From 4964b104b946e889587407e27fa11f9412e24c8b Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Wed, 26 Jul 2017 09:30:00 +0000
Subject: [PATCH 01/17] ld-wrapper: Optimize expanding rpath

The time to expand rpath was proportional to the number of -L flags times the
number of -l flags.  Now it is proportional to their sum (assuming constant
number of files in each directory in an -L flag).

Issue reported by @nh2 at https://github.com/NixOS/nixpkgs/issues/27609#issuecomment-317916623
---
 pkgs/build-support/cc-wrapper/ld-wrapper.sh | 189 +++++++++-----------
 1 file changed, 83 insertions(+), 106 deletions(-)

diff --git a/pkgs/build-support/cc-wrapper/ld-wrapper.sh b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
index 240082b5dfd..283a6fb3ef9 100644
--- a/pkgs/build-support/cc-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
@@ -1,4 +1,5 @@
 #! @shell@ -e
+shopt -s nullglob
 path_backup="$PATH"
 if [ -n "@coreutils_bin@" ]; then
   PATH="@coreutils_bin@/bin"
@@ -20,18 +21,19 @@ expandResponseParams "$@"
 if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" \
         -a \( -z "$NIX_IGNORE_LD_THROUGH_GCC" -o -z "$NIX_LDFLAGS_SET" \) ]; then
     rest=()
-    n=0
-    while [ $n -lt ${#params[*]} ]; do
+    nParams=${#params[@]}
+    declare -i n=0
+    while [ $n -lt $nParams ]; do
         p=${params[n]}
         p2=${params[$((n+1))]}
         if [ "${p:0:3}" = -L/ ] && badPath "${p:2}"; then
-            skip $p
+            skip "${p:2}"
         elif [ "$p" = -L ] && badPath "$p2"; then
-            n=$((n + 1)); skip $p2
+            n+=1; skip "$p2"
         elif [ "$p" = -rpath ] && badPath "$p2"; then
-            n=$((n + 1)); skip $p2
+            n+=1; skip "$p2"
         elif [ "$p" = -dynamic-linker ] && badPath "$p2"; then
-            n=$((n + 1)); skip $p2
+            n+=1; skip "$p2"
         elif [ "${p:0:1}" = / ] && badPath "$p"; then
             # We cannot skip this; barf.
             echo "impure path \`$p' used in link" >&2
@@ -40,9 +42,9 @@ if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" \
             # Our ld is not built with sysroot support (Can we fix that?)
             :
         else
-            rest=("${rest[@]}" "$p")
+            rest+=("$p")
         fi
-        n=$((n + 1))
+        n+=1
     done
     params=("${rest[@]}")
 fi
@@ -50,7 +52,7 @@ fi
 LD=@prog@
 source @out@/nix-support/add-hardening.sh
 
-extra=(${hardeningLDFlags[@]})
+extra=("${hardeningLDFlags[@]}")
 extraBefore=()
 
 if [ -z "$NIX_LDFLAGS_SET" ]; then
@@ -60,122 +62,97 @@ fi
 
 extra+=($NIX_LDFLAGS_AFTER $NIX_LDFLAGS_HARDEN)
 
+declare -A rpaths
+declare -a libDirs
+declare -A libs
+relocatable=
+
+# Find all -L... switches for rpath, and relocatable flags for build id.
+if [ "$NIX_DONT_SET_RPATH" != 1 ] || [ "$NIX_SET_BUILD_ID" = 1 ]; then
+    prev=
+    for p in "${params[@]}" "${extra[@]}"; do
+        case "$prev" in
+            -L)
+                libDirs+=("$p")
+                ;;
+            -l)
+                libs["lib${p}.so"]=1
+                ;;
+            -dynamic-linker)
+                # Ignore the dynamic linker argument, or it
+                # will match *.so and be added to rpath.
+                ;;
+            *)
+                case "$p" in
+                    -L/*)
+                        libDirs+=("${p:2}")
+                        ;;
+                    -l?*)
+                        libs["lib${p:2}.so"]=1
+                        ;;
+                    "$NIX_STORE"/*.so | "$NIX_STORE"/*.so.*)
+                        # This is a direct reference to a shared library, so add
+                        # its directory to the rpath.
+                        dir="${p%/*}"
+                        if [ ! "${rpaths[$dir]}" ]; then
+                            rpaths["$dir"]=1
+                            extra+=(-rpath "$dir")
+                        fi
+                        ;;
+                    -r | --relocatable | -i)
+                        relocatable=1
+                esac
+                ;;
+        esac
+        prev="$p"
+    done
+fi
+
 
 # Add all used dynamic libraries to the rpath.
 if [ "$NIX_DONT_SET_RPATH" != 1 ]; then
-
-    declare -A libDirsSeen
-    declare -a libDirs
-
-    addToLibPath() {
-        local path="$1"
-        if [ "${path:0:1}" != / ]; then return 0; fi
-        case "$path" in
-            *..*|*./*|*/.*|*//*)
-                local path2
-                if path2=$(readlink -f "$path"); then
-                    path="$path2"
-                fi
-                ;;
-        esac
-        if [[ -z ${libDirsSeen[$path]} ]]; then
-            libDirs+=("$path")
-            libDirsSeen[$path]=1
-        fi
-    }
-
-    declare -A rpathsSeen
-    declare -a rpaths
-
-    addToRPath() {
-        # If the path is not in the store, don't add it to the rpath.
-        # This typically happens for libraries in /tmp that are later
-        # copied to $out/lib.  If not, we're screwed.
-        if [ "${1:0:${#NIX_STORE}}" != "$NIX_STORE" ]; then return 0; fi
-        if [[ -z ${rpathsSeen[$1]} ]]; then
-            rpaths+=("$1")
-            rpathsSeen[$1]=1
-        fi
-    }
-
-    declare -a libs
-
-    # First, find all -L... switches.
-    allParams=("${params[@]}" ${extra[@]})
-    n=0
-    while [ $n -lt ${#allParams[*]} ]; do
-        p=${allParams[n]}
-        p2=${allParams[$((n+1))]}
-        if [ "${p:0:3}" = -L/ ]; then
-            addToLibPath ${p:2}
-        elif [ "$p" = -L ]; then
-            addToLibPath ${p2}
-            n=$((n + 1))
-        elif [ "$p" = -l ]; then
-            libs+=(${p2})
-            n=$((n + 1))
-        elif [ "${p:0:2}" = -l ]; then
-            libs+=(${p:2})
-        elif [ "$p" = -dynamic-linker ]; then
-            # Ignore the dynamic linker argument, or it
-            # will get into the next 'elif'. We don't want
-            # the dynamic linker path rpath to go always first.
-            n=$((n + 1))
-        elif [[ "$p" =~ ^[^-].*\.so($|\.) ]]; then
-            # This is a direct reference to a shared library, so add
-            # its directory to the rpath.
-            path="$(dirname "$p")";
-            addToRPath "${path}"
-        fi
-        n=$((n + 1))
-    done
-
-    # Second, for each directory in the library search path (-L...),
+    # For each directory in the library search path (-L...),
     # see if it contains a dynamic library used by a -l... flag.  If
     # so, add the directory to the rpath.
     # It's important to add the rpath in the order of -L..., so
     # the link time chosen objects will be those of runtime linking.
-    for i in ${libDirs[@]}; do
-        for j in ${libs[@]}; do
-            if [ -f "$i/lib$j.so" ]; then
-                addToRPath $i
-                break
+    for dir in "${libDirs[@]}"; do
+        if [[ "$dir" =~ [/.][/.] ]] && dir2=$(readlink -f "$dir"); then
+            dir="$dir2"
+        fi
+        if [ "${rpaths[$dir]}" ] || [[ "$dir" != "$NIX_STORE"/* ]]; then
+            # If the path is not in the store, don't add it to the rpath.
+            # This typically happens for libraries in /tmp that are later
+            # copied to $out/lib.  If not, we're screwed.
+            continue
+        fi
+        for path in "$dir"/lib*.so; do
+            file="${path##*/}"
+            if [ "${libs[$file]}" ]; then
+                libs["$file"]=
+                if [ ! "${rpaths[$dir]}" ]; then
+                    rpaths["$dir"]=1
+                    extra+=(-rpath "$dir")
+                fi
             fi
         done
     done
-
-    # Finally, add `-rpath' switches.
-    for i in ${rpaths[@]}; do
-        extra+=(-rpath "$i")
-    done
 fi
 
