Merge branch 'master' into core-updates

46 files changed, 2843 insertions, 255 deletions

diff --git a/gnu/packages/patches/bluez-tests.patch b/gnu/packages/patches/bluez-tests.patch
new file mode 100644
index 0000000000..608ded9be2
--- /dev/null
+++ b/gnu/packages/patches/bluez-tests.patch
@@ -0,0 +1,25 @@
+From 484ad8c9263bb524051a999ce19a994960e69572 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=E5=AE=8B=E6=96=87=E6=AD=A6?= <iyzsong@gmail.com>
+Date: Fri, 23 Oct 2015 20:48:57 +0800
+Subject: [PATCH] unit/test-gobex-header: Fix duplicate test names
+
+---
+ unit/test-gobex-header.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/unit/test-gobex-header.c b/unit/test-gobex-header.c
+index 6f49312..8705892 100644
+--- a/unit/test-gobex-header.c
++++ b/unit/test-gobex-header.c
+@@ -554,7 +554,7 @@ int main(int argc, char *argv[])
+ 					test_header_encode_name_umlaut);
+ 	g_test_add_func("/gobex/test_header_encode_body",
+ 						test_header_encode_body);
+-	g_test_add_func("/gobex/test_header_encode_connid",
++	g_test_add_func("/gobex/test_header_encode_actionid",
+ 						test_header_encode_actionid);
+ 	g_test_add_func("/gobex/test_header_encode_apparam",
+ 						test_header_encode_apparam);
+-- 
+2.5.0
+
diff --git a/gnu/packages/patches/byobu-writable-status.patch b/gnu/packages/patches/byobu-writable-status.patch
new file mode 100644
index 0000000000..2858280273
--- /dev/null
+++ b/gnu/packages/patches/byobu-writable-status.patch
@@ -0,0 +1,13 @@
+Skeleton status files are installed read-only.  When copying to the config dir
+upon initialization, make sure they end up writable.
+
+--- byobu-5.98/usr/bin/byobu-janitor.in
++++ byobu-5.98/usr/bin/byobu-janitor.in
+@@ -82,6 +82,7 @@
+ 	if [ ! -r "$BYOBU_CONFIG_DIR/$f" ]; then
+ 		# Copy from skeleton, if possible
+ 		cp -f "$BYOBU_PREFIX/share/$PKG/status/$f" "$BYOBU_CONFIG_DIR/$f"
++		chmod +w "$BYOBU_CONFIG_DIR/$f"
+ 		# Enable ec2_cost, if we're in ec2 and seeding a new setup
+ 		if metadata_available; then
+ 			$BYOBU_SED_INLINE -e "s/#ec2_cost/ec2_cost/g" "$($BYOBU_READLINK -f $BYOBU_CONFIG_DIR/$f)"
diff --git a/gnu/packages/patches/dbus-helper-search-path.patch b/gnu/packages/patches/dbus-helper-search-path.patch
new file mode 100644
index 0000000000..30c142312b
--- /dev/null
+++ b/gnu/packages/patches/dbus-helper-search-path.patch
@@ -0,0 +1,18 @@
+The setuid helper of D-Bus is responsible for "service activation".
+It looks for '.service' files in fixed locations, but the default locations
+make no sense (see below), so replace them with /etc/dbus-1/system-services.
+
+--- dbus-1.10.0/dbus/dbus-sysdeps-util-unix.c	2015-10-22 00:07:03.829251854 +0200
++++ dbus-1.10.0/dbus/dbus-sysdeps-util-unix.c	2015-10-22 00:07:14.893445175 +0200
+@@ -1410,10 +1410,7 @@ _dbus_get_standard_system_servicedirs (D
+    * be available.
+    */
+   static const char standard_search_path[] =
+-    "/usr/local/share:"
+-    "/usr/share:"
+-    DBUS_DATADIR ":"
+-    "/lib";
++    "/etc";
+   DBusString servicedir_path;
+ 
+   _dbus_string_init_const (&servicedir_path, standard_search_path);
diff --git a/gnu/packages/patches/dbus-localstatedir.patch b/gnu/packages/patches/dbus-localstatedir.patch
deleted file mode 100644
index 61bed91b5c..0000000000
--- a/gnu/packages/patches/dbus-localstatedir.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-Do not try to create $localstatedir and $sysconfdir since we cannot do this
-when they are /var and /etc.
-
---- dbus-1.6.4/bus/Makefile.in	2013-09-11 16:15:13.000000000 +0200
-+++ dbus-1.6.4/bus/Makefile.in	2013-09-11 16:15:15.000000000 +0200
-@@ -1510,9 +1510,6 @@ clean-local:
- 	/bin/rm *.bb *.bbg *.da *.gcov || true
- 
- install-data-hook:
--	$(mkinstalldirs) $(DESTDIR)$(localstatedir)/run/dbus
--	$(mkinstalldirs) $(DESTDIR)$(configdir)/system.d
--	$(mkinstalldirs) $(DESTDIR)$(configdir)/session.d
- 	$(mkinstalldirs) $(DESTDIR)$(datadir)/dbus-1/services
- 	$(mkinstalldirs) $(DESTDIR)$(datadir)/dbus-1/system-services
- # Install dbus.socket as default implementation of a D-Bus stack.
-
---- dbus-1.6.4/tools/Makefile.in	2013-09-11 16:10:31.000000000 +0200
-+++ dbus-1.6.4/tools/Makefile.in	2013-09-11 16:10:32.000000000 +0200
-@@ -757,11 +757,6 @@ uninstall-am: uninstall-binPROGRAMS
- 
- 
- # create the /var/lib/dbus directory for dbus-uuidgen
--install-data-local:
--	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/dbus
--
--installcheck-local:
--	test -d $(DESTDIR)$(localstatedir)/lib/dbus
- 
- # Tell versions [3.59,3.63) of GNU make to not export all variables.
- # Otherwise a system limit (for SysV at least) may be exceeded.
diff --git a/gnu/packages/patches/devil-fix-libpng.patch b/gnu/packages/patches/devil-fix-libpng.patch
new file mode 100644
index 0000000000..a8e90333a3
--- /dev/null
+++ b/gnu/packages/patches/devil-fix-libpng.patch
@@ -0,0 +1,36 @@
+From 724194d7a9a91221a564579f64bdd6f0abd64219 Mon Sep 17 00:00:00 2001
+From: Noah Mayr <max96at@gmail.com>
+Date: Sun, 1 Mar 2015 10:10:56 +0100
+Subject: [PATCH] Fixed deprecated libpng API usage.
+
+---
+ src-IL/src/il_icon.c | 2 +-
+ src-IL/src/il_png.c  | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src-IL/src/il_icon.c b/src-IL/src/il_icon.c
+index 2ccb1a3..fd9475d 100644
+--- a/src-IL/src/il_icon.c
++++ b/src-IL/src/il_icon.c
+@@ -525,7 +525,7 @@ ILboolean ico_readpng_get_image(ICOIMAGE *Icon, ILdouble display_exponent)
+
+ 	// Expand low-bit-depth grayscale images to 8 bits
+ 	if (ico_color_type == PNG_COLOR_TYPE_GRAY && bit_depth < 8) {
+-		png_set_gray_1_2_4_to_8(ico_png_ptr);
++		png_set_expand_gray_1_2_4_to_8(ico_png_ptr);
+ 	}
+
+ 	// Expand RGB images with transparency to full alpha channels
+diff --git a/src-IL/src/il_png.c b/src-IL/src/il_png.c
+index da9517d..2866508 100644
+--- a/src-IL/src/il_png.c
++++ b/src-IL/src/il_png.c
+@@ -277,7 +277,7 @@ ILboolean readpng_get_image(ILdouble display_exponent)
+
+ 	// Expand low-bit-depth grayscale images to 8 bits
+ 	if (png_color_type == PNG_COLOR_TYPE_GRAY && bit_depth < 8) {
+-		png_set_gray_1_2_4_to_8(png_ptr);
++		png_set_expand_gray_1_2_4_to_8(png_ptr);
+ 	}
+
+ 	// Expand RGB images with transparency to full alpha channels
diff --git a/gnu/packages/patches/dico-libtool-deterministic.patch b/gnu/packages/patches/dico-libtool-deterministic.patch
new file mode 100644
index 0000000000..957fc79786
--- /dev/null
+++ b/gnu/packages/patches/dico-libtool-deterministic.patch
@@ -0,0 +1,15 @@
+Dico 2.2 uses an old Libtool (2.2.7a) that did not sort the output
+of 'find', thereby leading to non-deterministic file name ordering
+in the arguments passed to 'ar rcu' for libdico.a & co.
+
+--- dico-2.2/build-aux/ltmain.sh	1970-01-01 01:00:00.000000000 +0100
++++ dico-2.2/build-aux/ltmain.sh	2015-11-25 09:39:30.826169050 +0100
+@@ -2926,7 +2926,7 @@ func_extract_archives ()
+         func_extract_an_archive "$my_xdir" "$my_xabs"
+ 	;;
+       esac
+-      my_oldobjs="$my_oldobjs "`find $my_xdir -name \*.$objext -print -o -name \*.lo -print | $NL2SP`
++      my_oldobjs="$my_oldobjs "`find $my_xdir -name \*.$objext -print -o -name \*.lo -print | sort | $NL2SP`
+     done
+ 
+     func_extract_archives_result="$my_oldobjs"
diff --git a/gnu/packages/patches/eudev-rules-directory.patch b/gnu/packages/patches/eudev-rules-directory.patch
index 9173e22f76..54fc01c6d5 100644
--- a/gnu/packages/patches/eudev-rules-directory.patch
+++ b/gnu/packages/patches/eudev-rules-directory.patch
@@ -4,9 +4,9 @@ The old udev 182 supported $UDEV_CONFIG_FILE, which in turn allowed
 the search path to be customized, but eudev no longer has this, hence
 this hack.
 
---- eudev-1.9/src/udev/udev-rules.c	2014-09-13 10:21:59.615980259 +0200
-+++ eudev-1.9/src/udev/udev-rules.c	2014-09-13 10:24:13.839976335 +0200
-@@ -46,15 +46,11 @@
+--- eudev-3.1.5/src/udev/udev-rules.c	2015-10-13 06:22:14.000000000 +0800
++++ eudev-3.1.5/src/udev/udev-rules.c	2015-10-16 20:45:38.491934336 +0800
+@@ -47,15 +47,11 @@
          };
  };
  
@@ -14,23 +14,23 @@ this hack.
 +static const char* rules_dirs[] = {
          UDEV_CONF_DIR "/rules.d",
          UDEV_RULES_DIR,
--        "/run/udev/rules.d",
+-        UDEV_ROOT_RUN "/udev/rules.d",
          UDEV_LIBEXEC_DIR "/rules.d",
 -#ifdef HAVE_SPLIT_USR
 -        "/lib/udev/rules.d",
 -        "/usr/lib/udev/rules.d",
 -#endif
-+	NULL,			  /* placeholder for $EUDEV_RULES_DIRECTORY */
++        NULL,			/* placeholder for $EUDEV_RULES_DIRECTORY */
          NULL};
  
  struct udev_rules {
-@@ -1637,6 +1633,9 @@
+@@ -1704,6 +1700,9 @@
  
          udev_rules_check_timestamp(rules);
  
-+	/* Allow the user to specify an additional rules directory.  */
-+	rules_dirs[3] = getenv("EUDEV_RULES_DIRECTORY");
++        /* Allow the user to specify an additional rules directory.  */
++        rules_dirs[3] = getenv("EUDEV_RULES_DIRECTORY");
 +
          r = conf_files_list_strv(&files, ".rules", NULL, rules_dirs);
          if (r < 0) {
-                 log_error("failed to enumerate rules files: %s", strerror(-r));
+                 log_error_errno(r, "failed to enumerate rules files: %m");
diff --git a/gnu/packages/patches/evilwm-lost-focus-bug.patch b/gnu/packages/patches/evilwm-lost-focus-bug.patch
new file mode 100644
index 0000000000..af24af8fe9
--- /dev/null
+++ b/gnu/packages/patches/evilwm-lost-focus-bug.patch
@@ -0,0 +1,18 @@
+evilwm may sometimes lose focus after closing a window.  This means that
+evilwm stops responding to keyboard shortcuts, and if no other window is open
+which the mouse can be moved over to regain focus evilwm becomes unusable and
+has to be restarted.
+
+Patch derived from discussion at
+https://wiki.archlinux.org/index.php/Evilwm#Lost_focus_bug_fix
+
+--- evilwm-1.1.1/client.c
++++ evilwm-1.1.1/client.c
+@@ -172,6 +172,7 @@
+ 	 *  _NET_WM_STATE) */
+ 	if (c->remove) {
+ 		LOG_DEBUG("setting WithdrawnState\n");
++		XSetInputFocus(dpy, PointerRoot, RevertToPointerRoot, CurrentTime);
+ 		set_wm_state(c, WithdrawnState);
+ 		ewmh_withdraw_client(c);
+ 	} else {
diff --git a/gnu/packages/patches/glib-tests-desktop.patch b/gnu/packages/patches/glib-tests-desktop.patch
index 61f48607f7..642234ebbc 100644
--- a/gnu/packages/patches/glib-tests-desktop.patch
+++ b/gnu/packages/patches/glib-tests-desktop.patch
@@ -56,11 +56,12 @@ database, the `update-desktop-database' program, which we don't provide.
 
 -----------------------------
 The hunk below removes tests that depend on `gdbus-testserver.py',
-because that script depends on python-gobject.
+because that script depends on python-gobject.  The second hunk
+disables a test that expects /etc/machine-id in the build environment.
  
---- glib-2.39.1/gio/tests/Makefile.in	2014-01-20 00:18:16.000000000 +0100
-+++ glib-2.39.1/gio/tests/Makefile.in	2014-01-20 00:18:47.000000000 +0100
-@@ -171,20 +171,13 @@ check_PROGRAMS = $(am__EXEEXT_14)
+--- glib-2.46.0/gio/tests/Makefile.in	2015-10-14 14:11:00.928809504 +0200
++++ glib-2.46.0/gio/tests/Makefile.in	2015-10-14 14:12:13.157291092 +0200
+@@ -186,20 +186,13 @@ check_PROGRAMS = $(am__EXEEXT_16)
  @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-auth				\
  @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-bz627724				\
  @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-close-pending			\
@@ -79,7 +80,16 @@ because that script depends on python-gobject.
  @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-test-codegen-old			\
 -@HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gdbus-threading				\
  @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gmenumodel				\
+ @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	gnotification				\
  @HAVE_DBUS_DAEMON_TRUE@@OS_UNIX_TRUE@	$(NULL)
+@@ -321,8 +314,7 @@ libresourceplugin_la_LINK = $(LIBTOOL) $
+ am__EXEEXT_1 =
+ @OS_UNIX_TRUE@am__EXEEXT_2 = contenttype$(EXEEXT) file$(EXEEXT) \
+ @OS_UNIX_TRUE@	gdbus-peer-object-manager$(EXEEXT) \
+-@OS_UNIX_TRUE@	gdbus-unix-addresses$(EXEEXT) \
+ @OS_UNIX_TRUE@	live-g-file$(EXEEXT) socket-address$(EXEEXT) \
+ @OS_UNIX_TRUE@	stream-rw_all$(EXEEXT) unix-fd$(EXEEXT) \
+ @OS_UNIX_TRUE@	unix-streams$(EXEEXT) $(am__EXEEXT_1) \
   
