Merge branch 'master' into upd.lxqt

15 files changed, 259 insertions, 103 deletions

diff --git a/pkgs/development/tools/build-managers/apache-maven/default.nix b/pkgs/development/tools/build-managers/apache-maven/default.nix
index 5490790fe385..79648c16f5e7 100644
--- a/pkgs/development/tools/build-managers/apache-maven/default.nix
+++ b/pkgs/development/tools/build-managers/apache-maven/default.nix
@@ -2,7 +2,7 @@
 
 assert jdk != null;
 
-let version = "3.5.0"; in
+let version = "3.5.2"; in
 stdenv.mkDerivation rec {
   name = "apache-maven-${version}";
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://apache/maven/maven-3/${version}/binaries/${name}-bin.tar.gz";
-    sha256 = "0d7hjnj77hc7qqnnfmqlwij8n6pcldfavvd6lilvv5ak4hci9fdy";
+    sha256 = "1zza5kjf69hnx41gy3yhvsk1kz259nig5njcmzjbsr8a75p1yyvh";
   };
 
   buildInputs = [ makeWrapper ];
@@ -22,5 +22,6 @@ stdenv.mkDerivation rec {
     homepage = http://maven.apache.org/;
     license = licenses.asl20;
     platforms = platforms.unix;
+    maintainers = with maintainers; [ cko ];
   };
 }
diff --git a/pkgs/development/tools/build-managers/bazel/default.nix b/pkgs/development/tools/build-managers/bazel/default.nix
index 8701db8d161e..e15b212ebca6 100644
--- a/pkgs/development/tools/build-managers/bazel/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
 
-  version = "0.6.1";
+  version = "0.7.0";
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/bazelbuild/bazel/";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
-    sha256 = "19rb1lh6v2gi8xlxhdmhydp16i1bgmvb510i053rfy0jlmh1znns";
+    sha256 = "05n4zz2a29y4vr2svc7ya9fx7qxb9151a6gkycxk9qj3v32sk150";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/development/tools/build-managers/buck/default.nix b/pkgs/development/tools/build-managers/buck/default.nix
index cddb1a90765a..5d486f47844e 100644
--- a/pkgs/development/tools/build-managers/buck/default.nix
+++ b/pkgs/development/tools/build-managers/buck/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "buck-${version}";
-  version = "v2017.05.31.01";
+  version = "v2017.10.01.01";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "buck";
-    rev = "0b8b3828a11afa79dc128832cb55b106f07e48aa";
-    sha256 = "1g3yg8qq91cdhsq7zmir7wxw3767l120f5zhq969gppdw9apqy0s";
+    rev = "2025fd74327477728b524eafdd4619a0170a24ea";
+    sha256 = "05nyyb6f0hv1h67zzvdq8297yl8zjhpbasx35lxnrsjz0m1h8ngw";
   };
 
