about summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/audio/chuck/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/providers.json26
-rw-r--r--pkgs/applications/networking/n8n/node-packages.nix517
-rw-r--r--pkgs/applications/video/haruna/default.nix4
-rw-r--r--pkgs/data/fonts/fraunces/default.nix32
-rw-r--r--pkgs/data/fonts/galatia-sil/default.nix48
-rw-r--r--pkgs/data/fonts/gentium-book-basic/default.nix36
-rw-r--r--pkgs/data/fonts/gentium/default.nix42
-rw-r--r--pkgs/data/fonts/hack/default.nix30
-rw-r--r--pkgs/data/fonts/hasklig/default.nix29
-rw-r--r--pkgs/data/fonts/hyperscrypt/default.nix35
-rw-r--r--pkgs/data/fonts/ibm-plex/default.nix27
-rw-r--r--pkgs/data/fonts/inter/default.nix31
-rw-r--r--pkgs/data/fonts/ipaexfont/default.nix28
-rw-r--r--pkgs/data/fonts/ipafont/default.nix28
-rw-r--r--pkgs/data/fonts/jost/default.nix29
-rw-r--r--pkgs/data/fonts/julia-mono/default.nix4
-rw-r--r--pkgs/data/fonts/kawkab-mono/default.nix29
-rw-r--r--pkgs/data/fonts/lato/default.nix29
-rw-r--r--pkgs/data/fonts/lmmath/default.nix34
-rw-r--r--pkgs/data/fonts/mno16/default.nix27
-rw-r--r--pkgs/data/fonts/mononoki/default.nix30
-rw-r--r--pkgs/data/fonts/nanum-gothic-coding/default.nix33
-rw-r--r--pkgs/data/fonts/national-park/default.nix29
-rw-r--r--pkgs/data/fonts/norwester/default.nix31
-rw-r--r--pkgs/data/fonts/oldstandard/default.nix32
-rw-r--r--pkgs/data/fonts/open-dyslexic/default.nix32
-rw-r--r--pkgs/data/fonts/overpass/default.nix33
-rw-r--r--pkgs/data/fonts/paratype-pt/mono.nix37
-rw-r--r--pkgs/data/fonts/paratype-pt/sans.nix37
-rw-r--r--pkgs/data/fonts/paratype-pt/serif.nix37
-rw-r--r--pkgs/data/fonts/public-sans/default.nix31
-rw-r--r--pkgs/data/fonts/quattrocento-sans/default.nix34
-rw-r--r--pkgs/data/fonts/quattrocento/default.nix33
-rw-r--r--pkgs/data/fonts/roboto/default.nix29
-rw-r--r--pkgs/data/fonts/scheherazade/default.nix41
-rw-r--r--pkgs/data/fonts/source-code-pro/default.nix29
-rw-r--r--pkgs/data/fonts/source-han-code-jp/default.nix29
-rw-r--r--pkgs/data/fonts/source-han/default.nix56
-rw-r--r--pkgs/data/fonts/source-sans-pro/default.nix33
-rw-r--r--pkgs/data/fonts/source-sans/default.nix32
-rw-r--r--pkgs/data/fonts/source-serif-pro/default.nix33
-rw-r--r--pkgs/data/fonts/source-serif/default.nix32
-rw-r--r--pkgs/data/fonts/stix-two/default.nix33
-rw-r--r--pkgs/data/fonts/sudo/default.nix30
-rw-r--r--pkgs/data/fonts/terminus-font-ttf/default.nix39
-rw-r--r--pkgs/data/fonts/theano/default.nix35
-rw-r--r--pkgs/data/fonts/times-newer-roman/default.nix31
-rw-r--r--pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix33
-rw-r--r--pkgs/data/fonts/undefined-medium/default.nix30
-rw-r--r--pkgs/data/fonts/vollkorn/default.nix41
-rw-r--r--pkgs/data/fonts/weather-icons/default.nix29
-rw-r--r--pkgs/data/fonts/work-sans/default.nix29
-rw-r--r--pkgs/data/fonts/yanone-kaffeesatz/default.nix29
-rw-r--r--pkgs/data/fonts/zilla-slab/default.nix32
-rw-r--r--pkgs/desktops/gnome/misc/metacity/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/15/bintools/default.nix40
-rw-r--r--pkgs/development/compilers/llvm/15/clang/default.nix129
-rw-r--r--pkgs/development/compilers/llvm/15/clang/gnu-install-dirs.patch105
-rw-r--r--pkgs/development/compilers/llvm/15/clang/purity.patch29
-rw-r--r--pkgs/development/compilers/llvm/15/compiler-rt/X86-support-extension.patch21
-rw-r--r--pkgs/development/compilers/llvm/15/compiler-rt/armv7l.patch32
-rw-r--r--pkgs/development/compilers/llvm/15/compiler-rt/darwin-targetconditionals.patch71
-rw-r--r--pkgs/development/compilers/llvm/15/compiler-rt/default.nix156
-rw-r--r--pkgs/development/compilers/llvm/15/compiler-rt/gnu-install-dirs.patch20
-rw-r--r--pkgs/development/compilers/llvm/15/compiler-rt/normalize-var.patch16
-rw-r--r--pkgs/development/compilers/llvm/15/compiler-rt/skip-explicit-codesign.patch12
-rw-r--r--pkgs/development/compilers/llvm/15/default.nix354
-rw-r--r--pkgs/development/compilers/llvm/15/libcxx/default.nix107
-rw-r--r--pkgs/development/compilers/llvm/15/libcxx/gnu-install-dirs.patch22
-rw-r--r--pkgs/development/compilers/llvm/15/libcxxabi/default.nix105
-rw-r--r--pkgs/development/compilers/llvm/15/libcxxabi/gnu-install-dirs.patch22
-rw-r--r--pkgs/development/compilers/llvm/15/libcxxabi/wasm.patch16
-rw-r--r--pkgs/development/compilers/llvm/15/libunwind/default.nix62
-rw-r--r--pkgs/development/compilers/llvm/15/libunwind/gnu-install-dirs.patch22
-rw-r--r--pkgs/development/compilers/llvm/15/lld/default.nix55
-rw-r--r--pkgs/development/compilers/llvm/15/lld/gnu-install-dirs.patch46
-rw-r--r--pkgs/development/compilers/llvm/15/lldb/cpu_subtype_arm64e_replacement.patch12
-rw-r--r--pkgs/development/compilers/llvm/15/lldb/default.nix186
-rw-r--r--pkgs/development/compilers/llvm/15/lldb/gnu-install-dirs.patch23
-rw-r--r--pkgs/development/compilers/llvm/15/lldb/procfs.patch46
-rw-r--r--pkgs/development/compilers/llvm/15/lldb/resource-dir.patch13
-rw-r--r--pkgs/development/compilers/llvm/15/llvm/default.nix429
-rw-r--r--pkgs/development/compilers/llvm/15/llvm/gnu-install-dirs-polly.patch19
-rw-r--r--pkgs/development/compilers/llvm/15/llvm/gnu-install-dirs.patch138
-rw-r--r--pkgs/development/compilers/llvm/15/llvm/lit-shell-script-runner-set-dyld-library-path.patch26
-rw-r--r--pkgs/development/compilers/llvm/15/llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch79
-rw-r--r--pkgs/development/compilers/llvm/15/llvm/polly-lit-cfg-add-libs-to-dylib-path.patch24
-rw-r--r--pkgs/development/compilers/llvm/15/openmp/default.nix71
-rw-r--r--pkgs/development/compilers/llvm/15/openmp/fix-find-tool.patch18
-rw-r--r--pkgs/development/compilers/llvm/15/openmp/gnu-install-dirs.patch22
-rw-r--r--pkgs/development/compilers/llvm/15/openmp/run-lit-directly.patch12
-rw-r--r--pkgs/development/libraries/gnome-desktop/default.nix4
-rw-r--r--pkgs/development/libraries/quantlib/default.nix31
-rw-r--r--pkgs/development/python-modules/cvss/default.nix4
-rw-r--r--pkgs/development/python-modules/googlemaps/default.nix4
-rw-r--r--pkgs/development/python-modules/loguru/default.nix34
-rw-r--r--pkgs/development/python-modules/lxmf/default.nix4
-rw-r--r--pkgs/development/python-modules/notify-py/default.nix4
-rw-r--r--pkgs/development/python-modules/peaqevcore/default.nix4
-rw-r--r--pkgs/development/python-modules/prefixed/default.nix4
-rw-r--r--pkgs/development/python-modules/pylutron/default.nix4
-rw-r--r--pkgs/development/python-modules/pytibber/default.nix4
-rw-r--r--pkgs/development/tools/cocogitto/default.nix6
-rw-r--r--pkgs/servers/dns/knot-resolver/default.nix9
-rw-r--r--pkgs/tools/admin/syft/default.nix6
-rw-r--r--pkgs/tools/audio/vgmtools/default.nix6
-rw-r--r--pkgs/tools/misc/licensor/default.nix12
-rw-r--r--pkgs/tools/misc/yutto/default.nix4
-rw-r--r--pkgs/tools/networking/s3rs/default.nix6
-rw-r--r--pkgs/tools/package-management/apk-tools/default.nix4
-rw-r--r--pkgs/tools/system/automatic-timezoned/default.nix6
-rw-r--r--pkgs/tools/system/clinfo/default.nix4
-rw-r--r--pkgs/top-level/all-packages.nix17
114 files changed, 3924 insertions, 1024 deletions
diff --git a/pkgs/applications/audio/chuck/default.nix b/pkgs/applications/audio/chuck/default.nix
index bb0e885cd7465..a62337d7d55ac 100644
--- a/pkgs/applications/audio/chuck/default.nix
+++ b/pkgs/applications/audio/chuck/default.nix
@@ -3,12 +3,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.4.1.1";
+  version = "1.4.2.0";
   pname = "chuck";
 
   src = fetchurl {
     url = "http://chuck.cs.princeton.edu/release/files/chuck-${version}.tgz";
-    sha256 = "sha256-RFnubxUdpy3N4VJeCv4FMp1hCGNWsWjs/AvDpXApD2M=";
+    sha256 = "sha256-hIwsC9rYgXWSTFqUufKGqoT0Gnsf4nR4KQ0iSVbj8xg=";
   };
 
