summary refs log tree commit diff
path: root/gnu/packages/patches
diff options
context:
space:
mode:
authorMarius Bakke <mbakke@fastmail.com>2019-01-31 23:32:56 +0100
committerMarius Bakke <mbakke@fastmail.com>2019-01-31 23:32:56 +0100
commit0747328e317de4bf936fab50e795d1e1523adfc1 (patch)
tree291d4f07a801b147d64faec31e4394c5cd46ce35 /gnu/packages/patches
parentdf09e1d6e71f68a8fb44bcc9f13e625f9f9701a5 (diff)
parentff75441fcf0ba1212b0342f933a8999bafe60f03 (diff)
downloadguix-0747328e317de4bf936fab50e795d1e1523adfc1.tar.gz
Merge branch 'master' into staging
Diffstat (limited to 'gnu/packages/patches')
-rw-r--r--gnu/packages/patches/combinatorial-blas-awpm.patch67
-rw-r--r--gnu/packages/patches/combinatorial-blas-io-fix.patch14
-rw-r--r--gnu/packages/patches/icecat-avoid-bundled-libraries.patch16
-rw-r--r--gnu/packages/patches/icecat-makeicecat.patch154
-rw-r--r--gnu/packages/patches/icecat-use-system-graphite2+harfbuzz.patch50
-rw-r--r--gnu/packages/patches/icecat-use-system-media-libs.patch87
-rw-r--r--gnu/packages/patches/linkchecker-mark-more-tests-that-require-the-network.patch182
-rw-r--r--gnu/packages/patches/p11-kit-jks-timestamps.patch42
-rw-r--r--gnu/packages/patches/qemu-CVE-2018-16872.patch88
-rw-r--r--gnu/packages/patches/qemu-CVE-2019-6778.patch43
-rw-r--r--gnu/packages/patches/scotch-graph-diam-64.patch27
-rw-r--r--gnu/packages/patches/scotch-graph-induce-type-64.patch19
-rw-r--r--gnu/packages/patches/scotch-integer-declarations.patch37
-rw-r--r--gnu/packages/patches/scotch-test-threading.patch22
-rw-r--r--gnu/packages/patches/superlu-dist-awpm-grid.patch36
-rw-r--r--gnu/packages/patches/x265-detect512-all-arches.patch37
16 files changed, 739 insertions, 182 deletions
diff --git a/gnu/packages/patches/combinatorial-blas-awpm.patch b/gnu/packages/patches/combinatorial-blas-awpm.patch
new file mode 100644
index 0000000000..86d4ab2dcf
--- /dev/null
+++ b/gnu/packages/patches/combinatorial-blas-awpm.patch
@@ -0,0 +1,67 @@
+Install BipartiteMatchings headers for SuperLU_DIST.
+
+--- a/BipartiteMatchings/ApproxWeightPerfectMatching.h
++++ b/BipartiteMatchings/ApproxWeightPerfectMatching.h
+@@ -9,7 +9,7 @@
+ #ifndef ApproxWeightPerfectMatching_h
+ #define ApproxWeightPerfectMatching_h
+ 
+-#include "../CombBLAS.h"
++#include "CombBLAS.h"
+ #include "BPMaximalMatching.h"
+ #include "BPMaximumMatching.h"
+ #include <parallel/algorithm>
+--- a/BipartiteMatchings/BPMaximalMatching.h
++++ b/BipartiteMatchings/BPMaximalMatching.h
+@@ -1,7 +1,7 @@
+ #ifndef BP_MAXIMAL_MATCHING_H
+ #define BP_MAXIMAL_MATCHING_H
+ 
+-#include "../CombBLAS.h"
++#include "CombBLAS.h"
+ #include <iostream>
+ #include <functional>
+ #include <algorithm>
+--- a/BipartiteMatchings/BPMaximumMatching.h
++++ b/BipartiteMatchings/BPMaximumMatching.h
+@@ -1,7 +1,7 @@
+ #ifndef BP_MAXIMUM_MATCHING_H
+ #define BP_MAXIMUM_MATCHING_H
+ 
+-#include "../CombBLAS.h"
++#include "CombBLAS.h"
+ #include <mpi.h>
+ #include <sys/time.h>
+ #include <iostream>
+--- a/BipartiteMatchings/MatchingDefs.h
++++ b/BipartiteMatchings/MatchingDefs.h
+@@ -9,7 +9,7 @@
+ #ifndef MatchingDefs_h
+ #define MatchingDefs_h
+ 
+-#include "../CombBLAS.h"
++#include "CombBLAS.h"
+ #include <iostream>
+ 
+ namespace combblas {
+--- a/BipartiteMatchings/Utility.h
++++ b/BipartiteMatchings/Utility.h
+@@ -1,7 +1,7 @@
+ #ifndef BP_UTILITY_H
+ #define BP_UTILITY_H
+ 
+-#include "../CombBLAS.h"
++#include "CombBLAS.h"
+ 
+ namespace combblas {
+ 
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -68,6 +68,7 @@ set_property(TARGET CombBLAS PROPERTY VERSION ${CombBLAS_VERSION})
+ # installation
+ install(DIRECTORY include/ DESTINATION include)
+ install(DIRECTORY psort-1.0/include/ DESTINATION include)
++install(DIRECTORY BipartiteMatchings DESTINATION include FILES_MATCHING PATTERN "*.h")
+ install(TARGETS CombBLAS EXPORT CombBLASTargets
+   LIBRARY DESTINATION lib
+   ARCHIVE DESTINATION lib
diff --git a/gnu/packages/patches/combinatorial-blas-io-fix.patch b/gnu/packages/patches/combinatorial-blas-io-fix.patch
new file mode 100644
index 0000000000..0ad28e5e0b
--- /dev/null
+++ b/gnu/packages/patches/combinatorial-blas-io-fix.patch
@@ -0,0 +1,14 @@
+IO not appropriate in the context of a sorting routine, and in any case the
+proper headers are not included, so gcc emits an undefined symbol error.
+Remove the "printf" statement.
+
+--- CombBLAS_beta_16_2/usort/include/usort/seqUtils.tcc
++++ CombBLAS_beta_16_2/usort/include/usort/seqUtils.tcc
+@@ -142,7 +142,6 @@
+       }
+         if ( (a[nmax]==a[nmin]) && (ctr==0) )
+         {
+-          printf("All the numbers are identical, the list is sorted\n");
+           return;
+         }
+ 
diff --git a/gnu/packages/patches/icecat-avoid-bundled-libraries.patch b/gnu/packages/patches/icecat-avoid-bundled-libraries.patch
index 33203b1a33..d9a7dfe550 100644
--- a/gnu/packages/patches/icecat-avoid-bundled-libraries.patch
+++ b/gnu/packages/patches/icecat-avoid-bundled-libraries.patch
@@ -1,7 +1,7 @@
 Fixes needed when avoiding bundled libraries.
 