 
 The test below depends on the availability /etc/passwd to dbus-daemon.
diff --git a/gnu/packages/patches/gsl-poly-test-fix-pt1.patch b/gnu/packages/patches/gsl-poly-test-fix-pt1.patch
deleted file mode 100644
index 3d1ed4243c..0000000000
--- a/gnu/packages/patches/gsl-poly-test-fix-pt1.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 9cc12d0377dd634b1b97954d076b715f982853b7 Mon Sep 17 00:00:00 2001
-From: Patrick Alken <alken@colorado.edu>
-Date: Fri, 4 Apr 2014 13:36:16 -0600
-Subject: [PATCH] bug fix in sorting of complex numbers (bug #39055)
-
----
- poly/test.c | 49 ++++++++++++++++++++++++++++++-------------------
- 1 file changed, 30 insertions(+), 19 deletions(-)
-
-diff --git a/poly/test.c b/poly/test.c
-index 9c147f6..d090802 100644
---- a/poly/test.c
-+++ b/poly/test.c
-@@ -25,11 +25,21 @@
- #include <gsl/gsl_poly.h>
- #include <gsl/gsl_heapsort.h>
- 
-+/* sort by Re(z) then by Im(z) */
- static int
- cmp_cplx(const double *a, const double *b)
- {
--	double t = (a[0] * a[0] + a[1] * a[1]) - (b[0] * b[0] + b[1] * b[1]);
--	return t < 0.0 ? -1 : t > 0.0 ? 1 : 0;
-+  double r = a[0] - b[0];
-+
-+  if (r == 0.0)
-+    {
-+      double t = a[1] - b[1];
-+	    return t < 0.0 ? -1 : t > 0.0 ? 1 : 0;
-+    }
-+  else if (r < 0.0)
-+    return -1;
-+  else
-+    return 1;
- }
- 
- int
-@@ -534,25 +544,26 @@ main (void)
-        Problem reported by Munagala Ramanath (bug #39055)
-     */
- 
--    double a[16] = { 32, -48, -8, 28, -8, 16, -16, 12, -16, 6, 10, -17, 10, 2, -4, 1 };
-+    double a[16] = { 32, -48, -8, 28, -8, 16, -16, 12,
-+                    -16, 6, 10, -17, 10, 2, -4, 1 };
-     double z[16*2];
- 
--    double expected[16*20] = {
--	   1.0000000000000000,  0.00000000000000000,
--	   1.0000000000000000,  0.00000000000000000,
--	  -1.0000000000000000,  0.00000000000000000,
--	 -0.65893856175240950,  0.83459757287426684,
--	 -0.65893856175240950, -0.83459757287426684,
--	-0.070891117403341281,  -1.1359249087587791,
--	-0.070891117403341281,   1.1359249087587791,
--	   1.1142366961812986, -0.48083981203389980,
--	   1.1142366961812986,  0.48083981203389980,
--	  -1.3066982484920768,  0.00000000000000000,
--	  0.57284747839410854,   1.1987808988289705,
--	  0.57284747839410854,  -1.1987808988289705,
--	  -1.6078107423472359,  0.00000000000000000,
--	   2.0000000000000000,  0.00000000000000000,
--	   2.0000000000000000,  0.00000000000000000 };
-+    double expected[16*2] = {
-+     -1.6078107423472359,    0.00000000000000000,
-+     -1.3066982484920768,    0.00000000000000000,
-+     -1.0000000000000000,    0.00000000000000000,
-+     -0.65893856175240950,  -0.83459757287426684,
-+     -0.65893856175240950,   0.83459757287426684,
-+     -0.070891117403341281, -1.1359249087587791,
-+     -0.070891117403341281,  1.1359249087587791,
-+      0.57284747839410854,  -1.1987808988289705,
-+      0.57284747839410854,   1.1987808988289705,
-+      1.0000000000000000,    0.00000000000000000,
-+      1.0000000000000000,    0.00000000000000000,
-+      1.1142366961812986,   -0.48083981203389980,
-+      1.1142366961812986,    0.48083981203389980,
-+      2.0000000000000000,    0.00000000000000000,
-+      2.0000000000000000,    0.00000000000000000 };
- 
-     int i;
- 
--- 
-2.4.3
-
diff --git a/gnu/packages/patches/gsl-poly-test-fix-pt2.patch b/gnu/packages/patches/gsl-poly-test-fix-pt2.patch
deleted file mode 100644
index 0e6fcf1a53..0000000000
--- a/gnu/packages/patches/gsl-poly-test-fix-pt2.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 0466df8660a7b6ddf2e082a1ec38bc6ea25a3c5c Mon Sep 17 00:00:00 2001
-From: Patrick Alken <alken@colorado.edu>
-Date: Mon, 7 Apr 2014 10:59:58 -0600
-Subject: [PATCH] change error test for 15th degree polynomial (bug #39055)
-
----
- poly/test.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/poly/test.c b/poly/test.c
-index d090802..f6a7e3f 100644
---- a/poly/test.c
-+++ b/poly/test.c
-@@ -579,8 +579,8 @@ main (void)
- 
-     for (i = 0; i<15; i++)
-       {
--        gsl_test_abs (z[2*i], expected[2*i], 1e-7, "z%d.real, 15th-order polynomial", i);
--        gsl_test_abs (z[2*i+1], expected[2*i+1], 1e-7, "z%d.imag, 15th-order polynomial", i);
-+        gsl_test_rel (z[2*i], expected[2*i], 1e-7, "z%d.real, 15th-order polynomial", i);
-+        gsl_test_rel (z[2*i+1], expected[2*i+1], 1e-7, "z%d.imag, 15th-order polynomial", i);
-       }
-   }
- 
--- 
-2.4.3
-
diff --git a/gnu/packages/patches/hwloc-gather-topology-lstopo.patch b/gnu/packages/patches/hwloc-gather-topology-lstopo.patch
deleted file mode 100644
index 06f47aecaa..0000000000
--- a/gnu/packages/patches/hwloc-gather-topology-lstopo.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-Derived from upstream commit 0a32f719c.
-
---- hwloc-1.10.1/tests/linux/Makefile.in	2015-01-26 03:37:52.000000000 -0600
-+++ hwloc-1.10.1/tests/linux/Makefile.in	2015-06-15 11:21:49.824842511 -0500
-@@ -1633,7 +1633,7 @@
- 
- 
- install-exec-hook:
--	$(SED) -e 's/HWLOC_top_builddir\/utils/bindir/' -e '/HWLOC_top_builddir/d' $(DESTDIR)$(bindir)/hwloc-gather-topology > $(DESTDIR)$(bindir)/hwloc-gather-topology.tmp && mv -f $(DESTDIR)$(bindir)/hwloc-gather-topology.tmp $(DESTDIR)$(bindir)/hwloc-gather-topology
-+	$(SED) -e 's/HWLOC_top_builddir\/utils\/lstopo/bindir/' -e '/HWLOC_top_builddir/d' $(DESTDIR)$(bindir)/hwloc-gather-topology > $(DESTDIR)$(bindir)/hwloc-gather-topology.tmp && mv -f $(DESTDIR)$(bindir)/hwloc-gather-topology.tmp $(DESTDIR)$(bindir)/hwloc-gather-topology
- 	chmod +x $(DESTDIR)$(bindir)/hwloc-gather-topology
- 
- # Tell versions [3.59,3.63) of GNU make to not export all variables.
diff --git a/gnu/packages/patches/jasper-CVE-2008-3522.patch b/gnu/packages/patches/jasper-CVE-2008-3522.patch
new file mode 100644
index 0000000000..10cfec99a5
--- /dev/null
+++ b/gnu/packages/patches/jasper-CVE-2008-3522.patch
@@ -0,0 +1,14 @@
+Fix CVE-2008-3522 (buffer overflow in 'jas_stream_printf').
+Patch from <https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-3522>.
+
+--- jasper-1.900.1/src/libjasper/base/jas_stream.c	2008-09-08 14:56:01.000000000 +0200
++++ jasper-1.900.1/src/libjasper/base/jas_stream.c	2008-09-08 14:58:16.000000000 +0200
+@@ -553,7 +553,7 @@ int jas_stream_printf(jas_stream_t *stre
+ 	int ret;
+ 
+ 	va_start(ap, fmt);
+-	ret = vsprintf(buf, fmt, ap);
++	ret = vsnprintf(buf, sizeof buf, fmt, ap);
+ 	jas_stream_puts(stream, buf);
+ 	va_end(ap);
+ 	return ret;
diff --git a/gnu/packages/patches/libdrm-symbol-check.patch b/gnu/packages/patches/libdrm-symbol-check.patch
new file mode 100644
index 0000000000..676024beb4
--- /dev/null
+++ b/gnu/packages/patches/libdrm-symbol-check.patch
@@ -0,0 +1,195 @@
+Augment the list of expected symbols to fix the symbol-check tests on
+mips64el-linux and armhf-linux.
+
+--- libdrm-2.4.65/freedreno/freedreno-symbol-check.orig	2015-09-04 11:07:40.000000000 -0400
++++ libdrm-2.4.65/freedreno/freedreno-symbol-check	2015-10-18 23:57:15.288416229 -0400
+@@ -1,6 +1,6 @@
+ #!/bin/bash
+ 
+-# The following symbols (past the first five) are taken from the public headers.
++# The following symbols (past the first 12) are taken from the public headers.
+ # A list of the latter should be available Makefile.sources/LIBDRM_FREEDRENO_H_FILES
+ 
+ FUNCS=$(nm -D --format=bsd --defined-only ${1-.libs/libdrm_freedreno.so} | awk '{print $3}'| while read func; do
+@@ -10,6 +10,13 @@
+ _end
+ _fini
+ _init
++_fbss
++_fdata
++_ftext
++__bss_start__
++__bss_end__
++_bss_end__
++__end__
+ fd_bo_cpu_fini
+ fd_bo_cpu_prep
+ fd_bo_del
+--- libdrm-2.4.65/nouveau/nouveau-symbol-check.orig	2015-05-04 11:47:43.000000000 -0400
++++ libdrm-2.4.65/nouveau/nouveau-symbol-check	2015-10-18 23:55:26.078327118 -0400
+@@ -1,6 +1,6 @@
+ #!/bin/bash
+ 
+-# The following symbols (past the first five) are taken from the public headers.
++# The following symbols (past the first 12) are taken from the public headers.
+ # A list of the latter should be available Makefile.sources/LIBDRM_NOUVEAU_H_FILES
+ 
+ FUNCS=$(nm -D --format=bsd --defined-only ${1-.libs/libdrm_nouveau.so} | awk '{print $3}'| while read func; do
+@@ -10,6 +10,13 @@
+ _end
+ _fini
+ _init
++_fbss
++_fdata
++_ftext
++__bss_start__
++__bss_end__
++_bss_end__
++__end__
+ nouveau_bo_map
+ nouveau_bo_name_get
+ nouveau_bo_name_ref
+--- libdrm-2.4.65/libkms/kms-symbol-check.orig	2015-05-04 11:47:43.000000000 -0400
++++ libdrm-2.4.65/libkms/kms-symbol-check	2015-10-18 23:46:10.683869471 -0400
+@@ -1,6 +1,6 @@
+ #!/bin/bash
+ 
+-# The following symbols (past the first five) are taken from the public headers.
++# The following symbols (past the first 12) are taken from the public headers.
+ # A list of the latter should be available Makefile.sources/LIBKMS_H_FILES
+ 
+ FUNCS=$(nm -D --format=bsd --defined-only ${1-.libs/libkms.so} | awk '{print $3}'| while read func; do
+@@ -10,6 +10,13 @@
+ _end
+ _fini
+ _init
++_fbss
++_fdata
++_ftext
++__bss_start__
++__bss_end__
++_bss_end__
++__end__
+ kms_bo_create
+ kms_bo_destroy
+ kms_bo_get_prop
+--- libdrm-2.4.65/intel/intel-symbol-check.orig	2015-05-04 11:47:43.000000000 -0400
++++ libdrm-2.4.65/intel/intel-symbol-check	2015-10-18 23:55:53.309558508 -0400
+@@ -1,6 +1,6 @@
+ #!/bin/bash
+ 
+-# The following symbols (past the first five) are taken from the public headers.
++# The following symbols (past the first 12) are taken from the public headers.
+ # A list of the latter should be available Makefile.sources/LIBDRM_INTEL_H_FILES
+ 
+ FUNCS=$(nm -D --format=bsd --defined-only ${1-.libs/libdrm_intel.so} | awk '{print $3}' | while read func; do
+@@ -10,6 +10,13 @@
+ _end
+ _fini
+ _init
++_fbss
++_fdata
++_ftext
++__bss_start__
++__bss_end__
++_bss_end__
++__end__
+ drm_intel_bo_alloc
+ drm_intel_bo_alloc_for_render
+ drm_intel_bo_alloc_tiled
+--- libdrm-2.4.65/amdgpu/amdgpu-symbol-check.orig	2015-08-17 10:08:11.000000000 -0400
++++ libdrm-2.4.65/amdgpu/amdgpu-symbol-check	2015-10-18 23:56:10.606917723 -0400
+@@ -1,6 +1,6 @@
+ #!/bin/bash
+ 
+-# The following symbols (past the first five) are taken from the public headers.
++# The following symbols (past the first 12) are taken from the public headers.
+ # A list of the latter should be available Makefile.am/libdrm_amdgpuinclude_HEADERS
+ 
+ FUNCS=$(nm -D --format=bsd --defined-only ${1-.libs/libdrm_amdgpu.so} | awk '{print $3}' | while read func; do
+@@ -10,6 +10,13 @@
+ _end
+ _fini
+ _init
++_fbss
++_fdata
++_ftext
++__bss_start__
++__bss_end__
++_bss_end__
++__end__
+ amdgpu_bo_alloc
+ amdgpu_bo_cpu_map
+ amdgpu_bo_cpu_unmap
+--- libdrm-2.4.65/exynos/exynos-symbol-check.orig	2015-05-04 11:47:43.000000000 -0400
++++ libdrm-2.4.65/exynos/exynos-symbol-check	2015-10-18 23:56:32.025486153 -0400
+@@ -1,6 +1,6 @@
+ #!/bin/bash
+ 
+-# The following symbols (past the first five) are taken from the public headers.
++# The following symbols (past the first 12) are taken from the public headers.
+ # A list of the latter should be available Makefile.am/libdrm_exynos*_HEADERS
+ 
+ FUNCS=$(nm -D --format=bsd --defined-only ${1-.libs/libdrm_exynos.so} | awk '{print $3}'| while read func; do
+@@ -10,6 +10,13 @@
+ _end
+ _fini
+ _init
++_fbss
++_fdata
++_ftext
++__bss_start__
++__bss_end__
++_bss_end__
++__end__
+ exynos_bo_create
+ exynos_bo_destroy
+ exynos_bo_from_name
+--- libdrm-2.4.65/omap/omap-symbol-check.orig	2015-05-04 11:47:43.000000000 -0400
++++ libdrm-2.4.65/omap/omap-symbol-check	2015-10-18 23:56:44.834438626 -0400
+@@ -1,6 +1,6 @@
+ #!/bin/bash
+ 
+-# The following symbols (past the first five) are taken from the public headers.
++# The following symbols (past the first 12) are taken from the public headers.
+ # A list of the latter should be available Makefile.am/libdrm_omap*HEADERS
+ 
+ FUNCS=$(nm -D --format=bsd --defined-only ${1-.libs/libdrm_omap.so} | awk '{print $3}'| while read func; do
+@@ -10,6 +10,13 @@
+ _end
+ _fini
+ _init
++_fbss
++_fdata
++_ftext
++__bss_start__
++__bss_end__
++_bss_end__
++__end__
+ omap_bo_cpu_fini
+ omap_bo_cpu_prep
+ omap_bo_del
+--- libdrm-2.4.65/tegra/tegra-symbol-check.orig	2015-05-04 11:47:43.000000000 -0400
++++ libdrm-2.4.65/tegra/tegra-symbol-check	2015-10-18 23:57:00.756759698 -0400
+@@ -1,6 +1,6 @@
+ #!/bin/bash
+ 
+-# The following symbols (past the first five) are taken from the public headers.
++# The following symbols (past the first 12) are taken from the public headers.
+ # A list of the latter should be available Makefile.sources/LIBDRM_FREEDRENO_H_FILES
+ 
+ FUNCS=$(nm -D --format=bsd --defined-only ${1-.libs/libdrm_tegra.so} | awk '{print $3}'| while read func; do
+@@ -10,6 +10,13 @@
+ _end
+ _fini
+ _init
++_fbss
++_fdata
++_ftext
++__bss_start__
++__bss_end__
++_bss_end__
++__end__
+ drm_tegra_bo_get_flags
+ drm_tegra_bo_get_handle
+ drm_tegra_bo_get_tiling
diff --git a/gnu/packages/patches/librsvg-tests.patch b/gnu/packages/patches/librsvg-tests.patch
new file mode 100644
index 0000000000..dc5b94e185
--- /dev/null
+++ b/gnu/packages/patches/librsvg-tests.patch
@@ -0,0 +1,27 @@
+From e06fc71a57156123e4e50a39957100a651ab632b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=E5=AE=8B=E6=96=87=E6=AD=A6?= <iyzsong@gmail.com>
+Date: Sat, 17 Oct 2015 10:20:33 +0800
+Subject: [PATCH] tests/styles: Don't duplicate test names.
+
+---
+ tests/styles.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tests/styles.c b/tests/styles.c
+index d09b1f2..a938835 100644
+--- a/tests/styles.c
++++ b/tests/styles.c
+@@ -97,8 +97,8 @@ static const FixtureData fixtures[] =
+     {"/styles/selectors/2 or more selectors (stroke)", "592207", "styles/bug592207.svg", "#target", "stroke", .expected.color = 0xff0000ff},
+     {"/styles/svg-element-style", "615701", "styles/svg-class.svg", "#svg", "fill", .expected.color = 0xff0000ff},
+     {"/styles/presentation attribute in svg element", "620693", "styles/bug620693.svg", "#svg", "stroke", .expected.color = 0xffff0000},
+-    {"/styles/!important", "379629", "styles/bug379629.svg", "#base_shadow", "stroke", .expected.color = 0xffffc0cb /* pink */},
+-    {"/styles/!important", "379629", "styles/bug379629.svg", "#base_shadow", "stroke-width", .expected.length = {POINTS_LENGTH(5.), 'i'}},
++    {"/styles/!important/1", "379629", "styles/bug379629.svg", "#base_shadow", "stroke", .expected.color = 0xffffc0cb /* pink */},
++    {"/styles/!important/2", "379629", "styles/bug379629.svg", "#base_shadow", "stroke-width", .expected.length = {POINTS_LENGTH(5.), 'i'}},
+     {"/styles/!important/class", "614606", "styles/bug614606.svg", "#path6306", "fill", .expected.color = 0xffff0000 /* red */ },
+     {"/styles/!important/element", "614606", "styles/bug614606.svg", "#path6308", "fill", .expected.color = 0xff000000},
+     {"/styles/!important/#id prior than class", NULL, "styles/important.svg", "#red", "fill", .expected.color = 0xffff0000 },
+-- 
+2.5.0
+
diff --git a/gnu/packages/patches/libsndfile-CVE-2014-9496.patch b/gnu/packages/patches/libsndfile-CVE-2014-9496.patch
new file mode 100644
index 0000000000..87d42955fb
--- /dev/null
+++ b/gnu/packages/patches/libsndfile-CVE-2014-9496.patch
@@ -0,0 +1,55 @@
+Copied from Fedora.
+
+http://pkgs.fedoraproject.org/cgit/libsndfile.git/plain/libsndfile-1.0.25-cve2014_9496.patch
+
+diff -up libsndfile-1.0.25/src/sd2.c.cve2014_9496 libsndfile-1.0.25/src/sd2.c
+--- libsndfile-1.0.25/src/sd2.c.cve2014_9496	2011-01-19 11:10:36.000000000 +0100
++++ libsndfile-1.0.25/src/sd2.c	2015-01-13 17:00:35.920285526 +0100
+@@ -395,6 +395,21 @@ read_marker (const unsigned char * data,
+ 		return 0x666 ;
+ } /* read_marker */
+ 
++static inline int
++read_rsrc_marker (const SD2_RSRC *prsrc, int offset)
++{	const unsigned char * data = prsrc->rsrc_data ;
++
++	if (offset < 0 || offset + 3 >= prsrc->rsrc_len)
++		return 0 ;
++
++	if (CPU_IS_BIG_ENDIAN)
++		return (((uint32_t) data [offset]) << 24) + (data [offset + 1] << 16) + (data [offset + 2] << 8) + data [offset + 3] ;
