openexr,imlbase: 2.3.0 -> 2.4.1

pkgs/development/libraries/ilmbase/bootstrap.patch

@@ -1,15 +0,0 @@
-diff -ur openexr-v2.2.0-src-orig/IlmBase/bootstrap openexr-v2.2.0-src/IlmBase/bootstrap
---- IlmBase/bootstrap	2015-03-31 01:02:41.000000000 -0400
-+++ IlmBase/bootstrap	2015-03-31 01:03:35.000000000 -0400
-@@ -47,11 +47,6 @@
-     fi
- }
- 
--# Check if /usr/local/share/aclocal exists
--if [ -d /usr/local/share/aclocal ]; then
--	ACLOCAL_INCLUDE="$ACLOCAL_INCLUDE -I /usr/local/share/aclocal"
--fi	
--
- run_cmd aclocal -I m4 $ACLOCAL_INCLUDE
- run_cmd $LIBTOOLIZE --automake --copy
- run_cmd automake --add-missing --copy

pkgs/development/libraries/ilmbase/default.nix

@@ -1,14 +1,15 @@
-{ stdenv, fetchurl, buildPackages, automake, autoconf, libtool, which,
-  fetchpatch }:
+{ stdenv, lib, buildPackages, automake, autoconf, libtool, which,
+  fetchpatch, openexr }:
 
 stdenv.mkDerivation rec {
   pname = "ilmbase";
-  version = "2.3.0";
+  version = lib.getVersion openexr;
 
-  src = fetchurl {
-    url = "https://github.com/openexr/openexr/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "0qiq5bqq9rxhqjiym2k36sx4vq8adgrz6xf6qwizi9bqm78phsa5";
-  };
+  # the project no longer provides separate tarballs. We may even want to merge
+  # the ilmbase package into openexr in the future.
+  src = openexr.src;
+
+  sourceRoot = "source/IlmBase";
 
   outputs = [ "out" "dev" ];
 
@@ -23,15 +24,7 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_LINK = "-pthread";
 
   patches = [
-    ./bootstrap.patch
     ./cross.patch
-    (fetchpatch {
-      name = "CVE-2018-18443.patch";
-      url = "https://github.com/kdt3rd/openexr/commit/5fa930b82cff2db386c64ca512af19e60c14d32a.patch";
-      sha256 = "1j6xd0qkx99acc1szycxaj0wwp01yac67jz48hwc4fwwpz8blx4s";
-      stripLen = 1;
-      excludes = [ "CHANGES.md" ];
-    })
   ];
 
   # fails 1 out of 1 tests with