Merge branch 'master' into staging

* master: (53 commits)
  hashcat: 4.0.0 -> 4.0.1
  vault: add nixos test
  emem: 0.2.48 -> 0.2.50
  nixos/nat: add dmzHost option (#32257)
  vulnix: 1.3.4 -> 1.4.0
  linux-4.13: mark as insecure (+required generic changes)
  vault: 0.8.3 -> 0.9.0
  gox: 20140904 -> 0.4.0
  guitarix: 0.35.6 -> 0.36.1
  geolite-legacy: 2017-10-25 -> 2017-12-02
  premake5: 5.0.0pre.alpha.11 -> 5.0.0-alpha12
  otfcc: build with ninja
  python/hetzner: 0.7.5 -> 0.8.0
  linux-testing: 4.15-rc1 -> 4.15-rc2
  Revert "linux_4_13: Remove, no longer supported."
  jenkins: 2.92 -> 2.93
  psc-package: 0.2.4 -> 0.2.5
  dino: 2017-09-26 -> 2017-12-03
  gnome3.gpaste: fix keybindings path
  plasma: 5.11.3 -> 5.11.4
  ...

pkgs/os-specific/linux/ioport/default.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     description = "Direct access to I/O ports from the command line";
     homepage = http://people.redhat.com/rjones/ioport/;
     license = licenses.gpl2Plus;
-    platforms = platforms.linux;
+    platforms = [ "x86_64-linux" "i686-linux" ];
     maintainers = [ maintainers.cleverca22 ];
   };
 }

pkgs/os-specific/linux/kernel/generic.nix

@@ -118,7 +118,7 @@ let
   };
 
   kernel = buildLinux {
-    inherit version modDirVersion src kernelPatches stdenv;
+    inherit version modDirVersion src kernelPatches stdenv extraMeta;
 
     configfile = configfile.nativeDrv or configfile;
 
@@ -131,10 +131,7 @@ let
 
   passthru = {
     features = kernelFeatures;
-
-    meta = kernel.meta // extraMeta;
-
-    passthru = kernel.passthru // (removeAttrs passthru [ "passthru" "meta" ]);
+    passthru = kernel.passthru // (removeAttrs passthru [ "passthru" ]);
   };
 
   nativeDrv = lib.addPassthru kernel.nativeDrv passthru;

pkgs/os-specific/linux/kernel/linux-4.13.nix

@@ -4,6 +4,12 @@ import ./generic.nix (args // rec {
   version = "4.13.16";
   extraMeta.branch = "4.13";
 
+  # TODO: perhaps try being more concrete (ideally CVE numbers).
+  extraMeta.knownVulnerabilities = [
+    "ALSA: usb-audio: Fix potential out-of-bound access at parsing SU"
+    "eCryptfs: use after free in ecryptfs_release_messaging()"
+  ];
+
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
     sha256 = "0cf7prqzl1ajbgl98w0symdyn0k5wl5xaf1l5ldgy6l083yg69dh";

pkgs/os-specific/linux/kernel/linux-testing.nix

@@ -1,13 +1,13 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, libelf, utillinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.15-rc1";
-  modDirVersion = "4.15.0-rc1";
+  version = "4.15-rc2";
+  modDirVersion = "4.15.0-rc2";
   extraMeta.branch = "4.15";
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "1l7c132qb5qjd80hga03ivssfq65brqyd95sb4rd065dqrixp20n";
+    sha256 = "1i79gkjipj1q7w0d4zjz2hj43r12jicgznxk0wz0la2d8a4d3lcq";
   };
 
   # Should the testing kernels ever be built on Hydra?

pkgs/os-specific/linux/kernel/manual-config.nix

@@ -39,6 +39,8 @@ in {
   config ? stdenv.lib.optionalAttrs allowImportFromDerivation (readConfig configfile),
   # Cross-compiling config
   crossConfig ? if allowImportFromDerivation then (readConfig crossConfigfile) else config,
+  # Use defaultMeta // extraMeta
+  extraMeta ? {},
   # Whether to utilize the controversial import-from-derivation feature to parse the config
   allowImportFromDerivation ? false
 }:
@@ -228,7 +230,7 @@ let
           maintainers.thoughtpolice
         ];
         platforms = platforms.linux;
-      };
+      } // extraMeta;
     };
 in