Merge commit 'd8fe5e6c'

Conflicts:
	nixpkgs/pkgs/build-support/go/module.nix

5 files changed, 36 insertions, 15 deletions

diff --git a/nixpkgs/pkgs/build-support/build-fhsenv-bubblewrap/default.nix b/nixpkgs/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
index 3292f4039a63..5b4de2dd04ca 100644
--- a/nixpkgs/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
+++ b/nixpkgs/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
@@ -123,6 +123,8 @@ let
     ro_mounts=()
     symlinks=()
     etc_ignored=()
+
+    # loop through all entries of root in the fhs environment, except its /etc.
     for i in ${fhsenv}/*; do
       path="/''${i##*/}"
       if [[ $path == '/etc' ]]; then
@@ -136,6 +138,7 @@ let
       fi
     done
 
+    # loop through the entries of /etc in the fhs environment.
     if [[ -d ${fhsenv}/etc ]]; then
       for i in ${fhsenv}/etc/*; do
         path="/''${i##*/}"
@@ -144,7 +147,11 @@ let
         if [[ $path == '/fonts' || $path == '/ssl' ]]; then
           continue
         fi
-        ro_mounts+=(--ro-bind "$i" "/etc$path")
+        if [[ -L $i ]]; then
+          symlinks+=(--symlink "$i" "/etc$path")
+        else
+          ro_mounts+=(--ro-bind "$i" "/etc$path")
+        fi
         etc_ignored+=("/etc$path")
       done
     fi
@@ -156,6 +163,7 @@ let
       ro_mounts+=(--ro-bind /etc /.host-etc)
     fi
 
+    # link selected etc entries from the actual root
     for i in ${lib.escapeShellArgs etcBindEntries}; do
       if [[ "''${etc_ignored[@]}" =~ "$i" ]]; then
         continue
diff --git a/nixpkgs/pkgs/build-support/docker/default.nix b/nixpkgs/pkgs/build-support/docker/default.nix
index 6b8a03932f5b..86bd7e312cbd 100644
--- a/nixpkgs/pkgs/build-support/docker/default.nix
+++ b/nixpkgs/pkgs/build-support/docker/default.nix
@@ -637,7 +637,7 @@ rec {
             if tag != null
             then tag
             else
-              lib.head (lib.strings.splitString "-" (baseNameOf result.outPath));
+              lib.head (lib.strings.splitString "-" (baseNameOf (builtins.unsafeDiscardStringContext result.outPath)));
         } ''
         ${lib.optionalString (tag == null) ''
           outName="$(basename "$out")"
@@ -1001,7 +1001,7 @@ rec {
               if tag != null
               then tag
               else
-                lib.head (lib.strings.splitString "-" (baseNameOf conf.outPath));
+                lib.head (lib.strings.splitString "-" (baseNameOf (builtins.unsafeDiscardStringContext conf.outPath)));
             paths = buildPackages.referencesByPopularity overallClosure;
             nativeBuildInputs = [ jq ];
           } ''
diff --git a/nixpkgs/pkgs/build-support/go/module.nix b/nixpkgs/pkgs/build-support/go/module.nix
index 53287c7182ba..6ef78797d743 100644
--- a/nixpkgs/pkgs/build-support/go/module.nix
+++ b/nixpkgs/pkgs/build-support/go/module.nix
@@ -18,7 +18,12 @@ let
       #
       # if vendorHash is null, then we won't fetch any dependencies and
       # rely on the vendor folder within the source.
-    , vendorHash ? args'.vendorSha256 or (throw "buildGoModule: vendorHash is missing")
+    , vendorHash ? throw (
+        if args'?vendorSha256 then
+          "buildGoModule: Expect vendorHash instead of vendorSha256"
+        else
+          "buildGoModule: vendorHash is missing"
+      )
       # Whether to delete the vendor folder supplied with the source.
     , deleteVendor ? false
       # Whether to fetch (go mod download) and proxy the vendor directory.
@@ -43,6 +48,8 @@ let
 
     , ldflags ? [ ]
 
+    , GOFLAGS ? [ ]
+
       # needed for buildFlags{,Array} warning
     , buildFlags ? ""
     , buildFlagsArray ? ""
@@ -51,7 +58,6 @@ let
     }@args':
 
     assert goPackagePath != "" -> throw "`goPackagePath` is not needed with `buildGoModule`";
-    assert (args' ? vendorHash && args' ? vendorSha256) -> throw "both `vendorHash` and `vendorSha256` set. only one can be set.";
 
     let
       args = removeAttrs args' [ "overrideModAttrs" "vendorSha256" "vendorHash" ];
@@ -147,7 +153,9 @@ let
 
         outputHashMode = "recursive";
         outputHash = vendorHash;
-        outputHashAlgo = if args' ? vendorSha256 || vendorHash == "" then "sha256" else null;
+        # Handle empty vendorHash; avoid
+        # error: empty hash requires explicit hash algorithm
+        outputHashAlgo = if vendorHash == "" then "sha256" else null;
       }).overrideAttrs overrideModAttrs;
 
       package = stdenv.mkDerivation (args // {
@@ -155,11 +163,13 @@ let
 
         inherit (go) GOOS GOARCH;
 
