Merge staging-next into master

doc/languages-frameworks/rust.section.md

@@ -53,10 +53,12 @@ all crate sources of this package. Currently it is obtained by inserting a
 fake checksum into the expression and building the package once. The correct
 checksum can be then take from the failed build.
 
-When the `Cargo.lock`, provided by upstream, is not in sync with the
+Per the instructions in the [Cargo Book](https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html)
-`Cargo.toml`, it is possible to use `cargoPatches` to update it. All patches
+best practices guide, Rust applications should always commit the `Cargo.lock`
-added in `cargoPatches` will also be prepended to the patches in `patches` at
+file in git to ensure a reproducible build. However, a few packages do not, and
-build-time.
+Nix depends on this file, so if it missing you can use `cargoPatches` to apply
+it in the `patchPhase`. Consider sending a PR upstream with a note to the
+maintainer describing why it's important to include in the application.
 
 Unless `legacyCargoFetcher` is set to `true`, the fetcher will also verify that
 the `Cargo.lock` file is in sync with the `src` attribute, and will compress the

pkgs/applications/editors/vim/common.nix

@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.0227";
+  version = "8.2.0343";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "1yi7l2yd214iv6i8pr52m272mlzps5v3h6xdgr1770xfz4y1yc0h";
+    sha256 = "063i52h8v7f87zamrw2ph057f0x2nzwf1s0izrm2psy41cyf4wa3";
   };
 
   enableParallelBuilding = true;
@@ -22,7 +22,7 @@ rec {
 
   meta = with lib; {
     description = "The most popular clone of the VI editor";
-    homepage    = http://www.vim.org;
+    homepage    = "http://www.vim.org";
     license     = licenses.vim;
     maintainers = with maintainers; [ lovek323 equirosa ];
     platforms   = platforms.unix;

pkgs/applications/science/misc/rink/default.nix

@@ -10,12 +10,11 @@ rustPlatform.buildRustPackage rec {
     rev = "v${version}";
     sha256 = "0vl996y58a9b62d8sqrpfn2h8qkya7qbg5zqsmy7nxhph1vhbspj";
   };
+
+  # Upstreamed in https://github.com/tiffany352/rink-rs/pull/53
   cargoPatches = [ ./cargo-lock.patch ];
 
-  # Delete this on next update; see #79975 for details
+  cargoSha256 = "0shlh0m9k0iqxpv9zmiw7a6v197swrvpz9x6qzhximzkdwni9gz9";
-  legacyCargoFetcher = true;
-
-  cargoSha256 = "0q2g1hkqyzq9lsas4fhsbpk3jn5hikchh6i1jf9c08ca2xm136c2";
 
   buildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ openssl gmp ncurses ];

pkgs/applications/virtualization/crosvm/default.nix

@@ -53,10 +53,7 @@ in
       ./default-seccomp-policy-dir.diff
     ];
 
-  # Delete this on next update; see #79975 for details
+    cargoSha256 = "1s9nfgfqk140hg08i0xzylnrgrx84dqss0vnvhxnydwy9q03nk7r";
-  legacyCargoFetcher = true;
-
-    cargoSha256 = "1d7y07wkliy5qnlyx5zj6ni39avhs3s48sqgvwxm5g5zrahg2a85";
 
     nativeBuildInputs = [ pkgconfig ];
 

pkgs/applications/virtualization/railcar/default.nix

@@ -11,15 +11,11 @@ rustPlatform.buildRustPackage rec {
     sha256 = "09zn160qxd7760ii6rs5nhr00qmaz49x1plclscznxh9hinyjyh9";
   };
 
-  # Delete this on next update; see #79975 for details
-  legacyCargoFetcher = true;
-
-  cargoSha256 = "1k4y37x783fsd8li17k56vlx5ziwmrz167a0w5mcb9sgyd2kc19a";
-
-  buildInputs = [ libseccomp ];
-
   # Submitted upstream https://github.com/oracle/railcar/pull/44
   cargoPatches = [ ./cargo-lock.patch ];
+  cargoSha256 = "10qxkxpdprl2rcgy52s3q5gyg3i75qmx68rpl7cx1bgjzppfn9c3";
+
+  buildInputs = [ libseccomp ];
 
   meta = with lib; {
     description = "Rust implementation of the Open Containers Initiative oci-runtime";

pkgs/build-support/cc-wrapper/default.nix

@@ -41,7 +41,9 @@ let
   libc_bin = if libc == null then null else getBin libc;
   libc_dev = if libc == null then null else getDev libc;
   libc_lib = if libc == null then null else getLib libc;
-  cc_solib = getLib cc;
+  cc_solib = getLib cc
+    + optionalString (targetPlatform != hostPlatform) "/${targetPlatform.config}";
+
   # The wrapper scripts use 'cat' and 'grep', so we may need coreutils.
   coreutils_bin = if nativeTools then "" else getBin coreutils;
 

pkgs/build-support/rust/default.nix

@@ -114,15 +114,37 @@ stdenv.mkDerivation (filteredArgs // {
     EOF
 
     export RUST_LOG=${logLevel}
-  '' + stdenv.lib.optionalString validateCargoDeps ''
+  '' + (args.postUnpack or "");
-    if ! diff source/Cargo.lock $cargoDepsCopy/Cargo.lock ; then
+
+  # After unpacking and applying patches, check that the Cargo.lock matches our
+  # src package. Note that we do this after the patchPhase, because the
+  # patchPhase may create the Cargo.lock if upstream has not shipped one.
+  postPatch = (args.postPatch or "") + stdenv.lib.optionalString validateCargoDeps ''
+    cargoDepsLockfile=$NIX_BUILD_TOP/$cargoDepsCopy/Cargo.lock
+    srcLockfile=$NIX_BUILD_TOP/$sourceRoot/Cargo.lock
+
+    echo "Validating consistency between $srcLockfile and $cargoDepsLockfile"
+    if ! diff $srcLockfile $cargoDepsLockfile; then
+
+      # If the diff failed, first double-check that the file exists, so we can
+      # give a friendlier error msg.
+      if ! [ -e $srcLockfile ]; then
+        echo "ERROR: Missing Cargo.lock from src. Expected to find it at: $srcLockfile"
+        exit 1
+      fi
+
+      if ! [ -e $cargoDepsLockfile ]; then
+        echo "ERROR: Missing lockfile from cargo vendor. Expected to find it at: $cargoDepsLockfile"
+        exit 1
+      fi
+
       echo
       echo "ERROR: cargoSha256 is out of date"
       echo
       echo "Cargo.lock is not the same in $cargoDepsCopy"
       echo
       echo "To fix the issue:"
-      echo '1. Use "1111111111111111111111111111111111111111111111111111" as the cargoSha256 value'
+      echo '1. Use "0000000000000000000000000000000000000000000000000000" as the cargoSha256 value'
       echo "2. Build the derivation and wait it to fail with a hash mismatch"
       echo "3. Copy the 'got: sha256:' value back into the cargoSha256 field"
       echo
@@ -131,7 +153,7 @@ stdenv.mkDerivation (filteredArgs // {
     fi
   '' + ''
     unset cargoDepsCopy
-  '' + (args.postUnpack or "");
+  '';
 
   configurePhase = args.configurePhase or ''
     runHook preConfigure

pkgs/build-support/setup-hooks/wrap-gapps-hook.sh

@@ -9,6 +9,37 @@ find_gio_modules() {
 
 addEnvHooks "${targetOffset:?}" find_gio_modules
 
+gappsWrapperArgsHook() {
+    if [ -n "$GDK_PIXBUF_MODULE_FILE" ]; then
+        gappsWrapperArgs+=(--set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE")
+    fi
+
+    if [ -n "$XDG_ICON_DIRS" ]; then
+        gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS")
+    fi
+
+    if [ -n "$GSETTINGS_SCHEMAS_PATH" ]; then
+        gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH")
+    fi
+
+    # Check for prefix as well
+    if [ -d "${prefix:?}/share" ]; then
+        gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$prefix/share")
+    fi
+
+    if [ -d "$prefix/lib/gio/modules" ] && [ -n "$(ls -A "$prefix/lib/gio/modules")" ]; then
+        gappsWrapperArgs+=(--prefix GIO_EXTRA_MODULES : "$prefix/lib/gio/modules")
+    fi
+
+    for v in ${wrapPrefixVariables:-} GST_PLUGIN_SYSTEM_PATH_1_0 GI_TYPELIB_PATH GRL_PLUGIN_PATH; do
+        if [ -n "${!v}" ]; then
+            gappsWrapperArgs+=(--prefix "$v" : "${!v}")
+        fi
+    done
+}
+
+preFixupPhases+=" gappsWrapperArgsHook"
+
 wrapGApp() {
     local program="$1"
     shift 1
@@ -17,72 +48,46 @@ wrapGApp() {
 
