nix-builder: bump nixpkgs and remove cacert overrides

nix-builder/overlay.nix

@@ -61,27 +61,19 @@ final: prev:
 
   torch-stable-abi-shim = final.callPackage ./pkgs/torch-stable-abi-shim { };
 
-  # Temporary: update the CA bundle to NSS 3.131.1, which removes the
-  # compromised eMudhra intermediates' roots. Remove once nixpkgs ships
-  # cacert >= 3.131.1 in our channel.
-  # https://emudhra.we-have-a-problem.com/
-  cacert = prev.cacert.overrideAttrs (
-    finalAttrs: _: {
-      version = "3.131.1";
-      src = prev.fetchurl {
-        urls =
-          let
-            file = "lib/ckfw/builtins/certdata.txt";
-            tag = "NSS_${prev.lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}_RTM";
-          in
-          [
-            "https://hg-edge.mozilla.org/projects/nss/raw-file/${tag}/${file}"
-            "https://raw.githubusercontent.com/nss-dev/nss/refs/tags/${tag}/${file}"
-          ];
-        hash = "sha256-PsK00kDcEsdH6vRQBh24SvdXxIO72jAvninOtdcL5RA=";
+  # Temporary: revert patchelf 0.15.2 -> 0.19.2 (NixOS/nixpkgs#569010), which
+  # causes segfaults (e.g. cc1plus) in binaries patched by autoPatchelfHook.
+  # Remove once nixpkgs ships a fixed patchelf. Can possibly be removed once
+  # https://github.com/NixOS/patchelf/pull/672 propagates to the channels.
+  patchelf-old =
+    (prev.patchelf.override (old: {
+      fetchurl =
+        args: old.fetchurl (args // { hash = "sha256-F3RfVkFZyOIo/EEtplogSLhGxLa0Igt3y/IkFuAvLXw="; });
+    })).overrideAttrs
+      {
+        version = "0.15.2";
+        __intentionallyOverridingVersion = true;
       };
-    }
-  );
 
   ruff = prev.ruff.overrideAttrs (
     finalAttrs: prevAttrs: {
@@ -344,6 +336,21 @@ final: prev:
   xpuPackages = final.xpuPackages_2025_3_2;
 }
 // (import ./pkgs/cutlass { pkgs = final; })
+// (
+  # libnvshmem builds are very slow. Use binraries instead.
+  let
+    inherit (prev) lib;
+    isCudaPackageSet = name: builtins.match "cudaPackages_[0-9]+_[0-9]+" name != null;
+  in
+  lib.mapAttrs (
+    _: cudaPackages:
+    cudaPackages.overrideScope (
+      finalScope: _: {
+        libnvshmem = finalScope.callPackage ./pkgs/libnvshmem { };
+      }
+    )
+  ) (lib.filterAttrs (name: _: isCudaPackageSet name) prev)
+)
 // (
   let
     flattenVersion = prev.lib.strings.replaceStrings [ "." ] [ "_" ];

nix-builder/pkgs/libnvshmem/default.nix

@@ -0,0 +1,69 @@
+{
+  buildRedist,
+  cuda_cudart,
+  cudaAtLeast,
+  gdrcopy,
+  hwloc,
+  lib,
+  libfabric,
+  libpciaccess,
+  libxml2_13,
+  mpi,
+  pmix,
+  rdma-core,
+  ucx,
+}:
+
+let
+  manifest = lib.importJSON ./redistrib_3.8.0.json;
+in
+buildRedist {
+  redistName = "nvshmem";
+  pname = "libnvshmem";
+  release = manifest.libnvshmem;
+
+  outputs = [
+    "out"
+    "samples"
+  ];
+
+  buildInputs = [
+    cuda_cudart
+    hwloc
+    libfabric
+    mpi
+    pmix
+    rdma-core
+    ucx
+  ]
+  ++ lib.optionals (cudaAtLeast "13.0") [
+    libpciaccess
+    libxml2_13
+  ];
+
+  # Libraries that are dlopened by soname and can therefore not be found by
+  # autoPatchelf.
+  appendRunpaths = [
+    "${lib.getLib rdma-core}/lib"
+    "${lib.getLib gdrcopy}/lib"
+  ];
+
+  autoPatchelfIgnoreMissingDeps = [ "libcuda.so.1" ];
+
+  allowFHSReferences = true;
+
+  postInstall = ''
+    moveToOutput "bin/examples" "''${!outputSamples:?}"
+    moveToOutput "bin/perftest" "''${!outputSamples:?}"
+
+    # Bitcode device libraries (~250 MB), only usable with clang. The source
+    # build in nixpkgs does not provide them either. Also drop the depfiles.
+    rm -v "$out"/lib/*.bc "$out"/lib/*.d
+  '';
+
+  meta = {
+    description = "Parallel programming interface for NVIDIA GPUs based on OpenSHMEM";
+    homepage = "https://developer.nvidia.com/nvshmem";
+    license = lib.licenses.nvidiaCudaRedist;
+  };
+}