++	if (CPU_IS_LITTLE_ENDIAN)
++		return data [offset] + (data [offset + 1] << 8) + (data [offset + 2] << 16) + (((uint32_t) data [offset + 3]) << 24) ;
++
++	return 0 ;
++} /* read_rsrc_marker */
++
+ static void
+ read_str (const unsigned char * data, int offset, char * buffer, int buffer_len)
+ {	int k ;
+@@ -496,6 +511,11 @@ sd2_parse_rsrc_fork (SF_PRIVATE *psf)
+ 
+ 	rsrc.type_offset = rsrc.map_offset + 30 ;
+ 
++	if (rsrc.map_offset + 28 > rsrc.rsrc_len)
++	{       psf_log_printf (psf, "Bad map offset.\n") ;
++		goto parse_rsrc_fork_cleanup ;
++		} ;
++
+ 	rsrc.type_count = read_short (rsrc.rsrc_data, rsrc.map_offset + 28) + 1 ;
+ 	if (rsrc.type_count < 1)
+ 	{	psf_log_printf (psf, "Bad type count.\n") ;
+@@ -512,7 +532,12 @@ sd2_parse_rsrc_fork (SF_PRIVATE *psf)
+ 
+ 	rsrc.str_index = -1 ;
+ 	for (k = 0 ; k < rsrc.type_count ; k ++)
+-	{	marker = read_marker (rsrc.rsrc_data, rsrc.type_offset + k * 8) ;
++	{	if (rsrc.type_offset + k * 8 > rsrc.rsrc_len)
++		{	psf_log_printf (psf, "Bad rsrc marker.\n") ;
++			goto parse_rsrc_fork_cleanup ;
++			} ;
++
++		marker = read_rsrc_marker (&rsrc, rsrc.type_offset + k * 8) ;
+ 
+ 		if (marker == STR_MARKER)
+ 		{	rsrc.str_index = k ;
diff --git a/gnu/packages/patches/libsndfile-CVE-2015-7805.patch b/gnu/packages/patches/libsndfile-CVE-2015-7805.patch
new file mode 100644
index 0000000000..d617f81e5c
--- /dev/null
+++ b/gnu/packages/patches/libsndfile-CVE-2015-7805.patch
@@ -0,0 +1,95 @@
+Slightly modified to apply cleanly to libsndfile-1.0.25.
+
+From d2a87385c1ca1d72918e9a2875d24f202a5093e8 Mon Sep 17 00:00:00 2001
+From: Erik de Castro Lopo <erikd@mega-nerd.com>
+Date: Sat, 7 Feb 2015 15:45:10 +1100
+Subject: [PATCH] src/common.c : Fix a header parsing bug.
+
+When the file header is bigger that SF_HEADER_LEN, the code would seek
+instead of reading causing file parse errors.
+
+The current header parsing and writing code *badly* needs a re-write.
+---
+ src/common.c | 27 +++++++++++----------------
+ 1 file changed, 11 insertions(+), 16 deletions(-)
+
+diff --git a/src/common.c b/src/common.c
+index dd4edb7..c6b88cc 100644
+--- a/src/common.c
++++ b/src/common.c
+@@ -1,5 +1,5 @@
+ /*
+-** Copyright (C) 1999-2011 Erik de Castro Lopo <erikd@mega-nerd.com>
++** Copyright (C) 1999-2015 Erik de Castro Lopo <erikd@mega-nerd.com>
+ **
+ ** This program is free software; you can redistribute it and/or modify
+ ** it under the terms of the GNU Lesser General Public License as published by
+@@ -800,21 +800,16 @@ header_read (SF_PRIVATE *psf, void *ptr, int bytes)
+ {	int count = 0 ;
+ 
+ 	if (psf->headindex >= SIGNED_SIZEOF (psf->header))
+-	{	memset (ptr, 0, SIGNED_SIZEOF (psf->header) - psf->headindex) ;
+-
+-		/* This is the best that we can do. */
+-		psf_fseek (psf, bytes, SEEK_CUR) ;
+-		return bytes ;
+-		} ;
++		return psf_fread (ptr, 1, bytes, psf) ;
+ 
+ 	if (psf->headindex + bytes > SIGNED_SIZEOF (psf->header))
+ 	{	int most ;
+ 
+ 		most = SIGNED_SIZEOF (psf->header) - psf->headindex ;
+ 		psf_fread (psf->header + psf->headend, 1, most, psf) ;
+-		memset ((char *) ptr + most, 0, bytes - most) ;
+-
+-		psf_fseek (psf, bytes - most, SEEK_CUR) ;
++		memcpy (ptr, psf->header + psf->headend, most) ;
++		psf->headend = psf->headindex += most ;
++		psf_fread ((char *) ptr + most, bytes - most, 1, psf) ;
+ 		return bytes ;
+ 		} ;
+ 
+@@ -822,7 +817,7 @@ header_read (SF_PRIVATE *psf, void *ptr, int bytes)
+ 	{	count = psf_fread (psf->header + psf->headend, 1, bytes - (psf->headend - psf->headindex), psf) ;
+ 		if (count != bytes - (int) (psf->headend - psf->headindex))
+ 		{	psf_log_printf (psf, "Error : psf_fread returned short count.\n") ;
+-			return 0 ;
++			return count ;
+ 			} ;
+ 		psf->headend += count ;
+ 		} ;
+@@ -836,7 +831,6 @@ header_read (SF_PRIVATE *psf, void *ptr, int bytes)
+ static void
+ header_seek (SF_PRIVATE *psf, sf_count_t position, int whence)
+ {
+-
+ 	switch (whence)
+ 	{	case SEEK_SET :
+ 			if (position > SIGNED_SIZEOF (psf->header))
+@@ -885,8 +879,7 @@ header_seek (SF_PRIVATE *psf, sf_count_t position, int whence)
+ 
+ static int
+ header_gets (SF_PRIVATE *psf, char *ptr, int bufsize)
+-{
+-	int		k ;
++{	int		k ;
+ 
+ 	for (k = 0 ; k < bufsize - 1 ; k++)
+ 	{	if (psf->headindex < psf->headend)
+@@ -1073,8 +1066,10 @@ psf_binheader_readf (SF_PRIVATE *psf, char const *format, ...)
+ 			case 'j' :
+ 					/* Get the seek position first. */
+ 					count = va_arg (argptr, size_t) ;
+-					header_seek (psf, count, SEEK_CUR) ;
+-					byte_count += count ;
++					if (count)
++					{	header_seek (psf, count, SEEK_CUR) ;
++						byte_count += count ;
++						} ;
+ 					break ;
+ 
+ 			default :
+-- 
+2.6.3
+
diff --git a/gnu/packages/patches/libxslt-CVE-2015-7995.patch b/gnu/packages/patches/libxslt-CVE-2015-7995.patch
new file mode 100644
index 0000000000..f291d5b387
--- /dev/null
+++ b/gnu/packages/patches/libxslt-CVE-2015-7995.patch
@@ -0,0 +1,29 @@
+From 7ca19df892ca22d9314e95d59ce2abdeff46b617 Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Thu, 29 Oct 2015 19:33:23 +0800
+Subject: [PATCH] Fix for type confusion in preprocessing attributes
+
+CVE-2015-7995 http://www.openwall.com/lists/oss-security/2015/10/27/10
+We need to check that the parent node is an element before dereferencing
+its namespace
+---
+ libxslt/preproc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/libxslt/preproc.c b/libxslt/preproc.c
+index 0eb80a0..7f69325 100644
+--- a/libxslt/preproc.c
++++ b/libxslt/preproc.c
+@@ -2249,7 +2249,8 @@ xsltStylePreCompute(xsltStylesheetPtr style, xmlNodePtr inst) {
+ 	} else if (IS_XSLT_NAME(inst, "attribute")) {
+ 	    xmlNodePtr parent = inst->parent;
+ 
+-	    if ((parent == NULL) || (parent->ns == NULL) ||
++	    if ((parent == NULL) ||
++	        (parent->type != XML_ELEMENT_NODE) || (parent->ns == NULL) ||
+ 		((parent->ns != inst->ns) &&
+ 		 (!xmlStrEqual(parent->ns->href, inst->ns->href))) ||
+ 		(!xmlStrEqual(parent->name, BAD_CAST "attribute-set"))) {
+-- 
+2.6.3
+
diff --git a/gnu/packages/patches/lua52-liblua-so.patch b/gnu/packages/patches/lua52-liblua-so.patch
new file mode 100644
index 0000000000..2e6b39ae79
--- /dev/null
+++ b/gnu/packages/patches/lua52-liblua-so.patch
@@ -0,0 +1,78 @@
+From 7a1b4e0829124976878ca2765a8e546667a92ceb Mon Sep 17 00:00:00 2001
+From: Leo Famulari <leo@famulari.name>
+Date: Fri, 30 Oct 2015 19:11:31 -0400
+Subject: [PATCH] apply existing non-executable library patch and install
+ libraries as executable
+
+---
+ Makefile     | 6 +++---
+ src/Makefile | 8 +++++++-
+ 2 files changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 1aea8e6..bfcfed9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -44,7 +44,7 @@ INTERPRETER= lua
+ COMPILER= luac
+ TO_BIN= $(INTERPRETER) $(COMPILER)
+ TO_INC= lua.h luaconf.h lualib.h lauxlib.h lua.hpp
+-TO_LIB= liblua.a
++TO_LIB= liblua.a liblua.so liblua.so.${V}
+ TO_PC=  lua-$(V).pc
+ TO_MAN= lua.1 luac.1
+ 
+@@ -56,7 +56,7 @@ R= $V.3
+ all:	$(PLAT)
+ 
+ $(PLATS):
+-	cd src && $(MAKE) $@
++	cd src && $(MAKE) $@ V=$(V) R=$(R)
+ 
+ clean:
+ 	cd src && $(MAKE) $@
+@@ -69,7 +69,7 @@ install: dummy $(TO_PC)
+ 	cd src && $(MKDIR) $(INSTALL_BIN) $(INSTALL_INC) $(INSTALL_LIB) $(INSTALL_PC) $(INSTALL_MAN) $(INSTALL_LMOD) $(INSTALL_CMOD)
+ 	cd src && $(INSTALL_EXEC) $(TO_BIN) $(INSTALL_BIN)
+ 	cd src && $(INSTALL_DATA) $(TO_INC) $(INSTALL_INC)
+-	cd src && $(INSTALL_DATA) $(TO_LIB) $(INSTALL_LIB)
++	cd src && $(INSTALL_EXEC) $(TO_LIB) $(INSTALL_LIB)
+ 	cd src && $(INSTALL_DATA) ../$(TO_PC) $(INSTALL_PC)
+ 	cd doc && $(INSTALL_DATA) $(TO_MAN) $(INSTALL_MAN)
+ 
+diff --git a/src/Makefile b/src/Makefile
+index 7b4b2b7..c86476e 100644
+--- a/src/Makefile
++++ b/src/Makefile
+@@ -29,6 +29,7 @@ MYOBJS=
+ PLATS= aix ansi bsd freebsd generic linux macosx mingw posix solaris
+ 
+ LUA_A=	liblua.a
++LUA_SO= liblua.so
+ CORE_O=	lapi.o lcode.o lctype.o ldebug.o ldo.o ldump.o lfunc.o lgc.o llex.o \
+ 	lmem.o lobject.o lopcodes.o lparser.o lstate.o lstring.o ltable.o \
+ 	ltm.o lundump.o lvm.o lzio.o
+@@ -43,7 +44,7 @@ LUAC_T=	luac
+ LUAC_O=	luac.o
+ 
+ ALL_O= $(BASE_O) $(LUA_O) $(LUAC_O)
+-ALL_T= $(LUA_A) $(LUA_T) $(LUAC_T)
++ALL_T= $(LUA_A) $(LUA_T) $(LUAC_T) $(LUA_SO)
+ ALL_A= $(LUA_A)
+ 
+ # Targets start here.
+@@ -55,6 +56,11 @@ o:	$(ALL_O)
+ 
+ a:	$(ALL_A)
+ 
++$(LUA_SO): $(CORE_O) $(LIB_O)
++	$(CC) -shared -ldl -Wl,-soname,$(LUA_SO).$(V) -o $@.$(R) $? -lm $(MYLDFLAGS)
++	ln -sf $(LUA_SO).$(R) $(LUA_SO).$(V)
++	ln -sf $(LUA_SO).$(R) $(LUA_SO)
++
+ $(LUA_A): $(BASE_O)
+ 	$(AR) $@ $(BASE_O)
+ 	$(RANLIB) $@
+-- 
+2.6.1
+
diff --git a/gnu/packages/patches/matplotlib-setupext-tk.patch b/gnu/packages/patches/matplotlib-setupext-tk.patch
new file mode 100644
index 0000000000..37c3d686e0
--- /dev/null
+++ b/gnu/packages/patches/matplotlib-setupext-tk.patch
@@ -0,0 +1,34 @@
+Use 'pkg-config' instead of heuristics to find 'tk' flags.
+
+--- matplotlib-1.4.3/setupext.py.orig	2015-12-01 14:21:19.554417453 +0100
++++ matplotlib-1.4.3/setupext.py	2015-12-02 10:39:47.282363530 +0100
+@@ -1457,7 +1457,7 @@
+             p = subprocess.Popen(
+                 '. %s ; eval echo ${%s}' % (file, varname),
+                 shell=True,
+-                executable="/bin/sh",
++                executable="sh",
+                 stdout=subprocess.PIPE)
+             result = p.communicate()[0]
+             return result.decode('ascii')
+@@ -1601,8 +1601,19 @@
+             #      of distros.
+ 
+             # Query Tcl/Tk system for library paths and version string
++            def getoutput(s):
++                ret = os.popen(s).read().strip()
++                return ret
+             try:
+-                tcl_lib_dir, tk_lib_dir, tk_ver = self.query_tcltk()
++                pkg_config_libs = getoutput('pkg-config --libs-only-L tk').split()
++                # drop '-L' part of strings
++                pkg_config_libs = [s[2:] for s in pkg_config_libs]
++                pkg_config_ver = getoutput('pkg-config --modversion tk')
++                tk_ver = re.match(r"(\d+.\d+)[\d.]*", pkg_config_ver).group(1)
++                tcl_lib_dir = next(s for s in pkg_config_libs
++                                   if re.match(r".*-tcl-.*", s)) + '/tcl' + tk_ver
++                tk_lib_dir = next(s for s in pkg_config_libs
++                                  if re.match(r".*-tk-.*", s)) + '/tk' + tk_ver
+             except:
+                 tk_ver = ''
+                 result = self.hardcoded_tcl_config()
diff --git a/gnu/packages/patches/mit-krb5-CVE-2015-2695-pt1.patch b/gnu/packages/patches/mit-krb5-CVE-2015-2695-pt1.patch
new file mode 100644
index 0000000000..0f5603e228
--- /dev/null
+++ b/gnu/packages/patches/mit-krb5-CVE-2015-2695-pt1.patch
@@ -0,0 +1,569 @@
+Copied from Debian.
+
+From b813d5811432faed844a2dfd3daecde914978f2c Mon Sep 17 00:00:00 2001
+From: Nicolas Williams <nico@twosigma.com>
+Date: Mon, 14 Sep 2015 12:27:52 -0400
+Subject: Fix SPNEGO context aliasing bugs [CVE-2015-2695]
+
+The SPNEGO mechanism currently replaces its context handle with the
+mechanism context handle upon establishment, under the assumption that
+most GSS functions are only called after context establishment.  This
+assumption is incorrect, and can lead to aliasing violations for some
+programs.  Maintain the SPNEGO context structure after context
+establishment and refer to it in all GSS methods.  Add initiate and
+opened flags to the SPNEGO context structure for use in
+gss_inquire_context() prior to context establishment.
+
+CVE-2015-2695:
+
+In MIT krb5 1.5 and later, applications which call
+gss_inquire_context() on a partially-established SPNEGO context can
+cause the GSS-API library to read from a pointer using the wrong type,
+generally causing a process crash.  This bug may go unnoticed, because
+the most common SPNEGO authentication scenario establishes the context
+after just one call to gss_accept_sec_context().  Java server
+applications using the native JGSS provider are vulnerable to this
+bug.  A carefully crafted SPNEGO packet might allow the
+gss_inquire_context() call to succeed with attacker-determined
+results, but applications should not make access control decisions
+based on gss_inquire_context() results prior to context establishment.
+
+    CVSSv2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C/E:POC/RL:OF/RC:C
+
+[ghudson@mit.edu: several bugfixes, style changes, and edge-case
+behavior changes; commit message and CVE description]
+
+ticket: 8244
+target_version: 1.14
+tags: pullup
+
+(cherry picked from commit b51b33f2bc5d1497ddf5bd107f791c101695000d)
+Patch-Category: upstream
+---
+ src/lib/gssapi/spnego/gssapiP_spnego.h |   2 +
+ src/lib/gssapi/spnego/spnego_mech.c    | 254 ++++++++++++++++++++++++---------
+ 2 files changed, 192 insertions(+), 64 deletions(-)
+
+diff --git a/src/lib/gssapi/spnego/gssapiP_spnego.h b/src/lib/gssapi/spnego/gssapiP_spnego.h
+index bc23f56..8e05736 100644
+--- a/src/lib/gssapi/spnego/gssapiP_spnego.h
++++ b/src/lib/gssapi/spnego/gssapiP_spnego.h
+@@ -102,6 +102,8 @@ typedef struct {
+ 	int firstpass;
+ 	int mech_complete;
+ 	int nego_done;
++	int initiate;
++	int opened;
+ 	OM_uint32 ctx_flags;
+ 	gss_name_t internal_name;
+ 	gss_OID actual_mech;
+diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c
+index 6e39c37..a1072b0 100644
+--- a/src/lib/gssapi/spnego/spnego_mech.c
++++ b/src/lib/gssapi/spnego/spnego_mech.c
+@@ -104,7 +104,7 @@ static OM_uint32 get_negotiable_mechs(OM_uint32 *, spnego_gss_cred_id_t,
+ 				      gss_cred_usage_t, gss_OID_set *);
+ static void release_spnego_ctx(spnego_gss_ctx_id_t *);
+ static void check_spnego_options(spnego_gss_ctx_id_t);
+-static spnego_gss_ctx_id_t create_spnego_ctx(void);
++static spnego_gss_ctx_id_t create_spnego_ctx(int);
+ static int put_mech_set(gss_OID_set mechSet, gss_buffer_t buf);
+ static int put_input_token(unsigned char **, gss_buffer_t, unsigned int);
+ static int put_mech_oid(unsigned char **, gss_OID_const, unsigned int);
+@@ -442,7 +442,7 @@ check_spnego_options(spnego_gss_ctx_id_t spnego_ctx)
+ }
+ 
+ static spnego_gss_ctx_id_t
+-create_spnego_ctx(void)
++create_spnego_ctx(int initiate)
+ {
+ 	spnego_gss_ctx_id_t spnego_ctx = NULL;
+ 	spnego_ctx = (spnego_gss_ctx_id_t)
+@@ -465,6 +465,8 @@ create_spnego_ctx(void)
+ 	spnego_ctx->mic_rcvd = 0;
+ 	spnego_ctx->mech_complete = 0;
+ 	spnego_ctx->nego_done = 0;
++	spnego_ctx->opened = 0;
++	spnego_ctx->initiate = initiate;
+ 	spnego_ctx->internal_name = GSS_C_NO_NAME;
+ 	spnego_ctx->actual_mech = GSS_C_NO_OID;
+ 
+@@ -630,7 +632,7 @@ init_ctx_new(OM_uint32 *minor_status,
+ 	OM_uint32 ret;
+ 	spnego_gss_ctx_id_t sc = NULL;
+ 
+-	sc = create_spnego_ctx();
++	sc = create_spnego_ctx(1);
+ 	if (sc == NULL)
+ 		return GSS_S_FAILURE;
+ 
+@@ -647,10 +649,7 @@ init_ctx_new(OM_uint32 *minor_status,
+ 		ret = GSS_S_FAILURE;
+ 		goto cleanup;
+ 	}
+-	/*
+-	 * The actual context is not yet determined, set the output
+-	 * context handle to refer to the spnego context itself.
+-	 */
++
+ 	sc->ctx_handle = GSS_C_NO_CONTEXT;
+ 	*ctx = (gss_ctx_id_t)sc;
+ 	sc = NULL;
+@@ -1091,16 +1090,11 @@ cleanup:
+ 	}
+ 	gss_release_buffer(&tmpmin, &mechtok_out);
+ 	if (ret == GSS_S_COMPLETE) {
+-		/*
+-		 * Now, switch the output context to refer to the
+-		 * negotiated mechanism's context.
+-		 */
+-		*context_handle = (gss_ctx_id_t)spnego_ctx->ctx_handle;
++		spnego_ctx->opened = 1;
+ 		if (actual_mech != NULL)
+ 			*actual_mech = spnego_ctx->actual_mech;
+ 		if (ret_flags != NULL)
+ 			*ret_flags = spnego_ctx->ctx_flags;
+-		release_spnego_ctx(&spnego_ctx);
+ 	} else if (ret != GSS_S_CONTINUE_NEEDED) {
+ 		if (spnego_ctx != NULL) {
+ 			gss_delete_sec_context(&tmpmin,
+@@ -1344,7 +1338,7 @@ acc_ctx_hints(OM_uint32 *minor_status,
+ 	if (ret != GSS_S_COMPLETE)
+ 		goto cleanup;
+ 
+-	sc = create_spnego_ctx();
++	sc = create_spnego_ctx(0);
+ 	if (sc == NULL) {
+ 		ret = GSS_S_FAILURE;
