Merge branch 'staging'

There's a security fix for curl inside.
2017-02-22 18:21:58 +01:00 · 2017-02-22 18:21:58 +01:00 · 838e29d236
commit 838e29d236
parent b66ec6026c ebf782829a
38 changed files with 153 additions and 87 deletions
--- a/pkgs/applications/graphics/solvespace/default.nix
+++ b/pkgs/applications/graphics/solvespace/default.nix
@ -9,6 +9,12 @@ stdenv.mkDerivation {
    rev = "e587d0e";
  };

+  # Fixup build after glibc-2.25.
+  postPatch = ''
+    sed 's/\<CHAR_WIDTH\>/CHARWIDTH/g' \
+      -i src/{fltk/fltkmain.cpp,glhelper.cpp,textwin.cpp,toolbar.cpp,ui.h}
+  '';
+
  # e587d0e fails with undefined reference errors if make is called
  # twice. Ugly workaround: Build while installing.
  dontBuild = true;
--- a/pkgs/applications/networking/instant-messengers/ekiga/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ekiga/default.nix
@ -45,6 +45,7 @@ stdenv.mkDerivation rec {
    description = "VOIP/Videoconferencing app with full SIP and H.323 support";
    maintainers = [ maintainers.raskin ];
    platforms = platforms.linux;
+    broken = true; # because of glibc-2.25
  };

  passthru = {
--- a/pkgs/applications/virtualization/open-vm-tools/default.nix
+++ b/pkgs/applications/virtualization/open-vm-tools/default.nix
@ -33,6 +33,9 @@ stdenv.mkDerivation rec {
     sed -i 's,etc/vmware-tools,''${prefix}/etc/vmware-tools,' services/vmtoolsd/Makefile.am
     sed -i 's,$(PAM_PREFIX),''${prefix}/$(PAM_PREFIX),' services/vmtoolsd/Makefile.am
     sed -i 's,$(UDEVRULESDIR),''${prefix}/$(UDEVRULESDIR),' udev/Makefile.am
+
+     # Avoid a glibc >= 2.25 deprecation warning that gets fatal via -Werror.
+     sed 1i'#include <sys/sysmacros.h>' -i lib/wiper/wiperPosix.c
  '';

  configureFlags = [ "--without-kernel-modules" "--without-xmlsecurity" ]
--- a/pkgs/applications/virtualization/xen/generic.nix
+++ b/pkgs/applications/virtualization/xen/generic.nix
@ -74,6 +74,11 @@ stdenv.mkDerivation {
      ${flip concatMapStrings xenExtfiles (x: let src = fetchurl x; in ''
        cp ${src} xen_ext_files/${src.name}
      '')}
+
+      # Avoid a glibc >= 2.25 deprecation warnings that get fatal via -Werror.
+      sed 1i'#include <sys/sysmacros.h>' \
+        -i tools/blktap2/control/tap-ctl-allocate.c \
+        -i tools/libxl/libxl_device.c
  '';

  preConfigure = ''
--- a/pkgs/development/compilers/dmd/2.067.1.nix
+++ b/pkgs/development/compilers/dmd/2.067.1.nix
@ -19,7 +19,11 @@ stdenv.mkDerivation {
      # Was not able to compile on darwin due to "__inline_isnanl"
      # being undefined.
      substituteInPlace src/dmd/root/port.c --replace __inline_isnanl __inline_isnan
-  '';
+  ''
+    + stdenv.lib.optionalString stdenv.isLinux ''
+        substituteInPlace src/dmd/root/port.c \
+          --replace "#include <bits/mathdef.h>" "#include <complex.h>"
+      '';

  # Buid and install are based on http://wiki.dlang.org/Building_DMD
  buildPhase = ''
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@ -66,6 +66,8 @@ let
      # libuuid, slowing down program startup a lot).
      ./no-ldconfig.patch