nix-builder/pkgs/libnvshmem/redistrib_3.8.0.json

@@ -0,0 +1,67 @@
+{
+    "release_date": "2026-09-22",
+    "release_label": "3.8.0",
+    "release_product": "nvshmem",
+    "libnvshmem": {
+        "name": "NVIDIA nvshmem",
+        "license": "nvshmem",
+        "license_path": "libnvshmem/LICENSE.txt",
+        "version": "3.8.0",
+        "linux-x86_64": {
+            "cuda12": {
+                "relative_path": "libnvshmem/linux-x86_64/libnvshmem-linux-x86_64-3.8.0_cuda12-archive.tar.xz",
+                "sha256": "328461eef448a2c7daa02efb36ff839d7811f1f563782979052b75796656b4cf",
+                "md5": "70368f1a4a83141d3fb5819a6b2683cf",
+                "size": "547534924"
+            },
+            "cuda13": {
+                "relative_path": "libnvshmem/linux-x86_64/libnvshmem-linux-x86_64-3.8.0_cuda13-archive.tar.xz",
+                "sha256": "254f6df1e9860d44b0d8a88f0a779f3881213031547cf28d71bb6d40e821e6ae",
+                "md5": "cc62a45cf232330828332ff7f83f8c34",
+                "size": "484957044"
+            }
+        },
+        "cuda_variant": [
+            "12",
+            "13"
+        ],
+        "linux-sbsa": {
+            "cuda12": {
+                "relative_path": "libnvshmem/linux-sbsa/libnvshmem-linux-sbsa-3.8.0_cuda12-archive.tar.xz",
+                "sha256": "31f61615ec521b65d3ec6ae03c63a985b5eead7a8e906eea913b3d5bddbe021d",
+                "md5": "81d419e9fea97627ea3fd71828d4caf7",
+                "size": "545243060"
+            },
+            "cuda13": {
+                "relative_path": "libnvshmem/linux-sbsa/libnvshmem-linux-sbsa-3.8.0_cuda13-archive.tar.xz",
+                "sha256": "949de817686f8d65c278c5e644c86c69271d63945db2ca71a40c2f7db9b134f6",
+                "md5": "13b70acce87683a8106aca4b7c771631",
+                "size": "477160292"
+            }
+        }
+    },
+    "nvshmem_python": {
+        "name": "NVIDIA nvshmem",
+        "license": "nvshmem",
+        "license_path": "nvshmem_python/LICENSE.txt",
+        "version": "0.4.0.38976383",
+        "source": {
+            "cuda13": {
+                "relative_path": "nvshmem_python/source/nvshmem_python-source-0.4.0.38966635_cuda13-archive.tar.xz",
+                "sha256": "19b9a2bd67e3d9615f3d082b5f4319a8acb83140a56868a9db5a77b9c1221064",
+                "md5": "3e6ca3801f1f1406c922445f78dc9e6e",
+                "size": "845464"
+            },
+            "cuda12": {
+                "relative_path": "nvshmem_python/source/nvshmem_python-source-0.4.0.38976383_cuda12-archive.tar.xz",
+                "sha256": "38455f031095d4a65e7d669a27cdabb4c8cd19550a74e4b433e0e45a33f7b57b",
+                "md5": "5b8d983b3d401a7cf1558a8046fada97",
+                "size": "872732"
+            }
+        },
+        "cuda_variant": [
+            "13",
+            "12"
+        ]
+    }
+}

nix-builder/pkgs/manylinux/generic.nix

@@ -6,6 +6,7 @@
 
   autoPatchelfHook,
   fakeroot,
+  patchelf-old,
 
   manylinuxPackages,
 
@@ -31,6 +32,7 @@ stdenvNoCC.mkDerivation (
     inherit pname version srcs;
 
     nativeBuildInputs = [
+      patchelf-old
       autoPatchelfHook
       fakeroot
       rpmextract

nix-builder/pkgs/python-modules/torch/binary/generic.nix

@@ -21,6 +21,7 @@
   # Native build inputs
   autoAddDriverRunpath,
   autoPatchelfHook,
+  patchelf-old,
   python,
   pythonKernelImportsCheckHook,
   pythonRelaxWheelDepsHook,
@@ -211,6 +212,7 @@ buildPythonPackage.override { stdenv = effectiveStdenv; } {
     pythonWheelDepsCheckHook
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
+    patchelf-old
     autoPatchelfHook
   ]
   ++ lib.optionals cudaSupport [

nix-builder/pkgs/xpu-packages/generic.nix

@@ -3,6 +3,7 @@
   autoPatchelfHook,
   callPackage,
   fetchurl,
+  patchelf-old,
   stdenv,
   rpmextract,
   rsync,
@@ -25,6 +26,7 @@ stdenv.mkDerivation rec {
   inherit pname version srcs;
 
   nativeBuildInputs = [
+    patchelf-old
     autoPatchelfHook
     rpmextract
     rsync