Merge to keep first-parent history on staging

(at least most of it)  We got switched on 58307d15a.

pkgs/applications/networking/newsreaders/quiterss/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "quiterss-${version}";
-  version = "0.18.8";
+  version = "0.18.9";
 
   src = fetchFromGitHub {
     owner = "QuiteRSS";
     repo = "quiterss";
     rev = "${version}";
-    sha256 = "09mdxpv04zycrip1p5w6947348xfraicijddvxsr7d498r59b7ff";
+    sha256 = "0n2rgzyxw6m29i8m8agri3cp5dbpjblhhyklvxsyzmkksnsxpw58";
   };
 
   nativeBuildInputs = [ pkgconfig qmake ];

pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -13,7 +13,7 @@
 }:
 
 let
-  version = "2.15.0";
+  version = "2.15.1";
   svn = subversionClient.override { perlBindings = true; };
 in
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "0siyxg1ppg6szjp8xp37zfq1fj97kbdxpigi3asmidqhkx41cw8h";
+    sha256 = "0p04linqdywdf7m1hqa904fzqvgzplsxlzdqrn96j1j5gpyr174r";
   };
 
   hardeningDisable = [ "format" ];

pkgs/applications/version-management/tortoisehg/default.nix

@@ -13,7 +13,7 @@ python2Packages.buildPythonApplication rec {
 
     propagatedBuildInputs = with python2Packages; [ qscintilla iniparse ];
 
-    doCheck = false;
+    doCheck = true;
     dontStrip = true;
     buildPhase = "";
     installPhase = ''
@@ -23,6 +23,11 @@ python2Packages.buildPythonApplication rec {
       ln -s $out/bin/thg $out/bin/tortoisehg     #convenient alias
     '';
 
+    checkPhase = ''
+      echo "test: thg version"
+      $out/bin/thg version
+    '';
+
     meta = {
       description = "Qt based graphical tool for working with Mercurial";
       homepage = http://tortoisehg.bitbucket.org/;

pkgs/data/sgml+xml/schemas/docbook-5.0/default.nix

@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "13i04dkd709f0p5f2413sf2y9321pfi4y85ynf8wih6ryphnbk9x";
   };
 
-  buildInputs = [ unzip ];
+  nativeBuildInputs = [ unzip ];
 
   installPhase =
     ''

pkgs/data/sgml+xml/schemas/sgml-dtd/docbook/3.1.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, unzip }:
 
-let 
+let
 
   src = fetchurl {
     url = http://www.oasis-open.org/docbook/sgml/3.1/docbk31.zip;
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
 
   unpackPhase = "true";
 
-  buildInputs = [ unzip ];
+  nativeBuildInputs = [ unzip ];
 
   installPhase =
     ''

pkgs/data/sgml+xml/schemas/sgml-dtd/docbook/4.1.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, unzip }:
 
-let 
+let
 
   src = fetchurl {
     url = http://www.oasis-open.org/docbook/sgml/4.1/docbk41.zip;
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
 
   unpackPhase = "true";
 
-  buildInputs = [ unzip ];
+  nativeBuildInputs = [ unzip ];
 
   installPhase =
     ''

pkgs/data/sgml+xml/schemas/xml-dtd/docbook-ebnf/builder.sh

@@ -1,6 +0,0 @@
-source $stdenv/setup
-
-mkdir -p $out/xml/dtd/docbook-ebnf
-cd $out/xml/dtd/docbook-ebnf
-cp -p $dtd dbebnf.dtd
-cp -p $catalog $(stripHash $catalog)

pkgs/data/sgml+xml/schemas/xml-dtd/docbook-ebnf/default.nix

@@ -1,16 +1,24 @@
 {stdenv, fetchurl, unzip}:
 
-assert unzip != null;
-
 stdenv.mkDerivation {
   name = "docbook-xml-ebnf-1.2b1";
-  builder = ./builder.sh;
+
   dtd = fetchurl {
     url = http://www.docbook.org/xml/ebnf/1.2b1/dbebnf.dtd;
     sha256 = "0min5dsc53my13b94g2yd65q1nkjcf4x1dak00bsc4ckf86mrx95";
   };
   catalog = ./docbook-ebnf.cat;
 