 # Note: $gappsWrapperArgs still gets defined even if ${dontWrapGApps-} is set.
 wrapGAppsHook() {
-  # guard against running multiple times (e.g. due to propagation)
+    # guard against running multiple times (e.g. due to propagation)
-  [ -z "$wrapGAppsHookHasRun" ] || return 0
+    [ -z "$wrapGAppsHookHasRun" ] || return 0
-  wrapGAppsHookHasRun=1
+    wrapGAppsHookHasRun=1
 
-  if [ -n "$GDK_PIXBUF_MODULE_FILE" ]; then
+    if [[ -z "${dontWrapGApps:-}" ]]; then
-    gappsWrapperArgs+=(--set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE")
+        targetDirsThatExist=()
-  fi
+        targetDirsRealPath=()
 
-  if [ -n "$XDG_ICON_DIRS" ]; then
+        # wrap binaries
-    gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS")
+        targetDirs=("${prefix}/bin" "${prefix}/libexec")
-  fi
+        for targetDir in "${targetDirs[@]}"; do
-
+            if [[ -d "${targetDir}" ]]; then
-  if [ -n "$GSETTINGS_SCHEMAS_PATH" ]; then
+                targetDirsThatExist+=("${targetDir}")
-    gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH")
+                targetDirsRealPath+=("$(realpath "${targetDir}")/")
-  fi
+                find "${targetDir}" -type f -executable -print0 |
-
+                    while IFS= read -r -d '' file; do
-  if [ -d "${prefix:?}/share" ]; then
+                        echo "Wrapping program '${file}'"
-    gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$prefix/share")
+                        wrapGApp "${file}"
-  fi
+                    done
-
+            fi
-  if [ -d "$prefix/lib/gio/modules" ] && [ -n "$(ls -A "$prefix/lib/gio/modules")" ] ; then
-    gappsWrapperArgs+=(--prefix GIO_EXTRA_MODULES : "$prefix/lib/gio/modules")
-  fi
-
-  for v in ${wrapPrefixVariables:-} GST_PLUGIN_SYSTEM_PATH_1_0 GI_TYPELIB_PATH GRL_PLUGIN_PATH; do
-    if [ -n "${!v}" ]; then
-      gappsWrapperArgs+=(--prefix "$v" : "${!v}")
-    fi
-  done
-
-  if [[ -z "${dontWrapGApps:-}" ]]; then
-    targetDirsThatExist=()
-    targetDirsRealPath=()
-
-    # wrap binaries
-    targetDirs=( "${prefix}/bin" "${prefix}/libexec" )
-    for targetDir in "${targetDirs[@]}"; do
-      if [[ -d "${targetDir}" ]]; then
-        targetDirsThatExist+=("${targetDir}")
-        targetDirsRealPath+=("$(realpath "${targetDir}")/")
-        find "${targetDir}" -type f -executable -print0 \
-          | while IFS= read -r -d '' file; do
-          echo "Wrapping program '${file}'"
-          wrapGApp "${file}"
         done
-      fi
-    done
 
-    # wrap links to binaries that point outside targetDirs
+        # wrap links to binaries that point outside targetDirs
-    # Note: links to binaries within targetDirs do not need
+        # Note: links to binaries within targetDirs do not need
-    #       to be wrapped as the binaries have already been wrapped
+        #       to be wrapped as the binaries have already been wrapped
-    if [[ ${#targetDirsThatExist[@]} -ne 0 ]]; then
+        if [[ ${#targetDirsThatExist[@]} -ne 0 ]]; then
-      find "${targetDirsThatExist[@]}" -type l -xtype f -executable -print0 \
+            find "${targetDirsThatExist[@]}" -type l -xtype f -executable -print0 |
-        | while IFS= read -r -d '' linkPath; do
+                while IFS= read -r -d '' linkPath; do
-        linkPathReal=$(realpath "${linkPath}")
+                    linkPathReal=$(realpath "${linkPath}")
-        for targetPath in "${targetDirsRealPath[@]}"; do
+                    for targetPath in "${targetDirsRealPath[@]}"; do
-          if [[ "$linkPathReal" == "$targetPath"* ]]; then
+                        if [[ "$linkPathReal" == "$targetPath"* ]]; then
-            echo "Not wrapping link: '$linkPath' (already wrapped)"
+                            echo "Not wrapping link: '$linkPath' (already wrapped)"
-            continue 2
+                            continue 2
-          fi
+                        fi
-        done
+                    done
-        echo "Wrapping link: '$linkPath'"
+                    echo "Wrapping link: '$linkPath'"
-        wrapGApp "${linkPath}"
+                    wrapGApp "${linkPath}"
-      done
+                done
+        fi
     fi
-  fi
 }
 
 fixupOutputHooks+=(wrapGAppsHook)

pkgs/development/compilers/gcc/builder.sh

@@ -133,7 +133,7 @@ if test "$noSysDirs" = "1"; then
 
     if test "$crossStageStatic" == 1; then
         # We don't want the gcc build to assume there will be a libc providing
-        # limits.h in this stagae
+        # limits.h in this stage
         makeFlagsArray+=(
             'LIMITS_H_TEST=false'
         )
@@ -203,31 +203,31 @@ postConfigure() {
 preInstall() {
     # Make ‘lib64’ symlinks to ‘lib’.
     if [ -n "$is64bit" -a -z "$enableMultilib" ]; then
-        mkdir -p "$out/lib"
+        mkdir -p "$out/${targetConfig}/lib"
-        ln -s lib "$out/lib64"
+        ln -s lib "$out/${targetConfig}/lib64"
-        mkdir -p "$lib/lib"
+        mkdir -p "$lib/${targetConfig}/lib"
-        ln -s lib "$lib/lib64"
+        ln -s lib "$lib/${targetConfig}/lib64"
     fi
 }
 
 
 postInstall() {
     # Move runtime libraries to $lib.
-    moveToOutput "lib/lib*.so*" "$lib"
+    moveToOutput "${targetConfig+$targetConfig/}lib/lib*.so*" "$lib"
-    moveToOutput "lib/lib*.la"  "$lib"
+    moveToOutput "${targetConfig+$targetConfig/}lib/lib*.la"  "$lib"
-    moveToOutput "lib/lib*.dylib" "$lib"
+    moveToOutput "${targetConfig+$targetConfig/}lib/lib*.dylib" "$lib"
     moveToOutput "share/gcc-*/python" "$lib"
 
-    for i in "$lib"/lib/*.{la,py}; do
+    for i in "$lib/${targetConfig}"/lib/*.{la,py}; do
         substituteInPlace "$i" --replace "$out" "$lib"
     done
 
     if [ -n "$enableMultilib" ]; then
-        moveToOutput "lib64/lib*.so*" "$lib"
+        moveToOutput "${targetConfig+$targetConfig/}lib64/lib*.so*" "$lib"
-        moveToOutput "lib64/lib*.la"  "$lib"
+        moveToOutput "${targetConfig+$targetConfig/}lib64/lib*.la"  "$lib"
-        moveToOutput "lib64/lib*.dylib" "$lib"
+        moveToOutput "${targetConfig+$targetConfig/}lib64/lib*.dylib" "$lib"
 
