Merge branch 'core-updates'

Makefile.am

@@ -284,6 +284,7 @@ SCM_TESTS =					\
   tests/nar.scm					\
   tests/union.scm				\
   tests/profiles.scm				\
+  tests/search-paths.scm			\
   tests/syscalls.scm				\
   tests/gremlin.scm				\
   tests/bournish.scm				\

build-aux/download.scm

@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2012, 2013, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014, 2015 Mark H Weaver <mhw@netris.org>
+;;; Copyright © 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -40,13 +41,18 @@
   "Return the URI for FILE."
   (match (string-tokenize file (char-set-complement (char-set #\/)))
     ((_ ... system basename)
-     (string->uri (string-append %url-base "/" system
+     (string->uri
+       (match system
+        ("aarch64-linux"
+         (string-append "http://flashner.co.il/guix/bootstrap/aarch64-linux"
+                        "/20170217/" basename))
+        (_ (string-append %url-base "/" system
                           (match system
                                  ("armhf-linux"
                                   "/20150101/")
                                  (_
                                   "/20131110/"))
-                                 basename)))))
+                          basename)))))))
 
 (match (command-line)
   ((_ file expected-hash)

build-aux/hydra/gnu-system.scm

@@ -127,6 +127,8 @@ SYSTEM."
     "mips64el-linux-gnuabi64"
     "arm-linux-gnueabihf"
     "aarch64-linux-gnu"
+    "powerpc-linux-gnu"
+    "i586-pc-gnu"                                 ;aka. GNU/Hurd
     "i686-w64-mingw32"))
 
 (define %guixsd-supported-systems
@@ -303,11 +305,14 @@ valid."
                      ;; Build everything, including replacements.
                      (let ((all (fold-packages
                                  (lambda (package result)
-                                   (if (package-replacement package)
+                                   (cond ((package-replacement package)
                                           (cons* package
                                                  (package-replacement package)
-                                              result)
+                                                 result))
-                                       (cons package result)))
+                                         ((package-superseded package)
+                                          result) ;don't build it
+                                         (else
+                                          (cons package result))))
                                  '()))
                            (job (lambda (package)
                                   (package->job store package

doc/guix.texi

@@ -24,7 +24,7 @@ Copyright @copyright{} 2015, 2016, 2017 Leo Famulari@*
 Copyright @copyright{} 2015, 2016 Ricardo Wurmus@*
 Copyright @copyright{} 2016 Ben Woodcroft@*
 Copyright @copyright{} 2016 Chris Marusich@*
-Copyright @copyright{} 2016 Efraim Flashner@*
+Copyright @copyright{} 2016, 2017 Efraim Flashner@*
 Copyright @copyright{} 2016 John Darrington@*
 Copyright @copyright{} 2016 ng0@*
 Copyright @copyright{} 2016 Jan Nieuwenhuizen@*
@@ -6877,6 +6877,11 @@ ARMv7-A architecture with hard float, Thumb-2 and NEON,
 using the EABI hard-float application binary interface (ABI),
 and Linux-Libre kernel.
 
+@item aarch64-linux
+little-endian 64-bit ARMv8-A processors, Linux-Libre kernel.  This is
+currently in an experimental stage, with limited support.
+@xref{Contributing}, for how to help!
+
 @item mips64el-linux
 little-endian 64-bit MIPS processors, specifically the Loongson series,
 n32 ABI, and Linux-Libre kernel.

gnu/build/activation.scm

@@ -79,11 +79,6 @@
 (define (dot-or-dot-dot? file)
   (member file '("." "..")))
 
-(define (make-file-writable file)
-  "Make FILE writable for its owner.."
-  (let ((stat (lstat file)))                      ;XXX: symlinks
-    (chmod file (logior #o600 (stat:perms stat)))))
-
 (define* (copy-account-skeletons home
                                  #:key
                                  (directory %skeleton-directory)

gnu/local.mk

@@ -9,6 +9,8 @@
 # Copyright © 2016 Adonay "adfeno" Felipe Nogueira <https://libreplanet.org/wiki/User:Adfeno> <adfeno@openmailbox.org>
 # Copyright © 2016, 2017 Ricardo Wurmus <rekado@elephly.net>
 # Copyright © 2016 Ben Woodcroft <donttrustben@gmail.com>
+# Copyright © 2016, 2017 Alex Vong <alexvong1995@gmail.com>
+# Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 # Copyright © 2017 Tobias Geerinckx-Rice <me@tobias.gr>
 # Copyright © 2017 Clément Lassieur <clement@lassieur.org>
 # Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
@@ -487,7 +489,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/aegis-test-fixup-1.patch            	\
   %D%/packages/patches/aegis-test-fixup-2.patch            	\
   %D%/packages/patches/agg-am_c_prototype.patch			\
-  %D%/packages/patches/alsa-lib-mips-atomic-fix.patch		\
   %D%/packages/patches/antiword-CVE-2014-8123.patch			\
   %D%/packages/patches/apr-skip-getservbyname-test.patch	\
   %D%/packages/patches/artanis-fix-Makefile.in.patch		\
@@ -523,6 +524,8 @@ dist_patch_DATA =						\
   %D%/packages/patches/clx-remove-demo.patch			\
   %D%/packages/patches/cmake-fix-tests.patch			\
   %D%/packages/patches/coda-use-system-libs.patch		\
+  %D%/packages/patches/coreutils-cut-huge-range-test.patch	\
+  %D%/packages/patches/coreutils-fix-cross-compilation.patch    \
   %D%/packages/patches/cpio-CVE-2016-2037.patch			\
   %D%/packages/patches/cpufrequtils-fix-aclocal.patch		\
   %D%/packages/patches/cracklib-CVE-2016-6318.patch		\
@@ -534,8 +537,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/cursynth-wave-rand.patch			\
   %D%/packages/patches/cyrus-sasl-CVE-2013-4122.patch		\
   %D%/packages/patches/dbus-helper-search-path.patch		\
-  %D%/packages/patches/devil-CVE-2009-3994.patch		\
-  %D%/packages/patches/devil-fix-libpng.patch			\
   %D%/packages/patches/dfu-programmer-fix-libusb.patch		\
   %D%/packages/patches/diffutils-gets-undeclared.patch		\
   %D%/packages/patches/doc++-include-directives.patch		\
@@ -549,6 +550,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/emacs-scheme-complete-scheme-r5rs-info.patch	\
   %D%/packages/patches/emacs-source-date-epoch.patch		\
   %D%/packages/patches/eudev-rules-directory.patch		\
+  %D%/packages/patches/eudev-conflicting-declaration.patch	\
   %D%/packages/patches/evilwm-lost-focus-bug.patch		\
   %D%/packages/patches/expat-CVE-2016-0718-fix-regression.patch	\
   %D%/packages/patches/fastcap-mulGlobal.patch			\
@@ -562,30 +564,34 @@ dist_patch_DATA =						\
   %D%/packages/patches/fcgi-2.4.0-poll.patch			\
   %D%/packages/patches/findutils-localstatedir.patch		\
   %D%/packages/patches/findutils-test-xargs.patch		\
-  %D%/packages/patches/flex-CVE-2016-6354.patch			\
   %D%/packages/patches/flint-ldconfig.patch			\
   %D%/packages/patches/fltk-shared-lib-defines.patch		\
   %D%/packages/patches/fltk-xfont-on-demand.patch		\
+  %D%/packages/patches/fontconfig-charwidth-symbol-conflict.patch	\
+  %D%/packages/patches/fontconfig-path-max.patch		\
   %D%/packages/patches/fontforge-svg-modtime.patch		\
   %D%/packages/patches/freeimage-CVE-2015-0852.patch		\
   %D%/packages/patches/freeimage-CVE-2016-5684.patch		\
+  %D%/packages/patches/freeimage-fix-build-with-gcc-5.patch	\
   %D%/packages/patches/gawk-shell.patch				\
   %D%/packages/patches/gcc-arm-bug-71399.patch			\
   %D%/packages/patches/gcc-arm-link-spec-fix.patch		\
   %D%/packages/patches/gcc-cross-environment-variables.patch	\
+  %D%/packages/patches/gcc-libiberty-printf-decl.patch		\
   %D%/packages/patches/gcc-libvtv-runpath.patch			\
   %D%/packages/patches/gcc-strmov-store-file-names.patch	\
   %D%/packages/patches/gcc-4.9.3-mingw-gthr-default.patch	\
   %D%/packages/patches/gcc-5.0-libvtv-runpath.patch		\
+  %D%/packages/patches/gcc-5-source-date-epoch-1.patch		\
+  %D%/packages/patches/gcc-5-source-date-epoch-2.patch		\
   %D%/packages/patches/gcc-6-arm-none-eabi-multilib.patch	\
   %D%/packages/patches/gcc-6-cross-environment-variables.patch	\
   %D%/packages/patches/gcj-arm-mode.patch			\
-  %D%/packages/patches/gd-CVE-2016-7568.patch			\
+  %D%/packages/patches/gdk-pixbuf-list-dir.patch		\
-  %D%/packages/patches/gd-CVE-2016-8670.patch			\
-  %D%/packages/patches/gd-fix-chunk-size-on-boundaries.patch	\
   %D%/packages/patches/gd-fix-gd2-read-test.patch		\
   %D%/packages/patches/gd-fix-tests-on-i686.patch		\
-  %D%/packages/patches/gd-fix-truecolor-format-correction.patch	\
+  %D%/packages/patches/gd-freetype-test-failure.patch		\
+  %D%/packages/patches/gd-php-73968-Fix-109-XBM-reading.patch		\
   %D%/packages/patches/gegl-CVE-2012-4433.patch			\
   %D%/packages/patches/geoclue-config.patch			\
   %D%/packages/patches/ghc-dont-pass-linker-flags-via-response-files.patch	\
@@ -611,6 +617,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/gobject-introspection-absolute-shlib-path.patch \
   %D%/packages/patches/gobject-introspection-cc.patch		\
   %D%/packages/patches/gobject-introspection-girepository.patch	\
+  %D%/packages/patches/graphite2-ffloat-store.patch		\
   %D%/packages/patches/grep-timing-sensitive-test.patch		\
   %D%/packages/patches/grub-CVE-2015-8370.patch			\
   %D%/packages/patches/grub-gets-undeclared.patch		\
@@ -622,7 +629,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/guile-linux-syscalls.patch		\
   %D%/packages/patches/guile-present-coding.patch		\
   %D%/packages/patches/guile-relocatable.patch			\
-  %D%/packages/patches/guile-repl-server-test.patch		\
   %D%/packages/patches/guile-rsvg-pkgconfig.patch		\
   %D%/packages/patches/gtk2-respect-GUIX_GTK2_PATH.patch	\
   %D%/packages/patches/gtk2-respect-GUIX_GTK2_IM_MODULE_FILE.patch \
@@ -669,7 +675,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/kobodeluxe-midicon-segmentation-fault.patch	\
   %D%/packages/patches/kobodeluxe-graphics-window-signed-char.patch	\
   %D%/packages/patches/laby-make-install.patch			\
-  %D%/packages/patches/lcms-fix-out-of-bounds-read.patch	\
+  %D%/packages/patches/lcms-CVE-2016-10165.patch		\
   %D%/packages/patches/ldc-disable-tests.patch			\
   %D%/packages/patches/ldc-1.1.0-disable-dmd-tests.patch	\
   %D%/packages/patches/ldc-1.1.0-disable-phobos-tests.patch	\
@@ -677,20 +683,15 @@ dist_patch_DATA =						\
   %D%/packages/patches/liba52-link-with-libm.patch		\
   %D%/packages/patches/liba52-set-soname.patch			\
   %D%/packages/patches/liba52-use-mtune-not-mcpu.patch		\
-  %D%/packages/patches/libarchive-7zip-heap-overflow.patch	\
-  %D%/packages/patches/libarchive-fix-symlink-check.patch	\
-  %D%/packages/patches/libarchive-fix-filesystem-attacks.patch	\
-  %D%/packages/patches/libarchive-safe_fprintf-buffer-overflow.patch	\
   %D%/packages/patches/libbonobo-activation-test-race.patch	\
   %D%/packages/patches/libcanberra-sound-theme-freedesktop.patch \
-  %D%/packages/patches/libcmis-fix-test-onedrive.patch		\
   %D%/packages/patches/libdrm-symbol-check.patch		\
-  %D%/packages/patches/libepoxy-gl-null-checks.patch		\
+  %D%/packages/patches/libetonyek-build-with-mdds-1.2.patch     \
   %D%/packages/patches/libevent-dns-tests.patch			\
+  %D%/packages/patches/libevent-2.0-CVE-2016-10195.patch	\
+  %D%/packages/patches/libevent-2.0-CVE-2016-10196.patch	\
+  %D%/packages/patches/libevent-2.0-CVE-2016-10197.patch	\
   %D%/packages/patches/libevent-2.0-evbuffer-add-use-last-with-datap.patch	\
-  %D%/packages/patches/libevent-2.0-evdns-fix-remote-stack-overread.patch	\
-  %D%/packages/patches/libevent-2.0-evdns-fix-searching-empty-hostnames.patch	\
-  %D%/packages/patches/libevent-2.0-evutil-fix-buffer-overflow.patch	\
   %D%/packages/patches/libevent-2.1-dns-tests.patch		\
   %D%/packages/patches/libevent-2.1-skip-failing-test.patch	\
   %D%/packages/patches/libextractor-ffmpeg-3.patch		\
@@ -704,7 +705,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/libmad-armv7-thumb-pt2.patch		\
   %D%/packages/patches/libmad-frame-length.patch		\
   %D%/packages/patches/libmad-mips-newgcc.patch			\
-  %D%/packages/patches/libpng-CVE-2016-10087.patch		\
+  %D%/packages/patches/libssh2-fix-build-failure-with-gcrypt.patch	\
   %D%/packages/patches/libtar-CVE-2013-4420.patch \
   %D%/packages/patches/libtheora-config-guess.patch		\
   %D%/packages/patches/libtiff-CVE-2016-10092.patch		\
@@ -723,6 +724,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/libtiff-invalid-read.patch		\
   %D%/packages/patches/libtiff-null-dereference.patch		\
   %D%/packages/patches/libtiff-tiffcp-underflow.patch		\
+  %D%/packages/patches/libtorrent-rasterbar-boost-compat.patch	\
   %D%/packages/patches/libtool-skip-tests2.patch		\
   %D%/packages/patches/libunwind-CVE-2015-3239.patch		\
   %D%/packages/patches/libvpx-CVE-2016-2818.patch		\
@@ -738,6 +740,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/libwmf-CVE-2015-0848+CVE-2015-4588.patch	\
   %D%/packages/patches/libwmf-CVE-2015-4695.patch		\
   %D%/packages/patches/libwmf-CVE-2015-4696.patch		\
+  %D%/packages/patches/libxcb-python-3.5-compat.patch		\
   %D%/packages/patches/libxml2-CVE-2016-4658.patch		\
   %D%/packages/patches/libxml2-CVE-2016-5131.patch		\
   %D%/packages/patches/libxslt-generated-ids.patch		\
@@ -772,6 +775,8 @@ dist_patch_DATA =						\
   %D%/packages/patches/mpc123-initialize-ao.patch		\
   %D%/packages/patches/mplayer2-theora-fix.patch		\
   %D%/packages/patches/module-init-tools-moduledir.patch	\
+  %D%/packages/patches/mozjs17-aarch64-support.patch		\
+  %D%/packages/patches/mozjs24-aarch64-support.patch		\
   %D%/packages/patches/multiqc-fix-git-subprocess-error.patch	\
   %D%/packages/patches/mumps-build-parallelism.patch		\
   %D%/packages/patches/mupdf-build-with-openjpeg-2.1.patch	\
@@ -791,6 +796,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/ngircd-handle-zombies.patch		\
   %D%/packages/patches/ninja-zero-mtime.patch			\
   %D%/packages/patches/node-9077.patch				\
+  %D%/packages/patches/nss-increase-test-timeout.patch		\
   %D%/packages/patches/nss-pkgconfig.patch			\
   %D%/packages/patches/ntfs-3g-CVE-2017-0358.patch		\
   %D%/packages/patches/nvi-assume-preserve-path.patch		\
@@ -804,11 +810,8 @@ dist_patch_DATA =						\
   %D%/packages/patches/omake-fix-non-determinism.patch	\
   %D%/packages/patches/ola-readdir-r.patch			\
   %D%/packages/patches/openexr-missing-samples.patch		\
-  %D%/packages/patches/openjpeg-CVE-2016-5157.patch		\
-  %D%/packages/patches/openjpeg-CVE-2016-7163.patch		\
   %D%/packages/patches/openjpeg-CVE-2016-9850-CVE-2016-9851.patch		\
   %D%/packages/patches/openjpeg-CVE-2016-9572-CVE-2016-9573.patch		\
-  %D%/packages/patches/openjpeg-use-after-free-fix.patch	\
   %D%/packages/patches/openocd-nrf52.patch			\
   %D%/packages/patches/openssl-runpath.patch			\
   %D%/packages/patches/openssl-1.1.0-c-rehash-in.patch		\
@@ -822,7 +825,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/patchelf-rework-for-arm.patch		\
   %D%/packages/patches/patchutils-xfail-gendiff-tests.patch	\
   %D%/packages/patches/patch-hurd-path-max.patch		\
-  %D%/packages/patches/pcre-CVE-2016-3191.patch			\
   %D%/packages/patches/perl-autosplit-default-time.patch	\
   %D%/packages/patches/perl-deterministic-ordering.patch	\
   %D%/packages/patches/perl-finance-quote-unuse-mozilla-ca.patch \
@@ -860,13 +862,14 @@ dist_patch_DATA =						\
   %D%/packages/patches/pygpgme-disable-problematic-tests.patch  \
   %D%/packages/patches/pyqt-configure.patch			\
   %D%/packages/patches/python-2-deterministic-build-info.patch	\
+  %D%/packages/patches/python-2.7-getentropy-on-old-kernels.patch	\
   %D%/packages/patches/python-2.7-search-paths.patch		\
   %D%/packages/patches/python-2.7-site-prefixes.patch		\
   %D%/packages/patches/python-2.7-source-date-epoch.patch	\
   %D%/packages/patches/python-3-deterministic-build-info.patch	\
   %D%/packages/patches/python-3-search-paths.patch		\
-  %D%/packages/patches/python-3.4-fix-tests.patch		\
   %D%/packages/patches/python-3.5-fix-tests.patch		\
+  %D%/packages/patches/python-3.5-getentropy-on-old-kernels.patch	\
   %D%/packages/patches/python-dendropy-fix-tests.patch		\
   %D%/packages/patches/python-file-double-encoding-bug.patch	\
   %D%/packages/patches/python-fix-tests.patch			\
@@ -879,6 +882,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/python-pandas-skip-failing-tests.patch	\
   %D%/packages/patches/python-paste-remove-website-test.patch	\
   %D%/packages/patches/python-paste-remove-timing-test.patch	\
+  %D%/packages/patches/python-pillow-freetype-2.7-test-failure.patch	\
   %D%/packages/patches/python-pygit2-disable-network-tests.patch	\
   %D%/packages/patches/python-pyopenssl-skip-network-test.patch	\
   %D%/packages/patches/python-pycrypto-CVE-2013-7459.patch	\
@@ -902,6 +906,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/quickswitch-fix-dmenu-check.patch	\
   %D%/packages/patches/rapicorn-isnan.patch			\
   %D%/packages/patches/ratpoison-shell.patch			\
+  %D%/packages/patches/rcs-5.9.4-noreturn.patch			\
   %D%/packages/patches/readline-link-ncurses.patch		\
   %D%/packages/patches/readline-6.2-CVE-2014-2524.patch		\
   %D%/packages/patches/readline-7.0-mingw.patch			\
@@ -909,10 +914,10 @@ dist_patch_DATA =						\
   %D%/packages/patches/rpm-CVE-2014-8118.patch			\
   %D%/packages/patches/rsem-makefile.patch			\
   %D%/packages/patches/ruby-concurrent-ignore-broken-test.patch	\
+  %D%/packages/patches/ruby-concurrent-test-arm.patch		\
   %D%/packages/patches/ruby-puma-ignore-broken-test.patch       \
   %D%/packages/patches/ruby-rack-ignore-failing-test.patch      \
   %D%/packages/patches/ruby-tzinfo-data-ignore-broken-test.patch\
-  %D%/packages/patches/sed-hurd-path-max.patch			\
   %D%/packages/patches/scheme48-tests.patch			\
   %D%/packages/patches/scotch-test-threading.patch		\
   %D%/packages/patches/sdl-libx11-1.6.patch			\
@@ -939,10 +944,10 @@ dist_patch_DATA =						\
   %D%/packages/patches/t1lib-CVE-2010-2642.patch		\
   %D%/packages/patches/t1lib-CVE-2011-0764.patch		\
   %D%/packages/patches/t1lib-CVE-2011-1552+CVE-2011-1553+CVE-2011-1554.patch		\
+  %D%/packages/patches/tar-CVE-2016-6321.patch			\
   %D%/packages/patches/tar-skip-unreliable-tests.patch		\
   %D%/packages/patches/tcl-mkindex-deterministic.patch		\
   %D%/packages/patches/tclxml-3.2-install.patch			\
-  %D%/packages/patches/tcsh-do-not-define-BSDWAIT.patch		\
   %D%/packages/patches/tcsh-fix-autotest.patch			\
   %D%/packages/patches/tcsh-fix-out-of-bounds-read.patch	\
   %D%/packages/patches/teensy-loader-cli-help.patch		\
@@ -973,6 +978,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/unzip-initialize-symlink-flag.patch	\
   %D%/packages/patches/unzip-overflow-long-fsize.patch		\
   %D%/packages/patches/unzip-remove-build-date.patch		\
+  %D%/packages/patches/ustr-fix-build-with-gcc-5.patch		\
   %D%/packages/patches/util-linux-tests.patch			\
   %D%/packages/patches/util-linux-CVE-2017-2616.patch		\
   %D%/packages/patches/upower-builddir.patch			\
@@ -986,6 +992,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/vte-CVE-2012-2738-pt2.patch			\
   %D%/packages/patches/weechat-python.patch			\
   %D%/packages/patches/wget-CVE-2017-6508.patch			\
+  %D%/packages/patches/wget-fix-504-test-timeout.patch			\
   %D%/packages/patches/wicd-bitrate-none-fix.patch		\
   %D%/packages/patches/wicd-get-selected-profile-fix.patch	\
   %D%/packages/patches/wicd-urwid-1.3.patch			\
@@ -995,8 +1002,11 @@ dist_patch_DATA =						\
   %D%/packages/patches/wordnet-CVE-2008-2149.patch			\
   %D%/packages/patches/wordnet-CVE-2008-3908-pt1.patch			\
   %D%/packages/patches/wordnet-CVE-2008-3908-pt2.patch			\
+  %D%/packages/patches/xcb-proto-python3-print.patch		\
+  %D%/packages/patches/xcb-proto-python3-whitespace.patch	\
   %D%/packages/patches/wxwidgets-fix-windowGTK.patch		\
   %D%/packages/patches/xdotool-fix-makefile.patch               \
+  %D%/packages/patches/xf86-input-wacom-xorg-abi-25.patch	\
   %D%/packages/patches/xf86-video-ark-remove-mibstore.patch	\
   %D%/packages/patches/xf86-video-ast-remove-mibstore.patch	\
   %D%/packages/patches/xf86-video-geode-glibc-2.20.patch	\
@@ -1021,6 +1031,7 @@ bootstrapdir = $(guilemoduledir)/%D%/packages/bootstrap
 bootstrap_x86_64_linuxdir = $(bootstrapdir)/x86_64-linux
 bootstrap_i686_linuxdir = $(bootstrapdir)/i686-linux
 bootstrap_armhf_linuxdir = $(bootstrapdir)/armhf-linux
+bootstrap_aarch64_linuxdir = $(bootstrapdir)/aarch64-linux
 bootstrap_mips64el_linuxdir = $(bootstrapdir)/mips64el-linux
 
 dist_bootstrap_x86_64_linux_DATA =		\
@@ -1041,6 +1052,12 @@ dist_bootstrap_armhf_linux_DATA =		\
   %D%/packages/bootstrap/armhf-linux/tar	\
   %D%/packages/bootstrap/armhf-linux/xz
 
+dist_bootstrap_aarch64_linux_DATA =		\
+  %D%/packages/bootstrap/aarch64-linux/bash	\
+  %D%/packages/bootstrap/aarch64-linux/mkdir	\
+  %D%/packages/bootstrap/aarch64-linux/tar	\
+  %D%/packages/bootstrap/aarch64-linux/xz
+
 dist_bootstrap_mips64el_linux_DATA =		\
   %D%/packages/bootstrap/mips64el-linux/bash	\
   %D%/packages/bootstrap/mips64el-linux/mkdir	\
@@ -1055,6 +1072,8 @@ nodist_bootstrap_i686_linux_DATA =					\
   %D%/packages/bootstrap/i686-linux/guile-2.0.9.tar.xz
 nodist_bootstrap_armhf_linux_DATA =					\
   %D%/packages/bootstrap/armhf-linux/guile-2.0.11.tar.xz
+nodist_bootstrap_aarch64_linux_DATA =					\
+  %D%/packages/bootstrap/aarch64-linux/guile-2.0.14.tar.xz
 nodist_bootstrap_mips64el_linux_DATA =					\
   %D%/packages/bootstrap/mips64el-linux/guile-2.0.9.tar.xz
 
@@ -1067,6 +1086,7 @@ DISTCLEANFILES =				\
   $(nodist_bootstrap_x86_64_linux_DATA)		\
   $(nodist_bootstrap_i686_linux_DATA)		\
   $(nodist_bootstrap_armhf_linux_DATA)		\
+  $(nodist_bootstrap_aarch64_linux_DATA)		\
   $(nodist_bootstrap_mips64el_linux_DATA)
 
 # Method to download a file from an external source.
@@ -1087,6 +1107,10 @@ DOWNLOAD_FILE =								\
 	$(AM_V_DL)$(MKDIR_P) `dirname "$@"`;	\
 	$(DOWNLOAD_FILE) "$@"			\
 	  "e551d05d4d385d6706ab8d574856a087758294dc90ab4c06e70a157a685e23d6"
+%D%/packages/bootstrap/aarch64-linux/guile-2.0.14.tar.xz:
+	$(AM_V_DL)$(MKDIR_P) `dirname "$@"`;	\
+	$(DOWNLOAD_FILE) "$@"			\
+	  "3939909f24dcb955621aa7f81ecde6844bea8a083969c2d275c55699af123ebe"
 %D%/packages/bootstrap/mips64el-linux/guile-2.0.9.tar.xz:
 	$(AM_V_DL)$(MKDIR_P) `dirname "$@"`;	\
 	$(DOWNLOAD_FILE) "$@" 			\

gnu/packages/admin.scm

@@ -112,20 +112,23 @@ usual file attributes can be checked for inconsistencies.")
 (define-public progress
   (package
     (name "progress")
-    (version "0.13")
+    (version "0.13.1")
     (source (origin
       (method url-fetch)
       (uri (string-append "https://github.com/Xfennec/"
                           name "/archive/v" version ".tar.gz"))
       (sha256
-       (base32 "133iar4vq5vlklydb4cyazjy6slmpbndrws474mg738bd8avc30n"))
+       (base32 "199rk6608q9m6l0fbjm0xl2w1c5krf8245dqnksdp4rqp7l9ak06"))
       (file-name (string-append name "-" version ".tar.gz"))))
     (build-system gnu-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)
+       ("which" ,which)))
     (inputs
      `(("ncurses" ,ncurses)))
     (arguments
      `(#:tests? #f ; There is no test suite.
-       #:make-flags (list "CC=gcc" "LDFLAGS+=-lncurses"
+       #:make-flags (list "CC=gcc"
                           (string-append "PREFIX=" (assoc-ref %outputs "out")))
        #:phases
        (modify-phases %standard-phases

gnu/packages/attr.scm

@@ -54,7 +54,7 @@
              ;; Use the right shell.
              (substitute* "test/run"
                (("/bin/sh")
-                (which "bash")))
+                (which "sh")))
 
              ;; When building natively, run the tests.
              (unless target

gnu/packages/audio.scm

@@ -1286,6 +1286,15 @@ synchronous execution of all clients, and low latency operation.")
                            "--alsa")
        #:phases
        (modify-phases %standard-phases
+         (add-after 'unpack 'patch-fast_rand
+           (lambda _
+             (substitute* "common/memops.c"
+               ;; Fixed in upstream commit d3c8e2d8d78899fba40a3e677ed4dbe388d82269
+               (("^inline unsigned int fast_rand" line)
+                (string-append "static " line))
+               ;; Fixed in upstream commit 0279a2d65a36d1378f5bab56d95bf9e99cc8cefb
+               ((" 96314165") " 196314165"))
+             #t))
          (add-before
           'configure 'set-linkflags
           (lambda _

gnu/packages/autotools.scm

@@ -5,6 +5,7 @@
 ;;; Copyright © 2014 Manolis Fragkiskos Ragkousis <manolis837@gmail.com>
 ;;; Copyright © 2015 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2016 David Thompson <davet@gnu.org>
+;;; Copyright © 2017 ng0 <ng0@libertad.pw>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -26,6 +27,7 @@
   #:use-module (gnu packages)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages m4)
+  #:use-module (gnu packages man)
   #:use-module (gnu packages bash)
   #:use-module (guix utils)
   #:use-module (guix packages)
@@ -300,6 +302,7 @@ Makefile, simplifying the entire process for the developer.")
     (propagated-inputs `(("m4" ,m4)))
     (native-inputs `(("m4" ,m4)
                      ("perl" ,perl)
+                     ("help2man" ,help2man) ;because we modify ltmain.sh
                      ("automake" ,automake)      ;some tests rely on 'aclocal'
                      ("autoconf" ,(autoconf-wrapper)))) ;others on 'autom4te'
 
@@ -313,21 +316,27 @@ Makefile, simplifying the entire process for the developer.")
                                       (or (%current-target-system)
                                           (%current-system))))
 