---- icecat-60.2.0/xpcom/build/moz.build.orig	2018-09-13 17:46:49.000000000 -0400
-+++ icecat-60.2.0/xpcom/build/moz.build	2018-09-22 04:26:50.659564554 -0400
+--- icecat-60.5.0/xpcom/build/moz.build.orig	2018-09-13 17:46:49.000000000 -0400
++++ icecat-60.5.0/xpcom/build/moz.build	2018-09-22 04:26:50.659564554 -0400
 @@ -99,10 +99,5 @@
      '/docshell/base',
  ]
@@ -13,8 +13,8 @@ Fixes needed when avoiding bundled libraries.
 -
  if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'cocoa':
      CXXFLAGS += CONFIG['TK_CFLAGS']
---- icecat-60.2.0/storage/moz.build.orig	2018-09-13 17:51:11.000000000 -0400
-+++ icecat-60.2.0/storage/moz.build	2018-09-22 04:26:50.659564554 -0400
+--- icecat-60.5.0/storage/moz.build.orig	2018-09-13 17:51:11.000000000 -0400
++++ icecat-60.5.0/storage/moz.build	2018-09-22 04:26:50.659564554 -0400
 @@ -117,7 +117,6 @@
      DEFINES['MOZ_MEMORY_TEMP_STORE_PRAGMA'] = True
  
@@ -23,8 +23,8 @@ Fixes needed when avoiding bundled libraries.
      '/dom/base',
  ]
  
---- icecat-60.2.0/dom/indexedDB/moz.build.orig	2018-09-13 17:49:42.000000000 -0400
-+++ icecat-60.2.0/dom/indexedDB/moz.build	2018-09-22 04:26:50.663564574 -0400
+--- icecat-60.5.0/dom/indexedDB/moz.build.orig	2018-09-13 17:49:42.000000000 -0400
++++ icecat-60.5.0/dom/indexedDB/moz.build	2018-09-22 04:26:50.663564574 -0400
 @@ -102,7 +102,6 @@
      CXXFLAGS += ['-Wno-error=shadow']
  
@@ -33,8 +33,8 @@ Fixes needed when avoiding bundled libraries.
      '/dom/base',
      '/dom/storage',
      '/ipc/glue',
---- icecat-60.2.0/media/webrtc/trunk/webrtc/base/rtc_task_queue_gn/moz.build.orig	2018-09-13 17:40:54.000000000 -0400
-+++ icecat-60.2.0/media/webrtc/trunk/webrtc/base/rtc_task_queue_gn/moz.build	2018-09-23 21:33:12.319975105 -0400
+--- icecat-60.5.0/media/webrtc/trunk/webrtc/base/rtc_task_queue_gn/moz.build.orig	2018-09-13 17:40:54.000000000 -0400
++++ icecat-60.5.0/media/webrtc/trunk/webrtc/base/rtc_task_queue_gn/moz.build	2018-09-23 21:33:12.319975105 -0400
 @@ -130,11 +130,6 @@
      DEFINES["WEBRTC_POSIX"] = True
      DEFINES["_FILE_OFFSET_BITS"] = "64"
diff --git a/gnu/packages/patches/icecat-makeicecat.patch b/gnu/packages/patches/icecat-makeicecat.patch
new file mode 100644
index 0000000000..2a11bf0b70
--- /dev/null
+++ b/gnu/packages/patches/icecat-makeicecat.patch
@@ -0,0 +1,154 @@
+Make some of the changes needed to the 'makeicecat' script, to allow it to run
+in a snippet without network access.  After this patch is applied, some
+additional changes will be made using 'substitute*'.
+
+diff --git a/makeicecat b/makeicecat
+index aa46b94..db27a86 100644
+--- a/makeicecat
++++ b/makeicecat
+@@ -36,75 +36,75 @@ export DEBFULLNAME="Ruben Rodriguez"
+ 
+ DATA="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"/data
+ 
+-mkdir output
+-cd output
++# mkdir output
++# cd output
+ 
+ ###############################################################################
+ # Retrieve FF source code
+ ###############################################################################
+ 
+-rm mozilla-esr${FFMAJOR} $SOURCEDIR -rf
+-
+-wget -N https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/${FFVERSION}esr/source/firefox-${FFVERSION}esr.source.tar.xz
+-wget -N https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/${FFVERSION}esr/source/firefox-${FFVERSION}esr.source.tar.xz.asc
+-gpg --recv-keys --keyserver keyserver.ubuntu.com 24C6F355
+-gpg --verify firefox-${FFVERSION}esr.source.tar.xz.asc
+-
+-echo Extracting Firefox tarball
+-tar -xf firefox-${FFVERSION}esr.source.tar.xz
+-
+-mv firefox-${FFVERSION} $SOURCEDIR
++# rm mozilla-esr${FFMAJOR} $SOURCEDIR -rf
++# 
++# wget -N https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/${FFVERSION}esr/source/firefox-${FFVERSION}esr.source.tar.xz
++# wget -N https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/${FFVERSION}esr/source/firefox-${FFVERSION}esr.source.tar.xz.asc
++# gpg --recv-keys --keyserver keyserver.ubuntu.com 24C6F355
++# gpg --verify firefox-${FFVERSION}esr.source.tar.xz.asc
++# 
++# echo Extracting Firefox tarball
++# tar -xf firefox-${FFVERSION}esr.source.tar.xz
++# 
++# mv firefox-${FFVERSION} $SOURCEDIR
+ 
+ ###############################################################################
+ # Retrieve /debian from Ubuntu
+ ###############################################################################
+ 
+-rm -rf firefox.$CODENAME
+-bzr branch https://code.launchpad.net/~mozillateam/firefox/firefox.$CODENAME
+-cd firefox.$CODENAME
+-bzr revert -r$REVISION
+-echo '3.0 (native)' > debian/source/format
+-
+-for PATCH in ubuntu-bookmarks.patch ubuntu-ua-string-changes.patch unity-menubar.patch ubuntu-search-defaults.patch fix-make-package-tests-without-webrtc.patch revert-upstream-search-engine-changes.patch
+-do
+-  rm debian/patches/$PATCH
+-  sed "/$PATCH/d" -i debian/patches/series
+-done
+-sed "/test-/d" -i debian/patches/series
+-cd ..
+-
+-mv firefox.$CODENAME/debian $SOURCEDIR
+-rm -rf firefox.$CODENAME
++# rm -rf firefox.$CODENAME
++# bzr branch https://code.launchpad.net/~mozillateam/firefox/firefox.$CODENAME
++# cd firefox.$CODENAME
++# bzr revert -r$REVISION
++# echo '3.0 (native)' > debian/source/format
++# 
++# for PATCH in ubuntu-bookmarks.patch ubuntu-ua-string-changes.patch unity-menubar.patch ubuntu-search-defaults.patch fix-make-package-tests-without-webrtc.patch revert-upstream-search-engine-changes.patch
++# do
++#   rm debian/patches/$PATCH
++#   sed "/$PATCH/d" -i debian/patches/series
++# done
++# sed "/test-/d" -i debian/patches/series
++# cd ..
++# 
++# mv firefox.$CODENAME/debian $SOURCEDIR
++# rm -rf firefox.$CODENAME
+ 
+ ###############################################################################
+ # Retrieve l10n
+ ###############################################################################
+ 
+-mkdir l10n
+-cd l10n
+-while read line;do
+-    line=$(echo $line |cut -d' ' -f1)
+-    #[ $line = "es-ES" ] || continue # To speed up testing
+-    [ $line = "en-US" ] && continue
+-    hg clone https://hg.mozilla.org/l10n-central/$line
+-    mkdir -p $line/browser/chrome/browser/preferences
+-    touch $line/browser/chrome/browser/preferences/advanced-scripts.dtd
+-    rm -rf $line/.hg*
+-done < ../$SOURCEDIR/browser/locales/shipped-locales
+-cd ..
+-
+-mv l10n $SOURCEDIR
+-
+-hg clone http://hg.mozilla.org/l10n/compare-locales/
+-cd compare-locales/
+-hg checkout RELEASE_3_3_0
+-cd ..
+-rm compare-locales/.hg* compare-locales/.git* -rf
+-mv compare-locales $SOURCEDIR/l10n
++# mkdir l10n
++# cd l10n
++# while read line;do
++#     line=$(echo $line |cut -d' ' -f1)
++#     #[ $line = "es-ES" ] || continue # To speed up testing
++#     [ $line = "en-US" ] && continue
++#     hg clone https://hg.mozilla.org/l10n-central/$line
++#     mkdir -p $line/browser/chrome/browser/preferences
++#     touch $line/browser/chrome/browser/preferences/advanced-scripts.dtd
++#     rm -rf $line/.hg*
++# done < ../$SOURCEDIR/browser/locales/shipped-locales
++# cd ..
++# 
++# mv l10n $SOURCEDIR
++# 
++# hg clone http://hg.mozilla.org/l10n/compare-locales/
++# cd compare-locales/
++# hg checkout RELEASE_3_3_0
++# cd ..
++# rm compare-locales/.hg* compare-locales/.git* -rf
++# mv compare-locales $SOURCEDIR/l10n
+ 
+ #######################################################
+ 
+-cd $SOURCEDIR
++# cd $SOURCEDIR
+ 
+ #for patch in $DATA/patches/*; do
+ #    echo Patching with file: $patch
+@@ -720,7 +720,7 @@ debian/rules debian/control
+ touch -d "yesterday" debian/control
+ debian/rules debian/control
+ 
+-echo | dch -b -D stable -v "$ICECATVERSION"  "Converted into IceCat (http://www.gnu.org/software/gnuzilla/)"
++# echo | dch -b -D stable -v "$ICECATVERSION"  "Converted into IceCat (http://www.gnu.org/software/gnuzilla/)"
+ sed "1s/firefox/icecat/" -i debian/changelog
+ 
+ touch configure js/src/configure
+@@ -734,6 +734,6 @@ sed 's/777/755/;' -i toolkit/crashreporter/google-breakpad/Makefile.in
+ /bin/sed 's/chmod a+w/chmod u+w/' -i ./js/src/ctypes/libffi/Makefile.in ./toolkit/crashreporter/google-breakpad/Makefile.in ./toolkit/crashreporter/google-breakpad/src/third_party/glog/Makefile.in || true
+ 
+ 
+-cd ..
+-echo Packaging tarball
+-tar cfj icecat-$ICECATVERSION.tar.bz2 $SOURCEDIR
++# cd ..
++# echo Packaging tarball
++# tar cfj icecat-$ICECATVERSION.tar.bz2 $SOURCEDIR
diff --git a/gnu/packages/patches/icecat-use-system-graphite2+harfbuzz.patch b/gnu/packages/patches/icecat-use-system-graphite2+harfbuzz.patch
index 94c211b797..776b5f3d9a 100644
--- a/gnu/packages/patches/icecat-use-system-graphite2+harfbuzz.patch
+++ b/gnu/packages/patches/icecat-use-system-graphite2+harfbuzz.patch
@@ -4,8 +4,8 @@ Based on:
   https://svnweb.freebsd.org/ports/head/www/firefox-esr/files/patch-bug847568?revision=472833&view=co
 Modified for use with patch -p1, and to apply cleanly to GNU IceCat.
 
