Merge branch 'staging' (older one)

Hydra seems OK-ish, except that some aarch64 jobs need restarting
after qt4 timing out for the first time:
https://hydra.nixos.org/eval/1412641?compare=1412561

pkgs/os-specific/darwin/apple-sdk/default.nix

@@ -198,6 +198,22 @@ in rec {
   };
 
   overrides = super: {
+    AppKit = stdenv.lib.overrideDerivation super.AppKit (drv: {
+      __propagatedImpureHostDeps = drv.__propagatedImpureHostDeps ++ [
+        "/System/Library/PrivateFrameworks/"
+      ];
+    });
+
+    CoreMedia = stdenv.lib.overrideDerivation super.CoreMedia (drv: {
+      __propagatedImpureHostDeps = drv.__propagatedImpureHostDeps ++ [
+        "/System/Library/Frameworks/CoreImage.framework"
+      ];
+    });
+
+    Security = stdenv.lib.overrideDerivation super.Security (drv: {
+      setupHook = ./security-setup-hook.sh;
+    });
+
     QuartzCore = stdenv.lib.overrideDerivation super.QuartzCore (drv: {
       installPhase = drv.installPhase + ''
         f="$out/Library/Frameworks/QuartzCore.framework/Headers/CoreImage.h"
@@ -205,16 +221,6 @@ in rec {
           --replace "QuartzCore/../Frameworks/CoreImage.framework/Headers" "CoreImage"
       '';
     });
-
-    CoreServices = stdenv.lib.overrideDerivation super.CoreServices (drv: {
-      __propagatedSandboxProfile = drv.__propagatedSandboxProfile ++ [''
-        (allow mach-lookup (global-name "com.apple.CoreServices.coreservicesd"))
-      ''];
-    });
-
-    Security = stdenv.lib.overrideDerivation super.Security (drv: {
-      setupHook = ./security-setup-hook.sh;
-    });
   };
 
   bareFrameworks = stdenv.lib.mapAttrs framework (import ./frameworks.nix {

pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix

@@ -1,24 +1,22 @@
 { stdenv, appleDerivation }:
 
 appleDerivation {
-  postUnpack = ''
-    substituteInPlace $sourceRoot/Makefile \
-      --replace "/usr/lib" "/lib" \
-      --replace "/usr/local/lib" "/lib" \
-      --replace "/usr/bin" "" \
-      --replace "/bin/" "" \
+  prePatch = ''
+    substituteInPlace Makefile \
+      --replace /usr/lib /lib \
+      --replace /usr/local/lib /lib \
+      --replace /usr/bin "" \
+      --replace /bin/ "" \
       --replace "CC = " "CC = cc #" \
-      --replace "SDK_DIR = " "SDK_DIR = . #"
+      --replace "SDK_DIR = " "SDK_DIR = . #" \
+
+    # Mac OS didn't support rpaths back before 10.5, but we don't care about it.
+    substituteInPlace Makefile \
+      --replace -mmacosx-version-min=10.4 -mmacosx-version-min=10.6 \
+      --replace -mmacosx-version-min=10.5 -mmacosx-version-min=10.6
   '';
 
-  # Mac OS didn't support rpaths back before 10.5, and this package intentionally builds stubs targeting versions prior to that
-  NIX_DONT_SET_RPATH = "1";
-  NIX_NO_SELF_RPATH  = "1";
-
-  installPhase = ''
-    export DSTROOT=$out
-    make install
-  '';
+  installFlags = [ "DSTROOT=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "Apple's common startup stubs for darwin";

pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix

@@ -23,7 +23,7 @@ appleDerivation rec {
       (cd $dep/include && find . -name '*.h' | cpio -pdm $out/include)
     done
 
-    (cd ${cctools}/include/mach-o && find . -name '*.h' | cpio -pdm $out/include/mach-o)
+    (cd ${cctools.dev}/include/mach-o && find . -name '*.h' | cpio -pdm $out/include/mach-o)
 
     cat <<EOF > $out/include/TargetConditionals.h
     #ifndef __TARGETCONDITIONALS__

pkgs/os-specific/darwin/apple-source-releases/configd/default.nix

@@ -8,10 +8,6 @@ appleDerivation {
 
   propagatedBuildInputs = [ Security ];
 
-  propagatedSandboxProfile = ''
-    (allow mach-lookup (global-name "com.apple.SystemConfiguration.configd"))
-  '';
-
   patchPhase = ''
     HACK=$PWD/hack
     mkdir $HACK

pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix

@@ -1,9 +1,9 @@
-{ stdenv, appleDerivation, fetchzip, bootstrap_cmds, bison, flex, gnum4, unifdef, perl }:
+{ stdenv, appleDerivation, fetchzip, bootstrap_cmds, bison, flex, gnum4, unifdef, perl, python }:
 
 appleDerivation {
   phases = [ "unpackPhase" "patchPhase" "installPhase" ];
 
-  buildInputs = [ bootstrap_cmds bison flex gnum4 unifdef perl ];
+  buildInputs = [ bootstrap_cmds bison flex gnum4 unifdef perl python ];
 
   patchPhase = ''
     substituteInPlace Makefile \

pkgs/os-specific/darwin/binutils/default.nix

@@ -37,17 +37,8 @@ stdenv.mkDerivation {
       ln -sf "${cctools}/bin/$i" "$out/bin/$i"
     done
 
