10 files changed, 77 insertions, 48 deletions
diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index 6e6fbed2dbff..7c410a1a4f4f 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -7,23 +7,23 @@ assert stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux" || stden
 
 stdenv.mkDerivation rec {
   name = "google-cloud-sdk-${version}";
-  version = "148.0.1";
+  version = "150.0.0";
 
   src =
     if stdenv.system == "i686-linux" then
       fetchurl {
         url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-linux-x86.tar.gz";
-        sha256 = "17az8nah6s33c790kkqcpmcsc8cydhndmq7dblpwgizd86hg245g";
+        sha256 = "0zg6jnn93dq53glds4cghksyghb4d4z0i2h38na0r88mr8hzmx1l";
       }
     else if stdenv.system == "x86_64-darwin" then
       fetchurl {
         url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-darwin-x86_64.tar.gz";
-        sha256 = "1p5076cqk02y8zc3pkdlmrgh3mx2w1pddb2r5c9h3krfcaim2yj8";
+        sha256 = "1vbc360z2da3blwx51asw7jh0v0v6wsrv20z36yq0hccmljlh24w";
       }
     else
       fetchurl {
         url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-linux-x86_64.tar.gz";
-        sha256 = "0fr07vcksy0vrg7inmyddz9jlbqx0yg933s45zzkpp3a0m5hz6ll";
+        sha256 = "1q66aap3qidfsa8gm13jff3dprx8qarhjkx5ib65439fy4zj0bca";
       };
 
   buildInputs = [python27 makeWrapper];
diff --git a/pkgs/tools/archivers/p7zip/default.nix b/pkgs/tools/archivers/p7zip/default.nix
index 2b61b5b2679f..8e9db09147ed 100644
--- a/pkgs/tools/archivers/p7zip/default.nix
+++ b/pkgs/tools/archivers/p7zip/default.nix
@@ -16,6 +16,14 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  # Default makefile is full of impurities on Darwin. The patch doesn't hurt Linux so I'm leaving it unconditional
+  postPatch = ''
+    sed -i '/CC=\/usr/d' makefile.macosx_llvm_64bits
+
+    # I think this is a typo and should be CXX? Either way let's kill it
+    sed -i '/XX=\/usr/d' makefile.macosx_llvm_64bits
+  '';
+
   preConfigure = ''
     makeFlagsArray=(DEST_HOME=$out)
     buildFlags=all3
diff --git a/pkgs/tools/archivers/sharutils/default.nix b/pkgs/tools/archivers/sharutils/default.nix
index 41043cda5b65..77ab8a1cb033 100644
--- a/pkgs/tools/archivers/sharutils/default.nix
+++ b/pkgs/tools/archivers/sharutils/default.nix
@@ -1,23 +1,17 @@
 { stdenv, fetchurl, gettext, coreutils }:
 
 stdenv.mkDerivation rec {
-  name = "sharutils-4.11.1";
+  name = "sharutils-4.15.2";
 
   src = fetchurl {
-    url = "mirror://gnu/sharutils/${name}.tar.bz2";
-    sha256 = "1mallg1gprimlggdisfzdmh1xi676jsfdlfyvanlcw72ny8fsj3g";
+    url = "mirror://gnu/sharutils/${name}.tar.xz";
+    sha256 = "16isapn8f39lnffc3dp4dan05b7x6mnc76v6q5nn8ysxvvvwy19b";
   };
 
   hardeningDisable = [ "format" ];
 
-  preConfigure = ''
-     # Fix for building on Glibc 2.16.  Won't be needed once the
-     # gnulib in sharutils is updated.
-     sed -i ${stdenv.lib.optionalString (stdenv.isOpenBSD && stdenv.cc.nativeTools) "''"} '/gets is a security hole/d' lib/stdio.in.h
-  '';
-
   # GNU Gettext is needed on non-GNU platforms.
-  buildInputs = [ gettext coreutils ];
+  buildInputs = [ coreutils gettext ];
 
   doCheck = true;
 