   nativeBuildInputs = [ flex bison which ]
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 71f6f2cb7ada6..08846a4ffe89e 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -112,13 +112,13 @@
     "vendorHash": null
   },
   "aws": {
-    "hash": "sha256-J+x3D7EpV/Kzp98AuhK8pqR26xhItG+JyfkHKc+2IA0=",
+    "hash": "sha256-jZYeMQW2DTGE/KyUJYGFPHGjFUGgfl11kE1jucZ5sH4=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v4.51.0",
+    "rev": "v4.52.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-iL03vDNHPQTAbTRoEutRtQllFgD1wn7qFleuZ4n99q8="
+    "vendorHash": "sha256-/6RbqOh5/Fpn25woV/AzmkTs1qnIo+sl3fKQxCtVZHQ="
   },
   "azuread": {
     "hash": "sha256-Byr6AJ1kP6fBxBCD8vLxQD5tz8fI3Z1fcCa0rXS9rhs=",
@@ -130,11 +130,11 @@
     "vendorHash": null
   },
   "azurerm": {
-    "hash": "sha256-dD2o0b5JQ1bZIBFshe+JkfkO5C0a3OvUwfrO2dgIiO8=",
+    "hash": "sha256-eDlRnJUo561edblydjBGePJzMFRqtEqKnS+8HOhKGdA=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v3.40.0",
+    "rev": "v3.41.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -825,13 +825,13 @@
     "vendorHash": null
   },
   "okta": {
-    "hash": "sha256-+aHlFu49BxdFqrVCEIEqpg+o2i4d5F1uZipc//Qipaw=",
+    "hash": "sha256-wKs5XRyyCda6pljtuo8ukAQl5ZZxeDSyt0CQWe8eXqY=",
     "homepage": "https://registry.terraform.io/providers/okta/okta",
     "owner": "okta",
     "repo": "terraform-provider-okta",
-    "rev": "v3.40.0",
+    "rev": "v3.41.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-XwQTtOsg1rktv/Oc+eTJ+Jr+BJvLEQPCaRSeXdXxWB0="
+    "vendorHash": "sha256-KWSHVI51YHHF3HXpyd1WB5Za721ak+cFhwDIfvC/ax4="
   },
   "oktaasa": {
     "hash": "sha256-2LhxgowqKvDDDOwdznusL52p2DKP+UiXALHcs9ZQd0U=",
@@ -1014,13 +1014,13 @@
     "vendorHash": "sha256-MIO0VHofPtKPtynbvjvEukMNr5NXHgk7BqwIhbc9+u0="
   },
   "signalfx": {
-    "hash": "sha256-qzLP+IGZU5bms8zjtcUg9rApZW2+TCF7KrtqSQvr3lw=",
+    "hash": "sha256-UgZr2ZFN5RvB7BG+DIXK6eSvTyvaVUKoBTIQ6aAfCpY=",
     "homepage": "https://registry.terraform.io/providers/splunk-terraform/signalfx",
     "owner": "splunk-terraform",
     "repo": "terraform-provider-signalfx",
-    "rev": "v6.20.0",
+    "rev": "v6.21.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-zIF5NA5kHXEr3aUleWrCYg8PZTKnrFubaRlALnbTLHQ="
+    "vendorHash": "sha256-Iue8P14x8P0lMa85goSF1D5mEeXw6dH1atJQhgbnZ6Y="
   },
   "skytap": {
     "hash": "sha256-JII4czazo6Di2sad1uFHMKDO2gWgZlQE8l/+IRYHQHU=",
@@ -1032,11 +1032,11 @@
     "vendorHash": null
   },
   "snowflake": {
-    "hash": "sha256-QikYp81omjlSckr/2oXCmAqiJlcMWuR120z86fP/zkE=",
+    "hash": "sha256-0nofzwxzf19T9klfzp+h3icyN4S92nPfq/HN+qaHK/E=",
     "homepage": "https://registry.terraform.io/providers/Snowflake-Labs/snowflake",
     "owner": "Snowflake-Labs",
     "repo": "terraform-provider-snowflake",
-    "rev": "v0.55.1",
+    "rev": "v0.56.0",
     "spdx": "MIT",
     "vendorHash": "sha256-ulgTRY8qQ5oXONkwYtffRl1QMNnbvyn0zYiYqqvwrUU="
   },
diff --git a/pkgs/applications/networking/n8n/node-packages.nix b/pkgs/applications/networking/n8n/node-packages.nix
index 0e9f619b1ffe2..86f2467677264 100644
--- a/pkgs/applications/networking/n8n/node-packages.nix
+++ b/pkgs/applications/networking/n8n/node-packages.nix
@@ -292,6 +292,15 @@ let
         sha512 = "+00smmZBradoGFEkRjliN7BjqPh/Hx0KCHWOEibUmflUqZz2RwBTU0MrVovEEHozhx3AUSGcO/rl3/5f9e9Biw==";
       };
     };
+    "@codemirror/lang-css-6.0.1" = {
+      name = "_at_codemirror_slash_lang-css";
+      packageName = "@codemirror/lang-css";
+      version = "6.0.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@codemirror/lang-css/-/lang-css-6.0.1.tgz";
+        sha512 = "rlLq1Dt0WJl+2epLQeAsfqIsx3lGu4HStHCJu95nGGuz2P2fNugbU3dQYafr2VRjM4eMC9HviI6jvS98CNtG5w==";
+      };
+    };
     "@codemirror/lang-javascript-6.1.2" = {
       name = "_at_codemirror_slash_lang-javascript";
       packageName = "@codemirror/lang-javascript";
@@ -643,6 +652,15 @@ let
         sha512 = "SVgiGtMnMnW3ActR8SXgsDhw7a0w0ChHSYAyAUxxrOiJ1OqYWEKk/xJd84tTSPo1mo6DXLObAJALNnd0Hrv7Ng==";
       };
     };
+    "@lezer/css-1.1.1" = {
+      name = "_at_lezer_slash_css";
+      packageName = "@lezer/css";
+      version = "1.1.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@lezer/css/-/css-1.1.1.tgz";
+        sha512 = "mSjx+unLLapEqdOYDejnGBokB5+AiJKZVclmud0MKQOKx3DLJ5b5VTCstgDDknR6iIV4gVrN6euzsCnj0A2gQA==";
+      };
+    };
     "@lezer/highlight-1.1.3" = {
       name = "_at_lezer_slash_highlight";
       packageName = "@lezer/highlight";
@@ -652,6 +670,15 @@ let
         sha512 = "3vLKLPThO4td43lYRBygmMY18JN3CPh9w+XS2j8WC30vR4yZeFG4z1iFe4jXE43NtGqe//zHW5q8ENLlHvz9gw==";
       };
     };
+    "@lezer/html-1.3.0" = {
+      name = "_at_lezer_slash_html";
+      packageName = "@lezer/html";
+      version = "1.3.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@lezer/html/-/html-1.3.0.tgz";
+        sha512 = "jU/ah8DEoiECLTMouU/X/ujIg6k9WQMIOFMaCLebzaXfrguyGaR3DpTgmk0tbljiuIJ7hlmVJPcJcxGzmCd0Mg==";
+      };
+    };
     "@lezer/javascript-1.4.1" = {
       name = "_at_lezer_slash_javascript";
       packageName = "@lezer/javascript";
@@ -949,49 +976,49 @@ let
         sha512 = "gW69MEamZ4wk1OsOq1nG1jcyhXIQcnrsX5JwixVw/9xaiav8TCyjESAruu1Rz9yyInhgBXxkNwMeygKnN2uxNA==";
       };
     };
-    "@sentry/core-7.33.0" = {
+    "@sentry/core-7.34.0" = {
       name = "_at_sentry_slash_core";
       packageName = "@sentry/core";
-      version = "7.33.0";
+      version = "7.34.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@sentry/core/-/core-7.33.0.tgz";
-        sha512 = "mrSgUnXjxHVi0cVea1lv7gC/Y66ya2a3atCHaPEij/+l+3APg5d0Ixt1zMx5YllMiZKf6wpxlZ0uwXcqdAAw+w==";
+        url = "https://registry.npmjs.org/@sentry/core/-/core-7.34.0.tgz";
+        sha512 = "J1oxsYZX1N0tkEcaHt/uuDqk6zOnaivyampp+EvBsUMCdemjg7rwKvawlRB0ZtBEQu3HAhi8zecm03mlpWfCDw==";
       };
     };
-    "@sentry/integrations-7.33.0" = {
+    "@sentry/integrations-7.34.0" = {
       name = "_at_sentry_slash_integrations";
       packageName = "@sentry/integrations";
-      version = "7.33.0";
+      version = "7.34.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@sentry/integrations/-/integrations-7.33.0.tgz";
-        sha512 = "r67/9R+DaOZETg7gRvOuYPo5XQdzEaE8f7OaET071dUP0kyUBjO74Y7SZxZV/xjBthMXexw5TANHmLVrZQQVag==";
+        url = "https://registry.npmjs.org/@sentry/integrations/-/integrations-7.34.0.tgz";
+        sha512 = "xbWnTvG4gkKeCVpmhhdPtMbQkPO0RAfEJ8VPO5TWmUMT23ZWy2kE0gTZHtnBopy7AXxg231XxTi4fxnwgQGxEQ==";
       };
     };
-    "@sentry/node-7.33.0" = {
+    "@sentry/node-7.34.0" = {
       name = "_at_sentry_slash_node";
       packageName = "@sentry/node";
-      version = "7.33.0";
+      version = "7.34.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@sentry/node/-/node-7.33.0.tgz";
-        sha512 = "isQVF9LLSG4EZLHiSJ3chgK6f3ZBdGxm8fX6YGm8HWz07CubJddes3yBPLPRNXrRLd7X3SK8pPcK5oc3LIKqAw==";
+        url = "https://registry.npmjs.org/@sentry/node/-/node-7.34.0.tgz";
+        sha512 = "VM4XeydRdgeaNTRe8kwqYg2oNPddVyY74PlCFEFnPEN1NccycNuwiFno68kNrApeqxxLlTTmzkJy0BWo16x2Yg==";
       };
     };
-    "@sentry/types-7.33.0" = {
+    "@sentry/types-7.34.0" = {
       name = "_at_sentry_slash_types";
       packageName = "@sentry/types";
-      version = "7.33.0";
+      version = "7.34.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@sentry/types/-/types-7.33.0.tgz";
-        sha512 = "5kkmYjtBWSbPxfYGiXdZFPS6xpFBNlXvDqeX4NpCFXz6/LiEDn6tZ61kuCSFb8MZlyqyCX5WsP3aiI2FJfpGIA==";
+        url = "https://registry.npmjs.org/@sentry/types/-/types-7.34.0.tgz";
+        sha512 = "K+OeHIrl35PSYn6Zwqe4b8WWyAJQoI5NeWxHVkM7oQTGJ1YLG4BvLsR+UiUXnKdR5krE4EDtEA5jLsDlBEyPvw==";
       };
     };
-    "@sentry/utils-7.33.0" = {
+    "@sentry/utils-7.34.0" = {
       name = "_at_sentry_slash_utils";
       packageName = "@sentry/utils";
-      version = "7.33.0";
+      version = "7.34.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@sentry/utils/-/utils-7.33.0.tgz";
-        sha512 = "msp02GV1gOfaN5FjKjWxI00rtbYLXEE5cTGldhs/Dt9KI63dDk1nwPDkSLhg6joqRItAq0thlBh6un717HdWbg==";
+        url = "https://registry.npmjs.org/@sentry/utils/-/utils-7.34.0.tgz";
+        sha512 = "VIHHXEBw0htzqxnU8A7WkXKvmsG2pZVqHlAn0H9W/yyFQtXMuP1j1i0NsjADB/3JXUKK83kTNWGzScXvp0o+Jg==";
       };
     };
     "@servie/events-1.0.0" = {
@@ -1012,22 +1039,22 @@ let
         sha512 = "Uy0+khmZqUrUGm5dmMqVlnvufZRSK0FbYzVgp0UMstm+F5+W2/jnEEQyc9vo1ZR/E5ZI/B1WjjoTqBqwJL6Krw==";
       };
     };
-    "@swc/core-1.3.28" = {
+    "@swc/core-1.3.29" = {
       name = "_at_swc_slash_core";
       packageName = "@swc/core";
-      version = "1.3.28";
+      version = "1.3.29";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@swc/core/-/core-1.3.28.tgz";
-        sha512 = "yzc61HbAIjHeOYTUW/IgXAywlSviMFymnUiLY7dNUELGHjMVxSp0XnIlPQN4v5UekYbwLEV8+KChaoQRACiQCw==";
+        url = "https://registry.npmjs.org/@swc/core/-/core-1.3.29.tgz";
+        sha512 = "BYDBEqQ77ASZNQYTP7PlKnMLwbHh3lhtlzD/gQP2zIK9XhqQlcy/zIcLljYDn0EOogLn3IyaUiXgAzDWoAmWMg==";
       };
     };
-    "@swc/wasm-1.3.28" = {
+    "@swc/wasm-1.3.29" = {
       name = "_at_swc_slash_wasm";
       packageName = "@swc/wasm";
-      version = "1.3.28";
+      version = "1.3.29";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@swc/wasm/-/wasm-1.3.28.tgz";
-        sha512 = "6RDkQHSi6FxaoPmGnzMq5smYxXlcEec+t6EHrv8rk4emIrnsFjSc2D2PQ0K4xoryJn2NVD3cDbAEVHe6XZX5AQ==";
+        url = "https://registry.npmjs.org/@swc/wasm/-/wasm-1.3.29.tgz";
+        sha512 = "Tzpl541GRLyzQufasGScL9tMOzk0SsdcVX0jYpG74u6VZHqr0u62Cw6nYtRhTtkcsFsfNpg7RQM+CycyXY8Nmw==";
       };
     };
     "@techteamer/ocsp-1.0.0" = {
@@ -1111,6 +1138,15 @@ let
         sha512 = "yOlFc+7UtL/89t2ZhjPvvB/DeAr3r+Dq58IgzsFkOAvVC6NMJXmCGjbptdXdR9qsX7pKcTL+s87FtYREi2dEEQ==";
       };
     };
+    "@types/asn1-0.2.0" = {
+      name = "_at_types_slash_asn1";
+      packageName = "@types/asn1";
+      version = "0.2.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@types/asn1/-/asn1-0.2.0.tgz";
+        sha512 = "5TMxIpYbIA9c1J0hYQjQDX3wr+rTgQEAXaW2BI8ECM8FO53wSW4HFZplTalrKSHuZUc76NtXcePRhwuOHqGD5g==";
+      };
+    };
     "@types/big.js-6.1.6" = {
       name = "_at_types_slash_big.js";
       packageName = "@types/big.js";
@@ -1336,6 +1372,15 @@ let
         sha512 = "sOUTGn6h1SfQ+gbgqC364jLFBw2lnFqkgF3q0WovEHRLMrVD1sd5aufqi/aJObLekJO+Aq5z646U4Oxy6shXMA==";
       };
     };
+    "@types/uuid-9.0.0" = {
+      name = "_at_types_slash_uuid";
+      packageName = "@types/uuid";
+      version = "9.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@types/uuid/-/uuid-9.0.0.tgz";
+        sha512 = "kr90f+ERiQtKWMz5rP32ltJ/BtULDI5RVO0uavn1HQUOwjx0R1h0rnDYNL0CepF1zL5bSY6FISAfd9tOdDhU5Q==";
+      };
+    };
     "@types/validator-13.7.11" = {
       name = "_at_types_slash_validator";
       packageName = "@types/validator";
@@ -1867,13 +1912,13 @@ let
         sha512 = "9cYNccliXZDByFsFliVwk5GvTq058Fj513CiR4E60ndDwmuXzTJEp/Bp8FyuRmGyYupLjHLs+JA9/CBoVS4/NQ==";
       };
     };
-    "aws-sdk-2.1301.0" = {
+    "aws-sdk-2.1304.0" = {
       name = "aws-sdk";
       packageName = "aws-sdk";
-      version = "2.1301.0";
+      version = "2.1304.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1301.0.tgz";
-        sha512 = "AxCt0GfWV14AWC0yvN3+WEBr45JMu2X3FHb8r3H8EhZjJfHk3hWcDwu6vS5Qd8NFDATlFdWJfyQjPVU1YuaDfw==";
+        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1304.0.tgz";
+        sha512 = "9mf2uafa2M9yFC5IlMe85TIc7OUo1HSProCQWzpRmAAYhcSwmfbRyt02Wtr5YSVvJJPmcSgcyI92snsQR1c3nw==";
       };
     };
     "aws-sign2-0.7.0" = {
@@ -2632,6 +2677,15 @@ let
         sha512 = "RMr0FhtfXemyinomL4hrWcYJxmX6deFdCxpJzhDttxgO1+bcCnkk+9drydLVDmAMG7NE6aN/fl4F7ucU/90gAA==";
       };
     };
+    "codemirror-lang-html-n8n-1.0.0" = {
+      name = "codemirror-lang-html-n8n";
+      packageName = "codemirror-lang-html-n8n";
+      version = "1.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/codemirror-lang-html-n8n/-/codemirror-lang-html-n8n-1.0.0.tgz";
+        sha512 = "ofNP6VTDGJ5rue+kTCZlDZdF1PnE0sl2cAkfrsCAd5MlBgDmqTwuFJIkTI6KXOJXs0ucdTYH6QLhy9BSW7EaOQ==";
+      };
+    };
     "codemirror-lang-n8n-expression-0.1.0" = {
       name = "codemirror-lang-n8n-expression";
       packageName = "codemirror-lang-n8n-expression";
@@ -3703,15 +3757,6 @@ let
         sha512 = "hCx1oky9PFrJ611mf0ifBLBRW8lUUVRlFolb5gWRfIELabBlbp9xZvrqZLZAs+NxFnbfQoeGd8wDkygjg7U85w==";
       };
     };
-    "entities-2.2.0" = {
-      name = "entities";
-      packageName = "entities";
-      version = "2.2.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/entities/-/entities-2.2.0.tgz";
-        sha512 = "p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A==";
-      };
-    };
     "entities-4.4.0" = {
       name = "entities";
       packageName = "entities";
@@ -3991,6 +4036,15 @@ let
         sha512 = "5/PsL6iGPdfQ/lKM1UuielYgv3BUoJfz1aUwU9vHZ+J7gyvwdQXFEBIEIaxeGf0GIcreATNyBExtalisDbuMqQ==";
       };
     };
+    "express-async-errors-3.1.1" = {
+      name = "express-async-errors";
+      packageName = "express-async-errors";
+      version = "3.1.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/express-async-errors/-/express-async-errors-3.1.1.tgz";
+        sha512 = "h6aK1da4tpqWSbyCa3FxB/V6Ehd4EEB15zyQq9qe75OZBp0krinNKuH4rAY+S/U/2I36vdLAUFSjQJ+TFmODng==";
+      };
+    };
     "express-openapi-validator-4.13.8" = {
       name = "express-openapi-validator";
       packageName = "express-openapi-validator";
@@ -4891,13 +4945,13 @@ let
         sha512 = "4lVbmc1diZC7GUJQtRQ5yBAeUCL1exyMwmForWkRLnwyzWBFxN633SALPMGYaWZvKe9j1pRZJpauvmxENSp/EA==";
       };
     };
-    "http-cache-semantics-4.1.0" = {
+    "http-cache-semantics-4.1.1" = {
       name = "http-cache-semantics";
       packageName = "http-cache-semantics";
-      version = "4.1.0";
+      version = "4.1.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.0.tgz";
-        sha512 = "carPklcUh7ROWRK7Cv27RPtdhYhUsela/ue5/jKzjegVvXDqM2ILE9Q2BGn9JZJh1g87cp56su/FgQSzcWS8cQ==";
+        url = "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.1.tgz";
+        sha512 = "er295DKPVsV82j5kw1Gjt+ADA/XYHsajl82cGNQG2eyoPkvgUhX+nDIyelzhIWbbsXP39EHcI6l5tYs2FYqYXQ==";
       };
     };
     "http-errors-2.0.0" = {
@@ -4945,6 +4999,15 @@ let
         sha512 = "dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==";
       };
     };
+    "humanize-duration-3.28.0" = {
+      name = "humanize-duration";
+      packageName = "humanize-duration";
+      version = "3.28.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/humanize-duration/-/humanize-duration-3.28.0.tgz";
+        sha512 = "jMAxraOOmHuPbffLVDKkEKi/NeG8dMqP8lGRd6Tbf7JgAeG33jjgPWDbXXU7ypCI0o+oNKJFgbSB9FKVdWNI2A==";
+      };
+    };
     "humanize-ms-1.2.1" = {
       name = "humanize-ms";
       packageName = "humanize-ms";
@@ -5134,13 +5197,13 @@ let
         sha512 = "3GYo0GJtLqgNXj4YhrisLaNNvWSNwSS2wS4OELGfGxH8I69+XfNdnmV1AyN+ZqMh0i7eX+SWjrwFKDBDgfBC1A==";
       };
     };
-    "ioredis-5.2.6" = {
+    "ioredis-5.3.0" = {
       name = "ioredis";
       packageName = "ioredis";
-      version = "5.2.6";
+      version = "5.3.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/ioredis/-/ioredis-5.2.6.tgz";
-        sha512 = "F1xO+kYIz+TCOccvhThs2pem6sc9uTl9JsZybWpqe4FeCFDmf04XwbLQUGIqi2UWaDUuR61w2dhxx6NJEFehOA==";
+        url = "https://registry.npmjs.org/ioredis/-/ioredis-5.3.0.tgz";
+        sha512 = "Id9jKHhsILuIZpHc61QkagfVdUj2Rag5GzG1TGEvRNeM7dtTOjICgjC+tvqYxi//PuX2wjQ+Xjva2ONBuf92Pw==";
       };
     };
     "ip-1.1.8" = {
@@ -5926,6 +5989,15 @@ let
         sha512 = "Xq9nH7KlWZmXAtodXDDRE7vs6DU1gTU8zYDHDiWLSip45Egwq3plLHzPn27NgvzL2r1LMPC1vdqh98sQxtqj4A==";
       };
     };
+    "ldapts-4.2.2" = {
+      name = "ldapts";
+      packageName = "ldapts";
+      version = "4.2.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/ldapts/-/ldapts-4.2.2.tgz";
+        sha512 = "UHe7BtEhPUFHZZ6XHnRvLHWQrftTap3PgGU0nOLtrFeigZvfpXSsqJ8C9uXNouDV+iDHqoWwplS0eHoDu/GIEQ==";
+      };
+    };
     "leac-0.6.0" = {
       name = "leac";
       packageName = "leac";
@@ -6547,6 +6619,15 @@ let
         sha512 = "TchMembfxfNVpHkbtriWltGWc+m3xszaRD0CZup7GFFhzIgQqxIfn3eGj1yZpfuflzPvfkt611B2Q/Bsk1YnGg==";
       };
     };
+    "markdown-it-13.0.1" = {
+      name = "markdown-it";
+      packageName = "markdown-it";
+      version = "13.0.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/markdown-it/-/markdown-it-13.0.1.tgz";
+        sha512 = "lTlxriVoy2criHP0JKRhO2VDG9c2ypWCsT237eDiLqi09rmbKoUetyGHq2uOIRoRS//kfoJckS0eUzzkDR+k2Q==";
+      };
+    };
     "markdown-it-emoji-2.0.2" = {
       name = "markdown-it-emoji";
       packageName = "markdown-it-emoji";
@@ -7033,49 +7114,49 @@ let
         sha512 = "z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==";
       };
     };
-    "n8n-core-0.151.2" = {
+    "n8n-core-0.152.0" = {
       name = "n8n-core";
       packageName = "n8n-core";
-      version = "0.151.2";
+      version = "0.152.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-core/-/n8n-core-0.151.2.tgz";
-        sha512 = "QIGNeKuRuY+G+kPxDShjXnxVjCMCEbZ6xB530+V30s2MFa+XnEKJtPdLbsCr0j8AUTHqEb/oMkHAoEyPPg8M1g==";
+        url = "https://registry.npmjs.org/n8n-core/-/n8n-core-0.152.0.tgz";
+        sha512 = "Bx+4vv3E7SwjFvxLDqzpDbJwVzDUYAw1QTcqAfMnHpkUM9uxlYHV5U3kgSsjpkw0TAF7RVVroHWFYWgnrW9XHA==";
       };
     };
-    "n8n-design-system-0.51.1" = {
+    "n8n-design-system-0.52.0" = {
       name = "n8n-design-system";
       packageName = "n8n-design-system";
-      version = "0.51.1";
+      version = "0.52.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-design-system/-/n8n-design-system-0.51.1.tgz";
-        sha512 = "zK4UI/LkdRzAGZfL9K7/tZSLjxXTIKgt/72LrgEJ8CGNxYPavk0f7eYTH9Q8tbcLAaMLDjUcbcdzVEWh5YZofA==";
+        url = "https://registry.npmjs.org/n8n-design-system/-/n8n-design-system-0.52.0.tgz";
+        sha512 = "Dd6SdWYDjlhgrpPbof4DFPP4hPdpH9cA+3YkFSCgQLNyCi0RdqiQJqPQ5xQFlNVaxd6a7R69RHy/oNwt6/+cLw==";
       };
     };
-    "n8n-editor-ui-0.178.1" = {
+    "n8n-editor-ui-0.179.0" = {
       name = "n8n-editor-ui";
       packageName = "n8n-editor-ui";
-      version = "0.178.1";
+      version = "0.179.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-editor-ui/-/n8n-editor-ui-0.178.1.tgz";
-        sha512 = "bpSRVRys6fIAuhsmxQrU2QXP0UaRfGan+wODcZbX8SnWSG90ANN7R++CvS6tfL+i8vKvDzLYFjWlm1y40Esbag==";
+        url = "https://registry.npmjs.org/n8n-editor-ui/-/n8n-editor-ui-0.179.0.tgz";
+        sha512 = "mo1HoCA7myKzkNkZgmjp9UZ5euxDUX+ZPAyLCoxI+HXki3mhVxELeffzbkBiXAfezi9xlaYAKzehg5HuUyiHjg==";
       };
     };
-    "n8n-nodes-base-0.210.1" = {
+    "n8n-nodes-base-0.211.0" = {
       name = "n8n-nodes-base";
       packageName = "n8n-nodes-base";
-      version = "0.210.1";
+      version = "0.211.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-nodes-base/-/n8n-nodes-base-0.210.1.tgz";
-        sha512 = "UvkjbmJoBtgqHMz+ff7AJYnVcRpPLY7rh0OPQSR3B6BQ7lzE9eBaBpfTvtIopxRwKeK3vke9UUb6ztdkgDaBDw==";
+        url = "https://registry.npmjs.org/n8n-nodes-base/-/n8n-nodes-base-0.211.0.tgz";
+        sha512 = "AoERAZJTuztzCuVvSeAPJk0fko4XcnlK7oweum08+0C1g0X1o9iHQE2kkoHwTxsY77eS6mRbGd2r6OCggpKftQ==";
       };
     };
-    "n8n-workflow-0.133.2" = {
+    "n8n-workflow-0.134.0" = {
       name = "n8n-workflow";
       packageName = "n8n-workflow";
-      version = "0.133.2";
+      version = "0.134.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-workflow/-/n8n-workflow-0.133.2.tgz";
-        sha512 = "XnNmt5idpqb/7nVFtNCS4RQUDMfIslfepl2WJfwa/0jSQYWaJmFWhV0OmIj3mJTWaLaiy1qDjAEaEYZZBaQ69A==";
+        url = "https://registry.npmjs.org/n8n-workflow/-/n8n-workflow-0.134.0.tgz";
+        sha512 = "m9sbI29zCXSeFprBEQ+Lqk1E53iI2Dbu0LoL+5Nw3fBcbxnTYCxReD9pSssZSKlHzb9BHSMSYeZk4pK5RyQuvw==";
       };
     };
     "named-placeholders-1.1.3" = {
@@ -7204,13 +7285,13 @@ let
         sha512 = "L8RfEgjBTHAISTuagw51PprVAqNZoG6KSB6LQ6H1bskMVkFs5E71IyjauLBv3XbuomJlguWF/VnRHdJ1gqiAqA==";
       };
     };
-    "node-abort-controller-3.0.1" = {
+    "node-abort-controller-3.1.1" = {
       name = "node-abort-controller";
       packageName = "node-abort-controller";
-      version = "3.0.1";
+      version = "3.1.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/node-abort-controller/-/node-abort-controller-3.0.1.tgz";
-        sha512 = "/ujIVxthRs+7q6hsdjHMaj8hRG9NuWmwrz+JdRwZ14jdFoKSkm+vDsCbF9PLpnSqjaWQJuTmVtcWHNLr+vrOFw==";
+        url = "https://registry.npmjs.org/node-abort-controller/-/node-abort-controller-3.1.1.tgz";
+        sha512 = "AGK2yQKIjRuqnc6VkX2Xj5d+QW8xZ87pa1UK6yA6ouUyuxfHuMP6umE5QK7UmTeOAymo+Zx1Fxiuw9rVx8taHQ==";
       };
     };
     "node-addon-api-4.3.0" = {
@@ -7330,13 +7411,13 @@ let
         sha512 = "EjYvSmHzekz6VNkNd12aUqAco+bOkRe3Of5jVhltqKhEsjw/y0PYPJfp83+s9Wzh1dspYAkUW/YNQ350NATbSQ==";
       };
     };
-    "nodemailer-6.9.0" = {
+    "nodemailer-6.9.1" = {
       name = "nodemailer";
       packageName = "nodemailer";
-      version = "6.9.0";
+      version = "6.9.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/nodemailer/-/nodemailer-6.9.0.tgz";
-        sha512 = "jFaCEGTeT3E/m/5R2MHWiyQH3pSARECRUDM+1hokOYc3lQAAG7ASuy+2jIsYVf+RVa9zePopSQwKNVFH8DKUpA==";
+        url = "https://registry.npmjs.org/nodemailer/-/nodemailer-6.9.1.tgz";
+        sha512 = "qHw7dOiU5UKNnQpXktdgQ1d3OFgRAekuvbJLcdG5dnEo/GtcTHRYM7+UfJARdOFU9WUQO8OiIamgWPmiSFHYAA==";
       };
     };
     "nopt-5.0.0" = {
@@ -8005,6 +8086,15 @@ let
         sha512 = "UXYN0ziKj+AeNNP7VDMwrehpACThH7LUl/p8TDFpEUuSejCUIwGSfxpHsPvtM6/WXFy6SU4E5RG4IJV/TZAGjw==";
       };
     };
+    "pg-8.9.0" = {
+      name = "pg";
+      packageName = "pg";
+      version = "8.9.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/pg/-/pg-8.9.0.tgz";
+        sha512 = "ZJM+qkEbtOHRuXjmvBtOgNOXOtLSbxiMiUVMgE4rV6Zwocy03RicCVvDXgx8l4Biwo8/qORUnEqn2fdQzV7KCg==";
+      };
+    };
     "pg-connection-string-2.5.0" = {
       name = "pg-connection-string";
       packageName = "pg-connection-string";
@@ -8014,13 +8104,13 @@ let
         sha512 = "r5o/V/ORTA6TmUnyWZR9nCj1klXCO2CEKNRlVuJptZe85QuhFayC7WeMic7ndayT5IRIR0S0xFxFi2ousartlQ==";
       };
     };
-    "pg-cursor-2.7.4" = {
+    "pg-cursor-2.8.0" = {
       name = "pg-cursor";
       packageName = "pg-cursor";
-      version = "2.7.4";
+      version = "2.8.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/pg-cursor/-/pg-cursor-2.7.4.tgz";
-        sha512 = "CNWwOzTTZ9QvphoOL+Wg/7pmVr9GnAWBjPbuK2FRclrB4A/WRO/ssCJ9BlkzIGmmofK2M/LyokNHgsLSn+fMHA==";
+        url = "https://registry.npmjs.org/pg-cursor/-/pg-cursor-2.8.0.tgz";
+        sha512 = "LrOaEHK+R1C40e+xeri3FTRY/VKp9uTOCVsKtGB7LJ57qbeaphYvWjbVly8AesdT1GfHXYcAnVdExKhW7DKOvA==";
       };
     };
     "pg-int8-1.0.1" = {
@@ -8068,22 +8158,22 @@ let
         sha512 = "BKlHCMCdNUmF6gagVbehRWSEiVcZzPVltEx14OJExR9Iz9/1R6KETDWLLGv2l6yRqYFnEZZy1VDjRhArzeIGrw==";
       };
     };
-    "pg-protocol-1.5.0" = {
+    "pg-protocol-1.6.0" = {
       name = "pg-protocol";
       packageName = "pg-protocol";
-      version = "1.5.0";
+      version = "1.6.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.5.0.tgz";
-        sha512 = "muRttij7H8TqRNu/DxrAJQITO4Ac7RmX3Klyr/9mJEOBeIpgnF8f9jAfRz5d3XwQZl5qBjF9gLsUtMPJE0vezQ==";
+        url = "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.6.0.tgz";
+        sha512 = "M+PDm637OY5WM307051+bsDia5Xej6d9IR4GwJse1qA1DIhiKlksvrneZOYQq42OM+spubpcNYEo2FcKQrDk+Q==";
       };
     };
-    "pg-query-stream-4.2.4" = {
+    "pg-query-stream-4.3.0" = {
       name = "pg-query-stream";
       packageName = "pg-query-stream";
-      version = "4.2.4";
+      version = "4.3.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/pg-query-stream/-/pg-query-stream-4.2.4.tgz";
-        sha512 = "Et3gTrWn4C2rj4LVioNq1QDd7aH/3mSJcBm79jZALv3wopvx9bWENtbOYZbHQ6KM+IkfFxs0JF1ZLjMDJ9/N6Q==";
+        url = "https://registry.npmjs.org/pg-query-stream/-/pg-query-stream-4.3.0.tgz";
+        sha512 = "+Eer4Y1e43rAaphFNu9/VJKn9nKTApFKCSwVtDjXYnuO4QYqWHOEkApmGJv8gvaU5T6fcuEtjsN24gk+Rx7X9A==";
       };
     };
     "pg-types-1.13.0" = {
@@ -8257,13 +8347,13 @@ let
         sha512 = "9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==";
       };
     };
-    "posthog-node-2.2.3" = {
+    "posthog-node-2.3.0" = {
       name = "posthog-node";
       packageName = "posthog-node";
-      version = "2.2.3";
+      version = "2.3.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/posthog-node/-/posthog-node-2.2.3.tgz";
-        sha512 = "dYlLZhrDus+uRov/Hh+EiRlMoMhRKchNjNa7mNE2iWmKg/ryOTipf0XYKS9UKdki7aU1NzWFhnLe11HF615XuA==";
+        url = "https://registry.npmjs.org/posthog-node/-/posthog-node-2.3.0.tgz";
+        sha512 = "VV4s1DP2DTAL1WaR4Detq28epLlX2DVWfr/+itRWLvDVFyK9EDbAMqBhOkh8dd3JPkng0kcIjJ8PFII/cCXP9A==";
       };
     };
     "prebuild-install-7.1.1" = {
@@ -8284,6 +8374,15 @@ let
         sha512 = "ESF23V4SKG6lVSGZgYNpbsiaAkdab6ZgOxe52p7+Kid3W3u3bxR4Vfd/o21dmN7jSt0IwgZ4v5MUd26FEtXE9w==";
       };
     };
+    "prettier-2.8.3" = {
+      name = "prettier";
+      packageName = "prettier";
+      version = "2.8.3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/prettier/-/prettier-2.8.3.tgz";
+        sha512 = "tJ/oJ4amDihPoufT5sM0Z1SKEuKay8LfVAMlbbhnnkvt6BUserZylqo2PN+p9KeljLr0OHa2rXHU1T8reeoTrw==";
+      };
+    };
     "pretty-bytes-5.6.0" = {
       name = "pretty-bytes";
       packageName = "pretty-bytes";
@@ -9049,13 +9148,13 @@ let
         sha512 = "YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==";
       };
     };
-    "sanitize-html-2.7.0" = {
+    "sanitize-html-2.7.3" = {
       name = "sanitize-html";
       packageName = "sanitize-html";
-      version = "2.7.0";
+      version = "2.7.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.7.0.tgz";
-        sha512 = "jfQelabOn5voO7FAfnQF7v+jsA6z9zC/O4ec0z3E35XPEtHYJT/OdUziVWlKW4irCr2kXaQAyXTXDHWAibg1tA==";
+        url = "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.7.3.tgz";
+        sha512 = "jMaHG29ak4miiJ8wgqA1849iInqORgNv7SLfSw9LtfOhEUQ1C0YHKH73R+hgyufBW9ZFeJrb057k9hjlfBCVlw==";
       };
     };
     "sax-1.2.1" = {
@@ -9634,6 +9733,15 @@ let
         sha512 = "KXDYZ9dszj6bzvnEMRYvxgeTHU74QBFL54XKtP3nyMuJ81CFYtABZ3bAzL2EdFUaEwJOBOgENyFj3R7oTzDyyw==";
       };
     };
+    "stream-browserify-3.0.0" = {
+      name = "stream-browserify";
+      packageName = "stream-browserify";
+      version = "3.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/stream-browserify/-/stream-browserify-3.0.0.tgz";
+        sha512 = "H73RAHsVBapbim0tU2JwwOiXUj+fikfiaoYAKHF3VJfA0pe2BCzkhAHBlLG6REzE+2WNZcxOXjK7lkso+9euLA==";
+      };
+    };
     "stream-events-1.0.5" = {
       name = "stream-events";
       packageName = "stream-events";
@@ -9661,6 +9769,15 @@ let
         sha512 = "Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg==";
       };
     };
+    "strict-event-emitter-types-2.0.0" = {
+      name = "strict-event-emitter-types";
+      packageName = "strict-event-emitter-types";
+      version = "2.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/strict-event-emitter-types/-/strict-event-emitter-types-2.0.0.tgz";
+        sha512 = "Nk/brWYpD85WlOgzw5h173aci0Teyv8YdIAEtV+N88nDB0dLlazZyJMIsN6eo1/AR61l+p6CJTG1JIyFaoNEEA==";
+      };
+    };
     "strict-uri-encode-2.0.0" = {
       name = "strict-uri-encode";
       packageName = "strict-uri-encode";
@@ -10192,13 +10309,13 @@ let
         sha512 = "Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==";
       };
     };
-    "tslib-2.4.1" = {
+    "tslib-2.5.0" = {
       name = "tslib";
       packageName = "tslib";
-      version = "2.4.1";
+      version = "2.5.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/tslib/-/tslib-2.4.1.tgz";
-        sha512 = "tGyy4dAjRIEwI7BzsB0lynWgOpfqjUdq91XXAlIWD2OwKBH7oCl/GZG/HT4BOHrTlPMOASlMQ7veyTqpmRcrNA==";
+        url = "https://registry.npmjs.org/tslib/-/tslib-2.5.0.tgz";
+        sha512 = "336iVw3rtn2BUK7ORdIAHTyxHGRIHVReokCR3XjbckJMK7ms8FysBfhLR8IXnAgy7T0PTPNBWKiH514FOW/WSg==";
       };
     };
     "tsscmp-1.0.6" = {
@@ -10597,6 +10714,15 @@ let
         sha512 = "+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==";
       };
     };
+    "uuid-9.0.0" = {
+      name = "uuid";
+      packageName = "uuid";
+      version = "9.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/uuid/-/uuid-9.0.0.tgz";
+        sha512 = "MXcSTerfPa4uqyzStbRoTgt5XIe3x5+42+q1sDuy3R5MDk66URdLMOZe5aPX/SQd+kuYAh0FdP/pO28IkQyTeg==";
+      };
+    };
     "v-click-outside-3.2.0" = {
       name = "v-click-outside";
       packageName = "v-click-outside";
@@ -10714,6 +10840,15 @@ let
         sha512 = "C5GZjs1tYlAqjwymaaCPDjCyGo10ajUphiwA922jKt9n7KPpqR7oM1PCwYzhB/E7+nT3wfdG3oRre5raIT1rKA==";
       };
     };
+    "vue-infinite-loading-2.4.5" = {
+      name = "vue-infinite-loading";
+      packageName = "vue-infinite-loading";
+      version = "2.4.5";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/vue-infinite-loading/-/vue-infinite-loading-2.4.5.tgz";
+        sha512 = "xhq95Mxun060bRnsOoLE2Be6BR7jYwuC89kDe18+GmCLVrRA/dU0jrGb12Xu6NjmKs+iTW0AA6saSEmEW4cR7g==";
+      };
+    };
     "vue-json-pretty-1.9.3" = {
       name = "vue-json-pretty";
       packageName = "vue-json-pretty";
@@ -10768,6 +10903,15 @@ let
         sha512 = "N3FYX9Z6rZdTeP3BOBz2LMxlWo9WRmPF6SOsYzz+tEuUH0QjX8UD7c1X95J8pZ7cFvbh9QflVujYQRqRiiwoAg==";
       };
     };
+    "vue2-boring-avatars-0.3.8" = {
+      name = "vue2-boring-avatars";
+      packageName = "vue2-boring-avatars";
+      version = "0.3.8";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/vue2-boring-avatars/-/vue2-boring-avatars-0.3.8.tgz";
+        sha512 = "8vNN+zhCIiIMnSQDu0DwhJ11e9r3t4t12dromXmXDtRryBhV58NPn4XgMb4JKrBlfNK92KFrY/cxRy3nzhQfpQ==";
+      };
+    };
     "vue2-teleport-1.0.1" = {
       name = "vue2-teleport";
       packageName = "vue2-teleport";
@@ -11179,10 +11323,10 @@ in
   n8n = nodeEnv.buildNodePackage {
     name = "n8n";
     packageName = "n8n";
-    version = "0.212.1";
+    version = "0.213.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/n8n/-/n8n-0.212.1.tgz";
-      sha512 = "9i4U/dJ84TEFIkj++nx+u3lLgpOxeco5QjopG+Ejjv6Gd3Jc+oL8MF3opN9v0JWagPX+yOnszol6aN+U4Sl8tA==";
+      url = "https://registry.npmjs.org/n8n/-/n8n-0.213.0.tgz";
+      sha512 = "O6ZOT3nhCSBXt0aA3OH64M+6UNwVO7coURqTaCI0oVwbaH387OawtKn+mVnn5Jho52hAAZAoHdF1RVal2LQtJQ==";
     };
     dependencies = [
       (sources."@acuminous/bitsyntax-0.1.2" // {
@@ -11198,53 +11342,53 @@ in
       })
       (sources."@azure/abort-controller-1.1.0" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/core-auth-1.4.0" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/core-client-1.7.0" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/core-http-2.3.1" // {
         dependencies = [
           sources."@azure/core-tracing-1.0.0-preview.13"
           sources."tough-cookie-4.1.2"
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
           sources."universalify-0.2.0"
         ];
       })
       sources."@azure/core-http-compat-1.3.0"
       (sources."@azure/core-lro-2.5.0" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/core-paging-1.4.0" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/core-rest-pipeline-1.10.1" // {
         dependencies = [
           sources."@tootallnate/once-2.0.0"
           sources."http-proxy-agent-5.0.0"
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/core-tracing-1.0.1" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/core-util-1.1.1" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/identity-2.1.0" // {
@@ -11252,17 +11396,17 @@ in
           sources."jwa-2.0.0"
           sources."jws-4.0.0"
           sources."open-8.4.0"
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/keyvault-keys-4.6.0" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/logger-1.0.3" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."@azure/ms-rest-azure-env-2.0.0"
@@ -11286,13 +11430,14 @@ in
       (sources."@azure/storage-blob-12.12.0" // {
         dependencies = [
           sources."@azure/core-tracing-1.0.0-preview.13"
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."@babel/parser-7.20.13"
       sources."@babel/runtime-7.20.13"
       sources."@codemirror/autocomplete-6.4.0"
       sources."@codemirror/commands-6.2.0"
+      sources."@codemirror/lang-css-6.0.1"
       sources."@codemirror/lang-javascript-6.1.2"
       sources."@codemirror/language-6.4.0"
       sources."@codemirror/lint-6.1.0"
@@ -11363,7 +11508,9 @@ in
       sources."@kwsites/file-exists-1.1.1"
       sources."@kwsites/promise-deferred-1.1.1"
       sources."@lezer/common-1.0.2"
+      sources."@lezer/css-1.1.1"
       sources."@lezer/highlight-1.1.3"
+      sources."@lezer/html-1.3.0"
       sources."@lezer/javascript-1.4.1"
       sources."@lezer/lr-1.3.1"
       sources."@mapbox/node-pre-gyp-1.0.10"
@@ -11385,13 +11532,13 @@ in
       sources."@oclif/command-1.8.21"
       (sources."@oclif/config-1.18.6" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@oclif/core-1.26.1" // {
         dependencies = [
           sources."supports-color-8.1.1"
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
           sources."wrap-ansi-7.0.0"
         ];
       })
@@ -11407,7 +11554,7 @@ in
       sources."@oclif/linewrap-1.0.0"
       (sources."@oclif/parser-3.8.9" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."@oclif/screen-3.0.4"
@@ -11440,15 +11587,15 @@ in
           sources."domhandler-5.0.3"
         ];
       })
-      sources."@sentry/core-7.33.0"
-      sources."@sentry/integrations-7.33.0"
-      sources."@sentry/node-7.33.0"
-      sources."@sentry/types-7.33.0"
-      sources."@sentry/utils-7.33.0"
+      sources."@sentry/core-7.34.0"
+      sources."@sentry/integrations-7.34.0"
+      sources."@sentry/node-7.34.0"
+      sources."@sentry/types-7.34.0"
+      sources."@sentry/utils-7.34.0"
       sources."@servie/events-1.0.0"
       sources."@sqltools/formatter-1.2.5"
-      sources."@swc/core-1.3.28"
-      sources."@swc/wasm-1.3.28"
+      sources."@swc/core-1.3.29"
+      sources."@swc/wasm-1.3.29"
       sources."@techteamer/ocsp-1.0.0"
       sources."@tediousjs/connection-string-0.3.0"
       sources."@tokenizer/token-0.3.0"
@@ -11457,6 +11604,7 @@ in
       sources."@tsconfig/node12-1.0.11"
       sources."@tsconfig/node14-1.0.3"
       sources."@tsconfig/node16-1.0.3"
+      sources."@types/asn1-0.2.0"
       sources."@types/big.js-6.1.6"
       sources."@types/body-parser-1.19.2"
       sources."@types/connect-3.4.35"
@@ -11486,6 +11634,7 @@ in
       sources."@types/stoppable-1.1.1"
       sources."@types/tough-cookie-2.3.8"
       sources."@types/tunnel-0.0.3"
+      sources."@types/uuid-9.0.0"
       sources."@types/validator-13.7.11"
       sources."@types/webidl-conversions-7.0.0"
       sources."@types/whatwg-url-8.2.2"
@@ -11560,7 +11709,7 @@ in
       sources."assert-plus-1.0.0"
       (sources."ast-types-0.13.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."async-3.2.4"
@@ -11574,7 +11723,7 @@ in
       })
       sources."available-typed-arrays-1.0.5"
       sources."avsc-5.7.7"
-      (sources."aws-sdk-2.1301.0" // {
+      (sources."aws-sdk-2.1304.0" // {
         dependencies = [
           sources."buffer-4.9.2"
           sources."events-1.1.1"
@@ -11611,11 +11760,7 @@ in
       sources."bignumber.js-2.4.0"
       sources."binary-extensions-2.2.0"
       sources."binascii-0.0.2"
-      (sources."bindings-1.5.0" // {
-        dependencies = [
-          sources."file-uri-to-path-1.0.0"
-        ];
-      })
+      sources."bindings-1.5.0"
       sources."bintrees-1.0.2"
       (sources."bl-4.1.0" // {
         dependencies = [
@@ -11666,12 +11811,12 @@ in
       sources."callsites-3.1.0"
       (sources."camel-case-4.1.2" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."capital-case-1.0.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."cardinal-2.1.1"
@@ -11684,7 +11829,7 @@ in
       sources."chalk-4.1.2"
       (sources."change-case-4.1.2" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."chardet-0.7.0"
@@ -11719,6 +11864,7 @@ in
         ];
       })
       sources."cluster-key-slot-1.1.2"
+      sources."codemirror-lang-html-n8n-1.0.0"
       sources."codemirror-lang-n8n-expression-0.1.0"
       sources."codepage-1.15.0"
       (sources."color-3.2.1" // {
@@ -11753,7 +11899,7 @@ in
       sources."console-control-strings-1.1.0"
       (sources."constant-case-3.0.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."content-disposition-0.5.4"
@@ -11823,7 +11969,7 @@ in
       sources."domutils-2.8.0"
       (sources."dot-case-3.0.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."dotenv-8.6.0"
@@ -11841,7 +11987,7 @@ in
       sources."encoding-japanese-2.0.0"
       sources."end-of-stream-1.4.4"
       sources."ent-2.2.0"
-      sources."entities-2.2.0"
+      sources."entities-2.1.0"
       sources."env-paths-2.2.1"
       sources."err-code-2.0.3"
       sources."es-abstract-1.21.1"
@@ -11875,6 +12021,7 @@ in
           sources."ms-2.0.0"
         ];
       })
+      sources."express-async-errors-3.1.1"
       (sources."express-openapi-validator-4.13.8" // {
         dependencies = [
           sources."media-typer-1.1.0"
@@ -11906,7 +12053,7 @@ in
       })
       sources."file-saver-2.0.5"
       sources."file-type-16.5.4"
-      sources."file-uri-to-path-2.0.0"
+      sources."file-uri-to-path-1.0.0"
       (sources."filelist-1.0.4" // {
         dependencies = [
           sources."minimatch-5.1.6"
@@ -11968,6 +12115,7 @@ in
       sources."get-system-fonts-2.0.2"
       (sources."get-uri-3.0.2" // {
         dependencies = [
+          sources."file-uri-to-path-2.0.0"
           sources."fs-extra-8.1.0"
           sources."jsonfile-4.0.0"
           sources."universalify-0.1.2"
@@ -12031,7 +12179,7 @@ in
       sources."he-1.2.0"
       (sources."header-case-2.0.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."heap-0.2.7"
@@ -12049,11 +12197,12 @@ in
         ];
       })
       sources."htmlparser2-6.1.0"
-      sources."http-cache-semantics-4.1.0"
+      sources."http-cache-semantics-4.1.1"
       sources."http-errors-2.0.0"
       sources."http-proxy-agent-4.0.1"
       sources."http-signature-1.2.0"
       sources."https-proxy-agent-5.0.1"
+      sources."humanize-duration-3.28.0"
       sources."humanize-ms-1.2.1"
       sources."hyperlinker-1.0.0"
       sources."iconv-lite-0.6.3"
@@ -12082,7 +12231,7 @@ in
       sources."inquirer-7.3.3"
       sources."internal-slot-1.0.4"
       sources."interpret-1.4.0"
-      (sources."ioredis-5.2.6" // {
+      (sources."ioredis-5.3.0" // {
         dependencies = [
           sources."denque-2.1.0"
         ];
@@ -12178,6 +12327,11 @@ in
       sources."jws-3.2.2"
       sources."kafkajs-1.16.0"
       sources."kuler-2.0.0"
+      (sources."ldapts-4.2.2" // {
+        dependencies = [
+          sources."uuid-9.0.0"
+        ];
+      })
       sources."leac-0.6.0"
       sources."leven-2.1.0"
       sources."levn-0.3.0"
@@ -12233,7 +12387,7 @@ in
       sources."lossless-json-1.0.5"
       (sources."lower-case-2.0.2" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."lru-cache-4.0.2"
@@ -12263,12 +12417,7 @@ in
         ];
       })
       sources."mappersmith-2.41.0"
-      (sources."markdown-it-12.3.2" // {
-        dependencies = [
-          sources."argparse-2.0.1"
-          sources."entities-2.1.0"
-        ];
-      })
+      sources."markdown-it-13.0.1"
       sources."markdown-it-emoji-2.0.2"
       sources."markdown-it-link-attributes-4.0.1"
       sources."markdown-it-task-lists-2.1.1"
@@ -12378,25 +12527,31 @@ in
         ];
       })
       sources."mz-2.7.0"
-      (sources."n8n-core-0.151.2" // {
+      (sources."n8n-core-0.152.0" // {
         dependencies = [
           sources."concat-stream-2.0.0"
           sources."readable-stream-3.6.0"
         ];
       })
-      sources."n8n-design-system-0.51.1"
-      (sources."n8n-editor-ui-0.178.1" // {
+      (sources."n8n-design-system-0.52.0" // {
+        dependencies = [
+          sources."argparse-2.0.1"
+          sources."markdown-it-12.3.2"
+          sources."vue2-boring-avatars-0.3.8"
+        ];
+      })
+      (sources."n8n-editor-ui-0.179.0" // {
         dependencies = [
           sources."luxon-2.5.2"
         ];
       })
-      (sources."n8n-nodes-base-0.210.1" // {
+      (sources."n8n-nodes-base-0.211.0" // {
         dependencies = [
           sources."chokidar-3.5.2"
           sources."luxon-2.3.2"
         ];
       })
-      (sources."n8n-workflow-0.133.2" // {
+      (sources."n8n-workflow-0.134.0" // {
         dependencies = [
           sources."luxon-2.3.2"
         ];
@@ -12418,11 +12573,11 @@ in
       sources."nice-try-1.0.5"
       (sources."no-case-3.0.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."node-abi-3.31.0"
-      sources."node-abort-controller-3.0.1"
+      sources."node-abort-controller-3.1.1"
       sources."node-addon-api-4.3.0"
       sources."node-ensure-0.0.0"
       sources."node-fetch-2.6.8"
@@ -12451,7 +12606,7 @@ in
       sources."node-rsa-1.1.1"
       sources."node-ssh-12.0.5"
       sources."nodeify-1.0.1"
-      sources."nodemailer-6.9.0"
+      sources."nodemailer-6.9.1"
       sources."nopt-5.0.0"
       sources."normalize-path-3.0.0"
       sources."normalize-wheel-1.0.1"
@@ -12498,7 +12653,7 @@ in
       sources."packet-reader-1.0.0"
       (sources."param-case-3.0.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."parse-github-url-1.0.2"
@@ -12510,7 +12665,7 @@ in
       sources."parseurl-1.3.3"
       (sources."pascal-case-3.1.2" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."passport-0.6.0"
@@ -12524,7 +12679,7 @@ in
       })
       (sources."path-case-3.0.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."path-dirname-1.0.2"
@@ -12543,9 +12698,9 @@ in
       sources."peberminta-0.8.0"
       sources."peek-readable-4.1.0"
       sources."performance-now-2.1.0"
-      sources."pg-8.8.0"
+      sources."pg-8.9.0"
       sources."pg-connection-string-2.5.0"
-      sources."pg-cursor-2.7.4"
+      sources."pg-cursor-2.8.0"
       sources."pg-int8-1.0.1"
       sources."pg-minify-1.6.2"
       (sources."pg-native-3.0.1" // {
@@ -12558,9 +12713,13 @@ in
         ];
       })
       sources."pg-pool-3.5.2"
-      sources."pg-promise-10.15.4"
-      sources."pg-protocol-1.5.0"
-      sources."pg-query-stream-4.2.4"
+      (sources."pg-promise-10.15.4" // {
+        dependencies = [
+          sources."pg-8.8.0"
+        ];
+      })
+      sources."pg-protocol-1.6.0"
+      sources."pg-query-stream-4.3.0"
       sources."pg-types-2.2.0"
       (sources."pgpass-1.0.5" // {
         dependencies = [
@@ -12582,13 +12741,14 @@ in
       sources."postgres-bytea-1.0.0"
       sources."postgres-date-1.0.7"
       sources."postgres-interval-1.2.0"
-      (sources."posthog-node-2.2.3" // {
+      (sources."posthog-node-2.3.0" // {
         dependencies = [
           sources."axios-0.27.2"
         ];
       })
       sources."prebuild-install-7.1.1"
       sources."prelude-ls-1.1.2"
+      sources."prettier-2.8.3"
       sources."pretty-bytes-5.6.0"
       sources."printj-1.1.2"
       sources."prismjs-1.29.0"
@@ -12651,7 +12811,7 @@ in
       (sources."recast-0.21.5" // {
         dependencies = [
           sources."ast-types-0.15.2"
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."rechoir-0.6.2"
@@ -12710,7 +12870,7 @@ in
       sources."safe-regex-test-1.0.0"
       sources."safe-stable-stringify-2.4.2"
       sources."safer-buffer-2.1.2"
-      (sources."sanitize-html-2.7.0" // {
+      (sources."sanitize-html-2.7.3" // {
         dependencies = [
           sources."deepmerge-4.2.2"
         ];
@@ -12737,7 +12897,7 @@ in
       })
       (sources."sentence-case-3.0.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."seq-queue-0.0.5"
@@ -12767,7 +12927,7 @@ in
       sources."smart-buffer-4.2.0"
       (sources."snake-case-3.0.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."snowflake-sdk-1.6.17" // {
@@ -12820,9 +12980,15 @@ in
       sources."statuses-2.0.1"
       sources."stealthy-require-1.1.1"
       sources."stoppable-1.1.0"
+      (sources."stream-browserify-3.0.0" // {
+        dependencies = [
+          sources."readable-stream-3.6.0"
+        ];
+      })
       sources."stream-events-1.0.5"
       sources."stream-shift-1.0.1"
       sources."streamsearch-1.1.0"
+      sources."strict-event-emitter-types-2.0.0"
       sources."strict-uri-encode-2.0.0"
       sources."string-similarity-4.0.4"
       sources."string-width-4.2.3"
@@ -12957,7 +13123,7 @@ in
               sources."bl-5.1.0"
             ];
           })
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
           sources."wrap-ansi-7.0.0"
           sources."yargs-17.6.2"
           sources."yargs-parser-21.1.1"
@@ -12978,12 +13144,12 @@ in
       sources."unpipe-1.0.0"
       (sources."upper-case-2.0.2" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."upper-case-first-2.0.2" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."uri-js-4.4.1"
@@ -13033,6 +13199,7 @@ in
       sources."vue-demi-0.13.11"
       sources."vue-fragment-1.5.1"
       sources."vue-i18n-8.28.2"
+      sources."vue-infinite-loading-2.4.5"
       sources."vue-json-pretty-1.9.3"
       sources."vue-prism-editor-0.3.0"
       sources."vue-router-3.6.5"
diff --git a/pkgs/applications/video/haruna/default.nix b/pkgs/applications/video/haruna/default.nix
index a776fabc9a790..3849acda9473e 100644
--- a/pkgs/applications/video/haruna/default.nix
+++ b/pkgs/applications/video/haruna/default.nix
@@ -26,13 +26,13 @@
 
 mkDerivation rec {
   pname = "haruna";
-  version = "0.10.0";
+  version = "0.10.2";
 
   src = fetchFromGitLab {
     owner = "multimedia";
     repo = "haruna";
     rev = "v${version}";
-    hash = "sha256-UU8tbaZz7udDulh+PHPZDc3rm1MvK4dafPgXL50apMI=";
+    hash = "sha256-hhHWxmr2EzW9QqfV1bpJCiWOWsmGJmvxvtQcuXlMTc4=";
     domain = "invent.kde.org";
   };
 
diff --git a/pkgs/data/fonts/fraunces/default.nix b/pkgs/data/fonts/fraunces/default.nix
index 2d053b1ce7fcb..7e453d05173f1 100644
--- a/pkgs/data/fonts/fraunces/default.nix
+++ b/pkgs/data/fonts/fraunces/default.nix
@@ -1,14 +1,22 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
-let
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "fraunces";
   version = "1.000";
-in
-(fetchzip {
-  name = "fraunces-${version}";
 
-  url = "https://github.com/undercasetype/Fraunces/releases/download/${version}/UnderCaseType_Fraunces_${version}.zip";
+  src = fetchzip {
+    url = "https://github.com/undercasetype/Fraunces/releases/download/${version}/UnderCaseType_Fraunces_${version}.zip";
+    hash = "sha256-hu2G4Fs2I3TMEy/EBFnc88Pv3c8Mpc5rm3OwVvol7gQ=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "0qgl140qkn9p87x7pk60fd3lj206y5h0fq2xkcj2qiv3sxbqxwqb";
+    install -Dm644 *Desktop/static/otf/*.otf -t $out/share/fonts/opentype
+    install -Dm644 *Desktop/static/ttf/*.ttf *Desktop/*.ttf -t $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "A display, “Old Style” soft-serif typeface inspired by early 20th century typefaces";
@@ -17,10 +25,4 @@ in
     maintainers = [ maintainers.marsam ];
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/galatia-sil/default.nix b/pkgs/data/fonts/galatia-sil/default.nix
index 965596373c26e..70881399d593e 100644
--- a/pkgs/data/fonts/galatia-sil/default.nix
+++ b/pkgs/data/fonts/galatia-sil/default.nix
@@ -1,31 +1,31 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "galatia-sil";
   version = "2.1";
-  name = "galatia-sil-${version}";
-in
-  (fetchzip rec {
-    inherit name;
 
+  src = fetchzip {
     url = "https://software.sil.org/downloads/r/galatia/GalatiaSIL-${version}.zip";
+    hash = "sha256-7kXnTC5vpUOjcT40oNW6e32zFGejlWJq1J+p+5DiAos=";
+  };
 
-    sha256 = "sha256-zLL/7LMcJul2LilhEafpvm+tiYlgv1y1jj85VvG+wiI=";
+  installPhase = ''
+    runHook preInstall
 
-    meta = with lib; {
-      homepage = "https://software.sil.org/galatia";
-      description = "Font designed to support Biblical Polytonic Greek";
-      longDescription = ''
-        Galatia SIL, designed to support Biblical Polytonic Greek, is a Unicode 3.1 font released under the SIL Open Font License. The font supports precomposed characters rather than decomposed characters. Thus, you must use a keyboard that outputs NFC encoding (precomposed).
-      '';
-      license = licenses.ofl;
-      platforms = platforms.all;
-      maintainers = [ maintainers.kmein ];
-    };
-  }).overrideAttrs (_: {
-    postFetch = ''
-      mkdir -p $out/share/{doc,fonts}
-      unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
-      unzip -j $downloadedFile \*OFL.txt \*OFL-FAQ.txt \*FONTLOG.txt -d "$out/share/doc/${name}"
+    install -Dm644 $downloadedFile *.ttf -t $out/share/fonts/truetype
+    install -Dm644 $downloadedFile OFL.txt OFL-FAQ.txt FONTLOG.txt -t $out/share/doc/${pname}-${version}
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://software.sil.org/galatia";
+    description = "Font designed to support Biblical Polytonic Greek";
+    longDescription = ''
+      Galatia SIL, designed to support Biblical Polytonic Greek, is a Unicode 3.1 font released under the SIL Open Font License. The font supports precomposed characters rather than decomposed characters. Thus, you must use a keyboard that outputs NFC encoding (precomposed).
     '';
-  })
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = [ maintainers.kmein ];
+  };
+}
diff --git a/pkgs/data/fonts/gentium-book-basic/default.nix b/pkgs/data/fonts/gentium-book-basic/default.nix
index be2f71b5346cf..96e9789cd115d 100644
--- a/pkgs/data/fonts/gentium-book-basic/default.nix
+++ b/pkgs/data/fonts/gentium-book-basic/default.nix
@@ -1,17 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
-  major = "1";
-  minor = "102";
-  version = "${major}.${minor}";
-  name = "gentium-book-basic-${version}";
-in (fetchzip rec {
-  inherit name;
+stdenvNoCC.mkDerivation rec {
+  pname = "gentium-book-basic";
+  version = "1.102";
 
