Merge branch 'nixos-unstable' of https://github.com/NixOS/nixpkgs

12 files changed, 49 insertions, 17 deletions

diff --git a/nixpkgs/pkgs/build-support/bintools-wrapper/default.nix b/nixpkgs/pkgs/build-support/bintools-wrapper/default.nix
index 9ed4f5886f61..ccd342eaa0d1 100644
--- a/nixpkgs/pkgs/build-support/bintools-wrapper/default.nix
+++ b/nixpkgs/pkgs/build-support/bintools-wrapper/default.nix
@@ -80,7 +80,8 @@ let
     else if targetPlatform.libc == "nblibc"           then "${sharedLibraryLoader}/libexec/ld.elf_so"
     else if targetPlatform.system == "i686-linux"     then "${sharedLibraryLoader}/lib/ld-linux.so.2"
     else if targetPlatform.system == "x86_64-linux"   then "${sharedLibraryLoader}/lib/ld-linux-x86-64.so.2"
-    else if targetPlatform.system == "powerpc64le-linux" then "${sharedLibraryLoader}/lib/ld64.so.2"
+    # ELFv1 (.1) or ELFv2 (.2) ABI
+    else if targetPlatform.isPower64                  then "${sharedLibraryLoader}/lib/ld64.so.*"
     # ARM with a wildcard, which can be "" or "-armhf".
     else if (with targetPlatform; isAarch32 && isLinux)   then "${sharedLibraryLoader}/lib/ld-linux*.so.3"
     else if targetPlatform.system == "aarch64-linux"  then "${sharedLibraryLoader}/lib/ld-linux-aarch64.so.1"
diff --git a/nixpkgs/pkgs/build-support/cc-wrapper/default.nix b/nixpkgs/pkgs/build-support/cc-wrapper/default.nix
index 8412aabfe5fa..e1da3ceb5bc9 100644
--- a/nixpkgs/pkgs/build-support/cc-wrapper/default.nix
+++ b/nixpkgs/pkgs/build-support/cc-wrapper/default.nix
@@ -107,6 +107,8 @@ let
     && !(stdenv.targetPlatform.useAndroidPrebuilt or false)
     && !(stdenv.targetPlatform.isiOS or false)
     && gccForLibs != null;
+  gccForLibs_solib = getLib gccForLibs
+    + optionalString (targetPlatform != hostPlatform) "/${targetPlatform.config}";
 
   # older compilers (for example bootstrap's GCC 5) fail with -march=too-modern-cpu
   isGccArchSupported = arch:
@@ -374,7 +376,7 @@ stdenv.mkDerivation {
     ''
     + optionalString useGccForLibs ''
       echo "-L${gccForLibs}/lib/gcc/${targetPlatform.config}/${gccForLibs.version}" >> $out/nix-support/cc-ldflags
-      echo "-L${gccForLibs.lib}/${targetPlatform.config}/lib" >> $out/nix-support/cc-ldflags
+      echo "-L${gccForLibs_solib}/lib" >> $out/nix-support/cc-ldflags
     ''
 
     # TODO We would like to connect this to `useGccForLibs`, but we cannot yet
diff --git a/nixpkgs/pkgs/build-support/docker/default.nix b/nixpkgs/pkgs/build-support/docker/default.nix
index 9f57804e957d..1ac0a69f7451 100644
--- a/nixpkgs/pkgs/build-support/docker/default.nix
+++ b/nixpkgs/pkgs/build-support/docker/default.nix
@@ -487,7 +487,7 @@ rec {
       '';
     };
 
-  buildLayeredImage = { name, ... }@args:
+  buildLayeredImage = lib.makeOverridable ({ name, ... }@args:
     let
       stream = streamLayeredImage args;
     in
@@ -496,7 +496,8 @@ rec {
         inherit (stream) imageName;
         passthru = { inherit (stream) imageTag; };
         nativeBuildInputs = [ pigz ];
-      } "${stream} | pigz -nTR > $out";
+      } "${stream} | pigz -nTR > $out"
+  );
 
   # 1. extract the base image
   # 2. create the layer
@@ -504,7 +505,7 @@ rec {
   # 4. compute the layer id
   # 5. put the layer in the image
   # 6. repack the image
-  buildImage =
+  buildImage = lib.makeOverridable (
     args@{
       # Image name.
       name
@@ -751,7 +752,8 @@ rec {
       '';
 
     in
-    checked result;
+    checked result
+  );
 
   # Merge the tarballs of images built with buildImage into a single
   # tarball that contains all images. Running `docker load` on the resulting
@@ -837,7 +839,7 @@ rec {
     })
   );
 
-  streamLayeredImage =
+  streamLayeredImage = lib.makeOverridable (
     {
       # Image Name
       name
@@ -1046,7 +1048,8 @@ rec {
           makeWrapper ${streamScript} $out --add-flags ${conf}
         '';
       in
-      result;
+      result
+  );
 
