Merge #309297: staging-next 2024-05-05

20 files changed, 327 insertions, 127 deletions

diff --git a/pkgs/tools/X11/xdg-utils/default.nix b/pkgs/tools/X11/xdg-utils/default.nix
index 3cbafa7c97bc9..10604d4acfa0a 100644
--- a/pkgs/tools/X11/xdg-utils/default.nix
+++ b/pkgs/tools/X11/xdg-utils/default.nix
@@ -1,8 +1,9 @@
-{ lib, stdenv, fetchFromGitLab, fetchFromGitHub, writeText
+{ lib, stdenv, fetchurl, fetchFromGitLab, fetchFromGitHub, runCommand, writeText
 # docs deps
 , libxslt, docbook_xml_dtd_412, docbook_xml_dtd_43, docbook_xsl, xmlto
 # runtime deps
 , resholve, bash, coreutils, dbus, file, gawk, glib, gnugrep, gnused, jq, nettools, procmail, procps, which, xdg-user-dirs
+, shared-mime-info
 , perl, perlPackages
 , mimiSupport ? false
 , withXdgOpenUsePortalPatch ? true }:
@@ -121,6 +122,7 @@ let
         "$KTRADER" = true;
       };
       prologue = "${writeText "xdg-mime-prologue" ''
+        export XDG_DATA_DIRS="$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${shared-mime-info}/share"
         export PERL5LIB=${with perlPackages; makePerlPath [ FileMimeInfo ]}
         export PATH=$PATH:${lib.makeBinPath [ coreutils perlPackages.FileMimeInfo ]}
       ''}";
@@ -237,7 +239,7 @@ let
   ];
 in
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (self: {
   pname = "xdg-utils";
   version = "1.2.1";
 
@@ -245,7 +247,7 @@ stdenv.mkDerivation rec {
     domain = "gitlab.freedesktop.org";
     owner = "xdg";
     repo = "xdg-utils";
-    rev = "v${version}";
+    rev = "v${self.version}";
     hash = "sha256-58ElbrVlk+13DUODSEHBPcDDt9H+Kuee8Rz9CIcoy0I=";
   };
 
@@ -269,6 +271,34 @@ stdenv.mkDerivation rec {
 
   preFixup = lib.concatStringsSep "\n" (map (resholve.phraseSolution "xdg-utils-resholved") solutions);
 
+  passthru.tests.xdg-mime = runCommand "xdg-mime-test" {
+    nativeBuildInputs = [ self.finalPackage ];
+    preferLocalBuild = true;
+    xenias = lib.mapAttrsToList (hash: urls: fetchurl { inherit hash urls; }) {
+      "sha256-SL95tM1AjOi7vDnCyT10s0tvQvc+ZSZBbkNOYXfbOy0=" = [
+        "https://staging.cohostcdn.org/attachment/0f5d9832-0cda-4d07-b35f-832b287feb6c/kernelkisser.png"
+        "https://static1.e621.net/data/0e/76/0e7672980d48e48c2d1373eb2505db5a.png"
+      ];
+      "sha256-Si9AtB7J9o6rK/oftv+saST77CNaeWomWU5ECfbRioM=" = [
+        "https://static1.e621.net/data/25/3d/253dc77fbc60d7214bc60e4a647d1c32.jpg"
+      ];
+      "sha256-Z+onQRY5zlDWPp5/y4E6crLz3TaMCNipcxEEMSHuLkM=" = [
+        "https://d.furaffinity.net/art/neotheta/1691409857/1691409857.neotheta_quickmakeanentry_by_neotheta-sig.png"
+        "https://static1.e621.net/data/bf/e4/bfe43ba264ad68e5d8a101ecef69c03e.png"
+      ];
+    };
+  } ''
+    for x in $xenias; do
+      ext=''${x##*.}
+      type="$(xdg-mime query filetype $x)"
+      [ $? -eq 0 ] && [ "$type" = "image/''${ext/jpg/jpeg}" ] || {
+        echo "Incorrect MIME type '$type' for '$x'" >&2
+        exit 1
+      }
+    done
+    touch $out
+  '';
+
   meta = with lib; {
     homepage = "https://www.freedesktop.org/wiki/Software/xdg-utils/";
     description = "A set of command line tools that assist applications with a variety of desktop integration tasks";
@@ -276,4 +306,4 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.eelco ];
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/tools/admin/pulsarctl/default.nix b/pkgs/tools/admin/pulsarctl/default.nix
index 486cdeff021df..3599bcb096117 100644
--- a/pkgs/tools/admin/pulsarctl/default.nix
+++ b/pkgs/tools/admin/pulsarctl/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , installShellFiles
 , nix-update-script
+, go
 , testers
 , pulsarctl
 }:
@@ -22,19 +23,17 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  preBuild = let
-    buildVars = {
-      ReleaseVersion = version;
-      BuildTS = "None";
-      GitHash = src.rev;
-      GitBranch = "None";
-      GoVersion = "$(go version | egrep -o 'go[0-9]+[.][^ ]*')";
-    };
-    buildVarsFlags = lib.concatStringsSep " " (lib.mapAttrsToList (k: v: "-X github.com/streamnative/pulsarctl/pkg/cmdutils.${k}=${v}") buildVars);
-  in
-  ''
-    buildFlagsArray+=("-ldflags=${buildVarsFlags}")
-  '';
+  ldflags =
+    let
+      buildVars = {
+        ReleaseVersion = version;
+        BuildTS = "None";
+        GitHash = src.rev;
+        GitBranch = "None";
+        GoVersion = "go${go.version}";
+      };
+    in
+    (lib.mapAttrsToList (k: v: "-X github.com/streamnative/pulsarctl/pkg/cmdutils.${k}=${v}") buildVars);
 
