-a-useless-message-in-user-sessions.patch
+    ./0010-hostnamed-localed-timedated-disable-methods-that-cha.patch
+    ./0011-Fix-hwdb-paths.patch
+    ./0012-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+    ./0013-localectl-use-etc-X11-xkb-for-list-x11.patch
+    ./0016-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+    ./0018-Install-default-configuration-into-out-share-factory.patch
+    ./0019-inherit-systemd-environment-when-calling-generators.patch
+    ./0021-add-rootprefix-to-lookup-dir-paths.patch
+    ./0022-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+    ./0023-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+    ./0024-kmod-static-nodes.service-Update-ConditionFileNotEmpty.patch
+    ./0025-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace src/basic/path-util.h --replace "@defaultPathNormal@" "${placeholder "out"}/bin/"
+  '';
+
   outputs = [ "out" "lib" "man" "dev" ];
 
   nativeBuildInputs =
@@ -83,8 +109,10 @@ in stdenv.mkDerivation {
     "-Dtests=false"
     "-Dimportd=true"
     "-Dlz4=true"
+    "-Dhomed=false"
     "-Dhostnamed=true"
     "-Dnetworkd=true"
+    "-Dportabled=false"
     "-Dsysusers=false"
     "-Dtimedated=true"
     "-Dtimesyncd=true"
@@ -195,6 +223,11 @@ in stdenv.mkDerivation {
 
   doCheck = false; # fails a bunch of tests
 
+  # trigger the test -n "$DESTDIR" || mutate in upstreams build system
+  preInstall = ''
+    export DESTDIR=/
+  '';
+
   postInstall = ''
     # sysinit.target: Don't depend on
     # systemd-tmpfiles-setup.service. This interferes with NixOps's
@@ -263,6 +296,6 @@ in stdenv.mkDerivation {
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
     priority = 10;
-    maintainers = with maintainers; [ andir eelco flokli mic92 ];
+    maintainers = with maintainers; [ andir eelco flokli ];
   };
 }