From 83f0bccc89b6cd6de576609bb49abcb3f507d58e Mon Sep 17 00:00:00 2001
From: Andreas Rammhold <andreas@rammhold.de>
Date: Sat, 31 Oct 2020 17:29:54 +0100
Subject: [PATCH 01/67] stdenv: add -frandom-seed to NIX_CFLAGS_COMPILE for
 reproducibility

This adds -frandom-seed to each compiler invocation in stdenv. The
object here is to make the compierl invocations produce the same output
every time they are called (for the same derivation). When the
-frandom-seed option is not set the compiler will use a combination of
random numbers (in GCC's case from /dev/urandom) and the durrent time to
produce a "random" input per file. This can (among other things) lead to
different ordering of symbols in the produced object files.

For reason of reproducibility we prefer having the same derivation
produce the exact same outputs. This is not a silver bullet but one way
to tame the compiler.
---
 pkgs/build-support/setup-hooks/reproducible-builds.sh | 4 ++++
 pkgs/stdenv/generic/default.nix                       | 1 +
 2 files changed, 5 insertions(+)
 create mode 100644 pkgs/build-support/setup-hooks/reproducible-builds.sh

diff --git a/pkgs/build-support/setup-hooks/reproducible-builds.sh b/pkgs/build-support/setup-hooks/reproducible-builds.sh
new file mode 100644
index 00000000000..2d8db6ff7d3
--- /dev/null
+++ b/pkgs/build-support/setup-hooks/reproducible-builds.sh
@@ -0,0 +1,4 @@
+# Use the last part of the out path as hash input for the build.
+# This should ensure that it is deterministic across rebuilds of the same
+# derivation and not easily collide with other builds.
+export NIX_CFLAGS_COMPILE+=" -frandom-seed=${out##*/}"
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index eeddb584a3d..c7c3bb9f3f3 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -70,6 +70,7 @@ let
       ../../build-support/setup-hooks/move-sbin.sh
       ../../build-support/setup-hooks/move-lib64.sh
       ../../build-support/setup-hooks/set-source-date-epoch-to-latest.sh
+      ../../build-support/setup-hooks/reproducible-builds.sh
       # TODO use lib.optional instead
       (if hasCC then cc else null)
     ];

From 976062ebd6728d63509e007245de97325dd5b19c Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Tue, 10 Nov 2020 15:10:27 -0800
Subject: [PATCH 02/67] python39Packages: recurseintoAttrs for package set

---
 pkgs/top-level/all-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f7a03558920..78b48577d15 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10450,7 +10450,7 @@ in
   python36Packages = python36.pkgs;
   python37Packages = recurseIntoAttrs python37.pkgs;
   python38Packages = recurseIntoAttrs python38.pkgs;
-  python39Packages = python39.pkgs;
+  python39Packages = recurseIntoAttrs python39.pkgs;
   python310Packages = python310.pkgs;
   pypyPackages = pypy.pkgs;
   pypy2Packages = pypy2.pkgs;

From a7871cb54ce021e415d71508b2996de6b293f683 Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Tue, 10 Nov 2020 15:29:48 -0800
Subject: [PATCH 03/67] python39Packages.tensorflow_1-bin: fix disable logic

---
 pkgs/development/python-modules/tensorflow/1/bin.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/tensorflow/1/bin.nix b/pkgs/development/python-modules/tensorflow/1/bin.nix
index 9bd2bc78437..5c93e957f7c 100644
--- a/pkgs/development/python-modules/tensorflow/1/bin.nix
+++ b/pkgs/development/python-modules/tensorflow/1/bin.nix
@@ -2,7 +2,7 @@
 , lib
 , fetchurl
 , buildPythonPackage
-, isPy3k, pythonOlder, isPy38
+, isPy3k, pythonOlder, pythonAtLeast
 , astor
 , gast
 , google-pasta
@@ -50,8 +50,7 @@ in buildPythonPackage {
   inherit pname;
   inherit (packages) version;
   format = "wheel";
-
-  disabled = isPy38;
+  disabled = pythonAtLeast "3.8";
 
   src = let
     pyVerNoDot = lib.strings.stringAsChars (x: if x == "." then "" else x) python.pythonVersion;

From b61df8cd970c8d2c0a4c63df1f5dcedbc9267d55 Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Tue, 10 Nov 2020 17:53:48 -0800
Subject: [PATCH 04/67] python39Packages.tensorflow_2-bin: fix disable logic

---
 pkgs/development/python-modules/tensorflow/2/bin.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tensorflow/2/bin.nix b/pkgs/development/python-modules/tensorflow/2/bin.nix
index acb5f473ec9..8dd282666a7 100644
--- a/pkgs/development/python-modules/tensorflow/2/bin.nix
+++ b/pkgs/development/python-modules/tensorflow/2/bin.nix
@@ -2,7 +2,7 @@
 , lib
 , fetchurl
 , buildPythonPackage
-, isPy3k, pythonOlder, isPy38
+, isPy3k, pythonOlder, pythonAtLeast, isPy38
 , astor
 , gast
 , google-pasta
@@ -54,7 +54,7 @@ in buildPythonPackage {
   inherit (packages) version;
   format = "wheel";
 
-  disabled = isPy38;
+  disabled = pythonAtLeast "3.8";
 
   src = let
     pyVerNoDot = lib.strings.stringAsChars (x: if x == "." then "" else x) python.pythonVersion;

From fbda64845f808768d9781c480a80af5c9f42470f Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Tue, 10 Nov 2020 18:21:15 -0800
Subject: [PATCH 05/67] python39Packages.pyflakes: disable python39 tests

Sensitive to exact parser output
---
 pkgs/development/python-modules/pyflakes/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pyflakes/default.nix b/pkgs/development/python-modules/pyflakes/default.nix
index d8cc4511948..04bc56df12d 100644
--- a/pkgs/development/python-modules/pyflakes/default.nix
+++ b/pkgs/development/python-modules/pyflakes/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, unittest2 }:
+{ stdenv, buildPythonPackage, fetchPypi, pythonOlder, unittest2 }:
 
 buildPythonPackage rec {
   pname = "pyflakes";
@@ -11,6 +11,9 @@ buildPythonPackage rec {
 
   checkInputs = [ unittest2 ];
 
+  # some tests are output dependent, which have changed slightly
+  doCheck = pythonOlder "3.9";
+
   meta = with stdenv.lib; {
     homepage = "https://launchpad.net/pyflakes";
     description = "A simple program which checks Python source files for errors";

From bfaa9af4164336b1fbc11f4ca49332ddd19d3405 Mon Sep 17 00:00:00 2001
From: TredwellGit <tredwell@tutanota.com>
Date: Fri, 13 Nov 2020 12:53:54 +0000
Subject: [PATCH 06/67] linuxHeaders: 5.5 -> 5.9.8

---
 pkgs/os-specific/linux/kernel-headers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index 59656f54db2..284ef472d04 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -69,12 +69,12 @@ let
 in {
   inherit makeLinuxHeaders;
 
-  linuxHeaders = let version = "5.5"; in
+  linuxHeaders = let version = "5.9.8"; in
     makeLinuxHeaders {
       inherit version;
       src = fetchurl {
         url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-        sha256 = "0c131fi6s7vgvka1c0597vnvcmwn1pp968rci5kq64iwj3pd9yx6";
+        sha256 = "19l67gzk97higd2cbggipcb0wi21pv0ag0mc4qh6cqk564xp6mkn";
       };
       patches = [
          ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms

From 1538cd4b2f03e59e83d88e4a71e993782f0ecbb2 Mon Sep 17 00:00:00 2001
From: Arnout Engelen <arnout@bzzt.net>
Date: Mon, 16 Nov 2020 10:20:41 +0100
Subject: [PATCH 07/67] Revert "python3Packages.pytest-testmon: 1.0.2 -> 1.0.3"

This reverts commit 0fc5e60fd2510bea25434eadf7e986208632c29c.

For some reason the v1.0.3 PyPI tarball ships with tests that expect pytest-testmon master instead of the v1.0.3 code (tarpas/pytest-testmon#158), causing these tests to fail against 1.0.3 itself.
---
 pkgs/development/python-modules/pytest-testmon/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-testmon/default.nix b/pkgs/development/python-modules/pytest-testmon/default.nix
index b86947f5f75..9d9add16782 100644
--- a/pkgs/development/python-modules/pytest-testmon/default.nix
+++ b/pkgs/development/python-modules/pytest-testmon/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-testmon";
-  version = "1.0.3";
+  version = "1.0.2";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "927a73dd510b90a2e4a48ea4d37e82c4490b56caa745663262024ea0cd278169";
+    sha256 = "fdb016d953036051d1ef0e36569b7168cefa4914014789a65a4ffefc87f85ac5";
   };
 
   propagatedBuildInputs = [ coverage ];

From 944a6ae388bd97aa1d5f27c9603a4effaa2567b9 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Wed, 18 Nov 2020 06:42:49 +0000
Subject: [PATCH 08/67] glib: 2.66.2 -> 2.66.3

---
 pkgs/development/libraries/glib/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index de874a798b2..51ee2edb635 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -45,11 +45,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "glib";
-  version = "2.66.2";
+  version = "2.66.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1i0pd8y6xz64qlzfj73wxyqp0x7x9j6mwf4gj6ggil4d9vnhnfgc";
+    sha256 = "1cdmyyycw2mf5s0f5sfd59q91223s4smcqi8n2fwrccwm5ji7wvr";
   };
 
   patches = optionals stdenv.isDarwin [

From d22b3ed4bcd24dcc96fd9f99c75bb568bffe2a8c Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Tue, 17 Nov 2020 21:54:26 +0100
Subject: [PATCH 09/67] systemd: switch to unified cgroup hierarchy by default
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

See https://www.redhat.com/sysadmin/fedora-31-control-group-v2 for
details on why this is desirable, and how it impacts containers.

Users that need to keep using the old cgroup hierarchy can re-enable it
by setting `systemd.unifiedCgroupHierarchy` to `false`.

Well-known candidates not supporting that hierarchy, like docker and
hidepid=… will disable it automatically.

Fixes #73800
---
 nixos/doc/manual/release-notes/rl-2103.xml | 13 +++++++++++++
 nixos/modules/security/hidepid.nix         |  4 ++++
 nixos/modules/system/boot/systemd.nix      |  9 +++++++++
 nixos/modules/virtualisation/docker.nix    |  3 +++
 pkgs/os-specific/linux/systemd/default.nix |  6 +++---
 5 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2103.xml b/nixos/doc/manual/release-notes/rl-2103.xml
index 5c017c65a25..8aaa9094a7a 100644
--- a/nixos/doc/manual/release-notes/rl-2103.xml
+++ b/nixos/doc/manual/release-notes/rl-2103.xml
@@ -264,6 +264,19 @@
      <literal>unbound-control</literal> without passing a custom configuration location.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     NixOS now defaults to the unified cgroup hierarchy (cgroupsv2).
+     See the <link xlink:href="https://www.redhat.com/sysadmin/fedora-31-control-group-v2">Fedora Article for 31</link>
+     for details on why this is desirable, and how it impacts containers.
+    </para>
+    <para>
+     If you want to run containers with a runtime that does not yet support cgroupsv2,
+     you can switch back to the old behaviour by setting
+     <xref linkend="opt-systemd.enableUnifiedCgroupHierarchy"/> = <literal>false</literal>;
+     and rebooting.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 </section>
diff --git a/nixos/modules/security/hidepid.nix b/nixos/modules/security/hidepid.nix
index 55a48ea3c9c..4953f517e93 100644
--- a/nixos/modules/security/hidepid.nix
+++ b/nixos/modules/security/hidepid.nix
@@ -23,5 +23,9 @@ with lib;
 
     boot.specialFileSystems."/proc".options = [ "hidepid=2" "gid=${toString config.ids.gids.proc}" ];
     systemd.services.systemd-logind.serviceConfig.SupplementaryGroups = [ "proc" ];
+
+    # Disable cgroupsv2, which doesn't work with hidepid.
+    # https://github.com/NixOS/nixpkgs/pull/104094#issuecomment-729996203
+    systemd.enableUnifiedCgroupHierarchy = false;
   };
 }
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index c22264b3e92..cbf9e7b49d3 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -550,6 +550,14 @@ in
       '';
     };
 
+    systemd.enableUnifiedCgroupHierarchy = mkOption {
+      default = true;
+      type = types.bool;
+      description = ''
+        Whether to enable the unified cgroup hierarchy (cgroupsv2).
+      '';
+    };
+
     systemd.coredump.enable = mkOption {
       default = true;
       type = types.bool;
@@ -1178,6 +1186,7 @@ in
     boot.kernel.sysctl = mkIf (!cfg.coredump.enable) {
       "kernel.core_pattern" = "core";
     };
+    boot.kernelParams = optional (!cfg.enableUnifiedCgroupHierarchy) "systemd.unified_cgroup_hierarchy=0";
   };
 
   # FIXME: Remove these eventually.
diff --git a/nixos/modules/virtualisation/docker.nix b/nixos/modules/virtualisation/docker.nix
index d87ada35a0a..ec257801b33 100644
--- a/nixos/modules/virtualisation/docker.nix
+++ b/nixos/modules/virtualisation/docker.nix
@@ -155,6 +155,9 @@ in
       users.groups.docker.gid = config.ids.gids.docker;
       systemd.packages = [ cfg.package ];
 
+      # TODO: remove once docker 20.10 is released
+      systemd.enableUnifiedCgroupHierarchy = false;
+
       systemd.services.docker = {
         wantedBy = optional cfg.enableOnBoot "multi-user.target";
         environment = proxy_env;
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 85c78ce1421..084ac1da9af 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -281,9 +281,9 @@ stdenv.mkDerivation {
     "-Dmount-path=${utillinux}/bin/mount"
     "-Dumount-path=${utillinux}/bin/umount"
     "-Dcreate-log-dirs=false"
-    # Upstream uses cgroupsv2 by default. To support docker and other
-    # container managers we still need v1.
-    "-Ddefault-hierarchy=hybrid"
+
+    # Use cgroupsv2. This is already the upstream default, but better be explicit.
+    "-Ddefault-hierarchy=unified"
     # Upstream defaulted to disable manpages since they optimize for the much
     # more frequent development builds
     "-Dman=true"

From 5d45f269aac3a89550c39ee90bbcf70c711b84dd Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Thu, 19 Nov 2020 00:36:04 +0100
Subject: [PATCH 10/67] nixos/k3s: disable unifiedCgroupHierarchy

This gets automatically disabled by docker if the docker backend is
used, but the bundled containerd also doesn't seem to support cgroupsv2,
so disable it explicitly here, too.
---
 nixos/modules/services/cluster/k3s/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/nixos/modules/services/cluster/k3s/default.nix b/nixos/modules/services/cluster/k3s/default.nix
index 2e8bf20a68f..f0317fdbd16 100644
--- a/nixos/modules/services/cluster/k3s/default.nix
+++ b/nixos/modules/services/cluster/k3s/default.nix
@@ -76,6 +76,10 @@ in
       enable = mkDefault true;
     };
 
+    # TODO: disable this once k3s supports cgroupsv2, either by docker
+    # supporting it, or their bundled containerd
+    systemd.enableUnifiedCgroupHierarchy = false;
+
     systemd.services.k3s = {
       description = "k3s service";
       after = mkIf cfg.docker [ "docker.service" ];

From f6832971f5111039e365d70048fe55b3a291cfe5 Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Thu, 19 Nov 2020 01:59:07 +0100
Subject: [PATCH 11/67] nixosTests.systemd: increase accounting coverage

For now, testing IO Accounting is skipped, as it seems to be either
broken, or hard to reproduce in a VM.
---
 nixos/tests/systemd.nix | 35 ++++++++++++++++++++++++-----------
 1 file changed, 24 insertions(+), 11 deletions(-)

diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix
index dfa16eecfad..390a1bd30f9 100644
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -82,6 +82,10 @@ import ./make-test-python.nix ({ pkgs, ... }: {
             "systemd-run --pty --property=Type=oneshot --property=DynamicUser=yes --property=User=iamatest whoami"
         )
 
+    with subtest("regression test for https://bugs.freedesktop.org/show_bug.cgi?id=77507"):
+        retcode, output = machine.execute("systemctl status testservice1.service")
+        assert retcode in [0, 3]  # https://bugs.freedesktop.org/show_bug.cgi?id=77507
+
     # Regression test for https://github.com/NixOS/nixpkgs/issues/35268
     with subtest("file system with x-initrd.mount is not unmounted"):
         machine.succeed("mountpoint -q /test-x-initrd-mount")
@@ -122,17 +126,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         machine.wait_for_unit("multi-user.target")
         assert "fq_codel" in machine.succeed("sysctl net.core.default_qdisc")
 
-    # Test cgroup accounting is enabled
-    with subtest("systemd cgroup accounting is enabled"):
-        machine.wait_for_unit("multi-user.target")
-        assert "yes" in machine.succeed(
-            "systemctl show testservice1.service -p IOAccounting"
-        )
-
-        retcode, output = machine.execute("systemctl status testservice1.service")
-        assert retcode in [0, 3]  # https://bugs.freedesktop.org/show_bug.cgi?id=77507
-        assert "CPU:" in output
-
     # Test systemd is configured to manage a watchdog
     with subtest("systemd manages hardware watchdog"):
         machine.wait_for_unit("multi-user.target")
@@ -168,5 +161,25 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         machine.succeed("systemctl status systemd-cryptsetup@luks1.service")
         machine.succeed("mkdir -p /tmp/luks1")
         machine.succeed("mount /dev/mapper/luks1 /tmp/luks1")
+
+    # Do some IP traffic
+    output_ping = machine.succeed(
+        "systemd-run --wait -- /run/wrappers/bin/ping -c 1 127.0.0.1 2>&1"
+    )
+
+    with subtest("systemd reports accounting data on system.slice"):
+        output = machine.succeed("systemctl status system.slice")
+        assert "CPU:" in output
+        assert "Memory:" in output
+
+        assert "IP:" in output
+        assert "0B in, 0B out" not in output
+
+        assert "IO:" in output
+        assert "0B read, 0B written" not in output
+
+    with subtest("systemd per-unit accounting works"):
+        assert "IP traffic received: 84B" in output_ping
+        assert "IP traffic sent: 84B" in output_ping
   '';
 })

From 8fec3bf643875d3023486faacfd86afbc1d676bc Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Wed, 18 Nov 2020 21:36:40 +0000
Subject: [PATCH 12/67] libsecret: 0.20.3 -> 0.20.4

---
 pkgs/development/libraries/libsecret/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libsecret/default.nix b/pkgs/development/libraries/libsecret/default.nix
index 010a74eab3c..d614ab01297 100644
--- a/pkgs/development/libraries/libsecret/default.nix
+++ b/pkgs/development/libraries/libsecret/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libsecret";
-  version = "0.20.3";
+  version = "0.20.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1r4habxdzmn02id324m0m4mg5isf22q1z436bg3vjjmcz1b3rjsg";
+    sha256 = "0a4xnfmraxchd9cq5ai66j12jv2vrgjmaaxz25kl031jvda4qnij";
   };
 
   postPatch = ''

From 71d2840883c229ebf1244374dbde9444bb2ad470 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Tue, 17 Nov 2020 23:20:00 -0500
Subject: [PATCH 13/67] postgresql_9_5: 9.5.23 -> 9.5.24

Release notes: https://www.postgresql.org/docs/9.5/release-9-5-24.html
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 31c60303c03..145992d1ecd 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -184,9 +184,9 @@ let
 in self: {
 
   postgresql_9_5 = self.callPackage generic {
-    version = "9.5.23";
+    version = "9.5.24";
     psqlSchema = "9.5";
-    sha256 = "0rl31jc3kg2wq6hazyd297gnmx3cibjvivllbsivii2m6dzgl573";
+    sha256 = "0an2k4m1da96897hyxlff8p4p63wg4dffwsfg57aib7mp4yzsp06";
     this = self.postgresql_9_5;
     inherit self;
   };

From efa0efa10bbae1347a7c93d1f63d67555ca73852 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Tue, 17 Nov 2020 23:20:00 -0500
Subject: [PATCH 14/67] postgresql_9_6: 9.6.19 -> 9.6.20

Release notes: https://www.postgresql.org/docs/9.6/release-9-6-20.html
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 145992d1ecd..496a2c371dd 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -192,9 +192,9 @@ in self: {
   };
 
   postgresql_9_6 = self.callPackage generic {
-    version = "9.6.19";
+    version = "9.6.20";
     psqlSchema = "9.6";
-    sha256 = "1c2wnl5bbpjs1s1rpzvlnzsqlpb0p823zw7s38nhpgnxrja3myb1";
+    sha256 = "1dkv916y7vrfbygrfbfvs6y3fxaysnh32i5j88nvcnnl16jcn21x";
     this = self.postgresql_9_6;
     inherit self;
   };

From 3bfbaf72faff79900ccbf0e0d75cac1973a58dbb Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Tue, 17 Nov 2020 23:20:00 -0500
Subject: [PATCH 15/67] postgresql_10: 10.14 -> 10.15

Release notes: https://www.postgresql.org/docs/10/release-10-15.html
---
 pkgs/servers/sql/postgresql/default.nix       |   5 +-
 .../patches/stabilize-timetz-dst.patch        | 117 ------------------
 2 files changed, 2 insertions(+), 120 deletions(-)
 delete mode 100644 pkgs/servers/sql/postgresql/patches/stabilize-timetz-dst.patch