-       #:phases (alist-cons-before
+       #:phases
-                 'check 'pre-check
+       (modify-phases %standard-phases
+         (add-before 'check 'pre-check
            (lambda* (#:key inputs #:allow-other-keys)
              ;; Run the test suite in parallel, if possible.
              (setenv "TESTSUITEFLAGS"
                      (string-append
                       "-j"
                       (number->string (parallel-job-count))))
-
+           ;; Patch references to /bin/sh.
-                   ;; Path references to /bin/sh.
            (let ((bash (assoc-ref inputs "bash")))
              (substitute* "tests/testsuite"
                (("/bin/sh")
-                        (string-append bash "/bin/bash")))))
+                (string-append bash "/bin/sh")))
-                 %standard-phases)))
+             #t)))
+         (add-after 'patch-source-shebangs 'restore-ltmain-shebang
+           (lambda* (#:key inputs #:allow-other-keys)
+             (substitute* "build-aux/ltmain.in"
+               (("^#!.*/bin/sh$") "#!/bin/sh"))
+             #t)))))
+
     (synopsis "Generic shared library support tools")
     (description
      "GNU Libtool helps in the creation and use of shared libraries, by

gnu/packages/avahi.scm

@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013, 2014, 2015 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2013, 2014, 2015, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014 Mark H Weaver <mhw@netris.org>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -25,6 +25,7 @@
   #:use-module (gnu packages)
   #:use-module (gnu packages databases)
   #:use-module (gnu packages libdaemon)
+  #:use-module (gnu packages linux)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages glib)
   #:use-module (gnu packages xml))
@@ -59,6 +60,7 @@
        ("glib" ,glib)
        ("dbus" ,dbus)
        ("gdbm" ,gdbm)
+       ("libcap" ,libcap)            ;to enable chroot support in avahi-daemon
        ("libdaemon" ,libdaemon)))
     (native-inputs
      `(("intltool" ,intltool)

gnu/packages/backup.scm

@@ -186,20 +186,15 @@ backups (called chunks) to allow easy burning to CD/DVD.")
 (define-public libarchive
   (package
     (name "libarchive")
-    (version "3.2.1")
+    (version "3.2.2")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "http://libarchive.org/downloads/libarchive-"
                            version ".tar.gz"))
-       (patches (search-patches
-                  "libarchive-7zip-heap-overflow.patch"
-                  "libarchive-fix-symlink-check.patch"
-                  "libarchive-fix-filesystem-attacks.patch"
-                  "libarchive-safe_fprintf-buffer-overflow.patch"))
        (sha256
         (base32
-         "1lngng84k1kkljl74q0cdqc3s82vn2kimfm02dgm4d6m7x71mvkj"))))
+         "03q6y428rg723c9fj1vidzjw46w1vf8z0h95lkvz1l9jw571j739"))))
     (build-system gnu-build-system)
     ;; TODO: Add -L/path/to/nettle in libarchive.pc.
     (inputs

gnu/packages/base.scm

@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2012, 2013, 2014, 2015, 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2012 Nikita Karetnikov <nikita@karetnikov.org>
 ;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
@@ -78,14 +78,14 @@ command-line arguments, multiple languages, and so on.")
 (define-public grep
   (package
    (name "grep")
-   (version "2.25")
+   (version "3.0")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/grep/grep-"
                                 version ".tar.xz"))
             (sha256
              (base32
-              "0c38b67cnwchwzv4wq2gpz6smkhdxrac2hhssv8f0l04qnx867p2"))
+              "1dcasjp3a578nrvzrcn38mpizb8w1q6mvfzhjmcqqgkf0nsivj72"))
             (patches (search-patches "grep-timing-sensitive-test.patch"))))
    (build-system gnu-build-system)
    (native-inputs `(("perl" ,perl)))             ;some of the tests require it
@@ -118,30 +118,36 @@ including, for example, recursive directory searching.")
 (define-public sed
   (package
    (name "sed")
-   (version "4.2.2")
+   (version "4.4")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/sed/sed-" version
-                                ".tar.bz2"))
+                                ".tar.xz"))
             (sha256
              (base32
-              "1myvrmh99jsvk7v3d7crm0gcrq51hmmm1r2kjyyci152in1x2j7h"))
+              "0fv88bcnraixc8jvpacvxshi30p5x9m7yb8ns1hfv07hmb2ypmnb"))))
-            (patches (search-patches "sed-hurd-path-max.patch"))))
    (build-system gnu-build-system)
    (synopsis "Stream editor")
    (arguments
-    (if (%current-target-system)
+    `(#:phases
-        '()
+      (modify-phases %standard-phases
-        `(#:phases (alist-cons-before
+        (add-after 'unpack 'dont-rebuild-sed.1
-                    'patch-source-shebangs 'patch-test-suite
+          (lambda _
+            ;; Make sure we do not attempt to rebuild 'doc/sed.1', which does
+            ;; not work when cross-compiling because we cannot run 'sed'.
+            ;; This is fixed upstream as commit a0a25e3.
+            (substitute* "Makefile.in"
+              (("^doc/sed\\.1:.*")
+               "doc/sed.1:\n"))
+            #t))
+        (add-before 'patch-source-shebangs 'patch-test-suite
           (lambda* (#:key inputs #:allow-other-keys)
-                      (let ((bash (assoc-ref inputs "bash")))
             (patch-makefile-SHELL "testsuite/Makefile.tests")
             (substitute* '("testsuite/bsd.sh"
                            "testsuite/bug-regex9.c")
               (("/bin/sh")
-                           (string-append bash "/bin/bash")))))
+               (which "sh")))
-                    %standard-phases))))
+            #t)))))
    (description
     "Sed is a non-interactive, text stream editor.  It receives a text
 input from a file or from standard input and it then applies a series of text
@@ -162,7 +168,8 @@ implementation offers several extensions over the standard utility.")
             (sha256
              (base32
               "097hx7sbzp8qirl4m930lw84kn0wmxhmq7v1qpra3mrg0b8cyba0"))
-            (patches (search-patches "tar-skip-unreliable-tests.patch"))))
+            (patches (search-patches "tar-CVE-2016-6321.patch"
+                                     "tar-skip-unreliable-tests.patch"))))
    (build-system gnu-build-system)
    ;; Note: test suite requires ~1GiB of disk space.
    (arguments
@@ -277,14 +284,15 @@ used to apply commands with arbitrarily long arguments.")
 (define-public coreutils
   (package
    (name "coreutils")
-   (version "8.25")
+   (version "8.26")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/coreutils/coreutils-"
                                 version ".tar.xz"))
             (sha256
              (base32
-              "11yfrnb94xzmvi4lhclkcmkqsbhww64wf234ya1aacjvg82prrii"))))
+              "13lspazc7xkviy93qz7ks9jv4sldvgmwpq36ghrbrqpq93br8phm"))
+            (patches (search-patches "coreutils-fix-cross-compilation.patch"))))
    (build-system gnu-build-system)
    (inputs `(("acl"  ,acl)                        ; TODO: add SELinux
              ("gmp"  ,gmp)                        ;bignums in 'expr', yay!
@@ -299,12 +307,21 @@ used to apply commands with arbitrarily long arguments.")
     ;; copy of help2man.  However, don't pass it when cross-compiling since
     ;; that would lead it to try to run programs to get their '--help' output
     ;; for help2man.
-    (if (%current-target-system)
+    `(,@(if (%current-target-system)
             '()
-        `(("perl" ,perl))))
+            `(("perl" ,perl)))
+
+      ;; Apply this patch only on ARM to avoid a full rebuild.
+      ;; TODO: Move to 'patches' in the next update cycle.
+      ,@(if (string-prefix? "arm" (or (%current-target-system)
+                                      (%current-system)))
+            `(("cut-test.patch"
+               ,(search-patch "coreutils-cut-huge-range-test.patch")))
+            '())))
    (outputs '("out" "debug"))
    (arguments
     `(#:parallel-build? #f            ; help2man may be called too early
+      #:parallel-tests? #f            ; race condition fixed after 8.26
       #:phases (alist-cons-before
                 'build 'patch-shell-references
                 (lambda* (#:key inputs #:allow-other-keys)
@@ -319,7 +336,22 @@ used to apply commands with arbitrarily long arguments.")
                     (substitute* (find-files "tests" "\\.sh$")
                       (("#!/bin/sh")
                        (format #f "#!~a/bin/sh" bash)))))
-                %standard-phases)))
+
+                ,@(if (string-prefix? "arm" (or (%current-target-system)
+                                                (%current-system)))
+                      '((alist-cons-before
+                         'build 'patch-cut-test
+                         (lambda* (#:key inputs native-inputs
+                                   #:allow-other-keys)
+                           (let ((patch (or (assoc-ref inputs
+                                                       "cut-test.patch")
+                                            (assoc-ref native-inputs
+                                                       "cut-test.patch"))))
+                             (zero?
+                              (system* "patch" "-p1" "--force"
+                                       "--input" patch))))
+                         %standard-phases))
+                      '(%standard-phases)))))
    (synopsis "Core GNU utilities (file, text, shell)")
    (description
     "GNU Coreutils includes all of the basic command-line tools that are
@@ -362,7 +394,7 @@ functionality beyond that which is outlined in the POSIX standard.")
             (let ((bash (assoc-ref inputs "bash")))
               (substitute* "job.c"
                 (("default_shell =.*$")
-                 (format #f "default_shell = \"~a/bin/bash\";\n"
+                 (format #f "default_shell = \"~a/bin/sh\";\n"
                          bash)))))))))
    (synopsis "Remake files automatically")
    (description
@@ -501,14 +533,14 @@ store.")
 (define-public glibc/linux
   (package
    (name "glibc")
-   (version "2.24")
+   (version "2.25")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/glibc/glibc-"
                                 version ".tar.xz"))
             (sha256
              (base32
-              "1lxmprg9gm73gvafxd503x70z32phwjzcy74i0adfi6ixzla7m4r"))
+              "1813dzkgw6v8q8q1m4v96yfis7vjqc9pslqib6j9mrwh6fxxjyq6"))
             (snippet
              ;; Disable 'ldconfig' and /etc/ld.so.cache.  The latter is
              ;; required on LFS distros to avoid loading the distro's libc.so
@@ -619,14 +651,14 @@ store.")
                       ;; Same for `popen'.
                       (substitute* "libio/iopopen.c"
                         (("/bin/sh")
-                         (string-append bash "/bin/bash")))
+                         (string-append bash "/bin/sh")))
 
                       ;; Same for the shell used by the 'exec' functions for
                       ;; scripts that lack a shebang.
                       (substitute* (find-files "." "^paths\\.h$")
                         (("#define[[:blank:]]+_PATH_BSHELL[[:blank:]].*$")
                          (string-append "#define _PATH_BSHELL \""
-                                        bash "/bin/bash\"\n")))
+                                        bash "/bin/sh\"\n")))
 
                       ;; Nscd uses __DATE__ and __TIME__ to create a string to
                       ;; make sure the client and server come from the same
@@ -715,7 +747,21 @@ with the Linux kernel.")
              ;; Use the right 'pwd'.
              (substitute* "configure"
                (("/bin/pwd") "pwd")))
-          ,original-phases)))
+           (alist-replace
+            'build
+            (lambda _
+              ;; Force mach/hurd/libpthread subdirs to build first in order to avoid
+              ;; linking errors.
+              ;; See <https://lists.gnu.org/archive/html/bug-hurd/2016-11/msg00045.html>
+              (let ((-j (list "-j" (number->string (parallel-job-count)))))
+                (let-syntax ((make (syntax-rules ()
+                                     ((_ target)
+                                      (zero? (apply system* "make" target -j))))))
+                  (and (make "mach/subdir_lib")
+                       (make "hurd/subdir_lib")
+                       (make "libpthread/subdir_lib")
+                       (zero? (apply system* "make" -j))))))
+            ,original-phases))))
         ((#:configure-flags original-configure-flags)
         `(append (list "--host=i586-pc-gnu"
 
@@ -750,6 +796,18 @@ GLIBC/HURD for a Hurd host"
 ;; Below are old libc versions, which we use mostly to build locale data in
 ;; the old format (which the new libc cannot cope with.)
 
+(define-public glibc-2.24
+  (package
+    (inherit glibc)
+    (version "2.24")
+    (source (origin
+              (inherit (package-source glibc))
+              (uri (string-append "mirror://gnu/glibc/glibc-"
+                                  version ".tar.xz"))
+              (sha256
+               (base32
+                "1lxmprg9gm73gvafxd503x70z32phwjzcy74i0adfi6ixzla7m4r"))))))
+
 (define-public glibc-2.23
   (package
     (inherit glibc)
@@ -943,7 +1001,7 @@ command.")
 (define-public tzdata
   (package
     (name "tzdata")
-    (version "2016j")
+    (version "2017a")
     (source (origin
              (method url-fetch)
              (uri (string-append
@@ -951,7 +1009,7 @@ command.")
                    version ".tar.gz"))
              (sha256
               (base32
-               "1j4xycpwhs57qnkcxwh3np8wnf3km69n3cf4w6p2yv2z247lxvpm"))))
+               "1mmv4rvcs12lrvgghw4fidczvb69yv69cmzknghcvw1c196mqfnz"))))
     (build-system gnu-build-system)
     (arguments
      '(#:tests? #f
@@ -999,7 +1057,7 @@ command.")
                                 version ".tar.gz"))
                           (sha256
                            (base32
-                            "1dxhrk4z0n2di8p0yd6q00pa6bwyz5xqbrfbasiz8785ni7zrvxr"))))))
+                            "1b1q7gnlsh5hjgs5065pvajd37rmbc3k9b8cgzad1vcrifswdwh2"))))))
     (home-page "https://www.iana.org/time-zones")
     (synopsis "Database of current and historical time zones")
     (description "The Time Zone Database (often called tz or zoneinfo)
@@ -1009,6 +1067,31 @@ reflect changes made by political bodies to time zone boundaries, UTC offsets,
 and daylight-saving rules.")
     (license public-domain)))
 
+;;; A "fixed" version of tzdata, which is used in the test suites of
+;;; glib and R. We can update this whenever we are able to rebuild
+;;; thousands of packages (for example, in a core-updates rebuild).
+(define-public tzdata-2017a
+  (package
+    (inherit tzdata)
+    (version "2017a")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (string-append "https://www.iana.org/time-zones/repository"
+                            "/releases/tzdata" version ".tar.gz"))
+        (sha256
+         (base32
+          "1mmv4rvcs12lrvgghw4fidczvb69yv69cmzknghcvw1c196mqfnz"))))
+    (inputs `(("tzcode" ,(origin
+                          (method url-fetch)
+                          (uri (string-append
+                                "http://www.iana.org/time-zones/repository/releases/tzcode"
+                                version ".tar.gz"))
+                          (sha256
+                           (base32
+                            "1b1q7gnlsh5hjgs5065pvajd37rmbc3k9b8cgzad1vcrifswdwh2"))))))))
+
+
 (define-public libiconv
   (package
     (name "libiconv")

gnu/packages/bash.scm

@@ -1,7 +1,8 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014, 2015 Mark H Weaver <mhw@netris.org>
-;;; Copyright © 2015 Leo Famulari <leo@famulari.name>
+;;; Copyright © 2015, 2017 Leo Famulari <leo@famulari.name>
+;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -58,7 +59,19 @@
 (define %patch-series-4.4
   ;; This is the current patches series for 4.4, generated using
   ;; 'download-patches' below.
-  (patch-series))
+  (patch-series
+   (1 "03vzy7qwjdd5qvl3ydg99naazas2qmyd0yhnrflgjbbm64axja1y")
+   (2 "0lrwq6vyqism3yqv9s7kzaf3dsl4q5w9r5svcqz279qp7qca083h")
+   (3 "1chqww2rj6g42b8s60q5zlzy0jzp684jkpsbrbfy1vzxja8mmpsi")
+   (4 "1cy8abf96hkrjhw921ndr0shlcnc52bg45rn6xri4v5clhq0l25d")
+   (5 "0a8515kyk4zsgmvlqvlganjfr7pq0j6kzpr4d6xx02kpbdr4n7i2")
+   (6 "1f24wgqngmj2mrj9yibwvc2zvlmn5xi53mnw777g3l40c4m2x3ka")
+   (7 "1bzdsnqaf05gdbqpsixhan8vygjxpcxlz1dd8d9f5jdznw3wq76y") ;CVE-2017-5932
+   (8 "1firw915mjm03hbbw9a70ch3cpgrgnvqjpllgdnn6csr8q04f546")
+   (9 "0g1l56kvw61rpw7dqa9fcl9llkl693h73g631hrhxlm030ddssqb")
+   (10 "01lfhrkdsdkdz8ypzapr614ras23x7ckjnr60aa5bzkaqprccrc4")
+   (11 "038p7mhnq9m65g505hi3827jkf9f35nd1cy00w8mwafpyxp44mnx")
+   (12 "0gh6lbb1rwpk44pvbamm6vzdfi50xnwkqd9v7s8cjwk3pz973hps")))
 
 (define (download-patches store count)
   "Download COUNT Bash patches into store.  Return a list of
@@ -99,7 +112,6 @@ number/base32-hash tuples, directly usable in the 'patch-series' form."
          (version "4.4"))
     (package
      (name "bash")
-     (replacement bash/fixed)
      (source (origin
               (method url-fetch)
               (uri (string-append
@@ -164,6 +176,13 @@ number/base32-hash tuples, directly usable in the 'patch-series' form."
                 (rename-file (string-append out "/lib/pkgconfig")
                              (string-append include
                                             "/lib/pkgconfig"))
+
+                ;; Don't capture the absolute file name of 'install' to avoid
+                ;; retaining a dependency on Coreutils.
+                (substitute* (string-append (lib include)
+                                            "/Makefile.inc")
+                  (("^INSTALL =.*")
+                   "INSTALL = install -c\n"))
                 #t))))))
 
      (native-search-paths
@@ -186,7 +205,6 @@ without modification.")
   ;; A stripped-down Bash for non-interactive use.
   (package (inherit bash)
     (name "bash-minimal")
-    (replacement #f) ;not vulnerable to CVE-2017-5932 since it lacks completion
     (inputs '())                                ; no readline, no curses
 
     ;; No "include" output because there's no support for loadable modules.
@@ -242,45 +260,6 @@ without modification.")
                    (delete-file-recursively (string-append out "/share"))
                    #t))))))))))
 
-(define* (url-fetch/reset-patch-level url hash-algo hash
-                                      #:optional name
-                                      #:key (system (%current-system)))
-  "Fetch the Bash patch from URL and reset its 'PATCHLEVEL' definition so it
-can apply to a patch-level 0 Bash."
-  ;; Note: Forcefully use %BOOTSTRAP-GUILE here to work around bootstrapping
-  ;; issues when using a daemon that lacks the "download" built-in.  See
-  ;; <https://bugs.gnu.org/25775>.
-  (mlet* %store-monad ((name -> (or name (basename url)))
-                       (patch (url-fetch url hash-algo hash
-                                         (string-append name ".orig")
-                                         #:system system
-                                         #:guile %bootstrap-guile)))
-    (gexp->derivation name
-                      (with-imported-modules '((guix build utils))
-                        #~(begin
-                            (use-modules (guix build utils))
-                            (copy-file #$patch #$output)
-                            (substitute* #$output
-                              (("PATCHLEVEL [0-6]+")
-                               "PATCHLEVEL 0"))))
-                      #:system system)))
-
-(define bash/fixed                        ;CVE-2017-5932 (RCE with completion)
-  (package
-    (inherit bash)
-    (version "4.4.A")                             ;4.4.0 + patch #7
-    (replacement #f)
-    (source
-     (origin
-       (inherit (package-source bash))
-       (patches (cons (origin
-                        (method url-fetch/reset-patch-level)
-                        (uri (patch-url 7))
-                        (sha256
-                         (base32
-                          "1bzdsnqaf05gdbqpsixhan8vygjxpcxlz1dd8d9f5jdznw3wq76y")))
-                      (origin-patches (package-source bash))))))))
-
 (define-public bash-completion
   (package
     (name "bash-completion")

gnu/packages/bdw-gc.scm

@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2012, 2013, 2014, 2016 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014 Mark H Weaver <mhw@netris.org>
+;;; Copyright © 2016 Leo Famulari <leo@famulari.name>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -24,24 +25,23 @@
   #:use-module (guix build-system gnu)
   #:use-module (gnu packages pkg-config))
 
-(define-public libgc-7.2
+(define-public libgc
   (package
    (name "libgc")
-   (version "7.2f")
+   (version "7.6.0")
    (source (origin
             (method url-fetch)
             (uri (string-append "http://www.hboehm.info/gc/gc_source/gc-"
                                 version ".tar.gz"))
             (sha256
              (base32
-              "119x7p1cqw40mpwj80xfq879l9m1dkc7vbc1f3bz3kvkf8bf6p16"))))
+              "143x7g0d0k6250ai6m2x3l4y352mzizi4wbgrmahxscv2aqjhjm1"))))
    (build-system gnu-build-system)
    (arguments
-    ;; Make it so that we don't rely on /proc.  This is especially useful in
+    '(#:configure-flags '(;; Install gc_cpp.h et al.
-    ;; an initrd run before /proc is mounted.
-    '(#:configure-flags '("CPPFLAGS=-DUSE_LIBC_PRIVATES"
-                          ;; Install gc_cpp.h et al.
                           "--enable-cplusplus")))
+   (native-inputs `(("pkg-config" ,pkg-config)))
+   (inputs `(("libatomic-ops" ,libatomic-ops)))
    (outputs '("out" "debug"))
    (synopsis "The Boehm-Demers-Weiser conservative garbage collector
 for C and C++")
@@ -67,7 +67,7 @@ C or C++ programs, though that is not its primary goal.")
 (define-public libatomic-ops
   (package
     (name "libatomic-ops")
-    (version "7.4.2")
+    (version "7.4.4")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -75,7 +75,7 @@ C or C++ programs, though that is not its primary goal.")
                     version ".tar.gz"))
               (sha256
                (base32
-                "1pdm0h1y7bgkczr8byg20r6bq15m5072cqm5pny4f9crc9gn3yh4"))))
+                "13vg5fqwil17zpf4hj4h8rh3blzmym693lkdjgvwpgni1mh0l8dz"))))
     (build-system gnu-build-system)
     (outputs '("out" "debug"))
     (synopsis "Accessing hardware atomic memory update operations")
@@ -88,21 +88,3 @@ lock-free code, experiment with thread programming paradigms, etc.")
 
     ;; Some source files are X11-style, others are GPLv2+.
     (license gpl2+)))
-
-(define-public libgc
-  (package (inherit libgc-7.2)
-    (version "7.4.2")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "http://www.hboehm.info/gc/gc_source/gc-"
-                                  version ".tar.gz"))
-              (sha256
-               (base32
-                "18mg28rr6kwr5clc65k4l4hkyy4kd16amx831sjf8q2lqkbhlck3"))))
-
-    ;; New dependencies.
-    (native-inputs `(("pkg-config" ,pkg-config)))
-    (inputs `(("libatomic-ops" ,libatomic-ops)))
-
-    ;; 'USE_LIBC_PRIVATES' is now the default.
-    (arguments '(#:configure-flags '("--enable-cplusplus")))))

gnu/packages/bioinformatics.scm

@@ -2133,7 +2133,19 @@ data and settings.")
         (base32
          "0rah9ja4m0rl5mldd6vag9rwrivw1zrqxssfq8qx64m7961fp68k"))))
     (build-system cmake-build-system)
-    (arguments `(#:tests? #f)) ; there are no tests
+    (arguments
+     `(#:tests? #f                      ; there are no tests
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'add-missing-includes
+           (lambda _
+             (substitute* "src/executioninformation.hpp"
+               (("#define EXECUTIONINFORMATION_HPP" line)
+                (string-append line "\n#include <random>")))
+             (substitute* "src/plasma/fasta.hpp"
+               (("#define FASTA_HPP" line)
+                (string-append line "\n#include <random>")))
+             #t)))))
     (inputs
      `(("boost" ,boost)
        ("cairo" ,cairo)))
@@ -3138,7 +3150,10 @@ command, or queried for specific k-mers with @code{jellyfish query}.")
      `(("zlib" ,zlib)
        ("bzip2" ,bzip2)
        ("python-screed" ,python-screed)
-       ("python-bz2file" ,python-bz2file)))
+       ("python-bz2file" ,python-bz2file)
+       ;; Tests fail when gcc-5 is used for compilation.  Use gcc-4.9 at least
+       ;; until the next version of khmer (likely 2.1) is released.
+       ("gcc" ,gcc-4.9)))
     (home-page "https://khmer.readthedocs.org/")
     (synopsis "K-mer counting, filtering and graph traversal library")
     (description "The khmer software is a set of command-line tools for
@@ -5210,6 +5225,13 @@ against local background noises.")
                (("#include \"(bam|sam|kstring).h\"" _ header)
                 (string-append "#include <samtools/" header ".h>")))
              #t))
+         (add-after 'unpack 'remove-duplicate-typedef
+           (lambda _
+             ;; This typedef conflicts with the typedef in
+             ;; glibc-2.25/include/bits/types.h
+             (substitute* "gclib/GThreads.h"
+               (("typedef long long __intmax_t;") ""))
+             #t))
          (replace 'install
           (lambda* (#:key outputs #:allow-other-keys)
             (let ((bin (string-append (assoc-ref outputs "out") "/bin/")))

gnu/packages/bittorrent.scm

@@ -31,6 +31,7 @@
   #:use-module (guix build-system python)
   #:use-module (guix build-system glib-or-gtk)
   #:use-module ((guix licenses) #:prefix l:)
+  #:use-module (gnu packages)
   #:use-module (gnu packages adns)
   #:use-module (gnu packages boost)
   #:use-module (gnu packages check)
@@ -379,16 +380,19 @@ and will take advantage of multiple processor cores where possible.")
 (define-public libtorrent-rasterbar
   (package
     (name "libtorrent-rasterbar")
-    (version "1.0.10")
+    (version "1.1.2")
     (source (origin
               (method url-fetch)
               (uri
                (string-append
                 "https://github.com/arvidn/libtorrent/releases/download/libtorrent-"
-                "1_0_10" "/libtorrent-rasterbar-" version ".tar.gz"))
+                (string-join (string-split version #\.) "_")
+                "/libtorrent-rasterbar-" version ".tar.gz"))
+              (patches
+               (search-patches "libtorrent-rasterbar-boost-compat.patch"))
               (sha256
                (base32
-                "0gjcr892hzmcngvpw5bycjci4dk49v763lsnpvbwsjmim2ncwrd8"))))
+                "16im9qsmfrmmkhfjpij9739nqpn4s6wgc9cikdxbcyshfhimzra5"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags

gnu/packages/boost.scm

@@ -4,6 +4,7 @@
 ;;; Copyright © 2015 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2016 Eric Bavier <bavier@member.fsf.org>
 ;;; Copyright © 2015 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2017 Thomas Danckaert <post@thomasdanckaert.be>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -34,7 +35,7 @@
 (define-public boost
   (package
     (name "boost")
-    (version "1.61.0")
+    (version "1.63.0")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -43,7 +44,7 @@
                     ".tar.bz2"))
               (sha256
                (base32
-                "0h5nk7pgxf7xsvvshj9qfpsfp9wx6gq9r78n3nx736pxq83bsix5"))))
+                "1c5kzhcqahnic55dxcnw7r80qvwx5sfa2sa97yzv7xjrywljbbmy"))))
     (build-system gnu-build-system)
     (inputs `(("zlib" ,zlib)))
     (native-inputs
@@ -109,14 +110,14 @@ across a broad spectrum of applications.")
 (define-public mdds
   (package
     (name "mdds")
-    (version "0.12.1")
+    (version "1.2.2")
     (source (origin
              (method url-fetch)
              (uri (string-append
-                   "http://kohei.us/files/mdds/src/mdds_" version ".tar.bz2"))
+                   "http://kohei.us/files/mdds/src/mdds-" version ".tar.bz2"))
              (sha256
               (base32
-               "0gg8mb9kxh3wggh7njj1gf90xy27p0yq2cw88wqar9hhg2fmwmi3"))))
+               "17fcjhsq3bzqm7ba9sgp6my3y4226jnwai6q5jq3810i745p67hl"))))
     (build-system gnu-build-system)
     (propagated-inputs
       `(("boost" ,boost))) ; inclusion of header files

gnu/packages/bootloaders.scm

@@ -27,7 +27,6 @@
   #:use-module (gnu packages admin)
   #:use-module ((gnu packages algebra) #:select (bc))
   #:use-module (gnu packages assembly)
-  #:use-module (gnu packages flex)
   #:use-module (gnu packages disk)
   #:use-module (gnu packages bison)
   #:use-module (gnu packages cdrom)
@@ -115,7 +114,10 @@
     (native-inputs
      `(("unifont" ,unifont)
        ("bison" ,bison)
-       ("flex" ,flex)
+       ;; Due to a bug in flex >= 2.6.2, GRUB must be built with an older flex:
+       ;; <http://lists.gnu.org/archive/html/grub-devel/2017-02/msg00133.html>
+       ;; TODO Try building with flex > 2.6.3.
+       ("flex" ,flex-2.6.1)
        ("texinfo" ,texinfo)
        ("help2man" ,help2man)
 
@@ -238,7 +240,7 @@ menu to select one of the installed operating systems.")
     (build-system gnu-build-system)
     (native-inputs
      `(("bison" ,bison)
-       ("flex" ,flex)))
+       ("flex" ,flex-2.6.1))) ; A bug in flex prevents building with flex-2.6.3.
     (arguments
      `(#:make-flags
        (list "CC=gcc"

gnu/packages/bootstrap.scm

@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014, 2015 Mark H Weaver <mhw@netris.org>
+;;; Copyright © 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -28,6 +29,7 @@
   #:use-module ((guix store) #:select (add-to-store add-text-to-store))
   #:use-module ((guix derivations) #:select (derivation))
   #:use-module ((guix utils) #:select (gnu-triplet->nix-system))
+  #:use-module ((guix build utils) #:select (elf-file?))
   #:use-module (guix memoization)
   #:use-module (srfi srfi-1)
   #:use-module (srfi srfi-26)
@@ -167,6 +169,7 @@ successful, or false to signal an error."
         ((string=? system "i586-gnu") "/lib/ld.so.1")
         ((string=? system "i686-gnu") "/lib/ld.so.1")
         ((string=? system "aarch64-linux") "/lib/ld-linux-aarch64.so.1")
+        ((string=? system "powerpc-linux") "/lib/ld.so.1")
         ((string=? system "alpha-linux") "/lib/ld-linux.so.2")
 
         ;; XXX: This one is used bare-bones, without a libc, so add a case
@@ -202,6 +205,8 @@ successful, or false to signal an error."
          (guile (->store (match system
                            ("armhf-linux"
                             "guile-2.0.11.tar.xz")
+                           ("aarch64-linux"
+                            "guile-2.0.14.tar.xz")
                            (_
                             "guile-2.0.9.tar.xz"))))
          ;; The following code, run by the bootstrap guile after it is
@@ -290,7 +295,8 @@ $out/bin/guile --version~%"
   ;; This is where the initial binaries come from.
   '("ftp://alpha.gnu.org/gnu/guix/bootstrap"
     "http://alpha.gnu.org/gnu/guix/bootstrap"
-    "http://www.fdn.fr/~lcourtes/software/guix/packages"))
+    "http://www.fdn.fr/~lcourtes/software/guix/packages"
+    "http://flashner.co.il/guix/bootstrap"))
 
 (define %bootstrap-coreutils&co
   (package-from-tarball "bootstrap-binaries"
@@ -301,6 +307,8 @@ $out/bin/guile --version~%"
                                           (match system
                                             ("armhf-linux"
                                              "/20150101/static-binaries.tar.xz")
+                                            ("aarch64-linux"
+                                             "/20170217/static-binaries.tar.xz")
                                             (_
                                              "/20131110/static-binaries.tar.xz")))
                                      %bootstrap-base-urls))
@@ -315,6 +323,9 @@ $out/bin/guile --version~%"
                               ("armhf-linux"
                                (base32
                                 "0gf0fn2kbpxkjixkmx5f4z6hv6qpmgixl69zgg74dbsfdfj8jdv5"))
+                              ("aarch64-linux"
+                               (base32
+                                "18dfiq6c6xhsdpbidigw6480wh0vdgsxqq3xindq4lpdgqlccpfh"))
                               ("mips64el-linux"
                                (base32
                                 "072y4wyfsj1bs80r6vbybbafy8ya4vfy7qj25dklwk97m6g71753"))))))
@@ -325,6 +336,13 @@ $out/bin/guile --version~%"
                            (chmod "bin" #o755)
                            (patch-shebang "bin/egrep" path)
                            (patch-shebang "bin/fgrep" path)
+                           ;; Starting with grep@2.25 'egrep' and 'fgrep' are shell files
+                           ;; that call 'grep'.  If the bootstrap 'egrep' and 'fgrep'
+                           ;; are not binaries then patch them to execute 'grep' via its
+                           ;; absolute file name instead of searching for it in $PATH.
+                           (if (not (elf-file? "bin/egrep"))
+                             (substitute* '("bin/egrep" "bin/fgrep")
+                               (("^exec grep") (string-append (getcwd) "/bin/grep"))))
                            (chmod "bin" #o555)
                            #t)))
 
@@ -337,6 +355,8 @@ $out/bin/guile --version~%"
                                           (match system
                                             ("armhf-linux"
                                              "/20150101/binutils-2.25.tar.xz")
+                                            ("aarch64-linux"
+                                             "/20170217/binutils-2.27.tar.xz")
                                             (_
                                              "/20131110/binutils-2.23.2.tar.xz")))
                                      %bootstrap-base-urls))
@@ -351,6 +371,9 @@ $out/bin/guile --version~%"
                               ("armhf-linux"
                                (base32
                                 "1v7dj6bzn6m36f20gw31l99xaabq4xrhrx3gwqkhhig0mdlmr69q"))
+                              ("aarch64-linux"
+                               (base32
+                                "111s7ilfiby033rczc71797xrmaa3qlv179wdvsaq132pd51xv3n"))
                               ("mips64el-linux"
                                (base32
                                 "1x8kkhcxmfyzg1ddpz2pxs6fbdl6412r7x0nzbmi5n7mj8zw2gy7"))))))
@@ -398,6 +421,8 @@ $out/bin/guile --version~%"
                                     (match (%current-system)
                                       ("armhf-linux"
                                        "/20150101/glibc-2.20.tar.xz")
+                                      ("aarch64-linux"
+                                       "/20170217/glibc-2.25.tar.xz")
                                       (_
                                        "/20131110/glibc-2.18.tar.xz")))
                                %bootstrap-base-urls))
@@ -412,6 +437,9 @@ $out/bin/guile --version~%"
                         ("armhf-linux"
                          (base32
                           "18cmgvpllqfpn6khsmivqib7ys8ymnq0hdzi3qp24prik0ykz8gn"))
+                        ("aarch64-linux"
+                         (base32
+                          "07nx3x8598i2924rjnlrncg6rm61c9bmcczbbcpbx0fb742nvv5c"))
                         ("mips64el-linux"
                          (base32
                           "0k97a3whzx3apsi9n2cbsrr79ad6lh00klxph9hw4fqyp1abkdsg")))))))))
@@ -476,6 +504,8 @@ exec ~a/bin/.gcc-wrapped -B~a/lib \
                                     (match (%current-system)
                                       ("armhf-linux"
                                        "/20150101/gcc-4.8.4.tar.xz")
+                                      ("aarch64-linux"
+                                       "/20170217/gcc-5.4.0.tar.xz")
                                       (_
                                        "/20131110/gcc-4.8.2.tar.xz")))
                                %bootstrap-base-urls))
@@ -490,6 +520,9 @@ exec ~a/bin/.gcc-wrapped -B~a/lib \
                         ("armhf-linux"
                          (base32
                           "0ghz825yzp43fxw53kd6afm8nkz16f7dxi9xi40bfwc8x3nbbr8v"))
+                        ("aarch64-linux"
+                         (base32
+                          "1ar3vdzyqbfm0z36kmvazvfswxhcihlacl2dzdjgiq25cqnq9ih1"))
                         ("mips64el-linux"
                          (base32
                           "1m5miqkyng45l745n0sfafdpjkqv9225xf44jqkygwsipj2cv9ks")))))))))

gnu/packages/c.scm

@@ -28,7 +28,8 @@
   #:use-module (gnu packages flex)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages texinfo)
-  #:use-module (gnu packages guile))
+  #:use-module (gnu packages guile)
+  #:use-module (srfi srfi-1))
 
 (define-public tcc
   (package
@@ -62,7 +63,8 @@
                                               "/lib"))
        #:test-target "test"))
     ;; Fails to build on MIPS: "Unsupported CPU"
-    (supported-systems (delete "mips64el-linux" %supported-systems))
+    (supported-systems (fold delete %supported-systems
+                             '("mips64el-linux" "aarch64-linux")))
     (synopsis "Tiny and fast C compiler")
     (description
      "TCC, also referred to as \"TinyCC\", is a small and fast C compiler
@@ -157,6 +159,7 @@ standard.")
      "PCC is a portable C compiler.  The project goal is to write a C99
 compiler while still keeping it small, simple, fast and understandable.")
     (home-page "http://pcc.ludd.ltu.se")
+    (supported-systems (delete "aarch64-linux" %supported-systems))
     ;; PCC incorporates code under various BSD licenses; for new code bsd-2 is
     ;; preferred.  See http://pcc.ludd.ltu.se/licenses/ for more details.
     (license (list license:bsd-2 license:bsd-3))))

gnu/packages/calendar.scm

@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
-;;; Copyright © 2015, 2016 Leo Famulari <leo@famulari.name>
+;;; Copyright © 2015, 2016, 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2016 Kei Kebreau <kei@openmailbox.org>
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Troy Sankey <sankeytms@gmail.com>
@@ -64,10 +64,11 @@
            (lambda _
              (let ((tzdata (assoc-ref %build-inputs "tzdata")))
                (substitute* "src/libical/icaltz-util.c"
-                 (("char \\*search_paths \\[\\] =.*$")
+                 (("\\\"/usr/share/zoneinfo\\\",")
-                  (string-append
+                  (string-append "\"" tzdata "/share/zoneinfo\""))
-                   "char *search_paths [] = "
+                 (("\\\"/usr/lib/zoneinfo\\\",") "")
-                   "{\"" tzdata "/share/zoneinfo\"};\n"))))
+                 (("\\\"/etc/zoneinfo\\\",") "")
+                 (("\\\"/usr/share/lib/zoneinfo\\\"") "")))
              #t)))))
     (native-inputs
      `(("perl" ,perl)))

gnu/packages/certs.scm

@@ -74,7 +74,7 @@
 (define-public nss-certs
   (package
     (name "nss-certs")
-    (version "3.29.2")
+    (version "3.29.3")
     (source (origin
               (method url-fetch)
               (uri (let ((version-with-underscores
@@ -85,7 +85,7 @@
                       "nss-" version ".tar.gz")))
               (sha256
                (base32
-                "149807rmzb76hnh48rw4m9jw83iw0168njzchz0hmbsgc8mk0i5w"))))
+                "1sz1r2iml9bhd4iqiqz75gii855a25895vpy9scjky0y4lqwrp9m"))))
     (build-system gnu-build-system)
     (outputs '("out"))
     (native-inputs

gnu/packages/chez.scm

@@ -190,7 +190,15 @@
                       (symlink file (string-append (dirname file)
                                                    "/" name ".boot")))
                     (find-files lib "scheme.boot"))
-               #t))))))
+               #t)))
+         (add-before 'reset-gzip-timestamps 'make-manpages-writable
+           (lambda* (#:key outputs #:allow-other-keys)
+             (map (lambda (file)
+                    (make-file-writable file))
+                  (find-files (string-append (assoc-ref outputs "out")
+                                             "/share/man")
+                              ".*\\.gz$"))
+             #t)))))
     ;; According to the documentation MIPS is not supported.
     ;; Cross-compiling for the Raspberry Pi is supported, but not native ARM.
     (supported-systems (fold delete %supported-systems

gnu/packages/cmake.scm

@@ -5,6 +5,7 @@
 ;;; Copyright © 2014 Ian Denhardt <ian@zenhack.net>
 ;;; Copyright © 2015 Sou Bunnbu <iyzsong@gmail.com>
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -22,7 +23,7 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
 
