Merge older staging

This still causes some uncached rebuilds, but master(!) and staging
move too fast forward rebuild-wise, so Hydra might never catch up.
(There are also other occasional problems.)
Therefore I merge at this point where the rebuild isn't that bad.

maintainers/scripts/rebuild-amount.sh

@@ -1,260 +1,115 @@
-#!/bin/sh
+#!/usr/bin/env bash
+set -e
 
-usage () {
+if [ "$#" != 1 ] && [ "$#" != 2 ]; then
-  echo 1>&2 "
+	cat <<-EOF
-usage:
+	Usage: $0 commit-spec [commit-spec]
-  $0
+	    You need to be in a git-controlled nixpkgs tree.
-    [--git commit..commit | --git commit]
+	    The current state of the tree will be used if the second commit is missing.
-    [--svn rev:rev | --svn rev]
+	EOF
-    [--path path[:path]*]
+	exit 1
-    [--help]
-
-This program is used to investigate how any changes inside your nixpkgs
-repository may hurt.  With these kind of information you may choose wisely
-where you should commit your changes.
-
-This program adapts it-self to your versionning system to avoid too much
-effort on your Internet bandwidth.  If you need to check more than one
-commits / revisions, you may use the following commands:
-
-  --git remotes/trunk..master
-  --svn 17670:17677
-
-    Check the differences between each commit separating the first and the
-    last commit.
-
-  --path /etc/nixos/nixpkgs:/tmp/nixpkgs_1:/tmp/nixpkgs_2
-
-    Check the differences between multiple directories containing different
-    versions of nixpkgs.
-
-All these options exist with one commit / revision argument.  Such options
-are used to compare your \$NIXPKGS path with the specified version.
-
-If you omit to mention any other commit / revision, then your \$NIXPKGS path
-is compared with its last update.  This command is useful to test code from
-a dirty repository.
-
-"
-
-  exit 1;
-}
-
-#####################
-# Process Arguments #
-#####################
-
-: ${NIXPKGS=/etc/nixos/nixpkgs/}
-
-vcs=""
-gitCommits=""
-svnRevisions=""
-pathLocations=""
-verbose=false
-
-argfun=""
-for arg; do
-  if test -z "$argfun"; then
-    case $arg in
-      --git) vcs="git"; argfun="set_gitCommits";;
-      --svn) vcs="svn"; argfun="set_svnRevisions";;
-      --path) vcs="path"; argfun="set_pathLocations";;
-      --verbose) verbose=true;;
-      --help) usage;;
-      *) usage;;
-    esac
-  else
-    case $argfun in
-      set_*)
-        var=$(echo $argfun | sed 's,^set_,,')
-        eval $var=$arg
-        ;;
-    esac
-    argfun=""
-  fi
-done
-
-if $verbose; then
-  set -x
-else
-  set +x
 fi
 
-############################
+# A slightly hacky way to get the config.
-# Find the repository type #
+parallel="$(echo 'config.rebuild-amount.parallel or false' | nix-repl . 2>/dev/null \
-############################
+			| grep -v '^\(nix-repl.*\)\?$' | tail -n 1 || true)"
 
-if test -z "$vcs"; then
+echo "Estimating rebuild amount by counting changed Hydra jobs."
-  if test -x "$NIXPKGS/.git"; then
-    if git --git-dir="$NIXPKGS/.git" branch > /dev/null 2>&1; then
-      vcs="git"
-      gitCommits=$(git --git-dir="$NIXPKGS/.git" log -n 1 --pretty=format:%H 2> /dev/null)
-    fi
-  elif test -x "$NIXPKGS/.svn"; then
-    cd "$NIXPKGS"
-    if svn info > /dev/null 2>&1; then
-      vcs="svn";
-      svnRevisions=$(svn info | sed -n 's,Revision: ,,p')
-    fi
-    cd -
-  else
-    usage
-  fi
-fi
 
-###############################
+toRemove=()
-# Define a storage directory. #
-###############################
 
-pkgListDir=""
+cleanup() {
-exitCode=1
+	rm -rf "${toRemove[@]}"
-cleanup(){
-  test -e "$pkgListDir" && rm -rf "$pkgListDir"
-  exit $exitCode;
 }
-
 trap cleanup EXIT SIGINT SIGQUIT ERR
 
-pkgListDir=$(mktemp --tmpdir -d rebuild-amount-XXXXXXXX)
+MKTEMP='mktemp --tmpdir nix-rebuild-amount-XXXXXXXX'
-vcsDir="$pkgListDir/.vcs"
 
-###########################
+nixexpr() {
-# Versionning for Dummies #
+	cat <<-EONIX
-###########################
+		let
+		  lib = import $1/lib;
+		  hydraJobs = import $1/pkgs/top-level/release.nix
+		    # Compromise: accuracy vs. resources needed for evaluation.
+		    { supportedSystems = cfg.systems or [ "x86_64-linux" "x86_64-darwin" ]; };
+		  cfg = (import $1 {}).config.rebuild-amount or {};
 
-path_init() {
+		  recurseIntoAttrs = attrs: attrs // { recurseForDerivations = true; };
-  if test "${pathLocations#*:}" = "$pathLocations"; then
+
-    pathLocations="$NIXPKGS:$pathLocations"
+		  # hydraJobs leaves recurseForDerivations as empty attrmaps;
-  fi
+		  # that would break nix-env and we also need to recurse everywhere.
-  pathLocations="${pathLocations}:"
+		  tweak = lib.mapAttrs
+		    (name: val:
+		      if name == "recurseForDerivations" then true
+		      else if lib.isAttrs val && val.type or null != "derivation"
+		              then recurseIntoAttrs (tweak val)
+		      else val
+		    );
+
+		  # Some of these contain explicit references to platform(s) we want to avoid;
+		  # some even (transitively) depend on ~/.nixpkgs/config.nix (!)
+		  blacklist = [
+		    "tarball" "metrics" "manual"
+		    "darwin-tested" "unstable" "stdenvBootstrapTools"
+		    "moduleSystem" "lib-tests" # these just confuse the output
+		  ];
+		
+		in
+		  tweak (builtins.removeAttrs hydraJobs blacklist)
+	EONIX
 }
 
-path_getNext() {
+# Output packages in tree $2 that weren't in $1.
-  pathLoc="${pathLocations%%:*}"
+# Changing the output hash or name is taken as a change.
-  pathLocations="${pathLocations#*:}"
+# Extra nix-env parameters can be in $3
+newPkgs() {
+	# We use files instead of pipes, as running multiple nix-env processes
+	# could eat too much memory for a standard 4GiB machine.
+	local -a list
+	for i in 1 2; do
+		local l="$($MKTEMP)"
+		list[$i]="$l"
+		toRemove+=("$l")
+
+		local expr="$($MKTEMP)"
+		toRemove+=("$expr")
+		nixexpr "${!i}" > "$expr"
+
+		nix-env -f "$expr" -qaP --no-name --out-path --show-trace $3 \
+			| sort > "${list[$i]}" &
+
+		if [ "$parallel" != "true" ]; then
+			wait
+		fi
+	done
+
+	wait
+	comm -13 "${list[@]}"
 }
 