---- icecat-60.2.0/config/system-headers.mozbuild
-+++ icecat-60.2.0/config/system-headers.mozbuild
+--- icecat-60.5.0/config/system-headers.mozbuild
++++ icecat-60.5.0/config/system-headers.mozbuild
 @@ -1311,6 +1311,19 @@
          'pixman.h',
      ]
@@ -26,8 +26,8 @@ Modified for use with patch -p1, and to apply cleanly to GNU IceCat.
  if CONFIG['MOZ_SYSTEM_LIBVPX']:
      system_headers += [
          'vpx_mem/vpx_mem.h',
---- icecat-60.2.0/dom/base/moz.build
-+++ icecat-60.2.0/dom/base/moz.build
+--- icecat-60.5.0/dom/base/moz.build
++++ icecat-60.5.0/dom/base/moz.build
 @@ -474,6 +474,9 @@
  if CONFIG['MOZ_X11']:
      CXXFLAGS += CONFIG['TK_CFLAGS']
@@ -38,8 +38,8 @@ Modified for use with patch -p1, and to apply cleanly to GNU IceCat.
  GENERATED_FILES += [
      'PropertyUseCounterMap.inc',
      'UseCounterList.h',
---- icecat-60.2.0/gfx/graphite2/moz-gr-update.sh
-+++ icecat-60.2.0/gfx/graphite2/moz-gr-update.sh
+--- icecat-60.5.0/gfx/graphite2/moz-gr-update.sh
++++ icecat-60.5.0/gfx/graphite2/moz-gr-update.sh
 @@ -1,6 +1,7 @@
  #!/bin/bash
  
@@ -66,8 +66,8 @@ Modified for use with patch -p1, and to apply cleanly to GNU IceCat.
  
  echo
  echo If gfx/graphite2/src/files.mk has changed, please make corresponding
---- icecat-60.2.0/gfx/moz.build
-+++ icecat-60.2.0/gfx/moz.build
+--- icecat-60.5.0/gfx/moz.build
++++ icecat-60.5.0/gfx/moz.build
 @@ -10,6 +10,12 @@ with Files('**'):
  if CONFIG['MOZ_TREE_CAIRO']:
      DIRS += ['cairo']
@@ -90,8 +90,8 @@ Modified for use with patch -p1, and to apply cleanly to GNU IceCat.
      'ots/src',
      'thebes',
      'ipc',
---- icecat-60.2.0/gfx/skia/generate_mozbuild.py
-+++ icecat-60.2.0/gfx/skia/generate_mozbuild.py
+--- icecat-60.5.0/gfx/skia/generate_mozbuild.py
++++ icecat-60.5.0/gfx/skia/generate_mozbuild.py
 @@ -148,6 +148,9 @@
          '-Wno-unused-private-field',
      ]
@@ -102,8 +102,8 @@ Modified for use with patch -p1, and to apply cleanly to GNU IceCat.
  if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk3', 'android'):
      CXXFLAGS += CONFIG['MOZ_CAIRO_CFLAGS']
      CXXFLAGS += CONFIG['CAIRO_FT_CFLAGS']
---- icecat-60.2.0/gfx/skia/moz.build
-+++ icecat-60.2.0/gfx/skia/moz.build
+--- icecat-60.5.0/gfx/skia/moz.build
++++ icecat-60.5.0/gfx/skia/moz.build
 @@ -822,6 +822,9 @@
          '-Wno-unused-private-field',
      ]
@@ -114,8 +114,8 @@ Modified for use with patch -p1, and to apply cleanly to GNU IceCat.
  if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk3', 'android'):
      CXXFLAGS += CONFIG['MOZ_CAIRO_CFLAGS']
      CXXFLAGS += CONFIG['CAIRO_FT_CFLAGS']
---- icecat-60.2.0/gfx/thebes/moz.build
-+++ icecat-60.2.0/gfx/thebes/moz.build
+--- icecat-60.5.0/gfx/thebes/moz.build
++++ icecat-60.5.0/gfx/thebes/moz.build
 @@ -272,7 +272,13 @@
  
  LOCAL_INCLUDES += CONFIG['SKIA_INCLUDES']
@@ -131,8 +131,8 @@ Modified for use with patch -p1, and to apply cleanly to GNU IceCat.
  
  if CONFIG['CC_TYPE'] == 'clang':
      # Suppress warnings from Skia header files.
---- icecat-60.2.0/intl/unicharutil/util/moz.build
-+++ icecat-60.2.0/intl/unicharutil/util/moz.build
+--- icecat-60.5.0/intl/unicharutil/util/moz.build
++++ icecat-60.5.0/intl/unicharutil/util/moz.build
 @@ -25,4 +25,7 @@ UNIFIED_SOURCES += [
      'nsUnicodeProperties.cpp',
  ]
@@ -141,8 +141,8 @@ Modified for use with patch -p1, and to apply cleanly to GNU IceCat.
 +    CXXFLAGS += CONFIG['MOZ_HARFBUZZ_CFLAGS']
 +
  FINAL_LIBRARY = 'xul'
---- icecat-60.2.0/netwerk/dns/moz.build
-+++ icecat-60.2.0/netwerk/dns/moz.build
+--- icecat-60.5.0/netwerk/dns/moz.build
++++ icecat-60.5.0/netwerk/dns/moz.build
 @@ -76,3 +76,6 @@
  
  if CONFIG['CC_TYPE'] in ('clang', 'gcc'):
@@ -150,9 +150,9 @@ Modified for use with patch -p1, and to apply cleanly to GNU IceCat.
 +
 +if CONFIG['MOZ_SYSTEM_HARFBUZZ']:
 +    CXXFLAGS += CONFIG['MOZ_HARFBUZZ_CFLAGS']
---- icecat-60.2.0/old-configure.in
-+++ icecat-60.2.0/old-configure.in
-@@ -3995,6 +3995,27 @@
+--- icecat-60.5.0/old-configure.in
++++ icecat-60.5.0/old-configure.in
+@@ -3971,6 +3971,27 @@
  AC_SUBST(MOZ_LINUX_32_SSE2_STARTUP_ERROR)
  
  dnl ========================================================
@@ -180,8 +180,8 @@ Modified for use with patch -p1, and to apply cleanly to GNU IceCat.
  dnl Check for pixman and cairo
  dnl ========================================================
  