+      ./glibc-2.25-enosys.patch
+
    ] ++ optionals stdenv.isCygwin [
      ./2.5.2-ctypes-util-find_library.patch
      ./2.5.2-tkinter-x11.patch
--- a/pkgs/development/interpreters/python/cpython/2.7/glibc-2.25-enosys.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/glibc-2.25-enosys.patch
@ -0,0 +1,15 @@
+https://bugs.python.org/issue29157
+https://github.com/python/cpython/commit/01bdbad3e951
+diff --git a/Python/random.c b/Python/random.c
+index 2f83b5d..0b775ec 100644
+--- a/Python/random.c
+++ b/Python/random.c
+@@ -98,7 +98,7 @@ win32_urandom(unsigned char *buffer, Py_ssize_t size, int raise)
+ 
+ /* Issue #25003: Don't use getentropy() on Solaris (available since
+  * Solaris 11.3), it is blocking whereas os.urandom() should not block. */
+-#elif defined(HAVE_GETENTROPY) && !defined(sun)
+#elif defined(HAVE_GETENTROPY) && !defined(sun) && !defined(linux)
+ #define PY_GETENTROPY 1
+ 
+ /* Fill buffer with size pseudo-random bytes generated by getentropy().
--- a/pkgs/development/interpreters/python/cpython/3.4/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.4/default.nix
@ -57,7 +57,14 @@ in stdenv.mkDerivation {

  postPatch = optionalString (x11Support && (tix != null)) ''
    substituteInPlace "Lib/tkinter/tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
-  '';
+  ''
+    # Avoid picking up getentropy() from glibc >= 2.25, as that would break
+    # on older kernels.  http://bugs.python.org/issue29157
+    + optionalString stdenv.isLinux
+      ''
+        substituteInPlace Python/random.c --replace 'defined(HAVE_GETENTROPY)' '0'
+        cat Python/random.c
+      '';

  preConfigure = ''
    for i in /usr /sw /opt /pkg; do	# improve purity
--- a/pkgs/development/interpreters/python/cpython/3.5/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.5/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl
+{ stdenv, fetchurl, fetchpatch
 , bzip2
 , gdbm
 , lzma
@ -55,6 +55,14 @@ in stdenv.mkDerivation {
    substituteInPlace configure --replace '-Wl,-stack_size,1000000' ' '
  '';

+  patches = [
+    (fetchpatch {
+      name = "glibc-2.25-enosys.patch";
+      url = https://github.com/python/cpython/commit/035ba5da3e53e.patch;
+      sha256 = "1y74ir1w5cq542w27rgzgp70chhq2x047db9911mihpab8p2nj71";
+    })
+  ];
+
  postPatch = optionalString (x11Support && (tix != null)) ''
    substituteInPlace "Lib/tkinter/tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
  '';
--- a/pkgs/development/interpreters/python/cpython/3.6/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.6/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl
+{ stdenv, fetchurl, fetchpatch
 , glibc
 , bzip2
 , gdbm
@ -55,6 +55,14 @@ in stdenv.mkDerivation {
    substituteInPlace configure --replace '-Wl,-stack_size,1000000' ' '
  '';

+  patches = [
+    (fetchpatch {
+      name = "glibc-2.25-failed-to-get-random-numbers.patch";
+      url = https://github.com/python/cpython/commit/ff558f5aba4.patch;
+      sha256 = "1k12gpn69np94cm942vaf40sv7gsxqf20rv1m3parzgi1gs4hqa3";
+    })
+  ];
+
  postPatch = optionalString (x11Support && (tix != null)) ''
    substituteInPlace "Lib/tkinter/tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
  '';
--- a/pkgs/development/interpreters/python/wrap.sh
+++ b/pkgs/development/interpreters/python/wrap.sh
@ -47,7 +47,7 @@ wrapPythonProgramsIn() {
    buildPythonPath "$pythonPath"

    # Find all regular files in the output directory that are executable.
-    for f in $(find "$dir" -type f -perm -0100); do
+    find "$dir" -type f -perm -0100 -print0 | while read -d "" f; do
        # Rewrite "#! .../env python" to "#! /nix/store/.../python".
        # Strip suffix, like "3" or "2.7m" -- we don't have any choice on which
        # Python to use besides one with this hook anyway.
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@ -6,8 +6,8 @@ assert x11Support -> libX11 != null
                  && libSM != null;

 let
-  version = "1.10.14";
-  sha256 = "10x0wvv2ly4lyyfd42k4xw0ar5qdbi9cksw3l5fcwf1y6mq8y8r3";
+  version = "1.10.16";
+  sha256 = "121kqkjsd3vgf8vca8364xl44qa5086h7qy5zs5f1l78ldpbmc57";

