push sheeet

pkgs/development/tools/alloy/default.nix

@@ -0,0 +1,83 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  jre,
+  makeWrapper,
+  makeDesktopItem,
+}:
+
+let
+  generic =
+    { version, sha256 }:
+    stdenv.mkDerivation rec {
+      pname = "alloy${lib.versions.major version}";
+      inherit version;
+
+      src = fetchurl {
+        inherit sha256;
+        url = "https://github.com/AlloyTools/org.alloytools.alloy/releases/download/v${version}/org.alloytools.alloy.dist.jar";
+      };
+
+      desktopItem = makeDesktopItem rec {
+        name = pname;
+        exec = name;
+        icon = name;
+        desktopName = "Alloy ${lib.versions.major version}";
+        genericName = "Relational modelling tool";
+        comment = meta.description;
+        categories = [
+          "Development"
+          "IDE"
+          "Education"
+        ];
+      };
+
+      nativeBuildInputs = [ makeWrapper ];
+
+      buildCommand = ''
+        jar=$out/share/alloy/${pname}.jar
+        install -Dm644 $src $jar
+
+        mkdir -p $out/bin
+        makeWrapper ${jre}/bin/java $out/bin/${pname} --add-flags \
+          "-jar $jar"
+
+        install -Dm644 ${./icon.png} $out/share/pixmaps/${pname}.png
+        cp -r ${desktopItem}/share/applications $out/share
+      '';
+
+      meta = with lib; {
+        description = "Language & tool for relational models";
+        longDescription = ''
+          Alloy is a language for describing structures and a tool for exploring
+          them. An Alloy model is a collection of constraints that describes a set
+          of structures, e.g. all the possible security configurations of a web
+          application, or all the possible topologies of a switching network. The
+          Alloy Analyzer is a solver that takes the constraints of a model and
+          finds structures that satisfy them. Structures are displayed graphically,
+          and their appearance can be customized for the domain at hand.
+        '';
+        homepage = "https://alloytools.org/";
+        downloadPage = "https://alloytools.org/download.html";
+        sourceProvenance = with sourceTypes; [ binaryBytecode ];
+        license = licenses.mit;
+        platforms = platforms.unix;
+        maintainers = with maintainers; [ notbandali ];
+      };
+    };
+
+in
+rec {
+  alloy5 = generic {
+    version = "5.1.0";
+    sha256 = "sha256-o7Q+jsmWeUeuotUQG9lrPE6w2B6z3Ju6QcyWSTScaQo=";
+  };
+
+  alloy6 = generic {
+    version = "6.2.0";
+    sha256 = "sha256-a4wctbyTvt/HxhQ1xOGrbmiKJC3HAqOUYo2amAHtt40=";
+  };
+
+  alloy = alloy5;
+}

pkgs/development/tools/ammonite/default.nix

@@ -0,0 +1,104 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  jre,
+  writeScript,
+  common-updater-scripts,
+  git,
+  nix,
+  coreutils,
+  gnused,
+  disableRemoteLogging ? true,
+}:
+
+let
+  repo = "git@github.com:lihaoyi/Ammonite.git";
+
+  common =
+    { scalaVersion, sha256 }:
+    stdenv.mkDerivation rec {
+      pname = "ammonite";
+      version = "3.0.2";
+
+      src = fetchurl {
+        url = "https://github.com/lihaoyi/Ammonite/releases/download/${version}/${scalaVersion}-${version}";
+        inherit sha256;
+      };
+
+      dontUnpack = true;
+
+      installPhase = ''
+        install -Dm755 $src $out/bin/amm
+        sed -i '0,/java/{s|java|${jre}/bin/java|}' $out/bin/amm
+      ''
+      + lib.optionalString disableRemoteLogging ''
+        sed -i "0,/ammonite.Main/{s|ammonite.Main'|ammonite.Main' --no-remote-logging|}" $out/bin/amm
+        sed -i '1i #!/bin/sh' $out/bin/amm
+      '';
+
+      passthru = {
+
+        updateScript = writeScript "update.sh" ''
+          #!${stdenv.shell}
+          set -o errexit
+          PATH=${
+            lib.makeBinPath [
+              common-updater-scripts
+              coreutils
+              git
+              gnused
+              nix
+            ]
+          }
+          oldVersion="$(nix-instantiate --eval -E "with import ./. {}; lib.getVersion ${pname}" | tr -d '"')"
+          latestTag="$(git -c 'versionsort.suffix=-' ls-remote --exit-code --refs --sort='version:refname' --tags ${repo} '*.*.*' | tail --lines=1 | cut --delimiter='/' --fields=3)"
+          if [ "$oldVersion" != "$latestTag" ]; then
+            update-source-version ${pname}_2_12 "$latestTag" --version-key=version --print-changes
+            sed -i "s|$latestTag|$oldVersion|g" "$(git rev-parse --show-toplevel)/pkgs/development/tools/ammonite/default.nix"
+            update-source-version ${pname}_2_13 "$latestTag" --version-key=version --print-changes
+          else
+            echo "${pname} is already up-to-date"
+          fi
+        '';
+      };
+
+      doInstallCheck = true;
+      installCheckPhase = ''
+        runHook preInstallCheck
+
+        $out/bin/amm -h "$PWD" -c 'val foo = 21; println(foo * 2)' | grep 42
+
+        runHook postInstallCheck
+      '';
+
+      meta = with lib; {
+        description = "Improved Scala REPL";
+        longDescription = ''
+          The Ammonite-REPL is an improved Scala REPL, re-implemented from first principles.
+          It is much more featureful than the default REPL and comes
+          with a lot of ergonomic improvements and configurability
+          that may be familiar to people coming from IDEs or other REPLs such as IPython or Zsh.
+        '';
+        homepage = "https://github.com/com-lihaoyi/Ammonite";
+        license = licenses.mit;
+        maintainers = [ maintainers.nequissimus ];
+        mainProgram = "amm";
+        platforms = platforms.all;
+      };
+    };
+in
+{
+  ammonite_2_12 = common {
+    scalaVersion = "2.12";
+    sha256 = "sha256-wPVvLMuc8EjTqaHY4VcP1gd4DVJQhQm0uS2f+HFuTls=";
+  };
+  ammonite_2_13 = common {
+    scalaVersion = "2.13";
+    sha256 = "sha256-OU3lAls2n4dMONIogg/qAFj5OhzqR6rBF3Hay4Onwxg=";
+  };
+  ammonite_3_3 = common {
+    scalaVersion = "3.3";
+    sha256 = "sha256-M1Pg+HsWSkk60NUzNQXxOijnfFxX5ijao76Phaz7ykQ=";
+  };
+}

pkgs/development/tools/analysis/binlore/default.nix

@@ -0,0 +1,257 @@
+{
+  lib,
+  fetchFromGitHub,
+  runCommand,
+  yallback,
+  yara,
+}:
+
+/*
+  TODO/CAUTION:
+
+  I don't want to discourage use, but I'm not sure how stable
+  the API is. Have fun, but be prepared to track changes! :)
+
+  For _now_, binlore is basically a thin wrapper around
+  `<invoke yara> | <postprocess with yallback>` with support
+  for running it on a derivation, saving the result in the
+  store, and aggregating results from a set of packages.
+
+  In the longer term, I suspect there are more uses for this
+  general pattern (i.e., run some analysis tool that produces
+  a deterministic output and cache the result per package...).
+
+  I'm not sure how that'll look and if it'll be the case that
+  binlore automatically collects all of them, or if you'll be
+  configuring which "kind(s)" of lore it generates. Nailing
+  that down will almost certainly mean reworking the API.
+*/
+
+let
+  src = fetchFromGitHub {
+    owner = "abathur";
+    repo = "binlore";
+    rev = "v0.3.0";
+    hash = "sha256-4Fs6HThfDhKRskuDJx2+hucl8crMRm10K6949JdIwPY=";
+  };
+  /*
+    binlore has one one more yallbacks responsible for
+    routing the appropriate lore to a named file in the
+    appropriate format. At some point I might try to do
+    something fancy with this, but for now the answer to
+    *all* questions about the lore are: the bare minimum
+    to get resholve over the next feature hump in time to
+    hopefully slip this feature in before the branch-off.
+  */
+  # TODO: feeling really uninspired on the API
+  loreDef = {
+    # YARA rule file
+    rules = (src + "/execers.yar");
+    # output filenames; "types" of lore
+    types = [
+      "execers"
+      "wrappers"
+    ];
+    # shell rule callbacks; see github.com/abathur/yallback
+    yallback = (src + "/execers.yall");
+    # TODO:
+    # - echo for debug, can be removed at some point
+    # - I really just wanted to put the bit after the pipe
+    #   in here, but I'm erring on the side of flexibility
+    #   since this form will make it easier to pilot other
+    #   uses of binlore.
+    callback = lore: drv: ''
+      if [[ -d "${drv}/bin" ]] || [[ -d "${drv}/lib" ]] || [[ -d "${drv}/libexec" ]]; then
+        echo generating binlore for $drv by running:
+        echo "${yara}/bin/yara --scan-list --recursive ${lore.rules} <(printf '%s\n' ${drv}/{bin,lib,libexec}) | ${yallback}/bin/yallback ${lore.yallback}"
+      else
+        echo "failed to generate binlore for $drv (none of ${drv}/{bin,lib,libexec} exist)"
+      fi
+
+      if [[ -d "${drv}/bin" ]] || [[ -d "${drv}/lib" ]] || [[ -d "${drv}/libexec" ]]; then
+        ${yara}/bin/yara --scan-list --recursive ${lore.rules} <(printf '%s\n' ${drv}/{bin,lib,libexec}) | ${yallback}/bin/yallback ${lore.yallback}
+      fi
+    '';
+  };
+
+in
+rec {
+  /*
+    Output a directory containing lore for multiple drvs.
+
+    This will `make` lore for drv in drvs and then combine lore
+    of the same type across all packages into a single file.
+
+    When drvs are also specified in the strip argument, corresponding
+    lore is made relative by stripping the path of each drv from
+    matching entries. (This is mainly useful in a build process that
+    uses a chain of two or more derivations where the output of one
+    is the source for the next. See resholve for an example.)
+  */
+  collect =
+    {
+      lore ? loreDef,
+      drvs,
+      strip ? [ ],
+    }:
+    (runCommand "more-binlore" { } ''
+      mkdir $out
+      for lorefile in ${toString lore.types}; do
+        cat ${
+          lib.concatMapStrings (x: x + "/$lorefile ") (
+            map (make lore) (map lib.getBin (builtins.filter lib.isDerivation drvs))
+          )
+        } > $out/$lorefile
+        substituteInPlace $out/$lorefile ${lib.concatMapStrings (x: "--replace-quiet '${x}/' '' ") strip}
+      done
+    '');
+
+  /*
+    Output a directory containing lore for a single drv.
+
+    This produces lore for the derivation (via lore.callback) and
+    appends any lore that the derivation itself wrote to nix-support
+    or which was overridden in drv.binlore.<outputName> (passthru).
+
+    > *Note*: Since the passthru is attached to all outputs, binlore
+    > is an attrset namespaced by outputName to support packages with
+    > executables in more than one output.
+
+    Since the last entry wins, the effective priority is:
+    drv.binlore.<outputName> > $drv/nix-support > lore generated here by callback
+  */
+  make =
+    lore: drv:
+    runCommand "${drv.name}-binlore"
+      {
+        drv = drv;
+      }
+      (
+        ''
+          mkdir $out
+          touch $out/{${builtins.concatStringsSep "," lore.types}}
+
+          ${lore.callback lore drv}
+        ''
+        +
+          # append lore from package's $out and drv.binlore.${drv.outputName} (last entry wins)
+          ''
+            for lore_type in ${toString lore.types}; do
+              if [[ -f "${drv}/nix-support/$lore_type" ]]; then
+                cat "${drv}/nix-support/$lore_type" >> "$out/$lore_type"
+              fi
+          ''
+        +
+          lib.optionalString (builtins.hasAttr "binlore" drv && builtins.hasAttr drv.outputName drv.binlore)
+            ''
+              if [[ -f "${drv.binlore."${drv.outputName}"}/$lore_type" ]]; then
+                cat "${drv.binlore."${drv.outputName}"}/$lore_type" >> "$out/$lore_type"
+              fi
+            ''
+        + ''
+          done
+
+          echo binlore for $drv written to $out
+        ''
+      );
+
+  /*
+    Utility function for creating override lore for drv.
+
+    We normally attach this lore to `drv.passthru.binlore.<outputName>`.
+
+    > *Notes*:
+    > - Since the passthru is attached to all outputs, binlore is an
+    >   attrset namespaced by outputName to support packages with
+    >   executables in more than one output. You'll generally just use
+    >   `out` or `bin`.
+    > - We can reconsider the passthru attr name if someone adds
+    >   a new lore provider. We settled on `.binlore` for now to make it
+    >   easier for people to figure out what this is for.
+
+    The lore argument should be a Shell script (string) that generates
+    the necessary lore. You can use arbitrary Shell, but this function
+    includes a shell DSL you can use to declare/generate lore in most
+    cases. It has the following functions:
+
+    - `execer <verdict> [<path>...]`
+    - `wrapper <wrapper_path> <original_path>`
+
+    Writing every override explicitly in a Nix list would be tedious
+    for large packages, but this small shell DSL enables us to express
+    many overrides efficiently via pathname expansion/globbing.
+
+    Here's a very general example of both functions:
+
+    passthru.binlore.out = binlore.synthesize finalAttrs.finalPackage ''
+      execer can bin/hello bin/{a,b,c}
+      wrapper bin/hello bin/.hello-wrapped
+    '';
+
+    And here's a specific example of how pathname expansion enables us
+    to express lore for the single-binary variant of coreutils while
+    being both explicit and (somewhat) efficient:
+
+    passthru = {} // optionalAttrs (singleBinary != false) {
+      binlore.out = binlore.synthesize coreutils ''
+        execer can bin/{chroot,env,install,nice,nohup,runcon,sort,split,stdbuf,timeout}
+        execer cannot bin/{[,b2sum,base32,base64,basename,basenc,cat,chcon,chgrp,chmod,chown,cksum,comm,cp,csplit,cut,date,dd,df,dir,dircolors,dirname,du,echo,expand,expr,factor,false,fmt,fold,groups,head,hostid,id,join,kill,link,ln,logname,ls,md5sum,mkdir,mkfifo,mknod,mktemp,mv,nl,nproc,numfmt,od,paste,pathchk,pinky,pr,printenv,printf,ptx,pwd,readlink,realpath,rm,rmdir,seq,sha1sum,sha224sum,sha256sum,sha384sum,sha512sum,shred,shuf,sleep,stat,stty,sum,sync,tac,tail,tee,test,touch,tr,true,truncate,tsort,tty,uname,unexpand,uniq,unlink,uptime,users,vdir,wc,who,whoami,yes}
+      '';
+    };
+
+    Caution: Be thoughtful about using a bare wildcard (*) glob here.
+    We should generally override lore only when a human understands if
+    the executable will exec arbitrary user-passed executables. A bare
+    glob can match new executables added in future package versions
+    before anyone can audit them.
+  */
+  synthesize =
+    drv: loreSynthesizingScript:
+    runCommand "${drv.name}-lore-override"
+      {
+        drv = drv;
+      }
+      (
+        ''
+          execer(){
+            local verdict="$1"
+
+            shift
+
+            for path in "$@"; do
+              if [[ -f "$PWD/$path" ]]; then
+                echo "$verdict:$PWD/$path"
+              else
+                echo "error: Tried to synthesize execer lore for missing file: $PWD/$path" >&2
+                exit 2
+              fi
+            done
+          } >> $out/execers
+
+          wrapper(){
+            local wrapper="$1"
+            local original="$2"
+
+            if [[ ! -f "$wrapper" ]]; then
+              echo "error: Tried to synthesize wrapper lore for missing wrapper: $PWD/$wrapper" >&2
+              exit 2
+            fi
+
+            if [[ ! -f "$original" ]]; then
+              echo "error: Tried to synthesize wrapper lore for missing original: $PWD/$original" >&2
+              exit 2
+            fi
+
+            echo "$PWD/$wrapper:$PWD/$original"
+
+          } >> $out/wrappers
+
+          mkdir $out
+
+          # lore override commands are relative to the drv root
+          cd $drv
+
+        ''
+        + loreSynthesizingScript
+      );
+}

pkgs/development/tools/analysis/clang-analyzer/0001-Fix-scan-build-to-use-NIX_CFLAGS_COMPILE.patch

@@ -0,0 +1,35 @@
+From 99a7e55a60c8d96e160f9104a3dd31b7914d3488 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Fri, 31 Jul 2020 09:22:03 +0100
+Subject: [PATCH] Fix scan-build to use NIX_CFLAGS_COMPILE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
+---
+ clang/tools/scan-build/libexec/ccc-analyzer | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/clang/tools/scan-build/libexec/ccc-analyzer
+b/clang/tools/scan-build/libexec/ccc-analyzer
+index ed0d4d3d73f3..2d5113435ca5 100755
+--- a/clang/tools/scan-build/libexec/ccc-analyzer
++++ b/clang/tools/scan-build/libexec/ccc-analyzer
+@@ -249,6 +249,14 @@ sub Analyze {
+       push @Args, "-target", $AnalyzerTarget;
+     }
+ 
++    # Add Nix flags to analysis
++    if (defined $ENV{'NIX_CFLAGS_COMPILE'}) {
++      my @nixArgs = split(/\s+/, $ENV{'NIX_CFLAGS_COMPILE'});
++      foreach my $nixArg (@nixArgs) {
++        push @Args, $nixArg;
++      }
++    }
++
+     my $AnalysisArgs = GetCCArgs($HtmlDir, "--analyze", \@Args);
+     @CmdArgs = @$AnalysisArgs;
+   }
+-- 
+2.33.0

pkgs/development/tools/analysis/clang-analyzer/default.nix

@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  clang,
+  llvmPackages,
+  perl,
+  makeWrapper,
+  python3,
+}:
+
+stdenv.mkDerivation {
+  pname = "clang-analyzer";
+  inherit (llvmPackages.clang-unwrapped) src version;
+
+  patches = [ ./0001-Fix-scan-build-to-use-NIX_CFLAGS_COMPILE.patch ];
+  buildInputs = [
+    clang
+    llvmPackages.clang
+    perl
+    python3
+  ];
+  nativeBuildInputs = [ makeWrapper ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/share/scan-view $out/bin
+    cp -R clang/tools/scan-view/share/* $out/share/scan-view
+    cp -R clang/tools/scan-view/bin/* $out/bin/scan-view
+    cp -R clang/tools/scan-build/* $out
+
+    rm $out/bin/*.bat $out/libexec/*.bat $out/CMakeLists.txt
+
+    wrapProgram $out/bin/scan-build \
+      --add-flags "--use-cc=${clang}/bin/clang" \
+      --add-flags "--use-c++=${clang}/bin/clang++" \
+      --add-flags "--use-analyzer='${llvmPackages.clang}/bin/clang'"
+  '';
+
+  meta = {
+    description = "Clang Static Analyzer";
+    longDescription = ''
+      The Clang Static Analyzer is a source code analysis tool that finds bugs
+      in C, C++, and Objective-C programs.
+    '';
+    homepage = "https://clang-analyzer.llvm.org/";
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.unix;
+    maintainers = [ lib.maintainers.thoughtpolice ];
+  };
+}

pkgs/development/tools/analysis/clazy/default.nix

@@ -0,0 +1,68 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  llvmPackages,
+  cmake,
+  makeWrapper,
+  versionCheckHook,
+  gitUpdater,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "clazy";
+  version = "1.15";
+
+  src = fetchFromGitHub {
+    owner = "KDE";
+    repo = "clazy";
+    tag = finalAttrs.version;
+    hash = "sha256-i/tqH2RHU+LwvMFI8ft92j0i04mQxLVIyrGXlqzMGWs=";
+  };
+
+  buildInputs = [
+    llvmPackages.llvm
+    llvmPackages.libclang
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    makeWrapper
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/clazy \
+      --suffix PATH               : "${llvmPackages.clang}/bin/"                            \
+      --suffix CPATH              : "$(<${llvmPackages.clang}/nix-support/libc-cflags)"     \
+      --suffix CPATH              : "${llvmPackages.clang}/resource-root/include"           \
+      --suffix CPLUS_INCLUDE_PATH : "$(<${llvmPackages.clang}/nix-support/libcxx-cxxflags)" \
+      --suffix CPLUS_INCLUDE_PATH : "$(<${llvmPackages.clang}/nix-support/libc-cflags)"     \
+      --suffix CPLUS_INCLUDE_PATH : "${llvmPackages.clang}/resource-root/include"
+
+    wrapProgram $out/bin/clazy-standalone \
+      --suffix CPATH              : "$(<${llvmPackages.clang}/nix-support/libc-cflags)"     \
+      --suffix CPATH              : "${llvmPackages.clang}/resource-root/include"           \
+      --suffix CPLUS_INCLUDE_PATH : "$(<${llvmPackages.clang}/nix-support/libcxx-cxxflags)" \
+      --suffix CPLUS_INCLUDE_PATH : "$(<${llvmPackages.clang}/nix-support/libc-cflags)"     \
+      --suffix CPLUS_INCLUDE_PATH : "${llvmPackages.clang}/resource-root/include"
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = gitUpdater { };
+  };
+
+  meta = {
+    description = "Qt-oriented static code analyzer based on the Clang framework";
+    homepage = "https://github.com/KDE/clazy";
+    changelog = "https://github.com/KDE/clazy/blob/${finalAttrs.version}/Changelog";
+    license = lib.licenses.lgpl2Plus;
+    maintainers = [ lib.maintainers.cadkin ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/development/tools/analysis/flow/default.nix

@@ -0,0 +1,63 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  ocamlPackages,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "flow";
+  version = "0.281.0";
+
+  src = fetchFromGitHub {
+    owner = "facebook";
+    repo = "flow";
+    tag = "v${version}";
+    hash = "sha256-YttdOu5zJo/I0e2hV5vrBSWvUMOZgfhf3RmEC8fRWlI=";
+  };
+
+  makeFlags = [ "FLOW_RELEASE=1" ];
+
+  installPhase = ''
+    install -Dm755 bin/flow $out/bin/flow
+    install -Dm644 resources/shell/bash-completion $out/share/bash-completion/completions/flow
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs = with ocamlPackages; [
+    ocaml
+    dune_3
+    findlib
+    ocamlbuild
+  ];
+
+  buildInputs = (
+    with ocamlPackages;
+    [
+      camlp-streams
+      dtoa
+      fileutils
+      lwt_log
+      lwt_ppx
+      lwt
+      ppx_deriving
+      ppx_gen_rec
+      ppx_let
+      sedlex
+      visitors
+      wtf8
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [ inotify ]
+  );
+
+  meta = with lib; {
+    description = "Static type checker for JavaScript";
+    mainProgram = "flow";
+    homepage = "https://flow.org/";
+    changelog = "https://github.com/facebook/flow/blob/v${version}/Changelog.md";
+    license = licenses.mit;
+    platforms = ocamlPackages.ocaml.meta.platforms;
+    maintainers = with maintainers; [ puffnfresh ];
+  };
+}

pkgs/development/tools/analysis/hopper/default.nix

@@ -0,0 +1,78 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+  wrapQtAppsHook,
+  gnustep-libobjc,
+  libbsd,
+  libffi_3_3,
+  libxml2,
+  ncurses6,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "hopper";
+  version = "5.19.4";
+  rev = "v4";
+
+  src = fetchurl {
+    url = "https://www.hopperapp.com/downloader/public/Hopper-${finalAttrs.rev}-${finalAttrs.version}-Linux-demo.pkg.tar.xz";
+    curlOptsList = [
+      "--user-agent"
+      "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
+      "--referer"
+      "https://www.hopperapp.com"
+    ];
+    hash = "sha256-NYnMJK9F3YxspjriyiLM+vV1HpEunGvznOesQ/FpTl4=";
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    gnustep-libobjc
+    libbsd
+    libffi_3_3
+    ncurses6
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/lib
+    install -Dm755 opt/hopper-${finalAttrs.rev}/bin/Hopper $out/bin/hopper
+    cp --archive \
+      opt/hopper-${finalAttrs.rev}/lib/libBlocksRuntime.so* \
+      opt/hopper-${finalAttrs.rev}/lib/libdispatch.so* \
+      opt/hopper-${finalAttrs.rev}/lib/libgnustep-base.so* \
+      opt/hopper-${finalAttrs.rev}/lib/libHopperCore.so* \
+      opt/hopper-${finalAttrs.rev}/lib/libkqueue.so* \
+      opt/hopper-${finalAttrs.rev}/lib/libobjcxx.so* \
+      opt/hopper-${finalAttrs.rev}/lib/libpthread_workqueue.so* \
+      $out/lib
+    cp -r usr/share $out/share
+    substituteInPlace $out/share/applications/hopper-${finalAttrs.rev}.desktop \
+      --replace-fail "Exec=/opt/hopper-${finalAttrs.rev}/bin/Hopper" "Exec=hopper"
+
+    runHook postInstall
+  '';
+
+  preFixup = ''
+    # Fix libxml2 breakage. See https://github.com/NixOS/nixpkgs/pull/396195#issuecomment-2881757108
+    mkdir -p "$out/lib"
+    ln -s "${lib.getLib libxml2}/lib/libxml2.so" "$out/lib/libxml2.so.2"
+  '';
+
+  meta = {
+    homepage = "https://www.hopperapp.com/index.html";
+    description = "MacOS and Linux Disassembler";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ Enteee ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/development/tools/analysis/include-what-you-use/default.nix

