Merge pull request #152145 from NixOS/staging-next

16 files changed, 196 insertions, 78 deletions

diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index 754b2e8cea6ab..49762e3278c87 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -1,5 +1,6 @@
 { lib
 , python3
+, fetchFromGitHub
 , groff
 , less
 }:
@@ -14,17 +15,31 @@ let
           sha256 = "189n8hpijy14jfan4ha9f5n06mnl33cxz7ay92wjqgkr639s0vg9";
         };
       });
+      pyyaml = super.pyyaml.overridePythonAttrs (oldAttrs: rec {
+        version = "5.4.1";
+        src = fetchFromGitHub {
+          owner = "yaml";
+          repo = "pyyaml";
+          rev = version;
+          hash = "sha256-VUqnlOF/8zSOqh6JoEYOsfQ0P4g+eYqxyFTywgCS7gM=";
+        };
+        checkPhase = ''
+          runHook preCheck
+          PYTHONPATH="tests/lib3:$PYTHONPATH" ${self.python.interpreter} -m test_all
+          runHook postCheck
+        '';
+      });
     };
   };
 
 in
 with py.pkgs; buildPythonApplication rec {
   pname = "awscli";
-  version = "1.22.14"; # N.B: if you change this, change botocore and boto3 to a matching version too
+  version = "1.22.21"; # N.B: if you change this, change botocore and boto3 to a matching version too
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-FTGtUqdjZel8XqSrO3s3XQNqR6fyTO3mc1gyIQfk9n8=";
+    hash = "sha256-yzfy6MjXC6LeydLNVXQvcK4UmpVQP/jJ+W2jMgpNMgw=";
   };
 
