Merge master into staging-next

doc/functions/library/attrsets.xml

@@ -1474,7 +1474,7 @@ lib.attrsets.zipAttrsWith
  <section xml:id="function-library-lib.attrsets.zipAttrs">
   <title><function>lib.attrsets.zipAttrs</function></title>
 
-  <subtitle><literal>zipAttrsWith :: [ AttrSet ] -> AttrSet</literal>
+  <subtitle><literal>zipAttrs :: [ AttrSet ] -> AttrSet</literal>
   </subtitle>
 
   <xi:include href="./locations.xml" xpointer="lib.attrsets.zipAttrs" />

doc/languages-frameworks/ocaml.section.md

@@ -38,8 +38,8 @@ Here is a simple package example.
 
 - It uses the `fetchFromGitHub` fetcher to get its source.
 
-- `useDune2 = true` ensures that the latest version of Dune is used for the
+- `useDune2 = true` ensures that Dune version 2 is used for the
-  build (this may become the default value in a future release).
+  build (this is the default; set to `false` to use Dune version 1).
 
 - It sets the optional `doCheck` attribute such that tests will be run with
   `dune runtest -p angstrom` after the build (`dune build -p angstrom`) is

nixos/doc/manual/development/writing-modules.chapter.md

@@ -90,6 +90,17 @@ modules: `systemd.services` (the set of all systemd services) and
 `systemd.timers` (the list of commands to be executed periodically by
 `systemd`).
 
+Care must be taken when writing systemd services using `Exec*` directives. By
+default systemd performs substitution on `%<char>` specifiers in these
+directives, expands environment variables from `$FOO` and `${FOO}`, splits
+arguments on whitespace, and splits commands on `;`. All of these must be escaped
+to avoid unexpected substitution or splitting when interpolating into an `Exec*`
+directive, e.g. when using an `extraArgs` option to pass additional arguments to
+the service. The functions `utils.escapeSystemdExecArg` and
+`utils.escapeSystemdExecArgs` are provided for this, see [Example: Escaping in
+Exec directives](#exec-escaping-example) for an example. When using these
+functions system environment substitution should *not* be disabled explicitly.
+
 ::: {#locate-example .example}
 ::: {.title}
 **Example: NixOS Module for the "locate" Service**
@@ -153,6 +164,37 @@ in {
 ```
 :::
 
+::: {#exec-escaping-example .example}
+::: {.title}
+**Example: Escaping in Exec directives**
+:::
+```nix
+{ config, lib, pkgs, utils, ... }:
+
+with lib;
+
+let
+  cfg = config.services.echo;
+  echoAll = pkgs.writeScript "echo-all" ''
+    #! ${pkgs.runtimeShell}
+    for s in "$@"; do
+      printf '%s\n' "$s"
+    done
+  '';
+  args = [ "a%Nything" "lang=\${LANG}" ";" "/bin/sh -c date" ];
+in {
+  systemd.services.echo =
+    { description = "Echo to the journal";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig.Type = "oneshot";
+      serviceConfig.ExecStart = ''
+        ${echoAll} ${utils.escapeSystemdExecArgs args}
+      '';
+    };
+}
+```
+:::
+
 ```{=docbook}
 <xi:include href="option-declarations.section.xml" />
 <xi:include href="option-types.section.xml" />

nixos/doc/manual/from_md/development/writing-modules.chapter.xml

@@ -122,6 +122,25 @@
     services) and <literal>systemd.timers</literal> (the list of
     commands to be executed periodically by <literal>systemd</literal>).
   </para>
+  <para>
+    Care must be taken when writing systemd services using
+    <literal>Exec*</literal> directives. By default systemd performs
+    substitution on <literal>%&lt;char&gt;</literal> specifiers in these
+    directives, expands environment variables from
+    <literal>$FOO</literal> and <literal>${FOO}</literal>, splits
+    arguments on whitespace, and splits commands on
+    <literal>;</literal>. All of these must be escaped to avoid
+    unexpected substitution or splitting when interpolating into an
+    <literal>Exec*</literal> directive, e.g. when using an
+    <literal>extraArgs</literal> option to pass additional arguments to
+    the service. The functions
+    <literal>utils.escapeSystemdExecArg</literal> and
+    <literal>utils.escapeSystemdExecArgs</literal> are provided for
+    this, see <link linkend="exec-escaping-example">Example: Escaping in
+    Exec directives</link> for an example. When using these functions
+    system environment substitution should <emphasis>not</emphasis> be
+    disabled explicitly.
+  </para>
   <anchor xml:id="locate-example" />
   <para>
     <emphasis role="strong">Example: NixOS Module for the
@@ -183,6 +202,36 @@ in {
       };
   };
 }
+</programlisting>
+  <anchor xml:id="exec-escaping-example" />
+  <para>
+    <emphasis role="strong">Example: Escaping in Exec
+    directives</emphasis>
+  </para>
+  <programlisting language="bash">
+{ config, lib, pkgs, utils, ... }:
+
+with lib;
+
+let
+  cfg = config.services.echo;
+  echoAll = pkgs.writeScript &quot;echo-all&quot; ''
+    #! ${pkgs.runtimeShell}
+    for s in &quot;$@&quot;; do
+      printf '%s\n' &quot;$s&quot;
+    done
+  '';
+  args = [ &quot;a%Nything&quot; &quot;lang=\${LANG}&quot; &quot;;&quot; &quot;/bin/sh -c date&quot; ];
+in {
+  systemd.services.echo =
+    { description = &quot;Echo to the journal&quot;;
+      wantedBy = [ &quot;multi-user.target&quot; ];
+      serviceConfig.Type = &quot;oneshot&quot;;
+      serviceConfig.ExecStart = ''
+        ${echoAll} ${utils.escapeSystemdExecArgs args}
+      '';
+    };
+}
 </programlisting>
   <xi:include href="option-declarations.section.xml" />
   <xi:include href="option-types.section.xml" />

nixos/lib/utils.nix

@@ -45,6 +45,26 @@ rec {
    replaceChars ["/" "-" " "] ["-" "\\x2d" "\\x20"]
    (removePrefix "/" s);
 
+  # Quotes an argument for use in Exec* service lines.
+  # systemd accepts "-quoted strings with escape sequences, toJSON produces
+  # a subset of these.
+  # Additionally we escape % to disallow expansion of % specifiers. Any lone ;
+  # in the input will be turned it ";" and thus lose its special meaning.
+  # Every $ is escaped to $$, this makes it unnecessary to disable environment
+  # substitution for the directive.
+  escapeSystemdExecArg = arg:
+    let
+      s = if builtins.isPath arg then "${arg}"
+        else if builtins.isString arg then arg
+        else if builtins.isInt arg || builtins.isFloat arg then toString arg
+        else throw "escapeSystemdExecArg only allows strings, paths and numbers";
+    in
+      replaceChars [ "%" "$" ] [ "%%" "$$" ] (builtins.toJSON s);
+
+  # Quotes a list of arguments into a single string for use in a Exec*
+  # line.
+  escapeSystemdExecArgs = concatMapStringsSep " " escapeSystemdExecArg;
+
   # Returns a system path for a given shell package
   toShellPath = shell:
     if types.shellPackage.check shell then

nixos/modules/services/web-servers/tomcat.nix

@@ -23,8 +23,8 @@ in
 
       package = mkOption {
         type = types.package;
-        default = pkgs.tomcat85;
+        default = pkgs.tomcat9;
-        defaultText = literalExpression "pkgs.tomcat85";
+        defaultText = literalExpression "pkgs.tomcat9";
         example = lib.literalExpression "pkgs.tomcat9";
         description = ''
           Which tomcat package to use.
@@ -127,7 +127,7 @@ in
       webapps = mkOption {
         type = types.listOf types.path;
         default = [ tomcat.webapps ];
-        defaultText = literalExpression "[ pkgs.tomcat85.webapps ]";
+        defaultText = literalExpression "[ config.services.tomcat.package.webapps ]";
         description = "List containing WAR files or directories with WAR files which are web applications to be deployed on Tomcat";
       };
 
@@ -201,6 +201,7 @@ in
       { uid = config.ids.uids.tomcat;
         description = "Tomcat user";
         home = "/homeless-shelter";
+        group = "tomcat";
         extraGroups = cfg.extraGroups;
       };
 

nixos/tests/all-tests.nix

@@ -503,6 +503,7 @@ in
   systemd-boot = handleTest ./systemd-boot.nix {};
   systemd-confinement = handleTest ./systemd-confinement.nix {};
   systemd-cryptenroll = handleTest ./systemd-cryptenroll.nix {};
+  systemd-escaping = handleTest ./systemd-escaping.nix {};
   systemd-journal = handleTest ./systemd-journal.nix {};
   systemd-machinectl = handleTest ./systemd-machinectl.nix {};
   systemd-networkd = handleTest ./systemd-networkd.nix {};
@@ -524,6 +525,7 @@ in
   tinc = handleTest ./tinc {};
   tinydns = handleTest ./tinydns.nix {};
   tinywl = handleTest ./tinywl.nix {};
+  tomcat = handleTest ./tomcat.nix {};
   tor = handleTest ./tor.nix {};
   # traefik test relies on docker-containers
   traefik = handleTestOn ["x86_64-linux"] ./traefik.nix {};

nixos/tests/systemd-escaping.nix

@@ -0,0 +1,45 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+let
+  echoAll = pkgs.writeScript "echo-all" ''
+    #! ${pkgs.runtimeShell}
+    for s in "$@"; do
+      printf '%s\n' "$s"
+    done
+  '';
+  # deliberately using a local empty file instead of pkgs.emptyFile to have
+  # a non-store path in the test
+  args = [ "a%Nything" "lang=\${LANG}" ";" "/bin/sh -c date" ./empty-file 4.2 23 ];
+in
+{
+  name = "systemd-escaping";
+
+  machine = { pkgs, lib, utils, ... }: {
+    systemd.services.echo =
+      assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ [] ])).success;
+      assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ {} ])).success;
+      assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ null ])).success;
+      assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ false ])).success;
+      assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ (_:_) ])).success;
+      { description = "Echo to the journal";
+        serviceConfig.Type = "oneshot";
+        serviceConfig.ExecStart = ''
+          ${echoAll} ${utils.escapeSystemdExecArgs args}
+        '';
+      };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("systemctl start echo.service")
+    # skip the first 'Starting <service> ...' line
+    logs = machine.succeed("journalctl -u echo.service -o cat").splitlines()[1:]
+    assert "a%Nything" == logs[0]
+    assert "lang=''${LANG}" == logs[1]
+    assert ";" == logs[2]
+    assert "/bin/sh -c date" == logs[3]
+    assert "/nix/store/ij3gw72f4n5z4dz6nnzl1731p9kmjbwr-empty-file" == logs[4]
+    assert "4.2" in logs[5] # toString produces extra fractional digits!
+    assert "23" == logs[6]
+  '';
+})

nixos/tests/tomcat.nix

@@ -0,0 +1,21 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+{
+  name = "tomcat";
+
+  machine = { pkgs, ... }: {
+    services.tomcat.enable = true;
+  };
+
+  testScript = ''
+    machine.wait_for_unit("tomcat.service")
+    machine.wait_for_open_port(8080)
+    machine.wait_for_file("/var/tomcat/webapps/examples");
+    machine.succeed(
+        "curl --fail http://localhost:8080/examples/servlets/servlet/HelloWorldExample | grep 'Hello World!'"
+    )
+    machine.succeed(
+        "curl --fail http://localhost:8080/examples/jsp/jsp2/simpletag/hello.jsp | grep 'Hello, world!'"
+    )
+  '';
+})

pkgs/applications/emulators/cdemu/vhba.nix

@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-csWowcRSgF5M74yv787MLSXOGXrkxnODCCgC5a3Nd7Y=";
   };
 