   patches = [ ./pex-mtime.patch ];
diff --git a/pkgs/development/tools/build-managers/cmake/setup-hook.sh b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
index bf876e81cda5..331f907ae612 100755
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
@@ -84,6 +84,9 @@ makeCmakeFindLibs(){
         -L*)
           export CMAKE_LIBRARY_PATH="$CMAKE_LIBRARY_PATH${CMAKE_LIBRARY_PATH:+:}${flag:2}"
           ;;
+        -F*)
+          export CMAKE_FRAMEWORK_PATH="$CMAKE_FRAMEWORK_PATH${CMAKE_FRAMEWORK_PATH:+:}${flag:2}"
+          ;;
         -isystem)
           isystem_seen=1
           ;;
diff --git a/pkgs/development/tools/build-managers/gnumake/4.2/default.nix b/pkgs/development/tools/build-managers/gnumake/4.2/default.nix
index 253aadb86d73..7914d8ebb4f8 100644
--- a/pkgs/development/tools/build-managers/gnumake/4.2/default.nix
+++ b/pkgs/development/tools/build-managers/gnumake/4.2/default.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation {
     # and /usr/lib. It's a stupid feature anyway. Likewise, when searching for
     # included Makefiles, don't look in /usr/include and friends.
     ./impure-dirs.patch
+    ./pselect.patch
   ];
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/tools/build-managers/gnumake/4.2/pselect.patch b/pkgs/development/tools/build-managers/gnumake/4.2/pselect.patch
new file mode 100644
index 000000000000..5a03acb2f7ca
--- /dev/null
+++ b/pkgs/development/tools/build-managers/gnumake/4.2/pselect.patch
@@ -0,0 +1,170 @@
+From b552b05251980f693c729e251f93f5225b400714 Mon Sep 17 00:00:00 2001
+From: Paul Smith <psmith@gnu.org>
+Date: Sat, 3 Jun 2017 16:20:51 -0400
+Subject: [SV 51159] Use a non-blocking read with pselect to avoid hangs.
+
+* posixos.c (set_blocking): Set blocking on a file descriptor.
+(jobserver_setup): Set non-blocking on the jobserver read side.
+(jobserver_parse_auth): Ditto.
+(jobserver_acquire_all): Set blocking to avoid a busy-wait loop.
+(jobserver_acquire): If the non-blocking read() returns without
+taking a token then try again.
+---
+ posixos.c | 97 ++++++++++++++++++++++++++++++++++++++++++++++-----------------
+ 1 file changed, 71 insertions(+), 26 deletions(-)
+
+diff --git posixos.c posixos.c
+index e642d7f..dbafa51 100644
+--- posixos.c
++++ posixos.c
+@@ -62,6 +62,24 @@ make_job_rfd (void)
+ #endif
+ }
+ 
++static void
++set_blocking (int fd, int blocking)
++{
++  // If we're not using pselect() don't change the blocking
++#ifdef HAVE_PSELECT
++  int flags;
++  EINTRLOOP (flags, fcntl (fd, F_GETFL));
++  if (flags >= 0)
++    {
++      int r;
++      flags = blocking ? (flags & ~O_NONBLOCK) : (flags | O_NONBLOCK);
++      EINTRLOOP (r, fcntl (fd, F_SETFL, flags));
++      if (r < 0)
++        pfatal_with_name ("fcntl(O_NONBLOCK)");
++    }
++#endif
++}
++
+ unsigned int
+ jobserver_setup (int slots)
+ {
+@@ -86,6 +104,9 @@ jobserver_setup (int slots)
+         pfatal_with_name (_("init jobserver pipe"));
+     }
+ 
++  /* When using pselect() we want the read to be non-blocking.  */
++  set_blocking (job_fds[0], 0);
++
+   return 1;
+ }
+ 
+@@ -121,6 +142,9 @@ jobserver_parse_auth (const char *auth)
+       return 0;
+     }
+ 
++  /* When using pselect() we want the read to be non-blocking.  */
++  set_blocking (job_fds[0], 0);
++
+   return 1;
+ }
+ 
+@@ -169,7 +193,10 @@ jobserver_acquire_all (void)
+ {
+   unsigned int tokens = 0;
+ 
+-  /* Close the write side, so the read() won't hang.  */
++  /* Use blocking reads to wait for all outstanding jobs.  */
++  set_blocking (job_fds[0], 1);
++
++  /* Close the write side, so the read() won't hang forever.  */
+   close (job_fds[1]);
+   job_fds[1] = -1;
+ 
+@@ -236,18 +263,12 @@ jobserver_pre_acquire (void)
+ unsigned int
+ jobserver_acquire (int timeout)
+ {
+-  sigset_t empty;
+-  fd_set readfds;
+   struct timespec spec;
+   struct timespec *specp = NULL;
+-  int r;
+-  char intake;
++  sigset_t empty;
+ 
+   sigemptyset (&empty);
+ 
+-  FD_ZERO (&readfds);
+-  FD_SET (job_fds[0], &readfds);
+-
+   if (timeout)
+     {
+       /* Alarm after one second (is this too granular?)  */
+@@ -256,28 +277,52 @@ jobserver_acquire (int timeout)
+       specp = &spec;
+     }
+ 
+-  r = pselect (job_fds[0]+1, &readfds, NULL, NULL, specp, &empty);
+-
+-  if (r == -1)
++  while (1)
+     {
+-      /* Better be SIGCHLD.  */
+-      if (errno != EINTR)
+-        pfatal_with_name (_("pselect jobs pipe"));
+-      return 0;
+-    }
++      fd_set readfds;
++      int r;
++      char intake;
+ 
+-  if (r == 0)
+-    /* Timeout.  */
+-    return 0;
++      FD_ZERO (&readfds);
++      FD_SET (job_fds[0], &readfds);
+ 
+-  /* The read FD is ready: read it!  */
+-  EINTRLOOP (r, read (job_fds[0], &intake, 1));
+-  if (r < 0)
+-    pfatal_with_name (_("read jobs pipe"));
++      r = pselect (job_fds[0]+1, &readfds, NULL, NULL, specp, &empty);
++      if (r < 0)
++        switch (errno)
++          {
++          case EINTR:
++            /* SIGCHLD will show up as an EINTR.  */
++            return 0;
++
++          case EBADF:
++            /* Someone closed the jobs pipe.
++               That shouldn't happen but if it does we're done.  */
++              O (fatal, NILF, _("job server shut down"));
+ 
+-  /* What does it mean if read() returns 0?  It shouldn't happen because only
+-     the master make can reap all the tokens and close the write side...??  */
+-  return r > 0;
++          default:
++            pfatal_with_name (_("pselect jobs pipe"));
++          }
++
++      if (r == 0)
++        /* Timeout.  */
++        return 0;
++
++      /* The read FD is ready: read it!  This is non-blocking.  */
++      EINTRLOOP (r, read (job_fds[0], &intake, 1));
++
++      if (r < 0)
++        {
++          /* Someone sniped our token!  Try again.  */
++          if (errno == EAGAIN)
++            continue;
++
++          pfatal_with_name (_("read jobs pipe"));
++        }
++
++      /* read() should never return 0: only the master make can reap all the
++         tokens and close the write side...??  */
++      return r > 0;
++    }
+ }
+ 
+ #else
+-- 
+cgit v1.0-41-gc330
+
diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index a5ea6df3c8df..bbfcc8513078 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -52,12 +52,12 @@ rec {
   };
 