+  unpackPhase = ''
+    mkdir -p $out/xml/dtd/docbook-ebnf
+    cd $out/xml/dtd/docbook-ebnf
+  '';
+
+  installPhase = ''
+    cp -p $dtd dbebnf.dtd
+    cp -p $catalog $(stripHash $catalog)
+  '';
+
   meta = {
     platforms = stdenv.lib.platforms.unix;
   };

pkgs/data/sgml+xml/schemas/xml-dtd/docbook/builder.sh

@@ -1,7 +0,0 @@
-source $stdenv/setup
-
-mkdir -p $out/xml/dtd/docbook
-cd $out/xml/dtd/docbook
-unpackFile $src
-find . -type f -exec chmod -x {} \;
-eval "$postInstall"

pkgs/data/sgml+xml/schemas/xml-dtd/docbook/generic.nix

@@ -1,12 +1,21 @@
 { stdenv, fetchurl, unzip, src, name, postInstall ? "true", meta ? {}, findXMLCatalogs }:
 
-assert unzip != null;
-
 stdenv.mkDerivation {
   inherit src name postInstall;
-  builder = ./builder.sh;
+
-  buildInputs = [unzip];
+  nativeBuildInputs = [unzip];
-  propagatedBuildInputs = [ findXMLCatalogs ];
+  propagatedNativeBuildInputs = [ findXMLCatalogs ];
+
+  unpackPhase = ''
+    mkdir -p $out/xml/dtd/docbook
+    cd $out/xml/dtd/docbook
+    unpackFile $src
+  '';
+
+  installPhase = ''
+    find . -type f -exec chmod -x {} \;
+    runHook postInstall
+  '';
 
   meta = meta // {
     platforms = stdenv.lib.platforms.unix;

pkgs/data/sgml+xml/schemas/xml-dtd/xhtml1/default.nix

@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "0rr0d89i0z75qvjbm8il93bippx09hbmjwy0y2sj44n9np69x3hl";
   };
 
-  buildInputs = [ libxml2 ];
+  nativeBuildInputs = [ libxml2 ];
 
   installPhase =
     ''

pkgs/desktops/gnome-3/apps/cheese/default.nix

@@ -1,18 +1,41 @@
 { stdenv, intltool, fetchurl, wrapGAppsHook, gnome-video-effects, libcanberra_gtk3
 , pkgconfig, gtk3, glib, clutter_gtk, clutter-gst, udev, gst_all_1, itstool
-, libgudev
+, libgudev, autoreconfHook, vala, docbook_xml_dtd_43, docbook_xsl, appstream-glib
-, adwaita-icon-theme, librsvg, gdk_pixbuf, gnome3, gnome_desktop, libxml2 }:
+, libxslt, yelp_tools, gnome_common, gtk_doc
+, adwaita-icon-theme, librsvg, totem, gdk_pixbuf, gnome3, gnome_desktop, libxml2 }:
 
 stdenv.mkDerivation rec {
   inherit (import ./src.nix fetchurl) name src;
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [
-  buildInputs = [ gtk3 glib intltool wrapGAppsHook gnome-video-effects itstool
+    pkgconfig intltool itstool vala wrapGAppsHook libxml2 appstream-glib
-                  gdk_pixbuf adwaita-icon-theme librsvg udev gst_all_1.gstreamer libxml2
+    libxslt docbook_xml_dtd_43 docbook_xsl
+    autoreconfHook gtk_doc yelp_tools gnome_common
+  ];
+  buildInputs = [ gtk3 glib gnome-video-effects
+                  gdk_pixbuf adwaita-icon-theme librsvg udev gst_all_1.gstreamer
                   gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good gnome_desktop
                   gst_all_1.gst-plugins-bad clutter_gtk clutter-gst
                   libcanberra_gtk3 libgudev ];
 