-  makeFlags = [ "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" "INSTALL_MOD_PATH=$(out)" ];
+  makeFlags = kernel.makeFlags ++ [ "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" "INSTALL_MOD_PATH=$(out)" ];
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
   meta = with lib; {

pkgs/applications/misc/mediaelch/default.nix

@@ -18,13 +18,13 @@
 
 mkDerivation rec {
   pname = "mediaelch";
-  version = "2.8.14";
+  version = "2.8.16";
 
   src = fetchFromGitHub {
     owner = "Komet";
     repo = "MediaElch";
     rev = "v${version}";
-    sha256 = "sha256-yHThX5Xs+8SijNKgmg+4Mawbwi3zHA/DJQoIBy0Wchs=";
+    sha256 = "sha256-83bHfIRVAC+3RkCYmV+TBjjQxaFMHfVyxt5Jq44dzeI=";
     fetchSubmodules = true;
   };
 

pkgs/applications/networking/cluster/terraform-providers/update-all-providers

@@ -5,7 +5,7 @@
 # Update all providers which have specified provider source address
 set -euo pipefail
 
-providers=$(
+readarray -t providers < <(
   jq -r 'to_entries
   | map_values(.value + { alias: .key })
   | .[]
@@ -13,10 +13,13 @@ providers=$(
   | .alias' providers.json
 )
 
-echo "Will update providers:"
+cat <<EOF
-echo "${providers}"
+Will update ${#providers[@]} providers:
 
-for provider in ${providers}; do
+${providers[*]}
-  echo "Updating ${provider}"
+
+EOF
+
+for provider in "${providers[@]}"; do
   ./update-provider "$@" "${provider}"
 done

pkgs/applications/networking/cluster/terraform-providers/update-provider

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -I nixpkgs=../../../../.. -i bash -p coreutils curl jq moreutils nix nix-prefetch
+#! nix-shell -I nixpkgs=../../../../.. -i bash -p coreutils curl git jq moreutils nix nix-prefetch
 # shellcheck shell=bash
 # vim: ft=sh
 #
@@ -75,45 +75,46 @@ if [[ -z ${provider} ]]; then
   exit 1
 fi
 
-provider_name=$(basename "${provider}")
-
 # Usage: read_attr <key>
 read_attr() {
-  jq -r ".\"${provider_name}\".\"$1\"" providers.json
+  jq -r ".\"${provider}\".\"$1\"" providers.json
 }
 
 # Usage: update_attr <key> <value>
 update_attr() {
   if [[ $2 == "null" ]]; then
-    jq -S ".\"${provider_name}\".\"$1\" = null" providers.json | sponge providers.json
+    jq -S ".\"${provider}\".\"$1\" = null" providers.json | sponge providers.json
   else
-    jq -S ".\"${provider_name}\".\"$1\" = \"$2\"" providers.json | sponge providers.json
+    jq -S ".\"${provider}\".\"$1\" = \"$2\"" providers.json | sponge providers.json
   fi
 }
 
-prefetch_github() {
+repo_root=$(git rev-parse --show-toplevel)
-  # of a given owner, repo and rev, fetch the tarball and return the output of
+
-  # `nix-prefetch-url`
+generate_hash() {
-  local owner=$1
+  nix-prefetch -I nixpkgs="${repo_root}" \
-  local repo=$2
+    "{ sha256 }: (import ${repo_root} {}).terraform-providers.${provider}.$1.overrideAttrs (_: { $2 = sha256; })"
-  local rev=$3
-  nix-prefetch-url --unpack "https://github.com/${owner}/${repo}/archive/${rev}.tar.gz"
 }
 
-old_source_address="$(read_attr provider-source-address)"
+echo_provider() {
-old_vendor_sha256=$(read_attr vendorSha256)
+  echo "== terraform-providers.${provider}: $* =="
-old_version=$(read_attr version)
+}
 
 if [[ ${provider} =~ ^[^/]+/[^/]+$ ]]; then
+  echo_provider "init"
   source_address=registry.terraform.io/${provider}
+  provider=$(basename "${provider}")
+  update_attr "provider-source-address" "${source_address}"
+  update_attr version "0"
+  # create empty stings so nix-prefetch works
+  update_attr sha256 ""
+  update_attr vendorSha256 ""
 else
-  source_address=${old_source_address}
+  source_address="$(read_attr provider-source-address)"
 fi
-if [[ ${source_address} == "null" ]]; then
+
-  echo "Could not find the source address for provider: ${provider}"
+old_vendor_sha256=$(read_attr vendorSha256)
-  exit 1
+old_version=$(read_attr version)
-fi
-update_attr "provider-source-address" "${source_address}"
 
 # The provider source address (used inside Terraform `required_providers` block) is
 # used to compute the registry API endpoint
@@ -125,8 +126,10 @@ registry_response=$(curl -s https://"${source_address/\///v1/providers/}")
 
 version="$(jq -r '.version' <<<"${registry_response}")"
 if [[ ${old_version} == "${version}" && ${force} != 1 && -z ${vendorSha256} && ${old_vendor_sha256} != "${vendorSha256}" ]]; then
-  echo "${provider_name} is already at version ${version}"
+  echo_provider "already at version ${version}"
   exit
+else
+  echo_provider "updating from ${old_version} to ${version}"
 fi
 update_attr version "${version}"
 
@@ -138,28 +141,23 @@ repo="$(echo "${provider_source_url}" | cut -d '/' -f 5)"
 update_attr repo "${repo}"
 rev="$(jq -r '.tag' <<<"${registry_response}")"
 update_attr rev "${rev}"
-sha256=$(prefetch_github "${org}" "${repo}" "${rev}")
+echo_provider "calculating sha256"
+sha256=$(generate_hash src outputHash)
 update_attr sha256 "${sha256}"
 
 if [[ -z ${vendorSha256} ]]; then
   if [[ ${old_vendor_sha256} == null ]]; then
     vendorSha256=null
-  elif [[ -n ${old_vendor_sha256} ]]; then
+  else
-    echo "=== Calculating vendorSha256 ==="
+    echo_provider "calculating vendorSha256"
-    vendorSha256=$(nix-prefetch -I nixpkgs=../../../../.. "{ sha256 }: (import ../../../../.. {}).terraform-providers.${provider_name}.go-modules.overrideAttrs (_: { vendorSha256 = sha256; })")
+    vendorSha256=$(generate_hash go-modules vendorSha256)
-    # Deal with nix unstable
-    if [[ ${vendorSha256} == sha256-* ]]; then
-      vendorSha256=$(nix --extra-experimental-features nix-command hash to-base32 "${vendorSha256}")
-    fi
   fi
 fi
 
-if [[ -n ${vendorSha256} ]]; then
+update_attr vendorSha256 "${vendorSha256}"
-  update_attr vendorSha256 "${vendorSha256}"
-fi
 
 # Check that the provider builds
 if [[ ${build} == 1 ]]; then
-  echo "=== Building terraform-providers.${provider_name} ==="
+  echo_provider "building"
-  nix-build --no-out-link ../../../../.. -A "terraform-providers.${provider_name}"
+  nix-build --no-out-link "${repo_root}" -A "terraform-providers.${provider}"
 fi

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -24,7 +24,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "5.34.0"; # Please backport all updates to the stable channel.
+  version = "5.35.0"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "sha256-uU4WJtd9qwrjHgsK0oDg/pCf/5lfNhoMDEd/lHUnLwk=";
+    sha256 = "sha256-2KF2OLq6/vHElgloxn+kgQisJC+HAkpOBfsKfEPW35c=";
   };
 
   nativeBuildInputs = [

pkgs/build-support/fetchurl/mirrors.nix

@@ -1,6 +1,6 @@
 {
 
-  # Content-addressable Nix mirrors.
+  # Content-addressable Nix mirrors
   hashedMirrors = [
     "https://tarballs.nixos.org"
   ];
@@ -8,52 +8,48 @@
   # Mirrors for mirror://site/filename URIs, where "site" is
   # "sourceforge", "gnu", etc.
 
-  luarocks = [
+  # Alsa Project
-    "https://luarocks.org/"
+  alsa = [
-    "https://raw.githubusercontent.com/rocks-moonscript-org/moonrocks-mirror/master/"
+    "https://www.alsa-project.org/files/pub/"
-    "https://luafr.org/moonrocks/"
+    "ftp://ftp.alsa-project.org/pub/"
-    "http://luarocks.logiceditor.com/rocks/"
+    "http://alsa.cybermirror.org/"
+    "http://www.mirrorservice.org/sites/ftp.alsa-project.org/pub/"
   ];
 
-  # SourceForge.
+  # Apache
-  sourceforge = [
+  apache = [
-    "https://downloads.sourceforge.net/"
+    "https://www-eu.apache.org/dist/"
-    "https://prdownloads.sourceforge.net/"
+    "https://ftp.wayne.edu/apache/"
-    "https://netcologne.dl.sourceforge.net/sourceforge/"
+    "https://www.apache.org/dist/"
-    "https://versaweb.dl.sourceforge.net/sourceforge/"
+    "https://archive.apache.org/dist/" # fallback for old releases
-    "https://freefr.dl.sourceforge.net/sourceforge/"
+    "https://apache.cs.uu.nl/"
-    "https://osdn.dl.sourceforge.net/sourceforge/"
+    "https://apache.cs.utah.edu/"
-    "https://kent.dl.sourceforge.net/sourceforge/"
+    "http://ftp.tudelft.nl/apache/"
+    "ftp://ftp.funet.fi/pub/mirrors/apache.org/"
   ];
 