   gradle_latest = gradleGen rec {
-    name = "gradle-4.2.1";
+    name = "gradle-4.3";
     nativeVersion = "0.14";
 
     src = fetchurl {
       url = "http://services.gradle.org/distributions/${name}-bin.zip";
-      sha256 = "1h7v133rm81jf0bgv9mgvydl7rgh4430dnsfs66wflfay82cqldm";
+      sha256 = "0k358y18pp2809kn5il4kv3qvlqrbwmy276bbm3mnmwjxx7g9jwd";
     };
   };
 
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 1c2e726cdc54..8e4c5d4801a4 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -22,7 +22,7 @@ python3Packages.buildPythonApplication rec {
     sed -i -e 's|e.fix_rpath(install_rpath)||' mesonbuild/scripts/meson_install.py
   '';
 
-  setupHook = ./setup-hook.sh;    
+  setupHook = ./setup-hook.sh;
 
   meta = with lib; {
     homepage = http://mesonbuild.com;
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
index 430e46f23030..44e4f494ff24 100644
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,16 +1,16 @@
 { lib, buildGoPackage, fetchFromGitLab, fetchurl, go-bindata }:
 
 let
-  version = "10.0.2";
+  version = "10.1.0";
   # Gitlab runner embeds some docker images these are prebuilt for arm and x86_64
   docker_x86_64 = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/docker/prebuilt-x86_64.tar.xz";
-    sha256 = "14lrc9frigym93ppphmdhwnbhk7xz5drpai3d29gyi1z4xsm1jaq";
+    sha256 = "0h8fwqsr8ibd82jxq4pc9p8x7af0i8jyrrsj13p4daqhla0srxr4";
   };
 
