jiebi/CodeConvo huggingface dataset:
Change:
Deluge 1.3.12 is incompatible with current libtorrent-rasterbar 1.1 introduced in . There are a few exceptions thrown in the log and several core features do not work as expected, e.g. seeding torrents get queued, although queues are disabled. The Deluge team does not plan to fix this, but it looks like libtorrent might in version 1.1.1. References: System: 16.09pre87431. Nix version: 1.11.2 Nixpkgs version: 16.09pre87431.
Should we include an older version of libtorrent-rasterbar in the repos alongside current? We can point deluge to use it instead.
Yes, that would probably best in the meantime. 1.0.9 should work as expected.
Looks like the PR that fixes this has been merged.

Discussion:
}; propagatedBuildInputs = with self; [ <del> pyGtkGlade pkgs.libtorrentRasterbar twisted Mako chardet pyxdg self.pyopenssl modules.curses service-identity </del> <ins> pyGtkGlade pkgs.libtorrentRasterbar_1_09 twisted Mako chardet pyxdg self.pyopenssl modules.curses service-identity </ins> ]; nativeBuildInputs = [ pkgs.intltool ];
Change:
Steps to reproduce the behavior: Happens on intel darwin. Please run and paste the result.
The .so dependency should be fixed up:

Discussion:
<del> { lib, buildPythonPackage, fetchPypi, unrar }: </del> <ins> { lib, stdenv, buildPythonPackage, fetchPypi, unrar }: </ins> buildPythonPackage rec { pname = "unrardll";

buildInputs = [ unrar ]; <ins> NIX_CFLAGS_LINK = lib.optionalString stdenv.isDarwin "-headerpad_max_install_names"; postInstall = lib.optionalString stdenv.isDarwin '' install_name_tool -change libunrar.so ${unrar}/lib/libunrar.so $out/lib/python*/site-packages/unrardll/unrar.*-darwin.so install_name_tool -change libunrar.so ${unrar}/lib/libunrar.so build/lib.*/unrardll/unrar.*-darwin.so ''; </ins> pythonImportsCheck = [ "unrardll" ]; meta = with lib; {
Change:
Updating the unstable channel fails on Darwin: this seems to be due to the by-default case-preserving nature of APFS (and HFS+), introduced with this PR: which adds a path which to macOS is the same as the already existing path. Steps to reproduce the behavior: the unstable channel to a macOS machine A new version of the channel is successfully to the machine. Please run and paste the result.
My bad. Should we add a channel blocker label to this to get the PR merged faster?

Discussion:
<ins> { lib , stdenv , fetchFromGitHub , libX11 }: stdenv.mkDerivation rec { pname = "xmcp"; version = "unstable-2020-10-10"; src = fetchFromGitHub { owner = "blblapco"; repo = "xmcp"; rev = "ee56225f1665f9edc04fe5c165809f2fe160a420"; sha256 = "sha256-B3YkYrVEg6UJ2ApaVook4N2XvrCboxDMUG5CN9I79Sg="; }; buildInputs = [ libX11 ]; installPhase = '' runHook preInstall install -Dm0755 xmcp $out/bin/xmcp runHook postInstall ''; meta = with lib; { description = "Tiny color picker for X11"; homepage = "https://github.com/blblapco/xmcp"; license = licenses.gpl3Plus; maintainers = with maintainers; [ azahi ]; platforms = platforms.linux; }; } </ins>

<del> { lib , stdenv , fetchFromGitHub , libX11 }: stdenv.mkDerivation rec { pname = "xmcp"; version = "unstable-2020-10-10"; src = fetchFromGitHub { owner = "blblapco"; repo = "xmcp"; rev = "ee56225f1665f9edc04fe5c165809f2fe160a420"; sha256 = "sha256-B3YkYrVEg6UJ2ApaVook4N2XvrCboxDMUG5CN9I79Sg="; }; buildInputs = [ libX11 ]; installPhase = '' runHook preInstall install -Dm0755 xmcp $out/bin/xmcp runHook postInstall ''; meta = with lib; { description = "Tiny color picker for X11"; homepage = "https://github.com/blblapco/xmcp"; license = licenses.gpl3Plus; maintainers = with maintainers; [ azahi ]; platforms = platforms.linux; }; } </del>