-    for i in ${stdenv.lib.getDev binutils-raw}/include/*.h; do
-      ln -s "$i" "$out/include/$(basename $i)"
-    done
-
-    for i in ${cctools}/include/*; do
-      ln -s "$i" "$out/include/$(basename $i)"
-    done
-
     # FIXME: this will give us incorrect man pages for bits of cctools
     ln -s ${binutils-raw.out}/share $out/share
-    ln -s ${binutils-raw.out}/lib $out/lib
 
     ln -s ${cctools}/libexec $out/libexec
   '';

pkgs/os-specific/darwin/cctools/port.nix

@@ -29,6 +29,8 @@ let
       sha256 = "0l45mvyags56jfi24rawms8j2ihbc45mq7v13pkrrwppghqrdn52";
     };
 
+    outputs = [ "out" "dev" ];
+
     nativeBuildInputs = [ autoconf automake libtool_2 ];
     buildInputs = [ libuuid ] ++
       # Only need llvm and clang if the stdenv isn't already clang-based (TODO: just make a stdenv.cc.isClang)
@@ -39,6 +41,12 @@ let
       ./ld-rpath-nonfinal.patch ./ld-ignore-rpath-link.patch
     ];
 
+    __propagatedImpureHostDeps = [
+      # As far as I can tell, otool from cctools is the only thing that depends on these two, and we should fix them
+      "/usr/lib/libobjc.A.dylib"
+      "/usr/lib/libobjc.dylib"
+    ];
+
     enableParallelBuilding = true;
 
     # TODO(@Ericson2314): Always pass "--target" and always prefix.

pkgs/os-specific/linux/alsa-lib/default.nix

@@ -1,14 +1,14 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "alsa-lib-1.1.4.1";
+  name = "alsa-lib-1.1.5";
 
   src = fetchurl {
     urls = [
      "ftp://ftp.alsa-project.org/pub/lib/${name}.tar.bz2"
      "http://alsa.cybermirror.org/lib/${name}.tar.bz2"
     ];
-    sha256 = "0xjvi381105gldhv0z872a0x58sghznyx19j45lw5iyi2h68gfwi";
+    sha256 = "1rhacnlj0grvfagjx5qzsnbhw7m7lyccghqs4jsv0dnsqv9qmxpl";
   };
 
   patches = [

pkgs/os-specific/linux/alsa-plugins/default.nix

@@ -1,14 +1,14 @@
 { stdenv, fetchurl, lib, pkgconfig, alsaLib, libogg, libpulseaudio ? null, libjack2 ? null }:
 
 stdenv.mkDerivation rec {
-  name = "alsa-plugins-1.1.4";
+  name = "alsa-plugins-1.1.5";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.alsa-project.org/pub/plugins/${name}.tar.bz2"
       "http://alsa.cybermirror.org/plugins/${name}.tar.bz2"
     ];
-    sha256 = "12hsvm6rpinjkg06pa9hzndkdrbfw6wk6yk00cm8y1gbv8xiq3ak";
+    sha256 = "073zpgvj4pldmzqq97l40wngvbqnvrkc8yw153mgny9kypwaazbr";
   };
 
   # ToDo: a52, etc.?

pkgs/os-specific/linux/alsa-tools/default.nix

@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   name = "alsa-tools-${version}";
-  version = "1.1.3";
+  version = "1.1.5";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.alsa-project.org/pub/tools/${name}.tar.bz2"
       "http://alsa.cybermirror.org/tools/${name}.tar.bz2"
     ];
-    sha256 = "02b75fyfmm9m2iz59d3xa97cas4f697a4pzdxn1i64kjd36iv3yq";
+    sha256 = "0d6m5dm5yskfr6q42cv1ihp5lfgv4a67nj39gpp26ll3vrknag5w";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/os-specific/linux/alsa-utils/default.nix

@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "alsa-utils-${version}";
-  version = "1.1.4";
+  version = "1.1.5";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.alsa-project.org/pub/utils/${name}.tar.bz2"
       "http://alsa.cybermirror.org/utils/${name}.tar.bz2"
     ];
-    sha256 = "17cxih9ibjp1193dyd79j50pyfa9dvrs6r9kpwrvzicjvr2110x7";
+    sha256 = "1s727md6mb408y2cfwzjkx23abxhampyrjdkgpyygdhxx62x42rj";
   };
 
   patchPhase = ''

pkgs/os-specific/linux/iproute/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "iproute2-${version}";
-  version = "4.13.0";
+  version = "4.14.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/iproute2/${name}.tar.xz";
-    sha256 = "0l2w84cwr54gaw3cbxijf614l76hx8mgcz57v81rwl68z3nq3yww";
+    sha256 = "0rq0n7yxb0hmk0s6wx5awzjgf7ikjbibd0a5ix20ldfcmxlc0fnl";
   };
 
   preConfigure = ''

pkgs/os-specific/linux/lvm2/default.nix

@@ -2,7 +2,7 @@
 , thin-provisioning-tools, enable_dmeventd ? false }:
 
 let
-  version = "2.02.175";
+  version = "2.02.176";
 in
 
 stdenv.mkDerivation {
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "ftp://sources.redhat.com/pub/lvm2/releases/LVM2.${version}.tgz";
-    sha256 = "0n95cc2b0jb0fh2pd9jyg9ww7lyzpia9n9sryw9f4aq8dpna7dsd";
+    sha256 = "0wx4rvy4frdmb66znh2xms2j2n06sm361ki6l5ks4y1ciii87kny";
   };
 
   configureFlags = [