NixOS · Jan 4, 2019 · Jan 4, 2019 · Jan 4, 2019 · Jan 4, 2019 · Jan 4, 2019
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
@@ -92,7 +92,7 @@ in
   hadoop.yarn = handleTestOn [ "x86_64-linux" ] ./hadoop/yarn.nix {};
   handbrake = handleTestOn ["x86_64-linux"] ./handbrake.nix {};
   haproxy = handleTest ./haproxy.nix {};
-  #hardened = handleTest ./hardened.nix {}; # broken due useSandbox = true
+  hardened = handleTest ./hardened.nix {};
   hibernate = handleTest ./hibernate.nix {};
   hitch = handleTest ./hitch {};
   hocker-fetchdocker = handleTest ./hocker-fetchdocker {};

diff --git a/nixos/tests/hardened.nix b/nixos/tests/hardened.nix
@@ -5,7 +5,7 @@ import ./make-test.nix ({ pkgs, ...} : {
   };
 
   machine =
-    { lib, pkgs, ... }:
+    { lib, pkgs, config, ... }:
     with lib;
     { users.users.alice = { isNormalUser = true; extraGroups = [ "proc" ]; };
       users.users.sybil = { isNormalUser = true; group = "wheel"; };
@@ -22,12 +22,19 @@ import ./make-test.nix ({ pkgs, ...} : {
           options = [ "noauto" ];
         };
       };
+      boot.extraModulePackages = [ config.boot.kernelPackages.wireguard ];
+      boot.kernelModules = [ "wireguard" ];
     };
 
   testScript =
     ''
       $machine->waitForUnit("multi-user.target");
 
+      # Test loading out-of-tree modules
+      subtest "extra-module-packages", sub {
+          $machine->succeed("grep -Fq wireguard /proc/modules");
+      };
+
       # Test hidepid
       subtest "hidepid", sub {
           $machine->succeed("grep -Fq hidepid=2 /proc/mounts");

diff --git a/pkgs/applications/audio/a2jmidid/default.nix b/pkgs/applications/audio/a2jmidid/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeWrapper, pkgconfig, alsaLib, dbus, libjack2
+{ stdenv, fetchurl, fetchpatch, makeWrapper, pkgconfig, alsaLib, dbus, libjack2
 , wafHook
 , python2Packages}:
 
@@ -16,6 +16,17 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig makeWrapper wafHook ];
   buildInputs = [ alsaLib dbus libjack2 python dbus-python ];
 
+  patches = [
+    (fetchpatch {
+      url = https://repo.or.cz/a2jmidid.git/patch/24e3b8e543256ae8fdfb4b75eb9fd775f07c46e2;
+      sha256 = "1nxrvnhxlgqc9wbxnp1gnpw4wjyzxvymwcg1gh2nqzmssgfykfkc";
+    })
+    (fetchpatch {
+      url = https://repo.or.cz/a2jmidid.git/patch/7f82da7eb2f540a94db23331be98d42a58ddc269;
+      sha256 = "1nab9zf0agbcj5pvhl90pz0cx1d204d4janqflc5ymjhy8jyrsdv";
+    })
+  ];
+
   postInstall = ''
     wrapProgram $out/bin/a2j_control --set PYTHONPATH $PYTHONPATH
   '';

diff --git a/pkgs/applications/audio/bitmeter/default.nix b/pkgs/applications/audio/bitmeter/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libjack2, gtk2, pkgconfig }:
+{ stdenv, autoreconfHook, fetchurl, libjack2, gtk2, pkgconfig }:
 
 stdenv.mkDerivation rec {
   name = "bitmeter-${version}";
@@ -9,9 +9,16 @@ stdenv.mkDerivation rec {
     sha256 = "09ck2gxqky701dc1p0ip61rrn16v0pdc7ih2hc2sd63zcw53g2a7";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ libjack2 gtk2 ];
 