@@ -0,0 +1,71 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  cmake,
+  llvmPackages,
+  python3,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "include-what-you-use";
+  # Make sure to bump `llvmPackages` in "pkgs/top-level/all-packages.nix" to the supported version:
+  # https://github.com/include-what-you-use/include-what-you-use?tab=readme-ov-file#clang-compatibility
+  version = "0.25";
+
+  src = fetchurl {
+    url = "${meta.homepage}/downloads/${pname}-${version}.src.tar.gz";
+    hash = "sha256-voH51UmIgUYkZQYN3Ci1h8ASVCVccG05fRpJTWnrXv0=";
+  };
+
+  postPatch = ''
+    patchShebangs .
+  '';
+
+  nativeBuildInputs = with llvmPackages; [
+    cmake
+    llvm.dev
+    llvm
+    python3
+  ];
+  buildInputs = with llvmPackages; [
+    libclang
+    clang-unwrapped
+    python3
+  ];
+
+  clang = llvmPackages.clang;
+
+  cmakeFlags = [ "-DCMAKE_PREFIX_PATH=${llvmPackages.llvm.dev}" ];
+
+  postInstall = ''
+    substituteInPlace $out/bin/iwyu_tool.py \
+      --replace-fail "'include-what-you-use'" "'$out/bin/include-what-you-use'"
+
+
+    mv $out/bin/include-what-you-use $out/bin/.include-what-you-use-unwrapped
+    mv $out/bin/iwyu_tool.py $out/bin/.iwyu_tool.py-unwrapped
+    substituteAll ${./wrapper} $out/bin/include-what-you-use
+    ln -s $out/bin/include-what-you-use $out/bin/iwyu_tool.py
+    chmod +x $out/bin/include-what-you-use
+    patchShebangs $out/bin/include-what-you-use
+  '';
+
+  meta = with lib; {
+    description = "Analyze #includes in C/C++ source files with clang";
+    longDescription = ''
+      For every symbol (type, function variable, or macro) that you use in
+      foo.cc, either foo.cc or foo.h should #include a .h file that exports the
+      declaration of that symbol.  The main goal of include-what-you-use is to
+      remove superfluous #includes, both by figuring out what #includes are not
+      actually needed for this file (for both .cc and .h files), and by
+      replacing #includes with forward-declares when possible.
+    '';
+    homepage = "https://include-what-you-use.org";
+    license = licenses.bsd3;
+    maintainers = [
+      maintainers.ja1den
+    ];
+    platforms = platforms.unix;
+  };
+}

pkgs/development/tools/analysis/include-what-you-use/wrapper

@@ -0,0 +1,26 @@
+#!/bin/sh
+
+buildcpath() {
+  local path after
+  while (( $# )); do
+    case $1 in
+        -isystem)
+            shift
+            path=$path${path:+':'}$1
+            ;;
+        -idirafter)
+            shift
+            after=$after${after:+':'}$1
+            ;;
+    esac
+    shift
+  done
+  echo $path${after:+':'}$after
+}
+
+export CPATH=${CPATH}${CPATH:+':'}$(buildcpath ${NIX_CFLAGS_COMPILE} \
+                                               $(<@clang@/nix-support/libc-cflags)):@clang@/resource-root/include
+export CPLUS_INCLUDE_PATH=${CPLUS_INCLUDE_PATH}${CPLUS_INCLUDE_PATH:+':'}$(buildcpath ${NIX_CFLAGS_COMPILE} \
+                                                                                      $(<@clang@/nix-support/libcxx-cxxflags) \
+                                                                                      $(<@clang@/nix-support/libc-cflags)):@clang@/resource-root/include
+exec -a "$0" @out@/bin/.$(basename $0)-unwrapped "$@"

pkgs/development/tools/analysis/massif-visualizer/default.nix

@@ -0,0 +1,53 @@
+{
+  mkDerivation,
+  lib,
+  fetchurl,
+  extra-cmake-modules,
+  shared-mime-info,
+  qtsvg,
+  qtxmlpatterns,
+  karchive,
+  kconfig,
+  kcoreaddons,
+  kparts,
+  kio,
+  ki18n,
+  kdiagram,
+  kgraphviewer,
+}:
+
+mkDerivation rec {
+  pname = "massif-visualizer";
+  version = "0.7.0";
+
+  src = fetchurl {
+    url = "mirror://kde/stable/massif-visualizer/${version}/src/${pname}-${version}.tar.xz";
+    sha256 = "0v8z6r9gngzckvqyxjm9kp7hilwfqibyk2f9vag9l98ar0iwr97q";
+  };
+
+  nativeBuildInputs = [
+    extra-cmake-modules
+    shared-mime-info
+  ];
+
+  buildInputs = [
+    qtsvg
+    qtxmlpatterns
+    karchive
+    kconfig
+    kcoreaddons
+    kparts
+    kio
+    ki18n
+    kdiagram
+    kgraphviewer
+  ];
+
+  meta = with lib; {
+    description = "Tool that visualizes massif data generated by valgrind";
+    mainProgram = "massif-visualizer";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ zraexy ];
+  };
+}

pkgs/development/tools/analysis/radare2/default.nix

@@ -0,0 +1,169 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  buildPackages,
+  capstone,
+  file,
+  gtk2,
+  gtkdialog,
+  libewf,
+  libusb-compat-0_1,
+  libuv,
+  libzip,
+  lua,
+  lz4,
+  meson,
+  ninja,
+  openssl,
+  perl,
+  pkg-config,
+  python3,
+  readline,
+  ruby,
+  vte,
+  xxHash,
+  zlib,
+  useX11 ? false,
+  rubyBindings ? false,
+  luaBindings ? false,
+}:
+let
+  binaryninja = fetchFromGitHub {
+    owner = "Vector35";
+    repo = "binaryninja-api";
+    rev = "c40a5f04deec68d388b2072dc42b29141089f9ce"; # https://github.com/radareorg/radare2/blob/master/subprojects/binaryninja.wrap
+    hash = "sha256-IfuGgwVI51urQxhaYkYsE45NkScgxKmmEBV6Pllhwmo=";
+  };
+
+  sdb = fetchFromGitHub {
+    owner = "radare";
+    repo = "sdb";
+    tag = "2.2.0"; # https://github.com/radareorg/radare2/blob/master/subprojects/sdb.wrap
+    hash = "sha256-S/aL3F6+Z/rqelfIJaZaBF1IxSmhA1qE9ahFvKARoaE=";
+  };
+
+  qjs = fetchFromGitHub {
+    owner = "quickjs-ng";
+    repo = "quickjs";
+    rev = "7238ee64dbc2fbdea044555cda8cda78785a93ed"; # https://github.com/radareorg/radare2/blob/master/subprojects/qjs.wrap
+    hash = "sha256-1ZeLCTmbrlRrZB9El3L497gt3QUA5GIScrFVIBkxA88=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "radare2";
+  version = "6.0.2";
+
+  src = fetchFromGitHub {
+    owner = "radare";
+    repo = "radare2";
+    tag = finalAttrs.version;
+    hash = "sha256-uCMf+pNqyjRLeNJlE8Kk6PQCIRBjidO/XGHeNV/F1lA=";
+  };
+
+  mesonFlags = [
+    (lib.mesonOption "use_sys_capstone" "true")
+    (lib.mesonOption "use_sys_lz4" "true")
+    (lib.mesonOption "use_sys_magic" "true")
+    (lib.mesonOption "use_sys_openssl" "true")
+    (lib.mesonOption "use_sys_xxhash" "true")
+    (lib.mesonOption "use_sys_zip" "true")
+    (lib.mesonOption "use_sys_zlib" "true")
+    (lib.mesonOption "r2_gittap" finalAttrs.version)
+  ];
+
+  enableParallelBuilding = true;
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+    python3
+  ];
+
+  buildInputs = [
+    capstone
+    file
+    libewf
+    libusb-compat-0_1
+    libuv
+    lz4
+    openssl
+    perl
+    readline
+    zlib
+  ]
+  ++ lib.optionals useX11 [
+    gtkdialog
+    vte
+    gtk2
+  ]
+  ++ lib.optionals rubyBindings [ ruby ]
+  ++ lib.optionals luaBindings [ lua ];
+
+  propagatedBuildInputs = [
+    # radare2 exposes r_lib which depends on these libraries
+    file # for its list of magic numbers (`libmagic`)
+    libzip
+    xxHash
+  ];
+
+  postUnpack = ''
+    pushd $sourceRoot/subprojects
+
+    cp -r ${binaryninja} binaryninja
+    chmod -R +w binaryninja
+    cp packagefiles/binaryninja/meson.build binaryninja
+
+    cp -r ${sdb} sdb
+    chmod -R +w sdb
+
+    cp -r ${qjs} qjs
+    chmod -R +w qjs
+    cp packagefiles/qjs/meson.build qjs
+
+    popd
+  '';
+
+  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    install_name_tool -add_rpath $out/lib $out/lib/libr_io.${finalAttrs.version}.dylib
+  '';
+
+  meta = {
+    description = "UNIX-like reverse engineering framework and command-line toolset";
+    longDescription = ''
+      r2 is a complete rewrite of radare. It provides a set of libraries, tools
+      and plugins to ease reverse engineering tasks. Distributed mostly under
+      LGPLv3, each plugin can have different licenses.
+
+      The radare project started as a simple command-line hexadecimal editor
+      focused on forensics. Today, r2 is a featureful low-level command-line
+      tool with support for scripting with the embedded JavaScript interpreter
+      or via r2pipe.
+
+      r2 can edit files on local hard drives, view kernel memory, and debug
+      programs locally or via a remote gdb/windbg servers. r2's wide
+      architecture support allows you to analyze, emulate, debug, modify, and
+      disassemble any binary.
+    '';
+    homepage = "https://radare.org";
+    changelog = "https://github.com/radareorg/radare2/releases/tag/${finalAttrs.version}";
+    license = with lib.licenses; [
+      gpl3Only
+      lgpl3Only
+    ];
+    maintainers = with lib.maintainers; [
+      arkivm
+      azahi
+      makefu
+      mic92
+      raskin
+    ];
+    mainProgram = "radare2";
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/development/tools/analysis/rizin/cutter.nix

@@ -0,0 +1,104 @@
+{
+  lib,
+  fetchFromGitHub,
+  fetchpatch,
+  stdenv,
+  # for passthru.plugins
+  pkgs,
+  # nativeBuildInputs
+  cmake,
+  pkg-config,
+  wrapQtAppsHook,
+  # Qt
+  qt5compat,
+  qtbase,
+  qtwayland,
+  qtsvg,
+  qttools,
+  qtwebengine,
+  # buildInputs
+  graphviz,
+  python3,
+  rizin,
+}:
+
+let
+  cutter = stdenv.mkDerivation rec {
+    pname = "cutter";
+    version = "2.4.1";
+
+    src = fetchFromGitHub {
+      owner = "rizinorg";
+      repo = "cutter";
+      rev = "v${version}";
+      hash = "sha256-fNOznaFzWJ4Dve9U1+E4xPaznnyxae2jHNaBCdJzDyQ=";
+      fetchSubmodules = true;
+    };
+
+    nativeBuildInputs = [
+      cmake
+      pkg-config
+      python3
+      wrapQtAppsHook
+    ];
+
+    propagatedBuildInputs = [
+      python3.pkgs.pyside6
+    ];
+
+    buildInputs = [
+      graphviz
+      python3
+      qt5compat
+      qtbase
+      qtsvg
+      qttools
+      qtwebengine
+      rizin
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      qtwayland
+    ];
+
+    cmakeFlags = [
+      "-DCUTTER_USE_BUNDLED_RIZIN=OFF"
+      "-DCUTTER_ENABLE_PYTHON=ON"
+      "-DCUTTER_ENABLE_PYTHON_BINDINGS=ON"
+      "-DCUTTER_ENABLE_GRAPHVIZ=ON"
+      "-DCUTTER_QT6=ON"
+    ];
+
+    preBuild = ''
+      qtWrapperArgs+=(--prefix PYTHONPATH : "$PYTHONPATH")
+    '';
+
+    passthru = rec {
+      plugins = rizin.plugins // {
+        rz-ghidra = rizin.plugins.rz-ghidra.override {
+          inherit cutter qtbase qtsvg;
+          enableCutterPlugin = true;
+        };
+      };
+      withPlugins =
+        filter:
+        pkgs.callPackage ./wrapper.nix {
+          inherit rizin cutter;
+          isCutter = true;
+          plugins = filter plugins;
+        };
+    };
+
+    meta = with lib; {
+      description = "Free and Open Source Reverse Engineering Platform powered by rizin";
+      homepage = src.meta.homepage;
+      license = licenses.gpl3;
+      mainProgram = "cutter";
+      maintainers = with maintainers; [
+        mic92
+        dtzWill
+      ];
+      inherit (rizin.meta) platforms;
+    };
+  };
+in
+cutter

pkgs/development/tools/analysis/rizin/default.nix

@@ -0,0 +1,155 @@
+{
+  lib,
+  pkgs, # for passthru.plugins
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libusb-compat-0_1,
+  readline,
+  libewf,
+  perl,
+  pcre2,
+  zlib,
+  openssl,
+  file,
+  libmspack,
+  libzip,
+  lz4,
+  xxHash,
+  xz,
+  meson,
+  python3,
+  cmake,
+  ninja,
+  capstone,
+  tree-sitter,
+  zstd,
+}:
+
+let
+  rizin = stdenv.mkDerivation rec {
+    pname = "rizin";
+    version = "0.8.1";
+
+    src = fetchurl {
+      url = "https://github.com/rizinorg/rizin/releases/download/v${version}/rizin-src-v${version}.tar.xz";
+      hash = "sha256-7yseZSXX3DasQ1JblWdJwcyge/F8H+2LZkAtggEKTsI=";
+    };
+
+    mesonFlags = [
+      "-Duse_sys_capstone=enabled"
+      "-Duse_sys_magic=enabled"
+      "-Duse_sys_libzip=enabled"
+      "-Duse_sys_zlib=enabled"
+      "-Duse_sys_lz4=enabled"
+      "-Duse_sys_libzstd=enabled"
+      "-Duse_sys_lzma=enabled"
+      "-Duse_sys_xxhash=enabled"
+      "-Duse_sys_openssl=enabled"
+      "-Duse_sys_libmspack=enabled"
+      "-Duse_sys_tree_sitter=enabled"
+      "-Duse_sys_pcre2=enabled"
+      # this is needed for wrapping (adding plugins) to work
+      "-Dportable=true"
+    ];
+
+    patches = [
+      # Normally, Rizin only looks for files in the install prefix. With
+      # portable=true, it instead looks for files in relation to the parent
+      # of the directory of the binary file specified in /proc/self/exe,
+      # caching it. This patch replaces the entire logic to only look at
+      # the env var NIX_RZ_PREFIX
+      ./librz-wrapper-support.patch
+    ];
+
+    nativeBuildInputs = [
+      pkg-config
+      meson
+      (python3.withPackages (
+        pp: with pp; [
+          pyyaml
+        ]
+      ))
+      ninja
+      cmake
+    ];
+
+    # meson's find_library seems to not use our compiler wrapper if static parameter
+    # is either true/false... We work around by also providing LIBRARY_PATH
+    preConfigure = ''
+      LIBRARY_PATH=""
+      for b in ${toString (map lib.getLib buildInputs)}; do
+        if [[ -d "$b/lib" ]]; then
+          LIBRARY_PATH="$b/lib''${LIBRARY_PATH:+:}$LIBRARY_PATH"
+        fi
+      done
+      export LIBRARY_PATH
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace binrz/rizin/macos_sign.sh \
+        --replace 'codesign' '# codesign'
+    '';
+
+    buildInputs = [
+      file
+      libzip
+      capstone
+      readline
+      libusb-compat-0_1
+      libewf
+      pcre2
+      perl
+      zlib
+      lz4
+      openssl
+      libmspack
+      tree-sitter
+      xxHash
+      xz
+      zstd
+    ];
+
+    postPatch = ''
+      # find_installation without arguments uses Meson’s Python interpreter,
+      # which does not have any extra modules.
+      # https://github.com/mesonbuild/meson/pull/9904
+      substituteInPlace meson.build \
+        --replace "import('python').find_installation()" "find_program('python3')"
+    '';
+
+    passthru = rec {
+      plugins = {
+        jsdec = pkgs.callPackage ./jsdec.nix {
+          inherit rizin openssl;
+        };
+        rz-ghidra = pkgs.qt6.callPackage ./rz-ghidra.nix {
+          inherit rizin openssl;
+          enableCutterPlugin = false;
+        };
+        # sigdb isn't a real plugin, but it's separated from the main rizin
+        # derivation so that only those who need it will download it
+        sigdb = pkgs.callPackage ./sigdb.nix { };
+      };
+      withPlugins =
+        filter:
+        pkgs.callPackage ./wrapper.nix {
+          inherit rizin;
+          plugins = filter plugins;
+        };
+    };
+
+    meta = {
+      description = "UNIX-like reverse engineering framework and command-line toolset";
+      homepage = "https://rizin.re/";
+      license = lib.licenses.gpl3Plus;
+      mainProgram = "rizin";
+      maintainers = with lib.maintainers; [
+        raskin
+        makefu
+        mic92
+      ];
+      platforms = with lib.platforms; unix;
+    };
+  };
+in
+rizin

pkgs/development/tools/analysis/rizin/jsdec.nix

@@ -0,0 +1,62 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  pkg-config,
+  ninja,
+  rizin,
+  openssl,
+}:
+
+let
+  version = "0.8.0";
+
+  libquickjs = fetchFromGitHub {
+    owner = "quickjs-ng";
+    repo = "quickjs";
+    tag = "v${version}";
+    hash = "sha256-o0Cpy+20EqNdNENaYlasJcKIGU7W4RYBcTMsQwFTUNc=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "jsdec";
+  version = version;
+
+  src = fetchFromGitHub {
+    owner = "rizinorg";
+    repo = "jsdec";
+    rev = "v${version}";
+    hash = "sha256-Xc8FMKSGdjrp288u49R6YC0xiynwHeoZe2P/UqnfsFU=";
+  };
+
+  postUnpack = ''
+    cp -r --no-preserve=mode ${libquickjs} $sourceRoot/subprojects/libquickjs
+  '';
+
+  postPatch = ''
+    cp subprojects/packagefiles/libquickjs/* subprojects/libquickjs
+  '';
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+  buildInputs = [
+    openssl
+    rizin
+  ];
+
+  meta = with lib; {
+    description = "Simple decompiler for Rizin";
+    homepage = finalAttrs.src.meta.homepage;
+    changelog = "${finalAttrs.src.meta.homepage}/releases/tag/${finalAttrs.src.rev}";
+    license = with licenses; [
+      asl20
+      bsd3
+      mit
+    ];
+    maintainers = with maintainers; [ chayleaf ];
+  };
+})

pkgs/development/tools/analysis/rizin/librz-wrapper-support.patch

@@ -0,0 +1,13 @@
+diff --git a/librz/util/path.c b/librz/util/path.c
+index 8ea3d67..f4a8918 100644
+--- a/librz/util/path.c
++++ b/librz/util/path.c
+@@ -35,6 +35,8 @@ static void fini_portable_prefix(void) {
+ }
+ 
+ static char *set_portable_prefix(void) {
++	return rz_sys_getenv("NIX_RZ_PREFIX");
++
+ 	char *pid_to_path = rz_sys_pid_to_path(rz_sys_getpid());
+ 	if (!pid_to_path) {
+ 		return NULL;

pkgs/development/tools/analysis/rizin/rz-ghidra.nix

@@ -0,0 +1,63 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  # buildInputs
+  rizin,
+  openssl,
+  pugixml,
+  # optional buildInputs
+  enableCutterPlugin ? true,
+  cutter,
+  qt5compat,
+  qtbase,
+  qtsvg,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "rz-ghidra";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "rizinorg";
+    repo = "rz-ghidra";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-uI0EnuHAuyrXYKDijh5Tg/WcQ/5yyZnW3d5MMHZxnqA=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [
+    openssl
+    pugixml
+    rizin
+  ]
+  ++ lib.optionals enableCutterPlugin [
+    cutter
+    qt5compat
+    qtbase
+    qtsvg
+  ];
+
+  dontWrapQtApps = true;
+
+  cmakeFlags = [
+    "-DUSE_SYSTEM_PUGIXML=ON"
+  ]
+  ++ lib.optionals enableCutterPlugin [
+    "-DBUILD_CUTTER_PLUGIN=ON"
+    "-DCUTTER_INSTALL_PLUGDIR=share/rizin/cutter/plugins/native"
+  ];
+
+  meta = with lib; {
+    # errors out with undefined symbols from Cutter
+    broken = enableCutterPlugin && stdenv.hostPlatform.isDarwin;
+    description = "Deep ghidra decompiler and sleigh disassembler integration for rizin";
+    homepage = finalAttrs.src.meta.homepage;
+    changelog = "${finalAttrs.src.meta.homepage}/releases/tag/${finalAttrs.src.rev}";
+    license = licenses.lgpl3;
+    maintainers = with maintainers; [ chayleaf ];
+    inherit (rizin.meta) platforms;
+  };
+})

pkgs/development/tools/analysis/rizin/sigdb.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "rizin-sigdb";
+  version = "unstable-2023-08-23";
+
+  src = fetchFromGitHub {
+    owner = "rizinorg";
+    # sigdb-source: source files (.pat and etc), around 2.5gb total
+    # sigdb: built and deflated .sig files, around 50mb total
+    repo = "sigdb";
+    rev = "4addbed50cd3b50eeef5a41d72533d079ebbfbf8";
+    hash = "sha256-Fy92MTuLswEgQ/XEUExqdU1Z4a5MP2Ahzi/gGxd5BtA=";
+  };
+
+  buildPhase = ''
+    mkdir installdir
+    cp -r elf pe installdir
+    .scripts/verify-sigs-install.sh
+  '';
+
+  installPhase = ''
+    mkdir -p $out/share/rizin
+    mv installdir $out/share/rizin/sigdb
+  '';
+
+  meta = with lib; {
+    description = "Rizin FLIRT Signature Database";
+    homepage = src.meta.homepage;
+    license = licenses.lgpl3;
+    maintainers = with lib.maintainers; [ chayleaf ];
+  };
+}

pkgs/development/tools/analysis/rizin/wrapper.nix

@@ -0,0 +1,43 @@
+{
+  lib,
+  makeWrapper,
+  symlinkJoin,
+  plugins,
+  rizin,
+  isCutter ? false,
+  cutter,
+}:
+
+let
+  unwrapped = if isCutter then cutter else rizin;
+in
+symlinkJoin {
+  name = "${unwrapped.pname}-with-plugins-${unwrapped.version}";
+
+  # NIX_RZ_PREFIX only changes where *Rizin* locates files (plugins,
+  # themes, etc). But we must change it even for wrapping Cutter, because
+  # Cutter plugins often have associated Rizin plugins. This means that
+  # $out (which NIX_RZ_PREFIX will be set to) must always contain Rizin
+  # files, even if we only wrap Cutter - so for Cutter, include Rizin to
+  # symlinkJoin paths.
+  paths = [ unwrapped ] ++ lib.optional isCutter rizin ++ plugins;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  passthru = {
+    inherit unwrapped;
+  };
+
+  postBuild = ''
+    rm $out/bin/*
+    wrapperArgs=(--set NIX_RZ_PREFIX $out${lib.optionalString isCutter " --prefix XDG_DATA_DIRS : $out/share"})
+    for binary in $(ls ${unwrapped}/bin); do
+      makeWrapper ${unwrapped}/bin/$binary $out/bin/$binary "''${wrapperArgs[@]}"
+    done
+  '';
+
+  meta = unwrapped.meta // {
+    # prefer wrapped over unwrapped
+    priority = (unwrapped.meta.priority or lib.meta.defaultPriority) - 1;
+  };
+}

pkgs/development/tools/analysis/rr/default.nix

@@ -0,0 +1,118 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  bash,
+  capnproto,
+  cmake,
+  gdb,
+  libpfm,
+  makeWrapper,
+  nix-update-script,
+  pkg-config,
+  procps,
+  python3,
+  which,
+  zlib,
+  zstd,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  version = "5.9.0";
+  pname = "rr";
+
+  src = fetchFromGitHub {
+    owner = "rr-debugger";
+    repo = "rr";
+    rev = finalAttrs.version;
+    hash = "sha256-o+HXrgGXdsvjlNh70qsXRtp2yXOiZIT30ejfs1KEaqE=";
+  };
+
+  postPatch = ''
+    substituteInPlace src/Command.cc --replace '_BSD_SOURCE' '_DEFAULT_SOURCE'
+    patchShebangs src
+  '';
+
+  # With LTO enabled, linking fails with the following message:
+  #
+  # src/AddressSpace.cc:1666: undefined reference to `rr_syscall_addr'
+  # ld.bfd: bin/rr: hidden symbol `rr_syscall_addr' isn't defined
+  # ld.bfd: final link failed: bad value
+  # collect2: error: ld returned 1 exit status
+  #
+  # See also https://github.com/NixOS/nixpkgs/pull/110846
+  preConfigure = ''
+    substituteInPlace CMakeLists.txt --replace "-flto" ""
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    capnproto
+    cmake
+    makeWrapper
+    pkg-config
+    python3.pythonOnBuildForHost
+    which
+  ];
+
+  buildInputs = [
+    bash
+    capnproto
+    gdb
+    libpfm
+    procps
+    python3
+    zlib
+    zstd
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "disable32bit" true)
+    (lib.cmakeBool "BUILD_TESTS" finalAttrs.finalPackage.doCheck)
+  ];
+
+  # we turn on additional warnings due to hardening
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
+
+  hardeningDisable = [ "fortify" ];
+
+  # FIXME
+  doCheck = false;
+
+  preCheck = "export HOME=$TMPDIR";
+
+  # needs GDB to replay programs at runtime
+  preFixup = ''
+    wrapProgram "$out/bin/rr" \
+      --prefix PATH ":" "${lib.makeBinPath [ gdb ]}";
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://rr-project.org/";
+    description = "Records nondeterministic executions and debugs them deterministically";
+    longDescription = ''
+      rr aspires to be your primary debugging tool, replacing -- well,
+      enhancing -- gdb. You record a failure once, then debug the
+      recording, deterministically, as many times as you want. Every
+      time the same execution is replayed.
+    '';
+
+    license = with lib.licenses; [
+      mit
+      bsd2
+    ];
+    maintainers = with lib.maintainers; [
+      pierron
+      thoughtpolice
+      lf-
+    ];
+    platforms = [
+      "aarch64-linux"
+      "i686-linux"
+      "x86_64-linux"
+    ];
+  };
+})

pkgs/development/tools/analysis/rr/zen_workaround.nix

@@ -0,0 +1,59 @@
+{
+  stdenv,
+  lib,
+  fetchpatch,
+  kernel,
+  rr,
+}:
+
+/*
+  The python script shouldn't be needed for users of this kernel module.
+  https://github.com/rr-debugger/rr/blob/master/scripts/zen_workaround.py
+  The module itself is called "zen_workaround" (a bit generic unfortunately).
+*/
+stdenv.mkDerivation {
+  pname = "rr-zen_workaround";
+
+  inherit (rr) src version;
+  sourceRoot = "${rr.src.name}/third-party/zen-pmu-workaround";
+  patches = [
+    (fetchpatch {
+      name = "kernel-6.16.patch";
+      url = "https://github.com/rr-debugger/rr/commit/86aa1ebe03c6a7f60eb65249233f866fd3da8316.diff";
+      stripLen = 2;
+      hash = "sha256-zj5MNwlZmWnagu0tE5Jl5a48wEF0lqNTh4KcbhmOkOo=";
+    })
+  ];
+
+  hardeningDisable = [ "pic" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = [
+    "-C${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+  postConfigure = ''
+    appendToVar makeFlags "M=$(pwd)"
+  '';
+  buildFlags = [ "modules" ];
+
+  installPhase =
+    let
+      modDestDir = "$out/lib/modules/${kernel.modDirVersion}/kernel"; # TODO: longer path?
+    in
+    ''
+      runHook preInstall
+      mkdir -p "${modDestDir}"
+      cp *.ko "${modDestDir}/"
+      find ${modDestDir} -name '*.ko' -exec xz -f '{}' \;
+      runHook postInstall
+    '';
+
+  meta = with lib; {
+    description = "Kernel module supporting the rr debugger on (some) AMD Zen-based CPUs";
+    homepage = "https://github.com/rr-debugger/rr/wiki/Zen#kernel-module";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.vcunat ];
+    platforms = [ "x86_64-linux" ];
+    broken = versionOlder kernel.version "4.19"; # 4.14 breaks and 4.19 works
+  };
+}

pkgs/development/tools/analysis/snowman/default.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  mkDerivation,
+  fetchFromGitHub,
+  cmake,
+  boost,
+  qtbase,
+}:
+
+mkDerivation rec {
+  pname = "snowman";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "yegord";
+    repo = "snowman";
+    rev = "v${version}";
+    sha256 = "1mrmhj2nddi0d47c266vsg5vbapbqbcpj5ld4v1qcwnnk6z2zn0j";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [
+    boost
+    qtbase
+  ];
+
+  postUnpack = ''
+    export sourceRoot=$sourceRoot/src
+  '';
+
+  meta = with lib; {
+    description = "Native code to C/C++ decompiler";
+    homepage = "http://derevenets.com/";
+
+    # https://github.com/yegord/snowman/blob/master/doc/licenses.asciidoc
+    license = licenses.gpl3Plus;
+    maintainers = [ ];
+    platforms = platforms.all;
+  };
+}

pkgs/development/tools/analysis/splint/darwin.patch

@@ -0,0 +1,13 @@
+diff --git a/src/osd.c b/src/osd.c
+index ebe214a..4ba81d5 100644
+--- a/src/osd.c
++++ b/src/osd.c
+@@ -516,7 +516,7 @@ osd_getPid ()
+ # if defined (WIN32) || defined (OS2) && defined (__IBMC__)
+   int pid = _getpid ();
+ # else
+-  __pid_t pid = getpid ();
++  pid_t pid = getpid ();
+ # endif
+ 
+   return (int) pid;

pkgs/development/tools/analysis/splint/default.nix

@@ -0,0 +1,39 @@
+{
+  fetchurl,
+  lib,
+  stdenv,
+  flex,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "splint";
+  version = "3.1.2";
+
+  src = fetchurl {
+    url = "https://www.splint.org/downloads/${pname}-${version}.src.tgz";
+    sha256 = "02pv8kscsrkrzip9r08pfs9xs98q74c52mlxzbii6cv6vx1vd3f7";
+  };
+
+  patches = [ ./tmpdir.patch ] ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin.patch;
+
+  buildInputs = [ flex ];
+
+  doCheck = true;
+
+  meta = with lib; {
+    homepage = "http://www.splint.org/";
+    description = "Annotation-assisted lightweight static analyzer for C";
+    mainProgram = "splint";
+
+    longDescription = ''
+      Splint is a tool for statically checking C programs for security
+      vulnerabilities and coding mistakes.  With minimal effort, Splint
+      can be used as a better lint.  If additional effort is invested
+      adding annotations to programs, Splint can perform stronger
+      checking than can be done by any standard lint.
+    '';
+
+    license = licenses.gpl2Plus;
+    platforms = platforms.unix;
+  };
+}