-        GOFLAGS = lib.optionals (!proxyVendor) [ "-mod=vendor" ] ++ lib.optionals (!allowGoReference) [ "-trimpath" ];
+        GOFLAGS = GOFLAGS
+          ++ lib.optional (!proxyVendor) "-mod=vendor"
+          ++ lib.optional (!allowGoReference) "-trimpath";
         inherit CGO_ENABLED enableParallelBuilding GO111MODULE GOTOOLCHAIN;
 
         # If not set to an explicit value, set the buildid empty for reproducibility.
-        ldflags = ldflags ++ lib.optionals (!lib.any (lib.hasPrefix "-buildid=") ldflags) [ "-buildid=" ];
+        ldflags = ldflags ++ lib.optional (!lib.any (lib.hasPrefix "-buildid=") ldflags) "-buildid=";
 
         configurePhase = args.configurePhase or (''
           runHook preConfigure
@@ -296,8 +306,7 @@ let
 
         disallowedReferences = lib.optional (!allowGoReference) go;
 
-        passthru = passthru // { inherit go goModules vendorHash; }
-                            // lib.optionalAttrs (args' ? vendorSha256 ) { inherit (args') vendorSha256; };
+        passthru = passthru // { inherit go goModules vendorHash; };
 
         meta = {
           # Add default meta information
@@ -307,10 +316,11 @@ let
         overrideGoAttrs = f: buildGoPackage (args' // (f args'));
       };
     in
-    lib.warnIf (args' ? vendorSha256) "`vendorSha256` is deprecated. Use `vendorHash` instead"
     lib.warnIf (buildFlags != "" || buildFlagsArray != "")
       "Use the `ldflags` and/or `tags` attributes instead of `buildFlags`/`buildFlagsArray`"
     lib.warnIf (builtins.elem "-buildid=" ldflags) "`-buildid=` is set by default as ldflag by buildGoModule"
+    lib.warnIf (builtins.elem "-trimpath" GOFLAGS) "`-trimpath` is added by default to GOFLAGS by buildGoModule when allowGoReference isn't set to true"
+    lib.warnIf (lib.any (lib.hasPrefix "-mod=") GOFLAGS) "use `proxyVendor` to control Go module/vendor behavior instead of setting `-mod=` in GOFLAGS"
       package;
 in
   buildGoPackage
diff --git a/nixpkgs/pkgs/build-support/go/package.nix b/nixpkgs/pkgs/build-support/go/package.nix
index 8ca5ca0dca01..94a459c267f3 100644
--- a/nixpkgs/pkgs/build-support/go/package.nix
+++ b/nixpkgs/pkgs/build-support/go/package.nix
@@ -39,6 +39,8 @@
 
 , ldflags ? [ ]
 
+, GOFLAGS ? [ ]
+
 # needed for buildFlags{,Array} warning
 , buildFlags ? ""
 , buildFlagsArray ? ""
@@ -89,12 +91,12 @@ let
 
     GO111MODULE = "off";
     GOTOOLCHAIN = "local";
-    GOFLAGS = lib.optionals (!allowGoReference) [ "-trimpath" ];
+    GOFLAGS = GOFLAGS ++ lib.optional (!allowGoReference)  "-trimpath" ;
 
     GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
 
     # If not set to an explicit value, set the buildid empty for reproducibility.
-    ldflags = ldflags ++ lib.optionals (!lib.any (lib.hasPrefix "-buildid=") ldflags) [ "-buildid=" ];
+    ldflags = ldflags ++ lib.optional (!lib.any (lib.hasPrefix "-buildid=") ldflags) "-buildid=";
 
     configurePhase = args.configurePhase or (''
       runHook preConfigure
@@ -286,4 +288,5 @@ in
 lib.warnIf (buildFlags != "" || buildFlagsArray != "")
   "Use the `ldflags` and/or `tags` attributes instead of `buildFlags`/`buildFlagsArray`"
 lib.warnIf (builtins.elem "-buildid=" ldflags) "`-buildid=` is set by default as ldflag by buildGoModule"
+lib.warnIf (builtins.elem "-trimpath" GOFLAGS) "`-trimpath` is added by default to GOFLAGS by buildGoModule when allowGoReference isn't set to true"
   package
diff --git a/nixpkgs/pkgs/build-support/kernel/make-initrd-ng/Cargo.lock b/nixpkgs/pkgs/build-support/kernel/make-initrd-ng/Cargo.lock
index 83e0fd3a2c5e..61f71f642777 100644
--- a/nixpkgs/pkgs/build-support/kernel/make-initrd-ng/Cargo.lock
+++ b/nixpkgs/pkgs/build-support/kernel/make-initrd-ng/Cargo.lock
@@ -4,9 +4,9 @@ version = 3
 
 [[package]]
 name = "eyre"
-version = "0.6.11"
+version = "0.6.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6267a1fa6f59179ea4afc8e50fd8612a3cc60bc858f786ff877a4a8cb042799"
+checksum = "7cd915d99f24784cdc19fd37ef22b97e3ff0ae756c7e492e9fbfe897d61e2aec"
 dependencies = [
  "indenter",
  "once_cell",