   excludedPackages = [
     "./pkg/test"
@@ -73,4 +72,3 @@ buildGoModule rec {
     mainProgram = "pulsarctl";
   };
 }
-
diff --git a/pkgs/tools/admin/pulumi/default.nix b/pkgs/tools/admin/pulumi/default.nix
index 3ff4d18d14787..d63bef2a0270c 100644
--- a/pkgs/tools/admin/pulumi/default.nix
+++ b/pkgs/tools/admin/pulumi/default.nix
@@ -53,32 +53,6 @@ buildGoModule rec {
     "-X github.com/pulumi/pulumi/pkg/v3/version.Version=v${version}"
   ];
 
-  doCheck = true;
-
-  disabledTests = [
-    # Flaky test
-    "TestPendingDeleteOrder"
-    # Tries to clone repo: github.com/pulumi/templates.git
-    "TestGenerateOnlyProjectCheck"
-    # Following tests give this error, not quite sure why:
-    #     Error Trace:    /build/pulumi/pkg/engine/lifecycletest/update_plan_test.go:273
-    # Error:          Received unexpected error:
-    #                 Unexpected diag message: <{%reset%}>using pulumi-resource-pkgA from $PATH at /build/tmp.bS8caxmTx7/pulumi-resource-pkgA<{%reset%}>
-    # Test:           TestUnplannedDelete
-    "TestExpectedDelete"
-    "TestPlannedInputOutputDifferences"
-    "TestPlannedUpdateChangedStack"
-    "TestExpectedCreate"
-    "TestUnplannedDelete"
-    # Following test gives this  error, not sure why:
-    # --- Expected
-    # +++ Actual
-    # @@ -1 +1 @@
-    # -gcp
-    # +aws
-    "TestPluginMapper_MappedNamesDifferFromPulumiName"
-  ];
-
   nativeCheckInputs = [
     git
   ];
@@ -100,12 +74,39 @@ buildGoModule rec {
     rm codegen/{docs,dotnet,go,nodejs,python,schema}/*_test.go
     rm -R codegen/{dotnet,go,nodejs,python}/gen_program_test
 
-    # Only run tests not marked as disabled
-    buildFlagsArray+=("-run" "[^(${lib.concatStringsSep "|" disabledTests})]")
   '' + lib.optionalString stdenv.isDarwin ''
     export PULUMI_HOME=$(mktemp -d)
   '';
 
