about summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/audio/ardour/6.nix2
-rw-r--r--pkgs/applications/audio/ardour/default.nix2
-rw-r--r--pkgs/applications/audio/guitarix/default.nix2
-rw-r--r--pkgs/applications/office/semantik/default.nix2
-rw-r--r--pkgs/applications/version-management/git/default.nix6
-rw-r--r--pkgs/applications/version-management/mercurial/default.nix7
-rw-r--r--pkgs/build-support/cc-wrapper/default.nix4
-rw-r--r--pkgs/build-support/setup-hooks/multiple-outputs.sh4
-rw-r--r--pkgs/build-support/setup-hooks/patch-shebangs.sh2
-rw-r--r--pkgs/build-support/setup-hooks/separate-debug-info.sh3
-rw-r--r--pkgs/build-support/setup-hooks/strip.sh10
-rw-r--r--pkgs/development/compilers/gcc/patches/default.nix262
-rw-r--r--pkgs/development/compilers/llvm/10/bintools/default.nix34
-rw-r--r--pkgs/development/compilers/llvm/10/compiler-rt/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/10/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/10/libcxxabi/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/11/bintools/default.nix34
-rw-r--r--pkgs/development/compilers/llvm/11/compiler-rt/codesign.patch33
-rw-r--r--pkgs/development/compilers/llvm/11/compiler-rt/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/11/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/11/libcxxabi/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/11/libcxxabi/no-threads.patch12
-rw-r--r--pkgs/development/compilers/llvm/11/libcxxabi/wasm.patch16
-rw-r--r--pkgs/development/compilers/llvm/12/bintools/default.nix34
-rw-r--r--pkgs/development/compilers/llvm/12/compiler-rt/codesign.patch33
-rw-r--r--pkgs/development/compilers/llvm/12/compiler-rt/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/12/default.nix17
-rw-r--r--pkgs/development/compilers/llvm/12/libcxxabi/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/12/libcxxabi/wasm.patch16
-rw-r--r--pkgs/development/compilers/llvm/13/bintools/default.nix35
-rw-r--r--pkgs/development/compilers/llvm/13/default.nix17
-rw-r--r--pkgs/development/compilers/llvm/13/libcxxabi/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/13/libcxxabi/wasm.patch16
-rw-r--r--pkgs/development/compilers/llvm/14/bintools/default.nix35
-rw-r--r--pkgs/development/compilers/llvm/14/default.nix17
-rw-r--r--pkgs/development/compilers/llvm/14/libcxxabi/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/14/libcxxabi/wasm.patch16
-rw-r--r--pkgs/development/compilers/llvm/15/bintools/default.nix37
-rw-r--r--pkgs/development/compilers/llvm/15/default.nix17
-rw-r--r--pkgs/development/compilers/llvm/15/libcxxabi/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/15/libcxxabi/wasm.patch16
-rw-r--r--pkgs/development/compilers/llvm/16/bintools/default.nix37
-rw-r--r--pkgs/development/compilers/llvm/16/default.nix17
-rw-r--r--pkgs/development/compilers/llvm/16/libcxxabi/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/16/libcxxabi/wasm.patch16
-rw-r--r--pkgs/development/compilers/llvm/5/clang/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/6/clang/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/6/clang/purity.patch30
-rw-r--r--pkgs/development/compilers/llvm/7/bintools/default.nix34
-rw-r--r--pkgs/development/compilers/llvm/7/clang/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/7/clang/purity.patch30
-rw-r--r--pkgs/development/compilers/llvm/7/compiler-rt/codesign.patch33
-rw-r--r--pkgs/development/compilers/llvm/7/compiler-rt/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/7/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/8/bintools/default.nix34
-rw-r--r--pkgs/development/compilers/llvm/8/clang/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/8/clang/purity.patch30
-rw-r--r--pkgs/development/compilers/llvm/8/compiler-rt/codesign.patch33
-rw-r--r--pkgs/development/compilers/llvm/8/compiler-rt/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/8/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/8/libcxxabi/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/8/libcxxabi/no-threads.patch12
-rw-r--r--pkgs/development/compilers/llvm/8/libcxxabi/wasm.patch16
-rw-r--r--pkgs/development/compilers/llvm/9/bintools/default.nix34
-rw-r--r--pkgs/development/compilers/llvm/9/compiler-rt/codesign.patch33
-rw-r--r--pkgs/development/compilers/llvm/9/compiler-rt/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/9/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/9/libcxxabi/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/9/libcxxabi/no-threads.patch12
-rw-r--r--pkgs/development/compilers/llvm/9/libcxxabi/wasm.patch16
-rw-r--r--pkgs/development/compilers/llvm/common/bintools.nix48
-rw-r--r--pkgs/development/compilers/llvm/common/clang/5-8-purity.patch (renamed from pkgs/development/compilers/llvm/5/clang/purity.patch)0
-rw-r--r--pkgs/development/compilers/llvm/common/compiler-rt/7-12-codesign.patch (renamed from pkgs/development/compilers/llvm/10/compiler-rt/codesign.patch)0
-rw-r--r--pkgs/development/compilers/llvm/common/libcxxabi/no-threads.patch (renamed from pkgs/development/compilers/llvm/10/libcxxabi/no-threads.patch)0
-rw-r--r--pkgs/development/compilers/llvm/common/libcxxabi/wasm.patch (renamed from pkgs/development/compilers/llvm/10/libcxxabi/wasm.patch)0
-rw-r--r--pkgs/development/compilers/llvm/common/lldb.nix69
-rw-r--r--pkgs/development/compilers/llvm/git/bintools/default.nix37
-rw-r--r--pkgs/development/compilers/llvm/git/default.nix27
-rw-r--r--pkgs/development/compilers/llvm/git/libcxxabi/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/git/libcxxabi/wasm.patch16
-rw-r--r--pkgs/development/compilers/llvm/git/lldb/default.nix144
-rw-r--r--pkgs/development/compilers/vala/default.nix4
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix5
-rw-r--r--pkgs/development/libraries/SDL2/default.nix18
-rw-r--r--pkgs/development/libraries/audio/lvtk/default.nix2
-rw-r--r--pkgs/development/libraries/ffmpeg/4.nix2
-rw-r--r--pkgs/development/libraries/ffmpeg/5.nix2
-rw-r--r--pkgs/development/libraries/ffmpeg/6.nix2
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix6
-rw-r--r--pkgs/development/libraries/fortify-headers/default.nix5
-rw-r--r--pkgs/development/libraries/fortify-headers/restore-macros.patch283
-rw-r--r--pkgs/development/libraries/fortify-headers/wchar-imports-skip.patch41
-rw-r--r--pkgs/development/libraries/gpgme/default.nix4
-rw-r--r--pkgs/development/libraries/ldb/default.nix2
-rw-r--r--pkgs/development/libraries/libxml2/default.nix4
-rw-r--r--pkgs/development/libraries/ndn-cxx/default.nix2
-rw-r--r--pkgs/development/libraries/openexr/3.nix4
-rw-r--r--pkgs/development/libraries/talloc/default.nix2
-rw-r--r--pkgs/development/libraries/tdb/default.nix2
-rw-r--r--pkgs/development/libraries/tevent/default.nix2
-rw-r--r--pkgs/development/libraries/zxing-cpp/default.nix47
-rw-r--r--pkgs/development/python-modules/pybind11/default.nix2
-rw-r--r--pkgs/development/python-modules/trustme/default.nix33
-rw-r--r--pkgs/development/python-modules/twisted/default.nix13
-rw-r--r--pkgs/development/python-modules/zxing_cpp/default.nix31
-rw-r--r--pkgs/development/python-modules/zxing_cpp/use-nixpkgs-pybind11.patch14
-rw-r--r--pkgs/development/tools/build-managers/waf/setup-hook.sh2
-rw-r--r--pkgs/development/tools/hotdoc/default.nix14
-rw-r--r--pkgs/misc/jackaudio/default.nix3
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix5
-rw-r--r--pkgs/os-specific/linux/kbd/default.nix14
-rw-r--r--pkgs/os-specific/linux/kbd/search-paths.patch3
-rw-r--r--pkgs/servers/nfd/default.nix2
-rw-r--r--pkgs/servers/samba/4.x.nix2
-rw-r--r--pkgs/stdenv/generic/make-derivation.nix2
-rw-r--r--pkgs/stdenv/generic/setup.sh2
-rw-r--r--pkgs/tools/cd-dvd/cdrtools/default.nix2
-rw-r--r--pkgs/tools/networking/ndn-tools/default.nix2
-rw-r--r--pkgs/tools/networking/saldl/default.nix2
-rw-r--r--pkgs/tools/networking/unbound/default.nix5
-rw-r--r--pkgs/tools/package-management/nix/common.nix2
-rw-r--r--pkgs/top-level/all-packages.nix12
-rw-r--r--pkgs/top-level/python-packages.nix4
123 files changed, 838 insertions, 1331 deletions
diff --git a/pkgs/applications/audio/ardour/6.nix b/pkgs/applications/audio/ardour/6.nix
index fa6cfce7977a..026e23649edd 100644
--- a/pkgs/applications/audio/ardour/6.nix
+++ b/pkgs/applications/audio/ardour/6.nix
@@ -129,7 +129,7 @@ stdenv.mkDerivation rec {
     vamp-plugin-sdk
   ] ++ lib.optionals videoSupport [ harvid xjadeo ];
 
-  wafConfigureFlags = [
+  configureFlags = [
     "--cxx11"
     "--docs"
     "--freedesktop"
diff --git a/pkgs/applications/audio/ardour/default.nix b/pkgs/applications/audio/ardour/default.nix
index a39aa7242e72..9589f8b087b7 100644
--- a/pkgs/applications/audio/ardour/default.nix
+++ b/pkgs/applications/audio/ardour/default.nix
@@ -150,7 +150,7 @@ stdenv.mkDerivation rec {
     vamp-plugin-sdk
   ] ++ lib.optionals videoSupport [ harvid xjadeo ];
 
-  wafConfigureFlags = [
+  configureFlags = [
     "--cxx11"
     "--docs"
     "--freedesktop"
diff --git a/pkgs/applications/audio/guitarix/default.nix b/pkgs/applications/audio/guitarix/default.nix
index e40084ff5a1b..abe24fb22453 100644
--- a/pkgs/applications/audio/guitarix/default.nix
+++ b/pkgs/applications/audio/guitarix/default.nix
@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
     zita-resampler
   ];
 
-  wafConfigureFlags = [
+  configureFlags = [
     "--no-font-cache-update"
     "--shared-lib"
     "--no-desktop-update"
diff --git a/pkgs/applications/office/semantik/default.nix b/pkgs/applications/office/semantik/default.nix
index 7e240823cb42..538fbe9011b9 100644
--- a/pkgs/applications/office/semantik/default.nix
+++ b/pkgs/applications/office/semantik/default.nix
@@ -85,7 +85,7 @@ mkDerivation rec {
     kdelibs4support
   ];
 
-  wafConfigureFlags = [
+  configureFlags = [
     "--qtlibs=${lib.getLib qtbase}/lib"
   ];
 
diff --git a/pkgs/applications/version-management/git/default.nix b/pkgs/applications/version-management/git/default.nix
index 59afb979acf6..1b92778e65cc 100644
--- a/pkgs/applications/version-management/git/default.nix
+++ b/pkgs/applications/version-management/git/default.nix
@@ -29,7 +29,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.41.0";
+  version = "2.42.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    hash = "sha256-50i6/UJM/oCyEsvG8bvMw6R9SGL7HreYiHd1BHhWgEA=";
+    hash = "sha256-MnghDp/SmUuEhN1+Pd2eqLlA71IXDNtgbaqU2IfJOw0=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
@@ -396,7 +396,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
 
     platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ primeos wmertens globin ];
+    maintainers = with lib.maintainers; [ primeos wmertens globin kashw2 ];
     mainProgram = "git";
   };
 })
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index f347ed884eff..01dc3efcd6e0 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -21,11 +21,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.5.1";
+    version = "6.5.2";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "sha256-M/fejYs2B/orQIzeS4cl4RfrCtQZJqeH6qtAnKik/C8=";
+      sha256 = "sha256-r8OdcGeXZZPIMyuOl6Eq/Tk7VQN8X7nDyrGkLHVg9go=";
     };
 
     format = "other";
@@ -35,7 +35,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "mercurial-${version}";
-      sha256 = "sha256-tPv0UeZOsHDGKzXWeA/fFio7d3EN+KGioDu/1WH1drc=";
+      sha256 = "sha256-dcyHmLkRadNK30Vv0XsCEaZGTIcF/L29lLe58ggB3Lg=";
       sourceRoot = "mercurial-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;
@@ -90,6 +90,7 @@ let
       description = "A fast, lightweight SCM system for very large distributed projects";
       homepage = "https://www.mercurial-scm.org";
       downloadPage = "https://www.mercurial-scm.org/release/";
+      changelog = "https://wiki.mercurial-scm.org/Release${versions.majorMinor version}";
       license = licenses.gpl2Plus;
       maintainers = with maintainers; [ eelco lukegb pacien techknowlogick ];
       platforms = platforms.unix;
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 8412aabfe5fa..e1da3ceb5bc9 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -107,6 +107,8 @@ let
     && !(stdenv.targetPlatform.useAndroidPrebuilt or false)
     && !(stdenv.targetPlatform.isiOS or false)
     && gccForLibs != null;
+  gccForLibs_solib = getLib gccForLibs
+    + optionalString (targetPlatform != hostPlatform) "/${targetPlatform.config}";
 
   # older compilers (for example bootstrap's GCC 5) fail with -march=too-modern-cpu
   isGccArchSupported = arch:
@@ -374,7 +376,7 @@ stdenv.mkDerivation {
     ''
     + optionalString useGccForLibs ''
       echo "-L${gccForLibs}/lib/gcc/${targetPlatform.config}/${gccForLibs.version}" >> $out/nix-support/cc-ldflags
-      echo "-L${gccForLibs.lib}/${targetPlatform.config}/lib" >> $out/nix-support/cc-ldflags
+      echo "-L${gccForLibs_solib}/lib" >> $out/nix-support/cc-ldflags
     ''
 
     # TODO We would like to connect this to `useGccForLibs`, but we cannot yet
diff --git a/pkgs/build-support/setup-hooks/multiple-outputs.sh b/pkgs/build-support/setup-hooks/multiple-outputs.sh
index 8a62c57dbd07..45096d833b42 100644
--- a/pkgs/build-support/setup-hooks/multiple-outputs.sh
+++ b/pkgs/build-support/setup-hooks/multiple-outputs.sh
@@ -69,8 +69,8 @@ _multioutConfig() {
     # try to detect share/doc/${shareDocName}
     # Note: sadly, $configureScript detection comes later in configurePhase,
     #   and reordering would cause more trouble than worth.
-    if [ -z "$shareDocName" ]; then
-        local confScript="$configureScript"
+    if [ -z "${shareDocName:-}" ]; then
+        local confScript="${configureScript:-}"
         if [ -z "$confScript" ] && [ -x ./configure ]; then
             confScript=./configure
         fi
diff --git a/pkgs/build-support/setup-hooks/patch-shebangs.sh b/pkgs/build-support/setup-hooks/patch-shebangs.sh
index e6872db1acd7..a22f989362c4 100644
--- a/pkgs/build-support/setup-hooks/patch-shebangs.sh
+++ b/pkgs/build-support/setup-hooks/patch-shebangs.sh
@@ -75,7 +75,7 @@ patchShebangs() {
         read -r oldInterpreterLine < "$f"
         read -r oldPath arg0 args <<< "${oldInterpreterLine:2}"
 
-        if [[ -z "$pathName" ]]; then
+        if [[ -z "${pathName:-}" ]]; then
             if [[ -n $strictDeps && $f == "$NIX_STORE"* ]]; then
                 pathName=HOST_PATH
             else
diff --git a/pkgs/build-support/setup-hooks/separate-debug-info.sh b/pkgs/build-support/setup-hooks/separate-debug-info.sh
index 334db4cfcd9c..3a16ac4fee90 100644
--- a/pkgs/build-support/setup-hooks/separate-debug-info.sh
+++ b/pkgs/build-support/setup-hooks/separate-debug-info.sh
@@ -21,6 +21,9 @@ _separateDebugInfo() {
     while IFS= read -r -d $'\0' i; do
         if ! isELF "$i"; then continue; fi
 
+        [ -z "${READELF:-}" ] && echo "_separateDebugInfo: '\$READELF' variable is empty, skipping." 1>&2 && break
+        [ -z "${OBJCOPY:-}" ] && echo "_separateDebugInfo: '\$OBJCOPY' variable is empty, skipping." 1>&2 && break
+
         # Extract the Build ID. FIXME: there's probably a cleaner way.
         local id="$($READELF -n "$i" | sed 's/.*Build ID: \([0-9a-f]*\).*/\1/; t; d')"
         if [ "${#id}" != 40 ]; then
diff --git a/pkgs/build-support/setup-hooks/strip.sh b/pkgs/build-support/setup-hooks/strip.sh
index d2422bb84234..ce41e6ea0562 100644
--- a/pkgs/build-support/setup-hooks/strip.sh
+++ b/pkgs/build-support/setup-hooks/strip.sh
@@ -49,11 +49,19 @@ stripDirs() {
     local ranlibCmd="$2"
     local paths="$3"
     local stripFlags="$4"
+    local excludeFlags=()
     local pathsNew=
 
     [ -z "$cmd" ] && echo "stripDirs: Strip command is empty" 1>&2 && exit 1
     [ -z "$ranlibCmd" ] && echo "stripDirs: Ranlib command is empty" 1>&2 && exit 1
 
+    local pattern
+    if [ -n "${stripExclude:-}" ]; then
+        for pattern in "${stripExclude[@]}"; do
+            excludeFlags+=(-a '!' '(' -name "$pattern" -o -wholename "$prefix/$pattern" ')' )
+        done
+    fi
+
     local p
     for p in ${paths}; do
         if [ -e "$prefix/$p" ]; then
@@ -67,7 +75,7 @@ stripDirs() {
         local striperr
         striperr="$(mktemp --tmpdir="$TMPDIR" 'striperr.XXXXXX')"
         # Do not strip lib/debug. This is a directory used by setup-hooks/separate-debug-info.sh.
-        find $paths -type f -a '!' -path "$prefix/lib/debug/*" -print0 |
+        find $paths -type f "${excludeFlags[@]}" -a '!' -path "$prefix/lib/debug/*" -print0 |
             # Make sure we process files under symlinks only once. Otherwise
             # 'strip` can corrupt files when writes to them in parallel:
             #   https://github.com/NixOS/nixpkgs/issues/246147#issuecomment-1657072039
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 79dbad30a0a9..0afc6586511a 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -47,102 +47,43 @@ let
   inherit (lib) optionals optional;
 in
 