-  # OSDN (formerly SourceForge.jp).
+  # Bioconductor mirrors (from https://bioconductor.org/about/mirrors/)
-  osdn = [
+  # The commented-out ones don't seem to allow direct package downloads;
-    "https://osdn.dl.osdn.jp/"
+  # they serve error messages that result in hash mismatches instead
-    "https://osdn.mirror.constant.com/"
+  bioc = [
-    "https://mirrors.gigenet.com/OSDN/"
+    # http://bioc.ism.ac.jp/
-    "https://osdn.dl.sourceforge.jp/"
+    # http://bioc.openanalytics.eu/
-    "https://jaist.dl.sourceforge.jp/"
+    # http://bioconductor.fmrp.usp.br/
+    # http://mirror.aarnet.edu.au/pub/bioconductor/
+    # http://watson.nci.nih.gov/bioc_mirror/
+    "https://bioconductor.statistik.tu-dortmund.de/packages/"
+    "https://mirrors.ustc.edu.cn/bioc/"
+    "http://bioconductor.jp/packages/"
   ];
 
-  # GNU (https://www.gnu.org/prep/ftp.html).
+  # BitlBee mirrors, see https://www.bitlbee.org/main.php/mirrors.html
-  gnu = [
+  bitlbee = [
-    # This one redirects to a (supposedly) nearby and (supposedly) up-to-date
+    "https://get.bitlbee.org/"
-    # mirror.
+    "https://ftp.snt.utwente.nl/pub/software/bitlbee/"
-    "https://ftpmirror.gnu.org/"
+    "http://bitlbee.intergenia.de/"
-
-    "https://ftp.nluug.nl/pub/gnu/"
-    "https://mirrors.kernel.org/gnu/"
-    "https://mirror.ibcp.fr/pub/gnu/"
-    "https://mirror.dogado.de/gnu/"
-    "https://mirror.tochlab.net/pub/gnu/"
-
-    # This one is the master repository, and thus it's always up-to-date.
-    "https://ftp.gnu.org/pub/gnu/"
-
-    "ftp://ftp.funet.fi/pub/mirrors/ftp.gnu.org/gnu/"
   ];
 
-  # GCC.
+  # GCC
   gcc = [
     "https://bigsearcher.com/mirrors/gcc/"
     "https://mirror.koddos.net/gcc/"
@@ -63,7 +59,37 @@
     "ftp://gcc.gnu.org/pub/gcc/"
   ];
 
-  # GnuPG.
+  # GNOME
+  gnome = [
+    # This one redirects to some mirror closeby, so it should be all you need
+    "https://download.gnome.org/"
+
+    "https://fr2.rpmfind.net/linux/gnome.org/"
+    "https://ftp.acc.umu.se/pub/GNOME/"
+    "https://ftp.belnet.be/mirror/ftp.gnome.org/"
+    "ftp://ftp.cse.buffalo.edu/pub/Gnome/"
+    "ftp://ftp.nara.wide.ad.jp/pub/X11/GNOME/"
+  ];
+
+  # GNU (https://www.gnu.org/prep/ftp.html)
+  gnu = [
+    # This one redirects to a (supposedly) nearby and (supposedly) up-to-date
+    # mirror
+    "https://ftpmirror.gnu.org/"
+
+    "https://ftp.nluug.nl/pub/gnu/"
+    "https://mirrors.kernel.org/gnu/"
+    "https://mirror.ibcp.fr/pub/gnu/"
+    "https://mirror.dogado.de/gnu/"
+    "https://mirror.tochlab.net/pub/gnu/"
+
+    # This one is the master repository, and thus it's always up-to-date
+    "https://ftp.gnu.org/pub/gnu/"
+
+    "ftp://ftp.funet.fi/pub/mirrors/ftp.gnu.org/gnu/"
+  ];
+
+  # GnuPG
   gnupg = [
     "https://gnupg.org/ftp/gcrypt/"
     "https://mirrors.dotsrc.org/gcrypt/"
@@ -72,11 +98,13 @@
     "http://www.ring.gr.jp/pub/net/"
   ];
 
-  # kernel.org's /pub (/pub/{linux,software}) tree.
+  # ImageMagick mirrors, see https://www.imagemagick.org/script/mirror.php
-  kernel = [
+  imagemagick = [
-    "https://cdn.kernel.org/pub/"
+    "https://www.imagemagick.org/download/"
-    "http://linux-kernel.uio.no/pub/"
+    "https://mirror.checkdomain.de/imagemagick/"
-    "ftp://ftp.funet.fi/pub/mirrors/ftp.kernel.org/pub/"
+    "https://ftp.nluug.nl/ImageMagick/"
+    "https://ftp.sunet.se/mirror/imagemagick.org/ftp/"
+    "ftp://ftp.sunet.se/mirror/imagemagick.org/ftp/" # also contains older versions removed from most mirrors
   ];
 
   # Mirrors from https://download.kde.org/ls-lR.mirrorlist
@@ -89,195 +117,47 @@
     "https://ftp.funet.fi/pub/mirrors/ftp.kde.org/pub/kde/"
   ];
 
-  # Gentoo files.
+  # kernel.org's /pub (/pub/{linux,software}) tree
-  gentoo = [
+  kernel = [
-    "https://ftp.snt.utwente.nl/pub/os/linux/gentoo/"
+    "https://cdn.kernel.org/pub/"
-    "https://distfiles.gentoo.org/"
+    "http://linux-kernel.uio.no/pub/"
-    "https://mirrors.kernel.org/gentoo/"
+    "ftp://ftp.funet.fi/pub/mirrors/ftp.kernel.org/pub/"
-  ];
-
-  savannah = [
-    # Mirrors from https://download-mirror.savannah.gnu.org/releases/00_MIRRORS.html
-    "https://mirror.easyname.at/nongnu/"
-    "https://savannah.c3sl.ufpr.br/"
-    "https://mirror.csclub.uwaterloo.ca/nongnu/"
-    "https://mirror.cedia.org.ec/nongnu/"
-    "https://ftp.igh.cnrs.fr/pub/nongnu/"
-    "https://mirror6.layerjet.com/nongnu"
-    "https://mirror.netcologne.de/savannah/"
-    "https://ftp.cc.uoc.gr/mirrors/nongnu.org/"
-    "https://nongnu.uib.no/"
-    "https://ftp.acc.umu.se/mirror/gnu.org/savannah/"
-    "http://mirror2.klaus-uwe.me/nongnu/"
-    "http://mirrors.fe.up.pt/pub/nongnu/"
-    "http://ftp.twaren.net/Unix/NonGNU/"
-    "http://savannah-nongnu-org.ip-connect.vn.ua/"
-    "http://www.mirrorservice.org/sites/download.savannah.gnu.org/releases/"
-    "http://gnu.mirrors.pair.com/savannah/savannah/"
-    "ftp://mirror.easyname.at/nongnu/"
-    "ftp://mirror2.klaus-uwe.me/nongnu/"
-    "ftp://mirror.csclub.uwaterloo.ca/nongnu/"
-    "ftp://ftp.igh.cnrs.fr/pub/nongnu/"
-    "ftp://mirror.netcologne.de/savannah/"
-    "ftp://nongnu.uib.no/pub/nongnu/"
-    "ftp://mirrors.fe.up.pt/pub/nongnu/"
-    "ftp://ftp.twaren.net/Unix/NonGNU/"
-    "ftp://savannah-nongnu-org.ip-connect.vn.ua/mirror/savannah.nongnu.org/"
-    "ftp://ftp.mirrorservice.org/sites/download.savannah.gnu.org/releases/"
-  ];
-
-  samba = [
-    "https://www.samba.org/ftp/"
-    "http://www.samba.org/ftp/"
-  ];
-
-  # BitlBee mirrors, see https://www.bitlbee.org/main.php/mirrors.html .
-  bitlbee = [
-    "https://get.bitlbee.org/"
-    "https://ftp.snt.utwente.nl/pub/software/bitlbee/"
-    "http://bitlbee.intergenia.de/"
-  ];
-
-  # ImageMagick mirrors, see https://www.imagemagick.org/script/mirror.php
-  imagemagick = [
-    "https://www.imagemagick.org/download/"
-    "https://mirror.checkdomain.de/imagemagick/"
-    "https://ftp.nluug.nl/ImageMagick/"
-    "https://ftp.sunet.se/mirror/imagemagick.org/ftp/"
-    "ftp://ftp.sunet.se/mirror/imagemagick.org/ftp/" # also contains older versions removed from most mirrors
-  ];
-
-  # CPAN mirrors.
-  cpan = [
-    "https://cpan.metacpan.org/"
-    "https://cpan.perl.org/"
-    "https://mirrors.kernel.org/CPAN/"
-    "https://backpan.perl.org/"  # for old releases
-  ];
-
-  # CentOS.
-  centos = [
-    # For old releases
-    "https://vault.centos.org/"
-    "https://archive.kernel.org/centos-vault/"
-    "https://ftp.jaist.ac.jp/pub/Linux/CentOS-vault/"
-    "https://mirrors.aliyun.com/centos-vault/"
-    "https://mirror.chpc.utah.edu/pub/vault.centos.org/"
-    "https://mirror.math.princeton.edu/pub/centos-vault/"
-    "https://mirrors.tripadvisor.com/centos-vault/"
-    "http://mirror.centos.org/centos/"
-  ];
-
-  # Debian.
-  debian = [
-    "https://httpredir.debian.org/debian/"
-    "https://ftp.debian.org/debian/"
-    "https://mirrors.edge.kernel.org/debian/"
-    "ftp://ftp.de.debian.org/debian/"
-    "ftp://ftp.fr.debian.org/debian/"
-    "ftp://ftp.nl.debian.org/debian/"
-    "ftp://ftp.ru.debian.org/debian/"
-    "http://archive.debian.org/debian-archive/debian/"
-    "ftp://ftp.funet.fi/pub/mirrors/ftp.debian.org/debian/"
-  ];
-
-  # Ubuntu.
-  ubuntu = [
-    "https://nl.archive.ubuntu.com/ubuntu/"
-    "https://old-releases.ubuntu.com/ubuntu/"
-    "https://mirrors.edge.kernel.org/ubuntu/"
-    "http://de.archive.ubuntu.com/ubuntu/"
-    "http://archive.ubuntu.com/ubuntu/"
-  ];
-
-  # Fedora (please only add full mirrors that carry old Fedora distributions as well).
-  # See: https://mirrors.fedoraproject.org/publiclist (but not all carry old content).
-  fedora = [
-    "https://archives.fedoraproject.org/pub/fedora/"
-    "https://fedora.osuosl.org/"
-    "https://ftp.funet.fi/pub/mirrors/ftp.redhat.com/pub/fedora/"
-    "https://ftp.linux.cz/pub/linux/fedora/"
-    "https://archives.fedoraproject.org/pub/archive/fedora/"
-    "http://ftp.nluug.nl/pub/os/Linux/distr/fedora/"
-    "http://mirror.csclub.uwaterloo.ca/fedora/"
-    "http://mirror.1000mbps.com/fedora/"
-  ];
-
-  # openSUSE.
-  opensuse = [
-    "https://opensuse.hro.nl/opensuse/distribution/"
-    "https://ftp.funet.fi/pub/linux/mirrors/opensuse/distribution/"
-    "https://ftp.opensuse.org/pub/opensuse/distribution/"
-    "https://ftp5.gwdg.de/pub/opensuse/discontinued/distribution/"
-    "https://mirrors.edge.kernel.org/opensuse/distribution/"
-    "http://ftp.hosteurope.de/mirror/ftp.opensuse.org/discontinued/"
-  ];
-
-  gnome = [
-    # This one redirects to some mirror closeby, so it should be all you need.
-    "https://download.gnome.org/"
-
-    "https://fr2.rpmfind.net/linux/gnome.org/"
-    "https://ftp.acc.umu.se/pub/GNOME/"
-    "https://ftp.belnet.be/mirror/ftp.gnome.org/"
-    "ftp://ftp.cse.buffalo.edu/pub/Gnome/"
-    "ftp://ftp.nara.wide.ad.jp/pub/X11/GNOME/"
-  ];
-
-  xfce = [
-    "https://archive.xfce.org/"
-    "https://mirror.netcologne.de/xfce/"
-    "https://archive.be.xfce.org/xfce/"
-    "https://archive.al-us.xfce.org/"
-    "http://archive.se.xfce.org/xfce/"
-    "http://mirror.perldude.de/archive.xfce.org/"
-    "http://archive.be2.xfce.org/"
-    "http://ftp.udc.es/xfce/"
-  ];
-
-  # X.org.
-  xorg = [
-    "https://xorg.freedesktop.org/releases/"
-    "https://ftp.x.org/archive/"
-  ];
-
-  apache = [
-    "https://www-eu.apache.org/dist/"
-    "https://ftp.wayne.edu/apache/"
-    "https://www.apache.org/dist/"
-    "https://archive.apache.org/dist/" # fallback for old releases
-    "https://apache.cs.uu.nl/"
-    "https://apache.cs.utah.edu/"
-    "http://ftp.tudelft.nl/apache/"
-    "ftp://ftp.funet.fi/pub/mirrors/apache.org/"
-  ];
-
-  postgresql = [
-    "https://ftp.postgresql.org/pub/"
   ];
 