---- icecat-60.2.0/toolkit/library/moz.build
-+++ icecat-60.2.0/toolkit/library/moz.build
+--- icecat-60.5.0/toolkit/library/moz.build
++++ icecat-60.5.0/toolkit/library/moz.build
 @@ -235,6 +235,12 @@
  if CONFIG['MOZ_SYSTEM_PNG']:
      OS_LIBS += CONFIG['MOZ_PNG_LIBS']
@@ -195,8 +195,8 @@ Modified for use with patch -p1, and to apply cleanly to GNU IceCat.
  if CONFIG['MOZ_SYSTEM_HUNSPELL']:
      OS_LIBS += CONFIG['MOZ_HUNSPELL_LIBS']
  
---- icecat-60.2.0/toolkit/moz.configure
-+++ icecat-60.2.0/toolkit/moz.configure
+--- icecat-60.5.0/toolkit/moz.configure
++++ icecat-60.5.0/toolkit/moz.configure
 @@ -1051,6 +1051,26 @@
  add_old_configure_assignment('FT2_CFLAGS',
                               ft2_info.cflags)
diff --git a/gnu/packages/patches/icecat-use-system-media-libs.patch b/gnu/packages/patches/icecat-use-system-media-libs.patch
index 648585a6f0..00c95fb82e 100644
--- a/gnu/packages/patches/icecat-use-system-media-libs.patch
+++ b/gnu/packages/patches/icecat-use-system-media-libs.patch
@@ -8,8 +8,8 @@ Changes to files within the bundled libraries are omitted, since those files
 are removed from Guix sources.  Modified for use with patch -p1, and to apply
 cleanly to GNU IceCat.
 
---- icecat-60.2.0/build/moz.configure/old.configure
-+++ icecat-60.2.0/build/moz.configure/old.configure
+--- icecat-60.5.0/build/moz.configure/old.configure
++++ icecat-60.5.0/build/moz.configure/old.configure
 @@ -273,7 +273,12 @@
      '--with-system-libvpx',
      '--with-system-nspr',
@@ -23,8 +23,8 @@ cleanly to GNU IceCat.
      '--with-system-zlib',
      '--with-thumb',
      '--with-thumb-interwork',
---- icecat-60.2.0/config/external/moz.build
-+++ icecat-60.2.0/config/external/moz.build
+--- icecat-60.5.0/config/external/moz.build
++++ icecat-60.5.0/config/external/moz.build
 @@ -23,12 +23,21 @@
  
  external_dirs += ['modules/xz-embedded']
@@ -61,8 +61,8 @@ cleanly to GNU IceCat.
      'media/mp4parse-rust',
      'media/psshparser'
  ]
---- icecat-60.2.0/config/system-headers.mozbuild
-+++ icecat-60.2.0/config/system-headers.mozbuild
+--- icecat-60.5.0/config/system-headers.mozbuild
++++ icecat-60.5.0/config/system-headers.mozbuild
 @@ -1324,6 +1324,28 @@
          'harfbuzz/hb.h',
      ]
@@ -92,19 +92,19 @@ cleanly to GNU IceCat.
  if CONFIG['MOZ_SYSTEM_LIBVPX']:
      system_headers += [
          'vpx_mem/vpx_mem.h',
---- icecat-60.2.0/dom/media/AudioStream.cpp
-+++ icecat-60.2.0/dom/media/AudioStream.cpp
-@@ -121,7 +121,9 @@
-   : mMonitor("AudioStream")
-   , mChannels(0)
-   , mOutChannels(0)
+--- icecat-60.5.0/dom/media/AudioStream.cpp
++++ icecat-60.5.0/dom/media/AudioStream.cpp
+@@ -128,7 +128,9 @@
+     : mMonitor("AudioStream"),
+       mChannels(0),
+       mOutChannels(0),
 +#ifndef MOZ_SYSTEM_SOUNDTOUCH
-   , mTimeStretcher(nullptr)
+       mTimeStretcher(nullptr),
 +#endif
-   , mDumpFile(nullptr)
-   , mState(INITIALIZED)
-   , mDataSource(aSource)
-@@ -142,9 +144,11 @@
+       mDumpFile(nullptr),
+       mState(INITIALIZED),
+       mDataSource(aSource),
+@@ -147,9 +149,11 @@
    if (mDumpFile) {
      fclose(mDumpFile);
    }
@@ -116,8 +116,8 @@ cleanly to GNU IceCat.
  #if defined(XP_WIN)
    if (XRE_IsContentProcess()) {
      audio::AudioNotificationReceiver::Unregister(this);
-@@ -168,7 +172,11 @@
- {
+@@ -170,7 +174,11 @@
+ nsresult AudioStream::EnsureTimeStretcherInitializedUnlocked() {
    mMonitor.AssertCurrentThreadOwns();
    if (!mTimeStretcher) {
 +#ifdef MOZ_SYSTEM_SOUNDTOUCH
@@ -128,8 +128,8 @@ cleanly to GNU IceCat.
      mTimeStretcher->setSampleRate(mAudioClock.GetInputRate());
      mTimeStretcher->setChannels(mOutChannels);
      mTimeStretcher->setPitch(1.0);
---- icecat-60.2.0/dom/media/AudioStream.h
-+++ icecat-60.2.0/dom/media/AudioStream.h
+--- icecat-60.5.0/dom/media/AudioStream.h
++++ icecat-60.5.0/dom/media/AudioStream.h
 @@ -15,7 +15,11 @@
  #include "mozilla/TimeStamp.h"
  #include "mozilla/UniquePtr.h"
@@ -142,7 +142,7 @@ cleanly to GNU IceCat.
  
  #if defined(XP_WIN)
  #include "mozilla/audio/AudioNotificationReceiver.h"
-@@ -297,7 +301,11 @@
+@@ -293,7 +297,11 @@
    uint32_t mChannels;
    uint32_t mOutChannels;
    AudioClock mAudioClock;
@@ -154,8 +154,8 @@ cleanly to GNU IceCat.
  
    // Output file for dumping audio
    FILE* mDumpFile;
---- icecat-60.2.0/dom/media/moz.build
-+++ icecat-60.2.0/dom/media/moz.build
+--- icecat-60.5.0/dom/media/moz.build
++++ icecat-60.5.0/dom/media/moz.build
 @@ -327,6 +327,21 @@
  
  DEFINES['MOZILLA_INTERNAL_API'] = True
@@ -178,8 +178,8 @@ cleanly to GNU IceCat.
  if CONFIG['MOZ_ANDROID_HLS_SUPPORT']:
      DEFINES['MOZ_ANDROID_HLS_SUPPORT'] = True
  
---- icecat-60.2.0/dom/media/platforms/ffmpeg/ffvpx/FFVPXRuntimeLinker.cpp
-+++ icecat-60.2.0/dom/media/platforms/ffmpeg/ffvpx/FFVPXRuntimeLinker.cpp
+--- icecat-60.5.0/dom/media/platforms/ffmpeg/ffvpx/FFVPXRuntimeLinker.cpp
++++ icecat-60.5.0/dom/media/platforms/ffmpeg/ffvpx/FFVPXRuntimeLinker.cpp
 @@ -15,9 +15,13 @@
  #include <windows.h>
  #endif
@@ -194,7 +194,7 @@ cleanly to GNU IceCat.
  