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 496a2c371dd..95df2b02c0b 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -65,7 +65,6 @@ let
         ./patches/specify_pkglibdir_at_runtime.patch
         ./patches/findstring.patch
       ]
-      ++ lib.optional (atLeast "10") ./patches/stabilize-timetz-dst.patch
       ++ lib.optional stdenv.isLinux (if atLeast "13" then ./patches/socketdir-in-run-13.patch else ./patches/socketdir-in-run.patch);
 
     installTargets = [ "install-world" ];
@@ -200,9 +199,9 @@ in self: {
   };
 
   postgresql_10 = self.callPackage generic {
-    version = "10.14";
+    version = "10.15";
     psqlSchema = "10.0"; # should be 10, but changing it is invasive
-    sha256 = "0fxj30jvwq5pqpbj97vhlxgmn2ah59a78s9jyjr7vxyqj7sdh71q";
+    sha256 = "0zhzj9skag1pgqas2rnd217vj41ilaalqna17j47gyngpvhbqmjr";
     this = self.postgresql_10;
     inherit self;
   };
diff --git a/pkgs/servers/sql/postgresql/patches/stabilize-timetz-dst.patch b/pkgs/servers/sql/postgresql/patches/stabilize-timetz-dst.patch
deleted file mode 100644
index b6c633cb73e..00000000000
--- a/pkgs/servers/sql/postgresql/patches/stabilize-timetz-dst.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-From 4a071afbd056282746a5bc9362e87f579a56402d Mon Sep 17 00:00:00 2001
-From: Tom Lane <tgl@sss.pgh.pa.us>
-Date: Thu, 29 Oct 2020 15:28:14 -0400
-Subject: [PATCH 1/1] Stabilize timetz test across DST transitions.
-
-The timetz test cases I added in commit a9632830b were unintentionally
-sensitive to whether or not DST is active in the PST8PDT time zone.
-Thus, they'll start failing this coming weekend, as reported by
-Bernhard M. Wiedemann in bug #16689.  Fortunately, DST-awareness is
-not significant to the purpose of these test cases, so we can just
-force them all to PDT (DST hours) to preserve stability of the
-results.
-
-Back-patch to v10, as the prior patch was.
-
-Discussion: https://postgr.es/m/16689-57701daa23b377bf@postgresql.org
-Git viewer: https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=4a071afbd056282746a5bc9362e87f579a56402d;hp=f90149e6285aaae6b48559afce1bd638ee26c33e
----
- src/test/regress/expected/timetz.out | 32 ++++++++++++++--------------
- src/test/regress/sql/timetz.sql      | 16 +++++++-------
- 2 files changed, 24 insertions(+), 24 deletions(-)
-
-diff --git a/src/test/regress/expected/timetz.out b/src/test/regress/expected/timetz.out
-index 038bb5fa09..1ab5ed5105 100644
---- a/src/test/regress/expected/timetz.out
-+++ b/src/test/regress/expected/timetz.out
-@@ -91,45 +91,45 @@ SELECT f1 AS "Ten" FROM TIMETZ_TBL WHERE f1 >= '00:00-07';
- (12 rows)
- 
- -- Check edge cases
--SELECT '23:59:59.999999'::timetz;
-+SELECT '23:59:59.999999 PDT'::timetz;
-        timetz       
- --------------------
-  23:59:59.999999-07
- (1 row)
- 
--SELECT '23:59:59.9999999'::timetz;  -- rounds up
-+SELECT '23:59:59.9999999 PDT'::timetz;  -- rounds up
-    timetz    
- -------------
-  24:00:00-07
- (1 row)
- 
--SELECT '23:59:60'::timetz;  -- rounds up
-+SELECT '23:59:60 PDT'::timetz;  -- rounds up
-    timetz    
- -------------
-  24:00:00-07
- (1 row)
- 
--SELECT '24:00:00'::timetz;  -- allowed
-+SELECT '24:00:00 PDT'::timetz;  -- allowed
-    timetz    
- -------------
-  24:00:00-07
- (1 row)
- 
--SELECT '24:00:00.01'::timetz;  -- not allowed
--ERROR:  date/time field value out of range: "24:00:00.01"
--LINE 1: SELECT '24:00:00.01'::timetz;
-+SELECT '24:00:00.01 PDT'::timetz;  -- not allowed
-+ERROR:  date/time field value out of range: "24:00:00.01 PDT"
-+LINE 1: SELECT '24:00:00.01 PDT'::timetz;
-                ^
--SELECT '23:59:60.01'::timetz;  -- not allowed
--ERROR:  date/time field value out of range: "23:59:60.01"
--LINE 1: SELECT '23:59:60.01'::timetz;
-+SELECT '23:59:60.01 PDT'::timetz;  -- not allowed
-+ERROR:  date/time field value out of range: "23:59:60.01 PDT"
-+LINE 1: SELECT '23:59:60.01 PDT'::timetz;
-                ^
--SELECT '24:01:00'::timetz;  -- not allowed
--ERROR:  date/time field value out of range: "24:01:00"
--LINE 1: SELECT '24:01:00'::timetz;
-+SELECT '24:01:00 PDT'::timetz;  -- not allowed
-+ERROR:  date/time field value out of range: "24:01:00 PDT"
-+LINE 1: SELECT '24:01:00 PDT'::timetz;
-                ^
--SELECT '25:00:00'::timetz;  -- not allowed
--ERROR:  date/time field value out of range: "25:00:00"
--LINE 1: SELECT '25:00:00'::timetz;
-+SELECT '25:00:00 PDT'::timetz;  -- not allowed
-+ERROR:  date/time field value out of range: "25:00:00 PDT"
-+LINE 1: SELECT '25:00:00 PDT'::timetz;
-                ^
- --
- -- TIME simple math
-diff --git a/src/test/regress/sql/timetz.sql b/src/test/regress/sql/timetz.sql
-index b699e4b03c..ce763d89e8 100644
---- a/src/test/regress/sql/timetz.sql
-+++ b/src/test/regress/sql/timetz.sql
-@@ -36,14 +36,14 @@ SELECT f1 AS "None" FROM TIMETZ_TBL WHERE f1 < '00:00-07';
- SELECT f1 AS "Ten" FROM TIMETZ_TBL WHERE f1 >= '00:00-07';
- 
- -- Check edge cases
--SELECT '23:59:59.999999'::timetz;
--SELECT '23:59:59.9999999'::timetz;  -- rounds up
--SELECT '23:59:60'::timetz;  -- rounds up
--SELECT '24:00:00'::timetz;  -- allowed
--SELECT '24:00:00.01'::timetz;  -- not allowed
--SELECT '23:59:60.01'::timetz;  -- not allowed
--SELECT '24:01:00'::timetz;  -- not allowed
--SELECT '25:00:00'::timetz;  -- not allowed
-+SELECT '23:59:59.999999 PDT'::timetz;
-+SELECT '23:59:59.9999999 PDT'::timetz;  -- rounds up
-+SELECT '23:59:60 PDT'::timetz;  -- rounds up
-+SELECT '24:00:00 PDT'::timetz;  -- allowed
-+SELECT '24:00:00.01 PDT'::timetz;  -- not allowed
-+SELECT '23:59:60.01 PDT'::timetz;  -- not allowed
-+SELECT '24:01:00 PDT'::timetz;  -- not allowed
-+SELECT '25:00:00 PDT'::timetz;  -- not allowed
- 
- --
- -- TIME simple math
--- 
-2.20.1

From 13666eaf58ff45faf83c7d6bfbc36b174f83f000 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Tue, 17 Nov 2020 23:20:00 -0500
Subject: [PATCH 16/67] postgresql_11: 11.9 -> 11.10

Release notes: https://www.postgresql.org/docs/11/release-11-10.html
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 95df2b02c0b..737847ac81a 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -207,9 +207,9 @@ in self: {
   };
 
   postgresql_11 = self.callPackage generic {
-    version = "11.9";
+    version = "11.10";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    sha256 = "0db6pfphc5rp12abnkvv2l9pbl7bdyf3hhiwj8ghjwh35skqlq9m";
+    sha256 = "16bqp6ds37kbwqx7mk5gg3y6gv59wq6xz33iqwxldzk20vwd5rhk";
     this = self.postgresql_11;
     inherit self;
   };

From 93e356349c71bd89ace398383bc5d78c98d940e5 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Tue, 17 Nov 2020 23:20:00 -0500
Subject: [PATCH 17/67] postgresql_12: 12.4 -> 12.5

Release notes: https://www.postgresql.org/docs/12/release-12-5.html
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 737847ac81a..49764af2e1c 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -215,9 +215,9 @@ in self: {
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.4";
+    version = "12.5";
     psqlSchema = "12";
-    sha256 = "1k06wryy8p4s1fim9qafcjlak3f58l0wqaqnrccr9x9j5jz3zsdy";
+    sha256 = "15gzg778da23sbfmy7sqg443f9ny480301lm7i3vay4m3ls2a3dx";
     this = self.postgresql_12;
     inherit self;
   };

From 9e802844fc19e77ac6b04126ec13288ce886c5c6 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Wed, 18 Nov 2020 04:20:00 +0000
Subject: [PATCH 18/67] postgresql_13: 13.0 -> 13.1

Release notes: https://www.postgresql.org/docs/13/release-13-1.html
---
 pkgs/servers/sql/postgresql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 49764af2e1c..c38541c4e9d 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -223,9 +223,9 @@ in self: {
   };
 
   postgresql_13 = self.callPackage generic {
-    version = "13.0";
+    version = "13.1";
     psqlSchema = "13";
-    sha256 = "15i2b7m9a9430idqdgvrcyx66cpxz0v2d81nfqcm8ss3inz51rw0";
+    sha256 = "07z6zwr58dckaa97yl9ml240z83d1lhgaxw9aq49i8lsp21mqd0j";
     this = self.postgresql_13;
     inherit self;
   };

From 354a3b92b4daba501c99329352a646b627f1c848 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Wed, 18 Nov 2020 04:30:58 +0000
Subject: [PATCH 19/67] gmp: 6.2.0 -> 6.2.1

---
 pkgs/development/libraries/gmp/6.x.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index f4432cfc5b8..10e63f733a2 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -11,11 +11,11 @@
 let inherit (stdenv.lib) optional; in
 
 let self = stdenv.mkDerivation rec {
-  name = "gmp-6.2.0";
+  name = "gmp-6.2.1";
 
   src = fetchurl { # we need to use bz2, others aren't in bootstrapping stdenv
     urls = [ "mirror://gnu/gmp/${name}.tar.bz2" "ftp://ftp.gmplib.org/pub/${name}/${name}.tar.bz2" ];
-    sha256 = "1sji8i9yjzfv5l2fsadpgjfyn452q6ab9zvm02k23ssd275rj77m";
+    sha256 = "0z2ddfiwgi0xbf65z4fg4hqqzlhv0cc6hdcswf3c6n21xdmk5sga";
   };
 
   #outputs TODO: split $cxx due to libstdc++ dependency

From d4838aea5b6efad038539617a471903f5334408e Mon Sep 17 00:00:00 2001
From: Scott Worley <scottworley@scottworley.com>
Date: Thu, 15 Oct 2020 18:10:31 -0700
Subject: [PATCH 20/67] python3Packages.memcached: Fix fetch URL

---
 pkgs/development/python-modules/memcached/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/memcached/default.nix b/pkgs/development/python-modules/memcached/default.nix
index 65473160480..0e1ec2a2765 100644
--- a/pkgs/development/python-modules/memcached/default.nix
+++ b/pkgs/development/python-modules/memcached/default.nix
@@ -6,11 +6,12 @@
 }:
 
 buildPythonPackage rec {
-  pname = "memcached-1.51";
+  pname = "memcached";
   version = "1.51";
 
   src = if isPy3k then fetchPypi {
-    inherit pname version;
+    inherit version;
+    pname = "python3-${pname}";
     sha256 = "0na8b369q8fivh3y0nvzbvhh3lgvxiyyv9xp93cnkvwfsr8mkgkw";
   } else fetchurl {
     url = "http://ftp.tummy.com/pub/python-memcached/old-releases/python-${pname}-${version}.tar.gz";

From 82229259dd30faa8ea26216459d761950f27f61f Mon Sep 17 00:00:00 2001
From: Scott Worley <scottworley@scottworley.com>
Date: Fri, 6 Nov 2020 10:27:24 -0800
Subject: [PATCH 21/67] cyrus-sasl: Tarballs now hosted at github

---
 pkgs/development/libraries/cyrus-sasl/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/cyrus-sasl/default.nix b/pkgs/development/libraries/cyrus-sasl/default.nix
index cd3fa3bb7fd..96778e8960b 100644
--- a/pkgs/development/libraries/cyrus-sasl/default.nix
+++ b/pkgs/development/libraries/cyrus-sasl/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     urls =
-      [ "http://www.cyrusimap.org/releases/${pname}-${version}.tar.gz"
+      [ "https://github.com/cyrusimap/${pname}/releases/download/${pname}-${version}/${pname}-${version}.tar.gz"
+        "http://www.cyrusimap.org/releases/${pname}-${version}.tar.gz"
         "http://www.cyrusimap.org/releases/old/${pname}-${version}.tar.gz"
       ];
     sha256 = "1m85zcpgfdhm43cavpdkhb1s2zq1b31472hq1w1gs3xh94anp1i6";

From 303adee602b836c48e3d654e2616179fbc1a34c2 Mon Sep 17 00:00:00 2001
From: Scott Worley <scottworley@scottworley.com>
Date: Fri, 6 Nov 2020 10:33:18 -0800
Subject: [PATCH 22/67] libdevil: Fix patch URL

---
 pkgs/development/libraries/libdevil/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/libdevil/default.nix b/pkgs/development/libraries/libdevil/default.nix
index 132e1d1dbf5..5d00d6b01ff 100644
--- a/pkgs/development/libraries/libdevil/default.nix
+++ b/pkgs/development/libraries/libdevil/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   patches =
     [ ( fetchurl {
-        url = "http://patch-tracker.debian.org/patch/series/dl/devil/1.7.8-6.1/03_CVE-2009-3994.diff";
+        url = "https://sources.debian.org/data/main/d/devil/1.7.8-10/debian/patches/03_CVE-2009-3994.diff";
         sha256 = "0qkx2qfv02igbrmsn6z5a3lbrbwjfh3rb0c2sj54wy0j1f775hbc";
       } )
       ./ftbfs-libpng15.patch

From 0ae2687f9eba10e74a0530392a342322dae4dd07 Mon Sep 17 00:00:00 2001
From: Scott Worley <scottworley@scottworley.com>
Date: Fri, 6 Nov 2020 13:53:46 -0800
Subject: [PATCH 23/67] xmlto: Fix fetch URL

---
 pkgs/tools/typesetting/xmlto/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/typesetting/xmlto/default.nix b/pkgs/tools/typesetting/xmlto/default.nix
index f37bfb7c133..31b260d846c 100644
--- a/pkgs/tools/typesetting/xmlto/default.nix
+++ b/pkgs/tools/typesetting/xmlto/default.nix
@@ -3,9 +3,10 @@
 , bash, getopt, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  name = "xmlto-0.0.28";
+  pname = "xmlto";
+  version = "0.0.28";
   src = fetchurl {
-    url = "http://fedorahosted.org/releases/x/m/xmlto/${name}.tar.bz2";
+    url = "https://releases.pagure.org/${pname}/${pname}-${version}.tar.bz2";
     sha256 = "0xhj8b2pwp4vhl9y16v3dpxpsakkflfamr191mprzsspg4xdyc0i";
   };
 

From 5354cd0a162a4a262fa03f4bfaed7de01d589271 Mon Sep 17 00:00:00 2001
From: Scott Worley <scottworley@scottworley.com>
Date: Fri, 6 Nov 2020 14:07:21 -0800
Subject: [PATCH 24/67] ghc: Use a real URL for D5123.diff

Please do not use tarballs.nixos.org in src URLs.  tarballs.nixos.org is
a cache, not an authority.

This patch differs from the one in tarballs.nixos.org only in source code
comments.
---
 pkgs/development/compilers/ghc/8.6.5.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/ghc/8.6.5.nix b/pkgs/development/compilers/ghc/8.6.5.nix
index 3d660dd9521..7adacff597c 100644
--- a/pkgs/development/compilers/ghc/8.6.5.nix
+++ b/pkgs/development/compilers/ghc/8.6.5.nix
@@ -110,10 +110,10 @@ stdenv.mkDerivation (rec {
   outputs = [ "out" "doc" ];
 
   patches = [
-    (fetchpatch rec { # https://phabricator.haskell.org/D5123
-     url = "http://tarballs.nixos.org/sha256/${sha256}";
+    (fetchpatch { # https://phabricator.haskell.org/D5123
+     url = "https://gitlab.haskell.org/ghc/ghc/-/commit/13ff0b7ced097286e0d7b054f050871effe07f86.diff";
      name = "D5123.diff";
-     sha256 = "0nhqwdamf2y4gbwqxcgjxs0kqx23w9gv5kj0zv6450dq19rji82n";
+     sha256 = "140lmnqxra7xkwy370c5pyf8dgdwgmbpcrs1dapnwr2dh8bavn8c";
     })
     (fetchpatch { # https://github.com/haskell/haddock/issues/900
      url = "https://patch-diff.githubusercontent.com/raw/haskell/haddock/pull/983.diff";

From 11806b6ede420bbdb980ca1c36918b71e9ddc0a2 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Fri, 25 Sep 2020 21:40:10 -0400
Subject: [PATCH 25/67] cpython: fix finding headers when cross-compiling
 extension modules

---
 ...finding-headers-when-cross-compiling.patch | 54 ++++++++++++++++
 ...finding-headers-when-cross-compiling.patch | 54 ++++++++++++++++
 .../interpreters/python/cpython/default.nix   | 61 +++++++++++++++++++
 .../bootstrapped-pip/default.nix              |  2 +-
 4 files changed, 170 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/interpreters/python/cpython/3.6/fix-finding-headers-when-cross-compiling.patch
 create mode 100644 pkgs/development/interpreters/python/cpython/3.7/fix-finding-headers-when-cross-compiling.patch

diff --git a/pkgs/development/interpreters/python/cpython/3.6/fix-finding-headers-when-cross-compiling.patch b/pkgs/development/interpreters/python/cpython/3.6/fix-finding-headers-when-cross-compiling.patch
new file mode 100644
index 00000000000..d324d10b39f
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/3.6/fix-finding-headers-when-cross-compiling.patch
@@ -0,0 +1,54 @@
+From 45dfbbb4f5b67ab83e4365564ea569334e979f8e Mon Sep 17 00:00:00 2001
+From: Ben Wolsieffer <benwolsieffer@gmail.com>
+Date: Fri, 25 Sep 2020 16:49:16 -0400
+Subject: [PATCH] Fix finding headers when cross compiling
+
+When cross-compiling third-party extensions, get_python_inc() may be called to
+return the path to Python's headers. However, it uses the sys.prefix or
+sys.exec_prefix of the build Python, which returns incorrect paths when
+cross-compiling (paths pointing to build system headers).
+
+To fix this, we use the INCLUDEPY and CONFINCLUDEPY conf variables, which can
+be configured to point at host Python by setting _PYTHON_SYSCONFIGDATA_NAME.
+The existing behavior is maintained on non-POSIX platforms or if a prefix is
+manually specified.
+---
+ Lib/distutils/sysconfig.py | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/Lib/distutils/sysconfig.py b/Lib/distutils/sysconfig.py
+index 2bcd1dd288..567375e488 100644
+--- a/Lib/distutils/sysconfig.py
++++ b/Lib/distutils/sysconfig.py
+@@ -84,8 +84,6 @@ def get_python_inc(plat_specific=0, prefix=None):
+     If 'prefix' is supplied, use it instead of sys.base_prefix or
+     sys.base_exec_prefix -- i.e., ignore 'plat_specific'.
+     """
+-    if prefix is None:
+-        prefix = plat_specific and BASE_EXEC_PREFIX or BASE_PREFIX
+     if os.name == "posix":
+         if python_build:
+             # Assume the executable is in the build directory.  The
+@@ -98,9 +96,17 @@ def get_python_inc(plat_specific=0, prefix=None):
+             else:
+                 incdir = os.path.join(get_config_var('srcdir'), 'Include')
+                 return os.path.normpath(incdir)
+-        python_dir = 'python' + get_python_version() + build_flags
+-        return os.path.join(prefix, "include", python_dir)
++        if prefix is None:
++          if plat_specific:
++            return get_config_var('CONFINCLUDEPY')
++          else:
++            return get_config_var('INCLUDEPY')
++        else:
++          python_dir = 'python' + get_python_version() + build_flags
++          return os.path.join(prefix, "include", python_dir)
+     elif os.name == "nt":
++        if prefix is None:
++          prefix = plat_specific and BASE_EXEC_PREFIX or BASE_PREFIX
+         return os.path.join(prefix, "include")
+     else:
+         raise DistutilsPlatformError(
+-- 
+2.28.0
+
diff --git a/pkgs/development/interpreters/python/cpython/3.7/fix-finding-headers-when-cross-compiling.patch b/pkgs/development/interpreters/python/cpython/3.7/fix-finding-headers-when-cross-compiling.patch
new file mode 100644
index 00000000000..543e267e94b
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/3.7/fix-finding-headers-when-cross-compiling.patch
@@ -0,0 +1,54 @@
+From debccd4be0a8d619770f63622d9de1b451dd02ac Mon Sep 17 00:00:00 2001
+From: Ben Wolsieffer <benwolsieffer@gmail.com>
+Date: Fri, 25 Sep 2020 16:49:16 -0400
+Subject: [PATCH] Fix finding headers when cross compiling
+
+When cross-compiling third-party extensions, get_python_inc() may be called to
+return the path to Python's headers. However, it uses the sys.prefix or
+sys.exec_prefix of the build Python, which returns incorrect paths when
+cross-compiling (paths pointing to build system headers).
+
+To fix this, we use the INCLUDEPY and CONFINCLUDEPY conf variables, which can
+be configured to point at host Python by setting _PYTHON_SYSCONFIGDATA_NAME.
+The existing behavior is maintained on non-POSIX platforms or if a prefix is
+manually specified.
+---
+ Lib/distutils/sysconfig.py | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/Lib/distutils/sysconfig.py b/Lib/distutils/sysconfig.py
+index 37feae5df7..6d4ad06696 100644
+--- a/Lib/distutils/sysconfig.py
++++ b/Lib/distutils/sysconfig.py
+@@ -95,8 +95,6 @@ def get_python_inc(plat_specific=0, prefix=None):
+     If 'prefix' is supplied, use it instead of sys.base_prefix or
+     sys.base_exec_prefix -- i.e., ignore 'plat_specific'.
+     """
+-    if prefix is None:
+-        prefix = plat_specific and BASE_EXEC_PREFIX or BASE_PREFIX
+     if os.name == "posix":
+         if python_build:
+             # Assume the executable is in the build directory.  The
+@@ -109,9 +107,17 @@ def get_python_inc(plat_specific=0, prefix=None):
+             else:
+                 incdir = os.path.join(get_config_var('srcdir'), 'Include')
+                 return os.path.normpath(incdir)
+-        python_dir = 'python' + get_python_version() + build_flags
+-        return os.path.join(prefix, "include", python_dir)
++        if prefix is None:
++          if plat_specific:
++            return get_config_var('CONFINCLUDEPY')
++          else:
++            return get_config_var('INCLUDEPY')
++        else:
++          python_dir = 'python' + get_python_version() + build_flags
++          return os.path.join(prefix, "include", python_dir)
+     elif os.name == "nt":
++        if prefix is None:
++          prefix = plat_specific and BASE_EXEC_PREFIX or BASE_PREFIX
+         if python_build:
+             # Include both the include and PC dir to ensure we can find
+             # pyconfig.h
+-- 
+2.28.0
+
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 02777063a77..62faab7e896 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -101,6 +101,44 @@ let
     "$out/bin/python"
   else pythonForBuild.interpreter;
 
