Merge branch 'staging'

Main change: glibc: 2.25-x -> 2.26-y, containing security fixes, and various features and deprecations. Unfortunately, some of the latter still cause (transitively) a couple hundred newly failing jobs. I'm not delaying anymore, so that we have the security fix on master. I mainly patched gcc, llvm and icu, but I can't fix everything...
2017-11-07 15:57:54 +01:00 · 2017-11-07 15:57:54 +01:00 · 6ffafc78fb
parent 4db6d35891 f04b64c1e9
commit 6ffafc78fb
61 changed files with 1082 additions and 364 deletions
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@ -1,5 +1,5 @@
 #! @shell@
-set -eu -o pipefail
+set -eu -o pipefail +o posix
 shopt -s nullglob

 if (( "${NIX_DEBUG:-0}" >= 7 )); then
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@ -286,7 +286,7 @@ stdenv.mkDerivation {
        *) echo "Multiple dynamic linkers found for platform '${targetPlatform.config}'." >&2;;
      esac

-      if [ -n "$dynamicLinker" ]; then
+      if [ -n "''${dynamicLinker:-}" ]; then
        echo $dynamicLinker > $out/nix-support/dynamic-linker

    '' + (if targetPlatform.isDarwin then ''
--- a/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
@ -1,5 +1,5 @@
 #! @shell@
-set -eu -o pipefail
+set -eu -o pipefail +o posix
 shopt -s nullglob

 if (( "${NIX_DEBUG:-0}" >= 7 )); then
--- a/pkgs/build-support/cc-wrapper/gnatlink-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/gnatlink-wrapper.sh
@ -1,5 +1,5 @@
 #! @shell@
-set -eu -o pipefail
+set -eu -o pipefail +o posix
 shopt -s nullglob

 if (( "${NIX_DEBUG:-0}" >= 7 )); then
--- a/pkgs/build-support/cc-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
@ -1,5 +1,5 @@
 #! @shell@
-set -eu -o pipefail
+set -eu -o pipefail +o posix
 shopt -s nullglob

 if (( "${NIX_DEBUG:-0}" >= 7 )); then
--- a/pkgs/data/misc/dns-root-data/default.nix
+++ b/pkgs/data/misc/dns-root-data/default.nix
@ -4,7 +4,7 @@ let

  rootHints = fetchurl {
    url = "https://www.internic.net/domain/named.root";
-    sha256 = "01n4bqf95kbvig1hahqzmmdkpn4v7mzfc1p944gq922i5j3fjr92";
+    sha256 = "0vdrff4l8s8grif52dnh091s8qydhh88k25zqd9rj66sf1qwcwxl";
  };

  rootKey = ./root.key;
@ -13,7 +13,7 @@ let
 in

 stdenv.mkDerivation {
-  name = "dns-root-data-2017-08-29";
+  name = "dns-root-data-2017-10-24";

  buildCommand = ''
    mkdir $out
--- a/pkgs/desktops/gnome-3/misc/gitg/src.nix
+++ b/pkgs/desktops/gnome-3/misc/gitg/src.nix
@ -1,10 +1,10 @@
 # Autogenerated by maintainers/scripts/gnome.sh update

 fetchurl: {
-  name = "gitg-3.24.0";
+  name = "gitg-3.26.0";

  src = fetchurl {
-    url = mirror://gnome/sources/gitg/3.24/gitg-3.24.0.tar.xz;
-    sha256 = "3e4ec4a8ae83bc7ced8c7610927ade70e37daa5e8beeb4f357a6ea30b4cc951e";
+    url = mirror://gnome/sources/gitg/3.26/gitg-3.26.0.tar.xz;
+    sha256 = "26730d437d6a30d6e341b9e8da99d2134dce4b96022c195609f45062f82b54d5";
  };
 }
--- a/pkgs/desktops/gnome-3/misc/libgit2-glib/default.nix
+++ b/pkgs/desktops/gnome-3/misc/libgit2-glib/default.nix
@ -1,12 +1,14 @@
-{ stdenv, fetchurl, gnome3, libtool, pkgconfig, vala_0_32, libssh2
+{ stdenv, fetchurl, gnome3, libtool, pkgconfig, vala, libssh2
 , gtk_doc, gobjectIntrospection, libgit2, glib }:

 stdenv.mkDerivation rec {
  inherit (import ./src.nix fetchurl) name src;

-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ gnome3.gnome_common libtool vala_0_32 libssh2
-                  gtk_doc gobjectIntrospection libgit2 glib ];
+  nativeBuildInputs = [
+    gnome3.gnome_common libtool pkgconfig vala gtk_doc gobjectIntrospection
+  ];
+
+  buildInputs = [ libssh2 libgit2 glib ];

  meta = with stdenv.lib; {
    platforms = platforms.linux;
--- a/pkgs/desktops/gnome-3/misc/libgit2-glib/src.nix
+++ b/pkgs/desktops/gnome-3/misc/libgit2-glib/src.nix
@ -1,12 +1,10 @@
 # Autogenerated by maintainers/scripts/gnome.sh update

-fetchurl: rec {
-  major = "0.25";
-  minor = "0";
-  name = "libgit2-glib-${major}.${minor}";
+fetchurl: {
+  name = "libgit2-glib-0.26.0";

  src = fetchurl {
-    url = "mirror://gnome/sources/libgit2-glib/${major}/${name}.tar.xz";
-    sha256 = "0rf5gcr3khp35wj9ax9cbyq5j3iiwa1l0fi16w6sfgmrryd6n9aa";
+    url = mirror://gnome/sources/libgit2-glib/0.26/libgit2-glib-0.26.0.tar.xz;
+    sha256 = "06b16cfcc3a53d9804858618d690e5509e9af2e2245b75f0479cadbbe39745c3";
  };
 }
--- a/pkgs/development/compilers/gcc/4.5/default.nix
+++ b/pkgs/development/compilers/gcc/4.5/default.nix
@ -153,6 +153,7 @@ stdenv.mkDerivation ({
    # target libraries and tools.
    ++ optional langAda ../gnat-cflags.patch
    ++ optional langVhdl ./ghdl-ortho-cflags.patch
+    ++ [ ../struct-ucontext-4.5.patch ] # glibc-2.26
    ;

  postPatch =
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@ -78,7 +78,11 @@ let version = "4.8.5";
          sha256 = "01jd7pdarh54ki498g6sz64ijl9a1l5f9v8q2696aaxalvh2vwzl";
          excludes = [ "gcc/cp/ChangeLog" ];
        })]
-      ;
+      ++ [ # glibc-2.26
+        ../struct-ucontext-4.8.patch
+        ../sigsegv-not-declared.patch
+        ../res_state-not-declared.patch
+      ];

    javaEcj = fetchurl {
      # The `$(top_srcdir)/ecj.jar' file is automatically picked up at
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@ -72,6 +72,7 @@ let version = "4.9.4";
      # target libraries and tools.
      ++ optional langAda ../gnat-cflags.patch
      ++ optional langFortran ../gfortran-driving.patch
+      ++ [ ../struct-ucontext.patch ../struct-sigaltstack-4.9.patch ] # glibc-2.26
      ;

    javaEcj = fetchurl {
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@ -72,7 +72,9 @@ let version = "6.4.0";
      # The GNAT Makefiles did not pay attention to CFLAGS_FOR_TARGET for its
      # target libraries and tools.
      ++ optional langAda ../gnat-cflags.patch
-      ++ optional langFortran ../gfortran-driving.patch;
+      ++ optional langFortran ../gfortran-driving.patch
+      ++ [ ../struct-ucontext.patch ../struct-sigaltstack.patch ] # glibc-2.26
+      ;