pkgs/development/tools/analysis/splint/tmpdir.patch

@@ -0,0 +1,16 @@
+Have Splint honor $TMPDIR.
+
+--- splint-3.1.2/src/context.c	2004-07-31 21:04:26.000000000 +0200
++++ splint-3.1.2/src/context.c	2008-07-11 10:55:16.000000000 +0200
+@@ -801,7 +801,10 @@ context_resetAllFlags (void) 
+                 val = cstring_makeLiteral (env != NULL ? env : DEFAULT_TMPDIR);
+ 	      }
+ # else
+-	      val = cstring_makeLiteral (DEFAULT_TMPDIR);
++	      {
++		char *env = getenv ("TMPDIR");
++		val = cstring_makeLiteral (env != NULL ? env : DEFAULT_TMPDIR);
++	      }
+ # endif /* !defined(OS2) && !defined(MSDOS) */
+ 
+ 	      break;

pkgs/development/tools/analysis/tflint-plugins/default.nix

@@ -0,0 +1,5 @@
+{ callPackage, ... }:
+{
+  tflint-ruleset-aws = callPackage ./tflint-ruleset-aws.nix { };
+  tflint-ruleset-google = callPackage ./tflint-ruleset-google.nix { };
+}

pkgs/development/tools/analysis/tflint-plugins/tflint-ruleset-aws.nix

@@ -0,0 +1,51 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "tflint-ruleset-aws";
+  version = "0.42.0";
+
+  src = fetchFromGitHub {
+    owner = "terraform-linters";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-R2Njm5RpjdSGMi9qdu8wTEEM5YyMaf/UAkdBVYPl9W0=";
+  };
+
+  vendorHash = "sha256-Sn7uze6uSI2O824UjG8pFMQ1KsnwdknRzOT9czpNnD4=";
+
+  postPatch = ''
+    # some automation for creating new releases on GitHub, which we don't need
+    rm -rf tools/release
+  '';
+
+  # upstream Makefile also does a  go test $(go list ./... | grep -v integration)
+  preCheck = ''
+    rm integration/integration_test.go
+  '';
+
+  postInstall = ''
+    # allow use as a versioned dependency, i.e., with `source = ...` and
+    # `version = ...` in `.tflintrc`:
+    mkdir -p $out/github.com/terraform-linters/${pname}/${version}
+    mv $out/bin/${pname} $out/github.com/terraform-linters/${pname}/${version}/
+
+    # allow use as an unversioned dependency, e.g., if one wants `.tflintrc` to
+    # solely rely on Nix to pin versions:
+    ln -s $out/github.com/terraform-linters/${pname}/${version}/${pname} $out/
+
+    # remove other binaries from bin
+    rm -R $out/bin
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/terraform-linters/tflint-ruleset-aws";
+    changelog = "https://github.com/terraform-linters/tflint-ruleset-aws/blob/v${version}/CHANGELOG.md";
+    description = "TFLint ruleset plugin for Terraform AWS Provider";
+    maintainers = with maintainers; [ flokli ];
+    license = with licenses; [ mpl20 ];
+  };
+}

pkgs/development/tools/analysis/tflint-plugins/tflint-ruleset-google.nix

@@ -0,0 +1,45 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "tflint-ruleset-google";
+  version = "0.36.0";
+
+  src = fetchFromGitHub {
+    owner = "terraform-linters";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-1E+3z/ZVonhJgldIDToKhGxFdhq0t+yNep38G3ePOrw=";
+  };
+
+  vendorHash = "sha256-XKKQBpS2PCGBuoiz4G3BI6czVNndPjr+rTKrM5jlsaY=";
+
+  # upstream Makefile also does a go test $(go list ./... | grep -v integration)
+  preCheck = ''
+    rm integration/integration_test.go
+  '';
+
+  subPackages = [ "." ];
+
+  postInstall = ''
+    # allow use as a versioned dependency, i.e., with `source = ...` and
+    # `version = ...` in `.tflintrc`:
+    mkdir -p $out/github.com/terraform-linters/${pname}/${version}
+    mv $out/bin/${pname} $out/github.com/terraform-linters/${pname}/${version}/
+
+    # allow use as an unversioned dependency, e.g., if one wants `.tflintrc` to
+    # solely rely on Nix to pin versions:
+    ln -s $out/github.com/terraform-linters/${pname}/${version}/${pname} $out/
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/terraform-linters/tflint-ruleset-google";
+    description = "TFLint ruleset plugin for Terraform Google Provider";
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ john-rodewald ];
+    license = with licenses; [ mpl20 ];
+  };
+}

pkgs/development/tools/asn2quickder/default.nix

@@ -0,0 +1,55 @@
+{
+  lib,
+  buildPythonApplication,
+  fetchFromGitLab,
+  makeWrapper,
+  cmake,
+  six,
+  pyparsing,
+  asn1ate,
+  colored,
+}:
+
+buildPythonApplication rec {
+  pname = "asn2quickder";
+  version = "1.7.1";
+  format = "setuptools";
+
+  src = fetchFromGitLab {
+    owner = "arpa2";
+    repo = "quick-der";
+    rev = "v${version}";
+    hash = "sha256-f+ph5PL+uWRkswpOLDwZFWjh938wxoJ6xocJZ2WZLEk=";
+  };
+
+  postPatch = ''
+    patchShebangs ./python/scripts/*
+
+    # Unpin pyparsing 3.0.0. Issue resolved in latest version.
+    substituteInPlace setup.py --replace 'pyparsing==3.0.0' 'pyparsing'
+  '';
+
+  dontUseCmakeConfigure = true;
+
+  nativeBuildInputs = [
+    makeWrapper
+    cmake
+  ];
+
+  propagatedBuildInputs = [
+    pyparsing
+    asn1ate
+    six
+    colored
+  ];
+
+  doCheck = false; # Flaky tests
+
+  meta = with lib; {
+    description = "ASN.1 compiler with a backend for Quick DER";
+    homepage = "https://gitlab.com/arpa2/quick-der";
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ leenaars ];
+  };
+}

pkgs/development/tools/boomerang/default.nix

@@ -0,0 +1,55 @@
+{
+  mkDerivation,
+  lib,
+  fetchFromGitHub,
+  fetchpatch,
+  cmake,
+  qtbase,
+  capstone,
+  bison,
+  flex,
+}:
+
+mkDerivation rec {
+  pname = "boomerang";
+  version = "0.5.2";
+  # NOTE: When bumping version beyond 0.5.2, you likely need to remove
+  #       the cstdint.patch below. The patch does a fix that has already
+  #       been done upstream but is not yet part of a release
+
+  src = fetchFromGitHub {
+    owner = "BoomerangDecompiler";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0xncdp0z8ry4lkzmvbj5d7hlzikivghpwicgywlv47spgh8ny0ix";
+  };
+
+  # Boomerang usually compiles with -Werror but has not been updated for newer
+  # compilers. Disable -Werror for now. Consider trying to remove this when
+  # updating this derivation.
+  NIX_CFLAGS_COMPILE = "-Wno-error";
+
+  nativeBuildInputs = [
+    cmake
+    bison
+    flex
+  ];
+  buildInputs = [
+    qtbase
+    capstone
+  ];
+  patches = [
+    (fetchpatch {
+      name = "include-missing-cstdint.patch";
+      url = "https://github.com/BoomerangDecompiler/boomerang/commit/3342b0eac6b7617d9913226c06c1470820593e74.patch";
+      sha256 = "sha256-941IydcV3mqj7AWvXTM6GePW5VgawEcL0wrBCXqeWvc=";
+    })
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/BoomerangDecompiler/boomerang";
+    license = licenses.bsd3;
+    description = "General, open source, retargetable decompiler";
+    maintainers = [ ];
+  };
+}

pkgs/development/tools/build-managers/buck/default.nix

@@ -0,0 +1,69 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  jdk8,
+  ant,
+  python3,
+  watchman,
+  bash,
+  makeWrapper,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "buck";
+  version = "2022.05.05.01";
+
+  src = fetchFromGitHub {
+    owner = "facebook";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "15v4sk1l43pgd5jxr5lxnh0ks6vb3xk5253n66s7vvsnph48j14q";
+  };
+
+  patches = [ ./pex-mtime.patch ];
+
+  postPatch = ''
+    grep -l -r '/bin/bash' --null | xargs -0 sed -i -e "s!/bin/bash!${bash}/bin/bash!g"
+  '';
+
+  nativeBuildInputs = [
+    makeWrapper
+    python3
+    jdk8
+    ant
+    watchman
+  ];
+
+  buildPhase = ''
+    # Set correct version, see https://github.com/facebook/buck/issues/2607
+    echo v${version} > .buckrelease
+
+    ant
+
+    PYTHONDONTWRITEBYTECODE=true ./bin/buck build -c buck.release_version=${version} buck
+  '';
+
+  installPhase = ''
+    install -D -m755 buck-out/gen/*/programs/buck.pex $out/bin/buck
+    wrapProgram $out/bin/buck \
+      --prefix PATH : "${
+        lib.makeBinPath [
+          jdk8
+          watchman
+          python3
+        ]
+      }"
+  '';
+
+  meta = with lib; {
+    homepage = "https://buck.build/";
+    description = "High-performance build tool";
+    mainProgram = "buck";
+    maintainers = [ maintainers.jgertm ];
+    license = licenses.asl20;
+    platforms = platforms.all;
+    # https://github.com/facebook/buck/issues/2666
+    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
+  };
+}

pkgs/development/tools/build-managers/buck/pex-mtime.patch

@@ -0,0 +1,13 @@
+diff --git a/third-party/py/pex/pex/common.py b/third-party/py/pex/pex/common.py
+index 76459ce23..eff411b20 100644
+--- a/third-party/py/pex/pex/common.py
++++ b/third-party/py/pex/pex/common.py
+@@ -328,4 +328,7 @@ class Chroot(object):
+   def zip(self, filename, mode='wb'):
+     with contextlib.closing(zipfile.ZipFile(filename, mode)) as zf:
+       for f in sorted(self.files()):
+-        zf.write(os.path.join(self.chroot, f), arcname=f, compress_type=zipfile.ZIP_DEFLATED)
++        path = os.path.join(self.chroot, f)
++        instant = 615532801
++        os.utime(path, (instant, instant))
++        zf.write(path, arcname=f, compress_type=zipfile.ZIP_DEFLATED)

pkgs/development/tools/build-managers/build2/bdep.nix

@@ -0,0 +1,57 @@
+{
+  lib,
+  stdenv,
+  build2,
+  fetchurl,
+  libbpkg,
+  libbutl,
+  libodb,
+  libodb-sqlite,
+  enableShared ? !stdenv.hostPlatform.isStatic,
+  enableStatic ? !enableShared,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "bdep";
+  version = "0.17.0";
+
+  outputs = [
+    "out"
+    "doc"
+    "man"
+  ];
+  src = fetchurl {
+    url = "https://pkg.cppget.org/1/alpha/build2/bdep-${version}.tar.gz";
+    hash = "sha256-+2Hl5kanxWJmOpfePAvvSBSmG3kZLQv/kYIkT4J+kaQ=";
+  };
+
+  strictDeps = true;
+  nativeBuildInputs = [
+    build2
+  ];
+  buildInputs = [
+    libbpkg
+    libbutl
+    libodb
+    libodb-sqlite
+  ];
+
+  build2ConfigureFlags = [
+    "config.bin.lib=${build2.configSharedStatic enableShared enableStatic}"
+  ];
+
+  meta = with lib; {
+    description = "Build2 project dependency manager";
+    mainProgram = "bdep";
+    # https://build2.org/bdep/doc/bdep.xhtml
+    longDescription = ''
+      The build2 project dependency manager is used to manage the dependencies
+      of a project during development.
+    '';
+    homepage = "https://build2.org/";
+    changelog = "https://git.build2.org/cgit/bdep/tree/NEWS";
+    license = licenses.mit;
+    maintainers = with maintainers; [ r-burns ];
+    platforms = platforms.all;
+  };
+}

pkgs/development/tools/build-managers/build2/bootstrap.nix

@@ -0,0 +1,56 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkgs,
+  buildPackages,
+  fixDarwinDylibNames,
+}:
+stdenv.mkDerivation rec {
+  pname = "build2-bootstrap";
+  version = "0.17.0";
+  src = fetchurl {
+    url = "https://download.build2.org/${version}/build2-toolchain-${version}.tar.xz";
+    hash = "sha256-NyKonqht90JTnQ+Ru0Qp/Ua79mhVOjUHgKY0EbZIv10=";
+  };
+  patches = [
+    # Pick up sysdirs from NIX_LDFLAGS
+    ./nix-ldflags-sysdirs.patch
+  ];
+
+  sourceRoot = "build2-toolchain-${version}/build2";
+  makefile = "bootstrap.gmake";
+  enableParallelBuilding = true;
+
+  setupHook = ./setup-hook.sh;
+
+  strictDeps = true;
+
+  propagatedBuildInputs = lib.optionals stdenv.targetPlatform.isDarwin [
+    fixDarwinDylibNames
+
+    # Build2 needs to use lld on Darwin because it creates thin archives when it detects `llvm-ar`,
+    # which ld64 does not support.
+    (lib.getBin buildPackages.llvmPackages.lld)
+  ];
+
+  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+    build2/b-boot --version
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -D build2/b-boot $out/bin/b
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    substituteInPlace $out/nix-support/setup-hook \
+      --subst-var-by isTargetDarwin '${toString stdenv.targetPlatform.isDarwin}'
+  '';
+
+  inherit (pkgs.build2) passthru;
+}

pkgs/development/tools/build-managers/build2/bpkg.nix

@@ -0,0 +1,76 @@
+{
+  lib,
+  stdenv,
+  build2,
+  fetchurl,
+  git,
+  libbpkg,
+  libbutl,
+  libodb,
+  libodb-sqlite,
+  openssl,
+  enableShared ? !stdenv.hostPlatform.isStatic,
+  enableStatic ? !enableShared,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "bpkg";
+  version = "0.17.0";
+
+  outputs = [
+    "out"
+    "doc"
+    "man"
+  ];
+
+  src = fetchurl {
+    url = "https://pkg.cppget.org/1/alpha/build2/bpkg-${version}.tar.gz";
+    hash = "sha256-Yw6wvTqO+VfCo91B2BUT0A8OIN0MVhGK1USYM7hgGMs=";
+  };
+
+  strictDeps = true;
+  nativeBuildInputs = [
+    build2
+  ];
+  buildInputs = [
+    build2
+    libbpkg
+    libbutl
+    libodb
+    libodb-sqlite
+  ];
+  nativeCheckInputs = [
+    git
+    openssl
+  ];
+
+  doCheck = true;
+
+  # Failing test
+  postPatch = ''
+    rm tests/rep-create.testscript
+  '';
+
+  build2ConfigureFlags = [
+    "config.bin.lib=${build2.configSharedStatic enableShared enableStatic}"
+  ];
+
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    install_name_tool -add_rpath '${lib.getLib build2}/lib' "''${!outputBin}/bin/bpkg"
+  '';
+
+  meta = with lib; {
+    description = "Build2 package dependency manager";
+    mainProgram = "bpkg";
+    # https://build2.org/bpkg/doc/bpkg.xhtml
+    longDescription = ''
+      The build2 package dependency manager is used to manipulate build
+      configurations, packages, and repositories.
+    '';
+    homepage = "https://build2.org/";
+    changelog = "https://git.build2.org/cgit/bpkg/tree/NEWS";
+    license = licenses.mit;
+    maintainers = with maintainers; [ r-burns ];
+    platforms = platforms.all;
+  };
+}

pkgs/development/tools/build-managers/build2/default.nix

@@ -0,0 +1,125 @@
+{
+  stdenv,
+  lib,
+  build2,
+  fetchurl,
+  fixDarwinDylibNames,
+  libbutl,
+  libpkgconf,
+  buildPackages,
+  enableShared ? !stdenv.hostPlatform.isStatic,
+  enableStatic ? !enableShared,
+}:
+let
+  configSharedStatic =
+    enableShared: enableStatic:
+    if enableShared && enableStatic then
+      "both"
+    else if enableShared then
+      "shared"
+    else if enableStatic then
+      "static"
+    else
+      throw "neither shared nor static libraries requested";
+in
+stdenv.mkDerivation rec {
+  pname = "build2";
+  version = "0.17.0";
+
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+    "man"
+  ];
+
+  setupHook = ./setup-hook.sh;
+
+  src = fetchurl {
+    url = "https://pkg.cppget.org/1/alpha/build2/build2-${version}.tar.gz";
+    hash = "sha256-Kx5X/GV3GjFSbjo1mzteiHnnm4mr6+NAKIR/mEE+IdA=";
+  };
+
+  patches = [
+    # Remove any build/host config entries which refer to nix store paths
+    ./remove-config-store-paths.patch
+    # Pick up sysdirs from NIX_LDFLAGS
+    ./nix-ldflags-sysdirs.patch
+  ];
+
+  strictDeps = true;
+  nativeBuildInputs = [
+    build2
+  ];
+  disallowedReferences = [
+    build2
+    libbutl.dev
+    libpkgconf.dev
+  ];
+  buildInputs = [
+    libbutl
+    libpkgconf
+  ];
+
+  # Build2 uses @rpath on darwin
+  # https://github.com/build2/build2/issues/166
+  # N.B. this only adjusts the install_name after all libraries are installed;
+  # packages containing multiple interdependent libraries may have
+  # LC_LOAD_DYLIB entries containing @rpath, requiring manual fixup
+  propagatedBuildInputs = lib.optionals stdenv.targetPlatform.isDarwin [
+    fixDarwinDylibNames
+
+    # Build2 needs to use lld on Darwin because it creates thin archives when it detects `llvm-ar`,
+    # which ld64 does not support.
+    (lib.getBin buildPackages.llvmPackages.lld)
+  ];
+
+  postPatch = ''
+    patchShebangs --build tests/bash/testscript
+  '';
+
+  build2ConfigureFlags = [
+    "config.bin.lib=${configSharedStatic enableShared enableStatic}"
+    "config.cc.poptions+=-I${lib.getDev libpkgconf}/include/pkgconf"
+    "config.build2.libpkgconf=true"
+  ];
+
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    install_name_tool -add_rpath "''${!outputLib}/lib" "''${!outputBin}/bin/b"
+  '';
+
+  postFixup = ''
+    substituteInPlace $dev/nix-support/setup-hook \
+      --subst-var-by isTargetDarwin '${toString stdenv.targetPlatform.isDarwin}'
+  '';
+
+  passthru = {
+    bootstrap = build2;
+    inherit configSharedStatic;
+  };
+
+  meta = with lib; {
+    homepage = "https://www.build2.org/";
+    description = "Build2 build system";
+    license = licenses.mit;
+    longDescription = ''
+      build2 is an open source (MIT), cross-platform build toolchain
+      that aims to approximate Rust Cargo's convenience for developing
+      and packaging C/C++ projects while providing more depth and
+      flexibility, especially in the build system.
+
+      build2 is a hierarchy of tools consisting of a general-purpose
+      build system, package manager (for package consumption), and
+      project manager (for project development). It is primarily aimed
+      at C/C++ projects as well as mixed-language projects involving
+      one of these languages (see bash and rust modules, for example).
+    '';
+    changelog = "https://git.build2.org/cgit/build2/tree/NEWS";
+    platforms = platforms.all;
+    maintainers = with maintainers; [
+      hiro98
+      r-burns
+    ];
+    mainProgram = "b";
+  };
+}

pkgs/development/tools/build-managers/build2/nix-ldflags-sysdirs.patch

@@ -0,0 +1,42 @@
+diff --git a/libbuild2/cc/common.cxx b/libbuild2/cc/common.cxx
+index f848003c..0f14f9a5 100644
+--- a/libbuild2/cc/common.cxx
++++ b/libbuild2/cc/common.cxx
+@@ -966,6 +966,17 @@ namespace build2
+     void
+     msvc_extract_library_search_dirs (const strings&, dir_paths&); // msvc.cxx
+ 
++    static strings split (const string& s, const char delim) {
++      stringstream ss (s);
++      string item;
++      strings result;
++
++      while (getline (ss, item, delim)) {
++        result.push_back (item);
++      }
++      return result;
++    }
++
+     dir_paths common::
+     extract_library_search_dirs (const scope& bs) const
+     {
+@@ -987,8 +998,19 @@ namespace build2
+           msvc_extract_library_search_dirs (v, r);
+         else
+           gcc_extract_library_search_dirs (v, r);
++
+       };
+ 
++      // NIX_LDFLAGS are implicitly used when linking,
++      // so its -L flags effectively specify system dirs.
++      // However, they are only enabled when actually linking and are thus
++      // not detected by build2, so we need to manually pick them up here.
++      if (auto s = getenv ("NIX_LDFLAGS")) {
++        // TODO: do we need more robust args splitting here? e.g. shlex.split
++        auto args = split (s.value (), ' ');
++        gcc_extract_library_search_dirs (args, r);
++      }
++
+       // Note that the compiler mode options are in sys_lib_dirs.
+       //
+       if (auto l = bs[c_loptions]) extract (*l, c_loptions);

pkgs/development/tools/build-managers/build2/remove-config-store-paths.patch

@@ -0,0 +1,14 @@
+--- a/libbuild2/buildfile
++++ b/libbuild2/buildfile
+@@ -86,8 +86,11 @@ build2_config_lines = [strings]
+ host_config_lines = [strings]
+ 
+ for l: $regex.replace_lines(                                                   \
++  $regex.replace_lines(                                                        \
+   $config.save(),                                                              \
+   '^( *(#|(config\.(test[. ]|dist\.|install\.chroot|config\.hermetic))).*|)$', \
++  [null], return_lines),                                                       \
++  '^.*'$getenv(NIX_STORE)'/[a-z0-9]{32}-.*$',                                  \
+   [null])
+ {
+   build2_config_lines += $l

pkgs/development/tools/build-managers/build2/setup-hook.sh

@@ -0,0 +1,91 @@
+# shellcheck shell=bash
+
+build2ConfigurePhase() {
+    runHook preConfigure
+
+    local flagsArray=(
+        "config.c=$CC"
+        "config.cxx=$CXX"
+        "config.cc.coptions+=-O2"
+        "config.cc.poptions+=-DNDEBUG"
+        "config.install.root=$prefix"
+        "config.install.bin=${!outputBin}/bin"
+        "config.install.doc=${!outputDoc}/share/doc/${shareDocName}"
+        "config.install.exec_root=${!outputBin}"
+        "config.install.include=${!outputInclude}/include"
+        "config.install.lib=${!outputLib}/lib"
+        "config.install.libexec=${!outputLib}/libexec"
+        "config.install.man=${!outputDoc}/share/man"
+        "config.install.sbin=${!outputBin}/sbin"
+        "config.install.bin.mode=755"
+    )
+    concatTo flagsArray build2ConfigureFlags build2ConfigureFlagsArray
+
+    # shellcheck disable=SC2157
+    if [ -n "@isTargetDarwin@" ]; then
+        flagsArray+=("config.bin.ld=ld64-lld")
+        flagsArray+=("config.cc.loptions+=-fuse-ld=lld")
+        flagsArray+=("config.cc.loptions+=-headerpad_max_install_names")
+    fi
+
+    echo 'configure flags' "${flagsArray[@]}"
+
+    b configure "${flagsArray[@]}"
+
+    runHook postConfigure
+}
+
+build2BuildPhase() {
+    runHook preBuild
+
+    local flagsArray=()
+    concatTo flagsArray build2BuildFlags build2BuildFlagsArray
+
+    echo 'build flags' "${flagsArray[@]}"
+    b "${flagsArray[@]}"
+
+    runHook postBuild
+}
+
+build2CheckPhase() {
+    runHook preCheck
+
+    local flagsArray=()
+    concatTo flagsArray build2CheckFlags build2CheckFlags
+
+    echo 'check flags' "${flagsArray[@]}"
+
+    b test "${build2Dir:-.}" "${flagsArray[@]}"
+
+    runHook postCheck
+}
+
+build2InstallPhase() {
+    runHook preInstall
+
+    local flagsArray=()
+    concatTo flagsArray build2InstallFlags build2InstallFlagsArray installTargets
+
+    echo 'install flags' "${flagsArray[@]}"
+    b install "${flagsArray[@]}"
+
+    runHook postInstall
+}
+
+if [ -z "${dontUseBuild2Configure-}" ] && [ -z "${configurePhase-}" ]; then
+    # shellcheck disable=SC2034
+    setOutputFlags=
+    configurePhase=build2ConfigurePhase
+fi
+
+if [ -z "${dontUseBuild2Build-}" ] && [ -z "${buildPhase-}" ]; then
+    buildPhase=build2BuildPhase
+fi
+
+if [ -z "${dontUseBuild2Check-}" ] && [ -z "${checkPhase-}" ]; then
+    checkPhase=build2CheckPhase
+fi
+
+if [ -z "${dontUseBuild2Install-}" ] && [ -z "${installPhase-}" ]; then
+    installPhase=build2InstallPhase
+fi

pkgs/development/tools/build-managers/drake/Gemfile

@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'drake'

pkgs/development/tools/build-managers/drake/Gemfile.lock

@@ -0,0 +1,15 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    comp_tree (1.1.3)
+    drake (0.9.2.0.3.1)
+      comp_tree (>= 1.1.3)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  drake
+
+BUNDLED WITH
+   2.1.4

pkgs/development/tools/build-managers/drake/default.nix

@@ -0,0 +1,25 @@
+{
+  lib,
+  bundlerApp,
+  bundlerUpdateScript,
+}:
+
+bundlerApp {
+  pname = "drake";
+  gemdir = ./.;
+  exes = [ "drake" ];
+
+  passthru.updateScript = bundlerUpdateScript "drake";
+
+  meta = with lib; {
+    description = "Branch of Rake supporting automatic parallelizing of tasks";
+    homepage = "http://quix.github.io/rake/";
+    maintainers = with maintainers; [
+      romildo
+      manveru
+      nicknovitski
+    ];
+    license = licenses.mit;
+    platforms = platforms.unix;
+  };
+}

pkgs/development/tools/build-managers/drake/gemset.nix

@@ -0,0 +1,23 @@
+{
+  comp_tree = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0dj9lkfxcczn67l1j12dcxswrfxxd1zgxa344zk6vqs2gwwhy9m9";
+      type = "gem";
+    };
+    version = "1.1.3";
+  };
+  drake = {
+    dependencies = [ "comp_tree" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "09gkmdshwdmdnkdxi03dv4rk1dip0wdv6dx14wscrmi0jyk86yag";
+      type = "gem";
+    };
+    version = "0.9.2.0.3.1";
+  };
+}

pkgs/development/tools/build-managers/gnumake/default.nix

@@ -0,0 +1,79 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoreconfHook,
+  guileSupport ? false,
+  guile,
+  # avoid guile depend on bootstrap to prevent dependency cycles
+  inBootstrap ? false,
+  pkg-config,
+  gnumake,
+}:
+
+let
+  guileEnabled = guileSupport && !inBootstrap;
+in
+
+stdenv.mkDerivation rec {
+  pname = "gnumake";
+  version = "4.4.1";
+
+  src = fetchurl {
+    url = "mirror://gnu/make/make-${version}.tar.gz";
+    sha256 = "sha256-3Rb7HWe/q3mnL16DkHNcSePo5wtJRaFasfgd23hlj7M=";
+  };
+
+  # To update patches:
+  #  $ version=4.4.1
+  #  $ git clone https://git.savannah.gnu.org/git/make.git
+  #  $ cd make && git checkout -b nixpkgs $version
+  #  $ git am --directory=../patches
+  #  $ # make changes, resolve conflicts, etc.
+  #  $ git format-patch --output-directory ../patches --diff-algorithm=histogram $version
+  #
+  # TODO: stdenv’s setup.sh should be aware of patch directories. It’s very
+  # convenient to keep them in a separate directory but we can defer listing the
+  # directory until derivation realization to avoid unnecessary Nix evaluations.
+  patches = lib.filesystem.listFilesRecursive ./patches;
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+  buildInputs = lib.optionals guileEnabled [ guile ];
+
+  configureFlags = lib.optional guileEnabled "--with-guile";
+
+  outputs = [
+    "out"
+    "man"
+    "info"
+  ];
+  separateDebugInfo = true;
+
+  passthru.tests = {
+    # make sure that the override doesn't break bootstrapping
+    gnumakeWithGuile = gnumake.override { guileSupport = true; };
+  };
+
+  meta = with lib; {
+    description = "Tool to control the generation of non-source files from sources";
+    longDescription = ''
+      Make is a tool which controls the generation of executables and
+      other non-source files of a program from the program's source files.
+
+      Make gets its knowledge of how to build your program from a file
+      called the makefile, which lists each of the non-source files and
+      how to compute it from other files. When you write a program, you
+      should write a makefile for it, so that it is possible to use Make
+      to build and install the program.
+    '';
+    homepage = "https://www.gnu.org/software/make/";
+
+    license = licenses.gpl3Plus;
+    maintainers = [ ];
+    mainProgram = "make";
+    platforms = platforms.all;
+  };
+}

pkgs/development/tools/build-managers/gnumake/patches/0001-No-impure-bin-sh.patch