+  # Metalab, now IBiblio
   metalab = [
     "ftp://ftp.gwdg.de/pub/linux/metalab/"
     "ftp://ftp.metalab.unc.edu/pub/linux/"
   ];
 
-  # Bioconductor mirrors (from https://bioconductor.org/about/mirrors/)
+  # MySQL
-  # The commented-out ones don't seem to allow direct package downloads;
+  mysql = [
-  # they serve error messages that result in hash mismatches instead.
+    "https://cdn.mysql.com/Downloads/"
-  bioc = [
-    # http://bioc.ism.ac.jp/
-    # http://bioc.openanalytics.eu/
-    # http://bioconductor.fmrp.usp.br/
-    # http://mirror.aarnet.edu.au/pub/bioconductor/
-    # http://watson.nci.nih.gov/bioc_mirror/
-    "https://bioconductor.statistik.tu-dortmund.de/packages/"
-    "https://mirrors.ustc.edu.cn/bioc/"
-    "http://bioconductor.jp/packages/"
   ];
 
-  # Hackage mirrors
+  # Maven Central
-  hackage = [
+  maven = [
-    "https://hackage.haskell.org/package/"
+    "https://repo1.maven.org/maven2/"
+  ];
+
+  # Mozilla projects
+  mozilla = [
+    "https://download.cdn.mozilla.net/pub/mozilla.org/"
+    "https://archive.mozilla.org/pub/"
+  ];
+
+  # OSDN (formerly SourceForge.jp)
+  osdn = [
+    "https://osdn.dl.osdn.jp/"
+    "https://osdn.mirror.constant.com/"
+    "https://mirrors.gigenet.com/OSDN/"
+    "https://osdn.dl.sourceforge.jp/"
+    "https://jaist.dl.sourceforge.jp/"
+  ];
+
+  # PostgreSQL
+  postgresql = [
+    "https://ftp.postgresql.org/pub/"
   ];
 
   # Roy marples mirrors
@@ -329,25 +209,114 @@
     "http://ftp.ntua.gr/pub/sagemath/spkg/upstream/"
   ];
 
-  # MySQL mirrors
+  # SAMBA
-  mysql = [
+  samba = [
-    "https://cdn.mysql.com/Downloads/"
+    "https://www.samba.org/ftp/"
+    "http://www.samba.org/ftp/"
   ];
 
-  # OpenBSD mirrors
+  # GNU Savannah
-  openbsd = [
+  savannah = [
-    "https://ftp.openbsd.org/pub/OpenBSD/"
+    # Mirrors from https://download-mirror.savannah.gnu.org/releases/00_MIRRORS.html
-    "ftp://ftp.nluug.nl/pub/OpenBSD/"
+    "https://mirror.easyname.at/nongnu/"
-    "ftp://ftp-stud.fht-esslingen.de/pub/OpenBSD/"
+    "https://savannah.c3sl.ufpr.br/"
+    "https://mirror.csclub.uwaterloo.ca/nongnu/"
+    "https://mirror.cedia.org.ec/nongnu/"
+    "https://ftp.igh.cnrs.fr/pub/nongnu/"
+    "https://mirror6.layerjet.com/nongnu"
+    "https://mirror.netcologne.de/savannah/"
+    "https://ftp.cc.uoc.gr/mirrors/nongnu.org/"
+    "https://nongnu.uib.no/"
+    "https://ftp.acc.umu.se/mirror/gnu.org/savannah/"
+    "http://mirror2.klaus-uwe.me/nongnu/"
+    "http://mirrors.fe.up.pt/pub/nongnu/"
+    "http://ftp.twaren.net/Unix/NonGNU/"
+    "http://savannah-nongnu-org.ip-connect.vn.ua/"
+    "http://www.mirrorservice.org/sites/download.savannah.gnu.org/releases/"
+    "http://gnu.mirrors.pair.com/savannah/savannah/"
+    "ftp://mirror.easyname.at/nongnu/"
+    "ftp://mirror2.klaus-uwe.me/nongnu/"
+    "ftp://mirror.csclub.uwaterloo.ca/nongnu/"
+    "ftp://ftp.igh.cnrs.fr/pub/nongnu/"
+    "ftp://mirror.netcologne.de/savannah/"
+    "ftp://nongnu.uib.no/pub/nongnu/"
+    "ftp://mirrors.fe.up.pt/pub/nongnu/"
+    "ftp://ftp.twaren.net/Unix/NonGNU/"
+    "ftp://savannah-nongnu-org.ip-connect.vn.ua/mirror/savannah.nongnu.org/"
+    "ftp://ftp.mirrorservice.org/sites/download.savannah.gnu.org/releases/"
   ];
 
-  # Steam Runtime mirrors
+  # SourceForge
+  sourceforge = [
+    "https://downloads.sourceforge.net/"
+    "https://prdownloads.sourceforge.net/"
+    "https://netcologne.dl.sourceforge.net/sourceforge/"
+    "https://versaweb.dl.sourceforge.net/sourceforge/"
+    "https://freefr.dl.sourceforge.net/sourceforge/"
+    "https://osdn.dl.sourceforge.net/sourceforge/"
+    "https://kent.dl.sourceforge.net/sourceforge/"
+  ];
+
+  # Steam Runtime
   steamrt = [
     "https://repo.steampowered.com/steamrt/"
     "https://public.abbradar.moe/steamrt/"
   ];
 
-  # Python PyPI mirrors
+  # TCSH shell
+  tcsh = [
+    "https://astron.com/pub/tcsh/"
+    "https://astron.com/pub/tcsh/old/"
+    "http://ftp.funet.fi/pub/mirrors/ftp.astron.com/pub/tcsh/"
+    "http://ftp.funet.fi/pub/mirrors/ftp.astron.com/pub/tcsh/old/"
+    "ftp://ftp.astron.com/pub/tcsh/"
+    "ftp://ftp.astron.com/pub/tcsh/old/"
+    "ftp://ftp.funet.fi/pub/unix/shells/tcsh/"
+    "ftp://ftp.funet.fi/pub/unix/shells/tcsh/old/"
+  ];
+
+  # XFCE
+  xfce = [
+    "https://archive.xfce.org/"
+    "https://mirror.netcologne.de/xfce/"
+    "https://archive.be.xfce.org/xfce/"
+    "https://archive.al-us.xfce.org/"
+    "http://archive.se.xfce.org/xfce/"
+    "http://mirror.perldude.de/archive.xfce.org/"
+    "http://archive.be2.xfce.org/"
+    "http://ftp.udc.es/xfce/"
+  ];
+
+  # X.org
+  xorg = [
+    "https://xorg.freedesktop.org/releases/"
+    "https://ftp.x.org/archive/"
+  ];
+
+  ### Programming languages' package repos
+
+  # Perl CPAN
+  cpan = [
+    "https://cpan.metacpan.org/"
+    "https://cpan.perl.org/"
+    "https://mirrors.kernel.org/CPAN/"
+    "https://backpan.perl.org/"  # for old releases
+  ];
+
+  # Haskell Hackage
+  hackage = [
+    "https://hackage.haskell.org/package/"
+  ];
+
+  # Lua Rocks
+  luarocks = [
+    "https://luarocks.org/"
+    "https://raw.githubusercontent.com/rocks-moonscript-org/moonrocks-mirror/master/"
+    "https://luafr.org/moonrocks/"
+    "http://luarocks.logiceditor.com/rocks/"
+  ];
+
+  # Python PyPI
   pypi = [
     "https://files.pythonhosted.org/packages/source/"
     # pypi.io is a more semantic link, but atm it’s referencing
@@ -355,27 +324,85 @@
     "https://pypi.io/packages/source/"
   ];
 
-  # Python Test-PyPI mirror
+  # Python Test-PyPI
   testpypi = [
     "https://test.pypi.io/packages/source/"
   ];
 
-  # Mozilla projects.
+  ### Linux distros
-  mozilla = [
+
-    "https://download.cdn.mozilla.net/pub/mozilla.org/"
+  # CentOS
-    "https://archive.mozilla.org/pub/"
+  centos = [
+    # For old releases
+    "https://vault.centos.org/"
+    "https://archive.kernel.org/centos-vault/"
+    "https://ftp.jaist.ac.jp/pub/Linux/CentOS-vault/"
+    "https://mirrors.aliyun.com/centos-vault/"
+    "https://mirror.chpc.utah.edu/pub/vault.centos.org/"
+    "https://mirror.math.princeton.edu/pub/centos-vault/"
+    "https://mirrors.tripadvisor.com/centos-vault/"
+    "http://mirror.centos.org/centos/"
   ];
 