+ 		goto cleanup;
+@@ -1426,7 +1420,7 @@ acc_ctx_new(OM_uint32 *minor_status,
+ 		gss_release_buffer(&tmpmin, &sc->DER_mechTypes);
+ 		assert(mech_wanted != GSS_C_NO_OID);
+ 	} else
+-		sc = create_spnego_ctx();
++		sc = create_spnego_ctx(0);
+ 	if (sc == NULL) {
+ 		ret = GSS_S_FAILURE;
+ 		*return_token = NO_TOKEN_SEND;
+@@ -1809,13 +1803,12 @@ cleanup:
+ 			ret = GSS_S_FAILURE;
+ 	}
+ 	if (ret == GSS_S_COMPLETE) {
+-		*context_handle = (gss_ctx_id_t)sc->ctx_handle;
++		sc->opened = 1;
+ 		if (sc->internal_name != GSS_C_NO_NAME &&
+ 		    src_name != NULL) {
+ 			*src_name = sc->internal_name;
+ 			sc->internal_name = GSS_C_NO_NAME;
+ 		}
+-		release_spnego_ctx(&sc);
+ 	} else if (ret != GSS_S_CONTINUE_NEEDED) {
+ 		if (sc != NULL) {
+ 			gss_delete_sec_context(&tmpmin, &sc->ctx_handle,
+@@ -2128,8 +2121,13 @@ spnego_gss_unwrap(
+ 		gss_qop_t *qop_state)
+ {
+ 	OM_uint32 ret;
++	spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle;
++
++	if (sc->ctx_handle == GSS_C_NO_CONTEXT)
++		return (GSS_S_NO_CONTEXT);
++
+ 	ret = gss_unwrap(minor_status,
+-			context_handle,
++			sc->ctx_handle,
+ 			input_message_buffer,
+ 			output_message_buffer,
+ 			conf_state,
+@@ -2149,8 +2147,13 @@ spnego_gss_wrap(
+ 		gss_buffer_t output_message_buffer)
+ {
+ 	OM_uint32 ret;
++	spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle;
++
++	if (sc->ctx_handle == GSS_C_NO_CONTEXT)
++		return (GSS_S_NO_CONTEXT);
++
+ 	ret = gss_wrap(minor_status,
+-		    context_handle,
++		    sc->ctx_handle,
+ 		    conf_req_flag,
+ 		    qop_req,
+ 		    input_message_buffer,
+@@ -2167,8 +2170,14 @@ spnego_gss_process_context_token(
+ 				const gss_buffer_t token_buffer)
+ {
+ 	OM_uint32 ret;
++	spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle;
++
++	/* SPNEGO doesn't have its own context tokens. */
++	if (!sc->opened)
++		return (GSS_S_DEFECTIVE_TOKEN);
++
+ 	ret = gss_process_context_token(minor_status,
+-					context_handle,
++					sc->ctx_handle,
+ 					token_buffer);
+ 
+ 	return (ret);
+@@ -2192,19 +2201,9 @@ spnego_gss_delete_sec_context(
+ 	if (*ctx == NULL)
+ 		return (GSS_S_COMPLETE);
+ 
+-	/*
+-	 * If this is still an SPNEGO mech, release it locally.
+-	 */
+-	if ((*ctx)->magic_num == SPNEGO_MAGIC_ID) {
+-		(void) gss_delete_sec_context(minor_status,
+-				    &(*ctx)->ctx_handle,
+-				    output_token);
+-		(void) release_spnego_ctx(ctx);
+-	} else {
+-		ret = gss_delete_sec_context(minor_status,
+-				    context_handle,
+-				    output_token);
+-	}
++	(void) gss_delete_sec_context(minor_status, &(*ctx)->ctx_handle,
++				      output_token);
++	(void) release_spnego_ctx(ctx);
+ 
+ 	return (ret);
+ }
+@@ -2216,8 +2215,13 @@ spnego_gss_context_time(
+ 			OM_uint32	*time_rec)
+ {
+ 	OM_uint32 ret;
++	spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle;
++
++	if (sc->ctx_handle == GSS_C_NO_CONTEXT)
++		return (GSS_S_NO_CONTEXT);
++
+ 	ret = gss_context_time(minor_status,
+-			    context_handle,
++			    sc->ctx_handle,
+ 			    time_rec);
+ 	return (ret);
+ }
+@@ -2229,9 +2233,20 @@ spnego_gss_export_sec_context(
+ 			    gss_buffer_t interprocess_token)
+ {
+ 	OM_uint32 ret;
++	spnego_gss_ctx_id_t sc = *(spnego_gss_ctx_id_t *)context_handle;
++
++	/* We don't currently support exporting partially established
++	 * contexts. */
++	if (!sc->opened)
++		return GSS_S_UNAVAILABLE;
++
+ 	ret = gss_export_sec_context(minor_status,
+-				    context_handle,
++				    &sc->ctx_handle,
+ 				    interprocess_token);
++	if (sc->ctx_handle == GSS_C_NO_CONTEXT) {
++		release_spnego_ctx(&sc);
++		*context_handle = GSS_C_NO_CONTEXT;
++	}
+ 	return (ret);
+ }
+ 
+@@ -2241,11 +2256,12 @@ spnego_gss_import_sec_context(
+ 	const gss_buffer_t	interprocess_token,
+ 	gss_ctx_id_t		*context_handle)
+ {
+-	OM_uint32 ret;
+-	ret = gss_import_sec_context(minor_status,
+-				    interprocess_token,
+-				    context_handle);
+-	return (ret);
++	/*
++	 * Until we implement partial context exports, there are no SPNEGO
++	 * exported context tokens, only tokens for underlying mechs.  So just
++	 * return an error for now.
++	 */
++	return GSS_S_UNAVAILABLE;
+ }
+ #endif /* LEAN_CLIENT */
+ 
+@@ -2262,16 +2278,48 @@ spnego_gss_inquire_context(
+ 			int		*opened)
+ {
+ 	OM_uint32 ret = GSS_S_COMPLETE;
++	spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle;
++
++	if (src_name != NULL)
++		*src_name = GSS_C_NO_NAME;
++	if (targ_name != NULL)
++		*targ_name = GSS_C_NO_NAME;
++	if (lifetime_rec != NULL)
++		*lifetime_rec = 0;
++	if (mech_type != NULL)
++		*mech_type = (gss_OID)gss_mech_spnego;
++	if (ctx_flags != NULL)
++		*ctx_flags = 0;
++	if (locally_initiated != NULL)
++		*locally_initiated = sc->initiate;
++	if (opened != NULL)
++		*opened = sc->opened;
++
++	if (sc->ctx_handle != GSS_C_NO_CONTEXT) {
++		ret = gss_inquire_context(minor_status, sc->ctx_handle,
++					  src_name, targ_name, lifetime_rec,
++					  mech_type, ctx_flags, NULL, NULL);
++	}
+ 
+-	ret = gss_inquire_context(minor_status,
+-				context_handle,
+-				src_name,
+-				targ_name,
+-				lifetime_rec,
+-				mech_type,
+-				ctx_flags,
+-				locally_initiated,
+-				opened);
++	if (!sc->opened) {
++		/*
++		 * We are still doing SPNEGO negotiation, so report SPNEGO as
++		 * the OID.  After negotiation is complete we will report the
++		 * underlying mechanism OID.
++		 */
++		if (mech_type != NULL)
++			*mech_type = (gss_OID)gss_mech_spnego;
++
++		/*
++		 * Remove flags we don't support with partially-established
++		 * contexts.  (Change this to keep GSS_C_TRANS_FLAG if we add
++		 * support for exporting partial SPNEGO contexts.)
++		 */
++		if (ctx_flags != NULL) {
++			*ctx_flags &= ~GSS_C_PROT_READY_FLAG;
++			*ctx_flags &= ~GSS_C_TRANS_FLAG;
++		}
++	}
+ 
+ 	return (ret);
+ }
+@@ -2286,8 +2334,13 @@ spnego_gss_wrap_size_limit(
+ 	OM_uint32	*max_input_size)
+ {
+ 	OM_uint32 ret;
++	spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle;
++
++	if (sc->ctx_handle == GSS_C_NO_CONTEXT)
++		return (GSS_S_NO_CONTEXT);
++
+ 	ret = gss_wrap_size_limit(minor_status,
+-				context_handle,
++				sc->ctx_handle,
+ 				conf_req_flag,
+ 				qop_req,
+ 				req_output_size,
+@@ -2304,8 +2357,13 @@ spnego_gss_get_mic(
+ 		gss_buffer_t message_token)
+ {
+ 	OM_uint32 ret;
++	spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle;
++
++	if (sc->ctx_handle == GSS_C_NO_CONTEXT)
++		return (GSS_S_NO_CONTEXT);
++
+ 	ret = gss_get_mic(minor_status,
+-		    context_handle,
++		    sc->ctx_handle,
+ 		    qop_req,
+ 		    message_buffer,
+ 		    message_token);
+@@ -2321,8 +2379,13 @@ spnego_gss_verify_mic(
+ 		gss_qop_t *qop_state)
+ {
+ 	OM_uint32 ret;
++	spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle;
++
++	if (sc->ctx_handle == GSS_C_NO_CONTEXT)
++		return (GSS_S_NO_CONTEXT);
++
+ 	ret = gss_verify_mic(minor_status,
+-			    context_handle,
++			    sc->ctx_handle,
+ 			    msg_buffer,
+ 			    token_buffer,
+ 			    qop_state);
+@@ -2337,8 +2400,14 @@ spnego_gss_inquire_sec_context_by_oid(
+ 		gss_buffer_set_t *data_set)
+ {
+ 	OM_uint32 ret;
++	spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle;
++
++	/* There are no SPNEGO-specific OIDs for this function. */
++	if (sc->ctx_handle == GSS_C_NO_CONTEXT)
++		return (GSS_S_UNAVAILABLE);
++
+ 	ret = gss_inquire_sec_context_by_oid(minor_status,
+-			    context_handle,
++			    sc->ctx_handle,
+ 			    desired_object,
+ 			    data_set);
+ 	return (ret);
+@@ -2407,8 +2476,15 @@ spnego_gss_set_sec_context_option(
+ 		const gss_buffer_t value)
+ {
+ 	OM_uint32 ret;
++	spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)*context_handle;
++
++	/* There are no SPNEGO-specific OIDs for this function, and we cannot
++	 * construct an empty SPNEGO context with it. */
++	if (sc == NULL || sc->ctx_handle == GSS_C_NO_CONTEXT)
++		return (GSS_S_UNAVAILABLE);
++
+ 	ret = gss_set_sec_context_option(minor_status,
+-			    context_handle,
++			    &sc->ctx_handle,
+ 			    desired_object,
+ 			    value);
+ 	return (ret);
+@@ -2425,8 +2501,13 @@ spnego_gss_wrap_aead(OM_uint32 *minor_status,
+ 		     gss_buffer_t output_message_buffer)
+ {
+ 	OM_uint32 ret;
++	spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle;
++
++	if (sc->ctx_handle == GSS_C_NO_CONTEXT)
++		return (GSS_S_NO_CONTEXT);
++
+ 	ret = gss_wrap_aead(minor_status,
+-			    context_handle,
++			    sc->ctx_handle,
+ 			    conf_req_flag,
+ 			    qop_req,
+ 			    input_assoc_buffer,
+@@ -2447,8 +2528,13 @@ spnego_gss_unwrap_aead(OM_uint32 *minor_status,
+ 		       gss_qop_t *qop_state)
+ {
+ 	OM_uint32 ret;
++	spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle;
++
++	if (sc->ctx_handle == GSS_C_NO_CONTEXT)
++		return (GSS_S_NO_CONTEXT);
++
+ 	ret = gss_unwrap_aead(minor_status,
+-			      context_handle,
++			      sc->ctx_handle,
+ 			      input_message_buffer,
+ 			      input_assoc_buffer,
+ 			      output_payload_buffer,
+@@ -2467,8 +2553,13 @@ spnego_gss_wrap_iov(OM_uint32 *minor_status,
+ 		    int iov_count)
+ {
+ 	OM_uint32 ret;
++	spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle;
++
++	if (sc->ctx_handle == GSS_C_NO_CONTEXT)
++		return (GSS_S_NO_CONTEXT);
++
+ 	ret = gss_wrap_iov(minor_status,
+-			   context_handle,
++			   sc->ctx_handle,
+ 			   conf_req_flag,
+ 			   qop_req,
+ 			   conf_state,
+@@ -2486,8 +2577,13 @@ spnego_gss_unwrap_iov(OM_uint32 *minor_status,
+ 		      int iov_count)
+ {
+ 	OM_uint32 ret;
++	spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle;
++
++	if (sc->ctx_handle == GSS_C_NO_CONTEXT)
++		return (GSS_S_NO_CONTEXT);
++
+ 	ret = gss_unwrap_iov(minor_status,
+-			     context_handle,
++			     sc->ctx_handle,
+ 			     conf_state,
+ 			     qop_state,
+ 			     iov,
+@@ -2505,8 +2601,13 @@ spnego_gss_wrap_iov_length(OM_uint32 *minor_status,
+ 			   int iov_count)
+ {
+ 	OM_uint32 ret;
++	spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle;
++
++	if (sc->ctx_handle == GSS_C_NO_CONTEXT)
++		return (GSS_S_NO_CONTEXT);
++
+ 	ret = gss_wrap_iov_length(minor_status,
+-				  context_handle,
++				  sc->ctx_handle,
+ 				  conf_req_flag,
+ 				  qop_req,
+ 				  conf_state,
+@@ -2523,8 +2624,13 @@ spnego_gss_complete_auth_token(
+ 		gss_buffer_t input_message_buffer)
+ {
+ 	OM_uint32 ret;
++	spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle;
++
++	if (sc->ctx_handle == GSS_C_NO_CONTEXT)
++		return (GSS_S_UNAVAILABLE);
++
+ 	ret = gss_complete_auth_token(minor_status,
+-				      context_handle,
++				      sc->ctx_handle,
+ 				      input_message_buffer);
+ 	return (ret);
+ }
+@@ -2776,8 +2882,13 @@ spnego_gss_pseudo_random(OM_uint32 *minor_status,
+ 			 gss_buffer_t prf_out)
+ {
+ 	OM_uint32 ret;
++	spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context;
++
++	if (sc->ctx_handle == GSS_C_NO_CONTEXT)
++		return (GSS_S_NO_CONTEXT);
++
+ 	ret = gss_pseudo_random(minor_status,
+-				context,
++				sc->ctx_handle,
+ 				prf_key,
+ 				prf_in,
+ 				desired_output_len,
+@@ -2918,7 +3029,12 @@ spnego_gss_get_mic_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
+ 		       gss_qop_t qop_req, gss_iov_buffer_desc *iov,
+ 		       int iov_count)
+ {
+-    return gss_get_mic_iov(minor_status, context_handle, qop_req, iov,
++    spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle;
++
++    if (sc->ctx_handle == GSS_C_NO_CONTEXT)
++	    return (GSS_S_NO_CONTEXT);
++
++    return gss_get_mic_iov(minor_status, sc->ctx_handle, qop_req, iov,
+ 			   iov_count);
+ }
+ 
+@@ -2927,7 +3043,12 @@ spnego_gss_verify_mic_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
+ 			  gss_qop_t *qop_state, gss_iov_buffer_desc *iov,
+ 			  int iov_count)
+ {
+-    return gss_verify_mic_iov(minor_status, context_handle, qop_state, iov,
++    spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle;
++
++    if (sc->ctx_handle == GSS_C_NO_CONTEXT)
++	    return (GSS_S_NO_CONTEXT);
++
++    return gss_verify_mic_iov(minor_status, sc->ctx_handle, qop_state, iov,
+ 			      iov_count);
+ }
+ 
+@@ -2936,7 +3057,12 @@ spnego_gss_get_mic_iov_length(OM_uint32 *minor_status,
+ 			      gss_ctx_id_t context_handle, gss_qop_t qop_req,
+ 			      gss_iov_buffer_desc *iov, int iov_count)
+ {
+-    return gss_get_mic_iov_length(minor_status, context_handle, qop_req, iov,
++    spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle;
++
++    if (sc->ctx_handle == GSS_C_NO_CONTEXT)
++	    return (GSS_S_NO_CONTEXT);
++
++    return gss_get_mic_iov_length(minor_status, sc->ctx_handle, qop_req, iov,
+ 				  iov_count);
+ }
+ 
diff --git a/gnu/packages/patches/mit-krb5-CVE-2015-2695-pt2.patch b/gnu/packages/patches/mit-krb5-CVE-2015-2695-pt2.patch
new file mode 100644
index 0000000000..aa9fcfa0dd
--- /dev/null
+++ b/gnu/packages/patches/mit-krb5-CVE-2015-2695-pt2.patch
@@ -0,0 +1,65 @@
+Copied from Debian.
+
+From 18c512ebdcc5cacc777e9dbcc6817f83c301ad93 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Wed, 4 Nov 2015 21:29:10 -0500
+Subject: Fix SPNEGO context import
+
+The patches for CVE-2015-2695 did not implement a SPNEGO
+gss_import_sec_context() function, under the erroneous belief than an
+exported SPNEGO context would be tagged with the underlying context
+mechanism.  Implement it now to allow SPNEGO contexts to be
+successfully exported and imported after establishment.
+
+ticket: 8273
+(cherry picked from commit fbb565f913c52eba9bea82f1694aba7a8c90e93d)
+
+Patch-Category: upstream
+---
+ src/lib/gssapi/spnego/spnego_mech.c | 33 +++++++++++++++++++++++++++------
+ 1 file changed, 27 insertions(+), 6 deletions(-)
+
+diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c
+index a1072b0..02284a1 100644
+--- a/src/lib/gssapi/spnego/spnego_mech.c
++++ b/src/lib/gssapi/spnego/spnego_mech.c
+@@ -2256,12 +2256,33 @@ spnego_gss_import_sec_context(
+ 	const gss_buffer_t	interprocess_token,
+ 	gss_ctx_id_t		*context_handle)
+ {
+-	/*
+-	 * Until we implement partial context exports, there are no SPNEGO
+-	 * exported context tokens, only tokens for underlying mechs.  So just
+-	 * return an error for now.
+-	 */
+-	return GSS_S_UNAVAILABLE;
++	OM_uint32 ret, tmpmin;
++	gss_ctx_id_t mctx;
++	spnego_gss_ctx_id_t sc;
++	int initiate, opened;
++
++	ret = gss_import_sec_context(minor_status, interprocess_token, &mctx);
++	if (ret != GSS_S_COMPLETE)
++		return ret;
++
++	ret = gss_inquire_context(&tmpmin, mctx, NULL, NULL, NULL, NULL, NULL,
++				  &initiate, &opened);
++	if (ret != GSS_S_COMPLETE || !opened) {
++		/* We don't currently support importing partially established
++		 * contexts. */
++		(void) gss_delete_sec_context(&tmpmin, &mctx, GSS_C_NO_BUFFER);
++		return GSS_S_FAILURE;
++	}
++
++	sc = create_spnego_ctx(initiate);
++	if (sc == NULL) {
++		(void) gss_delete_sec_context(&tmpmin, &mctx, GSS_C_NO_BUFFER);
++		return GSS_S_FAILURE;
++	}
++	sc->ctx_handle = mctx;
++	sc->opened = 1;
++	*context_handle = (gss_ctx_id_t)sc;
++	return GSS_S_COMPLETE;
+ }
+ #endif /* LEAN_CLIENT */
+ 
diff --git a/gnu/packages/patches/mit-krb5-CVE-2015-2696.patch b/gnu/packages/patches/mit-krb5-CVE-2015-2696.patch
new file mode 100644
index 0000000000..7b4b1d71ab
--- /dev/null
+++ b/gnu/packages/patches/mit-krb5-CVE-2015-2696.patch
@@ -0,0 +1,736 @@
+Copied from Debian.
+
+From ebea85358bc72ec20c53130d83acb93f95853b76 Mon Sep 17 00:00:00 2001
+From: Nicolas Williams <nico@twosigma.com>
+Date: Mon, 14 Sep 2015 12:28:36 -0400
+Subject: Fix IAKERB context aliasing bugs [CVE-2015-2696]
+
+The IAKERB mechanism currently replaces its context handle with the
+krb5 mechanism handle upon establishment, under the assumption that
+most GSS functions are only called after context establishment.  This
+assumption is incorrect, and can lead to aliasing violations for some
+programs.  Maintain the IAKERB context structure after context
+establishment and add new IAKERB entry points to refer to it with that
+type.  Add initiate and established flags to the IAKERB context
