Change:
stdenv.mkDerivation rec { pname = "bzip2"; <del> version = "1.0.6.0.2"; </del> <ins> version = "1.0.8"; </ins> <del> /* We use versions patched to use autotools style properly, saving lots of trouble. */ </del> src = fetchurl { <del> urls = map (prefix: prefix + "/people/sbrabec/bzip2/tarballs/${pname}-${version}.tar.gz") [ "http://ftp.uni-kl.de/pub/linux/suse" "ftp://ftp.hs.uni-hamburg.de/pub/mirrors/suse" "ftp://ftp.mplayerhq.hu/pub/linux/suse" "http://ftp.suse.com/pub" # the original patched version but slow ]; sha256 = "sha256-FnhwNy4OHe8d5M6iYCClkxzcB/EHXg0veXwv43ZlxbA="; </del> <ins> url = "https://sourceware.org/pub/bzip2/bzip2-${version}.tar.gz"; sha256 = "sha256-q1oDF27hBtPw+pDjgdpHjdrkBZGBU8yiSOaCzQxKImk="; </ins> }; <del> strictDeps = true; nativeBuildInputs = [ autoreconfHook ]; </del> <ins> patchFlags = ["-p0"]; </ins> patches = [ <del> ./CVE-2016-3189.patch ./cve-2019-12900.patch </del> <ins> (fetchurl { url = "https://ftp.suse.com/pub/people/sbrabec/bzip2/for_downstream/bzip2-1.0.6.2-autoconfiscated.patch"; sha256 = "sha256-QMufl6ffJVVVVZespvkCbFpB6++R1lnq1687jEsUjr0="; }) </ins> ]; <del> postPatch = '' sed -i -e '/<sysstat.h>/s||/|' bzip2.c ''; </del> <ins> strictDeps = true; nativeBuildInputs = [ autoreconfHook ]; </ins> outputs = [ "bin" "dev" "out" "man" ];

Discussion:
The package has a new maintainer and upstream:
Looks like they're up to 1.0.8 now, FWIW:
ping What's up with the "libtoolized" SUSE patch? AFAICT all it does it produce a useless file. Both the and the build without it; I rebuilt it with the stock 1.0.8 tarball and and shared-object Makefile and it seems to be fine. Hardly any packages even depend on anyway; mentions it in a weird , but that seems to break things rather than fix them, so I can't really test anything. The other one is which explicitly references for some insane reason (edit: I guess the is the wrong way round). It's dynamically loaded though, and I don't care enough to try and find what feature uses it. Perl also mentions . Not sure what to make of that.
The patch was useful before the recent maintenance pick-up upstream. I don't expect it will be useful anymore.
Thank you for your contributions. This has been automatically marked as stale because it has had no activity for 180 days. If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity. Here are suggestions that might help resolve this more quickly: for maintainers and people that previously touched the related code and @ mention them in a comment. on the . on the on .
.
I marked this as stale due to inactivity. &rarr;
There exist bzip2 archives in the wild which cannot be extracted by the 1.0.6 that's in nixpkgs due to the fix for CVE-2019-. It takes some gymnastics to use them in derivations, etc. because bzip2 is such a core package. It would be nice to be able to upgrade to 1.0.8, which can handle these files, or move to the 1.1 series as default.
What mentions is still an issue. I mentioned that just now on the closed PR to merge 1.0.8:
Fixed by