-optionals (is49 || is6) [
-  ./9/fix-struct-redefinition-on-glibc-2.36.patch
-] ++ optionals (is49 || (is6 && !stdenv.targetPlatform.isRedox)) [
-  ./use-source-date-epoch.patch
-] ++ optionals (is6 && !stdenv.targetPlatform.isRedox) [
-  ./6/0001-Fix-build-for-glibc-2.31.patch
-] ++ optionals (!atLeast6) [
-  ./parallel-bconfig.patch
-] ++ optionals (is49) [
-  (./. + "/${lib.versions.major version}.${lib.versions.minor version}/parallel-strsignal.patch")
-  (./. + "/${lib.versions.major version}.${lib.versions.minor version}/libsanitizer.patch")
-  (fetchpatch {
-    name = "avoid-ustat-glibc-2.28.patch";
-    url = "https://gitweb.gentoo.org/proj/gcc-patches.git/plain/4.9.4/gentoo/100_all_avoid-ustat-glibc-2.28.patch?id=55fcb515620a8f7d3bb77eba938aa0fcf0d67c96";
-    sha256 = "0b32sb4psv5lq0ij9fwhi1b4pjbwdjnv24nqprsk14dsc6xmi1g0";
-  })
-] ++ optionals (is7) [
-  # https://gcc.gnu.org/ml/gcc-patches/2018-02/msg00633.html
-  (./. + "/${majorVersion}/riscv-pthread-reentrant.patch")
-  # https://gcc.gnu.org/ml/gcc-patches/2018-03/msg00297.html
-  (./. + "/${majorVersion}/riscv-no-relax.patch")
-  # Fix for asan w/glibc-2.34. Although there's no upstream backport to v7,
-  # the patch from gcc 8 seems to work perfectly fine.
-  (./. + "/${majorVersion}/gcc8-asan-glibc-2.34.patch")
-  (./. + "/${majorVersion}/0001-Fix-build-for-glibc-2.31.patch")
-] ++ optional (majorVersion == "9") ./9/fix-struct-redefinition-on-glibc-2.36.patch
+#
+#  Patches below are organized into three general categories:
+#  1. Patches relevant to gcc>=12 on every platform
+#  2. Patches relevant to gcc>=12 on specific platforms
+#  3. Patches relevant only to gcc<12
+#
+
+
+## 1. Patches relevant to gcc>=12 on every platform ####################################
+
+[]
 ++ optional (atLeast6 && !atLeast12) ./fix-bug-80431.patch
-++ optional (is7 || is8) ./9/fix-struct-redefinition-on-glibc-2.36.patch
 ++ optional (targetPlatform != hostPlatform) ./libstdc++-target.patch
-++ optional (atLeast7 && !atLeast10 && targetPlatform.isNetBSD) ./libstdc++-netbsd-ctypes.patch
-++ optional (noSysDirs) (if atLeast12 then ./gcc-12-no-sys-dirs.patch else ./no-sys-dirs.patch)
-++ optionals (is6 && langAda) [
-  ./gnat-cflags.patch
-  ./6/gnat-glibc234.patch
-] ++ optional (noSysDirs && atLeast10 && !atLeast13 && (is10 || (!atLeast12 -> hostPlatform.isRiscV))) ./no-sys-dirs-riscv.patch
-++ optional (noSysDirs && is13) ./13/no-sys-dirs-riscv.patch
-++ optional (noSysDirs && is9 && hostPlatform.isRiscV) ./no-sys-dirs-riscv-gcc9.patch
-++ optionals (langAda || atLeast12) [
-  ./gnat-cflags-11.patch
-] ++ optionals (langAda && (is9 || is10)) [
-  ./gnat-cflags.patch
-] ++ optionals atLeast12 [
-  ./gcc-12-gfortran-driving.patch
-  ./ppc-musl.patch
-] ++ optionals is12 [
-  # backport ICE fix on ccache code
-  ./12/lambda-ICE-PR109241.patch
-]
-# We only apply this patch when building a native toolchain for aarch64-darwin, as it breaks building
-# a foreign one: https://github.com/iains/gcc-12-branch/issues/18
-++ optionals (stdenv.isDarwin && stdenv.isAarch64 && buildPlatform == hostPlatform && hostPlatform == targetPlatform) ({
-  "13" = [ (fetchpatch {
-    name = "gcc-13-darwin-aarch64-support.patch";
-    url = "https://raw.githubusercontent.com/Homebrew/formula-patches/3c5cbc8e9cf444a1967786af48e430588e1eb481/gcc/gcc-13.2.0.diff";
-    sha256 = "sha256-Y5r3U3dwAFG6+b0TNCFd18PNxYu2+W/5zDbZ5cHvv+U=";
-  }) ];
-  "12" = [ (fetchurl {
-    name = "gcc-12-darwin-aarch64-support.patch";
-    url = "https://raw.githubusercontent.com/Homebrew/formula-patches/f1188b90d610e2ed170b22512ff7435ba5c891e2/gcc/gcc-12.3.0.diff";
-    sha256 = "sha256-naL5ZNiurqfDBiPSU8PTbTmLqj25B+vjjiqc4fAFgYs=";
-  }) ];
-}."${majorVersion}" or [])
+++ optionals (noSysDirs) (
+  [(if atLeast12 then ./gcc-12-no-sys-dirs.patch else ./no-sys-dirs.patch)] ++
+  ({
+    "13" = [ ./13/no-sys-dirs-riscv.patch ];
+    "12" = [ ./no-sys-dirs-riscv.patch ];
+    "11" = [ ./no-sys-dirs-riscv.patch ];
+    "10" = [ ./no-sys-dirs-riscv.patch ];
+    "9"  = [ ./no-sys-dirs-riscv-gcc9.patch ];
+  }."${majorVersion}" or [])
+)
+++ optional (atLeast12 && langAda) ./gnat-cflags-11.patch
+++ optional langFortran (if atLeast12 then ./gcc-12-gfortran-driving.patch else ./gfortran-driving.patch)
+++ optional atLeast7 ./ppc-musl.patch
+++ optional is12 ./12/lambda-ICE-PR109241.patch # backport ICE fix on ccache code
 ++ optional (atLeast9 && langD) ./libphobos.patch
-++ optional (is7 && hostPlatform != buildPlatform) (fetchpatch { # XXX: Refine when this should be applied
-  url = "https://git.busybox.net/buildroot/plain/package/gcc/7.1.0/0900-remove-selftests.patch?id=11271540bfe6adafbc133caf6b5b902a816f5f02";
-  sha256 = "0mrvxsdwip2p3l17dscpc1x8vhdsciqw1z5q9i6p5g9yg1cqnmgs";
-})
-++ optional (!atLeast12 && langFortran) ./gfortran-driving.patch
-++ optional (!atLeast49 && hostPlatform.isDarwin) ./gfortran-darwin-NXConstStr.patch
-++ optionals (is49) [
-  # glibc-2.26
-  ./struct-ucontext.patch
-  ./struct-sigaltstack-4.9.patch
-]
-# TODO: deduplicate this with copy above -- leaving duplicated for now in order to avoid changing eval results by reordering
-++ optional (atLeast7 && !atLeast12 && targetPlatform.libc == "musl" && targetPlatform.isPower) ./ppc-musl.patch
-++ optional ((is6 || is7) && targetPlatform.libc == "musl" && targetPlatform.isx86_32) (fetchpatch {
-  url = "https://git.alpinelinux.org/aports/plain/main/gcc/gcc-6.1-musl-libssp.patch?id=5e4b96e23871ee28ef593b439f8c07ca7c7eb5bb";
-  sha256 = "1jf1ciz4gr49lwyh8knfhw6l5gvfkwzjy90m7qiwkcbsf4a3fqn2";
-})
-++ optional ((is6 || is7 || is8) && !atLeast9 && targetPlatform.libc == "musl") ./libgomp-dont-force-initial-exec.patch
-++ optional (is6 && langGo) ./gogcc-workaround-glibc-2.36.patch
-# TODO: deduplicate this with copy above -- leaving duplicated for now in order to avoid changing eval results by reordering
-++ optionals (is11 && stdenv.isDarwin) [
-  (fetchpatch {
-    # There are no upstream release tags in https://github.com/iains/gcc-11-branch.
-    # ff4bf32 is the commit from https://github.com/gcc-mirror/gcc/releases/tag/releases%2Fgcc-11.4.0
-    url = "https://github.com/iains/gcc-11-branch/compare/ff4bf326d03e750a8d4905ea49425fe7d15a04b8..gcc-11.4-darwin-r0.diff";
-    hash = "sha256-6prPgR2eGVJs7vKd6iM1eZsEPCD1ShzLns2Z+29vlt4=";
-  })
-]
-# https://github.com/osx-cross/homebrew-avr/issues/280#issuecomment-1272381808
-++ optional (is11 && stdenv.isDarwin && targetPlatform.isAvr) ./avr-gcc-11.3-darwin.patch
+
+
+
+## 2. Patches relevant to gcc>=12 on specific platforms ####################################
+
+### Musl+Go+gcc12
 
 # backport fixes to build gccgo with musl libc
-++ optionals (atLeast12 && langGo && stdenv.hostPlatform.isMusl) [
+++ optionals (stdenv.hostPlatform.isMusl && langGo && atLeast12) [
   (fetchpatch {
     excludes = [ "gcc/go/gofrontend/MERGE" ];
     url = "https://github.com/gcc-mirror/gcc/commit/cf79b1117bd177d3d4c6ed24b6fa243c3628ac2d.diff";
@@ -179,16 +120,143 @@ optionals (is49 || is6) [
   })
 ]
 
+
+## Darwin
+
 # Fix detection of bootstrap compiler Ada support (cctools as) on Nix Darwin
 ++ optional (atLeast12 && stdenv.isDarwin && langAda) ./ada-cctools-as-detection-configure.patch
 
 # Use absolute path in GNAT dylib install names on Darwin
 ++ optional (atLeast12 && stdenv.isDarwin && langAda) ./gnat-darwin-dylib-install-name.patch
 
+# We only apply this patch when building a native toolchain for aarch64-darwin, as it breaks building
+# a foreign one: https://github.com/iains/gcc-12-branch/issues/18
+++ optionals (stdenv.isDarwin && stdenv.isAarch64 && buildPlatform == hostPlatform && hostPlatform == targetPlatform) ({
+  "13" = [ (fetchpatch {
+    name = "gcc-13-darwin-aarch64-support.patch";
+    url = "https://raw.githubusercontent.com/Homebrew/formula-patches/3c5cbc8e9cf444a1967786af48e430588e1eb481/gcc/gcc-13.2.0.diff";
+    sha256 = "sha256-Y5r3U3dwAFG6+b0TNCFd18PNxYu2+W/5zDbZ5cHvv+U=";
+  }) ];
+  "12" = [ (fetchurl {
+    name = "gcc-12-darwin-aarch64-support.patch";
+    url = "https://raw.githubusercontent.com/Homebrew/formula-patches/f1188b90d610e2ed170b22512ff7435ba5c891e2/gcc/gcc-12.3.0.diff";
+    sha256 = "sha256-naL5ZNiurqfDBiPSU8PTbTmLqj25B+vjjiqc4fAFgYs=";
+  }) ];
+  "11" = [ (fetchpatch {
+    # There are no upstream release tags in https://github.com/iains/gcc-11-branch.
+    # ff4bf32 is the commit from https://github.com/gcc-mirror/gcc/releases/tag/releases%2Fgcc-11.4.0
+    url = "https://github.com/iains/gcc-11-branch/compare/ff4bf326d03e750a8d4905ea49425fe7d15a04b8..gcc-11.4-darwin-r0.diff";
+    hash = "sha256-6prPgR2eGVJs7vKd6iM1eZsEPCD1ShzLns2Z+29vlt4=";
+  }) ];
+}.${majorVersion} or [])
+
+
+## Windows
+
 # Obtain latest patch with ../update-mcfgthread-patches.sh
 ++ optional (atLeast6 && !atLeast13 && !withoutTargetLibc && targetPlatform.isMinGW && threadsCross.model == "mcf")
   (./. + "/${majorVersion}/Added-mcf-thread-model-support-from-mcfgthread.patch")
 
+
+
+
+##############################################################################
+##
+##  3. Patches relevant only to gcc<12
+##
+##  Above this point are patches which might potentially be applied
+##  to gcc version 12 or newer.  Below this point are patches which
+##  will *only* be used for gcc versions older than gcc12.
+##
+##############################################################################
+
+
+
+
+## gcc 11.0 and older ##############################################################################
+
+# https://github.com/osx-cross/homebrew-avr/issues/280#issuecomment-1272381808
+++ optional (is11 && stdenv.isDarwin && targetPlatform.isAvr) ./avr-gcc-11.3-darwin.patch
+
+# openjdk build fails without this on -march=opteron; is upstream in gcc12
+++ optionals (is11) [ ./11/gcc-issue-103910.patch ]
+
+
+
+## gcc 10.0 and older ##############################################################################
+
+++ optional (langAda && (is9 || is10)) ./gnat-cflags.patch
+++ optional (is10 && buildPlatform.system == "aarch64-darwin" && targetPlatform != buildPlatform) (fetchpatch {
+  url = "https://raw.githubusercontent.com/richard-vd/musl-cross-make/5e9e87f06fc3220e102c29d3413fbbffa456fcd6/patches/gcc-${version}/0008-darwin-aarch64-self-host-driver.patch";
+  sha256 = "sha256-XtykrPd5h/tsnjY1wGjzSOJ+AyyNLsfnjuOZ5Ryq9vA=";
+})
+
+
+## gcc 9.0 and older ##############################################################################
+
+++ optional (majorVersion == "9") ./9/fix-struct-redefinition-on-glibc-2.36.patch
+++ optional (atLeast7 && !atLeast10 && targetPlatform.isNetBSD) ./libstdc++-netbsd-ctypes.patch
+
+
+## gcc 8.0 and older ##############################################################################
+
+# for 49 this is applied later
+++ optional (atLeast49 && !is49 && !atLeast9) ./libsanitizer-no-cyclades-9.patch
+++ optional (is7 || is8) ./9/fix-struct-redefinition-on-glibc-2.36.patch
+
+
+## gcc 7.0 and older ##############################################################################
+
+++ optional (is7 && hostPlatform != buildPlatform) (fetchpatch { # XXX: Refine when this should be applied
+  url = "https://git.busybox.net/buildroot/plain/package/gcc/7.1.0/0900-remove-selftests.patch?id=11271540bfe6adafbc133caf6b5b902a816f5f02";
+  sha256 = "0mrvxsdwip2p3l17dscpc1x8vhdsciqw1z5q9i6p5g9yg1cqnmgs";
+})
+++ optionals (is7) [
+  # https://gcc.gnu.org/ml/gcc-patches/2018-02/msg00633.html
+  (./. + "/${majorVersion}/riscv-pthread-reentrant.patch")
+  # https://gcc.gnu.org/ml/gcc-patches/2018-03/msg00297.html
+  (./. + "/${majorVersion}/riscv-no-relax.patch")
+  # Fix for asan w/glibc-2.34. Although there's no upstream backport to v7,
+  # the patch from gcc 8 seems to work perfectly fine.
+  (./. + "/${majorVersion}/gcc8-asan-glibc-2.34.patch")
+  (./. + "/${majorVersion}/0001-Fix-build-for-glibc-2.31.patch")
+]
+++ optional ((is6 || is7) && targetPlatform.libc == "musl" && targetPlatform.isx86_32) (fetchpatch {
+  url = "https://git.alpinelinux.org/aports/plain/main/gcc/gcc-6.1-musl-libssp.patch?id=5e4b96e23871ee28ef593b439f8c07ca7c7eb5bb";
+  sha256 = "1jf1ciz4gr49lwyh8knfhw6l5gvfkwzjy90m7qiwkcbsf4a3fqn2";
+})
+++ optional ((is6 || is7 || is8) && !atLeast9 && targetPlatform.libc == "musl") ./libgomp-dont-force-initial-exec.patch
+
+
+
+## gcc 6.0 and older ##############################################################################
+
+++ optional (is6 && langGo) ./gogcc-workaround-glibc-2.36.patch
+++ optional (is49 || is6) ./9/fix-struct-redefinition-on-glibc-2.36.patch
+++ optional (is49 || (is6 && !stdenv.targetPlatform.isRedox)) ./use-source-date-epoch.patch
+++ optional (is6 && !stdenv.targetPlatform.isRedox) ./6/0001-Fix-build-for-glibc-2.31.patch
+++ optionals (is6 && langAda) [
+  ./gnat-cflags.patch
+  ./6/gnat-glibc234.patch
+]
+
+## gcc 4.9 and older ##############################################################################
+
+++ optional (!atLeast6) ./parallel-bconfig.patch
+++ optionals (is49) [
+  (./. + "/${lib.versions.major version}.${lib.versions.minor version}/parallel-strsignal.patch")
+  (./. + "/${lib.versions.major version}.${lib.versions.minor version}/libsanitizer.patch")
+  (fetchpatch {
+    name = "avoid-ustat-glibc-2.28.patch";
+    url = "https://gitweb.gentoo.org/proj/gcc-patches.git/plain/4.9.4/gentoo/100_all_avoid-ustat-glibc-2.28.patch?id=55fcb515620a8f7d3bb77eba938aa0fcf0d67c96";
+    sha256 = "0b32sb4psv5lq0ij9fwhi1b4pjbwdjnv24nqprsk14dsc6xmi1g0";
+  })
+  # has to be applied after "avoid-ustat-glibc-2.28.patch"
+  ./libsanitizer-no-cyclades-9.patch
+  # glibc-2.26
+  ./struct-ucontext.patch
+  ./struct-sigaltstack-4.9.patch
+]
 # Retpoline patches pulled from the branch hjl/indirect/gcc-4_9-branch (by H.J. Lu, the author of GCC upstream retpoline commits)
 ++ optionals is49
   (builtins.map ({commit, sha256}: fetchpatch {url = "https://github.com/hjl-tools/gcc/commit/${commit}.patch"; inherit sha256;})
@@ -206,7 +274,6 @@ optionals (is49 || is6) [
    { commit = "1e961ed49b18e176c7457f53df2433421387c23b"; sha256 = "04dnqqs4qsvz4g8cq6db5id41kzys7hzhcaycwmc9rpqygs2ajwz"; }
    { commit = "e137c72d099f9b3b47f4cc718aa11eab14df1a9c"; sha256 = "1ms0dmz74yf6kwgjfs4d2fhj8y6mcp2n184r3jk44wx2xc24vgb2"; }])
 
