Thu Sep 6 06:15:46 UTC 201820180906061546

a/acpid-2.0.30-x86_64-1.txz:  Upgraded.
a/etc-15.0-x86_64-9.txz:  Rebuilt.
  Added support for /etc/ld.so.conf.d/. Thanks to Qury.
a/kernel-firmware-20180904_85c5d90-noarch-1.txz:  Upgraded.
a/kernel-generic-4.14.68-x86_64-1.txz:  Upgraded.
a/kernel-huge-4.14.68-x86_64-1.txz:  Upgraded.
a/kernel-modules-4.14.68-x86_64-1.txz:  Upgraded.
a/pkgtools-15.0-noarch-22.txz:  Rebuilt.
  installpkg: prevent noise from the "stray cat" if tar hands it a broken
  pipe. Thanks to ivandi.
  Also (in the comments) provide a possibly better but untested solution.
  Thanks to SeB.
a/sysvinit-2.90-x86_64-2.txz:  Rebuilt.
  sysvinit-2.90 added an undocumented feature that tries to spawn agetty
  if it sees console= in the kernel command line. Avoiding the debate about
  whether this code belongs in init at all, at least such a change should
  be documented, and probably made opt-in. This patch disables the new
  behavior unless "sysvinit_agetty" is also seen in the kernel command line.
  It seems like this might have been something added for Hurd, and it might
  be wise to stick to what we've got rather than following upstream on this
  particular package. If anyone notices any other odd behavior, please let
  me know. Thanks to shastah.
a/sysvinit-scripts-2.1-noarch-19.txz:  Rebuilt.
  When checking for intel_pstate, direct the stderr to /dev/null in case
  the file doesn't exist in /sys. Thanks to ivandi.
  Allow forcing an option by editing /etc/default/cpufreq.
ap/cups-filters-1.21.2-x86_64-1.txz:  Upgraded.
ap/ghostscript-9.24-x86_64-1.txz:  Upgraded.
  Patched multiple -dSAFER sandbox bypass vulnerabilities.
  Thanks to Tavis Ormandy.
  For more information, see:
    https://www.ghostscript.com/doc/9.24/News.htm
    https://www.kb.cert.org/vuls/id/332928
  (* Security fix *)
ap/sudo-1.8.25-x86_64-1.txz:  Upgraded.
d/binutils-2.31.1-x86_64-2.txz:  Rebuilt.
  elf.c (_bfd_elf_get_symbol_version_string): Return _("<corrupt>") for
  corrupt symbol version info.
  elflink.c (bfd_elf_record_link_assignment): Always clear h->verinfo.verdef
  when overriding a dynamic definition.
  Thanks to Michael Short for pointing out the upstream patches.
d/ccache-3.4.3-x86_64-1.txz:  Upgraded.
d/kernel-headers-4.14.68-x86-1.txz:  Upgraded.
d/llvm-6.0.1-x86_64-2.txz:  Rebuilt.
  Recompiled with -DCLANG_BUILD_SHARED_LIBS=ON to fix issues when multiple
  OpenCL drivers are installed. Thanks to Heinz Wiesinger.
d/mercurial-4.7.1-x86_64-1.txz:  Upgraded.
k/kernel-source-4.14.68-noarch-1.txz:  Upgraded.
l/mozilla-nss-3.39-x86_64-1.txz:  Upgraded.
n/curl-7.61.1-x86_64-1.txz:  Upgraded.
  This update fixes an NTLM password overflow via integer overflow.
  For more information, see:
    https://curl.haxx.se/docs/CVE-2018-14618.html
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14618
  (* Security fix *)
n/gnupg2-2.2.10-x86_64-1.txz:  Upgraded.
n/libtirpc-1.1.4-x86_64-1.txz:  Upgraded.
n/netatalk-3.1.11-x86_64-2.txz:  Rebuilt.
  rc.atalk: fixed errors in status output. Thanks to marav.
n/nghttp2-1.33.0-x86_64-1.txz:  Upgraded.
n/p11-kit-0.23.14-x86_64-1.txz:  Upgraded.
n/stunnel-5.49-x86_64-1.txz:  Upgraded.
x/libdrm-2.4.94-x86_64-1.txz:  Upgraded.
x/xf86-video-ati-20180824_de88ea27-x86_64-1.txz:  Upgraded.
xap/hexchat-2.14.2-x86_64-1.txz:  Upgraded.
xap/mozilla-firefox-60.2.0esr-x86_64-1.txz:  Upgraded.
  This release contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html
  (* Security fix *)
xap/xlockmore-5.56-x86_64-1.txz:  Upgraded.
isolinux/initrd.img:  Rebuilt.
kernels/*:  Upgraded.
usb-and-pxe-installers/usbboot.img:  Rebuilt.