   # https://github.com/aws/aws-cli/issues/4837
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index e6809b474ea2f..befe53b9d907a 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -33,6 +33,9 @@ stdenv.mkDerivation (rec {
     ./fix-chmod-exit-code.patch
     # Workaround for https://debbugs.gnu.org/cgi/bugreport.cgi?bug=51433
     ./disable-seek-hole.patch
+    # Workaround for https://debbugs.gnu.org/cgi/bugreport.cgi?bug=52330
+    # This patch can be dropped, once we upgrade to the next coreutils version after 9.0
+    ./fix-arm64-macos.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/tools/misc/coreutils/fix-arm64-macos.patch b/pkgs/tools/misc/coreutils/fix-arm64-macos.patch
new file mode 100644
index 0000000000000..d8880b23dcbfc
--- /dev/null
+++ b/pkgs/tools/misc/coreutils/fix-arm64-macos.patch
@@ -0,0 +1,124 @@
+diff --git a/src/uname.c b/src/uname.c
+index ae9b8e29d..e84fc477a 100644
+--- a/src/uname.c
++++ b/src/uname.c
+@@ -27,7 +27,7 @@
+ # include <sys/systeminfo.h>
+ #endif
+ 
+-#if HAVE_SYS_SYSCTL_H && ! defined __GLIBC__
++#if HAVE_SYS_SYSCTL_H && ! defined __GLIBC__ && ! defined __APPLE__
+ # if HAVE_SYS_PARAM_H
+ #  include <sys/param.h> /* needed for OpenBSD 3.0 */
+ # endif
+@@ -44,11 +44,6 @@
+ # endif
+ #endif
+ 
+-#ifdef __APPLE__
+-# include <mach/machine.h>
+-# include <mach-o/arch.h>
+-#endif
+-
+ #include "system.h"
+ #include "die.h"
+ #include "error.h"
+@@ -167,6 +162,24 @@ print_element (char const *element)
+   fputs (element, stdout);
+ }
+ 
++/* Print ELEMENT, preceded by a space if something has already been
++   printed.  But if the environment variable ENVVAR is set, print its
++   value instead of ELEMENT.  */
++
++static void
++print_element_env (char const *element, char const *envvar)
++{
++#ifdef __APPLE__
++  if (envvar)
++    {
++      char const *val = getenv (envvar);
++      if (val)
++        element = val;
++    }
++#endif
++  print_element (element);
++}
++
+ 
+ /* Set all the option flags according to the switches specified.
+    Return the mask indicating which elements to print.  */
+@@ -287,26 +300,36 @@ main (int argc, char **argv)
+         die (EXIT_FAILURE, errno, _("cannot get system name"));
+ 
+       if (toprint & PRINT_KERNEL_NAME)
+-        print_element (name.sysname);
++        print_element_env (name.sysname, "UNAME_SYSNAME");
+       if (toprint & PRINT_NODENAME)
+-        print_element (name.nodename);
++        print_element_env (name.nodename, "UNAME_NODENAME");
+       if (toprint & PRINT_KERNEL_RELEASE)
+-        print_element (name.release);
++        print_element_env (name.release, "UNAME_RELEASE");
+       if (toprint & PRINT_KERNEL_VERSION)
+-        print_element (name.version);
++        print_element_env (name.version, "UNAME_VERSION");
+       if (toprint & PRINT_MACHINE)
+-        print_element (name.machine);
++        print_element_env (name.machine, "UNAME_MACHINE");
+     }
+ 
+   if (toprint & PRINT_PROCESSOR)
+     {
+       char const *element = unknown;
++#ifdef __APPLE__
++# if defined __arm__ || defined __arm64__
++      element = "arm";
++# elif defined __i386__ || defined __x86_64__
++      element = "i386";
++# elif defined __ppc__ || defined __ppc64__
++      element = "powerpc";
++# endif
++#endif
+ #if HAVE_SYSINFO && defined SI_ARCHITECTURE
+-      {
+-        static char processor[257];
+-        if (0 <= sysinfo (SI_ARCHITECTURE, processor, sizeof processor))
+-          element = processor;
+-      }
++      if (element == unknown)
++        {
++          static char processor[257];
++          if (0 <= sysinfo (SI_ARCHITECTURE, processor, sizeof processor))
++            element = processor;
++        }
+ #endif
+ #ifdef UNAME_PROCESSOR
+       if (element == unknown)
+@@ -316,26 +339,6 @@ main (int argc, char **argv)
+           static int mib[] = { CTL_HW, UNAME_PROCESSOR };
+           if (sysctl (mib, 2, processor, &s, 0, 0) >= 0)
+             element = processor;
+-
+-# ifdef __APPLE__
+-          /* This kludge works around a bug in Mac OS X.  */
+-          if (element == unknown)
+-            {
+-              cpu_type_t cputype;
+-              size_t cs = sizeof cputype;
+-              NXArchInfo const *ai;
+-              if (sysctlbyname ("hw.cputype", &cputype, &cs, NULL, 0) == 0
+-                  && (ai = NXGetArchInfoFromCpuType (cputype,
+-                                                     CPU_SUBTYPE_MULTIPLE))
+-                  != NULL)
+-                element = ai->name;
+-
+-              /* Hack "safely" around the ppc vs. powerpc return value. */
+-              if (cputype == CPU_TYPE_POWERPC
+-                  && STRNCMP_LIT (element, "ppc") == 0)
+-                element = "powerpc";
+-            }
+-# endif
+         }
+ #endif
+       if (! (toprint == UINT_MAX && element == unknown))
diff --git a/pkgs/tools/networking/dnsmasq/default.nix b/pkgs/tools/networking/dnsmasq/default.nix
index 131a645d838c7..b746bf557c1aa 100644
--- a/pkgs/tools/networking/dnsmasq/default.nix
+++ b/pkgs/tools/networking/dnsmasq/default.nix
@@ -13,11 +13,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "dnsmasq";
-  version = "2.85";
+  version = "2.86";
 
   src = fetchurl {
     url = "https://www.thekelleys.org.uk/dnsmasq/${pname}-${version}.tar.xz";
-    sha256 = "sha256-rZjTgD32h+W5OAgPPSXGKP5ByHh1LQP7xhmXh/7jEvo=";
+    sha256 = "sha256-KNUs/J4gBKxPhSdPUrMuFke028l2G4Ln3h5BxJkH6wg=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
diff --git a/pkgs/tools/networking/networkmanager/tray.nix b/pkgs/tools/networking/networkmanager/tray.nix
index e8ce8ad342fdc..ea9ff73b4e332 100644
--- a/pkgs/tools/networking/networkmanager/tray.nix
+++ b/pkgs/tools/networking/networkmanager/tray.nix
@@ -1,4 +1,4 @@
-{ lib, mkDerivation, fetchFromGitHub, cmake, qttools, qtbase, networkmanager-qt, modemmanager-qt }:
+{ lib, mkDerivation, fetchFromGitHub, cmake, pkg-config, qttools, qtbase, networkmanager-qt, modemmanager-qt }:
 
 mkDerivation rec {
   pname = "nm-tray";
@@ -15,7 +15,7 @@ mkDerivation rec {
     sed -i -e '1i#include <QMetaEnum>' src/nmmodel.cpp
   '';
 
