7 files changed, 136 insertions, 9 deletions
diff --git a/pkgs/tools/misc/hdf4/default.nix b/pkgs/tools/misc/hdf4/default.nix
new file mode 100644
index 000000000000..a227030f0bc4
--- /dev/null
+++ b/pkgs/tools/misc/hdf4/default.nix
@@ -0,0 +1,76 @@
+{ stdenv
+, fetchurl
+, cmake
+, libjpeg
+, szip
+, zlib
+}:
+
+stdenv.mkDerivation rec {
+  name = "hdf-${version}";
+  version = "4.2.12";
+  src = fetchurl {
+    url = "https://support.hdfgroup.org/ftp/HDF/releases/HDF${version}/src/hdf-${version}.tar.bz2";
+    sha256 = "020jh563sjyxsgml8l809d2i1d4ms9shivwj3gbm7n0ilxbll8id";
+  };
+
+  buildInputs = [
+    cmake
+    libjpeg
+    szip
+    zlib
+  ];
+
+  preConfigure = "export SZIP_INSTALL=${szip}";
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON"
+    "-DBUILD_TESTING=ON"
+    "-DHDF4_BUILD_TOOLS=ON"
+    "-DHDF4_BUILD_UTILS=ON"
+    "-DHDF4_BUILD_WITH_INSTALL_NAME=OFF"
+    "-DHDF4_ENABLE_JPEG_LIB_SUPPORT=ON"
+    "-DHDF4_ENABLE_NETCDF=OFF"
+    "-DHDF4_ENABLE_SZIP_ENCODING=ON"
+    "-DHDF4_ENABLE_SZIP_SUPPORT=ON"
+    "-DHDF4_ENABLE_Z_LIB_SUPPORT=ON"
+    "-DHDF4_BUILD_FORTRAN=OFF"
+    "-DJPEG_DIR=${libjpeg}"
+  ];
+
+  doCheck = true;
+
+  preCheck = ''
+    export LD_LIBRARY_PATH=$(pwd)/bin
+  '' + stdenv.lib.optionalString (stdenv.isDarwin) ''
+    export DYLD_LIBRARY_PATH=$(pwd)/bin
+  '';
+
+  excludedTests = [
+    "MFHDF_TEST-hdftest"
+    "MFHDF_TEST-hdftest-shared"
+    "HDP-dumpsds-18"
+    "NC_TEST-nctest"
+  ];
+
+  checkPhase = let excludedTestsRegex = if (excludedTests != [])
+    then "(" + (stdenv.lib.concatStringsSep "|" excludedTests) + ")"
+    else ""; in ''
+    runHook preCheck
+    ctest -E "${excludedTestsRegex}" --output-on-failure
+    runHook postCheck
+  '';
+
+  outputs = [ "bin" "dev" "out" ];
+
+  postInstall = ''
+    moveToOutput bin "$bin"
+  '';
+
+  meta = {
+    description = "Data model, library, and file format for storing and managing data";
+    homepage = https://support.hdfgroup.org/products/hdf4/;
+    maintainers = with stdenv.lib.maintainers; [ knedlsepp ];
+    platforms = stdenv.lib.platforms.unix;
+  };
+}
diff --git a/pkgs/tools/networking/nzbget/default.nix b/pkgs/tools/networking/nzbget/default.nix
index e7a23b70ce9a..d72ee844c0ec 100644
--- a/pkgs/tools/networking/nzbget/default.nix
+++ b/pkgs/tools/networking/nzbget/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "nzbget-${version}";
-  version = "18.1";
+  version = "19.0";
 
   src = fetchurl {
     url = "http://github.com/nzbget/nzbget/releases/download/v${version}/nzbget-${version}-src.tar.gz";
-    sha256 = "069q75b0s9fzzy15m96dhn83jypgc91yx998rl0nykfcl7nzkxyx";
+    sha256 = "08kgi4zmh4h1pvxh8x4c3ydf9xl2s6ncm579f0wdm2zknvpf0j16";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/security/gen-oath-safe/default.nix b/pkgs/tools/security/gen-oath-safe/default.nix
new file mode 100644
index 000000000000..49770813b2b6
--- /dev/null
+++ b/pkgs/tools/security/gen-oath-safe/default.nix
@@ -0,0 +1,41 @@
+{ coreutils, fetchFromGitHub, libcaca, makeWrapper, python, openssl, qrencode, stdenv, yubikey-manager }:
+
+stdenv.mkDerivation {
+  name = "gen-oath-safe-2017-01-23";
+  src = fetchFromGitHub {
+    owner = "mcepl";
+    repo = "gen-oath-safe";
+    rev = "fb53841";
+    sha256 = "0018kqmhg0861r5xkbis2a1rx49gyn0dxcyj05wap5ms7zz69m0m";
+  };
+
+  buildInputs = [ makeWrapper ];
+
+  buildPhase = ":";
+
+  installPhase =
+    let
+      path = stdenv.lib.makeBinPath [
+        coreutils
+        libcaca.bin
+        openssl.bin
+        python
+        qrencode
+        yubikey-manager
+      ];
+    in
+    ''
+      mkdir -p $out/bin
+      cp gen-oath-safe $out/bin/
+      wrapProgram $out/bin/gen-oath-safe \
+        --prefix PATH : ${path}
+    '';
+  meta = with stdenv.lib; {
+    homepage = https://github.com/mcepl/gen-oath-safe;
+    description = "Script for generating HOTP/TOTP keys (and QR code)";
+    platforms =  platforms.unix;
+    license = licenses.mit;
+    maintainers = [ maintainers.makefu ];
+  };
+
+}
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index 05dbe6b7d84f..2555aeccea4c 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "tor-0.3.0.8";
+  name = "tor-0.3.0.9";
 