    javaEcj = fetchurl {
      # The `$(top_srcdir)/ecj.jar' file is automatically picked up at
--- a/pkgs/development/compilers/gcc/res_state-not-declared.patch
+++ b/pkgs/development/compilers/gcc/res_state-not-declared.patch
@ -0,0 +1,13 @@
+diff --git a/libsanitizer/tsan/tsan_platform_linux.cc b/libsanitizer/tsan/tsan_platform_linux.cc
+index fe69430..49f5270 100644
+--- a/libsanitizer/tsan/tsan_platform_linux.cc
+++ b/libsanitizer/tsan/tsan_platform_linux.cc
+@@ -351,7 +351,7 @@ bool IsGlobalVar(uptr addr) {
+ // closes within glibc. The code is a pure hack.
+ int ExtractResolvFDs(void *state, int *fds, int nfd) {
+   int cnt = 0;
+-  __res_state *statp = (__res_state*)state;
+  struct __res_state *statp = (struct __res_state*)state;
+   for (int i = 0; i < MAXNS && cnt < nfd; i++) {
+     if (statp->_u._ext.nsaddrs[i] && statp->_u._ext.nssocks[i] != -1)
+       fds[cnt++] = statp->_u._ext.nssocks[i];
--- a/pkgs/development/compilers/gcc/sigsegv-not-declared.patch
+++ b/pkgs/development/compilers/gcc/sigsegv-not-declared.patch
@ -0,0 +1,13 @@
+error: 'SIGSEGV' was not declared in this scope
+diff --git a/libsanitizer/asan/asan_linux.cc b/libsanitizer/asan/asan_linux.cc
+index 0692eb1..472f734 100644
+--- a/libsanitizer/asan/asan_linux.cc
+++ b/libsanitizer/asan/asan_linux.cc
+@@ -26,6 +26,7 @@
+ #include <sys/types.h>
+ #include <fcntl.h>
+ #include <pthread.h>
+#include <signal.h>
+ #include <stdio.h>
+ #include <unistd.h>
+ #include <unwind.h>
--- a/pkgs/development/compilers/gcc/struct-sigaltstack-4.9.patch
+++ b/pkgs/development/compilers/gcc/struct-sigaltstack-4.9.patch
@ -0,0 +1,78 @@
+hand-resolved trivial conflicts for 4.9 from the upstream patch
+72edc2c02f8b4768ad660f46a1c7e2400c0a8e06
+diff --git a/libsanitizer/sanitizer_common/sanitizer_linux.cc b/libsanitizer/sanitizer_common/sanitizer_linux.cc
+index 69c9c10..8e53673 100644
+--- a/libsanitizer/sanitizer_common/sanitizer_linux.cc
+++ b/libsanitizer/sanitizer_common/sanitizer_linux.cc
+@@ -599,8 +599,7 @@ uptr internal_prctl(int option, uptr arg2, uptr arg3, uptr arg4, uptr arg5) {
+   return internal_syscall(__NR_prctl, option, arg2, arg3, arg4, arg5);
+ }
+ 
+-uptr internal_sigaltstack(const struct sigaltstack *ss,
+-                         struct sigaltstack *oss) {
+uptr internal_sigaltstack(const void *ss, void *oss) {
+   return internal_syscall(__NR_sigaltstack, (uptr)ss, (uptr)oss);
+ }
+ 
+diff --git a/libsanitizer/sanitizer_common/sanitizer_linux.h b/libsanitizer/sanitizer_common/sanitizer_linux.h
+index 6422df1..8e111d1 100644
+--- a/libsanitizer/sanitizer_common/sanitizer_linux.h
+++ b/libsanitizer/sanitizer_common/sanitizer_linux.h
+@@ -18,7 +18,6 @@
+ #include "sanitizer_platform_limits_posix.h"
+ 
+ struct link_map;  // Opaque type returned by dlopen().
+-struct sigaltstack;
+ 
+ namespace __sanitizer {
+ // Dirent structure for getdents(). Note that this structure is different from
+@@ -28,8 +27,7 @@ struct linux_dirent;
+ // Syscall wrappers.
+ uptr internal_getdents(fd_t fd, struct linux_dirent *dirp, unsigned int count);
+ uptr internal_prctl(int option, uptr arg2, uptr arg3, uptr arg4, uptr arg5);
+-uptr internal_sigaltstack(const struct sigaltstack* ss,
+-                          struct sigaltstack* oss);
+uptr internal_sigaltstack(const void* ss, void* oss);
+ uptr internal_sigaction(int signum, const __sanitizer_kernel_sigaction_t *act,
+     __sanitizer_kernel_sigaction_t *oldact);
+ uptr internal_sigprocmask(int how, __sanitizer_kernel_sigset_t *set,
+diff --git a/libsanitizer/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc b/libsanitizer/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc
+index 891386dc..234e8c6 100644
+--- a/libsanitizer/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc
+++ b/libsanitizer/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc
+@@ -273,7 +273,7 @@ static int TracerThread(void* argument) {
+ 
+   // Alternate stack for signal handling.
+   InternalScopedBuffer<char> handler_stack_memory(kHandlerStackSize);
+-  struct sigaltstack handler_stack;
+  stack_t handler_stack;
+   internal_memset(&handler_stack, 0, sizeof(handler_stack));
+   handler_stack.ss_sp = handler_stack_memory.data();
+   handler_stack.ss_size = kHandlerStackSize;
+diff --git a/libsanitizer/tsan/tsan_platform_linux.cc b/libsanitizer/tsan/tsan_platform_linux.cc
+index 2ed5718..6f972ab 100644
+--- a/libsanitizer/tsan/tsan_platform_linux.cc
+++ b/libsanitizer/tsan/tsan_platform_linux.cc
+@@ -287,7 +287,7 @@ void InitializePlatform() {
+ int ExtractResolvFDs(void *state, int *fds, int nfd) {
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+   int cnt = 0;
+-  __res_state *statp = (__res_state*)state;
+  struct __res_state *statp = (struct __res_state*)state;
+   for (int i = 0; i < MAXNS && cnt < nfd; i++) {
+     if (statp->_u._ext.nsaddrs[i] && statp->_u._ext.nssocks[i] != -1)
+       fds[cnt++] = statp->_u._ext.nssocks[i];
+
+error: 'SIGSEGV' was not declared in this scope
+diff --git a/libsanitizer/asan/asan_linux.cc b/libsanitizer/asan/asan_linux.cc
+index 0692eb1..472f734 100644
+--- a/libsanitizer/asan/asan_linux.cc
+++ b/libsanitizer/asan/asan_linux.cc
+@@ -26,6 +26,7 @@
+ #include <sys/types.h>
+ #include <fcntl.h>
+ #include <pthread.h>
+#include <signal.h>
+ #include <stdio.h>
+ #include <unistd.h>
+ #include <unwind.h>
--- a/pkgs/development/compilers/gcc/struct-sigaltstack.patch
+++ b/pkgs/development/compilers/gcc/struct-sigaltstack.patch
@ -0,0 +1,87 @@
+From 72edc2c02f8b4768ad660f46a1c7e2400c0a8e06 Mon Sep 17 00:00:00 2001
+From: jakub <jakub@138bc75d-0d04-0410-961f-82ee72b054a4>
+Date: Mon, 17 Jul 2017 19:41:08 +0000
+Subject: [PATCH] 	Backported from mainline 	2017-07-14  Jakub
+ Jelinek  <jakub@redhat.com>
+
+	PR sanitizer/81066
+	* sanitizer_common/sanitizer_linux.h: Cherry-pick upstream r307969.
+	* sanitizer_common/sanitizer_linux.cc: Likewise.
+	* sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc: Likewise.
+	* tsan/tsan_platform_linux.cc: Likewise.
+
+
+git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/branches/gcc-7-branch@250287 138bc75d-0d04-0410-961f-82ee72b054a4
+---
+ libsanitizer/ChangeLog  (REMOVED)                             | 11 +++++++++++
+ libsanitizer/sanitizer_common/sanitizer_linux.cc              |  3 +--
+ libsanitizer/sanitizer_common/sanitizer_linux.h               |  4 +---
+ .../sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc  |  2 +-
+ libsanitizer/tsan/tsan_platform_linux.cc                      |  2 +-
+ 5 files changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/libsanitizer/sanitizer_common/sanitizer_linux.cc b/libsanitizer/sanitizer_common/sanitizer_linux.cc
+index 806fcd5..5b6f186 100644
+--- a/libsanitizer/sanitizer_common/sanitizer_linux.cc
+++ b/libsanitizer/sanitizer_common/sanitizer_linux.cc
+@@ -605,8 +605,7 @@ uptr internal_prctl(int option, uptr arg2, uptr arg3, uptr arg4, uptr arg5) {
+ }
+ #endif
+ 
+-uptr internal_sigaltstack(const struct sigaltstack *ss,
+-                         struct sigaltstack *oss) {
+uptr internal_sigaltstack(const void *ss, void *oss) {
+   return internal_syscall(SYSCALL(sigaltstack), (uptr)ss, (uptr)oss);
+ }
+ 
+diff --git a/libsanitizer/sanitizer_common/sanitizer_linux.h b/libsanitizer/sanitizer_common/sanitizer_linux.h
+index 895bfc1..a42df57 100644
+--- a/libsanitizer/sanitizer_common/sanitizer_linux.h
+++ b/libsanitizer/sanitizer_common/sanitizer_linux.h
+@@ -19,7 +19,6 @@
+ #include "sanitizer_platform_limits_posix.h"
+ 
+ struct link_map;  // Opaque type returned by dlopen().
+-struct sigaltstack;
+ 
+ namespace __sanitizer {
+ // Dirent structure for getdents(). Note that this structure is different from
+@@ -28,8 +27,7 @@ struct linux_dirent;
+ 
+ // Syscall wrappers.
+ uptr internal_getdents(fd_t fd, struct linux_dirent *dirp, unsigned int count);
+-uptr internal_sigaltstack(const struct sigaltstack* ss,
+-                          struct sigaltstack* oss);
+uptr internal_sigaltstack(const void* ss, void* oss);
+ uptr internal_sigprocmask(int how, __sanitizer_sigset_t *set,
+     __sanitizer_sigset_t *oldset);
+ 
+diff --git a/libsanitizer/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc b/libsanitizer/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc
+index 891386dc..234e8c6 100644
+--- a/libsanitizer/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc
+++ b/libsanitizer/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc
+@@ -273,7 +273,7 @@ static int TracerThread(void* argument) {
+ 
+   // Alternate stack for signal handling.
+   InternalScopedBuffer<char> handler_stack_memory(kHandlerStackSize);
+-  struct sigaltstack handler_stack;
+  stack_t handler_stack;
+   internal_memset(&handler_stack, 0, sizeof(handler_stack));
+   handler_stack.ss_sp = handler_stack_memory.data();
+   handler_stack.ss_size = kHandlerStackSize;
+diff --git a/libsanitizer/tsan/tsan_platform_linux.cc b/libsanitizer/tsan/tsan_platform_linux.cc
+index 2ed5718..6f972ab 100644
+--- a/libsanitizer/tsan/tsan_platform_linux.cc
+++ b/libsanitizer/tsan/tsan_platform_linux.cc
+@@ -287,7 +287,7 @@ void InitializePlatform() {
+ int ExtractResolvFDs(void *state, int *fds, int nfd) {
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+   int cnt = 0;
+-  __res_state *statp = (__res_state*)state;
+  struct __res_state *statp = (struct __res_state*)state;
+   for (int i = 0; i < MAXNS && cnt < nfd; i++) {
+     if (statp->_u._ext.nsaddrs[i] && statp->_u._ext.nssocks[i] != -1)
+       fds[cnt++] = statp->_u._ext.nssocks[i];
+-- 
+2.9.3
+
--- a/pkgs/development/compilers/gcc/struct-ucontext-4.5.patch
+++ b/pkgs/development/compilers/gcc/struct-ucontext-4.5.patch
@ -0,0 +1,107 @@
+Trivally backported the upstream commit
+b685411208e0aaa79190d54faf945763514706b8
+(different directory, some files not present, etc.)
+We only really use x86* from those, probably, so I didn't bother much.
+diff --git a/gcc/config/alpha/linux-unwind.h b/gcc/config/alpha/linux-unwind.h
+index bdbba4a..e84812e 100644
+--- a/gcc/config/alpha/linux-unwind.h
+++ b/gcc/config/alpha/linux-unwind.h
+@@ -51,7 +51,7 @@ alpha_fallback_frame_state (struct _Unwind_Context *context,
+     {
+       struct rt_sigframe {
+ 	siginfo_t info;
+-	struct ucontext uc;
+	ucontext_t uc;
+       } *rt_ = context->cfa;
+       sc = &rt_->uc.uc_mcontext;
+     }
+diff --git a/gcc/config/bfin/linux-unwind.h b/gcc/config/bfin/linux-unwind.h
+index 77b7c23..8bf5e82 100644
+--- a/gcc/config/bfin/linux-unwind.h
+++ b/gcc/config/bfin/linux-unwind.h
+@@ -52,7 +52,7 @@ bfin_fallback_frame_state (struct _Unwind_Context *context,
+ 	void *puc;
+ 	char retcode[8];
+ 	siginfo_t info;
+-	struct ucontext uc;
+	ucontext_t uc;
+       } *rt_ = context->cfa;
+ 
+       /* The void * cast is necessary to avoid an aliasing warning.
+diff --git a/gcc/config/i386/linux-unwind.h b/gcc/config/i386/linux-unwind.h
+index 540a0a2..29efbe3 100644
+--- a/gcc/config/i386/linux-unwind.h
+++ b/gcc/config/i386/linux-unwind.h
+@@ -58,7 +58,7 @@ x86_64_fallback_frame_state (struct _Unwind_Context *context,
+   if (*(unsigned char *)(pc+0) == 0x48
+       && *(unsigned long long *)(pc+1) == RT_SIGRETURN_SYSCALL)
+     {
+-      struct ucontext *uc_ = context->cfa;
+      ucontext_t *uc_ = context->cfa;
+       /* The void * cast is necessary to avoid an aliasing warning.
+          The aliasing warning is correct, but should not be a problem
+          because it does not alias anything.  */
+@@ -138,7 +138,7 @@ x86_fallback_frame_state (struct _Unwind_Context *context,
+ 	siginfo_t *pinfo;
+ 	void *puc;
+ 	siginfo_t info;
+-	struct ucontext uc;
+	ucontext_t uc;
+       } *rt_ = context->cfa;
+       /* The void * cast is necessary to avoid an aliasing warning.
+          The aliasing warning is correct, but should not be a problem
+diff --git a/gcc/config/m68k/linux-unwind.h b/gcc/config/m68k/linux-unwind.h
+index 75b7cf7..f964e24 100644
+--- a/gcc/config/m68k/linux-unwind.h
+++ b/gcc/config/m68k/linux-unwind.h
+@@ -33,7 +33,7 @@ see the files COPYING3 and COPYING.RUNTIME respectively.  If not, see
+ /* <sys/ucontext.h> is unfortunately broken right now.  */
+ struct uw_ucontext {
+ 	unsigned long	  uc_flags;
+-	struct ucontext  *uc_link;
+	ucontext_t	 *uc_link;
+ 	stack_t		  uc_stack;
+ 	mcontext_t	  uc_mcontext;
+ 	unsigned long	  uc_filler[80];
+diff --git a/gcc/config/pa/linux-unwind.h b/gcc/config/pa/linux-unwind.h
+index 9a2657f..e47493d 100644
+--- a/gcc/config/pa/linux-unwind.h
+++ b/gcc/config/pa/linux-unwind.h
+@@ -80,7 +80,7 @@ pa32_fallback_frame_state (struct _Unwind_Context *context,
+   struct sigcontext *sc;
+   struct rt_sigframe {
+     siginfo_t info;
+-    struct ucontext uc;
+    ucontext_t uc;
+   } *frame;
+ 
+   /* rt_sigreturn trampoline:
+diff --git a/gcc/config/sh/linux-unwind.h b/gcc/config/sh/linux-unwind.h
+index e389cac..0bf43ba 100644
+--- a/gcc/config/sh/linux-unwind.h
+++ b/gcc/config/sh/linux-unwind.h
+@@ -180,7 +180,7 @@ sh_fallback_frame_state (struct _Unwind_Context *context,
+     {
+       struct rt_sigframe {
+ 	siginfo_t info;
+-	struct ucontext uc;
+	ucontext_t uc;
+       } *rt_ = context->cfa;
+       /* The void * cast is necessary to avoid an aliasing warning.
+          The aliasing warning is correct, but should not be a problem
+diff --git a/gcc/config/xtensa/linux-unwind.h b/gcc/config/xtensa/linux-unwind.h
+index 9872492..586a9d4 100644
+--- a/gcc/config/xtensa/linux-unwind.h
+++ b/gcc/config/xtensa/linux-unwind.h
+@@ -67,7 +67,7 @@ xtensa_fallback_frame_state (struct _Unwind_Context *context,
+ 
+   struct rt_sigframe {
+     siginfo_t info;
+-    struct ucontext uc;
+    ucontext_t uc;
+   } *rt_;
+ 
+   /* movi a2, __NR_rt_sigreturn; syscall */
+-- 
+2.9.3
+
--- a/pkgs/development/compilers/gcc/struct-ucontext-4.8.patch
+++ b/pkgs/development/compilers/gcc/struct-ucontext-4.8.patch
@ -0,0 +1,177 @@
+From b685411208e0aaa79190d54faf945763514706b8 Mon Sep 17 00:00:00 2001
+From: jsm28 <jsm28@138bc75d-0d04-0410-961f-82ee72b054a4>
+Date: Tue, 4 Jul 2017 10:23:57 +0000
+Subject: [PATCH] Use ucontext_t not struct ucontext in linux-unwind.h files.
+
+Current glibc no longer gives the ucontext_t type the tag struct
+ucontext, to conform with POSIX namespace rules.  This requires
+various linux-unwind.h files in libgcc, that were previously using
+struct ucontext, to be fixed to use ucontext_t instead.  This is
+similar to the removal of the struct siginfo tag from siginfo_t some
+years ago.
+
+This patch changes those files to use ucontext_t instead.  As the
+standard name that should be unconditionally safe, so this is not
+restricted to architectures supported by glibc, or conditioned on the
+glibc version.
+
+Tested compilation together with current glibc with glibc's