31 files changed, 235 insertions, 47 deletions

diff --git a/source/a/acpid/acpid.url b/source/a/acpid/acpid.url
index eda46461b..5b352a804 100644
--- a/source/a/acpid/acpid.url
+++ b/source/a/acpid/acpid.url
@@ -1 +1 @@
-http://downloads.sourceforge.net/project/acpid2/acpid-2.0.29.tar.xz
+http://downloads.sourceforge.net/project/acpid2/acpid-2.0.30.tar.xz
diff --git a/source/a/etc/_etc/etc/ld.so.conf.new b/source/a/etc/_etc/etc/ld.so.conf.new
index 804909e13..365df63f9 100644
--- a/source/a/etc/_etc/etc/ld.so.conf.new
+++ b/source/a/etc/_etc/etc/ld.so.conf.new
@@ -1,3 +1,4 @@
+include /etc/ld.so.conf.d/*.conf
 /lib
 /usr/lib
 /usr/local/lib
diff --git a/source/a/etc/etc.SlackBuild b/source/a/etc/etc.SlackBuild
index 1dccffdf8..ac74c0a9e 100755
--- a/source/a/etc/etc.SlackBuild
+++ b/source/a/etc/etc.SlackBuild
@@ -24,7 +24,7 @@ cd $(dirname $0) ; CWD=$(pwd)
 
 PKGNAM=etc
 VERSION=15.0
-BUILD=${BUILD:-8}
+BUILD=${BUILD:-9}
 
 # Automatically determine the architecture we're building on:
 if [ -z "$ARCH" ]; then
diff --git a/source/a/pkgtools/pkgtools.SlackBuild b/source/a/pkgtools/pkgtools.SlackBuild
index 749641335..18451d5fe 100755
--- a/source/a/pkgtools/pkgtools.SlackBuild
+++ b/source/a/pkgtools/pkgtools.SlackBuild
@@ -30,7 +30,7 @@ PKGNAM=pkgtools
 # *** UPDATE THESE WITH EACH BUILD:
 VERSION=15.0
 ARCH=${ARCH:-noarch}
-BUILD=${BUILD:-21}
+BUILD=${BUILD:-22}
 
 # If the variable PRINT_PACKAGE_NAME is set, then this script will report what
 # the name of the created package would be, and then exit. This information
diff --git a/source/a/pkgtools/scripts/installpkg b/source/a/pkgtools/scripts/installpkg
index 0d82f89c0..9e75ef030 100644
--- a/source/a/pkgtools/scripts/installpkg
+++ b/source/a/pkgtools/scripts/installpkg
@@ -493,7 +493,28 @@ for package in $* ; do
   fi
   # The stray cat reduces the frequency of the lack of reported size.
   # If it still fails, we hit it with a bigger hammer down below.
-  cat $package | $packagecompression -dc | LC_ALL=C dd 2> $TMP/tmpsize${MCOOKIE} | cat | tar tf - 2> /dev/null 1> $TMP/tmplist${MCOOKIE}
+  #
+  # SeB's proposed fix for this. Untested.
+  #cat $package | $packagecompression -dc | LC_ALL=C dd 2> $TMP/tmpsize${MCOOKIE} | ( tar tf - ; cat > /dev/null ) 2> /dev/null 1> $TMP/tmplist${MCOOKIE}
+  # Some background info from SeB's email:
+  # As you can see, when dd doesn't print anything, it returns 141,
+  # which means it has got a SIGPIPE. The problem is hence some tar
+  # archives cause tar to exit before having emptied stdin. That's
+  # why adding a cat before tar sometimes makes things better (tar
+  # causes it to get a SIGPIPE some ms before it causes itself dd to
+  # get one) 
+  #
+  # A fix is then to replace:
+  #
+  # cat ... | $decompressor ... | ... dd ...  | cat ... | tar tf - >...
+  #
+  # with:
+  #
+  # $decompressor ... | ... dd ...  | ( tar tf -; cat >/dev/null ) >...
+  #
+  # This way the last cat will either exit because there's nothing on
+  # stdin or purge this one properly so dd gets the EOF it needs.
+  cat $package | $packagecompression -dc | LC_ALL=C dd 2> $TMP/tmpsize${MCOOKIE} | cat 2> /dev/null | tar tf - 2> /dev/null 1> $TMP/tmplist${MCOOKIE}
   TARERROR=$?
   if [ ! "$TARERROR" = "0" ]; then
     EXITSTATUS=1 # tar file corrupt
diff --git a/source/a/sysvinit-scripts/default/cpufreq b/source/a/sysvinit-scripts/default/cpufreq
new file mode 100644
index 000000000..13dcda6e6
--- /dev/null
+++ b/source/a/sysvinit-scripts/default/cpufreq
@@ -0,0 +1,3 @@
+# To select a particular CPU governor option for /etc/rc.d/rc.cpufreq,
+# uncomment the line below and edit it to select your choice:
+#SCALING_GOVERNOR=ondemand
diff --git a/source/a/sysvinit-scripts/doinst.sh b/source/a/sysvinit-scripts/doinst.sh
index f6e94f5d1..c11a17985 100644
--- a/source/a/sysvinit-scripts/doinst.sh
+++ b/source/a/sysvinit-scripts/doinst.sh
@@ -23,6 +23,7 @@ config etc/rc.d/rc.loop.new
 config etc/rc.d/rc.sysvinit.new
 config etc/rc.d/rc.modules.new
 config etc/rc.d/rc.modules.local.new
+config etc/default/cpufreq.new
 
 ( cd etc/rc.d ; rm -rf rc.0 )
 ( cd etc/rc.d ; ln -sf rc.6 rc.0 )
diff --git a/source/a/sysvinit-scripts/scripts/rc.cpufreq b/source/a/sysvinit-scripts/scripts/rc.cpufreq
index 24adb8d92..4caaa5a4b 100644
--- a/source/a/sysvinit-scripts/scripts/rc.cpufreq
+++ b/source/a/sysvinit-scripts/scripts/rc.cpufreq
@@ -33,7 +33,7 @@ SCALING_GOVERNOR=ondemand
 # provides power savings on Intel processors while avoiding the ramp-up lag
 # present when using the powersave governor (which is the default if ondemand
 # is requested on these machines):
-if [ "$(cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_driver)" = "intel_pstate" ]; then
+if [ "$(cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_driver 2> /dev/null)" = "intel_pstate" ]; then
   SCALING_GOVERNOR="performance"
 fi
 