+  checkFlags =
+    let
+      disabledTests = [
+        # Flaky test
+        "TestPendingDeleteOrder"
+        # Tries to clone repo: github.com/pulumi/templates.git
+        "TestGenerateOnlyProjectCheck"
+        # Following tests give this error, not quite sure why:
+        #     Error Trace:    /build/pulumi/pkg/engine/lifecycletest/update_plan_test.go:273
+        # Error:          Received unexpected error:
+        #                 Unexpected diag message: <{%reset%}>using pulumi-resource-pkgA from $PATH at /build/tmp.bS8caxmTx7/pulumi-resource-pkgA<{%reset%}>
+        # Test:           TestUnplannedDelete
+        "TestExpectedDelete"
+        "TestPlannedInputOutputDifferences"
+        "TestPlannedUpdateChangedStack"
+        "TestExpectedCreate"
+        "TestUnplannedDelete"
+        # Following test gives this  error, not sure why:
+        # --- Expected
+        # +++ Actual
+        # @@ -1 +1 @@
+        # -gcp
+        # +aws
+        "TestPluginMapper_MappedNamesDifferFromPulumiName"
+        "TestProtect"
+      ];
+    in
+    [ "-skip=^${lib.concatStringsSep "$|^" disabledTests}$" ];
+
   # Allow tests that bind or connect to localhost on macOS.
   __darwinAllowLocalNetworking = true;
 
diff --git a/pkgs/tools/filesystems/gcsfuse/default.nix b/pkgs/tools/filesystems/gcsfuse/default.nix
index 78bf3faacd249..52010d7360022 100644
--- a/pkgs/tools/filesystems/gcsfuse/default.nix
+++ b/pkgs/tools/filesystems/gcsfuse/default.nix
@@ -20,17 +20,15 @@ buildGoModule rec {
 
   ldflags = [ "-s" "-w" "-X main.gcsfuseVersion=${version}" ];
 
-  preCheck =
+  checkFlags =
     let
       skippedTests = [
+        # Disable flaky tests
         "Test_Main"
         "TestFlags"
       ];
     in
-    ''
-      # Disable flaky tests
-      buildFlagsArray+=("-run" "[^(${builtins.concatStringsSep "|" skippedTests})]")
-    '';
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
   postInstall = ''
     ln -s $out/bin/mount_gcsfuse $out/bin/mount.gcsfuse
diff --git a/pkgs/tools/filesystems/go-mtpfs/default.nix b/pkgs/tools/filesystems/go-mtpfs/default.nix
index f3ed4fb6ab98a..cfcbc3c3f5a62 100644
--- a/pkgs/tools/filesystems/go-mtpfs/default.nix
+++ b/pkgs/tools/filesystems/go-mtpfs/default.nix
@@ -18,11 +18,11 @@ buildGoModule rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libusb1 ];
 
-  preCheck = ''
+  checkFlags = [
     # Only run tests under mtp/encoding_test.go
     # Other tests require an Android deviced attached over USB.
-    buildFlagsArray+=("-run" "Test(Encode|Decode|Variant).*")
-  '';
+    "-run=Test(Encode|Decode|Variant)"
+  ];
 
   meta = with lib; {
     description = "A simple FUSE filesystem for mounting Android devices as a MTP device";
diff --git a/pkgs/tools/graphics/wallutils/default.nix b/pkgs/tools/graphics/wallutils/default.nix
index 796baa25b0bf2..e8abeebfec2e8 100644
--- a/pkgs/tools/graphics/wallutils/default.nix
+++ b/pkgs/tools/graphics/wallutils/default.nix
@@ -48,17 +48,19 @@ buildGoModule rec {
 
   ldflags = [ "-s" "-w" ];
 
-  preCheck =
-    let skippedTests = [
-      "TestClosest" # Requiring Wayland or X
-      "TestEveryMinute" # Blocking
-      "TestNewSimpleEvent" # Blocking
-    ]; in
-    ''
-      export XDG_RUNTIME_DIR=`mktemp -d`
+  preCheck = ''
+    export XDG_RUNTIME_DIR=$(mktemp -d)
+  '';
 
-      buildFlagsArray+=("-run" "[^(${builtins.concatStringsSep "|" skippedTests})]")
-    '';
+  checkFlags =
+    let
+      skippedTests = [
+        "TestClosest" # Requiring Wayland or X
+        "TestEveryMinute" # Blocking
+        "TestNewSimpleEvent" # Blocking
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
   meta = {
     description = "Utilities for handling monitors, resolutions, and (timed) wallpapers";
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index efcdce15bf028..2e2f2f1601247 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -54,6 +54,9 @@ stdenv.mkDerivation rec {
     sed '2i echo Skipping rm deep-2 test && exit 77' -i ./tests/rm/deep-2.sh
     sed '2i echo Skipping du long-from-unreadable test && exit 77' -i ./tests/du/long-from-unreadable.sh
 