-  url = "http://software.sil.org/downloads/r/gentium/GentiumBasic_${major}${minor}.zip";
+  src = fetchzip {
+    url = "http://software.sil.org/downloads/r/gentium/GentiumBasic_${lib.versions.major version}${lib.versions.minor version}.zip";
+    hash = "sha256-oCmpl95MJRfCV25cg/4cf8AwQWnoymXasSss1ziOPoE=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "0598zr5f7d6ll48pbfbmmkrybhhdks9b2g3m2g67wm40070ffzmd";
+    mkdir -p $out/share/{doc,fonts}
+    install -Dm644 *.ttf                       -t $out/share/fonts/truetype
+    install -Dm644 FONTLOG.txt GENTIUM-FAQ.txt -t $out/share/doc/${pname}-${version}
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://software.sil.org/gentium/";
@@ -20,10 +26,4 @@ in (fetchzip rec {
     license = licenses.ofl;
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -j $downloadedFile \*.ttf                            -d $out/share/fonts/truetype
-    unzip -j $downloadedFile \*/FONTLOG.txt \*/GENTIUM-FAQ.txt -d $out/share/doc/${name}
-  '';
-})
+}
diff --git a/pkgs/data/fonts/gentium/default.nix b/pkgs/data/fonts/gentium/default.nix
index 9494f8e62afe4..5c3f7dfab23f1 100644
--- a/pkgs/data/fonts/gentium/default.nix
+++ b/pkgs/data/fonts/gentium/default.nix
@@ -1,15 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "gentium";
   version = "6.101";
-  name = "gentium-${version}";
-in (fetchzip rec {
-  inherit name;
 
-  url = "http://software.sil.org/downloads/r/gentium/GentiumPlus-${version}.zip";
+  src = fetchzip {
+    url = "http://software.sil.org/downloads/r/gentium/GentiumPlus-${version}.zip";
+    hash = "sha256-iKD1Q7/lsbZCuJQoJqySQHwplrHv8yzmph+QwKpYgMU=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "sha256-+T5aUlqQYDWRp4/4AZzsREHgjAnOeUB6qn1GAI0A5hE=";
+    install -Dm644 *.ttf -t $out/share/fonts/truetype
+    install -Dm644 FONTLOG.txt README.txt -t $out/share/doc/${pname}-${version}
+    cp -r documentation $out/share/doc/${pname}-${version}
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://software.sil.org/gentium/";
@@ -34,20 +42,4 @@ in (fetchzip rec {
     license = licenses.ofl;
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -l $downloadedFile
-    unzip -j $downloadedFile \*.ttf \
-      -d $out/share/fonts/truetype
-    unzip -j $downloadedFile \
-      \*/FONTLOG.txt \
-      \*/README.txt \
-      -d $out/share/doc/${name}
-    unzip -j $downloadedFile \
-      \*/documentation/\*.html \
-      \*/documentation/\*.txt \
-      -x \*/documentation/source/\* \
-      -d $out/share/doc/${name}/documentation
-  '';
-})
+}
diff --git a/pkgs/data/fonts/hack/default.nix b/pkgs/data/fonts/hack/default.nix
index 4b67da84d99ae..6c6bd1918dbf8 100644
--- a/pkgs/data/fonts/hack/default.nix
+++ b/pkgs/data/fonts/hack/default.nix
@@ -1,14 +1,21 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "hack-font";
   version = "3.003";
-in (fetchzip {
-  name = "hack-font-${version}";
 
-  url = "https://github.com/chrissimpkins/Hack/releases/download/v${version}/Hack-v${version}-ttf.zip";
+  src = fetchzip {
+    url = "https://github.com/chrissimpkins/Hack/releases/download/v${version}/Hack-v${version}-ttf.zip";
+    hash = "sha256-SxF4kYp9aL/9L9EUniquFadzWt/+PcvhUQOIOvCrFRM=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "1l6ih6v7dqali5c7zh6z2xnbf9h2wz0ag6fdgszmqd5lnhw39v6s";
+    install -Dm644 *.ttf -t $out/share/fonts/hack
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "A typeface designed for source code";
@@ -22,7 +29,7 @@ in (fetchzip {
     homepage = "https://sourcefoundry.org/hack/";
 
     /*
-     "The font binaries are released under a license that permits unlimited
+      "The font binaries are released under a license that permits unlimited
       print, desktop, and web use for commercial and non-commercial
       applications. It may be embedded and distributed in documents and
       applications. The source is released in the widely supported UFO format
@@ -33,9 +40,4 @@ in (fetchzip {
     maintainers = with maintainers; [ dywedir ];
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/hack
-  '';
-})
+}
diff --git a/pkgs/data/fonts/hasklig/default.nix b/pkgs/data/fonts/hasklig/default.nix
index 8c81bf520424e..a69f8f743cbea 100644
--- a/pkgs/data/fonts/hasklig/default.nix
+++ b/pkgs/data/fonts/hasklig/default.nix
@@ -1,14 +1,22 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "hasklig";
   version = "1.1";
-in (fetchzip {
-  name = "hasklig-${version}";
 
-  url = "https://github.com/i-tu/Hasklig/releases/download/${version}/Hasklig-${version}.zip";
+  src = fetchzip {
+    url = "https://github.com/i-tu/Hasklig/releases/download/${version}/Hasklig-${version}.zip";
+    stripRoot = false;
+    hash = "sha256-jsPQtjuegMePt4tB1dZ9mq15LSxXBYwtakbq4od/sko=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "0xxyx0nkapviqaqmf3b610nq17k20afirvc72l32pfspsbxz8ybq";
+    install -m444 -Dt $out/share/fonts/opentype *.otf
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/i-tu/Hasklig";
@@ -17,9 +25,4 @@ in (fetchzip {
     platforms = platforms.all;
     maintainers = with maintainers; [ davidrusu Profpatsch ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    unzip $downloadedFile
-    install -m444 -Dt $out/share/fonts/opentype *.otf
-  '';
-})
+}
diff --git a/pkgs/data/fonts/hyperscrypt/default.nix b/pkgs/data/fonts/hyperscrypt/default.nix
index 29abcfd607f78..c72e4b9e19a09 100644
--- a/pkgs/data/fonts/hyperscrypt/default.nix
+++ b/pkgs/data/fonts/hyperscrypt/default.nix
@@ -1,15 +1,22 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ fetchzip, lib }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "hyperscrypt";
   version = "1.1";
-  pname = "HyperScrypt";
-in
 
-(fetchzip {
-  name = "${lib.toLower pname}-font-${version}";
-  url = "https://gitlab.com/StudioTriple/Hyper-Scrypt/-/archive/${version}/Hyper-Scrypt-${version}.zip";
-  sha256 = "01pf5p2scmw02s0gxnibiwxbpzczphaaapv0v4s7svk9aw2gmc0m";
+  src = fetchzip {
+    url = "https://gitlab.com/StudioTriple/Hyper-Scrypt/-/archive/${version}/Hyper-Scrypt-${version}.zip";
+    hash = "sha256-ONlAB9C/GYK6KmOaiHCYErkS6OlQ3TUnoumNDHGZnes=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 fonts/HyperScrypt_Web/*.ttf -t $out/share/fonts/truetype/
+    install -Dm644 fonts/HyperScrypt_Web/*.otf fonts/*.otf -t $out/share/fonts/opentype/
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://velvetyne.fr/fonts/hyper-scrypt/";
@@ -28,15 +35,9 @@ in
       molted metal, Hyper Scrypt is based upon a rigorous grid,
       allowing some neat alignements between shapes in multi lines
       layouts.
-      '';
+    '';
     license = licenses.ofl;
     maintainers = with maintainers; [ leenaars ];
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/{truetype,opentype}
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype/${pname}.ttf
-    unzip -j $downloadedFile \*${pname}.otf -d $out/share/fonts/opentype/${pname}.otf
-  '';
-})
+}
diff --git a/pkgs/data/fonts/ibm-plex/default.nix b/pkgs/data/fonts/ibm-plex/default.nix
index c632338d59e1b..9909f8f5a3e0b 100644
--- a/pkgs/data/fonts/ibm-plex/default.nix
+++ b/pkgs/data/fonts/ibm-plex/default.nix
@@ -1,15 +1,21 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "ibm-plex";
   version = "6.0.1";
 
-in (fetchzip {
-  name = "ibm-plex-${version}";
+  src = fetchzip {
+    url = "https://github.com/IBM/plex/releases/download/v${version}/OpenType.zip";
+    hash = "sha256-n13NuKrZUc0JGvDf2PLZkxogefDkEHaOZk4JN42/C74=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  url = "https://github.com/IBM/plex/releases/download/v${version}/OpenType.zip";
+    install -Dm644 */*.otf IBM-Plex-Sans-JP/unhinted/* -t $out/share/fonts/opentype
 
-  sha256 = "sha256-HxO0L5Q6WJQBqtg64cczzuRcSYi4jEqbOzEWxDmqFp8=";
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "IBM Plex Typeface";
@@ -19,9 +25,4 @@ in (fetchzip {
     platforms = platforms.all;
     maintainers = [ maintainers.romildo ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile "OpenType/*/*.otf" -x "OpenType/IBM-Plex-Sans-JP/unhinted/*" -d $out/share/fonts/opentype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/inter/default.nix b/pkgs/data/fonts/inter/default.nix
index 16adc93a9eec2..46ab699fd3986 100644
--- a/pkgs/data/fonts/inter/default.nix
+++ b/pkgs/data/fonts/inter/default.nix
@@ -1,14 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "inter";
   version = "3.19";
-in (fetchzip {
-  name = "inter-${version}";
 
-  url = "https://github.com/rsms/inter/releases/download/v${version}/Inter-${version}.zip";
+  src = fetchzip {
+    url = "https://github.com/rsms/inter/releases/download/v${version}/Inter-${version}.zip";
+    stripRoot = false;
+    hash = "sha256-6kUQUTFtxiJEU6sYC6HzMwm1H4wvaKIoxoY3F6GJJa8=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/fonts/opentype
+    cp */*.otf $out/share/fonts/opentype
 
-  sha256 = "sha256-8p15thg3xyvCA/8dH2jGQoc54nzESFDyv5m47FgWrSI=";
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://rsms.me/inter/";
@@ -17,10 +26,4 @@ in (fetchzip {
     platforms = platforms.all;
     maintainers = with maintainers; [ demize dtzWill ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/opentype
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-  '';
-})
-
+}
diff --git a/pkgs/data/fonts/ipaexfont/default.nix b/pkgs/data/fonts/ipaexfont/default.nix
index 9f3268f8d5b76..986eab13a2577 100644
--- a/pkgs/data/fonts/ipaexfont/default.nix
+++ b/pkgs/data/fonts/ipaexfont/default.nix
@@ -1,12 +1,21 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-(fetchzip {
-  name = "ipaexfont-004.01";
+stdenvNoCC.mkDerivation {
+  pname = "ipaexfont";
+  version = "004.01";
 
-  url = "https://moji.or.jp/wp-content/ipafont/IPAexfont/IPAexfont00401.zip";
+  src = fetchzip {
+    url = "https://moji.or.jp/wp-content/ipafont/IPAexfont/IPAexfont00401.zip";
+    hash = "sha256-/87qJIb+v4qrtDy+ApfXxh59reOk+6RhGqFN98mc+8Q=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "0wp369kri33kb1mmiq4lpl9i4xnacw9fj63ycmkmlkq64s8qnjnx";
+    install -Dm644 *.ttf -t $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "Japanese font package with Mincho and Gothic fonts";
@@ -21,9 +30,4 @@
     license = licenses.ipa;
     maintainers = with maintainers; [ gebner ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/opentype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/ipafont/default.nix b/pkgs/data/fonts/ipafont/default.nix
index 5dca9b9faa918..8a1f91da34fb3 100644
--- a/pkgs/data/fonts/ipafont/default.nix
+++ b/pkgs/data/fonts/ipafont/default.nix
@@ -1,12 +1,21 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-(fetchzip {
-  name = "ipafont-003.03";
+stdenvNoCC.mkDerivation {
+  pname = "ipafont";
+  version = "003.03";
 
-  url = "https://moji.or.jp/wp-content/ipafont/IPAfont/IPAfont00303.zip";
+  src = fetchzip {
+    url = "https://moji.or.jp/wp-content/ipafont/IPAfont/IPAfont00303.zip";
+    hash = "sha256-EzUNKuDNHr0NIXiqX09w99wtz1r2pZurR/izdgzTcAs=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "0lrjd0bfy36f9j85m12afg5nvr5id3sig2nmzs5qifskbd7mqv9h";
+    install -Dm644 *.ttf -t $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
 
   meta = {
     description = "Japanese font package with Mincho and Gothic fonts";
@@ -19,9 +28,4 @@
     license = lib.licenses.ipa;
     maintainers = [ lib.maintainers.auntie ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/opentype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/jost/default.nix b/pkgs/data/fonts/jost/default.nix
index 676ec842c8d24..f5d3a1e48b5a1 100644
--- a/pkgs/data/fonts/jost/default.nix
+++ b/pkgs/data/fonts/jost/default.nix
@@ -1,13 +1,21 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{lib, fetchzip}:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "jost";
   version = "3.5";
-in (fetchzip {
-  name = "jost-${version}";
-  url = "https://github.com/indestructible-type/Jost/releases/download/${version}/Jost.zip";
 
-  sha256="0l78vhmbsyfmrva5wc76pskhxqryyg8q5xddpj9g5wqsddy525dq";
+  src = fetchzip {
+    url = "https://github.com/indestructible-type/Jost/releases/download/${version}/Jost.zip";
+    hash = "sha256-ne81bMhmTzNZ/GGIzb7nCYh19vNLK+hJ3cP/zDxtiGM=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 fonts/otf/*.otf -t $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/indestructible-type/Jost";
@@ -15,9 +23,4 @@ in (fetchzip {
     license = licenses.ofl;
     maintainers = [ maintainers.ar1a ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/julia-mono/default.nix b/pkgs/data/fonts/julia-mono/default.nix
index 47b1afd36fd96..e99dfde411dcb 100644
--- a/pkgs/data/fonts/julia-mono/default.nix
+++ b/pkgs/data/fonts/julia-mono/default.nix
@@ -2,12 +2,12 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "JuliaMono-ttf";
-  version = "0.046";
+  version = "0.047";
 
   src = fetchzip {
     url = "https://github.com/cormullion/juliamono/releases/download/v${version}/${pname}.tar.gz";
     stripRoot = false;
-    hash = "sha256-mq37L3bhUhdjB8z3I9i8+wyLrMSsu/nZrZXOuqE3JlU=";
+    hash = "sha256-tCZo48SBGdhcsP1wgaWkfWr3L3Yz+p/iqesLmarSWbk=";
   };
 
   installPhase = ''
diff --git a/pkgs/data/fonts/kawkab-mono/default.nix b/pkgs/data/fonts/kawkab-mono/default.nix
index 2dbe43aa6aec6..1a2f51a6d625f 100644
--- a/pkgs/data/fonts/kawkab-mono/default.nix
+++ b/pkgs/data/fonts/kawkab-mono/default.nix
@@ -1,21 +1,26 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-(fetchzip {
-  name = "kawkab-mono-20151015";
+stdenvNoCC.mkDerivation {
+  pname = "kawkab-mono";
+  version = "20151015";
 
-  url = "http://makkuk.com/kawkab-mono/downloads/kawkab-mono-0.1.zip";
+  src = fetchzip {
+    url = "http://makkuk.com/kawkab-mono/downloads/kawkab-mono-0.1.zip";
+    stripRoot = false;
+    hash = "sha256-arZTzXj7Ba5G4WF3eZVGNaONhOsYVPih9iBgsN/lg14=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "1vfrb7xs817najplncg7zl9j5yxj8qnwb7aqm2v9p9xwafa4d2yd";
+    install -Dm644 *.ttf -t $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
 
   meta = {
     description = "An arab fixed-width font";
     homepage = "https://makkuk.com/kawkab-mono/";
     license = lib.licenses.ofl;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/lato/default.nix b/pkgs/data/fonts/lato/default.nix
index 7fa894c1cc8d2..ff1cc62bee0e9 100644
--- a/pkgs/data/fonts/lato/default.nix
+++ b/pkgs/data/fonts/lato/default.nix
@@ -1,12 +1,22 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-(fetchzip {
-  name = "lato-2.0";
+stdenvNoCC.mkDerivation {
+  pname = "lato";
+  version = "2.0";
 
-  url = "https://www.latofonts.com/download/Lato2OFL.zip";
+  src = fetchzip {
+    url = "https://www.latofonts.com/download/Lato2OFL.zip";
+    stripRoot = false;
+    hash = "sha256-n1TsqigCQIGqyGLGTjLtjHuBf/iCwRlnqh21IHfAuXI=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "1amwn6vcaggxrd2s4zw21s2pr47zmzdf2xfy4x9lxa2cd9bkhvg5";
+    install -Dm644 Lato2OFL/*.ttf -t $out/share/fonts/lato
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://www.latofonts.com/";
@@ -32,9 +42,4 @@
     platforms = platforms.all;
     maintainers = with maintainers; [ chris-martin ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/lato
-  '';
-})
+}
diff --git a/pkgs/data/fonts/lmmath/default.nix b/pkgs/data/fonts/lmmath/default.nix
index ebe4ceb88ca11..3881f0f0f4e76 100644
--- a/pkgs/data/fonts/lmmath/default.nix
+++ b/pkgs/data/fonts/lmmath/default.nix
@@ -1,13 +1,24 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "lmmath";
   version = "1.959";
-in (fetchzip rec {
-  name = "lmmath-${version}";
 
-  url = "http://www.gust.org.pl/projects/e-foundry/lm-math/download/latinmodern-math-1959.zip";
-  sha256 = "05k145bxgxjh7i9gx1ahigxfpc2v2vwzsy2mc41jvvg51kjr8fnn";
+  src = fetchzip {
+    url = "http://www.gust.org.pl/projects/e-foundry/lm-math/download/latinmodern-math-1959.zip";
+    hash = "sha256-et/WMhfZZYgP0S7ZmI6MZK5owv9bSoMBXFX6yGSng5Y=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/fonts/opentype/
+    mkdir -p $out/share/doc/latinmodern-math-${version}/
+    cp otf/*.otf $out/share/fonts/opentype/
+    cp doc/*.txt $out/share/doc/latinmodern-math-${version}/
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "The Latin Modern Math (LM Math) font completes the modernization of the Computer Modern family of typefaces designed and programmed by Donald E. Knuth";
@@ -19,11 +30,4 @@ in (fetchzip rec {
     maintainers = with maintainers; [ siddharthist ];
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/opentype/
-    mkdir -p $out/share/doc/latinmodern-math-${version}/
-    unzip -j $downloadedFile "*/otf/*.otf" -d $out/share/fonts/opentype/
-    unzip -j $downloadedFile "*/doc/*.txt" -d $out/share/doc/latinmodern-math-${version}/
-  '';
-})
+}
diff --git a/pkgs/data/fonts/mno16/default.nix b/pkgs/data/fonts/mno16/default.nix
index f0ff4c1b2052e..59597120c1003 100644
--- a/pkgs/data/fonts/mno16/default.nix
+++ b/pkgs/data/fonts/mno16/default.nix
@@ -1,22 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
   pname = "mno16";
   version = "1.0";
-in (fetchzip rec {
-  name = "${pname}-${version}";
-  url = "https://github.com/sevmeyer/${pname}/releases/download/${version}/${name}.zip";
-  sha256 = "1x06nl281fcjk6g1p4cgrgxakmwcci6vvasskaygsqlzxd8ig87w";
+
+  src = fetchzip {
+    url = "https://github.com/sevmeyer/${pname}/releases/download/${version}/${pname}-${version}.zip";
+    stripRoot = false;
+    hash = "sha256-xJQ9V7GlGUTEeYhqYFl/SemS6iqV0eW85YOn/tLgA+M=";
+  };
+
+  installPhase = ''
+    mkdir -p $out/share/fonts/truetype
+    cp fonts/*.ttf $out/share/fonts/truetype/
+  '';
 
   meta = with lib; {
     description = "minimalist monospaced font";
     homepage = "https://sev.dev/fonts/mno16";
     license = licenses.cc0;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/truetype
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype/
-  '';
-})
+}
diff --git a/pkgs/data/fonts/mononoki/default.nix b/pkgs/data/fonts/mononoki/default.nix
index b45d130b1c284..7f7c2876694fc 100644
--- a/pkgs/data/fonts/mononoki/default.nix
+++ b/pkgs/data/fonts/mononoki/default.nix
@@ -1,14 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "mononoki";
   version = "1.3";
-in (fetchzip {
-  name = "mononoki-${version}";
 
-  url = "https://github.com/madmalik/mononoki/releases/download/${version}/mononoki.zip";
+  src = fetchzip {
+    url = "https://github.com/madmalik/mononoki/releases/download/${version}/mononoki.zip";
+    stripRoot = false;
+    hash = "sha256-bZYBRdmbQVs4i6UzMIHwJnoLWggX4CW8ZogNFYiX/9w=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "sha256-K2uOpJRmQ1NcDZfh6rorCF0MvGHFCsSW8J7Ue9OC/OY=";
+    mkdir -p $out/share/fonts/mononoki
+    cp webfont/* $out/share/fonts/mononoki
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/madmalik/mononoki";
@@ -16,9 +25,4 @@ in (fetchzip {
     license = licenses.ofl;
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/mononoki
-    unzip -j $downloadedFile -d $out/share/fonts/mononoki
-  '';
-})
+}
diff --git a/pkgs/data/fonts/nanum-gothic-coding/default.nix b/pkgs/data/fonts/nanum-gothic-coding/default.nix
index 4a0e3c975f542..3798a33b66c67 100644
--- a/pkgs/data/fonts/nanum-gothic-coding/default.nix
+++ b/pkgs/data/fonts/nanum-gothic-coding/default.nix
@@ -1,15 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
-  version = "VER2.5";
-  fullName = "NanumGothicCoding-2.5";
+stdenvNoCC.mkDerivation rec {
+  pname = "nanum-gothic-coding";
+  version = "2.5";
 
-in (fetchzip {
-  name = "nanum-gothic-coding";
-  url = "https://github.com/naver/nanumfont/releases/download/${version}/${fullName}.zip";
+  src = fetchzip {
+    url = "https://github.com/naver/nanumfont/releases/download/VER${version}/NanumGothicCoding-${version}.zip";
+    stripRoot = false;
+    hash = "sha256-jHbbCMUxn54iQMKdAWI3r8CDxi+5LLJh8ucQzq2Ukdc=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "0b3pkhd6xn6393zi0dhj3ah08w1y1ji9fl6584bi0c8lanamf2pc";
+    mkdir -p $out/share/fonts/NanumGothicCoding
+    cp *.ttf $out/share/fonts/NanumGothicCoding
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "A contemporary monospaced sans-serif typeface with a warm touch";
@@ -18,9 +26,4 @@ in (fetchzip {
     platforms = platforms.all;
     maintainers = with maintainers; [ ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/NanumGothicCoding
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/NanumGothicCoding
-  '';
-})
+}
diff --git a/pkgs/data/fonts/national-park/default.nix b/pkgs/data/fonts/national-park/default.nix
index cfa36870ed4bc..4970e0d5920fa 100644
--- a/pkgs/data/fonts/national-park/default.nix
+++ b/pkgs/data/fonts/national-park/default.nix
@@ -1,14 +1,22 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
   pname = "national-park-typeface";
   version = "206464";
-in (fetchzip {
-  name = "${pname}-${version}";
-  url = "https://files.cargocollective.com/c${version}/NationalPark.zip";
 
-  sha256 = "044gh4xcasp8i9ny6z4nmns1am2pk5krc4ann2afq35v9bnl2q5d";
+  src = fetchzip {
+    url = "https://files.cargocollective.com/c${version}/NationalPark.zip";
+    stripRoot = false;
+    hash = "sha256-VUboZZVJfKupnoHXo3RxetEEYimrr1DxghVZaaWnnw4=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 *.otf -t $out/share/fonts/opentype/
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = ''Typeface designed to mimic the national park service
@@ -17,9 +25,4 @@ in (fetchzip {
     license = licenses.ofl;
     maintainers = with maintainers; [ dtzWill ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile National\*.otf -d $out/share/fonts/opentype/
-  '';
-})
+}
diff --git a/pkgs/data/fonts/norwester/default.nix b/pkgs/data/fonts/norwester/default.nix
index 5d96ba5527205..f1236d5c05c10 100644
--- a/pkgs/data/fonts/norwester/default.nix
+++ b/pkgs/data/fonts/norwester/default.nix
@@ -1,15 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
-  version = "1.2";
+stdenvNoCC.mkDerivation rec {
   pname = "norwester";
-in (fetchzip {
-  name = "${pname}-${version}";
+  version = "1.2";
 
-  url = "http://jamiewilson.io/norwester/assets/norwester.zip";
+  src = fetchzip {
+    url = "http://jamiewilson.io/norwester/assets/norwester.zip";
+    stripRoot = false;
+    hash = "sha256-Ak/nobrQE/XYGWs/IhlZlTp74ff+s4adUR6Sht5Yf8g=";
+  };
 
-  sha256 = "1npsaiiz9g5z6315lnmynwcnrfl37fyxc7w1mhkw1xbzcnv74z4r";
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/fonts/opentype
+    cp ${pname}-v${version}/${pname}.otf $out/share/fonts/opentype/
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "http://jamiewilson.io/norwester";
@@ -18,9 +26,4 @@ in (fetchzip {
     license = licenses.ofl;
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/opentype
-    unzip -D -j $downloadedFile ${pname}-v${version}/${pname}.otf -d $out/share/fonts/opentype/
-  '';
-})
+}
diff --git a/pkgs/data/fonts/oldstandard/default.nix b/pkgs/data/fonts/oldstandard/default.nix
index c6b7846a85fe9..33bf37c18baef 100644
--- a/pkgs/data/fonts/oldstandard/default.nix
+++ b/pkgs/data/fonts/oldstandard/default.nix
@@ -1,15 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "oldstandard";
   version = "2.2";
-  name = "oldstandard-${version}";
-in (fetchzip rec {
-  inherit name;
 
-  url = "https://github.com/akryukov/oldstand/releases/download/v${version}/${name}.otf.zip";
+  src = fetchzip {
+    url = "https://github.com/akryukov/oldstand/releases/download/v${version}/${pname}-${version}.otf.zip";
+    stripRoot = false;
+    hash = "sha256-cDB5KJm87DK+GczZ3Nmn4l5ejqViswVbwrJ9XbhEh8I=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "1qwfsyp51grr56jcnkkmnrnl3r20pmhp9zh9g88kp64m026cah6n";
+    install -m444 -Dt $out/share/fonts/opentype *.otf
+    install -m444 -Dt $out/share/doc/${pname}-${version}    FONTLOG.txt
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/akryukov/oldstand";
@@ -18,10 +26,4 @@ in (fetchzip rec {
     license = licenses.ofl;
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    unzip $downloadedFile
-    install -m444 -Dt $out/share/fonts/opentype *.otf
-    install -m444 -Dt $out/share/doc/${name}    FONTLOG.txt
-  '';
-})
+}
diff --git a/pkgs/data/fonts/open-dyslexic/default.nix b/pkgs/data/fonts/open-dyslexic/default.nix
index f34ff0c17b7a7..8a6b01b1d6d79 100644
--- a/pkgs/data/fonts/open-dyslexic/default.nix
+++ b/pkgs/data/fonts/open-dyslexic/default.nix
@@ -1,26 +1,28 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation {
+  pname = "open-dyslexic";
   version = "2016-06-23";
-in (fetchzip {
-  name = "open-dyslexic-${version}";
 
-  url = "https://github.com/antijingoist/open-dyslexic/archive/20160623-Stable.zip";
+  src = fetchzip {
+    url = "https://github.com/antijingoist/open-dyslexic/archive/20160623-Stable.zip";
+    hash = "sha256-f/uavR3n0qHyqumZDw7r8Zy0om2RlJAKyWuGaUXSJ1s=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "1vl8z5rknh2hpr2f0v4b2qgs5kclx5pzyk8al7243k5db82a2cyi";
+    install -Dm644 otf/*.otf -t $out/share/fonts/opentype
+    install -Dm644 README.md -t $out/share/doc/open-dyslexic
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://opendyslexic.org/";
     description = "Font created to increase readability for readers with dyslexia";
     license = "Bitstream Vera License (https://www.gnome.org/fonts/#Final_Bitstream_Vera_Fonts)";
     platforms = platforms.all;
-    maintainers = [maintainers.rycee];
+    maintainers = [ maintainers.rycee ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -j $downloadedFile \*.otf       -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*/README.md -d $out/share/doc/open-dyslexic
-  '';
-})
+}
diff --git a/pkgs/data/fonts/overpass/default.nix b/pkgs/data/fonts/overpass/default.nix
index 553b4e52efdbb..521c08c85cea1 100644
--- a/pkgs/data/fonts/overpass/default.nix
+++ b/pkgs/data/fonts/overpass/default.nix
@@ -1,15 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "overpass";
   version = "3.0.5";
-  name = "overpass-${version}";
-in (fetchzip rec {
-  inherit name;
 
-  url = "https://github.com/RedHatOfficial/Overpass/releases/download/v${version}/overpass-${version}.zip";
+  src = fetchzip {
+    url = "https://github.com/RedHatOfficial/Overpass/releases/download/v${version}/overpass-${version}.zip";
+    hash = "sha256-8AWT0/DELfNWXtZOejC90DbUSOtyGt9tSkcSuO7HP2o=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "1fpyhd6x3i3g0xxjmyfnjsri1kkvci15fv7jp1bnza7k0hz0bnha";
+    install -Dm644 */*/*.otf -t $out/share/fonts/opentype
+    install -Dm644 */*/*.ttf -t $out/share/fonts/truetype
+    install -Dm644 *.md  -t $out/share/doc/${pname}-${version}
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://overpassfont.org/";
@@ -18,11 +26,4 @@ in (fetchzip rec {
     platforms = platforms.all;
     maintainers = [ maintainers.rycee ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts $out/share/doc
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
-    unzip -j $downloadedFile \*.md  -d $out/share/doc/${name}
-  '';
-})
+}
diff --git a/pkgs/data/fonts/paratype-pt/mono.nix b/pkgs/data/fonts/paratype-pt/mono.nix
index 292e9466b96cb..86646ae0ac5de 100644
--- a/pkgs/data/fonts/paratype-pt/mono.nix
+++ b/pkgs/data/fonts/paratype-pt/mono.nix
@@ -1,15 +1,26 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-(fetchzip {
-  name = "paratype-pt-mono";
+stdenvNoCC.mkDerivation rec {
+  pname = "paratype-pt-mono";
+  version = "2.005";
 
-  urls = [
-    "https://company.paratype.com/system/attachments/631/original/ptmono.zip"
-    "http://rus.paratype.ru/system/attachments/631/original/ptmono.zip"
-  ];
+  src = fetchzip {
+    urls = [
+      "https://company.paratype.com/system/attachments/631/original/ptmono.zip"
+      "http://rus.paratype.ru/system/attachments/631/original/ptmono.zip"
+    ];
+    stripRoot = false;
+    hash = "sha256-mfDAu/KGelC6wZpUCrUrLVZKo+XiKNBqcpMI8tH2tMw=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "07kl82ngby55khvzsvn831ddpc0q8djgz2y6gsjixkyjfdk2xjjm";
+    install -Dm644 *.ttf -t $out/share/fonts/truetype
+    install -Dm644 *.txt -t $out/share/doc/paratype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "http://www.paratype.ru/public/";
@@ -23,10 +34,4 @@
     platforms = platforms.all;
     maintainers = with maintainers; [ raskin ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
-    unzip -j $downloadedFile \*.txt -d $out/share/doc/paratype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/paratype-pt/sans.nix b/pkgs/data/fonts/paratype-pt/sans.nix
index 1c976ecb489ed..dffd25c23aa59 100644
--- a/pkgs/data/fonts/paratype-pt/sans.nix
+++ b/pkgs/data/fonts/paratype-pt/sans.nix
@@ -1,15 +1,26 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-(fetchzip {
-  name = "paratype-pt-sans";
+stdenvNoCC.mkDerivation rec {
+  pname = "paratype-pt-sans";
+  version = "2.005";
 
-  urls = [
-    "https://company.paratype.com/system/attachments/629/original/ptsans.zip"
-    "http://rus.paratype.ru/system/attachments/629/original/ptsans.zip"
-  ];
+  src = fetchzip {
+    urls = [
+      "https://company.paratype.com/system/attachments/629/original/ptsans.zip"
+      "http://rus.paratype.ru/system/attachments/629/original/ptsans.zip"
+    ];
+    stripRoot = false;
+    hash = "sha256-34TqYXtWzkAstaGQBhJy+/hVk5tg6ZvHZ/kvUroWVLs=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "01fkd417gv98jf3a6zyfi9w2dkqsbddy1vacga2672yf0kh1z1r0";
+    install -Dm644 *.ttf -t $out/share/fonts/truetype
+    install -Dm644 *.txt -t $out/share/doc/paratype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "http://www.paratype.ru/public/";
@@ -23,10 +34,4 @@
     platforms = platforms.all;
     maintainers = with maintainers; [ raskin ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
-    unzip -j $downloadedFile \*.txt -d $out/share/doc/paratype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/paratype-pt/serif.nix b/pkgs/data/fonts/paratype-pt/serif.nix
index abe6c3d87f661..f346382d1f738 100644
--- a/pkgs/data/fonts/paratype-pt/serif.nix
+++ b/pkgs/data/fonts/paratype-pt/serif.nix
@@ -1,15 +1,26 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-(fetchzip {
-  name = "paratype-pt-serif";
+stdenvNoCC.mkDerivation rec {
+  pname = "paratype-pt-serif";
+  version = "2.005";
 
-  urls = [
-    "https://company.paratype.com/system/attachments/634/original/ptserif.zip"
-    "http://rus.paratype.ru/system/attachments/634/original/ptserif.zip"
-  ];
+  src = fetchzip {
+    urls = [
+      "https://company.paratype.com/system/attachments/634/original/ptserif.zip"
+      "http://rus.paratype.ru/system/attachments/634/original/ptserif.zip"
+    ];
+    stripRoot = false;
+    hash = "sha256-4L3t5NEHmj975fn8eBAkRUO1OL0xseNp9g7k7tt/O2c=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "1iw5qi4ag3yp1lwmi91lb18gr768bqwl46xskaqnkhr9i9qp0v6d";
+    install -Dm644 *.ttf -t $out/share/fonts/truetype
+    install -Dm644 *.txt -t $out/share/doc/paratype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "http://www.paratype.ru/public/";
@@ -23,10 +34,4 @@
     platforms = platforms.all;
     maintainers = with maintainers; [ raskin ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
-    unzip -j $downloadedFile \*.txt -d $out/share/doc/paratype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/public-sans/default.nix b/pkgs/data/fonts/public-sans/default.nix
index 36fa7b136aff9..0682388978316 100644
--- a/pkgs/data/fonts/public-sans/default.nix
+++ b/pkgs/data/fonts/public-sans/default.nix
@@ -1,14 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "public-sans";
   version = "2.001";
-in (fetchzip {
-  name = "public-sans-${version}";
 