   docker_arm = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/docker/prebuilt-arm.tar.xz";
-    sha256 = "013bly0xswzkf2kwi2pr2ryd880h63n8pya2ccv4z77hxs80cfmp";
+    sha256 = "0bzj8zr6d5ab5bjlbw7q3iwn19ha8fksymrvw6cyzs4qacfsj54w";
   };
 in
 buildGoPackage rec {
@@ -29,7 +29,7 @@ buildGoPackage rec {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "0hr964r7bcff74sna0b8w3d2ip0hs441ijlhplh2xzqnzpbvx2jq";
+    sha256 = "0knvjmxcscyr6v5b9vvyvm8w6p58a1h6nfcvf13dxp59psm71q00";
   };
 
   patches = [ ./fix-shell-path.patch ];
diff --git a/pkgs/development/tools/continuous-integration/jenkins/default.nix b/pkgs/development/tools/continuous-integration/jenkins/default.nix
index de0321109d7d..e6f01ba5c93d 100644
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "jenkins-${version}";
-  version = "2.86";
+  version = "2.87";
 
   src = fetchurl {
     url = "http://mirrors.jenkins-ci.org/war/${version}/jenkins.war";
-    sha256 = "198fcj2wkz8qxawk3mq29kwl51pxlbd7ivndcpvdvg42g0caqyi0";
+    sha256 = "1nzs9nn1nr2jav59v1xj39rzmrh1zmwaqnpaiqsll8kixkr9rb8f";
   };
 
   buildCommand = ''
diff --git a/pkgs/development/tools/ocaml/camlp5/default.nix b/pkgs/development/tools/ocaml/camlp5/default.nix
index e5c79f534b0c..0acd70b424a8 100644
--- a/pkgs/development/tools/ocaml/camlp5/default.nix
+++ b/pkgs/development/tools/ocaml/camlp5/default.nix
@@ -6,11 +6,11 @@ in
 
 stdenv.mkDerivation {
 
-  name = "camlp5${if transitional then "_transitional" else ""}-7.02";
+  name = "camlp5${if transitional then "_transitional" else ""}-7.03";
 
   src = fetchzip {
-    url = https://github.com/camlp5/camlp5/archive/rel702.tar.gz;
-    sha256 = "1m2d55zrgllidhgslvzgmr27f56qzdahz2sv56bvjs3bg7grmhnc";
+    url = https://github.com/camlp5/camlp5/archive/rel703.tar.gz;
+    sha256 = "0bwzhp4qjypfa0x8drp8w434dfixm1nzrm6pcy9s5akpmqvb50a8";
   };
 