xsos = callPackage ../os-specific/linux/xsos { }; <del> xmcp = callPackage ../tools/x11/xmcp { }; </del> <ins> xmcp = callPackage ../tools/X11/xmcp { }; </ins> zk = callPackage ../applications/office/zk {};
Change:
The service vaultwarden creates a state directory . After creation, the state directory and all files in it (including the sqlite database) are world readable. Since the point of vaultwarden is to store sensitive information, this seems like a bad choice. Steps to reproduce the behavior: the vaultwarden service () permissions of All files in the directory (except for possibly should have permissions 0600. <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --
That is actually not a major issue as Bitwarden is end-to-end encrypted, so the database dump is useless without the master password. That said, it should be an easy and harmless fix to set it to 0600.
I agree.
I suppose this is a security issue. We probably want to prevent someone from getting a database dump as much as possible.
Sorry, completely forgot to actually submit the change. Here it is.

Discussion:
ProtectSystem = "strict"; AmbientCapabilities = "CAP_NET_BIND_SERVICE"; StateDirectory = "bitwarden_rs"; <ins> StateDirectoryMode = "0700"; </ins> }; wantedBy = [ "multi-user.target" ]; };
Change:
fails to compile on unstable. on (Flounder) System: (Flounder) Nix version: nix-env (Nix) 1.11.2 Nixpkgs version: "16.09pre88945." trace:

Discussion:
buildRustPackage rec { name = "racerd-${version}"; <del> version = "0.1.1"; </del> <ins> version = "2016-08-23"; </ins> src = fetchgit { url = "git://github.com/jwilm/racerd.git"; <del> rev = "dcbb7885e84eb5e2fbb2072e185701ad1abbd93a"; sha256 = "0qm0hpvxba632av355mj1wqd616zjvi0qy045np7mi746m0bbqwh"; </del> <ins> rev = "5d685ed26ba812a1afe892a8c0d12eb6abbeeb3d"; sha256 = "1ww96nc00l8p28rnln31n92x0mp2p5jnaqh2nwc8xi3r559p1y5i"; </ins> }; doCheck = false; <del> depsSha256 = "0ca0lc8mm8kczll5m03n5fwsr0540c2xbfi4nn9ksn0s4sap50yn"; </del> <ins> depsSha256 = "13vkabr6bbl2nairxpn3lhqxcr3larasjk03r4hzrn7ff7sy40h2"; </ins> buildInputs = [ makeWrapper ];

name = "exa-${version}"; version = "2016-04-20"; <del> depsSha256 = "0nyrdl57nhr3lxqs3gaij3mdmlrm0z52qv6mznvgw0ziwqmlq5w1"; </del> <ins> depsSha256 = "0qsqkgc1wxigvskhaamgfp5pyc2kprsikhcfccysgs07w44nxkd0"; </ins> src = fetchFromGitHub { owner = "ogham";

{ runCommand, fetchFromGitHub, git }: let <del> version = "2016-08-10"; rev = "fe018be71eeed9c1dc441a16e6a0f32eb6a46bce"; sha256 = "0d8rvhndkz8sz7zn79lrk5vlkpljfilrk52cb2pr5rx83cm89vmi"; </del> <ins> version = "2016-08-23"; rev = "e98ce679ed90bb5b8a64ad9f5bd82f87fd6b641f"; sha256 = "0dpl071ic3ddknsy98dxm99mznlblhmgjqi9ha6rlbldbjp3gf8j"; </ins> src = fetchFromGitHub { inherit rev;
Change:
<!-- Note that these are hard requirements --<!-- You can use the "Go to file" functionality on GitHub to find the package Then you can go to the history for this package Find the latest "packagename: oldversion -newversion" commit The "newversion" is the current version of the package --- <!-- Type the name of your package and try to find an open pull request for the package If you find an open pull request, you can review it! There's a high chance that you'll have the new version right away while helping the community! --- name: materia-kde-theme <!-- The current version can be found easily with the same process as above for checking the master branch If an open PR is present for the package, take this version as the current one and link to the PR --current version: desired version: <!-- Search your package here: If no maintainer is listed for your package, tag the person that last updated the package --maintainers: Please tag this issue in your PR.