-        for i in "$lib"/lib64/*.{la,py}; do
+        for i in "$lib/${targetConfig}"/lib64/*.{la,py}; do
             substituteInPlace "$i" --replace "$out" "$lib"
         done
     fi
@@ -247,13 +247,6 @@ postInstall() {
             NEW_RPATH=`echo "$PREV_RPATH" | sed 's,:[^:]*bootstrap-tools/lib,,g'`
             patchelf --set-rpath "$NEW_RPATH" "$i" && echo OK
         done
-
-        # For some reason the libs retain RPATH to $out
-        for i in "$lib"/lib/{libtsan,libasan,libubsan}.so.*.*.*; do
-            PREV_RPATH=`patchelf --print-rpath "$i"`
-            NEW_RPATH=`echo "$PREV_RPATH" | sed "s,:${out}[^:]*,,g"`
-            patchelf --set-rpath "$NEW_RPATH" "$i" && echo OK
-        done
     fi
 
     if type "install_name_tool"; then

pkgs/development/interpreters/python/default.nix

@@ -105,10 +105,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "8";
-      patch = "1";
+      patch = "2";
       suffix = "";
     };
-    sha256 = "1s4lwn5vzsajlc88m6hkghsvnjw4d00l2dsgng0m2w6vyqbl32bm";
+    sha256 = "1ps5v323cp5czfshqjmbsqw7nvrdpcbk06f62jbzaqik4gfffii6";
     inherit (darwin) configd;
     inherit passthruFun;
   };
@@ -119,9 +119,9 @@ in {
       major = "3";
       minor = "9";
       patch = "0";
-      suffix = "a3";
+      suffix = "a4";
     };
-    sha256 = "09l68jyfhhass3cqyqyp2cv3a3i86qs0x736isidmpbrbxsincva";
+    sha256 = "0qzy0wlq0izxk8ii28gy70v138g6xnz9sgsxpyayls2j04l6b5vz";
     inherit (darwin) configd;
     inherit passthruFun;
   };

pkgs/development/interpreters/python/hooks/default.nix

@@ -94,6 +94,14 @@ in rec {
       name = "python-remove-bin-bytecode-hook";
     } ./python-remove-bin-bytecode-hook.sh) {};
 
+  pythonRemoveTestsDirHook = callPackage ({ }:
+    makeSetupHook {
+      name = "python-remove-tests-dir-hook";
+      substitutions = {
+        inherit pythonSitePackages;
+      };
+    } ./python-remove-tests-dir-hook.sh) {};
+
   setuptoolsBuildHook = callPackage ({ setuptools, wheel }:
     makeSetupHook {
       name = "setuptools-setup-hook";

pkgs/development/interpreters/python/hooks/python-remove-tests-dir-hook.sh

@@ -0,0 +1,15 @@
+# Clean up top-level tests directory in site-package installation.
+echo "Sourcing python-remove-tests-dir-hook"
+
+pythonRemoveTestsDir() {
+    echo "Executing pythonRemoveTestsDir"
+
+    rm -rf $out/@pythonSitePackages@/tests
+
+    echo "Finished executing pythonRemoveTestsDir"
+}
+
+if [ -z "${dontUsePythonRemoveTestsDir-}" ]; then
+    postFixupHooks+=(pythonRemoveTestsDir)
+fi
+

pkgs/development/interpreters/python/mk-python-derivation.nix

@@ -17,6 +17,7 @@
 , pythonCatchConflictsHook
 , pythonImportsCheckHook
 , pythonRemoveBinBytecodeHook
+, pythonRemoveTestsDirHook
 , setuptoolsBuildHook
 , setuptoolsCheckHook
 , wheelUnpackHook
@@ -108,6 +109,7 @@ let
     python
     wrapPython
     ensureNewerSourcesForZipFilesHook  # move to wheel installer (pip) or builder (setuptools, flit, ...)?
+    pythonRemoveTestsDirHook
   ] ++ lib.optionals catchConflicts [
     setuptools pythonCatchConflictsHook
   ] ++ lib.optionals removeBinBytecode [

pkgs/development/libraries/at-spi2-atk/default.nix

@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "at-spi2-atk";
-  version = "2.34.1";
+  version = "2.34.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "05ncp7s5nddjinffs26mcvpbd63vk1m3cv5y530p3plgfhqgjvbp";
+    sha256 = "1w7l4xg00qx3dwhn0zaa64daiv5f073hdvjdxh0mrw7fw37264wh";
   };
 
   nativeBuildInputs = [ meson ninja pkgconfig ];
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "D-Bus bridge for Assistive Technology Service Provider Interface (AT-SPI) and Accessibility Toolkit (ATK)";
-    homepage = https://gitlab.gnome.org/GNOME/at-spi2-atk;
+    homepage = "https://gitlab.gnome.org/GNOME/at-spi2-atk";
     license = licenses.lgpl21Plus;
     maintainers = gnome3.maintainers;
     platforms = platforms.unix;

pkgs/development/libraries/geoclue/default.nix

@@ -7,14 +7,14 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "geoclue";
-  version = "2.5.5";
+  version = "2.5.6";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "0a8wmf5v3x4035ixz9jypj7c6qknvs6gjv2zawa3msq1j75rf2r5";
+    sha256 = "13fk6n4j74lvcsrg3kwbw1mkxgcr3iy9dnysmy0pclfsym8z5m5m";
   };
 
   patches = [
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Geolocation framework and some data providers";
-    homepage = https://gitlab.freedesktop.org/geoclue/geoclue/wikis/home;
+    homepage = "https://gitlab.freedesktop.org/geoclue/geoclue/wikis/home";
     maintainers = with maintainers; [ raskin ];
     platforms = with platforms; linux ++ darwin;
     license = licenses.lgpl2;

pkgs/development/libraries/glib/setup-hook.sh

@@ -24,4 +24,12 @@ glibPreFixupPhase() {
 
     addToSearchPath GSETTINGS_SCHEMAS_PATH "${!outputLib}/share/gsettings-schemas/$name"
 }
-preFixupPhases+=" glibPreFixupPhase"
+
+# gappsWrapperArgsHook expects GSETTINGS_SCHEMAS_PATH variable to be set by this.
+# Until we have dependency mechanism in generic builder, we need to use this ugly hack.
+if [[ " ${preFixupPhases:-} " =~ " gappsWrapperArgsHook " ]]; then
+    preFixupPhases+=" "
+    preFixupPhases="${preFixupPhases/ gappsWrapperArgsHook / glibPreFixupPhase gappsWrapperArgsHook }"
+else
+    preFixupPhases+=" glibPreFixupPhase"
+fi

pkgs/development/libraries/glibc/common.nix

@@ -89,6 +89,18 @@ stdenv.mkDerivation ({
         less linux-*?/arch/x86/kernel/syscall_table_32.S
        */
       ./allow-kernel-2.6.32.patch
+
+      /* Provide a fallback for missing prlimit64 syscall on RHEL 6 -like
+         kernels.
+
+         This patch is maintained by @veprbl. If it gives you trouble, feel
+         free to ping me, I'd be happy to help.
+       */
+      (fetchurl {
+        url = "https://git.savannah.gnu.org/cgit/guix.git/plain/gnu/packages/patches/glibc-reinstate-prlimit64-fallback.patch?id=eab07e78b691ae7866267fc04d31c7c3ad6b0eeb";
+        sha256 = "091bk3kyrx1gc380gryrxjzgcmh1ajcj8s2rjhp2d2yzd5mpd5ps";
+      })
+
       /* Provide utf-8 locales by default, so we can use it in stdenv without depending on our large locale-archive. */
       (fetchurl {
         url = "https://salsa.debian.org/glibc-team/glibc/raw/49767c9f7de4828220b691b29de0baf60d8a54ec/debian/patches/localedata/locale-C.diff";

pkgs/development/libraries/libevdev/default.nix

@@ -2,18 +2,18 @@
 
 stdenv.mkDerivation rec {
   pname = "libevdev";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "04a2klvii0in9ln8r85mk2cm73jq8ry2m3yzmf2z8xyjxzjcmlr0";
+    sha256 = "17pb5375njb1r05xmk0r57a2j986ihglh2n5nqcylbag4rj8mqg7";
   };
 