+build-many-glibcs.py.
+
+	* config/aarch64/linux-unwind.h (aarch64_fallback_frame_state),
+	config/alpha/linux-unwind.h (alpha_fallback_frame_state),
+	config/bfin/linux-unwind.h (bfin_fallback_frame_state),
+	config/i386/linux-unwind.h (x86_64_fallback_frame_state,
+	x86_fallback_frame_state), config/m68k/linux-unwind.h (struct
+	uw_ucontext), config/nios2/linux-unwind.h (struct nios2_ucontext),
+	config/pa/linux-unwind.h (pa32_fallback_frame_state),
+	config/sh/linux-unwind.h (sh_fallback_frame_state),
+	config/tilepro/linux-unwind.h (tile_fallback_frame_state),
+	config/xtensa/linux-unwind.h (xtensa_fallback_frame_state): Use
+	ucontext_t instead of struct ucontext.
+
+
+git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/branches/gcc-6-branch@249957 138bc75d-0d04-0410-961f-82ee72b054a4
+---
+ libgcc/ChangeLog     (REMOVED)       | 14 ++++++++++++++
+ libgcc/config/aarch64/linux-unwind.h |  2 +-
+ libgcc/config/alpha/linux-unwind.h   |  2 +-
+ libgcc/config/bfin/linux-unwind.h    |  2 +-
+ libgcc/config/i386/linux-unwind.h    |  4 ++--
+ libgcc/config/m68k/linux-unwind.h    |  2 +-
+ libgcc/config/nios2/linux-unwind.h   |  2 +-
+ libgcc/config/pa/linux-unwind.h      |  2 +-
+ libgcc/config/sh/linux-unwind.h      |  2 +-
+ libgcc/config/tilepro/linux-unwind.h |  2 +-
+ libgcc/config/xtensa/linux-unwind.h  |  2 +-
+ 11 files changed, 25 insertions(+), 11 deletions(-)
+
+diff --git a/libgcc/config/aarch64/linux-unwind.h b/libgcc/config/aarch64/linux-unwind.h
+index 4512efb..06de45a 100644
+--- a/libgcc/config/aarch64/linux-unwind.h
+++ b/libgcc/config/aarch64/linux-unwind.h
+@@ -52,7 +52,7 @@ aarch64_fallback_frame_state (struct _Unwind_Context *context,
+   struct rt_sigframe
+   {
+     siginfo_t info;
+-    struct ucontext uc;
+    ucontext_t uc;
+   };
+ 
+   struct rt_sigframe *rt_;
+diff --git a/libgcc/config/alpha/linux-unwind.h b/libgcc/config/alpha/linux-unwind.h
+index bdbba4a..e84812e 100644
+--- a/libgcc/config/alpha/linux-unwind.h
+++ b/libgcc/config/alpha/linux-unwind.h
+@@ -51,7 +51,7 @@ alpha_fallback_frame_state (struct _Unwind_Context *context,
+     {
+       struct rt_sigframe {
+ 	siginfo_t info;
+-	struct ucontext uc;
+	ucontext_t uc;
+       } *rt_ = context->cfa;
+       sc = &rt_->uc.uc_mcontext;
+     }
+diff --git a/libgcc/config/bfin/linux-unwind.h b/libgcc/config/bfin/linux-unwind.h
+index 77b7c23..8bf5e82 100644
+--- a/libgcc/config/bfin/linux-unwind.h
+++ b/libgcc/config/bfin/linux-unwind.h
+@@ -52,7 +52,7 @@ bfin_fallback_frame_state (struct _Unwind_Context *context,
+ 	void *puc;
+ 	char retcode[8];
+ 	siginfo_t info;
+-	struct ucontext uc;
+	ucontext_t uc;
+       } *rt_ = context->cfa;
+ 
+       /* The void * cast is necessary to avoid an aliasing warning.
+diff --git a/libgcc/config/i386/linux-unwind.h b/libgcc/config/i386/linux-unwind.h
+index 540a0a2..29efbe3 100644
+--- a/libgcc/config/i386/linux-unwind.h
+++ b/libgcc/config/i386/linux-unwind.h
+@@ -58,7 +58,7 @@ x86_64_fallback_frame_state (struct _Unwind_Context *context,
+   if (*(unsigned char *)(pc+0) == 0x48
+       && *(unsigned long long *)(pc+1) == RT_SIGRETURN_SYSCALL)
+     {
+-      struct ucontext *uc_ = context->cfa;
+      ucontext_t *uc_ = context->cfa;
+       /* The void * cast is necessary to avoid an aliasing warning.
+          The aliasing warning is correct, but should not be a problem
+          because it does not alias anything.  */
+@@ -138,7 +138,7 @@ x86_fallback_frame_state (struct _Unwind_Context *context,
+ 	siginfo_t *pinfo;
+ 	void *puc;
+ 	siginfo_t info;
+-	struct ucontext uc;
+	ucontext_t uc;
+       } *rt_ = context->cfa;
+       /* The void * cast is necessary to avoid an aliasing warning.
+          The aliasing warning is correct, but should not be a problem
+diff --git a/libgcc/config/m68k/linux-unwind.h b/libgcc/config/m68k/linux-unwind.h
+index 75b7cf7..f964e24 100644
+--- a/libgcc/config/m68k/linux-unwind.h
+++ b/libgcc/config/m68k/linux-unwind.h
+@@ -33,7 +33,7 @@ see the files COPYING3 and COPYING.RUNTIME respectively.  If not, see
+ /* <sys/ucontext.h> is unfortunately broken right now.  */
+ struct uw_ucontext {
+ 	unsigned long	  uc_flags;
+-	struct ucontext  *uc_link;
+	ucontext_t	 *uc_link;
+ 	stack_t		  uc_stack;
+ 	mcontext_t	  uc_mcontext;
+ 	unsigned long	  uc_filler[80];
+diff --git a/libgcc/config/pa/linux-unwind.h b/libgcc/config/pa/linux-unwind.h
+index 9a2657f..e47493d 100644
+--- a/libgcc/config/pa/linux-unwind.h
+++ b/libgcc/config/pa/linux-unwind.h
+@@ -80,7 +80,7 @@ pa32_fallback_frame_state (struct _Unwind_Context *context,
+   struct sigcontext *sc;
+   struct rt_sigframe {
+     siginfo_t info;
+-    struct ucontext uc;
+    ucontext_t uc;
+   } *frame;
+ 
+   /* rt_sigreturn trampoline:
+diff --git a/libgcc/config/sh/linux-unwind.h b/libgcc/config/sh/linux-unwind.h
+index e389cac..0bf43ba 100644
+--- a/libgcc/config/sh/linux-unwind.h
+++ b/libgcc/config/sh/linux-unwind.h
+@@ -180,7 +180,7 @@ sh_fallback_frame_state (struct _Unwind_Context *context,
+     {
+       struct rt_sigframe {
+ 	siginfo_t info;
+-	struct ucontext uc;
+	ucontext_t uc;
+       } *rt_ = context->cfa;
+       /* The void * cast is necessary to avoid an aliasing warning.
+          The aliasing warning is correct, but should not be a problem
+diff --git a/libgcc/config/tilepro/linux-unwind.h b/libgcc/config/tilepro/linux-unwind.h
+index 796e976..75f8890 100644
+--- a/libgcc/config/tilepro/linux-unwind.h
+++ b/libgcc/config/tilepro/linux-unwind.h
+@@ -61,7 +61,7 @@ tile_fallback_frame_state (struct _Unwind_Context *context,
+   struct rt_sigframe {
+     unsigned char save_area[C_ABI_SAVE_AREA_SIZE];
+     siginfo_t info;
+-    struct ucontext uc;
+    ucontext_t uc;
+   } *rt_;
+ 
+   /* Return if this is not a signal handler.  */
+diff --git a/libgcc/config/xtensa/linux-unwind.h b/libgcc/config/xtensa/linux-unwind.h
+index 9872492..586a9d4 100644
+--- a/libgcc/config/xtensa/linux-unwind.h
+++ b/libgcc/config/xtensa/linux-unwind.h
+@@ -67,7 +67,7 @@ xtensa_fallback_frame_state (struct _Unwind_Context *context,
+ 
+   struct rt_sigframe {
+     siginfo_t info;
+-    struct ucontext uc;
+    ucontext_t uc;
+   } *rt_;
+ 
+   /* movi a2, __NR_rt_sigreturn; syscall */
+-- 
+2.9.3
+
--- a/pkgs/development/compilers/gcc/struct-ucontext.patch
+++ b/pkgs/development/compilers/gcc/struct-ucontext.patch
@ -0,0 +1,190 @@
+From b685411208e0aaa79190d54faf945763514706b8 Mon Sep 17 00:00:00 2001
+From: jsm28 <jsm28@138bc75d-0d04-0410-961f-82ee72b054a4>
+Date: Tue, 4 Jul 2017 10:23:57 +0000
+Subject: [PATCH] Use ucontext_t not struct ucontext in linux-unwind.h files.
+
+Current glibc no longer gives the ucontext_t type the tag struct
+ucontext, to conform with POSIX namespace rules.  This requires
+various linux-unwind.h files in libgcc, that were previously using
+struct ucontext, to be fixed to use ucontext_t instead.  This is
+similar to the removal of the struct siginfo tag from siginfo_t some
+years ago.
+
+This patch changes those files to use ucontext_t instead.  As the
+standard name that should be unconditionally safe, so this is not
+restricted to architectures supported by glibc, or conditioned on the
+glibc version.
+
+Tested compilation together with current glibc with glibc's
+build-many-glibcs.py.
+
+	* config/aarch64/linux-unwind.h (aarch64_fallback_frame_state),
+	config/alpha/linux-unwind.h (alpha_fallback_frame_state),
+	config/bfin/linux-unwind.h (bfin_fallback_frame_state),
+	config/i386/linux-unwind.h (x86_64_fallback_frame_state,
+	x86_fallback_frame_state), config/m68k/linux-unwind.h (struct
+	uw_ucontext), config/nios2/linux-unwind.h (struct nios2_ucontext),
+	config/pa/linux-unwind.h (pa32_fallback_frame_state),
+	config/sh/linux-unwind.h (sh_fallback_frame_state),
+	config/tilepro/linux-unwind.h (tile_fallback_frame_state),
+	config/xtensa/linux-unwind.h (xtensa_fallback_frame_state): Use
+	ucontext_t instead of struct ucontext.
+
+
+git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/branches/gcc-6-branch@249957 138bc75d-0d04-0410-961f-82ee72b054a4
+---
+ libgcc/ChangeLog     (REMOVED)       | 14 ++++++++++++++
+ libgcc/config/aarch64/linux-unwind.h |  2 +-
+ libgcc/config/alpha/linux-unwind.h   |  2 +-
+ libgcc/config/bfin/linux-unwind.h    |  2 +-
+ libgcc/config/i386/linux-unwind.h    |  4 ++--
+ libgcc/config/m68k/linux-unwind.h    |  2 +-
+ libgcc/config/nios2/linux-unwind.h   |  2 +-
+ libgcc/config/pa/linux-unwind.h      |  2 +-
+ libgcc/config/sh/linux-unwind.h      |  2 +-
+ libgcc/config/tilepro/linux-unwind.h |  2 +-
+ libgcc/config/xtensa/linux-unwind.h  |  2 +-
+ 11 files changed, 25 insertions(+), 11 deletions(-)
+
+diff --git a/libgcc/config/aarch64/linux-unwind.h b/libgcc/config/aarch64/linux-unwind.h
+index 4512efb..06de45a 100644
+--- a/libgcc/config/aarch64/linux-unwind.h
+++ b/libgcc/config/aarch64/linux-unwind.h
+@@ -52,7 +52,7 @@ aarch64_fallback_frame_state (struct _Unwind_Context *context,
+   struct rt_sigframe
+   {
+     siginfo_t info;
+-    struct ucontext uc;
+    ucontext_t uc;
+   };
+ 
+   struct rt_sigframe *rt_;
+diff --git a/libgcc/config/alpha/linux-unwind.h b/libgcc/config/alpha/linux-unwind.h
+index bdbba4a..e84812e 100644
+--- a/libgcc/config/alpha/linux-unwind.h
+++ b/libgcc/config/alpha/linux-unwind.h
+@@ -51,7 +51,7 @@ alpha_fallback_frame_state (struct _Unwind_Context *context,
+     {
+       struct rt_sigframe {
+ 	siginfo_t info;
+-	struct ucontext uc;
+	ucontext_t uc;
+       } *rt_ = context->cfa;
+       sc = &rt_->uc.uc_mcontext;
+     }
+diff --git a/libgcc/config/bfin/linux-unwind.h b/libgcc/config/bfin/linux-unwind.h
+index 77b7c23..8bf5e82 100644
+--- a/libgcc/config/bfin/linux-unwind.h
+++ b/libgcc/config/bfin/linux-unwind.h
+@@ -52,7 +52,7 @@ bfin_fallback_frame_state (struct _Unwind_Context *context,
+ 	void *puc;
+ 	char retcode[8];
+ 	siginfo_t info;
+-	struct ucontext uc;
+	ucontext_t uc;
+       } *rt_ = context->cfa;
+ 
+       /* The void * cast is necessary to avoid an aliasing warning.
+diff --git a/libgcc/config/i386/linux-unwind.h b/libgcc/config/i386/linux-unwind.h
+index 540a0a2..29efbe3 100644
+--- a/libgcc/config/i386/linux-unwind.h
+++ b/libgcc/config/i386/linux-unwind.h
+@@ -58,7 +58,7 @@ x86_64_fallback_frame_state (struct _Unwind_Context *context,
+   if (*(unsigned char *)(pc+0) == 0x48
+       && *(unsigned long long *)(pc+1) == RT_SIGRETURN_SYSCALL)
+     {
+-      struct ucontext *uc_ = context->cfa;
+      ucontext_t *uc_ = context->cfa;
+       /* The void * cast is necessary to avoid an aliasing warning.
+          The aliasing warning is correct, but should not be a problem
+          because it does not alias anything.  */
+@@ -138,7 +138,7 @@ x86_fallback_frame_state (struct _Unwind_Context *context,
+ 	siginfo_t *pinfo;
+ 	void *puc;
+ 	siginfo_t info;
+-	struct ucontext uc;
+	ucontext_t uc;
+       } *rt_ = context->cfa;
+       /* The void * cast is necessary to avoid an aliasing warning.
+          The aliasing warning is correct, but should not be a problem
+diff --git a/libgcc/config/m68k/linux-unwind.h b/libgcc/config/m68k/linux-unwind.h
+index 75b7cf7..f964e24 100644
+--- a/libgcc/config/m68k/linux-unwind.h
+++ b/libgcc/config/m68k/linux-unwind.h
+@@ -33,7 +33,7 @@ see the files COPYING3 and COPYING.RUNTIME respectively.  If not, see
+ /* <sys/ucontext.h> is unfortunately broken right now.  */
+ struct uw_ucontext {
+ 	unsigned long	  uc_flags;
+-	struct ucontext  *uc_link;
+	ucontext_t	 *uc_link;
+ 	stack_t		  uc_stack;
+ 	mcontext_t	  uc_mcontext;
+ 	unsigned long	  uc_filler[80];
+diff --git a/libgcc/config/nios2/linux-unwind.h b/libgcc/config/nios2/linux-unwind.h
+index 2304142..30f25ea 100644
+--- a/libgcc/config/nios2/linux-unwind.h
+++ b/libgcc/config/nios2/linux-unwind.h
+@@ -38,7 +38,7 @@ struct nios2_mcontext {
+ 
+ struct nios2_ucontext {
+   unsigned long uc_flags;
+-  struct ucontext *uc_link;
+  ucontext_t *uc_link;
+   stack_t uc_stack;
+   struct nios2_mcontext uc_mcontext;
+   sigset_t uc_sigmask;	/* mask last for extensibility */
+diff --git a/libgcc/config/pa/linux-unwind.h b/libgcc/config/pa/linux-unwind.h
+index 9a2657f..e47493d 100644
+--- a/libgcc/config/pa/linux-unwind.h
+++ b/libgcc/config/pa/linux-unwind.h
+@@ -80,7 +80,7 @@ pa32_fallback_frame_state (struct _Unwind_Context *context,
+   struct sigcontext *sc;
+   struct rt_sigframe {
+     siginfo_t info;
+-    struct ucontext uc;
+    ucontext_t uc;
+   } *frame;
+ 
+   /* rt_sigreturn trampoline:
+diff --git a/libgcc/config/sh/linux-unwind.h b/libgcc/config/sh/linux-unwind.h
+index e389cac..0bf43ba 100644
+--- a/libgcc/config/sh/linux-unwind.h
+++ b/libgcc/config/sh/linux-unwind.h
+@@ -180,7 +180,7 @@ sh_fallback_frame_state (struct _Unwind_Context *context,
+     {
+       struct rt_sigframe {
+ 	siginfo_t info;
+-	struct ucontext uc;
+	ucontext_t uc;
+       } *rt_ = context->cfa;
+       /* The void * cast is necessary to avoid an aliasing warning.
+          The aliasing warning is correct, but should not be a problem
+diff --git a/libgcc/config/tilepro/linux-unwind.h b/libgcc/config/tilepro/linux-unwind.h
+index 796e976..75f8890 100644
+--- a/libgcc/config/tilepro/linux-unwind.h
+++ b/libgcc/config/tilepro/linux-unwind.h
+@@ -61,7 +61,7 @@ tile_fallback_frame_state (struct _Unwind_Context *context,
+   struct rt_sigframe {
+     unsigned char save_area[C_ABI_SAVE_AREA_SIZE];
+     siginfo_t info;
+-    struct ucontext uc;
+    ucontext_t uc;
+   } *rt_;
+ 
+   /* Return if this is not a signal handler.  */
+diff --git a/libgcc/config/xtensa/linux-unwind.h b/libgcc/config/xtensa/linux-unwind.h
+index 9872492..586a9d4 100644
+--- a/libgcc/config/xtensa/linux-unwind.h
+++ b/libgcc/config/xtensa/linux-unwind.h
+@@ -67,7 +67,7 @@ xtensa_fallback_frame_state (struct _Unwind_Context *context,
+ 
+   struct rt_sigframe {
+     siginfo_t info;
+-    struct ucontext uc;
+    ucontext_t uc;
+   } *rt_;
+ 
+   /* movi a2, __NR_rt_sigreturn; syscall */
+-- 
+2.9.3
+
--- a/pkgs/development/compilers/llvm/3.7/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.7/llvm.nix
@ -1,5 +1,6 @@
 { stdenv
 , fetch
+, fetchpatch
 , perl
 , groff
 , cmake
@ -45,6 +46,18 @@ in stdenv.mkDerivation rec {
  # those always succeed has the net effect of disabling all bindings.
  prePatch = ''
    substituteInPlace cmake/config-ix.cmake --replace "if(WIN32)" "if(1)"
+  ''
+  + stdenv.lib.optionalString (stdenv ? glibc) ''
+    (
+      cd projects/compiler-rt
+      patch -p1 < ${
+        fetchpatch {
+          name = "sigaltstack.patch"; # for glibc-2.26
+          url = https://github.com/llvm-mirror/compiler-rt/commit/8a5e425a68d.diff;
+          sha256 = "0h4y5vl74qaa7dl54b1fcyqalvlpd8zban2d1jxfkxpzyi7m8ifi";
+        }
+      }
+    )
  '';

