Merge branch 'master' into staging

Conflict: rename of pythondaemon -> python-daemon.

8 files changed, 60 insertions, 30 deletions

diff --git a/pkgs/tools/X11/virtualgl/lib.nix b/pkgs/tools/X11/virtualgl/lib.nix
index b3495b189a67..4c911e756330 100644
--- a/pkgs/tools/X11/virtualgl/lib.nix
+++ b/pkgs/tools/X11/virtualgl/lib.nix
@@ -19,12 +19,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  postPatch = ''
-    # script calls exec, which fails with plain sh
-    substituteInPlace ./server/vglrun.in \
-      --replace '#!/bin/sh' '#!/usr/bin/env bash'
-  '';
-
   meta = with stdenv.lib; {
     homepage = http://www.virtualgl.org/;
     description = "X11 GL rendering in a remote computer with full 3D hw acceleration";
diff --git a/pkgs/tools/graphics/vulkan-tools/default.nix b/pkgs/tools/graphics/vulkan-tools/default.nix
index 0d8f5bfe1bc7..afb6812b3a3a 100644
--- a/pkgs/tools/graphics/vulkan-tools/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools/default.nix
@@ -3,17 +3,17 @@
 
 stdenv.mkDerivation rec {
   name = "vulkan-tools-${version}";
-  version = "1.1.82.0";
+  version = "1.1.85.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Tools";
     rev = "sdk-${version}";
-    sha256 = "1viaqp1zfdgli3hw674rz8mrfzxpgv12vxcd07czwr8nyb19f2g5";
+    sha256 = "0f4dfr8g0vy7y1hvs6z9lw52kissailzisby4qnz4akv0zz5y5s5";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ cmake python3 vulkan-loader xlibsWrapper libxcb libXrandr wayland ];
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [ python3 vulkan-loader xlibsWrapper libxcb libXrandr wayland ];
   enableParallelBuilding = true;
 
   cmakeFlags = [ "-DBUILD_ICD=OFF" "-DGLSLANG_INSTALL_DIR=${glslang}" ];
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index 9de0f850d49b..8c08ee65805c 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -16,11 +16,14 @@
 buildPythonPackage rec {
 
   pname = "youtube-dl";
-  version = "2018.10.05";
+  # The websites youtube-dl deals with are a very moving target. That means that
+  # downloads break constantly. Because of that, updates should always be backported
+  # to the latest stable release.
+  version = "2018.10.29";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1iq02kwxdgh07bf0w0fvbsjbdshs4kja35gy8m70ji9cj10l1mbw";
+    sha256 = "1ndkkpnmjdyz5gjjmvaf18761lxa2c0kypicm9bpqpaj7sdr9s27";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/networking/eternal-terminal/default.nix b/pkgs/tools/networking/eternal-terminal/default.nix
index 36bc2a9bc284..73eaa07ac8ff 100644
--- a/pkgs/tools/networking/eternal-terminal/default.nix
+++ b/pkgs/tools/networking/eternal-terminal/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "eternal-terminal-${version}";
-  version = "5.1.7";
+  version = "5.1.8";
 
   src = fetchFromGitHub {
     owner = "MisterTea";
     repo = "EternalTCP";
     rev = "refs/tags/et-v${version}";
-    sha256 = "17ndpkpyh8hwr6v7ac6029sja95nhn9c1g8r93g20rp0vz3r6lpa";
+    sha256 = "0fq9a1fn0c77wfpypl3z7y23gbkw295ksy97wi9lhb5zj2m3dkq0";
   };
 
