Merge remote-tracking branch 'origin/release-21.05' into staging-next-21.05

nixos/modules/services/misc/nix-daemon.nix

@@ -12,8 +12,6 @@ let
 
   isNix23 = versionAtLeast nixVersion "2.3pre";
 
-  isNix24 = versionAtLeast nixVersion "2.4pre";
-
   makeNixBuildUser = nr: {
     name  = "nixbld${toString nr}";
     value = {
@@ -43,11 +41,7 @@ let
         max-jobs = ${toString (cfg.maxJobs)}
         cores = ${toString (cfg.buildCores)}
         sandbox = ${if (builtins.isBool cfg.useSandbox) then boolToString cfg.useSandbox else cfg.useSandbox}
-        ${if isNix24 then ''
+        extra-sandbox-paths = ${toString cfg.sandboxPaths}
-          sandbox-paths = ${toString cfg.sandboxPaths}
-        '' else ''
-          extra-sandbox-paths = ${toString cfg.sandboxPaths}
-        ''}
         substituters = ${toString cfg.binaryCaches}
         trusted-substituters = ${toString cfg.trustedBinaryCaches}
         trusted-public-keys = ${toString cfg.binaryCachePublicKeys}

nixos/modules/tasks/filesystems.nix

@@ -321,6 +321,7 @@ in
             RemainAfterExit = true;
           };
           unitConfig = {
+            ConditionPathIsMountPoint = "!/sys/fs/pstore";
             ConditionVirtualization = "!container";
             DefaultDependencies = false; # needed to prevent a cycle
           };

pkgs/applications/editors/neovim/neovide/default.nix

@@ -66,7 +66,7 @@ rustPlatform.buildRustPackage rec {
 
   SKIA_OFFLINE_NINJA_COMMAND = "${ninja}/bin/ninja";
   SKIA_OFFLINE_GN_COMMAND = "${gn}/bin/gn";
-  LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
+  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
 
   # test needs a valid fontconfig file
   FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -440,10 +440,10 @@
     "owner": "DeterminateSystems",
     "provider-source-address": "registry.terraform.io/DeterminateSystems/hydra",
     "repo": "terraform-provider-hydra",
-    "rev": "v0.1.0",
+    "rev": "v0.1.1",
-    "sha256": "18c9j54fy1f2sfz317rlv8z7fb18bpc1a0baw1bgl72x5sgil5kv",
+    "sha256": "093al7crxgjimy4nnxvb1xy9p7yc0c7gf2rgvql7y3y3n8bz5q1b",
     "vendorSha256": null,
-    "version": "0.1.0"
+    "version": "0.1.1"
   },
   "ibm": {
     "owner": "IBM-Cloud",

pkgs/applications/networking/instant-messengers/signal-desktop/db-reencryption-wrapper.py