  # hacky fix: created binaries need to be run before installation
--- a/pkgs/development/compilers/llvm/3.8/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.8/llvm.nix
@ -1,5 +1,6 @@
 { stdenv
 , fetch
+, fetchpatch
 , perl
 , groff
 , cmake
@ -49,6 +50,18 @@ in stdenv.mkDerivation rec {
    substituteInPlace CMakeLists.txt \
      --replace 'set(CMAKE_INSTALL_NAME_DIR "@rpath")' "set(CMAKE_INSTALL_NAME_DIR "$out/lib")" \
      --replace 'set(CMAKE_INSTALL_RPATH "@executable_path/../lib")' ""
+  ''
+  + stdenv.lib.optionalString (stdenv ? glibc) ''
+    (
+      cd projects/compiler-rt
+      patch -p1 < ${
+        fetchpatch {
+          name = "sigaltstack.patch"; # for glibc-2.26
+          url = https://github.com/llvm-mirror/compiler-rt/commit/8a5e425a68d.diff;
+          sha256 = "0h4y5vl74qaa7dl54b1fcyqalvlpd8zban2d1jxfkxpzyi7m8ifi";
+        }
+      }
+    )
  '';

  # hacky fix: created binaries need to be run before installation
--- a/pkgs/development/compilers/llvm/3.9/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.9/llvm.nix
@ -91,6 +91,20 @@ in stdenv.mkDerivation rec {
  + stdenv.lib.optionalString (enableSharedLibraries) ''
    substitute '${./llvm-outputs.patch}' ./llvm-outputs.patch --subst-var lib
    patch -p1 < ./llvm-outputs.patch
+  ''
+  + stdenv.lib.optionalString (stdenv ? glibc) ''
+    (
+      cd projects/compiler-rt
+      patch -p1 < ${
+        fetchpatch {
+          name = "sigaltstack.patch"; # for glibc-2.26
+          url = https://github.com/llvm-mirror/compiler-rt/commit/8a5e425a68d.diff;
+          sha256 = "0h4y5vl74qaa7dl54b1fcyqalvlpd8zban2d1jxfkxpzyi7m8ifi";
+        }
+      }
+      substituteInPlace lib/esan/esan_sideline_linux.cpp \
+        --replace 'struct sigaltstack' 'stack_t'
+    )
  '';

