Merge staging-next into staging

5 files changed, 170 insertions, 63 deletions

diff --git a/pkgs/servers/http/envoy/0001-nixpkgs-use-system-Python.patch b/pkgs/servers/http/envoy/0001-nixpkgs-use-system-Python.patch
index 1ff1fe66f10b8..fc10f59992334 100644
--- a/pkgs/servers/http/envoy/0001-nixpkgs-use-system-Python.patch
+++ b/pkgs/servers/http/envoy/0001-nixpkgs-use-system-Python.patch
@@ -1,22 +1,29 @@
-From 1b6ad143c0f5f96c42f603bb93a72f788b88b622 Mon Sep 17 00:00:00 2001
+From 4a9739da420b9584d5b9582c19cf3f86a6a90609 Mon Sep 17 00:00:00 2001
 From: Luke Granger-Brown <git@lukegb.com>
 Date: Fri, 12 May 2023 08:12:04 +0100
-Subject: [PATCH 1/2] nixpkgs: use system Python
+Subject: [PATCH 1/3] nixpkgs: use system Python
 
 ---
- bazel/python_dependencies.bzl |  4 ----
- bazel/repositories_extra.bzl  | 13 +------------
- 2 files changed, 1 insertion(+), 16 deletions(-)
+ bazel/python_dependencies.bzl | 11 ++++-------
+ bazel/repositories_extra.bzl  | 16 ----------------
+ 2 files changed, 4 insertions(+), 23 deletions(-)
 
 diff --git a/bazel/python_dependencies.bzl b/bazel/python_dependencies.bzl
-index 37c0183664..0bee5feb7e 100644
+index ea50bf30ba..b82f374720 100644
 --- a/bazel/python_dependencies.bzl
 +++ b/bazel/python_dependencies.bzl
-@@ -1,24 +1,20 @@
+@@ -1,27 +1,24 @@
  load("@rules_python//python:pip.bzl", "pip_parse")
--load("@python3_10//:defs.bzl", "interpreter")
+-load("@python3_11//:defs.bzl", "interpreter")
+-load("@envoy_toolshed//:packages.bzl", "load_packages")
  
  def envoy_python_dependencies():
+-    # TODO(phlax): rename base_pip3 -> pip3 and remove this
+-    load_packages()
++    pip_parse(
++        name = "pip3",
++        requirements_lock = "@envoy_toolshed//:requirements.txt",
++    )
      pip_parse(
          name = "base_pip3",
 -        python_interpreter_target = interpreter,
@@ -38,34 +45,39 @@ index 37c0183664..0bee5feb7e 100644
          extra_pip_args = ["--require-hashes"],
      )
 diff --git a/bazel/repositories_extra.bzl b/bazel/repositories_extra.bzl
-index 9d1b31c5d6..ac5605eb30 100644
+index 40d348073f..17b98b1ea1 100644
 --- a/bazel/repositories_extra.bzl
 +++ b/bazel/repositories_extra.bzl
-@@ -1,23 +1,12 @@
+@@ -1,29 +1,13 @@
  load("@emsdk//:deps.bzl", emsdk_deps = "deps")
 -load("@rules_python//python:repositories.bzl", "python_register_toolchains")
  load("@proxy_wasm_cpp_host//bazel/cargo/wasmtime:crates.bzl", "wasmtime_fetch_remote_crates")
  load("//bazel/external/cargo:crates.bzl", "raze_fetch_remote_crates")
  load("@aspect_bazel_lib//lib:repositories.bzl", "aspect_bazel_lib_dependencies")
  
+-def _python_minor_version(python_version):
+-    return "_".join(python_version.split(".")[:-1])
+-
 -# Python version for `rules_python`
--PYTHON_VERSION = "3.10.2"
+-PYTHON_VERSION = "3.11.3"
+-PYTHON_MINOR_VERSION = _python_minor_version(PYTHON_VERSION)
 -
  # Envoy deps that rely on a first stage of dependency loading in envoy_dependencies().
--def envoy_dependencies_extra(python_version = PYTHON_VERSION):
-+def envoy_dependencies_extra():
+ def envoy_dependencies_extra(
+-        python_version = PYTHON_VERSION,
+         ignore_root_user_error = False):
      emsdk_deps()
      raze_fetch_remote_crates()
      wasmtime_fetch_remote_crates()
  
