Merge branch 'staging-next'

There are several security fixes - again, as it consists mainly of the
previously reverted staging-next merge.

pkgs/development/python-modules/cryptography/default.nix

@@ -1,6 +1,7 @@
 { stdenv
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , openssl
 , cryptography_vectors
 , darwin
@@ -49,10 +50,18 @@ buildPythonPackage rec {
     pytz
   ];
 
+  # remove when https://github.com/pyca/cryptography/issues/4998 is fixed
   checkPhase = ''
-    py.test --disable-pytest-warnings tests
+    py.test --disable-pytest-warnings tests -k 'not load_ecdsa_no_named_curve'
   '';
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/pyca/cryptography/commit/e575e3d482f976c4a1f3203d63ea0f5007a49a2a.patch";
+      sha256 = "0vg9prqsizd6gzh5j7lscsfxzxlhz7pacvzhgqmj1vhdhjwbblcp";
+    })
+  ];
+
   # IOKit's dependencies are inconsistent between OSX versions, so this is the best we
   # can do until nix 1.11's release
   __impureHostDeps = [ "/usr/lib" ];

pkgs/development/python-modules/mysqlclient/default.nix

@@ -1,15 +1,15 @@
-{ stdenv, buildPythonPackage, fetchPypi, mysql }:
+{ stdenv, buildPythonPackage, fetchPypi, libmysqlclient }:
 
 buildPythonPackage rec {
   pname = "mysqlclient";
   version = "1.4.4";
 
   nativeBuildInputs = [
-    mysql.connector-c
+    libmysqlclient
   ];
 
   buildInputs = [
-    mysql.connector-c
+    libmysqlclient
   ];
 
   # Tests need a MySQL database

pkgs/development/python-modules/pyopenssl/default.nix

@@ -9,6 +9,7 @@
 , pretend
 , flaky
 , glibcLocales
+, six
 }:
 
 with stdenv.lib;
@@ -84,7 +85,7 @@ buildPythonPackage rec {
   doCheck = !stdenv.isDarwin;
 
   nativeBuildInputs = [ openssl ];
-  propagatedBuildInputs = [ cryptography pyasn1 idna ];
+  propagatedBuildInputs = [ cryptography pyasn1 idna six ];
 
   checkInputs = [ pytest pretend flaky glibcLocales ];
 }