@@ -1,92 +0,0 @@
-#!@PYTHON@
-
-import json
-import os
-import re
-import shlex
-import sqlite3
-import subprocess
-import sys
-
-
-DB_PATH = os.path.join(os.environ['HOME'], '.config/Signal/sql/db.sqlite')
-DB_COPY = os.path.join(os.environ['HOME'], '.config/Signal/sql/db.tmp')
-CONFIG_PATH = os.path.join(os.environ['HOME'], '.config/Signal/config.json')
-
-
-def zenity_askyesno(title, text):
-    args = [
-        '@ZENITY@',
-        '--question',
-        '--title',
-        shlex.quote(title),
-        '--text',
-        shlex.quote(text)
-    ]
-    return subprocess.run(args).returncode == 0
-
-
-def start_signal():
-    os.execvp('@SIGNAL-DESKTOP@', ['@SIGNAL-DESKTOP@'] + sys.argv[1:])
-
-
-def copy_pragma(name):
-    result = subprocess.run([
-        '@SQLCIPHER@',
-        DB_PATH,
-        f"PRAGMA {name};"
-    ], check=True, capture_output=True).stdout
-    result = re.search(r'[0-9]+', result.decode()).group(0)
-    subprocess.run([
-        '@SQLCIPHER@',
-        DB_COPY,
-        f"PRAGMA key = \"x'{key}'\"; PRAGMA {name} = {result};"
-    ], check=True, capture_output=True)
-
-
-try:
-    # Test if DB is encrypted:
-    con = sqlite3.connect(f'file:{DB_PATH}?mode=ro', uri=True)
-    cursor = con.cursor()
-    cursor.execute("SELECT name FROM sqlite_master WHERE type='table';")
-    con.close()
-except:
-    # DB is encrypted, everything ok:
-    start_signal()
-
-
-# DB is unencrypted!
-answer = zenity_askyesno(
-        "Error: Signal-Desktop database is not encrypted",
-        "Should we try to fix this automatically?"
-        + "You likely want to backup ~/.config/Signal/ first."
-)
-if not answer:
-    answer = zenity_askyesno(
-            "Launch Signal-Desktop",
-            "DB is unencrypted, should we still launch Signal-Desktop?"
-            + "Warning: This could result in data loss!"
-    )
-    if not answer:
-        print('Aborted')
-        sys.exit(0)
-    start_signal()
-
-# Re-encrypt the DB:
-with open(CONFIG_PATH) as json_file:
-    key = json.load(json_file)['key']
-result = subprocess.run([
-    '@SQLCIPHER@',
-    DB_PATH,
-    f" ATTACH DATABASE '{DB_COPY}' AS signal_db KEY \"x'{key}'\";"
-    + " SELECT sqlcipher_export('signal_db');"
-    + " DETACH DATABASE signal_db;"
-]).returncode
-if result != 0:
-    print('DB encryption failed')
-    sys.exit(1)
-# Need to copy user_version and schema_version manually:
-copy_pragma('user_version')
-copy_pragma('schema_version')
-os.rename(DB_COPY, DB_PATH)
-start_signal()

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -10,9 +10,6 @@
 , hunspellDicts, spellcheckerLanguage ? null # E.g. "de_DE"
 # For a full list of available languages:
 # $ cat pkgs/development/libraries/hunspell/dictionaries.nix | grep "dictFileName =" | awk '{ print $3 }'
-, python3
-, gnome
-, sqlcipher
 }:
 
 let
@@ -115,7 +112,7 @@ in stdenv.mkDerivation rec {
 
     # Symlink to bin
     mkdir -p $out/bin
-    ln -s $out/lib/Signal/signal-desktop $out/bin/signal-desktop-unwrapped
+    ln -s $out/lib/Signal/signal-desktop $out/bin/signal-desktop
 
     runHook postInstall
   '';
@@ -140,16 +137,6 @@ in stdenv.mkDerivation rec {
     patchelf --add-needed ${libpulseaudio}/lib/libpulse.so $out/lib/Signal/resources/app.asar.unpacked/node_modules/ringrtc/build/linux/libringrtc.node
   '';
 
-  postFixup = ''
-    # This hack is temporarily required to avoid data-loss for users:
-    cp ${./db-reencryption-wrapper.py} $out/bin/signal-desktop
-    substituteInPlace $out/bin/signal-desktop \
-      --replace '@PYTHON@' '${python3}/bin/python3' \
-      --replace '@ZENITY@' '${gnome.zenity}/bin/zenity' \
-      --replace '@SQLCIPHER@' '${sqlcipher}/bin/sqlcipher' \
-      --replace '@SIGNAL-DESKTOP@' "$out/bin/signal-desktop-unwrapped"
-  '';
-
   # Tests if the application launches and waits for "Link your phone to Signal Desktop":
   passthru.tests.application-launch = nixosTests.signal-desktop;
 

pkgs/development/libraries/exempi/default.nix

@@ -11,12 +11,14 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--with-boost=${boost.dev}"
+  ] ++ lib.optionals (!doCheck) [
+    "--enable-unittest=no"
   ];
 
   buildInputs = [ expat zlib boost ]
     ++ lib.optionals stdenv.isDarwin [ libiconv darwin.apple_sdk.frameworks.CoreServices ];
 
-  doCheck = stdenv.isLinux;
+  doCheck = stdenv.isLinux && stdenv.is64bit;
 
   meta = with lib; {
     description = "An implementation of XMP (Adobe's Extensible Metadata Platform)";

pkgs/development/libraries/igraph/default.nix

@@ -96,6 +96,10 @@ stdenv.mkDerivation rec {
     cp -r doc "$out/share"
   '';
 