-path_setPath() {
+# Prepare nixpkgs trees.
-  path="$pathLoc"
+declare -a tree
-}
+for i in 1 2; do
+	if [ -n "${!i}" ]; then # use the given commit
+		dir="$($MKTEMP -d)"
+		tree[$i]="$dir"
+		toRemove+=("$dir")
 
-path_setName() {
+		git clone --shared --no-checkout --quiet . "${tree[$i]}"
-  name=$(echo "$pathLoc" | tr '/' '_')
+		(cd "${tree[$i]}" && git checkout --quiet "${!i}")
-}
+	else #use the current tree
-
+		tree[$i]="$(pwd)"
-################
+	fi
-# Git Commands #
-################
-
-git_init() {
-  git clone "$NIXPKGS/.git" "$vcsDir" > /dev/null 2>&1
-  if echo "gitCommits" | grep -c "\.\." > /dev/null 2>&1; then
-    gitCommits=$(git --git-dir="$vcsDir/.git" log --reverse --pretty=format:%H $gitCommits 2> /dev/null)
-  else
-    pathLocations="$vcsDir:$NIXPKGS"
-    vcs="path"
-    path_init
-  fi
-}
-
-git_getNext() {
-  git --git-dir="$vcsDir/.git" checkout $(echo "$gitCommits" | head -n 1) > /dev/null 2>&1
-  gitCommits=$(echo "$gitCommits" | sed '1 d')
-}
-
-git_setPath() {
-  path="$vcsDir"
-}
-
-git_setName() {
-  name=$(git --git-dir="$vcsDir/.git" log -n 1 --pretty=format:%H  2> /dev/null)
-}
-
-#######################
-# Subversion Commands #
-#######################
-
-svn_init() {
-  cp -r "$NIXPKGS" "$vcsDir" > /dev/null 2>&1
-  if echo "svnRevisions" | grep -c ":" > /dev/null 2>&1; then
-    svnRevisions=$(seq ${svnRevisions%:*} ${svnRevisions#*:})
-  else
-    pathLocations="$vcsDir:$NIXPKGS"
-    vcs="path"
-    path_init
-  fi
-}
-
-svn_getNext() {
-  cd "$vcsDir"
-  svn checkout $(echo "$svnRevisions" | head -n 1) > /dev/null 2>&1
-  cd -
-  svnRevisions=$(echo "$svnRevisions" | sed '1 d')
-}
-
-svn_setPath() {
-  path="$vcsDir"
-}
-
-svn_setName() {
-  name=$(svn info  2> /dev/null | sed -n 's,Revision: ,,p')
-}
-
-####################
-# Logical Commands #
-####################
-
-init    () { ${vcs}_init; }
-getNext () { ${vcs}_getNext; }
-setPath () { ${vcs}_setPath; }
-setName () { ${vcs}_setName; }
-
-
-#####################
-# Check for Rebuild #
-#####################
-
-# Generate the list of all derivations that could be build from a nixpkgs
-# respository.  This list of derivation hashes is compared with previous
-# lists and a brief summary is produced on the output.
-
-compareNames () {
-    nb=$(diff -y --suppress-common-lines --speed-large-files "$pkgListDir/$1.drvs" "$pkgListDir/$2.drvs" 2> /dev/null | wc -l)
-    echo "$1 -> $2: $nb"
-}
-
-echo "Please wait, this may take some minutes ..."
-
-init
-first=""
-oldPrev=""
-
-prev=""
-curr=""
-
-while true; do
-  getNext
-  setPath # set path=...
-  setName # set name=...
-  curr="$name"
-
-  test -z "$curr" && break || true
-
-  nix-instantiate "$path" > "$pkgListDir/$curr.drvs" > /dev/null 2>&1 || true
-
-  if test -n "$prev"; then
-    compareNames "$prev" "$curr"
-  else
-    echo "Number of package to rebuild:"
-    first="$curr"
-  fi
-  oldPrev="$prev"
-  prev="$curr"
 done
 
-if test "$first" != "$oldPrev"; then
+newlist="$($MKTEMP)"
-  echo "Number of package to rebuild (first -> last):"
+toRemove+=("$newlist")
-  compareNames "$first" "$curr"
+# Notes:
-fi
+#	- the evaluation is done on x86_64-linux, like on Hydra.
+#	- using $newlist file so that newPkgs() isn't in a sub-shell (because of toRemove)
+newPkgs "${tree[1]}" "${tree[2]}" '--argstr system "x86_64-linux"' > "$newlist"
+
+# Hacky: keep only the last word of each attribute path and sort.
+sed -n 's/\([^. ]*\.\)*\([^. ]*\) .*$/\2/p' < "$newlist" \
+	| sort | uniq -c
 
-exitCode=0

pkgs/applications/science/math/calc/default.nix

@@ -34,6 +34,9 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/calc --prefix LD_LIBRARY_PATH : $out/lib
   '';
 
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" '';
+
   meta = {
     description = "C-style arbitrary precision calculator";
     homepage = http://www.isthe.com/chongo/tech/comp/calc/;

pkgs/build-support/cc-wrapper/utils.sh

@@ -23,26 +23,55 @@ badPath() {
         "${p:0:${#NIX_BUILD_TOP}}" != "$NIX_BUILD_TOP"
 }
 
-expandResponseParams() {
+# @args.rsp parser.
-    local inparams=("$@")
+# Char classes: space, other, backslash, single quote, double quote.
-    local n=0
+# States: 0 - outside, 1/2 - unquoted arg/slash, 3/4 - 'arg'/slash, 5/6 - "arg"/slash.
-    local p
+# State transitions:
-    params=()
+rspT=(01235 01235 11111 33413 33333 55651 55555)
-    while [ $n -lt ${#inparams[*]} ]; do
+# Push char on transition:
-        p=${inparams[n]}
+rspC[01]=1 rspC[11]=1 rspC[21]=1 rspC[33]=1 rspC[43]=1 rspC[55]=1 rspC[65]=1
-        case $p in
+
-            @*)
+rspParse() {
-                if [ -e "${p:1}" ]; then
+    rsp=()
-                    args=$(<"${p:1}")
+    local s="$1"
-                    eval 'for arg in '${args//$/\\$}'; do params+=("$arg"); done'
+    local state=0
-                else
+    local arg=''
-                    params+=("$p")
+
-                fi
+    for (( i=0; i<${#s}; i++ )); do
-                ;;
+        local c="${s:$i:1}"
-            *)
+        local cls=1
-                params+=("$p")
+        case "$c" in
-                ;;
+            ' ' | $'\t' | $'\r' | $'\n') cls=0 ;;
+            '\') cls=2 ;;
+            "'") cls=3 ;;
+            '"') cls=4 ;;
         esac
-        n=$((n + 1))
+        local nextstates="${rspT[$state]}"
+        local nextstate="${nextstates:$cls:1}"
+        if [ "${rspC[$state$nextstate]}" ]; then
+            arg+="$c"
+        elif [ "$state$nextstate" = "10" ]; then
+            rsp+=("$arg")
+            arg=''
+        fi
+        state="$nextstate"
+    done
+
+    if [ "$state" -ne 0 ]; then
+        rsp+=("$arg")
+    fi
+}
+
+expandResponseParams() {
+    params=()
+    while [ $# -gt 0 ]; do
+        local p="$1"
+        shift
+        if [ "${p:0:1}" = '@' -a -e "${p:1}" ]; then
+            rspParse "$(<"${p:1}")"
+            set -- "${rsp[@]}" "$@"
+        else
+            params+=("$p")
+        fi
     done
 }

