openexr,imlbase: 2.3.0 -> 2.4.1

pkgs/development/libraries/ilmbase/default.nix

@@ -1,14 +1,15 @@
-{ stdenv, fetchurl, buildPackages, automake, autoconf, libtool, which,
-  fetchpatch }:
+{ stdenv, lib, buildPackages, automake, autoconf, libtool, which,
+  fetchpatch, openexr }:
 
 stdenv.mkDerivation rec {
   pname = "ilmbase";
-  version = "2.3.0";
+  version = lib.getVersion openexr;
 
-  src = fetchurl {
-    url = "https://github.com/openexr/openexr/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "0qiq5bqq9rxhqjiym2k36sx4vq8adgrz6xf6qwizi9bqm78phsa5";
-  };
+  # the project no longer provides separate tarballs. We may even want to merge
+  # the ilmbase package into openexr in the future.
+  src = openexr.src;
+
+  sourceRoot = "source/IlmBase";
 
   outputs = [ "out" "dev" ];
 
@@ -23,15 +24,7 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_LINK = "-pthread";
 
   patches = [
-    ./bootstrap.patch
     ./cross.patch
-    (fetchpatch {
-      name = "CVE-2018-18443.patch";
-      url = "https://github.com/kdt3rd/openexr/commit/5fa930b82cff2db386c64ca512af19e60c14d32a.patch";
-      sha256 = "1j6xd0qkx99acc1szycxaj0wwp01yac67jz48hwc4fwwpz8blx4s";
-      stripLen = 1;
-      excludes = [ "CHANGES.md" ];
-    })
   ];
 
   # fails 1 out of 1 tests with