@@ -42,6 +42,12 @@ if [ ! -z "$1" -a "$1" != "start" ]; then
   SCALING_GOVERNOR=$1
 fi
 
+# To force a particular option without having to edit this file, uncomment the
+# line in /etc/default/cpufreq and edit it to select the desired option:
+if [ -r /etc/default/cpufreq ]; then
+  . /etc/default/cpufreq
+fi
+
 # If you need to load a specific CPUFreq driver, load it here.  Most likely you don't.
 #/sbin/modprobe acpi-cpufreq
 
diff --git a/source/a/sysvinit-scripts/sysvinit-scripts.SlackBuild b/source/a/sysvinit-scripts/sysvinit-scripts.SlackBuild
index 8876e3299..1fa513f9b 100755
--- a/source/a/sysvinit-scripts/sysvinit-scripts.SlackBuild
+++ b/source/a/sysvinit-scripts/sysvinit-scripts.SlackBuild
@@ -25,7 +25,7 @@ cd $(dirname $0) ; CWD=$(pwd)
 PKGNAM=sysvinit-scripts
 VERSION=${VERSION:-2.1}
 ARCH=noarch
-BUILD=${BUILD:-18}
+BUILD=${BUILD:-19}
 
 # If the variable PRINT_PACKAGE_NAME is set, then this script will report what
 # the name of the created package would be, and then exit. This information
@@ -52,6 +52,10 @@ cat $CWD/scripts/inittab > $PKG/etc/inittab.new
 chmod 644 $PKG/etc/inittab.new
 chown root:root $PKG/etc/inittab.new
 
+# Install /etc/default/cpufreq.new:
+mkdir -p $PKG/etc/default
+cat $CWD/default/cpufreq > $PKG/etc/default/cpufreq.new
+
 # Add a very handy tool for scanning new SCSI devices.  Most useful for
 # finding new USB and Firewire storage devices which show up as SCSI.
 mkdir -p $PKG/sbin
diff --git a/source/a/sysvinit/sysvinit.SlackBuild b/source/a/sysvinit/sysvinit.SlackBuild
index b74de22a6..92472cb44 100755
--- a/source/a/sysvinit/sysvinit.SlackBuild
+++ b/source/a/sysvinit/sysvinit.SlackBuild
@@ -24,7 +24,7 @@ cd $(dirname $0) ; CWD=$(pwd)
 
 PKGNAM=sysvinit
 VERSION=${VERSION:-2.90}
-BUILD=${BUILD:-1}
+BUILD=${BUILD:-2}
 
 # Automatically determine the architecture we're building on:
 if [ -z "$ARCH" ]; then
@@ -62,6 +62,13 @@ find . \
   \( -perm 666 -o -perm 664 -o -perm 600 -o -perm 444 -o -perm 440 -o -perm 400 \) \
   -exec chmod 644 {} \;
 
+# sysvinit-2.90 added an undocumented feature that tries to spawn agetty if
+# it sees console= in the kernel command line. Avoiding the debate about
+# whether this code belongs in init at all, at least such a change # should
+# be documented, and probably made opt-in. This patch disables the new behavior
+# unless "sysvinit_agetty" is also seen in the kernel command line.
+zcat $CWD/sysvinit.no.console.agetty.without.sysvinit_agetty.diff.gz | patch -p1 -E --verbose --backup --suffix=.orig || exit 1
+
 # Fix paths for /etc/forcefsck and /etc/fastboot:
 zcat $CWD/sysvinit.paths.diff.gz | patch -p1 -E --verbose --backup --suffix=.orig || exit 1
 
diff --git a/source/a/sysvinit/sysvinit.no.console.agetty.without.sysvinit_agetty.diff b/source/a/sysvinit/sysvinit.no.console.agetty.without.sysvinit_agetty.diff
new file mode 100644
index 000000000..c81f542bc
--- /dev/null
+++ b/source/a/sysvinit/sysvinit.no.console.agetty.without.sysvinit_agetty.diff
@@ -0,0 +1,16 @@
+--- ./src/init.c.orig	2018-06-18 18:25:26.000000000 -0500
++++ ./src/init.c	2018-08-28 23:45:05.134948889 -0500
+@@ -1337,6 +1337,13 @@
+ 		return;
+ 	}    
+ 	if (fgets(buf, sizeof(buf), fp)) {    
++		/* OK, this is a weird undocumented feature. We'll look for "sysvinit_agetty" in the kernel */
++		/* command line and if we don't see it, then we'll assume you didn't want this. */
++		char* t = buf;
++		if (!(t = strstr(t, "sysvinit_agetty"))) {
++			fclose(fp);
++			return;
++		}
+ 		char* p = buf;
+ 		while ((p = strstr(p, "console="))) {    
+ 			char* e;
diff --git a/source/ap/ghostscript/ghostscript.SlackBuild b/source/ap/ghostscript/ghostscript.SlackBuild
index 947524911..0e113a3a0 100755
--- a/source/ap/ghostscript/ghostscript.SlackBuild
+++ b/source/ap/ghostscript/ghostscript.SlackBuild
@@ -27,7 +27,7 @@ if [ -r gnu-ghostscript-*.tar.?z ]; then
   SRCPREFIX="gnu-"
 fi
 VERSION=${VERSION:-$(echo $SRCPREFIX$PKGNAM-*.tar.?z | rev | cut -f 3- -d . | cut -f 1 -d - | rev)}
-BUILD=${BUILD:-3}
+BUILD=${BUILD:-1}
 