+  patches = [
+    (fetchurl {
+      url = https://gitweb.gentoo.org/repo/gentoo.git/plain/media-sound/bitmeter/files/bitmeter-1.2-fix-build-system.patch;
+      sha256 = "021mz6933iw7mpk6b9cbjr8naj6smbq1hwqjszlyx72qbwrrid7k";
+    })
+  ];
+
   meta = with stdenv.lib; {
     homepage = http://devel.tlrmx.org/audio/bitmeter/;
     description = "Also known as jack bitscope. Useful to detect denormals";

diff --git a/pkgs/applications/audio/jack-rack/default.nix b/pkgs/applications/audio/jack-rack/default.nix
@@ -7,6 +7,11 @@ stdenv.mkDerivation rec {
   };
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libjack2 ladspaH gtk2 alsaLib libxml2 librdf ];
+  NIX_LDFLAGS = [
+    "-ldl"
+    "-lm"
+    "-lpthread"
+  ];
 
   meta = {
     description = ''An effects "rack" for the JACK low latency audio API'';

diff --git a/pkgs/applications/audio/lash/default.nix b/pkgs/applications/audio/lash/default.nix
@@ -18,6 +18,11 @@ stdenv.mkDerivation  rec {
   buildInputs = [ alsaLib gtk2 libjack2 libxml2 makeWrapper
     pkgconfig readline ];
   propagatedBuildInputs = [ libuuid ];
+  NIX_LDFLAGS = [
+    "-lm"
+    "-lpthread"
+    "-luuid"
+  ];
 
   postInstall = ''
     for i in lash_control lash_panel

diff --git a/pkgs/applications/audio/pianobooster/default.nix b/pkgs/applications/audio/pianobooster/default.nix
@@ -17,6 +17,7 @@ stdenv.mkDerivation  rec {
   preConfigure = "cd src";
 
   buildInputs = [ alsaLib cmake makeWrapper libGLU_combined qt4 ];
+  NIX_LDFLAGS = [ "-lGL" "-lpthread" ];
 
   postInstall = ''
     wrapProgram $out/bin/pianobooster \

diff --git a/pkgs/applications/audio/timemachine/default.nix b/pkgs/applications/audio/timemachine/default.nix
@@ -19,6 +19,10 @@ stdenv.mkDerivation rec {
 
   preConfigure = "./autogen.sh";
 
+  NIX_LDFLAGS =  [
+    "-lm"
+  ];
+
   meta = {
     description = "JACK audio recorder";
     homepage = http://plugin.org.uk/timemachine/;

diff --git a/pkgs/applications/editors/texmacs/default.nix b/pkgs/applications/editors/texmacs/default.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation {
   };
 
   buildInputs = [ guile_1_8 qt4 makeWrapper ghostscriptX freetype ];
+  NIX_LDFLAGS = [ "-lz" ];
 
   postInstall = "wrapProgram $out/bin/texmacs --suffix PATH : " +
         (if ghostscriptX == null then "" else "${ghostscriptX}/bin:") +
@@ -33,12 +34,6 @@ stdenv.mkDerivation {
 
   inherit (common) postPatch;
 
-  postFixup = ''
-    bin="$out/libexec/TeXmacs/bin/texmacs.bin"
-    rpath=$(patchelf --print-rpath "$bin")
-    patchelf --set-rpath "$rpath:${zlib.out}/lib" "$bin"
-  '';
-
   meta = common.meta // {
     maintainers = [ stdenv.lib.maintainers.roconnor ];
     platforms = stdenv.lib.platforms.gnu ++ stdenv.lib.platforms.linux;  # arbitrary choice

diff --git a/pkgs/applications/graphics/ahoviewer/default.nix b/pkgs/applications/graphics/ahoviewer/default.nix
@@ -29,6 +29,10 @@ stdenv.mkDerivation rec {
     gst_all_1.gst-plugins-base
   ] ++ stdenv.lib.optional useUnrar unrar;
 
