NixOS · Sep 22, 2019 · Oct 11, 2019 · Oct 12, 2019 · Oct 12, 2019 · Oct 13, 2019
diff --git a/nixos/modules/services/x11/display-managers/gdm.nix b/nixos/modules/services/x11/display-managers/gdm.nix
@@ -170,8 +170,9 @@ in
       "plymouth-start.service"
     ];
     systemd.services.display-manager.conflicts = [
-      "getty@tty${gdm.initialVT}.service"
-      "plymouth-quit.service"
+       "getty@tty${gdm.initialVT}.service"
+       # TODO: Add "plymouth-quit.service" so GDM can control when plymouth quits.
+       # Currently this breaks switching configurations while using plymouth.
     ];
     systemd.services.display-manager.onFailure = [
       "plymouth-quit.service"

diff --git a/nixos/tests/gnome3-xorg.nix b/nixos/tests/gnome3-xorg.nix
@@ -29,7 +29,7 @@ import ./make-test.nix ({ pkgs, ...} : {
       $machine->waitForUnit("default.target","alice");
 
       # Check that logging in has given the user ownership of devices.
-      $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
+      $machine->succeed("getfacl -p /dev/snd/timer | grep -q alice");
 
       $machine->succeed("su - alice -c 'DISPLAY=:0.0 gnome-terminal &'");
       $machine->succeed("xauth merge ~alice/.Xauthority");

diff --git a/nixos/tests/gnome3.nix b/nixos/tests/gnome3.nix
@@ -44,7 +44,7 @@ import ./make-test.nix ({ pkgs, ...} : {
       $machine->waitForUnit("default.target","alice");
 
       # Check that logging in has given the user ownership of devices.
-      $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
+      $machine->succeed("getfacl -p /dev/snd/timer | grep -q alice");
 
       # Wait for the wayland server
       $machine->waitForFile("/run/user/1000/wayland-0");

diff --git a/nixos/tests/login.nix b/nixos/tests/login.nix
@@ -48,12 +48,12 @@ import ./make-test.nix ({ pkgs, latestKernel ? false, ... }:
       # Check whether systemd gives and removes device ownership as
       # needed.
       subtest "device permissions", sub {
-          $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
+          $machine->succeed("getfacl -p /dev/snd/timer | grep -q alice");
           $machine->sendKeys("alt-f1");
           $machine->waitUntilSucceeds("[ \$(fgconsole) = 1 ]");
-          $machine->fail("getfacl /dev/snd/timer | grep -q alice");
+          $machine->fail("getfacl -p /dev/snd/timer | grep -q alice");
           $machine->succeed("chvt 2");
-          $machine->waitUntilSucceeds("getfacl /dev/snd/timer | grep -q alice");
+          $machine->waitUntilSucceeds("getfacl -p /dev/snd/timer | grep -q alice");
       };
 
       # Log out.

diff --git a/nixos/tests/pantheon.nix b/nixos/tests/pantheon.nix
@@ -42,7 +42,7 @@ import ./make-test.nix ({ pkgs, ...} :
     $machine->waitForWindow(qr/plank/);
 
     # Check that logging in has given the user ownership of devices.
-    $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
+    $machine->succeed("getfacl -p /dev/snd/timer | grep -q alice");
 
     # Open elementary terminal
     $machine->execute("su - alice -c 'DISPLAY=:0.0 io.elementary.terminal &'");

diff --git a/nixos/tests/plasma5.nix b/nixos/tests/plasma5.nix
@@ -48,7 +48,7 @@ import ./make-test.nix ({ pkgs, ...} :
     $machine->waitForWindow("^Desktop ");
 
     # Check that logging in has given the user ownership of devices.
-    $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
+    $machine->succeed("getfacl -p /dev/snd/timer | grep -q alice");
 