 
 # Only add --build-id if this is a final link. FIXME: should build gcc
 # with --enable-linker-build-id instead?
-if [ "$NIX_SET_BUILD_ID" = 1 ]; then
-    for p in "${params[@]}"; do
-        if [ "$p" = "-r" -o "$p" = "--relocatable" -o "$p" = "-i" ]; then
-            relocatable=1
-            break
-        fi
-    done
-    if [ -z "$relocatable" ]; then
-        extra+=(--build-id)
-    fi
+if [ "$NIX_SET_BUILD_ID" = 1 ] && [ ! "$relocatable" ]; then
+    extra+=(--build-id)
 fi
 
 
 # Optionally print debug info.
 if [ -n "$NIX_DEBUG" ]; then
-  echo "original flags to @prog@:" >&2
-  for i in "${params[@]}"; do
-      echo "  $i" >&2
-  done
-  echo "extra flags to @prog@:" >&2
-  for i in ${extra[@]}; do
-      echo "  $i" >&2
-  done
+    echo "original flags to @prog@:" >&2
+    printf "  %q\n" "${params[@]}" >&2
+    echo "extra flags to @prog@:" >&2
+    printf "  %q\n" "${extraBefore[@]}" "${extra[@]}" >&2
 fi
 
 if [ -n "$NIX_LD_WRAPPER_EXEC_HOOK" ]; then
@@ -183,4 +160,4 @@ if [ -n "$NIX_LD_WRAPPER_EXEC_HOOK" ]; then
 fi
 
 PATH="$path_backup"
-exec @prog@ ${extraBefore[@]} "${params[@]}" ${extra[@]}
+exec @prog@ "${extraBefore[@]}" "${params[@]}" "${extra[@]}"

From 733e20fee4a6700510f71fbe1a58ac23ea202f6a Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Sat, 29 Jul 2017 13:23:59 -0400
Subject: [PATCH 02/17] binutils: 2.28 -> 2.29

Binutils 2.29 no longer allows .semver symbols, which is why
we need to patch glibc to avoid them
---
 .../glibc/avoid-semver-on-common.patch        | 65 +++++++++++++++++++
 pkgs/development/libraries/glibc/common.nix   |  3 +
 .../tools/misc/binutils/default.nix           |  4 +-
 3 files changed, 70 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/development/libraries/glibc/avoid-semver-on-common.patch

diff --git a/pkgs/development/libraries/glibc/avoid-semver-on-common.patch b/pkgs/development/libraries/glibc/avoid-semver-on-common.patch
new file mode 100644
index 00000000000..966325d6f18
--- /dev/null
+++ b/pkgs/development/libraries/glibc/avoid-semver-on-common.patch
@@ -0,0 +1,65 @@
+From 0edeadc0d396aa713b808ae50a0058aca5d3837e Mon Sep 17 00:00:00 2001
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Wed, 26 Jul 2017 10:08:46 -0700
+Subject: [PATCH] Avoid .symver on common symbols [BZ #21666]
+
+The .symver directive on common symbol just creates a new common symbol,
+not an alias and the newer assembler with the bug fix for
+
+https://sourceware.org/bugzilla/show_bug.cgi?id=21661
+
+will issue an error.  Before the fix, we got
+
+$ readelf -sW libc.so | grep "loc[12s]"
+  5109: 00000000003a0608     8 OBJECT  LOCAL  DEFAULT   36 loc1
+  5188: 00000000003a0610     8 OBJECT  LOCAL  DEFAULT   36 loc2
+  5455: 00000000003a0618     8 OBJECT  LOCAL  DEFAULT   36 locs
+  6575: 00000000003a05f0     8 OBJECT  GLOBAL DEFAULT   36 locs@GLIBC_2.2.5
+  7156: 00000000003a05f8     8 OBJECT  GLOBAL DEFAULT   36 loc1@GLIBC_2.2.5
+  7312: 00000000003a0600     8 OBJECT  GLOBAL DEFAULT   36 loc2@GLIBC_2.2.5
+
+in libc.so.  The versioned loc1, loc2 and locs have the wrong addresses.
+After the fix, we got
+
+$ readelf -sW libc.so | grep "loc[12s]"
+  6570: 000000000039e3b8     8 OBJECT  GLOBAL DEFAULT   34 locs@GLIBC_2.2.5
+  7151: 000000000039e3c8     8 OBJECT  GLOBAL DEFAULT   34 loc1@GLIBC_2.2.5
+  7307: 000000000039e3c0     8 OBJECT  GLOBAL DEFAULT   34 loc2@GLIBC_2.2.5
+
+	[BZ #21666]
+	* misc/regexp.c (loc1): Add __attribute__ ((nocommon));
+	(loc2): Likewise.
+	(locs): Likewise.
+
+(cherry picked from commit 388b4f1a02f3a801965028bbfcd48d905638b797)
+---
+ ChangeLog     | 7 +++++++
+ misc/regexp.c | 9 +++++----
+ 2 files changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/misc/regexp.c b/misc/regexp.c
+index 19d76c0..eaea7c3 100644
+--- a/misc/regexp.c
++++ b/misc/regexp.c
+@@ -29,14 +29,15 @@
+
+ #if SHLIB_COMPAT (libc, GLIBC_2_0, GLIBC_2_23)
+
+-/* Define the variables used for the interface.  */
+-char *loc1;
+-char *loc2;
++/* Define the variables used for the interface.  Avoid .symver on common
++   symbol, which just creates a new common symbol, not an alias.  */
++char *loc1 __attribute__ ((nocommon));
++char *loc2 __attribute__ ((nocommon));
+ compat_symbol (libc, loc1, loc1, GLIBC_2_0);
+ compat_symbol (libc, loc2, loc2, GLIBC_2_0);
+
+ /* Although we do not support the use we define this variable as well.  */
+-char *locs;
++char *locs __attribute__ ((nocommon));
+ compat_symbol (libc, locs, locs, GLIBC_2_0);
+
+
+--
+2.9.3
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 1b53acf12b1..d1c5446e807 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -64,6 +64,9 @@ stdenv.mkDerivation ({
       ./CVE-2017-1000366-rtld-LD_LIBRARY_PATH.patch
       ./CVE-2017-1000366-rtld-LD_PRELOAD.patch
       ./CVE-2017-1000366-rtld-LD_AUDIT.patch
+
+      /* https://sourceware.org/bugzilla/show_bug.cgi?id=21666 */
+      ./avoid-semver-on-common.patch
     ]
     ++ lib.optionals stdenv.isi686 [
       ./fix-i686-memchr.patch
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index ae58c72b786..ac9ab141332 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "2.28";
+  version = "2.29";
   basename = "binutils-${version}";
   inherit (stdenv.lib) optional optionals optionalString;
   # The prefix prepended to binary names to allow multiple binuntils on the
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnu/binutils/${basename}.tar.bz2";
-    sha256 = "0wiasgns7i8km8nrxas265sh2dfpsw93b3qw195ipc90w4z475v2";
+    sha256 = "1gqfyksdnj3iir5gzyvlp785mnk60g1pll6zbzbslfchhr4rb8i9";
   };
 