+  postFixup = lib.optionalString stdenv.isDarwin ''
+    install_name_tool -change libblas.dylib ${blas}/lib/libblas.dylib $out/lib/libigraph.dylib
+  '';
+
   meta = with lib; {
     description = "The network analysis package";
     homepage = "https://igraph.org/";

pkgs/development/libraries/qt-5/modules/qtwebengine.nix

@@ -134,7 +134,7 @@ qtModule {
   '';
 
   qmakeFlags = [ "--" "-system-ffmpeg" ]
-    ++ optional stdenv.isLinux "-webengine-webrtc-pipewire"
+    ++ optional (stdenv.isLinux && (lib.versionAtLeast qtCompatVersion "5.15")) "-webengine-webrtc-pipewire"
     ++ optional enableProprietaryCodecs "-proprietary-codecs";
 
   propagatedBuildInputs = [
@@ -168,6 +168,7 @@ qtModule {
     xorg.xrandr libXScrnSaver libXcursor libXrandr xorg.libpciaccess libXtst
     xorg.libXcomposite xorg.libXdamage libdrm
 
+  ] ++ optionals (stdenv.isLinux && (lib.versionAtLeast qtCompatVersion "5.15")) [
     # Pipewire
     pipewire_0_2
   ]

pkgs/development/libraries/science/math/arpack/default.nix

@@ -46,6 +46,10 @@ stdenv.mkDerivation rec {
     export OMP_NUM_THREADS=2
   '';
 
+  postFixup = lib.optionalString stdenv.isDarwin ''
+    install_name_tool -change libblas.dylib ${blas}/lib/libblas.dylib $out/lib/libarpack.dylib
+  '';
+
   meta = {
     homepage = "https://github.com/opencollab/arpack-ng";
     description = ''

pkgs/development/libraries/spdk/default.nix

@@ -13,31 +13,17 @@
 , openssl
 }:
 
-let
+stdenv.mkDerivation rec {
-  dpdk-compat-patch = fetchurl {
-    url = "https://review.spdk.io/gerrit/plugins/gitiles/spdk/spdk/+/6acb9a58755856fb9316baf9dbbb7239dc6b9446%5E%21/?format=TEXT";
-    sha256 = "18q0956fkjw19r29hp16x4pygkfv01alj9cld2wlqqyfgp41nhn0";
-  };
-in stdenv.mkDerivation rec {
   pname = "spdk";
-  version = "20.04.1";
+  version = "21.04";
 
   src = fetchFromGitHub {
     owner = "spdk";
     repo = "spdk";
     rev = "v${version}";
-    sha256 = "ApMyGamPrMalzZLbVkJlcwatiB8dOJmoxesdjkWZElk=";
+    sha256 = "sha256-Xmmgojgtt1HwTqG/1ZOJVo1BcdAH0sheu40d73OJ68w=";
   };
 
-  patches = [
-    ./spdk-dpdk-meson.patch
-    # https://review.spdk.io/gerrit/c/spdk/spdk/+/3134
-    (fetchpatch {
-      url = "https://github.com/spdk/spdk/commit/c954b5b722c5c163774d3598458ff726c48852ab.patch";
-      sha256 = "1n149hva5qxmpr0nmav10nya7zklafxi136f809clv8pag84g698";
-    })
-  ];
-
   nativeBuildInputs = [
     python3
   ];
@@ -48,12 +34,13 @@ in stdenv.mkDerivation rec {
 
   postPatch = ''
     patchShebangs .
-    base64 -d ${dpdk-compat-patch} | patch -p1
   '';
 
   configureFlags = [ "--with-dpdk=${dpdk}" ];
 
   NIX_CFLAGS_COMPILE = "-mssse3"; # Necessary to compile.
+  # otherwise does not find strncpy when compiling
+  NIX_LDFLAGS = "-lbsd";
 
   meta = with lib; {
     description = "Set of libraries for fast user-mode storage";

pkgs/development/tools/misc/ccls/default.nix

@@ -21,17 +21,11 @@ stdenv.mkDerivation rec {
     cmakeFlagsArray+=(-DCMAKE_CXX_FLAGS="-fvisibility=hidden -fno-rtti")
   '';
 