 -    # Registers underscored Python minor version - eg `python3_10`
 -    python_register_toolchains(
--        name = "python%s" % ("_".join(python_version.split(".")[:-1])),
+-        name = "python%s" % _python_minor_version(python_version),
 -        python_version = python_version,
--        ignore_root_user_error = True,
+-        ignore_root_user_error = ignore_root_user_error,
 -    )
 -
      aspect_bazel_lib_dependencies()
 -- 
-2.40.0
+2.42.0
 
diff --git a/pkgs/servers/http/envoy/0002-nixpkgs-use-system-Go.patch b/pkgs/servers/http/envoy/0002-nixpkgs-use-system-Go.patch
index 422f926e01642..494b1e4e72622 100644
--- a/pkgs/servers/http/envoy/0002-nixpkgs-use-system-Go.patch
+++ b/pkgs/servers/http/envoy/0002-nixpkgs-use-system-Go.patch
@@ -1,7 +1,7 @@
-From 30e059d652bd4e352e2c1dc3c44d03a1e42ff912 Mon Sep 17 00:00:00 2001
+From 10e577a3c300f76ead5a5512f2fe970f12e46592 Mon Sep 17 00:00:00 2001
 From: Luke Granger-Brown <git@lukegb.com>
 Date: Fri, 12 May 2023 08:13:21 +0100
-Subject: [PATCH 2/2] nixpkgs: use system Go
+Subject: [PATCH 2/3] nixpkgs: use system Go
 
 ---
  bazel/dependency_imports.bzl | 29 +----------------------------
@@ -9,11 +9,11 @@ Subject: [PATCH 2/2] nixpkgs: use system Go
  2 files changed, 1 insertion(+), 31 deletions(-)
 
 diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
-index 681617f1b8..a10c560baf 100644
+index b743a1936d..afa04ef5c0 100644
 --- a/bazel/dependency_imports.bzl
 +++ b/bazel/dependency_imports.bzl
-@@ -17,7 +17,7 @@ load("@aspect_bazel_lib//lib:repositories.bzl", "register_jq_toolchains", "regis
- load("@com_google_cel_cpp//bazel:deps.bzl", "parser_deps")
+@@ -18,7 +18,7 @@ load("@com_google_cel_cpp//bazel:deps.bzl", "parser_deps")
+ load("@com_github_chrusty_protoc_gen_jsonschema//:deps.bzl", protoc_gen_jsonschema_go_dependencies = "go_dependencies")
  
  # go version for rules_go
 -GO_VERSION = "1.18"
@@ -22,17 +22,17 @@ index 681617f1b8..a10c560baf 100644
  JQ_VERSION = "1.6"
  YQ_VERSION = "4.24.4"
 @@ -27,7 +27,6 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y
-     rules_foreign_cc_dependencies(register_default_tools = False, register_built_tools = False)
+     rules_foreign_cc_dependencies()
      go_rules_dependencies()
      go_register_toolchains(go_version)
 -    envoy_download_go_sdks(go_version)
      gazelle_dependencies(go_sdk = "go_sdk")
      apple_rules_dependencies()
      pip_dependencies()
-@@ -146,29 +145,3 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y
-         # use_category = ["api"],
-         # source = "https://github.com/bufbuild/protoc-gen-validate/blob/v0.6.1/dependencies.bzl#L23-L28"
+@@ -148,29 +147,3 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y
      )
+ 
+     protoc_gen_jsonschema_go_dependencies()
 -
 -def envoy_download_go_sdks(go_version):
 -    go_download_sdk(
@@ -60,10 +60,10 @@ index 681617f1b8..a10c560baf 100644
 -        version = go_version,
 -    )
 diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
-index 6d2cf2014c..a8375bcdef 100644
+index 71667227f7..b10a47d344 100644
 --- a/bazel/repositories.bzl
 +++ b/bazel/repositories.bzl
-@@ -196,9 +196,6 @@ def _go_deps(skip_targets):
+@@ -215,9 +215,6 @@ def _go_deps(skip_targets):
      if "io_bazel_rules_go" not in skip_targets:
          external_http_archive(
              name = "io_bazel_rules_go",
@@ -74,5 +74,5 @@ index 6d2cf2014c..a8375bcdef 100644
          external_http_archive("bazel_gazelle")
  