 # Automatically determine the architecture we're building on:
 if [ -z "$ARCH" ]; then
diff --git a/source/ap/ghostscript/ghostscript.url b/source/ap/ghostscript/ghostscript.url
index de0a950b6..97f57f6c9 100644
--- a/source/ap/ghostscript/ghostscript.url
+++ b/source/ap/ghostscript/ghostscript.url
@@ -1 +1 @@
-https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs923/ghostscript-9.23.tar.xz
+https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs924/ghostscript-9.24.tar.xz
diff --git a/source/d/binutils/binutils.SlackBuild b/source/d/binutils/binutils.SlackBuild
index 05a715fa5..a189cba29 100755
--- a/source/d/binutils/binutils.SlackBuild
+++ b/source/d/binutils/binutils.SlackBuild
@@ -26,7 +26,7 @@ cd $(dirname $0) ; CWD=$(pwd)
 
 PKGNAM=binutils
 VERSION=${VERSION:-$(echo $PKGNAM-*.tar.?z | rev | cut -f 3- -d . | cut -f 1 -d - | rev)}
-BUILD=${BUILD:-1}
+BUILD=${BUILD:-2}
 
 # Automatically determine the architecture we're building on:
 MARCH=$( uname -m )
@@ -121,6 +121,9 @@ zcat $CWD/patches/binutils.export.demangle.h.diff.gz | patch -p1 --verbose || ex
 # Don't check to see if "config.h" was included in the installed headers:
 zcat $CWD/patches/binutils.no-config-h-check.diff.gz | patch -p1 --verbose || exit 1
 
+# Patch to Fix invalid version info and detect corrupted objects
+zcat $CWD/patches/binutils-2.31.1-verinfo-fix-corrupt-symbol-detect.patch.gz | patch -p2 --verbose || exit 1
+
 # Set %version to something halfway meaningful:
 sed -i -e 's/%''{release}/slack15/g' bfd/Makefile{.am,.in}
 