pkgs/build-support/setup-hooks/audit-tmpdir.sh

@@ -0,0 +1,41 @@
+# Check whether RPATHs or wrapper scripts contain references to
+# $TMPDIR. This is a serious security bug because it allows any user
+# to inject files into search paths of other users' processes.
+#
+# It might be better to have Nix scan build output for any occurrence
+# of $TMPDIR (which would also be good for reproducibility), but at
+# the moment that would produce too many spurious errors (e.g. debug
+# info or assertion messages that refer to $TMPDIR).
+
+fixupOutputHooks+=('if [ -z "$noAuditTmpdir" -a -e "$prefix" ]; then auditTmpdir "$prefix"; fi')
+
+auditTmpdir() {
+    local dir="$1"
+    [ -e "$dir" ] || return 0
+
+    header "checking for references to $TMPDIR in $dir..."
+
+    local i
+    while IFS= read -r -d $'\0' i; do
+        if [[ "$i" =~ .build-id ]]; then continue; fi
+
+        if isELF "$i"; then
+            if patchelf --print-rpath "$i" | grep -q -F "$TMPDIR"; then
+                echo "RPATH of binary $i contains a forbidden reference to $TMPDIR"
+                exit 1
+            fi
+        fi
+
+        if  isScript "$i"; then
+            if [ -e "$(dirname $i)/.$(basename $i)-wrapped" ]; then
+                if grep -q -F "$TMPDIR" "$i"; then
+                    echo "wrapper script $i contains a forbidden reference to $TMPDIR"
+                    exit 1
+                fi
+            fi
+        fi
+
+    done < <(find "$dir" -type f -print0)
+
+    stopNest
+}

pkgs/build-support/setup-hooks/multiple-outputs.sh

@@ -61,7 +61,7 @@ _multioutConfig() {
             local shareDocName="$(sed -n "s/^PACKAGE_TARNAME='\(.*\)'$/\1/p" < "$confScript")"
         fi
                                     # PACKAGE_TARNAME sometimes contains garbage.
-        if [ -n "$shareDocName" ] || echo "$shareDocName" | grep -q '[^a-zA-Z-_0-9]'; then
+        if [ -n "$shareDocName" ] || echo "$shareDocName" | grep -q '[^a-zA-Z0-9_-]'; then
             shareDocName="$(echo "$name" | sed 's/-[^a-zA-Z].*//')"
         fi
     fi

pkgs/development/compilers/bigloo/default.nix

@@ -32,6 +32,9 @@ stdenv.mkDerivation rec {
 
   checkTarget = "test";
 
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" '';
+
   meta = {
     description = "Efficient Scheme compiler";
     homepage    = http://www-sop.inria.fr/indes/fp/Bigloo/;

pkgs/development/compilers/llvm/3.9/clang/default.nix

@@ -13,7 +13,9 @@ let
       mv clang-tools-extra-* $sourceRoot/tools/extra
     '';
 
-    buildInputs = [ cmake libedit libxml2 llvm python ];
+    nativeBuildInputs = [ cmake ];
+
+    buildInputs = [ libedit libxml2 llvm python ];
 
     cmakeFlags = [
       "-DCMAKE_CXX_FLAGS=-std=c++11"

pkgs/development/compilers/llvm/3.9/llvm.nix

@@ -15,10 +15,15 @@
 , compiler-rt_src
 , libcxxabi
 , debugVersion ? false
-, enableSharedLibraries ? true
+, enableSharedLibraries ? (buildPlatform == hostPlatform)
 , darwin
+, buildPackages
+, buildPlatform
+, hostPlatform
 }:
 
+assert (hostPlatform != buildPlatform) -> !enableSharedLibraries;
+
 let
   src = fetch "llvm" "1vi9sf7rx1q04wj479rsvxayb6z740iaz3qniwp266fgp5a07n8z";
   shlib = if stdenv.isDarwin then "dylib" else "so";
@@ -39,8 +44,17 @@ in stdenv.mkDerivation rec {
 
   outputs = [ "out" ] ++ stdenv.lib.optional enableSharedLibraries "lib";
 
-  buildInputs = [ perl groff cmake libxml2 python libffi ]
+  nativeBuildInputs = [
-    ++ stdenv.lib.optionals stdenv.isDarwin [ libcxxabi ];
+    perl
+    cmake
+    python
+  ];
+
+  buildInputs = [
+    groff
+    libxml2
+    libffi
+  ] ++ stdenv.lib.optionals stdenv.isDarwin [ libcxxabi ];
 
   propagatedBuildInputs = [ ncurses zlib ];
 
@@ -88,6 +102,9 @@ in stdenv.mkDerivation rec {
     ++ stdenv.lib.optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
+  ] ++ stdenv.lib.optionals (buildPlatform != hostPlatform) [
+    "-DCMAKE_CROSSCOMPILING=True"
+    "-DLLVM_TABLEGEN=${buildPackages.llvmPackages_39.llvm}/bin/llvm-tblgen"
   ];
 
   postBuild = ''

pkgs/development/compilers/swift/default.nix

@@ -253,6 +253,9 @@ stdenv.mkDerivation rec {
     ln -s ${binutils}/bin/ar $out/bin/ar
   '';
 
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" '';
+
   meta = with stdenv.lib; {
     description = "The Swift Programming Language";
     homepage = "https://github.com/apple/swift";

pkgs/development/interpreters/python/cpython/2.7/default.nix

@@ -15,6 +15,7 @@
 , expat
 , libffi
 , CF, configd, coreutils
+, python-setup-hook
 # For the Python package set
 , pkgs, packageOverrides ? (self: super: {})
 }:
@@ -150,7 +151,7 @@ in stdenv.mkDerivation {
     NIX_CFLAGS_COMPILE = optionalString stdenv.isDarwin "-msse2";
     DETERMINISTIC_BUILD = 1;
 