+    # The test tends to fail on cephfs
+    sed '2i echo Skipping df total-verify test && exit 77' -i ./tests/df/total-verify.sh
+
     # Some target platforms, especially when building inside a container have
     # issues with the inotify test.
     sed '2i echo Skipping tail inotify dir recreate test && exit 77' -i ./tests/tail/inotify-dir-recreate.sh
diff --git a/pkgs/tools/misc/ethtool/default.nix b/pkgs/tools/misc/ethtool/default.nix
index eb1911170beb6..72590420e1a1f 100644
--- a/pkgs/tools/misc/ethtool/default.nix
+++ b/pkgs/tools/misc/ethtool/default.nix
@@ -9,23 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ethtool";
-  version = "6.1";
+  version = "6.7";
 
   src = fetchurl {
     url = "mirror://kernel/software/network/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-xB/Igf+lpAQy0t2CnrRMZKSd7kgucWuqz5Jixk2qj5A=";
+    sha256 = "sha256-w65SawHOTY32x5SrFw3kpBBNER6o2Ns/H9fCX8uQVhk=";
   };
 
-  patches = [
-    # Patch that fixes build with musl libc
-    # NOTE remove on next release, since it is applied in upstream
-    (fetchpatch {
-      name = "Fix-build-with-musl-libc.patch";
-      url = "https://git.kernel.org/pub/scm/network/ethtool/ethtool.git/patch/marvell.c?id=41be533331fc3c6b711dbe532405782d3b8be5d1";
-      sha256 = "sha256-CItvt/eeNJkr1sOzaaHZhAnaybDutL9cT2O6XwQll+M=";
-    })
-  ];
-
   nativeBuildInputs = [
     pkg-config
   ];
diff --git a/pkgs/tools/misc/google-cloud-bigtable-tool/default.nix b/pkgs/tools/misc/google-cloud-bigtable-tool/default.nix
index 3c61159bf9729..6e26aac5284df 100644
--- a/pkgs/tools/misc/google-cloud-bigtable-tool/default.nix
+++ b/pkgs/tools/misc/google-cloud-bigtable-tool/default.nix
@@ -16,9 +16,9 @@ buildGoModule rec {
 
   vendorHash = "sha256-kwvEfvHs6XF84bB3Ss1307OjId0nh/0Imih1fRFdY0M=";
 
-  preCheck = ''
-    buildFlagsArray+="-short"
-  '';
+  checkFlags = [
+    "-short"
+  ];
 
   meta = with lib; {
     description = "Google Cloud Bigtable Tool";
diff --git a/pkgs/tools/misc/google-cloud-sql-proxy/default.nix b/pkgs/tools/misc/google-cloud-sql-proxy/default.nix
index 1043b49820186..3bf76cc5bf3c6 100644
--- a/pkgs/tools/misc/google-cloud-sql-proxy/default.nix
+++ b/pkgs/tools/misc/google-cloud-sql-proxy/default.nix
@@ -18,9 +18,9 @@ buildGo122Module rec {
 
   vendorHash = "sha256-sAVMmDeHXEgQXb/Xi4nXYztXjuykE0TFebkeubMTZ3k=";
 
-  preCheck = ''
-    buildFlagsArray+="-short"
-  '';
+  checkFlags = [
+    "-short"
+  ];
 
   meta = with lib; {
     description = "Utility for ensuring secure connections to Google Cloud SQL instances";
diff --git a/pkgs/tools/misc/infracost/default.nix b/pkgs/tools/misc/infracost/default.nix
index ddec6c3c5d89e..51316f969ec1a 100644
--- a/pkgs/tools/misc/infracost/default.nix
+++ b/pkgs/tools/misc/infracost/default.nix
@@ -24,15 +24,14 @@ buildGoModule rec {
     # want but also limits the tests
     unset subPackages
 