+  # The CPython interpreter contains a _sysconfigdata_<platform specific suffix>
+  # module that is imported by the sysconfig and distutils.sysconfig modules.
+  # The sysconfigdata module is generated at build time and contains settings
+  # required for building Python extension modules, such as include paths and
+  # other compiler flags. By default, the sysconfigdata module is loaded from
+  # the currently running interpreter (ie. the build platform interpreter), but
+  # when cross-compiling we want to load it from the host platform interpreter.
+  # This can be done using the _PYTHON_SYSCONFIGDATA_NAME environment variable.
+  # The _PYTHON_HOST_PLATFORM variable also needs to be set to get the correct
+  # platform suffix on extension modules. The correct values for these variables
+  # are not documented, and must be derived from the configure script (see links
+  # below).
+  sysconfigdataHook = with stdenv.hostPlatform; let
+    # https://github.com/python/cpython/blob/e488e300f5c01289c10906c2e53a8e43d6de32d8/configure.ac#L428
+    pythonHostPlatform = "${parsed.kernel.name}-${parsed.cpu.name}";
+
+    # https://github.com/python/cpython/blob/e488e300f5c01289c10906c2e53a8e43d6de32d8/configure.ac#L724
+    multiarchCpu =
+      if isAarch32 then
+        if parsed.cpu.significantByte.name == "littleEndian" then "arm" else "armeb"
+      else parsed.cpu.name;
+    multiarch =
+      if isDarwin then "darwin"
+      else "${multiarchCpu}-${parsed.kernel.name}-${parsed.abi.name}";
+
+    # https://github.com/python/cpython/blob/e488e300f5c01289c10906c2e53a8e43d6de32d8/configure.ac#L78
+    pythonSysconfigdataName = "_sysconfigdata__${parsed.kernel.name}_${multiarch}";
+  in ''
+    sysconfigdataHook() {
+      if [ "$1" = '${placeholder "out"}' ]; then
+        export _PYTHON_HOST_PLATFORM='${pythonHostPlatform}'
+        export _PYTHON_SYSCONFIGDATA_NAME='${pythonSysconfigdataName}'
+      fi
+    }
+
+    addEnvHooks "$hostOffset" sysconfigdataHook
+  '';
+
 in with passthru; stdenv.mkDerivation {
   pname = "python3";
   inherit version;
@@ -166,6 +204,13 @@ in with passthru; stdenv.mkDerivation {
   ] ++ [
     # LDSHARED now uses $CC instead of gcc. Fixes cross-compilation of extension modules.
     ./3.8/0001-On-all-posix-systems-not-just-Darwin-set-LDSHARED-if.patch
+    # Use sysconfigdata to find headers. Fixes cross-compilation of extension modules.
+    (
+      if isPy36 then
+        ./3.6/fix-finding-headers-when-cross-compiling.patch
+      else
+        ./3.7/fix-finding-headers-when-cross-compiling.patch
+    )
   ];
 
   postPatch = ''
@@ -279,6 +324,14 @@ in with passthru; stdenv.mkDerivation {
     find $out/lib/python*/config-* -type f -print -exec nuke-refs -e $out '{}' +
     find $out/lib -name '_sysconfigdata*.py*' -print -exec nuke-refs -e $out '{}' +
 
+    # Make the sysconfigdata module accessible on PYTHONPATH
+    # This allows build Python to import host Python's sysconfigdata
+    mkdir -p "$out/${sitePackages}"
+    mv "$out/lib/${libPrefix}"/_sysconfigdata*.py "$out/${sitePackages}"
+    if [ -d "$out/lib/${libPrefix}"/__pycache__ ]; then
+      mkdir -p "$out/${sitePackages}/__pycache__"
+      mv "$out/lib/${libPrefix}"/__pycache__/_sysconfigdata*.py* "$out/${sitePackages}/__pycache__"
+    fi
     '' + optionalString stripConfig ''
     rm -R $out/bin/python*-config $out/lib/python*/config-*
     '' + optionalString stripIdlelib ''
@@ -311,6 +364,14 @@ in with passthru; stdenv.mkDerivation {
     export PATH=${stdenv.lib.makeBinPath [ "$out" bash ]}:$PATH
   '';
 
+  # Add CPython specific setup-hook that configures distutils.sysconfig to
+  # always load sysconfigdata from host Python.
+  postFixup = ''
+    cat << "EOF" >> "$out/nix-support/setup-hook"
+    ${sysconfigdataHook}
+    EOF
+  '';
+
   # Enforce that we don't have references to the OpenSSL -dev package, which we
   # explicitly specify in our configure flags above.
   disallowedReferences =
diff --git a/pkgs/development/python-modules/bootstrapped-pip/default.nix b/pkgs/development/python-modules/bootstrapped-pip/default.nix
index 04bac36cf5a..0d0117fa43c 100644
--- a/pkgs/development/python-modules/bootstrapped-pip/default.nix
+++ b/pkgs/development/python-modules/bootstrapped-pip/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     mv wheel* wheel
     # Set up PYTHONPATH. The above folders need to be on PYTHONPATH
     # $out is where we are installing to and takes precedence
-    export PYTHONPATH="$out/${python.sitePackages}:$(pwd)/pip/src:$(pwd)/setuptools:$(pwd)/setuptools/pkg_resources:$(pwd)/wheel"
+    export PYTHONPATH="$out/${python.sitePackages}:$(pwd)/pip/src:$(pwd)/setuptools:$(pwd)/setuptools/pkg_resources:$(pwd)/wheel:$PYTHONPATH"
 
     echo "Building setuptools wheel..."
     pushd setuptools

From 6501d9880c3f612afd417e7c45fff2f58f19009a Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Fri, 2 Oct 2020 13:22:35 -0400
Subject: [PATCH 26/67] talloc: fix cross-compilation to 32-bit platforms

---
 pkgs/development/libraries/talloc/default.nix | 14 ++++++++++----
 pkgs/top-level/all-packages.nix               |  4 +---
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/libraries/talloc/default.nix b/pkgs/development/libraries/talloc/default.nix
index f464364e8a0..fa920d037a9 100644
--- a/pkgs/development/libraries/talloc/default.nix
+++ b/pkgs/development/libraries/talloc/default.nix
@@ -1,6 +1,6 @@
 { stdenv
 , fetchurl
-, python
+, python3
 , pkg-config
 , readline
 , libxslt
@@ -10,7 +10,7 @@
 , wafHook
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (rec {
   pname = "talloc";
   version = "2.3.1";
 
@@ -22,13 +22,14 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     fixDarwinDylibNames
-    python
+    python3
     wafHook
     docbook-xsl-nons
     docbook_xml_dtd_42
   ];
 
   buildInputs = [
+    python3
     readline
     libxslt
   ];
@@ -56,4 +57,9 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     platforms = platforms.all;
   };
-}
+} // stdenv.lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform) {
+  # python-config from build Python gives incorrect values when cross-compiling.
+  # If python-config is not found, the build falls back to using the sysconfig
+  # module, which works correctly when cross-compiling.
+  PYTHON_CONFIG = "/invalid";
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 449d1576908..a5f21c65fc8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15949,9 +15949,7 @@ in
 
   taglib-sharp = callPackage ../development/libraries/taglib-sharp { };
 
-  talloc = callPackage ../development/libraries/talloc {
-    python = buildPackages.python3;
-  };
+  talloc = callPackage ../development/libraries/talloc { };
 
   tclap = callPackage ../development/libraries/tclap {};
 

From 27d3a18ac7d34b66a14b634cb785e8c8caef024b Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Thu, 19 Nov 2020 20:57:22 +0100
Subject: [PATCH 27/67] buildPython*: don't catch conflicts when
 cross-compiling

Hack until we fix PYTHONPATH.
---
 pkgs/development/interpreters/python/mk-python-derivation.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/python/mk-python-derivation.nix b/pkgs/development/interpreters/python/mk-python-derivation.nix
index c85a5939055..670c870f107 100644
--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@@ -53,7 +53,9 @@
 , disabled ? false
 
 # Raise an error if two packages are installed with the same name
-, catchConflicts ? true
+# TODO: For cross we probably need a different PYTHONPATH, or not
+# add the runtime deps until after buildPhase.
+, catchConflicts ? (python.stdenv.hostPlatform == python.stdenv.buildPlatform)
 
 # Additional arguments to pass to the makeWrapper function, which wraps
 # generated binaries.

From 489912ee8b863b6f66aae8cf924c5fb03a0f1244 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Thu, 19 Nov 2020 20:57:37 +0100
Subject: [PATCH 28/67] pythonPackages.cffi: cffi is a native build input as
 well

---
 .../python-modules/cryptography/default.nix           | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index 8774b181fcf..41802f0d065 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -31,13 +31,20 @@ buildPythonPackage rec {
 
   outputs = [ "out" "dev" ];
 
+  nativeBuildInputs = stdenv.lib.optionals (!isPyPy) [
+    cffi
+  ];
+
   buildInputs = [ openssl ]
              ++ stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
   propagatedBuildInputs = [
     packaging
     six
-  ] ++ stdenv.lib.optional (!isPyPy) cffi
-  ++ stdenv.lib.optionals isPy27 [ ipaddress enum34 ];
+  ] ++ stdenv.lib.optionals (!isPyPy) [
+    cffi
+  ] ++ stdenv.lib.optionals isPy27 [
+    ipaddress enum34
+  ];
 
   checkInputs = [
     cryptography_vectors

From 533e56c26204b002043dde3418d2826e827ee5fa Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Thu, 19 Nov 2020 21:09:23 +0100
Subject: [PATCH 29/67] pythonPackages.zstd: fix cross

---
 pkgs/development/python-modules/zstd/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/zstd/default.nix b/pkgs/development/python-modules/zstd/default.nix
index 8f61f2ffc66..d57416ac18a 100644
--- a/pkgs/development/python-modules/zstd/default.nix
+++ b/pkgs/development/python-modules/zstd/default.nix
@@ -1,4 +1,5 @@
 { stdenv, pkgconfig, fetchPypi, buildPythonPackage
+, buildPackages
 , zstd, pytest }:
 
 buildPythonPackage rec {
@@ -12,7 +13,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "/usr/bin/pkg-config" "${pkgconfig}/bin/${pkgconfig.targetPrefix}pkg-config"
+      --replace "/usr/bin/pkg-config" "${buildPackages.pkgconfig}/bin/${buildPackages.pkgconfig.targetPrefix}pkg-config"
   '';
 
   nativeBuildInputs = [ pkgconfig ];

From 346b2212c7c2b4684c95372fec4d34c3c01370cd Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Thu, 19 Nov 2020 21:40:10 +0100
Subject: [PATCH 30/67] pythonPackages.pybind11: 2.5.0 -> 2.6.1

---
 pkgs/development/python-modules/pybind11/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index 079c93db450..3fd93493860 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.5.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = pname;
     rev = "v${version}";
-    sha256 = "13hcj6g7k7yvj7nry2ar6f5mg58ln7frrvq1cg5f8mczxh1ch6zl";
+    sha256 = "TXljeRFonQwEmlIGMnTHwdfPsd9cMOVn5/1zb3tYBfI=";
   };
 
   nativeBuildInputs = [ cmake ];

From d9184fb8b2567b5a7dc7dbddeec3b7db507f8f73 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Thu, 19 Nov 2020 21:40:32 +0100
Subject: [PATCH 31/67] pythonPackages.cftime: fix cross

---
 .../python-modules/cftime/default.nix         | 25 +++++++++++++------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/cftime/default.nix b/pkgs/development/python-modules/cftime/default.nix
index 1a29e51b35f..a57e8b8cd9e 100644
--- a/pkgs/development/python-modules/cftime/default.nix
+++ b/pkgs/development/python-modules/cftime/default.nix
@@ -1,10 +1,11 @@
 { buildPythonPackage
 , fetchPypi
-, pytest
+, pytestCheckHook
 , coveralls
 , pytestcov
 , cython
 , numpy
+, python
 }:
 
 buildPythonPackage rec {
@@ -16,13 +17,23 @@ buildPythonPackage rec {
     sha256 = "ab5d5076f7d3e699758a244ada7c66da96bae36e22b9e351ce0ececc36f0a57f";
   };
 
-  checkInputs = [ pytest coveralls pytestcov ];
-  buildInputs = [ cython ];
-  propagatedBuildInputs = [ numpy ];
+  checkInputs = [
+    pytestCheckHook
+    coveralls
+    pytestcov
+  ];
 
-  checkPhase = ''
-    py.test
-  '';
+  nativeBuildInputs = [
+    cython
+    numpy
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+  ];
+
+  # ERROR test/test_cftime.py - ModuleNotFoundError: No module named 'cftime._cft...
+  doCheck = false;
 
   meta = {
     description = "Time-handling functionality from netcdf4-python";

From 8d171ccfc384052612ef6360c2e9dfafb3c05f74 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Thu, 19 Nov 2020 21:45:52 +0100
Subject: [PATCH 32/67] c-blosc: fix cross

---
 pkgs/development/libraries/c-blosc/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/c-blosc/default.nix b/pkgs/development/libraries/c-blosc/default.nix
index 8f7cee75e92..20b82df6169 100644
--- a/pkgs/development/libraries/c-blosc/default.nix
+++ b/pkgs/development/libraries/c-blosc/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0a3yrig78plzjbazfqcfrzqhnw17xd0dcayvp4z4kp415kgs2a3s";
   };
 
-  buildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake ];
 
   enableParallelBuilding = true;
 

From 9518714926bdacdf2bd76fa3fe77a87685f79126 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Sun, 8 Nov 2020 18:07:47 -0500
Subject: [PATCH 33/67] pythonPackages.grpcio: split outputs to avoid runtime
 build references

protobuf propagates build-arch protobuf, and this commit prevents it from
ending up in grpcio's runtime closure.
---
 pkgs/development/python-modules/grpcio/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/grpcio/default.nix b/pkgs/development/python-modules/grpcio/default.nix
index 9311838627a..55d569c9054 100644
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@@ -6,6 +6,8 @@ buildPythonPackage rec {
   inherit (grpc) src version;
   pname = "grpcio";
 
+  outputs = [ "out" "dev" ];
+
   nativeBuildInputs = [ cython pkgconfig ]
                     ++ stdenv.lib.optional stdenv.isDarwin darwin.cctools;
 

From 1e1560649cf9a825e9581d8e04711ae273a824cc Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Sun, 8 Nov 2020 18:08:53 -0500
Subject: [PATCH 34/67] pythonPackages.grpcio-tools: split outputs to reduce
 runtime closure

protobuf propagates build-arch protobuf, and this prevents it from ending up in
the runtime closure.
---
 pkgs/development/python-modules/grpcio-tools/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index fe0fc9d3f8e..a68eb704f6c 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -9,6 +9,8 @@ buildPythonPackage rec {
     sha256 = "af40774c0275f5465f49fd92bfcd9831b19b013de4cc77b8fb38aea76fa6dce3";
   };
 
+  outputs = [ "out" "dev" ];
+
   enableParallelBuilding = true;
 
   propagatedBuildInputs = [ protobuf grpcio setuptools ];

From f8716c6d5a50dd1afb488ed935f7f9ff6605a61d Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Thu, 19 Nov 2020 22:04:46 +0100
Subject: [PATCH 35/67] pythonPackages.numexpr: fix cross

---
 pkgs/development/python-modules/numexpr/default.nix | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/numexpr/default.nix b/pkgs/development/python-modules/numexpr/default.nix
index 3e3316788ed..046f0a5bd5d 100644
--- a/pkgs/development/python-modules/numexpr/default.nix
+++ b/pkgs/development/python-modules/numexpr/default.nix
@@ -19,12 +19,18 @@ buildPythonPackage rec {
     ln -s ${numpy.cfg} site.cfg
   '';
 
-  propagatedBuildInputs = [ numpy ];
+  nativeBuildInputs = [
+    numpy
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+  ];
 
   checkPhase = ''
     runtest="$(pwd)/numexpr/tests/test_numexpr.py"
     pushd "$out"
-    ${python}/bin/${python.executable} "$runtest"
+    ${python.interpreter} "$runtest"
     popd
   '';
 

From 17eb317428304255695ea41200e70bd172b1892c Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Fri, 20 Nov 2020 00:16:51 +0000
Subject: [PATCH 36/67] =?UTF-8?q?gdk-pixbuf:=202.40.0=20=E2=86=92=202.42.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://ftp.gnome.org/pub/GNOME/sources/gdk-pixbuf/2.42/gdk-pixbuf-2.42.0.news

xlib has been dropped, some build flags changed: https://mail.gnome.org/archives/distributor-list/2020-November/msg00000.html
Also corrected license.
---
 .../libraries/gdk-pixbuf/default.nix          | 19 +++++--------------
 1 file changed, 5 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index 9b2fd0b778b..2d6fae915f8 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -20,31 +20,23 @@
 , gobject-introspection
 , doCheck ? false
 , makeWrapper
-, fetchpatch
 , lib
 }:
 
 stdenv.mkDerivation rec {
   pname = "gdk-pixbuf";
-  version = "2.40.0";
+  version = "2.42.0";
 
   outputs = [ "out" "dev" "man" "devdoc" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1rnlx9yfw970maxi2x6niaxmih5la11q1ilr7gzshz2kk585k0hm";
+    sha256 = "1ixfmmamgv67is7snzighfr7c9y2maq3q4a075xdq0d9s4w16i3k";
   };
 
   patches = [
     # Move installed tests to a separate output
     ./installed-tests-path.patch
-
-    # Temporary until the fix is released.
-    (fetchpatch {
-      name = "tests-circular-table.patch";
-      url = "https://gitlab.gnome.org/GNOME/gdk-pixbuf/merge_requests/59.diff";
-      sha256 = "0kaflac3mrh6031hwxk7j9fhli775hc503818h8zfl6b28zyn93f";
-    })
   ];
 
   nativeBuildInputs = [
@@ -71,9 +63,8 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Ddocs=true"
-    "-Dx11=false" # use gdk-pixbuf-xlib
-    "-Dgir=${lib.boolToString (gobject-introspection != null)}"
+    "-Dgtk_doc=true"
+    "-Dintrospection=${if gobject-introspection != null then "enabled" else "disabled"}"
     "-Dgio_sniffing=false"
   ];
 
@@ -135,7 +126,7 @@ stdenv.mkDerivation rec {
     description = "A library for image loading and manipulation";
     homepage = "https://gitlab.gnome.org/GNOME/gdk-pixbuf";
     maintainers = [ maintainers.eelco ] ++ teams.gnome.members;
-    license = licenses.lgpl21;
+    license = licenses.lgpl21Plus;
     platforms = platforms.unix;
   };
 }

From 75e683d29d035d6c1161762facc319c3227b7507 Mon Sep 17 00:00:00 2001
From: Austin Seipp <aseipp@pobox.com>
Date: Sun, 15 Nov 2020 22:43:03 -0600
Subject: [PATCH 37/67] pythonPackages: add new 'seccomp' library

As requested in #99553. Closes #99553.

Libraries that install python modules as part of the build are
problematic, because they either

  - only support a single python version, because the input for
    pythonPackages gets fixed in all-packages.nix, or

  - need to be rebuild the underlying C code for *every* python version
    resulting in libfoo-python37, libfoo-python38, and so on

We would prefer to use the second approach because it works correctly
for all versions of python. However, it creates duplicate copies of
libseccomp.so and that can be expensive. Instead we 'deduplicate' the
copies of libseccomp.so by

  - attaching a new $pythonsrc output to the libseccomp deriv, and
  - exposing a new 'seccomp' package in python-packages.nix using
    libseccomp as input, and
  - having a custom python.nix derivation that builds the cython
    extension using libseccomp to get the python source and the
    package version

This means we build 1 copy of the seccomp python package, one for each
version of python, but all of those packages refer to a single instance
of the libseccomp C library, giving us the best of both worlds.