-    setupHook = ./setup-hook.sh;
+    setupHook = python-setup-hook sitePackages;
 
     postPatch = optionalString (x11Support && (tix != null)) ''
           substituteInPlace "Lib/lib-tk/Tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"

pkgs/development/interpreters/python/cpython/2.7/setup-hook.sh

@@ -1,15 +0,0 @@
-addPythonPath() {
-    addToSearchPathWithCustomDelimiter : PYTHONPATH $1/lib/python2.7/site-packages
-}
-
-toPythonPath() {
-    local paths="$1"
-    local result=
-    for i in $paths; do
-        p="$i/lib/python2.7/site-packages"
-        result="${result}${result:+:}$p"
-    done
-    echo $result
-}
-
-envHooks+=(addPythonPath)

pkgs/development/interpreters/python/cpython/3.3/default.nix

@@ -11,6 +11,7 @@
 , callPackage
 , self
 , CF, configd
+, python-setup-hook
 # For the Python package set
 , pkgs, packageOverrides ? (self: super: {})
 }:
@@ -77,7 +78,7 @@ in stdenv.mkDerivation {
                         )
   '';
 
-  setupHook = ./setup-hook.sh;
+  setupHook = python-setup-hook sitePackages;
 
   postInstall = ''
     # needed for some packages, especially packages that backport functionality

pkgs/development/interpreters/python/cpython/3.3/setup-hook.sh

@@ -1,15 +0,0 @@
-addPythonPath() {
-    addToSearchPathWithCustomDelimiter : PYTHONPATH $1/lib/python3.3/site-packages
-}
-
-toPythonPath() {
-    local paths="$1"
-    local result=
-    for i in $paths; do
-        p="$i/lib/python3.3/site-packages"
-        result="${result}${result:+:}$p"
-    done
-    echo $result
-}
-
-envHooks+=(addPythonPath)

pkgs/development/interpreters/python/cpython/3.4/default.nix

@@ -13,6 +13,7 @@
 , callPackage
 , self
 , CF, configd
+, python-setup-hook
 # For the Python package set
 , pkgs, packageOverrides ? (self: super: {})
 }:
@@ -100,7 +101,7 @@ in stdenv.mkDerivation {
      ''}
   '';
 
-  setupHook = ./setup-hook.sh;
+  setupHook = python-setup-hook sitePackages;
 
   postInstall = ''
     # needed for some packages, especially packages that backport functionality

pkgs/development/interpreters/python/cpython/3.4/setup-hook.sh

@@ -1,15 +0,0 @@
-addPythonPath() {
-    addToSearchPathWithCustomDelimiter : PYTHONPATH $1/lib/python3.4/site-packages
-}
-
-toPythonPath() {
-    local paths="$1"
-    local result=
-    for i in $paths; do
-        p="$i/lib/python3.4/site-packages"
-        result="${result}${result:+:}$p"
-    done
-    echo $result
-}
-
-envHooks+=(addPythonPath)

pkgs/development/interpreters/python/cpython/3.5/default.nix

@@ -13,6 +13,7 @@
 , callPackage
 , self
 , CF, configd
+, python-setup-hook
 # For the Python package set
 , pkgs, packageOverrides ? (self: super: {})
 }:
@@ -102,7 +103,7 @@ in stdenv.mkDerivation {
      ''}
   '';
 
-  setupHook = ./setup-hook.sh;
+  setupHook = python-setup-hook sitePackages;
 
   postInstall = ''
     # needed for some packages, especially packages that backport functionality

pkgs/development/interpreters/python/cpython/3.5/setup-hook.sh

@@ -1,15 +0,0 @@
-addPythonPath() {
-    addToSearchPathWithCustomDelimiter : PYTHONPATH $1/lib/python3.5/site-packages
-}
-
-toPythonPath() {
-    local paths="$1"
-    local result=
-    for i in $paths; do
-        p="$i/lib/python3.5/site-packages"
-        result="${result}${result:+:}$p"
-    done
-    echo $result
-}
-
-envHooks+=(addPythonPath)

pkgs/development/interpreters/python/cpython/3.6/default.nix

@@ -14,6 +14,7 @@
 , callPackage
 , self
 , CF, configd
+, python-setup-hook
 # For the Python package set
 , pkgs, packageOverrides ? (self: super: {})
 }:
@@ -94,7 +95,7 @@ in stdenv.mkDerivation {
      ''}
   '';
 
-  setupHook = ./setup-hook.sh;
+  setupHook = python-setup-hook sitePackages;
 
   postInstall = ''
     # needed for some packages, especially packages that backport functionality

pkgs/development/interpreters/python/cpython/3.6/setup-hook.sh

@@ -1,15 +0,0 @@
-addPythonPath() {
-    addToSearchPathWithCustomDelimiter : PYTHONPATH $1/lib/python3.6/site-packages
-}
-
-toPythonPath() {
-    local paths="$1"
-    local result=
-    for i in $paths; do
-        p="$i/lib/python3.6/site-packages"
-        result="${result}${result:+:}$p"
-    done
-    echo $result
-}
-
-envHooks+=(addPythonPath)

pkgs/development/interpreters/python/mk-python-derivation.nix

@@ -57,13 +57,6 @@ python.stdenv.mkDerivation (builtins.removeAttrs attrs ["disabled"] // {
 
   inherit pythonPath;
 
-
-  # Determinism: The interpreter is patched to write null timestamps when compiling python files.
-  # This way python doesn't try to update them when we freeze timestamps in nix store.
-  DETERMINISTIC_BUILD=1;
-  # Determinism: We fix the hashes of str, bytes and datetime objects.
-  PYTHONHASHSEED = 0;
-
   buildInputs = [ wrapPython ] ++ buildInputs ++ pythonPath
     ++ [ (ensureNewerSourcesHook { year = "1980"; }) ]
     ++ (lib.optional (lib.hasSuffix "zip" attrs.src.name or "") unzip)

pkgs/development/interpreters/python/pypy/2.7/default.nix

@@ -1,6 +1,7 @@
 { stdenv, fetchurl, zlib ? null, zlibSupport ? true, bzip2, pkgconfig, libffi
 , sqlite, openssl, ncurses, python, expat, tcl, tk, tix, xlibsWrapper, libX11
 , makeWrapper, callPackage, self, gdbm, db
+, python-setup-hook
 # For the Python package set
 , pkgs, packageOverrides ? (self: super: {})
 }:
@@ -14,6 +15,7 @@ let
   pythonVersion = "2.7";
   version = "${majorVersion}.${minorVersion}${minorVersionSuffix}";
   libPrefix = "pypy${majorVersion}";
+  sitePackages = "site-packages";
 
 in stdenv.mkDerivation rec {
     name = "pypy-${version}";
@@ -67,7 +69,7 @@ in stdenv.mkDerivation rec {
       ${python.interpreter} rpython/bin/rpython --make-jobs="$NIX_BUILD_CORES" -Ojit --batch pypy/goal/targetpypystandalone.py --withmod-_minimal_curses --withmod-unicodedata --withmod-thread --withmod-bz2 --withmod-_multiprocessing
     '';
 