 self = stdenv.mkDerivation {
    name = "dbus-${version}";
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@ -28,7 +28,17 @@ stdenv.mkDerivation rec {
      src = ./config-compat.patch;
      inherit configVersion;
    })
+    (fetchpatch {
+      name = "glibc-2.25.diff";
+      url = "https://cgit.freedesktop.org/fontconfig/patch/?id=1ab5258f7c";
+      sha256 = "0x2a4qx51j3gqcp1kp4lisdzmhrkw1zw0r851d82ksgjlc0vkbaz";
+    })
  ];
+  # additionally required for the glibc-2.25 patch; avoid requiring gperf
+  postPatch = ''
+    sed s/CHAR_WIDTH/CHARWIDTH/g -i src/fcobjshash.{h,gperf}
+    touch src/*
+  '';

  outputs = [ "bin" "dev" "lib" "out" ]; # $out contains all the config

--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@ -3,14 +3,14 @@

 let
  ver_maj = "2.36";
-  ver_min = "4";
+  ver_min = "5";
 in
 stdenv.mkDerivation rec {
  name = "gdk-pixbuf-${ver_maj}.${ver_min}";

  src = fetchurl {
    url = "mirror://gnome/sources/gdk-pixbuf/${ver_maj}/${name}.tar.xz";
-    sha256 = "0b19901c3eb0596141d2d48ddb9dac79ad1524bdf59366af58ab38fcb9ee7463";
+    sha256 = "7ace06170291a1f21771552768bace072ecdea9bd4a02f7658939b9a314c40fc";
  };

  outputs = [ "out" "dev" "devdoc" ];
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@ -43,7 +43,7 @@ let
  '';

  ver_maj = "2.50";
-  ver_min = "2";
+  ver_min = "3";
 in

 stdenv.mkDerivation rec {
@ -51,7 +51,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://gnome/sources/glib/${ver_maj}/${name}.tar.xz";
-    sha256 = "be68737c1f268c05493e503b3b654d2b7f43d7d0b8c5556f7e4651b870acfbf5";
+    sha256 = "82ee94bf4c01459b6b00cb9db0545c2237921e3060c0b74cff13fbc020cfd999";
  };

  patches = optional stdenv.isDarwin ./darwin-compilation.patch ++ optional doCheck ./skip-timer-test.patch;
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@ -10,8 +10,8 @@ cross:
 , preConfigure ? "", ... }@args:

 let
-  version = "2.24";
-  sha256 = "1ghzp41ryvsqxn4rhrm8r25wc33m2jf8zrcc1pj3jxyk8ad9a0by";
+  version = "2.25";
+  sha256 = "067bd9bb3390e79aa45911537d13c3721f1d9d3769931a30c2681bfee66f23a0";
 in

 assert cross != null -> gccCross != null;
@ -138,7 +138,7 @@ stdenv.mkDerivation ({
    lib.optionalString (cross != null) "-${cross.config}";

  src = fetchurl {
-    url = "mirror://gnu/glibc/glibc-${version}.tar.gz";
+    url = "mirror://gnu/glibc/glibc-${version}.tar.xz";
    inherit sha256;
  };

--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@ -81,7 +81,7 @@ in
      # to bootstrap-tools; on cross-arm this stripping would break objects.
      if [ -z "$crossConfig" ]; then
        for i in "$out"/lib/*.a; do
-            strip -S "$i"
+            [ "$i" = "$out/lib/libm.a" ] || strip -S "$i"
        done
      fi

@ -91,6 +91,9 @@ in
      mkdir -p $static/lib
      mv $out/lib/*.a $static/lib
      mv $static/lib/lib*_nonshared.a $out/lib
+      # Some of *.a files are linker scripts where moving broke the paths.
+      sed "/^GROUP/s|$out/lib/lib|$static/lib/lib|g" \
+        -i "$static"/lib/*.a