NOTE: because this requires changing the postInstall of libseccomp, it
requires a mass rebuild.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
---
 .../libraries/libseccomp/default.nix          |  9 +++++-
 .../python-modules/seccomp/default.nix        | 29 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 3 files changed, 39 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/python-modules/seccomp/default.nix

diff --git a/pkgs/development/libraries/libseccomp/default.nix b/pkgs/development/libraries/libseccomp/default.nix
index 6ea0e6be465..703b25fcf1c 100644
--- a/pkgs/development/libraries/libseccomp/default.nix
+++ b/pkgs/development/libraries/libseccomp/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1wql62cg8f95cwpy057cl764nni9g4sdn5lqj68x22kjs8w71yhz";
   };
 
-  outputs = [ "out" "lib" "dev" "man" ];
+  outputs = [ "out" "lib" "dev" "man" "pythonsrc" ];
 
   nativeBuildInputs = [ gperf ];
   buildInputs = [ getopt ];
@@ -24,6 +24,13 @@ stdenv.mkDerivation rec {
   # Hack to ensure that patchelf --shrink-rpath get rids of a $TMPDIR reference.
   preFixup = "rm -rfv src";
 
+  # Copy the python module code into a tarball that we can export and use as the
+  # src input for buildPythonPackage calls
+  postInstall = ''
+    cp -R ./src/python/ tmp-pythonsrc/
+    tar -zcf $pythonsrc --transform s/tmp-pythonsrc/python-foundationdb/ ./tmp-pythonsrc/
+  '';
+
   meta = with stdenv.lib; {
     description = "High level library for the Linux Kernel seccomp filter";
     homepage = "https://github.com/seccomp/libseccomp";
diff --git a/pkgs/development/python-modules/seccomp/default.nix b/pkgs/development/python-modules/seccomp/default.nix
new file mode 100644
index 00000000000..3257722b178
--- /dev/null
+++ b/pkgs/development/python-modules/seccomp/default.nix
@@ -0,0 +1,29 @@
+{ buildPythonPackage, lib
+, cython, libseccomp
+}:
+
+buildPythonPackage rec {
+  pname   = "libseccomp";
+  version = libseccomp.version;
+  src     = libseccomp.pythonsrc;
+
+  VERSION_RELEASE = version; # used by build system
+
+  nativeBuildInputs = [ cython ];
+  buildInputs = [ libseccomp ];
+
+  unpackCmd = "tar xf $curSrc";
+  doInstallCheck = true;
+
+  postPatch = ''
+    substituteInPlace ./setup.py \
+      --replace 'extra_objects=["../.libs/libseccomp.a"]' \
+                'libraries=["seccomp"]'
+  '';
+
+  meta = with lib; {
+    description = "Python bindings for libseccomp";
+    license     = with licenses; [ lgpl21 ];
+    maintainers = with maintainers; [ thoughtpolice ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 015d27c5660..c46cec5436e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6529,6 +6529,8 @@ in {
 
   seabreeze = callPackage ../development/python-modules/seabreeze { };
 
+  seccomp = callPackage ../development/python-modules/seccomp { };
+
   secp256k1 = callPackage ../development/python-modules/secp256k1 { inherit (pkgs) secp256k1 pkgconfig; };
 
   secretstorage = if isPy3k then

From 70ecb218f1d12ee4825d1c511573be51038af70b Mon Sep 17 00:00:00 2001
From: Arnout Engelen <arnout@bzzt.net>
Date: Fri, 20 Nov 2020 14:54:14 +0100
Subject: [PATCH 38/67] selinux: 2.9 -> 3.0 (#104087)

Notably, Python 2 code is not be supported in this project anymore and
new Python code should be written only for Python 3, which is no longer
restricted to Python 3.7 (see 780fb563c74171aafc2fb802cfdebd56a68d0705,
5dfd3c497540bb172ff0d04cc8eb5ecbeb59b938)

https://github.com/SELinuxProject/selinux/releases/tag/20191204
---
 pkgs/os-specific/linux/libselinux/default.nix | 20 +++++++++++--------
 pkgs/os-specific/linux/libsepol/default.nix   |  6 +++---
 pkgs/top-level/all-packages.nix               |  4 +---
 pkgs/top-level/python-packages.nix            |  4 ++--
 4 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index 741c51e2233..4dfd6a3f2cd 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -1,26 +1,26 @@
 { stdenv, fetchurl, pcre, pkgconfig, libsepol
-, enablePython ? true, swig ? null, python ? null
+, enablePython ? true, swig ? null, python3 ? null
 , fts
 }:
 
-assert enablePython -> swig != null && python != null;
+assert enablePython -> swig != null && python3 != null;
 
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "libselinux";
-  version = "2.9";
+  version = "3.0";
   inherit (libsepol) se_release se_url;
 
   outputs = [ "bin" "out" "dev" "man" ] ++ optional enablePython "py";
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libselinux-${version}.tar.gz";
-    sha256 = "14r69mgmz7najf9wbizvp68q56mqx4yjbkxjlbcqg5a47s3wik0v";
+    sha256 = "0cr4p0qkr4qd5z1x677vwhz6mlz55kxyijwi2dmrvbhxcw7v78if";
   };
 
-  nativeBuildInputs = [ pkgconfig ] ++ optionals enablePython [ swig python ];
-  buildInputs = [ libsepol pcre fts ] ++ optionals enablePython [ python ];
+  nativeBuildInputs = [ pkgconfig ] ++ optionals enablePython [ swig python3 ];
+  buildInputs = [ libsepol pcre fts ] ++ optionals enablePython [ python3 ];
 
   # drop fortify here since package uses it by default, leading to compile error:
   # command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror]
@@ -35,14 +35,18 @@ stdenv.mkDerivation rec {
     "MAN3DIR=$(man)/share/man/man3"
     "MAN5DIR=$(man)/share/man/man5"
     "MAN8DIR=$(man)/share/man/man8"
-    "PYTHON=${python.pythonForBuild}/bin/python"
-    "PYTHONLIBDIR=$(py)/${python.sitePackages}"
+    "PYTHON=${python3.pythonForBuild}/bin/python"
+    "PYTHONLIBDIR=$(py)/${python3.sitePackages}"
     "SBINDIR=$(bin)/sbin"
     "SHLIBDIR=$(out)/lib"
 
     "LIBSEPOLA=${stdenv.lib.getLib libsepol}/lib/libsepol.a"
   ];
 
+  preInstall = ''
+    mkdir -p $py/${python3.sitePackages}/selinux
+  '';
+
   installTargets = [ "install" ] ++ optional enablePython "install-pywrap";
 
   meta = removeAttrs libsepol.meta ["outputsToInstall"] // {
diff --git a/pkgs/os-specific/linux/libsepol/default.nix b/pkgs/os-specific/linux/libsepol/default.nix
index 497961af11b..3592ba1637c 100644
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@@ -2,15 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "libsepol";
-  version = "2.9";
-  se_release = "20190315";
+  version = "3.0";
+  se_release = "20191204";
   se_url = "https://github.com/SELinuxProject/selinux/releases/download";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libsepol-${version}.tar.gz";
-    sha256 = "0p8x7w73jn1nysx1d7416wqrhbi0r6isrjxib7jf68fi72q14jx3";
+    sha256 = "0ygb6dh5lng91xs6xiqf5v0nxa68qmjc787p0s5h9w89364f2yjv";
   };
 
   nativeBuildInputs = [ flex ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 964ebcbe977..4fbc808bdeb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -18505,9 +18505,7 @@ in
 
   keyutils = callPackage ../os-specific/linux/keyutils { };
 
-  libselinux = callPackage ../os-specific/linux/libselinux {
-    python = python37;
-  };
+  libselinux = callPackage ../os-specific/linux/libselinux { };
 
   libsemanage = callPackage ../os-specific/linux/libsemanage {
     python = python3;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index c46cec5436e..72a14222f25 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3447,13 +3447,13 @@ in {
       p.overrideAttrs (super: {
         meta = super.meta // {
           outputsToInstall = [ "py" ];
-          broken = (super.meta.broken or false) || pythonAtLeast "3.8";
+          broken = super.meta.broken or isPy27;
         };
       }))
     (p:
       p.override {
         enablePython = true;
-        inherit python;
+        python3 = python;
       })
     (p: p.py)
   ];

From 90d5bdb12fc4db671db9ec11043fe26f51c88404 Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Fri, 20 Nov 2020 00:15:31 +0100
Subject: [PATCH 39/67] nixosTests.podman: run default backends, don't run runc
 rootless

The runc backend doesn't work with unified cgroup hierarchy, and it
failing is a known issue.

However, the default backends should work in both rootless and as-root
scenarios, so make sure we test these.
---
 nixos/tests/podman.nix | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/nixos/tests/podman.nix b/nixos/tests/podman.nix
index cd8c2b4308c..bccd2de7c9b 100644
--- a/nixos/tests/podman.nix
+++ b/nixos/tests/podman.nix
@@ -34,7 +34,6 @@ import ./make-test-python.nix (
       podman.wait_for_unit("sockets.target")
       start_all()
 
-
       with subtest("Run container as root with runc"):
           podman.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
           podman.succeed(
@@ -53,16 +52,14 @@ import ./make-test-python.nix (
           podman.succeed("podman stop sleeping")
           podman.succeed("podman rm sleeping")
 
-      with subtest("Run container rootless with runc"):
-          podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
+      with subtest("Run container as root with the default backend"):
+          podman.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
           podman.succeed(
-              su_cmd(
-                  "podman run --runtime=runc -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
-              )
+              "podman run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
           )
-          podman.succeed(su_cmd("podman ps | grep sleeping"))
-          podman.succeed(su_cmd("podman stop sleeping"))
-          podman.succeed(su_cmd("podman rm sleeping"))
+          podman.succeed("podman ps | grep sleeping")
+          podman.succeed("podman stop sleeping")
+          podman.succeed("podman rm sleeping")
 
       with subtest("Run container rootless with crun"):
           podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
@@ -74,6 +71,18 @@ import ./make-test-python.nix (
           podman.succeed(su_cmd("podman ps | grep sleeping"))
           podman.succeed(su_cmd("podman stop sleeping"))
           podman.succeed(su_cmd("podman rm sleeping"))
+      # As of 2020-11-20, the runc backend doesn't work with cgroupsv2 yet, so we don't run that test.
+
+      with subtest("Run container rootless with the default backend"):
+          podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
+          podman.succeed(
+              su_cmd(
+                  "podman run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+              )
+          )
+          podman.succeed(su_cmd("podman ps | grep sleeping"))
+          podman.succeed(su_cmd("podman stop sleeping"))
+          podman.succeed(su_cmd("podman rm sleeping"))
     '';
   }
 )

From 8d210e2ea42f5a6ef10320800355ecd4b49fb428 Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Fri, 20 Nov 2020 11:43:56 -0800
Subject: [PATCH 40/67] python3.pkgs.pipInstallHook: don't warn on script
 installation

---
 pkgs/development/interpreters/python/hooks/pip-install-hook.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/python/hooks/pip-install-hook.sh b/pkgs/development/interpreters/python/hooks/pip-install-hook.sh
index 4eefe22d3f2..c15b99adef6 100644
--- a/pkgs/development/interpreters/python/hooks/pip-install-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pip-install-hook.sh
@@ -11,7 +11,7 @@ pipInstallPhase() {
     export PYTHONPATH="$out/@pythonSitePackages@:$PYTHONPATH"
 
     pushd dist || return 1
-    @pythonInterpreter@ -m pip install ./*.whl --no-index --prefix="$out" --no-cache $pipInstallFlags --build tmpbuild
+    @pythonInterpreter@ -m pip install ./*.whl --no-index --no-warn-script-location --prefix="$out" --no-cache $pipInstallFlags --build tmpbuild
     popd || return 1
 
     runHook postInstall

From 9ce7b79ec6daa5ecb1b37bfb13642cbead6be25d Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 21 Nov 2020 09:27:48 +0100
Subject: [PATCH 41/67] python27Packages: no longer build and prefer

The Python 2 packages set will remain available, however, it will not be
built by Hydra or ofBorg.

While some have expressed their desire to have a Python2 set around,
there has hardly been any effort to keep it working.

Not building Python 2 allows us to build an additional Python 3 set
(currently Python 3.9), which is important since Python switched
to a yearly release cadence.
---
 pkgs/top-level/all-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b06810722f6..07a0e0bf85a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10482,7 +10482,7 @@ in
   inherit (pythonInterpreters) python27 python36 python37 python38 python39 python310 python3Minimal pypy27 pypy36;
 
   # Python package sets.
-  python27Packages = lib.hiPrioSet (recurseIntoAttrs python27.pkgs);
+  python27Packages = python27.pkgs;
   python36Packages = python36.pkgs;
   python37Packages = recurseIntoAttrs python37.pkgs;
   python38Packages = recurseIntoAttrs python38.pkgs;

From 6a23dde75bd9bb0cdcc58477439aaf1e146e3623 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 22 Nov 2020 13:13:23 +0100
Subject: [PATCH 42/67] Revert "cpython: fix finding headers when
 cross-compiling extension modules"

This breaks virtualenv https://github.com/NixOS/nixpkgs/issues/104483.
We should probably not move `_sysconfigdata` but just copy it for cross to
another place or output.

This reverts commit 11806b6ede420bbdb980ca1c36918b71e9ddc0a2.
---
 ...finding-headers-when-cross-compiling.patch | 54 ----------------
 ...finding-headers-when-cross-compiling.patch | 54 ----------------
 .../interpreters/python/cpython/default.nix   | 61 -------------------
 .../bootstrapped-pip/default.nix              |  2 +-
 4 files changed, 1 insertion(+), 170 deletions(-)
 delete mode 100644 pkgs/development/interpreters/python/cpython/3.6/fix-finding-headers-when-cross-compiling.patch
 delete mode 100644 pkgs/development/interpreters/python/cpython/3.7/fix-finding-headers-when-cross-compiling.patch

diff --git a/pkgs/development/interpreters/python/cpython/3.6/fix-finding-headers-when-cross-compiling.patch b/pkgs/development/interpreters/python/cpython/3.6/fix-finding-headers-when-cross-compiling.patch
deleted file mode 100644
index d324d10b39f..00000000000
--- a/pkgs/development/interpreters/python/cpython/3.6/fix-finding-headers-when-cross-compiling.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 45dfbbb4f5b67ab83e4365564ea569334e979f8e Mon Sep 17 00:00:00 2001
-From: Ben Wolsieffer <benwolsieffer@gmail.com>
-Date: Fri, 25 Sep 2020 16:49:16 -0400
-Subject: [PATCH] Fix finding headers when cross compiling
-
-When cross-compiling third-party extensions, get_python_inc() may be called to
-return the path to Python's headers. However, it uses the sys.prefix or
-sys.exec_prefix of the build Python, which returns incorrect paths when
-cross-compiling (paths pointing to build system headers).
-
-To fix this, we use the INCLUDEPY and CONFINCLUDEPY conf variables, which can
-be configured to point at host Python by setting _PYTHON_SYSCONFIGDATA_NAME.
-The existing behavior is maintained on non-POSIX platforms or if a prefix is
-manually specified.
----
- Lib/distutils/sysconfig.py | 14 ++++++++++----
- 1 file changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/Lib/distutils/sysconfig.py b/Lib/distutils/sysconfig.py
-index 2bcd1dd288..567375e488 100644
---- a/Lib/distutils/sysconfig.py
-+++ b/Lib/distutils/sysconfig.py
-@@ -84,8 +84,6 @@ def get_python_inc(plat_specific=0, prefix=None):
-     If 'prefix' is supplied, use it instead of sys.base_prefix or
-     sys.base_exec_prefix -- i.e., ignore 'plat_specific'.
-     """
--    if prefix is None:
--        prefix = plat_specific and BASE_EXEC_PREFIX or BASE_PREFIX
-     if os.name == "posix":
-         if python_build:
-             # Assume the executable is in the build directory.  The
-@@ -98,9 +96,17 @@ def get_python_inc(plat_specific=0, prefix=None):
-             else:
-                 incdir = os.path.join(get_config_var('srcdir'), 'Include')
-                 return os.path.normpath(incdir)
--        python_dir = 'python' + get_python_version() + build_flags
--        return os.path.join(prefix, "include", python_dir)
-+        if prefix is None:
-+          if plat_specific:
-+            return get_config_var('CONFINCLUDEPY')
-+          else:
-+            return get_config_var('INCLUDEPY')
-+        else:
-+          python_dir = 'python' + get_python_version() + build_flags
-+          return os.path.join(prefix, "include", python_dir)
-     elif os.name == "nt":
-+        if prefix is None:
-+          prefix = plat_specific and BASE_EXEC_PREFIX or BASE_PREFIX
-         return os.path.join(prefix, "include")
-     else:
-         raise DistutilsPlatformError(
--- 
-2.28.0
-
diff --git a/pkgs/development/interpreters/python/cpython/3.7/fix-finding-headers-when-cross-compiling.patch b/pkgs/development/interpreters/python/cpython/3.7/fix-finding-headers-when-cross-compiling.patch
deleted file mode 100644
index 543e267e94b..00000000000
--- a/pkgs/development/interpreters/python/cpython/3.7/fix-finding-headers-when-cross-compiling.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From debccd4be0a8d619770f63622d9de1b451dd02ac Mon Sep 17 00:00:00 2001
-From: Ben Wolsieffer <benwolsieffer@gmail.com>
-Date: Fri, 25 Sep 2020 16:49:16 -0400
-Subject: [PATCH] Fix finding headers when cross compiling
-
-When cross-compiling third-party extensions, get_python_inc() may be called to
-return the path to Python's headers. However, it uses the sys.prefix or
-sys.exec_prefix of the build Python, which returns incorrect paths when
-cross-compiling (paths pointing to build system headers).
-
-To fix this, we use the INCLUDEPY and CONFINCLUDEPY conf variables, which can
-be configured to point at host Python by setting _PYTHON_SYSCONFIGDATA_NAME.
-The existing behavior is maintained on non-POSIX platforms or if a prefix is
-manually specified.
----
- Lib/distutils/sysconfig.py | 14 ++++++++++----
- 1 file changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/Lib/distutils/sysconfig.py b/Lib/distutils/sysconfig.py
-index 37feae5df7..6d4ad06696 100644
---- a/Lib/distutils/sysconfig.py
-+++ b/Lib/distutils/sysconfig.py
-@@ -95,8 +95,6 @@ def get_python_inc(plat_specific=0, prefix=None):
-     If 'prefix' is supplied, use it instead of sys.base_prefix or
-     sys.base_exec_prefix -- i.e., ignore 'plat_specific'.
-     """
--    if prefix is None:
--        prefix = plat_specific and BASE_EXEC_PREFIX or BASE_PREFIX
-     if os.name == "posix":
-         if python_build:
-             # Assume the executable is in the build directory.  The
-@@ -109,9 +107,17 @@ def get_python_inc(plat_specific=0, prefix=None):
-             else:
-                 incdir = os.path.join(get_config_var('srcdir'), 'Include')
-                 return os.path.normpath(incdir)
--        python_dir = 'python' + get_python_version() + build_flags
--        return os.path.join(prefix, "include", python_dir)
-+        if prefix is None:
-+          if plat_specific:
-+            return get_config_var('CONFINCLUDEPY')
-+          else:
-+            return get_config_var('INCLUDEPY')
-+        else:
-+          python_dir = 'python' + get_python_version() + build_flags
-+          return os.path.join(prefix, "include", python_dir)
-     elif os.name == "nt":
-+        if prefix is None:
-+          prefix = plat_specific and BASE_EXEC_PREFIX or BASE_PREFIX
-         if python_build:
-             # Include both the include and PC dir to ensure we can find
-             # pyconfig.h
--- 
-2.28.0
-
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 62faab7e896..02777063a77 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -101,44 +101,6 @@ let
     "$out/bin/python"
   else pythonForBuild.interpreter;
 
-  # The CPython interpreter contains a _sysconfigdata_<platform specific suffix>
-  # module that is imported by the sysconfig and distutils.sysconfig modules.
-  # The sysconfigdata module is generated at build time and contains settings
-  # required for building Python extension modules, such as include paths and
-  # other compiler flags. By default, the sysconfigdata module is loaded from
-  # the currently running interpreter (ie. the build platform interpreter), but
-  # when cross-compiling we want to load it from the host platform interpreter.
-  # This can be done using the _PYTHON_SYSCONFIGDATA_NAME environment variable.
-  # The _PYTHON_HOST_PLATFORM variable also needs to be set to get the correct
-  # platform suffix on extension modules. The correct values for these variables
-  # are not documented, and must be derived from the configure script (see links
-  # below).
-  sysconfigdataHook = with stdenv.hostPlatform; let
-    # https://github.com/python/cpython/blob/e488e300f5c01289c10906c2e53a8e43d6de32d8/configure.ac#L428
-    pythonHostPlatform = "${parsed.kernel.name}-${parsed.cpu.name}";
-
-    # https://github.com/python/cpython/blob/e488e300f5c01289c10906c2e53a8e43d6de32d8/configure.ac#L724
-    multiarchCpu =
-      if isAarch32 then
-        if parsed.cpu.significantByte.name == "littleEndian" then "arm" else "armeb"
-      else parsed.cpu.name;
-    multiarch =
-      if isDarwin then "darwin"
-      else "${multiarchCpu}-${parsed.kernel.name}-${parsed.abi.name}";
-
-    # https://github.com/python/cpython/blob/e488e300f5c01289c10906c2e53a8e43d6de32d8/configure.ac#L78
-    pythonSysconfigdataName = "_sysconfigdata__${parsed.kernel.name}_${multiarch}";
-  in ''
-    sysconfigdataHook() {
-      if [ "$1" = '${placeholder "out"}' ]; then
-        export _PYTHON_HOST_PLATFORM='${pythonHostPlatform}'
-        export _PYTHON_SYSCONFIGDATA_NAME='${pythonSysconfigdataName}'
-      fi
-    }
-
-    addEnvHooks "$hostOffset" sysconfigdataHook
-  '';
-
 in with passthru; stdenv.mkDerivation {
   pname = "python3";
   inherit version;
@@ -204,13 +166,6 @@ in with passthru; stdenv.mkDerivation {
   ] ++ [
     # LDSHARED now uses $CC instead of gcc. Fixes cross-compilation of extension modules.
     ./3.8/0001-On-all-posix-systems-not-just-Darwin-set-LDSHARED-if.patch
-    # Use sysconfigdata to find headers. Fixes cross-compilation of extension modules.
-    (
-      if isPy36 then
-        ./3.6/fix-finding-headers-when-cross-compiling.patch
-      else
-        ./3.7/fix-finding-headers-when-cross-compiling.patch
-    )
   ];
 
   postPatch = ''
@@ -324,14 +279,6 @@ in with passthru; stdenv.mkDerivation {
     find $out/lib/python*/config-* -type f -print -exec nuke-refs -e $out '{}' +
     find $out/lib -name '_sysconfigdata*.py*' -print -exec nuke-refs -e $out '{}' +
 
-    # Make the sysconfigdata module accessible on PYTHONPATH
-    # This allows build Python to import host Python's sysconfigdata
-    mkdir -p "$out/${sitePackages}"
-    mv "$out/lib/${libPrefix}"/_sysconfigdata*.py "$out/${sitePackages}"
-    if [ -d "$out/lib/${libPrefix}"/__pycache__ ]; then
-      mkdir -p "$out/${sitePackages}/__pycache__"
-      mv "$out/lib/${libPrefix}"/__pycache__/_sysconfigdata*.py* "$out/${sitePackages}/__pycache__"
-    fi
     '' + optionalString stripConfig ''
     rm -R $out/bin/python*-config $out/lib/python*/config-*
     '' + optionalString stripIdlelib ''
@@ -364,14 +311,6 @@ in with passthru; stdenv.mkDerivation {
     export PATH=${stdenv.lib.makeBinPath [ "$out" bash ]}:$PATH
   '';
 