 -- 
-2.40.0
+2.42.0
 
diff --git a/pkgs/servers/http/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch b/pkgs/servers/http/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch
new file mode 100644
index 0000000000000..5a24e7e4a90d1
--- /dev/null
+++ b/pkgs/servers/http/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch
@@ -0,0 +1,29 @@
+From 6175deb13a2df8bd25a56021ba8754e4be445219 Mon Sep 17 00:00:00 2001
+From: Luke Granger-Brown <git@lukegb.com>
+Date: Fri, 13 Oct 2023 21:42:51 +0000
+Subject: [PATCH 3/3] nixpkgs: use system C/C++ toolchains
+
+---
+ bazel/dependency_imports.bzl | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
+index afa04ef5c0..a5ffaf4ff3 100644
+--- a/bazel/dependency_imports.bzl
++++ b/bazel/dependency_imports.bzl
+@@ -24,7 +24,11 @@ JQ_VERSION = "1.6"
+ YQ_VERSION = "4.24.4"
+ 
+ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, yq_version = YQ_VERSION):
+-    rules_foreign_cc_dependencies()
++    rules_foreign_cc_dependencies(
++        register_default_tools=False,  # no prebuilt toolchains
++	register_built_tools=False,  # nor from source
++	register_preinstalled_tools=True,  # use host tools (default)
++    )
+     go_rules_dependencies()
+     go_register_toolchains(go_version)
+     gazelle_dependencies(go_sdk = "go_sdk")
+-- 
+2.42.0
+
diff --git a/pkgs/servers/http/envoy/default.nix b/pkgs/servers/http/envoy/default.nix
index 7c758331688ad..cda0d0a4daeb6 100644
--- a/pkgs/servers/http/envoy/default.nix
+++ b/pkgs/servers/http/envoy/default.nix
@@ -24,8 +24,8 @@ let
     # However, the version string is more useful for end-users.
     # These are contained in a attrset of their own to make it obvious that
     # people should update both.
-    version = "1.26.4";
-    rev = "cfa32deca25ac57c2bbecdad72807a9b13493fc1";
+    version = "1.27.1";
+    rev = "6b9db09c69965d5bfb37bdd29693f8b7f9e9e9ec";
   };
 in
 buildBazelPackage rec {
@@ -36,7 +36,7 @@ buildBazelPackage rec {
     owner = "envoyproxy";
     repo = "envoy";
     inherit (srcVer) rev;
-    hash = "sha256-j5QyqT+9tpChg5JxdSw21rtb9AI036vIiAmzCNzGWGc=";
+    hash = "sha256-eZ3UCVqQbtK2GbawUVef5+BMSQbqe+owtwH+b887mQE=";
 
     postFetch = ''
       chmod -R +w $out
@@ -59,6 +59,9 @@ buildBazelPackage rec {
 
     # use system Go, not bazel-fetched binary Go
     ./0002-nixpkgs-use-system-Go.patch
+
+    # use system C/C++ tools
+    ./0003-nixpkgs-use-system-C-C-toolchains.patch
   ];
 