  namespace mozilla {
  
-@@ -64,6 +68,12 @@
+@@ -60,6 +64,12 @@
  
    sLinkStatus = LinkStatus_FAILED;
  
@@ -207,17 +207,17 @@ cleanly to GNU IceCat.
    // We retrieve the path of the lgpllibs library as this is where mozavcodec
    // and mozavutil libs are located.
    PathString lgpllibsname = GetLibraryName(nullptr, "lgpllibs");
-@@ -73,6 +83,7 @@
-   PathString path =
-     GetLibraryFilePathname(lgpllibsname.get(),
-                            (PRFuncPtr)&soundtouch::SoundTouch::getVersionId);
+@@ -68,6 +78,7 @@
+   }
+   PathString path = GetLibraryFilePathname(
+       lgpllibsname.get(), (PRFuncPtr)&soundtouch::SoundTouch::getVersionId);
 +#endif
    if (path.IsEmpty()) {
      return false;
    }
---- icecat-60.2.0/old-configure.in
-+++ icecat-60.2.0/old-configure.in
-@@ -2451,6 +2451,111 @@
+--- icecat-60.5.0/old-configure.in
++++ icecat-60.5.0/old-configure.in
+@@ -2417,6 +2417,111 @@
  fi
  fi # COMPILE_ENVIRONMENT
  
@@ -329,8 +329,8 @@ cleanly to GNU IceCat.
  dnl system libvpx Support
  dnl ========================================================
  MOZ_ARG_WITH_BOOL(system-libvpx,
---- icecat-60.2.0/toolkit/library/moz.build
-+++ icecat-60.2.0/toolkit/library/moz.build
+--- icecat-60.5.0/toolkit/library/moz.build
++++ icecat-60.5.0/toolkit/library/moz.build
 @@ -244,6 +244,21 @@
  if CONFIG['MOZ_SYSTEM_HUNSPELL']:
      OS_LIBS += CONFIG['MOZ_HUNSPELL_LIBS']
@@ -353,9 +353,9 @@ cleanly to GNU IceCat.
  if CONFIG['MOZ_SYSTEM_LIBEVENT']:
      OS_LIBS += CONFIG['MOZ_LIBEVENT_LIBS']
  
---- icecat-60.2.0/xpcom/build/XPCOMInit.cpp
-+++ icecat-60.2.0/xpcom/build/XPCOMInit.cpp
-@@ -138,7 +138,9 @@
+--- icecat-60.5.0/xpcom/build/XPCOMInit.cpp
++++ icecat-60.5.0/xpcom/build/XPCOMInit.cpp
+@@ -139,7 +139,9 @@
  
  #include "mozilla/ipc/GeckoChildProcessHost.h"
  
@@ -365,16 +365,15 @@ cleanly to GNU IceCat.
  #if defined(MOZ_VPX) && !defined(MOZ_VPX_NO_MEM_REPORTING)
  #if defined(HAVE_STDINT_H)
  // mozilla-config.h defines HAVE_STDINT_H, and then it's defined *again* in
-@@ -639,11 +641,13 @@
+@@ -635,10 +637,12 @@
    // this oddness.
    mozilla::SetICUMemoryFunctions();
  
 +#ifndef MOZ_OGG_NO_MEM_REPORTING
    // Do the same for libogg.
-   ogg_set_mem_functions(OggReporter::CountingMalloc,
-                         OggReporter::CountingCalloc,
-                         OggReporter::CountingRealloc,
-                         OggReporter::CountingFree);
+   ogg_set_mem_functions(
+       OggReporter::CountingMalloc, OggReporter::CountingCalloc,
+       OggReporter::CountingRealloc, OggReporter::CountingFree);
 +#endif
  