diff --git a/source/d/binutils/patches/binutils-2.31.1-verinfo-fix-corrupt-symbol-detect.patch b/source/d/binutils/patches/binutils-2.31.1-verinfo-fix-corrupt-symbol-detect.patch
new file mode 100644
index 000000000..170577d50
--- /dev/null
+++ b/source/d/binutils/patches/binutils-2.31.1-verinfo-fix-corrupt-symbol-detect.patch
@@ -0,0 +1,106 @@
+diff -Naur a/binutils-2.31.1/bfd/ChangeLog b/binutils-2.31.1/bfd/ChangeLog
+--- a/binutils-2.31.1/bfd/ChangeLog	2018-07-18 00:50:08.000000000 -0700
++++ b/binutils-2.31.1/bfd/ChangeLog	2018-08-31 02:34:06.852965351 -0700
+@@ -1,3 +1,15 @@
++2018-08-25  H.J. Lu  <hongjiu.lu@intel.com>
++
++	PR ld/23499
++	* elf.c (_bfd_elf_get_symbol_version_string): Return
++	_("<corrupt>") for corrupt symbol version info.
++
++2018-08-10  H.J. Lu  <hongjiu.lu@intel.com>
++ 
++	PR ld/23499
++	* elflink.c (bfd_elf_record_link_assignment): Always clear
++	h->verinfo.verdef when overriding a dynamic definition.
++
+ 2018-07-18  Nick Clifton  <nickc@redhat.com>
+ 
+ 	2.31.1 Release point.
+diff -Naur a/binutils-2.31.1/bfd/elf.c b/binutils-2.31.1/bfd/elf.c
+--- a/binutils-2.31.1/bfd/elf.c	2018-08-31 01:07:56.804985073 -0700
++++ b/binutils-2.31.1/bfd/elf.c	2018-08-31 02:36:40.067964767 -0700
+@@ -1884,7 +1884,7 @@
+ 	{
+ 	  Elf_Internal_Verneed *t;
+ 
+-	  version_string = "";
++	  version_string = _("<corrupt>");
+ 	  for (t = elf_tdata (abfd)->verref;
+ 	       t != NULL;
+ 	       t = t->vn_nextref)
+diff -Naur a/binutils-2.31.1/bfd/elflink.c b/binutils-2.31.1/bfd/elflink.c
+--- a/binutils-2.31.1/bfd/elflink.c	2018-07-13 00:33:03.000000000 -0700
++++ b/binutils-2.31.1/bfd/elflink.c	2018-08-31 01:30:01.056980022 -0700
+@@ -686,13 +686,11 @@
+       && !h->def_regular)
+     h->root.type = bfd_link_hash_undefined;
+ 
+-  /* If this symbol is not being provided by the linker script, and it is
+-     currently defined by a dynamic object, but not by a regular object,
+-     then clear out any version information because the symbol will not be
+-     associated with the dynamic object any more.  */
+-  if (!provide
+-      && h->def_dynamic
+-      && !h->def_regular)
++  /* If this symbol is currently defined by a dynamic object, but not
++     by a regular object, then clear out any version information because
++     the symbol will not be associated with the dynamic object any
++     more.  */
++  if (h->def_dynamic && !h->def_regular)
+     h->verinfo.verdef = NULL;
+ 
+   /* Make sure this symbol is not garbage collected.  */
+diff -Naur a/binutils-2.31.1/binutils/ChangeLog b/binutils-2.31.1/binutils/ChangeLog
+--- a/binutils-2.31.1/binutils/ChangeLog	2018-07-18 00:50:26.000000000 -0700
++++ b/binutils-2.31.1/binutils/ChangeLog	2018-08-31 02:37:48.060964507 -0700
+@@ -1,3 +1,9 @@
++2018-08-25  H.J. Lu  <hongjiu.lu@intel.com>
++
++	PR ld/23499
++	* readelf.c (get_symbol_version_string): Return _("<corrupt>")
++	for corrupt symbol version info.
++
+ 2018-07-18  Nick Clifton  <nickc@redhat.com>
+ 
+ 	2.31.1 Release point.
+diff -Naur a/binutils-2.31.1/binutils/readelf.c b/binutils-2.31.1/binutils/readelf.c
+--- a/binutils-2.31.1/binutils/readelf.c	2018-06-24 11:38:57.000000000 -0700
++++ b/binutils-2.31.1/binutils/readelf.c	2018-08-31 02:47:39.215962252 -0700
+@@ -11252,6 +11252,7 @@
+   unsigned char data[2];
+   unsigned short vers_data;
+   unsigned long offset;
++  unsigned short max_vd_ndx;
+ 
+   if (!is_dynsym
+       || version_info[DT_VERSIONTAGIDX (DT_VERSYM)] == 0)
+@@ -11269,6 +11270,8 @@
+   if ((vers_data & VERSYM_HIDDEN) == 0 && vers_data == 0)
+     return NULL;
+ 
++  max_vd_ndx = 0;
++
+   /* Usually we'd only see verdef for defined symbols, and verneed for
+      undefined symbols.  However, symbols defined by the linker in
+      .dynbss for variables copied from a shared library in order to
+@@ -11311,6 +11314,9 @@
+ 	      ivd.vd_flags = BYTE_GET (evd.vd_flags);
+ 	    }
+ 
++	  if ((ivd.vd_ndx & VERSYM_VERSION) > max_vd_ndx)
++	    max_vd_ndx = ivd.vd_ndx & VERSYM_VERSION;
++
+ 	  off += ivd.vd_next;
+ 	}
+       while (ivd.vd_ndx != (vers_data & VERSYM_VERSION) && ivd.vd_next != 0);
+@@ -11402,6 +11408,9 @@
+ 	  return (ivna.vna_name < strtab_size
+ 		  ? strtab + ivna.vna_name : _("<corrupt>"));
+ 	}
++	else if ((max_vd_ndx || (vers_data & VERSYM_VERSION) != 1)
++		&& (vers_data & VERSYM_VERSION) > max_vd_ndx)
++	return _("<corrupt>");
+     }
+   return NULL;
+ }
diff --git a/source/d/ccache/ccache.SlackBuild b/source/d/ccache/ccache.SlackBuild
index 16d64a717..0ffab1565 100755
--- a/source/d/ccache/ccache.SlackBuild
+++ b/source/d/ccache/ccache.SlackBuild
@@ -24,7 +24,7 @@ cd $(dirname $0) ; CWD=$(pwd)
 
 PKGNAM=ccache
 VERSION=${VERSION:-$(echo $PKGNAM-*.tar.xz | rev | cut -f 3- -d . | cut -f 1 -d - | rev)}
-BUILD=${BUILD:-2}
+BUILD=${BUILD:-1}
 
 # Automatically determine the architecture we're building on:
 if [ -z "$ARCH" ]; then
diff --git a/source/d/llvm/clang_disable_pgo.patch b/source/d/llvm/clang_disable_pgo.patch
deleted file mode 100644
index c3998798d..000000000
--- a/source/d/llvm/clang_disable_pgo.patch
+++ /dev/null
@@ -1,14 +0,0 @@
---- ./tools/clang/lib/CodeGen/CodeGenPGO.cpp.orig	2018-03-08 19:50:01.115345121 -0600
-+++ ./tools/clang/lib/CodeGen/CodeGenPGO.cpp	2018-03-08 19:52:24.016358481 -0600
-@@ -22,10 +22,7 @@
- #include "llvm/Support/FileSystem.h"
- #include "llvm/Support/MD5.h"
- 
--static llvm::cl::opt<bool>
--    EnableValueProfiling("enable-value-profiling", llvm::cl::ZeroOrMore,
--                         llvm::cl::desc("Enable value profiling"),
--                         llvm::cl::Hidden, llvm::cl::init(false));
-+static bool EnableValueProfiling = false;
- 
- using namespace clang;
- using namespace CodeGen;
diff --git a/source/d/llvm/llvm.SlackBuild b/source/d/llvm/llvm.SlackBuild
index 87428b381..591ed74db 100755
--- a/source/d/llvm/llvm.SlackBuild
+++ b/source/d/llvm/llvm.SlackBuild
@@ -27,7 +27,7 @@ cd $(dirname $0) ; CWD=$(pwd)
 
 PKGNAM=llvm
 VERSION=${VERSION:-$(echo llvm-*.tar.xz | rev | cut -f 4- -d . | cut -f 1 -d - | rev)}
-BUILD=${BUILD:-1}
+BUILD=${BUILD:-2}
 