+structure for use in gss_inquire_context() prior to context
+establishment.
+
+CVE-2015-2696:
+
+In MIT krb5 1.9 and later, applications which call
+gss_inquire_context() on a partially-established IAKERB context can
+cause the GSS-API library to read from a pointer using the wrong type,
+generally causing a process crash.  Java server applications using the
+native JGSS provider are vulnerable to this bug.  A carefully crafted
+IAKERB packet might allow the gss_inquire_context() call to succeed
+with attacker-determined results, but applications should not make
+access control decisions based on gss_inquire_context() results prior
+to context establishment.
+
+    CVSSv2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C/E:POC/RL:OF/RC:C
+
+[ghudson@mit.edu: several bugfixes, style changes, and edge-case
+behavior changes; commit message and CVE description]
+
+ticket: 8244
+target_version: 1.14
+tags: pullup
+
+(cherry picked from commit e04f0283516e80d2f93366e0d479d13c9b5c8c2a)
+Patch-Category: upstream
+---
+ src/lib/gssapi/krb5/gssapiP_krb5.h | 114 ++++++++++++
+ src/lib/gssapi/krb5/gssapi_krb5.c  | 105 +++++++++--
+ src/lib/gssapi/krb5/iakerb.c       | 351 +++++++++++++++++++++++++++++++++----
+ 3 files changed, 529 insertions(+), 41 deletions(-)
+
+diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h
+index a0e8625..05dc321 100644
+--- a/src/lib/gssapi/krb5/gssapiP_krb5.h
++++ b/src/lib/gssapi/krb5/gssapiP_krb5.h
+@@ -620,6 +620,21 @@ OM_uint32 KRB5_CALLCONV krb5_gss_accept_sec_context_ext
+ );
+ #endif /* LEAN_CLIENT */
+ 
++OM_uint32 KRB5_CALLCONV krb5_gss_inquire_sec_context_by_oid
++(OM_uint32*,       /* minor_status */
++ const gss_ctx_id_t,
++ /* context_handle */
++ const gss_OID,    /* desired_object */
++ gss_buffer_set_t* /* data_set */
++);
++
++OM_uint32 KRB5_CALLCONV krb5_gss_set_sec_context_option
++(OM_uint32*,       /* minor_status */
++ gss_ctx_id_t*,    /* context_handle */
++ const gss_OID,    /* desired_object */
++ const gss_buffer_t/* value */
++);
++
+ OM_uint32 KRB5_CALLCONV krb5_gss_process_context_token
+ (OM_uint32*,       /* minor_status */
+  gss_ctx_id_t,     /* context_handle */
+@@ -1301,6 +1316,105 @@ OM_uint32 KRB5_CALLCONV
+ krb5_gss_import_cred(OM_uint32 *minor_status, gss_buffer_t token,
+                      gss_cred_id_t *cred_handle);
+ 
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_process_context_token(OM_uint32 *minor_status,
++                                 const gss_ctx_id_t context_handle,
++                                 const gss_buffer_t token_buffer);
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_context_time(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                        OM_uint32 *time_rec);
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_inquire_context(OM_uint32 *minor_status,
++                           gss_ctx_id_t context_handle, gss_name_t *src_name,
++                           gss_name_t *targ_name, OM_uint32 *lifetime_rec,
++                           gss_OID *mech_type, OM_uint32 *ctx_flags,
++                           int *locally_initiated, int *opened);
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_get_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                   gss_qop_t qop_req, gss_buffer_t message_buffer,
++                   gss_buffer_t message_token);
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_get_mic_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                       gss_qop_t qop_req, gss_iov_buffer_desc *iov,
++                       int iov_count);
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_get_mic_iov_length(OM_uint32 *minor_status,
++                              gss_ctx_id_t context_handle, gss_qop_t qop_req,
++                              gss_iov_buffer_desc *iov, int iov_count);
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_verify_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                      gss_buffer_t msg_buffer, gss_buffer_t token_buffer,
++                      gss_qop_t *qop_state);
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_verify_mic_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                          gss_qop_t *qop_state, gss_iov_buffer_desc *iov,
++                          int iov_count);
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_wrap(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                int conf_req_flag, gss_qop_t qop_req,
++                gss_buffer_t input_message_buffer, int *conf_state,
++                gss_buffer_t output_message_buffer);
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_wrap_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                    int conf_req_flag, gss_qop_t qop_req, int *conf_state,
++                    gss_iov_buffer_desc *iov, int iov_count);
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_wrap_iov_length(OM_uint32 *minor_status,
++                           gss_ctx_id_t context_handle, int conf_req_flag,
++                           gss_qop_t qop_req, int *conf_state,
++                           gss_iov_buffer_desc *iov, int iov_count);
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_unwrap(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                  gss_buffer_t input_message_buffer,
++                  gss_buffer_t output_message_buffer, int *conf_state,
++                  gss_qop_t *qop_state);
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_unwrap_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                      int *conf_state, gss_qop_t *qop_state,
++                      gss_iov_buffer_desc *iov, int iov_count);
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_wrap_size_limit(OM_uint32 *minor_status,
++                           gss_ctx_id_t context_handle, int conf_req_flag,
++                           gss_qop_t qop_req, OM_uint32 req_output_size,
++                           OM_uint32 *max_input_size);
++
++#ifndef LEAN_CLIENT
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_export_sec_context(OM_uint32 *minor_status,
++                              gss_ctx_id_t *context_handle,
++                              gss_buffer_t interprocess_token);
++#endif /* LEAN_CLIENT */
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_inquire_sec_context_by_oid(OM_uint32 *minor_status,
++                                      const gss_ctx_id_t context_handle,
++                                      const gss_OID desired_object,
++                                      gss_buffer_set_t *data_set);
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_set_sec_context_option(OM_uint32 *minor_status,
++                                  gss_ctx_id_t *context_handle,
++                                  const gss_OID desired_object,
++                                  const gss_buffer_t value);
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_pseudo_random(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                         int prf_key, const gss_buffer_t prf_in,
++                         ssize_t desired_output_len, gss_buffer_t prf_out);
++
+ /* Magic string to identify exported krb5 GSS credentials.  Increment this if
+  * the format changes. */
+ #define CRED_EXPORT_MAGIC "K5C1"
+diff --git a/src/lib/gssapi/krb5/gssapi_krb5.c b/src/lib/gssapi/krb5/gssapi_krb5.c
+index 77b7fff..9a23656 100644
+--- a/src/lib/gssapi/krb5/gssapi_krb5.c
++++ b/src/lib/gssapi/krb5/gssapi_krb5.c
+@@ -345,7 +345,7 @@ static struct {
+     }
+ };
+ 
+-static OM_uint32 KRB5_CALLCONV
++OM_uint32 KRB5_CALLCONV
+ krb5_gss_inquire_sec_context_by_oid (OM_uint32 *minor_status,
+                                      const gss_ctx_id_t context_handle,
+                                      const gss_OID desired_object,
+@@ -459,7 +459,7 @@ static struct {
+ };
+ #endif
+ 
+-static OM_uint32 KRB5_CALLCONV
++OM_uint32 KRB5_CALLCONV
+ krb5_gss_set_sec_context_option (OM_uint32 *minor_status,
+                                  gss_ctx_id_t *context_handle,
+                                  const gss_OID desired_object,
+@@ -904,20 +904,103 @@ static struct gss_config krb5_mechanism = {
+     krb5_gss_get_mic_iov_length,
+ };
+ 
++/* Functions which use security contexts or acquire creds are IAKERB-specific;
++ * other functions can borrow from the krb5 mech. */
++static struct gss_config iakerb_mechanism = {
++    { GSS_MECH_KRB5_OID_LENGTH, GSS_MECH_KRB5_OID },
++    NULL,
++    iakerb_gss_acquire_cred,
++    krb5_gss_release_cred,
++    iakerb_gss_init_sec_context,
++#ifdef LEAN_CLIENT
++    NULL,
++#else
++    iakerb_gss_accept_sec_context,
++#endif
++    iakerb_gss_process_context_token,
++    iakerb_gss_delete_sec_context,
++    iakerb_gss_context_time,
++    iakerb_gss_get_mic,
++    iakerb_gss_verify_mic,
++#if defined(IOV_SHIM_EXERCISE_WRAP) || defined(IOV_SHIM_EXERCISE)
++    NULL,
++#else
++    iakerb_gss_wrap,
++#endif
++#if defined(IOV_SHIM_EXERCISE_UNWRAP) || defined(IOV_SHIM_EXERCISE)
++    NULL,
++#else
++    iakerb_gss_unwrap,
++#endif
++    krb5_gss_display_status,
++    krb5_gss_indicate_mechs,
++    krb5_gss_compare_name,
++    krb5_gss_display_name,
++    krb5_gss_import_name,
++    krb5_gss_release_name,
++    krb5_gss_inquire_cred,
++    NULL,                /* add_cred */
++#ifdef LEAN_CLIENT
++    NULL,
++    NULL,
++#else
++    iakerb_gss_export_sec_context,
++    NULL,
++#endif
++    krb5_gss_inquire_cred_by_mech,
++    krb5_gss_inquire_names_for_mech,
++    iakerb_gss_inquire_context,
++    krb5_gss_internal_release_oid,
++    iakerb_gss_wrap_size_limit,
++    krb5_gss_localname,
++    krb5_gss_authorize_localname,
++    krb5_gss_export_name,
++    krb5_gss_duplicate_name,
++    krb5_gss_store_cred,
++    iakerb_gss_inquire_sec_context_by_oid,
++    krb5_gss_inquire_cred_by_oid,
++    iakerb_gss_set_sec_context_option,
++    krb5_gssspi_set_cred_option,
++    krb5_gssspi_mech_invoke,
++    NULL,                /* wrap_aead */
++    NULL,                /* unwrap_aead */
++    iakerb_gss_wrap_iov,
++    iakerb_gss_unwrap_iov,
++    iakerb_gss_wrap_iov_length,
++    NULL,               /* complete_auth_token */
++    NULL,               /* acquire_cred_impersonate_name */
++    NULL,               /* add_cred_impersonate_name */
++    NULL,               /* display_name_ext */
++    krb5_gss_inquire_name,
++    krb5_gss_get_name_attribute,
++    krb5_gss_set_name_attribute,
++    krb5_gss_delete_name_attribute,
++    krb5_gss_export_name_composite,
++    krb5_gss_map_name_to_any,
++    krb5_gss_release_any_name_mapping,
++    iakerb_gss_pseudo_random,
++    NULL,               /* set_neg_mechs */
++    krb5_gss_inquire_saslname_for_mech,
++    krb5_gss_inquire_mech_for_saslname,
++    krb5_gss_inquire_attrs_for_mech,
++    krb5_gss_acquire_cred_from,
++    krb5_gss_store_cred_into,
++    iakerb_gss_acquire_cred_with_password,
++    krb5_gss_export_cred,
++    krb5_gss_import_cred,
++    NULL,               /* import_sec_context_by_mech */
++    NULL,               /* import_name_by_mech */
++    NULL,               /* import_cred_by_mech */
++    iakerb_gss_get_mic_iov,
++    iakerb_gss_verify_mic_iov,
++    iakerb_gss_get_mic_iov_length,
++};
++
+ #ifdef _GSS_STATIC_LINK
+ #include "mglueP.h"
+ static int gss_iakerbmechglue_init(void)
+ {
+     struct gss_mech_config mech_iakerb;
+-    struct gss_config iakerb_mechanism = krb5_mechanism;
+-
+-    /* IAKERB mechanism mirrors krb5, but with different context SPIs */
+-    iakerb_mechanism.gss_accept_sec_context = iakerb_gss_accept_sec_context;
+-    iakerb_mechanism.gss_init_sec_context   = iakerb_gss_init_sec_context;
+-    iakerb_mechanism.gss_delete_sec_context = iakerb_gss_delete_sec_context;
+-    iakerb_mechanism.gss_acquire_cred       = iakerb_gss_acquire_cred;
+-    iakerb_mechanism.gssspi_acquire_cred_with_password
+-                                    = iakerb_gss_acquire_cred_with_password;
+ 
+     memset(&mech_iakerb, 0, sizeof(mech_iakerb));
+     mech_iakerb.mech = &iakerb_mechanism;
+diff --git a/src/lib/gssapi/krb5/iakerb.c b/src/lib/gssapi/krb5/iakerb.c
+index f30de32..4662bd9 100644
+--- a/src/lib/gssapi/krb5/iakerb.c
++++ b/src/lib/gssapi/krb5/iakerb.c
+@@ -47,6 +47,8 @@ struct _iakerb_ctx_id_rec {
+     gss_ctx_id_t gssc;
+     krb5_data conv;                     /* conversation for checksumming */
+     unsigned int count;                 /* number of round trips */
++    int initiate;
++    int established;
+     krb5_get_init_creds_opt *gic_opts;
+ };
+ 
+@@ -695,7 +697,7 @@ cleanup:
+  * Allocate and initialise an IAKERB context
+  */
+ static krb5_error_code
+-iakerb_alloc_context(iakerb_ctx_id_t *pctx)
++iakerb_alloc_context(iakerb_ctx_id_t *pctx, int initiate)
+ {
+     iakerb_ctx_id_t ctx;
+     krb5_error_code code;
+@@ -709,6 +711,8 @@ iakerb_alloc_context(iakerb_ctx_id_t *pctx)
+     ctx->magic = KG_IAKERB_CONTEXT;
+     ctx->state = IAKERB_AS_REQ;
+     ctx->count = 0;
++    ctx->initiate = initiate;
++    ctx->established = 0;
+ 
+     code = krb5_gss_init_context(&ctx->k5c);
+     if (code != 0)
+@@ -732,7 +736,7 @@ iakerb_gss_delete_sec_context(OM_uint32 *minor_status,
+                               gss_ctx_id_t *context_handle,
+                               gss_buffer_t output_token)
+ {
+-    OM_uint32 major_status = GSS_S_COMPLETE;
++    iakerb_ctx_id_t iakerb_ctx = (iakerb_ctx_id_t)*context_handle;
+ 
+     if (output_token != GSS_C_NO_BUFFER) {
+         output_token->length = 0;
+@@ -740,23 +744,10 @@ iakerb_gss_delete_sec_context(OM_uint32 *minor_status,
+     }
+ 
+     *minor_status = 0;
++    *context_handle = GSS_C_NO_CONTEXT;
++    iakerb_release_context(iakerb_ctx);
+ 
+-    if (*context_handle != GSS_C_NO_CONTEXT) {
+-        iakerb_ctx_id_t iakerb_ctx = (iakerb_ctx_id_t)*context_handle;
+-
+-        if (iakerb_ctx->magic == KG_IAKERB_CONTEXT) {
+-            iakerb_release_context(iakerb_ctx);
+-            *context_handle = GSS_C_NO_CONTEXT;
+-        } else {
+-            assert(iakerb_ctx->magic == KG_CONTEXT);
+-
+-            major_status = krb5_gss_delete_sec_context(minor_status,
+-                                                       context_handle,
+-                                                       output_token);
+-        }
+-    }
+-
+-    return major_status;
++    return GSS_S_COMPLETE;
+ }
+ 
+ static krb5_boolean
+@@ -802,7 +793,7 @@ iakerb_gss_accept_sec_context(OM_uint32 *minor_status,
+     int initialContextToken = (*context_handle == GSS_C_NO_CONTEXT);
+ 
+     if (initialContextToken) {
+-        code = iakerb_alloc_context(&ctx);
++        code = iakerb_alloc_context(&ctx, 0);
+         if (code != 0)
+             goto cleanup;
+ 
+@@ -854,11 +845,8 @@ iakerb_gss_accept_sec_context(OM_uint32 *minor_status,
+                                                        time_rec,
+                                                        delegated_cred_handle,
+                                                        &exts);
+-        if (major_status == GSS_S_COMPLETE) {
+-            *context_handle = ctx->gssc;
+-            ctx->gssc = NULL;
+-            iakerb_release_context(ctx);
+-        }
++        if (major_status == GSS_S_COMPLETE)
++            ctx->established = 1;
+         if (mech_type != NULL)
+             *mech_type = (gss_OID)gss_mech_krb5;
+     }
+@@ -897,7 +885,7 @@ iakerb_gss_init_sec_context(OM_uint32 *minor_status,
+     int initialContextToken = (*context_handle == GSS_C_NO_CONTEXT);
+ 
+     if (initialContextToken) {
+-        code = iakerb_alloc_context(&ctx);
++        code = iakerb_alloc_context(&ctx, 1);
+         if (code != 0) {
+             *minor_status = code;
+             goto cleanup;
+@@ -983,11 +971,8 @@ iakerb_gss_init_sec_context(OM_uint32 *minor_status,
+                                                      ret_flags,