@@ -25,7 +19,7 @@ stdenv.mkDerivation rec {
     patches = [ ./sharutils-4.11.1-cross-binary-mode-popen.patch ];
   };
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Tools for remote synchronization and `shell archives'";
     longDescription =
       '' GNU shar makes so-called shell archives out of many files, preparing
@@ -44,8 +38,8 @@ stdenv.mkDerivation rec {
          concatenated shell archives.
       '';
     homepage = http://www.gnu.org/software/sharutils/;
-    license = stdenv.lib.licenses.gpl3Plus;
-    maintainers = [ ];
-    platforms = stdenv.lib.platforms.all;
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.ndowens ];
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/tools/backup/bup/default.nix b/pkgs/tools/backup/bup/default.nix
index 8a81e737ccc8..0d60930b1fb4 100644
--- a/pkgs/tools/backup/bup/default.nix
+++ b/pkgs/tools/backup/bup/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, fetchurl, makeWrapper
 , perl, pandoc, python2Packages, git
-, par2cmdline ? null, par2Support ? false
+, par2cmdline ? null, par2Support ? true
 }:
 
 assert par2Support -> par2cmdline != null;
diff --git a/pkgs/tools/compression/brotli/default.nix b/pkgs/tools/compression/brotli/default.nix
index 921802166718..111d41256840 100644
--- a/pkgs/tools/compression/brotli/default.nix
+++ b/pkgs/tools/compression/brotli/default.nix
@@ -15,6 +15,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ cmake ];
 
+  # This breaks on Darwin because our cmake hook tries to make a build folder
+  # and the wonderful bazel BUILD file is already there (yay case-insensitivty?)
+  prePatch = "rm BUILD";
+
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
 
diff --git a/pkgs/tools/networking/ntp/default.nix b/pkgs/tools/networking/ntp/default.nix
index b4053c7a956c..29f8e1ae2570 100644
--- a/pkgs/tools/networking/ntp/default.nix
+++ b/pkgs/tools/networking/ntp/default.nix
@@ -15,6 +15,10 @@ stdenv.mkDerivation rec {
     sha256 = "17xrk7gxrl3hgg0i73n8qm53knyh01lf0f3l1zx9x6r1cip3dlnx";
   };
 
+  # The hardcoded list of allowed system calls for seccomp is
+  # insufficient for NixOS, add more to make it work (issue #21136).
+  patches = [ ./seccomp.patch ];
+
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"
diff --git a/pkgs/tools/networking/ntp/seccomp.patch b/pkgs/tools/networking/ntp/seccomp.patch
new file mode 100644
index 000000000000..28de2f01d073
--- /dev/null
+++ b/pkgs/tools/networking/ntp/seccomp.patch
@@ -0,0 +1,44 @@
+diff -urN ntp-4.2.8p10.orig/ntpd/ntpd.c ntp-4.2.8p10/ntpd/ntpd.c
+--- ntp-4.2.8p10.orig/ntpd/ntpd.c	2017-04-02 20:21:17.371319663 +0200
++++ ntp-4.2.8p10/ntpd/ntpd.c	2017-04-02 21:26:02.766178723 +0200
+@@ -1157,10 +1157,12 @@
+ 	SCMP_SYS(close),
+ 	SCMP_SYS(connect),
+ 	SCMP_SYS(exit_group),
++	SCMP_SYS(fcntl),
+ 	SCMP_SYS(fstat),
+ 	SCMP_SYS(fsync),
+ 	SCMP_SYS(futex),
+ 	SCMP_SYS(getitimer),
++	SCMP_SYS(getpid),
+ 	SCMP_SYS(getsockname),
+ 	SCMP_SYS(ioctl),
+ 	SCMP_SYS(lseek),
+@@ -1179,6 +1181,7 @@
+ 	SCMP_SYS(sendto),
+ 	SCMP_SYS(setitimer),
+ 	SCMP_SYS(setsid),
++        SCMP_SYS(setsockopt),
+ 	SCMP_SYS(socket),
+ 	SCMP_SYS(stat),
+ 	SCMP_SYS(time),
+@@ -1195,9 +1198,11 @@
+ 	SCMP_SYS(clock_settime),
+ 	SCMP_SYS(close),
+ 	SCMP_SYS(exit_group),
++	SCMP_SYS(fcntl),
+ 	SCMP_SYS(fsync),
+ 	SCMP_SYS(futex),
+ 	SCMP_SYS(getitimer),
++	SCMP_SYS(getpid),
+ 	SCMP_SYS(madvise),
+ 	SCMP_SYS(mmap),
+ 	SCMP_SYS(mmap2),
+@@ -1211,6 +1216,7 @@
+ 	SCMP_SYS(select),
+ 	SCMP_SYS(setitimer),
+ 	SCMP_SYS(setsid),
++        SCMP_SYS(setsockopt),
+ 	SCMP_SYS(sigprocmask),
+ 	SCMP_SYS(sigreturn),
+ 	SCMP_SYS(socketcall),
diff --git a/pkgs/tools/networking/strongswan/default.nix b/pkgs/tools/networking/strongswan/default.nix
index 7da47e339d08..5a9cf8f1f4b1 100644
--- a/pkgs/tools/networking/strongswan/default.nix
+++ b/pkgs/tools/networking/strongswan/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "strongswan-${version}";
-  version = "5.5.1";
+  version = "5.5.2";
 