-  # Add CPython specific setup-hook that configures distutils.sysconfig to
-  # always load sysconfigdata from host Python.
-  postFixup = ''
-    cat << "EOF" >> "$out/nix-support/setup-hook"
-    ${sysconfigdataHook}
-    EOF
-  '';
-
   # Enforce that we don't have references to the OpenSSL -dev package, which we
   # explicitly specify in our configure flags above.
   disallowedReferences =
diff --git a/pkgs/development/python-modules/bootstrapped-pip/default.nix b/pkgs/development/python-modules/bootstrapped-pip/default.nix
index 0d0117fa43c..04bac36cf5a 100644
--- a/pkgs/development/python-modules/bootstrapped-pip/default.nix
+++ b/pkgs/development/python-modules/bootstrapped-pip/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     mv wheel* wheel
     # Set up PYTHONPATH. The above folders need to be on PYTHONPATH
     # $out is where we are installing to and takes precedence
-    export PYTHONPATH="$out/${python.sitePackages}:$(pwd)/pip/src:$(pwd)/setuptools:$(pwd)/setuptools/pkg_resources:$(pwd)/wheel:$PYTHONPATH"
+    export PYTHONPATH="$out/${python.sitePackages}:$(pwd)/pip/src:$(pwd)/setuptools:$(pwd)/setuptools/pkg_resources:$(pwd)/wheel"
 
     echo "Building setuptools wheel..."
     pushd setuptools

From 7726f81b13410fb8bb39e2de86c809fe87b276de Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 22 Nov 2020 13:17:19 +0100
Subject: [PATCH 43/67] python.tests: use self.callPackage instead of
 super.callPackage

super was incorrectly possible until https://github.com/NixOS/nixpkgs/pull/104201
got merged.
---
 .../interpreters/python/tests/test_nix_pythonprefix/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/python/tests/test_nix_pythonprefix/default.nix b/pkgs/development/interpreters/python/tests/test_nix_pythonprefix/default.nix
index 05798cbaf1b..572cbdccbfb 100644
--- a/pkgs/development/interpreters/python/tests/test_nix_pythonprefix/default.nix
+++ b/pkgs/development/interpreters/python/tests/test_nix_pythonprefix/default.nix
@@ -4,7 +4,7 @@ let
 
   python = let
     packageOverrides = self: super: {
-      typeddep = super.callPackage ./typeddep {};
+      typeddep = self.callPackage ./typeddep {};
     };
   in interpreter.override {inherit packageOverrides; self = python;};
 

From 80f1e61114c8fe50d0057c469ae5daad4f6762e6 Mon Sep 17 00:00:00 2001
From: andreoss <andreoss@sdf.org>
Date: Sun, 1 Nov 2020 06:54:35 +0300
Subject: [PATCH 44/67] adoptopenjdk: 8.0.252 -> 8.0.272, 11.0.7 -> 11.0.9, add
 14.0.2, add 15.0.1

Add latest openjdk releases.
---
 .../adoptopenjdk-bin/generate-sources.py      |   2 +-
 .../adoptopenjdk-bin/jdk-linux-base.nix       |   2 +-
 .../adoptopenjdk-bin/jdk14-darwin.nix         |   9 +
 .../adoptopenjdk-bin/jdk14-linux.nix          |   9 +
 .../adoptopenjdk-bin/jdk15-darwin.nix         |   9 +
 .../adoptopenjdk-bin/jdk15-linux.nix          |   9 +
 .../compilers/adoptopenjdk-bin/sources.json   | 508 ++++++++++++++----
 pkgs/top-level/all-packages.nix               |  36 ++
 8 files changed, 470 insertions(+), 114 deletions(-)
 create mode 100644 pkgs/development/compilers/adoptopenjdk-bin/jdk14-darwin.nix
 create mode 100644 pkgs/development/compilers/adoptopenjdk-bin/jdk14-linux.nix
 create mode 100644 pkgs/development/compilers/adoptopenjdk-bin/jdk15-darwin.nix
 create mode 100644 pkgs/development/compilers/adoptopenjdk-bin/jdk15-linux.nix

diff --git a/pkgs/development/compilers/adoptopenjdk-bin/generate-sources.py b/pkgs/development/compilers/adoptopenjdk-bin/generate-sources.py
index a7782610afb..63b807bd800 100755
--- a/pkgs/development/compilers/adoptopenjdk-bin/generate-sources.py
+++ b/pkgs/development/compilers/adoptopenjdk-bin/generate-sources.py
@@ -6,7 +6,7 @@ import re
 import requests
 import sys
 
-releases = ("openjdk8", "openjdk11", "openjdk13")
+releases = ("openjdk8", "openjdk11", "openjdk13", "openjdk14", "openjdk15")
 oses = ("mac", "linux")
 types = ("jre", "jdk")
 impls = ("hotspot", "openj9")
diff --git a/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix b/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
index d62224d518d..00945e32535 100644
--- a/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
@@ -29,7 +29,7 @@ let result = stdenv.mkDerivation rec {
 
   buildInputs = [
     alsaLib freetype fontconfig zlib xorg.libX11 xorg.libXext xorg.libXtst
-    xorg.libXi xorg.libXrender
+    xorg.libXi xorg.libXrender stdenv.cc.cc.lib
   ] ++ lib.optional stdenv.isAarch32 libffi;
 
   nativeBuildInputs = [ autoPatchelfHook ];
diff --git a/pkgs/development/compilers/adoptopenjdk-bin/jdk14-darwin.nix b/pkgs/development/compilers/adoptopenjdk-bin/jdk14-darwin.nix
new file mode 100644
index 00000000000..e440903ad52
--- /dev/null
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk14-darwin.nix
@@ -0,0 +1,9 @@
+let
+  sources = builtins.fromJSON (builtins.readFile ./sources.json);
+in
+{
+  jdk-hotspot = import ./jdk-darwin-base.nix sources.openjdk14.mac.jdk.hotspot;
+  jre-hotspot = import ./jdk-darwin-base.nix sources.openjdk14.mac.jre.hotspot;
+  jdk-openj9 = import ./jdk-darwin-base.nix sources.openjdk14.mac.jdk.openj9;
+  jre-openj9 = import ./jdk-darwin-base.nix sources.openjdk14.mac.jre.openj9;
+}
diff --git a/pkgs/development/compilers/adoptopenjdk-bin/jdk14-linux.nix b/pkgs/development/compilers/adoptopenjdk-bin/jdk14-linux.nix
new file mode 100644
index 00000000000..90ae65ba970
--- /dev/null
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk14-linux.nix
@@ -0,0 +1,9 @@
+let
+  sources = builtins.fromJSON (builtins.readFile ./sources.json);
+in
+{
+  jdk-hotspot = import ./jdk-linux-base.nix sources.openjdk14.linux.jdk.hotspot;
+  jre-hotspot = import ./jdk-linux-base.nix sources.openjdk14.linux.jre.hotspot;
+  jdk-openj9 = import ./jdk-linux-base.nix sources.openjdk14.linux.jdk.openj9;
+  jre-openj9 = import ./jdk-linux-base.nix sources.openjdk14.linux.jre.openj9;
+}
diff --git a/pkgs/development/compilers/adoptopenjdk-bin/jdk15-darwin.nix b/pkgs/development/compilers/adoptopenjdk-bin/jdk15-darwin.nix
new file mode 100644
index 00000000000..b9b67f271ac
--- /dev/null
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk15-darwin.nix
@@ -0,0 +1,9 @@
+let
+  sources = builtins.fromJSON (builtins.readFile ./sources.json);
+in
+{
+  jdk-hotspot = import ./jdk-darwin-base.nix sources.openjdk15.mac.jdk.hotspot;
+  jre-hotspot = import ./jdk-darwin-base.nix sources.openjdk15.mac.jre.hotspot;
+  jdk-openj9 = import ./jdk-darwin-base.nix sources.openjdk15.mac.jdk.openj9;
+  jre-openj9 = import ./jdk-darwin-base.nix sources.openjdk15.mac.jre.openj9;
+}
diff --git a/pkgs/development/compilers/adoptopenjdk-bin/jdk15-linux.nix b/pkgs/development/compilers/adoptopenjdk-bin/jdk15-linux.nix
new file mode 100644
index 00000000000..d48f9312dd6
--- /dev/null
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk15-linux.nix
@@ -0,0 +1,9 @@
+let
+  sources = builtins.fromJSON (builtins.readFile ./sources.json);
+in
+{
+  jdk-hotspot = import ./jdk-linux-base.nix sources.openjdk15.linux.jdk.hotspot;
+  jre-hotspot = import ./jdk-linux-base.nix sources.openjdk15.linux.jre.hotspot;
+  jdk-openj9 = import ./jdk-linux-base.nix sources.openjdk15.linux.jdk.openj9;
+  jre-openj9 = import ./jdk-linux-base.nix sources.openjdk15.linux.jre.openj9;
+}
diff --git a/pkgs/development/compilers/adoptopenjdk-bin/sources.json b/pkgs/development/compilers/adoptopenjdk-bin/sources.json
index 41e7a8eac7d..14c887554f8 100644
--- a/pkgs/development/compilers/adoptopenjdk-bin/sources.json
+++ b/pkgs/development/compilers/adoptopenjdk-bin/sources.json
@@ -4,92 +4,92 @@
       "jdk": {
         "hotspot": {
           "aarch64": {
-            "build": "10",
-            "sha256": "3b8b8bba6a0472ec7de5271cbf67f11e6ab525de6dd5d4729300375f1d56b7a1",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jdk_aarch64_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "f90c6f941a95e20e305870700328804e5b48acb69d4928dc9c4627b3c755ae8a",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1/OpenJDK11U-jdk_aarch64_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           },
           "armv6l": {
-            "build": "10",
-            "sha256": "45c235af67498f87e3dc99642771e57547cf226335eaee8a55d195173e66a2e9",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jdk_arm_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "082a13a9a5fbcf7ca45e67ab39e9682a9ef9e3779395e37aa0bf235e42a8eaf5",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11/OpenJDK11U-jdk_arm_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           },
           "armv7l": {
-            "build": "10",
-            "sha256": "45c235af67498f87e3dc99642771e57547cf226335eaee8a55d195173e66a2e9",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jdk_arm_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "082a13a9a5fbcf7ca45e67ab39e9682a9ef9e3779395e37aa0bf235e42a8eaf5",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11/OpenJDK11U-jdk_arm_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "10",
-            "sha256": "ee60304d782c9d5654bf1a6b3f38c683921c1711045e1db94525a51b7024a2ca",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jdk_x64_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "a3c52b73a76bed0f113604165eb4f2020b767e188704d8cc0bfc8bc4eb596712",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1/OpenJDK11U-jdk_x64_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           }
         },
         "openj9": {
           "aarch64": {
-            "build": "10",
-            "sha256": "0be01fdcae330e26c489d8d0d0c98c535a2af8cbd0cdcda211776ab9fcd05086",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10_openj9-0.20.0/OpenJDK11U-jdk_aarch64_linux_openj9_11.0.7_10_openj9-0.20.0.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "f0426b6d37085d471a7f577ce6f28af7cc8fe35b9b0b09a5111eccaed80a0447",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11_openj9-0.23.0/OpenJDK11U-jdk_aarch64_linux_openj9_11.0.9_11_openj9-0.23.0.tar.gz",
+            "version": "11.0.9"
           },
           "packageType": "jdk",
           "vmType": "openj9",
           "x86_64": {
-            "build": "10",
-            "sha256": "526e89f3014fec473b24c10c2464c1343e23703114983fd171b68b1599bba561",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10_openj9-0.20.0/OpenJDK11U-jdk_x64_linux_openj9_11.0.7_10_openj9-0.20.0.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "812d58fac39465802039291a1bc530b4feaaa61b58664d9c458a075921ae8091",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11_openj9-0.23.0/OpenJDK11U-jdk_x64_linux_openj9_11.0.9_11_openj9-0.23.0.tar.gz",
+            "version": "11.0.9"
           }
         }
       },
       "jre": {
         "hotspot": {
           "aarch64": {
-            "build": "10",
-            "sha256": "cfe504e9e9621b831a5cfd800a2005dafe90a1d11aa14ee35d7b674d68685698",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jre_aarch64_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "89b9b3108afda968a97961c5602a896bae31fea7c95195b54be5ad68b3af9e45",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1/OpenJDK11U-jre_aarch64_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           },
           "armv6l": {
-            "build": "10",
-            "sha256": "581bae8efcaa40e209a780baa6f96b7c8c9397965bc6d54533f4fd8599d5c742",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jre_arm_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "8e52de3c7a24edb74e423631fa90a09f7af3193aa9e6e4837b337192669530b0",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11/OpenJDK11U-jre_arm_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           },
           "armv7l": {
-            "build": "10",
-            "sha256": "581bae8efcaa40e209a780baa6f96b7c8c9397965bc6d54533f4fd8599d5c742",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jre_arm_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "8e52de3c7a24edb74e423631fa90a09f7af3193aa9e6e4837b337192669530b0",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11/OpenJDK11U-jre_arm_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "10",
-            "sha256": "74b493dd8a884dcbee29682ead51b182d9d3e52b40c3d4cbb3167c2fd0063503",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jre_x64_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "2ed263b662afb8b5d2964d1c9941d20031d07e5af68679ebefdca35d40bb91b1",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1/OpenJDK11U-jre_x64_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           }
         },
         "openj9": {
           "aarch64": {
-            "build": "10",
-            "sha256": "37ae26443abb02d2ab041eced9be948f0d20db03183aaf3c159ef682eeeabf9b",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10_openj9-0.20.0/OpenJDK11U-jre_aarch64_linux_openj9_11.0.7_10_openj9-0.20.0.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "b73f406dba1560dc194ac891452a1aacc2ba3b3e5e7b55e91a64559f8c2d9539",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11_openj9-0.23.0/OpenJDK11U-jre_aarch64_linux_openj9_11.0.9_11_openj9-0.23.0.tar.gz",
+            "version": "11.0.9"
           },
           "packageType": "jre",
           "vmType": "openj9",
           "x86_64": {
-            "build": "10",
-            "sha256": "08258a767a6953bde21d15ef3c08e776d83257afa4acc52b55c70e1ac02f0489",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10_openj9-0.20.0/OpenJDK11U-jre_x64_linux_openj9_11.0.7_10_openj9-0.20.0.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "54c845c167c197ba789eb6c3508faa5b1c95c9abe2ac26878123b6eecc87a111",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11_openj9-0.23.0/OpenJDK11U-jre_x64_linux_openj9_11.0.9_11_openj9-0.23.0.tar.gz",
+            "version": "11.0.9"
           }
         }
       }
@@ -100,20 +100,20 @@
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "10",
-            "sha256": "0ab1e15e8bd1916423960e91b932d2b17f4c15b02dbdf9fa30e9423280d9e5cc",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jdk_x64_mac_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "7b21961ffb2649e572721a0dfad64169b490e987937b661cb4e13a594c21e764",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1/OpenJDK11U-jdk_x64_mac_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           }
         },
         "openj9": {
           "packageType": "jdk",
           "vmType": "openj9",
           "x86_64": {
-            "build": "10",
-            "sha256": "a0de749c37802cc233ac58ffde68191a4dc985c71b626e7c0ff53944f743427f",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10.2_openj9-0.20.0/OpenJDK11U-jdk_x64_mac_openj9_11.0.7_10_openj9-0.20.0.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "382238443d4495d976f9e1a66b0f6e3bc250d3d009b64d2c29d44022afd7e418",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1_openj9-0.23.0/OpenJDK11U-jdk_x64_mac_openj9_11.0.9_11_openj9-0.23.0.tar.gz",
+            "version": "11.0.9"
           }
         }
       },
@@ -122,20 +122,20 @@
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "10",
-            "sha256": "931a81f4bed38c48b364db57d4ebdd6e4b4ea1466e9bd0eaf8e0f1e47c4569e9",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jre_x64_mac_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "cd8965dc8dbd0b5b3b25b6a336857d9bb622965e039b77e3048bc825e5512e95",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1/OpenJDK11U-jre_x64_mac_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           }
         },
         "openj9": {
           "packageType": "jre",
           "vmType": "openj9",
           "x86_64": {
-            "build": "10",
-            "sha256": "0941d739e3230d1d83dc1ee54cff6d17d90331e4f275d00739cb78fba41c5b96",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10.2_openj9-0.20.0/OpenJDK11U-jre_x64_mac_openj9_11.0.7_10_openj9-0.20.0.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "33a868f12bbe9326f658e60abe48dac658df33578b3719f551355855a87d1911",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1_openj9-0.23.0/OpenJDK11U-jre_x64_mac_openj9_11.0.9_11_openj9-0.23.0.tar.gz",
+            "version": "11.0.9"
           }
         }
       }
@@ -259,45 +259,181 @@
       }
     }
   },
-  "openjdk8": {
+  "openjdk14": {
     "linux": {
       "jdk": {
         "hotspot": {
           "aarch64": {
-            "build": "9",
-            "sha256": "536bf397d98174b376da9ed49d2f659d65c7310318d8211444f4b7ba7c15e453",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jdk_aarch64_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "build": "12",
+            "sha256": "ee87e9f03b1fbe6f328429b78fe1a9f44900026d220c90dfd747fe0bcd62d904",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jdk_aarch64_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
           },
           "armv6l": {
-            "build": "9",
-            "sha256": "5b401ad3c9b246281bd6df34b1abaf75e10e5cad9c6b26b55232b016e90e411a",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jdk_arm_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "build": "12",
+            "sha256": "65f193496c6977ba7aed1563edc4b5be091b5ff03e3d790074bb4e389a034b36",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jdk_arm_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
           },
           "armv7l": {
-            "build": "9",
-            "sha256": "5b401ad3c9b246281bd6df34b1abaf75e10e5cad9c6b26b55232b016e90e411a",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jdk_arm_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "build": "12",
+            "sha256": "65f193496c6977ba7aed1563edc4b5be091b5ff03e3d790074bb4e389a034b36",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jdk_arm_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "9",
-            "sha256": "2b59b5282ff32bce7abba8ad6b9fde34c15a98f949ad8ae43e789bbd78fc8862",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jdk_x64_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "build": "12",
+            "sha256": "7d5ee7e06909b8a99c0d029f512f67b092597aa5b0e78c109bd59405bbfa74fe",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jdk_x64_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
           }
         },
         "openj9": {
           "packageType": "jdk",
           "vmType": "openj9",
           "x86_64": {
+            "build": "12",
+            "sha256": "306f7138cdb65daaf2596ec36cafbde72088144c83b2e964f0193662e6caf3be",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12_openj9-0.21.0/OpenJDK14U-jdk_x64_linux_openj9_14.0.2_12_openj9-0.21.0.tar.gz",
+            "version": "14.0.2"
+          }
+        }
+      },
+      "jre": {
+        "hotspot": {
+          "aarch64": {
+            "build": "12",
+            "sha256": "2b749ceead19d68dd7e3c28b143dc4f94bb0916378a98b7346e851318ea4da84",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jre_aarch64_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          },
+          "armv6l": {
+            "build": "12",
+            "sha256": "4468ecf74956783ae41a46e8ba023c003c69e4d111622944aad1af764a1bc4af",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jre_arm_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          },
+          "armv7l": {
+            "build": "12",
+            "sha256": "4468ecf74956783ae41a46e8ba023c003c69e4d111622944aad1af764a1bc4af",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jre_arm_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          },
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "12",
+            "sha256": "1107845947da56e6bdad0da0b79210a079a74ec5c806f815ec5db9d09e1a9236",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jre_x64_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          }
+        },
+        "openj9": {
+          "packageType": "jre",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "12",
+            "sha256": "3a137146a7b0bd8b029e72beb37c5fbb09dcfb9e33a10125076fff1555227cfd",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12_openj9-0.21.0/OpenJDK14U-jre_x64_linux_openj9_14.0.2_12_openj9-0.21.0.tar.gz",
+            "version": "14.0.2"
+          }
+        }
+      }
+    },
+    "mac": {
+      "jdk": {
+        "hotspot": {
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "12",
+            "sha256": "09b7e6ab5d5eb4b73813f4caa793a0b616d33794a17988fa6a6b7c972e8f3dd3",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jdk_x64_mac_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          }
+        },
+        "openj9": {
+          "packageType": "jdk",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "12",
+            "sha256": "95e6abcc12dde676ccd5ba65ab86f06ddaa22749dde00e31f4c6d3ea95277359",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12_openj9-0.21.0/OpenJDK14U-jdk_x64_mac_openj9_14.0.2_12_openj9-0.21.0.tar.gz",
+            "version": "14.0.2"
+          }
+        }
+      },
+      "jre": {
+        "hotspot": {
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "12",
+            "sha256": "e8b5196de8ecb2b136a28494c2888784b9d9e22e29d2c38528892fb7d0c95260",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jre_x64_mac_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          }
+        },
+        "openj9": {
+          "packageType": "jre",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "12",
+            "sha256": "2562a442d7278409358f474071db34df4ba9c555925f28d0270139f97133c8d5",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12_openj9-0.21.0/OpenJDK14U-jre_x64_mac_openj9_14.0.2_12_openj9-0.21.0.tar.gz",
+            "version": "14.0.2"
+          }
+        }
+      }
+    }
+  },
+  "openjdk15": {
+    "linux": {
+      "jdk": {
+        "hotspot": {
+          "aarch64": {
             "build": "9",
-            "sha256": "910ae847109a6dd1b6cf69baa7615ea2cce8cff787e5a9349a5331ce7604f3a5",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09_openj9-0.20.0/OpenJDK8U-jdk_x64_linux_openj9_8u252b09_openj9-0.20.0.tar.gz",
-            "version": "8.0.252"
+            "sha256": "84398a1566d66ee5a88f3326fb7f0b70504eb510190f8f798bdb386481a3900e",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jdk_aarch64_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
+          },
+          "armv6l": {
+            "build": "9",
+            "sha256": "bef5e9f4ab8a87645fa2b3d0ffb9f2b97374caa03cd1296597e8c86e8360d5a2",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jdk_arm_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
+          },
+          "armv7l": {
+            "build": "9",
+            "sha256": "bef5e9f4ab8a87645fa2b3d0ffb9f2b97374caa03cd1296597e8c86e8360d5a2",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jdk_arm_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
+          },
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "9",
+            "sha256": "61045ecb9434e3320dbc2c597715f9884586b7a18a56d29851b4d4a4d48a2a5e",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jdk_x64_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
+          }
+        },
+        "openj9": {
+          "aarch64": {
+            "build": "9",
+            "sha256": "6206643ec4a57597f73880423b72fc06c1018d92cc6b02972ec3ea3fe4d853a2",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9_openj9-0.23.0/OpenJDK15U-jdk_aarch64_linux_openj9_15.0.1_9_openj9-0.23.0.tar.gz",
+            "version": "15.0.1"
+          },
+          "packageType": "jdk",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "9",
+            "sha256": "b1561f7a69c977bfc9991e61e96dcb200c39300dd9ad423254af117c189e4a8d",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9_openj9-0.23.0/OpenJDK15U-jdk_x64_linux_openj9_15.0.1_9_openj9-0.23.0.tar.gz",
+            "version": "15.0.1"
           }
         }
       },
@@ -305,39 +441,45 @@
         "hotspot": {
           "aarch64": {
             "build": "9",
-            "sha256": "30bba4425497f5b4aabcba7b45db69d582d278fb17357d64c22c9dc6b2d29ca1",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jre_aarch64_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "9eecdd39239545b922878abf51015030ba9aed4dda5c4574ddbc669a71ddab31",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jre_aarch64_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           },
           "armv6l": {
             "build": "9",
-            "sha256": "107699a88f611e0c2d57816be25821ef9b17db860b14402c4e9e5bf0b9cf16fd",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jre_arm_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "f289d1b9fc05099889eaa9a52d352275d44698f3448153cc2ef05f2fa1c04cca",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jre_arm_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           },
           "armv7l": {
             "build": "9",
-            "sha256": "107699a88f611e0c2d57816be25821ef9b17db860b14402c4e9e5bf0b9cf16fd",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jre_arm_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "f289d1b9fc05099889eaa9a52d352275d44698f3448153cc2ef05f2fa1c04cca",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jre_arm_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "a93be303ed62398dba9acb0376fb3caf8f488fcde80dc62d0a8e46256b3adfb1",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jre_x64_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "e619197c7a5757631f6ea9c912ab47528ebf64c27cf788cdad22bc9245779411",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jre_x64_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           }
         },
         "openj9": {
+          "aarch64": {
+            "build": "9",
+            "sha256": "1db3c28e8c423d005fcf3b0c8a081061e56c51966273e32e3930d4c57c21bf49",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9_openj9-0.23.0/OpenJDK15U-jre_aarch64_linux_openj9_15.0.1_9_openj9-0.23.0.tar.gz",
+            "version": "15.0.1"
+          },
           "packageType": "jre",
           "vmType": "openj9",
           "x86_64": {
             "build": "9",
-            "sha256": "5c0ab4691ff5f8e69bb14462f2afb8d73d751b01048eacf4b426ed6d6646dc63",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09_openj9-0.20.0/OpenJDK8U-jre_x64_linux_openj9_8u252b09_openj9-0.20.0.tar.gz",
-            "version": "8.0.252"
+            "sha256": "e47fdadfe91f554f3e343b24e678b6862673f9b1dce3703efd1447950188357b",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9_openj9-0.23.0/OpenJDK15U-jre_x64_linux_openj9_15.0.1_9_openj9-0.23.0.tar.gz",
+            "version": "15.0.1"
           }
         }
       }
@@ -349,9 +491,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "2caed3ec07d108bda613f9b4614b22a8bdd196ccf2a432a126161cd4077f07a5",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09.1/OpenJDK8U-jdk_x64_mac_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "d32f9429c4992cef7be559a15c542011503d6bc38c89379800cd209a9d7ec539",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jdk_x64_mac_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           }
         },
         "openj9": {
@@ -359,9 +501,9 @@
           "vmType": "openj9",
           "x86_64": {
             "build": "9",
-            "sha256": "f522061a23290bce3423e49025a95b6e78d6f30e2741817e83c8fdba4c0c4ae7",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09.2_openj9-0.20.0/OpenJDK8U-jdk_x64_mac_openj9_8u252b09_openj9-0.20.0.tar.gz",
-            "version": "8.0.252"
+            "sha256": "c9b19fd1fda9c581aa0bcddbf5f821204c351a1de29da1c5aa51cb680ee99517",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9.1_openj9-0.23.0/OpenJDK15U-jdk_x64_mac_openj9_15.0.1_9_openj9-0.23.0.tar.gz",
+            "version": "15.0.1"
           }
         }
       },
@@ -371,9 +513,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "f8206f0fef194c598de6b206a4773b2e517154913ea0e26c5726091562a034c8",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09.1/OpenJDK8U-jre_x64_mac_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "fde1713fc51e824a08f8eeb5e2b8a2acf21424d5f9a0e70cfd2e85a77c827bc4",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jre_x64_mac_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           }
         },
         "openj9": {
@@ -381,12 +523,154 @@
           "vmType": "openj9",
           "x86_64": {
             "build": "9",
-            "sha256": "55cce54a39c5748360e2e3fe8edf04469b75a0783514853a5745463979b43c80",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09.2_openj9-0.20.0/OpenJDK8U-jre_x64_mac_openj9_8u252b09_openj9-0.20.0.tar.gz",
-            "version": "8.0.252"
+            "sha256": "e7c3710d6cc23480ac66eba79b48d9e2bebec34ba688f3053bb5eba406a2c315",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9.1_openj9-0.23.0/OpenJDK15U-jre_x64_mac_openj9_15.0.1_9_openj9-0.23.0.tar.gz",
+            "version": "15.0.1"
+          }
+        }
+      }
+    }
+  },
+  "openjdk8": {
+    "linux": {
+      "jdk": {
+        "hotspot": {
+          "aarch64": {
+            "build": "10",
+            "sha256": "cfbde5191027c6d25af44af8a3d64625c6e22422dea8c4af6fe9240e7e249baa",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jdk_aarch64_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          },
+          "armv6l": {
+            "build": "10",
+            "sha256": "b005e9e8a912aa6605debdea3685a223c077d5a4ba7c90bca02d804c5f39d0b9",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jdk_arm_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          },
+          "armv7l": {
+            "build": "10",
+            "sha256": "b005e9e8a912aa6605debdea3685a223c077d5a4ba7c90bca02d804c5f39d0b9",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jdk_arm_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          },
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "10",
+            "sha256": "6f124b69d07d8d3edf39b9aa5c58473f63a380b686ddb73a5495e01d25c2939a",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jdk_x64_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          }
+        },
+        "openj9": {
+          "aarch64": {
+            "build": "10",
+            "sha256": "bbc78dc8caf25372578a95287bcf672c4bf62af23939d4a988634b2a1356cd89",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10_openj9-0.23.0/OpenJDK8U-jdk_aarch64_linux_openj9_8u272b10_openj9-0.23.0.tar.gz",
+            "version": "8.0.272"
+          },
+          "packageType": "jdk",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "10",
+            "sha256": "ca852f976e5b27ccd9b73a527a517496bda865b2ae2a85517ca74486fb8de7da",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10_openj9-0.23.0/OpenJDK8U-jdk_x64_linux_openj9_8u272b10_openj9-0.23.0.tar.gz",
+            "version": "8.0.272"
+          }
+        }
+      },
+      "jre": {
+        "hotspot": {
+          "aarch64": {
+            "build": "10",
+            "sha256": "ed3a862d83dd1f19037fc6ccf73500f2ecf453eb245af8b70bec3fb80d084289",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jre_aarch64_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          },
+          "armv6l": {
+            "build": "10",
+            "sha256": "906113d909d81b930c4eb519512d1cc9f9be9789dfd349128d6e7efaeeb36e1c",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jre_arm_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          },
+          "armv7l": {
+            "build": "10",
+            "sha256": "906113d909d81b930c4eb519512d1cc9f9be9789dfd349128d6e7efaeeb36e1c",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jre_arm_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          },
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "10",
+            "sha256": "e6894601a559c5226c6dc337308df263444d356a6430f4aabb66e02607c82956",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jre_x64_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          }
+        },
+        "openj9": {
+          "aarch64": {
+            "build": "10",
+            "sha256": "b0891c3493a9fc6135700d065a826fc67223d54e9d0da3c41b57e6cb6897b726",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10_openj9-0.23.0/OpenJDK8U-jre_aarch64_linux_openj9_8u272b10_openj9-0.23.0.tar.gz",
+            "version": "8.0.272"
+          },
+          "packageType": "jre",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "10",
+            "sha256": "a4e58f3c15ca3bc15cb3aaa9f116de972809ca52ae81e0726f84c059442174d5",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10_openj9-0.23.0/OpenJDK8U-jre_x64_linux_openj9_8u272b10_openj9-0.23.0.tar.gz",
+            "version": "8.0.272"
+          }
+        }
+      }
+    },
+    "mac": {
+      "jdk": {
+        "hotspot": {
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "10",
+            "sha256": "091f9ee39b0bdbc8af8ec19f51aaa0f73e416c2e93a8fb2c79b82f4caac83ab6",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jdk_x64_mac_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          }
+        },
+        "openj9": {
+          "packageType": "jdk",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "10",
+            "sha256": "bbd66ec27a4ea9b0b0952f501e1837e69c24262f64b316dab0408d1a8633a527",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10.1_openj9-0.23.0/OpenJDK8U-jdk_x64_mac_openj9_8u272b10_openj9-0.23.0.tar.gz",
+            "version": "8.0.272"
+          }
+        }
+      },
+      "jre": {
+        "hotspot": {
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "10",
+            "sha256": "afb9c08cb8b93d8e7d4f1e48ced3d43cfb3082491595a2eaf1f00c48abd25428",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jre_x64_mac_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          }
+        },
+        "openj9": {
+          "packageType": "jre",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "10",
+            "sha256": "4d90e85240113189d897a86731e672b37a6e345c056f35c7719cb27f3d08385b",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10.1_openj9-0.23.0/OpenJDK8U-jre_x64_mac_openj9_8u272b10_openj9-0.23.0.tar.gz",
+            "version": "8.0.272"
           }
         }
       }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4538e9ae0e2..3f9be4850fc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8550,6 +8550,42 @@ in
     jdk = jdk8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
   };
 