     $machine->execute("su - alice -c 'DISPLAY=:0.0 dolphin &'");
     $machine->waitForWindow(" Dolphin");

diff --git a/nixos/tests/xfce.nix b/nixos/tests/xfce.nix
@@ -32,7 +32,7 @@ import ./make-test.nix ({ pkgs, ...} : {
       $machine->sleep(10);
 
       # Check that logging in has given the user ownership of devices.
-      $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
+      $machine->succeed("getfacl -p /dev/snd/timer | grep -q alice");
 
       $machine->succeed("su - alice -c 'DISPLAY=:0.0 xfce4-terminal &'");
       $machine->waitForWindow(qr/Terminal/);

diff --git a/nixos/tests/xfce4-14.nix b/nixos/tests/xfce4-14.nix
@@ -14,7 +14,7 @@ import ./make-test.nix ({ pkgs, ...} : {
       services.xserver.desktopManager.xfce4-14.enable = true;
 
       hardware.pulseaudio.enable = true; # needed for the factl test, /dev/snd/* exists without them but udev doesn't care then
-  
+
       virtualisation.memorySize = 1024;
     };
 
@@ -27,7 +27,7 @@ import ./make-test.nix ({ pkgs, ...} : {
       $machine->sleep(10);
 
       # Check that logging in has given the user ownership of devices.
-      $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
+      $machine->succeed("getfacl -p /dev/snd/timer | grep -q alice");
 
       $machine->succeed("su - alice -c 'DISPLAY=:0.0 xfce4-terminal &'");
       $machine->waitForWindow(qr/Terminal/);

diff --git a/pkgs/applications/networking/browsers/surf/default.nix b/pkgs/applications/networking/browsers/surf/default.nix
@@ -1,6 +1,7 @@
-{ stdenv, fetchurl
+{ lib, stdenv, fetchurl
 , pkgconfig, wrapGAppsHook
 , glib, glib-networking, gsettings-desktop-schemas, gtk, libsoup, webkitgtk
+, xorg, dmenu, findutils, gnused, coreutils
 , patches ? null
 }:
 
@@ -20,6 +21,16 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "PREFIX=$(out)" ];
 
+  # Add run-time dependencies to PATH. Append them to PATH so the user can
+  # override the dependencies with their own PATH.
+  preFixup = let
+    depsPath = lib.makeBinPath [ xorg.xprop dmenu findutils gnused coreutils ];
+  in ''
+    gappsWrapperArgs+=(
+      --suffix PATH : ${depsPath}
+    )
+  '';
+
   meta = with stdenv.lib; {
     description = "A simple web browser based on WebKit/GTK";
     longDescription = ''

diff --git a/pkgs/development/libraries/flatpak/default.nix b/pkgs/development/libraries/flatpak/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--with-system-bubblewrap=${bubblewrap}/bin/bwrap"
     "--with-system-dbus-proxy=${xdg-dbus-proxy}/bin/xdg-dbus-proxy"
-    "--dbus_config_dir=${placeholder "out"}/share/dbus-1/system.d"
+    "--with-dbus-config-dir=${placeholder "out"}/share/dbus-1/system.d"
     "--localstatedir=/var"
     "--enable-installed-tests"
   ];

diff --git a/pkgs/development/libraries/poppler/0.61-CVE-2019-9959.patch b/pkgs/development/libraries/poppler/0.61-CVE-2019-9959.patch
@@ -0,0 +1,20 @@
+diff --git a/poppler/JPEG2000Stream.cc b/poppler/JPEG2000Stream.cc
+--- a/poppler/JPEG2000Stream.cc
++++ b/poppler/JPEG2000Stream.cc
+@@ -201,7 +201,7 @@ void JPXStream::init()
+   if (getDict()) smaskInData = getDict()->lookup("SMaskInData");
+
+   int bufSize = BUFFER_INITIAL_SIZE;
+-  if (oLen.isInt()) bufSize = oLen.getInt();
++  if (oLen.isInt() && oLen.getInt() > 0) bufSize = oLen.getInt();
+
+   if (cspace.isArray() && cspace.arrayGetLength() > 0) {
+
+@@ -365,7 +365,7 @@ void JPXStream::init()
+   }
+
+   int bufSize = BUFFER_INITIAL_SIZE;
+-  if (oLen.isInt()) bufSize = oLen.getInt();
++  if (oLen.isInt() && oLen.getInt() > 0) bufSize = oLen.getInt();
+
+   if (cspace.isArray() && cspace.arrayGetLength() > 0) {
diff --git a/pkgs/development/libraries/poppler/0.61.nix b/pkgs/development/libraries/poppler/0.61.nix
@@ -8,15 +8,15 @@
 }:
 