   patches = [

From 85a0ab4b239148eecd88478a84db96721580538a Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Mon, 31 Jul 2017 13:16:29 +0200
Subject: [PATCH 03/17] Python: disable user site-packages for programs and
 environments.

Python by default checks a `site-packages` folder in the user's home
folder. We do not want such an impurity and therefore disable it.
Fixes #26846.
---
 pkgs/development/interpreters/python/wrap.sh     | 4 +++-
 pkgs/development/interpreters/python/wrapper.nix | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/python/wrap.sh b/pkgs/development/interpreters/python/wrap.sh
index 1c74e612b55..37bd5b09739 100644
--- a/pkgs/development/interpreters/python/wrap.sh
+++ b/pkgs/development/interpreters/python/wrap.sh
@@ -66,7 +66,9 @@ wrapPythonProgramsIn() {
                     # above. The script will set PYTHONPATH and PATH variables.!
                     # (see pkgs/build-support/setup-hooks/make-wrapper.sh)
                     local -a wrap_args=("$f"
-                                    --prefix PATH ':' "$program_PATH")
+                                    --prefix PATH ':' "$program_PATH"
+                                    --set PYTHONNOUSERSITE "true"
+                                    )
 
                     # Add any additional arguments provided by makeWrapperArgs
                     # argument to buildPythonPackage.
diff --git a/pkgs/development/interpreters/python/wrapper.nix b/pkgs/development/interpreters/python/wrapper.nix
index b4bd532dc1d..65b949661b0 100644
--- a/pkgs/development/interpreters/python/wrapper.nix
+++ b/pkgs/development/interpreters/python/wrapper.nix
@@ -29,7 +29,7 @@ let
           for prg in *; do
             if [ -f "$prg" ]; then
               rm -f "$out/bin/$prg"
-              makeWrapper "$path/bin/$prg" "$out/bin/$prg" --set PYTHONHOME "$out"
+              makeWrapper "$path/bin/$prg" "$out/bin/$prg" --set PYTHONHOME "$out" --set PYTHONNOUSERSITE "true"
             fi
           done
         fi

From 6ddbe2e34c884792322eecabbb1799fd16d1d79e Mon Sep 17 00:00:00 2001
From: Franz Pletz <fpletz@fnordicwalking.de>
Date: Tue, 1 Aug 2017 02:03:23 +0200
Subject: [PATCH 04/17] p11_kit: 0.23.2 -> 0.23.7

---
 .../development/libraries/p11-kit/default.nix | 20 +++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index 0888fba4eca..53c94ab874c 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -1,17 +1,25 @@
-{ stdenv, fetchurl, libiconv, pkgconfig, libffi, libtasn1 }:
+{ stdenv, fetchFromGitHub, autoreconfHook, which, pkgconfig, libiconv, libffi, libtasn1 }:
 
 stdenv.mkDerivation rec {
-  name = "p11-kit-0.23.2";
+  name = "p11-kit-${version}";
+  version = "0.23.7";
 
-  src = fetchurl {
-    url = "${meta.homepage}releases/${name}.tar.gz";
-    sha256 = "1w7szm190phlkg7qx05ychlj2dbvkgkhx9gw6dx4d5rw62l6wwms";
+  src = fetchFromGitHub {
+    owner = "p11-glue";
+    repo = "p11-kit";
+    rev = version;
+    sha256 = "1l8sg0g74k2mk0y6vz19hc103dzizxa0h579gdhvxifckglb01hy";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "dev";
 
-  buildInputs = [ pkgconfig libffi libtasn1 libiconv ];
+  nativeBuildInputs = [ autoreconfHook which pkgconfig ];
+  buildInputs = [ libffi libtasn1 libiconv ];
+
+  autoreconfPhase = ''
+    NOCONFIGURE=1 ./autogen.sh
+  '';
 
   configureFlags = [
     "--sysconfdir=/etc"

From 1c5ab2f639e9d30f663f759f193c57ea58ac9038 Mon Sep 17 00:00:00 2001
From: Franz Pletz <fpletz@fnordicwalking.de>
Date: Tue, 1 Aug 2017 06:34:56 +0200
Subject: [PATCH 05/17] avahi: 0.6.12 -> 0.7