   buildInputs = [ python3 ];
 
   meta = with stdenv.lib; {
     description = "Wrapper library for evdev devices";
-    homepage = http://www.freedesktop.org/software/libevdev/doc/latest/index.html;
+    homepage = "http://www.freedesktop.org/software/libevdev/doc/latest/index.html";
     license = licenses.mit;
     platforms = platforms.linux;
     maintainers = [ maintainers.amorsillo ];

pkgs/development/libraries/libsoup/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libsoup";
-  version = "2.68.3";
+  version = "2.68.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1yxs0ax4rq3g0lgkbv7mz497rqj16iyyizddyc13gzxh6n7b0jsk";
+    sha256 = "151j5dc84gbl6a917pxvd0b372lw5za48n63lyv6llfc48lv2l1d";
   };
 
   postPatch = ''
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "HTTP client/server library for GNOME";
-    homepage = https://wiki.gnome.org/Projects/libsoup;
+    homepage = "https://wiki.gnome.org/Projects/libsoup";
     license = stdenv.lib.licenses.gpl2;
     inherit (glib.meta) maintainers platforms;
   };

pkgs/development/libraries/libva/default.nix

@@ -6,14 +6,14 @@
 
 stdenv.mkDerivation rec {
   name = "libva-${lib.optionalString minimal "minimal-"}${version}";
-  version = "2.5.0";
+  version = "2.6.1";
 
   # update libva-utils and vaapiIntel as well
   src = fetchFromGitHub {
     owner  = "01org";
     repo   = "libva";
     rev    = version;
-    sha256 = "0pys6blkh8ayxmxgfh7qrjzzcrzzn14z5d8q4a34ffqk90b6r93z";
+    sha256 = "1x34kf38p5rf52bf54ljr9f7knnbilm7kbszqnfk3lzsqrfc7r2g";
   };
 
   outputs = [ "dev" "out" ];

pkgs/development/libraries/libvdpau/default.nix

@@ -1,28 +1,27 @@
-{ stdenv, fetchurl, pkgconfig, xorg, mesa }:
+{ stdenv, fetchurl, pkgconfig, xorg, mesa, meson, ninja }:
 
 stdenv.mkDerivation rec {
   pname = "libvdpau";
-  version = "1.2";
+  version = "1.3";
 
   src = fetchurl {
-    url = "https://gitlab.freedesktop.org/vdpau/libvdpau/uploads/14b620084c027d546fa0b3f083b800c6/${pname}-${version}.tar.bz2";
+    url = "https://gitlab.freedesktop.org/vdpau/libvdpau/-/archive/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "6a499b186f524e1c16b4f5b57a6a2de70dfceb25c4ee546515f26073cd33fa06";
+    sha256 = "b5a52eeac9417edbc396f26c40591ba5df0cd18285f68d84614ef8f06196e50e";
   };
+  patches = [ ./installdir.patch ];
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ meson ninja pkgconfig ];
   buildInputs = with xorg; [ xorgproto libXext ];
 
   propagatedBuildInputs = [ xorg.libX11 ];
 
-  configureFlags = stdenv.lib.optional stdenv.isLinux
+  mesonFlags = stdenv.lib.optional stdenv.isLinux
-    "--with-module-dir=${mesa.drivers.driverLink}/lib/vdpau";
+    [ "-Dmoduledir=${mesa.drivers.driverLink}/lib/vdpau" ];
 
   NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-lX11";
 
-  installFlags = [ "moduledir=$(out)/lib/vdpau" ];
-
   meta = with stdenv.lib; {
     homepage = https://people.freedesktop.org/~aplattner/vdpau/;
     description = "Library to use the Video Decode and Presentation API for Unix (VDPAU)";

pkgs/development/libraries/libvdpau/installdir.patch

@@ -0,0 +1,9 @@
+--- a/trace/meson.build	2020-02-15 16:34:58.698832000 +0100
++++ b/trace/meson.build	2020-02-15 16:39:05.359952802 +0100
+@@ -4,5 +4,5 @@
+     dependencies : libdl,
+     version : '1.0.0',
+     install : true,
+-    install_dir : moduledir,
++    install_dir : get_option('prefix') + '/lib/libvdpau',
+ )

pkgs/development/libraries/ncurses/default.nix

@@ -14,17 +14,17 @@
 
 stdenv.mkDerivation rec {
   # Note the revision needs to be adjusted.
-  version = "6.1-20190112";
+  version = "6.2";
   name = "ncurses-${version}" + lib.optionalString (abiVersion == "5") "-abi5-compat";
 
   # We cannot use fetchFromGitHub (which calls fetchzip)
   # because we need to be able to use fetchurlBoot.
   src = let
     # Note the version needs to be adjusted.
-    rev = "acb4184f8f69fddd052a3daa8c8675f4bf8ce369";
+    rev = "v${version}";
   in fetchurl {
     url = "https://github.com/mirror/ncurses/archive/${rev}.tar.gz";
-    sha256 = "1z8v63cj2y7dxf4m1api8cvk0ns9frif9c60m2sxhibs06pjy4q0";
+    sha256 = "15r2456g0mlq2q7gh2z52vl6zv6y0z8sdchrs80kg4idqd8sm8fd";
   };
 
   patches = lib.optional (!stdenv.cc.isClang) ./clang.patch;

pkgs/development/libraries/wayland/protocols.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "wayland-protocols";
-  version = "1.18";
+  version = "1.20";
 
   src = fetchurl {
     url = "https://wayland.freedesktop.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "1cvl93h83ymbfhb567jv5gzyq08181w7c46rsw4xqqqpcvkvfwrx";
+    sha256 = "1rsdgvkkvxs3cjhpl6agvbkm53vm7k8rg127j9y2vn33m2hvg0lp";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/development/python-modules/cffi/default.nix

@@ -2,11 +2,11 @@
 
 if isPyPy then null else buildPythonPackage rec {
   pname = "cffi";
-  version = "1.13.2";
+  version = "1.14.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "599a1e8ff057ac530c9ad1778293c665cb81a791421f46922d80a86473c13346";
+    sha256 = "1dn279gw5ql8i5n3s5v4rnv96rhhjjfn7xq729qbl5bs2954yf1d";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/python-modules/setuptools/44.0.nix

@@ -0,0 +1,74 @@
+{ stdenv
+, buildPythonPackage
+, fetchFromGitHub
+, python
+, wrapPython
+, unzip
+, callPackage
+, bootstrapped-pip
+, lib
+, pipInstallHook
+, setuptoolsBuildHook
+}:
+
+let
+  pname = "setuptools";
+  version = "44.0.0";
+
+  # Create an sdist of setuptools
+  sdist = stdenv.mkDerivation rec {
+    name = "${pname}-${version}-sdist.tar.gz";
+
+    src = fetchFromGitHub {
+      owner = "pypa";
+      repo = pname;
+      rev = "v${version}";
+      sha256 = "0z3q0qinyp1rmnxkw3y5f6nbsxhqlfq5k7skfrqa6ymb3zr009y1";
+      name = "${pname}-${version}-source";
+    };
+
+    buildPhase = ''
+      ${python.pythonForBuild.interpreter} bootstrap.py
+      ${python.pythonForBuild.interpreter} setup.py sdist --formats=gztar
+    '';
+
+    installPhase = ''
+      echo "Moving sdist..."
+      mv dist/*.tar.gz $out
+    '';
+  };
+in buildPythonPackage rec {
+  inherit pname version;
+  # Because of bootstrapping we don't use the setuptoolsBuildHook that comes with format="setuptools" directly.
+  # Instead, we override it to remove setuptools to avoid a circular dependency.
+  # The same is done for pip and the pipInstallHook.
+  format = "other";
+
+  src = sdist;
+
+  nativeBuildInputs = [
+    bootstrapped-pip
+    (pipInstallHook.override{pip=null;})
+    (setuptoolsBuildHook.override{setuptools=null; wheel=null;})
+  ];
+
+  preBuild = lib.strings.optionalString (!stdenv.hostPlatform.isWindows) ''
+    export SETUPTOOLS_INSTALL_WINDOWS_SPECIFIC_FILES=0
+  '';
+
+  pipInstallFlags = [ "--ignore-installed" ];
+
+  # Adds setuptools to nativeBuildInputs causing infinite recursion.
+  catchConflicts = false;
+
+  # Requires pytest, causing infinite recursion.
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Utilities to facilitate the installation of Python packages";
+    homepage = https://pypi.python.org/pypi/setuptools;
+    license = with licenses; [ psfl zpl20 ];
+    platforms = python.meta.platforms;
+    priority = 10;
+  };
+}

pkgs/development/python-modules/setuptools/default.nix

@@ -13,7 +13,7 @@
 
 let
   pname = "setuptools";
-  version = "44.0.0";
+  version = "45.2.0";
 