 let
-  version = "0.61.0";
+  version = "0.61.1";
   mkFlag = optset: flag: "-DENABLE_${flag}=${if optset then "on" else "off"}";
 in
 stdenv.mkDerivation rec {
   name = "poppler-${suffix}-${version}";
 
   src = fetchurl {
     url = "${meta.homepage}/poppler-${version}.tar.xz";
-    sha256 = "0zrbb1b77k6bm2qdnra08jnbyllv6vj29790igmp6fzs59xf3kak";
+    sha256 = "1afdrxxkaivvviazxkg5blsf2x24sjkfj92ib0d3q5pm8dihjrhj";
   };
 
   outputs = [ "out" "dev" ];
@@ -27,6 +27,7 @@ stdenv.mkDerivation rec {
       url = "https://cgit.freedesktop.org/poppler/poppler/patch/?id=004e3c10df0abda214f0c293f9e269fdd979c5ee";
       sha256 = "1l8713s57xc6g81bldw934rsfm140fqc7ggd50ha5mxdl1b3app2";
     })
+    ./0.61-CVE-2019-9959.patch
   ];
 
   buildInputs = [ libiconv libintl ] ++ lib.optional withData poppler_data;

diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, cmake, ninja, pkgconfig, libiconv, libintl
+{ stdenv, lib, fetchurl, fetchpatch, cmake, ninja, pkgconfig, libiconv, libintl
 , zlib, curl, cairo, freetype, fontconfig, lcms, libjpeg, openjpeg
 , withData ? true, poppler_data
 , qt5Support ? false, qtbase ? null
@@ -21,6 +21,14 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2019-9959.patch";
+      url = "https://gitlab.freedesktop.org/poppler/poppler/commit/68ef84e5968a4249c2162b839ca6d7975048a557.patch";
+      sha256 = "17a3qs74fnnrhjys23f4aw5y7yfsk5d507jcj4hh1bndqv6dpwg1";
+    })
+  ];
+
   buildInputs = [ libiconv libintl ] ++ lib.optional withData poppler_data;
 
   # TODO: reduce propagation to necessary libs

diff --git a/pkgs/development/libraries/science/math/mkl/default.nix b/pkgs/development/libraries/science/math/mkl/default.nix
@@ -3,7 +3,7 @@
   For details on using mkl as a blas provider for python packages such as numpy,
   numexpr, scipy, etc., see the Python section of the NixPkgs manual.
 */
-stdenvNoCC.mkDerivation (rec {
+stdenvNoCC.mkDerivation rec {
   name = "mkl-${version}";
   version = "${date}.${rel}";
   date = "2019.3";
@@ -35,11 +35,25 @@ stdenvNoCC.mkDerivation (rec {
       done
   '' else ''
     rpmextract rpm/intel-mkl-common-c-${date}-${rel}-${date}-${rel}.noarch.rpm
+    rpmextract rpm/intel-mkl-core-${date}-${rel}-${date}-${rel}.x86_64.rpm
     rpmextract rpm/intel-mkl-core-rt-${date}-${rel}-${date}-${rel}.x86_64.rpm
     rpmextract rpm/intel-openmp-19.0.3-${rel}-19.0.3-${rel}.x86_64.rpm
   '';
 