---
 pkgs/development/libraries/avahi/default.nix              | 4 ++--
 .../libraries/avahi/no-mkdir-localstatedir.patch          | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/libraries/avahi/default.nix b/pkgs/development/libraries/avahi/default.nix
index 69f86e020c7..098378701d5 100644
--- a/pkgs/development/libraries/avahi/default.nix
+++ b/pkgs/development/libraries/avahi/default.nix
@@ -8,11 +8,11 @@ assert qt4Support -> qt4 != null;
 
 stdenv.mkDerivation rec {
   name = "avahi-${version}";
-  version = "0.6.32";
+  version = "0.7";
 
   src = fetchurl {
     url = "https://github.com/lathiat/avahi/releases/download/v${version}/avahi-${version}.tar.gz";
-    sha256 = "0m5l3ny9i2z1l27y4wm731c0zdkmfn6l1szbajx0ljjiblc92jfm";
+    sha256 = "0128n7jlshw4bpx0vg8lwj8qwdisjxi7mvniwfafgnkzzrfrpaap";
   };
 
   patches = [ ./no-mkdir-localstatedir.patch ];
diff --git a/pkgs/development/libraries/avahi/no-mkdir-localstatedir.patch b/pkgs/development/libraries/avahi/no-mkdir-localstatedir.patch
index a8a1878cc90..72965c9f028 100644
--- a/pkgs/development/libraries/avahi/no-mkdir-localstatedir.patch
+++ b/pkgs/development/libraries/avahi/no-mkdir-localstatedir.patch
@@ -1,12 +1,12 @@
 Don't "mkdir $(localstatedir)" since we can't do it (/var).
 
---- avahi-0.6.27/avahi-daemon/Makefile.in	2010-07-13 05:06:35.000000000 +0200
-+++ avahi-0.6.27/avahi-daemon/Makefile.in	2010-07-13 18:03:45.000000000 +0200
-@@ -1554,7 +1554,6 @@ xmllint:
+--- a/avahi-daemon/Makefile.in
++++ b/avahi-daemon/Makefile.in
+@@ -1625,7 +1625,6 @@ xmllint:
  	done
  
  install-data-local:
--	test -z "$(localstatedir)/run" || $(MKDIR_P) "$(DESTDIR)$(localstatedir)/run"
+-	test -z "$(avahi_runtime_dir)" || $(MKDIR_P) "$(DESTDIR)$(avahi_runtime_dir)"
  
  update-systemd:
  	curl http://cgit.freedesktop.org/systemd/plain/src/sd-daemon.c > sd-daemon.c

From 1fb803c3677ad4423a68f1520b266c440d06bb23 Mon Sep 17 00:00:00 2001
From: Franz Pletz <fpletz@fnordicwalking.de>
Date: Tue, 1 Aug 2017 09:18:07 +0200
Subject: [PATCH 06/17] libtasn1: 4.10 -> 4.12, fix CVE-2017-9310

---
 pkgs/development/libraries/libtasn1/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/libtasn1/default.nix b/pkgs/development/libraries/libtasn1/default.nix
index dbd203b97cf..516005b874f 100644
--- a/pkgs/development/libraries/libtasn1/default.nix
+++ b/pkgs/development/libraries/libtasn1/default.nix
@@ -1,18 +1,18 @@
 { stdenv, fetchurl, perl, texinfo }:
 
 stdenv.mkDerivation rec {
-  name = "libtasn1-4.10";
+  name = "libtasn1-4.12";
 
   src = fetchurl {
     url = "mirror://gnu/libtasn1/${name}.tar.gz";
-    sha256 = "00jsix5hny0g768zv4hk78dib7w0qmk5fbizf4jj37r51nd4s6k8";
+    sha256 = "0ls7jdq3y5fnrwg0pzhq11m21r8pshac2705bczz6mqjc8pdllv7";
   };
 
   patches = [
     (fetchurl {
-      name = "CVE-2017-6891.patch";
-      url = "https://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=patch;h=5520704d075802df25ce4ffccc010ba1641bd484";
-      sha256 = "000r6wb87zkx8yhzkf1c3h7p5akwhjw51cv8f1yjnplrqqrr7h2k";
+      name = "CVE-2017-9310.patch";
+      url = "https://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=patch;h=d8d805e1f2e6799bb2dff4871a8598dc83088a39";
+      sha256 = "1v5w0dazp9qc2v7pc8b6g7s4dz5ak10hzrn35hx66q76yzrrzp7i";
     })
   ];
 

From 283364a2fec0ed3510ed9ac8f5fc4bf60408eb1d Mon Sep 17 00:00:00 2001
From: adisbladis <adis@blad.is>
Date: Tue, 1 Aug 2017 15:41:06 +0800
Subject: [PATCH 07/17] Revert "buildenv: read propagated-user-env-packages
 line-by-line"

This reverts commit dce958ac396e88c09d5b19c284f41eef68f54ce7.
---
 pkgs/build-support/buildenv/builder.pl | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/build-support/buildenv/builder.pl b/pkgs/build-support/buildenv/builder.pl
index 7cc37d15673..678f5a3fe9e 100755
--- a/pkgs/build-support/buildenv/builder.pl
+++ b/pkgs/build-support/buildenv/builder.pl
@@ -141,11 +141,12 @@ sub addPkg {
     my $propagatedFN = "$pkgDir/nix-support/propagated-user-env-packages";
     if (-e $propagatedFN) {
         open PROP, "<$propagatedFN" or die;
-        while (my $p = <PROP>) {
-            chomp $p;
+        my $propagated = <PROP>;
+        close PROP;
+        my @propagated = split ' ', $propagated;
+        foreach my $p (@propagated) {
             $postponed{$p} = 1 unless defined $done{$p};
         }
-        close PROP;
     }
 }
 

From 07674788d6932fe702117649b4cd16512d2da8a9 Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Tue, 1 Aug 2017 08:27:50 +0000
Subject: [PATCH 08/17] Respect NIX_DONT_SET_RPATH when .so appears in the
 command line

Unified processing of command line arguments in ld-wrapper broke support for
`NIX_DONT_SET_RPATH` and revealed that ld-wrapper adds the directory of its
`-plugin` argument to runpath. This pull request fixes that. It treats
`dir/libname.so` as `-L dir -l name`, because this is how `ld.so` interprets
resulting binary: with `dir` in `RUNPATH` and the bare `libname.so` (without
`dir`) in `NEEDED`, it looks for `libname.so` in each `RUNPATH` and chooses the
first, even when the linker was invoked with an absolute path to `.so`.
---
 pkgs/build-support/cc-wrapper/ld-wrapper.sh | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/pkgs/build-support/cc-wrapper/ld-wrapper.sh b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
index 283a6fb3ef9..72c0be304ac 100644
--- a/pkgs/build-support/cc-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
@@ -62,7 +62,6 @@ fi
 
 extra+=($NIX_LDFLAGS_AFTER $NIX_LDFLAGS_HARDEN)
 