+                                                      time_rec,
+                                                      &exts);
+-        if (major_status == GSS_S_COMPLETE) {
+-            *context_handle = ctx->gssc;
+-            ctx->gssc = GSS_C_NO_CONTEXT;
+-            iakerb_release_context(ctx);
+-        }
++        if (major_status == GSS_S_COMPLETE)
++            ctx->established = 1;
+         if (actual_mech_type != NULL)
+             *actual_mech_type = (gss_OID)gss_mech_krb5;
+     } else {
+@@ -1010,3 +995,309 @@ cleanup:
+ 
+     return major_status;
+ }
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_unwrap(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                  gss_buffer_t input_message_buffer,
++                  gss_buffer_t output_message_buffer, int *conf_state,
++                  gss_qop_t *qop_state)
++{
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
++
++    if (ctx->gssc == GSS_C_NO_CONTEXT)
++        return GSS_S_NO_CONTEXT;
++
++    return krb5_gss_unwrap(minor_status, ctx->gssc, input_message_buffer,
++                           output_message_buffer, conf_state, qop_state);
++}
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_wrap(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                int conf_req_flag, gss_qop_t qop_req,
++                gss_buffer_t input_message_buffer, int *conf_state,
++                gss_buffer_t output_message_buffer)
++{
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
++
++    if (ctx->gssc == GSS_C_NO_CONTEXT)
++        return GSS_S_NO_CONTEXT;
++
++    return krb5_gss_wrap(minor_status, ctx->gssc, conf_req_flag, qop_req,
++                         input_message_buffer, conf_state,
++                         output_message_buffer);
++}
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_process_context_token(OM_uint32 *minor_status,
++                                 const gss_ctx_id_t context_handle,
++                                 const gss_buffer_t token_buffer)
++{
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
++
++    if (ctx->gssc == GSS_C_NO_CONTEXT)
++        return GSS_S_DEFECTIVE_TOKEN;
++
++    return krb5_gss_process_context_token(minor_status, ctx->gssc,
++                                          token_buffer);
++}
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_context_time(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                        OM_uint32 *time_rec)
++{
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
++
++    if (ctx->gssc == GSS_C_NO_CONTEXT)
++        return GSS_S_NO_CONTEXT;
++
++    return krb5_gss_context_time(minor_status, ctx->gssc, time_rec);
++}
++
++#ifndef LEAN_CLIENT
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_export_sec_context(OM_uint32 *minor_status,
++                              gss_ctx_id_t *context_handle,
++                              gss_buffer_t interprocess_token)
++{
++    OM_uint32 maj;
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
++
++    /* We don't currently support exporting partially established contexts. */
++    if (!ctx->established)
++        return GSS_S_UNAVAILABLE;
++
++    maj = krb5_gss_export_sec_context(minor_status, &ctx->gssc,
++                                      interprocess_token);
++    if (ctx->gssc == GSS_C_NO_CONTEXT) {
++        iakerb_release_context(ctx);
++        *context_handle = GSS_C_NO_CONTEXT;
++    }
++    return maj;
++}
++
++/*
++ * Until we implement partial context exports, there are no SPNEGO exported
++ * context tokens, only tokens for the underlying krb5 context.  So we do not
++ * need to implement an iakerb_gss_import_sec_context() yet; it would be
++ * unreachable except via a manually constructed token.
++ */
++
++#endif /* LEAN_CLIENT */
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_inquire_context(OM_uint32 *minor_status,
++                           gss_ctx_id_t context_handle, gss_name_t *src_name,
++                           gss_name_t *targ_name, OM_uint32 *lifetime_rec,
++                           gss_OID *mech_type, OM_uint32 *ctx_flags,
++                           int *initiate, int *opened)
++{
++    OM_uint32 ret;
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
++
++    if (src_name != NULL)
++        *src_name = GSS_C_NO_NAME;
++    if (targ_name != NULL)
++        *targ_name = GSS_C_NO_NAME;
++    if (lifetime_rec != NULL)
++        *lifetime_rec = 0;
++    if (mech_type != NULL)
++        *mech_type = (gss_OID)gss_mech_iakerb;
++    if (ctx_flags != NULL)
++        *ctx_flags = 0;
++    if (initiate != NULL)
++        *initiate = ctx->initiate;
++    if (opened != NULL)
++        *opened = ctx->established;
++
++    if (ctx->gssc == GSS_C_NO_CONTEXT)
++        return GSS_S_COMPLETE;
++
++    ret = krb5_gss_inquire_context(minor_status, ctx->gssc, src_name,
++                                   targ_name, lifetime_rec, mech_type,
++                                   ctx_flags, initiate, opened);
++
++    if (!ctx->established) {
++        /* Report IAKERB as the mech OID until the context is established. */
++        if (mech_type != NULL)
++            *mech_type = (gss_OID)gss_mech_iakerb;
++
++        /* We don't support exporting partially-established contexts. */
++        if (ctx_flags != NULL)
++            *ctx_flags &= ~GSS_C_TRANS_FLAG;
++    }
++
++    return ret;
++}
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_wrap_size_limit(OM_uint32 *minor_status,
++                           gss_ctx_id_t context_handle, int conf_req_flag,
++                           gss_qop_t qop_req, OM_uint32 req_output_size,
++                           OM_uint32 *max_input_size)
++{
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
++
++    if (ctx->gssc == GSS_C_NO_CONTEXT)
++        return GSS_S_NO_CONTEXT;
++
++    return krb5_gss_wrap_size_limit(minor_status, ctx->gssc, conf_req_flag,
++                                    qop_req, req_output_size, max_input_size);
++}
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_get_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                   gss_qop_t qop_req, gss_buffer_t message_buffer,
++                   gss_buffer_t message_token)
++{
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
++
++    if (ctx->gssc == GSS_C_NO_CONTEXT)
++        return GSS_S_NO_CONTEXT;
++
++    return krb5_gss_get_mic(minor_status, ctx->gssc, qop_req, message_buffer,
++                            message_token);
++}
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_verify_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                      gss_buffer_t msg_buffer, gss_buffer_t token_buffer,
++                      gss_qop_t *qop_state)
++{
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
++
++    if (ctx->gssc == GSS_C_NO_CONTEXT)
++        return GSS_S_NO_CONTEXT;
++
++    return krb5_gss_verify_mic(minor_status, ctx->gssc, msg_buffer,
++                               token_buffer, qop_state);
++}
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_inquire_sec_context_by_oid(OM_uint32 *minor_status,
++                                      const gss_ctx_id_t context_handle,
++                                      const gss_OID desired_object,
++                                      gss_buffer_set_t *data_set)
++{
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
++
++    if (ctx->gssc == GSS_C_NO_CONTEXT)
++        return GSS_S_UNAVAILABLE;
++
++    return krb5_gss_inquire_sec_context_by_oid(minor_status, ctx->gssc,
++                                               desired_object, data_set);
++}
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_set_sec_context_option(OM_uint32 *minor_status,
++                                  gss_ctx_id_t *context_handle,
++                                  const gss_OID desired_object,
++                                  const gss_buffer_t value)
++{
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)*context_handle;
++
++    if (ctx == NULL || ctx->gssc == GSS_C_NO_CONTEXT)
++        return GSS_S_UNAVAILABLE;
++
++    return krb5_gss_set_sec_context_option(minor_status, &ctx->gssc,
++                                           desired_object, value);
++}
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_wrap_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                    int conf_req_flag, gss_qop_t qop_req, int *conf_state,
++                    gss_iov_buffer_desc *iov, int iov_count)
++{
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
++
++    if (ctx->gssc == GSS_C_NO_CONTEXT)
++        return GSS_S_NO_CONTEXT;
++
++    return krb5_gss_wrap_iov(minor_status, ctx->gssc, conf_req_flag, qop_req,
++                             conf_state, iov, iov_count);
++}
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_unwrap_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                      int *conf_state, gss_qop_t *qop_state,
++                      gss_iov_buffer_desc *iov, int iov_count)
++{
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
++
++    if (ctx->gssc == GSS_C_NO_CONTEXT)
++        return GSS_S_NO_CONTEXT;
++
++    return krb5_gss_unwrap_iov(minor_status, ctx->gssc, conf_state, qop_state,
++                               iov, iov_count);
++}
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_wrap_iov_length(OM_uint32 *minor_status,
++                           gss_ctx_id_t context_handle, int conf_req_flag,
++                           gss_qop_t qop_req, int *conf_state,
++                           gss_iov_buffer_desc *iov, int iov_count)
++{
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
++
++    if (ctx->gssc == GSS_C_NO_CONTEXT)
++        return GSS_S_NO_CONTEXT;
++
++    return krb5_gss_wrap_iov_length(minor_status, ctx->gssc, conf_req_flag,
++                                    qop_req, conf_state, iov, iov_count);
++}
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_pseudo_random(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                         int prf_key, const gss_buffer_t prf_in,
++                         ssize_t desired_output_len, gss_buffer_t prf_out)
++{
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
++
++    if (ctx->gssc == GSS_C_NO_CONTEXT)
++        return GSS_S_NO_CONTEXT;
++
++    return krb5_gss_pseudo_random(minor_status, ctx->gssc, prf_key, prf_in,
++                                  desired_output_len, prf_out);
++}
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_get_mic_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                       gss_qop_t qop_req, gss_iov_buffer_desc *iov,
++                       int iov_count)
++{
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
++
++    if (ctx->gssc == GSS_C_NO_CONTEXT)
++        return GSS_S_NO_CONTEXT;
++
++    return krb5_gss_get_mic_iov(minor_status, ctx->gssc, qop_req, iov,
++                                iov_count);
++}
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_verify_mic_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                          gss_qop_t *qop_state, gss_iov_buffer_desc *iov,
++                          int iov_count)
++{
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
++
++    if (ctx->gssc == GSS_C_NO_CONTEXT)
++        return GSS_S_NO_CONTEXT;
++
++    return krb5_gss_verify_mic_iov(minor_status, ctx->gssc, qop_state, iov,
++                                   iov_count);
++}
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_get_mic_iov_length(OM_uint32 *minor_status,
++                              gss_ctx_id_t context_handle, gss_qop_t qop_req,
++                              gss_iov_buffer_desc *iov, int iov_count)
++{
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
++
++    if (ctx->gssc == GSS_C_NO_CONTEXT)
++        return GSS_S_NO_CONTEXT;
++
++    return krb5_gss_get_mic_iov_length(minor_status, ctx->gssc, qop_req, iov,
++                                       iov_count);
++}
diff --git a/gnu/packages/patches/mit-krb5-CVE-2015-2697.patch b/gnu/packages/patches/mit-krb5-CVE-2015-2697.patch
new file mode 100644
index 0000000000..f65ce39623
--- /dev/null
+++ b/gnu/packages/patches/mit-krb5-CVE-2015-2697.patch
@@ -0,0 +1,55 @@
+Copied from Debian.
+
+From fcafb522a0509bfd6f4f6b57e4a1e93c0092eeb0 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Fri, 25 Sep 2015 12:51:47 -0400
+Subject: Fix build_principal memory bug [CVE-2015-2697]
+
+In build_principal_va(), use k5memdup0() instead of strdup() to make a
+copy of the realm, to ensure that we allocate the correct number of
+bytes and do not read past the end of the input string.  This bug
+affects krb5_build_principal(), krb5_build_principal_va(), and
+krb5_build_principal_alloc_va().  krb5_build_principal_ext() is not
+affected.
+
+CVE-2015-2697:
+
+In MIT krb5 1.7 and later, an authenticated attacker may be able to
+cause a KDC to crash using a TGS request with a large realm field
+beginning with a null byte.  If the KDC attempts to find a referral to
+answer the request, it constructs a principal name for lookup using
+krb5_build_principal() with the requested realm.  Due to a bug in this
+function, the null byte causes only one byte be allocated for the
+realm field of the constructed principal, far less than its length.
+Subsequent operations on the lookup principal may cause a read beyond
+the end of the mapped memory region, causing the KDC process to crash.
+
+CVSSv2: AV:N/AC:L/Au:S/C:N/I:N/A:C/E:POC/RL:OF/RC:C
+
+ticket: 8252 (new)
+target_version: 1.14
+tags: pullup
+
+(cherry picked from commit f0c094a1b745d91ef2f9a4eae2149aac026a5789)
+Patch-Category: upstream
+---
+ src/lib/krb5/krb/bld_princ.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/src/lib/krb5/krb/bld_princ.c b/src/lib/krb5/krb/bld_princ.c
+index ab6fed8..8604268 100644
+--- a/src/lib/krb5/krb/bld_princ.c
++++ b/src/lib/krb5/krb/bld_princ.c
+@@ -40,10 +40,8 @@ build_principal_va(krb5_context context, krb5_principal princ,
+     data = malloc(size * sizeof(krb5_data));
+     if (!data) { retval = ENOMEM; }
+ 
+-    if (!retval) {
+-        r = strdup(realm);
+-        if (!r) { retval = ENOMEM; }
+-    }
++    if (!retval)
++        r = k5memdup0(realm, rlen, &retval);
+ 
+     while (!retval && (component = va_arg(ap, char *))) {
+         if (count == size) {
diff --git a/gnu/packages/patches/mit-krb5-CVE-2015-2698-pt1.patch b/gnu/packages/patches/mit-krb5-CVE-2015-2698-pt1.patch
new file mode 100644
index 0000000000..67545e4c16
--- /dev/null
+++ b/gnu/packages/patches/mit-krb5-CVE-2015-2698-pt1.patch
@@ -0,0 +1,43 @@
+Copied from Debian.
+
+From 1a8bdc6d81dcd7dd8a4d42e8de6d2cacf1dd4408 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Tue, 27 Oct 2015 00:44:24 -0400
+Subject: Fix two IAKERB comments
+
+The comment explaining why there is no iakerb_gss_import_sec_context()
+erroneously referenced SPNEGO instead of IAKERB (noticed by Ben
+Kaduk).  The comment above iakerb_gss_delete_sec_context() is out of
+date after the last commit.
+
+(cherry picked from commit 92d6dd045dfc06cc03d20b327a6ee7a71e6bc24d)
+
+Patch-Category: upstream
+---
+ src/lib/gssapi/krb5/iakerb.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/src/lib/gssapi/krb5/iakerb.c b/src/lib/gssapi/krb5/iakerb.c
+index 4662bd9..e25862d 100644
+--- a/src/lib/gssapi/krb5/iakerb.c
++++ b/src/lib/gssapi/krb5/iakerb.c
+@@ -727,10 +727,6 @@ cleanup:
+     return code;
+ }
+ 
+-/*
+- * Delete an IAKERB context. This can also accept Kerberos context
+- * handles. The heuristic is similar to SPNEGO's delete_sec_context.
+- */
+ OM_uint32 KRB5_CALLCONV
+ iakerb_gss_delete_sec_context(OM_uint32 *minor_status,
+                               gss_ctx_id_t *context_handle,
+@@ -1077,7 +1073,7 @@ iakerb_gss_export_sec_context(OM_uint32 *minor_status,
+ }
+ 
+ /*
+- * Until we implement partial context exports, there are no SPNEGO exported