@@ -0,0 +1,35 @@
+From b69e3740e68afaec97b9957d40b9c135db87eaab Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Sat, 24 Apr 2021 10:11:40 +0200
+Subject: [PATCH 1/3] No impure bin sh
+
+default_shell is used to populuate default shell used to execute jobs.
+Unless SHELL is set to a different value this would be /bin/sh.
+Our stdenv provides sh in form of bash anyway. Having this value not
+hard-coded has some advantages:
+
+- It would ensure that on all systems it uses sh from its PATH rather
+  than /bin/sh, which helps as different systems might have different
+  shells there (bash vs. dash)
+- In the past I had issues with LD_PRELOAD with BEAR, where /bin/sh
+  used a different glibc than BEAR which came from my development shell.
+---
+ src/job.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/job.c b/src/job.c
+index ea885614..8a9bd8e0 100644
+--- a/src/job.c
++++ b/src/job.c
+@@ -76,7 +76,7 @@ char * vms_strsignal (int status);
+ 
+ #else
+ 
+-const char *default_shell = "/bin/sh";
++const char *default_shell = "sh";
+ int batch_mode_shell = 0;
+ 
+ #endif
+-- 
+2.44.1
+

pkgs/development/tools/build-managers/gnumake/patches/0002-Remove-impure-dirs.patch

@@ -0,0 +1,44 @@
+From 2db52008be2e2d504889f4f19318c2ba5a2a4797 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Sat, 24 Apr 2021 10:20:16 +0200
+Subject: [PATCH 2/3] Remove impure dirs
+
+Purity: don't look for library dependencies (of the form `-lfoo') in
+/lib and /usr/lib. It's a stupid feature anyway. Likewise, when
+searching for included Makefiles, don't look in /usr/include and
+friends.
+---
+ src/read.c   | 3 ---
+ src/remake.c | 2 --
+ 2 files changed, 5 deletions(-)
+
+diff --git a/src/read.c b/src/read.c
+index b0fc1e1f..d6b41c17 100644
+--- a/src/read.c
++++ b/src/read.c
+@@ -111,9 +111,6 @@ static const char *default_include_directories[] =
+     INCLUDEDIR,
+ #endif
+ #ifndef _AMIGA
+-    "/usr/gnu/include",
+-    "/usr/local/include",
+-    "/usr/include",
+ #endif
+     0
+   };
+diff --git a/src/remake.c b/src/remake.c
+index fe67ab28..1b76560c 100644
+--- a/src/remake.c
++++ b/src/remake.c
+@@ -1690,8 +1690,6 @@ library_search (const char *lib, FILE_TIMESTAMP *mtime_ptr)
+   static const char *dirs[] =
+     {
+ #ifndef _AMIGA
+-      "/lib",
+-      "/usr/lib",
+ #endif
+ #if defined(WINDOWS32) && !defined(LIBDIR)
+ /*
+-- 
+2.44.1
+

pkgs/development/tools/build-managers/gnumake/patches/0003-Do-not-search-for-a-C-compiler-and-set-MAKE_CXX.patch

@@ -0,0 +1,83 @@
+From 3317b3a78666e6073c63f62a322176e3dc680461 Mon Sep 17 00:00:00 2001
+From: Ivan Trubach <mr.trubach@icloud.com>
+Date: Sat, 17 Aug 2024 22:35:03 +0300
+Subject: [PATCH 3/3] Do not search for a C++ compiler and set MAKE_CXX
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Removes unnecessary reference to C++ compiler if CXX is set to an
+absolute path. If CXX is not an absolute path, we avoid defaulting CXX
+to a compiler name that was used to build the package.
+
+Context: GNU Make defines default values for CC, CXX and other
+environment variables. For CXX, it usually defaults to g++, however,
+FreeBSD and OpenBSD no longer ship GCC as a system compiler (and use
+Clang instead). For C compiler, POSIX standardizes the name to be "cc",
+but there is no such standard for C++ compiler name. As a fix, GNU Make
+uses CXX set for build as a default (via MAKE_CXX preprocessor macro in
+the source code).
+
+We revert the change that added this behavior and set the default to c++
+or g++ that does not depend on the build platform.
+
+In stdenv, CXX environment variable is always defined and overrides the
+default value.
+
+References:
+ • https://savannah.gnu.org/bugs/?63668
+ • https://git.savannah.gnu.org/cgit/make.git/commit/?id=ffa28f3914ff402b3915f75e4fed86ac6fb1449d
+---
+ configure.ac  |  2 --
+ src/default.c | 19 ++++++-------------
+ 2 files changed, 6 insertions(+), 15 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index cd785754..41a65307 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -37,8 +37,6 @@ AM_INIT_AUTOMAKE([1.16.1 foreign -Werror -Wall])
+ # Checks for programs.
+ AC_USE_SYSTEM_EXTENSIONS
+ AC_PROG_CC
+-AC_PROG_CXX
+-AC_DEFINE_UNQUOTED(MAKE_CXX, ["$CXX"], [Default C++ compiler.])
+ 
+ # Configure gnulib
+ gl_EARLY
+diff --git a/src/default.c b/src/default.c
+index e396269b..78ba402f 100644
+--- a/src/default.c
++++ b/src/default.c
+@@ -528,22 +528,15 @@ static const char *default_variables[] =
+ #ifdef GCC_IS_NATIVE
+     "CC", "gcc",
+     "OBJC", "gcc",
++# ifdef __MSDOS__
++    "CXX", "gpp",       /* g++ is an invalid name on MSDOS */
++# else
++    "CXX", "g++",
++# endif /* __MSDOS__ */
+ #else
+     "CC", "cc",
+     "OBJC", "cc",
+-#endif
+-#ifdef MAKE_CXX
+-    "CXX", MAKE_CXX,
+-#else
+-# ifdef GCC_IS_NATIVE
+-#  ifdef __MSDOS__
+-    "CXX", "gpp",       /* g++ is an invalid name on MSDOS */
+-#  else
+-    "CXX", "gcc",
+-#  endif /* __MSDOS__ */
+-# else
+-    "CXX", "g++",
+-# endif
++    "CXX", "c++",
+ #endif
+     /* This expands to $(CO) $(COFLAGS) $< $@ if $@ does not exist,
+        and to the empty string if $@ does exist.  */
+-- 
+2.44.1
+

pkgs/development/tools/build-managers/gradle/README.md

@@ -0,0 +1,245 @@
+# Gradle Setup Hook
+
+## Introduction
+
+Gradle build scripts are written in a DSL, computing the list of Gradle
+dependencies is a Turing-complete task, not just in theory but also in
+practice. Fetching all of the dependencies often requires building some
+native code, running some commands to check the host platform, or just
+fetching some files using either JVM code or commands like `curl` or
+`wget`.
+
+This practice is widespread and isn't considered a bad practice in the
+Java world, so all we can do is run Gradle to check what dependencies
+end up being fetched, and allow derivation authors to apply workarounds
+so they can run the code necessary for fetching the dependencies our
+script doesn't fetch.
+
+"Run Gradle to check what dependencies end up being fetched" isn't a
+straightforward task. For example, Gradle usually uses Maven
+repositories, which have features such as "snapshots", a way to always
+use the latest version of a dependency as opposed to a fixed version.
+Obviously, this is horrible for reproducibility. Additionally, Gradle
+doesn't offer a way to export the list of dependency URLs and hashes (it
+does in a way, but it's far from being complete, and as such is useless
+for Nixpkgs). Even if it did, it would be annoying to use considering
+fetching non-Gradle dependencies in Gradle scripts is commonplace.
+
+That's why the setup hook uses mitm-cache, a program designed for
+intercepting all HTTP requests, recording all the files that were
+accessed, creating a Nix derivation with all of them, and then allowing
+the Gradle derivation to access these files.
+
+## Maven Repositories
+
+(Reference: [Repository
+Layout](https://cwiki.apache.org/confluence/display/MAVENOLD/Repository+Layout+-+Final))
+
+Most of Gradle dependencies are fetched from Maven repositories. For
+each dependency, Gradle finds the first repo where it can successfully
+fetch that dependency, and uses that repo for it. Different repos might
+actually return different files for the same artifact because of e.g.
+pom normalization. Different repos may be used for the same artifact
+even across a single package (for example, if two build scripts define
+repositories in a different order).
+
+The artifact metadata is specified in a .pom file, and the artifacts
+themselves are typically .jar files. The URL format is as follows:
+
+`<repo>/<group-id>/<artifact-id>/<base-version>/<artifact-id>-<version>[-<classifier>].<ext>`
+
+For example:
+
+- `https://repo.maven.apache.org/maven2/org/slf4j/slf4j-api/2.0.9/slf4j-api-2.0.9.pom`
+- `https://oss.sonatype.org/content/groups/public/com/tobiasdiez/easybind/2.2.1-SNAPSHOT/easybind-2.2.1-20230117.075740-16.pom`
+
+Where:
+
+- `<repo>` is the repo base (`https://repo.maven.apache.org/maven2`)
+- `<group-id>` is the group ID with dots replaced with slashes
+  (`org.slf4j` -> `org/slf4j`)
+- `<artifact-id>` is the artifact ID (`slf4j-api`)
+- `<base-version>` is the artifact version (`2.0.9` for normal
+  artifacts, `2.2.1-SNAPSHOT` for snapshots)
+- `<version>` is the artifact version - can be either `<base-version>`
+  or `<version-base>-<timestamp>-<build-num>` (`2.0.9` for normal
+  artifacts, and either `2.2.1-SNAPSHOT` or `2.2.1-20230117.075740-16`
+  for snapshots)
+  - `<version-base>` - `<base-version>` without the `-SNAPSHOT` suffix
+  - `<timestamp>` - artifact build timestamp in the `YYYYMMDD.HHMMSS`
+    format (UTC)
+  - `<build-num>` - a counter that's incremented by 1 for each new
+    snapshot build
+- `<classifier>` is an optional classifier for allowing a single .pom to
+  refer to multiple .jar files. .pom files don't have classifiers, as
+  they describe metadata.
+- `<ext>` is the extension. .pom
+
+Note that the artifact ID can contain `-`, so you can't extract the
+artifact ID and version from just the file name.
+
+Additionally, the files in the repository may have associated signature
+files, formed by appending `.asc` to the filename, and hashsum files,
+formed by appending `.md5` or `.sha1` to the filename. The signatures
+are harmless, but the `.md5`/`.sha1` files are rejected.
+
+The reasoning is as follows - consider two files `a.jar` and `b.jar`,
+that have the same hash. Gradle will fetch `a.jar.sha1`, find out that
+it hasn't yet downloaded a file with this hash, and then fetch `a.jar`,
+and finally download `b.jar.sha1`, locate it in its cache, and then
+*not* download `b.jar`. This means `b.jar` won't be stored in the MITM
+cache. Then, consider that on a later invocation, the fetching order
+changed, whether it was because of running on a different system,
+changed behavior after a Gradle update, or any other source of
+nondeterminism - `b.jar` is fetched before `a.jar`. Gradle will first
+fetch `b.jar.sha1`, not find it in its cache, attempt to fetch `b.jar`,
+and fail, as the cache doesn't have that file.
+
+For the same reason, the proxy strips all checksum/etag headers. An
+alternative would be to make the proxy remember previous checksums and
+etags, but that would complicate the implementation - however, such a
+feature can be implemented if necessary. Note that checksum/etag header
+stripping is hardcoded, but `.md5/.sha1` file rejection is configured
+via CLI arguments.
+
+**Caveat**: Gradle .module files also contain file hashes, in md5, sha1,
+sha256, sha512 formats. It has posed no problem as of yet, but it might in
+the future. If it does pose problems, the deps derivation code can be
+extended to find all checksums in .module files and copy existing files
+there if their hash matches.
+
+## Snapshots
+
+Snapshots are a way to publish the very latest, unstable version of a
+dependency that constantly changes. Any project that depends on a
+snapshot will depend on this rolling version, rather than a fixed
+version. It's easy to understand why this is a bad idea for reproducible
+builds. Still, they can be dealt with by the logic in `gradle.fetchDeps`
+and `gradle.updateDeps`.
+
+First, as you can see above, while normal artifacts have the same
+`base-version` and `version`, for snapshots it usually (but not
+necessarily) differs.
+
+Second, for figuring out where to download the snapshot, Gradle consults
+`maven-metadata.xml`. With that in mind...
+
+## Maven Metadata
+
+(Reference: [Maven
+Metadata](https://maven.apache.org/repositories/metadata.html),
+[Metadata](https://maven.apache.org/ref/3.9.8/maven-repository-metadata/repository-metadata.html)
+
+Maven metadata files are called `maven-metadata.xml`.
+
+There are three levels of metadata: "G level", "A level", "V level",
+representing group, artifact, or version metadata.
+
+G level metadata is currently unsupported. It's only used for Maven
+plugins, which Gradle presumably doesn't use.
+
+A level metadata is used for getting the version list for an artifact.
+It's an xml with the following items:
+
+- `<groupId>` - group ID
+- `<artifactId>` - artifact ID
+- `<versioning>`
+  - `<latest>` - the very latest base version (e.g. `2.2.1-SNAPSHOT`)
+  - `<release>` - the latest non-snapshot version
+  - `<versions>` - the version list, each in a `<version>` tag
+  - `<lastUpdated>` - the metadata update timestamp (UTC,
+    `YYYYMMDDHHMMSS`)
+
+V level metadata is used for listing the snapshot versions. It has the
+following items:
+
+- `<groupId>` - group ID
+- `<artifactId>` - artifact ID
+- `<versioning>`
+  - `<lastUpdated>` - the metadata update timestamp (UTC,
+    `YYYYMMDDHHMMSS`)
+  - `<snapshot>` - info about the latest snapshot version
+    - `<timestamp>` - build timestamp (UTC, `YYYYMMDD.HHMMSS`)
+    - `<buildNumber>` - build number
+  - `<snapshotVersions>` - the list of all available snapshot file info,
+    each info is enclosed in a `<snapshotVersion>`
+    - `<classifier>` - classifier (optional)
+    - `<extension>` - file extension
+    - `<value>` - snapshot version (as opposed to base version)
+    - `<updated>` - snapshot build timestamp (UTC, `YYYYMMDDHHMMSS`)
+
+## Lockfile Format
+
+The mitm-cache lockfile format is described in the [mitm-cache
+README](https://github.com/chayleaf/mitm-cache#readme).
+
+The Nixpkgs Gradle lockfile format is more complicated:
+
+```json
+{
+  "!comment": "This is a Nixpkgs Gradle dependency lockfile. For more details, refer to the Gradle section in the Nixpkgs manual.",
+  "!version": 1,
+  "https://oss.sonatype.org/content/repositories/snapshots/com/badlogicgames/gdx-controllers": {
+    "gdx-controllers#gdx-controllers-core/2.2.4-20231021.200112-6/SNAPSHOT": {
+
+      "jar": "sha256-Gdz2J1IvDJFktUD2XeGNS0SIrOyym19X/+dCbbbe3/U=",
+      "pom": "sha256-90QW/Mtz1jbDUhKjdJ88ekhulZR2a7eCaEJoswmeny4="
+    },
+    "gdx-controllers-core/2.2.4-SNAPSHOT/maven-metadata": {
+      "xml": {
+        "groupId": "com.badlogicgames.gdx-controllers"
+      }
+    }
+  },
+  "https://repo.maven.apache.org/maven2": {
+    "com/badlogicgames/gdx#gdx-backend-lwjgl3/1.12.1": {
+      "jar": "sha256-B3OwjHfBoHcJPFlyy4u2WJuRe4ZF/+tKh7gKsDg41o0=",
+      "module": "sha256-9O7d2ip5+E6OiwN47WWxC8XqSX/mT+b0iDioCRTTyqc=",
+      "pom": "sha256-IRSihaCUPC2d0QzB0MVDoOWM1DXjcisTYtnaaxR9SRo="
+    }
+  }
+}
+```
+
+`!comment` is a human-readable description explaining what the file is,
+`!version` is the lockfile version (note that while it shares the name
+with mitm-cache's `!version`, they don't actually have to be in sync and
+can be bumped separately).
+
+The other keys are parts of a URL. Each URL is split into three parts.
+They are joined like this: `<part1>/<part2>.<part3>`.
+
+Some URLs may have a `#` in them. In that case, the part after `#` is
+parsed as `#<artifact-id>/<version>[/SNAPSHOT][/<classifier>].<ext>` and
+expanded into
+`<artifact-id>/<base-version>/<artifact-id>-<version>[-<classifier>].<ext>`.
+
+Each URL has a value associated with it. The value may be:
+
+- an SRI hash (string)
+- for `maven-metadata.xml` - an attrset containing the parts of the
+  metadata that can't be generated in Nix code (e.g. `groupId`, which is
+  challenging to parse from a URL because it's not always possible to
+  discern where the repo base ends and the group ID begins).
+
+`compress-deps-json.py` converts the JSON from mitm-cache format into
+Nixpkgs Gradle lockfile format. `fetch.nix` does the opposite.
+
+## Security Considerations
+
+Lockfiles won't be human-reviewed. They must be tampering-resistant.
+That's why it's imperative that nobody can inject their own contents
+into the lockfiles.
+
+This is achieved in a very simple way - the `deps.json` only contains
+the following:
+
+- `maven-metadata.xml` URLs and small pieces of the contained metadata
+  (most of it will be generated in Nix, i.e. the area of injection is
+  minimal, and the parts that aren't generated in Nix are validated).
+- artifact/other file URLs and associated hashes (Nix will complain if
+  the hash doesn't match, and Gradle won't even access the URL if it
+  doesn't match)
+
+Please be mindful of the above when working on Gradle support for
+Nixpkgs.

pkgs/development/tools/build-managers/gradle/compress-deps-json.py

@@ -0,0 +1,163 @@
+import json
+import sys
+
+from typing import Dict, Set
+
+# this compresses MITM URL lists with Gradle-specific optimizations
+# specifically, it splits each url into up to 3 parts - they will be
+# concatenated like part1/part2.part3 or part1.part2
+# part3 is simply always the file extension, but part1 and part2 is
+# optimized using special heuristics
+# additionally, if part2 ends with /a/b/{a}-{b}, the all occurences of
+# /{a}/{b}/ are replaced with #
+# finally, anything that ends with = is considered SHA256, anything that
+# starts with http is considered a redirect URL, anything else is
+# considered text
+
+with open(sys.argv[1], "rt") as f:
+    data: dict = json.load(f)
+
+new_data: Dict[str, Dict[str, Dict[str, dict]]] = {}
+
+for url, info in data.items():
+    if url == "!version":
+        continue
+    ext, base = map(lambda x: x[::-1], url[::-1].split(".", 1))
+    if base.endswith(".tar"):
+        base = base[:-4]
+        ext = "tar." + ext
+    # special logic for Maven repos
+    if ext in ["jar", "pom", "module"]:
+        comps = base.split("/")
+        if "-" in comps[-1]:
+            # convert base/name/ver/name-ver into base#name/ver
+
+            filename = comps[-1]
+            name = comps[-3]
+            basever = comps[-2]
+            ver = basever
+            is_snapshot = ver.endswith("-SNAPSHOT")
+            if is_snapshot:
+                ver = ver.removesuffix("-SNAPSHOT")
+            if filename.startswith(f"{name}-{ver}"):
+                if is_snapshot:
+                    if filename.startswith(f"{name}-{ver}-SNAPSHOT"):
+                        ver += "-SNAPSHOT"
+                    else:
+                        ver += "-".join(
+                            filename.removeprefix(f"{name}-{ver}").split("-")[:3]
+                        )
+                comp_end = comps[-1].removeprefix(f"{name}-{ver}")
+            else:
+                ver, name, comp_end = None, None, None
+            if name and ver and (not comp_end or comp_end.startswith("-")):
+                base = "/".join(comps[:-1]) + "/"
+                base = base.replace(f"/{name}/{basever}/", "#")
+                base += f"{name}/{ver}"
+                if is_snapshot:
+                    base += "/SNAPSHOT"
+                if comp_end:
+                    base += "/" + comp_end[1:]
+    scheme, rest = base.split("/", 1)
+    if scheme not in new_data.keys():
+        new_data[scheme] = {}
+    if rest not in new_data[scheme].keys():
+        new_data[scheme][rest] = {}
+    if "hash" in info.keys():
+        new_data[scheme][rest][ext] = info["hash"]
+    elif "text" in info.keys() and ext == "xml":
+        # nix code in fetch-deps.nix will autogenerate metadata xml files groupId
+        # is part of the URL, but it can be tricky to parse as we don't know the
+        # exact repo base, so take it from the xml and pass it to nix
+        xml = "".join(info["text"].split())
+        new_data[scheme][rest][ext] = {
+            "groupId": xml.split("<groupId>")[1].split("</groupId>")[0],
+        }
+        if "<release>" in xml:
+            new_data[scheme][rest][ext]["release"] = xml.split("<release>")[1].split(
+                "</release>"
+            )[0]
+        if "<latest>" in xml:
+            latest = xml.split("<latest>")[1].split("</latest>")[0]
+            if latest != new_data[scheme][rest][ext].get("release"):
+                new_data[scheme][rest][ext]["latest"] = latest
+        if "<lastUpdated>" in xml:
+            new_data[scheme][rest][ext]["lastUpdated"] = xml.split("<lastUpdated>")[
+                1
+            ].split("</lastUpdated>")[0]
+    else:
+        raise Exception("Unsupported key: " + repr(info))
+
+# At this point, we have a map by part1 (initially the scheme), part2 (initially a
+# slash-separated string without the scheme and with potential # substitution as
+# seen above), extension.
+# Now, push some segments from "part2" into "part1" like this:
+#  https # part1
+#   domain1/b # part2
+#   domain1/c
+#   domain2/a
+#   domain2/c
+# ->
+#  https/domain1 # part1
+#   b # part2
+#   c
+#  https/domain2 # part1
+#   a # part2
+#   c
+# This helps reduce the lockfile size because a Gradle project will usually use lots
+# of files from a single Maven repo
+
+data = new_data
+changed = True
+while changed:
+    changed = False
+    new_data = {}
+    for part1, info1 in data.items():
+        starts: Set[str] = set()
+        # by how many bytes the file size will be increased (roughly)
+        lose = 0
+        # by how many bytes the file size will be reduced (roughly)
+        win = 0
+        # how many different initial part2 segments there are
+        count = 0
+        for part2, info2 in info1.items():
+            if "/" not in part2:
+                # can't push a segment from part2 into part1
+                count = 0
+                break
+            st = part2.split("/", 1)[0]
+            if st not in starts:
+                lose += len(st) + 1
+                count += 1
+                starts.add(st)
+            win += len(st) + 1
+        if count == 0:
+            new_data[part1] = info1
+            continue
+        # only allow pushing part2 segments into path1 if *either*:
+        # - the domain isn't yet part of part1
+        # - the initial part2 segment is always the same
+        if count != 1 and "." in part1:
+            new_data[part1] = info1
+            continue
+        # some heuristics that may or may not work well (originally this was
+        # used when the above if wasn't here, but perhaps it's useless now)
+        lose += (count - 1) * max(0, len(part1) - 4)
+        if win > lose or ("." not in part1 and win >= lose):
+            changed = True
+            for part2, info2 in info1.items():
+                st, part3 = part2.split("/", 1)
+                new_part1 = part1 + "/" + st
+                if new_part1 not in new_data.keys():
+                    new_data[new_part1] = {}
+                new_data[new_part1][part3] = info2
+        else:
+            new_data[part1] = info1
+    data = new_data
+
+new_data["!comment"] = "This is a nixpkgs Gradle dependency lockfile. For more details, refer to the Gradle section in the nixpkgs manual."  # type: ignore
+new_data["!version"] = 1  # type: ignore
+
+with open(sys.argv[2], "wt") as f:
+    json.dump(new_data, f, sort_keys=True, indent=1)
+    f.write("\n")