   buildInputs = [ ocaml ];
diff --git a/pkgs/development/tools/rust/rustup/0001-dynamically-patchelf-binaries.patch b/pkgs/development/tools/rust/rustup/0001-dynamically-patchelf-binaries.patch
new file mode 100644
index 000000000000..4d77cf45d417
--- /dev/null
+++ b/pkgs/development/tools/rust/rustup/0001-dynamically-patchelf-binaries.patch
@@ -0,0 +1,54 @@
+From c21cc756b69a5f33c8a7758b746a816f40f55932 Mon Sep 17 00:00:00 2001
+From: Leon Isenberg <ljli@users.noreply.github.com>
+Date: Sat, 28 Oct 2017 17:58:17 +0200
+Subject: [PATCH] nix customization: patchelf installed binaries
+
+---
+ src/rustup-dist/src/component/package.rs | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/src/rustup-dist/src/component/package.rs b/src/rustup-dist/src/component/package.rs
+index 8aa63db9..4d219826 100644
+--- a/src/rustup-dist/src/component/package.rs
++++ b/src/rustup-dist/src/component/package.rs
+@@ -99,7 +99,13 @@ impl Package for DirectoryPackage {
+             let src_path = root.join(&path);
+ 
+             match &*part.0 {
+-                "file" => try!(builder.copy_file(path.clone(), &src_path)),
++                "file" => {
++                    try!(builder.copy_file(path.clone(), &src_path));
++                    nix_patchelf_if_needed(
++                        &target.prefix().path().join(path.clone()),
++                        &src_path,
++                    )
++                }
+                 "dir" => try!(builder.copy_dir(path.clone(), &src_path)),
+                 _ => return Err(ErrorKind::CorruptComponent(name.to_owned()).into()),
+             }
+@@ -117,6 +123,22 @@ impl Package for DirectoryPackage {
+     }
+ }
+ 
++fn nix_patchelf_if_needed(dest_path: &Path, src_path: &Path) {
++    let is_bin = if let Some(p) = src_path.parent() {
++        p.ends_with("bin")
++    } else {
++        false
++    };
++
++    if is_bin {
++        let _ = ::std::process::Command::new("@patchelf@/bin/patchelf")
++            .arg("--set-interpreter")
++            .arg("@dynamicLinker@")
++            .arg(dest_path)
++            .output();
++    }
++}
++
+ // On Unix we need to set up the file permissions correctly so
+ // binaries are executable and directories readable. This shouldn't be
+ // necessary: the source files *should* have the right permissions,
+-- 
+2.14.1
+
diff --git a/pkgs/development/tools/rust/rustup/0001-use-hardcoded-dynamic-linker.patch b/pkgs/development/tools/rust/rustup/0001-use-hardcoded-dynamic-linker.patch
deleted file mode 100644
index 3b429c1745e4..000000000000
--- a/pkgs/development/tools/rust/rustup/0001-use-hardcoded-dynamic-linker.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 36c053f37670c6003f9e8dc001741f7c49e9526a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Sat, 15 Apr 2017 20:42:10 +0200
-Subject: [PATCH] use hardcoded dynamic-linker
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
----
- src/rustup-cli/common.rs |  3 ++-
- src/rustup/toolchain.rs  | 22 ++++++++++++++++++++--
- 2 files changed, 22 insertions(+), 3 deletions(-)
-
-diff --git a/src/rustup-cli/common.rs b/src/rustup-cli/common.rs
-index 1abf345..21096e7 100644
---- a/src/rustup-cli/common.rs
-+++ b/src/rustup-cli/common.rs
-@@ -220,7 +220,8 @@ pub fn rustc_version(toolchain: &Toolchain) -> String {
-     if toolchain.exists() {
-         let rustc_path = toolchain.binary_file("rustc");
-         if utils::is_file(&rustc_path) {
--            let mut cmd = Command::new(&rustc_path);
-+            let mut cmd = Command::new("@dynamicLinker@");
-+            cmd.arg(&rustc_path);
-             cmd.arg("--version");
-             toolchain.set_ldpath(&mut cmd);
- 
-diff --git a/src/rustup/toolchain.rs b/src/rustup/toolchain.rs
-index dc29c32..212a4ab 100644
---- a/src/rustup/toolchain.rs
-+++ b/src/rustup/toolchain.rs
-@@ -315,7 +315,7 @@ impl<'a> Toolchain<'a> {
-             }
-             Path::new(&binary)
-         };
--        let mut cmd = Command::new(&path);
-+        let mut cmd = wrap_elf_interpreter(&path);
-         self.set_env(&mut cmd);
-         Ok(cmd)
-     }
-@@ -363,7 +363,7 @@ impl<'a> Toolchain<'a> {
-         } else {
-             src_file
-         };
--        let mut cmd = Command::new(exe_path);
-+        let mut cmd = wrap_elf_interpreter(exe_path);
-         self.set_env(&mut cmd);
-         cmd.env("RUSTUP_TOOLCHAIN", &primary_toolchain.name);
-         Ok(cmd)
-@@ -648,3 +648,21 @@ impl<'a> Toolchain<'a> {
-         path
-     }
- }
-+
-+fn wrap_elf_interpreter<S: AsRef<OsStr>>(p: S) -> Command {
-+    use std::fs::File;
-+    use std::io::Read;
-+    let path = Path::new(&p);
-+    let is_elf = File::open(path).map(|mut f| {
-+        let mut buf = [0; 4];
-+        let _ = f.read(&mut buf);
-+        buf == b"\x7fELF"[..]
-+    }).unwrap_or(false);
-+    if is_elf {
-+        let mut cmd = Command::new("@dynamicLinker@");
-+        cmd.arg(&path);
-+        cmd
-+    } else {
-+        Command::new(&path)
-+    }
-+}
--- 
-2.12.2
-
diff --git a/pkgs/development/tools/rust/rustup/default.nix b/pkgs/development/tools/rust/rustup/default.nix
index 65599ad8d18f..b7065cc5d7da 100644
--- a/pkgs/development/tools/rust/rustup/default.nix
+++ b/pkgs/development/tools/rust/rustup/default.nix
@@ -1,18 +1,18 @@
-{ stdenv, lib, runCommand
+{ stdenv, lib, runCommand, patchelf
 , fetchFromGitHub, rustPlatform
 , pkgconfig, curl, Security }:
 