-  nativeBuildInputs = [ cmake qttools ];
+  nativeBuildInputs = [ cmake pkg-config qttools ];
 
   cmakeFlags = [ "-DWITH_MODEMMANAGER_SUPPORT=ON" ];
 
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index f9ff82735b901..1d3f6b3b9f61a 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -40,11 +40,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unbound";
-  version = "1.13.2";
+  version = "1.14.0";
 
   src = fetchurl {
     url = "https://nlnetlabs.nl/downloads/unbound/unbound-${version}.tar.gz";
-    sha256 = "sha256-ChO1R/O5KgJrXr0EI/VMmR5XGAN/2fckRYF/agQOGoM=";
+    sha256 = "sha256-bvkcvwLVKZ6rOTKMCFc5Pee0iFov5yM93+PBJP9aicg=";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 146b9311fca68..4cf6ef23b6543 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -44,7 +44,7 @@ common =
         [ "out" "dev" ]
         ++ lib.optionals enableDocumentation [ "man" "doc" ];
 
-      hardeningEnable = [ "pie" ];
+      hardeningEnable = lib.optionals (!stdenv.isDarwin) [ "pie" ];
 
       nativeBuildInputs =
         [ pkg-config ]
diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/23.nix
index 83b04a9fe790b..f818dc7f11b0c 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/23.nix
@@ -3,10 +3,10 @@
 
 # Each of the dependencies below are optional.
 # Gnupg can be built without them at the cost of reduced functionality.
-, guiSupport ? true, enableMinimal ? false
-, adns ? null , bzip2 ? null , gnutls ? null , libusb1 ? null , openldap ? null
-, pcsclite ? null , pinentry ? null , readline ? null , sqlite ? null , zlib ?
-null
+, guiSupport ? stdenv.isDarwin, enableMinimal ? false
+, adns ? null, bzip2 ? null , gnutls ? null , libusb1 ? null , openldap ? null
+, tpm2-tss ? null
+, pcsclite ? null , pinentry ? null , readline ? null , sqlite ? null , zlib ? null
 }:
 
 with lib;
@@ -15,12 +15,11 @@ assert guiSupport -> pinentry != null && enableMinimal == false;
 
 stdenv.mkDerivation rec {
   pname = "gnupg";
-
-  version = "2.2.27";
+  version = "2.3.3";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    sha256 = "1693s2rp9sjwvdslj94n03wnb6rxysjy0dli0q1698af044h1ril";
+    sha256 = "0dz9x0r5021bhk1kjh29m1q13xbslwb8yn9qzcp7b9m1lrnvi2ap";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -28,11 +27,10 @@ stdenv.mkDerivation rec {
   buildInputs = [
     libgcrypt libassuan libksba libiconv npth gettext
     readline libusb1 gnutls adns openldap zlib bzip2 sqlite
-  ];
+  ] ++ optional (!stdenv.isDarwin) tpm2-tss ;
 
   patches = [
     ./fix-libusb-include-path.patch
-    ./0001-dirmngr-Only-use-SKS-pool-CA-for-SKS-pool.patch
     ./tests-add-test-cases-for-import-without-uid.patch
     ./allow-import-of-previously-known-keys-even-without-UI.patch
     ./accept-subkeys-with-a-good-revocation-but-no-self-sig.patch
@@ -42,7 +40,7 @@ stdenv.mkDerivation rec {
     # Fix broken SOURCE_DATE_EPOCH usage - remove on the next upstream update
     sed -i 's/$SOURCE_DATE_EPOCH/''${SOURCE_DATE_EPOCH}/' doc/Makefile.am
     sed -i 's/$SOURCE_DATE_EPOCH/''${SOURCE_DATE_EPOCH}/' doc/Makefile.in
-  '' + lib.optionalString ( stdenv.isLinux && pcsclite != null) ''
+  '' + lib.optionalString (stdenv.isLinux && pcsclite != null) ''
     sed -i 's,"libpcsclite\.so[^"]*","${lib.getLib pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c
   '';
 