-    # checkFlags aren't correctly passed through via buildGoModule so we use buildFlagsArray
-    # -short only runs the unit-tests tagged short
-    # move to checkFlags after https://github.com/NixOS/nixpkgs/pull/173702
-    buildFlagsArray+="-short"
-
     # remove tests that require networking
     rm cmd/infracost/{breakdown,diff,hcl,run}_test.go
   '';
 
+  checkFlags = [
+    "-short"
+  ];
+
   postInstall = ''
     export INFRACOST_SKIP_UPDATE_CHECK=true
     installShellCompletion --cmd infracost \
diff --git a/pkgs/tools/misc/massren/default.nix b/pkgs/tools/misc/massren/default.nix
index 763c3a2ae3706..a1f1e7027028e 100644
--- a/pkgs/tools/misc/massren/default.nix
+++ b/pkgs/tools/misc/massren/default.nix
@@ -23,7 +23,7 @@ buildGoModule rec {
 
   ldflags = [ "-s" "-w" ];
 
-  preCheck =
+  checkFlags =
     let
       skippedTests = [
         # Possible error about github.com/mattn/go-sqlite3
@@ -31,9 +31,7 @@ buildGoModule rec {
         "Test_processFileActions"
       ];
     in
-    ''
-      buildFlagsArray+=("-run" "[^(${builtins.concatStringsSep "|" skippedTests})]")
-    '';
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
   meta = with lib; {
     description = "Easily rename multiple files using your text editor";
diff --git a/pkgs/tools/misc/wakatime/default.nix b/pkgs/tools/misc/wakatime/default.nix
index 2ce8df19867e9..be311cb2e28ee 100644
--- a/pkgs/tools/misc/wakatime/default.nix
+++ b/pkgs/tools/misc/wakatime/default.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
     "-X github.com/wakatime/wakatime-cli/pkg/version.Version=${version}"
   ];
 
-  preCheck =
+  checkFlags =
     let
       skippedTests = [
         # Tests requiring network
@@ -33,10 +33,7 @@ buildGoModule rec {
         "TestLoadParams_ApiKey_FromVault_Err_Darwin"
       ];
     in
-    ''
-      # Disable tests
-      buildFlagsArray+=("-run" "[^(${builtins.concatStringsSep "|" skippedTests})]")
-    '';
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
   passthru.tests.version = testers.testVersion {
     package = wakatime;
diff --git a/pkgs/tools/networking/corerad/default.nix b/pkgs/tools/networking/corerad/default.nix
index bb0ac8f32176c..4caad92fc489a 100644
--- a/pkgs/tools/networking/corerad/default.nix
+++ b/pkgs/tools/networking/corerad/default.nix
@@ -17,12 +17,8 @@ buildGoModule rec {
   # we fetch the expected tag's timestamp from a file in the root of the
   # repository.
   preBuild = ''
-    buildFlagsArray=(
-      -ldflags="
-        -X github.com/mdlayher/corerad/internal/build.linkTimestamp=$(<.gittagtime)
-        -X github.com/mdlayher/corerad/internal/build.linkVersion=v${version}
-      "
-    )
+    ldflags+=" -X github.com/mdlayher/corerad/internal/build.linkVersion=v${version}"
+    ldflags+=" -X github.com/mdlayher/corerad/internal/build.linkTimestamp=$(<.gittagtime)"
   '';
 