Discussion:
stdenv.mkDerivation rec { pname = "materia-kde-theme"; <del> version = "20210814"; </del> <ins> version = "20220607"; </ins> src = fetchFromGitHub { owner = "PapirusDevelopmentTeam"; repo = "materia-kde"; rev = version; <del> sha256 = "KfC1nB5WUcYixqSy5XCP+6Uqhs07Y3p2F1H+5HB8wAg="; </del> <ins> sha256 = "sha256-xshkp1Y5V8A3Fj4HCkmFpWcw3xEuNyRJqOLBkIKhwpQ="; </ins> }; makeFlags = [ "PREFIX=$(out)" ];
Change:
the build ends up with:
We can trivially workaround this by disabling the tests for aarch64-darwin: but it would be much better to understand the underlying issue and fix that instead
ping
Fixed by
follow-up fix in PR:
I can see two PRs disabling hardening features, and , but neither have an explanation of the problem, or why turning off hardening features was the best / correct fix? Can you explain further? I see the workarounds are still present: and It would be great to know why this is necessary for Nix. These hardening features work fine for native builds, and are used in our release binaries.
This used to fix "Killed: 9" error while running the tests, but it seems this is not helping anymore. My guess is that code signing is somehow messing with the test binaries.
I think the hardening feature was broken when building with gfortran. The issue has been fixed recently.
Still broken with "Killed: 9". Looks like binaries are not signed before .
As can be seen here, the issue is intermittent and does not appear all the time: This makes it harder to debug.
Fix in

Discussion:
# fix "Killed: 9  test/test_bitcoin" # https://github.com/NixOS/nixpkgs/issues/179474 <del> hardeningDisable = lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [ "stackprotector" ]; </del> <ins> hardeningDisable = lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [ "fortify" "stackprotector" ]; </ins> checkInputs = [ python3 ];
Change:
the build ends up with:
We can trivially workaround this by disabling the tests for aarch64-darwin: but it would be much better to understand the underlying issue and fix that instead
ping
Fixed by
follow-up fix in PR:
I can see two PRs disabling hardening features, and , but neither have an explanation of the problem, or why turning off hardening features was the best / correct fix? Can you explain further? I see the workarounds are still present: and It would be great to know why this is necessary for Nix. These hardening features work fine for native builds, and are used in our release binaries.
This used to fix "Killed: 9" error while running the tests, but it seems this is not helping anymore. My guess is that code signing is somehow messing with the test binaries.
I think the hardening feature was broken when building with gfortran. The issue has been fixed recently.
Still broken with "Killed: 9". Looks like binaries are not signed before .
As can be seen here, the issue is intermittent and does not appear all the time: This makes it harder to debug.
Fix in

Discussion:
"--with-qt-bindir=${qtbase.dev}/bin:${qttools.dev}/bin" ]; <del> # fix "Killed: 9  test/test_bitcoin" # https://github.com/NixOS/nixpkgs/issues/179474 hardeningDisable = lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [ "fortify" "stackprotector" ]; </del> checkInputs = [ python3 ]; doCheck = true;

{ lib , stdenv , fetchurl <del> , which , cctools </del> <ins> , cmake </ins> }: stdenv.mkDerivation rec {

sha256 = "0jrc84lkc7xb53rb8dbswxrxj21ndj1iiclmk3r9wkp6xm55w6j8"; }; <del> nativeBuildInputs = lib.optionals stdenv.isDarwin [ which cctools ]; </del> <ins> nativeBuildInputs = [ cmake ]; </ins> patches = lib.optional stdenv.isFreeBSD ./freebsd.patch;