+  adoptopenjdk-bin-15-packages-linux = import ../development/compilers/adoptopenjdk-bin/jdk15-linux.nix;
+  adoptopenjdk-bin-15-packages-darwin = import ../development/compilers/adoptopenjdk-bin/jdk15-darwin.nix;
+
+  adoptopenjdk-hotspot-bin-15 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-15-packages-linux.jdk-hotspot {}
+    else callPackage adoptopenjdk-bin-15-packages-darwin.jdk-hotspot {};
+  adoptopenjdk-jre-hotspot-bin-15 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-15-packages-linux.jre-hotspot {}
+    else callPackage adoptopenjdk-bin-15-packages-darwin.jre-hotspot {};
+
+  adoptopenjdk-openj9-bin-15 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-15-packages-linux.jdk-openj9 {}
+    else callPackage adoptopenjdk-bin-15-packages-darwin.jdk-openj9 {};
+
+  adoptopenjdk-jre-openj9-bin-15 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-15-packages-linux.jre-openj9 {}
+    else callPackage adoptopenjdk-bin-15-packages-darwin.jre-openj9 {};
+
+  adoptopenjdk-bin-14-packages-linux = import ../development/compilers/adoptopenjdk-bin/jdk14-linux.nix;
+  adoptopenjdk-bin-14-packages-darwin = import ../development/compilers/adoptopenjdk-bin/jdk14-darwin.nix;
+
+  adoptopenjdk-hotspot-bin-14 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-14-packages-linux.jdk-hotspot {}
+    else callPackage adoptopenjdk-bin-14-packages-darwin.jdk-hotspot {};
+  adoptopenjdk-jre-hotspot-bin-14 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-14-packages-linux.jre-hotspot {}
+    else callPackage adoptopenjdk-bin-14-packages-darwin.jre-hotspot {};
+
+  adoptopenjdk-openj9-bin-14 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-14-packages-linux.jdk-openj9 {}
+    else callPackage adoptopenjdk-bin-14-packages-darwin.jdk-openj9 {};
+
+  adoptopenjdk-jre-openj9-bin-14 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-14-packages-linux.jre-openj9 {}
+    else callPackage adoptopenjdk-bin-14-packages-darwin.jre-openj9 {};
+
   adoptopenjdk-bin-13-packages-linux = import ../development/compilers/adoptopenjdk-bin/jdk13-linux.nix;
   adoptopenjdk-bin-13-packages-darwin = import ../development/compilers/adoptopenjdk-bin/jdk13-darwin.nix;
 

From 6100bc29f72b85332014bb4362721eda379e0e03 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 22 Nov 2020 13:19:16 +0100
Subject: [PATCH 45/67] Revert "Revert "cpython: fix finding headers when
 cross-compiling extension modules""

Moving the sysconfig file caused spidermonkey_78 to fail to build. We now symlink it instead.

This reverts commit 6a23dde75bd9bb0cdcc58477439aaf1e146e3623.
---
 ...finding-headers-when-cross-compiling.patch | 54 ++++++++++++++++++
 ...finding-headers-when-cross-compiling.patch | 54 ++++++++++++++++++
 .../interpreters/python/cpython/default.nix   | 57 +++++++++++++++++++
 .../bootstrapped-pip/default.nix              |  2 +-
 4 files changed, 166 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/interpreters/python/cpython/3.6/fix-finding-headers-when-cross-compiling.patch
 create mode 100644 pkgs/development/interpreters/python/cpython/3.7/fix-finding-headers-when-cross-compiling.patch

diff --git a/pkgs/development/interpreters/python/cpython/3.6/fix-finding-headers-when-cross-compiling.patch b/pkgs/development/interpreters/python/cpython/3.6/fix-finding-headers-when-cross-compiling.patch
new file mode 100644
index 00000000000..d324d10b39f
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/3.6/fix-finding-headers-when-cross-compiling.patch
@@ -0,0 +1,54 @@
+From 45dfbbb4f5b67ab83e4365564ea569334e979f8e Mon Sep 17 00:00:00 2001
+From: Ben Wolsieffer <benwolsieffer@gmail.com>
+Date: Fri, 25 Sep 2020 16:49:16 -0400
+Subject: [PATCH] Fix finding headers when cross compiling
+
+When cross-compiling third-party extensions, get_python_inc() may be called to
+return the path to Python's headers. However, it uses the sys.prefix or
+sys.exec_prefix of the build Python, which returns incorrect paths when
+cross-compiling (paths pointing to build system headers).
+
+To fix this, we use the INCLUDEPY and CONFINCLUDEPY conf variables, which can
+be configured to point at host Python by setting _PYTHON_SYSCONFIGDATA_NAME.
+The existing behavior is maintained on non-POSIX platforms or if a prefix is
+manually specified.
+---
+ Lib/distutils/sysconfig.py | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/Lib/distutils/sysconfig.py b/Lib/distutils/sysconfig.py
+index 2bcd1dd288..567375e488 100644
+--- a/Lib/distutils/sysconfig.py
++++ b/Lib/distutils/sysconfig.py
+@@ -84,8 +84,6 @@ def get_python_inc(plat_specific=0, prefix=None):
+     If 'prefix' is supplied, use it instead of sys.base_prefix or
+     sys.base_exec_prefix -- i.e., ignore 'plat_specific'.
+     """
+-    if prefix is None:
+-        prefix = plat_specific and BASE_EXEC_PREFIX or BASE_PREFIX
+     if os.name == "posix":
+         if python_build:
+             # Assume the executable is in the build directory.  The
+@@ -98,9 +96,17 @@ def get_python_inc(plat_specific=0, prefix=None):
+             else:
+                 incdir = os.path.join(get_config_var('srcdir'), 'Include')
+                 return os.path.normpath(incdir)
+-        python_dir = 'python' + get_python_version() + build_flags
+-        return os.path.join(prefix, "include", python_dir)
++        if prefix is None:
++          if plat_specific:
++            return get_config_var('CONFINCLUDEPY')
++          else:
++            return get_config_var('INCLUDEPY')
++        else:
++          python_dir = 'python' + get_python_version() + build_flags
++          return os.path.join(prefix, "include", python_dir)
+     elif os.name == "nt":
++        if prefix is None:
++          prefix = plat_specific and BASE_EXEC_PREFIX or BASE_PREFIX
+         return os.path.join(prefix, "include")
+     else:
+         raise DistutilsPlatformError(
+-- 
+2.28.0
+
diff --git a/pkgs/development/interpreters/python/cpython/3.7/fix-finding-headers-when-cross-compiling.patch b/pkgs/development/interpreters/python/cpython/3.7/fix-finding-headers-when-cross-compiling.patch
new file mode 100644
index 00000000000..543e267e94b
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/3.7/fix-finding-headers-when-cross-compiling.patch
@@ -0,0 +1,54 @@
+From debccd4be0a8d619770f63622d9de1b451dd02ac Mon Sep 17 00:00:00 2001
+From: Ben Wolsieffer <benwolsieffer@gmail.com>
+Date: Fri, 25 Sep 2020 16:49:16 -0400
+Subject: [PATCH] Fix finding headers when cross compiling
+
+When cross-compiling third-party extensions, get_python_inc() may be called to
+return the path to Python's headers. However, it uses the sys.prefix or
+sys.exec_prefix of the build Python, which returns incorrect paths when
+cross-compiling (paths pointing to build system headers).
+
+To fix this, we use the INCLUDEPY and CONFINCLUDEPY conf variables, which can
+be configured to point at host Python by setting _PYTHON_SYSCONFIGDATA_NAME.
+The existing behavior is maintained on non-POSIX platforms or if a prefix is
+manually specified.
+---
+ Lib/distutils/sysconfig.py | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/Lib/distutils/sysconfig.py b/Lib/distutils/sysconfig.py
+index 37feae5df7..6d4ad06696 100644
+--- a/Lib/distutils/sysconfig.py
++++ b/Lib/distutils/sysconfig.py
+@@ -95,8 +95,6 @@ def get_python_inc(plat_specific=0, prefix=None):
+     If 'prefix' is supplied, use it instead of sys.base_prefix or
+     sys.base_exec_prefix -- i.e., ignore 'plat_specific'.
+     """
+-    if prefix is None:
+-        prefix = plat_specific and BASE_EXEC_PREFIX or BASE_PREFIX
+     if os.name == "posix":
+         if python_build:
+             # Assume the executable is in the build directory.  The
+@@ -109,9 +107,17 @@ def get_python_inc(plat_specific=0, prefix=None):
+             else:
+                 incdir = os.path.join(get_config_var('srcdir'), 'Include')
+                 return os.path.normpath(incdir)
+-        python_dir = 'python' + get_python_version() + build_flags
+-        return os.path.join(prefix, "include", python_dir)
++        if prefix is None:
++          if plat_specific:
++            return get_config_var('CONFINCLUDEPY')
++          else:
++            return get_config_var('INCLUDEPY')
++        else:
++          python_dir = 'python' + get_python_version() + build_flags
++          return os.path.join(prefix, "include", python_dir)
+     elif os.name == "nt":
++        if prefix is None:
++          prefix = plat_specific and BASE_EXEC_PREFIX or BASE_PREFIX
+         if python_build:
+             # Include both the include and PC dir to ensure we can find
+             # pyconfig.h
+-- 
+2.28.0
+
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 02777063a77..4b4ff836095 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -101,6 +101,44 @@ let
     "$out/bin/python"
   else pythonForBuild.interpreter;
 
+  # The CPython interpreter contains a _sysconfigdata_<platform specific suffix>
+  # module that is imported by the sysconfig and distutils.sysconfig modules.
+  # The sysconfigdata module is generated at build time and contains settings
+  # required for building Python extension modules, such as include paths and
+  # other compiler flags. By default, the sysconfigdata module is loaded from
+  # the currently running interpreter (ie. the build platform interpreter), but
+  # when cross-compiling we want to load it from the host platform interpreter.
+  # This can be done using the _PYTHON_SYSCONFIGDATA_NAME environment variable.
+  # The _PYTHON_HOST_PLATFORM variable also needs to be set to get the correct
+  # platform suffix on extension modules. The correct values for these variables
+  # are not documented, and must be derived from the configure script (see links
+  # below).
+  sysconfigdataHook = with stdenv.hostPlatform; let
+    # https://github.com/python/cpython/blob/e488e300f5c01289c10906c2e53a8e43d6de32d8/configure.ac#L428
+    pythonHostPlatform = "${parsed.kernel.name}-${parsed.cpu.name}";
+
+    # https://github.com/python/cpython/blob/e488e300f5c01289c10906c2e53a8e43d6de32d8/configure.ac#L724
+    multiarchCpu =
+      if isAarch32 then
+        if parsed.cpu.significantByte.name == "littleEndian" then "arm" else "armeb"
+      else parsed.cpu.name;
+    multiarch =
+      if isDarwin then "darwin"
+      else "${multiarchCpu}-${parsed.kernel.name}-${parsed.abi.name}";
+
+    # https://github.com/python/cpython/blob/e488e300f5c01289c10906c2e53a8e43d6de32d8/configure.ac#L78
+    pythonSysconfigdataName = "_sysconfigdata__${parsed.kernel.name}_${multiarch}";
+  in ''
+    sysconfigdataHook() {
+      if [ "$1" = '${placeholder "out"}' ]; then
+        export _PYTHON_HOST_PLATFORM='${pythonHostPlatform}'
+        export _PYTHON_SYSCONFIGDATA_NAME='${pythonSysconfigdataName}'
+      fi
+    }
+
+    addEnvHooks "$hostOffset" sysconfigdataHook
+  '';
+
 in with passthru; stdenv.mkDerivation {
   pname = "python3";
   inherit version;
@@ -166,6 +204,13 @@ in with passthru; stdenv.mkDerivation {
   ] ++ [
     # LDSHARED now uses $CC instead of gcc. Fixes cross-compilation of extension modules.
     ./3.8/0001-On-all-posix-systems-not-just-Darwin-set-LDSHARED-if.patch
+    # Use sysconfigdata to find headers. Fixes cross-compilation of extension modules.
+    (
+      if isPy36 then
+        ./3.6/fix-finding-headers-when-cross-compiling.patch
+      else
+        ./3.7/fix-finding-headers-when-cross-compiling.patch
+    )
   ];
 
   postPatch = ''
@@ -279,6 +324,10 @@ in with passthru; stdenv.mkDerivation {
     find $out/lib/python*/config-* -type f -print -exec nuke-refs -e $out '{}' +
     find $out/lib -name '_sysconfigdata*.py*' -print -exec nuke-refs -e $out '{}' +
 