   passthru.tests = {
diff --git a/pkgs/tools/networking/curl/8.7.1-compression-fix.patch b/pkgs/tools/networking/curl/8.7.1-compression-fix.patch
new file mode 100644
index 0000000000000..53747b54c4610
--- /dev/null
+++ b/pkgs/tools/networking/curl/8.7.1-compression-fix.patch
@@ -0,0 +1,168 @@
+From b30d694a027eb771c02a3db0dee0ca03ccab7377 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Thu, 28 Mar 2024 11:08:15 +0100
+Subject: [PATCH] content_encoding: brotli and others, pass through 0-length
+ writes
+
+- curl's transfer handling may write 0-length chunks at the end of the
+  download with an EOS flag. (HTTP/2 does this commonly)
+
+- content encoders need to pass-through such a write and not count this
+  as error in case they are finished decoding
+
+Fixes #13209
+Fixes #13212
+Closes #13219
+---
+ lib/content_encoding.c         | 10 +++++-----
+ tests/http/test_02_download.py | 13 +++++++++++++
+ tests/http/testenv/env.py      |  7 ++++++-
+ tests/http/testenv/httpd.py    | 20 ++++++++++++++++++++
+ 4 files changed, 44 insertions(+), 6 deletions(-)
+
+diff --git a/lib/content_encoding.c b/lib/content_encoding.c
+index c1abf24e8c027c..8e926dd2ecd5ad 100644
+--- a/lib/content_encoding.c
++++ b/lib/content_encoding.c
+@@ -300,7 +300,7 @@ static CURLcode deflate_do_write(struct Curl_easy *data,
+   struct zlib_writer *zp = (struct zlib_writer *) writer;
+   z_stream *z = &zp->z;     /* zlib state structure */
+ 
+-  if(!(type & CLIENTWRITE_BODY))
++  if(!(type & CLIENTWRITE_BODY) || !nbytes)
+     return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
+ 
+   /* Set the compressed input when this function is called */
+@@ -457,7 +457,7 @@ static CURLcode gzip_do_write(struct Curl_easy *data,
+   struct zlib_writer *zp = (struct zlib_writer *) writer;
+   z_stream *z = &zp->z;     /* zlib state structure */
+ 
+-  if(!(type & CLIENTWRITE_BODY))
++  if(!(type & CLIENTWRITE_BODY) || !nbytes)
+     return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
+ 
+   if(zp->zlib_init == ZLIB_INIT_GZIP) {
+@@ -669,7 +669,7 @@ static CURLcode brotli_do_write(struct Curl_easy *data,
+   CURLcode result = CURLE_OK;
+   BrotliDecoderResult r = BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT;
+ 
+-  if(!(type & CLIENTWRITE_BODY))
++  if(!(type & CLIENTWRITE_BODY) || !nbytes)
+     return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
+ 
+   if(!bp->br)
+@@ -762,7 +762,7 @@ static CURLcode zstd_do_write(struct Curl_easy *data,
+   ZSTD_outBuffer out;
+   size_t errorCode;
+ 
+-  if(!(type & CLIENTWRITE_BODY))
++  if(!(type & CLIENTWRITE_BODY) || !nbytes)
+     return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
+ 
+   if(!zp->decomp) {
+@@ -916,7 +916,7 @@ static CURLcode error_do_write(struct Curl_easy *data,
+   (void) buf;
+   (void) nbytes;
+ 
+-  if(!(type & CLIENTWRITE_BODY))
++  if(!(type & CLIENTWRITE_BODY) || !nbytes)
+     return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
+ 
+   failf(data, "Unrecognized content encoding type. "
+diff --git a/tests/http/test_02_download.py b/tests/http/test_02_download.py
+index 4db9c9d36e9ed5..395fc862f2f839 100644
+--- a/tests/http/test_02_download.py
++++ b/tests/http/test_02_download.py
+@@ -394,6 +394,19 @@ def test_02_27_paused_no_cl(self, env: Env, httpd, nghttpx, repeat):
+         r = client.run(args=[url])
+         r.check_exit_code(0)
+ 
++    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
++    def test_02_28_get_compressed(self, env: Env, httpd, nghttpx, repeat, proto):
++        if proto == 'h3' and not env.have_h3():
++            pytest.skip("h3 not supported")
++        count = 1
++        urln = f'https://{env.authority_for(env.domain1brotli, proto)}/data-100k?[0-{count-1}]'
++        curl = CurlClient(env=env)