-declare -A rpaths
 declare -a libDirs
 declare -A libs
 relocatable=
@@ -78,9 +77,8 @@ if [ "$NIX_DONT_SET_RPATH" != 1 ] || [ "$NIX_SET_BUILD_ID" = 1 ]; then
             -l)
                 libs["lib${p}.so"]=1
                 ;;
-            -dynamic-linker)
-                # Ignore the dynamic linker argument, or it
-                # will match *.so and be added to rpath.
+            -dynamic-linker | -plugin)
+                # Ignore this argument, or it will match *.so and be added to rpath.
                 ;;
             *)
                 case "$p" in
@@ -91,13 +89,9 @@ if [ "$NIX_DONT_SET_RPATH" != 1 ] || [ "$NIX_SET_BUILD_ID" = 1 ]; then
                         libs["lib${p:2}.so"]=1
                         ;;
                     "$NIX_STORE"/*.so | "$NIX_STORE"/*.so.*)
-                        # This is a direct reference to a shared library, so add
-                        # its directory to the rpath.
-                        dir="${p%/*}"
-                        if [ ! "${rpaths[$dir]}" ]; then
-                            rpaths["$dir"]=1
-                            extra+=(-rpath "$dir")
-                        fi
+                        # This is a direct reference to a shared library.
+                        libDirs+=("${p%/*}")
+                        libs["${p##*/}"]=1
                         ;;
                     -r | --relocatable | -i)
                         relocatable=1
@@ -116,6 +110,7 @@ if [ "$NIX_DONT_SET_RPATH" != 1 ]; then
     # so, add the directory to the rpath.
     # It's important to add the rpath in the order of -L..., so
     # the link time chosen objects will be those of runtime linking.
+    declare -A rpaths
     for dir in "${libDirs[@]}"; do
         if [[ "$dir" =~ [/.][/.] ]] && dir2=$(readlink -f "$dir"); then
             dir="$dir2"

From ea4121d225e6b3a7bebad1f6686d952a3e5f0e13 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Tue, 1 Aug 2017 16:25:53 +0200
Subject: [PATCH 09/17] python.buildEnv: fix passthru

Python envs did not pass through any of the properties the Python
interpreter has. That could be annoying, especially not having
`python.interpreter` which is the path to the interpreter. This commit
fixes the situation and inherit python.passthru.
---
 .../interpreters/python/wrapper.nix           | 31 ++++++++++---------
 1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/interpreters/python/wrapper.nix b/pkgs/development/interpreters/python/wrapper.nix
index 65b949661b0..71e9e614352 100644
--- a/pkgs/development/interpreters/python/wrapper.nix
+++ b/pkgs/development/interpreters/python/wrapper.nix
@@ -6,8 +6,7 @@
 # Create a python executable that knows about additional packages.
 let
   recursivePthLoader = import ../../python-modules/recursive-pth-loader/default.nix { stdenv = stdenv; python = python; };
-  env = (
-  let
+  env = let
     paths = stdenv.lib.closePropagation (extraLibs ++ [ python recursivePthLoader ] ) ;
   in buildEnv {
     name = "${python.name}-env";
@@ -36,19 +35,21 @@ let
       done
     '' + postBuild;
 
-    passthru.env = stdenv.mkDerivation {
-      name = "interactive-${python.name}-environment";
-      nativeBuildInputs = [ env ];
-
-      buildCommand = ''
-        echo >&2 ""
-        echo >&2 "*** Python 'env' attributes are intended for interactive nix-shell sessions, not for building! ***"
-        echo >&2 ""
-        exit 1
-      '';
-    };
-  }) // {
-    inherit python;
     inherit (python) meta;
+
+    passthru = python.passthru // {
+      interpreter = "${env}/bin/${python.executable}";
+      env = stdenv.mkDerivation {
+        name = "interactive-${python.name}-environment";
+        nativeBuildInputs = [ env ];
+
+        buildCommand = ''
+          echo >&2 ""
+          echo >&2 "*** Python 'env' attributes are intended for interactive nix-shell sessions, not for building! ***"
+          echo >&2 ""
+          exit 1
+        '';
+    };
+    };
   };
 in env

From 93d80f19515867e3b215262532deb621e234c483 Mon Sep 17 00:00:00 2001
From: Robin Gloster <mail@glob.in>
Date: Tue, 1 Aug 2017 18:22:22 +0200
Subject: [PATCH 10/17] p11_kit: fix docs

---
 pkgs/development/libraries/p11-kit/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index 53c94ab874c..7a7a6d9d23f 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, which, pkgconfig, libiconv, libffi, libtasn1 }:
+{ stdenv, fetchFromGitHub, autoreconfHook, which, pkgconfig, libiconv
+, libffi, libtasn1, gtk_doc, libxslt, docbook_xsl }:
 
 stdenv.mkDerivation rec {
   name = "p11-kit-${version}";
@@ -14,7 +15,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "dev";
 
-  nativeBuildInputs = [ autoreconfHook which pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook which pkgconfig gtk_doc libxslt docbook_xsl ];
   buildInputs = [ libffi libtasn1 libiconv ];
 
   autoreconfPhase = ''
@@ -25,6 +26,7 @@ stdenv.mkDerivation rec {
     "--sysconfdir=/etc"
     "--localstatedir=/var"
     "--without-trust-paths"
+    "--enable-doc"
   ];
 
   installFlags = [ "exampledir=\${out}/etc/pkcs11" ];

From d9521c3418adc7d8883c6965c0083e8b9486543a Mon Sep 17 00:00:00 2001
From: Robin Gloster <mail@glob.in>
Date: Tue, 1 Aug 2017 22:47:03 +0200
Subject: [PATCH 11/17] gnome-tweak-tool: fix eval

---
 pkgs/desktops/gnome-3/3.22/misc/gnome-tweak-tool/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/desktops/gnome-3/3.22/misc/gnome-tweak-tool/default.nix b/pkgs/desktops/gnome-3/3.22/misc/gnome-tweak-tool/default.nix
index 5a1baa5e330..6268eaa3388 100644
--- a/pkgs/desktops/gnome-3/3.22/misc/gnome-tweak-tool/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/misc/gnome-tweak-tool/default.nix
@@ -22,7 +22,7 @@ in stdenv.mkDerivation rec {
                   gnome3.gnome_desktop wrapGAppsHook
                   python2Packages.pygobject3.dev pythonEnv gobjectIntrospection ];
 
-  PYTHONPATH = "$out/${pythonEnv.python.sitePackages}";
+  PYTHONPATH = "$out/${python2Packages.python.sitePackages}";
 
   wrapPrefixVariables = [ "PYTHONPATH" ];
 

