Fixes #352907

Changes: https://github.com/libgit2/libgit2/releases/tag/v1.8.4

…51258)

This one fails when tests are run with too many cores.

Closes: #353176

… true;`

Replaces / Closes #353131

A while ago `postgresql` switched to using structured attrs[1]. In the
PR it was reported that this made postgresql notably slower when
importing SQL dumps[2].

After a bit of debugging it turned out that the hardening was entirely
missing and the following combination of settings was the culprit:

    hardeningEnable = [ "pie" ];
    __structuredAttrs = true;

I.e. the combination of custom hardening settings and structured attrs.

What happened here is that internally the default and enabled hardening
flags get written into `NIX_HARDENING_ENABLE`. However, the value is a list
and the setting is not in the `env` section. This means that in the
structured-attrs case we get something like

    declare -ax NIX_HARDENING_ENABLE=([0]="bindnow" [1]="format" [2]="fortify" [3]="fortify3" [4]="pic" [5]="relro" [6]="stackprotector" [7]="strictoverflow" [8]="zerocallusedregs" [9]="pie")

i.e. an actual array rather than a string with all hardening flags being
space-separated which is what the hardening code of the cc-wrapper
expects[3].

This only happens if `hardeningEnable` or `hardeningDisable` are
explicitly set by a derivation: if none of those are set,
`NIX_HARDENING_ENABLE` won't be set by `stdenv.mkDerivation` and the
default hardening flags are configured by the setup hook of the
cc-wrapper[4].

In other words, this _only_ applies to derivations that have both custom
hardening settings _and_ `__structuredAttrs = true;`.

All values of `NIX_HARDENING_ENABLE` are well-known, so we don't have to
worry about escaping issues. Just forcing it to a string by
concatenating the list everytime solves the issue without additional
issues like eval errors when inheriting `env` from a structuredAttrs
derivation[5]. The price we're paying is a full rebuild.

[1] #294504
[2] #294504 (comment)
[3] https://github.com/NixOS/nixpkgs/blob/cf3e5d3744dc26c3498aa5dadfa0e078c632cede/pkgs/build-support/cc-wrapper/add-hardening.sh#L9
[4] https://github.com/NixOS/nixpkgs/blob/cf3e5d3744dc26c3498aa5dadfa0e078c632cede/pkgs/build-support/cc-wrapper/setup-hook.sh#L114
[5] 1e84a7f

This was changed for `qtbase` in
3be309e, but affects Qt WebEngine
as well.

The codesign binary is part of the bootstrapTools and is incompatible
with the version required by the compiler_rt build. Remove
find_program(.., codesign) from the cmake files to prevent the build
from using and then breaking due to an incompatible codesign

after
llvm/llvm-project@0b06727
clang_19 will produce errors if the function label comes after
.cfi_starproc. Vendor upstream commit
libffi/libffi@8308bed
to fix the issue

remove unused and incomplete function

file is part of the final stdenv and llvm_19 requires it for tests. add
file to the path to the early stage stdenv's for the upcoming switch to
llvm_19

#340162 introduced `autoPatchelfHook` as it's own top-level attribute.
This also made it use the Nixpkgs Python build infrastructure, which relies on dependency propagation, leaking Python as a dependency into many builds erroneously.

This change uses a `withPackages` constructed environment instead, and manually patches the script shebangs, not triggering the `buildPython*` dependency propagation mechanism

… true;` (#353142)

Rewriting SDK paths is only needed when a text-based stub is an umbrella
framework that does not include the contents of the stubs for the
libraries re-exported by the framework. This is only the case for older
SDKs. Once macOS introduced the dyld cache (and removed system dylibs)
in 11.0, all umbrella frameworks in the SDK include the contents of
their re-exported stubs.

While rewriting newer SDKs is mostly harmless, it breaks Zig, which
tries to interpret the paths relative to the SDKROOT.

https://gitlab.com/ita1024/waf/blob/waf-2.1.3/ChangeLog

Pylons/pastedeploy@3.0.1...3.1

Changes: https://chromium.googlesource.com/webm/libvpx/+/refs/tags/v1.15.0

Changes: https://gitlab.com/graphviz/graphviz/-/blob/12.2.0/CHANGELOG.md?ref_type=tags

This works around #291, halfway.

Without the change the build of `pkgsi686Linux.swtpm` fails on
filesystems with 64-bit inodes as:

   FAIL: test_parameters
   FAIL: test_swtpm_setup_file_backend
   FAIL: test_swtpm_setup_overwrite
   FAIL: test_tpm2_swtpm_setup_create_cert
   FAIL: test_tpm2_swtpm_setup_overwrite
   FAIL: test_swtpm_setup_create_cert
   FAIL: test_tpm2_parameters

Make the interation across pythonRelaxDeps and pythonRemoveDeps work
regardless of __structuredAttrs.

Ignore SC2164 at this moment, as it will be gone when adding `set -e`.