   nativeBuildInputs = [ cmake ninja ];
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Remote shell that automatically reconnects without interrupting the session";
     license = licenses.asl20;
-    homepage = https://mistertea.github.io/EternalTCP/;
+    homepage = https://mistertea.github.io/EternalTerminal/;
     platforms = platforms.linux ++ platforms.darwin;
     maintainers = [ maintainers.dezgeg ];
   };
diff --git a/pkgs/tools/networking/ntp/seccomp.patch b/pkgs/tools/networking/ntp/seccomp.patch
index 872bf8e7fcc2..c75536dac7fb 100644
--- a/pkgs/tools/networking/ntp/seccomp.patch
+++ b/pkgs/tools/networking/ntp/seccomp.patch
@@ -1,7 +1,18 @@
-diff -urN ntp-4.2.8p10.orig/ntpd/ntpd.c ntp-4.2.8p10/ntpd/ntpd.c
---- ntp-4.2.8p10.orig/ntpd/ntpd.c	2017-04-02 20:21:17.371319663 +0200
-+++ ntp-4.2.8p10/ntpd/ntpd.c	2017-04-02 21:26:02.766178723 +0200
-@@ -1157,10 +1157,12 @@
+From 881e427f3236046466bdb8235edf86e6dfa34391 Mon Sep 17 00:00:00 2001
+From: Michael Bishop <cleverca22@gmail.com>
+Date: Mon, 11 Jun 2018 08:30:48 -0300
+Subject: [PATCH] fix the seccomp filter to include a few previously missed
+ syscalls
+
+---
+ ntpd/ntpd.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/ntpd/ntpd.c b/ntpd/ntpd.c
+index 2c7f02ec5..4c59dc2ba 100644
+--- a/ntpd/ntpd.c
++++ b/ntpd/ntpd.c
+@@ -1140,10 +1140,12 @@ int scmp_sc[] = {
  	SCMP_SYS(close),
  	SCMP_SYS(connect),
  	SCMP_SYS(exit_group),
@@ -14,15 +25,16 @@ diff -urN ntp-4.2.8p10.orig/ntpd/ntpd.c ntp-4.2.8p10/ntpd/ntpd.c
  	SCMP_SYS(getsockname),
  	SCMP_SYS(ioctl),
  	SCMP_SYS(lseek),
-@@ -1179,6 +1181,7 @@
+@@ -1162,6 +1164,8 @@ int scmp_sc[] = {
  	SCMP_SYS(sendto),
  	SCMP_SYS(setitimer),
  	SCMP_SYS(setsid),
-+        SCMP_SYS(setsockopt),
++	SCMP_SYS(setsockopt),
++	SCMP_SYS(openat),
  	SCMP_SYS(socket),
  	SCMP_SYS(stat),
  	SCMP_SYS(time),
-@@ -1195,9 +1198,11 @@
+@@ -1178,9 +1182,11 @@ int scmp_sc[] = {
  	SCMP_SYS(clock_settime),
  	SCMP_SYS(close),
  	SCMP_SYS(exit_group),
@@ -34,12 +46,12 @@ diff -urN ntp-4.2.8p10.orig/ntpd/ntpd.c ntp-4.2.8p10/ntpd/ntpd.c
  	SCMP_SYS(madvise),
  	SCMP_SYS(mmap),
  	SCMP_SYS(mmap2),
-@@ -1211,6 +1216,8 @@
+@@ -1194,6 +1200,8 @@ int scmp_sc[] = {
  	SCMP_SYS(select),
  	SCMP_SYS(setitimer),
  	SCMP_SYS(setsid),
-+        SCMP_SYS(setsockopt),
-+        SCMP_SYS(openat),
++	SCMP_SYS(setsockopt),
++	SCMP_SYS(openat),
  	SCMP_SYS(sigprocmask),
  	SCMP_SYS(sigreturn),
  	SCMP_SYS(socketcall),
diff --git a/pkgs/tools/package-management/cargo-tree/default.nix b/pkgs/tools/package-management/cargo-tree/default.nix
index 90f2ad71fc21..dd7d88ff848c 100644
--- a/pkgs/tools/package-management/cargo-tree/default.nix
+++ b/pkgs/tools/package-management/cargo-tree/default.nix
@@ -1,17 +1,17 @@
 { stdenv, lib, rustPlatform, fetchFromGitHub, pkgconfig, cmake, curl, libiconv, darwin }:
 rustPlatform.buildRustPackage rec {
   name = "cargo-tree-${version}";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "sfackler";
     repo = "cargo-tree";
     rev = "v${version}";
 