   # Create an sdist of setuptools
   sdist = stdenv.mkDerivation rec {
@@ -23,7 +23,7 @@ let
       owner = "pypa";
       repo = pname;
       rev = "v${version}";
-      sha256 = "0z3q0qinyp1rmnxkw3y5f6nbsxhqlfq5k7skfrqa6ymb3zr009y1";
+      sha256 = "003iflm3ifjab3g1bnmhpwx1v3vpl4w90vwcvn8jf9449302d0md";
       name = "${pname}-${version}-source";
     };
 

pkgs/development/tools/build-managers/meson/default.nix

@@ -1,6 +1,5 @@
 { lib
 , python3Packages
-, fetchpatch
 , stdenv
 , writeTextDir
 , substituteAll
@@ -20,11 +19,11 @@ let
 in
 python3Packages.buildPythonApplication rec {
   pname = "meson";
-  version = "0.52.1";
+  version = "0.53.2";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "02fnrk1fjf3yiix0ak0m9vgbpl4h97fafii5pmw7phmvnlv9fyan";
+    sha256 = "Po+DDzMYQ5fC6wtlHsUCrbY97LKJeL3ISzVY1xKEwh8=";
   };
 
   postFixup = ''
@@ -62,14 +61,6 @@ python3Packages.buildPythonApplication rec {
       src = ./fix-rpath.patch;
       inherit (builtins) storeDir;
     })
-
-    # Fix detecting incorrect compiler in the store path hash.
-    # https://github.com/NixOS/nixpkgs/issues/73417#issuecomment-554077964
-    # https://github.com/mesonbuild/meson/pull/6185
-    (fetchpatch {
-      url = "https://github.com/mesonbuild/meson/commit/972ede1d14fdf17fe5bb8fb99be220f9395c2392.patch";
-      sha256 = "19bfsylhpy0b2xv3ks8ac9x3q6vvvyj1wjcy971v9d5f1455xhbb";
-    })
   ];
 
   setupHook = ./setup-hook.sh;

pkgs/development/tools/misc/gdb/darwin-target-match.patch

@@ -1,6 +1,6 @@
 --- a/configure	2017-06-05 00:51:26.000000000 +0900
 +++ b/configure	2018-03-06 23:12:58.000000000 +0900
-@@ -3603,7 +3603,7 @@
+@@ -3644,7 +3644,7 @@
      noconfigdirs="$noconfigdirs ld gprof"
      noconfigdirs="$noconfigdirs sim target-rda"
      ;;

pkgs/development/tools/misc/gdb/debug-info-from-env.patch

@@ -1,15 +1,24 @@
-Initialize debug-file-directory from NIX_DEBUG_INFO_DIRS, a colon-separated list
+diff -ur a/gdb/main.c b/gdb/main.c
-of directories with separate debugging information files.
+--- a/gdb/main.c	2020-02-08 13:50:14.000000000 +0100
-
++++ b/gdb/main.c	2020-02-24 10:02:07.731806739 +0100
---- a/gdb/main.c
+@@ -567,9 +567,17 @@
-+++ b/gdb/main.c
+       gdb_sysroot = xstrdup (TARGET_SYSROOT_PREFIX);
-@@ -556,3 +556,8 @@ captured_main_1 (struct captured_main_args *context)
+     }
  
--  debug_file_directory = relocate_gdb_directory (DEBUGDIR,
+-  debug_file_directory
-+  debug_file_directory = getenv("NIX_DEBUG_INFO_DIRS");
+-    = xstrdup (relocate_gdb_directory (DEBUGDIR,
-+
+-				     DEBUGDIR_RELOCATABLE).c_str ());
++  debug_file_directory = getenv ("NIX_DEBUG_INFO_DIRS");
 +  if (debug_file_directory != NULL)
-+    debug_file_directory = xstrdup(debug_file_directory);
++    // This might be updated later using
++    // $ set debug-file-directory /to/some/path
++    // which will use xfree. We must then have a xmallocated
++    // copy of the string that can be xfeed later.
++    debug_file_directory = xstrdup (debug_file_directory);
 +  else
-+    debug_file_directory = relocate_gdb_directory (DEBUGDIR,
++    debug_file_directory
- 						 DEBUGDIR_RELOCATABLE);
++      = xstrdup (relocate_gdb_directory (DEBUGDIR,
++                                         DEBUGDIR_RELOCATABLE).c_str ());
+ 
+   gdb_datadir = relocate_gdb_directory (GDB_DATADIR,
+ 					GDB_DATADIR_RELOCATABLE);

pkgs/development/tools/misc/gdb/default.nix

@@ -18,7 +18,7 @@
 
 let
   basename = "gdb-${version}";
-  version = "8.3.1";
+  version = "9.1";
 in
 
 assert pythonSupport -> python3 != null;
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnu/gdb/${basename}.tar.xz";
-    sha256 = "1i2pjwaafrlz7wqm40b4znr77ai32rjsxkpl2az38yyarpbv8m8y";
+    sha256 = "0dqp1p7w836iwijg1zb4a784n0j4pyjiw5v6h8fg5lpx6b40x7k9";
   };
 
   postPatch = if stdenv.isDarwin then ''
@@ -65,6 +65,13 @@ stdenv.mkDerivation rec {
   # TODO(@Ericson2314): Always pass "--target" and always prefix.
   configurePlatforms = [ "build" "host" ] ++ stdenv.lib.optional (stdenv.targetPlatform != stdenv.hostPlatform) "target";
 
+  # GDB have to be built out of tree.
+  preConfigure = ''
+    mkdir _build
+    cd _build
+  '';
+  configureScript = "../configure";
+
   configureFlags = with stdenv.lib; [
     "--enable-targets=all" "--enable-64-bit-bfd"
     "--disable-install-libbfd"
@@ -100,6 +107,6 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.gpl3Plus;
 
     platforms = with platforms; linux ++ cygwin ++ darwin;
-    maintainers = with maintainers; [ pierron globin ];
+    maintainers = with maintainers; [ pierron globin lsix ];
   };
 }

pkgs/os-specific/linux/util-linux/default.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     substituteInPlace include/pathnames.h \
       --replace "/bin/login" "${shadow}/bin/login"
     substituteInPlace sys-utils/eject.c \
-      --replace "/bin/umount" "$out/bin/umount"
+      --replace "/bin/umount" "$bin/bin/umount"
   '';
 