      # Work around a Nix bug: hard links across outputs cause a build failure.
      cp $bin/bin/getconf $bin/bin/getconf_
--- a/pkgs/development/libraries/gnutls/3.4.nix
+++ b/pkgs/development/libraries/gnutls/3.4.nix
@ -1,10 +0,0 @@
-{ callPackage, fetchurl, ... } @ args:
-
-callPackage ./generic.nix (args // rec {
-  version = "3.4.17";
-
-  src = fetchurl {
-    url = "ftp://ftp.gnutls.org/gcrypt/gnutls/v3.4/gnutls-${version}.tar.xz";
-    sha256 = "0bhp8cqrmw15yins65cn0zwbcpj1vmymr4wnbm151sfmf2kfhl4v";
-  };
-})
--- a/pkgs/development/libraries/gnutls/3.5.nix
+++ b/pkgs/development/libraries/gnutls/3.5.nix
@ -7,6 +7,4 @@ callPackage ./generic.nix (args // rec {
    url = "ftp://ftp.gnutls.org/gcrypt/gnutls/v3.5/gnutls-${version}.tar.xz";
    sha256 = "0l9971841jsfdcvcyhas17sk5rsby6x5vvwcmmj4x3zi9q60zcc2";
  };
-
-  buildInputs = [ libunistring ];
 })
--- a/pkgs/development/libraries/gnutls/generic.nix
+++ b/pkgs/development/libraries/gnutls/generic.nix
@ -1,6 +1,6 @@
 { lib, fetchurl, stdenv, zlib, lzo, libtasn1, nettle, pkgconfig, lzip
 , guileBindings, guile, perl, gmp, autogen, libidn, p11_kit, unbound, libiconv
-, tpmSupport ? false, trousers, nettools, bash
+, tpmSupport ? false, trousers, nettools, libunistring

 # Version dependent args
 , version, src, patches ? [], postPatch ? "", nativeBuildInputs ? []
@ -37,7 +37,7 @@ stdenv.mkDerivation {

  enableParallelBuilding = true;

-  buildInputs = [ lzo lzip libtasn1 libidn p11_kit zlib gmp autogen ]
+  buildInputs = [ lzo lzip libtasn1 libidn p11_kit zlib gmp autogen libunistring ]
    ++ lib.optional doCheck nettools
    ++ lib.optional (stdenv.isFreeBSD || stdenv.isDarwin) libiconv
    ++ lib.optional (tpmSupport && stdenv.isLinux) trousers
@ -58,6 +58,10 @@ stdenv.mkDerivation {
        -e 's,-L${gmp.dev}/lib,-L${gmp.out}/lib,' \
        -e 's,-lgmp,-L${gmp.out}/lib -lgmp,' \
        -i $out/lib/*.la "$dev/lib/pkgconfig/gnutls.pc"
+  '' + ''
+    # It seems only useful for static linking but basically noone does that.
+    substituteInPlace "$out/lib/libgnutls.la" \
+      --replace "-lunistring" ""
  '';

  meta = with lib; {
--- a/pkgs/development/libraries/gtk+/3.x.nix
+++ b/pkgs/development/libraries/gtk+/3.x.nix
@ -13,7 +13,7 @@ with stdenv.lib;

 let
  ver_maj = "3.22";
-  ver_min = "7";
+  ver_min = "8";
  version = "${ver_maj}.${ver_min}";
 in
 stdenv.mkDerivation rec {
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://gnome/sources/gtk+/${ver_maj}/gtk+-${version}.tar.xz";
-    sha256 = "a3a27564bfb1679ebbc75c37cd2bcd6e727c8bdfbcd3984d29305bf9ee60d432";
+    sha256 = "c7254a88df5c17e9609cee9e848c3d0104512707edad4c3b4f256b131f8d3af1";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/libunistring/default.nix
+++ b/pkgs/development/libraries/libunistring/default.nix
@ -10,6 +10,8 @@ stdenv.mkDerivation rec {

  patches = stdenv.lib.optional stdenv.isDarwin [ ./clang.patch ];

+  outputs = [ "out" "dev" "info" "doc" ];
+
  propagatedBuildInputs = stdenv.lib.optional (!stdenv.isLinux) libiconv;

  configureFlags = [
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@ -2,14 +2,14 @@
 , ApplicationServices, CoreServices }:

 stdenv.mkDerivation rec {
-  version = "1.10.1";
+  version = "1.11.0";
  name = "libuv-${version}";

  src = fetchFromGitHub {
    owner = "libuv";
    repo = "libuv";
    rev = "v${version}";
-    sha256 = "0gna53fgsjjs38kv1g20xfaalv0fk3xncb6abga3saswrv283hx0";
+    sha256 = "02sm7f3l0shpfz25b77q2jjvlypc1mmz4zpzfgfmiplhgxxaa6la";
  };

  postPatch = let
@ -23,8 +23,8 @@ stdenv.mkDerivation rec {
      sed '/${tdRegexp}/d' -i test/test-list.h
    '';