-  url = "https://github.com/uswds/public-sans/releases/download/v${version}/public-sans-v${version}.zip";
+  src = fetchzip {
+    url = "https://github.com/uswds/public-sans/releases/download/v${version}/public-sans-v${version}.zip";
+    stripRoot = false;
+    hash = "sha256-XFs/UMXI/kdrW+53t8Mj26+Rn5p+LQ6KW2K2/ShoIag=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "sha256-Ba7D4J72GZQsGn0KINRib9BmHsAnoEsAwAOC+M3CkMU=";
+    install -Dm644 */*/*.otf -t $out/share/fonts/opentype
+    install -Dm644 */*/*.ttf -t $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "A strong, neutral, principles-driven, open source typeface for text or display";
@@ -18,10 +27,4 @@ in (fetchzip {
     maintainers = with maintainers; [ dtzWill ];
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/quattrocento-sans/default.nix b/pkgs/data/fonts/quattrocento-sans/default.nix
index 7841a203f7e7f..7659598842324 100644
--- a/pkgs/data/fonts/quattrocento-sans/default.nix
+++ b/pkgs/data/fonts/quattrocento-sans/default.nix
@@ -1,27 +1,29 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "quattrocento-sans";
   version = "2.0";
-  name = "quattrocento-sans-${version}";
-in (fetchzip rec {
-  inherit name;
 
-  url = "https://web.archive.org/web/20170709124317/http://www.impallari.com/media/releases/quattrocento-sans-v${version}.zip";
+  src = fetchzip {
+    url = "https://web.archive.org/web/20170709124317/http://www.impallari.com/media/releases/quattrocento-sans-v${version}.zip";
+    stripRoot = false;
+    hash = "sha256-L3aFZmaA94B9APxsp8bSBpocIlK3Ehvj/RFXVcW2nso=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "0g8hnn92ks4y0jbizwj7yfa097lk887wqkqpqjdmc09sd2n44343";
+    install -Dm644 */*/QuattrocentoSans*.otf -t $out/share/fonts/opentype
+    install -Dm644 */FONTLOG.txt             -t $out/share/doc/${pname}-${version}
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "http://www.impallari.com/quattrocentosans/";
     description = "A classic, elegant and sober sans-serif typeface";
     license = licenses.ofl;
     platforms = platforms.all;
-    maintainers = [maintainers.rycee];
+    maintainers = [ maintainers.rycee ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/{fonts,doc}
-    unzip -j $downloadedFile '*/QuattrocentoSans*.otf' -d $out/share/fonts/opentype
-    unzip -j $downloadedFile '*/FONTLOG.txt'           -d $out/share/doc/${name}
-  '';
-})
+}
diff --git a/pkgs/data/fonts/quattrocento/default.nix b/pkgs/data/fonts/quattrocento/default.nix
index 12f146c0e8fcd..a70396437ec1b 100644
--- a/pkgs/data/fonts/quattrocento/default.nix
+++ b/pkgs/data/fonts/quattrocento/default.nix
@@ -1,27 +1,28 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "quattrocento";
   version = "1.1";
-  name = "quattrocento-${version}";
-in (fetchzip rec {
-  inherit name;
 
-  url = "https://web.archive.org/web/20170707001804/http://www.impallari.com/media/releases/quattrocento-v${version}.zip";
+  src = fetchzip {
+    url = "https://web.archive.org/web/20170707001804/http://www.impallari.com/media/releases/quattrocento-v${version}.zip";
+    hash = "sha256-ntY6Wl6TI8F7SShMyD8mdOxVg4oz9kvJ7vKTyGdPLtE=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "0f8l19y61y20sszn8ni8h9kgl0zy1gyzychg22z5k93ip4h7kfd0";
+    install -Dm644 */*.otf     -t $out/share/fonts/opentype
+    install -Dm644 FONTLOG.txt -t $out/share/doc/${pname}-${version}
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "http://www.impallari.com/quattrocento/";
     description = "A classic, elegant, sober and strong serif typeface";
     license = licenses.ofl;
     platforms = platforms.all;
-    maintainers = [maintainers.rycee];
+    maintainers = [ maintainers.rycee ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/{fonts,doc}
-    unzip -j $downloadedFile \*.otf        -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*FONTLOG.txt -d $out/share/doc/${name}
-  '';
-})
+}
diff --git a/pkgs/data/fonts/roboto/default.nix b/pkgs/data/fonts/roboto/default.nix
index 9f53eaa38cd1c..02ca82edf10f0 100644
--- a/pkgs/data/fonts/roboto/default.nix
+++ b/pkgs/data/fonts/roboto/default.nix
@@ -1,14 +1,22 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "roboto";
   version = "2.138";
-in (fetchzip {
-  name = "roboto-${version}";
 
-  url = "https://github.com/google/roboto/releases/download/v${version}/roboto-unhinted.zip";
+  src = fetchzip {
+    url = "https://github.com/google/roboto/releases/download/v${version}/roboto-unhinted.zip";
+    stripRoot = false;
+    hash = "sha256-ue3PUZinBpcYgSho1Zrw1KHl7gc/GlN1GhWFk6g5QXE=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "1s3c48wwvvwd3p4w3hfkri5v2c54j2bdxmd3bjv54klc5mrlh6z3";
+    install -Dm644 *.ttf -t $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
 
   meta = {
     homepage = "https://github.com/google/roboto";
@@ -22,9 +30,4 @@ in (fetchzip {
     platforms = lib.platforms.all;
     maintainers = [ lib.maintainers.romildo ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.ttf -x __MACOSX/\* -d $out/share/fonts/truetype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/scheherazade/default.nix b/pkgs/data/fonts/scheherazade/default.nix
index 07c7f6b0bc310..9960248b0d752 100644
--- a/pkgs/data/fonts/scheherazade/default.nix
+++ b/pkgs/data/fonts/scheherazade/default.nix
@@ -1,20 +1,30 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip, version ? "3.300" }:
+{ lib, stdenvNoCC, fetchzip, version ? "3.300" }:
 
 let
   new = lib.versionAtLeast version "3.000";
-  sha256 = {
-    "2.100" = "1g5f5f9gzamkq3kqyf7vbzvl4rdj3wmjf6chdrbxksrm3rnb926z";
-    "3.300" = "1bja1ma1mnna0qlk3dis31cvq5z1kgcqj7wjp8ml03zc5mpa2wb2";
+  hash = {
+    "2.100" = "sha256-d2UyOOOnmE1afCwyIrM1bL3lQC7XRwh03hzetk/4V30=";
+    "3.300" = "sha256-LaaA6DWAE2dcwVVX4go9cJaiuwI6efYbPk82ym3W3IY=";
   }."${version}";
-  name = "scheherazade${lib.optionalString new "-new"}-${version}";
+  pname = "scheherazade${lib.optionalString new "-new"}";
+in
+stdenvNoCC.mkDerivation rec {
+  inherit pname version;
+
+  src = fetchzip {
+    url = "http://software.sil.org/downloads/r/scheherazade/Scheherazade${lib.optionalString new "New"}-${version}.zip";
+    inherit hash;
+  };
 
-in (fetchzip rec {
-  inherit name;
+  installPhase = ''
+    runHook preInstall
 
-  url = "http://software.sil.org/downloads/r/scheherazade/Scheherazade${lib.optionalString new "New"}-${version}.zip";
+    install -Dm644 *.ttf -t $out/share/fonts/truetype
+    install -Dm644 FONTLOG.txt README.txt -t $out/share/doc
+    cp -r documentation $out/share/doc/
 
-  inherit sha256;
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://software.sil.org/scheherazade/";
@@ -40,13 +50,4 @@ in (fetchzip rec {
     license = licenses.ofl;
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -l $downloadedFile
-    unzip -j $downloadedFile \*.ttf                        -d $out/share/fonts/truetype
-    unzip    $downloadedFile \*/documentation/\*           -d $out/share/doc/
-    mv $out/share/doc/* $out/share/doc/${name}
-    unzip -j $downloadedFile \*/FONTLOG.txt  \*/README.txt -d $out/share/doc/${name}
-  '';
-})
+}
diff --git a/pkgs/data/fonts/source-code-pro/default.nix b/pkgs/data/fonts/source-code-pro/default.nix
index 37273530bb5c2..c94e9aaca4809 100644
--- a/pkgs/data/fonts/source-code-pro/default.nix
+++ b/pkgs/data/fonts/source-code-pro/default.nix
@@ -1,14 +1,22 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "source-code-pro";
   version = "2.038";
-in (fetchzip {
-  name = "source-code-pro-${version}";
 
-  url = "https://github.com/adobe-fonts/source-code-pro/releases/download/${version}R-ro%2F1.058R-it%2F1.018R-VAR/OTF-source-code-pro-${version}R-ro-1.058R-it.zip";
+  src = fetchzip {
+    url = "https://github.com/adobe-fonts/source-code-pro/releases/download/${version}R-ro%2F1.058R-it%2F1.018R-VAR/OTF-source-code-pro-${version}R-ro-1.058R-it.zip";
+    stripRoot = false;
+    hash = "sha256-ijeTLka131jf6B9xj/eNWK1T5r7r3aBXBgnVyRAxmuY=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "027cf62zj27q7l3d4sqzdfgz423lzysihdg8cvmkk6z910a1v368";
+    install -Dm644 *.otf -t $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
 
   meta = {
     description = "Monospaced font family for user interface and coding environments";
@@ -17,9 +25,4 @@ in (fetchzip {
     homepage = "https://adobe-fonts.github.io/source-code-pro/";
     license = lib.licenses.ofl;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/source-han-code-jp/default.nix b/pkgs/data/fonts/source-han-code-jp/default.nix
index 076291ab88934..2a64680ee19bc 100644
--- a/pkgs/data/fonts/source-han-code-jp/default.nix
+++ b/pkgs/data/fonts/source-han-code-jp/default.nix
@@ -1,15 +1,21 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
   pname = "source-han-code-jp";
-  version = "2.012R";
-in (fetchzip {
-  name = "${pname}-${version}";
+  version = "2.012";
 
-  url = "https://github.com/adobe-fonts/${pname}/archive/${version}.zip";
+  src = fetchzip {
+    url = "https://github.com/adobe-fonts/${pname}/archive/${version}R.zip";
+    hash = "sha256-ljO/1/CaE9Yj+AN5xxlIr30/nV/axGQPO0fGACAZGCQ=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "16y5as1k864ghy3vzp8svr3q0sw57rv53za3f48700ksvxz5pwry";
+    install -Dm444 OTF/*.otf -t $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
 
   meta = {
     description = "A monospaced Latin font suitable for coding";
@@ -18,9 +24,4 @@ in (fetchzip {
     homepage = "https://blogs.adobe.com/CCJKType/2015/06/source-han-code-jp.html";
     license = lib.licenses.ofl;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/source-han/default.nix b/pkgs/data/fonts/source-han/default.nix
index edf8ecfaa49fd..2f9111865455f 100644
--- a/pkgs/data/fonts/source-han/default.nix
+++ b/pkgs/data/fonts/source-han/default.nix
@@ -1,7 +1,7 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ stdenvNoCC
-, lib
-, fetchzip
+{ lib
+, stdenvNoCC
+, fetchurl
+, unzip
 }:
 
 let
@@ -9,21 +9,37 @@ let
     { family
     , description
     , rev
-    , sha256
-    , postFetch ? ''
-        install -m444 -Dt $out/share/fonts/opentype/source-han-${family} $downloadedFile
-      ''
+    , hash
     , zip ? ""
     }:
     let Family =
       lib.toUpper (lib.substring 0 1 family) +
       lib.substring 1 (lib.stringLength family) family;
     in
-    (fetchzip {
-      name = "source-han-${family}-${lib.removeSuffix "R" rev}";
+    stdenvNoCC.mkDerivation rec {
+      pname = "source-han-${family}";
+      version = lib.removeSuffix "R" rev;
 
-      url = "https://github.com/adobe-fonts/source-han-${family}/releases/download/${rev}/SourceHan${Family}.ttc${zip}";
-      inherit sha256;
+      src = fetchurl {
+        url = "https://github.com/adobe-fonts/source-han-${family}/releases/download/${rev}/SourceHan${Family}.ttc${zip}";
+        inherit hash;
+      };
+
+      nativeBuildInputs = lib.optionals (zip == ".zip") [ unzip ];
+
+      unpackPhase = lib.optionalString (zip == "") ''
+        cp $src SourceHan${Family}.ttc${zip}
+      '' + lib.optionalString (zip == ".zip") ''
+        unzip $src
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        install -Dm444 *.ttc -t $out/share/fonts/opentype/${pname}
+
+        runHook postInstall
+      '';
 
       meta = {
         description = "An open source Pan-CJK ${description} typeface";
@@ -31,18 +47,14 @@ let
         license = lib.licenses.ofl;
         maintainers = with lib.maintainers; [ taku0 emily ];
       };
-    }).overrideAttrs (_: { inherit postFetch; });
+    };
 in
 {
   sans = makePackage {
     family = "sans";
     description = "sans-serif";
     rev = "2.004R";
-    sha256 = "052d17hvz435zc4r2y1p9cgkkgn0ps8g74mfbvnbm1pv8ykj40m9";
-    postFetch = ''
-      mkdir -p $out/share/fonts/opentype/source-han-sans
-      unzip $downloadedFile -d $out/share/fonts/opentype/source-han-sans
-    '';
+    hash = "sha256-b1kRiprdpaf+Tp5rtTgwn34dPFQR+anTKvMqeVAbfk8=";
     zip = ".zip";
   };
 
@@ -50,11 +62,7 @@ in
     family = "serif";
     description = "serif";
     rev = "2.000R";
-    sha256 = "0x3n6s4khdd6l0crwd7g9sjaqp8lkvksglhc7kj3cv80hldab9wp";
-    postFetch = ''
-      mkdir -p $out/share/fonts/opentype/source-han-serif
-      unzip $downloadedFile -d $out/share/fonts/opentype/source-han-serif
-    '';
+    hash = "sha256-RDgywab7gwT+YBO7F1KJvKOv0E/3+7Zi/pQl+UDsGcM=";
     zip = ".zip";
   };
 
@@ -62,6 +70,6 @@ in
     family = "mono";
     description = "monospaced";
     rev = "1.002";
-    sha256 = "010h1y469c21bjavwdmkpbwk3ny686inz8i062wh1dhcv8cnqk3c";
+    hash = "sha256-DBkkSN6QhI8R64M2h2iDqaNtxluJZeSJYAz8x6ZzWME=";
   };
 }
diff --git a/pkgs/data/fonts/source-sans-pro/default.nix b/pkgs/data/fonts/source-sans-pro/default.nix
index 382c20aa97687..2a2d2c70f289c 100644
--- a/pkgs/data/fonts/source-sans-pro/default.nix
+++ b/pkgs/data/fonts/source-sans-pro/default.nix
@@ -1,18 +1,28 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
 # Source Sans Pro got renamed to Source Sans 3 (see
 # https://github.com/adobe-fonts/source-sans/issues/192). This is the
 # last version named "Pro". It is useful for backward compatibility
 # with older documents/templates/etc.
-let
-  version = "3.006";
-in (fetchzip {
+
+stdenvNoCC.mkDerivation rec {
   name = "source-sans-pro-${version}";
+  version = "3.006";
+
+  src = fetchzip {
+    url = "https://github.com/adobe-fonts/source-sans/archive/${version}R.zip";
+    hash = "sha256-1Savijgq3INuUN89MR0t748HOuGseXVw5Kd4hYwuVas=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  url = "https://github.com/adobe-fonts/source-sans/archive/${version}R.zip";
+    install -Dm444 OTF/*.otf -t $out/share/fonts/opentype
+    install -Dm444 TTF/*.ttf -t $out/share/fonts/truetype
+    install -Dm444 VAR/*.otf -t $out/share/fonts/variable
 
-  sha256 = "sha256-uWr/dFyLF65v0o6+oN/3RQoe4ziPspzGB1rgiBkoTYY=";
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://adobe-fonts.github.io/source-sans/";
@@ -21,11 +31,4 @@ in (fetchzip {
     platforms = platforms.all;
     maintainers = with maintainers; [ ttuegel ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/{opentype,truetype,variable}
-    unzip -j $downloadedFile "*/OTF/*.otf" -d $out/share/fonts/opentype
-    unzip -j $downloadedFile "*/TTF/*.ttf" -d $out/share/fonts/truetype
-    unzip -j $downloadedFile "*/VAR/*.otf" -d $out/share/fonts/variable
-  '';
-})
+}
diff --git a/pkgs/data/fonts/source-sans/default.nix b/pkgs/data/fonts/source-sans/default.nix
index 94df27765ee28..1433804ce71d7 100644
--- a/pkgs/data/fonts/source-sans/default.nix
+++ b/pkgs/data/fonts/source-sans/default.nix
@@ -1,14 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "source-sans";
   version = "3.046";
-in (fetchzip {
-  name = "source-sans-${version}";
 
-  url = "https://github.com/adobe-fonts/source-sans/archive/${version}R.zip";
+  src = fetchzip {
+    url = "https://github.com/adobe-fonts/source-sans/archive/${version}R.zip";
+    hash = "sha256-nBLEK+T5n1CdZK2zvCWIhF2MxPmiAwL9l55a55yHtgU=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "1wxdinnliq0xqbjrs0sqykwaggkmyqawfq862d9xn05g1pnxda94";
+    install -Dm444 OTF/*.otf -t $out/share/fonts/opentype
+    install -Dm444 TTF/*.ttf -t $out/share/fonts/truetype
+    install -Dm444 VAR/*.otf -t $out/share/fonts/variable
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://adobe-fonts.github.io/source-sans/";
@@ -17,11 +26,4 @@ in (fetchzip {
     platforms = platforms.all;
     maintainers = with maintainers; [ ttuegel ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/{opentype,truetype,variable}
-    unzip -j $downloadedFile "*/OTF/*.otf" -d $out/share/fonts/opentype
-    unzip -j $downloadedFile "*/TTF/*.ttf" -d $out/share/fonts/truetype
-    unzip -j $downloadedFile "*/VAR/*.otf" -d $out/share/fonts/variable
-  '';
-})
+}
diff --git a/pkgs/data/fonts/source-serif-pro/default.nix b/pkgs/data/fonts/source-serif-pro/default.nix
index 8f2ae0f79904c..698694faf5074 100644
--- a/pkgs/data/fonts/source-serif-pro/default.nix
+++ b/pkgs/data/fonts/source-serif-pro/default.nix
@@ -1,18 +1,28 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
 # Source Serif Pro got renamed to Source Serif 4 (see
 # https://github.com/adobe-fonts/source-serif/issues/77). This is the
 # last version named "Pro". It is useful for backward compatibility
 # with older documents/templates/etc.
-let
+
+stdenvNoCC.mkDerivation rec {
+  pname = "source-serif-pro";
   version = "3.001";
-in (fetchzip {
-  name = "source-serif-pro-${version}";
 
-  url = "https://github.com/adobe-fonts/source-serif/releases/download/${version}R/source-serif-pro-${version}R.zip";
+  src = fetchzip {
+    url = "https://github.com/adobe-fonts/source-serif/releases/download/${version}R/source-serif-pro-${version}R.zip";
+    hash = "sha256-chXoaPOACtQ7wz/etElXuIJH/yvUsP03WlxeCfqWF/w=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "sha256-rYWk8D41QMuuSP+cQMk8ttT7uX3a7gBk4OqjA7K9udk=";
+    install -Dm444 OTF/*.otf -t $out/share/fonts/opentype
+    install -Dm444 TTF/*.ttf -t $out/share/fonts/truetype
+    install -Dm444 VAR/*.otf -t $out/share/fonts/variable
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://adobe-fonts.github.io/source-serif/";
@@ -21,11 +31,4 @@ in (fetchzip {
     platforms = platforms.all;
     maintainers = with maintainers; [ ttuegel ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/{opentype,truetype,variable}
-    unzip -j $downloadedFile "*/OTF/*.otf" -d $out/share/fonts/opentype
-    unzip -j $downloadedFile "*/TTF/*.ttf" -d $out/share/fonts/truetype
-    unzip -j $downloadedFile "*/VAR/*.otf" -d $out/share/fonts/variable
-  '';
-})
+}
diff --git a/pkgs/data/fonts/source-serif/default.nix b/pkgs/data/fonts/source-serif/default.nix
index 3c61627183c01..626b36f2705b0 100644
--- a/pkgs/data/fonts/source-serif/default.nix
+++ b/pkgs/data/fonts/source-serif/default.nix
@@ -1,14 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "source-serif";
   version = "4.004";
-in (fetchzip {
-  name = "source-serif-${version}";
 
-  url = "https://github.com/adobe-fonts/source-serif/releases/download/${version}R/source-serif-${version}.zip";
+  src = fetchzip {
+    url = "https://github.com/adobe-fonts/source-serif/releases/download/${version}R/source-serif-${version}.zip";
+    hash = "sha256-tGSMOwYBEZat7MI78wkPr6lgJdsOdOaIZb+IAOoOlq4=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "06814hcp20abca6p0ii61f23g6h1ibqyhq30lsva59wbwx5iha0h";
+    install -Dm444 OTF/*.otf -t $out/share/fonts/opentype
+    install -Dm444 TTF/*.ttf -t $out/share/fonts/truetype
+    install -Dm444 VAR/*.otf -t $out/share/fonts/variable
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://adobe-fonts.github.io/source-serif/";
@@ -17,11 +26,4 @@ in (fetchzip {
     platforms = platforms.all;
     maintainers = with maintainers; [ ttuegel ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/{opentype,truetype,variable}
-    unzip -j $downloadedFile "*/OTF/*.otf" -d $out/share/fonts/opentype
-    unzip -j $downloadedFile "*/TTF/*.ttf" -d $out/share/fonts/truetype
-    unzip -j $downloadedFile "*/VAR/*.otf" -d $out/share/fonts/variable
-  '';
-})
+}
diff --git a/pkgs/data/fonts/stix-two/default.nix b/pkgs/data/fonts/stix-two/default.nix
index fb494391a8784..86ceb388f86aa 100644
--- a/pkgs/data/fonts/stix-two/default.nix
+++ b/pkgs/data/fonts/stix-two/default.nix
@@ -1,14 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
-let
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "stix-two";
   version = "2.13";
-in
-(fetchzip {
-  name = "stix-two-${version}";
 
-  url = "https://github.com/stipub/stixfonts/raw/v${version}/zipfiles/STIX${builtins.replaceStrings [ "." ] [ "_" ] version}-all.zip";
+  src = fetchzip {
+    url = "https://github.com/stipub/stixfonts/raw/v${version}/zipfiles/STIX${builtins.replaceStrings [ "." ] [ "_" ] version}-all.zip";
+    stripRoot = false;
+    hash = "sha256-hfQmrw7HjlhQSA0rVTs84i3j3iMVR0k7tCRBcB6hEpU=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "sha256-cBtZe/oq4bQCscSAhJ4YuTSghDleD9O/+3MHOJyI50o=";
+    install -Dm644 */*.otf -t $out/share/fonts/opentype
+    install -Dm644 */*.ttf -t $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://www.stixfonts.org/";
@@ -17,10 +26,4 @@ in
     platforms = platforms.all;
     maintainers = [ maintainers.rycee ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/sudo/default.nix b/pkgs/data/fonts/sudo/default.nix
index c4af97c7cc253..dca4ccd200cb5 100644
--- a/pkgs/data/fonts/sudo/default.nix
+++ b/pkgs/data/fonts/sudo/default.nix
@@ -1,12 +1,21 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "sudo-font";
   version = "0.64";
-in (fetchzip {
-  name = "sudo-font-${version}";
-  url = "https://github.com/jenskutilek/sudo-font/releases/download/v${version}/sudo.zip";
-  sha256 = "sha256-ewLTeIVY76eq5mHTnjIsJ5Q2CMuBqXJzxvjZTONPsr8=";
+
+  src = fetchzip {
+    url = "https://github.com/jenskutilek/sudo-font/releases/download/v${version}/sudo.zip";
+    hash = "sha256-Y99YPoNpe55Wrj5epiqqQ6ddUBTj9uI4oj4M5ARTzJo=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 *.ttf -t $out/share/fonts/truetype/
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "Font for programmers and command line users";
@@ -16,9 +25,4 @@ in (fetchzip {
     maintainers = with maintainers; [ dtzWill ];
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype/
-  '';
-})
+}
diff --git a/pkgs/data/fonts/terminus-font-ttf/default.nix b/pkgs/data/fonts/terminus-font-ttf/default.nix
index 3c9494f1c0436..6231d0e0c1dc5 100644
--- a/pkgs/data/fonts/terminus-font-ttf/default.nix
+++ b/pkgs/data/fonts/terminus-font-ttf/default.nix
@@ -1,14 +1,26 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "terminus-font-ttf";
   version = "4.49.1";
-in (fetchzip {
-  name = "terminus-font-ttf-${version}";
 
-  url = "https://files.ax86.net/terminus-ttf/files/${version}/terminus-ttf-${version}.zip";
+  src = fetchzip {
+    url = "https://files.ax86.net/terminus-ttf/files/${version}/terminus-ttf-${version}.zip";
+    hash = "sha256-NKswkZR05V21mszT56S2x85k//qhfzRShhepYaAybDc=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    for i in *.ttf; do
+      local destname="$(echo "$i" | sed -E 's|-[[:digit:].]+\.ttf$|.ttf|')"
+      install -Dm 644 "$i" "$out/share/fonts/truetype/$destname"
+    done
+
+    install -Dm 644 COPYING "$out/share/doc/terminus-font-ttf/COPYING"
 
-  sha256 = "sha256-UaTnCamIRN/3xZsYt5nYzvykXQ3ri94a047sWOJ2RfU=";
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "A clean fixed width TTF font";
@@ -20,15 +32,4 @@ in (fetchzip {
     license = licenses.ofl;
     maintainers = with maintainers; [ ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    unzip -j $downloadedFile
-
-    for i in *.ttf; do
-      local destname="$(echo "$i" | sed -E 's|-[[:digit:].]+\.ttf$|.ttf|')"
-      install -Dm 644 "$i" "$out/share/fonts/truetype/$destname"
-    done
-
-    install -Dm 644 COPYING "$out/share/doc/terminus-font-ttf/COPYING"
-  '';
-})
+}
diff --git a/pkgs/data/fonts/theano/default.nix b/pkgs/data/fonts/theano/default.nix
index 69107f4a8e577..3a3107e136666 100644
--- a/pkgs/data/fonts/theano/default.nix
+++ b/pkgs/data/fonts/theano/default.nix
@@ -1,15 +1,25 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "theano";
   version = "2.0";
-  name = "theano-${version}";
-in (fetchzip rec {
-  inherit name;
 
-  url = "https://github.com/akryukov/theano/releases/download/v${version}/theano-${version}.otf.zip";
+  src = fetchzip {
+    url = "https://github.com/akryukov/theano/releases/download/v${version}/theano-${version}.otf.zip";
+    stripRoot = false;
+    hash = "sha256-9wnwHcRHB+AToOvGwZSXvHkQ8hqMd7Sdl26Ty/IwbPw=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "1my1symb7k80ys33iphsxvmf6432wx6vjdnxhzhkgrang1rhx1h8";
+    mkdir -p $out/share/fonts/opentype
+    mkdir -p $out/share/doc/${pname}-${version}
+    cp *.otf $out/share/fonts/opentype
+    cp *.txt $out/share/doc/${pname}-${version}
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/akryukov/theano";
@@ -18,11 +28,4 @@ in (fetchzip rec {
     license = licenses.ofl;
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/opentype
-    mkdir -p $out/share/doc/${name}
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*.txt -d "$out/share/doc/${name}"
-  '';
-})
+}
diff --git a/pkgs/data/fonts/times-newer-roman/default.nix b/pkgs/data/fonts/times-newer-roman/default.nix
index 8f6e7eceb0c01..840e75c710b30 100644
--- a/pkgs/data/fonts/times-newer-roman/default.nix
+++ b/pkgs/data/fonts/times-newer-roman/default.nix
@@ -1,15 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation {
+  pname = "times-newer-roman";
   version = "unstable-2018-09-11";
-in
-(fetchzip {
-  name = "times-newer-roman-${version}";
 
-  url = "https://web.archive.org/web/20210609022835/https://timesnewerroman.com/assets/TimesNewerRoman.zip";
+  src = fetchzip {
+    url = "https://web.archive.org/web/20210609022835/https://timesnewerroman.com/assets/TimesNewerRoman.zip";
+    stripRoot = false;
+    hash = "sha256-wO4rxyJNQyhRLpswCYKXdeiXy5G+iWyxulYCHZb60QM=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  hash = "sha256-Hx59RYLLwfimEQjEEes0lCpg6iql46DFwhQ7kVGiEzc=";
+    mkdir -p $out/share/fonts/opentype
+    cp *.otf $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "A font that looks just like Times New Roman, except each character is 5-10% wider";
@@ -18,9 +26,4 @@ in
     maintainers = with maintainers; [ ];
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/opentype
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix b/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix
index 2c945f2452866..27933b5b139d4 100644
--- a/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix
+++ b/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix
@@ -1,13 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "ultimate-oldschool-pc-font-pack";
   version = "2.2";
-in
-(fetchzip {
-  name = "ultimate-oldschool-pc-font-pack-${version}";
-  url = "https://int10h.org/oldschool-pc-fonts/download/oldschool_pc_font_pack_v${version}_linux.zip";
-  sha256 = "sha256-BOA2fMa2KT3Bkpvj/0DzrzuZbl3RARvNn4qbI/+dApU=";
+
+  src = fetchzip {
+    url = "https://int10h.org/oldschool-pc-fonts/download/oldschool_pc_font_pack_v${version}_linux.zip";
+    stripRoot = false;
+    hash = "sha256-54U8tZzvivTSOgmGesj9QbIgkSTm9w4quMhsuEc0Xy4=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/fonts/truetype
+    cp */*.ttf $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "The Ultimate Oldschool PC Font Pack (TTF Fonts)";
@@ -16,9 +26,4 @@ in
     license = licenses.cc-by-sa-40;
     maintainers = [ maintainers.endgame ];
   };
-}).overrideAttrs (_: {
-  postFetch= ''
-    mkdir -p $out/share/fonts/truetype
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/undefined-medium/default.nix b/pkgs/data/fonts/undefined-medium/default.nix
index fe694a5e31a6b..9c605668845bd 100644
--- a/pkgs/data/fonts/undefined-medium/default.nix
+++ b/pkgs/data/fonts/undefined-medium/default.nix
@@ -1,12 +1,21 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
-let name = "undefined-medium-1.0";
-in (fetchzip rec {
-  inherit name;
+{ lib, stdenvNoCC, fetchzip }:
 
-  url = "https://github.com/andirueckel/undefined-medium/archive/v1.0.zip";
+stdenvNoCC.mkDerivation rec {
+  pname = "undefined-medium";
+  version = "1.0";
 
-  sha256 = "1wa04jzbffshwcxm705yb5wja8wakn8j7fvim1mlih2z1sqw0njk";
+  src = fetchzip {
+    url = "https://github.com/andirueckel/undefined-medium/archive/v1.0.zip";
+    hash = "sha256-HG+V7jR7dDI6LeoiCg/8F38lW8Zdo6CyLj2DXy/ff64=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 fonts/otf/*.otf -t $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://undefined-medium.com/";
@@ -19,9 +28,4 @@ in (fetchzip rec {
     license = licenses.ofl;
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile ${name}/fonts/otf/\*.otf -d $out/share/fonts/opentype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/vollkorn/default.nix b/pkgs/data/fonts/vollkorn/default.nix
index b5e3a8e5729df..deeeac19c9394 100644
--- a/pkgs/data/fonts/vollkorn/default.nix
+++ b/pkgs/data/fonts/vollkorn/default.nix
@@ -1,30 +1,33 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, stdenv, fetchzip }:
-let
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
   pname = "vollkorn";
   version = "4.105";
-in
-(fetchzip {
-  name = "${pname}-${version}";
-  url = "http://vollkorn-typeface.com/download/vollkorn-${builtins.replaceStrings ["."] ["-"] version}.zip";
-  sha256 = "0srff2nqs7353mqcpmvaq156lamfh621py4h1771n0l9ix2c8mss";
-  stripRoot = false;
 
-  meta = with lib; {
-    homepage = "http://vollkorn-typeface.com/";
-    description = "The free and healthy typeface for bread and butter use";
-    license = licenses.ofl;
-    platforms = platforms.all;
-    maintainers = [ maintainers.schmittlauch ];
+  src = fetchzip {
+    url = "http://vollkorn-typeface.com/download/vollkorn-${builtins.replaceStrings ["."] ["-"] version}.zip";
+    stripRoot = false;
+    hash = "sha256-oG79GgCwCavbMFAPakza08IPmt13Gwujrkc/NKTai7g=";
   };
-}).overrideAttrs (_: {
-  postFetch = ''
+
+  installPhase = ''
+    runHook preInstall
+
     mkdir -pv $out/share/{doc/${pname}-${version},fonts/{opentype,truetype,WOFF,WOFF2}}
-    unzip $downloadedFile
     cp -v {Fontlog,OFL-FAQ,OFL}.txt $out/share/doc/${pname}-${version}/
     cp -v PS-OTF/*.otf $out/share/fonts/opentype
     cp -v TTF/*.ttf $out/share/fonts/truetype
     cp -v WOFF/*.woff $out/share/fonts/WOFF
     cp -v WOFF2/*.woff2 $out/share/fonts/WOFF2
+
+    runHook postInstall
   '';
-})
+
+  meta = with lib; {
+    homepage = "http://vollkorn-typeface.com/";
+    description = "The free and healthy typeface for bread and butter use";
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = [ maintainers.schmittlauch ];
+  };
+}
diff --git a/pkgs/data/fonts/weather-icons/default.nix b/pkgs/data/fonts/weather-icons/default.nix
index 7171f65cb689c..00f9cebac121f 100644
--- a/pkgs/data/fonts/weather-icons/default.nix
+++ b/pkgs/data/fonts/weather-icons/default.nix
@@ -1,13 +1,21 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "weather-icons";
   version = "2.0.12";
-in (fetchzip {
-  name = "weather-icons-${version}";
 
-  url = "https://github.com/erikflowers/weather-icons/archive/refs/tags/${version}.zip";
-  sha256 = "sha256-NGPzAloeZa1nCazb+mjAbYw7ZYYDoKpLwcvzg1Ly9oM=";
+  src = fetchzip {
+    url = "https://github.com/erikflowers/weather-icons/archive/refs/tags/${version}.zip";
+    hash = "sha256-0ZFH2awUo4BkTpK1OsWZ4YKczJHo+HHM6ezGBJAmT+U=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 _docs/font-source/weathericons-regular.otf -t $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "Weather Icons";
@@ -21,9 +29,4 @@ in (fetchzip {
     platforms = platforms.all;
     maintainers = with maintainers; [ pnelson ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile weather-icons-${version}/_docs/font-source/weathericons-regular.otf -d $out/share/fonts/opentype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/work-sans/default.nix b/pkgs/data/fonts/work-sans/default.nix
index 208f370105798..07c5704b51713 100644
--- a/pkgs/data/fonts/work-sans/default.nix
+++ b/pkgs/data/fonts/work-sans/default.nix
@@ -1,15 +1,21 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "work-sans";
   version = "2.010";
-in
-(fetchzip {
-  name = "work-sans-${version}";
 
-  url = "https://github.com/weiweihuanghuang/Work-Sans/archive/refs/tags/v${version}.zip";
+  src = fetchzip {
+    url = "https://github.com/weiweihuanghuang/Work-Sans/archive/refs/tags/v${version}.zip";
+    hash = "sha256-cedcx3CpcPZk3jxxIs5Bz78dxZNtOemvXnUBO6zl2dw=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "sha256-S4O5EoKY4w/p+MHeHRCmPyQRAOUfEwNiETxMgNcsrws=";
+    install -Dm644 fonts/variable/*.ttf fonts/static/TTF/*.ttf -t $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "A grotesque sans";
@@ -18,9 +24,4 @@ in
     maintainers = [ maintainers.marsam ];
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile "*/fonts/*.ttf" -d $out/share/fonts/opentype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/yanone-kaffeesatz/default.nix b/pkgs/data/fonts/yanone-kaffeesatz/default.nix
index 2b1a967043df0..99cd30f3dfa73 100644
--- a/pkgs/data/fonts/yanone-kaffeesatz/default.nix
+++ b/pkgs/data/fonts/yanone-kaffeesatz/default.nix
@@ -1,12 +1,22 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-(fetchzip {
-  name = "yanone-kaffeesatz-2004";
+stdenvNoCC.mkDerivation rec {
+  pname = "yanone-kaffeesatz";
+  version = "2004";
 