-  # Maven Central
+  # Debian
-  maven = [
+  debian = [
-    "https://repo1.maven.org/maven2/"
+    "https://httpredir.debian.org/debian/"
+    "https://ftp.debian.org/debian/"
+    "https://mirrors.edge.kernel.org/debian/"
+    "ftp://ftp.de.debian.org/debian/"
+    "ftp://ftp.fr.debian.org/debian/"
+    "ftp://ftp.nl.debian.org/debian/"
+    "ftp://ftp.ru.debian.org/debian/"
+    "http://archive.debian.org/debian-archive/debian/"
+    "ftp://ftp.funet.fi/pub/mirrors/ftp.debian.org/debian/"
   ];
 
-  # Alsa Project
+  # Fedora
-  alsa = [
+  # Please add only full mirrors that carry old Fedora distributions as well
-    "https://www.alsa-project.org/files/pub/"
+  # See: https://mirrors.fedoraproject.org/publiclist (but not all carry old content)
-    "ftp://ftp.alsa-project.org/pub/"
+  fedora = [
-    "http://alsa.cybermirror.org/"
+    "https://archives.fedoraproject.org/pub/fedora/"
-    "http://www.mirrorservice.org/sites/ftp.alsa-project.org/pub/"
+    "https://fedora.osuosl.org/"
+    "https://ftp.funet.fi/pub/mirrors/ftp.redhat.com/pub/fedora/"
+    "https://ftp.linux.cz/pub/linux/fedora/"
+    "https://archives.fedoraproject.org/pub/archive/fedora/"
+    "http://ftp.nluug.nl/pub/os/Linux/distr/fedora/"
+    "http://mirror.csclub.uwaterloo.ca/fedora/"
+    "http://mirror.1000mbps.com/fedora/"
+  ];
+
+  # Gentoo
+  gentoo = [
+    "https://ftp.snt.utwente.nl/pub/os/linux/gentoo/"
+    "https://distfiles.gentoo.org/"
+    "https://mirrors.kernel.org/gentoo/"
+  ];
+
+  # openSUSE
+  opensuse = [
+    "https://opensuse.hro.nl/opensuse/distribution/"
+    "https://ftp.funet.fi/pub/linux/mirrors/opensuse/distribution/"
+    "https://ftp.opensuse.org/pub/opensuse/distribution/"
+    "https://ftp5.gwdg.de/pub/opensuse/discontinued/distribution/"
+    "https://mirrors.edge.kernel.org/opensuse/distribution/"
+    "http://ftp.hosteurope.de/mirror/ftp.opensuse.org/discontinued/"
+  ];
+
+  # Ubuntu
+  ubuntu = [
+    "https://nl.archive.ubuntu.com/ubuntu/"
+    "https://old-releases.ubuntu.com/ubuntu/"
+    "https://mirrors.edge.kernel.org/ubuntu/"
+    "http://de.archive.ubuntu.com/ubuntu/"
+    "http://archive.ubuntu.com/ubuntu/"
+  ];
+
+  # ... and other OSes in general
+
+  # OpenBSD
+  openbsd = [
+    "https://ftp.openbsd.org/pub/OpenBSD/"
+    "ftp://ftp.nluug.nl/pub/OpenBSD/"
+    "ftp://ftp-stud.fht-esslingen.de/pub/OpenBSD/"
   ];
 }

pkgs/build-support/ocaml/dune.nix

@@ -2,7 +2,7 @@
 
 { pname, version, nativeBuildInputs ? [], enableParallelBuilding ? true, ... }@args:
 
-let Dune = if args.useDune2 or false then dune_2 else dune_1; in
+let Dune = if args.useDune2 or true then dune_2 else dune_1; in
 
 if (args ? minimumOCamlVersion && ! lib.versionAtLeast ocaml.version args.minimumOCamlVersion) ||
    (args ? minimalOCamlVersion && ! lib.versionAtLeast ocaml.version args.minimalOCamlVersion)

pkgs/development/compilers/llvm/14/default.nix

@@ -19,7 +19,7 @@
 
 let
   release_version = "14.0.0";
-  candidate = "rc2"; # empty or "rcN"
+  candidate = "rc4"; # empty or "rcN"
   dash-candidate = lib.optionalString (candidate != "") "-${candidate}";
   rev = ""; # When using a Git commit
   rev-version = ""; # When using a Git commit
@@ -30,7 +30,7 @@ let
     owner = "llvm";
     repo = "llvm-project";
     rev = if rev != "" then rev else "llvmorg-${version}";
-    sha256 = "sha256-5wJEaWvwJohtjqlIsBkqQ5rE6rcWw07MaQnN1RxPb5w=";
+    sha256 = "0xm3hscg6xv48rjdi7sg9ky960af1qyg5k3jyavnaqimlaj9wxgp";
   };
 
   llvm_meta = {

pkgs/development/compilers/llvm/14/llvm/default.nix

@@ -209,6 +209,9 @@ in stdenv.mkDerivation (rec {
 
   checkTarget = "check-all";
 
+  # For the update script:
+  passthru.monorepoSrc = monorepoSrc;
+
   requiredSystemFeatures = [ "big-parallel" ];
   meta = llvm_meta // {
     homepage = "https://llvm.org/";

pkgs/development/compilers/llvm/update.sh

@@ -20,7 +20,11 @@ sed -Ei \
 
 readonly ATTRSET="llvmPackages_$VERSION_MAJOR"
 
-if [ "$VERSION_MAJOR" -ge "13" ]; then
+if [ "$VERSION_MAJOR" -ge "14" ]; then
+  readonly SOURCES=(
+    "llvm.monorepoSrc"
+  )
+elif [ "$VERSION_MAJOR" -eq "13" ]; then
   readonly SOURCES=(
     "llvm.src"
   )
@@ -43,7 +47,7 @@ fi
 for SOURCE in "${SOURCES[@]}"; do
   echo "Updating the hash of $SOURCE:"
   declare ATTR="$ATTRSET.$SOURCE"
-  declare OLD_HASH="$(nix eval -f . $ATTR.outputHash)"
+  declare OLD_HASH="$(nix --extra-experimental-features nix-command eval -f . $ATTR.outputHash)"
   declare NEW_HASH="\"$(nix-prefetch-url -A $ATTR)\""
   find "$DIR" -type f -exec sed -i "s/$OLD_HASH/$NEW_HASH/" {} +
 done

pkgs/development/compilers/ocaml/4.14.nix

@@ -0,0 +1,9 @@
+import ./generic.nix {
+  major_version = "4";
+  minor_version = "14";
+  patch_version = "0-beta1";
+  src = fetchTarball {
+    url = "https://caml.inria.fr/pub/distrib/ocaml-4.14/ocaml-4.14.0~beta1.tar.xz";
+    sha256 = "0jiz20hb58jbbk8j38agx11ra4hg0v3prmzc5a9j70lm09mnzfcd";
+  };
+}

pkgs/development/libraries/vte/default.nix

@@ -21,6 +21,7 @@
 , zlib
 , icu
 , systemd
+, systemdSupport ? stdenv.hostPlatform.isLinux
 }:
 
 stdenv.mkDerivation rec {
@@ -63,6 +64,7 @@ stdenv.mkDerivation rec {
     pcre2
     zlib
     icu
+  ] ++ lib.optionals systemdSupport [
     systemd
   ];
 
@@ -73,6 +75,10 @@ stdenv.mkDerivation rec {
     pango
   ];
 
+  mesonFlags = lib.optionals (!systemdSupport) [
+    "-D_systemd=false"
+  ];
+
   postPatch = ''
     patchShebangs perf/*
     patchShebangs src/box_drawing_generate.sh

pkgs/development/ocaml-modules/facile/default.nix

@@ -4,6 +4,8 @@ buildDunePackage rec {
   pname = "facile";
   version = "1.1.4";
 
+  useDune2 = false;
+
   src = fetchurl {
     url = "https://github.com/Emmanuel-PLF/facile/releases/download/${version}/facile-${version}.tbz";
     sha256 = "0jqrwmn6fr2vj2rrbllwxq4cmxykv7zh0y4vnngx29f5084a04jp";

pkgs/development/ocaml-modules/genspio/default.nix

@@ -6,6 +6,8 @@ buildDunePackage rec {
   pname = "genspio";
   version = "0.0.2";
 
+  useDune2 = false;
+
   src = fetchFromGitHub {
     owner = "hammerlab";
     repo = pname;
@@ -13,7 +15,7 @@ buildDunePackage rec {
     sha256 = "0cp6p1f713sfv4p2r03bzvjvakzn4ili7hf3a952b3w1k39hv37x";
   };
 
-  minimumOCamlVersion = "4.03";
+  minimalOCamlVersion = "4.03";
 
   propagatedBuildInputs = [ nonstd sosa ];
 

pkgs/development/ocaml-modules/janestreet/janePackage.nix

@@ -5,7 +5,9 @@
 buildDunePackage (args // {
   inherit version buildInputs;
 
-  minimumOCamlVersion = "4.04";
+  useDune2 = false;
+
+  minimalOCamlVersion = "4.04";
 
   src = fetchFromGitHub {
     owner = "janestreet";

pkgs/development/ocaml-modules/janestreet/janePackage_0_12.nix

@@ -5,6 +5,8 @@
 buildDunePackage (args // {
   inherit version;
 
+  useDune2 = false;
+
   minimalOCamlVersion = "4.07";
 
   src = fetchFromGitHub {

pkgs/development/ocaml-modules/lwt/camlp4.nix

@@ -11,7 +11,9 @@ buildDunePackage rec {
     sha256 = "1lv8z6ljfy47yvxmwf5jrvc5d3dc90r1n291x53j161sf22ddrk9";
   };
 
-  minimumOCamlVersion = "4.02";
+  useDune2 = false;
+
+  minimalOCamlVersion = "4.02";
 
   propagatedBuildInputs = [ camlp4 ];
 

pkgs/development/ocaml-modules/nonstd/default.nix

@@ -4,7 +4,9 @@ buildDunePackage rec {
   pname = "nonstd";
   version = "0.0.3";
 
-  minimumOCamlVersion = "4.02";
+  useDune2 = false;
+
+  minimalOCamlVersion = "4.02";
 
   src = fetchzip {
     url = "https://bitbucket.org/smondet/${pname}/get/${pname}.${version}.tar.gz";

pkgs/development/ocaml-modules/ocamlfuse/default.nix

@@ -1,14 +1,14 @@
 { lib, buildDunePackage, fetchFromGitHub, camlidl, fuse, dune-configurator }:
 
-buildDunePackage {
+buildDunePackage rec {
   pname = "ocamlfuse";
-  version = "2.7.1_cvs6_e35e76b";
+  version = "2.7.1_cvs7";
 
   src = fetchFromGitHub {
     owner = "astrada";
     repo = "ocamlfuse";
-    rev = "e35e76bee3b06806256b5bfca108b7697267cd5c";
+    rev = "v${version}";
-    sha256 = "1v9g0wh7rnjkrjrnw50145g6ry38plyjs8fq8w0nlzwizhf3qhff";
+    sha256 = "6nmPXZx38hBGlg+gV9nnlRpPfeSAqDj4zBPcjUNvTRo=";
   };
 