+  clang = llvmPackages.clang;
   shell = runtimeShell;
+
   postFixup = ''
-    # We need to tell ccls where to find the standard library headers.
+    export wrapped=".ccls-wrapped"
-
-    standard_library_includes="\\\"-isystem\\\", \\\"${lib.getDev stdenv.cc.libc}/include\\\""
-    standard_library_includes+=", \\\"-isystem\\\", \\\"${llvmPackages.libcxx}/include/c++/v1\\\""
-    export standard_library_includes
-
-    wrapped=".ccls-wrapped"
-    export wrapped
-
     mv $out/bin/ccls $out/bin/$wrapped
     substituteAll ${./wrapper} $out/bin/ccls
     chmod --reference=$out/bin/$wrapped $out/bin/ccls

pkgs/development/tools/misc/ccls/wrapper

@@ -1,12 +1,9 @@
 #! @shell@ -e
 
-initString="--init={\"clang\":{\"extraArgs\": [@standard_library_includes@"
+printf -v extraArgs ',\"%s\"' \
-
+  $(cat @clang@/nix-support/libc-cflags \
-if [ "${NIX_CFLAGS_COMPILE}" != "" ]; then
+        @clang@/nix-support/libcxx-cxxflags) \
-  read -a cflags_array <<< ${NIX_CFLAGS_COMPILE}
+  ${NIX_CFLAGS_COMPILE}
-  initString+=$(printf ', \"%s\"' "${cflags_array[@]}")
+initString="--init={\"clang\":{\"extraArgs\":[${extraArgs:1}]}}"
-fi
-
-initString+="]}}"
 
 exec -a "$0" "@out@/bin/@wrapped@" "${initString}" "$@"

pkgs/os-specific/linux/dpdk/default.nix

@@ -8,14 +8,14 @@
 
 let
   mod = kernel != null;
-
+  dpdkVersion = "21.02";
 in stdenv.mkDerivation rec {
-  name = "dpdk-${version}" + lib.optionalString mod "-${kernel.version}";
+  pname = "dpdk";
-  version = "20.05";
+  version = "${dpdkVersion}" + lib.optionalString mod "-${kernel.version}";
 
   src = fetchurl {
-    url = "https://fast.dpdk.org/rel/dpdk-${version}.tar.xz";
+    url = "https://fast.dpdk.org/rel/dpdk-${dpdkVersion}.tar.xz";
-    sha256 = "0h0xv2zwb91b9n29afg5ihn06a8q28in64hag2f112kc19f79jj8";
+    sha256 = "sha256-CZJKKoJVGqKZeKNoYYT4oQX1L1ZAsb4of1QLLJHpSJs==";
   };
 
   nativeBuildInputs = [
@@ -25,6 +25,7 @@ in stdenv.mkDerivation rec {
     pkg-config
     python3
     python3.pkgs.sphinx
+    python3.pkgs.pyelftools
   ];
   buildInputs = [
     jansson
@@ -42,9 +43,12 @@ in stdenv.mkDerivation rec {
   '';
 
   mesonFlags = [
+    "-Dtests=false"
     "-Denable_docs=true"
     "-Denable_kmods=${lib.boolToString mod}"
   ]
+  # kni kernel driver is currently not compatble with 5.11
+  ++ lib.optional (mod && kernel.kernelOlder "5.11") "-Ddisable_drivers=kni"
   ++ lib.optional (!shared) "-Ddefault_library=static"
   ++ lib.optional stdenv.isx86_64 "-Dmachine=nehalem"
   ++ lib.optional mod "-Dkernel_dir=${placeholder "kmod"}/lib/modules/${kernel.modDirVersion}";

pkgs/os-specific/linux/odp-dpdk/default.nix

@@ -1,21 +1,21 @@
 { lib, stdenv, fetchurl, autoreconfHook, pkg-config
-, dpdk, libconfig, libpcap, numactl, openssl, zlib, libbsd, libelf, jansson
+, dpdk, libbpf, libconfig, libpcap, numactl, openssl, zlib, libbsd, libelf, jansson
 }: let
-  dpdk_18_11 = dpdk.overrideAttrs (old: rec {
+  dpdk_19_11 = dpdk.overrideAttrs (old: rec {
-    version = "18.11.5";
+    version = "19.11";
     src = fetchurl {
       url = "https://fast.dpdk.org/rel/dpdk-${version}.tar.xz";
-      sha256 = "1n6nfaj7703l19jcw540lm8avni48hj9q1rq4mfp8b8gd4zjprj0";
+      sha256 = "sha256-RnEzlohDZ3uxwna7dKNFiqfAAswh4pXFHjvWVJexEqs=";
     };
   });
 