   nativeBuildInputs = [
@@ -80,8 +83,8 @@ buildBazelPackage rec {
 
   fetchAttrs = {
     sha256 = {
-      x86_64-linux = "sha256-MvY4cLdLOeb7+Zt7Oz7Kzz1+dsUceemP/V02egvHg+M=";
-      aarch64-linux = "sha256-U5mnAq8RHDygxiYeNc0HDeOgoaGyrd0MPjHKdyUkM0A=";
+      x86_64-linux = "sha256-bBi+3sAwtj5qu1npFpNMK2C99Q0ZI3zaSmMsTcreD8Y=";
+      aarch64-linux = "sha256-piIekotpxB02COglAon9w7a+1jXlHX29/VkrgKFsQ3c=";
     }.${stdenv.system} or (throw "unsupported system ${stdenv.system}");
     dontUseCmakeConfigure = true;
     dontUseGnConfigure = true;
diff --git a/pkgs/servers/http/envoy/protobuf.patch b/pkgs/servers/http/envoy/protobuf.patch
index 1cc071bd861a1..dc7026350316c 100644
--- a/pkgs/servers/http/envoy/protobuf.patch
+++ b/pkgs/servers/http/envoy/protobuf.patch
@@ -1,33 +1,39 @@
 diff --git a/BUILD.bazel b/BUILD.bazel
-index 0f6e41e3a..c0d2bbccf 100644
+index 637882c49..2cb08f1b0 100644
 --- a/BUILD.bazel
 +++ b/BUILD.bazel
-@@ -138,7 +138,7 @@ cc_library(
+@@ -165,6 +165,8 @@ alias(
      visibility = ["//visibility:public"],
-     deps = [":protobuf_lite"] + select({
-         "//build_defs:config_msvc": [],
--        "//conditions:default": ["@zlib//:zlib"],
-+        "//conditions:default": ["//external:zlib"],
-     }),
  )
  
-@@ -755,7 +820,7 @@ cc_test(
-         "@com_google_googletest//:gtest_main",
-     ] + select({
-         "//build_defs:config_msvc": [],
--        "//conditions:default": ["@zlib//:zlib"],
-+        "//conditions:default": ["//external:zlib"],
-     }),
++# Envoy: Patch
++
+ cc_binary(
+     name = "protoc",
+     copts = COPTS,
+@@ -173,6 +175,14 @@ cc_binary(
+     deps = ["//src/google/protobuf/compiler:protoc_lib"],
  )
  
++alias(
++    name = "protobuf_python_genproto",
++    actual = "//python:well_known_types_py_pb2_genproto",
++    visibility = ["//visibility:public"],
++)
++
++# /Envoy: Patch
++
+ cc_binary(
+     name = "protoc_static",
+     copts = COPTS,
 diff --git a/python/google/protobuf/__init__.py b/python/google/protobuf/__init__.py
-index e7555ee10..a93beb1c5 100644
+index 88de4cf8a..b3e046997 100755
 --- a/python/google/protobuf/__init__.py
 +++ b/python/google/protobuf/__init__.py
 @@ -31,3 +31,10 @@
  # Copyright 2007 Google Inc. All Rights Reserved.
  