++        r = curl.http_download(urls=[urln], alpn_proto=proto, extra_args=[
++            '--compressed'
++        ])
++        r.check_exit_code(code=0)
++        r.check_response(count=count, http_status=200)
++
+     def check_downloads(self, client, srcfile: str, count: int,
+                         complete: bool = True):
+         for i in range(count):
+diff --git a/tests/http/testenv/env.py b/tests/http/testenv/env.py
+index a207059dcd57c5..13c5d6bd46ee57 100644
+--- a/tests/http/testenv/env.py
++++ b/tests/http/testenv/env.py
+@@ -129,10 +129,11 @@ def __init__(self):
+         self.htdocs_dir = os.path.join(self.gen_dir, 'htdocs')
+         self.tld = 'http.curl.se'
+         self.domain1 = f"one.{self.tld}"
++        self.domain1brotli = f"brotli.one.{self.tld}"
+         self.domain2 = f"two.{self.tld}"
+         self.proxy_domain = f"proxy.{self.tld}"
+         self.cert_specs = [
+-            CertificateSpec(domains=[self.domain1, 'localhost'], key_type='rsa2048'),
++            CertificateSpec(domains=[self.domain1, self.domain1brotli, 'localhost'], key_type='rsa2048'),
+             CertificateSpec(domains=[self.domain2], key_type='rsa2048'),
+             CertificateSpec(domains=[self.proxy_domain, '127.0.0.1'], key_type='rsa2048'),
+             CertificateSpec(name="clientsX", sub_specs=[
+@@ -376,6 +377,10 @@ def htdocs_dir(self) -> str:
+     def domain1(self) -> str:
+         return self.CONFIG.domain1
+ 
++    @property
++    def domain1brotli(self) -> str:
++        return self.CONFIG.domain1brotli
++
+     @property
+     def domain2(self) -> str:
+         return self.CONFIG.domain2
+diff --git a/tests/http/testenv/httpd.py b/tests/http/testenv/httpd.py
+index c04c22699a62c4..b8615875a9a558 100644
+--- a/tests/http/testenv/httpd.py
++++ b/tests/http/testenv/httpd.py
+@@ -50,6 +50,7 @@ class Httpd:
+         'alias', 'env', 'filter', 'headers', 'mime', 'setenvif',
+         'socache_shmcb',
+         'rewrite', 'http2', 'ssl', 'proxy', 'proxy_http', 'proxy_connect',
++        'brotli',
+         'mpm_event',
+     ]
+     COMMON_MODULES_DIRS = [
+@@ -203,6 +204,7 @@ def _mkpath(self, path):
+ 
+     def _write_config(self):
+         domain1 = self.env.domain1
++        domain1brotli = self.env.domain1brotli
+         creds1 = self.env.get_credentials(domain1)
+         domain2 = self.env.domain2
+         creds2 = self.env.get_credentials(domain2)
+@@ -285,6 +287,24 @@ def _write_config(self):
+                 f'</VirtualHost>',
+                 f'',
+             ])
++            # Alternate to domain1 with BROTLI compression
++            conf.extend([  # https host for domain1, h1 + h2
++                f'<VirtualHost *:{self.env.https_port}>',
++                f'    ServerName {domain1brotli}',
++                f'    Protocols h2 http/1.1',
++                f'    SSLEngine on',
++                f'    SSLCertificateFile {creds1.cert_file}',
++                f'    SSLCertificateKeyFile {creds1.pkey_file}',
++                f'    DocumentRoot "{self._docs_dir}"',
++                f'    SetOutputFilter BROTLI_COMPRESS',
++            ])
++            conf.extend(self._curltest_conf(domain1))
++            if domain1 in self._extra_configs:
++                conf.extend(self._extra_configs[domain1])
++            conf.extend([
++                f'</VirtualHost>',
++                f'',
++            ])
+             conf.extend([  # https host for domain2, no h2
+                 f'<VirtualHost *:{self.env.https_port}>',
+                 f'    ServerName {domain2}',
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 6559a5cf4ecb0..0bd65a307b0b7 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -59,6 +59,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-b+oqrGpGEPvQQAr7C83b5yWKZMY/H2jlhV68DGWXEM0=";
   };
 