+  outputs = [ "out" "man" "devdoc" ];
+
+  patches = [
+    gtk_doc.respect_xml_catalog_files_var_patch
+  ];
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      # Effects
+      --prefix XDG_DATA_DIRS : "${gnome-video-effects}/share"
+      # vp8enc preset
+      --prefix GST_PRESET_PATH : "${gst_all_1.gst-plugins-good}/share/gstreamer-1.0/presets"
+      # Thumbnailers
+      --prefix XDG_DATA_DIRS : "${gdk_pixbuf}/share"
+      --prefix XDG_DATA_DIRS : "${totem}/share"
+    )
+  '';
+
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {

pkgs/desktops/gnome-3/core/gnome-desktop/bubblewrap-paths.patch

@@ -0,0 +1,19 @@
+--- a/libgnome-desktop/gnome-desktop-thumbnail-script.c
++++ b/libgnome-desktop/gnome-desktop-thumbnail-script.c
+@@ -504,14 +504,10 @@
+   g_return_val_if_fail (script->s_infile != NULL, FALSE);
+ 
+   add_args (array,
+-	    "bwrap",
+-	    "--ro-bind", "/usr", "/usr",
+-	    "--ro-bind", "/lib", "/lib",
+-	    "--ro-bind", "/lib64", "/lib64",
++	    "@BUBBLEWRAP_BIN@",
++      "--ro-bind", "/nix/store", "/nix/store",
+ 	    "--proc", "/proc",
+ 	    "--dev", "/dev",
+-	    "--symlink", "usr/bin", "/bin",
+-	    "--symlink", "usr/sbin", "/sbin",
+ 	    "--chdir", "/",
+ 	    "--setenv", "GIO_USE_VFS", "local",
+ 	    "--unshare-all",

pkgs/desktops/gnome-3/core/gnome-desktop/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, pkgconfig, python, libxml2Python, libxslt, which, libX11, gnome3, gtk3, glib
 , intltool, gnome_doc_utils, libxkbfile, xkeyboard_config, isocodes, itstool, wayland
-, libseccomp, gobjectIntrospection }:
+, libseccomp, bubblewrap, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
   inherit (import ./src.nix fetchurl) name src;
@@ -10,14 +10,24 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [
-  buildInputs = [ python libxml2Python libxslt which libX11
+    pkgconfig which itstool intltool libxslt gnome_doc_utils gobjectIntrospection
-                  xkeyboard_config isocodes itstool wayland
+  ];
-                  gtk3 glib intltool gnome_doc_utils libxkbfile
+  buildInputs = [ python libxml2Python libX11 bubblewrap
-                   libseccomp gobjectIntrospection ];
+                  xkeyboard_config isocodes wayland
+                  gtk3 glib libxkbfile libseccomp ];
 
   propagatedBuildInputs = [ gnome3.gsettings_desktop_schemas ];
 
+  patches = [
+    ./bubblewrap-paths.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace libgnome-desktop/gnome-desktop-thumbnail-script.c --subst-var-by \
+      BUBBLEWRAP_BIN "${bubblewrap}/bin/bwrap"
+  '';
+
   meta = with stdenv.lib; {
     platforms = platforms.linux;
     maintainers = gnome3.maintainers;

pkgs/desktops/gnome-3/misc/gnome-video-effects/default.nix

@@ -2,15 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "gnome-video-effects-${version}";
-  version = "0.4.1";
+  version = "0.4.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-video-effects/0.4/${name}.tar.xz";
-    sha256 = "0jl4iny2dqpcgi3sgxzpgnbw0752i8ay3rscp2cgdjlp79ql5gil";
+    sha256 = "06c2f1kihyhawap1s3zg5w7q7fypsybkp7xry4hxkdz4mpsy0zjs";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig intltool ];
-  buildInputs = [ intltool ];
 
   meta = with stdenv.lib; {
     homepage = https://wiki.gnome.org/Projects/GnomeVideoEffects;

pkgs/development/compilers/elm/default.nix

@@ -72,7 +72,9 @@ let
             where foo is a tag for a new version, for example "0.3.1-alpha".
             */
             elm-format = self.callPackage ./packages/elm-format.nix { };
-
+            elm-interface-to-json = self.callPackage ./packages/elm-interface-to-json.nix {
+              aeson-pretty = self.aeson-pretty_0_7_2;
+            };
           };
       in elmPkgs // {
         inherit elmPkgs;