-  buildInputs = [ automake autoconf libtool pkgconfig ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ ApplicationServices CoreServices ];
+  nativeBuildInputs = [ automake autoconf libtool pkgconfig ];
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ ApplicationServices CoreServices ];

  preConfigure = ''
    LIBTOOLIZE=libtoolize ./autogen.sh
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@ -27,7 +27,7 @@ if ! lists.elem stdenv.system platforms.mesaPlatforms then
 else

 let
-  version = "13.0.4";
+  version = "13.0.5";
  branch  = head (splitString "." version);
  driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32";
 in
@ -41,7 +41,7 @@ stdenv.mkDerivation {
      "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
      "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz"
    ];
-    sha256 = "a95d7ce8f7bd5f88585e4be3144a341236d8c0fc91f6feaec59bb8ba3120e726";
+    sha256 = "bfcea7e2c801525a60895c8aff11aa68457ee9aa35d01a4638e1f310a3f5ef87";
  };

  prePatch = "patchShebangs .";
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@ -13,7 +13,7 @@ with stdenv.lib;
 let
  os = stdenv.lib.optionalString;
  majorVersion = "3.7";
-  minorVersion = "1";
+  minorVersion = "2";
  version = "${majorVersion}.${minorVersion}";
 in

@ -24,8 +24,8 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "${meta.homepage}files/v${majorVersion}/cmake-${version}.tar.gz";
-    # from https://cmake.org/files/v3.7/cmake-3.7.1-SHA-256.txt
-    sha256 = "449a5bce64dbd4d5b9517ebd1a1248ed197add6ad27934478976fd5f1f9330e1";
+    # from https://cmake.org/files/v3.7/cmake-3.7.2-SHA-256.txt
+    sha256 = "dc1246c4e6d168ea4d6e042cfba577c1acd65feea27e56f5ff37df920c30cae0";
  };

  prePatch = optionalString (!useSharedLibraries) ''
--- a/pkgs/development/tools/xcbuild/default.nix
+++ b/pkgs/development/tools/xcbuild/default.nix
@ -31,6 +31,12 @@ in stdenv.mkDerivation rec {
    cp -r --no-preserve=all ${linenoise} ThirdParty/linenoise
  '';

+  # Avoid a glibc >= 2.25 deprecation warning that gets fatal via -Werror.
+  postPatch = ''
+    sed 1i'#include <sys/sysmacros.h>' \
+      -i Libraries/xcassets/Headers/xcassets/Slot/SystemVersion.h
+  '';
+
  enableParallelBuilding = true;

  # TODO: instruct cmake not to put it in /usr, rather than cleaning up
--- a/pkgs/misc/emulators/dolphin-emu/default.nix
+++ b/pkgs/misc/emulators/dolphin-emu/default.nix
@ -14,6 +14,11 @@ stdenv.mkDerivation rec {
    sha256 = "07mlfnh0hwvk6xarcg315x7z2j0qbg9g7cm040df9c8psiahc3g6";
  };

+  postPatch = ''
+    substituteInPlace Source/Core/VideoBackends/OGL/RasterFont.cpp \
+      --replace " CHAR_WIDTH " " CHARWIDTH "
+  '';
+
  cmakeFlags = ''
    -DGTK2_GLIBCONFIG_INCLUDE_DIR=${glib.out}/lib/glib-2.0/include
    -DGTK2_GDKCONFIG_INCLUDE_DIR=${gtk2.out}/lib/gtk-2.0/include
--- a/pkgs/misc/emulators/dolphin-emu/master.nix
+++ b/pkgs/misc/emulators/dolphin-emu/master.nix
@ -12,6 +12,12 @@ stdenv.mkDerivation rec {
    fetchSubmodules = false;
  };