-  installPhase = if stdenvNoCC.isDarwin then ''
+  installPhase = ''
+    for f in $(find . -name 'mkl*.pc') ; do
+      bn=$(basename $f)
+      substituteInPlace $f \
+        --replace "prefix=<INSTALLDIR>/mkl" "prefix=$out" \
+        --replace "lib/intel64_lin" "lib"
+    done
+
+    for f in $(find opt/intel -name 'mkl*iomp.pc') ; do
+      substituteInPlace $f \
+        --replace "../compiler/lib" "lib"
+    done
+  '' +
+    (if stdenvNoCC.isDarwin then ''
       mkdir -p $out/lib
 
       cp -r compilers_and_libraries_${version}/mac/mkl/include $out/
@@ -48,6 +62,9 @@ stdenvNoCC.mkDerivation (rec {
       cp -r compilers_and_libraries_${version}/mac/compiler/lib/* $out/lib/
       cp -r compilers_and_libraries_${version}/mac/mkl/lib/* $out/lib/
       cp -r compilers_and_libraries_${version}/mac/tbb/lib/* $out/lib/
+
+      mkdir -p $out/lib/pkgconfig
+      cp -r compilers_and_libraries_${version}/mac/mkl/bin/pkgconfig/* $out/lib/pkgconfig
   '' else ''
       mkdir -p $out/lib
 
@@ -56,7 +73,10 @@ stdenvNoCC.mkDerivation (rec {
       cp -r opt/intel/compilers_and_libraries_${version}/linux/compiler/lib/intel64_lin/* $out/lib/
       cp -r opt/intel/compilers_and_libraries_${version}/linux/mkl/lib/intel64_lin/* $out/lib/
       cp license.txt $out/lib/
-  '';
+
+      mkdir -p $out/lib/pkgconfig
+      cp -r opt/intel/compilers_and_libraries_${version}/linux/mkl/bin/pkgconfig/* $out/lib/pkgconfig
+  '');
 
   # fixDarwinDylibName fails for libmkl_cdft_core.dylib because the
   # larger updated load commands do not fit. Use install_name_tool
@@ -87,10 +107,4 @@ stdenvNoCC.mkDerivation (rec {
     platforms = [ "x86_64-linux" "x86_64-darwin" ];
     maintainers = [ maintainers.bhipple ];
   };
- } // stdenvNoCC.lib.optionalAttrs stdenvNoCC.isLinux {
-  # Since on Linux binaries are unmodified, we can make them
-  # fixed-output derivations.
-	outputHashAlgo = "sha256";
-	outputHashMode = "recursive";
-	outputHash = "101krzh2mjbfx8kvxim2zphdvgg7iijhbf9xdz3ad3ncgybxbdvw";
- })
+}
diff --git a/pkgs/development/libraries/tracker/default.nix b/pkgs/development/libraries/tracker/default.nix
@@ -20,10 +20,11 @@ stdenv.mkDerivation rec {
     gtk-doc docbook_xsl docbook_xml_dtd_412 docbook_xml_dtd_43 glibcLocales
     python3 # for data-generators
     systemd # used for checks to install systemd user service
+    dbus # used for checks and pkgconfig to install dbus service/s
   ];
 
   buildInputs = [
-    glib libxml2 sqlite upower icu networkmanager libsoup libuuid json-glib libstemmer dbus
+    glib libxml2 sqlite upower icu networkmanager libsoup libuuid json-glib libstemmer
   ];
 
   mesonFlags = [

diff --git a/pkgs/misc/drivers/epkowa/default.nix b/pkgs/misc/drivers/epkowa/default.nix
@@ -30,7 +30,15 @@ let plugins = {
     version = "2.30.4";
 