++ * Until we implement partial context exports, there are no IAKERB exported
+  * context tokens, only tokens for the underlying krb5 context.  So we do not
+  * need to implement an iakerb_gss_import_sec_context() yet; it would be
+  * unreachable except via a manually constructed token.
diff --git a/gnu/packages/patches/mit-krb5-CVE-2015-2698-pt2.patch b/gnu/packages/patches/mit-krb5-CVE-2015-2698-pt2.patch
new file mode 100644
index 0000000000..8725cd4eed
--- /dev/null
+++ b/gnu/packages/patches/mit-krb5-CVE-2015-2698-pt2.patch
@@ -0,0 +1,132 @@
+Copied from Debian.
+
+From 4b330d5be1f8048be4d079ac3cb38d60c0e99e69 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Wed, 4 Nov 2015 21:28:28 -0500
+Subject: Fix IAKERB context export/import [CVE-2015-2698]
+
+The patches for CVE-2015-2696 contained a regression in the newly
+added IAKERB iakerb_gss_export_sec_context() function, which could
+cause it to corrupt memory.  Fix the regression by properly
+dereferencing the context_handle pointer before casting it.
+
+Also, the patches did not implement an IAKERB gss_import_sec_context()
+function, under the erroneous belief than an exported IAKERB context
+would be tagged as a krb5 context.  Implement it now to allow IAKERB
+contexts to be successfully exported and imported after establishment.
+
+CVE-2015-2698:
+
+In any MIT krb5 release with the patches for CVE-2015-2696 applied, an
+application which calls gss_export_sec_context() may experience memory
+corruption if the context was established using the IAKERB mechanism.
+Historically, some vulnerabilities of this nature can be translated
+into remote code execution, though the necessary exploits must be
+tailored to the individual application and are usually quite
+complicated.
+
+    CVSSv2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C
+
+ticket: 8273 (new)
+target_version: 1.14
+tags: pullup
+
+(cherry picked from commit d8b31c874c7d1039be7649362ef11c89f4e14c27)
+
+Patch-Category: upstream
+---
+ src/lib/gssapi/krb5/gssapiP_krb5.h |  5 +++++
+ src/lib/gssapi/krb5/gssapi_krb5.c  |  2 +-
+ src/lib/gssapi/krb5/iakerb.c       | 42 +++++++++++++++++++++++++++++++-------
+ 3 files changed, 41 insertions(+), 8 deletions(-)
+
+diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h
+index 05dc321..ac53662 100644
+--- a/src/lib/gssapi/krb5/gssapiP_krb5.h
++++ b/src/lib/gssapi/krb5/gssapiP_krb5.h
+@@ -1396,6 +1396,11 @@ OM_uint32 KRB5_CALLCONV
+ iakerb_gss_export_sec_context(OM_uint32 *minor_status,
+                               gss_ctx_id_t *context_handle,
+                               gss_buffer_t interprocess_token);
++
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_import_sec_context(OM_uint32 *minor_status,
++                              const gss_buffer_t interprocess_token,
++                              gss_ctx_id_t *context_handle);
+ #endif /* LEAN_CLIENT */
+ 
+ OM_uint32 KRB5_CALLCONV
+diff --git a/src/lib/gssapi/krb5/gssapi_krb5.c b/src/lib/gssapi/krb5/gssapi_krb5.c
+index 9a23656..d7ba279 100644
+--- a/src/lib/gssapi/krb5/gssapi_krb5.c
++++ b/src/lib/gssapi/krb5/gssapi_krb5.c
+@@ -945,7 +945,7 @@ static struct gss_config iakerb_mechanism = {
+     NULL,
+ #else
+     iakerb_gss_export_sec_context,
+-    NULL,
++    iakerb_gss_import_sec_context,
+ #endif
+     krb5_gss_inquire_cred_by_mech,
+     krb5_gss_inquire_names_for_mech,
+diff --git a/src/lib/gssapi/krb5/iakerb.c b/src/lib/gssapi/krb5/iakerb.c
+index e25862d..32a341e 100644
+--- a/src/lib/gssapi/krb5/iakerb.c
++++ b/src/lib/gssapi/krb5/iakerb.c
+@@ -1057,7 +1057,7 @@ iakerb_gss_export_sec_context(OM_uint32 *minor_status,
+                               gss_buffer_t interprocess_token)
+ {
+     OM_uint32 maj;
+-    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle;
++    iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)*context_handle;
+ 
+     /* We don't currently support exporting partially established contexts. */
+     if (!ctx->established)
+@@ -1072,13 +1072,41 @@ iakerb_gss_export_sec_context(OM_uint32 *minor_status,
+     return maj;
+ }
+ 
+-/*
+- * Until we implement partial context exports, there are no IAKERB exported
+- * context tokens, only tokens for the underlying krb5 context.  So we do not
+- * need to implement an iakerb_gss_import_sec_context() yet; it would be
+- * unreachable except via a manually constructed token.
+- */
++OM_uint32 KRB5_CALLCONV
++iakerb_gss_import_sec_context(OM_uint32 *minor_status,
++                              gss_buffer_t interprocess_token,
++                              gss_ctx_id_t *context_handle)
++{
++    OM_uint32 maj, tmpmin;
++    krb5_error_code code;
++    gss_ctx_id_t gssc;
++    krb5_gss_ctx_id_t kctx;
++    iakerb_ctx_id_t ctx;
++
++    maj = krb5_gss_import_sec_context(minor_status, interprocess_token, &gssc);
++    if (maj != GSS_S_COMPLETE)
++        return maj;
++    kctx = (krb5_gss_ctx_id_t)gssc;
++
++    if (!kctx->established) {
++        /* We don't currently support importing partially established
++         * contexts. */
++        krb5_gss_delete_sec_context(&tmpmin, &gssc, GSS_C_NO_BUFFER);
++        return GSS_S_FAILURE;
++    }
+ 
++    code = iakerb_alloc_context(&ctx, kctx->initiate);
++    if (code != 0) {
++        krb5_gss_delete_sec_context(&tmpmin, &gssc, GSS_C_NO_BUFFER);
++        *minor_status = code;
++        return GSS_S_FAILURE;
++    }
++
++    ctx->gssc = gssc;
++    ctx->established = 1;
++    *context_handle = (gss_ctx_id_t)ctx;
++    return GSS_S_COMPLETE;
++}
+ #endif /* LEAN_CLIENT */
+ 
+ OM_uint32 KRB5_CALLCONV
diff --git a/gnu/packages/patches/mit-krb5-init-fix.patch b/gnu/packages/patches/mit-krb5-init-fix.patch
deleted file mode 100644
index 13e49c2789..0000000000
--- a/gnu/packages/patches/mit-krb5-init-fix.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-Fix the early context initialization code to avoid assuming that
-arguments will be evaluated from right to left.
-
-Patch by Mark H Weaver <mhw@netris.org>.
-
---- src/lib/krb5/krb/t_cc_config.c.orig	2012-12-17 21:47:05.000000000 -0500
-+++ src/lib/krb5/krb/t_cc_config.c	2013-10-29 18:19:16.547994590 -0400
-@@ -117,8 +117,8 @@
-     int c;
-     unsigned int i;
- 
--    bail_on_err(context, "Error initializing Kerberos library",
--                krb5_init_context(&context));
-+    ret = krb5_init_context(&context);
-+    bail_on_err(context, "Error initializing Kerberos library", ret);
-     bail_on_err(context, "Error getting location of default ccache",
-                 krb5_cc_default(context, &ccache));
-     server = NULL;
diff --git a/gnu/packages/patches/mupen64plus-ui-console-notice.patch b/gnu/packages/patches/mupen64plus-ui-console-notice.patch
new file mode 100644
index 0000000000..1d0b4c46bb
--- /dev/null
+++ b/gnu/packages/patches/mupen64plus-ui-console-notice.patch
@@ -0,0 +1,34 @@
+Mupen64Plus supports a single data directory and a single plugin directory in
+its configuration, yet we need data and plugin files from a variety of
+packages.  The best way to deal with this is to install all packages from
+which data and plugin files are needed into one's profile, and point the
+configuration there.  Hence, the ui-console package provides propagated inputs
+for packages with the most important data and plugin files, and this patch
+provides the user instructions on what needs to be done in order to have
+Mupen64Plus find the relevant data and plugins.
+
+--- a/src/plugin.c
++++ b/src/plugin.c
+@@ -122,6 +122,22 @@ m64p_error PluginSearchLoad(m64p_handle ConfigUI)
+     {
+         const char *plugindir = (*ConfigGetParamString)(ConfigUI, "PluginDir");
+         lib_filelist = osal_library_search(plugindir);
++        /* Guix specific */
++        if (lib_filelist == NULL)
++        {
++            DebugMessage(M64MSG_ERROR, "No plugins found in PluginDir path: %s", plugindir);
++            DebugMessage(M64MSG_ERROR,
++                         "\n\n"
++                         "*********************************\n"
++                         "*** Notice for GNU Guix users ***\n"
++                         "*********************************\n"
++                         "\n"
++                         "You might want to edit your mupen64plus.cfg (in $XDG_CONFIG_HOME by default)\n"
++                         "and set SharedDataPath to /path/to/my_guix_profile/share/mupen64plus and\n"
++                         "PluginDir to /path/to/my_guix_profile/lib/mupen64plus so that data and plugins\n"
++                         "are found.\n"
++                         "\n");
++        }
+     }
+ 
+     /* if still no plugins found, search some common system folders */
diff --git a/gnu/packages/patches/preseq-1.0.2-install-to-PREFIX.patch b/gnu/packages/patches/preseq-1.0.2-install-to-PREFIX.patch
deleted file mode 100644
index f8318ae0f5..0000000000
--- a/gnu/packages/patches/preseq-1.0.2-install-to-PREFIX.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-This patch has been submitted upstream: https://github.com/smithlabcode/preseq/pull/15
-
-From 65387b0d766e6c06a15cf8d8f9183d9a4ba644bb Mon Sep 17 00:00:00 2001
-From: Ricardo Wurmus <ricardo.wurmus@mdc-berlin.de>
-Date: Thu, 25 Jun 2015 15:01:53 +0200
-Subject: [PATCH] Install to PREFIX
-
----
- Makefile | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/Makefile b/Makefile
-index 4d0367a..e334f2f 100644
---- a/preseq-master/Makefile
-+++ b/preseq-master/Makefile
-@@ -22,6 +22,10 @@ ifndef ROOT
- ROOT = $(shell pwd)
- endif
- 
-+ifndef PREFIX
-+PREFIX = $(ROOT)
-+endif
-+
- ifndef SMITHLAB_CPP
- SMITHLAB_CPP=$(ROOT)/smithlab_cpp/
- endif
-@@ -91,8 +95,8 @@ endif
- 	$(CXX) $(CXXFLAGS) -o $@ $^ $(INCLUDEARGS) $(LIBS)
- 
- install: $(PROGS)
--	@mkdir -p $(ROOT)/bin
--	@install -m 755 $(PROGS) $(ROOT)/bin
-+	@mkdir -p $(PREFIX)/bin
-+	@install -m 755 $(PROGS) $(PREFIX)/bin
- 
- clean:
- 	@-rm -f $(PROGS) *.o *~
diff --git a/gnu/packages/patches/preseq-1.0.2-link-with-libbam.patch b/gnu/packages/patches/preseq-1.0.2-link-with-libbam.patch
deleted file mode 100644
index 035a3b1fe4..0000000000
--- a/gnu/packages/patches/preseq-1.0.2-link-with-libbam.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-This patch has been submitted upstream: https://github.com/smithlabcode/preseq/pull/15
-
-From a937a54d56e8a6ff06237471e568154d1fa5f267 Mon Sep 17 00:00:00 2001
-From: Ricardo Wurmus <ricardo.wurmus@mdc-berlin.de>
-Date: Thu, 25 Jun 2015 15:02:35 +0200
-Subject: [PATCH] Link with libbam.a if provided via LIBBAM
-
----
- Makefile | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/Makefile b/Makefile
-index e334f2f..de310e4 100644
---- a/preseq-master/Makefile
-+++ b/preseq-master/Makefile
-@@ -83,10 +83,17 @@ $(PROGS): $(addprefix $(SMITHLAB_CPP)/, \
- preseq: continued_fraction.o load_data_for_complexity.o moment_sequence.o
- 
- ifdef SAMTOOLS_DIR
-+ifdef LIBBAM
-+LIBS += -pthread
-+bam2mr preseq: $(addprefix $(SMITHLAB_CPP)/, SAM.o) \
-+        $(LIBBAM)
-+else
- bam2mr preseq: $(addprefix $(SMITHLAB_CPP)/, SAM.o) \
-         $(addprefix $(SAMTOOLS_DIR)/, sam.o bam.o bam_import.o bam_pileup.o \
-         faidx.o bam_aux.o kstring.o knetfile.o sam_header.o razf.o bgzf.o)
- endif
-+endif # SAMTOOLS_DIR
-+
- 
- %.o: %.cpp %.hpp
- 	$(CXX) $(CXXFLAGS) -c -o $@ $< $(INCLUDEARGS)
diff --git a/gnu/packages/patches/python-2-deterministic-build-info.patch b/gnu/packages/patches/python-2-deterministic-build-info.patch
new file mode 100644
index 0000000000..25a079fe90
--- /dev/null
+++ b/gnu/packages/patches/python-2-deterministic-build-info.patch
@@ -0,0 +1,17 @@
+Always provide the same date and time in 'Py_GetBuildInfo'.
+This is the information shown at the REPL and in 'sys.version'.
+We cannot pass it in CPPFLAGS due to whitespace in the DATE string.
+
+--- a/Modules/getbuildinfo.c
++++ b/Modules/getbuildinfo.c
+@@ -4,6 +4,10 @@
+ #include <stdio.h>
+ #endif
+ 
++/* Deterministic date and time.  */
++#define DATE "Jan  1 1970"
++#define TIME "00:00:01"
++
+ #ifndef DATE
+ #ifdef __DATE__
+ #define DATE __DATE__
diff --git a/gnu/packages/patches/python-2.7-source-date-epoch.patch b/gnu/packages/patches/python-2.7-source-date-epoch.patch
new file mode 100644
index 0000000000..be1f8e010e
--- /dev/null
+++ b/gnu/packages/patches/python-2.7-source-date-epoch.patch
@@ -0,0 +1,33 @@
+Honor the 'SOURCE_DATE_EPOCH' environment variable to allow for
+determinitic builds.
+
+--- a/Lib/py_compile.py
++++ b/Lib/py_compile.py
+@@ -105,7 +105,10 @@ def compile(file, cfile=None, dfile=None, doraise=False):
+     """
+     with open(file, 'U') as f:
+         try:
+-            timestamp = long(os.fstat(f.fileno()).st_mtime)
++            if 'SOURCE_DATE_EPOCH' in os.environ:
++                timestamp = long(os.environ['SOURCE_DATE_EPOCH'])
++            else:
++                timestamp = long(os.fstat(f.fileno()).st_mtime)
+         except AttributeError:
+             timestamp = long(os.stat(file).st_mtime)
+         codestring = f.read()
+diff --git a/Python/import.c b/Python/import.c
+index e47ce63..7eecf9c 100644
+--- a/Python/import.c
++++ b/Python/import.c
+@@ -945,6 +945,11 @@ write_compiled_module(PyCodeObject *co, char *cpathname, struct stat *srcstat, t
+     /* Now write the true mtime (as a 32-bit field) */
+     fseek(fp, 4L, 0);
+     assert(mtime <= 0xFFFFFFFF);
++    if (Py_GETENV("SOURCE_DATE_EPOCH") != NULL) {
++	const char *epoch = Py_GETENV("SOURCE_DATE_EPOCH");
++	mtime = atoi(epoch);
++    }
++
+     PyMarshal_WriteLongToFile((long)mtime, fp, Py_MARSHAL_VERSION);
+     fflush(fp);
+     fclose(fp);
diff --git a/gnu/packages/patches/python-3-deterministic-build-info.patch b/gnu/packages/patches/python-3-deterministic-build-info.patch
new file mode 100644
index 0000000000..22c372a0cf
--- /dev/null
+++ b/gnu/packages/patches/python-3-deterministic-build-info.patch
@@ -0,0 +1,17 @@
+Always provide the same date and time in 'Py_GetBuildInfo'.
+This is the information shown at the REPL and in 'sys.version'.
+We cannot pass it in CPPFLAGS due to whitespace in the DATE string.
+
+--- Modules/getbuildinfo.c
++++ Modules/getbuildinfo.c
+@@ -4,6 +4,10 @@
+ #include <stdio.h>
+ #endif
+ 
++/* Deterministic date and time.  */
++#define DATE "Jan  1 1970"
++#define TIME "00:00:01"
++
+ #ifndef DATE
+ #ifdef __DATE__
+ #define DATE __DATE__
diff --git a/gnu/packages/patches/python-configobj-setuptools.patch b/gnu/packages/patches/python-configobj-setuptools.patch
new file mode 100644
index 0000000000..3f207ffd74
--- /dev/null
+++ b/gnu/packages/patches/python-configobj-setuptools.patch
@@ -0,0 +1,30 @@
+From 16fbc38f13e435b4e3e1a37d706e64e05bad4691 Mon Sep 17 00:00:00 2001
+From: Leo Famulari <leo@famulari.name>
+Date: Tue, 10 Nov 2015 23:09:24 -0500
+Subject: [PATCH] patch build to use setuptools
+
+---
+ setup.py | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/setup.py b/setup.py
+index c6d57a6..27bf260 100644
+--- a/setup.py
++++ b/setup.py
+@@ -12,7 +12,12 @@
+ # http://opensource.org/licenses/BSD-3-Clause
+ import os
+ import sys
+-from distutils.core import setup
++
++try:
++    from setuptools import setup
++except ImportError:
++    from distutils.core import setup
++
+ # a simple import wouldn't work if we moved towards a package with __init__
+ from _version import __version__
+ 
+-- 
+2.6.2
+
diff --git a/gnu/packages/patches/scribus-qobject.patch b/gnu/packages/patches/scribus-qobject.patch
new file mode 100644
index 0000000000..91be932f1b
--- /dev/null
+++ b/gnu/packages/patches/scribus-qobject.patch
@@ -0,0 +1,17 @@
+See upstream bug report: http://bugs.scribus.net/view.php?id=13102
+
+scribus/sclayer.cpp | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/scribus/sclayer.cpp b/scribus/sclayer.cpp
+index 502112b..4da7bd5 100644
+--- a/scribus/sclayer.cpp
++++ b/scribus/sclayer.cpp
+@@ -9,6 +9,7 @@ for which a new license (GPL+exception) is in place.
+ 