 (define-module (gnu packages cmake)
-  #:use-module ((guix licenses) #:select (bsd-3))
+  #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix packages)
   #:use-module (guix download)
   #:use-module (guix utils)
@@ -32,13 +33,14 @@
   #:use-module (gnu packages compression)
   #:use-module (gnu packages curl)
   #:use-module (gnu packages file)
+  #:use-module (gnu packages libevent)
   #:use-module (gnu packages ncurses)
   #:use-module (gnu packages xml))
 
 (define-public cmake
   (package
     (name "cmake")
-    (version "3.6.1")
+    (version "3.7.2")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://www.cmake.org/files/v"
@@ -46,8 +48,24 @@
                                  "/cmake-" version ".tar.gz"))
              (sha256
               (base32
-               "04ggm9c0zklxypm6df1v4klrrd85m6vpv13kasj42za283n9ivi8"))
+               "1q6a60695prpzzsmczm2xrgxdb61fyjznb04dr6yls6iwv24c4nw"))
-             (patches (search-patches "cmake-fix-tests.patch"))))
+             (patches (search-patches "cmake-fix-tests.patch"))
+             (modules '((guix build utils)))
+             (snippet
+              '(begin
+                 ;; Drop bundled software.
+                 (with-directory-excursion "Utilities"
+                   (for-each delete-file-recursively
+                             '("cmbzip2"
+                               ;"cmcompress"
+                               "cmcurl"
+                               "cmexpat"
+                               ;"cmjsoncpp"
+                               ;"cmlibarchive"
+                               "cmliblzma"
+                               "cmlibuv"
+                               "cmzlib"))
+                   #t)))))
     (build-system gnu-build-system)
     (arguments
      `(#:test-target "test"
@@ -67,20 +85,19 @@
                  "Source/CTest/cmCTestBatchTestHandler.cxx"
                  "Source/cmLocalUnixMakefileGenerator3.cxx"
                  "Source/cmExecProgramCommand.cxx"
-                 "Utilities/cmbzip2/Makefile-libbz2_so"
                  "Utilities/Release/release_cmake.cmake"
                  "Utilities/cmlibarchive/libarchive/archive_write_set_format_shar.c"
                  "Tests/CMakeLists.txt"
                  "Tests/RunCMake/File_Generate/RunCMakeTest.cmake")
-               (("/bin/sh") (which "sh")))))
+               (("/bin/sh") (which "sh")))
+           #t))
          (add-before 'configure 'set-paths
            (lambda _
              ;; Help cmake's bootstrap process to find system libraries
              (begin
                (setenv "CMAKE_LIBRARY_PATH" (getenv "LIBRARY_PATH"))
                (setenv "CMAKE_INCLUDE_PATH" (getenv "C_INCLUDE_PATH"))
-               ;; Get verbose output from failed tests
+               #t)))
-               (setenv "CTEST_OUTPUT_ON_FAILURE" "TRUE"))))
          (replace 'configure
            (lambda* (#:key outputs #:allow-other-keys)
              (let ((out (assoc-ref outputs "out")))
@@ -88,7 +105,7 @@
                        "./configure"
                        (string-append "--prefix=" out)
                        "--system-libs"
-                       "--no-system-jsoncpp" ; not packaged yet
+                       "--no-system-jsoncpp" ; FIXME: Circular dependency.
                        ;; By default, the man pages and other docs land
                        ;; in PREFIX/man and PREFIX/doc, but we want them
                        ;; in share/{man,doc}.  Note that unlike
@@ -98,7 +115,15 @@
                        "--mandir=share/man"
                        ,(string-append
                          "--docdir=share/doc/cmake-"
-                         (version-major+minor version))))))))))
+                         (version-major+minor version)))))))
+         (add-before 'check 'set-test-environment
+           (lambda _
+             ;; Get verbose output from failed tests.
+             (setenv "CTEST_OUTPUT_ON_FAILURE" "TRUE")
+             ;; Run tests in parallel.
+             (setenv "CTEST_PARALLEL_LEVEL"
+                     (number->string (parallel-job-count)))
+             #t)))))
     (inputs
      `(("file"       ,file)
        ("curl"       ,curl)
@@ -106,6 +131,7 @@
        ("expat"      ,expat)
        ("bzip2"      ,bzip2)
        ("ncurses"    ,ncurses) ; required for ccmake
+       ("libuv"      ,libuv)
        ("libarchive" ,libarchive)))
     (native-search-paths
      (list (search-path-specification
@@ -118,4 +144,8 @@
 CMake is used to control the software compilation process using simple platform
 and compiler independent configuration files.  CMake generates native makefiles
 and workspaces that can be used in the compiler environment of your choice.")
-    (license bsd-3)))
+    (license (list license:bsd-3             ; cmake
+                   license:bsd-4             ; cmcompress
+                   license:bsd-2             ; cmlibarchive
+                   license:expat             ; cmjsoncpp is dual MIT/public domain
+                   license:public-domain)))) ; cmlibarchive/archive_getdate.c

gnu/packages/commencement.scm

@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2012, 2013, 2014, 2015, 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2012 Nikita Karetnikov <nikita@karetnikov.org>
 ;;; Copyright © 2014, 2015 Mark H Weaver <mhw@netris.org>
@@ -172,6 +172,26 @@
                     ,cf)))))
      (inputs %boot0-inputs))))
 
+(define libstdc++-boot0
+  ;; GCC's libcc1 is always built as a shared library (the top-level
+  ;; 'Makefile.def' forcefully adds --enable-shared) and thus needs to refer
+  ;; to libstdc++.so.  We cannot build libstdc++-5.3 because it relies on
+  ;; C++14 features missing in our bootstrap compiler.
+  (let ((lib (package-with-bootstrap-guile (make-libstdc++ gcc-4.9))))
+    (package
+      (inherit lib)
+      (name "libstdc++-boot0")
+      (arguments
+       `(#:guile ,%bootstrap-guile
+         #:implicit-inputs? #f
+
+         ;; XXX: libstdc++.so NEEDs ld.so for some reason.
+         #:validate-runpath? #f
+
+         ,@(package-arguments lib)))
+      (inputs %boot0-inputs)
+      (native-inputs '()))))
+
 (define gcc-boot0
   (package-with-bootstrap-guile
    (package (inherit gcc)
@@ -257,6 +277,9 @@
                ("mpc-source" ,(package-source mpc))
                ("binutils-cross" ,binutils-boot0)
 
+               ;; The libstdc++ that libcc1 links against.
+               ("libstdc++" ,libstdc++-boot0)
+
                ;; Call it differently so that the builder can check whether
                ;; the "libc" input is #f.
                ("libc-native" ,@(assoc-ref %boot0-inputs "libc"))
@@ -424,14 +447,8 @@ the bootstrap environment."
 (define ld-wrapper-boot0
   ;; We need this so binaries on Hurd will have libmachuser and libhurduser
   ;; in their RUNPATH, otherwise validate-runpath will fail.
-  ;;
+  (make-ld-wrapper "ld-wrapper-boot0"
-  ;; XXX: Work around <http://bugs.gnu.org/24832> by fixing the name and
+                   #:target boot-triplet
-  ;; triplet on GNU/Linux.  For GNU/Hurd, use the right triplet.
-  (make-ld-wrapper (string-append "ld-wrapper-" "x86_64-guix-linux-gnu")
-                   #:target (lambda (system)
-                              (if (string-suffix? "-linux" system)
-                                  "x86_64-guix-linux-gnu"
-                                  (boot-triplet system)))
                    #:binutils binutils-boot0
                    #:guile %bootstrap-guile
                    #:bash (car (assoc-ref %boot0-inputs "bash"))))
@@ -783,12 +800,17 @@ exec ~a/bin/~a-~a -B~a/lib -Wl,-dynamic-linker -Wl,~a/~a \"$@\"~%"
 (define bash-final
   ;; Link with `-static-libgcc' to make sure we don't retain a reference
   ;; to the bootstrap GCC.
-  ;; FIXME: This depends on 'bootstrap-binaries' via Makefile.in.
+  (let ((bash (package
+                (inherit bash)
+                (arguments
+                 `(#:disallowed-references
+                   ,(assoc-ref %boot3-inputs "coreutils&co")
+                   ,@(package-arguments bash))))))
     (package-with-bootstrap-guile
      (package-with-explicit-inputs (static-libgcc-package bash)
                                    %boot3-inputs
                                    (current-source-location)
-                                 #:guile %bootstrap-guile)))
+                                   #:guile %bootstrap-guile))))
 
 (define %boot4-inputs
   ;; Now use the final Bash.
@@ -987,10 +1009,10 @@ and binaries, plus debugging symbols in the 'debug' output), and Binutils.")
   (gcc-toolchain gcc-4.8))
 
 (define-public gcc-toolchain-4.9
-  (gcc-toolchain gcc-final))
+  (gcc-toolchain gcc-4.9))
 
 (define-public gcc-toolchain-5
-  (gcc-toolchain gcc-5))
+  (gcc-toolchain gcc-final))
 
 (define-public gcc-toolchain-6
   (gcc-toolchain gcc-6))

gnu/packages/compression.scm

@@ -56,7 +56,7 @@
 (define-public zlib
   (package
     (name "zlib")
-    (version "1.2.8")
+    (version "1.2.11")
     (source
      (origin
       (method url-fetch)
@@ -66,11 +66,12 @@
                                 version "/zlib-" version ".tar.gz")))
       (sha256
        (base32
-        "039agw5rqvqny92cpkrfn243x2gd4xn13hs3xi6isk55d2vqqr9n"))))
+        "18dighcs333gsvajvvgqp8l4cx7h1x7yx9gd5xacnk80spyykrf3"))))
     (build-system gnu-build-system)
     (arguments
-     `(#:phases (alist-replace
+     `(#:phases
-                 'configure
+       (modify-phases %standard-phases
+         (replace 'configure
            (lambda* (#:key outputs #:allow-other-keys)
              ;; Zlib's home-made `configure' fails when passed
              ;; extra flags like `--enable-fast-install', so we need to
@@ -82,8 +83,7 @@
                      '())
                (zero?
                 (system* "./configure"
-                               (string-append "--prefix=" out)))))
+                         (string-append "--prefix=" out)))))))))
-                 %standard-phases)))
     (home-page "http://zlib.net/")
     (synopsis "Compression library")
     (description

gnu/packages/cross-base.scm

@@ -281,7 +281,7 @@ GCC that does not target a libc; otherwise, target that libc."
               (setenv "ARCH" ,(system->linux-architecture target))
               (format #t "`ARCH' set to `~a' (cross compiling)~%" (getenv "ARCH"))
 
-              (and (zero? (system* "make" "defconfig"))
+              (and (zero? (system* "make" ,(system->defconfig target)))
                    (zero? (system* "make" "mrproper" "headers_check"))))
             ,phases))))
       (native-inputs `(("cross-gcc" ,xgcc)

gnu/packages/cups.scm

@@ -52,7 +52,6 @@
 (define-public cups-filters
   (package
     (name "cups-filters")
-    (replacement cups-filters/fixed)
     (version "1.13.1")
     (source(origin
               (method url-fetch)
@@ -88,6 +87,7 @@
      `(#:make-flags (list (string-append "PREFIX=" %output))
        #:configure-flags
        `("--disable-driverless" ; TODO: enable this
+         "--disable-mutool"     ; depends on yet another PDF library (mupdf)
          ,(string-append "--with-test-font-path="
                          (assoc-ref %build-inputs "font-dejavu")
                          "/share/fonts/truetype/DejaVuSans.ttf")
@@ -114,7 +114,6 @@
        ("libjpeg"      ,libjpeg)
        ("libpng"       ,libpng)
        ("libtiff"      ,libtiff)
-       ("mupdf"        ,mupdf)
        ("glib"         ,glib)
        ("qpdf"         ,qpdf)
        ("poppler"      ,poppler)
@@ -135,13 +134,6 @@ filters for the PDF-centric printing workflow introduced by OpenPrinting.")
                    license:lgpl2.0+
                    license:expat))))
 
-(define mupdf/fixed-instead-of-mupdf
-  (package-input-rewriting `((,mupdf . ,(@@ (gnu packages pdf) mupdf/fixed)))))
-
-;;; Fix CVE-2016-10132 and CVE-2016-10133. See mupdf/fixed for more information.
-(define cups-filters/fixed
-  (mupdf/fixed-instead-of-mupdf cups-filters))
-
 ;; CUPS on non-MacOS systems requires cups-filters.  Since cups-filters also
 ;; depends on CUPS libraries and binaries, cups-minimal has been added to
 ;; satisfy this dependency.
@@ -174,6 +166,14 @@ filters for the PDF-centric printing workflow introduced by OpenPrinting.")
              (substitute* "Makedefs.in"
                (("INITDIR.*=.*@INITDIR@") "INITDIR = @prefix@/@INITDIR@")
                (("/bin/sh") (which "sh")))))
+         ;; Make the compressed manpages writable so that the
+         ;; reset-gzip-timestamps phase does not error out.
+         (add-before 'reset-gzip-timestamps 'make-manpages-writable
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (man (string-append out "/share/man")))
+               (for-each (lambda (file) (chmod file #o644))
+                         (find-files man "\\.gz")))))
          (add-before 'build 'patch-tests
            (lambda _
              (substitute* "test/ippserver.c"
@@ -275,6 +275,14 @@ device-specific programs to convert and print many types of files.")
                   (string-append "cupsFileFind(\"cat\", \"" catpath "\""))
                  (("cupsFileFind\\(\"cat\", \"/bin:/usr/bin\"")
                   (string-append "cupsFileFind(\"cat\", \"" catpath "\""))))))
+         ;; Make the compressed manpages writable so that the
+         ;; reset-gzip-timestamps phase does not error out.
+         (add-before 'reset-gzip-timestamps 'make-manpages-writable
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (man (string-append out "/share/man")))
+               (for-each (lambda (file) (chmod file #o644))
+                         (find-files man "\\.gz")))))
          (add-after 'install 'install-cups-filters-symlinks
            (lambda* (#:key inputs outputs #:allow-other-keys)
              (let ((out (assoc-ref outputs "out"))

gnu/packages/curl.scm

@@ -3,7 +3,7 @@
 ;;; Copyright © 2015 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2015 Tomáš Čech <sleep_walker@suse.cz>
 ;;; Copyright © 2015 Ludovic Courtès <ludo@gnu.org>
-;;; Copyright © 2016 Leo Famulari <leo@famulari.name>
+;;; Copyright © 2016, 2017 Leo Famulari <leo@famulari.name>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -40,15 +40,14 @@
 (define-public curl
   (package
    (name "curl")
-   (replacement curl-7.53.0)
+   (version "7.53.0")
-   (version "7.50.3")
    (source (origin
             (method url-fetch)
             (uri (string-append "https://curl.haxx.se/download/curl-"
                                 version ".tar.lzma"))
             (sha256
              (base32
-              "1spmk0345hq0sgpwxs8d410268lmg3wf1x9v23hxff7wxki5fm4c"))))
+              "1k0i31xygb804c61llhin5wbpcscg4gfqmbxcfkpdr1alwh7igrq"))))
    (build-system gnu-build-system)
    (outputs '("out"
               "doc"))                             ;1.2 MiB of man3 pages
@@ -120,16 +119,3 @@ tunneling, and so on.")
    (license (license:non-copyleft "file://COPYING"
                                   "See COPYING in the distribution."))
    (home-page "https://curl.haxx.se/")))
-
-(define curl-7.53.0
-  (package
-    (inherit curl)
-    (source
-      (let ((version "7.53.0"))
-        (origin
-          (method url-fetch)
-          (uri (string-append "https://curl.haxx.se/download/curl-"
-                              version ".tar.lzma"))
-          (sha256
-           (base32
-            "1k0i31xygb804c61llhin5wbpcscg4gfqmbxcfkpdr1alwh7igrq")))))))

gnu/packages/cyrus-sasl.scm

@@ -31,7 +31,6 @@
 (define-public cyrus-sasl
   (package
    (name "cyrus-sasl")
-   (replacement cyrus-sasl/fixed)
    (version "2.1.26")
    (source (origin
             (method url-fetch)
@@ -41,6 +40,7 @@
                        (string-append
                         "ftp://ftp.cyrusimap.org/cyrus-sasl/cyrus-sasl-"
                         version ".tar.gz")))
+            (patches (search-patches "cyrus-sasl-CVE-2013-4122.patch"))
             (sha256 (base32
                      "1hvvbcsg21nlncbgs0cgn3iwlnb3vannzwsp6rwvnn9ba4v53g4g"))))
    (build-system gnu-build-system)
@@ -66,10 +66,3 @@ server writers.")
    (license (license:non-copyleft "file://COPYING"
                                   "See COPYING in the distribution."))
    (home-page "http://cyrusimap.web.cmu.edu")))
-
-(define cyrus-sasl/fixed
-  (package
-    (inherit cyrus-sasl)
-    (source (origin
-              (inherit (package-source cyrus-sasl))
-              (patches (search-patches "cyrus-sasl-CVE-2013-4122.patch"))))))

gnu/packages/databases.scm

@@ -7,7 +7,7 @@
 ;;; Copyright © 2015 Eric Bavier <bavier@member.fsf.org>
 ;;; Copyright © 2015 Sou Bunnbu <iyzsong@gmail.com>
 ;;; Copyright © 2015 Leo Famulari <leo@famulari.name>
-;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016, 2017 ng0 <contact.ng0@cryptolab.net>
 ;;; Copyright © 2016 Roel Janssen <roel@gnu.org>
 ;;; Copyright © 2016 David Craven <david@craven.ch>
@@ -210,7 +210,44 @@ SQL, Key/Value, XML/XQuery or Java Object storage for their data model.")
                                   version ".tar.gz"))
               (sha256
                (base32
-                "0a1n5hbl7027fbz5lm0vp0zzfp1hmxnz14wx3zl9563h83br5ag0"))))))
+                "0a1n5hbl7027fbz5lm0vp0zzfp1hmxnz14wx3zl9563h83br5ag0"))))
+    (arguments
+     `(#:tests? #f                            ; no check target available
+       #:disallowed-references ("doc")
+       #:phases
+       (alist-replace
+        'configure
+        (lambda* (#:key outputs #:allow-other-keys)
+          (let ((out (assoc-ref outputs "out"))
+                (doc (assoc-ref outputs "doc")))
+            ;; '--docdir' is not honored, so we need to patch.
+            (substitute* "dist/Makefile.in"
+              (("docdir[[:blank:]]*=.*")
+               (string-append "docdir = " doc "/share/doc/bdb")))
+
+            (zero?
+             (system* "./dist/configure"
+                      (string-append "--prefix=" out)
+                      (string-append "CONFIG_SHELL=" (which "bash"))
+                      (string-append "SHELL=" (which "bash"))
+
+                      ;; Bdb doesn't recognize aarch64 as an architecture.
+                      ,@(if (string=? "aarch64-linux" (%current-system))
+                            '("--build=aarch64-unknown-linux-gnu")
+                            '())
+
+                      ;; Remove 7 MiB of .a files.
+                      "--disable-static"
+
+                      ;; The compatibility mode is needed by some packages,
+                      ;; notably iproute2.
+                      "--enable-compat185"
+
+                      ;; The following flag is needed so that the inclusion
+                      ;; of db_cxx.h into C++ files works; it leads to
+                      ;; HAVE_CXX_STDHEADERS being defined in db_cxx.h.
+                      "--enable-cxx"))))
+                 %standard-phases)))))
 
 (define-public leveldb
   (package
@@ -307,7 +344,12 @@ mapping from string keys to string values.")
                        (for-each delete-file
                                  (find-files (string-append out "/bin")
                                              "_embedded$"))
-                       #t))))))
+                       #t))))
+       ;; On aarch64 the test suite runs out of memory and fails.
+       ,@(if (string-prefix? "aarch64-linux"
+                             (or (%current-target-system) (%current-system)))
+           '(#:tests? #f)
+           '())))
     (native-inputs
      `(("bison" ,bison)
        ("perl" ,perl)))
@@ -665,12 +707,9 @@ for example from a shell script.")
 (define-public sqlite
   (package
    (name "sqlite")
-   (version "3.14.1")
+   (version "3.17.0")
    (source (origin
             (method url-fetch)
-            ;; TODO: Download from sqlite.org once this bug :
-            ;; http://lists.gnu.org/archive/html/bug-guile/2013-01/msg00027.html
-            ;; has been fixed.
             (uri (let ((numeric-version
                         (match (string-split version #\.)
                           ((first-digit other-digits ...)
@@ -680,23 +719,11 @@ for example from a shell script.")
                                             (map (cut string-pad <> 2 #\0)
                                                  other-digits))
                                            6 #\0))))))
-                   (list
+                   (string-append "https://sqlite.org/2017/sqlite-autoconf-"
-                    (string-append
+                                  numeric-version ".tar.gz")))
-                     "https://fossies.org/linux/misc/sqlite-autoconf-"
-                     numeric-version ".tar.gz")
-                    (string-append
-                     "http://distfiles.gentoo.org/distfiles/"
-                     "/sqlite-autoconf-" numeric-version ".tar.gz"))
-
-                   ;; XXX: As of 2015-09-08, SourceForge is squatting the URL
-                   ;; below, returning 200 and showing an advertising page.
-                   ;; (string-append
-                   ;;  "mirror://sourceforge/sqlite.mirror/SQLite%20" version
-                   ;;  "/sqlite-autoconf-" numeric-version ".tar.gz")
-                   ))
             (sha256
              (base32
-              "19j73j44akqgc6m82wm98yvnmm3mfzmfqr8mp3n7n080d53q4wdw"))))
+              "0k472gq0p706jq4529p60znvw02hdf172qxgbdv59q0n7anqbr54"))))
    (build-system gnu-build-system)
    (inputs `(("readline" ,readline)))
    (arguments
@@ -707,7 +734,7 @@ for example from a shell script.")
       (list (string-append "CFLAGS=-O2 -DSQLITE_SECURE_DELETE "
                            "-DSQLITE_ENABLE_UNLOCK_NOTIFY "
                            "-DSQLITE_ENABLE_DBSTAT_VTAB"))))
-   (home-page "http://www.sqlite.org/")
+   (home-page "https://www.sqlite.org/")
    (synopsis "The SQLite database management system")
    (description
     "SQLite is a software library that implements a self-contained, serverless,
@@ -716,26 +743,6 @@ widely deployed SQL database engine in the world.  The source code for SQLite
 is in the public domain.")
    (license license:public-domain)))
 
-(define-public sqlite-3.15.1
-  (package (inherit sqlite)
-           (version "3.15.1")
-           (source (origin
-                     (method url-fetch)
-                     (uri (let ((numeric-version
-                                 (match (string-split version #\.)
-                                   ((first-digit other-digits ...)
-                                    (string-append first-digit
-                                                   (string-pad-right
-                                                    (string-concatenate
-                                                     (map (cut string-pad <> 2 #\0)
-                                                          other-digits))
-                                                    6 #\0))))))
-                            (string-append "https://sqlite.org/2016/sqlite-autoconf-"
-                                           numeric-version ".tar.gz")))
-                     (sha256
-                      (base32
-                       "1ig2d9jzzixiifmgqsl6kjcvy17jwxby3s24gfnc5qvyd6vqkyjx"))))))
-
 (define-public tdb
   (package
     (name "tdb")
@@ -1347,7 +1354,15 @@ trees (LSM), for sustained throughput under random insert workloads.")
      `(("python" ,python-2)))
     (inputs `(("postgresql" ,postgresql)))
     (arguments
-     `(#:tests? #f)) ; # FAIL:  1
+     `(#:tests? #f   ; # FAIL:  1
+       #:phases
+       (modify-phases %standard-phases
+         (add-before 'configure 'fix-sed-command
+           (lambda _
+             ;; Newer sed versions error out if double brackets are not used.
+             (substitute* "configure"
+               (("\\[:space:\\]") "[[:space:]]"))
+             #t)))))
     (synopsis "C++ connector for PostgreSQL")
     (description
      "Libpqxx is a C++ library to enable user programs to communicate with the

gnu/packages/display-managers.scm

@@ -140,7 +140,6 @@ Qt-style API for Wayland clients.")
        ("qttools" ,qttools)))
     (inputs
      `(("glib" ,glib)
-       ("greenisland" ,greenisland)
        ("libxcb" ,libxcb)
        ("libxkbcommon" ,libxkbcommon)
        ("linux-pam" ,linux-pam)

gnu/packages/documentation.scm

@@ -3,6 +3,7 @@
 ;;; Copyright © 2014, 2016 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2016 Eric Bavier <bavier@member.fsf.org>
 ;;; Copyright © 2016 Roel Janssen <roel@gnu.org>
+;;; Copyright © 2016 Thomas Danckaert <post@thomasdanckaert.be>
 ;;; Copyright © 2017 Kei Kebreau <kei@openmailbox.org>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -27,6 +28,7 @@
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system cmake)
   #:use-module (gnu packages)
+  #:use-module (gnu packages bash)
   #:use-module (gnu packages python)
   #:use-module (gnu packages bison)
   #:use-module (gnu packages docbook)
@@ -113,14 +115,14 @@ markup) can be customized and extended by the user.")
 (define-public doxygen
   (package
     (name "doxygen")
-    (version "1.8.11")
+    (version "1.8.13")
     (source (origin
              (method url-fetch)
              (uri (string-append "http://ftp.stack.nl/pub/users/dimitri/"
                                  name "-" version ".src.tar.gz"))
              (sha256
               (base32
-               "0ja02pm3fpfhc5dkry00kq8mn141cqvdqqpmms373ncbwi38pl35"))
+               "0srzawqn3apzrg8hwycwrawdylmmjrndij4spw6xr1vspn3phrmg"))
              (patches (search-patches "doxygen-test.patch"))))
     (build-system cmake-build-system)
     (native-inputs
@@ -128,8 +130,18 @@ markup) can be customized and extended by the user.")
        ("flex" ,flex)
        ("libxml2" ,libxml2) ; provides xmllint for the tests
        ("python" ,python-2))) ; for creating the documentation
+    (inputs
+     `(("bash" ,bash-minimal)))
     (arguments
-     `(#:test-target "tests"))
+     `(#:test-target "tests"
+       #:phases (modify-phases %standard-phases
+                  (add-before 'configure 'patch-sh
+                              (lambda* (#:key inputs #:allow-other-keys)
+                                (substitute* "src/portable.cpp"
+                                  (("/bin/sh")
+                                   (string-append
+                                    (assoc-ref inputs "bash") "/bin/sh")))
+                                #t)))))
     (home-page "http://www.stack.nl/~dimitri/doxygen/")
     (synopsis "Generate documentation from annotated sources")
     (description "Doxygen is the de facto standard tool for generating

gnu/packages/ed.scm

@@ -28,14 +28,14 @@
 (define-public ed
   (package
     (name "ed")
-    (version "1.13")
+    (version "1.14.1")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnu/ed/ed-"
                                  version ".tar.lz"))
              (sha256
               (base32
-               "1ly7i1iw02vbcd0zrx084z577ngxnarffmkm45dg6vndad5carnd"))))
+               "0ajm69pma7gigddlrq2qi4dsllz9vhm8gqwpkcdagdd2yaw7xfgz"))))
     (build-system gnu-build-system)
     (native-inputs `(("lzip" ,lzip)))
     (arguments
@@ -45,7 +45,8 @@
          (add-before 'patch-source-shebangs 'patch-test-suite
                      (lambda _
                        (substitute* "testsuite/check.sh"
-                         (("/bin/sh") (which "sh"))))))))
+                         (("/bin/sh") (which "sh")))
+                       #t)))))
     (home-page "https://www.gnu.org/software/ed/")
     (synopsis "Line-oriented text editor")
     (description

gnu/packages/elf.scm

@@ -2,6 +2,7 @@
 ;;; Copyright © 2013, 2014, 2015 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014, 2015 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2015 Andreas Enge <andreas@enge.fr>
+;;; Copyright © 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -78,8 +79,10 @@ addr2line, and more.")
               (base32
                "0vf7s9dwk2xkmhb79aigqm0x0yfbw1j0b9ksm51207qwr179n6jr"))))
     (build-system gnu-build-system)
-    (arguments '(#:phases (alist-replace
+    (arguments
-                           'configure
+     `(#:phases
+       (modify-phases %standard-phases
+         (replace 'configure
            (lambda* (#:key outputs #:allow-other-keys)
              ;; This old `configure' script doesn't support
              ;; variables passed as arguments.
@@ -87,8 +90,11 @@ addr2line, and more.")
                (setenv "CONFIG_SHELL" (which "bash"))
                (zero?
                 (system* "./configure"
-                                         (string-append "--prefix=" out)))))
+                         (string-append "--prefix=" out)
-                           %standard-phases)))
+                       ,@(if (string=? "aarch64-linux"
+                                       (%current-system))
+                             '("--host=aarch64-unknown-linux-gnu")
+                             '())))))))))
     (home-page "http://www.mr511.de/software/english.html")
     (synopsis "ELF object file access library")
     (description "Libelf is a C library to access ELF object files.")

gnu/packages/embedded.scm

@@ -412,7 +412,7 @@ with a layered architecture of JTAG interface and TAP support.")
          ,@(package-arguments xbinutils)))
       (native-inputs
        `(("bison" ,bison)
-         ("flex" ,flex)
+         ("flex" ,flex-2.6.1) ; needed because of yywrap error
          ("texinfo" ,texinfo)
          ("dejagnu" ,dejagnu)
          ,@(package-native-inputs xbinutils))))))
@@ -764,7 +764,7 @@ simulator.")
                  (base32
                   "14b3h2ji740s8zq5vwm4qdcxs4aa4wxi6wb9di3bv1h39x14nyr9"))))
          ("texinfo" ,texinfo)
-         ("flex" ,flex)
+         ("flex" ,flex-2.6.1) ; A bug in flex prevents building with flex-2.6.3.
          ("bison" ,bison)
          ("guile-1.8" ,guile-1.8)
          ("which" ,base:which)))

gnu/packages/flex.scm

@@ -24,6 +24,7 @@
   #:use-module (guix build-system gnu)
   #:use-module (gnu packages)
   #:use-module (gnu packages m4)
+  #:use-module (gnu packages man)
   #:use-module (gnu packages bison)
   #:use-module (gnu packages indent)
   #:use-module (srfi srfi-1))
@@ -31,26 +32,29 @@
 (define-public flex
   (package
     (name "flex")
-    (version "2.6.0")
+    (version "2.6.3")
     (source (origin
               (method url-fetch)
-             (uri (string-append "mirror://sourceforge/flex/flex-"
+              (uri (string-append
-                                 version ".tar.bz2"))
+                    "https://github.com/westes/flex"
-             (patches (search-patches "flex-CVE-2016-6354.patch"))
+                    "/releases/download/v" version "/"
+                    "flex-" version ".tar.gz"))
               (sha256
                (base32
-               "1sdqx63yadindzafrq1w31ajblf9gl1c301g068s20s7bbpi3ri4"))))
+                "1an2cn2z85mkpgqcinh1fhhcd7993qm2lil1yxic8iz76ci79ck8"))))
     (build-system gnu-build-system)
     (inputs
      (let ((bison-for-tests
             ;; Work around an incompatibility with Bison 3.0:
             ;; <http://lists.gnu.org/archive/html/bug-bison/2013-09/msg00014.html>.
-            (package (inherit bison)
+            (package
+              (inherit bison)
               (version "2.7.1")
               (source (origin
                         (method url-fetch)
-                       (uri (string-append "mirror://gnu/bison/bison-"
+                        (uri (string-append
-                                           version ".tar.xz"))
+                              "mirror://gnu/bison/"
+                              "bison-" version ".tar.xz"))
                         (sha256
                          (base32
                           "1yx7isx67sdmyijvihgyra1f59fwdz7sqriginvavfj5yb5ss2dl"))))
@@ -61,9 +65,11 @@
        `(("bison" ,bison-for-tests)
          ("indent" ,indent))))
     ;; m4 is not present in PATH when cross-building
-    (native-inputs `(("m4" ,m4)))
+    (native-inputs
+     `(("help2man" ,help2man)
+       ("m4" ,m4)))
     (propagated-inputs `(("m4" ,m4)))
-    (home-page "http://flex.sourceforge.net/")
+    (home-page "https://github.com/westes/flex")
     (synopsis "Fast lexical analyser generator")
     (description
      "Flex is a tool for generating scanners.  A scanner, sometimes
@@ -80,21 +86,19 @@ executes the corresponding C code.")
     (license (non-copyleft "file://COPYING"
                            "See COPYING in the distribution."))))
 