pkgs/development/tools/build-managers/gradle/default.nix

@@ -0,0 +1,349 @@
+{
+  callPackage,
+  jdk11,
+  jdk17,
+  jdk21,
+}:
+
+let
+  wrapGradle =
+    {
+      lib,
+      callPackage,
+      mitm-cache,
+      replaceVars,
+      symlinkJoin,
+      concatTextFile,
+      makeSetupHook,
+      nix-update-script,
+
+      # This is the "current" version of gradle in nixpkgs.
+      # Used to define the update script.
+      gradle-unwrapped,
+
+      runCommand,
+    }:
+    this-gradle-unwrapped:
+    lib.makeOverridable (
+      args:
+      let
+        gradle = this-gradle-unwrapped.override args;
+      in
+      symlinkJoin {
+        pname = "gradle";
+        inherit (gradle) version;
+
+        paths = [
+          (makeSetupHook { name = "gradle-setup-hook"; } (concatTextFile {
+            name = "setup-hook.sh";
+            files = [
+              (mitm-cache.setupHook)
+              (replaceVars ./setup-hook.sh {
+                # jdk used for keytool
+                inherit (gradle) jdk;
+                init_script = "${./init-build.gradle}";
+              })
+            ];
+          }))
+          gradle
+          mitm-cache
+        ];
+
+        passthru = {
+          fetchDeps = callPackage ./fetch-deps.nix { inherit mitm-cache; };
+          inherit (gradle) jdk;
+          unwrapped = gradle;
+          tests = {
+            toolchains =
+              let
+                javaVersion = lib.getVersion jdk11;
+                javaMajorVersion = lib.versions.major javaVersion;
+              in
+              runCommand "detects-toolchains-from-nix-env"
+                {
+                  # Use JDKs that are not the default for any of the gradle versions
+                  nativeBuildInputs = [
+                    (gradle.override {
+                      javaToolchains = [
+                        jdk11
+                      ];
+                    })
+                  ];
+                  src = ./tests/toolchains;
+                }
+                ''
+                  cp -a $src/* .
+                  substituteInPlace ./build.gradle --replace-fail '@JAVA_VERSION@' '${javaMajorVersion}'
+                  env GRADLE_USER_HOME=$TMPDIR/gradle org.gradle.native.dir=$TMPDIR/native \
+                  gradle run --no-daemon --quiet --console plain > $out
+                  actual="$(<$out)"
+                  if [[ "${javaVersion}" != "$actual"* ]]; then
+                    echo "Error: Expected '${javaVersion}', to start with '$actual'" >&2
+                    exit 1
+                  fi
+                '';
+          }
+          // gradle.tests;
+        }
+        // lib.optionalAttrs (this-gradle-unwrapped == gradle-unwrapped) {
+          updateScript = nix-update-script {
+            extraArgs = [
+              "--url=https://github.com/gradle/gradle"
+              # Gradle’s .0 releases are tagged as `vX.Y.0`, but the actual
+              # release version omits the `.0`, so we’ll wanto to only capture
+              # the version up but not including the the trailing `.0`.
+              "--version-regex=^v(\\d+\\.\\d+(?:\\.[1-9]\\d?)?)(\\.0)?$"
+            ];
+          };
+        };
+
+        meta = gradle.meta // {
+          # prefer normal gradle/mitm-cache over this wrapper, this wrapper only provides the setup hook
+          # and passthru
+          priority = (gradle.meta.priority or lib.meta.defaultPriority) + 1;
+        };
+      }
+    ) { };
+
+  gen =
+    {
+      version,
+      hash,
+
+      # The default JDK/JRE that will be used for derived Gradle packages.
+      # A current LTS version of a JDK is a good choice.
+      defaultJava,
+
+      # The platforms supported by this Gradle package.
+      # Gradle Native-Platform ships some binaries that
+      # are compatible only with specific platforms.
+      # As of 2022-04 this affects platform compatibility
+      # of multiple Gradle releases, so this is used as default.
+      # See https://github.com/gradle/native-platform#supported-platforms
+      platforms ? [
+        "aarch64-darwin"
+        "aarch64-linux"
+        "i686-windows"
+        "x86_64-cygwin"
+        "x86_64-darwin"
+        "x86_64-linux"
+        "x86_64-windows"
+      ],
+
+      # Extra attributes to be merged into the resulting derivation's
+      # meta attribute.
+      meta ? { },
+    }@genArgs:
+
+    {
+      lib,
+      stdenv,
+      fetchurl,
+      callPackage,
+      makeWrapper,
+      unzip,
+      ncurses5,
+      ncurses6,
+      udev,
+      testers,
+      runCommand,
+      writeText,
+      autoPatchelfHook,
+      buildPackages,
+
+      # The JDK/JRE used for running Gradle.
+      java ? defaultJava,
+
+      # Additional JDK/JREs to be registered as toolchains.
+      # See https://docs.gradle.org/current/userguide/toolchains.html
+      javaToolchains ? [ ],
+    }:
+
+    stdenv.mkDerivation (finalAttrs: {
+      pname = "gradle";
+      inherit version;
+
+      src = fetchurl {
+        inherit hash;
+        url = "https://services.gradle.org/distributions/gradle-${version}-bin.zip";
+      };
+
+      dontBuild = true;
+
+      nativeBuildInputs = [
+        makeWrapper
+        unzip
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isLinux [
+        autoPatchelfHook
+      ];
+
+      buildInputs = [
+        stdenv.cc.cc
+        ncurses5
+        ncurses6
+      ];
+
+      # We only need to patchelf some libs embedded in JARs.
+      dontAutoPatchelf = true;
+
+      installPhase =
+        with builtins;
+        let
+          # set toolchains via installations.path property in gradle.properties.
+          # See https://docs.gradle.org/current/userguide/toolchains.html#sec:custom_loc
+          toolchainPaths = "org.gradle.java.installations.paths=${concatStringsSep "," javaToolchains}";
+          jnaLibraryPath = if stdenv.hostPlatform.isLinux then lib.makeLibraryPath [ udev ] else "";
+          jnaFlag =
+            if stdenv.hostPlatform.isLinux then "--add-flags \"-Djna.library.path=${jnaLibraryPath}\"" else "";
+        in
+        ''
+          mkdir -pv $out/lib/gradle/
+          cp -rv lib/ $out/lib/gradle/
+
+          gradle_launcher_jar=$(echo $out/lib/gradle/lib/gradle-launcher-*.jar)
+          test -f $gradle_launcher_jar
+          makeWrapper ${java}/bin/java $out/bin/gradle \
+            --set JAVA_HOME ${java} \
+            ${jnaFlag} \
+            --add-flags "-classpath $gradle_launcher_jar org.gradle.launcher.GradleMain"
+
+          echo "${toolchainPaths}" > $out/lib/gradle/gradle.properties
+        '';
+
+      dontFixup = !stdenv.hostPlatform.isLinux;
+
+      fixupPhase =
+        let
+          arch = if stdenv.hostPlatform.is64bit then "amd64" else "i386";
+          newFileEvents = toString (lib.versionAtLeast version "8.12");
+        in
+        ''
+          # get the correct jar executable for cross
+          export PATH="${buildPackages.jdk}/bin:$PATH"
+          . ${./patching.sh}
+
+          nativeVersion="$(extractVersion native-platform $out/lib/gradle/lib/native-platform-*.jar)"
+          for variant in "" "-ncurses5" "-ncurses6"; do
+            autoPatchelfInJar \
+              $out/lib/gradle/lib/native-platform-linux-${arch}$variant-''${nativeVersion}.jar \
+              "${lib.getLib stdenv.cc.cc}/lib64:${
+                lib.makeLibraryPath [
+                  stdenv.cc.cc
+                  ncurses5
+                  ncurses6
+                ]
+              }"
+          done
+
+          # The file-events library _seems_ to follow the native-platform version, but
+          # we won’t assume that.
+          if [ -n "${newFileEvents}" ]; then
+            fileEventsVersion="$(extractVersion gradle-fileevents $out/lib/gradle/lib/gradle-fileevents-*.jar)"
+            autoPatchelfInJar \
+              $out/lib/gradle/lib/gradle-fileevents-''${fileEventsVersion}.jar \
+              "${lib.getLib stdenv.cc.cc}/lib64:${lib.makeLibraryPath [ stdenv.cc.cc ]}"
+          else
+            fileEventsVersion="$(extractVersion file-events $out/lib/gradle/lib/file-events-*.jar)"
+            autoPatchelfInJar \
+              $out/lib/gradle/lib/file-events-linux-${arch}-''${fileEventsVersion}.jar \
+              "${lib.getLib stdenv.cc.cc}/lib64:${lib.makeLibraryPath [ stdenv.cc.cc ]}"
+          fi
+
+          # The scanner doesn't pick up the runtime dependency in the jar.
+          # Manually add a reference where it will be found.
+          mkdir $out/nix-support
+          echo ${stdenv.cc.cc} > $out/nix-support/manual-runtime-dependencies
+          # Gradle will refuse to start without _both_ 5 and 6 versions of ncurses.
+          echo ${ncurses5} >> $out/nix-support/manual-runtime-dependencies
+          echo ${ncurses6} >> $out/nix-support/manual-runtime-dependencies
+          ${lib.optionalString stdenv.hostPlatform.isLinux "echo ${udev} >> $out/nix-support/manual-runtime-dependencies"}
+        '';
+
+      passthru.tests = {
+        version = testers.testVersion {
+          package = finalAttrs.finalPackage;
+          command = ''
+            env GRADLE_USER_HOME=$TMPDIR/gradle org.gradle.native.dir=$TMPDIR/native \
+              gradle --version
+          '';
+        };
+
+        java-application = testers.testEqualContents {
+          assertion = "can build and run a trivial Java application";
+          expected = writeText "expected" "hello\n";
+          actual =
+            runCommand "actual"
+              {
+                nativeBuildInputs = [ finalAttrs.finalPackage ];
+                src = ./tests/java-application;
+              }
+              ''
+                cp -a $src/* .
+                env GRADLE_USER_HOME=$TMPDIR/gradle org.gradle.native.dir=$TMPDIR/native \
+                  gradle run --no-daemon --quiet --console plain > $out
+              '';
+        };
+      };
+      passthru.jdk = defaultJava;
+      passthru.wrapped = callPackage wrapGradle { } (gen' genArgs);
+
+      meta =
+        with lib;
+        {
+          inherit platforms;
+          description = "Enterprise-grade build system";
+          longDescription = ''
+            Gradle is a build system which offers you ease, power and freedom.
+            You can choose the balance for yourself. It has powerful multi-project
+            build support. It has a layer on top of Ivy that provides a
+            build-by-convention integration for Ivy. It gives you always the choice
+            between the flexibility of Ant and the convenience of a
+            build-by-convention behavior.
+          '';
+          homepage = "https://www.gradle.org/";
+          changelog = "https://docs.gradle.org/${version}/release-notes.html";
+          downloadPage = "https://gradle.org/next-steps/?version=${version}";
+          sourceProvenance = with sourceTypes; [
+            binaryBytecode
+            binaryNativeCode
+          ];
+          license = licenses.asl20;
+          maintainers = with maintainers; [
+            britter
+            liff
+            lorenzleutgeb
+          ];
+          teams = [ lib.teams.java ];
+          mainProgram = "gradle";
+        }
+        // meta;
+    });
+
+  # Calls the generated Gradle package with default arguments.
+  gen' = args: callPackage (gen args) { };
+in
+rec {
+  # NOTE: Default JDKs that are hardcoded below must be LTS versions
+  # and respect the compatibility matrix at
+  # https://docs.gradle.org/current/userguide/compatibility.html
+
+  gradle_9 = gen' {
+    version = "9.1.0";
+    hash = "sha256-oX3dhaJran9d23H/iwX8UQTAICxuZHgkKXkMkzaGyAY=";
+    defaultJava = jdk21;
+  };
+  gradle_8 = gen' {
+    version = "8.14.3";
+    hash = "sha256-vXEQIhNJMGCVbsIp2Ua+7lcVjb2J0OYrkbyg+ixfNTE=";
+    defaultJava = jdk21;
+  };
+  gradle_7 = gen' {
+    version = "7.6.6";
+    hash = "sha256-Zz2XdvMDvHBI/DMp0jLW6/EFGweJO9nRFhb62ahnO+A=";
+    defaultJava = jdk17;
+  };
+
+  # Default version of Gradle in nixpkgs.
+  gradle = gradle_8;
+}

pkgs/development/tools/build-managers/gradle/fetch-deps.nix

@@ -0,0 +1,277 @@
+{
+  mitm-cache,
+  lib,
+  pkgs,
+  stdenv,
+  callPackage,
+}:
+
+let
+  getPkg = attrPath: lib.getAttrFromPath (lib.splitString "." (toString attrPath)) pkgs;
+in
+# the derivation to fetch/update deps for
+{
+  pkg ? getPkg attrPath,
+  pname ? null,
+  attrPath ? pname,
+  # bwrap flags for the update script (this will be put in bash as-is)
+  # this is relevant for downstream users
+  bwrapFlags ? "--ro-bind \"$PWD\" \"$PWD\"",
+  # deps path (relative to the package directory, or absolute)
+  data,
+  # redirect stdout to stderr to allow the update script to be used with update script combinators
+  silent ? true,
+  useBwrap ? stdenv.hostPlatform.isLinux,
+}@attrs:
+
+let
+  data' =
+    removeAttrs
+      (
+        if builtins.isPath data then
+          lib.importJSON data
+        else if builtins.isString data then
+          lib.importJSON "${dirOf pkg.meta.position}/${data}"
+        else
+          data
+      )
+      [
+        "!comment"
+        "!version"
+      ];
+
+  parseArtifactUrl =
+    url:
+    let
+      extension = lib.last (lib.splitString "." url);
+      splitUrl = lib.splitString "/" url;
+      artifactId = builtins.elemAt splitUrl (builtins.length splitUrl - 3);
+      baseVer = builtins.elemAt splitUrl (builtins.length splitUrl - 2);
+      filename = builtins.elemAt splitUrl (builtins.length splitUrl - 1);
+      filenameNoExt = lib.removeSuffix ".${extension}" filename;
+      verCls = lib.removePrefix "${artifactId}-" filenameNoExt;
+    in
+    rec {
+      inherit
+        artifactId
+        baseVer
+        filename
+        extension
+        ;
+      isSnapshot = lib.hasSuffix "-SNAPSHOT" baseVer;
+      version =
+        if isSnapshot && !lib.hasPrefix "SNAPSHOT" verCls then
+          builtins.concatStringsSep "-" (lib.take 3 (lib.splitString "-" verCls))
+        else
+          baseVer;
+      classifier = if verCls == version then null else lib.removePrefix "${version}-" verCls;
+      # for snapshots
+      timestamp = builtins.elemAt (lib.splitString "-" version) 1;
+      buildNum = builtins.elemAt (lib.splitString "-" version) 2;
+    };
+
+  parseMetadataUrl =
+    url:
+    let
+      xmlBase = lib.removeSuffix "/maven-metadata.xml" url;
+      vMeta = lib.hasSuffix "-SNAPSHOT" xmlBase;
+      splitBase = lib.splitString "/" xmlBase;
+    in
+    if vMeta then
+      {
+        vMeta = true;
+        baseVer = builtins.elemAt splitBase (builtins.length splitBase - 1);
+        artifactId = builtins.elemAt splitBase (builtins.length splitBase - 2);
+      }
+    else
+      {
+        vMeta = false;
+        baseVer = null;
+        artifactId = builtins.elemAt splitBase (builtins.length splitBase - 1);
+      };
+
+  extractHashArtifact =
+    afterHash:
+    let
+      nameVer = builtins.match "([^/]*)/([^/]*)(/SNAPSHOT)?(/.*)?" afterHash;
+      artifactId = builtins.elemAt nameVer 0;
+      version = builtins.elemAt nameVer 1;
+      isSnapshot = builtins.elemAt nameVer 2 != null;
+      cls = builtins.elemAt nameVer 3;
+    in
+    rec {
+      inherit artifactId version isSnapshot;
+      baseVer =
+        if !isSnapshot then
+          version
+        else
+          builtins.head (builtins.match "(.*)-([^-]*)-([^-]*)" version) + "-SNAPSHOT";
+      classifier = if cls == null then null else lib.removePrefix "/" cls;
+      clsSuf = if classifier == null then "" else "-${classifier}";
+    };
+
+  # replace base#name/ver with base/name/ver/name-ver
+  decompressNameVer =
+    prefix:
+    let
+      splitHash = lib.splitString "#" (builtins.concatStringsSep "/" prefix);
+      inherit (extractHashArtifact (lib.last splitHash))
+        artifactId
+        baseVer
+        version
+        clsSuf
+        ;
+    in
+    if builtins.length splitHash == 1 then
+      builtins.head splitHash
+    else
+      builtins.concatStringsSep "/${artifactId}/${baseVer}/" (
+        lib.init splitHash ++ [ "${artifactId}-${version}${clsSuf}" ]
+      );
+
+  # `visit` all elements in attrs and merge into a set
+  # attrs will be passed as parent1, parent1 will be passed as parent2
+  visitAttrs =
+    parent1: prefix: attrs:
+    builtins.foldl' (a: b: a // b) { } (lib.mapAttrsToList (visit parent1 attrs prefix) attrs);
+
+  # convert a compressed deps.json into an uncompressed json used for mitm-cache.fetch
+  visit =
+    parent2: parent1: prefix: k: v:
+    # groupId being present means this is a metadata xml "leaf" and we shouldn't descend further
+    if builtins.isAttrs v && !v ? groupId then
+      visitAttrs parent1 (prefix ++ [ k ]) v
+    else
+      let
+        url = "${decompressNameVer prefix}.${k}";
+      in
+      {
+        ${url} =
+          if builtins.isString v then
+            { hash = v; }
+          else
+            {
+              text =
+                let
+                  xmlBase = lib.removeSuffix "/maven-metadata.xml" url;
+                  meta = parseMetadataUrl url // v;
+                  inherit (meta)
+                    groupId
+                    vMeta
+                    artifactId
+                    baseVer
+                    ;
+
+                  fileList = builtins.filter (x: lib.hasPrefix xmlBase x && x != url) (builtins.attrNames finalData);
+                  jarPomList = map parseArtifactUrl fileList;
+
+                  sortByVersion = a: b: (builtins.compareVersions a.version b.version) < 0;
+                  sortedJarPomList = lib.sort sortByVersion jarPomList;
+
+                  uniqueVersionFiles = map ({ i, x }: x) (
+                    builtins.filter (
+                      { i, x }: i == 0 || (builtins.elemAt sortedJarPomList (i - 1)).version != x.version
+                    ) (lib.imap0 (i: x: { inherit i x; }) sortedJarPomList)
+                  );
+                  uniqueVersions' = map (x: x.version) uniqueVersionFiles;
+                  releaseVersions = map (x: x.version) (builtins.filter (x: !x.isSnapshot) uniqueVersionFiles);
+                  latestVer = v.latest or v.release or (lib.last uniqueVersions');
+                  releaseVer = v.release or (lib.last releaseVersions);
+
+                  # The very latest version isn't necessarily used by Gradle, so it may not be present in the MITM data.
+                  # In order to generate better metadata xml, if the latest version is known but wasn't fetched by Gradle,
+                  # add it anyway.
+                  uniqueVersions =
+                    uniqueVersions'
+                    ++ lib.optional (!builtins.elem releaseVer uniqueVersions') releaseVer
+                    ++ lib.optional (!builtins.elem latestVer uniqueVersions' && releaseVer != latestVer) latestVer;
+
+                  lastUpdated =
+                    v.lastUpdated
+                      or (if vMeta then builtins.replaceStrings [ "." ] [ "" ] snapshotTs else "20240101123456");
+
+                  # the following are only used for snapshots
+                  snapshotTsAndNum = lib.splitString "-" latestVer;
+                  snapshotTs = builtins.elemAt snapshotTsAndNum 1;
+                  snapshotNum = lib.last snapshotTsAndNum;
+
+                  indent = x: s: builtins.concatStringsSep "\n" (map (s: x + s) (lib.splitString "\n" s));
+                  containsSpecialXmlChars = s: builtins.match ''.*[<>"'&].*'' s != null;
+                in
+                # make sure all user-provided data is safe
+                assert lib.hasInfix "${builtins.replaceStrings [ "." ] [ "/" ] groupId}/${artifactId}" url;
+                assert !containsSpecialXmlChars groupId;
+                assert !containsSpecialXmlChars lastUpdated;
+                if vMeta then
+                  ''
+                    <?xml version="1.0" encoding="UTF-8"?>
+                    <metadata modelVersion="1.1.0">
+                      <groupId>${groupId}</groupId>
+                      <artifactId>${artifactId}</artifactId>
+                      <version>${baseVer}</version>
+                      <versioning>
+                        <snapshot>
+                          <timestamp>${snapshotTs}</timestamp>
+                          <buildNumber>${snapshotNum}</buildNumber>
+                        </snapshot>
+                        <lastUpdated>${lastUpdated}</lastUpdated>
+                        <snapshotVersions>
+                    ${builtins.concatStringsSep "\n" (
+                      map (
+                        x:
+                        indent "      " ''
+                          <snapshotVersion>${
+                            lib.optionalString (x.classifier != null) "\n        <classifier>${x.classifier}</classifier>"
+                          }
+                            <extension>${x.extension}</extension>
+                            <value>${x.version}</value>
+                            <updated>${builtins.replaceStrings [ "." ] [ "" ] x.timestamp}</updated>
+                          </snapshotVersion>''
+                      ) sortedJarPomList
+                    )}
+                        </snapshotVersions>
+                      </versioning>
+                    </metadata>
+                  ''
+                else
+                  assert !containsSpecialXmlChars latestVer;
+                  assert !containsSpecialXmlChars releaseVer;
+                  ''
+                    <?xml version="1.0" encoding="UTF-8"?>
+                    <metadata modelVersion="1.1.0">
+                      <groupId>${groupId}</groupId>
+                      <artifactId>${artifactId}</artifactId>
+                      <versioning>
+                        <latest>${latestVer}</latest>
+                        <release>${releaseVer}</release>
+                        <versions>
+                    ${builtins.concatStringsSep "\n" (map (x: "      <version>${x}</version>") uniqueVersions)}
+                        </versions>
+                        <lastUpdated>${lastUpdated}</lastUpdated>
+                      </versioning>
+                    </metadata>
+                  '';
+            };
+      };
+
+  finalData = visitAttrs { } [ ] data';
+in
+mitm-cache.fetch {
+  name = "${pkg.pname or pkg.name}-deps";
+  data = finalData // {
+    "!version" = 1;
+  };
+  passthru = lib.optionalAttrs (!builtins.isAttrs data) {
+    updateScript = callPackage ./update-deps.nix { } {
+      inherit
+        pkg
+        pname
+        attrPath
+        bwrapFlags
+        data
+        silent
+        useBwrap
+        ;
+    };
+  };
+}

pkgs/development/tools/build-managers/gradle/init-build.gradle

@@ -0,0 +1,8 @@
+gradle.projectsLoaded {
+  rootProject.allprojects {
+    tasks.withType(AbstractArchiveTask) {
+        preserveFileTimestamps = false
+        reproducibleFileOrder = true
+    }
+  }
+}

pkgs/development/tools/build-managers/gradle/init-deps.gradle

@@ -0,0 +1,10 @@
+gradle.projectsLoaded {
+  rootProject.allprojects {
+    task nixDownloadDeps {
+      doLast {
+        configurations.findAll{it.canBeResolved}.each{it.resolve()}
+        buildscript.configurations.findAll{it.canBeResolved}.each{it.resolve()}
+      }
+    }
+  }
+}

pkgs/development/tools/build-managers/gradle/patching.sh

@@ -0,0 +1,29 @@
+extractVersion() {
+    local jar version
+    local prefix="$1"
+    shift
+    local candidates="$@"
+
+    jar="$(basename -a $candidates | sort | head -n1)"
+
+    version="${jar#$prefix-}"
+
+    echo "${version%.jar}"
+}
+
+autoPatchelfInJar() {
+    local file="$1" rpath="$2"
+    local work
+
+    work="$(mktemp -dt patching.XXXXXXXXXX)"
+    pushd "$work"
+
+    jar xf "$file"
+    rm "$file"
+
+    autoPatchelf -- .
+
+    jar cf "$file" .
+
+    popd
+}

pkgs/development/tools/build-managers/gradle/setup-hook.sh

@@ -0,0 +1,72 @@
+gradleConfigureHook() {
+    if [ -z "${GRADLE_USER_HOME-}" ]; then
+        GRADLE_USER_HOME="$(mktemp -d)"
+    fi
+    export GRADLE_USER_HOME
+    export TERM=dumb
+    gradleFlagsArray+=(--no-daemon --console plain --init-script "${gradleInitScript:-@init_script@}")
+    if [ -n "${MITM_CACHE_CA-}" ]; then
+        if [ -z "${MITM_CACHE_KEYSTORE-}" ]; then
+            MITM_CACHE_KEYSTORE="$MITM_CACHE_CERT_DIR/keystore"
+            MITM_CACHE_KS_PWD="$(head -c10 /dev/random | base32)"
+            echo y | @jdk@/bin/keytool -importcert -file "$MITM_CACHE_CA" -alias alias -keystore "$MITM_CACHE_KEYSTORE" -storepass "$MITM_CACHE_KS_PWD"
+        fi
+        gradleFlagsArray+=(-Dhttp.proxyHost="$MITM_CACHE_HOST" -Dhttp.proxyPort="$MITM_CACHE_PORT")
+        gradleFlagsArray+=(-Dhttps.proxyHost="$MITM_CACHE_HOST" -Dhttps.proxyPort="$MITM_CACHE_PORT")
+        gradleFlagsArray+=(-Djavax.net.ssl.trustStore="$MITM_CACHE_KEYSTORE" -Djavax.net.ssl.trustStorePassword="$MITM_CACHE_KS_PWD")
+    else
+        gradleFlagsArray+=(--offline)
+    fi
+    if ! [[ -v enableParallelBuilding ]]; then
+        enableParallelBuilding=1
+    fi
+    if ! [[ -v enableParallelChecking ]]; then
+        enableParallelChecking=1
+    fi
+    if ! [[ -v enableParallelUpdating ]]; then
+        enableParallelUpdating=1
+    fi
+}
+
+gradle() {
+    local flagsArray=()
+    concatTo flagsArray gradleFlags gradleFlagsArray
+    command gradle "${flagsArray[@]}" "$@"
+}
+
+gradleBuildPhase() {
+    runHook preBuild
+
+    gradle ${enableParallelBuilding:+--parallel} ${gradleBuildTask:-assemble}
+
+    runHook postBuild
+}
+
+gradleCheckPhase() {
+    runHook preCheck
+
+    gradle ${enableParallelChecking:+--parallel} ${gradleCheckTask:-test}
+
+    runHook postCheck
+}
+
+gradleUpdateScript() {
+    runHook preBuild
+    runHook preGradleUpdate
+
+    gradle ${enableParallelUpdating:+--parallel} ${gradleUpdateTask:-nixDownloadDeps}
+
+    runHook postGradleUpdate
+}
+
+if [ -z "${dontUseGradleConfigure-}" ]; then
+    preConfigureHooks+=(gradleConfigureHook)
+fi
+
+if [ -z "${dontUseGradleBuild-}" ] && [ -z "${buildPhase-}" ]; then
+    buildPhase=gradleBuildPhase
+fi
+
+if [ -z "${dontUseGradleCheck-}" ] && [ -z "${checkPhase-}" ]; then
+    checkPhase=gradleCheckPhase
+fi

pkgs/development/tools/build-managers/gradle/tests/java-application/build.gradle

@@ -0,0 +1,7 @@
+plugins {
+    id('application')
+}
+
+application {
+    mainClass = 'Main'
+}

pkgs/development/tools/build-managers/gradle/tests/java-application/src/main/java/Main.java

@@ -0,0 +1,5 @@
+public class Main {
+    public static void main(String[] args) {
+        System.out.println("hello");
+    }
+}

pkgs/development/tools/build-managers/gradle/tests/toolchains/build.gradle

@@ -0,0 +1,11 @@
+plugins {
+    id('application')
+}
+
+java {
+    toolchain.languageVersion.set(JavaLanguageVersion.of(@JAVA_VERSION@))
+}
+
+application {
+    mainClass = 'Main'
+}

pkgs/development/tools/build-managers/gradle/tests/toolchains/src/main/java/Main.java

@@ -0,0 +1,5 @@
+public class Main {
+    public static void main(String[] args) {
+        System.out.println(System.getProperty("java.version"));
+    }
+}

pkgs/development/tools/build-managers/gradle/update-deps.nix

@@ -0,0 +1,157 @@
+{
+  lib,
+  runtimeShell,
+  srcOnly,
+  stdenvNoCC,
+  writeTextFile,
+  writeShellScript,
+  path,
+  bubblewrap,
+  coreutils,
+  curl,
+  jq,
+  mitm-cache,
+  nix,
+  openssl,
+  procps,
+  python3,
+}:
+
+lib.makeOverridable (
+  {
+    pkg,
+    pname,
+    attrPath,
+    bwrapFlags,
+    data,
+    silent,
+    useBwrap,
+  }:
+  let
+    keep = [
+      "MITM_CACHE_HOST"
+      "MITM_CACHE_PORT"
+      "MITM_CACHE_ADDRESS"
+      "MITM_CACHE_CA"
+      "MITM_CACHE_CERT_DIR"
+    ];
+    gradleScript = writeShellScript "gradle-commands.sh" ''
+      set -eo pipefail
+      export http_proxy="$MITM_CACHE_ADDRESS"
+      export https_proxy="$MITM_CACHE_ADDRESS"
+      export SSL_CERT_FILE="$MITM_CACHE_CA"
+      export NIX_SSL_CERT_FILE="$MITM_CACHE_CA"
+      export GRADLE_USER_HOME="$(${coreutils}/bin/mktemp -d)"
+      export IN_GRADLE_UPDATE_DEPS=1
+      trap "${coreutils}/bin/rm -rf '$GRADLE_USER_HOME'" SIGINT SIGTERM ERR EXIT
+      cd "$(${coreutils}/bin/mktemp -d)"
+      ${coreutils}/bin/mkdir out
+      export out="$PWD/out"
+      trap "${coreutils}/bin/rm -rf '$PWD'" SIGINT SIGTERM ERR EXIT
+      source "$stdenv/setup"
+      phases="''${prePhases[*]:-} unpackPhase patchPhase ''${preConfigurePhases[*]:-} configurePhase gradleUpdateScript" genericBuild
+    '';
+    source = srcOnly (
+      pkg.overrideAttrs (old: {
+        mitmCache = "";
+        gradleInitScript = ./init-deps.gradle;
+
+        stdenv = old.stdenv or stdenvNoCC;
+      })
+    );
+    sourceDrvPath = builtins.unsafeDiscardOutputDependency source.drvPath;
+    nixShellKeep = lib.concatMapStringsSep " " (x: "--keep ${x}") keep;
+  in
+  writeTextFile {
+    name = "fetch-deps.sh";
+    executable = true;
+    # see pkgs/common-updater/combinators.nix
+    derivationArgs.passthru = {
+      supportedFeatures = lib.optional silent "silent";
+    }
+    // lib.optionalAttrs (attrPath != null) { inherit attrPath; };
+    text = ''
+      #!${runtimeShell}
+      set -eo pipefail
+      export PATH="${
+        lib.makeBinPath (
+          [
+            coreutils
+            curl
+            jq
+            mitm-cache
+            openssl
+            procps
+            python3.pkgs.ephemeral-port-reserve
+          ]
+          ++ lib.optional useBwrap bubblewrap
+        )
+      }:$PATH"
+      outPath="${
+        # if this is an absolute path in nix store, use path relative to the store path
+        if lib.hasPrefix "${builtins.storeDir}/" (toString data) then
+          builtins.concatStringsSep "/" (
+            lib.drop 1 (lib.splitString "/" (lib.removePrefix "${builtins.storeDir}/" (toString data)))
+          )
+        # if this is an absolute path anywhere else, just use that path
+        else if lib.hasPrefix "/" (toString data) then
+          toString data
+        # otherwise, use a path relative to the package
+        else
+          "${dirOf pkg.meta.position}/${data}"
+      }"
+
+      pushd "$(mktemp -d)" >/dev/null
+      MITM_CACHE_DIR="$PWD"
+      trap "rm -rf '$MITM_CACHE_DIR'" SIGINT SIGTERM ERR EXIT
+      openssl genrsa -out ca.key 2048
+      openssl req -x509 -new -nodes -key ca.key -sha256 -days 1 -out ca.cer -subj "/C=AL/ST=a/L=a/O=a/OU=a/CN=example.org"
+      export MITM_CACHE_HOST=127.0.0.1
+      export MITM_CACHE_PORT="''${mitmCachePort:-$(ephemeral-port-reserve "$MITM_CACHE_HOST")}"
+      export MITM_CACHE_ADDRESS="$MITM_CACHE_HOST:$MITM_CACHE_PORT"
+      # forget all redirects - this makes the lockfiles predictable
+      # not only does this strip CDN URLs, but it also improves security - since the redirects aren't
+      # stored in the lockfile, a malicious actor can't change the redirect URL stored in the lockfile
+      mitm-cache \
+        -l"$MITM_CACHE_ADDRESS" \
+        record \
+        --reject '\.(md5|sha(1|256|512:?):?)$' \
+        --forget-redirects-from '.*' \
+        --record-text '/maven-metadata\.xml$' >/dev/null 2>/dev/null &
+      MITM_CACHE_PID="$!"
+      # wait for mitm-cache to fully start
+      for i in {0..20}; do
+        kill -0 "$MITM_CACHE_PID" 2>/dev/null || (echo "Failed to start mitm-cache" && exit 1)
+        curl -so/dev/null "$MITM_CACHE_ADDRESS" && break
+        [[ "$i" -eq 20 ]] && (echo "Failed to start mitm-cache" && exit 1)
+        sleep 0.5
+      done
+      trap "kill '$MITM_CACHE_PID'" SIGINT SIGTERM ERR EXIT
+      export MITM_CACHE_CERT_DIR="$PWD"
+      export MITM_CACHE_CA="$MITM_CACHE_CERT_DIR/ca.cer"
+      popd >/dev/null
+      useBwrap="''${USE_BWRAP:-${toString useBwrap}}"
+      if [ -n "$useBwrap" ]; then
+        # bwrap isn't necessary, it's only used to prevent messy build scripts from touching ~
+        bwrap \
+          --unshare-all --share-net --clearenv --chdir / --setenv HOME /homeless-shelter \
+          --tmpfs /home --bind /tmp /tmp --ro-bind /nix /nix --ro-bind /run /run --proc /proc --dev /dev  \
+          --ro-bind ${toString path} ${toString path} --bind "$MITM_CACHE_CERT_DIR" "$MITM_CACHE_CERT_DIR" \
+          ${builtins.concatStringsSep " " (map (x: "--setenv ${x} \"\$${x}\"") keep)} \
+          --setenv NIX_BUILD_SHELL ${runtimeShell} ${bwrapFlags} ''${BWRAP_FLAGS:-} \
+          -- ${nix}/bin/nix-shell --pure --run ${gradleScript} ${nixShellKeep} ${sourceDrvPath}
+      else
+        NIX_BUILD_SHELL=${runtimeShell} nix-shell --pure --run ${gradleScript} ${nixShellKeep} ${sourceDrvPath}
+      fi${lib.optionalString silent " >&2"}
+      kill -s SIGINT "$MITM_CACHE_PID"
+      for i in {0..20}; do
+        # check for valid json
+        if jq -e 1 "$MITM_CACHE_DIR/out.json" >/dev/null 2>/dev/null; then
+          exec ${python3.interpreter} ${./compress-deps-json.py} "$MITM_CACHE_DIR/out.json" "$outPath"
+        fi
+        sleep 1
+      done
+      exit 1
+    '';
+  }
+)

