Merge remote-tracking branch 'upstream/master' into hardened-stdenv

pkgs/tools/security/chntpw/default.nix

@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1k1cxsj0221dpsqi5yibq2hr7n8xywnicl8yyaicn91y8h2hkqln";
   };
 
-  buildInputs = [ unzip ];
+  buildInputs = [ unzip ]
+    ++ stdenv.lib.optionals stdenv.isLinux [ stdenv.glibc.out stdenv.glibc.static ];
 
   patches = [
     ./00-chntpw-build-arch-autodetect.patch

pkgs/tools/security/cipherscan/default.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   buildPhase = ''
     substituteInPlace cipherscan \
       --replace "@OPENSSLBIN@" \
-                "${openssl}/bin/openssl" \
+                "${openssl.bin}/bin/openssl" \
       --replace "@TIMEOUTBIN@" \
                 "${coreutils}/bin/timeout" \
       --replace "@READLINKBIN@" \
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
     substituteInPlace analyze.py \
       --replace "@OPENSSLBIN@" \
-                "${openssl}/bin/openssl"
+                "${openssl.bin}/bin/openssl"
   '';
   installPhase = ''
     mkdir -p $out/bin

pkgs/tools/security/clamav/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "clamav-${version}";
-  version = "0.99";
+  version = "0.99.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/clamav/clamav-${version}.tar.gz";
-    sha256 = "1abyg349yr31z764jcgx67q5v098jrkrj88bqkzmys6xza62qyfj";
+    sha256 = "12nm4mxzx3qlbm65cadflzncjfkxdfqcp0lch29i5yfk4a8nhi71";
   };
 
   buildInputs = [ zlib bzip2 libxml2 openssl ncurses curl libiconv libmilter pcre ];

pkgs/tools/security/eid-mw/default.nix

@@ -3,10 +3,10 @@
 
 stdenv.mkDerivation rec {
   name = "eid-mw-${version}";
-  version = "4.1.13";
+  version = "4.1.14";
 
   src = fetchFromGitHub {
-    sha256 = "1fkazhw6gs191w789fnp6mwnxrx9p38b3kh5bngb1ir0zhkgghkq";
+    sha256 = "1gj08dylcwdfjmdci1ja853n9xqkhgxy0x8m30bks81qwbnd12lp";
     rev = "v${version}";
     repo = "eid-mw";
     owner = "Fedict";

pkgs/tools/security/modsecurity/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl
+{ stdenv, lib, fetchurl, pkgconfig
 , curl, apacheHttpd, pcre, apr, aprutil, libxml2 }:
 
 with lib;
@@ -12,6 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "e2bbf789966c1f80094d88d9085a81bde082b2054f8e38e0db571ca49208f434";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ curl apacheHttpd pcre apr aprutil libxml2 ];
   configureFlags = [
     "--enable-standalone-module"

pkgs/tools/security/mpw/default.nix

@@ -27,7 +27,7 @@ in stdenv.mkDerivation {
     patchShebangs .
   '';
 
-  NIX_CFLAGS_COMPILE = "-I${libxml2}/include/libxml2";
+  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   buildInputs = [ autoconf automake openssl libxml2 ];
 

pkgs/tools/security/pass/default.nix

@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
   preInstall = ''
     mkdir -p "$out/share/bash-completion/completions"
     mkdir -p "$out/share/zsh/site-functions"
-    mkdir -p "$out/share/fish/completions"
+    mkdir -p "$out/share/fish/vendor_completions.d"
   '';
 
   installFlags = [ "PREFIX=$(out)" ];
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     '' else ""}
   '';
 
-  wrapperPath = with stdenv.lib; makeSearchPath "bin/" ([
+  wrapperPath = with stdenv.lib; makeBinPath ([
     coreutils
     gnused
     getopt

pkgs/tools/security/pass/rofi-pass.nix

@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     cp -a $src/config.example $out/share/doc/rofi-pass/config.example
   '';
 
-  wrapperPath = with stdenv.lib; makeSearchPath "bin/" [
+  wrapperPath = with stdenv.lib; makeBinPath [
     coreutils
     findutils
     gnugrep

pkgs/tools/security/pcsctools/default.nix

@@ -3,7 +3,7 @@
 , perl, pcscperl, Glib, Gtk2, Pango
 }:
 