     src = fetchurl {
-      url = "https://download2.ebz.epson.net/iscan/plugin/perfection-v330/rpm/x64/iscan-perfection-v330-bundle-${version}.x64.rpm.tar.gz";
+      # To find new versions, visit
+      # http://download.ebz.epson.net/dsc/search/01/search/?OSC=LX and search for
+      # some printer like for instance "WF-7210" to get to the most recent
+      # version.  
+      # NOTE: Don't forget to update the webarchive link too!
+      urls = [
+        "https://download2.ebz.epson.net/iscan/plugin/perfection-v330/rpm/x64/iscan-perfection-v330-bundle-${version}.x64.rpm.tar.gz"
+        "https://web.archive.org/web/https://download2.ebz.epson.net/iscan/plugin/perfection-v330/rpm/x64/iscan-perfection-v330-bundle-${version}.x64.rpm.tar.gz"
+      ];
       sha256 = "16iq5gmfcgkvcx5hixggxgb8lwin5gjdhnq0zabgpfqg11n2w21q";
     };
 
@@ -57,7 +65,10 @@ let plugins = {
 
     nativeBuildInputs = [ autoPatchelfHook rpm ];
     src = fetchurl {
-      url = "https://download2.ebz.epson.net/iscan/plugin/gt-x770/rpm/x64/iscan-gt-x770-bundle-${version}.x64.rpm.tar.gz";
+      urls = [
+        "https://download2.ebz.epson.net/iscan/plugin/gt-x770/rpm/x64/iscan-gt-x770-bundle-${version}.x64.rpm.tar.gz"
+        "https://web.archive.org/web/https://download2.ebz.epson.net/iscan/plugin/gt-x770/rpm/x64/iscan-gt-x770-bundle-${version}.x64.rpm.tar.gz"
+      ];
       sha256 = "1cz4z3wz216s77z185m665jcgdslil5gn4dsi118nv1fm17z3jik";
     };
     installPhase = ''
@@ -84,7 +95,10 @@ let plugins = {
     nativeBuildInputs= [ autoPatchelfHook ];
     buildInputs = [ gcc.cc.lib ];
     src = fetchurl {
-      url = "https://download2.ebz.epson.net/iscan/plugin/gt-f720/rpm/x64/iscan-gt-f720-bundle-${version}.x64.rpm.tar.gz";
+      urls = [
+        "https://download2.ebz.epson.net/iscan/plugin/gt-f720/rpm/x64/iscan-gt-f720-bundle-${version}.x64.rpm.tar.gz"
+        "https://web.archive.org/web/https://download2.ebz.epson.net/iscan/plugin/gt-f720/rpm/x64/iscan-gt-f720-bundle-${version}.x64.rpm.tar.gz"
+      ];
       sha256 = "12rivh00n9mhagy5yjl1m0bv7ypbig6brqkxm0a12xy0mjq7yv8y";
     };
     installPhase = ''
@@ -111,7 +125,10 @@ let plugins = {
     nativeBuildInputs = [ autoPatchelfHook ];
     buildInputs = [ gcc.cc.lib libtool ];
     src = fetchurl {
-      url = "https://download2.ebz.epson.net/iscan/plugin/gt-s80/rpm/x64/iscan-gt-s80-bundle-${version}.x64.rpm.tar.gz";
+      urls = [
+        "https://download2.ebz.epson.net/iscan/plugin/gt-s80/rpm/x64/iscan-gt-s80-bundle-${version}.x64.rpm.tar.gz"
+        "https://web.archive.org/web/https://download2.ebz.epson.net/iscan/plugin/gt-s80/rpm/x64/iscan-gt-s80-bundle-${version}.x64.rpm.tar.gz"
+      ];
       sha256 = "1ran75zsxcdci00jakngkz6p9lj4q483hjapmf80p68rzhpmdr5y";
     };
     installPhase = ''
@@ -145,7 +162,10 @@ let plugins = {
     nativeBuildInputs = [ autoPatchelfHook ];
 