   src = fetchurl {
     url = "https://dist.torproject.org/${name}.tar.gz";
-    sha256 = "0j0dhq1zp6w6zy7y4kiw7zg1imbgv8nsl7imlzwc0951p2kknfk6";
+    sha256 = "0hhyb1wil8japynqnm07r1f67w3wdnafdg9amzlrrcfcyq5qim28";
   };
 
   outputs = [ "out" "geoip" ];
diff --git a/pkgs/tools/system/runit/default.nix b/pkgs/tools/system/runit/default.nix
index 03da7bc657f6..61c61226acd6 100644
--- a/pkgs/tools/system/runit/default.nix
+++ b/pkgs/tools/system/runit/default.nix
@@ -23,6 +23,9 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     sed -i "s,\(#define RUNIT\) .*,\1 \"$out/bin/runit\"," src/runit.h
+    # usernamespace sandbox of nix seems to conflict with runit's assumptions
+    # about unix users. Therefor skip the check
+    sed -i '/.\/chkshsgr/d' src/Makefile
   '' + stdenv.lib.optionalString (!static) ''
     sed -i 's,-static,,g' src/Makefile
   '';
diff --git a/pkgs/tools/typesetting/tex/texlive/combine.nix b/pkgs/tools/typesetting/tex/texlive/combine.nix
index c783316c6d55..9af1d6a59ffd 100644
--- a/pkgs/tools/typesetting/tex/texlive/combine.nix
+++ b/pkgs/tools/typesetting/tex/texlive/combine.nix
@@ -155,18 +155,24 @@ in buildEnv {
         --prefix PERL5LIB : "$out/share/texmf/scripts/texlive"
 
       # avoid using non-nix shebang in $target by calling interpreter
-      if [[ "$(head -c 2 $target)" = "#!" ]]; then
-        local cmdline="$(head -n 1 $target | sed 's/^\#\! *//;s/ *$//')"
+      if [[ "$(head -c 2 "$target")" = "#!" ]]; then
+        local cmdline="$(head -n 1 "$target" | sed 's/^\#\! *//;s/ *$//')"
         local relative=`basename "$cmdline" | sed 's/^env //' `
         local newInterp=`echo "$relative" | cut -d\  -f1`
         local params=`echo "$relative" | cut -d\  -f2- -s`
-        local newPath="$(type -P $newInterp)"
+        local newPath="$(type -P "$newInterp")"
         if [[ -z "$newPath" ]]; then
           echo " Warning: unknown shebang '$cmdline' in '$target'"
           continue
         fi
         echo " and patching shebang '$cmdline'"
         sed "s|^exec |exec $newPath $params |" -i "$link"
+
+      elif head -n 1 "$target" | grep -q 'exec perl'; then
+        # see #24343 for details of the problem
+        echo " and patching weird perl shebang"
+        sed "s|^exec |exec '${perl}/bin/perl' -w |" -i "$link"
+
       else
         sed 's|^exec |exec -a "$0" |' -i "$link"
         echo
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index 701ce7f67b2d..692f6b1772c7 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -4,7 +4,7 @@
 */
 { stdenv, lib, fetchurl, runCommand, writeText, buildEnv
 , callPackage, ghostscriptX, harfbuzz, poppler_min
-, makeWrapper, perl, python, ruby
+, makeWrapper, perl522, python, ruby
 , useFixedHashes ? true
 , recurseIntoAttrs
 }:
@@ -28,7 +28,8 @@ let
   # function for creating a working environment from a set of TL packages
   combine = import ./combine.nix {
     inherit bin combinePkgs buildEnv fastUnique lib makeWrapper writeText
-      perl stdenv python ruby;
+      stdenv python ruby;
+    perl = perl522; # avoid issues like #26890, probably remove after texlive upgrade
   };
 
   # the set of TeX Live packages, collections, and schemes; using upstream naming