+;;; Many packages fail to build with flex > 2.6.1, due to this bug in flex:
+;;; <https://github.com/westes/flex/issues/162>
+;;; We must not use a flex before 2.6.1, due to CVE-2016-6354.
+;;; TODO Try using flex > 2.6.3.
 (define-public flex-2.6.1
-  ;; The kservice and solid packages use flex.  extra-cmake-modules
-  ;; forces C89 for all C files for compatibility with windows.
-  ;; Flex 2.6.0 generates a lexer containing a single line comment.  Single
-  ;; line comments are part of the C99 standard, so the lexer won't compile
-  ;; if C89 is used.
   (package
     (inherit flex)
     (version "2.6.1")
     (source (origin
               (method url-fetch)
-              (uri (string-append
+              (uri (string-append "https://github.com/westes/flex"
-                    "https://github.com/westes/flex"
                                   "/releases/download/v" version "/"
-                    "flex-" version ".tar.gz"))
+                                  "flex-" version ".tar.xz"))
              (sha256
               (base32
-                "0fy14c35yz2m1n1m4f02by3501fn0cca37zn7jp8lpp4b3kgjhrw"))))))
+               "0gqhk4vkwy4gl9xbpgkljph8c0a5kpijz6wd0p5r9q202qn42yic"))))))

gnu/packages/fontutils.scm

@@ -2,7 +2,9 @@
 ;;; Copyright © 2013, 2014, 2015 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2014, 2016 Eric Bavier <bavier@member.fsf.org>
 ;;; Copyright © 2016 Mark H Weaver <mhw@netris.org>
-;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2017 Rene Saavedra <rennes@openmailbox.org>
+;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -46,13 +48,13 @@
 (define-public freetype
   (package
    (name "freetype")
-   (version "2.6.3")
+   (version "2.7.1")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://savannah/freetype/freetype-"
                                 version ".tar.bz2"))
             (sha256 (base32
-                     "18k3b026762lmyrxfil5xv8qwnvj7hc12gz9bjqzbb12lmx707ip"))))
+                     "121gm15ayfg3rglby8ifh8384mcjb9dhmx9j40zl7yszw72b4frs"))))
    (build-system gnu-build-system)
    (native-inputs
     `(("pkg-config" ,pkg-config)))
@@ -69,7 +71,7 @@ It supports both bitmap and scalable formats, including TrueType, OpenType,
 Type1, CID, CFF, Windows FON/FNT, X11 PCF, and others.  It supports high-speed
 anti-aliased glyph bitmap generation with 256 gray levels.")
    (license license:freetype)           ; some files have other licenses
-   (home-page "http://www.freetype.org/")))
+   (home-page "https://www.freetype.org/")))
 
 (define-public ttfautohint
   (package
@@ -229,6 +231,8 @@ fonts to/from the WOFF2 format.")
             (uri (string-append
                    "https://www.freedesktop.org/software/fontconfig/release/fontconfig-"
                    version ".tar.bz2"))
+            (patches (search-patches "fontconfig-charwidth-symbol-conflict.patch"
+                                     "fontconfig-path-max.patch"))
             (sha256 (base32
                      "1wy7svvp7df6bjpg1m5vizb3ngd7rhb20vpclv3x3qa71khs6jdl"))))
    (build-system gnu-build-system)
@@ -254,6 +258,11 @@ fonts to/from the WOFF2 format.")
             "PYTHON=false")
       #:phases
       (modify-phases %standard-phases
+        (add-after 'unpack 'fix-tests-for-freetype-2.7.1
+          (lambda _
+            (substitute* "test/run-test.sh"
+              (("\\\| sort") "| cut -d' ' -f2 | sort"))
+            #t))
         (replace 'install
                  (lambda _
                    ;; Don't try to create /var/cache/fontconfig.
@@ -366,15 +375,16 @@ applications should be.")
 (define-public graphite2
   (package
    (name "graphite2")
-   (version "1.3.8")
+   (version "1.3.9")
    (source
      (origin
        (method url-fetch)
        (uri (string-append "https://github.com/silnrsi/graphite/releases/"
                            "download/" version "/" name "-" version ".tgz"))
+       (patches (search-patches "graphite2-ffloat-store.patch"))
        (sha256
         (base32
-         "1hlc9j7w7gihy6gvzfa7902pr6yxq1sr1xkp5rwf0p29m2rjagwz"))))
+         "0rs5h7m340z75kygx8d72cps0q6yvvqa9i788vym7585cfv8a0gc"))))
    (build-system cmake-build-system)
    (native-inputs
     `(("python" ,python-2) ; because of "import imap" in tests

gnu/packages/freedesktop.scm

@@ -206,7 +206,10 @@ the freedesktop.org XDG Base Directory specification.")
        ("m4" ,m4)
        ("libxml2" ,libxml2)                     ;for XML_CATALOG_FILES
        ("pkg-config" ,pkg-config)
-       ("gperf" ,gperf)))
+
+       ;; Use gperf 3.0 to work around
+       ;; <https://github.com/wingo/elogind/issues/8>.
+       ("gperf" ,gperf-3.0)))
     (inputs
      `(("linux-pam" ,linux-pam)
        ("linux-libre-headers" ,linux-libre-headers)
@@ -274,14 +277,14 @@ Python.")
 (define-public wayland
   (package
     (name "wayland")
-    (version "1.11.0")
+    (version "1.13.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://wayland.freedesktop.org/releases/"
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1c0d5ivy9n44hykvw2ggrvqrnn7naw3wg11vbvgwzgi8g5gr4h4m"))))
+                "0lgywr1m0d79vr4s8aimj8a307nss29hhy68gjpqj7m667055c39"))))
     (build-system gnu-build-system)
     (arguments `(#:parallel-tests? #f))
     (native-inputs
@@ -331,7 +334,7 @@ applications, X servers (rootless or fullscreen) or other display servers.")
 (define-public weston
   (package
     (name "weston")
-    (version "1.11.0")
+    (version "2.0.0")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -339,7 +342,7 @@ applications, X servers (rootless or fullscreen) or other display servers.")
                     "weston-" version ".tar.xz"))
               (sha256
                (base32
-                "09biddxw3ar797kxf9mywjkb2iwky6my39gpp51ni846y7lqdq05"))))
+                "1n35acsknwqfhsni854q5mjq2gnbnfdvinh92rpij67i4yn4dr5l"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)
@@ -372,9 +375,11 @@ applications, X servers (rootless or fullscreen) or other display servers.")
              ;; Use elogind instead of systemd
              (substitute* "configure"
                (("libsystemd-login >= 198") "libelogind"))
-             (substitute* '("src/launcher-logind.c" "src/weston-launch.c")
+             (substitute* '("libweston/launcher-logind.c"
+                            "libweston/weston-launch.c")
                (("#include <systemd/sd-login.h>")
-                "#include <elogind/sd-login.h>"))))
+                "#include <elogind/sd-login.h>"))
+             #t))
          (add-after 'configure 'patch-confdefs.h
            (lambda _
              (system "echo \"#define HAVE_SYSTEMD_LOGIN_209 1\" >> confdefs.h")))

gnu/packages/game-development.scm

@@ -4,7 +4,7 @@
 ;;; Copyright © 2015 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2015 Alex Kost <alezost@gmail.com>
 ;;; Copyright © 2015, 2016, 2017 David Thompson <davet@gnu.org>
-;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016, 2017 Kei Kebreau <kei@openmailbox.org>
 ;;; Copyright © 2016 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2016 Julian Graham <joolean@gmail.com>
@@ -457,18 +457,16 @@ etc.")
 (define-public aseprite
   (package
     (name "aseprite")
-    (version "1.1.1")
+    (version "1.1.7") ; After 1.1.7 the source is no longer distributed under the GPL.
-    ;; The release tarball isn't good enough because it's missing some
+    ;; TODO: Unbundle third party software.
-    ;; necessary code that is only in git submodules.
     (source (origin
-              (method git-fetch)
+              (method url-fetch/zipbomb)
-              (uri (git-reference
+              (uri (string-append "https://github.com/aseprite/aseprite"
-                    (url "https://github.com/aseprite/aseprite.git")
+                                  "/releases/download/v" version
-                    (commit "v1.1.1")
+                                  "/Aseprite-v" version "-Source.zip"))
-                    (recursive? #t)))
               (sha256
                (base32
-                "1yr0l3bc68lyrffrzxgw98zznv8yz5ldl98lyvp6s5grny4s4jyk"))))
+                "1plss4i1lfxcznv9p0pip1bkhj7ipw7jlhsh5avd6dzw079l4nvv"))))
     (build-system cmake-build-system)
     (arguments
      '(#:configure-flags

gnu/packages/gawk.scm

@@ -47,7 +47,7 @@
                      (let ((bash (assoc-ref inputs "bash")))
                        (substitute* "io.c"
                          (("/bin/sh")
-                          (string-append bash "/bin/bash")))
+                          (string-append bash "/bin/sh")))
 
                        ;; When cross-compiling, remove dependencies on the
                        ;; `check-for-shared-lib-support' target, which tries

gnu/packages/gcc.scm

@@ -4,6 +4,7 @@
 ;;; Copyright © 2014, 2015, 2016 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2015 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2015, 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016 Carlos Sánchez de La Lama <csanchezdll@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -204,17 +205,18 @@ where the OS part is overloaded to denote a specific ABI---into GCC
                 (for-each
                  (lambda (x)
                    (substitute* (find-files "gcc/config"
-                                            "^linux(64|-elf|-eabi)?\\.h$")
+                                            "^(linux|gnu|sysv4)(64|-elf|-eabi)?\\.h$")
-                     (("(#define GLIBC_DYNAMIC_LINKER.*)\\\\\n$" _ line)
+                     (("(#define (GLIBC|GNU_USER)_DYNAMIC_LINKER.*)\\\\\n$" _ line)
                       line)))
                  '(1 2 3))
 
                 ;; Fix the dynamic linker's file name.
                 (substitute* (find-files "gcc/config"
-                                         "^(linux|gnu)(64|-elf|-eabi)?\\.h$")
+                                         "^(linux|gnu|sysv4)(64|-elf|-eabi)?\\.h$")
-                  (("#define GLIBC_DYNAMIC_LINKER([^ ]*).*$" _ suffix)
+                  (("#define (GLIBC|GNU_USER)_DYNAMIC_LINKER([^ ]*).*$"
-                   (format #f "#define GLIBC_DYNAMIC_LINKER~a \"~a\"~%"
+                    _ gnu-user suffix)
-                           suffix
+                   (format #f "#define ~a_DYNAMIC_LINKER~a \"~a\"~%"
+                           gnu-user suffix
                            (string-append libc ,(glibc-dynamic-linker)))))
 
                 ;; Tell where to find libstdc++, libc, and `?crt*.o', except
@@ -239,6 +241,20 @@ where the OS part is overloaded to denote a specific ABI---into GCC
                   (("#define GNU_USER_TARGET_STARTFILE_SPEC.*$" line)
                    (format #f "#define STANDARD_STARTFILE_PREFIX_1 \"~a/lib\"
 #define STANDARD_STARTFILE_PREFIX_2 \"\"
+~a"
+                           libc line)))
+
+              ;; The rs6000 (a.k.a. powerpc) config in GCC does not use
+              ;; GNU_USER_* defines.  Do the above for this case.
+              (substitute*
+                  "gcc/config/rs6000/sysv4.h"
+                (("#define LIB_LINUX_SPEC (.*)$" _ suffix)
+                 (format #f "#define LIB_LINUX_SPEC \
+\"-L~a/lib %{!static:-rpath=~a/lib %{!static-libgcc:-rpath=~a/lib -lgcc_s}} \" ~a"
+                         libc libc libdir suffix))
+                (("#define	STARTFILE_LINUX_SPEC.*$" line)
+                 (format #f "#define STANDARD_STARTFILE_PREFIX_1 \"~a/lib\"
+#define STANDARD_STARTFILE_PREFIX_2 \"\"
 ~a"
                          libc line))))
 
@@ -247,6 +263,12 @@ where the OS part is overloaded to denote a specific ABI---into GCC
                 (("static char const sed_cmd_z\\[\\] =.*;")
                  "static char const sed_cmd_z[] = \"sed\";"))
 
+              ;; Aarch64 support didn't land in GCC until the 4.8 series.
+              (when (file-exists? "gcc/config/aarch64")
+                ;; Force Aarch64 libdir to be /lib and not /lib64
+                (substitute* "gcc/config/aarch64/t-aarch64-linux"
+                  (("lib64") "lib")))
+
               (when (file-exists? "libbacktrace")
                 ;; GCC 4.8+ comes with libbacktrace.  By default it builds
                 ;; with -Werror, which fails with a -Wcast-qual error in glibc
@@ -358,8 +380,11 @@ Go.  It also includes runtime support libraries for these languages.")
               (sha256
                (base32
                 "0fihlcy5hnksdxk0sn6bvgnyq8gfrgs8m794b1jxwd1dxinzg3b0"))
-              (patches (search-patches "gcc-strmov-store-file-names.patch"
+              (patches (search-patches "gcc-arm-bug-71399.patch"
-                                       "gcc-5.0-libvtv-runpath.patch"))))))
+                                       "gcc-strmov-store-file-names.patch"
+                                       "gcc-5.0-libvtv-runpath.patch"
+                                       "gcc-5-source-date-epoch-1.patch"
+                                       "gcc-5-source-date-epoch-2.patch"))))))
 
 (define-public gcc-6
   (package
@@ -376,8 +401,9 @@ Go.  It also includes runtime support libraries for these languages.")
                                        "gcc-5.0-libvtv-runpath.patch"))))))
 
 ;; Note: When changing the default gcc version, update
-;;       the gcc-toolchain-* definitions accordingly.
+;;       the gcc-toolchain-* definitions and the gfortran definition
-(define-public gcc gcc-4.9)
+;;       accordingly.
+(define-public gcc gcc-5)
 
 (define-public (make-libstdc++ gcc)
   "Return a libstdc++ package based on GCC.  The primary use case is when
@@ -493,17 +519,17 @@ as the 'native-search-paths' field."
   (custom-gcc gcc-4.9 "gfortran" '("fortran")
               %generic-search-paths))
 
-(define-public gfortran
-  ;; Note: Update this when GCC changes!  We cannot use
-  ;; (custom-gcc gcc "fortran" …) because that would lead to a package object
-  ;; that is not 'eq?' with GFORTRAN-4.9, and thus 'fold-packages' would
-  ;; report two gfortran@4.9 that are in fact identical.
-  gfortran-4.9)
-
 (define-public gfortran-5
   (custom-gcc gcc-5 "gfortran" '("fortran")
               %generic-search-paths))
 
+(define-public gfortran
+  ;; Note: Update this when GCC changes!  We cannot use
+  ;; (custom-gcc gcc "fortran" …) because that would lead to a package object
+  ;; that is not 'eq?' with GFORTRAN-5, and thus 'fold-packages' would
+  ;; report two gfortran@5 that are in fact identical.
+  gfortran-5)
+
 (define-public gccgo-4.9
   (custom-gcc gcc-4.9 "gccgo" '("go")
               %generic-search-paths

gnu/packages/gd.scm

@@ -3,6 +3,7 @@
 ;;; Copyright © 2015, 2016 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2015 Eric Bavier <bavier@member.fsf.org>
 ;;; Copyright © 2016, 2017 Leo Famulari <leo@famulari.name>
+;;; Copyright © 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -36,12 +37,11 @@
 (define-public gd
   (package
     (name "gd")
-    (replacement gd-2.2.4)
 
     ;; Note: With libgd.org now pointing to github.com, genuine old
     ;; tarballs are no longer available.  Notably, versions 2.0.x are
     ;; missing.
-    (version "2.2.3")
+    (version "2.2.4")
 
     (source (origin
              (method url-fetch)
@@ -50,12 +50,27 @@
                    version "/libgd-" version ".tar.xz"))
              (sha256
               (base32
-               "0g3xz8jpz1pl2zzmssglrpa9nxiaa7rmcmvgpbrjz8k9cyynqsvl"))
+               "1rp4v7n1dq38b92kl7gkvpvqqkw7nvdfnz6d5kip5klkxfki6zqk"))
-             (patches (search-patches "gd-CVE-2016-7568.patch"
+             (patches (search-patches "gd-fix-gd2-read-test.patch"
-                                      "gd-CVE-2016-8670.patch"
+                                      "gd-fix-tests-on-i686.patch"
-                                      "gd-fix-gd2-read-test.patch"
+                                      "gd-freetype-test-failure.patch"
-                                      "gd-fix-tests-on-i686.patch"))))
+                                      "gd-php-73968-Fix-109-XBM-reading.patch"))))
     (build-system gnu-build-system)
+    (arguments
+      ;; As recommended by github.com/libgd/libgd/issues/278 to fix rounding
+      ;; issues on aarch64 and other architectures.
+     `(#:make-flags '("CFLAGS=-ffp-contract=off")
+       #:phases
+       (modify-phases %standard-phases
+         ;; This test is known to fail on i686-linux:
+         ;; https://github.com/libgd/libgd/issues/359
+         ;; TODO Replace this substitution with an upstream bug fix.
+         (add-after 'unpack 'disable-failing-test
+           (lambda _
+             (substitute* "tests/gdimagegrayscale/basic.c"
+               (("return gdNumFailures\\(\\)")
+                 "return 0"))
+             #t)))))
     (native-inputs
      `(("pkg-config" ,pkg-config)))
     (inputs
@@ -78,32 +93,6 @@ most common applications of GD involve website development.")
                            "See COPYING file in the distribution."))
     (properties '((cpe-name . "libgd")))))
 
-(define gd-2.2.4
-  (package
-    (inherit gd)
-    (version "2.2.4")
-    (source
-      (origin
-        (method url-fetch)
-        (uri (string-append "https://github.com/libgd/libgd/releases/download/"
-                            "gd-" version "/libgd-" version ".tar.xz"))
-        (patches (search-patches "gd-fix-gd2-read-test.patch"
-                                 "gd-fix-tests-on-i686.patch"))
-        (sha256
-         (base32
-          "1rp4v7n1dq38b92kl7gkvpvqqkw7nvdfnz6d5kip5klkxfki6zqk"))))
-    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         ;; This test is known to fail on i686-linux:
-         ;; https://github.com/libgd/libgd/issues/359
-         ;; TODO Replace this substitution with an upstream bug fix.
-         (add-after 'unpack 'disable-failing-test
-           (lambda _
-             (substitute* "tests/gdimagegrayscale/basic.c"
-               (("return gdNumFailures\\(\\)")
-                 "return 0")))))))))
-
 (define-public perl-gd
   (package
     (name "perl-gd")

gnu/packages/gettext.scm

@@ -4,6 +4,7 @@
 ;;; Copyright © 2015 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Alex Kost <alezost@gmail.com>
+;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -160,7 +161,14 @@ translated messages from the catalogs.  Nearly all GNU packages use Gettext.")
                           (wrap-program file
                             `("PERL5LIB" ":" prefix (,path))))
                         (find-files bin "\\.*$"))
-              #t))))))
+              #t)))
+         (add-before 'reset-gzip-timestamps 'make-compressed-files-writable
+           (lambda* (#:key outputs #:allow-other-keys)
+             (for-each make-file-writable
+                       (find-files (string-append (assoc-ref outputs "out")
+                                                  "/share/man")
+                                   ".*\\.gz$"))
+             #t)))))
     (native-inputs
      `(("gettext" ,gettext-minimal)
        ("perl-module-build" ,perl-module-build)

gnu/packages/ghostscript.scm

@@ -3,6 +3,8 @@
 ;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2015 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2013, 2015, 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2017 Alex Vong <alexvong1995@gmail.com>
+;;; Copyright © 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -39,14 +41,14 @@
 (define-public lcms
   (package
    (name "lcms")
-   (replacement lcms/fixed)
+   (version "2.8")
-   (version "2.6")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://sourceforge/lcms/lcms/" version
                                 "/lcms2-" version ".tar.gz"))
+            (patches (search-patches "lcms-CVE-2016-10165.patch"))
             (sha256 (base32
-                     "1c8lgq8gfs3nyplvbx9k8wzfj6r2bqi3f611vb1m8z3476454wji"))))
+                     "08pvl289g0mbznzx5l6ibhaldsgx41kwvdn2c974ga9fkli2pl36"))))
    (build-system gnu-build-system)
    (inputs `(("libjpeg-8" ,libjpeg-8)
              ("libtiff" ,libtiff)
@@ -60,14 +62,6 @@ Consortium standard (ICC), approved as ISO 15076-1.")
    (home-page "http://www.littlecms.com/")
    (properties '((cpe-name . "little_cms_color_engine")))))
 
-(define lcms/fixed
-  (package
-    (inherit lcms)
-    (source
-      (origin
-        (inherit (package-source lcms))
-        (patches (search-patches "lcms-fix-out-of-bounds-read.patch"))))))
-
 (define-public libpaper
   (package
    (name "libpaper")
@@ -178,9 +172,9 @@ printing, and psresize, for adjusting page sizes.")
         (add-after 'configure 'patch-config-files
                    (lambda _
                      (substitute* "base/all-arch.mak"
-                       (("/bin/sh") (which "bash")))
+                       (("/bin/sh") (which "sh")))
                      (substitute* "base/unixhead.mak"
-                       (("/bin/sh") (which "bash")))))
+                       (("/bin/sh") (which "sh")))))
         (add-after 'configure 'remove-doc-reference
                    (lambda _
                      ;; Don't retain a reference to the 'doc' output in 'gs'.
@@ -279,16 +273,11 @@ architecture.")
    (build-system gnu-build-system)
    (arguments
     `(#:tests? #f ; nothing to check, just files to copy
-      #:modules ((guix build gnu-build-system)
-                 (guix build utils)
-                 (srfi srfi-1)) ; for alist-delete
       #:phases
-       (alist-delete
+      (modify-phases %standard-phases
-        'configure
+        (delete 'configure)
-       (alist-delete
+        (delete 'build)
-        'build
+        (replace 'install
-       (alist-replace
-        'install
           (lambda* (#:key outputs #:allow-other-keys)
             (let* ((out (assoc-ref outputs "out"))
                    (dir (string-append out "/share/fonts/type1/ghostscript")))
@@ -296,8 +285,7 @@ architecture.")
               (for-each
                 (lambda (file)
                   (copy-file file (string-append dir "/" file)))
-              (find-files "." "pfb|afm"))))
+                (find-files "." "pfb|afm"))))))))
-       %standard-phases)))))
    (synopsis "Free replacements for the PostScript fonts")
    (description
     "Ghostscript fonts provides fonts and font metrics customarily distributed with

gnu/packages/gl.scm

@@ -4,8 +4,9 @@
 ;;; Copyright © 2014, 2016 David Thompson <davet@gnu.org>
 ;;; Copyright © 2014, 2015, 2016, 2017 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2016 ng0 <ng0@we.make.ritual.n0.is>
-;;; Copyright © 2016 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2016, 2017 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2016 David Thompson <davet@gnu.org>
+;;; Copyright © 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -33,6 +34,7 @@
   #:use-module (gnu packages gettext)
   #:use-module (gnu packages guile)
   #:use-module (gnu packages linux)
+  #:use-module (gnu packages llvm)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages python)
   #:use-module (gnu packages video)
@@ -197,7 +199,7 @@ also known as DXTn or DXTC) for Mesa.")
 (define-public mesa
   (package
     (name "mesa")
-    (version "13.0.3")
+    (version "13.0.5")
     (source
       (origin
         (method url-fetch)
@@ -205,7 +207,7 @@ also known as DXTn or DXTC) for Mesa.")
                             version "/mesa-" version ".tar.xz"))
         (sha256
          (base32
-          "03m4gc6qc50lb0ic06f83r3yl0x4lmj2zjq3sl60vl3nq7jqpanr"))
+          "11zgynii1wz17131ml1mmblpwib8m88zz2jwi5h5llh1r3iagkmz"))
         (patches
          (search-patches "mesa-wayland-egl-symbols-check-mips.patch"))))
     (build-system gnu-build-system)
@@ -227,6 +229,11 @@ also known as DXTn or DXTC) for Mesa.")
         ("libxml2" ,libxml2)
         ;; TODO: Add 'libxml2-python' for OpenGL ES 1.1 and 2.0 support
         ("libxvmc" ,libxvmc)
+        ,@(match (%current-system)
+            ((or "x86_64-linux" "i686-linux")
+             `(("llvm" ,llvm)))
+            (_
+             `()))
         ("makedepend" ,makedepend)
         ("presentproto" ,presentproto)
         ("s2tc" ,s2tc)
@@ -236,8 +243,11 @@ also known as DXTn or DXTC) for Mesa.")
         ("python" ,python-2)))
     (arguments
      `(#:configure-flags
-       '(;; drop r300 from default gallium drivers, as it requires llvm
+       '(,@(match (%current-system)
-         "--with-gallium-drivers=r600,svga,swrast,nouveau,virgl"
+             ((or "armhf-linux" "aarch64-linux")
+              '("--with-gallium-drivers=freedreno,nouveau,r300,r600,svga,swrast,vc4,virgl"))
+             (_
+              '("--with-gallium-drivers=i915,nouveau,r300,r600,svga,swrast,virgl")))
          ;; Enable various optional features.  TODO: opencl requires libclc,
          ;; omx requires libomxil-bellagio
          "--with-egl-platforms=x11,drm,wayland"
@@ -254,11 +264,15 @@ also known as DXTn or DXTC) for Mesa.")
          ;; are stuck at OpenGL 2.1 instead of OpenGL 3.0+.
          "--enable-texture-float"
          
+         ;; Also enable the tests.
+         "--enable-gallium-tests"
+
          ;; on non-intel systems, drop i915 and i965
          ;; from the default dri drivers
          ,@(match (%current-system)
              ((or "x86_64-linux" "i686-linux")
-              '())
+              '("--with-dri-drivers=i915,i965,nouveau,r200,radeon,swrast"
+                "--enable-gallium-llvm")) ; default is x86/x86_64 only
              (_
               '("--with-dri-drivers=nouveau,r200,radeon,swrast"))))
        #:phases
@@ -456,25 +470,18 @@ OpenGL graphics API.")
 (define-public libepoxy
   (package
     (name "libepoxy")
-    (version "1.3.1")
+    (version "1.4.1")
     (source (origin
               (method url-fetch)
               (uri (string-append
-                    "https://github.com/anholt/libepoxy/archive/v"
+                    "https://github.com/anholt/libepoxy/releases/download/"
-                    version
+                    version "/libepoxy-" version ".tar.xz"))
-                    ".tar.gz"))
-              (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "1d1brhwfmlzgnphmdwlvn5wbcrxsdyzf1qfcf8nb89xqzznxs037"))
+                "19hsyap2p0sflj75ycf4af9bsp453bamymbcgnmrphigabsspil8"))))
-              (patches (search-patches "libepoxy-gl-null-checks.patch"))))
     (arguments
      `(#:phases
        (modify-phases %standard-phases
-         (add-after
-           'unpack 'autoreconf
-           (lambda _
-             (zero? (system* "autoreconf" "-vif"))))
          (add-before
            'configure 'patch-paths
            (lambda* (#:key inputs #:allow-other-keys)
@@ -482,30 +489,21 @@ OpenGL graphics API.")
                    (mesa (assoc-ref inputs "mesa")))
                (substitute* "src/gen_dispatch.py"
                  (("/usr/bin/env python") python))
+               ;; Add support for aarch64, see upstream:
+               ;; https://github.com/anholt/libepoxy/pull/114
+               (substitute* "test/dlwrap.c"
+                 (("GLIBC_2.4") "GLIBC_2.17\", \"GLIBC_2.4"))
                (substitute* (find-files "." "\\.[ch]$")
                  (("libGL.so.1") (string-append mesa "/lib/libGL.so.1"))
                  (("libEGL.so.1") (string-append mesa "/lib/libEGL.so.1")))
-
-               ;; XXX On armhf systems, we must add "GLIBC_2.4" to the list of
-               ;; versions in test/dlwrap.c:dlwrap_real_dlsym.  It would be
-               ;; better to make this a normal patch, but for now we do it here
-               ;; to prevent rebuilding on other platforms.
-               ,@(if (string-prefix? "arm" (or (%current-target-system)
-                                               (%current-system)))
-                     '((substitute* '"test/dlwrap.c"
-                         (("\"GLIBC_2\\.0\"") "\"GLIBC_2.0\", \"GLIBC_2.4\"")))
-                     '())
                #t))))))
     (build-system gnu-build-system)
     (native-inputs
-     `(("autoconf" ,autoconf)
+     `(("pkg-config" ,pkg-config)
-       ("automake" ,automake)
-       ("libtool" ,libtool)
-       ("pkg-config" ,pkg-config)
        ("python" ,python)))
     (inputs
      `(("mesa" ,mesa)))
-    (home-page "http://github.com/anholt/libepoxy/")
+    (home-page "https://github.com/anholt/libepoxy/")
     (synopsis "A library for handling OpenGL function pointer management")
     (description
      "A library for handling OpenGL function pointer management.")

gnu/packages/glib.scm

@@ -67,7 +67,7 @@
 (define dbus
   (package
     (name "dbus")
-    (version "1.10.14")
+    (version "1.10.16")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -75,7 +75,7 @@
                     version ".tar.gz"))
               (sha256
                (base32
-                "10x0wvv2ly4lyyfd42k4xw0ar5qdbi9cksw3l5fcwf1y6mq8y8r3"))
+                "121kqkjsd3vgf8vca8364xl44qa5086h7qy5zs5f1l78ldpbmc57"))
               (patches (search-patches "dbus-helper-search-path.patch"))))
     (build-system gnu-build-system)
     (arguments
@@ -137,7 +137,7 @@ shared NFS home directories.")
 (define glib
   (package
    (name "glib")
-   (version "2.50.2")
+   (version "2.50.3")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/"
@@ -145,7 +145,7 @@ shared NFS home directories.")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "1xgvmiqbhla6grpmbidqs3bl6zrb9mjknfsh7r4hb3163xy76s5y"))
+              "16frrwhc1yqkzx6bgh3060g94dr2biab17fb01mrni819jzr9vl2"))
             (patches (search-patches "glib-tests-timer.patch"))))
    (build-system gnu-build-system)
    (outputs '("out"           ; everything
@@ -157,17 +157,18 @@ shared NFS home directories.")
     `(("coreutils" ,coreutils)
       ("util-linux" ,util-linux)  ; for libmount
       ("libffi" ,libffi)
-      ("zlib" ,zlib)
+      ("zlib" ,zlib)))
-      ("tzdata" ,tzdata)))     ; for tests/gdatetime.c
    (native-inputs
     `(("gettext" ,gettext-minimal)
       ("dbus" ,dbus)                              ; for GDBus tests
       ("pkg-config" ,pkg-config)
       ("python" ,python-wrapper)
       ("perl" ,perl)                              ; needed by GIO tests
-      ("bash" ,bash)))
+      ("bash" ,bash)
+      ("tzdata" ,tzdata-2017a)))                  ; for tests/gdatetime.c
    (arguments
-    '(#:phases
+    `(#:disallowed-references (,tzdata-2017a)
+      #:phases
       (modify-phases %standard-phases
         (add-before 'build 'pre-build
           (lambda* (#:key inputs outputs #:allow-other-keys)
@@ -246,7 +247,12 @@ shared NFS home directories.")
 