@@ -53,12 +51,12 @@ stdenv.mkDerivation rec {
     "--with-libassuan-prefix=${libassuan.dev}"
     "--with-ksba-prefix=${libksba.dev}"
     "--with-npth-prefix=${npth}"
-  ] ++ optional guiSupport "--with-pinentry-pgm=${pinentry}/${pinentryBinaryPath}";
-
+  ] ++ optional guiSupport "--with-pinentry-pgm=${pinentry}/${pinentryBinaryPath}"
+  ++ optional ( (!stdenv.isDarwin) && (tpm2-tss != null) ) "--with-tss=intel";
   postInstall = if enableMinimal
   then ''
     rm -r $out/{libexec,sbin,share}
-    for f in `find $out/bin -type f -not -name gpg`
+    for f in $(find $out/bin -type f -not -name gpg)
     do
       rm $f
     done
@@ -73,12 +71,17 @@ stdenv.mkDerivation rec {
     ln -s $out/bin/gpg $out/bin/gpg2
 
     # Make libexec tools available in PATH
-    ln -s -t $out/bin $out/libexec/*
+    for f in $out/libexec/; do
+      if [[ "$(basename $f)" == "gpg-wks-client" ]]; then continue; fi
+      ln -s $f $out/bin/$(basename $f)
+    done
   '';
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     homepage = "https://gnupg.org";
-    description = "Modern (2.1) release of the GNU Privacy Guard, a GPL OpenPGP implementation";
+    description = "Modern release of the GNU Privacy Guard, a GPL OpenPGP implementation";
     license = licenses.gpl3Plus;
     longDescription = ''
       The GNU Privacy Guard is the GNU project's complete and free
diff --git a/pkgs/tools/security/gnupg/allow-import-of-previously-known-keys-even-without-UI.patch b/pkgs/tools/security/gnupg/allow-import-of-previously-known-keys-even-without-UI.patch
index 723a6952044e6..98dda54fc7fa3 100644
--- a/pkgs/tools/security/gnupg/allow-import-of-previously-known-keys-even-without-UI.patch
+++ b/pkgs/tools/security/gnupg/allow-import-of-previously-known-keys-even-without-UI.patch
@@ -17,10 +17,10 @@ Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
  1 file changed, 11 insertions(+), 33 deletions(-)
 
 diff --git a/g10/import.c b/g10/import.c
-index 95d419a..4fdf248 100644
+index 5d3162c..f9acf95 100644
 --- a/g10/import.c
 +++ b/g10/import.c
-@@ -1792,7 +1792,6 @@ import_one_real (ctrl_t ctrl,
+@@ -1788,7 +1788,6 @@ import_one_real (ctrl_t ctrl,
    size_t an;
    char pkstrbuf[PUBKEY_STRING_SIZE];
    int merge_keys_done = 0;
@@ -28,12 +28,12 @@ index 95d419a..4fdf248 100644
    KEYDB_HANDLE hd = NULL;
  
    if (r_valid)
-@@ -1829,14 +1828,6 @@ import_one_real (ctrl_t ctrl,
+@@ -1825,14 +1824,6 @@ import_one_real (ctrl_t ctrl,
        log_printf ("\n");
      }
  
 -
--  if (!uidnode )
+-  if (!uidnode)
 -    {
 -      if (!silent)
 -        log_error( _("key %s: no user ID\n"), keystr_from_pk(pk));
@@ -43,16 +43,17 @@ index 95d419a..4fdf248 100644
    if (screener && screener (keyblock, screener_arg))
      {
        log_error (_("key %s: %s\n"), keystr_from_pk (pk),
-@@ -1911,17 +1902,10 @@ import_one_real (ctrl_t ctrl,
+@@ -1907,18 +1898,10 @@ import_one_real (ctrl_t ctrl,
  	  }
      }
  
--  if (!delete_inv_parts (ctrl, keyblock, keyid, options ) )
+-  /* Delete invalid parts and bail out if there are no user ids left.  */
+-  if (!delete_inv_parts (ctrl, keyblock, keyid, options))
 -    {
 -      if (!silent)
 -        {
--          log_error( _("key %s: no valid user IDs\n"), keystr_from_pk(pk));
--          if (!opt.quiet )
+-          log_error ( _("key %s: no valid user IDs\n"), keystr_from_pk(pk));
+-          if (!opt.quiet)
 -            log_info(_("this may be caused by a missing self-signature\n"));
 -        }
 -      stats->no_user_id++;
@@ -65,7 +66,7 @@ index 95d419a..4fdf248 100644
  
    /* Get rid of deleted nodes.  */
    commit_kbnode (&keyblock);
-@@ -1931,24 +1915,11 @@ import_one_real (ctrl_t ctrl,
+@@ -1927,24 +1911,11 @@ import_one_real (ctrl_t ctrl,
      {
        apply_keep_uid_filter (ctrl, keyblock, import_filter.keep_uid);
        commit_kbnode (&keyblock);
@@ -90,7 +91,7 @@ index 95d419a..4fdf248 100644
      }
  