-++ optional (atLeast49 && !atLeast9) ./libsanitizer-no-cyclades-9.patch
 ++ optional (is49 && !atLeast6) [
   # gcc-11 compatibility
   (fetchpatch {
@@ -217,14 +284,11 @@ optionals (is49 || is6) [
   })
 ]
 
-# openjdk build fails without this on -march=opteron; is upstream in gcc12
-++ optionals (is11) [ ./11/gcc-issue-103910.patch ]
 
-++ optional (is10 && buildPlatform.system == "aarch64-darwin" && targetPlatform != buildPlatform) (fetchpatch {
-  url = "https://raw.githubusercontent.com/richard-vd/musl-cross-make/5e9e87f06fc3220e102c29d3413fbbffa456fcd6/patches/gcc-${version}/0008-darwin-aarch64-self-host-driver.patch";
-  sha256 = "sha256-XtykrPd5h/tsnjY1wGjzSOJ+AyyNLsfnjuOZ5Ryq9vA=";
-})
-++ lib.optionals is48 [
+## gcc 4.8 only ##############################################################################
+
+++ optional (!atLeast49 && hostPlatform.isDarwin) ./gfortran-darwin-NXConstStr.patch
+++ optionals is48 [
   (fetchpatch {
     name = "libc_name_p.diff"; # needed to build with gcc6
     url = "https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff_plain;h=ec1cc0263f1";
diff --git a/pkgs/development/compilers/llvm/10/bintools/default.nix b/pkgs/development/compilers/llvm/10/bintools/default.nix
deleted file mode 100644
index 38002439c205..000000000000
--- a/pkgs/development/compilers/llvm/10/bintools/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
index 6aed5d219a57..3702509d7756 100644
--- a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation {
   outputs = [ "out" "dev" ];
 
   patches = [
-    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    ../../common/compiler-rt/7-12-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./find-darwin-sdk-version.patch # don't test for macOS being >= 10.15
     ./gnu-install-dirs.patch
     ../../common/compiler-rt/libsanitizer-no-cyclades-11.patch
diff --git a/pkgs/development/compilers/llvm/10/default.nix b/pkgs/development/compilers/llvm/10/default.nix
index c1ea3a86342f..37c32e425c63 100644
--- a/pkgs/development/compilers/llvm/10/default.nix
+++ b/pkgs/development/compilers/llvm/10/default.nix
@@ -137,7 +137,7 @@ let
         ./lldb/procfs.patch
         ./lldb/gnu-install-dirs.patch
       ];
-      inherit llvm_meta release_version;
+      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -147,7 +147,7 @@ let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/10/libcxxabi/default.nix b/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
index d59191dfd724..c4eba56a6b81 100644
--- a/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
@@ -19,11 +19,11 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -d $(ls -d libcxx-*) -i ${../../libcxx-0001-musl-hacks.patch}
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d $(ls -d llvm-*) -i ${./wasm.patch}
+    patch -p1 -d $(ls -d llvm-*) -i ${../../common/libcxxabi/wasm.patch}
   '';
 
   patches = [
-    ./no-threads.patch
+    ../../common/libcxxabi/no-threads.patch
     ./gnu-install-dirs.patch
   ];
 
diff --git a/pkgs/development/compilers/llvm/11/bintools/default.nix b/pkgs/development/compilers/llvm/11/bintools/default.nix
deleted file mode 100644
index 38002439c205..000000000000
--- a/pkgs/development/compilers/llvm/11/bintools/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt/codesign.patch b/pkgs/development/compilers/llvm/11/compiler-rt/codesign.patch
deleted file mode 100644
index 3cc12b94b200..000000000000
--- a/pkgs/development/compilers/llvm/11/compiler-rt/codesign.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 3dec5f3475a26aeb4678627795c4b67c6b7b4785 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Tue, 19 Sep 2017 13:13:06 -0500
-Subject: [PATCH] remove codesign use on Apple, disable ios sim testing that
- needs it
-
----
- cmake/Modules/AddCompilerRT.cmake |  8 ------
- test/asan/CMakeLists.txt          | 52 ---------------------------------------
- test/tsan/CMakeLists.txt          | 47 -----------------------------------
- 3 files changed, 107 deletions(-)
-
-diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
-index bc5fb9ff7..b64eb4246 100644
---- a/cmake/Modules/AddCompilerRT.cmake
-+++ b/cmake/Modules/AddCompilerRT.cmake
-@@ -210,14 +210,6 @@ function(add_compiler_rt_runtime name type)
-         set_target_properties(${libname} PROPERTIES IMPORT_PREFIX "")
-         set_target_properties(${libname} PROPERTIES IMPORT_SUFFIX ".lib")
-       endif()
--      if(APPLE)
--        # Ad-hoc sign the dylibs
--        add_custom_command(TARGET ${libname}
--          POST_BUILD  
--          COMMAND codesign --sign - $<TARGET_FILE:${libname}>
--          WORKING_DIRECTORY ${COMPILER_RT_LIBRARY_OUTPUT_DIR}
--        )
--      endif()
-     endif()
-     install(TARGETS ${libname}
-       ARCHIVE DESTINATION ${COMPILER_RT_LIBRARY_INSTALL_DIR}
-2.14.1
-
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
index aaea3bf9e0d2..38dc7a0fbdc8 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
   outputs = [ "out" "dev" ];
 
   patches = [
-    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    ../../common/compiler-rt/7-12-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
     ./gnu-install-dirs.patch
     # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index acb649cdab0b..6ce7d86c835e 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -152,7 +152,7 @@ let
         ./lldb/procfs.patch
         ./lldb/gnu-install-dirs.patch
       ];
-      inherit llvm_meta release_version;
+      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -162,7 +162,7 @@ let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/11/libcxxabi/default.nix b/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
index 77f7e1411885..8a0a18f67822 100644
--- a/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
@@ -22,11 +22,11 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -d libcxx -i ${../../libcxx-0001-musl-hacks.patch}
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d llvm -i ${./wasm.patch}
+    patch -p1 -d llvm -i ${../../common/libcxxabi/wasm.patch}
   '';
 
   patches = [
-    ./no-threads.patch
+    ../../common/libcxxabi/no-threads.patch
     ./gnu-install-dirs.patch
   ];
 
diff --git a/pkgs/development/compilers/llvm/11/libcxxabi/no-threads.patch b/pkgs/development/compilers/llvm/11/libcxxabi/no-threads.patch
deleted file mode 100644
index 787f3e16500e..000000000000
--- a/pkgs/development/compilers/llvm/11/libcxxabi/no-threads.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 4138acf..41b4763 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -362,6 +362,7 @@ if (NOT LIBCXXABI_ENABLE_THREADS)
-                         " is also set to ON.")
-   endif()
-   add_definitions(-D_LIBCXXABI_HAS_NO_THREADS)
-+  add_definitions(-D_LIBCPP_HAS_NO_THREADS)
- endif()
- 
- if (LIBCXXABI_HAS_EXTERNAL_THREAD_API)
diff --git a/pkgs/development/compilers/llvm/11/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/11/libcxxabi/wasm.patch
deleted file mode 100644
index 4ebfe46aa813..000000000000
--- a/pkgs/development/compilers/llvm/11/libcxxabi/wasm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
-index 15497d405e0..33f7f18193a 100644
---- a/cmake/modules/HandleLLVMOptions.cmake
-+++ b/cmake/modules/HandleLLVMOptions.cmake
-@@ -127,7 +127,10 @@ else(WIN32)
-       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
-     endif()
-   else(FUCHSIA OR UNIX)
--    MESSAGE(SEND_ERROR "Unable to determine platform")
-+    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
-+    else()
-+      MESSAGE(SEND_ERROR "Unable to determine platform")
-+    endif()
-   endif(FUCHSIA OR UNIX)
- endif(WIN32)
- 
diff --git a/pkgs/development/compilers/llvm/12/bintools/default.nix b/pkgs/development/compilers/llvm/12/bintools/default.nix
deleted file mode 100644
index 38002439c205..000000000000
--- a/pkgs/development/compilers/llvm/12/bintools/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/12/compiler-rt/codesign.patch b/pkgs/development/compilers/llvm/12/compiler-rt/codesign.patch
deleted file mode 100644
index 3cc12b94b200..000000000000
--- a/pkgs/development/compilers/llvm/12/compiler-rt/codesign.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 3dec5f3475a26aeb4678627795c4b67c6b7b4785 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Tue, 19 Sep 2017 13:13:06 -0500
-Subject: [PATCH] remove codesign use on Apple, disable ios sim testing that
- needs it
-
----
- cmake/Modules/AddCompilerRT.cmake |  8 ------
- test/asan/CMakeLists.txt          | 52 ---------------------------------------
- test/tsan/CMakeLists.txt          | 47 -----------------------------------
- 3 files changed, 107 deletions(-)
-
-diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
-index bc5fb9ff7..b64eb4246 100644
---- a/cmake/Modules/AddCompilerRT.cmake
-+++ b/cmake/Modules/AddCompilerRT.cmake
-@@ -210,14 +210,6 @@ function(add_compiler_rt_runtime name type)
-         set_target_properties(${libname} PROPERTIES IMPORT_PREFIX "")
-         set_target_properties(${libname} PROPERTIES IMPORT_SUFFIX ".lib")
-       endif()
--      if(APPLE)
--        # Ad-hoc sign the dylibs
--        add_custom_command(TARGET ${libname}
--          POST_BUILD  
--          COMMAND codesign --sign - $<TARGET_FILE:${libname}>
--          WORKING_DIRECTORY ${COMPILER_RT_LIBRARY_OUTPUT_DIR}
--        )
--      endif()
-     endif()
-     install(TARGETS ${libname}
-       ARCHIVE DESTINATION ${COMPILER_RT_LIBRARY_INSTALL_DIR}
-2.14.1
-
diff --git a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
index 82c190fa0d64..02c20016bad0 100644
--- a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation {
   outputs = [ "out" "dev" ];
 
   patches = [
-    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    ../../common/compiler-rt/7-12-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
     ./gnu-install-dirs.patch
     # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
diff --git a/pkgs/development/compilers/llvm/12/default.nix b/pkgs/development/compilers/llvm/12/default.nix
index e390149f0dad..b976dd2ee67a 100644
--- a/pkgs/development/compilers/llvm/12/default.nix
+++ b/pkgs/development/compilers/llvm/12/default.nix
@@ -139,19 +139,20 @@ let
       src = fetch "lldb" "0g3pj1m3chafavpr35r9fynm85y2hdyla6klj0h28khxs2613i78";
       patches =
         let
-          resourceDirPatch = callPackage ({ runCommand, libclang }: (runCommand "resource-dir.patch"
-            {
-              clangLibDir = "${libclang.lib}/lib";
-            } ''
-            substitute '${./lldb/resource-dir.patch}' "$out" --subst-var clangLibDir
-          '')) { };
+          resourceDirPatch = callPackage
+            ({ substituteAll, libclang }: substituteAll
+              {
+                src = ./lldb/resource-dir.patch;
+                clangLibDir = "${libclang.lib}/lib";
+              })
+            { };
         in
         [
           ./lldb/procfs.patch
           resourceDirPatch
           ./lldb/gnu-install-dirs.patch
         ];
-      inherit llvm_meta release_version;
+      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -161,7 +162,7 @@ let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/12/libcxxabi/default.nix b/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
index bab39a5272c8..78a4a68d6a16 100644
--- a/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -d libcxx -i ${../../libcxx-0001-musl-hacks.patch}
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d llvm -i ${./wasm.patch}
+    patch -p1 -d llvm -i ${../../common/libcxxabi/wasm.patch}
   '';
 
   patches = [
diff --git a/pkgs/development/compilers/llvm/12/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/12/libcxxabi/wasm.patch
deleted file mode 100644
index 4ebfe46aa813..000000000000
--- a/pkgs/development/compilers/llvm/12/libcxxabi/wasm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
-index 15497d405e0..33f7f18193a 100644
---- a/cmake/modules/HandleLLVMOptions.cmake
-+++ b/cmake/modules/HandleLLVMOptions.cmake
-@@ -127,7 +127,10 @@ else(WIN32)
-       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
-     endif()
-   else(FUCHSIA OR UNIX)
--    MESSAGE(SEND_ERROR "Unable to determine platform")
-+    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
-+    else()
-+      MESSAGE(SEND_ERROR "Unable to determine platform")
-+    endif()
-   endif(FUCHSIA OR UNIX)
- endif(WIN32)
- 
diff --git a/pkgs/development/compilers/llvm/13/bintools/default.nix b/pkgs/development/compilers/llvm/13/bintools/default.nix
deleted file mode 100644
index b69f4bd12917..000000000000
--- a/pkgs/development/compilers/llvm/13/bintools/default.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-rc $out/bin/${prefix}windres
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/13/default.nix b/pkgs/development/compilers/llvm/13/default.nix
index 0432dcd14316..3cf7cd711ebe 100644
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@@ -138,12 +138,13 @@ let
     lldb = callPackage ../common/lldb.nix {
       patches =
         let
-          resourceDirPatch = callPackage ({ runCommand, libclang }: (runCommand "resource-dir.patch"
-            {
-              clangLibDir = "${libclang.lib}/lib";
-            } ''
-            substitute '${./lldb/resource-dir.patch}' "$out" --subst-var clangLibDir
-          '')) { };
+          resourceDirPatch = callPackage
+            ({ substituteAll, libclang }: substituteAll
+              {
+                src = ./lldb/resource-dir.patch;
+                clangLibDir = "${libclang.lib}/lib";
+              })
+            { };
         in
         [
           ./lldb/procfs.patch
@@ -164,7 +165,7 @@ let
             && !stdenv.targetPlatform.isAarch64
             && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
         ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-      inherit llvm_meta release_version;
+      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -174,7 +175,7 @@ let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/13/libcxxabi/default.nix b/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
index b1b57b3050ad..50f09831e974 100644
--- a/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   postUnpack = lib.optionalString stdenv.isDarwin ''
     export TRIPLE=x86_64-apple-darwin
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d llvm -i ${./wasm.patch}
+    patch -p1 -d llvm -i ${../../common/libcxxabi/wasm.patch}
   '';
 
   patches = [
diff --git a/pkgs/development/compilers/llvm/13/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/13/libcxxabi/wasm.patch
deleted file mode 100644
index 4ebfe46aa813..000000000000
--- a/pkgs/development/compilers/llvm/13/libcxxabi/wasm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
-index 15497d405e0..33f7f18193a 100644
---- a/cmake/modules/HandleLLVMOptions.cmake
-+++ b/cmake/modules/HandleLLVMOptions.cmake
-@@ -127,7 +127,10 @@ else(WIN32)
-       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
-     endif()
-   else(FUCHSIA OR UNIX)
--    MESSAGE(SEND_ERROR "Unable to determine platform")
-+    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
-+    else()
-+      MESSAGE(SEND_ERROR "Unable to determine platform")
-+    endif()
-   endif(FUCHSIA OR UNIX)
- endif(WIN32)
- 
diff --git a/pkgs/development/compilers/llvm/14/bintools/default.nix b/pkgs/development/compilers/llvm/14/bintools/default.nix
deleted file mode 100644
index b69f4bd12917..000000000000
--- a/pkgs/development/compilers/llvm/14/bintools/default.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-rc $out/bin/${prefix}windres
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/14/default.nix b/pkgs/development/compilers/llvm/14/default.nix
index 75a52b609605..b9a74e0f070a 100644
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ b/pkgs/development/compilers/llvm/14/default.nix
@@ -139,12 +139,13 @@ let
     lldb = callPackage ../common/lldb.nix {
       patches =
         let
-          resourceDirPatch = callPackage ({ runCommand, libclang }: (runCommand "resource-dir.patch"
-            {
-              clangLibDir = "${libclang.lib}/lib";
-            } ''
-            substitute '${./lldb/resource-dir.patch}' "$out" --subst-var clangLibDir
-          '')) { };
+          resourceDirPatch = callPackage
+            ({ substituteAll, libclang }: substituteAll
+              {
+                src = ./lldb/resource-dir.patch;
+                clangLibDir = "${libclang.lib}/lib";
+              })
+            { };
         in
         [
           ./lldb/procfs.patch
@@ -165,7 +166,7 @@ let
             && !stdenv.targetPlatform.isAarch64
             && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
         ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-      inherit llvm_meta release_version;
+      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -175,7 +176,7 @@ let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/14/libcxxabi/default.nix b/pkgs/development/compilers/llvm/14/libcxxabi/default.nix
index 30cc34a8c0e6..0f7cec3695d6 100644
--- a/pkgs/development/compilers/llvm/14/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/14/libcxxabi/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   postUnpack = lib.optionalString stdenv.isDarwin ''
     export TRIPLE=x86_64-apple-darwin
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d llvm -i ${./wasm.patch}
+    patch -p1 -d llvm -i ${../../common/libcxxabi/wasm.patch}
   '';
 