 NUMJOBS=${NUMJOBS:-" -j7 "}
 
@@ -114,9 +114,9 @@ find . \
   \( -perm 666 -o -perm 664 -o -perm 640 -o -perm 600 -o -perm 444 -o -perm 440 -o -perm 400 \) \
   -exec chmod 644 {} \;
 
-# disable value profiling until https://llvm.org/bugs/show_bug.cgi?id=30587
-# is fixed.
-zcat $CWD/clang_disable_pgo.patch.gz | patch -p1 --verbose || exit 1
+# Work around https://llvm.org/bugs/show_bug.cgi?id=30587
+# by building clang with shared libs
+zcat $CWD/n_clang_allow_BUILD_SHARED_LIBRARY.patch.gz | patch -p0 --verbose || exit 1
 
 # need to disable assertions to make llvm thread-safe
 # clang resource dir is a relative path based on the location of the clang binary
@@ -130,12 +130,14 @@ cd build
     -DCMAKE_INSTALL_PREFIX=/usr \
     -DLLVM_LIBDIR_SUFFIX=${LIBDIRSUFFIX} \
     -DCMAKE_BUILD_TYPE=Release \
+    -DBUILD_SHARED_LIBS=OFF \
+    -DCLANG_BUILD_SHARED_LIBS=ON \
     -DLLVM_BUILD_LLVM_DYLIB=ON \
-    -DLLVM_DYLIB_EXPORT_ALL=ON \
     -DLLVM_LINK_LLVM_DYLIB=ON \
     -DLLVM_ENABLE_RTTI=ON \
     -DLLVM_ENABLE_FFI=ON \
     -DLLVM_ENABLE_ASSERTIONS=OFF \
+    -DLLVM_USE_OPROFILE=ON \
     -DLLVM_BINUTILS_INCDIR=/usr/include \
     -DCLANG_RESOURCE_DIR="../lib${LIBDIRSUFFIX}/clang/${VERSION}" \
     .. || exit 1
@@ -163,8 +165,10 @@ done
 rm -f $PKG/usr/lib$LIBDIRSUFFIX/libgomp.so
 
 # Install Python bindings
-mkdir -p "$PKG/usr/lib$LIBDIRSUFFIX/python2.7/site-packages"
-cp -a tools/clang/bindings/python/clang "$PKG/usr/lib$LIBDIRSUFFIX/python2.7/site-packages/"
+for pyver in 2.7 3.6; do
+  mkdir -p "$PKG/usr/lib$LIBDIRSUFFIX/python$pyver/site-packages"
+  cp -a tools/clang/bindings/python/clang "$PKG/usr/lib$LIBDIRSUFFIX/python$pyver/site-packages/"
+done
 
 # Remove bundled python-six
 rm -f "$PKG/usr/lib$LIBDIRSUFFIX/python2.7/site-packages/six.py"
@@ -172,12 +176,16 @@ rm -f "$PKG/usr/lib$LIBDIRSUFFIX/python2.7/site-packages/six.py"
 # Compile Python scripts
 python -m compileall "$PKG/usr/lib$LIBDIRSUFFIX/python2.7/site-packages/clang"
 python -O -m compileall "$PKG/usr/lib$LIBDIRSUFFIX/python2.7/site-packages/clang"
+python3 -m compileall "$PKG/usr/lib$LIBDIRSUFFIX/python3.6/site-packages/clang"
+python3 -O -m compileall "$PKG/usr/lib$LIBDIRSUFFIX/python3.6/site-packages/clang"
 python -m compileall "$PKG/usr/lib$LIBDIRSUFFIX/python2.7/site-packages/lldb"
 python -O -m compileall "$PKG/usr/lib$LIBDIRSUFFIX/python2.7/site-packages/lldb"
 python -m compileall "$PKG/usr/share/scan-view"
 python -O -m compileall "$PKG/usr/share/scan-view"
 python -m compileall "$PKG/usr/share/clang"
 python -O -m compileall "$PKG/usr/share/clang"
+python -m compileall "$PKG/usr/share/opt-viewer"
+python -O -m compileall "$PKG/usr/share/opt-viewer"
 