- __version__ = '4.21.12'
+ __version__ = '4.23.1'
 +
 +
 +if __name__ != '__main__':
@@ -35,19 +41,76 @@ index e7555ee10..a93beb1c5 100644
 +        __import__('pkg_resources').declare_namespace(__name__)
 +    except ImportError:
 +        __path__ = __import__('pkgutil').extend_path(__path__, __name__)
-diff --git a/src/google/protobuf/generated_message_tctable_lite.cc b/src/google/protobuf/generated_message_tctable_lite.cc
-index 9993811dc..d80006af7 100644
---- a/src/google/protobuf/generated_message_tctable_lite.cc
-+++ b/src/google/protobuf/generated_message_tctable_lite.cc
-@@ -343,11 +343,6 @@ const char* TcParser::MiniParse(PROTOBUF_TC_PARAM_DECL) {
+diff --git a/src/google/protobuf/compiler/BUILD.bazel b/src/google/protobuf/compiler/BUILD.bazel
+index a2171c806..8aec6187f 100644
+--- a/src/google/protobuf/compiler/BUILD.bazel
++++ b/src/google/protobuf/compiler/BUILD.bazel
+@@ -306,7 +306,7 @@ cc_library(
+     srcs = ["retention.cc"],
+     hdrs = ["retention.h"],
+     include_prefix = "google/protobuf/compiler",
+-    visibility = ["//src/google/protobuf:__subpackages__"],
++    visibility = ["//visibility:public"],
+     deps = [
+         "//src/google/protobuf:protobuf_nowkt",
+         "@com_google_absl//absl/types:span",
+diff --git a/src/google/protobuf/io/BUILD.bazel b/src/google/protobuf/io/BUILD.bazel
+index 8f39625c2..2c2c73dcd 100644
+--- a/src/google/protobuf/io/BUILD.bazel
++++ b/src/google/protobuf/io/BUILD.bazel
+@@ -142,7 +142,7 @@ cc_library(
+         "@com_google_absl//absl/log:absl_log",
+     ] + select({
+         "//build_defs:config_msvc": [],
+-        "//conditions:default": ["@zlib//:zlib"],
++        "//conditions:default": ["//external:zlib"],
+     }),
+ )
+ 
+diff --git a/src/google/protobuf/map.h b/src/google/protobuf/map.h
+index 869ebf100..fec92e2b1 100644
+--- a/src/google/protobuf/map.h
++++ b/src/google/protobuf/map.h
+@@ -883,7 +883,7 @@ class KeyMapBase : public UntypedMapBase {
+         TreeConvert(b);
+       }
+       ABSL_DCHECK(TableEntryIsTree(b))
+-          << (void*)table_[b] << " " << (uintptr_t)table_[b];
++          << reinterpret_cast<void*>(table_[b]) << " " << static_cast<uintptr_t>(table_[b]);
+       InsertUniqueInTree(b, node);
+       index_of_first_non_null_ = (std::min)(index_of_first_non_null_, b);
+     }
+diff --git a/src/google/protobuf/map_field.h b/src/google/protobuf/map_field.h
+index 70b12b1e7..b8f46db45 100644
+--- a/src/google/protobuf/map_field.h
++++ b/src/google/protobuf/map_field.h
+@@ -345,7 +345,7 @@ class PROTOBUF_EXPORT MapFieldBase : public MapFieldBaseForParse {
+ 
+  protected:
+   // "protected" stops users from deleting a `MapFieldBase *`
+-  ~MapFieldBase();
++  virtual ~MapFieldBase();
  
- namespace {
+  public:
+   // Returns reference to internal repeated field. Data written using
+diff --git a/src/google/protobuf/port_def.inc b/src/google/protobuf/port_def.inc
+index 1c6a24945..6186c2ad1 100644
+--- a/src/google/protobuf/port_def.inc
++++ b/src/google/protobuf/port_def.inc
+@@ -1004,7 +1004,7 @@ static_assert(PROTOBUF_ABSL_MIN(20230125, 3),
+ #pragma clang diagnostic ignored "-Wshorten-64-to-32"
+ // Turn on -Wdeprecated-enum-enum-conversion. This deprecation comes in C++20
+ // via http://wg21.link/p1120r0.
+-#pragma clang diagnostic error "-Wdeprecated-enum-enum-conversion"
++// #pragma clang diagnostic error "-Wdeprecated-enum-enum-conversion"
+ // This error has been generally flaky, but we need to disable it specifically
+ // to fix https://github.com/protocolbuffers/protobuf/issues/12313
+ #pragma clang diagnostic ignored "-Wunused-parameter"
+@@ -1062,6 +1062,7 @@ static_assert(PROTOBUF_ABSL_MIN(20230125, 3),
+ #pragma warning(disable: 4125)
+ #endif
  
--// Offset returns the address `offset` bytes after `base`.
--inline void* Offset(void* base, uint32_t offset) {
--  return static_cast<uint8_t*>(base) + offset;
--}
--
- // InvertPacked changes tag bits from the given wire type to length
- // delimited. This is the difference expected between packed and non-packed
- // repeated fields.
++#pragma GCC diagnostic ignored "-Wundef"
+ #if PROTOBUF_ENABLE_DEBUG_LOGGING_MAY_LEAK_PII
+ #define PROTOBUF_DEBUG true
+ #else