pkgs/development/tools/build-managers/gup/default.nix

@@ -0,0 +1,57 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  nix-update-source,
+  lib,
+  python3,
+  which,
+  runtimeShell,
+  pylint,
+}:
+stdenv.mkDerivation rec {
+  version = "0.9.2";
+  src = fetchFromGitHub {
+    hash = "sha256-bV5HauM0xmRI/9Pxp1cYLPLA8PbFvPER2y4mAMmgchs=";
+    owner = "timbertson";
+    repo = "gup";
+    rev = "version-${version}";
+  };
+  pname = "gup";
+  nativeBuildInputs = [
+    python3
+    which
+    pylint
+  ];
+  buildInputs = [ python3 ];
+  strictDeps = true;
+  buildPhase = "make python";
+  installPhase = ''
+    mkdir $out
+    cp -r python/bin $out/bin
+  '';
+  passthru.updateScript = [
+    runtimeShell
+    "-c"
+    ''
+      set -e
+      echo
+      cd ${toString ./.}
+      ${nix-update-source}/bin/nix-update-source \
+        --prompt version \
+        --replace-attr version \
+        --set owner timbertson \
+        --set repo gup \
+        --set type fetchFromGitHub \
+        --set rev 'version-{version}' \
+        --nix-literal rev 'version-''${version}'\
+        --modify-nix default.nix
+    ''
+  ];
+  meta = {
+    inherit (src.meta) homepage;
+    description = "Better make, inspired by djb's redo";
+    license = lib.licenses.lgpl2Plus;
+    maintainers = [ lib.maintainers.timbertson ];
+    platforms = lib.platforms.all;
+  };
+}

pkgs/development/tools/build-managers/qbs/default.nix

@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  qmake,
+  qtbase,
+  qtscript,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "qbs";
+
+  version = "1.24.1";
+
+  src = fetchFromGitHub {
+    owner = "qbs";
+    repo = "qbs";
+    rev = "v${version}";
+    sha256 = "sha256-nL7UZh29Oecu3RvXYg5xsin2IvPWpApleLH37sEdSAI=";
+  };
+
+  nativeBuildInputs = [ qmake ];
+
+  dontWrapQtApps = true;
+
+  qmakeFlags = [
+    "QBS_INSTALL_PREFIX=$(out)"
+    "qbs.pro"
+  ];
+
+  buildInputs = [
+    qtbase
+    qtscript
+  ];
+
+  meta = with lib; {
+    description = "Tool that helps simplify the build process for developing projects across multiple platforms";
+    homepage = "https://wiki.qt.io/Qbs";
+    license = licenses.lgpl3;
+    maintainers = [ ];
+    platforms = platforms.linux;
+  };
+}

pkgs/development/tools/build-managers/rebar/default.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  erlang,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "rebar";
+  version = "2.6.4";
+
+  src = fetchFromGitHub {
+    owner = "rebar";
+    repo = "rebar";
+    rev = version;
+    sha256 = "sha256-okvG7X2uHtZ1p+HUoFOmslrWvYjk0QWBAvAMAW2E40c=";
+  };
+
+  buildInputs = [ erlang ];
+
+  buildPhase = "escript bootstrap";
+  installPhase = ''
+    mkdir -p $out/bin
+    cp rebar $out/bin/rebar
+  '';
+
+  meta = {
+    homepage = "https://github.com/rebar/rebar";
+    description = "Erlang build tool that makes it easy to compile and test Erlang applications, port drivers and releases";
+    mainProgram = "rebar";
+
+    longDescription = ''
+      rebar is a self-contained Erlang script, so it's easy to
+      distribute or even embed directly in a project. Where possible,
+      rebar uses standard Erlang/OTP conventions for project
+      structures, thus minimizing the amount of build configuration
+      work. rebar also provides dependency management, enabling
+      application writers to easily re-use common libraries from a
+      variety of locations (git, hg, etc).
+    '';
+
+    platforms = lib.platforms.unix;
+    license = lib.licenses.asl20;
+    teams = [ lib.teams.beam ];
+  };
+}

pkgs/development/tools/build-managers/rebar3/default.nix

@@ -0,0 +1,179 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchgit,
+  fetchHex,
+  erlang,
+  makeWrapper,
+  writeScript,
+  common-updater-scripts,
+  coreutils,
+  git,
+  gnused,
+  nix,
+  nixfmt,
+  rebar3-nix,
+}:
+
+let
+  version = "3.25.1";
+  owner = "erlang";
+  deps = import ./rebar-deps.nix { inherit fetchFromGitHub fetchgit fetchHex; };
+  rebar3 = stdenv.mkDerivation rec {
+    pname = "rebar3";
+    inherit version erlang;
+
+    # How to obtain `sha256`:
+    # nix-prefetch-url --unpack https://github.com/erlang/rebar3/archive/${version}.tar.gz
+    src = fetchFromGitHub {
+      inherit owner;
+      repo = pname;
+      rev = version;
+      sha256 = "Wpg8MDVwum/cBpwbcY3Cjt2JkuQHEp7wxbZKgyP6crc=";
+    };
+
+    buildInputs = [ erlang ];
+
+    postPatch = ''
+      mkdir -p _checkouts _build/default/lib/
+
+      ${toString (
+        lib.mapAttrsToList (k: v: ''
+          cp -R --no-preserve=mode ${v} _checkouts/${k}
+        '') deps
+      )}
+
+      # Bootstrap script expects the dependencies in _build/default/lib
+      # TODO: Make it accept checkouts?
+      for i in _checkouts/* ; do
+          ln -s $(pwd)/$i $(pwd)/_build/default/lib/
+      done
+    '';
+
+    buildPhase = ''
+      HOME=. escript bootstrap
+    '';
+
+    checkPhase = ''
+      HOME=. escript ./rebar3 ct
+    '';
+
+    doCheck = true;
+
+    installPhase = ''
+      mkdir -p $out/bin
+      cp rebar3 $out/bin/rebar3
+    '';
+
+    meta = {
+      homepage = "https://github.com/rebar/rebar3";
+      description = "Erlang build tool that makes it easy to compile and test Erlang applications, port drivers and releases";
+      mainProgram = "rebar3";
+
+      longDescription = ''
+        rebar is a self-contained Erlang script, so it's easy to distribute or
+        even embed directly in a project. Where possible, rebar uses standard
+        Erlang/OTP conventions for project structures, thus minimizing the amount
+        of build configuration work. rebar also provides dependency management,
+        enabling application writers to easily re-use common libraries from a
+        variety of locations (hex.pm, git, hg, and so on).
+      '';
+
+      platforms = lib.platforms.unix;
+      teams = [ lib.teams.beam ];
+      license = lib.licenses.asl20;
+    };
+
+    passthru.updateScript = writeScript "update.sh" ''
+      #!${stdenv.shell}
+      set -ox errexit
+      PATH=${
+        lib.makeBinPath [
+          common-updater-scripts
+          coreutils
+          git
+          gnused
+          nix
+          nixfmt
+          (rebar3WithPlugins { globalPlugins = [ rebar3-nix ]; })
+        ]
+      }
+      latest=$(list-git-tags | sed -n '/[\d\.]\+/p' | sort -V | tail -1)
+      if [ "$latest" != "${version}" ]; then
+        nixpkgs="$(git rev-parse --show-toplevel)"
+        nix_path="$nixpkgs/pkgs/development/tools/build-managers/rebar3"
+        update-source-version rebar3 "$latest" --version-key=version --print-changes --file="$nix_path/default.nix"
+        tmpdir=$(mktemp -d)
+        cp -R $(nix-build $nixpkgs --no-out-link -A rebar3.src)/* "$tmpdir"
+        (cd "$tmpdir" && rebar3 as test nix lock -o "$nix_path/rebar-deps.nix")
+        nixfmt "$nix_path/rebar-deps.nix"
+      else
+        echo "rebar3 is already up-to-date"
+      fi
+    '';
+  };
+
+  # Alias rebar3 so we can use it as default parameter below
+  _rebar3 = rebar3;
+
+  rebar3WithPlugins =
+    {
+      plugins ? [ ],
+      globalPlugins ? [ ],
+      rebar3 ? _rebar3,
+    }:
+    let
+      pluginLibDirs = map (p: "${p}/lib/erlang/lib") (lib.unique (plugins ++ globalPlugins));
+      globalPluginNames = lib.unique (map (p: p.packageName) globalPlugins);
+      rebar3Patched = (
+        rebar3.overrideAttrs (old: {
+
+          # skip-plugins.patch is necessary because otherwise rebar3 will always
+          # try to fetch plugins if they are not already present in _build.
+          #
+          # global-deps.patch makes it possible to use REBAR_GLOBAL_PLUGINS to
+          # instruct rebar3 to always load a certain plugin. It is necessary since
+          # REBAR_GLOBAL_CONFIG_DIR doesn't seem to work for this.
+          patches = [
+            ./skip-plugins.patch
+            ./global-plugins.patch
+          ];
+
+          # our patches cause the tests to fail
+          doCheck = false;
+        })
+      );
+    in
+    stdenv.mkDerivation {
+      pname = "rebar3-with-plugins";
+      inherit (rebar3) version;
+      nativeBuildInputs = [
+        erlang
+        makeWrapper
+      ];
+      unpackPhase = "true";
+
+      # Here we extract the rebar3 escript (like `rebar3_prv_local_install.erl`) and
+      # add plugins to the code path.
+
+      installPhase = ''
+        erl -noshell -eval '
+          {ok, Escript} = escript:extract("${rebar3Patched}/bin/rebar3", []),
+          {archive, Archive} = lists:keyfind(archive, 1, Escript),
+          {ok, _} = zip:extract(Archive, [{cwd, "'$out/lib'"}]),
+          init:stop(0)
+        '
+        cp ${./rebar_ignore_deps.erl} rebar_ignore_deps.erl
+        erlc -o $out/lib/rebar/ebin rebar_ignore_deps.erl
+        mkdir -p $out/bin
+        makeWrapper ${erlang}/bin/erl $out/bin/rebar3 \
+          --set REBAR_GLOBAL_PLUGINS "${toString globalPluginNames} rebar_ignore_deps" \
+          --suffix-each ERL_LIBS ":" "$out/lib ${toString pluginLibDirs}" \
+          --add-flags "+sbtu +A1 -noshell -boot start_clean -s rebar3 main -extra"
+      '';
+    };
+in
+{
+  inherit rebar3 rebar3WithPlugins;
+}

pkgs/development/tools/build-managers/rebar3/global-plugins.patch

@@ -0,0 +1,14 @@
+diff --git a/apps/rebar/src/rebar_plugins.erl b/apps/rebar/src/rebar_plugins.erl
+index 469be42e..3a901cbe 100644
+--- a/apps/rebar/src/rebar_plugins.erl
++++ b/apps/rebar/src/rebar_plugins.erl
+@@ -31,7 +31,8 @@ project_plugins_install(State) ->
+ top_level_install(State) ->
+     Profiles = rebar_state:current_profiles(State),
+     lists:foldl(fun(Profile, StateAcc) ->
+-                        Plugins = rebar_state:get(State, {plugins, Profile}, []),
++                        Plugins = rebar_state:get(State, {plugins, Profile}, [])
++                            ++ [list_to_atom(P) || P <- string:lexemes(os:getenv("REBAR_GLOBAL_PLUGINS", ""), " ")],
+                         handle_plugins(Profile, Plugins, StateAcc)
+                 end, State, Profiles).
+ 

pkgs/development/tools/build-managers/rebar3/rebar-deps.nix

@@ -0,0 +1,27 @@
+# Generated by rebar3_nix
+let
+  fetchOnly = { src, ... }: src;
+in
+{
+  builder ? fetchOnly,
+  fetchHex,
+  fetchgit,
+  fetchFromGitHub,
+  overrides ? (x: y: { }),
+}:
+let
+  self = packages // (overrides self packages);
+  packages = {
+    meck = builder {
+      name = "meck";
+      version = "0.8.13";
+      src = fetchHex {
+        pkg = "meck";
+        version = "0.8.13";
+        sha256 = "sha256-008BPBVttRrVfMVWiRuXIOahwd9f4uFa+ZnITWzr6xo=";
+      };
+      beamDeps = [ ];
+    };
+  };
+in
+self

pkgs/development/tools/build-managers/rebar3/rebar_ignore_deps.erl

@@ -0,0 +1,43 @@
+%% This module, when loaded as a plugin, overrides the default `install_deps`
+%% provider and erases the dependencies from the rebar3 state, when
+%% REBAR_IGNORE_DEPS is true.
+
+-module(rebar_ignore_deps).
+
+-export([init/1, do/1, format_error/1]).
+
+init(State0) ->
+    case os:getenv("REBAR_IGNORE_DEPS", "") of
+        "" ->
+            {ok, State0};
+        _ ->
+            do_init(State0)
+    end.
+
+do_init(State0) ->
+    State1 = rebar_state:allow_provider_overrides(State0, true),
+    Provider = providers:create(
+                 [
+                  {name, install_deps}, %% override the default install_deps provider
+                  {module, ?MODULE},
+                  {bare, false},
+                  {deps, [app_discovery]},
+                  {example, undefined},
+                  {opts, []},
+                  {short_desc, ""},
+                  {desc, ""}
+                 ]),
+    State2 = rebar_state:add_provider(State1, Provider),
+    {ok, rebar_state:allow_provider_overrides(State2, false)}.
+
+do(State0) ->
+    io:format("Ignoring deps...~n"),
+    Profiles = rebar_state:current_profiles(State0),
+    State = lists:foldl(fun(P, Acc0) ->
+                                 Acc = rebar_state:set(Acc0, {deps, P}, []),
+                                 rebar_state:set(Acc, {parsed_deps, P}, [])
+                         end, State0, Profiles),
+    {ok, State}.
+
+format_error(Reason) ->
+    io_lib:format("~p", [Reason]).

pkgs/development/tools/build-managers/rebar3/skip-plugins.patch

@@ -0,0 +1,80 @@
+diff --git a/apps/rebar/src/rebar_plugins.erl b/apps/rebar/src/rebar_plugins.erl
+index cd5f377c..469be42e 100644
+--- a/apps/rebar/src/rebar_plugins.erl
++++ b/apps/rebar/src/rebar_plugins.erl
+@@ -108,41 +108,9 @@ handle_plugins(Profile, Plugins, State, Upgrade) ->
+     State3 = rebar_state:set(State2, deps_dir, DepsDir),
+     rebar_state:lock(State3, Locks).
+ 
+-handle_plugin(Profile, Plugin, State, SrcPlugins, Upgrade) ->
++handle_plugin(_Profile, Plugin, State, _SrcPlugins, _Upgrade) ->
+     try
+-        %% Inject top-level src plugins as project apps, so that they get skipped
+-        %% by the installation as already seen
+-        ProjectApps = rebar_state:project_apps(State),
+-        State0 = rebar_state:project_apps(State, SrcPlugins),
+-        %% We however have to pick the deps of top-level apps and promote them
+-        %% directly to make sure they are installed if they were not also at the top level
+-        TopDeps = top_level_deps(State, SrcPlugins),
+-        %% Install the plugins
+-        {Apps, State1} = rebar_prv_install_deps:handle_deps_as_profile(Profile, State0, [Plugin|TopDeps], Upgrade),
+-        {no_cycle, Sorted} = rebar_prv_install_deps:find_cycles(SrcPlugins++Apps),
+-        ToBuild = rebar_prv_install_deps:cull_compile(Sorted, []),
+-        %% Return things to normal
+-        State2 = rebar_state:project_apps(State1, ProjectApps),
+-
+-        %% Add already built plugin deps to the code path
+-        ToBuildPaths = [rebar_app_info:ebin_dir(A) || A <- ToBuild],
+-        PreBuiltPaths = [Ebin || A <- Sorted,
+-                                 Ebin <- [rebar_app_info:ebin_dir(A)],
+-                                 not lists:member(Ebin, ToBuildPaths)],
+-        code:add_pathsa(PreBuiltPaths),
+-
+-        %% Build plugin and its deps
+-        build_plugins(ToBuild, Sorted, State2),
+-
+-        %% Add newly built deps and plugin to code path
+-        State3 = rebar_state:update_all_plugin_deps(State2, Sorted),
+-        NewCodePaths = [rebar_app_info:ebin_dir(A) || A <- ToBuild],
+-
+-        %% Store plugin code paths so we can remove them when compiling project apps
+-        State4 = rebar_state:update_code_paths(State3, all_plugin_deps, PreBuiltPaths++NewCodePaths),
+-        rebar_paths:set_paths([plugins], State4),
+-
+-        {plugin_providers(Plugin), State4}
++        {plugin_providers(Plugin), State}
+     catch
+         ?WITH_STACKTRACE(C,T,S)
+             ?DEBUG("~p ~p ~p", [C, T, S]),
+@@ -150,15 +118,6 @@ handle_plugin(Profile, Plugin, State, SrcPlugins, Upgrade) ->
+             {[], State}
+     end.
+ 
+-build_plugins(MustBuildApps, AllApps, State) ->
+-    State1 = rebar_state:deps_to_build(State, MustBuildApps),
+-    State2 = rebar_state:all_deps(State1, AllApps),
+-    State3 = rebar_state:set(State2, deps_dir, ?DEFAULT_PLUGINS_DIR),
+-    {Args, Extra} = rebar_state:command_parsed_args(State),
+-    State4 = rebar_state:command_parsed_args(State3, {[{deps_only, true}|Args], Extra}),
+-    rebar_prv_compile:do(State4),
+-    ok.
+-
+ plugin_providers({Plugin, _, _, _}) when is_atom(Plugin) ->
+     validate_plugin(Plugin);
+ plugin_providers({Plugin, _, _}) when is_atom(Plugin) ->
+@@ -251,15 +210,6 @@ prepare_plugin(AppInfo) ->
+         false -> rebar_app_info:valid(Relocated, undefined) % force revalidation
+     end.
+ 
+-top_level_deps(State, Apps) ->
+-    CurrentProfiles = rebar_state:current_profiles(State),
+-    Keys = lists:append([[{plugins, P}, {deps, P}] || P <- CurrentProfiles]),
+-    RawDeps = lists:foldl(fun(App, Acc) ->
+-        %% Only support the profiles we would with regular plugins?
+-        lists:append([rebar_app_info:get(App, Key, []) || Key <- Keys]) ++ Acc
+-    end, [], Apps),
+-    rebar_utils:tup_dedup(RawDeps).
+-
+ needs_rebuild(AppInfo) ->
+     %% if source files are newer than built files then the code was edited
+     %% and can't be considered valid -- force a rebuild.

pkgs/development/tools/build-managers/sbt/default.nix

@@ -0,0 +1,68 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  jre,
+  autoPatchelfHook,
+  zlib,
+  ncurses,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "sbt";
+  version = "1.11.7";
+
+  src = fetchurl {
+    url = "https://github.com/sbt/sbt/releases/download/v${finalAttrs.version}/sbt-${finalAttrs.version}.tgz";
+    hash = "sha256-EjKBj5HDljmpO74RCOEtlMcESmRqeEfxo5d7nkZxbNY=";
+  };
+
+  postPatch = ''
+    echo -java-home ${jre.home} >>conf/sbtopts
+  '';
+
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    stdenv.cc.cc # libstdc++.so.6
+    zlib
+  ];
+
+  propagatedBuildInputs = [
+    # for infocmp
+    ncurses
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/sbt $out/bin
+    cp -ra . $out/share/sbt
+    ln -sT ../share/sbt/bin/sbt $out/bin/sbt
+    ln -sT ../share/sbt/bin/sbtn-${
+      if (stdenv.hostPlatform.isDarwin) then
+        "universal-apple-darwin"
+      else if (stdenv.hostPlatform.isAarch64) then
+        "aarch64-pc-linux"
+      else
+        "x86_64-pc-linux"
+    } $out/bin/sbtn
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.scala-sbt.org/";
+    license = licenses.bsd3;
+    sourceProvenance = with sourceTypes; [
+      binaryBytecode
+      binaryNativeCode
+    ];
+    description = "Build tool for Scala, Java and more";
+    maintainers = with maintainers; [
+      nequissimus
+      kashw2
+    ];
+    platforms = platforms.unix;
+  };
+})

pkgs/development/tools/build-managers/sbt/scala-native.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  sbt,
+  makeWrapper,
+  boehmgc,
+  libunwind,
+  re2,
+  llvmPackages,
+  zlib,
+}:
+
+sbt.overrideAttrs (previousAttrs: {
+  nativeBuildInputs = (previousAttrs.nativeBuildInputs or [ ]) ++ [ makeWrapper ];
+
+  postFixup = (previousAttrs.postFixup or "") + ''
+    wrapProgram $out/bin/sbt \
+      --set CLANG_PATH      "${llvmPackages.clang}/bin/clang" \
+      --set CLANGPP_PATH    "${llvmPackages.clang}/bin/clang" \
+      --set CPATH           "${
+        lib.makeSearchPathOutput "dev" "include" [
+          re2
+          zlib
+          boehmgc
+          libunwind
+          llvmPackages.libcxx
+        ]
+      }/c++/v1" \
+      --set LIBRARY_PATH    "${
+        lib.makeLibraryPath [
+          re2
+          zlib
+          boehmgc
+          libunwind
+          llvmPackages.libcxx
+        ]
+      }" \
+      --set NIX_CFLAGS_LINK "-lc++"
+  '';
+})

pkgs/development/tools/buildah/default.nix

@@ -0,0 +1,86 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  go-md2man,
+  installShellFiles,
+  pkg-config,
+  gpgme,
+  lvm2,
+  btrfs-progs,
+  libapparmor,
+  libselinux,
+  libseccomp,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "buildah";
+  version = "1.41.5";
+
+  src = fetchFromGitHub {
+    owner = "containers";
+    repo = "buildah";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-NQ5nCU1uiw3SzPMo2rH4+GnAIbIzM9O0bJaXJg/rfZM=";
+  };
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  vendorHash = null;
+
+  doCheck = false;
+
+  # /nix/store/.../bin/ld: internal/mkcw/embed/entrypoint_amd64.o: relocation R_X86_64_32S against `.rodata.1' can not be used when making a PIE object; recompile with -fPIE
+  hardeningDisable = [ "pie" ];
+
+  nativeBuildInputs = [
+    go-md2man
+    installShellFiles
+    pkg-config
+  ];
+
+  buildInputs = [
+    gpgme
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    btrfs-progs
+    libapparmor
+    libseccomp
+    libselinux
+    lvm2
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    patchShebangs .
+    make bin/buildah
+    make -C docs GOMD2MAN="go-md2man"
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 bin/buildah $out/bin/buildah
+    installShellCompletion --bash contrib/completions/bash/buildah
+    make -C docs install PREFIX="$man"
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  meta = {
+    description = "Tool which facilitates building OCI images";
+    mainProgram = "buildah";
+    homepage = "https://buildah.io/";
+    changelog = "https://github.com/containers/buildah/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    teams = [ lib.teams.podman ];
+  };
+})

pkgs/development/tools/buildah/wrapper.nix

@@ -0,0 +1,78 @@
+{
+  buildah-unwrapped,
+  runCommand,
+  makeBinaryWrapper,
+  symlinkJoin,
+  lib,
+  stdenv,
+  extraPackages ? [ ],
+  runc, # Default container runtime
+  crun, # Container runtime (default with cgroups v2 for podman/buildah)
+  conmon, # Container runtime monitor
+  slirp4netns, # User-mode networking for unprivileged namespaces
+  fuse-overlayfs, # CoW for images, much faster than default vfs
+  util-linuxMinimal, # nsenter
+  iptables,
+  aardvark-dns,
+  netavark,
+  passt,
+}:
+
+let
+  binPath = lib.makeBinPath (
+    [
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      runc
+      crun
+      conmon
+      slirp4netns
+      fuse-overlayfs
+      util-linuxMinimal
+      iptables
+    ]
+    ++ extraPackages
+  );
+
+  helpersBin = symlinkJoin {
+    name = "${buildah-unwrapped.pname}-helper-binary-wrapper-${buildah-unwrapped.version}";
+
+    # this only works for some binaries, others may need to be added to `binPath` or in the modules
+    paths = [
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      aardvark-dns
+      netavark
+      passt
+    ];
+  };
+
+in
+runCommand buildah-unwrapped.name
+  {
+    name = "${buildah-unwrapped.pname}-wrapper-${buildah-unwrapped.version}";
+    inherit (buildah-unwrapped) pname version passthru;
+
+    preferLocalBuild = true;
+
+    meta = removeAttrs buildah-unwrapped.meta [ "outputsToInstall" ];
+
+    outputs = [
+      "out"
+      "man"
+    ];
+
+    nativeBuildInputs = [
+      makeBinaryWrapper
+    ];
+
+  }
+  ''
+    ln -s ${buildah-unwrapped.man} $man
+
+    mkdir -p $out
+    ln -s ${buildah-unwrapped}/share $out/share
+    makeWrapper ${buildah-unwrapped}/bin/buildah $out/bin/buildah \
+      --set CONTAINERS_HELPER_BINARY_DIR ${helpersBin}/bin \
+      --prefix PATH : ${binPath}
+  ''

pkgs/development/tools/ceedling/Gemfile

@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'ceedling'