   # This currently fails with dune

pkgs/development/ocaml-modules/owee/default.nix

@@ -1,20 +1,19 @@
-{ lib, buildDunePackage, fetchFromGitHub }:
+{ lib, buildDunePackage, fetchurl }:
 
 buildDunePackage rec {
-  minimumOCamlVersion = "4.06";
+  minimalOCamlVersion = "4.06";
+  useDune2 = true;
   pname = "owee";
-  version = "0.3";
+  version = "0.4";
 
-  src = fetchFromGitHub {
+  src = fetchurl {
-    owner = "let-def";
+    url = "https://github.com/let-def/owee/releases/download/v${version}/owee-${version}.tbz";
-    repo = "owee";
+    sha256 = "sha256:055bi0yfdki1pqagbhrwmfvigyawjgsmqw04zhpp6hds8513qzvb";
-    rev = "v${version}";
-    sha256 = "0jp8ca57488d7sj2nqy4yxcdpda6sxx51yyi8k6888hbinhyqp0j";
   };
 
   meta = {
     description = "An experimental OCaml library to work with DWARF format";
-    inherit (src.meta) homepage;
+    homepage = "https://github.com/let-def/owee/";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.vbgl ];
   };

pkgs/development/ocaml-modules/spacetime_lib/default.nix

@@ -1,4 +1,7 @@
-{ lib, fetchFromGitHub, buildDunePackage, owee }:
+{ lib, fetchFromGitHub, buildDunePackage, ocaml, owee }:
+
+lib.throwIfNot (lib.versionAtLeast "4.12" ocaml.version)
+  "spacetime_lib is not available for OCaml ${ocaml.version}"
 
 buildDunePackage rec {
   pname = "spacetime_lib";

pkgs/development/php-packages/box/default.nix

@@ -16,10 +16,12 @@ mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D $src $out/libexec/box/box.phar
     makeWrapper ${php}/bin/php $out/bin/box \
       --add-flags "-d phar.readonly=0 $out/libexec/box/box.phar"
+    runHook postInstall
   '';
 
   meta = with lib; {

pkgs/development/php-packages/deployer/default.nix

@@ -14,6 +14,7 @@ mkDerivation rec {
   nativeBuildInputs = [ makeWrapper installShellFiles ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D $src $out/libexec/deployer/deployer.phar
     makeWrapper ${php}/bin/php $out/bin/dep --add-flags "$out/libexec/deployer/deployer.phar"
@@ -22,6 +23,7 @@ mkDerivation rec {
     installShellCompletion --cmd dep \
       --bash <($out/bin/dep autocomplete --install) \
       --zsh <($out/bin/dep autocomplete --install)
+    runHook postInstall
   '';
 
   meta = with lib; {

pkgs/development/php-packages/phing/default.nix

@@ -16,10 +16,12 @@ mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D $src $out/libexec/phing/phing.phar
     makeWrapper ${php}/bin/php $out/bin/phing \
       --add-flags "$out/libexec/phing/phing.phar"
+    runHook postInstall
   '';
 
   meta = with lib; {

pkgs/development/php-packages/phive/default.nix

@@ -0,0 +1,31 @@
+{ mkDerivation, fetchurl, makeWrapper, lib, php }:
+
+mkDerivation rec {
+  pname = "phive";
+  version = "0.15.0";
+
+  src = fetchurl {
+    url = "https://github.com/phar-io/phive/releases/download/${version}/phive-${version}.phar";
+    sha256 = "sha256-crMr8d5nsVt7+zQ5xPeph/JXmTEn6jJFVtp3mOgylB4=";
+  };
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    install -D $src $out/libexec/phive/phive.phar
+    makeWrapper ${php}/bin/php $out/bin/phive \
+      --add-flags "$out/libexec/phive/phive.phar"
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "The Phar Installation and Verification Environment (PHIVE)";
+    homepage = "https://github.com/phar-io/phive";
+    license = licenses.bsd3;
+    maintainers = with maintainers; teams.php.members;
+  };
+}

pkgs/development/php-packages/php-cs-fixer/default.nix

@@ -16,10 +16,12 @@ mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D $src $out/libexec/php-cs-fixer/php-cs-fixer.phar
     makeWrapper ${php}/bin/php $out/bin/php-cs-fixer \
       --add-flags "$out/libexec/php-cs-fixer/php-cs-fixer.phar"
+    runHook postInstall
   '';
 
   meta = with lib; {

pkgs/development/php-packages/php-parallel-lint/default.nix

@@ -20,15 +20,19 @@ mkDerivation {
   ];
 
   buildPhase = ''
+    runHook preBuild
     composer dump-autoload
     box build
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D parallel-lint.phar $out/libexec/php-parallel-lint/php-parallel-lint.phar
     makeWrapper ${php}/bin/php $out/bin/php-parallel-lint \
       --add-flags "$out/libexec/php-parallel-lint/php-parallel-lint.phar"
+    runHook postInstall
   '';
 
   meta = with lib; {

pkgs/development/php-packages/phpcbf/default.nix

@@ -16,10 +16,12 @@ mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D $src $out/libexec/phpcbf/phpcbf.phar
     makeWrapper ${php}/bin/php $out/bin/phpcbf \
       --add-flags "$out/libexec/phpcbf/phpcbf.phar"
+    runHook postInstall
   '';
 
   meta = with lib; {

pkgs/development/php-packages/phpcs/default.nix

@@ -16,10 +16,12 @@ mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D $src $out/libexec/phpcs/phpcs.phar
     makeWrapper ${php}/bin/php $out/bin/phpcs \
       --add-flags "$out/libexec/phpcs/phpcs.phar"
+    runHook postInstall
   '';
 
   meta = with lib; {

pkgs/development/php-packages/phpmd/default.nix

@@ -16,10 +16,12 @@ mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D $src $out/libexec/phpmd/phpmd.phar
     makeWrapper ${php}/bin/php $out/bin/phpmd \
       --add-flags "$out/libexec/phpmd/phpmd.phar"
+    runHook postInstall
   '';
 
   meta = with lib; {

pkgs/development/php-packages/phpstan/default.nix

@@ -16,10 +16,12 @@ mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D $src $out/libexec/phpstan/phpstan.phar
     makeWrapper ${php}/bin/php $out/bin/phpstan \
       --add-flags "$out/libexec/phpstan/phpstan.phar"
+    runHook postInstall
   '';
 
   meta = with lib; {

pkgs/development/php-packages/psalm/default.nix

@@ -16,10 +16,12 @@ mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     install -D $src $out/libexec/psalm/psalm.phar
     makeWrapper ${php}/bin/php $out/bin/psalm \
       --add-flags "$out/libexec/psalm/psalm.phar"
+    runHook postInstall
   '';
 
   meta = with lib; {

pkgs/development/php-packages/psysh/default.nix

@@ -16,10 +16,12 @@ mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
     tar -xzf $src -C $out/bin
     chmod +x $out/bin/psysh
     wrapProgram $out/bin/psysh --prefix PATH : "${lib.makeBinPath [ php ]}"
+    runHook postInstall
   '';
 
   meta = with lib; {

pkgs/development/python-modules/aio-geojson-client/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aio-geojson-client";
-  version = "0.16";
+  version = "0.17";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "exxamalte";
     repo = "python-aio-geojson-client";
     rev = "v${version}";
-    hash = "sha256-u3SwrSxeBJrBTHfqKY/mAb2p1jqW2AvRsHomKsI81gM=";
+    hash = "sha256-5GiQgtbvYeleovFbXO2vlr2XPsDIWZiElM64O+urMcY=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pudb/default.nix

@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , dataclasses
-, isPy3k
 , fetchPypi
 , jedi
 , pygments
@@ -14,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pudb";
-  version = "2022.1";
+  version = "2022.1.1";
   format = "setuptools";
 
-  disabled = !isPy3k;
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e827a4b489dcad561189535db6677becbf32164b2b44df00786eb2d5e00c587e";
+    hash = "sha256-2zvdZkI8nSkHTBwsSfyyJL0Nbwgxn+0bTn6taDkUCD8=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/types-requests/default.nix

@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-requests";
-  version = "2.27.11";
+  version = "2.27.12";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-an7SSyF4CvSlteJMMQss2IX7YS31/ZVYTQPYfl8qGVo=";
+    sha256 = "sha256-/ROC+i4o6shI+u2wMyhAIE8G8MtRcAjjx7goLKU+VtI=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/types-urllib3/default.nix

@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-urllib3";
-  version = "1.26.10";
+  version = "1.26.11";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-omiY9TDmw/Q/JbkH8riESGho/9Vqn6qUy/mz624WXWo=";
+    hash = "sha256-JNZORBFohR6wXx0CLeGK4xVY9WScjxEX44TC6F4xMVs=";
   };
 
   # Module doesn't have tests

pkgs/development/python-modules/unidiff/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "unidiff";
-  version = "0.7.0";
+  version = "0.7.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "91bb13b4969514a400679d9ae5e29a6ffad85346087677f8b5e2e036af817447";
+    sha256 = "sha256-1fLlOpoA2zIkqMNjSbU4Dg4i0a7GxpSxT7lIPuk8YgU=";
   };
 
   pythonImportsCheck = [ "unidiff" ];

pkgs/development/tools/ocaml/js_of_ocaml/camlp4.nix

@@ -6,6 +6,8 @@ buildDunePackage rec {
   version = "3.2.1";
   pname = "js_of_ocaml-camlp4";
 
+  useDune2 = false;
+
   src = fetchFromGitHub {
     owner = "ocsigen";
     repo = "js_of_ocaml";

pkgs/development/tools/profiling/systemtap/default.nix

@@ -16,8 +16,8 @@ let
     pname = "systemtap";
     inherit version;
     src = fetchgit { inherit url rev sha256; };
-    nativeBuildInputs = [ pkg-config cpio ];
+    nativeBuildInputs = [ pkg-config cpio python3 python3.pkgs.setuptools ];
-    buildInputs = [ elfutils gettext python3 python3.pkgs.setuptools ];
+    buildInputs = [ elfutils gettext ];
     enableParallelBuilding = true;
   };
 

pkgs/games/freedroidrpg/default.nix

@@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, pkg-config, gettext, python3, SDL, SDL_image, SDL_gfx, SDL_mixer, libogg, libvorbis, lua5_3, libjpeg, libpng, zlib, libiconv }:
+{ fetchurl, fetchpatch, lib, stdenv, pkg-config, gettext, python3, SDL, SDL_image, SDL_gfx, SDL_mixer, libogg, libvorbis, lua5_3, libjpeg, libpng, zlib, libiconv }:
 
 let
   version = "0.16.1";
@@ -11,6 +11,15 @@ in stdenv.mkDerivation {
     sha256 = "0n4kn38ncmcy3lrxmq8fjry6c1z50z4q1zcqfig0j4jb0dsz2va2";
   };
 
