Things done:

- use libGLU instead of mesa for darwin support
- move patches from local to github url
- fixup xquartz install

There may still be some issues at runtime. PRs welcome!

Fixes #40196

(cherry picked from commit c839771)

(cherry picked from commit 276f289)

(cherry picked from commit 0f4269b)

(cherry picked from commit ccb4558)

(cherry picked from commit 7824c60)

(cherry picked from commit c936651)

(cherry picked from commit c1932f5)

(cherry picked from commit a88354d)

previously, $ORACLE_HOME had to be set for each python script using this
library.

We now patch odpi to load libclntsh.so from oracle-instantclient if
$ORACLE_HOME was not provided.

(cherry picked from commit 639f795)

Update includes 4 security fixes, including one critical (see [0]):

* [835887] Critical: Chain leading to sandbox escape. Reported by Anonymous on 2018-04-23:
* [836858] High CVE-2018-6121: Privilege Escalation in extensions.
* [836141] High CVE-2018-6122: Type confusion in V8.
* [$5000][833721] High CVE-2018-6120: Heap buffer overflow in PDFium.  Reported by Zhou Aiting(@zhouat1) of Qihoo 360 Vulcan Team on 2018-04-17

[0] https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop.html

PS: Didn't build Beta and Dev, verified only Stable for now

cc @bendlas @aszlig

(cherry picked from commit 1837026)

(cherry picked from commit 2729875)

service failed to start because of MemoryDenyWriteExecute = true,
which seems not to work on i686

(cherry picked from commit f4ec18a)

(cherry picked from commit 6ca5577)
Fixes #38536.

(cherry picked from commit 61fe3e86f65ec74b1710d1e63710c08250e4acc4)

(cherry picked from commit 33632bc43e26552f3dc1e33726e18cf0d7301b0f)

Semi-automatic update generated by https://github.com/ryantm/nix-update tools.

This update was made based on information from https://repology.org/metapackage/signal-desktop/versions.

These checks were done:

- built on NixOS
- Warning: no binary found that responded to help or version flags. (This warning appears even if the package isn't expected to have binaries.)
- found 1.6.1 with grep in /nix/store/pvdn1xmg25m71qciqgin0flihwbvf7p3-signal-desktop-1.6.1
- directory tree listing: https://gist.github.com/5e549f57e17894ca01ff108753e073e6

(cherry picked from commit b7046ab)

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/signal-desktop/versions.

These checks were done:

- built on NixOS
- Warning: no binary found that responded to help or version flags. (This warning appears even if the package isn't expected to have binaries.)
- found 1.7.0 with grep in /nix/store/xkslw2sdzbpbzy0ddd0f5qxk1wkfahs6-signal-desktop-1.7.0
- directory tree listing: https://gist.github.com/05c86387ecf6ea0334f3d0c18b44542e

(cherry picked from commit 50c6900)

(cherry picked from commit 70588bc)

(cherry picked from commit 1095c41)

(cherry picked from commit 938ff54)

(cherry picked from commit 2490c50)

(cherry picked from commit 1af7302)

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/wireguard/versions.

These checks were done:

- built on NixOS
- Warning: no binary found that responded to help or version flags. (This warning appears even if the package isn't expected to have binaries.)
- directory tree listing: https://gist.github.com/62dbb660d0b10010e5638c9be376d68b

(cherry picked from commit 751aa3d)

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/wireguard/versions.

These checks were done:

- built on NixOS

- 0 of 0 passed binary check by having a zero exit code.
- 0 of 0 passed binary check by having the new version present in output.
- directory tree listing: https://gist.github.com/ed69b3dfb89cc9d82136b356d54d21bb
- du listing: https://gist.github.com/0f8c8caf71b9d18efa2341ce03a212f1

(cherry picked from commit 2355a7f)

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/wireguard-tools/versions.

These checks were done:

- built on NixOS
- /nix/store/c48vhaf6wqmra1g6sv4hv3i6vqlw7ll1-wireguard-tools-0.0.20180519/bin/wg passed the binary check.
- /nix/store/c48vhaf6wqmra1g6sv4hv3i6vqlw7ll1-wireguard-tools-0.0.20180519/bin/wg-quick passed the binary check.
- 2 of 2 passed binary check by having a zero exit code.
- 0 of 2 passed binary check by having the new version present in output.
- found 0.0.20180519 with grep in /nix/store/c48vhaf6wqmra1g6sv4hv3i6vqlw7ll1-wireguard-tools-0.0.20180519
- directory tree listing: https://gist.github.com/64bccf9c57ca84c49486890ccbf17239
- du listing: https://gist.github.com/f28d6cfd8bcbf6ab1a6c39ad40ce1606

(cherry picked from commit 410be1a)

build was broken by  llvm: 5.0.1 -> 5.0.2 (#39979)

(cherry picked from commit e8ef471)

(cherry picked from commit d775dc9)

(cherry picked from commit d4aa6b626947f10e93b6e236d5709451fa9e72d1)

(cherry picked from commit 82eaa5b)

Split `buildCommand`, provide `unpackCmd` and add `installPhase`.

Use autoPatchelfHook, we can get rid of all the manual hacking around
with patchelf.

Use install to install to $out

(cherry picked from commit fe56ad7)

we requireFile, so hydra can't build it anyways.

(cherry picked from commit 9770699)

pythonPackages.cx_oracle: fix dlopen, patchelf and fix library path for oracle-instantclient binaries

(cherry picked from commit a32b6d5)

(cherry picked from commit 9d0b6b9)

Release notes: http://www.postfix.org/announcements/postfix-3.3.1.html

nixos/slimserver: Fix media scanning & transcoding (backport #40778)

(cherry picked from commit 6ea941d)