   patches = [
diff --git a/pkgs/development/compilers/llvm/14/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/14/libcxxabi/wasm.patch
deleted file mode 100644
index 4ebfe46aa813..000000000000
--- a/pkgs/development/compilers/llvm/14/libcxxabi/wasm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
-index 15497d405e0..33f7f18193a 100644
---- a/cmake/modules/HandleLLVMOptions.cmake
-+++ b/cmake/modules/HandleLLVMOptions.cmake
-@@ -127,7 +127,10 @@ else(WIN32)
-       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
-     endif()
-   else(FUCHSIA OR UNIX)
--    MESSAGE(SEND_ERROR "Unable to determine platform")
-+    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
-+    else()
-+      MESSAGE(SEND_ERROR "Unable to determine platform")
-+    endif()
-   endif(FUCHSIA OR UNIX)
- endif(WIN32)
- 
diff --git a/pkgs/development/compilers/llvm/15/bintools/default.nix b/pkgs/development/compilers/llvm/15/bintools/default.nix
deleted file mode 100644
index c7b20dd28e23..000000000000
--- a/pkgs/development/compilers/llvm/15/bintools/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-debuginfod $out/bin/${prefix}debuginfod
-   ln -s ${llvm}/bin/llvm-debuginfod-find $out/bin/${prefix}debuginfod-find
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-rc $out/bin/${prefix}windres
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/15/default.nix b/pkgs/development/compilers/llvm/15/default.nix
index f244987353b9..863d31874ec8 100644
--- a/pkgs/development/compilers/llvm/15/default.nix
+++ b/pkgs/development/compilers/llvm/15/default.nix
@@ -187,12 +187,13 @@ in let
     lldb = callPackage ../common/lldb.nix {
       patches =
         let
-          resourceDirPatch = callPackage ({ runCommand, libclang }: (runCommand "resource-dir.patch"
-            {
-              clangLibDir = "${libclang.lib}/lib";
-            } ''
-            substitute '${./lldb/resource-dir.patch}' "$out" --subst-var clangLibDir
-          '')) { };
+          resourceDirPatch = callPackage
+            ({ substituteAll, libclang }: substituteAll
+              {
+                src = ./lldb/resource-dir.patch;
+                clangLibDir = "${libclang.lib}/lib";
+              })
+            { };
         in
         [
           ./lldb/procfs.patch
@@ -213,7 +214,7 @@ in let
             && !stdenv.targetPlatform.isAarch64
             && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
         ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-      inherit llvm_meta release_version;
+      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -223,7 +224,7 @@ in let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/15/libcxxabi/default.nix b/pkgs/development/compilers/llvm/15/libcxxabi/default.nix
index 77ba2d2d008a..04bfee14aa18 100644
--- a/pkgs/development/compilers/llvm/15/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/15/libcxxabi/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   postUnpack = lib.optionalString stdenv.isDarwin ''
     export TRIPLE=x86_64-apple-darwin
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d llvm -i ${./wasm.patch}
+    patch -p1 -d llvm -i ${../../common/libcxxabi/wasm.patch}
   '';
 
   prePatch = ''
diff --git a/pkgs/development/compilers/llvm/15/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/15/libcxxabi/wasm.patch
deleted file mode 100644
index 4ebfe46aa813..000000000000
--- a/pkgs/development/compilers/llvm/15/libcxxabi/wasm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
-index 15497d405e0..33f7f18193a 100644
---- a/cmake/modules/HandleLLVMOptions.cmake
-+++ b/cmake/modules/HandleLLVMOptions.cmake
-@@ -127,7 +127,10 @@ else(WIN32)
-       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
-     endif()
-   else(FUCHSIA OR UNIX)
--    MESSAGE(SEND_ERROR "Unable to determine platform")
-+    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
-+    else()
-+      MESSAGE(SEND_ERROR "Unable to determine platform")
-+    endif()
-   endif(FUCHSIA OR UNIX)
- endif(WIN32)
- 
diff --git a/pkgs/development/compilers/llvm/16/bintools/default.nix b/pkgs/development/compilers/llvm/16/bintools/default.nix
deleted file mode 100644
index c7b20dd28e23..000000000000
--- a/pkgs/development/compilers/llvm/16/bintools/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-debuginfod $out/bin/${prefix}debuginfod
-   ln -s ${llvm}/bin/llvm-debuginfod-find $out/bin/${prefix}debuginfod-find
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-rc $out/bin/${prefix}windres
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/16/default.nix b/pkgs/development/compilers/llvm/16/default.nix
index 94d0e7d30b58..9dbe65ed68da 100644
--- a/pkgs/development/compilers/llvm/16/default.nix
+++ b/pkgs/development/compilers/llvm/16/default.nix
@@ -192,12 +192,13 @@ in let
       '') { };
       patches =
         let
-          resourceDirPatch = callPackage ({ runCommand, libclang }: (runCommand "resource-dir.patch"
-            {
-              clangLibDir = "${libclang.lib}/lib";
-            } ''
-            substitute '${./lldb/resource-dir.patch}' "$out" --subst-var clangLibDir
-          '')) { };
+          resourceDirPatch = callPackage
+            ({ substituteAll, libclang }: substituteAll
+              {
+                src = ./lldb/resource-dir.patch;
+                clangLibDir = "${libclang.lib}/lib";
+              })
+            { };
         in
         [
           # FIXME: do we need this? ./procfs.patch
@@ -218,7 +219,7 @@ in let
             && !stdenv.targetPlatform.isAarch64
             && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
         ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-      inherit llvm_meta release_version;
+      inherit llvm_meta;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -228,7 +229,7 @@ in let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/16/libcxxabi/default.nix b/pkgs/development/compilers/llvm/16/libcxxabi/default.nix
index 77ba2d2d008a..04bfee14aa18 100644
--- a/pkgs/development/compilers/llvm/16/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/16/libcxxabi/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   postUnpack = lib.optionalString stdenv.isDarwin ''
     export TRIPLE=x86_64-apple-darwin
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d llvm -i ${./wasm.patch}
+    patch -p1 -d llvm -i ${../../common/libcxxabi/wasm.patch}
   '';
 
   prePatch = ''
diff --git a/pkgs/development/compilers/llvm/16/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/16/libcxxabi/wasm.patch
deleted file mode 100644
index 4ebfe46aa813..000000000000
--- a/pkgs/development/compilers/llvm/16/libcxxabi/wasm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
-index 15497d405e0..33f7f18193a 100644
---- a/cmake/modules/HandleLLVMOptions.cmake
-+++ b/cmake/modules/HandleLLVMOptions.cmake
-@@ -127,7 +127,10 @@ else(WIN32)
-       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
-     endif()
-   else(FUCHSIA OR UNIX)
--    MESSAGE(SEND_ERROR "Unable to determine platform")
-+    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
-+    else()
-+      MESSAGE(SEND_ERROR "Unable to determine platform")
-+    endif()
-   endif(FUCHSIA OR UNIX)
- endif(WIN32)
- 
diff --git a/pkgs/development/compilers/llvm/5/clang/default.nix b/pkgs/development/compilers/llvm/5/clang/default.nix
index 6e968a6bd2a6..70ffb3e0dd19 100644
--- a/pkgs/development/compilers/llvm/5/clang/default.nix
+++ b/pkgs/development/compilers/llvm/5/clang/default.nix
@@ -41,7 +41,7 @@ let
     ];
 
     patches = [
-      ./purity.patch
+      ../../common/clang/5-8-purity.patch
       ./gnu-install-dirs.patch
       (substituteAll {
         src = ./LLVMgold-path.patch;
diff --git a/pkgs/development/compilers/llvm/6/clang/default.nix b/pkgs/development/compilers/llvm/6/clang/default.nix
index baf601ffbfc2..bc69f1c99cf4 100644
--- a/pkgs/development/compilers/llvm/6/clang/default.nix
+++ b/pkgs/development/compilers/llvm/6/clang/default.nix
@@ -41,7 +41,7 @@ let
     ];
 
     patches = [
-      ./purity.patch
+      ../../common/clang/5-8-purity.patch
       ./gnu-install-dirs.patch
       (substituteAll {
         src = ../../clang-6-10-LLVMgold-path.patch;
diff --git a/pkgs/development/compilers/llvm/6/clang/purity.patch b/pkgs/development/compilers/llvm/6/clang/purity.patch
deleted file mode 100644
index b30d0d0b5d5b..000000000000
--- a/pkgs/development/compilers/llvm/6/clang/purity.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 4add81bba40dcec62c4ea4481be8e35ac53e89d8 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Thu, 18 May 2017 11:56:12 -0500
-Subject: [PATCH] "purity" patch for 5.0
-
----
- lib/Driver/ToolChains/Gnu.cpp | 7 -------
- 1 file changed, 7 deletions(-)
-
-diff --git a/lib/Driver/ToolChains/Gnu.cpp b/lib/Driver/ToolChains/Gnu.cpp
-index fe3c0191bb..c6a482bece 100644
---- a/lib/Driver/ToolChains/Gnu.cpp
-+++ b/lib/Driver/ToolChains/Gnu.cpp
-@@ -494,13 +494,6 @@ void tools::gnutools::Linker::ConstructJob(Compilation &C, const JobAction &JA,
-   if (!Args.hasArg(options::OPT_static)) {
-     if (Args.hasArg(options::OPT_rdynamic))
-       CmdArgs.push_back("-export-dynamic");
--
--    if (!Args.hasArg(options::OPT_shared)) {
--      const std::string Loader =
--          D.DyldPrefix + ToolChain.getDynamicLinker(Args);
--      CmdArgs.push_back("-dynamic-linker");
--      CmdArgs.push_back(Args.MakeArgString(Loader));
--    }
-   }
- 
-   CmdArgs.push_back("-o");
--- 
-2.11.0
-
diff --git a/pkgs/development/compilers/llvm/7/bintools/default.nix b/pkgs/development/compilers/llvm/7/bintools/default.nix
deleted file mode 100644
index 38002439c205..000000000000
--- a/pkgs/development/compilers/llvm/7/bintools/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/7/clang/default.nix b/pkgs/development/compilers/llvm/7/clang/default.nix
index c3f2bcb73ffe..136a69e72161 100644
--- a/pkgs/development/compilers/llvm/7/clang/default.nix
+++ b/pkgs/development/compilers/llvm/7/clang/default.nix
@@ -45,7 +45,7 @@ let
     ];
 
     patches = [
-      ./purity.patch
+      ../../common/clang/5-8-purity.patch
       # make clang -xhip use $PATH to find executables
       ./HIP-use-PATH-7.patch
       # Backport for the `--unwindlib=[libgcc|compiler-rt]` flag, which is
diff --git a/pkgs/development/compilers/llvm/7/clang/purity.patch b/pkgs/development/compilers/llvm/7/clang/purity.patch
deleted file mode 100644
index b30d0d0b5d5b..000000000000
--- a/pkgs/development/compilers/llvm/7/clang/purity.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 4add81bba40dcec62c4ea4481be8e35ac53e89d8 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Thu, 18 May 2017 11:56:12 -0500
-Subject: [PATCH] "purity" patch for 5.0
-
----
- lib/Driver/ToolChains/Gnu.cpp | 7 -------
- 1 file changed, 7 deletions(-)
-
-diff --git a/lib/Driver/ToolChains/Gnu.cpp b/lib/Driver/ToolChains/Gnu.cpp
-index fe3c0191bb..c6a482bece 100644
---- a/lib/Driver/ToolChains/Gnu.cpp
-+++ b/lib/Driver/ToolChains/Gnu.cpp
-@@ -494,13 +494,6 @@ void tools::gnutools::Linker::ConstructJob(Compilation &C, const JobAction &JA,
-   if (!Args.hasArg(options::OPT_static)) {
-     if (Args.hasArg(options::OPT_rdynamic))
-       CmdArgs.push_back("-export-dynamic");
--
--    if (!Args.hasArg(options::OPT_shared)) {
--      const std::string Loader =
--          D.DyldPrefix + ToolChain.getDynamicLinker(Args);
--      CmdArgs.push_back("-dynamic-linker");
--      CmdArgs.push_back(Args.MakeArgString(Loader));
--    }
-   }
- 
-   CmdArgs.push_back("-o");
--- 
-2.11.0
-
diff --git a/pkgs/development/compilers/llvm/7/compiler-rt/codesign.patch b/pkgs/development/compilers/llvm/7/compiler-rt/codesign.patch
deleted file mode 100644
index 3cc12b94b200..000000000000
--- a/pkgs/development/compilers/llvm/7/compiler-rt/codesign.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 3dec5f3475a26aeb4678627795c4b67c6b7b4785 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Tue, 19 Sep 2017 13:13:06 -0500
-Subject: [PATCH] remove codesign use on Apple, disable ios sim testing that
- needs it
-
----
- cmake/Modules/AddCompilerRT.cmake |  8 ------
- test/asan/CMakeLists.txt          | 52 ---------------------------------------
- test/tsan/CMakeLists.txt          | 47 -----------------------------------
- 3 files changed, 107 deletions(-)
-
-diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
-index bc5fb9ff7..b64eb4246 100644
---- a/cmake/Modules/AddCompilerRT.cmake
-+++ b/cmake/Modules/AddCompilerRT.cmake
-@@ -210,14 +210,6 @@ function(add_compiler_rt_runtime name type)
-         set_target_properties(${libname} PROPERTIES IMPORT_PREFIX "")
-         set_target_properties(${libname} PROPERTIES IMPORT_SUFFIX ".lib")
-       endif()
--      if(APPLE)
--        # Ad-hoc sign the dylibs
--        add_custom_command(TARGET ${libname}
--          POST_BUILD  
--          COMMAND codesign --sign - $<TARGET_FILE:${libname}>
--          WORKING_DIRECTORY ${COMPILER_RT_LIBRARY_OUTPUT_DIR}
--        )
--      endif()
-     endif()
-     install(TARGETS ${libname}
-       ARCHIVE DESTINATION ${COMPILER_RT_LIBRARY_INSTALL_DIR}
-2.14.1
-
diff --git a/pkgs/development/compilers/llvm/7/compiler-rt/default.nix b/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
index a644229ff07c..7354397d2bf0 100644
--- a/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
   patches = [
     # https://github.com/llvm/llvm-project/commit/947f9692440836dcb8d88b74b69dd379d85974ce
     ../../common/compiler-rt/glibc.patch
-    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    ../../common/compiler-rt/7-12-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./gnu-install-dirs.patch
     ../../common/compiler-rt/libsanitizer-no-cyclades-9.patch
   ] ++ lib.optional (useLLVM) ./crtbegin-and-end.patch
diff --git a/pkgs/development/compilers/llvm/7/default.nix b/pkgs/development/compilers/llvm/7/default.nix
index 5c20086ce846..0607b5ebf42c 100644
--- a/pkgs/development/compilers/llvm/7/default.nix
+++ b/pkgs/development/compilers/llvm/7/default.nix
@@ -149,7 +149,7 @@ let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/8/bintools/default.nix b/pkgs/development/compilers/llvm/8/bintools/default.nix
deleted file mode 100644
index 38002439c205..000000000000
--- a/pkgs/development/compilers/llvm/8/bintools/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/8/clang/default.nix b/pkgs/development/compilers/llvm/8/clang/default.nix
index 0d0af5ab6aa6..994f9bd967c4 100644
--- a/pkgs/development/compilers/llvm/8/clang/default.nix
+++ b/pkgs/development/compilers/llvm/8/clang/default.nix
@@ -45,7 +45,7 @@ let
     ];
 
     patches = [
-      ./purity.patch
+      ../../common/clang/5-8-purity.patch
       ./xpc.patch
       # Backport for -static-pie, which the latter touches, and which is nice in
       # its own right.
diff --git a/pkgs/development/compilers/llvm/8/clang/purity.patch b/pkgs/development/compilers/llvm/8/clang/purity.patch
deleted file mode 100644
index b30d0d0b5d5b..000000000000
--- a/pkgs/development/compilers/llvm/8/clang/purity.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 4add81bba40dcec62c4ea4481be8e35ac53e89d8 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Thu, 18 May 2017 11:56:12 -0500
-Subject: [PATCH] "purity" patch for 5.0
-
----
- lib/Driver/ToolChains/Gnu.cpp | 7 -------
- 1 file changed, 7 deletions(-)
-
-diff --git a/lib/Driver/ToolChains/Gnu.cpp b/lib/Driver/ToolChains/Gnu.cpp
-index fe3c0191bb..c6a482bece 100644
---- a/lib/Driver/ToolChains/Gnu.cpp
-+++ b/lib/Driver/ToolChains/Gnu.cpp
-@@ -494,13 +494,6 @@ void tools::gnutools::Linker::ConstructJob(Compilation &C, const JobAction &JA,
-   if (!Args.hasArg(options::OPT_static)) {
-     if (Args.hasArg(options::OPT_rdynamic))
-       CmdArgs.push_back("-export-dynamic");
--
--    if (!Args.hasArg(options::OPT_shared)) {
--      const std::string Loader =
--          D.DyldPrefix + ToolChain.getDynamicLinker(Args);
--      CmdArgs.push_back("-dynamic-linker");
--      CmdArgs.push_back(Args.MakeArgString(Loader));
--    }
-   }
- 
-   CmdArgs.push_back("-o");
--- 
-2.11.0
-
diff --git a/pkgs/development/compilers/llvm/8/compiler-rt/codesign.patch b/pkgs/development/compilers/llvm/8/compiler-rt/codesign.patch
deleted file mode 100644
index 3cc12b94b200..000000000000
--- a/pkgs/development/compilers/llvm/8/compiler-rt/codesign.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 3dec5f3475a26aeb4678627795c4b67c6b7b4785 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Tue, 19 Sep 2017 13:13:06 -0500
-Subject: [PATCH] remove codesign use on Apple, disable ios sim testing that
- needs it
-
----
- cmake/Modules/AddCompilerRT.cmake |  8 ------
- test/asan/CMakeLists.txt          | 52 ---------------------------------------
- test/tsan/CMakeLists.txt          | 47 -----------------------------------
- 3 files changed, 107 deletions(-)
-
-diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
-index bc5fb9ff7..b64eb4246 100644
---- a/cmake/Modules/AddCompilerRT.cmake
-+++ b/cmake/Modules/AddCompilerRT.cmake
-@@ -210,14 +210,6 @@ function(add_compiler_rt_runtime name type)
-         set_target_properties(${libname} PROPERTIES IMPORT_PREFIX "")
-         set_target_properties(${libname} PROPERTIES IMPORT_SUFFIX ".lib")
-       endif()
--      if(APPLE)
--        # Ad-hoc sign the dylibs
--        add_custom_command(TARGET ${libname}
--          POST_BUILD  
--          COMMAND codesign --sign - $<TARGET_FILE:${libname}>
--          WORKING_DIRECTORY ${COMPILER_RT_LIBRARY_OUTPUT_DIR}
--        )
--      endif()
-     endif()
-     install(TARGETS ${libname}
-       ARCHIVE DESTINATION ${COMPILER_RT_LIBRARY_INSTALL_DIR}
-2.14.1
-
diff --git a/pkgs/development/compilers/llvm/8/compiler-rt/default.nix b/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
index 80f70ac64a0f..26cb5aa30617 100644
--- a/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
   patches = [
     # https://github.com/llvm/llvm-project/commit/947f9692440836dcb8d88b74b69dd379d85974ce
     ../../common/compiler-rt/glibc.patch
-    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    ../../common/compiler-rt/7-12-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./gnu-install-dirs.patch
     ../../common/compiler-rt/libsanitizer-no-cyclades-9.patch
   ] ++ lib.optional (useLLVM) ./crtbegin-and-end.patch
diff --git a/pkgs/development/compilers/llvm/8/default.nix b/pkgs/development/compilers/llvm/8/default.nix
index c24c84754e32..5beb8afb2ee9 100644
--- a/pkgs/development/compilers/llvm/8/default.nix
+++ b/pkgs/development/compilers/llvm/8/default.nix
@@ -150,7 +150,7 @@ let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/8/libcxxabi/default.nix b/pkgs/development/compilers/llvm/8/libcxxabi/default.nix
index ebf8a5c702ee..885d85b8c3e7 100644
--- a/pkgs/development/compilers/llvm/8/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/8/libcxxabi/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
   '';
 