-    setupHook = ./setup-hook.sh;
+    setupHook = python-setup-hook sitePackages;
 
     postBuild = ''
       cd ./lib_pypy
@@ -125,12 +127,11 @@ in stdenv.mkDerivation rec {
     passthru = let
       pythonPackages = callPackage ../../../../../top-level/python-packages.nix {python=self; overrides=packageOverrides;};
     in rec {
-      inherit zlibSupport libPrefix;
+      inherit zlibSupport libPrefix sitePackages;
       executable = "pypy";
       isPypy = true;
       buildEnv = callPackage ../../wrapper.nix { python = self; };
       interpreter = "${self}/bin/${executable}";
-      sitePackages = "site-packages";
       withPackages = import ../../with-packages.nix { inherit buildEnv pythonPackages;};
       pkgs = pythonPackages;
     };

pkgs/development/interpreters/python/pypy/2.7/setup-hook.sh

@@ -1,15 +0,0 @@
-addPythonPath() {
-    addToSearchPathWithCustomDelimiter : PYTHONPATH $1/site-packages
-}
-
-toPythonPath() {
-    local paths="$1"
-    local result=
-    for i in $paths; do
-        p="$i/site-packages"
-        result="${result}${result:+:}$p"
-    done
-    echo $result
-}
-
-envHooks+=(addPythonPath)

pkgs/development/interpreters/python/setup-hook.nix

@@ -0,0 +1,13 @@
+{ runCommand }:
+
+sitePackages:
+
+let
+  hook = ./setup-hook.sh;
+in runCommand "python-setup-hook.sh" {
+  inherit sitePackages;
+} ''
+  cp ${hook} hook.sh
+  substituteAllInPlace hook.sh
+  mv hook.sh $out
+''

pkgs/development/interpreters/python/setup-hook.sh

@@ -0,0 +1,21 @@
+addPythonPath() {
+    addToSearchPathWithCustomDelimiter : PYTHONPATH $1/@sitePackages@
+}
+
+toPythonPath() {
+    local paths="$1"
+    local result=
+    for i in $paths; do
+        p="$i/@sitePackages@"
+        result="${result}${result:+:}$p"
+    done
+    echo $result
+}
+
+envHooks+=(addPythonPath)
+
+# Determinism: The interpreter is patched to write null timestamps when compiling python files.
+# This way python doesn't try to update them when we freeze timestamps in nix store.
+export DETERMINISTIC_BUILD=1;
+# Determinism: We fix the hashes of str, bytes and datetime objects.
+export PYTHONHASHSEED=0;

pkgs/development/libraries/accounts-qt/default.nix

@@ -18,6 +18,9 @@ stdenv.mkDerivation rec {
     qmakeFlags="$qmakeFlags LIBDIR=$out/lib CMAKE_CONFIG_PATH=$out/lib/cmake"
   '';
 
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" '';
+
   meta = with stdenv.lib; {
     description = "Qt library for accessing the online accounts database";
     homepage = "http://code.google.com/p/accounts-sso/";

pkgs/development/libraries/freetype/cve-2017-8105.patch

@@ -0,0 +1,27 @@
+http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=f958c48ee43
+
+diff --git a/src/psaux/t1decode.c b/src/psaux/t1decode.c
+index af7b465..7dd4513 100644
+--- a/src/psaux/t1decode.c
++++ b/src/psaux/t1decode.c
+@@ -780,10 +780,19 @@
+             /* point without adding any point to the outline    */
+             idx = decoder->num_flex_vectors++;
+             if ( idx > 0 && idx < 7 )
++            {
++              /* in malformed fonts it is possible to have other */
++              /* opcodes in the middle of a flex (which don't    */
++              /* increase `num_flex_vectors'); we thus have to   */
++              /* check whether we can add a point                */
++              if ( FT_SET_ERROR( t1_builder_check_points( builder, 1 ) ) )
++                goto Syntax_Error;
++
+               t1_builder_add_point( builder,
+                                     x,
+                                     y,
+                                     (FT_Byte)( idx == 3 || idx == 6 ) );
++            }
+           }
+           break;
+ 
+

pkgs/development/libraries/freetype/cve-2017-8287.patch

@@ -0,0 +1,22 @@
+http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=3774fc08b
+
+diff --git a/src/psaux/psobjs.c b/src/psaux/psobjs.c
+index d18e821..0baf836 100644
+--- a/src/psaux/psobjs.c
++++ b/src/psaux/psobjs.c
+@@ -1718,6 +1718,14 @@
+     first = outline->n_contours <= 1
+             ? 0 : outline->contours[outline->n_contours - 2] + 1;
+ 
++    /* in malformed fonts it can happen that a contour was started */
++    /* but no points were added                                    */
++    if ( outline->n_contours && first == outline->n_points )
++    {
++      outline->n_contours--;
++      return;
++    }
++
+     /* We must not include the last point in the path if it */
+     /* is located on the first point.                       */
+     if ( outline->n_points > 1 )
+

pkgs/development/libraries/freetype/default.nix

@@ -48,6 +48,9 @@ in stdenv.mkDerivation {
       ./pcf-config-long-family-names.patch
       ./disable-pcf-long-family-names.patch
       ./enable-table-validation.patch
+      # remove the two CVE patches after updating to >= 2.8
+      ./cve-2017-8105.patch
+      ./cve-2017-8287.patch
     ] ++
     optional useEncumberedCode ./enable-subpixel-rendering.patch;
 

pkgs/development/libraries/gnutls/3.5.nix

@@ -1,11 +1,11 @@
 { callPackage, fetchurl, libunistring, ... } @ args:
 
 callPackage ./generic.nix (args // rec {
-  version = "3.5.11";
+  version = "3.5.12";
 
   src = fetchurl {
     url = "ftp://ftp.gnutls.org/gcrypt/gnutls/v3.5/gnutls-${version}.tar.xz";
-    sha256 = "13z2dxxyrsb7gfpl1k2kafqh2zaigi872y5xgykhs9cyaz2mqxji";
+    sha256 = "1jspvrmydqgz30c1ji94b55gr2dynz7p96p4y8fkhad0xajkkjv3";
   };
 
   # Skip two tests introduced in 3.5.11.  Probable reasons of failure:

pkgs/development/libraries/libcommuni/default.nix

@@ -25,6 +25,9 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" '';
+
   meta = with stdenv.lib; {
     description = "A cross-platform IRC framework written with Qt";
     homepage = https://communi.github.io;

pkgs/development/libraries/libdwg/default.nix

@@ -12,6 +12,9 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "format" ];
 