  # hacky fix: created binaries need to be run before installation
--- a/pkgs/development/compilers/llvm/4/llvm.nix
+++ b/pkgs/development/compilers/llvm/4/llvm.nix
@ -67,6 +67,20 @@ in stdenv.mkDerivation rec {
  + stdenv.lib.optionalString (enableSharedLibraries) ''
    substitute '${./llvm-outputs.patch}' ./llvm-outputs.patch --subst-var lib
    patch -p1 < ./llvm-outputs.patch
+  ''
+  + stdenv.lib.optionalString (stdenv ? glibc) ''
+    (
+      cd projects/compiler-rt
+      patch -p1 < ${
+        fetchpatch {
+          name = "sigaltstack.patch"; # for glibc-2.26
+          url = https://github.com/llvm-mirror/compiler-rt/commit/8a5e425a68d.diff;
+          sha256 = "0h4y5vl74qaa7dl54b1fcyqalvlpd8zban2d1jxfkxpzyi7m8ifi";
+        }
+      }
+      substituteInPlace lib/esan/esan_sideline_linux.cpp \
+        --replace 'struct sigaltstack' 'stack_t'
+    )
  '';

  # hacky fix: created binaries need to be run before installation
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@ -2,6 +2,7 @@
 , openglSupport ? false, mesa_noglu
 , alsaSupport ? true, alsaLib
 , x11Support ? true, libICE, libXi, libXScrnSaver, libXcursor, libXinerama, libXext, libXxf86vm, libXrandr
+, waylandSupport ? true, wayland, wayland-protocols, libxkbcommon
 , dbusSupport ? false, dbus
 , udevSupport ? false, udev
 , ibusSupport ? false, ibus
@ -17,7 +18,7 @@ assert openglSupport -> (stdenv.isDarwin || mesa_noglu != null && x11Support);

 let
  configureFlagsFun = attrs: [
-      "--disable-oss" "--disable-x11-shared"
+      "--disable-oss" "--disable-x11-shared" "--disable-wayland-shared"
      "--disable-pulseaudio-shared" "--disable-alsa-shared"
    ] ++ lib.optional alsaSupport "--with-alsa-prefix=${attrs.alsaLib.out}/lib"
      ++ lib.optional (!x11Support) "--without-x";
@ -39,6 +40,7 @@ stdenv.mkDerivation rec {

  # Since `libpulse*.la' contain `-lgdbm', PulseAudio must be propagated.
  propagatedBuildInputs = lib.optionals x11Support [ libICE libXi libXScrnSaver libXcursor libXinerama libXext libXrandr libXxf86vm ] ++
+    lib.optionals waylandSupport [ wayland wayland-protocols libxkbcommon ] ++
    lib.optional pulseaudioSupport libpulseaudio;

  buildInputs = [ audiofile ] ++
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchpatch, fetchurl }:

 stdenv.mkDerivation rec {
-  name = "expat-2.2.4";
+  name = "expat-2.2.5";

  src = fetchurl {
    url = "mirror://sourceforge/expat/${name}.tar.bz2";
-    sha256 = "17h1fb9zvqvf0sr78j211bngc6jpql5wzar8fg9b52jzjvdqbb83";
+    sha256 = "1xpd78sp7m34jqrw5x13bz7kgz0n6aj15wn4zj4gfx3ypbpk5p6r";
  };

  outputs = [ "out" "dev" ]; # TODO: fix referrers
--- a/pkgs/development/libraries/git2/0.25.nix
+++ b/pkgs/development/libraries/git2/0.25.nix
@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, python
+, zlib, libssh2, openssl, http-parser, curl, libiconv
+}:
+
+stdenv.mkDerivation (rec {
+  version = "0.25.1";
+  name = "libgit2-${version}";
+
+  src = fetchFromGitHub {
+    owner = "libgit2";
+    repo = "libgit2";
+    rev = "v${version}";
+    sha256 = "1jhikg0gqpdzfzhgv44ybdpm24lvgkc7ki4306lc5lvmj1s2nylj";
+  };
+
+  cmakeFlags = "-DTHREADSAFE=ON";
+
+  nativeBuildInputs = [ cmake python pkgconfig ];
+
+  buildInputs = [ zlib libssh2 openssl http-parser curl ];
+
+  enableParallelBuilding = true;
+
+  meta = {
+    description = "The Git linkable library";
+    homepage = https://libgit2.github.com/;
+    license = stdenv.lib.licenses.gpl2;
+    platforms = with stdenv.lib.platforms; all;
+  };
+} // stdenv.lib.optionalAttrs (!stdenv.isLinux) {
+  NIX_LDFLAGS = "-liconv";
+  propagatedBuildInputs = [ libiconv ];
+})
--- a/pkgs/development/libraries/git2/default.nix
+++ b/pkgs/development/libraries/git2/default.nix
@ -1,35 +1,30 @@
-{ stdenv, fetchurl, pkgconfig, cmake, zlib, python, libssh2, openssl, curl, http-parser, libiconv }:
+{ stdenv, fetchFromGitHub, pkgconfig, cmake, zlib, python, libssh2, openssl, curl, http-parser, libiconv }:

 stdenv.mkDerivation (rec {
-  version = "0.25.1";
  name = "libgit2-${version}";
+  version = "0.26.0";
+  # keep the version in sync with pythonPackages.pygit2 and gnome3.libgit2-glib

-  src = fetchurl {
-    name = "${name}.tar.gz";
-    url = "https://github.com/libgit2/libgit2/tarball/v${version}";
-    sha256 = "100bah8picqjzyhpw4wd7z5vyidcb8aggin50bhbpn607h8n8bml";
+  src = fetchFromGitHub {
+    owner = "libgit2";
+    repo = "libgit2";
+    rev = "v${version}";
+    sha256 = "0zrrmfkfhd2xb4879z5khjb6xsdklrm01f1lscrs2ks68v25fk78";
  };

-  # TODO: `cargo` (rust's package manager) surfaced a serious bug in
-  # libgit2 when the `Security.framework` transport is used on Darwin.
-  # The upstream issue is tracked at
-  # https://github.com/libgit2/libgit2/issues/3885 - feel free to
-  # remove this patch as soon as it's resolved (i.E. when cargo is
-  # working fine without this patch)
-  patches = stdenv.lib.optionals stdenv.isDarwin [
-    ./disable-security.framework.patch
-  ];
-
  cmakeFlags = "-DTHREADSAFE=ON";

  nativeBuildInputs = [ cmake python pkgconfig ];
+
  buildInputs = [ zlib libssh2 openssl http-parser curl ];

-  meta = {
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
    description = "The Git linkable library";
    homepage = https://libgit2.github.com/;
-    license = stdenv.lib.licenses.gpl2;
-    platforms = with stdenv.lib.platforms; all;
+    license = licenses.gpl2;
+    platforms = with platforms; all;
  };
 } // stdenv.lib.optionalAttrs (!stdenv.isLinux) {
  NIX_LDFLAGS = "-liconv";
--- a/pkgs/development/libraries/git2/disable-security.framework.patch
+++ b/pkgs/development/libraries/git2/disable-security.framework.patch
@ -1,58 +0,0 @@
-From fbc2ea65406236a740b8734dd41dc5ddbc24f8c9 Mon Sep 17 00:00:00 2001
-From: mulrich <mulrich@entwicklerheld.local>
-Date: Mon, 8 Aug 2016 15:36:07 +0200
-Subject: [PATCH] disable security.framework
-
---
- CMakeLists.txt    | 7 +++----
- src/curl_stream.c | 9 ++++++++-
- 2 files changed, 11 insertions(+), 5 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 93a9e47..331e148 100644
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -49,7 +49,8 @@ ENDIF()
- 
- IF(${CMAKE_SYSTEM_NAME} MATCHES "Darwin")
- 	SET( USE_ICONV ON )
-	FIND_PACKAGE(Security)
-+	# FIND_PACKAGE(Security)
-+  SET(SECURITY_FOUND "NO")
- 	FIND_PACKAGE(CoreFoundation REQUIRED)
- ENDIF()
- 
-@@ -87,9 +88,7 @@ IF(MSVC)
- 	OPTION(MSVC_CRTDBG "Enable CRTDBG memory leak reporting" OFF)
- ENDIF()
- 
-IF (NOT ${CMAKE_SYSTEM_NAME} MATCHES "Darwin")
-	OPTION( USE_OPENSSL                     "Link with and use openssl library"             ON )
-ENDIF()
-+OPTION( USE_OPENSSL                     "Link with and use openssl library"             ON )
- 
- CHECK_STRUCT_HAS_MEMBER ("struct stat" st_mtim "sys/types.h;sys/stat.h"
- 	HAVE_STRUCT_STAT_ST_MTIM LANGUAGE C)
-diff --git a/src/curl_stream.c b/src/curl_stream.c
-index 98de187..a8a9f4c 100644
--- a/src/curl_stream.c
-+++ b/src/curl_stream.c
-@@ -309,7 +309,14 @@ int git_curl_stream_new(git_stream **out, const char *host, const char *port)
- 	curl_easy_setopt(handle, CURLOPT_HTTPPROXYTUNNEL, 1);
- 	curl_easy_setopt(handle, CURLOPT_PROXYAUTH, CURLAUTH_ANY);
- 
-	/* curl_easy_setopt(handle, CURLOPT_VERBOSE, 1); */
-+  const char* cainfo = getenv("SSL_CERT_FILE");
-+  if(cainfo != NULL) {
-+    curl_easy_setopt(handle, CURLOPT_CAINFO, cainfo);
-+  }
-+
-+  /*
-+	curl_easy_setopt(handle, CURLOPT_VERBOSE, 1);
-+  */
- 
- 	st->parent.version = GIT_STREAM_VERSION;
- 	st->parent.encrypted = 0; /* we don't encrypt ourselves */
-- 
-2.3.8 (Apple Git-58)
-
--- a/pkgs/development/libraries/glibc/2.25-49.patch.gz
+++ b/pkgs/development/libraries/glibc/2.25-49.patch.gz
--- a/pkgs/development/libraries/glibc/2.26-75.patch.gz
+++ b/pkgs/development/libraries/glibc/2.26-75.patch.gz
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@ -19,9 +19,9 @@
 } @ args:

 let
-  version = "2.25";
-  patchSuffix = "-49";
-  sha256 = "067bd9bb3390e79aa45911537d13c3721f1d9d3769931a30c2681bfee66f23a0";
+  version = "2.26";
+  patchSuffix = "-75";
+  sha256 = "1ggnj1hzjym7sn93rbwydcqd562q73lsb7g7kd199g6j9j9hlkp5";
  cross = if buildPlatform != hostPlatform then hostPlatform else null;
 in