   patches = [
-    ./no-threads.patch
+    ../../common/libcxxabi/no-threads.patch
     ./gnu-install-dirs.patch
   ];
 
diff --git a/pkgs/development/compilers/llvm/8/libcxxabi/no-threads.patch b/pkgs/development/compilers/llvm/8/libcxxabi/no-threads.patch
deleted file mode 100644
index 787f3e16500e..000000000000
--- a/pkgs/development/compilers/llvm/8/libcxxabi/no-threads.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 4138acf..41b4763 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -362,6 +362,7 @@ if (NOT LIBCXXABI_ENABLE_THREADS)
-                         " is also set to ON.")
-   endif()
-   add_definitions(-D_LIBCXXABI_HAS_NO_THREADS)
-+  add_definitions(-D_LIBCPP_HAS_NO_THREADS)
- endif()
- 
- if (LIBCXXABI_HAS_EXTERNAL_THREAD_API)
diff --git a/pkgs/development/compilers/llvm/8/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/8/libcxxabi/wasm.patch
deleted file mode 100644
index 4ebfe46aa813..000000000000
--- a/pkgs/development/compilers/llvm/8/libcxxabi/wasm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
-index 15497d405e0..33f7f18193a 100644
---- a/cmake/modules/HandleLLVMOptions.cmake
-+++ b/cmake/modules/HandleLLVMOptions.cmake
-@@ -127,7 +127,10 @@ else(WIN32)
-       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
-     endif()
-   else(FUCHSIA OR UNIX)
--    MESSAGE(SEND_ERROR "Unable to determine platform")
-+    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
-+    else()
-+      MESSAGE(SEND_ERROR "Unable to determine platform")
-+    endif()
-   endif(FUCHSIA OR UNIX)
- endif(WIN32)
- 
diff --git a/pkgs/development/compilers/llvm/9/bintools/default.nix b/pkgs/development/compilers/llvm/9/bintools/default.nix
deleted file mode 100644
index 38002439c205..000000000000
--- a/pkgs/development/compilers/llvm/9/bintools/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/9/compiler-rt/codesign.patch b/pkgs/development/compilers/llvm/9/compiler-rt/codesign.patch
deleted file mode 100644
index 3cc12b94b200..000000000000
--- a/pkgs/development/compilers/llvm/9/compiler-rt/codesign.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 3dec5f3475a26aeb4678627795c4b67c6b7b4785 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Tue, 19 Sep 2017 13:13:06 -0500
-Subject: [PATCH] remove codesign use on Apple, disable ios sim testing that
- needs it
-
----
- cmake/Modules/AddCompilerRT.cmake |  8 ------
- test/asan/CMakeLists.txt          | 52 ---------------------------------------
- test/tsan/CMakeLists.txt          | 47 -----------------------------------
- 3 files changed, 107 deletions(-)
-
-diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
-index bc5fb9ff7..b64eb4246 100644
---- a/cmake/Modules/AddCompilerRT.cmake
-+++ b/cmake/Modules/AddCompilerRT.cmake
-@@ -210,14 +210,6 @@ function(add_compiler_rt_runtime name type)
-         set_target_properties(${libname} PROPERTIES IMPORT_PREFIX "")
-         set_target_properties(${libname} PROPERTIES IMPORT_SUFFIX ".lib")
-       endif()
--      if(APPLE)
--        # Ad-hoc sign the dylibs
--        add_custom_command(TARGET ${libname}
--          POST_BUILD  
--          COMMAND codesign --sign - $<TARGET_FILE:${libname}>
--          WORKING_DIRECTORY ${COMPILER_RT_LIBRARY_OUTPUT_DIR}
--        )
--      endif()
-     endif()
-     install(TARGETS ${libname}
-       ARCHIVE DESTINATION ${COMPILER_RT_LIBRARY_INSTALL_DIR}
-2.14.1
-
diff --git a/pkgs/development/compilers/llvm/9/compiler-rt/default.nix b/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
index 0398b126ab58..d03fcbc7f708 100644
--- a/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
   patches = [
     # https://github.com/llvm/llvm-project/commit/947f9692440836dcb8d88b74b69dd379d85974ce
     ../../common/compiler-rt/glibc.patch
-    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    ../../common/compiler-rt/7-12-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./gnu-install-dirs.patch
     ../../common/compiler-rt/libsanitizer-no-cyclades-9.patch
     # Fix build on armv6l
diff --git a/pkgs/development/compilers/llvm/9/default.nix b/pkgs/development/compilers/llvm/9/default.nix
index 4ec802a4f289..9f79dc5cce7f 100644
--- a/pkgs/development/compilers/llvm/9/default.nix
+++ b/pkgs/development/compilers/llvm/9/default.nix
@@ -150,7 +150,7 @@ let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/9/libcxxabi/default.nix b/pkgs/development/compilers/llvm/9/libcxxabi/default.nix
index f19bfb157ce9..24d89b1a2da5 100644
--- a/pkgs/development/compilers/llvm/9/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/9/libcxxabi/default.nix
@@ -19,11 +19,11 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -d $(ls -d libcxx-*) -i ${../../libcxx-0001-musl-hacks.patch}
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d $(ls -d llvm-*) -i ${./wasm.patch}
+    patch -p1 -d $(ls -d llvm-*) -i ${../../common/libcxxabi/wasm.patch}
   '';
 
   patches = [
-    ./no-threads.patch
+    ../../common/libcxxabi/no-threads.patch
     ./gnu-install-dirs.patch
   ];
 
diff --git a/pkgs/development/compilers/llvm/9/libcxxabi/no-threads.patch b/pkgs/development/compilers/llvm/9/libcxxabi/no-threads.patch
deleted file mode 100644
index 787f3e16500e..000000000000
--- a/pkgs/development/compilers/llvm/9/libcxxabi/no-threads.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 4138acf..41b4763 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -362,6 +362,7 @@ if (NOT LIBCXXABI_ENABLE_THREADS)
-                         " is also set to ON.")
-   endif()
-   add_definitions(-D_LIBCXXABI_HAS_NO_THREADS)
-+  add_definitions(-D_LIBCPP_HAS_NO_THREADS)
- endif()
- 
- if (LIBCXXABI_HAS_EXTERNAL_THREAD_API)
diff --git a/pkgs/development/compilers/llvm/9/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/9/libcxxabi/wasm.patch
deleted file mode 100644
index 4ebfe46aa813..000000000000
--- a/pkgs/development/compilers/llvm/9/libcxxabi/wasm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
-index 15497d405e0..33f7f18193a 100644
---- a/cmake/modules/HandleLLVMOptions.cmake
-+++ b/cmake/modules/HandleLLVMOptions.cmake
-@@ -127,7 +127,10 @@ else(WIN32)
-       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
-     endif()
-   else(FUCHSIA OR UNIX)
--    MESSAGE(SEND_ERROR "Unable to determine platform")
-+    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
-+    else()
-+      MESSAGE(SEND_ERROR "Unable to determine platform")
-+    endif()
-   endif(FUCHSIA OR UNIX)
- endif(WIN32)
- 
diff --git a/pkgs/development/compilers/llvm/common/bintools.nix b/pkgs/development/compilers/llvm/common/bintools.nix
new file mode 100644
index 000000000000..a60060e86891
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common/bintools.nix
@@ -0,0 +1,48 @@
+{ lib, runCommand, stdenv, llvm, lld, version, release_version }:
+
+let
+  targetPrefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
+in
+runCommand "llvm-binutils-${version}"
+{
+  preferLocalBuild = true;
+  passthru = {
+    isLLVM = true;
+  };
+}
+  (''
+    mkdir -p $out/bin
+    for prog in ${lld}/bin/*; do
+      ln -s $prog $out/bin/${targetPrefix}$(basename $prog)
+    done
+    for prog in ${llvm}/bin/*; do
+      ln -sf $prog $out/bin/${targetPrefix}$(basename $prog)
+    done
+
+    llvmBin="${llvm}/bin"
+
+    ln -s $llvmBin/llvm-ar $out/bin/${targetPrefix}ar
+    ln -s $llvmBin/llvm-ar $out/bin/${targetPrefix}dlltool
+    ln -s $llvmBin/llvm-ar $out/bin/${targetPrefix}ranlib
+    ln -s $llvmBin/llvm-cxxfilt $out/bin/${targetPrefix}c++filt
+    ln -s $llvmBin/llvm-dwp $out/bin/${targetPrefix}dwp
+    ln -s $llvmBin/llvm-nm $out/bin/${targetPrefix}nm
+    ln -s $llvmBin/llvm-objcopy $out/bin/${targetPrefix}objcopy
+    ln -s $llvmBin/llvm-objcopy $out/bin/${targetPrefix}strip
+    ln -s $llvmBin/llvm-objdump $out/bin/${targetPrefix}objdump
+    ln -s $llvmBin/llvm-readobj $out/bin/${targetPrefix}readelf
+    ln -s $llvmBin/llvm-size $out/bin/${targetPrefix}size
+    ln -s $llvmBin/llvm-strings $out/bin/${targetPrefix}strings
+    ln -s $llvmBin/llvm-symbolizer $out/bin/${targetPrefix}addr2line
+
+    if [ -e "$llvmBin/llvm-debuginfod" ]; then
+      ln -s $llvmBin/llvm-debuginfod $out/bin/${targetPrefix}debuginfod
+      ln -s $llvmBin/llvm-debuginfod-find $out/bin/${targetPrefix}debuginfod-find
+    fi
+
+    ln -s ${lld}/bin/lld $out/bin/${targetPrefix}ld
+
+    # Only >=13 show GNU windres compatible in help
+  '' + lib.optionalString (lib.versionAtLeast release_version "13") ''
+    ln -s $llvmBin/llvm-rc $out/bin/${targetPrefix}windres
+  '')
diff --git a/pkgs/development/compilers/llvm/5/clang/purity.patch b/pkgs/development/compilers/llvm/common/clang/5-8-purity.patch
index b30d0d0b5d5b..b30d0d0b5d5b 100644
--- a/pkgs/development/compilers/llvm/5/clang/purity.patch
+++ b/pkgs/development/compilers/llvm/common/clang/5-8-purity.patch
diff --git a/pkgs/development/compilers/llvm/10/compiler-rt/codesign.patch b/pkgs/development/compilers/llvm/common/compiler-rt/7-12-codesign.patch
index 3cc12b94b200..3cc12b94b200 100644
--- a/pkgs/development/compilers/llvm/10/compiler-rt/codesign.patch
+++ b/pkgs/development/compilers/llvm/common/compiler-rt/7-12-codesign.patch
diff --git a/pkgs/development/compilers/llvm/10/libcxxabi/no-threads.patch b/pkgs/development/compilers/llvm/common/libcxxabi/no-threads.patch
index 787f3e16500e..787f3e16500e 100644
--- a/pkgs/development/compilers/llvm/10/libcxxabi/no-threads.patch
+++ b/pkgs/development/compilers/llvm/common/libcxxabi/no-threads.patch
diff --git a/pkgs/development/compilers/llvm/10/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/common/libcxxabi/wasm.patch
index 4ebfe46aa813..4ebfe46aa813 100644
--- a/pkgs/development/compilers/llvm/10/libcxxabi/wasm.patch
+++ b/pkgs/development/compilers/llvm/common/libcxxabi/wasm.patch
diff --git a/pkgs/development/compilers/llvm/common/lldb.nix b/pkgs/development/compilers/llvm/common/lldb.nix
index 82ad9c304ea6..1f5d4a1e3385 100644
--- a/pkgs/development/compilers/llvm/common/lldb.nix
+++ b/pkgs/development/compilers/llvm/common/lldb.nix
@@ -45,25 +45,21 @@ stdenv.mkDerivation (rec {
 
   outputs = [ "out" "lib" "dev" ];
 
-  sourceRoot =
-    if lib.versionOlder release_version "13" then null
-    else "${src.name}/${pname}";
+  sourceRoot = lib.optional (lib.versionAtLeast release_version "13") "${src.name}/${pname}";
 
   nativeBuildInputs = [
     cmake
-  ] ++ lib.optionals (lib.versionAtLeast release_version "15") [
-    ninja
-  ] ++ [
     python3
     which
     swig
     lit
     makeWrapper
-  ] ++ lib.optionals (lib.versionAtLeast release_version "14") [
     lua5_3
   ] ++ lib.optionals enableManpages [
     python3.pkgs.sphinx
     python3.pkgs.recommonmark
+  ] ++ lib.optionals (lib.versionAtLeast release_version "14") [
+    ninja
   ];
 
   buildInputs = [
@@ -87,11 +83,13 @@ stdenv.mkDerivation (rec {
   #
   # See here for context:
   # https://github.com/NixOS/nixpkgs/pull/194634#issuecomment-1272129132
-  ++ lib.optional (
+  ++ lib.optional
+    (
       stdenv.targetPlatform.isDarwin
-      && !stdenv.targetPlatform.isAarch64
-      && (lib.versionAtLeast release_version "15")
-    ) (
+        && !stdenv.targetPlatform.isAarch64
+        && (lib.versionAtLeast release_version "15")
+    )
+    (
       runCommand "bsm-audit-session-header" { } ''
         install -Dm444 \
           "${lib.getDev darwin.apple_sdk.sdk}/include/bsm/audit_session.h" \
@@ -104,7 +102,7 @@ stdenv.mkDerivation (rec {
   cmakeFlags = [
     "-DLLDB_INCLUDE_TESTS=${if doCheck then "YES" else "NO"}"
     "-DLLVM_ENABLE_RTTI=OFF"
-    "-DClang_DIR=${libclang.dev}/lib/cmake"
+    "-DClang_DIR=${lib.getDev libclang}/lib/cmake"
     "-DLLVM_EXTERNAL_LIT=${lit}/bin/lit"
   ] ++ lib.optionals stdenv.isDarwin [
     "-DLLDB_USE_SYSTEM_DEBUGSERVER=ON"
@@ -127,28 +125,21 @@ stdenv.mkDerivation (rec {
   ];
 
   doCheck = false;
+  doInstallCheck = lib.versionOlder release_version "15";
 
   # TODO: cleanup with mass-rebuild
-  installCheckPhase =
-    if ((lib.versions.major release_version) == "14") then ''
-      if [ ! -e $lib/${python3.sitePackages}/lldb/_lldb*.so ] ; then
-          echo "ERROR: python files not installed where expected!";
-          return 1;
-      fi
-      if [ ! -e "$lib/lib/lua/${lua5_3.luaversion}/lldb.so" ] ; then
-          echo "ERROR: lua files not installed where expected!";
-          return 1;
-      fi
-    '' else if (((lib.versions.major release_version) == "15") || (lib.versions.major release_version) == "16") then ''
-      if [ ! -e "$lib/${python3.sitePackages}/lldb/_lldb.so" ] ; then
-          return 1;
-      fi
-    '' else ''
-      if [ ! -e "$lib/${python3.sitePackages}/lldb/_lldb.so" ] ; then
-          echo "ERROR: python files not installed where expected!";
-          return 1;
-      fi
-    '';
+  installCheckPhase = ''
+    if [ ! -e $lib/${python3.sitePackages}/lldb/_lldb*.so ] ; then
+        echo "ERROR: python files not installed where expected!";
+        return 1;
+    fi
+  '' # Something lua is built on older versions but this file doesn't exist.
+  + lib.optionalString (lib.versionAtLeast release_version "14") ''
+    if [ ! -e "$lib/lib/lua/${lua5_3.luaversion}/lldb.so" ] ; then
+        echo "ERROR: lua files not installed where expected!";
+        return 1;
+    fi
+  '';
 
   postInstall = ''
     wrapProgram $out/bin/lldb --prefix PYTHONPATH : $lib/${python3.sitePackages}/
@@ -157,7 +148,7 @@ stdenv.mkDerivation (rec {
     # vscode:
     install -D ../tools/lldb-vscode/package.json $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/package.json
     mkdir -p $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
-    ln -s $out/bin/${if (lib.versionOlder release_version "12") then "llvm-vscode" else "lldb-vscode"} $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
+    ln -s $out/bin/*-vscode $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
   '';
 
   meta = llvm_meta // {
@@ -174,17 +165,15 @@ stdenv.mkDerivation (rec {
       (lib.versionOlder release_version "11" && stdenv.isDarwin && stdenv.isAarch64)
         || (((lib.versions.major release_version) == "13") && stdenv.isDarwin);
   };
-} // lib.optionalAttrs (lib.versionOlder release_version "15") {
-  doInstallCheck = true;
 } // lib.optionalAttrs enableManpages {
   pname = "lldb-manpages";
 