    /* The keyblock is valid and ready for real import.  */
-@@ -2006,6 +1977,13 @@ import_one_real (ctrl_t ctrl,
+@@ -2002,6 +1973,13 @@ import_one_real (ctrl_t ctrl,
        err = 0;
        stats->skipped_new_keys++;
      }
diff --git a/pkgs/tools/security/gnupg/fix-libusb-include-path.patch b/pkgs/tools/security/gnupg/fix-libusb-include-path.patch
index a5432f8e3d95d..f20249b1cad16 100644
--- a/pkgs/tools/security/gnupg/fix-libusb-include-path.patch
+++ b/pkgs/tools/security/gnupg/fix-libusb-include-path.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -8987,8 +8987,7 @@
+@@ -9281,8 +9281,7 @@ fi
     { $as_echo "$as_me:${as_lineno-$LINENO}: checking libusb include dir" >&5
  $as_echo_n "checking libusb include dir... " >&6; }
     usb_incdir_found="no"
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index 1488e6561c9a6..db3ddd167a604 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pcsclite";
-  version = "1.9.4";
+  version = "1.9.5";
 
   outputs = [ "bin" "out" "dev" "doc" "man" ];
 
   src = fetchurl {
     url = "https://pcsclite.apdu.fr/files/pcsc-lite-${version}.tar.bz2";
-    sha256 = "sha256:0jqwnpywk9ka3q88b1k93p8s0xhmx1isdpcqa80nd8p04z1am34a";
+    sha256 = "sha256:024x0hadn0kc0m9yz3l2pqzc5mdqyza9lmckg0bn4xak6frzkqwy";
   };
 
   patches = [ ./no-dropdir-literals.patch ];
diff --git a/pkgs/tools/security/pcsclite/no-dropdir-literals.patch b/pkgs/tools/security/pcsclite/no-dropdir-literals.patch
index 6e6734c954329..4c6d5554d77a1 100644
--- a/pkgs/tools/security/pcsclite/no-dropdir-literals.patch
+++ b/pkgs/tools/security/pcsclite/no-dropdir-literals.patch
@@ -1,8 +1,8 @@
 diff --git a/src/hotplug_libudev.c b/src/hotplug_libudev.c
-index a8ba1b8..a53700b 100644
+index 51bd95f..84f959b 100644
 --- a/src/hotplug_libudev.c
 +++ b/src/hotplug_libudev.c
-@@ -119,7 +119,8 @@ static LONG HPReadBundleValues(void)
+@@ -120,7 +120,8 @@ static LONG HPReadBundleValues(void)
  
  	if (NULL == hpDir)
  	{
@@ -12,7 +12,7 @@ index a8ba1b8..a53700b 100644
  		Log1(PCSC_LOG_ERROR, "Disabling USB support for pcscd.");
  		return -1;
  	}
-@@ -722,7 +723,7 @@ ULONG HPRegisterForHotplugEvents(void)
+@@ -741,7 +742,7 @@ ULONG HPRegisterForHotplugEvents(void)
  
  	if (driverSize <= 0)
  	{
@@ -22,10 +22,10 @@ index a8ba1b8..a53700b 100644
  		Log1(PCSC_LOG_INFO, "Disabling USB support for pcscd");
  		return 0;
 diff --git a/src/hotplug_libusb.c b/src/hotplug_libusb.c
-index eff8519..8dd496d 100644
+index 0ada9f5..d49a407 100644
 --- a/src/hotplug_libusb.c
 +++ b/src/hotplug_libusb.c
-@@ -138,7 +138,8 @@ static LONG HPReadBundleValues(void)
+@@ -142,7 +142,8 @@ static LONG HPReadBundleValues(void)
  
  	if (hpDir == NULL)
  	{
@@ -35,7 +35,7 @@ index eff8519..8dd496d 100644
  		Log1(PCSC_LOG_ERROR, "Disabling USB support for pcscd.");
  		return -1;
  	}
-@@ -265,7 +266,8 @@ static LONG HPReadBundleValues(void)
+@@ -282,7 +283,8 @@ static LONG HPReadBundleValues(void)
  