+  NIX_LDFLAGS = [
+    "-lpthread"
+  ];
+
   postPatch = ''patchShebangs version.sh'';
 
   postInstall = ''

diff --git a/pkgs/applications/graphics/autopanosiftc/default.nix b/pkgs/applications/graphics/autopanosiftc/default.nix
@@ -10,6 +10,13 @@ stdenv.mkDerivation {
 
   buildInputs = [ cmake libpng libtiff libjpeg panotools libxml2 ];
 
+  patches = [
+    (fetchurl {
+      url = https://gitweb.gentoo.org/repo/gentoo.git/plain/media-gfx/autopano-sift-C/files/autopano-sift-C-2.5.1-lm.patch;
+      sha256 = "1bfcr5sps0ip9gl4jprji5jgf9wkczz6d2clsjjlbsy8r3ixi3lv";
+    })
+  ];
+
   meta = {
     homepage = http://hugin.sourceforge.net/;
     description = "Implementation in C of the autopano-sift algorithm for automatically stitching panoramas";

diff --git a/pkgs/applications/graphics/cinepaint/default.nix b/pkgs/applications/graphics/cinepaint/default.nix
@@ -26,7 +26,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkgconfig ];
 
-  NIX_LDFLAGS = "-llcms -ljpeg -lX11";
+  NIX_LDFLAGS = "-lm -llcms -ljpeg -lpng -lX11";
 
   meta = {
     homepage = http://www.cinepaint.org/;

diff --git a/pkgs/applications/graphics/feh/default.nix b/pkgs/applications/graphics/feh/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     install -D -m 644 man/*.1 $out/share/man/man1
   '';
 
-  checkInputs = [ perlPackages.TestCommand ];
+  checkInputs = [ perlPackages.perl perlPackages.TestCommand ];
   preCheck = ''
     export PERL5LIB="${perlPackages.TestCommand}/${perlPackages.perl.libPrefix}"
   '';

diff --git a/pkgs/applications/graphics/goxel/default.nix b/pkgs/applications/graphics/goxel/default.nix
@@ -16,6 +16,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ scons pkgconfig wrapGAppsHook ];
   buildInputs = [ glfw3 gtk3 libpng12 ];
+  NIX_LDFLAGS = [
+    "-lpthread"
+  ];
 
   buildPhase = ''
     make release

diff --git a/pkgs/applications/graphics/gqview/default.nix b/pkgs/applications/graphics/gqview/default.nix
@@ -18,6 +18,10 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "format" ];
 
+  NIX_LDFLAGS = [
+    "-lm"
+  ];
+
   meta = with stdenv.lib; {
     description = "A fast image viewer";
     homepage = http://gqview.sourceforge.net;

diff --git a/pkgs/applications/misc/1password/default.nix b/pkgs/applications/misc/1password/default.nix
@@ -1,25 +1,25 @@
 { stdenv, fetchzip }:
 
 stdenv.mkDerivation rec {
-  name = "1password-${version}";
-  version = "0.5.4";
+  pname = "1password";
+  version = "0.5.5";
   src =
     if stdenv.hostPlatform.system == "i686-linux" then
       fetchzip {
         url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_linux_386_v${version}.zip";
-        sha256 = "0wni2hk5b1qfr24vi24jiprpi08k3qgaw9lqp61k41a1sjp3izv0";
+        sha256 = "14qx69fq1a3h93h167nhwp6gxka8r34295p82kim9grijrx5zz5f";
         stripRoot = false;
       }
     else if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchzip {
         url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_linux_amd64_v${version}.zip";
-        sha256 = "169d5fl3cfw3xrlpm9nlmwbnp0xgh0la9qybzf8ragp0020nlyih";
+        sha256 = "1jh1sk07k3whbr0rvc4kf221wskcdbk0zpxaj49qbwq1d89cjnpg";
         stripRoot = false;
       }
     else if stdenv.hostPlatform.system == "x86_64-darwin" then
       fetchzip {
         url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_darwin_amd64_v${version}.zip";
-        sha256 = "1scikv7v33kzg9rqsrz97yklxaskvif84br13zg8annm43k5vlma";
+        sha256 = "1s6gw2qwsbhj4z9nrwrxs776y45ingpfp9533qz0gc1pk7ia99js";
         stripRoot = false;
       }
     else throw "Architecture not supported";