From f49c2fbf7a0594717a16432295983512091fba26 Mon Sep 17 00:00:00 2001
From: Sergey Mironov <grrwlf@gmail.com>
Date: Thu, 28 Jan 2016 01:26:40 +0300
Subject: [PATCH 12/17] trivial-builders.nix: add writeShellScriptBin builder

---
 pkgs/build-support/trivial-builders.nix | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index 16bd4e8e405..14553c33e03 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -26,6 +26,7 @@ rec {
     , text
     , executable ? false # run chmod +x ?
     , destination ? ""   # relative path appended to $out eg "/bin/foo"
+    , checkPhase ? ""    # syntax checks, e.g. for scripts
     }:
     runCommand name
       { inherit text executable;
@@ -44,6 +45,8 @@ rec {
           echo -n "$text" > "$n"
         fi
 
+        ${checkPhase}
+
         (test -n "$executable" && chmod +x "$n") || true
       '';
 
@@ -54,6 +57,20 @@ rec {
   writeScript = name: text: writeTextFile {inherit name text; executable = true;};
   writeScriptBin = name: text: writeTextFile {inherit name text; executable = true; destination = "/bin/${name}";};
 
+  # Create a Shell script, check its syntax
+  writeShellScriptBin = name : text :
+    writeTextFile {
+      inherit name;
+      executable = true;
+      destination = "/bin/${name}";
+      text = ''
+        #!${stdenv.shell}
+        ${text}
+        '';
+      checkPhase = ''
+        ${stdenv.shell} -n $out
+      '';
+    };
 
   # Create a forest of symlinks to the files in `paths'.
   symlinkJoin =

From 6e6271e82fba1e5aa0cd4649843c1c803af9115a Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Wed, 2 Aug 2017 15:05:00 +0200
Subject: [PATCH 13/17] python.buildEnv: undo removal of passthru.python

---
 pkgs/development/interpreters/python/wrapper.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/interpreters/python/wrapper.nix b/pkgs/development/interpreters/python/wrapper.nix
index 71e9e614352..f95e51c82ee 100644
--- a/pkgs/development/interpreters/python/wrapper.nix
+++ b/pkgs/development/interpreters/python/wrapper.nix
@@ -39,6 +39,7 @@ let
 
     passthru = python.passthru // {
       interpreter = "${env}/bin/${python.executable}";
+      inherit python;
       env = stdenv.mkDerivation {
         name = "interactive-${python.name}-environment";
         nativeBuildInputs = [ env ];

From 5d91e806b9acca860a0e69c9a144e7a8618d0f2c Mon Sep 17 00:00:00 2001
From: Robin Gloster <mail@glob.in>
Date: Wed, 2 Aug 2017 16:14:34 +0200
Subject: [PATCH 14/17] Revert "gnome-tweak-tool: fix eval"

This reverts commit d9521c3418adc7d8883c6965c0083e8b9486543a.

Cleaner fix in 6e6271e82fba1e5aa0cd4649843c1c803af9115a
---
 pkgs/desktops/gnome-3/3.22/misc/gnome-tweak-tool/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/desktops/gnome-3/3.22/misc/gnome-tweak-tool/default.nix b/pkgs/desktops/gnome-3/3.22/misc/gnome-tweak-tool/default.nix
index 6268eaa3388..5a1baa5e330 100644
--- a/pkgs/desktops/gnome-3/3.22/misc/gnome-tweak-tool/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/misc/gnome-tweak-tool/default.nix
@@ -22,7 +22,7 @@ in stdenv.mkDerivation rec {
                   gnome3.gnome_desktop wrapGAppsHook
                   python2Packages.pygobject3.dev pythonEnv gobjectIntrospection ];
 
-  PYTHONPATH = "$out/${python2Packages.python.sitePackages}";
+  PYTHONPATH = "$out/${pythonEnv.python.sitePackages}";
 
   wrapPrefixVariables = [ "PYTHONPATH" ];
 

From 2d64d1e601126efbf19be94575f0a642aaf2b4eb Mon Sep 17 00:00:00 2001
From: Robin Gloster <mail@glob.in>
Date: Fri, 4 Aug 2017 08:22:04 +0200
Subject: [PATCH 15/17] fetchurlBoot: add name attr

---
 pkgs/build-support/fetchurl/boot.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/fetchurl/boot.nix b/pkgs/build-support/fetchurl/boot.nix
index 722fd2566ef..bd71f93c529 100644
--- a/pkgs/build-support/fetchurl/boot.nix
+++ b/pkgs/build-support/fetchurl/boot.nix
@@ -5,10 +5,11 @@ let mirrors = import ./mirrors.nix; in
 { url ? builtins.head urls
 , urls ? []
 , sha256
+, name ? baseNameOf (toString url)
 }:
 
 import <nix/fetchurl.nix> {
-  inherit system sha256;
+  inherit system sha256 name;
 
   url =
     # Handle mirror:// URIs. Since <nix/fetchurl.nix> currently

From 0e18f28cecdc53191c6c9db1f4c86fe22b3bdfb5 Mon Sep 17 00:00:00 2001
From: Robin Gloster <mail@glob.in>
Date: Fri, 4 Aug 2017 08:22:20 +0200
Subject: [PATCH 16/17] binutils: patch bugs in 2.29

All are upstream patches, the last two added by handy to work around
them not applying on the changelog.

2.29.1/2.30 will contain the fixes, too.
---
 pkgs/development/tools/misc/binutils/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index ac9ab141332..04911e4cc56 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -45,6 +45,15 @@ stdenv.mkDerivation rec {
     # there) and causes a cycle between the lib and bin outputs, so
     # get rid of it.
     ./no-plugins.patch
+
+    # remove after 2.29.1/2.30
+    (fetchurl {
+      url = "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=patch;h=c6b78c965a96fb152fbd58926edccb5dee2707a5";
+      sha256 = "0rkbq5pf7ffgcggfk4czkxin1091bqjj92an9wxnqkgqwq6cx5yr";
+      name = "readelf-empty-sections.patch";
+    })
+    ./elf-check-orphan-input.patch
+    ./elf-check-orphan-placement.patch
   ];
 
   # TODO: all outputs on all platform

From ad83979e5986fa3bb0d254c2be9482c12a8743b9 Mon Sep 17 00:00:00 2001
From: Robin Gloster <mail@glob.in>
Date: Fri, 4 Aug 2017 08:36:44 +0200
Subject: [PATCH 17/17] binutils: add missing patches...