+ #include <QHash>   //necessary to avoid msvc warnings induced by SCRIBUS_API on ScLayers + early instanciation of templates

+ #include <QVector> //necessary to avoid msvc warnings induced by SCRIBUS_API on ScLayers + early instanciation of templates

++#include <QObject>

+ #include <QtAlgorithms>

+ 

+ ScLayer::ScLayer(void)

diff --git a/gnu/packages/patches/synfig-build-fix.patch b/gnu/packages/patches/synfig-build-fix.patch
new file mode 100644
index 0000000000..3f6168e0fb
--- /dev/null
+++ b/gnu/packages/patches/synfig-build-fix.patch
@@ -0,0 +1,61 @@
+Allow Synfig to build in C++11 mode.
+
+Taken from here:
+https://projects.archlinux.org/svntogit/community.git/plain/trunk/build-fix.patch?h=packages/synfig
+
+diff -wbBur synfig-1.0-RC5/src/modules/mod_libavcodec/mptr.cpp synfig-1.0-RC5.my/src/modules/mod_libavcodec/mptr.cpp
+--- synfig-1.0-RC5/src/modules/mod_libavcodec/mptr.cpp	2015-03-28 13:15:00.000000000 +0300
++++ synfig-1.0-RC5.my/src/modules/mod_libavcodec/mptr.cpp	2015-04-28 16:56:11.568749053 +0300
+@@ -56,8 +56,8 @@
+ /* === M E T H O D S ======================================================= */
+ 
+ 
+-Importer_LibAVCodec::Importer_LibAVCodec(const char *file):
+-	filename(file)
++Importer_LibAVCodec::Importer_LibAVCodec(const synfig::FileSystem::Identifier &identifier):
++	Importer(identifier)
+ {
+ }
+ 
+diff -wbBur synfig-1.0-RC5/src/modules/mod_libavcodec/mptr.h synfig-1.0-RC5.my/src/modules/mod_libavcodec/mptr.h
+--- synfig-1.0-RC5/src/modules/mod_libavcodec/mptr.h	2015-03-28 13:15:00.000000000 +0300
++++ synfig-1.0-RC5.my/src/modules/mod_libavcodec/mptr.h	2015-04-28 16:55:18.699192946 +0300
+@@ -46,7 +46,7 @@
+ 	synfig::String filename;
+ 
+ public:
+-	Importer_LibAVCodec(const char *filename);
++	Importer_LibAVCodec(const synfig::FileSystem::Identifier &identifier);
+ 	~Importer_LibAVCodec();
+ 
+ 	virtual bool get_frame(synfig::Surface &surface, const synfig::RendDesc &renddesc, synfig::Time time, synfig::ProgressCallback *callback);
+diff -wbBur synfig-1.0-RC5/src/modules/mod_libavcodec/trgt_av.cpp synfig-1.0-RC5.my/src/modules/mod_libavcodec/trgt_av.cpp
+--- synfig-1.0-RC5/src/modules/mod_libavcodec/trgt_av.cpp	2015-03-28 13:15:00.000000000 +0300
++++ synfig-1.0-RC5.my/src/modules/mod_libavcodec/trgt_av.cpp	2015-04-28 16:46:54.720091106 +0300
+@@ -121,14 +121,14 @@
+     picture = avcodec_alloc_frame();
+     if (!picture)
+         return NULL;
+-    size = avpicture_get_size(pix_fmt, width, height);
++    size = avpicture_get_size((::PixelFormat)pix_fmt, width, height);
+     picture_buf = (uint8_t *)malloc(size);
+     if (!picture_buf) {
+         av_free(picture);
+         return NULL;
+     }
+     avpicture_fill((AVPicture *)picture, picture_buf,
+-                   pix_fmt, width, height);
++                   (::PixelFormat)pix_fmt, width, height);
+     return picture;
+ }
+ 
+diff -wbBur synfig-1.0.2/src/synfig/time.cpp synfig-1.0.2.my/src/synfig/time.cpp
+--- synfig-1.0.2/src/synfig/time.cpp	2015-07-09 10:33:03.000000000 +0300
++++ synfig-1.0.2.my/src/synfig/time.cpp	2015-10-12 13:54:58.382313903 +0300
+@@ -319,5 +319,5 @@
+ bool
+ Time::is_valid()const
+ {
+-	return !isnan(value_);
++	return !::isnan(value_);
+ }
diff --git a/gnu/packages/patches/tcl-mkindex-deterministic.patch b/gnu/packages/patches/tcl-mkindex-deterministic.patch
new file mode 100644
index 0000000000..2fcef6a4f7
--- /dev/null
+++ b/gnu/packages/patches/tcl-mkindex-deterministic.patch
@@ -0,0 +1,29 @@
+This patch ensures that the 'tclIndex' files generated by 'auto_mkindex'
+are sorted in a deterministic fashion.
+
+Fixes a non-determinism issue reported
+at <https://lists.gnu.org/archive/html/guix-devel/2015-10/msg00696.html>.
+
+--- tcl8.6.4/library/auto.tcl	2015-02-26 17:57:28.000000000 +0100
++++ tcl8.6.4/library/auto.tcl	2015-11-13 23:18:34.964831717 +0100
+@@ -207,6 +207,9 @@ proc auto_mkindex {dir args} {
+ 	set args *.tcl
+     }
+ 
++    # Keep file names sorted in a determistic order.
++    set args [lsort -ascii $args]
++
+     auto_mkindex_parser::init
+     foreach file [glob -- {*}$args] {
+ 	try {
+@@ -241,6 +244,10 @@ proc auto_mkindex_old {dir args} {
+     if {![llength $args]} {
+ 	set args *.tcl
+     }
++
++    # Keep file names sorted in a determistic order.
++    set args [lsort -ascii $args]
++
+     foreach file [glob -- {*}$args] {
+ 	set f ""
+ 	set error [catch {
diff --git a/gnu/packages/patches/tinyxml-use-stl.patch b/gnu/packages/patches/tinyxml-use-stl.patch
new file mode 100644
index 0000000000..5d8aa899a9
--- /dev/null
+++ b/gnu/packages/patches/tinyxml-use-stl.patch
@@ -0,0 +1,41 @@
+From a53b6ee4519a7657164610ac14a82c57b1273bf6 Mon Sep 17 00:00:00 2001
+From: David Thompson <dthompson2@worcester.edu>
+Date: Mon, 23 Nov 2015 06:54:36 -0500
+Subject: [PATCH] Use STL.
+
+Software that uses the shared library, such as Kodi, assume that TinyXML was
+compiled with STL activated.
+
+---
+ tinyxml.h   | 2 ++
+ xmltest.cpp | 1 +
+ 2 files changed, 3 insertions(+)
+
+diff --git a/tinyxml.h b/tinyxml.h
+index a3589e5..6cbfc7d 100644
+--- a/tinyxml.h
++++ b/tinyxml.h
+@@ -43,6 +43,8 @@ distribution.
+ #define DEBUG
+ #endif
+ 
++#define TIXML_USE_STL 1
++
+ #ifdef TIXML_USE_STL
+ 	#include <string>
+  	#include <iostream>
+diff --git a/xmltest.cpp b/xmltest.cpp
+index 663c157..057dbfe 100644
+--- a/xmltest.cpp
++++ b/xmltest.cpp
+@@ -2,6 +2,7 @@
+    Test program for TinyXML.
+ */
+ 
++#define TIXML_USE_STL 1
+ 
+ #ifdef TIXML_USE_STL
+ 	#include <iostream>
+-- 
+2.5.0
+
diff --git a/gnu/packages/patches/tk-find-library.patch b/gnu/packages/patches/tk-find-library.patch
new file mode 100644
index 0000000000..70911bf0d2
--- /dev/null
+++ b/gnu/packages/patches/tk-find-library.patch
@@ -0,0 +1,29 @@
+This patch hard-codes the Tk library directory during package initialization.
+
+See <http://core.tcl.tk/tk/tktview/765642ffffffffffffff>.
+
+diff --git a/generic/tkWindow.c b/generic/tkWindow.c
+index b5cbbab..96b5501 100644
+--- a/generic/tkWindow.c
++++ b/generic/tkWindow.c
+@@ -988,6 +988,7 @@ TkCreateMainWindow(
+ 
+     Tcl_SetVar2(interp, "tk_patchLevel", NULL, TK_PATCH_LEVEL, TCL_GLOBAL_ONLY);
+     Tcl_SetVar2(interp, "tk_version",    NULL, TK_VERSION,     TCL_GLOBAL_ONLY);
++    Tcl_SetVar2(interp, "tk_library",    NULL, TK_LIBRARY,     TCL_GLOBAL_ONLY);
+ 
+     tsdPtr->numMainWindows++;
+     return tkwin;
+diff --git a/unix/Makefile.in b/unix/Makefile.in
+index f21fdbb..c61b0df 100644
+--- a/unix/Makefile.in
++++ b/unix/Makefile.in
+@@ -1029,7 +1029,7 @@ tkVisual.o: $(GENERIC_DIR)/tkVisual.c
+ 	$(CC) -c $(CC_SWITCHES) $(GENERIC_DIR)/tkVisual.c
+ 
+ tkWindow.o: $(GENERIC_DIR)/tkWindow.c
+-	$(CC) -c $(CC_SWITCHES) $(GENERIC_DIR)/tkWindow.c
++	$(CC) -c $(CC_SWITCHES) -DTK_LIBRARY=\"${TK_LIBRARY}\" $(GENERIC_DIR)/tkWindow.c
+ 
+ tkButton.o: $(GENERIC_DIR)/tkButton.c
+ 	$(CC) -c $(CC_SWITCHES) $(GENERIC_DIR)/tkButton.c
diff --git a/gnu/packages/patches/torsocks-dns-test.patch b/gnu/packages/patches/torsocks-dns-test.patch
new file mode 100644
index 0000000000..ba70ba5933
--- /dev/null
+++ b/gnu/packages/patches/torsocks-dns-test.patch
@@ -0,0 +1,18 @@
+Skip DNS tests that rely on the ability to look up arbitary
+host names.
+
+--- torsocks/tests/test_dns.c	2015-11-10 18:30:53.955941984 +0100
++++ torsocks/tests/test_dns.c	2015-11-10 18:31:02.199941892 +0100
+@@ -134,11 +134,8 @@ static void test_getaddrinfo(const struc
+ int main(int argc, char **argv)
+ {
+ 	/* Libtap call for the number of tests planned. */
+-	plan_tests(NUM_TESTS);
++	plan_tests(1);
+ 
+-	test_getaddrinfo(&tor_check);
+-    test_gethostbyname(&tor_dir_auth1);
+-	test_gethostbyaddr(&tor_dir_auth2);
+ 	test_getaddrinfo(&tor_localhost);
+ 
+     return 0;
diff --git a/gnu/packages/patches/weechat-python.patch b/gnu/packages/patches/weechat-python.patch
new file mode 100644
index 0000000000..8182636ecb
--- /dev/null
+++ b/gnu/packages/patches/weechat-python.patch
@@ -0,0 +1,40 @@
+Get Python LDFLAGS from 'pkg-config'.
+
+The other approach is more complex and gets it wrong: it returns
+"-L/path/to/python/lib/python-2.7.10/lib/python2.7/config -lpython -lwhatever";
+since that config/ sub-directory contains libpython2.7.a, we end up
+statically linking Python in Weechat's python.so, which we do not want.
+
+--- weechat-1.3/configure.ac	2015-08-16 08:27:07.000000000 +0200
++++ weechat-1.3/configure.ac	2015-11-29 18:18:52.975197048 +0100
+@@ -535,29 +535,7 @@ if test "x$enable_python" = "xyes" ; the
+             if test -r "$PYTHON_INCLUDE/Python.h"; then
+                 PYTHON_CFLAGS="-I$PYTHON_INCLUDE"
+                 AC_MSG_RESULT(found)
+-                PYTHON_LIB=`$PYTHON -c "import sys, distutils.sysconfig; sys.stdout.write(distutils.sysconfig.get_config_var('LIBPL'))"`
+-                PYTHON_LFLAGS="-lpython$PYTHON_VERSION "`$PYTHON -c "import sys, distutils.sysconfig; sys.stdout.write(distutils.sysconfig.get_config_var('LIBS')+' '+distutils.sysconfig.get_config_var('SYSLIBS')+' '+distutils.sysconfig.get_config_var('LINKFORSHARED'))"`
+-                AC_MSG_CHECKING(for Python library)
+-                if test -r "$PYTHON_LIB/libpython$PYTHON_VERSION.so"; then
+-                   PYTHON_LFLAGS="-L$PYTHON_LIB $PYTHON_LFLAGS"
+-                   AC_MSG_RESULT(found)
+-                elif test -r "$PYTHON_LIB/libpython$PYTHON_VERSION.a"; then
+-                   PYTHON_LFLAGS="-L$PYTHON_LIB $PYTHON_LFLAGS"
+-                   AC_MSG_RESULT(found)
+-                elif test -r "$PYTHON_LIB/libpython$PYTHON_VERSION.dll.a"; then
+-                   PYTHON_LFLAGS="-L$PYTHON_LIB $PYTHON_LFLAGS"
+-                   AC_MSG_RESULT(found)
+-                elif test -r "$PYTHON_SYSPREFIX/lib/libpython$PYTHON_VERSION.so"; then
+-                   PYTHON_LFLAGS="-L$PYTHON_SYSPREFIX/lib/ $PYTHON_LFLAGS"
+-                   AC_MSG_RESULT(found)
+-                else
+-                    AC_MSG_WARN([
+-*** Python library couldn't be found on your system.
+-*** Try to install it with your software package manager.
+-*** WeeChat will be built without Python support.])
+-                    enable_python="no"
+-                    not_found="$not_found python"
+-                fi
++                PYTHON_LFLAGS=`pkg-config python2 --libs`
+             else
+                 AC_MSG_WARN([
+ *** Python header files couldn't be found on your system.
diff --git a/gnu/packages/patches/wpa-supplicant-CVE-2015-5310.patch b/gnu/packages/patches/wpa-supplicant-CVE-2015-5310.patch
new file mode 100644
index 0000000000..00e5b7c771
--- /dev/null
+++ b/gnu/packages/patches/wpa-supplicant-CVE-2015-5310.patch
@@ -0,0 +1,32 @@
+From 6b12d93d2c7428a34bfd4b3813ba339ed57b698a Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Sun, 25 Oct 2015 15:45:50 +0200
+Subject: [PATCH] WNM: Ignore Key Data in WNM Sleep Mode Response frame if no
+ PMF in use
+
+WNM Sleep Mode Response frame is used to update GTK/IGTK only if PMF is
+enabled. Verify that PMF is in use before using this field on station
+side to avoid accepting unauthenticated key updates. (CVE-2015-5310)
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+ wpa_supplicant/wnm_sta.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
+index 954de67..7d79499 100644
+--- a/wpa_supplicant/wnm_sta.c
++++ b/wpa_supplicant/wnm_sta.c
+@@ -187,6 +187,12 @@ static void wnm_sleep_mode_exit_success(struct wpa_supplicant *wpa_s,
+ 	end = ptr + key_len_total;
+ 	wpa_hexdump_key(MSG_DEBUG, "WNM: Key Data", ptr, key_len_total);
+ 
++	if (key_len_total && !wpa_sm_pmf_enabled(wpa_s->wpa)) {
++		wpa_msg(wpa_s, MSG_INFO,
++			"WNM: Ignore Key Data in WNM-Sleep Mode Response - PMF not enabled");
++		return;
++	}
++
+ 	while (ptr + 1 < end) {
+ 		if (ptr + 2 + ptr[1] > end) {
+ 			wpa_printf(MSG_DEBUG, "WNM: Invalid Key Data element "
diff --git a/gnu/packages/patches/wpa-supplicant-CVE-2015-5314.patch b/gnu/packages/patches/wpa-supplicant-CVE-2015-5314.patch
new file mode 100644
index 0000000000..bfc4c74e95
--- /dev/null
+++ b/gnu/packages/patches/wpa-supplicant-CVE-2015-5314.patch
@@ -0,0 +1,51 @@
+From bef802ece03f9ae9d52a21f0cf4f1bc2c5a1f8aa Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Sun, 1 Nov 2015 18:24:16 +0200
+Subject: [PATCH] EAP-pwd server: Fix last fragment length validation
+
+All but the last fragment had their length checked against the remaining
+room in the reassembly buffer. This allowed a suitably constructed last
+fragment frame to try to add extra data that would go beyond the buffer.
+The length validation code in wpabuf_put_data() prevents an actual
+buffer write overflow from occurring, but this results in process
+termination. (CVE-2015-5314)
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+ src/eap_server/eap_server_pwd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/eap_server/eap_server_pwd.c b/src/eap_server/eap_server_pwd.c
+index cb83ff7..9f787ab 100644
+--- a/src/eap_server/eap_server_pwd.c
++++ b/src/eap_server/eap_server_pwd.c
+@@ -970,7 +970,7 @@ static void eap_pwd_process(struct eap_sm *sm, void *priv,
+ 	/*
+ 	 * the first and all intermediate fragments have the M bit set
+ 	 */
+-	if (EAP_PWD_GET_MORE_BIT(lm_exch)) {
++	if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) {
+ 		if ((data->in_frag_pos + len) > wpabuf_size(data->inbuf)) {
+ 			wpa_printf(MSG_DEBUG, "EAP-pwd: Buffer overflow "
+ 				   "attack detected! (%d+%d > %d)",
+@@ -981,6 +981,8 @@ static void eap_pwd_process(struct eap_sm *sm, void *priv,
+ 		}
+ 		wpabuf_put_data(data->inbuf, pos, len);
+ 		data->in_frag_pos += len;
++	}
++	if (EAP_PWD_GET_MORE_BIT(lm_exch)) {
+ 		wpa_printf(MSG_DEBUG, "EAP-pwd: Got a %d byte fragment",
+ 			   (int) len);
+ 		return;
+@@ -990,8 +992,6 @@ static void eap_pwd_process(struct eap_sm *sm, void *priv,
+ 	 * buffering fragments so that's how we know it's the last)
+ 	 */
+ 	if (data->in_frag_pos) {
+-		wpabuf_put_data(data->inbuf, pos, len);
+-		data->in_frag_pos += len;
+ 		pos = wpabuf_head_u8(data->inbuf);
+ 		len = data->in_frag_pos;
+ 		wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes",
+-- 
+1.9.1
+
diff --git a/gnu/packages/patches/wpa-supplicant-CVE-2015-5315.patch b/gnu/packages/patches/wpa-supplicant-CVE-2015-5315.patch
new file mode 100644
index 0000000000..82c26398b6
--- /dev/null
+++ b/gnu/packages/patches/wpa-supplicant-CVE-2015-5315.patch
@@ -0,0 +1,54 @@
+From 8057821706784608b828e769ccefbced95591e50 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Sun, 1 Nov 2015 18:18:17 +0200
+Subject: [PATCH] EAP-pwd peer: Fix last fragment length validation
+
+All but the last fragment had their length checked against the remaining
+room in the reassembly buffer. This allowed a suitably constructed last
+fragment frame to try to add extra data that would go beyond the buffer.
+The length validation code in wpabuf_put_data() prevents an actual
+buffer write overflow from occurring, but this results in process
+termination. (CVE-2015-5315)
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+ src/eap_peer/eap_pwd.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c
+index 1f78544..75ceef1 100644
+--- a/src/eap_peer/eap_pwd.c
++++ b/src/eap_peer/eap_pwd.c
+@@ -903,7 +903,7 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret,
+ 	/*
+ 	 * buffer and ACK the fragment
+ 	 */
+-	if (EAP_PWD_GET_MORE_BIT(lm_exch)) {
++	if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) {
+ 		data->in_frag_pos += len;
+ 		if (data->in_frag_pos > wpabuf_size(data->inbuf)) {
+ 			wpa_printf(MSG_INFO, "EAP-pwd: Buffer overflow attack "
+@@ -916,7 +916,8 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret,
+ 			return NULL;
+ 		}
+ 		wpabuf_put_data(data->inbuf, pos, len);
+-
++	}
++	if (EAP_PWD_GET_MORE_BIT(lm_exch)) {
+ 		resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
+ 				     EAP_PWD_HDR_SIZE,
+ 				     EAP_CODE_RESPONSE, eap_get_id(reqData));
+@@ -930,10 +931,8 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret,
+ 	 * we're buffering and this is the last fragment
+ 	 */
+ 	if (data->in_frag_pos) {
+-		wpabuf_put_data(data->inbuf, pos, len);
+ 		wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes",
+ 			   (int) len);
+-		data->in_frag_pos += len;
+ 		pos = wpabuf_head_u8(data->inbuf);
+ 		len = data->in_frag_pos;
+ 	}
+-- 
+1.9.1
+
diff --git a/gnu/packages/patches/wpa-supplicant-CVE-2015-5316.patch b/gnu/packages/patches/wpa-supplicant-CVE-2015-5316.patch
new file mode 100644
index 0000000000..3088f6a6dc
--- /dev/null
+++ b/gnu/packages/patches/wpa-supplicant-CVE-2015-5316.patch
@@ -0,0 +1,34 @@
+From 95577884ca4fa76be91344ff7a8d5d1e6dc3da61 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Sun, 1 Nov 2015 19:35:44 +0200
+Subject: [PATCH] EAP-pwd peer: Fix error path for unexpected Confirm message
+
+If the Confirm message is received from the server before the Identity
+exchange has been completed, the group has not yet been determined and
+data->grp is NULL. The error path in eap_pwd_perform_confirm_exchange()
+did not take this corner case into account and could end up
+dereferencing a NULL pointer and terminating the process if invalid
+message sequence is received. (CVE-2015-5316)
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+ src/eap_peer/eap_pwd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c
+index 75ceef1..892b590 100644
+--- a/src/eap_peer/eap_pwd.c
++++ b/src/eap_peer/eap_pwd.c
+@@ -774,7 +774,8 @@ eap_pwd_perform_confirm_exchange(struct eap_sm *sm, struct eap_pwd_data *data,
+ 	wpabuf_put_data(data->outbuf, conf, SHA256_MAC_LEN);
+ 
+ fin:
+-	bin_clear_free(cruft, BN_num_bytes(data->grp->prime));
++	if (data->grp)
++		bin_clear_free(cruft, BN_num_bytes(data->grp->prime));
+ 	BN_clear_free(x);
+ 	BN_clear_free(y);
+ 	if (data->outbuf == NULL) {
+-- 
+1.9.1
+
diff --git a/gnu/packages/patches/xfce4-session-fix-xflock4.patch b/gnu/packages/patches/xfce4-session-fix-xflock4.patch
new file mode 100644
index 0000000000..74769e4257
--- /dev/null
+++ b/gnu/packages/patches/xfce4-session-fix-xflock4.patch
@@ -0,0 +1,31 @@
+From cbb9c769316b4d32956a2c78aa01a38b473f0cfc Mon Sep 17 00:00:00 2001
+From: David Thompson <dthompson2@worcester.edu>
+Date: Fri, 30 Oct 2015 08:30:43 -0400
+Subject: [PATCH] xflock4: Do not override PATH with hardcoded value.
+
+The PATH "/bin:/usr/bin" may not be a valid search path on the user's
+machine.  The screen locking program may be in /usr/local/bin or
+elsewhere.  Distros that do not conform to the FHS, such as GuixSD and
+NixOS, will not have their executables in either location.  Thus, we
+simply leave PATH alone.
+---
+ scripts/xflock4 | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/scripts/xflock4 b/scripts/xflock4
+index ec4d05d..e7981ac 100644
+--- a/scripts/xflock4
++++ b/scripts/xflock4
+@@ -21,9 +21,6 @@
+ #  Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ #
+ 
+-PATH=/bin:/usr/bin
+-export PATH
+-
+ # Lock by xscreensaver or gnome-screensaver, if a respective daemon is running
+ for lock_cmd in \
+     "xscreensaver-command -lock" \
+-- 
+2.5.0
+