pkgs/development/tools/ceedling/Gemfile.lock

@@ -0,0 +1,29 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    ceedling (1.0.1)
+      constructor (~> 2)
+      deep_merge (~> 1.2)
+      diy (~> 1.1)
+      rake (>= 12, < 14)
+      thor (~> 1.3)
+      unicode-display_width (~> 3.1)
+    constructor (2.0.0)
+    deep_merge (1.2.2)
+    diy (1.1.2)
+      constructor (>= 1.0.0)
+    rake (13.2.1)
+    thor (1.3.2)
+    unicode-display_width (3.1.4)
+      unicode-emoji (~> 4.0, >= 4.0.4)
+    unicode-emoji (4.0.4)
+
+PLATFORMS
+  ruby
+  x86_64-linux
+
+DEPENDENCIES
+  ceedling
+
+BUNDLED WITH
+   2.5.9

pkgs/development/tools/ceedling/default.nix

@@ -0,0 +1,19 @@
+{
+  lib,
+  bundlerApp,
+}:
+
+bundlerApp {
+  pname = "ceedling";
+  gemdir = ./.;
+  exes = [ "ceedling" ];
+
+  meta = with lib; {
+    description = "Build system for C projects that is something of an extension around Ruby's Rake";
+    homepage = "https://www.throwtheswitch.org/ceedling";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.rlwrnc ];
+    mainProgram = "ceedling";
+  };
+}

pkgs/development/tools/ceedling/gemset.nix

@@ -0,0 +1,92 @@
+{
+  ceedling = {
+    dependencies = [
+      "constructor"
+      "deep_merge"
+      "diy"
+      "rake"
+      "thor"
+      "unicode-display_width"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "05iacl7p408b4p47khhvpp9hf00smb70x1qj8xmw50mdq2vng6gn";
+      type = "gem";
+    };
+    version = "1.0.1";
+  };
+  constructor = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "02qmp08kcvi5dkz3lxm5yck9msfwfx1msvrrz9d6z4klc14q889y";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
+  deep_merge = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0fjn4civid68a3zxnbgyjj6krs3l30dy8b4djpg6fpzrsyix7kl3";
+      type = "gem";
+    };
+    version = "1.2.2";
+  };
+  diy = {
+    dependencies = [ "constructor" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1gsgx4fi8yzjzafgsqcyjrj4wd8l0j07kkcp7w9pbfw7ay3glm79";
+      type = "gem";
+    };
+    version = "1.1.2";
+  };
+  rake = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "17850wcwkgi30p7yqh60960ypn7yibacjjha0av78zaxwvd3ijs6";
+      type = "gem";
+    };
+    version = "13.2.1";
+  };
+  thor = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1nmymd86a0vb39pzj2cwv57avdrl6pl3lf5bsz58q594kqxjkw7f";
+      type = "gem";
+    };
+    version = "1.3.2";
+  };
+  unicode-display_width = {
+    dependencies = [ "unicode-emoji" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1has87asspm6m9wgqas8ghhhwyf2i1yqrqgrkv47xw7jq3qjmbwc";
+      type = "gem";
+    };
+    version = "3.1.4";
+  };
+  unicode-emoji = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0ajk6rngypm3chvl6r0vwv36q1931fjqaqhjjya81rakygvlwb1c";
+      type = "gem";
+    };
+    version = "4.0.4";
+  };
+}

pkgs/development/tools/cmake-format/default.nix

@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonApplication,
+  fetchPypi,
+  autopep8,
+  flake8,
+  jinja2,
+  pylint,
+  pyyaml,
+  six,
+}:
+
+buildPythonApplication rec {
+  pname = "cmake-format";
+  version = "0.6.13";
+  # The source distribution does not build because of missing files.
+  format = "wheel";
+
+  src = fetchPypi {
+    inherit version format;
+    python = "py3";
+    pname = "cmakelang";
+    sha256 = "0kmggnfbv6bba75l3zfzqwk0swi90brjka307m2kcz2w35kr8jvn";
+  };
+
+  propagatedBuildInputs = [
+    autopep8
+    flake8
+    jinja2
+    pylint
+    pyyaml
+    six
+  ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Source code formatter for cmake listfiles";
+    homepage = "https://github.com/cheshirekow/cmake_format";
+    license = licenses.gpl3;
+    maintainers = [ maintainers.tobim ];
+    mainProgram = "cmake-format";
+    platforms = platforms.all;
+  };
+}

pkgs/development/tools/cocoapods/Gemfile

@@ -0,0 +1,3 @@
+source 'https://rubygems.org'
+
+gem 'cocoapods'

pkgs/development/tools/cocoapods/Gemfile-beta

@@ -0,0 +1,5 @@
+source 'https://rubygems.org'
+
+# We need to specify a version including prerelease to pick up prereleases.
+# This should pick up all future releases / prereleases.
+gem 'cocoapods', '>=1.7.0.beta.1'

pkgs/development/tools/cocoapods/Gemfile-beta.lock

@@ -0,0 +1,112 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    CFPropertyList (3.0.7)
+      base64
+      nkf
+      rexml
+    activesupport (7.2.2)
+      base64
+      benchmark (>= 0.3)
+      bigdecimal
+      concurrent-ruby (~> 1.0, >= 1.3.1)
+      connection_pool (>= 2.2.5)
+      drb
+      i18n (>= 1.6, < 2)
+      logger (>= 1.4.2)
+      minitest (>= 5.1)
+      securerandom (>= 0.3)
+      tzinfo (~> 2.0, >= 2.0.5)
+    addressable (2.8.7)
+      public_suffix (>= 2.0.2, < 7.0)
+    algoliasearch (1.27.5)
+      httpclient (~> 2.8, >= 2.8.3)
+      json (>= 1.5.1)
+    atomos (0.1.3)
+    base64 (0.2.0)
+    benchmark (0.3.0)
+    bigdecimal (3.1.8)
+    claide (1.1.0)
+    cocoapods (1.16.2)
+      addressable (~> 2.8)
+      claide (>= 1.0.2, < 2.0)
+      cocoapods-core (= 1.16.2)
+      cocoapods-deintegrate (>= 1.0.3, < 2.0)
+      cocoapods-downloader (>= 2.1, < 3.0)
+      cocoapods-plugins (>= 1.0.0, < 2.0)
+      cocoapods-search (>= 1.0.0, < 2.0)
+      cocoapods-trunk (>= 1.6.0, < 2.0)
+      cocoapods-try (>= 1.1.0, < 2.0)
+      colored2 (~> 3.1)
+      escape (~> 0.0.4)
+      fourflusher (>= 2.3.0, < 3.0)
+      gh_inspector (~> 1.0)
+      molinillo (~> 0.8.0)
+      nap (~> 1.0)
+      ruby-macho (>= 2.3.0, < 3.0)
+      xcodeproj (>= 1.27.0, < 2.0)
+    cocoapods-core (1.16.2)
+      activesupport (>= 5.0, < 8)
+      addressable (~> 2.8)
+      algoliasearch (~> 1.0)
+      concurrent-ruby (~> 1.1)
+      fuzzy_match (~> 2.0.4)
+      nap (~> 1.0)
+      netrc (~> 0.11)
+      public_suffix (~> 4.0)
+      typhoeus (~> 1.0)
+    cocoapods-deintegrate (1.0.5)
+    cocoapods-downloader (2.1)
+    cocoapods-plugins (1.0.0)
+      nap
+    cocoapods-search (1.0.1)
+    cocoapods-trunk (1.6.0)
+      nap (>= 0.8, < 2.0)
+      netrc (~> 0.11)
+    cocoapods-try (1.2.0)
+    colored2 (3.1.2)
+    concurrent-ruby (1.3.4)
+    connection_pool (2.4.1)
+    drb (2.2.1)
+    escape (0.0.4)
+    ethon (0.16.0)
+      ffi (>= 1.15.0)
+    ffi (1.17.0)
+    fourflusher (2.3.1)
+    fuzzy_match (2.0.4)
+    gh_inspector (1.1.3)
+    httpclient (2.8.3)
+    i18n (1.14.6)
+      concurrent-ruby (~> 1.0)
+    json (2.7.6)
+    logger (1.6.1)
+    minitest (5.25.1)
+    molinillo (0.8.0)
+    nanaimo (0.4.0)
+    nap (1.1.0)
+    netrc (0.11.0)
+    nkf (0.2.0)
+    public_suffix (4.0.7)
+    rexml (3.3.9)
+    ruby-macho (2.5.1)
+    securerandom (0.3.1)
+    typhoeus (1.4.1)
+      ethon (>= 0.9.0)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
+    xcodeproj (1.27.0)
+      CFPropertyList (>= 2.3.3, < 4.0)
+      atomos (~> 0.1.3)
+      claide (>= 1.0.2, < 2.0)
+      colored2 (~> 3.1)
+      nanaimo (~> 0.4.0)
+      rexml (>= 3.3.6, < 4.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  cocoapods (>= 1.7.0.beta.1)
+
+BUNDLED WITH
+   2.5.9

pkgs/development/tools/cocoapods/Gemfile.lock

@@ -0,0 +1,112 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    CFPropertyList (3.0.7)
+      base64
+      nkf
+      rexml
+    activesupport (7.2.2)
+      base64
+      benchmark (>= 0.3)
+      bigdecimal
+      concurrent-ruby (~> 1.0, >= 1.3.1)
+      connection_pool (>= 2.2.5)
+      drb
+      i18n (>= 1.6, < 2)
+      logger (>= 1.4.2)
+      minitest (>= 5.1)
+      securerandom (>= 0.3)
+      tzinfo (~> 2.0, >= 2.0.5)
+    addressable (2.8.7)
+      public_suffix (>= 2.0.2, < 7.0)
+    algoliasearch (1.27.5)
+      httpclient (~> 2.8, >= 2.8.3)
+      json (>= 1.5.1)
+    atomos (0.1.3)
+    base64 (0.2.0)
+    benchmark (0.3.0)
+    bigdecimal (3.1.8)
+    claide (1.1.0)
+    cocoapods (1.16.2)
+      addressable (~> 2.8)
+      claide (>= 1.0.2, < 2.0)
+      cocoapods-core (= 1.16.2)
+      cocoapods-deintegrate (>= 1.0.3, < 2.0)
+      cocoapods-downloader (>= 2.1, < 3.0)
+      cocoapods-plugins (>= 1.0.0, < 2.0)
+      cocoapods-search (>= 1.0.0, < 2.0)
+      cocoapods-trunk (>= 1.6.0, < 2.0)
+      cocoapods-try (>= 1.1.0, < 2.0)
+      colored2 (~> 3.1)
+      escape (~> 0.0.4)
+      fourflusher (>= 2.3.0, < 3.0)
+      gh_inspector (~> 1.0)
+      molinillo (~> 0.8.0)
+      nap (~> 1.0)
+      ruby-macho (>= 2.3.0, < 3.0)
+      xcodeproj (>= 1.27.0, < 2.0)
+    cocoapods-core (1.16.2)
+      activesupport (>= 5.0, < 8)
+      addressable (~> 2.8)
+      algoliasearch (~> 1.0)
+      concurrent-ruby (~> 1.1)
+      fuzzy_match (~> 2.0.4)
+      nap (~> 1.0)
+      netrc (~> 0.11)
+      public_suffix (~> 4.0)
+      typhoeus (~> 1.0)
+    cocoapods-deintegrate (1.0.5)
+    cocoapods-downloader (2.1)
+    cocoapods-plugins (1.0.0)
+      nap
+    cocoapods-search (1.0.1)
+    cocoapods-trunk (1.6.0)
+      nap (>= 0.8, < 2.0)
+      netrc (~> 0.11)
+    cocoapods-try (1.2.0)
+    colored2 (3.1.2)
+    concurrent-ruby (1.3.4)
+    connection_pool (2.4.1)
+    drb (2.2.1)
+    escape (0.0.4)
+    ethon (0.16.0)
+      ffi (>= 1.15.0)
+    ffi (1.17.0)
+    fourflusher (2.3.1)
+    fuzzy_match (2.0.4)
+    gh_inspector (1.1.3)
+    httpclient (2.8.3)
+    i18n (1.14.6)
+      concurrent-ruby (~> 1.0)
+    json (2.7.6)
+    logger (1.6.1)
+    minitest (5.25.1)
+    molinillo (0.8.0)
+    nanaimo (0.4.0)
+    nap (1.1.0)
+    netrc (0.11.0)
+    nkf (0.2.0)
+    public_suffix (4.0.7)
+    rexml (3.3.9)
+    ruby-macho (2.5.1)
+    securerandom (0.3.1)
+    typhoeus (1.4.1)
+      ethon (>= 0.9.0)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
+    xcodeproj (1.27.0)
+      CFPropertyList (>= 2.3.3, < 4.0)
+      atomos (~> 0.1.3)
+      claide (>= 1.0.2, < 2.0)
+      colored2 (~> 3.1)
+      nanaimo (~> 0.4.0)
+      rexml (>= 3.3.6, < 4.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  cocoapods
+
+BUNDLED WITH
+   2.5.9

pkgs/development/tools/cocoapods/default.nix

@@ -0,0 +1,29 @@
+{
+  lib,
+  bundlerApp,
+  ruby,
+  beta ? false,
+}:
+
+bundlerApp {
+  inherit ruby;
+  pname = "cocoapods";
+  gemfile = if beta then ./Gemfile-beta else ./Gemfile;
+  lockfile = if beta then ./Gemfile-beta.lock else ./Gemfile.lock;
+  gemset = if beta then ./gemset-beta.nix else ./gemset.nix;
+  exes = [ "pod" ];
+
+  # toString prevents the update script from being copied into the nix store
+  passthru.updateScript = toString ./update;
+
+  meta = with lib; {
+    description = "Manages dependencies for your Xcode projects";
+    homepage = "https://github.com/CocoaPods/CocoaPods";
+    license = licenses.mit;
+    platforms = platforms.darwin;
+    maintainers = with maintainers; [
+      peterromfeldhk
+    ];
+    mainProgram = "pod";
+  };
+}

pkgs/development/tools/cocoapods/gemset-beta.nix

@@ -0,0 +1,512 @@
+{
+  activesupport = {
+    dependencies = [
+      "base64"
+      "benchmark"
+      "bigdecimal"
+      "concurrent-ruby"
+      "connection_pool"
+      "drb"
+      "i18n"
+      "logger"
+      "minitest"
+      "securerandom"
+      "tzinfo"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "12ijz1mmg70agw4d91hjdyzvma3dzs52mchasslxyn7p9j960qs3";
+      type = "gem";
+    };
+    version = "7.2.2";
+  };
+  addressable = {
+    dependencies = [ "public_suffix" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0cl2qpvwiffym62z991ynks7imsm87qmgxf0yfsmlwzkgi9qcaa6";
+      type = "gem";
+    };
+    version = "2.8.7";
+  };
+  algoliasearch = {
+    dependencies = [
+      "httpclient"
+      "json"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0ly8zsgvih540xmxr098hsngv61cf119wf28q5hbvi1f7kgwvh96";
+      type = "gem";
+    };
+    version = "1.27.5";
+  };
+  atomos = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "17vq6sjyswr5jfzwdccw748kgph6bdw30bakwnn6p8sl4hpv4hvx";
+      type = "gem";
+    };
+    version = "0.1.3";
+  };
+  base64 = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "01qml0yilb9basf7is2614skjp8384h2pycfx86cr8023arfj98g";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  benchmark = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0wghmhwjzv4r9mdcny4xfz2h2cm7ci24md79rvy2x65r4i99k9sc";
+      type = "gem";
+    };
+    version = "0.3.0";
+  };
+  bigdecimal = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1gi7zqgmqwi5lizggs1jhc3zlwaqayy9rx2ah80sxy24bbnng558";
+      type = "gem";
+    };
+    version = "3.1.8";
+  };
+  CFPropertyList = {
+    dependencies = [
+      "base64"
+      "nkf"
+      "rexml"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0k1w5i4lb1z941m7ds858nly33f3iv12wvr1zav5x3fa99hj2my4";
+      type = "gem";
+    };
+    version = "3.0.7";
+  };
+  claide = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0bpqhc0kqjp1bh9b7ffc395l9gfls0337rrhmab4v46ykl45qg3d";
+      type = "gem";
+    };
+    version = "1.1.0";
+  };
+  cocoapods = {
+    dependencies = [
+      "addressable"
+      "claide"
+      "cocoapods-core"
+      "cocoapods-deintegrate"
+      "cocoapods-downloader"
+      "cocoapods-plugins"
+      "cocoapods-search"
+      "cocoapods-trunk"
+      "cocoapods-try"
+      "colored2"
+      "escape"
+      "fourflusher"
+      "gh_inspector"
+      "molinillo"
+      "nap"
+      "ruby-macho"
+      "xcodeproj"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0phyvpx78jlrpvldbxjmzq92mfx6l66va2fz2s5xpwrdydhciw8g";
+      type = "gem";
+    };
+    version = "1.16.2";
+  };
+  cocoapods-core = {
+    dependencies = [
+      "activesupport"
+      "addressable"
+      "algoliasearch"
+      "concurrent-ruby"
+      "fuzzy_match"
+      "nap"
+      "netrc"
+      "public_suffix"
+      "typhoeus"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0ay1dwjg79rfa6mbfyy96in0k364dgn7s8ps6v7n07k9432bbcab";
+      type = "gem";
+    };
+    version = "1.16.2";
+  };
+  cocoapods-deintegrate = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "18pnng0lv5z6kpp8hnki0agdxx979iq6hxkfkglsyqzmir22lz2i";
+      type = "gem";
+    };
+    version = "1.0.5";
+  };
+  cocoapods-downloader = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1ldnwwsx44i2xsdmsmyz9xrar19lfy5s5xslvral1p3674dvwvmv";
+      type = "gem";
+    };
+    version = "2.1";
+  };
+  cocoapods-plugins = {
+    dependencies = [ "nap" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "16na82sfyc8801qs1n22nwq486s4j7yj6rj7fcp8cbxmj371fpbj";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  cocoapods-search = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "12amy0nknv09bvzix8bkmcjn996c50c4ms20v2dl7v8rcw73n4qv";
+      type = "gem";
+    };
+    version = "1.0.1";
+  };
+  cocoapods-trunk = {
+    dependencies = [
+      "nap"
+      "netrc"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0cgdx7z9psxxrsa13fk7qc9i6jskrwcafhrdz94avzia2y6dlnsz";
+      type = "gem";
+    };
+    version = "1.6.0";
+  };
+  cocoapods-try = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1znyp625rql37ivb5rk9fk9564cmax8icxfr041ysivpdrn98nql";
+      type = "gem";
+    };
+    version = "1.2.0";
+  };
+  colored2 = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0jlbqa9q4mvrm73aw9mxh23ygzbjiqwisl32d8szfb5fxvbjng5i";
+      type = "gem";
+    };
+    version = "3.1.2";
+  };
+  concurrent-ruby = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0chwfdq2a6kbj6xz9l6zrdfnyghnh32si82la1dnpa5h75ir5anl";
+      type = "gem";
+    };
+    version = "1.3.4";
+  };
+  connection_pool = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1x32mcpm2cl5492kd6lbjbaf17qsssmpx9kdyr7z1wcif2cwyh0g";
+      type = "gem";
+    };
+    version = "2.4.1";
+  };
+  drb = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0h5kbj9hvg5hb3c7l425zpds0vb42phvln2knab8nmazg2zp5m79";
+      type = "gem";
+    };
+    version = "2.2.1";
+  };
+  escape = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0sa1xkfc9jvkwyw1jbz3jhkq0ms1zrvswi6mmfiwcisg5fp497z4";
+      type = "gem";
+    };
+    version = "0.0.4";
+  };
+  ethon = {
+    dependencies = [ "ffi" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "17ix0mijpsy3y0c6ywrk5ibarmvqzjsirjyprpsy3hwax8fdm85v";
+      type = "gem";
+    };
+    version = "0.16.0";
+  };
+  ffi = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "07139870npj59jnl8vmk39ja3gdk3fb5z9vc0lf32y2h891hwqsi";
+      type = "gem";
+    };
+    version = "1.17.0";
+  };
+  fourflusher = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1afabh3g3gwj0ad53fs62waks815xcckf7pkci76l6vrghffcg8v";
+      type = "gem";
+    };
+    version = "2.3.1";
+  };
+  fuzzy_match = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "19gw1ifsgfrv7xdi6n61658vffgm1867f4xdqfswb2b5h6alzpmm";
+      type = "gem";
+    };
+    version = "2.0.4";
+  };
+  gh_inspector = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0f8r9byajj3bi2c7c5sqrc7m0zrv3nblfcd4782lw5l73cbsgk04";
+      type = "gem";
+    };
+    version = "1.1.3";
+  };
+  httpclient = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "19mxmvghp7ki3klsxwrlwr431li7hm1lczhhj8z4qihl2acy8l99";
+      type = "gem";
+    };
+    version = "2.8.3";
+  };
+  i18n = {
+    dependencies = [ "concurrent-ruby" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0k31wcgnvcvd14snz0pfqj976zv6drfsnq6x8acz10fiyms9l8nw";
+      type = "gem";
+    };
+    version = "1.14.6";
+  };
+  json = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "03q7kbadhbyfnz21abv2b9dyqnjvxpd51ppqihg40rrimw1vm6id";
+      type = "gem";
+    };
+    version = "2.7.6";
+  };
+  logger = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0lwncq2rf8gm79g2rcnnyzs26ma1f4wnfjm6gs4zf2wlsdz5in9s";
+      type = "gem";
+    };
+    version = "1.6.1";
+  };
+  minitest = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1n1akmc6bibkbxkzm1p1wmfb4n9vv397knkgz0ffykb3h1d7kdix";
+      type = "gem";
+    };
+    version = "5.25.1";
+  };
+  molinillo = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0p846facmh1j5xmbrpgzadflspvk7bzs3sykrh5s7qi4cdqz5gzg";
+      type = "gem";
+    };
+    version = "0.8.0";
+  };
+  nanaimo = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "08q73nchv8cpk28h1sdnf5z6a862fcf4mxy1d58z25xb3dankw7s";
+      type = "gem";
+    };
+    version = "0.4.0";
+  };
+  nap = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0xm5xssxk5s03wjarpipfm39qmgxsalb46v1prsis14x1xk935ll";
+      type = "gem";
+    };
+    version = "1.1.0";
+  };
+  netrc = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0gzfmcywp1da8nzfqsql2zqi648mfnx6qwkig3cv36n9m0yy676y";
+      type = "gem";
+    };
+    version = "0.11.0";
+  };
+  nkf = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "09piyp2pd74klb9wcn0zw4mb5l0k9wzwppxggxi1yi95l2ym3hgv";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  public_suffix = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1f3knlwfwm05sfbaihrxm4g772b79032q14c16q4b38z8bi63qcb";
+      type = "gem";
+    };
+    version = "4.0.7";
+  };
+  rexml = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1j9p66pmfgxnzp76ksssyfyqqrg7281dyi3xyknl3wwraaw7a66p";
+      type = "gem";
+    };
+    version = "3.3.9";
+  };
+  ruby-macho = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1jgmhj4srl7cck1ipbjys6q4klcs473gq90bm59baw4j1wpfaxch";
+      type = "gem";
+    };
+    version = "2.5.1";
+  };
+  securerandom = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1phv6kh417vkanhssbjr960c0gfqvf8z7d3d9fd2yvd41q64bw4q";
+      type = "gem";
+    };
+    version = "0.3.1";
+  };
+  typhoeus = {
+    dependencies = [ "ethon" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0z7gamf6s83wy0yqms3bi4srirn3fc0lc7n65lqanidxcj1xn5qw";
+      type = "gem";
+    };
+    version = "1.4.1";
+  };
+  tzinfo = {
+    dependencies = [ "concurrent-ruby" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "16w2g84dzaf3z13gxyzlzbf748kylk5bdgg3n1ipvkvvqy685bwd";
+      type = "gem";
+    };
+    version = "2.0.6";
+  };
+  xcodeproj = {
+    dependencies = [
+      "CFPropertyList"
+      "atomos"
+      "claide"
+      "colored2"
+      "nanaimo"
+      "rexml"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1lslz1kfb8jnd1ilgg02qx0p0y6yiq8wwk84mgg2ghh58lxsgiwc";
+      type = "gem";
+    };
+    version = "1.27.0";
+  };
+}