 # Move man page directory:
 mv $PKG/usr/share/man $PKG/usr/
diff --git a/source/d/llvm/n_clang_allow_BUILD_SHARED_LIBRARY.patch b/source/d/llvm/n_clang_allow_BUILD_SHARED_LIBRARY.patch
new file mode 100644
index 000000000..8e42aaee6
--- /dev/null
+++ b/source/d/llvm/n_clang_allow_BUILD_SHARED_LIBRARY.patch
@@ -0,0 +1,19 @@
+We use LLVM_BUILD_LLVM_DYLIB to build the llvm libraries as shared, but that
+does not work for clang. We can use BUILD_SHARED_LIBS on clang, but since we
+build them all together, we need to smuggle it in using this patch.
+
+Index: CMakeLists.txt
+===================================================================
+--- tools/clang/CMakeLists.txt
++++ tools/clang/CMakeLists.txt
+@@ -1,5 +1,10 @@
+ cmake_minimum_required(VERSION 3.4.3)
+ 
++if( CLANG_BUILD_SHARED_LIBS )
++  set(BUILD_SHARED_LIBS ON)
++  set(LLVM_BUILD_LLVM_DYLIB OFF)
++endif()
++
+ # If we are not building as a part of LLVM, build Clang as an
+ # standalone project, using LLVM as an external library:
+ if( CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR )
diff --git a/source/k/kernel-configs/config-generic-4.14.67 b/source/k/kernel-configs/config-generic-4.14.68
index 826df85b9..b5f90f5d0 100644
--- a/source/k/kernel-configs/config-generic-4.14.67
+++ b/source/k/kernel-configs/config-generic-4.14.68
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 4.14.67 Kernel Configuration
+# Linux/x86 4.14.68 Kernel Configuration
 #
 # CONFIG_64BIT is not set
 CONFIG_X86_32=y
@@ -277,6 +277,7 @@ CONFIG_HAVE_PERF_REGS=y
 CONFIG_HAVE_PERF_USER_STACK_DUMP=y
 CONFIG_HAVE_ARCH_JUMP_LABEL=y
 CONFIG_HAVE_RCU_TABLE_FREE=y
+CONFIG_HAVE_RCU_TABLE_INVALIDATE=y
 CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y
 CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y
 CONFIG_HAVE_CMPXCHG_LOCAL=y
diff --git a/source/k/kernel-configs/config-generic-4.14.67.x64 b/source/k/kernel-configs/config-generic-4.14.68.x64
index 2dc890066..17492d6b6 100644
--- a/source/k/kernel-configs/config-generic-4.14.67.x64
+++ b/source/k/kernel-configs/config-generic-4.14.68.x64
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 4.14.67 Kernel Configuration
+# Linux/x86 4.14.68 Kernel Configuration
 #
 CONFIG_64BIT=y
 CONFIG_X86_64=y
@@ -297,6 +297,7 @@ CONFIG_HAVE_PERF_REGS=y
 CONFIG_HAVE_PERF_USER_STACK_DUMP=y
 CONFIG_HAVE_ARCH_JUMP_LABEL=y
 CONFIG_HAVE_RCU_TABLE_FREE=y
+CONFIG_HAVE_RCU_TABLE_INVALIDATE=y
 CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y
 CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y
 CONFIG_HAVE_CMPXCHG_LOCAL=y
diff --git a/source/k/kernel-configs/config-generic-smp-4.14.67-smp b/source/k/kernel-configs/config-generic-smp-4.14.68-smp
index 5f7562d8d..2524dc920 100644
--- a/source/k/kernel-configs/config-generic-smp-4.14.67-smp
+++ b/source/k/kernel-configs/config-generic-smp-4.14.68-smp
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 4.14.67 Kernel Configuration
+# Linux/x86 4.14.68 Kernel Configuration
 #
 # CONFIG_64BIT is not set
 CONFIG_X86_32=y
@@ -289,6 +289,7 @@ CONFIG_HAVE_PERF_REGS=y
 CONFIG_HAVE_PERF_USER_STACK_DUMP=y
 CONFIG_HAVE_ARCH_JUMP_LABEL=y
 CONFIG_HAVE_RCU_TABLE_FREE=y
+CONFIG_HAVE_RCU_TABLE_INVALIDATE=y
 CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y
 CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y
 CONFIG_HAVE_CMPXCHG_LOCAL=y
diff --git a/source/k/kernel-configs/config-huge-4.14.67 b/source/k/kernel-configs/config-huge-4.14.68
index 2a04674cc..bbf2e673c 100644
--- a/source/k/kernel-configs/config-huge-4.14.67
+++ b/source/k/kernel-configs/config-huge-4.14.68
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 4.14.67 Kernel Configuration
+# Linux/x86 4.14.68 Kernel Configuration
 #
 # CONFIG_64BIT is not set
 CONFIG_X86_32=y
@@ -277,6 +277,7 @@ CONFIG_HAVE_PERF_REGS=y
 CONFIG_HAVE_PERF_USER_STACK_DUMP=y
 CONFIG_HAVE_ARCH_JUMP_LABEL=y
 CONFIG_HAVE_RCU_TABLE_FREE=y
+CONFIG_HAVE_RCU_TABLE_INVALIDATE=y
 CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y
 CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y
 CONFIG_HAVE_CMPXCHG_LOCAL=y
diff --git a/source/k/kernel-configs/config-huge-4.14.67.x64 b/source/k/kernel-configs/config-huge-4.14.68.x64
index 4c2ef032b..9a96a38d3 100644
--- a/source/k/kernel-configs/config-huge-4.14.67.x64
+++ b/source/k/kernel-configs/config-huge-4.14.68.x64
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 4.14.67 Kernel Configuration
+# Linux/x86 4.14.68 Kernel Configuration
 #
 CONFIG_64BIT=y
 CONFIG_X86_64=y
@@ -297,6 +297,7 @@ CONFIG_HAVE_PERF_REGS=y
 CONFIG_HAVE_PERF_USER_STACK_DUMP=y
 CONFIG_HAVE_ARCH_JUMP_LABEL=y
 CONFIG_HAVE_RCU_TABLE_FREE=y
+CONFIG_HAVE_RCU_TABLE_INVALIDATE=y
 CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y
 CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y
 CONFIG_HAVE_CMPXCHG_LOCAL=y
diff --git a/source/k/kernel-configs/config-huge-smp-4.14.67-smp b/source/k/kernel-configs/config-huge-smp-4.14.68-smp
index ec6ff1b13..7baca83bf 100644
--- a/source/k/kernel-configs/config-huge-smp-4.14.67-smp
+++ b/source/k/kernel-configs/config-huge-smp-4.14.68-smp
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 4.14.67 Kernel Configuration
+# Linux/x86 4.14.68 Kernel Configuration
 #
 # CONFIG_64BIT is not set
 CONFIG_X86_32=y
@@ -289,6 +289,7 @@ CONFIG_HAVE_PERF_REGS=y
 CONFIG_HAVE_PERF_USER_STACK_DUMP=y
 CONFIG_HAVE_ARCH_JUMP_LABEL=y
 CONFIG_HAVE_RCU_TABLE_FREE=y
+CONFIG_HAVE_RCU_TABLE_INVALIDATE=y
 CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y
 CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y
 CONFIG_HAVE_CMPXCHG_LOCAL=y
diff --git a/source/l/mozilla-nss/mozilla-nss.SlackBuild b/source/l/mozilla-nss/mozilla-nss.SlackBuild
index 0bc7a3662..96a933189 100755
--- a/source/l/mozilla-nss/mozilla-nss.SlackBuild
+++ b/source/l/mozilla-nss/mozilla-nss.SlackBuild
@@ -26,8 +26,8 @@ cd $(dirname $0) ; CWD=$(pwd)
 