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" '';
+
   meta = {
     description = "Library reading dwg files";
     homepage = http://libdwg.sourceforge.net/en/;

pkgs/development/libraries/libftdi/default.nix

@@ -12,6 +12,9 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ libusb ];
 
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" '';
+
   meta = {
     description = "A library to talk to FTDI chips using libusb";
     homepage = http://www.intra2net.com/en/developer/libftdi/;

pkgs/development/libraries/libtiff/default.nix

@@ -12,10 +12,10 @@ stdenv.mkDerivation rec {
   };
 
   prePatch =let
-      # https://lwn.net/Vulnerabilities/711777/
+      # https://lwn.net/Vulnerabilities/711777/ and more patched in *-6 -> *-7
       debian = fetchurl {
-        url = http://http.debian.net/debian/pool/main/t/tiff/tiff_4.0.7-5.debian.tar.xz;
+        url = http://http.debian.net/debian/pool/main/t/tiff/tiff_4.0.7-6.debian.tar.xz;
-        sha256 = "1ribxdn89wx3nllcyh7ql3dx6wpr1h7z3waglz1w7dklxm43q67l";
+        sha256 = "9c9048c28205bdbeb5ba36c7a194d0cd604bd137c70961607bfc8a079be5fa31";
       };
     in ''
       tar xf '${debian}'

pkgs/development/libraries/mesa/default.nix

@@ -67,7 +67,7 @@ let
 in
 
 let
-  version = "17.0.4";
+  version = "17.0.6";
   branch  = head (splitString "." version);
   driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32";
 in
@@ -82,7 +82,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz"
     ];
-    sha256 = "1269dc8545a193932a0779b2db5bce9be4a5f6813b98c38b93b372be8362a346";
+    sha256 = "17d60jjzg4ddm95gk2cqx0xz6b9anmmz6ax4majwr3gis2yg7v49";
   };
 
   prePatch = "patchShebangs .";

pkgs/development/libraries/ncurses/default.nix

@@ -65,9 +65,6 @@ stdenv.mkDerivation rec {
     sed -i -e 's,LIB_SUFFIX="t,LIB_SUFFIX=",' configure
   '';
 
-  # Here only for native hash, remove on next mass rebuild
-  selfNativeBuildInput = buildPlatform == hostPlatform;
-
   enableParallelBuilding = true;
 
   doCheck = false;

pkgs/development/libraries/qt-5/5.6/qtwebkit/default.nix

@@ -31,5 +31,9 @@ qtSubmodule {
         };
     in optionals flashplayerFix [ dlopen-webkit-nsplugin dlopen-webkit-gtk ]
     ++ [ dlopen-webkit-udev ];
+
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" && mkdir "$(pwd)" '';
+
   meta.maintainers = with stdenv.lib.maintainers; [ abbradar ];
 }

pkgs/development/libraries/qt-5/5.8/qtwebkit/default.nix

@@ -39,5 +39,9 @@ qtSubmodule {
     in optionals flashplayerFix [ dlopen-webkit-nsplugin dlopen-webkit-gtk ]
     ++ optionals (!stdenv.isDarwin) [ dlopen-webkit-udev ]
     ++ optionals (stdenv.isDarwin) [ ./0004-icucore-darwin.patch ];
+
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" && mkdir "$(pwd)" '';
+
   meta.maintainers = with stdenv.lib.maintainers; [ abbradar periklis ];
 }

pkgs/development/tools/build-managers/cmake/setup-hook.sh

@@ -49,7 +49,7 @@ cmakeConfigurePhase() {
 
     # Avoid cmake resetting the rpath of binaries, on make install
     # And build always Release, to ensure optimisation flags
-    cmakeFlags="-DCMAKE_BUILD_TYPE=Release -DCMAKE_SKIP_BUILD_RPATH=ON $cmakeFlags"
+    cmakeFlags="-DCMAKE_BUILD_TYPE=${cmakeBuildType:-Release} -DCMAKE_SKIP_BUILD_RPATH=ON $cmakeFlags"
 
     echo "cmake flags: $cmakeFlags ${cmakeFlagsArray[@]}"
 

pkgs/development/tools/simavr/default.nix

@@ -18,6 +18,9 @@ stdenv.mkDerivation rec {
   buildFlags = "AVR_ROOT=${avrgcclibc}/avr SIMAVR_VERSION=${version}";
   installFlags = buildFlags + " DESTDIR=$(out)";
 
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" && mkdir "$(pwd)" '';
+
   postFixup = ''
     target="$out/bin/simavr"
     patchelf --set-rpath "$(patchelf --print-rpath "$target"):$out/lib" "$target"

pkgs/games/klavaro/default.nix

@@ -16,6 +16,9 @@ stdenv.mkDerivation rec {
       --prefix LD_LIBRARY_PATH : $out/lib
   '';
 
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" '';
+
   meta = {
     description = "Just another free touch typing tutor program";
     homepage = http://klavaro.sourceforge.net/;

pkgs/os-specific/linux/libsmbios/default.nix

@@ -23,6 +23,9 @@ stdenv.mkDerivation {
       cp -va "out/public-include/"* "$out/include/"
     '';
 
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" '';
+
   meta = {
     homepage = "http://linux.dell.com/libsmbios/main";
     description = "A library to obtain BIOS information";

pkgs/servers/x11/xorg/default.nix

@@ -1010,22 +1010,22 @@ let
   }) // {inherit xproto zlib ;};
 
   libpciaccess = (mkDerivation "libpciaccess" {
-    name = "libpciaccess-0.13.4";
+    name = "libpciaccess-0.13.5";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libpciaccess-0.13.4.tar.bz2;
+      url = mirror://xorg/individual/lib/libpciaccess-0.13.5.tar.bz2;
-      sha256 = "1krgryi9ngjr66242v0v5mczihgv0y7rrvx0563arr318mjn9y07";
+      sha256 = "16dr80rdw5bzdyhahvilfjrflj7scs2yl2mmghsb84f3nglm8b3m";
     };
     buildInputs = [pkgconfig zlib ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit zlib ;};
 
   libpthreadstubs = (mkDerivation "libpthreadstubs" {
-    name = "libpthread-stubs-0.3";
+    name = "libpthread-stubs-0.4";
     builder = ./builder.sh;
     src = fetchurl {
-      url = http://xcb.freedesktop.org/dist/libpthread-stubs-0.3.tar.bz2;
+      url = http://xcb.freedesktop.org/dist/libpthread-stubs-0.4.tar.bz2;
-      sha256 = "16bjv3in19l84hbri41iayvvg4ls9gv1ma0x0qlbmwy67i7dbdim";
+      sha256 = "0cz7s9w8lqgzinicd4g36rjg08zhsbyngh0w68c3np8nlc8mkl74";
     };
     buildInputs = [pkgconfig ];
     meta.platforms = stdenv.lib.platforms.unix;
@@ -1197,11 +1197,11 @@ let
   }) // {inherit ;};
 