 in stdenv.mkDerivation rec {
   pname = "odp-dpdk";
-  version = "1.22.0.0_DPDK_18.11";
+  version = "1.27.0.0_DPDK_19.11";
 
   src = fetchurl {
     url = "https://git.linaro.org/lng/odp-dpdk.git/snapshot/${pname}-${version}.tar.gz";
-    sha256 = "1m8xhmfjqlj2gkkigq5ka3yh0xgzrcpfpaxp1pnh8d1g99094vbx";
+    sha256 = "sha256-/4m2NqnEXyenNUrCq3c2ozJzPWFFs/Qp7MAVm9B2biA=";
   };
 
   nativeBuildInputs = [
@@ -23,7 +23,7 @@ in stdenv.mkDerivation rec {
     pkg-config
   ];
   buildInputs = [
-    dpdk_18_11
+    dpdk_19_11
     libconfig
     libpcap
     numactl
@@ -32,19 +32,9 @@ in stdenv.mkDerivation rec {
     libbsd
     libelf
     jansson
+    libbpf
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=address-of-packed-member" ];
-
-  # for some reason, /build/odp-dpdk-1.22.0.0_DPDK_18.11/lib/.libs ends up in all binaries,
-  # while it should be $out/lib instead.
-  # prepend rpath with the proper location, the /build will get removed during rpath shrinking
-  preFixup = ''
-    for prog in $out/bin/*; do
-      patchelf --set-rpath $out/lib:`patchelf --print-rpath $prog` $prog
-    done
-  '';
-
   # binaries will segfault otherwise
   dontStrip = true;
 

pkgs/os-specific/linux/pktgen/configure.patch

@@ -1,17 +0,0 @@
-1. librte_process_info does not exist.
-2. lua5.3 library is liblua.
-3. app/meson.build uses undeclared drivers_install_subdir.
---- a/lib/common/meson.build
-+++ b/lib/common/meson.build
-@@ -34,1 +34,1 @@
--libs = ['eal', 'kvargs', 'cmdline', 'process_info']
-+libs = ['eal', 'kvargs', 'cmdline']
---- a/lib/lua/meson.build
-+++ b/lib/lua/meson.build
-@@ -31 +31 @@ endforeach
--ext_deps += cc.find_library('lua5.3', required: true)
-+ext_deps += cc.find_library('lua', required: true)
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -0,0 +1,1 @@
-+option('drivers_install_subdir', type: 'string', value: '')

pkgs/os-specific/linux/pktgen/default.nix

@@ -1,29 +1,33 @@
-{ stdenv, lib, fetchurl, meson, ninja, pkg-config
+{ stdenv, lib, fetchFromGitHub, meson, ninja, pkg-config
 , dpdk, libbsd, libpcap, lua5_3, numactl, util-linux
 , gtk2, which, withGtk ? false
 }:
 
 stdenv.mkDerivation rec {
   pname = "pktgen";
-  version = "19.12.0";
+  version = "21.05.0";
 
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "http://dpdk.org/browse/apps/pktgen-dpdk/snapshot/${pname}-${version}.tar.xz";
+    owner = "pktgen";
-    sha256 = "1clfviz1qa4hysslcg6i29vsxwl9f6j1y7zf9wwx9br3yq08x956";
+    repo = "Pktgen-DPDK";
+    rev = "pktgen-${version}";
+    sha256 = "sha256-7lLDtbd14olEHO+1BuI6KTEUNRM/zAyRXau/OZbYbGA=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config ];
 
-  buildInputs =
+  buildInputs = [
-    [ dpdk libbsd libpcap lua5_3 numactl which ]
+    dpdk libbsd libpcap lua5_3 numactl which
-    ++ lib.optionals withGtk [gtk2];
+  ] ++ lib.optionals withGtk [
+    gtk2
+  ];
 
   RTE_SDK = dpdk;
   GUI = lib.optionalString withGtk "true";
 