+  patches = [
+    # Pull upstream fix for -fno-common tolchains.
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://gitlab.com/freedroid/freedroid-src/-/commit/e610d427374226b79da5258d979936459f30c761.patch";
+      sha256 = "1s7sw4dkc7b6i72j6x47driq6v0k3wss48l9ivd4fw40n3iaxjb1";
+    })
+  ];
+
   nativeBuildInputs = [ pkg-config gettext python3 ];
 
   buildInputs = [

pkgs/os-specific/linux/akvcam/default.nix

@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
   };
   sourceRoot = "source/src";
 
-  makeFlags = [
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags ++ [
     "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
 

pkgs/os-specific/linux/apfs/default.nix

@@ -18,7 +18,7 @@ stdenv.mkDerivation {
   hardeningDisable = [ "pic" ];
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KERNELRELEASE=${kernel.modDirVersion}"
     "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "INSTALL_MOD_PATH=$(out)"

pkgs/os-specific/linux/batman-adv/default.nix

@@ -12,11 +12,13 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags ++ [
+    "KERNELPATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
 
   hardeningDisable = [ "pic" ];
 
   preBuild = ''
-    makeFlags="KERNELPATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     sed -i -e "s,INSTALL_MOD_DIR=,INSTALL_MOD_PATH=$out INSTALL_MOD_DIR=," \
       -e /depmod/d Makefile
   '';

pkgs/os-specific/linux/can-isotp/default.nix

@@ -13,16 +13,13 @@ stdenv.mkDerivation {
     sha256 = "1laax93czalclg7cy9iq1r7hfh9jigh7igj06y9lski75ap2vhfq";
   };
 
-  KERNELDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+  makeFlags = kernel.makeFlags ++ [
-  INSTALL_MOD_PATH = "\${out}";
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
 
-  buildPhase = ''
+  buildFlags = [ "modules" ];
-    make modules
+  installTargets = [ "modules_install" ];
-  '';
-
-  installPhase = ''
-    make modules_install
-  '';
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 

pkgs/os-specific/linux/cryptodev/default.nix

@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-vJQ10rG5FGbeEOqCUmH/pZ0P77kAW/MtUarywbtIyHw=";
   };
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
   hardeningDisable = [ "pic" ];
 
   KERNEL_DIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";

pkgs/os-specific/linux/digimend/default.nix

@@ -13,8 +13,6 @@ stdenv.mkDerivation rec {
     sha256 = "1l54j85540386a8aypqka7p5hy1b63cwmpsscv9rmmf10f78v8mm";
   };
 
-  INSTALL_MOD_PATH = "\${out}";
-
   postPatch = ''
     sed 's/udevadm /true /' -i Makefile
     sed 's/depmod /true /' -i Makefile
@@ -38,10 +36,11 @@ stdenv.mkDerivation rec {
     rm -r $out/lib/udev
   '';
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KVERSION=${kernel.modDirVersion}"
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "DESTDIR=${placeholder "out"}"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
   ];
 
   meta = with lib; {

pkgs/os-specific/linux/dpdk-kmods/default.nix

@@ -11,6 +11,9 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
+  makeFlags = kernel.makeFlags ++ [
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
   KSRC = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -18,10 +21,9 @@ stdenv.mkDerivation rec {
   preBuild = "cd linux/igb_uio";
 
   installPhase = ''
-    make -C ${KSRC} M=$(pwd) modules_install
+    make -C ${KSRC} M=$(pwd) modules_install $makeFlags
   '';
 
-  INSTALL_MOD_PATH = placeholder "out";
   enableParallelBuilding = true;
 
   meta = with lib; {

pkgs/os-specific/linux/ena/default.nix

@@ -14,6 +14,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "pic" ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags;
 
   # linux 3.12
   NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
@@ -27,7 +28,7 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     runHook preInstall
-    strip -S ena.ko
+    $STRIP -S ena.ko
     dest=$out/lib/modules/${kernel.modDirVersion}/misc
     mkdir -p $dest
     cp ena.ko $dest/

pkgs/os-specific/linux/evdi/default.nix

@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ kernel libdrm ];
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KVER=${kernel.modDirVersion}"
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];

pkgs/os-specific/linux/fwts/module.nix

@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "INSTALL_MOD_PATH=${placeholder "out"}"
   ];
 

pkgs/os-specific/linux/gcadapter-oc-kmod/default.nix

@@ -19,7 +19,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KERNEL_SOURCE_DIR=${kernel.dev}/${kerneldir}/build"
     "INSTALL_MOD_PATH=$(out)"
   ];

pkgs/os-specific/linux/hid-nintendo/default.nix

@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "-C"
     "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "M=$(sourceRoot)"

pkgs/os-specific/linux/jool/default.nix

@@ -16,13 +16,12 @@ stdenv.mkDerivation {
     sed -e 's@/lib/modules/\$(.*)@${kernel.dev}/lib/modules/${kernel.modDirVersion}@' -i src/mod/*/Makefile
   '';
 
-  buildPhase = ''
+  makeFlags = kernel.makeFlags ++ [
-    make -C src/mod
+    "-C src/mod"
-  '';
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
 
-  installPhase = ''
+  installTargets = "modules_install";
-    make -C src/mod modules_install INSTALL_MOD_PATH=$out
-  '';
 
   meta = with lib; {
     homepage = "https://www.jool.mx/";

pkgs/os-specific/linux/kernel/manual-config.nix

@@ -56,7 +56,7 @@ let
     hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
 
   # Dependencies that are required to build kernel modules
-  moduleBuildDependencies = optional (lib.versionAtLeast version "4.14") libelf;
+  moduleBuildDependencies = [ perl ] ++ optional (lib.versionAtLeast version "4.14") libelf;
 
 
   installkernel = writeTextFile { name = "installkernel"; executable=true; text = ''

pkgs/os-specific/linux/lttng-modules/default.nix

@@ -9,16 +9,16 @@ stdenv.mkDerivation rec {
     sha256 = "0hzksx2fw008jdsgfzpws9g7imy6ryw09ai5y0knvrmvr68nvj57";
   };
 
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
 
   NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
 
-  preConfigure = ''
+  makeFlags = kernel.makeFlags ++ [
-    export KERNELDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-    export INSTALL_MOD_PATH="$out"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
-  '';
+  ];
 
   installTargets = [ "modules_install" ];
 

pkgs/os-specific/linux/mba6x_bl/default.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "INSTALL_MOD_PATH=$(out)"
   ];

pkgs/os-specific/linux/mbp-modules/mbp2018-bridge-drv/default.nix

@@ -11,14 +11,17 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-o6yGiR+Y5SnX1johdi7fQWP5ts7HdDMqeju75UOhgik=";
   };
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags;
+
   buildPhase = ''
     make -C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build \
-      -j$NIX_BUILD_CORES M=$(pwd) modules
+      -j$NIX_BUILD_CORES M=$(pwd) modules $makeFlags
   '';
 
   installPhase = ''
     make -C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build  \
-      INSTALL_MOD_PATH=$out M=$(pwd) modules_install
+      INSTALL_MOD_PATH=$out M=$(pwd) modules_install $makeFlags
   '';
 
   meta = with lib; {

pkgs/os-specific/linux/netatop/default.nix

@@ -12,6 +12,7 @@ stdenv.mkDerivation {
     sha256 = "0qjw8glfdmngfvbn1w63q128vxdz2jlabw13y140ga9i5ibl6vvk";
   };
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
   buildInputs = [ kmod zlib ];
 
   hardeningDisable = [ "pic" ];
@@ -36,6 +37,8 @@ stdenv.mkDerivation {
     kmod=${kmod} substituteAllInPlace netatop.service
   '';
 
+  makeFlags = kernel.makeFlags;
+
   preInstall = ''
     mkdir -p $out/lib/systemd/system $out/bin $out/sbin $out/share/man/man{4,8}
     mkdir -p $out/lib/modules/${kernel.modDirVersion}/extra

pkgs/os-specific/linux/openrazer/driver.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation (common // {
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  buildFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
 

pkgs/os-specific/linux/r8168/default.nix

@@ -27,11 +27,13 @@ in stdenv.mkDerivation rec {
   # avoid using the Makefile directly -- it doesn't understand
   # any kernel but the current.
   # based on the ArchLinux pkgbuild: https://git.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h=packages/r8168
+  makeFlags = kernel.makeFlags ++ [
+    "-C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "M=$(PWD)/src"
+    "modules"
+  ];
   preBuild = ''
-    makeFlagsArray+=("-C${kernel.dev}/lib/modules/${kernel.modDirVersion}/build")
-    makeFlagsArray+=("M=$PWD/src")
     makeFlagsArray+=("EXTRA_CFLAGS=-DCONFIG_R8168_NAPI -DCONFIG_R8168_VLAN -DCONFIG_ASPM -DENABLE_S5WOL -DENABLE_EEE")
-    makeFlagsArray+=("modules")
   '';
 
   enableParallelBuilding = true;

pkgs/os-specific/linux/rtl8189es/default.nix

@@ -2,17 +2,16 @@
 
 stdenv.mkDerivation rec {
   name = "rtl8189es-${kernel.version}-${version}";
-  version = "2020-10-03";
+  version = "2021-10-01";
 
   src = fetchFromGitHub {
     owner = "jwrdegoede";
     repo = "rtl8189ES_linux";
-    rev = "03ac413135a355b55b693154c44b70f86a39732e";
+    rev = "be378f47055da1bae42ff6ec1d62f1a5052ef097";
-    sha256 = "0wiikviwyvy6h55rgdvy7csi1zqniqg26p8x44rd6mhbw0g00h56";
+    sha256 = "sha256-+19q1Xux2BjquavY+s0UDzTubEt6BEUZ9XVDVmj36us=";
   };
 
-  nativeBuildInputs = [ bc nukeReferences ];
+  nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
-  buildInputs = kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" "format" ];
 
@@ -23,13 +22,10 @@ stdenv.mkDerivation rec {
     substituteInPlace ./Makefile --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
-    "ARCH=${stdenv.hostPlatform.linuxArch}"
     "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     ("CONFIG_PLATFORM_I386_PC=" + (if (stdenv.hostPlatform.isi686 || stdenv.hostPlatform.isx86_64) then "y" else "n"))
     ("CONFIG_PLATFORM_ARM_RPI=" + (if (stdenv.hostPlatform.isAarch32 || stdenv.hostPlatform.isAarch64) then "y" else "n"))
-  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
   ];
 
   preInstall = ''

pkgs/os-specific/linux/rtl8192eu/default.nix

@@ -19,7 +19,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = kernel.moduleBuildDependencies ++ [ bc ];
 
