Merge remote-tracking branch 'upstream/master' into hardened-stdenv

pkgs/tools/security/fail2ban/default.nix

@@ -17,11 +17,6 @@ pythonPackages.buildPythonApplication {
     ++ (stdenv.lib.optional stdenv.isLinux pythonPackages.systemd);
 
   preConfigure = ''
-    for i in fail2ban-client fail2ban-regex fail2ban-server; do
-      substituteInPlace $i \
-        --replace /usr/share/fail2ban $out/share/fail2ban
-    done
-
     for i in config/action.d/sendmail*.conf; do
       substituteInPlace $i \
         --replace /usr/sbin/sendmail sendmail \

pkgs/tools/security/gnupg/21.nix

@@ -27,14 +27,16 @@ stdenv.mkDerivation rec {
     readline libusb gnutls adns openldap zlib bzip2
   ];
 
+  # gpgsm-linking is fixed by commit (c49c43d7) in the gnupg master branch;
+  # fix-gpgsm-linking.patch should be dropped after gnupg 2.1.15 is released
+  patches = [ ./fix-gpgsm-linking.patch ];
+
   postPatch = stdenv.lib.optionalString stdenv.isLinux ''
     sed -i 's,"libpcsclite\.so[^"]*","${pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c
   ''; #" fix Emacs syntax highlighting :-(
 
   configureFlags = optional x11Support "--with-pinentry-pgm=${pinentry}/bin/pinentry";
 
-  postConfigure = "substituteAllInPlace tools/gpgkey2ssh.c";
-
   meta = with stdenv.lib; {
     homepage = http://gnupg.org;
     description = "A complete and free implementation of the OpenPGP standard";

pkgs/tools/security/gnupg/fix-gpgsm-linking.patch

@@ -0,0 +1,11 @@
+--- a/tests/gpgscm/Makefile.in
++++ b/tests/gpgscm/Makefile.in
+@@ -457,7 +457,7 @@
+ 	scheme-config.h opdefines.h scheme.c scheme.h scheme-private.h
+ 
+ gpgscm_LDADD = $(LDADD) $(common_libs) \
+-	$(NETLIBS) $(LIBICONV) $(LIBREADLINE) \
++	$(NETLIBS) $(LIBICONV) $(LIBREADLINE) $(LIBINTL) \
+ 	$(LIBGCRYPT_LIBS) $(GPG_ERROR_LIBS)
+ 
+ t_child_SOURCES = t-child.c

pkgs/tools/security/knockknock/default.nix

@@ -1,6 +1,6 @@
-{ stdenv, fetchFromGitHub, buildPythonApplication, python, pycrypto, hping }:
+{ stdenv, fetchFromGitHub, pythonPackages, buildPythonApplication, hping }:
 
-buildPythonApplication rec {
+pythonPackages.buildPythonApplication rec {
   rev  = "bf14bbff";
   name = "knockknock-r${rev}";
 
@@ -11,7 +11,7 @@ buildPythonApplication rec {
     sha256 = "1chpfs3w2vkjrgay69pbdr116z1jldv53fi768a1i05fdqhy1px4";
   };
 
-  propagatedBuildInputs = [ pycrypto ];
+  propagatedBuildInputs = [ pythonPackages.pycrypto ];
 
   patchPhase = ''
     sed -i '/build\//d' setup.py

pkgs/tools/security/nmap/default.nix

@@ -2,16 +2,15 @@
 , graphicalSupport ? false
 , libX11 ? null
 , gtk ? null
-, python ? null
-, pygtk ? null
+, pythonPackages
 , makeWrapper ? null
-, pygobject ? null
-, pycairo ? null
-, pysqlite ? null
 }:
 
 with stdenv.lib;
-stdenv.mkDerivation rec {
+
+let
+  inherit (pythonPackages) python pygtk pygobject pycairo pysqlite;
+in stdenv.mkDerivation rec {
   name = "nmap${optionalString graphicalSupport "-graphical"}-${version}";
   version = "7.12";
 

pkgs/tools/security/volatility/default.nix

@@ -1,10 +1,8 @@
-{ stdenv, fetchurl, buildPythonApplication, pycrypto }:
+{ stdenv, fetchurl, pythonPackages }:
 
-buildPythonApplication rec {
-  namePrefix = "";
+pythonPackages.buildPythonApplication rec {
   name = "volatility-2.4";
 
-
   src = fetchurl {
     url = "http://downloads.volatilityfoundation.org/releases/2.4/${name}.tar.gz";
     sha256 = "1wffrkvj2lrkqhwamyix9fy05y6g6w8h1sz2iqlm6i6ag7yxykv8";
@@ -12,7 +10,7 @@ buildPythonApplication rec {
 
   doCheck = false;
 
-  propagatedBuildInputs = [ pycrypto ];
+  propagatedBuildInputs = [ pythonPackages.pycrypto ];
 
   meta = with stdenv.lib; {
     homepage = https://code.google.com/p/volatility;