Merge remote-tracking branch 'upstream/master' into HEAD

Conflicts:
	pkgs/development/tools/misc/binutils/default.nix

5 files changed, 55 insertions, 16 deletions

diff --git a/pkgs/applications/version-management/bazaar/default.nix b/pkgs/applications/version-management/bazaar/default.nix
index 47d667a0c067..72e010fd283c 100644
--- a/pkgs/applications/version-management/bazaar/default.nix
+++ b/pkgs/applications/version-management/bazaar/default.nix
@@ -1,4 +1,5 @@
 { stdenv, fetchurl, python2Packages
+, fetchpatch
 , withSFTP ? true
  }:
 
@@ -17,8 +18,15 @@ python2Packages.buildPythonApplication rec {
   propagatedBuildInputs = []
   ++ stdenv.lib.optionals withSFTP [ python2Packages.paramiko ];
 
-  # Bazaar can't find the certificates alone
-  patches = [ ./add_certificates.patch ];
+  patches = [
+    # Bazaar can't find the certificates alone
+    ./add_certificates.patch
+    (fetchpatch {
+      url = "https://bazaar.launchpad.net/~brz/brz/trunk/revision/6754";
+      sha256 = "0mdqa9w1p6cmli6976v4wi0sw9r4p5prkj7lzfd1877wk11c9c73";
+      name = "CVE-2017-14176.patch";
+    })
+  ];
   postPatch = ''
     substituteInPlace bzrlib/transport/http/_urllib2_wrappers.py \
       --subst-var-by certPath /etc/ssl/certs/ca-certificates.crt
diff --git a/pkgs/applications/version-management/git-and-tools/default.nix b/pkgs/applications/version-management/git-and-tools/default.nix
index cd969ff81d0b..73659a32f4bf 100644
--- a/pkgs/applications/version-management/git-and-tools/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/default.nix
@@ -15,7 +15,6 @@ let
       perlPackages.MIMEBase64 perlPackages.AuthenSASL
       perlPackages.DigestHMAC
     ];
-    gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
   };
 
 in
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 6669d6d6044f..b1d5ad5b242c 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -1,9 +1,9 @@
 { fetchurl, stdenv, curl, openssl, zlib, expat, perl, python, gettext, cpio
 , gnugrep, gnused, gawk, coreutils # needed at runtime by git-filter-branch etc
-, gzip, openssh, pcre2
+, openssh, pcre2
 , asciidoc, texinfo, xmlto, docbook2x, docbook_xsl, docbook_xml_dtd_45
 , libxslt, tcl, tk, makeWrapper, libiconv
-, svnSupport, subversionClient, perlLibs, smtpPerlLibs, gitwebPerlLibs
+, svnSupport, subversionClient, perlLibs, smtpPerlLibs
 , guiSupport
 , withManual ? true
 , pythonSupport ? true
@@ -25,6 +25,8 @@ stdenv.mkDerivation {
     sha256 = "0j1dwvg5llnj3g0fp8hdgpms4hp90qw9f6509vqw30dhwplrjpfn";
   };
 
+  outputs = [ "out" "gitweb" ];
+
   hardeningDisable = [ "format" ];
 
   patches = [
@@ -139,15 +141,8 @@ stdenv.mkDerivation {
       substituteInPlace $out/libexec/git-core/git-sh-i18n \
           --subst-var-by gettext ${gettext}
 
-      # gzip (and optionally bzip2, xz, zip) are runtime dependencies for
-      # gitweb.cgi, need to patch so that it's found
-      sed -i -e "s|'compressor' => \['gzip'|'compressor' => ['${gzip}/bin/gzip'|" \
-          $out/share/gitweb/gitweb.cgi
-      # Give access to CGI.pm and friends (was removed from perl core in 5.22)
-      for p in ${stdenv.lib.concatStringsSep " " gitwebPerlLibs}; do
-          sed -i -e "/use CGI /i use lib \"$p/lib/perl5/site_perl\";" \
-              "$out/share/gitweb/gitweb.cgi"
-      done
+      # put in separate package for simpler maintenance
+      mv $out/share/gitweb $gitweb/
 
       # Also put git-http-backend into $PATH, so that we can use smart
       # HTTP(s) transports for pushing
diff --git a/pkgs/applications/version-management/git-and-tools/gitweb/default.nix b/pkgs/applications/version-management/git-and-tools/gitweb/default.nix
new file mode 100644
index 000000000000..0358f850c9ab
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/gitweb/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, git, gzip, perlPackages, fetchFromGitHub
+, gitwebTheme ? false }:
+
+let
+  gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
+  gitwebThemeSrc = fetchFromGitHub {
+    owner = "kogakure";
+    repo = "gitweb-theme";
+    rev = "049b88e664a359f8ec25dc6f531b7e2aa60dd1a2";
+    sha256 = "0wksqma41z36dbv6w6iplkjfdm0ha3njp222fakyh4lismajr71p";
+  };
+in stdenv.mkDerivation {
+  name = "gitweb";
+
+  src = git.gitweb;
+
+  installPhase = ''
+      mkdir $out
+      mv * $out
+
+      # gzip (and optionally bzip2, xz, zip) are runtime dependencies for
+      # gitweb.cgi, need to patch so that it's found
+      sed -i -e "s|'compressor' => \['gzip'|'compressor' => ['${gzip}/bin/gzip'|" \
+          $out/gitweb.cgi
+      # Give access to CGI.pm and friends (was removed from perl core in 5.22)
+      for p in ${stdenv.lib.concatStringsSep " " gitwebPerlLibs}; do
+          sed -i -e "/use CGI /i use lib \"$p/lib/perl5/site_perl\";" \
+              "$out/gitweb.cgi"
+      done
+
+      ${stdenv.lib.optionalString gitwebTheme "cp ${gitwebThemeSrc}/* $out/static"}
+  '';
+
+  meta = git.meta // {
+    maintainers = with stdenv.lib.maintainers; [ gnidorah ];
+  };
+}
diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix
index 8fcc3e7e9270..da9ee9b40811 100644
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@@ -7,13 +7,13 @@ with stdenv.lib;
 
 buildGoPackage rec {
   name = "gitea-${version}";
-  version = "1.3.3";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "go-gitea";
     repo = "gitea";
     rev = "v${version}";
-    sha256 = "0ikkpvarp6mzsqk56ihw72fbv7r98g5v5i83rxq8dk709fdqplm6";
+    sha256 = "07fbcd134n7giwxpqli5hfywmi0vb8awgdh3gyiwyzhjwwzfrxkq";
   };
 
   patches = [ ./static-root-path.patch ];