   # !!! It would be better to obtain the path to the mount helpers

pkgs/stdenv/linux/bootstrap-files/armv5tel.nix

@@ -1,12 +1,12 @@
 {
   busybox = import <nix/fetchurl.nix> {
-    url = http://nixos-arm.dezgeg.me/bootstrap-2017-04-13-1f32d4b4/armv5tel/busybox;
+    url = https://hydra.nixos.org/build/112609163/download/2/busybox;
-    sha256 = "00mxas5xg2j9n1g0q0nklr0dy87qqxk0jja5qz1yi7xl7zzsnpnw";
+    sha256 = "0dc5471dc6a5f69ad98eb7445f51a61e88aa5792d7a677025bf012bdb513b763";
     executable = true;
   };
 
   bootstrapTools = import <nix/fetchurl.nix> {
-    url = http://nixos-arm.dezgeg.me/bootstrap-2017-04-13-1f32d4b4/armv5tel/bootstrap-tools.tar.xz;
+    url = https://hydra.nixos.org/build/112609163/download/1/bootstrap-tools.tar.xz;
-    sha256 = "0fhiy9l3mbmlhpkby31c2s63bhjiqx25qqr3wdp8cb7fxz8ayx2f";
+    sha256 = "ca0564eca4eb944649ce10ec70859640427bf2241243af62812b163176487e02";
   };
 }

pkgs/stdenv/linux/bootstrap-files/armv6l.nix

@@ -1,12 +1,12 @@
 {
   busybox = import <nix/fetchurl.nix> {
-    url = http://nixos-arm.dezgeg.me/bootstrap-2017-04-13-1f32d4b4/armv6l/busybox;
+    url = https://hydra.nixos.org/build/112609441/download/2/busybox;
-    sha256 = "06n8dy8y2v28yx9ws8x64wxrvn9pszgpd299hc90nv9x21m79jzd";
+    sha256 = "e6f6aecb675e924a96516f4379445dd2c0ba8b9c438fbfbaa2dc14ccce2802e0";
     executable = true;
   };
 
   bootstrapTools = import <nix/fetchurl.nix> {
-    url = http://nixos-arm.dezgeg.me/bootstrap-2017-04-13-1f32d4b4/armv6l/bootstrap-tools.tar.xz;
+    url = https://hydra.nixos.org/build/112609441/download/1/bootstrap-tools.tar.xz;
-    sha256 = "1gg2q3sw81vi65g1gmpvx0nnd6hxb76vlz73wfp292m90z1mym7f";
+    sha256 = "7a3f20def1a17ebf0edb5a92c403558429bcc2ac3d931b5e1bd88606cb217778";
   };
 }

pkgs/stdenv/linux/bootstrap-files/armv7l.nix

@@ -1,12 +1,12 @@
 {
   busybox = import <nix/fetchurl.nix> {
-    url = http://nixos-arm.dezgeg.me/bootstrap-2017-04-13-1f32d4b4/armv7l/busybox;
+    url = https://hydra.nixos.org/build/112609103/download/2/busybox;
-    sha256 = "187xwzsng5lpak1nanrk88y4mlydmrbhx6la00rrd6kjx376s565";
+    sha256 = "566a469dac214b31e4abdb0a91d32550bab1be5858d329e1b6074eef05370ca3";
     executable = true;
   };
 
   bootstrapTools = import <nix/fetchurl.nix> {
-    url = http://nixos-arm.dezgeg.me/bootstrap-2017-04-13-1f32d4b4/armv7l/bootstrap-tools.tar.xz;
+    url = https://hydra.nixos.org/build/112609103/download/1/bootstrap-tools.tar.xz;
-    sha256 = "05ayki2kak3i5lw97qidd5h9jv00dmlhx9h7l771bj331yamyqdn";
+    sha256 = "79fa2d7722aeb856c7c9b62a3fd64b6d261fd6f6bcbac486f0a2a7d823210550";
   };
 }

pkgs/stdenv/linux/bootstrap-tools/scripts/unpack-bootstrap-tools.sh

@@ -35,12 +35,7 @@ for i in $out/lib/librt-*.so $out/lib/libpcre*; do
     $out/bin/patchelf --set-rpath $out/lib --force-rpath "$i"
 done
 
-# Fix the libc linker script.
 export PATH=$out/bin
-cat $out/lib/libc.so | sed "s|/nix/store/e*-[^/]*/|$out/|g" > $out/lib/libc.so.tmp
-mv $out/lib/libc.so.tmp $out/lib/libc.so
-cat $out/lib/libpthread.so | sed "s|/nix/store/e*-[^/]*/|$out/|g" > $out/lib/libpthread.so.tmp
-mv $out/lib/libpthread.so.tmp $out/lib/libpthread.so
 
 # Provide some additional symlinks.
 ln -s bash $out/bin/sh

pkgs/tools/X11/vdpauinfo/default.nix

@@ -1,11 +1,12 @@
 { stdenv, fetchurl, pkgconfig, libvdpau }:
 
 stdenv.mkDerivation rec {
-  name = "vdpauinfo-1.0";
+  pname = "vdpauinfo";
+  version = "1.3";
 
   src = fetchurl {
-    url = "https://people.freedesktop.org/~aplattner/vdpau/${name}.tar.gz";
+    url = "https://gitlab.freedesktop.org/vdpau/vdpauinfo/uploads/6fa9718c507ef0fb6966170ef55344bf/${pname}-${version}.tar.gz";
-    sha256 = "1i2b0k9h8r0lnxlrkgqzmrjakgaw3f1ygqqwzx8w6676g85rcm20";
+    sha256 = "0s6jdadnycyd1agsnfx7hrf17hmipasx1fpmppd4m1z6i9sp1i6g";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/tools/networking/modem-manager/default.nix

@@ -3,12 +3,12 @@
 
 stdenv.mkDerivation rec {
   pname = "modem-manager";
-  version = "1.12.4";
+  version = "1.12.6";
 
   package = "ModemManager";
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${package}/${package}-${version}.tar.xz";
-    sha256 = "0nx9b6wfz2r29gb3wgsi5vflycibfhnij5wvc068s6hcbrsn2bc5";
+    sha256 = "0k32rjh06p3q9yq054gxya6c7n39bilhi4s23p2hb02iwlz3bcrf";
   };
 
   nativeBuildInputs = [ vala gobject-introspection gettext pkgconfig ];
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "WWAN modem manager, part of NetworkManager";
-    homepage = https://www.freedesktop.org/wiki/Software/ModemManager/;
+    homepage = "https://www.freedesktop.org/wiki/Software/ModemManager/";
     license = licenses.gpl2Plus;
     maintainers = [ ];
     platforms = platforms.linux;

pkgs/tools/security/gnupg/22.nix

@@ -33,6 +33,9 @@ stdenv.mkDerivation rec {
   patches = [
     ./fix-libusb-include-path.patch
     ./0001-dirmngr-Only-use-SKS-pool-CA-for-SKS-pool.patch
+    ./tests-add-test-cases-for-import-without-uid.patch
+    ./allow-import-of-previously-known-keys-even-without-UI.patch
+    ./accept-subkeys-with-a-good-revocation-but-no-self-sig.patch
   ];
   postPatch = ''
     sed -i 's,hkps://hkps.pool.sks-keyservers.net,hkps://keys.openpgp.org,g' \

pkgs/tools/security/gnupg/accept-subkeys-with-a-good-revocation-but-no-self-sig.patch

@@ -0,0 +1,32 @@
+From: Vincent Breitmoser <look@my.amazin.horse>
+Date: Thu, 13 Jun 2019 21:27:43 +0200
+Subject: gpg: accept subkeys with a good revocation but no self-sig during
+ import
+
+* g10/import.c (chk_self_sigs): Set the NODE_GOOD_SELFSIG flag when we
+encounter a valid revocation signature. This allows import of subkey
+revocation signatures, even in the absence of a corresponding subkey
+binding signature.
+
+--
+
+This fixes the remaining test in import-incomplete.scm.
+
+GnuPG-Bug-id: 4393
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ g10/import.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/g10/import.c b/g10/import.c
+index 4fdf248..ee2fed8 100644
+--- a/g10/import.c
++++ b/g10/import.c
+@@ -3613,6 +3613,7 @@ chk_self_sigs (ctrl_t ctrl, kbnode_t keyblock, u32 *keyid, int *non_self)
+                   /* It's valid, so is it newer? */
+                   if (sig->timestamp >= rsdate)
+                     {
++                      knode->flag |= NODE_GOOD_SELFSIG; /* Subkey is valid.  */
+                       if (rsnode)
+                         {
+                           /* Delete the last revocation sig since

pkgs/tools/security/gnupg/allow-import-of-previously-known-keys-even-without-UI.patch