-  url = "https://yanone.de/2015/data/UIdownloads/Yanone%20Kaffeesatz.zip";
+  src = fetchzip {
+    url = "https://yanone.de/2015/data/UIdownloads/Yanone%20Kaffeesatz.zip";
+    stripRoot = false;
+    hash = "sha256-8yAB73UJ77/c8/VLqiFeT1KtoBQzOh+vWrI+JA2dCoY=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "190c4wx7avy3kp98lsyml7kc0jw7csf5n79af2ypbkhsadfsy8di";
+    install -Dm644 *.otf -t $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
 
   meta = {
     description = "The free font classic";
@@ -15,9 +25,4 @@
     homepage = "https://yanone.de/fonts/kaffeesatz/";
     license = lib.licenses.ofl;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/zilla-slab/default.nix b/pkgs/data/fonts/zilla-slab/default.nix
index e3dd19c71127e..886362d78e990 100644
--- a/pkgs/data/fonts/zilla-slab/default.nix
+++ b/pkgs/data/fonts/zilla-slab/default.nix
@@ -1,13 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "zilla-slab";
   version = "1.002";
-in (fetchzip {
-  name = "zilla-slab-${version}";
 
-  url = "https://github.com/mozilla/zilla-slab/releases/download/v${version}/Zilla-Slab-Fonts-v${version}.zip";
-  sha256 = "1b1ys28hyjcl4qwbnsyi6527nj01g3d6id9jl23fv6f8fjm4ph0f";
+  src = fetchzip {
+    url = "https://github.com/mozilla/zilla-slab/releases/download/v${version}/Zilla-Slab-Fonts-v${version}.zip";
+    stripRoot = false;
+    hash = "sha256-yOHu+dSWlyI7w1N1teED9R1Fphso2bKAlYDC1KdqBCc=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/fonts/truetype
+    cp -v zilla-slab/ttf/*.ttf $out/share/fonts/truetype/
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/mozilla/zilla-slab";
@@ -26,10 +36,4 @@ in (fetchzip {
     maintainers = with maintainers; [ caugner ];
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    unzip $downloadedFile
-    mkdir -p $out/share/fonts/truetype
-    cp -v zilla-slab/ttf/*.ttf $out/share/fonts/truetype/
-  '';
-})
+}
diff --git a/pkgs/desktops/gnome/misc/metacity/default.nix b/pkgs/desktops/gnome/misc/metacity/default.nix
index 460dbfdb38bfc..3b141c501a8c9 100644
--- a/pkgs/desktops/gnome/misc/metacity/default.nix
+++ b/pkgs/desktops/gnome/misc/metacity/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "metacity";
-  version = "3.46.0";
+  version = "3.46.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "S6d36ThUe/zL+azKCWdXTEZkMCLgVMk6AzQZyzzHwew=";
+    sha256 = "ALpJ92EgiPKzuuynnEXrKjBCPC5Ke+pAFYcr6uJd1sU=";
   };
 