@ -46,7 +46,7 @@ stdenv.mkDerivation ({
          glibc-2.25-49-gbc5ace67fe
          $ git show --reverse glibc-2.25..release/2.25/master | gzip -n -9 --rsyncable - > 2.25-49.patch.gz
      */
-      ./2.25-49.patch.gz
+      ./2.26-75.patch.gz

      /* Have rpcgen(1) look for cpp(1) in $PATH.  */
      ./rpcgen-path.patch
@ -100,15 +100,12 @@ stdenv.mkDerivation ({
      (if profilingLibraries
       then "--enable-profile"
       else "--disable-profile")
-    ] ++ lib.optionals (cross == null && withLinuxHeaders) [
-      "--enable-kernel=2.6.32"
+    ] ++ lib.optionals withLinuxHeaders [
+      "--enable-kernel=3.2.0" # can't get below with glibc >= 2.26
    ] ++ lib.optionals (cross != null) [
      (if cross.withTLS then "--with-tls" else "--without-tls")
      (if cross ? float && cross.float == "soft" then "--without-fp" else "--with-fp")
-    ] ++ lib.optionals (cross != null
-          && cross.platform ? kernelMajor
-          && cross.platform.kernelMajor == "2.6") [
-      "--enable-kernel=2.6.0"
+    ] ++ lib.optionals (cross != null) [
      "--with-__thread"
    ] ++ lib.optionals (cross == null && stdenv.isArm) [
      "--host=arm-linux-gnueabi"
--- a/pkgs/development/libraries/icu/base.nix
+++ b/pkgs/development/libraries/icu/base.nix
@ -25,6 +25,11 @@ stdenv.mkDerivation {
    echo Source root reset to ''${sourceRoot}
  '';

+  # https://sourceware.org/glibc/wiki/Release/2.26#Removal_of_.27xlocale.h.27
+  postPatch = if stdenv ? glibc
+    then "substituteInPlace i18n/digitlst.cpp --replace '<xlocale.h>' '<locale.h>'"
+    else null; # won't find locale_t on darwin
+
  inherit patchFlags patches;

  preConfigure = ''
--- a/pkgs/development/libraries/live555/default.nix
+++ b/pkgs/development/libraries/live555/default.nix
@ -12,7 +12,12 @@ stdenv.mkDerivation {
    sha256 = "02z2f8z5cy0ajnh9pgar40lsxdknfw5cbyw52138hxnpr6adrvak";
  };

-  postPatch = "sed 's,/bin/rm,rm,g' -i genMakefiles";
+  postPatch = "sed 's,/bin/rm,rm,g' -i genMakefiles"
+  + stdenv.lib.optionalString (stdenv ? glibc) ''
+
+    substituteInPlace liveMedia/include/Locale.hh \
+      --replace '<xlocale.h>' '<locale.h>'
+  '';

  configurePhase = ''
    sed \
--- a/pkgs/development/libraries/ti-rpc/default.nix
+++ b/pkgs/development/libraries/ti-rpc/default.nix
@ -8,6 +8,10 @@ stdenv.mkDerivation rec {
    sha256 = "1xchbxy0xql7yl7z4n1icj8r7dmly46i22fvm00vdjq64zlmqg3j";
  };

+  postPatch = ''
+    sed '1i#include <stdint.h>' -i src/xdr_sizeof.c
+  '';
+
  nativeBuildInputs = [ autoreconfHook ];
  propagatedBuildInputs = [ libkrb5 ];

--- a/pkgs/development/libraries/vigra/default.nix
+++ b/pkgs/development/libraries/vigra/default.nix
@ -24,6 +24,8 @@ in stdenv.mkDerivation rec {
            ++ stdenv.lib.optionals (stdenv.system == "x86_64-linux")
                  [ "-DCMAKE_CXX_FLAGS=-fPIC" "-DCMAKE_C_FLAGS=-fPIC" ];

+  enableParallelBuilding = true;
+
  meta = with stdenv.lib; {
    description = "Novel computer vision C++ library with customizable algorithms and data structures";
    homepage = http://hci.iwr.uni-heidelberg.de/vigra;
--- a/pkgs/development/python-modules/h2/default.nix
+++ b/pkgs/development/python-modules/h2/default.nix
@ -0,0 +1,21 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, enum34, hpack, hyperframe }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "h2";
+  version = "3.0.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0r3f43r0v7sqgdjjg5ngw0dndk2v6cyd0jncpwya54m37y42z5mj";
+  };
+
+  propagatedBuildInputs = [ enum34 hpack hyperframe ];
+
+  meta = with stdenv.lib; {
+    description = "HTTP/2 State-Machine based protocol implementation";
+    homepage = "http://hyper.rtfd.org/";
+    license = licenses.mit;
+  };
+}
--- a/pkgs/development/python-modules/hyperframe/default.nix
+++ b/pkgs/development/python-modules/hyperframe/default.nix
@ -0,0 +1,17 @@
+{ stdenv, buildPythonPackage, fetchPypi }:
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "hyperframe";
+  version = "5.1.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "017vjbb1xjak1pxcvihhilzjnmpfvhapk7k88wp6lvdkkm9l8nd2";
+  };
+
+  meta = with stdenv.lib; {
+    description = "HTTP/2 framing layer for Python";
+    homepage = "http://hyper.rtfd.org/";
+    license = licenses.mit;
+  };
+}
--- a/pkgs/development/python-modules/kaitaistruct/default.nix
+++ b/pkgs/development/python-modules/kaitaistruct/default.nix
@ -0,0 +1,18 @@
+{ stdenv, kaitaistruct, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "kaitaistruct";
+  version = "0.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "19j3snmr0qbd48f7yd3cc21ffv13dahf8ys591dnalbhvnkar71i";
+  };
+
+  meta = with stdenv.lib; {
+    description = "Kaitai Struct: runtime library for Python";
+    homepage = "https://github.com/kaitai-io/kaitai_struct_python_runtime";
+    license = licenses.mit;
+  };
+}
--- a/pkgs/development/python-modules/ldap3/default.nix
+++ b/pkgs/development/python-modules/ldap3/default.nix
@ -0,0 +1,24 @@
+{ stdenv, fetchPypi, buildPythonPackage, gssapi, pyasn1 }:
+
+buildPythonPackage rec {
+  version = "2.3";
+  pname = "ldap3";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1b36lwil4iflk2ay8gi663abpnfm8id7qg4n3jkmmqbnc1sv6mn0";
+  };
+
+  buildInputs = [ gssapi ];
+
+  propagatedBuildInputs = [ pyasn1 ];
+
+  doCheck = false; # requires network
+
+  meta = with stdenv.lib; {
+    homepage = https://pypi.python.org/pypi/ldap3;
+    description = "A strictly RFC 4510 conforming LDAP V3 pure Python client library";
+    license = licenses.lgpl3;
+  };
+}
--- a/pkgs/development/python-modules/pyasn1-modules/default.nix
+++ b/pkgs/development/python-modules/pyasn1-modules/default.nix
@ -0,0 +1,22 @@
+{ stdenv, buildPythonPackage, fetchPypi, pyasn1, isPyPy }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "pyasn1-modules";
+  version = "0.1.5";
+  disabled = isPyPy;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1239h6h67vg0wazg2qgv6m3hdim2gs66pl89lbnayk55bbnkwc0x";
+  };
+
+  propagatedBuildInputs = [ pyasn1 ];
+
+  meta = with stdenv.lib; {
+    description = "A collection of ASN.1-based protocols modules";
+    homepage = https://pypi.python.org/pypi/pyasn1-modules;
+    license = licenses.bsd3;
+    platforms = platforms.unix;  # same as pyasn1
+  };
+}
--- a/pkgs/development/python-modules/pyasn1/default.nix
+++ b/pkgs/development/python-modules/pyasn1/default.nix
@ -0,0 +1,19 @@
+{ stdenv, buildPythonPackage, fetchPypi, }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "pyasn1";
+  version = "0.3.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "06hhy38jhwh95gpn8f03cr439273fsfsh4vhd5024r86nh5gyiir";
+  };
+
+  meta = with stdenv.lib; {
+    description = "ASN.1 tools for Python";
+    homepage = http://pyasn1.sourceforge.net/;
+    license = "mBSD";
+    platforms = platforms.unix;  # arbitrary choice
+  };
+}
--- a/pkgs/development/python-modules/pygit2/default.nix
+++ b/pkgs/development/python-modules/pygit2/default.nix
@ -0,0 +1,31 @@
+{ stdenv, lib, buildPythonPackage, fetchPypi, isPyPy, libgit2, six, cffi }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "pygit2";
+  version = "0.26.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1cbc488ra3kg7r3qky17ms0szi3cda2d96qfkv1l9djsy9hnvw57";
+  };
+
+  preConfigure = lib.optionalString stdenv.isDarwin ''
+    export DYLD_LIBRARY_PATH="${libgit2}/lib"
+  '';
+
+  propagatedBuildInputs = [ libgit2 six ] ++ lib.optional (!isPyPy) cffi;
+
+  preCheck = ''
+    # disable tests that require networking
+    rm test/test_repository.py
+    rm test/test_credentials.py
+    rm test/test_submodule.py
+  '';
+
+  meta = with lib; {
+    description = "A set of Python bindings to the libgit2 shared library";
+    homepage = https://pypi.python.org/pypi/pygit2;
+    license = licenses.gpl2;
+  };
+}
--- a/pkgs/development/python-modules/urwid/default.nix
+++ b/pkgs/development/python-modules/urwid/default.nix
@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, fetchurl }:
+{ stdenv, buildPythonPackage, fetchPypi, fetchpatch }:

 buildPythonPackage (rec {
  pname = "urwid";
@ -11,10 +11,16 @@ buildPythonPackage (rec {
  };

  patches = [
-    (fetchurl {
-      url = https://github.com/urwid/urwid/commit/4b0ed8b6030450e6d99909a7c683e9642e546387.patch;
-      sha256 = "0ygghd6wzjqij5szg61l1dsk8b0yv8bwyj3bgxxj1lj4m17zsy5q";
-    })
+   # fix tests
+   (fetchpatch {
+     url = "https://github.com/urwid/urwid/commit/4b0ed8b6030450e6d99909a7c683e9642e546387.patch";
+     sha256 = "0azpn0ylbg8mfpr0y27n4lnq0ph75a4d4m9wdv3napnhf1vh9ahx";
+   })
+   # fix tests
+   (fetchpatch {
+     url = "https://github.com/floppym/urwid/commit/f68f2cf089cfd5ec45863baf59a91d5aeb0cf5c3.patch";
+     sha256 = "1b3vz7mrwz2bqvdwvbyv2j835f9lzapgw0j2km4sam76bxmgfpgq";
+   })
  ];

  meta = with stdenv.lib; {
--- a/pkgs/development/tools/git-series/default.nix
+++ b/pkgs/development/tools/git-series/default.nix
@ -17,7 +17,7 @@ buildRustPackage rec {

  cargoDepsHook = ''
    (
-      cd ${name}-src
+      cd */
      # see https://github.com/git-series/git-series/pull/56
      patch -p1 < ${fetchpatch {
        url = "https://github.com/Mic92/git-series/commit/3aa30a47d74ebf90b444dccdf8c153f07f119483.patch";
--- a/pkgs/development/tools/parsing/flex/default.nix
+++ b/pkgs/development/tools/parsing/flex/default.nix
@ -1,4 +1,6 @@
-{ stdenv, fetchurl, bison, m4 }:
+{ stdenv, fetchurl, bison, m4
+, fetchpatch, autoreconfHook, help2man
+}:

 stdenv.mkDerivation rec {
  name = "flex-${version}";
@ -9,6 +11,16 @@ stdenv.mkDerivation rec {
    sha256 = "15g9bv236nzi665p9ggqjlfn4dwck5835vf0bbw2cz7h5c1swyp8";
  };