   # This function streams a docker image that behaves like a nix-shell for a derivation
   streamNixShellImage =
diff --git a/nixpkgs/pkgs/build-support/node/fetch-npm-deps/default.nix b/nixpkgs/pkgs/build-support/node/fetch-npm-deps/default.nix
index ac76758ba50e..67a4c337c0d2 100644
--- a/nixpkgs/pkgs/build-support/node/fetch-npm-deps/default.nix
+++ b/nixpkgs/pkgs/build-support/node/fetch-npm-deps/default.nix
@@ -165,7 +165,9 @@
 
       dontInstall = true;
 
-      impureEnvVars = lib.fetchers.proxyImpureEnvVars;
+      # NIX_NPM_TOKENS environment variable should be a JSON mapping in the shape of:
+      # `{ "registry.example.com": "example-registry-bearer-token", ... }`
+      impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [ "NIX_NPM_TOKENS" ];
 
       SSL_CERT_FILE = if (hash_.outputHash == "" || hash_.outputHash == lib.fakeSha256 || hash_.outputHash == lib.fakeSha512 || hash_.outputHash == lib.fakeHash)
         then "${cacert}/etc/ssl/certs/ca-bundle.crt"
diff --git a/nixpkgs/pkgs/build-support/node/fetch-npm-deps/src/main.rs b/nixpkgs/pkgs/build-support/node/fetch-npm-deps/src/main.rs
index 62e5752c74c0..9d86bd8091a7 100644
--- a/nixpkgs/pkgs/build-support/node/fetch-npm-deps/src/main.rs
+++ b/nixpkgs/pkgs/build-support/node/fetch-npm-deps/src/main.rs
@@ -108,7 +108,7 @@ fn fixup_lockfile(
 
 // Recursive helper to fixup v1 lockfile deps
 fn fixup_v1_deps(
-    dependencies: &mut serde_json::Map<String, Value>,
+    dependencies: &mut Map<String, Value>,
     cache: &Option<HashMap<String, String>>,
     fixed: &mut bool,
 ) {
diff --git a/nixpkgs/pkgs/build-support/node/fetch-npm-deps/src/parse/mod.rs b/nixpkgs/pkgs/build-support/node/fetch-npm-deps/src/parse/mod.rs
index e1b491cccea2..b37652ffdf82 100644
--- a/nixpkgs/pkgs/build-support/node/fetch-npm-deps/src/parse/mod.rs
+++ b/nixpkgs/pkgs/build-support/node/fetch-npm-deps/src/parse/mod.rs
@@ -139,9 +139,9 @@ impl Package {
             None => Specifics::Registry {
                 integrity: pkg
                     .integrity
-                    .expect("non-git dependencies should have assosciated integrity")
+                    .expect("non-git dependencies should have associated integrity")
                     .into_best()
-                    .expect("non-git dependencies should have non-empty assosciated integrity"),
+                    .expect("non-git dependencies should have non-empty associated integrity"),
             },
         };
 
diff --git a/nixpkgs/pkgs/build-support/node/fetch-npm-deps/src/util.rs b/nixpkgs/pkgs/build-support/node/fetch-npm-deps/src/util.rs
index a165461fa71a..7a220f681c0d 100644
--- a/nixpkgs/pkgs/build-support/node/fetch-npm-deps/src/util.rs
+++ b/nixpkgs/pkgs/build-support/node/fetch-npm-deps/src/util.rs
@@ -3,6 +3,7 @@ use isahc::{
     config::{CaCertificate, Configurable, RedirectPolicy, SslOption},
     Body, Request, RequestExt,
 };
+use serde_json::{Map, Value};
 use std::{env, path::Path};
 use url::Url;
 
@@ -22,6 +23,18 @@ pub fn get_url(url: &Url) -> Result<Body, isahc::Error> {
         }
     }
 
+    // Respect NIX_NPM_TOKENS environment variable, which should be a JSON mapping in the shape of:
+    // `{ "registry.example.com": "example-registry-bearer-token", ... }`
+    if let Some(host) = url.host_str() {
+        if let Ok(npm_tokens) = env::var("NIX_NPM_TOKENS") {
+            if let Ok(tokens) = serde_json::from_str::<Map<String, Value>>(&npm_tokens) {
+                if let Some(token) = tokens.get(host).and_then(|val| val.as_str()) {
+                    request = request.header("Authorization", format!("Bearer {token}"));
+                }
+            }
+        }
+    }
+
     Ok(request.body(())?.send()?.into_body())
 }
 