                      ("gio/tests/gdbus-unix-addresses.c"
                       (;; Requires /etc/machine-id.
-                       "/gdbus/x11-autolaunch")))))
+                       "/gdbus/x11-autolaunch"))
+
+                     ("glib/tests/gdatetime.c"
+                      (;; Assumes that the Brasilian time zone is named 'BRT',
+                       ;; which is no longer true as of tzdata-2017a.
+                       "/GDateTime/new_full")))))
               (and-map (lambda (x) (apply disable x)) failing-tests)))))
 
       ;; Note: `--docdir' and `--htmldir' are not honored, so work around it.

gnu/packages/gnome.scm

@@ -1867,7 +1867,7 @@ editors, IDEs, etc.")
     (version "0.46.1.a")
     (native-inputs
      `(("gtk-doc" ,gtk-doc)
-       ("gperf" ,gperf)
+       ("gperf" ,gperf-3.0)
        ("autoconf" ,autoconf)
        ("automake" ,automake)
        ("libtool" ,libtool)

gnu/packages/gnupg.scm

@@ -58,7 +58,7 @@
 (define-public libgpg-error
   (package
     (name "libgpg-error")
-    (version "1.24")
+    (version "1.26")
     (source
      (origin
       (method url-fetch)
@@ -66,7 +66,7 @@
                           version ".tar.bz2"))
       (sha256
        (base32
-        "0h75sf1ngr750c3fjfn4583q7wz40qm63jhg8vjfdrbx936f2s4j"))))
+        "0sgfia0syq78k1c9h10rkhc1nfv5v097icrprlx2x4qn074wnjsc"))))
     (build-system gnu-build-system)
     (home-page "https://gnupg.org")
     (synopsis "Library of error values for GnuPG components")
@@ -82,14 +82,14 @@ Daemon and possibly more in the future.")
 (define-public libgcrypt
   (package
     (name "libgcrypt")
-    (version "1.7.3")
+    (version "1.7.6")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnupg/libgcrypt/libgcrypt-"
                                  version ".tar.bz2"))
              (sha256
               (base32
-               "0wbh6fq5zi9wg2xcfvfpwh7dv52jihivx1vm4h91c2kx0w8n3b6x"))))
+               "1g05prhgqw4ryd0w433q8nhds0h93kf47hfjagi2r7dghkpaysk2"))))
     (build-system gnu-build-system)
     (propagated-inputs
      `(("libgpg-error-host" ,libgpg-error)))

gnu/packages/gnuzilla.scm

@@ -3,7 +3,7 @@
 ;;; Copyright © 2013, 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014, 2015, 2016, 2017 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2015 Sou Bunnbu <iyzsong@gmail.com>
-;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Alex Griffin <a@ajgrf.com>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -23,10 +23,12 @@
 
 (define-module (gnu packages gnuzilla)
   #:use-module ((srfi srfi-1) #:hide (zip))
+  #:use-module (ice-9 match)
   #:use-module (gnu packages)
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix packages)
   #:use-module (guix download)
+  #:use-module (guix utils)
   #:use-module (guix build-system gnu)
   #:use-module (gnu packages base)
   #:use-module (gnu packages databases)
@@ -68,6 +70,7 @@
              (sha256
               (base32
                "1fig2wf4f10v43mqx67y68z6h77sy900d1w0pz9qarrqx57rc7ij"))
+             (patches (search-patches "mozjs17-aarch64-support.patch"))
              (modules '((guix build utils)))
              (snippet
               ;; Fix incompatibility with Perl 5.22+.
@@ -76,26 +79,37 @@
     (build-system gnu-build-system)
     (native-inputs
      `(("perl" ,perl)
+       ("pkg-config" ,pkg-config)
        ("python" ,python-2)))
+    (propagated-inputs
+     `(("nspr" ,nspr))) ; in the Requires.private field of mozjs-17.0.pc
+    (inputs
+     `(("zlib" ,zlib)))
     (arguments
      `(;; XXX: parallel build fails, lacking:
        ;;   mkdir -p "system_wrapper_js/"
        #:parallel-build? #f
        #:phases
-          (alist-cons-before
+       (modify-phases %standard-phases
-           'configure 'chdir
+         (add-after 'unpack 'delete-timedout-test
+           ;; This test times out on slower hardware.
+           (lambda _ (delete-file "js/src/jit-test/tests/basic/bug698584.js")))
+         (add-before 'configure 'chdir
            (lambda _
-             (chdir "js/src"))
+             (chdir "js/src")
-           (alist-replace
+             #t))
-            'configure
+         (replace 'configure
            ;; configure fails if it is followed by SHELL and CONFIG_SHELL
            (lambda* (#:key outputs #:allow-other-keys)
              (let ((out (assoc-ref outputs "out")))
                (setenv "SHELL" (which "sh"))
                (setenv "CONFIG_SHELL" (which "sh"))
                (zero? (system*
-                        "./configure" (string-append "--prefix=" out)))))
+                       "./configure" (string-append "--prefix=" out)
-            %standard-phases))))
+                                     ,@(if (string=? "aarch64-linux"
+                                                     (%current-system))
+                                         '("--host=aarch64-unknown-linux-gnu")
+                                         '())))))))))
     (home-page
      "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey")
     (synopsis "Mozilla javascript engine")
@@ -116,35 +130,30 @@ in C/C++.")
                (base32
                 "1n1phk8r3l8icqrrap4czplnylawa0ddc2cc4cgdz46x3lrkybz6"))
               (modules '((guix build utils)))
+              (patches (search-patches "mozjs24-aarch64-support.patch"))
               (snippet
                ;; Fix incompatibility with Perl 5.22+.
                '(substitute* '("js/src/config/milestone.pl")
                   (("defined\\(@TEMPLATE_FILE)") "@TEMPLATE_FILE")))))
     (arguments
-     '(;; XXX: parallel build fails, lacking:
+      (substitute-keyword-arguments (package-arguments mozjs)
-       ;;   mkdir -p "system_wrapper_js/"
+        ((#:phases phases)
-       #:parallel-build? #f
+         `(modify-phases ,phases
-       #:phases
+            (replace 'configure
-       (modify-phases %standard-phases
-         (replace
-          'configure
               (lambda* (#:key outputs #:allow-other-keys)
                 (let ((out (assoc-ref outputs "out")))
-              (chdir "js/src")
+                  ;; configure fails if it is followed by SHELL and CONFIG_SHELL
-              ;; configure fails if it is follwed by SHELL and CONFIG_SHELL
                   (setenv "SHELL" (which "sh"))
                   (setenv "CONFIG_SHELL" (which "sh"))
                   (zero? (system* "./configure"
                                   (string-append "--prefix=" out)
                                   "--with-system-nspr"
                                   "--enable-system-ffi"
-                              "--enable-threadsafe"))))))))
+                                  "--enable-threadsafe"
-    (native-inputs
+                                  ,@(if (string=? "aarch64-linux"
-     `(("perl" ,perl)
+                                                  (%current-system))
-       ("pkg-config" ,pkg-config)
+                                      '("--host=aarch64-unknown-linux-gnu")
-       ("python" ,python-2)))
+                                      '()))))))))))
-    (propagated-inputs
-     `(("nspr" ,nspr))) ; in the Requires.private field of mozjs-24.pc
     (inputs
      `(("libffi" ,libffi)
        ("zlib" ,zlib)))))
@@ -152,7 +161,7 @@ in C/C++.")
 (define-public nspr
   (package
     (name "nspr")
-    (version "4.13.1")
+    (version "4.14")
     (source (origin
              (method url-fetch)
              (uri (string-append
@@ -160,7 +169,7 @@ in C/C++.")
                    version "/src/nspr-" version ".tar.gz"))
              (sha256
               (base32
-               "1arkg08l6zlp8v44shqbk2c8qzwd913lgh60fb3yfxls6d8ifk2y"))))
+               "1m8p9l3prabhfxz6zs889fl7gmcka72a62i46a8klh2pca11iz34"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("perl" ,perl)))
@@ -170,11 +179,9 @@ in C/C++.")
                                (string-append "LDFLAGS=-Wl,-rpath="
                                               (assoc-ref %outputs "out")
                                               "/lib"))
-       #:phases (alist-cons-before
+       #:phases (modify-phases %standard-phases
-                 'configure 'chdir
+                  (add-before 'configure 'chdir
-                 (lambda _
+                    (lambda _ (chdir "nspr") #t)))))
-                   (chdir "nspr"))
-                 %standard-phases)))
     (home-page
      "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR")
     (synopsis "Netscape API for system level and libc-like functions")
@@ -186,7 +193,7 @@ in the Mozilla clients.")
 (define-public nss
   (package
     (name "nss")
-    (version "3.29.2")
+    (version "3.29.3")
     (source (origin
               (method url-fetch)
               (uri (let ((version-with-underscores
@@ -197,13 +204,14 @@ in the Mozilla clients.")
                       "nss-" version ".tar.gz")))
               (sha256
                (base32
-                "149807rmzb76hnh48rw4m9jw83iw0168njzchz0hmbsgc8mk0i5w"))
+                "1sz1r2iml9bhd4iqiqz75gii855a25895vpy9scjky0y4lqwrp9m"))
               ;; Create nss.pc and nss-config.
-              (patches (search-patches "nss-pkgconfig.patch"))))
+              (patches (search-patches "nss-pkgconfig.patch"
+                                       "nss-increase-test-timeout.patch"))))
     (build-system gnu-build-system)
     (outputs '("out" "bin"))
     (arguments
-     '(#:parallel-build? #f ; failed
+     `(#:parallel-build? #f ; not supported
        #:make-flags
        (let* ((out (assoc-ref %outputs "out"))
               (nspr (string-append (assoc-ref %build-inputs "nspr")))
@@ -221,25 +229,26 @@ in the Mozilla clients.")
                   (ice-9 match)
                   (srfi srfi-26))
        #:phases
-       (alist-replace
+       (modify-phases %standard-phases
-        'configure
+         (replace 'configure
-        (lambda* (#:key system inputs #:allow-other-keys)
+           (lambda _
              (setenv "CC" "gcc")
              ;; Tells NSS to build for the 64-bit ABI if we are 64-bit system.
-          (when (string-prefix? "x86_64" system)
+             ,@(match (%current-system)
-            (setenv "USE_64" "1"))
+                 ((or "x86_64-linux" "aarch64-linux")
-          #t)
+                  `((setenv "USE_64" "1")))
-        (alist-replace
+                 (_
-         'check
+                  '()))
+             #t))
+         (replace 'check
            (lambda _
              ;; Use 127.0.0.1 instead of $HOST.$DOMSUF as HOSTADDR for testing.
              ;; The later requires a working DNS or /etc/hosts.
              (setenv "DOMSUF" "(none)")
              (setenv "USE_IP" "TRUE")
              (setenv "IP_ADDRESS" "127.0.0.1")
-           (zero? (system* "./nss/tests/all.sh")))
+             (zero? (system* "./nss/tests/all.sh"))))
-         (alist-replace
+           (replace 'install
-          'install
              (lambda* (#:key outputs #:allow-other-keys)
                (let* ((out (assoc-ref outputs "out"))
                       (bin (string-append (assoc-ref outputs "bin") "/bin"))
@@ -268,8 +277,7 @@ in the Mozilla clients.")
                  ;; seems to be used only during the tests.
                  (delete-file (string-append lib "/libgtest1.so"))
 
-              #t))
+                 #t))))))
-          %standard-phases)))))
     (inputs
      `(("sqlite" ,sqlite)
        ("zlib" ,zlib)))

gnu/packages/golang.scm

@@ -120,6 +120,7 @@
                   ;; https://github.com/golang/go/issues/17545
                   ;; https://github.com/golang/go/issues/17276
                   ("time/time_test.go" "(.+)(TestLoadFixed.+)")
+                  ("time/format_test.go" "(.+)(TestParseInLocation.+)")
 
                   ("os/exec/exec_test.go" "(.+)(TestEcho.+)")
                   ("os/exec/exec_test.go" "(.+)(TestCommandRelativeName.+)")
@@ -266,6 +267,7 @@ sequential processes (CSP) concurrent programming features added.")
                     ("net/dial_test.go" "(.+)(TestDialTimeout.+)")
                     ("os/os_test.go" "(.+)(TestHostname.+)")
                     ("time/format_test.go" "(.+)(TestParseInSydney.+)")
+                    ("time/format_test.go" "(.+)(TestParseInLocation.+)")
                     ("os/exec/exec_test.go" "(.+)(TestEcho.+)")
                     ("os/exec/exec_test.go" "(.+)(TestCommandRelativeName.+)")
                     ("os/exec/exec_test.go" "(.+)(TestCatStdin.+)")

gnu/packages/gperf.scm

@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2012, 2013 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2012, 2013, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -25,7 +25,7 @@
 (define-public gperf
   (package
     (name "gperf")
-    (version "3.0.4")
+    (version "3.1")
     (source
      (origin
       (method url-fetch)
@@ -33,7 +33,7 @@
                           version ".tar.gz"))
       (sha256
        (base32
-        "0gnnm8iqcl52m8iha3sxrzrl9mcyhg7lfrhhqgdn4zj00ji14wbn"))))
+        "1qispg6i508rq8pkajh26cznwimbnj06wq9sd85vg95v8nwld1aq"))))
     (build-system gnu-build-system)
     (arguments '(#:parallel-tests? #f))
     (home-page "https://www.gnu.org/software/gperf/")
@@ -44,3 +44,18 @@ strings, it produces a hash function and hash table in C or C++ code.  That
 the hash function is perfect means that no collisions can exist and that
 look-ups can be made by single string comparisons.")
     (license gpl3+)))
+
+(define-public gperf-3.0
+  ;; This older version would use 'unsigned int' in its generated lookup
+  ;; functions whereas 3.1 uses 'size_t', which causes breakage such as
+  ;; <https://github.com/wingo/elogind/issues/8>.
+  (package
+    (inherit gperf)
+    (version "3.0.4")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://gnu/gperf/gperf-"
+                                  version ".tar.gz"))
+              (sha256
+               (base32
+                "0gnnm8iqcl52m8iha3sxrzrl9mcyhg7lfrhhqgdn4zj00ji14wbn"))))))

gnu/packages/gps.scm

@@ -50,7 +50,10 @@
     (arguments
      `(#:configure-flags
        '("--with-zlib=system"
-         "CXXFLAGS=-std=gnu++11")
+         ;; XXX Use -fPIC to work around build problems with Qt, GCC 5, and
+         ;; recent binutils:
+         ;; https://codereview.qt-project.org/#/c/111787/
+         "CXXFLAGS=-std=gnu++11 -fPIC")
        #:phases
        (modify-phases %standard-phases
         (add-before 'configure 'pre-configure

gnu/packages/gtk.scm

@@ -168,7 +168,7 @@ affine transformation (scale, rotation, shear, etc.).")
 (define-public harfbuzz
   (package
    (name "harfbuzz")
-   (version "1.4.1")
+   (version "1.4.3")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://www.freedesktop.org/software/"
@@ -176,7 +176,7 @@ affine transformation (scale, rotation, shear, etc.).")
                                  version ".tar.bz2"))
              (sha256
               (base32
-               "1g8mndf0p0fzjfvxrprga84zvqq186gbddnw6wbna7cscfmpz8l5"))))
+               "08akv3qzwnf48xajb60dfcchkmfdjkpp65a0xd8s98w81901g343"))))
    (build-system gnu-build-system)
    (outputs '("out"
               "bin")) ; 160K, only hb-view depend on cairo
@@ -432,7 +432,8 @@ highlighting and other features typical of a source code editor.")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "1v1rssjd8p5s3lymsfhiq5mbs2pc0h1r6jd0asrwdbrign7i68sj"))))
+              "1v1rssjd8p5s3lymsfhiq5mbs2pc0h1r6jd0asrwdbrign7i68sj"))
+            (patches (search-patches "gdk-pixbuf-list-dir.patch"))))
    (build-system gnu-build-system)
    (arguments
     '(#:configure-flags '("--with-x11")
@@ -688,9 +689,12 @@ application suites.")
       ("pkg-config" ,pkg-config)
       ("gobject-introspection" ,gobject-introspection)
       ("python-wrapper" ,python-wrapper)
-      ("xorg-server" ,xorg-server)))
+      ;; By using a special xorg-server for GTK+'s tests, we reduce the impact
+      ;; of updating xorg-server directly on the master branch.
+      ("xorg-server" ,xorg-server-1.19.2)))
    (arguments
-    `(;; 47 MiB goes to "out" (24 of which is locale data!), and 26 MiB goes
+    `(#:disallowed-references (,xorg-server-1.19.2)
+      ;; 47 MiB goes to "out" (24 of which is locale data!), and 26 MiB goes
       ;; to "doc".
       #:configure-flags (list (string-append "--with-html-dir="
                                              (assoc-ref %outputs "doc")

gnu/packages/guile.scm

@@ -137,15 +137,14 @@ without requiring the source code to be rewritten.")
 (define-public guile-2.0
   (package
    (name "guile")
-   (version "2.0.12")
+   (version "2.0.14")
-   (replacement guile-2.0.13)                 ;CVE-2016-8606 and CVE-2016-8605
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/guile/guile-" version
                                 ".tar.xz"))
             (sha256
              (base32
-              "1sdpjq0jf1h65w29q0zprj4x6kdp5jskkvbnlwphy9lvdxrqg0fy"))))
+              "10lxc6l5alf3lzbs3ihnbfy6dfcrsyf8667wa57f26vf4mk2ai78"))))
    (build-system gnu-build-system)
    (native-inputs `(("pkgconfig" ,pkg-config)))
    (inputs `(("libffi" ,libffi)
@@ -218,19 +217,6 @@ without requiring the source code to be rewritten.")
     (properties '((hidden? . #t)))          ;people should install 'guile-2.0'
     (replacement #f)))
 
-(define guile-2.0.13
-  (package
-    (inherit guile-2.0)
-    (version "2.0.13")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "mirror://gnu/guile/guile-" version
-                                  ".tar.xz"))
-              (sha256
-               (base32
-                "12yqkr974y91ylgw6jnmci2v90i90s7h9vxa4zk0sai8vjnz4i1p"))
-              (patches (search-patches "guile-repl-server-test.patch"))))))
-
 (define-public guile-2.2
   (package (inherit guile-2.0)
     (name "guile")
@@ -458,7 +444,7 @@ more.")
                  "0592s2s8ampqmqwilc4fvcild6rb9gy79di6vxv5kcdmv23abkgx"))))
     (build-system gnu-build-system)
     (native-inputs `(("pkgconfig" ,pkg-config)
-                     ("gperf" ,gperf)))
+                     ("gperf" ,gperf-3.0)))
     (inputs `(("guile" ,guile-2.2)))
     (synopsis "Framework for building readers for GNU Guile")
     (description
@@ -1721,6 +1707,11 @@ is not available for Guile 2.0.")
        '(#:phases (modify-phases %standard-phases
                     (add-after 'unpack 'bootstrap
                       (lambda _
+                        ;; Install .go files to "site-ccache", not "ccache".
+                        (substitute* "Makefile.am"
+                          (("/ccache")
+                           "/site-ccache"))
+
                         (zero? (system* "autoreconf" "-vfi")))))))
       (native-inputs
        `(("autoconf" ,autoconf)

gnu/packages/hugs.scm

@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2013 Nikita Karetnikov <nikita@karetnikov.org>
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -21,7 +22,8 @@
   #:use-module (guix licenses)
   #:use-module (guix packages)
   #:use-module (guix download)
-  #:use-module (guix build-system gnu))
+  #:use-module (guix build-system gnu)
+  #:use-module (gnu packages gcc))
 
 (define-public hugs
   (package
@@ -68,6 +70,8 @@
                      (("/bin/cp") (which "cp"))))
                   %standard-phases)
        #:tests? #f)) ; no test target
+    ;; FIXME: Fails to build with GCC 5.
+    (native-inputs `(("gcc" ,gcc-4.9)))
     (home-page "https://www.haskell.org/hugs/")
     (synopsis "Functional programming system based on Haskell 98")
     (description

gnu/packages/icu4c.scm

@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2015, 2016 Mark H Weaver <mhw@netris.org>
+;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -28,20 +29,17 @@
 (define-public icu4c
   (package
    (name "icu4c")
-   (version "55.1")
+   (version "58.2")
    (source (origin
             (method url-fetch)
             (uri (string-append
-                  "mirror://sourceforge/icu/ICU4C/"
+                  "http://download.icu-project.org/files/icu4c/"
                   version
                   "/icu4c-"
                   (string-map (lambda (x) (if (char=? x #\.) #\_ x)) version)
                   "-src.tgz"))
             (sha256
-             (base32 "0ys5f5spizg45qlaa31j2lhgry0jka2gfha527n4ndfxxz5j4sz1"))
+             (base32 "036shcb3f8bm1lynhlsb4kpjm9s9c2vdiir01vg216rs2l8482ib"))))
-            (patches (search-patches "icu4c-CVE-2014-6585.patch"
-                                     "icu4c-CVE-2015-1270.patch"
-                                     "icu4c-CVE-2015-4760.patch"))))
    (build-system gnu-build-system)
    (inputs
     `(("perl" ,perl)))
@@ -55,18 +53,9 @@
               '("--with-data-packaging=archive")
               '()))
       #:phases
-      (alist-cons-after
+      (modify-phases %standard-phases
-       'unpack 'chdir-to-source
+        (add-after 'unpack 'chdir-to-source
-       (lambda _ (chdir "source"))
+          (lambda _ (chdir "source") #t)))))
-       (alist-cons-before
-        'configure 'patch-configure
-        (lambda _
-          ;; patch out two occurrences of /bin/sh from configure script
-          ;; that might have disappeared in a release later than 54.1
-          (substitute* "configure"
-            (("`/bin/sh")
-             (string-append "`" (which "bash")))))
-        %standard-phases))))
    (synopsis "International Components for Unicode")
    (description
     "ICU is a set of C/C++ and Java libraries providing Unicode and

gnu/packages/image.scm

@@ -66,19 +66,19 @@
 (define-public libpng
   (package
    (name "libpng")
-   (replacement libpng/fixed)
+   (version "1.6.28")
-   (version "1.6.25")
    (source (origin
             (method url-fetch)
-
-            ;; Note: upstream removes older tarballs.
             (uri (list (string-append "mirror://sourceforge/libpng/libpng16/"
                                       version "/libpng-" version ".tar.xz")
                        (string-append
                         "ftp://ftp.simplesystems.org/pub/libpng/png/src"
-                        "/libpng15/libpng-" version ".tar.xz")))
+                        "/libpng16/libpng-" version ".tar.xz")
+                       (string-append
+                        "ftp://ftp.simplesystems.org/pub/libpng/png/src/history"
+                        "/libpng16/libpng-" version ".tar.xz")))
             (sha256
-             (base32 "04c8inn745hw25wz2dc5vll5n5d2gsndj01i4srwzgz8861qvzh9"))))
+             (base32 "0ylgyx93hnk38haqrh8prd3ax5ngzwvjqw5cxw7p9nxmwsfyrlyq"))))
    (build-system gnu-build-system)
 
    ;; libpng.la says "-lz", so propagate it.
@@ -91,24 +91,12 @@ library.  It supports almost all PNG features and is extensible.")
    (license license:zlib)
    (home-page "http://www.libpng.org/pub/png/libpng.html")))
 
-(define libpng/fixed
-  (package
-    (inherit libpng)
-    (source
-      (origin
-        (inherit (package-source libpng))
-        (patches (search-patches "libpng-CVE-2016-10087.patch"))))))
-
 (define-public libpng-apng
   (package
     (inherit libpng)
     (replacement #f) ;libpng's replacement doesn't apply here
     (name "libpng-apng")
     (version (package-version libpng))
-    (source
-     (origin
-       (inherit (package-source libpng))
-       (patches (search-patches "libpng-CVE-2016-10087.patch"))))
     (arguments
      `(#:phases
        (modify-phases %standard-phases
@@ -152,16 +140,17 @@ APNG patch provides APNG support to libpng.")
 (define-public libpng-1.2
   (package
     (inherit libpng)
-    (replacement #f)
     (version "1.2.57")
     (source
      (origin
        (method url-fetch)
-       ;; Note: upstream removes older tarballs.
        (uri (list (string-append "mirror://sourceforge/libpng/libpng12/"
                                  version "/libpng-" version ".tar.xz")
                   (string-append
                    "ftp://ftp.simplesystems.org/pub/libpng/png/src"
+                   "/libpng12/libpng-" version ".tar.xz")
+                  (string-append
+                   "ftp://ftp.simplesystems.org/pub/libpng/png/src/history"
                    "/libpng12/libpng-" version ".tar.xz")))
        (sha256
         (base32 "1n2lrzjkm5jhfg2bs10q398lkwbbx742fi27zgdgx0x23zhj0ihg"))))))
@@ -310,12 +299,27 @@ extracting icontainer icon files.")
 (define-public libtiff
   (package
    (name "libtiff")
-   (replacement libtiff/fixed)
    (version "4.0.7")
    (source (origin
             (method url-fetch)
             (uri (string-append "ftp://download.osgeo.org/libtiff/tiff-"
                                 version ".tar.gz"))
+            (patches (search-patches "libtiff-heap-overflow-tiffcp.patch"
+                                     "libtiff-null-dereference.patch"
+                                     "libtiff-heap-overflow-tif-dirread.patch"
+                                     "libtiff-heap-overflow-pixarlog-luv.patch"
+                                     "libtiff-divide-by-zero.patch"
+                                     "libtiff-divide-by-zero-ojpeg.patch"
+                                     "libtiff-tiffcp-underflow.patch"
+                                     "libtiff-invalid-read.patch"
+                                     "libtiff-CVE-2016-10092.patch"
+                                     "libtiff-heap-overflow-tiffcrop.patch"
+                                     "libtiff-divide-by-zero-tiffcrop.patch"
+                                     "libtiff-CVE-2016-10093.patch"
+                                     "libtiff-divide-by-zero-tiffcp.patch"
+                                     "libtiff-assertion-failure.patch"
+                                     "libtiff-CVE-2016-10094.patch"
+                                     "libtiff-CVE-2017-5225.patch"))
             (sha256
              (base32
               "06ghqhr4db1ssq0acyyz49gr8k41gzw6pqb6mbn5r7jqp77s4hwz"))))
@@ -343,29 +347,6 @@ collection of tools for doing simple manipulations of TIFF images.")
                                   "See COPYRIGHT in the distribution."))
    (home-page "http://www.simplesystems.org/libtiff/")))
 
-(define libtiff/fixed
-  (package
-    (inherit libtiff)
-    (source
-      (origin
-        (inherit (package-source libtiff))
-        (patches (search-patches "libtiff-heap-overflow-tiffcp.patch"
-                                 "libtiff-null-dereference.patch"
-                                 "libtiff-heap-overflow-tif-dirread.patch"
-                                 "libtiff-heap-overflow-pixarlog-luv.patch"
-                                 "libtiff-divide-by-zero.patch"
-                                 "libtiff-divide-by-zero-ojpeg.patch"
-                                 "libtiff-tiffcp-underflow.patch"
-                                 "libtiff-invalid-read.patch"
-                                 "libtiff-CVE-2016-10092.patch"
-                                 "libtiff-heap-overflow-tiffcrop.patch"
-                                 "libtiff-divide-by-zero-tiffcrop.patch"
-                                 "libtiff-CVE-2016-10093.patch"
-                                 "libtiff-divide-by-zero-tiffcp.patch"
-                                 "libtiff-assertion-failure.patch"
-                                 "libtiff-CVE-2016-10094.patch"
-                                 "libtiff-CVE-2017-5225.patch"))))))
-
 (define-public libwmf
   (package
     (name "libwmf")
@@ -497,8 +478,7 @@ work.")
 (define-public openjpeg
   (package
     (name "openjpeg")
-    (replacement openjpeg-2.1.2)
+    (version "2.1.2")
-    (version "2.1.1")
     (source
       (origin
         (method url-fetch)
@@ -508,9 +488,9 @@ work.")
         (file-name (string-append name "-" version ".tar.gz"))
         (sha256
          (base32
-          "1anv0rjkbxw9kx91wvlfpb3dhppibda6kb1papny46bjzi3pzhl2"))
+          "19yz4g0c45sm8y1z01j9djsrl1mkz3pmw7fykc6hkvrqymp7prsc"))
-        (patches (search-patches "openjpeg-CVE-2016-5157.patch"
+        (patches (search-patches "openjpeg-CVE-2016-9850-CVE-2016-9851.patch"
-                                 "openjpeg-CVE-2016-7163.patch"))))
+                                 "openjpeg-CVE-2016-9572-CVE-2016-9573.patch"))))
     (build-system cmake-build-system)
     (arguments
       ;; Trying to run `$ make check' results in a no rule fault.
@@ -534,28 +514,9 @@ error-resilience, a Java-viewer for j2k-images, ...")
     (home-page "https://github.com/uclouvain/openjpeg")
     (license license:bsd-2)))
 
-(define openjpeg-2.1.2
-  (package
-    (inherit openjpeg)
-    (name "openjpeg")
-    (version "2.1.2")
-    (source
-      (origin
-        (method url-fetch)
-        (uri (string-append "https://github.com/uclouvain/openjpeg/archive/v"
-                            version ".tar.gz"))
-        (file-name (string-append name "-" version ".tar.gz"))
-        (sha256
-         (base32
-          "19yz4g0c45sm8y1z01j9djsrl1mkz3pmw7fykc6hkvrqymp7prsc"))
-        (patches
-          (search-patches "openjpeg-CVE-2016-9850-CVE-2016-9851.patch"
-                          "openjpeg-CVE-2016-9572-CVE-2016-9573.patch"))))))
-
 (define-public openjpeg-1
   (package (inherit openjpeg)
     (name "openjpeg")
-    (replacement #f)
     (version "1.5.2")
     (source
      (origin
@@ -718,7 +679,8 @@ supplies a generic doubly-linked list and some string functions.")
              (base32
               "12bz57asdcfsz3zr9i9nska0fb6h3z2aizy412qjqkixkginbz7v"))
             (patches (search-patches "freeimage-CVE-2015-0852.patch"
-                                     "freeimage-CVE-2016-5684.patch"))))
+                                     "freeimage-CVE-2016-5684.patch"
+                                     "freeimage-fix-build-with-gcc-5.patch"))))
    (build-system gnu-build-system)
    (arguments
     '(#:phases
@@ -898,44 +860,28 @@ and XMP metadata of images in various formats.")
 (define-public devil
   (package
     (name "devil")
-    (version "1.7.8")
+    (version "1.8.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "http://downloads.sourceforge.net/openil/"
                                   "DevIL-" version ".tar.gz"))
               (sha256
                (base32
-                "1zd850nn7nvkkhasrv7kn17kzgslr5ry933v6db62s4lr0zzlbv8"))
+                "02dpzvi493r09c9hfjnk54nladl3qw55iqkkg18g12fxwwz9fx80"))))
-              ;; Backported from upstream:
+    (build-system cmake-build-system)
-              ;; https://github.com/DentonW/DevIL/commit/724194d7a9a91221a564579f64bdd6f0abd64219.patch
-              (patches (search-patches "devil-fix-libpng.patch"
-                                       "devil-CVE-2009-3994.patch"))
-              (modules '((guix build utils)))
-              (snippet
-               ;; Fix old lcms include directives and lib flags.
-               '(substitute* '("configure" "src-IL/src/il_profiles.c")
-                  (("-llcms") "-llcms2")
-                  (("lcms/lcms\\.h") "lcms2/lcms2.h")
-                  (("lcms\\.h") "lcms2.h")))))
-    (build-system gnu-build-system)
     (arguments
-     '(#:configure-flags '("--enable-ILUT=yes") ; build utility library
+     '(;; XXX: Not supported in the released CMakeLists.txt.
+       ;; Enable this for > 1.8.0.
+       #:tests? #f
        #:phases
        (modify-phases %standard-phases
-         (add-before 'check 'fix-tests
+         (add-before 'configure 'change-directory
-           (lambda* (#:key inputs #:allow-other-keys)
+           (lambda _ (chdir "DevIL") #t)))))
-             ;; Fix hard-coded /bin/bash reference.
-             (substitute* '("test/Makefile")
-               (("TESTS_ENVIRONMENT = /bin/bash")
-                (string-append "TESTS_ENVIRONMENT = "
-                               (assoc-ref inputs "bash")
-                               "/bin/bash")))
-             #t)))))
     (native-inputs
      `(("pkg-config" ,pkg-config)))
     (inputs
      `(("lcms" ,lcms)
-       ("libjpeg" ,libjpeg)
+       ("libjpeg" ,libjpeg-turbo)
        ("libmng" ,libmng)
        ("libpng" ,libpng)
        ("libtiff" ,libtiff)

gnu/packages/kde-frameworks.scm

@@ -1167,11 +1167,7 @@ which are used in DBus communication.")
     (native-inputs
      `(("bison" ,bison)
        ("extra-cmake-modules" ,extra-cmake-modules)
-       ;; extra-cmake-modules forces C89 for all C files for compatibility with
+       ("flex" ,flex)
-       ;; Windows.  Flex 2.6.0 generates a lexer containing a single line
-       ;; comment.  Single line comments are part of the C99 standard, so the
-       ;; lexer won't compile if C89 is used.
-       ("flex" ,flex-2.6.1)
        ("qttools" ,qttools)))
     (inputs
      `(("qtbase" ,qtbase)
@@ -2599,11 +2595,7 @@ typed.")
     (native-inputs
      `(("bison" ,bison)
        ("extra-cmake-modules" ,extra-cmake-modules)
-       ;; extra-cmake-modules forces C89 for all C files for compatibility with
+       ("flex" ,flex)))
-       ;; Windows.  Flex 2.6.0 generates a lexer containing a single line
-       ;; comment.  Single line comments are part of the C99 standard, so the
-       ;; lexer won't compile if C89 is used.
-       ("flex" ,flex-2.6.1)))
     (inputs
      `(("kcrash" ,kcrash)
        ("kdbusaddons" ,kdbusaddons)

gnu/packages/kerberos.scm

@@ -42,7 +42,7 @@
 (define-public mit-krb5
   (package
     (name "mit-krb5")
-    (version "1.14.3")
+    (version "1.14.4")
     (source (origin
               (method url-fetch)
               (uri (string-append "http://web.mit.edu/kerberos/dist/krb5/"
@@ -50,7 +50,7 @@
                                   "/krb5-" version ".tar.gz"))
               (sha256
                (base32
-                "1jgjiyh1sp72lkxvk437lz5hzcibvw99jc4ihzfz03fg43aj0ind"))))
+                "158bgq9xcg5ljgzia1880ak7m9g6vf2r009rzdqif5n9h111m9h3"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("bison" ,bison)
@@ -78,7 +78,7 @@
              (let ((perl (assoc-ref inputs "perl")))
                (substitute* "plugins/kdb/db2/libdb2/test/run.test"
                  (("/bin/cat") (string-append perl "/bin/perl"))
-                 (("D/bin/sh") (string-append "D" (which "bash")))
+                 (("D/bin/sh") (string-append "D" (which "sh")))
                  (("bindir=/bin/.") (string-append "bindir=" perl "/bin"))))
 
              ;; avoid service names since /etc/services is unavailable

gnu/packages/libevent.scm

@@ -84,9 +84,9 @@ loop.")
               (patches
                (search-patches
                 "libevent-dns-tests.patch"
-                "libevent-2.0-evdns-fix-remote-stack-overread.patch"
+                "libevent-2.0-CVE-2016-10195.patch"
-                "libevent-2.0-evutil-fix-buffer-overflow.patch"
+                "libevent-2.0-CVE-2016-10196.patch"
-                "libevent-2.0-evdns-fix-searching-empty-hostnames.patch"
+                "libevent-2.0-CVE-2016-10197.patch"
                 "libevent-2.0-evbuffer-add-use-last-with-datap.patch"))))))
 