   NIX_CFLAGS_COMPILE = "-msse3";
-
+  # requires symbols from this file
-  patches = [ ./configure.patch ];
+  NIX_LDFLAGS = "-lrte_net_bond";
 
   postPatch = ''
     substituteInPlace lib/common/lscpu.h --replace /usr/bin/lscpu ${util-linux}/bin/lscpu

pkgs/servers/nosql/redis/default.nix

@@ -5,20 +5,22 @@
 
 stdenv.mkDerivation rec {
   pname = "redis";
-  version = "6.2.1";
+  version = "6.2.3";
 
   src = fetchurl {
     url = "https://download.redis.io/releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-zSIlBQEsziCyVoL8qTHsk70hrpLLSr/nQs97dqqQdSA=";
+    sha256 = "sha256-mO19UytelnH13wglu3Hw83SDoWVGNkBJOExj24dkUSs=";
   };
 
   # Cross-compiling fixes
   configurePhase = ''
+    runHook preConfigure
     ${lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
       # This fixes hiredis, which has the AR awkwardly coded.
       # Probably a good candidate for a patch upstream.
       makeFlagsArray+=('STLIB_MAKE_CMD=${stdenv.cc.targetPrefix}ar rcs $(STLIBNAME)')
     ''}
+    runHook postConfigure
   '';
 
   nativeBuildInputs = [ pkg-config ];

pkgs/top-level/php-packages.nix

@@ -235,7 +235,7 @@ lib.makeScope pkgs.newScope (self: with self; {
           (dep: "mkdir -p ext; ln -s ${dep.dev}/include ext/${dep.extensionName}")
           internalDeps}
       '';
-      checkPhase = "echo n | make test";
+      checkPhase = "runHook preCheck; echo n | make test; runHook postCheck";
       outputs = [ "out" "dev" ];
       installPhase = ''
         mkdir -p $out/lib/php/extensions
@@ -270,6 +270,20 @@ lib.makeScope pkgs.newScope (self: with self; {
       { name = "dba"; }
       { name = "dom";
         buildInputs = [ libxml2 ];
+        patches = [
+          # https://github.com/php/php-src/pull/7030
+          (fetchpatch {
+            url = "https://github.com/php/php-src/commit/4cc261aa6afca2190b1b74de39c3caa462ec6f0b.patch";
+            sha256 = "11qsdiwj1zmpfc2pgh6nr0sn7qa1nyjg4jwf69cgwnd57qfjcy4k";
+            excludes = [ "ext/dom/tests/bug43364.phpt" "ext/dom/tests/bug80268.phpt" ];
+          })
+        ];
+        # For some reason `patch` fails to remove these files correctly.
+        # Since `postPatch` is already used in `mkExtension`, we have to make it here.
+        preCheck = ''
+          rm tests/bug43364.phpt
+          rm tests/bug80268.phpt
+        '';
         configureFlags = [ "--enable-dom" ]
           # Required to build on darwin.
           ++ lib.optionals (lib.versionOlder php.version "7.4") [ "--with-libxml-dir=${libxml2.dev}" ]; }
@@ -322,10 +336,16 @@ lib.makeScope pkgs.newScope (self: with self; {
         configureFlags = [ "--with-gmp=${gmp.dev}" ]; }
       { name = "hash"; enable = lib.versionOlder php.version "7.4"; }
       { name = "iconv";
-        configureFlags = if stdenv.isDarwin then
+        configureFlags = [
-                           [ "--with-iconv=${libiconv}" ]
+          "--with-iconv${lib.optionalString stdenv.isDarwin "=${libiconv}"}"
-                         else
+        ];
-                           [ "--with-iconv" ];
+        patches = lib.optionals (lib.versionOlder php.version "8.0") [
+          # Header path defaults to FHS location, preventing the configure script from detecting errno support.
+          (fetchpatch {
+            url = "https://github.com/fossar/nix-phps/raw/263861a8c9bdafd7abe44db6db4ef0179643680c/pkgs/iconv-header-path.patch";
+            sha256 = "7GHnEUu+hcsQ4h3itDwk6p46ZKfib9JZ2XpWlXrdn6E=";
+          })
+        ];
         doCheck = false; }
       { name = "imap";
         buildInputs = [ uwimap openssl pam pcre' ];