minissdpd = callPackage ../tools/networking/minissdpd { }; <del> miniupnpc = callPackage ../tools/networking/miniupnpc { inherit (darwin) cctools; }; </del> <ins> miniupnpc = callPackage ../tools/networking/miniupnpc { }; </ins> miniupnpd = callPackage ../tools/networking/miniupnpd { };
Change:
Steps to reproduce the behavior: the system with the config below This is where the error message comes from. But there hasnt been changed anything recently. nixos-channel UNSTABLE : (This configuration was created by the gui installer and worked fine so far.) If I change the locales to uppercase- Stings it also fails, but with a different error message:
I'm having the same problem
fixed this for me. However it is . In the meantime, you can try setting  manually like so:
It's in unstable now
I updated my system today and still had a similar error When rebuilding I got Full log: I found that in my configuration I have as opposed to Was the naming convention changed at some point?
Seems that glibc normalizes locale codeset names according to [this comment extracted from their codebase][glibc-norm]: Which means that setting and with worked fine before and . However, this is not the case with , since the name of the locale must match the values in [glibc localedata][glibc-supported] and as such anything other than variant will break. We should at least give a warning on and about these changes and the more strict codeset names needed. Since the error that is given to the user right now is not clear on what causes this. [glibc-norm]: ;a=blob;f=locale/programs/localedef.c;h=;hb=HEAD#l561 [glibc-supported]: ;a=blob;f=localedata/SUPPORTED;h=;hb=HEAD
Can confirm, had this happen right now as I tried on nixpkgs/master with some changes for my PR. Changing the capitalization fixed it.
This issue has been mentioned on NixOS Discourse. There might be relevant details there:

Discussion:
supportedLocales = mkOption { type = types.listOf types.str; <del> default = builtins.map (l: l + "/UTF-8") (unique ( </del> <ins> default = unique (builtins.map (l: (replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] l) + "/UTF-8") ( </ins> [ "C.UTF-8" config.i18n.defaultLocale ] ++ (attrValues (filterAttrs (n: v: n != "LANGUAGE") config.i18n.extraLocaleSettings)) )); defaultText = literalExpression '' <del> builtins.map (l: l + "/UTF-8") (unique ( </del> <ins> unique (builtins.map (l: (replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] l) + "/UTF-8") ( </ins> [ "C.UTF-8" config.i18n.defaultLocale
Change:
(shown here with command syntax) Trying that same URL in a browser does indeed get a 404. I guess Qoppa changed how their files or named (or worse, removed them).
Qoppa must have removed the download link for version 2021.1.3. PR upgrades to the latest 2021 version, which fixes the issue.

Discussion:
pdfstudio = callPackage ./common.nix rec { pname = program; year = "2021"; <del> version = "${year}.1.3"; </del> <ins> version = "${year}.2.0"; </ins> desktopName = "PDF Studio"; longDescription = '' PDF Studio is an easy to use, full-featured PDF editing software. This is the standard/pro edition, which requires a license. For the free PDF Studio Viewer see the package pdfstudioviewer.

]; src = fetchurl { url = makeurl { inherit pname year version; }; <del> sha256 = "sha256-2az8/slWeLY7l7dCwyTaT18KFfvsO71vJFDZEvbDHGM="; </del> <ins> sha256 = "sha256-wQgVWz2kS+XkrqvCAUishizfDrCwGyVDAAU4Yzj4uYU="; </ins> }; }; pdfstudioviewer = callPackage ./common.nix rec { pname = program; year = "2021"; <del> version = "${year}.1.3"; </del> <ins> version = "${year}.2.0"; </ins> desktopName = "PDF Studio Viewer"; longDescription = '' PDF Studio Viewer is an easy to use, full-featured PDF editing software. This is the free edition. For the standard/pro edition, see the package pdfstudio. ''; src = fetchurl { url = makeurl { inherit pname year version; }; <del> sha256 = "sha256-kd+rQruBL0fudmc30agRO/XV97l/6unqU0GK25yhOzI="; </del> <ins> sha256 = "sha256-RjVfl3wRK4bqNwSZr2R0CNx4urHTL0QLmKdogEnySWU="; </ins> }; }; }.${program}
Change:
name: hilbish I guess? dunno how to use current version: 1.0.4 desired version: maintainers: Please tag this issue in your PR. I tried to update it myself: But that's not enough to get it to build and I have no experience with Golang stuff: Also: This is outdated. , and the releases have pre-compiled builds for both of them as well: !