+  postPatch = ''
+    for f in Source/Core/VideoBackends/{Software,OGL}/RasterFont.{h,cpp}; do
+      substituteInPlace "$f" --replace " CHAR_WIDTH " " CHARWIDTH "
+    done
+  '';
+
  cmakeFlags = ''
    -DGTK2_GLIBCONFIG_INCLUDE_DIR=${glib.out}/lib/glib-2.0/include
    -DGTK2_GDKCONFIG_INCLUDE_DIR=${gtk2.out}/lib/gtk-2.0/include
--- a/pkgs/os-specific/linux/criu/default.nix
+++ b/pkgs/os-specific/linux/criu/default.nix
@ -22,6 +22,9 @@ stdenv.mkDerivation rec {
    substituteInPlace ./criu/Makefile --replace "-I/usr/include/libnl3" "-I${libnl.dev}/include/libnl3"
    substituteInPlace ./Makefile --replace "tar-name := $(shell git tag -l v$(CRIU_VERSION))" "tar-name = 2.0" # --replace "-Werror" ""
    ln -sf ${protobuf}/include/google/protobuf/descriptor.proto ./images/google/protobuf/descriptor.proto
+
+    # Avoid a glibc >= 2.25 deprecation warning that gets fatal via -Werror.
+    sed 1i'#include <sys/sysmacros.h>' -i criu/include/util.h
  '';

  buildPhase = "make PREFIX=$out";
--- a/pkgs/os-specific/linux/fatrace/default.nix
+++ b/pkgs/os-specific/linux/fatrace/default.nix
@ -14,6 +14,9 @@ stdenv.mkDerivation rec {
  postPatch = ''
    substituteInPlace power-usage-report \
      --replace "'which'" "'${which}/bin/which'"
+
+    # Avoid a glibc >= 2.25 deprecation warning that gets fatal via -Werror.
+    sed 1i'#include <sys/sysmacros.h>' -i fatrace.c
  '';

  makeFlags = [ "PREFIX=$(out)" ];
--- a/pkgs/os-specific/linux/reptyr/default.nix
+++ b/pkgs/os-specific/linux/reptyr/default.nix
@ -7,6 +7,12 @@ stdenv.mkDerivation rec {
    url = "https://github.com/nelhage/reptyr/archive/reptyr-${version}.tar.gz";
    sha256 = "07pfl0rkgm8m3f3jy8r9l2yvnhf8lgllpsk3mh57mhzdxq8fagf7";
  };
+
+  # Avoid a glibc >= 2.25 deprecation warning that gets fatal via -Werror.
+  postPatch = ''
+    sed 1i'#include <sys/sysmacros.h>' -i platform/linux/linux.c
+  '';
+
  makeFlags = ["PREFIX=$(out)"];
  meta = {
    platforms = stdenv.lib.platforms.linux;
--- a/pkgs/tools/audio/gvolicon/default.nix
+++ b/pkgs/tools/audio/gvolicon/default.nix
@ -13,7 +13,9 @@ stdenv.mkDerivation {
    librsvg wrapGAppsHook
  ];

-  makeFlags="PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  NIX_CFLAGS_COMPILE = [ "-D_POSIX_C_SOURCE" ];

  meta = {
    description = "A simple and lightweight volume icon that sits in your system tray";
--- a/pkgs/tools/misc/findutils/default.nix
+++ b/pkgs/tools/misc/findutils/default.nix
@ -12,7 +12,8 @@ stdenv.mkDerivation rec {

  buildInputs = [ coreutils ]; # bin/updatedb script needs to call sort

-  doCheck = !stdenv.isDarwin;
+  # Since glibc-2.25 the i686 tests hang reliably right after test-sleep.
+  doCheck = !stdenv.isDarwin && (stdenv.system != "i686-linux");

  outputs = [ "out" "info" ];

--- a/pkgs/tools/networking/cjdns/default.nix
+++ b/pkgs/tools/networking/cjdns/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, nodejs, which, python27, utillinux }:
+{ stdenv, fetchurl, fetchpatch, nodejs, which, python27, utillinux }:

 let version = "18"; in
 stdenv.mkDerivation {
@ -9,6 +9,12 @@ stdenv.mkDerivation {
    sha256 = "1as7n730ppn93cpal7s6r6iq1qx46m0c45iwy8baypbpp42zxrap";
  };

