Merge master into staging-next

pkgs/development/libraries/gdal/2.4.0.nix

@@ -16,6 +16,15 @@ stdenv.mkDerivation rec {
     sha256 = "09qgy36z0jc9w05373m4n0vm4j54almdzql6z9p9zr9pdp61syf3";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2019-17545.patch";
+      url = "https://github.com/OSGeo/gdal/commit/8cd2d2eb6327cf782a74dae263ffa6f89f46c93d.patch";
+      stripLen = 1;
+      sha256 = "06h88a659jcqf6ps1m91qy78s6s9krbkwnz28f5qh7032vlp6qpw";
+    })
+  ];
+
   buildInputs = [ unzip libjpeg libtiff libgeotiff libpng proj openssl sqlite
     libspatialite poppler hdf4 qhull giflib expat libxml2 proj ]
   ++ (with pythonPackages; [ python numpy wrapPython ])

pkgs/development/libraries/gdal/default.nix

@@ -20,7 +20,15 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "source/gdal";
 
-  patches = [ ./001.3_0_1.darwin.patch ];
+  patches = [
+    ./001.3_0_1.darwin.patch
+    (fetchpatch {
+      name = "CVE-2019-17545.patch";
+      url = "https://github.com/OSGeo/gdal/commit/148115fcc40f1651a5d15fa34c9a8c528e7147bb.patch";
+      stripLen = 1;
+      sha256 = "0hai59hhvrci9xwjw4lp3wc1brn00imngmqrbbs8v9yr3b0fzbgs";
+    })
+  ];
 
   nativeBuildInputs = [ autoreconfHook ];
 

pkgs/development/libraries/libisds/default.nix

@@ -0,0 +1,34 @@
+{ stdenv
+, fetchurl
+, expat
+, gpgme
+, libgcrypt
+, libxml2
+, libxslt
+, curl
+, docbook_xsl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libisds";
+  version = "0.11";
+
+  src = fetchurl {
+    url = "http://xpisar.wz.cz/${pname}/dist/${pname}-${version}.tar.xz";
+    sha256 = "1cy161l7rl25xji2xpb9vjpvg02bc7mwd4fpp2sx9zhpifn5dfbr";
+  };
+
+  configureFlags = [
+    "--with-docbook-xsl-stylesheets=${docbook_xsl}/xml/xsl/docbook"
+  ];
+
+  buildInputs = [ expat gpgme libgcrypt libxml2 libxslt curl docbook_xsl ];
+
+  meta = with stdenv.lib; {
+    description = "Client library for accessing SOAP services of Czech government-provided Databox infomation system";
+    homepage = "http://xpisar.wz.cz/libisds/";
+    license = licenses.lgpl3;
+    maintainers = [ maintainers.mmahut ];
+    platforms = platforms.linux;
+  };
+}

pkgs/development/libraries/lightstep-tracer-cpp/default.nix

@@ -1,44 +1,35 @@
-{ stdenv, lib, fetchFromGitHub, pkgconfig, protobuf, cmake, zlib
-, opentracing-cpp, enableGrpc ? false
+{ stdenv, lib, fetchFromGitHub, pkgconfig, cmake
+, opentracing-cpp, protobuf, zlib
+, enableGrpc ? false, grpc ? null, openssl ? null, c-ares ? null
 }:
 
-let
-  # be sure to use the right revision based on the submodule!
-  common =
-    fetchFromGitHub {
-      owner = "lightstep";
-      repo = "lightstep-tracer-common";
-      rev = "5fe3bf885bcece14c3c65df06c86c826ba45ad69";
-      sha256 = "1q39a0zaqbnqyhl2hza2xzc44235p65bbkfkzs2981niscmggq8w";
-    };
-
-in
+assert enableGrpc -> grpc != null;
+assert enableGrpc -> openssl != null;
+assert enableGrpc -> c-ares != null;
 
 stdenv.mkDerivation rec {
   pname = "lightstep-tracer-cpp";
-  version = "0.8.1";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "lightstep";
-    repo = "lightstep-tracer-cpp";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "1m4kl70lhvy1bsmkdh6bf2fddz5v1ikb27vgi99i2akpq40g4fvf";
+    sha256 = "1x7n3b5i9a0481azy3ymfybjfvr5z0i8wm17d964hsv7ryvnapj0";
   };
 