 rustPlatform.buildRustPackage rec {
   name = "rustup-${version}";
-  version = "1.3.0";
+  version = "2017-10-29";
 
-  cargoSha256 = "1yd7k0jpx78p5bp6iyzgbyj7pjz8vyjg9g7fmf1bl60jsbdpgv3g";
+  cargoSha256 = "1xwxv8y9xjgdmm92ldrn9m9fml2zb5h7qqm7dhw63j6psb3ajqrw";
 
   src = fetchFromGitHub {
     owner = "rust-lang-nursery";
     repo = "rustup.rs";
-    rev = version;
-    sha256 = "199jlqqidzak7nxmv2nzjzv7zfzy9z7hw6h8d8wf1rbfdwd9l6hs";
+    rev = "13c8092507bf646f3ef6a621fe2c5a68212e800f";
+    sha256 = "1qd01rjk9qpfzgqs35f5nxrcf00kmf76zwmgj3yzdig9zymjwndg";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -24,9 +24,11 @@ rustPlatform.buildRustPackage rec {
   cargoBuildFlags = [ "--features no-self-update" ];
 
   patches = lib.optionals stdenv.isLinux [
-    (runCommand "0001-use-hardcoded-dynamic-linker.patch" { CC=stdenv.cc; } ''
+    (runCommand "0001-dynamically-patchelf-binaries.patch" { CC=stdenv.cc; patchelf = patchelf; } ''
        export dynamicLinker=$(cat $CC/nix-support/dynamic-linker)
-       substituteAll ${./0001-use-hardcoded-dynamic-linker.patch} $out
+       substitute ${./0001-dynamically-patchelf-binaries.patch} $out \
+         --subst-var patchelf \
+         --subst-var dynamicLinker
     '')
   ];
 
diff --git a/pkgs/development/tools/wp-cli/default.nix b/pkgs/development/tools/wp-cli/default.nix
index 779aed7fea34..e0aac84abb70 100644
--- a/pkgs/development/tools/wp-cli/default.nix
+++ b/pkgs/development/tools/wp-cli/default.nix
@@ -2,11 +2,11 @@
 
 let
   name = "wp-cli-${version}";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchurl {
     url    = "https://github.com/wp-cli/wp-cli/releases/download/v${version}/${name}.phar";
-    sha256 = "0q5d32jq7a6rba77sr1yyj6ib6x838hw14mm186ah1xxgnn7rnry";
+    sha256 = "0rav5a6znx81gwaxin1ib10sbfg16bgdnnyv1zn5sjify3f1wpqj";
   };
 
   completion = fetchurl {