Discussion:
owner = "Rosettea"; repo = "Hilbish"; rev = "v${version}"; <del> sha256 = "sha256-n4+qUCbjqxLmGuCQ0QTscJ3me0UZUP/7ggvGp1pNkfg="; </del> <ins> sha256 = "sha256-fUGeQM+7FRGTRL3J4c2+c+NTwrM6d99F2ucKsou2kRk="; </ins> fetchSubmodules = true; };
Change:
Trying to update my package fails because assumes that just works. Steps to reproduce the behavior: 't have enabled? :shrug: or another package that uses / I should be able to run the updateScript without having to worry about experimental features & whether or not they're enabled. n/a I don't mess with experimental stuff ( or ) and Nix versions aside from the default one. Would adding be enough here without breaking stuff for everyone else? Please run and paste the result.
When the script was written, worked without any further options. was introduced later.

Discussion:
if [ -n "$latest_tag" ]; then # print commands to commit the changes if [ "$version" != "$latest_tag" ]; then <del> pfile=$(EDITOR=echo ${nix}/bin/nix edit -f. "$attr_path") </del> <ins> pfile=$(EDITOR=echo ${nix}/bin/nix edit --extra-experimental-features nix-command -f. "$attr_path") </ins> echo "   git add $pfile " >> ${fileForGitCommands} echo "   git commit -m '$attr_path: $version -> $latest_tag'" >> ${fileForGitCommands} fi
Change:
System: (macOS 10.11.6) Nix version: nix-env (Nix) 1.11.2 Nixpkgs version: 16.09pre-git
may fix this problem for you, though you may also wind up needing something like to get a functional set of go commands on darwin.

Discussion:
sed -i '/TestDisasmExtld/areturn' src/cmd/objdump/objdump_test.go <ins> sed -i 's/unrecognized/unknown/' src/cmd/link/internal/ld/lib.go sed -i 's/unrecognized/unknown/' src/cmd/go/build.go </ins> touch $TMPDIR/group $TMPDIR/hosts $TMPDIR/passwd sed -i '1 aexit 0' misc/cgo/errors/test.bash

inherit (darwin.apple_sdk.frameworks) Security Foundation; }; <del> go_1_7 = callPackage ../development/compilers/go/1.7.nix { </del> <ins> go_1_7 = callPackage ../development/compilers/go/1.7.nix ({ </ins> inherit (darwin.apple_sdk.frameworks) Security Foundation; <del> }; </del> <ins> } // stdenv.lib.optionalAttrs stdenv.isDarwin { stdenv = stdenvAdapters.overrideCC pkgs.stdenv pkgs.clang_38; }); </ins> go = self.go_1_7;
Change:
causes an error Consider this flake: Build the system closure with A new slice-unit is created. <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Please run and paste the result.
This issue can be closed now

Discussion:
"--enable-add-ons" "--sysconfdir=/etc" "--localedir=/var/run/current-system/sw/lib/locale" <ins> "libc_cv_ssp=no" </ins> (if kernelHeaders != null then "--with-headers=${kernelHeaders}/include" else "--without-headers")
Change:
Every Vulkan application (even from nixpkgs) simply doesn't work. For example: wine (DXVK): dolphin-emu-beta: Running returns absolutely nothing: I have to manually CTRL+C to interrupt it. works for some reason... Steps to reproduce the behavior: an AMD GPU (I guess) and be on nixos-unstable; ; a Vulkan application (except ). You can try . doesn't work! It should work. Latest build (that I tried) where I don't reproduce the problem is from June 24. The first (that I tried) where I do reproduce the problem is from June 27. I tried wiping (because maybe there was some rogue configuration file doing something?) to no avail. My GPU is an integrated Vega 6 (from a Ryzen 4500U). Tested both RADV and AMDVLK (both don't work).
I bisected the cause: . I have no idea why it does it with RADV, though it may be because I have both installed and using . (I'll test with RADV only now)
And without , Vulkan works even after that commit. Seems to be caused by