-  postUnpack = ''
-    cp -r ${common}/* $sourceRoot/lightstep-tracer-common
-  '';
-
-  cmakeFlags = ["-DOPENTRACING_INCLUDE_DIR=${opentracing-cpp}/include" "-DOPENTRACING_LIBRARY=${opentracing-cpp}/lib/libopentracing.so"] ++ lib.optional (!enableGrpc) [ "-DWITH_GRPC=OFF" ];
-
   nativeBuildInputs = [
-    pkgconfig cmake
+    cmake pkgconfig
   ];
 
   buildInputs = [
-    protobuf zlib
+    opentracing-cpp protobuf zlib
+  ] ++ lib.optionals enableGrpc [
+    grpc openssl c-ares c-ares.cmake-config
   ];
 
+  cmakeFlags = lib.optionals (!enableGrpc) [ "-DWITH_GRPC=OFF" ];
+
   meta = with lib; {
     description = "Distributed tracing system built on top of the OpenTracing standard";
     homepage = "https://lightstep.com/";

pkgs/development/libraries/qt-5/5.12/default.nix

@@ -79,6 +79,15 @@ let
         url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/qtbug-77037-workaround.patch?h=packages/qt5-webengine&id=fc77d6b3d5ec74e421b58f199efceb2593cbf951";
         sha256 = "1gv733qfdn9746nbqqxzyjx4ijjqkkb7zb71nxax49nna5bri3am";
       })
+      # patch for CVE-2019-13720, can be removed when it is included in the next upstream release
+      # https://bugreports.qt.io/browse/QTBUG-1019226
+      (fetchpatch {
+        name = "qtwebengine-CVE-2019-13720.patch";
+        url = "https://code.qt.io/cgit/qt/qtwebengine-chromium.git/patch/?id=d6e5fc10";
+        sha256 = "0ywc12m196pr6xn7l5xbascihygkjj4pbcgcn9wxvi5ssdr6z46z";
+        extraPrefix = "src/3rdparty/";
+        stripLen = 1;
+      })
     ]
       ++ optional stdenv.isDarwin ./qtwebengine-darwin-no-platform-check.patch;
     qtwebkit = [ ./qtwebkit.patch ]

pkgs/development/libraries/randomx/default.nix

@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, cmake }:
+
+stdenv.mkDerivation rec {
+  pname = "randomX";
+  version = "1.1.6";
+
+  nativeBuildInputs = [ cmake ];
+
+  src = fetchFromGitHub {
+    owner = "tevador";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1qd0rbzgxdy87wwy0n6ca29bcq25j5ndnfgmx8iyf225m4rcwngf";
+  };
+
+  meta = with stdenv.lib; {
+    description = "Proof of work algorithm based on random code execution";
+    homepage = https://github.com/tevador/RandomX;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ rnhmjoj ];
+    platforms = platforms.unix;
+  };
+
+}

pkgs/development/libraries/webkitgtk/default.nix

@@ -16,7 +16,7 @@ assert stdenv.isDarwin -> !enableGtk2Plugins;
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "webkitgtk";
-  version = "2.26.1";
+  version = "2.26.2";
 
   meta = {
     description = "Web content rendering engine, GTK port";
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "0mfikjfjhwcnrxbzdyh3fl9bbs2azgbdnx8h5910h41b3n022jvb";
+    sha256 = "04k5h0sid9azsqz9pyq436v1rx4lnfrhvmcgmicqb0c0g9iz103b";
   };
 
   patches = optionals stdenv.isLinux [