  	if (driverSize == 0)
  	{
@@ -45,29 +45,3 @@ index eff8519..8dd496d 100644
  		Log1(PCSC_LOG_INFO, "Disabling USB support for pcscd");
  	}
  #ifdef DEBUG_HOTPLUG
-diff --git a/src/hotplug_linux.c b/src/hotplug_linux.c
-index bf69af8..64b0ed7 100644
---- a/src/hotplug_linux.c
-+++ b/src/hotplug_linux.c
-@@ -130,8 +130,8 @@ static LONG HPReadBundleValues(void)
- 
- 	if (hpDir == NULL)
- 	{
--		Log1(PCSC_LOG_INFO,
--			"Cannot open PC/SC drivers directory: " PCSCLITE_HP_DROPDIR);
-+		Log2(PCSC_LOG_INFO, "Cannot open PC/SC drivers directory: %s",
-+			PCSCLITE_HP_DROPDIR);
- 		Log1(PCSC_LOG_INFO, "Disabling USB support for pcscd.");
- 		return -1;
- 	}
-@@ -219,8 +219,8 @@ end:
- 
- 	if (bundleSize == 0)
- 	{
--		Log1(PCSC_LOG_INFO,
--			"No bundle files in pcsc drivers directory: " PCSCLITE_HP_DROPDIR);
-+		Log2(PCSC_LOG_INFO, "No bundle files in pcsc drivers directory: %s",
-+			PCSCLITE_HP_DROPDIR);
- 		Log1(PCSC_LOG_INFO, "Disabling USB support for pcscd");
- 	}
- 
diff --git a/pkgs/tools/security/stoken/default.nix b/pkgs/tools/security/stoken/default.nix
index f5f733d70b91b..04e47dcb84098 100644
--- a/pkgs/tools/security/stoken/default.nix
+++ b/pkgs/tools/security/stoken/default.nix
@@ -20,9 +20,9 @@ stdenv.mkDerivation rec {
     autoconf
   '';
 
-  nativeBuildInputs = [ pkg-config ];
+  strictDeps = true;
+  nativeBuildInputs = [ pkg-config autoconf automake libtool ];
   buildInputs = [
-    autoconf automake libtool
     libxml2 nettle
   ] ++ lib.optional withGTK3 gtk3;
 
diff --git a/pkgs/tools/typesetting/xmlroff/default.nix b/pkgs/tools/typesetting/xmlroff/default.nix
index 61355910d5995..cd1a97c2da603 100644
--- a/pkgs/tools/typesetting/xmlroff/default.nix
+++ b/pkgs/tools/typesetting/xmlroff/default.nix
@@ -4,7 +4,6 @@
 , libxml2
 , libxslt
 , pango
-, pangoxsl
 , perl
 , pkg-config
 , popt
@@ -26,7 +25,6 @@ stdenv.mkDerivation rec {
     libxml2
     libxslt
     pango
-    pangoxsl
     gtk2
     popt
   ];
diff --git a/pkgs/tools/video/mjpegtools/default.nix b/pkgs/tools/video/mjpegtools/default.nix
index 29dad791bc692..77c187a48a613 100644
--- a/pkgs/tools/video/mjpegtools/default.nix
+++ b/pkgs/tools/video/mjpegtools/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mjpegtools";
-  version = "2.1.0";
+  version = "2.2.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/mjpeg/mjpegtools-${version}.tar.gz";
-    sha256 = "01y4xpfdvd4zgv6fmcjny9mr1gbfd4y2i4adp657ydw6fqyi8kw6";
+    sha256 = "sha256-sYBTbX2ZYLBeACOhl7ANyxAJKaSaq3HRnVX0obIQ9Jo=";
   };
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index bbf1e81a83d31..e35057fb888fa 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -4,14 +4,14 @@ let
   rustTargetPlatformSpec = rust.toRustTargetSpec stdenv.hostPlatform;
 in rustPlatform.buildRustPackage rec {
   pname = "rav1e";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-9fBAH1vuLJ3yu8X5+CQGLQFDlzTYoFBUTy3Muo6hLkw=";
+    sha256 = "sha256-3g2wqQJk26KUfzmneKdTxfNSRI/ioMa5MR6AEeR7eKs=";
   };
 
-  cargoSha256 = "sha256-QhWVqHcNjJF94uTvHGVnV8MTp2bYOuCEjaMBfViOLRo=";
+  cargoSha256 = "sha256-sPUAWQj8UDHV7IvYnerASltSPPGVB7f1tThqFYBu6t4=";
 
   nativeBuildInputs = [ nasm cargo-c ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];