Discussion:
in stdenv.mkDerivation rec { pname = "amdvlk"; <del> version = "2022.Q2.3"; </del> <ins> version = "2022.Q2.2"; </ins> src = fetchRepoProject { name = "${pname}-src"; manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git"; rev = "refs/tags/v-${version}"; <del> sha256 = "Yd2juNdSP8TdSX9j/iXsC2xrIRzDEuXJbms91AqwjEc="; </del> <ins> sha256 = "4LV6g2snT1usY+Ic9Hb/IwXAJQ97I9DigZCah6mwewA="; </ins> }; buildInputs = [
Change:
Trying to use harfbuzz in a CMake project, CMake fails with the following: That path comes from /nix/store/7ahz2g1i3m2pfk96fjl6j37ldcwlxpbg-harfbuzz-3.3.2-dev/lib/cmake/harfbuzz/harfbuzz-, probably on line 25 which says . Steps to reproduce the behavior: a CMake project that tries to link an executable to harfbuzz: to configure project () error above The project configures successfully. <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. -- Please run and paste the result.
I think I found a potential clean solution, this patch applies to harfbuzz. Meson has a path join operator, which I made it use instead of the plain string concat operation: Going to see if I can upstream it. (the same change for libdir just for consistency, it isn't technically needed) EDIT: Nope, this doesn't work yet. There must be something similar going on somewhere else still.
While the last one didn't work, this one does but it's nowhere as clean. Oh well.
Fixed in harfbuzz 6.0.0.

Discussion:
stdenv.mkDerivation rec { pname = "harfbuzz${lib.optionalString withIcu "-icu"}"; <del> version = "5.3.1"; </del> <ins> version = "6.0.0"; </ins> src = fetchurl { url = "https://github.com/harfbuzz/harfbuzz/releases/download/${version}/harfbuzz-${version}.tar.xz"; <del> sha256 = "sha256-Smzgl7dagSH6zEuoO1sIO/7GV/RbADzVo0JPKua0Q00="; </del> <ins> sha256 = "HRAQoXUdB21SkeQzwThQKnlNZ5p0mNEmjuIeLUoUDrQ="; </ins> }; <del> patches = [ # Pick upstream patch for exported symbol test failing on darwin # https://github.com/harfbuzz/harfbuzz/issues/3850 (fetchpatch { name = "harfbuzz-fix-check-symbol-tests-lto-and-darwin.patch"; url = "https://github.com/harfbuzz/harfbuzz/commit/b0b7a65388da25ae3fa01e969ad6abc67eed4f49.patch"; sha256 = "0my064r88pikw6q70hbgf6hwfkw544b9f5ai73qhn2a3c83jqn06"; }) ]; </del> postPatch = '' patchShebangs src/*.py test '' + lib.optionalString stdenv.isDarwin ''
Change:
add plpython to nix store The language named plpythonu implements PL/Python based on the default Python language variant, which is currently Python 2. (This default is independent of what any local Python installations might consider to be their “default”, for example, what /usr/bin/python might be.) The default will probably be changed to Python 3 in a distant future release of PostgreSQL, depending on the progress of the migration to Python 3 in the Python community. homepage URL: source URL: license: platforms: unix, linux, darwin, macOS

Discussion:
, nukeReferences, patchelf, llvmPackages , makeRustPlatform, buildPgxExtension, cargo, rustc <ins> # PL/Python , pythonSupport ? false , python3 </ins> # detection of crypt fails when using llvm stdenv, so we add it manually # for <13 (where it got removed: https://github.com/postgres/postgres/commit/c45643d618e35ec2fe91438df15abd4f3c0d85ca) , libxcrypt

++ lib.optionals lz4Enabled [ lz4 ] ++ lib.optionals zstdEnabled [ zstd ] ++ lib.optionals enableSystemd [ systemd ] <ins> ++ lib.optionals pythonSupport [ python3 ] </ins> ++ lib.optionals gssSupport [ libkrb5 ] ++ lib.optionals stdenv'.isLinux [ linux-pam ] ++ lib.optionals (!stdenv'.isDarwin) [ libossp_uuid ];

] ++ lib.optionals lz4Enabled [ "--with-lz4" ] ++ lib.optionals zstdEnabled [ "--with-zstd" ] ++ lib.optionals gssSupport [ "--with-gssapi" ] <ins> ++ lib.optionals pythonSupport [ "--with-python" ] </ins> ++ lib.optionals stdenv'.hostPlatform.isRiscV [ "--disable-spinlocks" ] ++ lib.optionals jitSupport [ "--with-llvm" ] ++ lib.optionals stdenv'.isLinux [ "--with-pam" ];