-  makeFlags = [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
+  makeFlags = kernel.makeFlags ++ [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
 
   enableParallelBuilding = true;
 

pkgs/os-specific/linux/rtl8814au/default.nix

@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     sha256 = "0lk3ldff489ggbqmlfi4zvnp1cvxj1b06m0fhpzai82070klzzmj";
   };
 
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags;
 
   hardeningDisable = [ "pic" ];
 

pkgs/os-specific/linux/rtl8821ce/default.nix

@@ -13,8 +13,8 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  nativeBuildInputs = [ bc ];
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
-  buildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags;
 
   prePatch = ''
     substituteInPlace ./Makefile \

pkgs/os-specific/linux/rtl8821cu/default.nix

@@ -13,8 +13,8 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  nativeBuildInputs = [ bc ];
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
-  buildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags;
 
   prePatch = ''
     substituteInPlace ./Makefile \

pkgs/os-specific/linux/rtl88x2bu/default.nix

@@ -13,10 +13,10 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  nativeBuildInputs = [ bc ];
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
-  buildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags;
 
- prePatch = ''
+  prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
       --replace '$(shell uname -r)' "${kernel.modDirVersion}" \

pkgs/os-specific/linux/rtw88/default.nix

@@ -14,7 +14,8 @@ stdenv.mkDerivation {
     hash = "sha256-PRzWXC1lre8gt1GfVdnaG836f5YK57P9a8tG20yef0w=";
   };
 
-  makeFlags = [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags ++ [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
 
   enableParallelBuilding = true;
 

pkgs/os-specific/linux/rtw89/default.nix

@@ -14,7 +14,8 @@ stdenv.mkDerivation {
     sha256 = "0cvawyi1ksw9xkr8pzwipsl7b8hnmrb17w5cblyicwih8fqaw632";
   };
 
-  makeFlags = [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags ++ [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
 
   enableParallelBuilding = true;
 

pkgs/os-specific/linux/v4l2loopback/default.nix

@@ -16,12 +16,9 @@ stdenv.mkDerivation rec {
   preBuild = ''
     substituteInPlace Makefile --replace "modules_install" "INSTALL_MOD_PATH=$out modules_install"
     sed -i '/depmod/d' Makefile
-    export PATH=${kmod}/sbin:$PATH
   '';
 
-  nativeBuildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ kmod ] ++ kernel.moduleBuildDependencies;
-
-  buildInputs = [ kmod ];
 
   postInstall = ''
     make install-utils PREFIX=$bin
@@ -29,7 +26,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "bin" ];
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KERNELRELEASE=${kernel.modDirVersion}"
     "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];

pkgs/os-specific/linux/veikk-linux-driver/default.nix

@@ -15,9 +15,9 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ kernel ];
 
-  buildPhase = ''
+  makeFlags = kernel.makeFlags ++ [
-    make BUILD_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build
+    "BUILD_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-  '';
+  ];
 
   installPhase = ''
     mkdir -p $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/veikk

pkgs/os-specific/linux/xmm7360-pci/default.nix

@@ -11,10 +11,12 @@ stdenv.mkDerivation rec {
     sha256 = "1wdb0phqg9rj9g9ycqdya0m7lx24kzjlh25yw0ifp898ddxrrr0c";
   };
 
-  makeFlags = [ "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
+  makeFlags = kernel.makeFlags ++ [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
-  INSTALL_MOD_PATH = placeholder "out";
   installFlags = [ "DEPMOD=true" ];
 
   meta = with lib; {

pkgs/os-specific/linux/xpadneo/default.nix

@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = kernel.moduleBuildDependencies;
   buildInputs = [ bluez ];
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "-C"
     "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "M=$(sourceRoot)"

pkgs/shells/tcsh/default.nix

@@ -10,17 +10,7 @@ stdenv.mkDerivation rec {
   version = "6.24.00";
 
   src = fetchurl {
-    urls = [
+    url = "mirror://tcsh/${pname}-${version}.tar.gz";
-      "https://astron.com/pub/tcsh/${pname}-${version}.tar.gz"
-      "https://astron.com/pub/tcsh/old/${pname}-${version}.tar.gz"
-      "http://ftp.funet.fi/pub/mirrors/ftp.astron.com/pub/tcsh/${pname}-${version}.tar.gz"
-      "http://ftp.funet.fi/pub/mirrors/ftp.astron.com/pub/tcsh/old/${pname}-${version}.tar.gz"
-
-      "ftp://ftp.astron.com/pub/tcsh/${pname}-${version}.tar.gz"
-      "ftp://ftp.astron.com/pub/tcsh/old/${pname}-${version}.tar.gz"
-      "ftp://ftp.funet.fi/pub/unix/shells/tcsh/${pname}-${version}.tar.gz"
-      "ftp://ftp.funet.fi/pub/unix/shells/tcsh/old/${pname}-${version}.tar.gz"
-    ];
     hash = "sha256-YL4sUEvY8fpuQksZVkldfnztUqKslNtf0n9La/yPdPA=";
   };
 
@@ -29,6 +19,7 @@ stdenv.mkDerivation rec {
   ];
 
   patches = lib.optional stdenv.hostPlatform.isMusl
+    # Use system malloc
     (fetchpatch {
       name = "sysmalloc.patch";
       url = "https://git.alpinelinux.org/aports/plain/community/tcsh/001-sysmalloc.patch?id=184585c046cdd56512f1a76e426dd799b368f8cf";

pkgs/tools/nix/nix-output-monitor/default.nix

@@ -6,6 +6,7 @@
   async,
   attoparsec,
   base,
+  bytestring,
   cassava,
   containers,
   data-default,
@@ -36,13 +37,14 @@
   unix,
   vector,
   wcwidth,
+  word8,
 }:
 mkDerivation {
   pname = "nix-output-monitor";
-  version = "1.1.1.0";
+  version = "1.1.2.0";
   src = fetchzip {
-    url = "https://github.com/maralorn/nix-output-monitor/archive/refs/tags/v1.1.1.0.tar.gz";
+    url = "https://github.com/maralorn/nix-output-monitor/archive/refs/tags/v1.1.2.0.tar.gz";
-    sha256 = "1zw7x1snyycl1bp5w7jh8wwnynqvw3g4glr293bnzi5jyirj5wlg";
+    sha256 = "03qhy4xzika41pxlmvpz3psgy54va72ipn9v1lv33l6369ikrhl1";
   };
   isLibrary = true;
   isExecutable = true;
@@ -51,6 +53,7 @@ mkDerivation {
     async
     attoparsec
     base
+    bytestring
     cassava
     containers
     data-default
@@ -74,12 +77,14 @@ mkDerivation {
     unix
     vector
     wcwidth
+    word8
   ];
   executableHaskellDepends = [
     ansi-terminal
     async
     attoparsec
     base
+    bytestring
     cassava
     containers
     data-default
@@ -103,12 +108,14 @@ mkDerivation {
     unix
     vector
     wcwidth
+    word8
   ];
   testHaskellDepends = [
     ansi-terminal
     async
     attoparsec
     base
+    bytestring
     cassava
     containers
     data-default
@@ -134,6 +141,7 @@ mkDerivation {
     unix
     vector
     wcwidth
+    word8
   ];
   homepage = "https://github.com/maralorn/nix-output-monitor";
   description = "Parses output of nix-build to show additional information";
@@ -148,11 +156,9 @@ mkDerivation {
     ${expect}/bin/unbuffer nix-build "\$@" 2>&1 | exec $out/bin/nom
     EOF
     chmod a+x $out/bin/nom-build
-    installShellCompletion --zsh --name _nom-build ${
+    installShellCompletion --zsh --name _nom-build ${builtins.toFile "completion.zsh" ''
-      builtins.toFile "completion.zsh" ''
+      #compdef nom-build
-        #compdef nom-build
+      compdef nom-build=nix-build
-        compdef nom-build=nix-build
+    ''}
-      ''
-    }
   '';
 }

pkgs/tools/package-management/nix-eval-jobs/default.nix

@@ -11,12 +11,12 @@
 }:
 stdenv.mkDerivation rec {
   pname = "nix-eval-jobs";
-  version = "0.0.3";
+  version = "0.0.4";
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256:0flnqn1vkr55sipii82vwjfkhv4p835d01f6yhlpbalxwy2kr14r";
+    hash = "sha256-SCwvFlBYUlxCucjMO4GHhEQWZFZt0lRKJncm6hvDx9I=";
   };
   buildInputs = [
     boost

pkgs/tools/package-management/nix/default.nix

@@ -73,13 +73,13 @@ in lib.makeExtensible (self: {
   stable = self.nix_2_7;
 
   unstable = lib.lowPrio (common rec {
-    version = "2.7";
+    version = "2.8";
-    suffix = "pre20220221_${lib.substring 0 7 src.rev}";
+    suffix = "pre20220311_${lib.substring 0 7 src.rev}";
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "nix";
-      rev = "caf51729450d4c57d48ddbef8e855e9bf65f8792";
+      rev = "d5322698a2abbc6d141e1d244e17b0d226a2f18b";
-      sha256 = "sha256-2fbza6fWPjyTyVEqWIp0jk/Z4epjSDe1u4lbEu+v7Iw=";
+      sha256 = "sha256-7rQSktGC8+DmeyGOnzFMy1QwAYnw4JJphv+lEwFCwfU=";
     };
   });
 })

pkgs/tools/security/gitleaks/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "gitleaks";
-  version = "8.3.0";
+  version = "8.4.0";
 
   src = fetchFromGitHub {
     owner = "zricethezav";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-D6leHpGZNQ9Xt4PSU0Dwte6N3bMge7itkZtcUl0mIrQ=";
+    sha256 = "sha256-z3YGRDgBGpr2hixIayih4wxGWPtYL0EPAuTYVPByzQc=";
   };
 
-  vendorSha256 = "sha256-JZOalUOIeV51Nttm6xeBos+/8fleSBpUiXa8ekVuYJA=";
+  vendorSha256 = "sha256-J1xX+r+Mph1QkqjK87tqGDkYvPZp0lHgdRhd88WZi1c=";
 
   ldflags = [
     "-s"

pkgs/top-level/ocaml-packages.nix

@@ -1580,6 +1580,8 @@ in let inherit (pkgs) callPackage; in rec
 
   ocamlPackages_4_13 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.13.nix { });
 
+  ocamlPackages_4_14 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.14.nix { });
+
   ocamlPackages_latest = ocamlPackages_4_13;
 
   ocamlPackages = ocamlPackages_4_13;

pkgs/top-level/php-packages.nix

@@ -144,6 +144,8 @@ lib.makeScope pkgs.newScope (self: with self; {
 
     phing = callPackage ../development/php-packages/phing { };
 
+    phive = callPackage ../development/php-packages/phive { };
+
     php-cs-fixer = callPackage ../development/php-packages/php-cs-fixer { };
 
     php-parallel-lint = callPackage ../development/php-packages/php-parallel-lint { };