+  # Also upstream, will be part of 2.6.5
+  # https://github.com/westes/flex/commit/24fd0551333e
+  patches = [(fetchpatch {
+    name = "glibc-2.26.patch";
+    url = "https://raw.githubusercontent.com/lede-project/source/0fb14a2b1ab2f82c"
+        + "/tools/flex/patches/200-build-AC_USE_SYSTEM_EXTENSIONS-in-configure.ac.patch";
+    sha256 = "1aarhcmz7mfrgh15pkj6f7ikxa2m0mllw1i1vscsf1kw5d05lw6f";
+  })];
+  nativeBuildInputs = [ autoreconfHook help2man ];
+
  buildInputs = [ bison ];

  propagatedBuildInputs = [ m4 ];
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
@ -6,7 +6,7 @@ appleDerivation {
    libsecurity_cdsa_plugin
  ];
  patchPhase = ''
-    cp ${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/usr/local/include/sandbox_private.h .
+    cp ${osx_private_sdk}/include/sandbox_private.h .
    substituteInPlace sandbox_private.h --replace '<sandbox.h>' '"${apple_sdk.sdk}/include/sandbox.h"'
    substituteInPlace lib/AtomicFile.cpp --replace '<sandbox.h>' '"sandbox_private.h"'
  '';
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
@ -10,7 +10,7 @@ name: version: sha256: args: let

      patchPhase = ''
        # allows including <Security/some-private-header.h>
-        ln -s ${pkgs.darwin.osx_private_sdk}/PrivateSDK10.9.sparse.sdk/System/Library/Frameworks/Security.framework/Versions/A/PrivateHeaders Security
+        cp -R ${pkgs.darwin.osx_private_sdk}/include/SecurityPrivateHeaders Security

        grep -Rl MacErrors.h . | while read file; do
          substituteInPlace "''$file" --replace \
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
@ -18,9 +18,9 @@ appleDerivation {

    substituteInPlace lib/SecCertificate.cpp --replace '#include <Security/SecCertificatePriv.h>' ""

-    cp ${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/usr/include/xpc/private.h xpc
+    cp ${osx_private_sdk}/include/xpc/private.h xpc
    cp ${apple_sdk.sdk}/include/xpc/*.h xpc
-    cp ${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/usr/local/include/sandbox_private.h lib/sandbox.h
+    cp ${osx_private_sdk}/include/sandbox_private.h lib/sandbox.h

    substituteInPlace lib/SecItemPriv.h \
      --replace "extern CFTypeRef kSecAttrAccessGroup" "extern const CFTypeRef kSecAttrAccessGroup" \
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
@ -17,9 +17,8 @@ appleDerivation {
    substituteInPlace lib/powerwatch.h --replace \
      '<IOKit/pwr_mgt/IOPMLibPrivate.h>' \
      '"${IOKit}/Library/Frameworks/IOKit.framework/Headers/pwr_mgt/IOPMLibPrivate.h"'
-
-    cp ${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/usr/include/security_utilities/utilities_dtrace.h lib
-    cp -R ${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/usr/local/include/bsm lib
+    cp -R ${osx_private_sdk}/include/bsm lib
+    cp ${osx_private_sdk}/include/utilities_dtrace.h lib
  '' + stdenv.lib.optionalString (!stdenv.cc.nativeLibc) ''
    substituteInPlace lib/vproc++.cpp --replace /usr/local/include/vproc_priv.h ${stdenv.libc}/include/vproc_priv.h
  '';
--- a/pkgs/os-specific/darwin/cf-private/default.nix
+++ b/pkgs/os-specific/darwin/cf-private/default.nix
@ -1,31 +1,18 @@
 { stdenv, osx_private_sdk, CF }:

-let
-  headers = [
-    "CFAvailability.h"
-    "CFAttributedString.h"
-    "CFFileDescriptor.h"
-    "CFFileSecurity.h"
-    "CFNotificationCenter.h"
-    "CFStringTokenizer.h"
-    "CFURLEnumerator.h"
-    "CFURL.h"
-    "CoreFoundation.h"
-  ];
-
-in stdenv.mkDerivation {
+stdenv.mkDerivation {
  name = "${CF.name}-private";
  phases = [ "installPhase" "fixupPhase" ];
  installPhase = ''
    dest=$out/Library/Frameworks/CoreFoundation.framework/Headers
    mkdir -p $dest
    pushd $dest
-    for file in ${CF}/Library/Frameworks/CoreFoundation.framework/Headers/*; do
-      ln -s $file
-    done
+      cp -Lv ${osx_private_sdk}/include/CoreFoundationPrivateHeaders/* $dest
+      for file in ${CF}/Library/Frameworks/CoreFoundation.framework/Headers/*; do
+        ln -sf $file 
+      done
    popd

-    install -m 0644 ${osx_private_sdk}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/CoreFoundation.framework/Headers/{${stdenv.lib.concatStringsSep "," headers}} $dest
  '';

  setupHook = ./setup-hook.sh;
--- a/pkgs/os-specific/darwin/osx-private-sdk/default.nix
+++ b/pkgs/os-specific/darwin/osx-private-sdk/default.nix
@ -1,8 +1,27 @@
 { stdenv, fetchFromGitHub }:

-fetchFromGitHub {
-  owner = "samdmarshall";
-  repo = "OSXPrivateSDK";
-  rev = "f4d52b60e86b496abfaffa119a7d299562d99783";
-  sha256 = "0bv0884yxpvk2ishxj8gdy1w6wb0gwfq55q5qjp0s8z0z7f63zqh";
+stdenv.mkDerivation {
+  name = "OSXPrivateSDK";
+
+  src = fetchFromGitHub {
+    owner = "samdmarshall";
+    repo = "OSXPrivateSDK";
+    rev = "f4d52b60e86b496abfaffa119a7d299562d99783";
+    sha256 = "0bv0884yxpvk2ishxj8gdy1w6wb0gwfq55q5qjp0s8z0z7f63zqh";
+  };
+
+  # NOTE: we install only headers that are really needed to keep closure sie
+  # reasonable.
+  installPhase = ''
+    mkdir -p $out/include
+    sdk10=PrivateSDK10.10.sparse.sdk
+    sdk=PrivateSDK10.9.sparse.sdk
+    cp $sdk/usr/local/include/sandbox_private.h $out/include/sandbox_private.h
+    # this can be removed once we dtrace binary
+    cp $sdk/usr/local/include/security_utilities/utilities_dtrace.h $out/include/utilities_dtrace.h
+    cp -RL $sdk/usr/include/xpc $out/include/xpc
+    cp -RL $sdk/usr/local/include/bsm $out/include/bsm
+    cp -RL $sdk/System/Library/Frameworks/Security.framework/Versions/A/PrivateHeaders $out/include/SecurityPrivateHeaders
+    cp -RL $sdk10/System/Library/Frameworks/CoreFoundation.framework/Headers $out/include/CoreFoundationPrivateHeaders
+  '';
 }
--- a/pkgs/os-specific/darwin/security-tool/default.nix
+++ b/pkgs/os-specific/darwin/security-tool/default.nix
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {

  patchPhase = ''
    # copied from libsecurity_generic
-    ln -s ${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/System/Library/Frameworks/Security.framework/Versions/A/PrivateHeaders Security
+    cp -R ${osx_private_sdk}/include/SecurityPrivateHeaders Security

    substituteInPlace cmsutil.c --replace \
      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
--- a/pkgs/os-specific/linux/checkpolicy/default.nix
+++ b/pkgs/os-specific/linux/checkpolicy/default.nix
@ -10,16 +10,17 @@ stdenv.mkDerivation rec {
    sha256 = "1m5wjm43lzp6bld8higsvdm2dkddydihhwv9qw2w9r4dm0largcv";
  };

+  # Don't build tests
+  postPatch = ''
+    sed '/-C test/d' -i Makefile
+    sed '1i#include <ctype.h>' -i checkpolicy.c
+  '';
+
  nativeBuildInputs = [ bison flex ];
  buildInputs = [ libsepol ];

  NIX_CFLAGS_COMPILE = "-fstack-protector-all";

-  # Don't build tests
-  postPatch = ''
-    sed -i '/-C test/d' Makefile
-  '';
-
  preBuild = ''
    makeFlagsArray+=("LEX=flex")
    makeFlagsArray+=("LIBDIR=${libsepol}/lib")
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@ -39,6 +39,9 @@ stdenv.mkDerivation rec {

  postPatch = optionalString enablePython ''
    sed -i -e 's|\$(LIBDIR)/libsepol.a|${libsepol}/lib/libsepol.a|' src/Makefile
+  ''
+  + ''
+    sed '1i#include <sys/uio.h>' -i src/setrans_client.c
  '';

  preBuild = ''
--- a/pkgs/servers/gpm/default.nix
+++ b/pkgs/servers/gpm/default.nix
@ -12,6 +12,11 @@ stdenv.mkDerivation rec {
    sha256 = "13d426a8h403ckpc8zyf7s2p5rql0lqbg2bv0454x0pvgbfbf4gh";
  };

+  postPatch = ''
+    sed '1i#include <sys/types.h>' -i src/daemon/open_console.c
+    substituteInPlace src/prog/gpm-root.y --replace __sigemptyset sigemptyset
+  '';
+
  nativeBuildInputs = [ automake autoconf libtool flex bison texinfo ];
  buildInputs = [ ncurses ];

--- a/pkgs/tools/networking/mitmproxy/default.nix
+++ b/pkgs/tools/networking/mitmproxy/default.nix
@ -1,82 +1,32 @@
 { stdenv, fetchpatch, fetchFromGitHub, fetchurl, python3, glibcLocales }:

-let
-  p = python3.override {
-    packageOverrides = self: super: {
-      cryptography = super.cryptography.overridePythonAttrs (oldAttrs: rec {
-        version = "1.8.2";
-        name = "${oldAttrs.pname}-${version}";
-        src = oldAttrs.src.override {
-          inherit version;
-          sha256 = "8e88ebac371a388024dab3ccf393bf3c1790d21bc3c299d5a6f9f83fb823beda";
-        };
-      });
-      cryptography_vectors = super.cryptography_vectors.overridePythonAttrs (oldAttrs: rec {
-        version = self.cryptography.version;
-        name = "${oldAttrs.pname}-${version}";
-        src = oldAttrs.src.override {
-          inherit version;
-          sha256 = "00daa04c9870345f56605d91d7d4897bc1b16f6fff7c74cb602b08ef16c0fb43";
-        };
-      });
-      pyopenssl = super.pyopenssl.overridePythonAttrs (oldAttrs: rec {
-        version = "17.0.0";
-        name = "${oldAttrs.pname}-${version}";
-        src = oldAttrs.src.override {
-          inherit version;
-          sha256 = "1pdg1gpmkzj8yasg6cmkhcivxcdp4c12nif88y4qvsxq5ffzxas8";
-        };
-        patches = fetchpatch {
-          url = "https://github.com/pyca/pyopenssl/commit/"
-              + "a40898b5f1d472f9449a344f703fa7f90cddc21d.patch";
-          sha256 = "0bdfrhfvdfxhfknn46s4db23i3hww6ami2r1l5rfrri0pn8b8mh7";
-        };
-      });
-    };
-  };
-in p.pkgs.buildPythonPackage rec {
+python3.pkgs.buildPythonPackage rec {
  baseName = "mitmproxy";
-  name = "${baseName}-${version}";
-  version = "2.0.2";
+  name = "${baseName}-unstable-2017-10-31";

  src = fetchFromGitHub {
    owner = baseName;
    repo = baseName;
-    rev = "v${version}";
-    sha256 = "1x1a28al5clpfd69rjcpw26gjjnpsm1vfl4scrwpdd1jhkw044h9";
+    rev = "80a8eaa708ea31dd9c5e7e1ab6b02c69079039c0";
+    sha256 = "0rvwm11yryzlp3c1i42rk2iv1m38yn6r83k41jb51hwg6wzbwzvw";
  };