 (define-public libev

gnu/packages/libffcall.scm

@@ -47,4 +47,5 @@
      "GNU Libffcall is a collection of libraries that can be used to build
 foreign function call interfaces in embedded interpreters.")
     (home-page "https://www.gnu.org/software/libffcall/")
+    (supported-systems (delete "aarch64-linux" %supported-systems))
     (license l:gpl2+)))

gnu/packages/libidn.scm

@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2012 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -60,9 +61,34 @@ Java libraries.")
               (sha256
                (base32
                 "13v8kh4d5nfkymai88zlw3h7k4x9khrpdpv97waf4ah8ykzrxb9g"))))
+    ;; XXX: Make sure to remove the 'create-pkg-config' phase
+    ;; below when this package is updated to >= 0.17.
     (inputs
      `(("libunistring" ,libunistring)))
     (build-system gnu-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-after 'install 'create-pkgconfig-file
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (pkgconfig (string-append out "/lib/pkgconfig")))
+               (mkdir-p pkgconfig)
+               (call-with-output-file (string-append pkgconfig "/libidn2.pc")
+                 (lambda (port)
+                   (format port "prefix=~a
+exec_prefix=${prefix}
+libdir=${exec_prefix}/lib
+includedir=${prefix}/include
+
+Name: Libidn2
+Description: Library implementing IDNA2008 and TR46
+Version: ~a
+Libs: -L${libdir} -lidn2
+Cflags: -I${includedir}
+"
+                           out ,version)))
+               #t))))))
     (synopsis "Internationalized domain name library for IDNA2008")
     (description "Libidn2 is an internationalized domain library implementing
 the IDNA2008 specifications.   Libidn2 is believed to be a complete IDNA2008

gnu/packages/libreoffice.scm

@@ -3,6 +3,7 @@
 ;;; Copyright © 2015 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017 Alex Griffin <a@ajgrf.com>
+;;; Copyright © 2017 Thomas Danckaert <post@thomasdanckaert.be>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -70,20 +71,20 @@
 (define-public ixion
   (package
     (name "ixion")
-    (version "0.9.1")
+    (version "0.12.2")
     (source
      (origin
       (method url-fetch)
       (uri (string-append "http://kohei.us/files/ixion/src/libixion-"
                           version ".tar.xz"))
       (sha256 (base32
-               "18g3nk29ljiqbyi0ml49j2x3f3xrqckdm9i66sw5fxnj7hb5rqvp"))))
+               "1bnsqbxpbijwbg42rrqq6mz06wvcxjpl0gjdzwyilkmv6s400i4b"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)))
      (inputs
       `(("mdds" ,mdds)
-        ("python" ,python-2))) ; looks for python.pc, not python3.pc
+        ("python" ,python)))
     (home-page "https://gitlab.com/ixion/ixion")
     (synopsis "General purpose formula parser and interpreter")
     (description "Ixion is a library for calculating the results of formula
@@ -95,20 +96,21 @@ their dependencies automatically upon calculation.")
 (define-public orcus
   (package
     (name "orcus")
-    (version "0.9.2")
+    (version "0.12.1")
     (source
      (origin
       (method url-fetch)
       (uri (string-append "http://kohei.us/files/" name "/src/lib"
                           name "-" version ".tar.xz"))
       (sha256 (base32
-               "170racjz7s7yxza722hxsqc12788w57qnp6x6j2692pzp3qzjjfx"))))
+               "171bmqa9hkk4xygz20qda5900rs4kq9fgl424ldkxlj4d733dffi"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)))
      (inputs
       `(("ixion" ,ixion)
         ("mdds" ,mdds)
+        ("python" ,python)
         ("zlib" ,zlib)))
     (home-page "https://gitlab.com/orcus/orcus")
     (synopsis "File import filter library for spreadsheet documents")
@@ -243,15 +245,15 @@ working with graphics in the WPG (WordPerfect Graphics) format.")
 (define-public libcmis
   (package
     (name "libcmis")
-    (version "0.5.0")
+    (version "0.5.1")
     (source
      (origin
       (method url-fetch)
-      (uri (string-append "mirror://sourceforge/" name "/" name "-"
+      (uri (string-append "https://github.com/tdf/libcmis/releases/download/v"
-                          version ".tar.gz"))
+                          version "/libcmis-" version ".tar.gz"))
-      (sha256 (base32
+      (sha256
-               "1dprvk4fibylv24l7gr49gfqbkfgmxynvgssvdcycgpf7n8h4zm8"))
+       (base32
-      (patches (search-patches "libcmis-fix-test-onedrive.patch"))))
+        "03kvl8ywsv5qrxblf0m6955mmvl5q2zpb6vj51vs7ayvxhidzjva"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("cppunit" ,cppunit)
@@ -276,7 +278,7 @@ working with graphics in the WPG (WordPerfect Graphics) format.")
           ;; fails without the following flag.
           (string-append "--with-boost="
                          (assoc-ref %build-inputs "boost")))))
-    (home-page "https://sourceforge.net/projects/libcmis/")
+    (home-page "https://github.com/tdf/libcmis")
     (synopsis "CMIS client library")
     (description "LibCMIS is a C++ client library for the CMIS interface.  It
 allows C++ applications to connect to any ECM behaving as a CMIS server such
@@ -348,22 +350,31 @@ CorelDRAW documents of all versions.")
 (define-public libetonyek
   (package
     (name "libetonyek")
-    (version "0.1.3")
+    (version "0.1.6")
     (source
      (origin
       (method url-fetch)
       (uri (string-append "http://dev-www.libreoffice.org/src/" name "/"
                           name "-" version ".tar.xz"))
       (sha256 (base32
-               "0mghaqzj0qqza8z1gzprw62702adlww4kgdzynj5qpxxc9m2f4py"))))
+               "0y60vi1plyq69fqbcjnc0v8mvcjqjsl1ry6rmb3bq3q7j8a2fm6z"))
+      (patches (search-patches "libetonyek-build-with-mdds-1.2.patch"))))
     (build-system gnu-build-system)
+    (arguments
+     `(#:configure-flags '("--with-mdds=1.2")
+       #:phases (modify-phases %standard-phases
+                  (add-before 'configure 'autoreconf
+                              (lambda _ (system* "autoreconf"))))))
     (native-inputs
      `(("cppunit" ,cppunit)
        ("doxygen" ,doxygen)
        ("glm" ,glm)
        ("gperf" ,gperf)
+       ("liblangtag" ,liblangtag)
        ("mdds" ,mdds)
-       ("pkg-config" ,pkg-config)))
+       ("pkg-config" ,pkg-config)
+       ("autoconf" ,autoconf) ; due to patch
+       ("automake" ,automake)))
     (propagated-inputs ; in Requires or Requires.private field of .pkg
      `(("librevenge" ,librevenge)
        ("libxml2" ,libxml2)))
@@ -600,6 +611,29 @@ text documents (MacWrite, ClarisWorks, ... ) and for some graphics and
 spreadsheet documents.")
     (license (list mpl2.0 lgpl2.1+)))) ; dual license
 
+(define-public libstaroffice
+  (package
+    (name "libstaroffice")
+    (version "0.0.3")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/fosnola/libstaroffice/releases/download/"
+                           version "/libstaroffice-" version ".tar.xz"))
+       (sha256 (base32
+                "1ii2wi3wr5npyz9gby1bjk8r4wyflpfpc6gx7mmqkhsc9c8frpmy"))))
+    (build-system gnu-build-system)
+    (inputs
+     `(("librevenge" ,librevenge)
+       ("zlib" ,zlib)))
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
+    (home-page "https://github.com/fosnola/libstaroffice")
+    (synopsis "Provides LibreOffice support for old StarOffice documents")
+    (description "@code{libstaroffice} is an import filter for the document formats
+from the old StarOffice (.sdc, .sdw, ...).")
+    (license (list mpl2.0 lgpl2.1+)))) ; dual license
+
 (define-public libwps
   (package
     (name "libwps")
@@ -629,6 +663,35 @@ spreadsheet documents.")
 Works word processor file format.")
     (license (list mpl2.0 lgpl2.1+)))) ; dual license
 
+(define-public libzmf
+  (package
+   (name "libzmf")
+   (version "0.0.1")
+   (source
+    (origin
+      (method url-fetch)
+      (uri (string-append "http://dev-www.libreoffice.org/src/libzmf/libzmf-"
+                          version ".tar.xz"))
+      (sha256 (base32
+               "0yp5l1b90xim506zmr3ljkn3qkvbc7qk3dnwq1snxdpr57m37xga"))))
+   (build-system gnu-build-system)
+   (inputs
+    `(("boost" ,boost)
+      ("icu4c" ,icu4c)
+      ("libpng" ,libpng)
+      ("librevenge" ,librevenge)
+      ("zlib" ,zlib)))
+    (native-inputs
+     `(("cppunit" ,cppunit)
+       ("doxygen" ,doxygen)
+       ("pkg-config" ,pkg-config)))
+    (home-page "https://wiki.documentfoundation.org/DLP/Libraries/libzmf")
+    (synopsis "Parses file format of Zoner Callisto/Draw documents")
+    (description "Libzmf is a library that parses the file format of Zoner
+Callisto/Draw documents.  Currently it only understands documents created by
+Zoner Draw version 4 and 5.")
+    (license mpl2.0)))
+
 (define-public hunspell
   (package
     (name "hunspell")
@@ -707,14 +770,14 @@ and to return information on pronunciations, meanings and synonyms.")
     (uri
       (string-append
        "http://dev-www.libreoffice.org/src/"
-        "1f24ab1d39f4a51faf22244c94a6203f-xmlsec1-1.2.14.tar.gz"))
+       "86b1daaa438f5a7bea9a52d7b9799ac0-xmlsec1-1.2.23.tar.gz"))
     (sha256 (base32
-              "0jnxxygg6z5zi6za94dvxmg1bfar1wh8p5xa2bzbha0qcn2m02ir"))))
+             "17qfw5crkqn4v6xbkjxrjvcccfc00dy053892wrwv54qdk8n7m21"))))
 
 (define-public libreoffice
   (package
     (name "libreoffice")
-    (version "5.1.6.2")
+    (version "5.3.1.2")
     (source
      (origin
       (method url-fetch)
@@ -723,7 +786,7 @@ and to return information on pronunciations, meanings and synonyms.")
           "http://download.documentfoundation.org/libreoffice/src/"
           (version-prefix version 3) "/libreoffice-" version ".tar.xz"))
       (sha256 (base32
-               "150xb76pc3889gfy4jrnq8sidymm1aihkm5pzy8b1fdy51zip804"))))
+               "1zsl0z0i8pw532x2lmwd64ms6igibkkjhwf01zmm2kpnr9ycsijp"))))
     (build-system gnu-build-system)
     (native-inputs
      `(;; autoreconf is run by the LibreOffice build system, since after
@@ -766,6 +829,7 @@ and to return information on pronunciations, meanings and synonyms.")
        ("libmwaw" ,libmwaw)
        ("libodfgen" ,libodfgen)
        ("libpagemaker" ,libpagemaker)
+       ("libstaroffice" ,libstaroffice)
        ("libvisio" ,libvisio)
        ("libwpg" ,libwpg)
        ("libwps" ,libwps)
@@ -773,6 +837,7 @@ and to return information on pronunciations, meanings and synonyms.")
        ("libxrender" ,libxrender)
        ("libxslt" ,libxslt)
        ("libxt" ,libxt)
+       ("libzmf" ,libzmf)
        ("lpsolve" ,lpsolve)
        ("mdds" ,mdds)
        ("mythes" ,mythes)
@@ -805,15 +870,14 @@ and to return information on pronunciations, meanings and synonyms.")
                  (substitute*
                    (list "sysui/CustomTarget_share.mk"
                          "solenv/gbuild/gbuild.mk"
-                         "solenv/gbuild/platform/unxgcc.mk"
+                         "solenv/gbuild/platform/unxgcc.mk")
-                         "external/libxmlsec/xmlsec1-oldlibtool.patch")
                    (("/bin/sh") (which "bash")))
                  (mkdir "external/tarballs")
                  (symlink
                    xmlsec
                    (string-append "external/tarballs/"
-                     "1f24ab1d39f4a51faf22244c94a6203f-"
+                                  "86b1daaa438f5a7bea9a52d7b9799ac0-"
-                     "xmlsec1-1.2.14.tar.gz"))
+                                  "xmlsec1-1.2.23.tar.gz"))
                  ;; The following is required for building xmlsec from the
                  ;; unpatched external tarball; since "configure" starts with
                  ;; "/bin/sh", it needs to be executed by a command invoking

gnu/packages/libunistring.scm

@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2012, 2013, 2014 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2015 Mark H Weaver <mhw@netris.org>
+;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Jan Nieuwenhuizen <janneke@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -28,15 +29,15 @@
 (define-public libunistring
   (package
    (name "libunistring")
-   (version "0.9.6")
+   (version "0.9.7")
    (source (origin
             (method url-fetch)
             (uri (string-append
                   "mirror://gnu/libunistring/libunistring-"
-                  version ".tar.gz"))
+                  version ".tar.xz"))
             (sha256
              (base32
-              "0ixxmgpgh2v8ifm6hbwsjxl023myk3dfnj7wnvmqjivza31fw9cn"))))
+              "15z76qrmrvkc3c6hfq2lzzqysgd21s682f2smycfab5g598n8drf"))))
    (propagated-inputs (libiconv-if-needed))
    (build-system gnu-build-system)
    (arguments
@@ -50,4 +51,4 @@
 Unicode strings and for manipulating C strings according to the Unicode
 standard.")
    (home-page "https://www.gnu.org/software/libunistring/")
-   (license lgpl3+)))
+   (license (list lgpl3+ gpl2))))

gnu/packages/linux.scm

@@ -5,7 +5,7 @@
 ;;; Copyright © 2014, 2015, 2016, 2017 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2015 Federico Beffa <beffa@fbengineering.ch>
 ;;; Copyright © 2015 Taylan Ulrich Bayırlı/Kammer <taylanbayirli@gmail.com>
-;;; Copyright © 2015, 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2015, 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Christopher Allan Webber <cwebber@dustycloud.org>
 ;;; Copyright © 2016, 2017 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2016, 2017 Alex Kost <alezost@gmail.com>
@@ -17,6 +17,7 @@
 ;;; Copyright © 2016 John Darrington <jmd@gnu.org>
 ;;; Copyright © 2016, 2017 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2016 Rene Saavedra <rennes@openmailbox.org>
+;;; Copyright © 2016 Carlos Sánchez de La Lama <csanchezdll@gmail.com>
 ;;; Copyright © 2016 ng0 <ng0@libertad.pw>
 ;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2017 José Miguel Sánchez García <jmi2k@openmailbox.com>
@@ -113,6 +114,13 @@
           ((string-prefix? "alpha" arch) "alpha")
           (else arch))))
 
+(define-public (system->defconfig system)
+  "Some systems (notably powerpc-linux) require a special target for kernel
+defconfig.  Return the appropiate make target if applicable, otherwise return
+\"defconfig\"."
+  (cond ((string-prefix? "powerpc-" system) "pmac32_defconfig")
+        (else "defconfig")))
+
 (define (linux-libre-urls version)
   "Return a list of URLs for Linux-Libre VERSION."
   (list (string-append
@@ -132,13 +140,13 @@
 (define-public linux-libre-headers
   (package
     (name "linux-libre-headers")
-    (version "4.4.18")
+    (version "4.4.47")
     (source (origin
              (method url-fetch)
              (uri (linux-libre-urls version))
              (sha256
               (base32
-               "0k8k17in7dkjd9d8zg3i8l1ax466dba6bxw28flxizzyq8znljps"))))
+               "00zdq7swhvzbbnnhzizq6m34q5k4fycpcp215bmkbxh1ic76v7bs"))))
     (build-system gnu-build-system)
     (native-inputs `(("perl" ,perl)))
     (arguments
@@ -151,12 +159,14 @@
          (replace 'build
            (lambda _
              (let ((arch ,(system->linux-architecture
+                          (or (%current-target-system)
+                              (%current-system))))
+                   (defconfig ,(system->defconfig
                                 (or (%current-target-system)
                                     (%current-system)))))
                (setenv "ARCH" arch)
                (format #t "`ARCH' set to `~a'~%" (getenv "ARCH"))
-
+               (and (zero? (system* "make" defconfig))
-               (and (zero? (system* "make" "defconfig"))
                     (zero? (system* "make" "mrproper" "headers_check"))))))
          (replace 'install
            (lambda* (#:key outputs #:allow-other-keys)
@@ -479,8 +489,7 @@ providing the system administrator with some help in common tasks.")
 (define-public util-linux
   (package
     (name "util-linux")
-    (replacement util-linux/fixed)
+    (version "2.29.2")
-    (version "2.28.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://kernel.org/linux/utils/"
@@ -488,7 +497,7 @@ providing the system administrator with some help in common tasks.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "03xnaw3c7pavxvvh1vnimcr44hlhhf25whawiyv8dxsflfj4xkiy"))
+                "1qz81w8vzrmy8xn9yx7ls4amkbgwx6vr62pl6kv9g7r0g3ba9kmc"))
               (patches (search-patches "util-linux-tests.patch"))
               (modules '((guix build utils)))
               (snippet
@@ -504,7 +513,7 @@ providing the system administrator with some help in common tasks.")
                "static"))      ; >2 MiB of static .a libraries
     (arguments
      `(#:configure-flags (list "--disable-use-tty-group"
-
+                               "--enable-fs-paths-default=/run/current-system/profile/sbin"
                                ;; Install completions where our
                                ;; bash-completion package expects them.
                                (string-append "--with-bashcompletiondir="
@@ -560,17 +569,6 @@ block devices, UUIDs, TTYs, and many other tools.")
     (license (list license:gpl3+ license:gpl2+ license:gpl2 license:lgpl2.0+
                    license:bsd-4 license:public-domain))))
 
-(define util-linux/fixed
-  (package
-    (inherit util-linux)
-    (source
-      (origin
-        (inherit (package-source util-linux))
-        (patches
-          (append
-            (origin-patches (package-source util-linux))
-            (search-patches "util-linux-CVE-2017-2616.patch")))))))
-
 (define-public procps
   (package
     (name "procps")
@@ -889,7 +887,7 @@ intercept and print the system calls executed by the program.")
 (define-public alsa-lib
   (package
     (name "alsa-lib")
-    (version "1.0.27.1")
+    (version "1.1.3")
     (source (origin
              (method url-fetch)
              (uri (string-append
@@ -897,10 +895,9 @@ intercept and print the system calls executed by the program.")
                    version ".tar.bz2"))
              (sha256
               (base32
-               "0fx057746dj7rjdi0jnvx2m9b0y1lgdkh1hks87d8w32xyihf3k9"))
+               "174n2psp0328xcy2f1ayls67598bxli6q9cf00d2qnac3012aa3i"))))
-             (patches (search-patches "alsa-lib-mips-atomic-fix.patch"))))
     (build-system gnu-build-system)
-    (home-page "http://www.alsa-project.org/")
+    (home-page "https://www.alsa-project.org/")
     (synopsis "The Advanced Linux Sound Architecture libraries")
     (description
      "The Advanced Linux Sound Architecture (ALSA) provides audio and
@@ -1211,7 +1208,7 @@ advanced aspects of IP configuration (iptunnel, ipmaddr).")
 (define-public libcap
   (package
     (name "libcap")
-    (version "2.24")
+    (version "2.25")
     (source (origin
              (method url-fetch)
              (uri (string-append
@@ -1219,7 +1216,7 @@ advanced aspects of IP configuration (iptunnel, ipmaddr).")
                    "libcap2/libcap-" version ".tar.xz"))
              (sha256
               (base32
-               "0rbc9qbqs5bp9am9s9g83wxj5k4ixps2agy9dxr1v1fwg27mdr6f"))))
+               "0qjiqc5pknaal57453nxcbz3mn1r4hkyywam41wfcglq3v2qlg39"))))
     (build-system gnu-build-system)
     (arguments '(#:phases
                  (modify-phases %standard-phases
@@ -1713,7 +1710,7 @@ to use Linux' inotify mechanism, which allows file accesses to be monitored.")
 (define-public kmod
   (package
     (name "kmod")
-    (version "23")
+    (version "24")
     (source (origin
               (method url-fetch)
               (uri
@@ -1721,7 +1718,7 @@ to use Linux' inotify mechanism, which allows file accesses to be monitored.")
                               "kmod-" version ".tar.xz"))
               (sha256
                (base32
-                "0mc12sx06p8il1ym3hdmgxxb37apn9yv7xij26gddjdfkx8xa0yk"))
+                "15xkkkzvca9flvkm48gkh8y8f13vlm3sl7nz9ydc7b3jy4fqs2v1"))
               (patches (search-patches "kmod-module-directory.patch"))))
     (build-system gnu-build-system)
     (native-inputs
@@ -1758,7 +1755,7 @@ from the module-init-tools project.")
   ;; The post-systemd fork, maintained by Gentoo.
   (package
     (name "eudev")
-    (version "3.2")
+    (version "3.2.1")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -1766,8 +1763,9 @@ from the module-init-tools project.")
                     version ".tar.gz"))
               (sha256
                (base32
-                "099w62ncq78nxpxizf910mx18hc8x4qvzw3azjd00fir89wmyjnq"))
+                "06gyyl90n85x8i7lfhns514y1kg1ians13l467admyzy3kjxkqsp"))
-              (patches (search-patches "eudev-rules-directory.patch"))))
+              (patches (search-patches "eudev-rules-directory.patch"
+                                       "eudev-conflicting-declaration.patch"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)
@@ -2713,7 +2711,7 @@ Bluetooth audio output devices like headphones or loudspeakers.")
 (define-public bluez
   (package
     (name "bluez")
-    (version "5.43")
+    (version "5.44")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -2721,7 +2719,7 @@ Bluetooth audio output devices like headphones or loudspeakers.")
                     version ".tar.xz"))
               (sha256
                (base32
-                "05cdnpz0w2lwq2x5ba87q1h2wgb4lfnpbnbh6p7499hx59fw1j8n"))))
+                "11bc6pndivd0rkqr3c8a1xd9ar9bb60gx79piskycicb3wliwchc"))))
     (build-system gnu-build-system)
     (arguments
      '(#:configure-flags

gnu/packages/lua.scm

@@ -3,7 +3,7 @@
 ;;; Copyright © 2014 Raimon Grau <raimonster@gmail.com>
 ;;; Copyright © 2014 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2014 Andreas Enge <andreas@enge.fr>
-;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2016 doncatnip <gnopap@gmail.com>
 ;;; Copyright © 2016 Clément Lassieur <clement@lassieur.org>
@@ -112,13 +112,13 @@ for configuration, scripting, and rapid prototyping.")
 (define-public luajit
   (package
     (name "luajit")
-    (version "2.0.4")
+    (version "2.1.0-beta2")
     (source (origin
               (method url-fetch)
               (uri (string-append "http://luajit.org/download/LuaJIT-"
                                   version ".tar.gz"))
               (sha256
-               (base32 "0zc0y7p6nx1c0pp4nhgbdgjljpfxsb5kgwp4ysz22l1p2bms83v2"))
+               (base32 "0iyghj1xjlmd9ywa4flf9yszynf3jhbp0yqb9b49k7ab0g528fbi"))
               (patches (search-patches "luajit-symlinks.patch"
                                        "luajit-no_ldconfig.patch"))))
     (build-system gnu-build-system)

gnu/packages/m4.scm

@@ -26,14 +26,14 @@
 (define-public m4
   (package
    (name "m4")
-   (version "1.4.17")
+   (version "1.4.18")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/m4/m4-"
-                                version ".tar.bz2"))
+                                version ".tar.xz"))
             (sha256
              (base32
-              "0w0da1chh12mczxa5lnwzjk9czi3dq6gnnndbpa6w4rj76b1yklf"))))
+              "01sfjd5a4waqw83bibvmn522g69qfqvwig9i2qlgy154l1nfihgj"))))
    (build-system gnu-build-system)
    (arguments
     `(;; Explicitly disable tests when cross-compiling, otherwise 'make check'
@@ -50,7 +50,7 @@
                     (substitute* (find-files "tests"
                                              "posix_spawn")
                       (("/bin/sh")
-                       (format #f "~a/bin/bash" bash)))))
+                       (format #f "~a/bin/sh" bash)))))
                 %standard-phases)))
    (synopsis "Macro processor")
    (description

gnu/packages/mail.scm

@@ -1461,8 +1461,14 @@ format and headers.")
     (source
      (origin
        (method url-fetch)
-       (uri (string-append "http://www.stafford.uklinux.net/libesmtp/libesmtp-"
+       (uri (list (string-append "https://pkgs.fedoraproject.org/repo/pkgs/"
-                           version ".tar.bz2"))
+                                 "libesmtp/libesmtp-" version ".tar.bz2/"
+                                 "bf3915e627fd8f35524a8fdfeed979c8/libesmtp-"
+                                 version ".tar.bz2")
+                  ;; XXX This site is offline, so we fetch Fedora's cached copy
+                  ;; of the source tarball.
+                  (string-append "http://www.stafford.uklinux.net/libesmtp/libesmtp-"
+                                 version ".tar.bz2")))
        (sha256
         (base32
          "02zbniyz7qys1jmx3ghx21kxmns1wc3hmv80gp7ag7yra9f1m9nh"))))

gnu/packages/make-bootstrap.scm

@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2012, 2013, 2014, 2015, 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -206,7 +207,17 @@ for `sh' in $PATH, and without nscd, and with static NSS modules."
                ("patch" ,patch)
                ("coreutils" ,coreutils)
                ("sed" ,sed)
-               ("grep" ,grep)
+               ;; We don't want to retain a reference to /gnu/store in the
+               ;; bootstrap versions of egrep/fgrep, so we remove the custom
+               ;; phase added since grep@2.25. The effect is 'egrep' and
+               ;; 'fgrep' look for 'grep' in $PATH.
+               ("grep" ,(package
+                          (inherit grep)
+                          (arguments
+                            (substitute-keyword-arguments (package-arguments grep)
+                              ((#:phases phases)
+                               `(modify-phases ,phases
+                                  (delete 'fix-egrep-and-fgrep)))))))
                ("gawk" ,gawk)))
       ("bash" ,static-bash))))
 
@@ -416,8 +427,9 @@ for `sh' in $PATH, and without nscd, and with static NSS modules."
                  ;; the 'pre-configure phase of our main gcc package, because
                  ;; that shared library is not present in this static gcc.  See
                  ;; <https://lists.gnu.org/archive/html/guix-devel/2015-01/msg00008.html>.
-                 (substitute* (find-files "gcc/config"
+                 (substitute* (cons "gcc/config/rs6000/sysv4.h"
-                                          "^gnu-user.*\\.h$")
+                                    (find-files "gcc/config"
+                                                "^gnu-user.*\\.h$"))
                    ((" -lgcc_s}}") "}}")))
                ,phases)))))
      (native-inputs

gnu/packages/maths.scm

@@ -8,7 +8,7 @@
 ;;; Copyright © 2015, 2016 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2015 Sou Bunnbu <iyzsong@gmail.com>
 ;;; Copyright © 2015 Mark H Weaver <mhw@netris.org>
-;;; Copyright © 2015, 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2015, 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2015 Fabian Harfert <fhmgufs@web.de>
 ;;; Copyright © 2016 Roel Janssen <roel@gnu.org>
 ;;; Copyright © 2016 Kei Kebreau <kei@openmailbox.org>
@@ -270,7 +270,13 @@ semiconductors.")
               (patches (search-patches "gsl-test-i686.patch"))))
     (build-system gnu-build-system)
     (arguments
-     `(#:parallel-tests? #f))
+     `(#:parallel-tests? #f
+       ;; Currently there are numerous tests that fail on "exotic"
+       ;; architectures such as aarch64 and ppc64le.
+       ,@(if (string-prefix? "aarch64-linux"
+                             (or (%current-target-system) (%current-system)))
+           '(#:tests? #f)
+           '())))
     (home-page "https://www.gnu.org/software/gsl/")
     (synopsis "Numerical library for C and C++")
     (description
@@ -1801,7 +1807,7 @@ implemented in ANSI C, and MPI for communications.")
     (build-system gnu-build-system)
     (inputs
      `(("zlib" ,zlib)
-       ("flex" ,flex)
+       ("flex" ,flex-2.6.1) ; A bug in flex prevents building with flex-2.6.3.
        ("bison" ,bison)))
     (arguments
      `(#:phases
@@ -2245,7 +2251,8 @@ parts of it.")
         ,(let ((system (or (%current-target-system) (%current-system))))
            (or (string-prefix? "x86_64" system)
                (string-prefix? "i686" system)
-               (string-prefix? "mips" system)))
+               (string-prefix? "mips" system)
+               (string-prefix? "aarch64" system)))
        #:make-flags
        (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
              "SHELL=bash"
@@ -2265,6 +2272,9 @@ parts of it.")
                   ;; for Loongson cores are used.
                   ((string-prefix? "mips" system)
                    '("TARGET=SICORTEX"))
+                  ;; On aarch64 force the generic 'armv8-a' target
+                  ((string-prefix? "aarch64" system)
+                   '("TARGET=ARMV8"))
                   (else '()))))
        ;; no configure script
        #:phases (alist-delete 'configure %standard-phases)))

gnu/packages/multiprecision.scm

@@ -32,7 +32,7 @@
 (define-public gmp
   (package
    (name "gmp")
-   (version "6.1.1")
+   (version "6.1.2")
    (source (origin
             (method url-fetch)
             (uri
@@ -40,7 +40,7 @@
                             version ".tar.xz"))
             (sha256
              (base32
-              "0cg84n482gcvl0s4xq4wgwsk4r0x0m8dnzpizwqdd2j8vw2rqvnk"))
+              "04hrwahdxyqdik559604r7wrj9ffklwvipgfxgj4ys4skbl6bdc7"))
             (patches (search-patches "gmp-faulty-test.patch"))))
    (build-system gnu-build-system)
    (native-inputs `(("m4" ,m4)))
@@ -87,13 +87,13 @@ cryptography and computational algebra.")
 (define-public mpfr
   (package
    (name "mpfr")
-   (version "3.1.4")
+   (version "3.1.5")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/mpfr/mpfr-" version
                                 ".tar.xz"))
             (sha256 (base32
-                     "1x8pcnpn1vxfzfsr0js07rwhwyq27fmdzcfjpzi5773ldnqi653n"))))
+                     "1g32l2fg8f62lcyzzh88y3fsh6rk539qc6ahhdgvx7wpnf1dwpq1"))))
    (build-system gnu-build-system)
    (outputs '("out" "debug"))
    (propagated-inputs `(("gmp" ,gmp)))            ; <mpfr.h> refers to <gmp.h>

gnu/packages/music.scm

@@ -906,6 +906,7 @@ add_library( rapidjson INTERFACE IMPORTED )"))
            (lambda* (#:key inputs #:allow-other-keys)
              ;; Link with required static libraries, because we're not
              ;; using the bundled version of withershins.
+             ;; Also add pthread for fixing a linker error.
              (substitute* "source/build/CMakeLists.txt"
                (("withershins" line)
                 (string-append line "\n"
@@ -914,6 +915,7 @@ add_library( rapidjson INTERFACE IMPORTED )"))
                                (assoc-ref inputs "libiberty")
                                "/lib/libiberty.a\n"
                                "dl\n"
+                               "pthread\n"
                                "z\n")))
              #t)))))
     (inputs
@@ -1239,6 +1241,13 @@ mixing, FFT scopes, MIDI automation and full scriptability in Scheme.")
                (substitute* "bristol/Makefile.in"
                  (("-msse -mfpmath=sse") "")))
              #t))
+         ;; alsa-lib 1.1.x no longer provides iatomic.h.  That's okay because
+         ;; bristol actually doesn't use it.
+         (add-after 'unpack 'do-not-use-alsa-iatomic
+           (lambda _
+             (substitute* "libbristolaudio/audioEngineJack.c"
+               (("#include <alsa/iatomic.h>") ""))
+             #t))
          ;; We know that Bristol has been linked with JACK and we don't have
          ;; ldd, so we can just skip this check.
          (add-after 'unpack 'do-not-grep-for-jack

gnu/packages/ncurses.scm

@@ -30,6 +30,7 @@
   #:use-module (guix build-system perl)
   #:use-module (gnu packages)
   #:use-module (gnu packages perl)
+  #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages swig)
   #:use-module (guix utils))
 
@@ -87,7 +88,7 @@
                (let ((out (assoc-ref outputs "out")))
                  ;; When building a wide-character (Unicode) build, create backward
                  ;; compatibility links from the the "normal" libraries to the
-                 ;; wide-character libraries (e.g. libncurses.so to libncursesw.so).
+                 ;; wide-character ones (e.g. libncurses.so to libncursesw.so).
                  ,@(if (target-mingw?)
                        '( ;; TODO: create .la files to link to the .dll?
                          (with-directory-excursion (string-append out "/bin")
@@ -116,7 +117,11 @@
                                        (define lib.so.x
                                          (string-append "lib" lib ".so.6"))
                                        (define lib.so
-                                         (string-append "lib" lib ".so")))
+                                         (string-append "lib" lib ".so"))
+                                       (define packagew.pc
+                                         (string-append lib "w.pc"))
+                                       (define package.pc
+                                         (string-append lib ".pc")))
                                      '())
 
                                (when (file-exists? libw.a)
@@ -127,7 +132,12 @@
                                          (false-if-exception (delete-file lib.so))
                                          (call-with-output-file lib.so
                                            (lambda (p)
-                                             (format p "INPUT (-l~aw)~%" lib))))
+                                             (format p "INPUT (-l~aw)~%" lib)))
+                                         (with-directory-excursion "pkgconfig"
+                                           (format #t "creating symlink for `~a'~%"
+                                                   package.pc)
+                                           (when (file-exists? packagew.pc)
+                                             (symlink packagew.pc package.pc))))
                                        '())))
                              '("curses" "ncurses" "form" "panel" "menu")))))))
        `(#:configure-flags
@@ -135,6 +145,11 @@
            'quasiquote
            `(("--with-shared" "--without-debug" "--enable-widec"
               
+              "--enable-pc-files"
+              ,(list 'unquote '(string-append "--with-pkg-config-libdir="
+                                              (assoc-ref %outputs "out")
+                                              "/lib/pkgconfig"))
+
               ;; By default headers land in an `ncursesw' subdir, which is not
               ;; what users expect.
               ,(list 'unquote '(string-append "--includedir=" (assoc-ref %outputs "out")
@@ -157,6 +172,8 @@
                     (add-after 'unpack 'remove-unneeded-shebang
                       ,remove-shebang-phase)))))
     (self-native-input? #t)           ; for `tic'
+     (native-inputs
+      `(("pkg-config" ,pkg-config)))
     (native-search-paths
      (list (search-path-specification
             (variable "TERMINFO_DIRS")

gnu/packages/nettle.scm

@@ -47,7 +47,7 @@
     (outputs '("out" "debug"))
     (native-inputs `(("m4" ,m4)))
     (propagated-inputs `(("gmp" ,gmp)))
-    (home-page "http://www.lysator.liu.se/~nisse/nettle/")
+    (home-page "https://www.lysator.liu.se/~nisse/nettle/")
     (synopsis "C library for low-level cryptographic functionality")
     (description
      "GNU Nettle is a low-level cryptographic library.  It is designed to
@@ -60,14 +60,14 @@ themselves.")
   ;; This version is not API-compatible with version 2.  In particular, lsh
   ;; cannot use it yet.  So keep it separate.
   (package (inherit nettle-2)
-    (version "3.2")
+    (version "3.3")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnu/nettle/nettle-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "15wxhk52yc62rx0pddmry66hqm6z5brrrkx4npd3wh9nybg86hpa"))))
+                "07mif3af077763vc35s1x8vzhzlgqcgxh67c1xr13jnhslkjd526"))))
     (arguments
      (substitute-keyword-arguments (package-arguments nettle-2)
        ((#:configure-flags flags)

gnu/packages/package-management.scm

@@ -56,13 +56,18 @@
 
 (define (boot-guile-uri arch)
   "Return the URI for the bootstrap Guile tarball for ARCH."
-  (if (string=? "armhf" arch)
+  (cond ((string=? "armhf" arch)
          (string-append "http://alpha.gnu.org/gnu/guix/bootstrap/"
                         arch "-linux"
-                     "/20150101/guile-2.0.11.tar.xz")
+                        "/20150101/guile-2.0.11.tar.xz"))
+        ((string=? "aarch64" arch)
+         (let ((suffix "/bootstrap/aarch64-linux/20170217/guile-2.0.14.tar.xz"))
+           (list (string-append "http://alpha.gnu.org/gnu/guix" suffix)
+                 (string-append "http://flashner.co.il/guix" suffix))))
+        (else
          (string-append "http://alpha.gnu.org/gnu/guix/bootstrap/"
                         arch "-linux"
-                     "/20131110/guile-2.0.9.tar.xz")))
+                        "/20131110/guile-2.0.9.tar.xz"))))
 