   patches = [
diff --git a/pkgs/development/compilers/llvm/15/bintools/default.nix b/pkgs/development/compilers/llvm/15/bintools/default.nix
new file mode 100644
index 0000000000000..303faf7bbb61b
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/bintools/default.nix
@@ -0,0 +1,40 @@
+{ runCommand, stdenv, llvm, lld, version }:
+
+let
+  prefix =
+    if stdenv.hostPlatform != stdenv.targetPlatform
+    then "${stdenv.targetPlatform.config}-"
+    else "";
+in runCommand "llvm-binutils-${version}" {
+  preferLocalBuild = true;
+  passthru = {
+    isLLVM = true;
+  };
+} ''
+   mkdir -p $out/bin
+   for prog in ${lld}/bin/*; do
+     ln -s $prog $out/bin/${prefix}$(basename $prog)
+   done
+   for prog in ${llvm}/bin/*; do
+     ln -sf $prog $out/bin/${prefix}$(basename $prog)
+   done
+
+   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
+   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
+   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
+   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
+   ln -s ${llvm}/bin/llvm-debuginfod $out/bin/${prefix}debuginfod
+   ln -s ${llvm}/bin/llvm-debuginfod-find $out/bin/${prefix}debuginfod-find
+   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
+   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
+   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
+   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
+   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
+   ln -s ${llvm}/bin/llvm-rc $out/bin/${prefix}windres
+   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
+   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
+   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
+   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
+
+   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
+''
diff --git a/pkgs/development/compilers/llvm/15/clang/default.nix b/pkgs/development/compilers/llvm/15/clang/default.nix
new file mode 100644
index 0000000000000..b0671150a7bd9
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/clang/default.nix
@@ -0,0 +1,129 @@
+{ lib, stdenv, llvm_meta
+, monorepoSrc, runCommand
+, substituteAll, cmake, ninja, libxml2, libllvm, version, python3
+, buildLlvmTools
+, fixDarwinDylibNames
+, enableManpages ? false
+}:
+
+let
+  self = stdenv.mkDerivation (rec {
+    pname = "clang";
+    inherit version;
+
+    src = runCommand "${pname}-src-${version}" {} ''
+      mkdir -p "$out"
+      cp -r ${monorepoSrc}/cmake "$out"
+      cp -r ${monorepoSrc}/${pname} "$out"
+      cp -r ${monorepoSrc}/clang-tools-extra "$out"
+    '';
+
+    sourceRoot = "${src.name}/${pname}";
+
+    nativeBuildInputs = [ cmake ninja python3 ]
+      ++ lib.optional enableManpages python3.pkgs.sphinx
+      ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+
+    buildInputs = [ libxml2 libllvm ];
+
+    cmakeFlags = [
+      "-DCLANG_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/cmake/clang"
+      "-DCLANGD_BUILD_XPC=OFF"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ lib.optionals enableManpages [
+      "-DCLANG_INCLUDE_DOCS=ON"
+      "-DLLVM_ENABLE_SPHINX=ON"
+      "-DSPHINX_OUTPUT_MAN=ON"
+      "-DSPHINX_OUTPUT_HTML=OFF"
+      "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+    ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+      "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
+      "-DCLANG_TABLEGEN=${buildLlvmTools.libclang.dev}/bin/clang-tblgen"
+    ];
+
+    patches = [
+      ./purity.patch
+      # https://reviews.llvm.org/D51899
+      ./gnu-install-dirs.patch
+      (substituteAll {
+        src = ../../clang-11-12-LLVMgold-path.patch;
+        libllvmLibdir = "${libllvm.lib}/lib";
+      })
+    ];
+
+    postPatch = ''
+      (cd tools && ln -s ../../clang-tools-extra extra)
+
+      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
+             -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
+             lib/Driver/ToolChains/*.cpp
+    '' + lib.optionalString stdenv.hostPlatform.isMusl ''
+      sed -i -e 's/lgcc_s/lgcc_eh/' lib/Driver/ToolChains/*.cpp
+    '';
+
+    outputs = [ "out" "lib" "dev" "python" ];
+
+    postInstall = ''
+      ln -sv $out/bin/clang $out/bin/cpp
+
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+      moveToOutput "lib/libclang-cpp.*" "$lib"
+      substituteInPlace $dev/lib/cmake/clang/ClangTargets-release.cmake \
+          --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang." \
+          --replace "\''${_IMPORT_PREFIX}/lib/libclang-cpp." "$lib/lib/libclang-cpp."
+
+      mkdir -p $python/bin $python/share/clang/
+      mv $out/bin/{git-clang-format,scan-view} $python/bin
+      if [ -e $out/bin/set-xcode-analyzer ]; then
+        mv $out/bin/set-xcode-analyzer $python/bin
+      fi
+      mv $out/share/clang/*.py $python/share/clang
+      rm $out/bin/c-index-test
+      patchShebangs $python/bin
+
+      mkdir -p $dev/bin
+      cp bin/clang-tblgen $dev/bin
+    '';
+
+    passthru = {
+      isClang = true;
+      inherit libllvm;
+    };
+
+    meta = llvm_meta // {
+      homepage = "https://clang.llvm.org/";
+      description = "A C language family frontend for LLVM";
+      longDescription = ''
+        The Clang project provides a language front-end and tooling
+        infrastructure for languages in the C language family (C, C++, Objective
+        C/C++, OpenCL, CUDA, and RenderScript) for the LLVM project.
+        It aims to deliver amazingly fast compiles, extremely useful error and
+        warning messages and to provide a platform for building great source
+        level tools. The Clang Static Analyzer and clang-tidy are tools that
+        automatically find bugs in your code, and are great examples of the sort
+        of tools that can be built using the Clang frontend as a library to
+        parse C/C++ code.
+      '';
+      mainProgram = "clang";
+    };
+  } // lib.optionalAttrs enableManpages {
+    pname = "clang-manpages";
+
+    ninjaFlags = [ "docs-clang-man" ];
+
+    installPhase = ''
+      mkdir -p $out/share/man/man1
+      # Manually install clang manpage
+      cp docs/man/*.1 $out/share/man/man1/
+    '';
+
+    outputs = [ "out" ];
+
+    doCheck = false;
+
+    meta = llvm_meta // {
+      description = "man page for Clang ${version}";
+    };
+  });
+in self
diff --git a/pkgs/development/compilers/llvm/15/clang/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/15/clang/gnu-install-dirs.patch
new file mode 100644
index 0000000000000..f767c56836d5c
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/clang/gnu-install-dirs.patch
@@ -0,0 +1,105 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index c27beec313d7..480f13e73c9f 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -78,15 +78,17 @@ if(CLANG_BUILT_STANDALONE)
+   if (NOT LLVM_CONFIG_FOUND)
+     # Pull values from LLVMConfig.cmake.  We can drop this once the llvm-config
+     # path is removed.
+-    set(MAIN_INCLUDE_DIR "${LLVM_INCLUDE_DIR}")
++    set(INCLUDE_DIRS ${LLVM_INCLUDE_DIRS})
+     set(LLVM_OBJ_DIR "${LLVM_BINARY_DIR}")
+     # N.B. this is just a default value, the CACHE PATHs below can be overriden.
+     set(MAIN_SRC_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../llvm")
+     set(TOOLS_BINARY_DIR "${LLVM_TOOLS_BINARY_DIR}")
+     set(LIBRARY_DIR "${LLVM_LIBRARY_DIR}")
++  else()
++    set(INCLUDE_DIRS "${LLVM_BINARY_DIR}/include" "${MAIN_INCLUDE_DIR}")
+   endif()
+ 
+-  set(LLVM_MAIN_INCLUDE_DIR "${MAIN_INCLUDE_DIR}" CACHE PATH "Path to llvm/include")
++  set(LLVM_INCLUDE_DIRS ${INCLUDE_DIRS} CACHE PATH "Path to llvm/include and any other header dirs needed")
+   set(LLVM_BINARY_DIR "${LLVM_OBJ_ROOT}" CACHE PATH "Path to LLVM build tree")
+   set(LLVM_MAIN_SRC_DIR "${MAIN_SRC_DIR}" CACHE PATH "Path to LLVM source tree")
+   set(LLVM_TOOLS_BINARY_DIR "${TOOLS_BINARY_DIR}" CACHE PATH "Path to llvm/bin")
+@@ -128,7 +130,7 @@ if(CLANG_BUILT_STANDALONE)
+     set(LLVM_INCLUDE_TESTS ON)
+   endif()
+ 
+-  include_directories("${LLVM_BINARY_DIR}/include" "${LLVM_MAIN_INCLUDE_DIR}")
++  include_directories(${LLVM_INCLUDE_DIRS})
+   link_directories("${LLVM_LIBRARY_DIR}")
+ 
+   set( CMAKE_RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/bin )
+diff --git a/cmake/modules/AddClang.cmake b/cmake/modules/AddClang.cmake
+index 21ac332e4f5f..b16c314bd1e2 100644
+--- a/cmake/modules/AddClang.cmake
++++ b/cmake/modules/AddClang.cmake
+@@ -119,8 +119,8 @@ macro(add_clang_library name)
+         install(TARGETS ${lib}
+           COMPONENT ${lib}
+           ${export_to_clangtargets}
+-          LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-          ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX}
++          LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}"
++          ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}"
+           RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}")
+ 
+         if (NOT LLVM_ENABLE_IDE)
+diff --git a/lib/Headers/CMakeLists.txt b/lib/Headers/CMakeLists.txt
+index 6e2060991b92..b9bc930d26b8 100644
+--- a/lib/Headers/CMakeLists.txt
++++ b/lib/Headers/CMakeLists.txt
+@@ -420,7 +420,7 @@ add_header_target("openmp-resource-headers" ${openmp_wrapper_files})
+ add_header_target("windows-resource-headers" ${windows_only_files})
+ add_header_target("utility-resource-headers" ${utility_files})
+ 
+-set(header_install_dir lib${LLVM_LIBDIR_SUFFIX}/clang/${CLANG_VERSION}/include)
++set(header_install_dir ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/clang/${CLANG_VERSION}/include)
+ 
+ #############################################################
+ # Install rules for the catch-all clang-resource-headers target
+diff --git a/tools/libclang/CMakeLists.txt b/tools/libclang/CMakeLists.txt
+index 8d95d0900e8c..ebc70ff7526d 100644
+--- a/tools/libclang/CMakeLists.txt
++++ b/tools/libclang/CMakeLists.txt
+@@ -180,7 +180,7 @@ foreach(PythonVersion ${CLANG_PYTHON_BINDINGS_VERSIONS})
+           COMPONENT
+             libclang-python-bindings
+           DESTINATION
+-            "lib${LLVM_LIBDIR_SUFFIX}/python${PythonVersion}/site-packages")
++            "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/python${PythonVersion}/site-packages")
+ endforeach()
+ if(NOT LLVM_ENABLE_IDE)
+   add_custom_target(libclang-python-bindings)
+diff --git a/tools/scan-build-py/CMakeLists.txt b/tools/scan-build-py/CMakeLists.txt
+index 061dc7ef4dd9..adc54b2edc32 100644
+--- a/tools/scan-build-py/CMakeLists.txt
++++ b/tools/scan-build-py/CMakeLists.txt
+@@ -88,7 +88,7 @@ foreach(lib ${LibScanbuild})
+                      DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/lib/libscanbuild/${lib})
+   list(APPEND Depends ${CMAKE_BINARY_DIR}/lib/libscanbuild/${lib})
+   install(PROGRAMS lib/libscanbuild/${lib}
+-          DESTINATION lib/libscanbuild
++          DESTINATION "${CMAKE_INSTALL_LIBDIR}/libscanbuild"
+           COMPONENT scan-build-py)
+ endforeach()
+ 
+@@ -106,7 +106,7 @@ foreach(resource ${LibScanbuildResources})
+                      DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/lib/libscanbuild/resources/${resource})
+   list(APPEND Depends ${CMAKE_BINARY_DIR}/lib/libscanbuild/resources/${resource})
+   install(PROGRAMS lib/libscanbuild/resources/${resource}
+-          DESTINATION lib/libscanbuild/resources
++          DESTINATION "${CMAKE_INSTALL_LIBDIR}/libscanbuild/resources"
+           COMPONENT scan-build-py)
+ endforeach()
+ 
+@@ -122,7 +122,7 @@ foreach(lib ${LibEar})
+                      DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/lib/libear/${lib})
+   list(APPEND Depends ${CMAKE_BINARY_DIR}/lib/libear/${lib})
+   install(PROGRAMS lib/libear/${lib}
+-          DESTINATION lib/libear
++          DESTINATION "${CMAKE_INSTALL_LIBDIR}/libear"
+           COMPONENT scan-build-py)
+ endforeach()
+ 
diff --git a/pkgs/development/compilers/llvm/15/clang/purity.patch b/pkgs/development/compilers/llvm/15/clang/purity.patch
new file mode 100644
index 0000000000000..1c94f293eb934
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/clang/purity.patch
@@ -0,0 +1,29 @@
+From 4add81bba40dcec62c4ea4481be8e35ac53e89d8 Mon Sep 17 00:00:00 2001
+From: Will Dietz <w@wdtz.org>
+Date: Thu, 18 May 2017 11:56:12 -0500
+Subject: [PATCH] "purity" patch for 5.0
+
+---
+ lib/Driver/ToolChains/Gnu.cpp | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/lib/Driver/ToolChains/Gnu.cpp b/lib/Driver/ToolChains/Gnu.cpp
+index fe3c0191bb..c6a482bece 100644
+--- a/lib/Driver/ToolChains/Gnu.cpp
++++ b/lib/Driver/ToolChains/Gnu.cpp
+@@ -487,13 +487,7 @@ void tools::gnutools::Linker::ConstructJob(Compilation &C, const JobAction &JA,
+   } else {
+     if (Args.hasArg(options::OPT_rdynamic))
+       CmdArgs.push_back("-export-dynamic");
+
+-    if (!Args.hasArg(options::OPT_shared) && !IsStaticPIE &&
+-        !Args.hasArg(options::OPT_r)) {
+-      CmdArgs.push_back("-dynamic-linker");
+-      CmdArgs.push_back(Args.MakeArgString(Twine(D.DyldPrefix) +
+-                                           ToolChain.getDynamicLinker(Args)));
+-    }
+   }
+ 
+   CmdArgs.push_back("-o");
+-- 
+2.11.0
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/X86-support-extension.patch b/pkgs/development/compilers/llvm/15/compiler-rt/X86-support-extension.patch
new file mode 100644
index 0000000000000..07013e5a68259
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/compiler-rt/X86-support-extension.patch
@@ -0,0 +1,21 @@
+diff --git a/lib/builtins/CMakeLists.txt b/lib/builtins/CMakeLists.txt
+index 3a66dd9c3fb..7efc85d9f9f 100644
+--- a/lib/builtins/CMakeLists.txt
++++ b/lib/builtins/CMakeLists.txt
+@@ -348,4 +348,8 @@ if (NOT MSVC)
+ 
++  set(i486_SOURCES ${i386_SOURCES})
++  set(i586_SOURCES ${i386_SOURCES})
++  set(i686_SOURCES ${i386_SOURCES})
++
+   if (WIN32)
+     set(i386_SOURCES
+       ${i386_SOURCES}
+@@ -723,6 +723,7 @@ else ()
+   endif()
+ 
+   foreach (arch ${BUILTIN_SUPPORTED_ARCH})
++      message("arch: ${arch}")
+     if (CAN_TARGET_${arch})
+       # For ARM archs, exclude any VFP builtins if VFP is not supported
+       if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7m|armv7em)$")
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/armv7l.patch b/pkgs/development/compilers/llvm/15/compiler-rt/armv7l.patch
new file mode 100644
index 0000000000000..ca1c2332abd9f
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/compiler-rt/armv7l.patch
@@ -0,0 +1,32 @@
+diff -ur a/cmake/builtin-config-ix.cmake b/cmake/builtin-config-ix.cmake
+--- a/cmake/builtin-config-ix.cmake @llvm 15.0.6
++++ b/cmake/builtin-config-ix.cmake
+@@ -46,7 +46,7 @@
+ 
+ set(ARM64 aarch64)
+-set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k armv8m.main armv8.1m.main)
++set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k armv7l armv8m.main armv8.1m.main)
+ set(AVR avr)
+ set(HEXAGON hexagon)
+ set(X86 i386)
+ set(X86_64 x86_64)
+diff -ur a/lib/builtins/CMakeLists.txt b/lib/builtins/CMakeLists.txt
+--- a/lib/builtins/CMakeLists.txt @llvm 15.0.6
++++ b/lib/builtins/CMakeLists.txt
+@@ -565,6 +565,7 @@
+ set(armv7_SOURCES ${arm_SOURCES})
+ set(armv7s_SOURCES ${arm_SOURCES})
+ set(armv7k_SOURCES ${arm_SOURCES})
++set(armv7l_SOURCES ${arm_SOURCES})
+ set(arm64_SOURCES ${aarch64_SOURCES})
+ 
+ # macho_embedded archs
+@@ -734,7 +735,7 @@
+   foreach (arch ${BUILTIN_SUPPORTED_ARCH})
+     if (CAN_TARGET_${arch})
+       # For ARM archs, exclude any VFP builtins if VFP is not supported
+-      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7m|armv7em|armv8m.main|armv8.1m.main)$")
++      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7l|armv7m|armv7em|armv8m.main|armv8.1m.main)$")
+         string(REPLACE ";" " " _TARGET_${arch}_CFLAGS "${TARGET_${arch}_CFLAGS}")
+         check_compile_definition(__VFP_FP__ "${CMAKE_C_FLAGS} ${_TARGET_${arch}_CFLAGS}" COMPILER_RT_HAS_${arch}_VFP)
+         if(NOT COMPILER_RT_HAS_${arch}_VFP)
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/darwin-targetconditionals.patch b/pkgs/development/compilers/llvm/15/compiler-rt/darwin-targetconditionals.patch
new file mode 100644
index 0000000000000..425dc2af01e7c
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/compiler-rt/darwin-targetconditionals.patch
@@ -0,0 +1,71 @@
+diff --git a/lib/sanitizer_common/sanitizer_mac.cpp b/lib/sanitizer_common/sanitizer_mac.cpp
+--- a/lib/sanitizer_common/sanitizer_mac.cpp
++++ b/lib/sanitizer_common/sanitizer_mac.cpp
+@@ -613,9 +613,15 @@ HandleSignalMode GetHandleSignalMode(int signum) {
+ // Offset example:
+ // XNU 17 -- macOS 10.13 -- iOS 11 -- tvOS 11 -- watchOS 4
+ constexpr u16 GetOSMajorKernelOffset() {
+-  if (TARGET_OS_OSX) return 4;
+-  if (TARGET_OS_IOS || TARGET_OS_TV) return 6;
+-  if (TARGET_OS_WATCH) return 13;
++#if TARGET_OS_OSX
++  return 4;
++#endif
++#if TARGET_OS_IOS || TARGET_OS_TV
++  return 6;
++#endif
++#if TARGET_OS_WATCH
++  return 13;
++#endif
+ }
+ 
+ using VersStr = char[64];
+@@ -627,13 +633,13 @@ static uptr ApproximateOSVersionViaKernelVersion(VersStr vers) {
+   u16 os_major = kernel_major - offset;
+ 
+   const char *format = "%d.0";
+-  if (TARGET_OS_OSX) {
+-    if (os_major >= 16) {  // macOS 11+
+-      os_major -= 5;
+-    } else {  // macOS 10.15 and below
+-      format = "10.%d";
+-    }
++#if TARGET_OS_OSX
++  if (os_major >= 16) {  // macOS 11+
++    os_major -= 5;
++  } else {  // macOS 10.15 and below
++    format = "10.%d";
+   }
++#endif
+   return internal_snprintf(vers, sizeof(VersStr), format, os_major);
+ }
+ 
+@@ -681,15 +687,14 @@ void ParseVersion(const char *vers, u16 *major, u16 *minor) {
+ // Aligned versions example:
+ // macOS 10.15 -- iOS 13 -- tvOS 13 -- watchOS 6
+ static void MapToMacos(u16 *major, u16 *minor) {
+-  if (TARGET_OS_OSX)
+-    return;
+-
+-  if (TARGET_OS_IOS || TARGET_OS_TV)
++#if !TARGET_OS_OSX
++#if TARGET_OS_IOS || TARGET_OS_TV
+     *major += 2;
+-  else if (TARGET_OS_WATCH)
++#elif TARGET_OS_WATCH
+     *major += 9;
+-  else
++#else
+     UNREACHABLE("unsupported platform");
++#endif
+ 
+   if (*major >= 16) {  // macOS 11+
+     *major -= 5;
+@@ -697,6 +702,7 @@ static void MapToMacos(u16 *major, u16 *minor) {
+     *minor = *major;
+     *major = 10;
+   }
++#endif
+ }
+ 
+ static MacosVersion GetMacosAlignedVersionInternal() {
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/default.nix b/pkgs/development/compilers/llvm/15/compiler-rt/default.nix
new file mode 100644
index 0000000000000..722a5bd90cbd6
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/compiler-rt/default.nix
@@ -0,0 +1,156 @@
+{ lib, stdenv, llvm_meta, version
+, monorepoSrc, runCommand
+, cmake, ninja, python3, xcbuild, libllvm, libcxxabi, libxcrypt
+, doFakeLibgcc ? stdenv.hostPlatform.isFreeBSD
+}:
+
+let
+
+  useLLVM = stdenv.hostPlatform.useLLVM or false;
+  bareMetal = stdenv.hostPlatform.parsed.kernel.name == "none";
+  haveLibc = stdenv.cc.libc != null;
+  inherit (stdenv.hostPlatform) isMusl isGnu;
+
+  baseName = "compiler-rt";
+
+  src = runCommand "${baseName}-src-${version}" {} ''
+    mkdir -p "$out"
+    cp -r ${monorepoSrc}/cmake "$out"
+    cp -r ${monorepoSrc}/${baseName} "$out"
+  '';
+in
+
+stdenv.mkDerivation {
+  pname = baseName + lib.optionalString (haveLibc) "-libc";
+  inherit version;
+
+  inherit src;
+  sourceRoot = "${src.name}/${baseName}";
+
+  nativeBuildInputs = [ cmake ninja python3 libllvm.dev ]
+    ++ lib.optional stdenv.isDarwin xcbuild.xcrun;
+  buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
+
+  NIX_CFLAGS_COMPILE = [
+    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
+  ];
+
+  cmakeFlags = [
+    "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
+    "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
+    "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
+  ] ++ lib.optionals (haveLibc && stdenv.hostPlatform.libc == "glibc") [
+    "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
+  ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
+    "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
+    "-DCOMPILER_RT_BUILD_XRAY=OFF"
+    "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
+    "-DCOMPILER_RT_BUILD_MEMPROF=OFF"
+    "-DCOMPILER_RT_BUILD_ORC=OFF" # may be possible to build with musl if necessary
+  ] ++ lib.optionals (useLLVM || bareMetal) [
+     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
+  ] ++ lib.optionals ((useLLVM && !haveLibc) || bareMetal) [
+    "-DCMAKE_C_COMPILER_WORKS=ON"
+    "-DCMAKE_CXX_COMPILER_WORKS=ON"
+    "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
+    "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
+  ] ++ lib.optionals (useLLVM && !haveLibc) [
+    "-DCMAKE_C_FLAGS=-nodefaultlibs"
+  ] ++ lib.optionals (useLLVM) [
+    "-DCOMPILER_RT_BUILD_BUILTINS=ON"
+    #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
+    "-DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY"
+  ] ++ lib.optionals (bareMetal) [
+    "-DCOMPILER_RT_OS_DIR=baremetal"
+  ] ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
+    "-DDARWIN_macosx_OVERRIDE_SDK_VERSION=ON"
+    "-DDARWIN_osx_ARCHS=${stdenv.hostPlatform.darwinArch}"
+    "-DDARWIN_osx_BUILTIN_ARCHS=${stdenv.hostPlatform.darwinArch}"
+
+    # `COMPILER_RT_DEFAULT_TARGET_ONLY` does not apply to Darwin:
+    # https://github.com/llvm/llvm-project/blob/27ef42bec80b6c010b7b3729ed0528619521a690/compiler-rt/cmake/base-config-ix.cmake#L153
+    "-DCOMPILER_RT_ENABLE_IOS=OFF"
+  ];
+
+  outputs = [ "out" "dev" ];
+
+  patches = [
+    ./X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
+    ./gnu-install-dirs.patch
+    # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
+    # extra `/`.
+    ./normalize-var.patch
+    # Prevent a compilation error on darwin
+    ./darwin-targetconditionals.patch
+    # See: https://github.com/NixOS/nixpkgs/pull/186575
+    ../../common/compiler-rt/darwin-plistbuddy-workaround.patch
+    # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
+    ./armv7l.patch
+  ]
+    # The `compiler-rt` build inspects `ld` to figure out whether it needs to
+    # explicitly call `codesign`:
+    # https://github.com/llvm/llvm-project/blob/27ef42bec80b6c010b7b3729ed0528619521a690/compiler-rt/cmake/Modules/AddCompilerRT.cmake#L409-L422
+    #
+    # In our case, despite (currently) having an `ld` version than 609, we don't
+    # need an explicit codesigning step because `postLinkSignHook` handles this
+    # for us.
+    #
+    # Unfortunately there isn't an easy way to override
+    # `NEED_EXPLICIT_ADHOC_CODESIGN`.
+    #
+    # Adding `codesign` as a build input also doesn't currently work because, as
+    # of this writing, `codesign` in nixpkgs doesn't support the `--sign` alias
+    # which the `compiler-rt` build uses. See here for context:
+    # https://github.com/NixOS/nixpkgs/pull/194634#issuecomment-1272116014
+    #
+    # So, for now, we patch `compiler-rt` to skip the explicit codesigning step.
+    ++ lib.optional stdenv.hostPlatform.isDarwin ./skip-explicit-codesign.patch;
+
+  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
+  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
+  # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
+  # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
+  # a flag and turn the flag off during the stdenv build.
+  postPatch = lib.optionalString (!stdenv.isDarwin) ''
+    substituteInPlace cmake/builtin-config-ix.cmake \
+      --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace cmake/builtin-config-ix.cmake \
+      --replace 'set(ARM64 arm64 arm64e)' 'set(ARM64)'
+    substituteInPlace cmake/config-ix.cmake \
+      --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
+  '' + lib.optionalString (useLLVM) ''
+    substituteInPlace lib/builtins/int_util.c \
+      --replace "#include <stdlib.h>" ""
+    substituteInPlace lib/builtins/clear_cache.c \
+      --replace "#include <assert.h>" ""
+    substituteInPlace lib/builtins/cpu_model.c \
+      --replace "#include <assert.h>" ""
+  '';
+
+  # Hack around weird upsream RPATH bug
+  postInstall = lib.optionalString (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isWasm) ''
+    ln -s "$out/lib"/*/* "$out/lib"
+  '' + lib.optionalString (useLLVM) ''
+    ln -s $out/lib/*/clang_rt.crtbegin-*.o $out/lib/crtbegin.o
+    ln -s $out/lib/*/clang_rt.crtend-*.o $out/lib/crtend.o
+    ln -s $out/lib/*/clang_rt.crtbegin_shared-*.o $out/lib/crtbeginS.o
+    ln -s $out/lib/*/clang_rt.crtend_shared-*.o $out/lib/crtendS.o
+  '' + lib.optionalString doFakeLibgcc ''
+     ln -s $out/lib/freebsd/libclang_rt.builtins-*.a $out/lib/libgcc.a
+  '';
+
+  meta = llvm_meta // {
+    homepage = "https://compiler-rt.llvm.org/";
+    description = "Compiler runtime libraries";
+    longDescription = ''
+      The compiler-rt project provides highly tuned implementations of the
+      low-level code generator support routines like "__fixunsdfdi" and other
+      calls generated when a target doesn't have a short sequence of native
+      instructions to implement a core IR operation. It also provides
+      implementations of run-time libraries for dynamic testing tools such as
+      AddressSanitizer, ThreadSanitizer, MemorySanitizer, and DataFlowSanitizer.
+    '';
+  };
+}
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/15/compiler-rt/gnu-install-dirs.patch
new file mode 100644
index 0000000000000..f3b1f63a7d713
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/compiler-rt/gnu-install-dirs.patch
@@ -0,0 +1,20 @@
+diff --git a/cmake/base-config-ix.cmake b/cmake/base-config-ix.cmake
+index 8a6219568b3f..30ee68a47ccf 100644
+--- a/cmake/base-config-ix.cmake
++++ b/cmake/base-config-ix.cmake
+@@ -100,13 +100,13 @@ endif()
+ if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+   set(COMPILER_RT_OUTPUT_LIBRARY_DIR
+     ${COMPILER_RT_OUTPUT_DIR}/lib)
+-  extend_path(default_install_path "${COMPILER_RT_INSTALL_PATH}" lib)
++  extend_path(default_install_path "${COMPILER_RT_INSTALL_PATH}" "${CMAKE_INSTALL_LIBDIR}")
+   set(COMPILER_RT_INSTALL_LIBRARY_DIR "${default_install_path}" CACHE PATH
+     "Path where built compiler-rt libraries should be installed.")
+ else(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+   set(COMPILER_RT_OUTPUT_LIBRARY_DIR
+     ${COMPILER_RT_OUTPUT_DIR}/lib/${COMPILER_RT_OS_DIR})
+-  extend_path(default_install_path "${COMPILER_RT_INSTALL_PATH}" "lib/${COMPILER_RT_OS_DIR}")
++  extend_path(default_install_path "${COMPILER_RT_INSTALL_PATH}" "${CMAKE_INSTALL_LIBDIR}/${COMPILER_RT_OS_DIR}")
+   set(COMPILER_RT_INSTALL_LIBRARY_DIR "${default_install_path}" CACHE PATH
+     "Path where built compiler-rt libraries should be installed.")
+ endif()
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/normalize-var.patch b/pkgs/development/compilers/llvm/15/compiler-rt/normalize-var.patch
new file mode 100644
index 0000000000000..135cf625ef78f
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/compiler-rt/normalize-var.patch
@@ -0,0 +1,16 @@
+diff --git a/compiler-rt/cmake/Modules/CompilerRTUtils.cmake b/compiler-rt/cmake/Modules/CompilerRTUtils.cmake
+index f1f46fb9599c..6f19e69507ba 100644
+--- a/cmake/Modules/CompilerRTUtils.cmake
++++ b/cmake/Modules/CompilerRTUtils.cmake
+@@ -302,8 +302,9 @@ macro(load_llvm_config)
+     # Get some LLVM variables from LLVMConfig.
+     include("${LLVM_CMAKE_PATH}/LLVMConfig.cmake")
+ 
+-    set(LLVM_LIBRARY_OUTPUT_INTDIR
+-      ${LLVM_BINARY_DIR}/${CMAKE_CFG_INTDIR}/lib${LLVM_LIBDIR_SUFFIX})
++    get_filename_component(LLVM_LIBRARY_OUTPUT_INTDIR
++      ${LLVM_BINARY_DIR}/${CMAKE_CFG_INTDIR}/lib${LLVM_LIBDIR_SUFFIX}
++      REALPATH)
+   endif()
+ endmacro()
+ 
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/skip-explicit-codesign.patch b/pkgs/development/compilers/llvm/15/compiler-rt/skip-explicit-codesign.patch
new file mode 100644
index 0000000000000..894a74e74d464
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/compiler-rt/skip-explicit-codesign.patch
@@ -0,0 +1,12 @@
+diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
+--- a/cmake/Modules/AddCompilerRT.cmake
++++ b/cmake/Modules/AddCompilerRT.cmake
+@@ -406,7 +406,7 @@ function(add_compiler_rt_runtime name type)
+         if (HAD_ERROR)
+           message(FATAL_ERROR "${CMAKE_LINKER} failed with status ${HAD_ERROR}")
+         endif()
+-        set(NEED_EXPLICIT_ADHOC_CODESIGN 1)
++        set(NEED_EXPLICIT_ADHOC_CODESIGN 0) # `postLinkSignHook` handles this for us
+         if ("${LD_V_OUTPUT}" MATCHES ".*ld64-([0-9.]+).*")
+           string(REGEX REPLACE ".*ld64-([0-9.]+).*" "\\1" HOST_LINK_VERSION ${LD_V_OUTPUT})
+           if (HOST_LINK_VERSION VERSION_GREATER_EQUAL 609)
diff --git a/pkgs/development/compilers/llvm/15/default.nix b/pkgs/development/compilers/llvm/15/default.nix
new file mode 100644
index 0000000000000..db98f2854a093
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/default.nix
@@ -0,0 +1,354 @@
+{ lowPrio, newScope, pkgs, lib, stdenv, stdenvNoCC, cmake, ninja
+, gccForLibs, preLibcCrossHeaders
+, libxml2, python3, fetchFromGitHub, overrideCC, wrapCCWith, wrapBintoolsWith
+, buildLlvmTools # tools, but from the previous stage, for cross
+, targetLlvmLibraries # libraries, but from the next stage, for cross
+, targetLlvm
+# This is the default binutils, but with *this* version of LLD rather
+# than the default LLVM verion's, if LLD is the choice. We use these for
+# the `useLLVM` bootstrapping below.
+, bootBintoolsNoLibc ?
+    if stdenv.targetPlatform.linker == "lld"
+    then null
+    else pkgs.bintoolsNoLibc
+, bootBintools ?
+    if stdenv.targetPlatform.linker == "lld"
+    then null
+    else pkgs.bintools
+, darwin
+# LLVM release information; specify one of these but not both:
+, gitRelease ? null
+  # i.e.:
+  # {
+  #   version = /* i.e. "15.0.0" */;
+  #   rev = /* commit SHA */;
+  #   rev-version = /* human readable version; i.e. "unstable-2022-26-07" */;
+  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
+  # }
+, officialRelease ? { version = "15.0.7"; sha256 = "sha256-wjuZQyXQ/jsmvy6y1aksCcEDXGBjuhpgngF3XQJ/T4s="; }
+  # i.e.:
+  # {
+  #   version = /* i.e. "15.0.0" */;
+  #   candidate = /* optional; if specified, should be: "rcN" */
+  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
+  # }
+# By default, we'll try to fetch a release from `github:llvm/llvm-project`
+# corresponding to the `gitRelease` or `officialRelease` specified.
+#
+# You can provide your own LLVM source by specifying this arg but then it's up
+# to you to make sure that the LLVM repo given matches the release configuration
+# specified.
+, monorepoSrc ? null
+}:
+
+assert let
+  int = a: if a then 1 else 0;
+  xor = a: b: ((builtins.bitXor (int a) (int b)) == 1);
+in
+  lib.assertMsg
+    (xor
+      (gitRelease != null)
+      (officialRelease != null))
+    ("must specify `gitRelease` or `officialRelease`" +
+      (lib.optionalString (gitRelease != null) " — not both"));
+let
+  monorepoSrc' = monorepoSrc;
+in let
+  releaseInfo = if gitRelease != null then rec {
+    original = gitRelease;
+    release_version = original.version;
+    version = gitRelease.rev-version;
+  } else rec {
+    original = officialRelease;
+    release_version = original.version;
+    version = if original ? candidate then
+      "${release_version}-${original.candidate}"
+    else
+      release_version;
+  };
+
+  monorepoSrc = if monorepoSrc' != null then
+    monorepoSrc'
+  else let
+    sha256 = releaseInfo.original.sha256;
+    rev = if gitRelease != null then
+      gitRelease.rev
+    else
+      "llvmorg-${releaseInfo.version}";
+  in fetchFromGitHub {
+    owner = "llvm";
+    repo = "llvm-project";
+    inherit rev sha256;
+  };
+
+  inherit (releaseInfo) release_version version;
+
+  llvm_meta = {
+    license     = with lib.licenses; [ ncsa llvm-exception ];
+    maintainers = lib.teams.llvm.members;
+    platforms   = lib.platforms.all;
+  };
+
+  tools = lib.makeExtensible (tools: let
+    callPackage = newScope (tools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc buildLlvmTools; });
+    mkExtraBuildCommands0 = cc: ''
+      rsrc="$out/resource-root"
+      mkdir "$rsrc"
+      ln -s "${cc.lib}/lib/clang/${release_version}/include" "$rsrc"
+      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
+    '';
+    mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
+      ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
+      ln -s "${targetLlvmLibraries.compiler-rt.out}/share" "$rsrc/share"
+    '';
+
+  bintoolsNoLibc' =
+    if bootBintoolsNoLibc == null
+    then tools.bintoolsNoLibc
+    else bootBintoolsNoLibc;
+  bintools' =
+    if bootBintools == null
+    then tools.bintools
+    else bootBintools;
+
+  in {
+
+    libllvm = callPackage ./llvm {
+      inherit llvm_meta;
+    };
+
+    # `llvm` historically had the binaries.  When choosing an output explicitly,
+    # we need to reintroduce `outputSpecified` to get the expected behavior e.g. of lib.get*
+    llvm = tools.libllvm.out // { outputSpecified = false; };
+
+    libclang = callPackage ./clang {
+      inherit llvm_meta;
+    };
+
+    clang-unwrapped = tools.libclang.out // { outputSpecified = false; };
+
+    llvm-manpages = lowPrio (tools.libllvm.override {
+      enableManpages = true;
+      python3 = pkgs.python3;  # don't use python-boot
+    });
+
+    clang-manpages = lowPrio (tools.libclang.override {
+      enableManpages = true;
+      python3 = pkgs.python3;  # don't use python-boot
+    });
+
+    lldb-manpages = lowPrio (tools.lldb.override {
+      enableManpages = true;
+      python3 = pkgs.python3;  # don't use python-boot
+    });
+
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
+
+    libstdcxxClang = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      # libstdcxx is taken from gcc in an ad-hoc way in cc-wrapper.
+      libcxx = null;
+      extraPackages = [
+        targetLlvmLibraries.compiler-rt
+      ];
+      extraBuildCommands = mkExtraBuildCommands cc;
+    };
+
+    libcxxClang = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = targetLlvmLibraries.libcxx;
+      extraPackages = [
+        libcxx.cxxabi
+        targetLlvmLibraries.compiler-rt
+      ];
+      extraBuildCommands = mkExtraBuildCommands cc;
+    };
+
+    lld = callPackage ./lld {
+      inherit llvm_meta;
+    };
+
+    lldb = callPackage ./lldb {
+      inherit llvm_meta;
+      inherit (darwin) libobjc bootstrap_cmds;
+      inherit (darwin.apple_sdk.libs) xpc;
+      inherit (darwin.apple_sdk.frameworks) Foundation Carbon Cocoa;
+    };
+
+    # Below, is the LLVM bootstrapping logic. It handles building a
+    # fully LLVM toolchain from scratch. No GCC toolchain should be
+    # pulled in. As a consequence, it is very quick to build different
+    # targets provided by LLVM and we can also build for what GCC
+    # doesn’t support like LLVM. Probably we should move to some other
+    # file.
+
+    bintools-unwrapped = callPackage ./bintools {};
+
+    bintoolsNoLibc = wrapBintoolsWith {
+      bintools = tools.bintools-unwrapped;
+      libc = preLibcCrossHeaders;
+    };
+
+    bintools = wrapBintoolsWith {
+      bintools = tools.bintools-unwrapped;
+    };
+
+    clangUseLLVM = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = targetLlvmLibraries.libcxx;
+      bintools = bintools';
+      extraPackages = [
+        libcxx.cxxabi
+        targetLlvmLibraries.compiler-rt
+      ] ++ lib.optionals (!stdenv.targetPlatform.isWasm) [
+        targetLlvmLibraries.libunwind
+      ];
+      extraBuildCommands = mkExtraBuildCommands cc;
+      nixSupport.cc-cflags =
+        [ "-rtlib=compiler-rt"
+          "-Wno-unused-command-line-argument"
+          "-B${targetLlvmLibraries.compiler-rt}/lib"
+        ]
+        ++ lib.optional (!stdenv.targetPlatform.isWasm) "--unwindlib=libunwind"
+        ++ lib.optional
+          (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false)
+          "-lunwind"
+        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
+    };
+
+    clangNoLibcxx = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = null;
+      bintools = bintools';
+      extraPackages = [
+        targetLlvmLibraries.compiler-rt
+      ];
+      extraBuildCommands = mkExtraBuildCommands cc;
+      nixSupport.cc-cflags = [
+        "-rtlib=compiler-rt"
+        "-B${targetLlvmLibraries.compiler-rt}/lib"
+        "-nostdlib++"
+      ];
+    };
+
+    clangNoLibc = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = null;
+      bintools = bintoolsNoLibc';
+      extraPackages = [
+        targetLlvmLibraries.compiler-rt
+      ];
+      extraBuildCommands = mkExtraBuildCommands cc;
+      nixSupport.cc-cflags = [
+        "-rtlib=compiler-rt"
+        "-B${targetLlvmLibraries.compiler-rt}/lib"
+      ];
+    };
+
+    clangNoCompilerRt = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = null;
+      bintools = bintoolsNoLibc';
+      extraPackages = [ ];
+      extraBuildCommands = mkExtraBuildCommands0 cc;
+      nixSupport.cc-cflags = [ "-nostartfiles" ];
+    };
+
+    clangNoCompilerRtWithLibc = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = null;
+      bintools = bintools';
+      extraPackages = [ ];
+      extraBuildCommands = mkExtraBuildCommands0 cc;
+    };
+
+  });
+
+  libraries = lib.makeExtensible (libraries: let
+    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc; });
+  in {
+
+    compiler-rt-libc = callPackage ./compiler-rt {
+      inherit llvm_meta;
+      stdenv = if stdenv.hostPlatform.useLLVM or false
+               then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
+               else stdenv;
+    };
+
+    compiler-rt-no-libc = callPackage ./compiler-rt {
+      inherit llvm_meta;
+      stdenv = if stdenv.hostPlatform.useLLVM or false
+               then overrideCC stdenv buildLlvmTools.clangNoCompilerRt
+               else stdenv;
+    };
+
+    # N.B. condition is safe because without useLLVM both are the same.
+    compiler-rt = if stdenv.hostPlatform.isAndroid
+      then libraries.compiler-rt-libc
+      else libraries.compiler-rt-no-libc;
+
+    stdenv = overrideCC stdenv buildLlvmTools.clang;
+
+    libcxxStdenv = overrideCC stdenv buildLlvmTools.libcxxClang;
+
+    libcxxabi = let
+      # CMake will "require" a compiler capable of compiling C++ programs
+      # cxx-header's build does not actually use one so it doesn't really matter
+      # what stdenv we use here, as long as CMake is happy.
+      cxx-headers = callPackage ./libcxx {
+        inherit llvm_meta;
+        # Note that if we use the regular stdenv here we'll get cycle errors
+        # when attempting to use this compiler in the stdenv.
+        #
+        # The final stdenv pulls `cxx-headers` from the package set where
+        # hostPlatform *is* the target platform which means that `stdenv` at
+        # that point attempts to use this toolchain.
+        #
+        # So, we use `stdenv_` (the stdenv containing `clang` from this package
+        # set, defined below) to sidestep this issue.
+        #
+        # Because we only use `cxx-headers` in `libcxxabi` (which depends on the
+        # clang stdenv _anyways_), this is okay.
+        stdenv = stdenv_;
+        headersOnly = true;
+      };
+
+      # `libcxxabi` *doesn't* need a compiler with a working C++ stdlib but it
+      # *does* need a relatively modern C++ compiler (see:
+      # https://releases.llvm.org/15.0.0/projects/libcxx/docs/index.html#platform-and-compiler-support).
+      #
+      # So, we use the clang from this LLVM package set, like libc++
+      # "boostrapping builds" do:
+      # https://releases.llvm.org/15.0.0/projects/libcxx/docs/BuildingLibcxx.html#bootstrapping-build
+      #
+      # We cannot use `clangNoLibcxx` because that contains `compiler-rt` which,
+      # on macOS, depends on `libcxxabi`, thus forming a cycle.
+      stdenv_ = overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc;
+    in callPackage ./libcxxabi {
+      stdenv = stdenv_;
+      inherit llvm_meta cxx-headers;
+    };
+
+    # Like `libcxxabi` above, `libcxx` requires a fairly modern C++ compiler,
+    # so: we use the clang from this LLVM package set instead of the regular
+    # stdenv's compiler.
+    libcxx = callPackage ./libcxx {
+      inherit llvm_meta;
+      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
+    };
+
+    libunwind = callPackage ./libunwind {
+      inherit llvm_meta;
+      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
+    };
+
+    openmp = callPackage ./openmp {
+      inherit llvm_meta targetLlvm;
+    };
+  });
+
+in { inherit tools libraries release_version; } // libraries // tools
diff --git a/pkgs/development/compilers/llvm/15/libcxx/default.nix b/pkgs/development/compilers/llvm/15/libcxx/default.nix
new file mode 100644
index 0000000000000..7762df29386ef
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/libcxx/default.nix
@@ -0,0 +1,107 @@
+{ lib, stdenv, llvm_meta
+, monorepoSrc, runCommand
+, cmake, ninja, python3, fixDarwinDylibNames, version
+, cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
+, libcxxabi, libcxxrt
+, enableShared ? !stdenv.hostPlatform.isStatic
+
+# If headersOnly is true, the resulting package would only include the headers.
+# Use this to break the circular dependency between libcxx and libcxxabi.
+#
+# Some context:
+# https://reviews.llvm.org/rG1687f2bbe2e2aaa092f942d4a97d41fad43eedfb
+, headersOnly ? false
+}:
+
+let
+  basename = "libcxx";
+in
+
+assert stdenv.isDarwin -> cxxabi.libName == "c++abi";
+
+stdenv.mkDerivation rec {
+  pname = basename + lib.optionalString headersOnly "-headers";
+  inherit version;
+
+  src = runCommand "${pname}-src-${version}" {} ''
+    mkdir -p "$out"
+    cp -r ${monorepoSrc}/cmake "$out"
+    cp -r ${monorepoSrc}/${basename} "$out"
+    mkdir -p "$out/libcxxabi"
+    cp -r ${monorepoSrc}/libcxxabi/include "$out/libcxxabi"
+    mkdir -p "$out/llvm"
+    cp -r ${monorepoSrc}/llvm/cmake "$out/llvm"
+    cp -r ${monorepoSrc}/llvm/utils "$out/llvm"
+    cp -r ${monorepoSrc}/third-party "$out"
+    cp -r ${monorepoSrc}/runtimes "$out"
+  '';
+
+  sourceRoot = "${src.name}/runtimes";
+
+  outputs = [ "out" ] ++ lib.optional (!headersOnly) "dev";
+
+  prePatch = ''
+    cd ../${basename}
+    chmod -R u+w .
+  '';
+
+  patches = [
+    ./gnu-install-dirs.patch
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+    ../../libcxx-0001-musl-hacks.patch
+  ];
+
+  postPatch = ''
+    cd ../runtimes
+  '';
+
+  preConfigure = lib.optionalString stdenv.hostPlatform.isMusl ''
+    patchShebangs utils/cat_files.py
+  '';
+
+  nativeBuildInputs = [ cmake ninja python3 ]
+    ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+
+  buildInputs = lib.optionals (!headersOnly) [ cxxabi ];
+
+  cmakeFlags = let
+    # See: https://libcxx.llvm.org/BuildingLibcxx.html#cmdoption-arg-libcxx-cxx-abi-string
+    libcxx_cxx_abi_opt = {
+      "c++abi" = "system-libcxxabi";
+      "cxxrt" = "libcxxrt";
+    }.${cxxabi.libName} or (throw "unknown cxxabi: ${cxxabi.libName} (${cxxabi.pname})");
+  in [
+    "-DLLVM_ENABLE_RUNTIMES=libcxx"
+    "-DLIBCXX_CXX_ABI=${if headersOnly then "none" else libcxx_cxx_abi_opt}"
+  ] ++ lib.optional (!headersOnly && cxxabi.libName == "c++abi") "-DLIBCXX_CXX_ABI_INCLUDE_PATHS=${cxxabi.dev}/include/c++/v1"
+    ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
+    ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
+    ++ lib.optionals stdenv.hostPlatform.isWasm [
+      "-DLIBCXX_ENABLE_THREADS=OFF"
+      "-DLIBCXX_ENABLE_FILESYSTEM=OFF"
+      "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
+    ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF"
+    # If we're only building the headers we don't actually *need* a functioning
+    # C/C++ compiler:
+    ++ lib.optionals (headersOnly) [
+      "-DCMAKE_C_COMPILER_WORKS=ON"
+      "-DCMAKE_CXX_COMPILER_WORKS=ON"
+    ];
+
+  ninjaFlags = lib.optional headersOnly "generate-cxx-headers";
+  installTargets = lib.optional headersOnly "install-cxx-headers";
+
+  passthru = {
+    isLLVM = true;
+    inherit cxxabi;
+  };
+
+  meta = llvm_meta // {
+    homepage = "https://libcxx.llvm.org/";
+    description = "C++ standard library";
+    longDescription = ''
+      libc++ is an implementation of the C++ standard library, targeting C++11,
+      C++14 and above.
+    '';
+  };
+}
diff --git a/pkgs/development/compilers/llvm/15/libcxx/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/15/libcxx/gnu-install-dirs.patch
new file mode 100644
index 0000000000000..daee5bdd0ed33
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/libcxx/gnu-install-dirs.patch
@@ -0,0 +1,22 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 74eff2002fc9..c935d10878bb 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -419,7 +419,7 @@ if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+   set(LIBCXX_LIBRARY_DIR ${LLVM_LIBRARY_OUTPUT_INTDIR}/${LLVM_DEFAULT_TARGET_TRIPLE})
+   set(LIBCXX_GENERATED_INCLUDE_DIR "${LLVM_BINARY_DIR}/include/c++/v1")
+   set(LIBCXX_GENERATED_INCLUDE_TARGET_DIR "${LLVM_BINARY_DIR}/include/${LLVM_DEFAULT_TARGET_TRIPLE}/c++/v1")
+-  set(LIBCXX_INSTALL_LIBRARY_DIR lib${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE} CACHE PATH
++  set(LIBCXX_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE} CACHE PATH
+       "Path where built libc++ libraries should be installed.")
+   set(LIBCXX_INSTALL_INCLUDE_TARGET_DIR "${CMAKE_INSTALL_INCLUDEDIR}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++/v1" CACHE PATH
+       "Path where target-specific libc++ headers should be installed.")
+@@ -436,7 +436,7 @@ else()
+     set(LIBCXX_GENERATED_INCLUDE_DIR "${CMAKE_BINARY_DIR}/include/c++/v1")
+   endif()
+   set(LIBCXX_GENERATED_INCLUDE_TARGET_DIR "${LIBCXX_GENERATED_INCLUDE_DIR}")
+-  set(LIBCXX_INSTALL_LIBRARY_DIR lib${LIBCXX_LIBDIR_SUFFIX} CACHE PATH
++  set(LIBCXX_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LIBCXX_LIBDIR_SUFFIX} CACHE PATH
+       "Path where built libc++ libraries should be installed.")
+   set(LIBCXX_INSTALL_INCLUDE_TARGET_DIR "${LIBCXX_INSTALL_INCLUDE_DIR}" CACHE PATH
+       "Path where target-specific libc++ headers should be installed.")
diff --git a/pkgs/development/compilers/llvm/15/libcxxabi/default.nix b/pkgs/development/compilers/llvm/15/libcxxabi/default.nix
new file mode 100644
index 0000000000000..fd99f4553c0cc
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/libcxxabi/default.nix
@@ -0,0 +1,105 @@
+{ lib, stdenv, llvm_meta, cmake, ninja, python3
+, monorepoSrc, runCommand, fetchpatch
+, cxx-headers, libunwind, version
+, enableShared ? !stdenv.hostPlatform.isStatic
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libcxxabi";
+  inherit version;
+
+  src = runCommand "${pname}-src-${version}" {} ''
+    mkdir -p "$out"
+    cp -r ${monorepoSrc}/cmake "$out"
+    cp -r ${monorepoSrc}/${pname} "$out"
+    mkdir -p "$out/libcxx/src"
+    cp -r ${monorepoSrc}/libcxx/cmake "$out/libcxx"
+    cp -r ${monorepoSrc}/libcxx/include "$out/libcxx"
+    cp -r ${monorepoSrc}/libcxx/src/include "$out/libcxx/src"
+    mkdir -p "$out/llvm"
+    cp -r ${monorepoSrc}/llvm/cmake "$out/llvm"
+    cp -r ${monorepoSrc}/llvm/utils "$out/llvm"
+    cp -r ${monorepoSrc}/runtimes "$out"
+  '';
+
+  sourceRoot = "${src.name}/runtimes";
+
+  outputs = [ "out" "dev" ];
+
+  postUnpack = lib.optionalString stdenv.isDarwin ''
+    export TRIPLE=x86_64-apple-darwin
+  '' + lib.optionalString stdenv.hostPlatform.isWasm ''
+    patch -p1 -d llvm -i ${./wasm.patch}
+  '';
+
+  prePatch = ''
+    cd ../${pname}
+    chmod -R u+w .
+  '';
+
+  patches = [
+    ./gnu-install-dirs.patch
+
+    # https://reviews.llvm.org/D132298, Allow building libcxxabi alone
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/e6a0800532bb409f6d1c62f3698bdd6994a877dc.patch";
+      sha256 = "1xyjd56m4pfwq8p3xh6i8lhkk9kq15jaml7qbhxdf87z4jjkk63a";
+      stripLen = 1;
+    })
+  ];
+
+  postPatch = ''
+    cd ../runtimes
+  '';
+
+  nativeBuildInputs = [ cmake ninja python3 ];
+  buildInputs = lib.optional (!stdenv.isDarwin && !stdenv.hostPlatform.isWasm) libunwind;
+
+  cmakeFlags = [
+    "-DLLVM_ENABLE_RUNTIMES=libcxxabi"
+    "-DLIBCXXABI_LIBCXX_INCLUDES=${cxx-headers}/include/c++/v1"
+
+    # `libcxxabi`'s build does not need a toolchain with a c++ stdlib attached
+    # (we specify the headers it should use explicitly above).
+    #
+    # CMake however checks for this anyways; this flag tells it not to. See:
+    # https://github.com/llvm/llvm-project/blob/4bd3f3759259548e159aeba5c76efb9a0864e6fa/llvm/runtimes/CMakeLists.txt#L243
+    "-DCMAKE_CXX_COMPILER_WORKS=ON"
+  ] ++ lib.optionals (stdenv.hostPlatform.useLLVM or false) [
+    "-DLLVM_ENABLE_LIBCXX=ON"
+    "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
+  ] ++ lib.optionals stdenv.hostPlatform.isWasm [
+    "-DLIBCXXABI_ENABLE_THREADS=OFF"
+    "-DLIBCXXABI_ENABLE_EXCEPTIONS=OFF"
+  ] ++ lib.optionals (!enableShared) [
+    "-DLIBCXXABI_ENABLE_SHARED=OFF"
+  ];
+
+  preInstall = lib.optionalString stdenv.isDarwin ''
+    for file in lib/*.dylib; do
+      # this should be done in CMake, but having trouble figuring out
+      # the magic combination of necessary CMake variables
+      # if you fancy a try, take a look at
+      # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
+      install_name_tool -id $out/$file $file
+    done
+  '';
+
+  postInstall = ''
+    mkdir -p "$dev/include"
+    install -m 644 ../../${pname}/include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
+  '';
+
+  passthru = {
+    libName = "c++abi";
+  };
+
+  meta = llvm_meta // {
+    homepage = "https://libcxxabi.llvm.org/";
+    description = "Provides C++ standard library support";
+    longDescription = ''
+      libc++abi is a new implementation of low level support for a standard C++ library.
+    '';
+    maintainers = llvm_meta.maintainers ++ [ lib.maintainers.vlstill ];
+  };
+}
diff --git a/pkgs/development/compilers/llvm/15/libcxxabi/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/15/libcxxabi/gnu-install-dirs.patch
new file mode 100644
index 0000000000000..fa587612aaf63
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/libcxxabi/gnu-install-dirs.patch
@@ -0,0 +1,22 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index b8326d08d23a..a1e36f713161 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -187,7 +187,7 @@ set(LIBCXXABI_INSTALL_RUNTIME_DIR "${CMAKE_INSTALL_BINDIR}" CACHE PATH
+ if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+   set(LIBCXXABI_HEADER_DIR ${LLVM_BINARY_DIR})
+   set(LIBCXXABI_LIBRARY_DIR ${LLVM_LIBRARY_OUTPUT_INTDIR}/${LLVM_DEFAULT_TARGET_TRIPLE})
+-  set(LIBCXXABI_INSTALL_LIBRARY_DIR lib${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE} CACHE PATH
++  set(LIBCXXABI_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE} CACHE PATH
+       "Path where built libc++abi libraries should be installed.")
+   if(LIBCXX_LIBDIR_SUBDIR)
+     string(APPEND LIBCXXABI_LIBRARY_DIR /${LIBCXXABI_LIBDIR_SUBDIR})
+@@ -201,7 +201,7 @@ else()
+     set(LIBCXXABI_HEADER_DIR ${CMAKE_BINARY_DIR})
+     set(LIBCXXABI_LIBRARY_DIR ${CMAKE_BINARY_DIR}/lib${LIBCXXABI_LIBDIR_SUFFIX})
+   endif()
+-  set(LIBCXXABI_INSTALL_LIBRARY_DIR lib${LIBCXXABI_LIBDIR_SUFFIX} CACHE PATH
++  set(LIBCXXABI_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LIBCXXABI_LIBDIR_SUFFIX} CACHE PATH
+       "Path where built libc++abi libraries should be installed.")
+ endif()
+ 
diff --git a/pkgs/development/compilers/llvm/15/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/15/libcxxabi/wasm.patch
new file mode 100644
index 0000000000000..4ebfe46aa813d
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/libcxxabi/wasm.patch
@@ -0,0 +1,16 @@
+diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
+index 15497d405e0..33f7f18193a 100644
+--- a/cmake/modules/HandleLLVMOptions.cmake
++++ b/cmake/modules/HandleLLVMOptions.cmake
+@@ -127,7 +127,10 @@ else(WIN32)
+       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
+     endif()
+   else(FUCHSIA OR UNIX)
+-    MESSAGE(SEND_ERROR "Unable to determine platform")
++    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
++    else()
++      MESSAGE(SEND_ERROR "Unable to determine platform")
++    endif()
+   endif(FUCHSIA OR UNIX)
+ endif(WIN32)
+ 
diff --git a/pkgs/development/compilers/llvm/15/libunwind/default.nix b/pkgs/development/compilers/llvm/15/libunwind/default.nix
new file mode 100644
index 0000000000000..dd14e2acaf869
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/libunwind/default.nix
@@ -0,0 +1,62 @@
+{ lib, stdenv, llvm_meta, version
+, monorepoSrc, runCommand
+, cmake
+, ninja
+, python3
+, enableShared ? !stdenv.hostPlatform.isStatic
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libunwind";
+  inherit version;
+
+  # I am not so comfortable giving libc++ and friends the whole monorepo as
+  # requested, so I filter it to what is needed.
+  src = runCommand "${pname}-src-${version}" {} ''
+    mkdir -p "$out"
+    cp -r ${monorepoSrc}/cmake "$out"
+    cp -r ${monorepoSrc}/${pname} "$out"
+    mkdir -p "$out/libcxx"
+    cp -r ${monorepoSrc}/libcxx/cmake "$out/libcxx"
+    cp -r ${monorepoSrc}/libcxx/utils "$out/libcxx"
+    mkdir -p "$out/llvm"
+    cp -r ${monorepoSrc}/llvm/cmake "$out/llvm"
+    cp -r ${monorepoSrc}/llvm/utils "$out/llvm"
+    cp -r ${monorepoSrc}/runtimes "$out"
+  '';
+
+  sourceRoot = "${src.name}/runtimes";
+
+  prePatch = ''
+    cd ../${pname}
+    chmod -R u+w .
+  '';
+
+  patches = [
+    ./gnu-install-dirs.patch
+  ];
+
+  postPatch = ''
+    cd ../runtimes
+  '';
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [ cmake ninja python3 ];
+
+  cmakeFlags = [
+    "-DLLVM_ENABLE_RUNTIMES=libunwind"
+  ] ++ lib.optional (!enableShared) "-DLIBUNWIND_ENABLE_SHARED=OFF";
+
+  meta = llvm_meta // {
+    # Details: https://github.com/llvm/llvm-project/blob/main/libunwind/docs/index.rst
+    homepage = "https://clang.llvm.org/docs/Toolchain.html#unwind-library";
+    description = "LLVM's unwinder library";
+    longDescription = ''
+      The unwind library provides a family of _Unwind_* functions implementing
+      the language-neutral stack unwinding portion of the Itanium C++ ABI (Level
+      I). It is a dependency of the C++ ABI library, and sometimes is a
+      dependency of other runtimes.
+    '';
+  };
+}
diff --git a/pkgs/development/compilers/llvm/15/libunwind/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/15/libunwind/gnu-install-dirs.patch
new file mode 100644
index 0000000000000..edfb2a8760bd6
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/libunwind/gnu-install-dirs.patch
@@ -0,0 +1,22 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 5a06805f05f1..86a50329e6a8 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -117,7 +117,7 @@ set(LIBUNWIND_INSTALL_RUNTIME_DIR "${CMAKE_INSTALL_BINDIR}" CACHE PATH
+ 
+ if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+   set(LIBUNWIND_LIBRARY_DIR ${LLVM_LIBRARY_OUTPUT_INTDIR}/${LLVM_DEFAULT_TARGET_TRIPLE})
+-  set(LIBUNWIND_INSTALL_LIBRARY_DIR lib${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE} CACHE PATH
++  set(LIBUNWIND_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE} CACHE PATH
+       "Path where built libunwind libraries should be installed.")
+   if(LIBCXX_LIBDIR_SUBDIR)
+     string(APPEND LIBUNWIND_LIBRARY_DIR /${LIBUNWIND_LIBDIR_SUBDIR})
+@@ -129,7 +129,7 @@ else()
+   else()
+     set(LIBUNWIND_LIBRARY_DIR ${CMAKE_BINARY_DIR}/lib${LIBUNWIND_LIBDIR_SUFFIX})
+   endif()
+-  set(LIBUNWIND_INSTALL_LIBRARY_DIR lib${LIBUNWIND_LIBDIR_SUFFIX} CACHE PATH
++  set(LIBUNWIND_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LIBUNWIND_LIBDIR_SUFFIX} CACHE PATH
+       "Path where built libunwind libraries should be installed.")
+ endif()
+ 
diff --git a/pkgs/development/compilers/llvm/15/lld/default.nix b/pkgs/development/compilers/llvm/15/lld/default.nix
new file mode 100644
index 0000000000000..e8bca769de5fa
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/lld/default.nix
@@ -0,0 +1,55 @@
+{ lib, stdenv, llvm_meta
+, buildLlvmTools
+, monorepoSrc, runCommand
+, cmake
+, ninja
+, libxml2
+, libllvm
+, version
+}:
+
+stdenv.mkDerivation rec {
+  pname = "lld";
+  inherit version;
+
+  # Blank llvm dir just so relative path works
+  src = runCommand "${pname}-src-${version}" {} ''
+    mkdir -p "$out"
+    cp -r ${monorepoSrc}/cmake "$out"
+    cp -r ${monorepoSrc}/${pname} "$out"
+    mkdir -p "$out/libunwind"
+    cp -r ${monorepoSrc}/libunwind/include "$out/libunwind"
+    mkdir -p "$out/llvm"
+  '';
+
+  sourceRoot = "${src.name}/${pname}";
+
+  patches = [
+    ./gnu-install-dirs.patch
+  ];
+
+  nativeBuildInputs = [ cmake ninja ];
+  buildInputs = [ libllvm libxml2 ];
+
+  cmakeFlags = [
+    "-DLLD_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/cmake/lld"
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
+  ];
+  LDFLAGS = lib.optionalString stdenv.hostPlatform.isMusl "-Wl,-z,stack-size=2097152";
+
+  outputs = [ "out" "lib" "dev" ];
+
+  meta = llvm_meta // {
+    homepage = "https://lld.llvm.org/";
+    description = "The LLVM linker (unwrapped)";
+    longDescription = ''
+      LLD is a linker from the LLVM project that is a drop-in replacement for
+      system linkers and runs much faster than them. It also provides features
+      that are useful for toolchain developers.
+      The linker supports ELF (Unix), PE/COFF (Windows), Mach-O (macOS), and
+      WebAssembly in descending order of completeness. Internally, LLD consists
+      of several different linkers.
+    '';
+  };
+}
diff --git a/pkgs/development/compilers/llvm/15/lld/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/15/lld/gnu-install-dirs.patch
new file mode 100644
index 0000000000000..ea62b2ad50c75
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/lld/gnu-install-dirs.patch
@@ -0,0 +1,46 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index dcc649629a4b..58dca54642e4 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -70,13 +70,15 @@ if(LLD_BUILT_STANDALONE)
+   if (NOT LLVM_CONFIG_FOUND)
+     # Pull values from LLVMConfig.cmake.  We can drop this once the llvm-config
+     # path is removed.
+-    set(MAIN_INCLUDE_DIR "${LLVM_INCLUDE_DIR}")
++    set(INCLUDE_DIRS ${LLVM_INCLUDE_DIRS})
+     set(LLVM_OBJ_DIR "${LLVM_BINARY_DIR}")
+     # N.B. this is just a default value, the CACHE PATHs below can be overridden.
+     set(MAIN_SRC_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../llvm")
++  else()
++    set(INCLUDE_DIRS "${LLVM_BINARY_DIR}/include" "${MAIN_INCLUDE_DIR}")
+   endif()
+ 
+-  set(LLVM_MAIN_INCLUDE_DIR "${MAIN_INCLUDE_DIR}" CACHE PATH "Path to llvm/include")
++  set(LLVM_INCLUDE_DIRS ${INCLUDE_DIRS} CACHE PATH "Path to llvm/include and any other header dirs needed")
+   set(LLVM_BINARY_DIR "${LLVM_OBJ_ROOT}" CACHE PATH "Path to LLVM build tree")
+   set(LLVM_MAIN_SRC_DIR "${MAIN_SRC_DIR}" CACHE PATH "Path to LLVM source tree")
+ 
+@@ -95,7 +97,7 @@ if(LLD_BUILT_STANDALONE)
+ 
+   set(PACKAGE_VERSION "${LLVM_PACKAGE_VERSION}")
+ 
+-  include_directories("${LLVM_BINARY_DIR}/include" ${LLVM_INCLUDE_DIRS})
++  include_directories(${LLVM_INCLUDE_DIRS})
+   link_directories(${LLVM_LIBRARY_DIRS})
+ 
+   if(LLVM_INCLUDE_TESTS)
+diff --git a/cmake/modules/AddLLD.cmake b/cmake/modules/AddLLD.cmake
+index d3924f7243d4..42a7cd62281c 100644
+--- a/cmake/modules/AddLLD.cmake
++++ b/cmake/modules/AddLLD.cmake
+@@ -18,8 +18,8 @@ macro(add_lld_library name)
+     install(TARGETS ${name}
+       COMPONENT ${name}
+       ${export_to_lldtargets}
+-      LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-      ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX}
++      LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}"
++      ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}"
+       RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}")
+ 
+     if (${ARG_SHARED} AND NOT CMAKE_CONFIGURATION_TYPES)
diff --git a/pkgs/development/compilers/llvm/15/lldb/cpu_subtype_arm64e_replacement.patch b/pkgs/development/compilers/llvm/15/lldb/cpu_subtype_arm64e_replacement.patch
new file mode 100644
index 0000000000000..20d35c9f3ea91
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/lldb/cpu_subtype_arm64e_replacement.patch
@@ -0,0 +1,12 @@
+diff --git a/source/Host/macosx/objcxx/HostInfoMacOSX.mm b/source/Host/macosx/objcxx/HostInfoMacOSX.mm
+--- a/source/Host/macosx/objcxx/HostInfoMacOSX.mm
++++ b/source/Host/macosx/objcxx/HostInfoMacOSX.mm
+@@ -233,7 +233,7 @@ void HostInfoMacOSX::ComputeHostArchitectureSupport(ArchSpec &arch_32,
+     len = sizeof(is_64_bit_capable);
+     ::sysctlbyname("hw.cpu64bit_capable", &is_64_bit_capable, &len, NULL, 0);
+ 
+-    if (cputype == CPU_TYPE_ARM64 && cpusubtype == CPU_SUBTYPE_ARM64E) {
++    if (cputype == CPU_TYPE_ARM64 && cpusubtype == ((cpu_subtype_t) 2)) { // CPU_SUBTYPE_ARM64E is not available in the macOS 10.12 headers
+       // The arm64e architecture is a preview. Pretend the host architecture
+       // is arm64.
+       cpusubtype = CPU_SUBTYPE_ARM64_ALL;
diff --git a/pkgs/development/compilers/llvm/15/lldb/default.nix b/pkgs/development/compilers/llvm/15/lldb/default.nix
new file mode 100644
index 0000000000000..4b50b79cf613b
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/lldb/default.nix
@@ -0,0 +1,186 @@
+{ lib, stdenv, llvm_meta
+, runCommand
+, monorepoSrc
+, cmake
+, ninja
+, zlib
+, ncurses
+, swig
+, which
+, libedit
+, libxml2
+, libllvm
+, libclang
+, python3
+, version
+, libobjc
+, xpc
+, Foundation
+, bootstrap_cmds
+, Carbon
+, Cocoa
+, lit
+, makeWrapper
+, darwin
+, enableManpages ? false
+, lua5_3
+}:
+
+# TODO: we build the python bindings but don't expose them as a python package
+# TODO: expose the vscode extension?
+
+stdenv.mkDerivation (rec {
+  pname = "lldb";
+  inherit version;
+
+  src = runCommand "${pname}-src-${version}" {} ''
+    mkdir -p "$out"
+    cp -r ${monorepoSrc}/cmake "$out"
+    cp -r ${monorepoSrc}/${pname} "$out"
+  '';
+
+  sourceRoot = "${src.name}/${pname}";
+
+  patches = [
+    ./procfs.patch
+    (runCommand "resource-dir.patch" {
+      clangLibDir = "${libclang.lib}/lib";
+    } ''
+      substitute '${./resource-dir.patch}' "$out" --subst-var clangLibDir
+    '')
+    ./gnu-install-dirs.patch
+  ]
+  # This is a stopgap solution if/until the macOS SDK used for x86_64 is
+  # updated.
+  #
+  # The older 10.12 SDK used on x86_64 as of this writing has a `mach/machine.h`
+  # header that does not define `CPU_SUBTYPE_ARM64E` so we replace the one use
+  # of this preprocessor symbol in `lldb` with its expansion.
+  #
+  # See here for some context:
+  # https://github.com/NixOS/nixpkgs/pull/194634#issuecomment-1272129132
+  ++ lib.optional (
+    stdenv.targetPlatform.isDarwin
+      && !stdenv.targetPlatform.isAarch64
+      && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
+  ) ./cpu_subtype_arm64e_replacement.patch;
+
+  outputs = [ "out" "lib" "dev" ];
+
+  nativeBuildInputs = [
+    cmake ninja python3 which swig lit makeWrapper lua5_3
+  ] ++ lib.optionals enableManpages [
+    python3.pkgs.sphinx python3.pkgs.recommonmark
+  ];
+
+  buildInputs = [
+    ncurses
+    zlib
+    libedit
+    libxml2
+    libllvm
+  ] ++ lib.optionals stdenv.isDarwin [
+    libobjc
+    xpc
+    Foundation
+    bootstrap_cmds
+    Carbon
+    Cocoa
+  ]
+  # The older libSystem used on x86_64 macOS is missing the
+  # `<bsm/audit_session.h>` header which `lldb` uses.
+  #
+  # We copy this header over from macOS 10.12 SDK.
+  #
+  # See here for context:
+  # https://github.com/NixOS/nixpkgs/pull/194634#issuecomment-1272129132
+  ++ lib.optional (
+      stdenv.targetPlatform.isDarwin
+        && !stdenv.targetPlatform.isAarch64
+    ) (
+      runCommand "bsm-audit-session-header" { } ''
+        install -Dm444 \
+          "${lib.getDev darwin.apple_sdk.sdk}/include/bsm/audit_session.h" \
+          "$out/include/bsm/audit_session.h"
+      ''
+    );
+
+  hardeningDisable = [ "format" ];
+
+  cmakeFlags = [
+    "-DLLDB_INCLUDE_TESTS=${if doCheck then "YES" else "NO"}"
+    "-DLLVM_ENABLE_RTTI=OFF"
+    "-DClang_DIR=${libclang.dev}/lib/cmake"
+    "-DLLVM_EXTERNAL_LIT=${lit}/bin/lit"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-DLLDB_USE_SYSTEM_DEBUGSERVER=ON"
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    "-DLLDB_CODESIGN_IDENTITY=" # codesigning makes nondeterministic
+  ] ++ lib.optionals enableManpages [
+    "-DLLVM_ENABLE_SPHINX=ON"
+    "-DSPHINX_OUTPUT_MAN=ON"
+    "-DSPHINX_OUTPUT_HTML=OFF"
+
+    # docs reference `automodapi` but it's not added to the extensions list when
+    # only building the manpages:
+    # https://github.com/llvm/llvm-project/blob/af6ec9200b09039573d85e349496c4f5b17c3d7f/lldb/docs/conf.py#L54
+    #
+    # so, we just ignore the resulting errors
+    "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+  ] ++ lib.optionals doCheck [
+    "-DLLDB_TEST_C_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
+    "-DLLDB_TEST_CXX_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++"
+  ];
+
+  doCheck = false;
+
+  installCheckPhase = ''
+    if [ ! -e "$lib/${python3.sitePackages}/lldb/_lldb.so" ] ; then
+        return 1;
+    fi
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/lldb --prefix PYTHONPATH : $lib/${python3.sitePackages}/
+
+    # Editor support
+    # vscode:
+    install -D ../tools/lldb-vscode/package.json $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/package.json
+    mkdir -p $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
+    ln -s $out/bin/lldb-vscode $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
+  '';
+
+  meta = llvm_meta // {
+    homepage = "https://lldb.llvm.org/";
+    description = "A next-generation high-performance debugger";
+    longDescription = ''
+      LLDB is a next generation, high-performance debugger. It is built as a set
+      of reusable components which highly leverage existing libraries in the
+      larger LLVM Project, such as the Clang expression parser and LLVM
+      disassembler.
+    '';
+  };
+} // lib.optionalAttrs enableManpages {
+  pname = "lldb-manpages";
+
+  ninjaFlags = [ "docs-lldb-man" ];
+
+  propagatedBuildInputs = [];
+
+  # manually install lldb man page
+  installPhase = ''
+    mkdir -p $out/share/man/man1
+    install docs/man/lldb.1 -t $out/share/man/man1/
+  '';
+
+  postPatch = null;
+  postInstall = null;
+
+  outputs = [ "out" ];
+
+  doCheck = false;
+
+  meta = llvm_meta // {
+    description = "man pages for LLDB ${version}";
+  };
+})
diff --git a/pkgs/development/compilers/llvm/15/lldb/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/15/lldb/gnu-install-dirs.patch
new file mode 100644
index 0000000000000..4388f5c7f593f
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/lldb/gnu-install-dirs.patch
@@ -0,0 +1,23 @@
+diff --git a/cmake/modules/AddLLDB.cmake b/cmake/modules/AddLLDB.cmake
+index 3291a7c808e1..b27d27ce6a87 100644
+--- a/cmake/modules/AddLLDB.cmake
++++ b/cmake/modules/AddLLDB.cmake
+@@ -109,7 +109,7 @@ function(add_lldb_library name)
+   endif()
+ 
+   if(PARAM_SHARED)
+-    set(install_dest lib${LLVM_LIBDIR_SUFFIX})
++    set(install_dest ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
+     if(PARAM_INSTALL_PREFIX)
+       set(install_dest ${PARAM_INSTALL_PREFIX})
+     endif()
+diff --git a/tools/intel-features/CMakeLists.txt b/tools/intel-features/CMakeLists.txt
+index 7d48491ec89a..c04543585588 100644
+--- a/tools/intel-features/CMakeLists.txt
++++ b/tools/intel-features/CMakeLists.txt
+@@ -30,4 +30,4 @@ add_lldb_library(lldbIntelFeatures SHARED
+   )
+ 
+ install(TARGETS lldbIntelFeatures
+-  LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX})
++  LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
diff --git a/pkgs/development/compilers/llvm/15/lldb/procfs.patch b/pkgs/development/compilers/llvm/15/lldb/procfs.patch
new file mode 100644
index 0000000000000..7b200e86505ca
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/lldb/procfs.patch
@@ -0,0 +1,46 @@
+--- a/source/Plugins/Process/Linux/Procfs.h
++++ b/source/Plugins/Process/Linux/Procfs.h
+@@ -10,6 +10,13 @@
+ // sys/procfs.h on Android/Linux for all supported architectures.
+ 
+ #include <sys/ptrace.h>
++#include <asm/ptrace.h>
++
++// on i686 preprocessor symbols with these register names are defined as
++// numeric constants; these symbols clash with identifier names used in
++// `llvm/Support/VirtualFileSystem.h` and `llvm/ADT/SmallVector.h`
++#undef FS
++#undef CS
+ 
+ #include "lldb/lldb-types.h"
+ 
+@@ -17,23 +24,13 @@
+ 
+ #include <vector>
+ 
+-#ifdef __ANDROID__
+-#if defined(__arm64__) || defined(__aarch64__)
+-typedef unsigned long elf_greg_t;
+-typedef elf_greg_t
+-    elf_gregset_t[(sizeof(struct user_pt_regs) / sizeof(elf_greg_t))];
+-typedef struct user_fpsimd_state elf_fpregset_t;
+-#ifndef NT_FPREGSET
+-#define NT_FPREGSET NT_PRFPREG
+-#endif // NT_FPREGSET
+-#elif defined(__mips__)
+-#ifndef NT_FPREGSET
+-#define NT_FPREGSET NT_PRFPREG
+-#endif // NT_FPREGSET
+-#endif
+-#else // __ANDROID__
++#if !defined(__GLIBC__) && defined(__powerpc__)
++#define pt_regs musl_pt_regs
++#include <sys/procfs.h>
++#undef pt_regs
++#else
+ #include <sys/procfs.h>
+-#endif // __ANDROID__
++#endif
+ 
+ namespace lldb_private {
+ namespace process_linux {
diff --git a/pkgs/development/compilers/llvm/15/lldb/resource-dir.patch b/pkgs/development/compilers/llvm/15/lldb/resource-dir.patch
new file mode 100644
index 0000000000000..e0db80afeb9f7
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/lldb/resource-dir.patch
@@ -0,0 +1,13 @@
+diff --git a/lldb/cmake/modules/LLDBConfig.cmake b/lldb/cmake/modules/LLDBConfig.cmake
+index 37364341ff8b..7f74c1a3e257 100644
+--- a/cmake/modules/LLDBConfig.cmake
++++ b/cmake/modules/LLDBConfig.cmake
+@@ -257,7 +257,7 @@ if (NOT TARGET clang-resource-headers)
+   # Iterate over the possible places where the external resource directory
+   # could be and pick the first that exists.
+   foreach(CANDIDATE "${Clang_DIR}/../.." "${LLVM_DIR}" "${LLVM_LIBRARY_DIRS}"
+-                    "${LLVM_BUILD_LIBRARY_DIR}"
++                    "${LLVM_BUILD_LIBRARY_DIR}" "@clangLibDir@"
+                     "${LLVM_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}")
+     # Build the resource directory path by appending 'clang/<version number>'.
+     set(CANDIDATE_RESOURCE_DIR "${CANDIDATE}/clang/${LLDB_CLANG_RESOURCE_DIR_NAME}")
diff --git a/pkgs/development/compilers/llvm/15/llvm/default.nix b/pkgs/development/compilers/llvm/15/llvm/default.nix
new file mode 100644
index 0000000000000..e0b79a9acfefc
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/llvm/default.nix
@@ -0,0 +1,429 @@
+{ lib, stdenv, llvm_meta
+, pkgsBuildBuild
+, monorepoSrc
+, runCommand
+, fetchpatch
+, cmake
+, darwin
+, ninja
+, python3
+, python3Packages
+, libffi
+, libbfd
+, libpfm
+, libxml2
+, ncurses
+, version
+, release_version
+, zlib
+, which
+, sysctl
+, buildLlvmTools
+, debugVersion ? false
+, doCheck ? (!stdenv.isx86_32 /* TODO: why */) && (!stdenv.hostPlatform.isMusl)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
+, enableManpages ? false
+, enableSharedLibraries ? !stdenv.hostPlatform.isStatic
+, enablePFM ? stdenv.isLinux /* PFM only supports Linux */
+  # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
+  # broken for the armv7l builder
+  && !stdenv.hostPlatform.isAarch
+, enablePolly ? true
+} @args:
+
+let
+  inherit (lib) optional optionals optionalString;
+
+  # Used when creating a version-suffixed symlink of libLLVM.dylib
+  shortVersion = with lib;
+    concatStringsSep "." (take 1 (splitString "." release_version));
+
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    # Note that we _explicitly_ ask for a python interpreter for our host
+    # platform here; the splicing that would ordinarily take care of this for
+    # us does not seem to work once we use `withPackages`.
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in pkgsBuildBuild.targetPackages.python3.withPackages checkDeps
+  else python3;
+
+in stdenv.mkDerivation (rec {
+  pname = "llvm";
+  inherit version;
+
+  src = runCommand "${pname}-src-${version}" {} (''
+    mkdir -p "$out"
+    cp -r ${monorepoSrc}/cmake "$out"
+    cp -r ${monorepoSrc}/${pname} "$out"
+    cp -r ${monorepoSrc}/third-party "$out"
+  '' + lib.optionalString enablePolly ''
+    chmod u+w "$out/${pname}/tools"
+    cp -r ${monorepoSrc}/polly "$out/${pname}/tools"
+  '');
+
+  sourceRoot = "${src.name}/${pname}";
+
+  outputs = [ "out" "lib" "dev" "python" ];
+
+  nativeBuildInputs = [ cmake ninja python ]
+    ++ optionals enableManpages [
+      # Note: we intentionally use `python3Packages` instead of `python3.pkgs`;
+      # splicing does *not* work with the latter. (TODO: fix)
+      python3Packages.sphinx python3Packages.recommonmark
+    ];
+
+  buildInputs = [ libxml2 libffi ]
+    ++ optional enablePFM libpfm; # exegesis
+
+  propagatedBuildInputs = [ ncurses zlib ];
+
+  nativeCheckInputs = [
+    which
+  ] ++ lib.optional stdenv.isDarwin sysctl;
+
+  patches = [
+    ./gnu-install-dirs.patch
+
+    # Running the tests involves invoking binaries (like `opt`) that depend on
+    # the LLVM dylibs and reference them by absolute install path (i.e. their
+    # nix store path).
+    #
+    # Because we have not yet run the install phase (we're running these tests
+    # as part of `checkPhase` instead of `installCheckPhase`) these absolute
+    # paths do not exist yet; to work around this we point the loader (`ld` on
+    # unix, `dyld` on macOS) at the `lib` directory which will later become this
+    # package's `lib` output.
+    #
+    # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
+    # dir but:
+    #   - this doesn't generalize well to other platforms; `lit` doesn't forward
+    #     `DYLD_LIBRARY_PATH` (macOS):
+    #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
+    #   - even if `lit` forwarded this env var, we actually cannot set
+    #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
+    #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
+    #     "protected processes" (i.e. the python interpreter that runs `lit`):
+    #     https://stackoverflow.com/a/35570229
+    #   - other LLVM subprojects deal with this issue by having their `lit`
+    #     configuration set these env vars for us; it makes sense to do the same
+    #     for LLVM:
+    #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
+    #
+    # !!! TODO: look into upstreaming this patch
+    ./llvm-lit-cfg-add-libs-to-dylib-path.patch
+
+    # `lit` has a mode where it executes run lines as a shell script which is
+    # constructs; this is problematic for macOS because it means that there's
+    # another process in between `lit` and the binaries being tested. As noted
+    # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
+    # tests fail with dyld errors.
+    #
+    # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
+    # present in the test configuration.
+    #
+    # It's not clear to me why this isn't an issue for LLVM developers running
+    # on macOS (nothing about this _seems_ nix specific)..
+    ./lit-shell-script-runner-set-dyld-library-path.patch
+  ] ++ lib.optionals enablePolly [
+    ./gnu-install-dirs-polly.patch
+
+    # Just like the `llvm-lit-cfg` patch, but for `polly`.
+    ./polly-lit-cfg-add-libs-to-dylib-path.patch
+  ];
+
+  postPatch = optionalString stdenv.isDarwin ''
+    substituteInPlace cmake/modules/AddLLVM.cmake \
+      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
+      --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
+
+    # As of LLVM 15, marked as XFAIL on arm64 macOS but lit doesn't seem to pick
+    # this up: https://github.com/llvm/llvm-project/blob/c344d97a125b18f8fed0a64aace73c49a870e079/llvm/test/MC/ELF/cfi-version.ll#L7
+    rm test/MC/ELF/cfi-version.ll
+
+    # This test tries to call `sw_vers` by absolute path (`/usr/bin/sw_vers`)
+    # and thus fails under the sandbox:
+    substituteInPlace unittests/Support/Host.cpp \
+      --replace '/usr/bin/sw_vers' "${(builtins.toString darwin.DarwinTools) + "/bin/sw_vers" }"
+  '' + optionalString (stdenv.isDarwin && stdenv.hostPlatform.isx86) ''
+    # This test tries to call the intrinsics `@llvm.roundeven.f32` and
+    # `@llvm.roundeven.f64` which seem to (incorrectly?) lower to `roundevenf`
+    # and `roundeven` on x86_64 macOS.
+    #
+    # However these functions are glibc specific so the test fails:
+    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundevenf.html
+    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundeven.html
+    #
+    # TODO(@rrbutani): this seems to run fine on `aarch64-darwin`, why does it
+    # pass there?
+    substituteInPlace test/ExecutionEngine/Interpreter/intrinsics.ll \
+      --replace "%roundeven32 = call float @llvm.roundeven.f32(float 0.000000e+00)" "" \
+      --replace "%roundeven64 = call double @llvm.roundeven.f64(double 0.000000e+00)" ""
+
+    # This test fails on darwin x86_64 because `sw_vers` reports a different
+    # macOS version than what LLVM finds by reading
+    # `/System/Library/CoreServices/SystemVersion.plist` (which is passed into
+    # the sandbox on macOS).
+    #
+    # The `sw_vers` provided by nixpkgs reports the macOS version associated
+    # with the `CoreFoundation` framework with which it was built. Because
+    # nixpkgs pins the SDK for `aarch64-darwin` and `x86_64-darwin` what
+    # `sw_vers` reports is not guaranteed to match the macOS version of the host
+    # that's building this derivation.
+    #
+    # Astute readers will note that we only _patch_ this test on aarch64-darwin
+    # (to use the nixpkgs provided `sw_vers`) instead of disabling it outright.
+    # So why does this test pass on aarch64?
+    #
+    # Well, it seems that `sw_vers` on aarch64 actually links against the _host_
+    # CoreFoundation framework instead of the nixpkgs provided one.
+    #
+    # Not entirely sure what the right fix is here. I'm assuming aarch64
+    # `sw_vers` doesn't intentionally link against the host `CoreFoundation`
+    # (still digging into how this ends up happening, will follow up) but that
+    # aside I think the more pertinent question is: should we be patching LLVM's
+    # macOS version detection logic to use `sw_vers` instead of reading host
+    # paths? This *is* a way in which details about builder machines can creep
+    # into the artifacts that are produced, affecting reproducibility, but it's
+    # not clear to me when/where/for what this even gets used in LLVM.
+    #
+    # TODO(@rrbutani): fix/follow-up
+    substituteInPlace unittests/Support/Host.cpp \
+      --replace "getMacOSHostVersion" "DISABLED_getMacOSHostVersion"
+
+    # This test fails with a `dysmutil` crash; have not yet dug into what's
+    # going on here (TODO(@rrbutani)).
+    rm test/tools/dsymutil/ARM/obfuscated.test
+  '' + ''
+    # FileSystem permissions tests fail with various special bits
+    substituteInPlace unittests/Support/CMakeLists.txt \
+      --replace "Path.cpp" ""
+    rm unittests/Support/Path.cpp
+    substituteInPlace unittests/IR/CMakeLists.txt \
+      --replace "PassBuilderCallbacksTest.cpp" ""
+    rm unittests/IR/PassBuilderCallbacksTest.cpp
+    rm test/tools/llvm-objcopy/ELF/mirror-permissions-unix.test
+  '' + optionalString stdenv.hostPlatform.isMusl ''
+    patch -p1 -i ${../../TLI-musl.patch}
+    substituteInPlace unittests/Support/CMakeLists.txt \
+      --replace "add_subdirectory(DynamicLibrary)" ""
+    rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
+    # valgrind unhappy with musl or glibc, but fails w/musl only
+    rm test/CodeGen/AArch64/wineh4.mir
+  '' + optionalString stdenv.hostPlatform.isAarch32 ''
+    # skip failing X86 test cases on 32-bit ARM
+    rm test/DebugInfo/X86/convert-debugloc.ll
+    rm test/DebugInfo/X86/convert-inlined.ll
+    rm test/DebugInfo/X86/convert-linked.ll
+    rm test/tools/dsymutil/X86/op-convert.test
+    rm test/tools/gold/X86/split-dwarf.ll
+    rm test/tools/llvm-dwarfdump/X86/prettyprint_types.s
+    rm test/tools/llvm-dwarfdump/X86/simplified-template-names.s
+
+    # !!! Note: these tests are removed in LLVM 16.
+    #
+    # See here for context: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999790443
+    rm test/CodeGen/RISCV/rv32zbp.ll
+    rm test/CodeGen/RISCV/rv64zbp.ll
+  '' + optionalString (stdenv.hostPlatform.system == "armv6l-linux") ''
+    # Seems to require certain floating point hardware (NEON?)
+    rm test/ExecutionEngine/frem.ll
+  '' + ''
+    patchShebangs test/BugPoint/compile-custom.ll.py
+  '';
+
+  preConfigure = ''
+    # Workaround for configure flags that need to have spaces
+    cmakeFlagsArray+=(
+      -DLLVM_LIT_ARGS="-svj''${NIX_BUILD_CORES} --no-progress-bar"
+    )
+  '';
+
+  # Defensive check: some paths (that we make symlinks to) depend on the release
+  # version, for example:
+  #  - https://github.com/llvm/llvm-project/blob/406bde9a15136254f2b10d9ef3a42033b3cb1b16/clang/lib/Headers/CMakeLists.txt#L185
+  #
+  # So we want to sure that the version in the source matches the release
+  # version we were given.
+  #
+  # We do this check here, in the LLVM build, because it happens early.
+  postConfigure = let
+    v = lib.versions;
+    major = v.major release_version;
+    minor = v.minor release_version;
+    patch = v.patch release_version;
+  in ''
+    # $1: part, $2: expected
+    check_version() {
+      part="''${1^^}"
+      part="$(cat include/llvm/Config/llvm-config.h  | grep "#define LLVM_VERSION_''${part} " | cut -d' ' -f3)"
+
+      if [[ "$part" != "$2" ]]; then
+        echo >&2 \
+          "mismatch in the $1 version! we have version ${release_version}" \
+          "and expected the $1 version to be '$2'; the source has '$part' instead"
+        exit 3
+      fi
+    }
+
+    check_version major ${major}
+    check_version minor ${minor}
+    check_version patch ${patch}
+  '';
+
+  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
+  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
+
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/cmake/llvm"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
+    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
+    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
+    "-DLLVM_ENABLE_FFI=ON"
+    "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
+    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
+    "-DLLVM_ENABLE_DUMP=ON"
+  ] ++ optionals stdenv.hostPlatform.isStatic [
+    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
+    "-DLLVM_ENABLE_PIC=OFF"
+    "-DLLVM_BUILD_STATIC=ON"
+    "-DLLVM_LINK_LLVM_DYLIB=off"
+    # libxml2 needs to be disabled because the LLVM build system ignores its .la
+    # file and doesn't link zlib as well.
+    # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
+    "-DLLVM_ENABLE_LIBXML2=OFF"
+  ] ++ optionals enableManpages [
+    "-DLLVM_BUILD_DOCS=ON"
+    "-DLLVM_ENABLE_SPHINX=ON"
+    "-DSPHINX_OUTPUT_MAN=ON"
+    "-DSPHINX_OUTPUT_HTML=OFF"
+    "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+  ] ++ optionals (!isDarwin) [
+    "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
+  ] ++ optionals isDarwin [
+    "-DLLVM_ENABLE_LIBCXX=ON"
+    "-DCAN_TARGET_i386=false"
+  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "-DCMAKE_CROSSCOMPILING=True"
+    "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
+    (
+      let
+        nativeCC = pkgsBuildBuild.targetPackages.stdenv.cc;
+        nativeBintools = nativeCC.bintools.bintools;
+        nativeToolchainFlags = [
+          "-DCMAKE_C_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}cc"
+          "-DCMAKE_CXX_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}c++"
+          "-DCMAKE_AR=${nativeBintools}/bin/${nativeBintools.targetPrefix}ar"
+          "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
+          "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
+        ];
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
+    )
+  ];
+
+  postInstall = ''
+    mkdir -p $python/share
+    mv $out/share/opt-viewer $python/share/opt-viewer
+    moveToOutput "bin/llvm-config*" "$dev"
+    substituteInPlace "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
+      --replace "\''${_IMPORT_PREFIX}/lib/lib" "$lib/lib/lib" \
+      --replace "$out/bin/llvm-config" "$dev/bin/llvm-config"
+    substituteInPlace "$dev/lib/cmake/llvm/LLVMConfig.cmake" \
+      --replace 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}")' 'set(LLVM_BINARY_DIR "'"$lib"'")'
+  ''
+  + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
+    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
+    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
+  ''
+  + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+    cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
+  '';
+
+  inherit doCheck;
+
+  checkTarget = "check-all";
+
+  # For the update script:
+  passthru.monorepoSrc = monorepoSrc;
+
+  requiredSystemFeatures = [ "big-parallel" ];
+  meta = llvm_meta // {
+    homepage = "https://llvm.org/";
+    description = "A collection of modular and reusable compiler and toolchain technologies";
+    longDescription = ''
+      The LLVM Project is a collection of modular and reusable compiler and
+      toolchain technologies. Despite its name, LLVM has little to do with
+      traditional virtual machines. The name "LLVM" itself is not an acronym; it
+      is the full name of the project.
+      LLVM began as a research project at the University of Illinois, with the
+      goal of providing a modern, SSA-based compilation strategy capable of
+      supporting both static and dynamic compilation of arbitrary programming
+      languages. Since then, LLVM has grown to be an umbrella project consisting
+      of a number of subprojects, many of which are being used in production by
+      a wide variety of commercial and open source projects as well as being
+      widely used in academic research. Code in the LLVM project is licensed
+      under the "Apache 2.0 License with LLVM exceptions".
+    '';
+  };
+} // lib.optionalAttrs enableManpages {
+  pname = "llvm-manpages";
+
+  propagatedBuildInputs = [];
+
+  ninjaFlags = [ "docs-llvm-man" ];
+  installTargets = [ "install-docs-llvm-man" ];
+
+  postPatch = null;
+  postInstall = null;
+
+  outputs = [ "out" ];
+
+  doCheck = false;
+
+  meta = llvm_meta // {
+    description = "man pages for LLVM ${version}";
+  };
+})
diff --git a/pkgs/development/compilers/llvm/15/llvm/gnu-install-dirs-polly.patch b/pkgs/development/compilers/llvm/15/llvm/gnu-install-dirs-polly.patch
new file mode 100644
index 0000000000000..b01363e98aa00
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/llvm/gnu-install-dirs-polly.patch
@@ -0,0 +1,19 @@
+This is the one remaining Polly install dirs related change that hasn't made it
+into upstream yet; previously this patch file also included:
+https://reviews.llvm.org/D117541
+
+diff --git a/tools/polly/cmake/polly_macros.cmake b/tools/polly/cmake/polly_macros.cmake
+index 518a09b45a42..bd9d6f5542ad 100644
+--- a/tools/polly/cmake/polly_macros.cmake
++++ b/tools/polly/cmake/polly_macros.cmake
+@@ -44,8 +44,8 @@ macro(add_polly_library name)
+   if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY OR ${name} STREQUAL "LLVMPolly")
+     install(TARGETS ${name}
+       EXPORT LLVMExports
+-      LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-      ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX})
++	  LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
++      ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
+   endif()
+   set_property(GLOBAL APPEND PROPERTY LLVM_EXPORTS ${name})
+ endmacro(add_polly_library)
diff --git a/pkgs/development/compilers/llvm/15/llvm/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/15/llvm/gnu-install-dirs.patch
new file mode 100644
index 0000000000000..0ef317af8cc75
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/llvm/gnu-install-dirs.patch
@@ -0,0 +1,138 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 45399dc0537e..5d946e9e6583 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -942,7 +942,7 @@ if (NOT TENSORFLOW_AOT_PATH STREQUAL "")
+   add_subdirectory(${TENSORFLOW_AOT_PATH}/xla_aot_runtime_src
+     ${CMAKE_ARCHIVE_OUTPUT_DIRECTORY}/tf_runtime)
+   install(TARGETS tf_xla_runtime EXPORT LLVMExports
+-    ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX} COMPONENT tf_xla_runtime)
++    ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX} COMPONENT tf_xla_runtime)
+   set_property(GLOBAL APPEND PROPERTY LLVM_EXPORTS tf_xla_runtime)
+   # Once we add more modules, we should handle this more automatically.
+   if (DEFINED LLVM_OVERRIDE_MODEL_HEADER_INLINERSIZEMODEL)
+diff --git a/cmake/modules/AddLLVM.cmake b/cmake/modules/AddLLVM.cmake
+index 057431208322..56f0dcb258da 100644
+--- a/cmake/modules/AddLLVM.cmake
++++ b/cmake/modules/AddLLVM.cmake
+@@ -844,8 +844,8 @@ macro(add_llvm_library name)
+       get_target_export_arg(${name} LLVM export_to_llvmexports ${umbrella})
+       install(TARGETS ${name}
+               ${export_to_llvmexports}
+-              LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX} COMPONENT ${name}
+-              ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX} COMPONENT ${name}
++              LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}" COMPONENT ${name}
++              ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}" COMPONENT ${name}
+               RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" COMPONENT ${name})
+ 
+       if (NOT LLVM_ENABLE_IDE)
+@@ -2007,7 +2007,7 @@ function(llvm_install_library_symlink name dest type)
+   set(full_name ${CMAKE_${type}_LIBRARY_PREFIX}${name}${CMAKE_${type}_LIBRARY_SUFFIX})
+   set(full_dest ${CMAKE_${type}_LIBRARY_PREFIX}${dest}${CMAKE_${type}_LIBRARY_SUFFIX})
+ 
+-  set(output_dir lib${LLVM_LIBDIR_SUFFIX})
++  set(output_dir ${CMAKE_INSTALL_FULL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
+   if(WIN32 AND "${type}" STREQUAL "SHARED")
+     set(output_dir "${CMAKE_INSTALL_BINDIR}")
+   endif()
+@@ -2271,15 +2271,15 @@ function(llvm_setup_rpath name)
+ 
+   if (APPLE)
+     set(_install_name_dir INSTALL_NAME_DIR "@rpath")
+-    set(_install_rpath "@loader_path/../lib${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
++    set(_install_rpath "@loader_path/../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
+   elseif(${CMAKE_SYSTEM_NAME} MATCHES "AIX" AND BUILD_SHARED_LIBS)
+     # $ORIGIN is not interpreted at link time by aix ld.
+     # Since BUILD_SHARED_LIBS is only recommended for use by developers,
+     # hardcode the rpath to build/install lib dir first in this mode.
+     # FIXME: update this when there is better solution.
+-    set(_install_rpath "${LLVM_LIBRARY_OUTPUT_INTDIR}" "${CMAKE_INSTALL_PREFIX}/lib${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
++    set(_install_rpath "${LLVM_LIBRARY_OUTPUT_INTDIR}" "${CMAKE_INSTALL_FULL_LIBDIR}${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
+   elseif(UNIX)
+-    set(_install_rpath "\$ORIGIN/../lib${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
++    set(_install_rpath "\$ORIGIN/../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
+     if(${CMAKE_SYSTEM_NAME} MATCHES "(FreeBSD|DragonFly)")
+       set_property(TARGET ${name} APPEND_STRING PROPERTY
+                    LINK_FLAGS " -Wl,-z,origin ")
+diff --git a/cmake/modules/AddOCaml.cmake b/cmake/modules/AddOCaml.cmake
+index 891c9e6d618c..8d963f3b0069 100644
+--- a/cmake/modules/AddOCaml.cmake
++++ b/cmake/modules/AddOCaml.cmake
+@@ -147,9 +147,9 @@ function(add_ocaml_library name)
+   endforeach()
+ 
+   if( APPLE )
+-    set(ocaml_rpath "@executable_path/../../../lib${LLVM_LIBDIR_SUFFIX}")
++    set(ocaml_rpath "@executable_path/../../../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
+   elseif( UNIX )
+-    set(ocaml_rpath "\\$ORIGIN/../../../lib${LLVM_LIBDIR_SUFFIX}")
++    set(ocaml_rpath "\\$ORIGIN/../../../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
+   endif()
+   list(APPEND ocaml_flags "-ldopt" "-Wl,-rpath,${ocaml_rpath}")
+ 
+diff --git a/cmake/modules/CMakeLists.txt b/cmake/modules/CMakeLists.txt
+index d4b0ab959148..26ed981fd09f 100644
+--- a/cmake/modules/CMakeLists.txt
++++ b/cmake/modules/CMakeLists.txt
+@@ -128,7 +128,7 @@ set(LLVM_CONFIG_INCLUDE_DIRS
+   )
+ list(REMOVE_DUPLICATES LLVM_CONFIG_INCLUDE_DIRS)
+ 
+-extend_path(LLVM_CONFIG_LIBRARY_DIR "\${LLVM_INSTALL_PREFIX}" "lib\${LLVM_LIBDIR_SUFFIX}")
++extend_path(LLVM_CONFIG_LIBRARY_DIR "\${LLVM_INSTALL_PREFIX}" "${CMAKE_INSTALL_LIBDIR}\${LLVM_LIBDIR_SUFFIX}")
+ set(LLVM_CONFIG_LIBRARY_DIRS
+   "${LLVM_CONFIG_LIBRARY_DIR}"
+   # FIXME: Should there be other entries here?
+diff --git a/docs/CMake.rst b/docs/CMake.rst
+index 879b7b231d4c..9c31d14e8950 100644
+--- a/docs/CMake.rst
++++ b/docs/CMake.rst
+@@ -250,7 +250,7 @@ description is in `LLVM-related variables`_ below.
+ **LLVM_LIBDIR_SUFFIX**:STRING
+   Extra suffix to append to the directory where libraries are to be
+   installed. On a 64-bit architecture, one could use ``-DLLVM_LIBDIR_SUFFIX=64``
+-  to install libraries to ``/usr/lib64``.
++  to install libraries to ``/usr/lib64``. See also ``CMAKE_INSTALL_LIBDIR``.
+ 
+ **LLVM_PARALLEL_{COMPILE,LINK}_JOBS**:STRING
+   Building the llvm toolchain can use a lot of resources, particularly
+@@ -284,6 +284,10 @@ manual, or execute ``cmake --help-variable VARIABLE_NAME``.
+   The path to install executables, relative to the *CMAKE_INSTALL_PREFIX*.
+   Defaults to "bin".
+ 
++**CMAKE_INSTALL_LIBDIR**:PATH
++  The path to install libraries, relative to the *CMAKE_INSTALL_PREFIX*.
++  Defaults to "lib".
++
+ **CMAKE_INSTALL_INCLUDEDIR**:PATH
+   The path to install header files, relative to the *CMAKE_INSTALL_PREFIX*.
+   Defaults to "include".
+diff --git a/tools/llvm-config/BuildVariables.inc.in b/tools/llvm-config/BuildVariables.inc.in
+index 370005cd8d7d..7e790bc52111 100644
+--- a/tools/llvm-config/BuildVariables.inc.in
++++ b/tools/llvm-config/BuildVariables.inc.in
+@@ -23,6 +23,7 @@
+ #define LLVM_CXXFLAGS "@LLVM_CXXFLAGS@"
+ #define LLVM_BUILDMODE "@LLVM_BUILDMODE@"
+ #define LLVM_LIBDIR_SUFFIX "@LLVM_LIBDIR_SUFFIX@"
++#define LLVM_INSTALL_LIBDIR "@CMAKE_INSTALL_LIBDIR@"
+ #define LLVM_INSTALL_INCLUDEDIR "@CMAKE_INSTALL_INCLUDEDIR@"
+ #define LLVM_INSTALL_PACKAGE_DIR "@LLVM_INSTALL_PACKAGE_DIR@"
+ #define LLVM_TARGETS_BUILT "@LLVM_TARGETS_BUILT@"
+diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
+index 2c6c55f89d38..f6d2068a0827 100644
+--- a/tools/llvm-config/llvm-config.cpp
++++ b/tools/llvm-config/llvm-config.cpp
+@@ -369,7 +369,11 @@ int main(int argc, char **argv) {
+       sys::fs::make_absolute(ActivePrefix, Path);
+       ActiveBinDir = std::string(Path.str());
+     }
+-    ActiveLibDir = ActivePrefix + "/lib" + LLVM_LIBDIR_SUFFIX;
++    {
++      SmallString<256> Path(LLVM_INSTALL_LIBDIR LLVM_LIBDIR_SUFFIX);
++      sys::fs::make_absolute(ActivePrefix, Path);
++      ActiveLibDir = std::string(Path.str());
++    }
+     {
+       SmallString<256> Path(LLVM_INSTALL_PACKAGE_DIR);
+       sys::fs::make_absolute(ActivePrefix, Path);
diff --git a/pkgs/development/compilers/llvm/15/llvm/lit-shell-script-runner-set-dyld-library-path.patch b/pkgs/development/compilers/llvm/15/llvm/lit-shell-script-runner-set-dyld-library-path.patch
new file mode 100644
index 0000000000000..32f1d13a9dc23
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/llvm/lit-shell-script-runner-set-dyld-library-path.patch
@@ -0,0 +1,26 @@
+diff --git a/utils/lit/lit/TestRunner.py b/utils/lit/lit/TestRunner.py
+index 0242e0b75af3..d732011306f7 100644
+--- a/utils/lit/lit/TestRunner.py
++++ b/utils/lit/lit/TestRunner.py
+@@ -1029,6 +1029,12 @@ def executeScript(test, litConfig, tmpBase, commands, cwd):
+             f.write('@echo off\n')
+         f.write('\n@if %ERRORLEVEL% NEQ 0 EXIT\n'.join(commands))
+     else:
++        # This env var is *purged* when invoking subprocesses so we have to
++        # manually set it from within the bash script in order for the commands
++        # in run lines to see this var:
++        if "DYLD_LIBRARY_PATH" in test.config.environment:
++            f.write(f'export DYLD_LIBRARY_PATH="{test.config.environment["DYLD_LIBRARY_PATH"]}"\n')
++
+         for i, ln in enumerate(commands):
+             match = re.match(kPdbgRegex, ln)
+             if match:
+@@ -1363,7 +1369,7 @@ def applySubstitutions(script, substitutions, conditions={},
+         return processed
+ 
+     process = processLine if recursion_limit is None else processLineToFixedPoint
+-    
++
+     return [unescapePercents(process(ln)) for ln in script]
+ 
+ 
diff --git a/pkgs/development/compilers/llvm/15/llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch b/pkgs/development/compilers/llvm/15/llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
new file mode 100644
index 0000000000000..d824516c0a16c
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
@@ -0,0 +1,79 @@
+diff --git a/test/Unit/lit.cfg.py b/test/Unit/lit.cfg.py
+index 81e8dc04acea..479ff95681e2 100644
+--- a/test/Unit/lit.cfg.py
++++ b/test/Unit/lit.cfg.py
+@@ -3,6 +3,7 @@
+ # Configuration file for the 'lit' test runner.
+ 
+ import os
++import platform
+ import subprocess
+ 
+ import lit.formats
+@@ -55,3 +56,26 @@ if sys.platform in ['win32', 'cygwin'] and os.path.isdir(config.shlibdir):
+ # Win32 may use %SYSTEMDRIVE% during file system shell operations, so propogate.
+ if sys.platform == 'win32' and 'SYSTEMDRIVE' in os.environ:
+     config.environment['SYSTEMDRIVE'] = os.environ['SYSTEMDRIVE']
++
++# Add the LLVM dynamic libs to the platform-specific loader search path env var:
++#
++# TODO: this is copied from `clang`'s `lit.cfg.py`; should unify..
++def find_shlibpath_var():
++    if platform.system() in ['Linux', 'FreeBSD', 'NetBSD', 'OpenBSD', 'SunOS']:
++        yield 'LD_LIBRARY_PATH'
++    elif platform.system() == 'Darwin':
++        yield 'DYLD_LIBRARY_PATH'
++    elif platform.system() == 'Windows':
++        yield 'PATH'
++    elif platform.system() == 'AIX':
++        yield 'LIBPATH'
++
++for shlibpath_var in find_shlibpath_var():
++    shlibpath = os.path.pathsep.join(
++        (config.shlibdir,
++         config.environment.get(shlibpath_var, '')))
++    config.environment[shlibpath_var] = shlibpath
++    break
++else:
++    lit_config.warning("unable to inject shared library path on '{}'"
++                       .format(platform.system()))
+diff --git a/test/lit.cfg.py b/test/lit.cfg.py
+index 75a38b4c5dad..856fc75c9d74 100644
+--- a/test/lit.cfg.py
++++ b/test/lit.cfg.py
+@@ -42,6 +42,26 @@ llvm_config.with_environment('PATH', config.llvm_tools_dir, append_path=True)
+ llvm_config.with_system_environment(
+     ['HOME', 'INCLUDE', 'LIB', 'TMP', 'TEMP'])
+ 
++# Add the LLVM dynamic libs to the platform-specific loader search path env var:
++#
++# TODO: this is copied from `clang`'s `lit.cfg.py`; should unify..
++def find_shlibpath_var():
++    if platform.system() in ['Linux', 'FreeBSD', 'NetBSD', 'OpenBSD', 'SunOS']:
++        yield 'LD_LIBRARY_PATH'
++    elif platform.system() == 'Darwin':
++        yield 'DYLD_LIBRARY_PATH'
++    elif platform.system() == 'Windows':
++        yield 'PATH'
++    elif platform.system() == 'AIX':
++        yield 'LIBPATH'
++
++for shlibpath_var in find_shlibpath_var():
++    shlibpath = config.llvm_shlib_dir
++    llvm_config.with_environment(shlibpath_var, shlibpath, append_path = True)
++    break
++else:
++    lit_config.warning("unable to inject shared library path on '{}'"
++                       .format(platform.system()))
+ 
+ # Set up OCAMLPATH to include newly built OCaml libraries.
+ top_ocaml_lib = os.path.join(config.llvm_lib_dir, 'ocaml')
+@@ -318,7 +338,7 @@ def have_cxx_shared_library():
+ 
+     try:
+         readobj_cmd = subprocess.Popen(
+-            [readobj_exe, '--needed-libs', readobj_exe], stdout=subprocess.PIPE)
++            [readobj_exe, '--needed-libs', readobj_exe], stdout=subprocess.PIPE, env=config.environment)
+     except OSError:
+         print('could not exec llvm-readobj')
+         return False
diff --git a/pkgs/development/compilers/llvm/15/llvm/polly-lit-cfg-add-libs-to-dylib-path.patch b/pkgs/development/compilers/llvm/15/llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
new file mode 100644
index 0000000000000..1354ad267314a
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
@@ -0,0 +1,24 @@
+diff --git a/tools/polly/test/lit.cfg b/tools/polly/test/lit.cfg
+index 41e3a589c61e..09f3b17498b0 100644
+--- a/tools/polly/test/lit.cfg
++++ b/tools/polly/test/lit.cfg
+@@ -36,9 +36,17 @@ base_paths = [config.llvm_tools_dir, config.environment['PATH']]
+ path = os.path.pathsep.join(base_paths + config.extra_paths)
+ config.environment['PATH'] = path
+ 
++# (Copied from polly/test/Unit/lit.cfg)
++if platform.system() == 'Darwin':
++    shlibpath_var = 'DYLD_LIBRARY_PATH'
++elif platform.system() == 'Windows':
++    shlibpath_var = 'PATH'
++else:
++    shlibpath_var = 'LD_LIBRARY_PATH'
++
+ path = os.path.pathsep.join((config.llvm_libs_dir,
+-                              config.environment.get('LD_LIBRARY_PATH','')))
+-config.environment['LD_LIBRARY_PATH'] = path
++                              config.environment.get(shlibpath_var,'')))
++config.environment[shlibpath_var] = path
+ 
+ llvm_config.use_default_substitutions()
+ 
diff --git a/pkgs/development/compilers/llvm/15/openmp/default.nix b/pkgs/development/compilers/llvm/15/openmp/default.nix
new file mode 100644
index 0000000000000..8047cb1122dee
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/openmp/default.nix
@@ -0,0 +1,71 @@
+{ lib
+, stdenv
+, llvm_meta
+, monorepoSrc
+, runCommand
+, cmake
+, ninja
+, llvm
+, targetLlvm
+, lit
+, clang-unwrapped
+, perl
+, pkg-config
+, xcbuild
+, version
+}:
+
+stdenv.mkDerivation rec {
+  pname = "openmp";
+  inherit version;
+
+  src = runCommand "${pname}-src-${version}" {} ''
+    mkdir -p "$out"
+    cp -r ${monorepoSrc}/cmake "$out"
+    cp -r ${monorepoSrc}/${pname} "$out"
+  '';
+
+  sourceRoot = "${src.name}/${pname}";
+
+  patches = [
+    ./fix-find-tool.patch
+    ./gnu-install-dirs.patch
+    ./run-lit-directly.patch
+  ];
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [ cmake ninja perl pkg-config lit ];
+  buildInputs = [
+    (if stdenv.buildPlatform == stdenv.hostPlatform then llvm else targetLlvm)
+  ];
+
+  nativeCheckInputs = lib.optional stdenv.hostPlatform.isDarwin xcbuild.xcrun;
+
+  # Unsup:Pass:XFail:Fail
+  # 26:267:16:8
+  doCheck = false;
+  checkTarget = "check-openmp";
+
+  preCheck = ''
+    patchShebangs ../tools/archer/tests/deflake.bash
+  '';
+
+  cmakeFlags = [
+    "-DCLANG_TOOL=${clang-unwrapped}/bin/clang"
+    "-DOPT_TOOL=${llvm}/bin/opt"
+    "-DLINK_TOOL=${llvm}/bin/llvm-link"
+  ];
+
+  meta = llvm_meta // {
+    homepage = "https://openmp.llvm.org/";
+    description = "Support for the OpenMP language";
+    longDescription = ''
+      The OpenMP subproject of LLVM contains the components required to build an
+      executable OpenMP program that are outside the compiler itself.
+      Contains the code for the runtime library against which code compiled by
+      "clang -fopenmp" must be linked before it can run and the library that
+      supports offload to target devices.
+    '';
+  };
+}
diff --git a/pkgs/development/compilers/llvm/15/openmp/fix-find-tool.patch b/pkgs/development/compilers/llvm/15/openmp/fix-find-tool.patch
new file mode 100644
index 0000000000000..103b054ed1763
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/openmp/fix-find-tool.patch
@@ -0,0 +1,18 @@
+diff --git a/libomptarget/DeviceRTL/CMakeLists.txt b/libomptarget/DeviceRTL/CMakeLists.txt
+index ce66214822a2..6ab7b33c95da 100644
+--- a/libomptarget/DeviceRTL/CMakeLists.txt
++++ b/libomptarget/DeviceRTL/CMakeLists.txt
+@@ -27,10 +27,10 @@ endif()
+ if (LLVM_DIR)
+   # Builds that use pre-installed LLVM have LLVM_DIR set.
+   # A standalone or LLVM_ENABLE_RUNTIMES=openmp build takes this route
+-  find_program(CLANG_TOOL clang PATHS ${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH)
++  find_program(CLANG_TOOL clang PATHS ${LLVM_TOOLS_BINARY_DIR})
+   find_program(LINK_TOOL llvm-link PATHS ${LLVM_TOOLS_BINARY_DIR}
+-    NO_DEFAULT_PATH)
+-  find_program(OPT_TOOL opt PATHS ${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH)
++    )
++  find_program(OPT_TOOL opt PATHS ${LLVM_TOOLS_BINARY_DIR})
+   if ((NOT CLANG_TOOL) OR (NOT LINK_TOOL) OR (NOT OPT_TOOL))
+     libomptarget_say("Not building DeviceRTL. Missing clang: ${CLANG_TOOL}, llvm-link: ${LINK_TOOL} or opt: ${OPT_TOOL}")
+     return()
diff --git a/pkgs/development/compilers/llvm/15/openmp/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/15/openmp/gnu-install-dirs.patch
new file mode 100644
index 0000000000000..77a93208832a1
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/openmp/gnu-install-dirs.patch
@@ -0,0 +1,22 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index b6ddbe90516d..311ab1d50e7f 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -29,7 +29,7 @@ if (OPENMP_STANDALONE_BUILD)
+   set(OPENMP_LIBDIR_SUFFIX "" CACHE STRING
+     "Suffix of lib installation directory, e.g. 64 => lib64")
+   # Do not use OPENMP_LIBDIR_SUFFIX directly, use OPENMP_INSTALL_LIBDIR.
+-  set(OPENMP_INSTALL_LIBDIR "lib${OPENMP_LIBDIR_SUFFIX}")
++  set(OPENMP_INSTALL_LIBDIR "${CMAKE_INSTALL_LIBDIR}${OPENMP_LIBDIR_SUFFIX}")
+ 
+   # Group test settings.
+   set(OPENMP_TEST_C_COMPILER ${CMAKE_C_COMPILER} CACHE STRING
+@@ -40,7 +40,7 @@ if (OPENMP_STANDALONE_BUILD)
+ else()
+   set(OPENMP_ENABLE_WERROR ${LLVM_ENABLE_WERROR})
+   # If building in tree, we honor the same install suffix LLVM uses.
+-  set(OPENMP_INSTALL_LIBDIR "lib${LLVM_LIBDIR_SUFFIX}")
++  set(OPENMP_INSTALL_LIBDIR "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
+ 
+   if (NOT MSVC)
+     set(OPENMP_TEST_C_COMPILER ${LLVM_RUNTIME_OUTPUT_INTDIR}/clang)
diff --git a/pkgs/development/compilers/llvm/15/openmp/run-lit-directly.patch b/pkgs/development/compilers/llvm/15/openmp/run-lit-directly.patch
new file mode 100644
index 0000000000000..1e952fdc36a8f
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/openmp/run-lit-directly.patch
@@ -0,0 +1,12 @@
+diff --git a/cmake/OpenMPTesting.cmake b/cmake/OpenMPTesting.cmake
+--- a/cmake/OpenMPTesting.cmake
++++ b/cmake/OpenMPTesting.cmake
+@@ -185,7 +185,7 @@ function(add_openmp_testsuite target comment)
+   if (${OPENMP_STANDALONE_BUILD})
+     set(LIT_ARGS ${OPENMP_LIT_ARGS} ${ARG_ARGS})
+     add_custom_target(${target}
+-      COMMAND ${PYTHON_EXECUTABLE} ${OPENMP_LLVM_LIT_EXECUTABLE} ${LIT_ARGS} ${ARG_UNPARSED_ARGUMENTS}
++      COMMAND ${OPENMP_LLVM_LIT_EXECUTABLE} ${LIT_ARGS} ${ARG_UNPARSED_ARGUMENTS}
+       COMMENT ${comment}
+       DEPENDS ${ARG_DEPENDS}
+       USES_TERMINAL
diff --git a/pkgs/development/libraries/gnome-desktop/default.nix b/pkgs/development/libraries/gnome-desktop/default.nix
index 6b58b171f7d3e..fd58e6b77ad28 100644
--- a/pkgs/development/libraries/gnome-desktop/default.nix
+++ b/pkgs/development/libraries/gnome-desktop/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-desktop";
-  version = "43";
+  version = "43.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-desktop/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-PW4VMxdIYVdZaqOAL4dnZBTFcHOPRQqUoEH+iDVCCmk=";
+    sha256 = "sha256-Mq+NvD2afVg1aafw1/GPlYGNXbnuj5LZEjpkexXqyMc=";
   };
 