     src = fetchurl {
-      url = "https://download2.ebz.epson.net/iscan/general/rpm/x64/iscan-bundle-${version}.x64.rpm.tar.gz";
+      urls = [
+        "https://download2.ebz.epson.net/iscan/general/rpm/x64/iscan-bundle-${version}.x64.rpm.tar.gz"
+        "https://web.archive.org/web/https://download2.ebz.epson.net/iscan/general/rpm/x64/iscan-bundle-${version}.x64.rpm.tar.gz"
+      ];
       sha256 = "1l0y4dy88y91jdq66pxrxqmiwsxwy0rd7x4bh0cw08r4iyhjqprz";
     };
     installPhase = ''
@@ -179,7 +199,10 @@ let iscan-data = stdenv.mkDerivation rec {
   version = "1.39.1-2";
 
   src = fetchurl {
-    url = "http://support.epson.net/linux/src/scanner/iscan/iscan-data_${version}.tar.gz";
+    urls = [
+      "http://support.epson.net/linux/src/scanner/iscan/iscan-data_${version}.tar.gz"
+      "https://web.archive.org/web/http://support.epson.net/linux/src/scanner/iscan/iscan-data_${version}.tar.gz"
+    ];
     sha256 = "04zrvbnxf1k6zinrd13hwnbzscc3qhmwlvx3k2jhjys2lginw7w4";
   };
 
@@ -195,7 +218,10 @@ stdenv.mkDerivation rec {
   version = "2.30.4-2";
 
   src = fetchurl {
-    url = "http://support.epson.net/linux/src/scanner/iscan/iscan_${version}.tar.gz";
+    urls = [
+      "http://support.epson.net/linux/src/scanner/iscan/iscan_${version}.tar.gz"
+      "https://web.archive.org/web/http://support.epson.net/linux/src/scanner/iscan/iscan_${version}.tar.gz"
+    ];
     sha256 = "1ma76jj0k3bz0fy06fiyl4di4y77rcryb0mwjmzs5ms2vq9rjysr";
   };
 
@@ -211,7 +237,10 @@ stdenv.mkDerivation rec {
 
   patches = [
     (fetchpatch {
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-gfx/iscan/files/iscan-2.28.1.3+libpng-1.5.patch?h=b6e4c805d53b49da79a0f64ef16bb82d6d800fcf";
+      urls = [
+        "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-gfx/iscan/files/iscan-2.28.1.3+libpng-1.5.patch?h=b6e4c805d53b49da79a0f64ef16bb82d6d800fcf"
+        "https://web.archive.org/web/https://gitweb.gentoo.org/repo/gentoo.git/plain/media-gfx/iscan/files/iscan-2.28.1.3+libpng-1.5.patch?h=b6e4c805d53b49da79a0f64ef16bb82d6d800fcf"
+      ];
       sha256 = "04y70qjd220dpyh771fiq50lha16pms98mfigwjczdfmx6kpj1jd";
     })
     ./firmware_location.patch

diff --git a/pkgs/misc/drivers/epson-201106w/default.nix b/pkgs/misc/drivers/epson-201106w/default.nix
@@ -10,7 +10,12 @@ in
     inherit version;
 
     src = fetchurl {
-      url = "https://download.ebz.epson.net/dsc/op/stable/SRPMS/epson-inkjet-printer-201106w-${version}-1lsb3.2.src.rpm";
+      # NOTE: Don't forget to update the webarchive link too!
+      urls = [
+        "https://download.ebz.epson.net/dsc/op/stable/SRPMS/epson-inkjet-printer-201106w-${version}-1lsb3.2.src.rpm"
+        "https://web.archive.org/web/https://download.ebz.epson.net/dsc/op/stable/SRPMS/epson-inkjet-printer-201106w-${version}-1lsb3.2.src.rpm"     
+      ];
+
       sha256 = "1yig1xrh1ikblbp7sx706n5nnc237wy4mbch23ymy6akbgqg4aig";
     };