pkgs/development/compilers/elm/packages/elm-interface-to-json.nix

@@ -0,0 +1,24 @@
+{ mkDerivation, aeson, aeson-pretty, base, binary, bytestring
+, concatenative, containers, directory, either, elm-compiler
+, filemanip, filepath, indents, optparse-applicative, parsec
+, stdenv, text, transformers, fetchgit
+}:
+mkDerivation {
+  pname = "elm-interface-to-json";
+  version = "0.1.0.0";
+  src = fetchgit {
+    url = "https://github.com/stoeffel/elm-interface-to-json";
+    sha256 = "1izc78w91m7nrc9i2b3lgy3kyjsy4d5mkkblx96ws0bp3dpm5f9k";
+    rev = "9884c1c997a55f11cf7c3d99a8afa72cf2e97323";
+  };
+  isLibrary = false;
+  isExecutable = true;
+  jailbreak = true;
+  executableHaskellDepends = [
+    aeson aeson-pretty base binary bytestring concatenative containers
+    directory either elm-compiler filemanip filepath indents
+    optparse-applicative parsec text transformers
+  ];
+  homepage = "https://github.com/githubuser/elm-interface-to-json#readme";
+  license = stdenv.lib.licenses.bsd3;
+}

pkgs/development/compilers/go/1.8.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, tzdata, iana-etc, go_bootstrap, runCommand, writeScriptBin
-, perl, which, pkgconfig, patch, fetchpatch
+, perl, which, pkgconfig, patch, procps
 , pcre, cacert, llvm
 , Security, Foundation, bash
 , makeWrapper, git, subversion, mercurial, bazaar }:
@@ -35,7 +35,8 @@ stdenv.mkDerivation rec {
   };
 
   # perl is used for testing go vet
-  nativeBuildInputs = [ perl which pkgconfig patch makeWrapper ];
+  nativeBuildInputs = [ perl which pkgconfig patch makeWrapper ]
+    ++ optionals stdenv.isLinux [ procps ];
   buildInputs = [ pcre ]
     ++ optionals stdenv.isLinux [ stdenv.glibc.out stdenv.glibc.static ];
   propagatedBuildInputs = optionals stdenv.isDarwin [ Security Foundation ];
@@ -144,6 +145,7 @@ stdenv.mkDerivation rec {
     export GOROOT=$out/share/go
     export GOBIN=$GOROOT/bin
     export PATH=$GOBIN:$PATH
+    ulimit -a
   '';
 
   postConfigure = optionalString stdenv.isDarwin ''

pkgs/development/compilers/go/1.9.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, tzdata, iana-etc, go_bootstrap, runCommand, writeScriptBin
-, perl, which, pkgconfig, patch, fetchpatch
+, perl, which, pkgconfig, patch, procps
 , pcre, cacert, llvm
 , Security, Foundation, bash
 , makeWrapper, git, subversion, mercurial, bazaar }:
@@ -35,7 +35,8 @@ stdenv.mkDerivation rec {
   };
 
   # perl is used for testing go vet
-  nativeBuildInputs = [ perl which pkgconfig patch makeWrapper ];
+  nativeBuildInputs = [ perl which pkgconfig patch makeWrapper ]
+    ++ optionals stdenv.isLinux [ procps ];
   buildInputs = [ pcre ]
     ++ optionals stdenv.isLinux [ stdenv.glibc.out stdenv.glibc.static ];
   propagatedBuildInputs = optionals stdenv.isDarwin [ Security Foundation ];
@@ -150,6 +151,7 @@ stdenv.mkDerivation rec {
     export GOROOT=$out/share/go
     export GOBIN=$GOROOT/bin
     export PATH=$GOBIN:$PATH
+    ulimit -a
   '';
 
   postConfigure = optionalString stdenv.isDarwin ''