   src = fetchurl {
     url = "http://download.strongswan.org/${name}.tar.bz2";
-    sha256 = "1drahhmwz1jg14rfh67cl231dlg2a9pra6jmipfxwyzpj4ck02vj";
+    sha256 = "0slzrr5amn1rs9lrjca0fv5n1ya5jwlspfiqg9xzq1bghg56z5ys";
   };
 
   dontPatchELF = true;
diff --git a/pkgs/tools/system/pciutils/default.nix b/pkgs/tools/system/pciutils/default.nix
index dd1070495786..998a3bdf6d1d 100644
--- a/pkgs/tools/system/pciutils/default.nix
+++ b/pkgs/tools/system/pciutils/default.nix
@@ -1,15 +1,13 @@
 { stdenv, fetchurl, pkgconfig, zlib, kmod, which }:
 
 stdenv.mkDerivation rec {
-  name = "pciutils-3.5.2"; # with database from 2016-10
+  name = "pciutils-3.5.4"; # with database from 2017-02
 
   src = fetchurl {
     url = "mirror://kernel/software/utils/pciutils/${name}.tar.xz";
-    sha256 = "1z2y4f3cyvm7a0dyan0n6jpb3p9pvh35lrim0058slj0kwd1969s";
+    sha256 = "0rpy7kkb2y89wmbcbfjjjxsk2x89v5xxhxib4vpl131ip5m3qab4";
   };
 
-  patches = [ ./module-dir.diff ];
-
   buildInputs = [ pkgconfig zlib kmod which ];
 
   makeFlags = "SHARED=yes PREFIX=\${out}";
diff --git a/pkgs/tools/system/pciutils/module-dir.diff b/pkgs/tools/system/pciutils/module-dir.diff
deleted file mode 100644
index ea38b115b248..000000000000
--- a/pkgs/tools/system/pciutils/module-dir.diff
+++ /dev/null
@@ -1,23 +0,0 @@
-Don't override libkmod's way of finding modules.
-
-(We override that behavior in nixpkgs to fit nixos.)
-
-diff --git a/ls-kernel.c b/ls-kernel.c
-index 78b70f1..ecacd0e 100644
---- a/ls-kernel.c
-+++ b/ls-kernel.c
-@@ -29,13 +29,7 @@ show_kernel_init(void)
-   if (show_kernel_inited >= 0)
-     return show_kernel_inited;
- 
--  struct utsname uts;
--  if (uname(&uts) < 0)
--    die("uname() failed: %m");
--  char *name = alloca(64 + strlen(uts.release));
--  sprintf(name, "/lib/modules/%s", uts.release);
--
--  kmod_ctx = kmod_new(name, NULL);
-+  kmod_ctx = kmod_new(NULL, NULL);
-   if (!kmod_ctx)
-     {
-       fprintf(stderr, "lspci: Unable to initialize libkmod context\n");