---
 .../binutils/elf-check-orphan-input.patch     |  99 +++++++++++
 .../binutils/elf-check-orphan-placement.patch | 161 ++++++++++++++++++
 2 files changed, 260 insertions(+)
 create mode 100644 pkgs/development/tools/misc/binutils/elf-check-orphan-input.patch
 create mode 100644 pkgs/development/tools/misc/binutils/elf-check-orphan-placement.patch

diff --git a/pkgs/development/tools/misc/binutils/elf-check-orphan-input.patch b/pkgs/development/tools/misc/binutils/elf-check-orphan-input.patch
new file mode 100644
index 00000000000..2ec90128347
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/elf-check-orphan-input.patch
@@ -0,0 +1,99 @@
+From a388b7afeffad6411686d39dc1c62294da48a814 Mon Sep 17 00:00:00 2001
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Wed, 2 Aug 2017 05:10:29 -0700
+Subject: [PATCH] Check ELF section header only for ELF output
+
+When placing an orphan input section, check ELF section header only for
+ELF output.
+
+	PR ld/21884
+	* emultempl/elf32.em (gld${EMULATION_NAME}_place_orphan): Check
+	ELF section header only for ELF output.
+	* testsuite/ld-elf/pr21884.d: New test.
+	* testsuite/ld-elf/pr21884.t: Likewise.
+	* testsuite/ld-elf/pr21884a.s: Likewise.
+	* testsuite/ld-elf/pr21884b.s: Likewise.
+
+(cherry picked from commit db99ecc08f5b66fbe9cb72e90352c7f77ec71a6e)
+---
+ ld/ChangeLog                   | 10 ++++++++++
+ ld/emultempl/elf32.em          |  3 ++-
+ ld/testsuite/ld-elf/pr21884.d  | 11 +++++++++++
+ ld/testsuite/ld-elf/pr21884.t  |  7 +++++++
+ ld/testsuite/ld-elf/pr21884a.s |  5 +++++
+ ld/testsuite/ld-elf/pr21884b.s |  5 +++++
+ 6 files changed, 40 insertions(+), 1 deletion(-)
+ create mode 100644 ld/testsuite/ld-elf/pr21884.d
+ create mode 100644 ld/testsuite/ld-elf/pr21884.t
+ create mode 100644 ld/testsuite/ld-elf/pr21884a.s
+ create mode 100644 ld/testsuite/ld-elf/pr21884b.s
+
+diff --git a/ld/emultempl/elf32.em b/ld/emultempl/elf32.em
+index d2551b6..75ded12 100644
+--- a/ld/emultempl/elf32.em
++++ b/ld/emultempl/elf32.em
+@@ -2136,7 +2136,8 @@ gld${EMULATION_NAME}_place_orphan (asection *s,
+     }
+ 
+   /* Look through the script to see where to place this section.  */
+-  if (constraint == 0)
++  if (constraint == 0
++      && link_info.output_bfd->xvec->flavour == bfd_target_elf_flavour)
+     for (os = lang_output_section_find (secname);
+ 	 os != NULL;
+ 	 os = next_matching_output_section_statement (os, 0))
+diff --git a/ld/testsuite/ld-elf/pr21884.d b/ld/testsuite/ld-elf/pr21884.d
+new file mode 100644
+index 0000000..52cd2c1
+--- /dev/null
++++ b/ld/testsuite/ld-elf/pr21884.d
+@@ -0,0 +1,11 @@
++#source: pr21884a.s
++#source: pr21884b.s
++#ld: -T pr21884.t
++#objdump: -b binary -s
++#notarget: aarch64*-*-* arm*-*-* nds32*-*-*
++# Skip targets which can't change output format to binary.
++
++.*:     file format binary
++
++Contents of section .data:
++#pass
+diff --git a/ld/testsuite/ld-elf/pr21884.t b/ld/testsuite/ld-elf/pr21884.t
+new file mode 100644
+index 0000000..d483911
+--- /dev/null
++++ b/ld/testsuite/ld-elf/pr21884.t
+@@ -0,0 +1,7 @@
++OUTPUT_FORMAT("binary")
++
++ENTRY(_main);
++SECTIONS {
++	. = 0;
++	.setup : { *(.setup) }
++}
+diff --git a/ld/testsuite/ld-elf/pr21884a.s b/ld/testsuite/ld-elf/pr21884a.s
+new file mode 100644
+index 0000000..a3361b2
+--- /dev/null
++++ b/ld/testsuite/ld-elf/pr21884a.s
+@@ -0,0 +1,5 @@
++	.text
++	.globl	_main
++	.type _main,%function
++_main:
++	.dc.a bar
+diff --git a/ld/testsuite/ld-elf/pr21884b.s b/ld/testsuite/ld-elf/pr21884b.s
+new file mode 100644
+index 0000000..e533837
+--- /dev/null
++++ b/ld/testsuite/ld-elf/pr21884b.s
+@@ -0,0 +1,5 @@
++	.text
++	.globl	bar
++	.type bar,%function
++bar:
++	.byte 0
+-- 
+2.9.3
+
diff --git a/pkgs/development/tools/misc/binutils/elf-check-orphan-placement.patch b/pkgs/development/tools/misc/binutils/elf-check-orphan-placement.patch
new file mode 100644
index 00000000000..7e7566aec43
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/elf-check-orphan-placement.patch
@@ -0,0 +1,161 @@
+From 36088682f447540fd8666a2c437fa232064044a7 Mon Sep 17 00:00:00 2001
+From: Alan Modra <amodra@gmail.com>
+Date: Thu, 3 Aug 2017 14:01:34 +0930
+Subject: [PATCH] ELF checks for orphan placement
+
+The loop checking for previous orphan placement should run even when
+the output is non-ELF.
+
+	PR ld/21884
+	* emultempl/elf32.em (gld${EMULATION_NAME}_place_orphan): Revert
+	last change.  Rename iself to elfinput.  Expand comments.  Condition
+	ELF checks on having both input and output ELF files.  Extract..
+	(elf_orphan_compatible): ..this new function.
+---
+ ld/ChangeLog          |  8 ++++++
+ ld/emultempl/elf32.em | 76 +++++++++++++++++++++++++++++++--------------------
+ 2 files changed, 55 insertions(+), 29 deletions(-)
+
+diff --git a/ld/emultempl/elf32.em b/ld/emultempl/elf32.em
+index 75ded12..9ac1840 100644
+--- a/ld/emultempl/elf32.em
++++ b/ld/emultempl/elf32.em
+@@ -2008,6 +2008,29 @@ output_rel_find (asection *sec, int isdyn)
+   return last;
+ }
+ 
++/* Return whether IN is suitable to be part of OUT.  */
++
++static bfd_boolean
++elf_orphan_compatible (asection *in, asection *out)
++{
++  /* Non-zero sh_info implies a section with SHF_INFO_LINK with
++     unknown semantics for the generic linker, or a SHT_REL/SHT_RELA
++     section where sh_info specifies a symbol table.  (We won't see
++     SHT_GROUP, SHT_SYMTAB or SHT_DYNSYM sections here.)  We clearly