-let deps = lib.makeSearchPath "bin" [ wget coreutils ];
+let deps = lib.makeBinPath [ wget coreutils ];
 
 in stdenv.mkDerivation rec {
   name = "pcsc-tools-1.4.25";

pkgs/tools/security/prey/default.nix

@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
     cp -R . $out
     cp -R ${modulesSrc}/* $out/modules/
     wrapProgram "$out/prey.sh" \
-      --prefix PATH ":" "${xawtv}/bin:${imagemagick}/bin:${curl}/bin:${scrot}/bin:${inetutils}/bin:${coreutils}/bin" \
+      --prefix PATH ":" "${xawtv}/bin:${imagemagick}/bin:${curl.bin}/bin:${scrot}/bin:${inetutils}/bin:${coreutils}/bin" \
       --set CURL_CA_BUNDLE "/etc/ssl/certs/ca-certificates.crt"
   '';
 

pkgs/tools/security/softhsm/default.nix

@@ -0,0 +1,31 @@
+{ stdenv, fetchurl, botan }:
+
+stdenv.mkDerivation rec {
+
+  name = "softhsm-${version}";
+  version = "2.1.0";
+
+  src = fetchurl {
+    url = "https://dist.opendnssec.org/source/${name}.tar.gz";
+    sha256 = "0399b06f196fbfaebe73b4aeff2e2d65d0dc1901161513d0d6a94f031dcd827e";
+  };
+
+  configureFlags = [
+    "--with-crypto-backend=botan"
+    "--with-botan=${botan}"
+    "--sysconfdir=$out/etc"
+    "--localstatedir=$out/var"
+    ];
+
+  buildInputs = [ botan ];
+
+  postInstall = "rm -rf $out/var";
+
+  meta = {
+    homepage = https://www.opendnssec.org/softhsm;
+    description = "Cryptographic store accessible through a PKCS #11 interface";
+    license = stdenv.lib.licenses.bsd2;
+    maintainers = stdenv.lib.maintainers.leenaars;
+    platforms = stdenv.lib.platforms.linux;
+  };
+}

pkgs/tools/security/sshuttle/default.nix

@@ -3,10 +3,10 @@
   
 pythonPackages.buildPythonApplication rec {
   name = "sshuttle-${version}";
-  version = "0.77.2";
+  version = "0.78.0";
 
   src = fetchurl {
-    sha256 = "1fwlhr5r9pl3pns65nn4mxf5ivypmd2a12gv3vpyznfy5f097k10";
+    sha256 = "18hrwi2gyri1n2rq0nghvv7hfhbhh5h67am89524vc1yyx40vn3b";
     url = "https://pypi.python.org/packages/source/s/sshuttle/${name}.tar.gz";
   };
 

pkgs/tools/security/sudo/default.nix

@@ -4,14 +4,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "sudo-1.8.15";
+  name = "sudo-1.8.16";
 
   src = fetchurl {
     urls =
       [ "ftp://ftp.sudo.ws/pub/sudo/${name}.tar.gz"
         "ftp://ftp.sudo.ws/pub/sudo/OLD/${name}.tar.gz"
       ];
-    sha256 = "0263gi6i19fyzzc488n0qw3m518i39f6a7qmrfvahk9j10bkh5j3";
+    sha256 = "0k86sm9ilhxhvnfwq3092zhfxazj3kddn0y2mirz0nqjqmpq50rd";
   };
 
   configureFlags = [

pkgs/tools/security/thc-hydra/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, openssl, libidn, ncurses, pcre, libssh, postgresql92 }:
+{ stdenv, fetchurl, pkgconfig, openssl, libidn, ncurses, pcre, libssh, postgresql92 }:
 
 with stdenv.lib;
 
@@ -12,10 +12,11 @@ stdenv.mkDerivation rec {
   };
 
   preConfigure = ''
-   substituteInPlace configure --replace "\$LIBDIRS" "${openssl}/lib ${pcre}/lib ${libssh}/lib ${postgresql92}/lib"
-   substituteInPlace configure --replace "\$INCDIRS" "${openssl}/include ${pcre}/include ${libssh}/include ${postgresql92}/include"
+   substituteInPlace configure --replace "\$LIBDIRS" "${openssl.out}/lib ${pcre.out}/lib ${libssh.out}/lib ${postgresql92.lib}/lib"
+   substituteInPlace configure --replace "\$INCDIRS" "${openssl.dev}/include ${pcre.dev}/include ${libssh.dev}/include ${postgresql92}/include"
   '';
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ openssl libidn ncurses pcre libssh ];
 
   meta = {

pkgs/tools/security/tor/tor-arm.nix

@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     for i in $(cd $out/bin && ls); do
       wrapProgram $out/bin/$i \
         --prefix PYTHONPATH : "$(toPythonPath $out):$(toPythonPath ${pythonPackages.curses}):$out/libexec:$PYTHONPATH" \
-        --set TERMINFO "${ncurses}/share/terminfo" \
+        --set TERMINFO "${ncurses.out}/share/terminfo" \
         --set TERM     "xterm"
     done
   '';

pkgs/tools/security/trousers/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   # Fix broken libtool file
   preFixup = stdenv.lib.optionalString (!stdenv.isDarwin) ''
-    sed 's,-lcrypto,-L${openssl}/lib -lcrypto,' -i $out/lib/libtspi.la
+    sed 's,-lcrypto,-L${openssl.out}/lib -lcrypto,' -i $out/lib/libtspi.la
   '';
 
   meta = with stdenv.lib; {