 (define-public guix-0.12.0
   (package
@@ -92,9 +97,9 @@
                    'configure 'copy-bootstrap-guile
                    (lambda* (#:key system inputs #:allow-other-keys)
                      (define (boot-guile-version arch)
-                       (if (string=? "armhf" arch)
+                       (cond ((string=? "armhf" arch)   "2.0.11")
-                           "2.0.11"
+                             ((string=? "aarch64" arch) "2.0.14")
-                           "2.0.9"))
+                             (else "2.0.9")))
 
                      (define (copy arch)
                        (let ((guile  (assoc-ref inputs
@@ -105,12 +110,14 @@
                                                     "/guile-"
                                                     (boot-guile-version arch)
                                                     ".tar.xz")))
+                         (mkdir-p (dirname target)) ;XXX: eventually unneeded
                          (copy-file guile target)))
 
                      (copy "i686")
                      (copy "x86_64")
                      (copy "mips64el")
                      (copy "armhf")
+                     (copy "aarch64")
                      #t))
                   (add-after
                    'unpack 'disable-container-tests
@@ -192,7 +199,11 @@
          ("boot-guile/armhf"
           ,(boot-guile "armhf"
                        (base32
-                        "1mi3brl7l58aww34rawhvja84xc7l1b4hmwdmc36fp9q9mfx0lg5"))))))
+                        "1mi3brl7l58aww34rawhvja84xc7l1b4hmwdmc36fp9q9mfx0lg5")))
+         ("boot-guile/aarch64"
+          ,(boot-guile "aarch64"
+                       (base32
+                        "1giy2aprjmn5fp9c4s9r125fljw4wv6ixy5739i5bffw4jgr0f9r"))))))
     (propagated-inputs
      `(("gnutls" ,gnutls)                         ;for 'guix download' & co.
        ("guile-json" ,guile-json)

gnu/packages/patches/alsa-lib-mips-atomic-fix.patch

@@ -1,42 +0,0 @@
-Fix the declarations of inlined atomic ops for mips.
-
-This patch was copied from Debian.
-
---- alsa-lib/include/iatomic.h.orig	2013-05-21 04:48:28.000000000 -0400
-+++ alsa-lib/include/iatomic.h	2013-10-29 13:01:37.055995968 -0400
-@@ -720,7 +720,7 @@
-  * Atomically adds @i to @v.  Note that the guaranteed useful range
-  * of an atomic_t is only 24 bits.
-  */
--extern __inline__ void atomic_add(int i, atomic_t * v)
-+static __inline__ void atomic_add(int i, atomic_t * v)
- {
- 	unsigned long temp;
- 
-@@ -744,7 +744,7 @@
-  * Atomically subtracts @i from @v.  Note that the guaranteed
-  * useful range of an atomic_t is only 24 bits.
-  */
--extern __inline__ void atomic_sub(int i, atomic_t * v)
-+static __inline__ void atomic_sub(int i, atomic_t * v)
- {
- 	unsigned long temp;
- 
-@@ -763,7 +763,7 @@
- /*
-  * Same as above, but return the result value
-  */
--extern __inline__ int atomic_add_return(int i, atomic_t * v)
-+static __inline__ int atomic_add_return(int i, atomic_t * v)
- {
- 	unsigned long temp, result;
- 
-@@ -784,7 +784,7 @@
- 	return result;
- }
- 
--extern __inline__ int atomic_sub_return(int i, atomic_t * v)
-+static __inline__ int atomic_sub_return(int i, atomic_t * v)
- {
- 	unsigned long temp, result;
- 

gnu/packages/patches/coreutils-cut-huge-range-test.patch

@@ -0,0 +1,22 @@
+This patch fixes 100% reproducible test failures on arm-linux-gnueabihf in our
+the build environment chroot, as reported at <https://bugs.gnu.org/26253>.
+It is a followup to this upstream patch:
+
+   commit 28803c8a3144d5d4363cdbd148bbe067af1a67c2
+   Author: Pádraig Brady <P@draigBrady.com>
+   Date:   Fri Mar 3 00:25:54 2017 -0800
+
+       tests: avoid a spurious failure on older debian
+
+... which appeared to be insufficient.
+
+--- a/tests/misc/cut-huge-range.sh
++++ b/tests/misc/cut-huge-range.sh
+@@ -22,6 +22,7 @@ getlimits_
+ 
+ vm=$(get_min_ulimit_v_ cut -b1 /dev/null) \
+   || skip_ "this shell lacks ulimit support"
++vm=$(($vm + $(getconf PAGESIZE))) # avoid spurious failures
+ 
+ # sed script to subtract one from the input.
+ # Each input line should consist of a positive decimal number.

gnu/packages/patches/coreutils-fix-cross-compilation.patch

@@ -0,0 +1,15 @@
+Coreutils fails to cross compile for other platforms because cu_install_program
+is not being evaluated properly. This patch fixes it.
+See <https://lists.gnu.org/archive/html/coreutils/2017-01/msg00039.html>
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -5023,7 +5023,7 @@ pr = progs-readme
+ @CROSS_COMPILING_FALSE@cu_install_program = src/ginstall
+ 
+ # Use the just-built 'ginstall', when not cross-compiling.
+-@CROSS_COMPILING_TRUE@cu_install_program = @INSTALL_PROGRAM@
++@CROSS_COMPILING_TRUE@cu_install_program := @INSTALL@
+ info_TEXINFOS = doc/coreutils.texi
+ doc_coreutils_TEXINFOS = \
+   doc/perm.texi \
+

gnu/packages/patches/devil-CVE-2009-3994.patch

@@ -1,24 +0,0 @@
-Fix CVE-2009-3994 (buffer overflow in GetUID() allows remote DOS or
-arbitrary code execution via crafted DICOM file).
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3994
-
-Copied from Fedora
-https://pkgs.fedoraproject.org/cgit/rpms/DevIL.git/tree/DevIL-1.7.8-CVE-2009-3994.patch?id=9c656a75393d6c455aef9f4968fbbee9c53f4fdb
-
-diff -up devil-1.7.8/src-IL/src/il_dicom.c~ devil-1.7.8/src-IL/src/il_dicom.c
---- devil-1.7.8/src-IL/src/il_dicom.c~	2009-03-08 08:10:09.000000000 +0100
-+++ devil-1.7.8/src-IL/src/il_dicom.c	2009-12-03 12:07:45.000000000 +0100
-@@ -427,9 +427,11 @@ ILboolean GetUID(ILubyte *UID)
- 		return IL_FALSE;
- 
- 	ValLen = GetLittleUShort();
-+	if (ValLen > 64)
-+		return IL_FALSE;
- 	if (iread(UID, ValLen, 1) != 1)
- 		return IL_FALSE;
--	UID[64] = 0;  // Just to make sure that our string is terminated.
-+	UID[ValLen] = 0;  // Just to make sure that our string is terminated.
- 
- 	return IL_TRUE;
- }

gnu/packages/patches/devil-fix-libpng.patch

@@ -1,36 +0,0 @@
-From 724194d7a9a91221a564579f64bdd6f0abd64219 Mon Sep 17 00:00:00 2001
-From: Noah Mayr <max96at@gmail.com>
-Date: Sun, 1 Mar 2015 10:10:56 +0100
-Subject: [PATCH] Fixed deprecated libpng API usage.
-
----
- src-IL/src/il_icon.c | 2 +-
- src-IL/src/il_png.c  | 4 ++--
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/src-IL/src/il_icon.c b/src-IL/src/il_icon.c
-index 2ccb1a3..fd9475d 100644
---- a/src-IL/src/il_icon.c
-+++ b/src-IL/src/il_icon.c
-@@ -525,7 +525,7 @@ ILboolean ico_readpng_get_image(ICOIMAGE *Icon, ILdouble display_exponent)
-
- 	// Expand low-bit-depth grayscale images to 8 bits
- 	if (ico_color_type == PNG_COLOR_TYPE_GRAY && bit_depth < 8) {
--		png_set_gray_1_2_4_to_8(ico_png_ptr);
-+		png_set_expand_gray_1_2_4_to_8(ico_png_ptr);
- 	}
-
- 	// Expand RGB images with transparency to full alpha channels
-diff --git a/src-IL/src/il_png.c b/src-IL/src/il_png.c
-index da9517d..2866508 100644
---- a/src-IL/src/il_png.c
-+++ b/src-IL/src/il_png.c
-@@ -277,7 +277,7 @@ ILboolean readpng_get_image(ILdouble display_exponent)
-
- 	// Expand low-bit-depth grayscale images to 8 bits
- 	if (png_color_type == PNG_COLOR_TYPE_GRAY && bit_depth < 8) {
--		png_set_gray_1_2_4_to_8(png_ptr);
-+		png_set_expand_gray_1_2_4_to_8(png_ptr);
- 	}
-
- 	// Expand RGB images with transparency to full alpha channels

gnu/packages/patches/eudev-conflicting-declaration.patch

@@ -0,0 +1,31 @@
+Fix build failure due to conflicting declaration of
+keyboard_lookup_key() in gperf-3.1:
+
+https://bugs.gentoo.org/show_bug.cgi?id=604864
+
+Patch copied from upstream source repository:
+
+https://github.com/gentoo/eudev/commit/5bab4d8de0dcbb8e2e7d4d5125b4aea1652a0d60
+
+From 5bab4d8de0dcbb8e2e7d4d5125b4aea1652a0d60 Mon Sep 17 00:00:00 2001
+From: "Anthony G. Basile" <blueness@gentoo.org>
+Date: Thu, 5 Jan 2017 16:21:17 -0500
+Subject: [PATCH] src/udev/udev-builtin-keyboard.c: fix build with gperf 3.1
+
+Signed-off-by: Anthony G. Basile <blueness@gentoo.org>
+---
+ src/udev/udev-builtin-keyboard.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/src/udev/udev-builtin-keyboard.c b/src/udev/udev-builtin-keyboard.c
+index 73171c3..fad3520 100644
+--- a/src/udev/udev-builtin-keyboard.c
++++ b/src/udev/udev-builtin-keyboard.c
+@@ -28,7 +28,6 @@
+ 
+ #include "udev.h"
+ 
+-static const struct key *keyboard_lookup_key(const char *str, unsigned len);
+ #include "keyboard-keys-from-name.h"
+ #include "keyboard-keys-to-name.h"
+ 

gnu/packages/patches/flex-CVE-2016-6354.patch

@@ -1,30 +0,0 @@
-Fix CVE-2016-6354 (Buffer overflow in generated code (yy_get_next_buffer).
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6354
-https://security-tracker.debian.org/tracker/CVE-2016-6354
-
-Patch copied from upstream source repository:
-https://github.com/westes/flex/commit/a5cbe929ac3255d371e698f62dc256afe7006466
-
-From a5cbe929ac3255d371e698f62dc256afe7006466 Mon Sep 17 00:00:00 2001
-From: Will Estes <westes575@gmail.com>
-Date: Sat, 27 Feb 2016 11:56:05 -0500
-Subject: [PATCH] Fixed incorrect integer type
-
----
- src/flex.skl | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/flex.skl b/src/flex.skl
-index 36a526a..64f853d 100644
---- a/src/flex.skl
-+++ b/src/flex.skl
-@@ -1703,7 +1703,7 @@ int yyFlexLexer::yy_get_next_buffer()
- 
- 	else
- 		{
--			yy_size_t num_to_read =
-+			int num_to_read =
- 			YY_CURRENT_BUFFER_LVALUE->yy_buf_size - number_to_move - 1;
- 
- 		while ( num_to_read <= 0 )

gnu/packages/patches/fontconfig-charwidth-symbol-conflict.patch

@@ -0,0 +1,82 @@
+The first patch is copied from the upstream source repository:
+
+https://cgit.freedesktop.org/fontconfig/commit/?id=1ab5258f7c2abfafcd63a760ca08bf93591912da
+
+The second patch is adapted from a message to from the OpenEmbedded mailing list:
+
+http://lists.openembedded.org/pipermail/openembedded-core/2016-December/130213.html
+
+From 1ab5258f7c2abfafcd63a760ca08bf93591912da Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Wed, 14 Dec 2016 16:11:05 -0800
+Subject: Avoid conflicts with integer width macros from TS 18661-1:2014
+
+glibc 2.25+ has now defined these macros in <limits.h>
+https://sourceware.org/git/?p=glibc.git;a=commit;h=5b17fd0da62bf923cb61d1bb7b08cf2e1f1f9c1a
+
+Create an alias for FC_CHAR_WIDTH for ABI compatibility
+
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+
+diff --git a/fontconfig/fontconfig.h b/fontconfig/fontconfig.h
+index 5c72b22..070a557 100644
+--- a/fontconfig/fontconfig.h
++++ b/fontconfig/fontconfig.h
+@@ -128,7 +128,8 @@ typedef int		FcBool;
+ #define FC_USER_CACHE_FILE	    ".fonts.cache-" FC_CACHE_VERSION
+ 
+ /* Adjust outline rasterizer */
+-#define FC_CHAR_WIDTH	    "charwidth"	/* Int */
++#define FC_CHARWIDTH	    "charwidth"	/* Int */
++#define FC_CHAR_WIDTH	    FC_CHARWIDTH
+ #define FC_CHAR_HEIGHT	    "charheight"/* Int */
+ #define FC_MATRIX	    "matrix"    /* FcMatrix */
+ 
+diff --git a/src/fcobjs.h b/src/fcobjs.h
+index 1fc4f65..d27864b 100644
+--- a/src/fcobjs.h
++++ b/src/fcobjs.h
+@@ -51,7 +51,7 @@ FC_OBJECT (DPI,			FcTypeDouble,	NULL)
+ FC_OBJECT (RGBA,		FcTypeInteger,	NULL)
+ FC_OBJECT (SCALE,		FcTypeDouble,	NULL)
+ FC_OBJECT (MINSPACE,		FcTypeBool,	NULL)
+-FC_OBJECT (CHAR_WIDTH,		FcTypeInteger,	NULL)
++FC_OBJECT (CHARWIDTH,		FcTypeInteger,	NULL)
+ FC_OBJECT (CHAR_HEIGHT,		FcTypeInteger,	NULL)
+ FC_OBJECT (MATRIX,		FcTypeMatrix,	NULL)
+ FC_OBJECT (CHARSET,		FcTypeCharSet,	FcCompareCharSet)
+-- 
+cgit v0.10.2
+
+From 20cddc824c6501c2082cac41b162c34cd5fcc530 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem at gmail.com>
+Date: Sun, 11 Dec 2016 14:32:00 -0800
+Subject: [PATCH] Avoid conflicts with integer width macros from TS
+ 18661-1:2014
+
+glibc 2.25+ has now defined these macros in <limits.h>
+https://sourceware.org/git/?p=glibc.git;a=commit;h=5b17fd0da62bf923cb61d1bb7b08cf2e1f1f9c1a
+
+Signed-off-by: Khem Raj <raj.khem at gmail.com>
+---
+Upstream-Status: Submitted
+
+ fontconfig/fontconfig.h | 2 +-
+ src/fcobjs.h            | 2 +-
+ src/fcobjshash.gperf    | 2 +-
+ src/fcobjshash.h        | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+Index: fontconfig-2.12.1/src/fcobjshash.h
+===================================================================
+--- fontconfig-2.12.1.orig/src/fcobjshash.h
++++ fontconfig-2.12.1/src/fcobjshash.h
+@@ -284,7 +284,7 @@ FcObjectTypeLookup (register const char
+       {(int)(long)&((struct FcObjectTypeNamePool_t *)0)->FcObjectTypeNamePool_str43,FC_CHARSET_OBJECT},
+       {-1},
+ #line 47 "fcobjshash.gperf"
+-      {(int)(long)&((struct FcObjectTypeNamePool_t *)0)->FcObjectTypeNamePool_str45,FC_CHAR_WIDTH_OBJECT},
++      {(int)(long)&((struct FcObjectTypeNamePool_t *)0)->FcObjectTypeNamePool_str45,FC_CHARWIDTH_OBJECT},
+ #line 48 "fcobjshash.gperf"
+       {(int)(long)&((struct FcObjectTypeNamePool_t *)0)->FcObjectTypeNamePool_str46,FC_CHAR_HEIGHT_OBJECT},
+ #line 55 "fcobjshash.gperf"

gnu/packages/patches/fontconfig-path-max.patch

@@ -0,0 +1,124 @@
+This patch fix the build on GNU/Hurd, due to PATH_MAX isn't defined.
+
+The patch was adapted from upstream source repository:
+'<https://cgit.freedesktop.org/fontconfig/commit/?id=abdb6d658e1a16410dd1c964e365a3ebd5039e7c>'
+Commit: abdb6d658e1a16410dd1c964e365a3ebd5039e7c
+
+---
+ src/fcdefault.c | 34 +++++++++++++++++++++++++++-------
+ src/fcint.h     |  6 ++++++
+ src/fcstat.c    | 12 +++++++++++-
+ 3 files changed, 44 insertions(+), 8 deletions(-)
+
+diff --git a/src/fcdefault.c b/src/fcdefault.c
+index 6647a8f..5afd7ec 100644
+--- a/src/fcdefault.c
++++ b/src/fcdefault.c
+@@ -148,17 +148,34 @@ retry:
+ 	    prgname = FcStrdup ("");
+ #else
+ # if defined (HAVE_GETEXECNAME)
+-	const char *p = getexecname ();
++	char *p = FcStrdup(getexecname ());
+ # elif defined (HAVE_READLINK)
+-	char buf[PATH_MAX + 1];
+-	int len;
++	size_t size = FC_PATH_MAX;
+ 	char *p = NULL;
+ 
+-	len = readlink ("/proc/self/exe", buf, sizeof (buf) - 1);
+-	if (len != -1)
++	while (1)
+ 	{
+-	    buf[len] = '\0';
+-	    p = buf;
++	    char *buf = malloc (size);
++	    ssize_t len;
++
++	    if (!buf)
++		break;
++
++	    len = readlink ("/proc/self/exe", buf, size - 1);
++	    if (len < 0)
++	    {
++		free (buf);
++		break;
++	    }
++	    if (len < size - 1)
++	    {
++		buf[len] = 0;
++		p = buf;
++		break;
++	    }
++
++	    free (buf);
++	    size *= 2;
+ 	}
+ # else
+ 	char *p = NULL;
+@@ -176,6 +193,9 @@ retry:
+ 
+ 	if (!prgname)
+ 	    prgname = FcStrdup ("");
++
++	if (p)
++	    free (p);
+ #endif
+ 
+ 	if (!fc_atomic_ptr_cmpexch (&default_prgname, NULL, prgname)) {
+diff --git a/src/fcint.h b/src/fcint.h
+index ac911ad..dad34c5 100644
+--- a/src/fcint.h
++++ b/src/fcint.h
+@@ -70,6 +70,12 @@ extern pfnSHGetFolderPathA pSHGetFolderPathA;
+ #  define FC_DIR_SEPARATOR_S       "/"
+ #endif
+ 
++#ifdef PATH_MAX
++#define FC_PATH_MAX	PATH_MAX
++#else
++#define FC_PATH_MAX	128
++#endif
++
+ #if __GNUC__ >= 4
+ #define FC_UNUSED	__attribute__((unused))
+ #else
+diff --git a/src/fcstat.c b/src/fcstat.c
+index 1734fa4..f6e1aaa 100644
+--- a/src/fcstat.c
++++ b/src/fcstat.c
+@@ -278,8 +278,13 @@ FcDirChecksum (const FcChar8 *dir, time_t *checksum)
+ 	{
+ #endif
+ 	struct stat statb;
+-	char f[PATH_MAX + 1];
++	char *f = malloc (len + 1 + dlen + 1);
+ 
++	if (!f)
++	{
++	    ret = -1;
++	    goto bail;
++	}
+ 	memcpy (f, dir, len);
+ 	f[len] = FC_DIR_SEPARATOR;
+ 	memcpy (&f[len + 1], files[n]->d_name, dlen);
+@@ -287,11 +292,16 @@ FcDirChecksum (const FcChar8 *dir, time_t *checksum)
+ 	if (lstat (f, &statb) < 0)
+ 	{
+ 	    ret = -1;
++	    free (f);
+ 	    goto bail;
+ 	}
+ 	if (S_ISDIR (statb.st_mode))
++	{
++	    free (f);
+ 	    goto bail;
++	}
+ 
++	free (f);
+ 	dtype = statb.st_mode;
+ #ifdef HAVE_STRUCT_DIRENT_D_TYPE
+ 	}
+-- 
+2.11.0
+

gnu/packages/patches/gcc-5-source-date-epoch-1.patch

@@ -0,0 +1,190 @@
+Make GCC respect SOURCE_DATE_EPOCH in __DATE__ and __TIME__ macros.
+
+Patch adapted from upstream source repository:
+
+https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=e3e8c48c4a494d9da741c1c8ea6c4c0b7c4ff934
+
+From e3e8c48c4a494d9da741c1c8ea6c4c0b7c4ff934 Mon Sep 17 00:00:00 2001
+From: doko <doko@138bc75d-0d04-0410-961f-82ee72b054a4>
+Date: Thu, 28 Apr 2016 09:12:05 +0000
+Subject: [PATCH] gcc/c-family/ChangeLog:
+
+diff --git a/gcc/c-family/c-common.c b/gcc/c-family/c-common.c
+index 1bf5d080034..6f0898a38d7 100644
+--- a/gcc/c-family/c-common.c
++++ b/gcc/c-family/c-common.c
+@@ -12318,4 +12318,37 @@ pointer_to_zero_sized_aggr_p (tree t)
+   return (TYPE_SIZE (t) && integer_zerop (TYPE_SIZE (t)));
+ }
+ 
++/* Read SOURCE_DATE_EPOCH from environment to have a deterministic
++   timestamp to replace embedded current dates to get reproducible
++   results.  Returns -1 if SOURCE_DATE_EPOCH is not defined.  */
++time_t
++get_source_date_epoch ()
++{
++  char *source_date_epoch;
++  long long epoch;
++  char *endptr;
++
++  source_date_epoch = getenv ("SOURCE_DATE_EPOCH");
++  if (!source_date_epoch)
++    return (time_t) -1;
++
++  errno = 0;
++  epoch = strtoll (source_date_epoch, &endptr, 10);
++  if ((errno == ERANGE && (epoch == LLONG_MAX || epoch == LLONG_MIN))
++      || (errno != 0 && epoch == 0))
++    fatal_error (UNKNOWN_LOCATION, "environment variable $SOURCE_DATE_EPOCH: "
++		 "strtoll: %s\n", xstrerror(errno));
++  if (endptr == source_date_epoch)
++    fatal_error (UNKNOWN_LOCATION, "environment variable $SOURCE_DATE_EPOCH: "
++		 "no digits were found: %s\n", endptr);
++  if (*endptr != '\0')
++    fatal_error (UNKNOWN_LOCATION, "environment variable $SOURCE_DATE_EPOCH: "
++		 "trailing garbage: %s\n", endptr);
++  if (epoch < 0)
++    fatal_error (UNKNOWN_LOCATION, "environment variable $SOURCE_DATE_EPOCH: "
++		 "value must be nonnegative: %lld \n", epoch);
++
++  return (time_t) epoch;
++}
++
+ #include "gt-c-family-c-common.h"
+diff --git a/gcc/c-family/c-common.h b/gcc/c-family/c-common.h
+index fdb227f85c3..ba0a5d7df50 100644
+--- a/gcc/c-family/c-common.h
++++ b/gcc/c-family/c-common.h
+@@ -1437,4 +1437,10 @@ extern bool contains_cilk_spawn_stmt (tree);
+ extern tree cilk_for_number_of_iterations (tree);
+ extern bool check_no_cilk (tree, const char *, const char *,
+ 		           location_t loc = UNKNOWN_LOCATION);
++
++/* Read SOURCE_DATE_EPOCH from environment to have a deterministic
++   timestamp to replace embedded current dates to get reproducible
++   results.  Returns -1 if SOURCE_DATE_EPOCH is not defined.  */
++extern time_t get_source_date_epoch (void);
++
+ #endif /* ! GCC_C_COMMON_H */
+diff --git a/gcc/c-family/c-lex.c b/gcc/c-family/c-lex.c
+index bb55be8063e..e68471b9d2b 100644
+--- a/gcc/c-family/c-lex.c
++++ b/gcc/c-family/c-lex.c
+@@ -402,6 +402,9 @@ c_lex_with_flags (tree *value, location_t *loc, unsigned char *cpp_flags,
+   enum cpp_ttype type;
+   unsigned char add_flags = 0;
+   enum overflow_type overflow = OT_NONE;
++  time_t source_date_epoch = get_source_date_epoch ();
++
++  cpp_init_source_date_epoch (parse_in, source_date_epoch);
+ 
+   timevar_push (TV_CPP);
+  retry:
+diff --git a/gcc/doc/cppenv.texi b/gcc/doc/cppenv.texi
+index 100811dc637..3b5317beb53 100644
+--- a/gcc/doc/cppenv.texi
++++ b/gcc/doc/cppenv.texi
+@@ -79,4 +79,21 @@ main input file is omitted.
+ @ifclear cppmanual
+ @xref{Preprocessor Options}.
+ @end ifclear
++
++@item SOURCE_DATE_EPOCH
++
++If this variable is set, its value specifies a UNIX timestamp to be
++used in replacement of the current date and time in the @code{__DATE__}
++and @code{__TIME__} macros, so that the embedded timestamps become
++reproducible.
++
++The value of @env{SOURCE_DATE_EPOCH} must be a UNIX timestamp,
++defined as the number of seconds (excluding leap seconds) since
++01 Jan 1970 00:00:00 represented in ASCII, identical to the output of
++@samp{@command{date +%s}}.
++
++The value should be a known timestamp such as the last modification
++time of the source or package and it should be set by the build
++process.
++
+ @end vtable
+diff --git a/libcpp/include/cpplib.h b/libcpp/include/cpplib.h
+index 1b731d1a3ad..7a5481219be 100644
+--- a/libcpp/include/cpplib.h
++++ b/libcpp/include/cpplib.h
+@@ -775,6 +775,9 @@ extern void cpp_init_special_builtins (cpp_reader *);
+ /* Set up built-ins like __FILE__.  */
+ extern void cpp_init_builtins (cpp_reader *, int);
+ 
++/* Initialize the source_date_epoch value.  */
++extern void cpp_init_source_date_epoch (cpp_reader *, time_t);
++
+ /* This is called after options have been parsed, and partially
+    processed.  */
+ extern void cpp_post_options (cpp_reader *);
+diff --git a/libcpp/init.c b/libcpp/init.c
+index 45a4d13ffa3..a8d00f4628b 100644
+--- a/libcpp/init.c
++++ b/libcpp/init.c
+@@ -530,6 +530,13 @@ cpp_init_builtins (cpp_reader *pfile, int hosted)
+     _cpp_define_builtin (pfile, "__OBJC__ 1");
+ }
+ 
++/* Initialize the source_date_epoch value.  */
++void
++cpp_init_source_date_epoch (cpp_reader *pfile, time_t source_date_epoch)
++{
++  pfile->source_date_epoch = source_date_epoch; 
++}
++
+ /* Sanity-checks are dependent on command-line options, so it is
+    called as a subroutine of cpp_read_main_file ().  */
+ #if ENABLE_CHECKING
+diff --git a/libcpp/internal.h b/libcpp/internal.h
+index c2d08168945..8507eba1747 100644
+--- a/libcpp/internal.h
++++ b/libcpp/internal.h
+@@ -502,6 +502,10 @@ struct cpp_reader
+   const unsigned char *date;
+   const unsigned char *time;
+ 
++  /* Externally set timestamp to replace current date and time useful for
++     reproducibility.  */
++  time_t source_date_epoch;
++
+   /* EOF token, and a token forcing paste avoidance.  */
+   cpp_token avoid_paste;
+   cpp_token eof;
+diff --git a/libcpp/macro.c b/libcpp/macro.c
+index eb32a6f8c98..3f3b278e97d 100644
+--- a/libcpp/macro.c
++++ b/libcpp/macro.c
+@@ -350,13 +350,20 @@ _cpp_builtin_macro_text (cpp_reader *pfile, cpp_hashnode *node)
+ 	  time_t tt;
+ 	  struct tm *tb = NULL;
+ 
+-	  /* (time_t) -1 is a legitimate value for "number of seconds
+-	     since the Epoch", so we have to do a little dance to
+-	     distinguish that from a genuine error.  */
+-	  errno = 0;
+-	  tt = time(NULL);
+-	  if (tt != (time_t)-1 || errno == 0)
+-	    tb = localtime (&tt);
++	  /* Set a reproducible timestamp for __DATE__ and __TIME__ macro
++	     usage if SOURCE_DATE_EPOCH is defined.  */
++	  if (pfile->source_date_epoch != (time_t) -1)
++	     tb = gmtime (&pfile->source_date_epoch);
++	  else
++	    {
++	      /* (time_t) -1 is a legitimate value for "number of seconds
++		 since the Epoch", so we have to do a little dance to
++		 distinguish that from a genuine error.  */
++	      errno = 0;
++	      tt = time (NULL);
++	      if (tt != (time_t)-1 || errno == 0)
++		tb = localtime (&tt);
++	    }
+ 
+ 	  if (tb)
+ 	    {
+-- 
+2.11.0
+