   sessreg = (mkDerivation "sessreg" {
-    name = "sessreg-1.1.0";
+    name = "sessreg-1.1.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/app/sessreg-1.1.0.tar.bz2;
+      url = mirror://xorg/individual/app/sessreg-1.1.1.tar.bz2;
-      sha256 = "0z013rskwmdadd8cdlxvh4asmgim61qijyzfbqmr1q1mg1jpf4am";
+      sha256 = "1qd66mg2bnppqz4xgdjzif2488zl82vx2c26ld3nb8pnyginm9vq";
     };
     buildInputs = [pkgconfig xproto ];
     meta.platforms = stdenv.lib.platforms.unix;
@@ -1869,11 +1869,11 @@ let
   }) // {inherit fontsproto randrproto renderproto videoproto xorgserver xproto ;};
 
   xf86videonouveau = (mkDerivation "xf86videonouveau" {
-    name = "xf86-video-nouveau-1.0.14";
+    name = "xf86-video-nouveau-1.0.15";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/driver/xf86-video-nouveau-1.0.14.tar.bz2;
+      url = mirror://xorg/individual/driver/xf86-video-nouveau-1.0.15.tar.bz2;
-      sha256 = "1h9izq510m2pvg77d0y9krc0cvvbhp2y3xlrrz6id7y47jdzkpsd";
+      sha256 = "0k0xah72ryjwak4dc4crszxrlkmi9x1s7p3sd4la642n77yi1pmf";
     };
     buildInputs = [pkgconfig dri2proto fontsproto libdrm udev libpciaccess randrproto renderproto videoproto xextproto xorgserver xproto ];
     meta.platforms = stdenv.lib.platforms.unix;
@@ -2210,11 +2210,11 @@ let
   }) // {inherit inputproto libX11 libXext libXi libXinerama libXrandr ;};
 
   xkbcomp = (mkDerivation "xkbcomp" {
-    name = "xkbcomp-1.3.1";
+    name = "xkbcomp-1.4.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/app/xkbcomp-1.3.1.tar.bz2;
+      url = mirror://xorg/individual/app/xkbcomp-1.4.0.tar.bz2;
-      sha256 = "0gcjy70ppmcl610z8gxc7sydsx93f8cm8pggm4qhihaa1ngdq103";
+      sha256 = "0syfc6zscvai824mzihlnrqxhkcr27dzkpy8zndavi83iischsdw";
     };
     buildInputs = [pkgconfig libX11 libxkbfile xproto ];
     meta.platforms = stdenv.lib.platforms.unix;

pkgs/servers/x11/xorg/extra.list

@@ -1,4 +1,4 @@
-http://xcb.freedesktop.org/dist/libpthread-stubs-0.3.tar.bz2
+http://xcb.freedesktop.org/dist/libpthread-stubs-0.4.tar.bz2
 http://xcb.freedesktop.org/dist/libxcb-1.12.tar.bz2
 http://xcb.freedesktop.org/dist/xcb-proto-1.12.tar.bz2
 http://xcb.freedesktop.org/dist/xcb-util-0.4.0.tar.bz2

pkgs/servers/x11/xorg/tarballs-7.7.list

@@ -56,7 +56,7 @@ mirror://xorg/individual/lib/libxshmfence-1.2.tar.bz2
 mirror://xorg/individual/lib/libfontenc-1.1.3.tar.bz2
 mirror://xorg/individual/lib/libFS-1.0.7.tar.bz2
 mirror://xorg/individual/lib/libICE-1.0.9.tar.bz2
-mirror://xorg/individual/lib/libpciaccess-0.13.4.tar.bz2
+mirror://xorg/individual/lib/libpciaccess-0.13.5.tar.bz2
 mirror://xorg/individual/lib/libSM-1.2.2.tar.bz2
 mirror://xorg/X11R7.7/src/everything/libWindowsWM-1.0.1.tar.bz2
 mirror://xorg/individual/lib/libX11-1.6.5.tar.bz2
@@ -96,7 +96,7 @@ mirror://xorg/X11R7.7/src/everything/recordproto-1.14.2.tar.bz2
 mirror://xorg/X11R7.7/src/everything/renderproto-0.11.1.tar.bz2
 mirror://xorg/X11R7.7/src/everything/resourceproto-1.2.0.tar.bz2
 mirror://xorg/X11R7.7/src/everything/scrnsaverproto-1.2.2.tar.bz2
-mirror://xorg/individual/app/sessreg-1.1.0.tar.bz2
+mirror://xorg/individual/app/sessreg-1.1.1.tar.bz2
 mirror://xorg/individual/app/setxkbmap-1.3.1.tar.bz2
 mirror://xorg/individual/app/smproxy-1.0.6.tar.bz2
 mirror://xorg/individual/app/twm-1.0.9.tar.bz2
@@ -131,7 +131,7 @@ mirror://xorg/individual/driver/xf86-video-amdgpu-1.3.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-ark-0.7.5.tar.bz2
 mirror://xorg/individual/driver/xf86-video-ast-1.1.5.tar.bz2
 mirror://xorg/individual/driver/xf86-video-ati-7.9.0.tar.bz2
-mirror://xorg/individual/driver/xf86-video-nouveau-1.0.14.tar.bz2
+mirror://xorg/individual/driver/xf86-video-nouveau-1.0.15.tar.bz2
 mirror://xorg/individual/driver/xf86-video-chips-1.2.7.tar.bz2
 mirror://xorg/individual/driver/xf86-video-cirrus-1.5.3.tar.bz2
 mirror://xorg/individual/driver/xf86-video-dummy-0.3.8.tar.bz2
@@ -174,7 +174,7 @@ mirror://xorg/individual/app/xgc-1.0.5.tar.bz2
 mirror://xorg/individual/app/xhost-1.0.7.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xineramaproto-1.2.1.tar.bz2
 mirror://xorg/individual/app/xinput-1.6.2.tar.bz2
-mirror://xorg/individual/app/xkbcomp-1.3.1.tar.bz2
+mirror://xorg/individual/app/xkbcomp-1.4.0.tar.bz2
 mirror://xorg/individual/app/xkbevd-1.1.4.tar.bz2
 mirror://xorg/individual/app/xkbutils-1.0.4.tar.bz2
 mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.20.tar.bz2

pkgs/stdenv/generic/default.nix

@@ -103,6 +103,11 @@ let
       ../../build-support/setup-hooks/compress-man-pages.sh
       ../../build-support/setup-hooks/strip.sh
       ../../build-support/setup-hooks/patch-shebangs.sh
+    ]
+      # FIXME this on Darwin; see
+      # https://github.com/NixOS/nixpkgs/commit/94d164dd7#commitcomment-22030369
+    ++ lib.optional result.isLinux ../../build-support/setup-hooks/audit-tmpdir.sh
+    ++ [
       ../../build-support/setup-hooks/multiple-outputs.sh
       ../../build-support/setup-hooks/move-sbin.sh
       ../../build-support/setup-hooks/move-lib64.sh

pkgs/stdenv/generic/setup.sh

@@ -199,6 +199,18 @@ isELF() {
     if [[ "$magic" =~ ELF ]]; then return 0; else return 1; fi
 }
 