+  patches = lib.optionals (lib.versionOlder finalAttrs.version "8.7.2") [
+    # https://github.com/curl/curl/pull/13219
+    # https://github.com/newsboat/newsboat/issues/2728
+    ./8.7.1-compression-fix.patch
+  ];
+
   postPatch = ''
     patchShebangs scripts
   '';
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index b078ee737bd95..115cb10c014e5 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -61,6 +61,9 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace src/Makefile.am \
       --replace-fail "noinst_PROGRAMS = testpcsc pcsc-wirecheck pcsc-wirecheck-gen" \
                      "noinst_PROGRAMS = testpcsc"
+  '' + ''
+    substituteInPlace src/libredirect.c src/spy/libpcscspy.c \
+      --replace-fail "libpcsclite_real.so.1" "$lib/lib/libpcsclite_real.so.1"
   '';
 
   postInstall = ''
diff --git a/pkgs/tools/security/yara/default.nix b/pkgs/tools/security/yara/default.nix
index 36a77102eb432..26eea76f016be 100644
--- a/pkgs/tools/security/yara/default.nix
+++ b/pkgs/tools/security/yara/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 , pcre
 , pkg-config
@@ -24,6 +25,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-AecHsUBtBleUkWuYMQ4Tx/PY8cs9j7JwqncBziJD0hA=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "LFS64.patch";
+      url = "https://github.com/VirusTotal/yara/commit/833a580430abe0fbc9bc17a21fb95bf36dacf367.patch";
+      hash = "sha256-EmwyDsxaNd9zfpAOu6ZB9kzg04qB7LAD7UJB3eAuKd8=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
diff --git a/pkgs/tools/system/skeema/default.nix b/pkgs/tools/system/skeema/default.nix
index 68d1a1c627b39..a7503baac14b5 100644
--- a/pkgs/tools/system/skeema/default.nix
+++ b/pkgs/tools/system/skeema/default.nix
@@ -17,32 +17,35 @@ buildGoModule rec {
 
   ldflags = [ "-s" "-w" ];
 
-  preCheck =
+  preCheck = ''
+    # Fix tests expecting /usr/bin/printf and /bin/echo
+    substituteInPlace skeema_cmd_test.go \
+      --replace /usr/bin/printf "${coreutils}/bin/printf"
+
+    substituteInPlace internal/fs/dir_test.go \
+      --replace /bin/echo "${coreutils}/bin/echo" \
+      --replace /usr/bin/printf "${coreutils}/bin/printf"
+
+    substituteInPlace internal/applier/ddlstatement_test.go \
+      --replace /bin/echo "${coreutils}/bin/echo"
+  '';
+
+  checkFlags =
     let
       skippedTests = [
         # Tests requiring network access to gitlab.com
         "TestDirRelPath"
-        "TestParseDirSymlinks"
+        "TestParseDir"
 
         # Flaky tests
         "TestCommandTimeout"
         "TestShellOutTimeout"
+
+        # Fails with 'internal/fs/testdata/cfgsymlinks1/validrel/.skeema is a symlink pointing outside of its repo'.
+        "TestParseDirSymlinks"
       ];
     in
-    ''
-      buildFlagsArray+=("-run" "[^(${builtins.concatStringsSep "|" skippedTests})]")
-
-      # Fix tests expecting /usr/bin/printf and /bin/echo
-      substituteInPlace skeema_cmd_test.go \
-        --replace /usr/bin/printf "${coreutils}/bin/printf"
-
-      substituteInPlace internal/fs/dir_test.go \
-        --replace /bin/echo "${coreutils}/bin/echo" \
-        --replace /usr/bin/printf "${coreutils}/bin/printf"
-
-      substituteInPlace internal/applier/ddlstatement_test.go \
-        --replace /bin/echo "${coreutils}/bin/echo"
-    '';
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
   passthru.tests.version = testers.testVersion {
     package = skeema;
diff --git a/pkgs/tools/text/gucci/default.nix b/pkgs/tools/text/gucci/default.nix
index 324dc56ca264d..2f448450661bd 100644
--- a/pkgs/tools/text/gucci/default.nix
+++ b/pkgs/tools/text/gucci/default.nix
@@ -19,15 +19,14 @@ buildGoModule rec {
     package = gucci;
   };
 
-  checkFlags = [ "-short" ];
-
-  # Integration tests rely on Ginkgo but fail.
-  # Related: https://github.com/onsi/ginkgo/issues/602
-  #
-  # Disable integration tests.
-  preCheck = ''
-    buildFlagsArray+=("-run" "[^(TestIntegration)]")
-  '';
+  checkFlags = [
+    "-short"
+    # Integration tests rely on Ginkgo but fail.
+    # Related: https://github.com/onsi/ginkgo/issues/602
+    #
+    # Disable integration tests.
+    "-skip=^TestIntegration"
+  ];
 
   meta = with lib; {
     description = "A simple CLI templating tool written in golang";