  #if defined(MOZ_VPX) && !defined(MOZ_VPX_NO_MEM_REPORTING)
diff --git a/gnu/packages/patches/linkchecker-mark-more-tests-that-require-the-network.patch b/gnu/packages/patches/linkchecker-mark-more-tests-that-require-the-network.patch
new file mode 100644
index 0000000000..f3e488cec2
--- /dev/null
+++ b/gnu/packages/patches/linkchecker-mark-more-tests-that-require-the-network.patch
@@ -0,0 +1,182 @@
+From f24c88a0732024028fffe0372039a847e91722ea Mon Sep 17 00:00:00 2001
+From: Christopher Baines <mail@cbaines.net>
+Date: Tue, 1 Jan 2019 22:36:29 +0000
+Subject: [PATCH] Mark more tests that require the network
+
+I believe all these tests require the network, at least they seem to
+fail if it's I run them without connecting my computer to the web.
+
+I'm looking at this as part of packaging linkchecker for GNU Guix,
+where the package is build and the tests are run in a isolated
+environment, intentionally without network access, to avoid issues
+with non-reproducible package builds.
+---
+ tests/checker/test_http.py          | 2 ++
+ tests/checker/test_http_misc.py     | 2 ++
+ tests/checker/test_http_redirect.py | 2 ++
+ tests/checker/test_httpbin.py       | 5 +++++
+ tests/checker/test_misc.py          | 4 ++++
+ tests/checker/test_whitespace.py    | 3 +++
+ 6 files changed, 18 insertions(+)
+
+diff --git a/tests/checker/test_http.py b/tests/checker/test_http.py
+index e4c1e097..8a8af567 100644
+--- a/tests/checker/test_http.py
++++ b/tests/checker/test_http.py
+@@ -20,6 +20,7 @@
+ 
+ import pytest
+ 
++from tests import need_network
+ from .httpserver import HttpServerTest, CookieRedirectHttpRequestHandler
+ 
+ class TestHttp (HttpServerTest):
+@@ -29,6 +30,7 @@ def __init__(self, methodName='runTest'):
+         super(TestHttp, self).__init__(methodName=methodName)
+         self.handler = CookieRedirectHttpRequestHandler
+ 
++    @need_network
+     def test_html (self):
+         confargs = dict(recursionlevel=1)
+         self.file_test("http.html", confargs=confargs)
+diff --git a/tests/checker/test_http_misc.py b/tests/checker/test_http_misc.py
+index 9922d85f..c6b6afdb 100644
+--- a/tests/checker/test_http_misc.py
++++ b/tests/checker/test_http_misc.py
+@@ -20,11 +20,13 @@
+ import os
+ import sys
+ from .httpserver import HttpServerTest
++from tests import need_network
+ from linkcheck.network import iputil
+ 
+ class TestHttpMisc (HttpServerTest):
+     """Test http:// misc link checking."""
+ 
++    @need_network
+     def test_html (self):
+         self.swf_test()
+         self.obfuscate_test()
+diff --git a/tests/checker/test_http_redirect.py b/tests/checker/test_http_redirect.py
+index f212d98e..2253a70d 100644
+--- a/tests/checker/test_http_redirect.py
++++ b/tests/checker/test_http_redirect.py
+@@ -17,6 +17,7 @@
+ """
+ Test http checking.
+ """
++from tests import need_network
+ from .httpserver import HttpServerTest, CookieRedirectHttpRequestHandler
+ 
+ class TestHttpRedirect (HttpServerTest):
+@@ -26,6 +27,7 @@ def __init__(self, methodName='runTest'):
+         super(TestHttpRedirect, self).__init__(methodName=methodName)
+         self.handler = CookieRedirectHttpRequestHandler
+ 
++    @need_network
+     def test_redirect (self):
+         self.redirect1()
+         self.redirect2()
+diff --git a/tests/checker/test_httpbin.py b/tests/checker/test_httpbin.py
+index 0319c2f6..4c8fa846 100644
+--- a/tests/checker/test_httpbin.py
++++ b/tests/checker/test_httpbin.py
+@@ -18,6 +18,7 @@
+ Test http stuff with httpbin.org.
+ """
+ import re
++from tests import need_network
+ from . import LinkCheckTest
+ 
+ 
+@@ -30,6 +31,7 @@ def get_httpbin_url(path):
+ class TestHttpbin(LinkCheckTest):
+     """Test http:// link redirection checking."""
+ 
++    @need_network
+     def test_http_link(self):
+         linkurl = u"http://www.example.com"
+         nlinkurl = self.norm(linkurl)
+@@ -48,6 +50,7 @@ def test_http_link(self):
+         ]
+         self.direct(url, resultlines, recursionlevel=1)
+ 
++    @need_network
+     def test_basic_auth(self):
+         user = u"testuser"
+         password = u"testpassword"
+@@ -67,6 +70,7 @@ def test_basic_auth(self):
+         ]
+         self.direct(url, resultlines, confargs=confargs)
+ 
++    @need_network
+     def test_http_refresh_header(self):
+         linkurl = u"http://www.example.com"
+         nlinkurl = self.norm(linkurl)
+@@ -85,6 +89,7 @@ def test_http_refresh_header(self):
+         ]
+         self.direct(url, resultlines, recursionlevel=1)
+ 
++    @need_network
+     def test_http_content_location_header(self):
+         linkurl = u"http://www.example.com"
+         nlinkurl = self.norm(linkurl)
+diff --git a/tests/checker/test_misc.py b/tests/checker/test_misc.py
+index 2e4cfd07..f9591f9d 100644
+--- a/tests/checker/test_misc.py
++++ b/tests/checker/test_misc.py
+@@ -17,6 +17,7 @@
+ """
+ Test miscellaneous html tag parsing and URL types
+ """
++from tests import need_network
+ from . import LinkCheckTest
+ 
+ 
+@@ -25,15 +26,18 @@ class TestMisc (LinkCheckTest):
+     Test misc link types.
+     """
+ 
++    @need_network
+     def test_misc (self):
+         self.file_test("misc.html")
+ 
+     def test_html5 (self):
+         self.file_test("html5.html")
+ 
++    @need_network
+     def test_archive (self):
+         self.file_test("archive.html")
+ 
++    @need_network
+     def test_itms_services(self):
+         url = u"itms-services:?action=download-manifest&url=http://www.example.com/"
+         resultlines = [
+diff --git a/tests/checker/test_whitespace.py b/tests/checker/test_whitespace.py
+index 609c108a..fc2727d6 100644
+--- a/tests/checker/test_whitespace.py
++++ b/tests/checker/test_whitespace.py
+@@ -17,6 +17,7 @@
+ """
+ Test whitespace handling.
+ """
++from tests import need_network
+ from . import LinkCheckTest
+ 
+ 
+@@ -25,6 +26,7 @@ class TestWhitespace (LinkCheckTest):
+     Test whitespace in URLs.
+     """
+ 
++    @need_network
+     def test_leading_whitespace (self):
+         # Leading whitespace
+         url = u" http://www.example.org/"
+@@ -50,6 +52,7 @@ def test_leading_whitespace (self):
+         ]
+         self.direct(url, resultlines)
+ 
++    @need_network
+     def test_trailing_whitespace (self):
+         # Trailing whitespace
+         url = u"http://www.example.org/ "
diff --git a/gnu/packages/patches/p11-kit-jks-timestamps.patch b/gnu/packages/patches/p11-kit-jks-timestamps.patch
new file mode 100644
index 0000000000..8cb8ed8684
--- /dev/null
+++ b/gnu/packages/patches/p11-kit-jks-timestamps.patch
@@ -0,0 +1,42 @@
+Fix test failures induced by setting the SOURCE_DATE_EPOCH variable.
+
+Taken from upstream: <https://github.com/p11-glue/p11-kit/pull/213>.
+
+From 2a474e1fe8f4bd8b4ed7622e5cf3b2718a202562 Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <dueno@redhat.com>
+Date: Mon, 28 Jan 2019 13:03:15 +0100
+Subject: [PATCH] extract-jks: Prefer _p11_extract_jks_timestamp to
+ SOURCE_DATE_EPOCH
+
+Give _p11_extract_jks_timestamp precedence over SOURCE_DATE_EPOCH so
+that the test results are not affected by the envvar settings.
+---
+ trust/extract-jks.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/trust/extract-jks.c b/trust/extract-jks.c
+index ad8dc35..a6f855f 100644
+--- a/trust/extract-jks.c
++++ b/trust/extract-jks.c
+@@ -250,7 +250,9 @@ prepare_jks_buffer (p11_enumerate *ex,
+ 	 * when this was this certificate was added to the keystore, however
+ 	 * we don't have that information. Java uses time in milliseconds
+ 	 */
+-	{
++	if (_p11_extract_jks_timestamp)
