systemd: 251.4 -> 251.5

We run pytest with `--forked` in nixpkgs, to reduce side effects that
can occur when multiple tests mutate their environment in incompatible
ways.

Forking on macOS 10.13 and later is unsafe when an application does work
between calls to fork() and its followup exec(). This may lead to
crashes when calls into the Objective-C runtime are issued, which will
in turn coredump the Python interpreter.

One good reproducer for this scenario is when the urllib module tries
to lookup proxy configurations in `urllib.request.getproxies()` through
`get_proxies_macos_sysconf` into the native `_scproxy` module.

This is a class of issues that is of course not limited to the urllib
module. The general recommendation is to use `spawn` instead of `fork`,
but we don't have any influence on upstream developers to do one or the
other.

One often cited workaround would be to disable fork safety entirely on
calls to `initialize()`, which is probably a better solution than
running without multithreading (slow) or without the `--forked` (prone
to side effects) mode.

This currently happens on aarch64-linux only, where we use more recent
11.0 SDK version, while x86_64-darwin has been stuck on 10.12 for a
while now.

python/cpython#77906 (comment)
http://www.sealiesoftware.com/blog/archive/2017/6/5/Objective-C_and_fork_in_macOS_1013.html

Closes: NixOS#194290

apparmor: 3.0.7 -> 3.1.1

or it will end up in the dist output.

Typically the actual wheel will be unchanged, but it is possible we use
the relax deps hook modifying the wheel.

Discussion: systemd/systemd#24191 (comment)

systemd: don't taint on unmerged /usr

…irection

Validated as no change in `out`, `man`, `doc` outputs with diffoscope on
`ghostscript` expression.

Support systemd-portabled

flac: build with cmake, fixes cross compilation

…er indirection

Validated as no change in `out` and `dev` outputs with diffoscope on
`gnome2.libgnomeui` expression.

go_1_18: 1.18.6 -> 1.18.7

numactl: 2.0.15 -> 2.0.16

libcxxabi: remove link with build libcxxabi

Co-authored-by: Janne Heß <[email protected]>
Co-authored-by: Ilan Joselevich <[email protected]>

Update pkgs/os-specific/linux/systemd/default.nix

Co-authored-by: Janne Heß <[email protected]>
Co-authored-by: Ilan Joselevich <[email protected]>
Co-authored-by: Jörg Thalheim <[email protected]>

…nitramfs

This improves the out-of-box experience of TPM2 unlocking at a
small (50K) overhead.

...into staging

llvmPackages_{14, git}.clang: add nostdlibinc flag

compiler-rt: build builtins on darwin

https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.38.0.txt

Without the change parallel builds occasionally fail as:

    $ make --shuffle
    ...
    gcc ... -c common/opencl.c -o common/opencl-8.o ...
    common/opencl.c:116:10: fatal error: common/oclobj.h: No such file or directory
      116 | #include "common/oclobj.h"
          |          ^~~~~~~~~~~~~~~~~

darwin.cctools: 949.0.1 -> 973.0.1

x264: pull upstream parallel build fix

Currently, `pkgs.ruby` is ruby 2.7.6, which is in 'security updates
only' mode and scheduled to go EOL April 2023. Updating `pkgs.ruby`
to be ruby 3.1 would be a rather large change, but using ruby 3 to
bootstrap building ruby itself would be a nice first step in that
direction.

Tested with asciidoctor that this indeed now allows building a ruby
application without getting ruby 2.7 in the build closure.

Also fixes NixOS#192729

Signed-off-by: Felix Singer <[email protected]>

See NixOS#82131 for the rest of the
changes for FreeBSD. This is PRed separately because it is a macOS
moderate rebuild so we target staging.

The main change is that we CD to the path we're building *after*
applying patches, so we can patch other parts of the tree (from
`extraPaths`) as needed.

Another change is that `netbsd.install` no longer depends on `fts`,
which it evidently no longer needs.

@alyssais and I agreed this is clearer.

netbsd: Adapt to BSD-common infra changes for FreeBSD

bundler: 2.3.22 -> 2.3.23

ruby: move towards 3.1

postgresql: remove 10.x

…gation

The code of `lib.closePropagation` was internally using a
recursion on the dependencies and returns all the derivation directly or
indirectly referenced by buildInputs.

`lib.closeProgation` is implemented in pure nix and uses an unique
function for list which is quadratic and does "true" equality, which
needs deep set comparison.

Instead, we use the `builtins.genericClosure` which is implemented as a
builtin and uses a more efficient sorting feature.

Note that `genericClosure` needs a `key` to discriminate the values, we
used the `outPath` which is unique and orderable.

On benchmarks, it performs up to 15x time faster on a benchmark related
to haskellPackages.ghcWithPackages.

[staging] openssh: 9.0p1 -> 9.1p1

to make strictDepsByDefault work

kexec-tools: 2.0.23 -> 2.0.25

…kages

…apper

pulseaudio: use xorg.* packages directly instead of xlibsWrapper indi…

…xlibsWrapper

gnome2.libgnomeui: use xorg.* packages directly instead of xlibsWrapp…

…rapper

ghostscript: use xorg.* packages directly instead of xlibsWrapper ind…

cc-wrapper/add-hardening.sh: always unset _FORTIFY_SOURCE before re-s…

adds `--sign` as an alias for `-s`: https://github.com/thefloweringash/sigtool/releases/tag/v0.1.3

sigtool: 0.1.2 →  0.1.3

libical: 3.0.14 -> 3.0.15

Removing this build dependency makes most NixOS tests completely
independent of the ruby ecosystem.
This helps reduce mass-rebuilds, which is especially useful when
bisecting the staging branch using a NixOS test.

The plugin is being built using `luaPackages` since NixOS#178180.

`toVimPlugin` function mentioned is added with NixOS#178180.

Don't set the `rtp` attribute using `overrideAttrs`. `overrideAttrs`
passes the attribute to the builder hence creates a different
derivation. This made vim plugins being built twice.

The libcrypt library is going to be replaced with libxcrypt in packages
that require it.