gnu/packages/patches/gcc-5-source-date-epoch-2.patch

@@ -0,0 +1,353 @@
+Continuation of the SOURCE_DATE_EPOCH patch.
+
+Patch adapted from upstream source repository:
+
+https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=dfa5c0d3f3e23e4fdb14857a42de376d9ff8601c
+
+From dfa5c0d3f3e23e4fdb14857a42de376d9ff8601c Mon Sep 17 00:00:00 2001
+From: doko <doko@138bc75d-0d04-0410-961f-82ee72b054a4>
+Date: Wed, 1 Jun 2016 16:42:41 +0000
+Subject: [PATCH] gcc/c-family/ChangeLog:
+
+diff --git a/gcc/c-family/c-common.c b/gcc/c-family/c-common.c
+index 6f0898a38d7..efbc78ef218 100644
+--- a/gcc/c-family/c-common.c
++++ b/gcc/c-family/c-common.c
+@@ -12321,8 +12321,9 @@ pointer_to_zero_sized_aggr_p (tree t)
+ /* Read SOURCE_DATE_EPOCH from environment to have a deterministic
+    timestamp to replace embedded current dates to get reproducible
+    results.  Returns -1 if SOURCE_DATE_EPOCH is not defined.  */
++
+ time_t
+-get_source_date_epoch ()
++cb_get_source_date_epoch (cpp_reader *pfile ATTRIBUTE_UNUSED)
+ {
+   char *source_date_epoch;
+   long long epoch;
+@@ -12334,19 +12335,14 @@ get_source_date_epoch ()
+ 
+   errno = 0;
+   epoch = strtoll (source_date_epoch, &endptr, 10);
+-  if ((errno == ERANGE && (epoch == LLONG_MAX || epoch == LLONG_MIN))
+-      || (errno != 0 && epoch == 0))
+-    fatal_error (UNKNOWN_LOCATION, "environment variable $SOURCE_DATE_EPOCH: "
+-		 "strtoll: %s\n", xstrerror(errno));
+-  if (endptr == source_date_epoch)
+-    fatal_error (UNKNOWN_LOCATION, "environment variable $SOURCE_DATE_EPOCH: "
+-		 "no digits were found: %s\n", endptr);
+-  if (*endptr != '\0')
+-    fatal_error (UNKNOWN_LOCATION, "environment variable $SOURCE_DATE_EPOCH: "
+-		 "trailing garbage: %s\n", endptr);
+-  if (epoch < 0)
+-    fatal_error (UNKNOWN_LOCATION, "environment variable $SOURCE_DATE_EPOCH: "
+-		 "value must be nonnegative: %lld \n", epoch);
++  if (errno != 0 || endptr == source_date_epoch || *endptr != '\0'
++      || epoch < 0 || epoch > MAX_SOURCE_DATE_EPOCH)
++    {
++      error_at (input_location, "environment variable SOURCE_DATE_EPOCH must "
++	        "expand to a non-negative integer less than or equal to %wd",
++		MAX_SOURCE_DATE_EPOCH);
++      return (time_t) -1;
++    }
+ 
+   return (time_t) epoch;
+ }
+diff --git a/gcc/c-family/c-common.h b/gcc/c-family/c-common.h
+index ba0a5d7df50..977ae9df5ea 100644
+--- a/gcc/c-family/c-common.h
++++ b/gcc/c-family/c-common.h
+@@ -1063,6 +1063,16 @@ extern vec<tree, va_gc> *make_tree_vector_copy (const vec<tree, va_gc> *);
+    c_register_builtin_type.  */
+ extern GTY(()) tree registered_builtin_types;
+ 
++/* Read SOURCE_DATE_EPOCH from environment to have a deterministic
++   timestamp to replace embedded current dates to get reproducible
++   results.  Returns -1 if SOURCE_DATE_EPOCH is not defined.  */
++extern time_t cb_get_source_date_epoch (cpp_reader *pfile);
++
++/* The value (as a unix timestamp) corresponds to date
++   "Dec 31 9999 23:59:59 UTC", which is the latest date that __DATE__ and
++   __TIME__ can store.  */
++#define MAX_SOURCE_DATE_EPOCH HOST_WIDE_INT_C (253402300799)
++
+ /* In c-gimplify.c  */
+ extern void c_genericize (tree);
+ extern int c_gimplify_expr (tree *, gimple_seq *, gimple_seq *);
+@@ -1438,9 +1448,4 @@ extern tree cilk_for_number_of_iterations (tree);
+ extern bool check_no_cilk (tree, const char *, const char *,
+ 		           location_t loc = UNKNOWN_LOCATION);
+ 
+-/* Read SOURCE_DATE_EPOCH from environment to have a deterministic
+-   timestamp to replace embedded current dates to get reproducible
+-   results.  Returns -1 if SOURCE_DATE_EPOCH is not defined.  */
+-extern time_t get_source_date_epoch (void);
+-
+ #endif /* ! GCC_C_COMMON_H */
+diff --git a/gcc/c-family/c-lex.c b/gcc/c-family/c-lex.c
+index e68471b9d2b..3f78073f640 100644
+--- a/gcc/c-family/c-lex.c
++++ b/gcc/c-family/c-lex.c
+@@ -97,6 +97,7 @@ init_c_lex (void)
+   cb->valid_pch = c_common_valid_pch;
+   cb->read_pch = c_common_read_pch;
+   cb->has_attribute = c_common_has_attribute;
++  cb->get_source_date_epoch = cb_get_source_date_epoch;
+ 
+   /* Set the debug callbacks if we can use them.  */
+   if ((debug_info_level == DINFO_LEVEL_VERBOSE
+@@ -402,9 +403,6 @@ c_lex_with_flags (tree *value, location_t *loc, unsigned char *cpp_flags,
+   enum cpp_ttype type;
+   unsigned char add_flags = 0;
+   enum overflow_type overflow = OT_NONE;
+-  time_t source_date_epoch = get_source_date_epoch ();
+-
+-  cpp_init_source_date_epoch (parse_in, source_date_epoch);
+ 
+   timevar_push (TV_CPP);
+  retry:
+diff --git a/gcc/doc/cppenv.texi b/gcc/doc/cppenv.texi
+index 3b5317beb53..7b4cf6adc11 100644
+--- a/gcc/doc/cppenv.texi
++++ b/gcc/doc/cppenv.texi
+@@ -81,7 +81,6 @@ main input file is omitted.
+ @end ifclear
+ 
+ @item SOURCE_DATE_EPOCH
+-
+ If this variable is set, its value specifies a UNIX timestamp to be
+ used in replacement of the current date and time in the @code{__DATE__}
+ and @code{__TIME__} macros, so that the embedded timestamps become
+@@ -89,8 +88,9 @@ reproducible.
+ 
+ The value of @env{SOURCE_DATE_EPOCH} must be a UNIX timestamp,
+ defined as the number of seconds (excluding leap seconds) since
+-01 Jan 1970 00:00:00 represented in ASCII, identical to the output of
+-@samp{@command{date +%s}}.
++01 Jan 1970 00:00:00 represented in ASCII; identical to the output of
++@samp{@command{date +%s}} on GNU/Linux and other systems that support the
++@code{%s} extension in the @code{date} command.
+ 
+ The value should be a known timestamp such as the last modification
+ time of the source or package and it should be set by the build
+diff --git a/gcc/gcc.c b/gcc/gcc.c
+index d956c36b151..2709f295734 100644
+--- a/gcc/gcc.c
++++ b/gcc/gcc.c
+@@ -3328,6 +3328,29 @@ save_switch (const char *opt, size_t n_args, const char *const *args,
+   n_switches++;
+ }
+ 
++/* Set the SOURCE_DATE_EPOCH environment variable to the current time if it is
++   not set already.  */
++
++static void
++set_source_date_epoch_envvar ()
++{
++  /* Array size is 21 = ceil(log_10(2^64)) + 1 to hold string representations
++     of 64 bit integers.  */
++  char source_date_epoch[21];
++  time_t tt;
++
++  errno = 0;
++  tt = time (NULL);
++  if (tt < (time_t) 0 || errno != 0)
++    tt = (time_t) 0;
++
++  snprintf (source_date_epoch, 21, "%llu", (unsigned long long) tt);
++  /* Using setenv instead of xputenv because we want the variable to remain
++     after finalizing so that it's still set in the second run when using
++     -fcompare-debug.  */
++  setenv ("SOURCE_DATE_EPOCH", source_date_epoch, 0);
++}
++
+ /* Handle an option DECODED that is unknown to the option-processing
+    machinery.  */
+ 
+@@ -3628,6 +3651,7 @@ driver_handle_option (struct gcc_options *opts,
+       else
+ 	compare_debug_opt = arg;
+       save_switch (compare_debug_replacement_opt, 0, NULL, validated, true);
++      set_source_date_epoch_envvar ();
+       return true;
+ 
+     case OPT_fdiagnostics_color_:
+diff --git a/gcc/testsuite/gcc.dg/cpp/source_date_epoch-1.c b/gcc/testsuite/gcc.dg/cpp/source_date_epoch-1.c
+new file mode 100644
+index 00000000000..f6aa1a360ff
+--- /dev/null
++++ b/gcc/testsuite/gcc.dg/cpp/source_date_epoch-1.c
+@@ -0,0 +1,11 @@
++/* { dg-do run } */
++/* { dg-set-compiler-env-var SOURCE_DATE_EPOCH "630333296" } */
++
++int
++main(void)
++{
++  __builtin_printf ("%s %s\n", __DATE__, __TIME__);
++  return 0;
++}
++
++/* { dg-output "^Dec 22 1989 12:34:56\n$" } */
+diff --git a/gcc/testsuite/gcc.dg/cpp/source_date_epoch-2.c b/gcc/testsuite/gcc.dg/cpp/source_date_epoch-2.c
+new file mode 100644
+index 00000000000..ae18362ae87
+--- /dev/null
++++ b/gcc/testsuite/gcc.dg/cpp/source_date_epoch-2.c
+@@ -0,0 +1,12 @@
++/* { dg-do compile } */
++/* { dg-set-compiler-env-var SOURCE_DATE_EPOCH "AAA" } */
++
++/* Make sure that SOURCE_DATE_EPOCH is only parsed once */
++
++int
++main(void)
++{
++  __builtin_printf ("%s %s\n", __DATE__, __TIME__); /* { dg-error "SOURCE_DATE_EPOCH must expand" } */
++  __builtin_printf ("%s %s\n", __DATE__, __TIME__);
++  return 0;
++}
+diff --git a/gcc/testsuite/lib/gcc-dg.exp b/gcc/testsuite/lib/gcc-dg.exp
+index 4fa433d9954..7656b2254a1 100644
+--- a/gcc/testsuite/lib/gcc-dg.exp
++++ b/gcc/testsuite/lib/gcc-dg.exp
+@@ -324,6 +324,38 @@ proc restore-target-env-var { } {
+     }
+ }
+ 
++proc dg-set-compiler-env-var { args } {
++    global set_compiler_env_var
++    global saved_compiler_env_var
++    if { [llength $args] != 3 } {
++	error "dg-set-compiler-env-var: need two arguments"
++	return
++    }
++    set var [lindex $args 1]
++    set value [lindex $args 2]
++    if [info exists ::env($var)] {
++      lappend saved_compiler_env_var [list $var 1 $::env($var)]
++    } else {
++      lappend saved_compiler_env_var [list $var 0]
++    }
++    setenv $var $value
++    lappend set_compiler_env_var [list $var $value]
++}
++
++proc restore-compiler-env-var { } {
++    global saved_compiler_env_var
++    for { set env_vari [llength $saved_compiler_env_var] } {
++          [incr env_vari -1] >= 0 } {} {
++	set env_var [lindex $saved_compiler_env_var $env_vari]
++	set var [lindex $env_var 0]
++	if [lindex $env_var 1] {
++	    setenv $var [lindex $env_var 2]
++	} else {
++	    unsetenv $var
++	}
++    }
++}
++
+ # Utility routines.
+ 
+ #
+@@ -785,6 +817,11 @@ if { [info procs saved-dg-test] == [list] } {
+ 	if [info exists set_target_env_var] {
+ 	    unset set_target_env_var
+ 	}
++	if [info exists set_compiler_env_var] {
++	    restore-compiler-env-var
++	    unset set_compiler_env_var
++	    unset saved_compiler_env_var
++	}
+ 	unset_timeout_vars
+ 	if [info exists compiler_conditional_xfail_data] {
+ 	    unset compiler_conditional_xfail_data
+diff --git a/libcpp/include/cpplib.h b/libcpp/include/cpplib.h
+index 7a5481219be..867aeebc39f 100644
+--- a/libcpp/include/cpplib.h
++++ b/libcpp/include/cpplib.h
+@@ -585,6 +585,9 @@ struct cpp_callbacks
+ 
+   /* Callback that can change a user builtin into normal macro.  */
+   bool (*user_builtin_macro) (cpp_reader *, cpp_hashnode *);
++
++  /* Callback to parse SOURCE_DATE_EPOCH from environment.  */
++  time_t (*get_source_date_epoch) (cpp_reader *);
+ };
+ 
+ #ifdef VMS
+@@ -775,9 +778,6 @@ extern void cpp_init_special_builtins (cpp_reader *);
+ /* Set up built-ins like __FILE__.  */
+ extern void cpp_init_builtins (cpp_reader *, int);
+ 
+-/* Initialize the source_date_epoch value.  */
+-extern void cpp_init_source_date_epoch (cpp_reader *, time_t);
+-
+ /* This is called after options have been parsed, and partially
+    processed.  */
+ extern void cpp_post_options (cpp_reader *);
+diff --git a/libcpp/init.c b/libcpp/init.c
+index a8d00f4628b..61c9bbbf945 100644
+--- a/libcpp/init.c
++++ b/libcpp/init.c
+@@ -254,6 +254,9 @@ cpp_create_reader (enum c_lang lang, cpp_hash_table *table,
+   /* Do not force token locations by default.  */
+   pfile->forced_token_location_p = NULL;
+ 
++  /* Initialize source_date_epoch to -2 (not yet set).  */
++  pfile->source_date_epoch = (time_t) -2;
++
+   /* The expression parser stack.  */
+   _cpp_expand_op_stack (pfile);
+ 
+@@ -530,13 +533,6 @@ cpp_init_builtins (cpp_reader *pfile, int hosted)
+     _cpp_define_builtin (pfile, "__OBJC__ 1");
+ }
+ 
+-/* Initialize the source_date_epoch value.  */
+-void
+-cpp_init_source_date_epoch (cpp_reader *pfile, time_t source_date_epoch)
+-{
+-  pfile->source_date_epoch = source_date_epoch; 
+-}
+-
+ /* Sanity-checks are dependent on command-line options, so it is
+    called as a subroutine of cpp_read_main_file ().  */
+ #if ENABLE_CHECKING
+diff --git a/libcpp/internal.h b/libcpp/internal.h
+index 8507eba1747..226ae328e76 100644
+--- a/libcpp/internal.h
++++ b/libcpp/internal.h
+@@ -503,7 +503,8 @@ struct cpp_reader
+   const unsigned char *time;
+ 
+   /* Externally set timestamp to replace current date and time useful for
+-     reproducibility.  */
++     reproducibility.  It should be initialized to -2 (not yet set) and
++     set to -1 to disable it or to a non-negative value to enable it.  */
+   time_t source_date_epoch;
+ 
+   /* EOF token, and a token forcing paste avoidance.  */
+diff --git a/libcpp/macro.c b/libcpp/macro.c
+index 3f3b278e97d..756c7c6e0c6 100644
+--- a/libcpp/macro.c
++++ b/libcpp/macro.c
+@@ -351,9 +351,13 @@ _cpp_builtin_macro_text (cpp_reader *pfile, cpp_hashnode *node)
+ 	  struct tm *tb = NULL;
+ 
+ 	  /* Set a reproducible timestamp for __DATE__ and __TIME__ macro
+-	     usage if SOURCE_DATE_EPOCH is defined.  */
+-	  if (pfile->source_date_epoch != (time_t) -1)
+-	     tb = gmtime (&pfile->source_date_epoch);
++	     if SOURCE_DATE_EPOCH is defined.  */
++	  if (pfile->source_date_epoch == (time_t) -2
++	      && pfile->cb.get_source_date_epoch != NULL)
++	    pfile->source_date_epoch = pfile->cb.get_source_date_epoch (pfile);
++
++	  if (pfile->source_date_epoch >= (time_t) 0)
++	    tb = gmtime (&pfile->source_date_epoch);
+ 	  else
+ 	    {
+ 	      /* (time_t) -1 is a legitimate value for "number of seconds
+-- 
+2.11.0
+

gnu/packages/patches/gcc-libiberty-printf-decl.patch

@@ -0,0 +1,28 @@
+This patch makes the exeception specifier of libiberty's 'asprintf'
+and 'vasprintf' declarations match those of glibc to work around the
+problem described at <https://gcc.gnu.org/ml/gcc-help/2016-04/msg00039.html>.
+
+The problem in part stems from the fact that libiberty is configured
+without _GNU_SOURCE (thus, it sets HAVE_DECL_ASPRINTF to 0), whereas libcc1
+is configured and built with _GNU_SOURCE, hence the conflicting declarations.
+
+--- gcc-5.3.0/include/libiberty.h	2016-04-23 22:45:46.262709079 +0200
++++ gcc-5.3.0/include/libiberty.h	2016-04-23 22:45:37.110635439 +0200
+@@ -625,7 +625,7 @@ extern int pwait (int, int *, int);
+ /* Like sprintf but provides a pointer to malloc'd storage, which must
+    be freed by the caller.  */
+ 
+-extern int asprintf (char **, const char *, ...) ATTRIBUTE_PRINTF_2;
++extern int asprintf (char **, const char *, ...) __THROWNL ATTRIBUTE_PRINTF_2;
+ #endif
+ 
+ /* Like asprintf but allocates memory without fail. This works like
+@@ -637,7 +637,7 @@ extern char *xasprintf (const char *, ..
+ /* Like vsprintf but provides a pointer to malloc'd storage, which
+    must be freed by the caller.  */
+ 
+-extern int vasprintf (char **, const char *, va_list) ATTRIBUTE_PRINTF(2,0);
++extern int vasprintf (char **, const char *, va_list) __THROWNL ATTRIBUTE_PRINTF(2,0);
+ #endif
+ 
+ /* Like vasprintf but allocates memory without fail. This works like

gnu/packages/patches/gd-CVE-2016-7568.patch

@@ -1,44 +0,0 @@
-Fix CVE-2016-7568 (integer overflow in gdImageWebpCtx()):
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7568
-
-Patch copied from upstream source repository:
-
-https://github.com/libgd/libgd/commit/2806adfdc27a94d333199345394d7c302952b95f
-
-From 2806adfdc27a94d333199345394d7c302952b95f Mon Sep 17 00:00:00 2001
-From: trylab <trylab@users.noreply.github.com>
-Date: Tue, 6 Sep 2016 18:35:32 +0800
-Subject: [PATCH] Fix integer overflow in gdImageWebpCtx
-
-Integer overflow can be happened in expression gdImageSX(im) * 4 *
-gdImageSY(im). It could lead to heap buffer overflow in the following
-code. This issue has been reported to the PHP Bug Tracking System. The
-proof-of-concept file will be supplied some days later. This issue was
-discovered by Ke Liu of Tencent's Xuanwu LAB.
----
- src/gd_webp.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/src/gd_webp.c b/src/gd_webp.c
-index 8eb4dee..9886399 100644
---- a/src/gd_webp.c
-+++ b/src/gd_webp.c
-@@ -199,6 +199,14 @@ BGD_DECLARE(void) gdImageWebpCtx (gdImagePtr im, gdIOCtx * outfile, int quality)
- 		quality = 80;
- 	}
- 
-+	if (overflow2(gdImageSX(im), 4)) {
-+		return;
-+	}
-+
-+	if (overflow2(gdImageSX(im) * 4, gdImageSY(im))) {
-+		return;
-+	}
-+
- 	argb = (uint8_t *)gdMalloc(gdImageSX(im) * 4 * gdImageSY(im));
- 	if (!argb) {
- 		return;
--- 
-2.10.0
-

gnu/packages/patches/gd-CVE-2016-8670.patch

@@ -1,38 +0,0 @@
-Fix CVE-2016-8670 (buffer overflow in dynamicGetbuf()):
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8670
-http://seclists.org/oss-sec/2016/q4/138
-
-Patch copied from upstream source repository:
-
-https://github.com/libgd/libgd/commit/53110871935244816bbb9d131da0bccff734bfe9
-
-From 53110871935244816bbb9d131da0bccff734bfe9 Mon Sep 17 00:00:00 2001
-From: "Christoph M. Becker" <cmbecker69@gmx.de>
-Date: Wed, 12 Oct 2016 11:15:32 +0200
-Subject: [PATCH] Avoid potentially dangerous signed to unsigned conversion
-
-We make sure to never pass a negative `rlen` as size to memcpy(). See
-also <https://bugs.php.net/bug.php?id=73280>.
-
-Patch provided by Emmanuel Law.
----
- src/gd_io_dp.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/gd_io_dp.c b/src/gd_io_dp.c
-index 135eda3..228bfa5 100644
---- a/src/gd_io_dp.c
-+++ b/src/gd_io_dp.c
-@@ -276,7 +276,7 @@ static int dynamicGetbuf(gdIOCtxPtr ctx, void *buf, int len)
- 	if(remain >= len) {
- 		rlen = len;
- 	} else {
--		if(remain == 0) {
-+		if(remain <= 0) {
- 			/* 2.0.34: EOF is incorrect. We use 0 for
- 			 * errors and EOF, just like fileGetbuf,
- 			 * which is a simple fread() wrapper.
--- 
-2.10.1
-

gnu/packages/patches/gd-fix-chunk-size-on-boundaries.patch

@@ -1,102 +0,0 @@
-This fixes PHP bug #73155: https://bugs.php.net/bug.php?id=73155
-
-Patch adapted from upstream source repository:
-
-https://github.com/libgd/libgd/commit/8067a8ac336dfe0acbe96ec2eb24572209a7f279
-
-(.gitignore change removed)
-
-From 8067a8ac336dfe0acbe96ec2eb24572209a7f279 Mon Sep 17 00:00:00 2001
-From: "Christoph M. Becker" <cmbecker69@gmx.de>
-Date: Fri, 23 Sep 2016 18:29:52 +0200
-Subject: [PATCH] Fix #309: gdImageGd2() writes wrong chunk sizes on boundaries
-
-(cherry picked from commit bb1998a16e30d542ab22eba5501911a9aa066edb)
----
- src/gd_gd2.c             |  4 ++--
- tests/gd2/CMakeLists.txt |  1 +
- tests/gd2/Makemodule.am  |  1 +
- tests/gd2/bug00309.c     | 37 +++++++++++++++++++++++++++++++++++++
- 4 files changed, 41 insertions(+), 2 deletions(-)
- create mode 100644 tests/gd2/bug00309.c
-
-diff --git a/src/gd_gd2.c b/src/gd_gd2.c
-index 75e5e1f..b9b2f93 100644
---- a/src/gd_gd2.c
-+++ b/src/gd_gd2.c
-@@ -938,8 +938,8 @@ _gdImageGd2 (gdImagePtr im, gdIOCtx * out, int cs, int fmt)
- 	};
- 
- 	/* Work out number of chunks. */
--	ncx = im->sx / cs + 1;
--	ncy = im->sy / cs + 1;
-+	ncx = (im->sx + cs - 1) / cs;
-+	ncy = (im->sy + cs - 1) / cs;
- 
- 	/* Write the standard header. */
- 	_gd2PutHeader (im, out, cs, fmt, ncx, ncy);
-diff --git a/tests/gd2/CMakeLists.txt b/tests/gd2/CMakeLists.txt
-index 3b650ad..247b466 100644
---- a/tests/gd2/CMakeLists.txt
-+++ b/tests/gd2/CMakeLists.txt
-@@ -1,5 +1,6 @@
- SET(TESTS_FILES
- 	bug_289
-+	bug00309
- 	gd2_empty_file
- 	gd2_im2im
- 	gd2_null
-diff --git a/tests/gd2/Makemodule.am b/tests/gd2/Makemodule.am
-index b8ee946..d69aee0 100644
---- a/tests/gd2/Makemodule.am
-+++ b/tests/gd2/Makemodule.am
-@@ -1,5 +1,6 @@
- libgd_test_programs += \
- 	gd2/bug_289 \
-+	gd2/bug00309 \
- 	gd2/gd2_empty_file \
- 	gd2/php_bug_72339 \
- 	gd2/gd2_read_corrupt
-diff --git a/tests/gd2/bug00309.c b/tests/gd2/bug00309.c
-new file mode 100644
-index 0000000..b649cdc
---- /dev/null
-+++ b/tests/gd2/bug00309.c
-@@ -0,0 +1,37 @@
-+/**
-+ * Regression test for <https://github.com/libgd/libgd/issues/309>.
-+ *
-+ * We test that an image with 64x64 pixels reports only a single chunk in the
-+ * GD2 image header when the chunk size is 64.
-+ */
-+
-+
-+#include "gd.h"
-+#include "gdtest.h"
-+
-+
-+int main()
-+{
-+    gdImagePtr im;
-+    unsigned char *buf;
-+    int size, word;
-+
-+    im = gdImageCreate(64, 64);
-+    gdImageColorAllocate(im, 0, 0, 0);
-+
-+    buf = gdImageGd2Ptr(im, 64, 1, &size);
-+
-+    gdImageDestroy(im);
-+
-+    word = buf[10] << 8 | buf[11];
-+    gdTestAssertMsg(word == 64, "chunk size is %d, but expected 64\n", word);
-+    word = buf[14] << 8 | buf[15];
-+    gdTestAssertMsg(word == 1, "x chunk count is %d, but expected 1\n", word);
-+    word = buf[16] << 8 | buf[17];
-+    gdTestAssertMsg(word == 1, "y chunk count is %d, but expected 1\n", word);
-+    gdTestAssertMsg(size == 5145, "file size is %d, but expected 5145\n", size);
-+
-+    gdFree(buf);
-+
-+    return gdNumFailures();
-+}

gnu/packages/patches/gd-fix-truecolor-format-correction.patch

@@ -1,95 +0,0 @@
-This fixes PHP bug #73159: https://bugs.php.net/bug.php?id=73159
-
-Patch lifted from upstream source repository:
-
-https://github.com/libgd/libgd/commit/e1f61a4141d2e0937a13b8bfb1992b9f29eb05f5
-
-From e1f61a4141d2e0937a13b8bfb1992b9f29eb05f5 Mon Sep 17 00:00:00 2001
-From: "Christoph M. Becker" <cmbecker69@gmx.de>
-Date: Mon, 15 Aug 2016 17:49:40 +0200
-Subject: [PATCH] Fix #289: Passing unrecognized formats to gdImageGd2 results
- in corrupted files
-
-We must not apply the format correction twice for truecolor images.
-
-(cherry picked from commit 09090c125658e23a4ae2a2e002646bb7278bd89e)
----
- src/gd_gd2.c             |  2 +-
- tests/gd2/CMakeLists.txt |  1 +
- tests/gd2/Makemodule.am  |  1 +
- tests/gd2/bug_289.c      | 33 +++++++++++++++++++++++++++++++++
- 4 files changed, 36 insertions(+), 1 deletion(-)
- create mode 100644 tests/gd2/bug_289.c
-
-diff --git a/src/gd_gd2.c b/src/gd_gd2.c
-index 86c881e..75e5e1f 100644
---- a/src/gd_gd2.c
-+++ b/src/gd_gd2.c
-@@ -918,7 +918,7 @@ _gdImageGd2 (gdImagePtr im, gdIOCtx * out, int cs, int fmt)
- 	/* Force fmt to a valid value since we don't return anything. */
- 	/* */
- 	if ((fmt != GD2_FMT_RAW) && (fmt != GD2_FMT_COMPRESSED)) {
--		fmt = im->trueColor ? GD2_FMT_TRUECOLOR_COMPRESSED : GD2_FMT_COMPRESSED;
-+		fmt = GD2_FMT_COMPRESSED;
- 	};
- 	if (im->trueColor) {
- 		fmt += 2;
-diff --git a/tests/gd2/CMakeLists.txt b/tests/gd2/CMakeLists.txt
-index 8aecacc..3b650ad 100644
---- a/tests/gd2/CMakeLists.txt
-+++ b/tests/gd2/CMakeLists.txt
-@@ -1,4 +1,5 @@
- SET(TESTS_FILES
-+	bug_289
- 	gd2_empty_file
- 	gd2_im2im
- 	gd2_null
-diff --git a/tests/gd2/Makemodule.am b/tests/gd2/Makemodule.am
-index 754a284..b8ee946 100644
---- a/tests/gd2/Makemodule.am
-+++ b/tests/gd2/Makemodule.am
-@@ -1,4 +1,5 @@
- libgd_test_programs += \
-+	gd2/bug_289 \
- 	gd2/gd2_empty_file \
- 	gd2/php_bug_72339 \
- 	gd2/gd2_read_corrupt
-diff --git a/tests/gd2/bug_289.c b/tests/gd2/bug_289.c
-new file mode 100644
-index 0000000..ad311e9
---- /dev/null
-+++ b/tests/gd2/bug_289.c
-@@ -0,0 +1,33 @@
-+/**
-+ * Passing an unrecognized format to gdImageGd2() should result in
-+ * GD2_FMT_TRUECOLOR_COMPRESSED for truecolor images.
-+ *
-+ * See <https://github.com/libgd/libgd/issues/289>.
-+ */
-+
-+#include "gd.h"
-+#include "gdtest.h"
-+
-+
-+#define GD2_FMT_UNRECOGNIZED 0
-+#define GD2_FMT_TRUECOLOR_COMPRESSED 4
-+
-+#define MSG "expected %s byte to be %d, but got %d\n"
-+
-+
-+int main()
-+{
-+    gdImagePtr im;
-+    char *buffer;
-+    int size;
-+
-+    im = gdImageCreateTrueColor(10, 10);
-+    gdTestAssert(im != NULL);
-+    buffer = (char *) gdImageGd2Ptr(im, 128, GD2_FMT_UNRECOGNIZED, &size);
-+    gdTestAssert(buffer != NULL);
-+    gdImageDestroy(im);
-+    gdTestAssertMsg(buffer[12] == 0, MSG, "1st", 0, buffer[12]);
-+    gdTestAssertMsg(buffer[13] == GD2_FMT_TRUECOLOR_COMPRESSED, MSG, "2nd", GD2_FMT_TRUECOLOR_COMPRESSED, buffer[13]);
-+
-+    return gdNumFailures();
-+}

gnu/packages/patches/gd-freetype-test-failure.patch

@@ -0,0 +1,59 @@
+Fix a test failure with freetype 2.7:
+
+https://github.com/libgd/libgd/commit/a5570d3ed30ff76c2a8bdd54f4ab1825acca0143
+
+Patch copied from upstream source repository:
+
+https://github.com/libgd/libgd/commit/a5570d3ed30ff76c2a8bdd54f4ab1825acca0143
+
+From a5570d3ed30ff76c2a8bdd54f4ab1825acca0143 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69@gmx.de>
+Date: Sun, 29 Jan 2017 17:07:50 +0100
+Subject: [PATCH] Fix #302: Test suite fails with freetype 2.7
+
+Actually, the test failures are not necessarily related to freetype
+2.7, but rather are caused by subpixel hinting which is enabled by
+default in freetype 2.7. Subpixel hinting is, however, already
+available in freetype 2.5 and in versions having the "Infinality"
+patch.
+
+To get the expected results in all environments, we have to disable
+subpixel hinting, what is easily done by setting a respective
+environment variable.
+
+See also:
+* https://www.freetype.org/freetype2/docs/subpixel-hinting.html
+* https://www.freetype.org/freetype2/docs/reference/ft2-tt_driver.html
+---
+ tests/freetype/bug00132.c                    | 3 +++
+ tests/gdimagestringft/gdimagestringft_bbox.c | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/tests/freetype/bug00132.c b/tests/freetype/bug00132.c
+index 713dd2d..42ed5b1 100644
+--- a/tests/freetype/bug00132.c
++++ b/tests/freetype/bug00132.c
+@@ -11,6 +11,9 @@ int main()
+ 	char *path;
+ 	char *ret = NULL;
+ 
++	/* disable subpixel hinting */
++	putenv("FREETYPE_PROPERTIES=truetype:interpreter-version=35");
++
+ 	im = gdImageCreateTrueColor(50, 30);
+ 
+ 	if (!im) {
+diff --git a/tests/gdimagestringft/gdimagestringft_bbox.c b/tests/gdimagestringft/gdimagestringft_bbox.c
+index 0161ec8..1596a9e 100644
+--- a/tests/gdimagestringft/gdimagestringft_bbox.c
++++ b/tests/gdimagestringft/gdimagestringft_bbox.c
+@@ -38,6 +38,9 @@ int main()
+ 	int error = 0;
+ 	FILE *fp;
+ 
++	/* disable subpixel hinting */
++	putenv("FREETYPE_PROPERTIES=truetype:interpreter-version=35");
++
+ 	path = gdTestFilePath("freetype/DejaVuSans.ttf");
+ 	im = gdImageCreate(800, 800);
+ 	gdImageColorAllocate(im, 0xFF, 0xFF, 0xFF); /* allocate white for background color */

gnu/packages/patches/gd-php-73968-Fix-109-XBM-reading.patch

@@ -0,0 +1,121 @@
+This bug was first reported to php on https://bugs.php.net/bug.php?id=73968.
+php then reported it to gd in https://github.com/libgd/libgd/issues/109.
+
+Patch adapted from upstream source repository:
+
+https://github.com/libgd/libgd/commit/082c5444838ea0d84f9fb6441aefdb44d78d9bba
+
+Binary diffs have been removed from the patch because our patch
+procedure doesn't support them.
+
+From 082c5444838ea0d84f9fb6441aefdb44d78d9bba Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69@gmx.de>
+Date: Fri, 20 Jan 2017 22:48:20 +0100
+Subject: [PATCH] Fix #109: XBM reading fails with printed error
+
+When calculating the number of required bytes of an XBM image, we have
+to take the line padding into account.
+---
+ src/gd_xbm.c                     |   2 +-
+ tests/xbm/CMakeLists.txt         |   1 +
+ tests/xbm/Makemodule.am          |   5 ++++-
+ tests/xbm/github_bug_109.c       |  35 +++++++++++++++++++++++++++++++++++
+ tests/xbm/github_bug_109.xbm     |   5 +++++
+ 5 files changed, 47 insertions(+), 2 deletions(-)
+ create mode 100644 tests/xbm/github_bug_109.c
+ create mode 100644 tests/xbm/github_bug_109.xbm
+ create mode 100644 tests/xbm/github_bug_109_exp.png
+
+diff --git a/src/gd_xbm.c b/src/gd_xbm.c
+index 5f09b56..c2ba2ad 100644
+--- a/src/gd_xbm.c
++++ b/src/gd_xbm.c
+@@ -108,7 +108,7 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromXbm(FILE * fd)
+ 				max_bit = 32768;
+ 			}
+ 			if (max_bit) {
+-				bytes = (width * height / 8) + 1;
++                bytes = (width + 7) / 8 * height;
+ 				if (!bytes) {
+ 					return 0;
+ 				}
+diff --git a/tests/xbm/CMakeLists.txt b/tests/xbm/CMakeLists.txt
+index 183cf5e..08576e0 100644
+--- a/tests/xbm/CMakeLists.txt
++++ b/tests/xbm/CMakeLists.txt
+@@ -1,4 +1,5 @@
+ LIST(APPEND TESTS_FILES
++	github_bug_109
+ 	github_bug_170
+ )
+ 
+diff --git a/tests/xbm/Makemodule.am b/tests/xbm/Makemodule.am
+index ba1eabd..0f5beb6 100644
+--- a/tests/xbm/Makemodule.am
++++ b/tests/xbm/Makemodule.am
+@@ -1,5 +1,8 @@
+ libgd_test_programs += \
++	xbm/github_bug_109 \
+ 	xbm/github_bug_170
+ 
+ EXTRA_DIST += \
+-	xbm/CMakeLists.txt
++	xbm/CMakeLists.txt \
++	xbm/github_bug_109.xbm \
++	xbm/github_bug_109_exp.png
+diff --git a/tests/xbm/github_bug_109.c b/tests/xbm/github_bug_109.c
+new file mode 100644
+index 0000000..1a020c6
+--- /dev/null
++++ b/tests/xbm/github_bug_109.c
+@@ -0,0 +1,35 @@
++/**
++ * Test reading of XBM images with a width that is not a multiple of 8
++ *
++ * We're reading such an XBM image, and check that we got what we've expected,
++ * instead of an error message.
++ *
++ * See also <https://github.com/libgd/libgd/issues/109>.
++ */
++
++
++#include "gd.h"
++#include "gdtest.h"
++
++
++int main()
++{
++    gdImagePtr im;
++    FILE *fp;
++    char *path;
++
++    fp = gdTestFileOpen2("xbm", "github_bug_109.xbm");
++    im = gdImageCreateFromXbm(fp);
++    fclose(fp);
++    gdTestAssert(im != NULL);
++    gdTestAssert(gdImageGetTrueColorPixel(im, 0, 0) == 0);
++    gdTestAssert(gdImageGetTrueColorPixel(im, 0, 1) == 0xffffff);
++
++    path = gdTestFilePath2("xbm", "github_bug_109_exp.png");
++    gdAssertImageEqualsToFile(path, im);
++    gdFree(path);
++
++    gdImageDestroy(im);
++
++    return gdNumFailures();
++}
+diff --git a/tests/xbm/github_bug_109.xbm b/tests/xbm/github_bug_109.xbm
+new file mode 100644
+index 0000000..f427d86
+--- /dev/null
++++ b/tests/xbm/github_bug_109.xbm
+@@ -0,0 +1,5 @@
++#define test_width 10
++#define test_height 10
++static unsigned char test_bits[] = {
++  0xFF, 0x03, 0x00, 0x00, 0xFF, 0x03, 0x00, 0x00, 0xFF, 0x03, 0x00, 0x00, 
++  0xFF, 0x03, 0x00, 0x00, 0xFF, 0x03, 0x00, 0x00};
+
+-- 
+2.7.4
+