@@ -0,0 +1,106 @@
+From: Vincent Breitmoser <look@my.amazin.horse>
+Date: Thu, 13 Jun 2019 21:27:42 +0200
+Subject: gpg: allow import of previously known keys, even without UIDs
+
+* g10/import.c (import_one): Accept an incoming OpenPGP certificate that
+has no user id, as long as we already have a local variant of the cert
+that matches the primary key.
+
+--
+
+This fixes two of the three broken tests in import-incomplete.scm.
+
+GnuPG-Bug-id: 4393
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ g10/import.c | 44 +++++++++++---------------------------------
+ 1 file changed, 11 insertions(+), 33 deletions(-)
+
+diff --git a/g10/import.c b/g10/import.c
+index 95d419a..4fdf248 100644
+--- a/g10/import.c
++++ b/g10/import.c
+@@ -1792,7 +1792,6 @@ import_one_real (ctrl_t ctrl,
+   size_t an;
+   char pkstrbuf[PUBKEY_STRING_SIZE];
+   int merge_keys_done = 0;
+-  int any_filter = 0;
+   KEYDB_HANDLE hd = NULL;
+ 
+   if (r_valid)
+@@ -1829,14 +1828,6 @@ import_one_real (ctrl_t ctrl,
+       log_printf ("\n");
+     }
+ 
+-
+-  if (!uidnode )
+-    {
+-      if (!silent)
+-        log_error( _("key %s: no user ID\n"), keystr_from_pk(pk));
+-      return 0;
+-    }
+-
+   if (screener && screener (keyblock, screener_arg))
+     {
+       log_error (_("key %s: %s\n"), keystr_from_pk (pk),
+@@ -1911,17 +1902,10 @@ import_one_real (ctrl_t ctrl,
+ 	  }
+     }
+ 
+-  if (!delete_inv_parts (ctrl, keyblock, keyid, options ) )
+-    {
+-      if (!silent)
+-        {
+-          log_error( _("key %s: no valid user IDs\n"), keystr_from_pk(pk));
+-          if (!opt.quiet )
+-            log_info(_("this may be caused by a missing self-signature\n"));
+-        }
+-      stats->no_user_id++;
+-      return 0;
+-    }
++  /* Delete invalid parts, and note if we have any valid ones left.
++   * We will later abort import if this key is new but contains
++   * no valid uids.  */
++  delete_inv_parts (ctrl, keyblock, keyid, options);
+ 
+   /* Get rid of deleted nodes.  */
+   commit_kbnode (&keyblock);
+@@ -1931,24 +1915,11 @@ import_one_real (ctrl_t ctrl,
+     {
+       apply_keep_uid_filter (ctrl, keyblock, import_filter.keep_uid);
+       commit_kbnode (&keyblock);
+-      any_filter = 1;
+     }
+   if (import_filter.drop_sig)
+     {
+       apply_drop_sig_filter (ctrl, keyblock, import_filter.drop_sig);
+       commit_kbnode (&keyblock);
+-      any_filter = 1;
+-    }
+-
+-  /* If we ran any filter we need to check that at least one user id
+-   * is left in the keyring.  Note that we do not use log_error in
+-   * this case. */
+-  if (any_filter && !any_uid_left (keyblock))
+-    {
+-      if (!opt.quiet )
+-        log_info ( _("key %s: no valid user IDs\n"), keystr_from_pk (pk));
+-      stats->no_user_id++;
+-      return 0;
+     }
+ 
+   /* The keyblock is valid and ready for real import.  */
+@@ -2006,6 +1977,13 @@ import_one_real (ctrl_t ctrl,
+       err = 0;
+       stats->skipped_new_keys++;
+     }
++  else if (err && !any_uid_left (keyblock))
++    {
++      if (!silent)
++        log_info( _("key %s: new key but contains no user ID - skipped\n"), keystr(keyid));
++      err = 0;
++      stats->no_user_id++;
++    }
+   else if (err)  /* Insert this key. */
+     {
+       /* Note: ERR can only be NO_PUBKEY or UNUSABLE_PUBKEY.  */