+  patches = [(fetchpatch {
+    name = "glibc-2.25.diff";
+    url = https://github.com/cjdelisle/cjdns/pull/1017.diff;
+    sha256 = "1k05d1w04lngcki56b6brkwg9xakzsbr5ibkcba8112v6jdzw51f";
+  })];
+
  buildInputs = [ which python27 nodejs ] ++
    # for flock
    stdenv.lib.optional stdenv.isLinux utillinux;
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@ -21,14 +21,14 @@ assert scpSupport -> libssh2 != null;
 assert c-aresSupport -> c-ares != null;

 stdenv.mkDerivation rec {
-  name = "curl-7.52.1";
+  name = "curl-7.53.0";

  src = fetchurl {
    url = "http://curl.haxx.se/download/${name}.tar.bz2";
-    sha256 = "16rqhyzlpnivifin8n7l2fr9ihay9v2nw2drsniinb6bcykqaqfi";
+    sha256 = "008833dd9w4l2277q9r0bsq1vqmm0fr7qqyzvqlw5d47xy5mld5j";
  };

-  patches = [ ./issue-1174.patch ];
+  patches = [ ];

  outputs = [ "bin" "dev" "out" "man" "devdoc" ];

--- a/pkgs/tools/networking/curl/issue-1174.patch
+++ b/pkgs/tools/networking/curl/issue-1174.patch
@ -1,34 +0,0 @@
-commit a7b38c9dc98481e4a5fc37e51a8690337c674dfb
-Author: Daniel Stenberg <daniel@haxx.se>
-Date:   Mon Dec 26 00:06:33 2016 +0100
-
-    vtls: s/SSLEAY/OPENSSL
-    
-    Fixed an old leftover use of the USE_SSLEAY define which would make a
-    socket get removed from the applications sockets to monitor when the
-    multi_socket API was used, leading to timeouts.
-    
-    Bug: #1174
-
-diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
-index b808e1c..707f24b 100644
--- a/lib/vtls/vtls.c
-+++ b/lib/vtls/vtls.c
-@@ -484,7 +484,7 @@ void Curl_ssl_close_all(struct Curl_easy *data)
-   curlssl_close_all(data);
- }
- 
-#if defined(USE_SSLEAY) || defined(USE_GNUTLS) || defined(USE_SCHANNEL) || \
-+#if defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_SCHANNEL) || \
-     defined(USE_DARWINSSL) || defined(USE_NSS)
- /* This function is for OpenSSL, GnuTLS, darwinssl, and schannel only. */
- int Curl_ssl_getsock(struct connectdata *conn, curl_socket_t *socks,
-@@ -518,7 +518,7 @@ int Curl_ssl_getsock(struct connectdata *conn,
-   (void)numsocks;
-   return GETSOCK_BLANK;
- }
-/* USE_SSLEAY || USE_GNUTLS || USE_SCHANNEL || USE_DARWINSSL || USE_NSS */
-+/* USE_OPENSSL || USE_GNUTLS || USE_SCHANNEL || USE_DARWINSSL || USE_NSS */
- #endif
- 
- void Curl_ssl_close(struct connectdata *conn, int sockindex)
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -7549,11 +7549,7 @@ with pkgs;

  gnu-efi = callPackage ../development/libraries/gnu-efi { };

-  gnutls = gnutls34;
-
-  gnutls34 = callPackage ../development/libraries/gnutls/3.4.nix {
-    guileBindings = config.gnutls.guile or false;
-  };
+  gnutls = gnutls35;

  gnutls35 = callPackage ../development/libraries/gnutls/3.5.nix {
    guileBindings = config.gnutls.guile or false;
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -19926,12 +19926,12 @@ in {
  };

  pycurl = buildPythonPackage (rec {
-    name = "pycurl-7.19.5";
+    name = "pycurl-7.19.5.1";
    disabled = isPyPy; # https://github.com/pycurl/pycurl/issues/208

    src = pkgs.fetchurl {
      url = "http://pycurl.sourceforge.net/download/${name}.tar.gz";
-      sha256 = "0hqsap82zklhi5fxhc69kxrwzb0g9566f7sdpz7f9gyxkmyam839";
+      sha256 = "0v5w66ir3siimfzg3kc8hfrrilwwnbxq5bvipmrpyxar0kw715vf";
    };

    propagatedBuildInputs = with self; [ pkgs.curl pkgs.openssl.out ];