-    sha256 = "197kbr7q7aqzv5l8xilz60m50rbkmfwfswyd6ka7w83j5bi88jw3";
+    sha256 = "0vr1mv8ns67kslxgwkvic8w86fvmqasxs6yd4yn21j49zg23866k";
   };
 
-  cargoSha256 = "1v84cj42ch49jrigrkivg99hzxa79jii8s3fddjk23hi1xx1c35y";
+  cargoSha256 = "0924bpcwz15zlp4vjaqap05s4nynw9mqz0np1kph3vx7aj9rsaw6";
 
   nativeBuildInputs = [ pkgconfig cmake ];
   buildInputs = [ curl ] ++ lib.optionals stdenv.isDarwin [ libiconv darwin.apple_sdk.frameworks.Security ];
diff --git a/pkgs/tools/security/saml2aws/default.nix b/pkgs/tools/security/saml2aws/default.nix
index 047706cd8a68..e90517f1581b 100644
--- a/pkgs/tools/security/saml2aws/default.nix
+++ b/pkgs/tools/security/saml2aws/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "saml2aws-${version}";
-  version = "2.6.1";
+  version = "2.10.0";
 
   goPackagePath = "github.com/versent/saml2aws";
   goDeps = ./deps.nix;
@@ -15,7 +15,7 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "Versent";
     repo = "saml2aws";
-    sha256 = "0sg5qm1gyrisna247lmxfgpa22y6rnz9vd6yg92kxlcwr4ji8l1j";
+    sha256 = "00m8x57fgry601w5f9dxnxdqbbqjiv7c0rsx47iv9qsp0w7l50c5";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/typesetting/tex/texlive/combine.nix b/pkgs/tools/typesetting/tex/texlive/combine.nix
index f76b71ced3cf..ea2926748198 100644
--- a/pkgs/tools/typesetting/tex/texlive/combine.nix
+++ b/pkgs/tools/typesetting/tex/texlive/combine.nix
@@ -218,9 +218,30 @@ in buildEnv {
         ln -sv "$(realpath $s)" "$out/bin/$tName" # wrapped below
       done
     )
+  '' +
+    # A hacky way to provide repstopdf
+    #  * Copy is done to have a correct "$0" so that epstopdf enables the restricted mode
+    #  * ./bin/repstopdf needs to be a symlink to be processed by wrapBin
+  ''
+    if [[ -e ./bin/epstopdf ]]; then
+      cp $(realpath ./bin/epstopdf) ./share/texmf/scripts/repstopdf
+      ln -s "$out"/share/texmf/scripts/repstopdf ./bin/repstopdf
+    fi
+  '' +
+    # finish up the wrappers
+  ''
     rm "$out"/bin/*-sys
     wrapBin
   '' +
+    # Perform a small test to verify that the restricted mode get enabled when
+    # needed (detected by checking if it disallows --gscmd)
+  ''
+    if [[ -e ./bin/epstopdf ]]; then
+      echo "Testing restricted mode for {,r}epstopdf"
+      ! (epstopdf --gscmd echo /dev/null 2>&1 || true) | grep forbidden
+      (repstopdf --gscmd echo /dev/null 2>&1 || true) | grep forbidden
+    fi
+  '' +
   # TODO: a context trigger https://www.preining.info/blog/2015/06/debian-tex-live-2015-the-new-layout/
     # http://wiki.contextgarden.net/ConTeXt_Standalone#Unix-like_platforms_.28Linux.2FMacOS_X.2FFreeBSD.2FSolaris.29