+    # Make the sysconfigdata module accessible on PYTHONPATH
+    # This allows build Python to import host Python's sysconfigdata
+    mkdir -p "$out/${sitePackages}"
+    ln -s "$out/lib/${libPrefix}/"_sysconfigdata*.py "$out/${sitePackages}/"
     '' + optionalString stripConfig ''
     rm -R $out/bin/python*-config $out/lib/python*/config-*
     '' + optionalString stripIdlelib ''
@@ -311,6 +360,14 @@ in with passthru; stdenv.mkDerivation {
     export PATH=${stdenv.lib.makeBinPath [ "$out" bash ]}:$PATH
   '';
 
+  # Add CPython specific setup-hook that configures distutils.sysconfig to
+  # always load sysconfigdata from host Python.
+  postFixup = ''
+    cat << "EOF" >> "$out/nix-support/setup-hook"
+    ${sysconfigdataHook}
+    EOF
+  '';
+
   # Enforce that we don't have references to the OpenSSL -dev package, which we
   # explicitly specify in our configure flags above.
   disallowedReferences =
diff --git a/pkgs/development/python-modules/bootstrapped-pip/default.nix b/pkgs/development/python-modules/bootstrapped-pip/default.nix
index 04bac36cf5a..0d0117fa43c 100644
--- a/pkgs/development/python-modules/bootstrapped-pip/default.nix
+++ b/pkgs/development/python-modules/bootstrapped-pip/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     mv wheel* wheel
     # Set up PYTHONPATH. The above folders need to be on PYTHONPATH
     # $out is where we are installing to and takes precedence
-    export PYTHONPATH="$out/${python.sitePackages}:$(pwd)/pip/src:$(pwd)/setuptools:$(pwd)/setuptools/pkg_resources:$(pwd)/wheel"
+    export PYTHONPATH="$out/${python.sitePackages}:$(pwd)/pip/src:$(pwd)/setuptools:$(pwd)/setuptools/pkg_resources:$(pwd)/wheel:$PYTHONPATH"
 
     echo "Building setuptools wheel..."
     pushd setuptools

From 95d9ff16f3c47324d7fb7d162f6794b5d9023265 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 22 Nov 2020 22:37:58 +0100
Subject: [PATCH 46/67] python.tests: not when cross-compiling

Running the tests is not possible when cross-compiling.
---
 pkgs/development/interpreters/python/tests.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/python/tests.nix b/pkgs/development/interpreters/python/tests.nix
index dcfa41cc308..a291919b327 100644
--- a/pkgs/development/interpreters/python/tests.nix
+++ b/pkgs/development/interpreters/python/tests.nix
@@ -1,4 +1,5 @@
-{ python
+{ stdenv
+, python
 , runCommand
 , substituteAll
 , lib
@@ -92,4 +93,4 @@ let
 
 
 
-in environmentTests // integrationTests
+in stdenv.lib.optionalAttrs (stdenv.hostPlatform == stdenv.buildPlatform ) (environmentTests // integrationTests)

From f5d9dd30509548a4a22dadba66dc1799e7140724 Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Fri, 20 Nov 2020 10:51:07 -0800
Subject: [PATCH 47/67] python/hooks/pythonNamespaces: fix __pycache__ logic

---
 .../interpreters/python/hooks/default.nix           |  3 ++-
 .../python/hooks/python-namespaces-hook.sh          | 13 ++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index 456aea4c5d8..1a64c79232b 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -5,6 +5,7 @@
 , disabledIf
 , isPy3k
 , ensureNewerSourcesForZipFilesHook
+, findutils
 }:
 
 let
@@ -94,7 +95,7 @@ in rec {
     makeSetupHook {
       name = "python-namespaces-hook.sh";
       substitutions = {
-        inherit pythonSitePackages;
+        inherit pythonSitePackages findutils;
       };
     } ./python-namespaces-hook.sh) {};
 
diff --git a/pkgs/development/interpreters/python/hooks/python-namespaces-hook.sh b/pkgs/development/interpreters/python/hooks/python-namespaces-hook.sh
index 50f21819d17..ebc94e076c8 100644
--- a/pkgs/development/interpreters/python/hooks/python-namespaces-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-namespaces-hook.sh
@@ -17,17 +17,16 @@ pythonNamespacesHook() {
         for pathSegment in ${pathSegments[@]}; do
             constructedPath=${constructedPath}/${pathSegment}
             pathToRemove=${constructedPath}/__init__.py
-            pycachePath=${constructedPath}/__pycache__/__init__*
+            pycachePath=${constructedPath}/__pycache__/
 
+            # remove __init__.py
             if [ -f "$pathToRemove" ]; then
-                echo "Removing $pathToRemove"
-                rm "$pathToRemove"
+                rm -v "$pathToRemove"
             fi
 
-            if [ -f "$pycachePath" ]; then
-                echo "Removing $pycachePath"
-                rm "$pycachePath"
-            fi
+            # remove __pycache__/ entry, can be interpreter specific. E.g. __init__.cpython-38.pyc
+            # use null characters to perserve potential whitespace in filepath
+            @findutils@/bin/find $pycachePath -name '__init__*' -print0 | xargs -0 rm -v
         done
     done
 

From 6192e912d85b39ab57cd5f39330c7d527afd9789 Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Fri, 20 Nov 2020 10:51:30 -0800
Subject: [PATCH 48/67] python3Packages.jaraco_functools: enforce jaraco
 namespace

---
 pkgs/development/python-modules/jaraco_functools/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/jaraco_functools/default.nix b/pkgs/development/python-modules/jaraco_functools/default.nix
index 6ee4c241710..eb176d0d857 100644
--- a/pkgs/development/python-modules/jaraco_functools/default.nix
+++ b/pkgs/development/python-modules/jaraco_functools/default.nix
@@ -17,6 +17,8 @@ buildPythonPackage rec {
 
   doCheck = false;
 
+  pythonNamespaces = [ "jaraco" ];
+
   meta = with lib; {
     description = "Additional functools in the spirit of stdlib's functools";
     homepage = "https://github.com/jaraco/jaraco.functools";

From 02ac13b563c082eaa51e8acdbe492a7961231836 Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Fri, 20 Nov 2020 10:52:15 -0800
Subject: [PATCH 49/67] python3Packages.jaraco_text: enforce jaraco namespace

---
 pkgs/development/python-modules/jaraco_text/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/jaraco_text/default.nix b/pkgs/development/python-modules/jaraco_text/default.nix
index 9b3821edd7a..c61c8f689dd 100644
--- a/pkgs/development/python-modules/jaraco_text/default.nix
+++ b/pkgs/development/python-modules/jaraco_text/default.nix
@@ -13,6 +13,8 @@ buildPythonPackage rec {
     sha256 = "1v0hz3h74m31jlbc5bxwkvrx1h2n7887bajrg1n1c3yc4q8qn1z5";
   };
 
+  pythonNamespaces = [ "jaraco" ];
+
   nativeBuildInputs =[ setuptools_scm ];
   propagatedBuildInputs = [
     jaraco_functools

From 3daabe0ca3789464707683adad279d04fea06979 Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Fri, 20 Nov 2020 10:53:11 -0800
Subject: [PATCH 50/67] python3Packages.jaraco_stream: enforce jaraco namespace

---
 pkgs/development/python-modules/jaraco_stream/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/jaraco_stream/default.nix b/pkgs/development/python-modules/jaraco_stream/default.nix
index 324eb625014..9a4f6d97245 100644
--- a/pkgs/development/python-modules/jaraco_stream/default.nix
+++ b/pkgs/development/python-modules/jaraco_stream/default.nix
@@ -3,10 +3,14 @@
 buildPythonPackage rec {
   pname = "jaraco.stream";
   version = "3.0.0";
+
   src = fetchPypi {
     inherit pname version;
     sha256 = "287e1cba9f278e0146fdded6bc40518930813a5584579769aeaa1d0bfd178a73";
   };
+
+  pythonNamespaces = [ "jaraco" ];
+
   doCheck = false;
   buildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [ six ];

From 1149afbfb8aab870086a2d2c449f88a73f23c338 Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Fri, 20 Nov 2020 10:53:49 -0800
Subject: [PATCH 51/67] python3Packages.jaraco_logging: enforce jaraco
 namespace

---
 pkgs/development/python-modules/jaraco_logging/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/jaraco_logging/default.nix b/pkgs/development/python-modules/jaraco_logging/default.nix
index 3f9fa4d67ca..4a6391fbc48 100644
--- a/pkgs/development/python-modules/jaraco_logging/default.nix
+++ b/pkgs/development/python-modules/jaraco_logging/default.nix
@@ -11,6 +11,8 @@ buildPythonPackage rec {
     sha256 = "31716fe84d3d5df39d95572942513bd4bf8ae0a478f64031eff4c2ea9e83434e";
   };
 
+  pythonNamespaces = [ "jaraco" ];
+
   nativeBuildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [ tempora six ];
 

From 304c2d2d953fb8edde3d49a183cc6602038c63b9 Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Fri, 20 Nov 2020 10:54:20 -0800
Subject: [PATCH 52/67] python3Packages.jaraco_classes: enforce jaraco
 namespace

---
 pkgs/development/python-modules/jaraco_classes/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/jaraco_classes/default.nix b/pkgs/development/python-modules/jaraco_classes/default.nix
index c9ce6915d2e..a3d19df7653 100644
--- a/pkgs/development/python-modules/jaraco_classes/default.nix
+++ b/pkgs/development/python-modules/jaraco_classes/default.nix
@@ -10,6 +10,8 @@ buildPythonPackage rec {
     sha256 = "1avsxzm5mwylmy2zbxq3xvn48z5djb0qy3hwv4ryncprivzri1n3";
   };
 
+  pythonNamespaces = [ "jaraco" ];
+
   nativeBuildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [ six more-itertools ];
 

From 7e0bffcb942425886fb6ed70c7f710633b12ae84 Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Fri, 20 Nov 2020 10:54:52 -0800
Subject: [PATCH 53/67] python3Packages.jaraco_itertools: enforce jaraco
 namespace

---
 pkgs/development/python-modules/jaraco_itertools/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/jaraco_itertools/default.nix b/pkgs/development/python-modules/jaraco_itertools/default.nix
index 5df70b6da97..f5d0b0538b6 100644
--- a/pkgs/development/python-modules/jaraco_itertools/default.nix
+++ b/pkgs/development/python-modules/jaraco_itertools/default.nix
@@ -11,6 +11,8 @@ buildPythonPackage rec {
     sha256 = "6447d567f57efe5efea386265c7864652e9530830a1b80f43e60b4f222b9ab84";
   };
 
+  pythonNamespaces = [ "jaraco" ];
+
   nativeBuildInputs = [ setuptools_scm ];
 
   patches = [

From 387b2c976f454b5ccf61f20244a446f3d7ceabe2 Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Fri, 20 Nov 2020 10:55:33 -0800
Subject: [PATCH 54/67] python3Packages.jaraco_collections: enforce jaraco
 namespace

---
 pkgs/development/python-modules/jaraco_collections/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/jaraco_collections/default.nix b/pkgs/development/python-modules/jaraco_collections/default.nix
index 9f6e6e2aa7e..3c37755366d 100644
--- a/pkgs/development/python-modules/jaraco_collections/default.nix
+++ b/pkgs/development/python-modules/jaraco_collections/default.nix
@@ -10,6 +10,8 @@ buildPythonPackage rec {
     sha256 = "be570ef4f2e7290b757449395238fa63d70a9255574624e73c5ff9f1ee554721";
   };
 
+  pythonNamespaces = [ "jaraco" ];
+
   doCheck = false;
   buildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [ six jaraco_classes jaraco_text ];

From e790ba33ff63fadf04e132ab6fe131dd21a176e7 Mon Sep 17 00:00:00 2001
From: Sarah Brofeldt <sarah@qtr.dk>
Date: Tue, 17 Nov 2020 20:29:17 +0100
Subject: [PATCH 55/67] ceph: Fix CVE-2020-25660

(cherry picked from commit d835ad4f1a7cdcf794d58ccd658a538b848671d0)
---
 pkgs/tools/filesystems/ceph/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index 7ada070aba6..57f9fd949dd 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -1,4 +1,5 @@
 { stdenv, runCommand, fetchurl
+, fetchpatch
 , ensureNewerSourcesHook
 , cmake, pkgconfig
 , which, git
@@ -134,6 +135,11 @@ in rec {
     patches = [
       ./0000-fix-SPDK-build-env.patch
       ./ceph-glibc-2-32-sigdescr_np.patch
+      (fetchpatch {
+        name = "CVE-2020-25660";
+        url = "https://github.com/ceph/ceph/compare/2c93eff00150f0cc5f106a559557a58d3d7b6f1f...6c14c2fb5650426285428dfe6ca1597e5ea1d07d.patch";
+        sha256 = "032hl15q34gq7y6bnljmklpsbd3bpkzmg7r3w0x0ly786iz7zwhm";
+      })
     ];
 
     nativeBuildInputs = [

From 31b7ef797a550b2113055a686f660e1e7c7e50af Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Fri, 20 Nov 2020 11:22:32 -0800
Subject: [PATCH 56/67] gengetopt: fix tests

---
 pkgs/development/tools/misc/gengetopt/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/tools/misc/gengetopt/default.nix b/pkgs/development/tools/misc/gengetopt/default.nix
index 114a7530f27..0a3b0b1c750 100644
--- a/pkgs/development/tools/misc/gengetopt/default.nix
+++ b/pkgs/development/tools/misc/gengetopt/default.nix
@@ -10,6 +10,10 @@ stdenv.mkDerivation rec {
   };
 
   doCheck = true;
+  # attempts to open non-existent file
+  preCheck = ''
+    rm tests/test_conf_parser_save.sh
+  '';
 
   enableParallelBuilding = true;
 

From 79fb554694a265f40ac47c6498c810fcf48b9ecb Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Wed, 18 Nov 2020 19:08:10 +0000
Subject: [PATCH 57/67] libdrm: 2.4.102 -> 2.4.103

---
 pkgs/development/libraries/libdrm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index 328c85830fb..b9825d9cfdf 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.102";
+  version = "2.4.103";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0nx0bd9dhymdsd99v4ifib77yjirkvkxf5hzdkbr7qr8dhrzkjwb";
+    sha256 = "08h2nnf4w96b4ql7485mvjgbbsb8rwc0qa93fdm1cq34pbyszq1z";
   };
 
   outputs = [ "out" "dev" "bin" ];

From 46e30163ff9e331578c91b4575f884d78369b90e Mon Sep 17 00:00:00 2001
From: Luke Granger-Brown <git@lukegb.com>
Date: Sat, 14 Nov 2020 23:03:53 +0000
Subject: [PATCH 58/67] gstreamer: 1.18.0 -> 1.18.1

---
 .../libraries/gstreamer/bad/default.nix            | 14 ++------------
 .../libraries/gstreamer/base/default.nix           |  4 ++--
 .../libraries/gstreamer/core/default.nix           |  4 ++--
 .../libraries/gstreamer/devtools/default.nix       |  4 ++--
 .../libraries/gstreamer/ges/default.nix            |  4 ++--
 .../libraries/gstreamer/good/default.nix           |  4 ++--
 .../libraries/gstreamer/libav/default.nix          |  4 ++--
 .../libraries/gstreamer/rtsp-server/default.nix    |  4 ++--
 .../libraries/gstreamer/ugly/default.nix           |  4 ++--
 .../libraries/gstreamer/vaapi/default.nix          |  4 ++--
 10 files changed, 20 insertions(+), 30 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 0863d7d1a3e..c5edeb2021f 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -89,27 +89,17 @@ let
   inherit (stdenv.lib) optional optionals;
 in stdenv.mkDerivation rec {
   pname = "gst-plugins-bad";
-  version = "1.18.0";
+  version = "1.18.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0pqqq5bs9fjwcmbwgsgxs2dx6gznhxs7ii5pmjkslr6xmlfap0pk";
+    sha256 = "1cn18cbqyysrxnrk5bpxdzd5xcws9g2kmm5rbv00cx6rhn69g5f1";
   };
 
   patches = [
     ./fix_pkgconfig_includedir.patch
-    # Fixes srt usage failing with
-    #     Failed to open SRT: failed to set SRTO_LINGER (reason: Operation not supported: Bad parameters)
-    # see https://github.com/Haivision/srt/issues/1374
-    # Remove when https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/commit/84f8dbd932029220ee86154dd85b241911ea3891
-    # is shown as being in a release tag that nixpkgs uses.
-    (fetchpatch {
-      name = "gstreamer-srtobject-typecast-SRTO_LINGER-to-linger.patch";
-      url = "https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/commit/84f8dbd932029220ee86154dd85b241911ea3891.patch";
-      sha256 = "0596lvgi93sj3yn98grgmsrhnqhhq7fnjk91qi4xc6618fpqmp9x";
-    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index db964c5c43f..da3434a77cd 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -40,13 +40,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-base";
-  version = "1.18.0";
+  version = "1.18.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "15vqvcy842vhbic3w7l4yvannzazdgwggzv2x8f9m02hm78vsakn";
+    sha256 = "0hf66sh8d4x2ksfnvaq2rqrrfq0vi0pv6wbh9i5jixrhvvbm99hv";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index be4d19f8d0d..3ea0bd8903a 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer";
-  version = "1.18.0";
+  version = "1.18.1";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "01bq1k0gj603zyhq975zl09q4zla12mxqvhmk9fyn2kcn12r5w0g";
+    sha256 = "1fpcpsw740svvdxvvwn0hly5i72miizm4s0mbid10ji83zi8vpvr";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index f865b3adf26..fe4c7005f60 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-devtools";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "05jzjkkdr5hg01mjihlqdcxqnjfrm4mqk0zp83212kv5nm0p2cw2";
+    sha256 = "1pxhg8n5nl34baq6mb07i27b33gaw47zrv5yalyj6f12pnx148ki";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index ae217c42825..075b2059dbf 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-editing-services";
-  version = "1.18.0";
+  version = "1.18.1";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1a00f07v0yjqz1hydhgkjjarm4rk99yjicbz5wkfl5alhzag1bjd";
+    sha256 = "09rr5a198p1r9wcbsjl01xg6idkfkgj5h9x7xxywarb5i7qv6g79";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index e8c885411bd..bcae19217e0 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -49,13 +49,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gst-plugins-good";
-  version = "1.18.0";
+  version = "1.18.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1b4b3a6fm2wyqpnx300pg1sz01m9qhfajadk3b7sbzisg8vvqab3";
+    sha256 = "0v329xi4qhlfh9aksfyviryqk9lclm4wj1lxrjnbdv4haldfj472";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 648ee8bab35..27635247391 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-libav";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0sm0sfdlalimpkf7a7rk7whvyvmmfi2kly2z3q2j5z53x5f3zya2";
+    sha256 = "1n1fkkbxxsndblnbm0c2ziqp967hrz5gag6z36xbpvqk4sy1g9rr";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index e1ee9222cc8..87aca8a7cf9 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-rtsp-server";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "03y7nyjaagis7mmg8vbhxmnc1v9xf2y3cab2s3q2vgsc0l8r7l9a";
+    sha256 = "0m7p7sarvi6n9pz0rrl9k3gp3l5s42qs8z0165kyd6fiqdjjia0h";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index ae1e2dd1b31..ab922f98808 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-ugly";
-  version = "1.18.0";
+  version = "1.18.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "10p0nyzighvkciaspxnhlr7d7n4acrv96lf483i8l988bvj48rk8";
+    sha256 = "09gpbykjchw3lb51ipxj53fy238gr9mg9jybcg5135pb56w6rk8q";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
index 1b2efa630b9..a1a6223798f 100644
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer-vaapi";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0ccyzv15jzf0pi0ndrmfww016cn4c0y4265bacdvnxbgff6fpvy6";
+    sha256 = "1sm6x2qa7ng78w0w8q4mjs7pbpbbk8qkfgzhdmbb8l0bh513q3a0";
   };
 
   outputs = [

From fc03fe100a151693e354cad7dda4a724b9ec7644 Mon Sep 17 00:00:00 2001
From: TredwellGit <tredwell@tutanota.com>
Date: Fri, 13 Nov 2020 14:29:41 +0000
Subject: [PATCH 59/67] xorg: fix update generation

Both e3d3bc66dc496f940b427443b503a67434e115b5 and 1d15641433b97eb1a45a7adec0a0e94600127dfb were done incorrectly.