++		now = _p11_extract_jks_timestamp;
++	else {
+ 		char *source_date_epoch;
+ 		source_date_epoch = secure_getenv ("SOURCE_DATE_EPOCH");
+ 		if (source_date_epoch) {
+@@ -276,9 +278,7 @@ prepare_jks_buffer (p11_enumerate *ex,
+ 				return false;
+ 			}
+ 			now = epoch;
+-		} else if (_p11_extract_jks_timestamp)
+-			now = _p11_extract_jks_timestamp;
+-		else
++		} else
+ 			now = time (NULL);
+ 	}
+ 
diff --git a/gnu/packages/patches/qemu-CVE-2018-16872.patch b/gnu/packages/patches/qemu-CVE-2018-16872.patch
new file mode 100644
index 0000000000..094e823ee4
--- /dev/null
+++ b/gnu/packages/patches/qemu-CVE-2018-16872.patch
@@ -0,0 +1,88 @@
+Fixes CVE-2018-16872:
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16872
+
+Patch copied from upstream source repository:
+
+https://git.qemu.org/?p=qemu.git;a=commitdiff;h=bab9df35ce73d1c8e19a37e2737717ea1c984dc1
+
+From bab9df35ce73d1c8e19a37e2737717ea1c984dc1 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 13 Dec 2018 13:25:11 +0100
+Subject: [PATCH] usb-mtp: use O_NOFOLLOW and O_CLOEXEC.
+
+Open files and directories with O_NOFOLLOW to avoid symlinks attacks.
+While being at it also add O_CLOEXEC.
+
+usb-mtp only handles regular files and directories and ignores
+everything else, so users should not see a difference.
+
+Because qemu ignores symlinks, carrying out a successful symlink attack
+requires swapping an existing file or directory below rootdir for a
+symlink and winning the race against the inotify notification to qemu.
+
+Fixes: CVE-2018-16872
+Cc: Prasad J Pandit <ppandit@redhat.com>
+Cc: Bandan Das <bsd@redhat.com>
+Reported-by: Michael Hanselmann <public@hansmi.ch>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Michael Hanselmann <public@hansmi.ch>
+Message-id: 20181213122511.13853-1-kraxel@redhat.com
+---
+ hw/usb/dev-mtp.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
+index 100b7171f4..36c43b8c20 100644
+--- a/hw/usb/dev-mtp.c
++++ b/hw/usb/dev-mtp.c
+@@ -653,13 +653,18 @@ static void usb_mtp_object_readdir(MTPState *s, MTPObject *o)
+ {
+     struct dirent *entry;
+     DIR *dir;
++    int fd;
+ 
+     if (o->have_children) {
+         return;
+     }
+     o->have_children = true;
+ 
+-    dir = opendir(o->path);
++    fd = open(o->path, O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW);
++    if (fd < 0) {
++        return;
++    }
++    dir = fdopendir(fd);
+     if (!dir) {
+         return;
+     }
+@@ -1007,7 +1012,7 @@ static MTPData *usb_mtp_get_object(MTPState *s, MTPControl *c,
+ 
+     trace_usb_mtp_op_get_object(s->dev.addr, o->handle, o->path);
+ 
+-    d->fd = open(o->path, O_RDONLY);
++    d->fd = open(o->path, O_RDONLY | O_CLOEXEC | O_NOFOLLOW);
+     if (d->fd == -1) {
+         usb_mtp_data_free(d);
+         return NULL;
+@@ -1031,7 +1036,7 @@ static MTPData *usb_mtp_get_partial_object(MTPState *s, MTPControl *c,
+                                         c->argv[1], c->argv[2]);
+ 
+     d = usb_mtp_data_alloc(c);
+-    d->fd = open(o->path, O_RDONLY);
++    d->fd = open(o->path, O_RDONLY | O_CLOEXEC | O_NOFOLLOW);
+     if (d->fd == -1) {
+         usb_mtp_data_free(d);
+         return NULL;
+@@ -1658,7 +1663,7 @@ static void usb_mtp_write_data(MTPState *s)
+                                  0, 0, 0, 0);
+             goto done;
+         }
+-        d->fd = open(path, O_CREAT | O_WRONLY, mask);
++        d->fd = open(path, O_CREAT | O_WRONLY | O_CLOEXEC | O_NOFOLLOW, mask);
+         if (d->fd == -1) {
+             usb_mtp_queue_result(s, RES_STORE_FULL, d->trans,
+                                  0, 0, 0, 0);
+-- 
+2.20.1
+
diff --git a/gnu/packages/patches/qemu-CVE-2019-6778.patch b/gnu/packages/patches/qemu-CVE-2019-6778.patch
new file mode 100644
index 0000000000..315f2922da
--- /dev/null
+++ b/gnu/packages/patches/qemu-CVE-2019-6778.patch
@@ -0,0 +1,43 @@
+Fixes CVE-2019-6778:
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6778
+
+Patch copied from upstream source repository:
+
+https://git.qemu.org/?p=qemu.git;a=commitdiff;h=a7104eda7dab99d0cdbd3595c211864cba415905
+
+From a7104eda7dab99d0cdbd3595c211864cba415905 Mon Sep 17 00:00:00 2001
+From: Prasad J Pandit <pjp@fedoraproject.org>
+Date: Sun, 13 Jan 2019 23:29:48 +0530
+Subject: [PATCH] slirp: check data length while emulating ident function
+
+While emulating identification protocol, tcp_emu() does not check
+available space in the 'sc_rcv->sb_data' buffer. It could lead to
+heap buffer overflow issue. Add check to avoid it.
+
+Reported-by: Kira <864786842@qq.com>
+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+---
+ slirp/tcp_subr.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/slirp/tcp_subr.c b/slirp/tcp_subr.c
+index 4a9a5b5edc..23a841f26e 100644
+--- a/slirp/tcp_subr.c
++++ b/slirp/tcp_subr.c
+@@ -634,6 +634,11 @@ tcp_emu(struct socket *so, struct mbuf *m)
+ 			socklen_t addrlen = sizeof(struct sockaddr_in);
+ 			struct sbuf *so_rcv = &so->so_rcv;
+ 
++			if (m->m_len > so_rcv->sb_datalen
++					- (so_rcv->sb_wptr - so_rcv->sb_data)) {
++			    return 1;
++			}
++
+ 			memcpy(so_rcv->sb_wptr, m->m_data, m->m_len);
+ 			so_rcv->sb_wptr += m->m_len;
+ 			so_rcv->sb_rptr += m->m_len;
+-- 
+2.20.1
+
diff --git a/gnu/packages/patches/scotch-graph-diam-64.patch b/gnu/packages/patches/scotch-graph-diam-64.patch
deleted file mode 100644
index 2ae31e3c3b..0000000000
--- a/gnu/packages/patches/scotch-graph-diam-64.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-Fixes test_scotch_graph_diam test with -DINTSIZE64.
-
-Reported upstream at
-https://gforge.inria.fr/tracker/index.php?func=detail&aid=21650&group_id=248&atid=1081
-
---- scotch-6.0.5a/src/libscotch/library.h
-+++ scotch-6.0.5a/src/libscotch/library.h
-@@ -187,6 +187,7 @@ SCOTCH_Num                  SCOTCH_graphBase    (SCOTCH_Graph * const, const SCO
- int                         SCOTCH_graphCheck   (const SCOTCH_Graph * const);
- void                        SCOTCH_graphSize    (const SCOTCH_Graph * const, SCOTCH_Num * const, SCOTCH_Num * const);
- void                        SCOTCH_graphData    (const SCOTCH_Graph * const, SCOTCH_Num * const, SCOTCH_Num * const, SCOTCH_Num ** const, SCOTCH_Num ** const, SCOTCH_Num ** const, SCOTCH_Num ** const, SCOTCH_Num * const, SCOTCH_Num ** const, SCOTCH_Num ** const);
-+SCOTCH_Num                  SCOTCH_graphDiamPV  (SCOTCH_Graph * const);
- void                        SCOTCH_graphStat    (const SCOTCH_Graph * const, SCOTCH_Num * const, SCOTCH_Num * const, SCOTCH_Num * const, double * const, double * const, SCOTCH_Num * const, SCOTCH_Num * const, double * const, double * const, SCOTCH_Num * const, SCOTCH_Num * const, SCOTCH_Num * const, double * const, double * const);
- int                         SCOTCH_graphCoarsen (const SCOTCH_Graph * const, const SCOTCH_Num, const double, const SCOTCH_Num, SCOTCH_Graph * const, SCOTCH_Num * const);
- int                         SCOTCH_graphCoarsenMatch (const SCOTCH_Graph * const, SCOTCH_Num * const, const double, const SCOTCH_Num, SCOTCH_Num * const);
---- scotch-6.0.5a/src/libscotch/library_graph_diam.c
-+++ scotch-6.0.5a/src/libscotch/library_graph_diam.c
-@@ -72,8 +72,7 @@
- 
- SCOTCH_Num
- SCOTCH_graphDiamPV (
--SCOTCH_Graph * const        grafptr,
--const SCOTCH_Num            baseval)
-+SCOTCH_Graph * const        grafptr)
- {
-   return ((SCOTCH_Num) graphDiamPV ((Graph * const) grafptr));
- }
diff --git a/gnu/packages/patches/scotch-graph-induce-type-64.patch b/gnu/packages/patches/scotch-graph-induce-type-64.patch
deleted file mode 100644
index d2eee52a7b..0000000000