-  buildPhase =
-    if lib.versionOlder release_version "15" then ''
-      make ${if (lib.versionOlder release_version "12") then "docs-man" else "docs-lldb-man"}
-    '' else null;
+  buildPhase = lib.optionalString (lib.versionOlder release_version "15") ''
+    make ${if (lib.versionOlder release_version "12") then "docs-man" else "docs-lldb-man"}
+  '';
+
 
-  ninjaFlags = if lib.versionAtLeast release_version "15" then [ "docs-lldb-man" ] else null;
+  ninjaFlags = lib.optionals (lib.versionAtLeast release_version "15") [ "docs-lldb-man" ];
 
   propagatedBuildInputs = [ ];
 
diff --git a/pkgs/development/compilers/llvm/git/bintools/default.nix b/pkgs/development/compilers/llvm/git/bintools/default.nix
deleted file mode 100644
index c7b20dd28e23..000000000000
--- a/pkgs/development/compilers/llvm/git/bintools/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ lib, runCommand, stdenv, llvm, lld, version }:
-
-let
-  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
-in runCommand "llvm-binutils-${version}" {
-  preferLocalBuild = true;
-  passthru = {
-    isLLVM = true;
-  };
-} ''
-   mkdir -p $out/bin
-   for prog in ${lld}/bin/*; do
-     ln -s $prog $out/bin/${prefix}$(basename $prog)
-   done
-   for prog in ${llvm}/bin/*; do
-     ln -sf $prog $out/bin/${prefix}$(basename $prog)
-   done
-
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
-   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
-   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
-   ln -s ${llvm}/bin/llvm-debuginfod $out/bin/${prefix}debuginfod
-   ln -s ${llvm}/bin/llvm-debuginfod-find $out/bin/${prefix}debuginfod-find
-   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
-   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
-   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
-   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
-   ln -s ${llvm}/bin/llvm-rc $out/bin/${prefix}windres
-   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
-   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
-   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
-   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
-
-   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
-''
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index 04f17d5edab6..930b716881e8 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -184,11 +184,28 @@ in let
       inherit llvm_meta;
     };
 
-    lldb = callPackage ./lldb {
+    lldb = callPackage ../common/lldb.nix {
+      src = callPackage ({ runCommand }: runCommand "lldb-src-${version}" {} ''
+        mkdir -p "$out"
+        cp -r ${monorepoSrc}/cmake "$out"
+        cp -r ${monorepoSrc}/lldb "$out"
+      '') { };
+      patches =
+        let
+          resourceDirPatch = callPackage
+            ({ substituteAll, libclang }: substituteAll
+              {
+                src = ./lldb/resource-dir.patch;
+                clangLibDir = "${libclang.lib}/lib";
+              })
+            { };
+        in
+        [
+          ./lldb/procfs.patch # FIXME: do we need this?
+          resourceDirPatch
+          ./lldb/gnu-install-dirs.patch
+        ];
       inherit llvm_meta;
-      inherit (darwin) libobjc bootstrap_cmds;
-      inherit (darwin.apple_sdk.libs) xpc;
-      inherit (darwin.apple_sdk.frameworks) Foundation Carbon Cocoa;
     };
 
     # Below, is the LLVM bootstrapping logic. It handles building a
@@ -198,7 +215,7 @@ in let
     # doesn’t support like LLVM. Probably we should move to some other
     # file.
 
-    bintools-unwrapped = callPackage ./bintools {};
+    bintools-unwrapped = callPackage ../common/bintools.nix { };
 
     bintoolsNoLibc = wrapBintoolsWith {
       bintools = tools.bintools-unwrapped;
diff --git a/pkgs/development/compilers/llvm/git/libcxxabi/default.nix b/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
index 362de957886d..6987e6b0ca3c 100644
--- a/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   postUnpack = lib.optionalString stdenv.isDarwin ''
     export TRIPLE=x86_64-apple-darwin
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d llvm -i ${./wasm.patch}
+    patch -p1 -d llvm -i ${../../common/libcxxabi/wasm.patch}
   '';
 
   prePatch = ''
diff --git a/pkgs/development/compilers/llvm/git/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/git/libcxxabi/wasm.patch
deleted file mode 100644
index 4ebfe46aa813..000000000000
--- a/pkgs/development/compilers/llvm/git/libcxxabi/wasm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
-index 15497d405e0..33f7f18193a 100644
---- a/cmake/modules/HandleLLVMOptions.cmake
-+++ b/cmake/modules/HandleLLVMOptions.cmake
-@@ -127,7 +127,10 @@ else(WIN32)
-       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
-     endif()
-   else(FUCHSIA OR UNIX)
--    MESSAGE(SEND_ERROR "Unable to determine platform")
-+    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
-+    else()
-+      MESSAGE(SEND_ERROR "Unable to determine platform")
-+    endif()
-   endif(FUCHSIA OR UNIX)
- endif(WIN32)
- 
diff --git a/pkgs/development/compilers/llvm/git/lldb/default.nix b/pkgs/development/compilers/llvm/git/lldb/default.nix
deleted file mode 100644
index a02c5ca4b136..000000000000
--- a/pkgs/development/compilers/llvm/git/lldb/default.nix
+++ /dev/null
@@ -1,144 +0,0 @@
-{ lib, stdenv, llvm_meta
-, runCommand
-, monorepoSrc
-, cmake
-, ninja
-, zlib
-, ncurses
-, swig
-, which
-, libedit
-, libxml2
-, libllvm
-, libclang
-, python3
-, version
-, libobjc
-, xpc
-, Foundation
-, bootstrap_cmds
-, Carbon
-, Cocoa
-, lit
-, makeWrapper
-, enableManpages ? false
-, lua5_3
-}:
-
-stdenv.mkDerivation (rec {
-  pname = "lldb";
-  inherit version;
-
-  src = runCommand "${pname}-src-${version}" {} ''
-    mkdir -p "$out"
-    cp -r ${monorepoSrc}/cmake "$out"
-    cp -r ${monorepoSrc}/${pname} "$out"
-  '';
-
-  sourceRoot = "${src.name}/${pname}";
-
-  patches = [
-    ./procfs.patch
-    (runCommand "resource-dir.patch" {
-      clangLibDir = "${libclang.lib}/lib";
-    } ''
-      substitute '${./resource-dir.patch}' "$out" --subst-var clangLibDir
-    '')
-    ./gnu-install-dirs.patch
-  ];
-
-  outputs = [ "out" "lib" "dev" ];
-
-  nativeBuildInputs = [
-    cmake ninja python3 which swig lit makeWrapper lua5_3
-  ] ++ lib.optionals enableManpages [
-    python3.pkgs.sphinx python3.pkgs.recommonmark
-  ];
-
-  buildInputs = [
-    ncurses
-    zlib
-    libedit
-    libxml2
-    libllvm
-  ] ++ lib.optionals stdenv.isDarwin [
-    libobjc
-    xpc
-    Foundation
-    bootstrap_cmds
-    Carbon
-    Cocoa
-  ];
-
-  hardeningDisable = [ "format" ];
-
-  cmakeFlags = [
-    "-DLLDB_INCLUDE_TESTS=${if doCheck then "YES" else "NO"}"
-    "-DLLVM_ENABLE_RTTI=OFF"
-    "-DClang_DIR=${libclang.dev}/lib/cmake"
-    "-DLLVM_EXTERNAL_LIT=${lit}/bin/lit"
-  ] ++ lib.optionals stdenv.isDarwin [
-    "-DLLDB_USE_SYSTEM_DEBUGSERVER=ON"
-  ] ++ lib.optionals (!stdenv.isDarwin) [
-    "-DLLDB_CODESIGN_IDENTITY=" # codesigning makes nondeterministic
-  ] ++ lib.optionals enableManpages [
-    "-DLLVM_ENABLE_SPHINX=ON"
-    "-DSPHINX_OUTPUT_MAN=ON"
-    "-DSPHINX_OUTPUT_HTML=OFF"
-  ] ++ lib.optionals doCheck [
-    "-DLLDB_TEST_C_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
-    "-DLLDB_TEST_CXX_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++"
-  ];
-
-  doCheck = false;
-
-  installCheckPhase = ''
-    if [ ! -e "$lib/${python3.sitePackages}/lldb/_lldb.so" ] ; then
-        return 1;
-    fi
-  '';
-
-  postInstall = ''
-    wrapProgram $out/bin/lldb --prefix PYTHONPATH : $lib/${python3.sitePackages}/
-
-    # Editor support
-    # vscode:
-    install -D ../tools/lldb-vscode/package.json $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/package.json
-    mkdir -p $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
-    ln -s $out/bin/lldb-vscode $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
-  '';
-
-  meta = llvm_meta // {
-    homepage = "https://lldb.llvm.org/";
-    description = "A next-generation high-performance debugger";
-    longDescription = ''
-      LLDB is a next generation, high-performance debugger. It is built as a set
-      of reusable components which highly leverage existing libraries in the
-      larger LLVM Project, such as the Clang expression parser and LLVM
-      disassembler.
-    '';
-  };
-} // lib.optionalAttrs enableManpages {
-  pname = "lldb-manpages";
-
-  ninjaFlags = [ "docs-lldb-man" ];
-
-  propagatedBuildInputs = [];
-
-  # manually install lldb man page
-  installPhase = ''
-    mkdir -p $out/share/man/man1
-    install docs/man/lldb.1 -t $out/share/man/man1/
-  '';
-
-  postPatch = null;
-  postInstall = null;
-
-  outputs = [ "out" ];
-
-  doCheck = false;
-
-  meta = llvm_meta // {
-    description = "man pages for LLDB ${version}";
-  };
-})
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index 9ad5d3b4a340..f16a075a1219 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -101,8 +101,8 @@ in rec {
   };
 
   vala_0_56 = generic {
-    version = "0.56.9";
-    sha256 = "VVeMfE8Ges4CjlQYBq8kD4CEy2/wzFVMqorAjL+Lzi8=";
+    version = "0.56.13";
+    sha256 = "SYgiMDbH4eSHTEdtDei9nL5QDuJe8Zp25WDcC21Wrgc=";
   };
 
   vala = vala_0_56;
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index a491c6c1d619..07fdb03a72be 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -429,8 +429,6 @@ in with passthru; stdenv.mkDerivation {
     done
     touch $out/lib/${libPrefix}/test/__init__.py
 
-    ln -s "$out/include/${executable}m" "$out/include/${executable}"
-
     # Determinism: Windows installers were not deterministic.
     # We're also not interested in building Windows installers.
     find "$out" -name 'wininst*.exe' | xargs -r rm -f
@@ -458,6 +456,9 @@ in with passthru; stdenv.mkDerivation {
     # This allows build Python to import host Python's sysconfigdata
     mkdir -p "$out/${sitePackages}"
     ln -s "$out/lib/${libPrefix}/"_sysconfigdata*.py "$out/${sitePackages}/"
+    '' + lib.optionalString (pythonOlder "3.8") ''
+    # This is gone in Python >= 3.8
+    ln -s "$out/include/${executable}m" "$out/include/${executable}"
     '' + optionalString stripConfig ''
     rm -R $out/bin/python*-config $out/lib/python*/config-*
     '' + optionalString stripIdlelib ''
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 4c8c7ed8f435..7b741b803de0 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -1,7 +1,8 @@
 { lib
 , stdenv
 , config
-, fetchurl
+, fetchFromGitHub
+, nix-update-script
 , pkg-config
 , libGLSupported ? lib.elem stdenv.hostPlatform.system lib.platforms.mesaPlatforms
 , openglSupport ? libGLSupported
@@ -55,11 +56,13 @@
 
 stdenv.mkDerivation rec {
   pname = "SDL2";
-  version = "2.28.2";
+  version = "2.28.3";
 
-  src = fetchurl {
-    url = "https://www.libsdl.org/release/${pname}-${version}.tar.gz";
-    hash = "sha256-ZLEQL6Igk1FbAu8z3Yc53uG6V+nbumoJKUK4u+0aHF4=";
+  src = fetchFromGitHub {
+    owner = "libsdl-org";
+    repo = "SDL";
+    rev = "release-${version}";
+    hash = "sha256-/kQ2IyvAfmZ+zIUt1WuEIeX0nYPGXDlAQk2qDsQnFFs=";
   };
   dontDisableStatic = if withStatic then 1 else 0;
   outputs = [ "out" "dev" ];
@@ -165,7 +168,10 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
-  passthru = { inherit openglSupport; };
+  passthru = {
+    inherit openglSupport;
+    updateScript = nix-update-script { extraArgs = ["--version-regex" "release-(.*)"]; };
+  };
 
   meta = with lib; {
     description = "A cross-platform multimedia library";
diff --git a/pkgs/development/libraries/audio/lvtk/default.nix b/pkgs/development/libraries/audio/lvtk/default.nix
index af784d80a3aa..6b16826d7d68 100644
--- a/pkgs/development/libraries/audio/lvtk/default.nix
+++ b/pkgs/development/libraries/audio/lvtk/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     sed -e '/print/d' -i wscript
   '';
 
-  wafConfigureFlags = [
+  configureFlags = [
     "--boost-includes=${boost.dev}/include"
     "--boost-libs=${boost.out}/lib"
   ];
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index 905e93de7a7f..6bd9a8b8f1ae 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -1,4 +1,4 @@
-import ./generic.nix rec {
+import ./generic.nix {
   version = "4.4.4";
   sha256 = "sha256-Q8bkuF/1uJfqttJJoObnnLX3BEduv+qxsvOrVhMvRjA=";
   extraPatches = [
diff --git a/pkgs/development/libraries/ffmpeg/5.nix b/pkgs/development/libraries/ffmpeg/5.nix
index dcfe033f040f..a3ff054f1e60 100644
--- a/pkgs/development/libraries/ffmpeg/5.nix
+++ b/pkgs/development/libraries/ffmpeg/5.nix
@@ -1,4 +1,4 @@
-import ./generic.nix rec {
+import ./generic.nix {
   version = "5.1.3";
   sha256 = "sha256-twfJvANLQGO7TiyHPMPqApfHLFUlOGZTTIIGEnjyvuE=";
   extraPatches = [
diff --git a/pkgs/development/libraries/ffmpeg/6.nix b/pkgs/development/libraries/ffmpeg/6.nix
index cf29526fbcb5..37bdf5b060f7 100644
--- a/pkgs/development/libraries/ffmpeg/6.nix
+++ b/pkgs/development/libraries/ffmpeg/6.nix
@@ -1,4 +1,4 @@
-import ./generic.nix rec {
+import ./generic.nix {
   version = "6.0";
   sha256 = "sha256-RVbgsafIbeUUNXmUbDQ03ZN42oaUo0njqROo7KOQgv0=";
 }
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index a1ca20f9483c..6bde5aa776ba 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -1,4 +1,4 @@
-{ version, sha256, extraPatches ? [], knownVulnerabilities ? [] }:
+{ version, sha256, extraPatches ? [] }:
 
 { lib, stdenv, buildPackages, removeReferencesTo, addOpenGLRunpath, pkg-config, perl, texinfo, yasm
 
@@ -33,7 +33,6 @@
 , withBzlib ? withHeadlessDeps
 , withCaca ? withFullDeps # Textual display (ASCII art)
 , withCelt ? withFullDeps # CELT decoder
-, withCrystalhd ? withFullDeps
 , withCuda ? withFullDeps && (with stdenv; (!isDarwin && !hostPlatform.isAarch && !hostPlatform.isRiscV))
 , withCudaLLVM ? withFullDeps
 , withDav1d ? withHeadlessDeps # AV1 decoder (focused on speed and correctness)
@@ -49,7 +48,6 @@
 , withGnutls ? withHeadlessDeps
 , withGsm ? withFullDeps # GSM de/encoder
 , withIconv ? withHeadlessDeps
-, withIlbc ? withFullDeps
 , withJack ? withFullDeps && !stdenv.isDarwin # Jack audio
 , withLadspa ? withFullDeps # LADSPA audio filtering
 , withLibplacebo ? withFullDeps && !stdenv.isDarwin # libplacebo video processing library
@@ -79,7 +77,7 @@
 , withSrt ? withHeadlessDeps # Secure Reliable Transport (SRT) protocol
 , withSsh ? withHeadlessDeps # SFTP protocol
 , withSvg ? withFullDeps # SVG protocol
-, withSvtav1 ? withFullDeps && !stdenv.isAarch64 # AV1 encoder/decoder (focused on speed and correctness)
+, withSvtav1 ? withHeadlessDeps && !stdenv.isAarch64 # AV1 encoder/decoder (focused on speed and correctness)
 , withTensorflow ? false # Tensorflow dnn backend support
 , withTheora ? withHeadlessDeps # Theora encoder
 , withV4l2 ? withFullDeps && !stdenv.isDarwin # Video 4 Linux support
diff --git a/pkgs/development/libraries/fortify-headers/default.nix b/pkgs/development/libraries/fortify-headers/default.nix
index 2c24665456b7..1f418af7ae96 100644
--- a/pkgs/development/libraries/fortify-headers/default.nix
+++ b/pkgs/development/libraries/fortify-headers/default.nix
@@ -15,6 +15,11 @@ stdenv.mkDerivation {
     hash = "sha256-8A8JcKHIBgXpUuIP4zs3Q1yBs5jCGd5F3H2E8UN/S2g=";
   };
 