   patches = lib.optionals stdenv.isLinux [
diff --git a/pkgs/development/libraries/quantlib/default.nix b/pkgs/development/libraries/quantlib/default.nix
new file mode 100644
index 0000000000000..d2cda30b5da7d
--- /dev/null
+++ b/pkgs/development/libraries/quantlib/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, boost
+}:
+
+stdenv.mkDerivation rec {
+  pname = "quantlib";
+  version = "1.29";
+
+  outputs = [ "out" "dev" ];
+
+  src = fetchFromGitHub {
+    owner = "lballabio";
+    repo = "QuantLib";
+    rev = "QuantLib-v${version}";
+    sha256 = "sha256-TpVn3zPru/GtdNqDH45YdOkm7fkJzv/qay9SY3J6Jiw=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ boost ];
+
+  meta = with lib; {
+    description = "A free/open-source library for quantitative finance";
+    homepage = "https://quantlib.org";
+    platforms = platforms.unix;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ candyc1oud ];
+  };
+}
diff --git a/pkgs/development/python-modules/cvss/default.nix b/pkgs/development/python-modules/cvss/default.nix
index e9d42e4535f5c..9f4979c53265c 100644
--- a/pkgs/development/python-modules/cvss/default.nix
+++ b/pkgs/development/python-modules/cvss/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "cvss";
-  version = "2.5";
+  version = "2.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "RedHatProductSecurity";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-6S646cvm+UwdpRGOtCuNijWcUxhZD6IG407hNBz+NA4=";
+    sha256 = "sha256-gD9MreJQPaxziy02Wt3BGFiIoQ/+pW3KqiNfNlTijJY=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/googlemaps/default.nix b/pkgs/development/python-modules/googlemaps/default.nix
index 162cda76f4e34..d2e67e4676e79 100644
--- a/pkgs/development/python-modules/googlemaps/default.nix
+++ b/pkgs/development/python-modules/googlemaps/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "googlemaps";
-  version = "4.9.0";
+  version = "4.10.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.5";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "googlemaps";
     repo = "google-maps-services-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Ji9GDVQdDmneOcjrmfaG84HJNCz4igHJQmnwk9xiUlM=";
+    hash = "sha256-8oGZEMKUGaDHKq4qIZy10cbLNMmVclJnQE/dx877pNQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/loguru/default.nix b/pkgs/development/python-modules/loguru/default.nix
index 70476a4b8900f..f89741e527af2 100644
--- a/pkgs/development/python-modules/loguru/default.nix
+++ b/pkgs/development/python-modules/loguru/default.nix
@@ -4,31 +4,29 @@
 , buildPythonPackage
 , colorama
 , fetchpatch
-, fetchPypi
+, fetchFromGitHub
+, freezegun
+, mypy
 , pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "loguru";
-  version = "0.6.0";
+  # No release since Jan 2022, only master is compatible with Python 3.11
+  # https://github.com/Delgan/loguru/issues/740
+  version = "unstable-2023-01-20";
   format = "setuptools";
 