pkgs/development/compilers/rust/bootstrap.nix

@@ -9,6 +9,7 @@ let
   hashes = {
     i686-unknown-linux-gnu = "abe592e06616cdc2fcca56ddbe482050dd49a1fada35e2af031c64fe6eb14668";
     x86_64-unknown-linux-gnu = "ca1cf3aed73ff03d065a7d3e57ecca92228d35dc36d9274a6597441319f18eb8";
+    aarch64-unknown-linux-gnu = "eaab3df489d4d8f976c4327d812b9870730eed6d0bbd52712767083d02be7472";
     i686-apple-darwin = "b3c2470f8f132d285e6c989681e251592b67071bc9d93cac8a2e6b66f7bdfcb5";
     x86_64-apple-darwin = "fa1fb8896d5e327cbe6deeb50e6e9a3346de629f2e6bcbd8c10f19f3e2ed67d5";
   };
@@ -18,6 +19,8 @@ let
     then "i686-unknown-linux-gnu"
     else if stdenv.system == "x86_64-linux"
     then "x86_64-unknown-linux-gnu"
+    else if stdenv.system == "aarch64-linux"
+    then "aarch64-unknown-linux-gnu"
     else if stdenv.system == "i686-darwin"
     then "i686-apple-darwin"
     else if stdenv.system == "x86_64-darwin"

pkgs/development/compilers/rust/default.nix

@@ -23,7 +23,9 @@ rec {
 
     patches = [
       ./patches/0001-Disable-fragile-tests-libstd-net-tcp-on-Darwin-Linux.patch
-    ] ++ stdenv.lib.optional stdenv.needsPax ./patches/grsec.patch;
+    ] ++ stdenv.lib.optional stdenv.needsPax ./patches/grsec.patch
+      # https://github.com/rust-lang/rust/issues/45410
+      ++ stdenv.lib.optional stdenv.isAarch64 ./patches/aarch64-disable-test_loading_cosine.patch;
 
   };
 

pkgs/development/compilers/rust/patches/aarch64-disable-test_loading_cosine.patch

@@ -0,0 +1,12 @@
+diff --git a/src/librustc_back/dynamic_lib.rs b/src/librustc_back/dynamic_lib.rs
+index 1b42fa0..92256dc 100644
+--- a/src/librustc_back/dynamic_lib.rs
++++ b/src/librustc_back/dynamic_lib.rs
+@@ -80,6 +80,7 @@ mod tests {
+     use std::mem;
+ 
+     #[test]
++    #[ignore]
+     fn test_loading_cosine() {
+         if cfg!(windows) {
+             return

pkgs/development/compilers/rust/print-hashes.sh

@@ -10,6 +10,7 @@ set -euo pipefail
 PLATFORMS=(
   i686-unknown-linux-gnu
   x86_64-unknown-linux-gnu
+  aarch64-unknown-linux-gnu
   i686-apple-darwin
   x86_64-apple-darwin
 )

pkgs/development/compilers/rust/rustc.nix

@@ -34,6 +34,9 @@ stdenv.mkDerivation {
 
   __darwinAllowLocalNetworking = true;
 
+  # The build will fail at the very end on AArch64 without this.
+  dontUpdateAutotoolsGnuConfigScripts = if stdenv.isAarch64 then true else null;
+
   NIX_LDFLAGS = optionalString stdenv.isDarwin "-rpath ${llvmShared}/lib";
 
   # Enable nightly features in stable compiles (used for

pkgs/development/libraries/libtasn1/default.nix

@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "dev";
 
-  buildInputs = [ perl texinfo ];
+  nativeBuildInputs = [ texinfo ];
+  buildInputs = [ perl ];
 
   doCheck = true;
 

pkgs/development/libraries/ncurses/default.nix

@@ -11,7 +11,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = if abiVersion == "5" then "5.9" else "6.0-20170902";
+  version = if abiVersion == "5" then "5.9" else "6.0-20171125";
   name = "ncurses-${version}";
 