+  patches = [
+    ./wchar-imports-skip.patch
+    ./restore-macros.patch
+  ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/development/libraries/fortify-headers/restore-macros.patch b/pkgs/development/libraries/fortify-headers/restore-macros.patch
new file mode 100644
index 000000000000..f7d31a329e35
--- /dev/null
+++ b/pkgs/development/libraries/fortify-headers/restore-macros.patch
@@ -0,0 +1,283 @@
+restore #undef'ed macro values after we're done
+
+some programs that define these miss them if removed
+
+push_macro and pop_macro pragmas allegedly well supported
+by gcc, clang and msvc
+
+--- a/include/fortify/poll.h
++++ b/include/fortify/poll.h
+@@ -29,6 +29,7 @@ __extension__
+ extern "C" {
+ #endif
+ 
++#pragma push_macro("poll")
+ #undef poll
+ 
+ _FORTIFY_FN(poll) int poll(struct pollfd * _FORTIFY_POS0 __f, nfds_t __n, int __s)
+@@ -40,6 +41,8 @@ _FORTIFY_FN(poll) int poll(struct pollfd * _FORTIFY_POS0 __f, nfds_t __n, int __
+ 	return __orig_poll(__f, __n, __s);
+ }
+ 
++#pragma pop_macro("poll")
++
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/include/fortify/stdio.h
++++ b/include/fortify/stdio.h
+@@ -29,12 +29,19 @@ __extension__
+ extern "C" {
+ #endif
+ 
++#pragma push_macro("fgets")
+ #undef fgets
++#pragma push_macro("fread")
+ #undef fread
++#pragma push_macro("fwrite")
+ #undef fwrite
++#pragma push_macro("vsprintf")
+ #undef vsprintf
++#pragma push_macro("vsnprintf")
+ #undef vsnprintf
++#pragma push_macro("snprintf")
+ #undef snprintf
++#pragma push_macro("sprintf")
+ #undef sprintf
+ 
+ _FORTIFY_FN(fgets) char *fgets(char * _FORTIFY_POS0 __s, int __n, FILE *__f)
+@@ -140,6 +147,14 @@ _FORTIFY_FN(sprintf) int sprintf(char *__s, const char *__f, ...)
+ #endif /* __has_builtin(__builtin_va_arg_pack) */
+ #endif /* defined(__has_builtin) */
+ 
++#pragma pop_macro("fgets")
++#pragma pop_macro("fread")
++#pragma pop_macro("fwrite")
++#pragma pop_macro("vsprintf")
++#pragma pop_macro("vsnprintf")
++#pragma pop_macro("snprintf")
++#pragma pop_macro("sprintf")
++
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/include/fortify/stdlib.h
++++ b/include/fortify/stdlib.h
+@@ -38,7 +38,10 @@ extern "C" {
+ 
+ /* FIXME clang */
+ #if (defined(_XOPEN_SOURCE) || defined(_GNU_SOURCE) || defined(_BSD_SOURCE)) && !defined(__clang__)
++
++#pragma push_macro("realpath")
+ #undef realpath
++
+ _FORTIFY_FN(realpath) char *realpath(const char *__p, char *__r)
+ {
+ #ifndef PATH_MAX
+@@ -60,6 +63,9 @@ _FORTIFY_FN(realpath) char *realpath(const char *__p, char *__r)
+ 	return __orig_realpath(__p, __r);
+ #endif
+ }
++
++#pragma pop_macro("realpath")
++
+ #endif
+ 
+ #ifdef __cplusplus
+--- a/include/fortify/string.h
++++ b/include/fortify/string.h
+@@ -29,12 +29,19 @@ __extension__
+ extern "C" {
+ #endif
+ 
++#pragma push_macro("memcpy")
+ #undef memcpy
++#pragma push_macro("memmove")
+ #undef memmove
++#pragma push_macro("memset")
+ #undef memset
++#pragma push_macro("strcat")
+ #undef strcat
++#pragma push_macro("strcpy")
+ #undef strcpy
++#pragma push_macro("strncat")
+ #undef strncat
++#pragma push_macro("strncpy")
+ #undef strncpy
+ 
+ _FORTIFY_FN(memcpy) void *memcpy(void * _FORTIFY_POS0 __od,
+@@ -183,6 +190,14 @@ _FORTIFY_FN(strlcpy) size_t strlcpy(char * _FORTIFY_POS0 __d,
+ }
+ #endif
+ 
++#pragma pop_macro("memcpy")
++#pragma pop_macro("memmove")
++#pragma pop_macro("memset")
++#pragma pop_macro("strcat")
++#pragma pop_macro("strcpy")
++#pragma pop_macro("strncat")
++#pragma pop_macro("strncpy")
++
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/include/fortify/strings.h
++++ b/include/fortify/strings.h
+@@ -29,8 +29,12 @@ extern "C" {
+ #if defined(_GNU_SOURCE) || defined(_BSD_SOURCE) || defined(_POSIX_SOURCE) \
+  || (defined(_POSIX_C_SOURCE) && _POSIX_C_SOURCE+0 < 200809L) \
+  || (defined(_XOPEN_SOURCE) && _XOPEN_SOURCE+0 < 700)
++
++#pragma push_macro("bcopy")
+ #undef bcopy
++#pragma push_macro("bzero")
+ #undef bzero
++
+ _FORTIFY_FN(bcopy) void bcopy(const void * _FORTIFY_POS0 __s,
+                               void * _FORTIFY_POS0 __d, size_t __n)
+ {
+@@ -52,6 +56,9 @@ _FORTIFY_FN(bzero) void bzero(void * _FORTIFY_POS0 __s, size_t __n)
+ }
+ #endif
+ 
++#pragma pop_macro("bcopy")
++#pragma pop_macro("bzero")
++
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/include/fortify/sys/socket.h
++++ b/include/fortify/sys/socket.h
+@@ -29,9 +29,13 @@ __extension__
+ extern "C" {
+ #endif
+ 
++#pragma push_macro("recv")
+ #undef recv
++#pragma push_macro("recvfrom")
+ #undef recvfrom
++#pragma push_macro("send")
+ #undef send
++#pragma push_macro("sendto")
+ #undef sendto
+ 
+ _FORTIFY_FN(recv) ssize_t recv(int __f, void * _FORTIFY_POS0 __s, size_t __n,
+@@ -76,6 +80,11 @@ _FORTIFY_FN(sendto) ssize_t sendto(int __f, const void * _FORTIFY_POS0 __s,
+ 	return __orig_sendto(__f, __s, __n, __fl, __a, __l);
+ }
+ 
++#pragma push_macro("recv")
++#pragma push_macro("recvfrom")
++#pragma push_macro("send")
++#pragma push_macro("sendto")
++
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/include/fortify/unistd.h
++++ b/include/fortify/unistd.h
+@@ -29,16 +29,27 @@ __extension__
+ extern "C" {
+ #endif
+ 
++#pragma push_macro("confstr")
+ #undef confstr
++#pragma push_macro("getcwd")
+ #undef getcwd
++#pragma push_macro("getgroups")
+ #undef getgroups
++#pragma push_macro("gethostname")
+ #undef gethostname
++#pragma push_macro("getlogin_r")
+ #undef getlogin_r
++#pragma push_macro("pread")
+ #undef pread
++#pragma push_macro("read")
+ #undef read
++#pragma push_macro("readlink")
+ #undef readlink
++#pragma push_macro("readlinkat")
+ #undef readlinkat
++#pragma push_macro("ttyname_r")
+ #undef ttyname_r
++#pragma push_macro("write")
+ #undef write
+ 
+ _FORTIFY_FN(confstr) size_t confstr(int __n, char * _FORTIFY_POS0 __s, size_t __l)
+@@ -158,6 +169,18 @@ _FORTIFY_FN(write) ssize_t write(int __f, const void * _FORTIFY_POS0 __s,
+ 	return __orig_write(__f, __s, __n);
+ }
+ 
++#pragma pop_macro("confstr")
++#pragma pop_macro("getcwd")
++#pragma pop_macro("getgroups")
++#pragma pop_macro("gethostname")
++#pragma pop_macro("getlogin_r")
++#pragma pop_macro("pread")
++#pragma pop_macro("read")
++#pragma pop_macro("readlink")
++#pragma pop_macro("readlinkat")
++#pragma pop_macro("ttyname_r")
++#pragma pop_macro("write")
++
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/include/fortify/wchar.h
++++ b/include/fortify/wchar.h
+@@ -43,19 +43,33 @@ __extension__
+ extern "C" {
+ #endif
+ 
++#pragma push_macro("fgetws")
+ #undef fgetws
++#pragma push_macro("mbsrtowcs")
+ #undef mbsrtowcs
++#pragma push_macro("mbstowcs")
+ #undef mbstowcs
++#pragma push_macro("wcrtomb")
+ #undef wcrtomb
++#pragma push_macro("wcscat")
+ #undef wcscat
++#pragma push_macro("wcscpy")
+ #undef wcscpy
++#pragma push_macro("wcsncat")
+ #undef wcsncat
++#pragma push_macro("wcsncpy")
+ #undef wcsncpy
++#pragma push_macro("wcsrtombs")
+ #undef wcsrtombs
++#pragma push_macro("wcstombs")
+ #undef wcstombs
++#pragma push_macro("wctomb")
+ #undef wctomb
++#pragma push_macro("wmemcpy")
+ #undef wmemcpy
++#pragma push_macro("wmemmove")
+ #undef wmemmove
++#pragma push_macro("wmemset")
+ #undef wmemset
+ 
+ _FORTIFY_FN(fgetws) wchar_t *fgetws(wchar_t * _FORTIFY_POS0 __s,
+@@ -269,6 +283,21 @@ _FORTIFY_FN(wmemset) wchar_t *wmemset(wchar_t * _FORTIFY_POS0 __s,
+ 	return __orig_wmemset(__s, __c, __n);
+ }
+ 
++#pragma pop_macro("fgetws")
++#pragma pop_macro("mbsrtowcs")
++#pragma pop_macro("mbstowcs")
++#pragma pop_macro("wcrtomb")
++#pragma pop_macro("wcscat")
++#pragma pop_macro("wcscpy")
++#pragma pop_macro("wcsncat")
++#pragma pop_macro("wcsncpy")
++#pragma pop_macro("wcsrtombs")
++#pragma pop_macro("wcstombs")
++#pragma pop_macro("wctomb")
++#pragma pop_macro("wmemcpy")
++#pragma pop_macro("wmemmove")
++#pragma pop_macro("wmemset")
++
+ #ifdef __cplusplus
+ }
+ #endif
diff --git a/pkgs/development/libraries/fortify-headers/wchar-imports-skip.patch b/pkgs/development/libraries/fortify-headers/wchar-imports-skip.patch
new file mode 100644
index 000000000000..255ceba9f099
--- /dev/null
+++ b/pkgs/development/libraries/fortify-headers/wchar-imports-skip.patch
@@ -0,0 +1,41 @@
+wchar.h: only include other headers if _FORTIFY_SOURCE is enabled
+
+unexpectedly including other headers can cause problems with
+sensitive/brittle code, particularly with alternative compilers
+(clang) which are already operating on the margins of what's
+supported/expected by some projects.
+
+having a way to almost entirely short-circuit these headers (by
+disabling _FORTIFY_SOURCE) is therefore important.
+
+--- a/include/fortify/wchar.h
++++ b/include/fortify/wchar.h
+@@ -20,21 +20,23 @@
+ #if !defined(__cplusplus) && !defined(__clang__)
+ __extension__
+ #endif
+-#include_next <limits.h>
++#include_next <wchar.h>
++
++#if defined(_FORTIFY_SOURCE) && _FORTIFY_SOURCE > 0 && defined(__OPTIMIZE__) && __OPTIMIZE__ > 0
++
+ #if !defined(__cplusplus) && !defined(__clang__)
+ __extension__
+ #endif
+-#include_next <stdlib.h>
++#include_next <limits.h>
+ #if !defined(__cplusplus) && !defined(__clang__)
+ __extension__
+ #endif
+-#include_next <string.h>
++#include_next <stdlib.h>
+ #if !defined(__cplusplus) && !defined(__clang__)
+ __extension__
+ #endif
+-#include_next <wchar.h>
++#include_next <string.h>
+ 
+-#if defined(_FORTIFY_SOURCE) && _FORTIFY_SOURCE > 0 && defined(__OPTIMIZE__) && __OPTIMIZE__ > 0
+ #include "fortify-headers.h"
+ 
+ #ifdef __cplusplus
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index 6af608995c2f..b223f249f83c 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -26,11 +26,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gpgme";
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchurl {
     url = "mirror://gnupg/gpgme/${pname}-${version}.tar.bz2";
-    hash = "sha256-QW4XThZXNNhIBiU/jJa9opk/0H8ljDqtXwU6bv1GPog=";
+    hash = "sha256-lVHjcIGtO96BAYoNJPJFw/ggaZBUlZj7Mal6aDgKe3E=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/ldb/default.nix b/pkgs/development/libraries/ldb/default.nix
index 753dee9e3f0c..96e8ded194aa 100644
--- a/pkgs/development/libraries/ldb/default.nix
+++ b/pkgs/development/libraries/ldb/default.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
 
   wafPath = "buildtools/bin/waf";
 
-  wafConfigureFlags = [
+  configureFlags = [
     "--bundled-libraries=NONE"
     "--builtin-libraries=replace"
     "--without-ldb-lmdb"
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index d670f8e96984..77a01951ab70 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -34,7 +34,7 @@ in
 let
 libxml = stdenv.mkDerivation rec {
   pname = "libxml2";
-  version = "2.11.4";
+  version = "2.11.5";
 
   outputs = [ "bin" "dev" "out" "doc" ]
     ++ lib.optional pythonSupport "py"
@@ -43,7 +43,7 @@ libxml = stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
-    sha256 = "c34df4qz8TlynKE6JJT9F78w3bS3pCfPM2JSyrV/V/c=";
+    sha256 = "NyeweMNg7Gn6hp3hS9b3XX7o02mHsHHmko1HIKKN86Y=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/ndn-cxx/default.nix b/pkgs/development/libraries/ndn-cxx/default.nix
index 7ab607b01f4e..dc79c78e8b4f 100644
--- a/pkgs/development/libraries/ndn-cxx/default.nix
+++ b/pkgs/development/libraries/ndn-cxx/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ boost179 openssl sqlite ];
 
-  wafConfigureFlags = [
+  configureFlags = [
     "--with-openssl=${openssl.dev}"
     "--boost-includes=${boost179.dev}/include"
     "--boost-libs=${boost179.out}/lib"
diff --git a/pkgs/development/libraries/openexr/3.nix b/pkgs/development/libraries/openexr/3.nix
index 1bd8e63d37f9..8e3dcc7cdb73 100644
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "3.1.10";
+  version = "3.1.11";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    sha256 = "sha256-8oV7Himk9AS2e2Z3OREE7KQgFIUysXwATlUN51dDe5M=";
+    sha256 = "sha256-xW/BmMtEYHiLk8kLZFXYE809jL/uAnCzkINugqJ8Iig=";
   };
 
   outputs = [ "bin" "dev" "out" "doc" ];
diff --git a/pkgs/development/libraries/talloc/default.nix b/pkgs/development/libraries/talloc/default.nix
index 5fad3c1c5121..137cc8b4757d 100644
--- a/pkgs/development/libraries/talloc/default.nix
+++ b/pkgs/development/libraries/talloc/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
 
   wafPath = "buildtools/bin/waf";
 
-  wafConfigureFlags = [
+  configureFlags = [
     "--enable-talloc-compat1"
     "--bundled-libraries=NONE"
     "--builtin-libraries=replace"
diff --git a/pkgs/development/libraries/tdb/default.nix b/pkgs/development/libraries/tdb/default.nix
index 562a422f91d6..05de9fbe6380 100644
--- a/pkgs/development/libraries/tdb/default.nix
+++ b/pkgs/development/libraries/tdb/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
 
   wafPath = "buildtools/bin/waf";
 
-  wafConfigureFlags = [
+  configureFlags = [
     "--bundled-libraries=NONE"
     "--builtin-libraries=replace"
   ];
diff --git a/pkgs/development/libraries/tevent/default.nix b/pkgs/development/libraries/tevent/default.nix
index 7d0d40439e4a..a39aedc0468c 100644
--- a/pkgs/development/libraries/tevent/default.nix
+++ b/pkgs/development/libraries/tevent/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
 
   wafPath = "buildtools/bin/waf";
 
-  wafConfigureFlags = [
+  configureFlags = [
     "--bundled-libraries=NONE"
     "--builtin-libraries=replace"
   ];
diff --git a/pkgs/development/libraries/zxing-cpp/default.nix b/pkgs/development/libraries/zxing-cpp/default.nix
index bcddfa96552f..9cd78b7b56a1 100644
--- a/pkgs/development/libraries/zxing-cpp/default.nix
+++ b/pkgs/development/libraries/zxing-cpp/default.nix
@@ -1,20 +1,21 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, pkg-config
 , cmake
+, pkg-config
 , python3
+, gitUpdater
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "zxing-cpp";
-  version = "1.4.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
-    owner = "nu-book";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-MTu8tvJXpo6+Z0aSIZ27nmerNtNBOwnL/jDkGedIiM8=";
+    owner = "zxing-cpp";
+    repo = "zxing-cpp";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-B/jGsHImRfj0iEio2b6R6laWBI1LL3OI407O7sren8s=";
   };
 
   nativeBuildInputs = [
@@ -27,23 +28,17 @@ stdenv.mkDerivation rec {
     "-DBUILD_BLACKBOX_TESTS=OFF"
   ];
 
-  # https://github.com/nu-book/zxing-cpp/issues/335
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace 'configure_file(zxing.pc.in' \
-                'include(GNUInstallDirs)
-                 configure_file(zxing.pc.in'
-    substituteInPlace zxing.pc.in \
-      --replace '$'{exec_prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@ \
-      --replace '$'{prefix}/@CMAKE_INSTALL_INCLUDEDIR@ @CMAKE_INSTALL_FULL_INCLUDEDIR@
-  '';
-
-  passthru.tests = {
-    inherit (python3.pkgs) zxing_cpp;
+  passthru = {
+    tests = {
+      inherit (python3.pkgs) zxing_cpp;
+    };
+    updateScript = gitUpdater {
+      rev-prefix = "v";
+    };
   };
 
-  meta = with lib; {
-    homepage = "https://github.com/nu-book/zxing-cpp";
+  meta = {
+    homepage = "https://github.com/zxing-cpp/zxing-cpp";
     description = "C++ port of zxing (a Java barcode image processing library)";
     longDescription = ''
       ZXing-C++ ("zebra crossing") is an open-source, multi-format 1D/2D barcode
@@ -54,8 +49,8 @@ stdenv.mkDerivation rec {
       and performance. It can both read and write barcodes in a number of
       formats.
     '';
-    license = licenses.asl20;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = with platforms; unix;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ AndersonTorres lukegb ];
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index 7ba24e4bd526..fe29cde9e522 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -93,6 +93,8 @@ in buildPythonPackage rec {
     "test_cross_module_exception_translator"
   ];
 