pkgs/development/tools/cocoapods/gemset.nix

@@ -0,0 +1,496 @@
+{
+  activesupport = {
+    dependencies = [
+      "base64"
+      "benchmark"
+      "bigdecimal"
+      "concurrent-ruby"
+      "connection_pool"
+      "drb"
+      "i18n"
+      "logger"
+      "minitest"
+      "securerandom"
+      "tzinfo"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "12ijz1mmg70agw4d91hjdyzvma3dzs52mchasslxyn7p9j960qs3";
+      type = "gem";
+    };
+    version = "7.2.2";
+  };
+  addressable = {
+    dependencies = [ "public_suffix" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0cl2qpvwiffym62z991ynks7imsm87qmgxf0yfsmlwzkgi9qcaa6";
+      type = "gem";
+    };
+    version = "2.8.7";
+  };
+  algoliasearch = {
+    dependencies = [
+      "httpclient"
+      "json"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0ly8zsgvih540xmxr098hsngv61cf119wf28q5hbvi1f7kgwvh96";
+      type = "gem";
+    };
+    version = "1.27.5";
+  };
+  atomos = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "17vq6sjyswr5jfzwdccw748kgph6bdw30bakwnn6p8sl4hpv4hvx";
+      type = "gem";
+    };
+    version = "0.1.3";
+  };
+  base64 = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "01qml0yilb9basf7is2614skjp8384h2pycfx86cr8023arfj98g";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  benchmark = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0wghmhwjzv4r9mdcny4xfz2h2cm7ci24md79rvy2x65r4i99k9sc";
+      type = "gem";
+    };
+    version = "0.3.0";
+  };
+  bigdecimal = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1gi7zqgmqwi5lizggs1jhc3zlwaqayy9rx2ah80sxy24bbnng558";
+      type = "gem";
+    };
+    version = "3.1.8";
+  };
+  CFPropertyList = {
+    dependencies = [
+      "base64"
+      "nkf"
+      "rexml"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0k1w5i4lb1z941m7ds858nly33f3iv12wvr1zav5x3fa99hj2my4";
+      type = "gem";
+    };
+    version = "3.0.7";
+  };
+  claide = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0bpqhc0kqjp1bh9b7ffc395l9gfls0337rrhmab4v46ykl45qg3d";
+      type = "gem";
+    };
+    version = "1.1.0";
+  };
+  cocoapods = {
+    dependencies = [
+      "addressable"
+      "claide"
+      "cocoapods-core"
+      "cocoapods-deintegrate"
+      "cocoapods-downloader"
+      "cocoapods-plugins"
+      "cocoapods-search"
+      "cocoapods-trunk"
+      "cocoapods-try"
+      "colored2"
+      "escape"
+      "fourflusher"
+      "gh_inspector"
+      "molinillo"
+      "nap"
+      "ruby-macho"
+      "xcodeproj"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0phyvpx78jlrpvldbxjmzq92mfx6l66va2fz2s5xpwrdydhciw8g";
+      type = "gem";
+    };
+    version = "1.16.2";
+  };
+  cocoapods-core = {
+    dependencies = [
+      "activesupport"
+      "addressable"
+      "algoliasearch"
+      "concurrent-ruby"
+      "fuzzy_match"
+      "nap"
+      "netrc"
+      "public_suffix"
+      "typhoeus"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0ay1dwjg79rfa6mbfyy96in0k364dgn7s8ps6v7n07k9432bbcab";
+      type = "gem";
+    };
+    version = "1.16.2";
+  };
+  cocoapods-deintegrate = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "18pnng0lv5z6kpp8hnki0agdxx979iq6hxkfkglsyqzmir22lz2i";
+      type = "gem";
+    };
+    version = "1.0.5";
+  };
+  cocoapods-downloader = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1ldnwwsx44i2xsdmsmyz9xrar19lfy5s5xslvral1p3674dvwvmv";
+      type = "gem";
+    };
+    version = "2.1";
+  };
+  cocoapods-plugins = {
+    dependencies = [ "nap" ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "16na82sfyc8801qs1n22nwq486s4j7yj6rj7fcp8cbxmj371fpbj";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  cocoapods-search = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "12amy0nknv09bvzix8bkmcjn996c50c4ms20v2dl7v8rcw73n4qv";
+      type = "gem";
+    };
+    version = "1.0.1";
+  };
+  cocoapods-trunk = {
+    dependencies = [
+      "nap"
+      "netrc"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0cgdx7z9psxxrsa13fk7qc9i6jskrwcafhrdz94avzia2y6dlnsz";
+      type = "gem";
+    };
+    version = "1.6.0";
+  };
+  cocoapods-try = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1znyp625rql37ivb5rk9fk9564cmax8icxfr041ysivpdrn98nql";
+      type = "gem";
+    };
+    version = "1.2.0";
+  };
+  colored2 = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0jlbqa9q4mvrm73aw9mxh23ygzbjiqwisl32d8szfb5fxvbjng5i";
+      type = "gem";
+    };
+    version = "3.1.2";
+  };
+  concurrent-ruby = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0chwfdq2a6kbj6xz9l6zrdfnyghnh32si82la1dnpa5h75ir5anl";
+      type = "gem";
+    };
+    version = "1.3.4";
+  };
+  connection_pool = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1x32mcpm2cl5492kd6lbjbaf17qsssmpx9kdyr7z1wcif2cwyh0g";
+      type = "gem";
+    };
+    version = "2.4.1";
+  };
+  drb = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0h5kbj9hvg5hb3c7l425zpds0vb42phvln2knab8nmazg2zp5m79";
+      type = "gem";
+    };
+    version = "2.2.1";
+  };
+  escape = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0sa1xkfc9jvkwyw1jbz3jhkq0ms1zrvswi6mmfiwcisg5fp497z4";
+      type = "gem";
+    };
+    version = "0.0.4";
+  };
+  ethon = {
+    dependencies = [ "ffi" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "17ix0mijpsy3y0c6ywrk5ibarmvqzjsirjyprpsy3hwax8fdm85v";
+      type = "gem";
+    };
+    version = "0.16.0";
+  };
+  ffi = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "07139870npj59jnl8vmk39ja3gdk3fb5z9vc0lf32y2h891hwqsi";
+      type = "gem";
+    };
+    version = "1.17.0";
+  };
+  fourflusher = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1afabh3g3gwj0ad53fs62waks815xcckf7pkci76l6vrghffcg8v";
+      type = "gem";
+    };
+    version = "2.3.1";
+  };
+  fuzzy_match = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "19gw1ifsgfrv7xdi6n61658vffgm1867f4xdqfswb2b5h6alzpmm";
+      type = "gem";
+    };
+    version = "2.0.4";
+  };
+  gh_inspector = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0f8r9byajj3bi2c7c5sqrc7m0zrv3nblfcd4782lw5l73cbsgk04";
+      type = "gem";
+    };
+    version = "1.1.3";
+  };
+  httpclient = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "19mxmvghp7ki3klsxwrlwr431li7hm1lczhhj8z4qihl2acy8l99";
+      type = "gem";
+    };
+    version = "2.8.3";
+  };
+  i18n = {
+    dependencies = [ "concurrent-ruby" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0k31wcgnvcvd14snz0pfqj976zv6drfsnq6x8acz10fiyms9l8nw";
+      type = "gem";
+    };
+    version = "1.14.6";
+  };
+  json = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "03q7kbadhbyfnz21abv2b9dyqnjvxpd51ppqihg40rrimw1vm6id";
+      type = "gem";
+    };
+    version = "2.7.6";
+  };
+  logger = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0lwncq2rf8gm79g2rcnnyzs26ma1f4wnfjm6gs4zf2wlsdz5in9s";
+      type = "gem";
+    };
+    version = "1.6.1";
+  };
+  minitest = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1n1akmc6bibkbxkzm1p1wmfb4n9vv397knkgz0ffykb3h1d7kdix";
+      type = "gem";
+    };
+    version = "5.25.1";
+  };
+  molinillo = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0p846facmh1j5xmbrpgzadflspvk7bzs3sykrh5s7qi4cdqz5gzg";
+      type = "gem";
+    };
+    version = "0.8.0";
+  };
+  nanaimo = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "08q73nchv8cpk28h1sdnf5z6a862fcf4mxy1d58z25xb3dankw7s";
+      type = "gem";
+    };
+    version = "0.4.0";
+  };
+  nap = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0xm5xssxk5s03wjarpipfm39qmgxsalb46v1prsis14x1xk935ll";
+      type = "gem";
+    };
+    version = "1.1.0";
+  };
+  netrc = {
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0gzfmcywp1da8nzfqsql2zqi648mfnx6qwkig3cv36n9m0yy676y";
+      type = "gem";
+    };
+    version = "0.11.0";
+  };
+  nkf = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "09piyp2pd74klb9wcn0zw4mb5l0k9wzwppxggxi1yi95l2ym3hgv";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  public_suffix = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1f3knlwfwm05sfbaihrxm4g772b79032q14c16q4b38z8bi63qcb";
+      type = "gem";
+    };
+    version = "4.0.7";
+  };
+  rexml = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1j9p66pmfgxnzp76ksssyfyqqrg7281dyi3xyknl3wwraaw7a66p";
+      type = "gem";
+    };
+    version = "3.3.9";
+  };
+  ruby-macho = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1jgmhj4srl7cck1ipbjys6q4klcs473gq90bm59baw4j1wpfaxch";
+      type = "gem";
+    };
+    version = "2.5.1";
+  };
+  securerandom = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1phv6kh417vkanhssbjr960c0gfqvf8z7d3d9fd2yvd41q64bw4q";
+      type = "gem";
+    };
+    version = "0.3.1";
+  };
+  typhoeus = {
+    dependencies = [ "ethon" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0z7gamf6s83wy0yqms3bi4srirn3fc0lc7n65lqanidxcj1xn5qw";
+      type = "gem";
+    };
+    version = "1.4.1";
+  };
+  tzinfo = {
+    dependencies = [ "concurrent-ruby" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "16w2g84dzaf3z13gxyzlzbf748kylk5bdgg3n1ipvkvvqy685bwd";
+      type = "gem";
+    };
+    version = "2.0.6";
+  };
+  xcodeproj = {
+    dependencies = [
+      "CFPropertyList"
+      "atomos"
+      "claide"
+      "colored2"
+      "nanaimo"
+      "rexml"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1lslz1kfb8jnd1ilgg02qx0p0y6yiq8wwk84mgg2ghh58lxsgiwc";
+      type = "gem";
+    };
+    version = "1.27.0";
+  };
+}

pkgs/development/tools/cocoapods/update

@@ -0,0 +1,15 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p bash bundix bundler
+
+set -e
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+rm -f Gemfile.lock Gemfile-beta.lock
+
+export BUNDLE_FORCE_RUBY_PLATFORM=1
+bundler lock
+BUNDLE_GEMFILE=Gemfile-beta bundler lock --lockfile=Gemfile-beta.lock
+
+bundix --gemfile=Gemfile --lockfile=Gemfile.lock --gemset=gemset.nix
+bundix --gemfile=Gemfile-beta --lockfile=Gemfile-beta.lock --gemset=gemset-beta.nix

pkgs/development/tools/comby/default.nix

@@ -0,0 +1,119 @@
+{
+  ocamlPackages,
+  fetchFromGitHub,
+  lib,
+  zlib,
+  pkg-config,
+  cacert,
+  gmp,
+  libev,
+  autoconf,
+  sqlite,
+  stdenv,
+}:
+let
+  mkCombyPackage =
+    {
+      pname,
+      extraBuildInputs ? [ ],
+      extraNativeInputs ? [ ],
+      preBuild ? "",
+    }:
+    ocamlPackages.buildDunePackage rec {
+      inherit pname preBuild;
+      version = "1.8.1";
+      duneVersion = "3";
+      minimalOCamlVersion = "4.08.1";
+      doCheck = true;
+
+      src = fetchFromGitHub {
+        owner = "comby-tools";
+        repo = "comby";
+        rev = version;
+        sha256 = "sha256-yQrfSzJgJm0OWJxhxst2XjZULIVHeEfPMvMIwH7BYDc=";
+      };
+
+      patches = [ ./comby.patch ];
+
+      nativeBuildInputs = extraNativeInputs;
+
+      buildInputs = [
+        ocamlPackages.core
+        ocamlPackages.core_kernel
+        ocamlPackages.ocaml_pcre
+        ocamlPackages.mparser
+        ocamlPackages.mparser-pcre
+        ocamlPackages.angstrom
+        ocamlPackages.ppx_deriving
+        ocamlPackages.ppx_deriving_yojson
+        ocamlPackages.ppx_sexp_conv
+        ocamlPackages.ppx_sexp_message
+      ]
+      ++ extraBuildInputs;
+
+      nativeCheckInputs = [ cacert ];
+
+      meta = {
+        description = "Tool for searching and changing code structure";
+        mainProgram = "comby";
+        license = lib.licenses.asl20;
+        homepage = "https://comby.dev";
+        broken = true; # Not compatible with ocamlPackages.tar ≥ 3
+      };
+    };
+
+  combyKernel = mkCombyPackage { pname = "comby-kernel"; };
+  combySemantic = mkCombyPackage {
+    pname = "comby-semantic";
+    extraBuildInputs = [ ocamlPackages.cohttp-lwt-unix ];
+  };
+in
+mkCombyPackage {
+  pname = "comby";
+
+  # tests have to be removed before building otherwise installPhase will fail
+  # cli tests expect a path to the built binary
+  preBuild = ''
+    substituteInPlace test/common/dune \
+      --replace "test_cli_list" "" \
+      --replace "test_cli_helper" "" \
+      --replace "test_cli" ""
+    rm test/common/{test_cli_list,test_cli_helper,test_cli}.ml
+  '';
+
+  extraBuildInputs = [
+    zlib
+    gmp
+    libev
+    sqlite
+    ocamlPackages.shell # This input must appear before `parany` or any other input that propagates `ocamlnet`
+    ocamlPackages.lwt
+    ocamlPackages.patience_diff
+    ocamlPackages.toml
+    ocamlPackages.cohttp-lwt-unix
+    ocamlPackages.textutils
+    ocamlPackages.jst-config
+    ocamlPackages.parany
+    ocamlPackages.conduit-lwt-unix
+    ocamlPackages.lwt_react
+    ocamlPackages.tar-unix
+    ocamlPackages.tls
+    ocamlPackages.ppx_jane
+    ocamlPackages.ppx_expect
+    ocamlPackages.dune-configurator
+    combyKernel
+    combySemantic
+  ]
+  ++ (
+    if !stdenv.hostPlatform.isAarch32 && !stdenv.hostPlatform.isAarch64 then
+      [ ocamlPackages.hack_parallel ]
+    else
+      [ ]
+  );
+
+  extraNativeInputs = [
+    autoconf
+    pkg-config
+  ];
+
+}

pkgs/development/tools/compass/Gemfile

@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'compass'

pkgs/development/tools/compass/Gemfile.lock

@@ -0,0 +1,31 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    chunky_png (1.4.0)
+    compass (1.0.3)
+      chunky_png (~> 1.2)
+      compass-core (~> 1.0.2)
+      compass-import-once (~> 1.0.5)
+      rb-fsevent (>= 0.9.3)
+      rb-inotify (>= 0.9)
+      sass (>= 3.3.13, < 3.5)
+    compass-core (1.0.3)
+      multi_json (~> 1.0)
+      sass (>= 3.3.0, < 3.5)
+    compass-import-once (1.0.5)
+      sass (>= 3.2, < 3.5)
+    ffi (1.15.4)
+    multi_json (1.15.0)
+    rb-fsevent (0.11.0)
+    rb-inotify (0.10.1)
+      ffi (~> 1.0)
+    sass (3.4.25)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  compass
+
+BUNDLED WITH
+   2.4.22

pkgs/development/tools/compass/default.nix

@@ -0,0 +1,29 @@
+{
+  lib,
+  bundlerEnv,
+  bundlerUpdateScript,
+  ruby,
+}:
+
+bundlerEnv {
+  pname = "compass";
+  version = "1.0.3";
+
+  inherit ruby;
+  gemdir = ./.;
+
+  passthru.updateScript = bundlerUpdateScript "compass";
+
+  meta = with lib; {
+    description = "Stylesheet Authoring Environment that makes your website design simpler to implement and easier to maintain";
+    homepage = "https://github.com/Compass/compass";
+    license = with licenses; mit;
+    maintainers = with maintainers; [
+      offline
+      manveru
+      nicknovitski
+    ];
+    mainProgram = "compass";
+    platforms = platforms.unix;
+  };
+}

pkgs/development/tools/compass/gemset.nix

@@ -0,0 +1,106 @@
+{
+  chunky_png = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1znw5x86hmm9vfhidwdsijz8m38pqgmv98l9ryilvky0aldv7mc9";
+      type = "gem";
+    };
+    version = "1.4.0";
+  };
+  compass = {
+    dependencies = [
+      "chunky_png"
+      "compass-core"
+      "compass-import-once"
+      "rb-fsevent"
+      "rb-inotify"
+      "sass"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0lfi83w8z75czr0pf0rmj9hda22082h3cmvczl8r1ma9agf88y2c";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
+  compass-core = {
+    dependencies = [
+      "multi_json"
+      "sass"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0yaspqwdmzwdcqviclbs3blq7an16pysrfzylz8q1gxmmd6bpj3a";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
+  compass-import-once = {
+    dependencies = [ "sass" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0bn7gwbfz7jvvdd0qdfqlx67fcb83gyvxqc7dr9fhcnks3z8z5rq";
+      type = "gem";
+    };
+    version = "1.0.5";
+  };
+  ffi = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0ssxcywmb3flxsjdg13is6k01807zgzasdhj4j48dm7ac59cmksn";
+      type = "gem";
+    };
+    version = "1.15.4";
+  };
+  multi_json = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0pb1g1y3dsiahavspyzkdy39j4q377009f6ix0bh1ag4nqw43l0z";
+      type = "gem";
+    };
+    version = "1.15.0";
+  };
+  rb-fsevent = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1qsx9c4jr11vr3a9s5j83avczx9qn9rjaf32gxpc2v451hvbc0is";
+      type = "gem";
+    };
+    version = "0.11.0";
+  };
+  rb-inotify = {
+    dependencies = [ "ffi" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1jm76h8f8hji38z3ggf4bzi8vps6p7sagxn3ab57qc0xyga64005";
+      type = "gem";
+    };
+    version = "0.10.1";
+  };
+  sass = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0kfpcwh8dgw4lc81qglkvjl73689jy3g7196zkxm4fpskg1p5lkw";
+      type = "gem";
+    };
+    version = "3.4.25";
+  };
+}

pkgs/development/tools/continuous-integration/buildbot/default.nix

@@ -0,0 +1,32 @@
+{
+  lib,
+  newScope,
+  python3,
+  recurseIntoAttrs,
+}:
+# Take packages from self first, then python.pkgs (and secondarily pkgs)
+lib.makeScope (self: newScope (self.python.pkgs // self)) (self: {
+  python = python3;
+
+  buildbot-pkg = self.callPackage ./pkg.nix { };
+
+  buildbot-worker = self.callPackage ./worker.nix { };
+
+  buildbot = self.callPackage ./master.nix { };
+
+  buildbot-plugins = recurseIntoAttrs (self.callPackage ./plugins.nix { });
+
+  buildbot-ui = self.buildbot.withPlugins (with self.buildbot-plugins; [ www ]);
+
+  buildbot-full = self.buildbot.withPlugins (
+    with self.buildbot-plugins;
+    [
+      www
+      console-view
+      waterfall-view
+      grid-view
+      wsgi-dashboards
+      badges
+    ]
+  );
+})

pkgs/development/tools/continuous-integration/buildbot/master.nix

@@ -0,0 +1,175 @@
+{
+  lib,
+  stdenv,
+  buildPythonApplication,
+  fetchFromGitHub,
+  makeWrapper,
+  # Tie withPlugins through the fixed point here, so it will receive an
+  # overridden version properly
+  buildbot,
+  pythonOlder,
+  python,
+  twisted,
+  jinja2,
+  msgpack,
+  zope-interface,
+  sqlalchemy,
+  alembic,
+  python-dateutil,
+  txaio,
+  autobahn,
+  pyjwt,
+  pyyaml,
+  treq,
+  txrequests,
+  pypugjs,
+  boto3,
+  moto,
+  markdown,
+  lz4,
+  brotli,
+  zstandard,
+  setuptools-trial,
+  buildbot-worker,
+  buildbot-plugins,
+  buildbot-pkg,
+  parameterized,
+  git,
+  openssh,
+  setuptools,
+  croniter,
+  importlib-resources,
+  packaging,
+  unidiff,
+  nixosTests,
+}:
+
+let
+  withPlugins =
+    plugins:
+    buildPythonApplication {
+      pname = "${buildbot.pname}-with-plugins";
+      inherit (buildbot) version;
+      format = "other";
+
+      dontUnpack = true;
+      dontBuild = true;
+      doCheck = false;
+
+      nativeBuildInputs = [
+        makeWrapper
+      ];
+
+      propagatedBuildInputs = plugins ++ buildbot.propagatedBuildInputs;
+
+      installPhase = ''
+        makeWrapper ${buildbot}/bin/buildbot $out/bin/buildbot \
+          --prefix PYTHONPATH : "${buildbot}/${python.sitePackages}:$PYTHONPATH"
+        ln -sfv ${buildbot}/lib $out/lib
+      '';
+
+      passthru = buildbot.passthru // {
+        withPlugins = morePlugins: withPlugins (morePlugins ++ plugins);
+      };
+    };
+in
+buildPythonApplication rec {
+  pname = "buildbot";
+  version = "4.3.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "buildbot";
+    repo = "buildbot";
+    rev = "v${version}";
+    hash = "sha256-yUtOJRI04/clCMImh5sokpj6MeBIXjEAdf9xnToqJZs=";
+  };
+
+  build-system = [
+  ];
+
+  pythonRelaxDeps = [
+    "twisted"
+  ];
+
+  propagatedBuildInputs = [
+    # core
+    twisted
+    jinja2
+    msgpack
+    zope-interface
+    sqlalchemy
+    alembic
+    python-dateutil
+    txaio
+    autobahn
+    pyjwt
+    pyyaml
+    setuptools
+    croniter
+    importlib-resources
+    packaging
+    unidiff
+    treq
+    brotli
+    zstandard
+  ]
+  # tls
+  ++ twisted.optional-dependencies.tls;
+
+  nativeCheckInputs = [
+    treq
+    txrequests
+    pypugjs
+    boto3
+    moto
+    markdown
+    lz4
+    setuptools-trial
+    buildbot-worker
+    buildbot-pkg
+    buildbot-plugins.www
+    parameterized
+    git
+    openssh
+  ];
+
+  patches = [
+    # This patch disables the test that tries to read /etc/os-release which
+    # is not accessible in sandboxed builds.
+    ./skip_test_linux_distro.patch
+  ];
+
+  postPatch = ''
+    cd master
+    touch buildbot/py.typed
+    substituteInPlace buildbot/scripts/logwatcher.py --replace '/usr/bin/tail' "$(type -P tail)"
+  '';
+
+  # TimeoutErrors on slow machines -> aarch64
+  doCheck = !stdenv.hostPlatform.isAarch64;
+
+  preCheck = ''
+    export PATH="$out/bin:$PATH"
+  '';
+
+  passthru = {
+    inherit withPlugins python;
+    updateScript = ./update.sh;
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isLinux {
+    tests = {
+      inherit (nixosTests) buildbot;
+    };
+  };
+
+  meta = with lib; {
+    description = "Open-source continuous integration framework for automating software build, test, and release processes";
+    homepage = "https://buildbot.net/";
+    changelog = "https://github.com/buildbot/buildbot/releases/tag/v${version}";
+    teams = [ teams.buildbot ];
+    license = licenses.gpl2Only;
+  };
+}

pkgs/development/tools/continuous-integration/buildbot/pkg.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  buildPythonPackage,
+  isPy3k,
+  buildbot,
+}:
+
+buildPythonPackage {
+  format = "setuptools";
+  pname = "buildbot_pkg";
+  inherit (buildbot) src version;
+
+  postPatch = ''
+    cd pkg
+    # Their listdir function filters out `node_modules` folders.
+    # Do we have to care about that with Nix...?
+    substituteInPlace buildbot_pkg.py --replace "os.listdir = listdir" ""
+  '';
+
+  # No tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "buildbot_pkg" ];
+
+  disabled = !isPy3k;
+
+  meta = with lib; {
+    homepage = "https://buildbot.net/";
+    description = "Buildbot Packaging Helper";
+    teams = [ teams.buildbot ];
+    license = licenses.gpl2;
+  };
+}

pkgs/development/tools/continuous-integration/buildbot/plugins.nix

@@ -0,0 +1,167 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchurl,
+  callPackage,
+  mock,
+  cairosvg,
+  klein,
+  jinja2,
+  buildbot-pkg,
+}:
+{
+  # this is exposed for potential plugins to use and for nix-update
+  inherit buildbot-pkg;
+  www = buildPythonPackage rec {
+    format = "setuptools";
+    pname = "buildbot_www";
+    inherit (buildbot-pkg) version;
+
+    src = fetchurl {
+      url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
+      hash = "sha256-mn55+Fb2cU2rNB5Nwt41nWXjcZfgd07ijYAAnZnnnwI=";
+    };
+
+    # Remove unnecessary circular dependency on buildbot
+    postPatch = ''
+      sed -i "s/'buildbot'//" setup.py
+    '';
+
+    buildInputs = [
+      buildbot-pkg
+      mock
+    ];
+
+    # No tests
+    doCheck = false;
+
+    meta = with lib; {
+      homepage = "https://buildbot.net/";
+      description = "Buildbot UI";
+      teams = [ teams.buildbot ];
+      license = licenses.gpl2;
+    };
+  };
+
+  console-view = buildPythonPackage rec {
+    pname = "buildbot_console_view";
+    inherit (buildbot-pkg) version;
+    format = "setuptools";
+
+    src = fetchurl {
+      url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
+      hash = "sha256-VA6xqJBjD4XmQabTN8M+PLvfrG7Hq2ooxChtz2jAT8A=";
+    };
+
+    buildInputs = [ buildbot-pkg ];
+
+    # No tests
+    doCheck = false;
+
+    meta = with lib; {
+      homepage = "https://buildbot.net/";
+      description = "Buildbot Console View Plugin";
+      teams = [ teams.buildbot ];
+      license = licenses.gpl2;
+    };
+  };
+
+  waterfall-view = buildPythonPackage rec {
+    pname = "buildbot_waterfall_view";
+    inherit (buildbot-pkg) version;
+    format = "setuptools";
+
+    src = fetchurl {
+      url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
+      hash = "sha256-c/Nmr0Uscalnndq72Y6jPM1JDs5OyOCERtuX/GXkxp8=";
+    };
+
+    buildInputs = [ buildbot-pkg ];
+
+    # No tests
+    doCheck = false;
+
+    meta = with lib; {
+      homepage = "https://buildbot.net/";
+      description = "Buildbot Waterfall View Plugin";
+      teams = [ teams.buildbot ];
+      license = licenses.gpl2;
+    };
+  };
+
+  grid-view = buildPythonPackage rec {
+    pname = "buildbot_grid_view";
+    inherit (buildbot-pkg) version;
+    format = "setuptools";
+
+    src = fetchurl {
+      url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
+      hash = "sha256-AmY8RkFX0POmVpW71nNz4+dFbr0FHGhNR3RJymDNoaw=";
+    };
+
+    buildInputs = [ buildbot-pkg ];
+
+    # No tests
+    doCheck = false;
+
+    meta = with lib; {
+      homepage = "https://buildbot.net/";
+      description = "Buildbot Grid View Plugin";
+      teams = [ teams.buildbot ];
+      license = licenses.gpl2;
+    };
+  };
+
+  wsgi-dashboards = buildPythonPackage rec {
+    pname = "buildbot_wsgi_dashboards";
+    inherit (buildbot-pkg) version;
+    format = "setuptools";
+
+    src = fetchurl {
+      url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
+      hash = "sha256-vofKxpIfbAs7HR43Y7ojHLQEn6/WIdjZPgZieBMsz74=";
+    };
+
+    buildInputs = [ buildbot-pkg ];
+
+    # No tests
+    doCheck = false;
+
+    meta = with lib; {
+      homepage = "https://buildbot.net/";
+      description = "Buildbot WSGI dashboards Plugin";
+      teams = [ teams.buildbot ];
+      license = licenses.gpl2;
+    };
+  };
+
+  badges = buildPythonPackage rec {
+    pname = "buildbot_badges";
+    inherit (buildbot-pkg) version;
+    format = "setuptools";
+
+    src = fetchurl {
+      url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
+      hash = "sha256-u7HF6X+ClT4rT3LJcTHXWi5oSxCKPXoUDH+QFRI2S0w=";
+    };
+
+    buildInputs = [ buildbot-pkg ];
+    propagatedBuildInputs = [
+      cairosvg
+      klein
+      jinja2
+    ];
+
+    # No tests
+    doCheck = false;
+
+    meta = with lib; {
+      homepage = "https://buildbot.net/";
+      description = "Buildbot Badges Plugin";
+      maintainers = [ maintainers.julienmalka ];
+      teams = [ teams.buildbot ];
+      license = licenses.gpl2;
+    };
+  };
+
+}

pkgs/development/tools/continuous-integration/buildbot/skip_test_linux_distro.patch

@@ -0,0 +1,11 @@
+diff -Nur buildbot-0.9.6/master/buildbot/test/unit/test_buildbot_net_usage_data.py buildbot-0.9.6.patched/buildbot/test/unit/test_buildbot_net_usage_data.py
+--- buildbot-0.9.6/master/buildbot/test/unit/test_buildbot_net_usage_data.py	2017-04-19 16:57:02.000000000 +0200
++++ buildbot-0.9.6.patched/master/buildbot/test/unit/test_buildbot_net_usage_data.py	2017-05-04 12:22:54.575762551 +0200
+@@ -147,6 +147,7 @@
+         _sendBuildbotNetUsageData({'foo': 'bar'})
+ 
+     def test_linux_distro(self):
++        raise SkipTest("NixOS sandboxed builds hides /etc/os-release")
+         system = platform.system()
+         if system != "Linux":
+             raise SkipTest("test is only for linux")

pkgs/development/tools/continuous-integration/buildbot/update.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-update
+set -eu -o pipefail
+
+nix-update buildbot
+nix-update --version=skip buildbot-plugins.www
+nix-update --version=skip buildbot-plugins.console-view
+nix-update --version=skip buildbot-plugins.waterfall-view
+nix-update --version=skip buildbot-plugins.grid-view
+nix-update --version=skip buildbot-plugins.wsgi-dashboards
+nix-update --version=skip buildbot-plugins.badges

pkgs/development/tools/continuous-integration/buildbot/worker.nix

@@ -0,0 +1,61 @@
+{
+  lib,
+  buildPythonPackage,
+  buildbot,
+  stdenv,
+
+  # patch
+  coreutils,
+
+  # propagates
+  autobahn,
+  msgpack,
+  twisted,
+
+  # tests
+  parameterized,
+  psutil,
+  setuptools-trial,
+
+  # passthru
+  nixosTests,
+}:
+
+buildPythonPackage {
+  pname = "buildbot_worker";
+  inherit (buildbot) src version;
+  format = "setuptools";
+
+  postPatch = ''
+    cd worker
+    touch buildbot_worker/py.typed
+    substituteInPlace buildbot_worker/scripts/logwatcher.py \
+      --replace /usr/bin/tail "${coreutils}/bin/tail"
+  '';
+
+  nativeBuildInputs = [
+    setuptools-trial
+  ];
+
+  propagatedBuildInputs = [
+    autobahn
+    msgpack
+    twisted
+  ];
+
+  nativeCheckInputs = [
+    parameterized
+    psutil
+  ];
+
+  passthru.tests = {
+    smoke-test = nixosTests.buildbot;
+  };
+
+  meta = with lib; {
+    homepage = "https://buildbot.net/";
+    description = "Buildbot Worker Daemon";
+    teams = [ teams.buildbot ];
+    license = licenses.gpl2;
+  };
+}

pkgs/development/tools/continuous-integration/buildkite-test-collector-rust/default.nix

@@ -0,0 +1,30 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "buildkite-test-collector-rust";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "buildkite";
+    repo = "test-collector-rust";
+    rev = "v${version}";
+    sha256 = "sha256-PF2TFfzWmHXLgTopzJ04dfnzd3Sc/A6Hduffz2guxmU=";
+  };
+
+  cargoHash = "sha256-jymWM0DCR6jUE1Kyhbx6HHf6YlrGu1THKTyDHaPG+Vs=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "Rust adapter for Buildkite Test Analytics";
+    mainProgram = "buildkite-test-collector";
+    homepage = "https://buildkite.com/test-analytics";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ jfroche ];
+  };
+}