diff --git a/pkgs/applications/misc/artha/default.nix b/pkgs/applications/misc/artha/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, dbus-glib, gtk2, pkgconfig, wordnet }:
+{ stdenv, autoreconfHook, fetchurl, dbus-glib, gtk2, pkgconfig, wordnet }:
 
 stdenv.mkDerivation rec {
   name = "artha-${version}";
@@ -9,9 +9,13 @@ stdenv.mkDerivation rec {
     sha256 = "0qr4ihl7ma3cq82xi1fpzvf74mm9vsg0j035xvmcp3r6rmw2fycx";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ dbus-glib gtk2 wordnet ];
 
+  patches = [
+    ./gio-underlink.patch
+  ];
+
   meta = with stdenv.lib; {
     description = "An offline thesaurus based on WordNet";
     homepage = http://artha.sourceforge.net;

diff --git a/pkgs/applications/misc/artha/gio-underlink.patch b/pkgs/applications/misc/artha/gio-underlink.patch
@@ -0,0 +1,13 @@
+diff --git a/src/Makefile.am b/src/Makefile.am
+index 0236d72..bcc1182 100644
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -38,7 +38,7 @@ artha_LDADD = libwni.a $(WORDNET_LIB)
+
+ if POSIX
+ AM_CFLAGS += @libdbus_CFLAGS@
+-artha_LDADD += -lX11 -ldbus-1 -ldbus-glib-1 -lgtk-x11-2.0 \
++artha_LDADD += -lX11 -ldbus-1 -ldbus-glib-1 -lgio-2.0 -lgtk-x11-2.0 \
+ 		-lgdk-x11-2.0 -lgmodule-2.0 -lgobject-2.0 -lglib-2.0
+ else
+ artha_LDADD += @GTK_LIBS@
diff --git a/pkgs/applications/misc/gnuradio/default.nix b/pkgs/applications/misc/gnuradio/default.nix
@@ -50,6 +50,10 @@ stdenv.mkDerivation rec {
     Mako cheetah numpy scipy matplotlib pyqt4 pygtk wxPython pyopengl
   ];
 
+  NIX_LDFLAGS = [
+    "-lpthread"
+  ];
+
   enableParallelBuilding = true;
 
   postPatch = ''

diff --git a/pkgs/applications/misc/golden-cheetah/default.nix b/pkgs/applications/misc/golden-cheetah/default.nix
@@ -26,6 +26,9 @@ in stdenv.mkDerivation rec {
     qtconnectivity
   ];
   nativeBuildInputs = [ flex makeWrapper qmake yacc ];
+  NIX_LDFLAGS = [
+    "-lz"
+  ];
   preConfigure = ''
     cp src/gcconfig.pri.in src/gcconfig.pri
     cp qwt/qwtconfig.pri.in qwt/qwtconfig.pri

diff --git a/pkgs/applications/misc/k2pdfopt/default.nix b/pkgs/applications/misc/k2pdfopt/default.nix
@@ -104,6 +104,10 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DCMAKE_C_FLAGS=-I${src}/include_mod" ];
 
+  NIX_LDFLAGS = [
+    "-lpthread"
+  ];
+
   installPhase = ''
     install -D -m 755 k2pdfopt $out/bin/k2pdfopt
   '';

diff --git a/pkgs/applications/misc/tangogps/default.nix b/pkgs/applications/misc/tangogps/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ gettext gtk2 gconf curl libexif sqlite libxml2 ];
+  NIX_LDFLAGS = [ "-lm" ];
 