diff --git a/nixpkgs/pkgs/build-support/setup-hooks/multiple-outputs.sh b/nixpkgs/pkgs/build-support/setup-hooks/multiple-outputs.sh
index 8a62c57dbd07..45096d833b42 100644
--- a/nixpkgs/pkgs/build-support/setup-hooks/multiple-outputs.sh
+++ b/nixpkgs/pkgs/build-support/setup-hooks/multiple-outputs.sh
@@ -69,8 +69,8 @@ _multioutConfig() {
     # try to detect share/doc/${shareDocName}
     # Note: sadly, $configureScript detection comes later in configurePhase,
     #   and reordering would cause more trouble than worth.
-    if [ -z "$shareDocName" ]; then
-        local confScript="$configureScript"
+    if [ -z "${shareDocName:-}" ]; then
+        local confScript="${configureScript:-}"
         if [ -z "$confScript" ] && [ -x ./configure ]; then
             confScript=./configure
         fi
diff --git a/nixpkgs/pkgs/build-support/setup-hooks/patch-shebangs.sh b/nixpkgs/pkgs/build-support/setup-hooks/patch-shebangs.sh
index e6872db1acd7..a22f989362c4 100644
--- a/nixpkgs/pkgs/build-support/setup-hooks/patch-shebangs.sh
+++ b/nixpkgs/pkgs/build-support/setup-hooks/patch-shebangs.sh
@@ -75,7 +75,7 @@ patchShebangs() {
         read -r oldInterpreterLine < "$f"
         read -r oldPath arg0 args <<< "${oldInterpreterLine:2}"
 
-        if [[ -z "$pathName" ]]; then
+        if [[ -z "${pathName:-}" ]]; then
             if [[ -n $strictDeps && $f == "$NIX_STORE"* ]]; then
                 pathName=HOST_PATH
             else
diff --git a/nixpkgs/pkgs/build-support/setup-hooks/separate-debug-info.sh b/nixpkgs/pkgs/build-support/setup-hooks/separate-debug-info.sh
index 334db4cfcd9c..3a16ac4fee90 100644
--- a/nixpkgs/pkgs/build-support/setup-hooks/separate-debug-info.sh
+++ b/nixpkgs/pkgs/build-support/setup-hooks/separate-debug-info.sh
@@ -21,6 +21,9 @@ _separateDebugInfo() {
     while IFS= read -r -d $'\0' i; do
         if ! isELF "$i"; then continue; fi
 
+        [ -z "${READELF:-}" ] && echo "_separateDebugInfo: '\$READELF' variable is empty, skipping." 1>&2 && break
+        [ -z "${OBJCOPY:-}" ] && echo "_separateDebugInfo: '\$OBJCOPY' variable is empty, skipping." 1>&2 && break
+
         # Extract the Build ID. FIXME: there's probably a cleaner way.
         local id="$($READELF -n "$i" | sed 's/.*Build ID: \([0-9a-f]*\).*/\1/; t; d')"
         if [ "${#id}" != 40 ]; then
diff --git a/nixpkgs/pkgs/build-support/setup-hooks/strip.sh b/nixpkgs/pkgs/build-support/setup-hooks/strip.sh
index d2422bb84234..ce41e6ea0562 100644
--- a/nixpkgs/pkgs/build-support/setup-hooks/strip.sh
+++ b/nixpkgs/pkgs/build-support/setup-hooks/strip.sh
@@ -49,11 +49,19 @@ stripDirs() {
     local ranlibCmd="$2"
     local paths="$3"
     local stripFlags="$4"
+    local excludeFlags=()
     local pathsNew=
 
     [ -z "$cmd" ] && echo "stripDirs: Strip command is empty" 1>&2 && exit 1
     [ -z "$ranlibCmd" ] && echo "stripDirs: Ranlib command is empty" 1>&2 && exit 1
 
+    local pattern
+    if [ -n "${stripExclude:-}" ]; then
+        for pattern in "${stripExclude[@]}"; do
+            excludeFlags+=(-a '!' '(' -name "$pattern" -o -wholename "$prefix/$pattern" ')' )
+        done
+    fi
+
     local p
     for p in ${paths}; do
         if [ -e "$prefix/$p" ]; then
@@ -67,7 +75,7 @@ stripDirs() {
         local striperr
         striperr="$(mktemp --tmpdir="$TMPDIR" 'striperr.XXXXXX')"
         # Do not strip lib/debug. This is a directory used by setup-hooks/separate-debug-info.sh.
-        find $paths -type f -a '!' -path "$prefix/lib/debug/*" -print0 |
+        find $paths -type f "${excludeFlags[@]}" -a '!' -path "$prefix/lib/debug/*" -print0 |
             # Make sure we process files under symlinks only once. Otherwise
             # 'strip` can corrupt files when writes to them in parallel:
             #   https://github.com/NixOS/nixpkgs/issues/246147#issuecomment-1657072039
diff --git a/nixpkgs/pkgs/build-support/testers/default.nix b/nixpkgs/pkgs/build-support/testers/default.nix
index 3ff52ed0178c..fc10597e3e12 100644
--- a/nixpkgs/pkgs/build-support/testers/default.nix
+++ b/nixpkgs/pkgs/build-support/testers/default.nix
@@ -61,7 +61,7 @@
       version ? package.version,
     }: runCommand "${package.name}-test-version" { nativeBuildInputs = [ package ]; meta.timeout = 60; } ''
       if output=$(${command} 2>&1); then
-        if grep -Fw "${version}" - <<< "$output"; then
+        if grep -Fw -- "${version}" - <<< "$output"; then
           touch $out
         else
           echo "Version string '${version}' not found!" >&2