   disabled = pythonOlder "3.5";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-BmvQZ1jQpRPpg2/ZxrWnW/s/02hB9LmWvGC1R6MJ1Bw=";
+  src = fetchFromGitHub {
+    owner = "Delgan";
+    repo = pname;
+    rev = "07f94f3c8373733119f85aa8b9ca05ace3325a4b";
+    hash = "sha256-lMGyQbBX3z6186ojs/iew7JMrG91ivPA679T9r+7xYw=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fix-test-repr-infinite-recursion.patch";
-      url = "https://github.com/Delgan/loguru/commit/4fe21f66991abeb1905e24c3bc3c634543d959a2.patch";
-      hash = "sha256-NUOkgUS28TOazO0txMinFtaKwsi/J1Y7kqjjvMRCnR8=";
-    })
-  ];
-
   propagatedBuildInputs = lib.optionals (pythonOlder "3.7") [
     aiocontextvars
   ];
@@ -36,19 +34,15 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     colorama
+    freezegun
+    mypy
   ];
 
   disabledTestPaths = lib.optionals stdenv.isDarwin [
     "tests/test_multiprocessing.py"
   ];
 
-  disabledTests = [
-    "test_time_rotation_reopening"
-    "test_file_buffering"
-    # Tests are failing with Python 3.10
-    "test_exception_others"
-    ""
-  ] ++ lib.optionals stdenv.isDarwin [
+  disabledTests = lib.optionals stdenv.isDarwin [
     "test_rotation_and_retention"
     "test_rotation_and_retention_timed_file"
     "test_renaming"
diff --git a/pkgs/development/python-modules/lxmf/default.nix b/pkgs/development/python-modules/lxmf/default.nix
index e3a061b637839..ab0edb676f5b4 100644
--- a/pkgs/development/python-modules/lxmf/default.nix
+++ b/pkgs/development/python-modules/lxmf/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "lxmf";
-  version = "0.2.9";
+  version = "0.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "lxmf";
     rev = "refs/tags/${version}";
-    hash = "sha256-etmQNUjxrJeRRWy2znkJ0slbODiRrTB/bABGFB1e9xc=";
+    hash = "sha256-9dvWm5FnqNkcILeY7qkRESk/iLlNEChs24RniRXtsNM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/notify-py/default.nix b/pkgs/development/python-modules/notify-py/default.nix
index d2d21ab09b6e3..61c1c9026e0be 100644
--- a/pkgs/development/python-modules/notify-py/default.nix
+++ b/pkgs/development/python-modules/notify-py/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "notify-py";
-  version = "0.3.39";
+  version = "0.3.42";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "ms7m";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-QIK5MCCOsD8SStoh7TRw+l9k28SjChwV2J/T7gMKnAs=";
+    hash = "sha256-XtjJImH9UwPPZS/Yqs8S5xGXOLBRmJRawzxWXoPWvrM=";
   };
 
   patches = lib.optionals stdenv.isLinux [
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index 0e6a82bab6a7e..38e06d362d934 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "11.0.0";
+  version = "11.0.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XWJlhbpOyEuAmnjOCYDe0LEtWckwi38rZv6KBydFgfM=";
+    hash = "sha256-SU8vsKwZio/5UD2SMhLenfkBjXRuMZCPo2k6+1hx8Y4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/prefixed/default.nix b/pkgs/development/python-modules/prefixed/default.nix
index 373a5d090d0ed..9b0efcad461ea 100644
--- a/pkgs/development/python-modules/prefixed/default.nix
+++ b/pkgs/development/python-modules/prefixed/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "prefixed";
-  version = "0.6.0";
+  version = "0.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-s5+/rHJhj6HutbP9ntE0HxDdkN91SZy0w4psPvR83ZQ=";
+    hash = "sha256-C1TRXmAuuK9Kwxsdsho36pXOWJDgdBuw3Z3tSTzvu+k=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/pylutron/default.nix b/pkgs/development/python-modules/pylutron/default.nix
index 4bf56d5e6edc5..e394986163715 100644
--- a/pkgs/development/python-modules/pylutron/default.nix
+++ b/pkgs/development/python-modules/pylutron/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "pylutron";
-  version = "0.2.9";
+  version = "0.2.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-xy5XPNOrvdPZMCfa2MYA+xtUcFdGSurW5QYL6H7n2VI=";
+    sha256 = "sha256-DKwjBQXC7O/8bFxq5shJJxRV3HYgBeS7tJXg4m3vQMY=";
   };
 
   # Project has no tests
diff --git a/pkgs/development/python-modules/pytibber/default.nix b/pkgs/development/python-modules/pytibber/default.nix
index e993567569eaf..3a595a2d301aa 100644
--- a/pkgs/development/python-modules/pytibber/default.nix
+++ b/pkgs/development/python-modules/pytibber/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pytibber";
-  version = "0.26.11";
+  version = "0.27.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "pyTibber";
     rev = "refs/tags/${version}";
-    hash = "sha256-FVbp7FYTzoNuwROdvKGzSnVN5nAp1hboyzNMhAu6YDY=";
+    hash = "sha256-m4y65UiuiWRS7EBv6AFnX9Ia2eTy8H1vgfx+fQrcXz4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/cocogitto/default.nix b/pkgs/development/tools/cocogitto/default.nix
index af3a32bb9d69b..e4217f06e22a9 100644
--- a/pkgs/development/tools/cocogitto/default.nix
+++ b/pkgs/development/tools/cocogitto/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cocogitto";
-  version = "5.3.0";
+  version = "5.3.1";
 
   src = fetchFromGitHub {
     owner = "oknozor";
     repo = pname;
     rev = version;
-    sha256 = "sha256-BqyV4hJw7H9yN5Kj/XwhYS6hElXdKUJEUi5M/PNlPO0=";
+    sha256 = "sha256-Z0snC5NomUWzxI2qcRMxdZbC1aOQ8P2Ll9EdVfhP7ZU=";
   };
 
-  cargoHash = "sha256-MA3XW2tPn0qVx7ve+UqCoG4nQ7UyuvXEebrPuLKqS4g=";
+  cargoHash = "sha256-P/xwE3oLVsIoxPmG+S0htSHhZxCj79z2ARGe2WzWCEo=";
 
   # Test depend on git configuration that would likly exist in a normal user enviroment
   # and might be failing to create the test repository it works in.
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index 929c76e7e2cac..aee57689308f6 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -3,7 +3,7 @@
 , runCommand, pkg-config, meson, ninja, makeWrapper
 # build+runtime deps.
 , knot-dns, luajitPackages, libuv, gnutls, lmdb
-, systemd, libcap_ng, dns-root-data, nghttp2 # optionals, in principle
+, jemalloc, systemd, libcap_ng, dns-root-data, nghttp2 # optionals, in principle
 # test-only deps.
 , cmocka, which, cacert
 , extraFeatures ? false /* catch-all if defaults aren't enough */
@@ -17,11 +17,11 @@ lua = luajitPackages;
 
 unwrapped = stdenv.mkDerivation rec {
   pname = "knot-resolver";
-  version = "5.5.3";
+  version = "5.6.0";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-resolver/${pname}-${version}.tar.xz";
-    sha256 = "a38f57c68b7d237d662784d8406e6098aad66a148f44dcf498d1e9664c5fed2d";
+    sha256 = "0c82ae937b685dc477fb3176098e3dc106c898b7cd83553e5bc54dccb83c80d7";
   };
 
   outputs = [ "out" "dev" ];
@@ -63,7 +63,7 @@ unwrapped = stdenv.mkDerivation rec {
   # http://knot-resolver.readthedocs.io/en/latest/build.html#requirements
   buildInputs = [ knot-dns lua.lua libuv gnutls lmdb ]
     ++ optionals stdenv.isLinux [ /*lib*/systemd libcap_ng ]
-    ++ [ nghttp2 ]
+    ++ [ jemalloc nghttp2 ]
     ## optional dependencies; TODO: dnstap
     ;
 
@@ -71,6 +71,7 @@ unwrapped = stdenv.mkDerivation rec {
     "-Dkeyfile_default=${dns-root-data}/root.ds"
     "-Droot_hints=${dns-root-data}/root.hints"
     "-Dinstall_kresd_conf=disabled" # not really useful; examples are inside share/doc/
+    "-Dmalloc=jemalloc"
     "--default-library=static" # not used by anyone
   ]
   ++ optional doInstallCheck "-Dunit_tests=enabled"
diff --git a/pkgs/tools/admin/syft/default.nix b/pkgs/tools/admin/syft/default.nix
index 104365de5d41e..30e61e00522fe 100644
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "0.66.2";
+  version = "0.68.1";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-CIFK4XIYpRK9CJOwQUV6kRGU++iWJCdMBR7v6xh0iaY=";
+    sha256 = "sha256-iOJnSeVRAjmJblaipmk05J9BvAkYgyS1OA8b3xDykXc=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -22,7 +22,7 @@ buildGoModule rec {
   };
   # hash mismatch with darwin
   proxyVendor = true;
-  vendorHash = "sha256-ttvfzlSFgh0xQ0W/ftLeSrJNOzg7Iq1qdLgflGy7N8Q=";
+  vendorHash = "sha256-5erZB2CoXVfIK0jYEe0HmdZaeLKLAqOiKi8QAQQFVKU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/audio/vgmtools/default.nix b/pkgs/tools/audio/vgmtools/default.nix
index 9571e1160666b..e0a14a82124cb 100644
--- a/pkgs/tools/audio/vgmtools/default.nix
+++ b/pkgs/tools/audio/vgmtools/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vgmtools";
-  version = "unstable-2022-12-30";
+  version = "unstable-2023-01-27";
 
   src = fetchFromGitHub {
     owner = "vgmrips";
     repo = "vgmtools";
-    rev = "6c2c21dfc871f8cb9c33a77fe7db01419b6ad97d";
-    sha256 = "qe8cHGf8X7JjjoiRQ/S3q/WhyvgrMEwsCo7QoQkmg5w=";
+    rev = "fc55484b5902191e5467e6044bb90c1c74a0c938";
+    sha256 = "Ho0yYoe1TIlVxMauz/harP1xSw42wdcklj/O6fA+VEk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/licensor/default.nix b/pkgs/tools/misc/licensor/default.nix
index 510a169f21506..8a81286eebbe6 100644
--- a/pkgs/tools/misc/licensor/default.nix
+++ b/pkgs/tools/misc/licensor/default.nix
@@ -17,14 +17,10 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1h66d1brx441bg7vzbqdish4avgmc6h7rrkw2qf1siwmplwqqhw0";
 
-  patches = [
-    # Support for 2022, https://github.com/raftario/licensor/pull/68
-    (fetchpatch {
-      name = "support-for-2022.patch";
-      url = "https://github.com/raftario/licensor/commit/6b2f248e5ad9e454fe30d71397691e47ac69b19e.patch";
-      sha256 = "sha256-kXiY5s2kuU+ibV3RpBoy7y3cmJU+gECBTsmRXWBOTP8=";
-    })
-  ];
+  # https://github.com/raftario/licensor/issues/67
+  postPatch = ''
+    sed "/Copyright (c) 2021/s/2021/$(date +%Y)/" -i tests/integration.rs
+  '';
 
   meta = with lib; {
     description = "Write licenses to stdout";
diff --git a/pkgs/tools/misc/yutto/default.nix b/pkgs/tools/misc/yutto/default.nix
index d246eb29b6144..b132125d928b7 100644
--- a/pkgs/tools/misc/yutto/default.nix
+++ b/pkgs/tools/misc/yutto/default.nix
@@ -9,14 +9,14 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "yutto";
-  version = "2.0.0b16";
+  version = "2.0.0b18";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-aGmayZGXmEyVuUKDKrgcYuPKsib/c5ou5CZ+Sag6Evk=";
+    hash = "sha256-BuubfySQfw4ljWTc1yyW4Zqle0VTimFLQ6enZA3joeQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/s3rs/default.nix b/pkgs/tools/networking/s3rs/default.nix
index f8c52cdc43ce5..cb73eaf6b59da 100644
--- a/pkgs/tools/networking/s3rs/default.nix
+++ b/pkgs/tools/networking/s3rs/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "s3rs";
-  version = "0.4.16";
+  version = "0.4.19";
 
   src = fetchFromGitHub {
     owner = "yanganto";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-n95ejw6EZ4zXzP16xFoUkVn1zIMcVgINy7m5NOz063A=";
+    sha256 = "sha256-mJ1bMfv/HY74TknpRvu8RIs1d2VlNreEVtHCtQSHQw8=";
   };
 
-  cargoSha256 = "sha256-eecQi03w7lq3VAsv9o+3kulwhAXPoxuDPMu/ZCQEom4=";
+  cargoHash = "sha256-Q1EqEyNxWIx3wD8zuU7/MO3Qz6zsfBZbtT/IIUmJccE=";
 
   nativeBuildInputs = [ python3 perl pkg-config ];
   buildInputs = [ openssl ]
diff --git a/pkgs/tools/package-management/apk-tools/default.nix b/pkgs/tools/package-management/apk-tools/default.nix
index c923b5a05824f..db114d6b98f3d 100644
--- a/pkgs/tools/package-management/apk-tools/default.nix
+++ b/pkgs/tools/package-management/apk-tools/default.nix
@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   pname = "apk-tools";
-  version = "2.12.10";
+  version = "2.12.11";
 
   src = fetchFromGitLab {
     domain = "gitlab.alpinelinux.org";
     owner = "alpine";
     repo = "apk-tools";
     rev = "v${version}";
-    sha256 = "sha256-VKgnnrEG1cx4cx6StWh+XaCe5meSU9LqZRH1ElMQkfk=";
+    sha256 = "sha256-vhEjzCuMvMZmzkCQK25JG3tT33KnX2fJbqdaTaeuhgo=";
   };
 
   nativeBuildInputs = [ pkg-config scdoc ]
diff --git a/pkgs/tools/system/automatic-timezoned/default.nix b/pkgs/tools/system/automatic-timezoned/default.nix
index 829bd30e4e941..ea3f03161dbb9 100644
--- a/pkgs/tools/system/automatic-timezoned/default.nix
+++ b/pkgs/tools/system/automatic-timezoned/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "1.0.57";
+  version = "1.0.60";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Wb7X4eDG9vZLJF5b9JPb0JVjQgstFo7Zr1MnidKcuZI=";
+    sha256 = "sha256-6p9hLbU5ZaA4o6PRyfSt/gb3D3XeeWacJ2LlpJ0+w18=";
   };
 
-  cargoHash = "sha256-BcIGaAGTwm8QBvrL7J91asNEpnFdsgDtRPDSWdE9JHI=";
+  cargoHash = "sha256-COWvEfFQMi3ltQSEFK3S6y07YLqqtjAf2H4p0TX/U70=";
 
   meta = with lib; {
     description = "Automatically update system timezone based on location";
diff --git a/pkgs/tools/system/clinfo/default.nix b/pkgs/tools/system/clinfo/default.nix
index a9e7c0c81def5..746f83690e7dd 100644
--- a/pkgs/tools/system/clinfo/default.nix
+++ b/pkgs/tools/system/clinfo/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clinfo";
-  version = "3.0.21.02.21";
+  version = "3.0.23.01.25";
 
   src = fetchFromGitHub {
     owner = "Oblomov";
     repo = "clinfo";
     rev = version;
-    sha256 = "sha256-0ijfbfv1F6mnt1uFH/A4yOADJoAFrPMa3yAOFJW53ek=";
+    sha256 = "sha256-1jZP4SnLIHh3vQJLBp+j/eQ1c8XBGFR2hjYxflhpWAU=";
   };
 
   buildInputs = lib.optionals (!stdenv.isDarwin) [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5b96f138f847f..21635140ebbf6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13983,6 +13983,7 @@ with pkgs;
   clang_12 = llvmPackages_12.clang;
   clang_13 = llvmPackages_13.clang;
   clang_14 = llvmPackages_14.clang;
+  clang_15 = llvmPackages_15.clang;
 
   clang-tools = callPackage ../development/tools/clang-tools {
     llvmPackages = llvmPackages_latest;
@@ -14028,6 +14029,10 @@ with pkgs;
     llvmPackages = llvmPackages_14;
   };
 
+  clang-tools_15 = callPackage ../development/tools/clang-tools {
+    llvmPackages = llvmPackages_15;
+  };
+
   clang-analyzer = callPackage ../development/tools/analysis/clang-analyzer {
     llvmPackages = llvmPackages_latest;
     inherit (llvmPackages_latest) clang;
@@ -15010,6 +15015,7 @@ with pkgs;
   lld_12 = llvmPackages_12.lld;
   lld_13 = llvmPackages_13.lld;
   lld_14 = llvmPackages_14.lld;
+  lld_15 = llvmPackages_15.lld;
 
   lldb = llvmPackages_latest.lldb;
   lldb_5 = llvmPackages_5.lldb;
@@ -15022,6 +15028,7 @@ with pkgs;
   lldb_12 = llvmPackages_12.lldb;
   lldb_13 = llvmPackages_13.lldb;
   lldb_14 = llvmPackages_14.lldb;
+  lldb_15 = llvmPackages_15.lldb;
 
   llvm = llvmPackages.llvm;
   llvm_5  = llvmPackages_5.llvm;
@@ -15034,6 +15041,7 @@ with pkgs;
   llvm_12 = llvmPackages_12.llvm;
   llvm_13 = llvmPackages_13.llvm;
   llvm_14 = llvmPackages_14.llvm;
+  llvm_15 = llvmPackages_15.llvm;
 
   libllvm = llvmPackages.libllvm;
   llvm-manpages = llvmPackages.llvm-manpages;
@@ -15128,6 +15136,13 @@ with pkgs;
     targetLlvm = targetPackages.llvmPackages_14.llvm or llvmPackages_14.llvm;
   }));
 
+  llvmPackages_15 = recurseIntoAttrs (callPackage ../development/compilers/llvm/15 ({
+    inherit (stdenvAdapters) overrideCC;
+    buildLlvmTools = buildPackages.llvmPackages_15.tools;
+    targetLlvmLibraries = targetPackages.llvmPackages_15.libraries or llvmPackages_15.libraries;
+    targetLlvm = targetPackages.llvmPackages_15.llvm or llvmPackages_15.llvm;
+  }));
+
   llvmPackages_latest = llvmPackages_14;
 
   llvmPackages_rocm = recurseIntoAttrs (callPackage ../development/compilers/llvm/rocm { });
@@ -22699,6 +22714,8 @@ with pkgs;
 
   quark-engine = callPackage ../tools/security/quark-engine { };
 
+  quantlib = callPackage ../development/libraries/quantlib { };
+
   quesoglc = callPackage ../development/libraries/quesoglc { };
 
   quickder = callPackage ../development/libraries/quickder {};