-  patches = [
-    # fix tests
-    (fetchpatch {
-      url = "https://github.com/mitmproxy/mitmproxy/commit/b3525570929ba47c10d9d08696876c39487f7000.patch";
-      sha256 = "111fld5gqdii7rs1jhqaqrxgbyhfn6qd0y7l15k4npamsnvdnv20";
-    })
-    # bump pyOpenSSL
-    (fetchpatch {
-      url = https://github.com/mitmproxy/mitmproxy/commit/6af72160bf98b58682b8f9fc5aabf51928d2b1d3.patch;
-      sha256 = "1q4ml81pq9c8j9iscq8janbxf4s37w3bqskbs6r30yqzy63v54f2";
-    })
-    # https://github.com/mitmproxy/mitmproxy/commit/3d7cde058b7e6242d93b9bc9d3e17520ffb578a5
-    ./tornado-4.6.patch
-  ];
-
  checkPhase = ''
    export HOME=$(mktemp -d)
    # test_echo resolves hostnames
-    LC_CTYPE=en_US.UTF-8 pytest -k 'not test_echo'
+    LC_CTYPE=en_US.UTF-8 pytest -k 'not test_echo and not test_find_unclaimed_URLs '
  '';

-  propagatedBuildInputs = with p.pkgs; [
-    blinker click certifi construct cryptography
-    cssutils editorconfig h2 html2text hyperframe
-    jsbeautifier kaitaistruct passlib pyasn1 pyopenssl
+  propagatedBuildInputs = with python3.pkgs; [
+    blinker click certifi cryptography
+    h2 hyperframe
+    kaitaistruct passlib pyasn1 pyopenssl
    pyparsing pyperclip requests ruamel_yaml tornado
-    urwid watchdog brotlipy sortedcontainers
+    urwid brotlipy sortedcontainers ldap3
  ];

-  buildInputs = with p.pkgs; [
-    beautifulsoup4 flask pytz pytest pytestrunner protobuf glibcLocales
+  buildInputs = with python3.pkgs; [
+    beautifulsoup4 flask pytest pytestrunner glibcLocales
  ];

  meta = with stdenv.lib; {
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@ -160,7 +160,7 @@ in rec {
  }) // { perl-bindings = nixStable; };

  nixUnstable = (lib.lowPrio (common rec {
-    name = "nix-1.12${suffix}";
+    name = "nix-unstable-1.12${suffix}";
    suffix = "pre5732_fd10f6f2";
    src = fetchFromGitHub {
      owner = "NixOS";
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@ -19,11 +19,11 @@ let
  inherit (stdenv.lib) optional;
 in
 stdenv.mkDerivation rec {
-  name = "gawk-4.1.4";
+  name = "gawk-4.2.0";

  src = fetchurl {
    url = "mirror://gnu/gawk/${name}.tar.xz";
-    sha256 = "0rn2mmjxm767zliqzd67j7h2ncjn4j0321c60y9fy3grs3i89qak";
+    sha256 = "1wm9lqj77y7xz07zi0n187aqm8zavzxzpm1j53ahxz81q0qwvwyl";
  };

  # When we do build separate interactive version, it makes sense to always include man.
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -6022,6 +6022,7 @@ with pkgs;

  julia_05 = callPackage ../development/compilers/julia/0.5.nix {
    gmp = gmp6;
+    libgit2 = libgit2_0_25;
    openblas = openblasCompat;
    inherit (darwin.apple_sdk.frameworks) CoreServices ApplicationServices;
    llvm = llvm_38;
@ -8295,11 +8296,13 @@ with pkgs;

  icon-lang = callPackage ../development/interpreters/icon-lang { };

-  libgit2 = callPackage ../development/libraries/git2 (
-    stdenv.lib.optionalAttrs stdenv.isDarwin {
+  inherit (rec {
+    arg = stdenv.lib.optionalAttrs stdenv.isDarwin {
      inherit (darwin) libiconv;
-    }
-  );
+    };
+    libgit2 = callPackage ../development/libraries/git2 arg;
+    libgit2_0_25 = callPackage ../development/libraries/git2/0.25.nix arg;
+  }) libgit2 libgit2_0_25;

  gle = callPackage ../development/libraries/gle { };

@ -10581,6 +10584,7 @@ with pkgs;
    openglSupport = mesaSupported;
    alsaSupport = stdenv.isLinux;
    x11Support = !stdenv.isCygwin;
+    waylandSupport = stdenv.isLinux;
    udevSupport = stdenv.isLinux;
    pulseaudioSupport = config.pulseaudio or stdenv.isLinux;
    inherit (darwin.apple_sdk.frameworks) AudioUnit Cocoa CoreAudio CoreServices ForceFeedback OpenGL;
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -11308,39 +11308,9 @@ in {
    };
  };

-  hyperframe = buildPythonPackage rec {
-    name = "hyperframe-${version}";
-    version = "4.0.1";
+  hyperframe = callPackage ../development/python-modules/hyperframe { };

-    src = pkgs.fetchurl {
-      url = "mirror://pypi/h/hyperframe/${name}.tar.gz";
-      sha256 = "0hsfq0jigwa0i58z7vbnp62l7za49gmlg75vnygq2ijhkidkcmwa";
-    };
-
-    meta = {
-      description = "HTTP/2 framing layer for Python";
-      homepage = "http://hyper.rtfd.org/";
-      license = licenses.mit;
-    };
-  };
-
-  h2 = buildPythonPackage rec {
-    name = "h2-${version}";
-    version = "2.5.1";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/h/h2/${name}.tar.gz";
-      sha256 = "0xhzm5vcfhdq3mihynwh4ljwi0r06lvzk3ypr0gmmbcp1x43ffb7";
-    };
-
-    propagatedBuildInputs = with self; [ enum34 hpack hyperframe ];
-
-    meta = {
-      description = "HTTP/2 State-Machine based protocol implementation";
-      homepage = "http://hyper.rtfd.org/";
-      license = licenses.mit;
-    };
-  };
+  h2 = callPackage ../development/python-modules/h2 { };

  editorconfig = buildPythonPackage rec {
    name = "EditorConfig-${version}";
@ -13529,21 +13499,7 @@ in {

  pecan = callPackage ../development/python-modules/pecan { };

-  kaitaistruct = buildPythonPackage rec {
-    name = "kaitaistruct-${version}";
-    version = "0.6";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/k/kaitaistruct/${name}.tar.gz";
-      sha256 = "0rwcrlz7f2bwmypqa38pag492bp71wp1bhz51hsaynjjyr9knr12";
-    };
-
-    meta = with stdenv.lib; {
-      description = "Kaitai Struct: runtime library for Python";
-      homepage = "https://github.com/kaitai-io/kaitai_struct_python_runtime";
-      license = licenses.mit;
-    };
-  };
+  kaitaistruct = callPackage ../development/python-modules/kaitaistruct { };

  Kajiki = buildPythonPackage rec {
    name = "Kajiki-${version}";
@ -15231,41 +15187,9 @@ in {
  };


-  pyasn1 = buildPythonPackage rec {
-    name = "pyasn1-0.1.9";
+  pyasn1 = callPackage ../development/python-modules/pyasn1 { };

-    src = pkgs.fetchurl {
-      url = "mirror://pypi/p/pyasn1/${name}.tar.gz";
-      sha256 = "0zraxni14bqi20kr4bi6nwsh32aibz0fq0xaczfisw0zdpcsqg45";
-    };
-
-    meta = {
-      description = "ASN.1 tools for Python";
-      homepage = http://pyasn1.sourceforge.net/;
-      license = "mBSD";
-      platforms = platforms.unix;  # arbitrary choice
-    };
-  };
-
-  pyasn1-modules = buildPythonPackage rec {
-    name = "pyasn1-modules-${version}";
-    version = "0.0.8";
-    disabled = isPyPy;
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/p/pyasn1-modules/${name}.tar.gz";
-      sha256 = "0drqgw81xd3fxdlg89kgd79zzrabvfncvkbybi2wr6w2y4s1jmhh";
-    };
-
-    propagatedBuildInputs = with self; [ pyasn1 ];
-
-    meta = {
-      description = "A collection of ASN.1-based protocols modules";
-      homepage = https://pypi.python.org/pypi/pyasn1-modules;
-      license = licenses.bsd3;
-      platforms = platforms.unix;  # same as pyasn1
-    };
-  };
+  pyasn1-modules = callPackage ../development/python-modules/pyasn1-modules { };

  pyaudio = buildPythonPackage rec {
    name = "python-pyaudio-${version}";
@ -15436,45 +15360,7 @@ in {
    };
  };

-  pygit2 = buildPythonPackage rec {
-    name = "pygit2-0.25.1";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/p/pygit2/${name}.tar.gz";
-      sha256 = "0sja3g9mqwp5bnhdc313b2gc4z3p70nn6zzf2h8j581g0lrn0sg8";
-    };
-
-    # Fixes a bug which can cause test failed when cffi==1.10
-    prePatch = let
-      cffiVersionPatch = pkgs.fetchurl {
-        url = "https://github.com/libgit2/pygit2/commit/b88dc868423af2f760f649960112efd0e37e5335.patch";
-        sha256 = "14cfrz56y2dnwlxrrss9pjhxfnyyg5856gbabzjzyx674k0qcid4";
-      };
-    in ''
-      # we need to delete part of the patch because the missing .travis.yml causes problem
-      sed -e '1,36d' ${cffiVersionPatch} | patch -p1
-    '';
-
-    preConfigure = ( if stdenv.isDarwin then ''
-      export DYLD_LIBRARY_PATH="${pkgs.libgit2}/lib"
-    '' else "" );
-
-    propagatedBuildInputs = with self; [ pkgs.libgit2 six ] ++ optionals (!isPyPy) [ cffi ];
-
-    preCheck = ''
-      # disable tests that require networking
-      rm test/test_repository.py
-      rm test/test_credentials.py
-      rm test/test_submodule.py
-    '';
-
-    meta = {
-      homepage = https://pypi.python.org/pypi/pygit2;
-      description = "A set of Python bindings to the libgit2 shared library";
-      license = licenses.gpl2;
-      platforms = platforms.all;
-    };
-  };
+  pygit2 = callPackage ../development/python-modules/pygit2 { };

  Babel = buildPythonPackage (rec {
    name = "Babel-2.3.4";
@ -16595,25 +16481,7 @@ in {
    inherit (pkgs) openldap cyrus_sasl openssl;
  };

-  ldap3 = buildPythonPackage rec {
-    version = "1.0.4";
-    name = "ldap3-${version}";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/l/ldap3/${name}.tar.gz";
-      sha256 = "0j4qqj9vq022hy7wfqn8s0j4vm2g6paabbzas1vbyspawvcfai98";
-    };
-
-    buildInputs = with self; [ gssapi ];
-
-    propagatedBuildInputs = with self; [ pyasn1 ];
-
-    meta = {
-      homepage = https://pypi.python.org/pypi/ldap3;
-      description = "A strictly RFC 4510 conforming LDAP V3 pure Python client library";
-      license = licenses.lgpl3;
-    };
-  };
+  ldap3 = callPackage ../development/python-modules/ldap3 {};

  ptest = buildPythonPackage rec {
    name = pname + "-" + version;