 PKGNAM=mozilla-nss
 SRCNAM=nss
-VERSION=${VERSION:-3.37.3}
-NSPR=${NSPR:-4.19}
+VERSION=${VERSION:-3.39}
+NSPR=${NSPR:-4.20}
 BUILD=${BUILD:-1}
 
 # Automatically determine the architecture we're building on:
diff --git a/source/n/libtirpc/libtirpc.SlackBuild b/source/n/libtirpc/libtirpc.SlackBuild
index ba4d01cca..2c908841e 100755
--- a/source/n/libtirpc/libtirpc.SlackBuild
+++ b/source/n/libtirpc/libtirpc.SlackBuild
@@ -30,7 +30,7 @@ cd $(dirname $0) ; CWD=$(pwd)
 
 PKGNAM=libtirpc
 VERSION=${VERSION:-$(echo $PKGNAM-*.tar.?z | rev | cut -f 3- -d . | cut -f 1 -d - | rev)}
-BUILD=${BUILD:-2}
+BUILD=${BUILD:-1}
 
 # To build with GSS support (requires Kerberos 5 libraries), pass any value
 # other than "NO" in the environment, or edit the line below:
diff --git a/source/n/netatalk/netatalk.SlackBuild b/source/n/netatalk/netatalk.SlackBuild
index 679cdb76e..240fae066 100755
--- a/source/n/netatalk/netatalk.SlackBuild
+++ b/source/n/netatalk/netatalk.SlackBuild
@@ -26,7 +26,7 @@ cd $(dirname $0) ; CWD=$(pwd)
 
 PKGNAM=netatalk
 VERSION=${VERSION:-$(echo netatalk-*.tar.?z* | rev | cut -f 3- -d . | cut -f 1 -d - | rev)}
-BUILD=${BUILD:-1}
+BUILD=${BUILD:-2}
 
 NUMJOBS=${NUMJOBS:-" -j7 "}
 
diff --git a/source/n/netatalk/rc.atalk.new b/source/n/netatalk/rc.atalk.new
index bc079b580..24b01fd0c 100644
--- a/source/n/netatalk/rc.atalk.new
+++ b/source/n/netatalk/rc.atalk.new
@@ -30,7 +30,7 @@ netatalk_restart() {
 
 # Check if netatalk is running
 netatalk_status() {
-  PID="$(/usr/bin/pgrep --ns $$ -f "^/usr/sbin/netatalk" 2> dev/null)
+  PID="$(/usr/bin/pgrep --ns $$ -f "^/usr/sbin/netatalk" 2> /dev/null)"
   if [ $PID ]; then
     echo "netatalk is running.  PID: $PID"
   else
diff --git a/source/xap/hexchat/hexchat.SlackBuild b/source/xap/hexchat/hexchat.SlackBuild
index 08856ae71..7fa4ec1c6 100755
--- a/source/xap/hexchat/hexchat.SlackBuild
+++ b/source/xap/hexchat/hexchat.SlackBuild
@@ -23,8 +23,8 @@
 cd $(dirname $0) ; CWD=$(pwd)
 
 PKGNAM=hexchat
-VERSION=${VERSION:-$(echo $PKGNAM-*.tar.?z* | rev | cut -f 3- -d . | cut -f 1 -d - | rev)}
-BUILD=${BUILD:-4}
+VERSION=${VERSION:-$(echo $PKGNAM-*.tar.?z | rev | cut -f 3- -d . | cut -f 1 -d - | rev)}
+BUILD=${BUILD:-1}
 
 # Automatically determine the architecture we're building on:
 if [ -z "$ARCH" ]; then
@@ -67,7 +67,7 @@ rm -rf $PKG
 mkdir -p $TMP $PKG
 cd $TMP
 rm -rf $PKGNAM-$VERSION
-tar xvf $CWD/$PKGNAM-$VERSION.tar.xz || exit 1
+tar xvf $CWD/$PKGNAM-$VERSION.tar.?z || exit 1
 cd $PKGNAM-$VERSION || exit 1
 chown -R root:root .
 find -L . \
diff --git a/source/xap/hexchat/hexchat.url b/source/xap/hexchat/hexchat.url
index 2c71b9d5a..9c61d9516 100644
--- a/source/xap/hexchat/hexchat.url
+++ b/source/xap/hexchat/hexchat.url
@@ -1 +1,2 @@
-https://dl.hexchat.net/hexchat/hexchat-2.12.4-repack.tar.xz
+https://dl.hexchat.net/hexchat/hexchat-2.14.2.tar.xz.asc
+https://dl.hexchat.net/hexchat/hexchat-2.14.2.tar.xz