   src = fetchurl (if abiVersion == "5" then {
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     sha256 = "0fsn7xis81za62afan0vvm38bvgzg5wfmv1m86flqcj0nj7jjilh";
   } else {
     url = "ftp://ftp.invisible-island.net/ncurses/current/${name}.tgz";
-    sha256 = "1cks4gsz4148jw6wpqia4w5jx7cfxr29g2kmpvp0ssmvwczh8dr4";
+    sha256 = "11adzj0k82nlgpfrflabvqn2m7fmhp2y6pd7ivmapynxqb9vvb92";
   });
 
   patches = [ ./clang.patch ] ++ lib.optional (abiVersion == "5" && stdenv.cc.isGNU) ./gcc-5.patch;

pkgs/development/tools/documentation/gtk-doc/default.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    ./respect-xml-catalog-files-var.patch
+    passthru.respect_xml_catalog_files_var_patch
   ];
 
   outputDevdoc = "out";
@@ -24,6 +24,11 @@ stdenv.mkDerivation rec {
 
   configureFlags = "--disable-scrollkeeper";
 
+  passthru = {
+    # Consumers are expected to copy the m4 files to their source tree, let them reuse the patch
+    respect_xml_catalog_files_var_patch = ./respect-xml-catalog-files-var.patch;
+  };
+
   meta = with stdenv.lib; {
     homepage = https://www.gtk.org/gtk-doc;
     description = "Tools to extract documentation embedded in GTK+ and GNOME source code";

pkgs/development/tools/misc/help2man/default.nix

@@ -1,11 +1,11 @@
 { stdenv, hostPlatform, fetchurl, perl, gettext, LocaleGettext, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  name = "help2man-1.47.4";
+  name = "help2man-1.47.5";
 
   src = fetchurl {
     url = "mirror://gnu/help2man/${name}.tar.xz";
-    sha256 = "0lvp4306f5nq08f3snffs5pp1zwv8l35z6f5g0dds51zs6bzdv6l";
+    sha256 = "1cb14kp380jzk1yi4i7x9d8qplc8c5mgcbgycgs9ggpx34jhp9kw";
   };
 
   nativeBuildInputs = [ makeWrapper gettext LocaleGettext ];

pkgs/development/tools/misc/libtool/default.nix

@@ -2,13 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "libtool-1.5.26";
-  
+
   src = fetchurl {
     url = "mirror://gnu/libtool/${name}.tar.gz";
     sha256 = "029ggq5kri1gjn6nfqmgw4w920gyfzscjjxbsxxidal5zqsawd8w";
   };
-  
+
-  buildInputs = [m4 perl];
+  nativeBuildInputs = [m4];
+  buildInputs = [perl];
 
   # Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the
   # "fixed" path in generated files!

pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix

@@ -3,9 +3,9 @@
 with stdenv.lib;
 
 let
-  version = "4.14.2";
+  version = "4.14.3";
   revision = "a";
-  sha256 = "0bpkff1phc68shw6spkhd6zbxgjkgvdglym8b2hp383h14845qhb";
+  sha256 = "18pcmi927gw4a0ih09fq1wv0jbzp1z42a8kga8ralcac828i6gi3";
 
   # modVersion needs to be x.y.z, will automatically add .0 if needed
   modVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));

pkgs/os-specific/linux/kexectools/default.nix

@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "kexec-tools-${version}";
-  version = "2.0.15";
+  version = "2.0.16";
 
   src = fetchurl {
     urls = [
       "mirror://kernel/linux/utils/kernel/kexec/${name}.tar.xz"
       "http://horms.net/projects/kexec/kexec-tools/${name}.tar.xz"
     ];
-    sha256 = "1rwl04y1mpb28yq5ynnk8j124dmhj5p8c4hcdn453sri2j37p6w9";
+    sha256 = "043hasx5b9zk7r7dzx24z5wybg74dpmh0nyns6nrnb3mmm8k642v";
   };
 
   hardeningDisable = [ "format" "pic" "relro" ];

pkgs/os-specific/linux/lm-sensors/default.nix

@@ -1,9 +1,14 @@
-{ stdenv, fetchurl, bison, flex, which, perl }:
+{ sensord ? false,
+  stdenv, fetchurl, bison, flex, which, perl,
+  rrdtool ? null
+}:
+
+assert sensord -> rrdtool != null;
 
 stdenv.mkDerivation rec {
   name = "lm-sensors-${version}";
   version = "3.4.0"; # don't forget to tweak fedoraproject mirror URL hash
-  
+
   src = fetchurl {
     urls = [
       "http://dl.lm-sensors.org/lm-sensors/releases/lm_sensors-${version}.tar.bz2"
@@ -12,10 +17,12 @@ stdenv.mkDerivation rec {
     sha256 = "07q6811l4pp0f7pxr8bk3s97ippb84mx5qdg7v92s9hs10b90mz0";
   };
 