pkgs/tools/security/gnupg/tests-add-test-cases-for-import-without-uid.patch

@@ -0,0 +1,201 @@
+From: Vincent Breitmoser <look@my.amazin.horse>
+Date: Thu, 13 Jun 2019 21:27:41 +0200
+Subject: tests: add test cases for import without uid
+
+This commit adds a test case that does the following, in order:
+- Import of a primary key plus user id
+- Check that import of a subkey works, without a user id present in the
+imported key
+- Check that import of a subkey revocation works, without a user id or
+subkey binding signature present in the imported key
+- Check that import of a primary key revocation works, without a user id
+present in the imported key
+
+--
+
+Note that this test currently fails.  The following changesets will
+fix gpg so that the tests pass.
+
+GnuPG-Bug-id: 4393
+Signed-Off-By: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ tests/openpgp/Makefile.am                          |  1 +
+ tests/openpgp/import-incomplete.scm                | 68 ++++++++++++++++++++++
+ .../import-incomplete/primary+revocation.asc       |  9 +++
+ .../primary+subkey+sub-revocation.asc              | 10 ++++
+ .../import-incomplete/primary+subkey+sub-sig.asc   | 10 ++++
+ .../openpgp/import-incomplete/primary+uid-sig.asc  | 10 ++++
+ tests/openpgp/import-incomplete/primary+uid.asc    | 10 ++++
+ 7 files changed, 118 insertions(+)
+ create mode 100755 tests/openpgp/import-incomplete.scm
+ create mode 100644 tests/openpgp/import-incomplete/primary+revocation.asc
+ create mode 100644 tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc
+ create mode 100644 tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc
+ create mode 100644 tests/openpgp/import-incomplete/primary+uid-sig.asc
+ create mode 100644 tests/openpgp/import-incomplete/primary+uid.asc
+
+diff --git a/tests/openpgp/Makefile.am b/tests/openpgp/Makefile.am
+index f6014c9..6423da1 100644
+--- a/tests/openpgp/Makefile.am
++++ b/tests/openpgp/Makefile.am
+@@ -78,6 +78,7 @@ XTESTS = \
+ 	gpgv-forged-keyring.scm \
+ 	armor.scm \
+ 	import.scm \
++	import-incomplete.scm \
+ 	import-revocation-certificate.scm \
+ 	ecc.scm \
+ 	4gb-packet.scm \
+diff --git a/tests/openpgp/import-incomplete.scm b/tests/openpgp/import-incomplete.scm
+new file mode 100755
+index 0000000..727a027
+--- /dev/null
++++ b/tests/openpgp/import-incomplete.scm
+@@ -0,0 +1,68 @@
++#!/usr/bin/env gpgscm
++
++;; Copyright (C) 2016 g10 Code GmbH
++;;
++;; This file is part of GnuPG.
++;;
++;; GnuPG is free software; you can redistribute it and/or modify
++;; it under the terms of the GNU General Public License as published by
++;; the Free Software Foundation; either version 3 of the License, or
++;; (at your option) any later version.
++;;
++;; GnuPG is distributed in the hope that it will be useful,
++;; but WITHOUT ANY WARRANTY; without even the implied warranty of
++;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++;; GNU General Public License for more details.
++;;
++;; You should have received a copy of the GNU General Public License
++;; along with this program; if not, see <http://www.gnu.org/licenses/>.
++
++(load (in-srcdir "tests" "openpgp" "defs.scm"))
++(setup-environment)
++
++(call-check `(,(tool 'gpg) --import ,(in-srcdir "tests" "openpgp" "import-incomplete" "primary+uid.asc")))
++
++(info "Test import of new subkey, from a certificate without uid")
++(define keyid "573EA710367356BB")
++(call-check `(,(tool 'gpg) --import ,(in-srcdir "tests" "openpgp" "import-incomplete" "primary+subkey+sub-sig.asc")))
++(tr:do
++ (tr:pipe-do
++  (pipe:gpg `(--list-keys --with-colons ,keyid)))
++ (tr:call-with-content
++  (lambda (c)
++    ;; XXX we do not have a regexp library
++    (unless (any (lambda (line)
++		   (and (string-prefix? line "sub:")
++			(string-contains? line "573EA710367356BB")))
++		 (string-split-newlines c))
++	    (exit 1)))))
++
++(info "Test import of a subkey revocation, from a certificate without uid")
++(define keyid "573EA710367356BB")
++(call-check `(,(tool 'gpg) --import ,(in-srcdir "tests" "openpgp" "import-incomplete" "primary+subkey+sub-revocation.asc")))
++(tr:do
++ (tr:pipe-do
++  (pipe:gpg `(--list-keys --with-colons ,keyid)))
++ (tr:call-with-content
++  (lambda (c)
++    ;; XXX we do not have a regexp library
++    (unless (any (lambda (line)
++		   (and (string-prefix? line "sub:r:")
++			(string-contains? line "573EA710367356BB")))
++		 (string-split-newlines c))
++	    (exit 1)))))
++
++(info "Test import of revocation, from a certificate without uid")
++(call-check `(,(tool 'gpg) --import ,(in-srcdir "tests" "openpgp" "import-incomplete" "primary+revocation.asc")))
++(tr:do
++ (tr:pipe-do
++  (pipe:gpg `(--list-keys --with-colons ,keyid)))
++ (tr:call-with-content
++  (lambda (c)
++    ;; XXX we do not have a regexp library
++    (unless (any (lambda (line)
++		   (and (string-prefix? line "pub:r:")
++			(string-contains? line "0843DA969AA8DAFB")))
++		 (string-split-newlines c))
++	    (exit 1)))))
++
+diff --git a/tests/openpgp/import-incomplete/primary+revocation.asc b/tests/openpgp/import-incomplete/primary+revocation.asc
+new file mode 100644
+index 0000000..6b7b608
+--- /dev/null
++++ b/tests/openpgp/import-incomplete/primary+revocation.asc
+@@ -0,0 +1,9 @@
++-----BEGIN PGP PUBLIC KEY BLOCK-----
++Comment: [E] primary key, revocation signature over primary (no user ID)
++
++mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
++631VAN2IeAQgFggAIBYhBLRpj5W82H/gSMzKKQhD2paaqNr7BQJc2ZQZAh0AAAoJ
++EAhD2paaqNr7qAwA/2jBUpnN0BxwRO/4CrxvrLIsL+C9aSXJUOTv8XkP4lvtAQD3
++XsDFfFNgEueiTfF7HtOGt5LPmRqVvUpQSMVgJJW6CQ==
++=tM90
++-----END PGP PUBLIC KEY BLOCK-----
+diff --git a/tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc b/tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc
+new file mode 100644
+index 0000000..83a51a5
+--- /dev/null
++++ b/tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc
+@@ -0,0 +1,10 @@
++-----BEGIN PGP PUBLIC KEY BLOCK-----
++Comment: [D] primary key, subkey, subkey revocation (no user ID)
++
++mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
++631VAN24OARc2ZQhEgorBgEEAZdVAQUBAQdABsd5ha0AWXdXcSmfeiWIfrNcGqQK
++j++lwwWDAOlkVicDAQgHiHgEKBYIACAWIQS0aY+VvNh/4EjMyikIQ9qWmqja+wUC
++XNmnkAIdAgAKCRAIQ9qWmqja+ylaAQDmIKf86BJEq4OpDqU+V9D+wn2cyuxbyWVQ
++3r9LiL9qNwD/QAjyrhSN8L3Mfq+wdTHo5i0yB9ZCCpHLXSbhCqfWZwQ=
++=dwx2
++-----END PGP PUBLIC KEY BLOCK-----
+diff --git a/tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc b/tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc
+new file mode 100644
+index 0000000..dc47a02
+--- /dev/null
++++ b/tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc
+@@ -0,0 +1,10 @@
++-----BEGIN PGP PUBLIC KEY BLOCK-----
++Comment: [B] primary key, subkey, subkey binding sig (no user ID)
++
++mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
++631VAN24OARc2ZQhEgorBgEEAZdVAQUBAQdABsd5ha0AWXdXcSmfeiWIfrNcGqQK
++j++lwwWDAOlkVicDAQgHiHgEGBYIACAWIQS0aY+VvNh/4EjMyikIQ9qWmqja+wUC
++XNmUIQIbDAAKCRAIQ9qWmqja++vFAP98G1L+1/rWTGbsnxOAV2RocBYIroAvsbkR
++Ly6FdP8YNwEA7jOgT05CoKIe37MstpOz23mM80AK369Ca3JMmKKCQgg=
++=xuDu
++-----END PGP PUBLIC KEY BLOCK-----
+diff --git a/tests/openpgp/import-incomplete/primary+uid-sig.asc b/tests/openpgp/import-incomplete/primary+uid-sig.asc
+new file mode 100644
+index 0000000..134607d
+--- /dev/null
++++ b/tests/openpgp/import-incomplete/primary+uid-sig.asc
+@@ -0,0 +1,10 @@
++-----BEGIN PGP PUBLIC KEY BLOCK-----
++Comment: [C] primary key and self-sig expiring in 2024 (no user ID)
++
++mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
++631VAN2IlgQTFggAPgIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgBYhBLRpj5W8
++2H/gSMzKKQhD2paaqNr7BQJc2ZR1BQkJZgHcAAoJEAhD2paaqNr79soA/0lWkUsu
++3NLwgbni6EzJxnTzgeNMpljqNpipHAwfix9hAP93AVtFdC8g7hdUZxawobl9lnSN
++9ohXOEBWvdJgVv2YAg==
++=KWIK
++-----END PGP PUBLIC KEY BLOCK-----
+diff --git a/tests/openpgp/import-incomplete/primary+uid.asc b/tests/openpgp/import-incomplete/primary+uid.asc
+new file mode 100644
+index 0000000..055f300
+--- /dev/null
++++ b/tests/openpgp/import-incomplete/primary+uid.asc
+@@ -0,0 +1,10 @@
++-----BEGIN PGP PUBLIC KEY BLOCK-----
++Comment: [A] primary key, user ID, and self-sig expiring in 2021
++
++mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
++631VAN20CHRlc3Qga2V5iJYEExYIAD4WIQS0aY+VvNh/4EjMyikIQ9qWmqja+wUC
++XNmUGQIbAwUJA8JnAAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRAIQ9qWmqja
+++0G1AQDdQiwhXxjXLMqoth+D4SigVHTJK8ORwifzsy3UE7mPGwD/aZ67XbAF/lgI
++kv2O1Jo0u9BL9RNNF+L0DM7rAFbfMAs=
++=1eII
++-----END PGP PUBLIC KEY BLOCK-----

pkgs/top-level/all-packages.nix

@@ -10804,6 +10804,7 @@ in
 
   gdb = callPackage ../development/tools/misc/gdb {
     guile = null;
+    readline = readline80;
   };
 
   jhiccup = callPackage ../development/tools/java/jhiccup { };

pkgs/top-level/python-packages.nix

@@ -108,7 +108,7 @@ in {
   inherit buildSetupcfg;
 
   inherit (callPackage ../development/interpreters/python/hooks { })
-    eggUnpackHook eggBuildHook eggInstallHook flitBuildHook pipBuildHook pipInstallHook pytestCheckHook pythonCatchConflictsHook pythonImportsCheckHook pythonRemoveBinBytecodeHook setuptoolsBuildHook setuptoolsCheckHook venvShellHook wheelUnpackHook;
+    eggUnpackHook eggBuildHook eggInstallHook flitBuildHook pipBuildHook pipInstallHook pytestCheckHook pythonCatchConflictsHook pythonImportsCheckHook pythonRemoveBinBytecodeHook pythonRemoveTestsDirHook setuptoolsBuildHook setuptoolsCheckHook venvShellHook wheelUnpackHook;
 
   # helpers
 
@@ -121,7 +121,10 @@ in {
 
   recursivePthLoader = callPackage ../development/python-modules/recursive-pth-loader { };
 
-  setuptools = callPackage ../development/python-modules/setuptools { };
+  setuptools = if isPy27 then
+    callPackage ../development/python-modules/setuptools/44.0.nix { }
+  else
+    callPackage ../development/python-modules/setuptools { };
 
   vowpalwabbit = callPackage ../development/python-modules/vowpalwabbit { };