++     can't merge SHT_REL/SHT_RELA using differing symbol tables, and
++     shouldn't merge sections with differing unknown semantics.  */
++  if (elf_section_data (out)->this_hdr.sh_info
++      != elf_section_data (in)->this_hdr.sh_info)
++    return FALSE;
++  /* We can't merge two sections with differing SHF_EXCLUDE when doing
++     a relocatable link.  */
++  if (bfd_link_relocatable (&link_info)
++      && ((elf_section_flags (out) ^ elf_section_flags (in)) & SHF_EXCLUDE) != 0)
++    return FALSE;
++  return _bfd_elf_match_sections_by_type (link_info.output_bfd, out,
++					  in->owner, in);
++}
++
+ /* Place an orphan section.  We use this to put random SHF_ALLOC
+    sections in the right segment.  */
+ 
+@@ -2064,8 +2087,9 @@ gld${EMULATION_NAME}_place_orphan (asection *s,
+   lang_output_section_statement_type *os;
+   lang_output_section_statement_type *match_by_name = NULL;
+   int isdyn = 0;
+-  int iself = s->owner->xvec->flavour == bfd_target_elf_flavour;
+-  unsigned int sh_type = iself ? elf_section_type (s) : SHT_NULL;
++  int elfinput = s->owner->xvec->flavour == bfd_target_elf_flavour;
++  int elfoutput = link_info.output_bfd->xvec->flavour == bfd_target_elf_flavour;
++  unsigned int sh_type = elfinput ? elf_section_type (s) : SHT_NULL;
+   flagword flags;
+   asection *nexts;
+ 
+@@ -2073,7 +2097,7 @@ gld${EMULATION_NAME}_place_orphan (asection *s,
+       && link_info.combreloc
+       && (s->flags & SEC_ALLOC))
+     {
+-      if (iself)
++      if (elfinput)
+ 	switch (sh_type)
+ 	  {
+ 	  case SHT_RELA:
+@@ -2095,6 +2119,8 @@ gld${EMULATION_NAME}_place_orphan (asection *s,
+     }
+ 
+   if (!bfd_link_relocatable (&link_info)
++      && elfinput
++      && elfoutput
+       && (s->flags & SEC_ALLOC) != 0
+       && (elf_section_flags (s) & SHF_GNU_MBIND) != 0)
+     {
+@@ -2135,9 +2161,11 @@ gld${EMULATION_NAME}_place_orphan (asection *s,
+ 	secname = ".mbind.text";
+     }
+ 
+-  /* Look through the script to see where to place this section.  */
+-  if (constraint == 0
+-      && link_info.output_bfd->xvec->flavour == bfd_target_elf_flavour)
++  /* Look through the script to see where to place this section.  The
++     script includes entries added by previous lang_insert_orphan
++     calls, so this loop puts multiple compatible orphans of the same
++     name into a single output section.  */
++  if (constraint == 0)
+     for (os = lang_output_section_find (secname);
+ 	 os != NULL;
+ 	 os = next_matching_output_section_statement (os, 0))
+@@ -2146,29 +2174,19 @@ gld${EMULATION_NAME}_place_orphan (asection *s,
+ 	   lang_insert_orphan to create a new output section.  */
+ 	constraint = SPECIAL;
+ 
+-	/* SEC_EXCLUDE is cleared when doing a relocatable link.  But
+-	   we can't merge 2 input sections with the same name when only
+-	   one of them has SHF_EXCLUDE.  Don't merge 2 sections with
+-	   different sh_info.  */
++	/* Check to see if we already have an output section statement
++	   with this name, and its bfd section has compatible flags.
++	   If the section already exists but does not have any flags
++	   set, then it has been created by the linker, possibly as a
++	   result of a --section-start command line switch.  */
+ 	if (os->bfd_section != NULL
+-	    && (elf_section_data (os->bfd_section)->this_hdr.sh_info
+-		== elf_section_data (s)->this_hdr.sh_info)
+ 	    && (os->bfd_section->flags == 0
+-		|| ((!bfd_link_relocatable (&link_info)
+-		     || (iself && (((elf_section_flags (s)
+-				     ^ elf_section_flags (os->bfd_section))
+-				    & SHF_EXCLUDE) == 0)))
+-		    && ((s->flags ^ os->bfd_section->flags)
++		|| (((s->flags ^ os->bfd_section->flags)
+ 		     & (SEC_LOAD | SEC_ALLOC)) == 0
+-		    && _bfd_elf_match_sections_by_type (link_info.output_bfd,
+-							os->bfd_section,
+-							s->owner, s))))
++		    && (!elfinput
++			|| !elfoutput
++			|| elf_orphan_compatible (s, os->bfd_section)))))
+ 	  {
+-	    /* We already have an output section statement with this
+-	       name, and its bfd section has compatible flags.
+-	       If the section already exists but does not have any flags
+-	       set, then it has been created by the linker, probably as a
+-	       result of a --section-start command line switch.  */
+ 	    lang_add_section (&os->children, s, NULL, os);
+ 	    return os;
+ 	  }
+@@ -2244,8 +2262,8 @@ gld${EMULATION_NAME}_place_orphan (asection *s,
+   else if ((flags & SEC_ALLOC) == 0)
+     ;
+   else if ((flags & SEC_LOAD) != 0
+-	   && ((iself && sh_type == SHT_NOTE)
+-	       || (!iself && CONST_STRNEQ (secname, ".note"))))
++	   && ((elfinput && sh_type == SHT_NOTE)
++	       || (!elfinput && CONST_STRNEQ (secname, ".note"))))
+     place = &hold[orphan_interp];
+   else if ((flags & (SEC_LOAD | SEC_HAS_CONTENTS | SEC_THREAD_LOCAL)) == 0)
+     place = &hold[orphan_bss];
+@@ -2255,8 +2273,8 @@ gld${EMULATION_NAME}_place_orphan (asection *s,
+     place = &hold[orphan_tdata];
+   else if ((flags & SEC_READONLY) == 0)
+     place = &hold[orphan_data];
+-  else if (((iself && (sh_type == SHT_RELA || sh_type == SHT_REL))
+-	    || (!iself && CONST_STRNEQ (secname, ".rel")))
++  else if (((elfinput && (sh_type == SHT_RELA || sh_type == SHT_REL))
++	    || (!elfinput && CONST_STRNEQ (secname, ".rel")))
+ 	   && (flags & SEC_LOAD) != 0)
+     place = &hold[orphan_rel];
+   else if ((flags & SEC_CODE) == 0)
+-- 
+2.9.3
+