--- a/gnu/packages/patches/scotch-graph-induce-type-64.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-Fixes return type of SCOTCH_graphInduceList and SCOTCH_graphInducePart
-so that the definition matches with -DINTSIZE64.
-
-Reported upstream at
-https://gforge.inria.fr/tracker/index.php?func=detail&aid=21608&group_id=248&atid=1081
-
---- scotch_6.0.5a/src/libscotch/library.h.orig	2018-02-11 10:52:38.000000000 -0600
-+++ scotch_6.0.5a/src/libscotch/library.h	2018-02-23 16:56:41.000000000 -0600
-@@ -199,8 +199,8 @@
- int                         SCOTCH_graphGeomSaveChac (const SCOTCH_Graph * const, const SCOTCH_Geom * const, FILE * const, FILE * const, const char * const);
- int                         SCOTCH_graphGeomSaveMmkt (const SCOTCH_Graph * const, const SCOTCH_Geom * const, FILE * const, FILE * const, const char * const);
- int                         SCOTCH_graphGeomSaveScot (const SCOTCH_Graph * const, const SCOTCH_Geom * const, FILE * const, FILE * const, const char * const);
--int                         SCOTCH_graphInduceList (const SCOTCH_Graph * const, const SCOTCH_Num, const SCOTCH_Num * const, SCOTCH_Graph * const);
--int                         SCOTCH_graphInducePart (const SCOTCH_Graph * const, const SCOTCH_Num, const SCOTCH_GraphPart2 * const, const SCOTCH_GraphPart2, SCOTCH_Graph * const);
-+SCOTCH_Num                  SCOTCH_graphInduceList (const SCOTCH_Graph * const, const SCOTCH_Num, const SCOTCH_Num * const, SCOTCH_Graph * const);
-+SCOTCH_Num                  SCOTCH_graphInducePart (const SCOTCH_Graph * const, const SCOTCH_Num, const SCOTCH_GraphPart2 * const, const SCOTCH_GraphPart2, SCOTCH_Graph * const);
- 
- int                         SCOTCH_graphMapInit (const SCOTCH_Graph * const, SCOTCH_Mapping * const, const SCOTCH_Arch * const, SCOTCH_Num * const);
- void                        SCOTCH_graphMapExit (const SCOTCH_Graph * const, SCOTCH_Mapping * const);
diff --git a/gnu/packages/patches/scotch-integer-declarations.patch b/gnu/packages/patches/scotch-integer-declarations.patch
new file mode 100644
index 0000000000..978625c1c0
--- /dev/null
+++ b/gnu/packages/patches/scotch-integer-declarations.patch
@@ -0,0 +1,37 @@
+diff --git a/src/libscotch/library.h b/src/libscotch/library.h
+index 1891c19..ecc0533 100644
+--- a/src/libscotch/library.h
++++ b/src/libscotch/library.h
+@@ -67,6 +67,8 @@
+ 
+ /*+ Integer type. +*/
+ 
++#include <stdint.h>
++
+ typedef DUMMYIDX SCOTCH_Idx;
+ 
+ typedef DUMMYINT SCOTCH_Num;
+diff --git a/src/libscotchmetis/library_metis.h b/src/libscotchmetis/library_metis.h
+index e6767e1..04e71c3 100644
+--- a/src/libscotchmetis/library_metis.h
++++ b/src/libscotchmetis/library_metis.h
+@@ -99,6 +99,7 @@ typedef enum {
+ */
+ 
+ #ifndef SCOTCH_H                                  /* In case "scotch.h" not included before */
++#include <stdint.h>
+ typedef DUMMYINT SCOTCH_Num;
+ #endif /* SCOTCH_H */
+ 
+diff --git a/src/libscotchmetis/library_parmetis.h b/src/libscotchmetis/library_parmetis.h
+index 6d2f0b0..3c803fc 100644
+--- a/src/libscotchmetis/library_parmetis.h
++++ b/src/libscotchmetis/library_parmetis.h
+@@ -106,6 +106,7 @@ typedef enum {
+ */
+ 
+ #ifndef SCOTCH_H                                  /* In case "scotch.h" not included before */
++#include <stdint.h>
+ typedef DUMMYINT SCOTCH_Num;
+ #endif /* SCOTCH_H */
+ 
diff --git a/gnu/packages/patches/scotch-test-threading.patch b/gnu/packages/patches/scotch-test-threading.patch
deleted file mode 100644
index de8cc49c41..0000000000
--- a/gnu/packages/patches/scotch-test-threading.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-Fix this test so that it succeeds when the library is not compiled with
-SCOTCH_PTHREAD.
-
---- scotch_6.0.4/src/check/test_common_thread.c	2014-09-28 11:39:59.000000000 -0500
-+++ scotch_6.0.4/src/check/test_common_thread.c	2015-01-10 00:52:00.076229542 -0600
-@@ -175,14 +175,14 @@
- char *              argv[])
- {
-   TestThreadGroup       groudat;
--#if ((defined COMMON_PTHREAD) || (defined SCOTCH_PTHREAD))
-+#if ((defined COMMON_PTHREAD) && (defined SCOTCH_PTHREAD))
-   TestThread * restrict thrdtab;
-   int                   thrdnbr;
- #endif /* ((defined COMMON_PTHREAD) || (defined SCOTCH_PTHREAD)) */
- 
-   SCOTCH_errorProg (argv[0]);
- 
--#if ((defined COMMON_PTHREAD) || (defined SCOTCH_PTHREAD))
-+#if ((defined COMMON_PTHREAD) && (defined SCOTCH_PTHREAD))
-   thrdnbr = SCOTCH_PTHREAD_NUMBER;
- 
-   groudat.redusum = COMPVAL (thrdnbr);
diff --git a/gnu/packages/patches/superlu-dist-awpm-grid.patch b/gnu/packages/patches/superlu-dist-awpm-grid.patch
new file mode 100644
index 0000000000..d6cb8e521d
--- /dev/null
+++ b/gnu/packages/patches/superlu-dist-awpm-grid.patch
@@ -0,0 +1,36 @@
+Create the CombBLAS::SpParMat with the MPI_Comm from the input 'gridinfo_t'.
+This prevents a warning/error from CombBLAS about using MPI_COMM_WORLD.
+
+--- a/SRC/AWPM_CombBLAS.hpp
++++ b/SRC/AWPM_CombBLAS.hpp
+@@ -52,7 +52,7 @@
+     {
+         printf("AWPM only supports square process grid. Retuning without a permutation.\n");
+     }
+-    combblas::SpParMat < int_t, double, combblas::SpDCCols<int_t,double> > Adcsc;
++    combblas::SpParMat < int_t, double, combblas::SpDCCols<int_t,double> > Adcsc(grid->comm);
+     std::vector< std::vector < std::tuple<int_t,int_t,double> > > data(procs);
+     
+     /* ------------------------------------------------------------
+@@ -100,11 +100,10 @@
+     combblas::AWPM(Adcsc, mateRow2Col, mateCol2Row,true);
+     
+     // now gather the matching vector
+-    MPI_Comm World = mateRow2Col.getcommgrid()->GetWorld();
+     int * rdispls = new int[procs];
+     int sendcnt = mateRow2Col.LocArrSize();
+     int * recvcnt = new int[procs];
+-    MPI_Allgather(&sendcnt, 1, MPI_INT, recvcnt, 1, MPI_INT, World);
++    MPI_Allgather(&sendcnt, 1, MPI_INT, recvcnt, 1, MPI_INT, grid->comm);
+     rdispls[0] = 0;
+     for(int i=0; i<procs-1; ++i)
+     {
+@@ -112,7 +111,7 @@
+     }
+     int_t *senddata = (int_t *)mateRow2Col.GetLocArr();
+     
+-    MPI_Allgatherv(senddata, sendcnt, combblas::MPIType<int_t>(), ScalePermstruct->perm_r, recvcnt, rdispls, combblas::MPIType<int_t>(), World);
++    MPI_Allgatherv(senddata, sendcnt, combblas::MPIType<int_t>(), ScalePermstruct->perm_r, recvcnt, rdispls, combblas::MPIType<int_t>(), grid->comm);
+     
+     delete[] rdispls;
+     delete[] recvcnt;
diff --git a/gnu/packages/patches/x265-detect512-all-arches.patch b/gnu/packages/patches/x265-detect512-all-arches.patch
deleted file mode 100644
index 4d39d868fd..0000000000
--- a/gnu/packages/patches/x265-detect512-all-arches.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-https://sources.debian.org/data/main/x/x265/2.9-3/debian/patches/0003-detect512-is-needed-on-all-architectures.patch
-
-From: Adam Sampson <unknown@bitbucket>
-Date: Sun, 14 Oct 2018 14:04:18 +0200
-Subject: detect512 is needed on all architectures
-
----
- source/common/cpu.cpp | 9 +++++----
- 1 file changed, 5 insertions(+), 4 deletions(-)
-
-diff --git a/source/common/cpu.cpp b/source/common/cpu.cpp
-index 0681ff5..fa687da 100644
---- a/source/common/cpu.cpp
-+++ b/source/common/cpu.cpp
-@@ -110,6 +110,11 @@ const cpu_name_t cpu_names[] =
-     { "", 0 },
- };
- 
-+bool detect512()
-+{
-+    return(enable512);
-+}
-+
- #if X265_ARCH_X86
- 
- extern "C" {
-@@ -123,10 +128,6 @@ uint64_t PFX(cpu_xgetbv)(int xcr);
- #pragma warning(disable: 4309) // truncation of constant value
- #endif
- 
--bool detect512()
--{
--    return(enable512);
--}
- uint32_t cpu_detect(bool benableavx512 )
- {
-