-  buildInputs = [ bison flex which perl ];
+  buildInputs = [ bison flex which perl ]
+   ++ stdenv.lib.optional sensord rrdtool;
 
   preBuild = ''
-    makeFlagsArray=(PREFIX=$out ETCDIR=$out/etc)
+    makeFlagsArray=(PREFIX=$out ETCDIR=$out/etc
+    ${stdenv.lib.optionalString sensord "PROG_EXTRA=sensord"})
   '';
 
   meta = {

pkgs/os-specific/linux/lvm2/default.nix

@@ -20,7 +20,11 @@ stdenv.mkDerivation {
     "--enable-pkgconfig"
     "--enable-applib"
     "--enable-cmdlib"
-  ] ++ stdenv.lib.optional enable_dmeventd " --enable-dmeventd";
+  ] ++ stdenv.lib.optional enable_dmeventd " --enable-dmeventd"
+  ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+  ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libudev libuuid thin-provisioning-tools ];

pkgs/os-specific/linux/pam/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "linux-pam-${version}";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchurl {
     url = "http://www.linux-pam.org/library/Linux-PAM-${version}.tar.bz2";
-    sha256 = "1n9lnf9gjs72kbj1g354v1xhi2j27aqaah15vykh7cnkq08i4arl";
+    sha256 = "1fyi04d5nsh8ivd0rn2y0z83ylgc0licz7kifbb6xxi2ylgfs6i4";
   };
 
   outputs = [ "out" "doc" "man" /* "modules" */ ];

pkgs/servers/web-apps/wordpress/default.nix

@@ -2,8 +2,8 @@
 { fetchFromGitHub, lib } : fetchFromGitHub {
   owner = "WordPress";
   repo = "WordPress";
-  rev = "4.9";
+  rev = "4.9.1";
-  sha256 = "1qffh413k8c1mf3jj9hys3a7y1qfjcg2w96w4c9x3ida3lchg7ln";
+  sha256 = "0d931mv6wbgnc7f15nisnn5al0ffi19zya2iwdzw98s4klpaq955";
   meta = {
     homepage = https://wordpress.org;
     description = "WordPress is open source software you can use to create a beautiful website, blog, or app.";

pkgs/tools/security/signing-party/default.nix

@@ -12,15 +12,14 @@ let
     GnuPGInterface ListMoreUtils ModuleRuntime Moo MooXHandlesVia MooXlate
     RoleTiny SubExporterProgressive SubQuote TypeTiny XSLoader
   ];
-in
+in stdenv.mkDerivation rec {
-stdenv.mkDerivation rec {
   pname = "signing-party";
-  version = "2.5";
+  version = "2.6";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/s/${pname}/${pname}_${version}.orig.tar.gz";
-    sha256 = "1y2bxk01qiwaqaily0s6zi10ssv7l35vksib6fxzyl76pp693nv2";
+    sha256 = "1n5bpcfpl9vg1xp6r1jhbyahrgdyxp05b5pria1rh4m0qnv8sifr";
   };
 
   sourceRoot = ".";

pkgs/top-level/all-packages.nix

@@ -12515,7 +12515,6 @@ with pkgs;
   linux_hardened_copperhead = callPackage ../os-specific/linux/kernel/linux-hardened-copperhead.nix {
     kernelPatches = with kernelPatches; [
       kernelPatches.bridge_stp_helper
-      kernelPatches.p9_fixes
       kernelPatches.modinst_arg_list_too_long
       kernelPatches.cpu-cgroup-v2."4.11"
       kernelPatches.tag_hardened