+# Return success if the specified file is a script (i.e. starts with
+# "#!").
+isScript() {
+    local fn="$1"
+    local magic
+    if ! [ -x /bin/sh ]; then return 0; fi
+    exec {fd}< "$fn"
+    read -n 2 -u $fd magic
+    exec {fd}<&-
+    if [[ "$magic" =~ \#! ]]; then return 0; else return 1; fi
+}
+
 
 ######################################################################
 # Initialisation.

pkgs/tools/networking/unbound/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "unbound-${version}";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchurl {
     url = "http://unbound.net/downloads/${name}.tar.gz";
-    sha256 = "000lylg5qgriaxh6k78l2inb905qshx01kxgmqj89zn08gvn7ps2";
+    sha256 = "171vbqijfk1crm04dbgbvw4052n6kwcvyvly3habg011qdr3schs";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB

pkgs/tools/security/ssdeep/default.nix

@@ -9,6 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "1igqy0j7jrklb8fdlrm6ald4cyl1fda5ipfl8crzyl6bax2ajk3f";
   };
 
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" '';
+
   # For some reason (probably a build system bug), the binary isn't
   # properly linked to $out/lib to find libfuzzy.so
   postFixup = stdenv.lib.optionalString (!stdenv.isDarwin) ''

pkgs/tools/text/groff/default.nix

@@ -1,6 +1,7 @@
 { stdenv, fetchurl, perl, groff
 , ghostscript #for postscript and html output
 , psutils, netpbm #for html output
+, buildPackages
 }:
 
 stdenv.mkDerivation rec {
@@ -49,7 +50,7 @@ stdenv.mkDerivation rec {
     # Trick to get the build system find the proper 'native' groff
     # http://www.mail-archive.com/bug-groff@gnu.org/msg01335.html
     preBuild = ''
-      makeFlags="GROFF_BIN_PATH=${groff}/bin GROFFBIN=${groff}/bin/groff"
+      makeFlags="GROFF_BIN_PATH=${buildPackages.groff}/bin GROFFBIN=${buildPackages.groff}/bin/groff"
     '';
   };
 

pkgs/tools/typesetting/sile/default.nix

@@ -45,6 +45,9 @@ stdenv.mkDerivation rec {
       --set LUA_CPATH "${luaCPath};" \
   '';
 
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" && mkdir "$(pwd)" '';
+
   meta = {
     description = "A typesetting system";
     longDescription = ''

pkgs/top-level/all-packages.nix

@@ -6178,7 +6178,7 @@ with pkgs;
   # available as `pythonPackages.tkinter` and can be used as any other Python package.
   python = python2;
   python2 = python27;
-  python3 = python35;
+  python3 = python36;
 
   # Python interpreter that is build with all modules, including tkinter.
   # These are for compatibility and should not be used inside Nixpkgs.
@@ -6192,9 +6192,9 @@ with pkgs;
   python36Full = python36.override{x11Support=true;};
 
   # pythonPackages further below, but assigned here because they need to be in sync
-  pythonPackages = python2Packages;
+  pythonPackages = python.pkgs;
-  python2Packages = python27Packages;
+  python2Packages = python2.pkgs;
-  python3Packages = python35Packages;
+  python3Packages = python3.pkgs;
 
   python27 = callPackage ../development/interpreters/python/cpython/2.7 {
     self = python27;
@@ -6204,19 +6204,22 @@ with pkgs;
     self = python33;
     inherit (darwin) CF configd;
   };
-  python34 = hiPrio (callPackage ../development/interpreters/python/cpython/3.4 {
+  python34 = callPackage ../development/interpreters/python/cpython/3.4 {
     inherit (darwin) CF configd;
     self = python34;
-  });
+  };
-  python35 = hiPrio (callPackage ../development/interpreters/python/cpython/3.5 {
+  python35 = callPackage ../development/interpreters/python/cpython/3.5 {
     inherit (darwin) CF configd;
     self = python35;
-  });
+  };
   python36 = callPackage ../development/interpreters/python/cpython/3.6 {
     inherit (darwin) CF configd;
     self = python36;
   };
 
+  # Should eventually be moved inside Python interpreters.
+  python-setup-hook = callPackage ../development/interpreters/python/setup-hook.nix { };
+
   pypy = pypy27;
 
   pypy27 = callPackage ../development/interpreters/python/pypy/2.7 {
@@ -9248,12 +9251,16 @@ with pkgs;
       inherit (darwin) apple_sdk;
     }
     else alternative;
+
   mesa_noglu = mesaDarwinOr (callPackage ../development/libraries/mesa {
     # makes it slower, but during runtime we link against just mesa_drivers
     # through /run/opengl-driver*, which is overriden according to config.grsecurity
-    grsecEnabled = true;
+    # grsecEnabled = true; # no more support in nixpkgs ATM
-    llvmPackages = llvmPackages_39;
+
+    # llvm-4.0.0 won't pass tests on aarch64
+    llvmPackages = if system == "aarch64-linux" then llvmPackages_39 else llvmPackages_4;
   });
+
   mesa_glu =  mesaDarwinOr (callPackage ../development/libraries/mesa-glu { });
   mesa_drivers = mesaDarwinOr (
     let mo = mesa_noglu.override {
@@ -10712,9 +10719,9 @@ with pkgs;
 
   python34Packages = python34.pkgs;
 
-  python35Packages = recurseIntoAttrs python35.pkgs;
+  python35Packages = python35.pkgs;
 
-  python36Packages = python36.pkgs;
+  python36Packages = recurseIntoAttrs python36.pkgs;
 
   pypyPackages = pypy.pkgs;
 

pkgs/top-level/release.nix

@@ -111,6 +111,7 @@ let
       ocamlPackages = { };
       perlPackages = { };
       pythonPackages = {
+        blaze = unix;
         pandas = unix;
         scikitlearn = unix;
       };
@@ -122,6 +123,12 @@ let
         pandas = unix;
         scikitlearn = unix;
       };
+      python36Packages = {
+        blaze = unix;
+        pandas = unix;
+        scikitlearn = unix;
+      };
+
     } ));
 
 in jobs