Also, use python3 in generate-expr-from-tarballs.pl instead of overrides.nix.
---
 pkgs/servers/x11/xorg/default.nix               | 17 +++++++----------
 .../x11/xorg/generate-expr-from-tarballs.pl     |  4 ++--
 pkgs/servers/x11/xorg/overrides.nix             | 14 ++++----------
 pkgs/servers/x11/xorg/tarballs.list             |  2 +-
 4 files changed, 14 insertions(+), 23 deletions(-)

diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index bd0d5bd6d8b..92b6df3ef43 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -1157,7 +1157,7 @@ lib.makeScope newScope (self: with self; {
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
-  libxcb = callPackage ({ stdenv, pkgconfig, fetchurl, libxslt, libpthreadstubs, libXau, xcbproto, libXdmcp, python }: stdenv.mkDerivation {
+  libxcb = callPackage ({ stdenv, pkgconfig, fetchurl, libxslt, libpthreadstubs, libXau, xcbproto, libXdmcp, python3 }: stdenv.mkDerivation {
     name = "libxcb-1.14";
     builder = ./builder.sh;
     src = fetchurl {
@@ -1165,7 +1165,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0d2chjgyn5lr9sfhacfvqgnj9l9faz11vn322a06jd6lk3dxcpm5";
     };
     hardeningDisable = [ "bindnow" "relro" ];
-    nativeBuildInputs = [ pkgconfig python ];
+    nativeBuildInputs = [ pkgconfig python3 ];
     buildInputs = [ libxslt libpthreadstubs libXau xcbproto libXdmcp ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
@@ -1430,7 +1430,7 @@ lib.makeScope newScope (self: with self; {
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
-  xcbproto = callPackage ({ stdenv, pkgconfig, fetchurl, python }: stdenv.mkDerivation {
+  xcbproto = callPackage ({ stdenv, pkgconfig, fetchurl, python3 }: stdenv.mkDerivation {
     name = "xcb-proto-1.14.1";
     builder = ./builder.sh;
     src = fetchurl {
@@ -1438,7 +1438,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1hzwazgyywd9mz4mjj1yv8ski27qqx7ypmyr27m39hrajyddsjph";
     };
     hardeningDisable = [ "bindnow" "relro" ];
-    nativeBuildInputs = [ pkgconfig python ];
+    nativeBuildInputs = [ pkgconfig python3 ];
     buildInputs = [ ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
@@ -1963,7 +1963,7 @@ lib.makeScope newScope (self: with self; {
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
-  xf86videointel = callPackage ({ stdenv, pkgconfig, fetchurl, cairo, xorgproto, libdrm, libpng, udev, libpciaccess, libX11, xcbutil, libxcb, libXcursor, libXdamage, libXext, libXfixes, xorgserver, libXrandr, libXrender, libxshmfence, libXtst, libXvMC, libXv }: stdenv.mkDerivation {
+  xf86videointel = callPackage ({ stdenv, pkgconfig, fetchurl, cairo, xorgproto, libdrm, libpng, udev, libpciaccess, libX11, xcbutil, libxcb, libXcursor, libXdamage, libXext, libXfixes, xorgserver, libXrandr, libXrender, libxshmfence, libXtst, libXvMC }: stdenv.mkDerivation {
     name = "xf86-video-intel-2.99.917";
     builder = ./builder.sh;
     src = fetchurl {
@@ -1972,7 +1972,7 @@ lib.makeScope newScope (self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ cairo xorgproto libdrm libpng udev libpciaccess libX11 xcbutil libxcb libXcursor libXdamage libXext libXfixes xorgserver libXrandr libXrender libxshmfence libXtst libXvMC libXv ];
+    buildInputs = [ cairo xorgproto libdrm libpng udev libpciaccess libX11 xcbutil libxcb libXcursor libXdamage libXext libXfixes xorgserver libXrandr libXrender libxshmfence libXtst libXvMC ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
@@ -2522,7 +2522,7 @@ lib.makeScope newScope (self: with self; {
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
-  xkeyboardconfig = callPackage ({ stdenv, python3, pkgconfig, fetchurl, libX11, xorgproto }: stdenv.mkDerivation {
+  xkeyboardconfig = callPackage ({ stdenv, pkgconfig, fetchurl, libX11, xorgproto, python3 }: stdenv.mkDerivation {
     name = "xkeyboard-config-2.31";
     builder = ./builder.sh;
     src = fetchurl {
@@ -2532,9 +2532,6 @@ lib.makeScope newScope (self: with self; {
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkgconfig python3 ];
     buildInputs = [ libX11 xorgproto ];
-    prePatch = ''
-      patchShebangs rules/merge.py
-    '';
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index ba33623b495..b0cab5fb88e 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -25,7 +25,7 @@ my %pcMap;
 my %extraAttrs;
 
 
-my @missingPCs = ("fontconfig", "libdrm", "libXaw", "zlib", "perl", "python", "mkfontscale", "bdftopcf", "libxslt", "openssl", "gperf", "m4", "libinput", "libevdev", "mtdev", "xorgproto", "cairo", "gettext" );
+my @missingPCs = ("fontconfig", "libdrm", "libXaw", "zlib", "perl", "python3", "mkfontscale", "bdftopcf", "libxslt", "openssl", "gperf", "m4", "libinput", "libevdev", "mtdev", "xorgproto", "cairo", "gettext" );
 $pcMap{$_} = $_ foreach @missingPCs;
 $pcMap{"freetype2"} = "freetype";
 $pcMap{"libpng12"} = "libpng";
@@ -161,7 +161,7 @@ while (<>) {
     }
 
     if ($file =~ /AM_PATH_PYTHON/) {
-        push @nativeRequires, "python";
+        push @nativeRequires, "python3";
     }
 
     if ($file =~ /AC_PATH_PROG\(FCCACHE/) {
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 14ef7a95c43..c9d48c9de9f 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -4,7 +4,7 @@
   freetype, tradcpp, fontconfig, meson, ninja, ed, fontforge,
   libGL, spice-protocol, zlib, libGLU, dbus, libunwind, libdrm,
   mesa, udev, bootstrap_cmds, bison, flex, clangStdenv, autoreconfHook,
-  mcpp, epoxy, openssl, pkgconfig, llvm_6, python3, libxslt,
+  mcpp, epoxy, openssl, pkgconfig, llvm_6, libxslt,
   ApplicationServices, Carbon, Cocoa, Xplugin
 }:
 
@@ -73,9 +73,7 @@ self: super:
 
   mkfontdir = self.mkfontscale;
 
-  libxcb = (super.libxcb.override {
-    python = python3;
-  }).overrideAttrs (attrs: {
+  libxcb = super.libxcb.overrideAttrs (attrs: {
     configureFlags = [ "--enable-xkb" "--enable-xinput" ];
     outputs = [ "out" "dev" "man" "doc" ];
   });
@@ -332,10 +330,6 @@ self: super:
     buildInputs = attrs.buildInputs ++ [ freetype fontconfig ];
   });
 
-  xcbproto = super.xcbproto.override {
-    python = python3;
-  };
-
   xcbutil = super.xcbutil.overrideAttrs (attrs: {
     outputs = [ "out" "dev" ];
   });
@@ -463,8 +457,8 @@ self: super:
   });
 
   xkeyboardconfig = super.xkeyboardconfig.overrideAttrs (attrs: {
+    prePatch = "patchShebangs rules/merge.py";
     nativeBuildInputs = attrs.nativeBuildInputs ++ [ intltool libxslt ];
-
     configureFlags = [ "--with-xkb-rules-symlink=xorg" ];
 
     # 1: compatibility for X11/xkb location
@@ -790,7 +784,7 @@ self: super:
       rev = "f66d39544bb8339130c96d282a80f87ca1606caf";
       sha256 = "14rwbbn06l8qpx7s5crxghn80vgcx8jmfc7qvivh72d81r0kvywl";
     };
-    buildInputs = attrs.buildInputs ++ [self.libXfixes self.libXScrnSaver self.pixman];
+    buildInputs = attrs.buildInputs ++ [ self.libXScrnSaver self.libXfixes self.libXv self.pixman ];
     nativeBuildInputs = attrs.nativeBuildInputs ++ [autoreconfHook self.utilmacros];
     configureFlags = [ "--with-default-dri=3" "--enable-tools" ];
 
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index cd294604884..70b76c7a6a2 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -75,7 +75,7 @@ mirror://xorg/individual/app/xwininfo-1.1.4.tar.bz2
 mirror://xorg/individual/app/xwud-1.0.5.tar.bz2
 mirror://xorg/individual/data/xbitmaps-1.1.2.tar.bz2
 mirror://xorg/individual/data/xcursor-themes-1.0.6.tar.bz2
-mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.27.tar.bz2
+mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.31.tar.bz2
 mirror://xorg/individual/doc/xorg-docs-1.7.1.tar.bz2
 mirror://xorg/individual/doc/xorg-sgml-doctools-1.11.tar.bz2
 mirror://xorg/individual/driver/xf86-input-evdev-2.10.6.tar.bz2

From 90bc70bbd2a1164f1dd98946f6732ac971fca102 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Thu, 19 Nov 2020 10:27:24 +0000
Subject: [PATCH 60/67] oniguruma: 6.9.5_rev1 -> 6.9.6

---
 pkgs/development/libraries/oniguruma/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/oniguruma/default.nix b/pkgs/development/libraries/oniguruma/default.nix
index 54b725c9955..44420c85cf5 100644
--- a/pkgs/development/libraries/oniguruma/default.nix
+++ b/pkgs/development/libraries/oniguruma/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "onig";
-  version = "6.9.5_rev1";
+  version = "6.9.6";
 
   src = fetchFromGitHub {
     owner = "kkos";
     repo = "oniguruma";
     rev = "v${version}";
-    sha256 = "1sx683hbb58gbjvla69n5vxdzwqhjqisqbfkf9xi95wr7p9ycjhl";
+    sha256 = "0y0dv6axvjjzi9367xc4q2nvvx58919iyzy25d5022lpz9z569kj";
   };
 
   nativeBuildInputs = [ autoreconfHook ];

From 0924152075062943f623ba9e9f8ded26bbe1cd2c Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Mon, 23 Nov 2020 19:04:14 -0800
Subject: [PATCH 61/67] glibc: fix cross-compile to ppc64le

Fixes cross-compilation when build == host != target == ppc64le.
Glibc invokes objcopy during cross-compilation to ppc64le, which
fails when the nonprefixed objcopy can't understand the target format.
---
 pkgs/development/libraries/glibc/common.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 3de840d4e3c..630b6b82446 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -160,6 +160,10 @@ stdenv.mkDerivation ({
       "libc_cv_as_needed=no"
     ] ++ lib.optional withGd "--with-gd";
 
+  makeFlags = [
+    "OBJCOPY=${stdenv.cc.targetPrefix}objcopy"
+  ];
+
   installFlags = [ "sysconfdir=$(out)/etc" ];
 
   outputs = [ "out" "bin" "dev" "static" ];

From 1083d88df6d573bd0519ca0e73ed2c8bce0fbf66 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Thu, 19 Nov 2020 03:24:51 +0000
Subject: [PATCH 62/67] modemmanager: 1.12.10 -> 1.14.8

---
 pkgs/tools/networking/modem-manager/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/modem-manager/default.nix b/pkgs/tools/networking/modem-manager/default.nix
index c3981b902f2..7bad593e4df 100644
--- a/pkgs/tools/networking/modem-manager/default.nix
+++ b/pkgs/tools/networking/modem-manager/default.nix
@@ -3,12 +3,12 @@
 
 stdenv.mkDerivation rec {
   pname = "modem-manager";
-  version = "1.12.10";
+  version = "1.14.8";
 
   package = "ModemManager";
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${package}/${package}-${version}.tar.xz";
-    sha256 = "1apq9camys2gaw6y6ic1ld20cncfwpmxnzvh4j5zkbbjpf5hbcxj";
+    sha256 = "15cjy7zzsxagx649vz0990avin47vpgdmm4ss2msggdla6x2c6py";
   };
 
   nativeBuildInputs = [ vala gobject-introspection gettext pkgconfig ];

From 42050cff6f5e00c7c811d1e7cee2d7896dc8ff19 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Fri, 13 Nov 2020 15:03:12 +0000
Subject: [PATCH 63/67] gnugrep: 3.5 -> 3.6

---
 pkgs/tools/text/gnugrep/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/text/gnugrep/default.nix b/pkgs/tools/text/gnugrep/default.nix
index 19ef3aacc6b..08b588691e5 100644
--- a/pkgs/tools/text/gnugrep/default.nix
+++ b/pkgs/tools/text/gnugrep/default.nix
@@ -5,7 +5,7 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-let version = "3.5"; in
+let version = "3.6"; in
 
 stdenv.mkDerivation {
   pname = "gnugrep";
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://gnu/grep/grep-${version}.tar.xz";
-    sha256 = "0jm4hynsqf32rw1j3kv239wzg47qm6glqh6841ar9ay20xvwfamq";
+    sha256 = "0gipv6bzkm1aihj0ncqpyh164xrzgcxcv9r1kwzyk2g1mzl1azk6";
   };
 
   # Perl is needed for testing

From 9eb79c42eb8b6ea07add51d972de0df1d7383f71 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Milan=20P=C3=A4ssler?= <milan@petabyte.dev>
Date: Sat, 21 Nov 2020 15:05:34 +0100
Subject: [PATCH 64/67] rust: 1.47 -> 1.48

---
 .../compilers/rust/{1_47.nix => 1_48.nix}     | 22 +++++++++----------
 pkgs/top-level/all-packages.nix               |  8 +++----
 2 files changed, 15 insertions(+), 15 deletions(-)
 rename pkgs/development/compilers/rust/{1_47.nix => 1_48.nix} (55%)

diff --git a/pkgs/development/compilers/rust/1_47.nix b/pkgs/development/compilers/rust/1_48.nix
similarity index 55%
rename from pkgs/development/compilers/rust/1_47.nix
rename to pkgs/development/compilers/rust/1_48.nix
index 8298a5d956c..b3a512e58bd 100644
--- a/pkgs/development/compilers/rust/1_47.nix
+++ b/pkgs/development/compilers/rust/1_48.nix
@@ -19,25 +19,25 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.47.0";
-  rustcSha256 = "sha256-MYXfBkxHR/LIubuMRGjt1Y/0rW0HiAyHmsGxc7do2B0=";
+  rustcVersion = "1.48.0";
+  rustcSha256 = "0fz4gbb5hp5qalrl9lcl8yw4kk7ai7wx511jb28nypbxninkwxhf";
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.46.0";
+  bootstrapVersion = "1.47.0";
 
   # fetch hashes by running `print-hashes.sh 1.45.2`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "6ebd7e04dc18a36d08b9731cdb42d5caf8460e1eb41b75f3a8596c39f5e71206";
-    x86_64-unknown-linux-gnu = "e3b98bc3440fe92817881933f9564389eccb396f5f431f33d48b979fa2fbdcf5";
-    arm-unknown-linux-gnueabihf = "bb8af68565321f54608e918597083eb016ed0f9f4f3cc23f7cc5f467b934ce7f";
-    armv7-unknown-linux-gnueabihf = "7c0640879d7f2c38db60352e3c0f09e3fc6fa3bac6ca8f22cbccb1eb5e950121";
-    aarch64-unknown-linux-gnu = "f0c6d630f3dedb3db69d69ed9f833aa6b472363096f5164f1068c7001ca42aeb";
-    x86_64-apple-darwin = "82d61582a3772932432a99789c3b3bd4abe6baca339e355048ca9efb9ea5b4db";
-    powerpc64le-unknown-linux-gnu = "89e2f4761d257f017a4b6aa427f36ac0603195546fa2cfded8c899789832941c";
+    i686-unknown-linux-gnu = "84bf092130ea5216fc701871e633563fc1c01b6528f60cb0767e96cd8eec30bf";
+    x86_64-unknown-linux-gnu = "d0e11e1756a072e8e246b05d54593402813d047d12e44df281fbabda91035d96";
+    arm-unknown-linux-gnueabihf = "82e12affb47596b68d0ca64045f4eb698c10ff15406afca604e12cdd07e17b26";
+    armv7-unknown-linux-gnueabihf = "19d0fe3892a8e98f99c5aa84f4d6f260853147650cb71f2bae985c91de6c29af";
+    aarch64-unknown-linux-gnu = "753c905e89a714ab9bce6fe1397b721f29c0760c32f09d2f328af3d39919c8e6";
+    x86_64-apple-darwin = "84e5be6c5c78734deba911dcf80316be1e4c7da2c59413124d039ad96620612f";
+    powerpc64le-unknown-linux-gnu = "5760c3b1897ea70791320c2565f3eef700a3d54059027b84bbe6b8d6157f81c8";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_47;
+  selectRustPackage = pkgs: pkgs.rust_1_48;
 
   rustcPatches = [
   ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c14eff0267d..52d3a16b4b1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9927,15 +9927,15 @@ in
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
     llvmPackages = if stdenv.cc.isClang then llvmPackages_5 else llvmPackages_10;
   };
-  rust_1_47 = callPackage ../development/compilers/rust/1_47.nix {
+  rust_1_48 = callPackage ../development/compilers/rust/1_48.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
     llvmPackages = if stdenv.cc.isClang then llvmPackages_5 else llvmPackages_11;
   };
-  rust = rust_1_47;
+  rust = rust_1_48;
 
   rustPackages_1_45 = rust_1_45.packages.stable;
-  rustPackages_1_47 = rust_1_47.packages.stable;
-  rustPackages = rustPackages_1_47;
+  rustPackages_1_48 = rust_1_48.packages.stable;
+  rustPackages = rustPackages_1_48;
 
   inherit (rustPackages) cargo clippy rustc rustPlatform;
 

From a1e98379b3f75c4ba91009f4b6cf2556bd85e154 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 20 Nov 2020 00:44:46 +0100
Subject: [PATCH 65/67] c-ares: 1.15.0 -> 1.17.1

Fixes:
  - CVE-2020-14354 (in 1.16.1)
  - CVE-2020-8277 (in 1.17.1)
---
 pkgs/development/libraries/c-ares/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/c-ares/default.nix b/pkgs/development/libraries/c-ares/default.nix
index 2751565670a..ac0dc43c67a 100644
--- a/pkgs/development/libraries/c-ares/default.nix
+++ b/pkgs/development/libraries/c-ares/default.nix
@@ -7,11 +7,12 @@
 
 let self =
 stdenv.mkDerivation rec {
-  name = "c-ares-1.15.0";
+  pname = "c-ares";
+  version = "1.17.1";
 
   src = fetchurl {
-    url = "https://c-ares.haxx.se/download/${name}.tar.gz";
-    sha256 = "0lk8knip4xk6qzksdkn7085mmgm4ixfczdyyjw656c193y3rgnvc";
+    url = "https://c-ares.haxx.se/download/${pname}-${version}.tar.gz";
+    sha256 = "0h7wjfnk2092glqcp9mqaax7xx0s13m501z1gi0gsjl2vvvd0gfp";
   };
 
   meta = with stdenv.lib; {

From 1bec9d20da83b8d090485cbb4427b84d4cfbd6fb Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Tue, 17 Nov 2020 13:30:24 -0500
Subject: [PATCH 66/67] avahi: 0.7 -> 0.8

---
 pkgs/development/libraries/avahi/default.nix | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/libraries/avahi/default.nix b/pkgs/development/libraries/avahi/default.nix
index 3f36b87af70..a560cc39d16 100644
--- a/pkgs/development/libraries/avahi/default.nix
+++ b/pkgs/development/libraries/avahi/default.nix
@@ -1,8 +1,10 @@
 { fetchurl, fetchpatch, stdenv, pkgconfig, libdaemon, dbus, perlPackages
-, expat, gettext, intltool, glib, libiconv, writeShellScriptBin
+, expat, gettext, intltool, glib, libiconv, writeShellScriptBin, libevent
 , gtk3Support ? false, gtk3 ? null
 , qt4 ? null
 , qt4Support ? false
+, qt5 ? null
+, qt5Support ? false
 , withLibdnssdCompat ? false
 , python ? null
 , withPython ? false }:
@@ -16,11 +18,11 @@ in
 
 stdenv.mkDerivation rec {
   name = "avahi${stdenv.lib.optionalString withLibdnssdCompat "-compat"}-${version}";
-  version = "0.7";
+  version = "0.8";
 
   src = fetchurl {
     url = "https://github.com/lathiat/avahi/releases/download/v${version}/avahi-${version}.tar.gz";
-    sha256 = "0128n7jlshw4bpx0vg8lwj8qwdisjxi7mvniwfafgnkzzrfrpaap";
+    sha256 = "1npdixwxxn3s9q1f365x9n9rc5xgfz39hxf23faqvlrklgbhj0q6";
   };
 
   prePatch = ''
@@ -30,17 +32,13 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./no-mkdir-localstatedir.patch
-    (fetchpatch {
-      name ="CVE-2017-6519-CVE-2018-100084.patch";
-      url = "https://github.com/lathiat/avahi/commit/e111def44a7df4624a4aa3f85fe98054bffb6b4f.patch";
-      sha256 = "06n7b7kz6xcc35c7xjfc1kj3k2llyjgi09nhy0ci32l1bhacjw0q";
-    })
   ];
 
-  buildInputs = [ libdaemon dbus glib expat libiconv ]
+  buildInputs = [ libdaemon dbus glib expat libiconv libevent ]
     ++ (with perlPackages; [ perl XMLParser ])
     ++ (stdenv.lib.optional gtk3Support gtk3)
-    ++ (stdenv.lib.optional qt4Support qt4);
+    ++ (stdenv.lib.optional qt4Support qt4)
+    ++ (stdenv.lib.optional qt5Support qt5);
 
   propagatedBuildInputs =
     stdenv.lib.optionals withPython (with python.pkgs; [ python pygobject3 dbus-python ]);
@@ -52,6 +50,7 @@ stdenv.mkDerivation rec {
       "--disable-gtk" "--with-dbus-sys=${placeholder "out"}/share/dbus-1/system.d"
       (stdenv.lib.enableFeature gtk3Support "gtk3")
       "--${if qt4Support then "enable" else "disable"}-qt4"
+      "--${if qt5Support then "enable" else "disable"}-qt5"
       (stdenv.lib.enableFeature withPython "python")
       "--localstatedir=/var" "--with-distro=none"
       # A systemd unit is provided by the avahi-daemon NixOS module

From 4c8c8d2ce514b37816dbae0d79afd5a742fa7671 Mon Sep 17 00:00:00 2001
From: yoctocell <yoctocell@disroot.org>
Date: Thu, 19 Nov 2020 09:15:23 +0100
Subject: [PATCH 67/67] [staging] openssh: Fix EOF: command not found

---
 pkgs/tools/networking/openssh/default.nix     |  3 +++
 .../openssh/ssh-copy-id-fix-eof.patch         | 21 +++++++++++++++++++
 2 files changed, 24 insertions(+)
 create mode 100644 pkgs/tools/networking/openssh/ssh-copy-id-fix-eof.patch

diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index 1a96cc58d58..ac40ad3f1fb 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -53,6 +53,9 @@ stdenv.mkDerivation rec {
       ./dont_create_privsep_path.patch
 
       ./ssh-keysign.patch
+
+      # See https://github.com/openssh/openssh-portable/pull/206
+      ./ssh-copy-id-fix-eof.patch
     ]
     ++ optional withGssapiPatches (assert withKerberos; gssapiPatch);
 
diff --git a/pkgs/tools/networking/openssh/ssh-copy-id-fix-eof.patch b/pkgs/tools/networking/openssh/ssh-copy-id-fix-eof.patch
new file mode 100644
index 00000000000..4ba2b562f55
--- /dev/null
+++ b/pkgs/tools/networking/openssh/ssh-copy-id-fix-eof.patch
@@ -0,0 +1,21 @@
+diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id
+index 392f64f..a769077 100644
+--- a/contrib/ssh-copy-id
++++ b/contrib/ssh-copy-id
+@@ -247,7 +247,7 @@ installkeys_sh() {
+   #    the -z `tail ...` checks for a trailing newline. The echo adds one if was missing
+   #    the cat adds the keys we're getting via STDIN
+   #    and if available restorecon is used to restore the SELinux context
+-  INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF)
++  INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF
+ 	cd;
+ 	umask 077;
+ 	mkdir -p $(dirname "${AUTH_KEY_FILE}") &&
+@@ -258,6 +258,7 @@ installkeys_sh() {
+ 	  restorecon -F .ssh ${AUTH_KEY_FILE};
+ 	fi
+ EOF
++  )
+ 
+   # to defend against quirky remote shells: use 'exec sh -c' to get POSIX;
+   printf "exec sh -c '%s'" "${INSTALLKEYS_SH}"