   # bogus includes fail with newer library version
   postPatch = ''

diff --git a/pkgs/applications/misc/wsjtx/default.nix b/pkgs/applications/misc/wsjtx/default.nix
@@ -4,12 +4,12 @@
 
 stdenv.mkDerivation rec {
   name = "wsjtx-${version}";
-  version = "1.9.1";
+  version = "2.0.0";
 
-  # This is a composite source tarball containing both wsjtx and a hamlib fork
+  # This is a "superbuild" tarball containing both wsjtx and a hamlib fork
   src = fetchurl {
-    url = "http://physics.princeton.edu/pulsar/K1JT/wsjtx-${version}.tgz";
-    sha256 = "143r17fri08mwz28g17wcfxy60h3xgfk46mln5lmdr9k6355aqqc";
+    url = "http://physics.princeton.edu/pulsar/k1jt/wsjtx-${version}.tgz";
+    sha256 = "66434f69f256742da1fe057ec51e4464cab2614f0bfb1a310c04a385b77bd014";
   };
 
   # Hamlib builds with autotools, wsjtx builds with cmake
@@ -20,7 +20,10 @@ stdenv.mkDerivation rec {
   ];
   buildInputs = [ fftw fftwFloat libusb1 qtbase qtmultimedia qtserialport ];
 
-  # Composite build has its own patch step after it extracts the inner archives
+  # Remove Git dependency from superbuild since sources are included
+  patches = [ ./super.patch ];
+
+  # Superbuild has its own patch step after it extracts the inner archives
   postPatch = "cp ${./wsjtx.patch} wsjtx.patch";
 
   meta = with stdenv.lib; {

diff --git a/pkgs/applications/misc/wsjtx/super.patch b/pkgs/applications/misc/wsjtx/super.patch
@@ -0,0 +1,12 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 3bf97a4..2c9dce5 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -23,7 +23,6 @@ source tarball." )
+ #
+ # Find_library (USB_LIBRARY NAMES libusb.a usb)
+ Find_program (PATCH_EXECUTABLE patch REQUIRED)
+-Find_package (Git REQUIRED)
+
+ #
+ # extra C flags to minimize hamlib excutable sizes
diff --git a/pkgs/applications/misc/wsjtx/wsjtx.patch b/pkgs/applications/misc/wsjtx/wsjtx.patch
@@ -1,11 +1,11 @@
-Index: wsjtx/CMakeLists.txt
-===================================================================
---- wsjtx/CMakeLists.txt	(revision 8382)
-+++ wsjtx/CMakeLists.txt	(working copy)
-@@ -866,6 +866,7 @@
- find_package (Qt5Widgets 5 REQUIRED)
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 3e7e816b..e7dbb14a 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -860,6 +860,7 @@ find_package (Qt5Widgets 5 REQUIRED)
  find_package (Qt5Multimedia 5 REQUIRED)
  find_package (Qt5PrintSupport 5 REQUIRED)
+ find_package (Qt5Sql 5 REQUIRED)
 +find_package (Qt5SerialPort 5 REQUIRED)
 
  if (WIN32)

diff --git a/pkgs/applications/misc/xautoclick/default.nix b/pkgs/applications/misc/xautoclick/default.nix
@@ -21,6 +21,7 @@ stdenv.mkDerivation rec {
     mkdir .bin
     ln -s ${qt4}/bin/moc .bin/moc-qt4
     addToSearchPath PATH .bin
+    sed -i -e "s@LD=\$_cc@LD=\$_cxx@" configure
   '';
 
   meta = with stdenv.lib; {

diff --git a/pkgs/applications/networking/instant-messengers/skype-call-recorder/default.nix b/pkgs/applications/networking/instant-messengers/skype-call-recorder/default.nix
@@ -16,6 +16,7 @@ stdenv.mkDerivation {
   patches = [ ./conference.patch ];
 
   buildInputs = [ cmake lame id3lib libvorbis qt4 libogg ];
+  NIX_LDFLAGS = [ "-lvorbis" ];
 
   meta = {
     homepage = http://atdot.ch/scr/;