+  hardeningDisable = lib.optional stdenv.hostPlatform.isMusl "fortify";
+
   meta = with lib; {
     homepage = "https://github.com/pybind/pybind11";
     changelog = "https://github.com/pybind/pybind11/blob/${src.rev}/docs/changelog.rst";
diff --git a/pkgs/development/python-modules/trustme/default.nix b/pkgs/development/python-modules/trustme/default.nix
index 4deb72308fdf..4648dd75a26e 100644
--- a/pkgs/development/python-modules/trustme/default.nix
+++ b/pkgs/development/python-modules/trustme/default.nix
@@ -1,45 +1,48 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, isPy3k
 , cryptography
-, futures ? null
+, fetchPypi
+, idna
 , pyopenssl
-, service-identity
 , pytestCheckHook
-, idna
+, pythonOlder
+, service-identity
 }:
 
 buildPythonPackage rec {
   pname = "trustme";
-  version = "0.9.0";
+  version = "1.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XgeyPXDO7WTzuzauS5q8UjVMFsmNRasDe+4rX7/+WGw=";
+    hash = "sha256-U3Wtf7QnB0vslWWS4NTuKkz02miTThukvPQhcSa8ReY=";
   };
 
+  propagatedBuildInputs = [
+    cryptography
+    idna
+  ];
+
   nativeCheckInputs = [
     pyopenssl
     pytestCheckHook
     service-identity
   ];
 
-  propagatedBuildInputs = [
-    cryptography
-    idna
-  ] ++ lib.optionals (!isPy3k) [
-    futures
-  ];
-
   # Some of the tests use localhost networking.
   __darwinAllowLocalNetworking = true;
 
-  pythonImportsCheck = [ "trustme" ];
+  pythonImportsCheck = [
+    "trustme"
+  ];
 
   meta = with lib; {
     description = "High quality TLS certs while you wait, for the discerning tester";
     homepage = "https://github.com/python-trio/trustme";
+    changelog = "https://trustme.readthedocs.io/en/latest/#change-history";
     license = with licenses; [ mit asl20 ];
     maintainers = with maintainers; [ catern ];
   };
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index 582a9e0f5636..7fe0bbdb8330 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -140,14 +140,9 @@ buildPythonPackage rec {
     # twisted.python.runtime.platform.supportsINotify() == False
     substituteInPlace src/twisted/python/_inotify.py --replace \
       "ctypes.util.find_library(\"c\")" "'${stdenv.cc.libc}/lib/libc.so.6'"
-  '' + lib.optionalString (stdenv.isAarch64 && stdenv.isDarwin) ''
-    echo 'AbortConnectionTests_AsyncioSelectorReactorTests.test_fullWriteBufferAfterByteExchange.skip = "Timeout after 120 seconds"' >> src/twisted/internet/test/test_tcp.py
-    echo 'AbortConnectionTests_AsyncioSelectorReactorTests.test_resumeProducingAbort.skip = "Timeout after 120 seconds"' >> src/twisted/internet/test/test_tcp.py
-
-    echo 'PosixReactorBaseTests.test_removeAllSkipsInternalReaders.skip = "Fails due to unclosed event loop"' >> src/twisted/internet/test/test_posixbase.py
-    echo 'PosixReactorBaseTests.test_wakerIsInternalReader.skip = "Fails due to unclosed event loop"' >> src/twisted/internet/test/test_posixbase.py
-
-    echo 'TCPPortTests.test_connectionLostFailed.skip = "Fails due to unclosed event loop"' >> src/twisted/internet/test/test_posixbase.py
+  '' + lib.optionalString stdenv.isDarwin ''
+    echo 'ProcessTestsBuilder_AsyncioSelectorReactorTests.test_openFileDescriptors.skip = "invalid syntax"'>> src/twisted/internet/test/test_process.py
+    echo 'ProcessTestsBuilder_SelectReactorTests.test_openFileDescriptors.skip = "invalid syntax"'>> src/twisted/internet/test/test_process.py
   '';
 
   # Generate Twisted's plug-in cache. Twisted users must do it as well. See
@@ -171,7 +166,7 @@ buildPythonPackage rec {
     export SOURCE_DATE_EPOCH=315532800
     export PATH=$out/bin:$PATH
     # race conditions when running in paralell
-    ${python.interpreter} -m twisted.trial twisted
+    ${python.interpreter} -m twisted.trial -j1 twisted
   '';
 
   passthru = {
diff --git a/pkgs/development/python-modules/zxing_cpp/default.nix b/pkgs/development/python-modules/zxing_cpp/default.nix
index 2427e1256998..b876ab05af3f 100644
--- a/pkgs/development/python-modules/zxing_cpp/default.nix
+++ b/pkgs/development/python-modules/zxing_cpp/default.nix
@@ -1,20 +1,18 @@
-{ buildPythonPackage
-, lib
+{ lib
+, buildPythonPackage
 , cmake
-, pybind11
-, zxing-cpp
 , numpy
 , pillow
+, pybind11
+, zxing-cpp
 }:
 
 buildPythonPackage rec {
   pname = "zxing_cpp";
-  inherit (zxing-cpp) src version;
+  inherit (zxing-cpp) src version meta;
 
   sourceRoot = "${src.name}/wrappers/python";
-  patches = [
-    ./use-nixpkgs-pybind11.patch
-  ];
+
   dontUseCmakeConfigure = true;
 
   propagatedBuildInputs = [
@@ -29,21 +27,4 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pillow
   ];
-
-  meta = with lib; {
-    homepage = "https://github.com/zxing-cpp/zxing-cpp";
-    description = "Python bindings for C++ port of zxing (a Java barcode image processing library)";
-    longDescription = ''
-      ZXing-C++ ("zebra crossing") is an open-source, multi-format 1D/2D barcode
-      image processing library implemented in C++.
-
-      It was originally ported from the Java ZXing Library but has been
-      developed further and now includes many improvements in terms of quality
-      and performance. It can both read and write barcodes in a number of
-      formats.
-    '';
-    license = licenses.asl20;
-    maintainers = with maintainers; [ lukegb ];
-    platforms = with platforms; unix;
-  };
 }
diff --git a/pkgs/development/python-modules/zxing_cpp/use-nixpkgs-pybind11.patch b/pkgs/development/python-modules/zxing_cpp/use-nixpkgs-pybind11.patch
deleted file mode 100644
index 4a4960f13d6d..000000000000
--- a/pkgs/development/python-modules/zxing_cpp/use-nixpkgs-pybind11.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index eadfc045..b6f273a6 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -20,8 +20,7 @@ if (NOT hasParent)
-         # In development mode, when the whole zxing-cpp directory is checked out, build against head code.
-         add_subdirectory(${CMAKE_CURRENT_SOURCE_DIR}/../../core ZXing EXCLUDE_FROM_ALL)
- 
--        include(${CMAKE_CURRENT_SOURCE_DIR}/../../zxing.cmake)
--        zxing_add_package(pybind11 pybind11 ${pybind11_git_repo} ${pybind11_git_rev})
-+        find_package(pybind11 CONFIG)
-     else()
-         # we don't have access to the top-level cmake helpers -> simply fetch it unconditional
-         include(FetchContent)
diff --git a/pkgs/development/tools/build-managers/waf/setup-hook.sh b/pkgs/development/tools/build-managers/waf/setup-hook.sh
index 2593b0a9d808..34d2ca6a3641 100644
--- a/pkgs/development/tools/build-managers/waf/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/waf/setup-hook.sh
@@ -18,7 +18,7 @@ wafConfigurePhase() {
 
     local flagsArray=(
         $prefixFlag
-        $wafConfigureFlags "${wafConfigureFlagsArray[@]}"
+        $configureFlags "${configureFlagsArray[@]}"
         ${configureTargets:-configure}
     )
 
diff --git a/pkgs/development/tools/hotdoc/default.nix b/pkgs/development/tools/hotdoc/default.nix
index 50e2e43a67b3..b649310214fb 100644
--- a/pkgs/development/tools/hotdoc/default.nix
+++ b/pkgs/development/tools/hotdoc/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , buildPythonApplication
+, fetchpatch
 , fetchPypi
 , pytestCheckHook
 , pkg-config
@@ -27,13 +28,22 @@
 
 buildPythonApplication rec {
   pname = "hotdoc";
-  version = "0.13.7";
+  version = "0.15";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ESOmWeLJSXLDKBPsMBGR0zPbJHEqg/fj0G3VjUfPAJg=";
+    hash = "sha256-sfQ/iBd1Z+YqnaOg8j32rC2iucdiiK3Tff9NfYFnQyc=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-test-hotdoc.patch";
+      url = "https://github.com/hotdoc/hotdoc/commit/d2415a520e960a7b540742a0695b699be9189540.patch";
+      hash = "sha256-9ORZ91c+/oRqEp2EKXjKkz7u8mLnWCq3uPsc3G4NB9E=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     cmake
diff --git a/pkgs/misc/jackaudio/default.nix b/pkgs/misc/jackaudio/default.nix
index 07d0a4dd2363..2fa874833c6a 100644
--- a/pkgs/misc/jackaudio/default.nix
+++ b/pkgs/misc/jackaudio/default.nix
@@ -51,7 +51,8 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   dontAddWafCrossFlags = true;
-  wafConfigureFlags = [
+
+  configureFlags = [
     "--classic"
     "--autostart=${if (optDbus != null) then "dbus" else "classic"}"
   ] ++ lib.optional (optDbus != null) "--dbus"
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 83ff3fd4cc3b..60133dfd3dc1 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -27,9 +27,12 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  preConfigure = ''
+  postPatch = ''
     # Don't try to create /var/lib/arpd:
     sed -e '/ARPDDIR/d' -i Makefile
+
+    substituteInPlace Makefile \
+      --replace "CC := gcc" "CC ?= $CC"
   '';
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/os-specific/linux/kbd/default.nix b/pkgs/os-specific/linux/kbd/default.nix
index c19646ac529a..1c38f4b7f491 100644
--- a/pkgs/os-specific/linux/kbd/default.nix
+++ b/pkgs/os-specific/linux/kbd/default.nix
@@ -12,15 +12,16 @@
 , bzip2
 , xz
 , zstd
+, gitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "kbd";
-  version = "2.6.1";
+  version = "2.6.2";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/kbd/${pname}-${version}.tar.xz";
-    sha256 = "sha256-LrbGyXK+lYm6tzMnW/AgvrX2RNX5Q5c3kg5wGvbPNIU=";
+    sha256 = "sha256-M+O7PD9VkzsQ8FOxS19pouJMKFQ+nsdpAkb+R2KN2U8=";
   };
 
   # vlock is moved into its own output, since it depends on pam. This
@@ -79,7 +80,14 @@ stdenv.mkDerivation rec {
   passthru.tests = {
     inherit (nixosTests) keymap kbd-setfont-decompress kbd-update-search-paths-patch;
   };
-  passthru.gzip = gzip;
+  passthru = {
+    gzip = gzip;
+    updateScript = gitUpdater {
+       # No nicer place to find latest release.
+       url = "https://github.com/legionus/kbd.git";
+       rev-prefix = "v";
+    };
+  };
 
   meta = with lib; {
     homepage = "https://kbd-project.org/";
diff --git a/pkgs/os-specific/linux/kbd/search-paths.patch b/pkgs/os-specific/linux/kbd/search-paths.patch
index 3b337ca7cc2b..fad33be45bdc 100644
--- a/pkgs/os-specific/linux/kbd/search-paths.patch
+++ b/pkgs/os-specific/linux/kbd/search-paths.patch
@@ -52,10 +52,9 @@ Without this patch, kbd will only look inside
  };
 --- a/src/loadkeys.c
 +++ b/src/loadkeys.c
-@@ -27,6 +27,7 @@
+@@ -27,5 +27,6 @@
  
  static const char *const dirpath1[] = {
- 	"",
 +	"/etc/kbd/" KEYMAPDIR "/**",
  	DATADIR "/" KEYMAPDIR "/**",
  	KERNDIR "/",
diff --git a/pkgs/servers/nfd/default.nix b/pkgs/servers/nfd/default.nix
index e790d07a8f66..2b6655106de7 100644
--- a/pkgs/servers/nfd/default.nix
+++ b/pkgs/servers/nfd/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config sphinx waf.hook ];
   buildInputs = [ libpcap ndn-cxx openssl websocketpp ] ++ lib.optional withSystemd systemd;
 
-  wafConfigureFlags = [
+  configureFlags = [
     "--boost-includes=${boost179.dev}/include"
     "--boost-libs=${boost179.out}/lib"
     "--with-tests"
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 6343b987a03d..85cc6b0e2472 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -135,7 +135,7 @@ stdenv.mkDerivation rec {
     export PYTHONHASHSEED=1
   '';
 
-  wafConfigureFlags = [
+  configureFlags = [
     "--with-static-modules=NONE"
     "--with-shared-modules=ALL"
     "--enable-fhs"
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 7a083660e449..beba687e788a 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -377,6 +377,8 @@ else let
           "-DCMAKE_HOST_SYSTEM_PROCESSOR=${stdenv.buildPlatform.uname.processor}"
         ] ++ lib.optionals (stdenv.buildPlatform.uname.release != null) [
           "-DCMAKE_HOST_SYSTEM_VERSION=${stdenv.buildPlatform.uname.release}"
+        ] ++ lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+          "-DCMAKE_CROSSCOMPILING_EMULATOR=env"
         ]);
 
       mesonFlags =
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 7c948afc4dac..ad9857fc9d61 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1216,7 +1216,7 @@ fixLibtool() {
     done
 
     sed -i "$1" \
-        -e "s^eval \(sys_lib_search_path=\).*^\1'$search_path'^" \
+        -e "s^eval \(sys_lib_search_path=\).*^\1'${search_path:-}'^" \
         -e 's^eval sys_lib_.+search_path=.*^^'
 }
 
diff --git a/pkgs/tools/cd-dvd/cdrtools/default.nix b/pkgs/tools/cd-dvd/cdrtools/default.nix
index fa90ceb61611..68358a0c333f 100644
--- a/pkgs/tools/cd-dvd/cdrtools/default.nix
+++ b/pkgs/tools/cd-dvd/cdrtools/default.nix
@@ -28,6 +28,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = false; # parallel building fails on some linux machines
 
+  hardeningDisable = lib.optional stdenv.hostPlatform.isMusl "fortify";
+
   meta = with lib; {
     homepage = "https://cdrtools.sourceforge.net/private/cdrecord.html";
     description = "Highly portable CD/DVD/BluRay command line recording software";
diff --git a/pkgs/tools/networking/ndn-tools/default.nix b/pkgs/tools/networking/ndn-tools/default.nix
index 01c05a5d1ac7..ea6c731f214e 100644
--- a/pkgs/tools/networking/ndn-tools/default.nix
+++ b/pkgs/tools/networking/ndn-tools/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config sphinx waf.hook ];
   buildInputs = [ libpcap ndn-cxx openssl ];
 
-  wafConfigureFlags = [
+  configureFlags = [
     "--boost-includes=${boost.dev}/include"
     "--boost-libs=${boost.out}/lib"
     "--with-tests"
diff --git a/pkgs/tools/networking/saldl/default.nix b/pkgs/tools/networking/saldl/default.nix
index 7f37e61f5117..c131a709f734 100644
--- a/pkgs/tools/networking/saldl/default.nix
+++ b/pkgs/tools/networking/saldl/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ curl libevent ];
 
-  wafConfigureFlags = [ "--saldl-version ${version}" "--no-werror" ];
+  configureFlags = [ "--saldl-version ${version}" "--no-werror" ];
 
   outputs = [ "out" "man" ];
 
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index b6ce17a80cca..1f135aecd851 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -48,11 +48,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unbound";
-  version = "1.17.1";
+  version = "1.18.0";
 
   src = fetchurl {
     url = "https://nlnetlabs.nl/downloads/unbound/unbound-${version}.tar.gz";
-    hash = "sha256-7kCFzszhJYTmAPPYFKKPqCLfqs7B+UyEv9Z/ilVxpfQ=";
+    hash = "sha256-PalUkKhc/2Qg8m+uC4Skn1ES3xvxt/w0+HJPAggstxI=";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
@@ -152,6 +152,7 @@ stdenv.mkDerivation rec {
   passthru.tests = {
     inherit gnutls;
     nixos-test = nixosTests.unbound;
+    nixos-test-exporter = nixosTests.prometheus-exporters.unbound;
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/package-management/nix/common.nix b/pkgs/tools/package-management/nix/common.nix
index 9259c7e21f1a..798c7cc918d5 100644
--- a/pkgs/tools/package-management/nix/common.nix
+++ b/pkgs/tools/package-management/nix/common.nix
@@ -82,6 +82,8 @@ self = stdenv.mkDerivation {
 
   hardeningEnable = lib.optionals (!stdenv.isDarwin) [ "pie" ];
 
+  hardeningDisable = lib.optional stdenv.hostPlatform.isMusl "fortify";
+
   nativeBuildInputs = [
     pkg-config
   ] ++ lib.optionals atLeast24 [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7c7044556471..2495049f581d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9720,7 +9720,17 @@ with pkgs;
 
   kestrel = callPackage ../tools/security/kestrel { };
 
-  kexec-tools = callPackage ../os-specific/linux/kexec-tools { };
+  kexec-tools = callPackage ../os-specific/linux/kexec-tools {
+    # clangStdenv fails with
+    # purgatory/arch/i386/entry32-16.S:23:2: error: unknown directive
+    #  .arch i386
+    #  ^
+    # purgatory/arch/i386/entry32-16.S:115:11: error: unknown token in expression
+    #  ljmp %cs:*(realdest - entry16)
+    #           ^
+    # make: *** [Makefile:128: purgatory/arch/i386/entry32-16.o] Error 1
+    stdenv = gccStdenv;
+  };
 
   keepkey_agent = with python3Packages; toPythonApplication keepkey_agent;
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e2922ae08cbd..c36b97cd9ef4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2411,10 +2411,10 @@ self: super: with self; {
   cython = callPackage ../development/python-modules/Cython { };
 
   cython_3 = self.cython.overridePythonAttrs (old: rec {
-    version = "3.0.0";
+    version = "3.0.2";
     src = old.src.override {
       inherit version;
-      hash = "sha256-NQsY+Wc+YxAdu/z3dO4vV8IKxGNtJVdB12ynkBaxvYI=";
+      hash = "sha256-lZSBjcqLsirmWAxSItorxcwyM0NQvS0pSgDYZpvMYbU=";
     };
     patches = [ ];
   });